From 0aee3e894ef75fc6750ec965465aa7e7fbe1f36e Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 30 Jul 2023 21:25:02 -0400 Subject: [PATCH] Fixes for 5.15 Signed-off-by: Sasha Levin --- ...soc-fsl_spdif-silence-output-on-stop.patch | 38 +++ ..._ns87415-mark-ns87560_tf_read-static.patch | 42 ++++ ...ce-code-comment-in-include-uapi-linu.patch | 50 ++++ ...-four-equivalent-goto-tags-in-raid_c.patch | 97 ++++++++ ...ing-reconfig_mutex-unlock-in-raid_ct.patch | 57 +++++ ...-protect-md_stop-with-reconfig_mutex.patch | 65 ++++++ ...rror-handling-mistake-in-psp_sw_init.patch | 44 ++++ ...reno-fix-snapshot-bindless_data-size.patch | 38 +++ ...-drop-enum-dpu_core_perf_data_bus_id.patch | 51 ++++ ...rr_or_null-vs-null-check-in-a5xx_sub.patch | 41 ++++ ...vent-handling-any-completions-after-.patch | 127 ++++++++++ ...rdma-irdma-add-missing-read-barriers.patch | 101 ++++++++ ...ix-data-race-on-cqp-completion-stats.patch | 217 ++++++++++++++++++ ...ma-fix-data-race-on-cqp-request-done.patch | 127 ++++++++++ .../rdma-irdma-report-correct-wc-error.patch | 37 +++ ...ake-check-for-invalid-flags-stricter.patch | 55 +++++ ...crash-when-polling-cq-for-shared-qps.patch | 40 ++++ ...er-fix-wrong-stat-of-cpu_buffer-read.patch | 130 +++++++++++ queue-5.15/series | 19 ++ ...ning-in-trace_buffered_event_disable.patch | 119 ++++++++++ 20 files changed, 1495 insertions(+) create mode 100644 queue-5.15/asoc-fsl_spdif-silence-output-on-stop.patch create mode 100644 queue-5.15/ata-pata_ns87415-mark-ns87560_tf_read-static.patch create mode 100644 queue-5.15/block-fix-a-source-code-comment-in-include-uapi-linu.patch create mode 100644 queue-5.15/dm-raid-clean-up-four-equivalent-goto-tags-in-raid_c.patch create mode 100644 queue-5.15/dm-raid-fix-missing-reconfig_mutex-unlock-in-raid_ct.patch create mode 100644 queue-5.15/dm-raid-protect-md_stop-with-reconfig_mutex.patch create mode 100644 queue-5.15/drm-amd-fix-an-error-handling-mistake-in-psp_sw_init.patch create mode 100644 queue-5.15/drm-msm-adreno-fix-snapshot-bindless_data-size.patch create mode 100644 queue-5.15/drm-msm-dpu-drop-enum-dpu_core_perf_data_bus_id.patch create mode 100644 queue-5.15/drm-msm-fix-is_err_or_null-vs-null-check-in-a5xx_sub.patch create mode 100644 queue-5.15/rdma-bnxt_re-prevent-handling-any-completions-after-.patch create mode 100644 queue-5.15/rdma-irdma-add-missing-read-barriers.patch create mode 100644 queue-5.15/rdma-irdma-fix-data-race-on-cqp-completion-stats.patch create mode 100644 queue-5.15/rdma-irdma-fix-data-race-on-cqp-request-done.patch create mode 100644 queue-5.15/rdma-irdma-report-correct-wc-error.patch create mode 100644 queue-5.15/rdma-mlx4-make-check-for-invalid-flags-stricter.patch create mode 100644 queue-5.15/rdma-mthca-fix-crash-when-polling-cq-for-shared-qps.patch create mode 100644 queue-5.15/ring-buffer-fix-wrong-stat-of-cpu_buffer-read.patch create mode 100644 queue-5.15/tracing-fix-warning-in-trace_buffered_event_disable.patch diff --git a/queue-5.15/asoc-fsl_spdif-silence-output-on-stop.patch b/queue-5.15/asoc-fsl_spdif-silence-output-on-stop.patch new file mode 100644 index 00000000000..62d259535ad --- /dev/null +++ b/queue-5.15/asoc-fsl_spdif-silence-output-on-stop.patch @@ -0,0 +1,38 @@ +From 8ee508b7d074420149a88cc407e09f1e3db7c879 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 18:47:29 +0200 +Subject: ASoC: fsl_spdif: Silence output on stop + +From: Matus Gajdos + +[ Upstream commit 0e4c2b6b0c4a4b4014d9424c27e5e79d185229c5 ] + +Clear TX registers on stop to prevent the SPDIF interface from sending +last written word over and over again. + +Fixes: a2388a498ad2 ("ASoC: fsl: Add S/PDIF CPU DAI driver") +Signed-off-by: Matus Gajdos +Reviewed-by: Fabio Estevam +Link: https://lore.kernel.org/r/20230719164729.19969-1-matuszpd@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_spdif.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/fsl/fsl_spdif.c b/sound/soc/fsl/fsl_spdif.c +index 8b5c3ba48516c..5b107f2555ddb 100644 +--- a/sound/soc/fsl/fsl_spdif.c ++++ b/sound/soc/fsl/fsl_spdif.c +@@ -666,6 +666,8 @@ static int fsl_spdif_trigger(struct snd_pcm_substream *substream, + case SNDRV_PCM_TRIGGER_PAUSE_PUSH: + regmap_update_bits(regmap, REG_SPDIF_SCR, dmaen, 0); + regmap_update_bits(regmap, REG_SPDIF_SIE, intr, 0); ++ regmap_write(regmap, REG_SPDIF_STL, 0x0); ++ regmap_write(regmap, REG_SPDIF_STR, 0x0); + break; + default: + return -EINVAL; +-- +2.40.1 + diff --git a/queue-5.15/ata-pata_ns87415-mark-ns87560_tf_read-static.patch b/queue-5.15/ata-pata_ns87415-mark-ns87560_tf_read-static.patch new file mode 100644 index 00000000000..2e9193a6939 --- /dev/null +++ b/queue-5.15/ata-pata_ns87415-mark-ns87560_tf_read-static.patch @@ -0,0 +1,42 @@ +From e942e608f5a171a55a4ae0608abd70102bd3a532 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jul 2023 22:33:22 +0200 +Subject: ata: pata_ns87415: mark ns87560_tf_read static + +From: Arnd Bergmann + +[ Upstream commit 3fc2febb0f8ffae354820c1772ec008733237cfa ] + +The global function triggers a warning because of the missing prototype + +drivers/ata/pata_ns87415.c:263:6: warning: no previous prototype for 'ns87560_tf_read' [-Wmissing-prototypes] + 263 | void ns87560_tf_read(struct ata_port *ap, struct ata_taskfile *tf) + +There are no other references to this, so just make it static. + +Fixes: c4b5b7b6c4423 ("pata_ns87415: Initial cut at 87415/87560 IDE support") +Reviewed-by: Sergey Shtylyov +Reviewed-by: Serge Semin +Signed-off-by: Arnd Bergmann +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/pata_ns87415.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/ata/pata_ns87415.c b/drivers/ata/pata_ns87415.c +index 9dd6bffefb485..602472d4e693e 100644 +--- a/drivers/ata/pata_ns87415.c ++++ b/drivers/ata/pata_ns87415.c +@@ -260,7 +260,7 @@ static u8 ns87560_check_status(struct ata_port *ap) + * LOCKING: + * Inherited from caller. + */ +-void ns87560_tf_read(struct ata_port *ap, struct ata_taskfile *tf) ++static void ns87560_tf_read(struct ata_port *ap, struct ata_taskfile *tf) + { + struct ata_ioports *ioaddr = &ap->ioaddr; + +-- +2.40.1 + diff --git a/queue-5.15/block-fix-a-source-code-comment-in-include-uapi-linu.patch b/queue-5.15/block-fix-a-source-code-comment-in-include-uapi-linu.patch new file mode 100644 index 00000000000..36f81d88e38 --- /dev/null +++ b/queue-5.15/block-fix-a-source-code-comment-in-include-uapi-linu.patch @@ -0,0 +1,50 @@ +From 6dfc7c1f54b9564d00e2a8fbe5af7e7941894d04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jul 2023 13:14:12 -0700 +Subject: block: Fix a source code comment in include/uapi/linux/blkzoned.h + +From: Bart Van Assche + +[ Upstream commit e0933b526fbfd937c4a8f4e35fcdd49f0e22d411 ] + +Fix the symbolic names for zone conditions in the blkzoned.h header +file. + +Cc: Hannes Reinecke +Cc: Damien Le Moal +Fixes: 6a0cb1bc106f ("block: Implement support for zoned block devices") +Signed-off-by: Bart Van Assche +Reviewed-by: Damien Le Moal +Link: https://lore.kernel.org/r/20230706201422.3987341-1-bvanassche@acm.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + include/uapi/linux/blkzoned.h | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/include/uapi/linux/blkzoned.h b/include/uapi/linux/blkzoned.h +index 656a326821a2b..321965feee354 100644 +--- a/include/uapi/linux/blkzoned.h ++++ b/include/uapi/linux/blkzoned.h +@@ -51,13 +51,13 @@ enum blk_zone_type { + * + * The Zone Condition state machine in the ZBC/ZAC standards maps the above + * deinitions as: +- * - ZC1: Empty | BLK_ZONE_EMPTY ++ * - ZC1: Empty | BLK_ZONE_COND_EMPTY + * - ZC2: Implicit Open | BLK_ZONE_COND_IMP_OPEN + * - ZC3: Explicit Open | BLK_ZONE_COND_EXP_OPEN +- * - ZC4: Closed | BLK_ZONE_CLOSED +- * - ZC5: Full | BLK_ZONE_FULL +- * - ZC6: Read Only | BLK_ZONE_READONLY +- * - ZC7: Offline | BLK_ZONE_OFFLINE ++ * - ZC4: Closed | BLK_ZONE_COND_CLOSED ++ * - ZC5: Full | BLK_ZONE_COND_FULL ++ * - ZC6: Read Only | BLK_ZONE_COND_READONLY ++ * - ZC7: Offline | BLK_ZONE_COND_OFFLINE + * + * Conditions 0x5 to 0xC are reserved by the current ZBC/ZAC spec and should + * be considered invalid. +-- +2.40.1 + diff --git a/queue-5.15/dm-raid-clean-up-four-equivalent-goto-tags-in-raid_c.patch b/queue-5.15/dm-raid-clean-up-four-equivalent-goto-tags-in-raid_c.patch new file mode 100644 index 00000000000..9746886903d --- /dev/null +++ b/queue-5.15/dm-raid-clean-up-four-equivalent-goto-tags-in-raid_c.patch @@ -0,0 +1,97 @@ +From 74d177c0d3f85791a134a8ffb212cc33211446e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Jul 2023 17:21:52 +0800 +Subject: dm raid: clean up four equivalent goto tags in raid_ctr() + +From: Yu Kuai + +[ Upstream commit e74c874eabe2e9173a8fbdad616cd89c70eb8ffd ] + +There are four equivalent goto tags in raid_ctr(), clean them up to +use just one. + +There is no functional change and this is preparation to fix +raid_ctr()'s unprotected md_stop(). + +Signed-off-by: Yu Kuai +Signed-off-by: Mike Snitzer +Stable-dep-of: 7d5fff8982a2 ("dm raid: protect md_stop() with 'reconfig_mutex'") +Signed-off-by: Sasha Levin +--- + drivers/md/dm-raid.c | 27 +++++++++------------------ + 1 file changed, 9 insertions(+), 18 deletions(-) + +diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c +index d3ac3b894bdf5..6d4e287350a33 100644 +--- a/drivers/md/dm-raid.c ++++ b/drivers/md/dm-raid.c +@@ -3258,8 +3258,7 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv) + r = md_start(&rs->md); + if (r) { + ti->error = "Failed to start raid array"; +- mddev_unlock(&rs->md); +- goto bad_md_start; ++ goto bad_unlock; + } + + /* If raid4/5/6 journal mode explicitly requested (only possible with journal dev) -> set it */ +@@ -3267,8 +3266,7 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv) + r = r5c_journal_mode_set(&rs->md, rs->journal_dev.mode); + if (r) { + ti->error = "Failed to set raid4/5/6 journal mode"; +- mddev_unlock(&rs->md); +- goto bad_journal_mode_set; ++ goto bad_unlock; + } + } + +@@ -3278,19 +3276,15 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv) + /* Try to adjust the raid4/5/6 stripe cache size to the stripe size */ + if (rs_is_raid456(rs)) { + r = rs_set_raid456_stripe_cache(rs); +- if (r) { +- mddev_unlock(&rs->md); +- goto bad_stripe_cache; +- } ++ if (r) ++ goto bad_unlock; + } + + /* Now do an early reshape check */ + if (test_bit(RT_FLAG_RESHAPE_RS, &rs->runtime_flags)) { + r = rs_check_reshape(rs); +- if (r) { +- mddev_unlock(&rs->md); +- goto bad_check_reshape; +- } ++ if (r) ++ goto bad_unlock; + + /* Restore new, ctr requested layout to perform check */ + rs_config_restore(rs, &rs_layout); +@@ -3299,8 +3293,7 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv) + r = rs->md.pers->check_reshape(&rs->md); + if (r) { + ti->error = "Reshape check failed"; +- mddev_unlock(&rs->md); +- goto bad_check_reshape; ++ goto bad_unlock; + } + } + } +@@ -3311,10 +3304,8 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv) + mddev_unlock(&rs->md); + return 0; + +-bad_md_start: +-bad_journal_mode_set: +-bad_stripe_cache: +-bad_check_reshape: ++bad_unlock: ++ mddev_unlock(&rs->md); + md_stop(&rs->md); + bad: + raid_set_free(rs); +-- +2.40.1 + diff --git a/queue-5.15/dm-raid-fix-missing-reconfig_mutex-unlock-in-raid_ct.patch b/queue-5.15/dm-raid-fix-missing-reconfig_mutex-unlock-in-raid_ct.patch new file mode 100644 index 00000000000..7da41a1ff8a --- /dev/null +++ b/queue-5.15/dm-raid-fix-missing-reconfig_mutex-unlock-in-raid_ct.patch @@ -0,0 +1,57 @@ +From c5b0e9bc5363c25703c2f2ce42bd2190e6cd6a3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Jul 2023 17:21:51 +0800 +Subject: dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths + +From: Yu Kuai + +[ Upstream commit bae3028799dc4f1109acc4df37c8ff06f2d8f1a0 ] + +In the error paths 'bad_stripe_cache' and 'bad_check_reshape', +'reconfig_mutex' is still held after raid_ctr() returns. + +Fixes: 9dbd1aa3a81c ("dm raid: add reshaping support to the target") +Signed-off-by: Yu Kuai +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-raid.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c +index eba277bb8a1f1..d3ac3b894bdf5 100644 +--- a/drivers/md/dm-raid.c ++++ b/drivers/md/dm-raid.c +@@ -3278,15 +3278,19 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv) + /* Try to adjust the raid4/5/6 stripe cache size to the stripe size */ + if (rs_is_raid456(rs)) { + r = rs_set_raid456_stripe_cache(rs); +- if (r) ++ if (r) { ++ mddev_unlock(&rs->md); + goto bad_stripe_cache; ++ } + } + + /* Now do an early reshape check */ + if (test_bit(RT_FLAG_RESHAPE_RS, &rs->runtime_flags)) { + r = rs_check_reshape(rs); +- if (r) ++ if (r) { ++ mddev_unlock(&rs->md); + goto bad_check_reshape; ++ } + + /* Restore new, ctr requested layout to perform check */ + rs_config_restore(rs, &rs_layout); +@@ -3295,6 +3299,7 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv) + r = rs->md.pers->check_reshape(&rs->md); + if (r) { + ti->error = "Reshape check failed"; ++ mddev_unlock(&rs->md); + goto bad_check_reshape; + } + } +-- +2.40.1 + diff --git a/queue-5.15/dm-raid-protect-md_stop-with-reconfig_mutex.patch b/queue-5.15/dm-raid-protect-md_stop-with-reconfig_mutex.patch new file mode 100644 index 00000000000..c912e53ceeb --- /dev/null +++ b/queue-5.15/dm-raid-protect-md_stop-with-reconfig_mutex.patch @@ -0,0 +1,65 @@ +From 2ae858e67bfd2918d6d1f62724efc16c800fb1c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Jul 2023 17:21:53 +0800 +Subject: dm raid: protect md_stop() with 'reconfig_mutex' + +From: Yu Kuai + +[ Upstream commit 7d5fff8982a2199d49ec067818af7d84d4f95ca0 ] + +__md_stop_writes() and __md_stop() will modify many fields that are +protected by 'reconfig_mutex', and all the callers will grab +'reconfig_mutex' except for md_stop(). + +Also, update md_stop() to make certain 'reconfig_mutex' is held using +lockdep_assert_held(). + +Fixes: 9d09e663d550 ("dm: raid456 basic support") +Signed-off-by: Yu Kuai +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-raid.c | 4 +++- + drivers/md/md.c | 2 ++ + 2 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c +index 6d4e287350a33..8d489933d5792 100644 +--- a/drivers/md/dm-raid.c ++++ b/drivers/md/dm-raid.c +@@ -3305,8 +3305,8 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv) + return 0; + + bad_unlock: +- mddev_unlock(&rs->md); + md_stop(&rs->md); ++ mddev_unlock(&rs->md); + bad: + raid_set_free(rs); + +@@ -3317,7 +3317,9 @@ static void raid_dtr(struct dm_target *ti) + { + struct raid_set *rs = ti->private; + ++ mddev_lock_nointr(&rs->md); + md_stop(&rs->md); ++ mddev_unlock(&rs->md); + raid_set_free(rs); + } + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 5a21aeedc1ba7..89a270d293698 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -6281,6 +6281,8 @@ static void __md_stop(struct mddev *mddev) + + void md_stop(struct mddev *mddev) + { ++ lockdep_assert_held(&mddev->reconfig_mutex); ++ + /* stop the array and free an attached data structures. + * This is called from dm-raid + */ +-- +2.40.1 + diff --git a/queue-5.15/drm-amd-fix-an-error-handling-mistake-in-psp_sw_init.patch b/queue-5.15/drm-amd-fix-an-error-handling-mistake-in-psp_sw_init.patch new file mode 100644 index 00000000000..c25bedbd4da --- /dev/null +++ b/queue-5.15/drm-amd-fix-an-error-handling-mistake-in-psp_sw_init.patch @@ -0,0 +1,44 @@ +From 7f33b89bcb65b6309f8f679b8b4e55e22d0ba000 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jul 2023 00:14:59 -0500 +Subject: drm/amd: Fix an error handling mistake in psp_sw_init() + +From: Mario Limonciello + +[ Upstream commit c01aebeef3ce45f696ffa0a1303cea9b34babb45 ] + +If the second call to amdgpu_bo_create_kernel() fails, the memory +allocated from the first call should be cleared. If the third call +fails, the memory from the second call should be cleared. + +Fixes: b95b5391684b ("drm/amdgpu/psp: move PSP memory alloc from hw_init to sw_init") +Signed-off-by: Mario Limonciello +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index 65744c3bd3648..f305a0f8e9b9a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -341,11 +341,11 @@ static int psp_sw_init(void *handle) + return 0; + + failed2: +- amdgpu_bo_free_kernel(&psp->fw_pri_bo, +- &psp->fw_pri_mc_addr, &psp->fw_pri_buf); +-failed1: + amdgpu_bo_free_kernel(&psp->fence_buf_bo, + &psp->fence_buf_mc_addr, &psp->fence_buf); ++failed1: ++ amdgpu_bo_free_kernel(&psp->fw_pri_bo, ++ &psp->fw_pri_mc_addr, &psp->fw_pri_buf); + return ret; + } + +-- +2.40.1 + diff --git a/queue-5.15/drm-msm-adreno-fix-snapshot-bindless_data-size.patch b/queue-5.15/drm-msm-adreno-fix-snapshot-bindless_data-size.patch new file mode 100644 index 00000000000..95fc083191a --- /dev/null +++ b/queue-5.15/drm-msm-adreno-fix-snapshot-bindless_data-size.patch @@ -0,0 +1,38 @@ +From b7434bf80f28e00e36d0abd51dfd7c9595cade4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jul 2023 10:54:07 -0700 +Subject: drm/msm/adreno: Fix snapshot BINDLESS_DATA size + +From: Rob Clark + +[ Upstream commit bd846ceee9c478d0397428f02696602ba5eb264a ] + +The incorrect size was causing "CP | AHB bus error" when snapshotting +the GPU state on a6xx gen4 (a660 family). + +Closes: https://gitlab.freedesktop.org/drm/msm/-/issues/26 +Signed-off-by: Rob Clark +Reviewed-by: Akhil P Oommen +Fixes: 1707add81551 ("drm/msm/a6xx: Add a6xx gpu state") +Patchwork: https://patchwork.freedesktop.org/patch/546763/ +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a6xx_gpu_state.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.h b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.h +index 2fb58b7098e4b..3bd2065a9d30e 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.h ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.h +@@ -200,7 +200,7 @@ static const struct a6xx_shader_block { + SHADER(A6XX_SP_LB_3_DATA, 0x800), + SHADER(A6XX_SP_LB_4_DATA, 0x800), + SHADER(A6XX_SP_LB_5_DATA, 0x200), +- SHADER(A6XX_SP_CB_BINDLESS_DATA, 0x2000), ++ SHADER(A6XX_SP_CB_BINDLESS_DATA, 0x800), + SHADER(A6XX_SP_CB_LEGACY_DATA, 0x280), + SHADER(A6XX_SP_UAV_DATA, 0x80), + SHADER(A6XX_SP_INST_TAG, 0x80), +-- +2.40.1 + diff --git a/queue-5.15/drm-msm-dpu-drop-enum-dpu_core_perf_data_bus_id.patch b/queue-5.15/drm-msm-dpu-drop-enum-dpu_core_perf_data_bus_id.patch new file mode 100644 index 00000000000..467d1cf1351 --- /dev/null +++ b/queue-5.15/drm-msm-dpu-drop-enum-dpu_core_perf_data_bus_id.patch @@ -0,0 +1,51 @@ +From 1639a50e75ef1ede2faccf3e0f201d897860ad2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 22:39:32 +0300 +Subject: drm/msm/dpu: drop enum dpu_core_perf_data_bus_id + +From: Dmitry Baryshkov + +[ Upstream commit e8383f5cf1b3573ce140a80bfbfd809278ab16d6 ] + +Drop the leftover of bus-client -> interconnect conversion, the enum +dpu_core_perf_data_bus_id. + +Fixes: cb88482e2570 ("drm/msm/dpu: clean up references of DPU custom bus scaling") +Reviewed-by: Konrad Dybcio +Reviewed-by: Abhinav Kumar +Signed-off-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/546048/ +Link: https://lore.kernel.org/r/20230707193942.3806526-2-dmitry.baryshkov@linaro.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.h | 13 ------------- + 1 file changed, 13 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.h +index cf4b9b5964c6c..cd6c3518ba021 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.h +@@ -14,19 +14,6 @@ + + #define DPU_PERF_DEFAULT_MAX_CORE_CLK_RATE 412500000 + +-/** +- * enum dpu_core_perf_data_bus_id - data bus identifier +- * @DPU_CORE_PERF_DATA_BUS_ID_MNOC: DPU/MNOC data bus +- * @DPU_CORE_PERF_DATA_BUS_ID_LLCC: MNOC/LLCC data bus +- * @DPU_CORE_PERF_DATA_BUS_ID_EBI: LLCC/EBI data bus +- */ +-enum dpu_core_perf_data_bus_id { +- DPU_CORE_PERF_DATA_BUS_ID_MNOC, +- DPU_CORE_PERF_DATA_BUS_ID_LLCC, +- DPU_CORE_PERF_DATA_BUS_ID_EBI, +- DPU_CORE_PERF_DATA_BUS_ID_MAX, +-}; +- + /** + * struct dpu_core_perf_params - definition of performance parameters + * @max_per_pipe_ib: maximum instantaneous bandwidth request +-- +2.40.1 + diff --git a/queue-5.15/drm-msm-fix-is_err_or_null-vs-null-check-in-a5xx_sub.patch b/queue-5.15/drm-msm-fix-is_err_or_null-vs-null-check-in-a5xx_sub.patch new file mode 100644 index 00000000000..0c64edc3fda --- /dev/null +++ b/queue-5.15/drm-msm-fix-is_err_or_null-vs-null-check-in-a5xx_sub.patch @@ -0,0 +1,41 @@ +From d5327c031883ca9b583fc22dc8e1970bec5011eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 09:47:38 +0800 +Subject: drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb() + +From: Gaosheng Cui + +[ Upstream commit 6e8a996563ecbe68e49c49abd4aaeef69f11f2dc ] + +The msm_gem_get_vaddr() returns an ERR_PTR() on failure, and a null +is catastrophic here, so we should use IS_ERR_OR_NULL() to check +the return value. + +Fixes: 6a8bd08d0465 ("drm/msm: add sudo flag to submit ioctl") +Signed-off-by: Gaosheng Cui +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Reviewed-by: Akhil P Oommen +Patchwork: https://patchwork.freedesktop.org/patch/547712/ +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c +index ef62900b06128..e9c8111122bd6 100644 +--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c +@@ -90,7 +90,7 @@ static void a5xx_submit_in_rb(struct msm_gpu *gpu, struct msm_gem_submit *submit + * since we've already mapped it once in + * submit_reloc() + */ +- if (WARN_ON(!ptr)) ++ if (WARN_ON(IS_ERR_OR_NULL(ptr))) + return; + + for (i = 0; i < dwords; i++) { +-- +2.40.1 + diff --git a/queue-5.15/rdma-bnxt_re-prevent-handling-any-completions-after-.patch b/queue-5.15/rdma-bnxt_re-prevent-handling-any-completions-after-.patch new file mode 100644 index 00000000000..d1e92764ae9 --- /dev/null +++ b/queue-5.15/rdma-bnxt_re-prevent-handling-any-completions-after-.patch @@ -0,0 +1,127 @@ +From 31d4fcd4747f63309fc5bbba3180ac3f7296314b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jul 2023 01:22:48 -0700 +Subject: RDMA/bnxt_re: Prevent handling any completions after qp destroy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kashyap Desai + +[ Upstream commit b5bbc6551297447d3cca55cf907079e206e9cd82 ] + +HW may generate completions that indicates QP is destroyed. +Driver should not be scheduling any more completion handlers +for this QP, after the QP is destroyed. Since CQs are active +during the QP destroy, driver may still schedule completion +handlers. This can cause a race where the destroy_cq and poll_cq +running simultaneously. + +Snippet of kernel panic while doing bnxt_re driver load unload in loop. +This indicates a poll after the CQ is freed.  + +[77786.481636] Call Trace: +[77786.481640]   +[77786.481644]  bnxt_re_poll_cq+0x14a/0x620 [bnxt_re] +[77786.481658]  ? kvm_clock_read+0x14/0x30 +[77786.481693]  __ib_process_cq+0x57/0x190 [ib_core] +[77786.481728]  ib_cq_poll_work+0x26/0x80 [ib_core] +[77786.481761]  process_one_work+0x1e5/0x3f0 +[77786.481768]  worker_thread+0x50/0x3a0 +[77786.481785]  ? __pfx_worker_thread+0x10/0x10 +[77786.481790]  kthread+0xe2/0x110 +[77786.481794]  ? __pfx_kthread+0x10/0x10 +[77786.481797]  ret_from_fork+0x2c/0x50 + +To avoid this, complete all completion handlers before returning the +destroy QP. If free_cq is called soon after destroy_qp, IB stack +will cancel the CQ work before invoking the destroy_cq verb and +this will prevent any race mentioned. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Signed-off-by: Kashyap Desai +Signed-off-by: Selvin Xavier +Link: https://lore.kernel.org/r/1689322969-25402-2-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 12 ++++++++++++ + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 18 ++++++++++++++++++ + drivers/infiniband/hw/bnxt_re/qplib_fp.h | 1 + + 3 files changed, 31 insertions(+) + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index 843d0b5d99acd..87ee616e69384 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -792,7 +792,10 @@ static int bnxt_re_destroy_gsi_sqp(struct bnxt_re_qp *qp) + int bnxt_re_destroy_qp(struct ib_qp *ib_qp, struct ib_udata *udata) + { + struct bnxt_re_qp *qp = container_of(ib_qp, struct bnxt_re_qp, ib_qp); ++ struct bnxt_qplib_qp *qplib_qp = &qp->qplib_qp; + struct bnxt_re_dev *rdev = qp->rdev; ++ struct bnxt_qplib_nq *scq_nq = NULL; ++ struct bnxt_qplib_nq *rcq_nq = NULL; + unsigned int flags; + int rc; + +@@ -826,6 +829,15 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp, struct ib_udata *udata) + ib_umem_release(qp->rumem); + ib_umem_release(qp->sumem); + ++ /* Flush all the entries of notification queue associated with ++ * given qp. ++ */ ++ scq_nq = qplib_qp->scq->nq; ++ rcq_nq = qplib_qp->rcq->nq; ++ bnxt_re_synchronize_nq(scq_nq); ++ if (scq_nq != rcq_nq) ++ bnxt_re_synchronize_nq(rcq_nq); ++ + return 0; + } + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +index d44b6a5c90b57..f1aa3e19b6de6 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +@@ -386,6 +386,24 @@ static void bnxt_qplib_service_nq(struct tasklet_struct *t) + spin_unlock_bh(&hwq->lock); + } + ++/* bnxt_re_synchronize_nq - self polling notification queue. ++ * @nq - notification queue pointer ++ * ++ * This function will start polling entries of a given notification queue ++ * for all pending entries. ++ * This function is useful to synchronize notification entries while resources ++ * are going away. ++ */ ++ ++void bnxt_re_synchronize_nq(struct bnxt_qplib_nq *nq) ++{ ++ int budget = nq->budget; ++ ++ nq->budget = nq->hwq.max_elements; ++ bnxt_qplib_service_nq(&nq->nq_tasklet); ++ nq->budget = budget; ++} ++ + static irqreturn_t bnxt_qplib_nq_irq(int irq, void *dev_instance) + { + struct bnxt_qplib_nq *nq = dev_instance; +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h +index f859710f9a7f4..49d89c0808275 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h +@@ -548,6 +548,7 @@ int bnxt_qplib_process_flush_list(struct bnxt_qplib_cq *cq, + struct bnxt_qplib_cqe *cqe, + int num_cqes); + void bnxt_qplib_flush_cqn_wq(struct bnxt_qplib_qp *qp); ++void bnxt_re_synchronize_nq(struct bnxt_qplib_nq *nq); + + static inline void *bnxt_qplib_get_swqe(struct bnxt_qplib_q *que, u32 *swq_idx) + { +-- +2.40.1 + diff --git a/queue-5.15/rdma-irdma-add-missing-read-barriers.patch b/queue-5.15/rdma-irdma-add-missing-read-barriers.patch new file mode 100644 index 00000000000..4349c8728af --- /dev/null +++ b/queue-5.15/rdma-irdma-add-missing-read-barriers.patch @@ -0,0 +1,101 @@ +From 7faeeb29116796bc154b40d070f2cef173274f31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jul 2023 12:52:51 -0500 +Subject: RDMA/irdma: Add missing read barriers + +From: Shiraz Saleem + +[ Upstream commit 4984eb51453ff7eddee9e5ce816145be39c0ec5c ] + +On code inspection, there are many instances in the driver where +CEQE and AEQE fields written to by HW are read without guaranteeing +that the polarity bit has been read and checked first. + +Add a read barrier to avoid reordering of loads on the CEQE/AEQE fields +prior to checking the polarity bit. + +Fixes: 3f49d6842569 ("RDMA/irdma: Implement HW Admin Queue OPs") +Signed-off-by: Shiraz Saleem +Link: https://lore.kernel.org/r/20230711175253.1289-2-shiraz.saleem@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/ctrl.c | 9 ++++++++- + drivers/infiniband/hw/irdma/puda.c | 6 ++++++ + drivers/infiniband/hw/irdma/uk.c | 3 +++ + 3 files changed, 17 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/irdma/ctrl.c b/drivers/infiniband/hw/irdma/ctrl.c +index 1ac7067e21be1..ab195ae089cfd 100644 +--- a/drivers/infiniband/hw/irdma/ctrl.c ++++ b/drivers/infiniband/hw/irdma/ctrl.c +@@ -3395,6 +3395,9 @@ enum irdma_status_code irdma_sc_ccq_get_cqe_info(struct irdma_sc_cq *ccq, + if (polarity != ccq->cq_uk.polarity) + return IRDMA_ERR_Q_EMPTY; + ++ /* Ensure CEQE contents are read after valid bit is checked */ ++ dma_rmb(); ++ + get_64bit_val(cqe, 8, &qp_ctx); + cqp = (struct irdma_sc_cqp *)(unsigned long)qp_ctx; + info->error = (bool)FIELD_GET(IRDMA_CQ_ERROR, temp); +@@ -4046,13 +4049,17 @@ enum irdma_status_code irdma_sc_get_next_aeqe(struct irdma_sc_aeq *aeq, + u8 polarity; + + aeqe = IRDMA_GET_CURRENT_AEQ_ELEM(aeq); +- get_64bit_val(aeqe, 0, &compl_ctx); + get_64bit_val(aeqe, 8, &temp); + polarity = (u8)FIELD_GET(IRDMA_AEQE_VALID, temp); + + if (aeq->polarity != polarity) + return IRDMA_ERR_Q_EMPTY; + ++ /* Ensure AEQE contents are read after valid bit is checked */ ++ dma_rmb(); ++ ++ get_64bit_val(aeqe, 0, &compl_ctx); ++ + print_hex_dump_debug("WQE: AEQ_ENTRY WQE", DUMP_PREFIX_OFFSET, 16, 8, + aeqe, 16, false); + +diff --git a/drivers/infiniband/hw/irdma/puda.c b/drivers/infiniband/hw/irdma/puda.c +index 58e7d875643b8..197eba5eb78fa 100644 +--- a/drivers/infiniband/hw/irdma/puda.c ++++ b/drivers/infiniband/hw/irdma/puda.c +@@ -235,6 +235,9 @@ irdma_puda_poll_info(struct irdma_sc_cq *cq, struct irdma_puda_cmpl_info *info) + if (valid_bit != cq_uk->polarity) + return IRDMA_ERR_Q_EMPTY; + ++ /* Ensure CQE contents are read after valid bit is checked */ ++ dma_rmb(); ++ + if (cq->dev->hw_attrs.uk_attrs.hw_rev >= IRDMA_GEN_2) + ext_valid = (bool)FIELD_GET(IRDMA_CQ_EXTCQE, qword3); + +@@ -248,6 +251,9 @@ irdma_puda_poll_info(struct irdma_sc_cq *cq, struct irdma_puda_cmpl_info *info) + if (polarity != cq_uk->polarity) + return IRDMA_ERR_Q_EMPTY; + ++ /* Ensure ext CQE contents are read after ext valid bit is checked */ ++ dma_rmb(); ++ + IRDMA_RING_MOVE_HEAD_NOCHECK(cq_uk->cq_ring); + if (!IRDMA_RING_CURRENT_HEAD(cq_uk->cq_ring)) + cq_uk->polarity = !cq_uk->polarity; +diff --git a/drivers/infiniband/hw/irdma/uk.c b/drivers/infiniband/hw/irdma/uk.c +index a348f0c010ab3..4b00a9adbe3a5 100644 +--- a/drivers/infiniband/hw/irdma/uk.c ++++ b/drivers/infiniband/hw/irdma/uk.c +@@ -1549,6 +1549,9 @@ void irdma_uk_clean_cq(void *q, struct irdma_cq_uk *cq) + if (polarity != temp) + break; + ++ /* Ensure CQE contents are read after valid bit is checked */ ++ dma_rmb(); ++ + get_64bit_val(cqe, 8, &comp_ctx); + if ((void *)(unsigned long)comp_ctx == q) + set_64bit_val(cqe, 8, 0); +-- +2.40.1 + diff --git a/queue-5.15/rdma-irdma-fix-data-race-on-cqp-completion-stats.patch b/queue-5.15/rdma-irdma-fix-data-race-on-cqp-completion-stats.patch new file mode 100644 index 00000000000..4a6f9730623 --- /dev/null +++ b/queue-5.15/rdma-irdma-fix-data-race-on-cqp-completion-stats.patch @@ -0,0 +1,217 @@ +From c2478d95376768c4774675c4c75ba4df4a0b9cf8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jul 2023 12:52:52 -0500 +Subject: RDMA/irdma: Fix data race on CQP completion stats + +From: Shiraz Saleem + +[ Upstream commit f2c3037811381f9149243828c7eb9a1631df9f9c ] + +CQP completion statistics is read lockesly in irdma_wait_event and +irdma_check_cqp_progress while it can be updated in the completion +thread irdma_sc_ccq_get_cqe_info on another CPU as KCSAN reports. + +Make completion statistics an atomic variable to reflect coherent updates +to it. This will also avoid load/store tearing logic bug potentially +possible by compiler optimizations. + +[77346.170861] BUG: KCSAN: data-race in irdma_handle_cqp_op [irdma] / irdma_sc_ccq_get_cqe_info [irdma] + +[77346.171383] write to 0xffff8a3250b108e0 of 8 bytes by task 9544 on cpu 4: +[77346.171483] irdma_sc_ccq_get_cqe_info+0x27a/0x370 [irdma] +[77346.171658] irdma_cqp_ce_handler+0x164/0x270 [irdma] +[77346.171835] cqp_compl_worker+0x1b/0x20 [irdma] +[77346.172009] process_one_work+0x4d1/0xa40 +[77346.172024] worker_thread+0x319/0x700 +[77346.172037] kthread+0x180/0x1b0 +[77346.172054] ret_from_fork+0x22/0x30 + +[77346.172136] read to 0xffff8a3250b108e0 of 8 bytes by task 9838 on cpu 2: +[77346.172234] irdma_handle_cqp_op+0xf4/0x4b0 [irdma] +[77346.172413] irdma_cqp_aeq_cmd+0x75/0xa0 [irdma] +[77346.172592] irdma_create_aeq+0x390/0x45a [irdma] +[77346.172769] irdma_rt_init_hw.cold+0x212/0x85d [irdma] +[77346.172944] irdma_probe+0x54f/0x620 [irdma] +[77346.173122] auxiliary_bus_probe+0x66/0xa0 +[77346.173137] really_probe+0x140/0x540 +[77346.173154] __driver_probe_device+0xc7/0x220 +[77346.173173] driver_probe_device+0x5f/0x140 +[77346.173190] __driver_attach+0xf0/0x2c0 +[77346.173208] bus_for_each_dev+0xa8/0xf0 +[77346.173225] driver_attach+0x29/0x30 +[77346.173240] bus_add_driver+0x29c/0x2f0 +[77346.173255] driver_register+0x10f/0x1a0 +[77346.173272] __auxiliary_driver_register+0xbc/0x140 +[77346.173287] irdma_init_module+0x55/0x1000 [irdma] +[77346.173460] do_one_initcall+0x7d/0x410 +[77346.173475] do_init_module+0x81/0x2c0 +[77346.173491] load_module+0x1232/0x12c0 +[77346.173506] __do_sys_finit_module+0x101/0x180 +[77346.173522] __x64_sys_finit_module+0x3c/0x50 +[77346.173538] do_syscall_64+0x39/0x90 +[77346.173553] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +[77346.173634] value changed: 0x0000000000000094 -> 0x0000000000000095 + +Fixes: 915cc7ac0f8e ("RDMA/irdma: Add miscellaneous utility definitions") +Signed-off-by: Shiraz Saleem +Link: https://lore.kernel.org/r/20230711175253.1289-3-shiraz.saleem@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/ctrl.c | 22 +++++++------- + drivers/infiniband/hw/irdma/defs.h | 46 ++++++++++++++--------------- + drivers/infiniband/hw/irdma/type.h | 2 ++ + drivers/infiniband/hw/irdma/utils.c | 2 +- + 4 files changed, 36 insertions(+), 36 deletions(-) + +diff --git a/drivers/infiniband/hw/irdma/ctrl.c b/drivers/infiniband/hw/irdma/ctrl.c +index ab195ae089cfd..ad14c2404e94c 100644 +--- a/drivers/infiniband/hw/irdma/ctrl.c ++++ b/drivers/infiniband/hw/irdma/ctrl.c +@@ -2741,13 +2741,13 @@ irdma_sc_cq_modify(struct irdma_sc_cq *cq, struct irdma_modify_cq_info *info, + */ + void irdma_check_cqp_progress(struct irdma_cqp_timeout *timeout, struct irdma_sc_dev *dev) + { +- if (timeout->compl_cqp_cmds != dev->cqp_cmd_stats[IRDMA_OP_CMPL_CMDS]) { +- timeout->compl_cqp_cmds = dev->cqp_cmd_stats[IRDMA_OP_CMPL_CMDS]; ++ u64 completed_ops = atomic64_read(&dev->cqp->completed_ops); ++ ++ if (timeout->compl_cqp_cmds != completed_ops) { ++ timeout->compl_cqp_cmds = completed_ops; + timeout->count = 0; +- } else { +- if (dev->cqp_cmd_stats[IRDMA_OP_REQ_CMDS] != +- timeout->compl_cqp_cmds) +- timeout->count++; ++ } else if (timeout->compl_cqp_cmds != dev->cqp->requested_ops) { ++ timeout->count++; + } + } + +@@ -2790,7 +2790,7 @@ static enum irdma_status_code irdma_cqp_poll_registers(struct irdma_sc_cqp *cqp, + if (newtail != tail) { + /* SUCCESS */ + IRDMA_RING_MOVE_TAIL(cqp->sq_ring); +- cqp->dev->cqp_cmd_stats[IRDMA_OP_CMPL_CMDS]++; ++ atomic64_inc(&cqp->completed_ops); + return 0; + } + udelay(cqp->dev->hw_attrs.max_sleep_count); +@@ -3152,8 +3152,8 @@ enum irdma_status_code irdma_sc_cqp_init(struct irdma_sc_cqp *cqp, + info->dev->cqp = cqp; + + IRDMA_RING_INIT(cqp->sq_ring, cqp->sq_size); +- cqp->dev->cqp_cmd_stats[IRDMA_OP_REQ_CMDS] = 0; +- cqp->dev->cqp_cmd_stats[IRDMA_OP_CMPL_CMDS] = 0; ++ cqp->requested_ops = 0; ++ atomic64_set(&cqp->completed_ops, 0); + /* for the cqp commands backlog. */ + INIT_LIST_HEAD(&cqp->dev->cqp_cmd_head); + +@@ -3306,7 +3306,7 @@ __le64 *irdma_sc_cqp_get_next_send_wqe_idx(struct irdma_sc_cqp *cqp, u64 scratch + if (ret_code) + return NULL; + +- cqp->dev->cqp_cmd_stats[IRDMA_OP_REQ_CMDS]++; ++ cqp->requested_ops++; + if (!*wqe_idx) + cqp->polarity = !cqp->polarity; + wqe = cqp->sq_base[*wqe_idx].elem; +@@ -3432,7 +3432,7 @@ enum irdma_status_code irdma_sc_ccq_get_cqe_info(struct irdma_sc_cq *ccq, + dma_wmb(); /* make sure shadow area is updated before moving tail */ + + IRDMA_RING_MOVE_TAIL(cqp->sq_ring); +- ccq->dev->cqp_cmd_stats[IRDMA_OP_CMPL_CMDS]++; ++ atomic64_inc(&cqp->completed_ops); + + return ret_code; + } +diff --git a/drivers/infiniband/hw/irdma/defs.h b/drivers/infiniband/hw/irdma/defs.h +index b8c10a6ccede5..afd16a93ac69c 100644 +--- a/drivers/infiniband/hw/irdma/defs.h ++++ b/drivers/infiniband/hw/irdma/defs.h +@@ -190,32 +190,30 @@ enum irdma_cqp_op_type { + IRDMA_OP_MANAGE_VF_PBLE_BP = 25, + IRDMA_OP_QUERY_FPM_VAL = 26, + IRDMA_OP_COMMIT_FPM_VAL = 27, +- IRDMA_OP_REQ_CMDS = 28, +- IRDMA_OP_CMPL_CMDS = 29, +- IRDMA_OP_AH_CREATE = 30, +- IRDMA_OP_AH_MODIFY = 31, +- IRDMA_OP_AH_DESTROY = 32, +- IRDMA_OP_MC_CREATE = 33, +- IRDMA_OP_MC_DESTROY = 34, +- IRDMA_OP_MC_MODIFY = 35, +- IRDMA_OP_STATS_ALLOCATE = 36, +- IRDMA_OP_STATS_FREE = 37, +- IRDMA_OP_STATS_GATHER = 38, +- IRDMA_OP_WS_ADD_NODE = 39, +- IRDMA_OP_WS_MODIFY_NODE = 40, +- IRDMA_OP_WS_DELETE_NODE = 41, +- IRDMA_OP_WS_FAILOVER_START = 42, +- IRDMA_OP_WS_FAILOVER_COMPLETE = 43, +- IRDMA_OP_SET_UP_MAP = 44, +- IRDMA_OP_GEN_AE = 45, +- IRDMA_OP_QUERY_RDMA_FEATURES = 46, +- IRDMA_OP_ALLOC_LOCAL_MAC_ENTRY = 47, +- IRDMA_OP_ADD_LOCAL_MAC_ENTRY = 48, +- IRDMA_OP_DELETE_LOCAL_MAC_ENTRY = 49, +- IRDMA_OP_CQ_MODIFY = 50, ++ IRDMA_OP_AH_CREATE = 28, ++ IRDMA_OP_AH_MODIFY = 29, ++ IRDMA_OP_AH_DESTROY = 30, ++ IRDMA_OP_MC_CREATE = 31, ++ IRDMA_OP_MC_DESTROY = 32, ++ IRDMA_OP_MC_MODIFY = 33, ++ IRDMA_OP_STATS_ALLOCATE = 34, ++ IRDMA_OP_STATS_FREE = 35, ++ IRDMA_OP_STATS_GATHER = 36, ++ IRDMA_OP_WS_ADD_NODE = 37, ++ IRDMA_OP_WS_MODIFY_NODE = 38, ++ IRDMA_OP_WS_DELETE_NODE = 39, ++ IRDMA_OP_WS_FAILOVER_START = 40, ++ IRDMA_OP_WS_FAILOVER_COMPLETE = 41, ++ IRDMA_OP_SET_UP_MAP = 42, ++ IRDMA_OP_GEN_AE = 43, ++ IRDMA_OP_QUERY_RDMA_FEATURES = 44, ++ IRDMA_OP_ALLOC_LOCAL_MAC_ENTRY = 45, ++ IRDMA_OP_ADD_LOCAL_MAC_ENTRY = 46, ++ IRDMA_OP_DELETE_LOCAL_MAC_ENTRY = 47, ++ IRDMA_OP_CQ_MODIFY = 48, + + /* Must be last entry*/ +- IRDMA_MAX_CQP_OPS = 51, ++ IRDMA_MAX_CQP_OPS = 49, + }; + + /* CQP SQ WQES */ +diff --git a/drivers/infiniband/hw/irdma/type.h b/drivers/infiniband/hw/irdma/type.h +index 1241e5988c101..8b75e2610e5ba 100644 +--- a/drivers/infiniband/hw/irdma/type.h ++++ b/drivers/infiniband/hw/irdma/type.h +@@ -411,6 +411,8 @@ struct irdma_sc_cqp { + struct irdma_dcqcn_cc_params dcqcn_params; + __le64 *host_ctx; + u64 *scratch_array; ++ u64 requested_ops; ++ atomic64_t completed_ops; + u32 cqp_id; + u32 sq_size; + u32 hw_sq_size; +diff --git a/drivers/infiniband/hw/irdma/utils.c b/drivers/infiniband/hw/irdma/utils.c +index 1d9280d46d087..d96779996e026 100644 +--- a/drivers/infiniband/hw/irdma/utils.c ++++ b/drivers/infiniband/hw/irdma/utils.c +@@ -567,7 +567,7 @@ static enum irdma_status_code irdma_wait_event(struct irdma_pci_f *rf, + bool cqp_error = false; + enum irdma_status_code err_code = 0; + +- cqp_timeout.compl_cqp_cmds = rf->sc_dev.cqp_cmd_stats[IRDMA_OP_CMPL_CMDS]; ++ cqp_timeout.compl_cqp_cmds = atomic64_read(&rf->sc_dev.cqp->completed_ops); + do { + irdma_cqp_ce_handler(rf, &rf->ccq.sc_cq); + if (wait_event_timeout(cqp_request->waitq, +-- +2.40.1 + diff --git a/queue-5.15/rdma-irdma-fix-data-race-on-cqp-request-done.patch b/queue-5.15/rdma-irdma-fix-data-race-on-cqp-request-done.patch new file mode 100644 index 00000000000..fdb29224aaf --- /dev/null +++ b/queue-5.15/rdma-irdma-fix-data-race-on-cqp-request-done.patch @@ -0,0 +1,127 @@ +From a151f068e53607ce8c7d22846727db497a525d72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jul 2023 12:52:53 -0500 +Subject: RDMA/irdma: Fix data race on CQP request done + +From: Shiraz Saleem + +[ Upstream commit f0842bb3d38863777e3454da5653d80b5fde6321 ] + +KCSAN detects a data race on cqp_request->request_done memory location +which is accessed locklessly in irdma_handle_cqp_op while being +updated in irdma_cqp_ce_handler. + +Annotate lockless intent with READ_ONCE/WRITE_ONCE to avoid any +compiler optimizations like load fusing and/or KCSAN warning. + +[222808.417128] BUG: KCSAN: data-race in irdma_cqp_ce_handler [irdma] / irdma_wait_event [irdma] + +[222808.417532] write to 0xffff8e44107019dc of 1 bytes by task 29658 on cpu 5: +[222808.417610] irdma_cqp_ce_handler+0x21e/0x270 [irdma] +[222808.417725] cqp_compl_worker+0x1b/0x20 [irdma] +[222808.417827] process_one_work+0x4d1/0xa40 +[222808.417835] worker_thread+0x319/0x700 +[222808.417842] kthread+0x180/0x1b0 +[222808.417852] ret_from_fork+0x22/0x30 + +[222808.417918] read to 0xffff8e44107019dc of 1 bytes by task 29688 on cpu 1: +[222808.417995] irdma_wait_event+0x1e2/0x2c0 [irdma] +[222808.418099] irdma_handle_cqp_op+0xae/0x170 [irdma] +[222808.418202] irdma_cqp_cq_destroy_cmd+0x70/0x90 [irdma] +[222808.418308] irdma_puda_dele_rsrc+0x46d/0x4d0 [irdma] +[222808.418411] irdma_rt_deinit_hw+0x179/0x1d0 [irdma] +[222808.418514] irdma_ib_dealloc_device+0x11/0x40 [irdma] +[222808.418618] ib_dealloc_device+0x2a/0x120 [ib_core] +[222808.418823] __ib_unregister_device+0xde/0x100 [ib_core] +[222808.418981] ib_unregister_device+0x22/0x40 [ib_core] +[222808.419142] irdma_ib_unregister_device+0x70/0x90 [irdma] +[222808.419248] i40iw_close+0x6f/0xc0 [irdma] +[222808.419352] i40e_client_device_unregister+0x14a/0x180 [i40e] +[222808.419450] i40iw_remove+0x21/0x30 [irdma] +[222808.419554] auxiliary_bus_remove+0x31/0x50 +[222808.419563] device_remove+0x69/0xb0 +[222808.419572] device_release_driver_internal+0x293/0x360 +[222808.419582] driver_detach+0x7c/0xf0 +[222808.419592] bus_remove_driver+0x8c/0x150 +[222808.419600] driver_unregister+0x45/0x70 +[222808.419610] auxiliary_driver_unregister+0x16/0x30 +[222808.419618] irdma_exit_module+0x18/0x1e [irdma] +[222808.419733] __do_sys_delete_module.constprop.0+0x1e2/0x310 +[222808.419745] __x64_sys_delete_module+0x1b/0x30 +[222808.419755] do_syscall_64+0x39/0x90 +[222808.419763] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +[222808.419829] value changed: 0x01 -> 0x03 + +Fixes: 915cc7ac0f8e ("RDMA/irdma: Add miscellaneous utility definitions") +Signed-off-by: Shiraz Saleem +Link: https://lore.kernel.org/r/20230711175253.1289-4-shiraz.saleem@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/hw.c | 2 +- + drivers/infiniband/hw/irdma/main.h | 2 +- + drivers/infiniband/hw/irdma/utils.c | 6 +++--- + 3 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c +index 2159470d7f7f4..0221200e16541 100644 +--- a/drivers/infiniband/hw/irdma/hw.c ++++ b/drivers/infiniband/hw/irdma/hw.c +@@ -2084,7 +2084,7 @@ void irdma_cqp_ce_handler(struct irdma_pci_f *rf, struct irdma_sc_cq *cq) + cqp_request->compl_info.error = info.error; + + if (cqp_request->waiting) { +- cqp_request->request_done = true; ++ WRITE_ONCE(cqp_request->request_done, true); + wake_up(&cqp_request->waitq); + irdma_put_cqp_request(&rf->cqp, cqp_request); + } else { +diff --git a/drivers/infiniband/hw/irdma/main.h b/drivers/infiniband/hw/irdma/main.h +index 454b4b370386c..f2e2bc50c6f7b 100644 +--- a/drivers/infiniband/hw/irdma/main.h ++++ b/drivers/infiniband/hw/irdma/main.h +@@ -160,8 +160,8 @@ struct irdma_cqp_request { + void (*callback_fcn)(struct irdma_cqp_request *cqp_request); + void *param; + struct irdma_cqp_compl_info compl_info; ++ bool request_done; /* READ/WRITE_ONCE macros operate on it */ + bool waiting:1; +- bool request_done:1; + bool dynamic:1; + }; + +diff --git a/drivers/infiniband/hw/irdma/utils.c b/drivers/infiniband/hw/irdma/utils.c +index d96779996e026..a47eedb6df82f 100644 +--- a/drivers/infiniband/hw/irdma/utils.c ++++ b/drivers/infiniband/hw/irdma/utils.c +@@ -481,7 +481,7 @@ void irdma_free_cqp_request(struct irdma_cqp *cqp, + if (cqp_request->dynamic) { + kfree(cqp_request); + } else { +- cqp_request->request_done = false; ++ WRITE_ONCE(cqp_request->request_done, false); + cqp_request->callback_fcn = NULL; + cqp_request->waiting = false; + +@@ -515,7 +515,7 @@ irdma_free_pending_cqp_request(struct irdma_cqp *cqp, + { + if (cqp_request->waiting) { + cqp_request->compl_info.error = true; +- cqp_request->request_done = true; ++ WRITE_ONCE(cqp_request->request_done, true); + wake_up(&cqp_request->waitq); + } + wait_event_timeout(cqp->remove_wq, +@@ -571,7 +571,7 @@ static enum irdma_status_code irdma_wait_event(struct irdma_pci_f *rf, + do { + irdma_cqp_ce_handler(rf, &rf->ccq.sc_cq); + if (wait_event_timeout(cqp_request->waitq, +- cqp_request->request_done, ++ READ_ONCE(cqp_request->request_done), + msecs_to_jiffies(CQP_COMPL_WAIT_TIME_MS))) + break; + +-- +2.40.1 + diff --git a/queue-5.15/rdma-irdma-report-correct-wc-error.patch b/queue-5.15/rdma-irdma-report-correct-wc-error.patch new file mode 100644 index 00000000000..63cfea8ded0 --- /dev/null +++ b/queue-5.15/rdma-irdma-report-correct-wc-error.patch @@ -0,0 +1,37 @@ +From f85b41930a3090ea3d3da79e3f5a45daac56c1d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 10:54:38 -0500 +Subject: RDMA/irdma: Report correct WC error + +From: Sindhu Devale + +[ Upstream commit ae463563b7a1b7d4a3d0b065b09d37a76b693937 ] + +Report the correct WC error if a MW bind is performed +on an already valid/bound window. + +Fixes: 44d9e52977a1 ("RDMA/irdma: Implement device initialization definitions") +Signed-off-by: Sindhu Devale +Signed-off-by: Shiraz Saleem +Link: https://lore.kernel.org/r/20230725155439.1057-2-shiraz.saleem@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/hw.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c +index 0221200e16541..70dffa9a9f674 100644 +--- a/drivers/infiniband/hw/irdma/hw.c ++++ b/drivers/infiniband/hw/irdma/hw.c +@@ -191,6 +191,7 @@ static void irdma_set_flush_fields(struct irdma_sc_qp *qp, + case IRDMA_AE_AMP_MWBIND_INVALID_RIGHTS: + case IRDMA_AE_AMP_MWBIND_BIND_DISABLED: + case IRDMA_AE_AMP_MWBIND_INVALID_BOUNDS: ++ case IRDMA_AE_AMP_MWBIND_VALID_STAG: + qp->flush_code = FLUSH_MW_BIND_ERR; + qp->event_type = IRDMA_QP_EVENT_ACCESS_ERR; + break; +-- +2.40.1 + diff --git a/queue-5.15/rdma-mlx4-make-check-for-invalid-flags-stricter.patch b/queue-5.15/rdma-mlx4-make-check-for-invalid-flags-stricter.patch new file mode 100644 index 00000000000..5589bb79ac0 --- /dev/null +++ b/queue-5.15/rdma-mlx4-make-check-for-invalid-flags-stricter.patch @@ -0,0 +1,55 @@ +From dbbe97b0d1355fdf2076b1fd3c60a0e554ef88cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 09:07:37 +0300 +Subject: RDMA/mlx4: Make check for invalid flags stricter + +From: Dan Carpenter + +[ Upstream commit d64b1ee12a168030fbb3e0aebf7bce49e9a07589 ] + +This code is trying to ensure that only the flags specified in the list +are allowed. The problem is that ucmd->rx_hash_fields_mask is a u64 and +the flags are an enum which is treated as a u32 in this context. That +means the test doesn't check whether the highest 32 bits are zero. + +Fixes: 4d02ebd9bbbd ("IB/mlx4: Fix RSS hash fields restrictions") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/233ed975-982d-422a-b498-410f71d8a101@moroto.mountain +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx4/qp.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c +index ec545b8858cc0..43b2aad845917 100644 +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -530,15 +530,15 @@ static int set_qp_rss(struct mlx4_ib_dev *dev, struct mlx4_ib_rss *rss_ctx, + return (-EOPNOTSUPP); + } + +- if (ucmd->rx_hash_fields_mask & ~(MLX4_IB_RX_HASH_SRC_IPV4 | +- MLX4_IB_RX_HASH_DST_IPV4 | +- MLX4_IB_RX_HASH_SRC_IPV6 | +- MLX4_IB_RX_HASH_DST_IPV6 | +- MLX4_IB_RX_HASH_SRC_PORT_TCP | +- MLX4_IB_RX_HASH_DST_PORT_TCP | +- MLX4_IB_RX_HASH_SRC_PORT_UDP | +- MLX4_IB_RX_HASH_DST_PORT_UDP | +- MLX4_IB_RX_HASH_INNER)) { ++ if (ucmd->rx_hash_fields_mask & ~(u64)(MLX4_IB_RX_HASH_SRC_IPV4 | ++ MLX4_IB_RX_HASH_DST_IPV4 | ++ MLX4_IB_RX_HASH_SRC_IPV6 | ++ MLX4_IB_RX_HASH_DST_IPV6 | ++ MLX4_IB_RX_HASH_SRC_PORT_TCP | ++ MLX4_IB_RX_HASH_DST_PORT_TCP | ++ MLX4_IB_RX_HASH_SRC_PORT_UDP | ++ MLX4_IB_RX_HASH_DST_PORT_UDP | ++ MLX4_IB_RX_HASH_INNER)) { + pr_debug("RX Hash fields_mask has unsupported mask (0x%llx)\n", + ucmd->rx_hash_fields_mask); + return (-EOPNOTSUPP); +-- +2.40.1 + diff --git a/queue-5.15/rdma-mthca-fix-crash-when-polling-cq-for-shared-qps.patch b/queue-5.15/rdma-mthca-fix-crash-when-polling-cq-for-shared-qps.patch new file mode 100644 index 00000000000..8be45eafce0 --- /dev/null +++ b/queue-5.15/rdma-mthca-fix-crash-when-polling-cq-for-shared-qps.patch @@ -0,0 +1,40 @@ +From 6ed1ceaa697435a36e4c374d23e741047b729a82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jul 2023 16:16:58 +0200 +Subject: RDMA/mthca: Fix crash when polling CQ for shared QPs + +From: Thomas Bogendoerfer + +[ Upstream commit dc52aadbc1849cbe3fcf6bc54d35f6baa396e0a1 ] + +Commit 21c2fe94abb2 ("RDMA/mthca: Combine special QP struct with mthca QP") +introduced a new struct mthca_sqp which doesn't contain struct mthca_qp +any longer. Placing a pointer of this new struct into qptable leads +to crashes, because mthca_poll_one() expects a qp pointer. Fix this +by putting the correct pointer into qptable. + +Fixes: 21c2fe94abb2 ("RDMA/mthca: Combine special QP struct with mthca QP") +Signed-off-by: Thomas Bogendoerfer +Link: https://lore.kernel.org/r/20230713141658.9426-1-tbogendoerfer@suse.de +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mthca/mthca_qp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c +index 69bba0ef4a5df..53f43649f7d08 100644 +--- a/drivers/infiniband/hw/mthca/mthca_qp.c ++++ b/drivers/infiniband/hw/mthca/mthca_qp.c +@@ -1393,7 +1393,7 @@ int mthca_alloc_sqp(struct mthca_dev *dev, + if (mthca_array_get(&dev->qp_table.qp, mqpn)) + err = -EBUSY; + else +- mthca_array_set(&dev->qp_table.qp, mqpn, qp->sqp); ++ mthca_array_set(&dev->qp_table.qp, mqpn, qp); + spin_unlock_irq(&dev->qp_table.lock); + + if (err) +-- +2.40.1 + diff --git a/queue-5.15/ring-buffer-fix-wrong-stat-of-cpu_buffer-read.patch b/queue-5.15/ring-buffer-fix-wrong-stat-of-cpu_buffer-read.patch new file mode 100644 index 00000000000..1ddbe93381f --- /dev/null +++ b/queue-5.15/ring-buffer-fix-wrong-stat-of-cpu_buffer-read.patch @@ -0,0 +1,130 @@ +From 15913878d382351802f0e85f345330dfa6d2c1f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 13:40:40 +0800 +Subject: ring-buffer: Fix wrong stat of cpu_buffer->read + +From: Zheng Yejian + +[ Upstream commit 2d093282b0d4357373497f65db6a05eb0c28b7c8 ] + +When pages are removed in rb_remove_pages(), 'cpu_buffer->read' is set +to 0 in order to make sure any read iterators reset themselves. However, +this will mess 'entries' stating, see following steps: + + # cd /sys/kernel/tracing/ + # 1. Enlarge ring buffer prepare for later reducing: + # echo 20 > per_cpu/cpu0/buffer_size_kb + # 2. Write a log into ring buffer of cpu0: + # taskset -c 0 echo "hello1" > trace_marker + # 3. Read the log: + # cat per_cpu/cpu0/trace_pipe + <...>-332 [000] ..... 62.406844: tracing_mark_write: hello1 + # 4. Stop reading and see the stats, now 0 entries, and 1 event readed: + # cat per_cpu/cpu0/stats + entries: 0 + [...] + read events: 1 + # 5. Reduce the ring buffer + # echo 7 > per_cpu/cpu0/buffer_size_kb + # 6. Now entries became unexpected 1 because actually no entries!!! + # cat per_cpu/cpu0/stats + entries: 1 + [...] + read events: 0 + +To fix it, introduce 'page_removed' field to count total removed pages +since last reset, then use it to let read iterators reset themselves +instead of changing the 'read' pointer. + +Link: https://lore.kernel.org/linux-trace-kernel/20230724054040.3489499-1-zhengyejian1@huawei.com + +Cc: +Cc: +Fixes: 83f40318dab0 ("ring-buffer: Make removal of ring buffer pages atomic") +Signed-off-by: Zheng Yejian +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/ring_buffer.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index ceeba8bf1265b..e1cef097b0df5 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -520,6 +520,8 @@ struct ring_buffer_per_cpu { + rb_time_t before_stamp; + u64 event_stamp[MAX_NEST]; + u64 read_stamp; ++ /* pages removed since last reset */ ++ unsigned long pages_removed; + /* ring buffer pages to update, > 0 to add, < 0 to remove */ + long nr_pages_to_update; + struct list_head new_pages; /* new pages to add */ +@@ -555,6 +557,7 @@ struct ring_buffer_iter { + struct buffer_page *head_page; + struct buffer_page *cache_reader_page; + unsigned long cache_read; ++ unsigned long cache_pages_removed; + u64 read_stamp; + u64 page_stamp; + struct ring_buffer_event *event; +@@ -1931,6 +1934,8 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages) + to_remove = rb_list_head(to_remove)->next; + head_bit |= (unsigned long)to_remove & RB_PAGE_HEAD; + } ++ /* Read iterators need to reset themselves when some pages removed */ ++ cpu_buffer->pages_removed += nr_removed; + + next_page = rb_list_head(to_remove)->next; + +@@ -1952,12 +1957,6 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages) + cpu_buffer->head_page = list_entry(next_page, + struct buffer_page, list); + +- /* +- * change read pointer to make sure any read iterators reset +- * themselves +- */ +- cpu_buffer->read = 0; +- + /* pages are removed, resume tracing and then free the pages */ + atomic_dec(&cpu_buffer->record_disabled); + raw_spin_unlock_irq(&cpu_buffer->reader_lock); +@@ -4347,6 +4346,7 @@ static void rb_iter_reset(struct ring_buffer_iter *iter) + + iter->cache_reader_page = iter->head_page; + iter->cache_read = cpu_buffer->read; ++ iter->cache_pages_removed = cpu_buffer->pages_removed; + + if (iter->head) { + iter->read_stamp = cpu_buffer->read_stamp; +@@ -4800,12 +4800,13 @@ rb_iter_peek(struct ring_buffer_iter *iter, u64 *ts) + buffer = cpu_buffer->buffer; + + /* +- * Check if someone performed a consuming read to +- * the buffer. A consuming read invalidates the iterator +- * and we need to reset the iterator in this case. ++ * Check if someone performed a consuming read to the buffer ++ * or removed some pages from the buffer. In these cases, ++ * iterator was invalidated and we need to reset it. + */ + if (unlikely(iter->cache_read != cpu_buffer->read || +- iter->cache_reader_page != cpu_buffer->reader_page)) ++ iter->cache_reader_page != cpu_buffer->reader_page || ++ iter->cache_pages_removed != cpu_buffer->pages_removed)) + rb_iter_reset(iter); + + again: +@@ -5249,6 +5250,7 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer) + cpu_buffer->last_overrun = 0; + + rb_head_page_activate(cpu_buffer); ++ cpu_buffer->pages_removed = 0; + } + + /* Must have disabled the cpu buffer then done a synchronize_rcu */ +-- +2.40.1 + diff --git a/queue-5.15/series b/queue-5.15/series index adb4345bf23..f7200d170dd 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -79,3 +79,22 @@ net-sched-mqprio-add-length-check-for-tca_mqprio_-ma.patch benet-fix-return-value-check-in-be_lancer_xmit_worka.patch tipc-check-return-value-of-pskb_trim.patch tipc-stop-tipc-crypto-on-failure-in-tipc_node_create.patch +rdma-mlx4-make-check-for-invalid-flags-stricter.patch +drm-msm-dpu-drop-enum-dpu_core_perf_data_bus_id.patch +drm-msm-adreno-fix-snapshot-bindless_data-size.patch +rdma-irdma-add-missing-read-barriers.patch +rdma-irdma-fix-data-race-on-cqp-completion-stats.patch +rdma-irdma-fix-data-race-on-cqp-request-done.patch +rdma-mthca-fix-crash-when-polling-cq-for-shared-qps.patch +rdma-bnxt_re-prevent-handling-any-completions-after-.patch +drm-msm-fix-is_err_or_null-vs-null-check-in-a5xx_sub.patch +asoc-fsl_spdif-silence-output-on-stop.patch +block-fix-a-source-code-comment-in-include-uapi-linu.patch +dm-raid-fix-missing-reconfig_mutex-unlock-in-raid_ct.patch +dm-raid-clean-up-four-equivalent-goto-tags-in-raid_c.patch +dm-raid-protect-md_stop-with-reconfig_mutex.patch +drm-amd-fix-an-error-handling-mistake-in-psp_sw_init.patch +rdma-irdma-report-correct-wc-error.patch +ata-pata_ns87415-mark-ns87560_tf_read-static.patch +ring-buffer-fix-wrong-stat-of-cpu_buffer-read.patch +tracing-fix-warning-in-trace_buffered_event_disable.patch diff --git a/queue-5.15/tracing-fix-warning-in-trace_buffered_event_disable.patch b/queue-5.15/tracing-fix-warning-in-trace_buffered_event_disable.patch new file mode 100644 index 00000000000..0d7b1708b6d --- /dev/null +++ b/queue-5.15/tracing-fix-warning-in-trace_buffered_event_disable.patch @@ -0,0 +1,119 @@ +From 3c5b90b4ca468311cec43ea186c4016a3cb09973 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jul 2023 17:58:04 +0800 +Subject: tracing: Fix warning in trace_buffered_event_disable() + +From: Zheng Yejian + +[ Upstream commit dea499781a1150d285c62b26659f62fb00824fce ] + +Warning happened in trace_buffered_event_disable() at + WARN_ON_ONCE(!trace_buffered_event_ref) + + Call Trace: + ? __warn+0xa5/0x1b0 + ? trace_buffered_event_disable+0x189/0x1b0 + __ftrace_event_enable_disable+0x19e/0x3e0 + free_probe_data+0x3b/0xa0 + unregister_ftrace_function_probe_func+0x6b8/0x800 + event_enable_func+0x2f0/0x3d0 + ftrace_process_regex.isra.0+0x12d/0x1b0 + ftrace_filter_write+0xe6/0x140 + vfs_write+0x1c9/0x6f0 + [...] + +The cause of the warning is in __ftrace_event_enable_disable(), +trace_buffered_event_enable() was called once while +trace_buffered_event_disable() was called twice. +Reproduction script show as below, for analysis, see the comments: + ``` + #!/bin/bash + + cd /sys/kernel/tracing/ + + # 1. Register a 'disable_event' command, then: + # 1) SOFT_DISABLED_BIT was set; + # 2) trace_buffered_event_enable() was called first time; + echo 'cmdline_proc_show:disable_event:initcall:initcall_finish' > \ + set_ftrace_filter + + # 2. Enable the event registered, then: + # 1) SOFT_DISABLED_BIT was cleared; + # 2) trace_buffered_event_disable() was called first time; + echo 1 > events/initcall/initcall_finish/enable + + # 3. Try to call into cmdline_proc_show(), then SOFT_DISABLED_BIT was + # set again!!! + cat /proc/cmdline + + # 4. Unregister the 'disable_event' command, then: + # 1) SOFT_DISABLED_BIT was cleared again; + # 2) trace_buffered_event_disable() was called second time!!! + echo '!cmdline_proc_show:disable_event:initcall:initcall_finish' > \ + set_ftrace_filter + ``` + +To fix it, IIUC, we can change to call trace_buffered_event_enable() at +fist time soft-mode enabled, and call trace_buffered_event_disable() at +last time soft-mode disabled. + +Link: https://lore.kernel.org/linux-trace-kernel/20230726095804.920457-1-zhengyejian1@huawei.com + +Cc: +Fixes: 0fc1b09ff1ff ("tracing: Use temp buffer when filtering events") +Signed-off-by: Zheng Yejian +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_events.c | 14 ++++---------- + 1 file changed, 4 insertions(+), 10 deletions(-) + +diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c +index 160298d285c0b..2a2a599997671 100644 +--- a/kernel/trace/trace_events.c ++++ b/kernel/trace/trace_events.c +@@ -594,7 +594,6 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, + { + struct trace_event_call *call = file->event_call; + struct trace_array *tr = file->tr; +- unsigned long file_flags = file->flags; + int ret = 0; + int disable; + +@@ -618,6 +617,8 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, + break; + disable = file->flags & EVENT_FILE_FL_SOFT_DISABLED; + clear_bit(EVENT_FILE_FL_SOFT_MODE_BIT, &file->flags); ++ /* Disable use of trace_buffered_event */ ++ trace_buffered_event_disable(); + } else + disable = !(file->flags & EVENT_FILE_FL_SOFT_MODE); + +@@ -656,6 +657,8 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, + if (atomic_inc_return(&file->sm_ref) > 1) + break; + set_bit(EVENT_FILE_FL_SOFT_MODE_BIT, &file->flags); ++ /* Enable use of trace_buffered_event */ ++ trace_buffered_event_enable(); + } + + if (!(file->flags & EVENT_FILE_FL_ENABLED)) { +@@ -695,15 +698,6 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, + break; + } + +- /* Enable or disable use of trace_buffered_event */ +- if ((file_flags & EVENT_FILE_FL_SOFT_DISABLED) != +- (file->flags & EVENT_FILE_FL_SOFT_DISABLED)) { +- if (file->flags & EVENT_FILE_FL_SOFT_DISABLED) +- trace_buffered_event_enable(); +- else +- trace_buffered_event_disable(); +- } +- + return ret; + } + +-- +2.40.1 + -- 2.47.3