From: Sasha Levin Date: Wed, 18 Jan 2023 20:22:16 +0000 (-0500) Subject: Fixes for 6.1 X-Git-Tag: v4.14.304~62 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=629275e354e227486ee1053d4e52bb2eecaa3358;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/bpf-keep-a-reference-to-the-mm-in-case-the-task-is-d.patch b/queue-6.1/bpf-keep-a-reference-to-the-mm-in-case-the-task-is-d.patch new file mode 100644 index 00000000000..891fba84b73 --- /dev/null +++ b/queue-6.1/bpf-keep-a-reference-to-the-mm-in-case-the-task-is-d.patch @@ -0,0 +1,168 @@ +From 80826867f0a12dd309b0dfb77828a5fd8a91cb3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Dec 2022 14:18:54 -0800 +Subject: bpf: keep a reference to the mm, in case the task is dead. + +From: Kui-Feng Lee + +[ Upstream commit 7ff94f276f8ea05df82eb115225e9b26f47a3347 ] + +Fix the system crash that happens when a task iterator travel through +vma of tasks. + +In task iterators, we used to access mm by following the pointer on +the task_struct; however, the death of a task will clear the pointer, +even though we still hold the task_struct. That can cause an +unexpected crash for a null pointer when an iterator is visiting a +task that dies during the visit. Keeping a reference of mm on the +iterator ensures we always have a valid pointer to mm. + +Co-developed-by: Song Liu +Signed-off-by: Song Liu +Signed-off-by: Kui-Feng Lee +Reported-by: Nathan Slingerland +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/20221216221855.4122288-2-kuifeng@meta.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/task_iter.c | 39 +++++++++++++++++++++++++++------------ + 1 file changed, 27 insertions(+), 12 deletions(-) + +diff --git a/kernel/bpf/task_iter.c b/kernel/bpf/task_iter.c +index c2a2182ce570..c4ab9d6cdbe9 100644 +--- a/kernel/bpf/task_iter.c ++++ b/kernel/bpf/task_iter.c +@@ -438,6 +438,7 @@ struct bpf_iter_seq_task_vma_info { + */ + struct bpf_iter_seq_task_common common; + struct task_struct *task; ++ struct mm_struct *mm; + struct vm_area_struct *vma; + u32 tid; + unsigned long prev_vm_start; +@@ -456,16 +457,19 @@ task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info) + enum bpf_task_vma_iter_find_op op; + struct vm_area_struct *curr_vma; + struct task_struct *curr_task; ++ struct mm_struct *curr_mm; + u32 saved_tid = info->tid; + + /* If this function returns a non-NULL vma, it holds a reference to +- * the task_struct, and holds read lock on vma->mm->mmap_lock. ++ * the task_struct, holds a refcount on mm->mm_users, and holds ++ * read lock on vma->mm->mmap_lock. + * If this function returns NULL, it does not hold any reference or + * lock. + */ + if (info->task) { + curr_task = info->task; + curr_vma = info->vma; ++ curr_mm = info->mm; + /* In case of lock contention, drop mmap_lock to unblock + * the writer. + * +@@ -504,13 +508,15 @@ task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info) + * 4.2) VMA2 and VMA2' covers different ranges, process + * VMA2'. + */ +- if (mmap_lock_is_contended(curr_task->mm)) { ++ if (mmap_lock_is_contended(curr_mm)) { + info->prev_vm_start = curr_vma->vm_start; + info->prev_vm_end = curr_vma->vm_end; + op = task_vma_iter_find_vma; +- mmap_read_unlock(curr_task->mm); +- if (mmap_read_lock_killable(curr_task->mm)) ++ mmap_read_unlock(curr_mm); ++ if (mmap_read_lock_killable(curr_mm)) { ++ mmput(curr_mm); + goto finish; ++ } + } else { + op = task_vma_iter_next_vma; + } +@@ -535,42 +541,47 @@ task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info) + op = task_vma_iter_find_vma; + } + +- if (!curr_task->mm) ++ curr_mm = get_task_mm(curr_task); ++ if (!curr_mm) + goto next_task; + +- if (mmap_read_lock_killable(curr_task->mm)) ++ if (mmap_read_lock_killable(curr_mm)) { ++ mmput(curr_mm); + goto finish; ++ } + } + + switch (op) { + case task_vma_iter_first_vma: +- curr_vma = find_vma(curr_task->mm, 0); ++ curr_vma = find_vma(curr_mm, 0); + break; + case task_vma_iter_next_vma: +- curr_vma = find_vma(curr_task->mm, curr_vma->vm_end); ++ curr_vma = find_vma(curr_mm, curr_vma->vm_end); + break; + case task_vma_iter_find_vma: + /* We dropped mmap_lock so it is necessary to use find_vma + * to find the next vma. This is similar to the mechanism + * in show_smaps_rollup(). + */ +- curr_vma = find_vma(curr_task->mm, info->prev_vm_end - 1); ++ curr_vma = find_vma(curr_mm, info->prev_vm_end - 1); + /* case 1) and 4.2) above just use curr_vma */ + + /* check for case 2) or case 4.1) above */ + if (curr_vma && + curr_vma->vm_start == info->prev_vm_start && + curr_vma->vm_end == info->prev_vm_end) +- curr_vma = find_vma(curr_task->mm, curr_vma->vm_end); ++ curr_vma = find_vma(curr_mm, curr_vma->vm_end); + break; + } + if (!curr_vma) { + /* case 3) above, or case 2) 4.1) with vma->next == NULL */ +- mmap_read_unlock(curr_task->mm); ++ mmap_read_unlock(curr_mm); ++ mmput(curr_mm); + goto next_task; + } + info->task = curr_task; + info->vma = curr_vma; ++ info->mm = curr_mm; + return curr_vma; + + next_task: +@@ -579,6 +590,7 @@ task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info) + + put_task_struct(curr_task); + info->task = NULL; ++ info->mm = NULL; + info->tid++; + goto again; + +@@ -587,6 +599,7 @@ task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info) + put_task_struct(curr_task); + info->task = NULL; + info->vma = NULL; ++ info->mm = NULL; + return NULL; + } + +@@ -658,7 +671,9 @@ static void task_vma_seq_stop(struct seq_file *seq, void *v) + */ + info->prev_vm_start = ~0UL; + info->prev_vm_end = info->vma->vm_end; +- mmap_read_unlock(info->task->mm); ++ mmap_read_unlock(info->mm); ++ mmput(info->mm); ++ info->mm = NULL; + put_task_struct(info->task); + info->task = NULL; + } +-- +2.35.1 + diff --git a/queue-6.1/btrfs-always-report-error-in-run_one_delayed_ref.patch b/queue-6.1/btrfs-always-report-error-in-run_one_delayed_ref.patch new file mode 100644 index 00000000000..f039bcb22ac --- /dev/null +++ b/queue-6.1/btrfs-always-report-error-in-run_one_delayed_ref.patch @@ -0,0 +1,80 @@ +From ac03a244327e889fdceabf059448e453c6585ddb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Dec 2022 09:00:40 +0800 +Subject: btrfs: always report error in run_one_delayed_ref() + +From: Qu Wenruo + +[ Upstream commit 39f501d68ec1ed5cd5c66ac6ec2a7131c517bb92 ] + +Currently we have a btrfs_debug() for run_one_delayed_ref() failure, but +if end users hit such problem, there will be no chance that +btrfs_debug() is enabled. This can lead to very little useful info for +debugging. + +This patch will: + +- Add extra info for error reporting + Including: + * logical bytenr + * num_bytes + * type + * action + * ref_mod + +- Replace the btrfs_debug() with btrfs_err() + +- Move the error reporting into run_one_delayed_ref() + This is to avoid use-after-free, the @node can be freed in the caller. + +This error should only be triggered at most once. + +As if run_one_delayed_ref() failed, we trigger the error message, then +causing the call chain to error out: + +btrfs_run_delayed_refs() +`- btrfs_run_delayed_refs() + `- btrfs_run_delayed_refs_for_head() + `- run_one_delayed_ref() + +And we will abort the current transaction in btrfs_run_delayed_refs(). +If we have to run delayed refs for the abort transaction, +run_one_delayed_ref() will just cleanup the refs and do nothing, thus no +new error messages would be output. + +Reviewed-by: Anand Jain +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/extent-tree.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 2801c991814f..571fcc5ae4dc 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -1706,6 +1706,11 @@ static int run_one_delayed_ref(struct btrfs_trans_handle *trans, + BUG(); + if (ret && insert_reserved) + btrfs_pin_extent(trans, node->bytenr, node->num_bytes, 1); ++ if (ret < 0) ++ btrfs_err(trans->fs_info, ++"failed to run delayed ref for logical %llu num_bytes %llu type %u action %u ref_mod %d: %d", ++ node->bytenr, node->num_bytes, node->type, ++ node->action, node->ref_mod, ret); + return ret; + } + +@@ -1947,8 +1952,6 @@ static int btrfs_run_delayed_refs_for_head(struct btrfs_trans_handle *trans, + if (ret) { + unselect_delayed_ref_head(delayed_refs, locked_ref); + btrfs_put_delayed_ref(ref); +- btrfs_debug(fs_info, "run_one_delayed_ref returned %d", +- ret); + return ret; + } + +-- +2.35.1 + diff --git a/queue-6.1/btrfs-fix-trace-event-name-typo-for-flush_delayed_re.patch b/queue-6.1/btrfs-fix-trace-event-name-typo-for-flush_delayed_re.patch new file mode 100644 index 00000000000..85330c65558 --- /dev/null +++ b/queue-6.1/btrfs-fix-trace-event-name-typo-for-flush_delayed_re.patch @@ -0,0 +1,37 @@ +From 711dc0a456d2310d665e0aa952056afad88e7277 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Dec 2022 11:06:07 +0900 +Subject: btrfs: fix trace event name typo for FLUSH_DELAYED_REFS + +From: Naohiro Aota + +[ Upstream commit 0a3212de8ab3e2ce5808c6265855e528d4a6767b ] + +Fix a typo of printing FLUSH_DELAYED_REFS event in flush_space() as +FLUSH_ELAYED_REFS. + +Reviewed-by: Johannes Thumshirn +Signed-off-by: Naohiro Aota +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + include/trace/events/btrfs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h +index ed50e81174bf..5e10b5b1d16c 100644 +--- a/include/trace/events/btrfs.h ++++ b/include/trace/events/btrfs.h +@@ -98,7 +98,7 @@ struct raid56_bio_trace_info; + EM( FLUSH_DELALLOC_WAIT, "FLUSH_DELALLOC_WAIT") \ + EM( FLUSH_DELALLOC_FULL, "FLUSH_DELALLOC_FULL") \ + EM( FLUSH_DELAYED_REFS_NR, "FLUSH_DELAYED_REFS_NR") \ +- EM( FLUSH_DELAYED_REFS, "FLUSH_ELAYED_REFS") \ ++ EM( FLUSH_DELAYED_REFS, "FLUSH_DELAYED_REFS") \ + EM( ALLOC_CHUNK, "ALLOC_CHUNK") \ + EM( ALLOC_CHUNK_FORCE, "ALLOC_CHUNK_FORCE") \ + EM( RUN_DELAYED_IPUTS, "RUN_DELAYED_IPUTS") \ +-- +2.35.1 + diff --git a/queue-6.1/cifs-fix-race-in-assemble_neg_contexts.patch b/queue-6.1/cifs-fix-race-in-assemble_neg_contexts.patch new file mode 100644 index 00000000000..ebe3ead42fb --- /dev/null +++ b/queue-6.1/cifs-fix-race-in-assemble_neg_contexts.patch @@ -0,0 +1,62 @@ +From 9e515a6de7ac33b3a690f91be2849500c2c82a7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Dec 2022 12:33:56 -0300 +Subject: cifs: fix race in assemble_neg_contexts() + +From: Paulo Alcantara + +[ Upstream commit 775e44d6d86dca400d614cbda5dab4def4951fe7 ] + +Serialise access of TCP_Server_Info::hostname in +assemble_neg_contexts() by holding the server's mutex otherwise it +might end up accessing an already-freed hostname pointer from +cifs_reconnect() or cifs_resolve_server(). + +Signed-off-by: Paulo Alcantara (SUSE) +Reviewed-by: Enzo Matsumiya +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2pdu.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 4ac5b1bfaf78..727f16b426be 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -541,9 +541,10 @@ static void + assemble_neg_contexts(struct smb2_negotiate_req *req, + struct TCP_Server_Info *server, unsigned int *total_len) + { +- char *pneg_ctxt; +- char *hostname = NULL; + unsigned int ctxt_len, neg_context_count; ++ struct TCP_Server_Info *pserver; ++ char *pneg_ctxt; ++ char *hostname; + + if (*total_len > 200) { + /* In case length corrupted don't want to overrun smb buffer */ +@@ -574,8 +575,9 @@ assemble_neg_contexts(struct smb2_negotiate_req *req, + * secondary channels don't have the hostname field populated + * use the hostname field in the primary channel instead + */ +- hostname = CIFS_SERVER_IS_CHAN(server) ? +- server->primary_server->hostname : server->hostname; ++ pserver = CIFS_SERVER_IS_CHAN(server) ? server->primary_server : server; ++ cifs_server_lock(pserver); ++ hostname = pserver->hostname; + if (hostname && (hostname[0] != 0)) { + ctxt_len = build_netname_ctxt((struct smb2_netname_neg_context *)pneg_ctxt, + hostname); +@@ -584,6 +586,7 @@ assemble_neg_contexts(struct smb2_negotiate_req *req, + neg_context_count = 3; + } else + neg_context_count = 2; ++ cifs_server_unlock(pserver); + + build_posix_ctxt((struct smb2_posix_neg_context *)pneg_ctxt); + *total_len += sizeof(struct smb2_posix_neg_context); +-- +2.35.1 + diff --git a/queue-6.1/dma-buf-fix-dma_buf_export-init-order-v2.patch b/queue-6.1/dma-buf-fix-dma_buf_export-init-order-v2.patch new file mode 100644 index 00000000000..33b4cce26ad --- /dev/null +++ b/queue-6.1/dma-buf-fix-dma_buf_export-init-order-v2.patch @@ -0,0 +1,255 @@ +From ca4d1ac4d0f4e64f284cb8e26fb070c5abb61f5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Dec 2022 14:07:49 +0100 +Subject: dma-buf: fix dma_buf_export init order v2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +[ Upstream commit f728a5ea27c92133893590e731ce10f6561ced87 ] + +The init order and resulting error handling in dma_buf_export +was pretty messy. + +Subordinate objects like the file and the sysfs kernel objects +were initializing and wiring itself up with the object in the +wrong order resulting not only in complicating and partially +incorrect error handling, but also in publishing only halve +initialized DMA-buf objects. + +Clean this up thoughtfully by allocating the file independent +of the DMA-buf object. Then allocate and initialize the DMA-buf +object itself, before publishing it through sysfs. If everything +works as expected the file is then connected with the DMA-buf +object and publish it through debugfs. + +Also adds the missing dma_resv_fini() into the error handling. + +v2: add some missing changes to dma_bug_getfile() and a missing NULL + check in dma_buf_file_release() + +Signed-off-by: Christian König +Reviewed-by: Michael J. Ruhl +Reviewed-by: T.J. Mercier +Acked-by: Sumit Semwal +Link: https://patchwork.freedesktop.org/patch/msgid/20221209071535.933698-1-christian.koenig@amd.com +Signed-off-by: Sasha Levin +--- + drivers/dma-buf/dma-buf-sysfs-stats.c | 7 +-- + drivers/dma-buf/dma-buf-sysfs-stats.h | 4 +- + drivers/dma-buf/dma-buf.c | 84 +++++++++++++-------------- + 3 files changed, 43 insertions(+), 52 deletions(-) + +diff --git a/drivers/dma-buf/dma-buf-sysfs-stats.c b/drivers/dma-buf/dma-buf-sysfs-stats.c +index 2bba0babcb62..4b680e10c15a 100644 +--- a/drivers/dma-buf/dma-buf-sysfs-stats.c ++++ b/drivers/dma-buf/dma-buf-sysfs-stats.c +@@ -168,14 +168,11 @@ void dma_buf_uninit_sysfs_statistics(void) + kset_unregister(dma_buf_stats_kset); + } + +-int dma_buf_stats_setup(struct dma_buf *dmabuf) ++int dma_buf_stats_setup(struct dma_buf *dmabuf, struct file *file) + { + struct dma_buf_sysfs_entry *sysfs_entry; + int ret; + +- if (!dmabuf || !dmabuf->file) +- return -EINVAL; +- + if (!dmabuf->exp_name) { + pr_err("exporter name must not be empty if stats needed\n"); + return -EINVAL; +@@ -192,7 +189,7 @@ int dma_buf_stats_setup(struct dma_buf *dmabuf) + + /* create the directory for buffer stats */ + ret = kobject_init_and_add(&sysfs_entry->kobj, &dma_buf_ktype, NULL, +- "%lu", file_inode(dmabuf->file)->i_ino); ++ "%lu", file_inode(file)->i_ino); + if (ret) + goto err_sysfs_dmabuf; + +diff --git a/drivers/dma-buf/dma-buf-sysfs-stats.h b/drivers/dma-buf/dma-buf-sysfs-stats.h +index a49c6e2650cc..7a8a995b75ba 100644 +--- a/drivers/dma-buf/dma-buf-sysfs-stats.h ++++ b/drivers/dma-buf/dma-buf-sysfs-stats.h +@@ -13,7 +13,7 @@ + int dma_buf_init_sysfs_statistics(void); + void dma_buf_uninit_sysfs_statistics(void); + +-int dma_buf_stats_setup(struct dma_buf *dmabuf); ++int dma_buf_stats_setup(struct dma_buf *dmabuf, struct file *file); + + void dma_buf_stats_teardown(struct dma_buf *dmabuf); + #else +@@ -25,7 +25,7 @@ static inline int dma_buf_init_sysfs_statistics(void) + + static inline void dma_buf_uninit_sysfs_statistics(void) {} + +-static inline int dma_buf_stats_setup(struct dma_buf *dmabuf) ++static inline int dma_buf_stats_setup(struct dma_buf *dmabuf, struct file *file) + { + return 0; + } +diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c +index e6f36c014c4c..eb6b59363c4f 100644 +--- a/drivers/dma-buf/dma-buf.c ++++ b/drivers/dma-buf/dma-buf.c +@@ -95,10 +95,11 @@ static int dma_buf_file_release(struct inode *inode, struct file *file) + return -EINVAL; + + dmabuf = file->private_data; +- +- mutex_lock(&db_list.lock); +- list_del(&dmabuf->list_node); +- mutex_unlock(&db_list.lock); ++ if (dmabuf) { ++ mutex_lock(&db_list.lock); ++ list_del(&dmabuf->list_node); ++ mutex_unlock(&db_list.lock); ++ } + + return 0; + } +@@ -523,17 +524,17 @@ static inline int is_dma_buf_file(struct file *file) + return file->f_op == &dma_buf_fops; + } + +-static struct file *dma_buf_getfile(struct dma_buf *dmabuf, int flags) ++static struct file *dma_buf_getfile(size_t size, int flags) + { + static atomic64_t dmabuf_inode = ATOMIC64_INIT(0); +- struct file *file; + struct inode *inode = alloc_anon_inode(dma_buf_mnt->mnt_sb); ++ struct file *file; + + if (IS_ERR(inode)) + return ERR_CAST(inode); + +- inode->i_size = dmabuf->size; +- inode_set_bytes(inode, dmabuf->size); ++ inode->i_size = size; ++ inode_set_bytes(inode, size); + + /* + * The ->i_ino acquired from get_next_ino() is not unique thus +@@ -547,8 +548,6 @@ static struct file *dma_buf_getfile(struct dma_buf *dmabuf, int flags) + flags, &dma_buf_fops); + if (IS_ERR(file)) + goto err_alloc_file; +- file->private_data = dmabuf; +- file->f_path.dentry->d_fsdata = dmabuf; + + return file; + +@@ -614,19 +613,11 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info) + size_t alloc_size = sizeof(struct dma_buf); + int ret; + +- if (!exp_info->resv) +- alloc_size += sizeof(struct dma_resv); +- else +- /* prevent &dma_buf[1] == dma_buf->resv */ +- alloc_size += 1; +- +- if (WARN_ON(!exp_info->priv +- || !exp_info->ops +- || !exp_info->ops->map_dma_buf +- || !exp_info->ops->unmap_dma_buf +- || !exp_info->ops->release)) { ++ if (WARN_ON(!exp_info->priv || !exp_info->ops ++ || !exp_info->ops->map_dma_buf ++ || !exp_info->ops->unmap_dma_buf ++ || !exp_info->ops->release)) + return ERR_PTR(-EINVAL); +- } + + if (WARN_ON(exp_info->ops->cache_sgt_mapping && + (exp_info->ops->pin || exp_info->ops->unpin))) +@@ -638,10 +629,21 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info) + if (!try_module_get(exp_info->owner)) + return ERR_PTR(-ENOENT); + ++ file = dma_buf_getfile(exp_info->size, exp_info->flags); ++ if (IS_ERR(file)) { ++ ret = PTR_ERR(file); ++ goto err_module; ++ } ++ ++ if (!exp_info->resv) ++ alloc_size += sizeof(struct dma_resv); ++ else ++ /* prevent &dma_buf[1] == dma_buf->resv */ ++ alloc_size += 1; + dmabuf = kzalloc(alloc_size, GFP_KERNEL); + if (!dmabuf) { + ret = -ENOMEM; +- goto err_module; ++ goto err_file; + } + + dmabuf->priv = exp_info->priv; +@@ -653,44 +655,36 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info) + init_waitqueue_head(&dmabuf->poll); + dmabuf->cb_in.poll = dmabuf->cb_out.poll = &dmabuf->poll; + dmabuf->cb_in.active = dmabuf->cb_out.active = 0; ++ mutex_init(&dmabuf->lock); ++ INIT_LIST_HEAD(&dmabuf->attachments); + + if (!resv) { +- resv = (struct dma_resv *)&dmabuf[1]; +- dma_resv_init(resv); ++ dmabuf->resv = (struct dma_resv *)&dmabuf[1]; ++ dma_resv_init(dmabuf->resv); ++ } else { ++ dmabuf->resv = resv; + } +- dmabuf->resv = resv; + +- file = dma_buf_getfile(dmabuf, exp_info->flags); +- if (IS_ERR(file)) { +- ret = PTR_ERR(file); ++ ret = dma_buf_stats_setup(dmabuf, file); ++ if (ret) + goto err_dmabuf; +- } + ++ file->private_data = dmabuf; ++ file->f_path.dentry->d_fsdata = dmabuf; + dmabuf->file = file; + +- mutex_init(&dmabuf->lock); +- INIT_LIST_HEAD(&dmabuf->attachments); +- + mutex_lock(&db_list.lock); + list_add(&dmabuf->list_node, &db_list.head); + mutex_unlock(&db_list.lock); + +- ret = dma_buf_stats_setup(dmabuf); +- if (ret) +- goto err_sysfs; +- + return dmabuf; + +-err_sysfs: +- /* +- * Set file->f_path.dentry->d_fsdata to NULL so that when +- * dma_buf_release() gets invoked by dentry_ops, it exits +- * early before calling the release() dma_buf op. +- */ +- file->f_path.dentry->d_fsdata = NULL; +- fput(file); + err_dmabuf: ++ if (!resv) ++ dma_resv_fini(dmabuf->resv); + kfree(dmabuf); ++err_file: ++ fput(file); + err_module: + module_put(exp_info->owner); + return ERR_PTR(ret); +-- +2.35.1 + diff --git a/queue-6.1/f2fs-let-s-avoid-panic-if-extent_tree-is-not-created.patch b/queue-6.1/f2fs-let-s-avoid-panic-if-extent_tree-is-not-created.patch new file mode 100644 index 00000000000..008155e740b --- /dev/null +++ b/queue-6.1/f2fs-let-s-avoid-panic-if-extent_tree-is-not-created.patch @@ -0,0 +1,70 @@ +From dea073062d1fbd07486a19cef1859928c67c9ad5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Dec 2022 16:14:10 -0800 +Subject: f2fs: let's avoid panic if extent_tree is not created + +From: Jaegeuk Kim + +[ Upstream commit df9d44b645b83fffccfb4e28c1f93376585fdec8 ] + +This patch avoids the below panic. + +pc : __lookup_extent_tree+0xd8/0x760 +lr : f2fs_do_write_data_page+0x104/0x87c +sp : ffffffc010cbb3c0 +x29: ffffffc010cbb3e0 x28: 0000000000000000 +x27: ffffff8803e7f020 x26: ffffff8803e7ed40 +x25: ffffff8803e7f020 x24: ffffffc010cbb460 +x23: ffffffc010cbb480 x22: 0000000000000000 +x21: 0000000000000000 x20: ffffffff22e90900 +x19: 0000000000000000 x18: ffffffc010c5d080 +x17: 0000000000000000 x16: 0000000000000020 +x15: ffffffdb1acdbb88 x14: ffffff888759e2b0 +x13: 0000000000000000 x12: ffffff802da49000 +x11: 000000000a001200 x10: ffffff8803e7ed40 +x9 : ffffff8023195800 x8 : ffffff802da49078 +x7 : 0000000000000001 x6 : 0000000000000000 +x5 : 0000000000000006 x4 : ffffffc010cbba28 +x3 : 0000000000000000 x2 : ffffffc010cbb480 +x1 : 0000000000000000 x0 : ffffff8803e7ed40 +Call trace: + __lookup_extent_tree+0xd8/0x760 + f2fs_do_write_data_page+0x104/0x87c + f2fs_write_single_data_page+0x420/0xb60 + f2fs_write_cache_pages+0x418/0xb1c + __f2fs_write_data_pages+0x428/0x58c + f2fs_write_data_pages+0x30/0x40 + do_writepages+0x88/0x190 + __writeback_single_inode+0x48/0x448 + writeback_sb_inodes+0x468/0x9e8 + __writeback_inodes_wb+0xb8/0x2a4 + wb_writeback+0x33c/0x740 + wb_do_writeback+0x2b4/0x400 + wb_workfn+0xe4/0x34c + process_one_work+0x24c/0x5bc + worker_thread+0x3e8/0xa50 + kthread+0x150/0x1b4 + +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/extent_cache.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c +index 932c070173b9..6c9e6f78a3e3 100644 +--- a/fs/f2fs/extent_cache.c ++++ b/fs/f2fs/extent_cache.c +@@ -415,7 +415,8 @@ static bool f2fs_lookup_extent_tree(struct inode *inode, pgoff_t pgofs, + struct extent_node *en; + bool ret = false; + +- f2fs_bug_on(sbi, !et); ++ if (!et) ++ return false; + + trace_f2fs_lookup_extent_tree_start(inode, pgofs); + +-- +2.35.1 + diff --git a/queue-6.1/fbdev-omapfb-avoid-stack-overflow-warning.patch b/queue-6.1/fbdev-omapfb-avoid-stack-overflow-warning.patch new file mode 100644 index 00000000000..ac2c8d4e892 --- /dev/null +++ b/queue-6.1/fbdev-omapfb-avoid-stack-overflow-warning.patch @@ -0,0 +1,100 @@ +From ddf5b49b11897751c7e916833aecdb2cecfbc187 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Dec 2022 18:02:28 +0100 +Subject: fbdev: omapfb: avoid stack overflow warning + +From: Arnd Bergmann + +[ Upstream commit 634cf6ead93988b0da9ac054521ab63a3ba189db ] + +The dsi_irq_stats structure is a little too big to fit on the +stack of a 32-bit task, depending on the specific gcc options: + +fbdev/omap2/omapfb/dss/dsi.c: In function 'dsi_dump_dsidev_irqs': +fbdev/omap2/omapfb/dss/dsi.c:1621:1: error: the frame size of 1064 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] + +Since this is only a debugfs file, performance is not critical, +so just dynamically allocate it, and print an error message +in there in place of a failure code when the allocation fails. + +Signed-off-by: Arnd Bergmann +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/omap2/omapfb/dss/dsi.c | 28 ++++++++++++++-------- + 1 file changed, 18 insertions(+), 10 deletions(-) + +diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c +index 54b0f034c2ed..7cddb7b8ae34 100644 +--- a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c ++++ b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c +@@ -1536,22 +1536,28 @@ static void dsi_dump_dsidev_irqs(struct platform_device *dsidev, + { + struct dsi_data *dsi = dsi_get_dsidrv_data(dsidev); + unsigned long flags; +- struct dsi_irq_stats stats; ++ struct dsi_irq_stats *stats; ++ ++ stats = kzalloc(sizeof(*stats), GFP_KERNEL); ++ if (!stats) { ++ seq_printf(s, "out of memory\n"); ++ return; ++ } + + spin_lock_irqsave(&dsi->irq_stats_lock, flags); + +- stats = dsi->irq_stats; ++ *stats = dsi->irq_stats; + memset(&dsi->irq_stats, 0, sizeof(dsi->irq_stats)); + dsi->irq_stats.last_reset = jiffies; + + spin_unlock_irqrestore(&dsi->irq_stats_lock, flags); + + seq_printf(s, "period %u ms\n", +- jiffies_to_msecs(jiffies - stats.last_reset)); ++ jiffies_to_msecs(jiffies - stats->last_reset)); + +- seq_printf(s, "irqs %d\n", stats.irq_count); ++ seq_printf(s, "irqs %d\n", stats->irq_count); + #define PIS(x) \ +- seq_printf(s, "%-20s %10d\n", #x, stats.dsi_irqs[ffs(DSI_IRQ_##x)-1]) ++ seq_printf(s, "%-20s %10d\n", #x, stats->dsi_irqs[ffs(DSI_IRQ_##x)-1]) + + seq_printf(s, "-- DSI%d interrupts --\n", dsi->module_id + 1); + PIS(VC0); +@@ -1575,10 +1581,10 @@ static void dsi_dump_dsidev_irqs(struct platform_device *dsidev, + + #define PIS(x) \ + seq_printf(s, "%-20s %10d %10d %10d %10d\n", #x, \ +- stats.vc_irqs[0][ffs(DSI_VC_IRQ_##x)-1], \ +- stats.vc_irqs[1][ffs(DSI_VC_IRQ_##x)-1], \ +- stats.vc_irqs[2][ffs(DSI_VC_IRQ_##x)-1], \ +- stats.vc_irqs[3][ffs(DSI_VC_IRQ_##x)-1]); ++ stats->vc_irqs[0][ffs(DSI_VC_IRQ_##x)-1], \ ++ stats->vc_irqs[1][ffs(DSI_VC_IRQ_##x)-1], \ ++ stats->vc_irqs[2][ffs(DSI_VC_IRQ_##x)-1], \ ++ stats->vc_irqs[3][ffs(DSI_VC_IRQ_##x)-1]); + + seq_printf(s, "-- VC interrupts --\n"); + PIS(CS); +@@ -1594,7 +1600,7 @@ static void dsi_dump_dsidev_irqs(struct platform_device *dsidev, + + #define PIS(x) \ + seq_printf(s, "%-20s %10d\n", #x, \ +- stats.cio_irqs[ffs(DSI_CIO_IRQ_##x)-1]); ++ stats->cio_irqs[ffs(DSI_CIO_IRQ_##x)-1]); + + seq_printf(s, "-- CIO interrupts --\n"); + PIS(ERRSYNCESC1); +@@ -1618,6 +1624,8 @@ static void dsi_dump_dsidev_irqs(struct platform_device *dsidev, + PIS(ULPSACTIVENOT_ALL0); + PIS(ULPSACTIVENOT_ALL1); + #undef PIS ++ ++ kfree(stats); + } + + static void dsi1_dump_irqs(struct seq_file *s) +-- +2.35.1 + diff --git a/queue-6.1/memblock-tests-fix-compilation-error.patch b/queue-6.1/memblock-tests-fix-compilation-error.patch new file mode 100644 index 00000000000..0556544e8c0 --- /dev/null +++ b/queue-6.1/memblock-tests-fix-compilation-error.patch @@ -0,0 +1,73 @@ +From 1f678048ff4c793fa93f82093d4001824ed994ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jan 2023 10:07:37 +0000 +Subject: memblock tests: Fix compilation error. + +From: Aaron Thompson + +[ Upstream commit 340726747336716350eb5a928b860a29db955f05 ] + +Commit cf4694be2b2cf ("tools: Add atomic_test_and_set_bit()") changed +tools/arch/x86/include/asm/atomic.h to include , which causes +'make -C tools/testing/memblock' to fail with: + +In file included from ../../include/asm/atomic.h:6, + from ../../include/linux/atomic.h:5, + from ./linux/mmzone.h:5, + from ../../include/linux/mm.h:5, + from ../../include/linux/pfn.h:5, + from ./linux/memory_hotplug.h:6, + from ./linux/init.h:7, + from ./linux/memblock.h:11, + from tests/common.h:8, + from tests/basic_api.h:5, + from main.c:2: +../../include/asm/../../arch/x86/include/asm/atomic.h:11:10: fatal error: asm/asm.h: No such file or directory + 11 | #include + | ^~~~~~~~~~~ + +Create a symlink to asm/asm.h in the same manner as the existing one to +asm/cmpxchg.h. + +Signed-off-by: Aaron Thompson +Link: https://lore.kernel.org/r/010101857c402765-96e2dbc6-b82b-47e2-a437-4834dbe0b96b-000000@us-west-2.amazonses.com +Signed-off-by: Mike Rapoport (IBM) +Signed-off-by: Sasha Levin +--- + tools/testing/memblock/.gitignore | 1 + + tools/testing/memblock/Makefile | 3 ++- + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/memblock/.gitignore b/tools/testing/memblock/.gitignore +index 654338e0be52..4cc7cd5aac2b 100644 +--- a/tools/testing/memblock/.gitignore ++++ b/tools/testing/memblock/.gitignore +@@ -1,4 +1,5 @@ + main + memblock.c + linux/memblock.h ++asm/asm.h + asm/cmpxchg.h +diff --git a/tools/testing/memblock/Makefile b/tools/testing/memblock/Makefile +index 246f7ac8489b..575e98fddc21 100644 +--- a/tools/testing/memblock/Makefile ++++ b/tools/testing/memblock/Makefile +@@ -29,13 +29,14 @@ include: ../../../include/linux/memblock.h ../../include/linux/*.h \ + + @mkdir -p linux + test -L linux/memblock.h || ln -s ../../../../include/linux/memblock.h linux/memblock.h ++ test -L asm/asm.h || ln -s ../../../arch/x86/include/asm/asm.h asm/asm.h + test -L asm/cmpxchg.h || ln -s ../../../arch/x86/include/asm/cmpxchg.h asm/cmpxchg.h + + memblock.c: $(EXTR_SRC) + test -L memblock.c || ln -s $(EXTR_SRC) memblock.c + + clean: +- $(RM) $(TARGETS) $(OFILES) linux/memblock.h memblock.c asm/cmpxchg.h ++ $(RM) $(TARGETS) $(OFILES) linux/memblock.h memblock.c asm/asm.h asm/cmpxchg.h + + help: + @echo 'Memblock simulator' +-- +2.35.1 + diff --git a/queue-6.1/net-ethernet-marvell-octeontx2-fix-uninitialized-var.patch b/queue-6.1/net-ethernet-marvell-octeontx2-fix-uninitialized-var.patch new file mode 100644 index 00000000000..d1ec3027af3 --- /dev/null +++ b/queue-6.1/net-ethernet-marvell-octeontx2-fix-uninitialized-var.patch @@ -0,0 +1,35 @@ +From faf3cdc22620031f5c6c4d4cb2e22dde2efcfda7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Dec 2022 23:12:22 +0530 +Subject: net: ethernet: marvell: octeontx2: Fix uninitialized variable warning + +From: Anuradha Weeraman + +[ Upstream commit d3805695fe1e7383517903715cefc9bbdcffdc90 ] + +Fix for uninitialized variable warning. + +Addresses-Coverity: ("Uninitialized scalar variable") +Signed-off-by: Anuradha Weeraman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c b/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c +index fa8029a94068..eb25e458266c 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c +@@ -589,7 +589,7 @@ int rvu_mbox_handler_mcs_free_resources(struct rvu *rvu, + u16 pcifunc = req->hdr.pcifunc; + struct mcs_rsrc_map *map; + struct mcs *mcs; +- int rc; ++ int rc = 0; + + if (req->mcs_id >= rvu->mcs_blk_cnt) + return MCS_AF_ERR_INVALID_MCSID; +-- +2.35.1 + diff --git a/queue-6.1/net-ethtool-ioctl-return-eopnotsupp-if-we-have-no-ph.patch b/queue-6.1/net-ethtool-ioctl-return-eopnotsupp-if-we-have-no-ph.patch new file mode 100644 index 00000000000..5893633ed19 --- /dev/null +++ b/queue-6.1/net-ethtool-ioctl-return-eopnotsupp-if-we-have-no-ph.patch @@ -0,0 +1,38 @@ +From 312b6f6c789376523ee1aecd97e66e35827a721c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Dec 2022 14:48:23 +0300 +Subject: net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats + +From: Daniil Tatianin + +[ Upstream commit 9deb1e9fb88b1120a908676fa33bdf9e2eeaefce ] + +It's not very useful to copy back an empty ethtool_stats struct and +return 0 if we didn't actually have any stats. This also allows for +further simplification of this function in the future commits. + +Signed-off-by: Daniil Tatianin +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ethtool/ioctl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c +index 81fe2422fe58..038398d41a93 100644 +--- a/net/ethtool/ioctl.c ++++ b/net/ethtool/ioctl.c +@@ -2094,7 +2094,8 @@ static int ethtool_get_phy_stats(struct net_device *dev, void __user *useraddr) + return n_stats; + if (n_stats > S32_MAX / sizeof(u64)) + return -ENOMEM; +- WARN_ON_ONCE(!n_stats); ++ if (WARN_ON_ONCE(!n_stats)) ++ return -EOPNOTSUPP; + + if (copy_from_user(&stats, useraddr, sizeof(stats))) + return -EFAULT; +-- +2.35.1 + diff --git a/queue-6.1/of-fdt-honor-config_cmdline-even-without-chosen-node.patch b/queue-6.1/of-fdt-honor-config_cmdline-even-without-chosen-node.patch new file mode 100644 index 00000000000..4df155a383a --- /dev/null +++ b/queue-6.1/of-fdt-honor-config_cmdline-even-without-chosen-node.patch @@ -0,0 +1,103 @@ +From 5eece547bd36776908d82ffb3ce1120ad84408d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Jan 2023 12:00:32 -0600 +Subject: of: fdt: Honor CONFIG_CMDLINE* even without /chosen node, take 2 + +From: Rob Herring + +[ Upstream commit 064e32dc5b03114d0767893fecdaf7b5dfd8c286 ] + +I do not read a strict requirement on /chosen node in either ePAPR or in +Documentation/devicetree. Help text for CONFIG_CMDLINE and +CONFIG_CMDLINE_EXTEND doesn't make their behavior explicitly dependent on +the presence of /chosen or the presense of /chosen/bootargs. + +However the early check for /chosen and bailing out in +early_init_dt_scan_chosen() skips CONFIG_CMDLINE handling which is not +really related to /chosen node or the particular method of passing cmdline +from bootloader. + +This leads to counterintuitive combinations (assuming +CONFIG_CMDLINE_EXTEND=y): + +a) bootargs="foo", CONFIG_CMDLINE="bar" => cmdline=="foo bar" +b) /chosen missing, CONFIG_CMDLINE="bar" => cmdline=="" +c) bootargs="", CONFIG_CMDLINE="bar" => cmdline==" bar" + +Rework early_init_dt_scan_chosen() so that the cmdline config options are +always handled. + +[commit msg written by Alexander Sverdlin] + +Cc: Alexander Sverdlin +Cc: Linus Walleij +Cc: Arnd Bergmann +Tested-by: Geoff Levand +Reviewed-by: Alexander Sverdlin +Link: https://lore.kernel.org/r/20230103-dt-cmdline-fix-v1-2-7038e88b18b6@kernel.org +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/fdt.c | 28 +++++++++++++++------------- + 1 file changed, 15 insertions(+), 13 deletions(-) + +diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c +index 4f88e8bbdd27..f08b25195ae7 100644 +--- a/drivers/of/fdt.c ++++ b/drivers/of/fdt.c +@@ -1163,18 +1163,32 @@ int __init early_init_dt_scan_chosen(char *cmdline) + if (node < 0) + node = fdt_path_offset(fdt, "/chosen@0"); + if (node < 0) +- return -ENOENT; ++ /* Handle the cmdline config options even if no /chosen node */ ++ goto handle_cmdline; + + chosen_node_offset = node; + + early_init_dt_check_for_initrd(node); + early_init_dt_check_for_elfcorehdr(node); + ++ rng_seed = of_get_flat_dt_prop(node, "rng-seed", &l); ++ if (rng_seed && l > 0) { ++ add_bootloader_randomness(rng_seed, l); ++ ++ /* try to clear seed so it won't be found. */ ++ fdt_nop_property(initial_boot_params, node, "rng-seed"); ++ ++ /* update CRC check value */ ++ of_fdt_crc32 = crc32_be(~0, initial_boot_params, ++ fdt_totalsize(initial_boot_params)); ++ } ++ + /* Retrieve command line */ + p = of_get_flat_dt_prop(node, "bootargs", &l); + if (p != NULL && l > 0) + strscpy(cmdline, p, min(l, COMMAND_LINE_SIZE)); + ++handle_cmdline: + /* + * CONFIG_CMDLINE is meant to be a default in case nothing else + * managed to set the command line, unless CONFIG_CMDLINE_FORCE +@@ -1195,18 +1209,6 @@ int __init early_init_dt_scan_chosen(char *cmdline) + + pr_debug("Command line is: %s\n", (char *)cmdline); + +- rng_seed = of_get_flat_dt_prop(node, "rng-seed", &l); +- if (rng_seed && l > 0) { +- add_bootloader_randomness(rng_seed, l); +- +- /* try to clear seed so it won't be found. */ +- fdt_nop_property(initial_boot_params, node, "rng-seed"); +- +- /* update CRC check value */ +- of_fdt_crc32 = crc32_be(~0, initial_boot_params, +- fdt_totalsize(initial_boot_params)); +- } +- + return 0; + } + +-- +2.35.1 + diff --git a/queue-6.1/perf-x86-rapl-add-support-for-intel-emerald-rapids.patch b/queue-6.1/perf-x86-rapl-add-support-for-intel-emerald-rapids.patch new file mode 100644 index 00000000000..d82c91cbb6b --- /dev/null +++ b/queue-6.1/perf-x86-rapl-add-support-for-intel-emerald-rapids.patch @@ -0,0 +1,35 @@ +From 4e51f778400868af70ee31a813900e2656196786 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jan 2023 22:58:31 +0800 +Subject: perf/x86/rapl: Add support for Intel Emerald Rapids + +From: Zhang Rui + +[ Upstream commit 57512b57dcfaf63c52d8ad2fb35321328cde31b0 ] + +Emerald Rapids RAPL support is the same as previous Sapphire Rapids. +Add Emerald Rapids model for RAPL. + +Signed-off-by: Zhang Rui +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20230104145831.25498-2-rui.zhang@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/rapl.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/events/rapl.c b/arch/x86/events/rapl.c +index 589c6885560d..52e6e7ed4f78 100644 +--- a/arch/x86/events/rapl.c ++++ b/arch/x86/events/rapl.c +@@ -806,6 +806,7 @@ static const struct x86_cpu_id rapl_model_match[] __initconst = { + X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_L, &model_skl), + X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_N, &model_skl), + X86_MATCH_INTEL_FAM6_MODEL(SAPPHIRERAPIDS_X, &model_spr), ++ X86_MATCH_INTEL_FAM6_MODEL(EMERALDRAPIDS_X, &model_spr), + X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE, &model_skl), + X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P, &model_skl), + X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S, &model_skl), +-- +2.35.1 + diff --git a/queue-6.1/perf-x86-rapl-add-support-for-intel-meteor-lake.patch b/queue-6.1/perf-x86-rapl-add-support-for-intel-meteor-lake.patch new file mode 100644 index 00000000000..777b8156619 --- /dev/null +++ b/queue-6.1/perf-x86-rapl-add-support-for-intel-meteor-lake.patch @@ -0,0 +1,36 @@ +From e284fed3abf13a15dae77ffefa508290ce767ff1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jan 2023 22:58:30 +0800 +Subject: perf/x86/rapl: Add support for Intel Meteor Lake + +From: Zhang Rui + +[ Upstream commit f52853a668bfeddd79f319d536a506f68cc2b478 ] + +Meteor Lake RAPL support is the same as previous Sky Lake. +Add Meteor Lake model for RAPL. + +Signed-off-by: Zhang Rui +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20230104145831.25498-1-rui.zhang@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/rapl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/x86/events/rapl.c b/arch/x86/events/rapl.c +index ae5779ea4417..589c6885560d 100644 +--- a/arch/x86/events/rapl.c ++++ b/arch/x86/events/rapl.c +@@ -809,6 +809,8 @@ static const struct x86_cpu_id rapl_model_match[] __initconst = { + X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE, &model_skl), + X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P, &model_skl), + X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S, &model_skl), ++ X86_MATCH_INTEL_FAM6_MODEL(METEORLAKE, &model_skl), ++ X86_MATCH_INTEL_FAM6_MODEL(METEORLAKE_L, &model_skl), + {}, + }; + MODULE_DEVICE_TABLE(x86cpu, rapl_model_match); +-- +2.35.1 + diff --git a/queue-6.1/perf-x86-rapl-treat-tigerlake-like-icelake.patch b/queue-6.1/perf-x86-rapl-treat-tigerlake-like-icelake.patch new file mode 100644 index 00000000000..43405bbf1a7 --- /dev/null +++ b/queue-6.1/perf-x86-rapl-treat-tigerlake-like-icelake.patch @@ -0,0 +1,40 @@ +From 95271ea8da60dd0540f256a6d1cded1b53eb1181 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Dec 2022 06:34:54 -0500 +Subject: perf/x86/rapl: Treat Tigerlake like Icelake + +From: Chris Wilson + +[ Upstream commit c07311b5509f6035f1dd828db3e90ff4859cf3b9 ] + +Since Tigerlake seems to have inherited its cstates and other RAPL power +caps from Icelake, assume it also follows Icelake for its RAPL events. + +Signed-off-by: Chris Wilson +Signed-off-by: Rodrigo Vivi +Signed-off-by: Ingo Molnar +Cc: Peter Zijlstra +Cc: Stephane Eranian +Cc: Zhang Rui +Link: https://lore.kernel.org/r/20221228113454.1199118-1-rodrigo.vivi@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/rapl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/x86/events/rapl.c b/arch/x86/events/rapl.c +index a829492bca4c..ae5779ea4417 100644 +--- a/arch/x86/events/rapl.c ++++ b/arch/x86/events/rapl.c +@@ -800,6 +800,8 @@ static const struct x86_cpu_id rapl_model_match[] __initconst = { + X86_MATCH_INTEL_FAM6_MODEL(ICELAKE_X, &model_hsx), + X86_MATCH_INTEL_FAM6_MODEL(COMETLAKE_L, &model_skl), + X86_MATCH_INTEL_FAM6_MODEL(COMETLAKE, &model_skl), ++ X86_MATCH_INTEL_FAM6_MODEL(TIGERLAKE_L, &model_skl), ++ X86_MATCH_INTEL_FAM6_MODEL(TIGERLAKE, &model_skl), + X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE, &model_skl), + X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_L, &model_skl), + X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_N, &model_skl), +-- +2.35.1 + diff --git a/queue-6.1/pnfs-filelayout-fix-coalescing-test-for-single-ds.patch b/queue-6.1/pnfs-filelayout-fix-coalescing-test-for-single-ds.patch new file mode 100644 index 00000000000..06ae86f2b9f --- /dev/null +++ b/queue-6.1/pnfs-filelayout-fix-coalescing-test-for-single-ds.patch @@ -0,0 +1,49 @@ +From a0a7a85641baa8225e12d174aa1b7200559786c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 12:31:29 -0500 +Subject: pNFS/filelayout: Fix coalescing test for single DS + +From: Olga Kornievskaia + +[ Upstream commit a6b9d2fa0024e7e399c26facd0fb466b7396e2b9 ] + +When there is a single DS no striping constraints need to be placed on +the IO. When such constraint is applied then buffered reads don't +coalesce to the DS's rsize. + +Signed-off-by: Olga Kornievskaia +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/filelayout/filelayout.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c +index ad34a33b0737..4974cd18ca46 100644 +--- a/fs/nfs/filelayout/filelayout.c ++++ b/fs/nfs/filelayout/filelayout.c +@@ -783,6 +783,12 @@ filelayout_alloc_lseg(struct pnfs_layout_hdr *layoutid, + return &fl->generic_hdr; + } + ++static bool ++filelayout_lseg_is_striped(const struct nfs4_filelayout_segment *flseg) ++{ ++ return flseg->num_fh > 1; ++} ++ + /* + * filelayout_pg_test(). Called by nfs_can_coalesce_requests() + * +@@ -803,6 +809,8 @@ filelayout_pg_test(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev, + size = pnfs_generic_pg_test(pgio, prev, req); + if (!size) + return 0; ++ else if (!filelayout_lseg_is_striped(FILELAYOUT_LSEG(pgio->pg_lseg))) ++ return size; + + /* see if req and prev are in the same stripe */ + if (prev) { +-- +2.35.1 + diff --git a/queue-6.1/r8169-fix-dmar-pte-write-access-is-not-set-error.patch b/queue-6.1/r8169-fix-dmar-pte-write-access-is-not-set-error.patch new file mode 100644 index 00000000000..5407a84ca81 --- /dev/null +++ b/queue-6.1/r8169-fix-dmar-pte-write-access-is-not-set-error.patch @@ -0,0 +1,92 @@ +From c6ea76e761a8f7999985eda5e62f2dfcf4c41afe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Dec 2022 20:31:53 +0800 +Subject: r8169: fix dmar pte write access is not set error + +From: Chunhao Lin + +[ Upstream commit bb41c13c05c23d9bc46b4e37d8914078c6a40e3a ] + +When close device, if wol is enabled, rx will be enabled. When open +device it will cause rx packet to be dma to the wrong memory address +after pci_set_master() and system log will show blow messages. + +DMAR: DRHD: handling fault status reg 3 +DMAR: [DMA Write] Request device [02:00.0] PASID ffffffff fault addr +ffdd4000 [fault reason 05] PTE Write access is not set + +In this patch, driver disable tx/rx when close device. If wol is +enabled, only enable rx filter and disable rxdv_gate(if support) to +let hardware only receive packet to fifo but not to dma it. + +Signed-off-by: Chunhao Lin +Reviewed-by: Heiner Kallweit +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 316c925c956f..cabed1b7b45e 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -2435,6 +2435,9 @@ static void rtl_wol_enable_rx(struct rtl8169_private *tp) + if (tp->mac_version >= RTL_GIGA_MAC_VER_25) + RTL_W32(tp, RxConfig, RTL_R32(tp, RxConfig) | + AcceptBroadcast | AcceptMulticast | AcceptMyPhys); ++ ++ if (tp->mac_version >= RTL_GIGA_MAC_VER_40) ++ rtl_disable_rxdvgate(tp); + } + + static void rtl_prepare_power_down(struct rtl8169_private *tp) +@@ -3869,7 +3872,7 @@ static void rtl8169_tx_clear(struct rtl8169_private *tp) + netdev_reset_queue(tp->dev); + } + +-static void rtl8169_cleanup(struct rtl8169_private *tp, bool going_down) ++static void rtl8169_cleanup(struct rtl8169_private *tp) + { + napi_disable(&tp->napi); + +@@ -3881,9 +3884,6 @@ static void rtl8169_cleanup(struct rtl8169_private *tp, bool going_down) + + rtl_rx_close(tp); + +- if (going_down && tp->dev->wol_enabled) +- goto no_reset; +- + switch (tp->mac_version) { + case RTL_GIGA_MAC_VER_28: + case RTL_GIGA_MAC_VER_31: +@@ -3904,7 +3904,7 @@ static void rtl8169_cleanup(struct rtl8169_private *tp, bool going_down) + } + + rtl_hw_reset(tp); +-no_reset: ++ + rtl8169_tx_clear(tp); + rtl8169_init_ring_indexes(tp); + } +@@ -3915,7 +3915,7 @@ static void rtl_reset_work(struct rtl8169_private *tp) + + netif_stop_queue(tp->dev); + +- rtl8169_cleanup(tp, false); ++ rtl8169_cleanup(tp); + + for (i = 0; i < NUM_RX_DESC; i++) + rtl8169_mark_to_asic(tp->RxDescArray + i); +@@ -4601,7 +4601,7 @@ static void rtl8169_down(struct rtl8169_private *tp) + pci_clear_master(tp->pci_dev); + rtl_pci_commit(tp); + +- rtl8169_cleanup(tp, true); ++ rtl8169_cleanup(tp); + rtl_disable_exit_l1(tp); + rtl_prepare_power_down(tp); + } +-- +2.35.1 + diff --git a/queue-6.1/r8169-move-rtl_wol_enable_rx-and-rtl_prepare_power_d.patch b/queue-6.1/r8169-move-rtl_wol_enable_rx-and-rtl_prepare_power_d.patch new file mode 100644 index 00000000000..6dab281fdb2 --- /dev/null +++ b/queue-6.1/r8169-move-rtl_wol_enable_rx-and-rtl_prepare_power_d.patch @@ -0,0 +1,85 @@ +From 9bf8c6abd9ac56dff989679accc36aaeea4f2fe3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Dec 2022 20:31:52 +0800 +Subject: r8169: move rtl_wol_enable_rx() and rtl_prepare_power_down() + +From: Chunhao Lin + +[ Upstream commit ad425666a1f05d9b215a84cf010c3789b2ea8206 ] + +There is no functional change. Moving these two functions for following +patch "r8169: fix dmar pte write access is not set error". + +Signed-off-by: Chunhao Lin +Reviewed-by: Heiner Kallweit +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 44 +++++++++++------------ + 1 file changed, 22 insertions(+), 22 deletions(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index fe8dc8e0522b..316c925c956f 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -2207,28 +2207,6 @@ static int rtl_set_mac_address(struct net_device *dev, void *p) + return 0; + } + +-static void rtl_wol_enable_rx(struct rtl8169_private *tp) +-{ +- if (tp->mac_version >= RTL_GIGA_MAC_VER_25) +- RTL_W32(tp, RxConfig, RTL_R32(tp, RxConfig) | +- AcceptBroadcast | AcceptMulticast | AcceptMyPhys); +-} +- +-static void rtl_prepare_power_down(struct rtl8169_private *tp) +-{ +- if (tp->dash_type != RTL_DASH_NONE) +- return; +- +- if (tp->mac_version == RTL_GIGA_MAC_VER_32 || +- tp->mac_version == RTL_GIGA_MAC_VER_33) +- rtl_ephy_write(tp, 0x19, 0xff64); +- +- if (device_may_wakeup(tp_to_dev(tp))) { +- phy_speed_down(tp->phydev, false); +- rtl_wol_enable_rx(tp); +- } +-} +- + static void rtl_init_rxcfg(struct rtl8169_private *tp) + { + switch (tp->mac_version) { +@@ -2452,6 +2430,28 @@ static void rtl_enable_rxdvgate(struct rtl8169_private *tp) + rtl_wait_txrx_fifo_empty(tp); + } + ++static void rtl_wol_enable_rx(struct rtl8169_private *tp) ++{ ++ if (tp->mac_version >= RTL_GIGA_MAC_VER_25) ++ RTL_W32(tp, RxConfig, RTL_R32(tp, RxConfig) | ++ AcceptBroadcast | AcceptMulticast | AcceptMyPhys); ++} ++ ++static void rtl_prepare_power_down(struct rtl8169_private *tp) ++{ ++ if (tp->dash_type != RTL_DASH_NONE) ++ return; ++ ++ if (tp->mac_version == RTL_GIGA_MAC_VER_32 || ++ tp->mac_version == RTL_GIGA_MAC_VER_33) ++ rtl_ephy_write(tp, 0x19, 0xff64); ++ ++ if (device_may_wakeup(tp_to_dev(tp))) { ++ phy_speed_down(tp->phydev, false); ++ rtl_wol_enable_rx(tp); ++ } ++} ++ + static void rtl_set_tx_config_registers(struct rtl8169_private *tp) + { + u32 val = TX_DMA_BURST << TxDMAShift | +-- +2.35.1 + diff --git a/queue-6.1/rdma-srp-move-large-values-to-a-new-enum-for-gcc13.patch b/queue-6.1/rdma-srp-move-large-values-to-a-new-enum-for-gcc13.patch new file mode 100644 index 00000000000..ece4c3838dd --- /dev/null +++ b/queue-6.1/rdma-srp-move-large-values-to-a-new-enum-for-gcc13.patch @@ -0,0 +1,66 @@ +From 103d189f794d78bcbdd54664c5ebbbba998ccef4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Dec 2022 13:04:11 +0100 +Subject: RDMA/srp: Move large values to a new enum for gcc13 + +From: Jiri Slaby (SUSE) + +[ Upstream commit 56c5dab20a6391604df9521f812c01d1e3fe1bd0 ] + +Since gcc13, each member of an enum has the same type as the enum [1]. And +that is inherited from its members. Provided these two: + SRP_TAG_NO_REQ = ~0U, + SRP_TAG_TSK_MGMT = 1U << 31 +all other members are unsigned ints. + +Esp. with SRP_MAX_SGE and SRP_TSK_MGMT_SQ_SIZE and their use in min(), +this results in the following warnings: + include/linux/minmax.h:20:35: error: comparison of distinct pointer types lacks a cast + drivers/infiniband/ulp/srp/ib_srp.c:563:42: note: in expansion of macro 'min' + + include/linux/minmax.h:20:35: error: comparison of distinct pointer types lacks a cast + drivers/infiniband/ulp/srp/ib_srp.c:2369:27: note: in expansion of macro 'min' + +So move the large values away to a separate enum, so that they don't +affect other members. + +[1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=36113 + +Link: https://lore.kernel.org/r/20221212120411.13750-1-jirislaby@kernel.org +Signed-off-by: Jiri Slaby (SUSE) +Reviewed-by: Bart Van Assche +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/srp/ib_srp.h | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/ulp/srp/ib_srp.h b/drivers/infiniband/ulp/srp/ib_srp.h +index 00b0068fda20..5d94db453df3 100644 +--- a/drivers/infiniband/ulp/srp/ib_srp.h ++++ b/drivers/infiniband/ulp/srp/ib_srp.h +@@ -62,9 +62,6 @@ enum { + SRP_DEFAULT_CMD_SQ_SIZE = SRP_DEFAULT_QUEUE_SIZE - SRP_RSP_SQ_SIZE - + SRP_TSK_MGMT_SQ_SIZE, + +- SRP_TAG_NO_REQ = ~0U, +- SRP_TAG_TSK_MGMT = 1U << 31, +- + SRP_MAX_PAGES_PER_MR = 512, + + SRP_MAX_ADD_CDB_LEN = 16, +@@ -79,6 +76,11 @@ enum { + sizeof(struct srp_imm_buf), + }; + ++enum { ++ SRP_TAG_NO_REQ = ~0U, ++ SRP_TAG_TSK_MGMT = BIT(31), ++}; ++ + enum srp_target_state { + SRP_TARGET_SCANNING, + SRP_TARGET_LIVE, +-- +2.35.1 + diff --git a/queue-6.1/selftests-bpf-check-null-propagation-only-neither-re.patch b/queue-6.1/selftests-bpf-check-null-propagation-only-neither-re.patch new file mode 100644 index 00000000000..79f6c21873e --- /dev/null +++ b/queue-6.1/selftests-bpf-check-null-propagation-only-neither-re.patch @@ -0,0 +1,92 @@ +From bdf08cc55a0f56dd745bf59354af0d37739486ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Dec 2022 10:44:14 +0800 +Subject: selftests/bpf: check null propagation only neither reg is + PTR_TO_BTF_ID + +From: Hao Sun + +[ Upstream commit cedebd74cf3883f0384af9ec26b4e6f8f1964dd4 ] + +Verify that nullness information is not porpagated in the branches +of register to register JEQ and JNE operations if one of them is +PTR_TO_BTF_ID. Implement this in C level so we can use CO-RE. + +Signed-off-by: Hao Sun +Suggested-by: Martin KaFai Lau +Link: https://lore.kernel.org/r/20221222024414.29539-2-sunhao.th@gmail.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + .../bpf/prog_tests/jeq_infer_not_null.c | 9 ++++ + .../bpf/progs/jeq_infer_not_null_fail.c | 42 +++++++++++++++++++ + 2 files changed, 51 insertions(+) + create mode 100644 tools/testing/selftests/bpf/prog_tests/jeq_infer_not_null.c + create mode 100644 tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c + +diff --git a/tools/testing/selftests/bpf/prog_tests/jeq_infer_not_null.c b/tools/testing/selftests/bpf/prog_tests/jeq_infer_not_null.c +new file mode 100644 +index 000000000000..3add34df5767 +--- /dev/null ++++ b/tools/testing/selftests/bpf/prog_tests/jeq_infer_not_null.c +@@ -0,0 +1,9 @@ ++// SPDX-License-Identifier: GPL-2.0 ++ ++#include ++#include "jeq_infer_not_null_fail.skel.h" ++ ++void test_jeq_infer_not_null(void) ++{ ++ RUN_TESTS(jeq_infer_not_null_fail); ++} +diff --git a/tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c b/tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c +new file mode 100644 +index 000000000000..f46965053acb +--- /dev/null ++++ b/tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c +@@ -0,0 +1,42 @@ ++// SPDX-License-Identifier: GPL-2.0 ++ ++#include "vmlinux.h" ++#include ++#include "bpf_misc.h" ++ ++char _license[] SEC("license") = "GPL"; ++ ++struct { ++ __uint(type, BPF_MAP_TYPE_HASH); ++ __uint(max_entries, 1); ++ __type(key, u64); ++ __type(value, u64); ++} m_hash SEC(".maps"); ++ ++SEC("?raw_tp") ++__failure __msg("R8 invalid mem access 'map_value_or_null") ++int jeq_infer_not_null_ptr_to_btfid(void *ctx) ++{ ++ struct bpf_map *map = (struct bpf_map *)&m_hash; ++ struct bpf_map *inner_map = map->inner_map_meta; ++ u64 key = 0, ret = 0, *val; ++ ++ val = bpf_map_lookup_elem(map, &key); ++ /* Do not mark ptr as non-null if one of them is ++ * PTR_TO_BTF_ID (R9), reject because of invalid ++ * access to map value (R8). ++ * ++ * Here, we need to inline those insns to access ++ * R8 directly, since compiler may use other reg ++ * once it figures out val==inner_map. ++ */ ++ asm volatile("r8 = %[val];\n" ++ "r9 = %[inner_map];\n" ++ "if r8 != r9 goto +1;\n" ++ "%[ret] = *(u64 *)(r8 +0);\n" ++ : [ret] "+r"(ret) ++ : [inner_map] "r"(inner_map), [val] "r"(val) ++ : "r8", "r9"); ++ ++ return ret; ++} +-- +2.35.1 + diff --git a/queue-6.1/selftests-net-fix-cmsg_so_mark.sh-test-hang.patch b/queue-6.1/selftests-net-fix-cmsg_so_mark.sh-test-hang.patch new file mode 100644 index 00000000000..d57de3b8708 --- /dev/null +++ b/queue-6.1/selftests-net-fix-cmsg_so_mark.sh-test-hang.patch @@ -0,0 +1,40 @@ +From d22fe71f51e00493f497bf767926ffd1018980d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Dec 2022 13:41:06 +0800 +Subject: selftests: net: fix cmsg_so_mark.sh test hang + +From: Po-Hsu Lin + +[ Upstream commit 1573c6882018f69991aead951d09423ce978adac ] + +This cmsg_so_mark.sh test will hang on non-amd64 systems because of the +infinity loop for argument parsing in cmsg_sender. + +Variable "o" in cs_parse_args() for taking getopt() should be an int, +otherwise it will be 255 when getopt() returns -1 on non-amd64 system +and thus causing infinity loop. + +Link: https://lore.kernel.org/lkml/CA+G9fYsM2k7mrF7W4V_TrZ-qDauWM394=8yEJ=-t1oUg8_40YA@mail.gmail.com/t/ +Signed-off-by: Po-Hsu Lin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/cmsg_sender.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/cmsg_sender.c b/tools/testing/selftests/net/cmsg_sender.c +index 75dd83e39207..24b21b15ed3f 100644 +--- a/tools/testing/selftests/net/cmsg_sender.c ++++ b/tools/testing/selftests/net/cmsg_sender.c +@@ -110,7 +110,7 @@ static void __attribute__((noreturn)) cs_usage(const char *bin) + + static void cs_parse_args(int argc, char *argv[]) + { +- char o; ++ int o; + + while ((o = getopt(argc, argv, "46sS:p:m:M:d:tf:F:c:C:l:L:H:")) != -1) { + switch (o) { +-- +2.35.1 + diff --git a/queue-6.1/series b/queue-6.1/series new file mode 100644 index 00000000000..cf6ade26eb7 --- /dev/null +++ b/queue-6.1/series @@ -0,0 +1,29 @@ +dma-buf-fix-dma_buf_export-init-order-v2.patch +btrfs-fix-trace-event-name-typo-for-flush_delayed_re.patch +wifi-iwlwifi-fw-skip-ppag-for-jf.patch +pnfs-filelayout-fix-coalescing-test-for-single-ds.patch +selftests-bpf-check-null-propagation-only-neither-re.patch +net-ethernet-marvell-octeontx2-fix-uninitialized-var.patch +tools-virtio-initialize-spinlocks-in-vring_test.c.patch +vdpa-mlx5-return-error-on-vlan-ctrl-commands-if-not-.patch +vdpa-mlx5-avoid-using-reslock-in-event_handler.patch +vdpa-mlx5-avoid-overwriting-cvq-iotlb.patch +virtio_pci-modify-enoent-to-einval.patch +vduse-validate-vq_num-in-vduse_validate_config.patch +vdpa_sim_net-should-not-drop-the-multicast-broadcast.patch +net-ethtool-ioctl-return-eopnotsupp-if-we-have-no-ph.patch +r8169-move-rtl_wol_enable_rx-and-rtl_prepare_power_d.patch +r8169-fix-dmar-pte-write-access-is-not-set-error.patch +bpf-keep-a-reference-to-the-mm-in-case-the-task-is-d.patch +rdma-srp-move-large-values-to-a-new-enum-for-gcc13.patch +selftests-net-fix-cmsg_so_mark.sh-test-hang.patch +btrfs-always-report-error-in-run_one_delayed_ref.patch +x86-asm-fix-an-assembler-warning-with-current-binuti.patch +f2fs-let-s-avoid-panic-if-extent_tree-is-not-created.patch +perf-x86-rapl-treat-tigerlake-like-icelake.patch +cifs-fix-race-in-assemble_neg_contexts.patch +memblock-tests-fix-compilation-error.patch +perf-x86-rapl-add-support-for-intel-meteor-lake.patch +perf-x86-rapl-add-support-for-intel-emerald-rapids.patch +of-fdt-honor-config_cmdline-even-without-chosen-node.patch +fbdev-omapfb-avoid-stack-overflow-warning.patch diff --git a/queue-6.1/tools-virtio-initialize-spinlocks-in-vring_test.c.patch b/queue-6.1/tools-virtio-initialize-spinlocks-in-vring_test.c.patch new file mode 100644 index 00000000000..9182c57dc00 --- /dev/null +++ b/queue-6.1/tools-virtio-initialize-spinlocks-in-vring_test.c.patch @@ -0,0 +1,48 @@ +From 7372f8867b1066f405c3f9c50cd60f2856ae1907 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Oct 2022 08:29:49 +0200 +Subject: tools/virtio: initialize spinlocks in vring_test.c +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ricardo Cañuelo + +[ Upstream commit c262f75cb6bb5a63828e72ce3b8fe808e5029479 ] + +The virtio_device vqs_list spinlocks must be initialized before use to +prevent functions that manipulate the device virtualqueues, such as +vring_new_virtqueue(), from blocking indefinitely. + +Signed-off-by: Ricardo Cañuelo +Message-Id: <20221012062949.1526176-1-ricardo.canuelo@collabora.com> +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Xuan Zhuo +Signed-off-by: Sasha Levin +--- + tools/virtio/vringh_test.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/virtio/vringh_test.c b/tools/virtio/vringh_test.c +index fa87b58bd5fa..98ff808d6f0c 100644 +--- a/tools/virtio/vringh_test.c ++++ b/tools/virtio/vringh_test.c +@@ -308,6 +308,7 @@ static int parallel_test(u64 features, + + gvdev.vdev.features = features; + INIT_LIST_HEAD(&gvdev.vdev.vqs); ++ spin_lock_init(&gvdev.vdev.vqs_list_lock); + gvdev.to_host_fd = to_host[1]; + gvdev.notifies = 0; + +@@ -455,6 +456,7 @@ int main(int argc, char *argv[]) + getrange = getrange_iov; + vdev.features = 0; + INIT_LIST_HEAD(&vdev.vqs); ++ spin_lock_init(&vdev.vqs_list_lock); + + while (argv[1]) { + if (strcmp(argv[1], "--indirect") == 0) +-- +2.35.1 + diff --git a/queue-6.1/vdpa-mlx5-avoid-overwriting-cvq-iotlb.patch b/queue-6.1/vdpa-mlx5-avoid-overwriting-cvq-iotlb.patch new file mode 100644 index 00000000000..a81b71e87be --- /dev/null +++ b/queue-6.1/vdpa-mlx5-avoid-overwriting-cvq-iotlb.patch @@ -0,0 +1,245 @@ +From fb1282bad1af1b75d79bfff427a158538bbb72ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 15:17:56 +0200 +Subject: vdpa/mlx5: Avoid overwriting CVQ iotlb +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Eli Cohen + +[ Upstream commit 38fc462f57ef4e5dc722bab6824854b105de8aa2 ] + +When qemu uses different address spaces for data and control virtqueues, +the current code would overwrite the control virtqueue iotlb through the +dup_iotlb call. Fix this by referring to the address space identifier +and the group to asid mapping to determine which mapping needs to be +updated. We also move the address space logic from mlx5 net to core +directory. + +Reported-by: Eugenio Pérez +Signed-off-by: Eli Cohen +Message-Id: <20221114131759.57883-6-elic@nvidia.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Acked-by: Eugenio Pérez +Signed-off-by: Sasha Levin +--- + drivers/vdpa/mlx5/core/mlx5_vdpa.h | 5 +-- + drivers/vdpa/mlx5/core/mr.c | 44 ++++++++++++++++----------- + drivers/vdpa/mlx5/net/mlx5_vnet.c | 49 ++++++------------------------ + 3 files changed, 39 insertions(+), 59 deletions(-) + +diff --git a/drivers/vdpa/mlx5/core/mlx5_vdpa.h b/drivers/vdpa/mlx5/core/mlx5_vdpa.h +index 6af9fdbb86b7..058fbe28107e 100644 +--- a/drivers/vdpa/mlx5/core/mlx5_vdpa.h ++++ b/drivers/vdpa/mlx5/core/mlx5_vdpa.h +@@ -116,8 +116,9 @@ int mlx5_vdpa_create_mkey(struct mlx5_vdpa_dev *mvdev, u32 *mkey, u32 *in, + int inlen); + int mlx5_vdpa_destroy_mkey(struct mlx5_vdpa_dev *mvdev, u32 mkey); + int mlx5_vdpa_handle_set_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb, +- bool *change_map); +-int mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb); ++ bool *change_map, unsigned int asid); ++int mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb, ++ unsigned int asid); + void mlx5_vdpa_destroy_mr(struct mlx5_vdpa_dev *mvdev); + + #define mlx5_vdpa_warn(__dev, format, ...) \ +diff --git a/drivers/vdpa/mlx5/core/mr.c b/drivers/vdpa/mlx5/core/mr.c +index a639b9208d41..a4d7ee2339fa 100644 +--- a/drivers/vdpa/mlx5/core/mr.c ++++ b/drivers/vdpa/mlx5/core/mr.c +@@ -511,7 +511,8 @@ void mlx5_vdpa_destroy_mr(struct mlx5_vdpa_dev *mvdev) + mutex_unlock(&mr->mkey_mtx); + } + +-static int _mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb) ++static int _mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev, ++ struct vhost_iotlb *iotlb, unsigned int asid) + { + struct mlx5_vdpa_mr *mr = &mvdev->mr; + int err; +@@ -519,42 +520,49 @@ static int _mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb + if (mr->initialized) + return 0; + +- if (iotlb) +- err = create_user_mr(mvdev, iotlb); +- else +- err = create_dma_mr(mvdev, mr); ++ if (mvdev->group2asid[MLX5_VDPA_DATAVQ_GROUP] == asid) { ++ if (iotlb) ++ err = create_user_mr(mvdev, iotlb); ++ else ++ err = create_dma_mr(mvdev, mr); + +- if (err) +- return err; ++ if (err) ++ return err; ++ } + +- err = dup_iotlb(mvdev, iotlb); +- if (err) +- goto out_err; ++ if (mvdev->group2asid[MLX5_VDPA_CVQ_GROUP] == asid) { ++ err = dup_iotlb(mvdev, iotlb); ++ if (err) ++ goto out_err; ++ } + + mr->initialized = true; + return 0; + + out_err: +- if (iotlb) +- destroy_user_mr(mvdev, mr); +- else +- destroy_dma_mr(mvdev, mr); ++ if (mvdev->group2asid[MLX5_VDPA_DATAVQ_GROUP] == asid) { ++ if (iotlb) ++ destroy_user_mr(mvdev, mr); ++ else ++ destroy_dma_mr(mvdev, mr); ++ } + + return err; + } + +-int mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb) ++int mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb, ++ unsigned int asid) + { + int err; + + mutex_lock(&mvdev->mr.mkey_mtx); +- err = _mlx5_vdpa_create_mr(mvdev, iotlb); ++ err = _mlx5_vdpa_create_mr(mvdev, iotlb, asid); + mutex_unlock(&mvdev->mr.mkey_mtx); + return err; + } + + int mlx5_vdpa_handle_set_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb, +- bool *change_map) ++ bool *change_map, unsigned int asid) + { + struct mlx5_vdpa_mr *mr = &mvdev->mr; + int err = 0; +@@ -566,7 +574,7 @@ int mlx5_vdpa_handle_set_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *io + *change_map = true; + } + if (!*change_map) +- err = _mlx5_vdpa_create_mr(mvdev, iotlb); ++ err = _mlx5_vdpa_create_mr(mvdev, iotlb, asid); + mutex_unlock(&mr->mkey_mtx); + + return err; +diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c +index 98dd8ce8af26..3a6dbbc6440d 100644 +--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c ++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c +@@ -2394,7 +2394,8 @@ static void restore_channels_info(struct mlx5_vdpa_net *ndev) + } + } + +-static int mlx5_vdpa_change_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb) ++static int mlx5_vdpa_change_map(struct mlx5_vdpa_dev *mvdev, ++ struct vhost_iotlb *iotlb, unsigned int asid) + { + struct mlx5_vdpa_net *ndev = to_mlx5_vdpa_ndev(mvdev); + int err; +@@ -2406,7 +2407,7 @@ static int mlx5_vdpa_change_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb + + teardown_driver(ndev); + mlx5_vdpa_destroy_mr(mvdev); +- err = mlx5_vdpa_create_mr(mvdev, iotlb); ++ err = mlx5_vdpa_create_mr(mvdev, iotlb, asid); + if (err) + goto err_mr; + +@@ -2587,7 +2588,7 @@ static int mlx5_vdpa_reset(struct vdpa_device *vdev) + ++mvdev->generation; + + if (MLX5_CAP_GEN(mvdev->mdev, umem_uid_0)) { +- if (mlx5_vdpa_create_mr(mvdev, NULL)) ++ if (mlx5_vdpa_create_mr(mvdev, NULL, 0)) + mlx5_vdpa_warn(mvdev, "create MR failed\n"); + } + up_write(&ndev->reslock); +@@ -2623,41 +2624,20 @@ static u32 mlx5_vdpa_get_generation(struct vdpa_device *vdev) + return mvdev->generation; + } + +-static int set_map_control(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb) +-{ +- u64 start = 0ULL, last = 0ULL - 1; +- struct vhost_iotlb_map *map; +- int err = 0; +- +- spin_lock(&mvdev->cvq.iommu_lock); +- vhost_iotlb_reset(mvdev->cvq.iotlb); +- +- for (map = vhost_iotlb_itree_first(iotlb, start, last); map; +- map = vhost_iotlb_itree_next(map, start, last)) { +- err = vhost_iotlb_add_range(mvdev->cvq.iotlb, map->start, +- map->last, map->addr, map->perm); +- if (err) +- goto out; +- } +- +-out: +- spin_unlock(&mvdev->cvq.iommu_lock); +- return err; +-} +- +-static int set_map_data(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb) ++static int set_map_data(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb, ++ unsigned int asid) + { + bool change_map; + int err; + +- err = mlx5_vdpa_handle_set_map(mvdev, iotlb, &change_map); ++ err = mlx5_vdpa_handle_set_map(mvdev, iotlb, &change_map, asid); + if (err) { + mlx5_vdpa_warn(mvdev, "set map failed(%d)\n", err); + return err; + } + + if (change_map) +- err = mlx5_vdpa_change_map(mvdev, iotlb); ++ err = mlx5_vdpa_change_map(mvdev, iotlb, asid); + + return err; + } +@@ -2670,16 +2650,7 @@ static int mlx5_vdpa_set_map(struct vdpa_device *vdev, unsigned int asid, + int err = -EINVAL; + + down_write(&ndev->reslock); +- if (mvdev->group2asid[MLX5_VDPA_DATAVQ_GROUP] == asid) { +- err = set_map_data(mvdev, iotlb); +- if (err) +- goto out; +- } +- +- if (mvdev->group2asid[MLX5_VDPA_CVQ_GROUP] == asid) +- err = set_map_control(mvdev, iotlb); +- +-out: ++ err = set_map_data(mvdev, iotlb, asid); + up_write(&ndev->reslock); + return err; + } +@@ -3182,7 +3153,7 @@ static int mlx5_vdpa_dev_add(struct vdpa_mgmt_dev *v_mdev, const char *name, + goto err_mpfs; + + if (MLX5_CAP_GEN(mvdev->mdev, umem_uid_0)) { +- err = mlx5_vdpa_create_mr(mvdev, NULL); ++ err = mlx5_vdpa_create_mr(mvdev, NULL, 0); + if (err) + goto err_res; + } +-- +2.35.1 + diff --git a/queue-6.1/vdpa-mlx5-avoid-using-reslock-in-event_handler.patch b/queue-6.1/vdpa-mlx5-avoid-using-reslock-in-event_handler.patch new file mode 100644 index 00000000000..4fca1428cf3 --- /dev/null +++ b/queue-6.1/vdpa-mlx5-avoid-using-reslock-in-event_handler.patch @@ -0,0 +1,81 @@ +From b586e508c75ae01b0a17e2166683552a05a74373 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 15:17:55 +0200 +Subject: vdpa/mlx5: Avoid using reslock in event_handler + +From: Eli Cohen + +[ Upstream commit 0dbc1b4ae07d003b2e88ba9d4142846320f8e349 ] + +event_handler runs under atomic context and may not acquire reslock. We +can still guarantee that the handler won't be called after suspend by +clearing nb_registered, unregistering the handler and flushing the +workqueue. + +Signed-off-by: Eli Cohen +Message-Id: <20221114131759.57883-5-elic@nvidia.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vdpa/mlx5/net/mlx5_vnet.c | 16 ++++------------ + 1 file changed, 4 insertions(+), 12 deletions(-) + +diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c +index b06260a37680..98dd8ce8af26 100644 +--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c ++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c +@@ -2845,8 +2845,8 @@ static int mlx5_vdpa_suspend(struct vdpa_device *vdev) + int i; + + down_write(&ndev->reslock); +- mlx5_notifier_unregister(mvdev->mdev, &ndev->nb); + ndev->nb_registered = false; ++ mlx5_notifier_unregister(mvdev->mdev, &ndev->nb); + flush_workqueue(ndev->mvdev.wq); + for (i = 0; i < ndev->cur_num_vqs; i++) { + mvq = &ndev->vqs[i]; +@@ -3024,7 +3024,7 @@ static void update_carrier(struct work_struct *work) + else + ndev->config.status &= cpu_to_mlx5vdpa16(mvdev, ~VIRTIO_NET_S_LINK_UP); + +- if (ndev->config_cb.callback) ++ if (ndev->nb_registered && ndev->config_cb.callback) + ndev->config_cb.callback(ndev->config_cb.private); + + kfree(wqent); +@@ -3041,21 +3041,13 @@ static int event_handler(struct notifier_block *nb, unsigned long event, void *p + switch (eqe->sub_type) { + case MLX5_PORT_CHANGE_SUBTYPE_DOWN: + case MLX5_PORT_CHANGE_SUBTYPE_ACTIVE: +- down_read(&ndev->reslock); +- if (!ndev->nb_registered) { +- up_read(&ndev->reslock); +- return NOTIFY_DONE; +- } + wqent = kzalloc(sizeof(*wqent), GFP_ATOMIC); +- if (!wqent) { +- up_read(&ndev->reslock); ++ if (!wqent) + return NOTIFY_DONE; +- } + + wqent->mvdev = &ndev->mvdev; + INIT_WORK(&wqent->work, update_carrier); + queue_work(ndev->mvdev.wq, &wqent->work); +- up_read(&ndev->reslock); + ret = NOTIFY_OK; + break; + default: +@@ -3242,8 +3234,8 @@ static void mlx5_vdpa_dev_del(struct vdpa_mgmt_dev *v_mdev, struct vdpa_device * + struct workqueue_struct *wq; + + if (ndev->nb_registered) { +- mlx5_notifier_unregister(mvdev->mdev, &ndev->nb); + ndev->nb_registered = false; ++ mlx5_notifier_unregister(mvdev->mdev, &ndev->nb); + } + wq = mvdev->wq; + mvdev->wq = NULL; +-- +2.35.1 + diff --git a/queue-6.1/vdpa-mlx5-return-error-on-vlan-ctrl-commands-if-not-.patch b/queue-6.1/vdpa-mlx5-return-error-on-vlan-ctrl-commands-if-not-.patch new file mode 100644 index 00000000000..b26bef317df --- /dev/null +++ b/queue-6.1/vdpa-mlx5-return-error-on-vlan-ctrl-commands-if-not-.patch @@ -0,0 +1,42 @@ +From 3be151026554b12d30251aafbb3e19bc620d82bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 15:17:53 +0200 +Subject: vdpa/mlx5: Return error on vlan ctrl commands if not supported +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Eli Cohen + +[ Upstream commit 5aec804936bbff182081f1cdc271fcb76af1a4ff ] + +Check if VIRTIO_NET_F_CTRL_VLAN is negotiated and return error if +control VQ command is received. + +Signed-off-by: Eli Cohen +Message-Id: <20221114131759.57883-3-elic@nvidia.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Acked-by: Eugenio Pérez +Signed-off-by: Sasha Levin +--- + drivers/vdpa/mlx5/net/mlx5_vnet.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c +index 444d6572b2d0..b06260a37680 100644 +--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c ++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c +@@ -1823,6 +1823,9 @@ static virtio_net_ctrl_ack handle_ctrl_vlan(struct mlx5_vdpa_dev *mvdev, u8 cmd) + size_t read; + u16 id; + ++ if (!(ndev->mvdev.actual_features & BIT_ULL(VIRTIO_NET_F_CTRL_VLAN))) ++ return status; ++ + switch (cmd) { + case VIRTIO_NET_CTRL_VLAN_ADD: + read = vringh_iov_pull_iotlb(&cvq->vring, &cvq->riov, &vlan, sizeof(vlan)); +-- +2.35.1 + diff --git a/queue-6.1/vdpa_sim_net-should-not-drop-the-multicast-broadcast.patch b/queue-6.1/vdpa_sim_net-should-not-drop-the-multicast-broadcast.patch new file mode 100644 index 00000000000..fff4bbbb748 --- /dev/null +++ b/queue-6.1/vdpa_sim_net-should-not-drop-the-multicast-broadcast.patch @@ -0,0 +1,38 @@ +From 5e2bf956726c15969b22225412b4c9d51d8bb747 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Dec 2022 13:43:06 +0800 +Subject: vdpa_sim_net: should not drop the multicast/broadcast packet + +From: Cindy Lu + +[ Upstream commit 72455a1142527e607e1d69439f3ffa2ef6d09e26 ] + +In the receive_filter(), should not drop the packet with the +broadcast/multicast address. Add the check for this + +Signed-off-by: Cindy Lu +Message-Id: <20221214054306.24145-1-lulu@redhat.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Signed-off-by: Sasha Levin +--- + drivers/vdpa/vdpa_sim/vdpa_sim_net.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/vdpa/vdpa_sim/vdpa_sim_net.c b/drivers/vdpa/vdpa_sim/vdpa_sim_net.c +index 11f5a121df24..584b975a98a7 100644 +--- a/drivers/vdpa/vdpa_sim/vdpa_sim_net.c ++++ b/drivers/vdpa/vdpa_sim/vdpa_sim_net.c +@@ -62,6 +62,9 @@ static bool receive_filter(struct vdpasim *vdpasim, size_t len) + if (len < ETH_ALEN + hdr_len) + return false; + ++ if (is_broadcast_ether_addr(vdpasim->buffer + hdr_len) || ++ is_multicast_ether_addr(vdpasim->buffer + hdr_len)) ++ return true; + if (!strncmp(vdpasim->buffer + hdr_len, vio_config->mac, ETH_ALEN)) + return true; + +-- +2.35.1 + diff --git a/queue-6.1/vduse-validate-vq_num-in-vduse_validate_config.patch b/queue-6.1/vduse-validate-vq_num-in-vduse_validate_config.patch new file mode 100644 index 00000000000..7512d51bcd8 --- /dev/null +++ b/queue-6.1/vduse-validate-vq_num-in-vduse_validate_config.patch @@ -0,0 +1,48 @@ +From a3b24fb7a17fd90fe95277f2882a66d26cfee806 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Nov 2022 07:57:15 -0800 +Subject: vduse: Validate vq_num in vduse_validate_config() + +From: Harshit Mogalapalli + +[ Upstream commit 937c783aa3d8d77963ec91918d3298edb45b9161 ] + +Add a limit to 'config->vq_num' which is user controlled data which +comes from an vduse_ioctl to prevent large memory allocations. + +Micheal says - This limit is somewhat arbitrary. +However, currently virtio pci and ccw are limited to a 16 bit vq number. +While MMIO isn't it is also isn't used with lots of VQs due to +current lack of support for per-vq interrupts. +Thus, the 0xffff limit on number of VQs corresponding +to a 16-bit VQ number seems sufficient for now. + +This is found using static analysis with smatch. + +Suggested-by: Michael S. Tsirkin +Signed-off-by: Harshit Mogalapalli +Message-Id: <20221128155717.2579992-1-harshit.m.mogalapalli@oracle.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Signed-off-by: Sasha Levin +--- + drivers/vdpa/vdpa_user/vduse_dev.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/vdpa/vdpa_user/vduse_dev.c b/drivers/vdpa/vdpa_user/vduse_dev.c +index 35dceee3ed56..31017ebc4d7c 100644 +--- a/drivers/vdpa/vdpa_user/vduse_dev.c ++++ b/drivers/vdpa/vdpa_user/vduse_dev.c +@@ -1440,6 +1440,9 @@ static bool vduse_validate_config(struct vduse_dev_config *config) + if (config->config_size > PAGE_SIZE) + return false; + ++ if (config->vq_num > 0xffff) ++ return false; ++ + if (!device_is_allowed(config->device_id)) + return false; + +-- +2.35.1 + diff --git a/queue-6.1/virtio_pci-modify-enoent-to-einval.patch b/queue-6.1/virtio_pci-modify-enoent-to-einval.patch new file mode 100644 index 00000000000..3c335dd940c --- /dev/null +++ b/queue-6.1/virtio_pci-modify-enoent-to-einval.patch @@ -0,0 +1,39 @@ +From b97590a31aa3757a945883c5593ece254fc8b055 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Nov 2022 19:16:54 +0800 +Subject: virtio_pci: modify ENOENT to EINVAL + +From: Angus Chen + +[ Upstream commit b66ead2d0ecac00c3a06a6218af5411cb5fcb5d5 ] + +Virtio_crypto use max_data_queues+1 to setup vqs, +we use vp_modern_get_num_queues to protect the vq range in setup_vq. +We could enter index >= vp_modern_get_num_queues(mdev) in setup_vq +if common->num_queues is not set well,and it return -ENOENT. +It is better to use -EINVAL instead. + +Signed-off-by: Angus Chen +Message-Id: <20221101111655.1947-1-angus.chen@jaguarmicro.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_pci_modern.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/virtio/virtio_pci_modern.c b/drivers/virtio/virtio_pci_modern.c +index c3b9f2761849..edf2e18014cd 100644 +--- a/drivers/virtio/virtio_pci_modern.c ++++ b/drivers/virtio/virtio_pci_modern.c +@@ -303,7 +303,7 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev, + int err; + + if (index >= vp_modern_get_num_queues(mdev)) +- return ERR_PTR(-ENOENT); ++ return ERR_PTR(-EINVAL); + + /* Check if queue is either not available or already active. */ + num = vp_modern_get_queue_size(mdev, index); +-- +2.35.1 + diff --git a/queue-6.1/wifi-iwlwifi-fw-skip-ppag-for-jf.patch b/queue-6.1/wifi-iwlwifi-fw-skip-ppag-for-jf.patch new file mode 100644 index 00000000000..55bb1c377f8 --- /dev/null +++ b/queue-6.1/wifi-iwlwifi-fw-skip-ppag-for-jf.patch @@ -0,0 +1,46 @@ +From 5b16c1aaae72edd3f895da027a532ee6a740df7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Dec 2022 23:15:04 +0200 +Subject: wifi: iwlwifi: fw: skip PPAG for JF +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Johannes Berg + +[ Upstream commit 1c4c0b28b517d778d37900deedfe91088839f07a ] + +For JF RFs we don't support PPAG, but many firmware +images lie about it. Always skip support for JF to +avoid firmware errors when sending the command. + +Reported-and-tested-by: Íñigo Huguet +Link: https://lore.kernel.org/linux-wireless/CACT4oufQsqHGp6bah2c4+jPn2wG1oZqY=UKa_TmPx=F6Lxng8Q@mail.gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Gregory Greenman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221213225723.2a43415d8990.I9ac210740a45b41f1b2e15274e1daf4284f2808a@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c +index e6d64152c81a..a02e5a67b706 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c +@@ -1106,6 +1106,11 @@ int iwl_read_ppag_table(struct iwl_fw_runtime *fwrt, union iwl_ppag_table_cmd *c + int i, j, num_sub_bands; + s8 *gain; + ++ /* many firmware images for JF lie about this */ ++ if (CSR_HW_RFID_TYPE(fwrt->trans->hw_rf_id) == ++ CSR_HW_RFID_TYPE(CSR_HW_RF_ID_TYPE_JF)) ++ return -EOPNOTSUPP; ++ + if (!fw_has_capa(&fwrt->fw->ucode_capa, IWL_UCODE_TLV_CAPA_SET_PPAG)) { + IWL_DEBUG_RADIO(fwrt, + "PPAG capability not supported by FW, command not sent.\n"); +-- +2.35.1 + diff --git a/queue-6.1/x86-asm-fix-an-assembler-warning-with-current-binuti.patch b/queue-6.1/x86-asm-fix-an-assembler-warning-with-current-binuti.patch new file mode 100644 index 00000000000..36f0c3759a1 --- /dev/null +++ b/queue-6.1/x86-asm-fix-an-assembler-warning-with-current-binuti.patch @@ -0,0 +1,34 @@ +From b4093d2c81cfbc6e4eff5f0c573f6af83126b6f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Jan 2023 10:24:11 -0500 +Subject: x86/asm: Fix an assembler warning with current binutils + +From: Mikulas Patocka + +[ Upstream commit 55d235361fccef573990dfa5724ab453866e7816 ] + +Fix a warning: "found `movsd'; assuming `movsl' was meant" + +Signed-off-by: Mikulas Patocka +Signed-off-by: Ingo Molnar +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/lib/iomap_copy_64.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/lib/iomap_copy_64.S b/arch/x86/lib/iomap_copy_64.S +index a1f9416bf67a..6ff2f56cb0f7 100644 +--- a/arch/x86/lib/iomap_copy_64.S ++++ b/arch/x86/lib/iomap_copy_64.S +@@ -10,6 +10,6 @@ + */ + SYM_FUNC_START(__iowrite32_copy) + movl %edx,%ecx +- rep movsd ++ rep movsl + RET + SYM_FUNC_END(__iowrite32_copy) +-- +2.35.1 +