From f5721c76012e2185c074c33aee388bb69d4d8489 Mon Sep 17 00:00:00 2001 From: Yousaf Kaukab Date: Apr 19 2024 14:09:00 +0000 Subject: Merge branch 'users/jgross/SLE15-SP5/for-next' into SLE15-SP5 Pull xen fixes from Juergen Gross --- diff --git a/patches.suse/x86-xen-Add-some-null-pointer-checking-to-smp.c.patch b/patches.suse/x86-xen-Add-some-null-pointer-checking-to-smp.c.patch new file mode 100644 index 0000000..19006a4 --- /dev/null +++ b/patches.suse/x86-xen-Add-some-null-pointer-checking-to-smp.c.patch @@ -0,0 +1,76 @@ +Patch-mainline: v6.8-rc5 +Git-commit: 3693bb4465e6e32a204a5b86d3ec7e6b9f7e67c2 +References: git-fixes +From: Kunwu Chan +Date: Fri, 19 Jan 2024 17:49:48 +0800 +Subject: [PATCH] x86/xen: Add some null pointer checking to smp.c + +kasprintf() returns a pointer to dynamically allocated memory +which can be NULL upon failure. Ensure the allocation was successful +by checking the pointer validity. + +Signed-off-by: Kunwu Chan +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202401161119.iof6BQsf-lkp@intel.com/ +Suggested-by: Markus Elfring +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20240119094948.275390-1-chentao@kylinos.cn +Signed-off-by: Juergen Gross +--- + arch/x86/xen/smp.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c +index 4b0d6fff88de..1fb9a1644d94 100644 +--- a/arch/x86/xen/smp.c ++++ b/arch/x86/xen/smp.c +@@ -65,6 +65,8 @@ int xen_smp_intr_init(unsigned int cpu) + char *resched_name, *callfunc_name, *debug_name; + + resched_name = kasprintf(GFP_KERNEL, "resched%d", cpu); ++ if (!resched_name) ++ goto fail_mem; + per_cpu(xen_resched_irq, cpu).name = resched_name; + rc = bind_ipi_to_irqhandler(XEN_RESCHEDULE_VECTOR, + cpu, +@@ -77,6 +79,8 @@ int xen_smp_intr_init(unsigned int cpu) + per_cpu(xen_resched_irq, cpu).irq = rc; + + callfunc_name = kasprintf(GFP_KERNEL, "callfunc%d", cpu); ++ if (!callfunc_name) ++ goto fail_mem; + per_cpu(xen_callfunc_irq, cpu).name = callfunc_name; + rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_VECTOR, + cpu, +@@ -90,6 +94,9 @@ int xen_smp_intr_init(unsigned int cpu) + + if (!xen_fifo_events) { + debug_name = kasprintf(GFP_KERNEL, "debug%d", cpu); ++ if (!debug_name) ++ goto fail_mem; ++ + per_cpu(xen_debug_irq, cpu).name = debug_name; + rc = bind_virq_to_irqhandler(VIRQ_DEBUG, cpu, + xen_debug_interrupt, +@@ -101,6 +108,9 @@ int xen_smp_intr_init(unsigned int cpu) + } + + callfunc_name = kasprintf(GFP_KERNEL, "callfuncsingle%d", cpu); ++ if (!callfunc_name) ++ goto fail_mem; ++ + per_cpu(xen_callfuncsingle_irq, cpu).name = callfunc_name; + rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_SINGLE_VECTOR, + cpu, +@@ -114,6 +124,8 @@ int xen_smp_intr_init(unsigned int cpu) + + return 0; + ++ fail_mem: ++ rc = -ENOMEM; + fail: + xen_smp_intr_free(cpu); + return rc; +-- +2.35.3 + diff --git a/patches.suse/x86-xen-add-CPU-dependencies-for-32-bit-build.patch b/patches.suse/x86-xen-add-CPU-dependencies-for-32-bit-build.patch new file mode 100644 index 0000000..175e4d2 --- /dev/null +++ b/patches.suse/x86-xen-add-CPU-dependencies-for-32-bit-build.patch @@ -0,0 +1,49 @@ +Patch-mainline: v6.7-rc7 +Git-commit: 93cd0597649844a0fe7989839a3202735fb3ae67 +References: git-fixes +From: Arnd Bergmann +Date: Mon, 4 Dec 2023 09:47:01 +0100 +Subject: [PATCH] x86/xen: add CPU dependencies for 32-bit build + +Xen only supports modern CPUs even when running a 32-bit kernel, and it now +requires a kernel built for a 64 byte (or larger) cache line: + +In file included from : +In function 'xen_vcpu_setup', + inlined from 'xen_vcpu_setup_restore' at arch/x86/xen/enlighten.c:111:3, + inlined from 'xen_vcpu_restore' at arch/x86/xen/enlighten.c:141:3: +include/linux/compiler_types.h:435:45: error: call to '__compiletime_assert_287' declared with attribute error: BUILD_BUG_ON failed: sizeof(*vcpup) > SMP_CACHE_BYTES +arch/x86/xen/enlighten.c:166:9: note: in expansion of macro 'BUILD_BUG_ON' + 166 | BUILD_BUG_ON(sizeof(*vcpup) > SMP_CACHE_BYTES); + | ^~~~~~~~~~~~ + +Enforce the dependency with a whitelist of CPU configurations. In normal +distro kernels, CONFIG_X86_GENERIC is enabled, and this works fine. When this +is not set, still allow Xen to be built on kernels that target a 64-bit +capable CPU. + +Fixes: db2832309a82 ("x86/xen: fix percpu vcpu_info allocation") +Signed-off-by: Arnd Bergmann +Reviewed-by: Juergen Gross +Tested-by: Alyssa Ross +Link: https://lore.kernel.org/r/20231204084722.3789473-1-arnd@kernel.org +Signed-off-by: Juergen Gross +--- + arch/x86/xen/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/xen/Kconfig b/arch/x86/xen/Kconfig +index 9b1ec5d8c99c..a65fc2ae15b4 100644 +--- a/arch/x86/xen/Kconfig ++++ b/arch/x86/xen/Kconfig +@@ -9,6 +9,7 @@ config XEN + select PARAVIRT_CLOCK + select X86_HV_CALLBACK_VECTOR + depends on X86_64 || (X86_32 && X86_PAE) ++ depends on X86_64 || (X86_GENERIC || MPENTIUM4 || MCORE2 || MATOM || MK8) + depends on X86_LOCAL_APIC && X86_TSC + help + This is the Linux Xen port. Enabling this will allow the +-- +2.35.3 + diff --git a/patches.suse/x86-xen-fix-percpu-vcpu_info-allocation.patch b/patches.suse/x86-xen-fix-percpu-vcpu_info-allocation.patch new file mode 100644 index 0000000..5e3bfe0 --- /dev/null +++ b/patches.suse/x86-xen-fix-percpu-vcpu_info-allocation.patch @@ -0,0 +1,67 @@ +Patch-mainline: v6.7-rc4 +Git-commit: db2832309a82b9acc4b8cc33a1831d36507ec13e +References: git-fixes +From: Juergen Gross +Date: Fri, 24 Nov 2023 08:48:52 +0100 +Subject: [PATCH] x86/xen: fix percpu vcpu_info allocation + +Today the percpu struct vcpu_info is allocated via DEFINE_PER_CPU(), +meaning that it could cross a page boundary. In this case registering +it with the hypervisor will fail, resulting in a panic(). + +This can easily be fixed by using DEFINE_PER_CPU_ALIGNED() instead, +as struct vcpu_info is guaranteed to have a size of 64 bytes, matching +the cache line size of x86 64-bit processors (Xen doesn't support +32-bit processors). + +Fixes: 5ead97c84fa7 ("xen: Core Xen implementation") +Signed-off-by: Juergen Gross +Reviewed-by: Boris Ostrovsky +Link: https://lore.kernel.org/r/20231124074852.25161-1-jgross@suse.com +Signed-off-by: Juergen Gross +--- + arch/x86/xen/enlighten.c | 6 +++++- + arch/x86/xen/xen-ops.h | 2 +- + 2 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c +index 0337392a3121..3c61bb98c10e 100644 +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -33,8 +33,11 @@ EXPORT_SYMBOL_GPL(hypercall_page); + * Per CPU pages used if hypervisor supports VCPUOP_register_vcpu_info + * hypercall. This can be used both in PV and PVHVM mode. The structure + * overrides the default per_cpu(xen_vcpu, cpu) value. ++ * Make sure that xen_vcpu_info doesn't cross a page boundary by making it ++ * cache-line aligned (the struct is guaranteed to have a size of 64 bytes, ++ * which matches the cache line size of 64-bit x86 processors). + */ +-DEFINE_PER_CPU(struct vcpu_info, xen_vcpu_info); ++DEFINE_PER_CPU_ALIGNED(struct vcpu_info, xen_vcpu_info); + + /* Linux <-> Xen vCPU id mapping */ + DEFINE_PER_CPU(uint32_t, xen_vcpu_id); +@@ -160,6 +163,7 @@ void xen_vcpu_setup(int cpu) + int err; + struct vcpu_info *vcpup; + ++ BUILD_BUG_ON(sizeof(*vcpup) > SMP_CACHE_BYTES); + BUG_ON(HYPERVISOR_shared_info == &xen_dummy_shared_info); + + /* +diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h +index 408a2aa66c69..a87ab36889e7 100644 +--- a/arch/x86/xen/xen-ops.h ++++ b/arch/x86/xen/xen-ops.h +@@ -21,7 +21,7 @@ extern void *xen_initial_gdt; + struct trap_info; + void xen_copy_trap_info(struct trap_info *traps); + +-DECLARE_PER_CPU(struct vcpu_info, xen_vcpu_info); ++DECLARE_PER_CPU_ALIGNED(struct vcpu_info, xen_vcpu_info); + DECLARE_PER_CPU(unsigned long, xen_cr3); + DECLARE_PER_CPU(unsigned long, xen_current_cr3); + +-- +2.35.3 + diff --git a/patches.suse/xen-gntdev-Fix-the-abuse-of-underlying-struct-page-i.patch b/patches.suse/xen-gntdev-Fix-the-abuse-of-underlying-struct-page-i.patch new file mode 100644 index 0000000..b94a764 --- /dev/null +++ b/patches.suse/xen-gntdev-Fix-the-abuse-of-underlying-struct-page-i.patch @@ -0,0 +1,149 @@ +Patch-mainline: v6.8-rc1 +Git-commit: 2d2db7d40254d5fb53b11ebd703cd1ed0c5de7a1 +References: git-fixes +From: Oleksandr Tyshchenko +Date: Sun, 7 Jan 2024 12:34:26 +0200 +Subject: [PATCH] xen/gntdev: Fix the abuse of underlying struct page in + DMA-buf import +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +DO NOT access the underlying struct page of an sg table exported +by DMA-buf in dmabuf_imp_to_refs(), this is not allowed. +Please see drivers/dma-buf/dma-buf.c:mangle_sg_table() for details. + +Fortunately, here (for special Xen device) we can avoid using +pages and calculate gfns directly from dma addresses provided by +the sg table. + +Suggested-by: Daniel Vetter +Signed-off-by: Oleksandr Tyshchenko +Acked-by: Christian König +Reviewed-by: Stefano Stabellini +Acked-by: Daniel Vetter +Link: https://lore.kernel.org/r/20240107103426.2038075-1-olekstysh@gmail.com +Signed-off-by: Juergen Gross +--- + drivers/xen/gntdev-dmabuf.c | 50 ++++++++++++++++++------------------- + 1 file changed, 25 insertions(+), 25 deletions(-) + +diff --git a/drivers/xen/gntdev-dmabuf.c b/drivers/xen/gntdev-dmabuf.c +index 4440e626b797..42adc2c1e06b 100644 +--- a/drivers/xen/gntdev-dmabuf.c ++++ b/drivers/xen/gntdev-dmabuf.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -50,7 +51,7 @@ struct gntdev_dmabuf { + + /* Number of pages this buffer has. */ + int nr_pages; +- /* Pages of this buffer. */ ++ /* Pages of this buffer (only for dma-buf export). */ + struct page **pages; + }; + +@@ -484,7 +485,7 @@ static int dmabuf_exp_from_refs(struct gntdev_priv *priv, int flags, + /* DMA buffer import support. */ + + static int +-dmabuf_imp_grant_foreign_access(struct page **pages, u32 *refs, ++dmabuf_imp_grant_foreign_access(unsigned long *gfns, u32 *refs, + int count, int domid) + { + grant_ref_t priv_gref_head; +@@ -507,7 +508,7 @@ dmabuf_imp_grant_foreign_access(struct page **pages, u32 *refs, + } + + gnttab_grant_foreign_access_ref(cur_ref, domid, +- xen_page_to_gfn(pages[i]), 0); ++ gfns[i], 0); + refs[i] = cur_ref; + } + +@@ -529,7 +530,6 @@ static void dmabuf_imp_end_foreign_access(u32 *refs, int count) + + static void dmabuf_imp_free_storage(struct gntdev_dmabuf *gntdev_dmabuf) + { +- kfree(gntdev_dmabuf->pages); + kfree(gntdev_dmabuf->u.imp.refs); + kfree(gntdev_dmabuf); + } +@@ -549,12 +549,6 @@ static struct gntdev_dmabuf *dmabuf_imp_alloc_storage(int count) + if (!gntdev_dmabuf->u.imp.refs) + goto fail; + +- gntdev_dmabuf->pages = kcalloc(count, +- sizeof(gntdev_dmabuf->pages[0]), +- GFP_KERNEL); +- if (!gntdev_dmabuf->pages) +- goto fail; +- + gntdev_dmabuf->nr_pages = count; + + for (i = 0; i < count; i++) +@@ -576,7 +570,8 @@ dmabuf_imp_to_refs(struct gntdev_dmabuf_priv *priv, struct device *dev, + struct dma_buf *dma_buf; + struct dma_buf_attachment *attach; + struct sg_table *sgt; +- struct sg_page_iter sg_iter; ++ struct sg_dma_page_iter sg_iter; ++ unsigned long *gfns; + int i; + + dma_buf = dma_buf_get(fd); +@@ -624,26 +619,31 @@ dmabuf_imp_to_refs(struct gntdev_dmabuf_priv *priv, struct device *dev, + + gntdev_dmabuf->u.imp.sgt = sgt; + +- /* Now convert sgt to array of pages and check for page validity. */ ++ gfns = kcalloc(count, sizeof(*gfns), GFP_KERNEL); ++ if (!gfns) { ++ ret = ERR_PTR(-ENOMEM); ++ goto fail_unmap; ++ } ++ ++ /* ++ * Now convert sgt to array of gfns without accessing underlying pages. ++ * It is not allowed to access the underlying struct page of an sg table ++ * exported by DMA-buf, but since we deal with special Xen dma device here ++ * (not a normal physical one) look at the dma addresses in the sg table ++ * and then calculate gfns directly from them. ++ */ + i = 0; +- for_each_sgtable_page(sgt, &sg_iter, 0) { +- struct page *page = sg_page_iter_page(&sg_iter); +- /* +- * Check if page is valid: this can happen if we are given +- * a page from VRAM or other resources which are not backed +- * by a struct page. +- */ +- if (!pfn_valid(page_to_pfn(page))) { +- ret = ERR_PTR(-EINVAL); +- goto fail_unmap; +- } ++ for_each_sgtable_dma_page(sgt, &sg_iter, 0) { ++ dma_addr_t addr = sg_page_iter_dma_address(&sg_iter); ++ unsigned long pfn = bfn_to_pfn(XEN_PFN_DOWN(dma_to_phys(dev, addr))); + +- gntdev_dmabuf->pages[i++] = page; ++ gfns[i++] = pfn_to_gfn(pfn); + } + +- ret = ERR_PTR(dmabuf_imp_grant_foreign_access(gntdev_dmabuf->pages, ++ ret = ERR_PTR(dmabuf_imp_grant_foreign_access(gfns, + gntdev_dmabuf->u.imp.refs, + count, domid)); ++ kfree(gfns); + if (IS_ERR(ret)) + goto fail_end_access; + +-- +2.35.3 + diff --git a/patches.suse/xen-netback-properly-sync-TX-responses.patch b/patches.suse/xen-netback-properly-sync-TX-responses.patch new file mode 100644 index 0000000..a869844 --- /dev/null +++ b/patches.suse/xen-netback-properly-sync-TX-responses.patch @@ -0,0 +1,208 @@ +Patch-mainline: v6.8-rc3 +Git-commit: 7b55984c96ffe9e236eb9c82a2196e0b1f84990d +References: git-fixes +From: Jan Beulich +Date: Mon, 29 Jan 2024 14:03:08 +0100 +Subject: [PATCH] xen-netback: properly sync TX responses + +Invoking the make_tx_response() / push_tx_responses() pair with no lock +held would be acceptable only if all such invocations happened from the +same context (NAPI instance or dealloc thread). Since this isn't the +case, and since the interface "spec" also doesn't demand that multicast +operations may only be performed with no in-flight transmits, +MCAST_{ADD,DEL} processing also needs to acquire the response lock +around the invocations. + +To prevent similar mistakes going forward, "downgrade" the present +functions to private helpers of just the two remaining ones using them +directly, with no forward declarations anymore. This involves renaming +what so far was make_tx_response(), for the new function of that name +to serve the new (wrapper) purpose. + +While there, +- constify the txp parameters, +- correct xenvif_idx_release()'s status parameter's type, +- rename {,_}make_tx_response()'s status parameters for consistency with + xenvif_idx_release()'s. + +Fixes: 210c34dcd8d9 ("xen-netback: add support for multicast control") +Cc: stable@vger.kernel.org +Signed-off-by: Jan Beulich +Reviewed-by: Paul Durrant +Link: https://lore.kernel.org/r/980c6c3d-e10e-4459-8565-e8fbde122f00@suse.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Juergen Gross +--- + drivers/net/xen-netback/netback.c | 84 +++++++++++++++---------------- + 1 file changed, 40 insertions(+), 44 deletions(-) + +diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c +index d7503aef599f..fab361a250d6 100644 +--- a/drivers/net/xen-netback/netback.c ++++ b/drivers/net/xen-netback/netback.c +@@ -104,13 +104,12 @@ bool provides_xdp_headroom = true; + module_param(provides_xdp_headroom, bool, 0644); + + static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx, +- u8 status); ++ s8 status); + + static void make_tx_response(struct xenvif_queue *queue, +- struct xen_netif_tx_request *txp, ++ const struct xen_netif_tx_request *txp, + unsigned int extra_count, +- s8 st); +-static void push_tx_responses(struct xenvif_queue *queue); ++ s8 status); + + static void xenvif_idx_unmap(struct xenvif_queue *queue, u16 pending_idx); + +@@ -208,13 +207,9 @@ static void xenvif_tx_err(struct xenvif_queue *queue, + unsigned int extra_count, RING_IDX end) + { + RING_IDX cons = queue->tx.req_cons; +- unsigned long flags; + + do { +- spin_lock_irqsave(&queue->response_lock, flags); + make_tx_response(queue, txp, extra_count, XEN_NETIF_RSP_ERROR); +- push_tx_responses(queue); +- spin_unlock_irqrestore(&queue->response_lock, flags); + if (cons == end) + break; + RING_COPY_REQUEST(&queue->tx, cons++, txp); +@@ -465,12 +460,7 @@ static void xenvif_get_requests(struct xenvif_queue *queue, + for (shinfo->nr_frags = 0; nr_slots > 0 && shinfo->nr_frags < MAX_SKB_FRAGS; + nr_slots--) { + if (unlikely(!txp->size)) { +- unsigned long flags; +- +- spin_lock_irqsave(&queue->response_lock, flags); + make_tx_response(queue, txp, 0, XEN_NETIF_RSP_OKAY); +- push_tx_responses(queue); +- spin_unlock_irqrestore(&queue->response_lock, flags); + ++txp; + continue; + } +@@ -496,14 +486,8 @@ static void xenvif_get_requests(struct xenvif_queue *queue, + + for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots; ++txp) { + if (unlikely(!txp->size)) { +- unsigned long flags; +- +- spin_lock_irqsave(&queue->response_lock, flags); + make_tx_response(queue, txp, 0, + XEN_NETIF_RSP_OKAY); +- push_tx_responses(queue); +- spin_unlock_irqrestore(&queue->response_lock, +- flags); + continue; + } + +@@ -995,7 +979,6 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue, + (ret == 0) ? + XEN_NETIF_RSP_OKAY : + XEN_NETIF_RSP_ERROR); +- push_tx_responses(queue); + continue; + } + +@@ -1007,7 +990,6 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue, + + make_tx_response(queue, &txreq, extra_count, + XEN_NETIF_RSP_OKAY); +- push_tx_responses(queue); + continue; + } + +@@ -1433,8 +1415,35 @@ int xenvif_tx_action(struct xenvif_queue *queue, int budget) + return work_done; + } + ++static void _make_tx_response(struct xenvif_queue *queue, ++ const struct xen_netif_tx_request *txp, ++ unsigned int extra_count, ++ s8 status) ++{ ++ RING_IDX i = queue->tx.rsp_prod_pvt; ++ struct xen_netif_tx_response *resp; ++ ++ resp = RING_GET_RESPONSE(&queue->tx, i); ++ resp->id = txp->id; ++ resp->status = status; ++ ++ while (extra_count-- != 0) ++ RING_GET_RESPONSE(&queue->tx, ++i)->status = XEN_NETIF_RSP_NULL; ++ ++ queue->tx.rsp_prod_pvt = ++i; ++} ++ ++static void push_tx_responses(struct xenvif_queue *queue) ++{ ++ int notify; ++ ++ RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify); ++ if (notify) ++ notify_remote_via_irq(queue->tx_irq); ++} ++ + static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx, +- u8 status) ++ s8 status) + { + struct pending_tx_info *pending_tx_info; + pending_ring_idx_t index; +@@ -1444,8 +1453,8 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx, + + spin_lock_irqsave(&queue->response_lock, flags); + +- make_tx_response(queue, &pending_tx_info->req, +- pending_tx_info->extra_count, status); ++ _make_tx_response(queue, &pending_tx_info->req, ++ pending_tx_info->extra_count, status); + + /* Release the pending index before pusing the Tx response so + * its available before a new Tx request is pushed by the +@@ -1459,32 +1468,19 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx, + spin_unlock_irqrestore(&queue->response_lock, flags); + } + +- + static void make_tx_response(struct xenvif_queue *queue, +- struct xen_netif_tx_request *txp, ++ const struct xen_netif_tx_request *txp, + unsigned int extra_count, +- s8 st) ++ s8 status) + { +- RING_IDX i = queue->tx.rsp_prod_pvt; +- struct xen_netif_tx_response *resp; +- +- resp = RING_GET_RESPONSE(&queue->tx, i); +- resp->id = txp->id; +- resp->status = st; +- +- while (extra_count-- != 0) +- RING_GET_RESPONSE(&queue->tx, ++i)->status = XEN_NETIF_RSP_NULL; ++ unsigned long flags; + +- queue->tx.rsp_prod_pvt = ++i; +-} ++ spin_lock_irqsave(&queue->response_lock, flags); + +-static void push_tx_responses(struct xenvif_queue *queue) +-{ +- int notify; ++ _make_tx_response(queue, txp, extra_count, status); ++ push_tx_responses(queue); + +- RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify); +- if (notify) +- notify_remote_via_irq(queue->tx_irq); ++ spin_unlock_irqrestore(&queue->response_lock, flags); + } + + static void xenvif_idx_unmap(struct xenvif_queue *queue, u16 pending_idx) +-- +2.35.3 + diff --git a/patches.suse/xen-netfront-Add-missing-skb_mark_for_recycle.patch b/patches.suse/xen-netfront-Add-missing-skb_mark_for_recycle.patch new file mode 100644 index 0000000..ec4c777 --- /dev/null +++ b/patches.suse/xen-netfront-Add-missing-skb_mark_for_recycle.patch @@ -0,0 +1,48 @@ +Patch-mainline: v6.9-rc3 +Git-commit: 037965402a010898d34f4e35327d22c0a95cd51f +References: git-fixes +From: Jesper Dangaard Brouer +Date: Wed, 27 Mar 2024 13:14:56 +0100 +Subject: [PATCH] xen-netfront: Add missing skb_mark_for_recycle + +Notice that skb_mark_for_recycle() is introduced later than fixes tag in +commit 6a5bcd84e886 ("page_pool: Allow drivers to hint on SKB recycling"). + +It is believed that fixes tag were missing a call to page_pool_release_page() +between v5.9 to v5.14, after which is should have used skb_mark_for_recycle(). +Since v6.6 the call page_pool_release_page() were removed (in +commit 535b9c61bdef ("net: page_pool: hide page_pool_release_page()") +and remaining callers converted (in commit 6bfef2ec0172 ("Merge branch +'net-page_pool-remove-page_pool_release_page'")). + +This leak became visible in v6.8 via commit dba1b8a7ab68 ("mm/page_pool: catch +page_pool memory leaks"). + +Cc: stable@vger.kernel.org +Fixes: 6c5aa6fc4def ("xen networking: add basic XDP support for xen-netfront") +Reported-by: Leonidas Spyropoulos +Link: https://bugzilla.kernel.org/show_bug.cgi?id=218654 +Reported-by: Arthur Borsboom +Signed-off-by: Jesper Dangaard Brouer +Link: https://lore.kernel.org/r/171154167446.2671062.9127105384591237363.stgit@firesoul +Signed-off-by: Jakub Kicinski +Signed-off-by: Juergen Gross +--- + drivers/net/xen-netfront.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index ad29f370034e..8d2aee88526c 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -285,6 +285,7 @@ static struct sk_buff *xennet_alloc_one_rx_buffer(struct netfront_queue *queue) + return NULL; + } + skb_add_rx_frag(skb, 0, page, 0, 0, PAGE_SIZE); ++ skb_mark_for_recycle(skb); + + /* Align ip header to a 16 bytes boundary */ + skb_reserve(skb, NET_IP_ALIGN); +-- +2.35.3 + diff --git a/patches.suse/xen-xenbus-document-will_handle-argument-for-xenbus_.patch b/patches.suse/xen-xenbus-document-will_handle-argument-for-xenbus_.patch new file mode 100644 index 0000000..070f01a --- /dev/null +++ b/patches.suse/xen-xenbus-document-will_handle-argument-for-xenbus_.patch @@ -0,0 +1,71 @@ +Patch-mainline: v6.8-rc5 +Git-commit: 7d8c67dd5d4f2ed1907e192c73dd948d35145641 +References: git-fixes +From: SeongJae Park +Date: Fri, 12 Jan 2024 10:59:03 -0800 +Subject: [PATCH] xen/xenbus: document will_handle argument for + xenbus_watch_path() + +Commit 2e85d32b1c86 ("xen/xenbus: Add 'will_handle' callback support in +xenbus_watch_path()") added will_handle argument to xenbus_watch_path() +and its wrapper, xenbus_watch_pathfmt(), but didn't document it on the +kerneldoc comments of the function. This is causing warnings that +reported by kernel test robot. Add the documentation to fix it. + +Fixes: 2e85d32b1c86 ("xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path()") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202401121154.FI8jDGun-lkp@intel.com/ +Signed-off-by: SeongJae Park +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20240112185903.83737-1-sj@kernel.org +Signed-off-by: Juergen Gross +--- + drivers/xen/xenbus/xenbus_client.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c +index 32835b4b9bc5..51b3124b0d56 100644 +--- a/drivers/xen/xenbus/xenbus_client.c ++++ b/drivers/xen/xenbus/xenbus_client.c +@@ -116,14 +116,17 @@ EXPORT_SYMBOL_GPL(xenbus_strstate); + * @dev: xenbus device + * @path: path to watch + * @watch: watch to register ++ * @will_handle: events queuing determine callback + * @callback: callback to register + * + * Register a @watch on the given path, using the given xenbus_watch structure +- * for storage, and the given @callback function as the callback. Return 0 on +- * success, or -errno on error. On success, the given @path will be saved as +- * @watch->node, and remains the caller's to free. On error, @watch->node will +- * be NULL, the device will switch to %XenbusStateClosing, and the error will +- * be saved in the store. ++ * for storage, @will_handle function as the callback to determine if each ++ * event need to be queued, and the given @callback function as the callback. ++ * On success, the given @path will be saved as @watch->node, and remains the ++ * caller's to free. On error, @watch->node will be NULL, the device will ++ * switch to %XenbusStateClosing, and the error will be saved in the store. ++ * ++ * Returns: %0 on success or -errno on error + */ + int xenbus_watch_path(struct xenbus_device *dev, const char *path, + struct xenbus_watch *watch, +@@ -158,11 +159,14 @@ EXPORT_SYMBOL_GPL(xenbus_watch_path); + * xenbus_watch_pathfmt - register a watch on a sprintf-formatted path + * @dev: xenbus device + * @watch: watch to register ++ * @will_handle: events queuing determine callback + * @callback: callback to register + * @pathfmt: format of path to watch + * + * Register a watch on the given @path, using the given xenbus_watch +- * structure for storage, and the given @callback function as the callback. ++ * structure for storage, @will_handle function as the callback to determine if ++ * each event need to be queued, and the given @callback function as the ++ * callback. + * Return 0 on success, or -errno on error. On success, the watched path + * (@path/@path2) will be saved as @watch->node, and becomes the caller's to + * kfree(). On error, watch->node will be NULL, so the caller has nothing to +-- +2.35.3 + diff --git a/series.conf b/series.conf index c07ee7a..0aee8cd 100644 --- a/series.conf +++ b/series.conf @@ -44931,6 +44931,7 @@ patches.suse/ALSA-hda-realtek-Add-supported-ALC257-for-ChromeOS.patch patches.suse/kprobes-consistent-rcu-api-usage-for-kretprobe-holder.patch patches.suse/rethook-Use-__rcu-pointer-for-rethook-handler.patch + patches.suse/x86-xen-fix-percpu-vcpu_info-allocation.patch patches.suse/powerpc-Don-t-clobber-f0-vs0-during-fp-altivec-regis.patch patches.suse/firewire-core-fix-possible-memory-leak-in-create_uni.patch patches.suse/x86-entry-convert-int-0x80-emulation-to-idtentry.patch @@ -45106,6 +45107,7 @@ patches.suse/net-9p-avoid-freeing-uninit-memory-in-p9pdu_vreadf.patch patches.suse/drm-amd-display-get-dprefclk-ss-info-from-integratio.patch patches.suse/drm-i915-Reject-async-flips-with-bigjoiner.patch + patches.suse/x86-xen-add-CPU-dependencies-for-32-bit-build.patch patches.suse/i2c-rk3x-fix-potential-spinlock-recursion-on-poll.patch patches.suse/i2c-aspeed-Handle-the-coalesced-stop-conditions-with.patch patches.suse/ALSA-hda-realtek-Add-quirk-for-ASUS-ROG-GV302XA.patch @@ -45444,6 +45446,7 @@ patches.suse/KVM-s390-vsie-Fix-STFLE-interpretive-execution-identification.patch patches.suse/KVM-arm64-vgic-its-Avoid-potential-UAF-in-LPI-transl.patch patches.suse/KVM-x86-Advertise-CPUID.-EAX-7-ECX-2-EDX-5-0-to-userspace.patch + patches.suse/xen-gntdev-Fix-the-abuse-of-underlying-struct-page-i.patch patches.suse/thermal-intel-hfi-Add-syscore-callbacks-for-system-w.patch patches.suse/mfd-syscon-Fix-null-pointer-dereference-in-of_syscon.patch patches.suse/mfd-intel-lpss-Fix-the-fractional-clock-divider-flag.patch @@ -45593,6 +45596,7 @@ patches.suse/firewire-core-correct-documentation-of-fw_csr_string.patch patches.suse/HID-i2c-hid-of-fix-NULL-deref-on-failed-power-up.patch patches.suse/nfc-nci-free-rx_data_reassembly-skb-on-NCI-device-cl.patch + patches.suse/xen-netback-properly-sync-TX-responses.patch patches.suse/msft-hv-2940-hv_netvsc-Fix-race-condition-between-netvsc_probe-an.patch patches.suse/nvme-rdma-Fix-transfer-length-when-write_generate-re.patch patches.suse/nvmet-tcp-fix-nvme-tcp-ida-memory-leak.patch @@ -45700,6 +45704,8 @@ patches.suse/HID-wacom-generic-Avoid-reporting-a-serial-of-0-to-u.patch patches.suse/spi-ppc4xx-Drop-write-only-variable.patch patches.suse/spi-mxs-Fix-chipselect-glitch.patch + patches.suse/xen-xenbus-document-will_handle-argument-for-xenbus_.patch + patches.suse/x86-xen-Add-some-null-pointer-checking-to-smp.c.patch patches.suse/net-openvswitch-limit-the-number-of-recursions-from-.patch patches.suse/tls-fix-race-between-tx-work-scheduling-and-socket-c.patch patches.suse/net-stmmac-xgmac-use-define-for-string-constants.patch @@ -46193,6 +46199,7 @@ patches.suse/RAS-AMD-FMPM-Safely-handle-saved-records-of-various-sizes.patch patches.suse/RAS-Avoid-build-errors-when-CONFIG_DEBUG_FS-n.patch patches.suse/vboxsf-Avoid-an-spurious-warning-if-load_nls_xxx-fai.patch + patches.suse/xen-netfront-Add-missing-skb_mark_for_recycle.patch patches.suse/msft-hv-2971-net-mana-Fix-Rx-DMA-datasize-and-skb_over_panic.patch patches.suse/net-usb-ax88179_178a-avoid-the-interface-always-conf.patch patches.suse/bpf-sockmap-Prevent-lock-inversion-deadlock-in-map-d.patch