From e29bba71fdbec3dcf0c3a1d3fb45eccec0c713f0 Mon Sep 17 00:00:00 2001 From: Mel Gorman Date: Apr 26 2023 08:51:22 +0000 Subject: Merge branch 'ALP-current' (ca5e068f6b6f) into 'ALP-current-RT' - Refreshed -rt patches. patches.rt/drm-i915-Don-t-disable-interrupts-on-PREEMPT_RT-duri.patch --- diff --git a/config-test/arm64/rt b/config-test/arm64/rt index 4917108..09eb785 100644 --- a/config-test/arm64/rt +++ b/config-test/arm64/rt @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 6.2.8 Kernel Configuration +# Linux/arm64 6.2.9 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (scripts/dummy-tools/gcc)" CONFIG_CC_IS_GCC=y @@ -12185,7 +12185,7 @@ CONFIG_EVM_ADD_XATTRS=y # CONFIG_DEFAULT_SECURITY_TOMOYO is not set CONFIG_DEFAULT_SECURITY_APPARMOR=y # CONFIG_DEFAULT_SECURITY_DAC is not set -CONFIG_LSM="integrity,apparmor" +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo,bpf" # # Kernel hardening options diff --git a/config/x86_64/rt b/config/x86_64/rt index e066d10..41337ed 100644 --- a/config/x86_64/rt +++ b/config/x86_64/rt @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86_64 6.2.8 Kernel Configuration +# Linux/x86_64 6.2.9 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (scripts/dummy-tools/gcc)" CONFIG_CC_IS_GCC=y @@ -10274,7 +10274,7 @@ CONFIG_EVM_ADD_XATTRS=y # CONFIG_DEFAULT_SECURITY_TOMOYO is not set CONFIG_DEFAULT_SECURITY_APPARMOR=y # CONFIG_DEFAULT_SECURITY_DAC is not set -CONFIG_LSM="integrity,apparmor" +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo,bpf" # # Kernel hardening options diff --git a/patches.kernel.org/6.2.10-001-thunderbolt-Limit-USB3-bandwidth-of-certain-In.patch b/patches.kernel.org/6.2.10-001-thunderbolt-Limit-USB3-bandwidth-of-certain-In.patch new file mode 100644 index 0000000..0819856 --- /dev/null +++ b/patches.kernel.org/6.2.10-001-thunderbolt-Limit-USB3-bandwidth-of-certain-In.patch @@ -0,0 +1,140 @@ +From: Gil Fine +Date: Tue, 31 Jan 2023 13:04:52 +0200 +Subject: [PATCH] thunderbolt: Limit USB3 bandwidth of certain Intel USB4 host + routers +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: f0a57dd33b3eadf540912cd130db727ea824d174 + +[ Upstream commit f0a57dd33b3eadf540912cd130db727ea824d174 ] + +Current Intel USB4 host routers have hardware limitation that the USB3 +bandwidth cannot go higher than 16376 Mb/s. Work this around by adding a +new quirk that limits the bandwidth for the affected host routers. + +Cc: stable@vger.kernel.org +Signed-off-by: Gil Fine +Signed-off-by: Mika Westerberg +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/thunderbolt/quirks.c | 31 +++++++++++++++++++++++++++++++ + drivers/thunderbolt/tb.h | 3 +++ + drivers/thunderbolt/usb4.c | 17 +++++++++++++++-- + 3 files changed, 49 insertions(+), 2 deletions(-) + +diff --git a/drivers/thunderbolt/quirks.c b/drivers/thunderbolt/quirks.c +index ae28a03f..1157b886 100644 +--- a/drivers/thunderbolt/quirks.c ++++ b/drivers/thunderbolt/quirks.c +@@ -26,6 +26,19 @@ static void quirk_clx_disable(struct tb_switch *sw) + tb_sw_dbg(sw, "disabling CL states\n"); + } + ++static void quirk_usb3_maximum_bandwidth(struct tb_switch *sw) ++{ ++ struct tb_port *port; ++ ++ tb_switch_for_each_port(sw, port) { ++ if (!tb_port_is_usb3_down(port)) ++ continue; ++ port->max_bw = 16376; ++ tb_port_dbg(port, "USB3 maximum bandwidth limited to %u Mb/s\n", ++ port->max_bw); ++ } ++} ++ + struct tb_quirk { + u16 hw_vendor_id; + u16 hw_device_id; +@@ -43,6 +56,24 @@ static const struct tb_quirk tb_quirks[] = { + * DP buffers. + */ + { 0x8087, 0x0b26, 0x0000, 0x0000, quirk_dp_credit_allocation }, ++ /* ++ * Limit the maximum USB3 bandwidth for the following Intel USB4 ++ * host routers due to a hardware issue. ++ */ ++ { 0x8087, PCI_DEVICE_ID_INTEL_ADL_NHI0, 0x0000, 0x0000, ++ quirk_usb3_maximum_bandwidth }, ++ { 0x8087, PCI_DEVICE_ID_INTEL_ADL_NHI1, 0x0000, 0x0000, ++ quirk_usb3_maximum_bandwidth }, ++ { 0x8087, PCI_DEVICE_ID_INTEL_RPL_NHI0, 0x0000, 0x0000, ++ quirk_usb3_maximum_bandwidth }, ++ { 0x8087, PCI_DEVICE_ID_INTEL_RPL_NHI1, 0x0000, 0x0000, ++ quirk_usb3_maximum_bandwidth }, ++ { 0x8087, PCI_DEVICE_ID_INTEL_MTL_M_NHI0, 0x0000, 0x0000, ++ quirk_usb3_maximum_bandwidth }, ++ { 0x8087, PCI_DEVICE_ID_INTEL_MTL_P_NHI0, 0x0000, 0x0000, ++ quirk_usb3_maximum_bandwidth }, ++ { 0x8087, PCI_DEVICE_ID_INTEL_MTL_P_NHI1, 0x0000, 0x0000, ++ quirk_usb3_maximum_bandwidth }, + /* + * CLx is not supported on AMD USB4 Yellow Carp and Pink Sardine platforms. + */ +diff --git a/drivers/thunderbolt/tb.h b/drivers/thunderbolt/tb.h +index e11d973a..f034723b 100644 +--- a/drivers/thunderbolt/tb.h ++++ b/drivers/thunderbolt/tb.h +@@ -252,6 +252,8 @@ struct tb_switch { + * @ctl_credits: Buffers reserved for control path + * @dma_credits: Number of credits allocated for DMA tunneling for all + * DMA paths through this port. ++ * @max_bw: Maximum possible bandwidth through this adapter if set to ++ * non-zero. + * + * In USB4 terminology this structure represents an adapter (protocol or + * lane adapter). +@@ -277,6 +279,7 @@ struct tb_port { + unsigned int total_credits; + unsigned int ctl_credits; + unsigned int dma_credits; ++ unsigned int max_bw; + }; + + /** +diff --git a/drivers/thunderbolt/usb4.c b/drivers/thunderbolt/usb4.c +index d5cd219e..3a11b30b 100644 +--- a/drivers/thunderbolt/usb4.c ++++ b/drivers/thunderbolt/usb4.c +@@ -1882,6 +1882,15 @@ int usb4_port_retimer_nvm_read(struct tb_port *port, u8 index, + usb4_port_retimer_nvm_read_block, &info); + } + ++static inline unsigned int ++usb4_usb3_port_max_bandwidth(const struct tb_port *port, unsigned int bw) ++{ ++ /* Take the possible bandwidth limitation into account */ ++ if (port->max_bw) ++ return min(bw, port->max_bw); ++ return bw; ++} ++ + /** + * usb4_usb3_port_max_link_rate() - Maximum support USB3 link rate + * @port: USB3 adapter port +@@ -1903,7 +1912,9 @@ int usb4_usb3_port_max_link_rate(struct tb_port *port) + return ret; + + lr = (val & ADP_USB3_CS_4_MSLR_MASK) >> ADP_USB3_CS_4_MSLR_SHIFT; +- return lr == ADP_USB3_CS_4_MSLR_20G ? 20000 : 10000; ++ ret = lr == ADP_USB3_CS_4_MSLR_20G ? 20000 : 10000; ++ ++ return usb4_usb3_port_max_bandwidth(port, ret); + } + + /** +@@ -1930,7 +1941,9 @@ int usb4_usb3_port_actual_link_rate(struct tb_port *port) + return 0; + + lr = val & ADP_USB3_CS_4_ALR_MASK; +- return lr == ADP_USB3_CS_4_ALR_20G ? 20000 : 10000; ++ ret = lr == ADP_USB3_CS_4_ALR_20G ? 20000 : 10000; ++ ++ return usb4_usb3_port_max_bandwidth(port, ret); + } + + static int usb4_usb3_port_cm_request(struct tb_port *port, bool request) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-002-cifs-update-ip_addr-for-ses-only-for-primary-c.patch b/patches.kernel.org/6.2.10-002-cifs-update-ip_addr-for-ses-only-for-primary-c.patch new file mode 100644 index 0000000..ecdc9f3 --- /dev/null +++ b/patches.kernel.org/6.2.10-002-cifs-update-ip_addr-for-ses-only-for-primary-c.patch @@ -0,0 +1,65 @@ +From: Shyam Prasad N +Date: Fri, 10 Feb 2023 17:41:17 +0000 +Subject: [PATCH] cifs: update ip_addr for ses only for primary chan setup +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: e77978de4765229e09c8fabcf4f8419ff367317f + +[ Upstream commit e77978de4765229e09c8fabcf4f8419ff367317f ] + +We update ses->ip_addr whenever we do a session setup. +But this should happen only for primary channel in mchan +scenario. + +Signed-off-by: Shyam Prasad N +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Stable-dep-of: bc962159e8e3 ("cifs: avoid race conditions with parallel reconnects") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/cifs/connect.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 6da2af97..f53837f4 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -3735,16 +3735,12 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses, + struct nls_table *nls_info) + { + int rc = -ENOSYS; +- struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr; +- struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr; ++ struct TCP_Server_Info *pserver = CIFS_SERVER_IS_CHAN(server) ? server->primary_server : server; ++ struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&pserver->dstaddr; ++ struct sockaddr_in *addr = (struct sockaddr_in *)&pserver->dstaddr; + bool is_binding = false; + + spin_lock(&ses->ses_lock); +- if (server->dstaddr.ss_family == AF_INET6) +- scnprintf(ses->ip_addr, sizeof(ses->ip_addr), "%pI6", &addr6->sin6_addr); +- else +- scnprintf(ses->ip_addr, sizeof(ses->ip_addr), "%pI4", &addr->sin_addr); +- + if (ses->ses_status != SES_GOOD && + ses->ses_status != SES_NEW && + ses->ses_status != SES_NEED_RECON) { +@@ -3768,6 +3764,14 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses, + ses->ses_status = SES_IN_SETUP; + spin_unlock(&ses->ses_lock); + ++ /* update ses ip_addr only for primary chan */ ++ if (server == pserver) { ++ if (server->dstaddr.ss_family == AF_INET6) ++ scnprintf(ses->ip_addr, sizeof(ses->ip_addr), "%pI6", &addr6->sin6_addr); ++ else ++ scnprintf(ses->ip_addr, sizeof(ses->ip_addr), "%pI4", &addr->sin_addr); ++ } ++ + if (!is_binding) { + ses->capabilities = server->capabilities; + if (!linuxExtEnabled) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-003-cifs-prevent-data-race-in-cifs_reconnect_tcon.patch b/patches.kernel.org/6.2.10-003-cifs-prevent-data-race-in-cifs_reconnect_tcon.patch new file mode 100644 index 0000000..763ffd9 --- /dev/null +++ b/patches.kernel.org/6.2.10-003-cifs-prevent-data-race-in-cifs_reconnect_tcon.patch @@ -0,0 +1,256 @@ +From: Paulo Alcantara +Date: Tue, 28 Feb 2023 19:01:55 -0300 +Subject: [PATCH] cifs: prevent data race in cifs_reconnect_tcon() +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 1bcd548d935a33c6fc58331405eb1b82fd6150de + +[ Upstream commit 1bcd548d935a33c6fc58331405eb1b82fd6150de ] + +Make sure to get an up-to-date TCP_Server_Info::nr_targets value prior +to waiting the server to be reconnected in cifs_reconnect_tcon(). It +is set in cifs_tcp_ses_needs_reconnect() and protected by +TCP_Server_Info::srv_lock. + +Create a new cifs_wait_for_server_reconnect() helper that can be used +by both SMB2+ and CIFS reconnect code. + +Signed-off-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Stable-dep-of: bc962159e8e3 ("cifs: avoid race conditions with parallel reconnects") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/cifs/cifsproto.h | 1 + + fs/cifs/cifssmb.c | 43 ++---------------------- + fs/cifs/misc.c | 44 ++++++++++++++++++++++++ + fs/cifs/smb2pdu.c | 82 ++++++++++++--------------------------------- + 4 files changed, 69 insertions(+), 101 deletions(-) + +diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h +index e7518454..639df85d 100644 +--- a/fs/cifs/cifsproto.h ++++ b/fs/cifs/cifsproto.h +@@ -697,5 +697,6 @@ static inline int cifs_create_options(struct cifs_sb_info *cifs_sb, int options) + + struct super_block *cifs_get_tcon_super(struct cifs_tcon *tcon); + void cifs_put_tcon_super(struct super_block *sb); ++int cifs_wait_for_server_reconnect(struct TCP_Server_Info *server, bool retry); + + #endif /* _CIFSPROTO_H */ +diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c +index 566e6a26..5ca4a538 100644 +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -70,7 +70,6 @@ cifs_reconnect_tcon(struct cifs_tcon *tcon, int smb_command) + struct cifs_ses *ses; + struct TCP_Server_Info *server; + struct nls_table *nls_codepage; +- int retries; + + /* + * SMBs NegProt, SessSetup, uLogoff do not have tcon yet so check for +@@ -98,45 +97,9 @@ cifs_reconnect_tcon(struct cifs_tcon *tcon, int smb_command) + } + spin_unlock(&tcon->tc_lock); + +- retries = server->nr_targets; +- +- /* +- * Give demultiplex thread up to 10 seconds to each target available for +- * reconnect -- should be greater than cifs socket timeout which is 7 +- * seconds. +- */ +- while (server->tcpStatus == CifsNeedReconnect) { +- rc = wait_event_interruptible_timeout(server->response_q, +- (server->tcpStatus != CifsNeedReconnect), +- 10 * HZ); +- if (rc < 0) { +- cifs_dbg(FYI, "%s: aborting reconnect due to a received signal by the process\n", +- __func__); +- return -ERESTARTSYS; +- } +- +- /* are we still trying to reconnect? */ +- spin_lock(&server->srv_lock); +- if (server->tcpStatus != CifsNeedReconnect) { +- spin_unlock(&server->srv_lock); +- break; +- } +- spin_unlock(&server->srv_lock); +- +- if (retries && --retries) +- continue; +- +- /* +- * on "soft" mounts we wait once. Hard mounts keep +- * retrying until process is killed or server comes +- * back on-line +- */ +- if (!tcon->retry) { +- cifs_dbg(FYI, "gave up waiting on reconnect in smb_init\n"); +- return -EHOSTDOWN; +- } +- retries = server->nr_targets; +- } ++ rc = cifs_wait_for_server_reconnect(server, tcon->retry); ++ if (rc) ++ return rc; + + spin_lock(&ses->chan_lock); + if (!cifs_chan_needs_reconnect(ses, server) && !tcon->need_reconnect) { +diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c +index 9f4486b7..5542893e 100644 +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -1376,3 +1376,47 @@ int cifs_inval_name_dfs_link_error(const unsigned int xid, + return 0; + } + #endif ++ ++int cifs_wait_for_server_reconnect(struct TCP_Server_Info *server, bool retry) ++{ ++ int timeout = 10; ++ int rc; ++ ++ spin_lock(&server->srv_lock); ++ if (server->tcpStatus != CifsNeedReconnect) { ++ spin_unlock(&server->srv_lock); ++ return 0; ++ } ++ timeout *= server->nr_targets; ++ spin_unlock(&server->srv_lock); ++ ++ /* ++ * Give demultiplex thread up to 10 seconds to each target available for ++ * reconnect -- should be greater than cifs socket timeout which is 7 ++ * seconds. ++ * ++ * On "soft" mounts we wait once. Hard mounts keep retrying until ++ * process is killed or server comes back on-line. ++ */ ++ do { ++ rc = wait_event_interruptible_timeout(server->response_q, ++ (server->tcpStatus != CifsNeedReconnect), ++ timeout * HZ); ++ if (rc < 0) { ++ cifs_dbg(FYI, "%s: aborting reconnect due to received signal\n", ++ __func__); ++ return -ERESTARTSYS; ++ } ++ ++ /* are we still trying to reconnect? */ ++ spin_lock(&server->srv_lock); ++ if (server->tcpStatus != CifsNeedReconnect) { ++ spin_unlock(&server->srv_lock); ++ return 0; ++ } ++ spin_unlock(&server->srv_lock); ++ } while (retry); ++ ++ cifs_dbg(FYI, "%s: gave up waiting on reconnect\n", __func__); ++ return -EHOSTDOWN; ++} +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 6e6e44d8..83d04cd2 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -139,66 +139,6 @@ smb2_hdr_assemble(struct smb2_hdr *shdr, __le16 smb2_cmd, + return; + } + +-static int wait_for_server_reconnect(struct TCP_Server_Info *server, +- __le16 smb2_command, bool retry) +-{ +- int timeout = 10; +- int rc; +- +- spin_lock(&server->srv_lock); +- if (server->tcpStatus != CifsNeedReconnect) { +- spin_unlock(&server->srv_lock); +- return 0; +- } +- timeout *= server->nr_targets; +- spin_unlock(&server->srv_lock); +- +- /* +- * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE +- * here since they are implicitly done when session drops. +- */ +- switch (smb2_command) { +- /* +- * BB Should we keep oplock break and add flush to exceptions? +- */ +- case SMB2_TREE_DISCONNECT: +- case SMB2_CANCEL: +- case SMB2_CLOSE: +- case SMB2_OPLOCK_BREAK: +- return -EAGAIN; +- } +- +- /* +- * Give demultiplex thread up to 10 seconds to each target available for +- * reconnect -- should be greater than cifs socket timeout which is 7 +- * seconds. +- * +- * On "soft" mounts we wait once. Hard mounts keep retrying until +- * process is killed or server comes back on-line. +- */ +- do { +- rc = wait_event_interruptible_timeout(server->response_q, +- (server->tcpStatus != CifsNeedReconnect), +- timeout * HZ); +- if (rc < 0) { +- cifs_dbg(FYI, "%s: aborting reconnect due to received signal\n", +- __func__); +- return -ERESTARTSYS; +- } +- +- /* are we still trying to reconnect? */ +- spin_lock(&server->srv_lock); +- if (server->tcpStatus != CifsNeedReconnect) { +- spin_unlock(&server->srv_lock); +- return 0; +- } +- spin_unlock(&server->srv_lock); +- } while (retry); +- +- cifs_dbg(FYI, "%s: gave up waiting on reconnect\n", __func__); +- return -EHOSTDOWN; +-} +- + static int + smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + struct TCP_Server_Info *server) +@@ -239,7 +179,27 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + (!tcon->ses->server) || !server) + return -EIO; + +- rc = wait_for_server_reconnect(server, smb2_command, tcon->retry); ++ spin_lock(&server->srv_lock); ++ if (server->tcpStatus == CifsNeedReconnect) { ++ /* ++ * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE ++ * here since they are implicitly done when session drops. ++ */ ++ switch (smb2_command) { ++ /* ++ * BB Should we keep oplock break and add flush to exceptions? ++ */ ++ case SMB2_TREE_DISCONNECT: ++ case SMB2_CANCEL: ++ case SMB2_CLOSE: ++ case SMB2_OPLOCK_BREAK: ++ spin_unlock(&server->srv_lock); ++ return -EAGAIN; ++ } ++ } ++ spin_unlock(&server->srv_lock); ++ ++ rc = cifs_wait_for_server_reconnect(server, tcon->retry); + if (rc) + return rc; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-004-cifs-avoid-race-conditions-with-parallel-recon.patch b/patches.kernel.org/6.2.10-004-cifs-avoid-race-conditions-with-parallel-recon.patch new file mode 100644 index 0000000..8677403 --- /dev/null +++ b/patches.kernel.org/6.2.10-004-cifs-avoid-race-conditions-with-parallel-recon.patch @@ -0,0 +1,334 @@ +From: Shyam Prasad N +Date: Mon, 20 Mar 2023 06:08:19 +0000 +Subject: [PATCH] cifs: avoid race conditions with parallel reconnects +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: bc962159e8e326af634a506508034a375bf2b858 + +[ Upstream commit bc962159e8e326af634a506508034a375bf2b858 ] + +When multiple processes/channels do reconnects in parallel +we used to return success immediately +negotiate/session-setup/tree-connect, causing race conditions +between processes that enter the function in parallel. +This caused several errors related to session not found to +show up during parallel reconnects. + +Signed-off-by: Shyam Prasad N +Reviewed-by: Paulo Alcantara (SUSE) +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/cifs/connect.c | 48 ++++++++++++++++++++++++++++++----------- + fs/cifs/smb2pdu.c | 44 +++++++++++++++++++++---------------- + fs/cifs/smb2transport.c | 17 ++++++++++++--- + 3 files changed, 76 insertions(+), 33 deletions(-) + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index f53837f4..985e962c 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -244,31 +244,42 @@ cifs_mark_tcp_ses_conns_for_reconnect(struct TCP_Server_Info *server, + cifs_chan_update_iface(ses, server); + + spin_lock(&ses->chan_lock); +- if (!mark_smb_session && cifs_chan_needs_reconnect(ses, server)) +- goto next_session; ++ if (!mark_smb_session && cifs_chan_needs_reconnect(ses, server)) { ++ spin_unlock(&ses->chan_lock); ++ continue; ++ } + + if (mark_smb_session) + CIFS_SET_ALL_CHANS_NEED_RECONNECT(ses); + else + cifs_chan_set_need_reconnect(ses, server); + ++ cifs_dbg(FYI, "%s: channel connect bitmap: 0x%lx\n", ++ __func__, ses->chans_need_reconnect); ++ + /* If all channels need reconnect, then tcon needs reconnect */ +- if (!mark_smb_session && !CIFS_ALL_CHANS_NEED_RECONNECT(ses)) +- goto next_session; ++ if (!mark_smb_session && !CIFS_ALL_CHANS_NEED_RECONNECT(ses)) { ++ spin_unlock(&ses->chan_lock); ++ continue; ++ } ++ spin_unlock(&ses->chan_lock); + ++ spin_lock(&ses->ses_lock); + ses->ses_status = SES_NEED_RECON; ++ spin_unlock(&ses->ses_lock); + + list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { + tcon->need_reconnect = true; ++ spin_lock(&tcon->tc_lock); + tcon->status = TID_NEED_RECON; ++ spin_unlock(&tcon->tc_lock); + } + if (ses->tcon_ipc) { + ses->tcon_ipc->need_reconnect = true; ++ spin_lock(&ses->tcon_ipc->tc_lock); + ses->tcon_ipc->status = TID_NEED_RECON; ++ spin_unlock(&ses->tcon_ipc->tc_lock); + } +- +-next_session: +- spin_unlock(&ses->chan_lock); + } + spin_unlock(&cifs_tcp_ses_lock); + } +@@ -3703,11 +3714,19 @@ cifs_negotiate_protocol(const unsigned int xid, struct cifs_ses *ses, + + /* only send once per connect */ + spin_lock(&server->srv_lock); +- if (!server->ops->need_neg(server) || ++ if (server->tcpStatus != CifsGood && ++ server->tcpStatus != CifsNew && + server->tcpStatus != CifsNeedNegotiate) { ++ spin_unlock(&server->srv_lock); ++ return -EHOSTDOWN; ++ } ++ ++ if (!server->ops->need_neg(server) && ++ server->tcpStatus == CifsGood) { + spin_unlock(&server->srv_lock); + return 0; + } ++ + server->tcpStatus = CifsInNegotiate; + spin_unlock(&server->srv_lock); + +@@ -3741,23 +3760,28 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses, + bool is_binding = false; + + spin_lock(&ses->ses_lock); ++ cifs_dbg(FYI, "%s: channel connect bitmap: 0x%lx\n", ++ __func__, ses->chans_need_reconnect); ++ + if (ses->ses_status != SES_GOOD && + ses->ses_status != SES_NEW && + ses->ses_status != SES_NEED_RECON) { + spin_unlock(&ses->ses_lock); +- return 0; ++ return -EHOSTDOWN; + } + + /* only send once per connect */ + spin_lock(&ses->chan_lock); +- if (CIFS_ALL_CHANS_GOOD(ses) || +- cifs_chan_in_reconnect(ses, server)) { ++ if (CIFS_ALL_CHANS_GOOD(ses)) { ++ if (ses->ses_status == SES_NEED_RECON) ++ ses->ses_status = SES_GOOD; + spin_unlock(&ses->chan_lock); + spin_unlock(&ses->ses_lock); + return 0; + } +- is_binding = !CIFS_ALL_CHANS_NEED_RECONNECT(ses); ++ + cifs_chan_set_in_reconnect(ses, server); ++ is_binding = !CIFS_ALL_CHANS_NEED_RECONNECT(ses); + spin_unlock(&ses->chan_lock); + + if (!is_binding) +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 83d04cd2..f0b1ae08 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -199,6 +199,7 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + } + spin_unlock(&server->srv_lock); + ++again: + rc = cifs_wait_for_server_reconnect(server, tcon->retry); + if (rc) + return rc; +@@ -217,6 +218,7 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + + nls_codepage = load_nls_default(); + ++ mutex_lock(&ses->session_mutex); + /* + * Recheck after acquire mutex. If another thread is negotiating + * and the server never sends an answer the socket will be closed +@@ -225,6 +227,11 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + spin_lock(&server->srv_lock); + if (server->tcpStatus == CifsNeedReconnect) { + spin_unlock(&server->srv_lock); ++ mutex_unlock(&ses->session_mutex); ++ ++ if (tcon->retry) ++ goto again; ++ + rc = -EHOSTDOWN; + goto out; + } +@@ -234,19 +241,22 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + * need to prevent multiple threads trying to simultaneously + * reconnect the same SMB session + */ ++ spin_lock(&ses->ses_lock); + spin_lock(&ses->chan_lock); +- if (!cifs_chan_needs_reconnect(ses, server)) { ++ if (!cifs_chan_needs_reconnect(ses, server) && ++ ses->ses_status == SES_GOOD) { + spin_unlock(&ses->chan_lock); +- ++ spin_unlock(&ses->ses_lock); + /* this means that we only need to tree connect */ + if (tcon->need_reconnect) + goto skip_sess_setup; + ++ mutex_unlock(&ses->session_mutex); + goto out; + } + spin_unlock(&ses->chan_lock); ++ spin_unlock(&ses->ses_lock); + +- mutex_lock(&ses->session_mutex); + rc = cifs_negotiate_protocol(0, ses, server); + if (!rc) { + rc = cifs_setup_session(0, ses, server, nls_codepage); +@@ -262,10 +272,8 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + mutex_unlock(&ses->session_mutex); + goto out; + } +- mutex_unlock(&ses->session_mutex); + + skip_sess_setup: +- mutex_lock(&ses->session_mutex); + if (!tcon->need_reconnect) { + mutex_unlock(&ses->session_mutex); + goto out; +@@ -280,7 +288,7 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + cifs_dbg(FYI, "reconnect tcon rc = %d\n", rc); + if (rc) { + /* If sess reconnected but tcon didn't, something strange ... */ +- pr_warn_once("reconnect tcon failed rc = %d\n", rc); ++ cifs_dbg(VFS, "reconnect tcon failed rc = %d\n", rc); + goto out; + } + +@@ -1252,9 +1260,9 @@ SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data) + if (rc) + return rc; + +- spin_lock(&ses->chan_lock); +- is_binding = !CIFS_ALL_CHANS_NEED_RECONNECT(ses); +- spin_unlock(&ses->chan_lock); ++ spin_lock(&ses->ses_lock); ++ is_binding = (ses->ses_status == SES_GOOD); ++ spin_unlock(&ses->ses_lock); + + if (is_binding) { + req->hdr.SessionId = cpu_to_le64(ses->Suid); +@@ -1412,9 +1420,9 @@ SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) + goto out_put_spnego_key; + } + +- spin_lock(&ses->chan_lock); +- is_binding = !CIFS_ALL_CHANS_NEED_RECONNECT(ses); +- spin_unlock(&ses->chan_lock); ++ spin_lock(&ses->ses_lock); ++ is_binding = (ses->ses_status == SES_GOOD); ++ spin_unlock(&ses->ses_lock); + + /* keep session key if binding */ + if (!is_binding) { +@@ -1538,9 +1546,9 @@ SMB2_sess_auth_rawntlmssp_negotiate(struct SMB2_sess_data *sess_data) + + cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n"); + +- spin_lock(&ses->chan_lock); +- is_binding = !CIFS_ALL_CHANS_NEED_RECONNECT(ses); +- spin_unlock(&ses->chan_lock); ++ spin_lock(&ses->ses_lock); ++ is_binding = (ses->ses_status == SES_GOOD); ++ spin_unlock(&ses->ses_lock); + + /* keep existing ses id and flags if binding */ + if (!is_binding) { +@@ -1606,9 +1614,9 @@ SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data) + + rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; + +- spin_lock(&ses->chan_lock); +- is_binding = !CIFS_ALL_CHANS_NEED_RECONNECT(ses); +- spin_unlock(&ses->chan_lock); ++ spin_lock(&ses->ses_lock); ++ is_binding = (ses->ses_status == SES_GOOD); ++ spin_unlock(&ses->ses_lock); + + /* keep existing ses id and flags if binding */ + if (!is_binding) { +diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c +index d827b754..790acf65 100644 +--- a/fs/cifs/smb2transport.c ++++ b/fs/cifs/smb2transport.c +@@ -81,6 +81,7 @@ int smb2_get_sign_key(__u64 ses_id, struct TCP_Server_Info *server, u8 *key) + struct cifs_ses *ses = NULL; + int i; + int rc = 0; ++ bool is_binding = false; + + spin_lock(&cifs_tcp_ses_lock); + +@@ -97,9 +98,12 @@ int smb2_get_sign_key(__u64 ses_id, struct TCP_Server_Info *server, u8 *key) + goto out; + + found: ++ spin_lock(&ses->ses_lock); + spin_lock(&ses->chan_lock); +- if (cifs_chan_needs_reconnect(ses, server) && +- !CIFS_ALL_CHANS_NEED_RECONNECT(ses)) { ++ ++ is_binding = (cifs_chan_needs_reconnect(ses, server) && ++ ses->ses_status == SES_GOOD); ++ if (is_binding) { + /* + * If we are in the process of binding a new channel + * to an existing session, use the master connection +@@ -107,6 +111,7 @@ int smb2_get_sign_key(__u64 ses_id, struct TCP_Server_Info *server, u8 *key) + */ + memcpy(key, ses->smb3signingkey, SMB3_SIGN_KEY_SIZE); + spin_unlock(&ses->chan_lock); ++ spin_unlock(&ses->ses_lock); + goto out; + } + +@@ -119,10 +124,12 @@ int smb2_get_sign_key(__u64 ses_id, struct TCP_Server_Info *server, u8 *key) + if (chan->server == server) { + memcpy(key, chan->signkey, SMB3_SIGN_KEY_SIZE); + spin_unlock(&ses->chan_lock); ++ spin_unlock(&ses->ses_lock); + goto out; + } + } + spin_unlock(&ses->chan_lock); ++ spin_unlock(&ses->ses_lock); + + cifs_dbg(VFS, + "%s: Could not find channel signing key for session 0x%llx\n", +@@ -392,11 +399,15 @@ generate_smb3signingkey(struct cifs_ses *ses, + bool is_binding = false; + int chan_index = 0; + ++ spin_lock(&ses->ses_lock); + spin_lock(&ses->chan_lock); +- is_binding = !CIFS_ALL_CHANS_NEED_RECONNECT(ses); ++ is_binding = (cifs_chan_needs_reconnect(ses, server) && ++ ses->ses_status == SES_GOOD); ++ + chan_index = cifs_ses_get_chan_index(ses, server); + /* TODO: introduce ref counting for channels when the can be freed */ + spin_unlock(&ses->chan_lock); ++ spin_unlock(&ses->ses_lock); + + /* + * All channels use the same encryption/decryption keys but +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-005-zonefs-Reorganize-code.patch b/patches.kernel.org/6.2.10-005-zonefs-Reorganize-code.patch new file mode 100644 index 0000000..1a2d888 --- /dev/null +++ b/patches.kernel.org/6.2.10-005-zonefs-Reorganize-code.patch @@ -0,0 +1,1991 @@ +From: Damien Le Moal +Date: Fri, 25 Nov 2022 09:39:33 +0900 +Subject: [PATCH] zonefs: Reorganize code +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 4008e2a0b01aba982356fd15b128a47bf11bd9c7 + +[ Upstream commit 4008e2a0b01aba982356fd15b128a47bf11bd9c7 ] + +Move all code related to zone file operations from super.c to the new +file.c file. Inode and zone management code remains in super.c. + +Signed-off-by: Damien Le Moal +Reviewed-by: Johannes Thumshirn +Stable-dep-of: 88b170088ad2 ("zonefs: Fix error message in zonefs_file_dio_append()") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/zonefs/Makefile | 2 +- + fs/zonefs/file.c | 874 ++++++++++++++++++++++++++++++++++++++++ + fs/zonefs/super.c | 973 +++------------------------------------------ + fs/zonefs/zonefs.h | 22 + + 4 files changed, 955 insertions(+), 916 deletions(-) + create mode 100644 fs/zonefs/file.c + +diff --git a/fs/zonefs/Makefile b/fs/zonefs/Makefile +index 9fe54f53..645f7229 100644 +--- a/fs/zonefs/Makefile ++++ b/fs/zonefs/Makefile +@@ -3,4 +3,4 @@ ccflags-y += -I$(src) + + obj-$(CONFIG_ZONEFS_FS) += zonefs.o + +-zonefs-y := super.o sysfs.o ++zonefs-y := super.o file.o sysfs.o +diff --git a/fs/zonefs/file.c b/fs/zonefs/file.c +new file mode 100644 +index 00000000..ece0f395 +--- /dev/null ++++ b/fs/zonefs/file.c +@@ -0,0 +1,874 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* ++ * Simple file system for zoned block devices exposing zones as files. ++ * ++ * Copyright (C) 2022 Western Digital Corporation or its affiliates. ++ */ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#include "zonefs.h" ++ ++#include "trace.h" ++ ++static int zonefs_read_iomap_begin(struct inode *inode, loff_t offset, ++ loff_t length, unsigned int flags, ++ struct iomap *iomap, struct iomap *srcmap) ++{ ++ struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct super_block *sb = inode->i_sb; ++ loff_t isize; ++ ++ /* ++ * All blocks are always mapped below EOF. If reading past EOF, ++ * act as if there is a hole up to the file maximum size. ++ */ ++ mutex_lock(&zi->i_truncate_mutex); ++ iomap->bdev = inode->i_sb->s_bdev; ++ iomap->offset = ALIGN_DOWN(offset, sb->s_blocksize); ++ isize = i_size_read(inode); ++ if (iomap->offset >= isize) { ++ iomap->type = IOMAP_HOLE; ++ iomap->addr = IOMAP_NULL_ADDR; ++ iomap->length = length; ++ } else { ++ iomap->type = IOMAP_MAPPED; ++ iomap->addr = (zi->i_zsector << SECTOR_SHIFT) + iomap->offset; ++ iomap->length = isize - iomap->offset; ++ } ++ mutex_unlock(&zi->i_truncate_mutex); ++ ++ trace_zonefs_iomap_begin(inode, iomap); ++ ++ return 0; ++} ++ ++static const struct iomap_ops zonefs_read_iomap_ops = { ++ .iomap_begin = zonefs_read_iomap_begin, ++}; ++ ++static int zonefs_write_iomap_begin(struct inode *inode, loff_t offset, ++ loff_t length, unsigned int flags, ++ struct iomap *iomap, struct iomap *srcmap) ++{ ++ struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct super_block *sb = inode->i_sb; ++ loff_t isize; ++ ++ /* All write I/Os should always be within the file maximum size */ ++ if (WARN_ON_ONCE(offset + length > zi->i_max_size)) ++ return -EIO; ++ ++ /* ++ * Sequential zones can only accept direct writes. This is already ++ * checked when writes are issued, so warn if we see a page writeback ++ * operation. ++ */ ++ if (WARN_ON_ONCE(zi->i_ztype == ZONEFS_ZTYPE_SEQ && ++ !(flags & IOMAP_DIRECT))) ++ return -EIO; ++ ++ /* ++ * For conventional zones, all blocks are always mapped. For sequential ++ * zones, all blocks after always mapped below the inode size (zone ++ * write pointer) and unwriten beyond. ++ */ ++ mutex_lock(&zi->i_truncate_mutex); ++ iomap->bdev = inode->i_sb->s_bdev; ++ iomap->offset = ALIGN_DOWN(offset, sb->s_blocksize); ++ iomap->addr = (zi->i_zsector << SECTOR_SHIFT) + iomap->offset; ++ isize = i_size_read(inode); ++ if (iomap->offset >= isize) { ++ iomap->type = IOMAP_UNWRITTEN; ++ iomap->length = zi->i_max_size - iomap->offset; ++ } else { ++ iomap->type = IOMAP_MAPPED; ++ iomap->length = isize - iomap->offset; ++ } ++ mutex_unlock(&zi->i_truncate_mutex); ++ ++ trace_zonefs_iomap_begin(inode, iomap); ++ ++ return 0; ++} ++ ++static const struct iomap_ops zonefs_write_iomap_ops = { ++ .iomap_begin = zonefs_write_iomap_begin, ++}; ++ ++static int zonefs_read_folio(struct file *unused, struct folio *folio) ++{ ++ return iomap_read_folio(folio, &zonefs_read_iomap_ops); ++} ++ ++static void zonefs_readahead(struct readahead_control *rac) ++{ ++ iomap_readahead(rac, &zonefs_read_iomap_ops); ++} ++ ++/* ++ * Map blocks for page writeback. This is used only on conventional zone files, ++ * which implies that the page range can only be within the fixed inode size. ++ */ ++static int zonefs_write_map_blocks(struct iomap_writepage_ctx *wpc, ++ struct inode *inode, loff_t offset) ++{ ++ struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ ++ if (WARN_ON_ONCE(zi->i_ztype != ZONEFS_ZTYPE_CNV)) ++ return -EIO; ++ if (WARN_ON_ONCE(offset >= i_size_read(inode))) ++ return -EIO; ++ ++ /* If the mapping is already OK, nothing needs to be done */ ++ if (offset >= wpc->iomap.offset && ++ offset < wpc->iomap.offset + wpc->iomap.length) ++ return 0; ++ ++ return zonefs_write_iomap_begin(inode, offset, zi->i_max_size - offset, ++ IOMAP_WRITE, &wpc->iomap, NULL); ++} ++ ++static const struct iomap_writeback_ops zonefs_writeback_ops = { ++ .map_blocks = zonefs_write_map_blocks, ++}; ++ ++static int zonefs_writepages(struct address_space *mapping, ++ struct writeback_control *wbc) ++{ ++ struct iomap_writepage_ctx wpc = { }; ++ ++ return iomap_writepages(mapping, wbc, &wpc, &zonefs_writeback_ops); ++} ++ ++static int zonefs_swap_activate(struct swap_info_struct *sis, ++ struct file *swap_file, sector_t *span) ++{ ++ struct inode *inode = file_inode(swap_file); ++ struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ ++ if (zi->i_ztype != ZONEFS_ZTYPE_CNV) { ++ zonefs_err(inode->i_sb, ++ "swap file: not a conventional zone file\n"); ++ return -EINVAL; ++ } ++ ++ return iomap_swapfile_activate(sis, swap_file, span, ++ &zonefs_read_iomap_ops); ++} ++ ++const struct address_space_operations zonefs_file_aops = { ++ .read_folio = zonefs_read_folio, ++ .readahead = zonefs_readahead, ++ .writepages = zonefs_writepages, ++ .dirty_folio = filemap_dirty_folio, ++ .release_folio = iomap_release_folio, ++ .invalidate_folio = iomap_invalidate_folio, ++ .migrate_folio = filemap_migrate_folio, ++ .is_partially_uptodate = iomap_is_partially_uptodate, ++ .error_remove_page = generic_error_remove_page, ++ .direct_IO = noop_direct_IO, ++ .swap_activate = zonefs_swap_activate, ++}; ++ ++int zonefs_file_truncate(struct inode *inode, loff_t isize) ++{ ++ struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ loff_t old_isize; ++ enum req_op op; ++ int ret = 0; ++ ++ /* ++ * Only sequential zone files can be truncated and truncation is allowed ++ * only down to a 0 size, which is equivalent to a zone reset, and to ++ * the maximum file size, which is equivalent to a zone finish. ++ */ ++ if (zi->i_ztype != ZONEFS_ZTYPE_SEQ) ++ return -EPERM; ++ ++ if (!isize) ++ op = REQ_OP_ZONE_RESET; ++ else if (isize == zi->i_max_size) ++ op = REQ_OP_ZONE_FINISH; ++ else ++ return -EPERM; ++ ++ inode_dio_wait(inode); ++ ++ /* Serialize against page faults */ ++ filemap_invalidate_lock(inode->i_mapping); ++ ++ /* Serialize against zonefs_iomap_begin() */ ++ mutex_lock(&zi->i_truncate_mutex); ++ ++ old_isize = i_size_read(inode); ++ if (isize == old_isize) ++ goto unlock; ++ ++ ret = zonefs_zone_mgmt(inode, op); ++ if (ret) ++ goto unlock; ++ ++ /* ++ * If the mount option ZONEFS_MNTOPT_EXPLICIT_OPEN is set, ++ * take care of open zones. ++ */ ++ if (zi->i_flags & ZONEFS_ZONE_OPEN) { ++ /* ++ * Truncating a zone to EMPTY or FULL is the equivalent of ++ * closing the zone. For a truncation to 0, we need to ++ * re-open the zone to ensure new writes can be processed. ++ * For a truncation to the maximum file size, the zone is ++ * closed and writes cannot be accepted anymore, so clear ++ * the open flag. ++ */ ++ if (!isize) ++ ret = zonefs_zone_mgmt(inode, REQ_OP_ZONE_OPEN); ++ else ++ zi->i_flags &= ~ZONEFS_ZONE_OPEN; ++ } ++ ++ zonefs_update_stats(inode, isize); ++ truncate_setsize(inode, isize); ++ zi->i_wpoffset = isize; ++ zonefs_account_active(inode); ++ ++unlock: ++ mutex_unlock(&zi->i_truncate_mutex); ++ filemap_invalidate_unlock(inode->i_mapping); ++ ++ return ret; ++} ++ ++static int zonefs_file_fsync(struct file *file, loff_t start, loff_t end, ++ int datasync) ++{ ++ struct inode *inode = file_inode(file); ++ int ret = 0; ++ ++ if (unlikely(IS_IMMUTABLE(inode))) ++ return -EPERM; ++ ++ /* ++ * Since only direct writes are allowed in sequential files, page cache ++ * flush is needed only for conventional zone files. ++ */ ++ if (ZONEFS_I(inode)->i_ztype == ZONEFS_ZTYPE_CNV) ++ ret = file_write_and_wait_range(file, start, end); ++ if (!ret) ++ ret = blkdev_issue_flush(inode->i_sb->s_bdev); ++ ++ if (ret) ++ zonefs_io_error(inode, true); ++ ++ return ret; ++} ++ ++static vm_fault_t zonefs_filemap_page_mkwrite(struct vm_fault *vmf) ++{ ++ struct inode *inode = file_inode(vmf->vma->vm_file); ++ struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ vm_fault_t ret; ++ ++ if (unlikely(IS_IMMUTABLE(inode))) ++ return VM_FAULT_SIGBUS; ++ ++ /* ++ * Sanity check: only conventional zone files can have shared ++ * writeable mappings. ++ */ ++ if (WARN_ON_ONCE(zi->i_ztype != ZONEFS_ZTYPE_CNV)) ++ return VM_FAULT_NOPAGE; ++ ++ sb_start_pagefault(inode->i_sb); ++ file_update_time(vmf->vma->vm_file); ++ ++ /* Serialize against truncates */ ++ filemap_invalidate_lock_shared(inode->i_mapping); ++ ret = iomap_page_mkwrite(vmf, &zonefs_write_iomap_ops); ++ filemap_invalidate_unlock_shared(inode->i_mapping); ++ ++ sb_end_pagefault(inode->i_sb); ++ return ret; ++} ++ ++static const struct vm_operations_struct zonefs_file_vm_ops = { ++ .fault = filemap_fault, ++ .map_pages = filemap_map_pages, ++ .page_mkwrite = zonefs_filemap_page_mkwrite, ++}; ++ ++static int zonefs_file_mmap(struct file *file, struct vm_area_struct *vma) ++{ ++ /* ++ * Conventional zones accept random writes, so their files can support ++ * shared writable mappings. For sequential zone files, only read ++ * mappings are possible since there are no guarantees for write ++ * ordering between msync() and page cache writeback. ++ */ ++ if (ZONEFS_I(file_inode(file))->i_ztype == ZONEFS_ZTYPE_SEQ && ++ (vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_MAYWRITE)) ++ return -EINVAL; ++ ++ file_accessed(file); ++ vma->vm_ops = &zonefs_file_vm_ops; ++ ++ return 0; ++} ++ ++static loff_t zonefs_file_llseek(struct file *file, loff_t offset, int whence) ++{ ++ loff_t isize = i_size_read(file_inode(file)); ++ ++ /* ++ * Seeks are limited to below the zone size for conventional zones ++ * and below the zone write pointer for sequential zones. In both ++ * cases, this limit is the inode size. ++ */ ++ return generic_file_llseek_size(file, offset, whence, isize, isize); ++} ++ ++static int zonefs_file_write_dio_end_io(struct kiocb *iocb, ssize_t size, ++ int error, unsigned int flags) ++{ ++ struct inode *inode = file_inode(iocb->ki_filp); ++ struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ ++ if (error) { ++ zonefs_io_error(inode, true); ++ return error; ++ } ++ ++ if (size && zi->i_ztype != ZONEFS_ZTYPE_CNV) { ++ /* ++ * Note that we may be seeing completions out of order, ++ * but that is not a problem since a write completed ++ * successfully necessarily means that all preceding writes ++ * were also successful. So we can safely increase the inode ++ * size to the write end location. ++ */ ++ mutex_lock(&zi->i_truncate_mutex); ++ if (i_size_read(inode) < iocb->ki_pos + size) { ++ zonefs_update_stats(inode, iocb->ki_pos + size); ++ zonefs_i_size_write(inode, iocb->ki_pos + size); ++ } ++ mutex_unlock(&zi->i_truncate_mutex); ++ } ++ ++ return 0; ++} ++ ++static const struct iomap_dio_ops zonefs_write_dio_ops = { ++ .end_io = zonefs_file_write_dio_end_io, ++}; ++ ++static ssize_t zonefs_file_dio_append(struct kiocb *iocb, struct iov_iter *from) ++{ ++ struct inode *inode = file_inode(iocb->ki_filp); ++ struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct block_device *bdev = inode->i_sb->s_bdev; ++ unsigned int max = bdev_max_zone_append_sectors(bdev); ++ struct bio *bio; ++ ssize_t size; ++ int nr_pages; ++ ssize_t ret; ++ ++ max = ALIGN_DOWN(max << SECTOR_SHIFT, inode->i_sb->s_blocksize); ++ iov_iter_truncate(from, max); ++ ++ nr_pages = iov_iter_npages(from, BIO_MAX_VECS); ++ if (!nr_pages) ++ return 0; ++ ++ bio = bio_alloc(bdev, nr_pages, ++ REQ_OP_ZONE_APPEND | REQ_SYNC | REQ_IDLE, GFP_NOFS); ++ bio->bi_iter.bi_sector = zi->i_zsector; ++ bio->bi_ioprio = iocb->ki_ioprio; ++ if (iocb_is_dsync(iocb)) ++ bio->bi_opf |= REQ_FUA; ++ ++ ret = bio_iov_iter_get_pages(bio, from); ++ if (unlikely(ret)) ++ goto out_release; ++ ++ size = bio->bi_iter.bi_size; ++ task_io_account_write(size); ++ ++ if (iocb->ki_flags & IOCB_HIPRI) ++ bio_set_polled(bio, iocb); ++ ++ ret = submit_bio_wait(bio); ++ ++ /* ++ * If the file zone was written underneath the file system, the zone ++ * write pointer may not be where we expect it to be, but the zone ++ * append write can still succeed. So check manually that we wrote where ++ * we intended to, that is, at zi->i_wpoffset. ++ */ ++ if (!ret) { ++ sector_t wpsector = ++ zi->i_zsector + (zi->i_wpoffset >> SECTOR_SHIFT); ++ ++ if (bio->bi_iter.bi_sector != wpsector) { ++ zonefs_warn(inode->i_sb, ++ "Corrupted write pointer %llu for zone at %llu\n", ++ wpsector, zi->i_zsector); ++ ret = -EIO; ++ } ++ } ++ ++ zonefs_file_write_dio_end_io(iocb, size, ret, 0); ++ trace_zonefs_file_dio_append(inode, size, ret); ++ ++out_release: ++ bio_release_pages(bio, false); ++ bio_put(bio); ++ ++ if (ret >= 0) { ++ iocb->ki_pos += size; ++ return size; ++ } ++ ++ return ret; ++} ++ ++/* ++ * Do not exceed the LFS limits nor the file zone size. If pos is under the ++ * limit it becomes a short access. If it exceeds the limit, return -EFBIG. ++ */ ++static loff_t zonefs_write_check_limits(struct file *file, loff_t pos, ++ loff_t count) ++{ ++ struct inode *inode = file_inode(file); ++ struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ loff_t limit = rlimit(RLIMIT_FSIZE); ++ loff_t max_size = zi->i_max_size; ++ ++ if (limit != RLIM_INFINITY) { ++ if (pos >= limit) { ++ send_sig(SIGXFSZ, current, 0); ++ return -EFBIG; ++ } ++ count = min(count, limit - pos); ++ } ++ ++ if (!(file->f_flags & O_LARGEFILE)) ++ max_size = min_t(loff_t, MAX_NON_LFS, max_size); ++ ++ if (unlikely(pos >= max_size)) ++ return -EFBIG; ++ ++ return min(count, max_size - pos); ++} ++ ++static ssize_t zonefs_write_checks(struct kiocb *iocb, struct iov_iter *from) ++{ ++ struct file *file = iocb->ki_filp; ++ struct inode *inode = file_inode(file); ++ struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ loff_t count; ++ ++ if (IS_SWAPFILE(inode)) ++ return -ETXTBSY; ++ ++ if (!iov_iter_count(from)) ++ return 0; ++ ++ if ((iocb->ki_flags & IOCB_NOWAIT) && !(iocb->ki_flags & IOCB_DIRECT)) ++ return -EINVAL; ++ ++ if (iocb->ki_flags & IOCB_APPEND) { ++ if (zi->i_ztype != ZONEFS_ZTYPE_SEQ) ++ return -EINVAL; ++ mutex_lock(&zi->i_truncate_mutex); ++ iocb->ki_pos = zi->i_wpoffset; ++ mutex_unlock(&zi->i_truncate_mutex); ++ } ++ ++ count = zonefs_write_check_limits(file, iocb->ki_pos, ++ iov_iter_count(from)); ++ if (count < 0) ++ return count; ++ ++ iov_iter_truncate(from, count); ++ return iov_iter_count(from); ++} ++ ++/* ++ * Handle direct writes. For sequential zone files, this is the only possible ++ * write path. For these files, check that the user is issuing writes ++ * sequentially from the end of the file. This code assumes that the block layer ++ * delivers write requests to the device in sequential order. This is always the ++ * case if a block IO scheduler implementing the ELEVATOR_F_ZBD_SEQ_WRITE ++ * elevator feature is being used (e.g. mq-deadline). The block layer always ++ * automatically select such an elevator for zoned block devices during the ++ * device initialization. ++ */ ++static ssize_t zonefs_file_dio_write(struct kiocb *iocb, struct iov_iter *from) ++{ ++ struct inode *inode = file_inode(iocb->ki_filp); ++ struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct super_block *sb = inode->i_sb; ++ bool sync = is_sync_kiocb(iocb); ++ bool append = false; ++ ssize_t ret, count; ++ ++ /* ++ * For async direct IOs to sequential zone files, refuse IOCB_NOWAIT ++ * as this can cause write reordering (e.g. the first aio gets EAGAIN ++ * on the inode lock but the second goes through but is now unaligned). ++ */ ++ if (zi->i_ztype == ZONEFS_ZTYPE_SEQ && !sync && ++ (iocb->ki_flags & IOCB_NOWAIT)) ++ return -EOPNOTSUPP; ++ ++ if (iocb->ki_flags & IOCB_NOWAIT) { ++ if (!inode_trylock(inode)) ++ return -EAGAIN; ++ } else { ++ inode_lock(inode); ++ } ++ ++ count = zonefs_write_checks(iocb, from); ++ if (count <= 0) { ++ ret = count; ++ goto inode_unlock; ++ } ++ ++ if ((iocb->ki_pos | count) & (sb->s_blocksize - 1)) { ++ ret = -EINVAL; ++ goto inode_unlock; ++ } ++ ++ /* Enforce sequential writes (append only) in sequential zones */ ++ if (zi->i_ztype == ZONEFS_ZTYPE_SEQ) { ++ mutex_lock(&zi->i_truncate_mutex); ++ if (iocb->ki_pos != zi->i_wpoffset) { ++ mutex_unlock(&zi->i_truncate_mutex); ++ ret = -EINVAL; ++ goto inode_unlock; ++ } ++ mutex_unlock(&zi->i_truncate_mutex); ++ append = sync; ++ } ++ ++ if (append) ++ ret = zonefs_file_dio_append(iocb, from); ++ else ++ ret = iomap_dio_rw(iocb, from, &zonefs_write_iomap_ops, ++ &zonefs_write_dio_ops, 0, NULL, 0); ++ if (zi->i_ztype == ZONEFS_ZTYPE_SEQ && ++ (ret > 0 || ret == -EIOCBQUEUED)) { ++ if (ret > 0) ++ count = ret; ++ ++ /* ++ * Update the zone write pointer offset assuming the write ++ * operation succeeded. If it did not, the error recovery path ++ * will correct it. Also do active seq file accounting. ++ */ ++ mutex_lock(&zi->i_truncate_mutex); ++ zi->i_wpoffset += count; ++ zonefs_account_active(inode); ++ mutex_unlock(&zi->i_truncate_mutex); ++ } ++ ++inode_unlock: ++ inode_unlock(inode); ++ ++ return ret; ++} ++ ++static ssize_t zonefs_file_buffered_write(struct kiocb *iocb, ++ struct iov_iter *from) ++{ ++ struct inode *inode = file_inode(iocb->ki_filp); ++ struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ ssize_t ret; ++ ++ /* ++ * Direct IO writes are mandatory for sequential zone files so that the ++ * write IO issuing order is preserved. ++ */ ++ if (zi->i_ztype != ZONEFS_ZTYPE_CNV) ++ return -EIO; ++ ++ if (iocb->ki_flags & IOCB_NOWAIT) { ++ if (!inode_trylock(inode)) ++ return -EAGAIN; ++ } else { ++ inode_lock(inode); ++ } ++ ++ ret = zonefs_write_checks(iocb, from); ++ if (ret <= 0) ++ goto inode_unlock; ++ ++ ret = iomap_file_buffered_write(iocb, from, &zonefs_write_iomap_ops); ++ if (ret > 0) ++ iocb->ki_pos += ret; ++ else if (ret == -EIO) ++ zonefs_io_error(inode, true); ++ ++inode_unlock: ++ inode_unlock(inode); ++ if (ret > 0) ++ ret = generic_write_sync(iocb, ret); ++ ++ return ret; ++} ++ ++static ssize_t zonefs_file_write_iter(struct kiocb *iocb, struct iov_iter *from) ++{ ++ struct inode *inode = file_inode(iocb->ki_filp); ++ ++ if (unlikely(IS_IMMUTABLE(inode))) ++ return -EPERM; ++ ++ if (sb_rdonly(inode->i_sb)) ++ return -EROFS; ++ ++ /* Write operations beyond the zone size are not allowed */ ++ if (iocb->ki_pos >= ZONEFS_I(inode)->i_max_size) ++ return -EFBIG; ++ ++ if (iocb->ki_flags & IOCB_DIRECT) { ++ ssize_t ret = zonefs_file_dio_write(iocb, from); ++ ++ if (ret != -ENOTBLK) ++ return ret; ++ } ++ ++ return zonefs_file_buffered_write(iocb, from); ++} ++ ++static int zonefs_file_read_dio_end_io(struct kiocb *iocb, ssize_t size, ++ int error, unsigned int flags) ++{ ++ if (error) { ++ zonefs_io_error(file_inode(iocb->ki_filp), false); ++ return error; ++ } ++ ++ return 0; ++} ++ ++static const struct iomap_dio_ops zonefs_read_dio_ops = { ++ .end_io = zonefs_file_read_dio_end_io, ++}; ++ ++static ssize_t zonefs_file_read_iter(struct kiocb *iocb, struct iov_iter *to) ++{ ++ struct inode *inode = file_inode(iocb->ki_filp); ++ struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct super_block *sb = inode->i_sb; ++ loff_t isize; ++ ssize_t ret; ++ ++ /* Offline zones cannot be read */ ++ if (unlikely(IS_IMMUTABLE(inode) && !(inode->i_mode & 0777))) ++ return -EPERM; ++ ++ if (iocb->ki_pos >= zi->i_max_size) ++ return 0; ++ ++ if (iocb->ki_flags & IOCB_NOWAIT) { ++ if (!inode_trylock_shared(inode)) ++ return -EAGAIN; ++ } else { ++ inode_lock_shared(inode); ++ } ++ ++ /* Limit read operations to written data */ ++ mutex_lock(&zi->i_truncate_mutex); ++ isize = i_size_read(inode); ++ if (iocb->ki_pos >= isize) { ++ mutex_unlock(&zi->i_truncate_mutex); ++ ret = 0; ++ goto inode_unlock; ++ } ++ iov_iter_truncate(to, isize - iocb->ki_pos); ++ mutex_unlock(&zi->i_truncate_mutex); ++ ++ if (iocb->ki_flags & IOCB_DIRECT) { ++ size_t count = iov_iter_count(to); ++ ++ if ((iocb->ki_pos | count) & (sb->s_blocksize - 1)) { ++ ret = -EINVAL; ++ goto inode_unlock; ++ } ++ file_accessed(iocb->ki_filp); ++ ret = iomap_dio_rw(iocb, to, &zonefs_read_iomap_ops, ++ &zonefs_read_dio_ops, 0, NULL, 0); ++ } else { ++ ret = generic_file_read_iter(iocb, to); ++ if (ret == -EIO) ++ zonefs_io_error(inode, false); ++ } ++ ++inode_unlock: ++ inode_unlock_shared(inode); ++ ++ return ret; ++} ++ ++/* ++ * Write open accounting is done only for sequential files. ++ */ ++static inline bool zonefs_seq_file_need_wro(struct inode *inode, ++ struct file *file) ++{ ++ struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ ++ if (zi->i_ztype != ZONEFS_ZTYPE_SEQ) ++ return false; ++ ++ if (!(file->f_mode & FMODE_WRITE)) ++ return false; ++ ++ return true; ++} ++ ++static int zonefs_seq_file_write_open(struct inode *inode) ++{ ++ struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ int ret = 0; ++ ++ mutex_lock(&zi->i_truncate_mutex); ++ ++ if (!zi->i_wr_refcnt) { ++ struct zonefs_sb_info *sbi = ZONEFS_SB(inode->i_sb); ++ unsigned int wro = atomic_inc_return(&sbi->s_wro_seq_files); ++ ++ if (sbi->s_mount_opts & ZONEFS_MNTOPT_EXPLICIT_OPEN) { ++ ++ if (sbi->s_max_wro_seq_files ++ && wro > sbi->s_max_wro_seq_files) { ++ atomic_dec(&sbi->s_wro_seq_files); ++ ret = -EBUSY; ++ goto unlock; ++ } ++ ++ if (i_size_read(inode) < zi->i_max_size) { ++ ret = zonefs_zone_mgmt(inode, REQ_OP_ZONE_OPEN); ++ if (ret) { ++ atomic_dec(&sbi->s_wro_seq_files); ++ goto unlock; ++ } ++ zi->i_flags |= ZONEFS_ZONE_OPEN; ++ zonefs_account_active(inode); ++ } ++ } ++ } ++ ++ zi->i_wr_refcnt++; ++ ++unlock: ++ mutex_unlock(&zi->i_truncate_mutex); ++ ++ return ret; ++} ++ ++static int zonefs_file_open(struct inode *inode, struct file *file) ++{ ++ int ret; ++ ++ ret = generic_file_open(inode, file); ++ if (ret) ++ return ret; ++ ++ if (zonefs_seq_file_need_wro(inode, file)) ++ return zonefs_seq_file_write_open(inode); ++ ++ return 0; ++} ++ ++static void zonefs_seq_file_write_close(struct inode *inode) ++{ ++ struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct super_block *sb = inode->i_sb; ++ struct zonefs_sb_info *sbi = ZONEFS_SB(sb); ++ int ret = 0; ++ ++ mutex_lock(&zi->i_truncate_mutex); ++ ++ zi->i_wr_refcnt--; ++ if (zi->i_wr_refcnt) ++ goto unlock; ++ ++ /* ++ * The file zone may not be open anymore (e.g. the file was truncated to ++ * its maximum size or it was fully written). For this case, we only ++ * need to decrement the write open count. ++ */ ++ if (zi->i_flags & ZONEFS_ZONE_OPEN) { ++ ret = zonefs_zone_mgmt(inode, REQ_OP_ZONE_CLOSE); ++ if (ret) { ++ __zonefs_io_error(inode, false); ++ /* ++ * Leaving zones explicitly open may lead to a state ++ * where most zones cannot be written (zone resources ++ * exhausted). So take preventive action by remounting ++ * read-only. ++ */ ++ if (zi->i_flags & ZONEFS_ZONE_OPEN && ++ !(sb->s_flags & SB_RDONLY)) { ++ zonefs_warn(sb, ++ "closing zone at %llu failed %d\n", ++ zi->i_zsector, ret); ++ zonefs_warn(sb, ++ "remounting filesystem read-only\n"); ++ sb->s_flags |= SB_RDONLY; ++ } ++ goto unlock; ++ } ++ ++ zi->i_flags &= ~ZONEFS_ZONE_OPEN; ++ zonefs_account_active(inode); ++ } ++ ++ atomic_dec(&sbi->s_wro_seq_files); ++ ++unlock: ++ mutex_unlock(&zi->i_truncate_mutex); ++} ++ ++static int zonefs_file_release(struct inode *inode, struct file *file) ++{ ++ /* ++ * If we explicitly open a zone we must close it again as well, but the ++ * zone management operation can fail (either due to an IO error or as ++ * the zone has gone offline or read-only). Make sure we don't fail the ++ * close(2) for user-space. ++ */ ++ if (zonefs_seq_file_need_wro(inode, file)) ++ zonefs_seq_file_write_close(inode); ++ ++ return 0; ++} ++ ++const struct file_operations zonefs_file_operations = { ++ .open = zonefs_file_open, ++ .release = zonefs_file_release, ++ .fsync = zonefs_file_fsync, ++ .mmap = zonefs_file_mmap, ++ .llseek = zonefs_file_llseek, ++ .read_iter = zonefs_file_read_iter, ++ .write_iter = zonefs_file_write_iter, ++ .splice_read = generic_file_splice_read, ++ .splice_write = iter_file_splice_write, ++ .iopoll = iocb_bio_iopoll, ++}; +diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c +index a9c5c3f7..e808276b 100644 +--- a/fs/zonefs/super.c ++++ b/fs/zonefs/super.c +@@ -30,7 +30,7 @@ + /* + * Manage the active zone count. Called with zi->i_truncate_mutex held. + */ +-static void zonefs_account_active(struct inode *inode) ++void zonefs_account_active(struct inode *inode) + { + struct zonefs_sb_info *sbi = ZONEFS_SB(inode->i_sb); + struct zonefs_inode_info *zi = ZONEFS_I(inode); +@@ -68,7 +68,7 @@ static void zonefs_account_active(struct inode *inode) + } + } + +-static inline int zonefs_zone_mgmt(struct inode *inode, enum req_op op) ++int zonefs_zone_mgmt(struct inode *inode, enum req_op op) + { + struct zonefs_inode_info *zi = ZONEFS_I(inode); + int ret; +@@ -99,7 +99,7 @@ static inline int zonefs_zone_mgmt(struct inode *inode, enum req_op op) + return 0; + } + +-static inline void zonefs_i_size_write(struct inode *inode, loff_t isize) ++void zonefs_i_size_write(struct inode *inode, loff_t isize) + { + struct zonefs_inode_info *zi = ZONEFS_I(inode); + +@@ -117,167 +117,7 @@ static inline void zonefs_i_size_write(struct inode *inode, loff_t isize) + } + } + +-static int zonefs_read_iomap_begin(struct inode *inode, loff_t offset, +- loff_t length, unsigned int flags, +- struct iomap *iomap, struct iomap *srcmap) +-{ +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- struct super_block *sb = inode->i_sb; +- loff_t isize; +- +- /* +- * All blocks are always mapped below EOF. If reading past EOF, +- * act as if there is a hole up to the file maximum size. +- */ +- mutex_lock(&zi->i_truncate_mutex); +- iomap->bdev = inode->i_sb->s_bdev; +- iomap->offset = ALIGN_DOWN(offset, sb->s_blocksize); +- isize = i_size_read(inode); +- if (iomap->offset >= isize) { +- iomap->type = IOMAP_HOLE; +- iomap->addr = IOMAP_NULL_ADDR; +- iomap->length = length; +- } else { +- iomap->type = IOMAP_MAPPED; +- iomap->addr = (zi->i_zsector << SECTOR_SHIFT) + iomap->offset; +- iomap->length = isize - iomap->offset; +- } +- mutex_unlock(&zi->i_truncate_mutex); +- +- trace_zonefs_iomap_begin(inode, iomap); +- +- return 0; +-} +- +-static const struct iomap_ops zonefs_read_iomap_ops = { +- .iomap_begin = zonefs_read_iomap_begin, +-}; +- +-static int zonefs_write_iomap_begin(struct inode *inode, loff_t offset, +- loff_t length, unsigned int flags, +- struct iomap *iomap, struct iomap *srcmap) +-{ +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- struct super_block *sb = inode->i_sb; +- loff_t isize; +- +- /* All write I/Os should always be within the file maximum size */ +- if (WARN_ON_ONCE(offset + length > zi->i_max_size)) +- return -EIO; +- +- /* +- * Sequential zones can only accept direct writes. This is already +- * checked when writes are issued, so warn if we see a page writeback +- * operation. +- */ +- if (WARN_ON_ONCE(zi->i_ztype == ZONEFS_ZTYPE_SEQ && +- !(flags & IOMAP_DIRECT))) +- return -EIO; +- +- /* +- * For conventional zones, all blocks are always mapped. For sequential +- * zones, all blocks after always mapped below the inode size (zone +- * write pointer) and unwriten beyond. +- */ +- mutex_lock(&zi->i_truncate_mutex); +- iomap->bdev = inode->i_sb->s_bdev; +- iomap->offset = ALIGN_DOWN(offset, sb->s_blocksize); +- iomap->addr = (zi->i_zsector << SECTOR_SHIFT) + iomap->offset; +- isize = i_size_read(inode); +- if (iomap->offset >= isize) { +- iomap->type = IOMAP_UNWRITTEN; +- iomap->length = zi->i_max_size - iomap->offset; +- } else { +- iomap->type = IOMAP_MAPPED; +- iomap->length = isize - iomap->offset; +- } +- mutex_unlock(&zi->i_truncate_mutex); +- +- trace_zonefs_iomap_begin(inode, iomap); +- +- return 0; +-} +- +-static const struct iomap_ops zonefs_write_iomap_ops = { +- .iomap_begin = zonefs_write_iomap_begin, +-}; +- +-static int zonefs_read_folio(struct file *unused, struct folio *folio) +-{ +- return iomap_read_folio(folio, &zonefs_read_iomap_ops); +-} +- +-static void zonefs_readahead(struct readahead_control *rac) +-{ +- iomap_readahead(rac, &zonefs_read_iomap_ops); +-} +- +-/* +- * Map blocks for page writeback. This is used only on conventional zone files, +- * which implies that the page range can only be within the fixed inode size. +- */ +-static int zonefs_write_map_blocks(struct iomap_writepage_ctx *wpc, +- struct inode *inode, loff_t offset) +-{ +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- +- if (WARN_ON_ONCE(zi->i_ztype != ZONEFS_ZTYPE_CNV)) +- return -EIO; +- if (WARN_ON_ONCE(offset >= i_size_read(inode))) +- return -EIO; +- +- /* If the mapping is already OK, nothing needs to be done */ +- if (offset >= wpc->iomap.offset && +- offset < wpc->iomap.offset + wpc->iomap.length) +- return 0; +- +- return zonefs_write_iomap_begin(inode, offset, zi->i_max_size - offset, +- IOMAP_WRITE, &wpc->iomap, NULL); +-} +- +-static const struct iomap_writeback_ops zonefs_writeback_ops = { +- .map_blocks = zonefs_write_map_blocks, +-}; +- +-static int zonefs_writepages(struct address_space *mapping, +- struct writeback_control *wbc) +-{ +- struct iomap_writepage_ctx wpc = { }; +- +- return iomap_writepages(mapping, wbc, &wpc, &zonefs_writeback_ops); +-} +- +-static int zonefs_swap_activate(struct swap_info_struct *sis, +- struct file *swap_file, sector_t *span) +-{ +- struct inode *inode = file_inode(swap_file); +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- +- if (zi->i_ztype != ZONEFS_ZTYPE_CNV) { +- zonefs_err(inode->i_sb, +- "swap file: not a conventional zone file\n"); +- return -EINVAL; +- } +- +- return iomap_swapfile_activate(sis, swap_file, span, +- &zonefs_read_iomap_ops); +-} +- +-static const struct address_space_operations zonefs_file_aops = { +- .read_folio = zonefs_read_folio, +- .readahead = zonefs_readahead, +- .writepages = zonefs_writepages, +- .dirty_folio = filemap_dirty_folio, +- .release_folio = iomap_release_folio, +- .invalidate_folio = iomap_invalidate_folio, +- .migrate_folio = filemap_migrate_folio, +- .is_partially_uptodate = iomap_is_partially_uptodate, +- .error_remove_page = generic_error_remove_page, +- .direct_IO = noop_direct_IO, +- .swap_activate = zonefs_swap_activate, +-}; +- +-static void zonefs_update_stats(struct inode *inode, loff_t new_isize) ++void zonefs_update_stats(struct inode *inode, loff_t new_isize) + { + struct super_block *sb = inode->i_sb; + struct zonefs_sb_info *sbi = ZONEFS_SB(sb); +@@ -487,7 +327,7 @@ static int zonefs_io_error_cb(struct blk_zone *zone, unsigned int idx, + * eventually correct the file size and zonefs inode write pointer offset + * (which can be out of sync with the drive due to partial write failures). + */ +-static void __zonefs_io_error(struct inode *inode, bool write) ++void __zonefs_io_error(struct inode *inode, bool write) + { + struct zonefs_inode_info *zi = ZONEFS_I(inode); + struct super_block *sb = inode->i_sb; +@@ -526,749 +366,6 @@ static void __zonefs_io_error(struct inode *inode, bool write) + memalloc_noio_restore(noio_flag); + } + +-static void zonefs_io_error(struct inode *inode, bool write) +-{ +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- +- mutex_lock(&zi->i_truncate_mutex); +- __zonefs_io_error(inode, write); +- mutex_unlock(&zi->i_truncate_mutex); +-} +- +-static int zonefs_file_truncate(struct inode *inode, loff_t isize) +-{ +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- loff_t old_isize; +- enum req_op op; +- int ret = 0; +- +- /* +- * Only sequential zone files can be truncated and truncation is allowed +- * only down to a 0 size, which is equivalent to a zone reset, and to +- * the maximum file size, which is equivalent to a zone finish. +- */ +- if (zi->i_ztype != ZONEFS_ZTYPE_SEQ) +- return -EPERM; +- +- if (!isize) +- op = REQ_OP_ZONE_RESET; +- else if (isize == zi->i_max_size) +- op = REQ_OP_ZONE_FINISH; +- else +- return -EPERM; +- +- inode_dio_wait(inode); +- +- /* Serialize against page faults */ +- filemap_invalidate_lock(inode->i_mapping); +- +- /* Serialize against zonefs_iomap_begin() */ +- mutex_lock(&zi->i_truncate_mutex); +- +- old_isize = i_size_read(inode); +- if (isize == old_isize) +- goto unlock; +- +- ret = zonefs_zone_mgmt(inode, op); +- if (ret) +- goto unlock; +- +- /* +- * If the mount option ZONEFS_MNTOPT_EXPLICIT_OPEN is set, +- * take care of open zones. +- */ +- if (zi->i_flags & ZONEFS_ZONE_OPEN) { +- /* +- * Truncating a zone to EMPTY or FULL is the equivalent of +- * closing the zone. For a truncation to 0, we need to +- * re-open the zone to ensure new writes can be processed. +- * For a truncation to the maximum file size, the zone is +- * closed and writes cannot be accepted anymore, so clear +- * the open flag. +- */ +- if (!isize) +- ret = zonefs_zone_mgmt(inode, REQ_OP_ZONE_OPEN); +- else +- zi->i_flags &= ~ZONEFS_ZONE_OPEN; +- } +- +- zonefs_update_stats(inode, isize); +- truncate_setsize(inode, isize); +- zi->i_wpoffset = isize; +- zonefs_account_active(inode); +- +-unlock: +- mutex_unlock(&zi->i_truncate_mutex); +- filemap_invalidate_unlock(inode->i_mapping); +- +- return ret; +-} +- +-static int zonefs_inode_setattr(struct user_namespace *mnt_userns, +- struct dentry *dentry, struct iattr *iattr) +-{ +- struct inode *inode = d_inode(dentry); +- int ret; +- +- if (unlikely(IS_IMMUTABLE(inode))) +- return -EPERM; +- +- ret = setattr_prepare(&init_user_ns, dentry, iattr); +- if (ret) +- return ret; +- +- /* +- * Since files and directories cannot be created nor deleted, do not +- * allow setting any write attributes on the sub-directories grouping +- * files by zone type. +- */ +- if ((iattr->ia_valid & ATTR_MODE) && S_ISDIR(inode->i_mode) && +- (iattr->ia_mode & 0222)) +- return -EPERM; +- +- if (((iattr->ia_valid & ATTR_UID) && +- !uid_eq(iattr->ia_uid, inode->i_uid)) || +- ((iattr->ia_valid & ATTR_GID) && +- !gid_eq(iattr->ia_gid, inode->i_gid))) { +- ret = dquot_transfer(mnt_userns, inode, iattr); +- if (ret) +- return ret; +- } +- +- if (iattr->ia_valid & ATTR_SIZE) { +- ret = zonefs_file_truncate(inode, iattr->ia_size); +- if (ret) +- return ret; +- } +- +- setattr_copy(&init_user_ns, inode, iattr); +- +- return 0; +-} +- +-static const struct inode_operations zonefs_file_inode_operations = { +- .setattr = zonefs_inode_setattr, +-}; +- +-static int zonefs_file_fsync(struct file *file, loff_t start, loff_t end, +- int datasync) +-{ +- struct inode *inode = file_inode(file); +- int ret = 0; +- +- if (unlikely(IS_IMMUTABLE(inode))) +- return -EPERM; +- +- /* +- * Since only direct writes are allowed in sequential files, page cache +- * flush is needed only for conventional zone files. +- */ +- if (ZONEFS_I(inode)->i_ztype == ZONEFS_ZTYPE_CNV) +- ret = file_write_and_wait_range(file, start, end); +- if (!ret) +- ret = blkdev_issue_flush(inode->i_sb->s_bdev); +- +- if (ret) +- zonefs_io_error(inode, true); +- +- return ret; +-} +- +-static vm_fault_t zonefs_filemap_page_mkwrite(struct vm_fault *vmf) +-{ +- struct inode *inode = file_inode(vmf->vma->vm_file); +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- vm_fault_t ret; +- +- if (unlikely(IS_IMMUTABLE(inode))) +- return VM_FAULT_SIGBUS; +- +- /* +- * Sanity check: only conventional zone files can have shared +- * writeable mappings. +- */ +- if (WARN_ON_ONCE(zi->i_ztype != ZONEFS_ZTYPE_CNV)) +- return VM_FAULT_NOPAGE; +- +- sb_start_pagefault(inode->i_sb); +- file_update_time(vmf->vma->vm_file); +- +- /* Serialize against truncates */ +- filemap_invalidate_lock_shared(inode->i_mapping); +- ret = iomap_page_mkwrite(vmf, &zonefs_write_iomap_ops); +- filemap_invalidate_unlock_shared(inode->i_mapping); +- +- sb_end_pagefault(inode->i_sb); +- return ret; +-} +- +-static const struct vm_operations_struct zonefs_file_vm_ops = { +- .fault = filemap_fault, +- .map_pages = filemap_map_pages, +- .page_mkwrite = zonefs_filemap_page_mkwrite, +-}; +- +-static int zonefs_file_mmap(struct file *file, struct vm_area_struct *vma) +-{ +- /* +- * Conventional zones accept random writes, so their files can support +- * shared writable mappings. For sequential zone files, only read +- * mappings are possible since there are no guarantees for write +- * ordering between msync() and page cache writeback. +- */ +- if (ZONEFS_I(file_inode(file))->i_ztype == ZONEFS_ZTYPE_SEQ && +- (vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_MAYWRITE)) +- return -EINVAL; +- +- file_accessed(file); +- vma->vm_ops = &zonefs_file_vm_ops; +- +- return 0; +-} +- +-static loff_t zonefs_file_llseek(struct file *file, loff_t offset, int whence) +-{ +- loff_t isize = i_size_read(file_inode(file)); +- +- /* +- * Seeks are limited to below the zone size for conventional zones +- * and below the zone write pointer for sequential zones. In both +- * cases, this limit is the inode size. +- */ +- return generic_file_llseek_size(file, offset, whence, isize, isize); +-} +- +-static int zonefs_file_write_dio_end_io(struct kiocb *iocb, ssize_t size, +- int error, unsigned int flags) +-{ +- struct inode *inode = file_inode(iocb->ki_filp); +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- +- if (error) { +- zonefs_io_error(inode, true); +- return error; +- } +- +- if (size && zi->i_ztype != ZONEFS_ZTYPE_CNV) { +- /* +- * Note that we may be seeing completions out of order, +- * but that is not a problem since a write completed +- * successfully necessarily means that all preceding writes +- * were also successful. So we can safely increase the inode +- * size to the write end location. +- */ +- mutex_lock(&zi->i_truncate_mutex); +- if (i_size_read(inode) < iocb->ki_pos + size) { +- zonefs_update_stats(inode, iocb->ki_pos + size); +- zonefs_i_size_write(inode, iocb->ki_pos + size); +- } +- mutex_unlock(&zi->i_truncate_mutex); +- } +- +- return 0; +-} +- +-static const struct iomap_dio_ops zonefs_write_dio_ops = { +- .end_io = zonefs_file_write_dio_end_io, +-}; +- +-static ssize_t zonefs_file_dio_append(struct kiocb *iocb, struct iov_iter *from) +-{ +- struct inode *inode = file_inode(iocb->ki_filp); +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- struct block_device *bdev = inode->i_sb->s_bdev; +- unsigned int max = bdev_max_zone_append_sectors(bdev); +- struct bio *bio; +- ssize_t size; +- int nr_pages; +- ssize_t ret; +- +- max = ALIGN_DOWN(max << SECTOR_SHIFT, inode->i_sb->s_blocksize); +- iov_iter_truncate(from, max); +- +- nr_pages = iov_iter_npages(from, BIO_MAX_VECS); +- if (!nr_pages) +- return 0; +- +- bio = bio_alloc(bdev, nr_pages, +- REQ_OP_ZONE_APPEND | REQ_SYNC | REQ_IDLE, GFP_NOFS); +- bio->bi_iter.bi_sector = zi->i_zsector; +- bio->bi_ioprio = iocb->ki_ioprio; +- if (iocb_is_dsync(iocb)) +- bio->bi_opf |= REQ_FUA; +- +- ret = bio_iov_iter_get_pages(bio, from); +- if (unlikely(ret)) +- goto out_release; +- +- size = bio->bi_iter.bi_size; +- task_io_account_write(size); +- +- if (iocb->ki_flags & IOCB_HIPRI) +- bio_set_polled(bio, iocb); +- +- ret = submit_bio_wait(bio); +- +- /* +- * If the file zone was written underneath the file system, the zone +- * write pointer may not be where we expect it to be, but the zone +- * append write can still succeed. So check manually that we wrote where +- * we intended to, that is, at zi->i_wpoffset. +- */ +- if (!ret) { +- sector_t wpsector = +- zi->i_zsector + (zi->i_wpoffset >> SECTOR_SHIFT); +- +- if (bio->bi_iter.bi_sector != wpsector) { +- zonefs_warn(inode->i_sb, +- "Corrupted write pointer %llu for zone at %llu\n", +- wpsector, zi->i_zsector); +- ret = -EIO; +- } +- } +- +- zonefs_file_write_dio_end_io(iocb, size, ret, 0); +- trace_zonefs_file_dio_append(inode, size, ret); +- +-out_release: +- bio_release_pages(bio, false); +- bio_put(bio); +- +- if (ret >= 0) { +- iocb->ki_pos += size; +- return size; +- } +- +- return ret; +-} +- +-/* +- * Do not exceed the LFS limits nor the file zone size. If pos is under the +- * limit it becomes a short access. If it exceeds the limit, return -EFBIG. +- */ +-static loff_t zonefs_write_check_limits(struct file *file, loff_t pos, +- loff_t count) +-{ +- struct inode *inode = file_inode(file); +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- loff_t limit = rlimit(RLIMIT_FSIZE); +- loff_t max_size = zi->i_max_size; +- +- if (limit != RLIM_INFINITY) { +- if (pos >= limit) { +- send_sig(SIGXFSZ, current, 0); +- return -EFBIG; +- } +- count = min(count, limit - pos); +- } +- +- if (!(file->f_flags & O_LARGEFILE)) +- max_size = min_t(loff_t, MAX_NON_LFS, max_size); +- +- if (unlikely(pos >= max_size)) +- return -EFBIG; +- +- return min(count, max_size - pos); +-} +- +-static ssize_t zonefs_write_checks(struct kiocb *iocb, struct iov_iter *from) +-{ +- struct file *file = iocb->ki_filp; +- struct inode *inode = file_inode(file); +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- loff_t count; +- +- if (IS_SWAPFILE(inode)) +- return -ETXTBSY; +- +- if (!iov_iter_count(from)) +- return 0; +- +- if ((iocb->ki_flags & IOCB_NOWAIT) && !(iocb->ki_flags & IOCB_DIRECT)) +- return -EINVAL; +- +- if (iocb->ki_flags & IOCB_APPEND) { +- if (zi->i_ztype != ZONEFS_ZTYPE_SEQ) +- return -EINVAL; +- mutex_lock(&zi->i_truncate_mutex); +- iocb->ki_pos = zi->i_wpoffset; +- mutex_unlock(&zi->i_truncate_mutex); +- } +- +- count = zonefs_write_check_limits(file, iocb->ki_pos, +- iov_iter_count(from)); +- if (count < 0) +- return count; +- +- iov_iter_truncate(from, count); +- return iov_iter_count(from); +-} +- +-/* +- * Handle direct writes. For sequential zone files, this is the only possible +- * write path. For these files, check that the user is issuing writes +- * sequentially from the end of the file. This code assumes that the block layer +- * delivers write requests to the device in sequential order. This is always the +- * case if a block IO scheduler implementing the ELEVATOR_F_ZBD_SEQ_WRITE +- * elevator feature is being used (e.g. mq-deadline). The block layer always +- * automatically select such an elevator for zoned block devices during the +- * device initialization. +- */ +-static ssize_t zonefs_file_dio_write(struct kiocb *iocb, struct iov_iter *from) +-{ +- struct inode *inode = file_inode(iocb->ki_filp); +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- struct super_block *sb = inode->i_sb; +- bool sync = is_sync_kiocb(iocb); +- bool append = false; +- ssize_t ret, count; +- +- /* +- * For async direct IOs to sequential zone files, refuse IOCB_NOWAIT +- * as this can cause write reordering (e.g. the first aio gets EAGAIN +- * on the inode lock but the second goes through but is now unaligned). +- */ +- if (zi->i_ztype == ZONEFS_ZTYPE_SEQ && !sync && +- (iocb->ki_flags & IOCB_NOWAIT)) +- return -EOPNOTSUPP; +- +- if (iocb->ki_flags & IOCB_NOWAIT) { +- if (!inode_trylock(inode)) +- return -EAGAIN; +- } else { +- inode_lock(inode); +- } +- +- count = zonefs_write_checks(iocb, from); +- if (count <= 0) { +- ret = count; +- goto inode_unlock; +- } +- +- if ((iocb->ki_pos | count) & (sb->s_blocksize - 1)) { +- ret = -EINVAL; +- goto inode_unlock; +- } +- +- /* Enforce sequential writes (append only) in sequential zones */ +- if (zi->i_ztype == ZONEFS_ZTYPE_SEQ) { +- mutex_lock(&zi->i_truncate_mutex); +- if (iocb->ki_pos != zi->i_wpoffset) { +- mutex_unlock(&zi->i_truncate_mutex); +- ret = -EINVAL; +- goto inode_unlock; +- } +- mutex_unlock(&zi->i_truncate_mutex); +- append = sync; +- } +- +- if (append) +- ret = zonefs_file_dio_append(iocb, from); +- else +- ret = iomap_dio_rw(iocb, from, &zonefs_write_iomap_ops, +- &zonefs_write_dio_ops, 0, NULL, 0); +- if (zi->i_ztype == ZONEFS_ZTYPE_SEQ && +- (ret > 0 || ret == -EIOCBQUEUED)) { +- if (ret > 0) +- count = ret; +- +- /* +- * Update the zone write pointer offset assuming the write +- * operation succeeded. If it did not, the error recovery path +- * will correct it. Also do active seq file accounting. +- */ +- mutex_lock(&zi->i_truncate_mutex); +- zi->i_wpoffset += count; +- zonefs_account_active(inode); +- mutex_unlock(&zi->i_truncate_mutex); +- } +- +-inode_unlock: +- inode_unlock(inode); +- +- return ret; +-} +- +-static ssize_t zonefs_file_buffered_write(struct kiocb *iocb, +- struct iov_iter *from) +-{ +- struct inode *inode = file_inode(iocb->ki_filp); +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- ssize_t ret; +- +- /* +- * Direct IO writes are mandatory for sequential zone files so that the +- * write IO issuing order is preserved. +- */ +- if (zi->i_ztype != ZONEFS_ZTYPE_CNV) +- return -EIO; +- +- if (iocb->ki_flags & IOCB_NOWAIT) { +- if (!inode_trylock(inode)) +- return -EAGAIN; +- } else { +- inode_lock(inode); +- } +- +- ret = zonefs_write_checks(iocb, from); +- if (ret <= 0) +- goto inode_unlock; +- +- ret = iomap_file_buffered_write(iocb, from, &zonefs_write_iomap_ops); +- if (ret > 0) +- iocb->ki_pos += ret; +- else if (ret == -EIO) +- zonefs_io_error(inode, true); +- +-inode_unlock: +- inode_unlock(inode); +- if (ret > 0) +- ret = generic_write_sync(iocb, ret); +- +- return ret; +-} +- +-static ssize_t zonefs_file_write_iter(struct kiocb *iocb, struct iov_iter *from) +-{ +- struct inode *inode = file_inode(iocb->ki_filp); +- +- if (unlikely(IS_IMMUTABLE(inode))) +- return -EPERM; +- +- if (sb_rdonly(inode->i_sb)) +- return -EROFS; +- +- /* Write operations beyond the zone size are not allowed */ +- if (iocb->ki_pos >= ZONEFS_I(inode)->i_max_size) +- return -EFBIG; +- +- if (iocb->ki_flags & IOCB_DIRECT) { +- ssize_t ret = zonefs_file_dio_write(iocb, from); +- if (ret != -ENOTBLK) +- return ret; +- } +- +- return zonefs_file_buffered_write(iocb, from); +-} +- +-static int zonefs_file_read_dio_end_io(struct kiocb *iocb, ssize_t size, +- int error, unsigned int flags) +-{ +- if (error) { +- zonefs_io_error(file_inode(iocb->ki_filp), false); +- return error; +- } +- +- return 0; +-} +- +-static const struct iomap_dio_ops zonefs_read_dio_ops = { +- .end_io = zonefs_file_read_dio_end_io, +-}; +- +-static ssize_t zonefs_file_read_iter(struct kiocb *iocb, struct iov_iter *to) +-{ +- struct inode *inode = file_inode(iocb->ki_filp); +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- struct super_block *sb = inode->i_sb; +- loff_t isize; +- ssize_t ret; +- +- /* Offline zones cannot be read */ +- if (unlikely(IS_IMMUTABLE(inode) && !(inode->i_mode & 0777))) +- return -EPERM; +- +- if (iocb->ki_pos >= zi->i_max_size) +- return 0; +- +- if (iocb->ki_flags & IOCB_NOWAIT) { +- if (!inode_trylock_shared(inode)) +- return -EAGAIN; +- } else { +- inode_lock_shared(inode); +- } +- +- /* Limit read operations to written data */ +- mutex_lock(&zi->i_truncate_mutex); +- isize = i_size_read(inode); +- if (iocb->ki_pos >= isize) { +- mutex_unlock(&zi->i_truncate_mutex); +- ret = 0; +- goto inode_unlock; +- } +- iov_iter_truncate(to, isize - iocb->ki_pos); +- mutex_unlock(&zi->i_truncate_mutex); +- +- if (iocb->ki_flags & IOCB_DIRECT) { +- size_t count = iov_iter_count(to); +- +- if ((iocb->ki_pos | count) & (sb->s_blocksize - 1)) { +- ret = -EINVAL; +- goto inode_unlock; +- } +- file_accessed(iocb->ki_filp); +- ret = iomap_dio_rw(iocb, to, &zonefs_read_iomap_ops, +- &zonefs_read_dio_ops, 0, NULL, 0); +- } else { +- ret = generic_file_read_iter(iocb, to); +- if (ret == -EIO) +- zonefs_io_error(inode, false); +- } +- +-inode_unlock: +- inode_unlock_shared(inode); +- +- return ret; +-} +- +-/* +- * Write open accounting is done only for sequential files. +- */ +-static inline bool zonefs_seq_file_need_wro(struct inode *inode, +- struct file *file) +-{ +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- +- if (zi->i_ztype != ZONEFS_ZTYPE_SEQ) +- return false; +- +- if (!(file->f_mode & FMODE_WRITE)) +- return false; +- +- return true; +-} +- +-static int zonefs_seq_file_write_open(struct inode *inode) +-{ +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- int ret = 0; +- +- mutex_lock(&zi->i_truncate_mutex); +- +- if (!zi->i_wr_refcnt) { +- struct zonefs_sb_info *sbi = ZONEFS_SB(inode->i_sb); +- unsigned int wro = atomic_inc_return(&sbi->s_wro_seq_files); +- +- if (sbi->s_mount_opts & ZONEFS_MNTOPT_EXPLICIT_OPEN) { +- +- if (sbi->s_max_wro_seq_files +- && wro > sbi->s_max_wro_seq_files) { +- atomic_dec(&sbi->s_wro_seq_files); +- ret = -EBUSY; +- goto unlock; +- } +- +- if (i_size_read(inode) < zi->i_max_size) { +- ret = zonefs_zone_mgmt(inode, REQ_OP_ZONE_OPEN); +- if (ret) { +- atomic_dec(&sbi->s_wro_seq_files); +- goto unlock; +- } +- zi->i_flags |= ZONEFS_ZONE_OPEN; +- zonefs_account_active(inode); +- } +- } +- } +- +- zi->i_wr_refcnt++; +- +-unlock: +- mutex_unlock(&zi->i_truncate_mutex); +- +- return ret; +-} +- +-static int zonefs_file_open(struct inode *inode, struct file *file) +-{ +- int ret; +- +- ret = generic_file_open(inode, file); +- if (ret) +- return ret; +- +- if (zonefs_seq_file_need_wro(inode, file)) +- return zonefs_seq_file_write_open(inode); +- +- return 0; +-} +- +-static void zonefs_seq_file_write_close(struct inode *inode) +-{ +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- struct super_block *sb = inode->i_sb; +- struct zonefs_sb_info *sbi = ZONEFS_SB(sb); +- int ret = 0; +- +- mutex_lock(&zi->i_truncate_mutex); +- +- zi->i_wr_refcnt--; +- if (zi->i_wr_refcnt) +- goto unlock; +- +- /* +- * The file zone may not be open anymore (e.g. the file was truncated to +- * its maximum size or it was fully written). For this case, we only +- * need to decrement the write open count. +- */ +- if (zi->i_flags & ZONEFS_ZONE_OPEN) { +- ret = zonefs_zone_mgmt(inode, REQ_OP_ZONE_CLOSE); +- if (ret) { +- __zonefs_io_error(inode, false); +- /* +- * Leaving zones explicitly open may lead to a state +- * where most zones cannot be written (zone resources +- * exhausted). So take preventive action by remounting +- * read-only. +- */ +- if (zi->i_flags & ZONEFS_ZONE_OPEN && +- !(sb->s_flags & SB_RDONLY)) { +- zonefs_warn(sb, +- "closing zone at %llu failed %d\n", +- zi->i_zsector, ret); +- zonefs_warn(sb, +- "remounting filesystem read-only\n"); +- sb->s_flags |= SB_RDONLY; +- } +- goto unlock; +- } +- +- zi->i_flags &= ~ZONEFS_ZONE_OPEN; +- zonefs_account_active(inode); +- } +- +- atomic_dec(&sbi->s_wro_seq_files); +- +-unlock: +- mutex_unlock(&zi->i_truncate_mutex); +-} +- +-static int zonefs_file_release(struct inode *inode, struct file *file) +-{ +- /* +- * If we explicitly open a zone we must close it again as well, but the +- * zone management operation can fail (either due to an IO error or as +- * the zone has gone offline or read-only). Make sure we don't fail the +- * close(2) for user-space. +- */ +- if (zonefs_seq_file_need_wro(inode, file)) +- zonefs_seq_file_write_close(inode); +- +- return 0; +-} +- +-static const struct file_operations zonefs_file_operations = { +- .open = zonefs_file_open, +- .release = zonefs_file_release, +- .fsync = zonefs_file_fsync, +- .mmap = zonefs_file_mmap, +- .llseek = zonefs_file_llseek, +- .read_iter = zonefs_file_read_iter, +- .write_iter = zonefs_file_write_iter, +- .splice_read = generic_file_splice_read, +- .splice_write = iter_file_splice_write, +- .iopoll = iocb_bio_iopoll, +-}; +- + static struct kmem_cache *zonefs_inode_cachep; + + static struct inode *zonefs_alloc_inode(struct super_block *sb) +@@ -1408,13 +505,47 @@ static int zonefs_remount(struct super_block *sb, int *flags, char *data) + return zonefs_parse_options(sb, data); + } + +-static const struct super_operations zonefs_sops = { +- .alloc_inode = zonefs_alloc_inode, +- .free_inode = zonefs_free_inode, +- .statfs = zonefs_statfs, +- .remount_fs = zonefs_remount, +- .show_options = zonefs_show_options, +-}; ++static int zonefs_inode_setattr(struct user_namespace *mnt_userns, ++ struct dentry *dentry, struct iattr *iattr) ++{ ++ struct inode *inode = d_inode(dentry); ++ int ret; ++ ++ if (unlikely(IS_IMMUTABLE(inode))) ++ return -EPERM; ++ ++ ret = setattr_prepare(&init_user_ns, dentry, iattr); ++ if (ret) ++ return ret; ++ ++ /* ++ * Since files and directories cannot be created nor deleted, do not ++ * allow setting any write attributes on the sub-directories grouping ++ * files by zone type. ++ */ ++ if ((iattr->ia_valid & ATTR_MODE) && S_ISDIR(inode->i_mode) && ++ (iattr->ia_mode & 0222)) ++ return -EPERM; ++ ++ if (((iattr->ia_valid & ATTR_UID) && ++ !uid_eq(iattr->ia_uid, inode->i_uid)) || ++ ((iattr->ia_valid & ATTR_GID) && ++ !gid_eq(iattr->ia_gid, inode->i_gid))) { ++ ret = dquot_transfer(mnt_userns, inode, iattr); ++ if (ret) ++ return ret; ++ } ++ ++ if (iattr->ia_valid & ATTR_SIZE) { ++ ret = zonefs_file_truncate(inode, iattr->ia_size); ++ if (ret) ++ return ret; ++ } ++ ++ setattr_copy(&init_user_ns, inode, iattr); ++ ++ return 0; ++} + + static const struct inode_operations zonefs_dir_inode_operations = { + .lookup = simple_lookup, +@@ -1434,6 +565,10 @@ static void zonefs_init_dir_inode(struct inode *parent, struct inode *inode, + inc_nlink(parent); + } + ++static const struct inode_operations zonefs_file_inode_operations = { ++ .setattr = zonefs_inode_setattr, ++}; ++ + static int zonefs_init_file_inode(struct inode *inode, struct blk_zone *zone, + enum zonefs_ztype type) + { +@@ -1785,6 +920,14 @@ static int zonefs_read_super(struct super_block *sb) + return ret; + } + ++static const struct super_operations zonefs_sops = { ++ .alloc_inode = zonefs_alloc_inode, ++ .free_inode = zonefs_free_inode, ++ .statfs = zonefs_statfs, ++ .remount_fs = zonefs_remount, ++ .show_options = zonefs_show_options, ++}; ++ + /* + * Check that the device is zoned. If it is, get the list of zones and create + * sub-directories and files according to the device zone configuration and +diff --git a/fs/zonefs/zonefs.h b/fs/zonefs/zonefs.h +index 1dbe7811..839ebe9a 100644 +--- a/fs/zonefs/zonefs.h ++++ b/fs/zonefs/zonefs.h +@@ -209,6 +209,28 @@ static inline struct zonefs_sb_info *ZONEFS_SB(struct super_block *sb) + #define zonefs_warn(sb, format, args...) \ + pr_warn("zonefs (%s) WARNING: " format, sb->s_id, ## args) + ++/* In super.c */ ++void zonefs_account_active(struct inode *inode); ++int zonefs_zone_mgmt(struct inode *inode, enum req_op op); ++void zonefs_i_size_write(struct inode *inode, loff_t isize); ++void zonefs_update_stats(struct inode *inode, loff_t new_isize); ++void __zonefs_io_error(struct inode *inode, bool write); ++ ++static inline void zonefs_io_error(struct inode *inode, bool write) ++{ ++ struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ ++ mutex_lock(&zi->i_truncate_mutex); ++ __zonefs_io_error(inode, write); ++ mutex_unlock(&zi->i_truncate_mutex); ++} ++ ++/* In file.c */ ++extern const struct address_space_operations zonefs_file_aops; ++extern const struct file_operations zonefs_file_operations; ++int zonefs_file_truncate(struct inode *inode, loff_t isize); ++ ++/* In sysfs.c */ + int zonefs_sysfs_register(struct super_block *sb); + void zonefs_sysfs_unregister(struct super_block *sb); + int zonefs_sysfs_init(void); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-006-zonefs-Simplify-IO-error-handling.patch b/patches.kernel.org/6.2.10-006-zonefs-Simplify-IO-error-handling.patch new file mode 100644 index 0000000..1c9af8d --- /dev/null +++ b/patches.kernel.org/6.2.10-006-zonefs-Simplify-IO-error-handling.patch @@ -0,0 +1,245 @@ +From: Damien Le Moal +Date: Fri, 25 Nov 2022 11:06:20 +0900 +Subject: [PATCH] zonefs: Simplify IO error handling +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 46a9c526eef7fb68a00321e2a9591ce5276ae92b + +[ Upstream commit 46a9c526eef7fb68a00321e2a9591ce5276ae92b ] + +Simplify zonefs_check_zone_condition() by moving the code that changes +an inode access rights to the new function zonefs_inode_update_mode(). +Furthermore, since on mount an inode wpoffset is always zero when +zonefs_check_zone_condition() is called during an inode initialization, +the "mount" boolean argument is not necessary for the readonly zone +case. This argument is thus removed. + +zonefs_io_error_cb() is also modified to use the inode offline and +zone state flags instead of checking the device zone condition. The +multiple calls to zonefs_check_zone_condition() are reduced to the first +call on entry, which allows removing the "warn" argument. +zonefs_inode_update_mode() is also used to update an inode access rights +as zonefs_io_error_cb() modifies the inode flags depending on the volume +error handling mode (defined with a mount option). Since an inode mode +change differs for read-only zones between mount time and IO error time, +the flag ZONEFS_ZONE_INIT_MODE is used to differentiate both cases. + +Signed-off-by: Damien Le Moal +Reviewed-by: Johannes Thumshirn +Stable-dep-of: 88b170088ad2 ("zonefs: Fix error message in zonefs_file_dio_append()") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/zonefs/super.c | 110 ++++++++++++++++++++++++--------------------- + fs/zonefs/zonefs.h | 9 ++-- + 2 files changed, 64 insertions(+), 55 deletions(-) + +diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c +index e808276b..6307cc95 100644 +--- a/fs/zonefs/super.c ++++ b/fs/zonefs/super.c +@@ -155,48 +155,31 @@ void zonefs_update_stats(struct inode *inode, loff_t new_isize) + * amount of readable data in the zone. + */ + static loff_t zonefs_check_zone_condition(struct inode *inode, +- struct blk_zone *zone, bool warn, +- bool mount) ++ struct blk_zone *zone) + { + struct zonefs_inode_info *zi = ZONEFS_I(inode); + + switch (zone->cond) { + case BLK_ZONE_COND_OFFLINE: +- /* +- * Dead zone: make the inode immutable, disable all accesses +- * and set the file size to 0 (zone wp set to zone start). +- */ +- if (warn) +- zonefs_warn(inode->i_sb, "inode %lu: offline zone\n", +- inode->i_ino); +- inode->i_flags |= S_IMMUTABLE; +- inode->i_mode &= ~0777; +- zone->wp = zone->start; ++ zonefs_warn(inode->i_sb, "inode %lu: offline zone\n", ++ inode->i_ino); + zi->i_flags |= ZONEFS_ZONE_OFFLINE; + return 0; + case BLK_ZONE_COND_READONLY: + /* +- * The write pointer of read-only zones is invalid. If such a +- * zone is found during mount, the file size cannot be retrieved +- * so we treat the zone as offline (mount == true case). +- * Otherwise, keep the file size as it was when last updated +- * so that the user can recover data. In both cases, writes are +- * always disabled for the zone. ++ * The write pointer of read-only zones is invalid, so we cannot ++ * determine the zone wpoffset (inode size). We thus keep the ++ * zone wpoffset as is, which leads to an empty file ++ * (wpoffset == 0) on mount. For a runtime error, this keeps ++ * the inode size as it was when last updated so that the user ++ * can recover data. + */ +- if (warn) +- zonefs_warn(inode->i_sb, "inode %lu: read-only zone\n", +- inode->i_ino); +- inode->i_flags |= S_IMMUTABLE; +- if (mount) { +- zone->cond = BLK_ZONE_COND_OFFLINE; +- inode->i_mode &= ~0777; +- zone->wp = zone->start; +- zi->i_flags |= ZONEFS_ZONE_OFFLINE; +- return 0; +- } ++ zonefs_warn(inode->i_sb, "inode %lu: read-only zone\n", ++ inode->i_ino); + zi->i_flags |= ZONEFS_ZONE_READONLY; +- inode->i_mode &= ~0222; +- return i_size_read(inode); ++ if (zi->i_ztype == ZONEFS_ZTYPE_CNV) ++ return zi->i_max_size; ++ return zi->i_wpoffset; + case BLK_ZONE_COND_FULL: + /* The write pointer of full zones is invalid. */ + return zi->i_max_size; +@@ -207,6 +190,30 @@ static loff_t zonefs_check_zone_condition(struct inode *inode, + } + } + ++/* ++ * Check a zone condition and adjust its inode access permissions for ++ * offline and readonly zones. ++ */ ++static void zonefs_inode_update_mode(struct inode *inode) ++{ ++ struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ ++ if (zi->i_flags & ZONEFS_ZONE_OFFLINE) { ++ /* Offline zones cannot be read nor written */ ++ inode->i_flags |= S_IMMUTABLE; ++ inode->i_mode &= ~0777; ++ } else if (zi->i_flags & ZONEFS_ZONE_READONLY) { ++ /* Readonly zones cannot be written */ ++ inode->i_flags |= S_IMMUTABLE; ++ if (zi->i_flags & ZONEFS_ZONE_INIT_MODE) ++ inode->i_mode &= ~0777; ++ else ++ inode->i_mode &= ~0222; ++ } ++ ++ zi->i_flags &= ~ZONEFS_ZONE_INIT_MODE; ++} ++ + struct zonefs_ioerr_data { + struct inode *inode; + bool write; +@@ -228,10 +235,9 @@ static int zonefs_io_error_cb(struct blk_zone *zone, unsigned int idx, + * as there is no inconsistency between the inode size and the amount of + * data writen in the zone (data_size). + */ +- data_size = zonefs_check_zone_condition(inode, zone, true, false); ++ data_size = zonefs_check_zone_condition(inode, zone); + isize = i_size_read(inode); +- if (zone->cond != BLK_ZONE_COND_OFFLINE && +- zone->cond != BLK_ZONE_COND_READONLY && ++ if (!(zi->i_flags & (ZONEFS_ZONE_READONLY | ZONEFS_ZONE_OFFLINE)) && + !err->write && isize == data_size) + return 0; + +@@ -264,24 +270,22 @@ static int zonefs_io_error_cb(struct blk_zone *zone, unsigned int idx, + * zone condition to read-only and offline respectively, as if the + * condition was signaled by the hardware. + */ +- if (zone->cond == BLK_ZONE_COND_OFFLINE || +- sbi->s_mount_opts & ZONEFS_MNTOPT_ERRORS_ZOL) { ++ if ((zi->i_flags & ZONEFS_ZONE_OFFLINE) || ++ (sbi->s_mount_opts & ZONEFS_MNTOPT_ERRORS_ZOL)) { + zonefs_warn(sb, "inode %lu: read/write access disabled\n", + inode->i_ino); +- if (zone->cond != BLK_ZONE_COND_OFFLINE) { +- zone->cond = BLK_ZONE_COND_OFFLINE; +- data_size = zonefs_check_zone_condition(inode, zone, +- false, false); +- } +- } else if (zone->cond == BLK_ZONE_COND_READONLY || +- sbi->s_mount_opts & ZONEFS_MNTOPT_ERRORS_ZRO) { ++ if (!(zi->i_flags & ZONEFS_ZONE_OFFLINE)) ++ zi->i_flags |= ZONEFS_ZONE_OFFLINE; ++ zonefs_inode_update_mode(inode); ++ data_size = 0; ++ } else if ((zi->i_flags & ZONEFS_ZONE_READONLY) || ++ (sbi->s_mount_opts & ZONEFS_MNTOPT_ERRORS_ZRO)) { + zonefs_warn(sb, "inode %lu: write access disabled\n", + inode->i_ino); +- if (zone->cond != BLK_ZONE_COND_READONLY) { +- zone->cond = BLK_ZONE_COND_READONLY; +- data_size = zonefs_check_zone_condition(inode, zone, +- false, false); +- } ++ if (!(zi->i_flags & ZONEFS_ZONE_READONLY)) ++ zi->i_flags |= ZONEFS_ZONE_READONLY; ++ zonefs_inode_update_mode(inode); ++ data_size = isize; + } else if (sbi->s_mount_opts & ZONEFS_MNTOPT_ERRORS_RO && + data_size > isize) { + /* Do not expose garbage data */ +@@ -295,8 +299,7 @@ static int zonefs_io_error_cb(struct blk_zone *zone, unsigned int idx, + * close of the zone when the inode file is closed. + */ + if ((sbi->s_mount_opts & ZONEFS_MNTOPT_EXPLICIT_OPEN) && +- (zone->cond == BLK_ZONE_COND_OFFLINE || +- zone->cond == BLK_ZONE_COND_READONLY)) ++ (zi->i_flags & (ZONEFS_ZONE_READONLY | ZONEFS_ZONE_OFFLINE))) + zi->i_flags &= ~ZONEFS_ZONE_OPEN; + + /* +@@ -378,6 +381,7 @@ static struct inode *zonefs_alloc_inode(struct super_block *sb) + + inode_init_once(&zi->i_vnode); + mutex_init(&zi->i_truncate_mutex); ++ zi->i_wpoffset = 0; + zi->i_wr_refcnt = 0; + zi->i_flags = 0; + +@@ -594,7 +598,7 @@ static int zonefs_init_file_inode(struct inode *inode, struct blk_zone *zone, + + zi->i_max_size = min_t(loff_t, MAX_LFS_FILESIZE, + zone->capacity << SECTOR_SHIFT); +- zi->i_wpoffset = zonefs_check_zone_condition(inode, zone, true, true); ++ zi->i_wpoffset = zonefs_check_zone_condition(inode, zone); + + inode->i_uid = sbi->s_uid; + inode->i_gid = sbi->s_gid; +@@ -605,6 +609,10 @@ static int zonefs_init_file_inode(struct inode *inode, struct blk_zone *zone, + inode->i_fop = &zonefs_file_operations; + inode->i_mapping->a_ops = &zonefs_file_aops; + ++ /* Update the inode access rights depending on the zone condition */ ++ zi->i_flags |= ZONEFS_ZONE_INIT_MODE; ++ zonefs_inode_update_mode(inode); ++ + sb->s_maxbytes = max(zi->i_max_size, sb->s_maxbytes); + sbi->s_blocks += zi->i_max_size >> sb->s_blocksize_bits; + sbi->s_used_blocks += zi->i_wpoffset >> sb->s_blocksize_bits; +diff --git a/fs/zonefs/zonefs.h b/fs/zonefs/zonefs.h +index 839ebe9a..43909644 100644 +--- a/fs/zonefs/zonefs.h ++++ b/fs/zonefs/zonefs.h +@@ -39,10 +39,11 @@ static inline enum zonefs_ztype zonefs_zone_type(struct blk_zone *zone) + return ZONEFS_ZTYPE_SEQ; + } + +-#define ZONEFS_ZONE_OPEN (1U << 0) +-#define ZONEFS_ZONE_ACTIVE (1U << 1) +-#define ZONEFS_ZONE_OFFLINE (1U << 2) +-#define ZONEFS_ZONE_READONLY (1U << 3) ++#define ZONEFS_ZONE_INIT_MODE (1U << 0) ++#define ZONEFS_ZONE_OPEN (1U << 1) ++#define ZONEFS_ZONE_ACTIVE (1U << 2) ++#define ZONEFS_ZONE_OFFLINE (1U << 3) ++#define ZONEFS_ZONE_READONLY (1U << 4) + + /* + * In-memory inode data. +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-007-zonefs-Reduce-struct-zonefs_inode_info-size.patch b/patches.kernel.org/6.2.10-007-zonefs-Reduce-struct-zonefs_inode_info-size.patch new file mode 100644 index 0000000..8713d58 --- /dev/null +++ b/patches.kernel.org/6.2.10-007-zonefs-Reduce-struct-zonefs_inode_info-size.patch @@ -0,0 +1,284 @@ +From: Damien Le Moal +Date: Thu, 24 Nov 2022 19:43:30 +0900 +Subject: [PATCH] zonefs: Reduce struct zonefs_inode_info size +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 34422914dc00b291d1c47dbdabe93b154c2f2b25 + +[ Upstream commit 34422914dc00b291d1c47dbdabe93b154c2f2b25 ] + +Instead of using the i_ztype field in struct zonefs_inode_info to +indicate the zone type of an inode, introduce the new inode flag +ZONEFS_ZONE_CNV to be set in the i_flags field of struct +zonefs_inode_info to identify conventional zones. If this flag is not +set, the zone of an inode is considered to be a sequential zone. + +The helpers zonefs_zone_is_cnv(), zonefs_zone_is_seq(), +zonefs_inode_is_cnv() and zonefs_inode_is_seq() are introduced to +simplify testing the zone type of a struct zonefs_inode_info and of a +struct inode. + +Signed-off-by: Damien Le Moal +Reviewed-by: Johannes Thumshirn +Stable-dep-of: 88b170088ad2 ("zonefs: Fix error message in zonefs_file_dio_append()") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/zonefs/file.c | 35 ++++++++++++++--------------------- + fs/zonefs/super.c | 12 +++++++----- + fs/zonefs/zonefs.h | 24 +++++++++++++++++++++--- + 3 files changed, 42 insertions(+), 29 deletions(-) + +diff --git a/fs/zonefs/file.c b/fs/zonefs/file.c +index ece0f395..64873d31 100644 +--- a/fs/zonefs/file.c ++++ b/fs/zonefs/file.c +@@ -77,8 +77,7 @@ static int zonefs_write_iomap_begin(struct inode *inode, loff_t offset, + * checked when writes are issued, so warn if we see a page writeback + * operation. + */ +- if (WARN_ON_ONCE(zi->i_ztype == ZONEFS_ZTYPE_SEQ && +- !(flags & IOMAP_DIRECT))) ++ if (WARN_ON_ONCE(zonefs_zone_is_seq(zi) && !(flags & IOMAP_DIRECT))) + return -EIO; + + /* +@@ -128,7 +127,7 @@ static int zonefs_write_map_blocks(struct iomap_writepage_ctx *wpc, + { + struct zonefs_inode_info *zi = ZONEFS_I(inode); + +- if (WARN_ON_ONCE(zi->i_ztype != ZONEFS_ZTYPE_CNV)) ++ if (WARN_ON_ONCE(zonefs_zone_is_seq(zi))) + return -EIO; + if (WARN_ON_ONCE(offset >= i_size_read(inode))) + return -EIO; +@@ -158,9 +157,8 @@ static int zonefs_swap_activate(struct swap_info_struct *sis, + struct file *swap_file, sector_t *span) + { + struct inode *inode = file_inode(swap_file); +- struct zonefs_inode_info *zi = ZONEFS_I(inode); + +- if (zi->i_ztype != ZONEFS_ZTYPE_CNV) { ++ if (zonefs_inode_is_seq(inode)) { + zonefs_err(inode->i_sb, + "swap file: not a conventional zone file\n"); + return -EINVAL; +@@ -196,7 +194,7 @@ int zonefs_file_truncate(struct inode *inode, loff_t isize) + * only down to a 0 size, which is equivalent to a zone reset, and to + * the maximum file size, which is equivalent to a zone finish. + */ +- if (zi->i_ztype != ZONEFS_ZTYPE_SEQ) ++ if (!zonefs_zone_is_seq(zi)) + return -EPERM; + + if (!isize) +@@ -266,7 +264,7 @@ static int zonefs_file_fsync(struct file *file, loff_t start, loff_t end, + * Since only direct writes are allowed in sequential files, page cache + * flush is needed only for conventional zone files. + */ +- if (ZONEFS_I(inode)->i_ztype == ZONEFS_ZTYPE_CNV) ++ if (zonefs_inode_is_cnv(inode)) + ret = file_write_and_wait_range(file, start, end); + if (!ret) + ret = blkdev_issue_flush(inode->i_sb->s_bdev); +@@ -280,7 +278,6 @@ static int zonefs_file_fsync(struct file *file, loff_t start, loff_t end, + static vm_fault_t zonefs_filemap_page_mkwrite(struct vm_fault *vmf) + { + struct inode *inode = file_inode(vmf->vma->vm_file); +- struct zonefs_inode_info *zi = ZONEFS_I(inode); + vm_fault_t ret; + + if (unlikely(IS_IMMUTABLE(inode))) +@@ -290,7 +287,7 @@ static vm_fault_t zonefs_filemap_page_mkwrite(struct vm_fault *vmf) + * Sanity check: only conventional zone files can have shared + * writeable mappings. + */ +- if (WARN_ON_ONCE(zi->i_ztype != ZONEFS_ZTYPE_CNV)) ++ if (zonefs_inode_is_seq(inode)) + return VM_FAULT_NOPAGE; + + sb_start_pagefault(inode->i_sb); +@@ -319,7 +316,7 @@ static int zonefs_file_mmap(struct file *file, struct vm_area_struct *vma) + * mappings are possible since there are no guarantees for write + * ordering between msync() and page cache writeback. + */ +- if (ZONEFS_I(file_inode(file))->i_ztype == ZONEFS_ZTYPE_SEQ && ++ if (zonefs_inode_is_seq(file_inode(file)) && + (vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_MAYWRITE)) + return -EINVAL; + +@@ -352,7 +349,7 @@ static int zonefs_file_write_dio_end_io(struct kiocb *iocb, ssize_t size, + return error; + } + +- if (size && zi->i_ztype != ZONEFS_ZTYPE_CNV) { ++ if (size && zonefs_zone_is_seq(zi)) { + /* + * Note that we may be seeing completions out of order, + * but that is not a problem since a write completed +@@ -491,7 +488,7 @@ static ssize_t zonefs_write_checks(struct kiocb *iocb, struct iov_iter *from) + return -EINVAL; + + if (iocb->ki_flags & IOCB_APPEND) { +- if (zi->i_ztype != ZONEFS_ZTYPE_SEQ) ++ if (zonefs_zone_is_cnv(zi)) + return -EINVAL; + mutex_lock(&zi->i_truncate_mutex); + iocb->ki_pos = zi->i_wpoffset; +@@ -531,8 +528,7 @@ static ssize_t zonefs_file_dio_write(struct kiocb *iocb, struct iov_iter *from) + * as this can cause write reordering (e.g. the first aio gets EAGAIN + * on the inode lock but the second goes through but is now unaligned). + */ +- if (zi->i_ztype == ZONEFS_ZTYPE_SEQ && !sync && +- (iocb->ki_flags & IOCB_NOWAIT)) ++ if (zonefs_zone_is_seq(zi) && !sync && (iocb->ki_flags & IOCB_NOWAIT)) + return -EOPNOTSUPP; + + if (iocb->ki_flags & IOCB_NOWAIT) { +@@ -554,7 +550,7 @@ static ssize_t zonefs_file_dio_write(struct kiocb *iocb, struct iov_iter *from) + } + + /* Enforce sequential writes (append only) in sequential zones */ +- if (zi->i_ztype == ZONEFS_ZTYPE_SEQ) { ++ if (zonefs_zone_is_seq(zi)) { + mutex_lock(&zi->i_truncate_mutex); + if (iocb->ki_pos != zi->i_wpoffset) { + mutex_unlock(&zi->i_truncate_mutex); +@@ -570,7 +566,7 @@ static ssize_t zonefs_file_dio_write(struct kiocb *iocb, struct iov_iter *from) + else + ret = iomap_dio_rw(iocb, from, &zonefs_write_iomap_ops, + &zonefs_write_dio_ops, 0, NULL, 0); +- if (zi->i_ztype == ZONEFS_ZTYPE_SEQ && ++ if (zonefs_zone_is_seq(zi) && + (ret > 0 || ret == -EIOCBQUEUED)) { + if (ret > 0) + count = ret; +@@ -596,14 +592,13 @@ static ssize_t zonefs_file_buffered_write(struct kiocb *iocb, + struct iov_iter *from) + { + struct inode *inode = file_inode(iocb->ki_filp); +- struct zonefs_inode_info *zi = ZONEFS_I(inode); + ssize_t ret; + + /* + * Direct IO writes are mandatory for sequential zone files so that the + * write IO issuing order is preserved. + */ +- if (zi->i_ztype != ZONEFS_ZTYPE_CNV) ++ if (zonefs_inode_is_seq(inode)) + return -EIO; + + if (iocb->ki_flags & IOCB_NOWAIT) { +@@ -731,9 +726,7 @@ static ssize_t zonefs_file_read_iter(struct kiocb *iocb, struct iov_iter *to) + static inline bool zonefs_seq_file_need_wro(struct inode *inode, + struct file *file) + { +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- +- if (zi->i_ztype != ZONEFS_ZTYPE_SEQ) ++ if (zonefs_inode_is_cnv(inode)) + return false; + + if (!(file->f_mode & FMODE_WRITE)) +diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c +index 6307cc95..a4af29dc 100644 +--- a/fs/zonefs/super.c ++++ b/fs/zonefs/super.c +@@ -37,7 +37,7 @@ void zonefs_account_active(struct inode *inode) + + lockdep_assert_held(&zi->i_truncate_mutex); + +- if (zi->i_ztype != ZONEFS_ZTYPE_SEQ) ++ if (zonefs_zone_is_cnv(zi)) + return; + + /* +@@ -177,14 +177,14 @@ static loff_t zonefs_check_zone_condition(struct inode *inode, + zonefs_warn(inode->i_sb, "inode %lu: read-only zone\n", + inode->i_ino); + zi->i_flags |= ZONEFS_ZONE_READONLY; +- if (zi->i_ztype == ZONEFS_ZTYPE_CNV) ++ if (zonefs_zone_is_cnv(zi)) + return zi->i_max_size; + return zi->i_wpoffset; + case BLK_ZONE_COND_FULL: + /* The write pointer of full zones is invalid. */ + return zi->i_max_size; + default: +- if (zi->i_ztype == ZONEFS_ZTYPE_CNV) ++ if (zonefs_zone_is_cnv(zi)) + return zi->i_max_size; + return (zone->wp - zone->start) << SECTOR_SHIFT; + } +@@ -260,7 +260,7 @@ static int zonefs_io_error_cb(struct blk_zone *zone, unsigned int idx, + * In all cases, warn about inode size inconsistency and handle the + * IO error according to the zone condition and to the mount options. + */ +- if (zi->i_ztype == ZONEFS_ZTYPE_SEQ && isize != data_size) ++ if (zonefs_zone_is_seq(zi) && isize != data_size) + zonefs_warn(sb, "inode %lu: invalid size %lld (should be %lld)\n", + inode->i_ino, isize, data_size); + +@@ -584,7 +584,9 @@ static int zonefs_init_file_inode(struct inode *inode, struct blk_zone *zone, + inode->i_ino = zone->start >> sbi->s_zone_sectors_shift; + inode->i_mode = S_IFREG | sbi->s_perm; + +- zi->i_ztype = type; ++ if (type == ZONEFS_ZTYPE_CNV) ++ zi->i_flags |= ZONEFS_ZONE_CNV; ++ + zi->i_zsector = zone->start; + zi->i_zone_size = zone->len << SECTOR_SHIFT; + if (zi->i_zone_size > bdev_zone_sectors(sb->s_bdev) << SECTOR_SHIFT && +diff --git a/fs/zonefs/zonefs.h b/fs/zonefs/zonefs.h +index 43909644..1a225f74 100644 +--- a/fs/zonefs/zonefs.h ++++ b/fs/zonefs/zonefs.h +@@ -44,6 +44,7 @@ static inline enum zonefs_ztype zonefs_zone_type(struct blk_zone *zone) + #define ZONEFS_ZONE_ACTIVE (1U << 2) + #define ZONEFS_ZONE_OFFLINE (1U << 3) + #define ZONEFS_ZONE_READONLY (1U << 4) ++#define ZONEFS_ZONE_CNV (1U << 31) + + /* + * In-memory inode data. +@@ -51,9 +52,6 @@ static inline enum zonefs_ztype zonefs_zone_type(struct blk_zone *zone) + struct zonefs_inode_info { + struct inode i_vnode; + +- /* File zone type */ +- enum zonefs_ztype i_ztype; +- + /* File zone start sector (512B unit) */ + sector_t i_zsector; + +@@ -91,6 +89,26 @@ static inline struct zonefs_inode_info *ZONEFS_I(struct inode *inode) + return container_of(inode, struct zonefs_inode_info, i_vnode); + } + ++static inline bool zonefs_zone_is_cnv(struct zonefs_inode_info *zi) ++{ ++ return zi->i_flags & ZONEFS_ZONE_CNV; ++} ++ ++static inline bool zonefs_zone_is_seq(struct zonefs_inode_info *zi) ++{ ++ return !zonefs_zone_is_cnv(zi); ++} ++ ++static inline bool zonefs_inode_is_cnv(struct inode *inode) ++{ ++ return zonefs_zone_is_cnv(ZONEFS_I(inode)); ++} ++ ++static inline bool zonefs_inode_is_seq(struct inode *inode) ++{ ++ return zonefs_zone_is_seq(ZONEFS_I(inode)); ++} ++ + /* + * On-disk super block (block 0). + */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-008-zonefs-Separate-zone-information-from-inode-in.patch b/patches.kernel.org/6.2.10-008-zonefs-Separate-zone-information-from-inode-in.patch new file mode 100644 index 0000000..7f545f5 --- /dev/null +++ b/patches.kernel.org/6.2.10-008-zonefs-Separate-zone-information-from-inode-in.patch @@ -0,0 +1,1486 @@ +From: Damien Le Moal +Date: Wed, 16 Nov 2022 18:15:40 +0900 +Subject: [PATCH] zonefs: Separate zone information from inode information +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: aa7f243f32e1d18036ee00d71d3ccfad70ae2121 + +[ Upstream commit aa7f243f32e1d18036ee00d71d3ccfad70ae2121 ] + +In preparation for adding dynamic inode allocation, separate an inode +zone information from the zonefs inode structure. The new data structure +zonefs_zone is introduced to store in memory information about a zone +that must be kept throughout the lifetime of the device mount. + +Linking between a zone file inode and its zone information is done by +setting the inode i_private field to point to a struct zonefs_zone. +Using the i_private pointer avoids the need for adding a pointer in +struct zonefs_inode_info. Beside the vfs inode, this structure is +reduced to a mutex and a write open counter. + +One struct zonefs_zone is created per file inode on mount. These +structures are organized in an array using the new struct +zonefs_zone_group data structure to represent zone groups. The +zonefs_zone arrays are indexed per file number (the index of a struct +zonefs_zone in its array directly gives the file number/name for that +zone file inode). + +Signed-off-by: Damien Le Moal +Reviewed-by: Johannes Thumshirn +Stable-dep-of: 88b170088ad2 ("zonefs: Fix error message in zonefs_file_dio_append()") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/zonefs/file.c | 99 ++++---- + fs/zonefs/super.c | 571 +++++++++++++++++++++++++++------------------ + fs/zonefs/trace.h | 20 +- + fs/zonefs/zonefs.h | 63 +++-- + 4 files changed, 449 insertions(+), 304 deletions(-) + +diff --git a/fs/zonefs/file.c b/fs/zonefs/file.c +index 64873d31..738b0e28 100644 +--- a/fs/zonefs/file.c ++++ b/fs/zonefs/file.c +@@ -29,6 +29,7 @@ static int zonefs_read_iomap_begin(struct inode *inode, loff_t offset, + struct iomap *iomap, struct iomap *srcmap) + { + struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct zonefs_zone *z = zonefs_inode_zone(inode); + struct super_block *sb = inode->i_sb; + loff_t isize; + +@@ -46,7 +47,7 @@ static int zonefs_read_iomap_begin(struct inode *inode, loff_t offset, + iomap->length = length; + } else { + iomap->type = IOMAP_MAPPED; +- iomap->addr = (zi->i_zsector << SECTOR_SHIFT) + iomap->offset; ++ iomap->addr = (z->z_sector << SECTOR_SHIFT) + iomap->offset; + iomap->length = isize - iomap->offset; + } + mutex_unlock(&zi->i_truncate_mutex); +@@ -65,11 +66,12 @@ static int zonefs_write_iomap_begin(struct inode *inode, loff_t offset, + struct iomap *iomap, struct iomap *srcmap) + { + struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct zonefs_zone *z = zonefs_inode_zone(inode); + struct super_block *sb = inode->i_sb; + loff_t isize; + + /* All write I/Os should always be within the file maximum size */ +- if (WARN_ON_ONCE(offset + length > zi->i_max_size)) ++ if (WARN_ON_ONCE(offset + length > z->z_capacity)) + return -EIO; + + /* +@@ -77,7 +79,7 @@ static int zonefs_write_iomap_begin(struct inode *inode, loff_t offset, + * checked when writes are issued, so warn if we see a page writeback + * operation. + */ +- if (WARN_ON_ONCE(zonefs_zone_is_seq(zi) && !(flags & IOMAP_DIRECT))) ++ if (WARN_ON_ONCE(zonefs_zone_is_seq(z) && !(flags & IOMAP_DIRECT))) + return -EIO; + + /* +@@ -88,11 +90,11 @@ static int zonefs_write_iomap_begin(struct inode *inode, loff_t offset, + mutex_lock(&zi->i_truncate_mutex); + iomap->bdev = inode->i_sb->s_bdev; + iomap->offset = ALIGN_DOWN(offset, sb->s_blocksize); +- iomap->addr = (zi->i_zsector << SECTOR_SHIFT) + iomap->offset; ++ iomap->addr = (z->z_sector << SECTOR_SHIFT) + iomap->offset; + isize = i_size_read(inode); + if (iomap->offset >= isize) { + iomap->type = IOMAP_UNWRITTEN; +- iomap->length = zi->i_max_size - iomap->offset; ++ iomap->length = z->z_capacity - iomap->offset; + } else { + iomap->type = IOMAP_MAPPED; + iomap->length = isize - iomap->offset; +@@ -125,9 +127,9 @@ static void zonefs_readahead(struct readahead_control *rac) + static int zonefs_write_map_blocks(struct iomap_writepage_ctx *wpc, + struct inode *inode, loff_t offset) + { +- struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct zonefs_zone *z = zonefs_inode_zone(inode); + +- if (WARN_ON_ONCE(zonefs_zone_is_seq(zi))) ++ if (WARN_ON_ONCE(zonefs_zone_is_seq(z))) + return -EIO; + if (WARN_ON_ONCE(offset >= i_size_read(inode))) + return -EIO; +@@ -137,7 +139,8 @@ static int zonefs_write_map_blocks(struct iomap_writepage_ctx *wpc, + offset < wpc->iomap.offset + wpc->iomap.length) + return 0; + +- return zonefs_write_iomap_begin(inode, offset, zi->i_max_size - offset, ++ return zonefs_write_iomap_begin(inode, offset, ++ z->z_capacity - offset, + IOMAP_WRITE, &wpc->iomap, NULL); + } + +@@ -185,6 +188,7 @@ const struct address_space_operations zonefs_file_aops = { + int zonefs_file_truncate(struct inode *inode, loff_t isize) + { + struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct zonefs_zone *z = zonefs_inode_zone(inode); + loff_t old_isize; + enum req_op op; + int ret = 0; +@@ -194,12 +198,12 @@ int zonefs_file_truncate(struct inode *inode, loff_t isize) + * only down to a 0 size, which is equivalent to a zone reset, and to + * the maximum file size, which is equivalent to a zone finish. + */ +- if (!zonefs_zone_is_seq(zi)) ++ if (!zonefs_zone_is_seq(z)) + return -EPERM; + + if (!isize) + op = REQ_OP_ZONE_RESET; +- else if (isize == zi->i_max_size) ++ else if (isize == z->z_capacity) + op = REQ_OP_ZONE_FINISH; + else + return -EPERM; +@@ -216,7 +220,7 @@ int zonefs_file_truncate(struct inode *inode, loff_t isize) + if (isize == old_isize) + goto unlock; + +- ret = zonefs_zone_mgmt(inode, op); ++ ret = zonefs_inode_zone_mgmt(inode, op); + if (ret) + goto unlock; + +@@ -224,7 +228,7 @@ int zonefs_file_truncate(struct inode *inode, loff_t isize) + * If the mount option ZONEFS_MNTOPT_EXPLICIT_OPEN is set, + * take care of open zones. + */ +- if (zi->i_flags & ZONEFS_ZONE_OPEN) { ++ if (z->z_flags & ZONEFS_ZONE_OPEN) { + /* + * Truncating a zone to EMPTY or FULL is the equivalent of + * closing the zone. For a truncation to 0, we need to +@@ -234,15 +238,15 @@ int zonefs_file_truncate(struct inode *inode, loff_t isize) + * the open flag. + */ + if (!isize) +- ret = zonefs_zone_mgmt(inode, REQ_OP_ZONE_OPEN); ++ ret = zonefs_inode_zone_mgmt(inode, REQ_OP_ZONE_OPEN); + else +- zi->i_flags &= ~ZONEFS_ZONE_OPEN; ++ z->z_flags &= ~ZONEFS_ZONE_OPEN; + } + + zonefs_update_stats(inode, isize); + truncate_setsize(inode, isize); +- zi->i_wpoffset = isize; +- zonefs_account_active(inode); ++ z->z_wpoffset = isize; ++ zonefs_inode_account_active(inode); + + unlock: + mutex_unlock(&zi->i_truncate_mutex); +@@ -349,7 +353,7 @@ static int zonefs_file_write_dio_end_io(struct kiocb *iocb, ssize_t size, + return error; + } + +- if (size && zonefs_zone_is_seq(zi)) { ++ if (size && zonefs_inode_is_seq(inode)) { + /* + * Note that we may be seeing completions out of order, + * but that is not a problem since a write completed +@@ -375,7 +379,7 @@ static const struct iomap_dio_ops zonefs_write_dio_ops = { + static ssize_t zonefs_file_dio_append(struct kiocb *iocb, struct iov_iter *from) + { + struct inode *inode = file_inode(iocb->ki_filp); +- struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct zonefs_zone *z = zonefs_inode_zone(inode); + struct block_device *bdev = inode->i_sb->s_bdev; + unsigned int max = bdev_max_zone_append_sectors(bdev); + struct bio *bio; +@@ -392,7 +396,7 @@ static ssize_t zonefs_file_dio_append(struct kiocb *iocb, struct iov_iter *from) + + bio = bio_alloc(bdev, nr_pages, + REQ_OP_ZONE_APPEND | REQ_SYNC | REQ_IDLE, GFP_NOFS); +- bio->bi_iter.bi_sector = zi->i_zsector; ++ bio->bi_iter.bi_sector = z->z_sector; + bio->bi_ioprio = iocb->ki_ioprio; + if (iocb_is_dsync(iocb)) + bio->bi_opf |= REQ_FUA; +@@ -417,12 +421,12 @@ static ssize_t zonefs_file_dio_append(struct kiocb *iocb, struct iov_iter *from) + */ + if (!ret) { + sector_t wpsector = +- zi->i_zsector + (zi->i_wpoffset >> SECTOR_SHIFT); ++ z->z_sector + (z->z_wpoffset >> SECTOR_SHIFT); + + if (bio->bi_iter.bi_sector != wpsector) { + zonefs_warn(inode->i_sb, + "Corrupted write pointer %llu for zone at %llu\n", +- wpsector, zi->i_zsector); ++ wpsector, z->z_sector); + ret = -EIO; + } + } +@@ -450,9 +454,9 @@ static loff_t zonefs_write_check_limits(struct file *file, loff_t pos, + loff_t count) + { + struct inode *inode = file_inode(file); +- struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct zonefs_zone *z = zonefs_inode_zone(inode); + loff_t limit = rlimit(RLIMIT_FSIZE); +- loff_t max_size = zi->i_max_size; ++ loff_t max_size = z->z_capacity; + + if (limit != RLIM_INFINITY) { + if (pos >= limit) { +@@ -476,6 +480,7 @@ static ssize_t zonefs_write_checks(struct kiocb *iocb, struct iov_iter *from) + struct file *file = iocb->ki_filp; + struct inode *inode = file_inode(file); + struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct zonefs_zone *z = zonefs_inode_zone(inode); + loff_t count; + + if (IS_SWAPFILE(inode)) +@@ -488,10 +493,10 @@ static ssize_t zonefs_write_checks(struct kiocb *iocb, struct iov_iter *from) + return -EINVAL; + + if (iocb->ki_flags & IOCB_APPEND) { +- if (zonefs_zone_is_cnv(zi)) ++ if (zonefs_zone_is_cnv(z)) + return -EINVAL; + mutex_lock(&zi->i_truncate_mutex); +- iocb->ki_pos = zi->i_wpoffset; ++ iocb->ki_pos = z->z_wpoffset; + mutex_unlock(&zi->i_truncate_mutex); + } + +@@ -518,6 +523,7 @@ static ssize_t zonefs_file_dio_write(struct kiocb *iocb, struct iov_iter *from) + { + struct inode *inode = file_inode(iocb->ki_filp); + struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct zonefs_zone *z = zonefs_inode_zone(inode); + struct super_block *sb = inode->i_sb; + bool sync = is_sync_kiocb(iocb); + bool append = false; +@@ -528,7 +534,7 @@ static ssize_t zonefs_file_dio_write(struct kiocb *iocb, struct iov_iter *from) + * as this can cause write reordering (e.g. the first aio gets EAGAIN + * on the inode lock but the second goes through but is now unaligned). + */ +- if (zonefs_zone_is_seq(zi) && !sync && (iocb->ki_flags & IOCB_NOWAIT)) ++ if (zonefs_zone_is_seq(z) && !sync && (iocb->ki_flags & IOCB_NOWAIT)) + return -EOPNOTSUPP; + + if (iocb->ki_flags & IOCB_NOWAIT) { +@@ -550,9 +556,9 @@ static ssize_t zonefs_file_dio_write(struct kiocb *iocb, struct iov_iter *from) + } + + /* Enforce sequential writes (append only) in sequential zones */ +- if (zonefs_zone_is_seq(zi)) { ++ if (zonefs_zone_is_seq(z)) { + mutex_lock(&zi->i_truncate_mutex); +- if (iocb->ki_pos != zi->i_wpoffset) { ++ if (iocb->ki_pos != z->z_wpoffset) { + mutex_unlock(&zi->i_truncate_mutex); + ret = -EINVAL; + goto inode_unlock; +@@ -566,7 +572,7 @@ static ssize_t zonefs_file_dio_write(struct kiocb *iocb, struct iov_iter *from) + else + ret = iomap_dio_rw(iocb, from, &zonefs_write_iomap_ops, + &zonefs_write_dio_ops, 0, NULL, 0); +- if (zonefs_zone_is_seq(zi) && ++ if (zonefs_zone_is_seq(z) && + (ret > 0 || ret == -EIOCBQUEUED)) { + if (ret > 0) + count = ret; +@@ -577,8 +583,8 @@ static ssize_t zonefs_file_dio_write(struct kiocb *iocb, struct iov_iter *from) + * will correct it. Also do active seq file accounting. + */ + mutex_lock(&zi->i_truncate_mutex); +- zi->i_wpoffset += count; +- zonefs_account_active(inode); ++ z->z_wpoffset += count; ++ zonefs_inode_account_active(inode); + mutex_unlock(&zi->i_truncate_mutex); + } + +@@ -629,6 +635,7 @@ static ssize_t zonefs_file_buffered_write(struct kiocb *iocb, + static ssize_t zonefs_file_write_iter(struct kiocb *iocb, struct iov_iter *from) + { + struct inode *inode = file_inode(iocb->ki_filp); ++ struct zonefs_zone *z = zonefs_inode_zone(inode); + + if (unlikely(IS_IMMUTABLE(inode))) + return -EPERM; +@@ -636,8 +643,8 @@ static ssize_t zonefs_file_write_iter(struct kiocb *iocb, struct iov_iter *from) + if (sb_rdonly(inode->i_sb)) + return -EROFS; + +- /* Write operations beyond the zone size are not allowed */ +- if (iocb->ki_pos >= ZONEFS_I(inode)->i_max_size) ++ /* Write operations beyond the zone capacity are not allowed */ ++ if (iocb->ki_pos >= z->z_capacity) + return -EFBIG; + + if (iocb->ki_flags & IOCB_DIRECT) { +@@ -669,6 +676,7 @@ static ssize_t zonefs_file_read_iter(struct kiocb *iocb, struct iov_iter *to) + { + struct inode *inode = file_inode(iocb->ki_filp); + struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct zonefs_zone *z = zonefs_inode_zone(inode); + struct super_block *sb = inode->i_sb; + loff_t isize; + ssize_t ret; +@@ -677,7 +685,7 @@ static ssize_t zonefs_file_read_iter(struct kiocb *iocb, struct iov_iter *to) + if (unlikely(IS_IMMUTABLE(inode) && !(inode->i_mode & 0777))) + return -EPERM; + +- if (iocb->ki_pos >= zi->i_max_size) ++ if (iocb->ki_pos >= z->z_capacity) + return 0; + + if (iocb->ki_flags & IOCB_NOWAIT) { +@@ -738,6 +746,7 @@ static inline bool zonefs_seq_file_need_wro(struct inode *inode, + static int zonefs_seq_file_write_open(struct inode *inode) + { + struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct zonefs_zone *z = zonefs_inode_zone(inode); + int ret = 0; + + mutex_lock(&zi->i_truncate_mutex); +@@ -755,14 +764,15 @@ static int zonefs_seq_file_write_open(struct inode *inode) + goto unlock; + } + +- if (i_size_read(inode) < zi->i_max_size) { +- ret = zonefs_zone_mgmt(inode, REQ_OP_ZONE_OPEN); ++ if (i_size_read(inode) < z->z_capacity) { ++ ret = zonefs_inode_zone_mgmt(inode, ++ REQ_OP_ZONE_OPEN); + if (ret) { + atomic_dec(&sbi->s_wro_seq_files); + goto unlock; + } +- zi->i_flags |= ZONEFS_ZONE_OPEN; +- zonefs_account_active(inode); ++ z->z_flags |= ZONEFS_ZONE_OPEN; ++ zonefs_inode_account_active(inode); + } + } + } +@@ -792,6 +802,7 @@ static int zonefs_file_open(struct inode *inode, struct file *file) + static void zonefs_seq_file_write_close(struct inode *inode) + { + struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct zonefs_zone *z = zonefs_inode_zone(inode); + struct super_block *sb = inode->i_sb; + struct zonefs_sb_info *sbi = ZONEFS_SB(sb); + int ret = 0; +@@ -807,8 +818,8 @@ static void zonefs_seq_file_write_close(struct inode *inode) + * its maximum size or it was fully written). For this case, we only + * need to decrement the write open count. + */ +- if (zi->i_flags & ZONEFS_ZONE_OPEN) { +- ret = zonefs_zone_mgmt(inode, REQ_OP_ZONE_CLOSE); ++ if (z->z_flags & ZONEFS_ZONE_OPEN) { ++ ret = zonefs_inode_zone_mgmt(inode, REQ_OP_ZONE_CLOSE); + if (ret) { + __zonefs_io_error(inode, false); + /* +@@ -817,11 +828,11 @@ static void zonefs_seq_file_write_close(struct inode *inode) + * exhausted). So take preventive action by remounting + * read-only. + */ +- if (zi->i_flags & ZONEFS_ZONE_OPEN && ++ if (z->z_flags & ZONEFS_ZONE_OPEN && + !(sb->s_flags & SB_RDONLY)) { + zonefs_warn(sb, + "closing zone at %llu failed %d\n", +- zi->i_zsector, ret); ++ z->z_sector, ret); + zonefs_warn(sb, + "remounting filesystem read-only\n"); + sb->s_flags |= SB_RDONLY; +@@ -829,8 +840,8 @@ static void zonefs_seq_file_write_close(struct inode *inode) + goto unlock; + } + +- zi->i_flags &= ~ZONEFS_ZONE_OPEN; +- zonefs_account_active(inode); ++ z->z_flags &= ~ZONEFS_ZONE_OPEN; ++ zonefs_inode_account_active(inode); + } + + atomic_dec(&sbi->s_wro_seq_files); +diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c +index a4af29dc..270ded20 100644 +--- a/fs/zonefs/super.c ++++ b/fs/zonefs/super.c +@@ -28,33 +28,47 @@ + #include "trace.h" + + /* +- * Manage the active zone count. Called with zi->i_truncate_mutex held. ++ * Get the name of a zone group directory. + */ +-void zonefs_account_active(struct inode *inode) ++static const char *zonefs_zgroup_name(enum zonefs_ztype ztype) + { +- struct zonefs_sb_info *sbi = ZONEFS_SB(inode->i_sb); +- struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ switch (ztype) { ++ case ZONEFS_ZTYPE_CNV: ++ return "cnv"; ++ case ZONEFS_ZTYPE_SEQ: ++ return "seq"; ++ default: ++ WARN_ON_ONCE(1); ++ return "???"; ++ } ++} + +- lockdep_assert_held(&zi->i_truncate_mutex); ++/* ++ * Manage the active zone count. ++ */ ++static void zonefs_account_active(struct super_block *sb, ++ struct zonefs_zone *z) ++{ ++ struct zonefs_sb_info *sbi = ZONEFS_SB(sb); + +- if (zonefs_zone_is_cnv(zi)) ++ if (zonefs_zone_is_cnv(z)) + return; + + /* + * For zones that transitioned to the offline or readonly condition, + * we only need to clear the active state. + */ +- if (zi->i_flags & (ZONEFS_ZONE_OFFLINE | ZONEFS_ZONE_READONLY)) ++ if (z->z_flags & (ZONEFS_ZONE_OFFLINE | ZONEFS_ZONE_READONLY)) + goto out; + + /* + * If the zone is active, that is, if it is explicitly open or + * partially written, check if it was already accounted as active. + */ +- if ((zi->i_flags & ZONEFS_ZONE_OPEN) || +- (zi->i_wpoffset > 0 && zi->i_wpoffset < zi->i_max_size)) { +- if (!(zi->i_flags & ZONEFS_ZONE_ACTIVE)) { +- zi->i_flags |= ZONEFS_ZONE_ACTIVE; ++ if ((z->z_flags & ZONEFS_ZONE_OPEN) || ++ (z->z_wpoffset > 0 && z->z_wpoffset < z->z_capacity)) { ++ if (!(z->z_flags & ZONEFS_ZONE_ACTIVE)) { ++ z->z_flags |= ZONEFS_ZONE_ACTIVE; + atomic_inc(&sbi->s_active_seq_files); + } + return; +@@ -62,18 +76,29 @@ void zonefs_account_active(struct inode *inode) + + out: + /* The zone is not active. If it was, update the active count */ +- if (zi->i_flags & ZONEFS_ZONE_ACTIVE) { +- zi->i_flags &= ~ZONEFS_ZONE_ACTIVE; ++ if (z->z_flags & ZONEFS_ZONE_ACTIVE) { ++ z->z_flags &= ~ZONEFS_ZONE_ACTIVE; + atomic_dec(&sbi->s_active_seq_files); + } + } + +-int zonefs_zone_mgmt(struct inode *inode, enum req_op op) ++/* ++ * Manage the active zone count. Called with zi->i_truncate_mutex held. ++ */ ++void zonefs_inode_account_active(struct inode *inode) + { +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- int ret; ++ lockdep_assert_held(&ZONEFS_I(inode)->i_truncate_mutex); + +- lockdep_assert_held(&zi->i_truncate_mutex); ++ return zonefs_account_active(inode->i_sb, zonefs_inode_zone(inode)); ++} ++ ++/* ++ * Execute a zone management operation. ++ */ ++static int zonefs_zone_mgmt(struct super_block *sb, ++ struct zonefs_zone *z, enum req_op op) ++{ ++ int ret; + + /* + * With ZNS drives, closing an explicitly open zone that has not been +@@ -83,37 +108,45 @@ int zonefs_zone_mgmt(struct inode *inode, enum req_op op) + * are exceeded, make sure that the zone does not remain active by + * resetting it. + */ +- if (op == REQ_OP_ZONE_CLOSE && !zi->i_wpoffset) ++ if (op == REQ_OP_ZONE_CLOSE && !z->z_wpoffset) + op = REQ_OP_ZONE_RESET; + +- trace_zonefs_zone_mgmt(inode, op); +- ret = blkdev_zone_mgmt(inode->i_sb->s_bdev, op, zi->i_zsector, +- zi->i_zone_size >> SECTOR_SHIFT, GFP_NOFS); ++ trace_zonefs_zone_mgmt(sb, z, op); ++ ret = blkdev_zone_mgmt(sb->s_bdev, op, z->z_sector, ++ z->z_size >> SECTOR_SHIFT, GFP_NOFS); + if (ret) { +- zonefs_err(inode->i_sb, ++ zonefs_err(sb, + "Zone management operation %s at %llu failed %d\n", +- blk_op_str(op), zi->i_zsector, ret); ++ blk_op_str(op), z->z_sector, ret); + return ret; + } + + return 0; + } + ++int zonefs_inode_zone_mgmt(struct inode *inode, enum req_op op) ++{ ++ lockdep_assert_held(&ZONEFS_I(inode)->i_truncate_mutex); ++ ++ return zonefs_zone_mgmt(inode->i_sb, zonefs_inode_zone(inode), op); ++} ++ + void zonefs_i_size_write(struct inode *inode, loff_t isize) + { +- struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct zonefs_zone *z = zonefs_inode_zone(inode); + + i_size_write(inode, isize); ++ + /* + * A full zone is no longer open/active and does not need + * explicit closing. + */ +- if (isize >= zi->i_max_size) { ++ if (isize >= z->z_capacity) { + struct zonefs_sb_info *sbi = ZONEFS_SB(inode->i_sb); + +- if (zi->i_flags & ZONEFS_ZONE_ACTIVE) ++ if (z->z_flags & ZONEFS_ZONE_ACTIVE) + atomic_dec(&sbi->s_active_seq_files); +- zi->i_flags &= ~(ZONEFS_ZONE_OPEN | ZONEFS_ZONE_ACTIVE); ++ z->z_flags &= ~(ZONEFS_ZONE_OPEN | ZONEFS_ZONE_ACTIVE); + } + } + +@@ -150,20 +183,18 @@ void zonefs_update_stats(struct inode *inode, loff_t new_isize) + } + + /* +- * Check a zone condition and adjust its file inode access permissions for +- * offline and readonly zones. Return the inode size corresponding to the +- * amount of readable data in the zone. ++ * Check a zone condition. Return the amount of written (and still readable) ++ * data in the zone. + */ +-static loff_t zonefs_check_zone_condition(struct inode *inode, ++static loff_t zonefs_check_zone_condition(struct super_block *sb, ++ struct zonefs_zone *z, + struct blk_zone *zone) + { +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- + switch (zone->cond) { + case BLK_ZONE_COND_OFFLINE: +- zonefs_warn(inode->i_sb, "inode %lu: offline zone\n", +- inode->i_ino); +- zi->i_flags |= ZONEFS_ZONE_OFFLINE; ++ zonefs_warn(sb, "Zone %llu: offline zone\n", ++ z->z_sector); ++ z->z_flags |= ZONEFS_ZONE_OFFLINE; + return 0; + case BLK_ZONE_COND_READONLY: + /* +@@ -174,18 +205,18 @@ static loff_t zonefs_check_zone_condition(struct inode *inode, + * the inode size as it was when last updated so that the user + * can recover data. + */ +- zonefs_warn(inode->i_sb, "inode %lu: read-only zone\n", +- inode->i_ino); +- zi->i_flags |= ZONEFS_ZONE_READONLY; +- if (zonefs_zone_is_cnv(zi)) +- return zi->i_max_size; +- return zi->i_wpoffset; ++ zonefs_warn(sb, "Zone %llu: read-only zone\n", ++ z->z_sector); ++ z->z_flags |= ZONEFS_ZONE_READONLY; ++ if (zonefs_zone_is_cnv(z)) ++ return z->z_capacity; ++ return z->z_wpoffset; + case BLK_ZONE_COND_FULL: + /* The write pointer of full zones is invalid. */ +- return zi->i_max_size; ++ return z->z_capacity; + default: +- if (zonefs_zone_is_cnv(zi)) +- return zi->i_max_size; ++ if (zonefs_zone_is_cnv(z)) ++ return z->z_capacity; + return (zone->wp - zone->start) << SECTOR_SHIFT; + } + } +@@ -196,22 +227,22 @@ static loff_t zonefs_check_zone_condition(struct inode *inode, + */ + static void zonefs_inode_update_mode(struct inode *inode) + { +- struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct zonefs_zone *z = zonefs_inode_zone(inode); + +- if (zi->i_flags & ZONEFS_ZONE_OFFLINE) { ++ if (z->z_flags & ZONEFS_ZONE_OFFLINE) { + /* Offline zones cannot be read nor written */ + inode->i_flags |= S_IMMUTABLE; + inode->i_mode &= ~0777; +- } else if (zi->i_flags & ZONEFS_ZONE_READONLY) { ++ } else if (z->z_flags & ZONEFS_ZONE_READONLY) { + /* Readonly zones cannot be written */ + inode->i_flags |= S_IMMUTABLE; +- if (zi->i_flags & ZONEFS_ZONE_INIT_MODE) ++ if (z->z_flags & ZONEFS_ZONE_INIT_MODE) + inode->i_mode &= ~0777; + else + inode->i_mode &= ~0222; + } + +- zi->i_flags &= ~ZONEFS_ZONE_INIT_MODE; ++ z->z_flags &= ~ZONEFS_ZONE_INIT_MODE; + } + + struct zonefs_ioerr_data { +@@ -224,7 +255,7 @@ static int zonefs_io_error_cb(struct blk_zone *zone, unsigned int idx, + { + struct zonefs_ioerr_data *err = data; + struct inode *inode = err->inode; +- struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct zonefs_zone *z = zonefs_inode_zone(inode); + struct super_block *sb = inode->i_sb; + struct zonefs_sb_info *sbi = ZONEFS_SB(sb); + loff_t isize, data_size; +@@ -235,9 +266,9 @@ static int zonefs_io_error_cb(struct blk_zone *zone, unsigned int idx, + * as there is no inconsistency between the inode size and the amount of + * data writen in the zone (data_size). + */ +- data_size = zonefs_check_zone_condition(inode, zone); ++ data_size = zonefs_check_zone_condition(sb, z, zone); + isize = i_size_read(inode); +- if (!(zi->i_flags & (ZONEFS_ZONE_READONLY | ZONEFS_ZONE_OFFLINE)) && ++ if (!(z->z_flags & (ZONEFS_ZONE_READONLY | ZONEFS_ZONE_OFFLINE)) && + !err->write && isize == data_size) + return 0; + +@@ -260,8 +291,9 @@ static int zonefs_io_error_cb(struct blk_zone *zone, unsigned int idx, + * In all cases, warn about inode size inconsistency and handle the + * IO error according to the zone condition and to the mount options. + */ +- if (zonefs_zone_is_seq(zi) && isize != data_size) +- zonefs_warn(sb, "inode %lu: invalid size %lld (should be %lld)\n", ++ if (zonefs_zone_is_seq(z) && isize != data_size) ++ zonefs_warn(sb, ++ "inode %lu: invalid size %lld (should be %lld)\n", + inode->i_ino, isize, data_size); + + /* +@@ -270,20 +302,20 @@ static int zonefs_io_error_cb(struct blk_zone *zone, unsigned int idx, + * zone condition to read-only and offline respectively, as if the + * condition was signaled by the hardware. + */ +- if ((zi->i_flags & ZONEFS_ZONE_OFFLINE) || ++ if ((z->z_flags & ZONEFS_ZONE_OFFLINE) || + (sbi->s_mount_opts & ZONEFS_MNTOPT_ERRORS_ZOL)) { + zonefs_warn(sb, "inode %lu: read/write access disabled\n", + inode->i_ino); +- if (!(zi->i_flags & ZONEFS_ZONE_OFFLINE)) +- zi->i_flags |= ZONEFS_ZONE_OFFLINE; ++ if (!(z->z_flags & ZONEFS_ZONE_OFFLINE)) ++ z->z_flags |= ZONEFS_ZONE_OFFLINE; + zonefs_inode_update_mode(inode); + data_size = 0; +- } else if ((zi->i_flags & ZONEFS_ZONE_READONLY) || ++ } else if ((z->z_flags & ZONEFS_ZONE_READONLY) || + (sbi->s_mount_opts & ZONEFS_MNTOPT_ERRORS_ZRO)) { + zonefs_warn(sb, "inode %lu: write access disabled\n", + inode->i_ino); +- if (!(zi->i_flags & ZONEFS_ZONE_READONLY)) +- zi->i_flags |= ZONEFS_ZONE_READONLY; ++ if (!(z->z_flags & ZONEFS_ZONE_READONLY)) ++ z->z_flags |= ZONEFS_ZONE_READONLY; + zonefs_inode_update_mode(inode); + data_size = isize; + } else if (sbi->s_mount_opts & ZONEFS_MNTOPT_ERRORS_RO && +@@ -299,8 +331,8 @@ static int zonefs_io_error_cb(struct blk_zone *zone, unsigned int idx, + * close of the zone when the inode file is closed. + */ + if ((sbi->s_mount_opts & ZONEFS_MNTOPT_EXPLICIT_OPEN) && +- (zi->i_flags & (ZONEFS_ZONE_READONLY | ZONEFS_ZONE_OFFLINE))) +- zi->i_flags &= ~ZONEFS_ZONE_OPEN; ++ (z->z_flags & (ZONEFS_ZONE_READONLY | ZONEFS_ZONE_OFFLINE))) ++ z->z_flags &= ~ZONEFS_ZONE_OPEN; + + /* + * If error=remount-ro was specified, any error result in remounting +@@ -317,8 +349,8 @@ static int zonefs_io_error_cb(struct blk_zone *zone, unsigned int idx, + */ + zonefs_update_stats(inode, data_size); + zonefs_i_size_write(inode, data_size); +- zi->i_wpoffset = data_size; +- zonefs_account_active(inode); ++ z->z_wpoffset = data_size; ++ zonefs_inode_account_active(inode); + + return 0; + } +@@ -332,7 +364,7 @@ static int zonefs_io_error_cb(struct blk_zone *zone, unsigned int idx, + */ + void __zonefs_io_error(struct inode *inode, bool write) + { +- struct zonefs_inode_info *zi = ZONEFS_I(inode); ++ struct zonefs_zone *z = zonefs_inode_zone(inode); + struct super_block *sb = inode->i_sb; + struct zonefs_sb_info *sbi = ZONEFS_SB(sb); + unsigned int noio_flag; +@@ -348,8 +380,8 @@ void __zonefs_io_error(struct inode *inode, bool write) + * files with aggregated conventional zones, for which the inode zone + * size is always larger than the device zone size. + */ +- if (zi->i_zone_size > bdev_zone_sectors(sb->s_bdev)) +- nr_zones = zi->i_zone_size >> ++ if (z->z_size > bdev_zone_sectors(sb->s_bdev)) ++ nr_zones = z->z_size >> + (sbi->s_zone_sectors_shift + SECTOR_SHIFT); + + /* +@@ -361,7 +393,7 @@ void __zonefs_io_error(struct inode *inode, bool write) + * the GFP_NOIO context avoids both problems. + */ + noio_flag = memalloc_noio_save(); +- ret = blkdev_report_zones(sb->s_bdev, zi->i_zsector, nr_zones, ++ ret = blkdev_report_zones(sb->s_bdev, z->z_sector, nr_zones, + zonefs_io_error_cb, &err); + if (ret != nr_zones) + zonefs_err(sb, "Get inode %lu zone information failed %d\n", +@@ -381,9 +413,7 @@ static struct inode *zonefs_alloc_inode(struct super_block *sb) + + inode_init_once(&zi->i_vnode); + mutex_init(&zi->i_truncate_mutex); +- zi->i_wpoffset = 0; + zi->i_wr_refcnt = 0; +- zi->i_flags = 0; + + return &zi->i_vnode; + } +@@ -416,8 +446,8 @@ static int zonefs_statfs(struct dentry *dentry, struct kstatfs *buf) + buf->f_bavail = buf->f_bfree; + + for (t = 0; t < ZONEFS_ZTYPE_MAX; t++) { +- if (sbi->s_nr_files[t]) +- buf->f_files += sbi->s_nr_files[t] + 1; ++ if (sbi->s_zgroup[t].g_nr_zones) ++ buf->f_files += sbi->s_zgroup[t].g_nr_zones + 1; + } + buf->f_ffree = 0; + +@@ -557,11 +587,11 @@ static const struct inode_operations zonefs_dir_inode_operations = { + }; + + static void zonefs_init_dir_inode(struct inode *parent, struct inode *inode, +- enum zonefs_ztype type) ++ enum zonefs_ztype ztype) + { + struct super_block *sb = parent->i_sb; + +- inode->i_ino = bdev_nr_zones(sb->s_bdev) + type + 1; ++ inode->i_ino = bdev_nr_zones(sb->s_bdev) + ztype + 1; + inode_init_owner(&init_user_ns, inode, parent, S_IFDIR | 0555); + inode->i_op = &zonefs_dir_inode_operations; + inode->i_fop = &simple_dir_operations; +@@ -573,79 +603,34 @@ static const struct inode_operations zonefs_file_inode_operations = { + .setattr = zonefs_inode_setattr, + }; + +-static int zonefs_init_file_inode(struct inode *inode, struct blk_zone *zone, +- enum zonefs_ztype type) ++static void zonefs_init_file_inode(struct inode *inode, ++ struct zonefs_zone *z) + { + struct super_block *sb = inode->i_sb; + struct zonefs_sb_info *sbi = ZONEFS_SB(sb); +- struct zonefs_inode_info *zi = ZONEFS_I(inode); +- int ret = 0; +- +- inode->i_ino = zone->start >> sbi->s_zone_sectors_shift; +- inode->i_mode = S_IFREG | sbi->s_perm; + +- if (type == ZONEFS_ZTYPE_CNV) +- zi->i_flags |= ZONEFS_ZONE_CNV; +- +- zi->i_zsector = zone->start; +- zi->i_zone_size = zone->len << SECTOR_SHIFT; +- if (zi->i_zone_size > bdev_zone_sectors(sb->s_bdev) << SECTOR_SHIFT && +- !(sbi->s_features & ZONEFS_F_AGGRCNV)) { +- zonefs_err(sb, +- "zone size %llu doesn't match device's zone sectors %llu\n", +- zi->i_zone_size, +- bdev_zone_sectors(sb->s_bdev) << SECTOR_SHIFT); +- return -EINVAL; +- } +- +- zi->i_max_size = min_t(loff_t, MAX_LFS_FILESIZE, +- zone->capacity << SECTOR_SHIFT); +- zi->i_wpoffset = zonefs_check_zone_condition(inode, zone); ++ inode->i_private = z; + ++ inode->i_ino = z->z_sector >> sbi->s_zone_sectors_shift; ++ inode->i_mode = S_IFREG | sbi->s_perm; + inode->i_uid = sbi->s_uid; + inode->i_gid = sbi->s_gid; +- inode->i_size = zi->i_wpoffset; +- inode->i_blocks = zi->i_max_size >> SECTOR_SHIFT; ++ inode->i_size = z->z_wpoffset; ++ inode->i_blocks = z->z_capacity >> SECTOR_SHIFT; + + inode->i_op = &zonefs_file_inode_operations; + inode->i_fop = &zonefs_file_operations; + inode->i_mapping->a_ops = &zonefs_file_aops; + + /* Update the inode access rights depending on the zone condition */ +- zi->i_flags |= ZONEFS_ZONE_INIT_MODE; ++ z->z_flags |= ZONEFS_ZONE_INIT_MODE; + zonefs_inode_update_mode(inode); +- +- sb->s_maxbytes = max(zi->i_max_size, sb->s_maxbytes); +- sbi->s_blocks += zi->i_max_size >> sb->s_blocksize_bits; +- sbi->s_used_blocks += zi->i_wpoffset >> sb->s_blocksize_bits; +- +- mutex_lock(&zi->i_truncate_mutex); +- +- /* +- * For sequential zones, make sure that any open zone is closed first +- * to ensure that the initial number of open zones is 0, in sync with +- * the open zone accounting done when the mount option +- * ZONEFS_MNTOPT_EXPLICIT_OPEN is used. +- */ +- if (type == ZONEFS_ZTYPE_SEQ && +- (zone->cond == BLK_ZONE_COND_IMP_OPEN || +- zone->cond == BLK_ZONE_COND_EXP_OPEN)) { +- ret = zonefs_zone_mgmt(inode, REQ_OP_ZONE_CLOSE); +- if (ret) +- goto unlock; +- } +- +- zonefs_account_active(inode); +- +-unlock: +- mutex_unlock(&zi->i_truncate_mutex); +- +- return ret; + } + + static struct dentry *zonefs_create_inode(struct dentry *parent, +- const char *name, struct blk_zone *zone, +- enum zonefs_ztype type) ++ const char *name, ++ struct zonefs_zone *z, ++ enum zonefs_ztype ztype) + { + struct inode *dir = d_inode(parent); + struct dentry *dentry; +@@ -661,15 +646,10 @@ static struct dentry *zonefs_create_inode(struct dentry *parent, + goto dput; + + inode->i_ctime = inode->i_mtime = inode->i_atime = dir->i_ctime; +- if (zone) { +- ret = zonefs_init_file_inode(inode, zone, type); +- if (ret) { +- iput(inode); +- goto dput; +- } +- } else { +- zonefs_init_dir_inode(dir, inode, type); +- } ++ if (z) ++ zonefs_init_file_inode(inode, z); ++ else ++ zonefs_init_dir_inode(dir, inode, ztype); + + d_add(dentry, inode); + dir->i_size++; +@@ -685,100 +665,51 @@ static struct dentry *zonefs_create_inode(struct dentry *parent, + struct zonefs_zone_data { + struct super_block *sb; + unsigned int nr_zones[ZONEFS_ZTYPE_MAX]; ++ sector_t cnv_zone_start; + struct blk_zone *zones; + }; + + /* +- * Create a zone group and populate it with zone files. ++ * Create the inodes for a zone group. + */ +-static int zonefs_create_zgroup(struct zonefs_zone_data *zd, +- enum zonefs_ztype type) ++static int zonefs_create_zgroup_inodes(struct super_block *sb, ++ enum zonefs_ztype ztype) + { +- struct super_block *sb = zd->sb; + struct zonefs_sb_info *sbi = ZONEFS_SB(sb); +- struct blk_zone *zone, *next, *end; +- const char *zgroup_name; +- char *file_name; ++ struct zonefs_zone_group *zgroup = &sbi->s_zgroup[ztype]; + struct dentry *dir, *dent; +- unsigned int n = 0; +- int ret; ++ char *file_name; ++ int i, ret = 0; ++ ++ if (!zgroup) ++ return -ENOMEM; + + /* If the group is empty, there is nothing to do */ +- if (!zd->nr_zones[type]) ++ if (!zgroup->g_nr_zones) + return 0; + + file_name = kmalloc(ZONEFS_NAME_MAX, GFP_KERNEL); + if (!file_name) + return -ENOMEM; + +- if (type == ZONEFS_ZTYPE_CNV) +- zgroup_name = "cnv"; +- else +- zgroup_name = "seq"; +- +- dir = zonefs_create_inode(sb->s_root, zgroup_name, NULL, type); ++ dir = zonefs_create_inode(sb->s_root, zonefs_zgroup_name(ztype), ++ NULL, ztype); + if (IS_ERR(dir)) { + ret = PTR_ERR(dir); + goto free; + } + +- /* +- * The first zone contains the super block: skip it. +- */ +- end = zd->zones + bdev_nr_zones(sb->s_bdev); +- for (zone = &zd->zones[1]; zone < end; zone = next) { +- +- next = zone + 1; +- if (zonefs_zone_type(zone) != type) +- continue; +- +- /* +- * For conventional zones, contiguous zones can be aggregated +- * together to form larger files. Note that this overwrites the +- * length of the first zone of the set of contiguous zones +- * aggregated together. If one offline or read-only zone is +- * found, assume that all zones aggregated have the same +- * condition. +- */ +- if (type == ZONEFS_ZTYPE_CNV && +- (sbi->s_features & ZONEFS_F_AGGRCNV)) { +- for (; next < end; next++) { +- if (zonefs_zone_type(next) != type) +- break; +- zone->len += next->len; +- zone->capacity += next->capacity; +- if (next->cond == BLK_ZONE_COND_READONLY && +- zone->cond != BLK_ZONE_COND_OFFLINE) +- zone->cond = BLK_ZONE_COND_READONLY; +- else if (next->cond == BLK_ZONE_COND_OFFLINE) +- zone->cond = BLK_ZONE_COND_OFFLINE; +- } +- if (zone->capacity != zone->len) { +- zonefs_err(sb, "Invalid conventional zone capacity\n"); +- ret = -EINVAL; +- goto free; +- } +- } +- +- /* +- * Use the file number within its group as file name. +- */ +- snprintf(file_name, ZONEFS_NAME_MAX - 1, "%u", n); +- dent = zonefs_create_inode(dir, file_name, zone, type); ++ for (i = 0; i < zgroup->g_nr_zones; i++) { ++ /* Use the zone number within its group as the file name */ ++ snprintf(file_name, ZONEFS_NAME_MAX - 1, "%u", i); ++ dent = zonefs_create_inode(dir, file_name, ++ &zgroup->g_zones[i], ztype); + if (IS_ERR(dent)) { + ret = PTR_ERR(dent); +- goto free; ++ break; + } +- +- n++; + } + +- zonefs_info(sb, "Zone group \"%s\" has %u file%s\n", +- zgroup_name, n, n > 1 ? "s" : ""); +- +- sbi->s_nr_files[type] = n; +- ret = 0; +- + free: + kfree(file_name); + +@@ -789,21 +720,38 @@ static int zonefs_get_zone_info_cb(struct blk_zone *zone, unsigned int idx, + void *data) + { + struct zonefs_zone_data *zd = data; ++ struct super_block *sb = zd->sb; ++ struct zonefs_sb_info *sbi = ZONEFS_SB(sb); ++ ++ /* ++ * We do not care about the first zone: it contains the super block ++ * and not exposed as a file. ++ */ ++ if (!idx) ++ return 0; + + /* +- * Count the number of usable zones: the first zone at index 0 contains +- * the super block and is ignored. ++ * Count the number of zones that will be exposed as files. ++ * For sequential zones, we always have as many files as zones. ++ * FOr conventional zones, the number of files depends on if we have ++ * conventional zones aggregation enabled. + */ + switch (zone->type) { + case BLK_ZONE_TYPE_CONVENTIONAL: +- zone->wp = zone->start + zone->len; +- if (idx) +- zd->nr_zones[ZONEFS_ZTYPE_CNV]++; ++ if (sbi->s_features & ZONEFS_F_AGGRCNV) { ++ /* One file per set of contiguous conventional zones */ ++ if (!(sbi->s_zgroup[ZONEFS_ZTYPE_CNV].g_nr_zones) || ++ zone->start != zd->cnv_zone_start) ++ sbi->s_zgroup[ZONEFS_ZTYPE_CNV].g_nr_zones++; ++ zd->cnv_zone_start = zone->start + zone->len; ++ } else { ++ /* One file per zone */ ++ sbi->s_zgroup[ZONEFS_ZTYPE_CNV].g_nr_zones++; ++ } + break; + case BLK_ZONE_TYPE_SEQWRITE_REQ: + case BLK_ZONE_TYPE_SEQWRITE_PREF: +- if (idx) +- zd->nr_zones[ZONEFS_ZTYPE_SEQ]++; ++ sbi->s_zgroup[ZONEFS_ZTYPE_SEQ].g_nr_zones++; + break; + default: + zonefs_err(zd->sb, "Unsupported zone type 0x%x\n", +@@ -843,11 +791,173 @@ static int zonefs_get_zone_info(struct zonefs_zone_data *zd) + return 0; + } + +-static inline void zonefs_cleanup_zone_info(struct zonefs_zone_data *zd) ++static inline void zonefs_free_zone_info(struct zonefs_zone_data *zd) + { + kvfree(zd->zones); + } + ++/* ++ * Create a zone group and populate it with zone files. ++ */ ++static int zonefs_init_zgroup(struct super_block *sb, ++ struct zonefs_zone_data *zd, ++ enum zonefs_ztype ztype) ++{ ++ struct zonefs_sb_info *sbi = ZONEFS_SB(sb); ++ struct zonefs_zone_group *zgroup = &sbi->s_zgroup[ztype]; ++ struct blk_zone *zone, *next, *end; ++ struct zonefs_zone *z; ++ unsigned int n = 0; ++ int ret; ++ ++ /* Allocate the zone group. If it is empty, we have nothing to do. */ ++ if (!zgroup->g_nr_zones) ++ return 0; ++ ++ zgroup->g_zones = kvcalloc(zgroup->g_nr_zones, ++ sizeof(struct zonefs_zone), GFP_KERNEL); ++ if (!zgroup->g_zones) ++ return -ENOMEM; ++ ++ /* ++ * Initialize the zone groups using the device zone information. ++ * We always skip the first zone as it contains the super block ++ * and is not use to back a file. ++ */ ++ end = zd->zones + bdev_nr_zones(sb->s_bdev); ++ for (zone = &zd->zones[1]; zone < end; zone = next) { ++ ++ next = zone + 1; ++ if (zonefs_zone_type(zone) != ztype) ++ continue; ++ ++ if (WARN_ON_ONCE(n >= zgroup->g_nr_zones)) ++ return -EINVAL; ++ ++ /* ++ * For conventional zones, contiguous zones can be aggregated ++ * together to form larger files. Note that this overwrites the ++ * length of the first zone of the set of contiguous zones ++ * aggregated together. If one offline or read-only zone is ++ * found, assume that all zones aggregated have the same ++ * condition. ++ */ ++ if (ztype == ZONEFS_ZTYPE_CNV && ++ (sbi->s_features & ZONEFS_F_AGGRCNV)) { ++ for (; next < end; next++) { ++ if (zonefs_zone_type(next) != ztype) ++ break; ++ zone->len += next->len; ++ zone->capacity += next->capacity; ++ if (next->cond == BLK_ZONE_COND_READONLY && ++ zone->cond != BLK_ZONE_COND_OFFLINE) ++ zone->cond = BLK_ZONE_COND_READONLY; ++ else if (next->cond == BLK_ZONE_COND_OFFLINE) ++ zone->cond = BLK_ZONE_COND_OFFLINE; ++ } ++ } ++ ++ z = &zgroup->g_zones[n]; ++ if (ztype == ZONEFS_ZTYPE_CNV) ++ z->z_flags |= ZONEFS_ZONE_CNV; ++ z->z_sector = zone->start; ++ z->z_size = zone->len << SECTOR_SHIFT; ++ if (z->z_size > bdev_zone_sectors(sb->s_bdev) << SECTOR_SHIFT && ++ !(sbi->s_features & ZONEFS_F_AGGRCNV)) { ++ zonefs_err(sb, ++ "Invalid zone size %llu (device zone sectors %llu)\n", ++ z->z_size, ++ bdev_zone_sectors(sb->s_bdev) << SECTOR_SHIFT); ++ return -EINVAL; ++ } ++ ++ z->z_capacity = min_t(loff_t, MAX_LFS_FILESIZE, ++ zone->capacity << SECTOR_SHIFT); ++ z->z_wpoffset = zonefs_check_zone_condition(sb, z, zone); ++ ++ sb->s_maxbytes = max(z->z_capacity, sb->s_maxbytes); ++ sbi->s_blocks += z->z_capacity >> sb->s_blocksize_bits; ++ sbi->s_used_blocks += z->z_wpoffset >> sb->s_blocksize_bits; ++ ++ /* ++ * For sequential zones, make sure that any open zone is closed ++ * first to ensure that the initial number of open zones is 0, ++ * in sync with the open zone accounting done when the mount ++ * option ZONEFS_MNTOPT_EXPLICIT_OPEN is used. ++ */ ++ if (ztype == ZONEFS_ZTYPE_SEQ && ++ (zone->cond == BLK_ZONE_COND_IMP_OPEN || ++ zone->cond == BLK_ZONE_COND_EXP_OPEN)) { ++ ret = zonefs_zone_mgmt(sb, z, REQ_OP_ZONE_CLOSE); ++ if (ret) ++ return ret; ++ } ++ ++ zonefs_account_active(sb, z); ++ ++ n++; ++ } ++ ++ if (WARN_ON_ONCE(n != zgroup->g_nr_zones)) ++ return -EINVAL; ++ ++ zonefs_info(sb, "Zone group \"%s\" has %u file%s\n", ++ zonefs_zgroup_name(ztype), ++ zgroup->g_nr_zones, ++ zgroup->g_nr_zones > 1 ? "s" : ""); ++ ++ return 0; ++} ++ ++static void zonefs_free_zgroups(struct super_block *sb) ++{ ++ struct zonefs_sb_info *sbi = ZONEFS_SB(sb); ++ enum zonefs_ztype ztype; ++ ++ if (!sbi) ++ return; ++ ++ for (ztype = 0; ztype < ZONEFS_ZTYPE_MAX; ztype++) { ++ kvfree(sbi->s_zgroup[ztype].g_zones); ++ sbi->s_zgroup[ztype].g_zones = NULL; ++ } ++} ++ ++/* ++ * Create a zone group and populate it with zone files. ++ */ ++static int zonefs_init_zgroups(struct super_block *sb) ++{ ++ struct zonefs_zone_data zd; ++ enum zonefs_ztype ztype; ++ int ret; ++ ++ /* First get the device zone information */ ++ memset(&zd, 0, sizeof(struct zonefs_zone_data)); ++ zd.sb = sb; ++ ret = zonefs_get_zone_info(&zd); ++ if (ret) ++ goto cleanup; ++ ++ /* Allocate and initialize the zone groups */ ++ for (ztype = 0; ztype < ZONEFS_ZTYPE_MAX; ztype++) { ++ ret = zonefs_init_zgroup(sb, &zd, ztype); ++ if (ret) { ++ zonefs_info(sb, ++ "Zone group \"%s\" initialization failed\n", ++ zonefs_zgroup_name(ztype)); ++ break; ++ } ++ } ++ ++cleanup: ++ zonefs_free_zone_info(&zd); ++ if (ret) ++ zonefs_free_zgroups(sb); ++ ++ return ret; ++} ++ + /* + * Read super block information from the device. + */ +@@ -945,7 +1055,6 @@ static const struct super_operations zonefs_sops = { + */ + static int zonefs_fill_super(struct super_block *sb, void *data, int silent) + { +- struct zonefs_zone_data zd; + struct zonefs_sb_info *sbi; + struct inode *inode; + enum zonefs_ztype t; +@@ -998,16 +1107,6 @@ static int zonefs_fill_super(struct super_block *sb, void *data, int silent) + if (ret) + return ret; + +- memset(&zd, 0, sizeof(struct zonefs_zone_data)); +- zd.sb = sb; +- ret = zonefs_get_zone_info(&zd); +- if (ret) +- goto cleanup; +- +- ret = zonefs_sysfs_register(sb); +- if (ret) +- goto cleanup; +- + zonefs_info(sb, "Mounting %u zones", bdev_nr_zones(sb->s_bdev)); + + if (!sbi->s_max_wro_seq_files && +@@ -1018,6 +1117,11 @@ static int zonefs_fill_super(struct super_block *sb, void *data, int silent) + sbi->s_mount_opts &= ~ZONEFS_MNTOPT_EXPLICIT_OPEN; + } + ++ /* Initialize the zone groups */ ++ ret = zonefs_init_zgroups(sb); ++ if (ret) ++ goto cleanup; ++ + /* Create root directory inode */ + ret = -ENOMEM; + inode = new_inode(sb); +@@ -1037,13 +1141,19 @@ static int zonefs_fill_super(struct super_block *sb, void *data, int silent) + + /* Create and populate files in zone groups directories */ + for (t = 0; t < ZONEFS_ZTYPE_MAX; t++) { +- ret = zonefs_create_zgroup(&zd, t); ++ ret = zonefs_create_zgroup_inodes(sb, t); + if (ret) +- break; ++ goto cleanup; + } + ++ ret = zonefs_sysfs_register(sb); ++ if (ret) ++ goto cleanup; ++ ++ return 0; ++ + cleanup: +- zonefs_cleanup_zone_info(&zd); ++ zonefs_free_zgroups(sb); + + return ret; + } +@@ -1062,6 +1172,7 @@ static void zonefs_kill_super(struct super_block *sb) + d_genocide(sb->s_root); + + zonefs_sysfs_unregister(sb); ++ zonefs_free_zgroups(sb); + kill_block_super(sb); + kfree(sbi); + } +diff --git a/fs/zonefs/trace.h b/fs/zonefs/trace.h +index 42edcfd3..9969db3a 100644 +--- a/fs/zonefs/trace.h ++++ b/fs/zonefs/trace.h +@@ -20,8 +20,9 @@ + #define show_dev(dev) MAJOR(dev), MINOR(dev) + + TRACE_EVENT(zonefs_zone_mgmt, +- TP_PROTO(struct inode *inode, enum req_op op), +- TP_ARGS(inode, op), ++ TP_PROTO(struct super_block *sb, struct zonefs_zone *z, ++ enum req_op op), ++ TP_ARGS(sb, z, op), + TP_STRUCT__entry( + __field(dev_t, dev) + __field(ino_t, ino) +@@ -30,12 +31,12 @@ TRACE_EVENT(zonefs_zone_mgmt, + __field(sector_t, nr_sectors) + ), + TP_fast_assign( +- __entry->dev = inode->i_sb->s_dev; +- __entry->ino = inode->i_ino; ++ __entry->dev = sb->s_dev; ++ __entry->ino = ++ z->z_sector >> ZONEFS_SB(sb)->s_zone_sectors_shift; + __entry->op = op; +- __entry->sector = ZONEFS_I(inode)->i_zsector; +- __entry->nr_sectors = +- ZONEFS_I(inode)->i_zone_size >> SECTOR_SHIFT; ++ __entry->sector = z->z_sector; ++ __entry->nr_sectors = z->z_size >> SECTOR_SHIFT; + ), + TP_printk("bdev=(%d,%d), ino=%lu op=%s, sector=%llu, nr_sectors=%llu", + show_dev(__entry->dev), (unsigned long)__entry->ino, +@@ -58,9 +59,10 @@ TRACE_EVENT(zonefs_file_dio_append, + TP_fast_assign( + __entry->dev = inode->i_sb->s_dev; + __entry->ino = inode->i_ino; +- __entry->sector = ZONEFS_I(inode)->i_zsector; ++ __entry->sector = zonefs_inode_zone(inode)->z_sector; + __entry->size = size; +- __entry->wpoffset = ZONEFS_I(inode)->i_wpoffset; ++ __entry->wpoffset = ++ zonefs_inode_zone(inode)->z_wpoffset; + __entry->ret = ret; + ), + TP_printk("bdev=(%d, %d), ino=%lu, sector=%llu, size=%zu, wpoffset=%llu, ret=%zu", +diff --git a/fs/zonefs/zonefs.h b/fs/zonefs/zonefs.h +index 1a225f74..2d626e18 100644 +--- a/fs/zonefs/zonefs.h ++++ b/fs/zonefs/zonefs.h +@@ -47,22 +47,39 @@ static inline enum zonefs_ztype zonefs_zone_type(struct blk_zone *zone) + #define ZONEFS_ZONE_CNV (1U << 31) + + /* +- * In-memory inode data. ++ * In-memory per-file inode zone data. + */ +-struct zonefs_inode_info { +- struct inode i_vnode; ++struct zonefs_zone { ++ /* Zone state flags */ ++ unsigned int z_flags; + +- /* File zone start sector (512B unit) */ +- sector_t i_zsector; ++ /* Zone start sector (512B unit) */ ++ sector_t z_sector; + +- /* File zone write pointer position (sequential zones only) */ +- loff_t i_wpoffset; ++ /* Zone size (bytes) */ ++ loff_t z_size; + +- /* File maximum size */ +- loff_t i_max_size; ++ /* Zone capacity (file maximum size, bytes) */ ++ loff_t z_capacity; + +- /* File zone size */ +- loff_t i_zone_size; ++ /* Write pointer offset in the zone (sequential zones only, bytes) */ ++ loff_t z_wpoffset; ++}; ++ ++/* ++ * In memory zone group information: all zones of a group are exposed ++ * as files, one file per zone. ++ */ ++struct zonefs_zone_group { ++ unsigned int g_nr_zones; ++ struct zonefs_zone *g_zones; ++}; ++ ++/* ++ * In-memory inode data. ++ */ ++struct zonefs_inode_info { ++ struct inode i_vnode; + + /* + * To serialise fully against both syscall and mmap based IO and +@@ -81,7 +98,6 @@ struct zonefs_inode_info { + + /* guarded by i_truncate_mutex */ + unsigned int i_wr_refcnt; +- unsigned int i_flags; + }; + + static inline struct zonefs_inode_info *ZONEFS_I(struct inode *inode) +@@ -89,24 +105,29 @@ static inline struct zonefs_inode_info *ZONEFS_I(struct inode *inode) + return container_of(inode, struct zonefs_inode_info, i_vnode); + } + +-static inline bool zonefs_zone_is_cnv(struct zonefs_inode_info *zi) ++static inline bool zonefs_zone_is_cnv(struct zonefs_zone *z) ++{ ++ return z->z_flags & ZONEFS_ZONE_CNV; ++} ++ ++static inline bool zonefs_zone_is_seq(struct zonefs_zone *z) + { +- return zi->i_flags & ZONEFS_ZONE_CNV; ++ return !zonefs_zone_is_cnv(z); + } + +-static inline bool zonefs_zone_is_seq(struct zonefs_inode_info *zi) ++static inline struct zonefs_zone *zonefs_inode_zone(struct inode *inode) + { +- return !zonefs_zone_is_cnv(zi); ++ return inode->i_private; + } + + static inline bool zonefs_inode_is_cnv(struct inode *inode) + { +- return zonefs_zone_is_cnv(ZONEFS_I(inode)); ++ return zonefs_zone_is_cnv(zonefs_inode_zone(inode)); + } + + static inline bool zonefs_inode_is_seq(struct inode *inode) + { +- return zonefs_zone_is_seq(ZONEFS_I(inode)); ++ return zonefs_zone_is_seq(zonefs_inode_zone(inode)); + } + + /* +@@ -200,7 +221,7 @@ struct zonefs_sb_info { + uuid_t s_uuid; + unsigned int s_zone_sectors_shift; + +- unsigned int s_nr_files[ZONEFS_ZTYPE_MAX]; ++ struct zonefs_zone_group s_zgroup[ZONEFS_ZTYPE_MAX]; + + loff_t s_blocks; + loff_t s_used_blocks; +@@ -229,8 +250,8 @@ static inline struct zonefs_sb_info *ZONEFS_SB(struct super_block *sb) + pr_warn("zonefs (%s) WARNING: " format, sb->s_id, ## args) + + /* In super.c */ +-void zonefs_account_active(struct inode *inode); +-int zonefs_zone_mgmt(struct inode *inode, enum req_op op); ++void zonefs_inode_account_active(struct inode *inode); ++int zonefs_inode_zone_mgmt(struct inode *inode, enum req_op op); + void zonefs_i_size_write(struct inode *inode, loff_t isize); + void zonefs_update_stats(struct inode *inode, loff_t new_isize); + void __zonefs_io_error(struct inode *inode, bool write); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-009-zonefs-Fix-error-message-in-zonefs_file_dio_ap.patch b/patches.kernel.org/6.2.10-009-zonefs-Fix-error-message-in-zonefs_file_dio_ap.patch new file mode 100644 index 0000000..bf01a4e --- /dev/null +++ b/patches.kernel.org/6.2.10-009-zonefs-Fix-error-message-in-zonefs_file_dio_ap.patch @@ -0,0 +1,42 @@ +From: Damien Le Moal +Date: Mon, 20 Mar 2023 22:49:15 +0900 +Subject: [PATCH] zonefs: Fix error message in zonefs_file_dio_append() +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 88b170088ad2c3e27086fe35769aa49f8a512564 + +[ Upstream commit 88b170088ad2c3e27086fe35769aa49f8a512564 ] + +Since the expected write location in a sequential file is always at the +end of the file (append write), when an invalid write append location is +detected in zonefs_file_dio_append(), print the invalid written location +instead of the expected write location. + +Fixes: a608da3bd730 ("zonefs: Detect append writes at invalid locations") +Cc: stable@vger.kernel.org +Signed-off-by: Damien Le Moal +Reviewed-by: Christoph Hellwig +Reviewed-by: Johannes Thumshirn +Reviewed-by: Himanshu Madhani +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/zonefs/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/zonefs/file.c b/fs/zonefs/file.c +index 738b0e28..c71cc0fc 100644 +--- a/fs/zonefs/file.c ++++ b/fs/zonefs/file.c +@@ -426,7 +426,7 @@ static ssize_t zonefs_file_dio_append(struct kiocb *iocb, struct iov_iter *from) + if (bio->bi_iter.bi_sector != wpsector) { + zonefs_warn(inode->i_sb, + "Corrupted write pointer %llu for zone at %llu\n", +- wpsector, z->z_sector); ++ bio->bi_iter.bi_sector, z->z_sector); + ret = -EIO; + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-010-btrfs-rename-BTRFS_FS_NO_OVERCOMMIT-to-BTRFS_F.patch b/patches.kernel.org/6.2.10-010-btrfs-rename-BTRFS_FS_NO_OVERCOMMIT-to-BTRFS_F.patch new file mode 100644 index 0000000..07b20c9 --- /dev/null +++ b/patches.kernel.org/6.2.10-010-btrfs-rename-BTRFS_FS_NO_OVERCOMMIT-to-BTRFS_F.patch @@ -0,0 +1,78 @@ +From: Josef Bacik +Date: Wed, 1 Mar 2023 16:14:42 -0500 +Subject: [PATCH] btrfs: rename BTRFS_FS_NO_OVERCOMMIT to + BTRFS_FS_ACTIVE_ZONE_TRACKING +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: bf1f1fec2724a33b67ec12032402ea75f2a83622 + +[ Upstream commit bf1f1fec2724a33b67ec12032402ea75f2a83622 ] + +This flag only gets set when we're doing active zone tracking, and we're +going to need to use this flag for things related to this behavior. +Rename the flag to represent what it actually means for the file system +so it can be used in other ways and still make sense. + +Reviewed-by: Naohiro Aota +Reviewed-by: Johannes Thumshirn +Reviewed-by: Anand Jain +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Stable-dep-of: e15acc25880c ("btrfs: zoned: drop space_info->active_total_bytes") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/btrfs/fs.h | 7 ++----- + fs/btrfs/space-info.c | 2 +- + fs/btrfs/zoned.c | 3 +-- + 3 files changed, 4 insertions(+), 8 deletions(-) + +diff --git a/fs/btrfs/fs.h b/fs/btrfs/fs.h +index 3d8156fc..f180ca06 100644 +--- a/fs/btrfs/fs.h ++++ b/fs/btrfs/fs.h +@@ -119,11 +119,8 @@ enum { + /* Indicate that we want to commit the transaction. */ + BTRFS_FS_NEED_TRANS_COMMIT, + +- /* +- * Indicate metadata over-commit is disabled. This is set when active +- * zone tracking is needed. +- */ +- BTRFS_FS_NO_OVERCOMMIT, ++ /* This is set when active zone tracking is needed. */ ++ BTRFS_FS_ACTIVE_ZONE_TRACKING, + + /* + * Indicate if we have some features changed, this is mostly for +diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c +index 69c09508..2237685d 100644 +--- a/fs/btrfs/space-info.c ++++ b/fs/btrfs/space-info.c +@@ -407,7 +407,7 @@ int btrfs_can_overcommit(struct btrfs_fs_info *fs_info, + return 0; + + used = btrfs_space_info_used(space_info, true); +- if (test_bit(BTRFS_FS_NO_OVERCOMMIT, &fs_info->flags) && ++ if (test_bit(BTRFS_FS_ACTIVE_ZONE_TRACKING, &fs_info->flags) && + (space_info->flags & BTRFS_BLOCK_GROUP_METADATA)) + avail = 0; + else +diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c +index f3b7d8ae..a6a8bc11 100644 +--- a/fs/btrfs/zoned.c ++++ b/fs/btrfs/zoned.c +@@ -539,8 +539,7 @@ int btrfs_get_dev_zone_info(struct btrfs_device *device, bool populate_cache) + } + atomic_set(&zone_info->active_zones_left, + max_active_zones - nactive); +- /* Overcommit does not work well with active zone tacking. */ +- set_bit(BTRFS_FS_NO_OVERCOMMIT, &fs_info->flags); ++ set_bit(BTRFS_FS_ACTIVE_ZONE_TRACKING, &fs_info->flags); + } + + /* Validate superblock log */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-011-btrfs-zoned-count-fresh-BG-region-as-zone-unus.patch b/patches.kernel.org/6.2.10-011-btrfs-zoned-count-fresh-BG-region-as-zone-unus.patch new file mode 100644 index 0000000..f538c81 --- /dev/null +++ b/patches.kernel.org/6.2.10-011-btrfs-zoned-count-fresh-BG-region-as-zone-unus.patch @@ -0,0 +1,136 @@ +From: Naohiro Aota +Date: Mon, 13 Mar 2023 16:06:13 +0900 +Subject: [PATCH] btrfs: zoned: count fresh BG region as zone unusable +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: fa2068d7e922b434eba5bfb0131e6d39febfdb48 + +[ Upstream commit fa2068d7e922b434eba5bfb0131e6d39febfdb48 ] + +The naming of space_info->active_total_bytes is misleading. It counts +not only active block groups but also full ones which are previously +active but now inactive. That confusion results in a bug not counting +the full BGs into active_total_bytes on mount time. + +For a background, there are three kinds of block groups in terms of +activation. + + 1. Block groups never activated + 2. Block groups currently active + 3. Block groups previously active and currently inactive (due to fully + written or zone finish) + +What we really wanted to exclude from "total_bytes" is the total size of +BGs #1. They seem empty and allocatable but since they are not activated, +we cannot rely on them to do the space reservation. + +And, since BGs #1 never get activated, they should have no "used", +"reserved" and "pinned" bytes. + +OTOH, BGs #3 can be counted in the "total", since they are already full +we cannot allocate from them anyway. For them, "total_bytes == used + +reserved + pinned + zone_unusable" should hold. + +Tracking #2 and #3 as "active_total_bytes" (current implementation) is +confusing. And, tracking #1 and subtract that properly from "total_bytes" +every time you need space reservation is cumbersome. + +Instead, we can count the whole region of a newly allocated block group as +zone_unusable. Then, once that block group is activated, release +[0 .. zone_capacity] from the zone_unusable counters. With this, we can +eliminate the confusing ->active_total_bytes and the code will be common +among regular and the zoned mode. Also, no additional counter is needed +with this approach. + +Fixes: 6a921de58992 ("btrfs: zoned: introduce space_info->active_total_bytes") +CC: stable@vger.kernel.org # 6.1+ +Signed-off-by: Naohiro Aota +Signed-off-by: David Sterba +Stable-dep-of: e15acc25880c ("btrfs: zoned: drop space_info->active_total_bytes") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/btrfs/free-space-cache.c | 8 +++++++- + fs/btrfs/zoned.c | 24 +++++++++++++++++++----- + 2 files changed, 26 insertions(+), 6 deletions(-) + +diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c +index 0d250d05..d84cef89 100644 +--- a/fs/btrfs/free-space-cache.c ++++ b/fs/btrfs/free-space-cache.c +@@ -2693,8 +2693,13 @@ static int __btrfs_add_free_space_zoned(struct btrfs_block_group *block_group, + bg_reclaim_threshold = READ_ONCE(sinfo->bg_reclaim_threshold); + + spin_lock(&ctl->tree_lock); ++ /* Count initial region as zone_unusable until it gets activated. */ + if (!used) + to_free = size; ++ else if (initial && ++ test_bit(BTRFS_FS_ACTIVE_ZONE_TRACKING, &block_group->fs_info->flags) && ++ (block_group->flags & (BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_SYSTEM))) ++ to_free = 0; + else if (initial) + to_free = block_group->zone_capacity; + else if (offset >= block_group->alloc_offset) +@@ -2722,7 +2727,8 @@ static int __btrfs_add_free_space_zoned(struct btrfs_block_group *block_group, + reclaimable_unusable = block_group->zone_unusable - + (block_group->length - block_group->zone_capacity); + /* All the region is now unusable. Mark it as unused and reclaim */ +- if (block_group->zone_unusable == block_group->length) { ++ if (block_group->zone_unusable == block_group->length && ++ block_group->alloc_offset) { + btrfs_mark_bg_unused(block_group); + } else if (bg_reclaim_threshold && + reclaimable_unusable >= +diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c +index a6a8bc11..c3c763cc 100644 +--- a/fs/btrfs/zoned.c ++++ b/fs/btrfs/zoned.c +@@ -1576,9 +1576,19 @@ void btrfs_calc_zone_unusable(struct btrfs_block_group *cache) + return; + + WARN_ON(cache->bytes_super != 0); +- unusable = (cache->alloc_offset - cache->used) + +- (cache->length - cache->zone_capacity); +- free = cache->zone_capacity - cache->alloc_offset; ++ ++ /* Check for block groups never get activated */ ++ if (test_bit(BTRFS_FS_ACTIVE_ZONE_TRACKING, &cache->fs_info->flags) && ++ cache->flags & (BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_SYSTEM) && ++ !test_bit(BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE, &cache->runtime_flags) && ++ cache->alloc_offset == 0) { ++ unusable = cache->length; ++ free = 0; ++ } else { ++ unusable = (cache->alloc_offset - cache->used) + ++ (cache->length - cache->zone_capacity); ++ free = cache->zone_capacity - cache->alloc_offset; ++ } + + /* We only need ->free_space in ALLOC_SEQ block groups */ + cache->cached = BTRFS_CACHE_FINISHED; +@@ -1915,7 +1925,11 @@ bool btrfs_zone_activate(struct btrfs_block_group *block_group) + + /* Successfully activated all the zones */ + set_bit(BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE, &block_group->runtime_flags); +- space_info->active_total_bytes += block_group->length; ++ WARN_ON(block_group->alloc_offset != 0); ++ if (block_group->zone_unusable == block_group->length) { ++ block_group->zone_unusable = block_group->length - block_group->zone_capacity; ++ space_info->bytes_zone_unusable -= block_group->zone_capacity; ++ } + spin_unlock(&block_group->lock); + btrfs_try_granting_tickets(fs_info, space_info); + spin_unlock(&space_info->lock); +@@ -2279,7 +2293,7 @@ int btrfs_zone_finish_one_bg(struct btrfs_fs_info *fs_info) + u64 avail; + + spin_lock(&block_group->lock); +- if (block_group->reserved || ++ if (block_group->reserved || block_group->alloc_offset == 0 || + (block_group->flags & BTRFS_BLOCK_GROUP_SYSTEM)) { + spin_unlock(&block_group->lock); + continue; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-012-btrfs-zoned-drop-space_info-active_total_bytes.patch b/patches.kernel.org/6.2.10-012-btrfs-zoned-drop-space_info-active_total_bytes.patch new file mode 100644 index 0000000..a5bd008 --- /dev/null +++ b/patches.kernel.org/6.2.10-012-btrfs-zoned-drop-space_info-active_total_bytes.patch @@ -0,0 +1,193 @@ +From: Naohiro Aota +Date: Mon, 13 Mar 2023 16:06:14 +0900 +Subject: [PATCH] btrfs: zoned: drop space_info->active_total_bytes +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: e15acc25880cf048dba9df94d76ed7e7e10040e6 + +[ Upstream commit e15acc25880cf048dba9df94d76ed7e7e10040e6 ] + +The space_info->active_total_bytes is no longer necessary as we now +count the region of newly allocated block group as zone_unusable. Drop +its usage. + +Fixes: 6a921de58992 ("btrfs: zoned: introduce space_info->active_total_bytes") +CC: stable@vger.kernel.org # 6.1+ +Signed-off-by: Naohiro Aota +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/btrfs/block-group.c | 6 ------ + fs/btrfs/space-info.c | 40 +++++++++------------------------------- + fs/btrfs/space-info.h | 2 -- + fs/btrfs/zoned.c | 4 ---- + 4 files changed, 9 insertions(+), 43 deletions(-) + +diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c +index d628d545..8eb62531 100644 +--- a/fs/btrfs/block-group.c ++++ b/fs/btrfs/block-group.c +@@ -1036,14 +1036,8 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans, + < block_group->zone_unusable); + WARN_ON(block_group->space_info->disk_total + < block_group->length * factor); +- WARN_ON(test_bit(BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE, +- &block_group->runtime_flags) && +- block_group->space_info->active_total_bytes +- < block_group->length); + } + block_group->space_info->total_bytes -= block_group->length; +- if (test_bit(BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE, &block_group->runtime_flags)) +- block_group->space_info->active_total_bytes -= block_group->length; + block_group->space_info->bytes_readonly -= + (block_group->length - block_group->zone_unusable); + block_group->space_info->bytes_zone_unusable -= +diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c +index 2237685d..3eecce86 100644 +--- a/fs/btrfs/space-info.c ++++ b/fs/btrfs/space-info.c +@@ -308,8 +308,6 @@ void btrfs_add_bg_to_space_info(struct btrfs_fs_info *info, + ASSERT(found); + spin_lock(&found->lock); + found->total_bytes += block_group->length; +- if (test_bit(BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE, &block_group->runtime_flags)) +- found->active_total_bytes += block_group->length; + found->disk_total += block_group->length * factor; + found->bytes_used += block_group->used; + found->disk_used += block_group->used * factor; +@@ -379,22 +377,6 @@ static u64 calc_available_free_space(struct btrfs_fs_info *fs_info, + return avail; + } + +-static inline u64 writable_total_bytes(struct btrfs_fs_info *fs_info, +- struct btrfs_space_info *space_info) +-{ +- /* +- * On regular filesystem, all total_bytes are always writable. On zoned +- * filesystem, there may be a limitation imposed by max_active_zones. +- * For metadata allocation, we cannot finish an existing active block +- * group to avoid a deadlock. Thus, we need to consider only the active +- * groups to be writable for metadata space. +- */ +- if (!btrfs_is_zoned(fs_info) || (space_info->flags & BTRFS_BLOCK_GROUP_DATA)) +- return space_info->total_bytes; +- +- return space_info->active_total_bytes; +-} +- + int btrfs_can_overcommit(struct btrfs_fs_info *fs_info, + struct btrfs_space_info *space_info, u64 bytes, + enum btrfs_reserve_flush_enum flush) +@@ -413,7 +395,7 @@ int btrfs_can_overcommit(struct btrfs_fs_info *fs_info, + else + avail = calc_available_free_space(fs_info, space_info, flush); + +- if (used + bytes < writable_total_bytes(fs_info, space_info) + avail) ++ if (used + bytes < space_info->total_bytes + avail) + return 1; + return 0; + } +@@ -449,7 +431,7 @@ void btrfs_try_granting_tickets(struct btrfs_fs_info *fs_info, + ticket = list_first_entry(head, struct reserve_ticket, list); + + /* Check and see if our ticket can be satisfied now. */ +- if ((used + ticket->bytes <= writable_total_bytes(fs_info, space_info)) || ++ if ((used + ticket->bytes <= space_info->total_bytes) || + btrfs_can_overcommit(fs_info, space_info, ticket->bytes, + flush)) { + btrfs_space_info_update_bytes_may_use(fs_info, +@@ -829,7 +811,6 @@ btrfs_calc_reclaim_metadata_size(struct btrfs_fs_info *fs_info, + { + u64 used; + u64 avail; +- u64 total; + u64 to_reclaim = space_info->reclaim_size; + + lockdep_assert_held(&space_info->lock); +@@ -844,9 +825,8 @@ btrfs_calc_reclaim_metadata_size(struct btrfs_fs_info *fs_info, + * space. If that's the case add in our overage so we make sure to put + * appropriate pressure on the flushing state machine. + */ +- total = writable_total_bytes(fs_info, space_info); +- if (total + avail < used) +- to_reclaim += used - (total + avail); ++ if (space_info->total_bytes + avail < used) ++ to_reclaim += used - (space_info->total_bytes + avail); + + return to_reclaim; + } +@@ -856,11 +836,10 @@ static bool need_preemptive_reclaim(struct btrfs_fs_info *fs_info, + { + u64 global_rsv_size = fs_info->global_block_rsv.reserved; + u64 ordered, delalloc; +- u64 total = writable_total_bytes(fs_info, space_info); + u64 thresh; + u64 used; + +- thresh = mult_perc(total, 90); ++ thresh = mult_perc(space_info->total_bytes, 90); + + lockdep_assert_held(&space_info->lock); + +@@ -923,8 +902,8 @@ static bool need_preemptive_reclaim(struct btrfs_fs_info *fs_info, + BTRFS_RESERVE_FLUSH_ALL); + used = space_info->bytes_used + space_info->bytes_reserved + + space_info->bytes_readonly + global_rsv_size; +- if (used < total) +- thresh += total - used; ++ if (used < space_info->total_bytes) ++ thresh += space_info->total_bytes - used; + thresh >>= space_info->clamp; + + used = space_info->bytes_pinned; +@@ -1651,7 +1630,7 @@ static int __reserve_bytes(struct btrfs_fs_info *fs_info, + * can_overcommit() to ensure we can overcommit to continue. + */ + if (!pending_tickets && +- ((used + orig_bytes <= writable_total_bytes(fs_info, space_info)) || ++ ((used + orig_bytes <= space_info->total_bytes) || + btrfs_can_overcommit(fs_info, space_info, orig_bytes, flush))) { + btrfs_space_info_update_bytes_may_use(fs_info, space_info, + orig_bytes); +@@ -1665,8 +1644,7 @@ static int __reserve_bytes(struct btrfs_fs_info *fs_info, + */ + if (ret && unlikely(flush == BTRFS_RESERVE_FLUSH_EMERGENCY)) { + used = btrfs_space_info_used(space_info, false); +- if (used + orig_bytes <= +- writable_total_bytes(fs_info, space_info)) { ++ if (used + orig_bytes <= space_info->total_bytes) { + btrfs_space_info_update_bytes_may_use(fs_info, space_info, + orig_bytes); + ret = 0; +diff --git a/fs/btrfs/space-info.h b/fs/btrfs/space-info.h +index fc99ea2b..2033b71b 100644 +--- a/fs/btrfs/space-info.h ++++ b/fs/btrfs/space-info.h +@@ -96,8 +96,6 @@ struct btrfs_space_info { + u64 bytes_may_use; /* number of bytes that may be used for + delalloc/allocations */ + u64 bytes_readonly; /* total bytes that are read only */ +- /* Total bytes in the space, but only accounts active block groups. */ +- u64 active_total_bytes; + u64 bytes_zone_unusable; /* total bytes that are unusable until + resetting the device zone */ + +diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c +index c3c763cc..ce5ebba7 100644 +--- a/fs/btrfs/zoned.c ++++ b/fs/btrfs/zoned.c +@@ -2330,10 +2330,6 @@ int btrfs_zoned_activate_one_bg(struct btrfs_fs_info *fs_info, + if (!btrfs_is_zoned(fs_info) || (space_info->flags & BTRFS_BLOCK_GROUP_DATA)) + return 0; + +- /* No more block groups to activate */ +- if (space_info->active_total_bytes == space_info->total_bytes) +- return 0; +- + for (;;) { + int ret; + bool need_finish = false; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-013-fsverity-don-t-drop-pagecache-at-end-of-FS_IOC.patch b/patches.kernel.org/6.2.10-013-fsverity-don-t-drop-pagecache-at-end-of-FS_IOC.patch new file mode 100644 index 0000000..5933a86 --- /dev/null +++ b/patches.kernel.org/6.2.10-013-fsverity-don-t-drop-pagecache-at-end-of-FS_IOC.patch @@ -0,0 +1,74 @@ +From: Eric Biggers +Date: Tue, 14 Mar 2023 16:31:32 -0700 +Subject: [PATCH] fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: a075bacde257f755bea0e53400c9f1cdd1b8e8e6 + +[ Upstream commit a075bacde257f755bea0e53400c9f1cdd1b8e8e6 ] + +The full pagecache drop at the end of FS_IOC_ENABLE_VERITY is causing +performance problems and is hindering adoption of fsverity. It was +intended to solve a race condition where unverified pages might be left +in the pagecache. But actually it doesn't solve it fully. + +Since the incomplete solution for this race condition has too much +performance impact for it to be worth it, let's remove it for now. + +Fixes: 3fda4c617e84 ("fs-verity: implement FS_IOC_ENABLE_VERITY ioctl") +Cc: stable@vger.kernel.org +Reviewed-by: Victor Hsieh +Link: https://lore.kernel.org/r/20230314235332.50270-1-ebiggers@kernel.org +Signed-off-by: Eric Biggers +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/verity/enable.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/fs/verity/enable.c b/fs/verity/enable.c +index df6b499b..400c264b 100644 +--- a/fs/verity/enable.c ++++ b/fs/verity/enable.c +@@ -390,25 +390,27 @@ int fsverity_ioctl_enable(struct file *filp, const void __user *uarg) + goto out_drop_write; + + err = enable_verity(filp, &arg); +- if (err) +- goto out_allow_write_access; + + /* +- * Some pages of the file may have been evicted from pagecache after +- * being used in the Merkle tree construction, then read into pagecache +- * again by another process reading from the file concurrently. Since +- * these pages didn't undergo verification against the file digest which +- * fs-verity now claims to be enforcing, we have to wipe the pagecache +- * to ensure that all future reads are verified. ++ * We no longer drop the inode's pagecache after enabling verity. This ++ * used to be done to try to avoid a race condition where pages could be ++ * evicted after being used in the Merkle tree construction, then ++ * re-instantiated by a concurrent read. Such pages are unverified, and ++ * the backing storage could have filled them with different content, so ++ * they shouldn't be used to fulfill reads once verity is enabled. ++ * ++ * But, dropping the pagecache has a big performance impact, and it ++ * doesn't fully solve the race condition anyway. So for those reasons, ++ * and also because this race condition isn't very important relatively ++ * speaking (especially for small-ish files, where the chance of a page ++ * being used, evicted, *and* re-instantiated all while enabling verity ++ * is quite small), we no longer drop the inode's pagecache. + */ +- filemap_write_and_wait(inode->i_mapping); +- invalidate_inode_pages2(inode->i_mapping); + + /* + * allow_write_access() is needed to pair with deny_write_access(). + * Regardless, the filesystem won't allow writing to verity files. + */ +-out_allow_write_access: + allow_write_access(filp); + out_drop_write: + mnt_drop_write_file(filp); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-014-cifs-fix-missing-unload_nls-in-smb2_reconnect.patch b/patches.kernel.org/6.2.10-014-cifs-fix-missing-unload_nls-in-smb2_reconnect.patch new file mode 100644 index 0000000..e8b55cf --- /dev/null +++ b/patches.kernel.org/6.2.10-014-cifs-fix-missing-unload_nls-in-smb2_reconnect.patch @@ -0,0 +1,55 @@ +From: Paulo Alcantara +Date: Fri, 24 Mar 2023 16:05:19 -0300 +Subject: [PATCH] cifs: fix missing unload_nls() in smb2_reconnect() +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: c24bb1a87dc3f2d77d410eaac2c6a295961bf50e + +[ Upstream commit c24bb1a87dc3f2d77d410eaac2c6a295961bf50e ] + +Make sure to unload_nls() @nls_codepage if we no longer need it. + +Fixes: bc962159e8e3 ("cifs: avoid race conditions with parallel reconnects") +Signed-off-by: Paulo Alcantara (SUSE) +Cc: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/cifs/smb2pdu.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index f0b1ae08..b37379b6 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -144,7 +144,7 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + struct TCP_Server_Info *server) + { + int rc = 0; +- struct nls_table *nls_codepage; ++ struct nls_table *nls_codepage = NULL; + struct cifs_ses *ses; + + /* +@@ -216,8 +216,6 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + tcon->ses->chans_need_reconnect, + tcon->need_reconnect); + +- nls_codepage = load_nls_default(); +- + mutex_lock(&ses->session_mutex); + /* + * Recheck after acquire mutex. If another thread is negotiating +@@ -237,6 +235,8 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + } + spin_unlock(&server->srv_lock); + ++ nls_codepage = load_nls_default(); ++ + /* + * need to prevent multiple threads trying to simultaneously + * reconnect the same SMB session +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-015-xfrm-Zero-padding-when-dumping-algos-and-encap.patch b/patches.kernel.org/6.2.10-015-xfrm-Zero-padding-when-dumping-algos-and-encap.patch new file mode 100644 index 0000000..5dbb027 --- /dev/null +++ b/patches.kernel.org/6.2.10-015-xfrm-Zero-padding-when-dumping-algos-and-encap.patch @@ -0,0 +1,112 @@ +From: Herbert Xu +Date: Thu, 9 Feb 2023 09:09:52 +0800 +Subject: [PATCH] xfrm: Zero padding when dumping algos and encap +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 8222d5910dae08213b6d9d4bc9a7f8502855e624 + +[ Upstream commit 8222d5910dae08213b6d9d4bc9a7f8502855e624 ] + +When copying data to user-space we should ensure that only valid +data is copied over. Padding in structures may be filled with +random (possibly sensitve) data and should never be given directly +to user-space. + +This patch fixes the copying of xfrm algorithms and the encap +template in xfrm_user so that padding is zeroed. + +Reported-by: syzbot+fa5414772d5c445dac3c@syzkaller.appspotmail.com +Reported-by: Hyunwoo Kim +Signed-off-by: Herbert Xu +Reviewed-by: Sabrina Dubroca +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/xfrm/xfrm_user.c | 45 ++++++++++++++++++++++++++++++++++++++++---- + 1 file changed, 41 insertions(+), 4 deletions(-) + +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index cf5172d4..103af2b3 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -1012,7 +1012,9 @@ static int copy_to_user_aead(struct xfrm_algo_aead *aead, struct sk_buff *skb) + return -EMSGSIZE; + + ap = nla_data(nla); +- memcpy(ap, aead, sizeof(*aead)); ++ strscpy_pad(ap->alg_name, aead->alg_name, sizeof(ap->alg_name)); ++ ap->alg_key_len = aead->alg_key_len; ++ ap->alg_icv_len = aead->alg_icv_len; + + if (redact_secret && aead->alg_key_len) + memset(ap->alg_key, 0, (aead->alg_key_len + 7) / 8); +@@ -1032,7 +1034,8 @@ static int copy_to_user_ealg(struct xfrm_algo *ealg, struct sk_buff *skb) + return -EMSGSIZE; + + ap = nla_data(nla); +- memcpy(ap, ealg, sizeof(*ealg)); ++ strscpy_pad(ap->alg_name, ealg->alg_name, sizeof(ap->alg_name)); ++ ap->alg_key_len = ealg->alg_key_len; + + if (redact_secret && ealg->alg_key_len) + memset(ap->alg_key, 0, (ealg->alg_key_len + 7) / 8); +@@ -1043,6 +1046,40 @@ static int copy_to_user_ealg(struct xfrm_algo *ealg, struct sk_buff *skb) + return 0; + } + ++static int copy_to_user_calg(struct xfrm_algo *calg, struct sk_buff *skb) ++{ ++ struct nlattr *nla = nla_reserve(skb, XFRMA_ALG_COMP, sizeof(*calg)); ++ struct xfrm_algo *ap; ++ ++ if (!nla) ++ return -EMSGSIZE; ++ ++ ap = nla_data(nla); ++ strscpy_pad(ap->alg_name, calg->alg_name, sizeof(ap->alg_name)); ++ ap->alg_key_len = 0; ++ ++ return 0; ++} ++ ++static int copy_to_user_encap(struct xfrm_encap_tmpl *ep, struct sk_buff *skb) ++{ ++ struct nlattr *nla = nla_reserve(skb, XFRMA_ENCAP, sizeof(*ep)); ++ struct xfrm_encap_tmpl *uep; ++ ++ if (!nla) ++ return -EMSGSIZE; ++ ++ uep = nla_data(nla); ++ memset(uep, 0, sizeof(*uep)); ++ ++ uep->encap_type = ep->encap_type; ++ uep->encap_sport = ep->encap_sport; ++ uep->encap_dport = ep->encap_dport; ++ uep->encap_oa = ep->encap_oa; ++ ++ return 0; ++} ++ + static int xfrm_smark_put(struct sk_buff *skb, struct xfrm_mark *m) + { + int ret = 0; +@@ -1098,12 +1135,12 @@ static int copy_to_user_state_extra(struct xfrm_state *x, + goto out; + } + if (x->calg) { +- ret = nla_put(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg); ++ ret = copy_to_user_calg(x->calg, skb); + if (ret) + goto out; + } + if (x->encap) { +- ret = nla_put(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap); ++ ret = copy_to_user_encap(x->encap, skb); + if (ret) + goto out; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-016-ASoC-codecs-tx-macro-Fix-for-KASAN-slab-out-of.patch b/patches.kernel.org/6.2.10-016-ASoC-codecs-tx-macro-Fix-for-KASAN-slab-out-of.patch new file mode 100644 index 0000000..3f42d9b --- /dev/null +++ b/patches.kernel.org/6.2.10-016-ASoC-codecs-tx-macro-Fix-for-KASAN-slab-out-of.patch @@ -0,0 +1,94 @@ +From: Ravulapati Vishnu Vardhan Rao +Date: Sat, 4 Mar 2023 13:37:02 +0530 +Subject: [PATCH] ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: e5e7e398f6bb7918dab0612eb6991f7bae95520d + +[ Upstream commit e5e7e398f6bb7918dab0612eb6991f7bae95520d ] + +When we run syzkaller we get below Out of Bound. + "KASAN: slab-out-of-bounds Read in regcache_flat_read" + + Below is the backtrace of the issue: + + dump_backtrace+0x0/0x4c8 + show_stack+0x34/0x44 + dump_stack_lvl+0xd8/0x118 + print_address_description+0x30/0x2d8 + kasan_report+0x158/0x198 + __asan_report_load4_noabort+0x44/0x50 + regcache_flat_read+0x10c/0x110 + regcache_read+0xf4/0x180 + _regmap_read+0xc4/0x278 + _regmap_update_bits+0x130/0x290 + regmap_update_bits_base+0xc0/0x15c + snd_soc_component_update_bits+0xa8/0x22c + snd_soc_component_write_field+0x68/0xd4 + tx_macro_digital_mute+0xec/0x140 + + Actually There is no need to have decimator with 32 bits. + By limiting the variable with short type u8 issue is resolved. + +Signed-off-by: Ravulapati Vishnu Vardhan Rao +Link: https://lore.kernel.org/r/20230304080702.609-1-quic_visr@quicinc.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/codecs/lpass-tx-macro.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c +index 2449a2df..8facdb92 100644 +--- a/sound/soc/codecs/lpass-tx-macro.c ++++ b/sound/soc/codecs/lpass-tx-macro.c +@@ -242,7 +242,7 @@ enum { + + struct tx_mute_work { + struct tx_macro *tx; +- u32 decimator; ++ u8 decimator; + struct delayed_work dwork; + }; + +@@ -635,7 +635,7 @@ static int tx_macro_mclk_enable(struct tx_macro *tx, + return 0; + } + +-static bool is_amic_enabled(struct snd_soc_component *component, int decimator) ++static bool is_amic_enabled(struct snd_soc_component *component, u8 decimator) + { + u16 adc_mux_reg, adc_reg, adc_n; + +@@ -849,7 +849,7 @@ static int tx_macro_enable_dec(struct snd_soc_dapm_widget *w, + struct snd_kcontrol *kcontrol, int event) + { + struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm); +- unsigned int decimator; ++ u8 decimator; + u16 tx_vol_ctl_reg, dec_cfg_reg, hpf_gate_reg, tx_gain_ctl_reg; + u8 hpf_cut_off_freq; + int hpf_delay = TX_MACRO_DMIC_HPF_DELAY_MS; +@@ -1064,7 +1064,8 @@ static int tx_macro_hw_params(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) + { + struct snd_soc_component *component = dai->component; +- u32 decimator, sample_rate; ++ u32 sample_rate; ++ u8 decimator; + int tx_fs_rate; + struct tx_macro *tx = snd_soc_component_get_drvdata(component); + +@@ -1128,7 +1129,7 @@ static int tx_macro_digital_mute(struct snd_soc_dai *dai, int mute, int stream) + { + struct snd_soc_component *component = dai->component; + struct tx_macro *tx = snd_soc_component_get_drvdata(component); +- u16 decimator; ++ u8 decimator; + + /* active decimator not set yet */ + if (tx->active_decimator[dai->id] == -1) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-017-ASoC-Intel-avs-max98357a-Explicitly-define-cod.patch b/patches.kernel.org/6.2.10-017-ASoC-Intel-avs-max98357a-Explicitly-define-cod.patch new file mode 100644 index 0000000..fb5b0d4 --- /dev/null +++ b/patches.kernel.org/6.2.10-017-ASoC-Intel-avs-max98357a-Explicitly-define-cod.patch @@ -0,0 +1,76 @@ +From: =?UTF-8?q?Amadeusz=20S=C5=82awi=C5=84ski?= + +Date: Fri, 3 Mar 2023 14:48:50 +0100 +Subject: [PATCH] ASoC: Intel: avs: max98357a: Explicitly define codec format +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: d16c893425d07ada1fdd817ec06d322efcf69480 + +[ Upstream commit d16c893425d07ada1fdd817ec06d322efcf69480 ] + +max98357a is speaker codec configured in 48000/2/S16_LE format +regardless of front end format, so force it to be so. + +Reviewed-by: Cezary Rojewski +Signed-off-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20230303134854.2277146-2-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/intel/avs/boards/max98357a.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/sound/soc/intel/avs/boards/max98357a.c b/sound/soc/intel/avs/boards/max98357a.c +index 921f42ca..183123d0 100644 +--- a/sound/soc/intel/avs/boards/max98357a.c ++++ b/sound/soc/intel/avs/boards/max98357a.c +@@ -8,6 +8,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -24,6 +25,26 @@ static const struct snd_soc_dapm_route card_base_routes[] = { + { "Spk", NULL, "Speaker" }, + }; + ++static int ++avs_max98357a_be_fixup(struct snd_soc_pcm_runtime *runrime, struct snd_pcm_hw_params *params) ++{ ++ struct snd_interval *rate, *channels; ++ struct snd_mask *fmt; ++ ++ rate = hw_param_interval(params, SNDRV_PCM_HW_PARAM_RATE); ++ channels = hw_param_interval(params, SNDRV_PCM_HW_PARAM_CHANNELS); ++ fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT); ++ ++ /* The ADSP will convert the FE rate to 48k, stereo */ ++ rate->min = rate->max = 48000; ++ channels->min = channels->max = 2; ++ ++ /* set SSP0 to 16 bit */ ++ snd_mask_none(fmt); ++ snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S16_LE); ++ return 0; ++} ++ + static int avs_create_dai_link(struct device *dev, const char *platform_name, int ssp_port, + struct snd_soc_dai_link **dai_link) + { +@@ -55,6 +76,7 @@ static int avs_create_dai_link(struct device *dev, const char *platform_name, in + dl->num_platforms = 1; + dl->id = 0; + dl->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF | SND_SOC_DAIFMT_CBS_CFS; ++ dl->be_hw_params_fixup = avs_max98357a_be_fixup; + dl->nonatomic = 1; + dl->no_pcm = 1; + dl->dpcm_playback = 1; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-018-ASoC-Intel-avs-da7219-Explicitly-define-codec-.patch b/patches.kernel.org/6.2.10-018-ASoC-Intel-avs-da7219-Explicitly-define-codec-.patch new file mode 100644 index 0000000..17a697e --- /dev/null +++ b/patches.kernel.org/6.2.10-018-ASoC-Intel-avs-da7219-Explicitly-define-codec-.patch @@ -0,0 +1,68 @@ +From: =?UTF-8?q?Amadeusz=20S=C5=82awi=C5=84ski?= + +Date: Fri, 3 Mar 2023 14:48:51 +0100 +Subject: [PATCH] ASoC: Intel: avs: da7219: Explicitly define codec format +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 61f368624fe4d0c25c6e9c917574b8ace51d776e + +[ Upstream commit 61f368624fe4d0c25c6e9c917574b8ace51d776e ] + +da7219 is headset codec configured in 48000/2/S24_LE format regardless +of front end format, so force it to be so. + +Reviewed-by: Cezary Rojewski +Signed-off-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20230303134854.2277146-3-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/intel/avs/boards/da7219.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/sound/soc/intel/avs/boards/da7219.c b/sound/soc/intel/avs/boards/da7219.c +index acd43b61..1a1d572c 100644 +--- a/sound/soc/intel/avs/boards/da7219.c ++++ b/sound/soc/intel/avs/boards/da7219.c +@@ -117,6 +117,26 @@ static void avs_da7219_codec_exit(struct snd_soc_pcm_runtime *rtd) + snd_soc_component_set_jack(asoc_rtd_to_codec(rtd, 0)->component, NULL, NULL); + } + ++static int ++avs_da7219_be_fixup(struct snd_soc_pcm_runtime *runrime, struct snd_pcm_hw_params *params) ++{ ++ struct snd_interval *rate, *channels; ++ struct snd_mask *fmt; ++ ++ rate = hw_param_interval(params, SNDRV_PCM_HW_PARAM_RATE); ++ channels = hw_param_interval(params, SNDRV_PCM_HW_PARAM_CHANNELS); ++ fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT); ++ ++ /* The ADSP will convert the FE rate to 48k, stereo */ ++ rate->min = rate->max = 48000; ++ channels->min = channels->max = 2; ++ ++ /* set SSP0 to 24 bit */ ++ snd_mask_none(fmt); ++ snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S24_LE); ++ return 0; ++} ++ + static int avs_create_dai_link(struct device *dev, const char *platform_name, int ssp_port, + struct snd_soc_dai_link **dai_link) + { +@@ -148,6 +168,7 @@ static int avs_create_dai_link(struct device *dev, const char *platform_name, in + dl->num_platforms = 1; + dl->id = 0; + dl->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF | SND_SOC_DAIFMT_CBS_CFS; ++ dl->be_hw_params_fixup = avs_da7219_be_fixup; + dl->init = avs_da7219_codec_init; + dl->exit = avs_da7219_codec_exit; + dl->nonatomic = 1; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-019-ASoC-Intel-avs-rt5682-Explicitly-define-codec-.patch b/patches.kernel.org/6.2.10-019-ASoC-Intel-avs-rt5682-Explicitly-define-codec-.patch new file mode 100644 index 0000000..283ecf4 --- /dev/null +++ b/patches.kernel.org/6.2.10-019-ASoC-Intel-avs-rt5682-Explicitly-define-codec-.patch @@ -0,0 +1,69 @@ +From: =?UTF-8?q?Amadeusz=20S=C5=82awi=C5=84ski?= + +Date: Fri, 3 Mar 2023 14:48:52 +0100 +Subject: [PATCH] ASoC: Intel: avs: rt5682: Explicitly define codec format +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: d24dbc865c2bd5946bef62bb862a65df092dfc79 + +[ Upstream commit d24dbc865c2bd5946bef62bb862a65df092dfc79 ] + +rt5682 is headset codec configured in 48000/2/S24_LE format regardless +of front end format, so force it to be so. + +Reviewed-by: Cezary Rojewski +Signed-off-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20230303134854.2277146-4-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/intel/avs/boards/rt5682.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/sound/soc/intel/avs/boards/rt5682.c b/sound/soc/intel/avs/boards/rt5682.c +index 473e9fe5..b2c2ba93 100644 +--- a/sound/soc/intel/avs/boards/rt5682.c ++++ b/sound/soc/intel/avs/boards/rt5682.c +@@ -169,6 +169,27 @@ static const struct snd_soc_ops avs_rt5682_ops = { + .hw_params = avs_rt5682_hw_params, + }; + ++static int ++avs_rt5682_be_fixup(struct snd_soc_pcm_runtime *runtime, struct snd_pcm_hw_params *params) ++{ ++ struct snd_interval *rate, *channels; ++ struct snd_mask *fmt; ++ ++ rate = hw_param_interval(params, SNDRV_PCM_HW_PARAM_RATE); ++ channels = hw_param_interval(params, SNDRV_PCM_HW_PARAM_CHANNELS); ++ fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT); ++ ++ /* The ADSP will convert the FE rate to 48k, stereo */ ++ rate->min = rate->max = 48000; ++ channels->min = channels->max = 2; ++ ++ /* set SSPN to 24 bit */ ++ snd_mask_none(fmt); ++ snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S24_LE); ++ ++ return 0; ++} ++ + static int avs_create_dai_link(struct device *dev, const char *platform_name, int ssp_port, + struct snd_soc_dai_link **dai_link) + { +@@ -201,6 +222,7 @@ static int avs_create_dai_link(struct device *dev, const char *platform_name, in + dl->id = 0; + dl->init = avs_rt5682_codec_init; + dl->exit = avs_rt5682_codec_exit; ++ dl->be_hw_params_fixup = avs_rt5682_be_fixup; + dl->ops = &avs_rt5682_ops; + dl->nonatomic = 1; + dl->no_pcm = 1; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-020-ASoC-Intel-avs-ssm4567-Remove-nau8825-bits.patch b/patches.kernel.org/6.2.10-020-ASoC-Intel-avs-ssm4567-Remove-nau8825-bits.patch new file mode 100644 index 0000000..41b8936 --- /dev/null +++ b/patches.kernel.org/6.2.10-020-ASoC-Intel-avs-ssm4567-Remove-nau8825-bits.patch @@ -0,0 +1,81 @@ +From: Cezary Rojewski +Date: Fri, 3 Mar 2023 14:48:53 +0100 +Subject: [PATCH] ASoC: Intel: avs: ssm4567: Remove nau8825 bits +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 933de2d127281731166cf2880fa1e23c5a0f7faa + +[ Upstream commit 933de2d127281731166cf2880fa1e23c5a0f7faa ] + +Some of the nau8825 clock control got into the ssm4567, remove it. + +Signed-off-by: Cezary Rojewski +Signed-off-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20230303134854.2277146-5-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/intel/avs/boards/ssm4567.c | 31 ---------------------------- + 1 file changed, 31 deletions(-) + +diff --git a/sound/soc/intel/avs/boards/ssm4567.c b/sound/soc/intel/avs/boards/ssm4567.c +index c5db6961..2b7f5ad9 100644 +--- a/sound/soc/intel/avs/boards/ssm4567.c ++++ b/sound/soc/intel/avs/boards/ssm4567.c +@@ -15,7 +15,6 @@ + #include + #include "../../../codecs/nau8825.h" + +-#define SKL_NUVOTON_CODEC_DAI "nau8825-hifi" + #define SKL_SSM_CODEC_DAI "ssm4567-hifi" + + static struct snd_soc_codec_conf card_codec_conf[] = { +@@ -34,41 +33,11 @@ static const struct snd_kcontrol_new card_controls[] = { + SOC_DAPM_PIN_SWITCH("Right Speaker"), + }; + +-static int +-platform_clock_control(struct snd_soc_dapm_widget *w, struct snd_kcontrol *control, int event) +-{ +- struct snd_soc_dapm_context *dapm = w->dapm; +- struct snd_soc_card *card = dapm->card; +- struct snd_soc_dai *codec_dai; +- int ret; +- +- codec_dai = snd_soc_card_get_codec_dai(card, SKL_NUVOTON_CODEC_DAI); +- if (!codec_dai) { +- dev_err(card->dev, "Codec dai not found\n"); +- return -EINVAL; +- } +- +- if (SND_SOC_DAPM_EVENT_ON(event)) { +- ret = snd_soc_dai_set_sysclk(codec_dai, NAU8825_CLK_MCLK, 24000000, +- SND_SOC_CLOCK_IN); +- if (ret < 0) +- dev_err(card->dev, "set sysclk err = %d\n", ret); +- } else { +- ret = snd_soc_dai_set_sysclk(codec_dai, NAU8825_CLK_INTERNAL, 0, SND_SOC_CLOCK_IN); +- if (ret < 0) +- dev_err(card->dev, "set sysclk err = %d\n", ret); +- } +- +- return ret; +-} +- + static const struct snd_soc_dapm_widget card_widgets[] = { + SND_SOC_DAPM_SPK("Left Speaker", NULL), + SND_SOC_DAPM_SPK("Right Speaker", NULL), + SND_SOC_DAPM_SPK("DP1", NULL), + SND_SOC_DAPM_SPK("DP2", NULL), +- SND_SOC_DAPM_SUPPLY("Platform Clock", SND_SOC_NOPM, 0, 0, platform_clock_control, +- SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD), + }; + + static const struct snd_soc_dapm_route card_base_routes[] = { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-021-ASoC-Intel-avs-nau8825-Adjust-clock-control.patch b/patches.kernel.org/6.2.10-021-ASoC-Intel-avs-nau8825-Adjust-clock-control.patch new file mode 100644 index 0000000..77c7b35 --- /dev/null +++ b/patches.kernel.org/6.2.10-021-ASoC-Intel-avs-nau8825-Adjust-clock-control.patch @@ -0,0 +1,55 @@ +From: Cezary Rojewski +Date: Fri, 3 Mar 2023 14:48:54 +0100 +Subject: [PATCH] ASoC: Intel: avs: nau8825: Adjust clock control +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 6206b2e787da2ed567922c37bb588a44f6fb6705 + +[ Upstream commit 6206b2e787da2ed567922c37bb588a44f6fb6705 ] + +Internal clock shall be adjusted also in cases when DAPM event other +than 'ON' is triggered. + +Signed-off-by: Cezary Rojewski +Signed-off-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20230303134854.2277146-6-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/intel/avs/boards/nau8825.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/sound/soc/intel/avs/boards/nau8825.c b/sound/soc/intel/avs/boards/nau8825.c +index 6731d8a4..49438a67 100644 +--- a/sound/soc/intel/avs/boards/nau8825.c ++++ b/sound/soc/intel/avs/boards/nau8825.c +@@ -33,15 +33,15 @@ avs_nau8825_clock_control(struct snd_soc_dapm_widget *w, struct snd_kcontrol *co + return -EINVAL; + } + +- if (!SND_SOC_DAPM_EVENT_ON(event)) { ++ if (SND_SOC_DAPM_EVENT_ON(event)) ++ ret = snd_soc_dai_set_sysclk(codec_dai, NAU8825_CLK_MCLK, 24000000, ++ SND_SOC_CLOCK_IN); ++ else + ret = snd_soc_dai_set_sysclk(codec_dai, NAU8825_CLK_INTERNAL, 0, SND_SOC_CLOCK_IN); +- if (ret < 0) { +- dev_err(card->dev, "set sysclk err = %d\n", ret); +- return ret; +- } +- } ++ if (ret < 0) ++ dev_err(card->dev, "Set sysclk failed: %d\n", ret); + +- return 0; ++ return ret; + } + + static const struct snd_kcontrol_new card_controls[] = { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-022-lib-zstd-Backport-fix-for-in-place-decompressi.patch b/patches.kernel.org/6.2.10-022-lib-zstd-Backport-fix-for-in-place-decompressi.patch new file mode 100644 index 0000000..9e27f45 --- /dev/null +++ b/patches.kernel.org/6.2.10-022-lib-zstd-Backport-fix-for-in-place-decompressi.patch @@ -0,0 +1,119 @@ +From: Nick Terrell +Date: Wed, 15 Feb 2023 15:19:17 -0800 +Subject: [PATCH] lib: zstd: Backport fix for in-place decompression +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 038505c41f0aad26ef101f4f7f6e111531c3914f + +[ Upstream commit 038505c41f0aad26ef101f4f7f6e111531c3914f ] + +Backport the relevant part of upstream commit 5b266196 [0]. + +This fixes in-place decompression for x86-64 kernel decompression. It +uses a bound of 131072 + (uncompressed_size >> 8), which can be violated +after upstream commit 6a7ede3d [1], as zstd can use part of the output +buffer as temporary storage, and without this patch needs a bound of +~262144. + +The fix is for zstd to detect that the input and output buffers overlap, +so that zstd knows it can't use the overlapping portion of the output +buffer as tempoary storage. If the margin is not large enough, this will +ensure that zstd will fail the decompression, rather than overwriting +part of the input data, and causing corruption. + +This fix has been landed upstream and is in release v1.5.4. That commit +also adds unit and fuzz tests to verify that the margin we use is +respected, and correct. That means that the fix is well tested upstream. + +I have not been able to reproduce the potential bug in x86-64 kernel +decompression locally, nor have I recieved reports of failures to +decompress the kernel. It is possible that compression saves enough +space to make it very hard for the issue to appear. + +I've boot tested the zstd compressed kernel on x86-64 and i386 with this +patch, which uses in-place decompression, and sanity tested zstd compression +in btrfs / squashfs to make sure that we don't see any issues, but other +uses of zstd shouldn't be affected, because they don't use in-place +decompression. + +Thanks to Vasily Gorbik for debugging a related issue +on s390, which was triggered by the same commit, but was a bug in how +__decompress() was called [2]. And to Sasha Levin +for the CC alerting me of the issue. + +[0] https://github.com/facebook/zstd/commit/5b266196a41e6a15e21bd4f0eeab43b938db1d90 +[1] https://github.com/facebook/zstd/commit/6a7ede3dfccbf3e0a5928b4224a039c260dcff72 +[2] https://lore.kernel.org/r/patch-1.thread-41c676.git-41c676c2d153.your-ad-here.call-01675030179-ext-9637@work.hours + +CC: Vasily Gorbik +CC: Heiko Carstens +CC: Sasha Levin +CC: Yann Collet +Signed-off-by: Nick Terrell +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + lib/zstd/decompress/zstd_decompress.c | 25 ++++++++++++++++++++++--- + 1 file changed, 22 insertions(+), 3 deletions(-) + +diff --git a/lib/zstd/decompress/zstd_decompress.c b/lib/zstd/decompress/zstd_decompress.c +index b9b935a9..6b3177c9 100644 +--- a/lib/zstd/decompress/zstd_decompress.c ++++ b/lib/zstd/decompress/zstd_decompress.c +@@ -798,7 +798,7 @@ static size_t ZSTD_copyRawBlock(void* dst, size_t dstCapacity, + if (srcSize == 0) return 0; + RETURN_ERROR(dstBuffer_null, ""); + } +- ZSTD_memcpy(dst, src, srcSize); ++ ZSTD_memmove(dst, src, srcSize); + return srcSize; + } + +@@ -858,6 +858,7 @@ static size_t ZSTD_decompressFrame(ZSTD_DCtx* dctx, + + /* Loop on each block */ + while (1) { ++ BYTE* oBlockEnd = oend; + size_t decodedSize; + blockProperties_t blockProperties; + size_t const cBlockSize = ZSTD_getcBlockSize(ip, remainingSrcSize, &blockProperties); +@@ -867,16 +868,34 @@ static size_t ZSTD_decompressFrame(ZSTD_DCtx* dctx, + remainingSrcSize -= ZSTD_blockHeaderSize; + RETURN_ERROR_IF(cBlockSize > remainingSrcSize, srcSize_wrong, ""); + ++ if (ip >= op && ip < oBlockEnd) { ++ /* We are decompressing in-place. Limit the output pointer so that we ++ * don't overwrite the block that we are currently reading. This will ++ * fail decompression if the input & output pointers aren't spaced ++ * far enough apart. ++ * ++ * This is important to set, even when the pointers are far enough ++ * apart, because ZSTD_decompressBlock_internal() can decide to store ++ * literals in the output buffer, after the block it is decompressing. ++ * Since we don't want anything to overwrite our input, we have to tell ++ * ZSTD_decompressBlock_internal to never write past ip. ++ * ++ * See ZSTD_allocateLiteralsBuffer() for reference. ++ */ ++ oBlockEnd = op + (ip - op); ++ } ++ + switch(blockProperties.blockType) + { + case bt_compressed: +- decodedSize = ZSTD_decompressBlock_internal(dctx, op, (size_t)(oend-op), ip, cBlockSize, /* frame */ 1, not_streaming); ++ decodedSize = ZSTD_decompressBlock_internal(dctx, op, (size_t)(oBlockEnd-op), ip, cBlockSize, /* frame */ 1, not_streaming); + break; + case bt_raw : ++ /* Use oend instead of oBlockEnd because this function is safe to overlap. It uses memmove. */ + decodedSize = ZSTD_copyRawBlock(op, (size_t)(oend-op), ip, cBlockSize); + break; + case bt_rle : +- decodedSize = ZSTD_setRleBlock(op, (size_t)(oend-op), *ip, blockProperties.origSize); ++ decodedSize = ZSTD_setRleBlock(op, (size_t)(oBlockEnd-op), *ip, blockProperties.origSize); + break; + case bt_reserved : + default: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-023-zstd-Fix-definition-of-assert.patch b/patches.kernel.org/6.2.10-023-zstd-Fix-definition-of-assert.patch new file mode 100644 index 0000000..9c448fc --- /dev/null +++ b/patches.kernel.org/6.2.10-023-zstd-Fix-definition-of-assert.patch @@ -0,0 +1,40 @@ +From: =?UTF-8?q?Jonathan=20Neusch=C3=A4fer?= +Date: Sun, 29 Jan 2023 14:14:36 +0100 +Subject: [PATCH] zstd: Fix definition of assert() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 6906598f1ce93761716d780b6e3f171e13f0f4ce + +[ Upstream commit 6906598f1ce93761716d780b6e3f171e13f0f4ce ] + +assert(x) should emit a warning if x is false. WARN_ON(x) emits a +warning if x is true. Thus, assert(x) should be defined as WARN_ON(!x) +rather than WARN_ON(x). + +Signed-off-by: Jonathan Neuschäfer +Signed-off-by: Nick Terrell +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + lib/zstd/common/zstd_deps.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/zstd/common/zstd_deps.h b/lib/zstd/common/zstd_deps.h +index 7a5bf448..f06df065 100644 +--- a/lib/zstd/common/zstd_deps.h ++++ b/lib/zstd/common/zstd_deps.h +@@ -84,7 +84,7 @@ static uint64_t ZSTD_div64(uint64_t dividend, uint32_t divisor) { + + #include + +-#define assert(x) WARN_ON((x)) ++#define assert(x) WARN_ON(!(x)) + + #endif /* ZSTD_DEPS_ASSERT */ + #endif /* ZSTD_DEPS_NEED_ASSERT */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-024-ACPI-video-Add-backlight-native-DMI-quirk-for-.patch b/patches.kernel.org/6.2.10-024-ACPI-video-Add-backlight-native-DMI-quirk-for-.patch new file mode 100644 index 0000000..7a37274 --- /dev/null +++ b/patches.kernel.org/6.2.10-024-ACPI-video-Add-backlight-native-DMI-quirk-for-.patch @@ -0,0 +1,43 @@ +From: "Chia-Lin Kao (AceLan)" +Date: Thu, 2 Mar 2023 17:33:00 +0800 +Subject: [PATCH] ACPI: video: Add backlight=native DMI quirk for Dell Vostro + 15 3535 +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 89b0411481967a2e8c91190a211a359966cfcf4b + +[ Upstream commit 89b0411481967a2e8c91190a211a359966cfcf4b ] + +Sometimes the system boots up with a acpi_video0 backlight interface +which doesn't work. So add Dell Vostro 15 3535 into the +video_detect_dmi_table to set it to native explicitly. + +Signed-off-by: Chia-Lin Kao (AceLan) +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/acpi/video_detect.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c +index 710ac640..14d6d81e 100644 +--- a/drivers/acpi/video_detect.c ++++ b/drivers/acpi/video_detect.c +@@ -716,6 +716,13 @@ static const struct dmi_system_id video_detect_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Dell G15 5515"), + }, + }, ++ { ++ .callback = video_detect_force_native, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 15 3535"), ++ }, ++ }, + + /* + * Desktops which falsely report a backlight and which our heuristics +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-025-ACPI-x86-Introduce-an-acpi_quirk_skip_gpio_eve.patch b/patches.kernel.org/6.2.10-025-ACPI-x86-Introduce-an-acpi_quirk_skip_gpio_eve.patch new file mode 100644 index 0000000..82d1fa3 --- /dev/null +++ b/patches.kernel.org/6.2.10-025-ACPI-x86-Introduce-an-acpi_quirk_skip_gpio_eve.patch @@ -0,0 +1,153 @@ +From: Hans de Goede +Date: Wed, 1 Mar 2023 11:04:34 +0100 +Subject: [PATCH] ACPI: x86: Introduce an acpi_quirk_skip_gpio_event_handlers() + helper +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 5adc409340b1fc82bc1175e602d14ac82ac685e3 + +[ Upstream commit 5adc409340b1fc82bc1175e602d14ac82ac685e3 ] + +x86 ACPI boards which ship with only Android as their factory image usually +have pretty broken ACPI tables, relying on everything being hardcoded in +the factory kernel image and often disabling parts of the ACPI enumeration +kernel code to avoid the broken tables causing issues. + +Part of this broken ACPI code is that sometimes these boards have _AEI +ACPI GPIO event handlers which are broken. + +So far this has been dealt with in the platform/x86/x86-android-tablets.c +module, which contains various workarounds for these devices, by it calling +acpi_gpiochip_free_interrupts() on gpiochip-s with troublesome handlers to +disable the handlers. + +But in some cases this is too late, if the handlers are of the edge type +then gpiolib-acpi.c's code will already have run them at boot. +This can cause issues such as GPIOs ending up as owned by "ACPI:OpRegion", +making them unavailable for drivers which actually need them. + +Boards with these broken ACPI tables are already listed in +drivers/acpi/x86/utils.c for e.g. acpi_quirk_skip_i2c_client_enumeration(). +Extend the quirks mechanism for a new acpi_quirk_skip_gpio_event_handlers() +helper, this re-uses the DMI-ids rather then having to duplicate the same +DMI table in gpiolib-acpi.c . + +Also add the new ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS quirk to existing +boards with troublesome ACPI gpio event handlers, so that the current +acpi_gpiochip_free_interrupts() hack can be removed from +x86-android-tablets.c . + +Signed-off-by: Hans de Goede +Acked-by: Andy Shevchenko +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/acpi/x86/utils.c | 24 +++++++++++++++++++++--- + drivers/gpio/gpiolib-acpi.c | 3 +++ + include/acpi/acpi_bus.h | 5 +++++ + 3 files changed, 29 insertions(+), 3 deletions(-) + +diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c +index e45285d4..4bf57cce 100644 +--- a/drivers/acpi/x86/utils.c ++++ b/drivers/acpi/x86/utils.c +@@ -251,6 +251,7 @@ bool force_storage_d3(void) + #define ACPI_QUIRK_UART1_TTY_UART2_SKIP BIT(1) + #define ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY BIT(2) + #define ACPI_QUIRK_USE_ACPI_AC_AND_BATTERY BIT(3) ++#define ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS BIT(4) + + static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { + /* +@@ -286,7 +287,8 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { + }, + .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | + ACPI_QUIRK_UART1_TTY_UART2_SKIP | +- ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY), ++ ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | ++ ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), + }, + { + .matches = { +@@ -294,7 +296,8 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "TF103C"), + }, + .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | +- ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY), ++ ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | ++ ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), + }, + { + /* Lenovo Yoga Tablet 2 1050F/L */ +@@ -336,7 +339,8 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "M890BAP"), + }, + .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | +- ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY), ++ ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | ++ ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), + }, + { + /* Whitelabel (sold as various brands) TM800A550L */ +@@ -413,6 +417,20 @@ int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *s + return 0; + } + EXPORT_SYMBOL_GPL(acpi_quirk_skip_serdev_enumeration); ++ ++bool acpi_quirk_skip_gpio_event_handlers(void) ++{ ++ const struct dmi_system_id *dmi_id; ++ long quirks; ++ ++ dmi_id = dmi_first_match(acpi_quirk_skip_dmi_ids); ++ if (!dmi_id) ++ return false; ++ ++ quirks = (unsigned long)dmi_id->driver_data; ++ return (quirks & ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS); ++} ++EXPORT_SYMBOL_GPL(acpi_quirk_skip_gpio_event_handlers); + #endif + + /* Lists of PMIC ACPI HIDs with an (often better) native charger driver */ +diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c +index 34ff048e..7c917561 100644 +--- a/drivers/gpio/gpiolib-acpi.c ++++ b/drivers/gpio/gpiolib-acpi.c +@@ -536,6 +536,9 @@ void acpi_gpiochip_request_interrupts(struct gpio_chip *chip) + if (ACPI_FAILURE(status)) + return; + ++ if (acpi_quirk_skip_gpio_event_handlers()) ++ return; ++ + acpi_walk_resources(handle, METHOD_NAME__AEI, + acpi_gpiochip_alloc_event, acpi_gpio); + +diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h +index 0584e9f6..57acb895 100644 +--- a/include/acpi/acpi_bus.h ++++ b/include/acpi/acpi_bus.h +@@ -657,6 +657,7 @@ static inline bool acpi_quirk_skip_acpi_ac_and_battery(void) + #if IS_ENABLED(CONFIG_X86_ANDROID_TABLETS) + bool acpi_quirk_skip_i2c_client_enumeration(struct acpi_device *adev); + int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *skip); ++bool acpi_quirk_skip_gpio_event_handlers(void); + #else + static inline bool acpi_quirk_skip_i2c_client_enumeration(struct acpi_device *adev) + { +@@ -668,6 +669,10 @@ acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *skip) + *skip = false; + return 0; + } ++static inline bool acpi_quirk_skip_gpio_event_handlers(void) ++{ ++ return false; ++} + #endif + + #ifdef CONFIG_PM +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-026-ACPI-x86-Add-skip-i2c-clients-quirk-for-Acer-I.patch b/patches.kernel.org/6.2.10-026-ACPI-x86-Add-skip-i2c-clients-quirk-for-Acer-I.patch new file mode 100644 index 0000000..2e80026 --- /dev/null +++ b/patches.kernel.org/6.2.10-026-ACPI-x86-Add-skip-i2c-clients-quirk-for-Acer-I.patch @@ -0,0 +1,53 @@ +From: Hans de Goede +Date: Wed, 1 Mar 2023 11:04:35 +0100 +Subject: [PATCH] ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 7 + B1-750 +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: a5cb0695c5f0ac2ab0cedf2c1c0d75826cb73448 + +[ Upstream commit a5cb0695c5f0ac2ab0cedf2c1c0d75826cb73448 ] + +The Acer Iconia One 7 B1-750 is a x86 tablet which ships with Android x86 +as factory OS. The Android x86 kernel fork ignores I2C devices described +in the DSDT, except for the PMIC and Audio codecs. + +As usual the Acer Iconia One 7 B1-750's DSDT contains a bunch of extra I2C +devices which are not actually there, causing various resource conflicts. +Add an ACPI_QUIRK_SKIP_I2C_CLIENTS quirk for the Acer Iconia One 7 B1-750 +to the acpi_quirk_skip_dmi_ids table to woraround this. + +The DSDT also contains broken ACPI GPIO event handlers, disable those too. + +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/acpi/x86/utils.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c +index 4bf57cce..b2b0e270 100644 +--- a/drivers/acpi/x86/utils.c ++++ b/drivers/acpi/x86/utils.c +@@ -280,6 +280,16 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { + * need the x86-android-tablets module to properly work. + */ + #if IS_ENABLED(CONFIG_X86_ANDROID_TABLETS) ++ { ++ /* Acer Iconia One 7 B1-750 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Insyde"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "VESPA2"), ++ }, ++ .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | ++ ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | ++ ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), ++ }, + { + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-027-ACPI-x86-Add-skip-i2c-clients-quirk-for-Lenovo.patch b/patches.kernel.org/6.2.10-027-ACPI-x86-Add-skip-i2c-clients-quirk-for-Lenovo.patch new file mode 100644 index 0000000..9af23ce --- /dev/null +++ b/patches.kernel.org/6.2.10-027-ACPI-x86-Add-skip-i2c-clients-quirk-for-Lenovo.patch @@ -0,0 +1,54 @@ +From: Hans de Goede +Date: Wed, 1 Mar 2023 11:04:36 +0100 +Subject: [PATCH] ACPI: x86: Add skip i2c clients quirk for Lenovo Yoga Book + X90 +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 1a1e7540cf501dd5c8b57a577a155cdd13c7e202 + +[ Upstream commit 1a1e7540cf501dd5c8b57a577a155cdd13c7e202 ] + +The Lenovo Yoga Book X90 is a x86 tablet which ships with Android x86 +as factory OS. The Android x86 kernel fork ignores I2C devices described +in the DSDT, except for the PMIC and Audio codecs. + +As usual the Lenovo Yoga Book X90's DSDT contains a bunch of extra I2C +devices which are not actually there, causing various resource conflicts. +Add an ACPI_QUIRK_SKIP_I2C_CLIENTS quirk for the Lenovo Yoga Book X90 +to the acpi_quirk_skip_dmi_ids table to woraround this. + +The DSDT also contains broken ACPI GPIO event handlers, disable those too. + +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/acpi/x86/utils.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c +index b2b0e270..da572706 100644 +--- a/drivers/acpi/x86/utils.c ++++ b/drivers/acpi/x86/utils.c +@@ -300,6 +300,17 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { + ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | + ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), + }, ++ { ++ /* Lenovo Yoga Book X90F/L */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "YETI-11"), ++ }, ++ .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | ++ ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | ++ ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), ++ }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-028-ASoC-SOF-ipc3-Check-for-upper-size-limit-for-t.patch b/patches.kernel.org/6.2.10-028-ASoC-SOF-ipc3-Check-for-upper-size-limit-for-t.patch new file mode 100644 index 0000000..abee747 --- /dev/null +++ b/patches.kernel.org/6.2.10-028-ASoC-SOF-ipc3-Check-for-upper-size-limit-for-t.patch @@ -0,0 +1,47 @@ +From: Peter Ujfalusi +Date: Tue, 7 Mar 2023 13:49:17 +0200 +Subject: [PATCH] ASoC: SOF: ipc3: Check for upper size limit for the received + message +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 989a3e4479177d0f4afab8be1960731bc0ffbbd0 + +[ Upstream commit 989a3e4479177d0f4afab8be1960731bc0ffbbd0 ] + +The sof_ipc3_rx_msg() checks for minimum size of a new rx message but it is +missing the check for upper limit. +Corrupted or compromised firmware might be able to take advantage of this +to cause out of bounds reads outside of the message area. + +Reported-by: Curtis Malainey +Signed-off-by: Peter Ujfalusi +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Curtis Malainey +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20230307114917.5124-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/sof/ipc3.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sof/ipc3.c b/sound/soc/sof/ipc3.c +index 1fef4dcc..fde8af5a 100644 +--- a/sound/soc/sof/ipc3.c ++++ b/sound/soc/sof/ipc3.c +@@ -970,8 +970,9 @@ static void sof_ipc3_rx_msg(struct snd_sof_dev *sdev) + return; + } + +- if (hdr.size < sizeof(hdr)) { +- dev_err(sdev->dev, "The received message size is invalid\n"); ++ if (hdr.size < sizeof(hdr) || hdr.size > SOF_IPC_MSG_MAX_SIZE) { ++ dev_err(sdev->dev, "The received message size is invalid: %u\n", ++ hdr.size); + return; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-029-ASoC-SOF-ipc4-topology-Fix-incorrect-sample-ra.patch b/patches.kernel.org/6.2.10-029-ASoC-SOF-ipc4-topology-Fix-incorrect-sample-ra.patch new file mode 100644 index 0000000..a526c9e --- /dev/null +++ b/patches.kernel.org/6.2.10-029-ASoC-SOF-ipc4-topology-Fix-incorrect-sample-ra.patch @@ -0,0 +1,41 @@ +From: Seppo Ingalsuo +Date: Tue, 7 Mar 2023 13:07:51 +0200 +Subject: [PATCH] ASoC: SOF: ipc4-topology: Fix incorrect sample rate print + unit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 9e269e3aa9006440de639597079ee7140ef5b5f3 + +[ Upstream commit 9e269e3aa9006440de639597079ee7140ef5b5f3 ] + +This patch fixes the sample rate print unit from KHz to Hz. +E.g. 48000KHz becomes 48000Hz. + +Signed-off-by: Seppo Ingalsuo +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Ranjani Sridharan +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20230307110751.2053-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/sof/ipc4-topology.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c +index 59f4d42f..65da1cf7 100644 +--- a/sound/soc/sof/ipc4-topology.c ++++ b/sound/soc/sof/ipc4-topology.c +@@ -155,7 +155,7 @@ static void sof_ipc4_dbg_audio_format(struct device *dev, + for (i = 0; i < num_format; i++, ptr = (u8 *)ptr + object_size) { + fmt = ptr; + dev_dbg(dev, +- " #%d: %uKHz, %ubit (ch_map %#x ch_cfg %u interleaving_style %u fmt_cfg %#x)\n", ++ " #%d: %uHz, %ubit (ch_map %#x ch_cfg %u interleaving_style %u fmt_cfg %#x)\n", + i, fmt->sampling_frequency, fmt->bit_depth, fmt->ch_map, + fmt->ch_cfg, fmt->interleaving_style, fmt->fmt_cfg); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-030-ASoC-SOF-Intel-pci-tng-revert-invalid-bar-size.patch b/patches.kernel.org/6.2.10-030-ASoC-SOF-Intel-pci-tng-revert-invalid-bar-size.patch new file mode 100644 index 0000000..ac08030 --- /dev/null +++ b/patches.kernel.org/6.2.10-030-ASoC-SOF-Intel-pci-tng-revert-invalid-bar-size.patch @@ -0,0 +1,61 @@ +From: Pierre-Louis Bossart +Date: Tue, 7 Mar 2023 11:53:41 +0200 +Subject: [PATCH] ASoC: SOF: Intel: pci-tng: revert invalid bar size setting +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: ca09e2a351fbc7836ba9418304ff0c3e72addfe0 + +[ Upstream commit ca09e2a351fbc7836ba9418304ff0c3e72addfe0 ] + +The logic for the ioremap is to find the resource index 3 (IRAM) and +infer the BAR address by subtracting the IRAM offset. The BAR size +defined in hardware specifications is 2MB. + +The commit 5947b2726beb6 ("ASoC: SOF: Intel: Check the bar size before +remapping") tried to find the BAR size by querying the resource length +instead of a pre-canned value, but by requesting the size for index 3 +it only gets the size of the IRAM. That's obviously wrong and prevents +the probe from proceeding. + +This commit attempted to fix an issue in a fuzzing/simulated +environment but created another on actual devices, so the best course +of action is to revert that change. + +Reported-by: Ferry Toth +Tested-by: Ferry Toth (Intel Edison-Arduino) +Link: https://github.com/thesofproject/linux/issues/3901 +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Péter Ujfalusi +Reviewed-by: Ranjani Sridharan +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20230307095341.3222-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/sof/intel/pci-tng.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/sound/soc/sof/intel/pci-tng.c b/sound/soc/sof/intel/pci-tng.c +index 5b2b4097..8c22a002 100644 +--- a/sound/soc/sof/intel/pci-tng.c ++++ b/sound/soc/sof/intel/pci-tng.c +@@ -75,11 +75,7 @@ static int tangier_pci_probe(struct snd_sof_dev *sdev) + + /* LPE base */ + base = pci_resource_start(pci, desc->resindex_lpe_base) - IRAM_OFFSET; +- size = pci_resource_len(pci, desc->resindex_lpe_base); +- if (size < PCI_BAR_SIZE) { +- dev_err(sdev->dev, "error: I/O region is too small.\n"); +- return -ENODEV; +- } ++ size = PCI_BAR_SIZE; + + dev_dbg(sdev->dev, "LPE PHY base at 0x%x size 0x%x", base, size); + sdev->bar[DSP_BAR] = devm_ioremap(sdev->dev, base, size); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-031-ASoC-SOF-Intel-hda-dsp-harden-D0i3-programming.patch b/patches.kernel.org/6.2.10-031-ASoC-SOF-Intel-hda-dsp-harden-D0i3-programming.patch new file mode 100644 index 0000000..e40e98b --- /dev/null +++ b/patches.kernel.org/6.2.10-031-ASoC-SOF-Intel-hda-dsp-harden-D0i3-programming.patch @@ -0,0 +1,62 @@ +From: Rander Wang +Date: Tue, 7 Mar 2023 11:54:52 +0200 +Subject: [PATCH] ASoC: SOF: Intel: hda-dsp: harden D0i3 programming sequence +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 52a55779ed14792a150421339664193d6eb8e036 + +[ Upstream commit 52a55779ed14792a150421339664193d6eb8e036 ] + +Add delay between set and wait command according to hardware programming +sequence. Also add debug log to detect error. + +Signed-off-by: Rander Wang +Reviewed-by: Péter Ujfalusi +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Péter Ujfalusi +Reviewed-by: Ranjani Sridharan +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20230307095453.3719-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/sof/intel/hda-dsp.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/sound/soc/sof/intel/hda-dsp.c b/sound/soc/sof/intel/hda-dsp.c +index b4eacae8..6b2094f7 100644 +--- a/sound/soc/sof/intel/hda-dsp.c ++++ b/sound/soc/sof/intel/hda-dsp.c +@@ -399,6 +399,12 @@ static int hda_dsp_update_d0i3c_register(struct snd_sof_dev *sdev, u8 value) + snd_sof_dsp_update8(sdev, HDA_DSP_HDA_BAR, chip->d0i3_offset, + SOF_HDA_VS_D0I3C_I3, value); + ++ /* ++ * The value written to the D0I3C::I3 bit may not be taken into account immediately. ++ * A delay is recommended before checking if D0I3C::CIP is cleared ++ */ ++ usleep_range(30, 40); ++ + /* Wait for cmd in progress to be cleared before exiting the function */ + ret = hda_dsp_wait_d0i3c_done(sdev); + if (ret < 0) { +@@ -407,6 +413,12 @@ static int hda_dsp_update_d0i3c_register(struct snd_sof_dev *sdev, u8 value) + } + + reg = snd_sof_dsp_read8(sdev, HDA_DSP_HDA_BAR, chip->d0i3_offset); ++ /* Confirm d0i3 state changed with paranoia check */ ++ if ((reg ^ value) & SOF_HDA_VS_D0I3C_I3) { ++ dev_err(sdev->dev, "failed to update D0I3C!\n"); ++ return -EIO; ++ } ++ + trace_sof_intel_D0I3C_updated(sdev, reg); + + return 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-032-ASoC-SOF-Intel-hda-ctrl-re-add-sleep-after-ent.patch b/patches.kernel.org/6.2.10-032-ASoC-SOF-Intel-hda-ctrl-re-add-sleep-after-ent.patch new file mode 100644 index 0000000..ff7bcda --- /dev/null +++ b/patches.kernel.org/6.2.10-032-ASoC-SOF-Intel-hda-ctrl-re-add-sleep-after-ent.patch @@ -0,0 +1,56 @@ +From: Pierre-Louis Bossart +Date: Tue, 7 Mar 2023 11:54:12 +0200 +Subject: [PATCH] ASoC: SOF: Intel: hda-ctrl: re-add sleep after entering and + exiting reset +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 8bac40b8ed17ab1be9133e9620f65fae80262b7e + +[ Upstream commit 8bac40b8ed17ab1be9133e9620f65fae80262b7e ] + +This reverts commit a09d82ce0a867 ("ASoC: SOF: Intel: hda-ctrl: remove +useless sleep") + +It was a mistake to remove those delays, in light of comments in the +HDaudio spec captured in snd_hdac_bus_reset_link() that the codec +needs time for its initialization and PLL lock. + +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Ranjani Sridharan +Reviewed-by: Péter Ujfalusi +Reviewed-by: Rander Wang +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20230307095412.3416-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/sof/intel/hda-ctrl.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/sof/intel/hda-ctrl.c b/sound/soc/sof/intel/hda-ctrl.c +index 3aea36c0..f3bdeba2 100644 +--- a/sound/soc/sof/intel/hda-ctrl.c ++++ b/sound/soc/sof/intel/hda-ctrl.c +@@ -196,12 +196,15 @@ int hda_dsp_ctrl_init_chip(struct snd_sof_dev *sdev) + goto err; + } + ++ usleep_range(500, 1000); ++ + /* exit HDA controller reset */ + ret = hda_dsp_ctrl_link_reset(sdev, false); + if (ret < 0) { + dev_err(sdev->dev, "error: failed to exit HDA controller reset\n"); + goto err; + } ++ usleep_range(1000, 1200); + + hda_codec_detect_mask(sdev); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-033-ASoC-SOF-IPC4-update-gain-ipc-msg-definition-t.patch b/patches.kernel.org/6.2.10-033-ASoC-SOF-IPC4-update-gain-ipc-msg-definition-t.patch new file mode 100644 index 0000000..29a5c99 --- /dev/null +++ b/patches.kernel.org/6.2.10-033-ASoC-SOF-IPC4-update-gain-ipc-msg-definition-t.patch @@ -0,0 +1,105 @@ +From: Rander Wang +Date: Tue, 7 Mar 2023 13:06:56 +0200 +Subject: [PATCH] ASoC: SOF: IPC4: update gain ipc msg definition to align with + fw +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: e45cd86c3a78bfb9875a5eb8ab5dab459b59bbe2 + +[ Upstream commit e45cd86c3a78bfb9875a5eb8ab5dab459b59bbe2 ] + +Recent firmware changes modified the curve duration from 32 to 64 bits, +which breaks volume ramps. A simple solution would be to change the +definition, but unfortunately the ASoC topology framework only supports +up to 32 bit tokens. + +This patch suggests breaking the 64 bit value in low and high parts, with +only the low-part extracted from topology and high-part only zeroes. Since +the curve duration is represented in hundred of nanoseconds, we can still +represent a 400s ramp, which is just fine. The defacto ABI change has no +effect on existing users since the IPC4 firmware has not been released just +yet. + +Link: https://github.com/thesofproject/linux/issues/4026 + +Signed-off-by: Rander Wang +Reviewed-by: Ranjani Sridharan +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Bard Liao +Reviewed-by: Péter Ujfalusi +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20230307110656.1816-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/sof/ipc4-control.c | 3 ++- + sound/soc/sof/ipc4-topology.c | 4 ++-- + sound/soc/sof/ipc4-topology.h | 6 ++++-- + 3 files changed, 8 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/sof/ipc4-control.c b/sound/soc/sof/ipc4-control.c +index 0d5a578c..7442ec1c 100644 +--- a/sound/soc/sof/ipc4-control.c ++++ b/sound/soc/sof/ipc4-control.c +@@ -84,7 +84,8 @@ sof_ipc4_set_volume_data(struct snd_sof_dev *sdev, struct snd_sof_widget *swidge + } + + /* set curve type and duration from topology */ +- data.curve_duration = gain->data.curve_duration; ++ data.curve_duration_l = gain->data.curve_duration_l; ++ data.curve_duration_h = gain->data.curve_duration_h; + data.curve_type = gain->data.curve_type; + + msg->data_ptr = &data; +diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c +index 65da1cf7..6da6137f 100644 +--- a/sound/soc/sof/ipc4-topology.c ++++ b/sound/soc/sof/ipc4-topology.c +@@ -107,7 +107,7 @@ static const struct sof_topology_token gain_tokens[] = { + get_token_u32, offsetof(struct sof_ipc4_gain_data, curve_type)}, + {SOF_TKN_GAIN_RAMP_DURATION, + SND_SOC_TPLG_TUPLE_TYPE_WORD, get_token_u32, +- offsetof(struct sof_ipc4_gain_data, curve_duration)}, ++ offsetof(struct sof_ipc4_gain_data, curve_duration_l)}, + {SOF_TKN_GAIN_VAL, SND_SOC_TPLG_TUPLE_TYPE_WORD, + get_token_u32, offsetof(struct sof_ipc4_gain_data, init_val)}, + }; +@@ -670,7 +670,7 @@ static int sof_ipc4_widget_setup_comp_pga(struct snd_sof_widget *swidget) + + dev_dbg(scomp->dev, + "pga widget %s: ramp type: %d, ramp duration %d, initial gain value: %#x, cpc %d\n", +- swidget->widget->name, gain->data.curve_type, gain->data.curve_duration, ++ swidget->widget->name, gain->data.curve_type, gain->data.curve_duration_l, + gain->data.init_val, gain->base_config.cpc); + + ret = sof_ipc4_widget_setup_msg(swidget, &gain->msg); +diff --git a/sound/soc/sof/ipc4-topology.h b/sound/soc/sof/ipc4-topology.h +index 2363a7cc..cf9d2785 100644 +--- a/sound/soc/sof/ipc4-topology.h ++++ b/sound/soc/sof/ipc4-topology.h +@@ -217,14 +217,16 @@ struct sof_ipc4_control_data { + * @init_val: Initial value + * @curve_type: Curve type + * @reserved: reserved for future use +- * @curve_duration: Curve duration ++ * @curve_duration_l: Curve duration low part ++ * @curve_duration_h: Curve duration high part + */ + struct sof_ipc4_gain_data { + uint32_t channels; + uint32_t init_val; + uint32_t curve_type; + uint32_t reserved; +- uint32_t curve_duration; ++ uint32_t curve_duration_l; ++ uint32_t curve_duration_h; + } __aligned(8); + + /** +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-034-ASoC-hdmi-codec-only-startup-shutdown-on-suppo.patch b/patches.kernel.org/6.2.10-034-ASoC-hdmi-codec-only-startup-shutdown-on-suppo.patch new file mode 100644 index 0000000..429729a --- /dev/null +++ b/patches.kernel.org/6.2.10-034-ASoC-hdmi-codec-only-startup-shutdown-on-suppo.patch @@ -0,0 +1,66 @@ +From: Emil Abildgaard Svendsen +Date: Thu, 9 Mar 2023 06:54:41 +0000 +Subject: [PATCH] ASoC: hdmi-codec: only startup/shutdown on supported streams +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: e041a2a550582106cba6a7c862c90dfc2ad14492 + +[ Upstream commit e041a2a550582106cba6a7c862c90dfc2ad14492 ] + +Currently only one stream is supported. This isn't usally a problem +until you have a multi codec audio card. Because the audio card will run +startup and shutdown on both capture and playback streams. So if your +hdmi-codec only support either playback or capture. Then ALSA can't open +for playback and capture. + +This patch will ignore if startup and shutdown are called with a non +supported stream. Thus, allowing an audio card like this: + + +-+ + cpu1 <--@-| |-> codec1 (HDMI-CODEC) + | |<- codec2 (NOT HDMI-CODEC) + +-+ + +Signed-off-by: Emil Svendsen +Link: https://lore.kernel.org/r/20230309065432.4150700-2-emas@bang-olufsen.dk +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/codecs/hdmi-codec.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c +index 74cbbe16..a22f2ec9 100644 +--- a/sound/soc/codecs/hdmi-codec.c ++++ b/sound/soc/codecs/hdmi-codec.c +@@ -428,8 +428,13 @@ static int hdmi_codec_startup(struct snd_pcm_substream *substream, + { + struct hdmi_codec_priv *hcp = snd_soc_dai_get_drvdata(dai); + bool tx = substream->stream == SNDRV_PCM_STREAM_PLAYBACK; ++ bool has_capture = !hcp->hcd.no_i2s_capture; ++ bool has_playback = !hcp->hcd.no_i2s_playback; + int ret = 0; + ++ if (!((has_playback && tx) || (has_capture && !tx))) ++ return 0; ++ + mutex_lock(&hcp->lock); + if (hcp->busy) { + dev_err(dai->dev, "Only one simultaneous stream supported!\n"); +@@ -468,6 +473,12 @@ static void hdmi_codec_shutdown(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) + { + struct hdmi_codec_priv *hcp = snd_soc_dai_get_drvdata(dai); ++ bool tx = substream->stream == SNDRV_PCM_STREAM_PLAYBACK; ++ bool has_capture = !hcp->hcd.no_i2s_capture; ++ bool has_playback = !hcp->hcd.no_i2s_playback; ++ ++ if (!((has_playback && tx) || (has_capture && !tx))) ++ return; + + hcp->chmap_idx = HDMI_CODEC_CHMAP_IDX_UNKNOWN; + hcp->hcd.ops->audio_shutdown(dai->dev->parent, hcp->hcd.data); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-035-wifi-mac80211-check-basic-rates-validity.patch b/patches.kernel.org/6.2.10-035-wifi-mac80211-check-basic-rates-validity.patch new file mode 100644 index 0000000..168fe49 --- /dev/null +++ b/patches.kernel.org/6.2.10-035-wifi-mac80211-check-basic-rates-validity.patch @@ -0,0 +1,65 @@ +From: Johannes Berg +Date: Fri, 24 Feb 2023 10:52:19 +0100 +Subject: [PATCH] wifi: mac80211: check basic rates validity +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: ce04abc3fcc62cd5640af981ebfd7c4dc3bded28 + +[ Upstream commit ce04abc3fcc62cd5640af981ebfd7c4dc3bded28 ] + +When userspace sets basic rates, it might send us some rates +list that's empty or consists of invalid values only. We're +currently ignoring invalid values and then may end up with a +rates bitmap that's empty, which later results in a warning. + +Reject the call if there were no valid rates. + +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/mac80211/cfg.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index d611e153..e24d2d5b 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -2576,6 +2576,17 @@ static int ieee80211_change_bss(struct wiphy *wiphy, + if (!sband) + return -EINVAL; + ++ if (params->basic_rates) { ++ if (!ieee80211_parse_bitrates(link->conf->chandef.width, ++ wiphy->bands[sband->band], ++ params->basic_rates, ++ params->basic_rates_len, ++ &link->conf->basic_rates)) ++ return -EINVAL; ++ changed |= BSS_CHANGED_BASIC_RATES; ++ ieee80211_check_rate_mask(link); ++ } ++ + if (params->use_cts_prot >= 0) { + link->conf->use_cts_prot = params->use_cts_prot; + changed |= BSS_CHANGED_ERP_CTS_PROT; +@@ -2597,16 +2608,6 @@ static int ieee80211_change_bss(struct wiphy *wiphy, + changed |= BSS_CHANGED_ERP_SLOT; + } + +- if (params->basic_rates) { +- ieee80211_parse_bitrates(link->conf->chandef.width, +- wiphy->bands[sband->band], +- params->basic_rates, +- params->basic_rates_len, +- &link->conf->basic_rates); +- changed |= BSS_CHANGED_BASIC_RATES; +- ieee80211_check_rate_mask(link); +- } +- + if (params->ap_isolate >= 0) { + if (params->ap_isolate) + sdata->flags |= IEEE80211_SDATA_DONT_BRIDGE_PACKETS; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-036-md-avoid-signed-overflow-in-slot_store.patch b/patches.kernel.org/6.2.10-036-md-avoid-signed-overflow-in-slot_store.patch new file mode 100644 index 0000000..7e21a6b --- /dev/null +++ b/patches.kernel.org/6.2.10-036-md-avoid-signed-overflow-in-slot_store.patch @@ -0,0 +1,45 @@ +From: NeilBrown +Date: Mon, 6 Mar 2023 09:36:25 +1100 +Subject: [PATCH] md: avoid signed overflow in slot_store() +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 3bc57292278a0b6ac4656cad94c14f2453344b57 + +[ Upstream commit 3bc57292278a0b6ac4656cad94c14f2453344b57 ] + +slot_store() uses kstrtouint() to get a slot number, but stores the +result in an "int" variable (by casting a pointer). +This can result in a negative slot number if the unsigned int value is +very large. + +A negative number means that the slot is empty, but setting a negative +slot number this way will not remove the device from the array. I don't +think this is a serious problem, but it could cause confusion and it is +best to fix it. + +Reported-by: Dan Carpenter +Signed-off-by: NeilBrown +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/md/md.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 272cc5d1..beab84f0 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -3131,6 +3131,9 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len) + err = kstrtouint(buf, 10, (unsigned int *)&slot); + if (err < 0) + return err; ++ if (slot < 0) ++ /* overflow */ ++ return -ENOSPC; + } + if (rdev->mddev->pers && slot == -1) { + /* Setting 'slot' on an active array requires also +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-037-x86-PVH-obtain-VGA-console-info-in-Dom0.patch b/patches.kernel.org/6.2.10-037-x86-PVH-obtain-VGA-console-info-in-Dom0.patch new file mode 100644 index 0000000..3b0dae3 --- /dev/null +++ b/patches.kernel.org/6.2.10-037-x86-PVH-obtain-VGA-console-info-in-Dom0.patch @@ -0,0 +1,140 @@ +From: Jan Beulich +Date: Mon, 13 Mar 2023 15:45:48 +0100 +Subject: [PATCH] x86/PVH: obtain VGA console info in Dom0 +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 934ef33ee75c3846f605f18b65048acd147e3918 + +[ Upstream commit 934ef33ee75c3846f605f18b65048acd147e3918 ] + +A new platform-op was added to Xen to allow obtaining the same VGA +console information PV Dom0 is handed. Invoke the new function and have +the output data processed by xen_init_vga(). + +Signed-off-by: Jan Beulich +Reviewed-by: Juergen Gross + +Link: https://lore.kernel.org/r/8f315e92-7bda-c124-71cc-478ab9c5e610@suse.com +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/x86/xen/Makefile | 2 +- + arch/x86/xen/enlighten_pv.c | 3 ++- + arch/x86/xen/enlighten_pvh.c | 13 +++++++++++++ + arch/x86/xen/vga.c | 5 ++--- + arch/x86/xen/xen-ops.h | 7 ++++--- + include/xen/interface/platform.h | 3 +++ + 6 files changed, 25 insertions(+), 8 deletions(-) + +diff --git a/arch/x86/xen/Makefile b/arch/x86/xen/Makefile +index 3c5b52fb..a9ec8c9f 100644 +--- a/arch/x86/xen/Makefile ++++ b/arch/x86/xen/Makefile +@@ -45,6 +45,6 @@ obj-$(CONFIG_PARAVIRT_SPINLOCKS)+= spinlock.o + + obj-$(CONFIG_XEN_DEBUG_FS) += debugfs.o + +-obj-$(CONFIG_XEN_PV_DOM0) += vga.o ++obj-$(CONFIG_XEN_DOM0) += vga.o + + obj-$(CONFIG_XEN_EFI) += efi.o +diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c +index 5b137966..68f5f5d2 100644 +--- a/arch/x86/xen/enlighten_pv.c ++++ b/arch/x86/xen/enlighten_pv.c +@@ -1389,7 +1389,8 @@ asmlinkage __visible void __init xen_start_kernel(struct start_info *si) + + x86_platform.set_legacy_features = + xen_dom0_set_legacy_features; +- xen_init_vga(info, xen_start_info->console.dom0.info_size); ++ xen_init_vga(info, xen_start_info->console.dom0.info_size, ++ &boot_params.screen_info); + xen_start_info->console.domU.mfn = 0; + xen_start_info->console.domU.evtchn = 0; + +diff --git a/arch/x86/xen/enlighten_pvh.c b/arch/x86/xen/enlighten_pvh.c +index bcae606b..1da44aca 100644 +--- a/arch/x86/xen/enlighten_pvh.c ++++ b/arch/x86/xen/enlighten_pvh.c +@@ -43,6 +43,19 @@ void __init xen_pvh_init(struct boot_params *boot_params) + x86_init.oem.banner = xen_banner; + + xen_efi_init(boot_params); ++ ++ if (xen_initial_domain()) { ++ struct xen_platform_op op = { ++ .cmd = XENPF_get_dom0_console, ++ }; ++ long ret = HYPERVISOR_platform_op(&op); ++ ++ if (ret > 0) ++ xen_init_vga(&op.u.dom0_console, ++ min(ret * sizeof(char), ++ sizeof(op.u.dom0_console)), ++ &boot_params->screen_info); ++ } + } + + void __init mem_map_via_hcall(struct boot_params *boot_params_p) +diff --git a/arch/x86/xen/vga.c b/arch/x86/xen/vga.c +index 14ea32e7..d97adab8 100644 +--- a/arch/x86/xen/vga.c ++++ b/arch/x86/xen/vga.c +@@ -9,10 +9,9 @@ + + #include "xen-ops.h" + +-void __init xen_init_vga(const struct dom0_vga_console_info *info, size_t size) ++void __init xen_init_vga(const struct dom0_vga_console_info *info, size_t size, ++ struct screen_info *screen_info) + { +- struct screen_info *screen_info = &boot_params.screen_info; +- + /* This is drawn from a dump from vgacon:startup in + * standard Linux. */ + screen_info->orig_video_mode = 3; +diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h +index 9a8bb972..a1090378 100644 +--- a/arch/x86/xen/xen-ops.h ++++ b/arch/x86/xen/xen-ops.h +@@ -108,11 +108,12 @@ static inline void xen_uninit_lock_cpu(int cpu) + + struct dom0_vga_console_info; + +-#ifdef CONFIG_XEN_PV_DOM0 +-void __init xen_init_vga(const struct dom0_vga_console_info *, size_t size); ++#ifdef CONFIG_XEN_DOM0 ++void __init xen_init_vga(const struct dom0_vga_console_info *, size_t size, ++ struct screen_info *); + #else + static inline void __init xen_init_vga(const struct dom0_vga_console_info *info, +- size_t size) ++ size_t size, struct screen_info *si) + { + } + #endif +diff --git a/include/xen/interface/platform.h b/include/xen/interface/platform.h +index 655d92e8..79a443c6 100644 +--- a/include/xen/interface/platform.h ++++ b/include/xen/interface/platform.h +@@ -483,6 +483,8 @@ struct xenpf_symdata { + }; + DEFINE_GUEST_HANDLE_STRUCT(xenpf_symdata); + ++#define XENPF_get_dom0_console 64 ++ + struct xen_platform_op { + uint32_t cmd; + uint32_t interface_version; /* XENPF_INTERFACE_VERSION */ +@@ -506,6 +508,7 @@ struct xen_platform_op { + struct xenpf_mem_hotadd mem_add; + struct xenpf_core_parking core_parking; + struct xenpf_symdata symdata; ++ struct dom0_vga_console_info dom0_console; + uint8_t pad[128]; + } u; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-038-drm-amdkfd-Fix-BO-offset-for-multi-VMA-page-mi.patch b/patches.kernel.org/6.2.10-038-drm-amdkfd-Fix-BO-offset-for-multi-VMA-page-mi.patch new file mode 100644 index 0000000..04d6e7f --- /dev/null +++ b/patches.kernel.org/6.2.10-038-drm-amdkfd-Fix-BO-offset-for-multi-VMA-page-mi.patch @@ -0,0 +1,110 @@ +From: Xiaogang Chen +Date: Wed, 1 Mar 2023 10:21:06 -0600 +Subject: [PATCH] drm/amdkfd: Fix BO offset for multi-VMA page migration +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: b4ee9606378bb9520c94d8b96f0305c3696f5c29 + +[ Upstream commit b4ee9606378bb9520c94d8b96f0305c3696f5c29 ] + +svm_migrate_ram_to_vram migrates a prange from sys ram to vram. The prange may +cross multiple vma. Need remember current dst vram offset in the TTM resource for +each migration. + +v2: squash in warning fix (Alex) + +Signed-off-by: Xiaogang Chen +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +index 10048ce1..5c319007 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +@@ -289,7 +289,7 @@ static unsigned long svm_migrate_unsuccessful_pages(struct migrate_vma *migrate) + static int + svm_migrate_copy_to_vram(struct amdgpu_device *adev, struct svm_range *prange, + struct migrate_vma *migrate, struct dma_fence **mfence, +- dma_addr_t *scratch) ++ dma_addr_t *scratch, uint64_t ttm_res_offset) + { + uint64_t npages = migrate->npages; + struct device *dev = adev->dev; +@@ -299,8 +299,8 @@ svm_migrate_copy_to_vram(struct amdgpu_device *adev, struct svm_range *prange, + uint64_t i, j; + int r; + +- pr_debug("svms 0x%p [0x%lx 0x%lx]\n", prange->svms, prange->start, +- prange->last); ++ pr_debug("svms 0x%p [0x%lx 0x%lx 0x%llx]\n", prange->svms, prange->start, ++ prange->last, ttm_res_offset); + + src = scratch; + dst = (uint64_t *)(scratch + npages); +@@ -311,7 +311,7 @@ svm_migrate_copy_to_vram(struct amdgpu_device *adev, struct svm_range *prange, + goto out; + } + +- amdgpu_res_first(prange->ttm_res, prange->offset << PAGE_SHIFT, ++ amdgpu_res_first(prange->ttm_res, ttm_res_offset, + npages << PAGE_SHIFT, &cursor); + for (i = j = 0; i < npages; i++) { + struct page *spage; +@@ -398,7 +398,7 @@ svm_migrate_copy_to_vram(struct amdgpu_device *adev, struct svm_range *prange, + static long + svm_migrate_vma_to_vram(struct amdgpu_device *adev, struct svm_range *prange, + struct vm_area_struct *vma, uint64_t start, +- uint64_t end, uint32_t trigger) ++ uint64_t end, uint32_t trigger, uint64_t ttm_res_offset) + { + struct kfd_process *p = container_of(prange->svms, struct kfd_process, svms); + uint64_t npages = (end - start) >> PAGE_SHIFT; +@@ -451,7 +451,7 @@ svm_migrate_vma_to_vram(struct amdgpu_device *adev, struct svm_range *prange, + else + pr_debug("0x%lx pages migrated\n", cpages); + +- r = svm_migrate_copy_to_vram(adev, prange, &migrate, &mfence, scratch); ++ r = svm_migrate_copy_to_vram(adev, prange, &migrate, &mfence, scratch, ttm_res_offset); + migrate_vma_pages(&migrate); + + pr_debug("successful/cpages/npages 0x%lx/0x%lx/0x%lx\n", +@@ -499,6 +499,7 @@ svm_migrate_ram_to_vram(struct svm_range *prange, uint32_t best_loc, + unsigned long addr, start, end; + struct vm_area_struct *vma; + struct amdgpu_device *adev; ++ uint64_t ttm_res_offset; + unsigned long cpages = 0; + long r = 0; + +@@ -519,6 +520,7 @@ svm_migrate_ram_to_vram(struct svm_range *prange, uint32_t best_loc, + + start = prange->start << PAGE_SHIFT; + end = (prange->last + 1) << PAGE_SHIFT; ++ ttm_res_offset = prange->offset << PAGE_SHIFT; + + for (addr = start; addr < end;) { + unsigned long next; +@@ -528,13 +530,14 @@ svm_migrate_ram_to_vram(struct svm_range *prange, uint32_t best_loc, + break; + + next = min(vma->vm_end, end); +- r = svm_migrate_vma_to_vram(adev, prange, vma, addr, next, trigger); ++ r = svm_migrate_vma_to_vram(adev, prange, vma, addr, next, trigger, ttm_res_offset); + if (r < 0) { + pr_debug("failed %ld to migrate\n", r); + break; + } else { + cpages += r; + } ++ ttm_res_offset += next - addr; + addr = next; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-039-drm-amdkfd-fix-a-potential-double-free-in-pqm_.patch b/patches.kernel.org/6.2.10-039-drm-amdkfd-fix-a-potential-double-free-in-pqm_.patch new file mode 100644 index 0000000..5dd3b17 --- /dev/null +++ b/patches.kernel.org/6.2.10-039-drm-amdkfd-fix-a-potential-double-free-in-pqm_.patch @@ -0,0 +1,40 @@ +From: Chia-I Wu +Date: Tue, 7 Mar 2023 16:19:02 -0800 +Subject: [PATCH] drm/amdkfd: fix a potential double free in pqm_create_queue +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: b2ca5c5d416b4e72d1e9d0293fc720e2d525fd42 + +[ Upstream commit b2ca5c5d416b4e72d1e9d0293fc720e2d525fd42 ] + +Set *q to NULL on errors, otherwise pqm_create_queue would free it +again. + +Signed-off-by: Chia-I Wu +Signed-off-by: Felix Kuehling +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +index 5137476e..4236539d 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +@@ -218,8 +218,8 @@ static int init_user_queue(struct process_queue_manager *pqm, + return 0; + + cleanup: +- if (dev->shared_resources.enable_mes) +- uninit_queue(*q); ++ uninit_queue(*q); ++ *q = NULL; + return retval; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-040-drm-amdgpu-vcn-custom-video-info-caps-for-srio.patch b/patches.kernel.org/6.2.10-040-drm-amdgpu-vcn-custom-video-info-caps-for-srio.patch new file mode 100644 index 0000000..f78feaa --- /dev/null +++ b/patches.kernel.org/6.2.10-040-drm-amdgpu-vcn-custom-video-info-caps-for-srio.patch @@ -0,0 +1,192 @@ +From: Jane Jian +Date: Tue, 28 Feb 2023 18:48:41 +0800 +Subject: [PATCH] drm/amdgpu/vcn: custom video info caps for sriov +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: d71e38df3b730a17ab6b25cabb2ccfe8a7f04385 + +[ Upstream commit d71e38df3b730a17ab6b25cabb2ccfe8a7f04385 ] + +for sriov, we added a new flag to indicate av1 support, +this will override the original caps info. + +Signed-off-by: Jane Jian +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 4 + + drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h | 3 +- + drivers/gpu/drm/amd/amdgpu/soc21.c | 103 ++++++++++++++++++-- + 3 files changed, 99 insertions(+), 11 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h +index 2b9d806e..10a0a510 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h +@@ -123,6 +123,8 @@ enum AMDGIM_FEATURE_FLAG { + AMDGIM_FEATURE_PP_ONE_VF = (1 << 4), + /* Indirect Reg Access enabled */ + AMDGIM_FEATURE_INDIRECT_REG_ACCESS = (1 << 5), ++ /* AV1 Support MODE*/ ++ AMDGIM_FEATURE_AV1_SUPPORT = (1 << 6), + }; + + enum AMDGIM_REG_ACCESS_FLAG { +@@ -321,6 +323,8 @@ static inline bool is_virtual_machine(void) + ((!amdgpu_in_reset(adev)) && adev->virt.tdr_debug) + #define amdgpu_sriov_is_normal(adev) \ + ((!amdgpu_in_reset(adev)) && (!adev->virt.tdr_debug)) ++#define amdgpu_sriov_is_av1_support(adev) \ ++ ((adev)->virt.gim_feature & AMDGIM_FEATURE_AV1_SUPPORT) + bool amdgpu_virt_mmio_blocked(struct amdgpu_device *adev); + void amdgpu_virt_init_setting(struct amdgpu_device *adev); + void amdgpu_virt_kiq_reg_write_reg_wait(struct amdgpu_device *adev, +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h b/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h +index 6c97148c..24d42d24 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h +@@ -93,7 +93,8 @@ union amd_sriov_msg_feature_flags { + uint32_t mm_bw_management : 1; + uint32_t pp_one_vf_mode : 1; + uint32_t reg_indirect_acc : 1; +- uint32_t reserved : 26; ++ uint32_t av1_support : 1; ++ uint32_t reserved : 25; + } flags; + uint32_t all; + }; +diff --git a/drivers/gpu/drm/amd/amdgpu/soc21.c b/drivers/gpu/drm/amd/amdgpu/soc21.c +index 3d938b52..9eedc1a1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/soc21.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc21.c +@@ -101,6 +101,59 @@ static const struct amdgpu_video_codecs vcn_4_0_0_video_codecs_decode_vcn1 = + .codec_array = vcn_4_0_0_video_codecs_decode_array_vcn1, + }; + ++/* SRIOV SOC21, not const since data is controlled by host */ ++static struct amdgpu_video_codec_info sriov_vcn_4_0_0_video_codecs_encode_array_vcn0[] = { ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 2304, 0)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 2304, 0)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_AV1, 8192, 4352, 0)}, ++}; ++ ++static struct amdgpu_video_codec_info sriov_vcn_4_0_0_video_codecs_encode_array_vcn1[] = { ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 2304, 0)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 2304, 0)}, ++}; ++ ++static struct amdgpu_video_codecs sriov_vcn_4_0_0_video_codecs_encode_vcn0 = { ++ .codec_count = ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_encode_array_vcn0), ++ .codec_array = sriov_vcn_4_0_0_video_codecs_encode_array_vcn0, ++}; ++ ++static struct amdgpu_video_codecs sriov_vcn_4_0_0_video_codecs_encode_vcn1 = { ++ .codec_count = ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_encode_array_vcn1), ++ .codec_array = sriov_vcn_4_0_0_video_codecs_encode_array_vcn1, ++}; ++ ++static struct amdgpu_video_codec_info sriov_vcn_4_0_0_video_codecs_decode_array_vcn0[] = { ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_AV1, 8192, 4352, 0)}, ++}; ++ ++static struct amdgpu_video_codec_info sriov_vcn_4_0_0_video_codecs_decode_array_vcn1[] = { ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)}, ++}; ++ ++static struct amdgpu_video_codecs sriov_vcn_4_0_0_video_codecs_decode_vcn0 = { ++ .codec_count = ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_decode_array_vcn0), ++ .codec_array = sriov_vcn_4_0_0_video_codecs_decode_array_vcn0, ++}; ++ ++static struct amdgpu_video_codecs sriov_vcn_4_0_0_video_codecs_decode_vcn1 = { ++ .codec_count = ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_decode_array_vcn1), ++ .codec_array = sriov_vcn_4_0_0_video_codecs_decode_array_vcn1, ++}; ++ + static int soc21_query_video_codecs(struct amdgpu_device *adev, bool encode, + const struct amdgpu_video_codecs **codecs) + { +@@ -111,16 +164,31 @@ static int soc21_query_video_codecs(struct amdgpu_device *adev, bool encode, + case IP_VERSION(4, 0, 0): + case IP_VERSION(4, 0, 2): + case IP_VERSION(4, 0, 4): +- if (adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0) { +- if (encode) +- *codecs = &vcn_4_0_0_video_codecs_encode_vcn1; +- else +- *codecs = &vcn_4_0_0_video_codecs_decode_vcn1; ++ if (amdgpu_sriov_vf(adev)) { ++ if ((adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0) || ++ !amdgpu_sriov_is_av1_support(adev)) { ++ if (encode) ++ *codecs = &sriov_vcn_4_0_0_video_codecs_encode_vcn1; ++ else ++ *codecs = &sriov_vcn_4_0_0_video_codecs_decode_vcn1; ++ } else { ++ if (encode) ++ *codecs = &sriov_vcn_4_0_0_video_codecs_encode_vcn0; ++ else ++ *codecs = &sriov_vcn_4_0_0_video_codecs_decode_vcn0; ++ } + } else { +- if (encode) +- *codecs = &vcn_4_0_0_video_codecs_encode_vcn0; +- else +- *codecs = &vcn_4_0_0_video_codecs_decode_vcn0; ++ if ((adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0)) { ++ if (encode) ++ *codecs = &vcn_4_0_0_video_codecs_encode_vcn1; ++ else ++ *codecs = &vcn_4_0_0_video_codecs_decode_vcn1; ++ } else { ++ if (encode) ++ *codecs = &vcn_4_0_0_video_codecs_encode_vcn0; ++ else ++ *codecs = &vcn_4_0_0_video_codecs_decode_vcn0; ++ } + } + return 0; + default: +@@ -729,8 +797,23 @@ static int soc21_common_late_init(void *handle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + +- if (amdgpu_sriov_vf(adev)) ++ if (amdgpu_sriov_vf(adev)) { + xgpu_nv_mailbox_get_irq(adev); ++ if ((adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0) || ++ !amdgpu_sriov_is_av1_support(adev)) { ++ amdgpu_virt_update_sriov_video_codec(adev, ++ sriov_vcn_4_0_0_video_codecs_encode_array_vcn1, ++ ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_encode_array_vcn1), ++ sriov_vcn_4_0_0_video_codecs_decode_array_vcn1, ++ ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_decode_array_vcn1)); ++ } else { ++ amdgpu_virt_update_sriov_video_codec(adev, ++ sriov_vcn_4_0_0_video_codecs_encode_array_vcn0, ++ ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_encode_array_vcn0), ++ sriov_vcn_4_0_0_video_codecs_decode_array_vcn0, ++ ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_decode_array_vcn0)); ++ } ++ } + + return 0; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-041-drm-amdkfd-fix-potential-kgd_mem-UAFs.patch b/patches.kernel.org/6.2.10-041-drm-amdkfd-fix-potential-kgd_mem-UAFs.patch new file mode 100644 index 0000000..71ef0a0 --- /dev/null +++ b/patches.kernel.org/6.2.10-041-drm-amdkfd-fix-potential-kgd_mem-UAFs.patch @@ -0,0 +1,99 @@ +From: Chia-I Wu +Date: Wed, 8 Mar 2023 13:37:24 -0800 +Subject: [PATCH] drm/amdkfd: fix potential kgd_mem UAFs +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 9da050b0d9e04439d225a2ec3044af70cdfb3933 + +[ Upstream commit 9da050b0d9e04439d225a2ec3044af70cdfb3933 ] + +kgd_mem pointers returned by kfd_process_device_translate_handle are +only guaranteed to be valid while p->mutex is held. As soon as the mutex +is unlocked, another thread can free the BO. + +Signed-off-by: Chia-I Wu +Signed-off-by: Felix Kuehling +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +index f79b8e96..e191d38f 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +@@ -1298,14 +1298,14 @@ static int kfd_ioctl_map_memory_to_gpu(struct file *filep, + args->n_success = i+1; + } + +- mutex_unlock(&p->mutex); +- + err = amdgpu_amdkfd_gpuvm_sync_memory(dev->adev, (struct kgd_mem *) mem, true); + if (err) { + pr_debug("Sync memory failed, wait interrupted by user signal\n"); + goto sync_memory_failed; + } + ++ mutex_unlock(&p->mutex); ++ + /* Flush TLBs after waiting for the page table updates to complete */ + for (i = 0; i < args->n_devices; i++) { + peer_pdd = kfd_process_device_data_by_id(p, devices_arr[i]); +@@ -1321,9 +1321,9 @@ static int kfd_ioctl_map_memory_to_gpu(struct file *filep, + bind_process_to_device_failed: + get_mem_obj_from_handle_failed: + map_memory_to_gpu_failed: ++sync_memory_failed: + mutex_unlock(&p->mutex); + copy_from_user_failed: +-sync_memory_failed: + kfree(devices_arr); + + return err; +@@ -1337,6 +1337,7 @@ static int kfd_ioctl_unmap_memory_from_gpu(struct file *filep, + void *mem; + long err = 0; + uint32_t *devices_arr = NULL, i; ++ bool flush_tlb; + + if (!args->n_devices) { + pr_debug("Device IDs array empty\n"); +@@ -1389,16 +1390,19 @@ static int kfd_ioctl_unmap_memory_from_gpu(struct file *filep, + } + args->n_success = i+1; + } +- mutex_unlock(&p->mutex); + +- if (kfd_flush_tlb_after_unmap(pdd->dev)) { ++ flush_tlb = kfd_flush_tlb_after_unmap(pdd->dev); ++ if (flush_tlb) { + err = amdgpu_amdkfd_gpuvm_sync_memory(pdd->dev->adev, + (struct kgd_mem *) mem, true); + if (err) { + pr_debug("Sync memory failed, wait interrupted by user signal\n"); + goto sync_memory_failed; + } ++ } ++ mutex_unlock(&p->mutex); + ++ if (flush_tlb) { + /* Flush TLBs after waiting for the page table updates to complete */ + for (i = 0; i < args->n_devices; i++) { + peer_pdd = kfd_process_device_data_by_id(p, devices_arr[i]); +@@ -1414,9 +1418,9 @@ static int kfd_ioctl_unmap_memory_from_gpu(struct file *filep, + bind_process_to_device_failed: + get_mem_obj_from_handle_failed: + unmap_memory_from_gpu_failed: ++sync_memory_failed: + mutex_unlock(&p->mutex); + copy_from_user_failed: +-sync_memory_failed: + kfree(devices_arr); + return err; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-042-drm-amd-display-Fix-HDCP-failing-to-enable-aft.patch b/patches.kernel.org/6.2.10-042-drm-amd-display-Fix-HDCP-failing-to-enable-aft.patch new file mode 100644 index 0000000..1d6d7f3 --- /dev/null +++ b/patches.kernel.org/6.2.10-042-drm-amd-display-Fix-HDCP-failing-to-enable-aft.patch @@ -0,0 +1,49 @@ +From: Bhawanpreet Lakha +Date: Fri, 17 Feb 2023 16:08:21 -0500 +Subject: [PATCH] drm/amd/display: Fix HDCP failing to enable after suspend +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 728cefa53a36ba378ed4a7f31a0c08289687d824 + +[ Upstream commit 728cefa53a36ba378ed4a7f31a0c08289687d824 ] + +[Why] +On resume some displays are not ready for HDCP, so they will fail if we +start the hdcp authentintication too soon. + +Add a delay so that the displays can be ready before we start. + +NOTE: Previoulsy this delay was set to 3 seconds but it was causing +issues with compliance, 2 seconds should enough for compliance and the +s3 resume case. + +[How] +Change the Delay to 2 seconds. + +Reviewed-by: Aurabindo Pillai +Acked-by: Qingqing Zhuo +Signed-off-by: Bhawanpreet Lakha +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c +index a7fd98f5..dc62375a 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c +@@ -495,7 +495,7 @@ static void update_config(void *handle, struct cp_psp_stream_config *config) + link->dp.mst_enabled = config->mst_enabled; + link->dp.usb4_enabled = config->usb4_enabled; + display->adjust.disable = MOD_HDCP_DISPLAY_DISABLE_AUTHENTICATION; +- link->adjust.auth_delay = 0; ++ link->adjust.auth_delay = 2; + link->adjust.hdcp1.disable = 0; + conn_state = aconnector->base.state; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-043-net-hsr-Don-t-log-netdev_err-message-on-unknow.patch b/patches.kernel.org/6.2.10-043-net-hsr-Don-t-log-netdev_err-message-on-unknow.patch new file mode 100644 index 0000000..25fe65b --- /dev/null +++ b/patches.kernel.org/6.2.10-043-net-hsr-Don-t-log-netdev_err-message-on-unknow.patch @@ -0,0 +1,42 @@ +From: Kristian Overskeid +Date: Tue, 7 Mar 2023 14:32:29 +0100 +Subject: [PATCH] net: hsr: Don't log netdev_err message on unknown prp dst + node +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 28e8cabe80f3e6e3c98121576eda898eeb20f1b1 + +[ Upstream commit 28e8cabe80f3e6e3c98121576eda898eeb20f1b1 ] + +If no frames has been exchanged with a node for HSR_NODE_FORGET_TIME, the +node will be deleted from the node_db list. If a frame is sent to the node +after it is deleted, a netdev_err message for each slave interface is +produced. This should not happen with dan nodes because of supervision +frames, but can happen often with san nodes, which clutters the kernel +log. Since the hsr protocol does not support sans, this is only relevant +for the prp protocol. + +Signed-off-by: Kristian Overskeid +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/hsr/hsr_framereg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c +index 00db74d9..865eda39 100644 +--- a/net/hsr/hsr_framereg.c ++++ b/net/hsr/hsr_framereg.c +@@ -415,7 +415,7 @@ void hsr_addr_subst_dest(struct hsr_node *node_src, struct sk_buff *skb, + node_dst = find_node_by_addr_A(&port->hsr->node_db, + eth_hdr(skb)->h_dest); + if (!node_dst) { +- if (net_ratelimit()) ++ if (net_ratelimit() && port->hsr->prot_version != PRP_V1) + netdev_err(skb->dev, "%s: Unknown node\n", __func__); + return; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-044-ALSA-asihpi-check-pao-in-control_message.patch b/patches.kernel.org/6.2.10-044-ALSA-asihpi-check-pao-in-control_message.patch new file mode 100644 index 0000000..c528203 --- /dev/null +++ b/patches.kernel.org/6.2.10-044-ALSA-asihpi-check-pao-in-control_message.patch @@ -0,0 +1,73 @@ +From: Kuninori Morimoto +Date: Mon, 13 Mar 2023 00:49:24 +0000 +Subject: [PATCH] ALSA: asihpi: check pao in control_message() +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 9026c0bf233db53b86f74f4c620715e94eb32a09 + +[ Upstream commit 9026c0bf233db53b86f74f4c620715e94eb32a09 ] + +control_message() might be called with pao = NULL. +Here indicates control_message() as sample. + +(B) static void control_message(struct hpi_adapter_obj *pao, ...) + { ^^^ + struct hpi_hw_obj *phw = pao->priv; + ... ^^^ + } + +(A) void _HPI_6205(struct hpi_adapter_obj *pao, ...) + { ^^^ + ... + case HPI_OBJ_CONTROL: +(B) control_message(pao, phm, phr); + break; ^^^ + ... + } + + void HPI_6205(...) + { + ... +(A) _HPI_6205(NULL, phm, phr); + ... ^^^^ + } + +Therefore, We will get too many warning via cppcheck, like below + + sound/pci/asihpi/hpi6205.c:238:27: warning: Possible null pointer dereference: pao [nullPointer] + struct hpi_hw_obj *phw = pao->priv; + ^ + sound/pci/asihpi/hpi6205.c:433:13: note: Calling function '_HPI_6205', 1st argument 'NULL' value is 0 + _HPI_6205(NULL, phm, phr); + ^ + sound/pci/asihpi/hpi6205.c:401:20: note: Calling function 'control_message', 1st argument 'pao' value is 0 + control_message(pao, phm, phr); + ^ +Set phr->error like many functions doing, and don't call _HPI_6205() +with NULL. + +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/87ttypeaqz.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/pci/asihpi/hpi6205.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/asihpi/hpi6205.c b/sound/pci/asihpi/hpi6205.c +index 27e11b5f..c7d7eff8 100644 +--- a/sound/pci/asihpi/hpi6205.c ++++ b/sound/pci/asihpi/hpi6205.c +@@ -430,7 +430,7 @@ void HPI_6205(struct hpi_message *phm, struct hpi_response *phr) + pao = hpi_find_adapter(phm->adapter_index); + } else { + /* subsys messages don't address an adapter */ +- _HPI_6205(NULL, phm, phr); ++ phr->error = HPI_ERROR_INVALID_OBJ_INDEX; + return; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-045-ALSA-hda-ca0132-fixup-buffer-overrun-at-tuning.patch b/patches.kernel.org/6.2.10-045-ALSA-hda-ca0132-fixup-buffer-overrun-at-tuning.patch new file mode 100644 index 0000000..f146d16 --- /dev/null +++ b/patches.kernel.org/6.2.10-045-ALSA-hda-ca0132-fixup-buffer-overrun-at-tuning.patch @@ -0,0 +1,63 @@ +From: Kuninori Morimoto +Date: Mon, 13 Mar 2023 00:50:28 +0000 +Subject: [PATCH] ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 98e5eb110095ec77cb6d775051d181edbf9cd3cf + +[ Upstream commit 98e5eb110095ec77cb6d775051d181edbf9cd3cf ] + +tuning_ctl_set() might have buffer overrun at (X) if it didn't break +from loop by matching (A). + + static int tuning_ctl_set(...) + { + for (i = 0; i < TUNING_CTLS_COUNT; i++) +(A) if (nid == ca0132_tuning_ctls[i].nid) + break; + + snd_hda_power_up(...); +(X) dspio_set_param(..., ca0132_tuning_ctls[i].mid, ...); + snd_hda_power_down(...); ^ + + return 1; + } + +We will get below error by cppcheck + + sound/pci/hda/patch_ca0132.c:4229:2: note: After for loop, i has value 12 + for (i = 0; i < TUNING_CTLS_COUNT; i++) + ^ + sound/pci/hda/patch_ca0132.c:4234:43: note: Array index out of bounds + dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20, + ^ +This patch cares non match case. + +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/87sfe9eap7.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/pci/hda/patch_ca0132.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c +index acde4cd5..099722eb 100644 +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -4228,8 +4228,10 @@ static int tuning_ctl_set(struct hda_codec *codec, hda_nid_t nid, + + for (i = 0; i < TUNING_CTLS_COUNT; i++) + if (nid == ca0132_tuning_ctls[i].nid) +- break; ++ goto found; + ++ return -EINVAL; ++found: + snd_hda_power_up(codec); + dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20, + ca0132_tuning_ctls[i].req, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-046-fbdev-tgafb-Fix-potential-divide-by-zero.patch b/patches.kernel.org/6.2.10-046-fbdev-tgafb-Fix-potential-divide-by-zero.patch new file mode 100644 index 0000000..12b971a --- /dev/null +++ b/patches.kernel.org/6.2.10-046-fbdev-tgafb-Fix-potential-divide-by-zero.patch @@ -0,0 +1,45 @@ +From: Wei Chen +Date: Tue, 7 Mar 2023 13:08:56 +0000 +Subject: [PATCH] fbdev: tgafb: Fix potential divide by zero +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: f90bd245de82c095187d8c2cabb8b488a39eaecc + +[ Upstream commit f90bd245de82c095187d8c2cabb8b488a39eaecc ] + +fb_set_var would by called when user invokes ioctl with cmd +FBIOPUT_VSCREENINFO. User-provided data would finally reach +tgafb_check_var. In case var->pixclock is assigned to zero, +divide by zero would occur when checking whether reciprocal +of var->pixclock is too high. + +Similar crashes have happened in other fbdev drivers. There +is no check and modification on var->pixclock along the call +chain to tgafb_check_var. We believe it could also be triggered +in driver tgafb from user site. + +Signed-off-by: Wei Chen +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/video/fbdev/tgafb.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/video/fbdev/tgafb.c b/drivers/video/fbdev/tgafb.c +index 14d37c49..b4400488 100644 +--- a/drivers/video/fbdev/tgafb.c ++++ b/drivers/video/fbdev/tgafb.c +@@ -173,6 +173,9 @@ tgafb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) + { + struct tga_par *par = (struct tga_par *)info->par; + ++ if (!var->pixclock) ++ return -EINVAL; ++ + if (par->tga_type == TGA_TYPE_8PLANE) { + if (var->bits_per_pixel != 8) + return -EINVAL; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-047-ACPI-tools-pfrut-Check-if-the-input-of-level-a.patch b/patches.kernel.org/6.2.10-047-ACPI-tools-pfrut-Check-if-the-input-of-level-a.patch new file mode 100644 index 0000000..b23f5f4 --- /dev/null +++ b/patches.kernel.org/6.2.10-047-ACPI-tools-pfrut-Check-if-the-input-of-level-a.patch @@ -0,0 +1,98 @@ +From: Chen Yu +Date: Wed, 8 Mar 2023 21:23:09 +0800 +Subject: [PATCH] ACPI: tools: pfrut: Check if the input of level and type is + in the right numeric range +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 0bc23d8b2237a104d7f8379d687aa4cb82e2968b + +[ Upstream commit 0bc23d8b2237a104d7f8379d687aa4cb82e2968b ] + +The user provides arbitrary non-numeic value to level and type, +which could bring unexpected behavior. In this case the expected +behavior would be to throw an error. + + pfrut -h +usage: pfrut [OPTIONS] +code injection: +-l, --load +-s, --stage +-a, --activate +-u, --update [stage and activate] +-q, --query +-d, --revid +update telemetry: +-G, --getloginfo +-T, --type(0:execution, 1:history) +-L, --level(0, 1, 2, 4) +-R, --read +-D, --revid log + + pfrut -T A + pfrut -G +log_level:0 +log_type:0 +log_revid:2 +max_data_size:65536 +chunk1_size:0 +chunk2_size:1530 +rollover_cnt:0 +reset_cnt:17 + +Fix this by restricting the input to be in the expected range. + +Reported-by: Hariganesh Govindarajulu +Suggested-by: "Rafael J. Wysocki" +Signed-off-by: Chen Yu +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/power/acpi/tools/pfrut/pfrut.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +diff --git a/tools/power/acpi/tools/pfrut/pfrut.c b/tools/power/acpi/tools/pfrut/pfrut.c +index 52aa0351..388c9e3a 100644 +--- a/tools/power/acpi/tools/pfrut/pfrut.c ++++ b/tools/power/acpi/tools/pfrut/pfrut.c +@@ -97,7 +97,7 @@ static struct option long_options[] = { + static void parse_options(int argc, char **argv) + { + int option_index = 0; +- char *pathname; ++ char *pathname, *endptr; + int opt; + + pathname = strdup(argv[0]); +@@ -125,11 +125,23 @@ static void parse_options(int argc, char **argv) + log_getinfo = 1; + break; + case 'T': +- log_type = atoi(optarg); ++ log_type = strtol(optarg, &endptr, 0); ++ if (*endptr || (log_type != 0 && log_type != 1)) { ++ printf("Number expected: type(0:execution, 1:history) - Quit.\n"); ++ exit(1); ++ } ++ + set_log_type = 1; + break; + case 'L': +- log_level = atoi(optarg); ++ log_level = strtol(optarg, &endptr, 0); ++ if (*endptr || ++ (log_level != 0 && log_level != 1 && ++ log_level != 2 && log_level != 4)) { ++ printf("Number expected: level(0, 1, 2, 4) - Quit.\n"); ++ exit(1); ++ } ++ + set_log_level = 1; + break; + case 'R': +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-048-sched_getaffinity-don-t-assume-cpumask_size-is.patch b/patches.kernel.org/6.2.10-048-sched_getaffinity-don-t-assume-cpumask_size-is.patch new file mode 100644 index 0000000..c95f0e0 --- /dev/null +++ b/patches.kernel.org/6.2.10-048-sched_getaffinity-don-t-assume-cpumask_size-is.patch @@ -0,0 +1,84 @@ +From: Linus Torvalds +Date: Tue, 14 Mar 2023 19:32:38 -0700 +Subject: [PATCH] sched_getaffinity: don't assume 'cpumask_size()' is fully + initialized +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 6015b1aca1a233379625385feb01dd014aca60b5 + +[ Upstream commit 6015b1aca1a233379625385feb01dd014aca60b5 ] + +The getaffinity() system call uses 'cpumask_size()' to decide how big +the CPU mask is - so far so good. It is indeed the allocation size of a +cpumask. + +But the code also assumes that the whole allocation is initialized +without actually doing so itself. That's wrong, because we might have +fixed-size allocations (making copying and clearing more efficient), but +not all of it is then necessarily used if 'nr_cpu_ids' is smaller. + +Having checked other users of 'cpumask_size()', they all seem to be ok, +either using it purely for the allocation size, or explicitly zeroing +the cpumask before using the size in bytes to copy it. + +See for example the ublk_ctrl_get_queue_affinity() function that uses +the proper 'zalloc_cpumask_var()' to make sure that the whole mask is +cleared, whether the storage is on the stack or if it was an external +allocation. + +Fix this by just zeroing the allocation before using it. Do the same +for the compat version of sched_getaffinity(), which had the same logic. + +Also, for consistency, make sched_getaffinity() use 'cpumask_bits()' to +access the bits. For a cpumask_var_t, it ends up being a pointer to the +same data either way, but it's just a good idea to treat it like you +would a 'cpumask_t'. The compat case already did that. + +Reported-by: Ryan Roberts +Link: https://lore.kernel.org/lkml/7d026744-6bd6-6827-0471-b5e8eae0be3f@arm.com/ +Cc: Yury Norov +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/compat.c | 2 +- + kernel/sched/core.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/kernel/compat.c b/kernel/compat.c +index 55551989..fb50f29d 100644 +--- a/kernel/compat.c ++++ b/kernel/compat.c +@@ -152,7 +152,7 @@ COMPAT_SYSCALL_DEFINE3(sched_getaffinity, compat_pid_t, pid, unsigned int, len, + if (len & (sizeof(compat_ulong_t)-1)) + return -EINVAL; + +- if (!alloc_cpumask_var(&mask, GFP_KERNEL)) ++ if (!zalloc_cpumask_var(&mask, GFP_KERNEL)) + return -ENOMEM; + + ret = sched_getaffinity(pid, mask); +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 9a069835..57d84b53 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -8404,14 +8404,14 @@ SYSCALL_DEFINE3(sched_getaffinity, pid_t, pid, unsigned int, len, + if (len & (sizeof(unsigned long)-1)) + return -EINVAL; + +- if (!alloc_cpumask_var(&mask, GFP_KERNEL)) ++ if (!zalloc_cpumask_var(&mask, GFP_KERNEL)) + return -ENOMEM; + + ret = sched_getaffinity(pid, mask); + if (ret == 0) { + unsigned int retlen = min(len, cpumask_size()); + +- if (copy_to_user(user_mask_ptr, mask, retlen)) ++ if (copy_to_user(user_mask_ptr, cpumask_bits(mask), retlen)) + ret = -EFAULT; + else + ret = retlen; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-049-nvme-pci-fixing-memory-leak-in-probe-teardown-.patch b/patches.kernel.org/6.2.10-049-nvme-pci-fixing-memory-leak-in-probe-teardown-.patch new file mode 100644 index 0000000..6b0ffcf --- /dev/null +++ b/patches.kernel.org/6.2.10-049-nvme-pci-fixing-memory-leak-in-probe-teardown-.patch @@ -0,0 +1,35 @@ +From: Irvin Cote +Date: Wed, 8 Mar 2023 18:05:08 -0300 +Subject: [PATCH] nvme-pci: fixing memory leak in probe teardown path +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: a61d265533b7fe0026a02a49916aa564ffe38e4c + +[ Upstream commit a61d265533b7fe0026a02a49916aa564ffe38e4c ] + +In case the nvme_probe teardown path is triggered the ctrl ref count does +not reach 0 thus creating a memory leak upon failure of nvme_probe. + +Signed-off-by: Irvin Cote +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/nvme/host/pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 29c902b9..c51ebbee 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -3126,6 +3126,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id) + nvme_dev_unmap(dev); + out_uninit_ctrl: + nvme_uninit_ctrl(&dev->ctrl); ++ nvme_put_ctrl(&dev->ctrl); + return result; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-050-nvme-pci-add-NVME_QUIRK_BOGUS_NID-for-Lexar-NM.patch b/patches.kernel.org/6.2.10-050-nvme-pci-add-NVME_QUIRK_BOGUS_NID-for-Lexar-NM.patch new file mode 100644 index 0000000..b1d719c --- /dev/null +++ b/patches.kernel.org/6.2.10-050-nvme-pci-add-NVME_QUIRK_BOGUS_NID-for-Lexar-NM.patch @@ -0,0 +1,36 @@ +From: Philipp Geulen +Date: Mon, 13 Mar 2023 11:11:50 +0100 +Subject: [PATCH] nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM620 +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: b65d44fa0fe072c91bf41cd8756baa2b4c77eff2 + +[ Upstream commit b65d44fa0fe072c91bf41cd8756baa2b4c77eff2 ] + +Added a quirk to fix Lexar NM620 1TB SSD reporting duplicate NGUIDs. + +Signed-off-by: Philipp Geulen +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/nvme/host/pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index c51ebbee..ea3f0806 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -3491,6 +3491,8 @@ static const struct pci_device_id nvme_id_table[] = { + .driver_data = NVME_QUIRK_BOGUS_NID, }, + { PCI_DEVICE(0x1d97, 0x2263), /* Lexar NM610 */ + .driver_data = NVME_QUIRK_BOGUS_NID, }, ++ { PCI_DEVICE(0x1d97, 0x1d97), /* Lexar NM620 */ ++ .driver_data = NVME_QUIRK_BOGUS_NID, }, + { PCI_DEVICE(0x1d97, 0x2269), /* Lexar NM760 */ + .driver_data = NVME_QUIRK_BOGUS_NID, }, + { PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0x0061), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-051-drm-amdkfd-Fixed-kfd_process-cleanup-on-module.patch b/patches.kernel.org/6.2.10-051-drm-amdkfd-Fixed-kfd_process-cleanup-on-module.patch new file mode 100644 index 0000000..963388d --- /dev/null +++ b/patches.kernel.org/6.2.10-051-drm-amdkfd-Fixed-kfd_process-cleanup-on-module.patch @@ -0,0 +1,151 @@ +From: David Belanger +Date: Tue, 28 Feb 2023 14:11:24 -0500 +Subject: [PATCH] drm/amdkfd: Fixed kfd_process cleanup on module exit. +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 20bc9f76b6a2455c6b54b91ae7634f147f64987f + +[ Upstream commit 20bc9f76b6a2455c6b54b91ae7634f147f64987f ] + +Handle case when module is unloaded (kfd_exit) before a process space +(mm_struct) is released. + +v2: Fixed potential race conditions by removing all kfd_process from +the process table first, then working on releasing the resources. + +v3: Fixed loop element access / synchronization. Fixed extra empty lines. + +Signed-off-by: David Belanger +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdkfd/kfd_module.c | 1 + + drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 1 + + drivers/gpu/drm/amd/amdkfd/kfd_process.c | 67 +++++++++++++++++++++--- + 3 files changed, 62 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_module.c b/drivers/gpu/drm/amd/amdkfd/kfd_module.c +index 09b966dc..aee2212e 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_module.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_module.c +@@ -77,6 +77,7 @@ static int kfd_init(void) + + static void kfd_exit(void) + { ++ kfd_cleanup_processes(); + kfd_debugfs_fini(); + kfd_process_destroy_wq(); + kfd_procfs_shutdown(); +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h +index 552c3ac8..7dc55919 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h +@@ -926,6 +926,7 @@ bool kfd_dev_is_large_bar(struct kfd_dev *dev); + + int kfd_process_create_wq(void); + void kfd_process_destroy_wq(void); ++void kfd_cleanup_processes(void); + struct kfd_process *kfd_create_process(struct file *filep); + struct kfd_process *kfd_get_process(const struct task_struct *task); + struct kfd_process *kfd_lookup_process_by_pasid(u32 pasid); +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +index 51b1683a..4d9f2d1c 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +@@ -1167,6 +1167,17 @@ static void kfd_process_free_notifier(struct mmu_notifier *mn) + kfd_unref_process(container_of(mn, struct kfd_process, mmu_notifier)); + } + ++static void kfd_process_notifier_release_internal(struct kfd_process *p) ++{ ++ cancel_delayed_work_sync(&p->eviction_work); ++ cancel_delayed_work_sync(&p->restore_work); ++ ++ /* Indicate to other users that MM is no longer valid */ ++ p->mm = NULL; ++ ++ mmu_notifier_put(&p->mmu_notifier); ++} ++ + static void kfd_process_notifier_release(struct mmu_notifier *mn, + struct mm_struct *mm) + { +@@ -1181,17 +1192,22 @@ static void kfd_process_notifier_release(struct mmu_notifier *mn, + return; + + mutex_lock(&kfd_processes_mutex); ++ /* ++ * Do early return if table is empty. ++ * ++ * This could potentially happen if this function is called concurrently ++ * by mmu_notifier and by kfd_cleanup_pocesses. ++ * ++ */ ++ if (hash_empty(kfd_processes_table)) { ++ mutex_unlock(&kfd_processes_mutex); ++ return; ++ } + hash_del_rcu(&p->kfd_processes); + mutex_unlock(&kfd_processes_mutex); + synchronize_srcu(&kfd_processes_srcu); + +- cancel_delayed_work_sync(&p->eviction_work); +- cancel_delayed_work_sync(&p->restore_work); +- +- /* Indicate to other users that MM is no longer valid */ +- p->mm = NULL; +- +- mmu_notifier_put(&p->mmu_notifier); ++ kfd_process_notifier_release_internal(p); + } + + static const struct mmu_notifier_ops kfd_process_mmu_notifier_ops = { +@@ -1200,6 +1216,43 @@ static const struct mmu_notifier_ops kfd_process_mmu_notifier_ops = { + .free_notifier = kfd_process_free_notifier, + }; + ++/* ++ * This code handles the case when driver is being unloaded before all ++ * mm_struct are released. We need to safely free the kfd_process and ++ * avoid race conditions with mmu_notifier that might try to free them. ++ * ++ */ ++void kfd_cleanup_processes(void) ++{ ++ struct kfd_process *p; ++ struct hlist_node *p_temp; ++ unsigned int temp; ++ HLIST_HEAD(cleanup_list); ++ ++ /* ++ * Move all remaining kfd_process from the process table to a ++ * temp list for processing. Once done, callback from mmu_notifier ++ * release will not see the kfd_process in the table and do early return, ++ * avoiding double free issues. ++ */ ++ mutex_lock(&kfd_processes_mutex); ++ hash_for_each_safe(kfd_processes_table, temp, p_temp, p, kfd_processes) { ++ hash_del_rcu(&p->kfd_processes); ++ synchronize_srcu(&kfd_processes_srcu); ++ hlist_add_head(&p->kfd_processes, &cleanup_list); ++ } ++ mutex_unlock(&kfd_processes_mutex); ++ ++ hlist_for_each_entry_safe(p, p_temp, &cleanup_list, kfd_processes) ++ kfd_process_notifier_release_internal(p); ++ ++ /* ++ * Ensures that all outstanding free_notifier get called, triggering ++ * the release of the kfd_process struct. ++ */ ++ mmu_notifier_synchronize(); ++} ++ + static int kfd_process_init_cwsr_apu(struct kfd_process *p, struct file *filep) + { + unsigned long offset; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-052-net-mlx5e-Lower-maximum-allowed-MTU-in-XSK-to-.patch b/patches.kernel.org/6.2.10-052-net-mlx5e-Lower-maximum-allowed-MTU-in-XSK-to-.patch new file mode 100644 index 0000000..225c34d --- /dev/null +++ b/patches.kernel.org/6.2.10-052-net-mlx5e-Lower-maximum-allowed-MTU-in-XSK-to-.patch @@ -0,0 +1,73 @@ +From: Adham Faris +Date: Mon, 23 Jan 2023 10:09:01 +0200 +Subject: [PATCH] net/mlx5e: Lower maximum allowed MTU in XSK to match XDP + prerequisites +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 78dee7befd56987283c13877b834c0aa97ad51b9 + +[ Upstream commit 78dee7befd56987283c13877b834c0aa97ad51b9 ] + +XSK redirecting XDP programs require linearity, hence applies +restrictions on the MTU. For PAGE_SIZE=4K, MTU shouldn't exceed 3498. + +Features that contradict with XDP such HW-LRO and HW-GRO are enforced +by the driver in advance, during XSK params validation, except for MTU, +which was not enforced before this patch. + +This has been spotted during test scenario described below: +Attaching xdpsock program (PAGE_SIZE=4K), with MTU < 3498, detaching +XDP program, changing the MTU to arbitrary value in the range +[3499, 3754], attaching XDP program again, which ended up with failure +since MTU is > 3498. + +This commit lowers the XSK MTU limitation to be aligned with XDP MTU +limitation, since XSK socket is meaningless without XDP program. + +Signed-off-by: Adham Faris +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 47d4b54d..1f4233b2 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -4117,13 +4117,17 @@ static bool mlx5e_xsk_validate_mtu(struct net_device *netdev, + struct xsk_buff_pool *xsk_pool = + mlx5e_xsk_get_pool(&chs->params, chs->params.xsk, ix); + struct mlx5e_xsk_param xsk; ++ int max_xdp_mtu; + + if (!xsk_pool) + continue; + + mlx5e_build_xsk_param(xsk_pool, &xsk); ++ max_xdp_mtu = mlx5e_xdp_max_mtu(new_params, &xsk); + +- if (!mlx5e_validate_xsk_param(new_params, &xsk, mdev)) { ++ /* Validate XSK params and XDP MTU in advance */ ++ if (!mlx5e_validate_xsk_param(new_params, &xsk, mdev) || ++ new_params->sw_mtu > max_xdp_mtu) { + u32 hr = mlx5e_get_linear_rq_headroom(new_params, &xsk); + int max_mtu_frame, max_mtu_page, max_mtu; + +@@ -4133,9 +4137,9 @@ static bool mlx5e_xsk_validate_mtu(struct net_device *netdev, + */ + max_mtu_frame = MLX5E_HW2SW_MTU(new_params, xsk.chunk_size - hr); + max_mtu_page = MLX5E_HW2SW_MTU(new_params, SKB_MAX_HEAD(0)); +- max_mtu = min(max_mtu_frame, max_mtu_page); ++ max_mtu = min3(max_mtu_frame, max_mtu_page, max_xdp_mtu); + +- netdev_err(netdev, "MTU %d is too big for an XSK running on channel %u. Try MTU <= %d\n", ++ netdev_err(netdev, "MTU %d is too big for an XSK running on channel %u or its redirection XDP program. Try MTU <= %d\n", + new_params->sw_mtu, ix, max_mtu); + return false; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-053-fbdev-nvidia-Fix-potential-divide-by-zero.patch b/patches.kernel.org/6.2.10-053-fbdev-nvidia-Fix-potential-divide-by-zero.patch new file mode 100644 index 0000000..c5165f2 --- /dev/null +++ b/patches.kernel.org/6.2.10-053-fbdev-nvidia-Fix-potential-divide-by-zero.patch @@ -0,0 +1,41 @@ +From: Wei Chen +Date: Wed, 15 Mar 2023 07:18:31 +0000 +Subject: [PATCH] fbdev: nvidia: Fix potential divide by zero +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 92e2a00f2987483e1f9253625828622edd442e61 + +[ Upstream commit 92e2a00f2987483e1f9253625828622edd442e61 ] + +variable var->pixclock can be set by user. In case it +equals to zero, divide by zero would occur in nvidiafb_set_par. + +Similar crashes have happened in other fbdev drivers. There +is no check and modification on var->pixclock along the call +chain to nvidia_check_var and nvidiafb_set_par. We believe it +could also be triggered in driver nvidia from user site. + +Signed-off-by: Wei Chen +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/video/fbdev/nvidia/nvidia.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/video/fbdev/nvidia/nvidia.c b/drivers/video/fbdev/nvidia/nvidia.c +index e60a276b..ea4ba3df 100644 +--- a/drivers/video/fbdev/nvidia/nvidia.c ++++ b/drivers/video/fbdev/nvidia/nvidia.c +@@ -764,6 +764,8 @@ static int nvidiafb_check_var(struct fb_var_screeninfo *var, + int pitch, err = 0; + + NVTRACE_ENTER(); ++ if (!var->pixclock) ++ return -EINVAL; + + var->transp.offset = 0; + var->transp.length = 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-054-fbdev-intelfb-Fix-potential-divide-by-zero.patch b/patches.kernel.org/6.2.10-054-fbdev-intelfb-Fix-potential-divide-by-zero.patch new file mode 100644 index 0000000..9382e3a --- /dev/null +++ b/patches.kernel.org/6.2.10-054-fbdev-intelfb-Fix-potential-divide-by-zero.patch @@ -0,0 +1,40 @@ +From: Wei Chen +Date: Wed, 15 Mar 2023 08:33:47 +0000 +Subject: [PATCH] fbdev: intelfb: Fix potential divide by zero +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: d823685486a3446d061fed7c7d2f80af984f119a + +[ Upstream commit d823685486a3446d061fed7c7d2f80af984f119a ] + +Variable var->pixclock is controlled by user and can be assigned +to zero. Without proper check, divide by zero would occur in +intelfbhw_validate_mode and intelfbhw_mode_to_hw. + +Error out if var->pixclock is zero. + +Signed-off-by: Wei Chen +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/video/fbdev/intelfb/intelfbdrv.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/video/fbdev/intelfb/intelfbdrv.c b/drivers/video/fbdev/intelfb/intelfbdrv.c +index 0a9e5067..a81095b2 100644 +--- a/drivers/video/fbdev/intelfb/intelfbdrv.c ++++ b/drivers/video/fbdev/intelfb/intelfbdrv.c +@@ -1222,6 +1222,9 @@ static int intelfb_check_var(struct fb_var_screeninfo *var, + + dinfo = GET_DINFO(info); + ++ if (!var->pixclock) ++ return -EINVAL; ++ + /* update the pitch */ + if (intelfbhw_validate_mode(dinfo, var) != 0) + return -EINVAL; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-055-fbdev-lxfb-Fix-potential-divide-by-zero.patch b/patches.kernel.org/6.2.10-055-fbdev-lxfb-Fix-potential-divide-by-zero.patch new file mode 100644 index 0000000..99035de --- /dev/null +++ b/patches.kernel.org/6.2.10-055-fbdev-lxfb-Fix-potential-divide-by-zero.patch @@ -0,0 +1,39 @@ +From: Wei Chen +Date: Wed, 15 Mar 2023 09:05:18 +0000 +Subject: [PATCH] fbdev: lxfb: Fix potential divide by zero +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 61ac4b86a4c047c20d5cb423ddd87496f14d9868 + +[ Upstream commit 61ac4b86a4c047c20d5cb423ddd87496f14d9868 ] + +var->pixclock can be assigned to zero by user. Without proper +check, divide by zero would occur in lx_set_clock. + +Error out if var->pixclock is zero. + +Signed-off-by: Wei Chen +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/video/fbdev/geode/lxfb_core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/video/fbdev/geode/lxfb_core.c b/drivers/video/fbdev/geode/lxfb_core.c +index 8130e9ee..556d8b1a 100644 +--- a/drivers/video/fbdev/geode/lxfb_core.c ++++ b/drivers/video/fbdev/geode/lxfb_core.c +@@ -235,6 +235,9 @@ static void get_modedb(struct fb_videomode **modedb, unsigned int *size) + + static int lxfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) + { ++ if (!var->pixclock) ++ return -EINVAL; ++ + if (var->xres > 1920 || var->yres > 1440) + return -EINVAL; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-056-fbdev-au1200fb-Fix-potential-divide-by-zero.patch b/patches.kernel.org/6.2.10-056-fbdev-au1200fb-Fix-potential-divide-by-zero.patch new file mode 100644 index 0000000..e07a517 --- /dev/null +++ b/patches.kernel.org/6.2.10-056-fbdev-au1200fb-Fix-potential-divide-by-zero.patch @@ -0,0 +1,40 @@ +From: Wei Chen +Date: Wed, 15 Mar 2023 09:22:54 +0000 +Subject: [PATCH] fbdev: au1200fb: Fix potential divide by zero +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 44a3b36b42acfc433aaaf526191dd12fbb919fdb + +[ Upstream commit 44a3b36b42acfc433aaaf526191dd12fbb919fdb ] + +var->pixclock can be assigned to zero by user. Without +proper check, divide by zero would occur when invoking +macro PICOS2KHZ in au1200fb_fb_check_var. + +Error out if var->pixclock is zero. + +Signed-off-by: Wei Chen +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/video/fbdev/au1200fb.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/video/fbdev/au1200fb.c b/drivers/video/fbdev/au1200fb.c +index 81c31545..b6b22fa4 100644 +--- a/drivers/video/fbdev/au1200fb.c ++++ b/drivers/video/fbdev/au1200fb.c +@@ -1040,6 +1040,9 @@ static int au1200fb_fb_check_var(struct fb_var_screeninfo *var, + u32 pixclock; + int screen_size, plane; + ++ if (!var->pixclock) ++ return -EINVAL; ++ + plane = fbdev->plane; + + /* Make sure that the mode respect all LCD controller and +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-057-tools-power-turbostat-Fix-dev-cpu_dma_latency-.patch b/patches.kernel.org/6.2.10-057-tools-power-turbostat-Fix-dev-cpu_dma_latency-.patch new file mode 100644 index 0000000..8cb53f0 --- /dev/null +++ b/patches.kernel.org/6.2.10-057-tools-power-turbostat-Fix-dev-cpu_dma_latency-.patch @@ -0,0 +1,59 @@ +From: Prarit Bhargava +Date: Thu, 15 Dec 2022 10:18:16 -0500 +Subject: [PATCH] tools/power turbostat: Fix /dev/cpu_dma_latency warnings +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 40aafc7d58d3544f152a863a0e9863014b6d5d8c + +[ Upstream commit 40aafc7d58d3544f152a863a0e9863014b6d5d8c ] + +When running as non-root the following error is seen in turbostat: + +turbostat: fopen /dev/cpu_dma_latency +: Permission denied + +turbostat and the man page have information on how to avoid other +permission errors, so these can be fixed the same way. + +Provide better /dev/cpu_dma_latency warnings that provide instructions on +how to avoid the error, and update the man page. + +Signed-off-by: Prarit Bhargava +Cc: linux-pm@vger.kernel.org +Signed-off-by: Len Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/power/x86/turbostat/turbostat.8 | 2 ++ + tools/power/x86/turbostat/turbostat.c | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/power/x86/turbostat/turbostat.8 b/tools/power/x86/turbostat/turbostat.8 +index c7b26a36..3e1a4c4b 100644 +--- a/tools/power/x86/turbostat/turbostat.8 ++++ b/tools/power/x86/turbostat/turbostat.8 +@@ -344,6 +344,8 @@ Alternatively, non-root users can be enabled to run turbostat this way: + + # chmod +r /dev/cpu/*/msr + ++# chmod +r /dev/cpu_dma_latency ++ + .B "turbostat " + reads hardware counters, but doesn't write them. + So it will not interfere with the OS or other programs, including +diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c +index aba46041..c24054e3 100644 +--- a/tools/power/x86/turbostat/turbostat.c ++++ b/tools/power/x86/turbostat/turbostat.c +@@ -5482,7 +5482,7 @@ void print_dev_latency(void) + + retval = read(fd, (void *)&value, sizeof(int)); + if (retval != sizeof(int)) { +- warn("read %s\n", path); ++ warn("read failed %s\n", path); + close(fd); + return; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-058-tools-power-turbostat-fix-decoding-of-HWP_STAT.patch b/patches.kernel.org/6.2.10-058-tools-power-turbostat-fix-decoding-of-HWP_STAT.patch new file mode 100644 index 0000000..24a7bb5 --- /dev/null +++ b/patches.kernel.org/6.2.10-058-tools-power-turbostat-fix-decoding-of-HWP_STAT.patch @@ -0,0 +1,38 @@ +From: Antti Laakso +Date: Wed, 25 Jan 2023 15:17:50 +0200 +Subject: [PATCH] tools/power turbostat: fix decoding of HWP_STATUS +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 92c25393586ac799b9b7d9e50434f3c44a7622c4 + +[ Upstream commit 92c25393586ac799b9b7d9e50434f3c44a7622c4 ] + +The "excursion to minimum" information is in bit2 +in HWP_STATUS MSR. Fix the bitmask used for +decoding the register. + +Signed-off-by: Antti Laakso +Reviewed-by: Artem Bityutskiy +Signed-off-by: Len Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/power/x86/turbostat/turbostat.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c +index c24054e3..c61c6c70 100644 +--- a/tools/power/x86/turbostat/turbostat.c ++++ b/tools/power/x86/turbostat/turbostat.c +@@ -4426,7 +4426,7 @@ int print_hwp(struct thread_data *t, struct core_data *c, struct pkg_data *p) + + fprintf(outf, "cpu%d: MSR_HWP_STATUS: 0x%08llx " + "(%sGuaranteed_Perf_Change, %sExcursion_Min)\n", +- cpu, msr, ((msr) & 0x1) ? "" : "No-", ((msr) & 0x2) ? "" : "No-"); ++ cpu, msr, ((msr) & 0x1) ? "" : "No-", ((msr) & 0x4) ? "" : "No-"); + + return 0; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-059-tracing-Fix-wrong-return-in-kprobe_event_gen_t.patch b/patches.kernel.org/6.2.10-059-tracing-Fix-wrong-return-in-kprobe_event_gen_t.patch new file mode 100644 index 0000000..c0f0823 --- /dev/null +++ b/patches.kernel.org/6.2.10-059-tracing-Fix-wrong-return-in-kprobe_event_gen_t.patch @@ -0,0 +1,54 @@ +From: Anton Gusev +Date: Tue, 31 Jan 2023 10:58:18 +0300 +Subject: [PATCH] tracing: Fix wrong return in kprobe_event_gen_test.c +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: bc4f359b3b607daac0290d0038561237a86b38cb + +[ Upstream commit bc4f359b3b607daac0290d0038561237a86b38cb ] + +Overwriting the error code with the deletion result may cause the +function to return 0 despite encountering an error. Commit b111545d26c0 +("tracing: Remove the useless value assignment in +test_create_synth_event()") solves a similar issue by +returning the original error code, so this patch does the same. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Link: https://lore.kernel.org/linux-trace-kernel/20230131075818.5322-1-aagusev@ispras.ru + +Signed-off-by: Anton Gusev +Reviewed-by: Steven Rostedt (Google) +Acked-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/trace/kprobe_event_gen_test.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/kprobe_event_gen_test.c b/kernel/trace/kprobe_event_gen_test.c +index c736487f..e0c420eb 100644 +--- a/kernel/trace/kprobe_event_gen_test.c ++++ b/kernel/trace/kprobe_event_gen_test.c +@@ -146,7 +146,7 @@ static int __init test_gen_kprobe_cmd(void) + if (trace_event_file_is_valid(gen_kprobe_test)) + gen_kprobe_test = NULL; + /* We got an error after creating the event, delete it */ +- ret = kprobe_event_delete("gen_kprobe_test"); ++ kprobe_event_delete("gen_kprobe_test"); + goto out; + } + +@@ -211,7 +211,7 @@ static int __init test_gen_kretprobe_cmd(void) + if (trace_event_file_is_valid(gen_kretprobe_test)) + gen_kretprobe_test = NULL; + /* We got an error after creating the event, delete it */ +- ret = kprobe_event_delete("gen_kretprobe_test"); ++ kprobe_event_delete("gen_kretprobe_test"); + goto out; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-060-btrfs-fix-uninitialized-variable-warning-in-bt.patch b/patches.kernel.org/6.2.10-060-btrfs-fix-uninitialized-variable-warning-in-bt.patch new file mode 100644 index 0000000..cc0597d --- /dev/null +++ b/patches.kernel.org/6.2.10-060-btrfs-fix-uninitialized-variable-warning-in-bt.patch @@ -0,0 +1,43 @@ +From: Josef Bacik +Date: Fri, 16 Dec 2022 15:15:54 -0500 +Subject: [PATCH] btrfs: fix uninitialized variable warning in + btrfs_update_block_group +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: efbf35a102b20246cfe4409c6ae92e72ecb67ab8 + +[ Upstream commit efbf35a102b20246cfe4409c6ae92e72ecb67ab8 ] + +reclaim isn't set in the alloc case, however we only care about +reclaim in the !alloc case. This isn't an actual problem, however +-Wmaybe-uninitialized will complain, so initialize reclaim to quiet the +compiler. + +Reviewed-by: Qu Wenruo +Reviewed-by: Johannes Thumshirn +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Stable-dep-of: df384da5a49c ("btrfs: use temporary variable for space_info in btrfs_update_block_group") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/btrfs/block-group.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c +index 8eb62531..f40e56d4 100644 +--- a/fs/btrfs/block-group.c ++++ b/fs/btrfs/block-group.c +@@ -3336,7 +3336,7 @@ int btrfs_update_block_group(struct btrfs_trans_handle *trans, + spin_unlock(&info->delalloc_root_lock); + + while (total) { +- bool reclaim; ++ bool reclaim = false; + + cache = btrfs_lookup_block_group(info, bytenr); + if (!cache) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-061-btrfs-use-temporary-variable-for-space_info-in.patch b/patches.kernel.org/6.2.10-061-btrfs-use-temporary-variable-for-space_info-in.patch new file mode 100644 index 0000000..54ff9bb --- /dev/null +++ b/patches.kernel.org/6.2.10-061-btrfs-use-temporary-variable-for-space_info-in.patch @@ -0,0 +1,95 @@ +From: Josef Bacik +Date: Wed, 1 Mar 2023 16:14:43 -0500 +Subject: [PATCH] btrfs: use temporary variable for space_info in + btrfs_update_block_group +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: df384da5a49cace5c5e3100803dfd563fd982f93 + +[ Upstream commit df384da5a49cace5c5e3100803dfd563fd982f93 ] + +We do + + cache->space_info->counter += num_bytes; + +everywhere in here. This is makes the lines longer than they need to +be, and will be especially noticeable when we add the active tracking in, +so add a temp variable for the space_info so this is cleaner. + +Reviewed-by: Naohiro Aota +Reviewed-by: Johannes Thumshirn +Reviewed-by: Anand Jain +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/btrfs/block-group.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c +index f40e56d4..c70a888b 100644 +--- a/fs/btrfs/block-group.c ++++ b/fs/btrfs/block-group.c +@@ -3336,6 +3336,7 @@ int btrfs_update_block_group(struct btrfs_trans_handle *trans, + spin_unlock(&info->delalloc_root_lock); + + while (total) { ++ struct btrfs_space_info *space_info; + bool reclaim = false; + + cache = btrfs_lookup_block_group(info, bytenr); +@@ -3343,6 +3344,7 @@ int btrfs_update_block_group(struct btrfs_trans_handle *trans, + ret = -ENOENT; + break; + } ++ space_info = cache->space_info; + factor = btrfs_bg_type_to_factor(cache->flags); + + /* +@@ -3357,7 +3359,7 @@ int btrfs_update_block_group(struct btrfs_trans_handle *trans, + byte_in_group = bytenr - cache->start; + WARN_ON(byte_in_group > cache->length); + +- spin_lock(&cache->space_info->lock); ++ spin_lock(&space_info->lock); + spin_lock(&cache->lock); + + if (btrfs_test_opt(info, SPACE_CACHE) && +@@ -3370,23 +3372,23 @@ int btrfs_update_block_group(struct btrfs_trans_handle *trans, + old_val += num_bytes; + cache->used = old_val; + cache->reserved -= num_bytes; +- cache->space_info->bytes_reserved -= num_bytes; +- cache->space_info->bytes_used += num_bytes; +- cache->space_info->disk_used += num_bytes * factor; ++ space_info->bytes_reserved -= num_bytes; ++ space_info->bytes_used += num_bytes; ++ space_info->disk_used += num_bytes * factor; + spin_unlock(&cache->lock); +- spin_unlock(&cache->space_info->lock); ++ spin_unlock(&space_info->lock); + } else { + old_val -= num_bytes; + cache->used = old_val; + cache->pinned += num_bytes; +- btrfs_space_info_update_bytes_pinned(info, +- cache->space_info, num_bytes); +- cache->space_info->bytes_used -= num_bytes; +- cache->space_info->disk_used -= num_bytes * factor; ++ btrfs_space_info_update_bytes_pinned(info, space_info, ++ num_bytes); ++ space_info->bytes_used -= num_bytes; ++ space_info->disk_used -= num_bytes * factor; + + reclaim = should_reclaim_block_group(cache, num_bytes); + spin_unlock(&cache->lock); +- spin_unlock(&cache->space_info->lock); ++ spin_unlock(&space_info->lock); + + set_extent_dirty(&trans->transaction->pinned_extents, + bytenr, bytenr + num_bytes - 1, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-062-mtd-rawnand-meson-initialize-struct-with-zeroe.patch b/patches.kernel.org/6.2.10-062-mtd-rawnand-meson-initialize-struct-with-zeroe.patch new file mode 100644 index 0000000..e05d703 --- /dev/null +++ b/patches.kernel.org/6.2.10-062-mtd-rawnand-meson-initialize-struct-with-zeroe.patch @@ -0,0 +1,60 @@ +From: Arseniy Krasnov +Date: Mon, 27 Feb 2023 13:24:25 +0300 +Subject: [PATCH] mtd: rawnand: meson: initialize struct with zeroes +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 4ce341de6c02d02aba7c78a6447ccfcaa9eeb328 + +[ Upstream commit 4ce341de6c02d02aba7c78a6447ccfcaa9eeb328 ] + +This structure must be zeroed, because it's field 'hw->core' is used as +'parent' in 'clk_core_fill_parent_index()', but it will be uninitialized. +This happens, because when this struct is not zeroed, pointer 'hw' is +"initialized" by garbage, which is valid pointer, but points to some +garbage. So 'hw' will be dereferenced, but 'core' contains some random +data which will be interpreted as a pointer. The following backtrace is +result of dereference of such pointer: + +[ 1.081319] __clk_register+0x414/0x820 +[ 1.085113] devm_clk_register+0x64/0xd0 +[ 1.088995] meson_nfc_probe+0x258/0x6ec +[ 1.092875] platform_probe+0x70/0xf0 +[ 1.096498] really_probe+0xc8/0x3e0 +[ 1.100034] __driver_probe_device+0x84/0x190 +[ 1.104346] driver_probe_device+0x44/0x120 +[ 1.108487] __driver_attach+0xb4/0x220 +[ 1.112282] bus_for_each_dev+0x78/0xd0 +[ 1.116077] driver_attach+0x2c/0x40 +[ 1.119613] bus_add_driver+0x184/0x240 +[ 1.123408] driver_register+0x80/0x140 +[ 1.127203] __platform_driver_register+0x30/0x40 +[ 1.131860] meson_nfc_driver_init+0x24/0x30 + +Fixes: 1e4d3ba66888 ("mtd: rawnand: meson: fix the clock") +Signed-off-by: Arseniy Krasnov +Acked-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230227102425.793841-1-AVKrasnov@sberdevices.ru +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/mtd/nand/raw/meson_nand.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c +index 5ee01231..30e326ad 100644 +--- a/drivers/mtd/nand/raw/meson_nand.c ++++ b/drivers/mtd/nand/raw/meson_nand.c +@@ -991,7 +991,7 @@ static const struct mtd_ooblayout_ops meson_ooblayout_ops = { + + static int meson_nfc_clk_init(struct meson_nfc *nfc) + { +- struct clk_parent_data nfc_divider_parent_data[1]; ++ struct clk_parent_data nfc_divider_parent_data[1] = {0}; + struct clk_init_data init = {0}; + int ret; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-063-mtd-nand-mxic-ecc-Fix-mxic_ecc_data_xfer_wait_.patch b/patches.kernel.org/6.2.10-063-mtd-nand-mxic-ecc-Fix-mxic_ecc_data_xfer_wait_.patch new file mode 100644 index 0000000..636a9b1 --- /dev/null +++ b/patches.kernel.org/6.2.10-063-mtd-nand-mxic-ecc-Fix-mxic_ecc_data_xfer_wait_.patch @@ -0,0 +1,45 @@ +From: Christophe JAILLET +Date: Wed, 15 Feb 2023 12:08:45 +0100 +Subject: [PATCH] mtd: nand: mxic-ecc: Fix + mxic_ecc_data_xfer_wait_for_completion() when irq is used +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 75dce6a941e3f16c3b4878c8b2f46d5d07c619ce + +[ Upstream commit 75dce6a941e3f16c3b4878c8b2f46d5d07c619ce ] + +wait_for_completion_timeout() and readl_poll_timeout() don't handle their +return value the same way. + +wait_for_completion_timeout() returns 0 on time out (and >0 in all other +cases) +readl_poll_timeout() returns 0 on success and -ETIMEDOUT upon a timeout. + +In order for the error handling path to work in both cases, the logic +against wait_for_completion_timeout() needs to be inverted. + +Fixes: 48e6633a9fa2 ("mtd: nand: mxic-ecc: Add Macronix external ECC engine support") +Signed-off-by: Christophe JAILLET +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/beddbc374557e44ceec897e68c4a5d12764ddbb9.1676459308.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/mtd/nand/ecc-mxic.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mtd/nand/ecc-mxic.c b/drivers/mtd/nand/ecc-mxic.c +index 8afdca73..6b487ffe 100644 +--- a/drivers/mtd/nand/ecc-mxic.c ++++ b/drivers/mtd/nand/ecc-mxic.c +@@ -429,6 +429,7 @@ static int mxic_ecc_data_xfer_wait_for_completion(struct mxic_ecc_engine *mxic) + mxic_ecc_enable_int(mxic); + ret = wait_for_completion_timeout(&mxic->complete, + msecs_to_jiffies(1000)); ++ ret = ret ? 0 : -ETIMEDOUT; + mxic_ecc_disable_int(mxic); + } else { + ret = readl_poll_timeout(mxic->regs + INTRPT_STS, val, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-064-ca8210-Fix-unsigned-mac_len-comparison-with-ze.patch b/patches.kernel.org/6.2.10-064-ca8210-Fix-unsigned-mac_len-comparison-with-ze.patch new file mode 100644 index 0000000..f6c8753 --- /dev/null +++ b/patches.kernel.org/6.2.10-064-ca8210-Fix-unsigned-mac_len-comparison-with-ze.patch @@ -0,0 +1,50 @@ +From: Harshit Mogalapalli +Date: Mon, 6 Mar 2023 11:18:24 -0800 +Subject: [PATCH] ca8210: Fix unsigned mac_len comparison with zero in + ca8210_skb_tx() +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 748b2f5e82d17480404b3e2895388fc2925f7caf + +[ Upstream commit 748b2f5e82d17480404b3e2895388fc2925f7caf ] + +mac_len is of type unsigned, which can never be less than zero. + + mac_len = ieee802154_hdr_peek_addrs(skb, &header); + if (mac_len < 0) + return mac_len; + +Change this to type int as ieee802154_hdr_peek_addrs() can return negative +integers, this is found by static analysis with smatch. + +Fixes: 6c993779ea1d ("ca8210: fix mac_len negative array access") +Signed-off-by: Harshit Mogalapalli +Acked-by: Alexander Aring +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230306191824.4115839-1-harshit.m.mogalapalli@oracle.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ieee802154/ca8210.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c +index 0b0c6c07..d0b51294 100644 +--- a/drivers/net/ieee802154/ca8210.c ++++ b/drivers/net/ieee802154/ca8210.c +@@ -1902,10 +1902,9 @@ static int ca8210_skb_tx( + struct ca8210_priv *priv + ) + { +- int status; + struct ieee802154_hdr header = { }; + struct secspec secspec; +- unsigned int mac_len; ++ int mac_len, status; + + dev_dbg(&priv->spi->dev, "%s called\n", __func__); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-065-riscv-kvm-Fix-VM-hang-in-case-of-timer-delta-b.patch b/patches.kernel.org/6.2.10-065-riscv-kvm-Fix-VM-hang-in-case-of-timer-delta-b.patch new file mode 100644 index 0000000..fe6dbf0 --- /dev/null +++ b/patches.kernel.org/6.2.10-065-riscv-kvm-Fix-VM-hang-in-case-of-timer-delta-b.patch @@ -0,0 +1,60 @@ +From: Rajnesh Kanwal +Date: Fri, 10 Feb 2023 14:27:11 +0000 +Subject: [PATCH] riscv/kvm: Fix VM hang in case of timer delta being zero. +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 6eff38048944cadc3cddcf117acfa5199ec32490 + +[ Upstream commit 6eff38048944cadc3cddcf117acfa5199ec32490 ] + +In case when VCPU is blocked due to WFI, we schedule the timer +from `kvm_riscv_vcpu_timer_blocking()` to keep timer interrupt +ticking. + +But in case when delta_ns comes to be zero, we never schedule +the timer and VCPU keeps sleeping indefinitely until any activity +is done with VM console. + +This is easily reproduce-able using kvmtool. +./lkvm-static run -c1 --console virtio -p "earlycon root=/dev/vda" \ + -k ./Image -d rootfs.ext4 + +Also, just add a print in kvm_riscv_vcpu_vstimer_expired() to +check the interrupt delivery and run `top` or similar auto-upating +cmd from guest. Within sometime one can notice that print from +timer expiry routine stops and the `top` cmd output will stop +updating. + +This change fixes this by making sure we schedule the timer even +with delta_ns being zero to bring the VCPU out of sleep immediately. + +Fixes: 8f5cb44b1bae ("RISC-V: KVM: Support sstc extension") +Signed-off-by: Rajnesh Kanwal +Reviewed-by: Atish Patra +Signed-off-by: Anup Patel +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/riscv/kvm/vcpu_timer.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/arch/riscv/kvm/vcpu_timer.c b/arch/riscv/kvm/vcpu_timer.c +index ad34519c..3ac2ff6a 100644 +--- a/arch/riscv/kvm/vcpu_timer.c ++++ b/arch/riscv/kvm/vcpu_timer.c +@@ -147,10 +147,8 @@ static void kvm_riscv_vcpu_timer_blocking(struct kvm_vcpu *vcpu) + return; + + delta_ns = kvm_riscv_delta_cycles2ns(t->next_cycles, gt, t); +- if (delta_ns) { +- hrtimer_start(&t->hrt, ktime_set(0, delta_ns), HRTIMER_MODE_REL); +- t->next_set = true; +- } ++ hrtimer_start(&t->hrt, ktime_set(0, delta_ns), HRTIMER_MODE_REL); ++ t->next_set = true; + } + + static void kvm_riscv_vcpu_timer_unblocking(struct kvm_vcpu *vcpu) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-066-mips-bmips-BCM6358-disable-RAC-flush-for-TP1.patch b/patches.kernel.org/6.2.10-066-mips-bmips-BCM6358-disable-RAC-flush-for-TP1.patch new file mode 100644 index 0000000..b4c9bff --- /dev/null +++ b/patches.kernel.org/6.2.10-066-mips-bmips-BCM6358-disable-RAC-flush-for-TP1.patch @@ -0,0 +1,118 @@ +From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= +Date: Fri, 17 Mar 2023 11:20:04 +0100 +Subject: [PATCH] mips: bmips: BCM6358: disable RAC flush for TP1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: ab327f8acdf8d06601fbf058859a539a9422afff + +[ Upstream commit ab327f8acdf8d06601fbf058859a539a9422afff ] + +RAC flush causes kernel panics on BCM6358 with EHCI/OHCI when booting from TP1: +[ 3.881739] usb 1-1: new high-speed USB device number 2 using ehci-platform +[ 3.895011] Reserved instruction in kernel code[#1]: +[ 3.900113] CPU: 0 PID: 1 Comm: init Not tainted 5.10.16 #0 +[ 3.905829] $ 0 : 00000000 10008700 00000000 77d94060 +[ 3.911238] $ 4 : 7fd1f088 00000000 81431cac 81431ca0 +[ 3.916641] $ 8 : 00000000 ffffefff 8075cd34 00000000 +[ 3.922043] $12 : 806f8d40 f3e812b7 00000000 000d9aaa +[ 3.927446] $16 : 7fd1f068 7fd1f080 7ff559b8 81428470 +[ 3.932848] $20 : 00000000 00000000 55590000 77d70000 +[ 3.938251] $24 : 00000018 00000010 +[ 3.943655] $28 : 81430000 81431e60 81431f28 800157fc +[ 3.949058] Hi : 00000000 +[ 3.952013] Lo : 00000000 +[ 3.955019] epc : 80015808 setup_sigcontext+0x54/0x24c +[ 3.960464] ra : 800157fc setup_sigcontext+0x48/0x24c +[ 3.965913] Status: 10008703 KERNEL EXL IE +[ 3.970216] Cause : 00800028 (ExcCode 0a) +[ 3.974340] PrId : 0002a010 (Broadcom BMIPS4350) +[ 3.979170] Modules linked in: ohci_platform ohci_hcd fsl_mph_dr_of ehci_platform ehci_fsl ehci_hcd gpio_button_hotplug usbcore nls_base usb_common +[ 3.992907] Process init (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=77e22ec8) +[ 4.000776] Stack : 81431ef4 7fd1f080 81431f28 81428470 7fd1f068 81431edc 7ff559b8 81428470 +[ 4.009467] 81431f28 7fd1f080 55590000 77d70000 77d5498c 80015c70 806f0000 8063ae74 +[ 4.018149] 08100002 81431f28 0000000a 08100002 81431f28 0000000a 77d6b418 00000003 +[ 4.026831] ffffffff 80016414 80080734 81431ecc 81431ecc 00000001 00000000 04000000 +[ 4.035512] 77d54874 00000000 00000000 00000000 00000000 00000012 00000002 00000000 +[ 4.044196] ... +[ 4.046706] Call Trace: +[ 4.049238] [<80015808>] setup_sigcontext+0x54/0x24c +[ 4.054356] [<80015c70>] setup_frame+0xdc/0x124 +[ 4.059015] [<80016414>] do_notify_resume+0x1dc/0x288 +[ 4.064207] [<80011b50>] work_notifysig+0x10/0x18 +[ 4.069036] +[ 4.070538] Code: 8fc300b4 00001025 26240008 ac830004 3c048063 0c0228aa 24846a00 26240010 +[ 4.080686] +[ 4.082517] ---[ end trace 22a8edb41f5f983b ]--- +[ 4.087374] Kernel panic - not syncing: Fatal exception +[ 4.092753] Rebooting in 1 seconds.. + +Because the bootloader (CFE) is not initializing the Read-ahead cache properly +on the second thread (TP1). Since the RAC was not initialized properly, we +should avoid flushing it at the risk of corrupting the instruction stream as +seen in the trace above. + +Fixes: d59098a0e9cb ("MIPS: bmips: use generic dma noncoherent ops") +Signed-off-by: Álvaro Fernández Rojas +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/mips/bmips/dma.c | 5 +++++ + arch/mips/bmips/setup.c | 8 ++++++++ + 2 files changed, 13 insertions(+) + +diff --git a/arch/mips/bmips/dma.c b/arch/mips/bmips/dma.c +index 33788668..3779e785 100644 +--- a/arch/mips/bmips/dma.c ++++ b/arch/mips/bmips/dma.c +@@ -5,6 +5,8 @@ + #include + #include + ++bool bmips_rac_flush_disable; ++ + void arch_sync_dma_for_cpu_all(void) + { + void __iomem *cbr = BMIPS_GET_CBR(); +@@ -15,6 +17,9 @@ void arch_sync_dma_for_cpu_all(void) + boot_cpu_type() != CPU_BMIPS4380) + return; + ++ if (unlikely(bmips_rac_flush_disable)) ++ return; ++ + /* Flush stale data out of the readahead cache */ + cfg = __raw_readl(cbr + BMIPS_RAC_CONFIG); + __raw_writel(cfg | 0x100, cbr + BMIPS_RAC_CONFIG); +diff --git a/arch/mips/bmips/setup.c b/arch/mips/bmips/setup.c +index e95b3f78..549a6392 100644 +--- a/arch/mips/bmips/setup.c ++++ b/arch/mips/bmips/setup.c +@@ -35,6 +35,8 @@ + #define REG_BCM6328_OTP ((void __iomem *)CKSEG1ADDR(0x1000062c)) + #define BCM6328_TP1_DISABLED BIT(9) + ++extern bool bmips_rac_flush_disable; ++ + static const unsigned long kbase = VMLINUX_LOAD_ADDRESS & 0xfff00000; + + struct bmips_quirk { +@@ -104,6 +106,12 @@ static void bcm6358_quirks(void) + * disable SMP for now + */ + bmips_smp_enabled = 0; ++ ++ /* ++ * RAC flush causes kernel panics on BCM6358 when booting from TP1 ++ * because the bootloader is not initializing it properly. ++ */ ++ bmips_rac_flush_disable = !!(read_c0_brcm_cmt_local() & (1 << 31)); + } + + static void bcm6368_quirks(void) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-067-ALSA-usb-audio-Fix-recursive-locking-at-XRUN-d.patch b/patches.kernel.org/6.2.10-067-ALSA-usb-audio-Fix-recursive-locking-at-XRUN-d.patch new file mode 100644 index 0000000..38b7462 --- /dev/null +++ b/patches.kernel.org/6.2.10-067-ALSA-usb-audio-Fix-recursive-locking-at-XRUN-d.patch @@ -0,0 +1,145 @@ +From: Takashi Iwai +Date: Mon, 20 Mar 2023 15:28:38 +0100 +Subject: [PATCH] ALSA: usb-audio: Fix recursive locking at XRUN during syncing +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 8c721c53dda512fdd48eb24d6d99e56deee57898 + +[ Upstream commit 8c721c53dda512fdd48eb24d6d99e56deee57898 ] + +The recent support of low latency playback in USB-audio driver made +the snd_usb_queue_pending_output_urbs() function to be called via PCM +ack ops. In the new code path, the function is performed already in +the PCM stream lock. The problem is that, when an XRUN is detected, +the function calls snd_pcm_xrun() to notify, but snd_pcm_xrun() is +supposed to be called only outside the stream lock. As a result, it +leads to a deadlock of PCM stream locking. + +For avoiding such a recursive locking, this patch adds an additional +check to the code paths in PCM core that call the ack callback; now it +checks the error code from the callback, and if it's -EPIPE, the XRUN +is handled in the PCM core side gracefully. Along with it, the +USB-audio driver code is changed to follow that, i.e. -EPIPE is +returned instead of the explicit snd_pcm_xrun() call when the function +is performed already in the stream lock. + +Fixes: d5f871f89e21 ("ALSA: usb-audio: Improved lowlatency playback support") +Reported-and-tested-by: John Keeping +Link: https://lore.kernel.org/r/20230317195128.3911155-1-john@metanate.com +Reviewed-by: Jaroslav Kysela +Reviewed-by; Takashi Sakamoto +Link: https://lore.kernel.org/r/20230320142838.494-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/core/pcm_lib.c | 2 ++ + sound/usb/endpoint.c | 22 ++++++++++++++-------- + sound/usb/endpoint.h | 4 ++-- + sound/usb/pcm.c | 2 +- + 4 files changed, 19 insertions(+), 11 deletions(-) + +diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c +index 8b6aeb8a..02fd6599 100644 +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -2155,6 +2155,8 @@ int pcm_lib_apply_appl_ptr(struct snd_pcm_substream *substream, + ret = substream->ops->ack(substream); + if (ret < 0) { + runtime->control->appl_ptr = old_appl_ptr; ++ if (ret == -EPIPE) ++ __snd_pcm_xrun(substream); + return ret; + } + } +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index 419302e2..647fa054 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -455,8 +455,8 @@ static void push_back_to_ready_list(struct snd_usb_endpoint *ep, + * This function is used both for implicit feedback endpoints and in low- + * latency playback mode. + */ +-void snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep, +- bool in_stream_lock) ++int snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep, ++ bool in_stream_lock) + { + bool implicit_fb = snd_usb_endpoint_implicit_feedback_sink(ep); + +@@ -480,7 +480,7 @@ void snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep, + spin_unlock_irqrestore(&ep->lock, flags); + + if (ctx == NULL) +- return; ++ break; + + /* copy over the length information */ + if (implicit_fb) { +@@ -495,11 +495,14 @@ void snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep, + break; + if (err < 0) { + /* push back to ready list again for -EAGAIN */ +- if (err == -EAGAIN) ++ if (err == -EAGAIN) { + push_back_to_ready_list(ep, ctx); +- else ++ break; ++ } ++ ++ if (!in_stream_lock) + notify_xrun(ep); +- return; ++ return -EPIPE; + } + + err = usb_submit_urb(ctx->urb, GFP_ATOMIC); +@@ -507,13 +510,16 @@ void snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep, + usb_audio_err(ep->chip, + "Unable to submit urb #%d: %d at %s\n", + ctx->index, err, __func__); +- notify_xrun(ep); +- return; ++ if (!in_stream_lock) ++ notify_xrun(ep); ++ return -EPIPE; + } + + set_bit(ctx->index, &ep->active_mask); + atomic_inc(&ep->submitted_urbs); + } ++ ++ return 0; + } + + /* +diff --git a/sound/usb/endpoint.h b/sound/usb/endpoint.h +index 924f4351..c09f68ce 100644 +--- a/sound/usb/endpoint.h ++++ b/sound/usb/endpoint.h +@@ -52,7 +52,7 @@ int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep); + int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep, + struct snd_urb_ctx *ctx, int idx, + unsigned int avail); +-void snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep, +- bool in_stream_lock); ++int snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep, ++ bool in_stream_lock); + + #endif /* __USBAUDIO_ENDPOINT_H */ +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index d959da7a..eec5232f 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -1639,7 +1639,7 @@ static int snd_usb_pcm_playback_ack(struct snd_pcm_substream *substream) + * outputs here + */ + if (!ep->active_mask) +- snd_usb_queue_pending_output_urbs(ep, true); ++ return snd_usb_queue_pending_output_urbs(ep, true); + return 0; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-068-PCI-dwc-Fix-PORT_LINK_CONTROL-update-when-CDM-.patch b/patches.kernel.org/6.2.10-068-PCI-dwc-Fix-PORT_LINK_CONTROL-update-when-CDM-.patch new file mode 100644 index 0000000..9f11486 --- /dev/null +++ b/patches.kernel.org/6.2.10-068-PCI-dwc-Fix-PORT_LINK_CONTROL-update-when-CDM-.patch @@ -0,0 +1,61 @@ +From: Yoshihiro Shimoda +Date: Fri, 10 Mar 2023 21:34:58 +0900 +Subject: [PATCH] PCI: dwc: Fix PORT_LINK_CONTROL update when CDM check enabled +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: cdce67099117ece371582f706c6eff7d3a65326d + +[ Upstream commit cdce67099117ece371582f706c6eff7d3a65326d ] + +If CDM_CHECK is enabled (by the DT "snps,enable-cdm-check" property), 'val' +is overwritten by PCIE_PL_CHK_REG_CONTROL_STATUS initialization. Commit +ec7b952f453c ("PCI: dwc: Always enable CDM check if "snps,enable-cdm-check" +exists") did not account for further usage of 'val', so we wrote improper +values to PCIE_PORT_LINK_CONTROL when the CDM check is enabled. + +Move the PCIE_PORT_LINK_CONTROL update to be completely after the +PCIE_PL_CHK_REG_CONTROL_STATUS register initialization. + +[bhelgaas: commit log adapted from Serge's version] +Fixes: ec7b952f453c ("PCI: dwc: Always enable CDM check if "snps,enable-cdm-check" exists") +Link: https://lore.kernel.org/r/20230310123510.675685-2-yoshihiro.shimoda.uh@renesas.com +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Bjorn Helgaas +Reviewed-by: Serge Semin +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pci/controller/dwc/pcie-designware.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-designware.c b/drivers/pci/controller/dwc/pcie-designware.c +index 6d5d619a..346f67d2 100644 +--- a/drivers/pci/controller/dwc/pcie-designware.c ++++ b/drivers/pci/controller/dwc/pcie-designware.c +@@ -806,11 +806,6 @@ void dw_pcie_setup(struct dw_pcie *pci) + dw_pcie_writel_dbi(pci, PCIE_LINK_WIDTH_SPEED_CONTROL, val); + } + +- val = dw_pcie_readl_dbi(pci, PCIE_PORT_LINK_CONTROL); +- val &= ~PORT_LINK_FAST_LINK_MODE; +- val |= PORT_LINK_DLL_LINK_EN; +- dw_pcie_writel_dbi(pci, PCIE_PORT_LINK_CONTROL, val); +- + if (dw_pcie_cap_is(pci, CDM_CHECK)) { + val = dw_pcie_readl_dbi(pci, PCIE_PL_CHK_REG_CONTROL_STATUS); + val |= PCIE_PL_CHK_REG_CHK_REG_CONTINUOUS | +@@ -818,6 +813,11 @@ void dw_pcie_setup(struct dw_pcie *pci) + dw_pcie_writel_dbi(pci, PCIE_PL_CHK_REG_CONTROL_STATUS, val); + } + ++ val = dw_pcie_readl_dbi(pci, PCIE_PORT_LINK_CONTROL); ++ val &= ~PORT_LINK_FAST_LINK_MODE; ++ val |= PORT_LINK_DLL_LINK_EN; ++ dw_pcie_writel_dbi(pci, PCIE_PORT_LINK_CONTROL, val); ++ + if (!pci->num_lanes) { + dev_dbg(pci->dev, "Using h/w default number of lanes\n"); + return; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-069-platform-x86-think-lmi-add-missing-type-attrib.patch b/patches.kernel.org/6.2.10-069-platform-x86-think-lmi-add-missing-type-attrib.patch new file mode 100644 index 0000000..e31f3ac --- /dev/null +++ b/patches.kernel.org/6.2.10-069-platform-x86-think-lmi-add-missing-type-attrib.patch @@ -0,0 +1,73 @@ +From: Mark Pearson +Date: Sun, 19 Mar 2023 20:32:18 -0400 +Subject: [PATCH] platform/x86: think-lmi: add missing type attribute +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 583329dcf22e568a328a944f20427ccfc95dce01 + +[ Upstream commit 583329dcf22e568a328a944f20427ccfc95dce01 ] + +This driver was missing the mandatory type attribute...oops. + +Add it in along with logic to determine whether the attribute is an +enumeration type or a string by parsing the possible_values attribute. + +Upstream bug https://bugzilla.kernel.org/show_bug.cgi?id=216460 + +Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") +Signed-off-by: Mark Pearson +Link: https://lore.kernel.org/r/20230320003221.561750-1-mpearson-lenovo@squebb.ca +Reviewed-by: Thomas Weißschuh +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/platform/x86/think-lmi.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c +index a01a9276..07c9dc21 100644 +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -947,6 +947,20 @@ static ssize_t possible_values_show(struct kobject *kobj, struct kobj_attribute + return sysfs_emit(buf, "%s\n", setting->possible_values); + } + ++static ssize_t type_show(struct kobject *kobj, struct kobj_attribute *attr, ++ char *buf) ++{ ++ struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); ++ ++ if (setting->possible_values) { ++ /* Figure out what setting type is as BIOS does not return this */ ++ if (strchr(setting->possible_values, ',')) ++ return sysfs_emit(buf, "enumeration\n"); ++ } ++ /* Anything else is going to be a string */ ++ return sysfs_emit(buf, "string\n"); ++} ++ + static ssize_t current_value_store(struct kobject *kobj, + struct kobj_attribute *attr, + const char *buf, size_t count) +@@ -1036,10 +1050,13 @@ static struct kobj_attribute attr_possible_values = __ATTR_RO(possible_values); + + static struct kobj_attribute attr_current_val = __ATTR_RW_MODE(current_value, 0600); + ++static struct kobj_attribute attr_type = __ATTR_RO(type); ++ + static struct attribute *tlmi_attrs[] = { + &attr_displ_name.attr, + &attr_current_val.attr, + &attr_possible_values.attr, ++ &attr_type.attr, + NULL + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-070-platform-x86-think-lmi-use-correct-possible_va.patch b/patches.kernel.org/6.2.10-070-platform-x86-think-lmi-use-correct-possible_va.patch new file mode 100644 index 0000000..7e5c66f --- /dev/null +++ b/patches.kernel.org/6.2.10-070-platform-x86-think-lmi-use-correct-possible_va.patch @@ -0,0 +1,60 @@ +From: Mark Pearson +Date: Sun, 19 Mar 2023 20:32:19 -0400 +Subject: [PATCH] platform/x86: think-lmi: use correct possible_values + delimiters +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 45e21289bfc6e257885514790a8a8887da822d40 + +[ Upstream commit 45e21289bfc6e257885514790a8a8887da822d40 ] + +firmware-attributes class requires that possible values are delimited +using ';' but the Lenovo firmware uses ',' instead. +Parse string and replace where appropriate. + +Suggested-by: Thomas Weißschuh +Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") +Signed-off-by: Mark Pearson +Link: https://lore.kernel.org/r/20230320003221.561750-2-mpearson-lenovo@squebb.ca +Reviewed-by: Thomas Weißschuh +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/platform/x86/think-lmi.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c +index 07c9dc21..62241680 100644 +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -954,7 +954,7 @@ static ssize_t type_show(struct kobject *kobj, struct kobj_attribute *attr, + + if (setting->possible_values) { + /* Figure out what setting type is as BIOS does not return this */ +- if (strchr(setting->possible_values, ',')) ++ if (strchr(setting->possible_values, ';')) + return sysfs_emit(buf, "enumeration\n"); + } + /* Anything else is going to be a string */ +@@ -1441,6 +1441,13 @@ static int tlmi_analyze(void) + pr_info("Error retrieving possible values for %d : %s\n", + i, setting->display_name); + } ++ /* ++ * firmware-attributes requires that possible_values are separated by ';' but ++ * Lenovo FW uses ','. Replace appropriately. ++ */ ++ if (setting->possible_values) ++ strreplace(setting->possible_values, ',', ';'); ++ + kobject_init(&setting->kobj, &tlmi_attr_setting_ktype); + tlmi_priv.setting[i] = setting; + kfree(item); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-071-platform-x86-think-lmi-only-display-possible_v.patch b/patches.kernel.org/6.2.10-071-platform-x86-think-lmi-only-display-possible_v.patch new file mode 100644 index 0000000..7a5a118 --- /dev/null +++ b/patches.kernel.org/6.2.10-071-platform-x86-think-lmi-only-display-possible_v.patch @@ -0,0 +1,72 @@ +From: Mark Pearson +Date: Sun, 19 Mar 2023 20:32:20 -0400 +Subject: [PATCH] platform/x86: think-lmi: only display possible_values if + available +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: cf337f27f3bfc4aeab4954c468239fd6233c7638 + +[ Upstream commit cf337f27f3bfc4aeab4954c468239fd6233c7638 ] + +Some attributes don't have any values available. In those cases don't +make the possible_values entry visible. + +Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") +Signed-off-by: Mark Pearson +Link: https://lore.kernel.org/r/20230320003221.561750-3-mpearson-lenovo@squebb.ca +Reviewed-by: Thomas Weißschuh +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/platform/x86/think-lmi.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c +index 62241680..ccd085ba 100644 +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -941,9 +941,6 @@ static ssize_t possible_values_show(struct kobject *kobj, struct kobj_attribute + { + struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); + +- if (!tlmi_priv.can_get_bios_selections) +- return -EOPNOTSUPP; +- + return sysfs_emit(buf, "%s\n", setting->possible_values); + } + +@@ -1052,6 +1049,18 @@ static struct kobj_attribute attr_current_val = __ATTR_RW_MODE(current_value, 06 + + static struct kobj_attribute attr_type = __ATTR_RO(type); + ++static umode_t attr_is_visible(struct kobject *kobj, ++ struct attribute *attr, int n) ++{ ++ struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); ++ ++ /* We don't want to display possible_values attributes if not available */ ++ if ((attr == &attr_possible_values.attr) && (!setting->possible_values)) ++ return 0; ++ ++ return attr->mode; ++} ++ + static struct attribute *tlmi_attrs[] = { + &attr_displ_name.attr, + &attr_current_val.attr, +@@ -1061,6 +1070,7 @@ static struct attribute *tlmi_attrs[] = { + }; + + static const struct attribute_group tlmi_attr_group = { ++ .is_visible = attr_is_visible, + .attrs = tlmi_attrs, + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-072-platform-x86-think-lmi-Add-possible_values-for.patch b/patches.kernel.org/6.2.10-072-platform-x86-think-lmi-Add-possible_values-for.patch new file mode 100644 index 0000000..3c832fd --- /dev/null +++ b/patches.kernel.org/6.2.10-072-platform-x86-think-lmi-Add-possible_values-for.patch @@ -0,0 +1,64 @@ +From: Mark Pearson +Date: Sun, 19 Mar 2023 20:32:21 -0400 +Subject: [PATCH] platform/x86: think-lmi: Add possible_values for ThinkStation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 8a02d70679fc1c434401863333c8ea7dbf201494 + +[ Upstream commit 8a02d70679fc1c434401863333c8ea7dbf201494 ] + +ThinkStation platforms don't support the API to return possible_values +but instead embed it in the settings string. + +Try and extract this information and set the possible_values attribute +appropriately. + +Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") +Signed-off-by: Mark Pearson +Link: https://lore.kernel.org/r/20230320003221.561750-4-mpearson-lenovo@squebb.ca +Reviewed-by: Thomas Weißschuh +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/platform/x86/think-lmi.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c +index ccd085ba..74af3e59 100644 +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -1450,6 +1450,26 @@ static int tlmi_analyze(void) + if (ret || !setting->possible_values) + pr_info("Error retrieving possible values for %d : %s\n", + i, setting->display_name); ++ } else { ++ /* ++ * Older Thinkstations don't support the bios_selections API. ++ * Instead they store this as a [Optional:Option1,Option2] section of the ++ * name string. ++ * Try and pull that out if it's available. ++ */ ++ char *item, *optstart, *optend; ++ ++ if (!tlmi_setting(setting->index, &item, LENOVO_BIOS_SETTING_GUID)) { ++ optstart = strstr(item, "[Optional:"); ++ if (optstart) { ++ optstart += strlen("[Optional:"); ++ optend = strstr(optstart, "]"); ++ if (optend) ++ setting->possible_values = ++ kstrndup(optstart, optend - optstart, ++ GFP_KERNEL); ++ } ++ } + } + /* + * firmware-attributes requires that possible_values are separated by ';' but +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-073-platform-surface-aggregator-Add-missing-fwnode.patch b/patches.kernel.org/6.2.10-073-platform-surface-aggregator-Add-missing-fwnode.patch new file mode 100644 index 0000000..f8031dd --- /dev/null +++ b/patches.kernel.org/6.2.10-073-platform-surface-aggregator-Add-missing-fwnode.patch @@ -0,0 +1,45 @@ +From: Liang He +Date: Wed, 22 Mar 2023 11:30:57 +0800 +Subject: [PATCH] platform/surface: aggregator: Add missing fwnode_handle_put() +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: acd0acb802b90f88d19ad4337183e44fd0f77c50 + +[ Upstream commit acd0acb802b90f88d19ad4337183e44fd0f77c50 ] + +In fwnode_for_each_child_node(), we should add +fwnode_handle_put() when break out of the iteration +fwnode_for_each_child_node() as it will automatically +increase and decrease the refcounter. + +Fixes: fc622b3d36e6 ("platform/surface: Set up Surface Aggregator device registry") +Signed-off-by: Liang He +Reviewed-by: Maximilian Luz +Link: https://lore.kernel.org/r/20230322033057.1855741-1-windhl@126.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/platform/surface/aggregator/bus.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/surface/aggregator/bus.c b/drivers/platform/surface/aggregator/bus.c +index de539938..b501a79f 100644 +--- a/drivers/platform/surface/aggregator/bus.c ++++ b/drivers/platform/surface/aggregator/bus.c +@@ -485,8 +485,10 @@ int __ssam_register_clients(struct device *parent, struct ssam_controller *ctrl, + * device, so ignore it and continue with the next one. + */ + status = ssam_add_client_device(parent, ctrl, child); +- if (status && status != -ENODEV) ++ if (status && status != -ENODEV) { ++ fwnode_handle_put(child); + goto err; ++ } + } + + return 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-074-mtd-rawnand-meson-invalidate-cache-on-polling-.patch b/patches.kernel.org/6.2.10-074-mtd-rawnand-meson-invalidate-cache-on-polling-.patch new file mode 100644 index 0000000..e816834 --- /dev/null +++ b/patches.kernel.org/6.2.10-074-mtd-rawnand-meson-invalidate-cache-on-polling-.patch @@ -0,0 +1,69 @@ +From: Arseniy Krasnov +Date: Mon, 13 Mar 2023 10:32:44 +0300 +Subject: [PATCH] mtd: rawnand: meson: invalidate cache on polling ECC bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: e732e39ed9929c05fd219035bc9653ba4100d4fa + +[ Upstream commit e732e39ed9929c05fd219035bc9653ba4100d4fa ] + +'info_buf' memory is cached and driver polls ECC bit in it. This bit +is set by the NAND controller. If 'usleep_range()' returns before device +sets this bit, 'info_buf' will be cached and driver won't see update of +this bit and will loop forever. + +Fixes: 8fae856c5350 ("mtd: rawnand: meson: add support for Amlogic NAND flash controller") +Signed-off-by: Arseniy Krasnov +Reviewed-by: Neil Armstrong +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/d4ef0bd6-816e-f6fa-9385-f05f775f0ae2@sberdevices.ru +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/mtd/nand/raw/meson_nand.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c +index 30e326ad..a28574c0 100644 +--- a/drivers/mtd/nand/raw/meson_nand.c ++++ b/drivers/mtd/nand/raw/meson_nand.c +@@ -176,6 +176,7 @@ struct meson_nfc { + + dma_addr_t daddr; + dma_addr_t iaddr; ++ u32 info_bytes; + + unsigned long assigned_cs; + }; +@@ -503,6 +504,7 @@ static int meson_nfc_dma_buffer_setup(struct nand_chip *nand, void *databuf, + nfc->daddr, datalen, dir); + return ret; + } ++ nfc->info_bytes = infolen; + cmd = GENCMDIADDRL(NFC_CMD_AIL, nfc->iaddr); + writel(cmd, nfc->reg_base + NFC_REG_CMD); + +@@ -520,8 +522,10 @@ static void meson_nfc_dma_buffer_release(struct nand_chip *nand, + struct meson_nfc *nfc = nand_get_controller_data(nand); + + dma_unmap_single(nfc->dev, nfc->daddr, datalen, dir); +- if (infolen) ++ if (infolen) { + dma_unmap_single(nfc->dev, nfc->iaddr, infolen, dir); ++ nfc->info_bytes = 0; ++ } + } + + static int meson_nfc_read_buf(struct nand_chip *nand, u8 *buf, int len) +@@ -710,6 +714,8 @@ static void meson_nfc_check_ecc_pages_valid(struct meson_nfc *nfc, + usleep_range(10, 15); + /* info is updated by nfc dma engine*/ + smp_rmb(); ++ dma_sync_single_for_cpu(nfc->dev, nfc->iaddr, nfc->info_bytes, ++ DMA_FROM_DEVICE); + ret = *info & ECC_COMPLETE; + } while (!ret); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-075-SUNRPC-fix-shutdown-of-NFS-TCP-client-socket.patch b/patches.kernel.org/6.2.10-075-SUNRPC-fix-shutdown-of-NFS-TCP-client-socket.patch new file mode 100644 index 0000000..6f29d6c --- /dev/null +++ b/patches.kernel.org/6.2.10-075-SUNRPC-fix-shutdown-of-NFS-TCP-client-socket.patch @@ -0,0 +1,118 @@ +From: Siddharth Kawar +Date: Mon, 20 Mar 2023 20:37:40 +0000 +Subject: [PATCH] SUNRPC: fix shutdown of NFS TCP client socket +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 943d045a6d796175e5d08f9973953b1d2c07d797 + +[ Upstream commit 943d045a6d796175e5d08f9973953b1d2c07d797 ] + +NFS server Duplicate Request Cache (DRC) algorithms rely on NFS clients +reconnecting using the same local TCP port. Unique NFS operations are +identified by the per-TCP connection set of XIDs. This prevents file +corruption when non-idempotent NFS operations are retried. + +Currently, NFS client TCP connections are using different local TCP ports +when reconnecting to NFS servers. + +After an NFS server initiates shutdown of the TCP connection, the NFS +client's TCP socket is set to NULL after the socket state has reached +TCP_LAST_ACK(9). When reconnecting, the new socket attempts to reuse +the same local port but fails with EADDRNOTAVAIL (99). This forces the +socket to use a different local TCP port to reconnect to the remote NFS +server. + +State Transition and Events: +TCP_CLOSE_WAIT(8) +TCP_LAST_ACK(9) +connect(fail EADDRNOTAVAIL(99)) +TCP_CLOSE(7) +bind on new port +connect success + +dmesg excerpts showing reconnect switching from TCP local port of 926 to +763 after commit 7c81e6a9d75b: +[13354.947854] NFS call mkdir testW +... +[13405.654781] RPC: xs_tcp_state_change client 00000000037d0f03... +[13405.654813] RPC: state 8 conn 1 dead 0 zapped 1 sk_shutdown 1 +[13405.654826] RPC: xs_data_ready... +[13405.654892] RPC: xs_tcp_state_change client 00000000037d0f03... +[13405.654895] RPC: state 9 conn 0 dead 0 zapped 1 sk_shutdown 3 +[13405.654899] RPC: xs_tcp_state_change client 00000000037d0f03... +[13405.654900] RPC: state 9 conn 0 dead 0 zapped 1 sk_shutdown 3 +[13405.654950] RPC: xs_connect scheduled xprt 00000000037d0f03 +[13405.654975] RPC: xs_bind 0.0.0.0:926: ok (0) +[13405.654980] RPC: worker connecting xprt 00000000037d0f03 via tcp + to 10.101.6.228 (port 2049) +[13405.654991] RPC: 00000000037d0f03 connect status 99 connected 0 + sock state 7 +[13405.655001] RPC: xs_tcp_state_change client 00000000037d0f03... +[13405.655002] RPC: state 7 conn 0 dead 0 zapped 1 sk_shutdown 3 +[13405.655024] RPC: xs_connect scheduled xprt 00000000037d0f03 +[13405.655038] RPC: xs_bind 0.0.0.0:763: ok (0) +[13405.655041] RPC: worker connecting xprt 00000000037d0f03 via tcp + to 10.101.6.228 (port 2049) +[13405.655065] RPC: 00000000037d0f03 connect status 115 connected 0 + sock state 2 + +State Transition and Events with patch applied: +TCP_CLOSE_WAIT(8) +TCP_LAST_ACK(9) +TCP_CLOSE(7) +connect(reuse of port succeeds) + +dmesg excerpts showing reconnect on same TCP local port of 936 with patch +applied: +[ 257.139935] NFS: mkdir(0:59/560857152), testQ +[ 257.139937] NFS call mkdir testQ +... +[ 307.822702] RPC: state 8 conn 1 dead 0 zapped 1 sk_shutdown 1 +[ 307.822714] RPC: xs_data_ready... +[ 307.822817] RPC: xs_tcp_state_change client 00000000ce702f14... +[ 307.822821] RPC: state 9 conn 0 dead 0 zapped 1 sk_shutdown 3 +[ 307.822825] RPC: xs_tcp_state_change client 00000000ce702f14... +[ 307.822826] RPC: state 9 conn 0 dead 0 zapped 1 sk_shutdown 3 +[ 307.823606] RPC: xs_tcp_state_change client 00000000ce702f14... +[ 307.823609] RPC: state 7 conn 0 dead 0 zapped 1 sk_shutdown 3 +[ 307.823629] RPC: xs_tcp_state_change client 00000000ce702f14... +[ 307.823632] RPC: state 7 conn 0 dead 0 zapped 1 sk_shutdown 3 +[ 307.823676] RPC: xs_connect scheduled xprt 00000000ce702f14 +[ 307.823704] RPC: xs_bind 0.0.0.0:936: ok (0) +[ 307.823709] RPC: worker connecting xprt 00000000ce702f14 via tcp + to 10.101.1.30 (port 2049) +[ 307.823748] RPC: 00000000ce702f14 connect status 115 connected 0 + sock state 2 +... +[ 314.916193] RPC: state 7 conn 0 dead 0 zapped 1 sk_shutdown 3 +[ 314.916251] RPC: xs_connect scheduled xprt 00000000ce702f14 +[ 314.916282] RPC: xs_bind 0.0.0.0:936: ok (0) +[ 314.916292] RPC: worker connecting xprt 00000000ce702f14 via tcp + to 10.101.1.30 (port 2049) +[ 314.916342] RPC: 00000000ce702f14 connect status 115 connected 0 + sock state 2 + +Fixes: 7c81e6a9d75b ("SUNRPC: Tweak TCP socket shutdown in the RPC client") +Signed-off-by: Siddharth Rajendra Kawar +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/sunrpc/xprtsock.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index aaa5b274..1b9465b4 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -2155,6 +2155,7 @@ static void xs_tcp_shutdown(struct rpc_xprt *xprt) + switch (skst) { + case TCP_FIN_WAIT1: + case TCP_FIN_WAIT2: ++ case TCP_LAST_ACK: + break; + case TCP_ESTABLISHED: + case TCP_CLOSE_WAIT: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-076-sfc-ef10-don-t-overwrite-offload-features-at-N.patch b/patches.kernel.org/6.2.10-076-sfc-ef10-don-t-overwrite-offload-features-at-N.patch new file mode 100644 index 0000000..520d3be --- /dev/null +++ b/patches.kernel.org/6.2.10-076-sfc-ef10-don-t-overwrite-offload-features-at-N.patch @@ -0,0 +1,148 @@ +From: =?UTF-8?q?=C3=8D=C3=B1igo=20Huguet?= +Date: Thu, 23 Mar 2023 09:34:17 +0100 +Subject: [PATCH] sfc: ef10: don't overwrite offload features at NIC reset +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: ca4a80e4bb7e87daf33b27d2ab9e4f5311018a89 + +[ Upstream commit ca4a80e4bb7e87daf33b27d2ab9e4f5311018a89 ] + +At NIC reset, some offload features related to encapsulated traffic +might have changed (this mainly happens if the firmware-variant is +changed with the sfboot userspace tool). Because of this, features are +checked and set again at reset time. + +However, this was not done right, and some features were improperly +overwritten at NIC reset: +- Tunneled IPv6 segmentation was always disabled +- Features disabled with ethtool were reenabled +- Features that becomes unsupported after the reset were not disabled + +Also, checking if the device supports IPV6_CSUM to enable TSO6 is no +longer necessary because all currently supported devices support it. +Additionally, move the assignment of some other features to the +EF10_OFFLOAD_FEATURES macro, like it is done in ef100, leaving the +selection of features in efx_pci_probe_post_io a bit cleaner. + +Fixes: ffffd2454a7a ("sfc: correctly advertise tunneled IPv6 segmentation") +Fixes: 24b2c3751aa3 ("sfc: advertise encapsulated offloads on EF10") +Reported-by: Tianhao Zhao +Suggested-by: Jonathan Cooper +Tested-by: Jonathan Cooper +Signed-off-by: Íñigo Huguet +Acked-by: Edward Cree +Link: https://lore.kernel.org/r/20230323083417.7345-1-ihuguet@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/sfc/ef10.c | 38 ++++++++++++++++++++++----------- + drivers/net/ethernet/sfc/efx.c | 17 ++++++--------- + 2 files changed, 33 insertions(+), 22 deletions(-) + +diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c +index 7022fb20..d30459db 100644 +--- a/drivers/net/ethernet/sfc/ef10.c ++++ b/drivers/net/ethernet/sfc/ef10.c +@@ -1304,7 +1304,8 @@ static void efx_ef10_fini_nic(struct efx_nic *efx) + static int efx_ef10_init_nic(struct efx_nic *efx) + { + struct efx_ef10_nic_data *nic_data = efx->nic_data; +- netdev_features_t hw_enc_features = 0; ++ struct net_device *net_dev = efx->net_dev; ++ netdev_features_t tun_feats, tso_feats; + int rc; + + if (nic_data->must_check_datapath_caps) { +@@ -1349,20 +1350,30 @@ static int efx_ef10_init_nic(struct efx_nic *efx) + nic_data->must_restore_piobufs = false; + } + +- /* add encapsulated checksum offload features */ ++ /* encap features might change during reset if fw variant changed */ + if (efx_has_cap(efx, VXLAN_NVGRE) && !efx_ef10_is_vf(efx)) +- hw_enc_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM; +- /* add encapsulated TSO features */ +- if (efx_has_cap(efx, TX_TSO_V2_ENCAP)) { +- netdev_features_t encap_tso_features; ++ net_dev->hw_enc_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM; ++ else ++ net_dev->hw_enc_features &= ~(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM); + +- encap_tso_features = NETIF_F_GSO_UDP_TUNNEL | NETIF_F_GSO_GRE | +- NETIF_F_GSO_UDP_TUNNEL_CSUM | NETIF_F_GSO_GRE_CSUM; ++ tun_feats = NETIF_F_GSO_UDP_TUNNEL | NETIF_F_GSO_GRE | ++ NETIF_F_GSO_UDP_TUNNEL_CSUM | NETIF_F_GSO_GRE_CSUM; ++ tso_feats = NETIF_F_TSO | NETIF_F_TSO6; + +- hw_enc_features |= encap_tso_features | NETIF_F_TSO; +- efx->net_dev->features |= encap_tso_features; ++ if (efx_has_cap(efx, TX_TSO_V2_ENCAP)) { ++ /* If this is first nic_init, or if it is a reset and a new fw ++ * variant has added new features, enable them by default. ++ * If the features are not new, maintain their current value. ++ */ ++ if (!(net_dev->hw_features & tun_feats)) ++ net_dev->features |= tun_feats; ++ net_dev->hw_enc_features |= tun_feats | tso_feats; ++ net_dev->hw_features |= tun_feats; ++ } else { ++ net_dev->hw_enc_features &= ~(tun_feats | tso_feats); ++ net_dev->hw_features &= ~tun_feats; ++ net_dev->features &= ~tun_feats; + } +- efx->net_dev->hw_enc_features = hw_enc_features; + + /* don't fail init if RSS setup doesn't work */ + rc = efx->type->rx_push_rss_config(efx, false, +@@ -4021,7 +4032,10 @@ static unsigned int efx_ef10_recycle_ring_size(const struct efx_nic *efx) + NETIF_F_HW_VLAN_CTAG_FILTER | \ + NETIF_F_IPV6_CSUM | \ + NETIF_F_RXHASH | \ +- NETIF_F_NTUPLE) ++ NETIF_F_NTUPLE | \ ++ NETIF_F_SG | \ ++ NETIF_F_RXCSUM | \ ++ NETIF_F_RXALL) + + const struct efx_nic_type efx_hunt_a0_vf_nic_type = { + .is_vf = true, +diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c +index 3a86f121..6a1bff54 100644 +--- a/drivers/net/ethernet/sfc/efx.c ++++ b/drivers/net/ethernet/sfc/efx.c +@@ -1001,21 +1001,18 @@ static int efx_pci_probe_post_io(struct efx_nic *efx) + } + + /* Determine netdevice features */ +- net_dev->features |= (efx->type->offload_features | NETIF_F_SG | +- NETIF_F_TSO | NETIF_F_RXCSUM | NETIF_F_RXALL); +- if (efx->type->offload_features & (NETIF_F_IPV6_CSUM | NETIF_F_HW_CSUM)) { +- net_dev->features |= NETIF_F_TSO6; +- if (efx_has_cap(efx, TX_TSO_V2_ENCAP)) +- net_dev->hw_enc_features |= NETIF_F_TSO6; +- } +- /* Check whether device supports TSO */ +- if (!efx->type->tso_versions || !efx->type->tso_versions(efx)) +- net_dev->features &= ~NETIF_F_ALL_TSO; ++ net_dev->features |= efx->type->offload_features; ++ ++ /* Add TSO features */ ++ if (efx->type->tso_versions && efx->type->tso_versions(efx)) ++ net_dev->features |= NETIF_F_TSO | NETIF_F_TSO6; ++ + /* Mask for features that also apply to VLAN devices */ + net_dev->vlan_features |= (NETIF_F_HW_CSUM | NETIF_F_SG | + NETIF_F_HIGHDMA | NETIF_F_ALL_TSO | + NETIF_F_RXCSUM); + ++ /* Determine user configurable features */ + net_dev->hw_features |= net_dev->features & ~efx->fixed_features; + + /* Disable receiving frames with bad FCS, by default. */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-077-scsi-megaraid_sas-Fix-crash-after-a-double-com.patch b/patches.kernel.org/6.2.10-077-scsi-megaraid_sas-Fix-crash-after-a-double-com.patch new file mode 100644 index 0000000..8d67738 --- /dev/null +++ b/patches.kernel.org/6.2.10-077-scsi-megaraid_sas-Fix-crash-after-a-double-com.patch @@ -0,0 +1,48 @@ +From: Tomas Henzl +Date: Fri, 24 Mar 2023 16:01:34 +0100 +Subject: [PATCH] scsi: megaraid_sas: Fix crash after a double completion +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 2309df27111a51734cb9240b4d3c25f2f3c6ab06 + +[ Upstream commit 2309df27111a51734cb9240b4d3c25f2f3c6ab06 ] + +When a physical disk is attached directly "without JBOD MAP support" (see +megasas_get_tm_devhandle()) then there is no real error handling in the +driver. Return FAILED instead of SUCCESS. + +Fixes: 18365b138508 ("megaraid_sas: Task management support") +Signed-off-by: Tomas Henzl +Link: https://lore.kernel.org/r/20230324150134.14696-1-thenzl@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/megaraid/megaraid_sas_fusion.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c +index fe70f8f1..5f746b4a 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -4768,7 +4768,7 @@ int megasas_task_abort_fusion(struct scsi_cmnd *scmd) + devhandle = megasas_get_tm_devhandle(scmd->device); + + if (devhandle == (u16)ULONG_MAX) { +- ret = SUCCESS; ++ ret = FAILED; + sdev_printk(KERN_INFO, scmd->device, + "task abort issued for invalid devhandle\n"); + mutex_unlock(&instance->reset_mutex); +@@ -4838,7 +4838,7 @@ int megasas_reset_target_fusion(struct scsi_cmnd *scmd) + devhandle = megasas_get_tm_devhandle(scmd->device); + + if (devhandle == (u16)ULONG_MAX) { +- ret = SUCCESS; ++ ret = FAILED; + sdev_printk(KERN_INFO, scmd->device, + "target reset issued for invalid devhandle\n"); + mutex_unlock(&instance->reset_mutex); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-078-scsi-mpt3sas-Don-t-print-sense-pool-info-twice.patch b/patches.kernel.org/6.2.10-078-scsi-mpt3sas-Don-t-print-sense-pool-info-twice.patch new file mode 100644 index 0000000..f8b7e7a --- /dev/null +++ b/patches.kernel.org/6.2.10-078-scsi-mpt3sas-Don-t-print-sense-pool-info-twice.patch @@ -0,0 +1,51 @@ +From: Jerry Snitselaar +Date: Fri, 24 Mar 2023 12:32:04 -0700 +Subject: [PATCH] scsi: mpt3sas: Don't print sense pool info twice +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: d684a7a26f7d2c7122a4581ac966ed64e88fb29c + +[ Upstream commit d684a7a26f7d2c7122a4581ac966ed64e88fb29c ] + +_base_allocate_sense_dma_pool() already prints out the sense pool +information, so don't print it a second time after calling it in +_base_allocate_memory_pools(). In addition the version in +_base_allocate_memory_pools() was using the wrong size value, sz, which was +last assigned when doing some nvme calculations instead of sense_sz to +determine the pool size in kilobytes. + +Cc: Sathya Prakash +Cc: Sreekanth Reddy +Cc: Suganath Prabu Subramani +Cc: MPT-FusionLinux.pdl@broadcom.com +Cc: "Martin K. Petersen" +Cc: "James E.J. Bottomley" +Fixes: 970ac2bb70e7 ("scsi: mpt3sas: Force sense buffer allocations to be within same 4 GB region") +Signed-off-by: Jerry Snitselaar +Link: https://lore.kernel.org/r/20230324193204.567932-1-jsnitsel@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 2ee9ea57..14ae0a9c 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -6616,11 +6616,6 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + else if (rc == -EAGAIN) + goto try_32bit_dma; + total_sz += sense_sz; +- ioc_info(ioc, +- "sense pool(0x%p)- dma(0x%llx): depth(%d)," +- "element_size(%d), pool_size(%d kB)\n", +- ioc->sense, (unsigned long long)ioc->sense_dma, ioc->scsiio_depth, +- SCSI_SENSE_BUFFERSIZE, sz / 1024); + /* reply pool, 4 byte align */ + sz = ioc->reply_free_queue_depth * ioc->reply_sz; + rc = _base_allocate_reply_pool(ioc, sz); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-079-net-dsa-realtek-fix-out-of-bounds-access.patch b/patches.kernel.org/6.2.10-079-net-dsa-realtek-fix-out-of-bounds-access.patch new file mode 100644 index 0000000..1fe1ea5 --- /dev/null +++ b/patches.kernel.org/6.2.10-079-net-dsa-realtek-fix-out-of-bounds-access.patch @@ -0,0 +1,65 @@ +From: Ahmad Fatoum +Date: Thu, 23 Mar 2023 11:37:35 +0100 +Subject: [PATCH] net: dsa: realtek: fix out-of-bounds access +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: b93eb564869321d0dffaf23fcc5c88112ed62466 + +[ Upstream commit b93eb564869321d0dffaf23fcc5c88112ed62466 ] + +The probe function sets priv->chip_data to (void *)priv + sizeof(*priv) +with the expectation that priv has enough trailing space. + +However, only realtek-smi actually allocated this chip_data space. +Do likewise in realtek-mdio to fix out-of-bounds accesses. + +These accesses likely went unnoticed so far, because of an (unused) +buf[4096] member in struct realtek_priv, which caused kmalloc to +round up the allocated buffer to a big enough size, so nothing of +value was overwritten. With a different allocator (like in the barebox +bootloader port of the driver) or with KASAN, the memory corruption +becomes quickly apparent. + +Fixes: aac94001067d ("net: dsa: realtek: add new mdio interface for drivers") +Reviewed-by: Florian Fainelli +Reviewed-by: Luiz Angelo Daros de Luca +Reviewed-by: Alvin Šipraga +Reviewed-by: Linus Walleij +Signed-off-by: Ahmad Fatoum +Link: https://lore.kernel.org/r/20230323103735.2331786-1-a.fatoum@pengutronix.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/dsa/realtek/realtek-mdio.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/realtek/realtek-mdio.c b/drivers/net/dsa/realtek/realtek-mdio.c +index 3e54fac5..5a8fe707 100644 +--- a/drivers/net/dsa/realtek/realtek-mdio.c ++++ b/drivers/net/dsa/realtek/realtek-mdio.c +@@ -21,6 +21,7 @@ + + #include + #include ++#include + #include + + #include "realtek.h" +@@ -152,7 +153,9 @@ static int realtek_mdio_probe(struct mdio_device *mdiodev) + if (!var) + return -EINVAL; + +- priv = devm_kzalloc(&mdiodev->dev, sizeof(*priv), GFP_KERNEL); ++ priv = devm_kzalloc(&mdiodev->dev, ++ size_add(sizeof(*priv), var->chip_data_sz), ++ GFP_KERNEL); + if (!priv) + return -ENOMEM; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-080-ptp_qoriq-fix-memory-leak-in-probe.patch b/patches.kernel.org/6.2.10-080-ptp_qoriq-fix-memory-leak-in-probe.patch new file mode 100644 index 0000000..2fcd5ff --- /dev/null +++ b/patches.kernel.org/6.2.10-080-ptp_qoriq-fix-memory-leak-in-probe.patch @@ -0,0 +1,47 @@ +From: SongJingyi +Date: Fri, 24 Mar 2023 11:14:06 +0800 +Subject: [PATCH] ptp_qoriq: fix memory leak in probe() +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: f33642224e38d7e0d59336e10e7b4e370b1c4506 + +[ Upstream commit f33642224e38d7e0d59336e10e7b4e370b1c4506 ] + +Smatch complains that: +drivers/ptp/ptp_qoriq.c ptp_qoriq_probe() +warn: 'base' from ioremap() not released. + +Fix this by revising the parameter from 'ptp_qoriq->base' to 'base'. +This is only a bug if ptp_qoriq_init() returns on the +first -ENODEV error path. +For other error paths ptp_qoriq->base and base are the same. +And this change makes the code more readable. + +Fixes: 7f4399ba405b ("ptp_qoriq: fix NULL access if ptp dt node missing") +Signed-off-by: SongJingyi +Reviewed-by: Dan Carpenter +Reviewed-by: Dongliang Mu +Link: https://lore.kernel.org/r/20230324031406.1895159-1-u201912584@hust.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/ptp/ptp_qoriq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/ptp/ptp_qoriq.c b/drivers/ptp/ptp_qoriq.c +index 08f4cf0a..8fa9772a 100644 +--- a/drivers/ptp/ptp_qoriq.c ++++ b/drivers/ptp/ptp_qoriq.c +@@ -601,7 +601,7 @@ static int ptp_qoriq_probe(struct platform_device *dev) + return 0; + + no_clock: +- iounmap(ptp_qoriq->base); ++ iounmap(base); + no_ioremap: + release_resource(ptp_qoriq->rsrc); + no_resource: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-081-net-dsa-microchip-ksz8-fix-ksz8_fdb_dump.patch b/patches.kernel.org/6.2.10-081-net-dsa-microchip-ksz8-fix-ksz8_fdb_dump.patch new file mode 100644 index 0000000..08d71c2 --- /dev/null +++ b/patches.kernel.org/6.2.10-081-net-dsa-microchip-ksz8-fix-ksz8_fdb_dump.patch @@ -0,0 +1,53 @@ +From: Oleksij Rempel +Date: Fri, 24 Mar 2023 09:06:03 +0100 +Subject: [PATCH] net: dsa: microchip: ksz8: fix ksz8_fdb_dump() +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 88e943e83827a349f70c3464b3eba7260be7461d + +[ Upstream commit 88e943e83827a349f70c3464b3eba7260be7461d ] + +Before this patch, the ksz8_fdb_dump() function had several issues, such +as uninitialized variables and incorrect usage of source port as a bit +mask. These problems caused inaccurate reporting of vid information and +port assignment in the bridge fdb. + +Fixes: e587be759e6e ("net: dsa: microchip: update fdb add/del/dump in ksz_common") +Signed-off-by: Oleksij Rempel +Acked-by: Arun Ramadoss +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/dsa/microchip/ksz8795.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/dsa/microchip/ksz8795.c b/drivers/net/dsa/microchip/ksz8795.c +index 003b0ac2..3fffd5da 100644 +--- a/drivers/net/dsa/microchip/ksz8795.c ++++ b/drivers/net/dsa/microchip/ksz8795.c +@@ -958,15 +958,14 @@ int ksz8_fdb_dump(struct ksz_device *dev, int port, + u16 entries = 0; + u8 timestamp = 0; + u8 fid; +- u8 member; +- struct alu_struct alu; ++ u8 src_port; ++ u8 mac[ETH_ALEN]; + + do { +- alu.is_static = false; +- ret = ksz8_r_dyn_mac_table(dev, i, alu.mac, &fid, &member, ++ ret = ksz8_r_dyn_mac_table(dev, i, mac, &fid, &src_port, + ×tamp, &entries); +- if (!ret && (member & BIT(port))) { +- ret = cb(alu.mac, alu.fid, alu.is_static, data); ++ if (!ret && port == src_port) { ++ ret = cb(mac, fid, false, data); + if (ret) + break; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-082-net-dsa-microchip-ksz8-fix-ksz8_fdb_dump-to-ex.patch b/patches.kernel.org/6.2.10-082-net-dsa-microchip-ksz8-fix-ksz8_fdb_dump-to-ex.patch new file mode 100644 index 0000000..c937c6e --- /dev/null +++ b/patches.kernel.org/6.2.10-082-net-dsa-microchip-ksz8-fix-ksz8_fdb_dump-to-ex.patch @@ -0,0 +1,57 @@ +From: Oleksij Rempel +Date: Fri, 24 Mar 2023 09:06:04 +0100 +Subject: [PATCH] net: dsa: microchip: ksz8: fix ksz8_fdb_dump() to extract all + 1024 entries +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 5d90492dd4ff50ad65c582c76c345d0b90001728 + +[ Upstream commit 5d90492dd4ff50ad65c582c76c345d0b90001728 ] + +Current ksz8_fdb_dump() is able to extract only max 249 entries on +the ksz8863/ksz8873 series of switches. This happened due to wrong +bit mask and offset calculation. + +This commit corrects the issue and allows for the complete extraction of +all 1024 entries. + +Fixes: 4b20a07e103f ("net: dsa: microchip: ksz8795: add support for ksz88xx chips") +Signed-off-by: Oleksij Rempel +Acked-by: Arun Ramadoss +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/dsa/microchip/ksz_common.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c +index 19cd0576..725a868b 100644 +--- a/drivers/net/dsa/microchip/ksz_common.c ++++ b/drivers/net/dsa/microchip/ksz_common.c +@@ -398,10 +398,10 @@ static const u32 ksz8863_masks[] = { + [STATIC_MAC_TABLE_FID] = GENMASK(29, 26), + [STATIC_MAC_TABLE_OVERRIDE] = BIT(20), + [STATIC_MAC_TABLE_FWD_PORTS] = GENMASK(18, 16), +- [DYNAMIC_MAC_TABLE_ENTRIES_H] = GENMASK(5, 0), ++ [DYNAMIC_MAC_TABLE_ENTRIES_H] = GENMASK(1, 0), + [DYNAMIC_MAC_TABLE_MAC_EMPTY] = BIT(7), + [DYNAMIC_MAC_TABLE_NOT_READY] = BIT(7), +- [DYNAMIC_MAC_TABLE_ENTRIES] = GENMASK(31, 28), ++ [DYNAMIC_MAC_TABLE_ENTRIES] = GENMASK(31, 24), + [DYNAMIC_MAC_TABLE_FID] = GENMASK(19, 16), + [DYNAMIC_MAC_TABLE_SRC_PORT] = GENMASK(21, 20), + [DYNAMIC_MAC_TABLE_TIMESTAMP] = GENMASK(23, 22), +@@ -411,7 +411,7 @@ static u8 ksz8863_shifts[] = { + [VLAN_TABLE_MEMBERSHIP_S] = 16, + [STATIC_MAC_FWD_PORTS] = 16, + [STATIC_MAC_FID] = 22, +- [DYNAMIC_MAC_ENTRIES_H] = 3, ++ [DYNAMIC_MAC_ENTRIES_H] = 8, + [DYNAMIC_MAC_ENTRIES] = 24, + [DYNAMIC_MAC_FID] = 16, + [DYNAMIC_MAC_TIMESTAMP] = 24, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-083-net-dsa-microchip-ksz8-fix-offset-for-the-time.patch b/patches.kernel.org/6.2.10-083-net-dsa-microchip-ksz8-fix-offset-for-the-time.patch new file mode 100644 index 0000000..ce2bd4e --- /dev/null +++ b/patches.kernel.org/6.2.10-083-net-dsa-microchip-ksz8-fix-offset-for-the-time.patch @@ -0,0 +1,38 @@ +From: Oleksij Rempel +Date: Fri, 24 Mar 2023 09:06:05 +0100 +Subject: [PATCH] net: dsa: microchip: ksz8: fix offset for the timestamp filed +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: b3177aab89be540dc50d2328427b073361093e38 + +[ Upstream commit b3177aab89be540dc50d2328427b073361093e38 ] + +We are using wrong offset, so we will get not a timestamp. + +Fixes: 4b20a07e103f ("net: dsa: microchip: ksz8795: add support for ksz88xx chips") +Signed-off-by: Oleksij Rempel +Acked-by: Arun Ramadoss +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/dsa/microchip/ksz_common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c +index 725a868b..9da2b3af 100644 +--- a/drivers/net/dsa/microchip/ksz_common.c ++++ b/drivers/net/dsa/microchip/ksz_common.c +@@ -414,7 +414,7 @@ static u8 ksz8863_shifts[] = { + [DYNAMIC_MAC_ENTRIES_H] = 8, + [DYNAMIC_MAC_ENTRIES] = 24, + [DYNAMIC_MAC_FID] = 16, +- [DYNAMIC_MAC_TIMESTAMP] = 24, ++ [DYNAMIC_MAC_TIMESTAMP] = 22, + [DYNAMIC_MAC_SRC_PORT] = 20, + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-084-net-dsa-microchip-ksz8-ksz8_fdb_dump-avoid-ext.patch b/patches.kernel.org/6.2.10-084-net-dsa-microchip-ksz8-ksz8_fdb_dump-avoid-ext.patch new file mode 100644 index 0000000..641cb0d --- /dev/null +++ b/patches.kernel.org/6.2.10-084-net-dsa-microchip-ksz8-ksz8_fdb_dump-avoid-ext.patch @@ -0,0 +1,40 @@ +From: Oleksij Rempel +Date: Fri, 24 Mar 2023 09:06:06 +0100 +Subject: [PATCH] net: dsa: microchip: ksz8: ksz8_fdb_dump: avoid extracting + ghost entry from empty dynamic MAC table. +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 492606cdc74804d372ab1bdb8f3ef4a6fb6f9f59 + +[ Upstream commit 492606cdc74804d372ab1bdb8f3ef4a6fb6f9f59 ] + +If the dynamic MAC table is empty, we will still extract one outdated +entry. Fix it by using correct bit offset. + +Fixes: 4b20a07e103f ("net: dsa: microchip: ksz8795: add support for ksz88xx chips") +Signed-off-by: Oleksij Rempel +Acked-by: Arun Ramadoss +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/dsa/microchip/ksz_common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c +index 9da2b3af..f8d04a4a 100644 +--- a/drivers/net/dsa/microchip/ksz_common.c ++++ b/drivers/net/dsa/microchip/ksz_common.c +@@ -399,7 +399,7 @@ static const u32 ksz8863_masks[] = { + [STATIC_MAC_TABLE_OVERRIDE] = BIT(20), + [STATIC_MAC_TABLE_FWD_PORTS] = GENMASK(18, 16), + [DYNAMIC_MAC_TABLE_ENTRIES_H] = GENMASK(1, 0), +- [DYNAMIC_MAC_TABLE_MAC_EMPTY] = BIT(7), ++ [DYNAMIC_MAC_TABLE_MAC_EMPTY] = BIT(2), + [DYNAMIC_MAC_TABLE_NOT_READY] = BIT(7), + [DYNAMIC_MAC_TABLE_ENTRIES] = GENMASK(31, 24), + [DYNAMIC_MAC_TABLE_FID] = GENMASK(19, 16), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-085-net-dsa-microchip-ksz8863_smi-fix-bulk-access.patch b/patches.kernel.org/6.2.10-085-net-dsa-microchip-ksz8863_smi-fix-bulk-access.patch new file mode 100644 index 0000000..6e74e71 --- /dev/null +++ b/patches.kernel.org/6.2.10-085-net-dsa-microchip-ksz8863_smi-fix-bulk-access.patch @@ -0,0 +1,91 @@ +From: Oleksij Rempel +Date: Fri, 24 Mar 2023 09:06:07 +0100 +Subject: [PATCH] net: dsa: microchip: ksz8863_smi: fix bulk access +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 392ff7a84cbca34118ca286dfbfe8aee24605897 + +[ Upstream commit 392ff7a84cbca34118ca286dfbfe8aee24605897 ] + +Current regmap bulk access is broken, resulting to wrong reads/writes +if ksz_read64/ksz_write64 functions are used. +Mostly this issue was visible by using ksz8_fdb_dump(), which returned +corrupt MAC address. + +The reason is that regmap was configured to have max_raw_read/write, +even if ksz8863_mdio_read/write functions are able to handle unlimited +read/write accesses. On ksz_read64 function we are using multiple 32bit +accesses by incrementing each access by 1 instead of 4. Resulting buffer +had 01234567.12345678 instead of 01234567.89abcdef. + +We have multiple ways to fix it: +- enable 4 byte alignment for 32bit accesses. Since the HW do not have + this requirement. It will break driver. +- disable max_raw_* limit. + +This patch is removing max_raw_* limit for regmap accesses in ksz8863_smi. + +Fixes: 60a364760002 ("net: dsa: microchip: Add Microchip KSZ8863 SMI based driver support") +Signed-off-by: Oleksij Rempel +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/dsa/microchip/ksz8863_smi.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/drivers/net/dsa/microchip/ksz8863_smi.c b/drivers/net/dsa/microchip/ksz8863_smi.c +index 2f4623f3..36981121 100644 +--- a/drivers/net/dsa/microchip/ksz8863_smi.c ++++ b/drivers/net/dsa/microchip/ksz8863_smi.c +@@ -82,22 +82,16 @@ static const struct regmap_bus regmap_smi[] = { + { + .read = ksz8863_mdio_read, + .write = ksz8863_mdio_write, +- .max_raw_read = 1, +- .max_raw_write = 1, + }, + { + .read = ksz8863_mdio_read, + .write = ksz8863_mdio_write, + .val_format_endian_default = REGMAP_ENDIAN_BIG, +- .max_raw_read = 2, +- .max_raw_write = 2, + }, + { + .read = ksz8863_mdio_read, + .write = ksz8863_mdio_write, + .val_format_endian_default = REGMAP_ENDIAN_BIG, +- .max_raw_read = 4, +- .max_raw_write = 4, + } + }; + +@@ -108,7 +102,6 @@ static const struct regmap_config ksz8863_regmap_config[] = { + .pad_bits = 24, + .val_bits = 8, + .cache_type = REGCACHE_NONE, +- .use_single_read = 1, + .lock = ksz_regmap_lock, + .unlock = ksz_regmap_unlock, + }, +@@ -118,7 +111,6 @@ static const struct regmap_config ksz8863_regmap_config[] = { + .pad_bits = 24, + .val_bits = 16, + .cache_type = REGCACHE_NONE, +- .use_single_read = 1, + .lock = ksz_regmap_lock, + .unlock = ksz_regmap_unlock, + }, +@@ -128,7 +120,6 @@ static const struct regmap_config ksz8863_regmap_config[] = { + .pad_bits = 24, + .val_bits = 32, + .cache_type = REGCACHE_NONE, +- .use_single_read = 1, + .lock = ksz_regmap_lock, + .unlock = ksz_regmap_unlock, + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-086-net-dsa-microchip-ksz8-fix-MDB-configuration-w.patch b/patches.kernel.org/6.2.10-086-net-dsa-microchip-ksz8-fix-MDB-configuration-w.patch new file mode 100644 index 0000000..7521019 --- /dev/null +++ b/patches.kernel.org/6.2.10-086-net-dsa-microchip-ksz8-fix-MDB-configuration-w.patch @@ -0,0 +1,42 @@ +From: Oleksij Rempel +Date: Fri, 24 Mar 2023 09:06:08 +0100 +Subject: [PATCH] net: dsa: microchip: ksz8: fix MDB configuration with + non-zero VID +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 9aa5757e1f71d85facdc3c98028762cbab8d15c7 + +[ Upstream commit 9aa5757e1f71d85facdc3c98028762cbab8d15c7 ] + +FID is directly mapped to VID. However, configuring a MAC address with a +VID != 0 resulted in incorrect configuration due to an incorrect bit +mask. This kernel commit fixed the issue by correcting the bit mask and +ensuring proper configuration of MAC addresses with non-zero VID. + +Fixes: 4b20a07e103f ("net: dsa: microchip: ksz8795: add support for ksz88xx chips") +Signed-off-by: Oleksij Rempel +Acked-by: Arun Ramadoss +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/dsa/microchip/ksz_common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c +index f8d04a4a..8601a9e4 100644 +--- a/drivers/net/dsa/microchip/ksz_common.c ++++ b/drivers/net/dsa/microchip/ksz_common.c +@@ -395,7 +395,7 @@ static const u32 ksz8863_masks[] = { + [VLAN_TABLE_VALID] = BIT(19), + [STATIC_MAC_TABLE_VALID] = BIT(19), + [STATIC_MAC_TABLE_USE_FID] = BIT(21), +- [STATIC_MAC_TABLE_FID] = GENMASK(29, 26), ++ [STATIC_MAC_TABLE_FID] = GENMASK(25, 22), + [STATIC_MAC_TABLE_OVERRIDE] = BIT(20), + [STATIC_MAC_TABLE_FWD_PORTS] = GENMASK(18, 16), + [DYNAMIC_MAC_TABLE_ENTRIES_H] = GENMASK(1, 0), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-087-r8169-fix-RTL8168H-and-RTL8107E-rx-crc-error.patch b/patches.kernel.org/6.2.10-087-r8169-fix-RTL8168H-and-RTL8107E-rx-crc-error.patch new file mode 100644 index 0000000..1202ca2 --- /dev/null +++ b/patches.kernel.org/6.2.10-087-r8169-fix-RTL8168H-and-RTL8107E-rx-crc-error.patch @@ -0,0 +1,43 @@ +From: ChunHao Lin +Date: Thu, 23 Mar 2023 22:33:09 +0800 +Subject: [PATCH] r8169: fix RTL8168H and RTL8107E rx crc error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 33189f0a94b9639c058781fcf82e4ea3803b1682 + +[ Upstream commit 33189f0a94b9639c058781fcf82e4ea3803b1682 ] + +When link speed is 10 Mbps and temperature is under -20°C, RTL8168H and +RTL8107E may have rx crc error. Disable phy 10 Mbps pll off to fix this +issue. + +Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E") +Signed-off-by: ChunHao Lin +Reviewed-by: Heiner Kallweit +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/realtek/r8169_phy_config.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/realtek/r8169_phy_config.c b/drivers/net/ethernet/realtek/r8169_phy_config.c +index 930496cd..b50f1678 100644 +--- a/drivers/net/ethernet/realtek/r8169_phy_config.c ++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c +@@ -826,6 +826,9 @@ static void rtl8168h_2_hw_phy_config(struct rtl8169_private *tp, + /* disable phy pfm mode */ + phy_modify_paged(phydev, 0x0a44, 0x11, BIT(7), 0); + ++ /* disable 10m pll off */ ++ phy_modify_paged(phydev, 0x0a43, 0x10, BIT(0), 0); ++ + rtl8168g_disable_aldps(phydev); + rtl8168g_config_eee_phy(phydev); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-088-regulator-Handle-deferred-clk.patch b/patches.kernel.org/6.2.10-088-regulator-Handle-deferred-clk.patch new file mode 100644 index 0000000..d11caeb --- /dev/null +++ b/patches.kernel.org/6.2.10-088-regulator-Handle-deferred-clk.patch @@ -0,0 +1,40 @@ +From: Christophe JAILLET +Date: Sun, 26 Mar 2023 10:29:33 +0200 +Subject: [PATCH] regulator: Handle deferred clk +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 02bcba0b9f9da706d5bd1e8cbeb83493863e17b5 + +[ Upstream commit 02bcba0b9f9da706d5bd1e8cbeb83493863e17b5 ] + +devm_clk_get() can return -EPROBE_DEFER. So it is better to return the +error code from devm_clk_get(), instead of a hard coded -ENOENT. + +This gives more opportunities to successfully probe the driver. + +Fixes: 8959e5324485 ("regulator: fixed: add possibility to enable by clock") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/18459fae3d017a66313699c7c8456b28158b2dd0.1679819354.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/regulator/fixed.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c +index 2a9867ab..e6724a22 100644 +--- a/drivers/regulator/fixed.c ++++ b/drivers/regulator/fixed.c +@@ -215,7 +215,7 @@ static int reg_fixed_voltage_probe(struct platform_device *pdev) + drvdata->enable_clock = devm_clk_get(dev, NULL); + if (IS_ERR(drvdata->enable_clock)) { + dev_err(dev, "Can't get enable-clock from devicetree\n"); +- return -ENOENT; ++ return PTR_ERR(drvdata->enable_clock); + } + } else if (drvtype && drvtype->has_performance_state) { + drvdata->desc.ops = &fixed_voltage_domain_ops; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-089-net-net_failover-fix-txq-exceeding-warning.patch b/patches.kernel.org/6.2.10-089-net-net_failover-fix-txq-exceeding-warning.patch new file mode 100644 index 0000000..7018419 --- /dev/null +++ b/patches.kernel.org/6.2.10-089-net-net_failover-fix-txq-exceeding-warning.patch @@ -0,0 +1,91 @@ +From: Faicker Mo +Date: Fri, 24 Mar 2023 17:19:54 +0800 +Subject: [PATCH] net/net_failover: fix txq exceeding warning +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: e3cbdcb0fbb61045ef3ce0e072927cc41737f787 + +[ Upstream commit e3cbdcb0fbb61045ef3ce0e072927cc41737f787 ] + +The failover txq is inited as 16 queues. +when a packet is transmitted from the failover device firstly, +the failover device will select the queue which is returned from +the primary device if the primary device is UP and running. +If the primary device txq is bigger than the default 16, +it can lead to the following warning: +eth0 selects TX queue 18, but real number of TX queues is 16 + +The warning backtrace is: +[ 32.146376] CPU: 18 PID: 9134 Comm: chronyd Tainted: G E 6.2.8-1.el7.centos.x86_64 #1 +[ 32.147175] Hardware name: Red Hat KVM, BIOS 1.10.2-3.el7_4.1 04/01/2014 +[ 32.147730] Call Trace: +[ 32.147971] +[ 32.148183] dump_stack_lvl+0x48/0x70 +[ 32.148514] dump_stack+0x10/0x20 +[ 32.148820] netdev_core_pick_tx+0xb1/0xe0 +[ 32.149180] __dev_queue_xmit+0x529/0xcf0 +[ 32.149533] ? __check_object_size.part.0+0x21c/0x2c0 +[ 32.149967] ip_finish_output2+0x278/0x560 +[ 32.150327] __ip_finish_output+0x1fe/0x2f0 +[ 32.150690] ip_finish_output+0x2a/0xd0 +[ 32.151032] ip_output+0x7a/0x110 +[ 32.151337] ? __pfx_ip_finish_output+0x10/0x10 +[ 32.151733] ip_local_out+0x5e/0x70 +[ 32.152054] ip_send_skb+0x19/0x50 +[ 32.152366] udp_send_skb.isra.0+0x163/0x3a0 +[ 32.152736] udp_sendmsg+0xba8/0xec0 +[ 32.153060] ? __folio_memcg_unlock+0x25/0x60 +[ 32.153445] ? __pfx_ip_generic_getfrag+0x10/0x10 +[ 32.153854] ? sock_has_perm+0x85/0xa0 +[ 32.154190] inet_sendmsg+0x6d/0x80 +[ 32.154508] ? inet_sendmsg+0x6d/0x80 +[ 32.154838] sock_sendmsg+0x62/0x70 +[ 32.155152] ____sys_sendmsg+0x134/0x290 +[ 32.155499] ___sys_sendmsg+0x81/0xc0 +[ 32.155828] ? _get_random_bytes.part.0+0x79/0x1a0 +[ 32.156240] ? ip4_datagram_release_cb+0x5f/0x1e0 +[ 32.156649] ? get_random_u16+0x69/0xf0 +[ 32.156989] ? __fget_light+0xcf/0x110 +[ 32.157326] __sys_sendmmsg+0xc4/0x210 +[ 32.157657] ? __sys_connect+0xb7/0xe0 +[ 32.157995] ? __audit_syscall_entry+0xce/0x140 +[ 32.158388] ? syscall_trace_enter.isra.0+0x12c/0x1a0 +[ 32.158820] __x64_sys_sendmmsg+0x24/0x30 +[ 32.159171] do_syscall_64+0x38/0x90 +[ 32.159493] entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Fix that by reducing txq number as the non-existent primary-dev does. + +Fixes: cfc80d9a1163 ("net: Introduce net_failover driver") +Signed-off-by: Faicker Mo +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/net_failover.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/net_failover.c b/drivers/net/net_failover.c +index 7a28e082..d0c916a5 100644 +--- a/drivers/net/net_failover.c ++++ b/drivers/net/net_failover.c +@@ -130,14 +130,10 @@ static u16 net_failover_select_queue(struct net_device *dev, + txq = ops->ndo_select_queue(primary_dev, skb, sb_dev); + else + txq = netdev_pick_tx(primary_dev, skb, NULL); +- +- qdisc_skb_cb(skb)->slave_dev_queue_mapping = skb->queue_mapping; +- +- return txq; ++ } else { ++ txq = skb_rx_queue_recorded(skb) ? skb_get_rx_queue(skb) : 0; + } + +- txq = skb_rx_queue_recorded(skb) ? skb_get_rx_queue(skb) : 0; +- + /* Save the original txq to restore before passing to the driver */ + qdisc_skb_cb(skb)->slave_dev_queue_mapping = skb->queue_mapping; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-090-net-stmmac-don-t-reject-VLANs-when-IFF_PROMISC.patch b/patches.kernel.org/6.2.10-090-net-stmmac-don-t-reject-VLANs-when-IFF_PROMISC.patch new file mode 100644 index 0000000..a1b104c --- /dev/null +++ b/patches.kernel.org/6.2.10-090-net-stmmac-don-t-reject-VLANs-when-IFF_PROMISC.patch @@ -0,0 +1,290 @@ +From: Vladimir Oltean +Date: Sat, 25 Mar 2023 13:28:15 +0200 +Subject: [PATCH] net: stmmac: don't reject VLANs when IFF_PROMISC is set +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: a7602e7332b97cfbec7bacb0f1ade99a575fe104 + +[ Upstream commit a7602e7332b97cfbec7bacb0f1ade99a575fe104 ] + +The blamed commit has introduced the following tests to +dwmac4_add_hw_vlan_rx_fltr(), called from stmmac_vlan_rx_add_vid(): + + if (hw->promisc) { + netdev_err(dev, + "Adding VLAN in promisc mode not supported\n"); + return -EPERM; + } + +"VLAN promiscuous" mode is keyed in this driver to IFF_PROMISC, and so, +vlan_vid_add() and vlan_vid_del() calls cannot take place in IFF_PROMISC +mode. I have the following 2 arguments that this restriction is.... hm, +how shall I put it nicely... unproductive :) + +First, take the case of a Linux bridge. If the kernel is compiled with +CONFIG_BRIDGE_VLAN_FILTERING=y, then this bridge shall have a VLAN +database. The bridge shall try to call vlan_add_vid() on its bridge +ports for each VLAN in the VLAN table. It will do this irrespectively of +whether that port is *currently* VLAN-aware or not. So it will do this +even when the bridge was created with vlan_filtering 0. +But the Linux bridge, in VLAN-unaware mode, configures its ports in +promiscuous (IFF_PROMISC) mode, so that they accept packets with any +MAC DA (a switch must do this in order to forward those packets which +are not directly targeted to its MAC address). + +As a result, the stmmac driver does not work as a bridge port, when the +kernel is compiled with CONFIG_BRIDGE_VLAN_FILTERING=y. + +$ ip link add br0 type bridge && ip link set br0 up +$ ip link set eth0 master br0 && ip link set eth0 up +[ 2333.943296] br0: port 1(eth0) entered blocking state +[ 2333.943381] br0: port 1(eth0) entered disabled state +[ 2333.943782] device eth0 entered promiscuous mode +[ 2333.944080] 4033c000.ethernet eth0: Adding VLAN in promisc mode not supported +[ 2333.976509] 4033c000.ethernet eth0: failed to initialize vlan filtering on this port +RTNETLINK answers: Operation not permitted + +Secondly, take the case of stmmac as DSA master. Some switch tagging +protocols are based on 802.1Q VLANs (tag_sja1105.c), and as such, +tag_8021q.c uses vlan_vid_add() to work with VLAN-filtering DSA masters. +But also, when a DSA port becomes promiscuous (for example when it joins +a bridge), the DSA framework also makes the DSA master promiscuous. + +Moreover, for every VLAN that a DSA switch sends to the CPU, DSA also +programs a VLAN filter on the DSA master, because if the the DSA switch +uses a tail tag, then the hardware frame parser of the DSA master will +see VLAN as VLAN, and might filter them out, for being unknown. + +Due to the above 2 reasons, my belief is that the stmmac driver does not +get to choose to not accept vlan_vid_add() calls while IFF_PROMISC is +enabled, because the 2 are completely independent and there are code +paths in the network stack which directly lead to this situation +occurring, without the user's direct input. + +In fact, my belief is that "VLAN promiscuous" mode should have never +been keyed on IFF_PROMISC in the first place, but rather, on the +NETIF_F_HW_VLAN_CTAG_FILTER feature flag which can be toggled by the +user through ethtool -k, when present in netdev->hw_features. + +In the stmmac driver, NETIF_F_HW_VLAN_CTAG_FILTER is only present in +"features", making this feature "on [fixed]". + +I have this belief because I am unaware of any definition of promiscuity +which implies having an effect on anything other than MAC DA (therefore +not VLAN). However, I seem to be rather alone in having this opinion, +looking back at the disagreements from this discussion: +https://lore.kernel.org/netdev/20201110153958.ci5ekor3o2ekg3ky@ipetronik.com/ + +In any case, to remove the vlan_vid_add() dependency on !IFF_PROMISC, +one would need to remove the check and see what fails. I guess the test +was there because of the way in which dwmac4_vlan_promisc_enable() is +implemented. + +For context, the dwmac4 supports Perfect Filtering for a limited number +of VLANs - dwmac4_get_num_vlan(), priv->hw->num_vlan, with a fallback on +Hash Filtering - priv->dma_cap.vlhash - see stmmac_vlan_update(), also +visible in cat /sys/kernel/debug/stmmaceth/eth0/dma_cap | grep 'VLAN +Hash Filtering'. + +The perfect filtering is based on MAC_VLAN_Tag_Filter/MAC_VLAN_Tag_Data +registers, accessed in the driver through dwmac4_write_vlan_filter(). + +The hash filtering is based on the MAC_VLAN_Hash_Table register, named +GMAC_VLAN_HASH_TABLE in the driver and accessed by dwmac4_update_vlan_hash(). +The control bit for enabling hash filtering is GMAC_VLAN_VTHM +(MAC_VLAN_Tag_Ctrl bit VTHM: VLAN Tag Hash Table Match Enable). + +Now, the description of dwmac4_vlan_promisc_enable() is that it iterates +through the driver's cache of perfect filter entries (hw->vlan_filter[i], +added by dwmac4_add_hw_vlan_rx_fltr()), and evicts them from hardware by +unsetting their GMAC_VLAN_TAG_DATA_VEN (MAC_VLAN_Tag_Data bit VEN - VLAN +Tag Enable) bit. Then it unsets the GMAC_VLAN_VTHM bit, which disables +hash matching. + +This leaves the MAC, according to table "VLAN Match Status" from the +documentation, to always enter these data paths: + +VID |VLAN Perfect Filter |VTHM Bit |VLAN Hash Filter |Final VLAN Match + |Match Result | |Match Result |Status +-------|--------------------|---------|-----------------|---------------- +VID!=0 |Fail |0 |don't care |Pass + +So, dwmac4_vlan_promisc_enable() does its job, but by unsetting +GMAC_VLAN_VTHM, it conflicts with the other code path which controls +this bit: dwmac4_update_vlan_hash(), called through stmmac_update_vlan_hash() +from stmmac_vlan_rx_add_vid() and from stmmac_vlan_rx_kill_vid(). +This is, I guess, why dwmac4_add_hw_vlan_rx_fltr() is not allowed to run +after dwmac4_vlan_promisc_enable() has unset GMAC_VLAN_VTHM: because if +it did, then dwmac4_update_vlan_hash() would set GMAC_VLAN_VTHM again, +breaking the "VLAN promiscuity". + +It turns out that dwmac4_vlan_promisc_enable() is way too complicated +for what needs to be done. The MAC_Packet_Filter register also has the +VTFE bit (VLAN Tag Filter Enable), which simply controls whether VLAN +tagged packets which don't match the filtering tables (either perfect or +hash) are dropped or not. At the moment, this driver unconditionally +sets GMAC_PACKET_FILTER_VTFE if NETIF_F_HW_VLAN_CTAG_FILTER was detected +through the priv->dma_cap.vlhash capability bits of the device, in +stmmac_dvr_probe(). + +I would suggest deleting the unnecessarily complex logic from +dwmac4_vlan_promisc_enable(), and simply unsetting GMAC_PACKET_FILTER_VTFE +when becoming IFF_PROMISC, which has the same effect of allowing packets +with any VLAN tags, but has the additional benefit of being able to run +concurrently with stmmac_vlan_rx_add_vid() and stmmac_vlan_rx_kill_vid(). + +As much as I believe that the VTFE bit should have been exclusively +controlled by NETIF_F_HW_VLAN_CTAG_FILTER through ethtool, and not by +IFF_PROMISC, changing that is not a punctual fix to the problem, and it +would probably break the VFFQ feature added by the later commit +e0f9956a3862 ("net: stmmac: Add option for VLAN filter fail queue +enable"). From the commit description, VFFQ needs IFF_PROMISC=on and +VTFE=off in order to work (and this change respects that). But if VTFE +was changed to be controlled through ethtool -k, then a user-visible +change would have been introduced in Intel's scripts (a need to run +"ethtool -k eth0 rx-vlan-filter off" which did not exist before). + +The patch was tested with this set of commands: + + ip link set eth0 up + ip link add link eth0 name eth0.100 type vlan id 100 + ip addr add 192.168.100.2/24 dev eth0.100 && ip link set eth0.100 up + ip link set eth0 promisc on + ip link add link eth0 name eth0.101 type vlan id 101 + ip addr add 192.168.101.2/24 dev eth0.101 && ip link set eth0.101 up + ip link set eth0 promisc off + ping -c 5 192.168.100.1 + ping -c 5 192.168.101.1 + ip link set eth0 promisc on + ping -c 5 192.168.100.1 + ping -c 5 192.168.101.1 + ip link del eth0.100 + ip link del eth0.101 + # Wait for VLAN-tagged pings from the other end... + # Check with "tcpdump -i eth0 -e -n -p" and we should see them + ip link set eth0 promisc off + # Wait for VLAN-tagged pings from the other end... + # Check with "tcpdump -i eth0 -e -n -p" and we shouldn't see them + # anymore, but remove the "-p" argument from tcpdump and they're there. + +Fixes: c89f44ff10fd ("net: stmmac: Add support for VLAN promiscuous mode") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/stmicro/stmmac/common.h | 1 - + .../net/ethernet/stmicro/stmmac/dwmac4_core.c | 61 +------------------ + 2 files changed, 3 insertions(+), 59 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h +index ec9c1302..54bb072a 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/common.h ++++ b/drivers/net/ethernet/stmicro/stmmac/common.h +@@ -532,7 +532,6 @@ struct mac_device_info { + unsigned int xlgmac; + unsigned int num_vlan; + u32 vlan_filter[32]; +- unsigned int promisc; + bool vlan_fail_q_en; + u8 vlan_fail_q; + }; +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +index 8c7a0b7c..36251ec2 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +@@ -472,12 +472,6 @@ static int dwmac4_add_hw_vlan_rx_fltr(struct net_device *dev, + if (vid > 4095) + return -EINVAL; + +- if (hw->promisc) { +- netdev_err(dev, +- "Adding VLAN in promisc mode not supported\n"); +- return -EPERM; +- } +- + /* Single Rx VLAN Filter */ + if (hw->num_vlan == 1) { + /* For single VLAN filter, VID 0 means VLAN promiscuous */ +@@ -527,12 +521,6 @@ static int dwmac4_del_hw_vlan_rx_fltr(struct net_device *dev, + { + int i, ret = 0; + +- if (hw->promisc) { +- netdev_err(dev, +- "Deleting VLAN in promisc mode not supported\n"); +- return -EPERM; +- } +- + /* Single Rx VLAN Filter */ + if (hw->num_vlan == 1) { + if ((hw->vlan_filter[0] & GMAC_VLAN_TAG_VID) == vid) { +@@ -557,39 +545,6 @@ static int dwmac4_del_hw_vlan_rx_fltr(struct net_device *dev, + return ret; + } + +-static void dwmac4_vlan_promisc_enable(struct net_device *dev, +- struct mac_device_info *hw) +-{ +- void __iomem *ioaddr = hw->pcsr; +- u32 value; +- u32 hash; +- u32 val; +- int i; +- +- /* Single Rx VLAN Filter */ +- if (hw->num_vlan == 1) { +- dwmac4_write_single_vlan(dev, 0); +- return; +- } +- +- /* Extended Rx VLAN Filter Enable */ +- for (i = 0; i < hw->num_vlan; i++) { +- if (hw->vlan_filter[i] & GMAC_VLAN_TAG_DATA_VEN) { +- val = hw->vlan_filter[i] & ~GMAC_VLAN_TAG_DATA_VEN; +- dwmac4_write_vlan_filter(dev, hw, i, val); +- } +- } +- +- hash = readl(ioaddr + GMAC_VLAN_HASH_TABLE); +- if (hash & GMAC_VLAN_VLHT) { +- value = readl(ioaddr + GMAC_VLAN_TAG); +- if (value & GMAC_VLAN_VTHM) { +- value &= ~GMAC_VLAN_VTHM; +- writel(value, ioaddr + GMAC_VLAN_TAG); +- } +- } +-} +- + static void dwmac4_restore_hw_vlan_rx_fltr(struct net_device *dev, + struct mac_device_info *hw) + { +@@ -709,22 +664,12 @@ static void dwmac4_set_filter(struct mac_device_info *hw, + } + + /* VLAN filtering */ +- if (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER) ++ if (dev->flags & IFF_PROMISC && !hw->vlan_fail_q_en) ++ value &= ~GMAC_PACKET_FILTER_VTFE; ++ else if (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER) + value |= GMAC_PACKET_FILTER_VTFE; + + writel(value, ioaddr + GMAC_PACKET_FILTER); +- +- if (dev->flags & IFF_PROMISC && !hw->vlan_fail_q_en) { +- if (!hw->promisc) { +- hw->promisc = 1; +- dwmac4_vlan_promisc_enable(dev, hw); +- } +- } else { +- if (hw->promisc) { +- hw->promisc = 0; +- dwmac4_restore_hw_vlan_rx_fltr(dev, hw); +- } +- } + } + + static void dwmac4_flow_ctrl(struct mac_device_info *hw, unsigned int duplex, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-091-drm-i915-pmu-Use-functions-common-with-sysfs-t.patch b/patches.kernel.org/6.2.10-091-drm-i915-pmu-Use-functions-common-with-sysfs-t.patch new file mode 100644 index 0000000..ae17f24 --- /dev/null +++ b/patches.kernel.org/6.2.10-091-drm-i915-pmu-Use-functions-common-with-sysfs-t.patch @@ -0,0 +1,182 @@ +From: Ashutosh Dixit +Date: Wed, 15 Mar 2023 17:48:00 -0700 +Subject: [PATCH] drm/i915/pmu: Use functions common with sysfs to read actual + freq +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 12d4eb20d9d86fae5f84117ff047e966e470f7b9 + +[ Upstream commit 12d4eb20d9d86fae5f84117ff047e966e470f7b9 ] + +Expose intel_rps_read_actual_frequency_fw to read the actual freq without +taking forcewake for use by PMU. The code is refactored to use a common set +of functions across sysfs and PMU. Using common functions with sysfs in PMU +solves the issues of missing support for MTL and missing support for older +generations (prior to Gen6). It also future proofs the PMU where sometimes +code has been updated for sysfs and PMU has been missed. + +v2: Remove runtime_pm_if_in_use from read_actual_frequency_fw (Tvrtko) + +v3: (Tvrtko) + - Remove goto in __read_cagf + - Unexport intel_rps_get_cagf and intel_rps_read_punit_req + +Fixes: 22009b6dad66 ("drm/i915/mtl: Modify CAGF functions for MTL") +Link: https://gitlab.freedesktop.org/drm/intel/-/issues/8280 +Signed-off-by: Ashutosh Dixit +Reviewed-by: Tvrtko Ursulin +Signed-off-by: Tvrtko Ursulin +Link: https://patchwork.freedesktop.org/patch/msgid/20230316004800.2539753-1-ashutosh.dixit@intel.com +(cherry picked from commit 44df42e66139b5fac8db49ee354be279210f9816) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/gt/intel_rps.c | 38 ++++++++++++++++------------- + drivers/gpu/drm/i915/gt/intel_rps.h | 4 +-- + drivers/gpu/drm/i915/i915_pmu.c | 10 +++----- + 3 files changed, 26 insertions(+), 26 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_rps.c b/drivers/gpu/drm/i915/gt/intel_rps.c +index 9ad3bc72..fc73cfe0 100644 +--- a/drivers/gpu/drm/i915/gt/intel_rps.c ++++ b/drivers/gpu/drm/i915/gt/intel_rps.c +@@ -2074,16 +2074,6 @@ void intel_rps_sanitize(struct intel_rps *rps) + rps_disable_interrupts(rps); + } + +-u32 intel_rps_read_rpstat_fw(struct intel_rps *rps) +-{ +- struct drm_i915_private *i915 = rps_to_i915(rps); +- i915_reg_t rpstat; +- +- rpstat = (GRAPHICS_VER(i915) >= 12) ? GEN12_RPSTAT1 : GEN6_RPSTAT1; +- +- return intel_uncore_read_fw(rps_to_gt(rps)->uncore, rpstat); +-} +- + u32 intel_rps_read_rpstat(struct intel_rps *rps) + { + struct drm_i915_private *i915 = rps_to_i915(rps); +@@ -2094,7 +2084,7 @@ u32 intel_rps_read_rpstat(struct intel_rps *rps) + return intel_uncore_read(rps_to_gt(rps)->uncore, rpstat); + } + +-u32 intel_rps_get_cagf(struct intel_rps *rps, u32 rpstat) ++static u32 intel_rps_get_cagf(struct intel_rps *rps, u32 rpstat) + { + struct drm_i915_private *i915 = rps_to_i915(rps); + u32 cagf; +@@ -2117,10 +2107,11 @@ u32 intel_rps_get_cagf(struct intel_rps *rps, u32 rpstat) + return cagf; + } + +-static u32 read_cagf(struct intel_rps *rps) ++static u32 __read_cagf(struct intel_rps *rps, bool take_fw) + { + struct drm_i915_private *i915 = rps_to_i915(rps); + struct intel_uncore *uncore = rps_to_uncore(rps); ++ i915_reg_t r = INVALID_MMIO_REG; + u32 freq; + + /* +@@ -2128,22 +2119,30 @@ static u32 read_cagf(struct intel_rps *rps) + * registers will return 0 freq when GT is in RC6 + */ + if (GRAPHICS_VER_FULL(i915) >= IP_VER(12, 70)) { +- freq = intel_uncore_read(uncore, MTL_MIRROR_TARGET_WP1); ++ r = MTL_MIRROR_TARGET_WP1; + } else if (GRAPHICS_VER(i915) >= 12) { +- freq = intel_uncore_read(uncore, GEN12_RPSTAT1); ++ r = GEN12_RPSTAT1; + } else if (IS_VALLEYVIEW(i915) || IS_CHERRYVIEW(i915)) { + vlv_punit_get(i915); + freq = vlv_punit_read(i915, PUNIT_REG_GPU_FREQ_STS); + vlv_punit_put(i915); + } else if (GRAPHICS_VER(i915) >= 6) { +- freq = intel_uncore_read(uncore, GEN6_RPSTAT1); ++ r = GEN6_RPSTAT1; + } else { +- freq = intel_uncore_read(uncore, MEMSTAT_ILK); ++ r = MEMSTAT_ILK; + } + ++ if (i915_mmio_reg_valid(r)) ++ freq = take_fw ? intel_uncore_read(uncore, r) : intel_uncore_read_fw(uncore, r); ++ + return intel_rps_get_cagf(rps, freq); + } + ++static u32 read_cagf(struct intel_rps *rps) ++{ ++ return __read_cagf(rps, true); ++} ++ + u32 intel_rps_read_actual_frequency(struct intel_rps *rps) + { + struct intel_runtime_pm *rpm = rps_to_uncore(rps)->rpm; +@@ -2156,7 +2155,12 @@ u32 intel_rps_read_actual_frequency(struct intel_rps *rps) + return freq; + } + +-u32 intel_rps_read_punit_req(struct intel_rps *rps) ++u32 intel_rps_read_actual_frequency_fw(struct intel_rps *rps) ++{ ++ return intel_gpu_freq(rps, __read_cagf(rps, false)); ++} ++ ++static u32 intel_rps_read_punit_req(struct intel_rps *rps) + { + struct intel_uncore *uncore = rps_to_uncore(rps); + struct intel_runtime_pm *rpm = rps_to_uncore(rps)->rpm; +diff --git a/drivers/gpu/drm/i915/gt/intel_rps.h b/drivers/gpu/drm/i915/gt/intel_rps.h +index 9e1cad9b..d86ddfee 100644 +--- a/drivers/gpu/drm/i915/gt/intel_rps.h ++++ b/drivers/gpu/drm/i915/gt/intel_rps.h +@@ -34,8 +34,8 @@ void intel_rps_mark_interactive(struct intel_rps *rps, bool interactive); + + int intel_gpu_freq(struct intel_rps *rps, int val); + int intel_freq_opcode(struct intel_rps *rps, int val); +-u32 intel_rps_get_cagf(struct intel_rps *rps, u32 rpstat1); + u32 intel_rps_read_actual_frequency(struct intel_rps *rps); ++u32 intel_rps_read_actual_frequency_fw(struct intel_rps *rps); + u32 intel_rps_get_requested_frequency(struct intel_rps *rps); + u32 intel_rps_get_min_frequency(struct intel_rps *rps); + u32 intel_rps_get_min_raw_freq(struct intel_rps *rps); +@@ -46,10 +46,8 @@ int intel_rps_set_max_frequency(struct intel_rps *rps, u32 val); + u32 intel_rps_get_rp0_frequency(struct intel_rps *rps); + u32 intel_rps_get_rp1_frequency(struct intel_rps *rps); + u32 intel_rps_get_rpn_frequency(struct intel_rps *rps); +-u32 intel_rps_read_punit_req(struct intel_rps *rps); + u32 intel_rps_read_punit_req_frequency(struct intel_rps *rps); + u32 intel_rps_read_rpstat(struct intel_rps *rps); +-u32 intel_rps_read_rpstat_fw(struct intel_rps *rps); + void gen6_rps_get_freq_caps(struct intel_rps *rps, struct intel_rps_freq_caps *caps); + void intel_rps_raise_unslice(struct intel_rps *rps); + void intel_rps_lower_unslice(struct intel_rps *rps); +diff --git a/drivers/gpu/drm/i915/i915_pmu.c b/drivers/gpu/drm/i915/i915_pmu.c +index 52531ab2..6d422b05 100644 +--- a/drivers/gpu/drm/i915/i915_pmu.c ++++ b/drivers/gpu/drm/i915/i915_pmu.c +@@ -393,14 +393,12 @@ frequency_sample(struct intel_gt *gt, unsigned int period_ns) + * case we assume the system is running at the intended + * frequency. Fortunately, the read should rarely fail! + */ +- val = intel_rps_read_rpstat_fw(rps); +- if (val) +- val = intel_rps_get_cagf(rps, val); +- else +- val = rps->cur_freq; ++ val = intel_rps_read_actual_frequency_fw(rps); ++ if (!val) ++ val = intel_gpu_freq(rps, rps->cur_freq); + + add_sample_mult(&pmu->sample[__I915_SAMPLE_FREQ_ACT], +- intel_gpu_freq(rps, val), period_ns / 1000); ++ val, period_ns / 1000); + } + + if (pmu->enable & config_mask(I915_PMU_REQUESTED_FREQUENCY)) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-092-drm-i915-tc-Fix-the-ICL-PHY-ownership-check-in.patch b/patches.kernel.org/6.2.10-092-drm-i915-tc-Fix-the-ICL-PHY-ownership-check-in.patch new file mode 100644 index 0000000..679ae58 --- /dev/null +++ b/patches.kernel.org/6.2.10-092-drm-i915-tc-Fix-the-ICL-PHY-ownership-check-in.patch @@ -0,0 +1,52 @@ +From: Imre Deak +Date: Thu, 16 Mar 2023 15:17:13 +0200 +Subject: [PATCH] drm/i915/tc: Fix the ICL PHY ownership check in TC-cold state +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 38c583019484f190d5b33f59b8ae810e6b1763c6 + +[ Upstream commit 38c583019484f190d5b33f59b8ae810e6b1763c6 ] + +The commit renaming icl_tc_phy_is_in_safe_mode() to +icl_tc_phy_take_ownership() didn't flip the function's return value +accordingly, fix this up. + +This didn't cause an actual problem besides state check errors, since +the function is only used during HW readout. + +Cc: José Roberto de Souza +Fixes: f53979d68a77 ("drm/i915/display/tc: Rename safe_mode functions ownership") +Reviewed-by: José Roberto de Souza +Reviewed-by: Ville Syrjälä +Signed-off-by: Imre Deak +Link: https://patchwork.freedesktop.org/patch/msgid/20230316131724.359612-4-imre.deak@intel.com +(cherry picked from commit f2c7959dda614d9b7c6a41510492de39d31705ec) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/display/intel_tc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_tc.c b/drivers/gpu/drm/i915/display/intel_tc.c +index 70624b4b..c5d41fd5 100644 +--- a/drivers/gpu/drm/i915/display/intel_tc.c ++++ b/drivers/gpu/drm/i915/display/intel_tc.c +@@ -436,9 +436,9 @@ static bool icl_tc_phy_is_owned(struct intel_digital_port *dig_port) + PORT_TX_DFLEXDPCSSS(dig_port->tc_phy_fia)); + if (val == 0xffffffff) { + drm_dbg_kms(&i915->drm, +- "Port %s: PHY in TCCOLD, assume safe mode\n", ++ "Port %s: PHY in TCCOLD, assume not owned\n", + dig_port->tc_port_name); +- return true; ++ return false; + } + + return val & DP_PHY_MODE_STATUS_NOT_SAFE(dig_port->tc_phy_fia_idx); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-093-drm-i915-perf-Drop-wakeref-on-GuC-RC-error.patch b/patches.kernel.org/6.2.10-093-drm-i915-perf-Drop-wakeref-on-GuC-RC-error.patch new file mode 100644 index 0000000..181611a --- /dev/null +++ b/patches.kernel.org/6.2.10-093-drm-i915-perf-Drop-wakeref-on-GuC-RC-error.patch @@ -0,0 +1,93 @@ +From: Chris Wilson +Date: Thu, 23 Mar 2023 15:58:51 -0700 +Subject: [PATCH] drm/i915/perf: Drop wakeref on GuC RC error +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 5c95b2d5d44fa250ce8aeee27bdb39b381d03857 + +[ Upstream commit 5c95b2d5d44fa250ce8aeee27bdb39b381d03857 ] + +If we fail to adjust the GuC run-control on opening the perf stream, +make sure we unwind the wakeref just taken. + +v2: Retain old goto label names (Ashutosh) +v3: Drop bitfield boolean + +Fixes: 01e742746785 ("drm/i915/guc: Support OA when Wa_16011777198 is enabled") +Signed-off-by: Chris Wilson +Reviewed-by: Ashutosh Dixit +Signed-off-by: Umesh Nerlige Ramappa +Link: https://patchwork.freedesktop.org/patch/msgid/20230323225901.3743681-2-umesh.nerlige.ramappa@intel.com +(cherry picked from commit 2810ac6c753d17ee2572ffb57fe2382a786a080a) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/i915_perf.c | 14 +++++++++----- + drivers/gpu/drm/i915/i915_perf_types.h | 6 ++++++ + 2 files changed, 15 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c +index 125b6ca2..7d5e2c53 100644 +--- a/drivers/gpu/drm/i915/i915_perf.c ++++ b/drivers/gpu/drm/i915/i915_perf.c +@@ -1592,9 +1592,7 @@ static void i915_oa_stream_destroy(struct i915_perf_stream *stream) + /* + * Wa_16011777198:dg2: Unset the override of GUCRC mode to enable rc6. + */ +- if (intel_uc_uses_guc_rc(>->uc) && +- (IS_DG2_GRAPHICS_STEP(gt->i915, G10, STEP_A0, STEP_C0) || +- IS_DG2_GRAPHICS_STEP(gt->i915, G11, STEP_A0, STEP_B0))) ++ if (stream->override_gucrc) + drm_WARN_ON(>->i915->drm, + intel_guc_slpc_unset_gucrc_mode(>->uc.guc.slpc)); + +@@ -3293,8 +3291,10 @@ static int i915_oa_stream_init(struct i915_perf_stream *stream, + if (ret) { + drm_dbg(&stream->perf->i915->drm, + "Unable to override gucrc mode\n"); +- goto err_config; ++ goto err_gucrc; + } ++ ++ stream->override_gucrc = true; + } + + ret = alloc_oa_buffer(stream); +@@ -3333,11 +3333,15 @@ static int i915_oa_stream_init(struct i915_perf_stream *stream, + free_oa_buffer(stream); + + err_oa_buf_alloc: +- free_oa_configs(stream); ++ if (stream->override_gucrc) ++ intel_guc_slpc_unset_gucrc_mode(>->uc.guc.slpc); + ++err_gucrc: + intel_uncore_forcewake_put(stream->uncore, FORCEWAKE_ALL); + intel_engine_pm_put(stream->engine); + ++ free_oa_configs(stream); ++ + err_config: + free_noa_wait(stream); + +diff --git a/drivers/gpu/drm/i915/i915_perf_types.h b/drivers/gpu/drm/i915/i915_perf_types.h +index ca150b7a..4d5d8c36 100644 +--- a/drivers/gpu/drm/i915/i915_perf_types.h ++++ b/drivers/gpu/drm/i915/i915_perf_types.h +@@ -316,6 +316,12 @@ struct i915_perf_stream { + * buffer should be checked for available data. + */ + u64 poll_oa_period; ++ ++ /** ++ * @override_gucrc: GuC RC has been overridden for the perf stream, ++ * and we need to restore the default configuration on release. ++ */ ++ bool override_gucrc; + }; + + /** +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-094-platform-x86-intel-pmc-Alder-Lake-PCH-slp_s0_r.patch b/patches.kernel.org/6.2.10-094-platform-x86-intel-pmc-Alder-Lake-PCH-slp_s0_r.patch new file mode 100644 index 0000000..18ba3ec --- /dev/null +++ b/patches.kernel.org/6.2.10-094-platform-x86-intel-pmc-Alder-Lake-PCH-slp_s0_r.patch @@ -0,0 +1,60 @@ +From: Rajvi Jingar +Date: Mon, 20 Mar 2023 14:20:29 -0700 +Subject: [PATCH] platform/x86/intel/pmc: Alder Lake PCH slp_s0_residency fix +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: fb5755100a0a5aa5957bdb204fd1e249684557fc + +[ Upstream commit fb5755100a0a5aa5957bdb204fd1e249684557fc ] + +For platforms with Alder Lake PCH (Alder Lake S and Raptor Lake S) the +slp_s0_residency attribute has been reporting the wrong value. Unlike other +platforms, ADL PCH does not have a counter for the time that the SLP_S0 +signal was asserted. Instead, firmware uses the aggregate of the Low Power +Mode (LPM) substate counters as the S0ix value. Since the LPM counters run +at a different frequency, this lead to misreporting of the S0ix time. + +Add a check for Alder Lake PCH and adjust the frequency accordingly when +display slp_s0_residency. + +Fixes: bbab31101f44 ("platform/x86/intel: pmc/core: Add Alderlake support to pmc core driver") +Signed-off-by: Rajvi Jingar +Signed-off-by: David E. Box +Reviewed-by: Rajneesh Bhardwaj +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230320212029.3154407-1-david.e.box@linux.intel.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/platform/x86/intel/pmc/core.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/intel/pmc/core.c b/drivers/platform/x86/intel/pmc/core.c +index 3a15d32d..b9591969 100644 +--- a/drivers/platform/x86/intel/pmc/core.c ++++ b/drivers/platform/x86/intel/pmc/core.c +@@ -66,7 +66,18 @@ static inline void pmc_core_reg_write(struct pmc_dev *pmcdev, int reg_offset, + + static inline u64 pmc_core_adjust_slp_s0_step(struct pmc_dev *pmcdev, u32 value) + { +- return (u64)value * pmcdev->map->slp_s0_res_counter_step; ++ /* ++ * ADL PCH does not have the SLP_S0 counter and LPM Residency counters are ++ * used as a workaround which uses 30.5 usec tick. All other client ++ * programs have the legacy SLP_S0 residency counter that is using the 122 ++ * usec tick. ++ */ ++ const int lpm_adj_x2 = pmcdev->map->lpm_res_counter_step_x2; ++ ++ if (pmcdev->map == &adl_reg_map) ++ return (u64)value * GET_X2_COUNTER((u64)lpm_adj_x2); ++ else ++ return (u64)value * pmcdev->map->slp_s0_res_counter_step; + } + + static int set_etr3(struct pmc_dev *pmcdev) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-095-can-bcm-bcm_tx_setup-fix-KMSAN-uninit-value-in.patch b/patches.kernel.org/6.2.10-095-can-bcm-bcm_tx_setup-fix-KMSAN-uninit-value-in.patch new file mode 100644 index 0000000..15caba2 --- /dev/null +++ b/patches.kernel.org/6.2.10-095-can-bcm-bcm_tx_setup-fix-KMSAN-uninit-value-in.patch @@ -0,0 +1,119 @@ +From: Ivan Orlov +Date: Tue, 14 Mar 2023 16:04:45 +0400 +Subject: [PATCH] can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 2b4c99f7d9a57ecd644eda9b1fb0a1072414959f + +[ Upstream commit 2b4c99f7d9a57ecd644eda9b1fb0a1072414959f ] + +Syzkaller reported the following issue: + +===================================================== +BUG: KMSAN: uninit-value in aio_rw_done fs/aio.c:1520 [inline] +BUG: KMSAN: uninit-value in aio_write+0x899/0x950 fs/aio.c:1600 + aio_rw_done fs/aio.c:1520 [inline] + aio_write+0x899/0x950 fs/aio.c:1600 + io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 + __do_sys_io_submit fs/aio.c:2078 [inline] + __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 + __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Uninit was created at: + slab_post_alloc_hook mm/slab.h:766 [inline] + slab_alloc_node mm/slub.c:3452 [inline] + __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491 + __do_kmalloc_node mm/slab_common.c:967 [inline] + __kmalloc+0x11d/0x3b0 mm/slab_common.c:981 + kmalloc_array include/linux/slab.h:636 [inline] + bcm_tx_setup+0x80e/0x29d0 net/can/bcm.c:930 + bcm_sendmsg+0x3a2/0xce0 net/can/bcm.c:1351 + sock_sendmsg_nosec net/socket.c:714 [inline] + sock_sendmsg net/socket.c:734 [inline] + sock_write_iter+0x495/0x5e0 net/socket.c:1108 + call_write_iter include/linux/fs.h:2189 [inline] + aio_write+0x63a/0x950 fs/aio.c:1600 + io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 + __do_sys_io_submit fs/aio.c:2078 [inline] + __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 + __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +CPU: 1 PID: 5034 Comm: syz-executor350 Not tainted 6.2.0-rc6-syzkaller-80422-geda666ff2276 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 +===================================================== + +We can follow the call chain and find that 'bcm_tx_setup' function +calls 'memcpy_from_msg' to copy some content to the newly allocated +frame of 'op->frames'. After that the 'len' field of copied structure +being compared with some constant value (64 or 8). However, if +'memcpy_from_msg' returns an error, we will compare some uninitialized +memory. This triggers 'uninit-value' issue. + +This patch will add 'memcpy_from_msg' possible errors processing to +avoid uninit-value issue. + +Tested via syzkaller + +Reported-by: syzbot+c9bfd85eca611ebf5db1@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?id=47f897f8ad958bbde5790ebf389b5e7e0a345089 +Signed-off-by: Ivan Orlov +Fixes: 6f3b911d5f29b ("can: bcm: add support for CAN FD frames") +Acked-by: Oliver Hartkopp +Link: https://lore.kernel.org/all/20230314120445.12407-1-ivan.orlov0322@gmail.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/can/bcm.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/net/can/bcm.c b/net/can/bcm.c +index 27706f6a..a962ec2b 100644 +--- a/net/can/bcm.c ++++ b/net/can/bcm.c +@@ -941,6 +941,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, + + cf = op->frames + op->cfsiz * i; + err = memcpy_from_msg((u8 *)cf, msg, op->cfsiz); ++ if (err < 0) ++ goto free_op; + + if (op->flags & CAN_FD_FRAME) { + if (cf->len > 64) +@@ -950,12 +952,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, + err = -EINVAL; + } + +- if (err < 0) { +- if (op->frames != &op->sframe) +- kfree(op->frames); +- kfree(op); +- return err; +- } ++ if (err < 0) ++ goto free_op; + + if (msg_head->flags & TX_CP_CAN_ID) { + /* copy can_id into frame */ +@@ -1026,6 +1024,12 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, + bcm_tx_start_timer(op); + + return msg_head->nframes * op->cfsiz + MHSIZ; ++ ++free_op: ++ if (op->frames != &op->sframe) ++ kfree(op->frames); ++ kfree(op); ++ return err; + } + + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-096-s390-vfio-ap-fix-memory-leak-in-vfio_ap-device.patch b/patches.kernel.org/6.2.10-096-s390-vfio-ap-fix-memory-leak-in-vfio_ap-device.patch new file mode 100644 index 0000000..164134d --- /dev/null +++ b/patches.kernel.org/6.2.10-096-s390-vfio-ap-fix-memory-leak-in-vfio_ap-device.patch @@ -0,0 +1,49 @@ +From: Tony Krowiak +Date: Mon, 20 Mar 2023 11:04:47 -0400 +Subject: [PATCH] s390/vfio-ap: fix memory leak in vfio_ap device driver +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 8f8cf767589f2131ae5d40f3758429095c701c84 + +[ Upstream commit 8f8cf767589f2131ae5d40f3758429095c701c84 ] + +The device release callback function invoked to release the matrix device +uses the dev_get_drvdata(device *dev) function to retrieve the +pointer to the vfio_matrix_dev object in order to free its storage. The +problem is, this object is not stored as drvdata with the device; since the +kfree function will accept a NULL pointer, the memory for the +vfio_matrix_dev object is never freed. + +Since the device being released is contained within the vfio_matrix_dev +object, the container_of macro will be used to retrieve its pointer. + +Fixes: 1fde573413b5 ("s390: vfio-ap: base implementation of VFIO AP device driver") +Signed-off-by: Tony Krowiak +Reviewed-by: Harald Freudenberger +Link: https://lore.kernel.org/r/20230320150447.34557-1-akrowiak@linux.ibm.com +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/s390/crypto/vfio_ap_drv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/s390/crypto/vfio_ap_drv.c b/drivers/s390/crypto/vfio_ap_drv.c +index 997b524b..a48c6938 100644 +--- a/drivers/s390/crypto/vfio_ap_drv.c ++++ b/drivers/s390/crypto/vfio_ap_drv.c +@@ -54,8 +54,9 @@ static struct ap_driver vfio_ap_drv = { + + static void vfio_ap_matrix_dev_release(struct device *dev) + { +- struct ap_matrix_dev *matrix_dev = dev_get_drvdata(dev); ++ struct ap_matrix_dev *matrix_dev; + ++ matrix_dev = container_of(dev, struct ap_matrix_dev, device); + kfree(matrix_dev); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-097-ACPI-bus-Rework-system-level-device-notificati.patch b/patches.kernel.org/6.2.10-097-ACPI-bus-Rework-system-level-device-notificati.patch new file mode 100644 index 0000000..c983925 --- /dev/null +++ b/patches.kernel.org/6.2.10-097-ACPI-bus-Rework-system-level-device-notificati.patch @@ -0,0 +1,238 @@ +From: "Rafael J. Wysocki" +Date: Fri, 24 Mar 2023 14:33:42 +0100 +Subject: [PATCH] ACPI: bus: Rework system-level device notification handling +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: c56610a869bce03490faf4f157076370c71b8ae3 + +[ Upstream commit c56610a869bce03490faf4f157076370c71b8ae3 ] + +For ACPI drivers that provide a ->notify() callback and set +ACPI_DRIVER_ALL_NOTIFY_EVENTS in their flags, that callback can be +invoked while either the ->add() or the ->remove() callback is running +without any synchronization at the bus type level which is counter to +the common-sense expectation that notification handling should only be +enabled when the driver is actually bound to the device. As a result, +if the driver is not careful enough, it's ->notify() callback may crash +when it is invoked too early or too late [1]. + +This issue has been amplified by commit d6fb6ee1820c ("ACPI: bus: Drop +driver member of struct acpi_device") that made acpi_bus_notify() check +for the presence of the driver and its ->notify() callback directly +instead of using an extra driver pointer that was only set and cleared +by the bus type code, but it was present before that commit although +it was harder to reproduce then. + +It can be addressed by using the observation that +acpi_device_install_notify_handler() can be modified to install the +handler for all types of events when ACPI_DRIVER_ALL_NOTIFY_EVENTS is +set in the driver flags, in which case acpi_bus_notify() will not need +to invoke the driver's ->notify() callback any more and that callback +will only be invoked after acpi_device_install_notify_handler() has run +and before acpi_device_remove_notify_handler() runs, which implies the +correct ordering with respect to the other ACPI driver callbacks. + +Modify the code accordingly and while at it, drop two redundant local +variables from acpi_bus_notify() and turn its description comment into +a proper kerneldoc one. + +Fixes: d6fb6ee1820c ("ACPI: bus: Drop driver member of struct acpi_device") +Link: https://lore.kernel.org/linux-acpi/9f6cba7a8a57e5a687c934e8e406e28c.squirrel@mail.panix.com # [1] +Reported-by: Pierre Asselin +Signed-off-by: Rafael J. Wysocki +Tested-by: Pierre Asselin +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/acpi/bus.c | 83 +++++++++++++++++++++------------------------- + 1 file changed, 37 insertions(+), 46 deletions(-) + +diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c +index 0c05ccde..7c16bc15 100644 +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -459,85 +459,67 @@ static void acpi_bus_osc_negotiate_usb_control(void) + Notification Handling + -------------------------------------------------------------------------- */ + +-/* +- * acpi_bus_notify +- * --------------- +- * Callback for all 'system-level' device notifications (values 0x00-0x7F). ++/** ++ * acpi_bus_notify - Global system-level (0x00-0x7F) notifications handler ++ * @handle: Target ACPI object. ++ * @type: Notification type. ++ * @data: Ignored. ++ * ++ * This only handles notifications related to device hotplug. + */ + static void acpi_bus_notify(acpi_handle handle, u32 type, void *data) + { + struct acpi_device *adev; +- u32 ost_code = ACPI_OST_SC_NON_SPECIFIC_FAILURE; +- bool hotplug_event = false; + + switch (type) { + case ACPI_NOTIFY_BUS_CHECK: + acpi_handle_debug(handle, "ACPI_NOTIFY_BUS_CHECK event\n"); +- hotplug_event = true; + break; + + case ACPI_NOTIFY_DEVICE_CHECK: + acpi_handle_debug(handle, "ACPI_NOTIFY_DEVICE_CHECK event\n"); +- hotplug_event = true; + break; + + case ACPI_NOTIFY_DEVICE_WAKE: + acpi_handle_debug(handle, "ACPI_NOTIFY_DEVICE_WAKE event\n"); +- break; ++ return; + + case ACPI_NOTIFY_EJECT_REQUEST: + acpi_handle_debug(handle, "ACPI_NOTIFY_EJECT_REQUEST event\n"); +- hotplug_event = true; + break; + + case ACPI_NOTIFY_DEVICE_CHECK_LIGHT: + acpi_handle_debug(handle, "ACPI_NOTIFY_DEVICE_CHECK_LIGHT event\n"); + /* TBD: Exactly what does 'light' mean? */ +- break; ++ return; + + case ACPI_NOTIFY_FREQUENCY_MISMATCH: + acpi_handle_err(handle, "Device cannot be configured due " + "to a frequency mismatch\n"); +- break; ++ return; + + case ACPI_NOTIFY_BUS_MODE_MISMATCH: + acpi_handle_err(handle, "Device cannot be configured due " + "to a bus mode mismatch\n"); +- break; ++ return; + + case ACPI_NOTIFY_POWER_FAULT: + acpi_handle_err(handle, "Device has suffered a power fault\n"); +- break; ++ return; + + default: + acpi_handle_debug(handle, "Unknown event type 0x%x\n", type); +- break; ++ return; + } + + adev = acpi_get_acpi_dev(handle); +- if (!adev) +- goto err; +- +- if (adev->dev.driver) { +- struct acpi_driver *driver = to_acpi_driver(adev->dev.driver); +- +- if (driver && driver->ops.notify && +- (driver->flags & ACPI_DRIVER_ALL_NOTIFY_EVENTS)) +- driver->ops.notify(adev, type); +- } +- +- if (!hotplug_event) { +- acpi_put_acpi_dev(adev); +- return; +- } + +- if (ACPI_SUCCESS(acpi_hotplug_schedule(adev, type))) ++ if (adev && ACPI_SUCCESS(acpi_hotplug_schedule(adev, type))) + return; + + acpi_put_acpi_dev(adev); + +- err: +- acpi_evaluate_ost(handle, type, ost_code, NULL); ++ acpi_evaluate_ost(handle, type, ACPI_OST_SC_NON_SPECIFIC_FAILURE, NULL); + } + + static void acpi_notify_device(acpi_handle handle, u32 event, void *data) +@@ -562,42 +544,51 @@ static u32 acpi_device_fixed_event(void *data) + return ACPI_INTERRUPT_HANDLED; + } + +-static int acpi_device_install_notify_handler(struct acpi_device *device) ++static int acpi_device_install_notify_handler(struct acpi_device *device, ++ struct acpi_driver *acpi_drv) + { + acpi_status status; + +- if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON) ++ if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON) { + status = + acpi_install_fixed_event_handler(ACPI_EVENT_POWER_BUTTON, + acpi_device_fixed_event, + device); +- else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON) ++ } else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON) { + status = + acpi_install_fixed_event_handler(ACPI_EVENT_SLEEP_BUTTON, + acpi_device_fixed_event, + device); +- else +- status = acpi_install_notify_handler(device->handle, +- ACPI_DEVICE_NOTIFY, ++ } else { ++ u32 type = acpi_drv->flags & ACPI_DRIVER_ALL_NOTIFY_EVENTS ? ++ ACPI_ALL_NOTIFY : ACPI_DEVICE_NOTIFY; ++ ++ status = acpi_install_notify_handler(device->handle, type, + acpi_notify_device, + device); ++ } + + if (ACPI_FAILURE(status)) + return -EINVAL; + return 0; + } + +-static void acpi_device_remove_notify_handler(struct acpi_device *device) ++static void acpi_device_remove_notify_handler(struct acpi_device *device, ++ struct acpi_driver *acpi_drv) + { +- if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON) ++ if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON) { + acpi_remove_fixed_event_handler(ACPI_EVENT_POWER_BUTTON, + acpi_device_fixed_event); +- else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON) ++ } else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON) { + acpi_remove_fixed_event_handler(ACPI_EVENT_SLEEP_BUTTON, + acpi_device_fixed_event); +- else +- acpi_remove_notify_handler(device->handle, ACPI_DEVICE_NOTIFY, ++ } else { ++ u32 type = acpi_drv->flags & ACPI_DRIVER_ALL_NOTIFY_EVENTS ? ++ ACPI_ALL_NOTIFY : ACPI_DEVICE_NOTIFY; ++ ++ acpi_remove_notify_handler(device->handle, type, + acpi_notify_device); ++ } + } + + /* Handle events targeting \_SB device (at present only graceful shutdown) */ +@@ -1039,7 +1030,7 @@ static int acpi_device_probe(struct device *dev) + acpi_drv->name, acpi_dev->pnp.bus_id); + + if (acpi_drv->ops.notify) { +- ret = acpi_device_install_notify_handler(acpi_dev); ++ ret = acpi_device_install_notify_handler(acpi_dev, acpi_drv); + if (ret) { + if (acpi_drv->ops.remove) + acpi_drv->ops.remove(acpi_dev); +@@ -1062,7 +1053,7 @@ static void acpi_device_remove(struct device *dev) + struct acpi_driver *acpi_drv = to_acpi_driver(dev->driver); + + if (acpi_drv->ops.notify) +- acpi_device_remove_notify_handler(acpi_dev); ++ acpi_device_remove_notify_handler(acpi_dev, acpi_drv); + + if (acpi_drv->ops.remove) + acpi_drv->ops.remove(acpi_dev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-098-loop-LOOP_CONFIGURE-send-uevents-for-partition.patch b/patches.kernel.org/6.2.10-098-loop-LOOP_CONFIGURE-send-uevents-for-partition.patch new file mode 100644 index 0000000..f6af038 --- /dev/null +++ b/patches.kernel.org/6.2.10-098-loop-LOOP_CONFIGURE-send-uevents-for-partition.patch @@ -0,0 +1,101 @@ +From: Alyssa Ross +Date: Mon, 20 Mar 2023 13:54:30 +0100 +Subject: [PATCH] loop: LOOP_CONFIGURE: send uevents for partitions +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: bb430b69422640891b0b8db762885730579a4145 + +[ Upstream commit bb430b69422640891b0b8db762885730579a4145 ] + +LOOP_CONFIGURE is, as far as I understand it, supposed to be a way to +combine LOOP_SET_FD and LOOP_SET_STATUS64 into a single syscall. When +using LOOP_SET_FD+LOOP_SET_STATUS64, a single uevent would be sent for +each partition found on the loop device after the second ioctl(), but +when using LOOP_CONFIGURE, no such uevent was being sent. + +In the old setup, uevents are disabled for LOOP_SET_FD, but not for +LOOP_SET_STATUS64. This makes sense, as it prevents uevents being +sent for a partially configured device during LOOP_SET_FD - they're +only sent at the end of LOOP_SET_STATUS64. But for LOOP_CONFIGURE, +uevents were disabled for the entire operation, so that final +notification was never issued. To fix this, reduce the critical +section to exclude the loop_reread_partitions() call, which causes +the uevents to be issued, to after uevents are re-enabled, matching +the behaviour of the LOOP_SET_FD+LOOP_SET_STATUS64 combination. + +I noticed this because Busybox's losetup program recently changed from +using LOOP_SET_FD+LOOP_SET_STATUS64 to LOOP_CONFIGURE, and this broke +my setup, for which I want a notification from the kernel any time a +new partition becomes available. + +Signed-off-by: Alyssa Ross +[hch: reduced the critical section] +Signed-off-by: Christoph Hellwig +Fixes: 3448914e8cc5 ("loop: Add LOOP_CONFIGURE ioctl") +Link: https://lore.kernel.org/r/20230320125430.55367-1-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/block/loop.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index eabbc3bd..4916fe78 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -1010,9 +1010,6 @@ static int loop_configure(struct loop_device *lo, fmode_t mode, + /* This is safe, since we have a reference from open(). */ + __module_get(THIS_MODULE); + +- /* suppress uevents while reconfiguring the device */ +- dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 1); +- + /* + * If we don't hold exclusive handle for the device, upgrade to it + * here to avoid changing device under exclusive owner. +@@ -1067,6 +1064,9 @@ static int loop_configure(struct loop_device *lo, fmode_t mode, + } + } + ++ /* suppress uevents while reconfiguring the device */ ++ dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 1); ++ + disk_force_media_change(lo->lo_disk, DISK_EVENT_MEDIA_CHANGE); + set_disk_ro(lo->lo_disk, (lo->lo_flags & LO_FLAGS_READ_ONLY) != 0); + +@@ -1109,17 +1109,17 @@ static int loop_configure(struct loop_device *lo, fmode_t mode, + if (partscan) + clear_bit(GD_SUPPRESS_PART_SCAN, &lo->lo_disk->state); + ++ /* enable and uncork uevent now that we are done */ ++ dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 0); ++ + loop_global_unlock(lo, is_loop); + if (partscan) + loop_reread_partitions(lo); ++ + if (!(mode & FMODE_EXCL)) + bd_abort_claiming(bdev, loop_configure); + +- error = 0; +-done: +- /* enable and uncork uevent now that we are done */ +- dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 0); +- return error; ++ return 0; + + out_unlock: + loop_global_unlock(lo, is_loop); +@@ -1130,7 +1130,7 @@ static int loop_configure(struct loop_device *lo, fmode_t mode, + fput(file); + /* This is safe: open() is still holding a reference. */ + module_put(THIS_MODULE); +- goto done; ++ return error; + } + + static void __loop_clr_fd(struct loop_device *lo, bool release) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-099-net-mvpp2-classifier-flow-fix-fragmentation-fl.patch b/patches.kernel.org/6.2.10-099-net-mvpp2-classifier-flow-fix-fragmentation-fl.patch new file mode 100644 index 0000000..77932a0 --- /dev/null +++ b/patches.kernel.org/6.2.10-099-net-mvpp2-classifier-flow-fix-fragmentation-fl.patch @@ -0,0 +1,118 @@ +From: Sven Auhagen +Date: Sat, 25 Mar 2023 17:40:29 +0100 +Subject: [PATCH] net: mvpp2: classifier flow fix fragmentation flags +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 9a251cae51d57289908222e6c322ca61fccc25fd + +[ Upstream commit 9a251cae51d57289908222e6c322ca61fccc25fd ] + +Add missing IP Fragmentation Flag. + +Fixes: f9358e12a0af ("net: mvpp2: split ingress traffic into multiple flows") +Signed-off-by: Sven Auhagen +Reviewed-by: Marcin Wojtas +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../net/ethernet/marvell/mvpp2/mvpp2_cls.c | 30 +++++++++++-------- + 1 file changed, 18 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c +index 41d935d1..40aeaa7b 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c +@@ -62,35 +62,38 @@ static const struct mvpp2_cls_flow cls_flows[MVPP2_N_PRS_FLOWS] = { + MVPP2_DEF_FLOW(MVPP22_FLOW_TCP4, MVPP2_FL_IP4_TCP_FRAG_UNTAG, + MVPP22_CLS_HEK_IP4_2T, + MVPP2_PRS_RI_VLAN_NONE | MVPP2_PRS_RI_L3_IP4 | +- MVPP2_PRS_RI_L4_TCP, ++ MVPP2_PRS_RI_IP_FRAG_TRUE | MVPP2_PRS_RI_L4_TCP, + MVPP2_PRS_IP_MASK | MVPP2_PRS_RI_VLAN_MASK), + + MVPP2_DEF_FLOW(MVPP22_FLOW_TCP4, MVPP2_FL_IP4_TCP_FRAG_UNTAG, + MVPP22_CLS_HEK_IP4_2T, + MVPP2_PRS_RI_VLAN_NONE | MVPP2_PRS_RI_L3_IP4_OPT | +- MVPP2_PRS_RI_L4_TCP, ++ MVPP2_PRS_RI_IP_FRAG_TRUE | MVPP2_PRS_RI_L4_TCP, + MVPP2_PRS_IP_MASK | MVPP2_PRS_RI_VLAN_MASK), + + MVPP2_DEF_FLOW(MVPP22_FLOW_TCP4, MVPP2_FL_IP4_TCP_FRAG_UNTAG, + MVPP22_CLS_HEK_IP4_2T, + MVPP2_PRS_RI_VLAN_NONE | MVPP2_PRS_RI_L3_IP4_OTHER | +- MVPP2_PRS_RI_L4_TCP, ++ MVPP2_PRS_RI_IP_FRAG_TRUE | MVPP2_PRS_RI_L4_TCP, + MVPP2_PRS_IP_MASK | MVPP2_PRS_RI_VLAN_MASK), + + /* TCP over IPv4 flows, fragmented, with vlan tag */ + MVPP2_DEF_FLOW(MVPP22_FLOW_TCP4, MVPP2_FL_IP4_TCP_FRAG_TAG, + MVPP22_CLS_HEK_IP4_2T | MVPP22_CLS_HEK_TAGGED, +- MVPP2_PRS_RI_L3_IP4 | MVPP2_PRS_RI_L4_TCP, ++ MVPP2_PRS_RI_L3_IP4 | MVPP2_PRS_RI_IP_FRAG_TRUE | ++ MVPP2_PRS_RI_L4_TCP, + MVPP2_PRS_IP_MASK), + + MVPP2_DEF_FLOW(MVPP22_FLOW_TCP4, MVPP2_FL_IP4_TCP_FRAG_TAG, + MVPP22_CLS_HEK_IP4_2T | MVPP22_CLS_HEK_TAGGED, +- MVPP2_PRS_RI_L3_IP4_OPT | MVPP2_PRS_RI_L4_TCP, ++ MVPP2_PRS_RI_L3_IP4_OPT | MVPP2_PRS_RI_IP_FRAG_TRUE | ++ MVPP2_PRS_RI_L4_TCP, + MVPP2_PRS_IP_MASK), + + MVPP2_DEF_FLOW(MVPP22_FLOW_TCP4, MVPP2_FL_IP4_TCP_FRAG_TAG, + MVPP22_CLS_HEK_IP4_2T | MVPP22_CLS_HEK_TAGGED, +- MVPP2_PRS_RI_L3_IP4_OTHER | MVPP2_PRS_RI_L4_TCP, ++ MVPP2_PRS_RI_L3_IP4_OTHER | MVPP2_PRS_RI_IP_FRAG_TRUE | ++ MVPP2_PRS_RI_L4_TCP, + MVPP2_PRS_IP_MASK), + + /* UDP over IPv4 flows, Not fragmented, no vlan tag */ +@@ -132,35 +135,38 @@ static const struct mvpp2_cls_flow cls_flows[MVPP2_N_PRS_FLOWS] = { + MVPP2_DEF_FLOW(MVPP22_FLOW_UDP4, MVPP2_FL_IP4_UDP_FRAG_UNTAG, + MVPP22_CLS_HEK_IP4_2T, + MVPP2_PRS_RI_VLAN_NONE | MVPP2_PRS_RI_L3_IP4 | +- MVPP2_PRS_RI_L4_UDP, ++ MVPP2_PRS_RI_IP_FRAG_TRUE | MVPP2_PRS_RI_L4_UDP, + MVPP2_PRS_IP_MASK | MVPP2_PRS_RI_VLAN_MASK), + + MVPP2_DEF_FLOW(MVPP22_FLOW_UDP4, MVPP2_FL_IP4_UDP_FRAG_UNTAG, + MVPP22_CLS_HEK_IP4_2T, + MVPP2_PRS_RI_VLAN_NONE | MVPP2_PRS_RI_L3_IP4_OPT | +- MVPP2_PRS_RI_L4_UDP, ++ MVPP2_PRS_RI_IP_FRAG_TRUE | MVPP2_PRS_RI_L4_UDP, + MVPP2_PRS_IP_MASK | MVPP2_PRS_RI_VLAN_MASK), + + MVPP2_DEF_FLOW(MVPP22_FLOW_UDP4, MVPP2_FL_IP4_UDP_FRAG_UNTAG, + MVPP22_CLS_HEK_IP4_2T, + MVPP2_PRS_RI_VLAN_NONE | MVPP2_PRS_RI_L3_IP4_OTHER | +- MVPP2_PRS_RI_L4_UDP, ++ MVPP2_PRS_RI_IP_FRAG_TRUE | MVPP2_PRS_RI_L4_UDP, + MVPP2_PRS_IP_MASK | MVPP2_PRS_RI_VLAN_MASK), + + /* UDP over IPv4 flows, fragmented, with vlan tag */ + MVPP2_DEF_FLOW(MVPP22_FLOW_UDP4, MVPP2_FL_IP4_UDP_FRAG_TAG, + MVPP22_CLS_HEK_IP4_2T | MVPP22_CLS_HEK_TAGGED, +- MVPP2_PRS_RI_L3_IP4 | MVPP2_PRS_RI_L4_UDP, ++ MVPP2_PRS_RI_L3_IP4 | MVPP2_PRS_RI_IP_FRAG_TRUE | ++ MVPP2_PRS_RI_L4_UDP, + MVPP2_PRS_IP_MASK), + + MVPP2_DEF_FLOW(MVPP22_FLOW_UDP4, MVPP2_FL_IP4_UDP_FRAG_TAG, + MVPP22_CLS_HEK_IP4_2T | MVPP22_CLS_HEK_TAGGED, +- MVPP2_PRS_RI_L3_IP4_OPT | MVPP2_PRS_RI_L4_UDP, ++ MVPP2_PRS_RI_L3_IP4_OPT | MVPP2_PRS_RI_IP_FRAG_TRUE | ++ MVPP2_PRS_RI_L4_UDP, + MVPP2_PRS_IP_MASK), + + MVPP2_DEF_FLOW(MVPP22_FLOW_UDP4, MVPP2_FL_IP4_UDP_FRAG_TAG, + MVPP22_CLS_HEK_IP4_2T | MVPP22_CLS_HEK_TAGGED, +- MVPP2_PRS_RI_L3_IP4_OTHER | MVPP2_PRS_RI_L4_UDP, ++ MVPP2_PRS_RI_L3_IP4_OTHER | MVPP2_PRS_RI_IP_FRAG_TRUE | ++ MVPP2_PRS_RI_L4_UDP, + MVPP2_PRS_IP_MASK), + + /* TCP over IPv6 flows, not fragmented, no vlan tag */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-100-net-mvpp2-parser-fix-QinQ.patch b/patches.kernel.org/6.2.10-100-net-mvpp2-parser-fix-QinQ.patch new file mode 100644 index 0000000..f4a2b2f --- /dev/null +++ b/patches.kernel.org/6.2.10-100-net-mvpp2-parser-fix-QinQ.patch @@ -0,0 +1,41 @@ +From: Sven Auhagen +Date: Sat, 25 Mar 2023 17:40:53 +0100 +Subject: [PATCH] net: mvpp2: parser fix QinQ +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: a587a84813b90372cb0a7565e201a4075da67919 + +[ Upstream commit a587a84813b90372cb0a7565e201a4075da67919 ] + +The mvpp2 parser entry for QinQ has the inner and outer VLAN +in the wrong order. +Fix the problem by swapping them. + +Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit") +Signed-off-by: Sven Auhagen +Reviewed-by: Marcin Wojtas +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c +index 75ba57bd..ed8be396 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c +@@ -1539,8 +1539,8 @@ static int mvpp2_prs_vlan_init(struct platform_device *pdev, struct mvpp2 *priv) + if (!priv->prs_double_vlans) + return -ENOMEM; + +- /* Double VLAN: 0x8100, 0x88A8 */ +- err = mvpp2_prs_double_vlan_add(priv, ETH_P_8021Q, ETH_P_8021AD, ++ /* Double VLAN: 0x88A8, 0x8100 */ ++ err = mvpp2_prs_double_vlan_add(priv, ETH_P_8021AD, ETH_P_8021Q, + MVPP2_PRS_PORT_MASK); + if (err) + return err; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-101-net-mvpp2-parser-fix-PPPoE.patch b/patches.kernel.org/6.2.10-101-net-mvpp2-parser-fix-PPPoE.patch new file mode 100644 index 0000000..5201081 --- /dev/null +++ b/patches.kernel.org/6.2.10-101-net-mvpp2-parser-fix-PPPoE.patch @@ -0,0 +1,124 @@ +From: Sven Auhagen +Date: Sat, 25 Mar 2023 17:41:05 +0100 +Subject: [PATCH] net: mvpp2: parser fix PPPoE +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 031a416c2170866be5132ae42e14453d669b0cb1 + +[ Upstream commit 031a416c2170866be5132ae42e14453d669b0cb1 ] + +In PPPoE add all IPv4 header option length to the parser +and adjust the L3 and L4 offset accordingly. +Currently the L4 match does not work with PPPoE and +all packets are matched as L3 IP4 OPT. + +Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit") +Signed-off-by: Sven Auhagen +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../net/ethernet/marvell/mvpp2/mvpp2_prs.c | 82 ++++++++----------- + 1 file changed, 34 insertions(+), 48 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c +index ed8be396..9af22f49 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c +@@ -1607,59 +1607,45 @@ static int mvpp2_prs_vlan_init(struct platform_device *pdev, struct mvpp2 *priv) + static int mvpp2_prs_pppoe_init(struct mvpp2 *priv) + { + struct mvpp2_prs_entry pe; +- int tid; +- +- /* IPv4 over PPPoE with options */ +- tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID, +- MVPP2_PE_LAST_FREE_TID); +- if (tid < 0) +- return tid; +- +- memset(&pe, 0, sizeof(pe)); +- mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_PPPOE); +- pe.index = tid; +- +- mvpp2_prs_match_etype(&pe, 0, PPP_IP); +- +- mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_IP4); +- mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_L3_IP4_OPT, +- MVPP2_PRS_RI_L3_PROTO_MASK); +- /* goto ipv4 dest-address (skip eth_type + IP-header-size - 4) */ +- mvpp2_prs_sram_shift_set(&pe, MVPP2_ETH_TYPE_LEN + +- sizeof(struct iphdr) - 4, +- MVPP2_PRS_SRAM_OP_SEL_SHIFT_ADD); +- /* Set L3 offset */ +- mvpp2_prs_sram_offset_set(&pe, MVPP2_PRS_SRAM_UDF_TYPE_L3, +- MVPP2_ETH_TYPE_LEN, +- MVPP2_PRS_SRAM_OP_SEL_UDF_ADD); +- +- /* Update shadow table and hw entry */ +- mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_PPPOE); +- mvpp2_prs_hw_write(priv, &pe); ++ int tid, ihl; + +- /* IPv4 over PPPoE without options */ +- tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID, +- MVPP2_PE_LAST_FREE_TID); +- if (tid < 0) +- return tid; ++ /* IPv4 over PPPoE with header length >= 5 */ ++ for (ihl = MVPP2_PRS_IPV4_IHL_MIN; ihl <= MVPP2_PRS_IPV4_IHL_MAX; ihl++) { ++ tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID, ++ MVPP2_PE_LAST_FREE_TID); ++ if (tid < 0) ++ return tid; + +- pe.index = tid; ++ memset(&pe, 0, sizeof(pe)); ++ mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_PPPOE); ++ pe.index = tid; + +- mvpp2_prs_tcam_data_byte_set(&pe, MVPP2_ETH_TYPE_LEN, +- MVPP2_PRS_IPV4_HEAD | +- MVPP2_PRS_IPV4_IHL_MIN, +- MVPP2_PRS_IPV4_HEAD_MASK | +- MVPP2_PRS_IPV4_IHL_MASK); ++ mvpp2_prs_match_etype(&pe, 0, PPP_IP); ++ mvpp2_prs_tcam_data_byte_set(&pe, MVPP2_ETH_TYPE_LEN, ++ MVPP2_PRS_IPV4_HEAD | ihl, ++ MVPP2_PRS_IPV4_HEAD_MASK | ++ MVPP2_PRS_IPV4_IHL_MASK); + +- /* Clear ri before updating */ +- pe.sram[MVPP2_PRS_SRAM_RI_WORD] = 0x0; +- pe.sram[MVPP2_PRS_SRAM_RI_CTRL_WORD] = 0x0; +- mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_L3_IP4, +- MVPP2_PRS_RI_L3_PROTO_MASK); ++ mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_IP4); ++ mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_L3_IP4, ++ MVPP2_PRS_RI_L3_PROTO_MASK); ++ /* goto ipv4 dst-address (skip eth_type + IP-header-size - 4) */ ++ mvpp2_prs_sram_shift_set(&pe, MVPP2_ETH_TYPE_LEN + ++ sizeof(struct iphdr) - 4, ++ MVPP2_PRS_SRAM_OP_SEL_SHIFT_ADD); ++ /* Set L3 offset */ ++ mvpp2_prs_sram_offset_set(&pe, MVPP2_PRS_SRAM_UDF_TYPE_L3, ++ MVPP2_ETH_TYPE_LEN, ++ MVPP2_PRS_SRAM_OP_SEL_UDF_ADD); ++ /* Set L4 offset */ ++ mvpp2_prs_sram_offset_set(&pe, MVPP2_PRS_SRAM_UDF_TYPE_L4, ++ MVPP2_ETH_TYPE_LEN + (ihl * 4), ++ MVPP2_PRS_SRAM_OP_SEL_UDF_ADD); + +- /* Update shadow table and hw entry */ +- mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_PPPOE); +- mvpp2_prs_hw_write(priv, &pe); ++ /* Update shadow table and hw entry */ ++ mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_PPPOE); ++ mvpp2_prs_hw_write(priv, &pe); ++ } + + /* IPv6 over PPPoE */ + tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-102-smsc911x-avoid-PHY-being-resumed-when-interfac.patch b/patches.kernel.org/6.2.10-102-smsc911x-avoid-PHY-being-resumed-when-interfac.patch new file mode 100644 index 0000000..8e57a27 --- /dev/null +++ b/patches.kernel.org/6.2.10-102-smsc911x-avoid-PHY-being-resumed-when-interfac.patch @@ -0,0 +1,61 @@ +From: Wolfram Sang +Date: Mon, 27 Mar 2023 10:31:38 +0200 +Subject: [PATCH] smsc911x: avoid PHY being resumed when interface is not up +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: f22c993f31fa9615df46e49cd768b713d39a852f + +[ Upstream commit f22c993f31fa9615df46e49cd768b713d39a852f ] + +SMSC911x doesn't need mdiobus suspend/resume, that's why it sets +'mac_managed_pm'. However, setting it needs to be moved from init to +probe, so mdiobus PM functions will really never be called (e.g. when +the interface is not up yet during suspend/resume). + +Fixes: 3ce9f2bef755 ("net: smsc911x: Stop and start PHY during suspend and resume") +Suggested-by: Heiner Kallweit +Signed-off-by: Wolfram Sang +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230327083138.6044-1-wsa+renesas@sang-engineering.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/smsc/smsc911x.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c +index a2e51191..a690d139 100644 +--- a/drivers/net/ethernet/smsc/smsc911x.c ++++ b/drivers/net/ethernet/smsc/smsc911x.c +@@ -1037,8 +1037,6 @@ static int smsc911x_mii_probe(struct net_device *dev) + return ret; + } + +- /* Indicate that the MAC is responsible for managing PHY PM */ +- phydev->mac_managed_pm = true; + phy_attached_info(phydev); + + phy_set_max_speed(phydev, SPEED_100); +@@ -1066,6 +1064,7 @@ static int smsc911x_mii_init(struct platform_device *pdev, + struct net_device *dev) + { + struct smsc911x_data *pdata = netdev_priv(dev); ++ struct phy_device *phydev; + int err = -ENXIO; + + pdata->mii_bus = mdiobus_alloc(); +@@ -1108,6 +1107,10 @@ static int smsc911x_mii_init(struct platform_device *pdev, + goto err_out_free_bus_2; + } + ++ phydev = phy_find_first(pdata->mii_bus); ++ if (phydev) ++ phydev->mac_managed_pm = true; ++ + return 0; + + err_out_free_bus_2: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-103-ice-Fix-ice_cfg_rdma_fltr-to-only-update-relev.patch b/patches.kernel.org/6.2.10-103-ice-Fix-ice_cfg_rdma_fltr-to-only-update-relev.patch new file mode 100644 index 0000000..6239975 --- /dev/null +++ b/patches.kernel.org/6.2.10-103-ice-Fix-ice_cfg_rdma_fltr-to-only-update-relev.patch @@ -0,0 +1,79 @@ +From: Brett Creeley +Date: Mon, 13 Mar 2023 13:36:08 -0700 +Subject: [PATCH] ice: Fix ice_cfg_rdma_fltr() to only update relevant fields +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: d94dbdc4e0209b5e7d736ab696f8d635b034e3ee + +[ Upstream commit d94dbdc4e0209b5e7d736ab696f8d635b034e3ee ] + +The current implementation causes ice_vsi_update() to update all VSI +fields based on the cached VSI context. This also assumes that the +ICE_AQ_VSI_PROP_Q_OPT_VALID bit is set. This can cause problems if the +VSI context is not correctly synced by the driver. Fix this by only +updating the fields that correspond to ICE_AQ_VSI_PROP_Q_OPT_VALID. +Also, make sure to save the updated result in the cached VSI context +on success. + +Fixes: 348048e724a0 ("ice: Implement iidc operations") +Co-developed-by: Robert Malz +Signed-off-by: Robert Malz +Signed-off-by: Brett Creeley +Signed-off-by: Jesse Brandeburg +Reviewed-by: Piotr Raczynski +Tested-by: Jakub Andrysiak +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/intel/ice/ice_switch.c | 26 +++++++++++++++++---- + 1 file changed, 22 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_switch.c b/drivers/net/ethernet/intel/ice/ice_switch.c +index 61f844d2..46b36851 100644 +--- a/drivers/net/ethernet/intel/ice/ice_switch.c ++++ b/drivers/net/ethernet/intel/ice/ice_switch.c +@@ -1780,18 +1780,36 @@ ice_update_vsi(struct ice_hw *hw, u16 vsi_handle, struct ice_vsi_ctx *vsi_ctx, + int + ice_cfg_rdma_fltr(struct ice_hw *hw, u16 vsi_handle, bool enable) + { +- struct ice_vsi_ctx *ctx; ++ struct ice_vsi_ctx *ctx, *cached_ctx; ++ int status; ++ ++ cached_ctx = ice_get_vsi_ctx(hw, vsi_handle); ++ if (!cached_ctx) ++ return -ENOENT; + +- ctx = ice_get_vsi_ctx(hw, vsi_handle); ++ ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); + if (!ctx) +- return -EIO; ++ return -ENOMEM; ++ ++ ctx->info.q_opt_rss = cached_ctx->info.q_opt_rss; ++ ctx->info.q_opt_tc = cached_ctx->info.q_opt_tc; ++ ctx->info.q_opt_flags = cached_ctx->info.q_opt_flags; ++ ++ ctx->info.valid_sections = cpu_to_le16(ICE_AQ_VSI_PROP_Q_OPT_VALID); + + if (enable) + ctx->info.q_opt_flags |= ICE_AQ_VSI_Q_OPT_PE_FLTR_EN; + else + ctx->info.q_opt_flags &= ~ICE_AQ_VSI_Q_OPT_PE_FLTR_EN; + +- return ice_update_vsi(hw, vsi_handle, ctx, NULL); ++ status = ice_update_vsi(hw, vsi_handle, ctx, NULL); ++ if (!status) { ++ cached_ctx->info.q_opt_flags = ctx->info.q_opt_flags; ++ cached_ctx->info.valid_sections |= ctx->info.valid_sections; ++ } ++ ++ kfree(ctx); ++ return status; + } + + /** +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-104-ice-add-profile-conflict-check-for-AVF-FDIR.patch b/patches.kernel.org/6.2.10-104-ice-add-profile-conflict-check-for-AVF-FDIR.patch new file mode 100644 index 0000000..8a99b58 --- /dev/null +++ b/patches.kernel.org/6.2.10-104-ice-add-profile-conflict-check-for-AVF-FDIR.patch @@ -0,0 +1,126 @@ +From: Junfeng Guo +Date: Tue, 14 Mar 2023 10:03:15 +0800 +Subject: [PATCH] ice: add profile conflict check for AVF FDIR +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 29486b6df3e6a63b57d1ed1dce06051267282ff4 + +[ Upstream commit 29486b6df3e6a63b57d1ed1dce06051267282ff4 ] + +Add profile conflict check while adding some FDIR rules to avoid +unexpected flow behavior, rules may have conflict including: + IPv4 <---> {IPv4_UDP, IPv4_TCP, IPv4_SCTP} + IPv6 <---> {IPv6_UDP, IPv6_TCP, IPv6_SCTP} + +For example, when we create an FDIR rule for IPv4, this rule will work +on packets including IPv4, IPv4_UDP, IPv4_TCP and IPv4_SCTP. But if we +then create an FDIR rule for IPv4_UDP and then destroy it, the first +FDIR rule for IPv4 cannot work on pkt IPv4_UDP then. + +To prevent this unexpected behavior, we add restriction in software +when creating FDIR rules by adding necessary profile conflict check. + +Fixes: 1f7ea1cd6a37 ("ice: Enable FDIR Configure for AVF") +Signed-off-by: Junfeng Guo +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../ethernet/intel/ice/ice_virtchnl_fdir.c | 73 +++++++++++++++++++ + 1 file changed, 73 insertions(+) + +diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c +index c6a58343..a2645ff3 100644 +--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c ++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c +@@ -541,6 +541,72 @@ static void ice_vc_fdir_rem_prof_all(struct ice_vf *vf) + } + } + ++/** ++ * ice_vc_fdir_has_prof_conflict ++ * @vf: pointer to the VF structure ++ * @conf: FDIR configuration for each filter ++ * ++ * Check if @conf has conflicting profile with existing profiles ++ * ++ * Return: true on success, and false on error. ++ */ ++static bool ++ice_vc_fdir_has_prof_conflict(struct ice_vf *vf, ++ struct virtchnl_fdir_fltr_conf *conf) ++{ ++ struct ice_fdir_fltr *desc; ++ ++ list_for_each_entry(desc, &vf->fdir.fdir_rule_list, fltr_node) { ++ struct virtchnl_fdir_fltr_conf *existing_conf; ++ enum ice_fltr_ptype flow_type_a, flow_type_b; ++ struct ice_fdir_fltr *a, *b; ++ ++ existing_conf = to_fltr_conf_from_desc(desc); ++ a = &existing_conf->input; ++ b = &conf->input; ++ flow_type_a = a->flow_type; ++ flow_type_b = b->flow_type; ++ ++ /* No need to compare two rules with different tunnel types or ++ * with the same protocol type. ++ */ ++ if (existing_conf->ttype != conf->ttype || ++ flow_type_a == flow_type_b) ++ continue; ++ ++ switch (flow_type_a) { ++ case ICE_FLTR_PTYPE_NONF_IPV4_UDP: ++ case ICE_FLTR_PTYPE_NONF_IPV4_TCP: ++ case ICE_FLTR_PTYPE_NONF_IPV4_SCTP: ++ if (flow_type_b == ICE_FLTR_PTYPE_NONF_IPV4_OTHER) ++ return true; ++ break; ++ case ICE_FLTR_PTYPE_NONF_IPV4_OTHER: ++ if (flow_type_b == ICE_FLTR_PTYPE_NONF_IPV4_UDP || ++ flow_type_b == ICE_FLTR_PTYPE_NONF_IPV4_TCP || ++ flow_type_b == ICE_FLTR_PTYPE_NONF_IPV4_SCTP) ++ return true; ++ break; ++ case ICE_FLTR_PTYPE_NONF_IPV6_UDP: ++ case ICE_FLTR_PTYPE_NONF_IPV6_TCP: ++ case ICE_FLTR_PTYPE_NONF_IPV6_SCTP: ++ if (flow_type_b == ICE_FLTR_PTYPE_NONF_IPV6_OTHER) ++ return true; ++ break; ++ case ICE_FLTR_PTYPE_NONF_IPV6_OTHER: ++ if (flow_type_b == ICE_FLTR_PTYPE_NONF_IPV6_UDP || ++ flow_type_b == ICE_FLTR_PTYPE_NONF_IPV6_TCP || ++ flow_type_b == ICE_FLTR_PTYPE_NONF_IPV6_SCTP) ++ return true; ++ break; ++ default: ++ break; ++ } ++ } ++ ++ return false; ++} ++ + /** + * ice_vc_fdir_write_flow_prof + * @vf: pointer to the VF structure +@@ -677,6 +743,13 @@ ice_vc_fdir_config_input_set(struct ice_vf *vf, struct virtchnl_fdir_add *fltr, + enum ice_fltr_ptype flow; + int ret; + ++ ret = ice_vc_fdir_has_prof_conflict(vf, conf); ++ if (ret) { ++ dev_dbg(dev, "Found flow profile conflict for VF %d\n", ++ vf->vf_id); ++ return ret; ++ } ++ + flow = input->flow_type; + ret = ice_vc_fdir_alloc_prof(vf, flow); + if (ret) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-105-ice-fix-invalid-check-for-empty-list-in-ice_sc.patch b/patches.kernel.org/6.2.10-105-ice-fix-invalid-check-for-empty-list-in-ice_sc.patch new file mode 100644 index 0000000..eb53023 --- /dev/null +++ b/patches.kernel.org/6.2.10-105-ice-fix-invalid-check-for-empty-list-in-ice_sc.patch @@ -0,0 +1,65 @@ +From: Jakob Koschel +Date: Mon, 20 Mar 2023 13:48:15 +0100 +Subject: [PATCH] ice: fix invalid check for empty list in + ice_sched_assoc_vsi_to_agg() +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: e9a1cc2e4c4ee7c7e60fb26345618c2522a2a10f + +[ Upstream commit e9a1cc2e4c4ee7c7e60fb26345618c2522a2a10f ] + +The code implicitly assumes that the list iterator finds a correct +handle. If 'vsi_handle' is not found the 'old_agg_vsi_info' was +pointing to an bogus memory location. For safety a separate list +iterator variable should be used to make the != NULL check on +'old_agg_vsi_info' correct under any circumstances. + +Additionally Linus proposed to avoid any use of the list iterator +variable after the loop, in the attempt to move the list iterator +variable declaration into the macro to avoid any potential misuse after +the loop. Using it in a pointer comparison after the loop is undefined +behavior and should be omitted if possible [1]. + +Fixes: 37c592062b16 ("ice: remove the VSI info from previous agg") +Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1] +Signed-off-by: Jakob Koschel +Tested-by: Arpana Arland (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/intel/ice/ice_sched.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_sched.c b/drivers/net/ethernet/intel/ice/ice_sched.c +index 6d08b397..8f0ea411 100644 +--- a/drivers/net/ethernet/intel/ice/ice_sched.c ++++ b/drivers/net/ethernet/intel/ice/ice_sched.c +@@ -2787,7 +2787,7 @@ static int + ice_sched_assoc_vsi_to_agg(struct ice_port_info *pi, u32 agg_id, + u16 vsi_handle, unsigned long *tc_bitmap) + { +- struct ice_sched_agg_vsi_info *agg_vsi_info, *old_agg_vsi_info = NULL; ++ struct ice_sched_agg_vsi_info *agg_vsi_info, *iter, *old_agg_vsi_info = NULL; + struct ice_sched_agg_info *agg_info, *old_agg_info; + struct ice_hw *hw = pi->hw; + int status = 0; +@@ -2805,11 +2805,13 @@ ice_sched_assoc_vsi_to_agg(struct ice_port_info *pi, u32 agg_id, + if (old_agg_info && old_agg_info != agg_info) { + struct ice_sched_agg_vsi_info *vtmp; + +- list_for_each_entry_safe(old_agg_vsi_info, vtmp, ++ list_for_each_entry_safe(iter, vtmp, + &old_agg_info->agg_vsi_list, + list_entry) +- if (old_agg_vsi_info->vsi_handle == vsi_handle) ++ if (iter->vsi_handle == vsi_handle) { ++ old_agg_vsi_info = iter; + break; ++ } + } + + /* check if entry already exist */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-106-net-ethernet-mtk_eth_soc-fix-tx-throughput-reg.patch b/patches.kernel.org/6.2.10-106-net-ethernet-mtk_eth_soc-fix-tx-throughput-reg.patch new file mode 100644 index 0000000..6bb8c4e --- /dev/null +++ b/patches.kernel.org/6.2.10-106-net-ethernet-mtk_eth_soc-fix-tx-throughput-reg.patch @@ -0,0 +1,47 @@ +From: Felix Fietkau +Date: Fri, 24 Mar 2023 15:04:04 +0100 +Subject: [PATCH] net: ethernet: mtk_eth_soc: fix tx throughput regression with + direct 1G links +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 07b3af42d8d528374d4f42d688bae86eeb30831a + +[ Upstream commit 07b3af42d8d528374d4f42d688bae86eeb30831a ] + +Using the QDMA tx scheduler to throttle tx to line speed works fine for +switch ports, but apparently caused a regression on non-switch ports. + +Based on a number of tests, it seems that this throttling can be safely +dropped without re-introducing the issues on switch ports that the +tx scheduling changes resolved. + +Link: https://lore.kernel.org/netdev/trinity-92c3826f-c2c8-40af-8339-bc6d0d3ffea4-1678213958520@3c-app-gmx-bs16/ +Fixes: f63959c7eec3 ("net: ethernet: mtk_eth_soc: implement multi-queue support for per-port queues") +Reported-by: Frank Wunderlich +Reported-by: Daniel Golle +Tested-by: Daniel Golle +Signed-off-by: Felix Fietkau +Link: https://lore.kernel.org/r/20230324140404.95745-1-nbd@nbd.name +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index 332329cb..9f9df625 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -713,8 +713,6 @@ static void mtk_mac_link_up(struct phylink_config *config, + break; + } + +- mtk_set_queue_speed(mac->hw, mac->id, speed); +- + /* Configure duplex */ + if (duplex == DUPLEX_FULL) + mcr |= MAC_MCR_FORCE_DPX; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-107-ALSA-ymfpci-Create-card-with-device-managed-sn.patch b/patches.kernel.org/6.2.10-107-ALSA-ymfpci-Create-card-with-device-managed-sn.patch new file mode 100644 index 0000000..4658194 --- /dev/null +++ b/patches.kernel.org/6.2.10-107-ALSA-ymfpci-Create-card-with-device-managed-sn.patch @@ -0,0 +1,91 @@ +From: Tasos Sahanidis +Date: Wed, 29 Mar 2023 06:24:22 +0300 +Subject: [PATCH] ALSA: ymfpci: Create card with device-managed + snd_devm_card_new() +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: f33fc1576757741479452255132d6e3aaf558ffe + +[ Upstream commit f33fc1576757741479452255132d6e3aaf558ffe ] + +snd_card_ymfpci_remove() was removed in commit c6e6bb5eab74 ("ALSA: +ymfpci: Allocate resources with device-managed APIs"), but the call to +snd_card_new() was not replaced with snd_devm_card_new(). + +Since there was no longer a call to snd_card_free, unloading the module +would eventually result in Oops: + +[697561.532887] BUG: unable to handle page fault for address: ffffffffc0924480 +[697561.532893] #PF: supervisor read access in kernel mode +[697561.532896] #PF: error_code(0x0000) - not-present page +[697561.532899] PGD ae1e15067 P4D ae1e15067 PUD ae1e17067 PMD 11a8f5067 PTE 0 +[697561.532905] Oops: 0000 [#1] PREEMPT SMP NOPTI +[697561.532909] CPU: 21 PID: 5080 Comm: wireplumber Tainted: G W OE 6.2.7 #1 +[697561.532914] Hardware name: System manufacturer System Product Name/TUF GAMING X570-PLUS, BIOS 4408 10/28/2022 +[697561.532916] RIP: 0010:try_module_get.part.0+0x1a/0xe0 +[697561.532924] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 49 89 fc bf 01 00 00 00 e8 56 3c f8 ff <41> 83 3c 24 02 0f 84 96 00 00 00 41 8b 84 24 30 03 00 00 85 c0 0f +[697561.532927] RSP: 0018:ffffbe9b858c3bd8 EFLAGS: 00010246 +[697561.532930] RAX: ffff9815d14f1900 RBX: ffff9815c14e6000 RCX: 0000000000000000 +[697561.532933] RDX: 0000000000000000 RSI: ffffffffc055092c RDI: ffffffffb3778c1a +[697561.532935] RBP: ffffbe9b858c3be8 R08: 0000000000000040 R09: ffff981a1a741380 +[697561.532937] R10: ffffbe9b858c3c80 R11: 00000009d56533a6 R12: ffffffffc0924480 +[697561.532939] R13: ffff9823439d8500 R14: 0000000000000025 R15: ffff9815cd109f80 +[697561.532942] FS: 00007f13084f1f80(0000) GS:ffff9824aef40000(0000) knlGS:0000000000000000 +[697561.532945] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[697561.532947] CR2: ffffffffc0924480 CR3: 0000000145344000 CR4: 0000000000350ee0 +[697561.532949] Call Trace: +[697561.532951] +[697561.532955] try_module_get+0x13/0x30 +[697561.532960] snd_ctl_open+0x61/0x1c0 [snd] +[697561.532976] snd_open+0xb4/0x1e0 [snd] +[697561.532989] chrdev_open+0xc7/0x240 +[697561.532995] ? fsnotify_perm.part.0+0x6e/0x160 +[697561.533000] ? __pfx_chrdev_open+0x10/0x10 +[697561.533005] do_dentry_open+0x169/0x440 +[697561.533009] vfs_open+0x2d/0x40 +[697561.533012] path_openat+0xa9d/0x10d0 +[697561.533017] ? debug_smp_processor_id+0x17/0x20 +[697561.533022] ? trigger_load_balance+0x65/0x370 +[697561.533026] do_filp_open+0xb2/0x160 +[697561.533032] ? _raw_spin_unlock+0x19/0x40 +[697561.533036] ? alloc_fd+0xa9/0x190 +[697561.533040] do_sys_openat2+0x9f/0x160 +[697561.533044] __x64_sys_openat+0x55/0x90 +[697561.533048] do_syscall_64+0x3b/0x90 +[697561.533052] entry_SYSCALL_64_after_hwframe+0x72/0xdc +[697561.533056] RIP: 0033:0x7f1308a40db4 +[697561.533059] Code: 24 20 eb 8f 66 90 44 89 54 24 0c e8 46 68 f8 ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 32 44 89 c7 89 44 24 0c e8 78 68 f8 ff 8b 44 +[697561.533062] RSP: 002b:00007ffcce664450 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 +[697561.533066] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f1308a40db4 +[697561.533068] RDX: 0000000000080000 RSI: 00007ffcce664690 RDI: 00000000ffffff9c +[697561.533070] RBP: 00007ffcce664690 R08: 0000000000000000 R09: 0000000000000012 +[697561.533072] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000080000 +[697561.533074] R13: 00007f13054b069b R14: 0000565209f83200 R15: 0000000000000000 +[697561.533078] + +Fixes: c6e6bb5eab74 ("ALSA: ymfpci: Allocate resources with device-managed APIs") +Signed-off-by: Tasos Sahanidis +Link: https://lore.kernel.org/r/20230329032422.170024-1-tasos@tasossah.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/pci/ymfpci/ymfpci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/ymfpci/ymfpci.c b/sound/pci/ymfpci/ymfpci.c +index 1e198e4d..82d4e0fd 100644 +--- a/sound/pci/ymfpci/ymfpci.c ++++ b/sound/pci/ymfpci/ymfpci.c +@@ -170,7 +170,7 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci, + return -ENOENT; + } + +- err = snd_card_new(&pci->dev, index[dev], id[dev], THIS_MODULE, ++ err = snd_devm_card_new(&pci->dev, index[dev], id[dev], THIS_MODULE, + sizeof(*chip), &card); + if (err < 0) + return err; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-108-ALSA-ymfpci-Fix-BUG_ON-in-probe-function.patch b/patches.kernel.org/6.2.10-108-ALSA-ymfpci-Fix-BUG_ON-in-probe-function.patch new file mode 100644 index 0000000..9f62275 --- /dev/null +++ b/patches.kernel.org/6.2.10-108-ALSA-ymfpci-Fix-BUG_ON-in-probe-function.patch @@ -0,0 +1,70 @@ +From: Tasos Sahanidis +Date: Wed, 29 Mar 2023 06:28:08 +0300 +Subject: [PATCH] ALSA: ymfpci: Fix BUG_ON in probe function +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 6be2e7522eb529b41c16d459f33bbdbcddbf5c15 + +[ Upstream commit 6be2e7522eb529b41c16d459f33bbdbcddbf5c15 ] + +The snd_dma_buffer.bytes field now contains the aligned size, which this +snd_BUG_ON() did not account for, resulting in the following: + +[ 9.625915] ------------[ cut here ]------------ +[ 9.633440] WARNING: CPU: 0 PID: 126 at sound/pci/ymfpci/ymfpci_main.c:2168 snd_ymfpci_create+0x681/0x698 [snd_ymfpci] +[ 9.648926] Modules linked in: snd_ymfpci(+) snd_intel_dspcfg kvm(+) snd_intel_sdw_acpi snd_ac97_codec snd_mpu401_uart snd_opl3_lib irqbypass snd_hda_codec gameport snd_rawmidi crct10dif_pclmul crc32_pclmul cfg80211 snd_hda_core polyval_clmulni polyval_generic gf128mul snd_seq_device ghash_clmulni_intel snd_hwdep ac97_bus sha512_ssse3 rfkill snd_pcm aesni_intel tg3 snd_timer crypto_simd snd mxm_wmi libphy cryptd k10temp fam15h_power pcspkr soundcore sp5100_tco wmi acpi_cpufreq mac_hid dm_multipath sg loop fuse dm_mod bpf_preload ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 sr_mod cdrom ata_generic pata_acpi firewire_ohci crc32c_intel firewire_core xhci_pci crc_itu_t pata_via xhci_pci_renesas floppy +[ 9.711849] CPU: 0 PID: 126 Comm: kworker/0:2 Not tainted 6.1.21-1-lts #1 08d2e5ece03136efa7c6aeea9a9c40916b1bd8da +[ 9.722200] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./990FX Extreme4, BIOS P2.70 06/05/2014 +[ 9.732204] Workqueue: events work_for_cpu_fn +[ 9.736580] RIP: 0010:snd_ymfpci_create+0x681/0x698 [snd_ymfpci] +[ 9.742594] Code: 8c c0 4c 89 e2 48 89 df 48 c7 c6 92 c6 8c c0 e8 15 d0 e9 ff 48 83 c4 08 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f e9 d3 7a 33 e3 <0f> 0b e9 cb fd ff ff 41 bd fb ff ff ff eb db 41 bd f4 ff ff ff eb +[ 9.761358] RSP: 0018:ffffab64804e7da0 EFLAGS: 00010287 +[ 9.766594] RAX: ffff8fa2df06c400 RBX: ffff8fa3073a8000 RCX: ffff8fa303fbc4a8 +[ 9.773734] RDX: ffff8fa2df06d000 RSI: 0000000000000010 RDI: 0000000000000020 +[ 9.780876] RBP: ffff8fa300b5d0d0 R08: ffff8fa3073a8e50 R09: 00000000df06bf00 +[ 9.788018] R10: ffff8fa2df06bf00 R11: 00000000df068200 R12: ffff8fa3073a8918 +[ 9.795159] R13: 0000000000000000 R14: 0000000000000080 R15: ffff8fa2df068200 +[ 9.802317] FS: 0000000000000000(0000) GS:ffff8fa9fec00000(0000) knlGS:0000000000000000 +[ 9.810414] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 9.816158] CR2: 000055febaf66500 CR3: 0000000101a2e000 CR4: 00000000000406f0 +[ 9.823301] Call Trace: +[ 9.825747] +[ 9.827889] snd_card_ymfpci_probe+0x194/0x950 [snd_ymfpci b78a5fe64b5663a6390a909c67808567e3e73615] +[ 9.837030] ? finish_task_switch.isra.0+0x90/0x2d0 +[ 9.841918] local_pci_probe+0x45/0x80 +[ 9.845680] work_for_cpu_fn+0x1a/0x30 +[ 9.849431] process_one_work+0x1c7/0x380 +[ 9.853464] worker_thread+0x1af/0x390 +[ 9.857225] ? rescuer_thread+0x3b0/0x3b0 +[ 9.861254] kthread+0xde/0x110 +[ 9.864414] ? kthread_complete_and_exit+0x20/0x20 +[ 9.869210] ret_from_fork+0x22/0x30 +[ 9.872792] +[ 9.874985] ---[ end trace 0000000000000000 ]--- + +Fixes: 5c1733e33c88 ("ALSA: memalloc: Align buffer allocations in page size") +Signed-off-by: Tasos Sahanidis +Link: https://lore.kernel.org/r/20230329032808.170403-1-tasos@tasossah.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/pci/ymfpci/ymfpci_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c +index c80114c0..b492c32c 100644 +--- a/sound/pci/ymfpci/ymfpci_main.c ++++ b/sound/pci/ymfpci/ymfpci_main.c +@@ -2165,7 +2165,7 @@ static int snd_ymfpci_memalloc(struct snd_ymfpci *chip) + chip->work_base = ptr; + chip->work_base_addr = ptr_addr; + +- snd_BUG_ON(ptr + chip->work_size != ++ snd_BUG_ON(ptr + PAGE_ALIGN(chip->work_size) != + chip->work_ptr->area + chip->work_ptr->bytes); + + snd_ymfpci_writel(chip, YDSXGR_PLAYCTRLBASE, chip->bank_base_playback_addr); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-109-net-wwan-iosm-fixes-7560-modem-crash.patch b/patches.kernel.org/6.2.10-109-net-wwan-iosm-fixes-7560-modem-crash.patch new file mode 100644 index 0000000..cda1033 --- /dev/null +++ b/patches.kernel.org/6.2.10-109-net-wwan-iosm-fixes-7560-modem-crash.patch @@ -0,0 +1,49 @@ +From: M Chetan Kumar +Date: Tue, 28 Mar 2023 11:58:44 +0530 +Subject: [PATCH] net: wwan: iosm: fixes 7560 modem crash +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 5f70bcbca469a087b54ad2d934185ed69a098576 + +[ Upstream commit 5f70bcbca469a087b54ad2d934185ed69a098576 ] + +ModemManger/Apps probing the wwan0xmmrpc0 port for 7560 Modem results in +modem crash. + +7560 Modem FW uses the MBIM interface for control command communication +whereas 7360 uses Intel RPC interface so disable wwan0xmmrpc0 port for +7560. + +Fixes: d08b0f8f46e4 ("net: wwan: iosm: add rpc interface for xmm modems") +Reported-and-tested-by: Martin +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217200 +Signed-off-by: M Chetan Kumar +Signed-off-by: Shane Parslow +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wwan/iosm/iosm_ipc_imem.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/wwan/iosm/iosm_ipc_imem.c b/drivers/net/wwan/iosm/iosm_ipc_imem.c +index 1e6a4797..c066b004 100644 +--- a/drivers/net/wwan/iosm/iosm_ipc_imem.c ++++ b/drivers/net/wwan/iosm/iosm_ipc_imem.c +@@ -587,6 +587,13 @@ static void ipc_imem_run_state_worker(struct work_struct *instance) + while (ctrl_chl_idx < IPC_MEM_MAX_CHANNELS) { + if (!ipc_chnl_cfg_get(&chnl_cfg_port, ctrl_chl_idx)) { + ipc_imem->ipc_port[ctrl_chl_idx] = NULL; ++ ++ if (ipc_imem->pcie->pci->device == INTEL_CP_DEVICE_7560_ID && ++ chnl_cfg_port.wwan_port_type == WWAN_PORT_XMMRPC) { ++ ctrl_chl_idx++; ++ continue; ++ } ++ + if (ipc_imem->pcie->pci->device == INTEL_CP_DEVICE_7360_ID && + chnl_cfg_port.wwan_port_type == WWAN_PORT_MBIM) { + ctrl_chl_idx++; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-110-drm-nouveau-kms-Fix-backlight-registration.patch b/patches.kernel.org/6.2.10-110-drm-nouveau-kms-Fix-backlight-registration.patch new file mode 100644 index 0000000..08aabbc --- /dev/null +++ b/patches.kernel.org/6.2.10-110-drm-nouveau-kms-Fix-backlight-registration.patch @@ -0,0 +1,65 @@ +From: Hans de Goede +Date: Sun, 26 Mar 2023 22:54:33 +0200 +Subject: [PATCH] drm/nouveau/kms: Fix backlight registration +Patch-mainline: 6.2.10 +References: bsc#1012628 bsc#1209296 +Git-commit: 30fb97ba4a8e082ba0a5432479d6995472edbd7b + +[ Upstream commit 30fb97ba4a8e082ba0a5432479d6995472edbd7b ] + +The nouveau code used to call drm_fb_helper_initial_config() from +nouveau_fbcon_init() before calling drm_dev_register(). This would +probe all connectors so that drm_connector->status could be used during +backlight registration which runs from nouveau_connector_late_register(). + +After commit 4a16dd9d18a0 ("drm/nouveau/kms: switch to drm fbdev helpers") +the fbdev emulation code, which now is a drm-client, can only run after +drm_dev_register(). So during backlight registration the connectors are +not probed yet and the drm_connector->status == connected check in +nv50_backlight_init() would now always fail. + +Replace the drm_connector->status == connected check with +a drm_helper_probe_detect() == connected check to fix nv_backlight +no longer getting registered because of this. + +Fixes: 4a16dd9d18a0 ("drm/nouveau/kms: switch to drm fbdev helpers") +Link: https://gitlab.freedesktop.org/drm/nouveau/-/issues/202 +Link: https://bugzilla.redhat.com/show_bug.cgi?id=2181941 +Signed-off-by: Hans de Goede +Reviewed-by: Lyude Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20230326205433.36485-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/nouveau/nouveau_backlight.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c +index 40409a29..91b5ecc5 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_backlight.c ++++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c +@@ -33,6 +33,7 @@ + #include + #include + #include ++#include + + #include "nouveau_drv.h" + #include "nouveau_reg.h" +@@ -299,8 +300,12 @@ nv50_backlight_init(struct nouveau_backlight *bl, + struct nouveau_drm *drm = nouveau_drm(nv_encoder->base.base.dev); + struct nvif_object *device = &drm->client.device.object; + ++ /* ++ * Note when this runs the connectors have not been probed yet, ++ * so nv_conn->base.status is not set yet. ++ */ + if (!nvif_rd32(device, NV50_PDISP_SOR_PWM_CTL(ffs(nv_encoder->dcb->or) - 1)) || +- nv_conn->base.status != connector_status_connected) ++ drm_helper_probe_detect(&nv_conn->base, NULL, false) != connector_status_connected) + return -ENODEV; + + if (nv_conn->type == DCB_CONNECTOR_eDP) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-111-net-ipa-compute-DMA-pool-size-properly.patch b/patches.kernel.org/6.2.10-111-net-ipa-compute-DMA-pool-size-properly.patch new file mode 100644 index 0000000..291f24d --- /dev/null +++ b/patches.kernel.org/6.2.10-111-net-ipa-compute-DMA-pool-size-properly.patch @@ -0,0 +1,57 @@ +From: Alex Elder +Date: Tue, 28 Mar 2023 11:27:51 -0500 +Subject: [PATCH] net: ipa: compute DMA pool size properly +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 6c75dc94f2b27fff57b305af9236eea181a00b6c + +[ Upstream commit 6c75dc94f2b27fff57b305af9236eea181a00b6c ] + +In gsi_trans_pool_init_dma(), the total size of a pool of memory +used for DMA transactions is calculated. However the calculation is +done incorrectly. + +For 4KB pages, this total size is currently always more than one +page, and as a result, the calculation produces a positive (though +incorrect) total size. The code still works in this case; we just +end up with fewer DMA pool entries than we intended. + +Bjorn Andersson tested booting a kernel with 16KB pages, and hit a +null pointer derereference in sg_alloc_append_table_from_pages(), +descending from gsi_trans_pool_init_dma(). The cause of this was +that a 16KB total size was going to be allocated, and with 16KB +pages the order of that allocation is 0. The total_size calculation +yielded 0, which eventually led to the crash. + +Correcting the total_size calculation fixes the problem. + +Reported-by: Bjorn Andersson +Tested-by: Bjorn Andersson +Fixes: 9dd441e4ed57 ("soc: qcom: ipa: GSI transactions") +Reviewed-by: Mark Bloch +Signed-off-by: Alex Elder +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20230328162751.2861791-1-elder@linaro.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ipa/gsi_trans.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ipa/gsi_trans.c b/drivers/net/ipa/gsi_trans.c +index 0f52c068..ee6fb00b 100644 +--- a/drivers/net/ipa/gsi_trans.c ++++ b/drivers/net/ipa/gsi_trans.c +@@ -156,7 +156,7 @@ int gsi_trans_pool_init_dma(struct device *dev, struct gsi_trans_pool *pool, + * gsi_trans_pool_exit_dma() can assume the total allocated + * size is exactly (count * size). + */ +- total_size = get_order(total_size) << PAGE_SHIFT; ++ total_size = PAGE_SIZE << get_order(total_size); + + virt = dma_alloc_coherent(dev, total_size, &addr, GFP_KERNEL); + if (!virt) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-112-bnx2x-use-the-right-build_skb-helper.patch b/patches.kernel.org/6.2.10-112-bnx2x-use-the-right-build_skb-helper.patch new file mode 100644 index 0000000..289c052 --- /dev/null +++ b/patches.kernel.org/6.2.10-112-bnx2x-use-the-right-build_skb-helper.patch @@ -0,0 +1,75 @@ +From: Jakub Kicinski +Date: Tue, 28 Mar 2023 17:00:13 -0700 +Subject: [PATCH] bnx2x: use the right build_skb() helper +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 8c495270845d6b4854607e946baef3637a8259ed + +[ Upstream commit 8c495270845d6b4854607e946baef3637a8259ed ] + +build_skb() no longer accepts slab buffers. Since slab use is fairly +uncommon we prefer the drivers to call a separate slab_build_skb() +function appropriately. + +bnx2x uses the old semantics where size of 0 meant buffer from slab. +It sets the fp->rx_frag_size to 0 for MTUs which don't fit in a page. +It needs to call slab_build_skb(). + +This fixes the WARN_ONCE() of incorrect API use seen with bnx2x. + +Reported-by: Thomas Voegtle +Link: https://lore.kernel.org/all/b8f295e4-ba57-8bfb-7d9c-9d62a498a727@lio96.de/ +Fixes: ce098da1497c ("skbuff: Introduce slab_build_skb()") +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20230329000013.2734957-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +index 16c49069..12083b96 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -672,6 +672,18 @@ static int bnx2x_fill_frag_skb(struct bnx2x *bp, struct bnx2x_fastpath *fp, + return 0; + } + ++static struct sk_buff * ++bnx2x_build_skb(const struct bnx2x_fastpath *fp, void *data) ++{ ++ struct sk_buff *skb; ++ ++ if (fp->rx_frag_size) ++ skb = build_skb(data, fp->rx_frag_size); ++ else ++ skb = slab_build_skb(data); ++ return skb; ++} ++ + static void bnx2x_frag_free(const struct bnx2x_fastpath *fp, void *data) + { + if (fp->rx_frag_size) +@@ -779,7 +791,7 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp, + dma_unmap_single(&bp->pdev->dev, dma_unmap_addr(rx_buf, mapping), + fp->rx_buf_size, DMA_FROM_DEVICE); + if (likely(new_data)) +- skb = build_skb(data, fp->rx_frag_size); ++ skb = bnx2x_build_skb(fp, data); + + if (likely(skb)) { + #ifdef BNX2X_STOP_ON_ERROR +@@ -1046,7 +1058,7 @@ static int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget) + dma_unmap_addr(rx_buf, mapping), + fp->rx_buf_size, + DMA_FROM_DEVICE); +- skb = build_skb(data, fp->rx_frag_size); ++ skb = bnx2x_build_skb(fp, data); + if (unlikely(!skb)) { + bnx2x_frag_free(fp, data); + bnx2x_fp_qstats(bp, fp)-> +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-113-i40e-fix-registers-dump-after-run-ethtool-adap.patch b/patches.kernel.org/6.2.10-113-i40e-fix-registers-dump-after-run-ethtool-adap.patch new file mode 100644 index 0000000..25be28b --- /dev/null +++ b/patches.kernel.org/6.2.10-113-i40e-fix-registers-dump-after-run-ethtool-adap.patch @@ -0,0 +1,92 @@ +From: Radoslaw Tyl +Date: Tue, 28 Mar 2023 10:26:59 -0700 +Subject: [PATCH] i40e: fix registers dump after run ethtool adapter self test +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: c5cff16f461a4a434a9915a7be7ac9ced861a8a4 + +[ Upstream commit c5cff16f461a4a434a9915a7be7ac9ced861a8a4 ] + +Fix invalid registers dump from ethtool -d ethX after adapter self test +by ethtool -t ethY. It causes invalid data display. + +The problem was caused by overwriting i40e_reg_list[].elements +which is common for ethtool self test and dump. + +Fixes: 22dd9ae8afcc ("i40e: Rework register diagnostic") +Signed-off-by: Radoslaw Tyl +Reviewed-by: Michal Swiatkowski +Tested-by: Arpana Arland (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20230328172659.3906413-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/intel/i40e/i40e_diag.c | 11 ++++++----- + drivers/net/ethernet/intel/i40e/i40e_diag.h | 2 +- + 2 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_diag.c b/drivers/net/ethernet/intel/i40e/i40e_diag.c +index ef4d3762..ca229b0e 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_diag.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_diag.c +@@ -44,7 +44,7 @@ static i40e_status i40e_diag_reg_pattern_test(struct i40e_hw *hw, + return 0; + } + +-struct i40e_diag_reg_test_info i40e_reg_list[] = { ++const struct i40e_diag_reg_test_info i40e_reg_list[] = { + /* offset mask elements stride */ + {I40E_QTX_CTL(0), 0x0000FFBF, 1, + I40E_QTX_CTL(1) - I40E_QTX_CTL(0)}, +@@ -78,27 +78,28 @@ i40e_status i40e_diag_reg_test(struct i40e_hw *hw) + { + i40e_status ret_code = 0; + u32 reg, mask; ++ u32 elements; + u32 i, j; + + for (i = 0; i40e_reg_list[i].offset != 0 && + !ret_code; i++) { + ++ elements = i40e_reg_list[i].elements; + /* set actual reg range for dynamically allocated resources */ + if (i40e_reg_list[i].offset == I40E_QTX_CTL(0) && + hw->func_caps.num_tx_qp != 0) +- i40e_reg_list[i].elements = hw->func_caps.num_tx_qp; ++ elements = hw->func_caps.num_tx_qp; + if ((i40e_reg_list[i].offset == I40E_PFINT_ITRN(0, 0) || + i40e_reg_list[i].offset == I40E_PFINT_ITRN(1, 0) || + i40e_reg_list[i].offset == I40E_PFINT_ITRN(2, 0) || + i40e_reg_list[i].offset == I40E_QINT_TQCTL(0) || + i40e_reg_list[i].offset == I40E_QINT_RQCTL(0)) && + hw->func_caps.num_msix_vectors != 0) +- i40e_reg_list[i].elements = +- hw->func_caps.num_msix_vectors - 1; ++ elements = hw->func_caps.num_msix_vectors - 1; + + /* test register access */ + mask = i40e_reg_list[i].mask; +- for (j = 0; j < i40e_reg_list[i].elements && !ret_code; j++) { ++ for (j = 0; j < elements && !ret_code; j++) { + reg = i40e_reg_list[i].offset + + (j * i40e_reg_list[i].stride); + ret_code = i40e_diag_reg_pattern_test(hw, reg, mask); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_diag.h b/drivers/net/ethernet/intel/i40e/i40e_diag.h +index c3340f32..1db7c6d5 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_diag.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_diag.h +@@ -20,7 +20,7 @@ struct i40e_diag_reg_test_info { + u32 stride; /* bytes between each element */ + }; + +-extern struct i40e_diag_reg_test_info i40e_reg_list[]; ++extern const struct i40e_diag_reg_test_info i40e_reg_list[]; + + i40e_status i40e_diag_reg_test(struct i40e_hw *hw); + i40e_status i40e_diag_eeprom_test(struct i40e_hw *hw); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-114-bnxt_en-Fix-reporting-of-test-result-in-ethtoo.patch b/patches.kernel.org/6.2.10-114-bnxt_en-Fix-reporting-of-test-result-in-ethtoo.patch new file mode 100644 index 0000000..4c47303 --- /dev/null +++ b/patches.kernel.org/6.2.10-114-bnxt_en-Fix-reporting-of-test-result-in-ethtoo.patch @@ -0,0 +1,40 @@ +From: Kalesh AP +Date: Tue, 28 Mar 2023 18:30:19 -0700 +Subject: [PATCH] bnxt_en: Fix reporting of test result in ethtool selftest +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 83714dc3db0e4a088673601bc8099b079bc1a077 + +[ Upstream commit 83714dc3db0e4a088673601bc8099b079bc1a077 ] + +When the selftest command fails, driver is not reporting the failure +by updating the "test->flags" when bnxt_close_nic() fails. + +Fixes: eb51365846bc ("bnxt_en: Add basic ethtool -t selftest support.") +Reviewed-by: Pavan Chebbi +Reviewed-by: Somnath Kotur +Signed-off-by: Kalesh AP +Signed-off-by: Michael Chan +Reviewed-by: Simon Horman +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index ec573127..7658a06b 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -3738,6 +3738,7 @@ static void bnxt_self_test(struct net_device *dev, struct ethtool_test *etest, + bnxt_ulp_stop(bp); + rc = bnxt_close_nic(bp, true, false); + if (rc) { ++ etest->flags |= ETH_TEST_FL_FAILED; + bnxt_ulp_start(bp, rc); + return; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-115-bnxt_en-Fix-typo-in-PCI-id-to-device-descripti.patch b/patches.kernel.org/6.2.10-115-bnxt_en-Fix-typo-in-PCI-id-to-device-descripti.patch new file mode 100644 index 0000000..fb278d5 --- /dev/null +++ b/patches.kernel.org/6.2.10-115-bnxt_en-Fix-typo-in-PCI-id-to-device-descripti.patch @@ -0,0 +1,49 @@ +From: Kalesh AP +Date: Tue, 28 Mar 2023 18:30:20 -0700 +Subject: [PATCH] bnxt_en: Fix typo in PCI id to device description string + mapping +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 62aad36ed31abc80f35db11e187e690448a79f7d + +[ Upstream commit 62aad36ed31abc80f35db11e187e690448a79f7d ] + +Fix 57502 and 57508 NPAR description string entries. The typos +caused these devices to not match up with lspci output. + +Fixes: 49c98421e6ab ("bnxt_en: Add PCI IDs for 57500 series NPAR devices.") +Reviewed-by: Pavan Chebbi +Signed-off-by: Kalesh AP +Signed-off-by: Michael Chan +Reviewed-by: Simon Horman +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index b44b2ec5..015b5848 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -175,12 +175,12 @@ static const struct pci_device_id bnxt_pci_tbl[] = { + { PCI_VDEVICE(BROADCOM, 0x1750), .driver_data = BCM57508 }, + { PCI_VDEVICE(BROADCOM, 0x1751), .driver_data = BCM57504 }, + { PCI_VDEVICE(BROADCOM, 0x1752), .driver_data = BCM57502 }, +- { PCI_VDEVICE(BROADCOM, 0x1800), .driver_data = BCM57508_NPAR }, ++ { PCI_VDEVICE(BROADCOM, 0x1800), .driver_data = BCM57502_NPAR }, + { PCI_VDEVICE(BROADCOM, 0x1801), .driver_data = BCM57504_NPAR }, +- { PCI_VDEVICE(BROADCOM, 0x1802), .driver_data = BCM57502_NPAR }, +- { PCI_VDEVICE(BROADCOM, 0x1803), .driver_data = BCM57508_NPAR }, ++ { PCI_VDEVICE(BROADCOM, 0x1802), .driver_data = BCM57508_NPAR }, ++ { PCI_VDEVICE(BROADCOM, 0x1803), .driver_data = BCM57502_NPAR }, + { PCI_VDEVICE(BROADCOM, 0x1804), .driver_data = BCM57504_NPAR }, +- { PCI_VDEVICE(BROADCOM, 0x1805), .driver_data = BCM57502_NPAR }, ++ { PCI_VDEVICE(BROADCOM, 0x1805), .driver_data = BCM57508_NPAR }, + { PCI_VDEVICE(BROADCOM, 0xd802), .driver_data = BCM58802 }, + { PCI_VDEVICE(BROADCOM, 0xd804), .driver_data = BCM58804 }, + #ifdef CONFIG_BNXT_SRIOV +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-116-bnxt_en-Add-missing-200G-link-speed-reporting.patch b/patches.kernel.org/6.2.10-116-bnxt_en-Add-missing-200G-link-speed-reporting.patch new file mode 100644 index 0000000..3742d94 --- /dev/null +++ b/patches.kernel.org/6.2.10-116-bnxt_en-Add-missing-200G-link-speed-reporting.patch @@ -0,0 +1,52 @@ +From: Michael Chan +Date: Tue, 28 Mar 2023 18:30:21 -0700 +Subject: [PATCH] bnxt_en: Add missing 200G link speed reporting +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 581bce7bcb7e7f100908728e7b292e266c76895b + +[ Upstream commit 581bce7bcb7e7f100908728e7b292e266c76895b ] + +bnxt_fw_to_ethtool_speed() is missing the case statement for 200G +link speed reported by firmware. As a result, ethtool will report +unknown speed when the firmware reports 200G link speed. + +Fixes: 532262ba3b84 ("bnxt_en: ethtool: support PAM4 link speeds up to 200G") +Signed-off-by: Michael Chan +Reviewed-by: Simon Horman +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 ++ + 2 files changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index 56355e64..3056e5bb 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -1225,6 +1225,7 @@ struct bnxt_link_info { + #define BNXT_LINK_SPEED_40GB PORT_PHY_QCFG_RESP_LINK_SPEED_40GB + #define BNXT_LINK_SPEED_50GB PORT_PHY_QCFG_RESP_LINK_SPEED_50GB + #define BNXT_LINK_SPEED_100GB PORT_PHY_QCFG_RESP_LINK_SPEED_100GB ++#define BNXT_LINK_SPEED_200GB PORT_PHY_QCFG_RESP_LINK_SPEED_200GB + u16 support_speeds; + u16 support_pam4_speeds; + u16 auto_link_speeds; /* fw adv setting */ +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 7658a06b..6bd18eb5 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -1714,6 +1714,8 @@ u32 bnxt_fw_to_ethtool_speed(u16 fw_link_speed) + return SPEED_50000; + case BNXT_LINK_SPEED_100GB: + return SPEED_100000; ++ case BNXT_LINK_SPEED_200GB: ++ return SPEED_200000; + default: + return SPEED_UNKNOWN; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-117-net-dsa-mv88e6xxx-Enable-IGMP-snooping-on-user.patch b/patches.kernel.org/6.2.10-117-net-dsa-mv88e6xxx-Enable-IGMP-snooping-on-user.patch new file mode 100644 index 0000000..c29146b --- /dev/null +++ b/patches.kernel.org/6.2.10-117-net-dsa-mv88e6xxx-Enable-IGMP-snooping-on-user.patch @@ -0,0 +1,56 @@ +From: =?UTF-8?q?Steffen=20B=C3=A4tz?= +Date: Wed, 29 Mar 2023 12:01:40 -0300 +Subject: [PATCH] net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 7bcad0f0e6fbc1d613e49e0ee35c8e5f2e685bb0 + +[ Upstream commit 7bcad0f0e6fbc1d613e49e0ee35c8e5f2e685bb0 ] + +Do not set the MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP bit on CPU or DSA ports. + +This allows the host CPU port to be a regular IGMP listener by sending out +IGMP Membership Reports, which would otherwise not be forwarded by the +mv88exxx chip, but directly looped back to the CPU port itself. + +Fixes: 54d792f257c6 ("net: dsa: Centralise global and port setup code into mv88e6xxx.") +Signed-off-by: Steffen Bätz +Signed-off-by: Fabio Estevam +Reviewed-by: Andrew Lunn +Reviewed-by: Vladimir Oltean +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20230329150140.701559-1-festevam@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/dsa/mv88e6xxx/chip.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 89829e0c..8211a4d3 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -3354,9 +3354,14 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port) + * If this is the upstream port for this switch, enable + * forwarding of unknown unicasts and multicasts. + */ +- reg = MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP | +- MV88E6185_PORT_CTL0_USE_TAG | MV88E6185_PORT_CTL0_USE_IP | ++ reg = MV88E6185_PORT_CTL0_USE_TAG | MV88E6185_PORT_CTL0_USE_IP | + MV88E6XXX_PORT_CTL0_STATE_FORWARDING; ++ /* Forward any IPv4 IGMP or IPv6 MLD frames received ++ * by a USER port to the CPU port to allow snooping. ++ */ ++ if (dsa_is_user_port(ds, port)) ++ reg |= MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP; ++ + err = mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_CTL0, reg); + if (err) + return err; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-118-net-dsa-sync-unicast-and-multicast-addresses-f.patch b/patches.kernel.org/6.2.10-118-net-dsa-sync-unicast-and-multicast-addresses-f.patch new file mode 100644 index 0000000..6dbf6e2 --- /dev/null +++ b/patches.kernel.org/6.2.10-118-net-dsa-sync-unicast-and-multicast-addresses-f.patch @@ -0,0 +1,281 @@ +From: Vladimir Oltean +Date: Wed, 29 Mar 2023 18:18:21 +0300 +Subject: [PATCH] net: dsa: sync unicast and multicast addresses for VLAN + filters too +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 64fdc5f341db01200e33105265d4b8450122a82e + +[ Upstream commit 64fdc5f341db01200e33105265d4b8450122a82e ] + +If certain conditions are met, DSA can install all necessary MAC +addresses on the CPU ports as FDB entries and disable flooding towards +the CPU (we call this RX filtering). + +There is one corner case where this does not work. + +ip link add br0 type bridge vlan_filtering 1 && ip link set br0 up +ip link set swp0 master br0 && ip link set swp0 up +ip link add link swp0 name swp0.100 type vlan id 100 +ip link set swp0.100 up && ip addr add 192.168.100.1/24 dev swp0.100 + +Traffic through swp0.100 is broken, because the bridge turns on VLAN +filtering in the swp0 port (causing RX packets to be classified to the +FDB database corresponding to the VID from their 802.1Q header), and +although the 8021q module does call dev_uc_add() towards the real +device, that API is VLAN-unaware, so it only contains the MAC address, +not the VID; and DSA's current implementation of ndo_set_rx_mode() is +only for VID 0 (corresponding to FDB entries which are installed in an +FDB database which is only hit when the port is VLAN-unaware). + +It's interesting to understand why the bridge does not turn on +IFF_PROMISC for its swp0 bridge port, and it may appear at first glance +that this is a regression caused by the logic in commit 2796d0c648c9 +("bridge: Automatically manage port promiscuous mode."). After all, +a bridge port needs to have IFF_PROMISC by its very nature - it needs to +receive and forward frames with a MAC DA different from the bridge +ports' MAC addresses. + +While that may be true, when the bridge is VLAN-aware *and* it has a +single port, there is no real reason to enable promiscuity even if that +is an automatic port, with flooding and learning (there is nowhere for +packets to go except to the BR_FDB_LOCAL entries), and this is how the +corner case appears. Adding a second automatic interface to the bridge +would make swp0 promisc as well, and would mask the corner case. + +Given the dev_uc_add() / ndo_set_rx_mode() API is what it is (it doesn't +pass a VLAN ID), the only way to address that problem is to install host +FDB entries for the cartesian product of RX filtering MAC addresses and +VLAN RX filters. + +Fixes: 7569459a52c9 ("net: dsa: manage flooding on the CPU ports") +Signed-off-by: Vladimir Oltean +Reviewed-by: Simon Horman +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20230329151821.745752-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/dsa/slave.c | 121 ++++++++++++++++++++++++++++++++++++++++++++++-- + 1 file changed, 116 insertions(+), 5 deletions(-) + +diff --git a/net/dsa/slave.c b/net/dsa/slave.c +index 6711ddc0..df8b16c7 100644 +--- a/net/dsa/slave.c ++++ b/net/dsa/slave.c +@@ -57,6 +57,12 @@ struct dsa_standalone_event_work { + u16 vid; + }; + ++struct dsa_host_vlan_rx_filtering_ctx { ++ struct net_device *dev; ++ const unsigned char *addr; ++ enum dsa_standalone_event event; ++}; ++ + static bool dsa_switch_supports_uc_filtering(struct dsa_switch *ds) + { + return ds->ops->port_fdb_add && ds->ops->port_fdb_del && +@@ -155,18 +161,37 @@ static int dsa_slave_schedule_standalone_work(struct net_device *dev, + return 0; + } + ++static int dsa_slave_host_vlan_rx_filtering(struct net_device *vdev, int vid, ++ void *arg) ++{ ++ struct dsa_host_vlan_rx_filtering_ctx *ctx = arg; ++ ++ return dsa_slave_schedule_standalone_work(ctx->dev, ctx->event, ++ ctx->addr, vid); ++} ++ + static int dsa_slave_sync_uc(struct net_device *dev, + const unsigned char *addr) + { + struct net_device *master = dsa_slave_to_master(dev); + struct dsa_port *dp = dsa_slave_to_port(dev); ++ struct dsa_host_vlan_rx_filtering_ctx ctx = { ++ .dev = dev, ++ .addr = addr, ++ .event = DSA_UC_ADD, ++ }; ++ int err; + + dev_uc_add(master, addr); + + if (!dsa_switch_supports_uc_filtering(dp->ds)) + return 0; + +- return dsa_slave_schedule_standalone_work(dev, DSA_UC_ADD, addr, 0); ++ err = dsa_slave_schedule_standalone_work(dev, DSA_UC_ADD, addr, 0); ++ if (err) ++ return err; ++ ++ return vlan_for_each(dev, dsa_slave_host_vlan_rx_filtering, &ctx); + } + + static int dsa_slave_unsync_uc(struct net_device *dev, +@@ -174,13 +199,23 @@ static int dsa_slave_unsync_uc(struct net_device *dev, + { + struct net_device *master = dsa_slave_to_master(dev); + struct dsa_port *dp = dsa_slave_to_port(dev); ++ struct dsa_host_vlan_rx_filtering_ctx ctx = { ++ .dev = dev, ++ .addr = addr, ++ .event = DSA_UC_DEL, ++ }; ++ int err; + + dev_uc_del(master, addr); + + if (!dsa_switch_supports_uc_filtering(dp->ds)) + return 0; + +- return dsa_slave_schedule_standalone_work(dev, DSA_UC_DEL, addr, 0); ++ err = dsa_slave_schedule_standalone_work(dev, DSA_UC_DEL, addr, 0); ++ if (err) ++ return err; ++ ++ return vlan_for_each(dev, dsa_slave_host_vlan_rx_filtering, &ctx); + } + + static int dsa_slave_sync_mc(struct net_device *dev, +@@ -188,13 +223,23 @@ static int dsa_slave_sync_mc(struct net_device *dev, + { + struct net_device *master = dsa_slave_to_master(dev); + struct dsa_port *dp = dsa_slave_to_port(dev); ++ struct dsa_host_vlan_rx_filtering_ctx ctx = { ++ .dev = dev, ++ .addr = addr, ++ .event = DSA_MC_ADD, ++ }; ++ int err; + + dev_mc_add(master, addr); + + if (!dsa_switch_supports_mc_filtering(dp->ds)) + return 0; + +- return dsa_slave_schedule_standalone_work(dev, DSA_MC_ADD, addr, 0); ++ err = dsa_slave_schedule_standalone_work(dev, DSA_MC_ADD, addr, 0); ++ if (err) ++ return err; ++ ++ return vlan_for_each(dev, dsa_slave_host_vlan_rx_filtering, &ctx); + } + + static int dsa_slave_unsync_mc(struct net_device *dev, +@@ -202,13 +247,23 @@ static int dsa_slave_unsync_mc(struct net_device *dev, + { + struct net_device *master = dsa_slave_to_master(dev); + struct dsa_port *dp = dsa_slave_to_port(dev); ++ struct dsa_host_vlan_rx_filtering_ctx ctx = { ++ .dev = dev, ++ .addr = addr, ++ .event = DSA_MC_DEL, ++ }; ++ int err; + + dev_mc_del(master, addr); + + if (!dsa_switch_supports_mc_filtering(dp->ds)) + return 0; + +- return dsa_slave_schedule_standalone_work(dev, DSA_MC_DEL, addr, 0); ++ err = dsa_slave_schedule_standalone_work(dev, DSA_MC_DEL, addr, 0); ++ if (err) ++ return err; ++ ++ return vlan_for_each(dev, dsa_slave_host_vlan_rx_filtering, &ctx); + } + + void dsa_slave_sync_ha(struct net_device *dev) +@@ -1668,6 +1723,8 @@ static int dsa_slave_vlan_rx_add_vid(struct net_device *dev, __be16 proto, + .flags = 0, + }; + struct netlink_ext_ack extack = {0}; ++ struct dsa_switch *ds = dp->ds; ++ struct netdev_hw_addr *ha; + int ret; + + /* User port... */ +@@ -1687,6 +1744,30 @@ static int dsa_slave_vlan_rx_add_vid(struct net_device *dev, __be16 proto, + return ret; + } + ++ if (!dsa_switch_supports_uc_filtering(ds) && ++ !dsa_switch_supports_mc_filtering(ds)) ++ return 0; ++ ++ netif_addr_lock_bh(dev); ++ ++ if (dsa_switch_supports_mc_filtering(ds)) { ++ netdev_for_each_synced_mc_addr(ha, dev) { ++ dsa_slave_schedule_standalone_work(dev, DSA_MC_ADD, ++ ha->addr, vid); ++ } ++ } ++ ++ if (dsa_switch_supports_uc_filtering(ds)) { ++ netdev_for_each_synced_uc_addr(ha, dev) { ++ dsa_slave_schedule_standalone_work(dev, DSA_UC_ADD, ++ ha->addr, vid); ++ } ++ } ++ ++ netif_addr_unlock_bh(dev); ++ ++ dsa_flush_workqueue(); ++ + return 0; + } + +@@ -1699,13 +1780,43 @@ static int dsa_slave_vlan_rx_kill_vid(struct net_device *dev, __be16 proto, + /* This API only allows programming tagged, non-PVID VIDs */ + .flags = 0, + }; ++ struct dsa_switch *ds = dp->ds; ++ struct netdev_hw_addr *ha; + int err; + + err = dsa_port_vlan_del(dp, &vlan); + if (err) + return err; + +- return dsa_port_host_vlan_del(dp, &vlan); ++ err = dsa_port_host_vlan_del(dp, &vlan); ++ if (err) ++ return err; ++ ++ if (!dsa_switch_supports_uc_filtering(ds) && ++ !dsa_switch_supports_mc_filtering(ds)) ++ return 0; ++ ++ netif_addr_lock_bh(dev); ++ ++ if (dsa_switch_supports_mc_filtering(ds)) { ++ netdev_for_each_synced_mc_addr(ha, dev) { ++ dsa_slave_schedule_standalone_work(dev, DSA_MC_DEL, ++ ha->addr, vid); ++ } ++ } ++ ++ if (dsa_switch_supports_uc_filtering(ds)) { ++ netdev_for_each_synced_uc_addr(ha, dev) { ++ dsa_slave_schedule_standalone_work(dev, DSA_UC_DEL, ++ ha->addr, vid); ++ } ++ } ++ ++ netif_addr_unlock_bh(dev); ++ ++ dsa_flush_workqueue(); ++ ++ return 0; + } + + static int dsa_slave_restore_vlan(struct net_device *vdev, int vid, void *arg) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-119-net-ethernet-mtk_eth_soc-fix-flow-block-refcou.patch b/patches.kernel.org/6.2.10-119-net-ethernet-mtk_eth_soc-fix-flow-block-refcou.patch new file mode 100644 index 0000000..f8cf812 --- /dev/null +++ b/patches.kernel.org/6.2.10-119-net-ethernet-mtk_eth_soc-fix-flow-block-refcou.patch @@ -0,0 +1,49 @@ +From: Felix Fietkau +Date: Thu, 30 Mar 2023 14:08:38 +0200 +Subject: [PATCH] net: ethernet: mtk_eth_soc: fix flow block refcounting logic +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 8c1cb87c2a5c29da416848451a687473f379611c + +[ Upstream commit 8c1cb87c2a5c29da416848451a687473f379611c ] + +Since we call flow_block_cb_decref on FLOW_BLOCK_UNBIND, we also need to +call flow_block_cb_incref for a newly allocated cb. +Also fix the accidentally inverted refcount check on unbind. + +Fixes: 502e84e2382d ("net: ethernet: mtk_eth_soc: add flow offloading support") +Reviewed-by: Simon Horman +Signed-off-by: Felix Fietkau +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20230330120840.52079-1-nbd@nbd.name +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/mediatek/mtk_ppe_offload.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c +index 81afd5ee..161751bb 100644 +--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c ++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c +@@ -576,6 +576,7 @@ mtk_eth_setup_tc_block(struct net_device *dev, struct flow_block_offload *f) + if (IS_ERR(block_cb)) + return PTR_ERR(block_cb); + ++ flow_block_cb_incref(block_cb); + flow_block_cb_add(block_cb, f); + list_add_tail(&block_cb->driver_list, &block_cb_list); + return 0; +@@ -584,7 +585,7 @@ mtk_eth_setup_tc_block(struct net_device *dev, struct flow_block_offload *f) + if (!block_cb) + return -ENOENT; + +- if (flow_block_cb_decref(block_cb)) { ++ if (!flow_block_cb_decref(block_cb)) { + flow_block_cb_remove(block_cb, f); + list_del(&block_cb->driver_list); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-120-net-ethernet-mtk_eth_soc-fix-L2-offloading-wit.patch b/patches.kernel.org/6.2.10-120-net-ethernet-mtk_eth_soc-fix-L2-offloading-wit.patch new file mode 100644 index 0000000..a63881d --- /dev/null +++ b/patches.kernel.org/6.2.10-120-net-ethernet-mtk_eth_soc-fix-L2-offloading-wit.patch @@ -0,0 +1,76 @@ +From: Felix Fietkau +Date: Thu, 30 Mar 2023 14:08:39 +0200 +Subject: [PATCH] net: ethernet: mtk_eth_soc: fix L2 offloading with DSA untag + offload +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 5f36ca1b841fb17a20249fd9fedafc7dc7fdd940 + +[ Upstream commit 5f36ca1b841fb17a20249fd9fedafc7dc7fdd940 ] + +Check for skb metadata in order to detect the case where the DSA header +is not present. + +Fixes: 2d7605a72906 ("net: ethernet: mtk_eth_soc: enable hardware DSA untagging") +Reviewed-by: Simon Horman +Signed-off-by: Felix Fietkau +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20230330120840.52079-2-nbd@nbd.name +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 6 +++--- + drivers/net/ethernet/mediatek/mtk_ppe.c | 5 ++++- + 2 files changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index 9f9df625..bd7c18c8 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -2006,9 +2006,6 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget, + skb_checksum_none_assert(skb); + skb->protocol = eth_type_trans(skb, netdev); + +- if (reason == MTK_PPE_CPU_REASON_HIT_UNBIND_RATE_REACHED) +- mtk_ppe_check_skb(eth->ppe[0], skb, hash); +- + if (netdev->features & NETIF_F_HW_VLAN_CTAG_RX) { + if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) { + if (trxd.rxd3 & RX_DMA_VTAG_V2) { +@@ -2036,6 +2033,9 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget, + __vlan_hwaccel_put_tag(skb, htons(vlan_proto), vlan_tci); + } + ++ if (reason == MTK_PPE_CPU_REASON_HIT_UNBIND_RATE_REACHED) ++ mtk_ppe_check_skb(eth->ppe[0], skb, hash); ++ + skb_record_rx_queue(skb, 0); + napi_gro_receive(napi, skb); + +diff --git a/drivers/net/ethernet/mediatek/mtk_ppe.c b/drivers/net/ethernet/mediatek/mtk_ppe.c +index 1ff024f4..52db211d 100644 +--- a/drivers/net/ethernet/mediatek/mtk_ppe.c ++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c +@@ -8,6 +8,7 @@ + #include + #include + #include ++#include + #include + #include "mtk_eth_soc.h" + #include "mtk_ppe.h" +@@ -699,7 +700,9 @@ void __mtk_ppe_check_skb(struct mtk_ppe *ppe, struct sk_buff *skb, u16 hash) + skb->dev->dsa_ptr->tag_ops->proto != DSA_TAG_PROTO_MTK) + goto out; + +- tag += 4; ++ if (!skb_metadata_dst(skb)) ++ tag += 4; ++ + if (get_unaligned_be16(tag) != ETH_P_8021Q) + break; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-121-net-ethernet-mtk_eth_soc-add-missing-ppe-cache.patch b/patches.kernel.org/6.2.10-121-net-ethernet-mtk_eth_soc-add-missing-ppe-cache.patch new file mode 100644 index 0000000..f473021 --- /dev/null +++ b/patches.kernel.org/6.2.10-121-net-ethernet-mtk_eth_soc-add-missing-ppe-cache.patch @@ -0,0 +1,40 @@ +From: Felix Fietkau +Date: Thu, 30 Mar 2023 14:08:40 +0200 +Subject: [PATCH] net: ethernet: mtk_eth_soc: add missing ppe cache flush when + deleting a flow +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 924531326e2dd4ceabe7240f2b55a88e7d894ec2 + +[ Upstream commit 924531326e2dd4ceabe7240f2b55a88e7d894ec2 ] + +The cache needs to be flushed to ensure that the hardware stops offloading +the flow immediately. + +Fixes: 33fc42de3327 ("net: ethernet: mtk_eth_soc: support creating mac address based offload entries") +Reviewed-by: Simon Horman +Signed-off-by: Felix Fietkau +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20230330120840.52079-3-nbd@nbd.name +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/mediatek/mtk_ppe.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mediatek/mtk_ppe.c b/drivers/net/ethernet/mediatek/mtk_ppe.c +index 52db211d..2ea539cc 100644 +--- a/drivers/net/ethernet/mediatek/mtk_ppe.c ++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c +@@ -459,6 +459,7 @@ __mtk_foe_entry_clear(struct mtk_ppe *ppe, struct mtk_flow_entry *entry) + hwe->ib1 &= ~MTK_FOE_IB1_STATE; + hwe->ib1 |= FIELD_PREP(MTK_FOE_IB1_STATE, MTK_FOE_STATE_INVALID); + dma_wmb(); ++ mtk_ppe_cache_clear(ppe); + } + entry->hash = 0xffff; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-122-pinctrl-ocelot-Fix-alt-mode-for-ocelot.patch b/patches.kernel.org/6.2.10-122-pinctrl-ocelot-Fix-alt-mode-for-ocelot.patch new file mode 100644 index 0000000..2695df2 --- /dev/null +++ b/patches.kernel.org/6.2.10-122-pinctrl-ocelot-Fix-alt-mode-for-ocelot.patch @@ -0,0 +1,41 @@ +From: Horatiu Vultur +Date: Mon, 6 Feb 2023 21:37:20 +0100 +Subject: [PATCH] pinctrl: ocelot: Fix alt mode for ocelot +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 657fd9da2d4b4aa0a384105b236baa22fa0233bf + +[ Upstream commit 657fd9da2d4b4aa0a384105b236baa22fa0233bf ] + +In case the driver was trying to set an alternate mode for gpio +0 or 32 then the mode was not set correctly. The reason is that +there is computation error inside the function ocelot_pinmux_set_mux +because in this case it was trying to shift to left by -1. +Fix this by actually shifting the function bits and not the position. + +Fixes: 4b36082e2e09 ("pinctrl: ocelot: fix pinmuxing for pins after 31") +Signed-off-by: Horatiu Vultur +Link: https://lore.kernel.org/r/20230206203720.1177718-1-horatiu.vultur@microchip.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pinctrl/pinctrl-ocelot.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/pinctrl-ocelot.c b/drivers/pinctrl/pinctrl-ocelot.c +index 29e4a628..1dcbd093 100644 +--- a/drivers/pinctrl/pinctrl-ocelot.c ++++ b/drivers/pinctrl/pinctrl-ocelot.c +@@ -1204,7 +1204,7 @@ static int ocelot_pinmux_set_mux(struct pinctrl_dev *pctldev, + regmap_update_bits(info->map, REG_ALT(0, info, pin->pin), + BIT(p), f << p); + regmap_update_bits(info->map, REG_ALT(1, info, pin->pin), +- BIT(p), f << (p - 1)); ++ BIT(p), (f >> 1) << p); + + return 0; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-123-Input-xpad-fix-incorrectly-applied-patch-for-M.patch b/patches.kernel.org/6.2.10-123-Input-xpad-fix-incorrectly-applied-patch-for-M.patch new file mode 100644 index 0000000..37b0cbb --- /dev/null +++ b/patches.kernel.org/6.2.10-123-Input-xpad-fix-incorrectly-applied-patch-for-M.patch @@ -0,0 +1,52 @@ +From: Matthias Benkmann +Date: Sun, 19 Mar 2023 21:30:15 -0700 +Subject: [PATCH] Input: xpad - fix incorrectly applied patch for + MAP_PROFILE_BUTTON +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: ffa6206ebf8d39e83d87ac226df68dbbe155819a + +[ Upstream commit ffa6206ebf8d39e83d87ac226df68dbbe155819a ] + +When commit commit fff1011a26d6 ("Input: xpad - add X-Box Adaptive Profile +button") was applied, one hunk ended up in the wrong function; move it to +where it belongs. + +Fixes: fff1011a26d6 ("Input: xpad - add X-Box Adaptive Profile button") +Signed-off-by: Matthias Benkmann +Link: https://lore.kernel.org/r/20230318162106.0aef4ba5@ninja +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/input/joystick/xpad.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index 2959d80f..cd36cf71 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -779,9 +779,6 @@ static void xpad_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned char *d + input_report_key(dev, BTN_C, data[8]); + input_report_key(dev, BTN_Z, data[9]); + +- /* Profile button has a value of 0-3, so it is reported as an axis */ +- if (xpad->mapping & MAP_PROFILE_BUTTON) +- input_report_abs(dev, ABS_PROFILE, data[34]); + + input_sync(dev); + } +@@ -1059,6 +1056,10 @@ static void xpadone_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned char + (__u16) le16_to_cpup((__le16 *)(data + 8))); + } + ++ /* Profile button has a value of 0-3, so it is reported as an axis */ ++ if (xpad->mapping & MAP_PROFILE_BUTTON) ++ input_report_abs(dev, ABS_PROFILE, data[34]); ++ + /* paddle handling */ + /* based on SDL's SDL_hidapi_xboxone.c */ + if (xpad->mapping & MAP_PADDLES) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-124-iommu-vt-d-Allow-zero-SAGAW-if-second-stage-no.patch b/patches.kernel.org/6.2.10-124-iommu-vt-d-Allow-zero-SAGAW-if-second-stage-no.patch new file mode 100644 index 0000000..3f6d6e1 --- /dev/null +++ b/patches.kernel.org/6.2.10-124-iommu-vt-d-Allow-zero-SAGAW-if-second-stage-no.patch @@ -0,0 +1,44 @@ +From: Lu Baolu +Date: Wed, 29 Mar 2023 21:47:20 +0800 +Subject: [PATCH] iommu/vt-d: Allow zero SAGAW if second-stage not supported +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: bfd3c6b9fa4a1dc78139dd1621d5bea321ffa69d + +[ Upstream commit bfd3c6b9fa4a1dc78139dd1621d5bea321ffa69d ] + +The VT-d spec states (in section 11.4.2) that hardware implementations +reporting second-stage translation support (SSTS) field as Clear also +report the SAGAW field as 0. Fix an inappropriate check in alloc_iommu(). + +Fixes: 792fb43ce2c9 ("iommu/vt-d: Enable Intel IOMMU scalable mode by default") +Suggested-by: Raghunathan Srinivasan +Reviewed-by: Kevin Tian +Signed-off-by: Jacob Pan +Signed-off-by: Lu Baolu +Link: https://lore.kernel.org/r/20230318024824.124542-1-baolu.lu@linux.intel.com +Link: https://lore.kernel.org/r/20230329134721.469447-3-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/iommu/intel/dmar.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c +index b00a0ceb..c80c524a 100644 +--- a/drivers/iommu/intel/dmar.c ++++ b/drivers/iommu/intel/dmar.c +@@ -1057,7 +1057,8 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd) + } + + err = -EINVAL; +- if (cap_sagaw(iommu->cap) == 0) { ++ if (!cap_sagaw(iommu->cap) && ++ (!ecap_smts(iommu->ecap) || ecap_slts(iommu->ecap))) { + pr_info("%s: No supported address widths. Not attempting DMA translation.\n", + iommu->name); + drhd->ignored = 1; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-125-Revert-venus-firmware-Correct-non-pix-start-an.patch b/patches.kernel.org/6.2.10-125-Revert-venus-firmware-Correct-non-pix-start-an.patch new file mode 100644 index 0000000..1e54e15 --- /dev/null +++ b/patches.kernel.org/6.2.10-125-Revert-venus-firmware-Correct-non-pix-start-an.patch @@ -0,0 +1,50 @@ +From: Javier Martinez Canillas +Date: Tue, 7 Feb 2023 11:22:54 +0100 +Subject: [PATCH] Revert "venus: firmware: Correct non-pix start and end + addresses" +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: f95b8ea79c47c0ad3d18f45ad538f9970e414d1f + +[ Upstream commit f95b8ea79c47c0ad3d18f45ad538f9970e414d1f ] + +This reverts commit a837e5161cff, which broke probing of the venus +driver, at least on the SC7180 SoC HP X2 Chromebook: + + qcom-venus aa00000.video-codec: Adding to iommu group 11 + qcom-venus aa00000.video-codec: non legacy binding + qcom-venus aa00000.video-codec: failed to reset venus core + qcom-venus: probe of aa00000.video-codec failed with error -110 + +Matthias Kaehlcke also reported that the same change caused a regression +in SC7180 and sc7280, that prevents AOSS from entering sleep mode during +system suspend. So let's revert this commit for now to fix both issues. + +Fixes: a837e5161cff ("venus: firmware: Correct non-pix start and end addresses") +Reported-by: Matthias Kaehlcke +Signed-off-by: Javier Martinez Canillas +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/platform/qcom/venus/firmware.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/qcom/venus/firmware.c b/drivers/media/platform/qcom/venus/firmware.c +index 142d4c74..d59ecf77 100644 +--- a/drivers/media/platform/qcom/venus/firmware.c ++++ b/drivers/media/platform/qcom/venus/firmware.c +@@ -38,8 +38,8 @@ static void venus_reset_cpu(struct venus_core *core) + writel(fw_size, wrapper_base + WRAPPER_FW_END_ADDR); + writel(0, wrapper_base + WRAPPER_CPA_START_ADDR); + writel(fw_size, wrapper_base + WRAPPER_CPA_END_ADDR); +- writel(0, wrapper_base + WRAPPER_NONPIX_START_ADDR); +- writel(0, wrapper_base + WRAPPER_NONPIX_END_ADDR); ++ writel(fw_size, wrapper_base + WRAPPER_NONPIX_START_ADDR); ++ writel(fw_size, wrapper_base + WRAPPER_NONPIX_END_ADDR); + + if (IS_V6(core)) { + /* Bring XTSS out of reset */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-126-Input-i8042-add-TUXEDO-devices-to-i8042-quirk-.patch b/patches.kernel.org/6.2.10-126-Input-i8042-add-TUXEDO-devices-to-i8042-quirk-.patch new file mode 100644 index 0000000..937ffc3 --- /dev/null +++ b/patches.kernel.org/6.2.10-126-Input-i8042-add-TUXEDO-devices-to-i8042-quirk-.patch @@ -0,0 +1,82 @@ +From: Werner Sembach +Date: Thu, 23 Mar 2023 18:13:11 -0700 +Subject: [PATCH] Input: i8042 - add TUXEDO devices to i8042 quirk tables for + partial fix +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: cbedf1a33970c9b825ae75b81fbd3e88e224a418 + +commit cbedf1a33970c9b825ae75b81fbd3e88e224a418 upstream. + +A lot of modern Clevo barebones have touchpad and/or keyboard issues after +suspend fixable with nomux + reset + noloop + nopnp. Luckily, none of them +have an external PS/2 port so this can safely be set for all of them. + +I'm not entirely sure if every device listed really needs all four quirks, +but after testing and production use, no negative effects could be +observed when setting all four. + +Setting SERIO_QUIRK_NOMUX or SERIO_QUIRK_RESET_ALWAYS on the Clevo N150CU +and the Clevo NHxxRZQ makes the keyboard very laggy for ~5 seconds after +boot and sometimes also after resume. However both are required for the +keyboard to not fail completely sometimes after boot or resume. + +Signed-off-by: Werner Sembach +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230321191619.647911-1-wse@tuxedocomputers.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/input/serio/i8042-acpipnpio.h | 28 +++++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/drivers/input/serio/i8042-acpipnpio.h b/drivers/input/serio/i8042-acpipnpio.h +index efc61736..371406f8 100644 +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -1116,6 +1116,20 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, ++ { ++ /* ++ * Setting SERIO_QUIRK_NOMUX or SERIO_QUIRK_RESET_ALWAYS makes ++ * the keyboard very laggy for ~5 seconds after boot and ++ * sometimes also after resume. ++ * However both are required for the keyboard to not fail ++ * completely sometimes after boot or resume. ++ */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "N150CU"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | ++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "NH5xAx"), +@@ -1123,6 +1137,20 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, ++ { ++ /* ++ * Setting SERIO_QUIRK_NOMUX or SERIO_QUIRK_RESET_ALWAYS makes ++ * the keyboard very laggy for ~5 seconds after boot and ++ * sometimes also after resume. ++ * However both are required for the keyboard to not fail ++ * completely sometimes after boot or resume. ++ */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "NHxxRZQ"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | ++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-127-Input-alps-fix-compatibility-with-funsigned-ch.patch b/patches.kernel.org/6.2.10-127-Input-alps-fix-compatibility-with-funsigned-ch.patch new file mode 100644 index 0000000..1ff16f8 --- /dev/null +++ b/patches.kernel.org/6.2.10-127-Input-alps-fix-compatibility-with-funsigned-ch.patch @@ -0,0 +1,83 @@ +From: msizanoen +Date: Sun, 19 Mar 2023 23:02:56 -0700 +Subject: [PATCH] Input: alps - fix compatibility with -funsigned-char +Patch-mainline: 6.2.10 +References: bsc#1012628 bsc#1209805 +Git-commit: 754ff5060daf5a1cf4474eff9b4edeb6c17ef7ab + +commit 754ff5060daf5a1cf4474eff9b4edeb6c17ef7ab upstream. + +The AlpsPS/2 code previously relied on the assumption that `char` is a +signed type, which was true on x86 platforms (the only place where this +driver is used) before kernel 6.2. However, on 6.2 and later, this +assumption is broken due to the introduction of -funsigned-char as a new +global compiler flag. + +Fix this by explicitly specifying the signedness of `char` when sign +extending the values received from the device. + +Fixes: f3f33c677699 ("Input: alps - Rushmore and v7 resolution support") +Signed-off-by: msizanoen +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230320045228.182259-1-msizanoen@qtmlabs.xyz +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/input/mouse/alps.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c +index 989228b5..e2c11d9f 100644 +--- a/drivers/input/mouse/alps.c ++++ b/drivers/input/mouse/alps.c +@@ -852,8 +852,8 @@ static void alps_process_packet_v6(struct psmouse *psmouse) + x = y = z = 0; + + /* Divide 4 since trackpoint's speed is too fast */ +- input_report_rel(dev2, REL_X, (char)x / 4); +- input_report_rel(dev2, REL_Y, -((char)y / 4)); ++ input_report_rel(dev2, REL_X, (s8)x / 4); ++ input_report_rel(dev2, REL_Y, -((s8)y / 4)); + + psmouse_report_standard_buttons(dev2, packet[3]); + +@@ -1104,8 +1104,8 @@ static void alps_process_trackstick_packet_v7(struct psmouse *psmouse) + ((packet[3] & 0x20) << 1); + z = (packet[5] & 0x3f) | ((packet[3] & 0x80) >> 1); + +- input_report_rel(dev2, REL_X, (char)x); +- input_report_rel(dev2, REL_Y, -((char)y)); ++ input_report_rel(dev2, REL_X, (s8)x); ++ input_report_rel(dev2, REL_Y, -((s8)y)); + input_report_abs(dev2, ABS_PRESSURE, z); + + psmouse_report_standard_buttons(dev2, packet[1]); +@@ -2294,20 +2294,20 @@ static int alps_get_v3_v7_resolution(struct psmouse *psmouse, int reg_pitch) + if (reg < 0) + return reg; + +- x_pitch = (char)(reg << 4) >> 4; /* sign extend lower 4 bits */ ++ x_pitch = (s8)(reg << 4) >> 4; /* sign extend lower 4 bits */ + x_pitch = 50 + 2 * x_pitch; /* In 0.1 mm units */ + +- y_pitch = (char)reg >> 4; /* sign extend upper 4 bits */ ++ y_pitch = (s8)reg >> 4; /* sign extend upper 4 bits */ + y_pitch = 36 + 2 * y_pitch; /* In 0.1 mm units */ + + reg = alps_command_mode_read_reg(psmouse, reg_pitch + 1); + if (reg < 0) + return reg; + +- x_electrode = (char)(reg << 4) >> 4; /* sign extend lower 4 bits */ ++ x_electrode = (s8)(reg << 4) >> 4; /* sign extend lower 4 bits */ + x_electrode = 17 + x_electrode; + +- y_electrode = (char)reg >> 4; /* sign extend upper 4 bits */ ++ y_electrode = (s8)reg >> 4; /* sign extend upper 4 bits */ + y_electrode = 13 + y_electrode; + + x_phys = x_pitch * (x_electrode - 1); /* In 0.1 mm units */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-128-Input-focaltech-use-explicitly-signed-char-typ.patch b/patches.kernel.org/6.2.10-128-Input-focaltech-use-explicitly-signed-char-typ.patch new file mode 100644 index 0000000..5210c26 --- /dev/null +++ b/patches.kernel.org/6.2.10-128-Input-focaltech-use-explicitly-signed-char-typ.patch @@ -0,0 +1,56 @@ +From: "Jason A. Donenfeld" +Date: Sun, 19 Mar 2023 21:36:36 -0700 +Subject: [PATCH] Input: focaltech - use explicitly signed char type +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 8980f190947ba29f23110408e712444884b74251 + +commit 8980f190947ba29f23110408e712444884b74251 upstream. + +The recent change of -funsigned-char causes additions of negative +numbers to become additions of large positive numbers, leading to wrong +calculations of mouse movement. Change these casts to be explicitly +signed, to take into account negative offsets. + +Fixes: 3bc753c06dd0 ("kbuild: treat char as always unsigned") +Signed-off-by: Jason A. Donenfeld +Reviewed-by: Hans de Goede +Cc: stable@vger.kernel.org +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217211 +Link: https://lore.kernel.org/r/20230318133010.1285202-1-Jason@zx2c4.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/input/mouse/focaltech.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/input/mouse/focaltech.c b/drivers/input/mouse/focaltech.c +index 6fd5fff0..c74b9907 100644 +--- a/drivers/input/mouse/focaltech.c ++++ b/drivers/input/mouse/focaltech.c +@@ -202,8 +202,8 @@ static void focaltech_process_rel_packet(struct psmouse *psmouse, + state->pressed = packet[0] >> 7; + finger1 = ((packet[0] >> 4) & 0x7) - 1; + if (finger1 < FOC_MAX_FINGERS) { +- state->fingers[finger1].x += (char)packet[1]; +- state->fingers[finger1].y += (char)packet[2]; ++ state->fingers[finger1].x += (s8)packet[1]; ++ state->fingers[finger1].y += (s8)packet[2]; + } else { + psmouse_err(psmouse, "First finger in rel packet invalid: %d\n", + finger1); +@@ -218,8 +218,8 @@ static void focaltech_process_rel_packet(struct psmouse *psmouse, + */ + finger2 = ((packet[3] >> 4) & 0x7) - 1; + if (finger2 < FOC_MAX_FINGERS) { +- state->fingers[finger2].x += (char)packet[4]; +- state->fingers[finger2].y += (char)packet[5]; ++ state->fingers[finger2].x += (s8)packet[4]; ++ state->fingers[finger2].y += (s8)packet[5]; + } + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-129-cifs-prevent-infinite-recursion-in-CIFSGetDFSR.patch b/patches.kernel.org/6.2.10-129-cifs-prevent-infinite-recursion-in-CIFSGetDFSR.patch new file mode 100644 index 0000000..b5133ec --- /dev/null +++ b/patches.kernel.org/6.2.10-129-cifs-prevent-infinite-recursion-in-CIFSGetDFSR.patch @@ -0,0 +1,46 @@ +From: Paulo Alcantara +Date: Wed, 29 Mar 2023 17:14:22 -0300 +Subject: [PATCH] cifs: prevent infinite recursion in CIFSGetDFSRefer() +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 09ba47b44d26b475bbdf9c80db9e0193d2b58956 + +commit 09ba47b44d26b475bbdf9c80db9e0193d2b58956 upstream. + +We can't call smb_init() in CIFSGetDFSRefer() as cifs_reconnect_tcon() +may end up calling CIFSGetDFSRefer() again to get new DFS referrals +and thus causing an infinite recursion. + +Signed-off-by: Paulo Alcantara (SUSE) +Reviewed-by: Ronnie Sahlberg +Cc: stable@vger.kernel.org # 6.2 +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cifs/cifssmb.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c +index 5ca4a538..f71f8533 100644 +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -4377,8 +4377,13 @@ CIFSGetDFSRefer(const unsigned int xid, struct cifs_ses *ses, + return -ENODEV; + + getDFSRetry: +- rc = smb_init(SMB_COM_TRANSACTION2, 15, ses->tcon_ipc, (void **) &pSMB, +- (void **) &pSMBr); ++ /* ++ * Use smb_init_no_reconnect() instead of smb_init() as ++ * CIFSGetDFSRefer() may be called from cifs_reconnect_tcon() and thus ++ * causing an infinite recursion. ++ */ ++ rc = smb_init_no_reconnect(SMB_COM_TRANSACTION2, 15, ses->tcon_ipc, ++ (void **)&pSMB, (void **)&pSMBr); + if (rc) + return rc; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-130-cifs-fix-DFS-traversal-oops-without-CONFIG_CIF.patch b/patches.kernel.org/6.2.10-130-cifs-fix-DFS-traversal-oops-without-CONFIG_CIF.patch new file mode 100644 index 0000000..103fc0a --- /dev/null +++ b/patches.kernel.org/6.2.10-130-cifs-fix-DFS-traversal-oops-without-CONFIG_CIF.patch @@ -0,0 +1,68 @@ +From: David Disseldorp +Date: Wed, 29 Mar 2023 22:24:06 +0200 +Subject: [PATCH] cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 179a88a8558bbf42991d361595281f3e45d7edfc + +commit 179a88a8558bbf42991d361595281f3e45d7edfc upstream. + +When compiled with CONFIG_CIFS_DFS_UPCALL disabled, cifs_dfs_d_automount +is NULL. cifs.ko logic for mapping CIFS_FATTR_DFS_REFERRAL attributes to +S_AUTOMOUNT and corresponding dentry flags is retained regardless of +CONFIG_CIFS_DFS_UPCALL, leading to a NULL pointer dereference in +VFS follow_automount() when traversing a DFS referral link: + BUG: kernel NULL pointer dereference, address: 0000000000000000 + ... + Call Trace: + + __traverse_mounts+0xb5/0x220 + ? cifs_revalidate_mapping+0x65/0xc0 [cifs] + step_into+0x195/0x610 + ? lookup_fast+0xe2/0xf0 + path_lookupat+0x64/0x140 + filename_lookup+0xc2/0x140 + ? __create_object+0x299/0x380 + ? kmem_cache_alloc+0x119/0x220 + ? user_path_at_empty+0x31/0x50 + user_path_at_empty+0x31/0x50 + __x64_sys_chdir+0x2a/0xd0 + ? exit_to_user_mode_prepare+0xca/0x100 + do_syscall_64+0x42/0x90 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + +This fix adds an inline cifs_dfs_d_automount() {return -EREMOTE} handler +when CONFIG_CIFS_DFS_UPCALL is disabled. An alternative would be to +avoid flagging S_AUTOMOUNT, etc. without CONFIG_CIFS_DFS_UPCALL. This +approach was chosen as it provides more control over the error path. + +Signed-off-by: David Disseldorp +Cc: stable@vger.kernel.org +Reviewed-by: Paulo Alcantara (SUSE) +Reviewed-by: Ronnie Sahlberg +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cifs/cifsfs.h | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h +index 63a0ac2b..16a703c6 100644 +--- a/fs/cifs/cifsfs.h ++++ b/fs/cifs/cifsfs.h +@@ -118,7 +118,10 @@ extern const struct dentry_operations cifs_ci_dentry_ops; + #ifdef CONFIG_CIFS_DFS_UPCALL + extern struct vfsmount *cifs_dfs_d_automount(struct path *path); + #else +-#define cifs_dfs_d_automount NULL ++static inline struct vfsmount *cifs_dfs_d_automount(struct path *path) ++{ ++ return ERR_PTR(-EREMOTE); ++} + #endif + + /* Functions related to symlinks */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-131-Input-i8042-add-quirk-for-Fujitsu-Lifebook-A57.patch b/patches.kernel.org/6.2.10-131-Input-i8042-add-quirk-for-Fujitsu-Lifebook-A57.patch new file mode 100644 index 0000000..c7459e8 --- /dev/null +++ b/patches.kernel.org/6.2.10-131-Input-i8042-add-quirk-for-Fujitsu-Lifebook-A57.patch @@ -0,0 +1,44 @@ +From: Jonathan Denose +Date: Fri, 17 Mar 2023 03:19:51 -0700 +Subject: [PATCH] Input: i8042 - add quirk for Fujitsu Lifebook A574/H +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: f5bad62f9107b701a6def7cac1f5f65862219b83 + +commit f5bad62f9107b701a6def7cac1f5f65862219b83 upstream. + +Fujitsu Lifebook A574/H requires the nomux option to properly +probe the touchpad, especially when waking from sleep. + +Signed-off-by: Jonathan Denose +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20230303152623.45859-1-jdenose@google.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/input/serio/i8042-acpipnpio.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/input/serio/i8042-acpipnpio.h b/drivers/input/serio/i8042-acpipnpio.h +index 371406f8..028e45bd 100644 +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -610,6 +610,14 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX) + }, ++ { ++ /* Fujitsu Lifebook A574/H */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "FMVA0501PZ"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_NOMUX) ++ }, + { + /* Gigabyte M912 */ + .matches = { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-132-Input-goodix-add-Lenovo-Yoga-Book-X90F-to-nine.patch b/patches.kernel.org/6.2.10-132-Input-goodix-add-Lenovo-Yoga-Book-X90F-to-nine.patch new file mode 100644 index 0000000..1642b92 --- /dev/null +++ b/patches.kernel.org/6.2.10-132-Input-goodix-add-Lenovo-Yoga-Book-X90F-to-nine.patch @@ -0,0 +1,60 @@ +From: Hans de Goede +Date: Fri, 17 Mar 2023 03:13:12 -0700 +Subject: [PATCH] Input: goodix - add Lenovo Yoga Book X90F to + nine_bytes_report DMI table +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 8a0432bab6ea3203d220785da7ab3c7677f70ecb + +commit 8a0432bab6ea3203d220785da7ab3c7677f70ecb upstream. + +The Android Lenovo Yoga Book X90F / X90L uses the same goodix touchscreen +with 9 bytes touch reports for its touch keyboard as the already supported +Windows Lenovo Yoga Book X91F/L, add a DMI match for this to +the nine_bytes_report DMI table. + +When the quirk for the X91F/L was initially added it was written to +also apply to the X90F/L but this does not work because the Android +version of the Yoga Book uses completely different DMI strings. +Also adjust the X91F/L quirk to reflect that it only applies to +the X91F/L models. + +Signed-off-by: Hans de Goede +Reviewed-by: Bastien Nocera +Link: https://lore.kernel.org/r/20230315134442.71787-1-hdegoede@redhat.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/input/touchscreen/goodix.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c +index 8a0a8078..2e502fcb 100644 +--- a/drivers/input/touchscreen/goodix.c ++++ b/drivers/input/touchscreen/goodix.c +@@ -124,10 +124,18 @@ static const unsigned long goodix_irq_flags[] = { + static const struct dmi_system_id nine_bytes_report[] = { + #if defined(CONFIG_DMI) && defined(CONFIG_X86) + { +- .ident = "Lenovo YogaBook", +- /* YB1-X91L/F and YB1-X90L/F */ ++ /* Lenovo Yoga Book X90F / X90L */ + .matches = { +- DMI_MATCH(DMI_PRODUCT_NAME, "Lenovo YB1-X9") ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "YETI-11"), ++ } ++ }, ++ { ++ /* Lenovo Yoga Book X91F / X91L */ ++ .matches = { ++ /* Non exact match to match F + L versions */ ++ DMI_MATCH(DMI_PRODUCT_NAME, "Lenovo YB1-X91"), + } + }, + #endif +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-133-btrfs-fix-deadlock-when-aborting-transaction-d.patch b/patches.kernel.org/6.2.10-133-btrfs-fix-deadlock-when-aborting-transaction-d.patch new file mode 100644 index 0000000..978e2a8 --- /dev/null +++ b/patches.kernel.org/6.2.10-133-btrfs-fix-deadlock-when-aborting-transaction-d.patch @@ -0,0 +1,414 @@ +From: Filipe Manana +Date: Wed, 22 Mar 2023 09:46:34 +0000 +Subject: [PATCH] btrfs: fix deadlock when aborting transaction during + relocation with scrub +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 2d82a40aa7d6fcae0250ec68b8566cdee7bfd44c + +commit 2d82a40aa7d6fcae0250ec68b8566cdee7bfd44c upstream. + +Before relocating a block group we pause scrub, then do the relocation and +then unpause scrub. The relocation process requires starting and committing +a transaction, and if we have a failure in the critical section of the +transaction commit path (transaction state >= TRANS_STATE_COMMIT_START), +we will deadlock if there is a paused scrub. + +That results in stack traces like the following: + + [42.479] BTRFS info (device sdc): relocating block group 53876686848 flags metadata|raid6 + [42.936] BTRFS warning (device sdc): Skipping commit of aborted transaction. + [42.936] ------------[ cut here ]------------ + [42.936] BTRFS: Transaction aborted (error -28) + [42.936] WARNING: CPU: 11 PID: 346822 at fs/btrfs/transaction.c:1977 btrfs_commit_transaction+0xcc8/0xeb0 [btrfs] + [42.936] Modules linked in: dm_flakey dm_mod loop btrfs (...) + [42.936] CPU: 11 PID: 346822 Comm: btrfs Tainted: G W 6.3.0-rc2-btrfs-next-127+ #1 + [42.936] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 + [42.936] RIP: 0010:btrfs_commit_transaction+0xcc8/0xeb0 [btrfs] + [42.936] Code: ff ff 45 8b (...) + [42.936] RSP: 0018:ffffb58649633b48 EFLAGS: 00010282 + [42.936] RAX: 0000000000000000 RBX: ffff8be6ef4d5bd8 RCX: 0000000000000000 + [42.936] RDX: 0000000000000002 RSI: ffffffffb35e7782 RDI: 00000000ffffffff + [42.936] RBP: ffff8be6ef4d5c98 R08: 0000000000000000 R09: ffffb586496339e8 + [42.936] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8be6d38c7c00 + [42.936] R13: 00000000ffffffe4 R14: ffff8be6c268c000 R15: ffff8be6ef4d5cf0 + [42.936] FS: 00007f381a82b340(0000) GS:ffff8beddfcc0000(0000) knlGS:0000000000000000 + [42.936] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + [42.936] CR2: 00007f1e35fb7638 CR3: 0000000117680006 CR4: 0000000000370ee0 + [42.936] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + [42.936] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + [42.936] Call Trace: + [42.936] + [42.936] ? start_transaction+0xcb/0x610 [btrfs] + [42.936] prepare_to_relocate+0x111/0x1a0 [btrfs] + [42.936] relocate_block_group+0x57/0x5d0 [btrfs] + [42.936] ? btrfs_wait_nocow_writers+0x25/0xb0 [btrfs] + [42.936] btrfs_relocate_block_group+0x248/0x3c0 [btrfs] + [42.936] ? __pfx_autoremove_wake_function+0x10/0x10 + [42.936] btrfs_relocate_chunk+0x3b/0x150 [btrfs] + [42.936] btrfs_balance+0x8ff/0x11d0 [btrfs] + [42.936] ? __kmem_cache_alloc_node+0x14a/0x410 + [42.936] btrfs_ioctl+0x2334/0x32c0 [btrfs] + [42.937] ? mod_objcg_state+0xd2/0x360 + [42.937] ? refill_obj_stock+0xb0/0x160 + [42.937] ? seq_release+0x25/0x30 + [42.937] ? __rseq_handle_notify_resume+0x3b5/0x4b0 + [42.937] ? percpu_counter_add_batch+0x2e/0xa0 + [42.937] ? __x64_sys_ioctl+0x88/0xc0 + [42.937] __x64_sys_ioctl+0x88/0xc0 + [42.937] do_syscall_64+0x38/0x90 + [42.937] entry_SYSCALL_64_after_hwframe+0x72/0xdc + [42.937] RIP: 0033:0x7f381a6ffe9b + [42.937] Code: 00 48 89 44 24 (...) + [42.937] RSP: 002b:00007ffd45ecf060 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 + [42.937] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f381a6ffe9b + [42.937] RDX: 00007ffd45ecf150 RSI: 00000000c4009420 RDI: 0000000000000003 + [42.937] RBP: 0000000000000003 R08: 0000000000000013 R09: 0000000000000000 + [42.937] R10: 00007f381a60c878 R11: 0000000000000246 R12: 00007ffd45ed0423 + [42.937] R13: 00007ffd45ecf150 R14: 0000000000000000 R15: 00007ffd45ecf148 + [42.937] + [42.937] ---[ end trace 0000000000000000 ]--- + [42.937] BTRFS: error (device sdc: state A) in cleanup_transaction:1977: errno=-28 No space left + [59.196] INFO: task btrfs:346772 blocked for more than 120 seconds. + [59.196] Tainted: G W 6.3.0-rc2-btrfs-next-127+ #1 + [59.196] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. + [59.196] task:btrfs state:D stack:0 pid:346772 ppid:1 flags:0x00004002 + [59.196] Call Trace: + [59.196] + [59.196] __schedule+0x392/0xa70 + [59.196] ? __pv_queued_spin_lock_slowpath+0x165/0x370 + [59.196] schedule+0x5d/0xd0 + [59.196] __scrub_blocked_if_needed+0x74/0xc0 [btrfs] + [59.197] ? __pfx_autoremove_wake_function+0x10/0x10 + [59.197] scrub_pause_off+0x21/0x50 [btrfs] + [59.197] scrub_simple_mirror+0x1c7/0x950 [btrfs] + [59.197] ? scrub_parity_put+0x1a5/0x1d0 [btrfs] + [59.198] ? __pfx_autoremove_wake_function+0x10/0x10 + [59.198] scrub_stripe+0x20d/0x740 [btrfs] + [59.198] scrub_chunk+0xc4/0x130 [btrfs] + [59.198] scrub_enumerate_chunks+0x3e4/0x7a0 [btrfs] + [59.198] ? __pfx_autoremove_wake_function+0x10/0x10 + [59.198] btrfs_scrub_dev+0x236/0x6a0 [btrfs] + [59.199] ? btrfs_ioctl+0xd97/0x32c0 [btrfs] + [59.199] ? _copy_from_user+0x7b/0x80 + [59.199] btrfs_ioctl+0xde1/0x32c0 [btrfs] + [59.199] ? refill_stock+0x33/0x50 + [59.199] ? should_failslab+0xa/0x20 + [59.199] ? kmem_cache_alloc_node+0x151/0x460 + [59.199] ? alloc_io_context+0x1b/0x80 + [59.199] ? preempt_count_add+0x70/0xa0 + [59.199] ? __x64_sys_ioctl+0x88/0xc0 + [59.199] __x64_sys_ioctl+0x88/0xc0 + [59.199] do_syscall_64+0x38/0x90 + [59.199] entry_SYSCALL_64_after_hwframe+0x72/0xdc + [59.199] RIP: 0033:0x7f82ffaffe9b + [59.199] RSP: 002b:00007f82ff9fcc50 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 + [59.199] RAX: ffffffffffffffda RBX: 000055b191e36310 RCX: 00007f82ffaffe9b + [59.199] RDX: 000055b191e36310 RSI: 00000000c400941b RDI: 0000000000000003 + [59.199] RBP: 0000000000000000 R08: 00007fff1575016f R09: 0000000000000000 + [59.199] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f82ff9fd640 + [59.199] R13: 000000000000006b R14: 00007f82ffa87580 R15: 0000000000000000 + [59.199] + [59.199] INFO: task btrfs:346773 blocked for more than 120 seconds. + [59.200] Tainted: G W 6.3.0-rc2-btrfs-next-127+ #1 + [59.200] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. + [59.201] task:btrfs state:D stack:0 pid:346773 ppid:1 flags:0x00004002 + [59.201] Call Trace: + [59.201] + [59.201] __schedule+0x392/0xa70 + [59.201] ? __pv_queued_spin_lock_slowpath+0x165/0x370 + [59.201] schedule+0x5d/0xd0 + [59.201] __scrub_blocked_if_needed+0x74/0xc0 [btrfs] + [59.201] ? __pfx_autoremove_wake_function+0x10/0x10 + [59.201] scrub_pause_off+0x21/0x50 [btrfs] + [59.202] scrub_simple_mirror+0x1c7/0x950 [btrfs] + [59.202] ? scrub_parity_put+0x1a5/0x1d0 [btrfs] + [59.202] ? __pfx_autoremove_wake_function+0x10/0x10 + [59.202] scrub_stripe+0x20d/0x740 [btrfs] + [59.202] scrub_chunk+0xc4/0x130 [btrfs] + [59.203] scrub_enumerate_chunks+0x3e4/0x7a0 [btrfs] + [59.203] ? __pfx_autoremove_wake_function+0x10/0x10 + [59.203] btrfs_scrub_dev+0x236/0x6a0 [btrfs] + [59.203] ? btrfs_ioctl+0xd97/0x32c0 [btrfs] + [59.203] ? _copy_from_user+0x7b/0x80 + [59.203] btrfs_ioctl+0xde1/0x32c0 [btrfs] + [59.204] ? should_failslab+0xa/0x20 + [59.204] ? kmem_cache_alloc_node+0x151/0x460 + [59.204] ? alloc_io_context+0x1b/0x80 + [59.204] ? preempt_count_add+0x70/0xa0 + [59.204] ? __x64_sys_ioctl+0x88/0xc0 + [59.204] __x64_sys_ioctl+0x88/0xc0 + [59.204] do_syscall_64+0x38/0x90 + [59.204] entry_SYSCALL_64_after_hwframe+0x72/0xdc + [59.204] RIP: 0033:0x7f82ffaffe9b + [59.204] RSP: 002b:00007f82ff1fbc50 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 + [59.204] RAX: ffffffffffffffda RBX: 000055b191e36790 RCX: 00007f82ffaffe9b + [59.204] RDX: 000055b191e36790 RSI: 00000000c400941b RDI: 0000000000000003 + [59.204] RBP: 0000000000000000 R08: 00007fff1575016f R09: 0000000000000000 + [59.204] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f82ff1fc640 + [59.204] R13: 000000000000006b R14: 00007f82ffa87580 R15: 0000000000000000 + [59.204] + [59.204] INFO: task btrfs:346774 blocked for more than 120 seconds. + [59.205] Tainted: G W 6.3.0-rc2-btrfs-next-127+ #1 + [59.205] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. + [59.206] task:btrfs state:D stack:0 pid:346774 ppid:1 flags:0x00004002 + [59.206] Call Trace: + [59.206] + [59.206] __schedule+0x392/0xa70 + [59.206] schedule+0x5d/0xd0 + [59.206] __scrub_blocked_if_needed+0x74/0xc0 [btrfs] + [59.206] ? __pfx_autoremove_wake_function+0x10/0x10 + [59.206] scrub_pause_off+0x21/0x50 [btrfs] + [59.207] scrub_simple_mirror+0x1c7/0x950 [btrfs] + [59.207] ? scrub_parity_put+0x1a5/0x1d0 [btrfs] + [59.207] ? __pfx_autoremove_wake_function+0x10/0x10 + [59.207] scrub_stripe+0x20d/0x740 [btrfs] + [59.208] scrub_chunk+0xc4/0x130 [btrfs] + [59.208] scrub_enumerate_chunks+0x3e4/0x7a0 [btrfs] + [59.208] ? __mutex_unlock_slowpath.isra.0+0x9a/0x120 + [59.208] btrfs_scrub_dev+0x236/0x6a0 [btrfs] + [59.208] ? btrfs_ioctl+0xd97/0x32c0 [btrfs] + [59.209] ? _copy_from_user+0x7b/0x80 + [59.209] btrfs_ioctl+0xde1/0x32c0 [btrfs] + [59.209] ? should_failslab+0xa/0x20 + [59.209] ? kmem_cache_alloc_node+0x151/0x460 + [59.209] ? alloc_io_context+0x1b/0x80 + [59.209] ? preempt_count_add+0x70/0xa0 + [59.209] ? __x64_sys_ioctl+0x88/0xc0 + [59.209] __x64_sys_ioctl+0x88/0xc0 + [59.209] do_syscall_64+0x38/0x90 + [59.209] entry_SYSCALL_64_after_hwframe+0x72/0xdc + [59.209] RIP: 0033:0x7f82ffaffe9b + [59.209] RSP: 002b:00007f82fe9fac50 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 + [59.209] RAX: ffffffffffffffda RBX: 000055b191e36c10 RCX: 00007f82ffaffe9b + [59.209] RDX: 000055b191e36c10 RSI: 00000000c400941b RDI: 0000000000000003 + [59.209] RBP: 0000000000000000 R08: 00007fff1575016f R09: 0000000000000000 + [59.209] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f82fe9fb640 + [59.209] R13: 000000000000006b R14: 00007f82ffa87580 R15: 0000000000000000 + [59.209] + [59.209] INFO: task btrfs:346775 blocked for more than 120 seconds. + [59.210] Tainted: G W 6.3.0-rc2-btrfs-next-127+ #1 + [59.210] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. + [59.211] task:btrfs state:D stack:0 pid:346775 ppid:1 flags:0x00004002 + [59.211] Call Trace: + [59.211] + [59.211] __schedule+0x392/0xa70 + [59.211] schedule+0x5d/0xd0 + [59.211] __scrub_blocked_if_needed+0x74/0xc0 [btrfs] + [59.211] ? __pfx_autoremove_wake_function+0x10/0x10 + [59.211] scrub_pause_off+0x21/0x50 [btrfs] + [59.212] scrub_simple_mirror+0x1c7/0x950 [btrfs] + [59.212] ? scrub_parity_put+0x1a5/0x1d0 [btrfs] + [59.212] ? __pfx_autoremove_wake_function+0x10/0x10 + [59.212] scrub_stripe+0x20d/0x740 [btrfs] + [59.213] scrub_chunk+0xc4/0x130 [btrfs] + [59.213] scrub_enumerate_chunks+0x3e4/0x7a0 [btrfs] + [59.213] ? __mutex_unlock_slowpath.isra.0+0x9a/0x120 + [59.213] btrfs_scrub_dev+0x236/0x6a0 [btrfs] + [59.213] ? btrfs_ioctl+0xd97/0x32c0 [btrfs] + [59.214] ? _copy_from_user+0x7b/0x80 + [59.214] btrfs_ioctl+0xde1/0x32c0 [btrfs] + [59.214] ? should_failslab+0xa/0x20 + [59.214] ? kmem_cache_alloc_node+0x151/0x460 + [59.214] ? alloc_io_context+0x1b/0x80 + [59.214] ? preempt_count_add+0x70/0xa0 + [59.214] ? __x64_sys_ioctl+0x88/0xc0 + [59.214] __x64_sys_ioctl+0x88/0xc0 + [59.214] do_syscall_64+0x38/0x90 + [59.214] entry_SYSCALL_64_after_hwframe+0x72/0xdc + [59.214] RIP: 0033:0x7f82ffaffe9b + [59.214] RSP: 002b:00007f82fe1f9c50 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 + [59.214] RAX: ffffffffffffffda RBX: 000055b191e37090 RCX: 00007f82ffaffe9b + [59.214] RDX: 000055b191e37090 RSI: 00000000c400941b RDI: 0000000000000003 + [59.214] RBP: 0000000000000000 R08: 00007fff1575016f R09: 0000000000000000 + [59.214] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f82fe1fa640 + [59.214] R13: 000000000000006b R14: 00007f82ffa87580 R15: 0000000000000000 + [59.214] + [59.214] INFO: task btrfs:346776 blocked for more than 120 seconds. + [59.215] Tainted: G W 6.3.0-rc2-btrfs-next-127+ #1 + [59.216] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. + [59.217] task:btrfs state:D stack:0 pid:346776 ppid:1 flags:0x00004002 + [59.217] Call Trace: + [59.217] + [59.217] __schedule+0x392/0xa70 + [59.217] ? __pv_queued_spin_lock_slowpath+0x165/0x370 + [59.217] schedule+0x5d/0xd0 + [59.217] __scrub_blocked_if_needed+0x74/0xc0 [btrfs] + [59.217] ? __pfx_autoremove_wake_function+0x10/0x10 + [59.217] scrub_pause_off+0x21/0x50 [btrfs] + [59.217] scrub_simple_mirror+0x1c7/0x950 [btrfs] + [59.217] ? scrub_parity_put+0x1a5/0x1d0 [btrfs] + [59.218] ? __pfx_autoremove_wake_function+0x10/0x10 + [59.218] scrub_stripe+0x20d/0x740 [btrfs] + [59.218] scrub_chunk+0xc4/0x130 [btrfs] + [59.218] scrub_enumerate_chunks+0x3e4/0x7a0 [btrfs] + [59.219] ? __pfx_autoremove_wake_function+0x10/0x10 + [59.219] btrfs_scrub_dev+0x236/0x6a0 [btrfs] + [59.219] ? btrfs_ioctl+0xd97/0x32c0 [btrfs] + [59.219] ? _copy_from_user+0x7b/0x80 + [59.219] btrfs_ioctl+0xde1/0x32c0 [btrfs] + [59.219] ? should_failslab+0xa/0x20 + [59.219] ? kmem_cache_alloc_node+0x151/0x460 + [59.219] ? alloc_io_context+0x1b/0x80 + [59.219] ? preempt_count_add+0x70/0xa0 + [59.219] ? __x64_sys_ioctl+0x88/0xc0 + [59.219] __x64_sys_ioctl+0x88/0xc0 + [59.219] do_syscall_64+0x38/0x90 + [59.219] entry_SYSCALL_64_after_hwframe+0x72/0xdc + [59.219] RIP: 0033:0x7f82ffaffe9b + [59.219] RSP: 002b:00007f82fd9f8c50 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 + [59.219] RAX: ffffffffffffffda RBX: 000055b191e37510 RCX: 00007f82ffaffe9b + [59.219] RDX: 000055b191e37510 RSI: 00000000c400941b RDI: 0000000000000003 + [59.219] RBP: 0000000000000000 R08: 00007fff1575016f R09: 0000000000000000 + [59.219] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f82fd9f9640 + [59.219] R13: 000000000000006b R14: 00007f82ffa87580 R15: 0000000000000000 + [59.219] + [59.219] INFO: task btrfs:346822 blocked for more than 120 seconds. + [59.220] Tainted: G W 6.3.0-rc2-btrfs-next-127+ #1 + [59.221] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. + [59.222] task:btrfs state:D stack:0 pid:346822 ppid:1 flags:0x00004002 + [59.222] Call Trace: + [59.222] + [59.222] __schedule+0x392/0xa70 + [59.222] schedule+0x5d/0xd0 + [59.222] btrfs_scrub_cancel+0x91/0x100 [btrfs] + [59.222] ? __pfx_autoremove_wake_function+0x10/0x10 + [59.222] btrfs_commit_transaction+0x572/0xeb0 [btrfs] + [59.223] ? start_transaction+0xcb/0x610 [btrfs] + [59.223] prepare_to_relocate+0x111/0x1a0 [btrfs] + [59.223] relocate_block_group+0x57/0x5d0 [btrfs] + [59.223] ? btrfs_wait_nocow_writers+0x25/0xb0 [btrfs] + [59.223] btrfs_relocate_block_group+0x248/0x3c0 [btrfs] + [59.224] ? __pfx_autoremove_wake_function+0x10/0x10 + [59.224] btrfs_relocate_chunk+0x3b/0x150 [btrfs] + [59.224] btrfs_balance+0x8ff/0x11d0 [btrfs] + [59.224] ? __kmem_cache_alloc_node+0x14a/0x410 + [59.224] btrfs_ioctl+0x2334/0x32c0 [btrfs] + [59.225] ? mod_objcg_state+0xd2/0x360 + [59.225] ? refill_obj_stock+0xb0/0x160 + [59.225] ? seq_release+0x25/0x30 + [59.225] ? __rseq_handle_notify_resume+0x3b5/0x4b0 + [59.225] ? percpu_counter_add_batch+0x2e/0xa0 + [59.225] ? __x64_sys_ioctl+0x88/0xc0 + [59.225] __x64_sys_ioctl+0x88/0xc0 + [59.225] do_syscall_64+0x38/0x90 + [59.225] entry_SYSCALL_64_after_hwframe+0x72/0xdc + [59.225] RIP: 0033:0x7f381a6ffe9b + [59.225] RSP: 002b:00007ffd45ecf060 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 + [59.225] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f381a6ffe9b + [59.225] RDX: 00007ffd45ecf150 RSI: 00000000c4009420 RDI: 0000000000000003 + [59.225] RBP: 0000000000000003 R08: 0000000000000013 R09: 0000000000000000 + [59.225] R10: 00007f381a60c878 R11: 0000000000000246 R12: 00007ffd45ed0423 + [59.225] R13: 00007ffd45ecf150 R14: 0000000000000000 R15: 00007ffd45ecf148 + [59.225] + +What happens is the following: + +1) A scrub is running, so fs_info->scrubs_running is 1; + +2) Task A starts block group relocation, and at btrfs_relocate_chunk() it + pauses scrub by calling btrfs_scrub_pause(). That increments + fs_info->scrub_pause_req from 0 to 1 and waits for the scrub task to + pause (for fs_info->scrubs_paused to be == to fs_info->scrubs_running); + +3) The scrub task pauses at scrub_pause_off(), waiting for + fs_info->scrub_pause_req to decrease to 0; + +4) Task A then enters btrfs_relocate_block_group(), and down that call + chain we start a transaction and then attempt to commit it; + +5) When task A calls btrfs_commit_transaction(), it either will do the + commit itself or wait for some other task that already started the + commit of the transaction - it doesn't matter which case; + +6) The transaction commit enters state TRANS_STATE_COMMIT_START; + +7) An error happens during the transaction commit, like -ENOSPC when + running delayed refs or delayed items for example; + +8) This results in calling transaction.c:cleanup_transaction(), where + we call btrfs_scrub_cancel(), incrementing fs_info->scrub_cancel_req + from 0 to 1, and blocking this task waiting for fs_info->scrubs_running + to decrease to 0; + +9) From this point on, both the transaction commit and the scrub task + hang forever: + + 1) The transaction commit is waiting for fs_info->scrubs_running to + be decreased to 0; + + 2) The scrub task is at scrub_pause_off() waiting for + fs_info->scrub_pause_req to decrease to 0 - so it can not proceed + to stop the scrub and decrement fs_info->scrubs_running from 0 to 1. + + Therefore resulting in a deadlock. + +Fix this by having cleanup_transaction(), called if a transaction commit +fails, not call btrfs_scrub_cancel() if relocation is in progress, and +having btrfs_relocate_block_group() call btrfs_scrub_cancel() instead if +the relocation failed and a transaction abort happened. + +This was triggered with btrfs/061 from fstests. + +Fixes: 55e3a601c81c ("btrfs: Fix data checksum error cause by replace with io-load.") +CC: stable@vger.kernel.org # 4.14+ +Reviewed-by: Josef Bacik +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/btrfs/transaction.c | 15 ++++++++++++++- + fs/btrfs/volumes.c | 9 ++++++++- + 2 files changed, 22 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c +index 8f8d0fce..9094e240 100644 +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -2035,7 +2035,20 @@ static void cleanup_transaction(struct btrfs_trans_handle *trans, int err) + + if (current->journal_info == trans) + current->journal_info = NULL; +- btrfs_scrub_cancel(fs_info); ++ ++ /* ++ * If relocation is running, we can't cancel scrub because that will ++ * result in a deadlock. Before relocating a block group, relocation ++ * pauses scrub, then starts and commits a transaction before unpausing ++ * scrub. If the transaction commit is being done by the relocation ++ * task or triggered by another task and the relocation task is waiting ++ * for the commit, and we end up here due to an error in the commit ++ * path, then calling btrfs_scrub_cancel() will deadlock, as we are ++ * asking for scrub to stop while having it asked to be paused higher ++ * above in relocation code. ++ */ ++ if (!test_bit(BTRFS_FS_RELOC_RUNNING, &fs_info->flags)) ++ btrfs_scrub_cancel(fs_info); + + kmem_cache_free(btrfs_trans_handle_cachep, trans); + } +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index df43093b..992b1dea 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -3266,8 +3266,15 @@ int btrfs_relocate_chunk(struct btrfs_fs_info *fs_info, u64 chunk_offset) + btrfs_scrub_pause(fs_info); + ret = btrfs_relocate_block_group(fs_info, chunk_offset); + btrfs_scrub_continue(fs_info); +- if (ret) ++ if (ret) { ++ /* ++ * If we had a transaction abort, stop all running scrubs. ++ * See transaction.c:cleanup_transaction() why we do it here. ++ */ ++ if (BTRFS_FS_ERROR(fs_info)) ++ btrfs_scrub_cancel(fs_info); + return ret; ++ } + + block_group = btrfs_lookup_block_group(fs_info, chunk_offset); + if (!block_group) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-134-btrfs-fix-race-between-quota-disable-and-quota.patch b/patches.kernel.org/6.2.10-134-btrfs-fix-race-between-quota-disable-and-quota.patch new file mode 100644 index 0000000..efe8d5b --- /dev/null +++ b/patches.kernel.org/6.2.10-134-btrfs-fix-race-between-quota-disable-and-quota.patch @@ -0,0 +1,201 @@ +From: Filipe Manana +Date: Wed, 22 Mar 2023 10:33:28 +0000 +Subject: [PATCH] btrfs: fix race between quota disable and quota assign ioctls +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 2f1a6be12ab6c8470d5776e68644726c94257c54 + +commit 2f1a6be12ab6c8470d5776e68644726c94257c54 upstream. + +The quota assign ioctl can currently run in parallel with a quota disable +ioctl call. The assign ioctl uses the quota root, while the disable ioctl +frees that root, and therefore we can have a use-after-free triggered in +the assign ioctl, leading to a trace like the following when KASAN is +enabled: + + [672.723][T736] BUG: KASAN: slab-use-after-free in btrfs_search_slot+0x2962/0x2db0 + [672.723][T736] Read of size 8 at addr ffff888022ec0208 by task btrfs_search_sl/27736 + [672.724][T736] + [672.725][T736] CPU: 1 PID: 27736 Comm: btrfs_search_sl Not tainted 6.3.0-rc3 #37 + [672.723][T736] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 + [672.727][T736] Call Trace: + [672.728][T736] + [672.728][T736] dump_stack_lvl+0xd9/0x150 + [672.725][T736] print_report+0xc1/0x5e0 + [672.720][T736] ? __virt_addr_valid+0x61/0x2e0 + [672.727][T736] ? __phys_addr+0xc9/0x150 + [672.725][T736] ? btrfs_search_slot+0x2962/0x2db0 + [672.722][T736] kasan_report+0xc0/0xf0 + [672.729][T736] ? btrfs_search_slot+0x2962/0x2db0 + [672.724][T736] btrfs_search_slot+0x2962/0x2db0 + [672.723][T736] ? fs_reclaim_acquire+0xba/0x160 + [672.722][T736] ? split_leaf+0x13d0/0x13d0 + [672.726][T736] ? rcu_is_watching+0x12/0xb0 + [672.723][T736] ? kmem_cache_alloc+0x338/0x3c0 + [672.722][T736] update_qgroup_status_item+0xf7/0x320 + [672.724][T736] ? add_qgroup_rb+0x3d0/0x3d0 + [672.739][T736] ? do_raw_spin_lock+0x12d/0x2b0 + [672.730][T736] ? spin_bug+0x1d0/0x1d0 + [672.737][T736] btrfs_run_qgroups+0x5de/0x840 + [672.730][T736] ? btrfs_qgroup_rescan_worker+0xa70/0xa70 + [672.738][T736] ? __del_qgroup_relation+0x4ba/0xe00 + [672.738][T736] btrfs_ioctl+0x3d58/0x5d80 + [672.735][T736] ? tomoyo_path_number_perm+0x16a/0x550 + [672.737][T736] ? tomoyo_execute_permission+0x4a0/0x4a0 + [672.731][T736] ? btrfs_ioctl_get_supported_features+0x50/0x50 + [672.737][T736] ? __sanitizer_cov_trace_switch+0x54/0x90 + [672.734][T736] ? do_vfs_ioctl+0x132/0x1660 + [672.730][T736] ? vfs_fileattr_set+0xc40/0xc40 + [672.730][T736] ? _raw_spin_unlock_irq+0x2e/0x50 + [672.732][T736] ? sigprocmask+0xf2/0x340 + [672.737][T736] ? __fget_files+0x26a/0x480 + [672.732][T736] ? bpf_lsm_file_ioctl+0x9/0x10 + [672.738][T736] ? btrfs_ioctl_get_supported_features+0x50/0x50 + [672.736][T736] __x64_sys_ioctl+0x198/0x210 + [672.736][T736] do_syscall_64+0x39/0xb0 + [672.731][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd + [672.739][T736] RIP: 0033:0x4556ad + [672.742][T736] + [672.743][T736] + [672.748][T736] Allocated by task 27677: + [672.743][T736] kasan_save_stack+0x22/0x40 + [672.741][T736] kasan_set_track+0x25/0x30 + [672.741][T736] __kasan_kmalloc+0xa4/0xb0 + [672.749][T736] btrfs_alloc_root+0x48/0x90 + [672.746][T736] btrfs_create_tree+0x146/0xa20 + [672.744][T736] btrfs_quota_enable+0x461/0x1d20 + [672.743][T736] btrfs_ioctl+0x4a1c/0x5d80 + [672.747][T736] __x64_sys_ioctl+0x198/0x210 + [672.749][T736] do_syscall_64+0x39/0xb0 + [672.744][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd + [672.756][T736] + [672.757][T736] Freed by task 27677: + [672.759][T736] kasan_save_stack+0x22/0x40 + [672.759][T736] kasan_set_track+0x25/0x30 + [672.756][T736] kasan_save_free_info+0x2e/0x50 + [672.751][T736] ____kasan_slab_free+0x162/0x1c0 + [672.758][T736] slab_free_freelist_hook+0x89/0x1c0 + [672.752][T736] __kmem_cache_free+0xaf/0x2e0 + [672.752][T736] btrfs_put_root+0x1ff/0x2b0 + [672.759][T736] btrfs_quota_disable+0x80a/0xbc0 + [672.752][T736] btrfs_ioctl+0x3e5f/0x5d80 + [672.756][T736] __x64_sys_ioctl+0x198/0x210 + [672.753][T736] do_syscall_64+0x39/0xb0 + [672.765][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd + [672.769][T736] + [672.768][T736] The buggy address belongs to the object at ffff888022ec0000 + [672.768][T736] which belongs to the cache kmalloc-4k of size 4096 + [672.769][T736] The buggy address is located 520 bytes inside of + [672.769][T736] freed 4096-byte region [ffff888022ec0000, ffff888022ec1000) + [672.760][T736] + [672.764][T736] The buggy address belongs to the physical page: + [672.761][T736] page:ffffea00008bb000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x22ec0 + [672.766][T736] head:ffffea00008bb000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 + [672.779][T736] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) + [672.770][T736] raw: 00fff00000010200 ffff888012842140 ffffea000054ba00 dead000000000002 + [672.770][T736] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 + [672.771][T736] page dumped because: kasan: bad access detected + [672.778][T736] page_owner tracks the page as allocated + [672.777][T736] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 88 + [672.779][T736] get_page_from_freelist+0x119c/0x2d50 + [672.779][T736] __alloc_pages+0x1cb/0x4a0 + [672.776][T736] alloc_pages+0x1aa/0x270 + [672.773][T736] allocate_slab+0x260/0x390 + [672.771][T736] ___slab_alloc+0xa9a/0x13e0 + [672.778][T736] __slab_alloc.constprop.0+0x56/0xb0 + [672.771][T736] __kmem_cache_alloc_node+0x136/0x320 + [672.789][T736] __kmalloc+0x4e/0x1a0 + [672.783][T736] tomoyo_realpath_from_path+0xc3/0x600 + [672.781][T736] tomoyo_path_perm+0x22f/0x420 + [672.782][T736] tomoyo_path_unlink+0x92/0xd0 + [672.780][T736] security_path_unlink+0xdb/0x150 + [672.788][T736] do_unlinkat+0x377/0x680 + [672.788][T736] __x64_sys_unlink+0xca/0x110 + [672.789][T736] do_syscall_64+0x39/0xb0 + [672.783][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd + [672.784][T736] page last free stack trace: + [672.787][T736] free_pcp_prepare+0x4e5/0x920 + [672.787][T736] free_unref_page+0x1d/0x4e0 + [672.784][T736] __unfreeze_partials+0x17c/0x1a0 + [672.797][T736] qlist_free_all+0x6a/0x180 + [672.796][T736] kasan_quarantine_reduce+0x189/0x1d0 + [672.797][T736] __kasan_slab_alloc+0x64/0x90 + [672.793][T736] kmem_cache_alloc+0x17c/0x3c0 + [672.799][T736] getname_flags.part.0+0x50/0x4e0 + [672.799][T736] getname_flags+0x9e/0xe0 + [672.792][T736] vfs_fstatat+0x77/0xb0 + [672.791][T736] __do_sys_newlstat+0x84/0x100 + [672.798][T736] do_syscall_64+0x39/0xb0 + [672.796][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd + [672.790][T736] + [672.791][T736] Memory state around the buggy address: + [672.799][T736] ffff888022ec0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + [672.805][T736] ffff888022ec0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + [672.802][T736] >ffff888022ec0200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + [672.809][T736] ^ + [672.809][T736] ffff888022ec0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + [672.809][T736] ffff888022ec0300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + +Fix this by having the qgroup assign ioctl take the qgroup ioctl mutex +before calling btrfs_run_qgroups(), which is what all qgroup ioctls should +call. + +Reported-by: butt3rflyh4ck +Link: https://lore.kernel.org/linux-btrfs/CAFcO6XN3VD8ogmHwqRk4kbiwtpUSNySu2VAxN8waEPciCHJvMA@mail.gmail.com/ +CC: stable@vger.kernel.org # 5.10+ +Reviewed-by: Qu Wenruo +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/btrfs/ioctl.c | 2 ++ + fs/btrfs/qgroup.c | 11 ++++++++++- + 2 files changed, 12 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 7e348bd2..c232636e 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -3731,7 +3731,9 @@ static long btrfs_ioctl_qgroup_assign(struct file *file, void __user *arg) + } + + /* update qgroup status and info */ ++ mutex_lock(&fs_info->qgroup_ioctl_lock); + err = btrfs_run_qgroups(trans); ++ mutex_unlock(&fs_info->qgroup_ioctl_lock); + if (err < 0) + btrfs_handle_fs_error(fs_info, err, + "failed to update qgroup status and info"); +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index af97413a..abf2b7f1 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -2828,13 +2828,22 @@ int btrfs_qgroup_account_extents(struct btrfs_trans_handle *trans) + } + + /* +- * called from commit_transaction. Writes all changed qgroups to disk. ++ * Writes all changed qgroups to disk. ++ * Called by the transaction commit path and the qgroup assign ioctl. + */ + int btrfs_run_qgroups(struct btrfs_trans_handle *trans) + { + struct btrfs_fs_info *fs_info = trans->fs_info; + int ret = 0; + ++ /* ++ * In case we are called from the qgroup assign ioctl, assert that we ++ * are holding the qgroup_ioctl_lock, otherwise we can race with a quota ++ * disable operation (ioctl) and access a freed quota root. ++ */ ++ if (trans->transaction->state != TRANS_STATE_COMMIT_DOING) ++ lockdep_assert_held(&fs_info->qgroup_ioctl_lock); ++ + if (!fs_info->quota_root) + return ret; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-135-btrfs-scan-device-in-non-exclusive-mode.patch b/patches.kernel.org/6.2.10-135-btrfs-scan-device-in-non-exclusive-mode.patch new file mode 100644 index 0000000..b1bba1c --- /dev/null +++ b/patches.kernel.org/6.2.10-135-btrfs-scan-device-in-non-exclusive-mode.patch @@ -0,0 +1,93 @@ +From: Anand Jain +Date: Thu, 23 Mar 2023 15:56:48 +0800 +Subject: [PATCH] btrfs: scan device in non-exclusive mode +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 50d281fc434cb8e2497f5e70a309ccca6b1a09f0 + +commit 50d281fc434cb8e2497f5e70a309ccca6b1a09f0 upstream. + +This fixes mkfs/mount/check failures due to race with systemd-udevd +scan. + +During the device scan initiated by systemd-udevd, other user space +EXCL operations such as mkfs, mount, or check may get blocked and result +in a "Device or resource busy" error. This is because the device +scan process opens the device with the EXCL flag in the kernel. + +Two reports were received: + + - btrfs/179 test case, where the fsck command failed with the -EBUSY + error + + - LTP pwritev03 test case, where mkfs.vfs failed with + the -EBUSY error, when mkfs.vfs tried to overwrite old btrfs filesystem + on the device. + +In both cases, fsck and mkfs (respectively) were racing with a +systemd-udevd device scan, and systemd-udevd won, resulting in the +-EBUSY error for fsck and mkfs. + +Reproducing the problem has been difficult because there is a very +small window during which these userspace threads can race to +acquire the exclusive device open. Even on the system where the problem +was observed, the problem occurrences were anywhere between 10 to 400 +iterations and chances of reproducing decreases with debug printk()s. + +However, an exclusive device open is unnecessary for the scan process, +as there are no write operations on the device during scan. Furthermore, +during the mount process, the superblock is re-read in the below +function call chain: + + btrfs_mount_root + btrfs_open_devices + open_fs_devices + btrfs_open_one_device + btrfs_get_bdev_and_sb + +So, to fix this issue, removes the FMODE_EXCL flag from the scan +operation, and add a comment. + +The case where mkfs may still write to the device and a scan is running, +the btrfs signature is not written at that time so scan will not +recognize such device. + +Reported-by: Sherry Yang +Reported-by: kernel test robot +Link: https://lore.kernel.org/oe-lkp/202303170839.fdf23068-oliver.sang@intel.com +CC: stable@vger.kernel.org # 5.4+ +Signed-off-by: Anand Jain +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/btrfs/volumes.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 992b1dea..fe652f8f 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -1366,8 +1366,17 @@ struct btrfs_device *btrfs_scan_one_device(const char *path, fmode_t flags, + * So, we need to add a special mount option to scan for + * later supers, using BTRFS_SUPER_MIRROR_MAX instead + */ +- flags |= FMODE_EXCL; + ++ /* ++ * Avoid using flag |= FMODE_EXCL here, as the systemd-udev may ++ * initiate the device scan which may race with the user's mount ++ * or mkfs command, resulting in failure. ++ * Since the device scan is solely for reading purposes, there is ++ * no need for FMODE_EXCL. Additionally, the devices are read again ++ * during the mount process. It is ok to get some inconsistent ++ * values temporarily, as the device paths of the fsid are the only ++ * required information for assembling the volume. ++ */ + bdev = blkdev_get_by_path(path, flags, holder); + if (IS_ERR(bdev)) + return ERR_CAST(bdev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-136-btrfs-ignore-fiemap-path-cache-when-there-are-.patch b/patches.kernel.org/6.2.10-136-btrfs-ignore-fiemap-path-cache-when-there-are-.patch new file mode 100644 index 0000000..4ab760a --- /dev/null +++ b/patches.kernel.org/6.2.10-136-btrfs-ignore-fiemap-path-cache-when-there-are-.patch @@ -0,0 +1,167 @@ +From: Filipe Manana +Date: Tue, 28 Mar 2023 10:45:20 +0100 +Subject: [PATCH] btrfs: ignore fiemap path cache when there are multiple paths + for a node +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 2280d425ba3599bdd85c41bd0ec8ba568f00c032 + +commit 2280d425ba3599bdd85c41bd0ec8ba568f00c032 upstream. + +During fiemap, when walking backreferences to determine if a b+tree +node/leaf is shared, we may find a tree block (leaf or node) for which +two parents were added to the references ulist. This happens if we get +for example one direct ref (shared tree block ref) and one indirect ref +(non-shared tree block ref) for the tree block at the current level, +which can happen during relocation. + +In that case the fiemap path cache can not be used since it's meant for +a single path, with one tree block at each possible level, so having +multiple references for a tree block at any level may result in getting +the level counter exceed BTRFS_MAX_LEVEL and eventually trigger the +warning: + + WARN_ON_ONCE(level >= BTRFS_MAX_LEVEL) + +at lookup_backref_shared_cache() and at store_backref_shared_cache(). +This is harmless since the code ignores any level >= BTRFS_MAX_LEVEL, the +warning is there just to catch any unexpected case like the one described +above. However if a user finds this it may be scary and get reported. + +So just ignore the path cache once we find a tree block for which there +are more than one reference, which is the less common case, and update +the cache with the sharedness check result for all levels below the level +for which we found multiple references. + +Reported-by: Jarno Pelkonen +Link: https://lore.kernel.org/linux-btrfs/CAKv8qLmDNAGJGCtsevxx_VZ_YOvvs1L83iEJkTgyA4joJertng@mail.gmail.com/ +Fixes: 12a824dc67a6 ("btrfs: speedup checking for extent sharedness during fiemap") +CC: stable@vger.kernel.org # 6.1+ +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/btrfs/backref.c | 85 ++++++++++++++++++++++++++++++++++------------ + 1 file changed, 63 insertions(+), 22 deletions(-) + +diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c +index 46851511..0d7ae20e 100644 +--- a/fs/btrfs/backref.c ++++ b/fs/btrfs/backref.c +@@ -1895,8 +1895,7 @@ int btrfs_is_data_extent_shared(struct btrfs_inode *inode, u64 bytenr, + ULIST_ITER_INIT(&uiter); + ctx->use_path_cache = true; + while (1) { +- bool is_shared; +- bool cached; ++ const unsigned long prev_ref_count = ctx->refs.nnodes; + + walk_ctx.bytenr = bytenr; + ret = find_parent_nodes(&walk_ctx, &shared); +@@ -1914,21 +1913,36 @@ int btrfs_is_data_extent_shared(struct btrfs_inode *inode, u64 bytenr, + ret = 0; + + /* +- * If our data extent was not directly shared (without multiple +- * reference items), than it might have a single reference item +- * with a count > 1 for the same offset, which means there are 2 +- * (or more) file extent items that point to the data extent - +- * this happens when a file extent item needs to be split and +- * then one item gets moved to another leaf due to a b+tree leaf +- * split when inserting some item. In this case the file extent +- * items may be located in different leaves and therefore some +- * of the leaves may be referenced through shared subtrees while +- * others are not. Since our extent buffer cache only works for +- * a single path (by far the most common case and simpler to +- * deal with), we can not use it if we have multiple leaves +- * (which implies multiple paths). ++ * More than one extent buffer (bytenr) may have been added to ++ * the ctx->refs ulist, in which case we have to check multiple ++ * tree paths in case the first one is not shared, so we can not ++ * use the path cache which is made for a single path. Multiple ++ * extent buffers at the current level happen when: ++ * ++ * 1) level -1, the data extent: If our data extent was not ++ * directly shared (without multiple reference items), then ++ * it might have a single reference item with a count > 1 for ++ * the same offset, which means there are 2 (or more) file ++ * extent items that point to the data extent - this happens ++ * when a file extent item needs to be split and then one ++ * item gets moved to another leaf due to a b+tree leaf split ++ * when inserting some item. In this case the file extent ++ * items may be located in different leaves and therefore ++ * some of the leaves may be referenced through shared ++ * subtrees while others are not. Since our extent buffer ++ * cache only works for a single path (by far the most common ++ * case and simpler to deal with), we can not use it if we ++ * have multiple leaves (which implies multiple paths). ++ * ++ * 2) level >= 0, a tree node/leaf: We can have a mix of direct ++ * and indirect references on a b+tree node/leaf, so we have ++ * to check multiple paths, and the extent buffer (the ++ * current bytenr) may be shared or not. One example is ++ * during relocation as we may get a shared tree block ref ++ * (direct ref) and a non-shared tree block ref (indirect ++ * ref) for the same node/leaf. + */ +- if (level == -1 && ctx->refs.nnodes > 1) ++ if ((ctx->refs.nnodes - prev_ref_count) > 1) + ctx->use_path_cache = false; + + if (level >= 0) +@@ -1938,18 +1952,45 @@ int btrfs_is_data_extent_shared(struct btrfs_inode *inode, u64 bytenr, + if (!node) + break; + bytenr = node->val; +- level++; +- cached = lookup_backref_shared_cache(ctx, root, bytenr, level, +- &is_shared); +- if (cached) { +- ret = (is_shared ? 1 : 0); +- break; ++ if (ctx->use_path_cache) { ++ bool is_shared; ++ bool cached; ++ ++ level++; ++ cached = lookup_backref_shared_cache(ctx, root, bytenr, ++ level, &is_shared); ++ if (cached) { ++ ret = (is_shared ? 1 : 0); ++ break; ++ } + } + shared.share_count = 0; + shared.have_delayed_delete_refs = false; + cond_resched(); + } + ++ /* ++ * If the path cache is disabled, then it means at some tree level we ++ * got multiple parents due to a mix of direct and indirect backrefs or ++ * multiple leaves with file extent items pointing to the same data ++ * extent. We have to invalidate the cache and cache only the sharedness ++ * result for the levels where we got only one node/reference. ++ */ ++ if (!ctx->use_path_cache) { ++ int i = 0; ++ ++ level--; ++ if (ret >= 0 && level >= 0) { ++ bytenr = ctx->path_cache_entries[level].bytenr; ++ ctx->use_path_cache = true; ++ store_backref_shared_cache(ctx, root, bytenr, level, ret); ++ i = level + 1; ++ } ++ ++ for ( ; i < BTRFS_MAX_LEVEL; i++) ++ ctx->path_cache_entries[i].bytenr = 0; ++ } ++ + /* + * Cache the sharedness result for the data extent if we know our inode + * has more than 1 file extent item that refers to the data extent. +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-137-zonefs-Do-not-propagate-iomap_dio_rw-ENOTBLK-e.patch b/patches.kernel.org/6.2.10-137-zonefs-Do-not-propagate-iomap_dio_rw-ENOTBLK-e.patch new file mode 100644 index 0000000..23ecdb5 --- /dev/null +++ b/patches.kernel.org/6.2.10-137-zonefs-Do-not-propagate-iomap_dio_rw-ENOTBLK-e.patch @@ -0,0 +1,63 @@ +From: Damien Le Moal +Date: Thu, 30 Mar 2023 09:47:58 +0900 +Subject: [PATCH] zonefs: Do not propagate iomap_dio_rw() ENOTBLK error to user + space +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 77af13ba3c7f91d91c377c7e2d122849bbc17128 + +commit 77af13ba3c7f91d91c377c7e2d122849bbc17128 upstream. + +The call to invalidate_inode_pages2_range() in __iomap_dio_rw() may +fail, in which case -ENOTBLK is returned and this error code is +propagated back to user space trhough iomap_dio_rw() -> +zonefs_file_dio_write() return chain. This error code is fairly obscure +and may confuse the user. Avoid this and be consistent with the behavior +of zonefs_file_dio_append() for similar invalidate_inode_pages2_range() +errors by returning -EBUSY to user space when iomap_dio_rw() returns +-ENOTBLK. + +Suggested-by: Christoph Hellwig +Fixes: 8dcc1a9d90c1 ("fs: New zonefs file system") +Cc: stable@vger.kernel.org +Signed-off-by: Damien Le Moal +Reviewed-by: Christoph Hellwig +Reviewed-by: Johannes Thumshirn +Tested-by: Hans Holmberg +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/zonefs/file.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/fs/zonefs/file.c b/fs/zonefs/file.c +index c71cc0fc..763f10a6 100644 +--- a/fs/zonefs/file.c ++++ b/fs/zonefs/file.c +@@ -567,11 +567,21 @@ static ssize_t zonefs_file_dio_write(struct kiocb *iocb, struct iov_iter *from) + append = sync; + } + +- if (append) ++ if (append) { + ret = zonefs_file_dio_append(iocb, from); +- else ++ } else { ++ /* ++ * iomap_dio_rw() may return ENOTBLK if there was an issue with ++ * page invalidation. Overwrite that error code with EBUSY to ++ * be consistent with zonefs_file_dio_append() return value for ++ * similar issues. ++ */ + ret = iomap_dio_rw(iocb, from, &zonefs_write_iomap_ops, + &zonefs_write_dio_ops, 0, NULL, 0); ++ if (ret == -ENOTBLK) ++ ret = -EBUSY; ++ } ++ + if (zonefs_zone_is_seq(z) && + (ret > 0 || ret == -EIOCBQUEUED)) { + if (ret > 0) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-138-io_uring-poll-clear-single-double-poll-flags-o.patch b/patches.kernel.org/6.2.10-138-io_uring-poll-clear-single-double-poll-flags-o.patch new file mode 100644 index 0000000..3e904e3 --- /dev/null +++ b/patches.kernel.org/6.2.10-138-io_uring-poll-clear-single-double-poll-flags-o.patch @@ -0,0 +1,44 @@ +From: Jens Axboe +Date: Mon, 27 Mar 2023 19:56:18 -0600 +Subject: [PATCH] io_uring/poll: clear single/double poll flags on poll arming +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 005308f7bdacf5685ed1a431244a183dbbb9e0e8 + +commit 005308f7bdacf5685ed1a431244a183dbbb9e0e8 upstream. + +Unless we have at least one entry queued, then don't call into +io_poll_remove_entries(). Normally this isn't possible, but if we +retry poll then we can have ->nr_entries cleared again as we're +setting it up. If this happens for a poll retry, then we'll still have +at least REQ_F_SINGLE_POLL set. io_poll_remove_entries() then thinks +it has entries to remove. + +Clear REQ_F_SINGLE_POLL and REQ_F_DOUBLE_POLL unconditionally when +arming a poll request. + +Fixes: c16bda37594f ("io_uring/poll: allow some retries for poll triggering spuriously") +Cc: stable@vger.kernel.org +Reported-by: Pengfei Xu +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + io_uring/poll.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/io_uring/poll.c b/io_uring/poll.c +index fea739ee..666666ab 100644 +--- a/io_uring/poll.c ++++ b/io_uring/poll.c +@@ -724,6 +724,7 @@ int io_arm_poll_handler(struct io_kiocb *req, unsigned issue_flags) + apoll = io_req_alloc_apoll(req, issue_flags); + if (!apoll) + return IO_APOLL_ABORTED; ++ req->flags &= ~(REQ_F_SINGLE_POLL | REQ_F_DOUBLE_POLL); + req->flags |= REQ_F_POLLED; + ipt.pt._qproc = io_async_queue_proc; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-139-io_uring-rsrc-fix-rogue-rsrc-node-grabbing.patch b/patches.kernel.org/6.2.10-139-io_uring-rsrc-fix-rogue-rsrc-node-grabbing.patch new file mode 100644 index 0000000..64ddef1 --- /dev/null +++ b/patches.kernel.org/6.2.10-139-io_uring-rsrc-fix-rogue-rsrc-node-grabbing.patch @@ -0,0 +1,52 @@ +From: Pavel Begunkov +Date: Wed, 29 Mar 2023 15:03:43 +0100 +Subject: [PATCH] io_uring/rsrc: fix rogue rsrc node grabbing +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 4ff0b50de8cabba055efe50bbcb7506c41a69835 + +commit 4ff0b50de8cabba055efe50bbcb7506c41a69835 upstream. + +We should not be looking at ctx->rsrc_node and anyhow modifying the node +without holding uring_lock, grabbing references in such a way is not +safe either. + +Cc: stable@vger.kernel.org +Fixes: 5106dd6e74ab6 ("io_uring: propagate issue_flags state down to file assignment") +Signed-off-by: Pavel Begunkov +Link: https://lore.kernel.org/r/1202ede2d7bb90136e3482b2b84aad9ed483e5d6.1680098433.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + io_uring/rsrc.h | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/io_uring/rsrc.h b/io_uring/rsrc.h +index 2b874364..f27f4975 100644 +--- a/io_uring/rsrc.h ++++ b/io_uring/rsrc.h +@@ -144,15 +144,13 @@ static inline void io_req_set_rsrc_node(struct io_kiocb *req, + unsigned int issue_flags) + { + if (!req->rsrc_node) { +- req->rsrc_node = ctx->rsrc_node; ++ io_ring_submit_lock(ctx, issue_flags); + +- if (!(issue_flags & IO_URING_F_UNLOCKED)) { +- lockdep_assert_held(&ctx->uring_lock); ++ lockdep_assert_held(&ctx->uring_lock); + +- io_charge_rsrc_node(ctx); +- } else { +- percpu_ref_get(&req->rsrc_node->refs); +- } ++ req->rsrc_node = ctx->rsrc_node; ++ io_charge_rsrc_node(ctx); ++ io_ring_submit_unlock(ctx, issue_flags); + } + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-140-io_uring-fix-poll-netmsg-alloc-caches.patch b/patches.kernel.org/6.2.10-140-io_uring-fix-poll-netmsg-alloc-caches.patch new file mode 100644 index 0000000..44fc00b --- /dev/null +++ b/patches.kernel.org/6.2.10-140-io_uring-fix-poll-netmsg-alloc-caches.patch @@ -0,0 +1,39 @@ +From: Pavel Begunkov +Date: Thu, 30 Mar 2023 06:52:38 -0600 +Subject: [PATCH] io_uring: fix poll/netmsg alloc caches +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: fd30d1cdcc4ff405fc54765edf2e11b03f2ed4f3 + +commit fd30d1cdcc4ff405fc54765edf2e11b03f2ed4f3 upstream. + +We increase cache->nr_cached when we free into the cache but don't +decrease when we take from it, so in some time we'll get an empty +cache with cache->nr_cached larger than IO_ALLOC_CACHE_MAX, that fails +io_alloc_cache_put() and effectively disables caching. + +Fixes: 9b797a37c4bd8 ("io_uring: add abstraction around apoll cache") +Cc: stable@vger.kernel.org +Signed-off-by: Pavel Begunkov +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + io_uring/alloc_cache.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/io_uring/alloc_cache.h b/io_uring/alloc_cache.h +index 729793ae..c2cde88a 100644 +--- a/io_uring/alloc_cache.h ++++ b/io_uring/alloc_cache.h +@@ -27,6 +27,7 @@ static inline struct io_cache_entry *io_alloc_cache_get(struct io_alloc_cache *c + struct hlist_node *node = cache->list.first; + + hlist_del(node); ++ cache->nr_cached--; + return container_of(node, struct io_cache_entry, node); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-141-vmxnet3-use-gro-callback-when-UPT-is-enabled.patch b/patches.kernel.org/6.2.10-141-vmxnet3-use-gro-callback-when-UPT-is-enabled.patch new file mode 100644 index 0000000..c317401 --- /dev/null +++ b/patches.kernel.org/6.2.10-141-vmxnet3-use-gro-callback-when-UPT-is-enabled.patch @@ -0,0 +1,54 @@ +From: Ronak Doshi +Date: Thu, 23 Mar 2023 13:07:21 -0700 +Subject: [PATCH] vmxnet3: use gro callback when UPT is enabled +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 3bced313b9a5a237c347e0f079c8c2fe4b3935aa + +commit 3bced313b9a5a237c347e0f079c8c2fe4b3935aa upstream. + +Currently, vmxnet3 uses GRO callback only if LRO is disabled. However, +on smartNic based setups where UPT is supported, LRO can be enabled +from guest VM but UPT devicve does not support LRO as of now. In such +cases, there can be performance degradation as GRO is not being done. + +This patch fixes this issue by calling GRO API when UPT is enabled. We +use updateRxProd to determine if UPT mode is active or not. + +To clarify few things discussed over the thread: +The patch is not neglecting any feature bits nor disabling GRO. It uses +GRO callback when UPT is active as LRO is not available in UPT. +GRO callback cannot be used as default for all cases as it degrades +performance for non-UPT cases or for cases when LRO is already done in +ESXi. + +Cc: stable@vger.kernel.org +Fixes: 6f91f4ba046e ("vmxnet3: add support for capability registers") +Signed-off-by: Ronak Doshi +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230323200721.27622-1-doshir@vmware.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/net/vmxnet3/vmxnet3_drv.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c +index 68298704..da488cbb 100644 +--- a/drivers/net/vmxnet3/vmxnet3_drv.c ++++ b/drivers/net/vmxnet3/vmxnet3_drv.c +@@ -1688,7 +1688,9 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq, + if (unlikely(rcd->ts)) + __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), rcd->tci); + +- if (adapter->netdev->features & NETIF_F_LRO) ++ /* Use GRO callback if UPT is enabled */ ++ if ((adapter->netdev->features & NETIF_F_LRO) && ++ !rq->shared->updateRxProd) + netif_receive_skb(skb); + else + napi_gro_receive(&rq->napi, skb); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-142-zonefs-Always-invalidate-last-cached-page-on-a.patch b/patches.kernel.org/6.2.10-142-zonefs-Always-invalidate-last-cached-page-on-a.patch new file mode 100644 index 0000000..216bd00 --- /dev/null +++ b/patches.kernel.org/6.2.10-142-zonefs-Always-invalidate-last-cached-page-on-a.patch @@ -0,0 +1,68 @@ +From: Damien Le Moal +Date: Wed, 29 Mar 2023 13:16:01 +0900 +Subject: [PATCH] zonefs: Always invalidate last cached page on append write +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: c1976bd8f23016d8706973908f2bb0ac0d852a8f + +commit c1976bd8f23016d8706973908f2bb0ac0d852a8f upstream. + +When a direct append write is executed, the append offset may correspond +to the last page of a sequential file inode which might have been cached +already by buffered reads, page faults with mmap-read or non-direct +readahead. To ensure that the on-disk and cached data is consistant for +such last cached page, make sure to always invalidate it in +zonefs_file_dio_append(). If the invalidation fails, return -EBUSY to +userspace to differentiate from IO errors. + +This invalidation will always be a no-op when the FS block size (device +zone write granularity) is equal to the page size (e.g. 4K). + +Reported-by: Hans Holmberg +Fixes: 02ef12a663c7 ("zonefs: use REQ_OP_ZONE_APPEND for sync DIO") +Cc: stable@vger.kernel.org +Signed-off-by: Damien Le Moal +Reviewed-by: Christoph Hellwig +Reviewed-by: Johannes Thumshirn +Tested-by: Hans Holmberg +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/zonefs/file.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/fs/zonefs/file.c b/fs/zonefs/file.c +index 763f10a6..63cd5084 100644 +--- a/fs/zonefs/file.c ++++ b/fs/zonefs/file.c +@@ -382,6 +382,7 @@ static ssize_t zonefs_file_dio_append(struct kiocb *iocb, struct iov_iter *from) + struct zonefs_zone *z = zonefs_inode_zone(inode); + struct block_device *bdev = inode->i_sb->s_bdev; + unsigned int max = bdev_max_zone_append_sectors(bdev); ++ pgoff_t start, end; + struct bio *bio; + ssize_t size; + int nr_pages; +@@ -390,6 +391,19 @@ static ssize_t zonefs_file_dio_append(struct kiocb *iocb, struct iov_iter *from) + max = ALIGN_DOWN(max << SECTOR_SHIFT, inode->i_sb->s_blocksize); + iov_iter_truncate(from, max); + ++ /* ++ * If the inode block size (zone write granularity) is smaller than the ++ * page size, we may be appending data belonging to the last page of the ++ * inode straddling inode->i_size, with that page already cached due to ++ * a buffered read or readahead. So make sure to invalidate that page. ++ * This will always be a no-op for the case where the block size is ++ * equal to the page size. ++ */ ++ start = iocb->ki_pos >> PAGE_SHIFT; ++ end = (iocb->ki_pos + iov_iter_count(from) - 1) >> PAGE_SHIFT; ++ if (invalidate_inode_pages2_range(inode->i_mapping, start, end)) ++ return -EBUSY; ++ + nr_pages = iov_iter_npages(from, BIO_MAX_VECS); + if (!nr_pages) + return 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-143-dm-fix-__send_duplicate_bios-to-always-allow-f.patch b/patches.kernel.org/6.2.10-143-dm-fix-__send_duplicate_bios-to-always-allow-f.patch new file mode 100644 index 0000000..eb5c152 --- /dev/null +++ b/patches.kernel.org/6.2.10-143-dm-fix-__send_duplicate_bios-to-always-allow-f.patch @@ -0,0 +1,62 @@ +From: Mike Snitzer +Date: Thu, 30 Mar 2023 15:09:29 -0400 +Subject: [PATCH] dm: fix __send_duplicate_bios() to always allow for splitting + IO +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 666eed46769d929c3e13636134ecfc67d75ef548 + +commit 666eed46769d929c3e13636134ecfc67d75ef548 upstream. + +Commit 7dd76d1feec70 ("dm: improve bio splitting and associated IO +accounting") only called setup_split_accounting() from +__send_duplicate_bios() if a single bio were being issued. But the case +where duplicate bios are issued must call it too. + +Otherwise the bio won't be split and resubmitted (via recursion through +block core back to DM) to submit the later portions of a bio (which may +map to an entirely different target). + +For example, when discarding an entire DM striped device with the +following DM table: + vg-lvol0: 0 159744 striped 2 128 7:0 2048 7:1 2048 + vg-lvol0: 159744 45056 striped 2 128 7:2 2048 7:3 2048 + +Before (broken, discards the first striped target's devices twice): + device-mapper: striped: target_stripe=0, bdev=7:0, start=2048 len=79872 + device-mapper: striped: target_stripe=1, bdev=7:1, start=2048 len=79872 + device-mapper: striped: target_stripe=0, bdev=7:0, start=2049 len=22528 + device-mapper: striped: target_stripe=1, bdev=7:1, start=2048 len=22528 + +After (works as expected): + device-mapper: striped: target_stripe=0, bdev=7:0, start=2048 len=79872 + device-mapper: striped: target_stripe=1, bdev=7:1, start=2048 len=79872 + device-mapper: striped: target_stripe=0, bdev=7:2, start=2048 len=22528 + device-mapper: striped: target_stripe=1, bdev=7:3, start=2048 len=22528 + +Fixes: 7dd76d1feec70 ("dm: improve bio splitting and associated IO accounting") +Cc: stable@vger.kernel.org +Reported-by: Orange Kao +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/md/dm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index fc953013..1b6c3c78 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -1509,6 +1509,8 @@ static int __send_duplicate_bios(struct clone_info *ci, struct dm_target *ti, + ret = 1; + break; + default: ++ if (len) ++ setup_split_accounting(ci, *len); + /* dm_accept_partial_bio() is not supported with shared tio->len_ptr */ + alloc_multiple_bios(&blist, ci, ti, num_bios); + while ((clone = bio_list_pop(&blist))) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-144-can-j1939-prevent-deadlock-by-moving-j1939_sk_.patch b/patches.kernel.org/6.2.10-144-can-j1939-prevent-deadlock-by-moving-j1939_sk_.patch new file mode 100644 index 0000000..522356c --- /dev/null +++ b/patches.kernel.org/6.2.10-144-can-j1939-prevent-deadlock-by-moving-j1939_sk_.patch @@ -0,0 +1,94 @@ +From: Oleksij Rempel +Date: Fri, 24 Mar 2023 14:01:41 +0100 +Subject: [PATCH] can: j1939: prevent deadlock by moving j1939_sk_errqueue() +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: d1366b283d94ac4537a4b3a1e8668da4df7ce7e9 + +commit d1366b283d94ac4537a4b3a1e8668da4df7ce7e9 upstream. + +This commit addresses a deadlock situation that can occur in certain +scenarios, such as when running data TP/ETP transfer and subscribing to +the error queue while receiving a net down event. The deadlock involves +locks in the following order: + +3 + j1939_session_list_lock -> active_session_list_lock + j1939_session_activate + ... + j1939_sk_queue_activate_next -> sk_session_queue_lock + ... + j1939_xtp_rx_eoma_one + +2 + j1939_sk_queue_drop_all -> sk_session_queue_lock + ... + j1939_sk_netdev_event_netdown -> j1939_socks_lock + j1939_netdev_notify + +1 + j1939_sk_errqueue -> j1939_socks_lock + __j1939_session_cancel -> active_session_list_lock + j1939_tp_rxtimer + + CPU0 CPU1 + ---- ---- + lock(&priv->active_session_list_lock); + lock(&jsk->sk_session_queue_lock); + lock(&priv->active_session_list_lock); + lock(&priv->j1939_socks_lock); + +The solution implemented in this commit is to move the +j1939_sk_errqueue() call out of the active_session_list_lock context, +thus preventing the deadlock situation. + +Reported-by: syzbot+ee1cd780f69483a8616b@syzkaller.appspotmail.com +Fixes: 5b9272e93f2e ("can: j1939: extend UAPI to notify about RX status") +Co-developed-by: Hillf Danton +Signed-off-by: Hillf Danton +Signed-off-by: Oleksij Rempel +Link: https://lore.kernel.org/all/20230324130141.2132787-1-o.rempel@pengutronix.de +Cc: stable@vger.kernel.org +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + net/can/j1939/transport.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c +index fce9b9eb..fb92c360 100644 +--- a/net/can/j1939/transport.c ++++ b/net/can/j1939/transport.c +@@ -1124,8 +1124,6 @@ static void __j1939_session_cancel(struct j1939_session *session, + + if (session->sk) + j1939_sk_send_loop_abort(session->sk, session->err); +- else +- j1939_sk_errqueue(session, J1939_ERRQUEUE_RX_ABORT); + } + + static void j1939_session_cancel(struct j1939_session *session, +@@ -1140,6 +1138,9 @@ static void j1939_session_cancel(struct j1939_session *session, + } + + j1939_session_list_unlock(session->priv); ++ ++ if (!session->sk) ++ j1939_sk_errqueue(session, J1939_ERRQUEUE_RX_ABORT); + } + + static enum hrtimer_restart j1939_tp_txtimer(struct hrtimer *hrtimer) +@@ -1253,6 +1254,9 @@ static enum hrtimer_restart j1939_tp_rxtimer(struct hrtimer *hrtimer) + __j1939_session_cancel(session, J1939_XTP_ABORT_TIMEOUT); + } + j1939_session_list_unlock(session->priv); ++ ++ if (!session->sk) ++ j1939_sk_errqueue(session, J1939_ERRQUEUE_RX_ABORT); + } + + j1939_session_put(session); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-145-xen-netback-don-t-do-grant-copy-across-page-bo.patch b/patches.kernel.org/6.2.10-145-xen-netback-don-t-do-grant-copy-across-page-bo.patch new file mode 100644 index 0000000..cbeaf76 --- /dev/null +++ b/patches.kernel.org/6.2.10-145-xen-netback-don-t-do-grant-copy-across-page-bo.patch @@ -0,0 +1,126 @@ +From: Juergen Gross +Date: Mon, 27 Mar 2023 10:36:45 +0200 +Subject: [PATCH] xen/netback: don't do grant copy across page boundary +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 05310f31ca74673a96567fb14637b7d5d6c82ea5 + +commit 05310f31ca74673a96567fb14637b7d5d6c82ea5 upstream. + +Fix xenvif_get_requests() not to do grant copy operations across local +page boundaries. This requires to double the maximum number of copy +operations per queue, as each copy could now be split into 2. + +Make sure that struct xenvif_tx_cb doesn't grow too large. + +Cc: stable@vger.kernel.org +Fixes: ad7f402ae4f4 ("xen/netback: Ensure protocol headers don't fall in the non-linear area") +Signed-off-by: Juergen Gross +Reviewed-by: Paul Durrant +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/net/xen-netback/common.h | 2 +- + drivers/net/xen-netback/netback.c | 25 +++++++++++++++++++++++-- + 2 files changed, 24 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h +index 3dbfc8a6..1fcbd83f 100644 +--- a/drivers/net/xen-netback/common.h ++++ b/drivers/net/xen-netback/common.h +@@ -166,7 +166,7 @@ struct xenvif_queue { /* Per-queue data for xenvif */ + struct pending_tx_info pending_tx_info[MAX_PENDING_REQS]; + grant_handle_t grant_tx_handle[MAX_PENDING_REQS]; + +- struct gnttab_copy tx_copy_ops[MAX_PENDING_REQS]; ++ struct gnttab_copy tx_copy_ops[2 * MAX_PENDING_REQS]; + struct gnttab_map_grant_ref tx_map_ops[MAX_PENDING_REQS]; + struct gnttab_unmap_grant_ref tx_unmap_ops[MAX_PENDING_REQS]; + /* passed to gnttab_[un]map_refs with pages under (un)mapping */ +diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c +index bf627af7..5c266062 100644 +--- a/drivers/net/xen-netback/netback.c ++++ b/drivers/net/xen-netback/netback.c +@@ -334,6 +334,7 @@ static int xenvif_count_requests(struct xenvif_queue *queue, + struct xenvif_tx_cb { + u16 copy_pending_idx[XEN_NETBK_LEGACY_SLOTS_MAX + 1]; + u8 copy_count; ++ u32 split_mask; + }; + + #define XENVIF_TX_CB(skb) ((struct xenvif_tx_cb *)(skb)->cb) +@@ -361,6 +362,8 @@ static inline struct sk_buff *xenvif_alloc_skb(unsigned int size) + struct sk_buff *skb = + alloc_skb(size + NET_SKB_PAD + NET_IP_ALIGN, + GFP_ATOMIC | __GFP_NOWARN); ++ ++ BUILD_BUG_ON(sizeof(*XENVIF_TX_CB(skb)) > sizeof(skb->cb)); + if (unlikely(skb == NULL)) + return NULL; + +@@ -396,11 +399,13 @@ static void xenvif_get_requests(struct xenvif_queue *queue, + nr_slots = shinfo->nr_frags + 1; + + copy_count(skb) = 0; ++ XENVIF_TX_CB(skb)->split_mask = 0; + + /* Create copy ops for exactly data_len bytes into the skb head. */ + __skb_put(skb, data_len); + while (data_len > 0) { + int amount = data_len > txp->size ? txp->size : data_len; ++ bool split = false; + + cop->source.u.ref = txp->gref; + cop->source.domid = queue->vif->domid; +@@ -413,6 +418,13 @@ static void xenvif_get_requests(struct xenvif_queue *queue, + cop->dest.u.gmfn = virt_to_gfn(skb->data + skb_headlen(skb) + - data_len); + ++ /* Don't cross local page boundary! */ ++ if (cop->dest.offset + amount > XEN_PAGE_SIZE) { ++ amount = XEN_PAGE_SIZE - cop->dest.offset; ++ XENVIF_TX_CB(skb)->split_mask |= 1U << copy_count(skb); ++ split = true; ++ } ++ + cop->len = amount; + cop->flags = GNTCOPY_source_gref; + +@@ -420,7 +432,8 @@ static void xenvif_get_requests(struct xenvif_queue *queue, + pending_idx = queue->pending_ring[index]; + callback_param(queue, pending_idx).ctx = NULL; + copy_pending_idx(skb, copy_count(skb)) = pending_idx; +- copy_count(skb)++; ++ if (!split) ++ copy_count(skb)++; + + cop++; + data_len -= amount; +@@ -441,7 +454,8 @@ static void xenvif_get_requests(struct xenvif_queue *queue, + nr_slots--; + } else { + /* The copy op partially covered the tx_request. +- * The remainder will be mapped. ++ * The remainder will be mapped or copied in the next ++ * iteration. + */ + txp->offset += amount; + txp->size -= amount; +@@ -539,6 +553,13 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue, + pending_idx = copy_pending_idx(skb, i); + + newerr = (*gopp_copy)->status; ++ ++ /* Split copies need to be handled together. */ ++ if (XENVIF_TX_CB(skb)->split_mask & (1U << i)) { ++ (*gopp_copy)++; ++ if (!newerr) ++ newerr = (*gopp_copy)->status; ++ } + if (likely(!newerr)) { + /* The first frag might still have this slot mapped */ + if (i < copy_count(skb) - 1 || !sharedslot) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-146-net-phy-dp83869-fix-default-value-for-tx-rx-in.patch b/patches.kernel.org/6.2.10-146-net-phy-dp83869-fix-default-value-for-tx-rx-in.patch new file mode 100644 index 0000000..763dc20 --- /dev/null +++ b/patches.kernel.org/6.2.10-146-net-phy-dp83869-fix-default-value-for-tx-rx-in.patch @@ -0,0 +1,62 @@ +From: Josua Mayer +Date: Thu, 23 Mar 2023 12:25:36 +0200 +Subject: [PATCH] net: phy: dp83869: fix default value for + tx-/rx-internal-delay +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 82e2c39f9ef78896e9b634dfd82dc042e6956bb7 + +commit 82e2c39f9ef78896e9b634dfd82dc042e6956bb7 upstream. + +dp83869 internally uses a look-up table for mapping supported delays in +nanoseconds to register values. +When specific delays are defined in device-tree, phy_get_internal_delay +does the lookup automatically returning an index. + +The default case wrongly assigns the nanoseconds value from the lookup +table, resulting in numeric value 2000 applied to delay configuration +register, rather than the expected index values 0-7 (7 for 2000). +Ultimately this issue broke RX for 1Gbps links. + +Fix default delay configuration by assigning the intended index value +directly. + +Cc: stable@vger.kernel.org +Fixes: 736b25afe284 ("net: dp83869: Add RGMII internal delay configuration") +Co-developed-by: Yazan Shhady +Signed-off-by: Yazan Shhady +Signed-off-by: Josua Mayer +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230323102536.31988-1-josua@solid-run.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/net/phy/dp83869.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/phy/dp83869.c b/drivers/net/phy/dp83869.c +index b4ff9c50..9ab5eff5 100644 +--- a/drivers/net/phy/dp83869.c ++++ b/drivers/net/phy/dp83869.c +@@ -588,15 +588,13 @@ static int dp83869_of_init(struct phy_device *phydev) + &dp83869_internal_delay[0], + delay_size, true); + if (dp83869->rx_int_delay < 0) +- dp83869->rx_int_delay = +- dp83869_internal_delay[DP83869_CLK_DELAY_DEF]; ++ dp83869->rx_int_delay = DP83869_CLK_DELAY_DEF; + + dp83869->tx_int_delay = phy_get_internal_delay(phydev, dev, + &dp83869_internal_delay[0], + delay_size, false); + if (dp83869->tx_int_delay < 0) +- dp83869->tx_int_delay = +- dp83869_internal_delay[DP83869_CLK_DELAY_DEF]; ++ dp83869->tx_int_delay = DP83869_CLK_DELAY_DEF; + + return ret; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-147-modpost-Fix-processing-of-CRCs-on-32-bit-build.patch b/patches.kernel.org/6.2.10-147-modpost-Fix-processing-of-CRCs-on-32-bit-build.patch new file mode 100644 index 0000000..cb6e447 --- /dev/null +++ b/patches.kernel.org/6.2.10-147-modpost-Fix-processing-of-CRCs-on-32-bit-build.patch @@ -0,0 +1,44 @@ +From: Ben Hutchings +Date: Wed, 22 Mar 2023 19:11:45 +0100 +Subject: [PATCH] modpost: Fix processing of CRCs on 32-bit build machines +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: fb27e70f6e408dee5d22b083e7a38a59e6118253 + +commit fb27e70f6e408dee5d22b083e7a38a59e6118253 upstream. + +modpost now reads CRCs from .*.cmd files, parsing them using strtol(). +This is inconsistent with its parsing of Module.symvers and with their +definition as *unsigned* 32-bit values. + +strtol() clamps values to [LONG_MIN, LONG_MAX], and when building on a +32-bit system this changes all CRCs >= 0x80000000 to be 0x7fffffff. + +Change extract_crcs_for_object() to use strtoul() instead. + +Cc: stable@vger.kernel.org +Fixes: f292d875d0dc ("modpost: extract symbol versions from *.cmd files") +Signed-off-by: Ben Hutchings +Signed-off-by: Masahiro Yamada +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + scripts/mod/modpost.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index efff8078..9466b6a2 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1733,7 +1733,7 @@ static void extract_crcs_for_object(const char *object, struct module *mod) + if (!isdigit(*p)) + continue; /* skip this line */ + +- crc = strtol(p, &p, 0); ++ crc = strtoul(p, &p, 0); + if (*p != '\n') + continue; /* skip this line */ + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-148-pinctrl-amd-Disable-and-mask-interrupts-on-res.patch b/patches.kernel.org/6.2.10-148-pinctrl-amd-Disable-and-mask-interrupts-on-res.patch new file mode 100644 index 0000000..6a97724 --- /dev/null +++ b/patches.kernel.org/6.2.10-148-pinctrl-amd-Disable-and-mask-interrupts-on-res.patch @@ -0,0 +1,103 @@ +From: =?UTF-8?q?Kornel=20Dul=C4=99ba?= +Date: Mon, 20 Mar 2023 09:32:59 +0000 +Subject: [PATCH] pinctrl: amd: Disable and mask interrupts on resume +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: b26cd9325be4c1fcd331b77f10acb627c560d4d7 + +commit b26cd9325be4c1fcd331b77f10acb627c560d4d7 upstream. + +This fixes a similar problem to the one observed in: +commit 4e5a04be88fe ("pinctrl: amd: disable and mask interrupts on probe"). + +On some systems, during suspend/resume cycle firmware leaves +an interrupt enabled on a pin that is not used by the kernel. +This confuses the AMD pinctrl driver and causes spurious interrupts. + +The driver already has logic to detect if a pin is used by the kernel. +Leverage it to re-initialize interrupt fields of a pin only if it's not +used by us. + +Cc: stable@vger.kernel.org +Fixes: dbad75dd1f25 ("pinctrl: add AMD GPIO driver support.") +Signed-off-by: Kornel Dulęba +Link: https://lore.kernel.org/r/20230320093259.845178-1-korneld@chromium.org +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/pinctrl/pinctrl-amd.c | 36 +++++++++++++++++++---------------- + 1 file changed, 20 insertions(+), 16 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c +index 32c3edaf..5e7b82a2 100644 +--- a/drivers/pinctrl/pinctrl-amd.c ++++ b/drivers/pinctrl/pinctrl-amd.c +@@ -865,32 +865,34 @@ static const struct pinconf_ops amd_pinconf_ops = { + .pin_config_group_set = amd_pinconf_group_set, + }; + +-static void amd_gpio_irq_init(struct amd_gpio *gpio_dev) ++static void amd_gpio_irq_init_pin(struct amd_gpio *gpio_dev, int pin) + { +- struct pinctrl_desc *desc = gpio_dev->pctrl->desc; ++ const struct pin_desc *pd; + unsigned long flags; + u32 pin_reg, mask; +- int i; + + mask = BIT(WAKE_CNTRL_OFF_S0I3) | BIT(WAKE_CNTRL_OFF_S3) | + BIT(INTERRUPT_MASK_OFF) | BIT(INTERRUPT_ENABLE_OFF) | + BIT(WAKE_CNTRL_OFF_S4); + +- for (i = 0; i < desc->npins; i++) { +- int pin = desc->pins[i].number; +- const struct pin_desc *pd = pin_desc_get(gpio_dev->pctrl, pin); +- +- if (!pd) +- continue; ++ pd = pin_desc_get(gpio_dev->pctrl, pin); ++ if (!pd) ++ return; + +- raw_spin_lock_irqsave(&gpio_dev->lock, flags); ++ raw_spin_lock_irqsave(&gpio_dev->lock, flags); ++ pin_reg = readl(gpio_dev->base + pin * 4); ++ pin_reg &= ~mask; ++ writel(pin_reg, gpio_dev->base + pin * 4); ++ raw_spin_unlock_irqrestore(&gpio_dev->lock, flags); ++} + +- pin_reg = readl(gpio_dev->base + i * 4); +- pin_reg &= ~mask; +- writel(pin_reg, gpio_dev->base + i * 4); ++static void amd_gpio_irq_init(struct amd_gpio *gpio_dev) ++{ ++ struct pinctrl_desc *desc = gpio_dev->pctrl->desc; ++ int i; + +- raw_spin_unlock_irqrestore(&gpio_dev->lock, flags); +- } ++ for (i = 0; i < desc->npins; i++) ++ amd_gpio_irq_init_pin(gpio_dev, i); + } + + #ifdef CONFIG_PM_SLEEP +@@ -943,8 +945,10 @@ static int amd_gpio_resume(struct device *dev) + for (i = 0; i < desc->npins; i++) { + int pin = desc->pins[i].number; + +- if (!amd_gpio_should_save(gpio_dev, pin)) ++ if (!amd_gpio_should_save(gpio_dev, pin)) { ++ amd_gpio_irq_init_pin(gpio_dev, pin); + continue; ++ } + + raw_spin_lock_irqsave(&gpio_dev->lock, flags); + gpio_dev->saved_regs[i] |= readl(gpio_dev->base + pin * 4) & PIN_IRQ_PENDING; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-149-pinctrl-at91-pio4-fix-domain-name-assignment.patch b/patches.kernel.org/6.2.10-149-pinctrl-at91-pio4-fix-domain-name-assignment.patch new file mode 100644 index 0000000..72d73b6 --- /dev/null +++ b/patches.kernel.org/6.2.10-149-pinctrl-at91-pio4-fix-domain-name-assignment.patch @@ -0,0 +1,45 @@ +From: Johan Hovold +Date: Fri, 24 Feb 2023 14:08:28 +0100 +Subject: [PATCH] pinctrl: at91-pio4: fix domain name assignment +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 7bb97e360acdd38b68ad0a1defb89c6e89c85596 + +commit 7bb97e360acdd38b68ad0a1defb89c6e89c85596 upstream. + +Since commit d59f6617eef0 ("genirq: Allow fwnode to carry name +information only") an IRQ domain is always given a name during +allocation (e.g. used for the debugfs entry). + +Drop the no longer valid name assignment, which would lead to an attempt +to free a string constant when removing the domain on late probe +failures (e.g. probe deferral). + +Fixes: d59f6617eef0 ("genirq: Allow fwnode to carry name information only") +Cc: stable@vger.kernel.org # 4.13 +Signed-off-by: Johan Hovold +Reviewed-by: Claudiu Beznea +Tested-by: Claudiu Beznea # on SAMA7G5 +Link: https://lore.kernel.org/r/20230224130828.27985-1-johan+linaro@kernel.org +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/pinctrl/pinctrl-at91-pio4.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c +index 373eed8b..c775d239 100644 +--- a/drivers/pinctrl/pinctrl-at91-pio4.c ++++ b/drivers/pinctrl/pinctrl-at91-pio4.c +@@ -1206,7 +1206,6 @@ static int atmel_pinctrl_probe(struct platform_device *pdev) + dev_err(dev, "can't add the irq domain\n"); + return -ENODEV; + } +- atmel_pioctrl->irq_domain->name = "atmel gpio"; + + for (i = 0; i < atmel_pioctrl->npins; i++) { + int irq = irq_create_mapping(atmel_pioctrl->irq_domain, i); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-150-platform-x86-ideapad-laptop-Stop-sending-KEY_T.patch b/patches.kernel.org/6.2.10-150-platform-x86-ideapad-laptop-Stop-sending-KEY_T.patch new file mode 100644 index 0000000..c17dd9b --- /dev/null +++ b/patches.kernel.org/6.2.10-150-platform-x86-ideapad-laptop-Stop-sending-KEY_T.patch @@ -0,0 +1,94 @@ +From: Hans de Goede +Date: Thu, 30 Mar 2023 21:46:44 +0200 +Subject: [PATCH] platform/x86: ideapad-laptop: Stop sending + KEY_TOUCHPAD_TOGGLE +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: e3271a5917d1501089b1a224d702aa053e2877f4 + +commit e3271a5917d1501089b1a224d702aa053e2877f4 upstream. + +Commit 5829f8a897e4 ("platform/x86: ideapad-laptop: Send +KEY_TOUCHPAD_TOGGLE on some models") made ideapad-laptop send +KEY_TOUCHPAD_TOGGLE when we receive an ACPI notify with VPC event bit 5 set +and the touchpad-state has not been changed by the EC itself already. + +This was done under the assumption that this would be good to do to make +the touchpad-toggle hotkey work on newer models where the EC does not +toggle the touchpad on/off itself (because it is not routed through +the PS/2 controller, but uses I2C). + +But it turns out that at least some models, e.g. the Yoga 7-15ITL5 the EC +triggers an ACPI notify with VPC event bit 5 set on resume, which would +now cause a spurious KEY_TOUCHPAD_TOGGLE on resume to which the desktop +environment responds by disabling the touchpad in software, breaking +the touchpad (until manually re-enabled) on resume. + +It was never confirmed that sending KEY_TOUCHPAD_TOGGLE actually improves +things on new models and at least some new models like the Yoga 7-15ITL5 +don't have a touchpad on/off toggle hotkey at all, while still sending +ACPI notify events with VPC event bit 5 set. + +So it seems best to revert the change to send KEY_TOUCHPAD_TOGGLE when +receiving an ACPI notify events with VPC event bit 5 and the touchpad +state as reported by the EC has not changed. + +Note this is not a full revert the code to cache the last EC touchpad +state is kept to avoid sending spurious KEY_TOUCHPAD_ON / _OFF events +on resume. + +Fixes: 5829f8a897e4 ("platform/x86: ideapad-laptop: Send KEY_TOUCHPAD_TOGGLE on some models") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217234 +Cc: stable@vger.kernel.org +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20230330194644.64628-1-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/platform/x86/ideapad-laptop.c | 23 ++++++++++------------- + 1 file changed, 10 insertions(+), 13 deletions(-) + +diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c +index 0eb5bfdd..959ec3c5 100644 +--- a/drivers/platform/x86/ideapad-laptop.c ++++ b/drivers/platform/x86/ideapad-laptop.c +@@ -1170,7 +1170,6 @@ static const struct key_entry ideapad_keymap[] = { + { KE_KEY, 65, { KEY_PROG4 } }, + { KE_KEY, 66, { KEY_TOUCHPAD_OFF } }, + { KE_KEY, 67, { KEY_TOUCHPAD_ON } }, +- { KE_KEY, 68, { KEY_TOUCHPAD_TOGGLE } }, + { KE_KEY, 128, { KEY_ESC } }, + + /* +@@ -1526,18 +1525,16 @@ static void ideapad_sync_touchpad_state(struct ideapad_private *priv, bool send_ + if (priv->features.ctrl_ps2_aux_port) + i8042_command(¶m, value ? I8042_CMD_AUX_ENABLE : I8042_CMD_AUX_DISABLE); + +- if (send_events) { +- /* +- * On older models the EC controls the touchpad and toggles it +- * on/off itself, in this case we report KEY_TOUCHPAD_ON/_OFF. +- * If the EC did not toggle, report KEY_TOUCHPAD_TOGGLE. +- */ +- if (value != priv->r_touchpad_val) { +- ideapad_input_report(priv, value ? 67 : 66); +- sysfs_notify(&priv->platform_device->dev.kobj, NULL, "touchpad"); +- } else { +- ideapad_input_report(priv, 68); +- } ++ /* ++ * On older models the EC controls the touchpad and toggles it on/off ++ * itself, in this case we report KEY_TOUCHPAD_ON/_OFF. Some models do ++ * an acpi-notify with VPC bit 5 set on resume, so this function get ++ * called with send_events=true on every resume. Therefor if the EC did ++ * not toggle, do nothing to avoid sending spurious KEY_TOUCHPAD_TOGGLE. ++ */ ++ if (send_events && value != priv->r_touchpad_val) { ++ ideapad_input_report(priv, value ? 67 : 66); ++ sysfs_notify(&priv->platform_device->dev.kobj, NULL, "touchpad"); + } + + priv->r_touchpad_val = value; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-151-thermal-intel-int340x-processor_thermal-Fix-ad.patch b/patches.kernel.org/6.2.10-151-thermal-intel-int340x-processor_thermal-Fix-ad.patch new file mode 100644 index 0000000..0369f95 --- /dev/null +++ b/patches.kernel.org/6.2.10-151-thermal-intel-int340x-processor_thermal-Fix-ad.patch @@ -0,0 +1,46 @@ +From: Srinivas Pandruvada +Date: Wed, 29 Mar 2023 08:22:07 -0700 +Subject: [PATCH] thermal: intel: int340x: processor_thermal: Fix additional + deadlock +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: a57cc2dbb3738930d9cb361b9b473f90c8ede0b8 + +commit a57cc2dbb3738930d9cb361b9b473f90c8ede0b8 upstream. + +Commit 52f04f10b900 ("thermal: intel: int340x: processor_thermal: Fix +deadlock") addressed deadlock issue during user space trip update. But it +missed a case when thermal zone device is disabled when user writes 0. + +Call to thermal_zone_device_disable() also causes deadlock as it also +tries to lock tz->lock, which is already claimed by trip_point_temp_store() +in the thermal core code. + +Remove call to thermal_zone_device_disable() in the function +sys_set_trip_temp(), which is called from trip_point_temp_store(). + +Fixes: 52f04f10b900 ("thermal: intel: int340x: processor_thermal: Fix deadlock") +Signed-off-by: Srinivas Pandruvada +Cc: 6.2+ # 6.2+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + .../thermal/intel/int340x_thermal/processor_thermal_device_pci.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c +index acc11ad5..cb898023 100644 +--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c ++++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c +@@ -181,7 +181,6 @@ static int sys_set_trip_temp(struct thermal_zone_device *tzd, int trip, int temp + cancel_delayed_work_sync(&pci_info->work); + proc_thermal_mmio_write(pci_info, PROC_THERMAL_MMIO_INT_ENABLE_0, 0); + proc_thermal_mmio_write(pci_info, PROC_THERMAL_MMIO_THRES_0, 0); +- thermal_zone_device_disable(tzd); + pci_info->stored_thres = 0; + return 0; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-152-powerpc-Don-t-try-to-copy-PPR-for-task-with-NU.patch b/patches.kernel.org/6.2.10-152-powerpc-Don-t-try-to-copy-PPR-for-task-with-NU.patch new file mode 100644 index 0000000..b225c9a --- /dev/null +++ b/patches.kernel.org/6.2.10-152-powerpc-Don-t-try-to-copy-PPR-for-task-with-NU.patch @@ -0,0 +1,87 @@ +From: Jens Axboe +Date: Sun, 26 Mar 2023 16:15:57 -0600 +Subject: [PATCH] powerpc: Don't try to copy PPR for task with NULL pt_regs +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: fd7276189450110ed835eb0a334e62d2f1c4e3be + +commit fd7276189450110ed835eb0a334e62d2f1c4e3be upstream. + +powerpc sets up PF_KTHREAD and PF_IO_WORKER with a NULL pt_regs, which +from my (arguably very short) checking is not commonly done for other +archs. This is fine, except when PF_IO_WORKER's have been created and +the task does something that causes a coredump to be generated. Then we +get this crash: + + Kernel attempted to read user page (160) - exploit attempt? (uid: 1000) + BUG: Kernel NULL pointer dereference on read at 0x00000160 + Faulting instruction address: 0xc0000000000c3a60 + Oops: Kernel access of bad area, sig: 11 [#1] + LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=32 NUMA pSeries + Modules linked in: bochs drm_vram_helper drm_kms_helper xts binfmt_misc ecb ctr syscopyarea sysfillrect cbc sysimgblt drm_ttm_helper aes_generic ttm sg libaes evdev joydev virtio_balloon vmx_crypto gf128mul drm dm_mod fuse loop configfs drm_panel_orientation_quirks ip_tables x_tables autofs4 hid_generic usbhid hid xhci_pci xhci_hcd usbcore usb_common sd_mod + CPU: 1 PID: 1982 Comm: ppc-crash Not tainted 6.3.0-rc2+ #88 + Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,HEAD hv:linux,kvm pSeries + NIP: c0000000000c3a60 LR: c000000000039944 CTR: c0000000000398e0 + REGS: c0000000041833b0 TRAP: 0300 Not tainted (6.3.0-rc2+) + MSR: 800000000280b033 CR: 88082828 XER: 200400f8 + ... + NIP memcpy_power7+0x200/0x7d0 + LR ppr_get+0x64/0xb0 + Call Trace: + ppr_get+0x40/0xb0 (unreliable) + __regset_get+0x180/0x1f0 + regset_get_alloc+0x64/0x90 + elf_core_dump+0xb98/0x1b60 + do_coredump+0x1c34/0x24a0 + get_signal+0x71c/0x1410 + do_notify_resume+0x140/0x6f0 + interrupt_exit_user_prepare_main+0x29c/0x320 + interrupt_exit_user_prepare+0x6c/0xa0 + interrupt_return_srr_user+0x8/0x138 + +Because ppr_get() is trying to copy from a PF_IO_WORKER with a NULL +pt_regs. + +Check for a valid pt_regs in both ppc_get/ppr_set, and return an error +if not set. The actual error value doesn't seem to be important here, so +just pick -EINVAL. + +Fixes: fa439810cc1b ("powerpc/ptrace: Enable support for NT_PPPC_TAR, NT_PPC_PPR, NT_PPC_DSCR") +Cc: stable@vger.kernel.org # v4.8+ +Signed-off-by: Jens Axboe +[mpe: Trim oops in change log, add Fixes & Cc stable] +Signed-off-by: Michael Ellerman +Link: https://msgid.link/d9f63344-fe7c-56ae-b420-4a1a04a2ae4c@kernel.dk +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/powerpc/kernel/ptrace/ptrace-view.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/powerpc/kernel/ptrace/ptrace-view.c b/arch/powerpc/kernel/ptrace/ptrace-view.c +index 2087a785..5fff0d04 100644 +--- a/arch/powerpc/kernel/ptrace/ptrace-view.c ++++ b/arch/powerpc/kernel/ptrace/ptrace-view.c +@@ -290,6 +290,9 @@ static int gpr_set(struct task_struct *target, const struct user_regset *regset, + static int ppr_get(struct task_struct *target, const struct user_regset *regset, + struct membuf to) + { ++ if (!target->thread.regs) ++ return -EINVAL; ++ + return membuf_write(&to, &target->thread.regs->ppr, sizeof(u64)); + } + +@@ -297,6 +300,9 @@ static int ppr_set(struct task_struct *target, const struct user_regset *regset, + unsigned int pos, unsigned int count, const void *kbuf, + const void __user *ubuf) + { ++ if (!target->thread.regs) ++ return -EINVAL; ++ + return user_regset_copyin(&pos, &count, &kbuf, &ubuf, + &target->thread.regs->ppr, 0, sizeof(u64)); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-153-powerpc-pseries-vas-Ignore-VAS-update-for-DLPA.patch b/patches.kernel.org/6.2.10-153-powerpc-pseries-vas-Ignore-VAS-update-for-DLPA.patch new file mode 100644 index 0000000..48a902a --- /dev/null +++ b/patches.kernel.org/6.2.10-153-powerpc-pseries-vas-Ignore-VAS-update-for-DLPA.patch @@ -0,0 +1,67 @@ +From: Haren Myneni +Date: Mon, 20 Mar 2023 19:50:08 -0700 +Subject: [PATCH] powerpc/pseries/vas: Ignore VAS update for DLPAR if + copy/paste is not enabled +References: bsc#1012628 bsc#1210216 ltc#202189 +Patch-mainline: 6.2.10 +Git-commit: eca9f6e6f83b6725b84e1c76fdde19b003cff0eb + +commit eca9f6e6f83b6725b84e1c76fdde19b003cff0eb upstream. + +The hypervisor supports user-mode NX from Power10. + +pseries_vas_dlpar_cpu() is called from lparcfg_write() to update VAS +windows for DLPAR event in shared processor mode and the kernel gets +-ENOTSUPP for HCALLs if the user-mode NX is not supported. The current +VAS implementation also supports only with Radix page tables. Whereas in +dedicated processor mode, pseries_vas_notifier() is registered only if +the copy/paste feature is enabled. So instead of displaying HCALL error +messages, update VAS capabilities if the copy/paste feature is +available. + +This patch ignores updating VAS capabilities in pseries_vas_dlpar_cpu() +and returns success if the copy/paste feature is not enabled. Then +lparcfg_write() completes the processor DLPAR operations without any +failures. + +Fixes: 2147783d6bf0 ("powerpc/pseries: Use lparcfg to reconfig VAS windows for DLPAR CPU") +Cc: stable@vger.kernel.org # v6.1+ +Signed-off-by: Haren Myneni +Reviewed-by: Nathan Lynch +Signed-off-by: Michael Ellerman +Link: https://msgid.link/1d0e727e7dbd9a28627ef08ca9df9c86a50175e2.camel@linux.ibm.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/powerpc/platforms/pseries/vas.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/powerpc/platforms/pseries/vas.c b/arch/powerpc/platforms/pseries/vas.c +index 4ad6e510..94c023bb 100644 +--- a/arch/powerpc/platforms/pseries/vas.c ++++ b/arch/powerpc/platforms/pseries/vas.c +@@ -857,6 +857,13 @@ int pseries_vas_dlpar_cpu(void) + { + int new_nr_creds, rc; + ++ /* ++ * NX-GZIP is not enabled. Nothing to do for DLPAR event ++ */ ++ if (!copypaste_feat) ++ return 0; ++ ++ + rc = h_query_vas_capabilities(H_QUERY_VAS_CAPABILITIES, + vascaps[VAS_GZIP_DEF_FEAT_TYPE].feat, + (u64)virt_to_phys(&hv_cop_caps)); +@@ -1013,6 +1020,7 @@ static int __init pseries_vas_init(void) + * Linux supports user space COPY/PASTE only with Radix + */ + if (!radix_enabled()) { ++ copypaste_feat = false; + pr_err("API is supported only with radix page tables\n"); + return -ENOTSUPP; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-154-powerpc-64s-Fix-__pte_needs_flush-false-positi.patch b/patches.kernel.org/6.2.10-154-powerpc-64s-Fix-__pte_needs_flush-false-positi.patch new file mode 100644 index 0000000..c56ee90 --- /dev/null +++ b/patches.kernel.org/6.2.10-154-powerpc-64s-Fix-__pte_needs_flush-false-positi.patch @@ -0,0 +1,60 @@ +From: Benjamin Gray +Date: Fri, 3 Mar 2023 09:59:47 +1100 +Subject: [PATCH] powerpc/64s: Fix __pte_needs_flush() false positive warning +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 1abce0580b89464546ae06abd5891ebec43c9470 + +commit 1abce0580b89464546ae06abd5891ebec43c9470 upstream. + +Userspace PROT_NONE ptes set _PAGE_PRIVILEGED, triggering a false +positive debug assertion that __pte_flags_need_flush() is not called +on a kernel mapping. + +Detect when it is a userspace PROT_NONE page by checking the required +bits of PAGE_NONE are set, and none of the RWX bits are set. +pte_protnone() is insufficient here because it always returns 0 when +CONFIG_NUMA_BALANCING=n. + +Fixes: b11931e9adc1 ("powerpc/64s: add pte_needs_flush and huge_pmd_needs_flush") +Cc: stable@vger.kernel.org # v6.1+ +Reported-by: Russell Currey +Signed-off-by: Benjamin Gray +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230302225947.81083-1-bgray@linux.ibm.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/powerpc/include/asm/book3s/64/tlbflush.h | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/include/asm/book3s/64/tlbflush.h b/arch/powerpc/include/asm/book3s/64/tlbflush.h +index 2bbc0fcc..5e26c7f2 100644 +--- a/arch/powerpc/include/asm/book3s/64/tlbflush.h ++++ b/arch/powerpc/include/asm/book3s/64/tlbflush.h +@@ -148,6 +148,11 @@ static inline void flush_tlb_fix_spurious_fault(struct vm_area_struct *vma, + */ + } + ++static inline bool __pte_protnone(unsigned long pte) ++{ ++ return (pte & (pgprot_val(PAGE_NONE) | _PAGE_RWX)) == pgprot_val(PAGE_NONE); ++} ++ + static inline bool __pte_flags_need_flush(unsigned long oldval, + unsigned long newval) + { +@@ -164,8 +169,8 @@ static inline bool __pte_flags_need_flush(unsigned long oldval, + /* + * We do not expect kernel mappings or non-PTEs or not-present PTEs. + */ +- VM_WARN_ON_ONCE(oldval & _PAGE_PRIVILEGED); +- VM_WARN_ON_ONCE(newval & _PAGE_PRIVILEGED); ++ VM_WARN_ON_ONCE(!__pte_protnone(oldval) && oldval & _PAGE_PRIVILEGED); ++ VM_WARN_ON_ONCE(!__pte_protnone(newval) && newval & _PAGE_PRIVILEGED); + VM_WARN_ON_ONCE(!(oldval & _PAGE_PTE)); + VM_WARN_ON_ONCE(!(newval & _PAGE_PTE)); + VM_WARN_ON_ONCE(!(oldval & _PAGE_PRESENT)); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-155-NFSv4-Fix-hangs-when-recovering-open-state-aft.patch b/patches.kernel.org/6.2.10-155-NFSv4-Fix-hangs-when-recovering-open-state-aft.patch new file mode 100644 index 0000000..25c23b0 --- /dev/null +++ b/patches.kernel.org/6.2.10-155-NFSv4-Fix-hangs-when-recovering-open-state-aft.patch @@ -0,0 +1,52 @@ +From: Trond Myklebust +Date: Tue, 21 Mar 2023 00:17:36 -0400 +Subject: [PATCH] NFSv4: Fix hangs when recovering open state after a server + reboot +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 6165a16a5ad9b237bb3131cff4d3c601ccb8f9a3 + +commit 6165a16a5ad9b237bb3131cff4d3c601ccb8f9a3 upstream. + +When we're using a cached open stateid or a delegation in order to avoid +sending a CLAIM_PREVIOUS open RPC call to the server, we don't have a +new open stateid to present to update_open_stateid(). +Instead rely on nfs4_try_open_cached(), just as if we were doing a +normal open. + +Fixes: d2bfda2e7aa0 ("NFSv4: don't reprocess cached open CLAIM_PREVIOUS") +Cc: stable@vger.kernel.org +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/nfs/nfs4proc.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 4214286e..4f4ef7aa 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -1980,8 +1980,7 @@ _nfs4_opendata_reclaim_to_nfs4_state(struct nfs4_opendata *data) + if (!data->rpc_done) { + if (data->rpc_status) + return ERR_PTR(data->rpc_status); +- /* cached opens have already been processed */ +- goto update; ++ return nfs4_try_open_cached(data); + } + + ret = nfs_refresh_inode(inode, &data->f_attr); +@@ -1990,7 +1989,7 @@ _nfs4_opendata_reclaim_to_nfs4_state(struct nfs4_opendata *data) + + if (data->o_res.delegation_type != 0) + nfs4_opendata_check_deleg(data, state); +-update: ++ + if (!update_open_stateid(state, &data->o_res.stateid, + NULL, data->o_arg.fmode)) + return ERR_PTR(-EAGAIN); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-156-ALSA-hda-conexant-Partial-revert-of-a-quirk-fo.patch b/patches.kernel.org/6.2.10-156-ALSA-hda-conexant-Partial-revert-of-a-quirk-fo.patch new file mode 100644 index 0000000..93a40aa --- /dev/null +++ b/patches.kernel.org/6.2.10-156-ALSA-hda-conexant-Partial-revert-of-a-quirk-fo.patch @@ -0,0 +1,65 @@ +From: Takashi Iwai +Date: Mon, 20 Mar 2023 15:09:54 +0100 +Subject: [PATCH] ALSA: hda/conexant: Partial revert of a quirk for Lenovo +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: b871cb971c683f7f212e7ca3c9a6709a75785116 + +commit b871cb971c683f7f212e7ca3c9a6709a75785116 upstream. + +The recent commit f83bb2592482 ("ALSA: hda/conexant: Add quirk for +LENOVO 20149 Notebook model") introduced a quirk for the device with +17aa:3977, but this caused a regression on another model (Lenovo +Ideadpad U31) with the very same PCI SSID. And, through skimming over +the net, it seems that this PCI SSID is used for multiple different +models, so it's no good idea to apply the quirk with the SSID. + +Although we may take a different ID check (e.g. the codec SSID instead +of the PCI SSID), unfortunately, the original patch author couldn't +identify the hardware details any longer as the machine was returned, +and we can't develop the further proper fix. + +In this patch, instead, we partially revert the change so that the +quirk won't be applied as default for addressing the regression. +Meanwhile, the quirk function itself is kept, and it's now made to be +applicable via the explicit model=lenovo-20149 option. + +Fixes: f83bb2592482 ("ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model") +Reported-by: Jetro Jormalainen +Link: https://lore.kernel.org/r/20230308215009.4d3e58a6@mopti +Cc: +Link: https://lore.kernel.org/r/20230320140954.31154-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + sound/pci/hda/patch_conexant.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 75e1d000..a889cccd 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -980,7 +980,10 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK(0x17aa, 0x3905, "Lenovo G50-30", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC), +- SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_PINCFG_LENOVO_NOTEBOOK), ++ /* NOTE: we'd need to extend the quirk for 17aa:3977 as the same ++ * PCI SSID is used on multiple Lenovo models ++ */ ++ SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo G50-70", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI), +@@ -1003,6 +1006,7 @@ static const struct hda_model_fixup cxt5066_fixup_models[] = { + { .id = CXT_FIXUP_MUTE_LED_GPIO, .name = "mute-led-gpio" }, + { .id = CXT_FIXUP_HP_ZBOOK_MUTE_LED, .name = "hp-zbook-mute-led" }, + { .id = CXT_FIXUP_HP_MIC_NO_PRESENCE, .name = "hp-mic-fix" }, ++ { .id = CXT_PINCFG_LENOVO_NOTEBOOK, .name = "lenovo-20149" }, + {} + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-157-ALSA-usb-audio-Fix-regression-on-detection-of-.patch b/patches.kernel.org/6.2.10-157-ALSA-usb-audio-Fix-regression-on-detection-of-.patch new file mode 100644 index 0000000..1bf2ce6 --- /dev/null +++ b/patches.kernel.org/6.2.10-157-ALSA-usb-audio-Fix-regression-on-detection-of-.patch @@ -0,0 +1,52 @@ +From: Takashi Iwai +Date: Fri, 24 Mar 2023 08:50:05 +0100 +Subject: [PATCH] ALSA: usb-audio: Fix regression on detection of Roland VS-100 +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: fa4e7a6fa12b1132340785e14bd439cbe95b7a5a + +commit fa4e7a6fa12b1132340785e14bd439cbe95b7a5a upstream. + +It's been reported that the recent kernel can't probe the PCM devices +on Roland VS-100 properly, and it turned out to be a regression by the +recent addition of the bit shift range check for the format bits. +In the old code, we just did bit-shift and it resulted in zero, which +is then corrected to the standard PCM format, while the new code +explicitly returns an error in such a case. + +For addressing the regression, relax the check and fallback to the +standard PCM type (with the info output). + +Fixes: 43d5ca88dfcd ("ALSA: usb-audio: Fix potential out-of-bounds shift") +Cc: +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217084 +Link: https://lore.kernel.org/r/20230324075005.19403-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + sound/usb/format.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/usb/format.c b/sound/usb/format.c +index 405dc0bf..4b1c5ba1 100644 +--- a/sound/usb/format.c ++++ b/sound/usb/format.c +@@ -39,8 +39,12 @@ static u64 parse_audio_format_i_type(struct snd_usb_audio *chip, + case UAC_VERSION_1: + default: { + struct uac_format_type_i_discrete_descriptor *fmt = _fmt; +- if (format >= 64) +- return 0; /* invalid format */ ++ if (format >= 64) { ++ usb_audio_info(chip, ++ "%u:%d: invalid format type 0x%llx is detected, processed as PCM\n", ++ fp->iface, fp->altsetting, format); ++ format = UAC_FORMAT_TYPE_I_PCM; ++ } + sample_width = fmt->bBitResolution; + sample_bytes = fmt->bSubframeSize; + format = 1ULL << format; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-158-ALSA-hda-realtek-Add-quirks-for-some-Clevo-lap.patch b/patches.kernel.org/6.2.10-158-ALSA-hda-realtek-Add-quirks-for-some-Clevo-lap.patch new file mode 100644 index 0000000..5decc86 --- /dev/null +++ b/patches.kernel.org/6.2.10-158-ALSA-hda-realtek-Add-quirks-for-some-Clevo-lap.patch @@ -0,0 +1,66 @@ +From: Tim Crawford +Date: Fri, 17 Mar 2023 08:18:25 -0600 +Subject: [PATCH] ALSA: hda/realtek: Add quirks for some Clevo laptops +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: b7a5822810c4398515300d614d988cf638adecad + +commit b7a5822810c4398515300d614d988cf638adecad upstream. + +Add the audio quirk for some of Clevo's latest RPL laptops: + +- NP50RNJS (ALC256) +- NP70SNE (ALC256) +- PD50SNE (ALC1220) +- PE60RNE (ALC1220) + +Co-authored-by: Jeremy Soller +Signed-off-by: Tim Crawford +Cc: +Link: https://lore.kernel.org/r/20230317141825.11807-1-tcrawford@system76.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + sound/pci/hda/patch_realtek.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 28ac6c15..62c5486d 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2631,6 +2631,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { + SND_PCI_QUIRK(0x1558, 0x65e5, "Clevo PC50D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x65f1, "Clevo PC50HS", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x65f5, "Clevo PD50PN[NRT]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), ++ SND_PCI_QUIRK(0x1558, 0x66a2, "Clevo PE60RNE", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS), +@@ -2651,6 +2652,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { + SND_PCI_QUIRK(0x1558, 0x96e1, "Clevo P960[ER][CDFN]-K", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1558, 0x97e1, "Clevo P970[ER][CDFN]", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1558, 0x97e2, "Clevo P970RC-M", ALC1220_FIXUP_CLEVO_P950), ++ SND_PCI_QUIRK(0x1558, 0xd502, "Clevo PD50SNE", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD), + SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD), + SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", ALC882_FIXUP_LENOVO_Y530), +@@ -9574,6 +9576,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1558, 0x5101, "Clevo S510WU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x5157, "Clevo W517GU1", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x51a1, "Clevo NS50MU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x5630, "Clevo NP50RNJS", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x70a1, "Clevo NB70T[HJK]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x70b3, "Clevo NK70SB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x70f2, "Clevo NH79EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), +@@ -9608,6 +9611,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1558, 0x971d, "Clevo N970T[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0xa500, "Clevo NL5[03]RU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0xa600, "Clevo NL50NU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xa671, "Clevo NP70SN[CDE]", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0xb018, "Clevo NP50D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0xb019, "Clevo NH77D[BE]Q", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0xb022, "Clevo NH77D[DC][QW]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-159-ALSA-hda-realtek-Add-quirk-for-Lenovo-ZhaoYang.patch b/patches.kernel.org/6.2.10-159-ALSA-hda-realtek-Add-quirk-for-Lenovo-ZhaoYang.patch new file mode 100644 index 0000000..d135762 --- /dev/null +++ b/patches.kernel.org/6.2.10-159-ALSA-hda-realtek-Add-quirk-for-Lenovo-ZhaoYang.patch @@ -0,0 +1,38 @@ +From: huangwenhui +Date: Tue, 28 Mar 2023 15:46:44 +0800 +Subject: [PATCH] ALSA: hda/realtek: Add quirk for Lenovo ZhaoYang CF4620Z +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 52aad39385e1bfdb34a1b405f699a8ef302c58b0 + +commit 52aad39385e1bfdb34a1b405f699a8ef302c58b0 upstream. + +Fix headset microphone detection on Lenovo ZhaoYang CF4620Z. + +[ adjusted to be applicable to the latest tree -- tiwai ] + +Signed-off-by: huangwenhui +Cc: +Link: https://lore.kernel.org/r/20230328074644.30142-1-huangwenhuia@uniontech.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 62c5486d..070150bb 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9712,6 +9712,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x511e, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x511f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD), ++ SND_PCI_QUIRK(0x17aa, 0x9e56, "Lenovo ZhaoYang CF4620Z", ALC286_FIXUP_SONY_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1849, 0x1233, "ASRock NUC Box 1100", ALC233_FIXUP_NO_AUDIO_JACK), + SND_PCI_QUIRK(0x1849, 0xa233, "Positivo Master C6300", ALC269_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-160-xtensa-fix-KASAN-report-for-show_stack.patch b/patches.kernel.org/6.2.10-160-xtensa-fix-KASAN-report-for-show_stack.patch new file mode 100644 index 0000000..d49dfd7 --- /dev/null +++ b/patches.kernel.org/6.2.10-160-xtensa-fix-KASAN-report-for-show_stack.patch @@ -0,0 +1,59 @@ +From: Max Filippov +Date: Thu, 16 Mar 2023 23:00:21 -0700 +Subject: [PATCH] xtensa: fix KASAN report for show_stack +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 1d3b7a788ca7435156809a6bd5b20c95b2370d45 + +commit 1d3b7a788ca7435156809a6bd5b20c95b2370d45 upstream. + +show_stack dumps raw stack contents which may trigger an unnecessary +KASAN report. Fix it by copying stack contents to a temporary buffer +with __memcpy and then printing that buffer instead of passing stack +pointer directly to the print_hex_dump. + +Cc: stable@vger.kernel.org +Signed-off-by: Max Filippov +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/xtensa/kernel/traps.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/arch/xtensa/kernel/traps.c b/arch/xtensa/kernel/traps.c +index cd98366a..f0a7d1c2 100644 +--- a/arch/xtensa/kernel/traps.c ++++ b/arch/xtensa/kernel/traps.c +@@ -539,7 +539,7 @@ static size_t kstack_depth_to_print = CONFIG_PRINT_STACK_DEPTH; + + void show_stack(struct task_struct *task, unsigned long *sp, const char *loglvl) + { +- size_t len; ++ size_t len, off = 0; + + if (!sp) + sp = stack_pointer(task); +@@ -548,9 +548,17 @@ void show_stack(struct task_struct *task, unsigned long *sp, const char *loglvl) + kstack_depth_to_print * STACK_DUMP_ENTRY_SIZE); + + printk("%sStack:\n", loglvl); +- print_hex_dump(loglvl, " ", DUMP_PREFIX_NONE, +- STACK_DUMP_LINE_SIZE, STACK_DUMP_ENTRY_SIZE, +- sp, len, false); ++ while (off < len) { ++ u8 line[STACK_DUMP_LINE_SIZE]; ++ size_t line_len = len - off > STACK_DUMP_LINE_SIZE ? ++ STACK_DUMP_LINE_SIZE : len - off; ++ ++ __memcpy(line, (u8 *)sp + off, line_len); ++ print_hex_dump(loglvl, " ", DUMP_PREFIX_NONE, ++ STACK_DUMP_LINE_SIZE, STACK_DUMP_ENTRY_SIZE, ++ line, line_len, false); ++ off += STACK_DUMP_LINE_SIZE; ++ } + show_trace(task, sp, loglvl); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-161-rcu-Fix-rcu_torture_read-ftrace-event.patch b/patches.kernel.org/6.2.10-161-rcu-Fix-rcu_torture_read-ftrace-event.patch new file mode 100644 index 0000000..ad1cd04 --- /dev/null +++ b/patches.kernel.org/6.2.10-161-rcu-Fix-rcu_torture_read-ftrace-event.patch @@ -0,0 +1,45 @@ +From: Douglas Raillard +Date: Mon, 6 Mar 2023 12:27:43 +0000 +Subject: [PATCH] rcu: Fix rcu_torture_read ftrace event +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: d18a04157fc171fd48075e3dc96471bd3b87f0dd + +commit d18a04157fc171fd48075e3dc96471bd3b87f0dd upstream. + +Fix the rcutorturename field so that its size is correctly reported in +the text format embedded in trace.dat files. As it stands, it is +reported as being of size 1: + + field:char rcutorturename[8]; offset:8; size:1; signed:0; + +Signed-off-by: Douglas Raillard +Reviewed-by: Mukesh Ojha +Cc: stable@vger.kernel.org +Fixes: 04ae87a52074e ("ftrace: Rework event_create_dir()") +Reviewed-by: Steven Rostedt (Google) +[ boqun: Add "Cc" and "Fixes" tags per Steven ] +Signed-off-by: Boqun Feng +Signed-off-by: Paul E. McKenney +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + include/trace/events/rcu.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/trace/events/rcu.h b/include/trace/events/rcu.h +index 90b2fb02..012fa0d1 100644 +--- a/include/trace/events/rcu.h ++++ b/include/trace/events/rcu.h +@@ -768,7 +768,7 @@ TRACE_EVENT_RCU(rcu_torture_read, + TP_ARGS(rcutorturename, rhp, secs, c_old, c), + + TP_STRUCT__entry( +- __field(char, rcutorturename[RCUTORTURENAME_LEN]) ++ __array(char, rcutorturename, RCUTORTURENAME_LEN) + __field(struct rcu_head *, rhp) + __field(unsigned long, secs) + __field(unsigned long, c_old) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-162-dt-bindings-mtd-jedec-spi-nor-Document-CPOL-CP.patch b/patches.kernel.org/6.2.10-162-dt-bindings-mtd-jedec-spi-nor-Document-CPOL-CP.patch new file mode 100644 index 0000000..554212d --- /dev/null +++ b/patches.kernel.org/6.2.10-162-dt-bindings-mtd-jedec-spi-nor-Document-CPOL-CP.patch @@ -0,0 +1,53 @@ +From: Geert Uytterhoeven +Date: Tue, 14 Feb 2023 15:26:43 +0100 +Subject: [PATCH] dt-bindings: mtd: jedec,spi-nor: Document CPOL/CPHA support +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: a56cde41340ac4049fa6edac9e6cfbcd2804074e + +commit a56cde41340ac4049fa6edac9e6cfbcd2804074e upstream. + +SPI EEPROMs typically support both SPI Mode 0 (CPOL=CPHA=0) and Mode 3 +(CPOL=CPHA=1). However, using the latter is currently flagged as an +error by "make dtbs_check", e.g.: + + arch/arm/boot/dts/r8a7791-koelsch.dtb: flash@0: Unevaluated properties are not allowed ('spi-cpha', 'spi-cpol' were unexpected) + From schema: Documentation/devicetree/bindings/mtd/jedec,spi-nor.yaml + +Fix this by documenting support for CPOL=CPHA=1. + +Fixes: 233363aba72ac638 ("spi/panel: dt-bindings: drop CPHA and CPOL from common properties") +Cc: stable@vger.kernel.org +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Miquel Raynal +Reviewed-by: Krzysztof Kozlowski +Reviewed-by: Tudor Ambarus +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/afe470603028db9374930b0c57464b1f6d52bdd3.1676384304.git.geert+renesas@glider.be +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + Documentation/devicetree/bindings/mtd/jedec,spi-nor.yaml | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/Documentation/devicetree/bindings/mtd/jedec,spi-nor.yaml b/Documentation/devicetree/bindings/mtd/jedec,spi-nor.yaml +index 3fe981b1..54736362 100644 +--- a/Documentation/devicetree/bindings/mtd/jedec,spi-nor.yaml ++++ b/Documentation/devicetree/bindings/mtd/jedec,spi-nor.yaml +@@ -76,6 +76,13 @@ properties: + If "broken-flash-reset" is present then having this property does not + make any difference. + ++ spi-cpol: true ++ spi-cpha: true ++ ++dependencies: ++ spi-cpol: [ spi-cpha ] ++ spi-cpha: [ spi-cpol ] ++ + unevaluatedProperties: false + + examples: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-163-s390-uaccess-add-missing-earlyclobber-annotati.patch b/patches.kernel.org/6.2.10-163-s390-uaccess-add-missing-earlyclobber-annotati.patch new file mode 100644 index 0000000..a9f1fb1 --- /dev/null +++ b/patches.kernel.org/6.2.10-163-s390-uaccess-add-missing-earlyclobber-annotati.patch @@ -0,0 +1,44 @@ +From: Heiko Carstens +Date: Thu, 23 Mar 2023 13:09:16 +0100 +Subject: [PATCH] s390/uaccess: add missing earlyclobber annotations to + __clear_user() +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 89aba4c26fae4e459f755a18912845c348ee48f3 + +commit 89aba4c26fae4e459f755a18912845c348ee48f3 upstream. + +Add missing earlyclobber annotation to size, to, and tmp2 operands of the +__clear_user() inline assembly since they are modified or written to before +the last usage of all input operands. This can lead to incorrect register +allocation for the inline assembly. + +Fixes: 6c2a9e6df604 ("[S390] Use alternative user-copy operations for new hardware.") +Reported-by: Mark Rutland +Link: https://lore.kernel.org/all/20230321122514.1743889-3-mark.rutland@arm.com/ +Cc: stable@vger.kernel.org +Reviewed-by: Gerald Schaefer +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/s390/lib/uaccess.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/lib/uaccess.c b/arch/s390/lib/uaccess.c +index 720036fb..d4421407 100644 +--- a/arch/s390/lib/uaccess.c ++++ b/arch/s390/lib/uaccess.c +@@ -172,7 +172,7 @@ unsigned long __clear_user(void __user *to, unsigned long size) + "4: slgr %0,%0\n" + "5:\n" + EX_TABLE(0b,2b) EX_TABLE(6b,2b) EX_TABLE(3b,5b) EX_TABLE(7b,5b) +- : "+a" (size), "+a" (to), "+a" (tmp1), "=a" (tmp2) ++ : "+&a" (size), "+&a" (to), "+a" (tmp1), "=&a" (tmp2) + : "a" (empty_zero_page), [spec] "d" (spec.val) + : "cc", "memory", "0"); + return size; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-164-s390-reintroduce-expoline-dependence-to-script.patch b/patches.kernel.org/6.2.10-164-s390-reintroduce-expoline-dependence-to-script.patch new file mode 100644 index 0000000..37c941a --- /dev/null +++ b/patches.kernel.org/6.2.10-164-s390-reintroduce-expoline-dependence-to-script.patch @@ -0,0 +1,54 @@ +From: "Jiri Slaby (SUSE)" +Date: Thu, 16 Mar 2023 12:28:09 +0100 +Subject: [PATCH] s390: reintroduce expoline dependence to scripts +Patch-mainline: 6.2.10 +References: & bsc#1012628 expolines fixdep s390 +Git-commit: 7bb2107e63d8a4a13bbb6fe0e1cbd68784a2e9ac + +commit 7bb2107e63d8a4a13bbb6fe0e1cbd68784a2e9ac upstream. + +Expolines depend on scripts/basic/fixdep. And build of expolines can now +race with the fixdep build: + + make[1]: *** Deleting file 'arch/s390/lib/expoline/expoline.o' + /bin/sh: line 1: scripts/basic/fixdep: Permission denied + make[1]: *** [../scripts/Makefile.build:385: arch/s390/lib/expoline/expoline.o] Error 126 + make: *** [../arch/s390/Makefile:166: expoline_prepare] Error 2 + +The dependence was removed in the below Fixes: commit. So reintroduce +the dependence on scripts. + +Fixes: a0b0987a7811 ("s390/nospec: remove unneeded header includes") +Cc: Joe Lawrence +Cc: stable@vger.kernel.org +Cc: Heiko Carstens +Cc: Vasily Gorbik +Cc: Alexander Gordeev +Cc: Christian Borntraeger +Cc: Sven Schnelle +Cc: linux-s390@vger.kernel.org +Signed-off-by: Jiri Slaby (SUSE) +Link: https://lore.kernel.org/r/20230316112809.7903-1-jirislaby@kernel.org +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/s390/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/Makefile b/arch/s390/Makefile +index b3235ab0..ed646c58 100644 +--- a/arch/s390/Makefile ++++ b/arch/s390/Makefile +@@ -162,7 +162,7 @@ vdso_prepare: prepare0 + + ifdef CONFIG_EXPOLINE_EXTERN + modules_prepare: expoline_prepare +-expoline_prepare: ++expoline_prepare: scripts + $(Q)$(MAKE) $(build)=arch/s390/lib/expoline arch/s390/lib/expoline/expoline.o + endif + endif +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-165-drm-etnaviv-fix-reference-leak-when-mmaping-im.patch b/patches.kernel.org/6.2.10-165-drm-etnaviv-fix-reference-leak-when-mmaping-im.patch new file mode 100644 index 0000000..993ac87 --- /dev/null +++ b/patches.kernel.org/6.2.10-165-drm-etnaviv-fix-reference-leak-when-mmaping-im.patch @@ -0,0 +1,47 @@ +From: Lucas Stach +Date: Fri, 24 Feb 2023 18:21:54 +0100 +Subject: [PATCH] drm/etnaviv: fix reference leak when mmaping imported buffer +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 963b2e8c428f79489ceeb058e8314554ec9cbe6f + +commit 963b2e8c428f79489ceeb058e8314554ec9cbe6f upstream. + +drm_gem_prime_mmap() takes a reference on the GEM object, but before that +drm_gem_mmap_obj() already takes a reference, which will be leaked as only +one reference is dropped when the mapping is closed. Drop the extra +reference when dma_buf_mmap() succeeds. + +Cc: stable@vger.kernel.org +Signed-off-by: Lucas Stach +Reviewed-by: Christian Gmeiner +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c +index 7031db14..3524b581 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c +@@ -91,7 +91,15 @@ static void *etnaviv_gem_prime_vmap_impl(struct etnaviv_gem_object *etnaviv_obj) + static int etnaviv_gem_prime_mmap_obj(struct etnaviv_gem_object *etnaviv_obj, + struct vm_area_struct *vma) + { +- return dma_buf_mmap(etnaviv_obj->base.dma_buf, vma, 0); ++ int ret; ++ ++ ret = dma_buf_mmap(etnaviv_obj->base.dma_buf, vma, 0); ++ if (!ret) { ++ /* Drop the reference acquired by drm_gem_mmap_obj(). */ ++ drm_gem_object_put(&etnaviv_obj->base); ++ } ++ ++ return ret; + } + + static const struct etnaviv_gem_ops etnaviv_gem_prime_ops = { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-166-drm-amdgpu-allow-more-APUs-to-do-mode2-reset-w.patch b/patches.kernel.org/6.2.10-166-drm-amdgpu-allow-more-APUs-to-do-mode2-reset-w.patch new file mode 100644 index 0000000..0906dd0 --- /dev/null +++ b/patches.kernel.org/6.2.10-166-drm-amdgpu-allow-more-APUs-to-do-mode2-reset-w.patch @@ -0,0 +1,49 @@ +From: Tim Huang +Date: Thu, 30 Mar 2023 10:33:02 +0800 +Subject: [PATCH] drm/amdgpu: allow more APUs to do mode2 reset when go to S4 +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 2fec9dc8e0acc3dfb56d1389151bcf405f087b10 + +commit 2fec9dc8e0acc3dfb56d1389151bcf405f087b10 upstream. + +Skip mode2 reset only for IMU enabled APUs when do S4. + +This patch is to fix the regression issue +https://gitlab.freedesktop.org/drm/amd/-/issues/2483 +It is generated by commit b589626674de ("drm/amdgpu: skip ASIC reset +for APUs when go to S4"). + +Fixes: b589626674de ("drm/amdgpu: skip ASIC reset for APUs when go to S4") +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2483 +Tested-by: Yuan Perry +Signed-off-by: Tim Huang +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.1.x +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +index f8736920..00a92e93 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +@@ -981,7 +981,12 @@ static bool amdgpu_atcs_pci_probe_handle(struct pci_dev *pdev) + */ + bool amdgpu_acpi_should_gpu_reset(struct amdgpu_device *adev) + { +- if (adev->flags & AMD_IS_APU) ++ if ((adev->flags & AMD_IS_APU) && ++ adev->gfx.imu.funcs) /* Not need to do mode2 reset for IMU enabled APUs */ ++ return false; ++ ++ if ((adev->flags & AMD_IS_APU) && ++ amdgpu_acpi_is_s3_active(adev)) + return false; + + if (amdgpu_sriov_vf(adev)) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-167-drm-amd-display-Add-DSC-Support-for-Synaptics-.patch b/patches.kernel.org/6.2.10-167-drm-amd-display-Add-DSC-Support-for-Synaptics-.patch new file mode 100644 index 0000000..e5c4daa --- /dev/null +++ b/patches.kernel.org/6.2.10-167-drm-amd-display-Add-DSC-Support-for-Synaptics-.patch @@ -0,0 +1,91 @@ +From: Fangzhi Zuo +Date: Fri, 24 Feb 2023 13:45:21 -0500 +Subject: [PATCH] drm/amd/display: Add DSC Support for Synaptics Cascaded MST + Hub +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: f4f3b7dedbe849e780c779ba67365bb1db0d8637 + +commit f4f3b7dedbe849e780c779ba67365bb1db0d8637 upstream. + +Traditional synaptics hub has one MST branch device without virtual dpcd. +Synaptics cascaded hub has two chained MST branch devices. DSC decoding +is performed via root MST branch device, instead of the second MST branch +device. + +Reviewed-by: Hersen Wu +Acked-by: Qingqing Zhuo +Signed-off-by: Fangzhi Zuo +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + .../display/amdgpu_dm/amdgpu_dm_mst_types.c | 19 +++++++++++++++++++ + .../display/amdgpu_dm/amdgpu_dm_mst_types.h | 12 ++++++++++++ + 2 files changed, 31 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +index abdbd435..3962706a 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +@@ -208,6 +208,21 @@ bool needs_dsc_aux_workaround(struct dc_link *link) + return false; + } + ++bool is_synaptics_cascaded_panamera(struct dc_link *link, struct drm_dp_mst_port *port) ++{ ++ u8 branch_vendor_data[4] = { 0 }; // Vendor data 0x50C ~ 0x50F ++ ++ if (drm_dp_dpcd_read(port->mgr->aux, DP_BRANCH_VENDOR_SPECIFIC_START, &branch_vendor_data, 4) == 4) { ++ if (link->dpcd_caps.branch_dev_id == DP_BRANCH_DEVICE_ID_90CC24 && ++ IS_SYNAPTICS_CASCADED_PANAMERA(link->dpcd_caps.branch_dev_name, branch_vendor_data)) { ++ DRM_INFO("Synaptics Cascaded MST hub\n"); ++ return true; ++ } ++ } ++ ++ return false; ++} ++ + static bool validate_dsc_caps_on_connector(struct amdgpu_dm_connector *aconnector) + { + struct dc_sink *dc_sink = aconnector->dc_sink; +@@ -231,6 +246,10 @@ static bool validate_dsc_caps_on_connector(struct amdgpu_dm_connector *aconnecto + needs_dsc_aux_workaround(aconnector->dc_link)) + aconnector->dsc_aux = &aconnector->mst_port->dm_dp_aux.aux; + ++ /* synaptics cascaded MST hub case */ ++ if (!aconnector->dsc_aux && is_synaptics_cascaded_panamera(aconnector->dc_link, port)) ++ aconnector->dsc_aux = port->mgr->aux; ++ + if (!aconnector->dsc_aux) + return false; + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h +index 97fd70df..0b575020 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h +@@ -34,6 +34,18 @@ + #define SYNAPTICS_RC_OFFSET 0x4BC + #define SYNAPTICS_RC_DATA 0x4C0 + ++#define DP_BRANCH_VENDOR_SPECIFIC_START 0x50C ++ ++/** ++ * Panamera MST Hub detection ++ * Offset DPCD 050Eh == 0x5A indicates cascaded MST hub case ++ * Check from beginning of branch device vendor specific field (050Ch) ++ */ ++#define IS_SYNAPTICS_PANAMERA(branchDevName) (((int)branchDevName[4] & 0xF0) == 0x50 ? 1 : 0) ++#define BRANCH_HW_REVISION_PANAMERA_A2 0x10 ++#define SYNAPTICS_CASCADED_HUB_ID 0x5A ++#define IS_SYNAPTICS_CASCADED_PANAMERA(devName, data) ((IS_SYNAPTICS_PANAMERA(devName) && ((int)data[2] == SYNAPTICS_CASCADED_HUB_ID)) ? 1 : 0) ++ + struct amdgpu_display_manager; + struct amdgpu_dm_connector; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-168-drm-amd-display-Take-FEC-Overhead-into-Timeslo.patch b/patches.kernel.org/6.2.10-168-drm-amd-display-Take-FEC-Overhead-into-Timeslo.patch new file mode 100644 index 0000000..de4d447 --- /dev/null +++ b/patches.kernel.org/6.2.10-168-drm-amd-display-Take-FEC-Overhead-into-Timeslo.patch @@ -0,0 +1,153 @@ +From: Fangzhi Zuo +Date: Tue, 28 Feb 2023 21:34:58 -0500 +Subject: [PATCH] drm/amd/display: Take FEC Overhead into Timeslot Calculation +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 68dc1846c3a44d5e633be145c169ce2fd5420695 + +commit 68dc1846c3a44d5e633be145c169ce2fd5420695 upstream. + +8b/10b encoding needs to add 3% fec overhead into the pbn. +In the Synapcis Cascaded MST hub, the first stage MST branch device +needs the information to determine the timeslot count for the +second stage MST branch device. Missing this overhead will leads to +insufficient timeslot allocation. + +Cc: stable@vger.kernel.org +Cc: Mario Limonciello +Reviewed-by: Hersen Wu +Acked-by: Qingqing Zhuo +Signed-off-by: Fangzhi Zuo +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + .../display/amdgpu_dm/amdgpu_dm_mst_types.c | 32 ++++++++++++++----- + .../display/amdgpu_dm/amdgpu_dm_mst_types.h | 3 ++ + 2 files changed, 27 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +index 3962706a..60dd8866 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +@@ -646,12 +646,25 @@ struct dsc_mst_fairness_params { + struct amdgpu_dm_connector *aconnector; + }; + +-static int kbps_to_peak_pbn(int kbps) ++static uint16_t get_fec_overhead_multiplier(struct dc_link *dc_link) ++{ ++ u8 link_coding_cap; ++ uint16_t fec_overhead_multiplier_x1000 = PBN_FEC_OVERHEAD_MULTIPLIER_8B_10B; ++ ++ link_coding_cap = dc_link_dp_mst_decide_link_encoding_format(dc_link); ++ if (link_coding_cap == DP_128b_132b_ENCODING) ++ fec_overhead_multiplier_x1000 = PBN_FEC_OVERHEAD_MULTIPLIER_128B_132B; ++ ++ return fec_overhead_multiplier_x1000; ++} ++ ++static int kbps_to_peak_pbn(int kbps, uint16_t fec_overhead_multiplier_x1000) + { + u64 peak_kbps = kbps; + + peak_kbps *= 1006; +- peak_kbps = div_u64(peak_kbps, 1000); ++ peak_kbps *= fec_overhead_multiplier_x1000; ++ peak_kbps = div_u64(peak_kbps, 1000 * 1000); + return (int) DIV64_U64_ROUND_UP(peak_kbps * 64, (54 * 8 * 1000)); + } + +@@ -745,11 +758,12 @@ static int increase_dsc_bpp(struct drm_atomic_state *state, + int link_timeslots_used; + int fair_pbn_alloc; + int ret = 0; ++ uint16_t fec_overhead_multiplier_x1000 = get_fec_overhead_multiplier(dc_link); + + for (i = 0; i < count; i++) { + if (vars[i + k].dsc_enabled) { + initial_slack[i] = +- kbps_to_peak_pbn(params[i].bw_range.max_kbps) - vars[i + k].pbn; ++ kbps_to_peak_pbn(params[i].bw_range.max_kbps, fec_overhead_multiplier_x1000) - vars[i + k].pbn; + bpp_increased[i] = false; + remaining_to_increase += 1; + } else { +@@ -845,6 +859,7 @@ static int try_disable_dsc(struct drm_atomic_state *state, + int next_index; + int remaining_to_try = 0; + int ret; ++ uint16_t fec_overhead_multiplier_x1000 = get_fec_overhead_multiplier(dc_link); + + for (i = 0; i < count; i++) { + if (vars[i + k].dsc_enabled +@@ -874,7 +889,7 @@ static int try_disable_dsc(struct drm_atomic_state *state, + if (next_index == -1) + break; + +- vars[next_index].pbn = kbps_to_peak_pbn(params[next_index].bw_range.stream_kbps); ++ vars[next_index].pbn = kbps_to_peak_pbn(params[next_index].bw_range.stream_kbps, fec_overhead_multiplier_x1000); + ret = drm_dp_atomic_find_time_slots(state, + params[next_index].port->mgr, + params[next_index].port, +@@ -887,7 +902,7 @@ static int try_disable_dsc(struct drm_atomic_state *state, + vars[next_index].dsc_enabled = false; + vars[next_index].bpp_x16 = 0; + } else { +- vars[next_index].pbn = kbps_to_peak_pbn(params[next_index].bw_range.max_kbps); ++ vars[next_index].pbn = kbps_to_peak_pbn(params[next_index].bw_range.max_kbps, fec_overhead_multiplier_x1000); + ret = drm_dp_atomic_find_time_slots(state, + params[next_index].port->mgr, + params[next_index].port, +@@ -916,6 +931,7 @@ static int compute_mst_dsc_configs_for_link(struct drm_atomic_state *state, + int count = 0; + int i, k, ret; + bool debugfs_overwrite = false; ++ uint16_t fec_overhead_multiplier_x1000 = get_fec_overhead_multiplier(dc_link); + + memset(params, 0, sizeof(params)); + +@@ -977,7 +993,7 @@ static int compute_mst_dsc_configs_for_link(struct drm_atomic_state *state, + /* Try no compression */ + for (i = 0; i < count; i++) { + vars[i + k].aconnector = params[i].aconnector; +- vars[i + k].pbn = kbps_to_peak_pbn(params[i].bw_range.stream_kbps); ++ vars[i + k].pbn = kbps_to_peak_pbn(params[i].bw_range.stream_kbps, fec_overhead_multiplier_x1000); + vars[i + k].dsc_enabled = false; + vars[i + k].bpp_x16 = 0; + ret = drm_dp_atomic_find_time_slots(state, params[i].port->mgr, params[i].port, +@@ -996,7 +1012,7 @@ static int compute_mst_dsc_configs_for_link(struct drm_atomic_state *state, + /* Try max compression */ + for (i = 0; i < count; i++) { + if (params[i].compression_possible && params[i].clock_force_enable != DSC_CLK_FORCE_DISABLE) { +- vars[i + k].pbn = kbps_to_peak_pbn(params[i].bw_range.min_kbps); ++ vars[i + k].pbn = kbps_to_peak_pbn(params[i].bw_range.min_kbps, fec_overhead_multiplier_x1000); + vars[i + k].dsc_enabled = true; + vars[i + k].bpp_x16 = params[i].bw_range.min_target_bpp_x16; + ret = drm_dp_atomic_find_time_slots(state, params[i].port->mgr, +@@ -1004,7 +1020,7 @@ static int compute_mst_dsc_configs_for_link(struct drm_atomic_state *state, + if (ret < 0) + return ret; + } else { +- vars[i + k].pbn = kbps_to_peak_pbn(params[i].bw_range.stream_kbps); ++ vars[i + k].pbn = kbps_to_peak_pbn(params[i].bw_range.stream_kbps, fec_overhead_multiplier_x1000); + vars[i + k].dsc_enabled = false; + vars[i + k].bpp_x16 = 0; + ret = drm_dp_atomic_find_time_slots(state, params[i].port->mgr, +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h +index 0b575020..1e4ede1e 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h +@@ -46,6 +46,9 @@ + #define SYNAPTICS_CASCADED_HUB_ID 0x5A + #define IS_SYNAPTICS_CASCADED_PANAMERA(devName, data) ((IS_SYNAPTICS_PANAMERA(devName) && ((int)data[2] == SYNAPTICS_CASCADED_HUB_ID)) ? 1 : 0) + ++#define PBN_FEC_OVERHEAD_MULTIPLIER_8B_10B 1031 ++#define PBN_FEC_OVERHEAD_MULTIPLIER_128B_132B 1000 ++ + struct amdgpu_display_manager; + struct amdgpu_dm_connector; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-169-drm-i915-gem-Flush-lmem-contents-after-constru.patch b/patches.kernel.org/6.2.10-169-drm-i915-gem-Flush-lmem-contents-after-constru.patch new file mode 100644 index 0000000..72e6564 --- /dev/null +++ b/patches.kernel.org/6.2.10-169-drm-i915-gem-Flush-lmem-contents-after-constru.patch @@ -0,0 +1,51 @@ +From: Chris Wilson +Date: Thu, 16 Mar 2023 17:59:18 +0100 +Subject: [PATCH] drm/i915/gem: Flush lmem contents after construction +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: d032ca43f2c80049ce5aabd3f208dc3849359497 + +commit d032ca43f2c80049ce5aabd3f208dc3849359497 upstream. + +i915_gem_object_create_lmem_from_data() lacks the flush of the data +written to lmem to ensure the object is marked as dirty and the writes +flushed to the backing store. Once created, we can immediately release +the obj->mm.mapping caching of the vmap. + +Fixes: 7acbbc7cf485 ("drm/i915/guc: put all guc objects in lmem when available") +Cc: Matthew Auld +Cc: Daniele Ceraolo Spurio +Cc: Andi Shyti +Cc: Matthew Brost +Cc: John Harrison +Signed-off-by: Chris Wilson +Cc: # v5.16+ +Signed-off-by: Nirmoy Das +Reviewed-by: Andi Shyti +Reviewed-by: Nirmoy Das +Link: https://patchwork.freedesktop.org/patch/msgid/20230316165918.13074-1-nirmoy.das@intel.com +(cherry picked from commit e2ee10474ce766686e7a7496585cdfaf79e3a1bf) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/gem/i915_gem_lmem.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_lmem.c b/drivers/gpu/drm/i915/gem/i915_gem_lmem.c +index 8949fb0a..3198b64a 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_lmem.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_lmem.c +@@ -127,7 +127,8 @@ i915_gem_object_create_lmem_from_data(struct drm_i915_private *i915, + + memcpy(map, data, size); + +- i915_gem_object_unpin_map(obj); ++ i915_gem_object_flush_map(obj); ++ __i915_gem_object_release_map(obj); + + return obj; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-170-drm-i915-dpt-Treat-the-DPT-BO-as-a-framebuffer.patch b/patches.kernel.org/6.2.10-170-drm-i915-dpt-Treat-the-DPT-BO-as-a-framebuffer.patch new file mode 100644 index 0000000..69fa503 --- /dev/null +++ b/patches.kernel.org/6.2.10-170-drm-i915-dpt-Treat-the-DPT-BO-as-a-framebuffer.patch @@ -0,0 +1,95 @@ +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Mon, 20 Mar 2023 11:05:17 +0200 +Subject: [PATCH] drm/i915/dpt: Treat the DPT BO as a framebuffer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 3413881e1ecc3cba722a2e87ec099692eed5be28 + +commit 3413881e1ecc3cba722a2e87ec099692eed5be28 upstream. + +Currently i915_gem_object_is_framebuffer() doesn't treat the +BO containing the framebuffer's DPT as a framebuffer itself. +This means eg. that the shrinker can evict the DPT BO while +leaving the actual FB BO bound, when the DPT is allocated +from regular shmem. + +That causes an immediate oops during hibernate as we +try to rewrite the PTEs inside the already evicted +DPT obj. + +TODO: presumably this might also be the reason for the +DPT related display faults under heavy memory pressure, +but I'm still not sure how that would happen as the object +should be pinned by intel_dpt_pin() while in active use by +the display engine... + +Cc: stable@vger.kernel.org +Cc: Juha-Pekka Heikkila +Cc: Matthew Auld +Cc: Imre Deak +Fixes: 0dc987b699ce ("drm/i915/display: Add smem fallback allocation for dpt") +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20230320090522.9909-2-ville.syrjala@linux.intel.com +Reviewed-by: Juha-Pekka Heikkila +(cherry picked from commit 779cb5ba64ec7df80675a956c9022929514f517a) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/display/intel_dpt.c | 2 ++ + drivers/gpu/drm/i915/gem/i915_gem_object.h | 2 +- + drivers/gpu/drm/i915/gem/i915_gem_object_types.h | 3 +++ + 3 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_dpt.c b/drivers/gpu/drm/i915/display/intel_dpt.c +index ad1a37b5..2a9f40a2 100644 +--- a/drivers/gpu/drm/i915/display/intel_dpt.c ++++ b/drivers/gpu/drm/i915/display/intel_dpt.c +@@ -301,6 +301,7 @@ intel_dpt_create(struct intel_framebuffer *fb) + vm->pte_encode = gen8_ggtt_pte_encode; + + dpt->obj = dpt_obj; ++ dpt->obj->is_dpt = true; + + return &dpt->vm; + } +@@ -309,5 +310,6 @@ void intel_dpt_destroy(struct i915_address_space *vm) + { + struct i915_dpt *dpt = i915_vm_to_dpt(vm); + ++ dpt->obj->is_dpt = false; + i915_vm_put(&dpt->vm); + } +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object.h b/drivers/gpu/drm/i915/gem/i915_gem_object.h +index 3db53769..2f53a683 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_object.h ++++ b/drivers/gpu/drm/i915/gem/i915_gem_object.h +@@ -319,7 +319,7 @@ i915_gem_object_never_mmap(const struct drm_i915_gem_object *obj) + static inline bool + i915_gem_object_is_framebuffer(const struct drm_i915_gem_object *obj) + { +- return READ_ONCE(obj->frontbuffer); ++ return READ_ONCE(obj->frontbuffer) || obj->is_dpt; + } + + static inline unsigned int +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object_types.h b/drivers/gpu/drm/i915/gem/i915_gem_object_types.h +index ab4c2f90..1d0d8ee9 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_object_types.h ++++ b/drivers/gpu/drm/i915/gem/i915_gem_object_types.h +@@ -491,6 +491,9 @@ struct drm_i915_gem_object { + */ + unsigned int cache_dirty:1; + ++ /* @is_dpt: Object houses a display page table (DPT) */ ++ unsigned int is_dpt:1; ++ + /** + * @read_domains: Read memory domains. + * +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-171-drm-i915-Disable-DC-states-for-all-commits.patch b/patches.kernel.org/6.2.10-171-drm-i915-Disable-DC-states-for-all-commits.patch new file mode 100644 index 0000000..fa6c772 --- /dev/null +++ b/patches.kernel.org/6.2.10-171-drm-i915-Disable-DC-states-for-all-commits.patch @@ -0,0 +1,115 @@ +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Mon, 20 Mar 2023 20:35:32 +0200 +Subject: [PATCH] drm/i915: Disable DC states for all commits +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: a2b6e99d8a623544f3bdccd28ee35b9c1b00daa5 + +commit a2b6e99d8a623544f3bdccd28ee35b9c1b00daa5 upstream. + +Keeping DC states enabled is incompatible with the _noarm()/_arm() +split we use for writing pipe/plane registers. When DC5 and PSR +are enabled, all pipe/plane registers effectively become self-arming +on account of DC5 exit arming the update, and PSR exit latching it. + +What probably saves us most of the time is that (with PIPE_MISC[21]=0) +all pipe register writes themselves trigger PSR exit, and then +we don't re-enter PSR until the idle frame count has elapsed. +So it may be that the PSR exit happens already before we've +updated the state too much. + +Also the PSR1 panel (at least on this KBL) seems to discard the first +frame we trasmit, presumably still scanning out from its internal +framebuffer at that point. So only the second frame we transmit is +actually visible. But I suppose that could also be panel specific +behaviour. I haven't checked out how other PSR panels behave, nor +did I bother to check what the eDP spec has to say about this. + +And since this really is all about DC states, let's switch from +the MODESET domain to the DC_OFF domain. Functionally they are +100% identical. We should probably remove the MODESET domain... + +And for good measure let's toss in an assert to the place where +we do the _noarm() register writes to make sure DC states are +in fact off. + +v2: Just use intel_display_power_is_enabled() (Imre) + +Cc: #v5.17+ +Cc: Manasi Navare +Cc: Drew Davenport +Cc: Jouni Högander +Reviewed-by: Imre Deak +Fixes: d13dde449580 ("drm/i915: Split pipe+output CSC programming to noarm+arm pair") +Fixes: f8a005eb8972 ("drm/i915: Optimize icl+ universal plane programming") +Fixes: 890b6ec4a522 ("drm/i915: Split skl+ plane update into noarm+arm pair") +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20230320183532.17727-1-ville.syrjala@linux.intel.com +(cherry picked from commit 41b4c7fe72b6105a4b49395eea9aa40cef94288d) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/display/intel_display.c | 28 +++++++++++++++++--- + 1 file changed, 25 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c +index 8b699485..f0aad240 100644 +--- a/drivers/gpu/drm/i915/display/intel_display.c ++++ b/drivers/gpu/drm/i915/display/intel_display.c +@@ -7107,6 +7107,8 @@ static void intel_update_crtc(struct intel_atomic_state *state, + + intel_fbc_update(state, crtc); + ++ drm_WARN_ON(&i915->drm, !intel_display_power_is_enabled(i915, POWER_DOMAIN_DC_OFF)); ++ + if (!modeset && + intel_crtc_needs_color_update(new_crtc_state)) + intel_color_commit_noarm(new_crtc_state); +@@ -7480,8 +7482,28 @@ static void intel_atomic_commit_tail(struct intel_atomic_state *state) + drm_atomic_helper_wait_for_dependencies(&state->base); + drm_dp_mst_atomic_wait_for_dependencies(&state->base); + +- if (state->modeset) +- wakeref = intel_display_power_get(dev_priv, POWER_DOMAIN_MODESET); ++ /* ++ * During full modesets we write a lot of registers, wait ++ * for PLLs, etc. Doing that while DC states are enabled ++ * is not a good idea. ++ * ++ * During fastsets and other updates we also need to ++ * disable DC states due to the following scenario: ++ * 1. DC5 exit and PSR exit happen ++ * 2. Some or all _noarm() registers are written ++ * 3. Due to some long delay PSR is re-entered ++ * 4. DC5 entry -> DMC saves the already written new ++ * _noarm() registers and the old not yet written ++ * _arm() registers ++ * 5. DC5 exit -> DMC restores a mixture of old and ++ * new register values and arms the update ++ * 6. PSR exit -> hardware latches a mixture of old and ++ * new register values -> corrupted frame, or worse ++ * 7. New _arm() registers are finally written ++ * 8. Hardware finally latches a complete set of new ++ * register values, and subsequent frames will be OK again ++ */ ++ wakeref = intel_display_power_get(dev_priv, POWER_DOMAIN_DC_OFF); + + intel_atomic_prepare_plane_clear_colors(state); + +@@ -7625,8 +7647,8 @@ static void intel_atomic_commit_tail(struct intel_atomic_state *state) + * the culprit. + */ + intel_uncore_arm_unclaimed_mmio_detection(&dev_priv->uncore); +- intel_display_power_put(dev_priv, POWER_DOMAIN_MODESET, wakeref); + } ++ intel_display_power_put(dev_priv, POWER_DOMAIN_DC_OFF, wakeref); + intel_runtime_pm_put(&dev_priv->runtime_pm, state->wakeref); + + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-172-drm-i915-Split-icl_color_commit_noarm-from-skl.patch b/patches.kernel.org/6.2.10-172-drm-i915-Split-icl_color_commit_noarm-from-skl.patch new file mode 100644 index 0000000..d51da94 --- /dev/null +++ b/patches.kernel.org/6.2.10-172-drm-i915-Split-icl_color_commit_noarm-from-skl.patch @@ -0,0 +1,77 @@ +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Mon, 20 Mar 2023 11:54:33 +0200 +Subject: [PATCH] drm/i915: Split icl_color_commit_noarm() from + skl_color_commit_noarm() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 76b767d4d1cd052e455cf18e06929e8b2b70101d + +commit 76b767d4d1cd052e455cf18e06929e8b2b70101d upstream. + +We're going to want different behavior for skl/glk vs. icl +in .color_commit_noarm(), so split the hook into two. Arguably +we already had slightly different behaviour since +csc_enable/gamma_enable are never set on icl+, so the old +code was perhaps a bit confusing as well. + +Cc: #v5.19+ +Cc: Manasi Navare +Cc: Drew Davenport +Cc: Imre Deak +Cc: Jouni Högander +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20230320095438.17328-2-ville.syrjala@linux.intel.com +Reviewed-by: Imre Deak +(cherry picked from commit f161eb01f50ab31f2084975b43bce54b7b671e17) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/display/intel_color.c | 21 ++++++++++++++++++++- + 1 file changed, 20 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_color.c b/drivers/gpu/drm/i915/display/intel_color.c +index 250e83f1..fdb79d2d 100644 +--- a/drivers/gpu/drm/i915/display/intel_color.c ++++ b/drivers/gpu/drm/i915/display/intel_color.c +@@ -574,6 +574,25 @@ static void skl_color_commit_arm(const struct intel_crtc_state *crtc_state) + crtc_state->csc_mode); + } + ++static void icl_color_commit_arm(const struct intel_crtc_state *crtc_state) ++{ ++ struct intel_crtc *crtc = to_intel_crtc(crtc_state->uapi.crtc); ++ struct drm_i915_private *i915 = to_i915(crtc->base.dev); ++ enum pipe pipe = crtc->pipe; ++ ++ /* ++ * We don't (yet) allow userspace to control the pipe background color, ++ * so force it to black. ++ */ ++ intel_de_write(i915, SKL_BOTTOM_COLOR(pipe), 0); ++ ++ intel_de_write(i915, GAMMA_MODE(crtc->pipe), ++ crtc_state->gamma_mode); ++ ++ intel_de_write_fw(i915, PIPE_CSC_MODE(crtc->pipe), ++ crtc_state->csc_mode); ++} ++ + static struct drm_property_blob * + create_linear_lut(struct drm_i915_private *i915, int lut_size) + { +@@ -2287,7 +2306,7 @@ static const struct intel_color_funcs i9xx_color_funcs = { + static const struct intel_color_funcs icl_color_funcs = { + .color_check = icl_color_check, + .color_commit_noarm = icl_color_commit_noarm, +- .color_commit_arm = skl_color_commit_arm, ++ .color_commit_arm = icl_color_commit_arm, + .load_luts = icl_load_luts, + .read_luts = icl_read_luts, + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-173-drm-i915-Move-CSC-load-back-into-.color_commit.patch b/patches.kernel.org/6.2.10-173-drm-i915-Move-CSC-load-back-into-.color_commit.patch new file mode 100644 index 0000000..2adf350 --- /dev/null +++ b/patches.kernel.org/6.2.10-173-drm-i915-Move-CSC-load-back-into-.color_commit.patch @@ -0,0 +1,107 @@ +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Mon, 20 Mar 2023 11:54:34 +0200 +Subject: [PATCH] drm/i915: Move CSC load back into .color_commit_arm() when + PSR is enabled on skl/glk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: a8e03e00b62073b494886dbff32f8b5338066c8b + +commit a8e03e00b62073b494886dbff32f8b5338066c8b upstream. + +SKL/GLK CSC unit suffers from a nasty issue where a CSC +coeff/offset register read or write between DC5 exit and +PSR exit will undo the CSC arming performed by DMC, and +then during PSR exit the hardware will latch zeroes into +the active CSC registers. This causes any plane going +through the CSC to output all black. + +We can sidestep the issue by making sure the PSR exit has +already actually happened before we touch the CSC coeff/offset +registers. Easiest way to guarantee that is to just move the +CSC programming back into the .color_commir_arm() as we force +a PSR exit (and crucially wait for it to actually happen) +prior to touching the arming registers. + +When PSR (and thus also DC states) are disabled we don't +have anything to worry about, so we can keep using the +more optional _noarm() hook for writing the CSC registers. + +Cc: #v5.19+ +Cc: Manasi Navare +Cc: Drew Davenport +Cc: Imre Deak +Cc: Jouni Högander +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8283 +Fixes: d13dde449580 ("drm/i915: Split pipe+output CSC programming to noarm+arm pair") +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20230320095438.17328-3-ville.syrjala@linux.intel.com +Reviewed-by: Imre Deak +(cherry picked from commit 80a892a4c2428b65366721599fc5fe50eaed35fd) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/display/intel_color.c | 23 ++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_color.c b/drivers/gpu/drm/i915/display/intel_color.c +index fdb79d2d..c3928d28 100644 +--- a/drivers/gpu/drm/i915/display/intel_color.c ++++ b/drivers/gpu/drm/i915/display/intel_color.c +@@ -514,6 +514,22 @@ static void icl_color_commit_noarm(const struct intel_crtc_state *crtc_state) + icl_load_csc_matrix(crtc_state); + } + ++static void skl_color_commit_noarm(const struct intel_crtc_state *crtc_state) ++{ ++ /* ++ * Possibly related to display WA #1184, SKL CSC loses the latched ++ * CSC coeff/offset register values if the CSC registers are disarmed ++ * between DC5 exit and PSR exit. This will cause the plane(s) to ++ * output all black (until CSC_MODE is rearmed and properly latched). ++ * Once PSR exit (and proper register latching) has occurred the ++ * danger is over. Thus when PSR is enabled the CSC coeff/offset ++ * register programming will be peformed from skl_color_commit_arm() ++ * which is called after PSR exit. ++ */ ++ if (!crtc_state->has_psr) ++ ilk_load_csc_matrix(crtc_state); ++} ++ + static void ilk_color_commit_noarm(const struct intel_crtc_state *crtc_state) + { + ilk_load_csc_matrix(crtc_state); +@@ -556,6 +572,9 @@ static void skl_color_commit_arm(const struct intel_crtc_state *crtc_state) + enum pipe pipe = crtc->pipe; + u32 val = 0; + ++ if (crtc_state->has_psr) ++ ilk_load_csc_matrix(crtc_state); ++ + /* + * We don't (yet) allow userspace to control the pipe background color, + * so force it to black, but apply pipe gamma and CSC appropriately +@@ -2313,7 +2332,7 @@ static const struct intel_color_funcs icl_color_funcs = { + + static const struct intel_color_funcs glk_color_funcs = { + .color_check = glk_color_check, +- .color_commit_noarm = ilk_color_commit_noarm, ++ .color_commit_noarm = skl_color_commit_noarm, + .color_commit_arm = skl_color_commit_arm, + .load_luts = glk_load_luts, + .read_luts = glk_read_luts, +@@ -2321,7 +2340,7 @@ static const struct intel_color_funcs glk_color_funcs = { + + static const struct intel_color_funcs skl_color_funcs = { + .color_check = ivb_color_check, +- .color_commit_noarm = ilk_color_commit_noarm, ++ .color_commit_noarm = skl_color_commit_noarm, + .color_commit_arm = skl_color_commit_arm, + .load_luts = bdw_load_luts, + .read_luts = NULL, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-174-KVM-arm64-PMU-Fix-GET_ONE_REG-for-vPMC-regs-to.patch b/patches.kernel.org/6.2.10-174-KVM-arm64-PMU-Fix-GET_ONE_REG-for-vPMC-regs-to.patch new file mode 100644 index 0000000..3a10db4 --- /dev/null +++ b/patches.kernel.org/6.2.10-174-KVM-arm64-PMU-Fix-GET_ONE_REG-for-vPMC-regs-to.patch @@ -0,0 +1,85 @@ +From: Reiji Watanabe +Date: Sun, 12 Mar 2023 20:32:08 -0700 +Subject: [PATCH] KVM: arm64: PMU: Fix GET_ONE_REG for vPMC regs to return the + current value +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 9228b26194d1cc00449f12f306f53ef2e234a55b + +commit 9228b26194d1cc00449f12f306f53ef2e234a55b upstream. + +Have KVM_GET_ONE_REG for vPMU counter (vPMC) registers (PMCCNTR_EL0 +and PMEVCNTR_EL0) return the sum of the register value in the sysreg +file and the current perf event counter value. + +Values of vPMC registers are saved in sysreg files on certain occasions. +These saved values don't represent the current values of the vPMC +registers if the perf events for the vPMCs count events after the save. +The current values of those registers are the sum of the sysreg file +value and the current perf event counter value. But, when userspace +reads those registers (using KVM_GET_ONE_REG), KVM returns the sysreg +file value to userspace (not the sum value). + +Fix this to return the sum value for KVM_GET_ONE_REG. + +Fixes: 051ff581ce70 ("arm64: KVM: Add access handler for event counter register") +Cc: stable@vger.kernel.org +Reviewed-by: Marc Zyngier +Signed-off-by: Reiji Watanabe +Link: https://lore.kernel.org/r/20230313033208.1475499-1-reijiw@google.com +Signed-off-by: Oliver Upton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm64/kvm/sys_regs.c | 21 +++++++++++++++++++-- + 1 file changed, 19 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c +index c6cbfe6b..c48c053d 100644 +--- a/arch/arm64/kvm/sys_regs.c ++++ b/arch/arm64/kvm/sys_regs.c +@@ -765,6 +765,22 @@ static bool pmu_counter_idx_valid(struct kvm_vcpu *vcpu, u64 idx) + return true; + } + ++static int get_pmu_evcntr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r, ++ u64 *val) ++{ ++ u64 idx; ++ ++ if (r->CRn == 9 && r->CRm == 13 && r->Op2 == 0) ++ /* PMCCNTR_EL0 */ ++ idx = ARMV8_PMU_CYCLE_IDX; ++ else ++ /* PMEVCNTRn_EL0 */ ++ idx = ((r->CRm & 3) << 3) | (r->Op2 & 7); ++ ++ *val = kvm_pmu_get_counter_value(vcpu, idx); ++ return 0; ++} ++ + static bool access_pmu_evcntr(struct kvm_vcpu *vcpu, + struct sys_reg_params *p, + const struct sys_reg_desc *r) +@@ -981,7 +997,7 @@ static bool access_pmuserenr(struct kvm_vcpu *vcpu, struct sys_reg_params *p, + /* Macro to expand the PMEVCNTRn_EL0 register */ + #define PMU_PMEVCNTR_EL0(n) \ + { PMU_SYS_REG(SYS_PMEVCNTRn_EL0(n)), \ +- .reset = reset_pmevcntr, \ ++ .reset = reset_pmevcntr, .get_user = get_pmu_evcntr, \ + .access = access_pmu_evcntr, .reg = (PMEVCNTR0_EL0 + n), } + + /* Macro to expand the PMEVTYPERn_EL0 register */ +@@ -1745,7 +1761,8 @@ static const struct sys_reg_desc sys_reg_descs[] = { + { PMU_SYS_REG(SYS_PMCEID1_EL0), + .access = access_pmceid, .reset = NULL }, + { PMU_SYS_REG(SYS_PMCCNTR_EL0), +- .access = access_pmu_evcntr, .reset = reset_unknown, .reg = PMCCNTR_EL0 }, ++ .access = access_pmu_evcntr, .reset = reset_unknown, ++ .reg = PMCCNTR_EL0, .get_user = get_pmu_evcntr}, + { PMU_SYS_REG(SYS_PMXEVTYPER_EL0), + .access = access_pmu_evtyper, .reset = NULL }, + { PMU_SYS_REG(SYS_PMXEVCNTR_EL0), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-175-KVM-arm64-PMU-Don-t-save-PMCR_EL0.-C-P-for-the.patch b/patches.kernel.org/6.2.10-175-KVM-arm64-PMU-Don-t-save-PMCR_EL0.-C-P-for-the.patch new file mode 100644 index 0000000..7a12bf8 --- /dev/null +++ b/patches.kernel.org/6.2.10-175-KVM-arm64-PMU-Don-t-save-PMCR_EL0.-C-P-for-the.patch @@ -0,0 +1,49 @@ +From: Reiji Watanabe +Date: Sun, 12 Mar 2023 20:32:34 -0700 +Subject: [PATCH] KVM: arm64: PMU: Don't save PMCR_EL0.{C,P} for the vCPU +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: f6da81f650fa47b61b847488f3938d43f90d093d + +commit f6da81f650fa47b61b847488f3938d43f90d093d upstream. + +Presently, when a guest writes 1 to PMCR_EL0.{C,P}, which is WO/RAZ, +KVM saves the register value, including these bits. +When userspace reads the register using KVM_GET_ONE_REG, KVM returns +the saved register value as it is (the saved value might have these +bits set). This could result in userspace setting these bits on the +destination during migration. Consequently, KVM may end up resetting +the vPMU counter registers (PMCCNTR_EL0 and/or PMEVCNTR_EL0) to +zero on the first KVM_RUN after migration. + +Fix this by not saving those bits when a guest writes 1 to those bits. + +Fixes: ab9468340d2b ("arm64: KVM: Add access handler for PMCR register") +Cc: stable@vger.kernel.org +Reviewed-by: Marc Zyngier +Signed-off-by: Reiji Watanabe +Link: https://lore.kernel.org/r/20230313033234.1475987-1-reijiw@google.com +Signed-off-by: Oliver Upton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm64/kvm/pmu-emul.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/kvm/pmu-emul.c b/arch/arm64/kvm/pmu-emul.c +index 24908400..c243b10f 100644 +--- a/arch/arm64/kvm/pmu-emul.c ++++ b/arch/arm64/kvm/pmu-emul.c +@@ -538,7 +538,8 @@ void kvm_pmu_handle_pmcr(struct kvm_vcpu *vcpu, u64 val) + if (!kvm_pmu_is_3p5(vcpu)) + val &= ~ARMV8_PMU_PMCR_LP; + +- __vcpu_sys_reg(vcpu, PMCR_EL0) = val; ++ /* The reset bits don't indicate any state, and shouldn't be saved. */ ++ __vcpu_sys_reg(vcpu, PMCR_EL0) = val & ~(ARMV8_PMU_PMCR_C | ARMV8_PMU_PMCR_P); + + if (val & ARMV8_PMU_PMCR_E) { + kvm_pmu_enable_counter_mask(vcpu, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-176-KVM-arm64-Retry-fault-if-vma_lookup-results-be.patch b/patches.kernel.org/6.2.10-176-KVM-arm64-Retry-fault-if-vma_lookup-results-be.patch new file mode 100644 index 0000000..587c230 --- /dev/null +++ b/patches.kernel.org/6.2.10-176-KVM-arm64-Retry-fault-if-vma_lookup-results-be.patch @@ -0,0 +1,113 @@ +From: David Matlack +Date: Mon, 13 Mar 2023 16:54:54 -0700 +Subject: [PATCH] KVM: arm64: Retry fault if vma_lookup() results become + invalid +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 13ec9308a85702af7c31f3638a2720863848a7f2 + +commit 13ec9308a85702af7c31f3638a2720863848a7f2 upstream. + +Read mmu_invalidate_seq before dropping the mmap_lock so that KVM can +detect if the results of vma_lookup() (e.g. vma_shift) become stale +before it acquires kvm->mmu_lock. This fixes a theoretical bug where a +VMA could be changed by userspace after vma_lookup() and before KVM +reads the mmu_invalidate_seq, causing KVM to install page table entries +based on a (possibly) no-longer-valid vma_shift. + +Re-order the MMU cache top-up to earlier in user_mem_abort() so that it +is not done after KVM has read mmu_invalidate_seq (i.e. so as to avoid +inducing spurious fault retries). + +This bug has existed since KVM/ARM's inception. It's unlikely that any +sane userspace currently modifies VMAs in such a way as to trigger this +race. And even with directed testing I was unable to reproduce it. But a +sufficiently motivated host userspace might be able to exploit this +race. + +Fixes: 94f8e6418d39 ("KVM: ARM: Handle guest faults in KVM") +Cc: stable@vger.kernel.org +Reported-by: Sean Christopherson +Signed-off-by: David Matlack +Reviewed-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230313235454.2964067-1-dmatlack@google.com +Signed-off-by: Oliver Upton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm64/kvm/mmu.c | 48 +++++++++++++++++++------------------------- + 1 file changed, 21 insertions(+), 27 deletions(-) + +diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c +index a3ee3b60..26df1653 100644 +--- a/arch/arm64/kvm/mmu.c ++++ b/arch/arm64/kvm/mmu.c +@@ -1217,6 +1217,20 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, + return -EFAULT; + } + ++ /* ++ * Permission faults just need to update the existing leaf entry, ++ * and so normally don't require allocations from the memcache. The ++ * only exception to this is when dirty logging is enabled at runtime ++ * and a write fault needs to collapse a block entry into a table. ++ */ ++ if (fault_status != ESR_ELx_FSC_PERM || ++ (logging_active && write_fault)) { ++ ret = kvm_mmu_topup_memory_cache(memcache, ++ kvm_mmu_cache_min_pages(kvm)); ++ if (ret) ++ return ret; ++ } ++ + /* + * Let's check if we will get back a huge page backed by hugetlbfs, or + * get block mapping for device MMIO region. +@@ -1269,37 +1283,17 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, + fault_ipa &= ~(vma_pagesize - 1); + + gfn = fault_ipa >> PAGE_SHIFT; +- mmap_read_unlock(current->mm); +- +- /* +- * Permission faults just need to update the existing leaf entry, +- * and so normally don't require allocations from the memcache. The +- * only exception to this is when dirty logging is enabled at runtime +- * and a write fault needs to collapse a block entry into a table. +- */ +- if (fault_status != ESR_ELx_FSC_PERM || +- (logging_active && write_fault)) { +- ret = kvm_mmu_topup_memory_cache(memcache, +- kvm_mmu_cache_min_pages(kvm)); +- if (ret) +- return ret; +- } + +- mmu_seq = vcpu->kvm->mmu_invalidate_seq; + /* +- * Ensure the read of mmu_invalidate_seq happens before we call +- * gfn_to_pfn_prot (which calls get_user_pages), so that we don't risk +- * the page we just got a reference to gets unmapped before we have a +- * chance to grab the mmu_lock, which ensure that if the page gets +- * unmapped afterwards, the call to kvm_unmap_gfn will take it away +- * from us again properly. This smp_rmb() interacts with the smp_wmb() +- * in kvm_mmu_notifier_invalidate_. ++ * Read mmu_invalidate_seq so that KVM can detect if the results of ++ * vma_lookup() or __gfn_to_pfn_memslot() become stale prior to ++ * acquiring kvm->mmu_lock. + * +- * Besides, __gfn_to_pfn_memslot() instead of gfn_to_pfn_prot() is +- * used to avoid unnecessary overhead introduced to locate the memory +- * slot because it's always fixed even @gfn is adjusted for huge pages. ++ * Rely on mmap_read_unlock() for an implicit smp_rmb(), which pairs ++ * with the smp_wmb() in kvm_mmu_invalidate_end(). + */ +- smp_rmb(); ++ mmu_seq = vcpu->kvm->mmu_invalidate_seq; ++ mmap_read_unlock(current->mm); + + pfn = __gfn_to_pfn_memslot(memslot, gfn, false, false, NULL, + write_fault, &writable, NULL); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-177-KVM-arm64-Disable-interrupts-while-walking-use.patch b/patches.kernel.org/6.2.10-177-KVM-arm64-Disable-interrupts-while-walking-use.patch new file mode 100644 index 0000000..b45a563 --- /dev/null +++ b/patches.kernel.org/6.2.10-177-KVM-arm64-Disable-interrupts-while-walking-use.patch @@ -0,0 +1,125 @@ +From: Marc Zyngier +Date: Thu, 16 Mar 2023 17:45:45 +0000 +Subject: [PATCH] KVM: arm64: Disable interrupts while walking userspace PTs +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: e86fc1a3a3e9b4850fe74d738e3cfcf4297d8bba + +commit e86fc1a3a3e9b4850fe74d738e3cfcf4297d8bba upstream. + +We walk the userspace PTs to discover what mapping size was +used there. However, this can race against the userspace tables +being freed, and we end-up in the weeds. + +Thankfully, the mm code is being generous and will IPI us when +doing so. So let's implement our part of the bargain and disable +interrupts around the walk. This ensures that nothing terrible +happens during that time. + +We still need to handle the removal of the page tables before +the walk. For that, allow get_user_mapping_size() to return an +error, and make sure this error can be propagated all the way +to the the exit handler. + +Signed-off-by: Marc Zyngier +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230316174546.3777507-2-maz@kernel.org +Signed-off-by: Oliver Upton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm64/kvm/mmu.c | 45 +++++++++++++++++++++++++++++++++++++------- + 1 file changed, 38 insertions(+), 7 deletions(-) + +diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c +index 26df1653..db6ddb8a 100644 +--- a/arch/arm64/kvm/mmu.c ++++ b/arch/arm64/kvm/mmu.c +@@ -665,14 +665,33 @@ static int get_user_mapping_size(struct kvm *kvm, u64 addr) + CONFIG_PGTABLE_LEVELS), + .mm_ops = &kvm_user_mm_ops, + }; ++ unsigned long flags; + kvm_pte_t pte = 0; /* Keep GCC quiet... */ + u32 level = ~0; + int ret; + ++ /* ++ * Disable IRQs so that we hazard against a concurrent ++ * teardown of the userspace page tables (which relies on ++ * IPI-ing threads). ++ */ ++ local_irq_save(flags); + ret = kvm_pgtable_get_leaf(&pgt, addr, &pte, &level); +- VM_BUG_ON(ret); +- VM_BUG_ON(level >= KVM_PGTABLE_MAX_LEVELS); +- VM_BUG_ON(!(pte & PTE_VALID)); ++ local_irq_restore(flags); ++ ++ if (ret) ++ return ret; ++ ++ /* ++ * Not seeing an error, but not updating level? Something went ++ * deeply wrong... ++ */ ++ if (WARN_ON(level >= KVM_PGTABLE_MAX_LEVELS)) ++ return -EFAULT; ++ ++ /* Oops, the userspace PTs are gone... Replay the fault */ ++ if (!kvm_pte_valid(pte)) ++ return -EAGAIN; + + return BIT(ARM64_HW_PGTABLE_LEVEL_SHIFT(level)); + } +@@ -1079,7 +1098,7 @@ static bool fault_supports_stage2_huge_mapping(struct kvm_memory_slot *memslot, + * + * Returns the size of the mapping. + */ +-static unsigned long ++static long + transparent_hugepage_adjust(struct kvm *kvm, struct kvm_memory_slot *memslot, + unsigned long hva, kvm_pfn_t *pfnp, + phys_addr_t *ipap) +@@ -1091,8 +1110,15 @@ transparent_hugepage_adjust(struct kvm *kvm, struct kvm_memory_slot *memslot, + * sure that the HVA and IPA are sufficiently aligned and that the + * block map is contained within the memslot. + */ +- if (fault_supports_stage2_huge_mapping(memslot, hva, PMD_SIZE) && +- get_user_mapping_size(kvm, hva) >= PMD_SIZE) { ++ if (fault_supports_stage2_huge_mapping(memslot, hva, PMD_SIZE)) { ++ int sz = get_user_mapping_size(kvm, hva); ++ ++ if (sz < 0) ++ return sz; ++ ++ if (sz < PMD_SIZE) ++ return PAGE_SIZE; ++ + /* + * The address we faulted on is backed by a transparent huge + * page. However, because we map the compound huge page and +@@ -1203,7 +1229,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, + kvm_pfn_t pfn; + bool logging_active = memslot_is_logging(memslot); + unsigned long fault_level = kvm_vcpu_trap_get_fault_level(vcpu); +- unsigned long vma_pagesize, fault_granule; ++ long vma_pagesize, fault_granule; + enum kvm_pgtable_prot prot = KVM_PGTABLE_PROT_R; + struct kvm_pgtable *pgt; + +@@ -1344,6 +1370,11 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, + vma_pagesize = transparent_hugepage_adjust(kvm, memslot, + hva, &pfn, + &fault_ipa); ++ ++ if (vma_pagesize < 0) { ++ ret = vma_pagesize; ++ goto out_unlock; ++ } + } + + if (fault_status != ESR_ELx_FSC_PERM && !device && kvm_has_mte(kvm)) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-178-KVM-arm64-Check-for-kvm_vma_mte_allowed-in-the.patch b/patches.kernel.org/6.2.10-178-KVM-arm64-Check-for-kvm_vma_mte_allowed-in-the.patch new file mode 100644 index 0000000..96e1be0 --- /dev/null +++ b/patches.kernel.org/6.2.10-178-KVM-arm64-Check-for-kvm_vma_mte_allowed-in-the.patch @@ -0,0 +1,64 @@ +From: Marc Zyngier +Date: Thu, 16 Mar 2023 17:45:46 +0000 +Subject: [PATCH] KVM: arm64: Check for kvm_vma_mte_allowed in the critical + section +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 8c2e8ac8ad4be68409e806ce1cc78fc7a04539f3 + +commit 8c2e8ac8ad4be68409e806ce1cc78fc7a04539f3 upstream. + +On page fault, we find about the VMA that backs the page fault +early on, and quickly release the mmap_read_lock. However, using +the VMA pointer after the critical section is pretty dangerous, +as a teardown may happen in the meantime and the VMA be long gone. + +Move the sampling of the MTE permission early, and NULL-ify the +VMA pointer after that, just to be on the safe side. + +Signed-off-by: Marc Zyngier +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230316174546.3777507-3-maz@kernel.org +Signed-off-by: Oliver Upton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm64/kvm/mmu.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c +index db6ddb8a..3c24178b 100644 +--- a/arch/arm64/kvm/mmu.c ++++ b/arch/arm64/kvm/mmu.c +@@ -1218,7 +1218,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, + { + int ret = 0; + bool write_fault, writable, force_pte = false; +- bool exec_fault; ++ bool exec_fault, mte_allowed; + bool device = false; + unsigned long mmu_seq; + struct kvm *kvm = vcpu->kvm; +@@ -1309,6 +1309,10 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, + fault_ipa &= ~(vma_pagesize - 1); + + gfn = fault_ipa >> PAGE_SHIFT; ++ mte_allowed = kvm_vma_mte_allowed(vma); ++ ++ /* Don't use the VMA after the unlock -- it may have vanished */ ++ vma = NULL; + + /* + * Read mmu_invalidate_seq so that KVM can detect if the results of +@@ -1379,7 +1383,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, + + if (fault_status != ESR_ELx_FSC_PERM && !device && kvm_has_mte(kvm)) { + /* Check the VMM hasn't introduced a new disallowed VMA */ +- if (kvm_vma_mte_allowed(vma)) { ++ if (mte_allowed) { + sanitise_mte_tags(kvm, pfn, vma_pagesize); + } else { + ret = -EFAULT; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-179-usb-ucsi-Fix-ucsi-connector-race.patch b/patches.kernel.org/6.2.10-179-usb-ucsi-Fix-ucsi-connector-race.patch new file mode 100644 index 0000000..3d5070c --- /dev/null +++ b/patches.kernel.org/6.2.10-179-usb-ucsi-Fix-ucsi-connector-race.patch @@ -0,0 +1,118 @@ +From: Hans de Goede +Date: Wed, 8 Mar 2023 16:42:43 +0100 +Subject: [PATCH] usb: ucsi: Fix ucsi->connector race +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 0482c34ec6f8557e06cd0f8e2d0e20e8ede6a22c + +commit 0482c34ec6f8557e06cd0f8e2d0e20e8ede6a22c upstream. + +ucsi_init() which runs from a workqueue sets ucsi->connector and +on an error will clear it again. + +ucsi->connector gets dereferenced by ucsi_resume(), this checks for +ucsi->connector being NULL in case ucsi_init() has not finished yet; +or in case ucsi_init() has failed. + +ucsi_init() setting ucsi->connector and then clearing it again on +an error creates a race where the check in ucsi_resume() may pass, +only to have ucsi->connector free-ed underneath it when ucsi_init() +hits an error. + +Fix this race by making ucsi_init() store the connector array in +a local variable and only assign it to ucsi->connector on success. + +Fixes: bdc62f2bae8f ("usb: typec: ucsi: Simplified registration and I/O API") +Cc: stable@vger.kernel.org +Reviewed-by: Heikki Krogerus +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20230308154244.722337-3-hdegoede@redhat.com +Signed-off-by: Joakim Tjernlund +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/typec/ucsi/ucsi.c | 22 +++++++++------------- + 1 file changed, 9 insertions(+), 13 deletions(-) + +diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c +index 8cbbb002..086b5096 100644 +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -1039,9 +1039,8 @@ static struct fwnode_handle *ucsi_find_fwnode(struct ucsi_connector *con) + return NULL; + } + +-static int ucsi_register_port(struct ucsi *ucsi, int index) ++static int ucsi_register_port(struct ucsi *ucsi, struct ucsi_connector *con) + { +- struct ucsi_connector *con = &ucsi->connector[index]; + struct typec_capability *cap = &con->typec_cap; + enum typec_accessory *accessory = cap->accessory; + enum usb_role u_role = USB_ROLE_NONE; +@@ -1062,7 +1061,6 @@ static int ucsi_register_port(struct ucsi *ucsi, int index) + init_completion(&con->complete); + mutex_init(&con->lock); + INIT_LIST_HEAD(&con->partner_tasks); +- con->num = index + 1; + con->ucsi = ucsi; + + cap->fwnode = ucsi_find_fwnode(con); +@@ -1204,7 +1202,7 @@ static int ucsi_register_port(struct ucsi *ucsi, int index) + */ + static int ucsi_init(struct ucsi *ucsi) + { +- struct ucsi_connector *con; ++ struct ucsi_connector *con, *connector; + u64 command, ntfy; + int ret; + int i; +@@ -1235,16 +1233,16 @@ static int ucsi_init(struct ucsi *ucsi) + } + + /* Allocate the connectors. Released in ucsi_unregister() */ +- ucsi->connector = kcalloc(ucsi->cap.num_connectors + 1, +- sizeof(*ucsi->connector), GFP_KERNEL); +- if (!ucsi->connector) { ++ connector = kcalloc(ucsi->cap.num_connectors + 1, sizeof(*connector), GFP_KERNEL); ++ if (!connector) { + ret = -ENOMEM; + goto err_reset; + } + + /* Register all connectors */ + for (i = 0; i < ucsi->cap.num_connectors; i++) { +- ret = ucsi_register_port(ucsi, i); ++ connector[i].num = i + 1; ++ ret = ucsi_register_port(ucsi, &connector[i]); + if (ret) + goto err_unregister; + } +@@ -1256,11 +1254,12 @@ static int ucsi_init(struct ucsi *ucsi) + if (ret < 0) + goto err_unregister; + ++ ucsi->connector = connector; + ucsi->ntfy = ntfy; + return 0; + + err_unregister: +- for (con = ucsi->connector; con->port; con++) { ++ for (con = connector; con->port; con++) { + ucsi_unregister_partner(con); + ucsi_unregister_altmodes(con, UCSI_RECIPIENT_CON); + ucsi_unregister_port_psy(con); +@@ -1269,10 +1268,7 @@ static int ucsi_init(struct ucsi *ucsi) + typec_unregister_port(con->port); + con->port = NULL; + } +- +- kfree(ucsi->connector); +- ucsi->connector = NULL; +- ++ kfree(connector); + err_reset: + memset(&ucsi->cap, 0, sizeof(ucsi->cap)); + ucsi_reset_ppm(ucsi); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-180-libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch b/patches.kernel.org/6.2.10-180-libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch new file mode 100644 index 0000000..3be91fd --- /dev/null +++ b/patches.kernel.org/6.2.10-180-libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch @@ -0,0 +1,427 @@ +From: Andrii Nakryiko +Date: Mon, 12 Dec 2022 13:15:04 -0800 +Subject: [PATCH] libbpf: Fix BTF-to-C converter's padding logic +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: ea2ce1ba99aa6a60c8d8a706e3abadf3de372163 + +[ Upstream commit ea2ce1ba99aa6a60c8d8a706e3abadf3de372163 ] + +Turns out that btf_dump API doesn't handle a bunch of tricky corner +cases, as reported by Per, and further discovered using his testing +Python script ([0]). + +This patch revamps btf_dump's padding logic significantly, making it +more correct and also avoiding unnecessary explicit padding, where +compiler would pad naturally. This overall topic turned out to be very +tricky and subtle, there are lots of subtle corner cases. The comments +in the code tries to give some clues, but comments themselves are +supposed to be paired with good understanding of C alignment and padding +rules. Plus some experimentation to figure out subtle things like +whether `long :0;` means that struct is now forced to be long-aligned +(no, it's not, turns out). + +Anyways, Per's script, while not completely correct in some known +situations, doesn't show any obvious cases where this logic breaks, so +this is a nice improvement over the previous state of this logic. + +Some selftests had to be adjusted to accommodate better use of natural +alignment rules, eliminating some unnecessary padding, or changing it to +`type: 0;` alignment markers. + +Note also that for when we are in between bitfields, we emit explicit +bit size, while otherwise we use `: 0`, this feels much more natural in +practice. + +Next patch will add few more test cases, found through randomized Per's +script. + + [0] https://lore.kernel.org/bpf/85f83c333f5355c8ac026f835b18d15060725fcb.camel@ericsson.com/ + +Reported-by: Per Sundström XP +Signed-off-by: Andrii Nakryiko +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20221212211505.558851-6-andrii@kernel.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/lib/bpf/btf_dump.c | 169 +++++++++++++----- + .../bpf/progs/btf_dump_test_case_bitfields.c | 2 +- + .../bpf/progs/btf_dump_test_case_padding.c | 58 ++++-- + 3 files changed, 164 insertions(+), 65 deletions(-) + +diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c +index 69e80ee5..e0f0b175 100644 +--- a/tools/lib/bpf/btf_dump.c ++++ b/tools/lib/bpf/btf_dump.c +@@ -829,6 +829,25 @@ static void btf_dump_emit_type(struct btf_dump *d, __u32 id, __u32 cont_id) + } + } + ++static int btf_natural_align_of(const struct btf *btf, __u32 id) ++{ ++ const struct btf_type *t = btf__type_by_id(btf, id); ++ int i, align, vlen; ++ const struct btf_member *m; ++ ++ if (!btf_is_composite(t)) ++ return btf__align_of(btf, id); ++ ++ align = 1; ++ m = btf_members(t); ++ vlen = btf_vlen(t); ++ for (i = 0; i < vlen; i++, m++) { ++ align = max(align, btf__align_of(btf, m->type)); ++ } ++ ++ return align; ++} ++ + static bool btf_is_struct_packed(const struct btf *btf, __u32 id, + const struct btf_type *t) + { +@@ -836,16 +855,16 @@ static bool btf_is_struct_packed(const struct btf *btf, __u32 id, + int align, i, bit_sz; + __u16 vlen; + +- align = btf__align_of(btf, id); +- /* size of a non-packed struct has to be a multiple of its alignment*/ +- if (align && t->size % align) ++ align = btf_natural_align_of(btf, id); ++ /* size of a non-packed struct has to be a multiple of its alignment */ ++ if (align && (t->size % align) != 0) + return true; + + m = btf_members(t); + vlen = btf_vlen(t); + /* all non-bitfield fields have to be naturally aligned */ + for (i = 0; i < vlen; i++, m++) { +- align = btf__align_of(btf, m->type); ++ align = btf_natural_align_of(btf, m->type); + bit_sz = btf_member_bitfield_size(t, i); + if (align && bit_sz == 0 && m->offset % (8 * align) != 0) + return true; +@@ -858,44 +877,97 @@ static bool btf_is_struct_packed(const struct btf *btf, __u32 id, + return false; + } + +-static int chip_away_bits(int total, int at_most) +-{ +- return total % at_most ? : at_most; +-} +- + static void btf_dump_emit_bit_padding(const struct btf_dump *d, +- int cur_off, int m_off, int m_bit_sz, +- int align, int lvl) ++ int cur_off, int next_off, int next_align, ++ bool in_bitfield, int lvl) + { +- int off_diff = m_off - cur_off; +- int ptr_bits = d->ptr_sz * 8; ++ const struct { ++ const char *name; ++ int bits; ++ } pads[] = { ++ {"long", d->ptr_sz * 8}, {"int", 32}, {"short", 16}, {"char", 8} ++ }; ++ int new_off, pad_bits, bits, i; ++ const char *pad_type; ++ ++ if (cur_off >= next_off) ++ return; /* no gap */ ++ ++ /* For filling out padding we want to take advantage of ++ * natural alignment rules to minimize unnecessary explicit ++ * padding. First, we find the largest type (among long, int, ++ * short, or char) that can be used to force naturally aligned ++ * boundary. Once determined, we'll use such type to fill in ++ * the remaining padding gap. In some cases we can rely on ++ * compiler filling some gaps, but sometimes we need to force ++ * alignment to close natural alignment with markers like ++ * `long: 0` (this is always the case for bitfields). Note ++ * that even if struct itself has, let's say 4-byte alignment ++ * (i.e., it only uses up to int-aligned types), using `long: ++ * X;` explicit padding doesn't actually change struct's ++ * overall alignment requirements, but compiler does take into ++ * account that type's (long, in this example) natural ++ * alignment requirements when adding implicit padding. We use ++ * this fact heavily and don't worry about ruining correct ++ * struct alignment requirement. ++ */ ++ for (i = 0; i < ARRAY_SIZE(pads); i++) { ++ pad_bits = pads[i].bits; ++ pad_type = pads[i].name; + +- if (off_diff <= 0) +- /* no gap */ +- return; +- if (m_bit_sz == 0 && off_diff < align * 8) +- /* natural padding will take care of a gap */ +- return; ++ new_off = roundup(cur_off, pad_bits); ++ if (new_off <= next_off) ++ break; ++ } + +- while (off_diff > 0) { +- const char *pad_type; +- int pad_bits; +- +- if (ptr_bits > 32 && off_diff > 32) { +- pad_type = "long"; +- pad_bits = chip_away_bits(off_diff, ptr_bits); +- } else if (off_diff > 16) { +- pad_type = "int"; +- pad_bits = chip_away_bits(off_diff, 32); +- } else if (off_diff > 8) { +- pad_type = "short"; +- pad_bits = chip_away_bits(off_diff, 16); +- } else { +- pad_type = "char"; +- pad_bits = chip_away_bits(off_diff, 8); ++ if (new_off > cur_off && new_off <= next_off) { ++ /* We need explicit `: 0` aligning mark if next ++ * field is right on alignment offset and its ++ * alignment requirement is less strict than 's ++ * alignment (so compiler won't naturally align to the ++ * offset we expect), or if subsequent `: X`, ++ * will actually completely fit in the remaining hole, ++ * making compiler basically ignore `: X` ++ * completely. ++ */ ++ if (in_bitfield || ++ (new_off == next_off && roundup(cur_off, next_align * 8) != new_off) || ++ (new_off != next_off && next_off - new_off <= new_off - cur_off)) ++ /* but for bitfields we'll emit explicit bit count */ ++ btf_dump_printf(d, "\n%s%s: %d;", pfx(lvl), pad_type, ++ in_bitfield ? new_off - cur_off : 0); ++ cur_off = new_off; ++ } ++ ++ /* Now we know we start at naturally aligned offset for a chosen ++ * padding type (long, int, short, or char), and so the rest is just ++ * a straightforward filling of remaining padding gap with full ++ * `: sizeof();` markers, except for the last one, which ++ * might need smaller than sizeof() padding. ++ */ ++ while (cur_off != next_off) { ++ bits = min(next_off - cur_off, pad_bits); ++ if (bits == pad_bits) { ++ btf_dump_printf(d, "\n%s%s: %d;", pfx(lvl), pad_type, pad_bits); ++ cur_off += bits; ++ continue; ++ } ++ /* For the remainder padding that doesn't cover entire ++ * pad_type bit length, we pick the smallest necessary type. ++ * This is pure aesthetics, we could have just used `long`, ++ * but having smallest necessary one communicates better the ++ * scale of the padding gap. ++ */ ++ for (i = ARRAY_SIZE(pads) - 1; i >= 0; i--) { ++ pad_type = pads[i].name; ++ pad_bits = pads[i].bits; ++ if (pad_bits < bits) ++ continue; ++ ++ btf_dump_printf(d, "\n%s%s: %d;", pfx(lvl), pad_type, bits); ++ cur_off += bits; ++ break; + } +- btf_dump_printf(d, "\n%s%s: %d;", pfx(lvl), pad_type, pad_bits); +- off_diff -= pad_bits; + } + } + +@@ -915,9 +987,11 @@ static void btf_dump_emit_struct_def(struct btf_dump *d, + { + const struct btf_member *m = btf_members(t); + bool is_struct = btf_is_struct(t); +- int align, i, packed, off = 0; ++ bool packed, prev_bitfield = false; ++ int align, i, off = 0; + __u16 vlen = btf_vlen(t); + ++ align = btf__align_of(d->btf, id); + packed = is_struct ? btf_is_struct_packed(d->btf, id, t) : 0; + + btf_dump_printf(d, "%s%s%s {", +@@ -927,33 +1001,36 @@ static void btf_dump_emit_struct_def(struct btf_dump *d, + + for (i = 0; i < vlen; i++, m++) { + const char *fname; +- int m_off, m_sz; ++ int m_off, m_sz, m_align; ++ bool in_bitfield; + + fname = btf_name_of(d, m->name_off); + m_sz = btf_member_bitfield_size(t, i); + m_off = btf_member_bit_offset(t, i); +- align = packed ? 1 : btf__align_of(d->btf, m->type); ++ m_align = packed ? 1 : btf__align_of(d->btf, m->type); ++ ++ in_bitfield = prev_bitfield && m_sz != 0; + +- btf_dump_emit_bit_padding(d, off, m_off, m_sz, align, lvl + 1); ++ btf_dump_emit_bit_padding(d, off, m_off, m_align, in_bitfield, lvl + 1); + btf_dump_printf(d, "\n%s", pfx(lvl + 1)); + btf_dump_emit_type_decl(d, m->type, fname, lvl + 1); + + if (m_sz) { + btf_dump_printf(d, ": %d", m_sz); + off = m_off + m_sz; ++ prev_bitfield = true; + } else { + m_sz = max((__s64)0, btf__resolve_size(d->btf, m->type)); + off = m_off + m_sz * 8; ++ prev_bitfield = false; + } ++ + btf_dump_printf(d, ";"); + } + + /* pad at the end, if necessary */ +- if (is_struct) { +- align = packed ? 1 : btf__align_of(d->btf, id); +- btf_dump_emit_bit_padding(d, off, t->size * 8, 0, align, +- lvl + 1); +- } ++ if (is_struct) ++ btf_dump_emit_bit_padding(d, off, t->size * 8, align, false, lvl + 1); + + /* + * Keep `struct empty {}` on a single line, +diff --git a/tools/testing/selftests/bpf/progs/btf_dump_test_case_bitfields.c b/tools/testing/selftests/bpf/progs/btf_dump_test_case_bitfields.c +index e5560a65..e0169061 100644 +--- a/tools/testing/selftests/bpf/progs/btf_dump_test_case_bitfields.c ++++ b/tools/testing/selftests/bpf/progs/btf_dump_test_case_bitfields.c +@@ -53,7 +53,7 @@ struct bitfields_only_mixed_types { + */ + /* ------ END-EXPECTED-OUTPUT ------ */ + struct bitfield_mixed_with_others { +- long: 4; /* char is enough as a backing field */ ++ char: 4; /* char is enough as a backing field */ + int a: 4; + /* 8-bit implicit padding */ + short b; /* combined with previous bitfield */ +diff --git a/tools/testing/selftests/bpf/progs/btf_dump_test_case_padding.c b/tools/testing/selftests/bpf/progs/btf_dump_test_case_padding.c +index 7cb522d2..6f963d34 100644 +--- a/tools/testing/selftests/bpf/progs/btf_dump_test_case_padding.c ++++ b/tools/testing/selftests/bpf/progs/btf_dump_test_case_padding.c +@@ -19,7 +19,7 @@ struct padded_implicitly { + /* + *struct padded_explicitly { + * int a; +- * int: 32; ++ * long: 0; + * int b; + *}; + * +@@ -28,41 +28,28 @@ struct padded_implicitly { + + struct padded_explicitly { + int a; +- int: 1; /* algo will explicitly pad with full 32 bits here */ ++ int: 1; /* algo will emit aligning `long: 0;` here */ + int b; + }; + + /* ----- START-EXPECTED-OUTPUT ----- */ +-/* +- *struct padded_a_lot { +- * int a; +- * long: 32; +- * long: 64; +- * long: 64; +- * int b; +- *}; +- * +- */ +-/* ------ END-EXPECTED-OUTPUT ------ */ +- + struct padded_a_lot { + int a; +- /* 32 bit of implicit padding here, which algo will make explicit */ + long: 64; + long: 64; + int b; + }; + ++/* ------ END-EXPECTED-OUTPUT ------ */ ++ + /* ----- START-EXPECTED-OUTPUT ----- */ + /* + *struct padded_cache_line { + * int a; +- * long: 32; + * long: 64; + * long: 64; + * long: 64; + * int b; +- * long: 32; + * long: 64; + * long: 64; + * long: 64; +@@ -85,7 +72,7 @@ struct padded_cache_line { + *struct zone { + * int a; + * short b; +- * short: 16; ++ * long: 0; + * struct zone_padding __pad__; + *}; + * +@@ -108,6 +95,39 @@ struct padding_wo_named_members { + long: 64; + }; + ++struct padding_weird_1 { ++ int a; ++ long: 64; ++ short: 16; ++ short b; ++}; ++ ++/* ------ END-EXPECTED-OUTPUT ------ */ ++ ++/* ----- START-EXPECTED-OUTPUT ----- */ ++/* ++ *struct padding_weird_2 { ++ * long: 56; ++ * char a; ++ * long: 56; ++ * char b; ++ * char: 8; ++ *}; ++ * ++ */ ++/* ------ END-EXPECTED-OUTPUT ------ */ ++struct padding_weird_2 { ++ int: 32; /* these paddings will be collapsed into `long: 56;` */ ++ short: 16; ++ char: 8; ++ char a; ++ int: 32; /* these paddings will be collapsed into `long: 56;` */ ++ short: 16; ++ char: 8; ++ char b; ++ char: 8; ++}; ++ + /* ------ END-EXPECTED-OUTPUT ------ */ + + int f(struct { +@@ -117,6 +137,8 @@ int f(struct { + struct padded_cache_line _4; + struct zone _5; + struct padding_wo_named_members _6; ++ struct padding_weird_1 _7; ++ struct padding_weird_2 _8; + } *_) + { + return 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-181-selftests-bpf-Add-few-corner-cases-to-test-pad.patch b/patches.kernel.org/6.2.10-181-selftests-bpf-Add-few-corner-cases-to-test-pad.patch new file mode 100644 index 0000000..3deb4e8 --- /dev/null +++ b/patches.kernel.org/6.2.10-181-selftests-bpf-Add-few-corner-cases-to-test-pad.patch @@ -0,0 +1,230 @@ +From: Andrii Nakryiko +Date: Mon, 12 Dec 2022 13:15:05 -0800 +Subject: [PATCH] selftests/bpf: Add few corner cases to test padding handling + of btf_dump +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: b148c8b9b926e257a59c8eb2cd6fa3adfd443254 + +[ Upstream commit b148c8b9b926e257a59c8eb2cd6fa3adfd443254 ] + +Add few hand-crafted cases and few randomized cases found using script +from [0] that tests btf_dump's padding logic. + + [0] https://lore.kernel.org/bpf/85f83c333f5355c8ac026f835b18d15060725fcb.camel@ericsson.com/ + +Signed-off-by: Andrii Nakryiko +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20221212211505.558851-7-andrii@kernel.org +Stable-dep-of: 4fb877aaa179 ("libbpf: Fix btf_dump's packed struct determination") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../bpf/progs/btf_dump_test_case_packing.c | 61 +++++++++- + .../bpf/progs/btf_dump_test_case_padding.c | 104 ++++++++++++++++++ + 2 files changed, 164 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/progs/btf_dump_test_case_packing.c b/tools/testing/selftests/bpf/progs/btf_dump_test_case_packing.c +index e304b620..5c6c62f7 100644 +--- a/tools/testing/selftests/bpf/progs/btf_dump_test_case_packing.c ++++ b/tools/testing/selftests/bpf/progs/btf_dump_test_case_packing.c +@@ -58,7 +58,64 @@ union jump_code_union { + } __attribute__((packed)); + }; + +-/*------ END-EXPECTED-OUTPUT ------ */ ++/* ----- START-EXPECTED-OUTPUT ----- */ ++/* ++ *struct nested_packed_but_aligned_struct { ++ * int x1; ++ * int x2; ++ *}; ++ * ++ *struct outer_implicitly_packed_struct { ++ * char y1; ++ * struct nested_packed_but_aligned_struct y2; ++ *} __attribute__((packed)); ++ * ++ */ ++/* ------ END-EXPECTED-OUTPUT ------ */ ++ ++struct nested_packed_but_aligned_struct { ++ int x1; ++ int x2; ++} __attribute__((packed)); ++ ++struct outer_implicitly_packed_struct { ++ char y1; ++ struct nested_packed_but_aligned_struct y2; ++}; ++/* ----- START-EXPECTED-OUTPUT ----- */ ++/* ++ *struct usb_ss_ep_comp_descriptor { ++ * char: 8; ++ * char bDescriptorType; ++ * char bMaxBurst; ++ * short wBytesPerInterval; ++ *}; ++ * ++ *struct usb_host_endpoint { ++ * long: 64; ++ * char: 8; ++ * struct usb_ss_ep_comp_descriptor ss_ep_comp; ++ * long: 0; ++ *} __attribute__((packed)); ++ * ++ */ ++/* ------ END-EXPECTED-OUTPUT ------ */ ++ ++struct usb_ss_ep_comp_descriptor { ++ char: 8; ++ char bDescriptorType; ++ char bMaxBurst; ++ int: 0; ++ short wBytesPerInterval; ++} __attribute__((packed)); ++ ++struct usb_host_endpoint { ++ long: 64; ++ char: 8; ++ struct usb_ss_ep_comp_descriptor ss_ep_comp; ++ long: 0; ++}; ++ + + int f(struct { + struct packed_trailing_space _1; +@@ -69,6 +126,8 @@ int f(struct { + union union_is_never_packed _6; + union union_does_not_need_packing _7; + union jump_code_union _8; ++ struct outer_implicitly_packed_struct _9; ++ struct usb_host_endpoint _10; + } *_) + { + return 0; +diff --git a/tools/testing/selftests/bpf/progs/btf_dump_test_case_padding.c b/tools/testing/selftests/bpf/progs/btf_dump_test_case_padding.c +index 6f963d34..79276fbe 100644 +--- a/tools/testing/selftests/bpf/progs/btf_dump_test_case_padding.c ++++ b/tools/testing/selftests/bpf/progs/btf_dump_test_case_padding.c +@@ -128,6 +128,98 @@ struct padding_weird_2 { + char: 8; + }; + ++/* ----- START-EXPECTED-OUTPUT ----- */ ++struct exact_1byte { ++ char x; ++}; ++ ++struct padded_1byte { ++ char: 8; ++}; ++ ++struct exact_2bytes { ++ short x; ++}; ++ ++struct padded_2bytes { ++ short: 16; ++}; ++ ++struct exact_4bytes { ++ int x; ++}; ++ ++struct padded_4bytes { ++ int: 32; ++}; ++ ++struct exact_8bytes { ++ long x; ++}; ++ ++struct padded_8bytes { ++ long: 64; ++}; ++ ++struct ff_periodic_effect { ++ int: 32; ++ short magnitude; ++ long: 0; ++ short phase; ++ long: 0; ++ int: 32; ++ int custom_len; ++ short *custom_data; ++}; ++ ++struct ib_wc { ++ long: 64; ++ long: 64; ++ int: 32; ++ int byte_len; ++ void *qp; ++ union {} ex; ++ long: 64; ++ int slid; ++ int wc_flags; ++ long: 64; ++ char smac[6]; ++ long: 0; ++ char network_hdr_type; ++}; ++ ++struct acpi_object_method { ++ long: 64; ++ char: 8; ++ char type; ++ short reference_count; ++ char flags; ++ short: 0; ++ char: 8; ++ char sync_level; ++ long: 64; ++ void *node; ++ void *aml_start; ++ union {} dispatch; ++ long: 64; ++ int aml_length; ++}; ++ ++struct nested_unpacked { ++ int x; ++}; ++ ++struct nested_packed { ++ struct nested_unpacked a; ++ char c; ++} __attribute__((packed)); ++ ++struct outer_mixed_but_unpacked { ++ struct nested_packed b1; ++ short a1; ++ struct nested_packed b2; ++}; ++ + /* ------ END-EXPECTED-OUTPUT ------ */ + + int f(struct { +@@ -139,6 +231,18 @@ int f(struct { + struct padding_wo_named_members _6; + struct padding_weird_1 _7; + struct padding_weird_2 _8; ++ struct exact_1byte _100; ++ struct padded_1byte _101; ++ struct exact_2bytes _102; ++ struct padded_2bytes _103; ++ struct exact_4bytes _104; ++ struct padded_4bytes _105; ++ struct exact_8bytes _106; ++ struct padded_8bytes _107; ++ struct ff_periodic_effect _200; ++ struct ib_wc _201; ++ struct acpi_object_method _202; ++ struct outer_mixed_but_unpacked _203; + } *_) + { + return 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-182-libbpf-Fix-btf_dump-s-packed-struct-determinat.patch b/patches.kernel.org/6.2.10-182-libbpf-Fix-btf_dump-s-packed-struct-determinat.patch new file mode 100644 index 0000000..e09b8a3 --- /dev/null +++ b/patches.kernel.org/6.2.10-182-libbpf-Fix-btf_dump-s-packed-struct-determinat.patch @@ -0,0 +1,133 @@ +From: Andrii Nakryiko +Date: Thu, 15 Dec 2022 10:36:05 -0800 +Subject: [PATCH] libbpf: Fix btf_dump's packed struct determination +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 4fb877aaa179dcdb1676d55216482febaada457e + +[ Upstream commit 4fb877aaa179dcdb1676d55216482febaada457e ] + +Fix bug in btf_dump's logic of determining if a given struct type is +packed or not. The notion of "natural alignment" is not needed and is +even harmful in this case, so drop it altogether. The biggest difference +in btf_is_struct_packed() compared to its original implementation is +that we don't really use btf__align_of() to determine overall alignment +of a struct type (because it could be 1 for both packed and non-packed +struct, depending on specifci field definitions), and just use field's +actual alignment to calculate whether any field is requiring packing or +struct's size overall necessitates packing. + +Add two simple test cases that demonstrate the difference this change +would make. + +Fixes: ea2ce1ba99aa ("libbpf: Fix BTF-to-C converter's padding logic") +Reported-by: Eduard Zingerman +Signed-off-by: Andrii Nakryiko +Signed-off-by: Daniel Borkmann +Acked-by: Eduard Zingerman +Link: https://lore.kernel.org/bpf/20221215183605.4149488-1-andrii@kernel.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/lib/bpf/btf_dump.c | 33 ++++--------------- + .../bpf/progs/btf_dump_test_case_packing.c | 19 +++++++++++ + 2 files changed, 25 insertions(+), 27 deletions(-) + +diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c +index e0f0b175..cfbec31e 100644 +--- a/tools/lib/bpf/btf_dump.c ++++ b/tools/lib/bpf/btf_dump.c +@@ -829,47 +829,26 @@ static void btf_dump_emit_type(struct btf_dump *d, __u32 id, __u32 cont_id) + } + } + +-static int btf_natural_align_of(const struct btf *btf, __u32 id) +-{ +- const struct btf_type *t = btf__type_by_id(btf, id); +- int i, align, vlen; +- const struct btf_member *m; +- +- if (!btf_is_composite(t)) +- return btf__align_of(btf, id); +- +- align = 1; +- m = btf_members(t); +- vlen = btf_vlen(t); +- for (i = 0; i < vlen; i++, m++) { +- align = max(align, btf__align_of(btf, m->type)); +- } +- +- return align; +-} +- + static bool btf_is_struct_packed(const struct btf *btf, __u32 id, + const struct btf_type *t) + { + const struct btf_member *m; +- int align, i, bit_sz; ++ int max_align = 1, align, i, bit_sz; + __u16 vlen; + +- align = btf_natural_align_of(btf, id); +- /* size of a non-packed struct has to be a multiple of its alignment */ +- if (align && (t->size % align) != 0) +- return true; +- + m = btf_members(t); + vlen = btf_vlen(t); + /* all non-bitfield fields have to be naturally aligned */ + for (i = 0; i < vlen; i++, m++) { +- align = btf_natural_align_of(btf, m->type); ++ align = btf__align_of(btf, m->type); + bit_sz = btf_member_bitfield_size(t, i); + if (align && bit_sz == 0 && m->offset % (8 * align) != 0) + return true; ++ max_align = max(align, max_align); + } +- ++ /* size of a non-packed struct has to be a multiple of its alignment */ ++ if (t->size % max_align != 0) ++ return true; + /* + * if original struct was marked as packed, but its layout is + * naturally aligned, we'll detect that it's not packed +diff --git a/tools/testing/selftests/bpf/progs/btf_dump_test_case_packing.c b/tools/testing/selftests/bpf/progs/btf_dump_test_case_packing.c +index 5c6c62f7..7998f27d 100644 +--- a/tools/testing/selftests/bpf/progs/btf_dump_test_case_packing.c ++++ b/tools/testing/selftests/bpf/progs/btf_dump_test_case_packing.c +@@ -116,6 +116,23 @@ struct usb_host_endpoint { + long: 0; + }; + ++/* ----- START-EXPECTED-OUTPUT ----- */ ++struct nested_packed_struct { ++ int a; ++ char b; ++} __attribute__((packed)); ++ ++struct outer_nonpacked_struct { ++ short a; ++ struct nested_packed_struct b; ++}; ++ ++struct outer_packed_struct { ++ short a; ++ struct nested_packed_struct b; ++} __attribute__((packed)); ++ ++/* ------ END-EXPECTED-OUTPUT ------ */ + + int f(struct { + struct packed_trailing_space _1; +@@ -128,6 +145,8 @@ int f(struct { + union jump_code_union _8; + struct outer_implicitly_packed_struct _9; + struct usb_host_endpoint _10; ++ struct outer_nonpacked_struct _11; ++ struct outer_packed_struct _12; + } *_) + { + return 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-183-drm-amdkfd-Get-prange-offset-after-svm_range_v.patch b/patches.kernel.org/6.2.10-183-drm-amdkfd-Get-prange-offset-after-svm_range_v.patch new file mode 100644 index 0000000..158d53e --- /dev/null +++ b/patches.kernel.org/6.2.10-183-drm-amdkfd-Get-prange-offset-after-svm_range_v.patch @@ -0,0 +1,76 @@ +From: Xiaogang Chen +Date: Thu, 9 Mar 2023 17:44:55 -0600 +Subject: [PATCH] drm/amdkfd: Get prange->offset after svm_range_vram_node_new +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 8eeddc0d4200762063e1c66b9cc63afa7b24ebf0 + +commit 8eeddc0d4200762063e1c66b9cc63afa7b24ebf0 upstream. + +During miration to vram prange->offset is valid after vram buffer is located, +either use old one or allocate a new one. Move svm_range_vram_node_new before +migrate for each vma to get valid prange->offset. + +v2: squash in warning fix + +Fixes: b4ee9606378b ("drm/amdkfd: Fix BO offset for multi-VMA page migration") +Signed-off-by: Xiaogang Chen +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +index 5c319007..5c8506f1 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +@@ -305,12 +305,6 @@ svm_migrate_copy_to_vram(struct amdgpu_device *adev, struct svm_range *prange, + src = scratch; + dst = (uint64_t *)(scratch + npages); + +- r = svm_range_vram_node_new(adev, prange, true); +- if (r) { +- dev_dbg(adev->dev, "fail %d to alloc vram\n", r); +- goto out; +- } +- + amdgpu_res_first(prange->ttm_res, ttm_res_offset, + npages << PAGE_SHIFT, &cursor); + for (i = j = 0; i < npages; i++) { +@@ -391,7 +385,7 @@ svm_migrate_copy_to_vram(struct amdgpu_device *adev, struct svm_range *prange, + migrate->dst[i + 3] = 0; + } + #endif +-out: ++ + return r; + } + +@@ -520,6 +514,12 @@ svm_migrate_ram_to_vram(struct svm_range *prange, uint32_t best_loc, + + start = prange->start << PAGE_SHIFT; + end = (prange->last + 1) << PAGE_SHIFT; ++ ++ r = svm_range_vram_node_new(adev, prange, true); ++ if (r) { ++ dev_dbg(adev->dev, "fail %ld to alloc vram\n", r); ++ return r; ++ } + ttm_res_offset = prange->offset << PAGE_SHIFT; + + for (addr = start; addr < end;) { +@@ -543,6 +543,8 @@ svm_migrate_ram_to_vram(struct svm_range *prange, uint32_t best_loc, + + if (cpages) + prange->actual_loc = best_loc; ++ else ++ svm_range_vram_node_free(prange); + + return r < 0 ? r : 0; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-184-hsr-ratelimit-only-when-errors-are-printed.patch b/patches.kernel.org/6.2.10-184-hsr-ratelimit-only-when-errors-are-printed.patch new file mode 100644 index 0000000..d5f3723 --- /dev/null +++ b/patches.kernel.org/6.2.10-184-hsr-ratelimit-only-when-errors-are-printed.patch @@ -0,0 +1,55 @@ +From: Matthieu Baerts +Date: Wed, 15 Mar 2023 21:25:17 +0100 +Subject: [PATCH] hsr: ratelimit only when errors are printed +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 1b0120e4db0bf2838d1ce741195ce4b7cc100b91 + +commit 1b0120e4db0bf2838d1ce741195ce4b7cc100b91 upstream. + +Recently, when automatically merging -net and net-next in MPTCP devel +tree, our CI reported [1] a conflict in hsr, the same as the one +reported by Stephen in netdev [2]. + +When looking at the conflict, I noticed it is in fact the v1 [3] that +has been applied in -net and the v2 [4] in net-next. Maybe the v1 was +applied by accident. + +As mentioned by Jakub Kicinski [5], the new condition makes more sense +before the net_ratelimit(), not to update net_ratelimit's state which is +unnecessary if we're not going to print either way. + +Here, this modification applies the v2 but in -net. + +Link: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/4423171069 [1] +Link: https://lore.kernel.org/netdev/20230315100914.53fc1760@canb.auug.org.au/ [2] +Link: https://lore.kernel.org/netdev/20230307133229.127442-1-koverskeid@gmail.com/ [3] +Link: https://lore.kernel.org/netdev/20230309092302.179586-1-koverskeid@gmail.com/ [4] +Link: https://lore.kernel.org/netdev/20230308232001.2fb62013@kernel.org/ [5] +Fixes: 28e8cabe80f3 ("net: hsr: Don't log netdev_err message on unknown prp dst node") +Signed-off-by: Matthieu Baerts +Reviewed-by: Steen Hegelund +Link: https://lore.kernel.org/r/20230315-net-20230315-hsr_framereg-ratelimit-v1-1-61d2ef176d11@tessares.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + net/hsr/hsr_framereg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c +index 865eda39..b77f1189 100644 +--- a/net/hsr/hsr_framereg.c ++++ b/net/hsr/hsr_framereg.c +@@ -415,7 +415,7 @@ void hsr_addr_subst_dest(struct hsr_node *node_src, struct sk_buff *skb, + node_dst = find_node_by_addr_A(&port->hsr->node_db, + eth_hdr(skb)->h_dest); + if (!node_dst) { +- if (net_ratelimit() && port->hsr->prot_version != PRP_V1) ++ if (port->hsr->prot_version != PRP_V1 && net_ratelimit()) + netdev_err(skb->dev, "%s: Unknown node\n", __func__); + return; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-185-x86-PVH-avoid-32-bit-build-warning-when-obtain.patch b/patches.kernel.org/6.2.10-185-x86-PVH-avoid-32-bit-build-warning-when-obtain.patch new file mode 100644 index 0000000..612dd80 --- /dev/null +++ b/patches.kernel.org/6.2.10-185-x86-PVH-avoid-32-bit-build-warning-when-obtain.patch @@ -0,0 +1,43 @@ +From: Jan Beulich +Date: Tue, 21 Mar 2023 09:03:26 +0100 +Subject: [PATCH] x86/PVH: avoid 32-bit build warning when obtaining VGA + console info +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: aadbd07ff8a75ed342388846da78dfaddb8b106a + +commit aadbd07ff8a75ed342388846da78dfaddb8b106a upstream. + +In the commit referenced below I failed to pay attention to this code +also being buildable as 32-bit. Adjust the type of "ret" - there's no +real need for it to be wider than 32 bits. + +Fixes: 934ef33ee75c ("x86/PVH: obtain VGA console info in Dom0") +Reported-by: kernel test robot +Signed-off-by: Jan Beulich +Reviewed-by: Juergen Gross +Signed-off-by: Greg Kroah-Hartman + +Link: https://lore.kernel.org/r/2d2193ff-670b-0a27-e12d-2c5c4c121c79@suse.com +Signed-off-by: Juergen Gross +Signed-off-by: Jiri Slaby +--- + arch/x86/xen/enlighten_pvh.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/xen/enlighten_pvh.c b/arch/x86/xen/enlighten_pvh.c +index 1da44aca..ada3868c 100644 +--- a/arch/x86/xen/enlighten_pvh.c ++++ b/arch/x86/xen/enlighten_pvh.c +@@ -48,7 +48,7 @@ void __init xen_pvh_init(struct boot_params *boot_params) + struct xen_platform_op op = { + .cmd = XENPF_get_dom0_console, + }; +- long ret = HYPERVISOR_platform_op(&op); ++ int ret = HYPERVISOR_platform_op(&op); + + if (ret > 0) + xen_init_vga(&op.u.dom0_console, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-186-Revert-cpuidle-intel_idle-Fix-CPUIDLE_FLAG_IRQ.patch b/patches.kernel.org/6.2.10-186-Revert-cpuidle-intel_idle-Fix-CPUIDLE_FLAG_IRQ.patch new file mode 100644 index 0000000..055b92a --- /dev/null +++ b/patches.kernel.org/6.2.10-186-Revert-cpuidle-intel_idle-Fix-CPUIDLE_FLAG_IRQ.patch @@ -0,0 +1,41 @@ +From: Sasha Levin +Date: Wed, 5 Apr 2023 07:30:26 -0400 +Subject: [PATCH] Revert "cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE + *again*" +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: 6d9c7f51b1d9179bf7c3542267c656a934e8af23 + +This reverts commit dca64f4bea7669f2056662e1f2776054d62f0153 which was +upstream commit 6d9c7f51b1d9179bf7c3542267c656a934e8af23. + +Lockdep warnings on boot that are not seen with Linus's tree. + +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/idle/intel_idle.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c +index f060ac73..cfeb24d4 100644 +--- a/drivers/idle/intel_idle.c ++++ b/drivers/idle/intel_idle.c +@@ -168,7 +168,13 @@ static __cpuidle int intel_idle_irq(struct cpuidle_device *dev, + + raw_local_irq_enable(); + ret = __intel_idle(dev, drv, index); +- raw_local_irq_disable(); ++ ++ /* ++ * The lockdep hardirqs state may be changed to 'on' with timer ++ * tick interrupt followed by __do_softirq(). Use local_irq_disable() ++ * to keep the hardirqs state correct. ++ */ ++ local_irq_disable(); + + return ret; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.10-187-Linux-6.2.10.patch b/patches.kernel.org/6.2.10-187-Linux-6.2.10.patch new file mode 100644 index 0000000..688fd39 --- /dev/null +++ b/patches.kernel.org/6.2.10-187-Linux-6.2.10.patch @@ -0,0 +1,53 @@ +From: Greg Kroah-Hartman +Date: Thu, 6 Apr 2023 12:12:48 +0200 +Subject: [PATCH] Linux 6.2.10 +References: bsc#1012628 +Patch-mainline: 6.2.10 +Git-commit: cb9384f7deb195360e7cb2a1aee2a31792c4106c + +Link: https://lore.kernel.org/r/20230403140416.015323160@linuxfoundation.org +Tested-by: Ronald Warsow +Tested-by: Shuah Khan +Tested-by: Justin M. Forbes +Tested-by: Florian Fainelli +Tested-by: Bagas Sanjaya +Tested-by: Ron Economos +Tested-by: Jon Hunter +Tested-by: Conor Dooley +Tested-by: Chris Paterson (CIP) +Tested-by: Linux Kernel Functional Testing +Tested-by: Markus Reichelt +Tested-by: Guenter Roeck +Tested-by: Jon Hunter +Link: https://lore.kernel.org/r/20230405100309.298748790@linuxfoundation.org +Tested-by: Ronald Warsow +Tested-by: Florian Fainelli +Tested-by: Jon Hunter +Tested-by: Markus Reichelt +Tested-by: Linux Kernel Functional Testing +Tested-by: Guenter Roeck +Tested-by: Kelsey Steele +Tested-by: Bagas Sanjaya +Tested-by: Allen Pais +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Makefile b/Makefile +index 8732f720..6ec0ec45 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 6 + PATCHLEVEL = 2 +-SUBLEVEL = 9 ++SUBLEVEL = 10 + EXTRAVERSION = + NAME = Hurr durr I'ma ninja sloth + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-001-dm-cache-Add-some-documentation-to-dm-cache-ba.patch b/patches.kernel.org/6.2.11-001-dm-cache-Add-some-documentation-to-dm-cache-ba.patch new file mode 100644 index 0000000..cb96620 --- /dev/null +++ b/patches.kernel.org/6.2.11-001-dm-cache-Add-some-documentation-to-dm-cache-ba.patch @@ -0,0 +1,95 @@ +From: Joe Thornber +Date: Thu, 26 Jan 2023 10:14:26 +0000 +Subject: [PATCH] dm cache: Add some documentation to + dm-cache-background-tracker.h +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 22c40e134c4c7a828ac09d25a5a8597b1e45c031 + +[ Upstream commit 22c40e134c4c7a828ac09d25a5a8597b1e45c031 ] + +Signed-off-by: Joe Thornber +Signed-off-by: Mike Snitzer +Stable-dep-of: f7b58a69fad9 ("dm: fix improper splitting for abnormal bios") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/md/dm-cache-background-tracker.h | 40 ++++++++++++++++++++++-- + 1 file changed, 37 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/dm-cache-background-tracker.h b/drivers/md/dm-cache-background-tracker.h +index 27ab90db..b5056e82 100644 +--- a/drivers/md/dm-cache-background-tracker.h ++++ b/drivers/md/dm-cache-background-tracker.h +@@ -12,19 +12,44 @@ + + /*----------------------------------------------------------------*/ + ++/* ++ * The cache policy decides what background work should be performed, ++ * such as promotions, demotions and writebacks. The core cache target ++ * is in charge of performing the work, and does so when it sees fit. ++ * ++ * The background_tracker acts as a go between. Keeping track of future ++ * work that the policy has decided upon, and handing (issuing) it to ++ * the core target when requested. ++ * ++ * There is no locking in this, so calls will probably need to be ++ * protected with a spinlock. ++ */ ++ + struct background_work; + struct background_tracker; + + /* +- * FIXME: discuss lack of locking in all methods. ++ * Create a new tracker, it will not be able to queue more than ++ * 'max_work' entries. + */ + struct background_tracker *btracker_create(unsigned max_work); ++ ++/* ++ * Destroy the tracker. No issued, but not complete, work should ++ * exist when this is called. It is fine to have queued but unissued ++ * work. ++ */ + void btracker_destroy(struct background_tracker *b); + + unsigned btracker_nr_writebacks_queued(struct background_tracker *b); + unsigned btracker_nr_demotions_queued(struct background_tracker *b); + + /* ++ * Queue some work within the tracker. 'work' should point to the work ++ * to queue, this will be copied (ownership doesn't pass). If pwork ++ * is not NULL then it will be set to point to the tracker's internal ++ * copy of the work. ++ * + * returns -EINVAL iff the work is already queued. -ENOMEM if the work + * couldn't be queued for another reason. + */ +@@ -33,11 +58,20 @@ int btracker_queue(struct background_tracker *b, + struct policy_work **pwork); + + /* ++ * Hands out the next piece of work to be performed. + * Returns -ENODATA if there's no work. + */ + int btracker_issue(struct background_tracker *b, struct policy_work **work); +-void btracker_complete(struct background_tracker *b, +- struct policy_work *op); ++ ++/* ++ * Informs the tracker that the work has been completed and it may forget ++ * about it. ++ */ ++void btracker_complete(struct background_tracker *b, struct policy_work *op); ++ ++/* ++ * Predicate to see if an origin block is already scheduled for promotion. ++ */ + bool btracker_promotion_already_present(struct background_tracker *b, + dm_oblock_t oblock); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-002-dm-integrity-Remove-bi_sector-that-s-only-used.patch b/patches.kernel.org/6.2.11-002-dm-integrity-Remove-bi_sector-that-s-only-used.patch new file mode 100644 index 0000000..03b20ca --- /dev/null +++ b/patches.kernel.org/6.2.11-002-dm-integrity-Remove-bi_sector-that-s-only-used.patch @@ -0,0 +1,52 @@ +From: Jiapeng Chong +Date: Tue, 31 Jan 2023 14:09:41 +0800 +Subject: [PATCH] dm integrity: Remove bi_sector that's only used by commented + debug code +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 5cd6d1d53a1f74222e73d8b42ab7ecf28ee2f34f + +[ Upstream commit 5cd6d1d53a1f74222e73d8b42ab7ecf28ee2f34f ] + +drivers/md/dm-integrity.c:1738:13: warning: variable 'bi_sector' set but not used. + +Reported-by: Abaci Robot +Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3895 +Signed-off-by: Jiapeng Chong +Signed-off-by: Mike Snitzer +Stable-dep-of: f7b58a69fad9 ("dm: fix improper splitting for abnormal bios") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/md/dm-integrity.c | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index 1388ee35..c62c21aa 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -1735,7 +1735,6 @@ static void integrity_metadata(struct work_struct *w) + } + + if (unlikely(dio->op == REQ_OP_DISCARD)) { +- sector_t bi_sector = dio->bio_details.bi_iter.bi_sector; + unsigned bi_size = dio->bio_details.bi_iter.bi_size; + unsigned max_size = likely(checksums != checksums_onstack) ? PAGE_SIZE : HASH_MAX_DIGESTSIZE; + unsigned max_blocks = max_size / ic->tag_size; +@@ -1752,13 +1751,7 @@ static void integrity_metadata(struct work_struct *w) + goto error; + } + +- /*if (bi_size < this_step_blocks << (SECTOR_SHIFT + ic->sb->log2_sectors_per_block)) { +- printk("BUGG: bi_sector: %llx, bi_size: %u\n", bi_sector, bi_size); +- printk("BUGG: this_step_blocks: %u\n", this_step_blocks); +- BUG(); +- }*/ + bi_size -= this_step_blocks << (SECTOR_SHIFT + ic->sb->log2_sectors_per_block); +- bi_sector += this_step_blocks << ic->sb->log2_sectors_per_block; + } + + if (likely(checksums != checksums_onstack)) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-003-dm-change-unsigned-to-unsigned-int.patch b/patches.kernel.org/6.2.11-003-dm-change-unsigned-to-unsigned-int.patch new file mode 100644 index 0000000..fae377d --- /dev/null +++ b/patches.kernel.org/6.2.11-003-dm-change-unsigned-to-unsigned-int.patch @@ -0,0 +1,7583 @@ +From: Heinz Mauelshagen +Date: Wed, 25 Jan 2023 21:14:58 +0100 +Subject: [PATCH] dm: change "unsigned" to "unsigned int" +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 86a3238c7b9b759cb864f4f768ab2e24687dc0e6 + +[ Upstream commit 86a3238c7b9b759cb864f4f768ab2e24687dc0e6 ] + +Signed-off-by: Heinz Mauelshagen +Signed-off-by: Mike Snitzer +Stable-dep-of: f7b58a69fad9 ("dm: fix improper splitting for abnormal bios") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/md/dm-bio-prison-v1.c | 10 +- + drivers/md/dm-bio-prison-v2.c | 12 +- + drivers/md/dm-bio-prison-v2.h | 10 +- + drivers/md/dm-bufio.c | 58 ++-- + drivers/md/dm-cache-background-tracker.c | 8 +- + drivers/md/dm-cache-background-tracker.h | 6 +- + drivers/md/dm-cache-metadata.c | 40 +-- + drivers/md/dm-cache-metadata.h | 4 +- + drivers/md/dm-cache-policy-internal.h | 10 +- + drivers/md/dm-cache-policy-smq.c | 163 ++++----- + drivers/md/dm-cache-policy.c | 2 +- + drivers/md/dm-cache-policy.h | 4 +- + drivers/md/dm-cache-target.c | 50 +-- + drivers/md/dm-core.h | 6 +- + drivers/md/dm-crypt.c | 48 +-- + drivers/md/dm-delay.c | 6 +- + drivers/md/dm-ebs-target.c | 2 +- + drivers/md/dm-era-target.c | 32 +- + drivers/md/dm-exception-store.c | 6 +- + drivers/md/dm-exception-store.h | 18 +- + drivers/md/dm-flakey.c | 22 +- + drivers/md/dm-integrity.c | 321 +++++++++--------- + drivers/md/dm-io-rewind.c | 4 +- + drivers/md/dm-io.c | 32 +- + drivers/md/dm-ioctl.c | 18 +- + drivers/md/dm-kcopyd.c | 30 +- + drivers/md/dm-linear.c | 2 +- + drivers/md/dm-log-userspace-base.c | 6 +- + drivers/md/dm-log-userspace-transfer.c | 2 +- + drivers/md/dm-log-writes.c | 10 +- + drivers/md/dm-log.c | 10 +- + drivers/md/dm-mpath.c | 46 +-- + drivers/md/dm-mpath.h | 2 +- + drivers/md/dm-path-selector.h | 2 +- + drivers/md/dm-ps-io-affinity.c | 4 +- + drivers/md/dm-ps-queue-length.c | 10 +- + drivers/md/dm-ps-round-robin.c | 6 +- + drivers/md/dm-ps-service-time.c | 14 +- + drivers/md/dm-raid.c | 2 +- + drivers/md/dm-raid1.c | 22 +- + drivers/md/dm-region-hash.c | 22 +- + drivers/md/dm-rq.c | 16 +- + drivers/md/dm-rq.h | 2 +- + drivers/md/dm-snap-persistent.c | 8 +- + drivers/md/dm-snap-transient.c | 6 +- + drivers/md/dm-snap.c | 34 +- + drivers/md/dm-stats.c | 74 ++-- + drivers/md/dm-stats.h | 6 +- + drivers/md/dm-stripe.c | 10 +- + drivers/md/dm-switch.c | 46 +-- + drivers/md/dm-table.c | 25 +- + drivers/md/dm-thin-metadata.c | 24 +- + drivers/md/dm-thin.c | 46 +-- + drivers/md/dm-uevent.c | 4 +- + drivers/md/dm-uevent.h | 4 +- + drivers/md/dm-verity-fec.c | 30 +- + drivers/md/dm-verity-fec.h | 18 +- + drivers/md/dm-verity-target.c | 30 +- + drivers/md/dm-verity.h | 8 +- + drivers/md/dm-writecache.c | 80 ++--- + drivers/md/dm.c | 50 ++- + drivers/md/dm.h | 4 +- + drivers/md/persistent-data/dm-array.c | 69 ++-- + drivers/md/persistent-data/dm-array.h | 2 +- + drivers/md/persistent-data/dm-bitset.c | 12 +- + drivers/md/persistent-data/dm-block-manager.c | 16 +- + drivers/md/persistent-data/dm-block-manager.h | 6 +- + drivers/md/persistent-data/dm-btree-remove.c | 46 +-- + drivers/md/persistent-data/dm-btree-spine.c | 4 +- + drivers/md/persistent-data/dm-btree.c | 98 +++--- + drivers/md/persistent-data/dm-btree.h | 12 +- + .../dm-persistent-data-internal.h | 6 +- + .../md/persistent-data/dm-space-map-common.c | 28 +- + .../persistent-data/dm-space-map-metadata.c | 20 +- + .../persistent-data/dm-transaction-manager.c | 16 +- + .../persistent-data/dm-transaction-manager.h | 2 +- + include/linux/device-mapper.h | 38 +-- + include/linux/dm-bufio.h | 12 +- + include/linux/dm-dirty-log.h | 6 +- + include/linux/dm-io.h | 8 +- + include/linux/dm-kcopyd.h | 22 +- + include/linux/dm-region-hash.h | 2 +- + 82 files changed, 1016 insertions(+), 1016 deletions(-) + +diff --git a/drivers/md/dm-bio-prison-v1.c b/drivers/md/dm-bio-prison-v1.c +index 1f8f98ef..138067ab 100644 +--- a/drivers/md/dm-bio-prison-v1.c ++++ b/drivers/md/dm-bio-prison-v1.c +@@ -285,14 +285,14 @@ EXPORT_SYMBOL_GPL(dm_cell_promote_or_release); + + struct dm_deferred_entry { + struct dm_deferred_set *ds; +- unsigned count; ++ unsigned int count; + struct list_head work_items; + }; + + struct dm_deferred_set { + spinlock_t lock; +- unsigned current_entry; +- unsigned sweeper; ++ unsigned int current_entry; ++ unsigned int sweeper; + struct dm_deferred_entry entries[DEFERRED_SET_SIZE]; + }; + +@@ -338,7 +338,7 @@ struct dm_deferred_entry *dm_deferred_entry_inc(struct dm_deferred_set *ds) + } + EXPORT_SYMBOL_GPL(dm_deferred_entry_inc); + +-static unsigned ds_next(unsigned index) ++static unsigned int ds_next(unsigned int index) + { + return (index + 1) % DEFERRED_SET_SIZE; + } +@@ -373,7 +373,7 @@ EXPORT_SYMBOL_GPL(dm_deferred_entry_dec); + int dm_deferred_set_add_work(struct dm_deferred_set *ds, struct list_head *work) + { + int r = 1; +- unsigned next_entry; ++ unsigned int next_entry; + + spin_lock_irq(&ds->lock); + if ((ds->sweeper == ds->current_entry) && +diff --git a/drivers/md/dm-bio-prison-v2.c b/drivers/md/dm-bio-prison-v2.c +index 9dec3b61..0cc0d13c 100644 +--- a/drivers/md/dm-bio-prison-v2.c ++++ b/drivers/md/dm-bio-prison-v2.c +@@ -148,7 +148,7 @@ static bool __find_or_insert(struct dm_bio_prison_v2 *prison, + + static bool __get(struct dm_bio_prison_v2 *prison, + struct dm_cell_key_v2 *key, +- unsigned lock_level, ++ unsigned int lock_level, + struct bio *inmate, + struct dm_bio_prison_cell_v2 *cell_prealloc, + struct dm_bio_prison_cell_v2 **cell) +@@ -171,7 +171,7 @@ static bool __get(struct dm_bio_prison_v2 *prison, + + bool dm_cell_get_v2(struct dm_bio_prison_v2 *prison, + struct dm_cell_key_v2 *key, +- unsigned lock_level, ++ unsigned int lock_level, + struct bio *inmate, + struct dm_bio_prison_cell_v2 *cell_prealloc, + struct dm_bio_prison_cell_v2 **cell_result) +@@ -224,7 +224,7 @@ EXPORT_SYMBOL_GPL(dm_cell_put_v2); + + static int __lock(struct dm_bio_prison_v2 *prison, + struct dm_cell_key_v2 *key, +- unsigned lock_level, ++ unsigned int lock_level, + struct dm_bio_prison_cell_v2 *cell_prealloc, + struct dm_bio_prison_cell_v2 **cell_result) + { +@@ -255,7 +255,7 @@ static int __lock(struct dm_bio_prison_v2 *prison, + + int dm_cell_lock_v2(struct dm_bio_prison_v2 *prison, + struct dm_cell_key_v2 *key, +- unsigned lock_level, ++ unsigned int lock_level, + struct dm_bio_prison_cell_v2 *cell_prealloc, + struct dm_bio_prison_cell_v2 **cell_result) + { +@@ -291,7 +291,7 @@ EXPORT_SYMBOL_GPL(dm_cell_quiesce_v2); + + static int __promote(struct dm_bio_prison_v2 *prison, + struct dm_bio_prison_cell_v2 *cell, +- unsigned new_lock_level) ++ unsigned int new_lock_level) + { + if (!cell->exclusive_lock) + return -EINVAL; +@@ -302,7 +302,7 @@ static int __promote(struct dm_bio_prison_v2 *prison, + + int dm_cell_lock_promote_v2(struct dm_bio_prison_v2 *prison, + struct dm_bio_prison_cell_v2 *cell, +- unsigned new_lock_level) ++ unsigned int new_lock_level) + { + int r; + +diff --git a/drivers/md/dm-bio-prison-v2.h b/drivers/md/dm-bio-prison-v2.h +index 6e042342..5a7d996b 100644 +--- a/drivers/md/dm-bio-prison-v2.h ++++ b/drivers/md/dm-bio-prison-v2.h +@@ -44,8 +44,8 @@ struct dm_cell_key_v2 { + struct dm_bio_prison_cell_v2 { + // FIXME: pack these + bool exclusive_lock; +- unsigned exclusive_level; +- unsigned shared_count; ++ unsigned int exclusive_level; ++ unsigned int shared_count; + struct work_struct *quiesce_continuation; + + struct rb_node node; +@@ -86,7 +86,7 @@ void dm_bio_prison_free_cell_v2(struct dm_bio_prison_v2 *prison, + */ + bool dm_cell_get_v2(struct dm_bio_prison_v2 *prison, + struct dm_cell_key_v2 *key, +- unsigned lock_level, ++ unsigned int lock_level, + struct bio *inmate, + struct dm_bio_prison_cell_v2 *cell_prealloc, + struct dm_bio_prison_cell_v2 **cell_result); +@@ -114,7 +114,7 @@ bool dm_cell_put_v2(struct dm_bio_prison_v2 *prison, + */ + int dm_cell_lock_v2(struct dm_bio_prison_v2 *prison, + struct dm_cell_key_v2 *key, +- unsigned lock_level, ++ unsigned int lock_level, + struct dm_bio_prison_cell_v2 *cell_prealloc, + struct dm_bio_prison_cell_v2 **cell_result); + +@@ -132,7 +132,7 @@ void dm_cell_quiesce_v2(struct dm_bio_prison_v2 *prison, + */ + int dm_cell_lock_promote_v2(struct dm_bio_prison_v2 *prison, + struct dm_bio_prison_cell_v2 *cell, +- unsigned new_lock_level); ++ unsigned int new_lock_level); + + /* + * Adds any held bios to the bio list. +diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c +index 19caaf68..382c5cc4 100644 +--- a/drivers/md/dm-bufio.c ++++ b/drivers/md/dm-bufio.c +@@ -89,7 +89,7 @@ struct dm_bufio_client { + unsigned long n_buffers[LIST_SIZE]; + + struct block_device *bdev; +- unsigned block_size; ++ unsigned int block_size; + s8 sectors_per_block_bits; + void (*alloc_callback)(struct dm_buffer *); + void (*write_callback)(struct dm_buffer *); +@@ -98,9 +98,9 @@ struct dm_bufio_client { + struct dm_io_client *dm_io; + + struct list_head reserved_buffers; +- unsigned need_reserved_buffers; ++ unsigned int need_reserved_buffers; + +- unsigned minimum_buffers; ++ unsigned int minimum_buffers; + + struct rb_root buffer_tree; + wait_queue_head_t free_buffer_wait; +@@ -145,14 +145,14 @@ struct dm_buffer { + unsigned char list_mode; /* LIST_* */ + blk_status_t read_error; + blk_status_t write_error; +- unsigned accessed; +- unsigned hold_count; ++ unsigned int accessed; ++ unsigned int hold_count; + unsigned long state; + unsigned long last_accessed; +- unsigned dirty_start; +- unsigned dirty_end; +- unsigned write_start; +- unsigned write_end; ++ unsigned int dirty_start; ++ unsigned int dirty_end; ++ unsigned int write_start; ++ unsigned int write_end; + struct dm_bufio_client *c; + struct list_head write_list; + void (*end_io)(struct dm_buffer *, blk_status_t); +@@ -220,7 +220,7 @@ static unsigned long global_num = 0; + /* + * Buffers are freed after this timeout + */ +-static unsigned dm_bufio_max_age = DM_BUFIO_DEFAULT_AGE_SECS; ++static unsigned int dm_bufio_max_age = DM_BUFIO_DEFAULT_AGE_SECS; + static unsigned long dm_bufio_retain_bytes = DM_BUFIO_DEFAULT_RETAIN_BYTES; + + static unsigned long dm_bufio_peak_allocated; +@@ -438,7 +438,7 @@ static void *alloc_buffer_data(struct dm_bufio_client *c, gfp_t gfp_mask, + * as if GFP_NOIO was specified. + */ + if (gfp_mask & __GFP_NORETRY) { +- unsigned noio_flag = memalloc_noio_save(); ++ unsigned int noio_flag = memalloc_noio_save(); + void *ptr = __vmalloc(c->block_size, gfp_mask); + + memalloc_noio_restore(noio_flag); +@@ -591,7 +591,7 @@ static void dmio_complete(unsigned long error, void *context) + } + + static void use_dmio(struct dm_buffer *b, enum req_op op, sector_t sector, +- unsigned n_sectors, unsigned offset) ++ unsigned int n_sectors, unsigned int offset) + { + int r; + struct dm_io_request io_req = { +@@ -629,11 +629,11 @@ static void bio_complete(struct bio *bio) + } + + static void use_bio(struct dm_buffer *b, enum req_op op, sector_t sector, +- unsigned n_sectors, unsigned offset) ++ unsigned int n_sectors, unsigned int offset) + { + struct bio *bio; + char *ptr; +- unsigned vec_size, len; ++ unsigned int vec_size, len; + + vec_size = b->c->block_size >> PAGE_SHIFT; + if (unlikely(b->c->sectors_per_block_bits < PAGE_SHIFT - SECTOR_SHIFT)) +@@ -654,7 +654,7 @@ static void use_bio(struct dm_buffer *b, enum req_op op, sector_t sector, + len = n_sectors << SECTOR_SHIFT; + + do { +- unsigned this_step = min((unsigned)(PAGE_SIZE - offset_in_page(ptr)), len); ++ unsigned int this_step = min((unsigned int)(PAGE_SIZE - offset_in_page(ptr)), len); + if (!bio_add_page(bio, virt_to_page(ptr), this_step, + offset_in_page(ptr))) { + bio_put(bio); +@@ -684,9 +684,9 @@ static inline sector_t block_to_sector(struct dm_bufio_client *c, sector_t block + static void submit_io(struct dm_buffer *b, enum req_op op, + void (*end_io)(struct dm_buffer *, blk_status_t)) + { +- unsigned n_sectors; ++ unsigned int n_sectors; + sector_t sector; +- unsigned offset, end; ++ unsigned int offset, end; + + b->end_io = end_io; + +@@ -1156,7 +1156,7 @@ void *dm_bufio_new(struct dm_bufio_client *c, sector_t block, + EXPORT_SYMBOL_GPL(dm_bufio_new); + + void dm_bufio_prefetch(struct dm_bufio_client *c, +- sector_t block, unsigned n_blocks) ++ sector_t block, unsigned int n_blocks) + { + struct blk_plug plug; + +@@ -1232,7 +1232,7 @@ void dm_bufio_release(struct dm_buffer *b) + EXPORT_SYMBOL_GPL(dm_bufio_release); + + void dm_bufio_mark_partial_buffer_dirty(struct dm_buffer *b, +- unsigned start, unsigned end) ++ unsigned int start, unsigned int end) + { + struct dm_bufio_client *c = b->c; + +@@ -1529,13 +1529,13 @@ void dm_bufio_forget_buffers(struct dm_bufio_client *c, sector_t block, sector_t + } + EXPORT_SYMBOL_GPL(dm_bufio_forget_buffers); + +-void dm_bufio_set_minimum_buffers(struct dm_bufio_client *c, unsigned n) ++void dm_bufio_set_minimum_buffers(struct dm_bufio_client *c, unsigned int n) + { + c->minimum_buffers = n; + } + EXPORT_SYMBOL_GPL(dm_bufio_set_minimum_buffers); + +-unsigned dm_bufio_get_block_size(struct dm_bufio_client *c) ++unsigned int dm_bufio_get_block_size(struct dm_bufio_client *c) + { + return c->block_size; + } +@@ -1734,15 +1734,15 @@ static unsigned long dm_bufio_shrink_count(struct shrinker *shrink, struct shrin + /* + * Create the buffering interface + */ +-struct dm_bufio_client *dm_bufio_client_create(struct block_device *bdev, unsigned block_size, +- unsigned reserved_buffers, unsigned aux_size, ++struct dm_bufio_client *dm_bufio_client_create(struct block_device *bdev, unsigned int block_size, ++ unsigned int reserved_buffers, unsigned int aux_size, + void (*alloc_callback)(struct dm_buffer *), + void (*write_callback)(struct dm_buffer *), + unsigned int flags) + { + int r; + struct dm_bufio_client *c; +- unsigned i; ++ unsigned int i; + char slab_name[27]; + + if (!block_size || block_size & ((1 << SECTOR_SHIFT) - 1)) { +@@ -1796,7 +1796,7 @@ struct dm_bufio_client *dm_bufio_client_create(struct block_device *bdev, unsign + + if (block_size <= KMALLOC_MAX_SIZE && + (block_size < PAGE_SIZE || !is_power_of_2(block_size))) { +- unsigned align = min(1U << __ffs(block_size), (unsigned)PAGE_SIZE); ++ unsigned int align = min(1U << __ffs(block_size), (unsigned int)PAGE_SIZE); + snprintf(slab_name, sizeof slab_name, "dm_bufio_cache-%u", block_size); + c->slab_cache = kmem_cache_create(slab_name, block_size, align, + SLAB_RECLAIM_ACCOUNT, NULL); +@@ -1872,7 +1872,7 @@ EXPORT_SYMBOL_GPL(dm_bufio_client_create); + */ + void dm_bufio_client_destroy(struct dm_bufio_client *c) + { +- unsigned i; ++ unsigned int i; + + drop_buffers(c); + +@@ -1920,9 +1920,9 @@ void dm_bufio_set_sector_offset(struct dm_bufio_client *c, sector_t start) + } + EXPORT_SYMBOL_GPL(dm_bufio_set_sector_offset); + +-static unsigned get_max_age_hz(void) ++static unsigned int get_max_age_hz(void) + { +- unsigned max_age = READ_ONCE(dm_bufio_max_age); ++ unsigned int max_age = READ_ONCE(dm_bufio_max_age); + + if (max_age > UINT_MAX / HZ) + max_age = UINT_MAX / HZ; +@@ -1973,7 +1973,7 @@ static void do_global_cleanup(struct work_struct *w) + struct dm_bufio_client *locked_client = NULL; + struct dm_bufio_client *current_client; + struct dm_buffer *b; +- unsigned spinlock_hold_count; ++ unsigned int spinlock_hold_count; + unsigned long threshold = dm_bufio_cache_size - + dm_bufio_cache_size / DM_BUFIO_LOW_WATERMARK_RATIO; + unsigned long loops = global_num * 2; +diff --git a/drivers/md/dm-cache-background-tracker.c b/drivers/md/dm-cache-background-tracker.c +index 7887f99b..c606e6bf 100644 +--- a/drivers/md/dm-cache-background-tracker.c ++++ b/drivers/md/dm-cache-background-tracker.c +@@ -17,7 +17,7 @@ struct bt_work { + }; + + struct background_tracker { +- unsigned max_work; ++ unsigned int max_work; + atomic_t pending_promotes; + atomic_t pending_writebacks; + atomic_t pending_demotes; +@@ -29,7 +29,7 @@ struct background_tracker { + struct kmem_cache *work_cache; + }; + +-struct background_tracker *btracker_create(unsigned max_work) ++struct background_tracker *btracker_create(unsigned int max_work) + { + struct background_tracker *b = kmalloc(sizeof(*b), GFP_KERNEL); + +@@ -155,13 +155,13 @@ static void update_stats(struct background_tracker *b, struct policy_work *w, in + } + } + +-unsigned btracker_nr_writebacks_queued(struct background_tracker *b) ++unsigned int btracker_nr_writebacks_queued(struct background_tracker *b) + { + return atomic_read(&b->pending_writebacks); + } + EXPORT_SYMBOL_GPL(btracker_nr_writebacks_queued); + +-unsigned btracker_nr_demotions_queued(struct background_tracker *b) ++unsigned int btracker_nr_demotions_queued(struct background_tracker *b) + { + return atomic_read(&b->pending_demotes); + } +diff --git a/drivers/md/dm-cache-background-tracker.h b/drivers/md/dm-cache-background-tracker.h +index b5056e82..14d3d53d 100644 +--- a/drivers/md/dm-cache-background-tracker.h ++++ b/drivers/md/dm-cache-background-tracker.h +@@ -32,7 +32,7 @@ struct background_tracker; + * Create a new tracker, it will not be able to queue more than + * 'max_work' entries. + */ +-struct background_tracker *btracker_create(unsigned max_work); ++struct background_tracker *btracker_create(unsigned int max_work); + + /* + * Destroy the tracker. No issued, but not complete, work should +@@ -41,8 +41,8 @@ struct background_tracker *btracker_create(unsigned max_work); + */ + void btracker_destroy(struct background_tracker *b); + +-unsigned btracker_nr_writebacks_queued(struct background_tracker *b); +-unsigned btracker_nr_demotions_queued(struct background_tracker *b); ++unsigned int btracker_nr_writebacks_queued(struct background_tracker *b); ++unsigned int btracker_nr_demotions_queued(struct background_tracker *b); + + /* + * Queue some work within the tracker. 'work' should point to the work +diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c +index 83a5975b..f5b4c996 100644 +--- a/drivers/md/dm-cache-metadata.c ++++ b/drivers/md/dm-cache-metadata.c +@@ -104,7 +104,7 @@ struct dm_cache_metadata { + refcount_t ref_count; + struct list_head list; + +- unsigned version; ++ unsigned int version; + struct block_device *bdev; + struct dm_block_manager *bm; + struct dm_space_map *metadata_sm; +@@ -129,7 +129,7 @@ struct dm_cache_metadata { + bool clean_when_opened:1; + + char policy_name[CACHE_POLICY_NAME_SIZE]; +- unsigned policy_version[CACHE_POLICY_VERSION_SIZE]; ++ unsigned int policy_version[CACHE_POLICY_VERSION_SIZE]; + size_t policy_hint_size; + struct dm_cache_statistics stats; + +@@ -260,10 +260,10 @@ static int superblock_lock(struct dm_cache_metadata *cmd, + static int __superblock_all_zeroes(struct dm_block_manager *bm, bool *result) + { + int r; +- unsigned i; ++ unsigned int i; + struct dm_block *b; + __le64 *data_le, zero = cpu_to_le64(0); +- unsigned sb_block_size = dm_bm_block_size(bm) / sizeof(__le64); ++ unsigned int sb_block_size = dm_bm_block_size(bm) / sizeof(__le64); + + /* + * We can't use a validator here - it may be all zeroes. +@@ -727,7 +727,7 @@ static int __commit_transaction(struct dm_cache_metadata *cmd, + */ + #define FLAGS_MASK ((1 << 16) - 1) + +-static __le64 pack_value(dm_oblock_t block, unsigned flags) ++static __le64 pack_value(dm_oblock_t block, unsigned int flags) + { + uint64_t value = from_oblock(block); + value <<= 16; +@@ -735,7 +735,7 @@ static __le64 pack_value(dm_oblock_t block, unsigned flags) + return cpu_to_le64(value); + } + +-static void unpack_value(__le64 value_le, dm_oblock_t *block, unsigned *flags) ++static void unpack_value(__le64 value_le, dm_oblock_t *block, unsigned int *flags) + { + uint64_t value = le64_to_cpu(value_le); + uint64_t b = value >> 16; +@@ -749,7 +749,7 @@ static struct dm_cache_metadata *metadata_open(struct block_device *bdev, + sector_t data_block_size, + bool may_format_device, + size_t policy_hint_size, +- unsigned metadata_version) ++ unsigned int metadata_version) + { + int r; + struct dm_cache_metadata *cmd; +@@ -810,7 +810,7 @@ static struct dm_cache_metadata *lookup_or_open(struct block_device *bdev, + sector_t data_block_size, + bool may_format_device, + size_t policy_hint_size, +- unsigned metadata_version) ++ unsigned int metadata_version) + { + struct dm_cache_metadata *cmd, *cmd2; + +@@ -855,7 +855,7 @@ struct dm_cache_metadata *dm_cache_metadata_open(struct block_device *bdev, + sector_t data_block_size, + bool may_format_device, + size_t policy_hint_size, +- unsigned metadata_version) ++ unsigned int metadata_version) + { + struct dm_cache_metadata *cmd = lookup_or_open(bdev, data_block_size, may_format_device, + policy_hint_size, metadata_version); +@@ -890,7 +890,7 @@ static int block_clean_combined_dirty(struct dm_cache_metadata *cmd, dm_cblock_t + int r; + __le64 value; + dm_oblock_t ob; +- unsigned flags; ++ unsigned int flags; + + r = dm_array_get_value(&cmd->info, cmd->root, from_cblock(b), &value); + if (r) +@@ -1288,7 +1288,7 @@ static bool policy_unchanged(struct dm_cache_metadata *cmd, + struct dm_cache_policy *policy) + { + const char *policy_name = dm_cache_policy_get_name(policy); +- const unsigned *policy_version = dm_cache_policy_get_version(policy); ++ const unsigned int *policy_version = dm_cache_policy_get_version(policy); + size_t policy_hint_size = dm_cache_policy_get_hint_size(policy); + + /* +@@ -1339,7 +1339,7 @@ static int __load_mapping_v1(struct dm_cache_metadata *cmd, + __le32 *hint_value_le; + + dm_oblock_t oblock; +- unsigned flags; ++ unsigned int flags; + bool dirty = true; + + dm_array_cursor_get_value(mapping_cursor, (void **) &mapping_value_le); +@@ -1381,7 +1381,7 @@ static int __load_mapping_v2(struct dm_cache_metadata *cmd, + __le32 *hint_value_le; + + dm_oblock_t oblock; +- unsigned flags; ++ unsigned int flags; + bool dirty = true; + + dm_array_cursor_get_value(mapping_cursor, (void **) &mapping_value_le); +@@ -1513,7 +1513,7 @@ static int __dump_mapping(void *context, uint64_t cblock, void *leaf) + { + __le64 value; + dm_oblock_t oblock; +- unsigned flags; ++ unsigned int flags; + + memcpy(&value, leaf, sizeof(value)); + unpack_value(value, &oblock, &flags); +@@ -1547,7 +1547,7 @@ int dm_cache_changed_this_transaction(struct dm_cache_metadata *cmd) + static int __dirty(struct dm_cache_metadata *cmd, dm_cblock_t cblock, bool dirty) + { + int r; +- unsigned flags; ++ unsigned int flags; + dm_oblock_t oblock; + __le64 value; + +@@ -1574,10 +1574,10 @@ static int __dirty(struct dm_cache_metadata *cmd, dm_cblock_t cblock, bool dirty + + } + +-static int __set_dirty_bits_v1(struct dm_cache_metadata *cmd, unsigned nr_bits, unsigned long *bits) ++static int __set_dirty_bits_v1(struct dm_cache_metadata *cmd, unsigned int nr_bits, unsigned long *bits) + { + int r; +- unsigned i; ++ unsigned int i; + for (i = 0; i < nr_bits; i++) { + r = __dirty(cmd, to_cblock(i), test_bit(i, bits)); + if (r) +@@ -1594,7 +1594,7 @@ static int is_dirty_callback(uint32_t index, bool *value, void *context) + return 0; + } + +-static int __set_dirty_bits_v2(struct dm_cache_metadata *cmd, unsigned nr_bits, unsigned long *bits) ++static int __set_dirty_bits_v2(struct dm_cache_metadata *cmd, unsigned int nr_bits, unsigned long *bits) + { + int r = 0; + +@@ -1613,7 +1613,7 @@ static int __set_dirty_bits_v2(struct dm_cache_metadata *cmd, unsigned nr_bits, + } + + int dm_cache_set_dirty_bits(struct dm_cache_metadata *cmd, +- unsigned nr_bits, ++ unsigned int nr_bits, + unsigned long *bits) + { + int r; +@@ -1712,7 +1712,7 @@ static int write_hints(struct dm_cache_metadata *cmd, struct dm_cache_policy *po + int r; + size_t hint_size; + const char *policy_name = dm_cache_policy_get_name(policy); +- const unsigned *policy_version = dm_cache_policy_get_version(policy); ++ const unsigned int *policy_version = dm_cache_policy_get_version(policy); + + if (!policy_name[0] || + (strlen(policy_name) > sizeof(cmd->policy_name) - 1)) +diff --git a/drivers/md/dm-cache-metadata.h b/drivers/md/dm-cache-metadata.h +index 0905f2c1..b40322bc 100644 +--- a/drivers/md/dm-cache-metadata.h ++++ b/drivers/md/dm-cache-metadata.h +@@ -60,7 +60,7 @@ struct dm_cache_metadata *dm_cache_metadata_open(struct block_device *bdev, + sector_t data_block_size, + bool may_format_device, + size_t policy_hint_size, +- unsigned metadata_version); ++ unsigned int metadata_version); + + void dm_cache_metadata_close(struct dm_cache_metadata *cmd); + +@@ -96,7 +96,7 @@ int dm_cache_load_mappings(struct dm_cache_metadata *cmd, + void *context); + + int dm_cache_set_dirty_bits(struct dm_cache_metadata *cmd, +- unsigned nr_bits, unsigned long *bits); ++ unsigned int nr_bits, unsigned long *bits); + + struct dm_cache_statistics { + uint32_t read_hits; +diff --git a/drivers/md/dm-cache-policy-internal.h b/drivers/md/dm-cache-policy-internal.h +index 56f0a23f..8e49baa7 100644 +--- a/drivers/md/dm-cache-policy-internal.h ++++ b/drivers/md/dm-cache-policy-internal.h +@@ -85,7 +85,7 @@ static inline void policy_tick(struct dm_cache_policy *p, bool can_block) + } + + static inline int policy_emit_config_values(struct dm_cache_policy *p, char *result, +- unsigned maxlen, ssize_t *sz_ptr) ++ unsigned int maxlen, ssize_t *sz_ptr) + { + ssize_t sz = *sz_ptr; + if (p->emit_config_values) +@@ -112,18 +112,18 @@ static inline void policy_allow_migrations(struct dm_cache_policy *p, bool allow + /* + * Some utility functions commonly used by policies and the core target. + */ +-static inline size_t bitset_size_in_bytes(unsigned nr_entries) ++static inline size_t bitset_size_in_bytes(unsigned int nr_entries) + { + return sizeof(unsigned long) * dm_div_up(nr_entries, BITS_PER_LONG); + } + +-static inline unsigned long *alloc_bitset(unsigned nr_entries) ++static inline unsigned long *alloc_bitset(unsigned int nr_entries) + { + size_t s = bitset_size_in_bytes(nr_entries); + return vzalloc(s); + } + +-static inline void clear_bitset(void *bitset, unsigned nr_entries) ++static inline void clear_bitset(void *bitset, unsigned int nr_entries) + { + size_t s = bitset_size_in_bytes(nr_entries); + memset(bitset, 0, s); +@@ -154,7 +154,7 @@ void dm_cache_policy_destroy(struct dm_cache_policy *p); + */ + const char *dm_cache_policy_get_name(struct dm_cache_policy *p); + +-const unsigned *dm_cache_policy_get_version(struct dm_cache_policy *p); ++const unsigned int *dm_cache_policy_get_version(struct dm_cache_policy *p); + + size_t dm_cache_policy_get_hint_size(struct dm_cache_policy *p); + +diff --git a/drivers/md/dm-cache-policy-smq.c b/drivers/md/dm-cache-policy-smq.c +index a3d281fc..54343812 100644 +--- a/drivers/md/dm-cache-policy-smq.c ++++ b/drivers/md/dm-cache-policy-smq.c +@@ -23,12 +23,12 @@ + /* + * Safe division functions that return zero on divide by zero. + */ +-static unsigned safe_div(unsigned n, unsigned d) ++static unsigned int safe_div(unsigned int n, unsigned int d) + { + return d ? n / d : 0u; + } + +-static unsigned safe_mod(unsigned n, unsigned d) ++static unsigned int safe_mod(unsigned int n, unsigned int d) + { + return d ? n % d : 0u; + } +@@ -36,10 +36,10 @@ static unsigned safe_mod(unsigned n, unsigned d) + /*----------------------------------------------------------------*/ + + struct entry { +- unsigned hash_next:28; +- unsigned prev:28; +- unsigned next:28; +- unsigned level:6; ++ unsigned int hash_next:28; ++ unsigned int prev:28; ++ unsigned int next:28; ++ unsigned int level:6; + bool dirty:1; + bool allocated:1; + bool sentinel:1; +@@ -62,7 +62,7 @@ struct entry_space { + struct entry *end; + }; + +-static int space_init(struct entry_space *es, unsigned nr_entries) ++static int space_init(struct entry_space *es, unsigned int nr_entries) + { + if (!nr_entries) { + es->begin = es->end = NULL; +@@ -82,7 +82,7 @@ static void space_exit(struct entry_space *es) + vfree(es->begin); + } + +-static struct entry *__get_entry(struct entry_space *es, unsigned block) ++static struct entry *__get_entry(struct entry_space *es, unsigned int block) + { + struct entry *e; + +@@ -92,13 +92,13 @@ static struct entry *__get_entry(struct entry_space *es, unsigned block) + return e; + } + +-static unsigned to_index(struct entry_space *es, struct entry *e) ++static unsigned int to_index(struct entry_space *es, struct entry *e) + { + BUG_ON(e < es->begin || e >= es->end); + return e - es->begin; + } + +-static struct entry *to_entry(struct entry_space *es, unsigned block) ++static struct entry *to_entry(struct entry_space *es, unsigned int block) + { + if (block == INDEXER_NULL) + return NULL; +@@ -109,8 +109,8 @@ static struct entry *to_entry(struct entry_space *es, unsigned block) + /*----------------------------------------------------------------*/ + + struct ilist { +- unsigned nr_elts; /* excluding sentinel entries */ +- unsigned head, tail; ++ unsigned int nr_elts; /* excluding sentinel entries */ ++ unsigned int head, tail; + }; + + static void l_init(struct ilist *l) +@@ -252,23 +252,23 @@ static struct entry *l_pop_tail(struct entry_space *es, struct ilist *l) + struct queue { + struct entry_space *es; + +- unsigned nr_elts; +- unsigned nr_levels; ++ unsigned int nr_elts; ++ unsigned int nr_levels; + struct ilist qs[MAX_LEVELS]; + + /* + * We maintain a count of the number of entries we would like in each + * level. + */ +- unsigned last_target_nr_elts; +- unsigned nr_top_levels; +- unsigned nr_in_top_levels; +- unsigned target_count[MAX_LEVELS]; ++ unsigned int last_target_nr_elts; ++ unsigned int nr_top_levels; ++ unsigned int nr_in_top_levels; ++ unsigned int target_count[MAX_LEVELS]; + }; + +-static void q_init(struct queue *q, struct entry_space *es, unsigned nr_levels) ++static void q_init(struct queue *q, struct entry_space *es, unsigned int nr_levels) + { +- unsigned i; ++ unsigned int i; + + q->es = es; + q->nr_elts = 0; +@@ -284,7 +284,7 @@ static void q_init(struct queue *q, struct entry_space *es, unsigned nr_levels) + q->nr_in_top_levels = 0u; + } + +-static unsigned q_size(struct queue *q) ++static unsigned int q_size(struct queue *q) + { + return q->nr_elts; + } +@@ -332,9 +332,9 @@ static void q_del(struct queue *q, struct entry *e) + /* + * Return the oldest entry of the lowest populated level. + */ +-static struct entry *q_peek(struct queue *q, unsigned max_level, bool can_cross_sentinel) ++static struct entry *q_peek(struct queue *q, unsigned int max_level, bool can_cross_sentinel) + { +- unsigned level; ++ unsigned int level; + struct entry *e; + + max_level = min(max_level, q->nr_levels); +@@ -369,7 +369,7 @@ static struct entry *q_pop(struct queue *q) + * used by redistribute, so we know this is true. It also doesn't adjust + * the q->nr_elts count. + */ +-static struct entry *__redist_pop_from(struct queue *q, unsigned level) ++static struct entry *__redist_pop_from(struct queue *q, unsigned int level) + { + struct entry *e; + +@@ -383,9 +383,10 @@ static struct entry *__redist_pop_from(struct queue *q, unsigned level) + return NULL; + } + +-static void q_set_targets_subrange_(struct queue *q, unsigned nr_elts, unsigned lbegin, unsigned lend) ++static void q_set_targets_subrange_(struct queue *q, unsigned int nr_elts, ++ unsigned int lbegin, unsigned int lend) + { +- unsigned level, nr_levels, entries_per_level, remainder; ++ unsigned int level, nr_levels, entries_per_level, remainder; + + BUG_ON(lbegin > lend); + BUG_ON(lend > q->nr_levels); +@@ -426,7 +427,7 @@ static void q_set_targets(struct queue *q) + + static void q_redistribute(struct queue *q) + { +- unsigned target, level; ++ unsigned int target, level; + struct ilist *l, *l_above; + struct entry *e; + +@@ -467,12 +468,12 @@ static void q_redistribute(struct queue *q) + } + } + +-static void q_requeue(struct queue *q, struct entry *e, unsigned extra_levels, ++static void q_requeue(struct queue *q, struct entry *e, unsigned int extra_levels, + struct entry *s1, struct entry *s2) + { + struct entry *de; +- unsigned sentinels_passed = 0; +- unsigned new_level = min(q->nr_levels - 1u, e->level + extra_levels); ++ unsigned int sentinels_passed = 0; ++ unsigned int new_level = min(q->nr_levels - 1u, e->level + extra_levels); + + /* try and find an entry to swap with */ + if (extra_levels && (e->level < q->nr_levels - 1u)) { +@@ -512,9 +513,9 @@ static void q_requeue(struct queue *q, struct entry *e, unsigned extra_levels, + #define EIGHTH (1u << (FP_SHIFT - 3u)) + + struct stats { +- unsigned hit_threshold; +- unsigned hits; +- unsigned misses; ++ unsigned int hit_threshold; ++ unsigned int hits; ++ unsigned int misses; + }; + + enum performance { +@@ -523,7 +524,7 @@ enum performance { + Q_WELL + }; + +-static void stats_init(struct stats *s, unsigned nr_levels) ++static void stats_init(struct stats *s, unsigned int nr_levels) + { + s->hit_threshold = (nr_levels * 3u) / 4u; + s->hits = 0u; +@@ -535,7 +536,7 @@ static void stats_reset(struct stats *s) + s->hits = s->misses = 0u; + } + +-static void stats_level_accessed(struct stats *s, unsigned level) ++static void stats_level_accessed(struct stats *s, unsigned int level) + { + if (level >= s->hit_threshold) + s->hits++; +@@ -556,7 +557,7 @@ static void stats_miss(struct stats *s) + */ + static enum performance stats_assess(struct stats *s) + { +- unsigned confidence = safe_div(s->hits << FP_SHIFT, s->hits + s->misses); ++ unsigned int confidence = safe_div(s->hits << FP_SHIFT, s->hits + s->misses); + + if (confidence < SIXTEENTH) + return Q_POOR; +@@ -573,16 +574,16 @@ static enum performance stats_assess(struct stats *s) + struct smq_hash_table { + struct entry_space *es; + unsigned long long hash_bits; +- unsigned *buckets; ++ unsigned int *buckets; + }; + + /* + * All cache entries are stored in a chained hash table. To save space we + * use indexing again, and only store indexes to the next entry. + */ +-static int h_init(struct smq_hash_table *ht, struct entry_space *es, unsigned nr_entries) ++static int h_init(struct smq_hash_table *ht, struct entry_space *es, unsigned int nr_entries) + { +- unsigned i, nr_buckets; ++ unsigned int i, nr_buckets; + + ht->es = es; + nr_buckets = roundup_pow_of_two(max(nr_entries / 4u, 16u)); +@@ -603,7 +604,7 @@ static void h_exit(struct smq_hash_table *ht) + vfree(ht->buckets); + } + +-static struct entry *h_head(struct smq_hash_table *ht, unsigned bucket) ++static struct entry *h_head(struct smq_hash_table *ht, unsigned int bucket) + { + return to_entry(ht->es, ht->buckets[bucket]); + } +@@ -613,7 +614,7 @@ static struct entry *h_next(struct smq_hash_table *ht, struct entry *e) + return to_entry(ht->es, e->hash_next); + } + +-static void __h_insert(struct smq_hash_table *ht, unsigned bucket, struct entry *e) ++static void __h_insert(struct smq_hash_table *ht, unsigned int bucket, struct entry *e) + { + e->hash_next = ht->buckets[bucket]; + ht->buckets[bucket] = to_index(ht->es, e); +@@ -621,11 +622,11 @@ static void __h_insert(struct smq_hash_table *ht, unsigned bucket, struct entry + + static void h_insert(struct smq_hash_table *ht, struct entry *e) + { +- unsigned h = hash_64(from_oblock(e->oblock), ht->hash_bits); ++ unsigned int h = hash_64(from_oblock(e->oblock), ht->hash_bits); + __h_insert(ht, h, e); + } + +-static struct entry *__h_lookup(struct smq_hash_table *ht, unsigned h, dm_oblock_t oblock, ++static struct entry *__h_lookup(struct smq_hash_table *ht, unsigned int h, dm_oblock_t oblock, + struct entry **prev) + { + struct entry *e; +@@ -641,7 +642,7 @@ static struct entry *__h_lookup(struct smq_hash_table *ht, unsigned h, dm_oblock + return NULL; + } + +-static void __h_unlink(struct smq_hash_table *ht, unsigned h, ++static void __h_unlink(struct smq_hash_table *ht, unsigned int h, + struct entry *e, struct entry *prev) + { + if (prev) +@@ -656,7 +657,7 @@ static void __h_unlink(struct smq_hash_table *ht, unsigned h, + static struct entry *h_lookup(struct smq_hash_table *ht, dm_oblock_t oblock) + { + struct entry *e, *prev; +- unsigned h = hash_64(from_oblock(oblock), ht->hash_bits); ++ unsigned int h = hash_64(from_oblock(oblock), ht->hash_bits); + + e = __h_lookup(ht, h, oblock, &prev); + if (e && prev) { +@@ -673,7 +674,7 @@ static struct entry *h_lookup(struct smq_hash_table *ht, dm_oblock_t oblock) + + static void h_remove(struct smq_hash_table *ht, struct entry *e) + { +- unsigned h = hash_64(from_oblock(e->oblock), ht->hash_bits); ++ unsigned int h = hash_64(from_oblock(e->oblock), ht->hash_bits); + struct entry *prev; + + /* +@@ -689,16 +690,16 @@ static void h_remove(struct smq_hash_table *ht, struct entry *e) + + struct entry_alloc { + struct entry_space *es; +- unsigned begin; ++ unsigned int begin; + +- unsigned nr_allocated; ++ unsigned int nr_allocated; + struct ilist free; + }; + + static void init_allocator(struct entry_alloc *ea, struct entry_space *es, +- unsigned begin, unsigned end) ++ unsigned int begin, unsigned int end) + { +- unsigned i; ++ unsigned int i; + + ea->es = es; + ea->nr_allocated = 0u; +@@ -742,7 +743,7 @@ static struct entry *alloc_entry(struct entry_alloc *ea) + /* + * This assumes the cblock hasn't already been allocated. + */ +-static struct entry *alloc_particular_entry(struct entry_alloc *ea, unsigned i) ++static struct entry *alloc_particular_entry(struct entry_alloc *ea, unsigned int i) + { + struct entry *e = __get_entry(ea->es, ea->begin + i); + +@@ -770,12 +771,12 @@ static bool allocator_empty(struct entry_alloc *ea) + return l_empty(&ea->free); + } + +-static unsigned get_index(struct entry_alloc *ea, struct entry *e) ++static unsigned int get_index(struct entry_alloc *ea, struct entry *e) + { + return to_index(ea->es, e) - ea->begin; + } + +-static struct entry *get_entry(struct entry_alloc *ea, unsigned index) ++static struct entry *get_entry(struct entry_alloc *ea, unsigned int index) + { + return __get_entry(ea->es, ea->begin + index); + } +@@ -800,9 +801,9 @@ struct smq_policy { + sector_t cache_block_size; + + sector_t hotspot_block_size; +- unsigned nr_hotspot_blocks; +- unsigned cache_blocks_per_hotspot_block; +- unsigned hotspot_level_jump; ++ unsigned int nr_hotspot_blocks; ++ unsigned int cache_blocks_per_hotspot_block; ++ unsigned int hotspot_level_jump; + + struct entry_space es; + struct entry_alloc writeback_sentinel_alloc; +@@ -831,7 +832,7 @@ struct smq_policy { + * Keeps track of time, incremented by the core. We use this to + * avoid attributing multiple hits within the same tick. + */ +- unsigned tick; ++ unsigned int tick; + + /* + * The hash tables allows us to quickly find an entry by origin +@@ -846,8 +847,8 @@ struct smq_policy { + bool current_demote_sentinels; + unsigned long next_demote_period; + +- unsigned write_promote_level; +- unsigned read_promote_level; ++ unsigned int write_promote_level; ++ unsigned int read_promote_level; + + unsigned long next_hotspot_period; + unsigned long next_cache_period; +@@ -859,24 +860,24 @@ struct smq_policy { + + /*----------------------------------------------------------------*/ + +-static struct entry *get_sentinel(struct entry_alloc *ea, unsigned level, bool which) ++static struct entry *get_sentinel(struct entry_alloc *ea, unsigned int level, bool which) + { + return get_entry(ea, which ? level : NR_CACHE_LEVELS + level); + } + +-static struct entry *writeback_sentinel(struct smq_policy *mq, unsigned level) ++static struct entry *writeback_sentinel(struct smq_policy *mq, unsigned int level) + { + return get_sentinel(&mq->writeback_sentinel_alloc, level, mq->current_writeback_sentinels); + } + +-static struct entry *demote_sentinel(struct smq_policy *mq, unsigned level) ++static struct entry *demote_sentinel(struct smq_policy *mq, unsigned int level) + { + return get_sentinel(&mq->demote_sentinel_alloc, level, mq->current_demote_sentinels); + } + + static void __update_writeback_sentinels(struct smq_policy *mq) + { +- unsigned level; ++ unsigned int level; + struct queue *q = &mq->dirty; + struct entry *sentinel; + +@@ -889,7 +890,7 @@ static void __update_writeback_sentinels(struct smq_policy *mq) + + static void __update_demote_sentinels(struct smq_policy *mq) + { +- unsigned level; ++ unsigned int level; + struct queue *q = &mq->clean; + struct entry *sentinel; + +@@ -917,7 +918,7 @@ static void update_sentinels(struct smq_policy *mq) + + static void __sentinels_init(struct smq_policy *mq) + { +- unsigned level; ++ unsigned int level; + struct entry *sentinel; + + for (level = 0; level < NR_CACHE_LEVELS; level++) { +@@ -1008,7 +1009,7 @@ static void requeue(struct smq_policy *mq, struct entry *e) + } + } + +-static unsigned default_promote_level(struct smq_policy *mq) ++static unsigned int default_promote_level(struct smq_policy *mq) + { + /* + * The promote level depends on the current performance of the +@@ -1030,9 +1031,9 @@ static unsigned default_promote_level(struct smq_policy *mq) + 1, 1, 1, 2, 4, 6, 7, 8, 7, 6, 4, 4, 3, 3, 2, 2, 1 + }; + +- unsigned hits = mq->cache_stats.hits; +- unsigned misses = mq->cache_stats.misses; +- unsigned index = safe_div(hits << 4u, hits + misses); ++ unsigned int hits = mq->cache_stats.hits; ++ unsigned int misses = mq->cache_stats.misses; ++ unsigned int index = safe_div(hits << 4u, hits + misses); + return table[index]; + } + +@@ -1042,7 +1043,7 @@ static void update_promote_levels(struct smq_policy *mq) + * If there are unused cache entries then we want to be really + * eager to promote. + */ +- unsigned threshold_level = allocator_empty(&mq->cache_alloc) ? ++ unsigned int threshold_level = allocator_empty(&mq->cache_alloc) ? + default_promote_level(mq) : (NR_HOTSPOT_LEVELS / 2u); + + threshold_level = max(threshold_level, NR_HOTSPOT_LEVELS); +@@ -1124,7 +1125,7 @@ static void end_cache_period(struct smq_policy *mq) + #define CLEAN_TARGET 25u + #define FREE_TARGET 25u + +-static unsigned percent_to_target(struct smq_policy *mq, unsigned p) ++static unsigned int percent_to_target(struct smq_policy *mq, unsigned int p) + { + return from_cblock(mq->cache_size) * p / 100u; + } +@@ -1150,7 +1151,7 @@ static bool clean_target_met(struct smq_policy *mq, bool idle) + + static bool free_target_met(struct smq_policy *mq) + { +- unsigned nr_free; ++ unsigned int nr_free; + + nr_free = from_cblock(mq->cache_size) - mq->cache_alloc.nr_allocated; + return (nr_free + btracker_nr_demotions_queued(mq->bg_work)) >= +@@ -1300,7 +1301,7 @@ static dm_oblock_t to_hblock(struct smq_policy *mq, dm_oblock_t b) + + static struct entry *update_hotspot_queue(struct smq_policy *mq, dm_oblock_t b) + { +- unsigned hi; ++ unsigned int hi; + dm_oblock_t hb = to_hblock(mq, b); + struct entry *e = h_lookup(&mq->hotspot_table, hb); + +@@ -1549,7 +1550,7 @@ static void smq_clear_dirty(struct dm_cache_policy *p, dm_cblock_t cblock) + spin_unlock_irqrestore(&mq->lock, flags); + } + +-static unsigned random_level(dm_cblock_t cblock) ++static unsigned int random_level(dm_cblock_t cblock) + { + return hash_32(from_cblock(cblock), 9) & (NR_CACHE_LEVELS - 1); + } +@@ -1660,7 +1661,7 @@ static int mq_set_config_value(struct dm_cache_policy *p, + } + + static int mq_emit_config_values(struct dm_cache_policy *p, char *result, +- unsigned maxlen, ssize_t *sz_ptr) ++ unsigned int maxlen, ssize_t *sz_ptr) + { + ssize_t sz = *sz_ptr; + +@@ -1699,16 +1700,16 @@ static void init_policy_functions(struct smq_policy *mq, bool mimic_mq) + + static bool too_many_hotspot_blocks(sector_t origin_size, + sector_t hotspot_block_size, +- unsigned nr_hotspot_blocks) ++ unsigned int nr_hotspot_blocks) + { + return (hotspot_block_size * nr_hotspot_blocks) > origin_size; + } + + static void calc_hotspot_params(sector_t origin_size, + sector_t cache_block_size, +- unsigned nr_cache_blocks, ++ unsigned int nr_cache_blocks, + sector_t *hotspot_block_size, +- unsigned *nr_hotspot_blocks) ++ unsigned int *nr_hotspot_blocks) + { + *hotspot_block_size = cache_block_size * 16u; + *nr_hotspot_blocks = max(nr_cache_blocks / 4u, 1024u); +@@ -1724,9 +1725,9 @@ static struct dm_cache_policy *__smq_create(dm_cblock_t cache_size, + bool mimic_mq, + bool migrations_allowed) + { +- unsigned i; +- unsigned nr_sentinels_per_queue = 2u * NR_CACHE_LEVELS; +- unsigned total_sentinels = 2u * nr_sentinels_per_queue; ++ unsigned int i; ++ unsigned int nr_sentinels_per_queue = 2u * NR_CACHE_LEVELS; ++ unsigned int total_sentinels = 2u * nr_sentinels_per_queue; + struct smq_policy *mq = kzalloc(sizeof(*mq), GFP_KERNEL); + + if (!mq) +diff --git a/drivers/md/dm-cache-policy.c b/drivers/md/dm-cache-policy.c +index c1a3cee9..2e58bbcf 100644 +--- a/drivers/md/dm-cache-policy.c ++++ b/drivers/md/dm-cache-policy.c +@@ -154,7 +154,7 @@ const char *dm_cache_policy_get_name(struct dm_cache_policy *p) + } + EXPORT_SYMBOL_GPL(dm_cache_policy_get_name); + +-const unsigned *dm_cache_policy_get_version(struct dm_cache_policy *p) ++const unsigned int *dm_cache_policy_get_version(struct dm_cache_policy *p) + { + struct dm_cache_policy_type *t = p->private; + +diff --git a/drivers/md/dm-cache-policy.h b/drivers/md/dm-cache-policy.h +index 06eb31af..6ba3e9c9 100644 +--- a/drivers/md/dm-cache-policy.h ++++ b/drivers/md/dm-cache-policy.h +@@ -128,7 +128,7 @@ struct dm_cache_policy { + * Configuration. + */ + int (*emit_config_values)(struct dm_cache_policy *p, char *result, +- unsigned maxlen, ssize_t *sz_ptr); ++ unsigned int maxlen, ssize_t *sz_ptr); + int (*set_config_value)(struct dm_cache_policy *p, + const char *key, const char *value); + +@@ -157,7 +157,7 @@ struct dm_cache_policy_type { + * what gets passed on the target line to select your policy. + */ + char name[CACHE_POLICY_NAME_SIZE]; +- unsigned version[CACHE_POLICY_VERSION_SIZE]; ++ unsigned int version[CACHE_POLICY_VERSION_SIZE]; + + /* + * For use by an alias dm_cache_policy_type to point to the +diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c +index 17fde3e5..8f7426b7 100644 +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -275,7 +275,7 @@ enum cache_io_mode { + struct cache_features { + enum cache_metadata_mode mode; + enum cache_io_mode io_mode; +- unsigned metadata_version; ++ unsigned int metadata_version; + bool discard_passdown:1; + }; + +@@ -362,7 +362,7 @@ struct cache { + * Rather than reconstructing the table line for the status we just + * save it and regurgitate. + */ +- unsigned nr_ctr_args; ++ unsigned int nr_ctr_args; + const char **ctr_args; + + struct dm_kcopyd_client *copier; +@@ -378,7 +378,7 @@ struct cache { + unsigned long *dirty_bitset; + atomic_t nr_dirty; + +- unsigned policy_nr_args; ++ unsigned int policy_nr_args; + struct dm_cache_policy *policy; + + /* +@@ -409,7 +409,7 @@ struct cache { + + struct per_bio_data { + bool tick:1; +- unsigned req_nr:2; ++ unsigned int req_nr:2; + struct dm_bio_prison_cell_v2 *cell; + struct dm_hook_info hook_info; + sector_t len; +@@ -517,7 +517,7 @@ static void build_key(dm_oblock_t begin, dm_oblock_t end, struct dm_cell_key_v2 + #define WRITE_LOCK_LEVEL 0 + #define READ_WRITE_LOCK_LEVEL 1 + +-static unsigned lock_level(struct bio *bio) ++static unsigned int lock_level(struct bio *bio) + { + return bio_data_dir(bio) == WRITE ? + WRITE_LOCK_LEVEL : +@@ -1884,7 +1884,7 @@ static void check_migrations(struct work_struct *ws) + */ + static void destroy(struct cache *cache) + { +- unsigned i; ++ unsigned int i; + + mempool_exit(&cache->migration_pool); + +@@ -2124,7 +2124,7 @@ static int parse_features(struct cache_args *ca, struct dm_arg_set *as, + }; + + int r, mode_ctr = 0; +- unsigned argc; ++ unsigned int argc; + const char *arg; + struct cache_features *cf = &ca->features; + +@@ -2544,7 +2544,7 @@ static int cache_create(struct cache_args *ca, struct cache **result) + + static int copy_ctr_args(struct cache *cache, int argc, const char **argv) + { +- unsigned i; ++ unsigned int i; + const char **copy; + + copy = kcalloc(argc, sizeof(*copy), GFP_KERNEL); +@@ -2566,7 +2566,7 @@ static int copy_ctr_args(struct cache *cache, int argc, const char **argv) + return 0; + } + +-static int cache_ctr(struct dm_target *ti, unsigned argc, char **argv) ++static int cache_ctr(struct dm_target *ti, unsigned int argc, char **argv) + { + int r = -EINVAL; + struct cache_args *ca; +@@ -2669,7 +2669,7 @@ static int write_dirty_bitset(struct cache *cache) + + static int write_discard_bitset(struct cache *cache) + { +- unsigned i, r; ++ unsigned int i, r; + + if (get_cache_mode(cache) >= CM_READ_ONLY) + return -EINVAL; +@@ -2983,11 +2983,11 @@ static void cache_resume(struct dm_target *ti) + } + + static void emit_flags(struct cache *cache, char *result, +- unsigned maxlen, ssize_t *sz_ptr) ++ unsigned int maxlen, ssize_t *sz_ptr) + { + ssize_t sz = *sz_ptr; + struct cache_features *cf = &cache->features; +- unsigned count = (cf->metadata_version == 2) + !cf->discard_passdown + 1; ++ unsigned int count = (cf->metadata_version == 2) + !cf->discard_passdown + 1; + + DMEMIT("%u ", count); + +@@ -3027,10 +3027,10 @@ static void emit_flags(struct cache *cache, char *result, + * <#policy args> * + */ + static void cache_status(struct dm_target *ti, status_type_t type, +- unsigned status_flags, char *result, unsigned maxlen) ++ unsigned int status_flags, char *result, unsigned int maxlen) + { + int r = 0; +- unsigned i; ++ unsigned int i; + ssize_t sz = 0; + dm_block_t nr_free_blocks_metadata = 0; + dm_block_t nr_blocks_metadata = 0; +@@ -3067,18 +3067,18 @@ static void cache_status(struct dm_target *ti, status_type_t type, + residency = policy_residency(cache->policy); + + DMEMIT("%u %llu/%llu %llu %llu/%llu %u %u %u %u %u %u %lu ", +- (unsigned)DM_CACHE_METADATA_BLOCK_SIZE, ++ (unsigned int)DM_CACHE_METADATA_BLOCK_SIZE, + (unsigned long long)(nr_blocks_metadata - nr_free_blocks_metadata), + (unsigned long long)nr_blocks_metadata, + (unsigned long long)cache->sectors_per_block, + (unsigned long long) from_cblock(residency), + (unsigned long long) from_cblock(cache->cache_size), +- (unsigned) atomic_read(&cache->stats.read_hit), +- (unsigned) atomic_read(&cache->stats.read_miss), +- (unsigned) atomic_read(&cache->stats.write_hit), +- (unsigned) atomic_read(&cache->stats.write_miss), +- (unsigned) atomic_read(&cache->stats.demotion), +- (unsigned) atomic_read(&cache->stats.promotion), ++ (unsigned int) atomic_read(&cache->stats.read_hit), ++ (unsigned int) atomic_read(&cache->stats.read_miss), ++ (unsigned int) atomic_read(&cache->stats.write_hit), ++ (unsigned int) atomic_read(&cache->stats.write_miss), ++ (unsigned int) atomic_read(&cache->stats.demotion), ++ (unsigned int) atomic_read(&cache->stats.promotion), + (unsigned long) atomic_read(&cache->nr_dirty)); + + emit_flags(cache, result, maxlen, &sz); +@@ -3257,11 +3257,11 @@ static int request_invalidation(struct cache *cache, struct cblock_range *range) + return r; + } + +-static int process_invalidate_cblocks_message(struct cache *cache, unsigned count, ++static int process_invalidate_cblocks_message(struct cache *cache, unsigned int count, + const char **cblock_ranges) + { + int r = 0; +- unsigned i; ++ unsigned int i; + struct cblock_range range; + + if (!passthrough_mode(cache)) { +@@ -3298,8 +3298,8 @@ static int process_invalidate_cblocks_message(struct cache *cache, unsigned coun + * + * The key migration_threshold is supported by the cache target core. + */ +-static int cache_message(struct dm_target *ti, unsigned argc, char **argv, +- char *result, unsigned maxlen) ++static int cache_message(struct dm_target *ti, unsigned int argc, char **argv, ++ char *result, unsigned int maxlen) + { + struct cache *cache = ti->private; + +diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h +index 6c6bd247..28c64135 100644 +--- a/drivers/md/dm-core.h ++++ b/drivers/md/dm-core.h +@@ -119,7 +119,7 @@ struct mapped_device { + struct dm_stats stats; + + /* the number of internal suspends */ +- unsigned internal_suspend_count; ++ unsigned int internal_suspend_count; + + int swap_bios; + struct semaphore swap_bios_semaphore; +@@ -326,9 +326,9 @@ static inline struct completion *dm_get_completion_from_kobject(struct kobject * + return &container_of(kobj, struct dm_kobject_holder, kobj)->completion; + } + +-unsigned __dm_get_module_param(unsigned *module_param, unsigned def, unsigned max); ++unsigned int __dm_get_module_param(unsigned int *module_param, unsigned int def, unsigned int max); + +-static inline bool dm_message_test_buffer_overflow(char *result, unsigned maxlen) ++static inline bool dm_message_test_buffer_overflow(char *result, unsigned int maxlen) + { + return !maxlen || strlen(result) + 1 >= maxlen; + } +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index dc2d0d61..ee269b1d 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -173,14 +173,14 @@ struct crypt_config { + } iv_gen_private; + u64 iv_offset; + unsigned int iv_size; +- unsigned short int sector_size; ++ unsigned short sector_size; + unsigned char sector_shift; + + union { + struct crypto_skcipher **tfms; + struct crypto_aead **tfms_aead; + } cipher_tfm; +- unsigned tfms_count; ++ unsigned int tfms_count; + unsigned long cipher_flags; + + /* +@@ -214,7 +214,7 @@ struct crypt_config { + * pool for per bio private data, crypto requests, + * encryption requeusts/buffer pages and integrity tags + */ +- unsigned tag_pool_max_sectors; ++ unsigned int tag_pool_max_sectors; + mempool_t tag_pool; + mempool_t req_pool; + mempool_t page_pool; +@@ -231,7 +231,7 @@ struct crypt_config { + #define POOL_ENTRY_SIZE 512 + + static DEFINE_SPINLOCK(dm_crypt_clients_lock); +-static unsigned dm_crypt_clients_n = 0; ++static unsigned int dm_crypt_clients_n = 0; + static volatile unsigned long dm_crypt_pages_per_client; + #define DM_CRYPT_MEMORY_PERCENT 2 + #define DM_CRYPT_MIN_PAGES_PER_CLIENT (BIO_MAX_VECS * 16) +@@ -356,7 +356,7 @@ static int crypt_iv_essiv_gen(struct crypt_config *cc, u8 *iv, + static int crypt_iv_benbi_ctr(struct crypt_config *cc, struct dm_target *ti, + const char *opts) + { +- unsigned bs; ++ unsigned int bs; + int log; + + if (crypt_integrity_aead(cc)) +@@ -1466,7 +1466,7 @@ static void kcryptd_async_done(struct crypto_async_request *async_req, + static int crypt_alloc_req_skcipher(struct crypt_config *cc, + struct convert_context *ctx) + { +- unsigned key_index = ctx->cc_sector & (cc->tfms_count - 1); ++ unsigned int key_index = ctx->cc_sector & (cc->tfms_count - 1); + + if (!ctx->r.req) { + ctx->r.req = mempool_alloc(&cc->req_pool, in_interrupt() ? GFP_ATOMIC : GFP_NOIO); +@@ -1660,13 +1660,13 @@ static void crypt_free_buffer_pages(struct crypt_config *cc, struct bio *clone); + * non-blocking allocations without a mutex first but on failure we fallback + * to blocking allocations with a mutex. + */ +-static struct bio *crypt_alloc_buffer(struct dm_crypt_io *io, unsigned size) ++static struct bio *crypt_alloc_buffer(struct dm_crypt_io *io, unsigned int size) + { + struct crypt_config *cc = io->cc; + struct bio *clone; + unsigned int nr_iovecs = (size + PAGE_SIZE - 1) >> PAGE_SHIFT; + gfp_t gfp_mask = GFP_NOWAIT | __GFP_HIGHMEM; +- unsigned i, len, remaining_size; ++ unsigned int i, len, remaining_size; + struct page *page; + + retry: +@@ -1806,7 +1806,7 @@ static void crypt_endio(struct bio *clone) + { + struct dm_crypt_io *io = clone->bi_private; + struct crypt_config *cc = io->cc; +- unsigned rw = bio_data_dir(clone); ++ unsigned int rw = bio_data_dir(clone); + blk_status_t error; + + /* +@@ -2261,7 +2261,7 @@ static void crypt_free_tfms_aead(struct crypt_config *cc) + + static void crypt_free_tfms_skcipher(struct crypt_config *cc) + { +- unsigned i; ++ unsigned int i; + + if (!cc->cipher_tfm.tfms) + return; +@@ -2286,7 +2286,7 @@ static void crypt_free_tfms(struct crypt_config *cc) + + static int crypt_alloc_tfms_skcipher(struct crypt_config *cc, char *ciphermode) + { +- unsigned i; ++ unsigned int i; + int err; + + cc->cipher_tfm.tfms = kcalloc(cc->tfms_count, +@@ -2344,12 +2344,12 @@ static int crypt_alloc_tfms(struct crypt_config *cc, char *ciphermode) + return crypt_alloc_tfms_skcipher(cc, ciphermode); + } + +-static unsigned crypt_subkey_size(struct crypt_config *cc) ++static unsigned int crypt_subkey_size(struct crypt_config *cc) + { + return (cc->key_size - cc->key_extra_size) >> ilog2(cc->tfms_count); + } + +-static unsigned crypt_authenckey_size(struct crypt_config *cc) ++static unsigned int crypt_authenckey_size(struct crypt_config *cc) + { + return crypt_subkey_size(cc) + RTA_SPACE(sizeof(struct crypto_authenc_key_param)); + } +@@ -2360,7 +2360,7 @@ static unsigned crypt_authenckey_size(struct crypt_config *cc) + * This funcion converts cc->key to this special format. + */ + static void crypt_copy_authenckey(char *p, const void *key, +- unsigned enckeylen, unsigned authkeylen) ++ unsigned int enckeylen, unsigned int authkeylen) + { + struct crypto_authenc_key_param *param; + struct rtattr *rta; +@@ -2378,7 +2378,7 @@ static void crypt_copy_authenckey(char *p, const void *key, + + static int crypt_setkey(struct crypt_config *cc) + { +- unsigned subkey_size; ++ unsigned int subkey_size; + int err = 0, i, r; + + /* Ignore extra keys (which are used for IV etc) */ +@@ -3417,7 +3417,7 @@ static int crypt_map(struct dm_target *ti, struct bio *bio) + crypt_io_init(io, cc, bio, dm_target_offset(ti, bio->bi_iter.bi_sector)); + + if (cc->on_disk_tag_size) { +- unsigned tag_len = cc->on_disk_tag_size * (bio_sectors(bio) >> cc->sector_shift); ++ unsigned int tag_len = cc->on_disk_tag_size * (bio_sectors(bio) >> cc->sector_shift); + + if (unlikely(tag_len > KMALLOC_MAX_SIZE) || + unlikely(!(io->integrity_metadata = kmalloc(tag_len, +@@ -3445,14 +3445,14 @@ static int crypt_map(struct dm_target *ti, struct bio *bio) + + static char hex2asc(unsigned char c) + { +- return c + '0' + ((unsigned)(9 - c) >> 4 & 0x27); ++ return c + '0' + ((unsigned int)(9 - c) >> 4 & 0x27); + } + + static void crypt_status(struct dm_target *ti, status_type_t type, +- unsigned status_flags, char *result, unsigned maxlen) ++ unsigned int status_flags, char *result, unsigned int maxlen) + { + struct crypt_config *cc = ti->private; +- unsigned i, sz = 0; ++ unsigned int i, sz = 0; + int num_feature_args = 0; + + switch (type) { +@@ -3568,8 +3568,8 @@ static void crypt_resume(struct dm_target *ti) + * key set + * key wipe + */ +-static int crypt_message(struct dm_target *ti, unsigned argc, char **argv, +- char *result, unsigned maxlen) ++static int crypt_message(struct dm_target *ti, unsigned int argc, char **argv, ++ char *result, unsigned int maxlen) + { + struct crypt_config *cc = ti->private; + int key_size, ret = -EINVAL; +@@ -3630,10 +3630,10 @@ static void crypt_io_hints(struct dm_target *ti, struct queue_limits *limits) + limits->max_segment_size = PAGE_SIZE; + + limits->logical_block_size = +- max_t(unsigned, limits->logical_block_size, cc->sector_size); ++ max_t(unsigned int, limits->logical_block_size, cc->sector_size); + limits->physical_block_size = +- max_t(unsigned, limits->physical_block_size, cc->sector_size); +- limits->io_min = max_t(unsigned, limits->io_min, cc->sector_size); ++ max_t(unsigned int, limits->physical_block_size, cc->sector_size); ++ limits->io_min = max_t(unsigned int, limits->io_min, cc->sector_size); + limits->dma_alignment = limits->logical_block_size - 1; + } + +diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c +index 869afef5..02b8f4e8 100644 +--- a/drivers/md/dm-delay.c ++++ b/drivers/md/dm-delay.c +@@ -20,8 +20,8 @@ + struct delay_class { + struct dm_dev *dev; + sector_t start; +- unsigned delay; +- unsigned ops; ++ unsigned int delay; ++ unsigned int ops; + }; + + struct delay_c { +@@ -305,7 +305,7 @@ static int delay_map(struct dm_target *ti, struct bio *bio) + DMEMIT("%s %llu %u", (c)->dev->name, (unsigned long long)(c)->start, (c)->delay) + + static void delay_status(struct dm_target *ti, status_type_t type, +- unsigned status_flags, char *result, unsigned maxlen) ++ unsigned int status_flags, char *result, unsigned int maxlen) + { + struct delay_c *dc = ti->private; + int sz = 0; +diff --git a/drivers/md/dm-ebs-target.c b/drivers/md/dm-ebs-target.c +index 512cc6ce..7606c669 100644 +--- a/drivers/md/dm-ebs-target.c ++++ b/drivers/md/dm-ebs-target.c +@@ -390,7 +390,7 @@ static int ebs_map(struct dm_target *ti, struct bio *bio) + } + + static void ebs_status(struct dm_target *ti, status_type_t type, +- unsigned status_flags, char *result, unsigned maxlen) ++ unsigned int status_flags, char *result, unsigned int maxlen) + { + struct ebs_c *ec = ti->private; + +diff --git a/drivers/md/dm-era-target.c b/drivers/md/dm-era-target.c +index e92c1afc..a9629010 100644 +--- a/drivers/md/dm-era-target.c ++++ b/drivers/md/dm-era-target.c +@@ -51,7 +51,7 @@ static void writeset_free(struct writeset *ws) + } + + static int setup_on_disk_bitset(struct dm_disk_bitset *info, +- unsigned nr_bits, dm_block_t *root) ++ unsigned int nr_bits, dm_block_t *root) + { + int r; + +@@ -62,7 +62,7 @@ static int setup_on_disk_bitset(struct dm_disk_bitset *info, + return dm_bitset_resize(info, *root, 0, nr_bits, false, root); + } + +-static size_t bitset_size(unsigned nr_bits) ++static size_t bitset_size(unsigned int nr_bits) + { + return sizeof(unsigned long) * dm_div_up(nr_bits, BITS_PER_LONG); + } +@@ -323,10 +323,10 @@ static int superblock_lock(struct era_metadata *md, + static int superblock_all_zeroes(struct dm_block_manager *bm, bool *result) + { + int r; +- unsigned i; ++ unsigned int i; + struct dm_block *b; + __le64 *data_le, zero = cpu_to_le64(0); +- unsigned sb_block_size = dm_bm_block_size(bm) / sizeof(__le64); ++ unsigned int sb_block_size = dm_bm_block_size(bm) / sizeof(__le64); + + /* + * We can't use a validator here - it may be all zeroes. +@@ -363,12 +363,12 @@ static void ws_unpack(const struct writeset_disk *disk, struct writeset_metadata + core->root = le64_to_cpu(disk->root); + } + +-static void ws_inc(void *context, const void *value, unsigned count) ++static void ws_inc(void *context, const void *value, unsigned int count) + { + struct era_metadata *md = context; + struct writeset_disk ws_d; + dm_block_t b; +- unsigned i; ++ unsigned int i; + + for (i = 0; i < count; i++) { + memcpy(&ws_d, value + (i * sizeof(ws_d)), sizeof(ws_d)); +@@ -377,12 +377,12 @@ static void ws_inc(void *context, const void *value, unsigned count) + } + } + +-static void ws_dec(void *context, const void *value, unsigned count) ++static void ws_dec(void *context, const void *value, unsigned int count) + { + struct era_metadata *md = context; + struct writeset_disk ws_d; + dm_block_t b; +- unsigned i; ++ unsigned int i; + + for (i = 0; i < count; i++) { + memcpy(&ws_d, value + (i * sizeof(ws_d)), sizeof(ws_d)); +@@ -667,7 +667,7 @@ static void swap_writeset(struct era_metadata *md, struct writeset *new_writeset + *--------------------------------------------------------------*/ + struct digest { + uint32_t era; +- unsigned nr_bits, current_bit; ++ unsigned int nr_bits, current_bit; + struct writeset_metadata writeset; + __le32 value; + struct dm_disk_bitset info; +@@ -702,7 +702,7 @@ static int metadata_digest_transcribe_writeset(struct era_metadata *md, + { + int r; + bool marked; +- unsigned b, e = min(d->current_bit + INSERTS_PER_STEP, d->nr_bits); ++ unsigned int b, e = min(d->current_bit + INSERTS_PER_STEP, d->nr_bits); + + for (b = d->current_bit; b < e; b++) { + r = writeset_marked_on_disk(&d->info, &d->writeset, b, &marked); +@@ -1439,7 +1439,7 @@ static bool valid_block_size(dm_block_t block_size) + /* + * + */ +-static int era_ctr(struct dm_target *ti, unsigned argc, char **argv) ++static int era_ctr(struct dm_target *ti, unsigned int argc, char **argv) + { + int r; + char dummy; +@@ -1618,7 +1618,7 @@ static int era_preresume(struct dm_target *ti) + * + */ + static void era_status(struct dm_target *ti, status_type_t type, +- unsigned status_flags, char *result, unsigned maxlen) ++ unsigned int status_flags, char *result, unsigned int maxlen) + { + int r; + struct era *era = ti->private; +@@ -1633,10 +1633,10 @@ static void era_status(struct dm_target *ti, status_type_t type, + goto err; + + DMEMIT("%u %llu/%llu %u", +- (unsigned) (DM_ERA_METADATA_BLOCK_SIZE >> SECTOR_SHIFT), ++ (unsigned int) (DM_ERA_METADATA_BLOCK_SIZE >> SECTOR_SHIFT), + (unsigned long long) stats.used, + (unsigned long long) stats.total, +- (unsigned) stats.era); ++ (unsigned int) stats.era); + + if (stats.snap != SUPERBLOCK_LOCATION) + DMEMIT(" %llu", stats.snap); +@@ -1662,8 +1662,8 @@ static void era_status(struct dm_target *ti, status_type_t type, + DMEMIT("Error"); + } + +-static int era_message(struct dm_target *ti, unsigned argc, char **argv, +- char *result, unsigned maxlen) ++static int era_message(struct dm_target *ti, unsigned int argc, char **argv, ++ char *result, unsigned int maxlen) + { + struct era *era = ti->private; + +diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c +index 3997f34c..cc3987c9 100644 +--- a/drivers/md/dm-exception-store.c ++++ b/drivers/md/dm-exception-store.c +@@ -142,7 +142,7 @@ EXPORT_SYMBOL(dm_exception_store_type_unregister); + static int set_chunk_size(struct dm_exception_store *store, + const char *chunk_size_arg, char **error) + { +- unsigned chunk_size; ++ unsigned int chunk_size; + + if (kstrtouint(chunk_size_arg, 10, &chunk_size)) { + *error = "Invalid chunk size"; +@@ -158,7 +158,7 @@ static int set_chunk_size(struct dm_exception_store *store, + } + + int dm_exception_store_set_chunk_size(struct dm_exception_store *store, +- unsigned chunk_size, ++ unsigned int chunk_size, + char **error) + { + /* Check chunk_size is a power of 2 */ +@@ -190,7 +190,7 @@ int dm_exception_store_set_chunk_size(struct dm_exception_store *store, + + int dm_exception_store_create(struct dm_target *ti, int argc, char **argv, + struct dm_snapshot *snap, +- unsigned *args_used, ++ unsigned int *args_used, + struct dm_exception_store **store) + { + int r = 0; +diff --git a/drivers/md/dm-exception-store.h b/drivers/md/dm-exception-store.h +index b5f20eba..862df68a 100644 +--- a/drivers/md/dm-exception-store.h ++++ b/drivers/md/dm-exception-store.h +@@ -96,9 +96,9 @@ struct dm_exception_store_type { + */ + void (*drop_snapshot) (struct dm_exception_store *store); + +- unsigned (*status) (struct dm_exception_store *store, +- status_type_t status, char *result, +- unsigned maxlen); ++ unsigned int (*status) (struct dm_exception_store *store, ++ status_type_t status, char *result, ++ unsigned int maxlen); + + /* + * Return how full the snapshot is. +@@ -118,9 +118,9 @@ struct dm_exception_store { + struct dm_snapshot *snap; + + /* Size of data blocks saved - must be a power of 2 */ +- unsigned chunk_size; +- unsigned chunk_mask; +- unsigned chunk_shift; ++ unsigned int chunk_size; ++ unsigned int chunk_mask; ++ unsigned int chunk_shift; + + void *context; + +@@ -144,7 +144,7 @@ static inline chunk_t dm_chunk_number(chunk_t chunk) + return chunk & (chunk_t)((1ULL << DM_CHUNK_NUMBER_BITS) - 1ULL); + } + +-static inline unsigned dm_consecutive_chunk_count(struct dm_exception *e) ++static inline unsigned int dm_consecutive_chunk_count(struct dm_exception *e) + { + return e->new_chunk >> DM_CHUNK_NUMBER_BITS; + } +@@ -181,12 +181,12 @@ int dm_exception_store_type_register(struct dm_exception_store_type *type); + int dm_exception_store_type_unregister(struct dm_exception_store_type *type); + + int dm_exception_store_set_chunk_size(struct dm_exception_store *store, +- unsigned chunk_size, ++ unsigned int chunk_size, + char **error); + + int dm_exception_store_create(struct dm_target *ti, int argc, char **argv, + struct dm_snapshot *snap, +- unsigned *args_used, ++ unsigned int *args_used, + struct dm_exception_store **store); + void dm_exception_store_destroy(struct dm_exception_store *store); + +diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c +index 335684a1..7efbdb42 100644 +--- a/drivers/md/dm-flakey.c ++++ b/drivers/md/dm-flakey.c +@@ -26,12 +26,12 @@ struct flakey_c { + struct dm_dev *dev; + unsigned long start_time; + sector_t start; +- unsigned up_interval; +- unsigned down_interval; ++ unsigned int up_interval; ++ unsigned int down_interval; + unsigned long flags; +- unsigned corrupt_bio_byte; +- unsigned corrupt_bio_rw; +- unsigned corrupt_bio_value; ++ unsigned int corrupt_bio_byte; ++ unsigned int corrupt_bio_rw; ++ unsigned int corrupt_bio_value; + blk_opf_t corrupt_bio_flags; + }; + +@@ -48,7 +48,7 @@ static int parse_features(struct dm_arg_set *as, struct flakey_c *fc, + struct dm_target *ti) + { + int r; +- unsigned argc; ++ unsigned int argc; + const char *arg_name; + + static const struct dm_arg _args[] = { +@@ -148,7 +148,7 @@ static int parse_features(struct dm_arg_set *as, struct flakey_c *fc, + BUILD_BUG_ON(sizeof(fc->corrupt_bio_flags) != + sizeof(unsigned int)); + r = dm_read_arg(_args + 3, as, +- (__force unsigned *)&fc->corrupt_bio_flags, ++ (__force unsigned int *)&fc->corrupt_bio_flags, + &ti->error); + if (r) + return r; +@@ -324,7 +324,7 @@ static void corrupt_bio_data(struct bio *bio, struct flakey_c *fc) + static int flakey_map(struct dm_target *ti, struct bio *bio) + { + struct flakey_c *fc = ti->private; +- unsigned elapsed; ++ unsigned int elapsed; + struct per_bio_data *pb = dm_per_bio_data(bio, sizeof(struct per_bio_data)); + pb->bio_submitted = false; + +@@ -417,11 +417,11 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio, + } + + static void flakey_status(struct dm_target *ti, status_type_t type, +- unsigned status_flags, char *result, unsigned maxlen) ++ unsigned int status_flags, char *result, unsigned int maxlen) + { +- unsigned sz = 0; ++ unsigned int sz = 0; + struct flakey_c *fc = ti->private; +- unsigned drop_writes, error_writes; ++ unsigned int drop_writes, error_writes; + + switch (type) { + case STATUSTYPE_INFO: +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index c62c21aa..53f9f765 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -157,13 +157,13 @@ struct alg_spec { + char *alg_string; + char *key_string; + __u8 *key; +- unsigned key_size; ++ unsigned int key_size; + }; + + struct dm_integrity_c { + struct dm_dev *dev; + struct dm_dev *meta_dev; +- unsigned tag_size; ++ unsigned int tag_size; + __s8 log2_tag_size; + sector_t start; + mempool_t journal_io_mempool; +@@ -171,8 +171,8 @@ struct dm_integrity_c { + struct dm_bufio_client *bufio; + struct workqueue_struct *metadata_wq; + struct superblock *sb; +- unsigned journal_pages; +- unsigned n_bitmap_blocks; ++ unsigned int journal_pages; ++ unsigned int n_bitmap_blocks; + + struct page_list *journal; + struct page_list *journal_io; +@@ -180,7 +180,7 @@ struct dm_integrity_c { + struct page_list *recalc_bitmap; + struct page_list *may_write_bitmap; + struct bitmap_block_status *bbs; +- unsigned bitmap_flush_interval; ++ unsigned int bitmap_flush_interval; + int synchronous_mode; + struct bio_list synchronous_bios; + struct delayed_work bitmap_flush_work; +@@ -201,12 +201,12 @@ struct dm_integrity_c { + unsigned char journal_entries_per_sector; + unsigned char journal_section_entries; + unsigned short journal_section_sectors; +- unsigned journal_sections; +- unsigned journal_entries; ++ unsigned int journal_sections; ++ unsigned int journal_entries; + sector_t data_device_sectors; + sector_t meta_device_sectors; +- unsigned initial_sectors; +- unsigned metadata_run; ++ unsigned int initial_sectors; ++ unsigned int metadata_run; + __s8 log2_metadata_run; + __u8 log2_buffer_sectors; + __u8 sectors_per_block; +@@ -230,17 +230,17 @@ struct dm_integrity_c { + unsigned char commit_seq; + commit_id_t commit_ids[N_COMMIT_IDS]; + +- unsigned committed_section; +- unsigned n_committed_sections; ++ unsigned int committed_section; ++ unsigned int n_committed_sections; + +- unsigned uncommitted_section; +- unsigned n_uncommitted_sections; ++ unsigned int uncommitted_section; ++ unsigned int n_uncommitted_sections; + +- unsigned free_section; ++ unsigned int free_section; + unsigned char free_section_entry; +- unsigned free_sectors; ++ unsigned int free_sectors; + +- unsigned free_sectors_threshold; ++ unsigned int free_sectors_threshold; + + struct workqueue_struct *commit_wq; + struct work_struct commit_work; +@@ -257,7 +257,7 @@ struct dm_integrity_c { + + unsigned long autocommit_jiffies; + struct timer_list autocommit_timer; +- unsigned autocommit_msec; ++ unsigned int autocommit_msec; + + wait_queue_head_t copy_to_journal_wait; + +@@ -305,7 +305,7 @@ struct dm_integrity_io { + struct dm_integrity_range range; + + sector_t metadata_block; +- unsigned metadata_offset; ++ unsigned int metadata_offset; + + atomic_t in_flight; + blk_status_t bi_status; +@@ -329,7 +329,7 @@ struct journal_io { + struct bitmap_block_status { + struct work_struct work; + struct dm_integrity_c *ic; +- unsigned idx; ++ unsigned int idx; + unsigned long *bitmap; + struct bio_list bio_queue; + spinlock_t bio_queue_lock; +@@ -410,8 +410,8 @@ static bool dm_integrity_disable_recalculate(struct dm_integrity_c *ic) + return false; + } + +-static commit_id_t dm_integrity_commit_id(struct dm_integrity_c *ic, unsigned i, +- unsigned j, unsigned char seq) ++static commit_id_t dm_integrity_commit_id(struct dm_integrity_c *ic, unsigned int i, ++ unsigned int j, unsigned char seq) + { + /* + * Xor the number with section and sector, so that if a piece of +@@ -426,7 +426,7 @@ static void get_area_and_offset(struct dm_integrity_c *ic, sector_t data_sector, + if (!ic->meta_dev) { + __u8 log2_interleave_sectors = ic->sb->log2_interleave_sectors; + *area = data_sector >> log2_interleave_sectors; +- *offset = (unsigned)data_sector & ((1U << log2_interleave_sectors) - 1); ++ *offset = (unsigned int)data_sector & ((1U << log2_interleave_sectors) - 1); + } else { + *area = 0; + *offset = data_sector; +@@ -435,15 +435,15 @@ static void get_area_and_offset(struct dm_integrity_c *ic, sector_t data_sector, + + #define sector_to_block(ic, n) \ + do { \ +- BUG_ON((n) & (unsigned)((ic)->sectors_per_block - 1)); \ ++ BUG_ON((n) & (unsigned int)((ic)->sectors_per_block - 1)); \ + (n) >>= (ic)->sb->log2_sectors_per_block; \ + } while (0) + + static __u64 get_metadata_sector_and_offset(struct dm_integrity_c *ic, sector_t area, +- sector_t offset, unsigned *metadata_offset) ++ sector_t offset, unsigned int *metadata_offset) + { + __u64 ms; +- unsigned mo; ++ unsigned int mo; + + ms = area << ic->sb->log2_interleave_sectors; + if (likely(ic->log2_metadata_run >= 0)) +@@ -484,7 +484,7 @@ static sector_t get_data_sector(struct dm_integrity_c *ic, sector_t area, sector + return result; + } + +-static void wraparound_section(struct dm_integrity_c *ic, unsigned *sec_ptr) ++static void wraparound_section(struct dm_integrity_c *ic, unsigned int *sec_ptr) + { + if (unlikely(*sec_ptr >= ic->journal_sections)) + *sec_ptr -= ic->journal_sections; +@@ -508,7 +508,7 @@ static int sb_mac(struct dm_integrity_c *ic, bool wr) + { + SHASH_DESC_ON_STACK(desc, ic->journal_mac); + int r; +- unsigned size = crypto_shash_digestsize(ic->journal_mac); ++ unsigned int size = crypto_shash_digestsize(ic->journal_mac); + + if (sizeof(struct superblock) + size > 1 << SECTOR_SHIFT) { + dm_integrity_io_error(ic, "digest is too long", -EINVAL); +@@ -704,8 +704,8 @@ static bool block_bitmap_op(struct dm_integrity_c *ic, struct page_list *bitmap, + + static void block_bitmap_copy(struct dm_integrity_c *ic, struct page_list *dst, struct page_list *src) + { +- unsigned n_bitmap_pages = DIV_ROUND_UP(ic->n_bitmap_blocks, PAGE_SIZE / BITMAP_BLOCK_SIZE); +- unsigned i; ++ unsigned int n_bitmap_pages = DIV_ROUND_UP(ic->n_bitmap_blocks, PAGE_SIZE / BITMAP_BLOCK_SIZE); ++ unsigned int i; + + for (i = 0; i < n_bitmap_pages; i++) { + unsigned long *dst_data = lowmem_page_address(dst[i].page); +@@ -716,18 +716,18 @@ static void block_bitmap_copy(struct dm_integrity_c *ic, struct page_list *dst, + + static struct bitmap_block_status *sector_to_bitmap_block(struct dm_integrity_c *ic, sector_t sector) + { +- unsigned bit = sector >> (ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit); +- unsigned bitmap_block = bit / (BITMAP_BLOCK_SIZE * 8); ++ unsigned int bit = sector >> (ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit); ++ unsigned int bitmap_block = bit / (BITMAP_BLOCK_SIZE * 8); + + BUG_ON(bitmap_block >= ic->n_bitmap_blocks); + return &ic->bbs[bitmap_block]; + } + +-static void access_journal_check(struct dm_integrity_c *ic, unsigned section, unsigned offset, ++static void access_journal_check(struct dm_integrity_c *ic, unsigned int section, unsigned int offset, + bool e, const char *function) + { + #if defined(CONFIG_DM_DEBUG) || defined(INTERNAL_VERIFY) +- unsigned limit = e ? ic->journal_section_entries : ic->journal_section_sectors; ++ unsigned int limit = e ? ic->journal_section_entries : ic->journal_section_sectors; + + if (unlikely(section >= ic->journal_sections) || + unlikely(offset >= limit)) { +@@ -738,10 +738,10 @@ static void access_journal_check(struct dm_integrity_c *ic, unsigned section, un + #endif + } + +-static void page_list_location(struct dm_integrity_c *ic, unsigned section, unsigned offset, +- unsigned *pl_index, unsigned *pl_offset) ++static void page_list_location(struct dm_integrity_c *ic, unsigned int section, unsigned int offset, ++ unsigned int *pl_index, unsigned int *pl_offset) + { +- unsigned sector; ++ unsigned int sector; + + access_journal_check(ic, section, offset, false, "page_list_location"); + +@@ -752,9 +752,9 @@ static void page_list_location(struct dm_integrity_c *ic, unsigned section, unsi + } + + static struct journal_sector *access_page_list(struct dm_integrity_c *ic, struct page_list *pl, +- unsigned section, unsigned offset, unsigned *n_sectors) ++ unsigned int section, unsigned int offset, unsigned int *n_sectors) + { +- unsigned pl_index, pl_offset; ++ unsigned int pl_index, pl_offset; + char *va; + + page_list_location(ic, section, offset, &pl_index, &pl_offset); +@@ -767,14 +767,14 @@ static struct journal_sector *access_page_list(struct dm_integrity_c *ic, struct + return (struct journal_sector *)(va + pl_offset); + } + +-static struct journal_sector *access_journal(struct dm_integrity_c *ic, unsigned section, unsigned offset) ++static struct journal_sector *access_journal(struct dm_integrity_c *ic, unsigned int section, unsigned int offset) + { + return access_page_list(ic, ic->journal, section, offset, NULL); + } + +-static struct journal_entry *access_journal_entry(struct dm_integrity_c *ic, unsigned section, unsigned n) ++static struct journal_entry *access_journal_entry(struct dm_integrity_c *ic, unsigned int section, unsigned int n) + { +- unsigned rel_sector, offset; ++ unsigned int rel_sector, offset; + struct journal_sector *js; + + access_journal_check(ic, section, n, true, "access_journal_entry"); +@@ -786,7 +786,7 @@ static struct journal_entry *access_journal_entry(struct dm_integrity_c *ic, uns + return (struct journal_entry *)((char *)js + offset * ic->journal_entry_size); + } + +-static struct journal_sector *access_journal_data(struct dm_integrity_c *ic, unsigned section, unsigned n) ++static struct journal_sector *access_journal_data(struct dm_integrity_c *ic, unsigned int section, unsigned int n) + { + n <<= ic->sb->log2_sectors_per_block; + +@@ -797,11 +797,11 @@ static struct journal_sector *access_journal_data(struct dm_integrity_c *ic, uns + return access_journal(ic, section, n); + } + +-static void section_mac(struct dm_integrity_c *ic, unsigned section, __u8 result[JOURNAL_MAC_SIZE]) ++static void section_mac(struct dm_integrity_c *ic, unsigned int section, __u8 result[JOURNAL_MAC_SIZE]) + { + SHASH_DESC_ON_STACK(desc, ic->journal_mac); + int r; +- unsigned j, size; ++ unsigned int j, size; + + desc->tfm = ic->journal_mac; + +@@ -866,10 +866,10 @@ static void section_mac(struct dm_integrity_c *ic, unsigned section, __u8 result + memset(result, 0, JOURNAL_MAC_SIZE); + } + +-static void rw_section_mac(struct dm_integrity_c *ic, unsigned section, bool wr) ++static void rw_section_mac(struct dm_integrity_c *ic, unsigned int section, bool wr) + { + __u8 result[JOURNAL_MAC_SIZE]; +- unsigned j; ++ unsigned int j; + + if (!ic->journal_mac) + return; +@@ -898,12 +898,12 @@ static void complete_journal_op(void *context) + complete(&comp->comp); + } + +-static void xor_journal(struct dm_integrity_c *ic, bool encrypt, unsigned section, +- unsigned n_sections, struct journal_completion *comp) ++static void xor_journal(struct dm_integrity_c *ic, bool encrypt, unsigned int section, ++ unsigned int n_sections, struct journal_completion *comp) + { + struct async_submit_ctl submit; + size_t n_bytes = (size_t)(n_sections * ic->journal_section_sectors) << SECTOR_SHIFT; +- unsigned pl_index, pl_offset, section_index; ++ unsigned int pl_index, pl_offset, section_index; + struct page_list *source_pl, *target_pl; + + if (likely(encrypt)) { +@@ -928,7 +928,7 @@ static void xor_journal(struct dm_integrity_c *ic, bool encrypt, unsigned sectio + struct page *dst_page; + + while (unlikely(pl_index == section_index)) { +- unsigned dummy; ++ unsigned int dummy; + if (likely(encrypt)) + rw_section_mac(ic, section, true); + section++; +@@ -990,8 +990,8 @@ static bool do_crypt(bool encrypt, struct skcipher_request *req, struct journal_ + return false; + } + +-static void crypt_journal(struct dm_integrity_c *ic, bool encrypt, unsigned section, +- unsigned n_sections, struct journal_completion *comp) ++static void crypt_journal(struct dm_integrity_c *ic, bool encrypt, unsigned int section, ++ unsigned int n_sections, struct journal_completion *comp) + { + struct scatterlist **source_sg; + struct scatterlist **target_sg; +@@ -1008,7 +1008,7 @@ static void crypt_journal(struct dm_integrity_c *ic, bool encrypt, unsigned sect + + do { + struct skcipher_request *req; +- unsigned ivsize; ++ unsigned int ivsize; + char *iv; + + if (likely(encrypt)) +@@ -1034,8 +1034,8 @@ static void crypt_journal(struct dm_integrity_c *ic, bool encrypt, unsigned sect + complete_journal_op(comp); + } + +-static void encrypt_journal(struct dm_integrity_c *ic, bool encrypt, unsigned section, +- unsigned n_sections, struct journal_completion *comp) ++static void encrypt_journal(struct dm_integrity_c *ic, bool encrypt, unsigned int section, ++ unsigned int n_sections, struct journal_completion *comp) + { + if (ic->journal_xor) + return xor_journal(ic, encrypt, section, n_sections, comp); +@@ -1052,12 +1052,12 @@ static void complete_journal_io(unsigned long error, void *context) + } + + static void rw_journal_sectors(struct dm_integrity_c *ic, blk_opf_t opf, +- unsigned sector, unsigned n_sectors, ++ unsigned int sector, unsigned int n_sectors, + struct journal_completion *comp) + { + struct dm_io_request io_req; + struct dm_io_region io_loc; +- unsigned pl_index, pl_offset; ++ unsigned int pl_index, pl_offset; + int r; + + if (unlikely(dm_integrity_failed(ic))) { +@@ -1099,10 +1099,10 @@ static void rw_journal_sectors(struct dm_integrity_c *ic, blk_opf_t opf, + } + + static void rw_journal(struct dm_integrity_c *ic, blk_opf_t opf, +- unsigned section, unsigned n_sections, ++ unsigned int section, unsigned int n_sections, + struct journal_completion *comp) + { +- unsigned sector, n_sectors; ++ unsigned int sector, n_sectors; + + sector = section * ic->journal_section_sectors; + n_sectors = n_sections * ic->journal_section_sectors; +@@ -1110,12 +1110,12 @@ static void rw_journal(struct dm_integrity_c *ic, blk_opf_t opf, + rw_journal_sectors(ic, opf, sector, n_sectors, comp); + } + +-static void write_journal(struct dm_integrity_c *ic, unsigned commit_start, unsigned commit_sections) ++static void write_journal(struct dm_integrity_c *ic, unsigned int commit_start, unsigned int commit_sections) + { + struct journal_completion io_comp; + struct journal_completion crypt_comp_1; + struct journal_completion crypt_comp_2; +- unsigned i; ++ unsigned int i; + + io_comp.ic = ic; + init_completion(&io_comp.comp); +@@ -1135,7 +1135,7 @@ static void write_journal(struct dm_integrity_c *ic, unsigned commit_start, unsi + rw_journal(ic, REQ_OP_WRITE | REQ_FUA | REQ_SYNC, commit_start, + commit_sections, &io_comp); + } else { +- unsigned to_end; ++ unsigned int to_end; + io_comp.in_flight = (atomic_t)ATOMIC_INIT(2); + to_end = ic->journal_sections - commit_start; + if (ic->journal_io) { +@@ -1172,15 +1172,15 @@ static void write_journal(struct dm_integrity_c *ic, unsigned commit_start, unsi + wait_for_completion_io(&io_comp.comp); + } + +-static void copy_from_journal(struct dm_integrity_c *ic, unsigned section, unsigned offset, +- unsigned n_sectors, sector_t target, io_notify_fn fn, void *data) ++static void copy_from_journal(struct dm_integrity_c *ic, unsigned int section, unsigned int offset, ++ unsigned int n_sectors, sector_t target, io_notify_fn fn, void *data) + { + struct dm_io_request io_req; + struct dm_io_region io_loc; + int r; +- unsigned sector, pl_index, pl_offset; ++ unsigned int sector, pl_index, pl_offset; + +- BUG_ON((target | n_sectors | offset) & (unsigned)(ic->sectors_per_block - 1)); ++ BUG_ON((target | n_sectors | offset) & (unsigned int)(ic->sectors_per_block - 1)); + + if (unlikely(dm_integrity_failed(ic))) { + fn(-1UL, data); +@@ -1221,7 +1221,7 @@ static bool add_new_range(struct dm_integrity_c *ic, struct dm_integrity_range * + struct rb_node **n = &ic->in_progress.rb_node; + struct rb_node *parent; + +- BUG_ON((new_range->logical_sector | new_range->n_sectors) & (unsigned)(ic->sectors_per_block - 1)); ++ BUG_ON((new_range->logical_sector | new_range->n_sectors) & (unsigned int)(ic->sectors_per_block - 1)); + + if (likely(check_waiting)) { + struct dm_integrity_range *range; +@@ -1339,10 +1339,10 @@ static void remove_journal_node(struct dm_integrity_c *ic, struct journal_node * + + #define NOT_FOUND (-1U) + +-static unsigned find_journal_node(struct dm_integrity_c *ic, sector_t sector, sector_t *next_sector) ++static unsigned int find_journal_node(struct dm_integrity_c *ic, sector_t sector, sector_t *next_sector) + { + struct rb_node *n = ic->journal_tree_root.rb_node; +- unsigned found = NOT_FOUND; ++ unsigned int found = NOT_FOUND; + *next_sector = (sector_t)-1; + while (n) { + struct journal_node *j = container_of(n, struct journal_node, node); +@@ -1360,7 +1360,7 @@ static unsigned find_journal_node(struct dm_integrity_c *ic, sector_t sector, se + return found; + } + +-static bool test_journal_node(struct dm_integrity_c *ic, unsigned pos, sector_t sector) ++static bool test_journal_node(struct dm_integrity_c *ic, unsigned int pos, sector_t sector) + { + struct journal_node *node, *next_node; + struct rb_node *next; +@@ -1385,7 +1385,7 @@ static bool find_newer_committed_node(struct dm_integrity_c *ic, struct journal_ + { + struct rb_node *next; + struct journal_node *next_node; +- unsigned next_section; ++ unsigned int next_section; + + BUG_ON(RB_EMPTY_NODE(&node->node)); + +@@ -1398,7 +1398,7 @@ static bool find_newer_committed_node(struct dm_integrity_c *ic, struct journal_ + if (next_node->sector != node->sector) + return false; + +- next_section = (unsigned)(next_node - ic->journal_tree) / ic->journal_section_entries; ++ next_section = (unsigned int)(next_node - ic->journal_tree) / ic->journal_section_entries; + if (next_section >= ic->committed_section && + next_section < ic->committed_section + ic->n_committed_sections) + return true; +@@ -1413,17 +1413,17 @@ static bool find_newer_committed_node(struct dm_integrity_c *ic, struct journal_ + #define TAG_CMP 2 + + static int dm_integrity_rw_tag(struct dm_integrity_c *ic, unsigned char *tag, sector_t *metadata_block, +- unsigned *metadata_offset, unsigned total_size, int op) ++ unsigned int *metadata_offset, unsigned int total_size, int op) + { + #define MAY_BE_FILLER 1 + #define MAY_BE_HASH 2 +- unsigned hash_offset = 0; +- unsigned may_be = MAY_BE_HASH | (ic->discard ? MAY_BE_FILLER : 0); ++ unsigned int hash_offset = 0; ++ unsigned int may_be = MAY_BE_HASH | (ic->discard ? MAY_BE_FILLER : 0); + + do { + unsigned char *data, *dp; + struct dm_buffer *b; +- unsigned to_copy; ++ unsigned int to_copy; + int r; + + r = dm_integrity_failed(ic); +@@ -1453,7 +1453,7 @@ static int dm_integrity_rw_tag(struct dm_integrity_c *ic, unsigned char *tag, se + goto thorough_test; + } + } else { +- unsigned i, ts; ++ unsigned int i, ts; + thorough_test: + ts = total_size; + +@@ -1652,7 +1652,7 @@ static void integrity_sector_checksum(struct dm_integrity_c *ic, sector_t sector + __le64 sector_le = cpu_to_le64(sector); + SHASH_DESC_ON_STACK(req, ic->internal_hash); + int r; +- unsigned digest_size; ++ unsigned int digest_size; + + req->tfm = ic->internal_hash; + +@@ -1709,13 +1709,13 @@ static void integrity_metadata(struct work_struct *w) + if (ic->internal_hash) { + struct bvec_iter iter; + struct bio_vec bv; +- unsigned digest_size = crypto_shash_digestsize(ic->internal_hash); ++ unsigned int digest_size = crypto_shash_digestsize(ic->internal_hash); + struct bio *bio = dm_bio_from_per_bio_data(dio, sizeof(struct dm_integrity_io)); + char *checksums; +- unsigned extra_space = unlikely(digest_size > ic->tag_size) ? digest_size - ic->tag_size : 0; ++ unsigned int extra_space = unlikely(digest_size > ic->tag_size) ? digest_size - ic->tag_size : 0; + char checksums_onstack[max((size_t)HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)]; + sector_t sector; +- unsigned sectors_to_process; ++ unsigned int sectors_to_process; + + if (unlikely(ic->mode == 'R')) + goto skip_io; +@@ -1735,13 +1735,13 @@ static void integrity_metadata(struct work_struct *w) + } + + if (unlikely(dio->op == REQ_OP_DISCARD)) { +- unsigned bi_size = dio->bio_details.bi_iter.bi_size; +- unsigned max_size = likely(checksums != checksums_onstack) ? PAGE_SIZE : HASH_MAX_DIGESTSIZE; +- unsigned max_blocks = max_size / ic->tag_size; ++ unsigned int bi_size = dio->bio_details.bi_iter.bi_size; ++ unsigned int max_size = likely(checksums != checksums_onstack) ? PAGE_SIZE : HASH_MAX_DIGESTSIZE; ++ unsigned int max_blocks = max_size / ic->tag_size; + memset(checksums, DISCARD_FILLER, max_size); + + while (bi_size) { +- unsigned this_step_blocks = bi_size >> (SECTOR_SHIFT + ic->sb->log2_sectors_per_block); ++ unsigned int this_step_blocks = bi_size >> (SECTOR_SHIFT + ic->sb->log2_sectors_per_block); + this_step_blocks = min(this_step_blocks, max_blocks); + r = dm_integrity_rw_tag(ic, checksums, &dio->metadata_block, &dio->metadata_offset, + this_step_blocks * ic->tag_size, TAG_WRITE); +@@ -1763,7 +1763,7 @@ static void integrity_metadata(struct work_struct *w) + sectors_to_process = dio->range.n_sectors; + + __bio_for_each_segment(bv, bio, iter, dio->bio_details.bi_iter) { +- unsigned pos; ++ unsigned int pos; + char *mem, *checksums_ptr; + + again: +@@ -1816,13 +1816,13 @@ static void integrity_metadata(struct work_struct *w) + if (bip) { + struct bio_vec biv; + struct bvec_iter iter; +- unsigned data_to_process = dio->range.n_sectors; ++ unsigned int data_to_process = dio->range.n_sectors; + sector_to_block(ic, data_to_process); + data_to_process *= ic->tag_size; + + bip_for_each_vec(biv, bip, iter) { + unsigned char *tag; +- unsigned this_len; ++ unsigned int this_len; + + BUG_ON(PageHighMem(biv.bv_page)); + tag = bvec_virt(&biv); +@@ -1860,7 +1860,7 @@ static int dm_integrity_map(struct dm_target *ti, struct bio *bio) + if (unlikely(dio->op == REQ_OP_DISCARD)) { + if (ti->max_io_len) { + sector_t sec = dm_target_offset(ti, bio->bi_iter.bi_sector); +- unsigned log2_max_io_len = __fls(ti->max_io_len); ++ unsigned int log2_max_io_len = __fls(ti->max_io_len); + sector_t start_boundary = sec >> log2_max_io_len; + sector_t end_boundary = (sec + bio_sectors(bio) - 1) >> log2_max_io_len; + if (start_boundary < end_boundary) { +@@ -1890,7 +1890,7 @@ static int dm_integrity_map(struct dm_target *ti, struct bio *bio) + ic->provided_data_sectors); + return DM_MAPIO_KILL; + } +- if (unlikely((dio->range.logical_sector | bio_sectors(bio)) & (unsigned)(ic->sectors_per_block - 1))) { ++ if (unlikely((dio->range.logical_sector | bio_sectors(bio)) & (unsigned int)(ic->sectors_per_block - 1))) { + DMERR("Bio not aligned on %u sectors: 0x%llx, 0x%x", + ic->sectors_per_block, + dio->range.logical_sector, bio_sectors(bio)); +@@ -1912,7 +1912,7 @@ static int dm_integrity_map(struct dm_target *ti, struct bio *bio) + bip = bio_integrity(bio); + if (!ic->internal_hash) { + if (bip) { +- unsigned wanted_tag_size = bio_sectors(bio) >> ic->sb->log2_sectors_per_block; ++ unsigned int wanted_tag_size = bio_sectors(bio) >> ic->sb->log2_sectors_per_block; + if (ic->log2_tag_size >= 0) + wanted_tag_size <<= ic->log2_tag_size; + else +@@ -1942,11 +1942,11 @@ static int dm_integrity_map(struct dm_target *ti, struct bio *bio) + } + + static bool __journal_read_write(struct dm_integrity_io *dio, struct bio *bio, +- unsigned journal_section, unsigned journal_entry) ++ unsigned int journal_section, unsigned int journal_entry) + { + struct dm_integrity_c *ic = dio->ic; + sector_t logical_sector; +- unsigned n_sectors; ++ unsigned int n_sectors; + + logical_sector = dio->range.logical_sector; + n_sectors = dio->range.n_sectors; +@@ -1969,7 +1969,7 @@ static bool __journal_read_write(struct dm_integrity_io *dio, struct bio *bio, + if (unlikely(dio->op == REQ_OP_READ)) { + struct journal_sector *js; + char *mem_ptr; +- unsigned s; ++ unsigned int s; + + if (unlikely(journal_entry_is_inprogress(je))) { + flush_dcache_page(bv.bv_page); +@@ -2006,12 +2006,12 @@ static bool __journal_read_write(struct dm_integrity_io *dio, struct bio *bio, + + if (!ic->internal_hash) { + struct bio_integrity_payload *bip = bio_integrity(bio); +- unsigned tag_todo = ic->tag_size; ++ unsigned int tag_todo = ic->tag_size; + char *tag_ptr = journal_entry_tag(ic, je); + + if (bip) do { + struct bio_vec biv = bvec_iter_bvec(bip->bip_vec, bip->bip_iter); +- unsigned tag_now = min(biv.bv_len, tag_todo); ++ unsigned int tag_now = min(biv.bv_len, tag_todo); + char *tag_addr; + BUG_ON(PageHighMem(biv.bv_page)); + tag_addr = bvec_virt(&biv); +@@ -2030,7 +2030,7 @@ static bool __journal_read_write(struct dm_integrity_io *dio, struct bio *bio, + + if (likely(dio->op == REQ_OP_WRITE)) { + struct journal_sector *js; +- unsigned s; ++ unsigned int s; + + js = access_journal_data(ic, journal_section, journal_entry); + memcpy(js, mem + bv.bv_offset, ic->sectors_per_block << SECTOR_SHIFT); +@@ -2041,7 +2041,7 @@ static bool __journal_read_write(struct dm_integrity_io *dio, struct bio *bio, + } while (++s < ic->sectors_per_block); + + if (ic->internal_hash) { +- unsigned digest_size = crypto_shash_digestsize(ic->internal_hash); ++ unsigned int digest_size = crypto_shash_digestsize(ic->internal_hash); + if (unlikely(digest_size > ic->tag_size)) { + char checksums_onstack[HASH_MAX_DIGESTSIZE]; + integrity_sector_checksum(ic, logical_sector, (char *)js, checksums_onstack); +@@ -2098,8 +2098,8 @@ static void dm_integrity_map_continue(struct dm_integrity_io *dio, bool from_map + { + struct dm_integrity_c *ic = dio->ic; + struct bio *bio = dm_bio_from_per_bio_data(dio, sizeof(struct dm_integrity_io)); +- unsigned journal_section, journal_entry; +- unsigned journal_read_pos; ++ unsigned int journal_section, journal_entry; ++ unsigned int journal_read_pos; + struct completion read_comp; + bool discard_retried = false; + bool need_sync_io = ic->internal_hash && dio->op == REQ_OP_READ; +@@ -2124,8 +2124,8 @@ static void dm_integrity_map_continue(struct dm_integrity_io *dio, bool from_map + journal_read_pos = NOT_FOUND; + if (ic->mode == 'J' && likely(dio->op != REQ_OP_DISCARD)) { + if (dio->op == REQ_OP_WRITE) { +- unsigned next_entry, i, pos; +- unsigned ws, we, range_sectors; ++ unsigned int next_entry, i, pos; ++ unsigned int ws, we, range_sectors; + + dio->range.n_sectors = min(dio->range.n_sectors, + (sector_t)ic->free_sectors << ic->sb->log2_sectors_per_block); +@@ -2178,8 +2178,8 @@ static void dm_integrity_map_continue(struct dm_integrity_io *dio, bool from_map + if (unlikely(dio->range.n_sectors > next_sector - dio->range.logical_sector)) + dio->range.n_sectors = next_sector - dio->range.logical_sector; + } else { +- unsigned i; +- unsigned jp = journal_read_pos + 1; ++ unsigned int i; ++ unsigned int jp = journal_read_pos + 1; + for (i = ic->sectors_per_block; i < dio->range.n_sectors; i += ic->sectors_per_block, jp++) { + if (!test_journal_node(ic, jp, dio->range.logical_sector + i)) + break; +@@ -2211,7 +2211,7 @@ static void dm_integrity_map_continue(struct dm_integrity_io *dio, bool from_map + */ + if (journal_read_pos != NOT_FOUND) { + sector_t next_sector; +- unsigned new_pos = find_journal_node(ic, dio->range.logical_sector, &next_sector); ++ unsigned int new_pos = find_journal_node(ic, dio->range.logical_sector, &next_sector); + if (unlikely(new_pos != journal_read_pos)) { + remove_range_unlocked(ic, &dio->range); + goto retry; +@@ -2220,7 +2220,7 @@ static void dm_integrity_map_continue(struct dm_integrity_io *dio, bool from_map + } + if (ic->mode == 'J' && likely(dio->op == REQ_OP_DISCARD) && !discard_retried) { + sector_t next_sector; +- unsigned new_pos = find_journal_node(ic, dio->range.logical_sector, &next_sector); ++ unsigned int new_pos = find_journal_node(ic, dio->range.logical_sector, &next_sector); + if (unlikely(new_pos != NOT_FOUND) || + unlikely(next_sector < dio->range.logical_sector - dio->range.n_sectors)) { + remove_range_unlocked(ic, &dio->range); +@@ -2347,8 +2347,8 @@ static void pad_uncommitted(struct dm_integrity_c *ic) + static void integrity_commit(struct work_struct *w) + { + struct dm_integrity_c *ic = container_of(w, struct dm_integrity_c, commit_work); +- unsigned commit_start, commit_sections; +- unsigned i, j, n; ++ unsigned int commit_start, commit_sections; ++ unsigned int i, j, n; + struct bio *flushes; + + del_timer(&ic->autocommit_timer); +@@ -2426,17 +2426,17 @@ static void complete_copy_from_journal(unsigned long error, void *context) + static void restore_last_bytes(struct dm_integrity_c *ic, struct journal_sector *js, + struct journal_entry *je) + { +- unsigned s = 0; ++ unsigned int s = 0; + do { + js->commit_id = je->last_bytes[s]; + js++; + } while (++s < ic->sectors_per_block); + } + +-static void do_journal_write(struct dm_integrity_c *ic, unsigned write_start, +- unsigned write_sections, bool from_replay) ++static void do_journal_write(struct dm_integrity_c *ic, unsigned int write_start, ++ unsigned int write_sections, bool from_replay) + { +- unsigned i, j, n; ++ unsigned int i, j, n; + struct journal_completion comp; + struct blk_plug plug; + +@@ -2455,9 +2455,9 @@ static void do_journal_write(struct dm_integrity_c *ic, unsigned write_start, + for (j = 0; j < ic->journal_section_entries; j++) { + struct journal_entry *je = access_journal_entry(ic, i, j); + sector_t sec, area, offset; +- unsigned k, l, next_loop; ++ unsigned int k, l, next_loop; + sector_t metadata_block; +- unsigned metadata_offset; ++ unsigned int metadata_offset; + struct journal_io *io; + + if (journal_entry_is_unused(je)) +@@ -2465,7 +2465,7 @@ static void do_journal_write(struct dm_integrity_c *ic, unsigned write_start, + BUG_ON(unlikely(journal_entry_is_inprogress(je)) && !from_replay); + sec = journal_entry_get_sector(je); + if (unlikely(from_replay)) { +- if (unlikely(sec & (unsigned)(ic->sectors_per_block - 1))) { ++ if (unlikely(sec & (unsigned int)(ic->sectors_per_block - 1))) { + dm_integrity_io_error(ic, "invalid sector in journal", -EIO); + sec &= ~(sector_t)(ic->sectors_per_block - 1); + } +@@ -2583,9 +2583,9 @@ static void do_journal_write(struct dm_integrity_c *ic, unsigned write_start, + static void integrity_writer(struct work_struct *w) + { + struct dm_integrity_c *ic = container_of(w, struct dm_integrity_c, writer_work); +- unsigned write_start, write_sections; ++ unsigned int write_start, write_sections; + +- unsigned prev_free_sectors; ++ unsigned int prev_free_sectors; + + spin_lock_irq(&ic->endio_wait.lock); + write_start = ic->committed_section; +@@ -2632,12 +2632,12 @@ static void integrity_recalc(struct work_struct *w) + struct dm_io_region io_loc; + sector_t area, offset; + sector_t metadata_block; +- unsigned metadata_offset; ++ unsigned int metadata_offset; + sector_t logical_sector, n_sectors; + __u8 *t; +- unsigned i; ++ unsigned int i; + int r; +- unsigned super_counter = 0; ++ unsigned int super_counter = 0; + + DEBUG_print("start recalculation... (position %llx)\n", le64_to_cpu(ic->sb->recalc_sector)); + +@@ -2661,7 +2661,7 @@ static void integrity_recalc(struct work_struct *w) + get_area_and_offset(ic, range.logical_sector, &area, &offset); + range.n_sectors = min((sector_t)RECALC_SECTORS, ic->provided_data_sectors - range.logical_sector); + if (!ic->meta_dev) +- range.n_sectors = min(range.n_sectors, ((sector_t)1U << ic->sb->log2_interleave_sectors) - (unsigned)offset); ++ range.n_sectors = min(range.n_sectors, ((sector_t)1U << ic->sb->log2_interleave_sectors) - (unsigned int)offset); + + add_new_range_and_wait(ic, &range); + spin_unlock_irq(&ic->endio_wait.lock); +@@ -2852,10 +2852,10 @@ static void bitmap_flush_work(struct work_struct *work) + } + + +-static void init_journal(struct dm_integrity_c *ic, unsigned start_section, +- unsigned n_sections, unsigned char commit_seq) ++static void init_journal(struct dm_integrity_c *ic, unsigned int start_section, ++ unsigned int n_sections, unsigned char commit_seq) + { +- unsigned i, j, n; ++ unsigned int i, j, n; + + if (!n_sections) + return; +@@ -2878,7 +2878,7 @@ static void init_journal(struct dm_integrity_c *ic, unsigned start_section, + write_journal(ic, start_section, n_sections); + } + +-static int find_commit_seq(struct dm_integrity_c *ic, unsigned i, unsigned j, commit_id_t id) ++static int find_commit_seq(struct dm_integrity_c *ic, unsigned int i, unsigned int j, commit_id_t id) + { + unsigned char k; + for (k = 0; k < N_COMMIT_IDS; k++) { +@@ -2891,11 +2891,11 @@ static int find_commit_seq(struct dm_integrity_c *ic, unsigned i, unsigned j, co + + static void replay_journal(struct dm_integrity_c *ic) + { +- unsigned i, j; ++ unsigned int i, j; + bool used_commit_ids[N_COMMIT_IDS]; +- unsigned max_commit_id_sections[N_COMMIT_IDS]; +- unsigned write_start, write_sections; +- unsigned continue_section; ++ unsigned int max_commit_id_sections[N_COMMIT_IDS]; ++ unsigned int write_start, write_sections; ++ unsigned int continue_section; + bool journal_empty; + unsigned char unused, last_used, want_commit_seq; + +@@ -3013,7 +3013,7 @@ static void replay_journal(struct dm_integrity_c *ic) + ic->commit_seq = want_commit_seq; + DEBUG_print("continuing from section %u, commit seq %d\n", write_start, ic->commit_seq); + } else { +- unsigned s; ++ unsigned int s; + unsigned char erase_seq; + clear_journal: + DEBUG_print("clearing journal\n"); +@@ -3245,10 +3245,10 @@ static void dm_integrity_resume(struct dm_target *ti) + } + + static void dm_integrity_status(struct dm_target *ti, status_type_t type, +- unsigned status_flags, char *result, unsigned maxlen) ++ unsigned int status_flags, char *result, unsigned int maxlen) + { + struct dm_integrity_c *ic = (struct dm_integrity_c *)ti->private; +- unsigned arg_count; ++ unsigned int arg_count; + size_t sz = 0; + + switch (type) { +@@ -3298,7 +3298,7 @@ static void dm_integrity_status(struct dm_target *ti, status_type_t type, + DMEMIT(" interleave_sectors:%u", 1U << ic->sb->log2_interleave_sectors); + DMEMIT(" buffer_sectors:%u", 1U << ic->log2_buffer_sectors); + if (ic->mode == 'J') { +- DMEMIT(" journal_watermark:%u", (unsigned)watermark_percentage); ++ DMEMIT(" journal_watermark:%u", (unsigned int)watermark_percentage); + DMEMIT(" commit_time:%u", ic->autocommit_msec); + } + if (ic->mode == 'B') { +@@ -3377,7 +3377,7 @@ static void dm_integrity_io_hints(struct dm_target *ti, struct queue_limits *lim + + static void calculate_journal_section_size(struct dm_integrity_c *ic) + { +- unsigned sector_space = JOURNAL_SECTOR_DATA; ++ unsigned int sector_space = JOURNAL_SECTOR_DATA; + + ic->journal_sections = le32_to_cpu(ic->sb->journal_sections); + ic->journal_entry_size = roundup(offsetof(struct journal_entry, last_bytes[ic->sectors_per_block]) + ic->tag_size, +@@ -3454,9 +3454,10 @@ static void get_provided_data_sectors(struct dm_integrity_c *ic) + } + } + +-static int initialize_superblock(struct dm_integrity_c *ic, unsigned journal_sectors, unsigned interleave_sectors) ++static int initialize_superblock(struct dm_integrity_c *ic, ++ unsigned int journal_sectors, unsigned int interleave_sectors) + { +- unsigned journal_sections; ++ unsigned int journal_sections; + int test_bit; + + memset(ic->sb, 0, SB_SECTORS << SECTOR_SHIFT); +@@ -3541,7 +3542,7 @@ static void dm_integrity_set(struct dm_target *ti, struct dm_integrity_c *ic) + + static void dm_integrity_free_page_list(struct page_list *pl) + { +- unsigned i; ++ unsigned int i; + + if (!pl) + return; +@@ -3550,10 +3551,10 @@ static void dm_integrity_free_page_list(struct page_list *pl) + kvfree(pl); + } + +-static struct page_list *dm_integrity_alloc_page_list(unsigned n_pages) ++static struct page_list *dm_integrity_alloc_page_list(unsigned int n_pages) + { + struct page_list *pl; +- unsigned i; ++ unsigned int i; + + pl = kvmalloc_array(n_pages + 1, sizeof(struct page_list), GFP_KERNEL | __GFP_ZERO); + if (!pl) +@@ -3576,7 +3577,7 @@ static struct page_list *dm_integrity_alloc_page_list(unsigned n_pages) + + static void dm_integrity_free_journal_scatterlist(struct dm_integrity_c *ic, struct scatterlist **sl) + { +- unsigned i; ++ unsigned int i; + for (i = 0; i < ic->journal_sections; i++) + kvfree(sl[i]); + kvfree(sl); +@@ -3586,7 +3587,7 @@ static struct scatterlist **dm_integrity_alloc_journal_scatterlist(struct dm_int + struct page_list *pl) + { + struct scatterlist **sl; +- unsigned i; ++ unsigned int i; + + sl = kvmalloc_array(ic->journal_sections, + sizeof(struct scatterlist *), +@@ -3596,10 +3597,10 @@ static struct scatterlist **dm_integrity_alloc_journal_scatterlist(struct dm_int + + for (i = 0; i < ic->journal_sections; i++) { + struct scatterlist *s; +- unsigned start_index, start_offset; +- unsigned end_index, end_offset; +- unsigned n_pages; +- unsigned idx; ++ unsigned int start_index, start_offset; ++ unsigned int end_index, end_offset; ++ unsigned int n_pages; ++ unsigned int idx; + + page_list_location(ic, i, 0, &start_index, &start_offset); + page_list_location(ic, i, ic->journal_section_sectors - 1, +@@ -3617,7 +3618,7 @@ static struct scatterlist **dm_integrity_alloc_journal_scatterlist(struct dm_int + sg_init_table(s, n_pages); + for (idx = start_index; idx <= end_index; idx++) { + char *va = lowmem_page_address(pl[idx].page); +- unsigned start = 0, end = PAGE_SIZE; ++ unsigned int start = 0, end = PAGE_SIZE; + if (idx == start_index) + start = start_offset; + if (idx == end_index) +@@ -3704,7 +3705,7 @@ static int get_mac(struct crypto_shash **hash, struct alg_spec *a, char **error, + static int create_journal(struct dm_integrity_c *ic, char **error) + { + int r = 0; +- unsigned i; ++ unsigned int i; + __u64 journal_pages, journal_desc_size, journal_tree_size; + unsigned char *crypt_data = NULL, *crypt_iv = NULL; + struct skcipher_request *req = NULL; +@@ -3731,7 +3732,7 @@ static int create_journal(struct dm_integrity_c *ic, char **error) + goto bad; + } + if (ic->journal_crypt_alg.alg_string) { +- unsigned ivsize, blocksize; ++ unsigned int ivsize, blocksize; + struct journal_completion comp; + + comp.ic = ic; +@@ -3820,7 +3821,7 @@ static int create_journal(struct dm_integrity_c *ic, char **error) + crypto_free_skcipher(ic->journal_crypt); + ic->journal_crypt = NULL; + } else { +- unsigned crypt_len = roundup(ivsize, blocksize); ++ unsigned int crypt_len = roundup(ivsize, blocksize); + + req = skcipher_request_alloc(ic->journal_crypt, GFP_KERNEL); + if (!req) { +@@ -3908,7 +3909,7 @@ static int create_journal(struct dm_integrity_c *ic, char **error) + } + + for (i = 0; i < N_COMMIT_IDS; i++) { +- unsigned j; ++ unsigned int j; + retest_commit_id: + for (j = 0; j < i; j++) { + if (ic->commit_ids[j] == ic->commit_ids[i]) { +@@ -3962,17 +3963,17 @@ static int create_journal(struct dm_integrity_c *ic, char **error) + * journal_mac + * recalculate + */ +-static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv) ++static int dm_integrity_ctr(struct dm_target *ti, unsigned int argc, char **argv) + { + struct dm_integrity_c *ic; + char dummy; + int r; +- unsigned extra_args; ++ unsigned int extra_args; + struct dm_arg_set as; + static const struct dm_arg _args[] = { + {0, 18, "Invalid number of feature args"}, + }; +- unsigned journal_sectors, interleave_sectors, buffer_sectors, journal_watermark, sync_msec; ++ unsigned int journal_sectors, interleave_sectors, buffer_sectors, journal_watermark, sync_msec; + bool should_write_sb; + __u64 threshold; + unsigned long long start; +@@ -4051,7 +4052,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv) + + while (extra_args--) { + const char *opt_string; +- unsigned val; ++ unsigned int val; + unsigned long long llval; + opt_string = dm_shift_arg(&as); + if (!opt_string) { +@@ -4384,7 +4385,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv) + DEBUG_print(" journal_entries_per_sector %u\n", ic->journal_entries_per_sector); + DEBUG_print(" journal_section_entries %u\n", ic->journal_section_entries); + DEBUG_print(" journal_section_sectors %u\n", ic->journal_section_sectors); +- DEBUG_print(" journal_sections %u\n", (unsigned)le32_to_cpu(ic->sb->journal_sections)); ++ DEBUG_print(" journal_sections %u\n", (unsigned int)le32_to_cpu(ic->sb->journal_sections)); + DEBUG_print(" journal_entries %u\n", ic->journal_entries); + DEBUG_print(" log2_interleave_sectors %d\n", ic->sb->log2_interleave_sectors); + DEBUG_print(" data_device_sectors 0x%llx\n", bdev_nr_sectors(ic->dev->bdev)); +@@ -4458,8 +4459,8 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv) + } + + if (ic->mode == 'B') { +- unsigned i; +- unsigned n_bitmap_pages = DIV_ROUND_UP(ic->n_bitmap_blocks, PAGE_SIZE / BITMAP_BLOCK_SIZE); ++ unsigned int i; ++ unsigned int n_bitmap_pages = DIV_ROUND_UP(ic->n_bitmap_blocks, PAGE_SIZE / BITMAP_BLOCK_SIZE); + + ic->recalc_bitmap = dm_integrity_alloc_page_list(n_bitmap_pages); + if (!ic->recalc_bitmap) { +@@ -4479,7 +4480,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv) + INIT_DELAYED_WORK(&ic->bitmap_flush_work, bitmap_flush_work); + for (i = 0; i < ic->n_bitmap_blocks; i++) { + struct bitmap_block_status *bbs = &ic->bbs[i]; +- unsigned sector, pl_index, pl_offset; ++ unsigned int sector, pl_index, pl_offset; + + INIT_WORK(&bbs->work, bitmap_block_work); + bbs->ic = ic; +@@ -4516,7 +4517,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv) + goto bad; + } + if (ic->mode == 'B') { +- unsigned max_io_len = ((sector_t)ic->sectors_per_block << ic->log2_blocks_per_bitmap_bit) * (BITMAP_BLOCK_SIZE * 8); ++ unsigned int max_io_len = ((sector_t)ic->sectors_per_block << ic->log2_blocks_per_bitmap_bit) * (BITMAP_BLOCK_SIZE * 8); + if (!max_io_len) + max_io_len = 1U << 31; + DEBUG_print("max_io_len: old %u, new %u\n", ti->max_io_len, max_io_len); +@@ -4587,7 +4588,7 @@ static void dm_integrity_dtr(struct dm_target *ti) + if (ic->journal_io_scatterlist) + dm_integrity_free_journal_scatterlist(ic, ic->journal_io_scatterlist); + if (ic->sk_requests) { +- unsigned i; ++ unsigned int i; + + for (i = 0; i < ic->journal_sections; i++) { + struct skcipher_request *req = ic->sk_requests[i]; +diff --git a/drivers/md/dm-io-rewind.c b/drivers/md/dm-io-rewind.c +index 0db53ccb..773c4cff 100644 +--- a/drivers/md/dm-io-rewind.c ++++ b/drivers/md/dm-io-rewind.c +@@ -57,7 +57,7 @@ static void dm_bio_integrity_rewind(struct bio *bio, unsigned int bytes_done) + { + struct bio_integrity_payload *bip = bio_integrity(bio); + struct blk_integrity *bi = blk_get_integrity(bio->bi_bdev->bd_disk); +- unsigned bytes = bio_integrity_bytes(bi, bytes_done >> 9); ++ unsigned int bytes = bio_integrity_bytes(bi, bytes_done >> 9); + + bip->bip_iter.bi_sector -= bio_integrity_intervals(bi, bytes_done >> 9); + dm_bvec_iter_rewind(bip->bip_vec, &bip->bip_iter, bytes); +@@ -131,7 +131,7 @@ static inline void dm_bio_rewind_iter(const struct bio *bio, + * rewinding from end of bio and restoring its original position. + * Caller is also responsibile for restoring bio's size. + */ +-static void dm_bio_rewind(struct bio *bio, unsigned bytes) ++static void dm_bio_rewind(struct bio *bio, unsigned int bytes) + { + if (bio_integrity(bio)) + dm_bio_integrity_rewind(bio, bytes); +diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c +index 78356453..e488b05e 100644 +--- a/drivers/md/dm-io.c ++++ b/drivers/md/dm-io.c +@@ -48,7 +48,7 @@ static struct kmem_cache *_dm_io_cache; + struct dm_io_client *dm_io_client_create(void) + { + struct dm_io_client *client; +- unsigned min_ios = dm_get_reserved_bio_based_ios(); ++ unsigned int min_ios = dm_get_reserved_bio_based_ios(); + int ret; + + client = kzalloc(sizeof(*client), GFP_KERNEL); +@@ -88,7 +88,7 @@ EXPORT_SYMBOL(dm_io_client_destroy); + * bi_private. + *---------------------------------------------------------------*/ + static void store_io_and_region_in_bio(struct bio *bio, struct io *io, +- unsigned region) ++ unsigned int region) + { + if (unlikely(!IS_ALIGNED((unsigned long)io, DM_IO_MAX_REGIONS))) { + DMCRIT("Unaligned struct io pointer %p", io); +@@ -99,7 +99,7 @@ static void store_io_and_region_in_bio(struct bio *bio, struct io *io, + } + + static void retrieve_io_and_region_from_bio(struct bio *bio, struct io **io, +- unsigned *region) ++ unsigned int *region) + { + unsigned long val = (unsigned long)bio->bi_private; + +@@ -137,7 +137,7 @@ static void dec_count(struct io *io, unsigned int region, blk_status_t error) + static void endio(struct bio *bio) + { + struct io *io; +- unsigned region; ++ unsigned int region; + blk_status_t error; + + if (bio->bi_status && bio_data_dir(bio) == READ) +@@ -160,11 +160,11 @@ static void endio(struct bio *bio) + *---------------------------------------------------------------*/ + struct dpages { + void (*get_page)(struct dpages *dp, +- struct page **p, unsigned long *len, unsigned *offset); ++ struct page **p, unsigned long *len, unsigned int *offset); + void (*next_page)(struct dpages *dp); + + union { +- unsigned context_u; ++ unsigned int context_u; + struct bvec_iter context_bi; + }; + void *context_ptr; +@@ -177,9 +177,9 @@ struct dpages { + * Functions for getting the pages from a list. + */ + static void list_get_page(struct dpages *dp, +- struct page **p, unsigned long *len, unsigned *offset) ++ struct page **p, unsigned long *len, unsigned int *offset) + { +- unsigned o = dp->context_u; ++ unsigned int o = dp->context_u; + struct page_list *pl = (struct page_list *) dp->context_ptr; + + *p = pl->page; +@@ -194,7 +194,7 @@ static void list_next_page(struct dpages *dp) + dp->context_u = 0; + } + +-static void list_dp_init(struct dpages *dp, struct page_list *pl, unsigned offset) ++static void list_dp_init(struct dpages *dp, struct page_list *pl, unsigned int offset) + { + dp->get_page = list_get_page; + dp->next_page = list_next_page; +@@ -206,7 +206,7 @@ static void list_dp_init(struct dpages *dp, struct page_list *pl, unsigned offse + * Functions for getting the pages from a bvec. + */ + static void bio_get_page(struct dpages *dp, struct page **p, +- unsigned long *len, unsigned *offset) ++ unsigned long *len, unsigned int *offset) + { + struct bio_vec bvec = bvec_iter_bvec((struct bio_vec *)dp->context_ptr, + dp->context_bi); +@@ -244,7 +244,7 @@ static void bio_dp_init(struct dpages *dp, struct bio *bio) + * Functions for getting the pages from a VMA. + */ + static void vm_get_page(struct dpages *dp, +- struct page **p, unsigned long *len, unsigned *offset) ++ struct page **p, unsigned long *len, unsigned int *offset) + { + *p = vmalloc_to_page(dp->context_ptr); + *offset = dp->context_u; +@@ -269,7 +269,7 @@ static void vm_dp_init(struct dpages *dp, void *data) + * Functions for getting the pages from kernel memory. + */ + static void km_get_page(struct dpages *dp, struct page **p, unsigned long *len, +- unsigned *offset) ++ unsigned int *offset) + { + *p = virt_to_page(dp->context_ptr); + *offset = dp->context_u; +@@ -293,15 +293,15 @@ static void km_dp_init(struct dpages *dp, void *data) + /*----------------------------------------------------------------- + * IO routines that accept a list of pages. + *---------------------------------------------------------------*/ +-static void do_region(const blk_opf_t opf, unsigned region, ++static void do_region(const blk_opf_t opf, unsigned int region, + struct dm_io_region *where, struct dpages *dp, + struct io *io) + { + struct bio *bio; + struct page *page; + unsigned long len; +- unsigned offset; +- unsigned num_bvecs; ++ unsigned int offset; ++ unsigned int num_bvecs; + sector_t remaining = where->count; + struct request_queue *q = bdev_get_queue(where->bdev); + sector_t num_sectors; +@@ -508,7 +508,7 @@ static int dp_init(struct dm_io_request *io_req, struct dpages *dp, + return 0; + } + +-int dm_io(struct dm_io_request *io_req, unsigned num_regions, ++int dm_io(struct dm_io_request *io_req, unsigned int num_regions, + struct dm_io_region *where, unsigned long *sync_error_bits) + { + int r; +diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c +index e031088f..37f5ea73 100644 +--- a/drivers/md/dm-ioctl.c ++++ b/drivers/md/dm-ioctl.c +@@ -31,7 +31,7 @@ struct dm_file { + * poll will wait until the global event number is greater than + * this value. + */ +- volatile unsigned global_event_nr; ++ volatile unsigned int global_event_nr; + }; + + /*----------------------------------------------------------------- +@@ -413,7 +413,7 @@ static struct mapped_device *dm_hash_rename(struct dm_ioctl *param, + struct hash_cell *hc; + struct dm_table *table; + struct mapped_device *md; +- unsigned change_uuid = (param->flags & DM_UUID_FLAG) ? 1 : 0; ++ unsigned int change_uuid = (param->flags & DM_UUID_FLAG) ? 1 : 0; + int srcu_idx; + + /* +@@ -1021,7 +1021,7 @@ static int dev_rename(struct file *filp, struct dm_ioctl *param, size_t param_si + int r; + char *new_data = (char *) param + param->data_start; + struct mapped_device *md; +- unsigned change_uuid = (param->flags & DM_UUID_FLAG) ? 1 : 0; ++ unsigned int change_uuid = (param->flags & DM_UUID_FLAG) ? 1 : 0; + + if (new_data < param->data || + invalid_str(new_data, (void *) param + param_size) || !*new_data || +@@ -1096,7 +1096,7 @@ static int dev_set_geometry(struct file *filp, struct dm_ioctl *param, size_t pa + static int do_suspend(struct dm_ioctl *param) + { + int r = 0; +- unsigned suspend_flags = DM_SUSPEND_LOCKFS_FLAG; ++ unsigned int suspend_flags = DM_SUSPEND_LOCKFS_FLAG; + struct mapped_device *md; + + md = find_device(param); +@@ -1125,7 +1125,7 @@ static int do_suspend(struct dm_ioctl *param) + static int do_resume(struct dm_ioctl *param) + { + int r = 0; +- unsigned suspend_flags = DM_SUSPEND_LOCKFS_FLAG; ++ unsigned int suspend_flags = DM_SUSPEND_LOCKFS_FLAG; + struct hash_cell *hc; + struct mapped_device *md; + struct dm_table *new_map, *old_map = NULL; +@@ -1243,7 +1243,7 @@ static void retrieve_status(struct dm_table *table, + char *outbuf, *outptr; + status_type_t type; + size_t remaining, len, used = 0; +- unsigned status_flags = 0; ++ unsigned int status_flags = 0; + + outptr = outbuf = get_result_buffer(param, param_size, &len); + +@@ -1648,8 +1648,8 @@ static int table_status(struct file *filp, struct dm_ioctl *param, size_t param_ + * Returns a number <= 1 if message was processed by device mapper. + * Returns 2 if message should be delivered to the target. + */ +-static int message_for_md(struct mapped_device *md, unsigned argc, char **argv, +- char *result, unsigned maxlen) ++static int message_for_md(struct mapped_device *md, unsigned int argc, char **argv, ++ char *result, unsigned int maxlen) + { + int r; + +@@ -1859,7 +1859,7 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern + struct dm_ioctl *dmi; + int secure_data; + const size_t minimum_data_size = offsetof(struct dm_ioctl, data); +- unsigned noio_flag; ++ unsigned int noio_flag; + + if (copy_from_user(param_kernel, user, minimum_data_size)) + return -EFAULT; +diff --git a/drivers/md/dm-kcopyd.c b/drivers/md/dm-kcopyd.c +index 4d3bbbea..0ef78e56 100644 +--- a/drivers/md/dm-kcopyd.c ++++ b/drivers/md/dm-kcopyd.c +@@ -34,14 +34,14 @@ + #define DEFAULT_SUB_JOB_SIZE_KB 512 + #define MAX_SUB_JOB_SIZE_KB 1024 + +-static unsigned kcopyd_subjob_size_kb = DEFAULT_SUB_JOB_SIZE_KB; ++static unsigned int kcopyd_subjob_size_kb = DEFAULT_SUB_JOB_SIZE_KB; + + module_param(kcopyd_subjob_size_kb, uint, S_IRUGO | S_IWUSR); + MODULE_PARM_DESC(kcopyd_subjob_size_kb, "Sub-job size for dm-kcopyd clients"); + +-static unsigned dm_get_kcopyd_subjob_size(void) ++static unsigned int dm_get_kcopyd_subjob_size(void) + { +- unsigned sub_job_size_kb; ++ unsigned int sub_job_size_kb; + + sub_job_size_kb = __dm_get_module_param(&kcopyd_subjob_size_kb, + DEFAULT_SUB_JOB_SIZE_KB, +@@ -56,9 +56,9 @@ static unsigned dm_get_kcopyd_subjob_size(void) + *---------------------------------------------------------------*/ + struct dm_kcopyd_client { + struct page_list *pages; +- unsigned nr_reserved_pages; +- unsigned nr_free_pages; +- unsigned sub_job_size; ++ unsigned int nr_reserved_pages; ++ unsigned int nr_free_pages; ++ unsigned int sub_job_size; + + struct dm_io_client *io_client; + +@@ -119,7 +119,7 @@ static DEFINE_SPINLOCK(throttle_spinlock); + + static void io_job_start(struct dm_kcopyd_throttle *t) + { +- unsigned throttle, now, difference; ++ unsigned int throttle, now, difference; + int slept = 0, skew; + + if (unlikely(!t)) +@@ -182,7 +182,7 @@ static void io_job_finish(struct dm_kcopyd_throttle *t) + goto skip_limit; + + if (!t->num_io_jobs) { +- unsigned now, difference; ++ unsigned int now, difference; + + now = jiffies; + difference = now - t->last_jiffies; +@@ -303,9 +303,9 @@ static void drop_pages(struct page_list *pl) + /* + * Allocate and reserve nr_pages for the use of a specific client. + */ +-static int client_reserve_pages(struct dm_kcopyd_client *kc, unsigned nr_pages) ++static int client_reserve_pages(struct dm_kcopyd_client *kc, unsigned int nr_pages) + { +- unsigned i; ++ unsigned int i; + struct page_list *pl = NULL, *next; + + for (i = 0; i < nr_pages; i++) { +@@ -341,7 +341,7 @@ static void client_free_pages(struct dm_kcopyd_client *kc) + struct kcopyd_job { + struct dm_kcopyd_client *kc; + struct list_head list; +- unsigned flags; ++ unsigned int flags; + + /* + * Error state of the job. +@@ -582,7 +582,7 @@ static int run_io_job(struct kcopyd_job *job) + static int run_pages_job(struct kcopyd_job *job) + { + int r; +- unsigned nr_pages = dm_div_up(job->dests[0].count, PAGE_SIZE >> 9); ++ unsigned int nr_pages = dm_div_up(job->dests[0].count, PAGE_SIZE >> 9); + + r = kcopyd_get_pages(job->kc, nr_pages, &job->pages); + if (!r) { +@@ -849,8 +849,8 @@ void dm_kcopyd_copy(struct dm_kcopyd_client *kc, struct dm_io_region *from, + EXPORT_SYMBOL(dm_kcopyd_copy); + + void dm_kcopyd_zero(struct dm_kcopyd_client *kc, +- unsigned num_dests, struct dm_io_region *dests, +- unsigned flags, dm_kcopyd_notify_fn fn, void *context) ++ unsigned int num_dests, struct dm_io_region *dests, ++ unsigned int flags, dm_kcopyd_notify_fn fn, void *context) + { + dm_kcopyd_copy(kc, NULL, num_dests, dests, flags, fn, context); + } +@@ -906,7 +906,7 @@ int kcopyd_cancel(struct kcopyd_job *job, int block) + struct dm_kcopyd_client *dm_kcopyd_client_create(struct dm_kcopyd_throttle *throttle) + { + int r; +- unsigned reserve_pages; ++ unsigned int reserve_pages; + struct dm_kcopyd_client *kc; + + kc = kzalloc(sizeof(*kc), GFP_KERNEL); +diff --git a/drivers/md/dm-linear.c b/drivers/md/dm-linear.c +index 3212ef6a..26b1af64 100644 +--- a/drivers/md/dm-linear.c ++++ b/drivers/md/dm-linear.c +@@ -95,7 +95,7 @@ static int linear_map(struct dm_target *ti, struct bio *bio) + } + + static void linear_status(struct dm_target *ti, status_type_t type, +- unsigned status_flags, char *result, unsigned maxlen) ++ unsigned int status_flags, char *result, unsigned int maxlen) + { + struct linear_c *lc = (struct linear_c *) ti->private; + size_t sz = 0; +diff --git a/drivers/md/dm-log-userspace-base.c b/drivers/md/dm-log-userspace-base.c +index 9ab93ebe..9fc69382 100644 +--- a/drivers/md/dm-log-userspace-base.c ++++ b/drivers/md/dm-log-userspace-base.c +@@ -123,7 +123,7 @@ static int userspace_do_request(struct log_c *lc, const char *uuid, + } + + static int build_constructor_string(struct dm_target *ti, +- unsigned argc, char **argv, ++ unsigned int argc, char **argv, + char **ctr_str) + { + int i, str_size; +@@ -188,7 +188,7 @@ static void do_flush(struct work_struct *work) + * to the userspace ctr function. + */ + static int userspace_ctr(struct dm_dirty_log *log, struct dm_target *ti, +- unsigned argc, char **argv) ++ unsigned int argc, char **argv) + { + int r = 0; + int str_size; +@@ -792,7 +792,7 @@ static region_t userspace_get_sync_count(struct dm_dirty_log *log) + * Returns: amount of space consumed + */ + static int userspace_status(struct dm_dirty_log *log, status_type_t status_type, +- char *result, unsigned maxlen) ++ char *result, unsigned int maxlen) + { + int r = 0; + char *table_args; +diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c +index fdf8ec30..072559b7 100644 +--- a/drivers/md/dm-log-userspace-transfer.c ++++ b/drivers/md/dm-log-userspace-transfer.c +@@ -142,7 +142,7 @@ static void cn_ulog_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp) + fill_pkg(msg, NULL); + else if (msg->len < sizeof(*tfr)) + DMERR("Incomplete message received (expected %u, got %u): [%u]", +- (unsigned)sizeof(*tfr), msg->len, msg->seq); ++ (unsigned int)sizeof(*tfr), msg->len, msg->seq); + else + fill_pkg(NULL, tfr); + spin_unlock(&receiving_list_lock); +diff --git a/drivers/md/dm-log-writes.c b/drivers/md/dm-log-writes.c +index 178e13a5..efdfb2e1 100644 +--- a/drivers/md/dm-log-writes.c ++++ b/drivers/md/dm-log-writes.c +@@ -792,10 +792,10 @@ static int normal_end_io(struct dm_target *ti, struct bio *bio, + * INFO format: + */ + static void log_writes_status(struct dm_target *ti, status_type_t type, +- unsigned status_flags, char *result, +- unsigned maxlen) ++ unsigned int status_flags, char *result, ++ unsigned int maxlen) + { +- unsigned sz = 0; ++ unsigned int sz = 0; + struct log_writes_c *lc = ti->private; + + switch (type) { +@@ -844,8 +844,8 @@ static int log_writes_iterate_devices(struct dm_target *ti, + * Messages supported: + * mark - specify the marked data. + */ +-static int log_writes_message(struct dm_target *ti, unsigned argc, char **argv, +- char *result, unsigned maxlen) ++static int log_writes_message(struct dm_target *ti, unsigned int argc, char **argv, ++ char *result, unsigned int maxlen) + { + int r = -EINVAL; + struct log_writes_c *lc = ti->private; +diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c +index cf10fa66..159f2c05 100644 +--- a/drivers/md/dm-log.c ++++ b/drivers/md/dm-log.c +@@ -223,7 +223,7 @@ struct log_c { + unsigned int region_count; + region_t sync_count; + +- unsigned bitset_uint32_count; ++ unsigned int bitset_uint32_count; + uint32_t *clean_bits; + uint32_t *sync_bits; + uint32_t *recovering_bits; /* FIXME: this seems excessive */ +@@ -255,20 +255,20 @@ struct log_c { + * The touched member needs to be updated every time we access + * one of the bitsets. + */ +-static inline int log_test_bit(uint32_t *bs, unsigned bit) ++static inline int log_test_bit(uint32_t *bs, unsigned int bit) + { + return test_bit_le(bit, bs) ? 1 : 0; + } + + static inline void log_set_bit(struct log_c *l, +- uint32_t *bs, unsigned bit) ++ uint32_t *bs, unsigned int bit) + { + __set_bit_le(bit, bs); + l->touched_cleaned = 1; + } + + static inline void log_clear_bit(struct log_c *l, +- uint32_t *bs, unsigned bit) ++ uint32_t *bs, unsigned int bit) + { + __clear_bit_le(bit, bs); + l->touched_dirtied = 1; +@@ -582,7 +582,7 @@ static void fail_log_device(struct log_c *lc) + static int disk_resume(struct dm_dirty_log *log) + { + int r; +- unsigned i; ++ unsigned int i; + struct log_c *lc = (struct log_c *) log->context; + size_t size = lc->bitset_uint32_count * sizeof(uint32_t); + +diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c +index 0e325469..91c25ad8 100644 +--- a/drivers/md/dm-mpath.c ++++ b/drivers/md/dm-mpath.c +@@ -29,7 +29,7 @@ + + #define DM_MSG_PREFIX "multipath" + #define DM_PG_INIT_DELAY_MSECS 2000 +-#define DM_PG_INIT_DELAY_DEFAULT ((unsigned) -1) ++#define DM_PG_INIT_DELAY_DEFAULT ((unsigned int) -1) + #define QUEUE_IF_NO_PATH_TIMEOUT_DEFAULT 0 + + static unsigned long queue_if_no_path_timeout_secs = QUEUE_IF_NO_PATH_TIMEOUT_DEFAULT; +@@ -39,7 +39,7 @@ struct pgpath { + struct list_head list; + + struct priority_group *pg; /* Owning PG */ +- unsigned fail_count; /* Cumulative failure count */ ++ unsigned int fail_count; /* Cumulative failure count */ + + struct dm_path path; + struct delayed_work activate_path; +@@ -59,8 +59,8 @@ struct priority_group { + struct multipath *m; /* Owning multipath instance */ + struct path_selector ps; + +- unsigned pg_num; /* Reference number */ +- unsigned nr_pgpaths; /* Number of paths in PG */ ++ unsigned int pg_num; /* Reference number */ ++ unsigned int nr_pgpaths; /* Number of paths in PG */ + struct list_head pgpaths; + + bool bypassed:1; /* Temporarily bypass this PG? */ +@@ -78,14 +78,14 @@ struct multipath { + struct priority_group *next_pg; /* Switch to this PG if set */ + + atomic_t nr_valid_paths; /* Total number of usable paths */ +- unsigned nr_priority_groups; ++ unsigned int nr_priority_groups; + struct list_head priority_groups; + + const char *hw_handler_name; + char *hw_handler_params; + wait_queue_head_t pg_init_wait; /* Wait for pg_init completion */ +- unsigned pg_init_retries; /* Number of times to retry pg_init */ +- unsigned pg_init_delay_msecs; /* Number of msecs before pg_init retry */ ++ unsigned int pg_init_retries; /* Number of times to retry pg_init */ ++ unsigned int pg_init_delay_msecs; /* Number of msecs before pg_init retry */ + atomic_t pg_init_in_progress; /* Only one pg_init allowed at once */ + atomic_t pg_init_count; /* Number of times pg_init called */ + +@@ -397,7 +397,7 @@ static struct pgpath *choose_pgpath(struct multipath *m, size_t nr_bytes) + unsigned long flags; + struct priority_group *pg; + struct pgpath *pgpath; +- unsigned bypassed = 1; ++ unsigned int bypassed = 1; + + if (!atomic_read(&m->nr_valid_paths)) { + spin_lock_irqsave(&m->lock, flags); +@@ -840,7 +840,7 @@ static int parse_path_selector(struct dm_arg_set *as, struct priority_group *pg, + { + int r; + struct path_selector_type *pst; +- unsigned ps_argc; ++ unsigned int ps_argc; + + static const struct dm_arg _args[] = { + {0, 1024, "invalid number of path selector args"}, +@@ -983,7 +983,7 @@ static struct priority_group *parse_priority_group(struct dm_arg_set *as, + }; + + int r; +- unsigned i, nr_selector_args, nr_args; ++ unsigned int i, nr_selector_args, nr_args; + struct priority_group *pg; + struct dm_target *ti = m->ti; + +@@ -1049,7 +1049,7 @@ static struct priority_group *parse_priority_group(struct dm_arg_set *as, + + static int parse_hw_handler(struct dm_arg_set *as, struct multipath *m) + { +- unsigned hw_argc; ++ unsigned int hw_argc; + int ret; + struct dm_target *ti = m->ti; + +@@ -1101,7 +1101,7 @@ static int parse_hw_handler(struct dm_arg_set *as, struct multipath *m) + static int parse_features(struct dm_arg_set *as, struct multipath *m) + { + int r; +- unsigned argc; ++ unsigned int argc; + struct dm_target *ti = m->ti; + const char *arg_name; + +@@ -1170,7 +1170,7 @@ static int parse_features(struct dm_arg_set *as, struct multipath *m) + return r; + } + +-static int multipath_ctr(struct dm_target *ti, unsigned argc, char **argv) ++static int multipath_ctr(struct dm_target *ti, unsigned int argc, char **argv) + { + /* target arguments */ + static const struct dm_arg _args[] = { +@@ -1181,8 +1181,8 @@ static int multipath_ctr(struct dm_target *ti, unsigned argc, char **argv) + int r; + struct multipath *m; + struct dm_arg_set as; +- unsigned pg_count = 0; +- unsigned next_pg_num; ++ unsigned int pg_count = 0; ++ unsigned int next_pg_num; + unsigned long flags; + + as.argc = argc; +@@ -1224,7 +1224,7 @@ static int multipath_ctr(struct dm_target *ti, unsigned argc, char **argv) + /* parse the priority groups */ + while (as.argc) { + struct priority_group *pg; +- unsigned nr_valid_paths = atomic_read(&m->nr_valid_paths); ++ unsigned int nr_valid_paths = atomic_read(&m->nr_valid_paths); + + pg = parse_priority_group(&as, m); + if (IS_ERR(pg)) { +@@ -1365,7 +1365,7 @@ static int reinstate_path(struct pgpath *pgpath) + int r = 0, run_queue = 0; + unsigned long flags; + struct multipath *m = pgpath->pg->m; +- unsigned nr_valid_paths; ++ unsigned int nr_valid_paths; + + spin_lock_irqsave(&m->lock, flags); + +@@ -1454,7 +1454,7 @@ static void bypass_pg(struct multipath *m, struct priority_group *pg, + static int switch_pg_num(struct multipath *m, const char *pgstr) + { + struct priority_group *pg; +- unsigned pgnum; ++ unsigned int pgnum; + unsigned long flags; + char dummy; + +@@ -1487,7 +1487,7 @@ static int switch_pg_num(struct multipath *m, const char *pgstr) + static int bypass_pg_num(struct multipath *m, const char *pgstr, bool bypassed) + { + struct priority_group *pg; +- unsigned pgnum; ++ unsigned int pgnum; + char dummy; + + if (!pgstr || (sscanf(pgstr, "%u%c", &pgnum, &dummy) != 1) || !pgnum || +@@ -1789,14 +1789,14 @@ static void multipath_resume(struct dm_target *ti) + * num_paths num_selector_args [path_dev [selector_args]* ]+ ]+ + */ + static void multipath_status(struct dm_target *ti, status_type_t type, +- unsigned status_flags, char *result, unsigned maxlen) ++ unsigned int status_flags, char *result, unsigned int maxlen) + { + int sz = 0, pg_counter, pgpath_counter; + unsigned long flags; + struct multipath *m = ti->private; + struct priority_group *pg; + struct pgpath *p; +- unsigned pg_num; ++ unsigned int pg_num; + char state; + + spin_lock_irqsave(&m->lock, flags); +@@ -1948,8 +1948,8 @@ static void multipath_status(struct dm_target *ti, status_type_t type, + spin_unlock_irqrestore(&m->lock, flags); + } + +-static int multipath_message(struct dm_target *ti, unsigned argc, char **argv, +- char *result, unsigned maxlen) ++static int multipath_message(struct dm_target *ti, unsigned int argc, char **argv, ++ char *result, unsigned int maxlen) + { + int r = -EINVAL; + struct dm_dev *dev; +diff --git a/drivers/md/dm-mpath.h b/drivers/md/dm-mpath.h +index e230f719..5343698f 100644 +--- a/drivers/md/dm-mpath.h ++++ b/drivers/md/dm-mpath.h +@@ -17,6 +17,6 @@ struct dm_path { + }; + + /* Callback for hwh_pg_init_fn to use when complete */ +-void dm_pg_init_complete(struct dm_path *path, unsigned err_flags); ++void dm_pg_init_complete(struct dm_path *path, unsigned int err_flags); + + #endif +diff --git a/drivers/md/dm-path-selector.h b/drivers/md/dm-path-selector.h +index 83cac2b0..0f2b37af 100644 +--- a/drivers/md/dm-path-selector.h ++++ b/drivers/md/dm-path-selector.h +@@ -52,7 +52,7 @@ struct path_selector_type { + /* + * Constructs a path selector object, takes custom arguments + */ +- int (*create) (struct path_selector *ps, unsigned argc, char **argv); ++ int (*create) (struct path_selector *ps, unsigned int argc, char **argv); + void (*destroy) (struct path_selector *ps); + + /* +diff --git a/drivers/md/dm-ps-io-affinity.c b/drivers/md/dm-ps-io-affinity.c +index f74501e6..76ce4ce8 100644 +--- a/drivers/md/dm-ps-io-affinity.c ++++ b/drivers/md/dm-ps-io-affinity.c +@@ -108,7 +108,7 @@ static int ioa_add_path(struct path_selector *ps, struct dm_path *path, + return ret; + } + +-static int ioa_create(struct path_selector *ps, unsigned argc, char **argv) ++static int ioa_create(struct path_selector *ps, unsigned int argc, char **argv) + { + struct selector *s; + +@@ -138,7 +138,7 @@ static int ioa_create(struct path_selector *ps, unsigned argc, char **argv) + static void ioa_destroy(struct path_selector *ps) + { + struct selector *s = ps->context; +- unsigned cpu; ++ unsigned int cpu; + + for_each_cpu(cpu, s->path_mask) + ioa_free_path(s, cpu); +diff --git a/drivers/md/dm-ps-queue-length.c b/drivers/md/dm-ps-queue-length.c +index cef70657..6fbec9fc 100644 +--- a/drivers/md/dm-ps-queue-length.c ++++ b/drivers/md/dm-ps-queue-length.c +@@ -35,7 +35,7 @@ struct selector { + struct path_info { + struct list_head list; + struct dm_path *path; +- unsigned repeat_count; ++ unsigned int repeat_count; + atomic_t qlen; /* the number of in-flight I/Os */ + }; + +@@ -52,7 +52,7 @@ static struct selector *alloc_selector(void) + return s; + } + +-static int ql_create(struct path_selector *ps, unsigned argc, char **argv) ++static int ql_create(struct path_selector *ps, unsigned int argc, char **argv) + { + struct selector *s = alloc_selector(); + +@@ -84,9 +84,9 @@ static void ql_destroy(struct path_selector *ps) + } + + static int ql_status(struct path_selector *ps, struct dm_path *path, +- status_type_t type, char *result, unsigned maxlen) ++ status_type_t type, char *result, unsigned int maxlen) + { +- unsigned sz = 0; ++ unsigned int sz = 0; + struct path_info *pi; + + /* When called with NULL path, return selector status/args. */ +@@ -116,7 +116,7 @@ static int ql_add_path(struct path_selector *ps, struct dm_path *path, + { + struct selector *s = ps->context; + struct path_info *pi; +- unsigned repeat_count = QL_MIN_IO; ++ unsigned int repeat_count = QL_MIN_IO; + char dummy; + unsigned long flags; + +diff --git a/drivers/md/dm-ps-round-robin.c b/drivers/md/dm-ps-round-robin.c +index 27f44c5f..1d07392b 100644 +--- a/drivers/md/dm-ps-round-robin.c ++++ b/drivers/md/dm-ps-round-robin.c +@@ -26,7 +26,7 @@ + struct path_info { + struct list_head list; + struct dm_path *path; +- unsigned repeat_count; ++ unsigned int repeat_count; + }; + + static void free_paths(struct list_head *paths) +@@ -62,7 +62,7 @@ static struct selector *alloc_selector(void) + return s; + } + +-static int rr_create(struct path_selector *ps, unsigned argc, char **argv) ++static int rr_create(struct path_selector *ps, unsigned int argc, char **argv) + { + struct selector *s; + +@@ -119,7 +119,7 @@ static int rr_add_path(struct path_selector *ps, struct dm_path *path, + { + struct selector *s = ps->context; + struct path_info *pi; +- unsigned repeat_count = RR_MIN_IO; ++ unsigned int repeat_count = RR_MIN_IO; + char dummy; + unsigned long flags; + +diff --git a/drivers/md/dm-ps-service-time.c b/drivers/md/dm-ps-service-time.c +index 3ec9c332..84d26234 100644 +--- a/drivers/md/dm-ps-service-time.c ++++ b/drivers/md/dm-ps-service-time.c +@@ -30,8 +30,8 @@ struct selector { + struct path_info { + struct list_head list; + struct dm_path *path; +- unsigned repeat_count; +- unsigned relative_throughput; ++ unsigned int repeat_count; ++ unsigned int relative_throughput; + atomic_t in_flight_size; /* Total size of in-flight I/Os */ + }; + +@@ -48,7 +48,7 @@ static struct selector *alloc_selector(void) + return s; + } + +-static int st_create(struct path_selector *ps, unsigned argc, char **argv) ++static int st_create(struct path_selector *ps, unsigned int argc, char **argv) + { + struct selector *s = alloc_selector(); + +@@ -80,9 +80,9 @@ static void st_destroy(struct path_selector *ps) + } + + static int st_status(struct path_selector *ps, struct dm_path *path, +- status_type_t type, char *result, unsigned maxlen) ++ status_type_t type, char *result, unsigned int maxlen) + { +- unsigned sz = 0; ++ unsigned int sz = 0; + struct path_info *pi; + + if (!path) +@@ -113,8 +113,8 @@ static int st_add_path(struct path_selector *ps, struct dm_path *path, + { + struct selector *s = ps->context; + struct path_info *pi; +- unsigned repeat_count = ST_MIN_IO; +- unsigned relative_throughput = 1; ++ unsigned int repeat_count = ST_MIN_IO; ++ unsigned int relative_throughput = 1; + char dummy; + unsigned long flags; + +diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c +index 54263679..b26c1285 100644 +--- a/drivers/md/dm-raid.c ++++ b/drivers/md/dm-raid.c +@@ -3712,7 +3712,7 @@ static void raid_status(struct dm_target *ti, status_type_t type, + } + + static int raid_message(struct dm_target *ti, unsigned int argc, char **argv, +- char *result, unsigned maxlen) ++ char *result, unsigned int maxlen) + { + struct raid_set *rs = ti->private; + struct mddev *mddev = &rs->md; +diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c +index 06a38dc3..8bd7e87d 100644 +--- a/drivers/md/dm-raid1.c ++++ b/drivers/md/dm-raid1.c +@@ -82,7 +82,7 @@ struct mirror_set { + + struct work_struct trigger_event; + +- unsigned nr_mirrors; ++ unsigned int nr_mirrors; + struct mirror mirror[]; + }; + +@@ -327,7 +327,7 @@ static void recovery_complete(int read_err, unsigned long write_err, + + static void recover(struct mirror_set *ms, struct dm_region *reg) + { +- unsigned i; ++ unsigned int i; + struct dm_io_region from, to[DM_KCOPYD_MAX_REGIONS], *dest; + struct mirror *m; + unsigned long flags = 0; +@@ -593,7 +593,7 @@ static void do_reads(struct mirror_set *ms, struct bio_list *reads) + + static void write_callback(unsigned long error, void *context) + { +- unsigned i; ++ unsigned int i; + struct bio *bio = (struct bio *) context; + struct mirror_set *ms; + int should_wake = 0; +@@ -963,10 +963,10 @@ static int get_mirror(struct mirror_set *ms, struct dm_target *ti, + * Create dirty log: log_type #log_params + */ + static struct dm_dirty_log *create_dirty_log(struct dm_target *ti, +- unsigned argc, char **argv, +- unsigned *args_used) ++ unsigned int argc, char **argv, ++ unsigned int *args_used) + { +- unsigned param_count; ++ unsigned int param_count; + struct dm_dirty_log *dl; + char dummy; + +@@ -997,10 +997,10 @@ static struct dm_dirty_log *create_dirty_log(struct dm_target *ti, + return dl; + } + +-static int parse_features(struct mirror_set *ms, unsigned argc, char **argv, +- unsigned *args_used) ++static int parse_features(struct mirror_set *ms, unsigned int argc, char **argv, ++ unsigned int *args_used) + { +- unsigned num_features; ++ unsigned int num_features; + struct dm_target *ti = ms->ti; + char dummy; + int i; +@@ -1389,7 +1389,7 @@ static char device_status_char(struct mirror *m) + + + static void mirror_status(struct dm_target *ti, status_type_t type, +- unsigned status_flags, char *result, unsigned maxlen) ++ unsigned int status_flags, char *result, unsigned int maxlen) + { + unsigned int m, sz = 0; + int num_feature_args = 0; +@@ -1458,7 +1458,7 @@ static int mirror_iterate_devices(struct dm_target *ti, + { + struct mirror_set *ms = ti->private; + int ret = 0; +- unsigned i; ++ unsigned int i; + + for (i = 0; !ret && i < ms->nr_mirrors; i++) + ret = fn(ti, ms->mirror[i].dev, +diff --git a/drivers/md/dm-region-hash.c b/drivers/md/dm-region-hash.c +index 1f760451..adbdb4b6 100644 +--- a/drivers/md/dm-region-hash.c ++++ b/drivers/md/dm-region-hash.c +@@ -56,17 +56,17 @@ + *---------------------------------------------------------------*/ + struct dm_region_hash { + uint32_t region_size; +- unsigned region_shift; ++ unsigned int region_shift; + + /* holds persistent region state */ + struct dm_dirty_log *log; + + /* hash table */ + rwlock_t hash_lock; +- unsigned mask; +- unsigned nr_buckets; +- unsigned prime; +- unsigned shift; ++ unsigned int mask; ++ unsigned int nr_buckets; ++ unsigned int prime; ++ unsigned int shift; + struct list_head *buckets; + + /* +@@ -74,7 +74,7 @@ struct dm_region_hash { + */ + int flush_failure; + +- unsigned max_recovery; /* Max # of regions to recover in parallel */ ++ unsigned int max_recovery; /* Max # of regions to recover in parallel */ + + spinlock_t region_lock; + atomic_t recovery_in_flight; +@@ -163,12 +163,12 @@ struct dm_region_hash *dm_region_hash_create( + struct bio_list *bios), + void (*wakeup_workers)(void *context), + void (*wakeup_all_recovery_waiters)(void *context), +- sector_t target_begin, unsigned max_recovery, ++ sector_t target_begin, unsigned int max_recovery, + struct dm_dirty_log *log, uint32_t region_size, + region_t nr_regions) + { + struct dm_region_hash *rh; +- unsigned nr_buckets, max_buckets; ++ unsigned int nr_buckets, max_buckets; + size_t i; + int ret; + +@@ -236,7 +236,7 @@ EXPORT_SYMBOL_GPL(dm_region_hash_create); + + void dm_region_hash_destroy(struct dm_region_hash *rh) + { +- unsigned h; ++ unsigned int h; + struct dm_region *reg, *nreg; + + BUG_ON(!list_empty(&rh->quiesced_regions)); +@@ -263,9 +263,9 @@ struct dm_dirty_log *dm_rh_dirty_log(struct dm_region_hash *rh) + } + EXPORT_SYMBOL_GPL(dm_rh_dirty_log); + +-static unsigned rh_hash(struct dm_region_hash *rh, region_t region) ++static unsigned int rh_hash(struct dm_region_hash *rh, region_t region) + { +- return (unsigned) ((region * rh->prime) >> rh->shift) & rh->mask; ++ return (unsigned int) ((region * rh->prime) >> rh->shift) & rh->mask; + } + + static struct dm_region *__rh_lookup(struct dm_region_hash *rh, region_t region) +diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c +index a41209a4..80f46e01 100644 +--- a/drivers/md/dm-rq.c ++++ b/drivers/md/dm-rq.c +@@ -23,33 +23,33 @@ struct dm_rq_target_io { + union map_info info; + struct dm_stats_aux stats_aux; + unsigned long duration_jiffies; +- unsigned n_sectors; +- unsigned completed; ++ unsigned int n_sectors; ++ unsigned int completed; + }; + + #define DM_MQ_NR_HW_QUEUES 1 + #define DM_MQ_QUEUE_DEPTH 2048 +-static unsigned dm_mq_nr_hw_queues = DM_MQ_NR_HW_QUEUES; +-static unsigned dm_mq_queue_depth = DM_MQ_QUEUE_DEPTH; ++static unsigned int dm_mq_nr_hw_queues = DM_MQ_NR_HW_QUEUES; ++static unsigned int dm_mq_queue_depth = DM_MQ_QUEUE_DEPTH; + + /* + * Request-based DM's mempools' reserved IOs set by the user. + */ + #define RESERVED_REQUEST_BASED_IOS 256 +-static unsigned reserved_rq_based_ios = RESERVED_REQUEST_BASED_IOS; ++static unsigned int reserved_rq_based_ios = RESERVED_REQUEST_BASED_IOS; + +-unsigned dm_get_reserved_rq_based_ios(void) ++unsigned int dm_get_reserved_rq_based_ios(void) + { + return __dm_get_module_param(&reserved_rq_based_ios, + RESERVED_REQUEST_BASED_IOS, DM_RESERVED_MAX_IOS); + } + +-static unsigned dm_get_blk_mq_nr_hw_queues(void) ++static unsigned int dm_get_blk_mq_nr_hw_queues(void) + { + return __dm_get_module_param(&dm_mq_nr_hw_queues, 1, 32); + } + +-static unsigned dm_get_blk_mq_queue_depth(void) ++static unsigned int dm_get_blk_mq_queue_depth(void) + { + return __dm_get_module_param(&dm_mq_queue_depth, + DM_MQ_QUEUE_DEPTH, BLK_MQ_MAX_DEPTH); +diff --git a/drivers/md/dm-rq.h b/drivers/md/dm-rq.h +index 1eea0da6..2c97ad14 100644 +--- a/drivers/md/dm-rq.h ++++ b/drivers/md/dm-rq.h +@@ -38,7 +38,7 @@ void dm_stop_queue(struct request_queue *q); + + void dm_mq_kick_requeue_list(struct mapped_device *md); + +-unsigned dm_get_reserved_rq_based_ios(void); ++unsigned int dm_get_reserved_rq_based_ios(void); + + ssize_t dm_attr_rq_based_seq_io_merge_deadline_show(struct mapped_device *md, char *buf); + ssize_t dm_attr_rq_based_seq_io_merge_deadline_store(struct mapped_device *md, +diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c +index 680cc05e..5176810f 100644 +--- a/drivers/md/dm-snap-persistent.c ++++ b/drivers/md/dm-snap-persistent.c +@@ -303,7 +303,7 @@ static int read_header(struct pstore *ps, int *new_snapshot) + { + int r; + struct disk_header *dh; +- unsigned chunk_size; ++ unsigned int chunk_size; + int chunk_size_supplied = 1; + char *chunk_err; + +@@ -895,11 +895,11 @@ static int persistent_ctr(struct dm_exception_store *store, char *options) + return r; + } + +-static unsigned persistent_status(struct dm_exception_store *store, ++static unsigned int persistent_status(struct dm_exception_store *store, + status_type_t status, char *result, +- unsigned maxlen) ++ unsigned int maxlen) + { +- unsigned sz = 0; ++ unsigned int sz = 0; + + switch (status) { + case STATUSTYPE_INFO: +diff --git a/drivers/md/dm-snap-transient.c b/drivers/md/dm-snap-transient.c +index 0e0ae4c3..d83a0565 100644 +--- a/drivers/md/dm-snap-transient.c ++++ b/drivers/md/dm-snap-transient.c +@@ -84,11 +84,11 @@ static int transient_ctr(struct dm_exception_store *store, char *options) + return 0; + } + +-static unsigned transient_status(struct dm_exception_store *store, ++static unsigned int transient_status(struct dm_exception_store *store, + status_type_t status, char *result, +- unsigned maxlen) ++ unsigned int maxlen) + { +- unsigned sz = 0; ++ unsigned int sz = 0; + + switch (status) { + case STATUSTYPE_INFO: +diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c +index d1c2f84d..c64d987c 100644 +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -41,7 +41,7 @@ static const char dm_snapshot_merge_target_name[] = "snapshot-merge"; + + struct dm_exception_table { + uint32_t hash_mask; +- unsigned hash_shift; ++ unsigned int hash_shift; + struct hlist_bl_head *table; + }; + +@@ -106,7 +106,7 @@ struct dm_snapshot { + /* The on disk metadata handler */ + struct dm_exception_store *store; + +- unsigned in_progress; ++ unsigned int in_progress; + struct wait_queue_head in_progress_wait; + + struct dm_kcopyd_client *kcopyd_client; +@@ -161,7 +161,7 @@ struct dm_snapshot { + */ + #define DEFAULT_COW_THRESHOLD 2048 + +-static unsigned cow_threshold = DEFAULT_COW_THRESHOLD; ++static unsigned int cow_threshold = DEFAULT_COW_THRESHOLD; + module_param_named(snapshot_cow_threshold, cow_threshold, uint, 0644); + MODULE_PARM_DESC(snapshot_cow_threshold, "Maximum number of chunks being copied on write"); + +@@ -324,7 +324,7 @@ struct origin { + struct dm_origin { + struct dm_dev *dev; + struct dm_target *ti; +- unsigned split_boundary; ++ unsigned int split_boundary; + struct list_head hash_list; + }; + +@@ -377,7 +377,7 @@ static void exit_origin_hash(void) + kfree(_dm_origins); + } + +-static unsigned origin_hash(struct block_device *bdev) ++static unsigned int origin_hash(struct block_device *bdev) + { + return bdev->bd_dev & ORIGIN_MASK; + } +@@ -652,7 +652,7 @@ static void dm_exception_table_unlock(struct dm_exception_table_lock *lock) + } + + static int dm_exception_table_init(struct dm_exception_table *et, +- uint32_t size, unsigned hash_shift) ++ uint32_t size, unsigned int hash_shift) + { + unsigned int i; + +@@ -850,7 +850,7 @@ static int dm_add_exception(void *context, chunk_t old, chunk_t new) + static uint32_t __minimum_chunk_size(struct origin *o) + { + struct dm_snapshot *snap; +- unsigned chunk_size = rounddown_pow_of_two(UINT_MAX); ++ unsigned int chunk_size = rounddown_pow_of_two(UINT_MAX); + + if (o) + list_for_each_entry(snap, &o->snapshots, list) +@@ -1010,7 +1010,7 @@ static int remove_single_exception_chunk(struct dm_snapshot *s) + } + + static int origin_write_extent(struct dm_snapshot *merging_snap, +- sector_t sector, unsigned chunk_size); ++ sector_t sector, unsigned int chunk_size); + + static void merge_callback(int read_err, unsigned long write_err, + void *context); +@@ -1183,7 +1183,7 @@ static int parse_snapshot_features(struct dm_arg_set *as, struct dm_snapshot *s, + struct dm_target *ti) + { + int r; +- unsigned argc; ++ unsigned int argc; + const char *arg_name; + + static const struct dm_arg _args[] = { +@@ -1241,7 +1241,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv) + int r = -EINVAL; + char *origin_path, *cow_path; + dev_t origin_dev, cow_dev; +- unsigned args_used, num_flush_bios = 1; ++ unsigned int args_used, num_flush_bios = 1; + fmode_t origin_mode = FMODE_READ; + + if (argc < 4) { +@@ -2315,11 +2315,11 @@ static void snapshot_merge_resume(struct dm_target *ti) + } + + static void snapshot_status(struct dm_target *ti, status_type_t type, +- unsigned status_flags, char *result, unsigned maxlen) ++ unsigned int status_flags, char *result, unsigned int maxlen) + { +- unsigned sz = 0; ++ unsigned int sz = 0; + struct dm_snapshot *snap = ti->private; +- unsigned num_features; ++ unsigned int num_features; + + switch (type) { + case STATUSTYPE_INFO: +@@ -2592,7 +2592,7 @@ static int do_origin(struct dm_dev *origin, struct bio *bio, bool limit) + * size must be a multiple of merging_snap's chunk_size. + */ + static int origin_write_extent(struct dm_snapshot *merging_snap, +- sector_t sector, unsigned size) ++ sector_t sector, unsigned int size) + { + int must_wait = 0; + sector_t n; +@@ -2668,7 +2668,7 @@ static void origin_dtr(struct dm_target *ti) + static int origin_map(struct dm_target *ti, struct bio *bio) + { + struct dm_origin *o = ti->private; +- unsigned available_sectors; ++ unsigned int available_sectors; + + bio_set_dev(bio, o->dev->bdev); + +@@ -2679,7 +2679,7 @@ static int origin_map(struct dm_target *ti, struct bio *bio) + return DM_MAPIO_REMAPPED; + + available_sectors = o->split_boundary - +- ((unsigned)bio->bi_iter.bi_sector & (o->split_boundary - 1)); ++ ((unsigned int)bio->bi_iter.bi_sector & (o->split_boundary - 1)); + + if (bio_sectors(bio) > available_sectors) + dm_accept_partial_bio(bio, available_sectors); +@@ -2713,7 +2713,7 @@ static void origin_postsuspend(struct dm_target *ti) + } + + static void origin_status(struct dm_target *ti, status_type_t type, +- unsigned status_flags, char *result, unsigned maxlen) ++ unsigned int status_flags, char *result, unsigned int maxlen) + { + struct dm_origin *o = ti->private; + +diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c +index d12ba9bc..7eeb3c2a 100644 +--- a/drivers/md/dm-stats.c ++++ b/drivers/md/dm-stats.c +@@ -42,12 +42,12 @@ struct dm_stat_shared { + struct dm_stat { + struct list_head list_entry; + int id; +- unsigned stat_flags; ++ unsigned int stat_flags; + size_t n_entries; + sector_t start; + sector_t end; + sector_t step; +- unsigned n_histogram_entries; ++ unsigned int n_histogram_entries; + unsigned long long *histogram_boundaries; + const char *program_id; + const char *aux_data; +@@ -63,7 +63,7 @@ struct dm_stat { + + struct dm_stats_last_position { + sector_t last_sector; +- unsigned last_rw; ++ unsigned int last_rw; + }; + + /* +@@ -255,8 +255,8 @@ static void dm_stats_recalc_precise_timestamps(struct dm_stats *stats) + } + + static int dm_stats_create(struct dm_stats *stats, sector_t start, sector_t end, +- sector_t step, unsigned stat_flags, +- unsigned n_histogram_entries, ++ sector_t step, unsigned int stat_flags, ++ unsigned int n_histogram_entries, + unsigned long long *histogram_boundaries, + const char *program_id, const char *aux_data, + void (*suspend_callback)(struct mapped_device *), +@@ -475,11 +475,11 @@ static int dm_stats_delete(struct dm_stats *stats, int id) + } + + static int dm_stats_list(struct dm_stats *stats, const char *program, +- char *result, unsigned maxlen) ++ char *result, unsigned int maxlen) + { + struct dm_stat *s; + sector_t len; +- unsigned sz = 0; ++ unsigned int sz = 0; + + /* + * Output format: +@@ -499,7 +499,7 @@ static int dm_stats_list(struct dm_stats *stats, const char *program, + if (s->stat_flags & STAT_PRECISE_TIMESTAMPS) + DMEMIT(" precise_timestamps"); + if (s->n_histogram_entries) { +- unsigned i; ++ unsigned int i; + DMEMIT(" histogram:"); + for (i = 0; i < s->n_histogram_entries; i++) { + if (i) +@@ -523,7 +523,7 @@ static void dm_stat_round(struct dm_stat *s, struct dm_stat_shared *shared, + * This is racy, but so is part_round_stats_single. + */ + unsigned long long now, difference; +- unsigned in_flight_read, in_flight_write; ++ unsigned int in_flight_read, in_flight_write; + + if (likely(!(s->stat_flags & STAT_PRECISE_TIMESTAMPS))) + now = jiffies; +@@ -534,8 +534,8 @@ static void dm_stat_round(struct dm_stat *s, struct dm_stat_shared *shared, + if (!difference) + return; + +- in_flight_read = (unsigned)atomic_read(&shared->in_flight[READ]); +- in_flight_write = (unsigned)atomic_read(&shared->in_flight[WRITE]); ++ in_flight_read = (unsigned int)atomic_read(&shared->in_flight[READ]); ++ in_flight_write = (unsigned int)atomic_read(&shared->in_flight[WRITE]); + if (in_flight_read) + p->io_ticks[READ] += difference; + if (in_flight_write) +@@ -596,9 +596,9 @@ static void dm_stat_for_entry(struct dm_stat *s, size_t entry, + duration = stats_aux->duration_ns; + } + if (s->n_histogram_entries) { +- unsigned lo = 0, hi = s->n_histogram_entries + 1; ++ unsigned int lo = 0, hi = s->n_histogram_entries + 1; + while (lo + 1 < hi) { +- unsigned mid = (lo + hi) / 2; ++ unsigned int mid = (lo + hi) / 2; + if (s->histogram_boundaries[mid - 1] > duration) { + hi = mid; + } else { +@@ -656,7 +656,7 @@ static void __dm_stat_bio(struct dm_stat *s, int bi_rw, + } + + void dm_stats_account_io(struct dm_stats *stats, unsigned long bi_rw, +- sector_t bi_sector, unsigned bi_sectors, bool end, ++ sector_t bi_sector, unsigned int bi_sectors, bool end, + unsigned long start_time, + struct dm_stats_aux *stats_aux) + { +@@ -745,7 +745,7 @@ static void __dm_stat_init_temporary_percpu_totals(struct dm_stat_shared *shared + shared->tmp.io_ticks_total += READ_ONCE(p->io_ticks_total); + shared->tmp.time_in_queue += READ_ONCE(p->time_in_queue); + if (s->n_histogram_entries) { +- unsigned i; ++ unsigned int i; + for (i = 0; i < s->n_histogram_entries + 1; i++) + shared->tmp.histogram[i] += READ_ONCE(p->histogram[i]); + } +@@ -779,7 +779,7 @@ static void __dm_stat_clear(struct dm_stat *s, size_t idx_start, size_t idx_end, + p->time_in_queue -= shared->tmp.time_in_queue; + local_irq_enable(); + if (s->n_histogram_entries) { +- unsigned i; ++ unsigned int i; + for (i = 0; i < s->n_histogram_entries + 1; i++) { + local_irq_disable(); + p = &s->stat_percpu[smp_processor_id()][x]; +@@ -816,7 +816,7 @@ static int dm_stats_clear(struct dm_stats *stats, int id) + static unsigned long long dm_jiffies_to_msec64(struct dm_stat *s, unsigned long long j) + { + unsigned long long result; +- unsigned mult; ++ unsigned int mult; + + if (s->stat_flags & STAT_PRECISE_TIMESTAMPS) + return j; +@@ -836,9 +836,9 @@ static unsigned long long dm_jiffies_to_msec64(struct dm_stat *s, unsigned long + + static int dm_stats_print(struct dm_stats *stats, int id, + size_t idx_start, size_t idx_len, +- bool clear, char *result, unsigned maxlen) ++ bool clear, char *result, unsigned int maxlen) + { +- unsigned sz = 0; ++ unsigned int sz = 0; + struct dm_stat *s; + size_t x; + sector_t start, end, step; +@@ -894,7 +894,7 @@ static int dm_stats_print(struct dm_stats *stats, int id, + dm_jiffies_to_msec64(s, shared->tmp.io_ticks[READ]), + dm_jiffies_to_msec64(s, shared->tmp.io_ticks[WRITE])); + if (s->n_histogram_entries) { +- unsigned i; ++ unsigned int i; + for (i = 0; i < s->n_histogram_entries + 1; i++) { + DMEMIT("%s%llu", !i ? " " : ":", shared->tmp.histogram[i]); + } +@@ -943,11 +943,11 @@ static int dm_stats_set_aux(struct dm_stats *stats, int id, const char *aux_data + return 0; + } + +-static int parse_histogram(const char *h, unsigned *n_histogram_entries, ++static int parse_histogram(const char *h, unsigned int *n_histogram_entries, + unsigned long long **histogram_boundaries) + { + const char *q; +- unsigned n; ++ unsigned int n; + unsigned long long last; + + *n_histogram_entries = 1; +@@ -982,23 +982,23 @@ static int parse_histogram(const char *h, unsigned *n_histogram_entries, + } + + static int message_stats_create(struct mapped_device *md, +- unsigned argc, char **argv, +- char *result, unsigned maxlen) ++ unsigned int argc, char **argv, ++ char *result, unsigned int maxlen) + { + int r; + int id; + char dummy; + unsigned long long start, end, len, step; +- unsigned divisor; ++ unsigned int divisor; + const char *program_id, *aux_data; +- unsigned stat_flags = 0; ++ unsigned int stat_flags = 0; + +- unsigned n_histogram_entries = 0; ++ unsigned int n_histogram_entries = 0; + unsigned long long *histogram_boundaries = NULL; + + struct dm_arg_set as, as_backup; + const char *a; +- unsigned feature_args; ++ unsigned int feature_args; + + /* + * Input format: +@@ -1107,7 +1107,7 @@ static int message_stats_create(struct mapped_device *md, + } + + static int message_stats_delete(struct mapped_device *md, +- unsigned argc, char **argv) ++ unsigned int argc, char **argv) + { + int id; + char dummy; +@@ -1122,7 +1122,7 @@ static int message_stats_delete(struct mapped_device *md, + } + + static int message_stats_clear(struct mapped_device *md, +- unsigned argc, char **argv) ++ unsigned int argc, char **argv) + { + int id; + char dummy; +@@ -1137,8 +1137,8 @@ static int message_stats_clear(struct mapped_device *md, + } + + static int message_stats_list(struct mapped_device *md, +- unsigned argc, char **argv, +- char *result, unsigned maxlen) ++ unsigned int argc, char **argv, ++ char *result, unsigned int maxlen) + { + int r; + const char *program = NULL; +@@ -1160,8 +1160,8 @@ static int message_stats_list(struct mapped_device *md, + } + + static int message_stats_print(struct mapped_device *md, +- unsigned argc, char **argv, bool clear, +- char *result, unsigned maxlen) ++ unsigned int argc, char **argv, bool clear, ++ char *result, unsigned int maxlen) + { + int id; + char dummy; +@@ -1187,7 +1187,7 @@ static int message_stats_print(struct mapped_device *md, + } + + static int message_stats_set_aux(struct mapped_device *md, +- unsigned argc, char **argv) ++ unsigned int argc, char **argv) + { + int id; + char dummy; +@@ -1201,8 +1201,8 @@ static int message_stats_set_aux(struct mapped_device *md, + return dm_stats_set_aux(dm_get_stats(md), id, argv[2]); + } + +-int dm_stats_message(struct mapped_device *md, unsigned argc, char **argv, +- char *result, unsigned maxlen) ++int dm_stats_message(struct mapped_device *md, unsigned int argc, char **argv, ++ char *result, unsigned int maxlen) + { + int r; + +diff --git a/drivers/md/dm-stats.h b/drivers/md/dm-stats.h +index ee32b099..c6728c8b 100644 +--- a/drivers/md/dm-stats.h ++++ b/drivers/md/dm-stats.h +@@ -26,11 +26,11 @@ void dm_stats_cleanup(struct dm_stats *st); + + struct mapped_device; + +-int dm_stats_message(struct mapped_device *md, unsigned argc, char **argv, +- char *result, unsigned maxlen); ++int dm_stats_message(struct mapped_device *md, unsigned int argc, char **argv, ++ char *result, unsigned int maxlen); + + void dm_stats_account_io(struct dm_stats *stats, unsigned long bi_rw, +- sector_t bi_sector, unsigned bi_sectors, bool end, ++ sector_t bi_sector, unsigned int bi_sectors, bool end, + unsigned long start_time, + struct dm_stats_aux *aux); + +diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c +index baa085cc..a81ed080 100644 +--- a/drivers/md/dm-stripe.c ++++ b/drivers/md/dm-stripe.c +@@ -273,7 +273,7 @@ static int stripe_map(struct dm_target *ti, struct bio *bio) + { + struct stripe_c *sc = ti->private; + uint32_t stripe; +- unsigned target_bio_nr; ++ unsigned int target_bio_nr; + + if (bio->bi_opf & REQ_PREFLUSH) { + target_bio_nr = dm_bio_get_target_bio_nr(bio); +@@ -359,7 +359,7 @@ static size_t stripe_dax_recovery_write(struct dm_target *ti, pgoff_t pgoff, + */ + + static void stripe_status(struct dm_target *ti, status_type_t type, +- unsigned status_flags, char *result, unsigned maxlen) ++ unsigned int status_flags, char *result, unsigned int maxlen) + { + struct stripe_c *sc = (struct stripe_c *) ti->private; + unsigned int sz = 0; +@@ -406,7 +406,7 @@ static void stripe_status(struct dm_target *ti, status_type_t type, + static int stripe_end_io(struct dm_target *ti, struct bio *bio, + blk_status_t *error) + { +- unsigned i; ++ unsigned int i; + char major_minor[16]; + struct stripe_c *sc = ti->private; + +@@ -444,7 +444,7 @@ static int stripe_iterate_devices(struct dm_target *ti, + { + struct stripe_c *sc = ti->private; + int ret = 0; +- unsigned i = 0; ++ unsigned int i = 0; + + do { + ret = fn(ti, sc->stripe[i].dev, +@@ -459,7 +459,7 @@ static void stripe_io_hints(struct dm_target *ti, + struct queue_limits *limits) + { + struct stripe_c *sc = ti->private; +- unsigned chunk_size = sc->chunk_size << SECTOR_SHIFT; ++ unsigned int chunk_size = sc->chunk_size << SECTOR_SHIFT; + + blk_limits_io_min(limits, chunk_size); + blk_limits_io_opt(limits, chunk_size * sc->stripes); +diff --git a/drivers/md/dm-switch.c b/drivers/md/dm-switch.c +index 534dc2ca..f734b5a0 100644 +--- a/drivers/md/dm-switch.c ++++ b/drivers/md/dm-switch.c +@@ -38,9 +38,9 @@ struct switch_path { + struct switch_ctx { + struct dm_target *ti; + +- unsigned nr_paths; /* Number of paths in path_list. */ ++ unsigned int nr_paths; /* Number of paths in path_list. */ + +- unsigned region_size; /* Region size in 512-byte sectors */ ++ unsigned int region_size; /* Region size in 512-byte sectors */ + unsigned long nr_regions; /* Number of regions making up the device */ + signed char region_size_bits; /* log2 of region_size or -1 */ + +@@ -56,8 +56,8 @@ struct switch_ctx { + struct switch_path path_list[]; + }; + +-static struct switch_ctx *alloc_switch_ctx(struct dm_target *ti, unsigned nr_paths, +- unsigned region_size) ++static struct switch_ctx *alloc_switch_ctx(struct dm_target *ti, unsigned int nr_paths, ++ unsigned int region_size) + { + struct switch_ctx *sctx; + +@@ -73,7 +73,7 @@ static struct switch_ctx *alloc_switch_ctx(struct dm_target *ti, unsigned nr_pat + return sctx; + } + +-static int alloc_region_table(struct dm_target *ti, unsigned nr_paths) ++static int alloc_region_table(struct dm_target *ti, unsigned int nr_paths) + { + struct switch_ctx *sctx = ti->private; + sector_t nr_regions = ti->len; +@@ -124,7 +124,7 @@ static int alloc_region_table(struct dm_target *ti, unsigned nr_paths) + } + + static void switch_get_position(struct switch_ctx *sctx, unsigned long region_nr, +- unsigned long *region_index, unsigned *bit) ++ unsigned long *region_index, unsigned int *bit) + { + if (sctx->region_entries_per_slot_bits >= 0) { + *region_index = region_nr >> sctx->region_entries_per_slot_bits; +@@ -137,10 +137,10 @@ static void switch_get_position(struct switch_ctx *sctx, unsigned long region_nr + *bit *= sctx->region_table_entry_bits; + } + +-static unsigned switch_region_table_read(struct switch_ctx *sctx, unsigned long region_nr) ++static unsigned int switch_region_table_read(struct switch_ctx *sctx, unsigned long region_nr) + { + unsigned long region_index; +- unsigned bit; ++ unsigned int bit; + + switch_get_position(sctx, region_nr, ®ion_index, &bit); + +@@ -151,9 +151,9 @@ static unsigned switch_region_table_read(struct switch_ctx *sctx, unsigned long + /* + * Find which path to use at given offset. + */ +-static unsigned switch_get_path_nr(struct switch_ctx *sctx, sector_t offset) ++static unsigned int switch_get_path_nr(struct switch_ctx *sctx, sector_t offset) + { +- unsigned path_nr; ++ unsigned int path_nr; + sector_t p; + + p = offset; +@@ -172,10 +172,10 @@ static unsigned switch_get_path_nr(struct switch_ctx *sctx, sector_t offset) + } + + static void switch_region_table_write(struct switch_ctx *sctx, unsigned long region_nr, +- unsigned value) ++ unsigned int value) + { + unsigned long region_index; +- unsigned bit; ++ unsigned int bit; + region_table_slot_t pte; + + switch_get_position(sctx, region_nr, ®ion_index, &bit); +@@ -191,7 +191,7 @@ static void switch_region_table_write(struct switch_ctx *sctx, unsigned long reg + */ + static void initialise_region_table(struct switch_ctx *sctx) + { +- unsigned path_nr = 0; ++ unsigned int path_nr = 0; + unsigned long region_nr; + + for (region_nr = 0; region_nr < sctx->nr_regions; region_nr++) { +@@ -249,7 +249,7 @@ static void switch_dtr(struct dm_target *ti) + * Optional args are to allow for future extension: currently this + * parameter must be 0. + */ +-static int switch_ctr(struct dm_target *ti, unsigned argc, char **argv) ++static int switch_ctr(struct dm_target *ti, unsigned int argc, char **argv) + { + static const struct dm_arg _args[] = { + {1, (KMALLOC_MAX_SIZE - sizeof(struct switch_ctx)) / sizeof(struct switch_path), "Invalid number of paths"}, +@@ -259,7 +259,7 @@ static int switch_ctr(struct dm_target *ti, unsigned argc, char **argv) + + struct switch_ctx *sctx; + struct dm_arg_set as; +- unsigned nr_paths, region_size, nr_optional_args; ++ unsigned int nr_paths, region_size, nr_optional_args; + int r; + + as.argc = argc; +@@ -320,7 +320,7 @@ static int switch_map(struct dm_target *ti, struct bio *bio) + { + struct switch_ctx *sctx = ti->private; + sector_t offset = dm_target_offset(ti, bio->bi_iter.bi_sector); +- unsigned path_nr = switch_get_path_nr(sctx, offset); ++ unsigned int path_nr = switch_get_path_nr(sctx, offset); + + bio_set_dev(bio, sctx->path_list[path_nr].dmdev->bdev); + bio->bi_iter.bi_sector = sctx->path_list[path_nr].start + offset; +@@ -371,9 +371,9 @@ static __always_inline unsigned long parse_hex(const char **string) + } + + static int process_set_region_mappings(struct switch_ctx *sctx, +- unsigned argc, char **argv) ++ unsigned int argc, char **argv) + { +- unsigned i; ++ unsigned int i; + unsigned long region_index = 0; + + for (i = 1; i < argc; i++) { +@@ -466,8 +466,8 @@ static int process_set_region_mappings(struct switch_ctx *sctx, + * + * Only set_region_mappings is supported. + */ +-static int switch_message(struct dm_target *ti, unsigned argc, char **argv, +- char *result, unsigned maxlen) ++static int switch_message(struct dm_target *ti, unsigned int argc, char **argv, ++ char *result, unsigned int maxlen) + { + static DEFINE_MUTEX(message_mutex); + +@@ -487,10 +487,10 @@ static int switch_message(struct dm_target *ti, unsigned argc, char **argv, + } + + static void switch_status(struct dm_target *ti, status_type_t type, +- unsigned status_flags, char *result, unsigned maxlen) ++ unsigned int status_flags, char *result, unsigned int maxlen) + { + struct switch_ctx *sctx = ti->private; +- unsigned sz = 0; ++ unsigned int sz = 0; + int path_nr; + + switch (type) { +@@ -519,7 +519,7 @@ static void switch_status(struct dm_target *ti, status_type_t type, + static int switch_prepare_ioctl(struct dm_target *ti, struct block_device **bdev) + { + struct switch_ctx *sctx = ti->private; +- unsigned path_nr; ++ unsigned int path_nr; + + path_nr = switch_get_path_nr(sctx, 0); + +diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c +index 8541d568..c571f238 100644 +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -126,7 +126,7 @@ static int alloc_targets(struct dm_table *t, unsigned int num) + } + + int dm_table_create(struct dm_table **result, fmode_t mode, +- unsigned num_targets, struct mapped_device *md) ++ unsigned int num_targets, struct mapped_device *md) + { + struct dm_table *t = kzalloc(sizeof(*t), GFP_KERNEL); + +@@ -470,10 +470,10 @@ static int adjoin(struct dm_table *t, struct dm_target *ti) + * On the other hand, dm-switch needs to process bulk data using messages and + * excessive use of GFP_NOIO could cause trouble. + */ +-static char **realloc_argv(unsigned *size, char **old_argv) ++static char **realloc_argv(unsigned int *size, char **old_argv) + { + char **argv; +- unsigned new_size; ++ unsigned int new_size; + gfp_t gfp; + + if (*size) { +@@ -499,7 +499,7 @@ static char **realloc_argv(unsigned *size, char **old_argv) + int dm_split_args(int *argc, char ***argvp, char *input) + { + char *start, *end = input, *out, **argv = NULL; +- unsigned array_size = 0; ++ unsigned int array_size = 0; + + *argc = 0; + +@@ -732,9 +732,8 @@ int dm_table_add_target(struct dm_table *t, const char *type, + /* + * Target argument parsing helpers. + */ +-static int validate_next_arg(const struct dm_arg *arg, +- struct dm_arg_set *arg_set, +- unsigned *value, char **error, unsigned grouped) ++static int validate_next_arg(const struct dm_arg *arg, struct dm_arg_set *arg_set, ++ unsigned int *value, char **error, unsigned int grouped) + { + const char *arg_str = dm_shift_arg(arg_set); + char dummy; +@@ -752,14 +751,14 @@ static int validate_next_arg(const struct dm_arg *arg, + } + + int dm_read_arg(const struct dm_arg *arg, struct dm_arg_set *arg_set, +- unsigned *value, char **error) ++ unsigned int *value, char **error) + { + return validate_next_arg(arg, arg_set, value, error, 0); + } + EXPORT_SYMBOL(dm_read_arg); + + int dm_read_arg_group(const struct dm_arg *arg, struct dm_arg_set *arg_set, +- unsigned *value, char **error) ++ unsigned int *value, char **error) + { + return validate_next_arg(arg, arg_set, value, error, 1); + } +@@ -780,7 +779,7 @@ const char *dm_shift_arg(struct dm_arg_set *as) + } + EXPORT_SYMBOL(dm_shift_arg); + +-void dm_consume_args(struct dm_arg_set *as, unsigned num_args) ++void dm_consume_args(struct dm_arg_set *as, unsigned int num_args) + { + BUG_ON(as->argc < num_args); + as->argc -= num_args; +@@ -856,7 +855,7 @@ static int device_is_rq_stackable(struct dm_target *ti, struct dm_dev *dev, + + static int dm_table_determine_type(struct dm_table *t) + { +- unsigned bio_based = 0, request_based = 0, hybrid = 0; ++ unsigned int bio_based = 0, request_based = 0, hybrid = 0; + struct dm_target *ti; + struct list_head *devices = dm_table_get_devices(t); + enum dm_queue_mode live_md_type = dm_get_md_type(t->md); +@@ -1535,7 +1534,7 @@ static bool dm_table_any_dev_attr(struct dm_table *t, + static int count_device(struct dm_target *ti, struct dm_dev *dev, + sector_t start, sector_t len, void *data) + { +- unsigned *num_devices = data; ++ unsigned int *num_devices = data; + + (*num_devices)++; + +@@ -1565,7 +1564,7 @@ bool dm_table_has_no_data_devices(struct dm_table *t) + { + for (unsigned int i = 0; i < t->num_targets; i++) { + struct dm_target *ti = dm_table_get_target(t, i); +- unsigned num_devices = 0; ++ unsigned int num_devices = 0; + + if (!ti->type->iterate_devices) + return false; +diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c +index 6bcc4c47..80545ec5 100644 +--- a/drivers/md/dm-thin-metadata.c ++++ b/drivers/md/dm-thin-metadata.c +@@ -318,12 +318,12 @@ static void unpack_block_time(uint64_t v, dm_block_t *b, uint32_t *t) + */ + typedef int (*run_fn)(struct dm_space_map *, dm_block_t, dm_block_t); + +-static void with_runs(struct dm_space_map *sm, const __le64 *value_le, unsigned count, run_fn fn) ++static void with_runs(struct dm_space_map *sm, const __le64 *value_le, unsigned int count, run_fn fn) + { + uint64_t b, begin, end; + uint32_t t; + bool in_run = false; +- unsigned i; ++ unsigned int i; + + for (i = 0; i < count; i++, value_le++) { + /* We know value_le is 8 byte aligned */ +@@ -348,13 +348,13 @@ static void with_runs(struct dm_space_map *sm, const __le64 *value_le, unsigned + fn(sm, begin, end); + } + +-static void data_block_inc(void *context, const void *value_le, unsigned count) ++static void data_block_inc(void *context, const void *value_le, unsigned int count) + { + with_runs((struct dm_space_map *) context, + (const __le64 *) value_le, count, dm_sm_inc_blocks); + } + +-static void data_block_dec(void *context, const void *value_le, unsigned count) ++static void data_block_dec(void *context, const void *value_le, unsigned int count) + { + with_runs((struct dm_space_map *) context, + (const __le64 *) value_le, count, dm_sm_dec_blocks); +@@ -374,21 +374,21 @@ static int data_block_equal(void *context, const void *value1_le, const void *va + return b1 == b2; + } + +-static void subtree_inc(void *context, const void *value, unsigned count) ++static void subtree_inc(void *context, const void *value, unsigned int count) + { + struct dm_btree_info *info = context; + const __le64 *root_le = value; +- unsigned i; ++ unsigned int i; + + for (i = 0; i < count; i++, root_le++) + dm_tm_inc(info->tm, le64_to_cpu(*root_le)); + } + +-static void subtree_dec(void *context, const void *value, unsigned count) ++static void subtree_dec(void *context, const void *value, unsigned int count) + { + struct dm_btree_info *info = context; + const __le64 *root_le = value; +- unsigned i; ++ unsigned int i; + + for (i = 0; i < count; i++, root_le++) + if (dm_btree_del(info, le64_to_cpu(*root_le))) +@@ -448,10 +448,10 @@ static int superblock_lock(struct dm_pool_metadata *pmd, + static int __superblock_all_zeroes(struct dm_block_manager *bm, int *result) + { + int r; +- unsigned i; ++ unsigned int i; + struct dm_block *b; + __le64 *data_le, zero = cpu_to_le64(0); +- unsigned block_size = dm_bm_block_size(bm) / sizeof(__le64); ++ unsigned int block_size = dm_bm_block_size(bm) / sizeof(__le64); + + /* + * We can't use a validator here - it may be all zeroes. +@@ -971,7 +971,7 @@ struct dm_pool_metadata *dm_pool_metadata_open(struct block_device *bdev, + int dm_pool_metadata_close(struct dm_pool_metadata *pmd) + { + int r; +- unsigned open_devices = 0; ++ unsigned int open_devices = 0; + struct dm_thin_device *td, *tmp; + + down_read(&pmd->root_lock); +@@ -1679,7 +1679,7 @@ int dm_thin_insert_block(struct dm_thin_device *td, dm_block_t block, + static int __remove_range(struct dm_thin_device *td, dm_block_t begin, dm_block_t end) + { + int r; +- unsigned count, total_count = 0; ++ unsigned int count, total_count = 0; + struct dm_pool_metadata *pmd = td->pmd; + dm_block_t keys[1] = { td->id }; + __le64 value; +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index e6e5ab29..ba4ba6be 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -32,7 +32,7 @@ + #define COMMIT_PERIOD HZ + #define NO_SPACE_TIMEOUT_SECS 60 + +-static unsigned no_space_timeout_secs = NO_SPACE_TIMEOUT_SECS; ++static unsigned int no_space_timeout_secs = NO_SPACE_TIMEOUT_SECS; + + DECLARE_DM_KCOPYD_THROTTLE_WITH_MODULE_PARM(snapshot_copy_throttle, + "A percentage of time allocated for copy on write"); +@@ -254,7 +254,7 @@ struct pool { + struct delayed_work no_space_timeout; + + unsigned long last_commit_jiffies; +- unsigned ref_count; ++ unsigned int ref_count; + + spinlock_t lock; + struct bio_list deferred_flush_bios; +@@ -2159,7 +2159,7 @@ static void process_thin_deferred_bios(struct thin_c *tc) + struct bio *bio; + struct bio_list bios; + struct blk_plug plug; +- unsigned count = 0; ++ unsigned int count = 0; + + if (tc->requeue_mode) { + error_thin_bio_list(tc, &tc->deferred_bio_list, +@@ -2229,9 +2229,9 @@ static int cmp_cells(const void *lhs, const void *rhs) + return 0; + } + +-static unsigned sort_cells(struct pool *pool, struct list_head *cells) ++static unsigned int sort_cells(struct pool *pool, struct list_head *cells) + { +- unsigned count = 0; ++ unsigned int count = 0; + struct dm_bio_prison_cell *cell, *tmp; + + list_for_each_entry_safe(cell, tmp, cells, user_list) { +@@ -2252,7 +2252,7 @@ static void process_thin_deferred_cells(struct thin_c *tc) + struct pool *pool = tc->pool; + struct list_head cells; + struct dm_bio_prison_cell *cell; +- unsigned i, j, count; ++ unsigned int i, j, count; + + INIT_LIST_HEAD(&cells); + +@@ -3115,7 +3115,7 @@ static int parse_pool_features(struct dm_arg_set *as, struct pool_features *pf, + struct dm_target *ti) + { + int r; +- unsigned argc; ++ unsigned int argc; + const char *arg_name; + + static const struct dm_arg _args[] = { +@@ -3252,7 +3252,7 @@ static dm_block_t calc_metadata_threshold(struct pool_c *pt) + * read_only: Don't allow any changes to be made to the pool metadata. + * error_if_no_space: error IOs, instead of queueing, if no space. + */ +-static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv) ++static int pool_ctr(struct dm_target *ti, unsigned int argc, char **argv) + { + int r, pool_created = 0; + struct pool_c *pt; +@@ -3648,7 +3648,7 @@ static void pool_postsuspend(struct dm_target *ti) + (void) commit(pool); + } + +-static int check_arg_count(unsigned argc, unsigned args_required) ++static int check_arg_count(unsigned int argc, unsigned int args_required) + { + if (argc != args_required) { + DMWARN("Message received with %u arguments instead of %u.", +@@ -3671,7 +3671,7 @@ static int read_dev_id(char *arg, dm_thin_id *dev_id, int warning) + return -EINVAL; + } + +-static int process_create_thin_mesg(unsigned argc, char **argv, struct pool *pool) ++static int process_create_thin_mesg(unsigned int argc, char **argv, struct pool *pool) + { + dm_thin_id dev_id; + int r; +@@ -3694,7 +3694,7 @@ static int process_create_thin_mesg(unsigned argc, char **argv, struct pool *poo + return 0; + } + +-static int process_create_snap_mesg(unsigned argc, char **argv, struct pool *pool) ++static int process_create_snap_mesg(unsigned int argc, char **argv, struct pool *pool) + { + dm_thin_id dev_id; + dm_thin_id origin_dev_id; +@@ -3722,7 +3722,7 @@ static int process_create_snap_mesg(unsigned argc, char **argv, struct pool *poo + return 0; + } + +-static int process_delete_mesg(unsigned argc, char **argv, struct pool *pool) ++static int process_delete_mesg(unsigned int argc, char **argv, struct pool *pool) + { + dm_thin_id dev_id; + int r; +@@ -3742,7 +3742,7 @@ static int process_delete_mesg(unsigned argc, char **argv, struct pool *pool) + return r; + } + +-static int process_set_transaction_id_mesg(unsigned argc, char **argv, struct pool *pool) ++static int process_set_transaction_id_mesg(unsigned int argc, char **argv, struct pool *pool) + { + dm_thin_id old_id, new_id; + int r; +@@ -3771,7 +3771,7 @@ static int process_set_transaction_id_mesg(unsigned argc, char **argv, struct po + return 0; + } + +-static int process_reserve_metadata_snap_mesg(unsigned argc, char **argv, struct pool *pool) ++static int process_reserve_metadata_snap_mesg(unsigned int argc, char **argv, struct pool *pool) + { + int r; + +@@ -3788,7 +3788,7 @@ static int process_reserve_metadata_snap_mesg(unsigned argc, char **argv, struct + return r; + } + +-static int process_release_metadata_snap_mesg(unsigned argc, char **argv, struct pool *pool) ++static int process_release_metadata_snap_mesg(unsigned int argc, char **argv, struct pool *pool) + { + int r; + +@@ -3812,8 +3812,8 @@ static int process_release_metadata_snap_mesg(unsigned argc, char **argv, struct + * reserve_metadata_snap + * release_metadata_snap + */ +-static int pool_message(struct dm_target *ti, unsigned argc, char **argv, +- char *result, unsigned maxlen) ++static int pool_message(struct dm_target *ti, unsigned int argc, char **argv, ++ char *result, unsigned int maxlen) + { + int r = -EINVAL; + struct pool_c *pt = ti->private; +@@ -3853,9 +3853,9 @@ static int pool_message(struct dm_target *ti, unsigned argc, char **argv, + } + + static void emit_flags(struct pool_features *pf, char *result, +- unsigned sz, unsigned maxlen) ++ unsigned int sz, unsigned int maxlen) + { +- unsigned count = !pf->zero_new_blocks + !pf->discard_enabled + ++ unsigned int count = !pf->zero_new_blocks + !pf->discard_enabled + + !pf->discard_passdown + (pf->mode == PM_READ_ONLY) + + pf->error_if_no_space; + DMEMIT("%u ", count); +@@ -3883,10 +3883,10 @@ static void emit_flags(struct pool_features *pf, char *result, + * + */ + static void pool_status(struct dm_target *ti, status_type_t type, +- unsigned status_flags, char *result, unsigned maxlen) ++ unsigned int status_flags, char *result, unsigned int maxlen) + { + int r; +- unsigned sz = 0; ++ unsigned int sz = 0; + uint64_t transaction_id; + dm_block_t nr_free_blocks_data; + dm_block_t nr_free_blocks_metadata; +@@ -4148,7 +4148,7 @@ static void thin_dtr(struct dm_target *ti) + * If the pool device has discards disabled, they get disabled for the thin + * device as well. + */ +-static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv) ++static int thin_ctr(struct dm_target *ti, unsigned int argc, char **argv) + { + int r; + struct thin_c *tc; +@@ -4371,7 +4371,7 @@ static int thin_preresume(struct dm_target *ti) + * + */ + static void thin_status(struct dm_target *ti, status_type_t type, +- unsigned status_flags, char *result, unsigned maxlen) ++ unsigned int status_flags, char *result, unsigned int maxlen) + { + int r; + ssize_t sz = 0; +diff --git a/drivers/md/dm-uevent.c b/drivers/md/dm-uevent.c +index 86712672..a02b3f6e 100644 +--- a/drivers/md/dm-uevent.c ++++ b/drivers/md/dm-uevent.c +@@ -60,7 +60,7 @@ static struct dm_uevent *dm_build_path_uevent(struct mapped_device *md, + enum kobject_action action, + const char *dm_action, + const char *path, +- unsigned nr_valid_paths) ++ unsigned int nr_valid_paths) + { + struct dm_uevent *event; + +@@ -168,7 +168,7 @@ EXPORT_SYMBOL_GPL(dm_send_uevents); + * + */ + void dm_path_uevent(enum dm_uevent_type event_type, struct dm_target *ti, +- const char *path, unsigned nr_valid_paths) ++ const char *path, unsigned int nr_valid_paths) + { + struct mapped_device *md = dm_table_get_md(ti->table); + struct dm_uevent *event; +diff --git a/drivers/md/dm-uevent.h b/drivers/md/dm-uevent.h +index d30d226f..2c9ba561 100644 +--- a/drivers/md/dm-uevent.h ++++ b/drivers/md/dm-uevent.h +@@ -20,7 +20,7 @@ extern void dm_uevent_exit(void); + extern void dm_send_uevents(struct list_head *events, struct kobject *kobj); + extern void dm_path_uevent(enum dm_uevent_type event_type, + struct dm_target *ti, const char *path, +- unsigned nr_valid_paths); ++ unsigned int nr_valid_paths); + + #else + +@@ -37,7 +37,7 @@ static inline void dm_send_uevents(struct list_head *events, + } + static inline void dm_path_uevent(enum dm_uevent_type event_type, + struct dm_target *ti, const char *path, +- unsigned nr_valid_paths) ++ unsigned int nr_valid_paths) + { + } + +diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c +index 23cffce5..962fc32c 100644 +--- a/drivers/md/dm-verity-fec.c ++++ b/drivers/md/dm-verity-fec.c +@@ -59,14 +59,14 @@ static int fec_decode_rs8(struct dm_verity *v, struct dm_verity_fec_io *fio, + * to the data block. Caller is responsible for releasing buf. + */ + static u8 *fec_read_parity(struct dm_verity *v, u64 rsb, int index, +- unsigned *offset, struct dm_buffer **buf) ++ unsigned int *offset, struct dm_buffer **buf) + { + u64 position, block, rem; + u8 *res; + + position = (index + rsb) * v->fec->roots; + block = div64_u64_rem(position, v->fec->io_size, &rem); +- *offset = (unsigned)rem; ++ *offset = (unsigned int)rem; + + res = dm_bufio_read(v->fec->bufio, block, buf); + if (IS_ERR(res)) { +@@ -102,7 +102,7 @@ static u8 *fec_read_parity(struct dm_verity *v, u64 rsb, int index, + */ + static inline u8 *fec_buffer_rs_block(struct dm_verity *v, + struct dm_verity_fec_io *fio, +- unsigned i, unsigned j) ++ unsigned int i, unsigned int j) + { + return &fio->bufs[i][j * v->fec->rsn]; + } +@@ -111,7 +111,7 @@ static inline u8 *fec_buffer_rs_block(struct dm_verity *v, + * Return an index to the current RS block when called inside + * fec_for_each_buffer_rs_block. + */ +-static inline unsigned fec_buffer_rs_index(unsigned i, unsigned j) ++static inline unsigned int fec_buffer_rs_index(unsigned int i, unsigned int j) + { + return (i << DM_VERITY_FEC_BUF_RS_BITS) + j; + } +@@ -121,12 +121,12 @@ static inline unsigned fec_buffer_rs_index(unsigned i, unsigned j) + * starting from block_offset. + */ + static int fec_decode_bufs(struct dm_verity *v, struct dm_verity_fec_io *fio, +- u64 rsb, int byte_index, unsigned block_offset, ++ u64 rsb, int byte_index, unsigned int block_offset, + int neras) + { + int r, corrected = 0, res; + struct dm_buffer *buf; +- unsigned n, i, offset; ++ unsigned int n, i, offset; + u8 *par, *block; + + par = fec_read_parity(v, rsb, block_offset, &offset, &buf); +@@ -197,7 +197,7 @@ static int fec_is_erasure(struct dm_verity *v, struct dm_verity_io *io, + * fits into buffers. Check for erasure locations if @neras is non-NULL. + */ + static int fec_read_bufs(struct dm_verity *v, struct dm_verity_io *io, +- u64 rsb, u64 target, unsigned block_offset, ++ u64 rsb, u64 target, unsigned int block_offset, + int *neras) + { + bool is_zero; +@@ -208,7 +208,7 @@ static int fec_read_bufs(struct dm_verity *v, struct dm_verity_io *io, + u64 block, ileaved; + u8 *bbuf, *rs_block; + u8 want_digest[HASH_MAX_DIGESTSIZE]; +- unsigned n, k; ++ unsigned int n, k; + + if (neras) + *neras = 0; +@@ -304,7 +304,7 @@ static int fec_read_bufs(struct dm_verity *v, struct dm_verity_io *io, + */ + static int fec_alloc_bufs(struct dm_verity *v, struct dm_verity_fec_io *fio) + { +- unsigned n; ++ unsigned int n; + + if (!fio->rs) + fio->rs = mempool_alloc(&v->fec->rs_pool, GFP_NOIO); +@@ -344,7 +344,7 @@ static int fec_alloc_bufs(struct dm_verity *v, struct dm_verity_fec_io *fio) + */ + static void fec_init_bufs(struct dm_verity *v, struct dm_verity_fec_io *fio) + { +- unsigned n; ++ unsigned int n; + + fec_for_each_buffer(fio, n) + memset(fio->bufs[n], 0, v->fec->rsn << DM_VERITY_FEC_BUF_RS_BITS); +@@ -362,7 +362,7 @@ static int fec_decode_rsb(struct dm_verity *v, struct dm_verity_io *io, + bool use_erasures) + { + int r, neras = 0; +- unsigned pos; ++ unsigned int pos; + + r = fec_alloc_bufs(v, fio); + if (unlikely(r < 0)) +@@ -484,7 +484,7 @@ int verity_fec_decode(struct dm_verity *v, struct dm_verity_io *io, + */ + void verity_fec_finish_io(struct dm_verity_io *io) + { +- unsigned n; ++ unsigned int n; + struct dm_verity_fec *f = io->v->fec; + struct dm_verity_fec_io *fio = fec_io(io); + +@@ -522,8 +522,8 @@ void verity_fec_init_io(struct dm_verity_io *io) + /* + * Append feature arguments and values to the status table. + */ +-unsigned verity_fec_status_table(struct dm_verity *v, unsigned sz, +- char *result, unsigned maxlen) ++unsigned int verity_fec_status_table(struct dm_verity *v, unsigned int sz, ++ char *result, unsigned int maxlen) + { + if (!verity_fec_is_enabled(v)) + return sz; +@@ -589,7 +589,7 @@ bool verity_is_fec_opt_arg(const char *arg_name) + } + + int verity_fec_parse_opt_args(struct dm_arg_set *as, struct dm_verity *v, +- unsigned *argc, const char *arg_name) ++ unsigned int *argc, const char *arg_name) + { + int r; + struct dm_target *ti = v->ti; +diff --git a/drivers/md/dm-verity-fec.h b/drivers/md/dm-verity-fec.h +index 3c46c8d6..8454070d 100644 +--- a/drivers/md/dm-verity-fec.h ++++ b/drivers/md/dm-verity-fec.h +@@ -55,10 +55,10 @@ struct dm_verity_fec_io { + struct rs_control *rs; /* Reed-Solomon state */ + int erasures[DM_VERITY_FEC_MAX_RSN]; /* erasures for decode_rs8 */ + u8 *bufs[DM_VERITY_FEC_BUF_MAX]; /* bufs for deinterleaving */ +- unsigned nbufs; /* number of buffers allocated */ ++ unsigned int nbufs; /* number of buffers allocated */ + u8 *output; /* buffer for corrected output */ + size_t output_pos; +- unsigned level; /* recursion level */ ++ unsigned int level; /* recursion level */ + }; + + #ifdef CONFIG_DM_VERITY_FEC +@@ -72,15 +72,15 @@ extern int verity_fec_decode(struct dm_verity *v, struct dm_verity_io *io, + enum verity_block_type type, sector_t block, + u8 *dest, struct bvec_iter *iter); + +-extern unsigned verity_fec_status_table(struct dm_verity *v, unsigned sz, +- char *result, unsigned maxlen); ++extern unsigned int verity_fec_status_table(struct dm_verity *v, unsigned int sz, ++ char *result, unsigned int maxlen); + + extern void verity_fec_finish_io(struct dm_verity_io *io); + extern void verity_fec_init_io(struct dm_verity_io *io); + + extern bool verity_is_fec_opt_arg(const char *arg_name); + extern int verity_fec_parse_opt_args(struct dm_arg_set *as, +- struct dm_verity *v, unsigned *argc, ++ struct dm_verity *v, unsigned int *argc, + const char *arg_name); + + extern void verity_fec_dtr(struct dm_verity *v); +@@ -106,9 +106,9 @@ static inline int verity_fec_decode(struct dm_verity *v, + return -EOPNOTSUPP; + } + +-static inline unsigned verity_fec_status_table(struct dm_verity *v, +- unsigned sz, char *result, +- unsigned maxlen) ++static inline unsigned int verity_fec_status_table(struct dm_verity *v, ++ unsigned int sz, char *result, ++ unsigned int maxlen) + { + return sz; + } +@@ -128,7 +128,7 @@ static inline bool verity_is_fec_opt_arg(const char *arg_name) + + static inline int verity_fec_parse_opt_args(struct dm_arg_set *as, + struct dm_verity *v, +- unsigned *argc, ++ unsigned int *argc, + const char *arg_name) + { + return -EINVAL; +diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c +index ccf5b852..64e8ac42 100644 +--- a/drivers/md/dm-verity-target.c ++++ b/drivers/md/dm-verity-target.c +@@ -41,7 +41,7 @@ + #define DM_VERITY_OPTS_MAX (4 + DM_VERITY_OPTS_FEC + \ + DM_VERITY_ROOT_HASH_VERIFICATION_OPTS) + +-static unsigned dm_verity_prefetch_cluster = DM_VERITY_DEFAULT_PREFETCH_SIZE; ++static unsigned int dm_verity_prefetch_cluster = DM_VERITY_DEFAULT_PREFETCH_SIZE; + + module_param_named(prefetch_cluster, dm_verity_prefetch_cluster, uint, S_IRUGO | S_IWUSR); + +@@ -51,7 +51,7 @@ struct dm_verity_prefetch_work { + struct work_struct work; + struct dm_verity *v; + sector_t block; +- unsigned n_blocks; ++ unsigned int n_blocks; + }; + + /* +@@ -196,10 +196,10 @@ int verity_hash(struct dm_verity *v, struct ahash_request *req, + } + + static void verity_hash_at_level(struct dm_verity *v, sector_t block, int level, +- sector_t *hash_block, unsigned *offset) ++ sector_t *hash_block, unsigned int *offset) + { + sector_t position = verity_position_at_level(v, block, level); +- unsigned idx; ++ unsigned int idx; + + *hash_block = v->hash_level_block[level] + (position >> v->hash_per_block_bits); + +@@ -287,7 +287,7 @@ static int verity_verify_level(struct dm_verity *v, struct dm_verity_io *io, + u8 *data; + int r; + sector_t hash_block; +- unsigned offset; ++ unsigned int offset; + + verity_hash_at_level(v, block, level, &hash_block, &offset); + +@@ -445,13 +445,13 @@ int verity_for_bv_block(struct dm_verity *v, struct dm_verity_io *io, + struct dm_verity_io *io, u8 *data, + size_t len)) + { +- unsigned todo = 1 << v->data_dev_block_bits; ++ unsigned int todo = 1 << v->data_dev_block_bits; + struct bio *bio = dm_bio_from_per_bio_data(io, v->ti->per_io_data_size); + + do { + int r; + u8 *page; +- unsigned len; ++ unsigned int len; + struct bio_vec bv = bio_iter_iovec(bio, *iter); + + page = bvec_kmap_local(&bv); +@@ -688,7 +688,7 @@ static void verity_prefetch_io(struct work_struct *work) + verity_hash_at_level(v, pw->block, i, &hash_block_start, NULL); + verity_hash_at_level(v, pw->block + pw->n_blocks - 1, i, &hash_block_end, NULL); + if (!i) { +- unsigned cluster = READ_ONCE(dm_verity_prefetch_cluster); ++ unsigned int cluster = READ_ONCE(dm_verity_prefetch_cluster); + + cluster >>= v->data_dev_block_bits; + if (unlikely(!cluster)) +@@ -753,7 +753,7 @@ static int verity_map(struct dm_target *ti, struct bio *bio) + bio_set_dev(bio, v->data_dev->bdev); + bio->bi_iter.bi_sector = verity_map_sector(v, bio->bi_iter.bi_sector); + +- if (((unsigned)bio->bi_iter.bi_sector | bio_sectors(bio)) & ++ if (((unsigned int)bio->bi_iter.bi_sector | bio_sectors(bio)) & + ((1 << (v->data_dev_block_bits - SECTOR_SHIFT)) - 1)) { + DMERR_LIMIT("unaligned io"); + return DM_MAPIO_KILL; +@@ -789,12 +789,12 @@ static int verity_map(struct dm_target *ti, struct bio *bio) + * Status: V (valid) or C (corruption found) + */ + static void verity_status(struct dm_target *ti, status_type_t type, +- unsigned status_flags, char *result, unsigned maxlen) ++ unsigned int status_flags, char *result, unsigned int maxlen) + { + struct dm_verity *v = ti->private; +- unsigned args = 0; +- unsigned sz = 0; +- unsigned x; ++ unsigned int args = 0; ++ unsigned int sz = 0; ++ unsigned int x; + + switch (type) { + case STATUSTYPE_INFO: +@@ -1054,7 +1054,7 @@ static int verity_parse_opt_args(struct dm_arg_set *as, struct dm_verity *v, + bool only_modifier_opts) + { + int r = 0; +- unsigned argc; ++ unsigned int argc; + struct dm_target *ti = v->ti; + const char *arg_name; + +@@ -1156,7 +1156,7 @@ static int verity_parse_opt_args(struct dm_arg_set *as, struct dm_verity *v, + * + * Hex string or "-" if no salt. + */ +-static int verity_ctr(struct dm_target *ti, unsigned argc, char **argv) ++static int verity_ctr(struct dm_target *ti, unsigned int argc, char **argv) + { + struct dm_verity *v; + struct dm_verity_sig_opts verify_args = {0}; +diff --git a/drivers/md/dm-verity.h b/drivers/md/dm-verity.h +index 98f306ec..2f555b42 100644 +--- a/drivers/md/dm-verity.h ++++ b/drivers/md/dm-verity.h +@@ -42,7 +42,7 @@ struct dm_verity { + u8 *root_digest; /* digest of the root block */ + u8 *salt; /* salt: its size is salt_size */ + u8 *zero_digest; /* digest for a zero block */ +- unsigned salt_size; ++ unsigned int salt_size; + sector_t data_start; /* data offset in 512-byte sectors */ + sector_t hash_start; /* hash start in blocks */ + sector_t data_blocks; /* the number of data blocks */ +@@ -54,10 +54,10 @@ struct dm_verity { + unsigned char version; + bool hash_failed:1; /* set if hash of any block failed */ + bool use_tasklet:1; /* try to verify in tasklet before work-queue */ +- unsigned digest_size; /* digest size for the current hash algorithm */ ++ unsigned int digest_size; /* digest size for the current hash algorithm */ + unsigned int ahash_reqsize;/* the size of temporary space for crypto */ + enum verity_mode mode; /* mode for handling verification errors */ +- unsigned corrupted_errs;/* Number of errors for corrupted blocks */ ++ unsigned int corrupted_errs;/* Number of errors for corrupted blocks */ + + struct workqueue_struct *verify_wq; + +@@ -77,7 +77,7 @@ struct dm_verity_io { + bio_end_io_t *orig_bi_end_io; + + sector_t block; +- unsigned n_blocks; ++ unsigned int n_blocks; + bool in_tasklet; + + struct bvec_iter iter; +diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c +index 96a003eb..431c8459 100644 +--- a/drivers/md/dm-writecache.c ++++ b/drivers/md/dm-writecache.c +@@ -128,9 +128,9 @@ struct dm_writecache { + unsigned long max_age; + unsigned long pause; + +- unsigned uncommitted_blocks; +- unsigned autocommit_blocks; +- unsigned max_writeback_jobs; ++ unsigned int uncommitted_blocks; ++ unsigned int autocommit_blocks; ++ unsigned int max_writeback_jobs; + + int error; + +@@ -155,7 +155,7 @@ struct dm_writecache { + sector_t data_device_sectors; + void *block_start; + struct wc_entry *entries; +- unsigned block_size; ++ unsigned int block_size; + unsigned char block_size_bits; + + bool pmem_mode:1; +@@ -178,13 +178,13 @@ struct dm_writecache { + bool metadata_only:1; + bool pause_set:1; + +- unsigned high_wm_percent_value; +- unsigned low_wm_percent_value; +- unsigned autocommit_time_value; +- unsigned max_age_value; +- unsigned pause_value; ++ unsigned int high_wm_percent_value; ++ unsigned int low_wm_percent_value; ++ unsigned int autocommit_time_value; ++ unsigned int max_age_value; ++ unsigned int pause_value; + +- unsigned writeback_all; ++ unsigned int writeback_all; + struct workqueue_struct *writeback_wq; + struct work_struct writeback_work; + struct work_struct flush_work; +@@ -202,7 +202,7 @@ struct dm_writecache { + + struct dm_kcopyd_client *dm_kcopyd; + unsigned long *dirty_bitmap; +- unsigned dirty_bitmap_size; ++ unsigned int dirty_bitmap_size; + + struct bio_set bio_set; + mempool_t copy_pool; +@@ -227,7 +227,7 @@ struct writeback_struct { + struct list_head endio_entry; + struct dm_writecache *wc; + struct wc_entry **wc_list; +- unsigned wc_list_n; ++ unsigned int wc_list_n; + struct wc_entry *wc_list_inline[WB_LIST_INLINE]; + struct bio bio; + }; +@@ -236,7 +236,7 @@ struct copy_struct { + struct list_head endio_entry; + struct dm_writecache *wc; + struct wc_entry *e; +- unsigned n_entries; ++ unsigned int n_entries; + int error; + }; + +@@ -369,7 +369,7 @@ static struct page *persistent_memory_page(void *addr) + return virt_to_page(addr); + } + +-static unsigned persistent_memory_page_offset(void *addr) ++static unsigned int persistent_memory_page_offset(void *addr) + { + return (unsigned long)addr & (PAGE_SIZE - 1); + } +@@ -502,11 +502,11 @@ static void ssd_commit_flushed(struct dm_writecache *wc, bool wait_for_ios) + COMPLETION_INITIALIZER_ONSTACK(endio.c), + ATOMIC_INIT(1), + }; +- unsigned bitmap_bits = wc->dirty_bitmap_size * 8; +- unsigned i = 0; ++ unsigned int bitmap_bits = wc->dirty_bitmap_size * 8; ++ unsigned int i = 0; + + while (1) { +- unsigned j; ++ unsigned int j; + i = find_next_bit(wc->dirty_bitmap, bitmap_bits, i); + if (unlikely(i == bitmap_bits)) + break; +@@ -1100,7 +1100,7 @@ static void writecache_resume(struct dm_target *ti) + wc_unlock(wc); + } + +-static int process_flush_mesg(unsigned argc, char **argv, struct dm_writecache *wc) ++static int process_flush_mesg(unsigned int argc, char **argv, struct dm_writecache *wc) + { + if (argc != 1) + return -EINVAL; +@@ -1133,7 +1133,7 @@ static int process_flush_mesg(unsigned argc, char **argv, struct dm_writecache * + return 0; + } + +-static int process_flush_on_suspend_mesg(unsigned argc, char **argv, struct dm_writecache *wc) ++static int process_flush_on_suspend_mesg(unsigned int argc, char **argv, struct dm_writecache *wc) + { + if (argc != 1) + return -EINVAL; +@@ -1153,7 +1153,7 @@ static void activate_cleaner(struct dm_writecache *wc) + wc->freelist_low_watermark = wc->n_blocks; + } + +-static int process_cleaner_mesg(unsigned argc, char **argv, struct dm_writecache *wc) ++static int process_cleaner_mesg(unsigned int argc, char **argv, struct dm_writecache *wc) + { + if (argc != 1) + return -EINVAL; +@@ -1167,7 +1167,7 @@ static int process_cleaner_mesg(unsigned argc, char **argv, struct dm_writecache + return 0; + } + +-static int process_clear_stats_mesg(unsigned argc, char **argv, struct dm_writecache *wc) ++static int process_clear_stats_mesg(unsigned int argc, char **argv, struct dm_writecache *wc) + { + if (argc != 1) + return -EINVAL; +@@ -1179,8 +1179,8 @@ static int process_clear_stats_mesg(unsigned argc, char **argv, struct dm_writec + return 0; + } + +-static int writecache_message(struct dm_target *ti, unsigned argc, char **argv, +- char *result, unsigned maxlen) ++static int writecache_message(struct dm_target *ti, unsigned int argc, char **argv, ++ char *result, unsigned int maxlen) + { + int r = -EINVAL; + struct dm_writecache *wc = ti->private; +@@ -1238,9 +1238,9 @@ static void memcpy_flushcache_optimized(void *dest, void *source, size_t size) + static void bio_copy_block(struct dm_writecache *wc, struct bio *bio, void *data) + { + void *buf; +- unsigned size; ++ unsigned int size; + int rw = bio_data_dir(bio); +- unsigned remaining_size = wc->block_size; ++ unsigned int remaining_size = wc->block_size; + + do { + struct bio_vec bv = bio_iter_iovec(bio, bio->bi_iter); +@@ -1371,7 +1371,7 @@ static enum wc_map_op writecache_map_read(struct dm_writecache *wc, struct bio * + static void writecache_bio_copy_ssd(struct dm_writecache *wc, struct bio *bio, + struct wc_entry *e, bool search_used) + { +- unsigned bio_size = wc->block_size; ++ unsigned int bio_size = wc->block_size; + sector_t start_cache_sec = cache_sector(wc, e); + sector_t current_cache_sec = start_cache_sec + (bio_size >> SECTOR_SHIFT); + +@@ -1540,7 +1540,7 @@ static int writecache_map(struct dm_target *ti, struct bio *bio) + + bio->bi_iter.bi_sector = dm_target_offset(ti, bio->bi_iter.bi_sector); + +- if (unlikely((((unsigned)bio->bi_iter.bi_sector | bio_sectors(bio)) & ++ if (unlikely((((unsigned int)bio->bi_iter.bi_sector | bio_sectors(bio)) & + (wc->block_size / 512 - 1)) != 0)) { + DMERR("I/O is not aligned, sector %llu, size %u, block size %u", + (unsigned long long)bio->bi_iter.bi_sector, +@@ -1666,7 +1666,7 @@ static void writecache_copy_endio(int read_err, unsigned long write_err, void *p + + static void __writecache_endio_pmem(struct dm_writecache *wc, struct list_head *list) + { +- unsigned i; ++ unsigned int i; + struct writeback_struct *wb; + struct wc_entry *e; + unsigned long n_walked = 0; +@@ -1782,7 +1782,7 @@ static int writecache_endio_thread(void *data) + static bool wc_add_block(struct writeback_struct *wb, struct wc_entry *e) + { + struct dm_writecache *wc = wb->wc; +- unsigned block_size = wc->block_size; ++ unsigned int block_size = wc->block_size; + void *address = memory_data(wc, e); + + persistent_memory_flush_cache(address, block_size); +@@ -1817,7 +1817,7 @@ static void __writecache_writeback_pmem(struct dm_writecache *wc, struct writeba + struct wc_entry *e, *f; + struct bio *bio; + struct writeback_struct *wb; +- unsigned max_pages; ++ unsigned int max_pages; + + while (wbl->size) { + wbl->size--; +@@ -1880,7 +1880,7 @@ static void __writecache_writeback_ssd(struct dm_writecache *wc, struct writebac + struct copy_struct *c; + + while (wbl->size) { +- unsigned n_sectors; ++ unsigned int n_sectors; + + wbl->size--; + e = container_of(wbl->list.prev, struct wc_entry, lru); +@@ -2092,7 +2092,7 @@ static void writecache_writeback(struct work_struct *work) + } + } + +-static int calculate_memory_size(uint64_t device_size, unsigned block_size, ++static int calculate_memory_size(uint64_t device_size, unsigned int block_size, + size_t *n_blocks_p, size_t *n_metadata_blocks_p) + { + uint64_t n_blocks, offset; +@@ -2207,12 +2207,12 @@ static void writecache_dtr(struct dm_target *ti) + kfree(wc); + } + +-static int writecache_ctr(struct dm_target *ti, unsigned argc, char **argv) ++static int writecache_ctr(struct dm_target *ti, unsigned int argc, char **argv) + { + struct dm_writecache *wc; + struct dm_arg_set as; + const char *string; +- unsigned opt_params; ++ unsigned int opt_params; + size_t offset, data_size; + int i, r; + char dummy; +@@ -2419,7 +2419,7 @@ static int writecache_ctr(struct dm_target *ti, unsigned argc, char **argv) + goto invalid_optional; + wc->autocommit_blocks_set = true; + } else if (!strcasecmp(string, "autocommit_time") && opt_params >= 1) { +- unsigned autocommit_msecs; ++ unsigned int autocommit_msecs; + string = dm_shift_arg(&as), opt_params--; + if (sscanf(string, "%u%c", &autocommit_msecs, &dummy) != 1) + goto invalid_optional; +@@ -2429,7 +2429,7 @@ static int writecache_ctr(struct dm_target *ti, unsigned argc, char **argv) + wc->autocommit_time_value = autocommit_msecs; + wc->autocommit_time_set = true; + } else if (!strcasecmp(string, "max_age") && opt_params >= 1) { +- unsigned max_age_msecs; ++ unsigned int max_age_msecs; + string = dm_shift_arg(&as), opt_params--; + if (sscanf(string, "%u%c", &max_age_msecs, &dummy) != 1) + goto invalid_optional; +@@ -2454,7 +2454,7 @@ static int writecache_ctr(struct dm_target *ti, unsigned argc, char **argv) + } else if (!strcasecmp(string, "metadata_only")) { + wc->metadata_only = true; + } else if (!strcasecmp(string, "pause_writeback") && opt_params >= 1) { +- unsigned pause_msecs; ++ unsigned int pause_msecs; + if (WC_MODE_PMEM(wc)) + goto invalid_optional; + string = dm_shift_arg(&as), opt_params--; +@@ -2653,11 +2653,11 @@ static int writecache_ctr(struct dm_target *ti, unsigned argc, char **argv) + } + + static void writecache_status(struct dm_target *ti, status_type_t type, +- unsigned status_flags, char *result, unsigned maxlen) ++ unsigned int status_flags, char *result, unsigned int maxlen) + { + struct dm_writecache *wc = ti->private; +- unsigned extra_args; +- unsigned sz = 0; ++ unsigned int extra_args; ++ unsigned int sz = 0; + + switch (type) { + case STATUSTYPE_INFO: +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 1b6c3c78..94e4899d 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -83,7 +83,7 @@ struct clone_info { + struct bio *bio; + struct dm_io *io; + sector_t sector; +- unsigned sector_count; ++ unsigned int sector_count; + bool is_abnormal_io:1; + bool submit_as_polled:1; + }; +@@ -111,7 +111,7 @@ struct bio *dm_bio_from_per_bio_data(void *data, size_t data_size) + } + EXPORT_SYMBOL_GPL(dm_bio_from_per_bio_data); + +-unsigned dm_bio_get_target_bio_nr(const struct bio *bio) ++unsigned int dm_bio_get_target_bio_nr(const struct bio *bio) + { + return container_of(bio, struct dm_target_io, clone)->target_bio_nr; + } +@@ -142,7 +142,7 @@ struct table_device { + * Bio-based DM's mempools' reserved IOs set by the user. + */ + #define RESERVED_BIO_BASED_IOS 16 +-static unsigned reserved_bio_based_ios = RESERVED_BIO_BASED_IOS; ++static unsigned int reserved_bio_based_ios = RESERVED_BIO_BASED_IOS; + + static int __dm_get_module_param_int(int *module_param, int min, int max) + { +@@ -165,11 +165,10 @@ static int __dm_get_module_param_int(int *module_param, int min, int max) + return param; + } + +-unsigned __dm_get_module_param(unsigned *module_param, +- unsigned def, unsigned max) ++unsigned int __dm_get_module_param(unsigned int *module_param, unsigned int def, unsigned int max) + { +- unsigned param = READ_ONCE(*module_param); +- unsigned modified_param = 0; ++ unsigned int param = READ_ONCE(*module_param); ++ unsigned int modified_param = 0; + + if (!param) + modified_param = def; +@@ -184,14 +183,14 @@ unsigned __dm_get_module_param(unsigned *module_param, + return param; + } + +-unsigned dm_get_reserved_bio_based_ios(void) ++unsigned int dm_get_reserved_bio_based_ios(void) + { + return __dm_get_module_param(&reserved_bio_based_ios, + RESERVED_BIO_BASED_IOS, DM_RESERVED_MAX_IOS); + } + EXPORT_SYMBOL_GPL(dm_get_reserved_bio_based_ios); + +-static unsigned dm_get_numa_node(void) ++static unsigned int dm_get_numa_node(void) + { + return __dm_get_module_param_int(&dm_numa_node, + DM_NUMA_NODE, num_online_nodes() - 1); +@@ -603,7 +602,7 @@ static void free_io(struct dm_io *io) + } + + static struct bio *alloc_tio(struct clone_info *ci, struct dm_target *ti, +- unsigned target_bio_nr, unsigned *len, gfp_t gfp_mask) ++ unsigned int target_bio_nr, unsigned int *len, gfp_t gfp_mask) + { + struct mapped_device *md = ci->io->md; + struct dm_target_io *tio; +@@ -1314,11 +1313,11 @@ static size_t dm_dax_recovery_write(struct dax_device *dax_dev, pgoff_t pgoff, + * the partially processed part (the sum of regions 1+2) must be the same for all + * copies of the bio. + */ +-void dm_accept_partial_bio(struct bio *bio, unsigned n_sectors) ++void dm_accept_partial_bio(struct bio *bio, unsigned int n_sectors) + { + struct dm_target_io *tio = clone_to_tio(bio); + struct dm_io *io = tio->io; +- unsigned bio_sectors = bio_sectors(bio); ++ unsigned int bio_sectors = bio_sectors(bio); + + BUG_ON(dm_tio_flagged(tio, DM_TIO_IS_DUPLICATE_BIO)); + BUG_ON(op_is_zone_mgmt(bio_op(bio))); +@@ -1447,7 +1446,7 @@ static void __map_bio(struct bio *clone) + } + } + +-static void setup_split_accounting(struct clone_info *ci, unsigned len) ++static void setup_split_accounting(struct clone_info *ci, unsigned int len) + { + struct dm_io *io = ci->io; + +@@ -1463,7 +1462,7 @@ static void setup_split_accounting(struct clone_info *ci, unsigned len) + } + + static void alloc_multiple_bios(struct bio_list *blist, struct clone_info *ci, +- struct dm_target *ti, unsigned num_bios) ++ struct dm_target *ti, unsigned int num_bios) + { + struct bio *bio; + int try; +@@ -1492,7 +1491,7 @@ static void alloc_multiple_bios(struct bio_list *blist, struct clone_info *ci, + } + + static int __send_duplicate_bios(struct clone_info *ci, struct dm_target *ti, +- unsigned int num_bios, unsigned *len) ++ unsigned int num_bios, unsigned int *len) + { + struct bio_list blist = BIO_EMPTY_LIST; + struct bio *clone; +@@ -1560,10 +1559,9 @@ static void __send_empty_flush(struct clone_info *ci) + } + + static void __send_changing_extent_only(struct clone_info *ci, struct dm_target *ti, +- unsigned num_bios) ++ unsigned int num_bios) + { +- unsigned len; +- unsigned int bios; ++ unsigned int len, bios; + + len = min_t(sector_t, ci->sector_count, + max_io_len_target_boundary(ti, dm_target_offset(ti, ci->sector))); +@@ -1601,7 +1599,7 @@ static bool is_abnormal_io(struct bio *bio) + static blk_status_t __process_abnormal_io(struct clone_info *ci, + struct dm_target *ti) + { +- unsigned num_bios = 0; ++ unsigned int num_bios = 0; + + switch (bio_op(ci->bio)) { + case REQ_OP_DISCARD: +@@ -1679,7 +1677,7 @@ static blk_status_t __split_and_process_bio(struct clone_info *ci) + { + struct bio *clone; + struct dm_target *ti; +- unsigned len; ++ unsigned int len; + + ti = dm_table_find_target(ci->map, ci->sector); + if (unlikely(!ti)) +@@ -2376,7 +2374,7 @@ int dm_setup_md_queue(struct mapped_device *md, struct dm_table *t) + struct mapped_device *dm_get_md(dev_t dev) + { + struct mapped_device *md; +- unsigned minor = MINOR(dev); ++ unsigned int minor = MINOR(dev); + + if (MAJOR(dev) != _major || minor >= (1 << MINORBITS)) + return NULL; +@@ -2659,7 +2657,7 @@ static void unlock_fs(struct mapped_device *md) + * are being added to md->deferred list. + */ + static int __dm_suspend(struct mapped_device *md, struct dm_table *map, +- unsigned suspend_flags, unsigned int task_state, ++ unsigned int suspend_flags, unsigned int task_state, + int dmf_suspended_flag) + { + bool do_lockfs = suspend_flags & DM_SUSPEND_LOCKFS_FLAG; +@@ -2766,7 +2764,7 @@ static int __dm_suspend(struct mapped_device *md, struct dm_table *map, + * + * To abort suspend, start the request_queue. + */ +-int dm_suspend(struct mapped_device *md, unsigned suspend_flags) ++int dm_suspend(struct mapped_device *md, unsigned int suspend_flags) + { + struct dm_table *map = NULL; + int r = 0; +@@ -2868,7 +2866,7 @@ int dm_resume(struct mapped_device *md) + * It may be used only from the kernel. + */ + +-static void __dm_internal_suspend(struct mapped_device *md, unsigned suspend_flags) ++static void __dm_internal_suspend(struct mapped_device *md, unsigned int suspend_flags) + { + struct dm_table *map = NULL; + +@@ -2970,10 +2968,10 @@ EXPORT_SYMBOL_GPL(dm_internal_resume_fast); + * Event notification. + *---------------------------------------------------------------*/ + int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action, +- unsigned cookie, bool need_resize_uevent) ++ unsigned int cookie, bool need_resize_uevent) + { + int r; +- unsigned noio_flag; ++ unsigned int noio_flag; + char udev_cookie[DM_COOKIE_LENGTH]; + char *envp[3] = { NULL, NULL, NULL }; + char **envpp = envp; +diff --git a/drivers/md/dm.h b/drivers/md/dm.h +index a9a3ffca..a7917df0 100644 +--- a/drivers/md/dm.h ++++ b/drivers/md/dm.h +@@ -203,7 +203,7 @@ int dm_get_table_device(struct mapped_device *md, dev_t dev, fmode_t mode, + void dm_put_table_device(struct mapped_device *md, struct dm_dev *d); + + int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action, +- unsigned cookie, bool need_resize_uevent); ++ unsigned int cookie, bool need_resize_uevent); + + void dm_internal_suspend(struct mapped_device *md); + void dm_internal_resume(struct mapped_device *md); +@@ -222,6 +222,6 @@ void dm_free_md_mempools(struct dm_md_mempools *pools); + /* + * Various helpers + */ +-unsigned dm_get_reserved_bio_based_ios(void); ++unsigned int dm_get_reserved_bio_based_ios(void); + + #endif +diff --git a/drivers/md/persistent-data/dm-array.c b/drivers/md/persistent-data/dm-array.c +index 3a963d78..eff9b418 100644 +--- a/drivers/md/persistent-data/dm-array.c ++++ b/drivers/md/persistent-data/dm-array.c +@@ -68,8 +68,8 @@ static int array_block_check(struct dm_block_validator *v, + CSUM_XOR)); + if (csum_disk != bh_le->csum) { + DMERR_LIMIT("array_block_check failed: csum %u != wanted %u", +- (unsigned) le32_to_cpu(csum_disk), +- (unsigned) le32_to_cpu(bh_le->csum)); ++ (unsigned int) le32_to_cpu(csum_disk), ++ (unsigned int) le32_to_cpu(bh_le->csum)); + return -EILSEQ; + } + +@@ -94,7 +94,7 @@ static struct dm_block_validator array_validator = { + * index - The index into _this_ specific block. + */ + static void *element_at(struct dm_array_info *info, struct array_block *ab, +- unsigned index) ++ unsigned int index) + { + unsigned char *entry = (unsigned char *) (ab + 1); + +@@ -108,9 +108,9 @@ static void *element_at(struct dm_array_info *info, struct array_block *ab, + * in an array block. + */ + static void on_entries(struct dm_array_info *info, struct array_block *ab, +- void (*fn)(void *, const void *, unsigned)) ++ void (*fn)(void *, const void *, unsigned int)) + { +- unsigned nr_entries = le32_to_cpu(ab->nr_entries); ++ unsigned int nr_entries = le32_to_cpu(ab->nr_entries); + fn(info->value_type.context, element_at(info, ab, 0), nr_entries); + } + +@@ -171,7 +171,7 @@ static int alloc_ablock(struct dm_array_info *info, size_t size_of_block, + * the current number of entries. + */ + static void fill_ablock(struct dm_array_info *info, struct array_block *ab, +- const void *value, unsigned new_nr) ++ const void *value, unsigned int new_nr) + { + uint32_t nr_entries, delta, i; + struct dm_btree_value_type *vt = &info->value_type; +@@ -194,7 +194,7 @@ static void fill_ablock(struct dm_array_info *info, struct array_block *ab, + * entries. + */ + static void trim_ablock(struct dm_array_info *info, struct array_block *ab, +- unsigned new_nr) ++ unsigned int new_nr) + { + uint32_t nr_entries, delta; + struct dm_btree_value_type *vt = &info->value_type; +@@ -247,7 +247,7 @@ static void unlock_ablock(struct dm_array_info *info, struct dm_block *block) + * / max_entries). + */ + static int lookup_ablock(struct dm_array_info *info, dm_block_t root, +- unsigned index, struct dm_block **block, ++ unsigned int index, struct dm_block **block, + struct array_block **ab) + { + int r; +@@ -295,7 +295,7 @@ static int __shadow_ablock(struct dm_array_info *info, dm_block_t b, + * The shadow op will often be a noop. Only insert if it really + * copied data. + */ +-static int __reinsert_ablock(struct dm_array_info *info, unsigned index, ++static int __reinsert_ablock(struct dm_array_info *info, unsigned int index, + struct dm_block *block, dm_block_t b, + dm_block_t *root) + { +@@ -321,7 +321,7 @@ static int __reinsert_ablock(struct dm_array_info *info, unsigned index, + * for both the current root block, and the new one. + */ + static int shadow_ablock(struct dm_array_info *info, dm_block_t *root, +- unsigned index, struct dm_block **block, ++ unsigned int index, struct dm_block **block, + struct array_block **ab) + { + int r; +@@ -346,7 +346,7 @@ static int shadow_ablock(struct dm_array_info *info, dm_block_t *root, + */ + static int insert_new_ablock(struct dm_array_info *info, size_t size_of_block, + uint32_t max_entries, +- unsigned block_index, uint32_t nr, ++ unsigned int block_index, uint32_t nr, + const void *value, dm_block_t *root) + { + int r; +@@ -365,8 +365,8 @@ static int insert_new_ablock(struct dm_array_info *info, size_t size_of_block, + } + + static int insert_full_ablocks(struct dm_array_info *info, size_t size_of_block, +- unsigned begin_block, unsigned end_block, +- unsigned max_entries, const void *value, ++ unsigned int begin_block, unsigned int end_block, ++ unsigned int max_entries, const void *value, + dm_block_t *root) + { + int r = 0; +@@ -402,20 +402,20 @@ struct resize { + /* + * Maximum nr entries in an array block. + */ +- unsigned max_entries; ++ unsigned int max_entries; + + /* + * nr of completely full blocks in the array. + * + * 'old' refers to before the resize, 'new' after. + */ +- unsigned old_nr_full_blocks, new_nr_full_blocks; ++ unsigned int old_nr_full_blocks, new_nr_full_blocks; + + /* + * Number of entries in the final block. 0 iff only full blocks in + * the array. + */ +- unsigned old_nr_entries_in_last_block, new_nr_entries_in_last_block; ++ unsigned int old_nr_entries_in_last_block, new_nr_entries_in_last_block; + + /* + * The default value used when growing the array. +@@ -430,8 +430,8 @@ struct resize { + * begin_index - the index of the first array block to remove. + * end_index - the one-past-the-end value. ie. this block is not removed. + */ +-static int drop_blocks(struct resize *resize, unsigned begin_index, +- unsigned end_index) ++static int drop_blocks(struct resize *resize, unsigned int begin_index, ++ unsigned int end_index) + { + int r; + +@@ -449,8 +449,8 @@ static int drop_blocks(struct resize *resize, unsigned begin_index, + /* + * Calculates how many blocks are needed for the array. + */ +-static unsigned total_nr_blocks_needed(unsigned nr_full_blocks, +- unsigned nr_entries_in_last_block) ++static unsigned int total_nr_blocks_needed(unsigned int nr_full_blocks, ++ unsigned int nr_entries_in_last_block) + { + return nr_full_blocks + (nr_entries_in_last_block ? 1 : 0); + } +@@ -461,7 +461,7 @@ static unsigned total_nr_blocks_needed(unsigned nr_full_blocks, + static int shrink(struct resize *resize) + { + int r; +- unsigned begin, end; ++ unsigned int begin, end; + struct dm_block *block; + struct array_block *ab; + +@@ -527,7 +527,7 @@ static int grow_add_tail_block(struct resize *resize) + static int grow_needs_more_blocks(struct resize *resize) + { + int r; +- unsigned old_nr_blocks = resize->old_nr_full_blocks; ++ unsigned int old_nr_blocks = resize->old_nr_full_blocks; + + if (resize->old_nr_entries_in_last_block > 0) { + old_nr_blocks++; +@@ -569,11 +569,11 @@ static int grow(struct resize *resize) + * These are the value_type functions for the btree elements, which point + * to array blocks. + */ +-static void block_inc(void *context, const void *value, unsigned count) ++static void block_inc(void *context, const void *value, unsigned int count) + { + const __le64 *block_le = value; + struct dm_array_info *info = context; +- unsigned i; ++ unsigned int i; + + for (i = 0; i < count; i++, block_le++) + dm_tm_inc(info->btree_info.tm, le64_to_cpu(*block_le)); +@@ -618,9 +618,9 @@ static void __block_dec(void *context, const void *value) + dm_tm_dec(info->btree_info.tm, b); + } + +-static void block_dec(void *context, const void *value, unsigned count) ++static void block_dec(void *context, const void *value, unsigned int count) + { +- unsigned i; ++ unsigned int i; + for (i = 0; i < count; i++, value += sizeof(__le64)) + __block_dec(context, value); + } +@@ -700,10 +700,11 @@ int dm_array_resize(struct dm_array_info *info, dm_block_t root, + EXPORT_SYMBOL_GPL(dm_array_resize); + + static int populate_ablock_with_values(struct dm_array_info *info, struct array_block *ab, +- value_fn fn, void *context, unsigned base, unsigned new_nr) ++ value_fn fn, void *context, ++ unsigned int base, unsigned int new_nr) + { + int r; +- unsigned i; ++ unsigned int i; + struct dm_btree_value_type *vt = &info->value_type; + + BUG_ON(le32_to_cpu(ab->nr_entries)); +@@ -728,7 +729,7 @@ int dm_array_new(struct dm_array_info *info, dm_block_t *root, + int r; + struct dm_block *block; + struct array_block *ab; +- unsigned block_index, end_block, size_of_block, max_entries; ++ unsigned int block_index, end_block, size_of_block, max_entries; + + r = dm_array_empty(info, root); + if (r) +@@ -776,7 +777,7 @@ int dm_array_get_value(struct dm_array_info *info, dm_block_t root, + struct dm_block *block; + struct array_block *ab; + size_t size_of_block; +- unsigned entry, max_entries; ++ unsigned int entry, max_entries; + + size_of_block = dm_bm_block_size(dm_tm_get_bm(info->btree_info.tm)); + max_entries = calc_max_entries(info->value_type.size, size_of_block); +@@ -804,8 +805,8 @@ static int array_set_value(struct dm_array_info *info, dm_block_t root, + struct dm_block *block; + struct array_block *ab; + size_t size_of_block; +- unsigned max_entries; +- unsigned entry; ++ unsigned int max_entries; ++ unsigned int entry; + void *old_value; + struct dm_btree_value_type *vt = &info->value_type; + +@@ -861,9 +862,9 @@ static int walk_ablock(void *context, uint64_t *keys, void *leaf) + struct walk_info *wi = context; + + int r; +- unsigned i; ++ unsigned int i; + __le64 block_le; +- unsigned nr_entries, max_entries; ++ unsigned int nr_entries, max_entries; + struct dm_block *block; + struct array_block *ab; + +diff --git a/drivers/md/persistent-data/dm-array.h b/drivers/md/persistent-data/dm-array.h +index d7d2d579..b6c7077c 100644 +--- a/drivers/md/persistent-data/dm-array.h ++++ b/drivers/md/persistent-data/dm-array.h +@@ -198,7 +198,7 @@ struct dm_array_cursor { + + struct dm_block *block; + struct array_block *ab; +- unsigned index; ++ unsigned int index; + }; + + int dm_array_cursor_begin(struct dm_array_info *info, +diff --git a/drivers/md/persistent-data/dm-bitset.c b/drivers/md/persistent-data/dm-bitset.c +index b7208d82..625d9349 100644 +--- a/drivers/md/persistent-data/dm-bitset.c ++++ b/drivers/md/persistent-data/dm-bitset.c +@@ -41,7 +41,7 @@ EXPORT_SYMBOL_GPL(dm_bitset_empty); + + struct packer_context { + bit_value_fn fn; +- unsigned nr_bits; ++ unsigned int nr_bits; + void *context; + }; + +@@ -49,7 +49,7 @@ static int pack_bits(uint32_t index, void *value, void *context) + { + int r; + struct packer_context *p = context; +- unsigned bit, nr = min(64u, p->nr_bits - (index * 64)); ++ unsigned int bit, nr = min(64u, p->nr_bits - (index * 64)); + uint64_t word = 0; + bool bv; + +@@ -147,7 +147,7 @@ static int get_array_entry(struct dm_disk_bitset *info, dm_block_t root, + uint32_t index, dm_block_t *new_root) + { + int r; +- unsigned array_index = index / BITS_PER_ARRAY_ENTRY; ++ unsigned int array_index = index / BITS_PER_ARRAY_ENTRY; + + if (info->current_index_set) { + if (info->current_index == array_index) +@@ -165,7 +165,7 @@ int dm_bitset_set_bit(struct dm_disk_bitset *info, dm_block_t root, + uint32_t index, dm_block_t *new_root) + { + int r; +- unsigned b = index % BITS_PER_ARRAY_ENTRY; ++ unsigned int b = index % BITS_PER_ARRAY_ENTRY; + + r = get_array_entry(info, root, index, new_root); + if (r) +@@ -182,7 +182,7 @@ int dm_bitset_clear_bit(struct dm_disk_bitset *info, dm_block_t root, + uint32_t index, dm_block_t *new_root) + { + int r; +- unsigned b = index % BITS_PER_ARRAY_ENTRY; ++ unsigned int b = index % BITS_PER_ARRAY_ENTRY; + + r = get_array_entry(info, root, index, new_root); + if (r) +@@ -199,7 +199,7 @@ int dm_bitset_test_bit(struct dm_disk_bitset *info, dm_block_t root, + uint32_t index, dm_block_t *new_root, bool *result) + { + int r; +- unsigned b = index % BITS_PER_ARRAY_ENTRY; ++ unsigned int b = index % BITS_PER_ARRAY_ENTRY; + + r = get_array_entry(info, root, index, new_root); + if (r) +diff --git a/drivers/md/persistent-data/dm-block-manager.c b/drivers/md/persistent-data/dm-block-manager.c +index 11935864..1f401009 100644 +--- a/drivers/md/persistent-data/dm-block-manager.c ++++ b/drivers/md/persistent-data/dm-block-manager.c +@@ -57,10 +57,10 @@ struct waiter { + int wants_write; + }; + +-static unsigned __find_holder(struct block_lock *lock, ++static unsigned int __find_holder(struct block_lock *lock, + struct task_struct *task) + { +- unsigned i; ++ unsigned int i; + + for (i = 0; i < MAX_HOLDERS; i++) + if (lock->holders[i] == task) +@@ -73,7 +73,7 @@ static unsigned __find_holder(struct block_lock *lock, + /* call this *after* you increment lock->count */ + static void __add_holder(struct block_lock *lock, struct task_struct *task) + { +- unsigned h = __find_holder(lock, NULL); ++ unsigned int h = __find_holder(lock, NULL); + #ifdef CONFIG_DM_DEBUG_BLOCK_STACK_TRACING + struct stack_store *t; + #endif +@@ -90,14 +90,14 @@ static void __add_holder(struct block_lock *lock, struct task_struct *task) + /* call this *before* you decrement lock->count */ + static void __del_holder(struct block_lock *lock, struct task_struct *task) + { +- unsigned h = __find_holder(lock, task); ++ unsigned int h = __find_holder(lock, task); + lock->holders[h] = NULL; + put_task_struct(task); + } + + static int __check_holder(struct block_lock *lock) + { +- unsigned i; ++ unsigned int i; + + for (i = 0; i < MAX_HOLDERS; i++) { + if (lock->holders[i] == current) { +@@ -376,8 +376,8 @@ struct dm_block_manager { + }; + + struct dm_block_manager *dm_block_manager_create(struct block_device *bdev, +- unsigned block_size, +- unsigned max_held_per_thread) ++ unsigned int block_size, ++ unsigned int max_held_per_thread) + { + int r; + struct dm_block_manager *bm; +@@ -415,7 +415,7 @@ void dm_block_manager_destroy(struct dm_block_manager *bm) + } + EXPORT_SYMBOL_GPL(dm_block_manager_destroy); + +-unsigned dm_bm_block_size(struct dm_block_manager *bm) ++unsigned int dm_bm_block_size(struct dm_block_manager *bm) + { + return dm_bufio_get_block_size(bm->bufio); + } +diff --git a/drivers/md/persistent-data/dm-block-manager.h b/drivers/md/persistent-data/dm-block-manager.h +index e728937f..58a23b8e 100644 +--- a/drivers/md/persistent-data/dm-block-manager.h ++++ b/drivers/md/persistent-data/dm-block-manager.h +@@ -32,11 +32,11 @@ void *dm_block_data(struct dm_block *b); + */ + struct dm_block_manager; + struct dm_block_manager *dm_block_manager_create( +- struct block_device *bdev, unsigned block_size, +- unsigned max_held_per_thread); ++ struct block_device *bdev, unsigned int block_size, ++ unsigned int max_held_per_thread); + void dm_block_manager_destroy(struct dm_block_manager *bm); + +-unsigned dm_bm_block_size(struct dm_block_manager *bm); ++unsigned int dm_bm_block_size(struct dm_block_manager *bm); + dm_block_t dm_bm_nr_blocks(struct dm_block_manager *bm); + + /*----------------------------------------------------------------*/ +diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c +index 4ead31e0..ac213138 100644 +--- a/drivers/md/persistent-data/dm-btree-remove.c ++++ b/drivers/md/persistent-data/dm-btree-remove.c +@@ -124,10 +124,10 @@ static int node_copy(struct btree_node *left, struct btree_node *right, int shif + /* + * Delete a specific entry from a leaf node. + */ +-static void delete_at(struct btree_node *n, unsigned index) ++static void delete_at(struct btree_node *n, unsigned int index) + { +- unsigned nr_entries = le32_to_cpu(n->header.nr_entries); +- unsigned nr_to_copy = nr_entries - (index + 1); ++ unsigned int nr_entries = le32_to_cpu(n->header.nr_entries); ++ unsigned int nr_to_copy = nr_entries - (index + 1); + uint32_t value_size = le32_to_cpu(n->header.value_size); + BUG_ON(index >= nr_entries); + +@@ -144,20 +144,20 @@ static void delete_at(struct btree_node *n, unsigned index) + n->header.nr_entries = cpu_to_le32(nr_entries - 1); + } + +-static unsigned merge_threshold(struct btree_node *n) ++static unsigned int merge_threshold(struct btree_node *n) + { + return le32_to_cpu(n->header.max_entries) / 3; + } + + struct child { +- unsigned index; ++ unsigned int index; + struct dm_block *block; + struct btree_node *n; + }; + + static int init_child(struct dm_btree_info *info, struct dm_btree_value_type *vt, + struct btree_node *parent, +- unsigned index, struct child *result) ++ unsigned int index, struct child *result) + { + int r, inc; + dm_block_t root; +@@ -263,7 +263,7 @@ static int __rebalance2(struct dm_btree_info *info, struct btree_node *parent, + /* + * Rebalance. + */ +- unsigned target_left = (nr_left + nr_right) / 2; ++ unsigned int target_left = (nr_left + nr_right) / 2; + ret = shift(left, right, nr_left - target_left); + if (ret) + return ret; +@@ -273,7 +273,7 @@ static int __rebalance2(struct dm_btree_info *info, struct btree_node *parent, + } + + static int rebalance2(struct shadow_spine *s, struct dm_btree_info *info, +- struct dm_btree_value_type *vt, unsigned left_index) ++ struct dm_btree_value_type *vt, unsigned int left_index) + { + int r; + struct btree_node *parent; +@@ -310,7 +310,7 @@ static int delete_center_node(struct dm_btree_info *info, struct btree_node *par + uint32_t nr_left, uint32_t nr_center, uint32_t nr_right) + { + uint32_t max_entries = le32_to_cpu(left->header.max_entries); +- unsigned shift = min(max_entries - nr_left, nr_center); ++ unsigned int shift = min(max_entries - nr_left, nr_center); + + if (nr_left + shift > max_entries) { + DMERR("node shift out of bounds"); +@@ -351,10 +351,10 @@ static int redistribute3(struct dm_btree_info *info, struct btree_node *parent, + { + int s, ret; + uint32_t max_entries = le32_to_cpu(left->header.max_entries); +- unsigned total = nr_left + nr_center + nr_right; +- unsigned target_right = total / 3; +- unsigned remainder = (target_right * 3) != total; +- unsigned target_left = target_right + remainder; ++ unsigned int total = nr_left + nr_center + nr_right; ++ unsigned int target_right = total / 3; ++ unsigned int remainder = (target_right * 3) != total; ++ unsigned int target_left = target_right + remainder; + + BUG_ON(target_left > max_entries); + BUG_ON(target_right > max_entries); +@@ -422,7 +422,7 @@ static int __rebalance3(struct dm_btree_info *info, struct btree_node *parent, + uint32_t nr_center = le32_to_cpu(center->header.nr_entries); + uint32_t nr_right = le32_to_cpu(right->header.nr_entries); + +- unsigned threshold = merge_threshold(left) * 4 + 1; ++ unsigned int threshold = merge_threshold(left) * 4 + 1; + + if ((left->header.max_entries != center->header.max_entries) || + (center->header.max_entries != right->header.max_entries)) { +@@ -440,7 +440,7 @@ static int __rebalance3(struct dm_btree_info *info, struct btree_node *parent, + } + + static int rebalance3(struct shadow_spine *s, struct dm_btree_info *info, +- struct dm_btree_value_type *vt, unsigned left_index) ++ struct dm_btree_value_type *vt, unsigned int left_index) + { + int r; + struct btree_node *parent = dm_block_data(shadow_current(s)); +@@ -519,7 +519,7 @@ static int rebalance_children(struct shadow_spine *s, + return r; + } + +-static int do_leaf(struct btree_node *n, uint64_t key, unsigned *index) ++static int do_leaf(struct btree_node *n, uint64_t key, unsigned int *index) + { + int i = lower_bound(n, key); + +@@ -539,7 +539,7 @@ static int do_leaf(struct btree_node *n, uint64_t key, unsigned *index) + */ + static int remove_raw(struct shadow_spine *s, struct dm_btree_info *info, + struct dm_btree_value_type *vt, dm_block_t root, +- uint64_t key, unsigned *index) ++ uint64_t key, unsigned int *index) + { + int i = *index, r; + struct btree_node *n; +@@ -589,7 +589,7 @@ static int remove_raw(struct shadow_spine *s, struct dm_btree_info *info, + int dm_btree_remove(struct dm_btree_info *info, dm_block_t root, + uint64_t *keys, dm_block_t *new_root) + { +- unsigned level, last_level = info->levels - 1; ++ unsigned int level, last_level = info->levels - 1; + int index = 0, r = 0; + struct shadow_spine spine; + struct btree_node *n; +@@ -601,7 +601,7 @@ int dm_btree_remove(struct dm_btree_info *info, dm_block_t root, + r = remove_raw(&spine, info, + (level == last_level ? + &info->value_type : &le64_vt), +- root, keys[level], (unsigned *)&index); ++ root, keys[level], (unsigned int *)&index); + if (r < 0) + break; + +@@ -685,9 +685,9 @@ static int remove_nearest(struct shadow_spine *s, struct dm_btree_info *info, + + static int remove_one(struct dm_btree_info *info, dm_block_t root, + uint64_t *keys, uint64_t end_key, +- dm_block_t *new_root, unsigned *nr_removed) ++ dm_block_t *new_root, unsigned int *nr_removed) + { +- unsigned level, last_level = info->levels - 1; ++ unsigned int level, last_level = info->levels - 1; + int index = 0, r = 0; + struct shadow_spine spine; + struct btree_node *n; +@@ -698,7 +698,7 @@ static int remove_one(struct dm_btree_info *info, dm_block_t root, + init_shadow_spine(&spine, info); + for (level = 0; level < last_level; level++) { + r = remove_raw(&spine, info, &le64_vt, +- root, keys[level], (unsigned *) &index); ++ root, keys[level], (unsigned int *) &index); + if (r < 0) + goto out; + +@@ -742,7 +742,7 @@ static int remove_one(struct dm_btree_info *info, dm_block_t root, + + int dm_btree_remove_leaves(struct dm_btree_info *info, dm_block_t root, + uint64_t *first_key, uint64_t end_key, +- dm_block_t *new_root, unsigned *nr_removed) ++ dm_block_t *new_root, unsigned int *nr_removed) + { + int r; + +diff --git a/drivers/md/persistent-data/dm-btree-spine.c b/drivers/md/persistent-data/dm-btree-spine.c +index e6534588..45a39d4f 100644 +--- a/drivers/md/persistent-data/dm-btree-spine.c ++++ b/drivers/md/persistent-data/dm-btree-spine.c +@@ -234,12 +234,12 @@ dm_block_t shadow_root(struct shadow_spine *s) + return s->root; + } + +-static void le64_inc(void *context, const void *value_le, unsigned count) ++static void le64_inc(void *context, const void *value_le, unsigned int count) + { + dm_tm_with_runs(context, value_le, count, dm_tm_inc_range); + } + +-static void le64_dec(void *context, const void *value_le, unsigned count) ++static void le64_dec(void *context, const void *value_le, unsigned int count) + { + dm_tm_with_runs(context, value_le, count, dm_tm_dec_range); + } +diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c +index 5ce64e93..1cc783d7 100644 +--- a/drivers/md/persistent-data/dm-btree.c ++++ b/drivers/md/persistent-data/dm-btree.c +@@ -23,8 +23,8 @@ static void memcpy_disk(void *dest, const void *src, size_t len) + __dm_unbless_for_disk(src); + } + +-static void array_insert(void *base, size_t elt_size, unsigned nr_elts, +- unsigned index, void *elt) ++static void array_insert(void *base, size_t elt_size, unsigned int nr_elts, ++ unsigned int index, void *elt) + __dm_written_to_disk(elt) + { + if (index < nr_elts) +@@ -80,7 +80,7 @@ void inc_children(struct dm_transaction_manager *tm, struct btree_node *n, + vt->inc(vt->context, value_ptr(n, 0), nr_entries); + } + +-static int insert_at(size_t value_size, struct btree_node *node, unsigned index, ++static int insert_at(size_t value_size, struct btree_node *node, unsigned int index, + uint64_t key, void *value) + __dm_written_to_disk(value) + { +@@ -162,9 +162,9 @@ EXPORT_SYMBOL_GPL(dm_btree_empty); + struct frame { + struct dm_block *b; + struct btree_node *n; +- unsigned level; +- unsigned nr_children; +- unsigned current_child; ++ unsigned int level; ++ unsigned int nr_children; ++ unsigned int current_child; + }; + + struct del_stack { +@@ -193,7 +193,7 @@ static int unprocessed_frames(struct del_stack *s) + + static void prefetch_children(struct del_stack *s, struct frame *f) + { +- unsigned i; ++ unsigned int i; + struct dm_block_manager *bm = dm_tm_get_bm(s->tm); + + for (i = 0; i < f->nr_children; i++) +@@ -205,7 +205,7 @@ static bool is_internal_level(struct dm_btree_info *info, struct frame *f) + return f->level < (info->levels - 1); + } + +-static int push_frame(struct del_stack *s, dm_block_t b, unsigned level) ++static int push_frame(struct del_stack *s, dm_block_t b, unsigned int level) + { + int r; + uint32_t ref_count; +@@ -371,7 +371,7 @@ static int btree_lookup_raw(struct ro_spine *s, dm_block_t block, uint64_t key, + int dm_btree_lookup(struct dm_btree_info *info, dm_block_t root, + uint64_t *keys, void *value_le) + { +- unsigned level, last_level = info->levels - 1; ++ unsigned int level, last_level = info->levels - 1; + int r = -ENODATA; + uint64_t rkey; + __le64 internal_value_le; +@@ -467,7 +467,7 @@ static int dm_btree_lookup_next_single(struct dm_btree_info *info, dm_block_t ro + int dm_btree_lookup_next(struct dm_btree_info *info, dm_block_t root, + uint64_t *keys, uint64_t *rkey, void *value_le) + { +- unsigned level; ++ unsigned int level; + int r = -ENODATA; + __le64 internal_value_le; + struct ro_spine spine; +@@ -502,9 +502,9 @@ EXPORT_SYMBOL_GPL(dm_btree_lookup_next); + * Copies entries from one region of a btree node to another. The regions + * must not overlap. + */ +-static void copy_entries(struct btree_node *dest, unsigned dest_offset, +- struct btree_node *src, unsigned src_offset, +- unsigned count) ++static void copy_entries(struct btree_node *dest, unsigned int dest_offset, ++ struct btree_node *src, unsigned int src_offset, ++ unsigned int count) + { + size_t value_size = le32_to_cpu(dest->header.value_size); + memcpy(dest->keys + dest_offset, src->keys + src_offset, count * sizeof(uint64_t)); +@@ -515,9 +515,9 @@ static void copy_entries(struct btree_node *dest, unsigned dest_offset, + * Moves entries from one region fo a btree node to another. The regions + * may overlap. + */ +-static void move_entries(struct btree_node *dest, unsigned dest_offset, +- struct btree_node *src, unsigned src_offset, +- unsigned count) ++static void move_entries(struct btree_node *dest, unsigned int dest_offset, ++ struct btree_node *src, unsigned int src_offset, ++ unsigned int count) + { + size_t value_size = le32_to_cpu(dest->header.value_size); + memmove(dest->keys + dest_offset, src->keys + src_offset, count * sizeof(uint64_t)); +@@ -528,7 +528,7 @@ static void move_entries(struct btree_node *dest, unsigned dest_offset, + * Erases the first 'count' entries of a btree node, shifting following + * entries down into their place. + */ +-static void shift_down(struct btree_node *n, unsigned count) ++static void shift_down(struct btree_node *n, unsigned int count) + { + move_entries(n, 0, n, count, le32_to_cpu(n->header.nr_entries) - count); + } +@@ -537,7 +537,7 @@ static void shift_down(struct btree_node *n, unsigned count) + * Moves entries in a btree node up 'count' places, making space for + * new entries at the start of the node. + */ +-static void shift_up(struct btree_node *n, unsigned count) ++static void shift_up(struct btree_node *n, unsigned int count) + { + move_entries(n, count, n, 0, le32_to_cpu(n->header.nr_entries)); + } +@@ -548,18 +548,18 @@ static void shift_up(struct btree_node *n, unsigned count) + */ + static void redistribute2(struct btree_node *left, struct btree_node *right) + { +- unsigned nr_left = le32_to_cpu(left->header.nr_entries); +- unsigned nr_right = le32_to_cpu(right->header.nr_entries); +- unsigned total = nr_left + nr_right; +- unsigned target_left = total / 2; +- unsigned target_right = total - target_left; ++ unsigned int nr_left = le32_to_cpu(left->header.nr_entries); ++ unsigned int nr_right = le32_to_cpu(right->header.nr_entries); ++ unsigned int total = nr_left + nr_right; ++ unsigned int target_left = total / 2; ++ unsigned int target_right = total - target_left; + + if (nr_left < target_left) { +- unsigned delta = target_left - nr_left; ++ unsigned int delta = target_left - nr_left; + copy_entries(left, nr_left, right, 0, delta); + shift_down(right, delta); + } else if (nr_left > target_left) { +- unsigned delta = nr_left - target_left; ++ unsigned int delta = nr_left - target_left; + if (nr_right) + shift_up(right, delta); + copy_entries(right, 0, left, target_left, delta); +@@ -576,10 +576,10 @@ static void redistribute2(struct btree_node *left, struct btree_node *right) + static void redistribute3(struct btree_node *left, struct btree_node *center, + struct btree_node *right) + { +- unsigned nr_left = le32_to_cpu(left->header.nr_entries); +- unsigned nr_center = le32_to_cpu(center->header.nr_entries); +- unsigned nr_right = le32_to_cpu(right->header.nr_entries); +- unsigned total, target_left, target_center, target_right; ++ unsigned int nr_left = le32_to_cpu(left->header.nr_entries); ++ unsigned int nr_center = le32_to_cpu(center->header.nr_entries); ++ unsigned int nr_right = le32_to_cpu(right->header.nr_entries); ++ unsigned int total, target_left, target_center, target_right; + + BUG_ON(nr_center); + +@@ -589,19 +589,19 @@ static void redistribute3(struct btree_node *left, struct btree_node *center, + target_right = (total - target_left - target_center); + + if (nr_left < target_left) { +- unsigned left_short = target_left - nr_left; ++ unsigned int left_short = target_left - nr_left; + copy_entries(left, nr_left, right, 0, left_short); + copy_entries(center, 0, right, left_short, target_center); + shift_down(right, nr_right - target_right); + + } else if (nr_left < (target_left + target_center)) { +- unsigned left_to_center = nr_left - target_left; ++ unsigned int left_to_center = nr_left - target_left; + copy_entries(center, 0, left, target_left, left_to_center); + copy_entries(center, left_to_center, right, 0, target_center - left_to_center); + shift_down(right, nr_right - target_right); + + } else { +- unsigned right_short = target_right - nr_right; ++ unsigned int right_short = target_right - nr_right; + shift_up(right, right_short); + copy_entries(right, 0, left, nr_left - right_short, right_short); + copy_entries(center, 0, left, target_left, nr_left - target_left); +@@ -642,7 +642,7 @@ static void redistribute3(struct btree_node *left, struct btree_node *center, + * + * Where A* is a shadow of A. + */ +-static int split_one_into_two(struct shadow_spine *s, unsigned parent_index, ++static int split_one_into_two(struct shadow_spine *s, unsigned int parent_index, + struct dm_btree_value_type *vt, uint64_t key) + { + int r; +@@ -696,7 +696,7 @@ static int split_one_into_two(struct shadow_spine *s, unsigned parent_index, + * to the new shadow. + */ + static int shadow_child(struct dm_btree_info *info, struct dm_btree_value_type *vt, +- struct btree_node *parent, unsigned index, ++ struct btree_node *parent, unsigned int index, + struct dm_block **result) + { + int r, inc; +@@ -725,11 +725,11 @@ static int shadow_child(struct dm_btree_info *info, struct dm_btree_value_type * + * Splits two nodes into three. This is more work, but results in fuller + * nodes, so saves metadata space. + */ +-static int split_two_into_three(struct shadow_spine *s, unsigned parent_index, ++static int split_two_into_three(struct shadow_spine *s, unsigned int parent_index, + struct dm_btree_value_type *vt, uint64_t key) + { + int r; +- unsigned middle_index; ++ unsigned int middle_index; + struct dm_block *left, *middle, *right, *parent; + struct btree_node *ln, *rn, *mn, *pn; + __le64 location; +@@ -830,7 +830,7 @@ static int btree_split_beneath(struct shadow_spine *s, uint64_t key) + { + int r; + size_t size; +- unsigned nr_left, nr_right; ++ unsigned int nr_left, nr_right; + struct dm_block *left, *right, *new_parent; + struct btree_node *pn, *ln, *rn; + __le64 val; +@@ -904,7 +904,7 @@ static int btree_split_beneath(struct shadow_spine *s, uint64_t key) + * Redistributes a node's entries with its left sibling. + */ + static int rebalance_left(struct shadow_spine *s, struct dm_btree_value_type *vt, +- unsigned parent_index, uint64_t key) ++ unsigned int parent_index, uint64_t key) + { + int r; + struct dm_block *sib; +@@ -933,7 +933,7 @@ static int rebalance_left(struct shadow_spine *s, struct dm_btree_value_type *vt + * Redistributes a nodes entries with its right sibling. + */ + static int rebalance_right(struct shadow_spine *s, struct dm_btree_value_type *vt, +- unsigned parent_index, uint64_t key) ++ unsigned int parent_index, uint64_t key) + { + int r; + struct dm_block *sib; +@@ -961,10 +961,10 @@ static int rebalance_right(struct shadow_spine *s, struct dm_btree_value_type *v + /* + * Returns the number of spare entries in a node. + */ +-static int get_node_free_space(struct dm_btree_info *info, dm_block_t b, unsigned *space) ++static int get_node_free_space(struct dm_btree_info *info, dm_block_t b, unsigned int *space) + { + int r; +- unsigned nr_entries; ++ unsigned int nr_entries; + struct dm_block *block; + struct btree_node *node; + +@@ -990,12 +990,12 @@ static int get_node_free_space(struct dm_btree_info *info, dm_block_t b, unsigne + */ + #define SPACE_THRESHOLD 8 + static int rebalance_or_split(struct shadow_spine *s, struct dm_btree_value_type *vt, +- unsigned parent_index, uint64_t key) ++ unsigned int parent_index, uint64_t key) + { + int r; + struct btree_node *parent = dm_block_data(shadow_parent(s)); +- unsigned nr_parent = le32_to_cpu(parent->header.nr_entries); +- unsigned free_space; ++ unsigned int nr_parent = le32_to_cpu(parent->header.nr_entries); ++ unsigned int free_space; + int left_shared = 0, right_shared = 0; + + /* Should we move entries to the left sibling? */ +@@ -1080,7 +1080,7 @@ static bool has_space_for_insert(struct btree_node *node, uint64_t key) + + static int btree_insert_raw(struct shadow_spine *s, dm_block_t root, + struct dm_btree_value_type *vt, +- uint64_t key, unsigned *index) ++ uint64_t key, unsigned int *index) + { + int r, i = *index, top = 1; + struct btree_node *node; +@@ -1214,7 +1214,7 @@ int btree_get_overwrite_leaf(struct dm_btree_info *info, dm_block_t root, + } + + static bool need_insert(struct btree_node *node, uint64_t *keys, +- unsigned level, unsigned index) ++ unsigned int level, unsigned int index) + { + return ((index >= le32_to_cpu(node->header.nr_entries)) || + (le64_to_cpu(node->keys[index]) != keys[level])); +@@ -1226,7 +1226,7 @@ static int insert(struct dm_btree_info *info, dm_block_t root, + __dm_written_to_disk(value) + { + int r; +- unsigned level, index = -1, last_level = info->levels - 1; ++ unsigned int level, index = -1, last_level = info->levels - 1; + dm_block_t block = root; + struct shadow_spine spine; + struct btree_node *n; +@@ -1412,7 +1412,7 @@ static int walk_node(struct dm_btree_info *info, dm_block_t block, + void *context) + { + int r; +- unsigned i, nr; ++ unsigned int i, nr; + struct dm_block *node; + struct btree_node *n; + uint64_t keys; +@@ -1455,7 +1455,7 @@ EXPORT_SYMBOL_GPL(dm_btree_walk); + + static void prefetch_values(struct dm_btree_cursor *c) + { +- unsigned i, nr; ++ unsigned int i, nr; + __le64 value_le; + struct cursor_node *n = c->nodes + c->depth - 1; + struct btree_node *bn = dm_block_data(n->b); +diff --git a/drivers/md/persistent-data/dm-btree.h b/drivers/md/persistent-data/dm-btree.h +index d2ae5aa4..5566e7c3 100644 +--- a/drivers/md/persistent-data/dm-btree.h ++++ b/drivers/md/persistent-data/dm-btree.h +@@ -58,14 +58,14 @@ struct dm_btree_value_type { + * somewhere.) This method is _not_ called for insertion of a new + * value: It is assumed the ref count is already 1. + */ +- void (*inc)(void *context, const void *value, unsigned count); ++ void (*inc)(void *context, const void *value, unsigned int count); + + /* + * These values are being deleted. The btree takes care of freeing + * the memory pointed to by @value. Often the del function just + * needs to decrement a reference counts somewhere. + */ +- void (*dec)(void *context, const void *value, unsigned count); ++ void (*dec)(void *context, const void *value, unsigned int count); + + /* + * A test for equality between two values. When a value is +@@ -84,7 +84,7 @@ struct dm_btree_info { + /* + * Number of nested btrees. (Not the depth of a single tree.) + */ +- unsigned levels; ++ unsigned int levels; + struct dm_btree_value_type value_type; + }; + +@@ -149,7 +149,7 @@ int dm_btree_remove(struct dm_btree_info *info, dm_block_t root, + */ + int dm_btree_remove_leaves(struct dm_btree_info *info, dm_block_t root, + uint64_t *keys, uint64_t end_key, +- dm_block_t *new_root, unsigned *nr_removed); ++ dm_block_t *new_root, unsigned int *nr_removed); + + /* + * Returns < 0 on failure. Otherwise the number of key entries that have +@@ -188,7 +188,7 @@ int dm_btree_walk(struct dm_btree_info *info, dm_block_t root, + + struct cursor_node { + struct dm_block *b; +- unsigned index; ++ unsigned int index; + }; + + struct dm_btree_cursor { +@@ -196,7 +196,7 @@ struct dm_btree_cursor { + dm_block_t root; + + bool prefetch_leaves; +- unsigned depth; ++ unsigned int depth; + struct cursor_node nodes[DM_BTREE_CURSOR_MAX_DEPTH]; + }; + +diff --git a/drivers/md/persistent-data/dm-persistent-data-internal.h b/drivers/md/persistent-data/dm-persistent-data-internal.h +index c49e26ff..b945a2be 100644 +--- a/drivers/md/persistent-data/dm-persistent-data-internal.h ++++ b/drivers/md/persistent-data/dm-persistent-data-internal.h +@@ -9,11 +9,11 @@ + + #include "dm-block-manager.h" + +-static inline unsigned dm_hash_block(dm_block_t b, unsigned hash_mask) ++static inline unsigned int dm_hash_block(dm_block_t b, unsigned int hash_mask) + { +- const unsigned BIG_PRIME = 4294967291UL; ++ const unsigned int BIG_PRIME = 4294967291UL; + +- return (((unsigned) b) * BIG_PRIME) & hash_mask; ++ return (((unsigned int) b) * BIG_PRIME) & hash_mask; + } + + #endif /* _PERSISTENT_DATA_INTERNAL_H */ +diff --git a/drivers/md/persistent-data/dm-space-map-common.c b/drivers/md/persistent-data/dm-space-map-common.c +index bfbfa750..af800efe 100644 +--- a/drivers/md/persistent-data/dm-space-map-common.c ++++ b/drivers/md/persistent-data/dm-space-map-common.c +@@ -126,7 +126,7 @@ static void *dm_bitmap_data(struct dm_block *b) + + #define WORD_MASK_HIGH 0xAAAAAAAAAAAAAAAAULL + +-static unsigned dm_bitmap_word_used(void *addr, unsigned b) ++static unsigned int dm_bitmap_word_used(void *addr, unsigned int b) + { + __le64 *words_le = addr; + __le64 *w_le = words_le + (b >> ENTRIES_SHIFT); +@@ -137,11 +137,11 @@ static unsigned dm_bitmap_word_used(void *addr, unsigned b) + return !(~bits & mask); + } + +-static unsigned sm_lookup_bitmap(void *addr, unsigned b) ++static unsigned int sm_lookup_bitmap(void *addr, unsigned int b) + { + __le64 *words_le = addr; + __le64 *w_le = words_le + (b >> ENTRIES_SHIFT); +- unsigned hi, lo; ++ unsigned int hi, lo; + + b = (b & (ENTRIES_PER_WORD - 1)) << 1; + hi = !!test_bit_le(b, (void *) w_le); +@@ -149,7 +149,7 @@ static unsigned sm_lookup_bitmap(void *addr, unsigned b) + return (hi << 1) | lo; + } + +-static void sm_set_bitmap(void *addr, unsigned b, unsigned val) ++static void sm_set_bitmap(void *addr, unsigned int b, unsigned int val) + { + __le64 *words_le = addr; + __le64 *w_le = words_le + (b >> ENTRIES_SHIFT); +@@ -167,8 +167,8 @@ static void sm_set_bitmap(void *addr, unsigned b, unsigned val) + __clear_bit_le(b + 1, (void *) w_le); + } + +-static int sm_find_free(void *addr, unsigned begin, unsigned end, +- unsigned *result) ++static int sm_find_free(void *addr, unsigned int begin, unsigned int end, ++ unsigned int *result) + { + while (begin < end) { + if (!(begin & (ENTRIES_PER_WORD - 1)) && +@@ -237,7 +237,7 @@ int sm_ll_extend(struct ll_disk *ll, dm_block_t extra_blocks) + { + int r; + dm_block_t i, nr_blocks, nr_indexes; +- unsigned old_blocks, blocks; ++ unsigned int old_blocks, blocks; + + nr_blocks = ll->nr_blocks + extra_blocks; + old_blocks = dm_sector_div_up(ll->nr_blocks, ll->entries_per_block); +@@ -351,7 +351,7 @@ int sm_ll_find_free_block(struct ll_disk *ll, dm_block_t begin, + + for (i = index_begin; i < index_end; i++, begin = 0) { + struct dm_block *blk; +- unsigned position; ++ unsigned int position; + uint32_t bit_end; + + r = ll->load_ie(ll, i, &ie_disk); +@@ -369,7 +369,7 @@ int sm_ll_find_free_block(struct ll_disk *ll, dm_block_t begin, + bit_end = (i == index_end - 1) ? end : ll->entries_per_block; + + r = sm_find_free(dm_bitmap_data(blk), +- max_t(unsigned, begin, le32_to_cpu(ie_disk.none_free_before)), ++ max_t(unsigned int, begin, le32_to_cpu(ie_disk.none_free_before)), + bit_end, &position); + if (r == -ENOSPC) { + /* +@@ -1097,7 +1097,7 @@ static inline int ie_cache_writeback(struct ll_disk *ll, struct ie_cache *iec) + &iec->index, &iec->ie, &ll->bitmap_root); + } + +-static inline unsigned hash_index(dm_block_t index) ++static inline unsigned int hash_index(dm_block_t index) + { + return dm_hash_block(index, IE_CACHE_MASK); + } +@@ -1106,7 +1106,7 @@ static int disk_ll_load_ie(struct ll_disk *ll, dm_block_t index, + struct disk_index_entry *ie) + { + int r; +- unsigned h = hash_index(index); ++ unsigned int h = hash_index(index); + struct ie_cache *iec = ll->ie_cache + h; + + if (iec->valid) { +@@ -1137,7 +1137,7 @@ static int disk_ll_save_ie(struct ll_disk *ll, dm_block_t index, + struct disk_index_entry *ie) + { + int r; +- unsigned h = hash_index(index); ++ unsigned int h = hash_index(index); + struct ie_cache *iec = ll->ie_cache + h; + + ll->bitmap_index_changed = true; +@@ -1164,7 +1164,7 @@ static int disk_ll_save_ie(struct ll_disk *ll, dm_block_t index, + + static int disk_ll_init_index(struct ll_disk *ll) + { +- unsigned i; ++ unsigned int i; + for (i = 0; i < IE_CACHE_SIZE; i++) { + struct ie_cache *iec = ll->ie_cache + i; + iec->valid = false; +@@ -1186,7 +1186,7 @@ static dm_block_t disk_ll_max_entries(struct ll_disk *ll) + static int disk_ll_commit(struct ll_disk *ll) + { + int r = 0; +- unsigned i; ++ unsigned int i; + + for (i = 0; i < IE_CACHE_SIZE; i++) { + struct ie_cache *iec = ll->ie_cache + i; +diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c +index 392ae261..0d1fcdf2 100644 +--- a/drivers/md/persistent-data/dm-space-map-metadata.c ++++ b/drivers/md/persistent-data/dm-space-map-metadata.c +@@ -94,8 +94,8 @@ struct block_op { + }; + + struct bop_ring_buffer { +- unsigned begin; +- unsigned end; ++ unsigned int begin; ++ unsigned int end; + struct block_op bops[MAX_RECURSIVE_ALLOCATIONS + 1]; + }; + +@@ -110,9 +110,9 @@ static bool brb_empty(struct bop_ring_buffer *brb) + return brb->begin == brb->end; + } + +-static unsigned brb_next(struct bop_ring_buffer *brb, unsigned old) ++static unsigned int brb_next(struct bop_ring_buffer *brb, unsigned int old) + { +- unsigned r = old + 1; ++ unsigned int r = old + 1; + return r >= ARRAY_SIZE(brb->bops) ? 0 : r; + } + +@@ -120,7 +120,7 @@ static int brb_push(struct bop_ring_buffer *brb, + enum block_op_type type, dm_block_t b, dm_block_t e) + { + struct block_op *bop; +- unsigned next = brb_next(brb, brb->end); ++ unsigned int next = brb_next(brb, brb->end); + + /* + * We don't allow the last bop to be filled, this way we can +@@ -171,8 +171,8 @@ struct sm_metadata { + + dm_block_t begin; + +- unsigned recursion_count; +- unsigned allocated_this_transaction; ++ unsigned int recursion_count; ++ unsigned int allocated_this_transaction; + struct bop_ring_buffer uncommitted; + + struct threshold threshold; +@@ -300,9 +300,9 @@ static int sm_metadata_get_count(struct dm_space_map *sm, dm_block_t b, + uint32_t *result) + { + int r; +- unsigned i; ++ unsigned int i; + struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm); +- unsigned adjustment = 0; ++ unsigned int adjustment = 0; + + /* + * We may have some uncommitted adjustments to add. This list +@@ -340,7 +340,7 @@ static int sm_metadata_count_is_more_than_one(struct dm_space_map *sm, + dm_block_t b, int *result) + { + int r, adjustment = 0; +- unsigned i; ++ unsigned int i; + struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm); + uint32_t rc; + +diff --git a/drivers/md/persistent-data/dm-transaction-manager.c b/drivers/md/persistent-data/dm-transaction-manager.c +index 16643fc9..39885f83 100644 +--- a/drivers/md/persistent-data/dm-transaction-manager.c ++++ b/drivers/md/persistent-data/dm-transaction-manager.c +@@ -28,14 +28,14 @@ struct prefetch_set { + dm_block_t blocks[PREFETCH_SIZE]; + }; + +-static unsigned prefetch_hash(dm_block_t b) ++static unsigned int prefetch_hash(dm_block_t b) + { + return hash_64(b, PREFETCH_BITS); + } + + static void prefetch_wipe(struct prefetch_set *p) + { +- unsigned i; ++ unsigned int i; + for (i = 0; i < PREFETCH_SIZE; i++) + p->blocks[i] = PREFETCH_SENTINEL; + } +@@ -48,7 +48,7 @@ static void prefetch_init(struct prefetch_set *p) + + static void prefetch_add(struct prefetch_set *p, dm_block_t b) + { +- unsigned h = prefetch_hash(b); ++ unsigned int h = prefetch_hash(b); + + mutex_lock(&p->lock); + if (p->blocks[h] == PREFETCH_SENTINEL) +@@ -59,7 +59,7 @@ static void prefetch_add(struct prefetch_set *p, dm_block_t b) + + static void prefetch_issue(struct prefetch_set *p, struct dm_block_manager *bm) + { +- unsigned i; ++ unsigned int i; + + mutex_lock(&p->lock); + +@@ -103,7 +103,7 @@ struct dm_transaction_manager { + static int is_shadow(struct dm_transaction_manager *tm, dm_block_t b) + { + int r = 0; +- unsigned bucket = dm_hash_block(b, DM_HASH_MASK); ++ unsigned int bucket = dm_hash_block(b, DM_HASH_MASK); + struct shadow_info *si; + + spin_lock(&tm->lock); +@@ -123,7 +123,7 @@ static int is_shadow(struct dm_transaction_manager *tm, dm_block_t b) + */ + static void insert_shadow(struct dm_transaction_manager *tm, dm_block_t b) + { +- unsigned bucket; ++ unsigned int bucket; + struct shadow_info *si; + + si = kmalloc(sizeof(*si), GFP_NOIO); +@@ -393,11 +393,11 @@ void dm_tm_dec_range(struct dm_transaction_manager *tm, dm_block_t b, dm_block_t + EXPORT_SYMBOL_GPL(dm_tm_dec_range); + + void dm_tm_with_runs(struct dm_transaction_manager *tm, +- const __le64 *value_le, unsigned count, dm_tm_run_fn fn) ++ const __le64 *value_le, unsigned int count, dm_tm_run_fn fn) + { + uint64_t b, begin, end; + bool in_run = false; +- unsigned i; ++ unsigned int i; + + for (i = 0; i < count; i++, value_le++) { + b = le64_to_cpu(*value_le); +diff --git a/drivers/md/persistent-data/dm-transaction-manager.h b/drivers/md/persistent-data/dm-transaction-manager.h +index 906c02ed..0f573a4a 100644 +--- a/drivers/md/persistent-data/dm-transaction-manager.h ++++ b/drivers/md/persistent-data/dm-transaction-manager.h +@@ -111,7 +111,7 @@ void dm_tm_dec_range(struct dm_transaction_manager *tm, dm_block_t b, dm_block_t + */ + typedef void (*dm_tm_run_fn)(struct dm_transaction_manager *, dm_block_t, dm_block_t); + void dm_tm_with_runs(struct dm_transaction_manager *tm, +- const __le64 *value_le, unsigned count, dm_tm_run_fn fn); ++ const __le64 *value_le, unsigned int count, dm_tm_run_fn fn); + + int dm_tm_ref(struct dm_transaction_manager *tm, dm_block_t b, uint32_t *result); + +diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h +index 04c6acf7..201dd1ab 100644 +--- a/include/linux/device-mapper.h ++++ b/include/linux/device-mapper.h +@@ -87,10 +87,10 @@ typedef int (*dm_preresume_fn) (struct dm_target *ti); + typedef void (*dm_resume_fn) (struct dm_target *ti); + + typedef void (*dm_status_fn) (struct dm_target *ti, status_type_t status_type, +- unsigned status_flags, char *result, unsigned maxlen); ++ unsigned int status_flags, char *result, unsigned int maxlen); + +-typedef int (*dm_message_fn) (struct dm_target *ti, unsigned argc, char **argv, +- char *result, unsigned maxlen); ++typedef int (*dm_message_fn) (struct dm_target *ti, unsigned int argc, char **argv, ++ char *result, unsigned int maxlen); + + typedef int (*dm_prepare_ioctl_fn) (struct dm_target *ti, struct block_device **bdev); + +@@ -187,7 +187,7 @@ struct target_type { + uint64_t features; + const char *name; + struct module *module; +- unsigned version[3]; ++ unsigned int version[3]; + dm_ctr_fn ctr; + dm_dtr_fn dtr; + dm_map_fn map; +@@ -313,31 +313,31 @@ struct dm_target { + * It is a responsibility of the target driver to remap these bios + * to the real underlying devices. + */ +- unsigned num_flush_bios; ++ unsigned int num_flush_bios; + + /* + * The number of discard bios that will be submitted to the target. + * The bio number can be accessed with dm_bio_get_target_bio_nr. + */ +- unsigned num_discard_bios; ++ unsigned int num_discard_bios; + + /* + * The number of secure erase bios that will be submitted to the target. + * The bio number can be accessed with dm_bio_get_target_bio_nr. + */ +- unsigned num_secure_erase_bios; ++ unsigned int num_secure_erase_bios; + + /* + * The number of WRITE ZEROES bios that will be submitted to the target. + * The bio number can be accessed with dm_bio_get_target_bio_nr. + */ +- unsigned num_write_zeroes_bios; ++ unsigned int num_write_zeroes_bios; + + /* + * The minimum number of extra bytes allocated in each io for the + * target to use. + */ +- unsigned per_io_data_size; ++ unsigned int per_io_data_size; + + /* target specific data */ + void *private; +@@ -383,7 +383,7 @@ struct dm_target { + + void *dm_per_bio_data(struct bio *bio, size_t data_size); + struct bio *dm_bio_from_per_bio_data(void *data, size_t data_size); +-unsigned dm_bio_get_target_bio_nr(const struct bio *bio); ++unsigned int dm_bio_get_target_bio_nr(const struct bio *bio); + + u64 dm_start_time_ns_from_clone(struct bio *bio); + +@@ -394,7 +394,7 @@ void dm_unregister_target(struct target_type *t); + * Target argument parsing. + */ + struct dm_arg_set { +- unsigned argc; ++ unsigned int argc; + char **argv; + }; + +@@ -403,8 +403,8 @@ struct dm_arg_set { + * the error message to use if the number is found to be outside that range. + */ + struct dm_arg { +- unsigned min; +- unsigned max; ++ unsigned int min; ++ unsigned int max; + char *error; + }; + +@@ -413,7 +413,7 @@ struct dm_arg { + * returning -EINVAL and setting *error. + */ + int dm_read_arg(const struct dm_arg *arg, struct dm_arg_set *arg_set, +- unsigned *value, char **error); ++ unsigned int *value, char **error); + + /* + * Process the next argument as the start of a group containing between +@@ -421,7 +421,7 @@ int dm_read_arg(const struct dm_arg *arg, struct dm_arg_set *arg_set, + * *num_args or, if invalid, return -EINVAL and set *error. + */ + int dm_read_arg_group(const struct dm_arg *arg, struct dm_arg_set *arg_set, +- unsigned *num_args, char **error); ++ unsigned int *num_args, char **error); + + /* + * Return the current argument and shift to the next. +@@ -431,7 +431,7 @@ const char *dm_shift_arg(struct dm_arg_set *as); + /* + * Move through num_args arguments. + */ +-void dm_consume_args(struct dm_arg_set *as, unsigned num_args); ++void dm_consume_args(struct dm_arg_set *as, unsigned int num_args); + + /*----------------------------------------------------------------- + * Functions for creating and manipulating mapped devices. +@@ -461,7 +461,7 @@ void *dm_get_mdptr(struct mapped_device *md); + /* + * A device can still be used while suspended, but I/O is deferred. + */ +-int dm_suspend(struct mapped_device *md, unsigned suspend_flags); ++int dm_suspend(struct mapped_device *md, unsigned int suspend_flags); + int dm_resume(struct mapped_device *md); + + /* +@@ -481,7 +481,7 @@ struct gendisk *dm_disk(struct mapped_device *md); + int dm_suspended(struct dm_target *ti); + int dm_post_suspending(struct dm_target *ti); + int dm_noflush_suspending(struct dm_target *ti); +-void dm_accept_partial_bio(struct bio *bio, unsigned n_sectors); ++void dm_accept_partial_bio(struct bio *bio, unsigned int n_sectors); + void dm_submit_bio_remap(struct bio *clone, struct bio *tgt_clone); + union map_info *dm_get_rq_mapinfo(struct request *rq); + +@@ -525,7 +525,7 @@ int dm_set_geometry(struct mapped_device *md, struct hd_geometry *geo); + * First create an empty table. + */ + int dm_table_create(struct dm_table **result, fmode_t mode, +- unsigned num_targets, struct mapped_device *md); ++ unsigned int num_targets, struct mapped_device *md); + + /* + * Then call this once for each target. +diff --git a/include/linux/dm-bufio.h b/include/linux/dm-bufio.h +index 15d9e15c..1262d92a 100644 +--- a/include/linux/dm-bufio.h ++++ b/include/linux/dm-bufio.h +@@ -26,8 +26,8 @@ struct dm_buffer; + * Create a buffered IO cache on a given device + */ + struct dm_bufio_client * +-dm_bufio_client_create(struct block_device *bdev, unsigned block_size, +- unsigned reserved_buffers, unsigned aux_size, ++dm_bufio_client_create(struct block_device *bdev, unsigned int block_size, ++ unsigned int reserved_buffers, unsigned int aux_size, + void (*alloc_callback)(struct dm_buffer *), + void (*write_callback)(struct dm_buffer *), + unsigned int flags); +@@ -81,7 +81,7 @@ void *dm_bufio_new(struct dm_bufio_client *c, sector_t block, + * I/O to finish. + */ + void dm_bufio_prefetch(struct dm_bufio_client *c, +- sector_t block, unsigned n_blocks); ++ sector_t block, unsigned int n_blocks); + + /* + * Release a reference obtained with dm_bufio_{read,get,new}. The data +@@ -106,7 +106,7 @@ void dm_bufio_mark_buffer_dirty(struct dm_buffer *b); + * write the specified part of the buffer or it may write a larger superset. + */ + void dm_bufio_mark_partial_buffer_dirty(struct dm_buffer *b, +- unsigned start, unsigned end); ++ unsigned int start, unsigned int end); + + /* + * Initiate writing of dirty buffers, without waiting for completion. +@@ -152,9 +152,9 @@ void dm_bufio_forget_buffers(struct dm_bufio_client *c, sector_t block, sector_t + /* + * Set the minimum number of buffers before cleanup happens. + */ +-void dm_bufio_set_minimum_buffers(struct dm_bufio_client *c, unsigned n); ++void dm_bufio_set_minimum_buffers(struct dm_bufio_client *c, unsigned int n); + +-unsigned dm_bufio_get_block_size(struct dm_bufio_client *c); ++unsigned int dm_bufio_get_block_size(struct dm_bufio_client *c); + sector_t dm_bufio_get_device_size(struct dm_bufio_client *c); + struct dm_io_client *dm_bufio_get_dm_io_client(struct dm_bufio_client *c); + sector_t dm_bufio_get_block_number(struct dm_buffer *b); +diff --git a/include/linux/dm-dirty-log.h b/include/linux/dm-dirty-log.h +index 7084503c..843c857f 100644 +--- a/include/linux/dm-dirty-log.h ++++ b/include/linux/dm-dirty-log.h +@@ -33,7 +33,7 @@ struct dm_dirty_log_type { + struct list_head list; + + int (*ctr)(struct dm_dirty_log *log, struct dm_target *ti, +- unsigned argc, char **argv); ++ unsigned int argc, char **argv); + void (*dtr)(struct dm_dirty_log *log); + + /* +@@ -116,7 +116,7 @@ struct dm_dirty_log_type { + * Support function for mirror status requests. + */ + int (*status)(struct dm_dirty_log *log, status_type_t status_type, +- char *result, unsigned maxlen); ++ char *result, unsigned int maxlen); + + /* + * is_remote_recovering is necessary for cluster mirroring. It provides +@@ -139,7 +139,7 @@ int dm_dirty_log_type_unregister(struct dm_dirty_log_type *type); + struct dm_dirty_log *dm_dirty_log_create(const char *type_name, + struct dm_target *ti, + int (*flush_callback_fn)(struct dm_target *ti), +- unsigned argc, char **argv); ++ unsigned int argc, char **argv); + void dm_dirty_log_destroy(struct dm_dirty_log *log); + + #endif /* __KERNEL__ */ +diff --git a/include/linux/dm-io.h b/include/linux/dm-io.h +index 8e1c4ab5..92e7abfe 100644 +--- a/include/linux/dm-io.h ++++ b/include/linux/dm-io.h +@@ -26,7 +26,7 @@ struct page_list { + struct page *page; + }; + +-typedef void (*io_notify_fn)(unsigned long error, void *context); ++typedef void (*io_notify_fn)(unsigned int long error, void *context); + + enum dm_io_mem_type { + DM_IO_PAGE_LIST,/* Page list */ +@@ -38,7 +38,7 @@ enum dm_io_mem_type { + struct dm_io_memory { + enum dm_io_mem_type type; + +- unsigned offset; ++ unsigned int offset; + + union { + struct page_list *pl; +@@ -78,8 +78,8 @@ void dm_io_client_destroy(struct dm_io_client *client); + * Each bit in the optional 'sync_error_bits' bitset indicates whether an + * error occurred doing io to the corresponding region. + */ +-int dm_io(struct dm_io_request *io_req, unsigned num_regions, +- struct dm_io_region *region, unsigned long *sync_error_bits); ++int dm_io(struct dm_io_request *io_req, unsigned int num_regions, ++ struct dm_io_region *region, unsigned int long *sync_error_bits); + + #endif /* __KERNEL__ */ + #endif /* _LINUX_DM_IO_H */ +diff --git a/include/linux/dm-kcopyd.h b/include/linux/dm-kcopyd.h +index c1707ee5..68c412b3 100644 +--- a/include/linux/dm-kcopyd.h ++++ b/include/linux/dm-kcopyd.h +@@ -23,11 +23,11 @@ + #define DM_KCOPYD_WRITE_SEQ 2 + + struct dm_kcopyd_throttle { +- unsigned throttle; +- unsigned num_io_jobs; +- unsigned io_period; +- unsigned total_period; +- unsigned last_jiffies; ++ unsigned int throttle; ++ unsigned int num_io_jobs; ++ unsigned int io_period; ++ unsigned int total_period; ++ unsigned int last_jiffies; + }; + + /* +@@ -60,12 +60,12 @@ void dm_kcopyd_client_flush(struct dm_kcopyd_client *kc); + * read_err is a boolean, + * write_err is a bitset, with 1 bit for each destination region + */ +-typedef void (*dm_kcopyd_notify_fn)(int read_err, unsigned long write_err, ++typedef void (*dm_kcopyd_notify_fn)(int read_err, unsigned int long write_err, + void *context); + + void dm_kcopyd_copy(struct dm_kcopyd_client *kc, struct dm_io_region *from, +- unsigned num_dests, struct dm_io_region *dests, +- unsigned flags, dm_kcopyd_notify_fn fn, void *context); ++ unsigned int num_dests, struct dm_io_region *dests, ++ unsigned int flags, dm_kcopyd_notify_fn fn, void *context); + + /* + * Prepare a callback and submit it via the kcopyd thread. +@@ -80,11 +80,11 @@ void dm_kcopyd_copy(struct dm_kcopyd_client *kc, struct dm_io_region *from, + */ + void *dm_kcopyd_prepare_callback(struct dm_kcopyd_client *kc, + dm_kcopyd_notify_fn fn, void *context); +-void dm_kcopyd_do_callback(void *job, int read_err, unsigned long write_err); ++void dm_kcopyd_do_callback(void *job, int read_err, unsigned int long write_err); + + void dm_kcopyd_zero(struct dm_kcopyd_client *kc, +- unsigned num_dests, struct dm_io_region *dests, +- unsigned flags, dm_kcopyd_notify_fn fn, void *context); ++ unsigned int num_dests, struct dm_io_region *dests, ++ unsigned int flags, dm_kcopyd_notify_fn fn, void *context); + + #endif /* __KERNEL__ */ + #endif /* _LINUX_DM_KCOPYD_H */ +diff --git a/include/linux/dm-region-hash.h b/include/linux/dm-region-hash.h +index 9e2a7a40..e8691539 100644 +--- a/include/linux/dm-region-hash.h ++++ b/include/linux/dm-region-hash.h +@@ -37,7 +37,7 @@ struct dm_region_hash *dm_region_hash_create( + struct bio_list *bios), + void (*wakeup_workers)(void *context), + void (*wakeup_all_recovery_waiters)(void *context), +- sector_t target_begin, unsigned max_recovery, ++ sector_t target_begin, unsigned int max_recovery, + struct dm_dirty_log *log, uint32_t region_size, + region_t nr_regions); + void dm_region_hash_destroy(struct dm_region_hash *rh); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-004-dm-fix-improper-splitting-for-abnormal-bios.patch b/patches.kernel.org/6.2.11-004-dm-fix-improper-splitting-for-abnormal-bios.patch new file mode 100644 index 0000000..2e33e32 --- /dev/null +++ b/patches.kernel.org/6.2.11-004-dm-fix-improper-splitting-for-abnormal-bios.patch @@ -0,0 +1,84 @@ +From: Mike Snitzer +Date: Thu, 30 Mar 2023 14:56:38 -0400 +Subject: [PATCH] dm: fix improper splitting for abnormal bios +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: f7b58a69fad9d2c4c90cab0247811155dd0d48e7 + +[ Upstream commit f7b58a69fad9d2c4c90cab0247811155dd0d48e7 ] + +"Abnormal" bios include discards, write zeroes and secure erase. By no +longer passing the calculated 'len' pointer, commit 7dd06a2548b2 ("dm: +allow dm_accept_partial_bio() for dm_io without duplicate bios") took a +senseless approach to disallowing dm_accept_partial_bio() from working +for duplicate bios processed using __send_duplicate_bios(). + +It inadvertently and incorrectly stopped the use of 'len' when +initializing a target's io (in alloc_tio). As such the resulting tio +could address more area of a device than it should. + +For example, when discarding an entire DM striped device with the +following DM table: + vg-lvol0: 0 159744 striped 2 128 7:0 2048 7:1 2048 + vg-lvol0: 159744 45056 striped 2 128 7:2 2048 7:3 2048 + +Before this fix: + + device-mapper: striped: target_stripe=0, bdev=7:0, start=2048 len=102400 + blkdiscard: attempt to access beyond end of device + loop0: rw=2051, sector=2048, nr_sectors = 102400 limit=81920 + + device-mapper: striped: target_stripe=1, bdev=7:1, start=2048 len=102400 + blkdiscard: attempt to access beyond end of device + loop1: rw=2051, sector=2048, nr_sectors = 102400 limit=81920 + +After this fix; + + device-mapper: striped: target_stripe=0, bdev=7:0, start=2048 len=79872 + device-mapper: striped: target_stripe=1, bdev=7:1, start=2048 len=79872 + +Fixes: 7dd06a2548b2 ("dm: allow dm_accept_partial_bio() for dm_io without duplicate bios") +Cc: stable@vger.kernel.org +Reported-by: Orange Kao +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/md/dm.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 94e4899d..cdbf24de 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -1462,7 +1462,8 @@ static void setup_split_accounting(struct clone_info *ci, unsigned int len) + } + + static void alloc_multiple_bios(struct bio_list *blist, struct clone_info *ci, +- struct dm_target *ti, unsigned int num_bios) ++ struct dm_target *ti, unsigned int num_bios, ++ unsigned *len) + { + struct bio *bio; + int try; +@@ -1473,7 +1474,7 @@ static void alloc_multiple_bios(struct bio_list *blist, struct clone_info *ci, + if (try) + mutex_lock(&ci->io->md->table_devices_lock); + for (bio_nr = 0; bio_nr < num_bios; bio_nr++) { +- bio = alloc_tio(ci, ti, bio_nr, NULL, ++ bio = alloc_tio(ci, ti, bio_nr, len, + try ? GFP_NOIO : GFP_NOWAIT); + if (!bio) + break; +@@ -1511,7 +1512,7 @@ static int __send_duplicate_bios(struct clone_info *ci, struct dm_target *ti, + if (len) + setup_split_accounting(ci, *len); + /* dm_accept_partial_bio() is not supported with shared tio->len_ptr */ +- alloc_multiple_bios(&blist, ci, ti, num_bios); ++ alloc_multiple_bios(&blist, ci, ti, num_bios, len); + while ((clone = bio_list_pop(&blist))) { + dm_tio_set_flag(clone_to_tio(clone), DM_TIO_IS_DUPLICATE_BIO); + __map_bio(clone); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-005-drm-i915-Move-the-DSB-setup-cleaup-into-the-co.patch b/patches.kernel.org/6.2.11-005-drm-i915-Move-the-DSB-setup-cleaup-into-the-co.patch new file mode 100644 index 0000000..6e131ec --- /dev/null +++ b/patches.kernel.org/6.2.11-005-drm-i915-Move-the-DSB-setup-cleaup-into-the-co.patch @@ -0,0 +1,159 @@ +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Wed, 23 Nov 2022 17:26:33 +0200 +Subject: [PATCH] drm/i915: Move the DSB setup/cleaup into the color code +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: efb2b57edf20c32b08eee4ce8b436c459fe4caea + +[ Upstream commit efb2b57edf20c32b08eee4ce8b436c459fe4caea ] + +Since the color management code is the only user of the DSB +at the moment move the DSB prepare/cleanup there too. The +code has to anyway make decisions on whether to use the DSB +or not (and how to use it). Also we'll need a place where we +actually generate the DSB command buffer ahead of time rather +than the current situation where it gets generated too late +during the mmio programming of the hardware. + +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20221123152638.20622-9-ville.syrjala@linux.intel.com +Reviewed-by: Uma Shankar +Stable-dep-of: c880f855d1e2 ("drm/i915: Add a .color_post_update() hook") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/display/intel_color.c | 10 ++++++++ + drivers/gpu/drm/i915/display/intel_color.h | 2 ++ + drivers/gpu/drm/i915/display/intel_display.c | 25 ++++++++------------ + drivers/gpu/drm/i915/display/intel_display.h | 8 +++++++ + 4 files changed, 30 insertions(+), 15 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_color.c b/drivers/gpu/drm/i915/display/intel_color.c +index c3928d28..ff6b8aaa 100644 +--- a/drivers/gpu/drm/i915/display/intel_color.c ++++ b/drivers/gpu/drm/i915/display/intel_color.c +@@ -1220,6 +1220,16 @@ void intel_color_commit_arm(const struct intel_crtc_state *crtc_state) + i915->display.funcs.color->color_commit_arm(crtc_state); + } + ++void intel_color_prepare_commit(struct intel_crtc_state *crtc_state) ++{ ++ intel_dsb_prepare(crtc_state); ++} ++ ++void intel_color_cleanup_commit(struct intel_crtc_state *crtc_state) ++{ ++ intel_dsb_cleanup(crtc_state); ++} ++ + static bool intel_can_preload_luts(const struct intel_crtc_state *new_crtc_state) + { + struct intel_crtc *crtc = to_intel_crtc(new_crtc_state->uapi.crtc); +diff --git a/drivers/gpu/drm/i915/display/intel_color.h b/drivers/gpu/drm/i915/display/intel_color.h +index 2a5ada67..0e854060 100644 +--- a/drivers/gpu/drm/i915/display/intel_color.h ++++ b/drivers/gpu/drm/i915/display/intel_color.h +@@ -17,6 +17,8 @@ void intel_color_init_hooks(struct drm_i915_private *i915); + int intel_color_init(struct drm_i915_private *i915); + void intel_color_crtc_init(struct intel_crtc *crtc); + int intel_color_check(struct intel_crtc_state *crtc_state); ++void intel_color_prepare_commit(struct intel_crtc_state *crtc_state); ++void intel_color_cleanup_commit(struct intel_crtc_state *crtc_state); + void intel_color_commit_noarm(const struct intel_crtc_state *crtc_state); + void intel_color_commit_arm(const struct intel_crtc_state *crtc_state); + void intel_color_load_luts(const struct intel_crtc_state *crtc_state); +diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c +index f0aad240..ca76408b 100644 +--- a/drivers/gpu/drm/i915/display/intel_display.c ++++ b/drivers/gpu/drm/i915/display/intel_display.c +@@ -93,7 +93,6 @@ + #include "intel_dp_link_training.h" + #include "intel_dpio_phy.h" + #include "intel_dpt.h" +-#include "intel_dsb.h" + #include "intel_fbc.h" + #include "intel_fbdev.h" + #include "intel_fdi.h" +@@ -6946,7 +6945,7 @@ static int intel_atomic_prepare_commit(struct intel_atomic_state *state) + + for_each_new_intel_crtc_in_state(state, crtc, crtc_state, i) { + if (intel_crtc_needs_color_update(crtc_state)) +- intel_dsb_prepare(crtc_state); ++ intel_color_prepare_commit(crtc_state); + } + + return 0; +@@ -7399,24 +7398,18 @@ static void intel_atomic_commit_fence_wait(struct intel_atomic_state *intel_stat + &wait_reset); + } + +-static void intel_cleanup_dsbs(struct intel_atomic_state *state) +-{ +- struct intel_crtc_state *old_crtc_state, *new_crtc_state; +- struct intel_crtc *crtc; +- int i; +- +- for_each_oldnew_intel_crtc_in_state(state, crtc, old_crtc_state, +- new_crtc_state, i) +- intel_dsb_cleanup(old_crtc_state); +-} +- + static void intel_atomic_cleanup_work(struct work_struct *work) + { + struct intel_atomic_state *state = + container_of(work, struct intel_atomic_state, base.commit_work); + struct drm_i915_private *i915 = to_i915(state->base.dev); ++ struct intel_crtc_state *old_crtc_state; ++ struct intel_crtc *crtc; ++ int i; ++ ++ for_each_old_intel_crtc_in_state(state, crtc, old_crtc_state, i) ++ intel_color_cleanup_commit(old_crtc_state); + +- intel_cleanup_dsbs(state); + drm_atomic_helper_cleanup_planes(&i915->drm, &state->base); + drm_atomic_helper_commit_cleanup_done(&state->base); + drm_atomic_state_put(&state->base); +@@ -7624,6 +7617,8 @@ static void intel_atomic_commit_tail(struct intel_atomic_state *state) + * DSB cleanup is done in cleanup_work aligning with framebuffer + * cleanup. So copy and reset the dsb structure to sync with + * commit_done and later do dsb cleanup in cleanup_work. ++ * ++ * FIXME get rid of this funny new->old swapping + */ + old_crtc_state->dsb = fetch_and_zero(&new_crtc_state->dsb); + } +@@ -7774,7 +7769,7 @@ static int intel_atomic_commit(struct drm_device *dev, + i915_sw_fence_commit(&state->commit_ready); + + for_each_new_intel_crtc_in_state(state, crtc, new_crtc_state, i) +- intel_dsb_cleanup(new_crtc_state); ++ intel_color_cleanup_commit(new_crtc_state); + + drm_atomic_helper_cleanup_planes(dev, &state->base); + intel_runtime_pm_put(&dev_priv->runtime_pm, state->wakeref); +diff --git a/drivers/gpu/drm/i915/display/intel_display.h b/drivers/gpu/drm/i915/display/intel_display.h +index 71403013..ef73730f 100644 +--- a/drivers/gpu/drm/i915/display/intel_display.h ++++ b/drivers/gpu/drm/i915/display/intel_display.h +@@ -440,6 +440,14 @@ enum hpd_pin { + (__i)++) \ + for_each_if(plane) + ++#define for_each_old_intel_crtc_in_state(__state, crtc, old_crtc_state, __i) \ ++ for ((__i) = 0; \ ++ (__i) < (__state)->base.dev->mode_config.num_crtc && \ ++ ((crtc) = to_intel_crtc((__state)->base.crtcs[__i].ptr), \ ++ (old_crtc_state) = to_intel_crtc_state((__state)->base.crtcs[__i].old_state), 1); \ ++ (__i)++) \ ++ for_each_if(crtc) ++ + #define for_each_new_intel_plane_in_state(__state, plane, new_plane_state, __i) \ + for ((__i) = 0; \ + (__i) < (__state)->base.dev->mode_config.num_total_plane && \ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-006-drm-i915-Add-a-.color_post_update-hook.patch b/patches.kernel.org/6.2.11-006-drm-i915-Add-a-.color_post_update-hook.patch new file mode 100644 index 0000000..ec53447 --- /dev/null +++ b/patches.kernel.org/6.2.11-006-drm-i915-Add-a-.color_post_update-hook.patch @@ -0,0 +1,93 @@ +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Mon, 20 Mar 2023 11:54:35 +0200 +Subject: [PATCH] drm/i915: Add a .color_post_update() hook +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: c880f855d1e240a956dcfce884269bad92fc849c + +[ Upstream commit c880f855d1e240a956dcfce884269bad92fc849c ] + +We're going to need stuff after the color management +register latching has happened. Add a corresponding hook. + +Cc: #v5.19+ +Cc: Manasi Navare +Cc: Drew Davenport +Cc: Imre Deak +Cc: Jouni Högander +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20230320095438.17328-4-ville.syrjala@linux.intel.com +Reviewed-by: Imre Deak +(cherry picked from commit 3962ca4e080a525fc9eae87aa6b2286f1fae351d) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/display/intel_color.c | 13 +++++++++++++ + drivers/gpu/drm/i915/display/intel_color.h | 1 + + drivers/gpu/drm/i915/display/intel_display.c | 3 +++ + 3 files changed, 17 insertions(+) + +diff --git a/drivers/gpu/drm/i915/display/intel_color.c b/drivers/gpu/drm/i915/display/intel_color.c +index ff6b8aaa..85a38d79 100644 +--- a/drivers/gpu/drm/i915/display/intel_color.c ++++ b/drivers/gpu/drm/i915/display/intel_color.c +@@ -46,6 +46,11 @@ struct intel_color_funcs { + * registers involved with the same commit. + */ + void (*color_commit_arm)(const struct intel_crtc_state *crtc_state); ++ /* ++ * Perform any extra tasks needed after all the ++ * double buffered registers have been latched. ++ */ ++ void (*color_post_update)(const struct intel_crtc_state *crtc_state); + /* + * Load LUTs (and other single buffered color management + * registers). Will (hopefully) be called during the vblank +@@ -1220,6 +1225,14 @@ void intel_color_commit_arm(const struct intel_crtc_state *crtc_state) + i915->display.funcs.color->color_commit_arm(crtc_state); + } + ++void intel_color_post_update(const struct intel_crtc_state *crtc_state) ++{ ++ struct drm_i915_private *i915 = to_i915(crtc_state->uapi.crtc->dev); ++ ++ if (i915->display.funcs.color->color_post_update) ++ i915->display.funcs.color->color_post_update(crtc_state); ++} ++ + void intel_color_prepare_commit(struct intel_crtc_state *crtc_state) + { + intel_dsb_prepare(crtc_state); +diff --git a/drivers/gpu/drm/i915/display/intel_color.h b/drivers/gpu/drm/i915/display/intel_color.h +index 0e854060..0256f49c 100644 +--- a/drivers/gpu/drm/i915/display/intel_color.h ++++ b/drivers/gpu/drm/i915/display/intel_color.h +@@ -21,6 +21,7 @@ void intel_color_prepare_commit(struct intel_crtc_state *crtc_state); + void intel_color_cleanup_commit(struct intel_crtc_state *crtc_state); + void intel_color_commit_noarm(const struct intel_crtc_state *crtc_state); + void intel_color_commit_arm(const struct intel_crtc_state *crtc_state); ++void intel_color_post_update(const struct intel_crtc_state *crtc_state); + void intel_color_load_luts(const struct intel_crtc_state *crtc_state); + void intel_color_get_config(struct intel_crtc_state *crtc_state); + int intel_color_get_gamma_bit_precision(const struct intel_crtc_state *crtc_state); +diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c +index ca76408b..2d46dcf8 100644 +--- a/drivers/gpu/drm/i915/display/intel_display.c ++++ b/drivers/gpu/drm/i915/display/intel_display.c +@@ -1263,6 +1263,9 @@ static void intel_post_plane_update(struct intel_atomic_state *state, + if (needs_cursorclk_wa(old_crtc_state) && + !needs_cursorclk_wa(new_crtc_state)) + icl_wa_cursorclkgating(dev_priv, pipe, false); ++ ++ if (intel_crtc_needs_color_update(new_crtc_state)) ++ intel_color_post_update(new_crtc_state); + } + + static void intel_crtc_enable_flip_done(struct intel_atomic_state *state, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-007-gpio-GPIO_REGMAP-select-REGMAP-instead-of-depe.patch b/patches.kernel.org/6.2.11-007-gpio-GPIO_REGMAP-select-REGMAP-instead-of-depe.patch new file mode 100644 index 0000000..d3c50a4 --- /dev/null +++ b/patches.kernel.org/6.2.11-007-gpio-GPIO_REGMAP-select-REGMAP-instead-of-depe.patch @@ -0,0 +1,48 @@ +From: Randy Dunlap +Date: Sat, 25 Feb 2023 21:39:48 -0800 +Subject: [PATCH] gpio: GPIO_REGMAP: select REGMAP instead of depending on it +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: d49765b5f4320a402fbc4ed5edfd73d87640f27c + +[ Upstream commit d49765b5f4320a402fbc4ed5edfd73d87640f27c ] + +REGMAP is a hidden (not user visible) symbol. Users cannot set it +directly thru "make *config", so drivers should select it instead of +depending on it if they need it. + +Consistently using "select" or "depends on" can also help reduce +Kconfig circular dependency issues. + +Therefore, change the use of "depends on REGMAP" to "select REGMAP". + +Fixes: ebe363197e52 ("gpio: add a reusable generic gpio_chip using regmap") +Signed-off-by: Randy Dunlap +Cc: Michael Walle +Cc: Linus Walleij +Cc: Bartosz Golaszewski +Cc: linux-gpio@vger.kernel.org +Acked-by: Michael Walle +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpio/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig +index e9917a45..42e5042d 100644 +--- a/drivers/gpio/Kconfig ++++ b/drivers/gpio/Kconfig +@@ -100,7 +100,7 @@ config GPIO_GENERIC + tristate + + config GPIO_REGMAP +- depends on REGMAP ++ select REGMAP + tristate + + # put drivers in the right section, in alphabetical order +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-008-Drivers-vmbus-Check-for-channel-allocation-bef.patch b/patches.kernel.org/6.2.11-008-Drivers-vmbus-Check-for-channel-allocation-bef.patch new file mode 100644 index 0000000..ed846df --- /dev/null +++ b/patches.kernel.org/6.2.11-008-Drivers-vmbus-Check-for-channel-allocation-bef.patch @@ -0,0 +1,50 @@ +From: Mohammed Gamal +Date: Fri, 17 Feb 2023 22:44:11 +0200 +Subject: [PATCH] Drivers: vmbus: Check for channel allocation before looking + up relids +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 1eb65c8687316c65140b48fad27133d583178e15 + +[ Upstream commit 1eb65c8687316c65140b48fad27133d583178e15 ] + +relid2channel() assumes vmbus channel array to be allocated when called. +However, in cases such as kdump/kexec, not all relids will be reset by the host. +When the second kernel boots and if the guest receives a vmbus interrupt during +vmbus driver initialization before vmbus_connect() is called, before it finishes, +or if it fails, the vmbus interrupt service routine is called which in turn calls +relid2channel() and can cause a null pointer dereference. + +Print a warning and error out in relid2channel() for a channel id that's invalid +in the second kernel. + +Fixes: 8b6a877c060e ("Drivers: hv: vmbus: Replace the per-CPU channel lists with a global array of channels") + +Signed-off-by: Mohammed Gamal +Reviewed-by: Dexuan Cui +Link: https://lore.kernel.org/r/20230217204411.212709-1-mgamal@redhat.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hv/connection.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c +index 9dc27e5d..da51b507 100644 +--- a/drivers/hv/connection.c ++++ b/drivers/hv/connection.c +@@ -409,6 +409,10 @@ void vmbus_disconnect(void) + */ + struct vmbus_channel *relid2channel(u32 relid) + { ++ if (vmbus_connection.channels == NULL) { ++ pr_warn_once("relid2channel: relid=%d: No channels mapped!\n", relid); ++ return NULL; ++ } + if (WARN_ON(relid >= MAX_CHANNEL_RELIDS)) + return NULL; + return READ_ONCE(vmbus_connection.channels[relid]); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-009-ASoC-SOF-ipc4-Ensure-DSP-is-in-D0I0-during-sof.patch b/patches.kernel.org/6.2.11-009-ASoC-SOF-ipc4-Ensure-DSP-is-in-D0I0-during-sof.patch new file mode 100644 index 0000000..dc430e7 --- /dev/null +++ b/patches.kernel.org/6.2.11-009-ASoC-SOF-ipc4-Ensure-DSP-is-in-D0I0-during-sof.patch @@ -0,0 +1,61 @@ +From: Ranjani Sridharan +Date: Wed, 22 Mar 2023 10:55:38 +0200 +Subject: [PATCH] ASoC: SOF: ipc4: Ensure DSP is in D0I0 during + sof_ipc4_set_get_data() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: e51f49512d98783b90799c9cc2002895ec3aa0eb + +[ Upstream commit e51f49512d98783b90799c9cc2002895ec3aa0eb ] + +The set_get_data() IPC op bypasses the check for the no_pm flag as done +with the regular IPC tx_msg op. Since set_get_data should be performed +when the DSP is in D0I0, set the DSP power state to D0I0 before sending +the IPC's in sof_ipc4_set_get_data(). + +Fixes: ceb89acc4dc8 ("ASoC: SOF: ipc4: Add support for mandatory message handling functionality") +Signed-off-by: Ranjani Sridharan +Reviewed-by: Bard Liao +Reviewed-by: Péter Ujfalusi +Reviewed-by: Pierre-Louis Bossart +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20230322085538.10214-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/sof/ipc4.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/sound/soc/sof/ipc4.c b/sound/soc/sof/ipc4.c +index 74cd7e95..280fc890 100644 +--- a/sound/soc/sof/ipc4.c ++++ b/sound/soc/sof/ipc4.c +@@ -393,6 +393,9 @@ static int sof_ipc4_tx_msg(struct snd_sof_dev *sdev, void *msg_data, size_t msg_ + static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data, + size_t payload_bytes, bool set) + { ++ const struct sof_dsp_power_state target_state = { ++ .state = SOF_DSP_PM_D0, ++ }; + size_t payload_limit = sdev->ipc->max_payload_size; + struct sof_ipc4_msg *ipc4_msg = data; + struct sof_ipc4_msg tx = {{ 0 }}; +@@ -423,6 +426,11 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data, + + tx.extension |= SOF_IPC4_MOD_EXT_MSG_FIRST_BLOCK(1); + ++ /* ensure the DSP is in D0i0 before sending IPC */ ++ ret = snd_sof_dsp_set_power_state(sdev, &target_state); ++ if (ret < 0) ++ return ret; ++ + /* Serialise IPC TX */ + mutex_lock(&sdev->ipc->tx_mutex); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-010-pwm-hibvt-Explicitly-set-.polarity-in-.get_sta.patch b/patches.kernel.org/6.2.11-010-pwm-hibvt-Explicitly-set-.polarity-in-.get_sta.patch new file mode 100644 index 0000000..dde3ee1 --- /dev/null +++ b/patches.kernel.org/6.2.11-010-pwm-hibvt-Explicitly-set-.polarity-in-.get_sta.patch @@ -0,0 +1,41 @@ +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Wed, 22 Mar 2023 22:45:40 +0100 +Subject: [PATCH] pwm: hibvt: Explicitly set .polarity in .get_state() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 6f57937980142715e927697a6ffd2050f38ed6f6 + +[ Upstream commit 6f57937980142715e927697a6ffd2050f38ed6f6 ] + +The driver only both polarities. Complete the implementation of +.get_state() by setting .polarity according to the configured hardware +state. + +Fixes: d09f00810850 ("pwm: Add PWM driver for HiSilicon BVT SOCs") +Link: https://lore.kernel.org/r/20230228135508.1798428-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pwm/pwm-hibvt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pwm/pwm-hibvt.c b/drivers/pwm/pwm-hibvt.c +index 12c05c15..1b9274c5 100644 +--- a/drivers/pwm/pwm-hibvt.c ++++ b/drivers/pwm/pwm-hibvt.c +@@ -146,6 +146,7 @@ static int hibvt_pwm_get_state(struct pwm_chip *chip, struct pwm_device *pwm, + + value = readl(base + PWM_CTRL_ADDR(pwm->hwpwm)); + state->enabled = (PWM_ENABLE_MASK & value); ++ state->polarity = (PWM_POLARITY_MASK & value) ? PWM_POLARITY_INVERSED : PWM_POLARITY_NORMAL; + + return 0; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-011-pwm-cros-ec-Explicitly-set-.polarity-in-.get_s.patch b/patches.kernel.org/6.2.11-011-pwm-cros-ec-Explicitly-set-.polarity-in-.get_s.patch new file mode 100644 index 0000000..521f2f1 --- /dev/null +++ b/patches.kernel.org/6.2.11-011-pwm-cros-ec-Explicitly-set-.polarity-in-.get_s.patch @@ -0,0 +1,41 @@ +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Wed, 22 Mar 2023 22:45:41 +0100 +Subject: [PATCH] pwm: cros-ec: Explicitly set .polarity in .get_state() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 30006b77c7e130e01d1ab2148cc8abf73dfcc4bf + +[ Upstream commit 30006b77c7e130e01d1ab2148cc8abf73dfcc4bf ] + +The driver only supports normal polarity. Complete the implementation of +.get_state() by setting .polarity accordingly. + +Reviewed-by: Guenter Roeck +Fixes: 1f0d3bb02785 ("pwm: Add ChromeOS EC PWM driver") +Link: https://lore.kernel.org/r/20230228135508.1798428-3-u.kleine-koenig@pengutronix.de +Signed-off-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pwm/pwm-cros-ec.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pwm/pwm-cros-ec.c b/drivers/pwm/pwm-cros-ec.c +index 86df6702..ad18b0eb 100644 +--- a/drivers/pwm/pwm-cros-ec.c ++++ b/drivers/pwm/pwm-cros-ec.c +@@ -198,6 +198,7 @@ static int cros_ec_pwm_get_state(struct pwm_chip *chip, struct pwm_device *pwm, + + state->enabled = (ret > 0); + state->period = EC_PWM_MAX_DUTY; ++ state->polarity = PWM_POLARITY_NORMAL; + + /* + * Note that "disabled" and "duty cycle == 0" are treated the same. If +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-012-pwm-iqs620a-Explicitly-set-.polarity-in-.get_s.patch b/patches.kernel.org/6.2.11-012-pwm-iqs620a-Explicitly-set-.polarity-in-.get_s.patch new file mode 100644 index 0000000..b7b4709 --- /dev/null +++ b/patches.kernel.org/6.2.11-012-pwm-iqs620a-Explicitly-set-.polarity-in-.get_s.patch @@ -0,0 +1,41 @@ +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Wed, 22 Mar 2023 22:45:42 +0100 +Subject: [PATCH] pwm: iqs620a: Explicitly set .polarity in .get_state() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: b20b097128d9145fadcea1cbb45c4d186cb57466 + +[ Upstream commit b20b097128d9145fadcea1cbb45c4d186cb57466 ] + +The driver only supports normal polarity. Complete the implementation of +.get_state() by setting .polarity accordingly. + +Fixes: 6f0841a8197b ("pwm: Add support for Azoteq IQS620A PWM generator") +Reviewed-by: Jeff LaBundy +Link: https://lore.kernel.org/r/20230228135508.1798428-4-u.kleine-koenig@pengutronix.de +Signed-off-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pwm/pwm-iqs620a.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pwm/pwm-iqs620a.c b/drivers/pwm/pwm-iqs620a.c +index 4987ca94..01208c2f 100644 +--- a/drivers/pwm/pwm-iqs620a.c ++++ b/drivers/pwm/pwm-iqs620a.c +@@ -126,6 +126,7 @@ static int iqs620_pwm_get_state(struct pwm_chip *chip, struct pwm_device *pwm, + mutex_unlock(&iqs620_pwm->lock); + + state->period = IQS620_PWM_PERIOD_NS; ++ state->polarity = PWM_POLARITY_NORMAL; + + return 0; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-013-pwm-sprd-Explicitly-set-.polarity-in-.get_stat.patch b/patches.kernel.org/6.2.11-013-pwm-sprd-Explicitly-set-.polarity-in-.get_stat.patch new file mode 100644 index 0000000..6b44147 --- /dev/null +++ b/patches.kernel.org/6.2.11-013-pwm-sprd-Explicitly-set-.polarity-in-.get_stat.patch @@ -0,0 +1,40 @@ +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Wed, 22 Mar 2023 22:45:43 +0100 +Subject: [PATCH] pwm: sprd: Explicitly set .polarity in .get_state() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 2be4dcf6627e1bcbbef8e6ba1811f5127d39202c + +[ Upstream commit 2be4dcf6627e1bcbbef8e6ba1811f5127d39202c ] + +The driver only supports normal polarity. Complete the implementation of +.get_state() by setting .polarity accordingly. + +Fixes: 8aae4b02e8a6 ("pwm: sprd: Add Spreadtrum PWM support") +Link: https://lore.kernel.org/r/20230228135508.1798428-5-u.kleine-koenig@pengutronix.de +Signed-off-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pwm/pwm-sprd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pwm/pwm-sprd.c b/drivers/pwm/pwm-sprd.c +index d866ce34..bde579a3 100644 +--- a/drivers/pwm/pwm-sprd.c ++++ b/drivers/pwm/pwm-sprd.c +@@ -109,6 +109,7 @@ static int sprd_pwm_get_state(struct pwm_chip *chip, struct pwm_device *pwm, + duty = val & SPRD_PWM_DUTY_MSK; + tmp = (prescale + 1) * NSEC_PER_SEC * duty; + state->duty_cycle = DIV_ROUND_CLOSEST_ULL(tmp, chn->clk_rate); ++ state->polarity = PWM_POLARITY_NORMAL; + + /* Disable PWM clocks if the PWM channel is not in enable state. */ + if (!state->enabled) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-014-pwm-meson-Explicitly-set-.polarity-in-.get_sta.patch b/patches.kernel.org/6.2.11-014-pwm-meson-Explicitly-set-.polarity-in-.get_sta.patch new file mode 100644 index 0000000..772e916 --- /dev/null +++ b/patches.kernel.org/6.2.11-014-pwm-meson-Explicitly-set-.polarity-in-.get_sta.patch @@ -0,0 +1,68 @@ +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Wed, 22 Mar 2023 22:45:44 +0100 +Subject: [PATCH] pwm: meson: Explicitly set .polarity in .get_state() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 8caa81eb950cb2e9d2d6959b37d853162d197f57 + +[ Upstream commit 8caa81eb950cb2e9d2d6959b37d853162d197f57 ] + +The driver only supports normal polarity. Complete the implementation of +.get_state() by setting .polarity accordingly. + +This fixes a regression that was possible since commit c73a3107624d +("pwm: Handle .get_state() failures") which stopped to zero-initialize +the state passed to the .get_state() callback. This was reported at +https://forum.odroid.com/viewtopic.php?f=177&t=46360 . While this was an +unintended side effect, the real issue is the driver's callback not +setting the polarity. + +There is a complicating fact, that the .apply() callback fakes support +for inversed polarity. This is not (and cannot) be matched by +.get_state(). As fixing this isn't easy, only point it out in a comment +to prevent authors of other drivers from copying that approach. + +Fixes: c375bcbaabdb ("pwm: meson: Read the full hardware state in meson_pwm_get_state()") +Reported-by: Munehisa Kamata +Acked-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20230310191405.2606296-1-u.kleine-koenig@pengutronix.de +Signed-off-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pwm/pwm-meson.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c +index 16d79ca5..5cd7b908 100644 +--- a/drivers/pwm/pwm-meson.c ++++ b/drivers/pwm/pwm-meson.c +@@ -162,6 +162,12 @@ static int meson_pwm_calc(struct meson_pwm *meson, struct pwm_device *pwm, + duty = state->duty_cycle; + period = state->period; + ++ /* ++ * Note this is wrong. The result is an output wave that isn't really ++ * inverted and so is wrongly identified by .get_state as normal. ++ * Fixing this needs some care however as some machines might rely on ++ * this. ++ */ + if (state->polarity == PWM_POLARITY_INVERSED) + duty = period - duty; + +@@ -358,6 +364,8 @@ static int meson_pwm_get_state(struct pwm_chip *chip, struct pwm_device *pwm, + state->duty_cycle = 0; + } + ++ state->polarity = PWM_POLARITY_NORMAL; ++ + return 0; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-015-ASoC-codecs-lpass-fix-the-order-or-clks-turn-o.patch b/patches.kernel.org/6.2.11-015-ASoC-codecs-lpass-fix-the-order-or-clks-turn-o.patch new file mode 100644 index 0000000..a44ef26 --- /dev/null +++ b/patches.kernel.org/6.2.11-015-ASoC-codecs-lpass-fix-the-order-or-clks-turn-o.patch @@ -0,0 +1,86 @@ +From: Srinivas Kandagatla +Date: Thu, 23 Mar 2023 11:01:25 +0000 +Subject: [PATCH] ASoC: codecs: lpass: fix the order or clks turn off during + suspend +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: a4a3203426f4b67535d6442ddc5dca8878a0678f + +[ Upstream commit a4a3203426f4b67535d6442ddc5dca8878a0678f ] + +The order in which clocks are stopped matters as some of the clock +like NPL are derived from MCLK. + +Without this patch, Dragonboard RB5 DSP would crash with below error: + qcom_q6v5_pas 17300000.remoteproc: fatal error received: + ABT_dal.c:278:ABTimeout: AHB Bus hang is detected, + Number of bus hang detected := 2 , addr0 = 0x3370000 , addr1 = 0x0!!! + +Turn off fsgen first, followed by npl and then finally mclk, which is exactly +the opposite order of enable sequence. + +Fixes: 1dc3459009c3 ("ASoC: codecs: lpass: register mclk after runtime pm") +Reported-by: Amit Pundir +Signed-off-by: Srinivas Kandagatla +Tested-by: Amit Pundir +Link: https://lore.kernel.org/r/20230323110125.23790-1-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/codecs/lpass-rx-macro.c | 4 ++-- + sound/soc/codecs/lpass-tx-macro.c | 4 ++-- + sound/soc/codecs/lpass-wsa-macro.c | 4 ++-- + 3 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c +index 8621cfab..1639f3b6 100644 +--- a/sound/soc/codecs/lpass-rx-macro.c ++++ b/sound/soc/codecs/lpass-rx-macro.c +@@ -3667,9 +3667,9 @@ static int __maybe_unused rx_macro_runtime_suspend(struct device *dev) + regcache_cache_only(rx->regmap, true); + regcache_mark_dirty(rx->regmap); + +- clk_disable_unprepare(rx->mclk); +- clk_disable_unprepare(rx->npl); + clk_disable_unprepare(rx->fsgen); ++ clk_disable_unprepare(rx->npl); ++ clk_disable_unprepare(rx->mclk); + + return 0; + } +diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c +index 8facdb92..9f33289c 100644 +--- a/sound/soc/codecs/lpass-tx-macro.c ++++ b/sound/soc/codecs/lpass-tx-macro.c +@@ -2093,9 +2093,9 @@ static int __maybe_unused tx_macro_runtime_suspend(struct device *dev) + regcache_cache_only(tx->regmap, true); + regcache_mark_dirty(tx->regmap); + +- clk_disable_unprepare(tx->mclk); +- clk_disable_unprepare(tx->npl); + clk_disable_unprepare(tx->fsgen); ++ clk_disable_unprepare(tx->npl); ++ clk_disable_unprepare(tx->mclk); + + return 0; + } +diff --git a/sound/soc/codecs/lpass-wsa-macro.c b/sound/soc/codecs/lpass-wsa-macro.c +index c0b86d69..01149b20 100644 +--- a/sound/soc/codecs/lpass-wsa-macro.c ++++ b/sound/soc/codecs/lpass-wsa-macro.c +@@ -2504,9 +2504,9 @@ static int __maybe_unused wsa_macro_runtime_suspend(struct device *dev) + regcache_cache_only(wsa->regmap, true); + regcache_mark_dirty(wsa->regmap); + +- clk_disable_unprepare(wsa->mclk); +- clk_disable_unprepare(wsa->npl); + clk_disable_unprepare(wsa->fsgen); ++ clk_disable_unprepare(wsa->npl); ++ clk_disable_unprepare(wsa->mclk); + + return 0; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-016-KVM-s390-pv-fix-external-interruption-loop-not.patch b/patches.kernel.org/6.2.11-016-KVM-s390-pv-fix-external-interruption-loop-not.patch new file mode 100644 index 0000000..a3c8fea --- /dev/null +++ b/patches.kernel.org/6.2.11-016-KVM-s390-pv-fix-external-interruption-loop-not.patch @@ -0,0 +1,102 @@ +From: Nico Boehr +Date: Mon, 13 Feb 2023 09:55:20 +0100 +Subject: [PATCH] KVM: s390: pv: fix external interruption loop not always + detected +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 21f27df854008b86349a203bf97fef79bb11f53e + +[ Upstream commit 21f27df854008b86349a203bf97fef79bb11f53e ] + +To determine whether the guest has caused an external interruption loop +upon code 20 (external interrupt) intercepts, the ext_new_psw needs to +be inspected to see whether external interrupts are enabled. + +Under non-PV, ext_new_psw can simply be taken from guest lowcore. Under +PV, KVM can only access the encrypted guest lowcore and hence the +ext_new_psw must not be taken from guest lowcore. + +handle_external_interrupt() incorrectly did that and hence was not able +to reliably tell whether an external interruption loop is happening or +not. False negatives cause spurious failures of my kvm-unit-test +for extint loops[1] under PV. + +Since code 20 is only caused under PV if and only if the guest's +ext_new_psw is enabled for external interrupts, false positive detection +of a external interruption loop can not happen. + +Fix this issue by instead looking at the guest PSW in the state +description. Since the PSW swap for external interrupt is done by the +ultravisor before the intercept is caused, this reliably tells whether +the guest is enabled for external interrupts in the ext_new_psw. + +Also update the comments to explain better what is happening. + +[1] https://lore.kernel.org/kvm/20220812062151.1980937-4-nrb@linux.ibm.com/ + +Signed-off-by: Nico Boehr +Reviewed-by: Janosch Frank +Reviewed-by: Christian Borntraeger +Fixes: 201ae986ead7 ("KVM: s390: protvirt: Implement interrupt injection") +Link: https://lore.kernel.org/r/20230213085520.100756-2-nrb@linux.ibm.com +Message-Id: <20230213085520.100756-2-nrb@linux.ibm.com> +Signed-off-by: Janosch Frank +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/s390/kvm/intercept.c | 32 ++++++++++++++++++++++++-------- + 1 file changed, 24 insertions(+), 8 deletions(-) + +diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c +index 0ee02dae..2cda8d9d 100644 +--- a/arch/s390/kvm/intercept.c ++++ b/arch/s390/kvm/intercept.c +@@ -271,10 +271,18 @@ static int handle_prog(struct kvm_vcpu *vcpu) + * handle_external_interrupt - used for external interruption interceptions + * @vcpu: virtual cpu + * +- * This interception only occurs if the CPUSTAT_EXT_INT bit was set, or if +- * the new PSW does not have external interrupts disabled. In the first case, +- * we've got to deliver the interrupt manually, and in the second case, we +- * drop to userspace to handle the situation there. ++ * This interception occurs if: ++ * - the CPUSTAT_EXT_INT bit was already set when the external interrupt ++ * occurred. In this case, the interrupt needs to be injected manually to ++ * preserve interrupt priority. ++ * - the external new PSW has external interrupts enabled, which will cause an ++ * interruption loop. We drop to userspace in this case. ++ * ++ * The latter case can be detected by inspecting the external mask bit in the ++ * external new psw. ++ * ++ * Under PV, only the latter case can occur, since interrupt priorities are ++ * handled in the ultravisor. + */ + static int handle_external_interrupt(struct kvm_vcpu *vcpu) + { +@@ -285,10 +293,18 @@ static int handle_external_interrupt(struct kvm_vcpu *vcpu) + + vcpu->stat.exit_external_interrupt++; + +- rc = read_guest_lc(vcpu, __LC_EXT_NEW_PSW, &newpsw, sizeof(psw_t)); +- if (rc) +- return rc; +- /* We can not handle clock comparator or timer interrupt with bad PSW */ ++ if (kvm_s390_pv_cpu_is_protected(vcpu)) { ++ newpsw = vcpu->arch.sie_block->gpsw; ++ } else { ++ rc = read_guest_lc(vcpu, __LC_EXT_NEW_PSW, &newpsw, sizeof(psw_t)); ++ if (rc) ++ return rc; ++ } ++ ++ /* ++ * Clock comparator or timer interrupt with external interrupt enabled ++ * will cause interrupt loop. Drop to userspace. ++ */ + if ((eic == EXT_IRQ_CLK_COMP || eic == EXT_IRQ_CPU_TIMER) && + (newpsw.mask & PSW_MASK_EXT)) + return -EOPNOTSUPP; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-017-wifi-mac80211-fix-the-size-calculation-of-ieee.patch b/patches.kernel.org/6.2.11-017-wifi-mac80211-fix-the-size-calculation-of-ieee.patch new file mode 100644 index 0000000..36e7d2c --- /dev/null +++ b/patches.kernel.org/6.2.11-017-wifi-mac80211-fix-the-size-calculation-of-ieee.patch @@ -0,0 +1,38 @@ +From: Ryder Lee +Date: Tue, 28 Mar 2023 01:07:41 +0800 +Subject: [PATCH] wifi: mac80211: fix the size calculation of + ieee80211_ie_len_eht_cap() +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: dd01579e5ed922dcfcb8fec53fa03b81c7649a04 + +[ Upstream commit dd01579e5ed922dcfcb8fec53fa03b81c7649a04 ] + +Here should return the size of ieee80211_eht_cap_elem_fixed, so fix it. + +Fixes: 820acc810fb6 ("mac80211: Add EHT capabilities to association/probe request") +Signed-off-by: Ryder Lee +Link: https://lore.kernel.org/r/06c13635fc03bcff58a647b8e03e9f01a74294bd.1679935259.git.ryder.lee@mediatek.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/mac80211/util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/util.c b/net/mac80211/util.c +index 9c219e52..ed9e659f 100644 +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -4906,7 +4906,7 @@ u8 ieee80211_ie_len_eht_cap(struct ieee80211_sub_if_data *sdata, u8 iftype) + &eht_cap->eht_cap_elem, + is_ap); + return 2 + 1 + +- sizeof(he_cap->he_cap_elem) + n + ++ sizeof(eht_cap->eht_cap_elem) + n + + ieee80211_eht_ppe_size(eht_cap->eht_ppe_thres[0], + eht_cap->eht_cap_elem.phy_cap_info); + return 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-018-wifi-mac80211-fix-invalid-drv_sta_pre_rcu_remo.patch b/patches.kernel.org/6.2.11-018-wifi-mac80211-fix-invalid-drv_sta_pre_rcu_remo.patch new file mode 100644 index 0000000..f970ac2 --- /dev/null +++ b/patches.kernel.org/6.2.11-018-wifi-mac80211-fix-invalid-drv_sta_pre_rcu_remo.patch @@ -0,0 +1,41 @@ +From: Felix Fietkau +Date: Fri, 24 Mar 2023 13:09:24 +0100 +Subject: [PATCH] wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for + non-uploaded sta +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 12b220a6171faf10638ab683a975cadcf1a352d6 + +[ Upstream commit 12b220a6171faf10638ab683a975cadcf1a352d6 ] + +Avoid potential data corruption issues caused by uninitialized driver +private data structures. + +Reported-by: Brian Coverstone +Fixes: 6a9d1b91f34d ("mac80211: add pre-RCU-sync sta removal driver operation") +Signed-off-by: Felix Fietkau +Link: https://lore.kernel.org/r/20230324120924.38412-3-nbd@nbd.name +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/mac80211/sta_info.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index 34cb833d..39731ef5 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -1261,7 +1261,8 @@ static int __must_check __sta_info_destroy_part1(struct sta_info *sta) + list_del_rcu(&sta->list); + sta->removed = true; + +- drv_sta_pre_rcu_remove(local, sta->sdata, sta); ++ if (sta->uploaded) ++ drv_sta_pre_rcu_remove(local, sta->sdata, sta); + + if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN && + rcu_access_pointer(sdata->u.vlan.sta) == sta) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-019-net-qrtr-Fix-a-refcount-bug-in-qrtr_recvmsg.patch b/patches.kernel.org/6.2.11-019-net-qrtr-Fix-a-refcount-bug-in-qrtr_recvmsg.patch new file mode 100644 index 0000000..0366cf8 --- /dev/null +++ b/patches.kernel.org/6.2.11-019-net-qrtr-Fix-a-refcount-bug-in-qrtr_recvmsg.patch @@ -0,0 +1,78 @@ +From: Ziyang Xuan +Date: Thu, 30 Mar 2023 09:25:32 +0800 +Subject: [PATCH] net: qrtr: Fix a refcount bug in qrtr_recvmsg() +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 44d807320000db0d0013372ad39b53e12d52f758 + +[ Upstream commit 44d807320000db0d0013372ad39b53e12d52f758 ] + +Syzbot reported a bug as following: + +refcount_t: addition on 0; use-after-free. +... +RIP: 0010:refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25 +... +Call Trace: + + __refcount_add include/linux/refcount.h:199 [inline] + __refcount_inc include/linux/refcount.h:250 [inline] + refcount_inc include/linux/refcount.h:267 [inline] + kref_get include/linux/kref.h:45 [inline] + qrtr_node_acquire net/qrtr/af_qrtr.c:202 [inline] + qrtr_node_lookup net/qrtr/af_qrtr.c:398 [inline] + qrtr_send_resume_tx net/qrtr/af_qrtr.c:1003 [inline] + qrtr_recvmsg+0x85f/0x990 net/qrtr/af_qrtr.c:1070 + sock_recvmsg_nosec net/socket.c:1017 [inline] + sock_recvmsg+0xe2/0x160 net/socket.c:1038 + qrtr_ns_worker+0x170/0x1700 net/qrtr/ns.c:688 + process_one_work+0x991/0x15c0 kernel/workqueue.c:2390 + worker_thread+0x669/0x1090 kernel/workqueue.c:2537 + +It occurs in the concurrent scenario of qrtr_recvmsg() and +qrtr_endpoint_unregister() as following: + + cpu0 cpu1 +qrtr_recvmsg qrtr_endpoint_unregister +qrtr_send_resume_tx qrtr_node_release +qrtr_node_lookup mutex_lock(&qrtr_node_lock) +spin_lock_irqsave(&qrtr_nodes_lock, ) refcount_dec_and_test(&node->ref) [node->ref == 0] +radix_tree_lookup [node != NULL] __qrtr_node_release +qrtr_node_acquire spin_lock_irqsave(&qrtr_nodes_lock, ) +kref_get(&node->ref) [WARNING] ... + mutex_unlock(&qrtr_node_lock) + +Use qrtr_node_lock to protect qrtr_node_lookup() implementation, this +is actually improving the protection of node reference. + +Fixes: 0a7e0d0ef054 ("net: qrtr: Migrate node lookup tree to spinlock") +Reported-by: syzbot+a7492efaa5d61b51db23@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?extid=a7492efaa5d61b51db23 +Signed-off-by: Ziyang Xuan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/qrtr/af_qrtr.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c +index 5c2fb992..3a70255c 100644 +--- a/net/qrtr/af_qrtr.c ++++ b/net/qrtr/af_qrtr.c +@@ -393,10 +393,12 @@ static struct qrtr_node *qrtr_node_lookup(unsigned int nid) + struct qrtr_node *node; + unsigned long flags; + ++ mutex_lock(&qrtr_node_lock); + spin_lock_irqsave(&qrtr_nodes_lock, flags); + node = radix_tree_lookup(&qrtr_nodes, nid); + node = qrtr_node_acquire(node); + spin_unlock_irqrestore(&qrtr_nodes_lock, flags); ++ mutex_unlock(&qrtr_node_lock); + + return node; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-020-net-phylink-add-phylink_expects_phy-method.patch b/patches.kernel.org/6.2.11-020-net-phylink-add-phylink_expects_phy-method.patch new file mode 100644 index 0000000..ca94508 --- /dev/null +++ b/patches.kernel.org/6.2.11-020-net-phylink-add-phylink_expects_phy-method.patch @@ -0,0 +1,72 @@ +From: Michael Sit Wei Hong +Date: Thu, 30 Mar 2023 17:14:02 +0800 +Subject: [PATCH] net: phylink: add phylink_expects_phy() method +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 653a180957a85c3fc30320cc7e84f5dc913a64f8 + +[ Upstream commit 653a180957a85c3fc30320cc7e84f5dc913a64f8 ] + +Provide phylink_expects_phy() to allow MAC drivers to check if it +is expecting a PHY to attach to. Since fixed-linked setups do not +need to attach to a PHY. + +Provides a boolean value as to if the MAC should expect a PHY. +Returns true if a PHY is expected. + +Reviewed-by: Russell King (Oracle) +Signed-off-by: Michael Sit Wei Hong +Signed-off-by: David S. Miller +Stable-dep-of: fe2cfbc96803 ("net: stmmac: check if MAC needs to attach to a PHY") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/phy/phylink.c | 19 +++++++++++++++++++ + include/linux/phylink.h | 1 + + 2 files changed, 20 insertions(+) + +diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c +index 4d2519cd..bf8a8ed5 100644 +--- a/drivers/net/phy/phylink.c ++++ b/drivers/net/phy/phylink.c +@@ -1571,6 +1571,25 @@ void phylink_destroy(struct phylink *pl) + } + EXPORT_SYMBOL_GPL(phylink_destroy); + ++/** ++ * phylink_expects_phy() - Determine if phylink expects a phy to be attached ++ * @pl: a pointer to a &struct phylink returned from phylink_create() ++ * ++ * When using fixed-link mode, or in-band mode with 1000base-X or 2500base-X, ++ * no PHY is needed. ++ * ++ * Returns true if phylink will be expecting a PHY. ++ */ ++bool phylink_expects_phy(struct phylink *pl) ++{ ++ if (pl->cfg_link_an_mode == MLO_AN_FIXED || ++ (pl->cfg_link_an_mode == MLO_AN_INBAND && ++ phy_interface_mode_is_8023z(pl->link_config.interface))) ++ return false; ++ return true; ++} ++EXPORT_SYMBOL_GPL(phylink_expects_phy); ++ + static void phylink_phy_change(struct phy_device *phydev, bool up) + { + struct phylink *pl = phydev->phylink; +diff --git a/include/linux/phylink.h b/include/linux/phylink.h +index c492c262..637698ed 100644 +--- a/include/linux/phylink.h ++++ b/include/linux/phylink.h +@@ -574,6 +574,7 @@ struct phylink *phylink_create(struct phylink_config *, struct fwnode_handle *, + phy_interface_t iface, + const struct phylink_mac_ops *mac_ops); + void phylink_destroy(struct phylink *); ++bool phylink_expects_phy(struct phylink *pl); + + int phylink_connect_phy(struct phylink *, struct phy_device *); + int phylink_of_phy_connect(struct phylink *, struct device_node *, u32 flags); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-021-net-stmmac-check-if-MAC-needs-to-attach-to-a-P.patch b/patches.kernel.org/6.2.11-021-net-stmmac-check-if-MAC-needs-to-attach-to-a-P.patch new file mode 100644 index 0000000..d512abf --- /dev/null +++ b/patches.kernel.org/6.2.11-021-net-stmmac-check-if-MAC-needs-to-attach-to-a-P.patch @@ -0,0 +1,54 @@ +From: Michael Sit Wei Hong +Date: Thu, 30 Mar 2023 17:14:03 +0800 +Subject: [PATCH] net: stmmac: check if MAC needs to attach to a PHY +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: fe2cfbc9680356a3d9f8adde8a38e715831e32f5 + +[ Upstream commit fe2cfbc9680356a3d9f8adde8a38e715831e32f5 ] + +After the introduction of the fixed-link support, the MAC driver +no longer attempt to scan for a PHY to attach to. This causes the +non fixed-link setups to stop working. + +Using the phylink_expects_phy() to check and determine if the MAC +should expect and attach a PHY. + +Fixes: ab21cf920928 ("net: stmmac: make mdio register skips PHY scanning for fixed-link") +Signed-off-by: Michael Sit Wei Hong +Signed-off-by: Lai Peter Jun Ann +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 7389718b..20b51a39 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -1135,6 +1135,7 @@ static int stmmac_init_phy(struct net_device *dev) + { + struct stmmac_priv *priv = netdev_priv(dev); + struct fwnode_handle *fwnode; ++ bool phy_needed; + int ret; + + fwnode = of_fwnode_handle(priv->plat->phylink_node); +@@ -1144,10 +1145,11 @@ static int stmmac_init_phy(struct net_device *dev) + if (fwnode) + ret = phylink_fwnode_phy_connect(priv->phylink, fwnode, 0); + ++ phy_needed = phylink_expects_phy(priv->phylink); + /* Some DT bindings do not set-up the PHY handle. Let's try to + * manually parse it + */ +- if (!fwnode || ret) { ++ if (!fwnode || phy_needed || ret) { + int addr = priv->plat->phy_addr; + struct phy_device *phydev; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-022-net-stmmac-remove-redundant-fixup-to-support-f.patch b/patches.kernel.org/6.2.11-022-net-stmmac-remove-redundant-fixup-to-support-f.patch new file mode 100644 index 0000000..a7b27fc --- /dev/null +++ b/patches.kernel.org/6.2.11-022-net-stmmac-remove-redundant-fixup-to-support-f.patch @@ -0,0 +1,45 @@ +From: Michael Sit Wei Hong +Date: Thu, 30 Mar 2023 17:14:04 +0800 +Subject: [PATCH] net: stmmac: remove redundant fixup to support fixed-link + mode +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 6fc21a6ed5953b1dd3a41ce7be1ea57f5ef8c081 + +[ Upstream commit 6fc21a6ed5953b1dd3a41ce7be1ea57f5ef8c081 ] + +Currently, intel_speed_mode_2500() will fix-up xpcs_an_inband +to 1 if the underlying controller has a max speed of 1000Mbps. +The value has been initialized and modified if it is +a fixed-linked setup earlier. + +This patch removes the fix-up to allow for fixed-linked setup +support. In stmmac_phy_setup(), ovr_an_inband is set based on +the value of xpcs_an_inband. Which in turn will return an +error in phylink_parse_mode() where MLO_AN_FIXED and +ovr_an_inband are both set. + +Fixes: c82386310d95 ("stmmac: intel: prepare to support 1000BASE-X phy interface setting") +Signed-off-by: Michael Sit Wei Hong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c +index 13aa9196..ab9f876b 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c +@@ -251,7 +251,6 @@ static void intel_speed_mode_2500(struct net_device *ndev, void *intel_data) + priv->plat->mdio_bus_data->xpcs_an_inband = false; + } else { + priv->plat->max_speed = 1000; +- priv->plat->mdio_bus_data->xpcs_an_inband = true; + } + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-023-l2tp-generate-correct-module-alias-strings.patch b/patches.kernel.org/6.2.11-023-l2tp-generate-correct-module-alias-strings.patch new file mode 100644 index 0000000..23b4906 --- /dev/null +++ b/patches.kernel.org/6.2.11-023-l2tp-generate-correct-module-alias-strings.patch @@ -0,0 +1,83 @@ +From: Andrea Righi +Date: Thu, 30 Mar 2023 11:54:42 +0200 +Subject: [PATCH] l2tp: generate correct module alias strings +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 154e07c164859fc90bf4e8143f2f6c1af9f3a35e + +[ Upstream commit 154e07c164859fc90bf4e8143f2f6c1af9f3a35e ] + +Commit 65b32f801bfb ("uapi: move IPPROTO_L2TP to in.h") moved the +definition of IPPROTO_L2TP from a define to an enum, but since +__stringify doesn't work properly with enums, we ended up breaking the +modalias strings for the l2tp modules: + + $ modinfo l2tp_ip l2tp_ip6 | grep alias + alias: net-pf-2-proto-IPPROTO_L2TP + alias: net-pf-2-proto-2-type-IPPROTO_L2TP + alias: net-pf-10-proto-IPPROTO_L2TP + alias: net-pf-10-proto-2-type-IPPROTO_L2TP + +Use the resolved number directly in MODULE_ALIAS_*() macros (as we +already do with SOCK_DGRAM) to fix the alias strings: + +$ modinfo l2tp_ip l2tp_ip6 | grep alias +alias: net-pf-2-proto-115 +alias: net-pf-2-proto-115-type-2 +alias: net-pf-10-proto-115 +alias: net-pf-10-proto-115-type-2 + +Moreover, fix the ordering of the parameters passed to +MODULE_ALIAS_NET_PF_PROTO_TYPE() by switching proto and type. + +Fixes: 65b32f801bfb ("uapi: move IPPROTO_L2TP to in.h") +Link: https://lore.kernel.org/lkml/ZCQt7hmodtUaBlCP@righiandr-XPS-13-7390 +Signed-off-by: Guillaume Nault +Signed-off-by: Andrea Righi +Reviewed-by: Wojciech Drewek +Tested-by: Wojciech Drewek +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/l2tp/l2tp_ip.c | 8 ++++---- + net/l2tp/l2tp_ip6.c | 8 ++++---- + 2 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c +index 4db5a554..41a74fc8 100644 +--- a/net/l2tp/l2tp_ip.c ++++ b/net/l2tp/l2tp_ip.c +@@ -677,8 +677,8 @@ MODULE_AUTHOR("James Chapman "); + MODULE_DESCRIPTION("L2TP over IP"); + MODULE_VERSION("1.0"); + +-/* Use the value of SOCK_DGRAM (2) directory, because __stringify doesn't like +- * enums ++/* Use the values of SOCK_DGRAM (2) as type and IPPROTO_L2TP (115) as protocol, ++ * because __stringify doesn't like enums + */ +-MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 2, IPPROTO_L2TP); +-MODULE_ALIAS_NET_PF_PROTO(PF_INET, IPPROTO_L2TP); ++MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 115, 2); ++MODULE_ALIAS_NET_PF_PROTO(PF_INET, 115); +diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c +index 2478aa60..5137ea18 100644 +--- a/net/l2tp/l2tp_ip6.c ++++ b/net/l2tp/l2tp_ip6.c +@@ -806,8 +806,8 @@ MODULE_AUTHOR("Chris Elston "); + MODULE_DESCRIPTION("L2TP IP encapsulation for IPv6"); + MODULE_VERSION("1.0"); + +-/* Use the value of SOCK_DGRAM (2) directory, because __stringify doesn't like +- * enums ++/* Use the values of SOCK_DGRAM (2) as type and IPPROTO_L2TP (115) as protocol, ++ * because __stringify doesn't like enums + */ +-MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET6, 2, IPPROTO_L2TP); +-MODULE_ALIAS_NET_PF_PROTO(PF_INET6, IPPROTO_L2TP); ++MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET6, 115, 2); ++MODULE_ALIAS_NET_PF_PROTO(PF_INET6, 115); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-024-wifi-brcmfmac-Fix-SDIO-suspend-resume-regressi.patch b/patches.kernel.org/6.2.11-024-wifi-brcmfmac-Fix-SDIO-suspend-resume-regressi.patch new file mode 100644 index 0000000..05b7094 --- /dev/null +++ b/patches.kernel.org/6.2.11-024-wifi-brcmfmac-Fix-SDIO-suspend-resume-regressi.patch @@ -0,0 +1,163 @@ +From: Hans de Goede +Date: Mon, 20 Mar 2023 13:22:52 +0100 +Subject: [PATCH] wifi: brcmfmac: Fix SDIO suspend/resume regression +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: e4efa515d58f1363d8a27e548f9c5769d3121e03 + +[ Upstream commit e4efa515d58f1363d8a27e548f9c5769d3121e03 ] + +After commit 92cadedd9d5f ("brcmfmac: Avoid keeping power to SDIO card +unless WOWL is used"), the wifi adapter by default is turned off on suspend +and then re-probed on resume. + +In at least 2 model x86/acpi tablets with brcmfmac43430a1 wifi adapters, +the newly added re-probe on resume fails like this: + + brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout + ieee80211 phy1: brcmf_bus_started: failed: -110 + ieee80211 phy1: brcmf_attach: dongle is not responding: err=-110 + brcmfmac: brcmf_sdio_firmware_callback: brcmf_attach failed + +It seems this specific brcmfmac model does not like being reprobed without +it actually being turned off first. + +And the adapter is not being turned off during suspend because of +commit f0992ace680c ("brcmfmac: prohibit ACPI power management for brcmfmac +driver"). + +Now that the driver is being reprobed on resume, the disabling of ACPI +pm is no longer necessary, except when WOWL is used (in which case there +is no-reprobe). + +Move the dis-/en-abling of ACPI pm to brcmf_sdio_wowl_config(), this fixes +the brcmfmac43430a1 suspend/resume regression and should help save some +power when suspended. + +This change means that the code now also may re-enable ACPI pm when WOWL +gets disabled. ACPI pm should only be re-enabled if it was enabled by +the ACPI core originally. Add a brcmf_sdiod_acpi_save_power_manageable() +to save the original state for this. + +This has been tested on the following devices: + +Asus T100TA brcmfmac43241b4-sdio +Acer Iconia One 7 B1-750 brcmfmac43340-sdio +Chuwi Hi8 brcmfmac43430a0-sdio +Chuwi Hi8 brcmfmac43430a1-sdio + +(the Asus T100TA is the device for which the prohibiting of ACPI pm + was originally added) + +Fixes: 92cadedd9d5f ("brcmfmac: Avoid keeping power to SDIO card unless WOWL is used") +Cc: Ulf Hansson +Signed-off-by: Hans de Goede +Reviewed-by: Ulf Hansson +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230320122252.240070-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../broadcom/brcm80211/brcmfmac/bcmsdh.c | 36 +++++++++++++------ + .../broadcom/brcm80211/brcmfmac/sdio.h | 2 ++ + 2 files changed, 28 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +index b7c918f2..65d4799a 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +@@ -994,15 +994,34 @@ static const struct sdio_device_id brcmf_sdmmc_ids[] = { + MODULE_DEVICE_TABLE(sdio, brcmf_sdmmc_ids); + + +-static void brcmf_sdiod_acpi_set_power_manageable(struct device *dev, +- int val) ++static void brcmf_sdiod_acpi_save_power_manageable(struct brcmf_sdio_dev *sdiodev) + { + #if IS_ENABLED(CONFIG_ACPI) + struct acpi_device *adev; + +- adev = ACPI_COMPANION(dev); ++ adev = ACPI_COMPANION(&sdiodev->func1->dev); + if (adev) +- adev->flags.power_manageable = 0; ++ sdiodev->func1_power_manageable = adev->flags.power_manageable; ++ ++ adev = ACPI_COMPANION(&sdiodev->func2->dev); ++ if (adev) ++ sdiodev->func2_power_manageable = adev->flags.power_manageable; ++#endif ++} ++ ++static void brcmf_sdiod_acpi_set_power_manageable(struct brcmf_sdio_dev *sdiodev, ++ int enable) ++{ ++#if IS_ENABLED(CONFIG_ACPI) ++ struct acpi_device *adev; ++ ++ adev = ACPI_COMPANION(&sdiodev->func1->dev); ++ if (adev) ++ adev->flags.power_manageable = enable ? sdiodev->func1_power_manageable : 0; ++ ++ adev = ACPI_COMPANION(&sdiodev->func2->dev); ++ if (adev) ++ adev->flags.power_manageable = enable ? sdiodev->func2_power_manageable : 0; + #endif + } + +@@ -1012,7 +1031,6 @@ static int brcmf_ops_sdio_probe(struct sdio_func *func, + int err; + struct brcmf_sdio_dev *sdiodev; + struct brcmf_bus *bus_if; +- struct device *dev; + + brcmf_dbg(SDIO, "Enter\n"); + brcmf_dbg(SDIO, "Class=%x\n", func->class); +@@ -1020,14 +1038,9 @@ static int brcmf_ops_sdio_probe(struct sdio_func *func, + brcmf_dbg(SDIO, "sdio device ID: 0x%04x\n", func->device); + brcmf_dbg(SDIO, "Function#: %d\n", func->num); + +- dev = &func->dev; +- + /* Set MMC_QUIRK_LENIENT_FN0 for this card */ + func->card->quirks |= MMC_QUIRK_LENIENT_FN0; + +- /* prohibit ACPI power management for this device */ +- brcmf_sdiod_acpi_set_power_manageable(dev, 0); +- + /* Consume func num 1 but dont do anything with it. */ + if (func->num == 1) + return 0; +@@ -1059,6 +1072,7 @@ static int brcmf_ops_sdio_probe(struct sdio_func *func, + dev_set_drvdata(&sdiodev->func1->dev, bus_if); + sdiodev->dev = &sdiodev->func1->dev; + ++ brcmf_sdiod_acpi_save_power_manageable(sdiodev); + brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_DOWN); + + brcmf_dbg(SDIO, "F2 found, calling brcmf_sdiod_probe...\n"); +@@ -1124,6 +1138,8 @@ void brcmf_sdio_wowl_config(struct device *dev, bool enabled) + + if (sdiodev->settings->bus.sdio.oob_irq_supported || + pm_caps & MMC_PM_WAKE_SDIO_IRQ) { ++ /* Stop ACPI from turning off the device when wowl is enabled */ ++ brcmf_sdiod_acpi_set_power_manageable(sdiodev, !enabled); + sdiodev->wowl_enabled = enabled; + brcmf_dbg(SDIO, "Configuring WOWL, enabled=%d\n", enabled); + return; +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h +index b76d34d3..0d18ed15 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h +@@ -188,6 +188,8 @@ struct brcmf_sdio_dev { + char nvram_name[BRCMF_FW_NAME_LEN]; + char clm_name[BRCMF_FW_NAME_LEN]; + bool wowl_enabled; ++ bool func1_power_manageable; ++ bool func2_power_manageable; + enum brcmf_sdiod_state state; + struct brcmf_sdiod_freezer *freezer; + const struct firmware *clm_fw; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-025-NFSD-Avoid-calling-OPDESC-with-ops-opnum-OP_IL.patch b/patches.kernel.org/6.2.11-025-NFSD-Avoid-calling-OPDESC-with-ops-opnum-OP_IL.patch new file mode 100644 index 0000000..6c62311 --- /dev/null +++ b/patches.kernel.org/6.2.11-025-NFSD-Avoid-calling-OPDESC-with-ops-opnum-OP_IL.patch @@ -0,0 +1,55 @@ +From: Chuck Lever +Date: Fri, 31 Mar 2023 16:31:19 -0400 +Subject: [PATCH] NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 804d8e0a6e54427268790472781e03bc243f4ee3 + +[ Upstream commit 804d8e0a6e54427268790472781e03bc243f4ee3 ] + +OPDESC() simply indexes into nfsd4_ops[] by the op's operation +number, without range checking that value. It assumes callers are +careful to avoid calling it with an out-of-bounds opnum value. + +nfsd4_decode_compound() is not so careful, and can invoke OPDESC() +with opnum set to OP_ILLEGAL, which is 10044 -- well beyond the end +of nfsd4_ops[]. + +Reported-by: Jeff Layton +Fixes: f4f9ef4a1b0a ("nfsd4: opdesc will be useful outside nfs4proc.c") +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/nfsd/nfs4xdr.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index 97edb32b..67bbd2d6 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -2476,10 +2476,12 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp) + for (i = 0; i < argp->opcnt; i++) { + op = &argp->ops[i]; + op->replay = NULL; ++ op->opdesc = NULL; + + if (xdr_stream_decode_u32(argp->xdr, &op->opnum) < 0) + return false; + if (nfsd4_opnum_in_range(argp, op)) { ++ op->opdesc = OPDESC(op); + op->status = nfsd4_dec_ops[op->opnum](argp, &op->u); + if (op->status != nfs_ok) + trace_nfsd_compound_decode_err(argp->rqstp, +@@ -2490,7 +2492,7 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp) + op->opnum = OP_ILLEGAL; + op->status = nfserr_op_illegal; + } +- op->opdesc = OPDESC(op); ++ + /* + * We'll try to cache the result in the DRC if any one + * op in the compound wants to be cached: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-026-nfsd-call-op_release-even-when-op_func-returns.patch b/patches.kernel.org/6.2.11-026-nfsd-call-op_release-even-when-op_func-returns.patch new file mode 100644 index 0000000..21850b4 --- /dev/null +++ b/patches.kernel.org/6.2.11-026-nfsd-call-op_release-even-when-op_func-returns.patch @@ -0,0 +1,83 @@ +From: Jeff Layton +Date: Mon, 27 Mar 2023 06:21:37 -0400 +Subject: [PATCH] nfsd: call op_release, even when op_func returns an error +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 15a8b55dbb1ba154d82627547c5761cac884d810 + +[ Upstream commit 15a8b55dbb1ba154d82627547c5761cac884d810 ] + +For ops with "trivial" replies, nfsd4_encode_operation will shortcut +most of the encoding work and skip to just marshalling up the status. +One of the things it skips is calling op_release. This could cause a +memory leak in the layoutget codepath if there is an error at an +inopportune time. + +Have the compound processing engine always call op_release, even when +op_func sets an error in op->status. With this change, we also need +nfsd4_block_get_device_info_scsi to set the gd_device pointer to NULL +on error to avoid a double free. + +Reported-by: Zhi Li +Link: https://bugzilla.redhat.com/show_bug.cgi?id=2181403 +Fixes: 34b1744c91cc ("nfsd4: define ->op_release for compound ops") +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/nfsd/blocklayout.c | 1 + + fs/nfsd/nfs4xdr.c | 11 +++++------ + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/fs/nfsd/blocklayout.c b/fs/nfsd/blocklayout.c +index 04697f8d..01d7fd10 100644 +--- a/fs/nfsd/blocklayout.c ++++ b/fs/nfsd/blocklayout.c +@@ -297,6 +297,7 @@ nfsd4_block_get_device_info_scsi(struct super_block *sb, + + out_free_dev: + kfree(dev); ++ gdp->gd_device = NULL; + return ret; + } + +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index 67bbd2d6..7799835c 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -5400,10 +5400,8 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op) + __be32 *p; + + p = xdr_reserve_space(xdr, 8); +- if (!p) { +- WARN_ON_ONCE(1); +- return; +- } ++ if (!p) ++ goto release; + *p++ = cpu_to_be32(op->opnum); + post_err_offset = xdr->buf->len; + +@@ -5418,8 +5416,6 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op) + op->status = encoder(resp, op->status, &op->u); + if (op->status) + trace_nfsd_compound_encode_err(rqstp, op->opnum, op->status); +- if (opdesc && opdesc->op_release) +- opdesc->op_release(&op->u); + xdr_commit_encode(xdr); + + /* nfsd4_check_resp_size guarantees enough room for error status */ +@@ -5460,6 +5456,9 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op) + } + status: + *p = op->status; ++release: ++ if (opdesc && opdesc->op_release) ++ opdesc->op_release(&op->u); + } + + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-027-icmp-guard-against-too-small-mtu.patch b/patches.kernel.org/6.2.11-027-icmp-guard-against-too-small-mtu.patch new file mode 100644 index 0000000..54a4ac0 --- /dev/null +++ b/patches.kernel.org/6.2.11-027-icmp-guard-against-too-small-mtu.patch @@ -0,0 +1,87 @@ +From: Eric Dumazet +Date: Thu, 30 Mar 2023 17:45:02 +0000 +Subject: [PATCH] icmp: guard against too small mtu +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 7d63b67125382ff0ffdfca434acbc94a38bd092b + +[ Upstream commit 7d63b67125382ff0ffdfca434acbc94a38bd092b ] + +syzbot was able to trigger a panic [1] in icmp_glue_bits(), or +more exactly in skb_copy_and_csum_bits() + +There is no repro yet, but I think the issue is that syzbot +manages to lower device mtu to a small value, fooling __icmp_send() + +__icmp_send() must make sure there is enough room for the +packet to include at least the headers. + +We might in the future refactor skb_copy_and_csum_bits() and its +callers to no longer crash when something bad happens. + +[1] +kernel BUG at net/core/skbuff.c:3343 ! +invalid opcode: 0000 [#1] PREEMPT SMP KASAN +CPU: 0 PID: 15766 Comm: syz-executor.0 Not tainted 6.3.0-rc4-syzkaller-00039-gffe78bbd5121 #0 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 +RIP: 0010:skb_copy_and_csum_bits+0x798/0x860 net/core/skbuff.c:3343 +Code: f0 c1 c8 08 41 89 c6 e9 73 ff ff ff e8 61 48 d4 f9 e9 41 fd ff ff 48 8b 7c 24 48 e8 52 48 d4 f9 e9 c3 fc ff ff e8 c8 27 84 f9 <0f> 0b 48 89 44 24 28 e8 3c 48 d4 f9 48 8b 44 24 28 e9 9d fb ff ff +RSP: 0018:ffffc90000007620 EFLAGS: 00010246 +RAX: 0000000000000000 RBX: 00000000000001e8 RCX: 0000000000000100 +RDX: ffff8880276f6280 RSI: ffffffff87fdd138 RDI: 0000000000000005 +RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 +R10: 00000000000001e8 R11: 0000000000000001 R12: 000000000000003c +R13: 0000000000000000 R14: ffff888028244868 R15: 0000000000000b0e +FS: 00007fbc81f1c700(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000001b2df43000 CR3: 00000000744db000 CR4: 0000000000150ef0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + +icmp_glue_bits+0x7b/0x210 net/ipv4/icmp.c:353 +__ip_append_data+0x1d1b/0x39f0 net/ipv4/ip_output.c:1161 +ip_append_data net/ipv4/ip_output.c:1343 [inline] +ip_append_data+0x115/0x1a0 net/ipv4/ip_output.c:1322 +icmp_push_reply+0xa8/0x440 net/ipv4/icmp.c:370 +__icmp_send+0xb80/0x1430 net/ipv4/icmp.c:765 +ipv4_send_dest_unreach net/ipv4/route.c:1239 [inline] +ipv4_link_failure+0x5a9/0x9e0 net/ipv4/route.c:1246 +dst_link_failure include/net/dst.h:423 [inline] +arp_error_report+0xcb/0x1c0 net/ipv4/arp.c:296 +neigh_invalidate+0x20d/0x560 net/core/neighbour.c:1079 +neigh_timer_handler+0xc77/0xff0 net/core/neighbour.c:1166 +call_timer_fn+0x1a0/0x580 kernel/time/timer.c:1700 +expire_timers+0x29b/0x4b0 kernel/time/timer.c:1751 +__run_timers kernel/time/timer.c:2022 [inline] + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: syzbot+d373d60fddbdc915e666@syzkaller.appspotmail.com +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20230330174502.1915328-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/ipv4/icmp.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index 46aa2d65..635ed4f0 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -746,6 +746,11 @@ void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info, + room = 576; + room -= sizeof(struct iphdr) + icmp_param.replyopts.opt.opt.optlen; + room -= sizeof(struct icmphdr); ++ /* Guard against tiny mtu. We need to include at least one ++ * IP network header for this message to make any sense. ++ */ ++ if (room <= (int)sizeof(struct iphdr)) ++ goto ende; + + icmp_param.data_len = skb_in->len - icmp_param.offset; + if (icmp_param.data_len > room) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-028-ALSA-hda-hdmi-Preserve-the-previous-PCM-device.patch b/patches.kernel.org/6.2.11-028-ALSA-hda-hdmi-Preserve-the-previous-PCM-device.patch new file mode 100644 index 0000000..8297635 --- /dev/null +++ b/patches.kernel.org/6.2.11-028-ALSA-hda-hdmi-Preserve-the-previous-PCM-device.patch @@ -0,0 +1,95 @@ +From: Takashi Iwai +Date: Fri, 31 Mar 2023 16:22:17 +0200 +Subject: [PATCH] ALSA: hda/hdmi: Preserve the previous PCM device upon + re-enablement +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: f785f5ee968f7045268b8be6b0abc850c4a4277c + +[ Upstream commit f785f5ee968f7045268b8be6b0abc850c4a4277c ] + +When a DRM driver turns on or off the screen with the audio +capability, it notifies the ELD to HD-audio HDMI codec driver via +component ops. HDMI codec driver, in turn, attaches or detaches the +PCM stream for the given port on the fly. + +The problem is that, since the recent code change, the HDMI driver +always treats the PCM stream assignment dynamically; this ended up the +confusion of the PCM device appearance. e.g. when a screen goes once +off and on again, it may appear on a different PCM device before the +screen-off. Although the application should treat such a change, it +doesn't seem working gracefully with the current pipewire (maybe +PulseAudio, too). + +As a workaround, this patch changes the HDMI codec driver behavior +slightly to be more consistent. Now it remembers the previous PCM +slot for the given port and try to assign to it. That is, if a port +is re-enabled, the driver tries to use the same PCM slot that was +assigned to that port previously. If it conflicts, a new slot is +searched and used like before, instead. + +Note that multiple monitor connections are the only typical case where +the PCM slot preservation is effective. As long as only a single +monitor is connected, the behavior isn't changed, and the first PCM +slot is still assigned always. + +Fixes: ef6f5494faf6 ("ALSA: hda/hdmi: Use only dynamic PCM device allocation") +Reviewed-by: Jaroslav Kysela +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217259 +Link: https://lore.kernel.org/r/20230331142217.19791-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/pci/hda/patch_hdmi.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index 9ea633fe..4ffa3a59 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -81,6 +81,7 @@ struct hdmi_spec_per_pin { + struct delayed_work work; + struct hdmi_pcm *pcm; /* pointer to spec->pcm_rec[n] dynamically*/ + int pcm_idx; /* which pcm is attached. -1 means no pcm is attached */ ++ int prev_pcm_idx; /* previously assigned pcm index */ + int repoll_count; + bool setup; /* the stream has been set up by prepare callback */ + bool silent_stream; +@@ -1380,9 +1381,17 @@ static void hdmi_attach_hda_pcm(struct hdmi_spec *spec, + /* pcm already be attached to the pin */ + if (per_pin->pcm) + return; ++ /* try the previously used slot at first */ ++ idx = per_pin->prev_pcm_idx; ++ if (idx >= 0) { ++ if (!test_bit(idx, &spec->pcm_bitmap)) ++ goto found; ++ per_pin->prev_pcm_idx = -1; /* no longer valid, clear it */ ++ } + idx = hdmi_find_pcm_slot(spec, per_pin); + if (idx == -EBUSY) + return; ++ found: + per_pin->pcm_idx = idx; + per_pin->pcm = get_hdmi_pcm(spec, idx); + set_bit(idx, &spec->pcm_bitmap); +@@ -1398,6 +1407,7 @@ static void hdmi_detach_hda_pcm(struct hdmi_spec *spec, + return; + idx = per_pin->pcm_idx; + per_pin->pcm_idx = -1; ++ per_pin->prev_pcm_idx = idx; /* remember the previous index */ + per_pin->pcm = NULL; + if (idx >= 0 && idx < spec->pcm_used) + clear_bit(idx, &spec->pcm_bitmap); +@@ -1924,6 +1934,7 @@ static int hdmi_add_pin(struct hda_codec *codec, hda_nid_t pin_nid) + + per_pin->pcm = NULL; + per_pin->pcm_idx = -1; ++ per_pin->prev_pcm_idx = -1; + per_pin->pin_nid = pin_nid; + per_pin->pin_nid_idx = spec->num_nids; + per_pin->dev_id = i; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-029-net-don-t-let-netpoll-invoke-NAPI-if-in-xmit-c.patch b/patches.kernel.org/6.2.11-029-net-don-t-let-netpoll-invoke-NAPI-if-in-xmit-c.patch new file mode 100644 index 0000000..02008ad --- /dev/null +++ b/patches.kernel.org/6.2.11-029-net-don-t-let-netpoll-invoke-NAPI-if-in-xmit-c.patch @@ -0,0 +1,81 @@ +From: Jakub Kicinski +Date: Thu, 30 Mar 2023 19:21:44 -0700 +Subject: [PATCH] net: don't let netpoll invoke NAPI if in xmit context +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 275b471e3d2daf1472ae8fa70dc1b50c9e0b9e75 + +[ Upstream commit 275b471e3d2daf1472ae8fa70dc1b50c9e0b9e75 ] + +Commit 0db3dc73f7a3 ("[NETPOLL]: tx lock deadlock fix") narrowed +down the region under netif_tx_trylock() inside netpoll_send_skb(). +(At that point in time netif_tx_trylock() would lock all queues of +the device.) Taking the tx lock was problematic because driver's +cleanup method may take the same lock. So the change made us hold +the xmit lock only around xmit, and expected the driver to take +care of locking within ->ndo_poll_controller(). + +Unfortunately this only works if netpoll isn't itself called with +the xmit lock already held. Netpoll code is careful and uses +trylock(). The drivers, however, may be using plain lock(). +Printing while holding the xmit lock is going to result in rare +deadlocks. + +Luckily we record the xmit lock owners, so we can scan all the queues, +the same way we scan NAPI owners. If any of the xmit locks is held +by the local CPU we better not attempt any polling. + +It would be nice if we could narrow down the check to only the NAPIs +and the queue we're trying to use. I don't see a way to do that now. + +Reported-by: Roman Gushchin +Fixes: 0db3dc73f7a3 ("[NETPOLL]: tx lock deadlock fix") +Signed-off-by: Jakub Kicinski +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/core/netpoll.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/net/core/netpoll.c b/net/core/netpoll.c +index 9be762e1..4ac8d0ad 100644 +--- a/net/core/netpoll.c ++++ b/net/core/netpoll.c +@@ -137,6 +137,20 @@ static void queue_process(struct work_struct *work) + } + } + ++static int netif_local_xmit_active(struct net_device *dev) ++{ ++ int i; ++ ++ for (i = 0; i < dev->num_tx_queues; i++) { ++ struct netdev_queue *txq = netdev_get_tx_queue(dev, i); ++ ++ if (READ_ONCE(txq->xmit_lock_owner) == smp_processor_id()) ++ return 1; ++ } ++ ++ return 0; ++} ++ + static void poll_one_napi(struct napi_struct *napi) + { + int work; +@@ -183,7 +197,10 @@ void netpoll_poll_dev(struct net_device *dev) + if (!ni || down_trylock(&ni->dev_lock)) + return; + +- if (!netif_running(dev)) { ++ /* Some drivers will take the same locks in poll and xmit, ++ * we can't poll if local CPU is already in xmit. ++ */ ++ if (!netif_running(dev) || netif_local_xmit_active(dev)) { + up(&ni->dev_lock); + return; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-030-net-dsa-mv88e6xxx-Reset-mv88e6393x-force-WD-ev.patch b/patches.kernel.org/6.2.11-030-net-dsa-mv88e6xxx-Reset-mv88e6393x-force-WD-ev.patch new file mode 100644 index 0000000..e346549 --- /dev/null +++ b/patches.kernel.org/6.2.11-030-net-dsa-mv88e6xxx-Reset-mv88e6393x-force-WD-ev.patch @@ -0,0 +1,92 @@ +From: Gustav Ekelund +Date: Fri, 31 Mar 2023 10:40:13 +0200 +Subject: [PATCH] net: dsa: mv88e6xxx: Reset mv88e6393x force WD event bit +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 089b91a0155c4de1209a07ff2a7dd299ff3ece47 + +[ Upstream commit 089b91a0155c4de1209a07ff2a7dd299ff3ece47 ] + +The force watchdog event bit is not cleared during SW reset in the +mv88e6393x switch. This is a different behavior compared to mv886390 which +clears the force WD event bit as advertised. This causes a force WD event +to be handled over and over again as the SW reset following the event never +clears the force WD event bit. + +Explicitly clear the watchdog event register to 0 in irq_action when +handling an event to prevent the switch from sending continuous interrupts. +Marvell aren't aware of any other stuck bits apart from the force WD +bit. + +Fixes: de776d0d316f ("net: dsa: mv88e6xxx: add support for mv88e6393x family" +Signed-off-by: Gustav Ekelund +Reviewed-by: Andrew Lunn +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/dsa/mv88e6xxx/chip.c | 2 +- + drivers/net/dsa/mv88e6xxx/global2.c | 20 ++++++++++++++++++++ + drivers/net/dsa/mv88e6xxx/global2.h | 1 + + 3 files changed, 22 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 8211a4d3..e57d8648 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -5518,7 +5518,7 @@ static const struct mv88e6xxx_ops mv88e6393x_ops = { + * .port_set_upstream_port method. + */ + .set_egress_port = mv88e6393x_set_egress_port, +- .watchdog_ops = &mv88e6390_watchdog_ops, ++ .watchdog_ops = &mv88e6393x_watchdog_ops, + .mgmt_rsvd2cpu = mv88e6393x_port_mgmt_rsvd2cpu, + .pot_clear = mv88e6xxx_g2_pot_clear, + .reset = mv88e6352_g1_reset, +diff --git a/drivers/net/dsa/mv88e6xxx/global2.c b/drivers/net/dsa/mv88e6xxx/global2.c +index fa65ecd9..ec499399 100644 +--- a/drivers/net/dsa/mv88e6xxx/global2.c ++++ b/drivers/net/dsa/mv88e6xxx/global2.c +@@ -931,6 +931,26 @@ const struct mv88e6xxx_irq_ops mv88e6390_watchdog_ops = { + .irq_free = mv88e6390_watchdog_free, + }; + ++static int mv88e6393x_watchdog_action(struct mv88e6xxx_chip *chip, int irq) ++{ ++ mv88e6390_watchdog_action(chip, irq); ++ ++ /* Fix for clearing the force WD event bit. ++ * Unreleased erratum on mv88e6393x. ++ */ ++ mv88e6xxx_g2_write(chip, MV88E6390_G2_WDOG_CTL, ++ MV88E6390_G2_WDOG_CTL_UPDATE | ++ MV88E6390_G2_WDOG_CTL_PTR_EVENT); ++ ++ return IRQ_HANDLED; ++} ++ ++const struct mv88e6xxx_irq_ops mv88e6393x_watchdog_ops = { ++ .irq_action = mv88e6393x_watchdog_action, ++ .irq_setup = mv88e6390_watchdog_setup, ++ .irq_free = mv88e6390_watchdog_free, ++}; ++ + static irqreturn_t mv88e6xxx_g2_watchdog_thread_fn(int irq, void *dev_id) + { + struct mv88e6xxx_chip *chip = dev_id; +diff --git a/drivers/net/dsa/mv88e6xxx/global2.h b/drivers/net/dsa/mv88e6xxx/global2.h +index 7536b8b0..c05fad5c 100644 +--- a/drivers/net/dsa/mv88e6xxx/global2.h ++++ b/drivers/net/dsa/mv88e6xxx/global2.h +@@ -363,6 +363,7 @@ int mv88e6xxx_g2_device_mapping_write(struct mv88e6xxx_chip *chip, int target, + extern const struct mv88e6xxx_irq_ops mv88e6097_watchdog_ops; + extern const struct mv88e6xxx_irq_ops mv88e6250_watchdog_ops; + extern const struct mv88e6xxx_irq_ops mv88e6390_watchdog_ops; ++extern const struct mv88e6xxx_irq_ops mv88e6393x_watchdog_ops; + + extern const struct mv88e6xxx_avb_ops mv88e6165_avb_ops; + extern const struct mv88e6xxx_avb_ops mv88e6352_avb_ops; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-031-net-ethernet-mtk_eth_soc-fix-remaining-through.patch b/patches.kernel.org/6.2.11-031-net-ethernet-mtk_eth_soc-fix-remaining-through.patch new file mode 100644 index 0000000..288d599 --- /dev/null +++ b/patches.kernel.org/6.2.11-031-net-ethernet-mtk_eth_soc-fix-remaining-through.patch @@ -0,0 +1,58 @@ +From: Felix Fietkau +Date: Fri, 31 Mar 2023 14:49:59 +0200 +Subject: [PATCH] net: ethernet: mtk_eth_soc: fix remaining throughput + regression +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: e669ce46740a9815953bb4452a6bc5a7fdc21a50 + +[ Upstream commit e669ce46740a9815953bb4452a6bc5a7fdc21a50 ] + +Based on further tests, it seems that the QDMA shaper is not able to +perform shaping close to the MAC link rate without throughput loss. +This cannot be compensated by increasing the shaping rate, so it seems +to be an internal limit. + +Fix the remaining throughput regression by detecting that condition and +limiting shaping to ports with lower link speed. + +This patch intentionally ignores link speed gain from TRGMII, because +even on such links, shaping to 1000 Mbit/s incurs some throughput +degradation. + +Fixes: f63959c7eec3 ("net: ethernet: mtk_eth_soc: implement multi-queue support for per-port queues") +Tested-By: Frank Wunderlich +Reported-by: Frank Wunderlich +Signed-off-by: Felix Fietkau +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index bd7c18c8..f56d4e7d 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -703,6 +703,7 @@ static void mtk_mac_link_up(struct phylink_config *config, + MAC_MCR_FORCE_RX_FC); + + /* Configure speed */ ++ mac->speed = speed; + switch (speed) { + case SPEED_2500: + case SPEED_1000: +@@ -3169,6 +3170,9 @@ static int mtk_device_event(struct notifier_block *n, unsigned long event, void + if (dp->index >= MTK_QDMA_NUM_QUEUES) + return NOTIFY_DONE; + ++ if (mac->speed > 0 && mac->speed <= s.base.speed) ++ s.base.speed = 0; ++ + mtk_set_queue_speed(eth, dp->index + 3, s.base.speed); + + return NOTIFY_DONE; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-032-sctp-check-send-stream-number-after-wait_for_s.patch b/patches.kernel.org/6.2.11-032-sctp-check-send-stream-number-after-wait_for_s.patch new file mode 100644 index 0000000..d99292b --- /dev/null +++ b/patches.kernel.org/6.2.11-032-sctp-check-send-stream-number-after-wait_for_s.patch @@ -0,0 +1,67 @@ +From: Xin Long +Date: Sat, 1 Apr 2023 19:09:57 -0400 +Subject: [PATCH] sctp: check send stream number after wait_for_sndbuf +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 2584024b23552c00d95b50255e47bd18d306d31a + +[ Upstream commit 2584024b23552c00d95b50255e47bd18d306d31a ] + +This patch fixes a corner case where the asoc out stream count may change +after wait_for_sndbuf. + +When the main thread in the client starts a connection, if its out stream +count is set to N while the in stream count in the server is set to N - 2, +another thread in the client keeps sending the msgs with stream number +N - 1, and waits for sndbuf before processing INIT_ACK. + +However, after processing INIT_ACK, the out stream count in the client is +shrunk to N - 2, the same to the in stream count in the server. The crash +occurs when the thread waiting for sndbuf is awake and sends the msg in a +non-existing stream(N - 1), the call trace is as below: + + KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] + Call Trace: + + sctp_cmd_send_msg net/sctp/sm_sideeffect.c:1114 [inline] + sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1777 [inline] + sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline] + sctp_do_sm+0x197d/0x5310 net/sctp/sm_sideeffect.c:1170 + sctp_primitive_SEND+0x9f/0xc0 net/sctp/primitive.c:163 + sctp_sendmsg_to_asoc+0x10eb/0x1a30 net/sctp/socket.c:1868 + sctp_sendmsg+0x8d4/0x1d90 net/sctp/socket.c:2026 + inet_sendmsg+0x9d/0xe0 net/ipv4/af_inet.c:825 + sock_sendmsg_nosec net/socket.c:722 [inline] + sock_sendmsg+0xde/0x190 net/socket.c:745 + +The fix is to add an unlikely check for the send stream number after the +thread wakes up from the wait_for_sndbuf. + +Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations") +Reported-by: syzbot+47c24ca20a2fa01f082e@syzkaller.appspotmail.com +Signed-off-by: Xin Long +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/sctp/socket.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 84021a6c..ec7d1a89 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -1829,6 +1829,10 @@ static int sctp_sendmsg_to_asoc(struct sctp_association *asoc, + err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len); + if (err) + goto err; ++ if (unlikely(sinfo->sinfo_stream >= asoc->stream.outcnt)) { ++ err = -EINVAL; ++ goto err; ++ } + } + + if (sctp_state(asoc, CLOSED)) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-033-drm-i915-huc-Cancel-HuC-delayed-load-timer-on-.patch b/patches.kernel.org/6.2.11-033-drm-i915-huc-Cancel-HuC-delayed-load-timer-on-.patch new file mode 100644 index 0000000..25bd769 --- /dev/null +++ b/patches.kernel.org/6.2.11-033-drm-i915-huc-Cancel-HuC-delayed-load-timer-on-.patch @@ -0,0 +1,74 @@ +From: Daniele Ceraolo Spurio +Date: Mon, 13 Mar 2023 13:55:56 -0700 +Subject: [PATCH] drm/i915/huc: Cancel HuC delayed load timer on reset. +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: c74237496fbc799257b091179dd01a3200f7314d + +[ Upstream commit c74237496fbc799257b091179dd01a3200f7314d ] + +In the rare case where we do a full GT reset after starting the HuC +load and before it completes (which basically boils down to i915 hanging +during init), we need to cancel the delayed load fence, as it will be +re-initialized in the post-reset recovery. + +Fixes: 27536e03271d ("drm/i915/huc: track delayed HuC load with a fence") +Signed-off-by: Daniele Ceraolo Spurio +Cc: Alan Previn +Reviewed-by: Alan Previn +Link: https://patchwork.freedesktop.org/patch/msgid/20230313205556.1174503-1-daniele.ceraolospurio@intel.com +(cherry picked from commit cdf7911f7dbcb37228409a63bf75630776c45a15) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/gt/uc/intel_huc.c | 7 +++++++ + drivers/gpu/drm/i915/gt/uc/intel_huc.h | 7 +------ + 2 files changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_huc.c b/drivers/gpu/drm/i915/gt/uc/intel_huc.c +index 410905da..0c103ca1 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_huc.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_huc.c +@@ -235,6 +235,13 @@ static void delayed_huc_load_fini(struct intel_huc *huc) + i915_sw_fence_fini(&huc->delayed_load.fence); + } + ++int intel_huc_sanitize(struct intel_huc *huc) ++{ ++ delayed_huc_load_complete(huc); ++ intel_uc_fw_sanitize(&huc->fw); ++ return 0; ++} ++ + static bool vcs_supported(struct intel_gt *gt) + { + intel_engine_mask_t mask = gt->info.engine_mask; +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_huc.h b/drivers/gpu/drm/i915/gt/uc/intel_huc.h +index 52db0362..db555b3c 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_huc.h ++++ b/drivers/gpu/drm/i915/gt/uc/intel_huc.h +@@ -41,6 +41,7 @@ struct intel_huc { + } delayed_load; + }; + ++int intel_huc_sanitize(struct intel_huc *huc); + void intel_huc_init_early(struct intel_huc *huc); + int intel_huc_init(struct intel_huc *huc); + void intel_huc_fini(struct intel_huc *huc); +@@ -54,12 +55,6 @@ bool intel_huc_is_authenticated(struct intel_huc *huc); + void intel_huc_register_gsc_notifier(struct intel_huc *huc, struct bus_type *bus); + void intel_huc_unregister_gsc_notifier(struct intel_huc *huc, struct bus_type *bus); + +-static inline int intel_huc_sanitize(struct intel_huc *huc) +-{ +- intel_uc_fw_sanitize(&huc->fw); +- return 0; +-} +- + static inline bool intel_huc_is_supported(struct intel_huc *huc) + { + return intel_uc_fw_is_supported(&huc->fw); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-034-net-qrtr-Do-not-do-DEL_SERVER-broadcast-after-.patch b/patches.kernel.org/6.2.11-034-net-qrtr-Do-not-do-DEL_SERVER-broadcast-after-.patch new file mode 100644 index 0000000..b4c66dd --- /dev/null +++ b/patches.kernel.org/6.2.11-034-net-qrtr-Do-not-do-DEL_SERVER-broadcast-after-.patch @@ -0,0 +1,95 @@ +From: Sricharan Ramabadhran +Date: Mon, 3 Apr 2023 12:28:51 +0530 +Subject: [PATCH] net: qrtr: Do not do DEL_SERVER broadcast after DEL_CLIENT +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 839349d13905927d8a567ca4d21d88c82028e31d + +[ Upstream commit 839349d13905927d8a567ca4d21d88c82028e31d ] + +On the remote side, when QRTR socket is removed, af_qrtr will call +qrtr_port_remove() which broadcasts the DEL_CLIENT packet to all neighbours +including local NS. NS upon receiving the DEL_CLIENT packet, will remove +the lookups associated with the node:port and broadcasts the DEL_SERVER +packet. + +But on the host side, due to the arrival of the DEL_CLIENT packet, the NS +would've already deleted the server belonging to that port. So when the +remote's NS again broadcasts the DEL_SERVER for that port, it throws below +error message on the host: + +"failed while handling packet from 2:-2" + +So fix this error by not broadcasting the DEL_SERVER packet when the +DEL_CLIENT packet gets processed." + +Fixes: 0c2204a4ad71 ("net: qrtr: Migrate nameservice to kernel from userspace") +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Ram Kumar Dharuman +Signed-off-by: Sricharan Ramabadhran +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/qrtr/ns.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/net/qrtr/ns.c b/net/qrtr/ns.c +index e595079c..3e40a1ba 100644 +--- a/net/qrtr/ns.c ++++ b/net/qrtr/ns.c +@@ -273,7 +273,7 @@ static struct qrtr_server *server_add(unsigned int service, + return NULL; + } + +-static int server_del(struct qrtr_node *node, unsigned int port) ++static int server_del(struct qrtr_node *node, unsigned int port, bool bcast) + { + struct qrtr_lookup *lookup; + struct qrtr_server *srv; +@@ -286,7 +286,7 @@ static int server_del(struct qrtr_node *node, unsigned int port) + radix_tree_delete(&node->servers, port); + + /* Broadcast the removal of local servers */ +- if (srv->node == qrtr_ns.local_node) ++ if (srv->node == qrtr_ns.local_node && bcast) + service_announce_del(&qrtr_ns.bcast_sq, srv); + + /* Announce the service's disappearance to observers */ +@@ -372,7 +372,7 @@ static int ctrl_cmd_bye(struct sockaddr_qrtr *from) + } + slot = radix_tree_iter_resume(slot, &iter); + rcu_read_unlock(); +- server_del(node, srv->port); ++ server_del(node, srv->port, true); + rcu_read_lock(); + } + rcu_read_unlock(); +@@ -458,10 +458,13 @@ static int ctrl_cmd_del_client(struct sockaddr_qrtr *from, + kfree(lookup); + } + +- /* Remove the server belonging to this port */ ++ /* Remove the server belonging to this port but don't broadcast ++ * DEL_SERVER. Neighbours would've already removed the server belonging ++ * to this port due to the DEL_CLIENT broadcast from qrtr_port_remove(). ++ */ + node = node_get(node_id); + if (node) +- server_del(node, port); ++ server_del(node, port, false); + + /* Advertise the removal of this client to all local servers */ + local_node = node_get(qrtr_ns.local_node); +@@ -566,7 +569,7 @@ static int ctrl_cmd_del_server(struct sockaddr_qrtr *from, + if (!node) + return -ENOENT; + +- return server_del(node, port); ++ return server_del(node, port, true); + } + + static int ctrl_cmd_new_lookup(struct sockaddr_qrtr *from, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-035-ipv6-Fix-an-uninit-variable-access-bug-in-__ip.patch b/patches.kernel.org/6.2.11-035-ipv6-Fix-an-uninit-variable-access-bug-in-__ip.patch new file mode 100644 index 0000000..5822707 --- /dev/null +++ b/patches.kernel.org/6.2.11-035-ipv6-Fix-an-uninit-variable-access-bug-in-__ip.patch @@ -0,0 +1,102 @@ +From: Ziyang Xuan +Date: Mon, 3 Apr 2023 15:34:17 +0800 +Subject: [PATCH] ipv6: Fix an uninit variable access bug in __ip6_make_skb() +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: ea30388baebcce37fd594d425a65037ca35e59e8 + +[ Upstream commit ea30388baebcce37fd594d425a65037ca35e59e8 ] + +Syzbot reported a bug as following: + +===================================================== +BUG: KMSAN: uninit-value in arch_atomic64_inc arch/x86/include/asm/atomic64_64.h:88 [inline] +BUG: KMSAN: uninit-value in arch_atomic_long_inc include/linux/atomic/atomic-long.h:161 [inline] +BUG: KMSAN: uninit-value in atomic_long_inc include/linux/atomic/atomic-instrumented.h:1429 [inline] +BUG: KMSAN: uninit-value in __ip6_make_skb+0x2f37/0x30f0 net/ipv6/ip6_output.c:1956 + arch_atomic64_inc arch/x86/include/asm/atomic64_64.h:88 [inline] + arch_atomic_long_inc include/linux/atomic/atomic-long.h:161 [inline] + atomic_long_inc include/linux/atomic/atomic-instrumented.h:1429 [inline] + __ip6_make_skb+0x2f37/0x30f0 net/ipv6/ip6_output.c:1956 + ip6_finish_skb include/net/ipv6.h:1122 [inline] + ip6_push_pending_frames+0x10e/0x550 net/ipv6/ip6_output.c:1987 + rawv6_push_pending_frames+0xb12/0xb90 net/ipv6/raw.c:579 + rawv6_sendmsg+0x297e/0x2e60 net/ipv6/raw.c:922 + inet_sendmsg+0x101/0x180 net/ipv4/af_inet.c:827 + sock_sendmsg_nosec net/socket.c:714 [inline] + sock_sendmsg net/socket.c:734 [inline] + ____sys_sendmsg+0xa8e/0xe70 net/socket.c:2476 + ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2530 + __sys_sendmsg net/socket.c:2559 [inline] + __do_sys_sendmsg net/socket.c:2568 [inline] + __se_sys_sendmsg net/socket.c:2566 [inline] + __x64_sys_sendmsg+0x367/0x540 net/socket.c:2566 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Uninit was created at: + slab_post_alloc_hook mm/slab.h:766 [inline] + slab_alloc_node mm/slub.c:3452 [inline] + __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491 + __do_kmalloc_node mm/slab_common.c:967 [inline] + __kmalloc_node_track_caller+0x114/0x3b0 mm/slab_common.c:988 + kmalloc_reserve net/core/skbuff.c:492 [inline] + __alloc_skb+0x3af/0x8f0 net/core/skbuff.c:565 + alloc_skb include/linux/skbuff.h:1270 [inline] + __ip6_append_data+0x51c1/0x6bb0 net/ipv6/ip6_output.c:1684 + ip6_append_data+0x411/0x580 net/ipv6/ip6_output.c:1854 + rawv6_sendmsg+0x2882/0x2e60 net/ipv6/raw.c:915 + inet_sendmsg+0x101/0x180 net/ipv4/af_inet.c:827 + sock_sendmsg_nosec net/socket.c:714 [inline] + sock_sendmsg net/socket.c:734 [inline] + ____sys_sendmsg+0xa8e/0xe70 net/socket.c:2476 + ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2530 + __sys_sendmsg net/socket.c:2559 [inline] + __do_sys_sendmsg net/socket.c:2568 [inline] + __se_sys_sendmsg net/socket.c:2566 [inline] + __x64_sys_sendmsg+0x367/0x540 net/socket.c:2566 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +It is because icmp6hdr does not in skb linear region under the scenario +of SOCK_RAW socket. Access icmp6_hdr(skb)->icmp6_type directly will +trigger the uninit variable access bug. + +Use a local variable icmp6_type to carry the correct value in different +scenarios. + +Fixes: 14878f75abd5 ("[IPV6]: Add ICMPMsgStats MIB (RFC 4293) [rev 2]") +Reported-by: syzbot+8257f4dcef79de670baf@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?id=3d605ec1d0a7f2a269a1a6936ac7f2b85975ee9c +Signed-off-by: Ziyang Xuan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/ipv6/ip6_output.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index c314fdde..95a55c66 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -1965,8 +1965,13 @@ struct sk_buff *__ip6_make_skb(struct sock *sk, + IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len); + if (proto == IPPROTO_ICMPV6) { + struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb)); ++ u8 icmp6_type; + +- ICMP6MSGOUT_INC_STATS(net, idev, icmp6_hdr(skb)->icmp6_type); ++ if (sk->sk_socket->type == SOCK_RAW && !inet_sk(sk)->hdrincl) ++ icmp6_type = fl6->fl6_icmp_type; ++ else ++ icmp6_type = icmp6_hdr(skb)->icmp6_type; ++ ICMP6MSGOUT_INC_STATS(net, idev, icmp6_type); + ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-036-platform-x86-think-lmi-Fix-memory-leak-when-sh.patch b/patches.kernel.org/6.2.11-036-platform-x86-think-lmi-Fix-memory-leak-when-sh.patch new file mode 100644 index 0000000..d29336a --- /dev/null +++ b/patches.kernel.org/6.2.11-036-platform-x86-think-lmi-Fix-memory-leak-when-sh.patch @@ -0,0 +1,52 @@ +From: Armin Wolf +Date: Fri, 31 Mar 2023 23:33:19 +0200 +Subject: [PATCH] platform/x86: think-lmi: Fix memory leak when showing current + settings +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: a3c4c053014585dcf20f4df954791b74d8a8afcd + +[ Upstream commit a3c4c053014585dcf20f4df954791b74d8a8afcd ] + +When retriving a item string with tlmi_setting(), the result has to be +freed using kfree(). In current_value_show() however, malformed +item strings are not freed, causing a memory leak. +Fix this by eliminating the early return responsible for this. + +Reported-by: Mirsad Goran Todorovac +Link: https://lore.kernel.org/platform-driver-x86/01e920bc-5882-ba0c-dd15-868bf0eca0b8@alu.unizg.hr/T/#t +Tested-by: Mirsad Goran Todorovac +Fixes: 0fdf10e5fc96 ("platform/x86: think-lmi: Split current_value to reflect only the value") +Signed-off-by: Armin Wolf +Link: https://lore.kernel.org/r/20230331213319.41040-1-W_Armin@gmx.de +Tested-by: Mario Limonciello +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/platform/x86/think-lmi.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c +index 74af3e59..4e738ec5 100644 +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -930,10 +930,12 @@ static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *a + /* validate and split from `item,value` -> `value` */ + value = strpbrk(item, ","); + if (!value || value == item || !strlen(value + 1)) +- return -EINVAL; ++ ret = -EINVAL; ++ else ++ ret = sysfs_emit(buf, "%s\n", value + 1); + +- ret = sysfs_emit(buf, "%s\n", value + 1); + kfree(item); ++ + return ret; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-037-platform-x86-think-lmi-Fix-memory-leaks-when-p.patch b/patches.kernel.org/6.2.11-037-platform-x86-think-lmi-Fix-memory-leaks-when-p.patch new file mode 100644 index 0000000..eedd1d1 --- /dev/null +++ b/patches.kernel.org/6.2.11-037-platform-x86-think-lmi-Fix-memory-leaks-when-p.patch @@ -0,0 +1,59 @@ +From: Mark Pearson +Date: Sun, 2 Apr 2023 21:31:19 -0400 +Subject: [PATCH] platform/x86: think-lmi: Fix memory leaks when parsing + ThinkStation WMI strings +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: e7d796fccdc8d17c2d21817ebe4c7bf5bbfe5433 + +[ Upstream commit e7d796fccdc8d17c2d21817ebe4c7bf5bbfe5433 ] + +My previous commit introduced a memory leak where the item allocated +from tlmi_setting was not freed. +This commit also renames it to avoid confusion with the similarly name +variable in the same function. + +Fixes: 8a02d70679fc ("platform/x86: think-lmi: Add possible_values for ThinkStation") +Reported-by: Mirsad Todorovac +Link: https://lore.kernel.org/lkml/df26ff45-8933-f2b3-25f4-6ee51ccda7d8@gmx.de/T/ +Signed-off-by: Mark Pearson +Link: https://lore.kernel.org/r/20230403013120.2105-1-mpearson-lenovo@squebb.ca +Tested-by: Mario Limonciello +Tested-by: Mirsad Goran Todorovac +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/platform/x86/think-lmi.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c +index 4e738ec5..70c4ee25 100644 +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -1459,10 +1459,10 @@ static int tlmi_analyze(void) + * name string. + * Try and pull that out if it's available. + */ +- char *item, *optstart, *optend; ++ char *optitem, *optstart, *optend; + +- if (!tlmi_setting(setting->index, &item, LENOVO_BIOS_SETTING_GUID)) { +- optstart = strstr(item, "[Optional:"); ++ if (!tlmi_setting(setting->index, &optitem, LENOVO_BIOS_SETTING_GUID)) { ++ optstart = strstr(optitem, "[Optional:"); + if (optstart) { + optstart += strlen("[Optional:"); + optend = strstr(optstart, "]"); +@@ -1471,6 +1471,7 @@ static int tlmi_analyze(void) + kstrndup(optstart, optend - optstart, + GFP_KERNEL); + } ++ kfree(optitem); + } + } + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-038-platform-x86-think-lmi-Clean-up-display-of-cur.patch b/patches.kernel.org/6.2.11-038-platform-x86-think-lmi-Clean-up-display-of-cur.patch new file mode 100644 index 0000000..d7167b4 --- /dev/null +++ b/patches.kernel.org/6.2.11-038-platform-x86-think-lmi-Clean-up-display-of-cur.patch @@ -0,0 +1,61 @@ +From: Mark Pearson +Date: Sun, 2 Apr 2023 21:31:20 -0400 +Subject: [PATCH] platform/x86: think-lmi: Clean up display of current_value on + Thinkstation +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 7065655216d4d034d71164641f3bec0b189ad6fa + +[ Upstream commit 7065655216d4d034d71164641f3bec0b189ad6fa ] + +On ThinkStations on retrieving the attribute value the BIOS appends the +possible values to the string. +Clean up the display in the current_value_show function so the options +part is not displayed. + +Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") +Reported by Mario Limoncello +Link: https://github.com/fwupd/fwupd/issues/5077#issuecomment-1488730526 +Signed-off-by: Mark Pearson +Link: https://lore.kernel.org/r/20230403013120.2105-2-mpearson-lenovo@squebb.ca +Tested-by: Mario Limonciello +Tested-by: Mirsad Goran Todorovac +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/platform/x86/think-lmi.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c +index 70c4ee25..336b9029 100644 +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -920,7 +920,7 @@ static ssize_t display_name_show(struct kobject *kobj, struct kobj_attribute *at + static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) + { + struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); +- char *item, *value; ++ char *item, *value, *p; + int ret; + + ret = tlmi_setting(setting->index, &item, LENOVO_BIOS_SETTING_GUID); +@@ -931,9 +931,12 @@ static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *a + value = strpbrk(item, ","); + if (!value || value == item || !strlen(value + 1)) + ret = -EINVAL; +- else ++ else { ++ /* On Workstations remove the Options part after the value */ ++ p = strchrnul(value, ';'); ++ *p = '\0'; + ret = sysfs_emit(buf, "%s\n", value + 1); +- ++ } + kfree(item); + + return ret; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-039-gpio-davinci-Do-not-clear-the-bank-intr-enable.patch b/patches.kernel.org/6.2.11-039-gpio-davinci-Do-not-clear-the-bank-intr-enable.patch new file mode 100644 index 0000000..84260b5 --- /dev/null +++ b/patches.kernel.org/6.2.11-039-gpio-davinci-Do-not-clear-the-bank-intr-enable.patch @@ -0,0 +1,45 @@ +From: Dhruva Gole +Date: Mon, 3 Apr 2023 12:54:42 +0530 +Subject: [PATCH] gpio: davinci: Do not clear the bank intr enable bit in + save_context +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: fe092498cb9638418c96675be320c74a16306b48 + +[ Upstream commit fe092498cb9638418c96675be320c74a16306b48 ] + +The interrupt enable bits might be set if we want to use the GPIO as +wakeup source. Clearing this will mean disabling of interrupts in the GPIO +banks that we may want to wakeup from. +Thus remove the line that was clearing this bit from the driver's save +context function. + +Cc: Devarsh Thakkar +Fixes: 0651a730924b ("gpio: davinci: Add support for system suspend/resume PM") +Signed-off-by: Dhruva Gole +Reviewed-by: Linus Walleij +Acked-by: Keerthy +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpio/gpio-davinci.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c +index fa51a91a..39b00855 100644 +--- a/drivers/gpio/gpio-davinci.c ++++ b/drivers/gpio/gpio-davinci.c +@@ -642,9 +642,6 @@ static void davinci_gpio_save_context(struct davinci_gpio_controller *chips, + context->set_falling = readl_relaxed(&g->set_falling); + } + +- /* Clear Bank interrupt enable bit */ +- writel_relaxed(0, base + BINTEN); +- + /* Clear all interrupt status registers */ + writel_relaxed(GENMASK(31, 0), &g->intstat); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-040-gpio-davinci-Add-irq-chip-flag-to-skip-set-wak.patch b/patches.kernel.org/6.2.11-040-gpio-davinci-Add-irq-chip-flag-to-skip-set-wak.patch new file mode 100644 index 0000000..42201e3 --- /dev/null +++ b/patches.kernel.org/6.2.11-040-gpio-davinci-Add-irq-chip-flag-to-skip-set-wak.patch @@ -0,0 +1,38 @@ +From: Dhruva Gole +Date: Mon, 3 Apr 2023 12:54:43 +0530 +Subject: [PATCH] gpio: davinci: Add irq chip flag to skip set wake +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 7b75c4703609a3ebaf67271813521bc0281e1ec1 + +[ Upstream commit 7b75c4703609a3ebaf67271813521bc0281e1ec1 ] + +Add the IRQCHIP_SKIP_SET_WAKE flag since there are no special IRQ Wake +bits that can be set to enable wakeup IRQ. + +Fixes: 3d9edf09d452 ("[ARM] 4457/2: davinci: GPIO support") +Signed-off-by: Dhruva Gole +Reviewed-by: Linus Walleij +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpio/gpio-davinci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c +index 39b00855..7a26919f 100644 +--- a/drivers/gpio/gpio-davinci.c ++++ b/drivers/gpio/gpio-davinci.c +@@ -325,7 +325,7 @@ static struct irq_chip gpio_irqchip = { + .irq_enable = gpio_irq_enable, + .irq_disable = gpio_irq_disable, + .irq_set_type = gpio_irq_type, +- .flags = IRQCHIP_SET_TYPE_MASKED, ++ .flags = IRQCHIP_SET_TYPE_MASKED | IRQCHIP_SKIP_SET_WAKE, + }; + + static void gpio_irq_handler(struct irq_desc *desc) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-041-net-ethernet-ti-am65-cpsw-Fix-mdio-cleanup-in-.patch b/patches.kernel.org/6.2.11-041-net-ethernet-ti-am65-cpsw-Fix-mdio-cleanup-in-.patch new file mode 100644 index 0000000..9db5f90 --- /dev/null +++ b/patches.kernel.org/6.2.11-041-net-ethernet-ti-am65-cpsw-Fix-mdio-cleanup-in-.patch @@ -0,0 +1,58 @@ +From: Siddharth Vadapalli +Date: Mon, 3 Apr 2023 14:33:21 +0530 +Subject: [PATCH] net: ethernet: ti: am65-cpsw: Fix mdio cleanup in probe +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: c6b486fb33680ad5a3a6390ce693c835caaae3f7 + +[ Upstream commit c6b486fb33680ad5a3a6390ce693c835caaae3f7 ] + +In the am65_cpsw_nuss_probe() function's cleanup path, the call to +of_platform_device_destroy() for the common->mdio_dev device is invoked +unconditionally. It is possible that either the MDIO node is not present +in the device-tree, or the MDIO node is disabled in the device-tree. In +both these cases, the MDIO device is not created, resulting in a NULL +pointer dereference when the of_platform_device_destroy() function is +invoked on the common->mdio_dev device on the cleanup path. + +Fix this by ensuring that the common->mdio_dev device exists, before +attempting to invoke of_platform_device_destroy(). + +Fixes: a45cfcc69a25 ("net: ethernet: ti: am65-cpsw-nuss: use of_platform_device_create() for mdio") +Signed-off-by: Siddharth Vadapalli +Reviewed-by: Roger Quadros +Link: https://lore.kernel.org/r/20230403090321.835877-1-s-vadapalli@ti.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +index 3e171527..9286b2b3 100644 +--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c ++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +@@ -2854,7 +2854,8 @@ static int am65_cpsw_nuss_probe(struct platform_device *pdev) + am65_cpsw_nuss_phylink_cleanup(common); + am65_cpts_release(common->cpts); + err_of_clear: +- of_platform_device_destroy(common->mdio_dev, NULL); ++ if (common->mdio_dev) ++ of_platform_device_destroy(common->mdio_dev, NULL); + err_pm_clear: + pm_runtime_put_sync(dev); + pm_runtime_disable(dev); +@@ -2883,7 +2884,8 @@ static int am65_cpsw_nuss_remove(struct platform_device *pdev) + am65_cpsw_nuss_phylink_cleanup(common); + am65_cpts_release(common->cpts); + +- of_platform_device_destroy(common->mdio_dev, NULL); ++ if (common->mdio_dev) ++ of_platform_device_destroy(common->mdio_dev, NULL); + + pm_runtime_put_sync(&pdev->dev); + pm_runtime_disable(&pdev->dev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-042-net-stmmac-fix-up-RX-flow-hash-indirection-tab.patch b/patches.kernel.org/6.2.11-042-net-stmmac-fix-up-RX-flow-hash-indirection-tab.patch new file mode 100644 index 0000000..1c106a5 --- /dev/null +++ b/patches.kernel.org/6.2.11-042-net-stmmac-fix-up-RX-flow-hash-indirection-tab.patch @@ -0,0 +1,87 @@ +From: Corinna Vinschen +Date: Mon, 3 Apr 2023 14:11:20 +0200 +Subject: [PATCH] net: stmmac: fix up RX flow hash indirection table when + setting channels +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 218c597325f4faf7b7a6049233a30d7842b5b2dc + +[ Upstream commit 218c597325f4faf7b7a6049233a30d7842b5b2dc ] + +stmmac_reinit_queues() fails to fix up the RX hash. Even if the number +of channels gets restricted, the output of `ethtool -x' indicates that +all RX queues are used: + + $ ethtool -l enp0s29f2 + Channel parameters for enp0s29f2: + Pre-set maximums: + RX: 8 + TX: 8 + Other: n/a + Combined: n/a + Current hardware settings: + RX: 8 + TX: 8 + Other: n/a + Combined: n/a + $ ethtool -x enp0s29f2 + RX flow hash indirection table for enp0s29f2 with 8 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 0 1 2 3 4 5 6 7 + [...] + $ ethtool -L enp0s29f2 rx 3 + $ ethtool -x enp0s29f2 + RX flow hash indirection table for enp0s29f2 with 3 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 0 1 2 3 4 5 6 7 + [...] + +Fix this by setting the indirection table according to the number +of specified queues. The result is now as expected: + + $ ethtool -L enp0s29f2 rx 3 + $ ethtool -x enp0s29f2 + RX flow hash indirection table for enp0s29f2 with 3 RX ring(s): + 0: 0 1 2 0 1 2 0 1 + 8: 2 0 1 2 0 1 2 0 + [...] + +Tested on Intel Elkhart Lake. + +Fixes: 0366f7e06a6b ("net: stmmac: add ethtool support for get/set channels") +Signed-off-by: Corinna Vinschen +Link: https://lore.kernel.org/r/20230403121120.489138-1-vinschen@redhat.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 20b51a39..4888536a 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -6948,7 +6948,7 @@ static void stmmac_napi_del(struct net_device *dev) + int stmmac_reinit_queues(struct net_device *dev, u32 rx_cnt, u32 tx_cnt) + { + struct stmmac_priv *priv = netdev_priv(dev); +- int ret = 0; ++ int ret = 0, i; + + if (netif_running(dev)) + stmmac_release(dev); +@@ -6957,6 +6957,10 @@ int stmmac_reinit_queues(struct net_device *dev, u32 rx_cnt, u32 tx_cnt) + + priv->plat->rx_queues_to_use = rx_cnt; + priv->plat->tx_queues_to_use = tx_cnt; ++ if (!netif_is_rxfh_configured(dev)) ++ for (i = 0; i < ARRAY_SIZE(priv->rss.table); i++) ++ priv->rss.table[i] = ethtool_rxfh_indir_default(i, ++ rx_cnt); + + stmmac_napi_add(dev); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-043-sunrpc-only-free-unix-grouplist-after-RCU-sett.patch b/patches.kernel.org/6.2.11-043-sunrpc-only-free-unix-grouplist-after-RCU-sett.patch new file mode 100644 index 0000000..da68f3f --- /dev/null +++ b/patches.kernel.org/6.2.11-043-sunrpc-only-free-unix-grouplist-after-RCU-sett.patch @@ -0,0 +1,59 @@ +From: Jeff Layton +Date: Thu, 30 Mar 2023 14:24:27 -0400 +Subject: [PATCH] sunrpc: only free unix grouplist after RCU settles +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 5085e41f9e83a1bec51da1f20b54f2ec3a13a3fe + +[ Upstream commit 5085e41f9e83a1bec51da1f20b54f2ec3a13a3fe ] + +While the unix_gid object is rcu-freed, the group_info list that it +contains is not. Ensure that we only put the group list reference once +we are really freeing the unix_gid object. + +Reported-by: Zhi Li +Link: https://bugzilla.redhat.com/show_bug.cgi?id=2183056 +Signed-off-by: Jeff Layton +Fixes: fd5d2f78261b ("SUNRPC: Make server side AUTH_UNIX use lockless lookups") +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/sunrpc/svcauth_unix.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c +index b1efc34d..609ade4f 100644 +--- a/net/sunrpc/svcauth_unix.c ++++ b/net/sunrpc/svcauth_unix.c +@@ -416,14 +416,23 @@ static int unix_gid_hash(kuid_t uid) + return hash_long(from_kuid(&init_user_ns, uid), GID_HASHBITS); + } + +-static void unix_gid_put(struct kref *kref) ++static void unix_gid_free(struct rcu_head *rcu) + { +- struct cache_head *item = container_of(kref, struct cache_head, ref); +- struct unix_gid *ug = container_of(item, struct unix_gid, h); ++ struct unix_gid *ug = container_of(rcu, struct unix_gid, rcu); ++ struct cache_head *item = &ug->h; ++ + if (test_bit(CACHE_VALID, &item->flags) && + !test_bit(CACHE_NEGATIVE, &item->flags)) + put_group_info(ug->gi); +- kfree_rcu(ug, rcu); ++ kfree(ug); ++} ++ ++static void unix_gid_put(struct kref *kref) ++{ ++ struct cache_head *item = container_of(kref, struct cache_head, ref); ++ struct unix_gid *ug = container_of(item, struct unix_gid, h); ++ ++ call_rcu(&ug->rcu, unix_gid_free); + } + + static int unix_gid_match(struct cache_head *corig, struct cache_head *cnew) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-044-NFSD-callback-request-does-not-use-correct-cre.patch b/patches.kernel.org/6.2.11-044-NFSD-callback-request-does-not-use-correct-cre.patch new file mode 100644 index 0000000..e017cb9 --- /dev/null +++ b/patches.kernel.org/6.2.11-044-NFSD-callback-request-does-not-use-correct-cre.patch @@ -0,0 +1,45 @@ +From: Dai Ngo +Date: Sat, 1 Apr 2023 13:22:08 -0700 +Subject: [PATCH] NFSD: callback request does not use correct credential for + AUTH_SYS +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 7de82c2f36fb26aa78440bbf0efcf360b691d98b + +[ Upstream commit 7de82c2f36fb26aa78440bbf0efcf360b691d98b ] + +Currently callback request does not use the credential specified in +CREATE_SESSION if the security flavor for the back channel is AUTH_SYS. + +Problem was discovered by pynfs 4.1 DELEG5 and DELEG7 test with error: +DELEG5 st_delegation.testCBSecParms : FAILURE + expected callback with uid, gid == 17, 19, got 0, 0 + +Signed-off-by: Dai Ngo +Reviewed-by: Jeff Layton +Fixes: 8276c902bbe9 ("SUNRPC: remove uid and gid from struct auth_cred") +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/nfsd/nfs4callback.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c +index 2a815f5a..4039ffcf 100644 +--- a/fs/nfsd/nfs4callback.c ++++ b/fs/nfsd/nfs4callback.c +@@ -946,8 +946,8 @@ static const struct cred *get_backchannel_cred(struct nfs4_client *clp, struct r + if (!kcred) + return NULL; + +- kcred->uid = ses->se_cb_sec.uid; +- kcred->gid = ses->se_cb_sec.gid; ++ kcred->fsuid = ses->se_cb_sec.uid; ++ kcred->fsgid = ses->se_cb_sec.gid; + return kcred; + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-045-ice-fix-wrong-fallback-logic-for-FDIR.patch b/patches.kernel.org/6.2.11-045-ice-fix-wrong-fallback-logic-for-FDIR.patch new file mode 100644 index 0000000..8033f52 --- /dev/null +++ b/patches.kernel.org/6.2.11-045-ice-fix-wrong-fallback-logic-for-FDIR.patch @@ -0,0 +1,60 @@ +From: Simei Su +Date: Wed, 22 Mar 2023 10:24:15 +0800 +Subject: [PATCH] ice: fix wrong fallback logic for FDIR +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: b4a01ace20f5c93c724abffc0a83ec84f514b98d + +[ Upstream commit b4a01ace20f5c93c724abffc0a83ec84f514b98d ] + +When adding a FDIR filter, if ice_vc_fdir_set_irq_ctx returns failure, +the inserted fdir entry will not be removed and if ice_vc_fdir_write_fltr +returns failure, the fdir context info for irq handler will not be cleared +which may lead to inconsistent or memory leak issue. This patch refines +failure cases to resolve this issue. + +Fixes: 1f7ea1cd6a37 ("ice: Enable FDIR Configure for AVF") +Signed-off-by: Simei Su +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c +index a2645ff3..f4ef76e3 100644 +--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c ++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c +@@ -1871,7 +1871,7 @@ int ice_vc_add_fdir_fltr(struct ice_vf *vf, u8 *msg) + v_ret = VIRTCHNL_STATUS_SUCCESS; + stat->status = VIRTCHNL_FDIR_FAILURE_RULE_NORESOURCE; + dev_dbg(dev, "VF %d: set FDIR context failed\n", vf->vf_id); +- goto err_free_conf; ++ goto err_rem_entry; + } + + ret = ice_vc_fdir_write_fltr(vf, conf, true, is_tun); +@@ -1880,15 +1880,16 @@ int ice_vc_add_fdir_fltr(struct ice_vf *vf, u8 *msg) + stat->status = VIRTCHNL_FDIR_FAILURE_RULE_NORESOURCE; + dev_err(dev, "VF %d: writing FDIR rule failed, ret:%d\n", + vf->vf_id, ret); +- goto err_rem_entry; ++ goto err_clr_irq; + } + + exit: + kfree(stat); + return ret; + +-err_rem_entry: ++err_clr_irq: + ice_vc_fdir_clear_irq_ctx(vf); ++err_rem_entry: + ice_vc_fdir_remove_entry(vf, conf, conf->flow_id); + err_free_conf: + devm_kfree(dev, conf); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-046-ice-Reset-FDIR-counter-in-FDIR-init-stage.patch b/patches.kernel.org/6.2.11-046-ice-Reset-FDIR-counter-in-FDIR-init-stage.patch new file mode 100644 index 0000000..41861a1 --- /dev/null +++ b/patches.kernel.org/6.2.11-046-ice-Reset-FDIR-counter-in-FDIR-init-stage.patch @@ -0,0 +1,62 @@ +From: Lingyu Liu +Date: Tue, 28 Mar 2023 10:49:11 +0000 +Subject: [PATCH] ice: Reset FDIR counter in FDIR init stage +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 83c911dc5e0e8e6eaa6431c06972a8f159bfe2fc + +[ Upstream commit 83c911dc5e0e8e6eaa6431c06972a8f159bfe2fc ] + +Reset the FDIR counters when FDIR inits. Without this patch, +when VF initializes or resets, all the FDIR counters are not +cleaned, which may cause unexpected behaviors for future FDIR +rule create (e.g., rule conflict). + +Fixes: 1f7ea1cd6a37 ("ice: Enable FDIR Configure for AVF") +Signed-off-by: Junfeng Guo +Signed-off-by: Lingyu Liu +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../net/ethernet/intel/ice/ice_virtchnl_fdir.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c +index f4ef76e3..7f726040 100644 +--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c ++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c +@@ -541,6 +541,21 @@ static void ice_vc_fdir_rem_prof_all(struct ice_vf *vf) + } + } + ++/** ++ * ice_vc_fdir_reset_cnt_all - reset all FDIR counters for this VF FDIR ++ * @fdir: pointer to the VF FDIR structure ++ */ ++static void ice_vc_fdir_reset_cnt_all(struct ice_vf_fdir *fdir) ++{ ++ enum ice_fltr_ptype flow; ++ ++ for (flow = ICE_FLTR_PTYPE_NONF_NONE; ++ flow < ICE_FLTR_PTYPE_MAX; flow++) { ++ fdir->fdir_fltr_cnt[flow][0] = 0; ++ fdir->fdir_fltr_cnt[flow][1] = 0; ++ } ++} ++ + /** + * ice_vc_fdir_has_prof_conflict + * @vf: pointer to the VF structure +@@ -1998,6 +2013,7 @@ void ice_vf_fdir_init(struct ice_vf *vf) + spin_lock_init(&fdir->ctx_lock); + fdir->ctx_irq.flags = 0; + fdir->ctx_done.flags = 0; ++ ice_vc_fdir_reset_cnt_all(fdir); + } + + /** +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-047-raw-use-net_hash_mix-in-hash-function.patch b/patches.kernel.org/6.2.11-047-raw-use-net_hash_mix-in-hash-function.patch new file mode 100644 index 0000000..bc52200 --- /dev/null +++ b/patches.kernel.org/6.2.11-047-raw-use-net_hash_mix-in-hash-function.patch @@ -0,0 +1,140 @@ +From: Eric Dumazet +Date: Thu, 2 Feb 2023 09:41:00 +0000 +Subject: [PATCH] raw: use net_hash_mix() in hash function +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 6579f5bacc2c4cbc5ef6abb45352416939d1f844 + +[ Upstream commit 6579f5bacc2c4cbc5ef6abb45352416939d1f844 ] + +Some applications seem to rely on RAW sockets. + +If they use private netns, we can avoid piling all RAW +sockets bound to a given protocol into a single bucket. + +Also place (struct raw_hashinfo).lock into its own +cache line to limit false sharing. + +Alternative would be to have per-netns hashtables, +but this seems too expensive for most netns +where RAW sockets are not used. + +Signed-off-by: Eric Dumazet +Signed-off-by: Jakub Kicinski +Stable-dep-of: 0a78cf7264d2 ("raw: Fix NULL deref in raw_get_next().") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + include/net/raw.h | 13 +++++++++++-- + net/ipv4/raw.c | 13 +++++++------ + net/ipv6/raw.c | 4 ++-- + 3 files changed, 20 insertions(+), 10 deletions(-) + +diff --git a/include/net/raw.h b/include/net/raw.h +index 5e665934..2c004c20 100644 +--- a/include/net/raw.h ++++ b/include/net/raw.h +@@ -15,6 +15,8 @@ + + #include + #include ++#include ++#include + #include + + extern struct proto raw_prot; +@@ -29,13 +31,20 @@ int raw_local_deliver(struct sk_buff *, int); + + int raw_rcv(struct sock *, struct sk_buff *); + +-#define RAW_HTABLE_SIZE MAX_INET_PROTOS ++#define RAW_HTABLE_LOG 8 ++#define RAW_HTABLE_SIZE (1U << RAW_HTABLE_LOG) + + struct raw_hashinfo { + spinlock_t lock; +- struct hlist_nulls_head ht[RAW_HTABLE_SIZE]; ++ ++ struct hlist_nulls_head ht[RAW_HTABLE_SIZE] ____cacheline_aligned; + }; + ++static inline u32 raw_hashfunc(const struct net *net, u32 proto) ++{ ++ return hash_32(net_hash_mix(net) ^ proto, RAW_HTABLE_LOG); ++} ++ + static inline void raw_hashinfo_init(struct raw_hashinfo *hashinfo) + { + int i; +diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c +index 006c1f0e..2a53a0bf 100644 +--- a/net/ipv4/raw.c ++++ b/net/ipv4/raw.c +@@ -93,7 +93,7 @@ int raw_hash_sk(struct sock *sk) + struct raw_hashinfo *h = sk->sk_prot->h.raw_hash; + struct hlist_nulls_head *hlist; + +- hlist = &h->ht[inet_sk(sk)->inet_num & (RAW_HTABLE_SIZE - 1)]; ++ hlist = &h->ht[raw_hashfunc(sock_net(sk), inet_sk(sk)->inet_num)]; + + spin_lock(&h->lock); + __sk_nulls_add_node_rcu(sk, hlist); +@@ -160,9 +160,9 @@ static int icmp_filter(const struct sock *sk, const struct sk_buff *skb) + * RFC 1122: SHOULD pass TOS value up to the transport layer. + * -> It does. And not only TOS, but all IP header. + */ +-static int raw_v4_input(struct sk_buff *skb, const struct iphdr *iph, int hash) ++static int raw_v4_input(struct net *net, struct sk_buff *skb, ++ const struct iphdr *iph, int hash) + { +- struct net *net = dev_net(skb->dev); + struct hlist_nulls_head *hlist; + struct hlist_nulls_node *hnode; + int sdif = inet_sdif(skb); +@@ -193,9 +193,10 @@ static int raw_v4_input(struct sk_buff *skb, const struct iphdr *iph, int hash) + + int raw_local_deliver(struct sk_buff *skb, int protocol) + { +- int hash = protocol & (RAW_HTABLE_SIZE - 1); ++ struct net *net = dev_net(skb->dev); + +- return raw_v4_input(skb, ip_hdr(skb), hash); ++ return raw_v4_input(net, skb, ip_hdr(skb), ++ raw_hashfunc(net, protocol)); + } + + static void raw_err(struct sock *sk, struct sk_buff *skb, u32 info) +@@ -271,7 +272,7 @@ void raw_icmp_error(struct sk_buff *skb, int protocol, u32 info) + struct sock *sk; + int hash; + +- hash = protocol & (RAW_HTABLE_SIZE - 1); ++ hash = raw_hashfunc(net, protocol); + hlist = &raw_v4_hashinfo.ht[hash]; + + rcu_read_lock(); +diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c +index ada087b5..45b35b5f 100644 +--- a/net/ipv6/raw.c ++++ b/net/ipv6/raw.c +@@ -152,7 +152,7 @@ static bool ipv6_raw_deliver(struct sk_buff *skb, int nexthdr) + saddr = &ipv6_hdr(skb)->saddr; + daddr = saddr + 1; + +- hash = nexthdr & (RAW_HTABLE_SIZE - 1); ++ hash = raw_hashfunc(net, nexthdr); + hlist = &raw_v6_hashinfo.ht[hash]; + rcu_read_lock(); + sk_nulls_for_each(sk, hnode, hlist) { +@@ -338,7 +338,7 @@ void raw6_icmp_error(struct sk_buff *skb, int nexthdr, + struct sock *sk; + int hash; + +- hash = nexthdr & (RAW_HTABLE_SIZE - 1); ++ hash = raw_hashfunc(net, nexthdr); + hlist = &raw_v6_hashinfo.ht[hash]; + rcu_read_lock(); + sk_nulls_for_each(sk, hnode, hlist) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-048-raw-Fix-NULL-deref-in-raw_get_next.patch b/patches.kernel.org/6.2.11-048-raw-Fix-NULL-deref-in-raw_get_next.patch new file mode 100644 index 0000000..db53e42 --- /dev/null +++ b/patches.kernel.org/6.2.11-048-raw-Fix-NULL-deref-in-raw_get_next.patch @@ -0,0 +1,349 @@ +From: Kuniyuki Iwashima +Date: Mon, 3 Apr 2023 12:49:58 -0700 +Subject: [PATCH] raw: Fix NULL deref in raw_get_next(). +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 0a78cf7264d29abeca098eae0b188a10aabc8a32 + +[ Upstream commit 0a78cf7264d29abeca098eae0b188a10aabc8a32 ] + +Dae R. Jeong reported a NULL deref in raw_get_next() [0]. + +It seems that the repro was running these sequences in parallel so +that one thread was iterating on a socket that was being freed in +another netns. + + unshare(0x40060200) + r0 = syz_open_procfs(0x0, &(0x7f0000002080)='net/raw\x00') + socket$inet_icmp_raw(0x2, 0x3, 0x1) + pread64(r0, &(0x7f0000000000)=""/10, 0xa, 0x10000000007f) + +After commit 0daf07e52709 ("raw: convert raw sockets to RCU"), we +use RCU and hlist_nulls_for_each_entry() to iterate over SOCK_RAW +sockets. However, we should use spinlock for slow paths to avoid +the NULL deref. + +Also, SOCK_RAW does not use SLAB_TYPESAFE_BY_RCU, and the slab object +is not reused during iteration in the grace period. In fact, the +lockless readers do not check the nulls marker with get_nulls_value(). +So, SOCK_RAW should use hlist instead of hlist_nulls. + +Instead of adding an unnecessary barrier by sk_nulls_for_each_rcu(), +let's convert hlist_nulls to hlist and use sk_for_each_rcu() for +fast paths and sk_for_each() and spinlock for /proc/net/raw. + +[0]: +general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN +KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] +CPU: 2 PID: 20952 Comm: syz-executor.0 Not tainted 6.2.0-g048ec869bafd-dirty #7 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 +RIP: 0010:read_pnet include/net/net_namespace.h:383 [inline] +RIP: 0010:sock_net include/net/sock.h:649 [inline] +RIP: 0010:raw_get_next net/ipv4/raw.c:974 [inline] +RIP: 0010:raw_get_idx net/ipv4/raw.c:986 [inline] +RIP: 0010:raw_seq_start+0x431/0x800 net/ipv4/raw.c:995 +Code: ef e8 33 3d 94 f7 49 8b 6d 00 4c 89 ef e8 b7 65 5f f7 49 89 ed 49 83 c5 98 0f 84 9a 00 00 00 48 83 c5 c8 48 89 e8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 ef e8 00 3d 94 f7 4c 8b 7d 00 48 89 ef +RSP: 0018:ffffc9001154f9b0 EFLAGS: 00010206 +RAX: 0000000000000005 RBX: 1ffff1100302c8fd RCX: 0000000000000000 +RDX: 0000000000000028 RSI: ffffc9001154f988 RDI: ffffc9000f77a338 +RBP: 0000000000000029 R08: ffffffff8a50ffb4 R09: fffffbfff24b6bd9 +R10: fffffbfff24b6bd9 R11: 0000000000000000 R12: ffff88801db73b78 +R13: fffffffffffffff9 R14: dffffc0000000000 R15: 0000000000000030 +FS: 00007f843ae8e700(0000) GS:ffff888063700000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 000055bb9614b35f CR3: 000000003c672000 CR4: 00000000003506e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + seq_read_iter+0x4c6/0x10f0 fs/seq_file.c:225 + seq_read+0x224/0x320 fs/seq_file.c:162 + pde_read fs/proc/inode.c:316 [inline] + proc_reg_read+0x23f/0x330 fs/proc/inode.c:328 + vfs_read+0x31e/0xd30 fs/read_write.c:468 + ksys_pread64 fs/read_write.c:665 [inline] + __do_sys_pread64 fs/read_write.c:675 [inline] + __se_sys_pread64 fs/read_write.c:672 [inline] + __x64_sys_pread64+0x1e9/0x280 fs/read_write.c:672 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x478d29 +Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007f843ae8dbe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000011 +RAX: ffffffffffffffda RBX: 0000000000791408 RCX: 0000000000478d29 +RDX: 000000000000000a RSI: 0000000020000000 RDI: 0000000000000003 +RBP: 00000000f477909a R08: 0000000000000000 R09: 0000000000000000 +R10: 000010000000007f R11: 0000000000000246 R12: 0000000000791740 +R13: 0000000000791414 R14: 0000000000791408 R15: 00007ffc2eb48a50 + +Modules linked in: +---[ end trace 0000000000000000 ]--- +RIP: 0010:read_pnet include/net/net_namespace.h:383 [inline] +RIP: 0010:sock_net include/net/sock.h:649 [inline] +RIP: 0010:raw_get_next net/ipv4/raw.c:974 [inline] +RIP: 0010:raw_get_idx net/ipv4/raw.c:986 [inline] +RIP: 0010:raw_seq_start+0x431/0x800 net/ipv4/raw.c:995 +Code: ef e8 33 3d 94 f7 49 8b 6d 00 4c 89 ef e8 b7 65 5f f7 49 89 ed 49 83 c5 98 0f 84 9a 00 00 00 48 83 c5 c8 48 89 e8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 ef e8 00 3d 94 f7 4c 8b 7d 00 48 89 ef +RSP: 0018:ffffc9001154f9b0 EFLAGS: 00010206 +RAX: 0000000000000005 RBX: 1ffff1100302c8fd RCX: 0000000000000000 +RDX: 0000000000000028 RSI: ffffc9001154f988 RDI: ffffc9000f77a338 +RBP: 0000000000000029 R08: ffffffff8a50ffb4 R09: fffffbfff24b6bd9 +R10: fffffbfff24b6bd9 R11: 0000000000000000 R12: ffff88801db73b78 +R13: fffffffffffffff9 R14: dffffc0000000000 R15: 0000000000000030 +FS: 00007f843ae8e700(0000) GS:ffff888063700000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f92ff166000 CR3: 000000003c672000 CR4: 00000000003506e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + +Fixes: 0daf07e52709 ("raw: convert raw sockets to RCU") +Reported-by: syzbot +Reported-by: Dae R. Jeong +Link: https://lore.kernel.org/netdev/ZCA2mGV_cmq7lIfV@dragonet/ +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + include/net/raw.h | 4 ++-- + net/ipv4/raw.c | 36 +++++++++++++++++++----------------- + net/ipv4/raw_diag.c | 10 ++++------ + net/ipv6/raw.c | 10 ++++------ + 4 files changed, 29 insertions(+), 31 deletions(-) + +diff --git a/include/net/raw.h b/include/net/raw.h +index 2c004c20..3af5289f 100644 +--- a/include/net/raw.h ++++ b/include/net/raw.h +@@ -37,7 +37,7 @@ int raw_rcv(struct sock *, struct sk_buff *); + struct raw_hashinfo { + spinlock_t lock; + +- struct hlist_nulls_head ht[RAW_HTABLE_SIZE] ____cacheline_aligned; ++ struct hlist_head ht[RAW_HTABLE_SIZE] ____cacheline_aligned; + }; + + static inline u32 raw_hashfunc(const struct net *net, u32 proto) +@@ -51,7 +51,7 @@ static inline void raw_hashinfo_init(struct raw_hashinfo *hashinfo) + + spin_lock_init(&hashinfo->lock); + for (i = 0; i < RAW_HTABLE_SIZE; i++) +- INIT_HLIST_NULLS_HEAD(&hashinfo->ht[i], i); ++ INIT_HLIST_HEAD(&hashinfo->ht[i]); + } + + #ifdef CONFIG_PROC_FS +diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c +index 2a53a0bf..af03aa8a 100644 +--- a/net/ipv4/raw.c ++++ b/net/ipv4/raw.c +@@ -91,12 +91,12 @@ EXPORT_SYMBOL_GPL(raw_v4_hashinfo); + int raw_hash_sk(struct sock *sk) + { + struct raw_hashinfo *h = sk->sk_prot->h.raw_hash; +- struct hlist_nulls_head *hlist; ++ struct hlist_head *hlist; + + hlist = &h->ht[raw_hashfunc(sock_net(sk), inet_sk(sk)->inet_num)]; + + spin_lock(&h->lock); +- __sk_nulls_add_node_rcu(sk, hlist); ++ sk_add_node_rcu(sk, hlist); + sock_set_flag(sk, SOCK_RCU_FREE); + spin_unlock(&h->lock); + sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1); +@@ -110,7 +110,7 @@ void raw_unhash_sk(struct sock *sk) + struct raw_hashinfo *h = sk->sk_prot->h.raw_hash; + + spin_lock(&h->lock); +- if (__sk_nulls_del_node_init_rcu(sk)) ++ if (sk_del_node_init_rcu(sk)) + sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1); + spin_unlock(&h->lock); + } +@@ -163,16 +163,15 @@ static int icmp_filter(const struct sock *sk, const struct sk_buff *skb) + static int raw_v4_input(struct net *net, struct sk_buff *skb, + const struct iphdr *iph, int hash) + { +- struct hlist_nulls_head *hlist; +- struct hlist_nulls_node *hnode; + int sdif = inet_sdif(skb); ++ struct hlist_head *hlist; + int dif = inet_iif(skb); + int delivered = 0; + struct sock *sk; + + hlist = &raw_v4_hashinfo.ht[hash]; + rcu_read_lock(); +- sk_nulls_for_each(sk, hnode, hlist) { ++ sk_for_each_rcu(sk, hlist) { + if (!raw_v4_match(net, sk, iph->protocol, + iph->saddr, iph->daddr, dif, sdif)) + continue; +@@ -264,10 +263,9 @@ static void raw_err(struct sock *sk, struct sk_buff *skb, u32 info) + void raw_icmp_error(struct sk_buff *skb, int protocol, u32 info) + { + struct net *net = dev_net(skb->dev); +- struct hlist_nulls_head *hlist; +- struct hlist_nulls_node *hnode; + int dif = skb->dev->ifindex; + int sdif = inet_sdif(skb); ++ struct hlist_head *hlist; + const struct iphdr *iph; + struct sock *sk; + int hash; +@@ -276,7 +274,7 @@ void raw_icmp_error(struct sk_buff *skb, int protocol, u32 info) + hlist = &raw_v4_hashinfo.ht[hash]; + + rcu_read_lock(); +- sk_nulls_for_each(sk, hnode, hlist) { ++ sk_for_each_rcu(sk, hlist) { + iph = (const struct iphdr *)skb->data; + if (!raw_v4_match(net, sk, iph->protocol, + iph->daddr, iph->saddr, dif, sdif)) +@@ -948,14 +946,13 @@ static struct sock *raw_get_first(struct seq_file *seq, int bucket) + { + struct raw_hashinfo *h = pde_data(file_inode(seq->file)); + struct raw_iter_state *state = raw_seq_private(seq); +- struct hlist_nulls_head *hlist; +- struct hlist_nulls_node *hnode; ++ struct hlist_head *hlist; + struct sock *sk; + + for (state->bucket = bucket; state->bucket < RAW_HTABLE_SIZE; + ++state->bucket) { + hlist = &h->ht[state->bucket]; +- sk_nulls_for_each(sk, hnode, hlist) { ++ sk_for_each(sk, hlist) { + if (sock_net(sk) == seq_file_net(seq)) + return sk; + } +@@ -968,7 +965,7 @@ static struct sock *raw_get_next(struct seq_file *seq, struct sock *sk) + struct raw_iter_state *state = raw_seq_private(seq); + + do { +- sk = sk_nulls_next(sk); ++ sk = sk_next(sk); + } while (sk && sock_net(sk) != seq_file_net(seq)); + + if (!sk) +@@ -987,9 +984,12 @@ static struct sock *raw_get_idx(struct seq_file *seq, loff_t pos) + } + + void *raw_seq_start(struct seq_file *seq, loff_t *pos) +- __acquires(RCU) ++ __acquires(&h->lock) + { +- rcu_read_lock(); ++ struct raw_hashinfo *h = pde_data(file_inode(seq->file)); ++ ++ spin_lock(&h->lock); ++ + return *pos ? raw_get_idx(seq, *pos - 1) : SEQ_START_TOKEN; + } + EXPORT_SYMBOL_GPL(raw_seq_start); +@@ -1008,9 +1008,11 @@ void *raw_seq_next(struct seq_file *seq, void *v, loff_t *pos) + EXPORT_SYMBOL_GPL(raw_seq_next); + + void raw_seq_stop(struct seq_file *seq, void *v) +- __releases(RCU) ++ __releases(&h->lock) + { +- rcu_read_unlock(); ++ struct raw_hashinfo *h = pde_data(file_inode(seq->file)); ++ ++ spin_unlock(&h->lock); + } + EXPORT_SYMBOL_GPL(raw_seq_stop); + +diff --git a/net/ipv4/raw_diag.c b/net/ipv4/raw_diag.c +index 99932183..da3591a6 100644 +--- a/net/ipv4/raw_diag.c ++++ b/net/ipv4/raw_diag.c +@@ -57,8 +57,7 @@ static bool raw_lookup(struct net *net, struct sock *sk, + static struct sock *raw_sock_get(struct net *net, const struct inet_diag_req_v2 *r) + { + struct raw_hashinfo *hashinfo = raw_get_hashinfo(r); +- struct hlist_nulls_head *hlist; +- struct hlist_nulls_node *hnode; ++ struct hlist_head *hlist; + struct sock *sk; + int slot; + +@@ -68,7 +67,7 @@ static struct sock *raw_sock_get(struct net *net, const struct inet_diag_req_v2 + rcu_read_lock(); + for (slot = 0; slot < RAW_HTABLE_SIZE; slot++) { + hlist = &hashinfo->ht[slot]; +- sk_nulls_for_each(sk, hnode, hlist) { ++ sk_for_each_rcu(sk, hlist) { + if (raw_lookup(net, sk, r)) { + /* + * Grab it and keep until we fill +@@ -142,9 +141,8 @@ static void raw_diag_dump(struct sk_buff *skb, struct netlink_callback *cb, + struct raw_hashinfo *hashinfo = raw_get_hashinfo(r); + struct net *net = sock_net(skb->sk); + struct inet_diag_dump_data *cb_data; +- struct hlist_nulls_head *hlist; +- struct hlist_nulls_node *hnode; + int num, s_num, slot, s_slot; ++ struct hlist_head *hlist; + struct sock *sk = NULL; + struct nlattr *bc; + +@@ -161,7 +159,7 @@ static void raw_diag_dump(struct sk_buff *skb, struct netlink_callback *cb, + num = 0; + + hlist = &hashinfo->ht[slot]; +- sk_nulls_for_each(sk, hnode, hlist) { ++ sk_for_each_rcu(sk, hlist) { + struct inet_sock *inet = inet_sk(sk); + + if (!net_eq(sock_net(sk), net)) +diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c +index 45b35b5f..4fc511bd 100644 +--- a/net/ipv6/raw.c ++++ b/net/ipv6/raw.c +@@ -141,10 +141,9 @@ EXPORT_SYMBOL(rawv6_mh_filter_unregister); + static bool ipv6_raw_deliver(struct sk_buff *skb, int nexthdr) + { + struct net *net = dev_net(skb->dev); +- struct hlist_nulls_head *hlist; +- struct hlist_nulls_node *hnode; + const struct in6_addr *saddr; + const struct in6_addr *daddr; ++ struct hlist_head *hlist; + struct sock *sk; + bool delivered = false; + __u8 hash; +@@ -155,7 +154,7 @@ static bool ipv6_raw_deliver(struct sk_buff *skb, int nexthdr) + hash = raw_hashfunc(net, nexthdr); + hlist = &raw_v6_hashinfo.ht[hash]; + rcu_read_lock(); +- sk_nulls_for_each(sk, hnode, hlist) { ++ sk_for_each_rcu(sk, hlist) { + int filtered; + + if (!raw_v6_match(net, sk, nexthdr, daddr, saddr, +@@ -333,15 +332,14 @@ void raw6_icmp_error(struct sk_buff *skb, int nexthdr, + u8 type, u8 code, int inner_offset, __be32 info) + { + struct net *net = dev_net(skb->dev); +- struct hlist_nulls_head *hlist; +- struct hlist_nulls_node *hnode; ++ struct hlist_head *hlist; + struct sock *sk; + int hash; + + hash = raw_hashfunc(net, nexthdr); + hlist = &raw_v6_hashinfo.ht[hash]; + rcu_read_lock(); +- sk_nulls_for_each(sk, hnode, hlist) { ++ sk_for_each_rcu(sk, hlist) { + /* Note: ipv6_hdr(skb) != skb->data */ + const struct ipv6hdr *ip6h = (const struct ipv6hdr *)skb->data; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-049-ping-Fix-potentail-NULL-deref-for-proc-net-icm.patch b/patches.kernel.org/6.2.11-049-ping-Fix-potentail-NULL-deref-for-proc-net-icm.patch new file mode 100644 index 0000000..7299c4f --- /dev/null +++ b/patches.kernel.org/6.2.11-049-ping-Fix-potentail-NULL-deref-for-proc-net-icm.patch @@ -0,0 +1,64 @@ +From: Kuniyuki Iwashima +Date: Mon, 3 Apr 2023 12:49:59 -0700 +Subject: [PATCH] ping: Fix potentail NULL deref for /proc/net/icmp. +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: ab5fb73ffa01072b4d8031cc05801fa1cb653bee + +[ Upstream commit ab5fb73ffa01072b4d8031cc05801fa1cb653bee ] + +After commit dbca1596bbb0 ("ping: convert to RCU lookups, get rid +of rwlock"), we use RCU for ping sockets, but we should use spinlock +for /proc/net/icmp to avoid a potential NULL deref mentioned in +the previous patch. + +Let's go back to using spinlock there. + +Note we can convert ping sockets to use hlist instead of hlist_nulls +because we do not use SLAB_TYPESAFE_BY_RCU for ping sockets. + +Fixes: dbca1596bbb0 ("ping: convert to RCU lookups, get rid of rwlock") +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/ipv4/ping.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c +index 409ec2a1..5178a3f3 100644 +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -1089,13 +1089,13 @@ static struct sock *ping_get_idx(struct seq_file *seq, loff_t pos) + } + + void *ping_seq_start(struct seq_file *seq, loff_t *pos, sa_family_t family) +- __acquires(RCU) ++ __acquires(ping_table.lock) + { + struct ping_iter_state *state = seq->private; + state->bucket = 0; + state->family = family; + +- rcu_read_lock(); ++ spin_lock(&ping_table.lock); + + return *pos ? ping_get_idx(seq, *pos-1) : SEQ_START_TOKEN; + } +@@ -1121,9 +1121,9 @@ void *ping_seq_next(struct seq_file *seq, void *v, loff_t *pos) + EXPORT_SYMBOL_GPL(ping_seq_next); + + void ping_seq_stop(struct seq_file *seq, void *v) +- __releases(RCU) ++ __releases(ping_table.lock) + { +- rcu_read_unlock(); ++ spin_unlock(&ping_table.lock); + } + EXPORT_SYMBOL_GPL(ping_seq_stop); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-050-ethtool-reset-lanes-when-lanes-is-omitted.patch b/patches.kernel.org/6.2.11-050-ethtool-reset-lanes-when-lanes-is-omitted.patch new file mode 100644 index 0000000..fda01bb --- /dev/null +++ b/patches.kernel.org/6.2.11-050-ethtool-reset-lanes-when-lanes-is-omitted.patch @@ -0,0 +1,94 @@ +From: Andy Roulin +Date: Mon, 3 Apr 2023 14:20:53 -0700 +Subject: [PATCH] ethtool: reset #lanes when lanes is omitted +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: e847c7675e19ef344913724dc68f83df31ad6a17 + +[ Upstream commit e847c7675e19ef344913724dc68f83df31ad6a17 ] + +If the number of lanes was forced and then subsequently the user +omits this parameter, the ksettings->lanes is reset. The driver +should then reset the number of lanes to the device's default +for the specified speed. + +However, although the ksettings->lanes is set to 0, the mod variable +is not set to true to indicate the driver and userspace should be +notified of the changes. + +The consequence is that the same ethtool operation will produce +different results based on the initial state. + +If the initial state is: +$ ethtool swp1 | grep -A 3 'Speed: ' + Speed: 500000Mb/s + Lanes: 2 + Duplex: Full + Auto-negotiation: on + +then executing 'ethtool -s swp1 speed 50000 autoneg off' will yield: +$ ethtool swp1 | grep -A 3 'Speed: ' + Speed: 500000Mb/s + Lanes: 2 + Duplex: Full + Auto-negotiation: off + +While if the initial state is: +$ ethtool swp1 | grep -A 3 'Speed: ' + Speed: 500000Mb/s + Lanes: 1 + Duplex: Full + Auto-negotiation: off + +executing the same 'ethtool -s swp1 speed 50000 autoneg off' results in: +$ ethtool swp1 | grep -A 3 'Speed: ' + Speed: 500000Mb/s + Lanes: 1 + Duplex: Full + Auto-negotiation: off + +This patch fixes this behavior. Omitting lanes will always results in +the driver choosing the default lane width for the chosen speed. In this +scenario, regardless of the initial state, the end state will be, e.g., + +$ ethtool swp1 | grep -A 3 'Speed: ' + Speed: 500000Mb/s + Lanes: 2 + Duplex: Full + Auto-negotiation: off + +Fixes: 012ce4dd3102 ("ethtool: Extend link modes settings uAPI with lanes") +Signed-off-by: Andy Roulin +Reviewed-by: Danielle Ratson +Reviewed-by: Ido Schimmel +Link: https://lore.kernel.org/r/ac238d6b-8726-8156-3810-6471291dbc7f@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/ethtool/linkmodes.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/net/ethtool/linkmodes.c b/net/ethtool/linkmodes.c +index 126e06c7..2d91f2a8 100644 +--- a/net/ethtool/linkmodes.c ++++ b/net/ethtool/linkmodes.c +@@ -282,11 +282,12 @@ static int ethnl_update_linkmodes(struct genl_info *info, struct nlattr **tb, + "lanes configuration not supported by device"); + return -EOPNOTSUPP; + } +- } else if (!lsettings->autoneg) { +- /* If autoneg is off and lanes parameter is not passed from user, +- * set the lanes parameter to 0. ++ } else if (!lsettings->autoneg && ksettings->lanes) { ++ /* If autoneg is off and lanes parameter is not passed from user but ++ * it was defined previously then set the lanes parameter to 0. + */ + ksettings->lanes = 0; ++ *mod = true; + } + + ret = ethnl_update_bitset(ksettings->link_modes.advertising, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-051-netlink-annotate-lockless-accesses-to-nlk-max_.patch b/patches.kernel.org/6.2.11-051-netlink-annotate-lockless-accesses-to-nlk-max_.patch new file mode 100644 index 0000000..048cd49 --- /dev/null +++ b/patches.kernel.org/6.2.11-051-netlink-annotate-lockless-accesses-to-nlk-max_.patch @@ -0,0 +1,112 @@ +From: Eric Dumazet +Date: Mon, 3 Apr 2023 21:46:43 +0000 +Subject: [PATCH] netlink: annotate lockless accesses to nlk->max_recvmsg_len +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: a1865f2e7d10dde00d35a2122b38d2e469ae67ed + +[ Upstream commit a1865f2e7d10dde00d35a2122b38d2e469ae67ed ] + +syzbot reported a data-race in data-race in netlink_recvmsg() [1] + +Indeed, netlink_recvmsg() can be run concurrently, +and netlink_dump() also needs protection. + +[1] +BUG: KCSAN: data-race in netlink_recvmsg / netlink_recvmsg + +read to 0xffff888141840b38 of 8 bytes by task 23057 on cpu 0: +netlink_recvmsg+0xea/0x730 net/netlink/af_netlink.c:1988 +sock_recvmsg_nosec net/socket.c:1017 [inline] +sock_recvmsg net/socket.c:1038 [inline] +__sys_recvfrom+0x1ee/0x2e0 net/socket.c:2194 +__do_sys_recvfrom net/socket.c:2212 [inline] +__se_sys_recvfrom net/socket.c:2208 [inline] +__x64_sys_recvfrom+0x78/0x90 net/socket.c:2208 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +write to 0xffff888141840b38 of 8 bytes by task 23037 on cpu 1: +netlink_recvmsg+0x114/0x730 net/netlink/af_netlink.c:1989 +sock_recvmsg_nosec net/socket.c:1017 [inline] +sock_recvmsg net/socket.c:1038 [inline] +____sys_recvmsg+0x156/0x310 net/socket.c:2720 +___sys_recvmsg net/socket.c:2762 [inline] +do_recvmmsg+0x2e5/0x710 net/socket.c:2856 +__sys_recvmmsg net/socket.c:2935 [inline] +__do_sys_recvmmsg net/socket.c:2958 [inline] +__se_sys_recvmmsg net/socket.c:2951 [inline] +__x64_sys_recvmmsg+0xe2/0x160 net/socket.c:2951 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +value changed: 0x0000000000000000 -> 0x0000000000001000 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 PID: 23037 Comm: syz-executor.2 Not tainted 6.3.0-rc4-syzkaller-00195-g5a57b48fdfcb #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 + +Fixes: 9063e21fb026 ("netlink: autosize skb lengthes") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230403214643.768555-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/netlink/af_netlink.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index c6427765..f365dfdd 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -1952,7 +1952,7 @@ static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + struct scm_cookie scm; + struct sock *sk = sock->sk; + struct netlink_sock *nlk = nlk_sk(sk); +- size_t copied; ++ size_t copied, max_recvmsg_len; + struct sk_buff *skb, *data_skb; + int err, ret; + +@@ -1985,9 +1985,10 @@ static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + #endif + + /* Record the max length of recvmsg() calls for future allocations */ +- nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len); +- nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len, +- SKB_WITH_OVERHEAD(32768)); ++ max_recvmsg_len = max(READ_ONCE(nlk->max_recvmsg_len), len); ++ max_recvmsg_len = min_t(size_t, max_recvmsg_len, ++ SKB_WITH_OVERHEAD(32768)); ++ WRITE_ONCE(nlk->max_recvmsg_len, max_recvmsg_len); + + copied = data_skb->len; + if (len < copied) { +@@ -2236,6 +2237,7 @@ static int netlink_dump(struct sock *sk) + struct netlink_ext_ack extack = {}; + struct netlink_callback *cb; + struct sk_buff *skb = NULL; ++ size_t max_recvmsg_len; + struct module *module; + int err = -ENOBUFS; + int alloc_min_size; +@@ -2258,8 +2260,9 @@ static int netlink_dump(struct sock *sk) + cb = &nlk->cb; + alloc_min_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE); + +- if (alloc_min_size < nlk->max_recvmsg_len) { +- alloc_size = nlk->max_recvmsg_len; ++ max_recvmsg_len = READ_ONCE(nlk->max_recvmsg_len); ++ if (alloc_min_size < max_recvmsg_len) { ++ alloc_size = max_recvmsg_len; + skb = alloc_skb(alloc_size, + (GFP_KERNEL & ~__GFP_DIRECT_RECLAIM) | + __GFP_NOWARN | __GFP_NORETRY); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-052-gve-Secure-enough-bytes-in-the-first-TX-desc-f.patch b/patches.kernel.org/6.2.11-052-gve-Secure-enough-bytes-in-the-first-TX-desc-f.patch new file mode 100644 index 0000000..a7b2ac0 --- /dev/null +++ b/patches.kernel.org/6.2.11-052-gve-Secure-enough-bytes-in-the-first-TX-desc-f.patch @@ -0,0 +1,75 @@ +From: Shailend Chand +Date: Mon, 3 Apr 2023 10:28:09 -0700 +Subject: [PATCH] gve: Secure enough bytes in the first TX desc for all TCP + pkts +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 3ce9345580974863c060fa32971537996a7b2d57 + +[ Upstream commit 3ce9345580974863c060fa32971537996a7b2d57 ] + +Non-GSO TCP packets whose SKBs' linear portion did not include the +entire TCP header were not populating the first Tx descriptor with +as many bytes as the vNIC expected. This change ensures that all +TCP packets populate the first descriptor with the correct number of +bytes. + +Fixes: 893ce44df565 ("gve: Add basic driver framework for Compute Engine Virtual NIC") +Signed-off-by: Shailend Chand +Link: https://lore.kernel.org/r/20230403172809.2939306-1-shailend@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/google/gve/gve.h | 2 ++ + drivers/net/ethernet/google/gve/gve_tx.c | 12 +++++------- + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/google/gve/gve.h b/drivers/net/ethernet/google/gve/gve.h +index 64eb0442..005cb9df 100644 +--- a/drivers/net/ethernet/google/gve/gve.h ++++ b/drivers/net/ethernet/google/gve/gve.h +@@ -47,6 +47,8 @@ + + #define GVE_RX_BUFFER_SIZE_DQO 2048 + ++#define GVE_GQ_TX_MIN_PKT_DESC_BYTES 182 ++ + /* Each slot in the desc ring has a 1:1 mapping to a slot in the data ring */ + struct gve_rx_desc_queue { + struct gve_rx_desc *desc_ring; /* the descriptor ring */ +diff --git a/drivers/net/ethernet/google/gve/gve_tx.c b/drivers/net/ethernet/google/gve/gve_tx.c +index 4888bf05..5e11b823 100644 +--- a/drivers/net/ethernet/google/gve/gve_tx.c ++++ b/drivers/net/ethernet/google/gve/gve_tx.c +@@ -284,8 +284,8 @@ static inline int gve_skb_fifo_bytes_required(struct gve_tx_ring *tx, + int bytes; + int hlen; + +- hlen = skb_is_gso(skb) ? skb_checksum_start_offset(skb) + +- tcp_hdrlen(skb) : skb_headlen(skb); ++ hlen = skb_is_gso(skb) ? skb_checksum_start_offset(skb) + tcp_hdrlen(skb) : ++ min_t(int, GVE_GQ_TX_MIN_PKT_DESC_BYTES, skb->len); + + pad_bytes = gve_tx_fifo_pad_alloc_one_frag(&tx->tx_fifo, + hlen); +@@ -454,13 +454,11 @@ static int gve_tx_add_skb_copy(struct gve_priv *priv, struct gve_tx_ring *tx, st + pkt_desc = &tx->desc[idx]; + + l4_hdr_offset = skb_checksum_start_offset(skb); +- /* If the skb is gso, then we want the tcp header in the first segment +- * otherwise we want the linear portion of the skb (which will contain +- * the checksum because skb->csum_start and skb->csum_offset are given +- * relative to skb->head) in the first segment. ++ /* If the skb is gso, then we want the tcp header alone in the first segment ++ * otherwise we want the minimum required by the gVNIC spec. + */ + hlen = is_gso ? l4_hdr_offset + tcp_hdrlen(skb) : +- skb_headlen(skb); ++ min_t(int, GVE_GQ_TX_MIN_PKT_DESC_BYTES, skb->len); + + info->skb = skb; + /* We don't want to split the header, so if necessary, pad to the end +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-053-arm64-compat-Work-around-uninitialized-variabl.patch b/patches.kernel.org/6.2.11-053-arm64-compat-Work-around-uninitialized-variabl.patch new file mode 100644 index 0000000..fe2acd9 --- /dev/null +++ b/patches.kernel.org/6.2.11-053-arm64-compat-Work-around-uninitialized-variabl.patch @@ -0,0 +1,94 @@ +From: Ard Biesheuvel +Date: Tue, 4 Apr 2023 12:36:25 +0200 +Subject: [PATCH] arm64: compat: Work around uninitialized variable warning +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 32d85999680601d01b2a36713c9ffd7397c8688b + +[ Upstream commit 32d85999680601d01b2a36713c9ffd7397c8688b ] + +Dan reports that smatch complains about a potential uninitialized +variable being used in the compat alignment fixup code. + +The logic is not wrong per se, but we do end up using an uninitialized +variable if reading the instruction that triggered the alignment fault +from user space faults, even if the fault ensures that the uninitialized +value doesn't propagate any further. + +Given that we just give up and return 1 if any fault occurs when reading +the instruction, let's get rid of the 'success handling' pattern that +captures the fault in a variable and aborts later, and instead, just +return 1 immediately if any of the get_user() calls result in an +exception. + +Fixes: 3fc24ef32d3b ("arm64: compat: Implement misalignment fixups for multiword loads") +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Link: https://lore.kernel.org/r/202304021214.gekJ8yRc-lkp@intel.com/ +Signed-off-by: Ard Biesheuvel +Link: https://lore.kernel.org/r/20230404103625.2386382-1-ardb@kernel.org +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/kernel/compat_alignment.c | 32 ++++++++++++---------------- + 1 file changed, 14 insertions(+), 18 deletions(-) + +diff --git a/arch/arm64/kernel/compat_alignment.c b/arch/arm64/kernel/compat_alignment.c +index 5edec2f4..deff21bf 100644 +--- a/arch/arm64/kernel/compat_alignment.c ++++ b/arch/arm64/kernel/compat_alignment.c +@@ -314,36 +314,32 @@ int do_compat_alignment_fixup(unsigned long addr, struct pt_regs *regs) + int (*handler)(unsigned long addr, u32 instr, struct pt_regs *regs); + unsigned int type; + u32 instr = 0; +- u16 tinstr = 0; + int isize = 4; + int thumb2_32b = 0; +- int fault; + + instrptr = instruction_pointer(regs); + + if (compat_thumb_mode(regs)) { + __le16 __user *ptr = (__le16 __user *)(instrptr & ~1); ++ u16 tinstr, tinst2; + +- fault = alignment_get_thumb(regs, ptr, &tinstr); +- if (!fault) { +- if (IS_T32(tinstr)) { +- /* Thumb-2 32-bit */ +- u16 tinst2; +- fault = alignment_get_thumb(regs, ptr + 1, &tinst2); +- instr = ((u32)tinstr << 16) | tinst2; +- thumb2_32b = 1; +- } else { +- isize = 2; +- instr = thumb2arm(tinstr); +- } ++ if (alignment_get_thumb(regs, ptr, &tinstr)) ++ return 1; ++ ++ if (IS_T32(tinstr)) { /* Thumb-2 32-bit */ ++ if (alignment_get_thumb(regs, ptr + 1, &tinst2)) ++ return 1; ++ instr = ((u32)tinstr << 16) | tinst2; ++ thumb2_32b = 1; ++ } else { ++ isize = 2; ++ instr = thumb2arm(tinstr); + } + } else { +- fault = alignment_get_arm(regs, (__le32 __user *)instrptr, &instr); ++ if (alignment_get_arm(regs, (__le32 __user *)instrptr, &instr)) ++ return 1; + } + +- if (fault) +- return 1; +- + switch (CODING_BITS(instr)) { + case 0x00000000: /* 3.13.4 load/store instruction extensions */ + if (LDSTHD_I_BIT(instr)) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-054-net-stmmac-check-fwnode-for-phy-device-before-.patch b/patches.kernel.org/6.2.11-054-net-stmmac-check-fwnode-for-phy-device-before-.patch new file mode 100644 index 0000000..1920e9c --- /dev/null +++ b/patches.kernel.org/6.2.11-054-net-stmmac-check-fwnode-for-phy-device-before-.patch @@ -0,0 +1,82 @@ +From: Michael Sit Wei Hong +Date: Thu, 6 Apr 2023 10:45:41 +0800 +Subject: [PATCH] net: stmmac: check fwnode for phy device before scanning for + phy +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 8fbc10b995a506e173f1080dfa2764f232a65e02 + +[ Upstream commit 8fbc10b995a506e173f1080dfa2764f232a65e02 ] + +Some DT devices already have phy device configured in the DT/ACPI. +Current implementation scans for a phy unconditionally even though +there is a phy listed in the DT/ACPI and already attached. + +We should check the fwnode if there is any phy device listed in +fwnode and decide whether to scan for a phy to attach to. + +Fixes: fe2cfbc96803 ("net: stmmac: check if MAC needs to attach to a PHY") +Reported-by: Martin Blumenstingl +Link: https://lore.kernel.org/lkml/20230403212434.296975-1-martin.blumenstingl@googlemail.com/ +Tested-by: Guenter Roeck +Tested-by: Shahab Vahedi +Tested-by: Marek Szyprowski +Tested-by: Martin Blumenstingl +Suggested-by: Russell King (Oracle) +Signed-off-by: Michael Sit Wei Hong +Link: https://lore.kernel.org/r/20230406024541.3556305-1-michael.wei.hong.sit@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 4888536a..622b95bf 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -1134,22 +1134,26 @@ static void stmmac_check_pcs_mode(struct stmmac_priv *priv) + static int stmmac_init_phy(struct net_device *dev) + { + struct stmmac_priv *priv = netdev_priv(dev); ++ struct fwnode_handle *phy_fwnode; + struct fwnode_handle *fwnode; +- bool phy_needed; + int ret; + ++ if (!phylink_expects_phy(priv->phylink)) ++ return 0; ++ + fwnode = of_fwnode_handle(priv->plat->phylink_node); + if (!fwnode) + fwnode = dev_fwnode(priv->device); + + if (fwnode) +- ret = phylink_fwnode_phy_connect(priv->phylink, fwnode, 0); ++ phy_fwnode = fwnode_get_phy_node(fwnode); ++ else ++ phy_fwnode = NULL; + +- phy_needed = phylink_expects_phy(priv->phylink); + /* Some DT bindings do not set-up the PHY handle. Let's try to + * manually parse it + */ +- if (!fwnode || phy_needed || ret) { ++ if (!phy_fwnode || IS_ERR(phy_fwnode)) { + int addr = priv->plat->phy_addr; + struct phy_device *phydev; + +@@ -1165,6 +1169,9 @@ static int stmmac_init_phy(struct net_device *dev) + } + + ret = phylink_connect_phy(priv->phylink, phydev); ++ } else { ++ fwnode_handle_put(phy_fwnode); ++ ret = phylink_fwnode_phy_connect(priv->phylink, fwnode, 0); + } + + if (!priv->plat->pmt) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-055-cxl-pci-Fix-CDAT-retrieval-on-big-endian.patch b/patches.kernel.org/6.2.11-055-cxl-pci-Fix-CDAT-retrieval-on-big-endian.patch new file mode 100644 index 0000000..4bb1c62 --- /dev/null +++ b/patches.kernel.org/6.2.11-055-cxl-pci-Fix-CDAT-retrieval-on-big-endian.patch @@ -0,0 +1,248 @@ +From: Lukas Wunner +Date: Sat, 11 Mar 2023 15:40:01 +0100 +Subject: [PATCH] cxl/pci: Fix CDAT retrieval on big endian +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: fbaa38214cd9e150764ccaa82e04ecf42cc1140c + +commit fbaa38214cd9e150764ccaa82e04ecf42cc1140c upstream. + +The CDAT exposed in sysfs differs between little endian and big endian +arches: On big endian, every 4 bytes are byte-swapped. + +PCI Configuration Space is little endian (PCI r3.0 sec 6.1). Accessors +such as pci_read_config_dword() implicitly swap bytes on big endian. +That way, the macros in include/uapi/linux/pci_regs.h work regardless of +the arch's endianness. For an example of implicit byte-swapping, see +ppc4xx_pciex_read_config(), which calls in_le32(), which uses lwbrx +(Load Word Byte-Reverse Indexed). + +DOE Read/Write Data Mailbox Registers are unlike other registers in +Configuration Space in that they contain or receive a 4 byte portion of +an opaque byte stream (a "Data Object" per PCIe r6.0 sec 7.9.24.5f). +They need to be copied to or from the request/response buffer verbatim. +So amend pci_doe_send_req() and pci_doe_recv_resp() to undo the implicit +byte-swapping. + +The CXL_DOE_TABLE_ACCESS_* and PCI_DOE_DATA_OBJECT_DISC_* macros assume +implicit byte-swapping. Byte-swap requests after constructing them with +those macros and byte-swap responses before parsing them. + +Change the request and response type to __le32 to avoid sparse warnings. +Per a request from Jonathan, replace sizeof(u32) with sizeof(__le32) for +consistency. + +Fixes: c97006046c79 ("cxl/port: Read CDAT table") +Tested-by: Ira Weiny +Signed-off-by: Lukas Wunner +Reviewed-by: Dan Williams +Cc: stable@vger.kernel.org # v6.0+ +Reviewed-by: Jonathan Cameron +Link: https://lore.kernel.org/r/3051114102f41d19df3debbee123129118fc5e6d.1678543498.git.lukas@wunner.de +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/cxl/core/pci.c | 26 +++++++++++++------------- + drivers/pci/doe.c | 25 ++++++++++++++----------- + include/linux/pci-doe.h | 8 ++++++-- + 3 files changed, 33 insertions(+), 26 deletions(-) + +diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c +index 57764e9c..28b1880a 100644 +--- a/drivers/cxl/core/pci.c ++++ b/drivers/cxl/core/pci.c +@@ -480,7 +480,7 @@ static struct pci_doe_mb *find_cdat_doe(struct device *uport) + return NULL; + } + +-#define CDAT_DOE_REQ(entry_handle) \ ++#define CDAT_DOE_REQ(entry_handle) cpu_to_le32 \ + (FIELD_PREP(CXL_DOE_TABLE_ACCESS_REQ_CODE, \ + CXL_DOE_TABLE_ACCESS_REQ_CODE_READ) | \ + FIELD_PREP(CXL_DOE_TABLE_ACCESS_TABLE_TYPE, \ +@@ -493,8 +493,8 @@ static void cxl_doe_task_complete(struct pci_doe_task *task) + } + + struct cdat_doe_task { +- u32 request_pl; +- u32 response_pl[32]; ++ __le32 request_pl; ++ __le32 response_pl[32]; + struct completion c; + struct pci_doe_task task; + }; +@@ -528,10 +528,10 @@ static int cxl_cdat_get_length(struct device *dev, + return rc; + } + wait_for_completion(&t.c); +- if (t.task.rv < sizeof(u32)) ++ if (t.task.rv < sizeof(__le32)) + return -EIO; + +- *length = t.response_pl[1]; ++ *length = le32_to_cpu(t.response_pl[1]); + dev_dbg(dev, "CDAT length %zu\n", *length); + + return 0; +@@ -542,13 +542,13 @@ static int cxl_cdat_read_table(struct device *dev, + struct cxl_cdat *cdat) + { + size_t length = cdat->length; +- u32 *data = cdat->table; ++ __le32 *data = cdat->table; + int entry_handle = 0; + + do { + DECLARE_CDAT_DOE_TASK(CDAT_DOE_REQ(entry_handle), t); + size_t entry_dw; +- u32 *entry; ++ __le32 *entry; + int rc; + + rc = pci_doe_submit_task(cdat_doe, &t.task); +@@ -558,21 +558,21 @@ static int cxl_cdat_read_table(struct device *dev, + } + wait_for_completion(&t.c); + /* 1 DW header + 1 DW data min */ +- if (t.task.rv < (2 * sizeof(u32))) ++ if (t.task.rv < (2 * sizeof(__le32))) + return -EIO; + + /* Get the CXL table access header entry handle */ + entry_handle = FIELD_GET(CXL_DOE_TABLE_ACCESS_ENTRY_HANDLE, +- t.response_pl[0]); ++ le32_to_cpu(t.response_pl[0])); + entry = t.response_pl + 1; +- entry_dw = t.task.rv / sizeof(u32); ++ entry_dw = t.task.rv / sizeof(__le32); + /* Skip Header */ + entry_dw -= 1; +- entry_dw = min(length / sizeof(u32), entry_dw); ++ entry_dw = min(length / sizeof(__le32), entry_dw); + /* Prevent length < 1 DW from causing a buffer overflow */ + if (entry_dw) { +- memcpy(data, entry, entry_dw * sizeof(u32)); +- length -= entry_dw * sizeof(u32); ++ memcpy(data, entry, entry_dw * sizeof(__le32)); ++ length -= entry_dw * sizeof(__le32); + data += entry_dw; + } + } while (entry_handle != CXL_DOE_TABLE_ACCESS_LAST_ENTRY); +diff --git a/drivers/pci/doe.c b/drivers/pci/doe.c +index 66d9ab28..6f097932 100644 +--- a/drivers/pci/doe.c ++++ b/drivers/pci/doe.c +@@ -128,7 +128,7 @@ static int pci_doe_send_req(struct pci_doe_mb *doe_mb, + return -EIO; + + /* Length is 2 DW of header + length of payload in DW */ +- length = 2 + task->request_pl_sz / sizeof(u32); ++ length = 2 + task->request_pl_sz / sizeof(__le32); + if (length > PCI_DOE_MAX_LENGTH) + return -EIO; + if (length == PCI_DOE_MAX_LENGTH) +@@ -141,9 +141,9 @@ static int pci_doe_send_req(struct pci_doe_mb *doe_mb, + pci_write_config_dword(pdev, offset + PCI_DOE_WRITE, + FIELD_PREP(PCI_DOE_DATA_OBJECT_HEADER_2_LENGTH, + length)); +- for (i = 0; i < task->request_pl_sz / sizeof(u32); i++) ++ for (i = 0; i < task->request_pl_sz / sizeof(__le32); i++) + pci_write_config_dword(pdev, offset + PCI_DOE_WRITE, +- task->request_pl[i]); ++ le32_to_cpu(task->request_pl[i])); + + pci_doe_write_ctrl(doe_mb, PCI_DOE_CTRL_GO); + +@@ -195,11 +195,11 @@ static int pci_doe_recv_resp(struct pci_doe_mb *doe_mb, struct pci_doe_task *tas + + /* First 2 dwords have already been read */ + length -= 2; +- payload_length = min(length, task->response_pl_sz / sizeof(u32)); ++ payload_length = min(length, task->response_pl_sz / sizeof(__le32)); + /* Read the rest of the response payload */ + for (i = 0; i < payload_length; i++) { +- pci_read_config_dword(pdev, offset + PCI_DOE_READ, +- &task->response_pl[i]); ++ pci_read_config_dword(pdev, offset + PCI_DOE_READ, &val); ++ task->response_pl[i] = cpu_to_le32(val); + /* Prior to the last ack, ensure Data Object Ready */ + if (i == (payload_length - 1) && !pci_doe_data_obj_ready(doe_mb)) + return -EIO; +@@ -217,7 +217,7 @@ static int pci_doe_recv_resp(struct pci_doe_mb *doe_mb, struct pci_doe_task *tas + if (FIELD_GET(PCI_DOE_STATUS_ERROR, val)) + return -EIO; + +- return min(length, task->response_pl_sz / sizeof(u32)) * sizeof(u32); ++ return min(length, task->response_pl_sz / sizeof(__le32)) * sizeof(__le32); + } + + static void signal_task_complete(struct pci_doe_task *task, int rv) +@@ -317,14 +317,16 @@ static int pci_doe_discovery(struct pci_doe_mb *doe_mb, u8 *index, u16 *vid, + { + u32 request_pl = FIELD_PREP(PCI_DOE_DATA_OBJECT_DISC_REQ_3_INDEX, + *index); ++ __le32 request_pl_le = cpu_to_le32(request_pl); ++ __le32 response_pl_le; + u32 response_pl; + DECLARE_COMPLETION_ONSTACK(c); + struct pci_doe_task task = { + .prot.vid = PCI_VENDOR_ID_PCI_SIG, + .prot.type = PCI_DOE_PROTOCOL_DISCOVERY, +- .request_pl = &request_pl, ++ .request_pl = &request_pl_le, + .request_pl_sz = sizeof(request_pl), +- .response_pl = &response_pl, ++ .response_pl = &response_pl_le, + .response_pl_sz = sizeof(response_pl), + .complete = pci_doe_task_complete, + .private = &c, +@@ -340,6 +342,7 @@ static int pci_doe_discovery(struct pci_doe_mb *doe_mb, u8 *index, u16 *vid, + if (task.rv != sizeof(response_pl)) + return -EIO; + ++ response_pl = le32_to_cpu(response_pl_le); + *vid = FIELD_GET(PCI_DOE_DATA_OBJECT_DISC_RSP_3_VID, response_pl); + *protocol = FIELD_GET(PCI_DOE_DATA_OBJECT_DISC_RSP_3_PROTOCOL, + response_pl); +@@ -533,8 +536,8 @@ int pci_doe_submit_task(struct pci_doe_mb *doe_mb, struct pci_doe_task *task) + * DOE requests must be a whole number of DW and the response needs to + * be big enough for at least 1 DW + */ +- if (task->request_pl_sz % sizeof(u32) || +- task->response_pl_sz < sizeof(u32)) ++ if (task->request_pl_sz % sizeof(__le32) || ++ task->response_pl_sz < sizeof(__le32)) + return -EINVAL; + + if (test_bit(PCI_DOE_FLAG_DEAD, &doe_mb->flags)) +diff --git a/include/linux/pci-doe.h b/include/linux/pci-doe.h +index ed9b4df7..43765eaf 100644 +--- a/include/linux/pci-doe.h ++++ b/include/linux/pci-doe.h +@@ -34,6 +34,10 @@ struct pci_doe_mb; + * @work: Used internally by the mailbox + * @doe_mb: Used internally by the mailbox + * ++ * Payloads are treated as opaque byte streams which are transmitted verbatim, ++ * without byte-swapping. If payloads contain little-endian register values, ++ * the caller is responsible for conversion with cpu_to_le32() / le32_to_cpu(). ++ * + * The payload sizes and rv are specified in bytes with the following + * restrictions concerning the protocol. + * +@@ -45,9 +49,9 @@ struct pci_doe_mb; + */ + struct pci_doe_task { + struct pci_doe_protocol prot; +- u32 *request_pl; ++ __le32 *request_pl; + size_t request_pl_sz; +- u32 *response_pl; ++ __le32 *response_pl; + size_t response_pl_sz; + int rv; + void (*complete)(struct pci_doe_task *task); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-056-cxl-pci-Handle-truncated-CDAT-header.patch b/patches.kernel.org/6.2.11-056-cxl-pci-Handle-truncated-CDAT-header.patch new file mode 100644 index 0000000..f0b626a --- /dev/null +++ b/patches.kernel.org/6.2.11-056-cxl-pci-Handle-truncated-CDAT-header.patch @@ -0,0 +1,49 @@ +From: Lukas Wunner +Date: Sat, 11 Mar 2023 15:40:02 +0100 +Subject: [PATCH] cxl/pci: Handle truncated CDAT header +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 34bafc747c54fb58c1908ec3116fa6137393e596 + +commit 34bafc747c54fb58c1908ec3116fa6137393e596 upstream. + +cxl_cdat_get_length() only checks whether the DOE response size is +sufficient for the Table Access response header (1 dword), but not the +succeeding CDAT header (1 dword length plus other fields). + +It thus returns whatever uninitialized memory happens to be on the stack +if a truncated DOE response with only 1 dword was received. Fix it. + +Fixes: c97006046c79 ("cxl/port: Read CDAT table") +Reported-by: Ming Li +Tested-by: Ira Weiny +Signed-off-by: Lukas Wunner +Reviewed-by: Ming Li +Reviewed-by: Dan Williams +Reviewed-by: Jonathan Cameron +Cc: stable@vger.kernel.org # v6.0+ +Reviewed-by: Kuppuswamy Sathyanarayanan +Link: https://lore.kernel.org/r/000e69cd163461c8b1bc2cf4155b6e25402c29c7.1678543498.git.lukas@wunner.de +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/cxl/core/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c +index 28b1880a..e72143a4 100644 +--- a/drivers/cxl/core/pci.c ++++ b/drivers/cxl/core/pci.c +@@ -528,7 +528,7 @@ static int cxl_cdat_get_length(struct device *dev, + return rc; + } + wait_for_completion(&t.c); +- if (t.task.rv < sizeof(__le32)) ++ if (t.task.rv < 2 * sizeof(__le32)) + return -EIO; + + *length = le32_to_cpu(t.response_pl[1]); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-057-cxl-pci-Handle-truncated-CDAT-entries.patch b/patches.kernel.org/6.2.11-057-cxl-pci-Handle-truncated-CDAT-entries.patch new file mode 100644 index 0000000..d873e93 --- /dev/null +++ b/patches.kernel.org/6.2.11-057-cxl-pci-Handle-truncated-CDAT-entries.patch @@ -0,0 +1,112 @@ +From: Lukas Wunner +Date: Sat, 11 Mar 2023 15:40:03 +0100 +Subject: [PATCH] cxl/pci: Handle truncated CDAT entries +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: b56faef2312057db20479b240eb71bd2e51fb51c + +commit b56faef2312057db20479b240eb71bd2e51fb51c upstream. + +If truncated CDAT entries are received from a device, the concatenation +of those entries constitutes a corrupt CDAT, yet is happily exposed to +user space. + +Avoid by verifying response lengths and erroring out if truncation is +detected. + +The last CDAT entry may still be truncated despite the checks introduced +herein if the length in the CDAT header is too small. However, that is +easily detectable by user space because it reaches EOF prematurely. +A subsequent commit which rightsizes the CDAT response allocation closes +that remaining loophole. + +The two lines introduced here which exceed 80 chars are shortened to +less than 80 chars by a subsequent commit which migrates to a +synchronous DOE API and replaces "t.task.rv" by "rc". + +The existing acpi_cdat_header and acpi_table_cdat struct definitions +provided by ACPICA cannot be used because they do not employ __le16 or +__le32 types. I believe that cannot be changed because those types are +Linux-specific and ACPI is specified for little endian platforms only, +hence doesn't care about endianness. So duplicate the structs. + +Fixes: c97006046c79 ("cxl/port: Read CDAT table") +Tested-by: Ira Weiny +Signed-off-by: Lukas Wunner +Reviewed-by: Dan Williams +Reviewed-by: Jonathan Cameron +Cc: stable@vger.kernel.org # v6.0+ +Link: https://lore.kernel.org/r/bce3aebc0e8e18a1173425a7a865b232c3912963.1678543498.git.lukas@wunner.de +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/cxl/core/pci.c | 13 +++++++++---- + drivers/cxl/cxlpci.h | 14 ++++++++++++++ + 2 files changed, 23 insertions(+), 4 deletions(-) + +diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c +index e72143a4..380cc285 100644 +--- a/drivers/cxl/core/pci.c ++++ b/drivers/cxl/core/pci.c +@@ -547,8 +547,8 @@ static int cxl_cdat_read_table(struct device *dev, + + do { + DECLARE_CDAT_DOE_TASK(CDAT_DOE_REQ(entry_handle), t); ++ struct cdat_entry_header *entry; + size_t entry_dw; +- __le32 *entry; + int rc; + + rc = pci_doe_submit_task(cdat_doe, &t.task); +@@ -557,14 +557,19 @@ static int cxl_cdat_read_table(struct device *dev, + return rc; + } + wait_for_completion(&t.c); +- /* 1 DW header + 1 DW data min */ +- if (t.task.rv < (2 * sizeof(__le32))) ++ ++ /* 1 DW Table Access Response Header + CDAT entry */ ++ entry = (struct cdat_entry_header *)(t.response_pl + 1); ++ if ((entry_handle == 0 && ++ t.task.rv != sizeof(__le32) + sizeof(struct cdat_header)) || ++ (entry_handle > 0 && ++ (t.task.rv < sizeof(__le32) + sizeof(*entry) || ++ t.task.rv != sizeof(__le32) + le16_to_cpu(entry->length)))) + return -EIO; + + /* Get the CXL table access header entry handle */ + entry_handle = FIELD_GET(CXL_DOE_TABLE_ACCESS_ENTRY_HANDLE, + le32_to_cpu(t.response_pl[0])); +- entry = t.response_pl + 1; + entry_dw = t.task.rv / sizeof(__le32); + /* Skip Header */ + entry_dw -= 1; +diff --git a/drivers/cxl/cxlpci.h b/drivers/cxl/cxlpci.h +index 92090979..104ad2b7 100644 +--- a/drivers/cxl/cxlpci.h ++++ b/drivers/cxl/cxlpci.h +@@ -62,6 +62,20 @@ enum cxl_regloc_type { + CXL_REGLOC_RBI_TYPES + }; + ++struct cdat_header { ++ __le32 length; ++ u8 revision; ++ u8 checksum; ++ u8 reserved[6]; ++ __le32 sequence; ++} __packed; ++ ++struct cdat_entry_header { ++ u8 type; ++ u8 reserved; ++ __le16 length; ++} __packed; ++ + int devm_cxl_port_enumerate_dports(struct cxl_port *port); + struct cxl_dev_state; + int cxl_hdm_decode_init(struct cxl_dev_state *cxlds, struct cxl_hdm *cxlhdm); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-058-cxl-pci-Handle-excessive-CDAT-length.patch b/patches.kernel.org/6.2.11-058-cxl-pci-Handle-excessive-CDAT-length.patch new file mode 100644 index 0000000..2196a0f --- /dev/null +++ b/patches.kernel.org/6.2.11-058-cxl-pci-Handle-excessive-CDAT-length.patch @@ -0,0 +1,48 @@ +From: Lukas Wunner +Date: Sat, 11 Mar 2023 15:40:04 +0100 +Subject: [PATCH] cxl/pci: Handle excessive CDAT length +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 4fe2c13d59d849be3b45371e3913ec5dc77fc0fb + +commit 4fe2c13d59d849be3b45371e3913ec5dc77fc0fb upstream. + +If the length in the CDAT header is larger than the concatenation of the +header and all table entries, then the CDAT exposed to user space +contains trailing null bytes. + +Not every consumer may be able to handle that. Per Postel's robustness +principle, "be liberal in what you accept" and silently reduce the +cached length to avoid exposing those null bytes. + +Fixes: c97006046c79 ("cxl/port: Read CDAT table") +Tested-by: Ira Weiny +Signed-off-by: Lukas Wunner +Reviewed-by: Dan Williams +Reviewed-by: Jonathan Cameron +Cc: stable@vger.kernel.org # v6.0+ +Link: https://lore.kernel.org/r/6d98b3c7da5343172bd3ccabfabbc1f31c079d74.1678543498.git.lukas@wunner.de +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/cxl/core/pci.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c +index 380cc285..76596cd1 100644 +--- a/drivers/cxl/core/pci.c ++++ b/drivers/cxl/core/pci.c +@@ -582,6 +582,9 @@ static int cxl_cdat_read_table(struct device *dev, + } + } while (entry_handle != CXL_DOE_TABLE_ACCESS_LAST_ENTRY); + ++ /* Length in CDAT header may exceed concatenation of CDAT entries */ ++ cdat->length -= length; ++ + return 0; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-059-PCI-DOE-Silence-WARN-splat-with-CONFIG_DEBUG_O.patch b/patches.kernel.org/6.2.11-059-PCI-DOE-Silence-WARN-splat-with-CONFIG_DEBUG_O.patch new file mode 100644 index 0000000..91b81e8 --- /dev/null +++ b/patches.kernel.org/6.2.11-059-PCI-DOE-Silence-WARN-splat-with-CONFIG_DEBUG_O.patch @@ -0,0 +1,85 @@ +From: Lukas Wunner +Date: Sat, 11 Mar 2023 15:40:05 +0100 +Subject: [PATCH] PCI/DOE: Silence WARN splat with CONFIG_DEBUG_OBJECTS=y +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 92dc899c3b4927f3cfa23f55bf759171234b5802 + +commit 92dc899c3b4927f3cfa23f55bf759171234b5802 upstream. + +Gregory Price reports a WARN splat with CONFIG_DEBUG_OBJECTS=y upon CXL +probing because pci_doe_submit_task() invokes INIT_WORK() instead of +INIT_WORK_ONSTACK() for a work_struct that was allocated on the stack. + +All callers of pci_doe_submit_task() allocate the work_struct on the +stack, so replace INIT_WORK() with INIT_WORK_ONSTACK() as a backportable +short-term fix. + +The long-term fix implemented by a subsequent commit is to move to a +synchronous API which allocates the work_struct internally in the DOE +library. + +Stacktrace for posterity: + +WARNING: CPU: 0 PID: 23 at lib/debugobjects.c:545 __debug_object_init.cold+0x18/0x183 +CPU: 0 PID: 23 Comm: kworker/u2:1 Not tainted 6.1.0-0.rc1.20221019gitaae703b02f92.17.fc38.x86_64 #1 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 +Call Trace: + pci_doe_submit_task+0x5d/0xd0 + pci_doe_discovery+0xb4/0x100 + pcim_doe_create_mb+0x219/0x290 + cxl_pci_probe+0x192/0x430 + local_pci_probe+0x41/0x80 + pci_device_probe+0xb3/0x220 + really_probe+0xde/0x380 + __driver_probe_device+0x78/0x170 + driver_probe_device+0x1f/0x90 + __driver_attach_async_helper+0x5c/0xe0 + async_run_entry_fn+0x30/0x130 + process_one_work+0x294/0x5b0 + +Fixes: 9d24322e887b ("PCI/DOE: Add DOE mailbox support functions") +Link: https://lore.kernel.org/linux-cxl/Y1bOniJliOFszvIK@memverge.com/ +Reported-by: Gregory Price +Tested-by: Ira Weiny +Tested-by: Gregory Price +Signed-off-by: Lukas Wunner +Reviewed-by: Ira Weiny +Reviewed-by: Dan Williams +Reviewed-by: Gregory Price +Cc: stable@vger.kernel.org # v6.0+ +Reviewed-by: Jonathan Cameron +Acked-by: Bjorn Helgaas +Link: https://lore.kernel.org/r/67a9117f463ecdb38a2dbca6a20391ce2f1e7a06.1678543498.git.lukas@wunner.de +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/pci/doe.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/doe.c b/drivers/pci/doe.c +index 6f097932..c14ffdf2 100644 +--- a/drivers/pci/doe.c ++++ b/drivers/pci/doe.c +@@ -523,6 +523,8 @@ EXPORT_SYMBOL_GPL(pci_doe_supports_prot); + * task->complete will be called when the state machine is done processing this + * task. + * ++ * @task must be allocated on the stack. ++ * + * Excess data will be discarded. + * + * RETURNS: 0 when task has been successfully queued, -ERRNO on error +@@ -544,7 +546,7 @@ int pci_doe_submit_task(struct pci_doe_mb *doe_mb, struct pci_doe_task *task) + return -EIO; + + task->doe_mb = doe_mb; +- INIT_WORK(&task->work, doe_statemachine_work); ++ INIT_WORK_ONSTACK(&task->work, doe_statemachine_work); + queue_work(doe_mb->work_queue, &task->work); + return 0; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-060-PCI-DOE-Fix-memory-leak-with-CONFIG_DEBUG_OBJE.patch b/patches.kernel.org/6.2.11-060-PCI-DOE-Fix-memory-leak-with-CONFIG_DEBUG_OBJE.patch new file mode 100644 index 0000000..79a13a4 --- /dev/null +++ b/patches.kernel.org/6.2.11-060-PCI-DOE-Fix-memory-leak-with-CONFIG_DEBUG_OBJE.patch @@ -0,0 +1,44 @@ +From: Lukas Wunner +Date: Sat, 11 Mar 2023 15:40:06 +0100 +Subject: [PATCH] PCI/DOE: Fix memory leak with CONFIG_DEBUG_OBJECTS=y +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: abf04be0e7071f2bcd39bf97ba407e7d4439785e + +commit abf04be0e7071f2bcd39bf97ba407e7d4439785e upstream. + +After a pci_doe_task completes, its work_struct needs to be destroyed +to avoid a memory leak with CONFIG_DEBUG_OBJECTS=y. + +Fixes: 9d24322e887b ("PCI/DOE: Add DOE mailbox support functions") +Tested-by: Ira Weiny +Signed-off-by: Lukas Wunner +Reviewed-by: Ira Weiny +Reviewed-by: Davidlohr Bueso +Reviewed-by: Dan Williams +Reviewed-by: Jonathan Cameron +Cc: stable@vger.kernel.org # v6.0+ +Acked-by: Bjorn Helgaas +Link: https://lore.kernel.org/r/775768b4912531c3b887d405fc51a50e465e1bf9.1678543498.git.lukas@wunner.de +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/pci/doe.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pci/doe.c b/drivers/pci/doe.c +index c14ffdf2..e5e9b287 100644 +--- a/drivers/pci/doe.c ++++ b/drivers/pci/doe.c +@@ -224,6 +224,7 @@ static void signal_task_complete(struct pci_doe_task *task, int rv) + { + task->rv = rv; + task->complete(task); ++ destroy_work_on_stack(&task->work); + } + + static void signal_task_abort(struct pci_doe_task *task, int rv) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-061-Revert-usb-xhci-pci-Set-PROBE_PREFER_ASYNCHRON.patch b/patches.kernel.org/6.2.11-061-Revert-usb-xhci-pci-Set-PROBE_PREFER_ASYNCHRON.patch new file mode 100644 index 0000000..91a2c86 --- /dev/null +++ b/patches.kernel.org/6.2.11-061-Revert-usb-xhci-pci-Set-PROBE_PREFER_ASYNCHRON.patch @@ -0,0 +1,57 @@ +From: Mathias Nyman +Date: Thu, 30 Mar 2023 17:30:55 +0300 +Subject: [PATCH] Revert "usb: xhci-pci: Set PROBE_PREFER_ASYNCHRONOUS" +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 8e77d3d59d7b5da13deda1d832c51b8bbdbe2037 + +commit 8e77d3d59d7b5da13deda1d832c51b8bbdbe2037 upstream. + +This reverts commit 4c2604a9a6899bab195edbee35fc8d64ce1444aa. + +Asynch probe caused regression in a setup with both Renesas and Intel xHC +controllers. Devices connected to the Renesas disconnected shortly after +boot. With Asynch probe the busnumbers got interleaved. + +xhci_hcd 0000:00:14.0: new USB bus registered, assigned bus number 1 +xhci_hcd 0000:04:00.0: new USB bus registered, assigned bus number 2 +xhci_hcd 0000:00:14.0: new USB bus registered, assigned bus number 3 +xhci_hcd 0000:04:00.0: new USB bus registered, assigned bus number 4 + +Reason why this commit causes regression is still unknown, but revert it +while debugging the issue. + +Fixes: 4c2604a9a689 ("usb: xhci-pci: Set PROBE_PREFER_ASYNCHRONOUS") +Cc: stable +Link: https://lore.kernel.org/linux-usb/20230307132120.5897c5af@deangelis.fenrir.org.uk +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20230330143056.1390020-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/host/xhci-pci.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index fb988e4e..6db07ca4 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -771,12 +771,11 @@ static struct pci_driver xhci_pci_driver = { + /* suspend and resume implemented later */ + + .shutdown = usb_hcd_pci_shutdown, +- .driver = { + #ifdef CONFIG_PM +- .pm = &usb_hcd_pci_pm_ops, +-#endif +- .probe_type = PROBE_PREFER_ASYNCHRONOUS, ++ .driver = { ++ .pm = &usb_hcd_pci_pm_ops + }, ++#endif + }; + + static int __init xhci_pci_init(void) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-062-usb-xhci-tegra-fix-sleep-in-atomic-call.patch b/patches.kernel.org/6.2.11-062-usb-xhci-tegra-fix-sleep-in-atomic-call.patch new file mode 100644 index 0000000..69e9d09 --- /dev/null +++ b/patches.kernel.org/6.2.11-062-usb-xhci-tegra-fix-sleep-in-atomic-call.patch @@ -0,0 +1,82 @@ +From: Wayne Chang +Date: Mon, 27 Mar 2023 17:55:48 +0800 +Subject: [PATCH] usb: xhci: tegra: fix sleep in atomic call +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 4c7f9d2e413dc06a157c4e5dccde84aaf4655eb3 + +commit 4c7f9d2e413dc06a157c4e5dccde84aaf4655eb3 upstream. + +When we set the dual-role port to Host mode, we observed the following +splat: +[ 167.057718] BUG: sleeping function called from invalid context at +include/linux/sched/mm.h:229 +[ 167.057872] Workqueue: events tegra_xusb_usb_phy_work +[ 167.057954] Call trace: +[ 167.057962] dump_backtrace+0x0/0x210 +[ 167.057996] show_stack+0x30/0x50 +[ 167.058020] dump_stack_lvl+0x64/0x84 +[ 167.058065] dump_stack+0x14/0x34 +[ 167.058100] __might_resched+0x144/0x180 +[ 167.058140] __might_sleep+0x64/0xd0 +[ 167.058171] slab_pre_alloc_hook.constprop.0+0xa8/0x110 +[ 167.058202] __kmalloc_track_caller+0x74/0x2b0 +[ 167.058233] kvasprintf+0xa4/0x190 +[ 167.058261] kasprintf+0x58/0x90 +[ 167.058285] tegra_xusb_find_port_node.isra.0+0x58/0xd0 +[ 167.058334] tegra_xusb_find_port+0x38/0xa0 +[ 167.058380] tegra_xusb_padctl_get_usb3_companion+0x38/0xd0 +[ 167.058430] tegra_xhci_id_notify+0x8c/0x1e0 +[ 167.058473] notifier_call_chain+0x88/0x100 +[ 167.058506] atomic_notifier_call_chain+0x44/0x70 +[ 167.058537] tegra_xusb_usb_phy_work+0x60/0xd0 +[ 167.058581] process_one_work+0x1dc/0x4c0 +[ 167.058618] worker_thread+0x54/0x410 +[ 167.058650] kthread+0x188/0x1b0 +[ 167.058672] ret_from_fork+0x10/0x20 + +The function tegra_xusb_padctl_get_usb3_companion eventually calls +tegra_xusb_find_port and this in turn calls kasprintf which might sleep +and so cannot be called from an atomic context. + +Fix this by moving the call to tegra_xusb_padctl_get_usb3_companion to +the tegra_xhci_id_work function where it is really needed. + +Fixes: f836e7843036 ("usb: xhci-tegra: Add OTG support") +Cc: stable@vger.kernel.org +Signed-off-by: Wayne Chang +Signed-off-by: Haotien Hsu +Link: https://lore.kernel.org/r/20230327095548.1599470-1-haotienh@nvidia.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/host/xhci-tegra.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c +index bdb77655..32df571b 100644 +--- a/drivers/usb/host/xhci-tegra.c ++++ b/drivers/usb/host/xhci-tegra.c +@@ -1225,6 +1225,9 @@ static void tegra_xhci_id_work(struct work_struct *work) + + mutex_unlock(&tegra->lock); + ++ tegra->otg_usb3_port = tegra_xusb_padctl_get_usb3_companion(tegra->padctl, ++ tegra->otg_usb2_port); ++ + if (tegra->host_mode) { + /* switch to host mode */ + if (tegra->otg_usb3_port >= 0) { +@@ -1339,9 +1342,6 @@ static int tegra_xhci_id_notify(struct notifier_block *nb, + } + + tegra->otg_usb2_port = tegra_xusb_get_usb2_port(tegra, usbphy); +- tegra->otg_usb3_port = tegra_xusb_padctl_get_usb3_companion( +- tegra->padctl, +- tegra->otg_usb2_port); + + tegra->host_mode = (usbphy->last_event == USB_EVENT_ID) ? true : false; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-063-xhci-Free-the-command-allocated-for-setting-LP.patch b/patches.kernel.org/6.2.11-063-xhci-Free-the-command-allocated-for-setting-LP.patch new file mode 100644 index 0000000..447c084 --- /dev/null +++ b/patches.kernel.org/6.2.11-063-xhci-Free-the-command-allocated-for-setting-LP.patch @@ -0,0 +1,42 @@ +From: Mathias Nyman +Date: Thu, 30 Mar 2023 17:30:56 +0300 +Subject: [PATCH] xhci: Free the command allocated for setting LPM if we return + early +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: f6caea4855553a8b99ba3ec23ecdb5ed8262f26c + +commit f6caea4855553a8b99ba3ec23ecdb5ed8262f26c upstream. + +The command allocated to set exit latency LPM values need to be freed in +case the command is never queued. This would be the case if there is no +change in exit latency values, or device is missing. + +Reported-by: Mirsad Goran Todorovac +Link: https://lore.kernel.org/linux-usb/24263902-c9b3-ce29-237b-1c3d6918f4fe@alu.unizg.hr +Tested-by: Mirsad Goran Todorovac +Fixes: 5c2a380a5aa8 ("xhci: Allocate separate command structures for each LPM command") +Cc: +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20230330143056.1390020-4-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/host/xhci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 2b280beb..af42abb6d 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -4406,6 +4406,7 @@ static int __maybe_unused xhci_change_max_exit_latency(struct xhci_hcd *xhci, + + if (!virt_dev || max_exit_latency == virt_dev->current_mel) { + spin_unlock_irqrestore(&xhci->lock, flags); ++ xhci_free_command(xhci, command); + return 0; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-064-xhci-also-avoid-the-XHCI_ZERO_64B_REGS-quirk-w.patch b/patches.kernel.org/6.2.11-064-xhci-also-avoid-the-XHCI_ZERO_64B_REGS-quirk-w.patch new file mode 100644 index 0000000..895b569 --- /dev/null +++ b/patches.kernel.org/6.2.11-064-xhci-also-avoid-the-XHCI_ZERO_64B_REGS-quirk-w.patch @@ -0,0 +1,63 @@ +From: D Scott Phillips +Date: Thu, 30 Mar 2023 17:30:54 +0300 +Subject: [PATCH] xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a + passthrough iommu +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: ecaa4902439298f6b0e29f47424a86b310a9ff4f + +commit ecaa4902439298f6b0e29f47424a86b310a9ff4f upstream. + +Previously the quirk was skipped when no iommu was present. The same +rationale for skipping the quirk also applies in the iommu.passthrough=1 +case. + +Skip applying the XHCI_ZERO_64B_REGS quirk if the device's iommu domain is +passthrough. + +Fixes: 12de0a35c996 ("xhci: Add quirk to zero 64bit registers on Renesas PCIe controllers") +Cc: stable +Signed-off-by: D Scott Phillips +Acked-by: Marc Zyngier +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20230330143056.1390020-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/host/xhci.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index af42abb6d..c02ad4f7 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -9,6 +9,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -228,6 +229,7 @@ int xhci_reset(struct xhci_hcd *xhci, u64 timeout_us) + static void xhci_zero_64b_regs(struct xhci_hcd *xhci) + { + struct device *dev = xhci_to_hcd(xhci)->self.sysdev; ++ struct iommu_domain *domain; + int err, i; + u64 val; + u32 intrs; +@@ -246,7 +248,9 @@ static void xhci_zero_64b_regs(struct xhci_hcd *xhci) + * an iommu. Doing anything when there is no iommu is definitely + * unsafe... + */ +- if (!(xhci->quirks & XHCI_ZERO_64B_REGS) || !device_iommu_mapped(dev)) ++ domain = iommu_get_domain_for_dev(dev); ++ if (!(xhci->quirks & XHCI_ZERO_64B_REGS) || !domain || ++ domain->type == IOMMU_DOMAIN_IDENTITY) + return; + + xhci_info(xhci, "Zeroing 64bit base registers, expecting fault\n"); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-065-usb-cdnsp-Fixes-error-uninitialized-symbol-len.patch b/patches.kernel.org/6.2.11-065-usb-cdnsp-Fixes-error-uninitialized-symbol-len.patch new file mode 100644 index 0000000..3b76c20 --- /dev/null +++ b/patches.kernel.org/6.2.11-065-usb-cdnsp-Fixes-error-uninitialized-symbol-len.patch @@ -0,0 +1,49 @@ +From: Pawel Laszczak +Date: Fri, 31 Mar 2023 05:06:00 -0400 +Subject: [PATCH] usb: cdnsp: Fixes error: uninitialized symbol 'len' +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 1edf48991a783d00a3a18dc0d27c88139e4030a2 + +commit 1edf48991a783d00a3a18dc0d27c88139e4030a2 upstream. + +The patch 5bc38d33a5a1: "usb: cdnsp: Fixes issue with redundant +Status Stage" leads to the following Smatch static checker warning: + + drivers/usb/cdns3/cdnsp-ep0.c:470 cdnsp_setup_analyze() + error: uninitialized symbol 'len'. + +cc: +Fixes: 5bc38d33a5a1 ("usb: cdnsp: Fixes issue with redundant Status Stage") +Signed-off-by: Pawel Laszczak +Link: https://lore.kernel.org/r/20230331090600.454674-1-pawell@cadence.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/cdns3/cdnsp-ep0.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/usb/cdns3/cdnsp-ep0.c b/drivers/usb/cdns3/cdnsp-ep0.c +index d63d5d92..f317d3c8 100644 +--- a/drivers/usb/cdns3/cdnsp-ep0.c ++++ b/drivers/usb/cdns3/cdnsp-ep0.c +@@ -414,7 +414,7 @@ static int cdnsp_ep0_std_request(struct cdnsp_device *pdev, + void cdnsp_setup_analyze(struct cdnsp_device *pdev) + { + struct usb_ctrlrequest *ctrl = &pdev->setup; +- int ret = 0; ++ int ret = -EINVAL; + u16 len; + + trace_cdnsp_ctrl_req(ctrl); +@@ -424,7 +424,6 @@ void cdnsp_setup_analyze(struct cdnsp_device *pdev) + + if (pdev->gadget.state == USB_STATE_NOTATTACHED) { + dev_err(pdev->dev, "ERR: Setup detected in unattached state\n"); +- ret = -EINVAL; + goto out; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-066-usb-dwc3-pci-add-support-for-the-Intel-Meteor-.patch b/patches.kernel.org/6.2.11-066-usb-dwc3-pci-add-support-for-the-Intel-Meteor-.patch new file mode 100644 index 0000000..91f8c42 --- /dev/null +++ b/patches.kernel.org/6.2.11-066-usb-dwc3-pci-add-support-for-the-Intel-Meteor-.patch @@ -0,0 +1,46 @@ +From: Heikki Krogerus +Date: Thu, 30 Mar 2023 18:02:24 +0300 +Subject: [PATCH] usb: dwc3: pci: add support for the Intel Meteor Lake-S +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: ec799c8a92e0be91e0940cc739a27f483242df65 + +commit ec799c8a92e0be91e0940cc739a27f483242df65 upstream. + +This patch adds the necessary PCI ID for Intel Meteor Lake-S +devices. + +Signed-off-by: Heikki Krogerus +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230330150224.89316-1-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/dwc3/dwc3-pci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index a23ddbb8..56079354 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -49,6 +49,7 @@ + #define PCI_DEVICE_ID_INTEL_RPLS 0x7a61 + #define PCI_DEVICE_ID_INTEL_MTLM 0x7eb1 + #define PCI_DEVICE_ID_INTEL_MTLP 0x7ec1 ++#define PCI_DEVICE_ID_INTEL_MTLS 0x7f6f + #define PCI_DEVICE_ID_INTEL_MTL 0x7e7e + #define PCI_DEVICE_ID_INTEL_TGL 0x9a15 + #define PCI_DEVICE_ID_AMD_MR 0x163a +@@ -474,6 +475,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTLP), + (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTLS), ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, ++ + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTL), + (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-067-USB-serial-cp210x-add-Silicon-Labs-IFS-USB-DAT.patch b/patches.kernel.org/6.2.11-067-USB-serial-cp210x-add-Silicon-Labs-IFS-USB-DAT.patch new file mode 100644 index 0000000..fe84971 --- /dev/null +++ b/patches.kernel.org/6.2.11-067-USB-serial-cp210x-add-Silicon-Labs-IFS-USB-DAT.patch @@ -0,0 +1,37 @@ +From: Kees Jan Koster +Date: Sat, 18 Feb 2023 15:18:30 +0100 +Subject: [PATCH] USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 71f8afa2b66e356f435b6141b4a9ccf953e18356 + +commit 71f8afa2b66e356f435b6141b4a9ccf953e18356 upstream. + +The Silicon Labs IFS-USB-DATACABLE is used in conjunction with for example +the Quint UPSes. It is used to enable Modbus communication with the UPS to +query configuration, power and battery status. + +Signed-off-by: Kees Jan Koster +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 832ad592..cdea1bff 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -120,6 +120,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x826B) }, /* Cygnal Integrated Products, Inc., Fasttrax GPS demonstration module */ + { USB_DEVICE(0x10C4, 0x8281) }, /* Nanotec Plug & Drive */ + { USB_DEVICE(0x10C4, 0x8293) }, /* Telegesis ETRX2USB */ ++ { USB_DEVICE(0x10C4, 0x82AA) }, /* Silicon Labs IFS-USB-DATACABLE used with Quint UPS */ + { USB_DEVICE(0x10C4, 0x82EF) }, /* CESINEL FALCO 6105 AC Power Supply */ + { USB_DEVICE(0x10C4, 0x82F1) }, /* CESINEL MEDCAL EFD Earth Fault Detector */ + { USB_DEVICE(0x10C4, 0x82F2) }, /* CESINEL MEDCAL ST Network Analyzer */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-068-usb-typec-altmodes-displayport-Fix-configure-i.patch b/patches.kernel.org/6.2.11-068-usb-typec-altmodes-displayport-Fix-configure-i.patch new file mode 100644 index 0000000..0c48293 --- /dev/null +++ b/patches.kernel.org/6.2.11-068-usb-typec-altmodes-displayport-Fix-configure-i.patch @@ -0,0 +1,52 @@ +From: RD Babiera +Date: Wed, 29 Mar 2023 21:51:59 +0000 +Subject: [PATCH] usb: typec: altmodes/displayport: Fix configure initial pin + assignment +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: eddebe39602efe631b83ff8d03f26eba12cfd760 + +commit eddebe39602efe631b83ff8d03f26eba12cfd760 upstream. + +While determining the initial pin assignment to be sent in the configure +message, using the DP_PIN_ASSIGN_DP_ONLY_MASK mask causes the DFP_U to +send both Pin Assignment C and E when both are supported by the DFP_U and +UFP_U. The spec (Table 5-7 DFP_U Pin Assignment Selection Mandates, +VESA DisplayPort Alt Mode Standard v2.0) indicates that the DFP_U never +selects Pin Assignment E when Pin Assignment C is offered. + +Update the DP_PIN_ASSIGN_DP_ONLY_MASK conditional to intially select only +Pin Assignment C if it is available. + +Fixes: 0e3bb7d6894d ("usb: typec: Add driver for DisplayPort alternate mode") +Cc: stable@vger.kernel.org +Signed-off-by: RD Babiera +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20230329215159.2046932-1-rdbabiera@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/typec/altmodes/displayport.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c +index 50b24096..0ea50b44 100644 +--- a/drivers/usb/typec/altmodes/displayport.c ++++ b/drivers/usb/typec/altmodes/displayport.c +@@ -112,8 +112,12 @@ static int dp_altmode_configure(struct dp_altmode *dp, u8 con) + if (dp->data.status & DP_STATUS_PREFER_MULTI_FUNC && + pin_assign & DP_PIN_ASSIGN_MULTI_FUNC_MASK) + pin_assign &= DP_PIN_ASSIGN_MULTI_FUNC_MASK; +- else if (pin_assign & DP_PIN_ASSIGN_DP_ONLY_MASK) ++ else if (pin_assign & DP_PIN_ASSIGN_DP_ONLY_MASK) { + pin_assign &= DP_PIN_ASSIGN_DP_ONLY_MASK; ++ /* Default to pin assign C if available */ ++ if (pin_assign & BIT(DP_PIN_ASSIGN_C)) ++ pin_assign = BIT(DP_PIN_ASSIGN_C); ++ } + + if (!pin_assign) + return -EINVAL; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-069-USB-serial-option-add-Telit-FE990-compositions.patch b/patches.kernel.org/6.2.11-069-USB-serial-option-add-Telit-FE990-compositions.patch new file mode 100644 index 0000000..405e9cc --- /dev/null +++ b/patches.kernel.org/6.2.11-069-USB-serial-option-add-Telit-FE990-compositions.patch @@ -0,0 +1,48 @@ +From: Enrico Sau +Date: Tue, 14 Mar 2023 10:00:59 +0100 +Subject: [PATCH] USB: serial: option: add Telit FE990 compositions +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 773e8e7d07b753474b2ccd605ff092faaa9e65b9 + +commit 773e8e7d07b753474b2ccd605ff092faaa9e65b9 upstream. + +Add the following Telit FE990 compositions: + +0x1080: tty, adb, rmnet, tty, tty, tty, tty +0x1081: tty, adb, mbim, tty, tty, tty, tty +0x1082: rndis, tty, adb, tty, tty, tty, tty +0x1083: tty, adb, ecm, tty, tty, tty, tty + +Signed-off-by: Enrico Sau +Link: https://lore.kernel.org/r/20230314090059.77876-1-enrico.sau@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/serial/option.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index e6d8d9b3..1621f66d 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1300,6 +1300,14 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990 (PCIe) */ + .driver_info = RSVD(0) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff), /* Telit FE990 (rmnet) */ ++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1081, 0xff), /* Telit FE990 (MBIM) */ ++ .driver_info = NCTRL(0) | RSVD(1) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1082, 0xff), /* Telit FE990 (RNDIS) */ ++ .driver_info = NCTRL(2) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1083, 0xff), /* Telit FE990 (ECM) */ ++ .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-070-USB-serial-option-add-Quectel-RM500U-CN-modem.patch b/patches.kernel.org/6.2.11-070-USB-serial-option-add-Quectel-RM500U-CN-modem.patch new file mode 100644 index 0000000..758a7df --- /dev/null +++ b/patches.kernel.org/6.2.11-070-USB-serial-option-add-Quectel-RM500U-CN-modem.patch @@ -0,0 +1,138 @@ +From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= +Date: Tue, 28 Mar 2023 20:41:31 +0200 +Subject: [PATCH] USB: serial: option: add Quectel RM500U-CN modem +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 7708a3858e69db91a8b69487994f33b96d20192a + +commit 7708a3858e69db91a8b69487994f33b96d20192a upstream. + +This modem supports several modes with a class network function +and a number of serial functions, all using ff/00/00 + +The device ID is the same in all modes. + +RNDIS mode +---------- +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0900 Rev= 4.04 +S: Manufacturer=Quectel +S: Product=RM500U-CN +S: SerialNumber=0123456789ABCDEF +C:* #Ifs= 7 Cfg#= 1 Atr=c0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +ECM mode +-------- +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0900 Rev= 4.04 +S: Manufacturer=Quectel +S: Product=RM500U-CN +S: SerialNumber=0123456789ABCDEF +C:* #Ifs= 7 Cfg#= 1 Atr=c0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=06 Prot=00 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +NCM mode +-------- +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0900 Rev= 4.04 +S: Manufacturer=Quectel +S: Product=RM500U-CN +S: SerialNumber=0123456789ABCDEF +C:* #Ifs= 7 Cfg#= 1 Atr=c0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0d Prot=00 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0d Prot=00 Driver=cdc_ncm +E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=01 Driver=cdc_ncm +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=01 Driver=cdc_ncm +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Reported-by: Andrew Green +Cc: stable@vger.kernel.org +Signed-off-by: Bjørn Mork +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 1621f66d..f31cc3c7 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1198,6 +1198,8 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, 0x0900, 0xff, 0, 0), /* RM500U-CN */ ++ .driver_info = ZLP }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200U, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) }, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-071-drivers-iio-adc-ltc2497-fix-LSB-shift.patch b/patches.kernel.org/6.2.11-071-drivers-iio-adc-ltc2497-fix-LSB-shift.patch new file mode 100644 index 0000000..659a8a8 --- /dev/null +++ b/patches.kernel.org/6.2.11-071-drivers-iio-adc-ltc2497-fix-LSB-shift.patch @@ -0,0 +1,64 @@ +From: Ian Ray +Date: Fri, 27 Jan 2023 14:57:14 +0200 +Subject: [PATCH] drivers: iio: adc: ltc2497: fix LSB shift +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 6327a930ab7bfa1ab33bcdffd5f5f4b1e7131504 + +commit 6327a930ab7bfa1ab33bcdffd5f5f4b1e7131504 upstream. + +Correct the "sub_lsb" shift for the ltc2497 and drop the sub_lsb element +which is now constant. + +An earlier version of the code shifted by 14 but this was a consequence +of reading three bytes into a __be32 buffer and using be32_to_cpu(), so +eight extra bits needed to be skipped. Now we use get_unaligned_be24() +and thus the additional skip is wrong. + +Fixes: 2187cfeb3626 ("drivers: iio: adc: ltc2497: LTC2499 support") +Signed-off-by: Ian Ray +Link: https://lore.kernel.org/r/20230127125714.44608-1-ian.ray@ge.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iio/adc/ltc2497.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/iio/adc/ltc2497.c b/drivers/iio/adc/ltc2497.c +index 17370c5e..ec198c6f 100644 +--- a/drivers/iio/adc/ltc2497.c ++++ b/drivers/iio/adc/ltc2497.c +@@ -28,7 +28,6 @@ struct ltc2497_driverdata { + struct ltc2497core_driverdata common_ddata; + struct i2c_client *client; + u32 recv_size; +- u32 sub_lsb; + /* + * DMA (thus cache coherency maintenance) may require the + * transfer buffers to live in their own cache lines. +@@ -65,10 +64,10 @@ static int ltc2497_result_and_measure(struct ltc2497core_driverdata *ddata, + * equivalent to a sign extension. + */ + if (st->recv_size == 3) { +- *val = (get_unaligned_be24(st->data.d8) >> st->sub_lsb) ++ *val = (get_unaligned_be24(st->data.d8) >> 6) + - BIT(ddata->chip_info->resolution + 1); + } else { +- *val = (be32_to_cpu(st->data.d32) >> st->sub_lsb) ++ *val = (be32_to_cpu(st->data.d32) >> 6) + - BIT(ddata->chip_info->resolution + 1); + } + +@@ -122,7 +121,6 @@ static int ltc2497_probe(struct i2c_client *client) + st->common_ddata.chip_info = chip_info; + + resolution = chip_info->resolution; +- st->sub_lsb = 31 - (resolution + 1); + st->recv_size = BITS_TO_BYTES(resolution) + 1; + + return ltc2497core_probe(dev, indio_dev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-072-iio-adis16480-select-CONFIG_CRC32.patch b/patches.kernel.org/6.2.11-072-iio-adis16480-select-CONFIG_CRC32.patch new file mode 100644 index 0000000..d7d5ea4 --- /dev/null +++ b/patches.kernel.org/6.2.11-072-iio-adis16480-select-CONFIG_CRC32.patch @@ -0,0 +1,46 @@ +From: Arnd Bergmann +Date: Tue, 31 Jan 2023 10:46:11 +0100 +Subject: [PATCH] iio: adis16480: select CONFIG_CRC32 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: d9b540ee461cca7edca0dd2c2a42625c6b9ffb8f + +commit d9b540ee461cca7edca0dd2c2a42625c6b9ffb8f upstream. + +In rare randconfig builds, the missing CRC32 helper causes +a link error: + +ld.lld: error: undefined symbol: crc32_le +>>> referenced by usercopy_64.c +>>> vmlinux.o:(adis16480_trigger_handler) + +Fixes: 941f130881fa ("iio: adis16480: support burst read function") +Signed-off-by: Arnd Bergmann +Reviewed-by: Nuno Sá +Link: https://lore.kernel.org/r/20230131094616.130238-1-arnd@kernel.org +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iio/imu/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/iio/imu/Kconfig b/drivers/iio/imu/Kconfig +index f1d7d4b5..c2f97629 100644 +--- a/drivers/iio/imu/Kconfig ++++ b/drivers/iio/imu/Kconfig +@@ -47,6 +47,7 @@ config ADIS16480 + depends on SPI + select IIO_ADIS_LIB + select IIO_ADIS_LIB_BUFFER if IIO_BUFFER ++ select CRC32 + help + Say yes here to build support for Analog Devices ADIS16375, ADIS16480, + ADIS16485, ADIS16488 inertial sensors. +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-073-iio-adc-qcom-spmi-adc5-Fix-the-channel-name.patch b/patches.kernel.org/6.2.11-073-iio-adc-qcom-spmi-adc5-Fix-the-channel-name.patch new file mode 100644 index 0000000..3d04818 --- /dev/null +++ b/patches.kernel.org/6.2.11-073-iio-adc-qcom-spmi-adc5-Fix-the-channel-name.patch @@ -0,0 +1,57 @@ +From: Andy Shevchenko +Date: Wed, 18 Jan 2023 12:06:23 +0200 +Subject: [PATCH] iio: adc: qcom-spmi-adc5: Fix the channel name +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 701c875aded880013aacac608832995c4b052257 + +commit 701c875aded880013aacac608832995c4b052257 upstream. + +The node name can contain an address part which is unused +by the driver. Moreover, this string is propagated into +the userspace label, sysfs filenames *and breaking ABI*. + +Cut the address part out before assigning the channel name. + +Fixes: 4f47a236a23d ("iio: adc: qcom-spmi-adc5: convert to device properties") +Reported-by: Marijn Suijten +Signed-off-by: Andy Shevchenko +Reviewed-by: Marijn Suijten +Link: https://lore.kernel.org/r/20230118100623.42255-1-andriy.shevchenko@linux.intel.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iio/adc/qcom-spmi-adc5.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/iio/adc/qcom-spmi-adc5.c b/drivers/iio/adc/qcom-spmi-adc5.c +index 821fee60..d1b86570 100644 +--- a/drivers/iio/adc/qcom-spmi-adc5.c ++++ b/drivers/iio/adc/qcom-spmi-adc5.c +@@ -626,12 +626,20 @@ static int adc5_get_fw_channel_data(struct adc5_chip *adc, + struct fwnode_handle *fwnode, + const struct adc5_data *data) + { +- const char *name = fwnode_get_name(fwnode), *channel_name; ++ const char *channel_name; ++ char *name; + u32 chan, value, varr[2]; + u32 sid = 0; + int ret; + struct device *dev = adc->dev; + ++ name = devm_kasprintf(dev, GFP_KERNEL, "%pfwP", fwnode); ++ if (!name) ++ return -ENOMEM; ++ ++ /* Cut the address part */ ++ name[strchrnul(name, '@') - name] = '\0'; ++ + ret = fwnode_property_read_u32(fwnode, "reg", &chan); + if (ret) { + dev_err(dev, "invalid channel number %s\n", name); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-074-iio-adc-ti-ads7950-Set-can_sleep-flag-for-GPIO.patch b/patches.kernel.org/6.2.11-074-iio-adc-ti-ads7950-Set-can_sleep-flag-for-GPIO.patch new file mode 100644 index 0000000..571d29b --- /dev/null +++ b/patches.kernel.org/6.2.11-074-iio-adc-ti-ads7950-Set-can_sleep-flag-for-GPIO.patch @@ -0,0 +1,43 @@ +From: Lars-Peter Clausen +Date: Sun, 12 Mar 2023 14:09:33 -0700 +Subject: [PATCH] iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 363c7dc72f79edd55bf1c4380e0fbf7f1bbc2c86 + +commit 363c7dc72f79edd55bf1c4380e0fbf7f1bbc2c86 upstream. + +The ads7950 uses a mutex as well as SPI transfers in its GPIO callbacks. +This means these callbacks can sleep and the `can_sleep` flag should be +set. + +Having the flag set will make sure that warnings are generated when calling +any of the callbacks from a potentially non-sleeping context. + +Fixes: c97dce792dc8 ("iio: adc: ti-ads7950: add GPIO support") +Signed-off-by: Lars-Peter Clausen +Acked-by: David Lechner +Link: https://lore.kernel.org/r/20230312210933.2275376-1-lars@metafoo.de +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iio/adc/ti-ads7950.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/iio/adc/ti-ads7950.c b/drivers/iio/adc/ti-ads7950.c +index 2cc9a9bd..263fc3a1 100644 +--- a/drivers/iio/adc/ti-ads7950.c ++++ b/drivers/iio/adc/ti-ads7950.c +@@ -634,6 +634,7 @@ static int ti_ads7950_probe(struct spi_device *spi) + st->chip.label = dev_name(&st->spi->dev); + st->chip.parent = &st->spi->dev; + st->chip.owner = THIS_MODULE; ++ st->chip.can_sleep = true; + st->chip.base = -1; + st->chip.ngpio = TI_ADS7950_NUM_GPIOS; + st->chip.get_direction = ti_ads7950_get_direction; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-075-iio-dac-cio-dac-Fix-max-DAC-write-value-check-.patch b/patches.kernel.org/6.2.11-075-iio-dac-cio-dac-Fix-max-DAC-write-value-check-.patch new file mode 100644 index 0000000..ba08b11 --- /dev/null +++ b/patches.kernel.org/6.2.11-075-iio-dac-cio-dac-Fix-max-DAC-write-value-check-.patch @@ -0,0 +1,44 @@ +From: William Breathitt Gray +Date: Fri, 10 Mar 2023 19:22:48 -0500 +Subject: [PATCH] iio: dac: cio-dac: Fix max DAC write value check for 12-bit +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: c3701185ee1973845db088d8b0fc443397ab0eb2 + +commit c3701185ee1973845db088d8b0fc443397ab0eb2 upstream. + +The CIO-DAC series of devices only supports DAC values up to 12-bit +rather than 16-bit. Trying to write a 16-bit value results in only the +lower 12 bits affecting the DAC output which is not what the user +expects. Instead, adjust the DAC write value check to reject values +larger than 12-bit so that they fail explicitly as invalid for the user. + +Fixes: 3b8df5fd526e ("iio: Add IIO support for the Measurement Computing CIO-DAC family") +Cc: stable@vger.kernel.org +Signed-off-by: William Breathitt Gray +Link: https://lore.kernel.org/r/20230311002248.8548-1-william.gray@linaro.org +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iio/dac/cio-dac.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/dac/cio-dac.c b/drivers/iio/dac/cio-dac.c +index 791dd999..18a64f72 100644 +--- a/drivers/iio/dac/cio-dac.c ++++ b/drivers/iio/dac/cio-dac.c +@@ -66,8 +66,8 @@ static int cio_dac_write_raw(struct iio_dev *indio_dev, + if (mask != IIO_CHAN_INFO_RAW) + return -EINVAL; + +- /* DAC can only accept up to a 16-bit value */ +- if ((unsigned int)val > 65535) ++ /* DAC can only accept up to a 12-bit value */ ++ if ((unsigned int)val > 4095) + return -EINVAL; + + priv->chan_out_states[chan->channel] = val; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-076-iio-adc-max11410-fix-read_poll_timeout-usage.patch b/patches.kernel.org/6.2.11-076-iio-adc-max11410-fix-read_poll_timeout-usage.patch new file mode 100644 index 0000000..6deb18d --- /dev/null +++ b/patches.kernel.org/6.2.11-076-iio-adc-max11410-fix-read_poll_timeout-usage.patch @@ -0,0 +1,90 @@ +From: =?UTF-8?q?Nuno=20S=C3=A1?= +Date: Tue, 7 Mar 2023 10:53:03 +0100 +Subject: [PATCH] iio: adc: max11410: fix read_poll_timeout() usage +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 7b3825e9487d77e83bf1e27b10a74cd729b8f972 + +commit 7b3825e9487d77e83bf1e27b10a74cd729b8f972 upstream. + +Even though we are passing 'ret' as stop condition for +read_poll_timeout(), that return code is still being ignored. The reason +is that the poll will stop if the passed condition is true which will +happen if the passed op() returns error. However, read_poll_timeout() +returns 0 if the *complete* condition evaluates to true. Therefore, the +error code returned by op() will be ignored. + +To fix this we need to check for both error codes: + * The one returned by read_poll_timeout() which is either 0 or +ETIMEDOUT. + * The one returned by the passed op(). + +Fixes: a44ef7c46097 ("iio: adc: add max11410 adc driver") +Signed-off-by: Nuno Sá +Acked-by: Ibrahim Tilki +Link: https://lore.kernel.org/r/20230307095303.713251-1-nuno.sa@analog.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iio/adc/max11410.c | 22 +++++++++++++++------- + 1 file changed, 15 insertions(+), 7 deletions(-) + +diff --git a/drivers/iio/adc/max11410.c b/drivers/iio/adc/max11410.c +index fdc9f031..e64cd979 100644 +--- a/drivers/iio/adc/max11410.c ++++ b/drivers/iio/adc/max11410.c +@@ -413,13 +413,17 @@ static int max11410_sample(struct max11410_state *st, int *sample_raw, + if (!ret) + return -ETIMEDOUT; + } else { ++ int ret2; ++ + /* Wait for status register Conversion Ready flag */ +- ret = read_poll_timeout(max11410_read_reg, ret, +- ret || (val & MAX11410_STATUS_CONV_READY_BIT), ++ ret = read_poll_timeout(max11410_read_reg, ret2, ++ ret2 || (val & MAX11410_STATUS_CONV_READY_BIT), + 5000, MAX11410_CONVERSION_TIMEOUT_MS * 1000, + true, st, MAX11410_REG_STATUS, &val); + if (ret) + return ret; ++ if (ret2) ++ return ret2; + } + + /* Read ADC Data */ +@@ -850,17 +854,21 @@ static int max11410_init_vref(struct device *dev, + + static int max11410_calibrate(struct max11410_state *st, u32 cal_type) + { +- int ret, val; ++ int ret, ret2, val; + + ret = max11410_write_reg(st, MAX11410_REG_CAL_START, cal_type); + if (ret) + return ret; + + /* Wait for status register Calibration Ready flag */ +- return read_poll_timeout(max11410_read_reg, ret, +- ret || (val & MAX11410_STATUS_CAL_READY_BIT), +- 50000, MAX11410_CALIB_TIMEOUT_MS * 1000, true, +- st, MAX11410_REG_STATUS, &val); ++ ret = read_poll_timeout(max11410_read_reg, ret2, ++ ret2 || (val & MAX11410_STATUS_CAL_READY_BIT), ++ 50000, MAX11410_CALIB_TIMEOUT_MS * 1000, true, ++ st, MAX11410_REG_STATUS, &val); ++ if (ret) ++ return ret; ++ ++ return ret2; + } + + static int max11410_self_calibrate(struct max11410_state *st) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-077-iio-accel-kionix-kx022a-Get-the-timestamp-from.patch b/patches.kernel.org/6.2.11-077-iio-accel-kionix-kx022a-Get-the-timestamp-from.patch new file mode 100644 index 0000000..a5f4c64 --- /dev/null +++ b/patches.kernel.org/6.2.11-077-iio-accel-kionix-kx022a-Get-the-timestamp-from.patch @@ -0,0 +1,46 @@ +From: Mehdi Djait +Date: Sat, 18 Feb 2023 14:51:11 +0100 +Subject: [PATCH] iio: accel: kionix-kx022a: Get the timestamp from the + driver's private data in the trigger_handler +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 03fada47311a3e668f73efc9278c4a559e64ee85 + +commit 03fada47311a3e668f73efc9278c4a559e64ee85 upstream. + +The trigger_handler gets called from the IRQ thread handler using +iio_trigger_poll_chained() which will only call the bottom half of the +pollfunc and therefore pf->timestamp will not get set. + +Use instead the timestamp from the driver's private data which is always +set in the IRQ handler. + +Fixes: 7c1d1677b322 ("iio: accel: Support Kionix/ROHM KX022A accelerometer") +Link: https://lore.kernel.org/linux-iio/Y+6QoBLh1k82cJVN@carbian/ +Reviewed-by: Matti Vaittinen +Signed-off-by: Mehdi Djait +Link: https://lore.kernel.org/r/20230218135111.90061-1-mehdi.djait.k@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iio/accel/kionix-kx022a.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/accel/kionix-kx022a.c b/drivers/iio/accel/kionix-kx022a.c +index f8668598..1c3a7238 100644 +--- a/drivers/iio/accel/kionix-kx022a.c ++++ b/drivers/iio/accel/kionix-kx022a.c +@@ -864,7 +864,7 @@ static irqreturn_t kx022a_trigger_handler(int irq, void *p) + if (ret < 0) + goto err_read; + +- iio_push_to_buffers_with_timestamp(idev, data->buffer, pf->timestamp); ++ iio_push_to_buffers_with_timestamp(idev, data->buffer, data->timestamp); + err_read: + iio_trigger_notify_done(idev->trig); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-078-iio-buffer-correctly-return-bytes-written-in-o.patch b/patches.kernel.org/6.2.11-078-iio-buffer-correctly-return-bytes-written-in-o.patch new file mode 100644 index 0000000..196ce40 --- /dev/null +++ b/patches.kernel.org/6.2.11-078-iio-buffer-correctly-return-bytes-written-in-o.patch @@ -0,0 +1,45 @@ +From: =?UTF-8?q?Nuno=20S=C3=A1?= +Date: Thu, 16 Feb 2023 11:14:50 +0100 +Subject: [PATCH] iio: buffer: correctly return bytes written in output buffers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: b5184a26a28fac1d708b0bfeeb958a9260c2924c + +commit b5184a26a28fac1d708b0bfeeb958a9260c2924c upstream. + +If for some reason 'rb->access->write()' does not write the full +requested data and the O_NONBLOCK is set, we would return 'n' to +userspace which is not really truth. Hence, let's return the number of +bytes we effectively wrote. + +Fixes: 9eeee3b0bf190 ("iio: Add output buffer support") +Signed-off-by: Nuno Sá +Reviewed-by: Lars-Peter Clausen +Link: https://lore.kernel.org/r/20230216101452.591805-2-nuno.sa@analog.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iio/industrialio-buffer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c +index 80c78bd6..6340d8e1 100644 +--- a/drivers/iio/industrialio-buffer.c ++++ b/drivers/iio/industrialio-buffer.c +@@ -220,7 +220,7 @@ static ssize_t iio_buffer_write(struct file *filp, const char __user *buf, + } while (ret == 0); + remove_wait_queue(&rb->pollq, &wait); + +- return ret < 0 ? ret : n; ++ return ret < 0 ? ret : written; + } + + /** +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-079-iio-buffer-make-sure-O_NONBLOCK-is-respected.patch b/patches.kernel.org/6.2.11-079-iio-buffer-make-sure-O_NONBLOCK-is-respected.patch new file mode 100644 index 0000000..07050c1 --- /dev/null +++ b/patches.kernel.org/6.2.11-079-iio-buffer-make-sure-O_NONBLOCK-is-respected.patch @@ -0,0 +1,73 @@ +From: =?UTF-8?q?Nuno=20S=C3=A1?= +Date: Thu, 16 Feb 2023 11:14:51 +0100 +Subject: [PATCH] iio: buffer: make sure O_NONBLOCK is respected +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 3da1814184582ed0faf039275a3f02e6f69944ee + +commit 3da1814184582ed0faf039275a3f02e6f69944ee upstream. + +For output buffers, there's no guarantee that the buffer won't be full +in the first iteration of the loop in which case we would block +independently of userspace passing O_NONBLOCK or not. Fix it by always +checking the flag before going to sleep. + +While at it (and as it's a bit related), refactored the loop so that the +stop condition is 'written != n', i.e, run the loop until all data has +been copied into the IIO buffers. This makes the code a bit simpler. + +Fixes: 9eeee3b0bf190 ("iio: Add output buffer support") +Signed-off-by: Nuno Sá +Reviewed-by: Lars-Peter Clausen +Link: https://lore.kernel.org/r/20230216101452.591805-3-nuno.sa@analog.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iio/industrialio-buffer.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c +index 6340d8e1..a7a080be 100644 +--- a/drivers/iio/industrialio-buffer.c ++++ b/drivers/iio/industrialio-buffer.c +@@ -203,21 +203,24 @@ static ssize_t iio_buffer_write(struct file *filp, const char __user *buf, + break; + } + ++ if (filp->f_flags & O_NONBLOCK) { ++ if (!written) ++ ret = -EAGAIN; ++ break; ++ } ++ + wait_woken(&wait, TASK_INTERRUPTIBLE, + MAX_SCHEDULE_TIMEOUT); + continue; + } + + ret = rb->access->write(rb, n - written, buf + written); +- if (ret == 0 && (filp->f_flags & O_NONBLOCK)) +- ret = -EAGAIN; ++ if (ret < 0) ++ break; + +- if (ret > 0) { +- written += ret; +- if (written != n && !(filp->f_flags & O_NONBLOCK)) +- continue; +- } +- } while (ret == 0); ++ written += ret; ++ ++ } while (written != n); + remove_wait_queue(&rb->pollq, &wait); + + return ret < 0 ? ret : written; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-080-iio-light-cm32181-Unregister-second-I2C-client.patch b/patches.kernel.org/6.2.11-080-iio-light-cm32181-Unregister-second-I2C-client.patch new file mode 100644 index 0000000..b0a277d --- /dev/null +++ b/patches.kernel.org/6.2.11-080-iio-light-cm32181-Unregister-second-I2C-client.patch @@ -0,0 +1,62 @@ +From: Kai-Heng Feng +Date: Thu, 23 Feb 2023 10:00:59 +0800 +Subject: [PATCH] iio: light: cm32181: Unregister second I2C client if present +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 099cc90a5a62e68b2fe3a42da011ab929b98bf73 + +commit 099cc90a5a62e68b2fe3a42da011ab929b98bf73 upstream. + +If a second dummy client that talks to the actual I2C address was +created in probe(), there should be a proper cleanup on driver and +device removal to avoid leakage. + +So unregister the dummy client via another callback. + +Reviewed-by: Hans de Goede +Suggested-by: Hans de Goede +Fixes: c1e62062ff54 ("iio: light: cm32181: Handle CM3218 ACPI devices with 2 I2C resources") +Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2152281 +Signed-off-by: Kai-Heng Feng +Link: https://lore.kernel.org/r/20230223020059.2013993-1-kai.heng.feng@canonical.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iio/light/cm32181.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/iio/light/cm32181.c b/drivers/iio/light/cm32181.c +index b1674a5b..d4a34a3b 100644 +--- a/drivers/iio/light/cm32181.c ++++ b/drivers/iio/light/cm32181.c +@@ -429,6 +429,14 @@ static const struct iio_info cm32181_info = { + .attrs = &cm32181_attribute_group, + }; + ++static void cm32181_unregister_dummy_client(void *data) ++{ ++ struct i2c_client *client = data; ++ ++ /* Unregister the dummy client */ ++ i2c_unregister_device(client); ++} ++ + static int cm32181_probe(struct i2c_client *client) + { + struct device *dev = &client->dev; +@@ -460,6 +468,10 @@ static int cm32181_probe(struct i2c_client *client) + client = i2c_acpi_new_device(dev, 1, &board_info); + if (IS_ERR(client)) + return PTR_ERR(client); ++ ++ ret = devm_add_action_or_reset(dev, cm32181_unregister_dummy_client, client); ++ if (ret) ++ return ret; + } + + cm32181 = iio_priv(indio_dev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-081-iio-light-vcnl4000-Fix-WARN_ON-on-uninitialize.patch b/patches.kernel.org/6.2.11-081-iio-light-vcnl4000-Fix-WARN_ON-on-uninitialize.patch new file mode 100644 index 0000000..2318303 --- /dev/null +++ b/patches.kernel.org/6.2.11-081-iio-light-vcnl4000-Fix-WARN_ON-on-uninitialize.patch @@ -0,0 +1,67 @@ +From: =?UTF-8?q?M=C3=A5rten=20Lindahl?= +Date: Tue, 31 Jan 2023 15:01:09 +0100 +Subject: [PATCH] iio: light: vcnl4000: Fix WARN_ON on uninitialized lock +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 42ec40b0883c1cce58b06e8fa82049a61033151c + +commit 42ec40b0883c1cce58b06e8fa82049a61033151c upstream. + +There are different init functions for the sensors in this driver in +which only one initializes the generic vcnl4000_lock. With commit +e21b5b1f2669 ("iio: light: vcnl4000: Preserve conf bits when toggle power") +the vcnl4040 sensor started to depend on the lock, but it was missed to +initialize it in vcnl4040's init function. This has not been visible +until we run lockdep on it: + + DEBUG_LOCKS_WARN_ON(lock->magic != lock) + at kernel/locking/mutex.c:575 __mutex_lock+0x4f8/0x890 + Call trace: + __mutex_lock + mutex_lock_nested + vcnl4200_set_power_state + vcnl4200_init + vcnl4000_probe + +Fix this by initializing the lock in the probe function instead of doing +it in the chip specific init functions. + +Fixes: e21b5b1f2669 ("iio: light: vcnl4000: Preserve conf bits when toggle power") +Signed-off-by: Mårten Lindahl +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230131140109.2067577-1-marten.lindahl@axis.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iio/light/vcnl4000.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/iio/light/vcnl4000.c b/drivers/iio/light/vcnl4000.c +index cc1a2062..69c5bc98 100644 +--- a/drivers/iio/light/vcnl4000.c ++++ b/drivers/iio/light/vcnl4000.c +@@ -199,7 +199,6 @@ static int vcnl4000_init(struct vcnl4000_data *data) + + data->rev = ret & 0xf; + data->al_scale = 250000; +- mutex_init(&data->vcnl4000_lock); + + return data->chip_spec->set_power_state(data, true); + }; +@@ -1197,6 +1196,8 @@ static int vcnl4000_probe(struct i2c_client *client) + data->id = id->driver_data; + data->chip_spec = &vcnl4000_chip_spec_cfg[data->id]; + ++ mutex_init(&data->vcnl4000_lock); ++ + ret = data->chip_spec->init(data); + if (ret < 0) + return ret; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-082-tty-serial-sh-sci-Fix-transmit-end-interrupt-h.patch b/patches.kernel.org/6.2.11-082-tty-serial-sh-sci-Fix-transmit-end-interrupt-h.patch new file mode 100644 index 0000000..ac7a980 --- /dev/null +++ b/patches.kernel.org/6.2.11-082-tty-serial-sh-sci-Fix-transmit-end-interrupt-h.patch @@ -0,0 +1,53 @@ +From: Biju Das +Date: Fri, 17 Mar 2023 15:04:03 +0000 +Subject: [PATCH] tty: serial: sh-sci: Fix transmit end interrupt handler +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: b43a18647f03c87e77d50d6fe74904b61b96323e + +commit b43a18647f03c87e77d50d6fe74904b61b96323e upstream. + +The fourth interrupt on SCI port is transmit end interrupt compared to +the break interrupt on other port types. So, shuffle the interrupts to fix +the transmit end interrupt handler. + +Fixes: e1d0be616186 ("sh-sci: Add h8300 SCI") +Cc: stable +Suggested-by: Geert Uytterhoeven +Signed-off-by: Biju Das +Link: https://lore.kernel.org/r/20230317150403.154094-1-biju.das.jz@bp.renesas.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/tty/serial/sh-sci.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index 7bd08072..c07663fe 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -31,6 +31,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -2864,6 +2865,13 @@ static int sci_init_single(struct platform_device *dev, + sci_port->irqs[i] = platform_get_irq(dev, i); + } + ++ /* ++ * The fourth interrupt on SCI port is transmit end interrupt, so ++ * shuffle the interrupts. ++ */ ++ if (p->type == PORT_SCI) ++ swap(sci_port->irqs[SCIx_BRI_IRQ], sci_port->irqs[SCIx_TEI_IRQ]); ++ + /* The SCI generates several interrupts. They can be muxed together or + * connected to different interrupt lines. In the muxed case only one + * interrupt resource is specified as there is only one interrupt ID. +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-083-tty-serial-sh-sci-Fix-Rx-on-RZ-G2L-SCI.patch b/patches.kernel.org/6.2.11-083-tty-serial-sh-sci-Fix-Rx-on-RZ-G2L-SCI.patch new file mode 100644 index 0000000..64d35f0 --- /dev/null +++ b/patches.kernel.org/6.2.11-083-tty-serial-sh-sci-Fix-Rx-on-RZ-G2L-SCI.patch @@ -0,0 +1,39 @@ +From: Biju Das +Date: Tue, 21 Mar 2023 11:47:50 +0000 +Subject: [PATCH] tty: serial: sh-sci: Fix Rx on RZ/G2L SCI +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: f92ed0cd9328aed918ebb0ebb64d259eccbcc6e7 + +commit f92ed0cd9328aed918ebb0ebb64d259eccbcc6e7 upstream. + +SCI IP on RZ/G2L alike SoCs do not need regshift compared to other SCI +IPs on the SH platform. Currently, it does regshift and configuring Rx +wrongly. Drop adding regshift for RZ/G2L alike SoCs. + +Fixes: dfc80387aefb ("serial: sh-sci: Compute the regshift value for SCI ports") +Cc: stable@vger.kernel.org +Signed-off-by: Biju Das +Link: https://lore.kernel.org/r/20230321114753.75038-3-biju.das.jz@bp.renesas.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/tty/serial/sh-sci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index c07663fe..caa09a0c 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -2937,7 +2937,7 @@ static int sci_init_single(struct platform_device *dev, + port->flags = UPF_FIXED_PORT | UPF_BOOT_AUTOCONF | p->flags; + port->fifosize = sci_port->params->fifosize; + +- if (port->type == PORT_SCI) { ++ if (port->type == PORT_SCI && !dev->dev.of_node) { + if (sci_port->reg_size >= 0x20) + port->regshift = 2; + else +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-084-tty-serial-fsl_lpuart-avoid-checking-for-trans.patch b/patches.kernel.org/6.2.11-084-tty-serial-fsl_lpuart-avoid-checking-for-trans.patch new file mode 100644 index 0000000..b11c999 --- /dev/null +++ b/patches.kernel.org/6.2.11-084-tty-serial-fsl_lpuart-avoid-checking-for-trans.patch @@ -0,0 +1,55 @@ +From: Sherry Sun +Date: Thu, 23 Mar 2023 13:44:15 +0800 +Subject: [PATCH] tty: serial: fsl_lpuart: avoid checking for transfer complete + when UARTCTRL_SBK is asserted in lpuart32_tx_empty +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 9425914f3de6febbd6250395f56c8279676d9c3c + +commit 9425914f3de6febbd6250395f56c8279676d9c3c upstream. + +According to LPUART RM, Transmission Complete Flag becomes 0 if queuing +a break character by writing 1 to CTRL[SBK], so here need to avoid +checking for transmission complete when UARTCTRL_SBK is asserted, +otherwise the lpuart32_tx_empty may never get TIOCSER_TEMT. + +Commit 2411fd94ceaa("tty: serial: fsl_lpuart: skip waiting for +transmission complete when UARTCTRL_SBK is asserted") only fix it in +lpuart32_set_termios(), here also fix it in lpuart32_tx_empty(). + +Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register interface support") +Cc: stable +Signed-off-by: Sherry Sun +Link: https://lore.kernel.org/r/20230323054415.20363-1-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/tty/serial/fsl_lpuart.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 812216b2..f58f57ad 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -832,11 +832,17 @@ static unsigned int lpuart32_tx_empty(struct uart_port *port) + struct lpuart_port, port); + unsigned long stat = lpuart32_read(port, UARTSTAT); + unsigned long sfifo = lpuart32_read(port, UARTFIFO); ++ unsigned long ctrl = lpuart32_read(port, UARTCTRL); + + if (sport->dma_tx_in_progress) + return 0; + +- if (stat & UARTSTAT_TC && sfifo & UARTFIFO_TXEMPT) ++ /* ++ * LPUART Transmission Complete Flag may never be set while queuing a break ++ * character, so avoid checking for transmission complete when UARTCTRL_SBK ++ * is asserted. ++ */ ++ if ((stat & UARTSTAT_TC && sfifo & UARTFIFO_TXEMPT) || ctrl & UARTCTRL_SBK) + return TIOCSER_TEMT; + + return 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-085-tty-serial-fsl_lpuart-fix-crash-in-lpuart_upor.patch b/patches.kernel.org/6.2.11-085-tty-serial-fsl_lpuart-fix-crash-in-lpuart_upor.patch new file mode 100644 index 0000000..e05ca71 --- /dev/null +++ b/patches.kernel.org/6.2.11-085-tty-serial-fsl_lpuart-fix-crash-in-lpuart_upor.patch @@ -0,0 +1,39 @@ +From: Sherry Sun +Date: Thu, 23 Mar 2023 19:09:23 +0800 +Subject: [PATCH] tty: serial: fsl_lpuart: fix crash in lpuart_uport_is_active +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 178e00f36f934a88682d96aa046c1f90cb6f83a7 + +commit 178e00f36f934a88682d96aa046c1f90cb6f83a7 upstream. + +For serdev framework, tty->dev is a NULL pointer, lpuart_uport_is_active +calling device_may_wakeup() may cause kernel NULL pointer crash, so here +add the NULL pointer check before using it. + +Fixes: 4f5cb8c5e915 ("tty: serial: fsl_lpuart: enable wakeup source for lpuart") +Cc: stable +Signed-off-by: Sherry Sun +Link: https://lore.kernel.org/r/20230323110923.24581-1-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/tty/serial/fsl_lpuart.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index f58f57ad..59c10bce 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -2896,7 +2896,7 @@ static bool lpuart_uport_is_active(struct lpuart_port *sport) + tty = tty_port_tty_get(port); + if (tty) { + tty_dev = tty->dev; +- may_wake = device_may_wakeup(tty_dev); ++ may_wake = tty_dev && device_may_wakeup(tty_dev); + tty_kref_put(tty); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-086-nilfs2-fix-potential-UAF-of-struct-nilfs_sc_in.patch b/patches.kernel.org/6.2.11-086-nilfs2-fix-potential-UAF-of-struct-nilfs_sc_in.patch new file mode 100644 index 0000000..d381921 --- /dev/null +++ b/patches.kernel.org/6.2.11-086-nilfs2-fix-potential-UAF-of-struct-nilfs_sc_in.patch @@ -0,0 +1,62 @@ +From: Ryusuke Konishi +Date: Tue, 28 Mar 2023 02:53:18 +0900 +Subject: [PATCH] nilfs2: fix potential UAF of struct nilfs_sc_info in + nilfs_segctor_thread() +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 6be49d100c22ffea3287a4b19d7639d259888e33 + +commit 6be49d100c22ffea3287a4b19d7639d259888e33 upstream. + +The finalization of nilfs_segctor_thread() can race with +nilfs_segctor_kill_thread() which terminates that thread, potentially +causing a use-after-free BUG as KASAN detected. + +At the end of nilfs_segctor_thread(), it assigns NULL to "sc_task" member +of "struct nilfs_sc_info" to indicate the thread has finished, and then +notifies nilfs_segctor_kill_thread() of this using waitqueue +"sc_wait_task" on the struct nilfs_sc_info. + +However, here, immediately after the NULL assignment to "sc_task", it is +possible that nilfs_segctor_kill_thread() will detect it and return to +continue the deallocation, freeing the nilfs_sc_info structure before the +thread does the notification. + +This fixes the issue by protecting the NULL assignment to "sc_task" and +its notification, with spinlock "sc_state_lock" of the struct +nilfs_sc_info. Since nilfs_segctor_kill_thread() does a final check to +see if "sc_task" is NULL with "sc_state_lock" locked, this can eliminate +the race. + +Link: https://lkml.kernel.org/r/20230327175318.8060-1-konishi.ryusuke@gmail.com +Reported-by: syzbot+b08ebcc22f8f3e6be43a@syzkaller.appspotmail.com +Link: https://lkml.kernel.org/r/00000000000000660d05f7dfa877@google.com +Signed-off-by: Ryusuke Konishi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/nilfs2/segment.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c +index 76c3bd88..7aea13c3 100644 +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -2607,11 +2607,10 @@ static int nilfs_segctor_thread(void *arg) + goto loop; + + end_thread: +- spin_unlock(&sci->sc_state_lock); +- + /* end sync. */ + sci->sc_task = NULL; + wake_up(&sci->sc_wait_task); /* for nilfs_segctor_kill_thread() */ ++ spin_unlock(&sci->sc_state_lock); + return 0; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-087-nilfs2-fix-sysfs-interface-lifetime.patch b/patches.kernel.org/6.2.11-087-nilfs2-fix-sysfs-interface-lifetime.patch new file mode 100644 index 0000000..e95300b --- /dev/null +++ b/patches.kernel.org/6.2.11-087-nilfs2-fix-sysfs-interface-lifetime.patch @@ -0,0 +1,126 @@ +From: Ryusuke Konishi +Date: Fri, 31 Mar 2023 05:55:15 +0900 +Subject: [PATCH] nilfs2: fix sysfs interface lifetime +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 42560f9c92cc43dce75dbf06cc0d840dced39b12 + +commit 42560f9c92cc43dce75dbf06cc0d840dced39b12 upstream. + +The current nilfs2 sysfs support has issues with the timing of creation +and deletion of sysfs entries, potentially leading to null pointer +dereferences, use-after-free, and lockdep warnings. + +Some of the sysfs attributes for nilfs2 per-filesystem instance refer to +metadata file "cpfile", "sufile", or "dat", but +nilfs_sysfs_create_device_group that creates those attributes is executed +before the inodes for these metadata files are loaded, and +nilfs_sysfs_delete_device_group which deletes these sysfs entries is +called after releasing their metadata file inodes. + +Therefore, access to some of these sysfs attributes may occur outside of +the lifetime of these metadata files, resulting in inode NULL pointer +dereferences or use-after-free. + +In addition, the call to nilfs_sysfs_create_device_group() is made during +the locking period of the semaphore "ns_sem" of nilfs object, so the +shrinker call caused by the memory allocation for the sysfs entries, may +derive lock dependencies "ns_sem" -> (shrinker) -> "locks acquired in +nilfs_evict_inode()". + +Since nilfs2 may acquire "ns_sem" deep in the call stack holding other +locks via its error handler __nilfs_error(), this causes lockdep to report +circular locking. This is a false positive and no circular locking +actually occurs as no inodes exist yet when +nilfs_sysfs_create_device_group() is called. Fortunately, the lockdep +warnings can be resolved by simply moving the call to +nilfs_sysfs_create_device_group() out of "ns_sem". + +This fixes these sysfs issues by revising where the device's sysfs +interface is created/deleted and keeping its lifetime within the lifetime +of the metadata files above. + +Link: https://lkml.kernel.org/r/20230330205515.6167-1-konishi.ryusuke@gmail.com +Fixes: dd70edbde262 ("nilfs2: integrate sysfs support into driver") +Signed-off-by: Ryusuke Konishi +Reported-by: syzbot+979fa7f9c0d086fdc282@syzkaller.appspotmail.com + Link: https://lkml.kernel.org/r/0000000000003414b505f7885f7e@google.com +Reported-by: syzbot+5b7d542076d9bddc3c6a@syzkaller.appspotmail.com + Link: https://lkml.kernel.org/r/0000000000006ac86605f5f44eb9@google.com +Cc: Viacheslav Dubeyko +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/nilfs2/super.c | 2 ++ + fs/nilfs2/the_nilfs.c | 12 +++++++----- + 2 files changed, 9 insertions(+), 5 deletions(-) + +diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c +index 1422b8ba..77f1e577 100644 +--- a/fs/nilfs2/super.c ++++ b/fs/nilfs2/super.c +@@ -482,6 +482,7 @@ static void nilfs_put_super(struct super_block *sb) + up_write(&nilfs->ns_sem); + } + ++ nilfs_sysfs_delete_device_group(nilfs); + iput(nilfs->ns_sufile); + iput(nilfs->ns_cpfile); + iput(nilfs->ns_dat); +@@ -1105,6 +1106,7 @@ nilfs_fill_super(struct super_block *sb, void *data, int silent) + nilfs_put_root(fsroot); + + failed_unload: ++ nilfs_sysfs_delete_device_group(nilfs); + iput(nilfs->ns_sufile); + iput(nilfs->ns_cpfile); + iput(nilfs->ns_dat); +diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c +index 3a4c9c15..2894152a 100644 +--- a/fs/nilfs2/the_nilfs.c ++++ b/fs/nilfs2/the_nilfs.c +@@ -87,7 +87,6 @@ void destroy_nilfs(struct the_nilfs *nilfs) + { + might_sleep(); + if (nilfs_init(nilfs)) { +- nilfs_sysfs_delete_device_group(nilfs); + brelse(nilfs->ns_sbh[0]); + brelse(nilfs->ns_sbh[1]); + } +@@ -305,6 +304,10 @@ int load_nilfs(struct the_nilfs *nilfs, struct super_block *sb) + goto failed; + } + ++ err = nilfs_sysfs_create_device_group(sb); ++ if (unlikely(err)) ++ goto sysfs_error; ++ + if (valid_fs) + goto skip_recovery; + +@@ -366,6 +369,9 @@ int load_nilfs(struct the_nilfs *nilfs, struct super_block *sb) + goto failed; + + failed_unload: ++ nilfs_sysfs_delete_device_group(nilfs); ++ ++ sysfs_error: + iput(nilfs->ns_cpfile); + iput(nilfs->ns_sufile); + iput(nilfs->ns_dat); +@@ -697,10 +703,6 @@ int init_nilfs(struct the_nilfs *nilfs, struct super_block *sb, char *data) + if (err) + goto failed_sbh; + +- err = nilfs_sysfs_create_device_group(sb); +- if (err) +- goto failed_sbh; +- + set_nilfs_init(nilfs); + err = 0; + out: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-088-fsdax-dedupe-should-compare-the-min-of-two-ite.patch b/patches.kernel.org/6.2.11-088-fsdax-dedupe-should-compare-the-min-of-two-ite.patch new file mode 100644 index 0000000..f04a229 --- /dev/null +++ b/patches.kernel.org/6.2.11-088-fsdax-dedupe-should-compare-the-min-of-two-ite.patch @@ -0,0 +1,55 @@ +From: Shiyang Ruan +Date: Wed, 22 Mar 2023 07:25:58 +0000 +Subject: [PATCH] fsdax: dedupe should compare the min of two iters' length +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: e900ba10d15041a6236cc75778cc6e06c3590a58 + +commit e900ba10d15041a6236cc75778cc6e06c3590a58 upstream. + +In an dedupe comparison iter loop, the length of iomap_iter decreases +because it implies the remaining length after each iteration. + +The dedupe command will fail with -EIO if the range is larger than one +page size and not aligned to the page size. Also report warning in dmesg: + +[ 4338.498374] ------------[ cut here ]------------ +[ 4338.498689] WARNING: CPU: 3 PID: 1415645 at fs/iomap/iter.c:16 +... + +The compare function should use the min length of the current iters, +not the total length. + +Link: https://lkml.kernel.org/r/1679469958-2-1-git-send-email-ruansy.fnst@fujitsu.com +Fixes: 0e79e3736d54 ("fsdax: dedupe: iter two files at the same time") +Signed-off-by: Shiyang Ruan +Reviewed-by: Darrick J. Wong +Cc: Dan Williams +Cc: Jan Kara +Cc: Matthew Wilcox (Oracle) +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/dax.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/dax.c b/fs/dax.c +index 3e457a16..9800b93e 100644 +--- a/fs/dax.c ++++ b/fs/dax.c +@@ -2022,8 +2022,8 @@ int dax_dedupe_file_range_compare(struct inode *src, loff_t srcoff, + + while ((ret = iomap_iter(&src_iter, ops)) > 0 && + (ret = iomap_iter(&dst_iter, ops)) > 0) { +- compared = dax_range_compare_iter(&src_iter, &dst_iter, len, +- same); ++ compared = dax_range_compare_iter(&src_iter, &dst_iter, ++ min(src_iter.len, dst_iter.len), same); + if (compared < 0) + return ret; + src_iter.processed = dst_iter.processed = compared; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-089-fsdax-unshare-zero-destination-if-srcmap-is-HO.patch b/patches.kernel.org/6.2.11-089-fsdax-unshare-zero-destination-if-srcmap-is-HO.patch new file mode 100644 index 0000000..cdeb25b --- /dev/null +++ b/patches.kernel.org/6.2.11-089-fsdax-unshare-zero-destination-if-srcmap-is-HO.patch @@ -0,0 +1,66 @@ +From: Shiyang Ruan +Date: Wed, 22 Mar 2023 11:11:09 +0000 +Subject: [PATCH] fsdax: unshare: zero destination if srcmap is HOLE or + UNWRITTEN +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 13dd4e04625f600e5affb1b3f0b6c35268ab839b + +commit 13dd4e04625f600e5affb1b3f0b6c35268ab839b upstream. + +unshare copies data from source to destination. But if the source is +HOLE or UNWRITTEN extents, we should zero the destination, otherwise +the HOLE or UNWRITTEN part will be user-visible old data of the new +allocated extent. + +Found by running generic/649 while mounting with -o dax=always on pmem. + +Link: https://lkml.kernel.org/r/1679483469-2-1-git-send-email-ruansy.fnst@fujitsu.com +Fixes: d984648e428b ("fsdax,xfs: port unshare to fsdax") +Signed-off-by: Shiyang Ruan +Cc: Dan Williams +Cc: Darrick J. Wong +Cc: Jan Kara +Cc: Matthew Wilcox (Oracle) +Cc: Alistair Popple +Cc: Jason Gunthorpe +Cc: John Hubbard +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/dax.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/fs/dax.c b/fs/dax.c +index 9800b93e..5d2e9b10 100644 +--- a/fs/dax.c ++++ b/fs/dax.c +@@ -1258,15 +1258,20 @@ static s64 dax_unshare_iter(struct iomap_iter *iter) + /* don't bother with blocks that are not shared to start with */ + if (!(iomap->flags & IOMAP_F_SHARED)) + return length; +- /* don't bother with holes or unwritten extents */ +- if (srcmap->type == IOMAP_HOLE || srcmap->type == IOMAP_UNWRITTEN) +- return length; + + id = dax_read_lock(); + ret = dax_iomap_direct_access(iomap, pos, length, &daddr, NULL); + if (ret < 0) + goto out_unlock; + ++ /* zero the distance if srcmap is HOLE or UNWRITTEN */ ++ if (srcmap->flags & IOMAP_F_SHARED || srcmap->type == IOMAP_UNWRITTEN) { ++ memset(daddr, 0, length); ++ dax_flush(iomap->dax_dev, daddr, length); ++ ret = length; ++ goto out_unlock; ++ } ++ + ret = dax_iomap_direct_access(srcmap, pos, length, &saddr, NULL); + if (ret < 0) + goto out_unlock; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-090-fsdax-force-clear-dirty-mark-if-CoW.patch b/patches.kernel.org/6.2.11-090-fsdax-force-clear-dirty-mark-if-CoW.patch new file mode 100644 index 0000000..614ffe7 --- /dev/null +++ b/patches.kernel.org/6.2.11-090-fsdax-force-clear-dirty-mark-if-CoW.patch @@ -0,0 +1,133 @@ +From: Shiyang Ruan +Date: Fri, 24 Mar 2023 10:28:00 +0000 +Subject: [PATCH] fsdax: force clear dirty mark if CoW +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: f76b3a32879de215ced3f8c754c4077b0c2f79e3 + +commit f76b3a32879de215ced3f8c754c4077b0c2f79e3 upstream. + +XFS allows CoW on non-shared extents to combat fragmentation[1]. The old +non-shared extent could be mwrited before, its dax entry is marked dirty. + +This results in a WARNing: + +[ 28.512349] ------------[ cut here ]------------ +[ 28.512622] WARNING: CPU: 2 PID: 5255 at fs/dax.c:390 dax_insert_entry+0x342/0x390 +[ 28.513050] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace fscache netfs nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables +[ 28.515462] CPU: 2 PID: 5255 Comm: fsstress Kdump: loaded Not tainted 6.3.0-rc1-00001-g85e1481e19c1-dirty #117 +[ 28.515902] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS Arch Linux 1.16.1-1-1 04/01/2014 +[ 28.516307] RIP: 0010:dax_insert_entry+0x342/0x390 +[ 28.516536] Code: 30 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 8b 45 20 48 83 c0 01 e9 e2 fe ff ff 48 8b 45 20 48 83 c0 01 e9 cd fe ff ff <0f> 0b e9 53 ff ff ff 48 8b 7c 24 08 31 f6 e8 1b 61 a1 00 eb 8c 48 +[ 28.517417] RSP: 0000:ffffc9000845fb18 EFLAGS: 00010086 +[ 28.517721] RAX: 0000000000000053 RBX: 0000000000000155 RCX: 000000000018824b +[ 28.518113] RDX: 0000000000000000 RSI: ffffffff827525a6 RDI: 00000000ffffffff +[ 28.518515] RBP: ffffea00062092c0 R08: 0000000000000000 R09: ffffc9000845f9c8 +[ 28.518905] R10: 0000000000000003 R11: ffffffff82ddb7e8 R12: 0000000000000155 +[ 28.519301] R13: 0000000000000000 R14: 000000000018824b R15: ffff88810cfa76b8 +[ 28.519703] FS: 00007f14a0c94740(0000) GS:ffff88817bd00000(0000) knlGS:0000000000000000 +[ 28.520148] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 28.520472] CR2: 00007f14a0c8d000 CR3: 000000010321c004 CR4: 0000000000770ee0 +[ 28.520863] PKRU: 55555554 +[ 28.521043] Call Trace: +[ 28.521219] +[ 28.521368] dax_fault_iter+0x196/0x390 +[ 28.521595] dax_iomap_pte_fault+0x19b/0x3d0 +[ 28.521852] __xfs_filemap_fault+0x234/0x2b0 +[ 28.522116] __do_fault+0x30/0x130 +[ 28.522334] do_fault+0x193/0x340 +[ 28.522586] __handle_mm_fault+0x2d3/0x690 +[ 28.522975] handle_mm_fault+0xe6/0x2c0 +[ 28.523259] do_user_addr_fault+0x1bc/0x6f0 +[ 28.523521] exc_page_fault+0x60/0x140 +[ 28.523763] asm_exc_page_fault+0x22/0x30 +[ 28.524001] RIP: 0033:0x7f14a0b589ca +[ 28.524225] Code: c5 fe 7f 07 c5 fe 7f 47 20 c5 fe 7f 47 40 c5 fe 7f 47 60 c5 f8 77 c3 66 0f 1f 84 00 00 00 00 00 40 0f b6 c6 48 89 d1 48 89 fa aa 48 89 d0 c5 f8 77 c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 +[ 28.525198] RSP: 002b:00007fff1dea1c98 EFLAGS: 00010202 +[ 28.525505] RAX: 000000000000001e RBX: 000000000014a000 RCX: 0000000000006046 +[ 28.525895] RDX: 00007f14a0c82000 RSI: 000000000000001e RDI: 00007f14a0c8d000 +[ 28.526290] RBP: 000000000000006f R08: 0000000000000004 R09: 000000000014a000 +[ 28.526681] R10: 0000000000000008 R11: 0000000000000246 R12: 028f5c28f5c28f5c +[ 28.527067] R13: 8f5c28f5c28f5c29 R14: 0000000000011046 R15: 00007f14a0c946c0 +[ 28.527449] +[ 28.527600] ---[ end trace 0000000000000000 ]--- + + +To be able to delete this entry, clear its dirty mark before +invalidate_inode_pages2_range(). + +[1] https://lore.kernel.org/linux-xfs/20230321151339.GA11376@frogsfrogsfrogs/ + +Link: https://lkml.kernel.org/r/1679653680-2-1-git-send-email-ruansy.fnst@fujitsu.com +Fixes: f80e1668888f3 ("fsdax: invalidate pages when CoW") +Signed-off-by: Shiyang Ruan +Cc: Dan Williams +Cc: Darrick J. Wong +Cc: Jan Kara +Cc: Matthew Wilcox (Oracle) +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/dax.c | 37 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 37 insertions(+) + +diff --git a/fs/dax.c b/fs/dax.c +index 5d2e9b10..2ababb89 100644 +--- a/fs/dax.c ++++ b/fs/dax.c +@@ -781,6 +781,33 @@ static int __dax_invalidate_entry(struct address_space *mapping, + return ret; + } + ++static int __dax_clear_dirty_range(struct address_space *mapping, ++ pgoff_t start, pgoff_t end) ++{ ++ XA_STATE(xas, &mapping->i_pages, start); ++ unsigned int scanned = 0; ++ void *entry; ++ ++ xas_lock_irq(&xas); ++ xas_for_each(&xas, entry, end) { ++ entry = get_unlocked_entry(&xas, 0); ++ xas_clear_mark(&xas, PAGECACHE_TAG_DIRTY); ++ xas_clear_mark(&xas, PAGECACHE_TAG_TOWRITE); ++ put_unlocked_entry(&xas, entry, WAKE_NEXT); ++ ++ if (++scanned % XA_CHECK_SCHED) ++ continue; ++ ++ xas_pause(&xas); ++ xas_unlock_irq(&xas); ++ cond_resched(); ++ xas_lock_irq(&xas); ++ } ++ xas_unlock_irq(&xas); ++ ++ return 0; ++} ++ + /* + * Delete DAX entry at @index from @mapping. Wait for it + * to be unlocked before deleting it. +@@ -1440,6 +1467,16 @@ static loff_t dax_iomap_iter(const struct iomap_iter *iomi, + * written by write(2) is visible in mmap. + */ + if (iomap->flags & IOMAP_F_NEW || cow) { ++ /* ++ * Filesystem allows CoW on non-shared extents. The src extents ++ * may have been mmapped with dirty mark before. To be able to ++ * invalidate its dax entries, we need to clear the dirty mark ++ * in advance. ++ */ ++ if (cow) ++ __dax_clear_dirty_range(iomi->inode->i_mapping, ++ pos >> PAGE_SHIFT, ++ (end - 1) >> PAGE_SHIFT); + invalidate_inode_pages2_range(iomi->inode->i_mapping, + pos >> PAGE_SHIFT, + (end - 1) >> PAGE_SHIFT); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-091-dt-bindings-serial-renesas-scif-Fix-4th-IRQ-fo.patch b/patches.kernel.org/6.2.11-091-dt-bindings-serial-renesas-scif-Fix-4th-IRQ-fo.patch new file mode 100644 index 0000000..07428eb --- /dev/null +++ b/patches.kernel.org/6.2.11-091-dt-bindings-serial-renesas-scif-Fix-4th-IRQ-fo.patch @@ -0,0 +1,50 @@ +From: Geert Uytterhoeven +Date: Fri, 17 Mar 2023 10:46:57 +0100 +Subject: [PATCH] dt-bindings: serial: renesas,scif: Fix 4th IRQ for 4-IRQ + SCIFs +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 7b21f329ae0ab6361c0aebfc094db95821490cd1 + +commit 7b21f329ae0ab6361c0aebfc094db95821490cd1 upstream. + +The fourth interrupt on SCIF variants with four interrupts (RZ/A1) is +the Break interrupt, not the Transmit End interrupt (like on SCI(g)). +Update the description and interrupt name to fix this. + +Fixes: 384d00fae8e51f8f ("dt-bindings: serial: sh-sci: Convert to json-schema") +Cc: stable +Signed-off-by: Geert Uytterhoeven +Acked-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/719d1582e0ebbe3d674e3a48fc26295e1475a4c3.1679046394.git.geert+renesas@glider.be +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + Documentation/devicetree/bindings/serial/renesas,scif.yaml | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/Documentation/devicetree/bindings/serial/renesas,scif.yaml b/Documentation/devicetree/bindings/serial/renesas,scif.yaml +index f81f2d67..38391a5d 100644 +--- a/Documentation/devicetree/bindings/serial/renesas,scif.yaml ++++ b/Documentation/devicetree/bindings/serial/renesas,scif.yaml +@@ -92,7 +92,7 @@ properties: + - description: Error interrupt + - description: Receive buffer full interrupt + - description: Transmit buffer empty interrupt +- - description: Transmit End interrupt ++ - description: Break interrupt + - items: + - description: Error interrupt + - description: Receive buffer full interrupt +@@ -107,7 +107,7 @@ properties: + - const: eri + - const: rxi + - const: txi +- - const: tei ++ - const: bri + - items: + - const: eri + - const: rxi +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-092-serial-8250-Prevent-starting-up-DMA-Rx-on-THRI.patch b/patches.kernel.org/6.2.11-092-serial-8250-Prevent-starting-up-DMA-Rx-on-THRI.patch new file mode 100644 index 0000000..d9a5c17 --- /dev/null +++ b/patches.kernel.org/6.2.11-092-serial-8250-Prevent-starting-up-DMA-Rx-on-THRI.patch @@ -0,0 +1,84 @@ +From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= +Date: Fri, 17 Mar 2023 12:30:34 +0200 +Subject: [PATCH] serial: 8250: Prevent starting up DMA Rx on THRI interrupt +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 90b8596ac46043e4a782d9111f5b285251b13756 + +commit 90b8596ac46043e4a782d9111f5b285251b13756 upstream. + +Hans de Goede reported Bluetooth adapters (HCIs) connected over an UART +connection failed due corrupted Rx payload. The problem was narrowed +down to DMA Rx starting on UART_IIR_THRI interrupt. The problem occurs +despite LSR having DR bit set, which is precondition for attempting to +start DMA Rx in the first place. + +From a debug patch: +[x.807834] 8250irq: iir=cc lsr+saved=60 received=0/15 ier=0f dma_t/rx/err=0/0/0 +[x.808676] 8250irq: iir=c2 lsr+saved=61 received=0/0 ier=0f dma_t/rx/err=0/0/0 +[x.808776] 8250irq: iir=cc lsr+saved=60 received=1/12 ier=0d dma_t/rx/err=0/1/0 +[x.808870] Bluetooth: hci0: Frame reassembly failed (-84) + +In the debug snippet, received field indicates 1 byte was transferred +over DMA and 12 bytes after that with the non-DMA Rx. The sole byte DMA +handled was corrupted (gets zeroed) which leads to the HCI failure. + +This problem became apparent after commit e8ffbb71f783 ("serial: 8250: +use THRE & __stop_tx also with DMA") changed Tx stop behavior. Tx stop +is now triggered from a THRI interrupt. + +Despite that this problem looks like a HW bug, this fix is not adding +UART_BUG_xx flag to the driver beucase it seems useful in general to +avoid starting DMA when there are only a few bytes to transfer. +Skipping DMA for small transfers avoids the extra overhead DMA incurs. + +Thus, don't setup DMA Rx on UART_IIR_THRI but leave it to a subsequent +interrupt which has Rx a related IIR value. + +By returning false from handle_rx_dma(), the DMA vs non-DMA decision is +postponed until either UART_IIR_RDI (FIFO threshold worth of bytes +awaiting) or UART_IIR_TIMEOUT (inter-character timeout) triggers at a +later time which allows better to discern whether the number of bytes +warrants starting DMA or not. + +Reported-by: Hans de Goede +Tested-by: Hans de Goede +Fixes: e8ffbb71f783 ("serial: 8250: use THRE & __stop_tx also with DMA") +Cc: stable@vger.kernel.org +Signed-off-by: Ilpo Järvinen +Acked-by: Hans de Goede +Link: https://lore.kernel.org/r/20230317103034.12881-1-ilpo.jarvinen@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/tty/serial/8250/8250_port.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index beba8f38..d006467e 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -1896,6 +1896,17 @@ EXPORT_SYMBOL_GPL(serial8250_modem_status); + static bool handle_rx_dma(struct uart_8250_port *up, unsigned int iir) + { + switch (iir & 0x3f) { ++ case UART_IIR_THRI: ++ /* ++ * Postpone DMA or not decision to IIR_RDI or IIR_RX_TIMEOUT ++ * because it's impossible to do an informed decision about ++ * that with IIR_THRI. ++ * ++ * This also fixes one known DMA Rx corruption issue where ++ * DR is asserted but DMA Rx only gets a corrupted zero byte ++ * (too early DR?). ++ */ ++ return false; + case UART_IIR_RDI: + if (!up->dma->rx_running) + break; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-093-ksmbd-do-not-call-kvmalloc-with-__GFP_NORETRY-.patch b/patches.kernel.org/6.2.11-093-ksmbd-do-not-call-kvmalloc-with-__GFP_NORETRY-.patch new file mode 100644 index 0000000..b89fe97 --- /dev/null +++ b/patches.kernel.org/6.2.11-093-ksmbd-do-not-call-kvmalloc-with-__GFP_NORETRY-.patch @@ -0,0 +1,46 @@ +From: Marios Makassikis +Date: Thu, 16 Mar 2023 14:40:43 +0100 +Subject: [PATCH] ksmbd: do not call kvmalloc() with __GFP_NORETRY | + __GFP_NO_WARN +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: e416ea62a9166e6075a07a970cc5bf79255d2700 + +commit e416ea62a9166e6075a07a970cc5bf79255d2700 upstream. + +Commit 83dcedd5540d ("ksmbd: fix infinite loop in ksmbd_conn_handler_loop()"), +changes GFP modifiers passed to kvmalloc(). This cause xfstests generic/551 +test to fail. We limit pdu length size according to connection status and +maximum number of connections. In the rest, memory allocation of request +is limited by credit management. so these flags are no longer needed. + +Fixes: 83dcedd5540d ("ksmbd: fix infinite loop in ksmbd_conn_handler_loop()") +Cc: stable@vger.kernel.org +Signed-off-by: Marios Makassikis +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/ksmbd/connection.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/fs/ksmbd/connection.c b/fs/ksmbd/connection.c +index 2be9d746..b8f9d627 100644 +--- a/fs/ksmbd/connection.c ++++ b/fs/ksmbd/connection.c +@@ -326,10 +326,7 @@ int ksmbd_conn_handler_loop(void *p) + + /* 4 for rfc1002 length field */ + size = pdu_size + 4; +- conn->request_buf = kvmalloc(size, +- GFP_KERNEL | +- __GFP_NOWARN | +- __GFP_NORETRY); ++ conn->request_buf = kvmalloc(size, GFP_KERNEL); + if (!conn->request_buf) + break; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-094-ksmbd-fix-slab-out-of-bounds-in-init_smb2_rsp_.patch b/patches.kernel.org/6.2.11-094-ksmbd-fix-slab-out-of-bounds-in-init_smb2_rsp_.patch new file mode 100644 index 0000000..82636f9 --- /dev/null +++ b/patches.kernel.org/6.2.11-094-ksmbd-fix-slab-out-of-bounds-in-init_smb2_rsp_.patch @@ -0,0 +1,292 @@ +From: Namjae Jeon +Date: Sat, 1 Apr 2023 13:21:04 +0900 +Subject: [PATCH] ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: dc8289f912387c3bcfbc5d2db29c8947fa207c11 + +commit dc8289f912387c3bcfbc5d2db29c8947fa207c11 upstream. + +When smb1 mount fails, KASAN detect slab-out-of-bounds in +init_smb2_rsp_hdr like the following one. +For smb1 negotiate(56bytes) , init_smb2_rsp_hdr() for smb2 is called. +The issue occurs while handling smb1 negotiate as smb2 server operations. +Add smb server operations for smb1 (get_cmd_val, init_rsp_hdr, +allocate_rsp_buf, check_user_session) to handle smb1 negotiate so that +smb2 server operation does not handle it. + +[ 411.400423] CIFS: VFS: Use of the less secure dialect vers=1.0 is +not recommended unless required for access to very old servers +[ 411.400452] CIFS: Attempting to mount \\192.168.45.139\homes +[ 411.479312] ksmbd: init_smb2_rsp_hdr : 492 +[ 411.479323] ================================================================== +[ 411.479327] BUG: KASAN: slab-out-of-bounds in +init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] +[ 411.479369] Read of size 16 at addr ffff888488ed0734 by task kworker/14:1/199 + +[ 411.479379] CPU: 14 PID: 199 Comm: kworker/14:1 Tainted: G + OE 6.1.21 #3 +[ 411.479386] Hardware name: ASUSTeK COMPUTER INC. Z10PA-D8 +Series/Z10PA-D8 Series, BIOS 3801 08/23/2019 +[ 411.479390] Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] +[ 411.479425] Call Trace: +[ 411.479428] +[ 411.479432] dump_stack_lvl+0x49/0x63 +[ 411.479444] print_report+0x171/0x4a8 +[ 411.479452] ? kasan_complete_mode_report_info+0x3c/0x200 +[ 411.479463] ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] +[ 411.479497] kasan_report+0xb4/0x130 +[ 411.479503] ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] +[ 411.479537] kasan_check_range+0x149/0x1e0 +[ 411.479543] memcpy+0x24/0x70 +[ 411.479550] init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] +[ 411.479585] handle_ksmbd_work+0x109/0x760 [ksmbd] +[ 411.479616] ? _raw_spin_unlock_irqrestore+0x50/0x50 +[ 411.479624] ? smb3_encrypt_resp+0x340/0x340 [ksmbd] +[ 411.479656] process_one_work+0x49c/0x790 +[ 411.479667] worker_thread+0x2b1/0x6e0 +[ 411.479674] ? process_one_work+0x790/0x790 +[ 411.479680] kthread+0x177/0x1b0 +[ 411.479686] ? kthread_complete_and_exit+0x30/0x30 +[ 411.479692] ret_from_fork+0x22/0x30 +[ 411.479702] + +Fixes: 39b291b86b59 ("ksmbd: return unsupported error on smb1 mount") +Cc: stable@vger.kernel.org +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/ksmbd/server.c | 5 +- + fs/ksmbd/smb2pdu.c | 3 - + fs/ksmbd/smb_common.c | 138 +++++++++++++++++++++++++++++++++--------- + fs/ksmbd/smb_common.h | 2 +- + 4 files changed, 111 insertions(+), 37 deletions(-) + +diff --git a/fs/ksmbd/server.c b/fs/ksmbd/server.c +index 394b6cea..0d824278 100644 +--- a/fs/ksmbd/server.c ++++ b/fs/ksmbd/server.c +@@ -289,10 +289,7 @@ static int queue_ksmbd_work(struct ksmbd_conn *conn) + work->request_buf = conn->request_buf; + conn->request_buf = NULL; + +- if (ksmbd_init_smb_server(work)) { +- ksmbd_free_work_struct(work); +- return -EINVAL; +- } ++ ksmbd_init_smb_server(work); + + ksmbd_conn_enqueue_request(work); + atomic_inc(&conn->r_count); +diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c +index d0e76e2a..7e0b62f9 100644 +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -235,9 +235,6 @@ int init_smb2_neg_rsp(struct ksmbd_work *work) + struct smb2_negotiate_rsp *rsp; + struct ksmbd_conn *conn = work->conn; + +- if (conn->need_neg == false) +- return -EINVAL; +- + *(__be32 *)work->response_buf = + cpu_to_be32(conn->vals->header_size); + +diff --git a/fs/ksmbd/smb_common.c b/fs/ksmbd/smb_common.c +index 5ab93fe0..212dfff8 100644 +--- a/fs/ksmbd/smb_common.c ++++ b/fs/ksmbd/smb_common.c +@@ -283,20 +283,121 @@ static int ksmbd_negotiate_smb_dialect(void *buf) + return BAD_PROT_ID; + } + +-int ksmbd_init_smb_server(struct ksmbd_work *work) ++#define SMB_COM_NEGOTIATE_EX 0x0 ++ ++/** ++ * get_smb1_cmd_val() - get smb command value from smb header ++ * @work: smb work containing smb header ++ * ++ * Return: smb command value ++ */ ++static u16 get_smb1_cmd_val(struct ksmbd_work *work) + { +- struct ksmbd_conn *conn = work->conn; ++ return SMB_COM_NEGOTIATE_EX; ++} + +- if (conn->need_neg == false) ++/** ++ * init_smb1_rsp_hdr() - initialize smb negotiate response header ++ * @work: smb work containing smb request ++ * ++ * Return: 0 on success, otherwise -EINVAL ++ */ ++static int init_smb1_rsp_hdr(struct ksmbd_work *work) ++{ ++ struct smb_hdr *rsp_hdr = (struct smb_hdr *)work->response_buf; ++ struct smb_hdr *rcv_hdr = (struct smb_hdr *)work->request_buf; ++ ++ /* ++ * Remove 4 byte direct TCP header. ++ */ ++ *(__be32 *)work->response_buf = ++ cpu_to_be32(sizeof(struct smb_hdr) - 4); ++ ++ rsp_hdr->Command = SMB_COM_NEGOTIATE; ++ *(__le32 *)rsp_hdr->Protocol = SMB1_PROTO_NUMBER; ++ rsp_hdr->Flags = SMBFLG_RESPONSE; ++ rsp_hdr->Flags2 = SMBFLG2_UNICODE | SMBFLG2_ERR_STATUS | ++ SMBFLG2_EXT_SEC | SMBFLG2_IS_LONG_NAME; ++ rsp_hdr->Pid = rcv_hdr->Pid; ++ rsp_hdr->Mid = rcv_hdr->Mid; ++ return 0; ++} ++ ++/** ++ * smb1_check_user_session() - check for valid session for a user ++ * @work: smb work containing smb request buffer ++ * ++ * Return: 0 on success, otherwise error ++ */ ++static int smb1_check_user_session(struct ksmbd_work *work) ++{ ++ unsigned int cmd = work->conn->ops->get_cmd_val(work); ++ ++ if (cmd == SMB_COM_NEGOTIATE_EX) + return 0; + +- init_smb3_11_server(conn); ++ return -EINVAL; ++} ++ ++/** ++ * smb1_allocate_rsp_buf() - allocate response buffer for a command ++ * @work: smb work containing smb request ++ * ++ * Return: 0 on success, otherwise -ENOMEM ++ */ ++static int smb1_allocate_rsp_buf(struct ksmbd_work *work) ++{ ++ work->response_buf = kmalloc(MAX_CIFS_SMALL_BUFFER_SIZE, ++ GFP_KERNEL | __GFP_ZERO); ++ work->response_sz = MAX_CIFS_SMALL_BUFFER_SIZE; ++ ++ if (!work->response_buf) { ++ pr_err("Failed to allocate %u bytes buffer\n", ++ MAX_CIFS_SMALL_BUFFER_SIZE); ++ return -ENOMEM; ++ } + +- if (conn->ops->get_cmd_val(work) != SMB_COM_NEGOTIATE) +- conn->need_neg = false; + return 0; + } + ++static struct smb_version_ops smb1_server_ops = { ++ .get_cmd_val = get_smb1_cmd_val, ++ .init_rsp_hdr = init_smb1_rsp_hdr, ++ .allocate_rsp_buf = smb1_allocate_rsp_buf, ++ .check_user_session = smb1_check_user_session, ++}; ++ ++static int smb1_negotiate(struct ksmbd_work *work) ++{ ++ return ksmbd_smb_negotiate_common(work, SMB_COM_NEGOTIATE); ++} ++ ++static struct smb_version_cmds smb1_server_cmds[1] = { ++ [SMB_COM_NEGOTIATE_EX] = { .proc = smb1_negotiate, }, ++}; ++ ++static void init_smb1_server(struct ksmbd_conn *conn) ++{ ++ conn->ops = &smb1_server_ops; ++ conn->cmds = smb1_server_cmds; ++ conn->max_cmds = ARRAY_SIZE(smb1_server_cmds); ++} ++ ++void ksmbd_init_smb_server(struct ksmbd_work *work) ++{ ++ struct ksmbd_conn *conn = work->conn; ++ __le32 proto; ++ ++ if (conn->need_neg == false) ++ return; ++ ++ proto = *(__le32 *)((struct smb_hdr *)work->request_buf)->Protocol; ++ if (proto == SMB1_PROTO_NUMBER) ++ init_smb1_server(conn); ++ else ++ init_smb3_11_server(conn); ++} ++ + int ksmbd_populate_dot_dotdot_entries(struct ksmbd_work *work, int info_level, + struct ksmbd_file *dir, + struct ksmbd_dir_info *d_info, +@@ -444,20 +545,10 @@ static int smb_handle_negotiate(struct ksmbd_work *work) + + ksmbd_debug(SMB, "Unsupported SMB1 protocol\n"); + +- /* +- * Remove 4 byte direct TCP header, add 2 byte bcc and +- * 2 byte DialectIndex. +- */ +- *(__be32 *)work->response_buf = +- cpu_to_be32(sizeof(struct smb_hdr) - 4 + 2 + 2); ++ /* Add 2 byte bcc and 2 byte DialectIndex. */ ++ inc_rfc1001_len(work->response_buf, 4); + neg_rsp->hdr.Status.CifsError = STATUS_SUCCESS; + +- neg_rsp->hdr.Command = SMB_COM_NEGOTIATE; +- *(__le32 *)neg_rsp->hdr.Protocol = SMB1_PROTO_NUMBER; +- neg_rsp->hdr.Flags = SMBFLG_RESPONSE; +- neg_rsp->hdr.Flags2 = SMBFLG2_UNICODE | SMBFLG2_ERR_STATUS | +- SMBFLG2_EXT_SEC | SMBFLG2_IS_LONG_NAME; +- + neg_rsp->hdr.WordCount = 1; + neg_rsp->DialectIndex = cpu_to_le16(work->conn->dialect); + neg_rsp->ByteCount = 0; +@@ -473,24 +564,13 @@ int ksmbd_smb_negotiate_common(struct ksmbd_work *work, unsigned int command) + ksmbd_negotiate_smb_dialect(work->request_buf); + ksmbd_debug(SMB, "conn->dialect 0x%x\n", conn->dialect); + +- if (command == SMB2_NEGOTIATE_HE) { +- struct smb2_hdr *smb2_hdr = smb2_get_msg(work->request_buf); +- +- if (smb2_hdr->ProtocolId != SMB2_PROTO_NUMBER) { +- ksmbd_debug(SMB, "Downgrade to SMB1 negotiation\n"); +- command = SMB_COM_NEGOTIATE; +- } +- } +- + if (command == SMB2_NEGOTIATE_HE) { + ret = smb2_handle_negotiate(work); +- init_smb2_neg_rsp(work); + return ret; + } + + if (command == SMB_COM_NEGOTIATE) { + if (__smb2_negotiate(conn)) { +- conn->need_neg = true; + init_smb3_11_server(conn); + init_smb2_neg_rsp(work); + ksmbd_debug(SMB, "Upgrade to SMB2 negotiation\n"); +diff --git a/fs/ksmbd/smb_common.h b/fs/ksmbd/smb_common.h +index d30ce4c1..9130d2e3 100644 +--- a/fs/ksmbd/smb_common.h ++++ b/fs/ksmbd/smb_common.h +@@ -427,7 +427,7 @@ bool ksmbd_smb_request(struct ksmbd_conn *conn); + + int ksmbd_lookup_dialect_by_id(__le16 *cli_dialects, __le16 dialects_count); + +-int ksmbd_init_smb_server(struct ksmbd_work *work); ++void ksmbd_init_smb_server(struct ksmbd_work *work); + + struct ksmbd_kstat; + int ksmbd_populate_dot_dotdot_entries(struct ksmbd_work *work, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-095-ALSA-hda-realtek-Add-quirk-for-Clevo-X370SNW.patch b/patches.kernel.org/6.2.11-095-ALSA-hda-realtek-Add-quirk-for-Clevo-X370SNW.patch new file mode 100644 index 0000000..fd76898 --- /dev/null +++ b/patches.kernel.org/6.2.11-095-ALSA-hda-realtek-Add-quirk-for-Clevo-X370SNW.patch @@ -0,0 +1,37 @@ +From: Jeremy Soller +Date: Fri, 31 Mar 2023 10:23:17 -0600 +Subject: [PATCH] ALSA: hda/realtek: Add quirk for Clevo X370SNW +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 36d4d213c6d4fffae2645a601e8ae996de4c3645 + +commit 36d4d213c6d4fffae2645a601e8ae996de4c3645 upstream. + +Fixes speaker output and headset detection on Clevo X370SNW. + +Signed-off-by: Jeremy Soller +Signed-off-by: Tim Crawford +Cc: +Link: https://lore.kernel.org/r/20230331162317.14992-1-tcrawford@system76.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 070150bb..cd0f8097 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2624,6 +2624,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { + SND_PCI_QUIRK(0x1462, 0xda57, "MSI Z270-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS), + SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3), + SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX), ++ SND_PCI_QUIRK(0x1558, 0x3702, "Clevo X370SN[VW]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x50d3, "Clevo PC50[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x65d1, "Clevo PB51[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x65d2, "Clevo PB51R[CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-096-ALSA-hda-realtek-fix-mute-micmute-LEDs-for-a-H.patch b/patches.kernel.org/6.2.11-096-ALSA-hda-realtek-fix-mute-micmute-LEDs-for-a-H.patch new file mode 100644 index 0000000..7227024 --- /dev/null +++ b/patches.kernel.org/6.2.11-096-ALSA-hda-realtek-fix-mute-micmute-LEDs-for-a-H.patch @@ -0,0 +1,38 @@ +From: Andy Chi +Date: Fri, 31 Mar 2023 16:32:41 +0800 +Subject: [PATCH] ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 9fdc1605c504204e0fdec7892b29c916579e06f3 + +commit 9fdc1605c504204e0fdec7892b29c916579e06f3 upstream. + +There is a HP ProBook which using ALC236 codec and need the +ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF quirk to make mute LED and +micmute LED work. + +Signed-off-by: Andy Chi +Cc: +Link: https://lore.kernel.org/r/20230331083242.58416-1-andy.chi@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index cd0f8097..50b8573b 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9443,6 +9443,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8b47, "HP", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8b5d, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), + SND_PCI_QUIRK(0x103c, 0x8b5e, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), ++ SND_PCI_QUIRK(0x103c, 0x8b66, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), + SND_PCI_QUIRK(0x103c, 0x8b7a, "HP", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8b7d, "HP", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8b87, "HP", ALC236_FIXUP_HP_GPIO_LED), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-097-x86-acpi-boot-Correct-acpi_is_processor_usable.patch b/patches.kernel.org/6.2.11-097-x86-acpi-boot-Correct-acpi_is_processor_usable.patch new file mode 100644 index 0000000..50d1811 --- /dev/null +++ b/patches.kernel.org/6.2.11-097-x86-acpi-boot-Correct-acpi_is_processor_usable.patch @@ -0,0 +1,51 @@ +From: Eric DeVolder +Date: Mon, 27 Mar 2023 15:10:26 -0400 +Subject: [PATCH] x86/acpi/boot: Correct acpi_is_processor_usable() check +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: fed8d8773b8ea68ad99d9eee8c8343bef9da2c2c + +commit fed8d8773b8ea68ad99d9eee8c8343bef9da2c2c upstream. + +The logic in acpi_is_processor_usable() requires the online capable +bit be set for hotpluggable CPUs. The online capable bit has been +introduced in ACPI 6.3. + +However, for ACPI revisions < 6.3 which do not support that bit, CPUs +should be reported as usable, not the other way around. + +Reverse the check. + + [ bp: Rewrite commit message. ] + +Fixes: e2869bd7af60 ("x86/acpi/boot: Do not register processors that cannot be onlined for x2APIC") +Suggested-by: Miguel Luis +Suggested-by: Boris Ostrovsky +Signed-off-by: Eric DeVolder +Signed-off-by: Borislav Petkov (AMD) +Tested-by: David R +Cc: +Link: https://lore.kernel.org/r/20230327191026.3454-2-eric.devolder@oracle.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kernel/acpi/boot.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c +index 518bda50..ee45e0e3 100644 +--- a/arch/x86/kernel/acpi/boot.c ++++ b/arch/x86/kernel/acpi/boot.c +@@ -193,7 +193,8 @@ static bool __init acpi_is_processor_usable(u32 lapic_flags) + if (lapic_flags & ACPI_MADT_ENABLED) + return true; + +- if (acpi_support_online_capable && (lapic_flags & ACPI_MADT_ONLINE_CAPABLE)) ++ if (!acpi_support_online_capable || ++ (lapic_flags & ACPI_MADT_ONLINE_CAPABLE)) + return true; + + return false; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-098-x86-ACPI-boot-Use-FADT-version-to-check-suppor.patch b/patches.kernel.org/6.2.11-098-x86-ACPI-boot-Use-FADT-version-to-check-suppor.patch new file mode 100644 index 0000000..dbc7b54 --- /dev/null +++ b/patches.kernel.org/6.2.11-098-x86-ACPI-boot-Use-FADT-version-to-check-suppor.patch @@ -0,0 +1,56 @@ +From: Mario Limonciello +Date: Wed, 29 Mar 2023 12:45:35 -0500 +Subject: [PATCH] x86/ACPI/boot: Use FADT version to check support for online + capable +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: a74fabfbd1b7013045afc8cc541e6cab3360ccb5 + +commit a74fabfbd1b7013045afc8cc541e6cab3360ccb5 upstream. + +ACPI 6.3 introduced the online capable bit, and also introduced MADT +version 5. + +Latter was used to distinguish whether the offset storing online capable +could be used. However ACPI 6.2b has MADT version "45" which is for +an errata version of the ACPI 6.2 spec. This means that the Linux code +for detecting availability of MADT will mistakenly flag ACPI 6.2b as +supporting online capable which is inaccurate as it's an ACPI 6.3 feature. + +Instead use the FADT major and minor revision fields to distinguish this. + + [ bp: Massage. ] + +Fixes: aa06e20f1be6 ("x86/ACPI: Don't add CPUs that are not online capable") +Reported-by: Eric DeVolder +Reported-by: Borislav Petkov +Signed-off-by: Mario Limonciello +Signed-off-by: Borislav Petkov (AMD) +Cc: +Link: https://lore.kernel.org/r/943d2445-84df-d939-f578-5d8240d342cc@unsolicited.net +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kernel/acpi/boot.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c +index ee45e0e3..0f762070 100644 +--- a/arch/x86/kernel/acpi/boot.c ++++ b/arch/x86/kernel/acpi/boot.c +@@ -146,7 +146,11 @@ static int __init acpi_parse_madt(struct acpi_table_header *table) + + pr_debug("Local APIC address 0x%08x\n", madt->address); + } +- if (madt->header.revision >= 5) ++ ++ /* ACPI 6.3 and newer support the online capable bit. */ ++ if (acpi_gbl_FADT.header.revision > 6 || ++ (acpi_gbl_FADT.header.revision == 6 && ++ acpi_gbl_FADT.minor_revision >= 3)) + acpi_support_online_capable = true; + + default_acpi_madt_oem_check(madt->header.oem_id, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-099-KVM-x86-Clear-has_error_code-not-error_code-fo.patch b/patches.kernel.org/6.2.11-099-KVM-x86-Clear-has_error_code-not-error_code-fo.patch new file mode 100644 index 0000000..f31f5a8 --- /dev/null +++ b/patches.kernel.org/6.2.11-099-KVM-x86-Clear-has_error_code-not-error_code-fo.patch @@ -0,0 +1,61 @@ +From: Sean Christopherson +Date: Wed, 22 Mar 2023 07:32:59 -0700 +Subject: [PATCH] KVM: x86: Clear "has_error_code", not "error_code", for RM + exception injection +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 6c41468c7c12d74843bb414fc00307ea8a6318c3 + +commit 6c41468c7c12d74843bb414fc00307ea8a6318c3 upstream. + +When injecting an exception into a vCPU in Real Mode, suppress the error +code by clearing the flag that tracks whether the error code is valid, not +by clearing the error code itself. The "typo" was introduced by recent +fix for SVM's funky Paged Real Mode. + +Opportunistically hoist the logic above the tracepoint so that the trace +is coherent with respect to what is actually injected (this was also the +behavior prior to the buggy commit). + +Fixes: b97f07458373 ("KVM: x86: determine if an exception has an error code only when injecting it.") +Cc: stable@vger.kernel.org +Cc: Maxim Levitsky +Signed-off-by: Sean Christopherson +Message-Id: <20230322143300.2209476-2-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kvm/x86.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 0ec7a0cb..2d76c254 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -9795,13 +9795,20 @@ int kvm_check_nested_events(struct kvm_vcpu *vcpu) + + static void kvm_inject_exception(struct kvm_vcpu *vcpu) + { ++ /* ++ * Suppress the error code if the vCPU is in Real Mode, as Real Mode ++ * exceptions don't report error codes. The presence of an error code ++ * is carried with the exception and only stripped when the exception ++ * is injected as intercepted #PF VM-Exits for AMD's Paged Real Mode do ++ * report an error code despite the CPU being in Real Mode. ++ */ ++ vcpu->arch.exception.has_error_code &= is_protmode(vcpu); ++ + trace_kvm_inj_exception(vcpu->arch.exception.vector, + vcpu->arch.exception.has_error_code, + vcpu->arch.exception.error_code, + vcpu->arch.exception.injected); + +- if (vcpu->arch.exception.error_code && !is_protmode(vcpu)) +- vcpu->arch.exception.error_code = false; + static_call(kvm_x86_inject_exception)(vcpu); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-100-KVM-nVMX-Do-not-report-error-code-when-synthes.patch b/patches.kernel.org/6.2.11-100-KVM-nVMX-Do-not-report-error-code-when-synthes.patch new file mode 100644 index 0000000..49574a8 --- /dev/null +++ b/patches.kernel.org/6.2.11-100-KVM-nVMX-Do-not-report-error-code-when-synthes.patch @@ -0,0 +1,54 @@ +From: Sean Christopherson +Date: Wed, 22 Mar 2023 07:33:00 -0700 +Subject: [PATCH] KVM: nVMX: Do not report error code when synthesizing VM-Exit + from Real Mode +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 80962ec912db56d323883154efc2297473e692cb + +commit 80962ec912db56d323883154efc2297473e692cb upstream. + +Don't report an error code to L1 when synthesizing a nested VM-Exit and +L2 is in Real Mode. Per Intel's SDM, regarding the error code valid bit: + + This bit is always 0 if the VM exit occurred while the logical processor + was in real-address mode (CR0.PE=0). + +The bug was introduced by a recent fix for AMD's Paged Real Mode, which +moved the error code suppression from the common "queue exception" path +to the "inject exception" path, but missed VMX's "synthesize VM-Exit" +path. + +Fixes: b97f07458373 ("KVM: x86: determine if an exception has an error code only when injecting it.") +Cc: stable@vger.kernel.org +Cc: Maxim Levitsky +Signed-off-by: Sean Christopherson +Message-Id: <20230322143300.2209476-3-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kvm/vmx/nested.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c +index bceb5ad4..b7f2e59d 100644 +--- a/arch/x86/kvm/vmx/nested.c ++++ b/arch/x86/kvm/vmx/nested.c +@@ -3873,7 +3873,12 @@ static void nested_vmx_inject_exception_vmexit(struct kvm_vcpu *vcpu) + exit_qual = 0; + } + +- if (ex->has_error_code) { ++ /* ++ * Unlike AMD's Paged Real Mode, which reports an error code on #PF ++ * VM-Exits even if the CPU is in Real Mode, Intel VMX never sets the ++ * "has error code" flags on VM-Exit if the CPU is in Real Mode. ++ */ ++ if (ex->has_error_code && is_protmode(vcpu)) { + /* + * Intel CPUs do not generate error codes with bits 31:16 set, + * and more importantly VMX disallows setting bits 31:16 in the +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-101-KVM-SVM-Flush-Hyper-V-TLB-when-required.patch b/patches.kernel.org/6.2.11-101-KVM-SVM-Flush-Hyper-V-TLB-when-required.patch new file mode 100644 index 0000000..2b128bc --- /dev/null +++ b/patches.kernel.org/6.2.11-101-KVM-SVM-Flush-Hyper-V-TLB-when-required.patch @@ -0,0 +1,168 @@ +From: Jeremi Piotrowski +Date: Fri, 24 Mar 2023 15:52:33 +0100 +Subject: [PATCH] KVM: SVM: Flush Hyper-V TLB when required +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: e5c972c1fadacc858b6a564d056f177275238040 + +commit e5c972c1fadacc858b6a564d056f177275238040 upstream. + +The Hyper-V "EnlightenedNptTlb" enlightenment is always enabled when KVM +is running on top of Hyper-V and Hyper-V exposes support for it (which +is always). On AMD CPUs this enlightenment results in ASID invalidations +not flushing TLB entries derived from the NPT. To force the underlying +(L0) hypervisor to rebuild its shadow page tables, an explicit hypercall +is needed. + +The original KVM implementation of Hyper-V's "EnlightenedNptTlb" on SVM +only added remote TLB flush hooks. This worked out fine for a while, as +sufficient remote TLB flushes where being issued in KVM to mask the +problem. Since v5.17, changes in the TDP code reduced the number of +flushes and the out-of-sync TLB prevents guests from booting +successfully. + +Split svm_flush_tlb_current() into separate callbacks for the 3 cases +(guest/all/current), and issue the required Hyper-V hypercall when a +Hyper-V TLB flush is needed. The most important case where the TLB flush +was missing is when loading a new PGD, which is followed by what is now +svm_flush_tlb_current(). + +Cc: stable@vger.kernel.org # v5.17+ +Fixes: 1e0c7d40758b ("KVM: SVM: hyper-v: Remote TLB flush for SVM") +Link: https://lore.kernel.org/lkml/43980946-7bbf-dcef-7e40-af904c456250@linux.microsoft.com/ +Suggested-by: Sean Christopherson +Signed-off-by: Jeremi Piotrowski +Reviewed-by: Vitaly Kuznetsov +Message-Id: <20230324145233.4585-1-jpiotrowski@linux.microsoft.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kvm/kvm_onhyperv.h | 5 +++++ + arch/x86/kvm/svm/svm.c | 37 ++++++++++++++++++++++++++++++--- + arch/x86/kvm/svm/svm_onhyperv.h | 15 +++++++++++++ + 3 files changed, 54 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kvm/kvm_onhyperv.h b/arch/x86/kvm/kvm_onhyperv.h +index 287e98ef..6272dabe 100644 +--- a/arch/x86/kvm/kvm_onhyperv.h ++++ b/arch/x86/kvm/kvm_onhyperv.h +@@ -12,6 +12,11 @@ int hv_remote_flush_tlb_with_range(struct kvm *kvm, + int hv_remote_flush_tlb(struct kvm *kvm); + void hv_track_root_tdp(struct kvm_vcpu *vcpu, hpa_t root_tdp); + #else /* !CONFIG_HYPERV */ ++static inline int hv_remote_flush_tlb(struct kvm *kvm) ++{ ++ return -EOPNOTSUPP; ++} ++ + static inline void hv_track_root_tdp(struct kvm_vcpu *vcpu, hpa_t root_tdp) + { + } +diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c +index f03bdaf7..a682ca4c 100644 +--- a/arch/x86/kvm/svm/svm.c ++++ b/arch/x86/kvm/svm/svm.c +@@ -3718,7 +3718,7 @@ static void svm_enable_nmi_window(struct kvm_vcpu *vcpu) + svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF); + } + +-static void svm_flush_tlb_current(struct kvm_vcpu *vcpu) ++static void svm_flush_tlb_asid(struct kvm_vcpu *vcpu) + { + struct vcpu_svm *svm = to_svm(vcpu); + +@@ -3742,6 +3742,37 @@ static void svm_flush_tlb_current(struct kvm_vcpu *vcpu) + svm->current_vmcb->asid_generation--; + } + ++static void svm_flush_tlb_current(struct kvm_vcpu *vcpu) ++{ ++ hpa_t root_tdp = vcpu->arch.mmu->root.hpa; ++ ++ /* ++ * When running on Hyper-V with EnlightenedNptTlb enabled, explicitly ++ * flush the NPT mappings via hypercall as flushing the ASID only ++ * affects virtual to physical mappings, it does not invalidate guest ++ * physical to host physical mappings. ++ */ ++ if (svm_hv_is_enlightened_tlb_enabled(vcpu) && VALID_PAGE(root_tdp)) ++ hyperv_flush_guest_mapping(root_tdp); ++ ++ svm_flush_tlb_asid(vcpu); ++} ++ ++static void svm_flush_tlb_all(struct kvm_vcpu *vcpu) ++{ ++ /* ++ * When running on Hyper-V with EnlightenedNptTlb enabled, remote TLB ++ * flushes should be routed to hv_remote_flush_tlb() without requesting ++ * a "regular" remote flush. Reaching this point means either there's ++ * a KVM bug or a prior hv_remote_flush_tlb() call failed, both of ++ * which might be fatal to the guest. Yell, but try to recover. ++ */ ++ if (WARN_ON_ONCE(svm_hv_is_enlightened_tlb_enabled(vcpu))) ++ hv_remote_flush_tlb(vcpu->kvm); ++ ++ svm_flush_tlb_asid(vcpu); ++} ++ + static void svm_flush_tlb_gva(struct kvm_vcpu *vcpu, gva_t gva) + { + struct vcpu_svm *svm = to_svm(vcpu); +@@ -4747,10 +4778,10 @@ static struct kvm_x86_ops svm_x86_ops __initdata = { + .set_rflags = svm_set_rflags, + .get_if_flag = svm_get_if_flag, + +- .flush_tlb_all = svm_flush_tlb_current, ++ .flush_tlb_all = svm_flush_tlb_all, + .flush_tlb_current = svm_flush_tlb_current, + .flush_tlb_gva = svm_flush_tlb_gva, +- .flush_tlb_guest = svm_flush_tlb_current, ++ .flush_tlb_guest = svm_flush_tlb_asid, + + .vcpu_pre_run = svm_vcpu_pre_run, + .vcpu_run = svm_vcpu_run, +diff --git a/arch/x86/kvm/svm/svm_onhyperv.h b/arch/x86/kvm/svm/svm_onhyperv.h +index 65c355b4..345b87ac 100644 +--- a/arch/x86/kvm/svm/svm_onhyperv.h ++++ b/arch/x86/kvm/svm/svm_onhyperv.h +@@ -6,6 +6,8 @@ + #ifndef __ARCH_X86_KVM_SVM_ONHYPERV_H__ + #define __ARCH_X86_KVM_SVM_ONHYPERV_H__ + ++#include ++ + #if IS_ENABLED(CONFIG_HYPERV) + + #include "kvm_onhyperv.h" +@@ -15,6 +17,14 @@ static struct kvm_x86_ops svm_x86_ops; + + int svm_hv_enable_l2_tlb_flush(struct kvm_vcpu *vcpu); + ++static inline bool svm_hv_is_enlightened_tlb_enabled(struct kvm_vcpu *vcpu) ++{ ++ struct hv_vmcb_enlightenments *hve = &to_svm(vcpu)->vmcb->control.hv_enlightenments; ++ ++ return ms_hyperv.nested_features & HV_X64_NESTED_ENLIGHTENED_TLB && ++ !!hve->hv_enlightenments_control.enlightened_npt_tlb; ++} ++ + static inline void svm_hv_init_vmcb(struct vmcb *vmcb) + { + struct hv_vmcb_enlightenments *hve = &vmcb->control.hv_enlightenments; +@@ -80,6 +90,11 @@ static inline void svm_hv_update_vp_id(struct vmcb *vmcb, struct kvm_vcpu *vcpu) + } + #else + ++static inline bool svm_hv_is_enlightened_tlb_enabled(struct kvm_vcpu *vcpu) ++{ ++ return false; ++} ++ + static inline void svm_hv_init_vmcb(struct vmcb *vmcb) + { + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-102-mm-kfence-fix-PG_slab-and-memcg_data-clearing.patch b/patches.kernel.org/6.2.11-102-mm-kfence-fix-PG_slab-and-memcg_data-clearing.patch new file mode 100644 index 0000000..d3b6d1b --- /dev/null +++ b/patches.kernel.org/6.2.11-102-mm-kfence-fix-PG_slab-and-memcg_data-clearing.patch @@ -0,0 +1,95 @@ +From: Muchun Song +Date: Mon, 20 Mar 2023 11:00:59 +0800 +Subject: [PATCH] mm: kfence: fix PG_slab and memcg_data clearing +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 3ee2d7471fa4963a2ced0a84f0653ce88b43c5b2 + +commit 3ee2d7471fa4963a2ced0a84f0653ce88b43c5b2 upstream. + +It does not reset PG_slab and memcg_data when KFENCE fails to initialize +kfence pool at runtime. It is reporting a "Bad page state" message when +kfence pool is freed to buddy. The checking of whether it is a compound +head page seems unnecessary since we already guarantee this when +allocating kfence pool. Remove the check to simplify the code. + +Link: https://lkml.kernel.org/r/20230320030059.20189-1-songmuchun@bytedance.com +Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure") +Signed-off-by: Muchun Song +Cc: Alexander Potapenko +Cc: Dmitry Vyukov +Cc: Jann Horn +Cc: Marco Elver +Cc: Roman Gushchin +Cc: SeongJae Park +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + mm/kfence/core.c | 30 +++++++++++++++--------------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +diff --git a/mm/kfence/core.c b/mm/kfence/core.c +index 79c94ee5..d66092dd 100644 +--- a/mm/kfence/core.c ++++ b/mm/kfence/core.c +@@ -561,10 +561,6 @@ static unsigned long kfence_init_pool(void) + if (!i || (i % 2)) + continue; + +- /* Verify we do not have a compound head page. */ +- if (WARN_ON(compound_head(&pages[i]) != &pages[i])) +- return addr; +- + __folio_set_slab(slab_folio(slab)); + #ifdef CONFIG_MEMCG + slab->memcg_data = (unsigned long)&kfence_metadata[i / 2 - 1].objcg | +@@ -597,12 +593,26 @@ static unsigned long kfence_init_pool(void) + + /* Protect the right redzone. */ + if (unlikely(!kfence_protect(addr + PAGE_SIZE))) +- return addr; ++ goto reset_slab; + + addr += 2 * PAGE_SIZE; + } + + return 0; ++ ++reset_slab: ++ for (i = 0; i < KFENCE_POOL_SIZE / PAGE_SIZE; i++) { ++ struct slab *slab = page_slab(&pages[i]); ++ ++ if (!i || (i % 2)) ++ continue; ++#ifdef CONFIG_MEMCG ++ slab->memcg_data = 0; ++#endif ++ __folio_clear_slab(slab_folio(slab)); ++ } ++ ++ return addr; + } + + static bool __init kfence_init_pool_early(void) +@@ -632,16 +642,6 @@ static bool __init kfence_init_pool_early(void) + * fails for the first page, and therefore expect addr==__kfence_pool in + * most failure cases. + */ +- for (char *p = (char *)addr; p < __kfence_pool + KFENCE_POOL_SIZE; p += PAGE_SIZE) { +- struct slab *slab = virt_to_slab(p); +- +- if (!slab) +- continue; +-#ifdef CONFIG_MEMCG +- slab->memcg_data = 0; +-#endif +- __folio_clear_slab(slab_folio(slab)); +- } + memblock_free_late(__pa(addr), KFENCE_POOL_SIZE - (addr - (unsigned long)__kfence_pool)); + __kfence_pool = NULL; + return false; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-103-mm-kfence-fix-handling-discontiguous-page.patch b/patches.kernel.org/6.2.11-103-mm-kfence-fix-handling-discontiguous-page.patch new file mode 100644 index 0000000..840d87a --- /dev/null +++ b/patches.kernel.org/6.2.11-103-mm-kfence-fix-handling-discontiguous-page.patch @@ -0,0 +1,61 @@ +From: Muchun Song +Date: Thu, 23 Mar 2023 10:50:03 +0800 +Subject: [PATCH] mm: kfence: fix handling discontiguous page +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 1f2803b2660f4b04d48d065072c0ae0c9ca255fd + +commit 1f2803b2660f4b04d48d065072c0ae0c9ca255fd upstream. + +The struct pages could be discontiguous when the kfence pool is allocated +via alloc_contig_pages() with CONFIG_SPARSEMEM and +!CONFIG_SPARSEMEM_VMEMMAP. + +This may result in setting PG_slab and memcg_data to a arbitrary +address (may be not used as a struct page), which in the worst case +might corrupt the kernel. + +So the iteration should use nth_page(). + +Link: https://lkml.kernel.org/r/20230323025003.94447-1-songmuchun@bytedance.com +Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure") +Signed-off-by: Muchun Song +Reviewed-by: Marco Elver +Reviewed-by: Kefeng Wang +Cc: Alexander Potapenko +Cc: Dmitry Vyukov +Cc: Jann Horn +Cc: SeongJae Park +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + mm/kfence/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/mm/kfence/core.c b/mm/kfence/core.c +index d66092dd..1065e056 100644 +--- a/mm/kfence/core.c ++++ b/mm/kfence/core.c +@@ -556,7 +556,7 @@ static unsigned long kfence_init_pool(void) + * enters __slab_free() slow-path. + */ + for (i = 0; i < KFENCE_POOL_SIZE / PAGE_SIZE; i++) { +- struct slab *slab = page_slab(&pages[i]); ++ struct slab *slab = page_slab(nth_page(pages, i)); + + if (!i || (i % 2)) + continue; +@@ -602,7 +602,7 @@ static unsigned long kfence_init_pool(void) + + reset_slab: + for (i = 0; i < KFENCE_POOL_SIZE / PAGE_SIZE; i++) { +- struct slab *slab = page_slab(&pages[i]); ++ struct slab *slab = page_slab(nth_page(pages, i)); + + if (!i || (i % 2)) + continue; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-104-coresight-etm4x-Do-not-access-TRCIDR1-for-iden.patch b/patches.kernel.org/6.2.11-104-coresight-etm4x-Do-not-access-TRCIDR1-for-iden.patch new file mode 100644 index 0000000..a88f887 --- /dev/null +++ b/patches.kernel.org/6.2.11-104-coresight-etm4x-Do-not-access-TRCIDR1-for-iden.patch @@ -0,0 +1,121 @@ +From: Suzuki K Poulose +Date: Tue, 21 Mar 2023 10:45:30 +0000 +Subject: [PATCH] coresight: etm4x: Do not access TRCIDR1 for identification +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 735e7b30a53a1679c050cddb73f5e5316105d2e3 + +commit 735e7b30a53a1679c050cddb73f5e5316105d2e3 upstream. + +CoreSight ETM4x architecture clearly provides ways to identify a device +via registers in the "Management" class, TRCDEVARCH and TRCDEVTYPE. These +registers can be accessed without the Trace domain being powered on. +We additionally added TRCIDR1 as fallback in order to cover for any +ETMs that may not have implemented TRCDEVARCH. So far, nobody has +reported hitting a WARNING we placed to catch such systems. + +Also, more importantly it is problematic to access TRCIDR1, which is a +"Trace" register via MMIO access, without clearing the OSLK. But we cannot +mess with the OSLK until we know for sure that this is an ETMv4 device. +Thus, this kind of creates a chicken and egg problem unnecessarily for +systems "which are compliant" to the ETMv4 architecture. + +Let us remove the TRCIDR1 fall back check and rely only on TRCDEVARCH. + +Fixes: 8b94db1edaee ("coresight: etm4x: Use TRCDEVARCH for component discovery") +Cc: stable@vger.kernel.org +Reported-by: Steve Clevenger +Link: https://lore.kernel.org/all/143540e5623d4c7393d24833f2b80600d8d745d2.1677881753.git.scclevenger@os.amperecomputing.com/ +Cc: Mike Leach +Cc: James Clark +Reviewed-by: Mike Leach +Reviewed-by: Anshuman Khandual +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20230321104530.1547136-1-suzuki.poulose@arm.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + .../coresight/coresight-etm4x-core.c | 22 ++++++++----------- + drivers/hwtracing/coresight/coresight-etm4x.h | 20 +++++------------ + 2 files changed, 15 insertions(+), 27 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index 77bca693..d6e2f5b9 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -1013,25 +1013,21 @@ static bool etm4_init_iomem_access(struct etmv4_drvdata *drvdata, + struct csdev_access *csa) + { + u32 devarch = readl_relaxed(drvdata->base + TRCDEVARCH); +- u32 idr1 = readl_relaxed(drvdata->base + TRCIDR1); + + /* + * All ETMs must implement TRCDEVARCH to indicate that +- * the component is an ETMv4. To support any broken +- * implementations we fall back to TRCIDR1 check, which +- * is not really reliable. ++ * the component is an ETMv4. Even though TRCIDR1 also ++ * contains the information, it is part of the "Trace" ++ * register and must be accessed with the OSLK cleared, ++ * with MMIO. But we cannot touch the OSLK until we are ++ * sure this is an ETM. So rely only on the TRCDEVARCH. + */ +- if ((devarch & ETM_DEVARCH_ID_MASK) == ETM_DEVARCH_ETMv4x_ARCH) { +- drvdata->arch = etm_devarch_to_arch(devarch); +- } else { +- pr_warn("CPU%d: ETM4x incompatible TRCDEVARCH: %x, falling back to TRCIDR1\n", +- smp_processor_id(), devarch); +- +- if (ETM_TRCIDR1_ARCH_MAJOR(idr1) != ETM_TRCIDR1_ARCH_ETMv4) +- return false; +- drvdata->arch = etm_trcidr_to_arch(idr1); ++ if ((devarch & ETM_DEVARCH_ID_MASK) != ETM_DEVARCH_ETMv4x_ARCH) { ++ pr_warn_once("TRCDEVARCH doesn't match ETMv4 architecture\n"); ++ return false; + } + ++ drvdata->arch = etm_devarch_to_arch(devarch); + *csa = CSDEV_ACCESS_IOMEM(drvdata->base); + return true; + } +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h +index 4b21bb79..0174fbf1 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.h ++++ b/drivers/hwtracing/coresight/coresight-etm4x.h +@@ -753,14 +753,12 @@ + * TRCDEVARCH - CoreSight architected register + * - Bits[15:12] - Major version + * - Bits[19:16] - Minor version +- * TRCIDR1 - ETM architected register +- * - Bits[11:8] - Major version +- * - Bits[7:4] - Minor version +- * We must rely on TRCDEVARCH for the version information, +- * however we don't want to break the support for potential +- * old implementations which might not implement it. Thus +- * we fall back to TRCIDR1 if TRCDEVARCH is not implemented +- * for memory mapped components. ++ * ++ * We must rely only on TRCDEVARCH for the version information. Even though, ++ * TRCIDR1 also provides the architecture version, it is a "Trace" register ++ * and as such must be accessed only with Trace power domain ON. This may ++ * not be available at probe time. ++ * + * Now to make certain decisions easier based on the version + * we use an internal representation of the version in the + * driver, as follows : +@@ -786,12 +784,6 @@ static inline u8 etm_devarch_to_arch(u32 devarch) + ETM_DEVARCH_REVISION(devarch)); + } + +-static inline u8 etm_trcidr_to_arch(u32 trcidr1) +-{ +- return ETM_ARCH_VERSION(ETM_TRCIDR1_ARCH_MAJOR(trcidr1), +- ETM_TRCIDR1_ARCH_MINOR(trcidr1)); +-} +- + enum etm_impdef_type { + ETM4_IMPDEF_HISI_CORE_COMMIT, + ETM4_IMPDEF_FEATURE_MAX, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-105-coresight-etm4-Fix-for-loop-drvdata-nr_addr_cm.patch b/patches.kernel.org/6.2.11-105-coresight-etm4-Fix-for-loop-drvdata-nr_addr_cm.patch new file mode 100644 index 0000000..54e476d --- /dev/null +++ b/patches.kernel.org/6.2.11-105-coresight-etm4-Fix-for-loop-drvdata-nr_addr_cm.patch @@ -0,0 +1,39 @@ +From: Steve Clevenger +Date: Mon, 27 Feb 2023 16:54:32 -0700 +Subject: [PATCH] coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: bf84937e882009075f57fd213836256fc65d96bc + +commit bf84937e882009075f57fd213836256fc65d96bc upstream. + +In etm4_enable_hw, fix for() loop range to represent address comparator pairs. + +Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver") +Cc: stable@vger.kernel.org +Signed-off-by: Steve Clevenger +Reviewed-by: James Clark +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/4a4ee61ce8ef402615a4528b21a051de3444fb7b.1677540079.git.scclevenger@os.amperecomputing.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/hwtracing/coresight/coresight-etm4x-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index d6e2f5b9..a65b4101 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -454,7 +454,7 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata) + if (etm4x_sspcicrn_present(drvdata, i)) + etm4x_relaxed_write32(csa, config->ss_pe_cmp[i], TRCSSPCICRn(i)); + } +- for (i = 0; i < drvdata->nr_addr_cmp; i++) { ++ for (i = 0; i < drvdata->nr_addr_cmp * 2; i++) { + etm4x_relaxed_write64(csa, config->addr_val[i], TRCACVRn(i)); + etm4x_relaxed_write64(csa, config->addr_acc[i], TRCACATRn(i)); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-106-counter-104-quad-8-Fix-race-condition-between-.patch b/patches.kernel.org/6.2.11-106-counter-104-quad-8-Fix-race-condition-between-.patch new file mode 100644 index 0000000..7a18bb1 --- /dev/null +++ b/patches.kernel.org/6.2.11-106-counter-104-quad-8-Fix-race-condition-between-.patch @@ -0,0 +1,121 @@ +From: William Breathitt Gray +Date: Sun, 12 Mar 2023 19:15:49 -0400 +Subject: [PATCH] counter: 104-quad-8: Fix race condition between FLAG and CNTR + reads +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 4aa3b75c74603c3374877d5fd18ad9cc3a9a62ed + +commit 4aa3b75c74603c3374877d5fd18ad9cc3a9a62ed upstream. + +The Counter (CNTR) register is 24 bits wide, but we can have an +effective 25-bit count value by setting bit 24 to the XOR of the Borrow +flag and Carry flag. The flags can be read from the FLAG register, but a +race condition exists: the Borrow flag and Carry flag are instantaneous +and could change by the time the count value is read from the CNTR +register. + +Since the race condition could result in an incorrect 25-bit count +value, remove support for 25-bit count values from this driver; +hard-coded maximum count values are replaced by a LS7267_CNTR_MAX define +for consistency and clarity. + +Fixes: 28e5d3bb0325 ("iio: 104-quad-8: Add IIO support for the ACCES 104-QUAD-8") +Cc: # 6.1.x +Cc: # 6.2.x +Link: https://lore.kernel.org/r/20230312231554.134858-1-william.gray@linaro.org/ +Signed-off-by: William Breathitt Gray +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/counter/104-quad-8.c | 29 ++++++++--------------------- + 1 file changed, 8 insertions(+), 21 deletions(-) + +diff --git a/drivers/counter/104-quad-8.c b/drivers/counter/104-quad-8.c +index deed4afa..d59e4f34 100644 +--- a/drivers/counter/104-quad-8.c ++++ b/drivers/counter/104-quad-8.c +@@ -97,10 +97,6 @@ struct quad8 { + struct quad8_reg __iomem *reg; + }; + +-/* Borrow Toggle flip-flop */ +-#define QUAD8_FLAG_BT BIT(0) +-/* Carry Toggle flip-flop */ +-#define QUAD8_FLAG_CT BIT(1) + /* Error flag */ + #define QUAD8_FLAG_E BIT(4) + /* Up/Down flag */ +@@ -133,6 +129,9 @@ struct quad8 { + #define QUAD8_CMR_QUADRATURE_X2 0x10 + #define QUAD8_CMR_QUADRATURE_X4 0x18 + ++/* Each Counter is 24 bits wide */ ++#define LS7267_CNTR_MAX GENMASK(23, 0) ++ + static int quad8_signal_read(struct counter_device *counter, + struct counter_signal *signal, + enum counter_signal_level *level) +@@ -156,18 +155,10 @@ static int quad8_count_read(struct counter_device *counter, + { + struct quad8 *const priv = counter_priv(counter); + struct channel_reg __iomem *const chan = priv->reg->channel + count->id; +- unsigned int flags; +- unsigned int borrow; +- unsigned int carry; + unsigned long irqflags; + int i; + +- flags = ioread8(&chan->control); +- borrow = flags & QUAD8_FLAG_BT; +- carry = !!(flags & QUAD8_FLAG_CT); +- +- /* Borrow XOR Carry effectively doubles count range */ +- *val = (unsigned long)(borrow ^ carry) << 24; ++ *val = 0; + + spin_lock_irqsave(&priv->lock, irqflags); + +@@ -191,8 +182,7 @@ static int quad8_count_write(struct counter_device *counter, + unsigned long irqflags; + int i; + +- /* Only 24-bit values are supported */ +- if (val > 0xFFFFFF) ++ if (val > LS7267_CNTR_MAX) + return -ERANGE; + + spin_lock_irqsave(&priv->lock, irqflags); +@@ -806,8 +796,7 @@ static int quad8_count_preset_write(struct counter_device *counter, + struct quad8 *const priv = counter_priv(counter); + unsigned long irqflags; + +- /* Only 24-bit values are supported */ +- if (preset > 0xFFFFFF) ++ if (preset > LS7267_CNTR_MAX) + return -ERANGE; + + spin_lock_irqsave(&priv->lock, irqflags); +@@ -834,8 +823,7 @@ static int quad8_count_ceiling_read(struct counter_device *counter, + *ceiling = priv->preset[count->id]; + break; + default: +- /* By default 0x1FFFFFF (25 bits unsigned) is maximum count */ +- *ceiling = 0x1FFFFFF; ++ *ceiling = LS7267_CNTR_MAX; + break; + } + +@@ -850,8 +838,7 @@ static int quad8_count_ceiling_write(struct counter_device *counter, + struct quad8 *const priv = counter_priv(counter); + unsigned long irqflags; + +- /* Only 24-bit values are supported */ +- if (ceiling > 0xFFFFFF) ++ if (ceiling > LS7267_CNTR_MAX) + return -ERANGE; + + spin_lock_irqsave(&priv->lock, irqflags); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-107-counter-104-quad-8-Fix-Synapse-action-reported.patch b/patches.kernel.org/6.2.11-107-counter-104-quad-8-Fix-Synapse-action-reported.patch new file mode 100644 index 0000000..123d078 --- /dev/null +++ b/patches.kernel.org/6.2.11-107-counter-104-quad-8-Fix-Synapse-action-reported.patch @@ -0,0 +1,42 @@ +From: William Breathitt Gray +Date: Thu, 16 Mar 2023 16:34:26 -0400 +Subject: [PATCH] counter: 104-quad-8: Fix Synapse action reported for Index + signals +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 00f4bc5184c19cb33f468f1ea409d70d19f8f502 + +commit 00f4bc5184c19cb33f468f1ea409d70d19f8f502 upstream. + +Signal 16 and higher represent the device's Index lines. The +priv->preset_enable array holds the device configuration for these Index +lines. The preset_enable configuration is active low on the device, so +invert the conditional check in quad8_action_read() to properly handle +the logical state of preset_enable. + +Fixes: f1d8a071d45b ("counter: 104-quad-8: Add Generic Counter interface support") +Cc: +Link: https://lore.kernel.org/r/20230316203426.224745-1-william.gray@linaro.org/ +Signed-off-by: William Breathitt Gray +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/counter/104-quad-8.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/counter/104-quad-8.c b/drivers/counter/104-quad-8.c +index d59e4f34..d9cb9376 100644 +--- a/drivers/counter/104-quad-8.c ++++ b/drivers/counter/104-quad-8.c +@@ -368,7 +368,7 @@ static int quad8_action_read(struct counter_device *counter, + + /* Handle Index signals */ + if (synapse->signal->id >= 16) { +- if (priv->preset_enable[count->id]) ++ if (!priv->preset_enable[count->id]) + *action = COUNTER_SYNAPSE_ACTION_RISING_EDGE; + else + *action = COUNTER_SYNAPSE_ACTION_NONE; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-108-blk-mq-directly-poll-requests.patch b/patches.kernel.org/6.2.11-108-blk-mq-directly-poll-requests.patch new file mode 100644 index 0000000..1d4b335 --- /dev/null +++ b/patches.kernel.org/6.2.11-108-blk-mq-directly-poll-requests.patch @@ -0,0 +1,60 @@ +From: Keith Busch +Date: Fri, 31 Mar 2023 11:00:56 -0700 +Subject: [PATCH] blk-mq: directly poll requests +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 38a8c4d1d45006841f0643f4cb29b5e50758837c + +commit 38a8c4d1d45006841f0643f4cb29b5e50758837c upstream. + +Polling needs a bio with a valid bi_bdev, but neither of those are +guaranteed for polled driver requests. Make request based polling +directly use blk-mq's polling function instead. + +When executing a request from a polled hctx, we know the request's +cookie, and that it's from a live blk-mq queue that supports polling, so +we can safely skip everything that bio_poll provides. + +Cc: stable@kernel.org +Reported-by: Martin Belanger +Reported-by: Daniel Wagner +Signed-off-by: Keith Busch +Tested-by: Daniel Wagner +Revieded-by: Daniel Wagner +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Sagi Grimberg +Reviewed-by: Christoph Hellwig +Tested-by: Shin'ichiro Kawasaki +Link: https://lore.kernel.org/r/20230331180056.1155862-1-kbusch@meta.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + block/blk-mq.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index c021fb05..86425167 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1359,8 +1359,6 @@ bool blk_rq_is_poll(struct request *rq) + return false; + if (rq->mq_hctx->type != HCTX_TYPE_POLL) + return false; +- if (WARN_ON_ONCE(!rq->bio)) +- return false; + return true; + } + EXPORT_SYMBOL_GPL(blk_rq_is_poll); +@@ -1368,7 +1366,7 @@ EXPORT_SYMBOL_GPL(blk_rq_is_poll); + static void blk_rq_poll_completion(struct request *rq, struct completion *wait) + { + do { +- bio_poll(rq->bio, NULL, 0); ++ blk_mq_poll(rq->q, blk_rq_to_qc(rq), NULL, 0); + cond_resched(); + } while (!completion_done(wait)); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-109-ftrace-Mark-get_lock_parent_ip-__always_inline.patch b/patches.kernel.org/6.2.11-109-ftrace-Mark-get_lock_parent_ip-__always_inline.patch new file mode 100644 index 0000000..2609b69 --- /dev/null +++ b/patches.kernel.org/6.2.11-109-ftrace-Mark-get_lock_parent_ip-__always_inline.patch @@ -0,0 +1,43 @@ +From: John Keeping +Date: Mon, 27 Mar 2023 18:36:46 +0100 +Subject: [PATCH] ftrace: Mark get_lock_parent_ip() __always_inline +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: ea65b41807a26495ff2a73dd8b1bab2751940887 + +commit ea65b41807a26495ff2a73dd8b1bab2751940887 upstream. + +If the compiler decides not to inline this function then preemption +tracing will always show an IP inside the preemption disabling path and +never the function actually calling preempt_{enable,disable}. + +Link: https://lore.kernel.org/linux-trace-kernel/20230327173647.1690849-1-john@metanate.com + +Cc: Masami Hiramatsu +Cc: Mark Rutland +Cc: stable@vger.kernel.org +Fixes: f904f58263e1d ("sched/debug: Fix preempt_disable_ip recording for preempt_disable()") +Signed-off-by: John Keeping +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + include/linux/ftrace.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h +index 99f11466..f4f9787d 100644 +--- a/include/linux/ftrace.h ++++ b/include/linux/ftrace.h +@@ -970,7 +970,7 @@ static inline void __ftrace_enabled_restore(int enabled) + #define CALLER_ADDR5 ((unsigned long)ftrace_return_address(5)) + #define CALLER_ADDR6 ((unsigned long)ftrace_return_address(6)) + +-static inline unsigned long get_lock_parent_ip(void) ++static __always_inline unsigned long get_lock_parent_ip(void) + { + unsigned long addr = CALLER_ADDR0; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-110-ftrace-Fix-issue-that-direct-addr-not-restored.patch b/patches.kernel.org/6.2.11-110-ftrace-Fix-issue-that-direct-addr-not-restored.patch new file mode 100644 index 0000000..b1bffaf --- /dev/null +++ b/patches.kernel.org/6.2.11-110-ftrace-Fix-issue-that-direct-addr-not-restored.patch @@ -0,0 +1,63 @@ +From: Zheng Yejian +Date: Thu, 30 Mar 2023 10:52:23 +0800 +Subject: [PATCH] ftrace: Fix issue that 'direct->addr' not restored in + modify_ftrace_direct() +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 2a2d8c51defb446e8d89a83f42f8e5cd529111e9 + +commit 2a2d8c51defb446e8d89a83f42f8e5cd529111e9 upstream. + +Syzkaller report a WARNING: "WARN_ON(!direct)" in modify_ftrace_direct(). + +Root cause is 'direct->addr' was changed from 'old_addr' to 'new_addr' but +not restored if error happened on calling ftrace_modify_direct_caller(). +Then it can no longer find 'direct' by that 'old_addr'. + +To fix it, restore 'direct->addr' to 'old_addr' explicitly in error path. + +Link: https://lore.kernel.org/linux-trace-kernel/20230330025223.1046087-1-zhengyejian1@huawei.com + +Cc: stable@vger.kernel.org +Cc: +Cc: +Cc: +Cc: +Fixes: 8a141dd7f706 ("ftrace: Fix modify_ftrace_direct.") +Signed-off-by: Zheng Yejian +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/trace/ftrace.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index a47f7d93..5f662d13 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -5568,12 +5568,15 @@ int modify_ftrace_direct(unsigned long ip, + ret = 0; + } + +- if (unlikely(ret && new_direct)) { +- direct->count++; +- list_del_rcu(&new_direct->next); +- synchronize_rcu_tasks(); +- kfree(new_direct); +- ftrace_direct_func_count--; ++ if (ret) { ++ direct->addr = old_addr; ++ if (unlikely(new_direct)) { ++ direct->count++; ++ list_del_rcu(&new_direct->next); ++ synchronize_rcu_tasks(); ++ kfree(new_direct); ++ ftrace_direct_func_count--; ++ } + } + + out_unlock: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-111-fs-drop-peer-group-ids-under-namespace-lock.patch b/patches.kernel.org/6.2.11-111-fs-drop-peer-group-ids-under-namespace-lock.patch new file mode 100644 index 0000000..3495cb0 --- /dev/null +++ b/patches.kernel.org/6.2.11-111-fs-drop-peer-group-ids-under-namespace-lock.patch @@ -0,0 +1,43 @@ +From: Christian Brauner +Date: Thu, 30 Mar 2023 09:13:16 +0200 +Subject: [PATCH] fs: drop peer group ids under namespace lock +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: cb2239c198ad9fbd5aced22cf93e45562da781eb + +commit cb2239c198ad9fbd5aced22cf93e45562da781eb upstream. + +When cleaning up peer group ids in the failure path we need to make sure +to hold on to the namespace lock. Otherwise another thread might just +turn the mount from a shared into a non-shared mount concurrently. + +Link: https://lore.kernel.org/lkml/00000000000088694505f8132d77@google.com +Fixes: 2a1867219c7b ("fs: add mount_setattr()") +Reported-by: syzbot+8ac3859139c685c4f597@syzkaller.appspotmail.com +Cc: stable@vger.kernel.org # 5.12+ +Message-Id: <20230330-vfs-mount_setattr-propagation-fix-v1-1-37548d91533b@kernel.org> +Signed-off-by: Christian Brauner +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/namespace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/namespace.c b/fs/namespace.c +index ab467ee5..14fa31f1 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -4286,9 +4286,9 @@ static int do_mount_setattr(struct path *path, struct mount_kattr *kattr) + unlock_mount_hash(); + + if (kattr->propagation) { +- namespace_unlock(); + if (err) + cleanup_group_ids(mnt, NULL); ++ namespace_unlock(); + } + + return err; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-112-can-j1939-j1939_tp_tx_dat_new-fix-out-of-bound.patch b/patches.kernel.org/6.2.11-112-can-j1939-j1939_tp_tx_dat_new-fix-out-of-bound.patch new file mode 100644 index 0000000..704e858 --- /dev/null +++ b/patches.kernel.org/6.2.11-112-can-j1939-j1939_tp_tx_dat_new-fix-out-of-bound.patch @@ -0,0 +1,60 @@ +From: Oleksij Rempel +Date: Tue, 4 Apr 2023 09:31:28 +0200 +Subject: [PATCH] can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory + access +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: b45193cb4df556fe6251b285a5ce44046dd36b4a + +commit b45193cb4df556fe6251b285a5ce44046dd36b4a upstream. + +In the j1939_tp_tx_dat_new() function, an out-of-bounds memory access +could occur during the memcpy() operation if the size of skb->cb is +larger than the size of struct j1939_sk_buff_cb. This is because the +memcpy() operation uses the size of skb->cb, leading to a read beyond +the struct j1939_sk_buff_cb. + +Updated the memcpy() operation to use the size of struct +j1939_sk_buff_cb instead of the size of skb->cb. This ensures that the +memcpy() operation only reads the memory within the bounds of struct +j1939_sk_buff_cb, preventing out-of-bounds memory access. + +Additionally, add a BUILD_BUG_ON() to check that the size of skb->cb +is greater than or equal to the size of struct j1939_sk_buff_cb. This +ensures that the skb->cb buffer is large enough to hold the +j1939_sk_buff_cb structure. + +Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") +Reported-by: Shuangpeng Bai +Tested-by: Shuangpeng Bai +Signed-off-by: Oleksij Rempel +Link: https://groups.google.com/g/syzkaller/c/G_LL-C3plRs/m/-8xCi6dCAgAJ +Link: https://lore.kernel.org/all/20230404073128.3173900-1-o.rempel@pengutronix.de +Cc: stable@vger.kernel.org +[mkl: rephrase commit message] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + net/can/j1939/transport.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c +index fb92c360..fe3df23a 100644 +--- a/net/can/j1939/transport.c ++++ b/net/can/j1939/transport.c +@@ -604,7 +604,10 @@ sk_buff *j1939_tp_tx_dat_new(struct j1939_priv *priv, + /* reserve CAN header */ + skb_reserve(skb, offsetof(struct can_frame, data)); + +- memcpy(skb->cb, re_skcb, sizeof(skb->cb)); ++ /* skb->cb must be large enough to hold a j1939_sk_buff_cb structure */ ++ BUILD_BUG_ON(sizeof(skb->cb) < sizeof(*re_skcb)); ++ ++ memcpy(skb->cb, re_skcb, sizeof(*re_skcb)); + skcb = j1939_skb_to_cb(skb); + if (swap_src_dst) + j1939_skbcb_swap(skcb); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-113-can-isotp-fix-race-between-isotp_sendsmg-and-i.patch b/patches.kernel.org/6.2.11-113-can-isotp-fix-race-between-isotp_sendsmg-and-i.patch new file mode 100644 index 0000000..a877f20 --- /dev/null +++ b/patches.kernel.org/6.2.11-113-can-isotp-fix-race-between-isotp_sendsmg-and-i.patch @@ -0,0 +1,169 @@ +From: Oliver Hartkopp +Date: Fri, 31 Mar 2023 15:19:35 +0200 +Subject: [PATCH] can: isotp: fix race between isotp_sendsmg() and + isotp_release() +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 051737439eaee5bdd03d3c2ef5510d54a478fd05 + +commit 051737439eaee5bdd03d3c2ef5510d54a478fd05 upstream. + +As discussed with Dae R. Jeong and Hillf Danton here [1] the sendmsg() +function in isotp.c might get into a race condition when restoring the +former tx.state from the old_state. + +Remove the old_state concept and implement proper locking for the +ISOTP_IDLE transitions in isotp_sendmsg(), inspired by a +simplification idea from Hillf Danton. + +Introduce a new tx.state ISOTP_SHUTDOWN and use the same locking +mechanism from isotp_release() which resolves a potential race between +isotp_sendsmg() and isotp_release(). + +[1] https://lore.kernel.org/linux-can/ZB%2F93xJxq%2FBUqAgG@dragonet + +v1: https://lore.kernel.org/all/20230331102114.15164-1-socketcan@hartkopp.net +v2: https://lore.kernel.org/all/20230331123600.3550-1-socketcan@hartkopp.net + take care of signal interrupts for wait_event_interruptible() in + isotp_release() +v3: https://lore.kernel.org/all/20230331130654.9886-1-socketcan@hartkopp.net + take care of signal interrupts for wait_event_interruptible() in + isotp_sendmsg() in the wait_tx_done case +v4: https://lore.kernel.org/all/20230331131935.21465-1-socketcan@hartkopp.net + take care of signal interrupts for wait_event_interruptible() in + isotp_sendmsg() in ALL cases + +Cc: Dae R. Jeong +Cc: Hillf Danton +Signed-off-by: Oliver Hartkopp +Fixes: 4f027cba8216 ("can: isotp: split tx timer into transmission and timeout") +Link: https://lore.kernel.org/all/20230331131935.21465-1-socketcan@hartkopp.net +Cc: stable@vger.kernel.org +[mkl: rephrase commit message] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + net/can/isotp.c | 55 ++++++++++++++++++++++++++++--------------------- + 1 file changed, 31 insertions(+), 24 deletions(-) + +diff --git a/net/can/isotp.c b/net/can/isotp.c +index 9bc34485..f70ee4cf 100644 +--- a/net/can/isotp.c ++++ b/net/can/isotp.c +@@ -119,7 +119,8 @@ enum { + ISOTP_WAIT_FIRST_FC, + ISOTP_WAIT_FC, + ISOTP_WAIT_DATA, +- ISOTP_SENDING ++ ISOTP_SENDING, ++ ISOTP_SHUTDOWN, + }; + + struct tpcon { +@@ -880,8 +881,8 @@ static enum hrtimer_restart isotp_tx_timer_handler(struct hrtimer *hrtimer) + txtimer); + struct sock *sk = &so->sk; + +- /* don't handle timeouts in IDLE state */ +- if (so->tx.state == ISOTP_IDLE) ++ /* don't handle timeouts in IDLE or SHUTDOWN state */ ++ if (so->tx.state == ISOTP_IDLE || so->tx.state == ISOTP_SHUTDOWN) + return HRTIMER_NORESTART; + + /* we did not get any flow control or echo frame in time */ +@@ -918,7 +919,6 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) + { + struct sock *sk = sock->sk; + struct isotp_sock *so = isotp_sk(sk); +- u32 old_state = so->tx.state; + struct sk_buff *skb; + struct net_device *dev; + struct canfd_frame *cf; +@@ -928,23 +928,24 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) + int off; + int err; + +- if (!so->bound) ++ if (!so->bound || so->tx.state == ISOTP_SHUTDOWN) + return -EADDRNOTAVAIL; + ++wait_free_buffer: + /* we do not support multiple buffers - for now */ +- if (cmpxchg(&so->tx.state, ISOTP_IDLE, ISOTP_SENDING) != ISOTP_IDLE || +- wq_has_sleeper(&so->wait)) { +- if (msg->msg_flags & MSG_DONTWAIT) { +- err = -EAGAIN; +- goto err_out; +- } ++ if (wq_has_sleeper(&so->wait) && (msg->msg_flags & MSG_DONTWAIT)) ++ return -EAGAIN; + +- /* wait for complete transmission of current pdu */ +- err = wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE); +- if (err) +- goto err_out; ++ /* wait for complete transmission of current pdu */ ++ err = wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE); ++ if (err) ++ goto err_event_drop; + +- so->tx.state = ISOTP_SENDING; ++ if (cmpxchg(&so->tx.state, ISOTP_IDLE, ISOTP_SENDING) != ISOTP_IDLE) { ++ if (so->tx.state == ISOTP_SHUTDOWN) ++ return -EADDRNOTAVAIL; ++ ++ goto wait_free_buffer; + } + + if (!size || size > MAX_MSG_LENGTH) { +@@ -1074,7 +1075,9 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) + + if (wait_tx_done) { + /* wait for complete transmission of current pdu */ +- wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE); ++ err = wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE); ++ if (err) ++ goto err_event_drop; + + if (sk->sk_err) + return -sk->sk_err; +@@ -1082,13 +1085,15 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) + + return size; + ++err_event_drop: ++ /* got signal: force tx state machine to be idle */ ++ so->tx.state = ISOTP_IDLE; ++ hrtimer_cancel(&so->txfrtimer); ++ hrtimer_cancel(&so->txtimer); + err_out_drop: + /* drop this PDU and unlock a potential wait queue */ +- old_state = ISOTP_IDLE; +-err_out: +- so->tx.state = old_state; +- if (so->tx.state == ISOTP_IDLE) +- wake_up_interruptible(&so->wait); ++ so->tx.state = ISOTP_IDLE; ++ wake_up_interruptible(&so->wait); + + return err; + } +@@ -1150,10 +1155,12 @@ static int isotp_release(struct socket *sock) + net = sock_net(sk); + + /* wait for complete transmission of current pdu */ +- wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE); ++ while (wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE) == 0 && ++ cmpxchg(&so->tx.state, ISOTP_IDLE, ISOTP_SHUTDOWN) != ISOTP_IDLE) ++ ; + + /* force state machines to be idle also when a signal occurred */ +- so->tx.state = ISOTP_IDLE; ++ so->tx.state = ISOTP_SHUTDOWN; + so->rx.state = ISOTP_IDLE; + + spin_lock(&isotp_notifier_lock); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-114-can-isotp-isotp_ops-fix-poll-to-not-report-fal.patch b/patches.kernel.org/6.2.11-114-can-isotp-isotp_ops-fix-poll-to-not-report-fal.patch new file mode 100644 index 0000000..3e577a2 --- /dev/null +++ b/patches.kernel.org/6.2.11-114-can-isotp-isotp_ops-fix-poll-to-not-report-fal.patch @@ -0,0 +1,78 @@ +From: Michal Sojka +Date: Fri, 31 Mar 2023 14:55:11 +0200 +Subject: [PATCH] can: isotp: isotp_ops: fix poll() to not report false + EPOLLOUT events +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 79e19fa79cb5d5f1b3bf3e3ae24989ccb93c7b7b + +commit 79e19fa79cb5d5f1b3bf3e3ae24989ccb93c7b7b upstream. + +When using select()/poll()/epoll() with a non-blocking ISOTP socket to +wait for when non-blocking write is possible, a false EPOLLOUT event +is sometimes returned. This can happen at least after sending a +message which must be split to multiple CAN frames. + +The reason is that isotp_sendmsg() returns -EAGAIN when tx.state is +not equal to ISOTP_IDLE and this behavior is not reflected in +datagram_poll(), which is used in isotp_ops. + +This is fixed by introducing ISOTP-specific poll function, which +suppresses the EPOLLOUT events in that case. + +v2: https://lore.kernel.org/all/20230302092812.320643-1-michal.sojka@cvut.cz +v1: https://lore.kernel.org/all/20230224010659.48420-1-michal.sojka@cvut.cz + https://lore.kernel.org/all/b53a04a2-ba1f-3858-84c1-d3eb3301ae15@hartkopp.net + +Signed-off-by: Michal Sojka +Reported-by: Jakub Jira +Tested-by: Oliver Hartkopp +Acked-by: Oliver Hartkopp +Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") +Link: https://lore.kernel.org/all/20230331125511.372783-1-michal.sojka@cvut.cz +Cc: stable@vger.kernel.org +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + net/can/isotp.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/net/can/isotp.c b/net/can/isotp.c +index f70ee4cf..6d377b16 100644 +--- a/net/can/isotp.c ++++ b/net/can/isotp.c +@@ -1615,6 +1615,21 @@ static int isotp_init(struct sock *sk) + return 0; + } + ++static __poll_t isotp_poll(struct file *file, struct socket *sock, poll_table *wait) ++{ ++ struct sock *sk = sock->sk; ++ struct isotp_sock *so = isotp_sk(sk); ++ ++ __poll_t mask = datagram_poll(file, sock, wait); ++ poll_wait(file, &so->wait, wait); ++ ++ /* Check for false positives due to TX state */ ++ if ((mask & EPOLLWRNORM) && (so->tx.state != ISOTP_IDLE)) ++ mask &= ~(EPOLLOUT | EPOLLWRNORM); ++ ++ return mask; ++} ++ + static int isotp_sock_no_ioctlcmd(struct socket *sock, unsigned int cmd, + unsigned long arg) + { +@@ -1630,7 +1645,7 @@ static const struct proto_ops isotp_ops = { + .socketpair = sock_no_socketpair, + .accept = sock_no_accept, + .getname = isotp_getname, +- .poll = datagram_poll, ++ .poll = isotp_poll, + .ioctl = isotp_sock_no_ioctlcmd, + .gettstamp = sock_gettstamp, + .listen = sock_no_listen, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-115-can-isotp-isotp_recvmsg-use-sock_recv_cmsgs-to.patch b/patches.kernel.org/6.2.11-115-can-isotp-isotp_recvmsg-use-sock_recv_cmsgs-to.patch new file mode 100644 index 0000000..b80070b --- /dev/null +++ b/patches.kernel.org/6.2.11-115-can-isotp-isotp_recvmsg-use-sock_recv_cmsgs-to.patch @@ -0,0 +1,40 @@ +From: Oliver Hartkopp +Date: Thu, 30 Mar 2023 19:02:48 +0200 +Subject: [PATCH] can: isotp: isotp_recvmsg(): use sock_recv_cmsgs() to get + SOCK_RXQ_OVFL infos +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 0145462fc802cd447ef5d029758043c7f15b4b1e + +commit 0145462fc802cd447ef5d029758043c7f15b4b1e upstream. + +isotp.c was still using sock_recv_timestamp() which does not provide +control messages to detect dropped PDUs in the receive path. + +Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") +Signed-off-by: Oliver Hartkopp +Link: https://lore.kernel.org/all/20230330170248.62342-1-socketcan@hartkopp.net +Cc: stable@vger.kernel.org +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + net/can/isotp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/can/isotp.c b/net/can/isotp.c +index 6d377b16..5761d4ab 100644 +--- a/net/can/isotp.c ++++ b/net/can/isotp.c +@@ -1125,7 +1125,7 @@ static int isotp_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, + if (ret < 0) + goto out_err; + +- sock_recv_timestamp(msg, sk, skb); ++ sock_recv_cmsgs(msg, sk, skb); + + if (msg->msg_name) { + __sockaddr_check_size(ISOTP_MIN_NAMELEN); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-116-ACPI-video-Add-auto_detect-arg-to-__acpi_video.patch b/patches.kernel.org/6.2.11-116-ACPI-video-Add-auto_detect-arg-to-__acpi_video.patch new file mode 100644 index 0000000..82a0d7f --- /dev/null +++ b/patches.kernel.org/6.2.11-116-ACPI-video-Add-auto_detect-arg-to-__acpi_video.patch @@ -0,0 +1,119 @@ +From: Hans de Goede +Date: Tue, 4 Apr 2023 13:02:46 +0200 +Subject: [PATCH] ACPI: video: Add auto_detect arg to + __acpi_video_get_backlight_type() +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 78dfc9d1d1abb9e400386fa9c5724a8f7d75e3b9 + +commit 78dfc9d1d1abb9e400386fa9c5724a8f7d75e3b9 upstream. + +Allow callers of __acpi_video_get_backlight_type() to pass a pointer +to a bool which will get set to false if the backlight-type comes from +the cmdline or a DMI quirk and set to true if auto-detection was used. + +And make __acpi_video_get_backlight_type() non static so that it can +be called directly outside of video_detect.c . + +While at it turn the acpi_video_get_backlight_type() and +acpi_video_backlight_use_native() wrappers into static inline functions +in include/acpi/video.h, so that we need to export one less symbol. + +Fixes: 5aa9d943e9b6 ("ACPI: video: Don't enable fallback path for creating ACPI backlight by default") +Cc: All applicable +Reviewed-by: Mario Limonciello +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/acpi/video_detect.c | 21 ++++++++------------- + include/acpi/video.h | 15 +++++++++++++-- + 2 files changed, 21 insertions(+), 15 deletions(-) + +diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c +index 14d6d81e..9f514ad2 100644 +--- a/drivers/acpi/video_detect.c ++++ b/drivers/acpi/video_detect.c +@@ -774,7 +774,7 @@ static bool prefer_native_over_acpi_video(void) + * Determine which type of backlight interface to use on this system, + * First check cmdline, then dmi quirks, then do autodetect. + */ +-static enum acpi_backlight_type __acpi_video_get_backlight_type(bool native) ++enum acpi_backlight_type __acpi_video_get_backlight_type(bool native, bool *auto_detect) + { + static DEFINE_MUTEX(init_mutex); + static bool nvidia_wmi_ec_present; +@@ -799,6 +799,9 @@ static enum acpi_backlight_type __acpi_video_get_backlight_type(bool native) + native_available = true; + mutex_unlock(&init_mutex); + ++ if (auto_detect) ++ *auto_detect = false; ++ + /* + * The below heuristics / detection steps are in order of descending + * presedence. The commandline takes presedence over anything else. +@@ -810,6 +813,9 @@ static enum acpi_backlight_type __acpi_video_get_backlight_type(bool native) + if (acpi_backlight_dmi != acpi_backlight_undef) + return acpi_backlight_dmi; + ++ if (auto_detect) ++ *auto_detect = true; ++ + /* Special cases such as nvidia_wmi_ec and apple gmux. */ + if (nvidia_wmi_ec_present) + return acpi_backlight_nvidia_wmi_ec; +@@ -829,15 +835,4 @@ static enum acpi_backlight_type __acpi_video_get_backlight_type(bool native) + /* No ACPI video/native (old hw), use vendor specific fw methods. */ + return acpi_backlight_vendor; + } +- +-enum acpi_backlight_type acpi_video_get_backlight_type(void) +-{ +- return __acpi_video_get_backlight_type(false); +-} +-EXPORT_SYMBOL(acpi_video_get_backlight_type); +- +-bool acpi_video_backlight_use_native(void) +-{ +- return __acpi_video_get_backlight_type(true) == acpi_backlight_native; +-} +-EXPORT_SYMBOL(acpi_video_backlight_use_native); ++EXPORT_SYMBOL(__acpi_video_get_backlight_type); +diff --git a/include/acpi/video.h b/include/acpi/video.h +index 8ed9bec0..ff5a8da5 100644 +--- a/include/acpi/video.h ++++ b/include/acpi/video.h +@@ -59,8 +59,6 @@ extern void acpi_video_unregister(void); + extern void acpi_video_register_backlight(void); + extern int acpi_video_get_edid(struct acpi_device *device, int type, + int device_id, void **edid); +-extern enum acpi_backlight_type acpi_video_get_backlight_type(void); +-extern bool acpi_video_backlight_use_native(void); + /* + * Note: The value returned by acpi_video_handles_brightness_key_presses() + * may change over time and should not be cached. +@@ -69,6 +67,19 @@ extern bool acpi_video_handles_brightness_key_presses(void); + extern int acpi_video_get_levels(struct acpi_device *device, + struct acpi_video_device_brightness **dev_br, + int *pmax_level); ++ ++extern enum acpi_backlight_type __acpi_video_get_backlight_type(bool native, ++ bool *auto_detect); ++ ++static inline enum acpi_backlight_type acpi_video_get_backlight_type(void) ++{ ++ return __acpi_video_get_backlight_type(false, NULL); ++} ++ ++static inline bool acpi_video_backlight_use_native(void) ++{ ++ return __acpi_video_get_backlight_type(true, NULL) == acpi_backlight_native; ++} + #else + static inline void acpi_video_report_nolcd(void) { return; }; + static inline int acpi_video_register(void) { return -ENODEV; } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-117-ACPI-video-Make-acpi_backlight-video-work-inde.patch b/patches.kernel.org/6.2.11-117-ACPI-video-Make-acpi_backlight-video-work-inde.patch new file mode 100644 index 0000000..46d1999 --- /dev/null +++ b/patches.kernel.org/6.2.11-117-ACPI-video-Make-acpi_backlight-video-work-inde.patch @@ -0,0 +1,83 @@ +From: Hans de Goede +Date: Tue, 4 Apr 2023 13:02:47 +0200 +Subject: [PATCH] ACPI: video: Make acpi_backlight=video work independent from + GPU driver +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: e506731c8f35699d746c615164ed620cd53c00ca + +commit e506731c8f35699d746c615164ed620cd53c00ca upstream. + +Commit 3dbc80a3e4c5 ("ACPI: video: Make backlight class device +registration a separate step (v2)") combined with +commit 5aa9d943e9b6 ("ACPI: video: Don't enable fallback path for +creating ACPI backlight by default") + +Means that the video.ko code now fully depends on the GPU driver calling +acpi_video_register_backlight() for the acpi_video# backlight class +devices to get registered. + +This means that if the GPU driver does not do this, acpi_backlight=video +on the cmdline, or DMI quirks for selecting acpi_video# will not work. + +This is a problem on for example Apple iMac14,1 all-in-ones where +the monitor's LCD panel shows up as a regular DP connection instead of +eDP so the GPU driver will not call acpi_video_register_backlight() [1]. + +Fix this by making video.ko directly register the acpi_video# devices +when these have been explicitly requested either on the cmdline or +through DMI quirks (rather then auto-detection being used). + +[1] GPU drivers only call acpi_video_register_backlight() when an internal +panel is detected, to avoid non working acpi_video# devices getting +registered on desktops which unfortunately is a real issue. + +Fixes: 5aa9d943e9b6 ("ACPI: video: Don't enable fallback path for creating ACPI backlight by default") +Cc: All applicable +Reviewed-by: Mario Limonciello +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/acpi/acpi_video.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c +index 97b711e5..c7a6d0b6 100644 +--- a/drivers/acpi/acpi_video.c ++++ b/drivers/acpi/acpi_video.c +@@ -1984,6 +1984,7 @@ static int instance; + static int acpi_video_bus_add(struct acpi_device *device) + { + struct acpi_video_bus *video; ++ bool auto_detect; + int error; + acpi_status status; + +@@ -2045,10 +2046,20 @@ static int acpi_video_bus_add(struct acpi_device *device) + mutex_unlock(&video_list_lock); + + /* +- * The userspace visible backlight_device gets registered separately +- * from acpi_video_register_backlight(). ++ * If backlight-type auto-detection is used then a native backlight may ++ * show up later and this may change the result from video to native. ++ * Therefor normally the userspace visible /sys/class/backlight device ++ * gets registered separately by the GPU driver calling ++ * acpi_video_register_backlight() when an internal panel is detected. ++ * Register the backlight now when not using auto-detection, so that ++ * when the kernel cmdline or DMI-quirks are used the backlight will ++ * get registered even if acpi_video_register_backlight() is not called. + */ + acpi_video_run_bcl_for_osi(video); ++ if (__acpi_video_get_backlight_type(false, &auto_detect) == acpi_backlight_video && ++ !auto_detect) ++ acpi_video_bus_register_backlight(video); ++ + acpi_video_bus_add_notify_handler(video); + + return 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-118-ACPI-video-Add-acpi_backlight-video-quirk-for-.patch b/patches.kernel.org/6.2.11-118-ACPI-video-Add-acpi_backlight-video-quirk-for-.patch new file mode 100644 index 0000000..9251efc --- /dev/null +++ b/patches.kernel.org/6.2.11-118-ACPI-video-Add-acpi_backlight-video-quirk-for-.patch @@ -0,0 +1,72 @@ +From: Hans de Goede +Date: Tue, 4 Apr 2023 13:02:48 +0200 +Subject: [PATCH] ACPI: video: Add acpi_backlight=video quirk for Apple + iMac14,1 and iMac14,2 +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 2699107989431d6db44f8a9e809ea74c387336d1 + +commit 2699107989431d6db44f8a9e809ea74c387336d1 upstream. + +On the Apple iMac14,1 and iMac14,2 all-in-ones (monitors with builtin "PC") +the connection between the GPU and the panel is seen by the GPU driver as +regular DP instead of eDP, causing the GPU driver to never call +acpi_video_register_backlight(). + +(GPU drivers only call acpi_video_register_backlight() when an internal + panel is detected, to avoid non working acpi_video# devices getting + registered on desktops which unfortunately is a real issue.) + +Fix the missing acpi_video# backlight device on these all-in-ones by +adding a acpi_backlight=video DMI quirk, so that video.ko will +immediately register the backlight device instead of waiting for +an acpi_video_register_backlight() call. + +Fixes: 5aa9d943e9b6 ("ACPI: video: Don't enable fallback path for creating ACPI backlight by default") +Cc: All applicable +Reviewed-by: Mario Limonciello +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/acpi/video_detect.c | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) + +diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c +index 9f514ad2..a21c63e7 100644 +--- a/drivers/acpi/video_detect.c ++++ b/drivers/acpi/video_detect.c +@@ -276,6 +276,29 @@ static const struct dmi_system_id video_detect_dmi_table[] = { + }, + }, + ++ /* ++ * Models which need acpi_video backlight control where the GPU drivers ++ * do not call acpi_video_register_backlight() because no internal panel ++ * is detected. Typically these are all-in-ones (monitors with builtin ++ * PC) where the panel connection shows up as regular DP instead of eDP. ++ */ ++ { ++ .callback = video_detect_force_video, ++ /* Apple iMac14,1 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "iMac14,1"), ++ }, ++ }, ++ { ++ .callback = video_detect_force_video, ++ /* Apple iMac14,2 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "iMac14,2"), ++ }, ++ }, ++ + /* + * These models have a working acpi_video backlight control, and using + * native backlight causes a regression where backlight does not work +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-119-ACPI-video-Add-acpi_backlight-video-quirk-for-.patch b/patches.kernel.org/6.2.11-119-ACPI-video-Add-acpi_backlight-video-quirk-for-.patch new file mode 100644 index 0000000..127e4ff --- /dev/null +++ b/patches.kernel.org/6.2.11-119-ACPI-video-Add-acpi_backlight-video-quirk-for-.patch @@ -0,0 +1,71 @@ +From: Hans de Goede +Date: Tue, 4 Apr 2023 13:02:49 +0200 +Subject: [PATCH] ACPI: video: Add acpi_backlight=video quirk for Lenovo + ThinkPad W530 +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: a5b2781dcab2c77979a4b8adda781d2543580901 + +commit a5b2781dcab2c77979a4b8adda781d2543580901 upstream. + +The Lenovo ThinkPad W530 uses a nvidia k1000m GPU. When this gets used +together with one of the older nvidia binary driver series (the latest +series does not support it), then backlight control does not work. + +This is caused by commit 3dbc80a3e4c5 ("ACPI: video: Make backlight +class device registration a separate step (v2)") combined with +commit 5aa9d943e9b6 ("ACPI: video: Don't enable fallback path for +creating ACPI backlight by default"). + +After these changes the acpi_video# backlight device is only registered +when requested by a GPU driver calling acpi_video_register_backlight() +which the nvidia binary driver does not do. + +I realize that using the nvidia binary driver is not a supported use-case +and users can workaround this by adding acpi_backlight=video on the kernel +commandline, but the ThinkPad W530 is a popular model under Linux users, +so it seems worthwhile to add a quirk for this. + +I will also email Nvidia asking them to make the driver call +acpi_video_register_backlight() when an internal LCD panel is detected. +So maybe the next maintenance release of the drivers will fix this... + +Fixes: 5aa9d943e9b6 ("ACPI: video: Don't enable fallback path for creating ACPI backlight by default") +Cc: All applicable +Reviewed-by: Mario Limonciello +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/acpi/video_detect.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c +index a21c63e7..b3b0b069 100644 +--- a/drivers/acpi/video_detect.c ++++ b/drivers/acpi/video_detect.c +@@ -299,6 +299,20 @@ static const struct dmi_system_id video_detect_dmi_table[] = { + }, + }, + ++ /* ++ * Older models with nvidia GPU which need acpi_video backlight ++ * control and where the old nvidia binary driver series does not ++ * call acpi_video_register_backlight(). ++ */ ++ { ++ .callback = video_detect_force_video, ++ /* ThinkPad W530 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W530"), ++ }, ++ }, ++ + /* + * These models have a working acpi_video backlight control, and using + * native backlight causes a regression where backlight does not work +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-120-net-stmmac-Add-queue-reset-into-stmmac_xdp_ope.patch b/patches.kernel.org/6.2.11-120-net-stmmac-Add-queue-reset-into-stmmac_xdp_ope.patch new file mode 100644 index 0000000..fd0a165 --- /dev/null +++ b/patches.kernel.org/6.2.11-120-net-stmmac-Add-queue-reset-into-stmmac_xdp_ope.patch @@ -0,0 +1,43 @@ +From: Song Yoong Siang +Date: Tue, 4 Apr 2023 12:48:23 +0800 +Subject: [PATCH] net: stmmac: Add queue reset into stmmac_xdp_open() function +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 24e3fce00c0b557491ff596c0682a29dee6fe848 + +commit 24e3fce00c0b557491ff596c0682a29dee6fe848 upstream. + +Queue reset was moved out from __init_dma_rx_desc_rings() and +__init_dma_tx_desc_rings() functions. Thus, the driver fails to transmit +and receive packet after XDP prog setup. + +This commit adds the missing queue reset into stmmac_xdp_open() function. + +Fixes: f9ec5723c3db ("net: ethernet: stmicro: stmmac: move queue reset to dedicated functions") +Cc: # 6.0+ +Signed-off-by: Song Yoong Siang +Reviewed-by: Alexander Duyck +Link: https://lore.kernel.org/r/20230404044823.3226144-1-yoong.siang.song@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 622b95bf..014ce97f 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -6629,6 +6629,8 @@ int stmmac_xdp_open(struct net_device *dev) + goto init_error; + } + ++ stmmac_reset_queues_param(priv); ++ + /* DMA CSR Channel configuration */ + for (chan = 0; chan < dma_csr_ch; chan++) { + stmmac_init_chan(priv, priv->ioaddr, priv->plat->dma_cfg, chan); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-121-tracing-synthetic-Fix-races-on-freeing-last_cm.patch b/patches.kernel.org/6.2.11-121-tracing-synthetic-Fix-races-on-freeing-last_cm.patch new file mode 100644 index 0000000..ab5b6ed --- /dev/null +++ b/patches.kernel.org/6.2.11-121-tracing-synthetic-Fix-races-on-freeing-last_cm.patch @@ -0,0 +1,190 @@ +From: Tze-nan Wu +Date: Tue, 21 Mar 2023 19:04:43 +0800 +Subject: [PATCH] tracing/synthetic: Fix races on freeing last_cmd +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 4ccf11c4e8a8e051499d53a12f502196c97a758e + +commit 4ccf11c4e8a8e051499d53a12f502196c97a758e upstream. + +Currently, the "last_cmd" variable can be accessed by multiple processes +asynchronously when multiple users manipulate synthetic_events node +at the same time, it could lead to use-after-free or double-free. + +This patch add "lastcmd_mutex" to prevent "last_cmd" from being accessed +asynchronously. + +================================================================ + +It's easy to reproduce in the KASAN environment by running the two +scripts below in different shells. + +script 1: + while : + do + echo -n -e '\x88' > /sys/kernel/tracing/synthetic_events + done + +script 2: + while : + do + echo -n -e '\xb0' > /sys/kernel/tracing/synthetic_events + done + +================================================================ +double-free scenario: + + process A process B +------------------- --------------- +1.kstrdup last_cmd + 2.free last_cmd +3.free last_cmd(double-free) + +================================================================ +use-after-free scenario: + + process A process B +------------------- --------------- +1.kstrdup last_cmd + 2.free last_cmd +3.tracing_log_err(use-after-free) + +================================================================ + +Appendix 1. KASAN report double-free: + +BUG: KASAN: double-free in kfree+0xdc/0x1d4 +Free of addr ***** by task sh/4879 +Call trace: + ... + kfree+0xdc/0x1d4 + create_or_delete_synth_event+0x60/0x1e8 + trace_parse_run_command+0x2bc/0x4b8 + synth_events_write+0x20/0x30 + vfs_write+0x200/0x830 + ... + +Allocated by task 4879: + ... + kstrdup+0x5c/0x98 + create_or_delete_synth_event+0x6c/0x1e8 + trace_parse_run_command+0x2bc/0x4b8 + synth_events_write+0x20/0x30 + vfs_write+0x200/0x830 + ... + +Freed by task 5464: + ... + kfree+0xdc/0x1d4 + create_or_delete_synth_event+0x60/0x1e8 + trace_parse_run_command+0x2bc/0x4b8 + synth_events_write+0x20/0x30 + vfs_write+0x200/0x830 + ... + +================================================================ +Appendix 2. KASAN report use-after-free: + +BUG: KASAN: use-after-free in strlen+0x5c/0x7c +Read of size 1 at addr ***** by task sh/5483 +sh: CPU: 7 PID: 5483 Comm: sh + ... + __asan_report_load1_noabort+0x34/0x44 + strlen+0x5c/0x7c + tracing_log_err+0x60/0x444 + create_or_delete_synth_event+0xc4/0x204 + trace_parse_run_command+0x2bc/0x4b8 + synth_events_write+0x20/0x30 + vfs_write+0x200/0x830 + ... + +Allocated by task 5483: + ... + kstrdup+0x5c/0x98 + create_or_delete_synth_event+0x80/0x204 + trace_parse_run_command+0x2bc/0x4b8 + synth_events_write+0x20/0x30 + vfs_write+0x200/0x830 + ... + +Freed by task 5480: + ... + kfree+0xdc/0x1d4 + create_or_delete_synth_event+0x74/0x204 + trace_parse_run_command+0x2bc/0x4b8 + synth_events_write+0x20/0x30 + vfs_write+0x200/0x830 + ... + +Link: https://lore.kernel.org/linux-trace-kernel/20230321110444.1587-1-Tze-nan.Wu@mediatek.com + +Fixes: 27c888da9867 ("tracing: Remove size restriction on synthetic event cmd error logging") +Cc: stable@vger.kernel.org +Cc: Masami Hiramatsu +Cc: Matthias Brugger +Cc: AngeloGioacchino Del Regno +Cc: "Tom Zanussi" +Signed-off-by: Tze-nan Wu +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/trace/trace_events_synth.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/kernel/trace/trace_events_synth.c b/kernel/trace/trace_events_synth.c +index 67592eed..ea948939 100644 +--- a/kernel/trace/trace_events_synth.c ++++ b/kernel/trace/trace_events_synth.c +@@ -44,14 +44,21 @@ enum { ERRORS }; + + static const char *err_text[] = { ERRORS }; + ++DEFINE_MUTEX(lastcmd_mutex); + static char *last_cmd; + + static int errpos(const char *str) + { ++ int ret = 0; ++ ++ mutex_lock(&lastcmd_mutex); + if (!str || !last_cmd) +- return 0; ++ goto out; + +- return err_pos(last_cmd, str); ++ ret = err_pos(last_cmd, str); ++ out: ++ mutex_unlock(&lastcmd_mutex); ++ return ret; + } + + static void last_cmd_set(const char *str) +@@ -59,18 +66,22 @@ static void last_cmd_set(const char *str) + if (!str) + return; + ++ mutex_lock(&lastcmd_mutex); + kfree(last_cmd); +- + last_cmd = kstrdup(str, GFP_KERNEL); ++ mutex_unlock(&lastcmd_mutex); + } + + static void synth_err(u8 err_type, u16 err_pos) + { ++ mutex_lock(&lastcmd_mutex); + if (!last_cmd) +- return; ++ goto out; + + tracing_log_err(NULL, "synthetic_events", last_cmd, err_text, + err_type, err_pos); ++ out: ++ mutex_unlock(&lastcmd_mutex); + } + + static int create_synth_event(const char *raw_command); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-122-tracing-timerlat-Notify-new-max-thread-latency.patch b/patches.kernel.org/6.2.11-122-tracing-timerlat-Notify-new-max-thread-latency.patch new file mode 100644 index 0000000..9a98988 --- /dev/null +++ b/patches.kernel.org/6.2.11-122-tracing-timerlat-Notify-new-max-thread-latency.patch @@ -0,0 +1,43 @@ +From: Daniel Bristot de Oliveira +Date: Wed, 29 Mar 2023 17:50:15 +0200 +Subject: [PATCH] tracing/timerlat: Notify new max thread latency +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: b9f451a9029a16eb7913ace09b92493d00f2e564 + +commit b9f451a9029a16eb7913ace09b92493d00f2e564 upstream. + +timerlat is not reporting a new tracing_max_latency for the thread +latency. The reason is that it is not calling notify_new_max_latency() +function after the new thread latency is sampled. + +Call notify_new_max_latency() after computing the thread latency. + +Link: https://lkml.kernel.org/r/16e18d61d69073d0192ace07bf61e405cca96e9c.1680104184.git.bristot@kernel.org + +Cc: stable@vger.kernel.org +Fixes: dae181349f1e ("tracing/osnoise: Support a list of trace_array *tr") +Signed-off-by: Daniel Bristot de Oliveira +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/trace/trace_osnoise.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c +index 210e1f16..c732287f 100644 +--- a/kernel/trace/trace_osnoise.c ++++ b/kernel/trace/trace_osnoise.c +@@ -1738,6 +1738,8 @@ static int timerlat_main(void *data) + + trace_timerlat_sample(&s); + ++ notify_new_max_latency(diff); ++ + timerlat_dump_stack(time_to_us(diff)); + + tlat->tracing_thread = false; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-123-tracing-osnoise-Fix-notify-new-tracing_max_lat.patch b/patches.kernel.org/6.2.11-123-tracing-osnoise-Fix-notify-new-tracing_max_lat.patch new file mode 100644 index 0000000..8ce8dba --- /dev/null +++ b/patches.kernel.org/6.2.11-123-tracing-osnoise-Fix-notify-new-tracing_max_lat.patch @@ -0,0 +1,42 @@ +From: Daniel Bristot de Oliveira +Date: Wed, 29 Mar 2023 17:50:16 +0200 +Subject: [PATCH] tracing/osnoise: Fix notify new tracing_max_latency +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: d3cba7f02cd82118c32651c73374d8a5a459d9a6 + +commit d3cba7f02cd82118c32651c73374d8a5a459d9a6 upstream. + +osnoise/timerlat tracers are reporting new max latency on instances +where the tracing is off, creating inconsistencies between the max +reported values in the trace and in the tracing_max_latency. Thus +only report new tracing_max_latency on active tracing instances. + +Link: https://lkml.kernel.org/r/ecd109fde4a0c24ab0f00ba1e9a144ac19a91322.1680104184.git.bristot@kernel.org + +Cc: stable@vger.kernel.org +Fixes: dae181349f1e ("tracing/osnoise: Support a list of trace_array *tr") +Signed-off-by: Daniel Bristot de Oliveira +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/trace/trace_osnoise.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c +index c732287f..2a1b337a 100644 +--- a/kernel/trace/trace_osnoise.c ++++ b/kernel/trace/trace_osnoise.c +@@ -1296,7 +1296,7 @@ static void notify_new_max_latency(u64 latency) + rcu_read_lock(); + list_for_each_entry_rcu(inst, &osnoise_instances, list) { + tr = inst->tr; +- if (tr->max_latency < latency) { ++ if (tracer_tracing_is_on(tr) && tr->max_latency < latency) { + tr->max_latency = latency; + latency_fsnotify(tr); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-124-tracing-Free-error-logs-of-tracing-instances.patch b/patches.kernel.org/6.2.11-124-tracing-Free-error-logs-of-tracing-instances.patch new file mode 100644 index 0000000..f696c04 --- /dev/null +++ b/patches.kernel.org/6.2.11-124-tracing-Free-error-logs-of-tracing-instances.patch @@ -0,0 +1,99 @@ +From: "Steven Rostedt (Google)" +Date: Tue, 4 Apr 2023 19:45:04 -0400 +Subject: [PATCH] tracing: Free error logs of tracing instances +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 3357c6e429643231e60447b52ffbb7ac895aca22 + +commit 3357c6e429643231e60447b52ffbb7ac895aca22 upstream. + +When a tracing instance is removed, the error messages that hold errors +that occurred in the instance needs to be freed. The following reports a +memory leak: + + # cd /sys/kernel/tracing + # mkdir instances/foo + # echo 'hist:keys=x' > instances/foo/events/sched/sched_switch/trigger + # cat instances/foo/error_log + [ 117.404795] hist:sched:sched_switch: error: Couldn't find field + Command: hist:keys=x + ^ + # rmdir instances/foo + +Then check for memory leaks: + + # echo scan > /sys/kernel/debug/kmemleak + # cat /sys/kernel/debug/kmemleak +unreferenced object 0xffff88810d8ec700 (size 192): + comm "bash", pid 869, jiffies 4294950577 (age 215.752s) + hex dump (first 32 bytes): + 60 dd 68 61 81 88 ff ff 60 dd 68 61 81 88 ff ff `.ha....`.ha.... + a0 30 8c 83 ff ff ff ff 26 00 0a 00 00 00 00 00 .0......&....... + backtrace: + [<00000000dae26536>] kmalloc_trace+0x2a/0xa0 + [<00000000b2938940>] tracing_log_err+0x277/0x2e0 + [<000000004a0e1b07>] parse_atom+0x966/0xb40 + [<0000000023b24337>] parse_expr+0x5f3/0xdb0 + [<00000000594ad074>] event_hist_trigger_parse+0x27f8/0x3560 + [<00000000293a9645>] trigger_process_regex+0x135/0x1a0 + [<000000005c22b4f2>] event_trigger_write+0x87/0xf0 + [<000000002cadc509>] vfs_write+0x162/0x670 + [<0000000059c3b9be>] ksys_write+0xca/0x170 + [<00000000f1cddc00>] do_syscall_64+0x3e/0xc0 + [<00000000868ac68c>] entry_SYSCALL_64_after_hwframe+0x72/0xdc +unreferenced object 0xffff888170c35a00 (size 32): + comm "bash", pid 869, jiffies 4294950577 (age 215.752s) + hex dump (first 32 bytes): + 0a 20 20 43 6f 6d 6d 61 6e 64 3a 20 68 69 73 74 . Command: hist + 3a 6b 65 79 73 3d 78 0a 00 00 00 00 00 00 00 00 :keys=x......... + backtrace: + [<000000006a747de5>] __kmalloc+0x4d/0x160 + [<000000000039df5f>] tracing_log_err+0x29b/0x2e0 + [<000000004a0e1b07>] parse_atom+0x966/0xb40 + [<0000000023b24337>] parse_expr+0x5f3/0xdb0 + [<00000000594ad074>] event_hist_trigger_parse+0x27f8/0x3560 + [<00000000293a9645>] trigger_process_regex+0x135/0x1a0 + [<000000005c22b4f2>] event_trigger_write+0x87/0xf0 + [<000000002cadc509>] vfs_write+0x162/0x670 + [<0000000059c3b9be>] ksys_write+0xca/0x170 + [<00000000f1cddc00>] do_syscall_64+0x3e/0xc0 + [<00000000868ac68c>] entry_SYSCALL_64_after_hwframe+0x72/0xdc + +The problem is that the error log needs to be freed when the instance is +removed. + +Link: https://lore.kernel.org/lkml/76134d9f-a5ba-6a0d-37b3-28310b4a1e91@alu.unizg.hr/ +Link: https://lore.kernel.org/linux-trace-kernel/20230404194504.5790b95f@gandalf.local.home + +Cc: stable@vger.kernel.org +Cc: Masami Hiramatsu +Cc: Andrew Morton +Cc: Mark Rutland +Cc: Thorsten Leemhuis +Cc: Ulf Hansson +Cc: Eric Biggers +Fixes: 2f754e771b1a6 ("tracing: Have the error logs show up in the proper instances") +Reported-by: Mirsad Goran Todorovac +Tested-by: Mirsad Todorovac +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/trace/trace.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 1b692574..1a931896 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -9472,6 +9472,7 @@ static int __remove_instance(struct trace_array *tr) + tracefs_remove(tr->dir); + free_percpu(tr->last_func_repeats); + free_trace_buffers(tr); ++ clear_tracing_err_log(tr); + + for (i = 0; i < tr->nr_topts; i++) { + kfree(tr->topts[i].topts); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-125-iommufd-Check-for-uptr-overflow.patch b/patches.kernel.org/6.2.11-125-iommufd-Check-for-uptr-overflow.patch new file mode 100644 index 0000000..323d82e --- /dev/null +++ b/patches.kernel.org/6.2.11-125-iommufd-Check-for-uptr-overflow.patch @@ -0,0 +1,86 @@ +From: Jason Gunthorpe +Date: Fri, 31 Mar 2023 12:32:24 -0300 +Subject: [PATCH] iommufd: Check for uptr overflow +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: e4395701330fc4aee530905039516fe770b81417 + +commit e4395701330fc4aee530905039516fe770b81417 upstream. + +syzkaller found that setting up a map with a user VA that wraps past zero +can trigger WARN_ONs, particularly from pin_user_pages weirdly returning 0 +due to invalid arguments. + +Prevent creating a pages with a uptr and size that would math overflow. + + WARNING: CPU: 0 PID: 518 at drivers/iommu/iommufd/pages.c:793 pfn_reader_user_pin+0x2e6/0x390 + Modules linked in: + CPU: 0 PID: 518 Comm: repro Not tainted 6.3.0-rc2-eeac8ede1755+ #1 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 + RIP: 0010:pfn_reader_user_pin+0x2e6/0x390 + Code: b1 11 e9 25 fe ff ff e8 28 e4 0f ff 31 ff 48 89 de e8 2e e6 0f ff 48 85 db 74 0a e8 14 e4 0f ff e9 4d ff ff ff e8 0a e4 0f ff <0f> 0b bb f2 ff ff ff e9 3c ff ff ff e8 f9 e3 0f ff ba 01 00 00 00 + RSP: 0018:ffffc90000f9fa30 EFLAGS: 00010246 + RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff821e2b72 + RDX: 0000000000000000 RSI: ffff888014184680 RDI: 0000000000000002 + RBP: ffffc90000f9fa78 R08: 00000000000000ff R09: 0000000079de6f4e + R10: ffffc90000f9f790 R11: ffff888014185418 R12: ffffc90000f9fc60 + R13: 0000000000000002 R14: ffff888007879800 R15: 0000000000000000 + FS: 00007f4227555740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000020000043 CR3: 000000000e748005 CR4: 0000000000770ef0 + PKRU: 55555554 + Call Trace: + + pfn_reader_next+0x14a/0x7b0 + ? interval_tree_double_span_iter_update+0x11a/0x140 + pfn_reader_first+0x140/0x1b0 + iopt_pages_rw_slow+0x71/0x280 + ? __this_cpu_preempt_check+0x20/0x30 + iopt_pages_rw_access+0x2b2/0x5b0 + iommufd_access_rw+0x19f/0x2f0 + iommufd_test+0xd11/0x16f0 + ? write_comp_data+0x2f/0x90 + iommufd_fops_ioctl+0x206/0x330 + __x64_sys_ioctl+0x10e/0x160 + ? __pfx_iommufd_fops_ioctl+0x10/0x10 + do_syscall_64+0x3b/0x90 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Cc: +Fixes: 8d160cd4d506 ("iommufd: Algorithms for PFN storage") +Link: https://lore.kernel.org/r/1-v1-ceab6a4d7d7a+94-iommufd_syz_jgg@nvidia.com +Reviewed-by: Kevin Tian +Reported-by: Pengfei Xu +Tested-by: Pengfei Xu +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iommu/iommufd/pages.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c +index 1e1d3509..22be85ef 100644 +--- a/drivers/iommu/iommufd/pages.c ++++ b/drivers/iommu/iommufd/pages.c +@@ -1140,6 +1140,7 @@ struct iopt_pages *iopt_alloc_pages(void __user *uptr, unsigned long length, + bool writable) + { + struct iopt_pages *pages; ++ unsigned long end; + + /* + * The iommu API uses size_t as the length, and protect the DIV_ROUND_UP +@@ -1148,6 +1149,9 @@ struct iopt_pages *iopt_alloc_pages(void __user *uptr, unsigned long length, + if (length > SIZE_MAX - PAGE_SIZE || length == 0) + return ERR_PTR(-EINVAL); + ++ if (check_add_overflow((unsigned long)uptr, length, &end)) ++ return ERR_PTR(-EOVERFLOW); ++ + pages = kzalloc(sizeof(*pages), GFP_KERNEL_ACCOUNT); + if (!pages) + return ERR_PTR(-ENOMEM); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-126-iommufd-Fix-unpinning-of-pages-when-an-access-.patch b/patches.kernel.org/6.2.11-126-iommufd-Fix-unpinning-of-pages-when-an-access-.patch new file mode 100644 index 0000000..04216d2 --- /dev/null +++ b/patches.kernel.org/6.2.11-126-iommufd-Fix-unpinning-of-pages-when-an-access-.patch @@ -0,0 +1,92 @@ +From: Jason Gunthorpe +Date: Fri, 31 Mar 2023 12:32:25 -0300 +Subject: [PATCH] iommufd: Fix unpinning of pages when an access is present +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 727c28c1cef2bc013d2c8bb6c50e410a3882a04e + +commit 727c28c1cef2bc013d2c8bb6c50e410a3882a04e upstream. + +syzkaller found that the calculation of batch_last_index should use +'start_index' since at input to this function the batch is either empty or +it has already been adjusted to cross any accesses so it will start at the +point we are unmapping from. + +Getting this wrong causes the unmap to run over the end of the pages +which corrupts pages that were never mapped. In most cases this triggers +the num pinned debugging: + + WARNING: CPU: 0 PID: 557 at drivers/iommu/iommufd/pages.c:294 __iopt_area_unfill_domain+0x152/0x560 + Modules linked in: + CPU: 0 PID: 557 Comm: repro Not tainted 6.3.0-rc2-eeac8ede1755 #1 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 + RIP: 0010:__iopt_area_unfill_domain+0x152/0x560 + Code: d2 0f ff 44 8b 64 24 54 48 8b 44 24 48 31 ff 44 89 e6 48 89 44 24 38 e8 fc d3 0f ff 45 85 e4 0f 85 eb 01 00 00 e8 0e d2 0f ff <0f> 0b e8 07 d2 0f ff 48 8b 44 24 38 89 5c 24 58 89 18 8b 44 24 54 + RSP: 0018:ffffc9000108baf0 EFLAGS: 00010246 + RAX: 0000000000000000 RBX: 00000000ffffffff RCX: ffffffff821e3f85 + RDX: 0000000000000000 RSI: ffff88800faf0000 RDI: 0000000000000002 + RBP: ffffc9000108bd18 R08: 000000000003ca25 R09: 0000000000000014 + R10: 000000000003ca00 R11: 0000000000000024 R12: 0000000000000004 + R13: 0000000000000801 R14: 00000000000007ff R15: 0000000000000800 + FS: 00007f3499ce1740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000020000243 CR3: 00000000179c2001 CR4: 0000000000770ef0 + PKRU: 55555554 + Call Trace: + + iopt_area_unfill_domain+0x32/0x40 + iopt_table_remove_domain+0x23f/0x4c0 + iommufd_device_selftest_detach+0x3a/0x90 + iommufd_selftest_destroy+0x55/0x70 + iommufd_object_destroy_user+0xce/0x130 + iommufd_destroy+0xa2/0xc0 + iommufd_fops_ioctl+0x206/0x330 + __x64_sys_ioctl+0x10e/0x160 + do_syscall_64+0x3b/0x90 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Also add some useful WARN_ON sanity checks. + +Cc: +Fixes: 8d160cd4d506 ("iommufd: Algorithms for PFN storage") +Link: https://lore.kernel.org/r/2-v1-ceab6a4d7d7a+94-iommufd_syz_jgg@nvidia.com +Reviewed-by: Kevin Tian +Reported-by: Pengfei Xu +Tested-by: Pengfei Xu +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iommu/iommufd/pages.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c +index 22be85ef..93bae13e 100644 +--- a/drivers/iommu/iommufd/pages.c ++++ b/drivers/iommu/iommufd/pages.c +@@ -1205,13 +1205,21 @@ iopt_area_unpin_domain(struct pfn_batch *batch, struct iopt_area *area, + unsigned long start = + max(start_index, *unmapped_end_index); + ++ if (IS_ENABLED(CONFIG_IOMMUFD_TEST) && ++ batch->total_pfns) ++ WARN_ON(*unmapped_end_index - ++ batch->total_pfns != ++ start_index); + batch_from_domain(batch, domain, area, start, + last_index); +- batch_last_index = start + batch->total_pfns - 1; ++ batch_last_index = start_index + batch->total_pfns - 1; + } else { + batch_last_index = last_index; + } + ++ if (IS_ENABLED(CONFIG_IOMMUFD_TEST)) ++ WARN_ON(batch_last_index > real_last_index); ++ + /* + * unmaps must always 'cut' at a place where the pfns are not + * contiguous to pair with the maps that always install +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-127-iommufd-Do-not-corrupt-the-pfn-list-when-doing.patch b/patches.kernel.org/6.2.11-127-iommufd-Do-not-corrupt-the-pfn-list-when-doing.patch new file mode 100644 index 0000000..726dbc6 --- /dev/null +++ b/patches.kernel.org/6.2.11-127-iommufd-Do-not-corrupt-the-pfn-list-when-doing.patch @@ -0,0 +1,79 @@ +From: Jason Gunthorpe +Date: Fri, 31 Mar 2023 12:32:26 -0300 +Subject: [PATCH] iommufd: Do not corrupt the pfn list when doing batch carry +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 13a0d1ae7ee6b438f5537711a8c60cba00554943 + +commit 13a0d1ae7ee6b438f5537711a8c60cba00554943 upstream. + +If batch->end is 0 then setting npfns[0] before computing the new value of +pfns will fail to adjust the pfn and result in various page accounting +corruptions. It should be ordered after. + +This seems to result in various kinds of page meta-data corruption related +failures: + + WARNING: CPU: 1 PID: 527 at mm/gup.c:75 try_grab_folio+0x503/0x740 + Modules linked in: + CPU: 1 PID: 527 Comm: repro Not tainted 6.3.0-rc2-eeac8ede1755+ #1 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 + RIP: 0010:try_grab_folio+0x503/0x740 + Code: e3 01 48 89 de e8 6d c1 dd ff 48 85 db 0f 84 7c fe ff ff e8 4f bf dd ff 49 8d 47 ff 48 89 45 d0 e9 73 fe ff ff e8 3d bf dd ff <0f> 0b 31 db e9 d0 fc ff ff e8 2f bf dd ff 48 8b 5d c8 31 ff 48 89 + RSP: 0018:ffffc90000f37908 EFLAGS: 00010046 + RAX: 0000000000000000 RBX: 00000000fffffc02 RCX: ffffffff81504c26 + RDX: 0000000000000000 RSI: ffff88800d030000 RDI: 0000000000000002 + RBP: ffffc90000f37948 R08: 000000000003ca24 R09: 0000000000000008 + R10: 000000000003ca00 R11: 0000000000000023 R12: ffffea000035d540 + R13: 0000000000000001 R14: 0000000000000000 R15: ffffea000035d540 + FS: 00007fecbf659740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00000000200011c3 CR3: 000000000ef66006 CR4: 0000000000770ee0 + PKRU: 55555554 + Call Trace: + + internal_get_user_pages_fast+0xd32/0x2200 + pin_user_pages_fast+0x65/0x90 + pfn_reader_user_pin+0x376/0x390 + pfn_reader_next+0x14a/0x7b0 + pfn_reader_first+0x140/0x1b0 + iopt_area_fill_domain+0x74/0x210 + iopt_table_add_domain+0x30e/0x6e0 + iommufd_device_selftest_attach+0x7f/0x140 + iommufd_test+0x10ff/0x16f0 + iommufd_fops_ioctl+0x206/0x330 + __x64_sys_ioctl+0x10e/0x160 + do_syscall_64+0x3b/0x90 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Cc: +Fixes: f394576eb11d ("iommufd: PFN handling for iopt_pages") +Link: https://lore.kernel.org/r/3-v1-ceab6a4d7d7a+94-iommufd_syz_jgg@nvidia.com +Reviewed-by: Kevin Tian +Reported-by: Pengfei Xu +Tested-by: Pengfei Xu +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iommu/iommufd/pages.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c +index 93bae13e..105e0c4d 100644 +--- a/drivers/iommu/iommufd/pages.c ++++ b/drivers/iommu/iommufd/pages.c +@@ -294,9 +294,9 @@ static void batch_clear_carry(struct pfn_batch *batch, unsigned int keep_pfns) + batch->npfns[batch->end - 1] < keep_pfns); + + batch->total_pfns = keep_pfns; +- batch->npfns[0] = keep_pfns; + batch->pfns[0] = batch->pfns[batch->end - 1] + + (batch->npfns[batch->end - 1] - keep_pfns); ++ batch->npfns[0] = keep_pfns; + batch->end = 0; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-128-ASoC-hdac_hdmi-use-set_stream-instead-of-set_t.patch b/patches.kernel.org/6.2.11-128-ASoC-hdac_hdmi-use-set_stream-instead-of-set_t.patch new file mode 100644 index 0000000..dd77ddf --- /dev/null +++ b/patches.kernel.org/6.2.11-128-ASoC-hdac_hdmi-use-set_stream-instead-of-set_t.patch @@ -0,0 +1,75 @@ +From: Jason Montleon +Date: Fri, 24 Mar 2023 13:07:11 -0400 +Subject: [PATCH] ASoC: hdac_hdmi: use set_stream() instead of set_tdm_slots() +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: f6887a71bdd2f0dcba9b8180dd2223cfa8637e85 + +commit f6887a71bdd2f0dcba9b8180dd2223cfa8637e85 upstream. + +hdac_hdmi was not updated to use set_stream() instead of set_tdm_slots() +in the original commit so HDMI no longer produces audio. + +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/regressions/CAJD_bPKQdtaExvVEKxhQ47G-ZXDA=k+gzhMJRHLBe=mysPnuKA@mail.gmail.com/ +Fixes: 636110411ca7 ("ASoC: Intel/SOF: use set_stream() instead of set_tdm_slots() for HDAudio") +Signed-off-by: Jason Montleon +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20230324170711.2526-1-jmontleo@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + sound/soc/codecs/hdac_hdmi.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c +index ed4f7cdd..8b6b7602 100644 +--- a/sound/soc/codecs/hdac_hdmi.c ++++ b/sound/soc/codecs/hdac_hdmi.c +@@ -436,23 +436,28 @@ static int hdac_hdmi_setup_audio_infoframe(struct hdac_device *hdev, + return 0; + } + +-static int hdac_hdmi_set_tdm_slot(struct snd_soc_dai *dai, +- unsigned int tx_mask, unsigned int rx_mask, +- int slots, int slot_width) ++static int hdac_hdmi_set_stream(struct snd_soc_dai *dai, ++ void *stream, int direction) + { + struct hdac_hdmi_priv *hdmi = snd_soc_dai_get_drvdata(dai); + struct hdac_device *hdev = hdmi->hdev; + struct hdac_hdmi_dai_port_map *dai_map; + struct hdac_hdmi_pcm *pcm; ++ struct hdac_stream *hstream; + +- dev_dbg(&hdev->dev, "%s: strm_tag: %d\n", __func__, tx_mask); ++ if (!stream) ++ return -EINVAL; ++ ++ hstream = (struct hdac_stream *)stream; ++ ++ dev_dbg(&hdev->dev, "%s: strm_tag: %d\n", __func__, hstream->stream_tag); + + dai_map = &hdmi->dai_map[dai->id]; + + pcm = hdac_hdmi_get_pcm_from_cvt(hdmi, dai_map->cvt); + + if (pcm) +- pcm->stream_tag = (tx_mask << 4); ++ pcm->stream_tag = (hstream->stream_tag << 4); + + return 0; + } +@@ -1544,7 +1549,7 @@ static const struct snd_soc_dai_ops hdmi_dai_ops = { + .startup = hdac_hdmi_pcm_open, + .shutdown = hdac_hdmi_pcm_close, + .hw_params = hdac_hdmi_set_hw_params, +- .set_tdm_slot = hdac_hdmi_set_tdm_slot, ++ .set_stream = hdac_hdmi_set_stream, + }; + + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-129-ASoC-SOF-avoid-a-NULL-dereference-with-unsuppo.patch b/patches.kernel.org/6.2.11-129-ASoC-SOF-avoid-a-NULL-dereference-with-unsuppo.patch new file mode 100644 index 0000000..0ff20a2 --- /dev/null +++ b/patches.kernel.org/6.2.11-129-ASoC-SOF-avoid-a-NULL-dereference-with-unsuppo.patch @@ -0,0 +1,46 @@ +From: Guennadi Liakhovetski +Date: Wed, 29 Mar 2023 14:38:28 +0300 +Subject: [PATCH] ASoC: SOF: avoid a NULL dereference with unsupported widgets +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: e3720f92e0237921da537e47a0b24e27899203f8 + +commit e3720f92e0237921da537e47a0b24e27899203f8 upstream. + +If an IPC4 topology contains an unsupported widget, its .module_info +field won't be set, then sof_ipc4_route_setup() will cause a kernel +Oops trying to dereference it. Add a check for such cases. + +Cc: stable@vger.kernel.org # 6.2 +Signed-off-by: Guennadi Liakhovetski +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20230329113828.28562-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + sound/soc/sof/ipc4-topology.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c +index 6da6137f..4f7adbe6 100644 +--- a/sound/soc/sof/ipc4-topology.c ++++ b/sound/soc/sof/ipc4-topology.c +@@ -1686,6 +1686,14 @@ static int sof_ipc4_route_setup(struct snd_sof_dev *sdev, struct snd_sof_route * + u32 header, extension; + int ret; + ++ if (!src_fw_module || !sink_fw_module) { ++ /* The NULL module will print as "(efault)" */ ++ dev_err(sdev->dev, "source %s or sink %s widget weren't set up properly\n", ++ src_fw_module->man4_module_entry.name, ++ sink_fw_module->man4_module_entry.name); ++ return -ENODEV; ++ } ++ + sroute->src_queue_id = sof_ipc4_get_queue_id(src_widget, sink_widget, + SOF_PIN_TYPE_SOURCE); + if (sroute->src_queue_id < 0) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-130-iio-adc-ad7791-fix-IRQ-flags.patch b/patches.kernel.org/6.2.11-130-iio-adc-ad7791-fix-IRQ-flags.patch new file mode 100644 index 0000000..8df4edd --- /dev/null +++ b/patches.kernel.org/6.2.11-130-iio-adc-ad7791-fix-IRQ-flags.patch @@ -0,0 +1,41 @@ +From: =?UTF-8?q?Nuno=20S=C3=A1?= +Date: Fri, 20 Jan 2023 13:46:45 +0100 +Subject: [PATCH] iio: adc: ad7791: fix IRQ flags +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 0c6ef985a1fd8a74dcb5cad941ddcadd55cb8697 + +[ Upstream commit 0c6ef985a1fd8a74dcb5cad941ddcadd55cb8697 ] + +The interrupt is triggered on the falling edge rather than being a level +low interrupt. + +Fixes: da4d3d6bb9f6 ("iio: adc: ad-sigma-delta: Allow custom IRQ flags") +Signed-off-by: Nuno Sá +Link: https://lore.kernel.org/r/20230120124645.819910-1-nuno.sa@analog.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/iio/adc/ad7791.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/adc/ad7791.c b/drivers/iio/adc/ad7791.c +index fee8d129..86effe85 100644 +--- a/drivers/iio/adc/ad7791.c ++++ b/drivers/iio/adc/ad7791.c +@@ -253,7 +253,7 @@ static const struct ad_sigma_delta_info ad7791_sigma_delta_info = { + .has_registers = true, + .addr_shift = 4, + .read_mask = BIT(3), +- .irq_flags = IRQF_TRIGGER_LOW, ++ .irq_flags = IRQF_TRIGGER_FALLING, + }; + + static int ad7791_read_raw(struct iio_dev *indio_dev, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-131-io_uring-fix-return-value-when-removing-provid.patch b/patches.kernel.org/6.2.11-131-io_uring-fix-return-value-when-removing-provid.patch new file mode 100644 index 0000000..f916774 --- /dev/null +++ b/patches.kernel.org/6.2.11-131-io_uring-fix-return-value-when-removing-provid.patch @@ -0,0 +1,51 @@ +From: Wojciech Lukowicz +Date: Sat, 1 Apr 2023 20:50:38 +0100 +Subject: [PATCH] io_uring: fix return value when removing provided buffers +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: c0921e51dab767ef5adf6175c4a0ba3c6e1074a3 + +[ Upstream commit c0921e51dab767ef5adf6175c4a0ba3c6e1074a3 ] + +When a request to remove buffers is submitted, and the given number to be +removed is larger than available in the specified buffer group, the +resulting CQE result will be the number of removed buffers + 1, which is +1 more than it should be. + +Previously, the head was part of the list and it got removed after the +loop, so the increment was needed. Now, the head is not an element of +the list, so the increment shouldn't be there anymore. + +Fixes: dbc7d452e7cf ("io_uring: manage provided buffers strictly ordered") +Signed-off-by: Wojciech Lukowicz +Link: https://lore.kernel.org/r/20230401195039.404909-2-wlukowicz01@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + io_uring/kbuf.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c +index 3002dc82..0fdcc0ad 100644 +--- a/io_uring/kbuf.c ++++ b/io_uring/kbuf.c +@@ -228,7 +228,6 @@ static int __io_remove_buffers(struct io_ring_ctx *ctx, + return i; + } + +- /* the head kbuf is the list itself */ + while (!list_empty(&bl->buf_list)) { + struct io_buffer *nxt; + +@@ -238,7 +237,6 @@ static int __io_remove_buffers(struct io_ring_ctx *ctx, + return i; + cond_resched(); + } +- i++; + + return i; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-132-io_uring-fix-memory-leak-when-removing-provide.patch b/patches.kernel.org/6.2.11-132-io_uring-fix-memory-leak-when-removing-provide.patch new file mode 100644 index 0000000..f65739e --- /dev/null +++ b/patches.kernel.org/6.2.11-132-io_uring-fix-memory-leak-when-removing-provide.patch @@ -0,0 +1,64 @@ +From: Wojciech Lukowicz +Date: Sat, 1 Apr 2023 20:50:39 +0100 +Subject: [PATCH] io_uring: fix memory leak when removing provided buffers +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: b4a72c0589fdea6259720375426179888969d6a2 + +[ Upstream commit b4a72c0589fdea6259720375426179888969d6a2 ] + +When removing provided buffers, io_buffer structs are not being disposed +of, leading to a memory leak. They can't be freed individually, because +they are allocated in page-sized groups. They need to be added to some +free list instead, such as io_buffers_cache. All callers already hold +the lock protecting it, apart from when destroying buffers, so had to +extend the lock there. + +Fixes: cc3cec8367cb ("io_uring: speedup provided buffer handling") +Signed-off-by: Wojciech Lukowicz +Link: https://lore.kernel.org/r/20230401195039.404909-2-wlukowicz01@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + io_uring/io_uring.c | 2 +- + io_uring/kbuf.c | 5 ++++- + 2 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index a4e9dbc7..add5cff7 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -2722,8 +2722,8 @@ static __cold void io_ring_ctx_free(struct io_ring_ctx *ctx) + io_eventfd_unregister(ctx); + io_alloc_cache_free(&ctx->apoll_cache, io_apoll_cache_free); + io_alloc_cache_free(&ctx->netmsg_cache, io_netmsg_cache_free); +- mutex_unlock(&ctx->uring_lock); + io_destroy_buffers(ctx); ++ mutex_unlock(&ctx->uring_lock); + if (ctx->sq_creds) + put_cred(ctx->sq_creds); + if (ctx->submitter_task) +diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c +index 0fdcc0ad..a90c820c 100644 +--- a/io_uring/kbuf.c ++++ b/io_uring/kbuf.c +@@ -228,11 +228,14 @@ static int __io_remove_buffers(struct io_ring_ctx *ctx, + return i; + } + ++ /* protects io_buffers_cache */ ++ lockdep_assert_held(&ctx->uring_lock); ++ + while (!list_empty(&bl->buf_list)) { + struct io_buffer *nxt; + + nxt = list_first_entry(&bl->buf_list, struct io_buffer, list); +- list_del(&nxt->list); ++ list_move(&nxt->list, &ctx->io_buffers_cache); + if (++i == nbufs) + return i; + cond_resched(); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-133-scsi-qla2xxx-Fix-memory-leak-in-qla2x00_probe_.patch b/patches.kernel.org/6.2.11-133-scsi-qla2xxx-Fix-memory-leak-in-qla2x00_probe_.patch new file mode 100644 index 0000000..b868278 --- /dev/null +++ b/patches.kernel.org/6.2.11-133-scsi-qla2xxx-Fix-memory-leak-in-qla2x00_probe_.patch @@ -0,0 +1,59 @@ +From: Li Zetao +Date: Sat, 25 Mar 2023 11:00:04 +0000 +Subject: [PATCH] scsi: qla2xxx: Fix memory leak in qla2x00_probe_one() +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 85ade4010e13ef152ea925c74d94253db92e5428 + +[ Upstream commit 85ade4010e13ef152ea925c74d94253db92e5428 ] + +There is a memory leak reported by kmemleak: + + unreferenced object 0xffffc900003f0000 (size 12288): + comm "modprobe", pid 19117, jiffies 4299751452 (age 42490.264s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<00000000629261a8>] __vmalloc_node_range+0xe56/0x1110 + [<0000000001906886>] __vmalloc_node+0xbd/0x150 + [<000000005bb4dc34>] vmalloc+0x25/0x30 + [<00000000a2dc1194>] qla2x00_create_host+0x7a0/0xe30 [qla2xxx] + [<0000000062b14b47>] qla2x00_probe_one+0x2eb8/0xd160 [qla2xxx] + [<00000000641ccc04>] local_pci_probe+0xeb/0x1a0 + +The root cause is traced to an error-handling path in qla2x00_probe_one() +when the adapter "base_vha" initialize failed. The fab_scan_rp "scan.l" is +used to record the port information and it is allocated in +qla2x00_create_host(). However, it is not released in the error handling +path "probe_failed". + +Fix this by freeing the memory of "scan.l" when an error occurs in the +adapter initialization process. + +Fixes: a4239945b8ad ("scsi: qla2xxx: Add switch command to simplify fabric discovery") +Signed-off-by: Li Zetao +Link: https://lore.kernel.org/r/20230325110004.363898-1-lizetao1@huawei.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/qla2xxx/qla_os.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 02913cc7..901c5c80 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -3607,6 +3607,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + probe_failed: + qla_enode_stop(base_vha); + qla_edb_stop(base_vha); ++ vfree(base_vha->scan.l); + if (base_vha->gnl.l) { + dma_free_coherent(&ha->pdev->dev, base_vha->gnl.size, + base_vha->gnl.l, base_vha->gnl.ldma); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-134-scsi-iscsi_tcp-Check-that-sock-is-valid-before.patch b/patches.kernel.org/6.2.11-134-scsi-iscsi_tcp-Check-that-sock-is-valid-before.patch new file mode 100644 index 0000000..dd3128c --- /dev/null +++ b/patches.kernel.org/6.2.11-134-scsi-iscsi_tcp-Check-that-sock-is-valid-before.patch @@ -0,0 +1,50 @@ +From: Zhong Jinghua +Date: Wed, 29 Mar 2023 15:17:39 +0800 +Subject: [PATCH] scsi: iscsi_tcp: Check that sock is valid before + iscsi_set_param() +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 48b19b79cfa37b1e50da3b5a8af529f994c08901 + +[ Upstream commit 48b19b79cfa37b1e50da3b5a8af529f994c08901 ] + +The validity of sock should be checked before assignment to avoid incorrect +values. Commit 57569c37f0ad ("scsi: iscsi: iscsi_tcp: Fix null-ptr-deref +while calling getpeername()") introduced this change which may lead to +inconsistent values of tcp_sw_conn->sendpage and conn->datadgst_en. + +Fix the issue by moving the position of the assignment. + +Fixes: 57569c37f0ad ("scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()") +Signed-off-by: Zhong Jinghua +Link: https://lore.kernel.org/r/20230329071739.2175268-1-zhongjinghua@huaweicloud.com +Reviewed-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/iscsi_tcp.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c +index 0454d94e..e7a6fc01 100644 +--- a/drivers/scsi/iscsi_tcp.c ++++ b/drivers/scsi/iscsi_tcp.c +@@ -768,13 +768,12 @@ static int iscsi_sw_tcp_conn_set_param(struct iscsi_cls_conn *cls_conn, + iscsi_set_param(cls_conn, param, buf, buflen); + break; + case ISCSI_PARAM_DATADGST_EN: +- iscsi_set_param(cls_conn, param, buf, buflen); +- + mutex_lock(&tcp_sw_conn->sock_lock); + if (!tcp_sw_conn->sock) { + mutex_unlock(&tcp_sw_conn->sock_lock); + return -ENOTCONN; + } ++ iscsi_set_param(cls_conn, param, buf, buflen); + tcp_sw_conn->sendpage = conn->datadgst_en ? + sock_no_sendpage : tcp_sw_conn->sock->ops->sendpage; + mutex_unlock(&tcp_sw_conn->sock_lock); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-135-nvme-fix-discard-support-without-oncs.patch b/patches.kernel.org/6.2.11-135-nvme-fix-discard-support-without-oncs.patch new file mode 100644 index 0000000..41ae7e0 --- /dev/null +++ b/patches.kernel.org/6.2.11-135-nvme-fix-discard-support-without-oncs.patch @@ -0,0 +1,58 @@ +From: Keith Busch +Date: Mon, 3 Apr 2023 13:09:25 -0700 +Subject: [PATCH] nvme: fix discard support without oncs +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: d3205ab75e99a47539ec91ef85ba488f4ddfeaa9 + +[ Upstream commit d3205ab75e99a47539ec91ef85ba488f4ddfeaa9 ] + +The device can report discard support without setting the ONCS DSM bit. +When not set, the driver clears max_discard_size expecting it to be set +later. We don't know the size until we have the namespace format, +though, so setting it is deferred until configuring one, but the driver +was abandoning the discard settings due to that initial clearing. + +Move the max_discard_size calculation above the check for a '0' discard +size. + +Fixes: 1a86924e4f46475 ("nvme: fix interpretation of DMRSL") +Reported-by: Laurence Oberman +Signed-off-by: Keith Busch +Reviewed-by: Niklas Cassel +Reviewed-by: Sagi Grimberg +Tested-by: Laurence Oberman +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/nvme/host/core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 70b5e891..ee1b075d 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1717,6 +1717,9 @@ static void nvme_config_discard(struct gendisk *disk, struct nvme_ns *ns) + struct request_queue *queue = disk->queue; + u32 size = queue_logical_block_size(queue); + ++ if (ctrl->dmrsl && ctrl->dmrsl <= nvme_sect_to_lba(ns, UINT_MAX)) ++ ctrl->max_discard_sectors = nvme_lba_to_sect(ns, ctrl->dmrsl); ++ + if (ctrl->max_discard_sectors == 0) { + blk_queue_max_discard_sectors(queue, 0); + return; +@@ -1731,9 +1734,6 @@ static void nvme_config_discard(struct gendisk *disk, struct nvme_ns *ns) + if (queue->limits.max_discard_sectors) + return; + +- if (ctrl->dmrsl && ctrl->dmrsl <= nvme_sect_to_lba(ns, UINT_MAX)) +- ctrl->max_discard_sectors = nvme_lba_to_sect(ns, ctrl->dmrsl); +- + blk_queue_max_discard_sectors(queue, ctrl->max_discard_sectors); + blk_queue_max_discard_segments(queue, ctrl->max_discard_segments); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-136-cifs-sanitize-paths-in-cifs_update_super_prepa.patch b/patches.kernel.org/6.2.11-136-cifs-sanitize-paths-in-cifs_update_super_prepa.patch new file mode 100644 index 0000000..961ce5e --- /dev/null +++ b/patches.kernel.org/6.2.11-136-cifs-sanitize-paths-in-cifs_update_super_prepa.patch @@ -0,0 +1,99 @@ +From: Thiago Rafael Becker +Date: Wed, 5 Apr 2023 10:16:48 -0300 +Subject: [PATCH] cifs: sanitize paths in cifs_update_super_prepath. +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: d19342c6609b67f2ba83b9eccca2777e3687f625 + +[ Upstream commit d19342c6609b67f2ba83b9eccca2777e3687f625 ] + +After a server reboot, clients are failing to move files with ENOENT. +This is caused by DFS referrals containing multiple separators, which +the server move call doesn't recognize. + +v1: Initial patch. +v2: Move prototype to header. + +Link: https://bugzilla.redhat.com/show_bug.cgi?id=2182472 +Fixes: a31080899d5f ("cifs: sanitize multiple delimiters in prepath") +Actually-Fixes: 24e0a1eff9e2 ("cifs: switch to new mount api") +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Thiago Rafael Becker +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/cifs/fs_context.c | 13 +++++++------ + fs/cifs/fs_context.h | 3 +++ + fs/cifs/misc.c | 2 +- + 3 files changed, 11 insertions(+), 7 deletions(-) + +diff --git a/fs/cifs/fs_context.c b/fs/cifs/fs_context.c +index 6d13f820..ace11a1a 100644 +--- a/fs/cifs/fs_context.c ++++ b/fs/cifs/fs_context.c +@@ -441,13 +441,14 @@ int smb3_parse_opt(const char *options, const char *key, char **val) + * but there are some bugs that prevent rename from working if there are + * multiple delimiters. + * +- * Returns a sanitized duplicate of @path. The caller is responsible for +- * cleaning up the original. ++ * Returns a sanitized duplicate of @path. @gfp indicates the GFP_* flags ++ * for kstrdup. ++ * The caller is responsible for freeing the original. + */ + #define IS_DELIM(c) ((c) == '/' || (c) == '\\') +-static char *sanitize_path(char *path) ++char *cifs_sanitize_prepath(char *prepath, gfp_t gfp) + { +- char *cursor1 = path, *cursor2 = path; ++ char *cursor1 = prepath, *cursor2 = prepath; + + /* skip all prepended delimiters */ + while (IS_DELIM(*cursor1)) +@@ -469,7 +470,7 @@ static char *sanitize_path(char *path) + cursor2--; + + *(cursor2) = '\0'; +- return kstrdup(path, GFP_KERNEL); ++ return kstrdup(prepath, gfp); + } + + /* +@@ -531,7 +532,7 @@ smb3_parse_devname(const char *devname, struct smb3_fs_context *ctx) + if (!*pos) + return 0; + +- ctx->prepath = sanitize_path(pos); ++ ctx->prepath = cifs_sanitize_prepath(pos, GFP_KERNEL); + if (!ctx->prepath) + return -ENOMEM; + +diff --git a/fs/cifs/fs_context.h b/fs/cifs/fs_context.h +index 3de00e71..f4eaf855 100644 +--- a/fs/cifs/fs_context.h ++++ b/fs/cifs/fs_context.h +@@ -287,4 +287,7 @@ extern void smb3_update_mnt_flags(struct cifs_sb_info *cifs_sb); + */ + #define SMB3_MAX_DCLOSETIMEO (1 << 30) + #define SMB3_DEF_DCLOSETIMEO (1 * HZ) /* even 1 sec enough to help eg open/write/close/open/read */ ++ ++extern char *cifs_sanitize_prepath(char *prepath, gfp_t gfp); ++ + #endif +diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c +index 5542893e..2fae6b08 100644 +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -1297,7 +1297,7 @@ int cifs_update_super_prepath(struct cifs_sb_info *cifs_sb, char *prefix) + kfree(cifs_sb->prepath); + + if (prefix && *prefix) { +- cifs_sb->prepath = kstrdup(prefix, GFP_ATOMIC); ++ cifs_sb->prepath = cifs_sanitize_prepath(prefix, GFP_ATOMIC); + if (!cifs_sb->prepath) + return -ENOMEM; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-137-block-ublk-make-sure-that-block-size-is-set-co.patch b/patches.kernel.org/6.2.11-137-block-ublk-make-sure-that-block-size-is-set-co.patch new file mode 100644 index 0000000..10d4aa7 --- /dev/null +++ b/patches.kernel.org/6.2.11-137-block-ublk-make-sure-that-block-size-is-set-co.patch @@ -0,0 +1,52 @@ +From: Ming Lei +Date: Thu, 6 Apr 2023 20:40:59 +0800 +Subject: [PATCH] block: ublk: make sure that block size is set correctly +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 1d1665279a845d16c93687389e364386e3fe0f38 + +[ Upstream commit 1d1665279a845d16c93687389e364386e3fe0f38 ] + +block size is one very key setting for block layer, and bad block size +could panic kernel easily. + +Make sure that block size is set correctly. + +Meantime if ublk_validate_params() fails, clear ub->params so that disk +is prevented from being added. + +Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") +Reported-and-tested-by: Breno Leitao +Signed-off-by: Ming Lei +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/block/ublk_drv.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c +index 22a790d5..341f490f 100644 +--- a/drivers/block/ublk_drv.c ++++ b/drivers/block/ublk_drv.c +@@ -233,7 +233,7 @@ static int ublk_validate_params(const struct ublk_device *ub) + if (ub->params.types & UBLK_PARAM_TYPE_BASIC) { + const struct ublk_param_basic *p = &ub->params.basic; + +- if (p->logical_bs_shift > PAGE_SHIFT) ++ if (p->logical_bs_shift > PAGE_SHIFT || p->logical_bs_shift < 9) + return -EINVAL; + + if (p->logical_bs_shift > p->physical_bs_shift) +@@ -1886,6 +1886,8 @@ static int ublk_ctrl_set_params(struct io_uring_cmd *cmd) + /* clear all we don't support yet */ + ub->params.types &= UBLK_PARAM_TYPE_ALL; + ret = ublk_validate_params(ub); ++ if (ret) ++ ub->params.types = 0; + } + mutex_unlock(&ub->mutex); + ublk_put_device(ub); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-138-block-don-t-set-GD_NEED_PART_SCAN-if-scan-part.patch b/patches.kernel.org/6.2.11-138-block-don-t-set-GD_NEED_PART_SCAN-if-scan-part.patch new file mode 100644 index 0000000..8a65e90 --- /dev/null +++ b/patches.kernel.org/6.2.11-138-block-don-t-set-GD_NEED_PART_SCAN-if-scan-part.patch @@ -0,0 +1,76 @@ +From: Yu Kuai +Date: Wed, 22 Mar 2023 11:59:26 +0800 +Subject: [PATCH] block: don't set GD_NEED_PART_SCAN if scan partition failed +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 3723091ea1884d599cc8b8bf719d6f42e8d4d8b1 + +[ Upstream commit 3723091ea1884d599cc8b8bf719d6f42e8d4d8b1 ] + +Currently if disk_scan_partitions() failed, GD_NEED_PART_SCAN will still +set, and partition scan will be proceed again when blkdev_get_by_dev() +is called. However, this will cause a problem that re-assemble partitioned +raid device will creat partition for underlying disk. + +Test procedure: + +mdadm -CR /dev/md0 -l 1 -n 2 /dev/sda /dev/sdb -e 1.0 +sgdisk -n 0:0:+100MiB /dev/md0 +blockdev --rereadpt /dev/sda +blockdev --rereadpt /dev/sdb +mdadm -S /dev/md0 +mdadm -A /dev/md0 /dev/sda /dev/sdb + +Test result: underlying disk partition and raid partition can be +observed at the same time + +Note that this can still happen in come corner cases that +GD_NEED_PART_SCAN can be set for underlying disk while re-assemble raid +device. + +Fixes: e5cfefa97bcc ("block: fix scan partition for exclusively open device again") +Reviewed-by: Jan Kara +Reviewed-by: Ming Lei +Signed-off-by: Yu Kuai +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + block/genhd.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/block/genhd.c b/block/genhd.c +index 9c4c9aa5..70820326 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -368,7 +368,6 @@ int disk_scan_partitions(struct gendisk *disk, fmode_t mode) + if (disk->open_partitions) + return -EBUSY; + +- set_bit(GD_NEED_PART_SCAN, &disk->state); + /* + * If the device is opened exclusively by current thread already, it's + * safe to scan partitons, otherwise, use bd_prepare_to_claim() to +@@ -381,12 +380,19 @@ int disk_scan_partitions(struct gendisk *disk, fmode_t mode) + return ret; + } + ++ set_bit(GD_NEED_PART_SCAN, &disk->state); + bdev = blkdev_get_by_dev(disk_devt(disk), mode & ~FMODE_EXCL, NULL); + if (IS_ERR(bdev)) + ret = PTR_ERR(bdev); + else + blkdev_put(bdev, mode & ~FMODE_EXCL); + ++ /* ++ * If blkdev_get_by_dev() failed early, GD_NEED_PART_SCAN is still set, ++ * and this will cause that re-assemble partitioned raid device will ++ * creat partition for underlying disk. ++ */ ++ clear_bit(GD_NEED_PART_SCAN, &disk->state); + if (!(mode & FMODE_EXCL)) + bd_abort_claiming(disk->part0, disk_scan_partitions); + return ret; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-139-perf-Optimize-perf_pmu_migrate_context.patch b/patches.kernel.org/6.2.11-139-perf-Optimize-perf_pmu_migrate_context.patch new file mode 100644 index 0000000..73bdf2f --- /dev/null +++ b/patches.kernel.org/6.2.11-139-perf-Optimize-perf_pmu_migrate_context.patch @@ -0,0 +1,56 @@ +From: Peter Zijlstra +Date: Mon, 3 Apr 2023 11:08:58 +0200 +Subject: [PATCH] perf: Optimize perf_pmu_migrate_context() +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: b168098912926236bbeebaf7795eb7aab76d2b45 + +[ Upstream commit b168098912926236bbeebaf7795eb7aab76d2b45 ] + +Thomas reported that offlining CPUs spends a lot of time in +synchronize_rcu() as called from perf_pmu_migrate_context() even though +he's not actually using uncore events. + +Turns out, the thing is unconditionally waiting for RCU, even if there's +no actual events to migrate. + +Fixes: 0cda4c023132 ("perf: Introduce perf_pmu_migrate_context()") +Reported-by: Thomas Gleixner +Signed-off-by: Peter Zijlstra (Intel) +Tested-by: Thomas Gleixner +Reviewed-by: Thomas Gleixner +Reviewed-by: Paul E. McKenney +Link: https://lkml.kernel.org/r/20230403090858.GT4253@hirez.programming.kicks-ass.net +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/events/core.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index fad170b4..4b3205f6 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -12875,12 +12875,14 @@ void perf_pmu_migrate_context(struct pmu *pmu, int src_cpu, int dst_cpu) + __perf_pmu_remove(src_ctx, src_cpu, pmu, &src_ctx->pinned_groups, &events); + __perf_pmu_remove(src_ctx, src_cpu, pmu, &src_ctx->flexible_groups, &events); + +- /* +- * Wait for the events to quiesce before re-instating them. +- */ +- synchronize_rcu(); ++ if (!list_empty(&events)) { ++ /* ++ * Wait for the events to quiesce before re-instating them. ++ */ ++ synchronize_rcu(); + +- __perf_pmu_install(dst_ctx, dst_cpu, pmu, &events); ++ __perf_pmu_install(dst_ctx, dst_cpu, pmu, &events); ++ } + + mutex_unlock(&dst_ctx->mutex); + mutex_unlock(&src_ctx->mutex); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-140-perf-core-Fix-the-same-task-check-in-perf_even.patch b/patches.kernel.org/6.2.11-140-perf-core-Fix-the-same-task-check-in-perf_even.patch new file mode 100644 index 0000000..bb342ba --- /dev/null +++ b/patches.kernel.org/6.2.11-140-perf-core-Fix-the-same-task-check-in-perf_even.patch @@ -0,0 +1,74 @@ +From: Kan Liang +Date: Wed, 22 Mar 2023 13:24:49 -0700 +Subject: [PATCH] perf/core: Fix the same task check in perf_event_set_output +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 24d3ae2f37d8bc3c14b31d353c5d27baf582b6a6 + +[ Upstream commit 24d3ae2f37d8bc3c14b31d353c5d27baf582b6a6 ] + +The same task check in perf_event_set_output has some potential issues +for some usages. + +For the current perf code, there is a problem if using of +perf_event_open() to have multiple samples getting into the same mmap’d +memory when they are both attached to the same process. +https://lore.kernel.org/all/92645262-D319-4068-9C44-2409EF44888E@gmail.com/ +Because the event->ctx is not ready when the perf_event_set_output() is +invoked in the perf_event_open(). + +Besides the above issue, before the commit bd2756811766 ("perf: Rewrite +core context handling"), perf record can errors out when sampling with +a hardware event and a software event as below. + $ perf record -e cycles,dummy --per-thread ls + failed to mmap with 22 (Invalid argument) +That's because that prior to the commit a hardware event and a software +event are from different task context. + +The problem should be a long time issue since commit c3f00c70276d +("perk: Separate find_get_context() from event initialization"). + +The task struct is stored in the event->hw.target for each per-thread +event. It is a more reliable way to determine whether two events are +attached to the same task. + +The event->hw.target was also introduced several years ago by the +commit 50f16a8bf9d7 ("perf: Remove type specific target pointers"). It +can not only be used to fix the issue with the current code, but also +back port to fix the issues with an older kernel. + +Note: The event->hw.target was introduced later than commit +c3f00c70276d. The patch may cannot be applied between the commit +c3f00c70276d and commit 50f16a8bf9d7. Anybody that wants to back-port +this at that period may have to find other solutions. + +Fixes: c3f00c70276d ("perf: Separate find_get_context() from event initialization") +Signed-off-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Zhengjun Xing +Link: https://lkml.kernel.org/r/20230322202449.512091-1-kan.liang@linux.intel.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/events/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 4b3205f6..daecb8c9 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -12155,7 +12155,7 @@ perf_event_set_output(struct perf_event *event, struct perf_event *output_event) + /* + * If its not a per-cpu rb, it must be the same task. + */ +- if (output_event->cpu == -1 && output_event->ctx != event->ctx) ++ if (output_event->cpu == -1 && output_event->hw.target != event->hw.target) + goto out; + + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-141-tracing-synthetic-Make-lastcmd_mutex-static.patch b/patches.kernel.org/6.2.11-141-tracing-synthetic-Make-lastcmd_mutex-static.patch new file mode 100644 index 0000000..1dd98d6 --- /dev/null +++ b/patches.kernel.org/6.2.11-141-tracing-synthetic-Make-lastcmd_mutex-static.patch @@ -0,0 +1,44 @@ +From: "Steven Rostedt (Google)" +Date: Thu, 6 Apr 2023 11:10:33 -0400 +Subject: [PATCH] tracing/synthetic: Make lastcmd_mutex static +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 31c683967174b487939efaf65e41f5ff1404e141 + +commit 31c683967174b487939efaf65e41f5ff1404e141 upstream. + +The lastcmd_mutex is only used in trace_events_synth.c and should be +static. + +Link: https://lore.kernel.org/linux-trace-kernel/202304062033.cRStgOuP-lkp@intel.com/ +Link: https://lore.kernel.org/linux-trace-kernel/20230406111033.6e26de93@gandalf.local.home + +Cc: Masami Hiramatsu +Cc: Mark Rutland +Cc: Tze-nan Wu +Fixes: 4ccf11c4e8a8e ("tracing/synthetic: Fix races on freeing last_cmd") +Reviewed-by: Mukesh Ojha +Reported-by: kernel test robot +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/trace/trace_events_synth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/trace/trace_events_synth.c b/kernel/trace/trace_events_synth.c +index ea948939..89083ae1 100644 +--- a/kernel/trace/trace_events_synth.c ++++ b/kernel/trace/trace_events_synth.c +@@ -44,7 +44,7 @@ enum { ERRORS }; + + static const char *err_text[] = { ERRORS }; + +-DEFINE_MUTEX(lastcmd_mutex); ++static DEFINE_MUTEX(lastcmd_mutex); + static char *last_cmd; + + static int errpos(const char *str) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-142-zsmalloc-document-freeable-stats.patch b/patches.kernel.org/6.2.11-142-zsmalloc-document-freeable-stats.patch new file mode 100644 index 0000000..0a73248 --- /dev/null +++ b/patches.kernel.org/6.2.11-142-zsmalloc-document-freeable-stats.patch @@ -0,0 +1,40 @@ +From: Sergey Senozhatsky +Date: Sat, 25 Mar 2023 11:46:31 +0900 +Subject: [PATCH] zsmalloc: document freeable stats +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 618a8a917dbf5830e2064d2fa0568940eb5d2584 + +commit 618a8a917dbf5830e2064d2fa0568940eb5d2584 upstream. + +When freeable class stat was added to classes file (back in 2016) we +forgot to update zsmalloc documentation. Fix that. + +Link: https://lkml.kernel.org/r/20230325024631.2817153-3-senozhatsky@chromium.org +Fixes: 1120ed548394 ("mm/zsmalloc: add `freeable' column to pool stat") +Signed-off-by: Sergey Senozhatsky +Cc: Minchan Kim +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + Documentation/mm/zsmalloc.rst | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/Documentation/mm/zsmalloc.rst b/Documentation/mm/zsmalloc.rst +index 6e79893d..d98607aa 100644 +--- a/Documentation/mm/zsmalloc.rst ++++ b/Documentation/mm/zsmalloc.rst +@@ -68,6 +68,8 @@ pages_used + the number of pages allocated for the class + pages_per_zspage + the number of 0-order pages to make a zspage ++freeable ++ the approximate number of pages class compaction can free + + We assign a zspage to ZS_ALMOST_EMPTY fullness group when n <= N / f, where + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-143-mm-vmalloc-avoid-warn_alloc-noise-caused-by-fa.patch b/patches.kernel.org/6.2.11-143-mm-vmalloc-avoid-warn_alloc-noise-caused-by-fa.patch new file mode 100644 index 0000000..1c900a3 --- /dev/null +++ b/patches.kernel.org/6.2.11-143-mm-vmalloc-avoid-warn_alloc-noise-caused-by-fa.patch @@ -0,0 +1,128 @@ +From: Yafang Shao +Date: Thu, 30 Mar 2023 16:26:25 +0000 +Subject: [PATCH] mm: vmalloc: avoid warn_alloc noise caused by fatal signal +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: f349b15e183d6956f1b63d6ff57849ff10c7edd5 + +commit f349b15e183d6956f1b63d6ff57849ff10c7edd5 upstream. + +There're some suspicious warn_alloc on my test serer, for example, + +[13366.518837] warn_alloc: 81 callbacks suppressed +[13366.518841] test_verifier: vmalloc error: size 4096, page order 0, failed to allocate pages, mode:0x500dc2(GFP_HIGHUSER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 +[13366.522240] CPU: 30 PID: 722463 Comm: test_verifier Kdump: loaded Tainted: G W O 6.2.0+ #638 +[13366.524216] Call Trace: +[13366.524702] +[13366.525148] dump_stack_lvl+0x6c/0x80 +[13366.525712] dump_stack+0x10/0x20 +[13366.526239] warn_alloc+0x119/0x190 +[13366.526783] ? alloc_pages_bulk_array_mempolicy+0x9e/0x2a0 +[13366.527470] __vmalloc_area_node+0x546/0x5b0 +[13366.528066] __vmalloc_node_range+0xc2/0x210 +[13366.528660] __vmalloc_node+0x42/0x50 +[13366.529186] ? bpf_prog_realloc+0x53/0xc0 +[13366.529743] __vmalloc+0x1e/0x30 +[13366.530235] bpf_prog_realloc+0x53/0xc0 +[13366.530771] bpf_patch_insn_single+0x80/0x1b0 +[13366.531351] bpf_jit_blind_constants+0xe9/0x1c0 +[13366.531932] ? __free_pages+0xee/0x100 +[13366.532457] ? free_large_kmalloc+0x58/0xb0 +[13366.533002] bpf_int_jit_compile+0x8c/0x5e0 +[13366.533546] bpf_prog_select_runtime+0xb4/0x100 +[13366.534108] bpf_prog_load+0x6b1/0xa50 +[13366.534610] ? perf_event_task_tick+0x96/0xb0 +[13366.535151] ? security_capable+0x3a/0x60 +[13366.535663] __sys_bpf+0xb38/0x2190 +[13366.536120] ? kvm_clock_get_cycles+0x9/0x10 +[13366.536643] __x64_sys_bpf+0x1c/0x30 +[13366.537094] do_syscall_64+0x38/0x90 +[13366.537554] entry_SYSCALL_64_after_hwframe+0x72/0xdc +[13366.538107] RIP: 0033:0x7f78310f8e29 +[13366.538561] Code: 01 00 48 81 c4 80 00 00 00 e9 f1 fe ff ff 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 17 e0 2c 00 f7 d8 64 89 01 48 +[13366.540286] RSP: 002b:00007ffe2a61fff8 EFLAGS: 00000206 ORIG_RAX: 0000000000000141 +[13366.541031] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f78310f8e29 +[13366.541749] RDX: 0000000000000080 RSI: 00007ffe2a6200b0 RDI: 0000000000000005 +[13366.542470] RBP: 00007ffe2a620010 R08: 00007ffe2a6202a0 R09: 00007ffe2a6200b0 +[13366.543183] R10: 00000000000f423e R11: 0000000000000206 R12: 0000000000407800 +[13366.543900] R13: 00007ffe2a620540 R14: 0000000000000000 R15: 0000000000000000 +[13366.544623] +[13366.545260] Mem-Info: +[13366.546121] active_anon:81319 inactive_anon:20733 isolated_anon:0 + active_file:69450 inactive_file:5624 isolated_file:0 + unevictable:0 dirty:10 writeback:0 + slab_reclaimable:69649 slab_unreclaimable:48930 + mapped:27400 shmem:12868 pagetables:4929 + sec_pagetables:0 bounce:0 + kernel_misc_reclaimable:0 + free:15870308 free_pcp:142935 free_cma:0 +[13366.551886] Node 0 active_anon:224836kB inactive_anon:33528kB active_file:175692kB inactive_file:13752kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:59248kB dirty:32kB writeback:0kB shmem:18252kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:4616kB pagetables:10664kB sec_pagetables:0kB all_unreclaimable? no +[13366.555184] Node 1 active_anon:100440kB inactive_anon:49404kB active_file:102108kB inactive_file:8744kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:50352kB dirty:8kB writeback:0kB shmem:33220kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:3896kB pagetables:9052kB sec_pagetables:0kB all_unreclaimable? no +[13366.558262] Node 0 DMA free:15360kB boost:0kB min:304kB low:380kB high:456kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB +[13366.560821] lowmem_reserve[]: 0 2735 31873 31873 31873 +[13366.561981] Node 0 DMA32 free:2790904kB boost:0kB min:56028kB low:70032kB high:84036kB reserved_highatomic:0KB active_anon:1936kB inactive_anon:20kB active_file:396kB inactive_file:344kB unevictable:0kB writepending:0kB present:3129200kB managed:2801520kB mlocked:0kB bounce:0kB free_pcp:5188kB local_pcp:0kB free_cma:0kB +[13366.565148] lowmem_reserve[]: 0 0 29137 29137 29137 +[13366.566168] Node 0 Normal free:28533824kB boost:0kB min:596740kB low:745924kB high:895108kB reserved_highatomic:28672KB active_anon:222900kB inactive_anon:33508kB active_file:175296kB inactive_file:13408kB unevictable:0kB writepending:32kB present:30408704kB managed:29837172kB mlocked:0kB bounce:0kB free_pcp:295724kB local_pcp:0kB free_cma:0kB +[13366.569485] lowmem_reserve[]: 0 0 0 0 0 +[13366.570416] Node 1 Normal free:32141144kB boost:0kB min:660504kB low:825628kB high:990752kB reserved_highatomic:69632KB active_anon:100440kB inactive_anon:49404kB active_file:102108kB inactive_file:8744kB unevictable:0kB writepending:8kB present:33554432kB managed:33025372kB mlocked:0kB bounce:0kB free_pcp:270880kB local_pcp:46860kB free_cma:0kB +[13366.573403] lowmem_reserve[]: 0 0 0 0 0 +[13366.574015] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB +[13366.575474] Node 0 DMA32: 782*4kB (UME) 756*8kB (UME) 736*16kB (UME) 745*32kB (UME) 694*64kB (UME) 653*128kB (UME) 595*256kB (UME) 552*512kB (UME) 454*1024kB (UME) 347*2048kB (UME) 246*4096kB (UME) = 2790904kB +[13366.577442] Node 0 Normal: 33856*4kB (UMEH) 51815*8kB (UMEH) 42418*16kB (UMEH) 36272*32kB (UMEH) 22195*64kB (UMEH) 10296*128kB (UMEH) 7238*256kB (UMEH) 5638*512kB (UEH) 5337*1024kB (UMEH) 3506*2048kB (UMEH) 1470*4096kB (UME) = 28533784kB +[13366.580460] Node 1 Normal: 15776*4kB (UMEH) 37485*8kB (UMEH) 29509*16kB (UMEH) 21420*32kB (UMEH) 14818*64kB (UMEH) 13051*128kB (UMEH) 9918*256kB (UMEH) 7374*512kB (UMEH) 5397*1024kB (UMEH) 3887*2048kB (UMEH) 2002*4096kB (UME) = 32141240kB +[13366.583027] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB +[13366.584380] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB +[13366.585702] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB +[13366.587042] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB +[13366.588372] 87386 total pagecache pages +[13366.589266] 0 pages in swap cache +[13366.590327] Free swap = 0kB +[13366.591227] Total swap = 0kB +[13366.592142] 16777082 pages RAM +[13366.593057] 0 pages HighMem/MovableOnly +[13366.594037] 357226 pages reserved +[13366.594979] 0 pages hwpoisoned + +This failure really confuse me as there're still lots of available pages. +Finally I figured out it was caused by a fatal signal. When a process is +allocating memory via vm_area_alloc_pages(), it will break directly even +if it hasn't allocated the requested pages when it receives a fatal +signal. In that case, we shouldn't show this warn_alloc, as it is +useless. We only need to show this warning when there're really no enough +pages. + +Link: https://lkml.kernel.org/r/20230330162625.13604-1-laoar.shao@gmail.com +Signed-off-by: Yafang Shao +Reviewed-by: Lorenzo Stoakes +Cc: Christoph Hellwig +Cc: Uladzislau Rezki (Sony) +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + mm/vmalloc.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/mm/vmalloc.c b/mm/vmalloc.c +index ca71de7c..b2249d01 100644 +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -3070,9 +3070,11 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask, + * allocation request, free them via __vfree() if any. + */ + if (area->nr_pages != nr_small_pages) { +- warn_alloc(gfp_mask, NULL, +- "vmalloc error: size %lu, page order %u, failed to allocate pages", +- area->nr_pages * PAGE_SIZE, page_order); ++ /* vm_area_alloc_pages() can also fail due to a fatal signal */ ++ if (!fatal_signal_pending(current)) ++ warn_alloc(gfp_mask, NULL, ++ "vmalloc error: size %lu, page order %u, failed to allocate pages", ++ area->nr_pages * PAGE_SIZE, page_order); + goto fail; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-144-wifi-mt76-mt7921-fix-fw-used-for-offload-check.patch b/patches.kernel.org/6.2.11-144-wifi-mt76-mt7921-fix-fw-used-for-offload-check.patch new file mode 100644 index 0000000..45fa752 --- /dev/null +++ b/patches.kernel.org/6.2.11-144-wifi-mt76-mt7921-fix-fw-used-for-offload-check.patch @@ -0,0 +1,40 @@ +From: Lorenzo Bianconi +Date: Tue, 28 Mar 2023 12:01:17 +0200 +Subject: [PATCH] wifi: mt76: mt7921: fix fw used for offload check for mt7922 +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: eb85df0a5643612285f61f38122564498d0c49f7 + +commit eb85df0a5643612285f61f38122564498d0c49f7 upstream. + +Fix the firmware version used for offload capability check used by 0x0616 +devices. This path enables offload capabilities for 0x0616 devices. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217245 +Fixes: 034ae28b56f1 ("wifi: mt76: mt7921: introduce remain_on_channel support") +Cc: stable@vger.kernel.org +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/632d8f0c9781c9902d7160e2c080aa7e9232d50d.1679997487.git.lorenzo@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c +index cb72ded3..5c23c827 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c +@@ -20,7 +20,7 @@ static const struct pci_device_id mt7921_pci_device_table[] = { + { PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x0608), + .driver_data = (kernel_ulong_t)MT7921_FIRMWARE_WM }, + { PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x0616), +- .driver_data = (kernel_ulong_t)MT7921_FIRMWARE_WM }, ++ .driver_data = (kernel_ulong_t)MT7922_FIRMWARE_WM }, + { }, + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-145-wifi-mt76-ignore-key-disable-commands.patch b/patches.kernel.org/6.2.11-145-wifi-mt76-ignore-key-disable-commands.patch new file mode 100644 index 0000000..d81901d --- /dev/null +++ b/patches.kernel.org/6.2.11-145-wifi-mt76-ignore-key-disable-commands.patch @@ -0,0 +1,363 @@ +From: Felix Fietkau +Date: Thu, 30 Mar 2023 11:12:59 +0200 +Subject: [PATCH] wifi: mt76: ignore key disable commands +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: e6db67fa871dee37d22701daba806bfcd4d9df49 + +commit e6db67fa871dee37d22701daba806bfcd4d9df49 upstream. + +This helps avoid cleartext leakage of already queued or powersave buffered +packets, when a reassoc triggers the key deletion. + +Cc: stable@vger.kernel.org +Signed-off-by: Felix Fietkau +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230330091259.61378-1-nbd@nbd.name +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + .../net/wireless/mediatek/mt76/mt7603/main.c | 10 +-- + .../net/wireless/mediatek/mt76/mt7615/mac.c | 70 ++++++------------- + .../net/wireless/mediatek/mt76/mt7615/main.c | 15 ++-- + .../wireless/mediatek/mt76/mt7615/mt7615.h | 6 +- + .../net/wireless/mediatek/mt76/mt76x02_util.c | 18 ++--- + .../net/wireless/mediatek/mt76/mt7915/main.c | 13 ++-- + .../net/wireless/mediatek/mt76/mt7921/main.c | 13 ++-- + .../net/wireless/mediatek/mt76/mt7996/main.c | 13 ++-- + 8 files changed, 62 insertions(+), 96 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/main.c b/drivers/net/wireless/mediatek/mt76/mt7603/main.c +index ca50feb0..1b1358c6 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7603/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7603/main.c +@@ -512,15 +512,15 @@ mt7603_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) + return -EOPNOTSUPP; + +- if (cmd == SET_KEY) { +- key->hw_key_idx = wcid->idx; +- wcid->hw_key_idx = idx; +- } else { ++ if (cmd != SET_KEY) { + if (idx == wcid->hw_key_idx) + wcid->hw_key_idx = -1; + +- key = NULL; ++ return 0; + } ++ ++ key->hw_key_idx = wcid->idx; ++ wcid->hw_key_idx = idx; + mt76_wcid_key_setup(&dev->mt76, wcid, key); + + return mt7603_wtbl_set_key(dev, wcid->idx, key); +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +index a9560247..51a968a6 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +@@ -1193,8 +1193,7 @@ EXPORT_SYMBOL_GPL(mt7615_mac_enable_rtscts); + static int + mt7615_mac_wtbl_update_key(struct mt7615_dev *dev, struct mt76_wcid *wcid, + struct ieee80211_key_conf *key, +- enum mt76_cipher_type cipher, u16 cipher_mask, +- enum set_key_cmd cmd) ++ enum mt76_cipher_type cipher, u16 cipher_mask) + { + u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx) + 30 * 4; + u8 data[32] = {}; +@@ -1203,27 +1202,18 @@ mt7615_mac_wtbl_update_key(struct mt7615_dev *dev, struct mt76_wcid *wcid, + return -EINVAL; + + mt76_rr_copy(dev, addr, data, sizeof(data)); +- if (cmd == SET_KEY) { +- if (cipher == MT_CIPHER_TKIP) { +- /* Rx/Tx MIC keys are swapped */ +- memcpy(data, key->key, 16); +- memcpy(data + 16, key->key + 24, 8); +- memcpy(data + 24, key->key + 16, 8); +- } else { +- if (cipher_mask == BIT(cipher)) +- memcpy(data, key->key, key->keylen); +- else if (cipher != MT_CIPHER_BIP_CMAC_128) +- memcpy(data, key->key, 16); +- if (cipher == MT_CIPHER_BIP_CMAC_128) +- memcpy(data + 16, key->key, 16); +- } ++ if (cipher == MT_CIPHER_TKIP) { ++ /* Rx/Tx MIC keys are swapped */ ++ memcpy(data, key->key, 16); ++ memcpy(data + 16, key->key + 24, 8); ++ memcpy(data + 24, key->key + 16, 8); + } else { ++ if (cipher_mask == BIT(cipher)) ++ memcpy(data, key->key, key->keylen); ++ else if (cipher != MT_CIPHER_BIP_CMAC_128) ++ memcpy(data, key->key, 16); + if (cipher == MT_CIPHER_BIP_CMAC_128) +- memset(data + 16, 0, 16); +- else if (cipher_mask) +- memset(data, 0, 16); +- if (!cipher_mask) +- memset(data, 0, sizeof(data)); ++ memcpy(data + 16, key->key, 16); + } + + mt76_wr_copy(dev, addr, data, sizeof(data)); +@@ -1234,7 +1224,7 @@ mt7615_mac_wtbl_update_key(struct mt7615_dev *dev, struct mt76_wcid *wcid, + static int + mt7615_mac_wtbl_update_pk(struct mt7615_dev *dev, struct mt76_wcid *wcid, + enum mt76_cipher_type cipher, u16 cipher_mask, +- int keyidx, enum set_key_cmd cmd) ++ int keyidx) + { + u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx), w0, w1; + +@@ -1253,9 +1243,7 @@ mt7615_mac_wtbl_update_pk(struct mt7615_dev *dev, struct mt76_wcid *wcid, + else + w0 &= ~MT_WTBL_W0_RX_IK_VALID; + +- if (cmd == SET_KEY && +- (cipher != MT_CIPHER_BIP_CMAC_128 || +- cipher_mask == BIT(cipher))) { ++ if (cipher != MT_CIPHER_BIP_CMAC_128 || cipher_mask == BIT(cipher)) { + w0 &= ~MT_WTBL_W0_KEY_IDX; + w0 |= FIELD_PREP(MT_WTBL_W0_KEY_IDX, keyidx); + } +@@ -1272,19 +1260,10 @@ mt7615_mac_wtbl_update_pk(struct mt7615_dev *dev, struct mt76_wcid *wcid, + + static void + mt7615_mac_wtbl_update_cipher(struct mt7615_dev *dev, struct mt76_wcid *wcid, +- enum mt76_cipher_type cipher, u16 cipher_mask, +- enum set_key_cmd cmd) ++ enum mt76_cipher_type cipher, u16 cipher_mask) + { + u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx); + +- if (!cipher_mask) { +- mt76_clear(dev, addr + 2 * 4, MT_WTBL_W2_KEY_TYPE); +- return; +- } +- +- if (cmd != SET_KEY) +- return; +- + if (cipher == MT_CIPHER_BIP_CMAC_128 && + cipher_mask & ~BIT(MT_CIPHER_BIP_CMAC_128)) + return; +@@ -1295,8 +1274,7 @@ mt7615_mac_wtbl_update_cipher(struct mt7615_dev *dev, struct mt76_wcid *wcid, + + int __mt7615_mac_wtbl_set_key(struct mt7615_dev *dev, + struct mt76_wcid *wcid, +- struct ieee80211_key_conf *key, +- enum set_key_cmd cmd) ++ struct ieee80211_key_conf *key) + { + enum mt76_cipher_type cipher; + u16 cipher_mask = wcid->cipher; +@@ -1306,19 +1284,14 @@ int __mt7615_mac_wtbl_set_key(struct mt7615_dev *dev, + if (cipher == MT_CIPHER_NONE) + return -EOPNOTSUPP; + +- if (cmd == SET_KEY) +- cipher_mask |= BIT(cipher); +- else +- cipher_mask &= ~BIT(cipher); +- +- mt7615_mac_wtbl_update_cipher(dev, wcid, cipher, cipher_mask, cmd); +- err = mt7615_mac_wtbl_update_key(dev, wcid, key, cipher, cipher_mask, +- cmd); ++ cipher_mask |= BIT(cipher); ++ mt7615_mac_wtbl_update_cipher(dev, wcid, cipher, cipher_mask); ++ err = mt7615_mac_wtbl_update_key(dev, wcid, key, cipher, cipher_mask); + if (err < 0) + return err; + + err = mt7615_mac_wtbl_update_pk(dev, wcid, cipher, cipher_mask, +- key->keyidx, cmd); ++ key->keyidx); + if (err < 0) + return err; + +@@ -1329,13 +1302,12 @@ int __mt7615_mac_wtbl_set_key(struct mt7615_dev *dev, + + int mt7615_mac_wtbl_set_key(struct mt7615_dev *dev, + struct mt76_wcid *wcid, +- struct ieee80211_key_conf *key, +- enum set_key_cmd cmd) ++ struct ieee80211_key_conf *key) + { + int err; + + spin_lock_bh(&dev->mt76.lock); +- err = __mt7615_mac_wtbl_set_key(dev, wcid, key, cmd); ++ err = __mt7615_mac_wtbl_set_key(dev, wcid, key); + spin_unlock_bh(&dev->mt76.lock); + + return err; +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/main.c b/drivers/net/wireless/mediatek/mt76/mt7615/main.c +index ab4c1b44..dadb13f2 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c +@@ -391,18 +391,17 @@ static int mt7615_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + + if (cmd == SET_KEY) + *wcid_keyidx = idx; +- else if (idx == *wcid_keyidx) +- *wcid_keyidx = -1; +- else ++ else { ++ if (idx == *wcid_keyidx) ++ *wcid_keyidx = -1; + goto out; ++ } + +- mt76_wcid_key_setup(&dev->mt76, wcid, +- cmd == SET_KEY ? key : NULL); +- ++ mt76_wcid_key_setup(&dev->mt76, wcid, key); + if (mt76_is_mmio(&dev->mt76)) +- err = mt7615_mac_wtbl_set_key(dev, wcid, key, cmd); ++ err = mt7615_mac_wtbl_set_key(dev, wcid, key); + else +- err = __mt7615_mac_wtbl_set_key(dev, wcid, key, cmd); ++ err = __mt7615_mac_wtbl_set_key(dev, wcid, key); + + out: + mt7615_mutex_release(dev); +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h b/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h +index 087d4886..ab10ad0e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h +@@ -484,11 +484,9 @@ int mt7615_mac_write_txwi(struct mt7615_dev *dev, __le32 *txwi, + void mt7615_mac_set_timing(struct mt7615_phy *phy); + int __mt7615_mac_wtbl_set_key(struct mt7615_dev *dev, + struct mt76_wcid *wcid, +- struct ieee80211_key_conf *key, +- enum set_key_cmd cmd); ++ struct ieee80211_key_conf *key); + int mt7615_mac_wtbl_set_key(struct mt7615_dev *dev, struct mt76_wcid *wcid, +- struct ieee80211_key_conf *key, +- enum set_key_cmd cmd); ++ struct ieee80211_key_conf *key); + void mt7615_mac_reset_work(struct work_struct *work); + u32 mt7615_mac_get_sta_tid_sn(struct mt7615_dev *dev, int wcid, u8 tid); + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_util.c b/drivers/net/wireless/mediatek/mt76/mt76x02_util.c +index 604ddcc2..324535a0 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76x02_util.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x02_util.c +@@ -455,20 +455,20 @@ int mt76x02_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + msta = sta ? (struct mt76x02_sta *)sta->drv_priv : NULL; + wcid = msta ? &msta->wcid : &mvif->group_wcid; + +- if (cmd == SET_KEY) { +- key->hw_key_idx = wcid->idx; +- wcid->hw_key_idx = idx; +- if (key->flags & IEEE80211_KEY_FLAG_RX_MGMT) { +- key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX; +- wcid->sw_iv = true; +- } +- } else { ++ if (cmd != SET_KEY) { + if (idx == wcid->hw_key_idx) { + wcid->hw_key_idx = -1; + wcid->sw_iv = false; + } + +- key = NULL; ++ return 0; ++ } ++ ++ key->hw_key_idx = wcid->idx; ++ wcid->hw_key_idx = idx; ++ if (key->flags & IEEE80211_KEY_FLAG_RX_MGMT) { ++ key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX; ++ wcid->sw_iv = true; + } + mt76_wcid_key_setup(&dev->mt76, wcid, key); + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c +index 7589af4b..06c10451 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c +@@ -410,16 +410,15 @@ static int mt7915_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + mt7915_mcu_add_bss_info(phy, vif, true); + } + +- if (cmd == SET_KEY) ++ if (cmd == SET_KEY) { + *wcid_keyidx = idx; +- else if (idx == *wcid_keyidx) +- *wcid_keyidx = -1; +- else ++ } else { ++ if (idx == *wcid_keyidx) ++ *wcid_keyidx = -1; + goto out; ++ } + +- mt76_wcid_key_setup(&dev->mt76, wcid, +- cmd == SET_KEY ? key : NULL); +- ++ mt76_wcid_key_setup(&dev->mt76, wcid, key); + err = mt76_connac_mcu_add_key(&dev->mt76, vif, &msta->bip, + key, MCU_EXT_CMD(STA_REC_UPDATE), + &msta->wcid, cmd); +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +index cdb0d619..744382be 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +@@ -569,16 +569,15 @@ static int mt7921_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + + mt7921_mutex_acquire(dev); + +- if (cmd == SET_KEY) ++ if (cmd == SET_KEY) { + *wcid_keyidx = idx; +- else if (idx == *wcid_keyidx) +- *wcid_keyidx = -1; +- else ++ } else { ++ if (idx == *wcid_keyidx) ++ *wcid_keyidx = -1; + goto out; ++ } + +- mt76_wcid_key_setup(&dev->mt76, wcid, +- cmd == SET_KEY ? key : NULL); +- ++ mt76_wcid_key_setup(&dev->mt76, wcid, key); + err = mt76_connac_mcu_add_key(&dev->mt76, vif, &msta->bip, + key, MCU_UNI_CMD(STA_REC_UPDATE), + &msta->wcid, cmd); +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +index c423b052..2734aae5 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +@@ -351,16 +351,15 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + mt7996_mcu_add_bss_info(phy, vif, true); + } + +- if (cmd == SET_KEY) ++ if (cmd == SET_KEY) { + *wcid_keyidx = idx; +- else if (idx == *wcid_keyidx) +- *wcid_keyidx = -1; +- else ++ } else { ++ if (idx == *wcid_keyidx) ++ *wcid_keyidx = -1; + goto out; ++ } + +- mt76_wcid_key_setup(&dev->mt76, wcid, +- cmd == SET_KEY ? key : NULL); +- ++ mt76_wcid_key_setup(&dev->mt76, wcid, key); + err = mt7996_mcu_add_key(&dev->mt76, vif, &msta->bip, + key, MCU_WMWA_UNI_CMD(STA_REC_UPDATE), + &msta->wcid, cmd); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-146-ublk-read-any-SQE-values-upfront.patch b/patches.kernel.org/6.2.11-146-ublk-read-any-SQE-values-upfront.patch new file mode 100644 index 0000000..2624f26 --- /dev/null +++ b/patches.kernel.org/6.2.11-146-ublk-read-any-SQE-values-upfront.patch @@ -0,0 +1,71 @@ +From: Jens Axboe +Date: Wed, 5 Apr 2023 20:00:46 -0600 +Subject: [PATCH] ublk: read any SQE values upfront +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 8c68ae3b22fa6fb2dbe83ef955ff10936503d28e + +commit 8c68ae3b22fa6fb2dbe83ef955ff10936503d28e upstream. + +Since SQE memory is shared with userspace, we should only be reading it +once. We cannot read it multiple times, particularly when it's read once +for validation and then read again for the actual use. + +ublk_ch_uring_cmd() is safe when called as a retry operation, as the +memory backing is stable at that point. But for normal issue, we want +to ensure that we only read ublksrv_io_cmd once. Wrap the function in +a helper that reads the value into an on-stack copy of the struct. + +Cc: stable@vger.kernel.org # 6.0+ +Reviewed-by: Ming Lei +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/block/ublk_drv.c | 22 ++++++++++++++++++++-- + 1 file changed, 20 insertions(+), 2 deletions(-) + +diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c +index 341f490f..2ed994a3 100644 +--- a/drivers/block/ublk_drv.c ++++ b/drivers/block/ublk_drv.c +@@ -1202,9 +1202,10 @@ static void ublk_handle_need_get_data(struct ublk_device *ub, int q_id, + ublk_queue_cmd(ubq, req); + } + +-static int ublk_ch_uring_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags) ++static int __ublk_ch_uring_cmd(struct io_uring_cmd *cmd, ++ unsigned int issue_flags, ++ struct ublksrv_io_cmd *ub_cmd) + { +- struct ublksrv_io_cmd *ub_cmd = (struct ublksrv_io_cmd *)cmd->cmd; + struct ublk_device *ub = cmd->file->private_data; + struct ublk_queue *ubq; + struct ublk_io *io; +@@ -1306,6 +1307,23 @@ static int ublk_ch_uring_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags) + return -EIOCBQUEUED; + } + ++static int ublk_ch_uring_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags) ++{ ++ struct ublksrv_io_cmd *ub_src = (struct ublksrv_io_cmd *) cmd->cmd; ++ struct ublksrv_io_cmd ub_cmd; ++ ++ /* ++ * Not necessary for async retry, but let's keep it simple and always ++ * copy the values to avoid any potential reuse. ++ */ ++ ub_cmd.q_id = READ_ONCE(ub_src->q_id); ++ ub_cmd.tag = READ_ONCE(ub_src->tag); ++ ub_cmd.result = READ_ONCE(ub_src->result); ++ ub_cmd.addr = READ_ONCE(ub_src->addr); ++ ++ return __ublk_ch_uring_cmd(cmd, issue_flags, &ub_cmd); ++} ++ + static const struct file_operations ublk_ch_fops = { + .owner = THIS_MODULE, + .open = ublk_ch_open, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-147-drm-panfrost-Fix-the-panfrost_mmu_map_fault_ad.patch b/patches.kernel.org/6.2.11-147-drm-panfrost-Fix-the-panfrost_mmu_map_fault_ad.patch new file mode 100644 index 0000000..d2c1546 --- /dev/null +++ b/patches.kernel.org/6.2.11-147-drm-panfrost-Fix-the-panfrost_mmu_map_fault_ad.patch @@ -0,0 +1,40 @@ +From: Boris Brezillon +Date: Fri, 21 May 2021 11:38:11 +0200 +Subject: [PATCH] drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error + path +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 764a2ab9eb56e1200083e771aab16186836edf1d + +commit 764a2ab9eb56e1200083e771aab16186836edf1d upstream. + +Make sure all bo->base.pages entries are either NULL or pointing to a +valid page before calling drm_gem_shmem_put_pages(). + +Reported-by: Tomeu Vizoso +Cc: +Fixes: 187d2929206e ("drm/panfrost: Add support for GPU heap allocations") +Signed-off-by: Boris Brezillon +Reviewed-by: Steven Price +Link: https://patchwork.freedesktop.org/patch/msgid/20210521093811.1018992-1-boris.brezillon@collabora.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/panfrost/panfrost_mmu.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/panfrost/panfrost_mmu.c b/drivers/gpu/drm/panfrost/panfrost_mmu.c +index 666a5e53..e961fa27 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c ++++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c +@@ -504,6 +504,7 @@ static int panfrost_mmu_map_fault_addr(struct panfrost_device *pfdev, int as, + if (IS_ERR(pages[i])) { + mutex_unlock(&bo->base.pages_lock); + ret = PTR_ERR(pages[i]); ++ pages[i] = NULL; + goto err_pages; + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-148-drm-nouveau-disp-Support-more-modes-by-checkin.patch b/patches.kernel.org/6.2.11-148-drm-nouveau-disp-Support-more-modes-by-checkin.patch new file mode 100644 index 0000000..bc660f0 --- /dev/null +++ b/patches.kernel.org/6.2.11-148-drm-nouveau-disp-Support-more-modes-by-checkin.patch @@ -0,0 +1,105 @@ +From: Karol Herbst +Date: Fri, 31 Mar 2023 00:39:38 +0200 +Subject: [PATCH] drm/nouveau/disp: Support more modes by checking with lower + bpc +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 7f67aa097e875c87fba024e850cf405342300059 + +commit 7f67aa097e875c87fba024e850cf405342300059 upstream. + +This allows us to advertise more modes especially on HDR displays. + +Fixes using 4K@60 modes on my TV and main display both using a HDMI to DP +adapter. Also fixes similar issues for users running into this. + +Cc: stable@vger.kernel.org # 5.10+ +Signed-off-by: Karol Herbst +Reviewed-by: Lyude Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20230330223938.4025569-1-kherbst@redhat.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/nouveau/dispnv50/disp.c | 32 +++++++++++++++++++++++++ + drivers/gpu/drm/nouveau/nouveau_dp.c | 8 ++++--- + 2 files changed, 37 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c +index ed9d3741..5bb777ff 100644 +--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c +@@ -363,6 +363,35 @@ nv50_outp_atomic_check_view(struct drm_encoder *encoder, + return 0; + } + ++static void ++nv50_outp_atomic_fix_depth(struct drm_encoder *encoder, struct drm_crtc_state *crtc_state) ++{ ++ struct nv50_head_atom *asyh = nv50_head_atom(crtc_state); ++ struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder); ++ struct drm_display_mode *mode = &asyh->state.adjusted_mode; ++ unsigned int max_rate, mode_rate; ++ ++ switch (nv_encoder->dcb->type) { ++ case DCB_OUTPUT_DP: ++ max_rate = nv_encoder->dp.link_nr * nv_encoder->dp.link_bw; ++ ++ /* we don't support more than 10 anyway */ ++ asyh->or.bpc = min_t(u8, asyh->or.bpc, 10); ++ ++ /* reduce the bpc until it works out */ ++ while (asyh->or.bpc > 6) { ++ mode_rate = DIV_ROUND_UP(mode->clock * asyh->or.bpc * 3, 8); ++ if (mode_rate <= max_rate) ++ break; ++ ++ asyh->or.bpc -= 2; ++ } ++ break; ++ default: ++ break; ++ } ++} ++ + static int + nv50_outp_atomic_check(struct drm_encoder *encoder, + struct drm_crtc_state *crtc_state, +@@ -381,6 +410,9 @@ nv50_outp_atomic_check(struct drm_encoder *encoder, + if (crtc_state->mode_changed || crtc_state->connectors_changed) + asyh->or.bpc = connector->display_info.bpc; + ++ /* We might have to reduce the bpc */ ++ nv50_outp_atomic_fix_depth(encoder, crtc_state); ++ + return 0; + } + +diff --git a/drivers/gpu/drm/nouveau/nouveau_dp.c b/drivers/gpu/drm/nouveau/nouveau_dp.c +index e00876f9..d49b4875 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_dp.c ++++ b/drivers/gpu/drm/nouveau/nouveau_dp.c +@@ -263,8 +263,6 @@ nouveau_dp_irq(struct work_struct *work) + } + + /* TODO: +- * - Use the minimum possible BPC here, once we add support for the max bpc +- * property. + * - Validate against the DP caps advertised by the GPU (we don't check these + * yet) + */ +@@ -276,7 +274,11 @@ nv50_dp_mode_valid(struct drm_connector *connector, + { + const unsigned int min_clock = 25000; + unsigned int max_rate, mode_rate, ds_max_dotclock, clock = mode->clock; +- const u8 bpp = connector->display_info.bpc * 3; ++ /* Check with the minmum bpc always, so we can advertise better modes. ++ * In particlar not doing this causes modes to be dropped on HDR ++ * displays as we might check with a bpc of 16 even. ++ */ ++ const u8 bpp = 6 * 3; + + if (mode->flags & DRM_MODE_FLAG_INTERLACE && !outp->caps.dp_interlace) + return MODE_NO_INTERLACE; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-149-drm-i915-Fix-context-runtime-accounting.patch b/patches.kernel.org/6.2.11-149-drm-i915-Fix-context-runtime-accounting.patch new file mode 100644 index 0000000..0dd3305 --- /dev/null +++ b/patches.kernel.org/6.2.11-149-drm-i915-Fix-context-runtime-accounting.patch @@ -0,0 +1,67 @@ +From: Tvrtko Ursulin +Date: Mon, 20 Mar 2023 15:14:23 +0000 +Subject: [PATCH] drm/i915: Fix context runtime accounting +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: dc3421560a67361442f33ec962fc6dd48895a0df + +commit dc3421560a67361442f33ec962fc6dd48895a0df upstream. + +When considering whether to mark one context as stopped and another as +started we need to look at whether the previous and new _contexts_ are +different and not just requests. Otherwise the software tracked context +start time was incorrectly updated to the most recent lite-restore time- +stamp, which was in some cases resulting in active time going backward, +until the context switch (typically the heartbeat pulse) would synchronise +with the hardware tracked context runtime. Easiest use case to observe +this behaviour was with a full screen clients with close to 100% engine +load. + +Signed-off-by: Tvrtko Ursulin +Fixes: bb6287cb1886 ("drm/i915: Track context current active time") +Cc: # v5.19+ +Reviewed-by: Matthew Auld +Link: https://patchwork.freedesktop.org/patch/msgid/20230320151423.1708436-1-tvrtko.ursulin@linux.intel.com +[tursulin: Fix spelling in commit msg.] +(cherry picked from commit b3e70051879c665acdd3a1ab50d0ed58d6a8001f) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/gt/intel_execlists_submission.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_execlists_submission.c b/drivers/gpu/drm/i915/gt/intel_execlists_submission.c +index 3c573d41..eefd327c 100644 +--- a/drivers/gpu/drm/i915/gt/intel_execlists_submission.c ++++ b/drivers/gpu/drm/i915/gt/intel_execlists_submission.c +@@ -2018,6 +2018,8 @@ process_csb(struct intel_engine_cs *engine, struct i915_request **inactive) + * inspecting the queue to see if we need to resumbit. + */ + if (*prev != *execlists->active) { /* elide lite-restores */ ++ struct intel_context *prev_ce = NULL, *active_ce = NULL; ++ + /* + * Note the inherent discrepancy between the HW runtime, + * recorded as part of the context switch, and the CPU +@@ -2029,9 +2031,15 @@ process_csb(struct intel_engine_cs *engine, struct i915_request **inactive) + * and correct overselves later when updating from HW. + */ + if (*prev) +- lrc_runtime_stop((*prev)->context); ++ prev_ce = (*prev)->context; + if (*execlists->active) +- lrc_runtime_start((*execlists->active)->context); ++ active_ce = (*execlists->active)->context; ++ if (prev_ce != active_ce) { ++ if (prev_ce) ++ lrc_runtime_stop(prev_ce); ++ if (active_ce) ++ lrc_runtime_start(active_ce); ++ } + new_timeslice(execlists); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-150-drm-i915-fix-race-condition-UAF-in-i915_perf_a.patch b/patches.kernel.org/6.2.11-150-drm-i915-fix-race-condition-UAF-in-i915_perf_a.patch new file mode 100644 index 0000000..fb9b5f8 --- /dev/null +++ b/patches.kernel.org/6.2.11-150-drm-i915-fix-race-condition-UAF-in-i915_perf_a.patch @@ -0,0 +1,55 @@ +From: Min Li +Date: Tue, 28 Mar 2023 17:36:27 +0800 +Subject: [PATCH] drm/i915: fix race condition UAF in + i915_perf_add_config_ioctl +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: dc30c011469165d57af9adac5baff7d767d20e5c + +commit dc30c011469165d57af9adac5baff7d767d20e5c upstream. + +Userspace can guess the id value and try to race oa_config object creation +with config remove, resulting in a use-after-free if we dereference the +object after unlocking the metrics_lock. For that reason, unlocking the +metrics_lock must be done after we are done dereferencing the object. + +Signed-off-by: Min Li +Fixes: f89823c21224 ("drm/i915/perf: Implement I915_PERF_ADD/REMOVE_CONFIG interface") +Cc: # v4.14+ +Reviewed-by: Andi Shyti +Reviewed-by: Umesh Nerlige Ramappa +Signed-off-by: Tvrtko Ursulin +Link: https://patchwork.freedesktop.org/patch/msgid/20230328093627.5067-1-lm0963hack@gmail.com +[tursulin: Manually added stable tag.] +(cherry picked from commit 49f6f6483b652108bcb73accd0204a464b922395) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/i915_perf.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c +index 7d5e2c53..1a1b74b8 100644 +--- a/drivers/gpu/drm/i915/i915_perf.c ++++ b/drivers/gpu/drm/i915/i915_perf.c +@@ -4612,13 +4612,13 @@ int i915_perf_add_config_ioctl(struct drm_device *dev, void *data, + err = oa_config->id; + goto sysfs_err; + } +- +- mutex_unlock(&perf->metrics_lock); ++ id = oa_config->id; + + drm_dbg(&perf->i915->drm, + "Added config %s id=%i\n", oa_config->uuid, oa_config->id); ++ mutex_unlock(&perf->metrics_lock); + +- return oa_config->id; ++ return id; + + sysfs_err: + mutex_unlock(&perf->metrics_lock); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-151-ring-buffer-Fix-race-while-reader-and-writer-a.patch b/patches.kernel.org/6.2.11-151-ring-buffer-Fix-race-while-reader-and-writer-a.patch new file mode 100644 index 0000000..65e7d2c --- /dev/null +++ b/patches.kernel.org/6.2.11-151-ring-buffer-Fix-race-while-reader-and-writer-a.patch @@ -0,0 +1,110 @@ +From: Zheng Yejian +Date: Sat, 25 Mar 2023 10:12:47 +0800 +Subject: [PATCH] ring-buffer: Fix race while reader and writer are on the same + page +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 6455b6163d8c680366663cdb8c679514d55fc30c + +commit 6455b6163d8c680366663cdb8c679514d55fc30c upstream. + +When user reads file 'trace_pipe', kernel keeps printing following logs +that warn at "cpu_buffer->reader_page->read > rb_page_size(reader)" in +rb_get_reader_page(). It just looks like there's an infinite loop in +tracing_read_pipe(). This problem occurs several times on arm64 platform +when testing v5.10 and below. + + Call trace: + rb_get_reader_page+0x248/0x1300 + rb_buffer_peek+0x34/0x160 + ring_buffer_peek+0xbc/0x224 + peek_next_entry+0x98/0xbc + __find_next_entry+0xc4/0x1c0 + trace_find_next_entry_inc+0x30/0x94 + tracing_read_pipe+0x198/0x304 + vfs_read+0xb4/0x1e0 + ksys_read+0x74/0x100 + __arm64_sys_read+0x24/0x30 + el0_svc_common.constprop.0+0x7c/0x1bc + do_el0_svc+0x2c/0x94 + el0_svc+0x20/0x30 + el0_sync_handler+0xb0/0xb4 + el0_sync+0x160/0x180 + +Then I dump the vmcore and look into the problematic per_cpu ring_buffer, +I found that tail_page/commit_page/reader_page are on the same page while +reader_page->read is obviously abnormal: + tail_page == commit_page == reader_page == { + .write = 0x100d20, + .read = 0x8f9f4805, // Far greater than 0xd20, obviously abnormal!!! + .entries = 0x10004c, + .real_end = 0x0, + .page = { + .time_stamp = 0x857257416af0, + .commit = 0xd20, // This page hasn't been full filled. + // .data[0...0xd20] seems normal. + } + } + +The root cause is most likely the race that reader and writer are on the +same page while reader saw an event that not fully committed by writer. + +To fix this, add memory barriers to make sure the reader can see the +content of what is committed. Since commit a0fcaaed0c46 ("ring-buffer: Fix +race between reset page and reading page") has added the read barrier in +rb_get_reader_page(), here we just need to add the write barrier. + +Link: https://lore.kernel.org/linux-trace-kernel/20230325021247.2923907-1-zhengyejian1@huawei.com + +Cc: stable@vger.kernel.org +Fixes: 77ae365eca89 ("ring-buffer: make lockless") +Suggested-by: Steven Rostedt (Google) +Signed-off-by: Zheng Yejian +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/trace/ring_buffer.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 20cd8c9d..12da1724 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -3102,6 +3102,10 @@ rb_set_commit_to_write(struct ring_buffer_per_cpu *cpu_buffer) + if (RB_WARN_ON(cpu_buffer, + rb_is_reader_page(cpu_buffer->tail_page))) + return; ++ /* ++ * No need for a memory barrier here, as the update ++ * of the tail_page did it for this page. ++ */ + local_set(&cpu_buffer->commit_page->page->commit, + rb_page_write(cpu_buffer->commit_page)); + rb_inc_page(&cpu_buffer->commit_page); +@@ -3111,6 +3115,8 @@ rb_set_commit_to_write(struct ring_buffer_per_cpu *cpu_buffer) + while (rb_commit_index(cpu_buffer) != + rb_page_write(cpu_buffer->commit_page)) { + ++ /* Make sure the readers see the content of what is committed. */ ++ smp_wmb(); + local_set(&cpu_buffer->commit_page->page->commit, + rb_page_write(cpu_buffer->commit_page)); + RB_WARN_ON(cpu_buffer, +@@ -4688,7 +4694,12 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer) + + /* + * Make sure we see any padding after the write update +- * (see rb_reset_tail()) ++ * (see rb_reset_tail()). ++ * ++ * In addition, a writer may be writing on the reader page ++ * if the page has not been fully filled, so the read barrier ++ * is also needed to make sure we see the content of what is ++ * committed by the writer (see rb_set_commit_to_write()). + */ + smp_rmb(); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-152-mm-swap-fix-swap_info_struct-race-between-swap.patch b/patches.kernel.org/6.2.11-152-mm-swap-fix-swap_info_struct-race-between-swap.patch new file mode 100644 index 0000000..099a9b5 --- /dev/null +++ b/patches.kernel.org/6.2.11-152-mm-swap-fix-swap_info_struct-race-between-swap.patch @@ -0,0 +1,126 @@ +From: Rongwei Wang +Date: Tue, 4 Apr 2023 23:47:16 +0800 +Subject: [PATCH] mm/swap: fix swap_info_struct race between swapoff and + get_swap_pages() +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 6fe7d6b992113719e96744d974212df3fcddc76c + +commit 6fe7d6b992113719e96744d974212df3fcddc76c upstream. + +The si->lock must be held when deleting the si from the available list. +Otherwise, another thread can re-add the si to the available list, which +can lead to memory corruption. The only place we have found where this +happens is in the swapoff path. This case can be described as below: + +core 0 core 1 +swapoff + +del_from_avail_list(si) waiting + +try lock si->lock acquire swap_avail_lock + and re-add si into + swap_avail_head + +acquire si->lock but missing si already being added again, and continuing +to clear SWP_WRITEOK, etc. + +It can be easily found that a massive warning messages can be triggered +inside get_swap_pages() by some special cases, for example, we call +madvise(MADV_PAGEOUT) on blocks of touched memory concurrently, meanwhile, +run much swapon-swapoff operations (e.g. stress-ng-swap). + +However, in the worst case, panic can be caused by the above scene. In +swapoff(), the memory used by si could be kept in swap_info[] after +turning off a swap. This means memory corruption will not be caused +immediately until allocated and reset for a new swap in the swapon path. +A panic message caused: (with CONFIG_PLIST_DEBUG enabled) + +------------[ cut here ]------------ +top: 00000000e58a3003, n: 0000000013e75cda, p: 000000008cd4451a +prev: 0000000035b1e58a, n: 000000008cd4451a, p: 000000002150ee8d +next: 000000008cd4451a, n: 000000008cd4451a, p: 000000008cd4451a +WARNING: CPU: 21 PID: 1843 at lib/plist.c:60 plist_check_prev_next_node+0x50/0x70 +Modules linked in: rfkill(E) crct10dif_ce(E)... +CPU: 21 PID: 1843 Comm: stress-ng Kdump: ... 5.10.134+ +Hardware name: Alibaba Cloud ECS, BIOS 0.0.0 02/06/2015 +pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--) +pc : plist_check_prev_next_node+0x50/0x70 +lr : plist_check_prev_next_node+0x50/0x70 +sp : ffff0018009d3c30 +x29: ffff0018009d3c40 x28: ffff800011b32a98 +x27: 0000000000000000 x26: ffff001803908000 +x25: ffff8000128ea088 x24: ffff800011b32a48 +x23: 0000000000000028 x22: ffff001800875c00 +x21: ffff800010f9e520 x20: ffff001800875c00 +x19: ffff001800fdc6e0 x18: 0000000000000030 +x17: 0000000000000000 x16: 0000000000000000 +x15: 0736076307640766 x14: 0730073007380731 +x13: 0736076307640766 x12: 0730073007380731 +x11: 000000000004058d x10: 0000000085a85b76 +x9 : ffff8000101436e4 x8 : ffff800011c8ce08 +x7 : 0000000000000000 x6 : 0000000000000001 +x5 : ffff0017df9ed338 x4 : 0000000000000001 +x3 : ffff8017ce62a000 x2 : ffff0017df9ed340 +x1 : 0000000000000000 x0 : 0000000000000000 +Call trace: + plist_check_prev_next_node+0x50/0x70 + plist_check_head+0x80/0xf0 + plist_add+0x28/0x140 + add_to_avail_list+0x9c/0xf0 + _enable_swap_info+0x78/0xb4 + __do_sys_swapon+0x918/0xa10 + __arm64_sys_swapon+0x20/0x30 + el0_svc_common+0x8c/0x220 + do_el0_svc+0x2c/0x90 + el0_svc+0x1c/0x30 + el0_sync_handler+0xa8/0xb0 + el0_sync+0x148/0x180 +irq event stamp: 2082270 + +Now, si->lock locked before calling 'del_from_avail_list()' to make sure +other thread see the si had been deleted and SWP_WRITEOK cleared together, +will not reinsert again. + +This problem exists in versions after stable 5.10.y. + +Link: https://lkml.kernel.org/r/20230404154716.23058-1-rongwei.wang@linux.alibaba.com +Fixes: a2468cc9bfdff ("swap: choose swap device according to numa node") +Tested-by: Yongchen Yin +Signed-off-by: Rongwei Wang +Cc: Bagas Sanjaya +Cc: Matthew Wilcox (Oracle) +Cc: Aaron Lu +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + mm/swapfile.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/mm/swapfile.c b/mm/swapfile.c +index eb9b0bf1..36899c42 100644 +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -679,6 +679,7 @@ static void __del_from_avail_list(struct swap_info_struct *p) + { + int nid; + ++ assert_spin_locked(&p->lock); + for_each_node(nid) + plist_del(&p->avail_lists[nid], &swap_avail_heads[nid]); + } +@@ -2435,8 +2436,8 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile) + spin_unlock(&swap_lock); + goto out_dput; + } +- del_from_avail_list(p); + spin_lock(&p->lock); ++ del_from_avail_list(p); + if (p->prio < 0) { + struct swap_info_struct *si = p; + int nid; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-153-mm-hugetlb-fix-uffd-wr-protection-for-CoW-opti.patch b/patches.kernel.org/6.2.11-153-mm-hugetlb-fix-uffd-wr-protection-for-CoW-opti.patch new file mode 100644 index 0000000..d4ae62d --- /dev/null +++ b/patches.kernel.org/6.2.11-153-mm-hugetlb-fix-uffd-wr-protection-for-CoW-opti.patch @@ -0,0 +1,94 @@ +From: Peter Xu +Date: Tue, 21 Mar 2023 15:18:40 -0400 +Subject: [PATCH] mm/hugetlb: fix uffd wr-protection for CoW optimization path +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 60d5b473d61be61ac315e544fcd6a8234a79500e + +commit 60d5b473d61be61ac315e544fcd6a8234a79500e upstream. + +This patch fixes an issue that a hugetlb uffd-wr-protected mapping can be +writable even with uffd-wp bit set. It only happens with hugetlb private +mappings, when someone firstly wr-protects a missing pte (which will +install a pte marker), then a write to the same page without any prior +access to the page. + +Userfaultfd-wp trap for hugetlb was implemented in hugetlb_fault() before +reaching hugetlb_wp() to avoid taking more locks that userfault won't +need. However there's one CoW optimization path that can trigger +hugetlb_wp() inside hugetlb_no_page(), which will bypass the trap. + +This patch skips hugetlb_wp() for CoW and retries the fault if uffd-wp bit +is detected. The new path will only trigger in the CoW optimization path +because generic hugetlb_fault() (e.g. when a present pte was +wr-protected) will resolve the uffd-wp bit already. Also make sure +anonymous UNSHARE won't be affected and can still be resolved, IOW only +skip CoW not CoR. + +This patch will be needed for v5.19+ hence copy stable. + +[peterx@redhat.com: v2] + Link: https://lkml.kernel.org/r/ZBzOqwF2wrHgBVZb@x1n +[peterx@redhat.com: v3] + Link: https://lkml.kernel.org/r/20230324142620.2344140-1-peterx@redhat.com +Link: https://lkml.kernel.org/r/20230321191840.1897940-1-peterx@redhat.com +Fixes: 166f3ecc0daf ("mm/hugetlb: hook page faults for uffd write protection") +Signed-off-by: Peter Xu +Reported-by: Muhammad Usama Anjum +Tested-by: Muhammad Usama Anjum +Acked-by: David Hildenbrand +Reviewed-by: Mike Kravetz +Cc: Andrea Arcangeli +Cc: Axel Rasmussen +Cc: Mike Rapoport +Cc: Nadav Amit +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + mm/hugetlb.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index bdbfeb6f..4d338f70 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -5476,7 +5476,7 @@ static vm_fault_t hugetlb_wp(struct mm_struct *mm, struct vm_area_struct *vma, + struct page *pagecache_page, spinlock_t *ptl) + { + const bool unshare = flags & FAULT_FLAG_UNSHARE; +- pte_t pte; ++ pte_t pte = huge_ptep_get(ptep); + struct hstate *h = hstate_vma(vma); + struct page *old_page, *new_page; + int outside_reserve = 0; +@@ -5484,6 +5484,17 @@ static vm_fault_t hugetlb_wp(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long haddr = address & huge_page_mask(h); + struct mmu_notifier_range range; + ++ /* ++ * Never handle CoW for uffd-wp protected pages. It should be only ++ * handled when the uffd-wp protection is removed. ++ * ++ * Note that only the CoW optimization path (in hugetlb_no_page()) ++ * can trigger this, because hugetlb_fault() will always resolve ++ * uffd-wp bit first. ++ */ ++ if (!unshare && huge_pte_uffd_wp(pte)) ++ return 0; ++ + /* + * hugetlb does not support FOLL_FORCE-style write faults that keep the + * PTE mapped R/O such as maybe_mkwrite() would do. +@@ -5497,7 +5508,6 @@ static vm_fault_t hugetlb_wp(struct mm_struct *mm, struct vm_area_struct *vma, + return 0; + } + +- pte = huge_ptep_get(ptep); + old_page = pte_page(pte); + + delayacct_wpcopy_start(); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-154-maple_tree-fix-get-wrong-data_end-in-mtree_loo.patch b/patches.kernel.org/6.2.11-154-maple_tree-fix-get-wrong-data_end-in-mtree_loo.patch new file mode 100644 index 0000000..a7ddaa7 --- /dev/null +++ b/patches.kernel.org/6.2.11-154-maple_tree-fix-get-wrong-data_end-in-mtree_loo.patch @@ -0,0 +1,62 @@ +From: Peng Zhang +Date: Tue, 14 Mar 2023 20:42:01 +0800 +Subject: [PATCH] maple_tree: fix get wrong data_end in mtree_lookup_walk() +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: ec07967d7523adb3670f9dfee0232e3bc868f3de + +commit ec07967d7523adb3670f9dfee0232e3bc868f3de upstream. + +if (likely(offset > end)) + max = pivots[offset]; + +The above code should be changed to if (likely(offset < end)), which is +correct. This affects the correctness of ma_data_end(). Now it seems +that the final result will not be wrong, but it is best to change it. +This patch does not change the code as above, because it simplifies the +code by the way. + +Link: https://lkml.kernel.org/r/20230314124203.91572-1-zhangpeng.00@bytedance.com +Link: https://lkml.kernel.org/r/20230314124203.91572-2-zhangpeng.00@bytedance.com +Fixes: 54a611b60590 ("Maple Tree: add new data structure") +Signed-off-by: Peng Zhang +Reviewed-by: Liam R. Howlett +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + lib/maple_tree.c | 15 +++++---------- + 1 file changed, 5 insertions(+), 10 deletions(-) + +diff --git a/lib/maple_tree.c b/lib/maple_tree.c +index a63594be..61223895 100644 +--- a/lib/maple_tree.c ++++ b/lib/maple_tree.c +@@ -3875,18 +3875,13 @@ static inline void *mtree_lookup_walk(struct ma_state *mas) + end = ma_data_end(node, type, pivots, max); + if (unlikely(ma_dead_node(node))) + goto dead_node; +- +- if (pivots[offset] >= mas->index) +- goto next; +- + do { +- offset++; +- } while ((offset < end) && (pivots[offset] < mas->index)); +- +- if (likely(offset > end)) +- max = pivots[offset]; ++ if (pivots[offset] >= mas->index) { ++ max = pivots[offset]; ++ break; ++ } ++ } while (++offset < end); + +-next: + slots = ma_slots(node, type); + next = mt_slot(mas->tree, slots, offset); + if (unlikely(ma_dead_node(node))) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-155-maple_tree-fix-a-potential-concurrency-bug-in-.patch b/patches.kernel.org/6.2.11-155-maple_tree-fix-a-potential-concurrency-bug-in-.patch new file mode 100644 index 0000000..a127501 --- /dev/null +++ b/patches.kernel.org/6.2.11-155-maple_tree-fix-a-potential-concurrency-bug-in-.patch @@ -0,0 +1,88 @@ +From: Peng Zhang +Date: Tue, 14 Mar 2023 20:42:03 +0800 +Subject: [PATCH] maple_tree: fix a potential concurrency bug in RCU mode +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: c45ea315a602d45569b08b93e9ab30f6a63a38aa + +commit c45ea315a602d45569b08b93e9ab30f6a63a38aa upstream. + +There is a concurrency bug that may cause the wrong value to be loaded +when a CPU is modifying the maple tree. + +CPU1: +mtree_insert_range() + mas_insert() + mas_store_root() + ... + mas_root_expand() + ... + rcu_assign_pointer(mas->tree->ma_root, mte_mk_root(mas->node)); + ma_set_meta(node, maple_leaf_64, 0, slot); <---IP + +CPU2: +mtree_load() + mtree_lookup_walk() + ma_data_end(); + +When CPU1 is about to execute the instruction pointed to by IP, the +ma_data_end() executed by CPU2 may return the wrong end position, which +will cause the value loaded by mtree_load() to be wrong. + +An example of triggering the bug: + +Add mdelay(100) between rcu_assign_pointer() and ma_set_meta() in +mas_root_expand(). + +static DEFINE_MTREE(tree); +int work(void *p) { + unsigned long val; + for (int i = 0 ; i< 30; ++i) { + val = (unsigned long)mtree_load(&tree, 8); + mdelay(5); + pr_info("%lu",val); + } + return 0; +} + +mt_init_flags(&tree, MT_FLAGS_USE_RCU); +mtree_insert(&tree, 0, (void*)12345, GFP_KERNEL); +run_thread(work) +mtree_insert(&tree, 1, (void*)56789, GFP_KERNEL); + +In RCU mode, mtree_load() should always return the value before or after +the data structure is modified, and in this example mtree_load(&tree, 8) +may return 56789 which is not expected, it should always return NULL. Fix +it by put ma_set_meta() before rcu_assign_pointer(). + +Link: https://lkml.kernel.org/r/20230314124203.91572-4-zhangpeng.00@bytedance.com +Fixes: 54a611b60590 ("Maple Tree: add new data structure") +Signed-off-by: Peng Zhang +Reviewed-by: Liam R. Howlett +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + lib/maple_tree.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/lib/maple_tree.c b/lib/maple_tree.c +index 61223895..7e79fa2b 100644 +--- a/lib/maple_tree.c ++++ b/lib/maple_tree.c +@@ -3659,10 +3659,9 @@ static inline int mas_root_expand(struct ma_state *mas, void *entry) + slot++; + mas->depth = 1; + mas_set_height(mas); +- ++ ma_set_meta(node, maple_leaf_64, 0, slot); + /* swap the new root into the tree */ + rcu_assign_pointer(mas->tree->ma_root, mte_mk_root(mas->node)); +- ma_set_meta(node, maple_leaf_64, 0, slot); + return slot; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-156-drm-amd-display-Clear-MST-topology-if-it-fails.patch b/patches.kernel.org/6.2.11-156-drm-amd-display-Clear-MST-topology-if-it-fails.patch new file mode 100644 index 0000000..019d546 --- /dev/null +++ b/patches.kernel.org/6.2.11-156-drm-amd-display-Clear-MST-topology-if-it-fails.patch @@ -0,0 +1,45 @@ +From: Roman Li +Date: Thu, 1 Dec 2022 09:49:23 -0500 +Subject: [PATCH] drm/amd/display: Clear MST topology if it fails to resume +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 3f6752b4de41896c7f1609b1585db2080e8150d8 + +commit 3f6752b4de41896c7f1609b1585db2080e8150d8 upstream. + +[Why] +In case of failure to resume MST topology after suspend, an emtpty +mst tree prevents further mst hub detection on the same connector. +That causes the issue with MST hub hotplug after it's been unplug in +suspend. + +[How] +Stop topology manager on the connector after detecting DM_MST failure. + +Reviewed-by: Wayne Lin +Acked-by: Jasdeep Dhillon +Signed-off-by: Roman Li +Signed-off-by: Alex Deucher +Cc: "Limonciello, Mario" +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 8661de32..7fa17283 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -2183,6 +2183,8 @@ static int detect_mst_link_for_all_connectors(struct drm_device *dev) + DRM_ERROR("DM_MST: Failed to start MST\n"); + aconnector->dc_link->type = + dc_connection_single; ++ ret = dm_helpers_dp_mst_stop_top_mgr(aconnector->dc_link->ctx, ++ aconnector->dc_link); + break; + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-157-drm-amdgpu-for-S0ix-skip-SDMA-5.x-suspend-resu.patch b/patches.kernel.org/6.2.11-157-drm-amdgpu-for-S0ix-skip-SDMA-5.x-suspend-resu.patch new file mode 100644 index 0000000..c2366bb --- /dev/null +++ b/patches.kernel.org/6.2.11-157-drm-amdgpu-for-S0ix-skip-SDMA-5.x-suspend-resu.patch @@ -0,0 +1,45 @@ +From: Alex Deucher +Date: Fri, 2 Dec 2022 10:13:40 -0500 +Subject: [PATCH] drm/amdgpu: for S0ix, skip SDMA 5.x+ suspend/resume +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 2a7798ea7390fd78f191c9e9bf68f5581d3b4a02 + +commit 2a7798ea7390fd78f191c9e9bf68f5581d3b4a02 upstream. + +SDMA 5.x is part of the GFX block so it's controlled via +GFXOFF. Skip suspend as it should be handled the same +as GFX. + +v2: drop SDMA 4.x. That requires special handling. + +Reviewed-by: Mario Limonciello +Acked-by: Rajneesh Bhardwaj +Signed-off-by: Alex Deucher +Cc: "Limonciello, Mario" +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index d5e14a3a..5f6d756f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -3045,6 +3045,12 @@ static int amdgpu_device_ip_suspend_phase2(struct amdgpu_device *adev) + adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_MES)) + continue; + ++ /* SDMA 5.x+ is part of GFX power domain so it's covered by GFXOFF */ ++ if (adev->in_s0ix && ++ (adev->ip_versions[SDMA0_HWIP][0] >= IP_VERSION(5, 0, 0)) && ++ (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_SDMA)) ++ continue; ++ + /* XXX handle errors */ + r = adev->ip_blocks[i].version->funcs->suspend(adev); + /* XXX handle errors */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-158-drm-amdgpu-skip-psp-suspend-for-IMU-enabled-AS.patch b/patches.kernel.org/6.2.11-158-drm-amdgpu-skip-psp-suspend-for-IMU-enabled-AS.patch new file mode 100644 index 0000000..39ca3ad --- /dev/null +++ b/patches.kernel.org/6.2.11-158-drm-amdgpu-skip-psp-suspend-for-IMU-enabled-AS.patch @@ -0,0 +1,49 @@ +From: Tim Huang +Date: Fri, 20 Jan 2023 22:27:32 +0800 +Subject: [PATCH] drm/amdgpu: skip psp suspend for IMU enabled ASICs mode2 + reset +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: e11c775030c5585370fda43035204bb5fa23b139 + +commit e11c775030c5585370fda43035204bb5fa23b139 upstream. + +The psp suspend & resume should be skipped to avoid destroy +the TMR and reload FWs again for IMU enabled APU ASICs. + +Signed-off-by: Tim Huang +Acked-by: Alex Deucher +Reviewed-by: Mario Limonciello +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 5f6d756f..3dac1e13 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -3051,6 +3051,18 @@ static int amdgpu_device_ip_suspend_phase2(struct amdgpu_device *adev) + (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_SDMA)) + continue; + ++ /* Once swPSP provides the IMU, RLC FW binaries to TOS during cold-boot. ++ * These are in TMR, hence are expected to be reused by PSP-TOS to reload ++ * from this location and RLC Autoload automatically also gets loaded ++ * from here based on PMFW -> PSP message during re-init sequence. ++ * Therefore, the psp suspend & resume should be skipped to avoid destroy ++ * the TMR and reload FWs again for IMU enabled APU ASICs. ++ */ ++ if (amdgpu_in_reset(adev) && ++ (adev->flags & AMD_IS_APU) && adev->gfx.imu.funcs && ++ adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_PSP) ++ continue; ++ + /* XXX handle errors */ + r = adev->ip_blocks[i].version->funcs->suspend(adev); + /* XXX handle errors */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-159-drm-bridge-lt9611-Fix-PLL-being-unable-to-lock.patch b/patches.kernel.org/6.2.11-159-drm-bridge-lt9611-Fix-PLL-being-unable-to-lock.patch new file mode 100644 index 0000000..724f1dc --- /dev/null +++ b/patches.kernel.org/6.2.11-159-drm-bridge-lt9611-Fix-PLL-being-unable-to-lock.patch @@ -0,0 +1,43 @@ +From: Robert Foss +Date: Tue, 13 Dec 2022 16:03:04 +0100 +Subject: [PATCH] drm/bridge: lt9611: Fix PLL being unable to lock +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 2a9df204be0bbb896e087f00b9ee3fc559d5a608 + +commit 2a9df204be0bbb896e087f00b9ee3fc559d5a608 upstream. + +This fixes PLL being unable to lock, and is derived from an equivalent +downstream commit. + +Available LT9611 documentation does not list this register, neither does +LT9611UXC (which is a different chip). + +This commit has been confirmed to fix HDMI output on DragonBoard 845c. + +Suggested-by: Amit Pundir +Reviewed-by: Amit Pundir +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20221213150304.4189760-1-robert.foss@linaro.org +Signed-off-by: Amit Pundir +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index 3b77238c..ae8c6d9d 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -258,6 +258,7 @@ static int lt9611_pll_setup(struct lt9611 *lt9611, const struct drm_display_mode + { 0x8126, 0x55 }, + { 0x8127, 0x66 }, + { 0x8128, 0x88 }, ++ { 0x812a, 0x20 }, + }; + + regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg)); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-160-mm-take-a-page-reference-when-removing-device-.patch b/patches.kernel.org/6.2.11-160-mm-take-a-page-reference-when-removing-device-.patch new file mode 100644 index 0000000..353828c --- /dev/null +++ b/patches.kernel.org/6.2.11-160-mm-take-a-page-reference-when-removing-device-.patch @@ -0,0 +1,91 @@ +From: Alistair Popple +Date: Thu, 30 Mar 2023 12:25:19 +1100 +Subject: [PATCH] mm: take a page reference when removing device exclusive + entries +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 7c7b962938ddda6a9cd095de557ee5250706ea88 + +commit 7c7b962938ddda6a9cd095de557ee5250706ea88 upstream. + +Device exclusive page table entries are used to prevent CPU access to a +page whilst it is being accessed from a device. Typically this is used to +implement atomic operations when the underlying bus does not support +atomic access. When a CPU thread encounters a device exclusive entry it +locks the page and restores the original entry after calling mmu notifiers +to signal drivers that exclusive access is no longer available. + +The device exclusive entry holds a reference to the page making it safe to +access the struct page whilst the entry is present. However the fault +handling code does not hold the PTL when taking the page lock. This means +if there are multiple threads faulting concurrently on the device +exclusive entry one will remove the entry whilst others will wait on the +page lock without holding a reference. + +This can lead to threads locking or waiting on a folio with a zero +refcount. Whilst mmap_lock prevents the pages getting freed via munmap() +they may still be freed by a migration. This leads to warnings such as +PAGE_FLAGS_CHECK_AT_FREE due to the page being locked when the refcount +drops to zero. + +Fix this by trying to take a reference on the folio before locking it. +The code already checks the PTE under the PTL and aborts if the entry is +no longer there. It is also possible the folio has been unmapped, freed +and re-allocated allowing a reference to be taken on an unrelated folio. +This case is also detected by the PTE check and the folio is unlocked +without further changes. + +Link: https://lkml.kernel.org/r/20230330012519.804116-1-apopple@nvidia.com +Fixes: b756a3b5e7ea ("mm: device exclusive memory access") +Signed-off-by: Alistair Popple +Reviewed-by: Ralph Campbell +Reviewed-by: John Hubbard +Acked-by: David Hildenbrand +Cc: Matthew Wilcox (Oracle) +Cc: Christoph Hellwig +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + mm/memory.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/mm/memory.c b/mm/memory.c +index f526b915..6a99e9dc 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -3580,8 +3580,21 @@ static vm_fault_t remove_device_exclusive_entry(struct vm_fault *vmf) + struct vm_area_struct *vma = vmf->vma; + struct mmu_notifier_range range; + +- if (!folio_lock_or_retry(folio, vma->vm_mm, vmf->flags)) ++ /* ++ * We need a reference to lock the folio because we don't hold ++ * the PTL so a racing thread can remove the device-exclusive ++ * entry and unmap it. If the folio is free the entry must ++ * have been removed already. If it happens to have already ++ * been re-allocated after being freed all we do is lock and ++ * unlock it. ++ */ ++ if (!folio_try_get(folio)) ++ return 0; ++ ++ if (!folio_lock_or_retry(folio, vma->vm_mm, vmf->flags)) { ++ folio_put(folio); + return VM_FAULT_RETRY; ++ } + mmu_notifier_range_init_owner(&range, MMU_NOTIFY_EXCLUSIVE, 0, vma, + vma->vm_mm, vmf->address & PAGE_MASK, + (vmf->address & PAGE_MASK) + PAGE_SIZE, NULL); +@@ -3594,6 +3607,7 @@ static vm_fault_t remove_device_exclusive_entry(struct vm_fault *vmf) + + pte_unmap_unlock(vmf->pte, vmf->ptl); + folio_unlock(folio); ++ folio_put(folio); + + mmu_notifier_invalidate_range_end(&range); + return 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-161-maple_tree-remove-GFP_ZERO-from-kmem_cache_all.patch b/patches.kernel.org/6.2.11-161-maple_tree-remove-GFP_ZERO-from-kmem_cache_all.patch new file mode 100644 index 0000000..1fd5642 --- /dev/null +++ b/patches.kernel.org/6.2.11-161-maple_tree-remove-GFP_ZERO-from-kmem_cache_all.patch @@ -0,0 +1,300 @@ +From: "Liam R. Howlett" +Date: Tue, 11 Apr 2023 11:10:42 -0400 +Subject: [PATCH] maple_tree: remove GFP_ZERO from kmem_cache_alloc() and + kmem_cache_alloc_bulk() +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 541e06b772c1aaffb3b6a245ccface36d7107af2 + +commit 541e06b772c1aaffb3b6a245ccface36d7107af2 upstream. + +Preallocations are common in the VMA code to avoid allocating under +certain locking conditions. The preallocations must also cover the +worst-case scenario. Removing the GFP_ZERO flag from the +kmem_cache_alloc() (and bulk variant) calls will reduce the amount of time +spent zeroing memory that may not be used. Only zero out the necessary +area to keep track of the allocations in the maple state. Zero the entire +node prior to using it in the tree. + +This required internal changes to node counting on allocation, so the test +code is also updated. + +This restores some micro-benchmark performance: up to +9% in mmtests mmap1 +by my testing +10% to +20% in mmap, mmapaddr, mmapmany tests reported by +Red Hat + +Link: https://bugzilla.redhat.com/show_bug.cgi?id=2149636 +Link: https://lkml.kernel.org/r/20230105160427.2988454-1-Liam.Howlett@oracle.com +Cc: stable@vger.kernel.org +Fixes: 54a611b60590 ("Maple Tree: add new data structure") +Signed-off-by: Liam Howlett +Reported-by: Jirka Hladky +Suggested-by: Matthew Wilcox (Oracle) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + lib/maple_tree.c | 80 +++++++++++++++++--------------- + tools/testing/radix-tree/maple.c | 18 +++---- + 2 files changed, 52 insertions(+), 46 deletions(-) + +diff --git a/lib/maple_tree.c b/lib/maple_tree.c +index 7e79fa2b..0b8353c6 100644 +--- a/lib/maple_tree.c ++++ b/lib/maple_tree.c +@@ -149,13 +149,12 @@ struct maple_subtree_state { + /* Functions */ + static inline struct maple_node *mt_alloc_one(gfp_t gfp) + { +- return kmem_cache_alloc(maple_node_cache, gfp | __GFP_ZERO); ++ return kmem_cache_alloc(maple_node_cache, gfp); + } + + static inline int mt_alloc_bulk(gfp_t gfp, size_t size, void **nodes) + { +- return kmem_cache_alloc_bulk(maple_node_cache, gfp | __GFP_ZERO, size, +- nodes); ++ return kmem_cache_alloc_bulk(maple_node_cache, gfp, size, nodes); + } + + static inline void mt_free_bulk(size_t size, void __rcu **nodes) +@@ -1128,9 +1127,10 @@ static inline struct maple_node *mas_pop_node(struct ma_state *mas) + { + struct maple_alloc *ret, *node = mas->alloc; + unsigned long total = mas_allocated(mas); ++ unsigned int req = mas_alloc_req(mas); + + /* nothing or a request pending. */ +- if (unlikely(!total)) ++ if (WARN_ON(!total)) + return NULL; + + if (total == 1) { +@@ -1140,27 +1140,25 @@ static inline struct maple_node *mas_pop_node(struct ma_state *mas) + goto single_node; + } + +- if (!node->node_count) { ++ if (node->node_count == 1) { + /* Single allocation in this node. */ + mas->alloc = node->slot[0]; +- node->slot[0] = NULL; + mas->alloc->total = node->total - 1; + ret = node; + goto new_head; + } +- + node->total--; +- ret = node->slot[node->node_count]; +- node->slot[node->node_count--] = NULL; ++ ret = node->slot[--node->node_count]; ++ node->slot[node->node_count] = NULL; + + single_node: + new_head: +- ret->total = 0; +- ret->node_count = 0; +- if (ret->request_count) { +- mas_set_alloc_req(mas, ret->request_count + 1); +- ret->request_count = 0; ++ if (req) { ++ req++; ++ mas_set_alloc_req(mas, req); + } ++ ++ memset(ret, 0, sizeof(*ret)); + return (struct maple_node *)ret; + } + +@@ -1179,21 +1177,20 @@ static inline void mas_push_node(struct ma_state *mas, struct maple_node *used) + unsigned long count; + unsigned int requested = mas_alloc_req(mas); + +- memset(reuse, 0, sizeof(*reuse)); + count = mas_allocated(mas); + +- if (count && (head->node_count < MAPLE_ALLOC_SLOTS - 1)) { +- if (head->slot[0]) +- head->node_count++; +- head->slot[head->node_count] = reuse; ++ reuse->request_count = 0; ++ reuse->node_count = 0; ++ if (count && (head->node_count < MAPLE_ALLOC_SLOTS)) { ++ head->slot[head->node_count++] = reuse; + head->total++; + goto done; + } + + reuse->total = 1; + if ((head) && !((unsigned long)head & 0x1)) { +- head->request_count = 0; + reuse->slot[0] = head; ++ reuse->node_count = 1; + reuse->total += head->total; + } + +@@ -1212,7 +1209,6 @@ static inline void mas_alloc_nodes(struct ma_state *mas, gfp_t gfp) + { + struct maple_alloc *node; + unsigned long allocated = mas_allocated(mas); +- unsigned long success = allocated; + unsigned int requested = mas_alloc_req(mas); + unsigned int count; + void **slots = NULL; +@@ -1228,24 +1224,29 @@ static inline void mas_alloc_nodes(struct ma_state *mas, gfp_t gfp) + WARN_ON(!allocated); + } + +- if (!allocated || mas->alloc->node_count == MAPLE_ALLOC_SLOTS - 1) { ++ if (!allocated || mas->alloc->node_count == MAPLE_ALLOC_SLOTS) { + node = (struct maple_alloc *)mt_alloc_one(gfp); + if (!node) + goto nomem_one; + +- if (allocated) ++ if (allocated) { + node->slot[0] = mas->alloc; ++ node->node_count = 1; ++ } else { ++ node->node_count = 0; ++ } + +- success++; + mas->alloc = node; ++ node->total = ++allocated; + requested--; + } + + node = mas->alloc; ++ node->request_count = 0; + while (requested) { + max_req = MAPLE_ALLOC_SLOTS; +- if (node->slot[0]) { +- unsigned int offset = node->node_count + 1; ++ if (node->node_count) { ++ unsigned int offset = node->node_count; + + slots = (void **)&node->slot[offset]; + max_req -= offset; +@@ -1259,15 +1260,13 @@ static inline void mas_alloc_nodes(struct ma_state *mas, gfp_t gfp) + goto nomem_bulk; + + node->node_count += count; +- /* zero indexed. */ +- if (slots == (void **)&node->slot) +- node->node_count--; +- +- success += count; ++ allocated += count; + node = node->slot[0]; ++ node->node_count = 0; ++ node->request_count = 0; + requested -= count; + } +- mas->alloc->total = success; ++ mas->alloc->total = allocated; + return; + + nomem_bulk: +@@ -1276,7 +1275,7 @@ static inline void mas_alloc_nodes(struct ma_state *mas, gfp_t gfp) + nomem_one: + mas_set_alloc_req(mas, requested); + if (mas->alloc && !(((unsigned long)mas->alloc & 0x1))) +- mas->alloc->total = success; ++ mas->alloc->total = allocated; + mas_set_err(mas, -ENOMEM); + return; + +@@ -5725,6 +5724,7 @@ int mas_preallocate(struct ma_state *mas, void *entry, gfp_t gfp) + void mas_destroy(struct ma_state *mas) + { + struct maple_alloc *node; ++ unsigned long total; + + /* + * When using mas_for_each() to insert an expected number of elements, +@@ -5747,14 +5747,20 @@ void mas_destroy(struct ma_state *mas) + } + mas->mas_flags &= ~(MA_STATE_BULK|MA_STATE_PREALLOC); + +- while (mas->alloc && !((unsigned long)mas->alloc & 0x1)) { ++ total = mas_allocated(mas); ++ while (total) { + node = mas->alloc; + mas->alloc = node->slot[0]; +- if (node->node_count > 0) +- mt_free_bulk(node->node_count, +- (void __rcu **)&node->slot[1]); ++ if (node->node_count > 1) { ++ size_t count = node->node_count - 1; ++ ++ mt_free_bulk(count, (void __rcu **)&node->slot[1]); ++ total -= count; ++ } + kmem_cache_free(maple_node_cache, node); ++ total--; + } ++ + mas->alloc = NULL; + } + EXPORT_SYMBOL_GPL(mas_destroy); +diff --git a/tools/testing/radix-tree/maple.c b/tools/testing/radix-tree/maple.c +index 81fa7ec2..1f36bc1c 100644 +--- a/tools/testing/radix-tree/maple.c ++++ b/tools/testing/radix-tree/maple.c +@@ -173,11 +173,11 @@ static noinline void check_new_node(struct maple_tree *mt) + + if (!MAPLE_32BIT) { + if (i >= 35) +- e = i - 35; ++ e = i - 34; + else if (i >= 5) +- e = i - 5; ++ e = i - 4; + else if (i >= 2) +- e = i - 2; ++ e = i - 1; + } else { + if (i >= 4) + e = i - 4; +@@ -305,17 +305,17 @@ static noinline void check_new_node(struct maple_tree *mt) + MT_BUG_ON(mt, mas.node != MA_ERROR(-ENOMEM)); + MT_BUG_ON(mt, !mas_nomem(&mas, GFP_KERNEL)); + MT_BUG_ON(mt, mas_allocated(&mas) != MAPLE_ALLOC_SLOTS + 1); +- MT_BUG_ON(mt, mas.alloc->node_count != MAPLE_ALLOC_SLOTS - 1); ++ MT_BUG_ON(mt, mas.alloc->node_count != MAPLE_ALLOC_SLOTS); + + mn = mas_pop_node(&mas); /* get the next node. */ + MT_BUG_ON(mt, mn == NULL); + MT_BUG_ON(mt, not_empty(mn)); + MT_BUG_ON(mt, mas_allocated(&mas) != MAPLE_ALLOC_SLOTS); +- MT_BUG_ON(mt, mas.alloc->node_count != MAPLE_ALLOC_SLOTS - 2); ++ MT_BUG_ON(mt, mas.alloc->node_count != MAPLE_ALLOC_SLOTS - 1); + + mas_push_node(&mas, mn); + MT_BUG_ON(mt, mas_allocated(&mas) != MAPLE_ALLOC_SLOTS + 1); +- MT_BUG_ON(mt, mas.alloc->node_count != MAPLE_ALLOC_SLOTS - 1); ++ MT_BUG_ON(mt, mas.alloc->node_count != MAPLE_ALLOC_SLOTS); + + /* Check the limit of pop/push/pop */ + mas_node_count(&mas, MAPLE_ALLOC_SLOTS + 2); /* Request */ +@@ -323,14 +323,14 @@ static noinline void check_new_node(struct maple_tree *mt) + MT_BUG_ON(mt, mas.node != MA_ERROR(-ENOMEM)); + MT_BUG_ON(mt, !mas_nomem(&mas, GFP_KERNEL)); + MT_BUG_ON(mt, mas_alloc_req(&mas)); +- MT_BUG_ON(mt, mas.alloc->node_count); ++ MT_BUG_ON(mt, mas.alloc->node_count != 1); + MT_BUG_ON(mt, mas_allocated(&mas) != MAPLE_ALLOC_SLOTS + 2); + mn = mas_pop_node(&mas); + MT_BUG_ON(mt, not_empty(mn)); + MT_BUG_ON(mt, mas_allocated(&mas) != MAPLE_ALLOC_SLOTS + 1); +- MT_BUG_ON(mt, mas.alloc->node_count != MAPLE_ALLOC_SLOTS - 1); ++ MT_BUG_ON(mt, mas.alloc->node_count != MAPLE_ALLOC_SLOTS); + mas_push_node(&mas, mn); +- MT_BUG_ON(mt, mas.alloc->node_count); ++ MT_BUG_ON(mt, mas.alloc->node_count != 1); + MT_BUG_ON(mt, mas_allocated(&mas) != MAPLE_ALLOC_SLOTS + 2); + mn = mas_pop_node(&mas); + MT_BUG_ON(mt, not_empty(mn)); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-162-maple_tree-fix-potential-rcu-issue.patch b/patches.kernel.org/6.2.11-162-maple_tree-fix-potential-rcu-issue.patch new file mode 100644 index 0000000..42932a0 --- /dev/null +++ b/patches.kernel.org/6.2.11-162-maple_tree-fix-potential-rcu-issue.patch @@ -0,0 +1,43 @@ +From: "Liam R. Howlett" +Date: Tue, 11 Apr 2023 11:10:43 -0400 +Subject: [PATCH] maple_tree: fix potential rcu issue +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 65be6f058b0eba98dc6c6f197ea9f62c9b6a519f + +commit 65be6f058b0eba98dc6c6f197ea9f62c9b6a519f upstream. + +Ensure the node isn't dead after reading the node end. + +Link: https://lkml.kernel.org/r/20230120162650.984577-3-Liam.Howlett@oracle.com +Cc: +Fixes: 54a611b60590 ("Maple Tree: add new data structure") +Signed-off-by: Liam R. Howlett +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + lib/maple_tree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/maple_tree.c b/lib/maple_tree.c +index 0b8353c6..e0a76f63 100644 +--- a/lib/maple_tree.c ++++ b/lib/maple_tree.c +@@ -4655,13 +4655,13 @@ static inline void *mas_next_nentry(struct ma_state *mas, + pivots = ma_pivots(node, type); + slots = ma_slots(node, type); + mas->index = mas_safe_min(mas, pivots, mas->offset); ++ count = ma_data_end(node, type, pivots, mas->max); + if (ma_dead_node(node)) + return NULL; + + if (mas->index > max) + return NULL; + +- count = ma_data_end(node, type, pivots, mas->max); + if (mas->offset > count) + return NULL; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-163-maple_tree-reduce-user-error-potential.patch b/patches.kernel.org/6.2.11-163-maple_tree-reduce-user-error-potential.patch new file mode 100644 index 0000000..d65fd1b --- /dev/null +++ b/patches.kernel.org/6.2.11-163-maple_tree-reduce-user-error-potential.patch @@ -0,0 +1,54 @@ +From: "Liam R. Howlett" +Date: Tue, 11 Apr 2023 11:10:44 -0400 +Subject: [PATCH] maple_tree: reduce user error potential +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 50e81c82ad947045c7ed26ddc9acb17276b653b6 + +commit 50e81c82ad947045c7ed26ddc9acb17276b653b6 upstream. + +When iterating, a user may operate on the tree and cause the maple state +to be altered and left in an unintuitive state. Detect this scenario and +correct it by setting to the limit and invalidating the state. + +Link: https://lkml.kernel.org/r/20230120162650.984577-4-Liam.Howlett@oracle.com +Cc: +Fixes: 54a611b60590 ("Maple Tree: add new data structure") +Signed-off-by: Liam R. Howlett +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + lib/maple_tree.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/lib/maple_tree.c b/lib/maple_tree.c +index e0a76f63..9a97bab9 100644 +--- a/lib/maple_tree.c ++++ b/lib/maple_tree.c +@@ -4736,6 +4736,11 @@ static inline void *mas_next_entry(struct ma_state *mas, unsigned long limit) + unsigned long last; + enum maple_type mt; + ++ if (mas->index > limit) { ++ mas->index = mas->last = limit; ++ mas_pause(mas); ++ return NULL; ++ } + last = mas->last; + retry: + offset = mas->offset; +@@ -4842,6 +4847,11 @@ static inline void *mas_prev_entry(struct ma_state *mas, unsigned long min) + { + void *entry; + ++ if (mas->index < min) { ++ mas->index = mas->last = min; ++ mas_pause(mas); ++ return NULL; ++ } + retry: + while (likely(!mas_is_none(mas))) { + entry = mas_prev_nentry(mas, min, mas->index); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-164-maple_tree-fix-handle-of-invalidated-state-in-.patch b/patches.kernel.org/6.2.11-164-maple_tree-fix-handle-of-invalidated-state-in-.patch new file mode 100644 index 0000000..cd9c2fd --- /dev/null +++ b/patches.kernel.org/6.2.11-164-maple_tree-fix-handle-of-invalidated-state-in-.patch @@ -0,0 +1,43 @@ +From: "Liam R. Howlett" +Date: Tue, 11 Apr 2023 11:10:45 -0400 +Subject: [PATCH] maple_tree: fix handle of invalidated state in + mas_wr_store_setup() +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 1202700c3f8cc5f7e4646c3cf05ee6f7c8bc6ccf + +commit 1202700c3f8cc5f7e4646c3cf05ee6f7c8bc6ccf upstream. + +If an invalidated maple state is encountered during write, reset the maple +state to MAS_START. This will result in a re-walk of the tree to the +correct location for the write. + +Link: https://lore.kernel.org/all/20230107020126.1627-1-sj@kernel.org/ +Link: https://lkml.kernel.org/r/20230120162650.984577-6-Liam.Howlett@oracle.com +Cc: +Fixes: 54a611b60590 ("Maple Tree: add new data structure") +Signed-off-by: Liam R. Howlett +Reported-by: SeongJae Park +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + lib/maple_tree.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/lib/maple_tree.c b/lib/maple_tree.c +index 9a97bab9..6041f74a 100644 +--- a/lib/maple_tree.c ++++ b/lib/maple_tree.c +@@ -5599,6 +5599,9 @@ static inline void mte_destroy_walk(struct maple_enode *enode, + + static void mas_wr_store_setup(struct ma_wr_state *wr_mas) + { ++ if (unlikely(mas_is_paused(wr_mas->mas))) ++ mas_reset(wr_mas->mas); ++ + if (!mas_is_start(wr_mas->mas)) { + if (mas_is_none(wr_mas->mas)) { + mas_reset(wr_mas->mas); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-165-maple_tree-fix-mas_prev-and-mas_find-state-han.patch b/patches.kernel.org/6.2.11-165-maple_tree-fix-mas_prev-and-mas_find-state-han.patch new file mode 100644 index 0000000..627ff5f --- /dev/null +++ b/patches.kernel.org/6.2.11-165-maple_tree-fix-mas_prev-and-mas_find-state-han.patch @@ -0,0 +1,58 @@ +From: "Liam R. Howlett" +Date: Tue, 11 Apr 2023 11:10:46 -0400 +Subject: [PATCH] maple_tree: fix mas_prev() and mas_find() state handling +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 17dc622c7b0f94e49bed030726df4db12ecaa6b5 + +commit 17dc622c7b0f94e49bed030726df4db12ecaa6b5 upstream. + +When mas_prev() does not find anything, set the state to MAS_NONE. + +Handle the MAS_NONE in mas_find() like a MAS_START. + +Link: https://lkml.kernel.org/r/20230120162650.984577-7-Liam.Howlett@oracle.com +Cc: +Fixes: 54a611b60590 ("Maple Tree: add new data structure") +Signed-off-by: Liam R. Howlett +Reported-by: +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + lib/maple_tree.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/lib/maple_tree.c b/lib/maple_tree.c +index 6041f74a..480e7fbf 100644 +--- a/lib/maple_tree.c ++++ b/lib/maple_tree.c +@@ -4849,7 +4849,7 @@ static inline void *mas_prev_entry(struct ma_state *mas, unsigned long min) + + if (mas->index < min) { + mas->index = mas->last = min; +- mas_pause(mas); ++ mas->node = MAS_NONE; + return NULL; + } + retry: +@@ -5911,6 +5911,7 @@ void *mas_prev(struct ma_state *mas, unsigned long min) + if (!mas->index) { + /* Nothing comes before 0 */ + mas->last = 0; ++ mas->node = MAS_NONE; + return NULL; + } + +@@ -6001,6 +6002,9 @@ void *mas_find(struct ma_state *mas, unsigned long max) + mas->index = ++mas->last; + } + ++ if (unlikely(mas_is_none(mas))) ++ mas->node = MAS_START; ++ + if (unlikely(mas_is_start(mas))) { + /* First run or continue */ + void *entry; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-166-maple_tree-be-more-cautious-about-dead-nodes.patch b/patches.kernel.org/6.2.11-166-maple_tree-be-more-cautious-about-dead-nodes.patch new file mode 100644 index 0000000..b76b169 --- /dev/null +++ b/patches.kernel.org/6.2.11-166-maple_tree-be-more-cautious-about-dead-nodes.patch @@ -0,0 +1,193 @@ +From: "Liam R. Howlett" +Date: Tue, 11 Apr 2023 11:10:48 -0400 +Subject: [PATCH] maple_tree: be more cautious about dead nodes +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 39d0bd86c499ecd6abae42a9b7112056c5560691 + +commit 39d0bd86c499ecd6abae42a9b7112056c5560691 upstream. + +ma_pivots() and ma_data_end() may be called with a dead node. Ensure to +that the node isn't dead before using the returned values. + +This is necessary for RCU mode of the maple tree. + +Link: https://lkml.kernel.org/r/20230227173632.3292573-1-surenb@google.com +Link: https://lkml.kernel.org/r/20230227173632.3292573-2-surenb@google.com +Fixes: 54a611b60590 ("Maple Tree: add new data structure") +Cc: +Signed-off-by: Liam Howlett +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + lib/maple_tree.c | 52 +++++++++++++++++++++++++++++++++++++++--------- + 1 file changed, 43 insertions(+), 9 deletions(-) + +diff --git a/lib/maple_tree.c b/lib/maple_tree.c +index 480e7fbf..d486c703 100644 +--- a/lib/maple_tree.c ++++ b/lib/maple_tree.c +@@ -539,6 +539,7 @@ static inline bool ma_dead_node(const struct maple_node *node) + + return (parent == node); + } ++ + /* + * mte_dead_node() - check if the @enode is dead. + * @enode: The encoded maple node +@@ -620,6 +621,8 @@ static inline unsigned int mas_alloc_req(const struct ma_state *mas) + * @node - the maple node + * @type - the node type + * ++ * In the event of a dead node, this array may be %NULL ++ * + * Return: A pointer to the maple node pivots + */ + static inline unsigned long *ma_pivots(struct maple_node *node, +@@ -1091,8 +1094,11 @@ static int mas_ascend(struct ma_state *mas) + a_type = mas_parent_enum(mas, p_enode); + a_node = mte_parent(p_enode); + a_slot = mte_parent_slot(p_enode); +- pivots = ma_pivots(a_node, a_type); + a_enode = mt_mk_node(a_node, a_type); ++ pivots = ma_pivots(a_node, a_type); ++ ++ if (unlikely(ma_dead_node(a_node))) ++ return 1; + + if (!set_min && a_slot) { + set_min = true; +@@ -1398,6 +1404,9 @@ static inline unsigned char ma_data_end(struct maple_node *node, + { + unsigned char offset; + ++ if (!pivots) ++ return 0; ++ + if (type == maple_arange_64) + return ma_meta_end(node, type); + +@@ -1433,6 +1442,9 @@ static inline unsigned char mas_data_end(struct ma_state *mas) + return ma_meta_end(node, type); + + pivots = ma_pivots(node, type); ++ if (unlikely(ma_dead_node(node))) ++ return 0; ++ + offset = mt_pivots[type] - 1; + if (likely(!pivots[offset])) + return ma_meta_end(node, type); +@@ -4498,6 +4510,9 @@ static inline int mas_prev_node(struct ma_state *mas, unsigned long min) + node = mas_mn(mas); + slots = ma_slots(node, mt); + pivots = ma_pivots(node, mt); ++ if (unlikely(ma_dead_node(node))) ++ return 1; ++ + mas->max = pivots[offset]; + if (offset) + mas->min = pivots[offset - 1] + 1; +@@ -4519,6 +4534,9 @@ static inline int mas_prev_node(struct ma_state *mas, unsigned long min) + slots = ma_slots(node, mt); + pivots = ma_pivots(node, mt); + offset = ma_data_end(node, mt, pivots, mas->max); ++ if (unlikely(ma_dead_node(node))) ++ return 1; ++ + if (offset) + mas->min = pivots[offset - 1] + 1; + +@@ -4567,6 +4585,7 @@ static inline int mas_next_node(struct ma_state *mas, struct maple_node *node, + struct maple_enode *enode; + int level = 0; + unsigned char offset; ++ unsigned char node_end; + enum maple_type mt; + void __rcu **slots; + +@@ -4590,7 +4609,11 @@ static inline int mas_next_node(struct ma_state *mas, struct maple_node *node, + node = mas_mn(mas); + mt = mte_node_type(mas->node); + pivots = ma_pivots(node, mt); +- } while (unlikely(offset == ma_data_end(node, mt, pivots, mas->max))); ++ node_end = ma_data_end(node, mt, pivots, mas->max); ++ if (unlikely(ma_dead_node(node))) ++ return 1; ++ ++ } while (unlikely(offset == node_end)); + + slots = ma_slots(node, mt); + pivot = mas_safe_pivot(mas, pivots, ++offset, mt); +@@ -4606,6 +4629,9 @@ static inline int mas_next_node(struct ma_state *mas, struct maple_node *node, + mt = mte_node_type(mas->node); + slots = ma_slots(node, mt); + pivots = ma_pivots(node, mt); ++ if (unlikely(ma_dead_node(node))) ++ return 1; ++ + offset = 0; + pivot = pivots[0]; + } +@@ -4652,11 +4678,14 @@ static inline void *mas_next_nentry(struct ma_state *mas, + return NULL; + } + +- pivots = ma_pivots(node, type); + slots = ma_slots(node, type); +- mas->index = mas_safe_min(mas, pivots, mas->offset); ++ pivots = ma_pivots(node, type); + count = ma_data_end(node, type, pivots, mas->max); +- if (ma_dead_node(node)) ++ if (unlikely(ma_dead_node(node))) ++ return NULL; ++ ++ mas->index = mas_safe_min(mas, pivots, mas->offset); ++ if (unlikely(ma_dead_node(node))) + return NULL; + + if (mas->index > max) +@@ -4814,6 +4843,11 @@ static inline void *mas_prev_nentry(struct ma_state *mas, unsigned long limit, + + slots = ma_slots(mn, mt); + pivots = ma_pivots(mn, mt); ++ if (unlikely(ma_dead_node(mn))) { ++ mas_rewalk(mas, index); ++ goto retry; ++ } ++ + if (offset == mt_pivots[mt]) + pivot = mas->max; + else +@@ -6616,11 +6650,11 @@ static inline void *mas_first_entry(struct ma_state *mas, struct maple_node *mn, + while (likely(!ma_is_leaf(mt))) { + MT_BUG_ON(mas->tree, mte_dead_node(mas->node)); + slots = ma_slots(mn, mt); +- pivots = ma_pivots(mn, mt); +- max = pivots[0]; + entry = mas_slot(mas, slots, 0); ++ pivots = ma_pivots(mn, mt); + if (unlikely(ma_dead_node(mn))) + return NULL; ++ max = pivots[0]; + mas->node = entry; + mn = mas_mn(mas); + mt = mte_node_type(mas->node); +@@ -6640,13 +6674,13 @@ static inline void *mas_first_entry(struct ma_state *mas, struct maple_node *mn, + if (likely(entry)) + return entry; + +- pivots = ma_pivots(mn, mt); +- mas->index = pivots[0] + 1; + mas->offset = 1; + entry = mas_slot(mas, slots, 1); ++ pivots = ma_pivots(mn, mt); + if (unlikely(ma_dead_node(mn))) + return NULL; + ++ mas->index = pivots[0] + 1; + if (mas->index > limit) + goto none; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-167-maple_tree-refine-ma_state-init-from-mas_start.patch b/patches.kernel.org/6.2.11-167-maple_tree-refine-ma_state-init-from-mas_start.patch new file mode 100644 index 0000000..1d19eee --- /dev/null +++ b/patches.kernel.org/6.2.11-167-maple_tree-refine-ma_state-init-from-mas_start.patch @@ -0,0 +1,68 @@ +From: "Liam R. Howlett" +Date: Tue, 11 Apr 2023 11:10:49 -0400 +Subject: [PATCH] maple_tree: refine ma_state init from mas_start() +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 46b345848261009477552d654cb2f65000c30e4d + +commit 46b345848261009477552d654cb2f65000c30e4d upstream. + +If mas->node is an MAS_START, there are three cases, and they all assign +different values to mas->node and mas->offset. So there is no need to set +them to a default value before updating. + +Update them directly to make them easier to understand and for better +readability. + +Link: https://lkml.kernel.org/r/20221221060058.609003-7-vernon2gm@gmail.com +Cc: +Fixes: 54a611b60590 ("Maple Tree: add new data structure") +Signed-off-by: Vernon Yang +Signed-off-by: Liam R. Howlett +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + lib/maple_tree.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/lib/maple_tree.c b/lib/maple_tree.c +index d486c703..693d5c6a 100644 +--- a/lib/maple_tree.c ++++ b/lib/maple_tree.c +@@ -1339,7 +1339,7 @@ static void mas_node_count(struct ma_state *mas, int count) + * mas_start() - Sets up maple state for operations. + * @mas: The maple state. + * +- * If mas->node == MAS_START, then set the min, max, depth, and offset to ++ * If mas->node == MAS_START, then set the min, max and depth to + * defaults. + * + * Return: +@@ -1353,22 +1353,22 @@ static inline struct maple_enode *mas_start(struct ma_state *mas) + if (likely(mas_is_start(mas))) { + struct maple_enode *root; + +- mas->node = MAS_NONE; + mas->min = 0; + mas->max = ULONG_MAX; + mas->depth = 0; +- mas->offset = 0; + + root = mas_root(mas); + /* Tree with nodes */ + if (likely(xa_is_node(root))) { + mas->depth = 1; + mas->node = mte_safe_root(root); ++ mas->offset = 0; + return NULL; + } + + /* empty tree */ + if (unlikely(!root)) { ++ mas->node = MAS_NONE; + mas->offset = MAPLE_NODE_SLOTS; + return NULL; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-168-maple_tree-detect-dead-nodes-in-mas_start.patch b/patches.kernel.org/6.2.11-168-maple_tree-detect-dead-nodes-in-mas_start.patch new file mode 100644 index 0000000..4751ce8 --- /dev/null +++ b/patches.kernel.org/6.2.11-168-maple_tree-detect-dead-nodes-in-mas_start.patch @@ -0,0 +1,47 @@ +From: "Liam R. Howlett" +Date: Tue, 11 Apr 2023 11:10:50 -0400 +Subject: [PATCH] maple_tree: detect dead nodes in mas_start() +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: a7b92d59c885018cb7bb88539892278e4fd64b29 + +commit a7b92d59c885018cb7bb88539892278e4fd64b29 upstream. + +When initially starting a search, the root node may already be in the +process of being replaced in RCU mode. Detect and restart the walk if +this is the case. This is necessary for RCU mode of the maple tree. + +Link: https://lkml.kernel.org/r/20230227173632.3292573-3-surenb@google.com +Cc: +Fixes: 54a611b60590 ("Maple Tree: add new data structure") +Signed-off-by: Liam Howlett +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + lib/maple_tree.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/lib/maple_tree.c b/lib/maple_tree.c +index 693d5c6a..dfe82620 100644 +--- a/lib/maple_tree.c ++++ b/lib/maple_tree.c +@@ -1357,12 +1357,16 @@ static inline struct maple_enode *mas_start(struct ma_state *mas) + mas->max = ULONG_MAX; + mas->depth = 0; + ++retry: + root = mas_root(mas); + /* Tree with nodes */ + if (likely(xa_is_node(root))) { + mas->depth = 1; + mas->node = mte_safe_root(root); + mas->offset = 0; ++ if (mte_dead_node(mas->node)) ++ goto retry; ++ + return NULL; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-169-maple_tree-fix-freeing-of-nodes-in-rcu-mode.patch b/patches.kernel.org/6.2.11-169-maple_tree-fix-freeing-of-nodes-in-rcu-mode.patch new file mode 100644 index 0000000..d0b1e00 --- /dev/null +++ b/patches.kernel.org/6.2.11-169-maple_tree-fix-freeing-of-nodes-in-rcu-mode.patch @@ -0,0 +1,185 @@ +From: "Liam R. Howlett" +Date: Tue, 11 Apr 2023 11:10:51 -0400 +Subject: [PATCH] maple_tree: fix freeing of nodes in rcu mode +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 2e5b4921f8efc9e845f4f04741797d16f36847eb + +commit 2e5b4921f8efc9e845f4f04741797d16f36847eb upstream. + +The walk to destroy the nodes was not always setting the node type and +would result in a destroy method potentially using the values as nodes. +Avoid this by setting the correct node types. This is necessary for the +RCU mode of the maple tree. + +Link: https://lkml.kernel.org/r/20230227173632.3292573-4-surenb@google.com +Cc: +Fixes: 54a611b60590 ("Maple Tree: add new data structure") +Signed-off-by: Liam Howlett +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + lib/maple_tree.c | 73 ++++++++++++++++++++++++++++++++++++++++-------- + 1 file changed, 62 insertions(+), 11 deletions(-) + +diff --git a/lib/maple_tree.c b/lib/maple_tree.c +index dfe82620..f7513c54 100644 +--- a/lib/maple_tree.c ++++ b/lib/maple_tree.c +@@ -897,6 +897,44 @@ static inline void ma_set_meta(struct maple_node *mn, enum maple_type mt, + meta->end = end; + } + ++/* ++ * mas_clear_meta() - clear the metadata information of a node, if it exists ++ * @mas: The maple state ++ * @mn: The maple node ++ * @mt: The maple node type ++ * @offset: The offset of the highest sub-gap in this node. ++ * @end: The end of the data in this node. ++ */ ++static inline void mas_clear_meta(struct ma_state *mas, struct maple_node *mn, ++ enum maple_type mt) ++{ ++ struct maple_metadata *meta; ++ unsigned long *pivots; ++ void __rcu **slots; ++ void *next; ++ ++ switch (mt) { ++ case maple_range_64: ++ pivots = mn->mr64.pivot; ++ if (unlikely(pivots[MAPLE_RANGE64_SLOTS - 2])) { ++ slots = mn->mr64.slot; ++ next = mas_slot_locked(mas, slots, ++ MAPLE_RANGE64_SLOTS - 1); ++ if (unlikely((mte_to_node(next) && mte_node_type(next)))) ++ return; /* The last slot is a node, no metadata */ ++ } ++ fallthrough; ++ case maple_arange_64: ++ meta = ma_meta(mn, mt); ++ break; ++ default: ++ return; ++ } ++ ++ meta->gap = 0; ++ meta->end = 0; ++} ++ + /* + * ma_meta_end() - Get the data end of a node from the metadata + * @mn: The maple node +@@ -5438,20 +5476,22 @@ static inline int mas_rev_alloc(struct ma_state *mas, unsigned long min, + * mas_dead_leaves() - Mark all leaves of a node as dead. + * @mas: The maple state + * @slots: Pointer to the slot array ++ * @type: The maple node type + * + * Must hold the write lock. + * + * Return: The number of leaves marked as dead. + */ + static inline +-unsigned char mas_dead_leaves(struct ma_state *mas, void __rcu **slots) ++unsigned char mas_dead_leaves(struct ma_state *mas, void __rcu **slots, ++ enum maple_type mt) + { + struct maple_node *node; + enum maple_type type; + void *entry; + int offset; + +- for (offset = 0; offset < mt_slot_count(mas->node); offset++) { ++ for (offset = 0; offset < mt_slots[mt]; offset++) { + entry = mas_slot_locked(mas, slots, offset); + type = mte_node_type(entry); + node = mte_to_node(entry); +@@ -5470,14 +5510,13 @@ unsigned char mas_dead_leaves(struct ma_state *mas, void __rcu **slots) + + static void __rcu **mas_dead_walk(struct ma_state *mas, unsigned char offset) + { +- struct maple_node *node, *next; ++ struct maple_node *next; + void __rcu **slots = NULL; + + next = mas_mn(mas); + do { +- mas->node = ma_enode_ptr(next); +- node = mas_mn(mas); +- slots = ma_slots(node, node->type); ++ mas->node = mt_mk_node(next, next->type); ++ slots = ma_slots(next, next->type); + next = mas_slot_locked(mas, slots, offset); + offset = 0; + } while (!ma_is_leaf(next->type)); +@@ -5541,11 +5580,14 @@ static inline void __rcu **mas_destroy_descend(struct ma_state *mas, + node = mas_mn(mas); + slots = ma_slots(node, mte_node_type(mas->node)); + next = mas_slot_locked(mas, slots, 0); +- if ((mte_dead_node(next))) ++ if ((mte_dead_node(next))) { ++ mte_to_node(next)->type = mte_node_type(next); + next = mas_slot_locked(mas, slots, 1); ++ } + + mte_set_node_dead(mas->node); + node->type = mte_node_type(mas->node); ++ mas_clear_meta(mas, node, node->type); + node->piv_parent = prev; + node->parent_slot = offset; + offset = 0; +@@ -5565,13 +5607,18 @@ static void mt_destroy_walk(struct maple_enode *enode, unsigned char ma_flags, + + MA_STATE(mas, &mt, 0, 0); + +- if (mte_is_leaf(enode)) ++ mas.node = enode; ++ if (mte_is_leaf(enode)) { ++ node->type = mte_node_type(enode); + goto free_leaf; ++ } + ++ ma_flags &= ~MT_FLAGS_LOCK_MASK; + mt_init_flags(&mt, ma_flags); + mas_lock(&mas); + +- mas.node = start = enode; ++ mte_to_node(enode)->ma_flags = ma_flags; ++ start = enode; + slots = mas_destroy_descend(&mas, start, 0); + node = mas_mn(&mas); + do { +@@ -5579,7 +5626,8 @@ static void mt_destroy_walk(struct maple_enode *enode, unsigned char ma_flags, + unsigned char offset; + struct maple_enode *parent, *tmp; + +- node->slot_len = mas_dead_leaves(&mas, slots); ++ node->type = mte_node_type(mas.node); ++ node->slot_len = mas_dead_leaves(&mas, slots, node->type); + if (free) + mt_free_bulk(node->slot_len, slots); + offset = node->parent_slot + 1; +@@ -5603,7 +5651,8 @@ static void mt_destroy_walk(struct maple_enode *enode, unsigned char ma_flags, + } while (start != mas.node); + + node = mas_mn(&mas); +- node->slot_len = mas_dead_leaves(&mas, slots); ++ node->type = mte_node_type(mas.node); ++ node->slot_len = mas_dead_leaves(&mas, slots, node->type); + if (free) + mt_free_bulk(node->slot_len, slots); + +@@ -5613,6 +5662,8 @@ static void mt_destroy_walk(struct maple_enode *enode, unsigned char ma_flags, + free_leaf: + if (free) + mt_free_rcu(&node->rcu); ++ else ++ mas_clear_meta(&mas, node, node->type); + } + + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-170-maple_tree-remove-extra-smp_wmb-from-mas_dead_.patch b/patches.kernel.org/6.2.11-170-maple_tree-remove-extra-smp_wmb-from-mas_dead_.patch new file mode 100644 index 0000000..b593c44 --- /dev/null +++ b/patches.kernel.org/6.2.11-170-maple_tree-remove-extra-smp_wmb-from-mas_dead_.patch @@ -0,0 +1,38 @@ +From: "Liam R. Howlett" +Date: Tue, 11 Apr 2023 11:10:52 -0400 +Subject: [PATCH] maple_tree: remove extra smp_wmb() from mas_dead_leaves() +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 8372f4d83f96f35915106093cde4565836587123 + +commit 8372f4d83f96f35915106093cde4565836587123 upstream. + +The call to mte_set_dead_node() before the smp_wmb() already calls +smp_wmb() so this is not needed. This is an optimization for the RCU mode +of the maple tree. + +Link: https://lkml.kernel.org/r/20230227173632.3292573-5-surenb@google.com +Fixes: 54a611b60590 ("Maple Tree: add new data structure") +Cc: stable@vger.kernel.org +Signed-off-by: Liam Howlett +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + lib/maple_tree.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/lib/maple_tree.c b/lib/maple_tree.c +index f7513c54..aeb218f2 100644 +--- a/lib/maple_tree.c ++++ b/lib/maple_tree.c +@@ -5500,7 +5500,6 @@ unsigned char mas_dead_leaves(struct ma_state *mas, void __rcu **slots, + break; + + mte_set_node_dead(entry); +- smp_wmb(); /* Needed for RCU */ + node->type = type; + rcu_assign_pointer(slots[offset], node); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-171-maple_tree-add-smp_rmb-to-dead-node-detection.patch b/patches.kernel.org/6.2.11-171-maple_tree-add-smp_rmb-to-dead-node-detection.patch new file mode 100644 index 0000000..215e6b8 --- /dev/null +++ b/patches.kernel.org/6.2.11-171-maple_tree-add-smp_rmb-to-dead-node-detection.patch @@ -0,0 +1,55 @@ +From: "Liam R. Howlett" +Date: Tue, 11 Apr 2023 11:10:53 -0400 +Subject: [PATCH] maple_tree: add smp_rmb() to dead node detection +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 0a2b18d948838e16912b3b627b504ab062b7d02a + +commit 0a2b18d948838e16912b3b627b504ab062b7d02a upstream. + +Add an smp_rmb() before reading the parent pointer to ensure that anything +read from the node prior to the parent pointer hasn't been reordered ahead +of this check. + +The is necessary for RCU mode. + +Link: https://lkml.kernel.org/r/20230227173632.3292573-7-surenb@google.com +Fixes: 54a611b60590 ("Maple Tree: add new data structure") +Cc: stable@vger.kernel.org +Signed-off-by: Liam R. Howlett +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + lib/maple_tree.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/lib/maple_tree.c b/lib/maple_tree.c +index aeb218f2..1ec872809 100644 +--- a/lib/maple_tree.c ++++ b/lib/maple_tree.c +@@ -534,9 +534,11 @@ static inline struct maple_node *mte_parent(const struct maple_enode *enode) + */ + static inline bool ma_dead_node(const struct maple_node *node) + { +- struct maple_node *parent = (void *)((unsigned long) +- node->parent & ~MAPLE_NODE_MASK); ++ struct maple_node *parent; + ++ /* Do not reorder reads from the node prior to the parent check */ ++ smp_rmb(); ++ parent = (void *)((unsigned long) node->parent & ~MAPLE_NODE_MASK); + return (parent == node); + } + +@@ -551,6 +553,8 @@ static inline bool mte_dead_node(const struct maple_enode *enode) + struct maple_node *parent, *node; + + node = mte_to_node(enode); ++ /* Do not reorder reads from the node prior to the parent check */ ++ smp_rmb(); + parent = mte_parent(enode); + return (parent == node); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-172-maple_tree-add-RCU-lock-checking-to-rcu-callba.patch b/patches.kernel.org/6.2.11-172-maple_tree-add-RCU-lock-checking-to-rcu-callba.patch new file mode 100644 index 0000000..86ad84b --- /dev/null +++ b/patches.kernel.org/6.2.11-172-maple_tree-add-RCU-lock-checking-to-rcu-callba.patch @@ -0,0 +1,383 @@ +From: "Liam R. Howlett" +Date: Tue, 11 Apr 2023 11:10:54 -0400 +Subject: [PATCH] maple_tree: add RCU lock checking to rcu callback functions +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 790e1fa86b340c2bd4a327e01c161f7a1ad885f6 + +commit 790e1fa86b340c2bd4a327e01c161f7a1ad885f6 upstream. + +Dereferencing RCU objects within the RCU callback without the RCU check +has caused lockdep to complain. Fix the RCU dereferencing by using the +RCU callback lock to ensure the operation is safe. + +Also stop creating a new lock to use for dereferencing during destruction +of the tree or subtree. Instead, pass through a pointer to the tree that +has the lock that is held for RCU dereferencing checking. It also does +not make sense to use the maple state in the freeing scenario as the tree +walk is a special case where the tree no longer has the normal encodings +and parent pointers. + +Link: https://lkml.kernel.org/r/20230227173632.3292573-8-surenb@google.com +Fixes: 54a611b60590 ("Maple Tree: add new data structure") +Cc: stable@vger.kernel.org +Reported-by: Suren Baghdasaryan +Signed-off-by: Liam R. Howlett +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + lib/maple_tree.c | 188 ++++++++++++++++++++++++----------------------- + 1 file changed, 96 insertions(+), 92 deletions(-) + +diff --git a/lib/maple_tree.c b/lib/maple_tree.c +index 1ec872809..fb452873 100644 +--- a/lib/maple_tree.c ++++ b/lib/maple_tree.c +@@ -819,6 +819,11 @@ static inline void *mt_slot(const struct maple_tree *mt, + return rcu_dereference_check(slots[offset], mt_locked(mt)); + } + ++static inline void *mt_slot_locked(struct maple_tree *mt, void __rcu **slots, ++ unsigned char offset) ++{ ++ return rcu_dereference_protected(slots[offset], mt_locked(mt)); ++} + /* + * mas_slot_locked() - Get the slot value when holding the maple tree lock. + * @mas: The maple state +@@ -830,7 +835,7 @@ static inline void *mt_slot(const struct maple_tree *mt, + static inline void *mas_slot_locked(struct ma_state *mas, void __rcu **slots, + unsigned char offset) + { +- return rcu_dereference_protected(slots[offset], mt_locked(mas->tree)); ++ return mt_slot_locked(mas->tree, slots, offset); + } + + /* +@@ -902,34 +907,35 @@ static inline void ma_set_meta(struct maple_node *mn, enum maple_type mt, + } + + /* +- * mas_clear_meta() - clear the metadata information of a node, if it exists +- * @mas: The maple state ++ * mt_clear_meta() - clear the metadata information of a node, if it exists ++ * @mt: The maple tree + * @mn: The maple node +- * @mt: The maple node type ++ * @type: The maple node type + * @offset: The offset of the highest sub-gap in this node. + * @end: The end of the data in this node. + */ +-static inline void mas_clear_meta(struct ma_state *mas, struct maple_node *mn, +- enum maple_type mt) ++static inline void mt_clear_meta(struct maple_tree *mt, struct maple_node *mn, ++ enum maple_type type) + { + struct maple_metadata *meta; + unsigned long *pivots; + void __rcu **slots; + void *next; + +- switch (mt) { ++ switch (type) { + case maple_range_64: + pivots = mn->mr64.pivot; + if (unlikely(pivots[MAPLE_RANGE64_SLOTS - 2])) { + slots = mn->mr64.slot; +- next = mas_slot_locked(mas, slots, +- MAPLE_RANGE64_SLOTS - 1); +- if (unlikely((mte_to_node(next) && mte_node_type(next)))) +- return; /* The last slot is a node, no metadata */ ++ next = mt_slot_locked(mt, slots, ++ MAPLE_RANGE64_SLOTS - 1); ++ if (unlikely((mte_to_node(next) && ++ mte_node_type(next)))) ++ return; /* no metadata, could be node */ + } + fallthrough; + case maple_arange_64: +- meta = ma_meta(mn, mt); ++ meta = ma_meta(mn, type); + break; + default: + return; +@@ -5477,7 +5483,7 @@ static inline int mas_rev_alloc(struct ma_state *mas, unsigned long min, + } + + /* +- * mas_dead_leaves() - Mark all leaves of a node as dead. ++ * mte_dead_leaves() - Mark all leaves of a node as dead. + * @mas: The maple state + * @slots: Pointer to the slot array + * @type: The maple node type +@@ -5487,16 +5493,16 @@ static inline int mas_rev_alloc(struct ma_state *mas, unsigned long min, + * Return: The number of leaves marked as dead. + */ + static inline +-unsigned char mas_dead_leaves(struct ma_state *mas, void __rcu **slots, +- enum maple_type mt) ++unsigned char mte_dead_leaves(struct maple_enode *enode, struct maple_tree *mt, ++ void __rcu **slots) + { + struct maple_node *node; + enum maple_type type; + void *entry; + int offset; + +- for (offset = 0; offset < mt_slots[mt]; offset++) { +- entry = mas_slot_locked(mas, slots, offset); ++ for (offset = 0; offset < mt_slot_count(enode); offset++) { ++ entry = mt_slot(mt, slots, offset); + type = mte_node_type(entry); + node = mte_to_node(entry); + /* Use both node and type to catch LE & BE metadata */ +@@ -5511,162 +5517,160 @@ unsigned char mas_dead_leaves(struct ma_state *mas, void __rcu **slots, + return offset; + } + +-static void __rcu **mas_dead_walk(struct ma_state *mas, unsigned char offset) ++/** ++ * mte_dead_walk() - Walk down a dead tree to just before the leaves ++ * @enode: The maple encoded node ++ * @offset: The starting offset ++ * ++ * Note: This can only be used from the RCU callback context. ++ */ ++static void __rcu **mte_dead_walk(struct maple_enode **enode, unsigned char offset) + { +- struct maple_node *next; ++ struct maple_node *node, *next; + void __rcu **slots = NULL; + +- next = mas_mn(mas); ++ next = mte_to_node(*enode); + do { +- mas->node = mt_mk_node(next, next->type); +- slots = ma_slots(next, next->type); +- next = mas_slot_locked(mas, slots, offset); ++ *enode = ma_enode_ptr(next); ++ node = mte_to_node(*enode); ++ slots = ma_slots(node, node->type); ++ next = rcu_dereference_protected(slots[offset], ++ lock_is_held(&rcu_callback_map)); + offset = 0; + } while (!ma_is_leaf(next->type)); + + return slots; + } + ++/** ++ * mt_free_walk() - Walk & free a tree in the RCU callback context ++ * @head: The RCU head that's within the node. ++ * ++ * Note: This can only be used from the RCU callback context. ++ */ + static void mt_free_walk(struct rcu_head *head) + { + void __rcu **slots; + struct maple_node *node, *start; +- struct maple_tree mt; ++ struct maple_enode *enode; + unsigned char offset; + enum maple_type type; +- MA_STATE(mas, &mt, 0, 0); + + node = container_of(head, struct maple_node, rcu); + + if (ma_is_leaf(node->type)) + goto free_leaf; + +- mt_init_flags(&mt, node->ma_flags); +- mas_lock(&mas); + start = node; +- mas.node = mt_mk_node(node, node->type); +- slots = mas_dead_walk(&mas, 0); +- node = mas_mn(&mas); ++ enode = mt_mk_node(node, node->type); ++ slots = mte_dead_walk(&enode, 0); ++ node = mte_to_node(enode); + do { + mt_free_bulk(node->slot_len, slots); + offset = node->parent_slot + 1; +- mas.node = node->piv_parent; +- if (mas_mn(&mas) == node) +- goto start_slots_free; +- +- type = mte_node_type(mas.node); +- slots = ma_slots(mte_to_node(mas.node), type); +- if ((offset < mt_slots[type]) && (slots[offset])) +- slots = mas_dead_walk(&mas, offset); +- +- node = mas_mn(&mas); ++ enode = node->piv_parent; ++ if (mte_to_node(enode) == node) ++ goto free_leaf; ++ ++ type = mte_node_type(enode); ++ slots = ma_slots(mte_to_node(enode), type); ++ if ((offset < mt_slots[type]) && ++ rcu_dereference_protected(slots[offset], ++ lock_is_held(&rcu_callback_map))) ++ slots = mte_dead_walk(&enode, offset); ++ node = mte_to_node(enode); + } while ((node != start) || (node->slot_len < offset)); + + slots = ma_slots(node, node->type); + mt_free_bulk(node->slot_len, slots); + +-start_slots_free: +- mas_unlock(&mas); + free_leaf: + mt_free_rcu(&node->rcu); + } + +-static inline void __rcu **mas_destroy_descend(struct ma_state *mas, +- struct maple_enode *prev, unsigned char offset) ++static inline void __rcu **mte_destroy_descend(struct maple_enode **enode, ++ struct maple_tree *mt, struct maple_enode *prev, unsigned char offset) + { + struct maple_node *node; +- struct maple_enode *next = mas->node; ++ struct maple_enode *next = *enode; + void __rcu **slots = NULL; ++ enum maple_type type; ++ unsigned char next_offset = 0; + + do { +- mas->node = next; +- node = mas_mn(mas); +- slots = ma_slots(node, mte_node_type(mas->node)); +- next = mas_slot_locked(mas, slots, 0); +- if ((mte_dead_node(next))) { +- mte_to_node(next)->type = mte_node_type(next); +- next = mas_slot_locked(mas, slots, 1); +- } ++ *enode = next; ++ node = mte_to_node(*enode); ++ type = mte_node_type(*enode); ++ slots = ma_slots(node, type); ++ next = mt_slot_locked(mt, slots, next_offset); ++ if ((mte_dead_node(next))) ++ next = mt_slot_locked(mt, slots, ++next_offset); + +- mte_set_node_dead(mas->node); +- node->type = mte_node_type(mas->node); +- mas_clear_meta(mas, node, node->type); ++ mte_set_node_dead(*enode); ++ node->type = type; + node->piv_parent = prev; + node->parent_slot = offset; +- offset = 0; +- prev = mas->node; ++ offset = next_offset; ++ next_offset = 0; ++ prev = *enode; + } while (!mte_is_leaf(next)); + + return slots; + } + +-static void mt_destroy_walk(struct maple_enode *enode, unsigned char ma_flags, ++static void mt_destroy_walk(struct maple_enode *enode, struct maple_tree *mt, + bool free) + { + void __rcu **slots; + struct maple_node *node = mte_to_node(enode); + struct maple_enode *start; +- struct maple_tree mt; +- +- MA_STATE(mas, &mt, 0, 0); + +- mas.node = enode; + if (mte_is_leaf(enode)) { + node->type = mte_node_type(enode); + goto free_leaf; + } + +- ma_flags &= ~MT_FLAGS_LOCK_MASK; +- mt_init_flags(&mt, ma_flags); +- mas_lock(&mas); +- +- mte_to_node(enode)->ma_flags = ma_flags; + start = enode; +- slots = mas_destroy_descend(&mas, start, 0); +- node = mas_mn(&mas); ++ slots = mte_destroy_descend(&enode, mt, start, 0); ++ node = mte_to_node(enode); // Updated in the above call. + do { + enum maple_type type; + unsigned char offset; + struct maple_enode *parent, *tmp; + +- node->type = mte_node_type(mas.node); +- node->slot_len = mas_dead_leaves(&mas, slots, node->type); ++ node->slot_len = mte_dead_leaves(enode, mt, slots); + if (free) + mt_free_bulk(node->slot_len, slots); + offset = node->parent_slot + 1; +- mas.node = node->piv_parent; +- if (mas_mn(&mas) == node) +- goto start_slots_free; ++ enode = node->piv_parent; ++ if (mte_to_node(enode) == node) ++ goto free_leaf; + +- type = mte_node_type(mas.node); +- slots = ma_slots(mte_to_node(mas.node), type); ++ type = mte_node_type(enode); ++ slots = ma_slots(mte_to_node(enode), type); + if (offset >= mt_slots[type]) + goto next; + +- tmp = mas_slot_locked(&mas, slots, offset); ++ tmp = mt_slot_locked(mt, slots, offset); + if (mte_node_type(tmp) && mte_to_node(tmp)) { +- parent = mas.node; +- mas.node = tmp; +- slots = mas_destroy_descend(&mas, parent, offset); ++ parent = enode; ++ enode = tmp; ++ slots = mte_destroy_descend(&enode, mt, parent, offset); + } + next: +- node = mas_mn(&mas); +- } while (start != mas.node); ++ node = mte_to_node(enode); ++ } while (start != enode); + +- node = mas_mn(&mas); +- node->type = mte_node_type(mas.node); +- node->slot_len = mas_dead_leaves(&mas, slots, node->type); ++ node = mte_to_node(enode); ++ node->slot_len = mte_dead_leaves(enode, mt, slots); + if (free) + mt_free_bulk(node->slot_len, slots); + +-start_slots_free: +- mas_unlock(&mas); +- + free_leaf: + if (free) + mt_free_rcu(&node->rcu); + else +- mas_clear_meta(&mas, node, node->type); ++ mt_clear_meta(mt, node, node->type); + } + + /* +@@ -5682,10 +5686,10 @@ static inline void mte_destroy_walk(struct maple_enode *enode, + struct maple_node *node = mte_to_node(enode); + + if (mt_in_rcu(mt)) { +- mt_destroy_walk(enode, mt->ma_flags, false); ++ mt_destroy_walk(enode, mt, false); + call_rcu(&node->rcu, mt_free_walk); + } else { +- mt_destroy_walk(enode, mt->ma_flags, true); ++ mt_destroy_walk(enode, mt, true); + } + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-173-mm-enable-maple-tree-RCU-mode-by-default.patch b/patches.kernel.org/6.2.11-173-mm-enable-maple-tree-RCU-mode-by-default.patch new file mode 100644 index 0000000..5236daa --- /dev/null +++ b/patches.kernel.org/6.2.11-173-mm-enable-maple-tree-RCU-mode-by-default.patch @@ -0,0 +1,99 @@ +From: "Liam R. Howlett" +Date: Tue, 11 Apr 2023 11:10:55 -0400 +Subject: [PATCH] mm: enable maple tree RCU mode by default. +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: 3dd4432549415f3c65dd52d5c687629efbf4ece1 + +commit 3dd4432549415f3c65dd52d5c687629efbf4ece1 upstream. + +Use the maple tree in RCU mode for VMA tracking. + +The maple tree tracks the stack and is able to update the pivot +(lower/upper boundary) in-place to allow the page fault handler to write +to the tree while holding just the mmap read lock. This is safe as the +writes to the stack have a guard VMA which ensures there will always be +a NULL in the direction of the growth and thus will only update a pivot. + +It is possible, but not recommended, to have VMAs that grow up/down +without guard VMAs. syzbot has constructed a testcase which sets up a +VMA to grow and consume the empty space. Overwriting the entire NULL +entry causes the tree to be altered in a way that is not safe for +concurrent readers; the readers may see a node being rewritten or one +that does not match the maple state they are using. + +Enabling RCU mode allows the concurrent readers to see a stable node and +will return the expected result. + +Link: https://lkml.kernel.org/r/20230227173632.3292573-9-surenb@google.com +Cc: stable@vger.kernel.org +Fixes: d4af56c5c7c6 ("mm: start tracking VMAs with maple tree") +Signed-off-by: Liam R. Howlett +Reported-by: syzbot+8d95422d3537159ca390@syzkaller.appspotmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + include/linux/mm_types.h | 3 ++- + kernel/fork.c | 3 +++ + mm/mmap.c | 3 ++- + 3 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h +index 9757067c..0e41359d 100644 +--- a/include/linux/mm_types.h ++++ b/include/linux/mm_types.h +@@ -810,7 +810,8 @@ struct mm_struct { + unsigned long cpu_bitmap[]; + }; + +-#define MM_MT_FLAGS (MT_FLAGS_ALLOC_RANGE | MT_FLAGS_LOCK_EXTERN) ++#define MM_MT_FLAGS (MT_FLAGS_ALLOC_RANGE | MT_FLAGS_LOCK_EXTERN | \ ++ MT_FLAGS_USE_RCU) + extern struct mm_struct init_mm; + + /* Pointer magic because the dynamic array size confuses some compilers. */ +diff --git a/kernel/fork.c b/kernel/fork.c +index 8dd0127d..e8808ffb 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -617,6 +617,7 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, + if (retval) + goto out; + ++ mt_clear_in_rcu(mas.tree); + mas_for_each(&old_mas, mpnt, ULONG_MAX) { + struct file *file; + +@@ -703,6 +704,8 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, + retval = arch_dup_mmap(oldmm, mm); + loop_out: + mas_destroy(&mas); ++ if (!retval) ++ mt_set_in_rcu(mas.tree); + out: + mmap_write_unlock(mm); + flush_tlb_mm(oldmm); +diff --git a/mm/mmap.c b/mm/mmap.c +index 425a9349..1931da07 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -2308,7 +2308,7 @@ do_mas_align_munmap(struct ma_state *mas, struct vm_area_struct *vma, + int count = 0; + int error = -ENOMEM; + MA_STATE(mas_detach, &mt_detach, 0, 0); +- mt_init_flags(&mt_detach, MT_FLAGS_LOCK_EXTERN); ++ mt_init_flags(&mt_detach, mas->tree->ma_flags & MT_FLAGS_LOCK_MASK); + mt_set_external_lock(&mt_detach, &mm->mmap_lock); + + if (mas_preallocate(mas, vma, GFP_KERNEL)) +@@ -3095,6 +3095,7 @@ void exit_mmap(struct mm_struct *mm) + */ + set_bit(MMF_OOM_SKIP, &mm->flags); + mmap_write_lock(mm); ++ mt_clear_in_rcu(&mm->mm_mt); + free_pgtables(&tlb, &mm->mm_mt, vma, FIRST_USER_ADDRESS, + USER_PGTABLES_CEILING); + tlb_finish_mmu(&tlb); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.11-174-Linux-6.2.11.patch b/patches.kernel.org/6.2.11-174-Linux-6.2.11.patch new file mode 100644 index 0000000..1f063f3 --- /dev/null +++ b/patches.kernel.org/6.2.11-174-Linux-6.2.11.patch @@ -0,0 +1,41 @@ +From: Greg Kroah-Hartman +Date: Thu, 13 Apr 2023 17:02:59 +0200 +Subject: [PATCH] Linux 6.2.11 +References: bsc#1012628 +Patch-mainline: 6.2.11 +Git-commit: cdc7aff9ed012801e62eedd99e4a5573eccac4db + +Link: https://lore.kernel.org/r/20230412082838.125271466@linuxfoundation.org +Tested-by: Conor Dooley +Tested-by: Ronald Warsow +Tested-by: Markus Reichelt +Tested-by: Justin M. Forbes +Tested-by: Florian Fainelli +Tested-by: Shuah Khan +Tested-by: Guenter Roeck +Tested-by: Ron Economos +Tested-by: Slade Watkins +Tested-by: Bagas Sanjaya +Tested-by: Linux Kernel Functional Testing +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Makefile b/Makefile +index 6ec0ec45..416490da 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 6 + PATCHLEVEL = 2 +-SUBLEVEL = 10 ++SUBLEVEL = 11 + EXTRAVERSION = + NAME = Hurr durr I'ma ninja sloth + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-001-Revert-pinctrl-amd-Disable-and-mask-interrupts.patch b/patches.kernel.org/6.2.12-001-Revert-pinctrl-amd-Disable-and-mask-interrupts.patch new file mode 100644 index 0000000..dbdc3fa --- /dev/null +++ b/patches.kernel.org/6.2.12-001-Revert-pinctrl-amd-Disable-and-mask-interrupts.patch @@ -0,0 +1,97 @@ +From: =?UTF-8?q?Kornel=20Dul=C4=99ba?= +Date: Tue, 11 Apr 2023 13:49:32 +0000 +Subject: [PATCH] Revert "pinctrl: amd: Disable and mask interrupts on resume" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 534e465845ebfb4a97eb5459d3931a0b35e3b9a5 + +commit 534e465845ebfb4a97eb5459d3931a0b35e3b9a5 upstream. + +This reverts commit b26cd9325be4c1fcd331b77f10acb627c560d4d7. + +This patch introduces a regression on Lenovo Z13, which can't wake +from the lid with it applied; and some unspecified AMD based Dell +platforms are unable to wake from hitting the power button + +Signed-off-by: Kornel Dulęba +Reviewed-by: Mario Limonciello +Link: https://lore.kernel.org/r/20230411134932.292287-1-korneld@chromium.org +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/pinctrl/pinctrl-amd.c | 36 ++++++++++++++++------------------- + 1 file changed, 16 insertions(+), 20 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c +index 5e7b82a2..32c3edaf 100644 +--- a/drivers/pinctrl/pinctrl-amd.c ++++ b/drivers/pinctrl/pinctrl-amd.c +@@ -865,34 +865,32 @@ static const struct pinconf_ops amd_pinconf_ops = { + .pin_config_group_set = amd_pinconf_group_set, + }; + +-static void amd_gpio_irq_init_pin(struct amd_gpio *gpio_dev, int pin) ++static void amd_gpio_irq_init(struct amd_gpio *gpio_dev) + { +- const struct pin_desc *pd; ++ struct pinctrl_desc *desc = gpio_dev->pctrl->desc; + unsigned long flags; + u32 pin_reg, mask; ++ int i; + + mask = BIT(WAKE_CNTRL_OFF_S0I3) | BIT(WAKE_CNTRL_OFF_S3) | + BIT(INTERRUPT_MASK_OFF) | BIT(INTERRUPT_ENABLE_OFF) | + BIT(WAKE_CNTRL_OFF_S4); + +- pd = pin_desc_get(gpio_dev->pctrl, pin); +- if (!pd) +- return; ++ for (i = 0; i < desc->npins; i++) { ++ int pin = desc->pins[i].number; ++ const struct pin_desc *pd = pin_desc_get(gpio_dev->pctrl, pin); + +- raw_spin_lock_irqsave(&gpio_dev->lock, flags); +- pin_reg = readl(gpio_dev->base + pin * 4); +- pin_reg &= ~mask; +- writel(pin_reg, gpio_dev->base + pin * 4); +- raw_spin_unlock_irqrestore(&gpio_dev->lock, flags); +-} ++ if (!pd) ++ continue; + +-static void amd_gpio_irq_init(struct amd_gpio *gpio_dev) +-{ +- struct pinctrl_desc *desc = gpio_dev->pctrl->desc; +- int i; ++ raw_spin_lock_irqsave(&gpio_dev->lock, flags); + +- for (i = 0; i < desc->npins; i++) +- amd_gpio_irq_init_pin(gpio_dev, i); ++ pin_reg = readl(gpio_dev->base + i * 4); ++ pin_reg &= ~mask; ++ writel(pin_reg, gpio_dev->base + i * 4); ++ ++ raw_spin_unlock_irqrestore(&gpio_dev->lock, flags); ++ } + } + + #ifdef CONFIG_PM_SLEEP +@@ -945,10 +943,8 @@ static int amd_gpio_resume(struct device *dev) + for (i = 0; i < desc->npins; i++) { + int pin = desc->pins[i].number; + +- if (!amd_gpio_should_save(gpio_dev, pin)) { +- amd_gpio_irq_init_pin(gpio_dev, pin); ++ if (!amd_gpio_should_save(gpio_dev, pin)) + continue; +- } + + raw_spin_lock_irqsave(&gpio_dev->lock, flags); + gpio_dev->saved_regs[i] |= readl(gpio_dev->base + pin * 4) & PIN_IRQ_PENDING; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-002-drm-amd-display-Pass-the-right-info-to-drm_dp_.patch b/patches.kernel.org/6.2.12-002-drm-amd-display-Pass-the-right-info-to-drm_dp_.patch new file mode 100644 index 0000000..8419b63 --- /dev/null +++ b/patches.kernel.org/6.2.12-002-drm-amd-display-Pass-the-right-info-to-drm_dp_.patch @@ -0,0 +1,120 @@ +From: Wayne Lin +Date: Fri, 17 Feb 2023 13:26:56 +0800 +Subject: [PATCH] drm/amd/display: Pass the right info to drm_dp_remove_payload +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: b8ca445f550a9a079134f836466ddda3bfad6108 + +commit b8ca445f550a9a079134f836466ddda3bfad6108 upstream. + +[Why & How] +drm_dp_remove_payload() interface was changed. Correct amdgpu dm code +to pass the right parameter to the drm helper function. + +Reviewed-by: Jerry Zuo +Acked-by: Qingqing Zhuo +Signed-off-by: Wayne Lin +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry-picked from b8ca445f550a9a079134f836466ddda3bfad6108) +[Hand modified due to missing f0127cb11299df80df45583b216e13f27c408545 which + failed to apply due to missing 94dfeaa46925bb6b4d43645bbb6234e846dec257] +Reported-and-tested-by: Veronika Schwan +Fixes: d7b5638bd337 ("drm/amd/display: Take FEC Overhead into Timeslot Calculation") +Signed-off-by: Mario Limonciello +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + .../amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 57 ++++++++++++++++--- + 1 file changed, 50 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c +index 657e7c7b..43be27c8 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c +@@ -175,6 +175,40 @@ void dm_helpers_dp_update_branch_info( + const struct dc_link *link) + {} + ++static void dm_helpers_construct_old_payload( ++ struct dc_link *link, ++ int pbn_per_slot, ++ struct drm_dp_mst_atomic_payload *new_payload, ++ struct drm_dp_mst_atomic_payload *old_payload) ++{ ++ struct link_mst_stream_allocation_table current_link_table = ++ link->mst_stream_alloc_table; ++ struct link_mst_stream_allocation *dc_alloc; ++ int i; ++ ++ *old_payload = *new_payload; ++ ++ /* Set correct time_slots/PBN of old payload. ++ * other fields (delete & dsc_enabled) in ++ * struct drm_dp_mst_atomic_payload are don't care fields ++ * while calling drm_dp_remove_payload() ++ */ ++ for (i = 0; i < current_link_table.stream_count; i++) { ++ dc_alloc = ++ ¤t_link_table.stream_allocations[i]; ++ ++ if (dc_alloc->vcp_id == new_payload->vcpi) { ++ old_payload->time_slots = dc_alloc->slot_count; ++ old_payload->pbn = dc_alloc->slot_count * pbn_per_slot; ++ break; ++ } ++ } ++ ++ /* make sure there is an old payload*/ ++ ASSERT(i != current_link_table.stream_count); ++ ++} ++ + /* + * Writes payload allocation table in immediate downstream device. + */ +@@ -186,7 +220,7 @@ bool dm_helpers_dp_mst_write_payload_allocation_table( + { + struct amdgpu_dm_connector *aconnector; + struct drm_dp_mst_topology_state *mst_state; +- struct drm_dp_mst_atomic_payload *payload; ++ struct drm_dp_mst_atomic_payload *target_payload, *new_payload, old_payload; + struct drm_dp_mst_topology_mgr *mst_mgr; + + aconnector = (struct amdgpu_dm_connector *)stream->dm_stream_context; +@@ -202,17 +236,26 @@ bool dm_helpers_dp_mst_write_payload_allocation_table( + mst_state = to_drm_dp_mst_topology_state(mst_mgr->base.state); + + /* It's OK for this to fail */ +- payload = drm_atomic_get_mst_payload_state(mst_state, aconnector->port); +- if (enable) +- drm_dp_add_payload_part1(mst_mgr, mst_state, payload); +- else +- drm_dp_remove_payload(mst_mgr, mst_state, payload, payload); ++ new_payload = drm_atomic_get_mst_payload_state(mst_state, aconnector->port); ++ ++ if (enable) { ++ target_payload = new_payload; ++ ++ drm_dp_add_payload_part1(mst_mgr, mst_state, new_payload); ++ } else { ++ /* construct old payload by VCPI*/ ++ dm_helpers_construct_old_payload(stream->link, mst_state->pbn_div, ++ new_payload, &old_payload); ++ target_payload = &old_payload; ++ ++ drm_dp_remove_payload(mst_mgr, mst_state, &old_payload, new_payload); ++ } + + /* mst_mgr->->payloads are VC payload notify MST branch using DPCD or + * AUX message. The sequence is slot 1-63 allocated sequence for each + * stream. AMD ASIC stream slot allocation should follow the same + * sequence. copy DRM MST allocation to dc */ +- fill_dc_mst_payload_table_from_drm(stream->link, enable, payload, proposed_table); ++ fill_dc_mst_payload_table_from_drm(stream->link, enable, target_payload, proposed_table); + + return true; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-003-drm-i915-Workaround-ICL-CSC_MODE-sticky-arming.patch b/patches.kernel.org/6.2.12-003-drm-i915-Workaround-ICL-CSC_MODE-sticky-arming.patch new file mode 100644 index 0000000..1365fb0 --- /dev/null +++ b/patches.kernel.org/6.2.12-003-drm-i915-Workaround-ICL-CSC_MODE-sticky-arming.patch @@ -0,0 +1,123 @@ +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Mon, 20 Mar 2023 11:54:36 +0200 +Subject: [PATCH] drm/i915: Workaround ICL CSC_MODE sticky arming +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 4d4e766f8b7dbdefa7a78e91eb9c7a29d0d818b8 + +commit 4d4e766f8b7dbdefa7a78e91eb9c7a29d0d818b8 upstream. + +Unlike SKL/GLK the ICL CSC unit suffers from a new issue where +CSC_MODE arming is sticky. That is, once armed it remains armed +causing the CSC coeff/offset registers to become effectively +self-arming. + +CSC coeff/offset registers writes no longer disarm the CSC, +but fortunately register read still do. So we can use that +to disarm the CSC unit once the registers for the current +frame have been latched. This avoid s the self-arming behaviour +from persisting into the next frame's .color_commit_noarm() +call. + +Cc: #v5.19+ +Cc: Manasi Navare +Cc: Drew Davenport +Cc: Imre Deak +Cc: Jouni Högander +Fixes: d13dde449580 ("drm/i915: Split pipe+output CSC programming to noarm+arm pair") +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20230320095438.17328-5-ville.syrjala@linux.intel.com +Reviewed-by: Imre Deak +(cherry picked from commit 92736f1b452bbb8a66bdb5b1d263ad00e04dd3b8) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/display/intel_color.c | 43 +++++++++++++++++++++- + 1 file changed, 42 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_color.c b/drivers/gpu/drm/i915/display/intel_color.c +index 85a38d79..c9c9af79 100644 +--- a/drivers/gpu/drm/i915/display/intel_color.c ++++ b/drivers/gpu/drm/i915/display/intel_color.c +@@ -516,6 +516,14 @@ static void ilk_lut_12p4_pack(struct drm_color_lut *entry, u32 ldw, u32 udw) + + static void icl_color_commit_noarm(const struct intel_crtc_state *crtc_state) + { ++ /* ++ * Despite Wa_1406463849, ICL no longer suffers from the SKL ++ * DC5/PSR CSC black screen issue (see skl_color_commit_noarm()). ++ * Possibly due to the extra sticky CSC arming ++ * (see icl_color_post_update()). ++ * ++ * On TGL+ all CSC arming issues have been properly fixed. ++ */ + icl_load_csc_matrix(crtc_state); + } + +@@ -617,6 +625,28 @@ static void icl_color_commit_arm(const struct intel_crtc_state *crtc_state) + crtc_state->csc_mode); + } + ++static void icl_color_post_update(const struct intel_crtc_state *crtc_state) ++{ ++ struct intel_crtc *crtc = to_intel_crtc(crtc_state->uapi.crtc); ++ struct drm_i915_private *i915 = to_i915(crtc->base.dev); ++ ++ /* ++ * Despite Wa_1406463849, ICL CSC is no longer disarmed by ++ * coeff/offset register *writes*. Instead, once CSC_MODE ++ * is armed it stays armed, even after it has been latched. ++ * Afterwards the coeff/offset registers become effectively ++ * self-arming. That self-arming must be disabled before the ++ * next icl_color_commit_noarm() tries to write the next set ++ * of coeff/offset registers. Fortunately register *reads* ++ * do still disarm the CSC. Naturally this must not be done ++ * until the previously written CSC registers have actually ++ * been latched. ++ * ++ * TGL+ no longer need this workaround. ++ */ ++ intel_de_read_fw(i915, PIPE_CSC_PREOFF_HI(crtc->pipe)); ++} ++ + static struct drm_property_blob * + create_linear_lut(struct drm_i915_private *i915, int lut_size) + { +@@ -2345,10 +2375,19 @@ static const struct intel_color_funcs i9xx_color_funcs = { + .read_luts = i9xx_read_luts, + }; + ++static const struct intel_color_funcs tgl_color_funcs = { ++ .color_check = icl_color_check, ++ .color_commit_noarm = icl_color_commit_noarm, ++ .color_commit_arm = icl_color_commit_arm, ++ .load_luts = icl_load_luts, ++ .read_luts = icl_read_luts, ++}; ++ + static const struct intel_color_funcs icl_color_funcs = { + .color_check = icl_color_check, + .color_commit_noarm = icl_color_commit_noarm, + .color_commit_arm = icl_color_commit_arm, ++ .color_post_update = icl_color_post_update, + .load_luts = icl_load_luts, + .read_luts = icl_read_luts, + }; +@@ -2440,7 +2479,9 @@ void intel_color_init_hooks(struct drm_i915_private *i915) + else + i915->display.funcs.color = &i9xx_color_funcs; + } else { +- if (DISPLAY_VER(i915) >= 11) ++ if (DISPLAY_VER(i915) >= 12) ++ i915->display.funcs.color = &tgl_color_funcs; ++ else if (DISPLAY_VER(i915) == 11) + i915->display.funcs.color = &icl_color_funcs; + else if (DISPLAY_VER(i915) == 10) + i915->display.funcs.color = &glk_color_funcs; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-004-ALSA-emu10k1-fix-capture-interrupt-handler-unl.patch b/patches.kernel.org/6.2.12-004-ALSA-emu10k1-fix-capture-interrupt-handler-unl.patch new file mode 100644 index 0000000..5618c6d --- /dev/null +++ b/patches.kernel.org/6.2.12-004-ALSA-emu10k1-fix-capture-interrupt-handler-unl.patch @@ -0,0 +1,55 @@ +From: Oswald Buddenhagen +Date: Wed, 5 Apr 2023 22:12:20 +0200 +Subject: [PATCH] ALSA: emu10k1: fix capture interrupt handler unlinking +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: b09c551c77c7e01dc6e4f3c8bf06b5ffa7b06db5 + +commit b09c551c77c7e01dc6e4f3c8bf06b5ffa7b06db5 upstream. + +Due to two copy/pastos, closing the MIC or EFX capture device would +make a running ADC capture hang due to unsetting its interrupt handler. +In principle, this would have also allowed dereferencing dangling +pointers, but we're actually rather thorough at disabling and flushing +the ints. + +While it may sound like one, this actually wasn't a hypothetical bug: +PortAudio will open a capture stream at startup (and close it right +away) even if not asked to. If the first device is busy, it will just +proceed with the next one ... thus killing a concurrent capture. + +Signed-off-by: Oswald Buddenhagen +Cc: +Link: https://lore.kernel.org/r/20230405201220.2197923-1-oswald.buddenhagen@gmx.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + sound/pci/emu10k1/emupcm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c +index 48af77ae..908f76f1 100644 +--- a/sound/pci/emu10k1/emupcm.c ++++ b/sound/pci/emu10k1/emupcm.c +@@ -1236,7 +1236,7 @@ static int snd_emu10k1_capture_mic_close(struct snd_pcm_substream *substream) + { + struct snd_emu10k1 *emu = snd_pcm_substream_chip(substream); + +- emu->capture_interrupt = NULL; ++ emu->capture_mic_interrupt = NULL; + emu->pcm_capture_mic_substream = NULL; + return 0; + } +@@ -1344,7 +1344,7 @@ static int snd_emu10k1_capture_efx_close(struct snd_pcm_substream *substream) + { + struct snd_emu10k1 *emu = snd_pcm_substream_chip(substream); + +- emu->capture_interrupt = NULL; ++ emu->capture_efx_interrupt = NULL; + emu->pcm_capture_efx_substream = NULL; + return 0; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-005-ALSA-hda-sigmatel-add-pin-overrides-for-Intel-.patch b/patches.kernel.org/6.2.12-005-ALSA-hda-sigmatel-add-pin-overrides-for-Intel-.patch new file mode 100644 index 0000000..1d0a2e6 --- /dev/null +++ b/patches.kernel.org/6.2.12-005-ALSA-hda-sigmatel-add-pin-overrides-for-Intel-.patch @@ -0,0 +1,53 @@ +From: Oswald Buddenhagen +Date: Wed, 5 Apr 2023 22:12:19 +0200 +Subject: [PATCH] ALSA: hda/sigmatel: add pin overrides for Intel DP45SG + motherboard +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: c17f8fd31700392b1bb9e7b66924333568cb3700 + +commit c17f8fd31700392b1bb9e7b66924333568cb3700 upstream. + +Like the other boards from the D*45* series, this one sets up the +outputs not quite correctly. + +Signed-off-by: Oswald Buddenhagen +Cc: +Link: https://lore.kernel.org/r/20230405201220.2197826-1-oswald.buddenhagen@gmx.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + Documentation/sound/hd-audio/models.rst | 2 +- + sound/pci/hda/patch_sigmatel.c | 2 ++ + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/Documentation/sound/hd-audio/models.rst b/Documentation/sound/hd-audio/models.rst +index 9b52f50a..12043045 100644 +--- a/Documentation/sound/hd-audio/models.rst ++++ b/Documentation/sound/hd-audio/models.rst +@@ -704,7 +704,7 @@ ref + no-jd + BIOS setup but without jack-detection + intel +- Intel DG45* mobos ++ Intel D*45* mobos + dell-m6-amic + Dell desktops/laptops with analog mics + dell-m6-dmic +diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c +index a794a01a..64a97d8c 100644 +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -1955,6 +1955,8 @@ static const struct snd_pci_quirk stac92hd73xx_fixup_tbl[] = { + "DFI LanParty", STAC_92HD73XX_REF), + SND_PCI_QUIRK(PCI_VENDOR_ID_DFI, 0x3101, + "DFI LanParty", STAC_92HD73XX_REF), ++ SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x5001, ++ "Intel DP45SG", STAC_92HD73XX_INTEL), + SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x5002, + "Intel DG45ID", STAC_92HD73XX_INTEL), + SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x5003, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-006-ALSA-i2c-cs8427-fix-iec958-mixer-control-deact.patch b/patches.kernel.org/6.2.12-006-ALSA-i2c-cs8427-fix-iec958-mixer-control-deact.patch new file mode 100644 index 0000000..40f2a49 --- /dev/null +++ b/patches.kernel.org/6.2.12-006-ALSA-i2c-cs8427-fix-iec958-mixer-control-deact.patch @@ -0,0 +1,46 @@ +From: Oswald Buddenhagen +Date: Wed, 5 Apr 2023 22:12:19 +0200 +Subject: [PATCH] ALSA: i2c/cs8427: fix iec958 mixer control deactivation +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: e98e7a82bca2b6dce3e03719cff800ec913f9af7 + +commit e98e7a82bca2b6dce3e03719cff800ec913f9af7 upstream. + +snd_cs8427_iec958_active() would always delete +SNDRV_CTL_ELEM_ACCESS_INACTIVE, even though the function has an +argument `active`. + +Signed-off-by: Oswald Buddenhagen +Cc: +Link: https://lore.kernel.org/r/20230405201219.2197811-1-oswald.buddenhagen@gmx.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + sound/i2c/cs8427.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/sound/i2c/cs8427.c b/sound/i2c/cs8427.c +index 65012af6..f58b14b4 100644 +--- a/sound/i2c/cs8427.c ++++ b/sound/i2c/cs8427.c +@@ -561,10 +561,13 @@ int snd_cs8427_iec958_active(struct snd_i2c_device *cs8427, int active) + if (snd_BUG_ON(!cs8427)) + return -ENXIO; + chip = cs8427->private_data; +- if (active) ++ if (active) { + memcpy(chip->playback.pcm_status, + chip->playback.def_status, 24); +- chip->playback.pcm_ctl->vd[0].access &= ~SNDRV_CTL_ELEM_ACCESS_INACTIVE; ++ chip->playback.pcm_ctl->vd[0].access &= ~SNDRV_CTL_ELEM_ACCESS_INACTIVE; ++ } else { ++ chip->playback.pcm_ctl->vd[0].access |= SNDRV_CTL_ELEM_ACCESS_INACTIVE; ++ } + snd_ctl_notify(cs8427->bus->card, + SNDRV_CTL_EVENT_MASK_VALUE | SNDRV_CTL_EVENT_MASK_INFO, + &chip->playback.pcm_ctl->id); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-007-ALSA-hda-patch_realtek-add-quirk-for-Asus-N760.patch b/patches.kernel.org/6.2.12-007-ALSA-hda-patch_realtek-add-quirk-for-Asus-N760.patch new file mode 100644 index 0000000..08debff --- /dev/null +++ b/patches.kernel.org/6.2.12-007-ALSA-hda-patch_realtek-add-quirk-for-Asus-N760.patch @@ -0,0 +1,84 @@ +From: Pierre-Louis Bossart +Date: Thu, 6 Apr 2023 10:27:25 -0500 +Subject: [PATCH] ALSA: hda: patch_realtek: add quirk for Asus N7601ZM +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: e959f2beec8e655dba79c5a7111beedae5e757e0 + +commit e959f2beec8e655dba79c5a7111beedae5e757e0 upstream. + +Add pins and verbs needed to enable speakers and jack. + +The pins and verbs configurations were identified by snooping the +Windows driver commands, with a nice write-up here: +https://brakkee.org/site/2023/02/07/fixing-sound-on-the-asus-n7601zm/ + +Reported-by: Erik Brakkee +Link: https://github.com/thesofproject/linux/issues/4176 +Tested-by: Erik Brakkee +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Kai Vehmanen +Reviewed-by: Bard Liao +Cc: +Link: https://lore.kernel.org/r/20230406152725.15191-1-pierre-louis.bossart@linux.intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + sound/pci/hda/patch_realtek.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 50b8573b..1beab036 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6960,6 +6960,8 @@ enum { + ALC269_FIXUP_DELL_M101Z, + ALC269_FIXUP_SKU_IGNORE, + ALC269_FIXUP_ASUS_G73JW, ++ ALC269_FIXUP_ASUS_N7601ZM_PINS, ++ ALC269_FIXUP_ASUS_N7601ZM, + ALC269_FIXUP_LENOVO_EAPD, + ALC275_FIXUP_SONY_HWEQ, + ALC275_FIXUP_SONY_DISABLE_AAMIX, +@@ -7256,6 +7258,29 @@ static const struct hda_fixup alc269_fixups[] = { + { } + } + }, ++ [ALC269_FIXUP_ASUS_N7601ZM_PINS] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x03A11050 }, ++ { 0x1a, 0x03A11C30 }, ++ { 0x21, 0x03211420 }, ++ { } ++ } ++ }, ++ [ALC269_FIXUP_ASUS_N7601ZM] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ {0x20, AC_VERB_SET_COEF_INDEX, 0x62}, ++ {0x20, AC_VERB_SET_PROC_COEF, 0xa007}, ++ {0x20, AC_VERB_SET_COEF_INDEX, 0x10}, ++ {0x20, AC_VERB_SET_PROC_COEF, 0x8420}, ++ {0x20, AC_VERB_SET_COEF_INDEX, 0x0f}, ++ {0x20, AC_VERB_SET_PROC_COEF, 0x7774}, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_ASUS_N7601ZM_PINS, ++ }, + [ALC269_FIXUP_LENOVO_EAPD] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb[]) { +@@ -9465,6 +9490,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1271, "ASUS X430UN", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x1290, "ASUS X441SA", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x12a0, "ASUS X441UV", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1043, 0x12a3, "Asus N7691ZM", ALC269_FIXUP_ASUS_N7601ZM), + SND_PCI_QUIRK(0x1043, 0x12af, "ASUS UX582ZS", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x12e0, "ASUS X541SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x12f0, "ASUS X541UV", ALC256_FIXUP_ASUS_MIC), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-008-ALSA-hda-realtek-Add-quirks-for-Lenovo-Z13-Z16.patch b/patches.kernel.org/6.2.12-008-ALSA-hda-realtek-Add-quirks-for-Lenovo-Z13-Z16.patch new file mode 100644 index 0000000..31148bf --- /dev/null +++ b/patches.kernel.org/6.2.12-008-ALSA-hda-realtek-Add-quirks-for-Lenovo-Z13-Z16.patch @@ -0,0 +1,39 @@ +From: Stefan Binding +Date: Wed, 12 Apr 2023 17:05:31 +0100 +Subject: [PATCH] ALSA: hda/realtek: Add quirks for Lenovo Z13/Z16 Gen2 +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 8eda19cd59cedbfe4ec11aea4bcecabe4c98e9e4 + +commit 8eda19cd59cedbfe4ec11aea4bcecabe4c98e9e4 upstream. + +These Lenovo laptops use Realtek HDA codec combined with +2xCS35L41 Amplifiers using I2C with External Boost. + +Signed-off-by: Stefan Binding +Cc: +Link: https://lore.kernel.org/r/20230412160531.182007-1-sbinding@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + sound/pci/hda/patch_realtek.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 1beab036..6a6c72b5 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9688,6 +9688,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x22f1, "Thinkpad", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x17aa, 0x22f2, "Thinkpad", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x17aa, 0x22f3, "Thinkpad", ALC287_FIXUP_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x17aa, 0x2318, "Thinkpad Z13 Gen2", ALC287_FIXUP_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x17aa, 0x2319, "Thinkpad Z16 Gen2", ALC287_FIXUP_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x17aa, 0x231a, "Thinkpad Z16 Gen2", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-009-ALSA-firewire-tascam-add-missing-unwind-goto-i.patch b/patches.kernel.org/6.2.12-009-ALSA-firewire-tascam-add-missing-unwind-goto-i.patch new file mode 100644 index 0000000..bbe7473 --- /dev/null +++ b/patches.kernel.org/6.2.12-009-ALSA-firewire-tascam-add-missing-unwind-goto-i.patch @@ -0,0 +1,65 @@ +From: Xu Biang +Date: Thu, 6 Apr 2023 06:28:01 -0700 +Subject: [PATCH] ALSA: firewire-tascam: add missing unwind goto in + snd_tscm_stream_start_duplex() +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: fb4a624f88f658c7b7ae124452bd42eaa8ac7168 + +commit fb4a624f88f658c7b7ae124452bd42eaa8ac7168 upstream. + +Smatch Warns: +sound/firewire/tascam/tascam-stream.c:493 snd_tscm_stream_start_duplex() +warn: missing unwind goto? + +The direct return will cause the stream list of "&tscm->domain" unemptied +and the session in "tscm" unfinished if amdtp_domain_start() returns with +an error. + +Fix this by changing the direct return to a goto which will empty the +stream list of "&tscm->domain" and finish the session in "tscm". + +The snd_tscm_stream_start_duplex() function is called in the prepare +callback of PCM. According to "ALSA Kernel API Documentation", the prepare +callback of PCM will be called many times at each setup. So, if the +"&d->streams" list is not emptied, when the prepare callback is called +next time, snd_tscm_stream_start_duplex() will receive -EBUSY from +amdtp_domain_add_stream() that tries to add an existing stream to the +domain. The error handling code after the "error" label will be executed +in this case, and the "&d->streams" list will be emptied. So not emptying +the "&d->streams" list will not cause an issue. But it is more efficient +and readable to empty it on the first error by changing the direct return +to a goto statement. + +The session in "tscm" has been begun before amdtp_domain_start(), so it +needs to be finished when amdtp_domain_start() fails. + +Fixes: c281d46a51e3 ("ALSA: firewire-tascam: support AMDTP domain") +Signed-off-by: Xu Biang +Reviewed-by: Dan Carpenter +Acked-by: Takashi Sakamoto +Cc: +Link: https://lore.kernel.org/r/20230406132801.105108-1-xubiang@hust.edu.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + sound/firewire/tascam/tascam-stream.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/firewire/tascam/tascam-stream.c b/sound/firewire/tascam/tascam-stream.c +index 53e094cc..dfe783d0 100644 +--- a/sound/firewire/tascam/tascam-stream.c ++++ b/sound/firewire/tascam/tascam-stream.c +@@ -490,7 +490,7 @@ int snd_tscm_stream_start_duplex(struct snd_tscm *tscm, unsigned int rate) + // packet is important for media clock recovery. + err = amdtp_domain_start(&tscm->domain, tx_init_skip_cycles, true, true); + if (err < 0) +- return err; ++ goto error; + + if (!amdtp_domain_wait_ready(&tscm->domain, READY_TIMEOUT_MS)) { + err = -ETIMEDOUT; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-010-ALSA-emu10k1-don-t-create-old-pass-through-pla.patch b/patches.kernel.org/6.2.12-010-ALSA-emu10k1-don-t-create-old-pass-through-pla.patch new file mode 100644 index 0000000..d389b45 --- /dev/null +++ b/patches.kernel.org/6.2.12-010-ALSA-emu10k1-don-t-create-old-pass-through-pla.patch @@ -0,0 +1,58 @@ +From: Oswald Buddenhagen +Date: Wed, 5 Apr 2023 22:12:20 +0200 +Subject: [PATCH] ALSA: emu10k1: don't create old pass-through playback device + on Audigy +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 8dd13214a810c695044aa168c0ddba1a9c433e4f + +commit 8dd13214a810c695044aa168c0ddba1a9c433e4f upstream. + +It could have never worked, as snd_emu10k1_fx8010_playback_prepare() and +snd_emu10k1_fx8010_playback_hw_free() assume the emu10k1 offset for the +ETRAM, and the default DSP code includes no handler for it. It also +wouldn't make a lot of sense to make it work, as Audigy has an own, much +simpler, pass-through mechanism. So just skip creation of the device. + +Signed-off-by: Oswald Buddenhagen +Cc: +Link: https://lore.kernel.org/r/20230405201220.2197938-1-oswald.buddenhagen@gmx.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + sound/pci/emu10k1/emupcm.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c +index 908f76f1..6ec394fb 100644 +--- a/sound/pci/emu10k1/emupcm.c ++++ b/sound/pci/emu10k1/emupcm.c +@@ -1781,17 +1781,21 @@ int snd_emu10k1_pcm_efx(struct snd_emu10k1 *emu, int device) + struct snd_kcontrol *kctl; + int err; + +- err = snd_pcm_new(emu->card, "emu10k1 efx", device, 8, 1, &pcm); ++ err = snd_pcm_new(emu->card, "emu10k1 efx", device, emu->audigy ? 0 : 8, 1, &pcm); + if (err < 0) + return err; + + pcm->private_data = emu; + +- snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK, &snd_emu10k1_fx8010_playback_ops); ++ if (!emu->audigy) ++ snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK, &snd_emu10k1_fx8010_playback_ops); + snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_CAPTURE, &snd_emu10k1_capture_efx_ops); + + pcm->info_flags = 0; +- strcpy(pcm->name, "Multichannel Capture/PT Playback"); ++ if (emu->audigy) ++ strcpy(pcm->name, "Multichannel Capture"); ++ else ++ strcpy(pcm->name, "Multichannel Capture/PT Playback"); + emu->pcm_efx = pcm; + + /* EFX capture - record the "FXBUS2" channels, by default we connect the EXTINs +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-011-ALSA-hda-sigmatel-fix-S-PDIF-out-on-Intel-D-45.patch b/patches.kernel.org/6.2.12-011-ALSA-hda-sigmatel-fix-S-PDIF-out-on-Intel-D-45.patch new file mode 100644 index 0000000..1e1556a --- /dev/null +++ b/patches.kernel.org/6.2.12-011-ALSA-hda-sigmatel-fix-S-PDIF-out-on-Intel-D-45.patch @@ -0,0 +1,74 @@ +From: Oswald Buddenhagen +Date: Wed, 5 Apr 2023 22:12:20 +0200 +Subject: [PATCH] ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* + motherboards +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: f342ac00da1064eb4f94b1f4bcacbdfea955797a + +commit f342ac00da1064eb4f94b1f4bcacbdfea955797a upstream. + +The BIOS botches this one completely - it says the 2nd S/PDIF output is +used, while in fact it's the 1st one. This is tested on DP45SG, but I'm +assuming it's valid for the other boards in the series as well. + +Also add some comments regarding the pins. +FWIW, the codec is apparently still sold by Tempo Semiconductor, Inc., +where one can download the documentation. + +Signed-off-by: Oswald Buddenhagen +Cc: +Link: https://lore.kernel.org/r/20230405201220.2197826-2-oswald.buddenhagen@gmx.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + sound/pci/hda/patch_sigmatel.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c +index 64a97d8c..61258b0a 100644 +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -1707,6 +1707,7 @@ static const struct snd_pci_quirk stac925x_fixup_tbl[] = { + }; + + static const struct hda_pintbl ref92hd73xx_pin_configs[] = { ++ // Port A-H + { 0x0a, 0x02214030 }, + { 0x0b, 0x02a19040 }, + { 0x0c, 0x01a19020 }, +@@ -1715,9 +1716,12 @@ static const struct hda_pintbl ref92hd73xx_pin_configs[] = { + { 0x0f, 0x01014010 }, + { 0x10, 0x01014020 }, + { 0x11, 0x01014030 }, ++ // CD in + { 0x12, 0x02319040 }, ++ // Digial Mic ins + { 0x13, 0x90a000f0 }, + { 0x14, 0x90a000f0 }, ++ // Digital outs + { 0x22, 0x01452050 }, + { 0x23, 0x01452050 }, + {} +@@ -1758,6 +1762,7 @@ static const struct hda_pintbl alienware_m17x_pin_configs[] = { + }; + + static const struct hda_pintbl intel_dg45id_pin_configs[] = { ++ // Analog outputs + { 0x0a, 0x02214230 }, + { 0x0b, 0x02A19240 }, + { 0x0c, 0x01013214 }, +@@ -1765,6 +1770,9 @@ static const struct hda_pintbl intel_dg45id_pin_configs[] = { + { 0x0e, 0x01A19250 }, + { 0x0f, 0x01011212 }, + { 0x10, 0x01016211 }, ++ // Digital output ++ { 0x22, 0x01451380 }, ++ { 0x23, 0x40f000f0 }, + {} + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-012-ALSA-hda-hdmi-disable-KAE-for-Intel-DG2.patch b/patches.kernel.org/6.2.12-012-ALSA-hda-hdmi-disable-KAE-for-Intel-DG2.patch new file mode 100644 index 0000000..e13c1d4 --- /dev/null +++ b/patches.kernel.org/6.2.12-012-ALSA-hda-hdmi-disable-KAE-for-Intel-DG2.patch @@ -0,0 +1,43 @@ +From: Kai Vehmanen +Date: Thu, 13 Apr 2023 22:11:53 +0300 +Subject: [PATCH] ALSA: hda/hdmi: disable KAE for Intel DG2 +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 6ab6f98fcdc9d4fbe245aa67de03542deea65322 + +commit 6ab6f98fcdc9d4fbe245aa67de03542deea65322 upstream. + +Use of keep-alive (KAE) has resulted in loss of audio on some A750/770 +cards as the transition from keep-alive to stream playback is not +working as expected. As there is limited benefit of the new KAE mode +on discrete cards, revert back to older silent-stream implementation +on these systems. + +Cc: stable@vger.kernel.org +Fixes: 15175a4f2bbb ("ALSA: hda/hdmi: add keep-alive support for ADL-P and DG2") +Link: https://gitlab.freedesktop.org/drm/intel/-/issues/8307 +Signed-off-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20230413191153.3692049-1-kai.vehmanen@linux.intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + sound/pci/hda/patch_hdmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index 4ffa3a59..5c698039 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -4604,7 +4604,7 @@ HDA_CODEC_ENTRY(0x80862814, "DG1 HDMI", patch_i915_tgl_hdmi), + HDA_CODEC_ENTRY(0x80862815, "Alderlake HDMI", patch_i915_tgl_hdmi), + HDA_CODEC_ENTRY(0x80862816, "Rocketlake HDMI", patch_i915_tgl_hdmi), + HDA_CODEC_ENTRY(0x80862818, "Raptorlake HDMI", patch_i915_tgl_hdmi), +-HDA_CODEC_ENTRY(0x80862819, "DG2 HDMI", patch_i915_adlp_hdmi), ++HDA_CODEC_ENTRY(0x80862819, "DG2 HDMI", patch_i915_tgl_hdmi), + HDA_CODEC_ENTRY(0x8086281a, "Jasperlake HDMI", patch_i915_icl_hdmi), + HDA_CODEC_ENTRY(0x8086281b, "Elkhartlake HDMI", patch_i915_icl_hdmi), + HDA_CODEC_ENTRY(0x8086281c, "Alderlake-P HDMI", patch_i915_adlp_hdmi), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-013-Bluetooth-L2CAP-Fix-use-after-free-in-l2cap_di.patch b/patches.kernel.org/6.2.12-013-Bluetooth-L2CAP-Fix-use-after-free-in-l2cap_di.patch new file mode 100644 index 0000000..26fe1d3 --- /dev/null +++ b/patches.kernel.org/6.2.12-013-Bluetooth-L2CAP-Fix-use-after-free-in-l2cap_di.patch @@ -0,0 +1,104 @@ +From: Luiz Augusto von Dentz +Date: Thu, 6 Apr 2023 09:33:09 -0700 +Subject: [PATCH] Bluetooth: L2CAP: Fix use-after-free in + l2cap_disconnect_{req,rsp} +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: a2a9339e1c9deb7e1e079e12e27a0265aea8421a + +commit a2a9339e1c9deb7e1e079e12e27a0265aea8421a upstream. + +Similar to commit d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free +caused by l2cap_chan_put"), just use l2cap_chan_hold_unless_zero to +prevent referencing a channel that is about to be destroyed. + +Cc: stable@kernel.org +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Min Li +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + net/bluetooth/l2cap_core.c | 24 ++++++------------------ + 1 file changed, 6 insertions(+), 18 deletions(-) + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 49926f59..55a72262 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -4652,33 +4652,27 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, + + BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid); + +- mutex_lock(&conn->chan_lock); +- +- chan = __l2cap_get_chan_by_scid(conn, dcid); ++ chan = l2cap_get_chan_by_scid(conn, dcid); + if (!chan) { +- mutex_unlock(&conn->chan_lock); + cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid); + return 0; + } + +- l2cap_chan_hold(chan); +- l2cap_chan_lock(chan); +- + rsp.dcid = cpu_to_le16(chan->scid); + rsp.scid = cpu_to_le16(chan->dcid); + l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp); + + chan->ops->set_shutdown(chan); + ++ mutex_lock(&conn->chan_lock); + l2cap_chan_del(chan, ECONNRESET); ++ mutex_unlock(&conn->chan_lock); + + chan->ops->close(chan); + + l2cap_chan_unlock(chan); + l2cap_chan_put(chan); + +- mutex_unlock(&conn->chan_lock); +- + return 0; + } + +@@ -4698,33 +4692,27 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, + + BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid); + +- mutex_lock(&conn->chan_lock); +- +- chan = __l2cap_get_chan_by_scid(conn, scid); ++ chan = l2cap_get_chan_by_scid(conn, scid); + if (!chan) { + mutex_unlock(&conn->chan_lock); + return 0; + } + +- l2cap_chan_hold(chan); +- l2cap_chan_lock(chan); +- + if (chan->state != BT_DISCONN) { + l2cap_chan_unlock(chan); + l2cap_chan_put(chan); +- mutex_unlock(&conn->chan_lock); + return 0; + } + ++ mutex_lock(&conn->chan_lock); + l2cap_chan_del(chan, 0); ++ mutex_unlock(&conn->chan_lock); + + chan->ops->close(chan); + + l2cap_chan_unlock(chan); + l2cap_chan_put(chan); + +- mutex_unlock(&conn->chan_lock); +- + return 0; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-014-Bluetooth-Fix-race-condition-in-hidp_session_t.patch b/patches.kernel.org/6.2.12-014-Bluetooth-Fix-race-condition-in-hidp_session_t.patch new file mode 100644 index 0000000..c48536c --- /dev/null +++ b/patches.kernel.org/6.2.12-014-Bluetooth-Fix-race-condition-in-hidp_session_t.patch @@ -0,0 +1,58 @@ +From: Min Li +Date: Sat, 4 Mar 2023 22:23:30 +0800 +Subject: [PATCH] Bluetooth: Fix race condition in hidp_session_thread +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: c95930abd687fcd1aa040dc4fe90dff947916460 + +commit c95930abd687fcd1aa040dc4fe90dff947916460 upstream. + +There is a potential race condition in hidp_session_thread that may +lead to use-after-free. For instance, the timer is active while +hidp_del_timer is called in hidp_session_thread(). After hidp_session_put, +then 'session' will be freed, causing kernel panic when hidp_idle_timeout +is running. + +The solution is to use del_timer_sync instead of del_timer. + +Here is the call trace: + +? hidp_session_probe+0x780/0x780 +call_timer_fn+0x2d/0x1e0 +__run_timers.part.0+0x569/0x940 +hidp_session_probe+0x780/0x780 +call_timer_fn+0x1e0/0x1e0 +ktime_get+0x5c/0xf0 +lapic_next_deadline+0x2c/0x40 +clockevents_program_event+0x205/0x320 +run_timer_softirq+0xa9/0x1b0 +__do_softirq+0x1b9/0x641 +__irq_exit_rcu+0xdc/0x190 +irq_exit_rcu+0xe/0x20 +sysvec_apic_timer_interrupt+0xa1/0xc0 + +Cc: stable@vger.kernel.org +Signed-off-by: Min Li +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + net/bluetooth/hidp/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c +index cc20e706..82cc15ad 100644 +--- a/net/bluetooth/hidp/core.c ++++ b/net/bluetooth/hidp/core.c +@@ -433,7 +433,7 @@ static void hidp_set_timer(struct hidp_session *session) + static void hidp_del_timer(struct hidp_session *session) + { + if (session->idle_to > 0) +- del_timer(&session->timer); ++ del_timer_sync(&session->timer); + } + + static void hidp_process_report(struct hidp_session *session, int type, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-015-bluetooth-btbcm-Fix-logic-error-in-forming-the.patch b/patches.kernel.org/6.2.12-015-bluetooth-btbcm-Fix-logic-error-in-forming-the.patch new file mode 100644 index 0000000..ae60ab7 --- /dev/null +++ b/patches.kernel.org/6.2.12-015-bluetooth-btbcm-Fix-logic-error-in-forming-the.patch @@ -0,0 +1,38 @@ +From: Sasha Finkelstein +Date: Fri, 10 Mar 2023 11:28:42 +0100 +Subject: [PATCH] bluetooth: btbcm: Fix logic error in forming the board name. +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: b76abe4648c1acc791a207e7c08d1719eb9f4ea8 + +commit b76abe4648c1acc791a207e7c08d1719eb9f4ea8 upstream. + +This patch fixes an incorrect loop exit condition in code that replaces +'/' symbols in the board name. There might also be a memory corruption +issue here, but it is unlikely to be a real problem. + +Cc: +Signed-off-by: Sasha Finkelstein +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/bluetooth/btbcm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c +index 3006e2a0..43e98a59 100644 +--- a/drivers/bluetooth/btbcm.c ++++ b/drivers/bluetooth/btbcm.c +@@ -511,7 +511,7 @@ static const char *btbcm_get_board_name(struct device *dev) + len = strlen(tmp) + 1; + board_type = devm_kzalloc(dev, len, GFP_KERNEL); + strscpy(board_type, tmp, len); +- for (i = 0; i < board_type[i]; i++) { ++ for (i = 0; i < len; i++) { + if (board_type[i] == '/') + board_type[i] = '-'; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-016-Bluetooth-Free-potentially-unfreed-SCO-connect.patch b/patches.kernel.org/6.2.12-016-Bluetooth-Free-potentially-unfreed-SCO-connect.patch new file mode 100644 index 0000000..ab7d67d --- /dev/null +++ b/patches.kernel.org/6.2.12-016-Bluetooth-Free-potentially-unfreed-SCO-connect.patch @@ -0,0 +1,56 @@ +From: Archie Pusaka +Date: Fri, 3 Feb 2023 17:30:55 +0800 +Subject: [PATCH] Bluetooth: Free potentially unfreed SCO connection +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 0f00cd322d22d4441de51aa80bcce5bb6a8cbb44 + +commit 0f00cd322d22d4441de51aa80bcce5bb6a8cbb44 upstream. + +It is possible to initiate a SCO connection while deleting the +corresponding ACL connection, e.g. in below scenario: + +(1) < hci setup sync connect command +(2) > hci disconn complete event (for the acl connection) +(3) > hci command complete event (for(1), failure) + +When it happens, hci_cs_setup_sync_conn won't be able to obtain the +reference to the SCO connection, so it will be stuck and potentially +hinder subsequent connections to the same device. + +This patch prevents that by also deleting the SCO connection if it is +still not established when the corresponding ACL connection is deleted. + +Signed-off-by: Archie Pusaka +Reviewed-by: Ying Hsu +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + net/bluetooth/hci_conn.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 61a34801..838f51c2 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -1061,8 +1061,15 @@ int hci_conn_del(struct hci_conn *conn) + + if (conn->type == ACL_LINK) { + struct hci_conn *sco = conn->link; +- if (sco) ++ if (sco) { + sco->link = NULL; ++ /* Due to race, SCO connection might be not established ++ * yet at this point. Delete it now, otherwise it is ++ * possible for it to be stuck and can't be deleted. ++ */ ++ if (sco->handle == HCI_CONN_HANDLE_UNSET) ++ hci_conn_del(sco); ++ } + + /* Unacked frames */ + hdev->acl_cnt += conn->sent; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-017-Bluetooth-hci_conn-Fix-possible-UAF.patch b/patches.kernel.org/6.2.12-017-Bluetooth-hci_conn-Fix-possible-UAF.patch new file mode 100644 index 0000000..dbf7557 --- /dev/null +++ b/patches.kernel.org/6.2.12-017-Bluetooth-hci_conn-Fix-possible-UAF.patch @@ -0,0 +1,120 @@ +From: Luiz Augusto von Dentz +Date: Mon, 3 Apr 2023 14:19:14 -0700 +Subject: [PATCH] Bluetooth: hci_conn: Fix possible UAF +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 5dc7d23e167e2882ef118456ceccd57873e876d8 + +commit 5dc7d23e167e2882ef118456ceccd57873e876d8 upstream. + +This fixes the following trace: + +================================================================== +BUG: KASAN: slab-use-after-free in hci_conn_del+0xba/0x3a0 +Write of size 8 at addr ffff88800208e9c8 by task iso-tester/31 + +CPU: 0 PID: 31 Comm: iso-tester Not tainted 6.3.0-rc2-g991aa4a69a47 + #4716 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc36 +04/01/2014 +Call Trace: + + dump_stack_lvl+0x1d/0x70 + print_report+0xce/0x610 + ? __virt_addr_valid+0xd4/0x150 + ? hci_conn_del+0xba/0x3a0 + kasan_report+0xdd/0x110 + ? hci_conn_del+0xba/0x3a0 + hci_conn_del+0xba/0x3a0 + hci_conn_hash_flush+0xf2/0x120 + hci_dev_close_sync+0x388/0x920 + hci_unregister_dev+0x122/0x260 + vhci_release+0x4f/0x90 + __fput+0x102/0x430 + task_work_run+0xf1/0x160 + ? __pfx_task_work_run+0x10/0x10 + ? mark_held_locks+0x24/0x90 + exit_to_user_mode_prepare+0x170/0x180 + syscall_exit_to_user_mode+0x19/0x50 + do_syscall_64+0x4e/0x90 + entry_SYSCALL_64_after_hwframe+0x70/0xda + +Fixes: 0f00cd322d22 ("Bluetooth: Free potentially unfreed SCO connection") +Link: https://syzkaller.appspot.com/bug?extid=8bb72f86fc823817bc5d +Cc: +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + net/bluetooth/hci_conn.c | 30 ++++++++++++++++++++++++------ + 1 file changed, 24 insertions(+), 6 deletions(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 838f51c2..17baea2b 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -1049,6 +1049,17 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, + return conn; + } + ++static bool hci_conn_unlink(struct hci_conn *conn) ++{ ++ if (!conn->link) ++ return false; ++ ++ conn->link->link = NULL; ++ conn->link = NULL; ++ ++ return true; ++} ++ + int hci_conn_del(struct hci_conn *conn) + { + struct hci_dev *hdev = conn->hdev; +@@ -1060,15 +1071,16 @@ int hci_conn_del(struct hci_conn *conn) + cancel_delayed_work_sync(&conn->idle_work); + + if (conn->type == ACL_LINK) { +- struct hci_conn *sco = conn->link; +- if (sco) { +- sco->link = NULL; ++ struct hci_conn *link = conn->link; ++ ++ if (link) { ++ hci_conn_unlink(conn); + /* Due to race, SCO connection might be not established + * yet at this point. Delete it now, otherwise it is + * possible for it to be stuck and can't be deleted. + */ +- if (sco->handle == HCI_CONN_HANDLE_UNSET) +- hci_conn_del(sco); ++ if (link->handle == HCI_CONN_HANDLE_UNSET) ++ hci_conn_del(link); + } + + /* Unacked frames */ +@@ -1084,7 +1096,7 @@ int hci_conn_del(struct hci_conn *conn) + struct hci_conn *acl = conn->link; + + if (acl) { +- acl->link = NULL; ++ hci_conn_unlink(conn); + hci_conn_drop(acl); + } + +@@ -2436,6 +2448,12 @@ void hci_conn_hash_flush(struct hci_dev *hdev) + c->state = BT_CLOSED; + + hci_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM); ++ ++ /* Unlink before deleting otherwise it is possible that ++ * hci_conn_del removes the link which may cause the list to ++ * contain items already freed. ++ */ ++ hci_conn_unlink(c); + hci_conn_del(c); + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-018-btrfs-restore-the-thread_pool-behavior-in-remo.patch b/patches.kernel.org/6.2.12-018-btrfs-restore-the-thread_pool-behavior-in-remo.patch new file mode 100644 index 0000000..af67723 --- /dev/null +++ b/patches.kernel.org/6.2.12-018-btrfs-restore-the-thread_pool-behavior-in-remo.patch @@ -0,0 +1,42 @@ +From: Christoph Hellwig +Date: Tue, 28 Mar 2023 12:56:13 +0900 +Subject: [PATCH] btrfs: restore the thread_pool= behavior in remount for the + end I/O workqueues +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 40fac6472f22a59f5694496e179988ab4a1dfe07 + +commit 40fac6472f22a59f5694496e179988ab4a1dfe07 upstream. + +Commit d7b9416fe5c5 ("btrfs: remove btrfs_end_io_wq") converted the read +and I/O handling from btrfs_workqueues to Linux workqueues, and as part +of that lost the code to apply the thread_pool= based max_active limit +on remount. Restore it. + +Fixes: d7b9416fe5c5 ("btrfs: remove btrfs_end_io_wq") +CC: stable@vger.kernel.org # 6.0+ +Signed-off-by: Christoph Hellwig +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/btrfs/super.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c +index 433ce221..8dd8f56b 100644 +--- a/fs/btrfs/super.c ++++ b/fs/btrfs/super.c +@@ -1630,6 +1630,8 @@ static void btrfs_resize_thread_pool(struct btrfs_fs_info *fs_info, + btrfs_workqueue_set_max(fs_info->hipri_workers, new_pool_size); + btrfs_workqueue_set_max(fs_info->delalloc_workers, new_pool_size); + btrfs_workqueue_set_max(fs_info->caching_workers, new_pool_size); ++ workqueue_set_max_active(fs_info->endio_workers, new_pool_size); ++ workqueue_set_max_active(fs_info->endio_meta_workers, new_pool_size); + btrfs_workqueue_set_max(fs_info->endio_write_workers, new_pool_size); + btrfs_workqueue_set_max(fs_info->endio_freespace_worker, new_pool_size); + btrfs_workqueue_set_max(fs_info->delayed_workers, new_pool_size); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-019-btrfs-fix-fast-csum-implementation-detection.patch b/patches.kernel.org/6.2.12-019-btrfs-fix-fast-csum-implementation-detection.patch new file mode 100644 index 0000000..f2a3492 --- /dev/null +++ b/patches.kernel.org/6.2.12-019-btrfs-fix-fast-csum-implementation-detection.patch @@ -0,0 +1,69 @@ +From: Christoph Hellwig +Date: Wed, 29 Mar 2023 09:13:05 +0900 +Subject: [PATCH] btrfs: fix fast csum implementation detection +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 68d99ab0e9221ef54506f827576c5a914680eeaf + +commit 68d99ab0e9221ef54506f827576c5a914680eeaf upstream. + +The BTRFS_FS_CSUM_IMPL_FAST flag is currently set whenever a non-generic +crc32c is detected, which is the incorrect check if the file system uses +a different checksumming algorithm. Refactor the code to only check +this if crc32c is actually used. Note that in an ideal world the +information if an algorithm is hardware accelerated or not should be +provided by the crypto API instead, but that's left for another day. + +CC: stable@vger.kernel.org # 5.4.x: c8a5f8ca9a9c: btrfs: print checksum type and implementation at mount time +CC: stable@vger.kernel.org # 5.4.x +Signed-off-by: Christoph Hellwig +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/btrfs/disk-io.c | 14 ++++++++++++++ + fs/btrfs/super.c | 2 -- + 2 files changed, 14 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index fde40112..174d196d 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -2433,6 +2433,20 @@ static int btrfs_init_csum_hash(struct btrfs_fs_info *fs_info, u16 csum_type) + + fs_info->csum_shash = csum_shash; + ++ /* ++ * Check if the checksum implementation is a fast accelerated one. ++ * As-is this is a bit of a hack and should be replaced once the csum ++ * implementations provide that information themselves. ++ */ ++ switch (csum_type) { ++ case BTRFS_CSUM_TYPE_CRC32: ++ if (!strstr(crypto_shash_driver_name(csum_shash), "generic")) ++ set_bit(BTRFS_FS_CSUM_IMPL_FAST, &fs_info->flags); ++ break; ++ default: ++ break; ++ } ++ + btrfs_info(fs_info, "using %s (%s) checksum algorithm", + btrfs_super_csum_name(csum_type), + crypto_shash_driver_name(csum_shash)); +diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c +index 8dd8f56b..3f3c8f91 100644 +--- a/fs/btrfs/super.c ++++ b/fs/btrfs/super.c +@@ -1515,8 +1515,6 @@ static struct dentry *btrfs_mount_root(struct file_system_type *fs_type, + shrinker_debugfs_rename(&s->s_shrink, "sb-%s:%s", fs_type->name, + s->s_id); + btrfs_sb(s)->bdev_holder = fs_type; +- if (!strstr(crc32c_impl(), "generic")) +- set_bit(BTRFS_FS_CSUM_IMPL_FAST, &fs_info->flags); + error = btrfs_fill_super(s, fs_devices, data); + } + if (!error) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-020-fbmem-Reject-FB_ACTIVATE_KD_TEXT-from-userspac.patch b/patches.kernel.org/6.2.12-020-fbmem-Reject-FB_ACTIVATE_KD_TEXT-from-userspac.patch new file mode 100644 index 0000000..79d9fcf --- /dev/null +++ b/patches.kernel.org/6.2.12-020-fbmem-Reject-FB_ACTIVATE_KD_TEXT-from-userspac.patch @@ -0,0 +1,75 @@ +From: Daniel Vetter +Date: Tue, 4 Apr 2023 21:39:34 +0200 +Subject: [PATCH] fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 6fd33a3333c7916689b8f051a185defe4dd515b0 + +commit 6fd33a3333c7916689b8f051a185defe4dd515b0 upstream. + +This is an oversight from dc5bdb68b5b3 ("drm/fb-helper: Fix vt +restore") - I failed to realize that nasty userspace could set this. + +It's not pretty to mix up kernel-internal and userspace uapi flags +like this, but since the entire fb_var_screeninfo structure is uapi +we'd need to either add a new parameter to the ->fb_set_par callback +and fb_set_par() function, which has a _lot_ of users. Or some other +fairly ugly side-channel int fb_info. Neither is a pretty prospect. + +Instead just correct the issue at hand by filtering out this +kernel-internal flag in the ioctl handling code. + +Reviewed-by: Javier Martinez Canillas +Acked-by: Maarten Lankhorst +Signed-off-by: Daniel Vetter +Fixes: dc5bdb68b5b3 ("drm/fb-helper: Fix vt restore") +Cc: Alex Deucher +Cc: shlomo@fastmail.com +Cc: Michel Dänzer +Cc: Noralf Trønnes +Cc: Thomas Zimmermann +Cc: Daniel Vetter +Cc: Maarten Lankhorst +Cc: Maxime Ripard +Cc: David Airlie +Cc: Daniel Vetter +Cc: dri-devel@lists.freedesktop.org +Cc: # v5.7+ +Cc: Bartlomiej Zolnierkiewicz +Cc: Geert Uytterhoeven +Cc: Nathan Chancellor +Cc: Qiujun Huang +Cc: Peter Rosin +Cc: linux-fbdev@vger.kernel.org +Cc: Helge Deller +Cc: Sam Ravnborg +Cc: Geert Uytterhoeven +Cc: Samuel Thibault +Cc: Tetsuo Handa +Cc: Shigeru Yoshida +Link: https://patchwork.freedesktop.org/patch/msgid/20230404193934.472457-1-daniel.vetter@ffwll.ch +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/video/fbdev/core/fbmem.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c +index ab3545a0..aa2cb36a 100644 +--- a/drivers/video/fbdev/core/fbmem.c ++++ b/drivers/video/fbdev/core/fbmem.c +@@ -1117,6 +1117,8 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd, + case FBIOPUT_VSCREENINFO: + if (copy_from_user(&var, argp, sizeof(var))) + return -EFAULT; ++ /* only for kernel-internal use */ ++ var.activate &= ~FB_ACTIVATE_KD_TEXT; + console_lock(); + lock_fb_info(info); + ret = fbcon_modechange_possible(info, &var); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-021-mtdblock-tolerate-corrected-bit-flips.patch b/patches.kernel.org/6.2.12-021-mtdblock-tolerate-corrected-bit-flips.patch new file mode 100644 index 0000000..1184bd3 --- /dev/null +++ b/patches.kernel.org/6.2.12-021-mtdblock-tolerate-corrected-bit-flips.patch @@ -0,0 +1,64 @@ +From: Bang Li +Date: Wed, 29 Mar 2023 00:30:12 +0800 +Subject: [PATCH] mtdblock: tolerate corrected bit-flips +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 0c3089601f064d80b3838eceb711fcac04bceaad + +commit 0c3089601f064d80b3838eceb711fcac04bceaad upstream. + +mtd_read() may return -EUCLEAN in case of corrected bit-flips.This +particular condition should not be treated like an error. + +Signed-off-by: Bang Li +Fixes: e47f68587b82 ("mtd: check for max_bitflips in mtd_read_oob()") +Cc: # v3.7 +Acked-by: Richard Weinberger +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230328163012.4264-1-libang.linuxer@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/mtd/mtdblock.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/mtd/mtdblock.c b/drivers/mtd/mtdblock.c +index 1e94e7d1..a0a1194d 100644 +--- a/drivers/mtd/mtdblock.c ++++ b/drivers/mtd/mtdblock.c +@@ -153,7 +153,7 @@ static int do_cached_write (struct mtdblk_dev *mtdblk, unsigned long pos, + mtdblk->cache_state = STATE_EMPTY; + ret = mtd_read(mtd, sect_start, sect_size, + &retlen, mtdblk->cache_data); +- if (ret) ++ if (ret && !mtd_is_bitflip(ret)) + return ret; + if (retlen != sect_size) + return -EIO; +@@ -188,8 +188,12 @@ static int do_cached_read (struct mtdblk_dev *mtdblk, unsigned long pos, + pr_debug("mtdblock: read on \"%s\" at 0x%lx, size 0x%x\n", + mtd->name, pos, len); + +- if (!sect_size) +- return mtd_read(mtd, pos, len, &retlen, buf); ++ if (!sect_size) { ++ ret = mtd_read(mtd, pos, len, &retlen, buf); ++ if (ret && !mtd_is_bitflip(ret)) ++ return ret; ++ return 0; ++ } + + while (len > 0) { + unsigned long sect_start = (pos/sect_size)*sect_size; +@@ -209,7 +213,7 @@ static int do_cached_read (struct mtdblk_dev *mtdblk, unsigned long pos, + memcpy (buf, mtdblk->cache_data + offset, size); + } else { + ret = mtd_read(mtd, pos, size, &retlen, buf); +- if (ret) ++ if (ret && !mtd_is_bitflip(ret)) + return ret; + if (retlen != size) + return -EIO; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-022-mtd-rawnand-meson-fix-bitmask-for-length-in-co.patch b/patches.kernel.org/6.2.12-022-mtd-rawnand-meson-fix-bitmask-for-length-in-co.patch new file mode 100644 index 0000000..eaf1cd0 --- /dev/null +++ b/patches.kernel.org/6.2.12-022-mtd-rawnand-meson-fix-bitmask-for-length-in-co.patch @@ -0,0 +1,63 @@ +From: Arseniy Krasnov +Date: Wed, 29 Mar 2023 10:47:26 +0300 +Subject: [PATCH] mtd: rawnand: meson: fix bitmask for length in command word +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 93942b70461574ca7fc3d91494ca89b16a4c64c7 + +commit 93942b70461574ca7fc3d91494ca89b16a4c64c7 upstream. + +Valid mask is 0x3FFF, without this patch the following problems were +found: + +1) [ 0.938914] Could not find a valid ONFI parameter page, trying + bit-wise majority to recover it + [ 0.947384] ONFI parameter recovery failed, aborting + +2) Read with disabled ECC mode was broken. + +Fixes: 8fae856c5350 ("mtd: rawnand: meson: add support for Amlogic NAND flash controller") +Cc: +Signed-off-by: Arseniy Krasnov +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/3794ffbf-dfea-e96f-1f97-fe235b005e19@sberdevices.ru +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/mtd/nand/raw/meson_nand.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c +index a28574c0..074e1422 100644 +--- a/drivers/mtd/nand/raw/meson_nand.c ++++ b/drivers/mtd/nand/raw/meson_nand.c +@@ -280,7 +280,7 @@ static void meson_nfc_cmd_access(struct nand_chip *nand, int raw, bool dir, + + if (raw) { + len = mtd->writesize + mtd->oobsize; +- cmd = (len & GENMASK(5, 0)) | scrambler | DMA_DIR(dir); ++ cmd = (len & GENMASK(13, 0)) | scrambler | DMA_DIR(dir); + writel(cmd, nfc->reg_base + NFC_REG_CMD); + return; + } +@@ -544,7 +544,7 @@ static int meson_nfc_read_buf(struct nand_chip *nand, u8 *buf, int len) + if (ret) + goto out; + +- cmd = NFC_CMD_N2M | (len & GENMASK(5, 0)); ++ cmd = NFC_CMD_N2M | (len & GENMASK(13, 0)); + writel(cmd, nfc->reg_base + NFC_REG_CMD); + + meson_nfc_drain_cmd(nfc); +@@ -568,7 +568,7 @@ static int meson_nfc_write_buf(struct nand_chip *nand, u8 *buf, int len) + if (ret) + return ret; + +- cmd = NFC_CMD_M2N | (len & GENMASK(5, 0)); ++ cmd = NFC_CMD_M2N | (len & GENMASK(13, 0)); + writel(cmd, nfc->reg_base + NFC_REG_CMD); + + meson_nfc_drain_cmd(nfc); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-023-mtd-rawnand-stm32_fmc2-remove-unsupported-EDO-.patch b/patches.kernel.org/6.2.12-023-mtd-rawnand-stm32_fmc2-remove-unsupported-EDO-.patch new file mode 100644 index 0000000..fba8525 --- /dev/null +++ b/patches.kernel.org/6.2.12-023-mtd-rawnand-stm32_fmc2-remove-unsupported-EDO-.patch @@ -0,0 +1,41 @@ +From: Christophe Kerello +Date: Tue, 28 Mar 2023 17:58:18 +0200 +Subject: [PATCH] mtd: rawnand: stm32_fmc2: remove unsupported EDO mode +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: f71e0e329c152c7f11ddfd97ffc62aba152fad3f + +commit f71e0e329c152c7f11ddfd97ffc62aba152fad3f upstream. + +Remove the EDO mode support from as the FMC2 controller does not +support the feature. + +Signed-off-by: Christophe Kerello +Fixes: 2cd457f328c1 ("mtd: rawnand: stm32_fmc2: add STM32 FMC2 NAND flash controller driver") +Cc: stable@vger.kernel.org #v5.4+ +Reviewed-by: Tudor Ambarus +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230328155819.225521-2-christophe.kerello@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/mtd/nand/raw/stm32_fmc2_nand.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/mtd/nand/raw/stm32_fmc2_nand.c b/drivers/mtd/nand/raw/stm32_fmc2_nand.c +index 5d627048..3abb63d0 100644 +--- a/drivers/mtd/nand/raw/stm32_fmc2_nand.c ++++ b/drivers/mtd/nand/raw/stm32_fmc2_nand.c +@@ -1531,6 +1531,9 @@ static int stm32_fmc2_nfc_setup_interface(struct nand_chip *chip, int chipnr, + if (IS_ERR(sdrt)) + return PTR_ERR(sdrt); + ++ if (sdrt->tRC_min < 30000) ++ return -EOPNOTSUPP; ++ + if (chipnr == NAND_DATA_IFACE_CHECK_ONLY) + return 0; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-024-mtd-rawnand-stm32_fmc2-use-timings.mode-instea.patch b/patches.kernel.org/6.2.12-024-mtd-rawnand-stm32_fmc2-use-timings.mode-instea.patch new file mode 100644 index 0000000..2939d21 --- /dev/null +++ b/patches.kernel.org/6.2.12-024-mtd-rawnand-stm32_fmc2-use-timings.mode-instea.patch @@ -0,0 +1,41 @@ +From: Christophe Kerello +Date: Tue, 28 Mar 2023 17:58:19 +0200 +Subject: [PATCH] mtd: rawnand: stm32_fmc2: use timings.mode instead of + checking tRC_min +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: ddbb664b6ab8de7dffa388ae0c88cd18616494e5 + +commit ddbb664b6ab8de7dffa388ae0c88cd18616494e5 upstream. + +Use timings.mode value instead of checking tRC_min timing +for EDO mode support. + +Signed-off-by: Christophe Kerello +Fixes: 2cd457f328c1 ("mtd: rawnand: stm32_fmc2: add STM32 FMC2 NAND flash controller driver") +Cc: stable@vger.kernel.org #v5.10+ +Reviewed-by: Tudor Ambarus +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230328155819.225521-3-christophe.kerello@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/mtd/nand/raw/stm32_fmc2_nand.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/stm32_fmc2_nand.c b/drivers/mtd/nand/raw/stm32_fmc2_nand.c +index 3abb63d0..9e74bcd9 100644 +--- a/drivers/mtd/nand/raw/stm32_fmc2_nand.c ++++ b/drivers/mtd/nand/raw/stm32_fmc2_nand.c +@@ -1531,7 +1531,7 @@ static int stm32_fmc2_nfc_setup_interface(struct nand_chip *chip, int chipnr, + if (IS_ERR(sdrt)) + return PTR_ERR(sdrt); + +- if (sdrt->tRC_min < 30000) ++ if (conf->timings.mode > 3) + return -EOPNOTSUPP; + + if (chipnr == NAND_DATA_IFACE_CHECK_ONLY) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-025-KVM-arm64-PMU-Restore-the-guest-s-EL0-event-co.patch b/patches.kernel.org/6.2.12-025-KVM-arm64-PMU-Restore-the-guest-s-EL0-event-co.patch new file mode 100644 index 0000000..4dcabc8 --- /dev/null +++ b/patches.kernel.org/6.2.12-025-KVM-arm64-PMU-Restore-the-guest-s-EL0-event-co.patch @@ -0,0 +1,66 @@ +From: Reiji Watanabe +Date: Tue, 28 Mar 2023 19:39:44 -0700 +Subject: [PATCH] KVM: arm64: PMU: Restore the guest's EL0 event counting after + migration +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: f9ea835e99bc8d049bf2a3ec8fa5a7cb4fcade23 + +commit f9ea835e99bc8d049bf2a3ec8fa5a7cb4fcade23 upstream. + +Currently, with VHE, KVM enables the EL0 event counting for the +guest on vcpu_load() or KVM enables it as a part of the PMU +register emulation process, when needed. However, in the migration +case (with VHE), the same handling is lacking, as vPMU register +values that were restored by userspace haven't been propagated yet +(the PMU events haven't been created) at the vcpu load-time on the +first KVM_RUN (kvm_vcpu_pmu_restore_guest() called from vcpu_load() +on the first KVM_RUN won't do anything as events_{guest,host} of +kvm_pmu_events are still zero). + +So, with VHE, enable the guest's EL0 event counting on the first +KVM_RUN (after the migration) when needed. More specifically, +have kvm_pmu_handle_pmcr() call kvm_vcpu_pmu_restore_guest() +so that kvm_pmu_handle_pmcr() on the first KVM_RUN can take +care of it. + +Fixes: d0c94c49792c ("KVM: arm64: Restore PMU configuration on first run") +Cc: stable@vger.kernel.org +Reviewed-by: Marc Zyngier +Signed-off-by: Reiji Watanabe +Link: https://lore.kernel.org/r/20230329023944.2488484-1-reijiw@google.com +Signed-off-by: Oliver Upton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm64/kvm/pmu-emul.c | 1 + + arch/arm64/kvm/sys_regs.c | 1 - + 2 files changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/kvm/pmu-emul.c b/arch/arm64/kvm/pmu-emul.c +index c243b10f..5eca0cdd 100644 +--- a/arch/arm64/kvm/pmu-emul.c ++++ b/arch/arm64/kvm/pmu-emul.c +@@ -558,6 +558,7 @@ void kvm_pmu_handle_pmcr(struct kvm_vcpu *vcpu, u64 val) + for_each_set_bit(i, &mask, 32) + kvm_pmu_set_pmc_value(kvm_vcpu_idx_to_pmc(vcpu, i), 0, true); + } ++ kvm_vcpu_pmu_restore_guest(vcpu); + } + + static bool kvm_pmu_counter_is_enabled(struct kvm_pmc *pmc) +diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c +index c48c053d..de966c87 100644 +--- a/arch/arm64/kvm/sys_regs.c ++++ b/arch/arm64/kvm/sys_regs.c +@@ -703,7 +703,6 @@ static bool access_pmcr(struct kvm_vcpu *vcpu, struct sys_reg_params *p, + if (!kvm_supports_32bit_el0()) + val |= ARMV8_PMU_PMCR_LC; + kvm_pmu_handle_pmcr(vcpu, val); +- kvm_vcpu_pmu_restore_guest(vcpu); + } else { + /* PMCR.P & PMCR.C are RAZ */ + val = __vcpu_sys_reg(vcpu, PMCR_EL0) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-026-fbcon-Fix-error-paths-in-set_con2fb_map.patch b/patches.kernel.org/6.2.12-026-fbcon-Fix-error-paths-in-set_con2fb_map.patch new file mode 100644 index 0000000..b95b66a --- /dev/null +++ b/patches.kernel.org/6.2.12-026-fbcon-Fix-error-paths-in-set_con2fb_map.patch @@ -0,0 +1,101 @@ +From: Daniel Vetter +Date: Wed, 12 Apr 2023 17:23:49 +0200 +Subject: [PATCH] fbcon: Fix error paths in set_con2fb_map +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: edf79dd2172233452ff142dcc98b19d955fc8974 + +commit edf79dd2172233452ff142dcc98b19d955fc8974 upstream. + +This is a regressoin introduced in b07db3958485 ("fbcon: Ditch error +handling for con2fb_release_oldinfo"). I failed to realize what the if +(!err) checks. The mentioned commit was dropping the +con2fb_release_oldinfo() return value but the if (!err) was also +checking whether the con2fb_acquire_newinfo() function call above +failed or not. + +Fix this with an early return statement. + +Note that there's still a difference compared to the orginal state of +the code, the below lines are now also skipped on error: + + if (!search_fb_in_map(info_idx)) + info_idx = newidx; + +These are only needed when we've actually thrown out an old fb_info +from the console mappings, which only happens later on. + +Also move the fbcon_add_cursor_work() call into the same if block, +it's all protected by console_lock so doesn't matter when we set up +the blinking cursor delayed work anyway. This further simplifies the +control flow and allows us to ditch the found local variable. + +v2: Clarify commit message (Javier) + +Signed-off-by: Daniel Vetter +Reviewed-by: Javier Martinez Canillas +Acked-by: Helge Deller +Tested-by: Xingyuan Mo +Fixes: b07db3958485 ("fbcon: Ditch error handling for con2fb_release_oldinfo") +Cc: Thomas Zimmermann +Cc: Sam Ravnborg +Cc: Xingyuan Mo +Cc: Thomas Zimmermann +Cc: Helge Deller +Cc: # v5.19+ +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/video/fbdev/core/fbcon.c | 17 ++++++++--------- + 1 file changed, 8 insertions(+), 9 deletions(-) + +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index 2bc8baa9..b9dc29d6 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -823,7 +823,7 @@ static int set_con2fb_map(int unit, int newidx, int user) + int oldidx = con2fb_map[unit]; + struct fb_info *info = fbcon_registered_fb[newidx]; + struct fb_info *oldinfo = NULL; +- int found, err = 0, show_logo; ++ int err = 0, show_logo; + + WARN_CONSOLE_UNLOCKED(); + +@@ -841,26 +841,25 @@ static int set_con2fb_map(int unit, int newidx, int user) + if (oldidx != -1) + oldinfo = fbcon_registered_fb[oldidx]; + +- found = search_fb_in_map(newidx); +- +- if (!err && !found) { ++ if (!search_fb_in_map(newidx)) { + err = con2fb_acquire_newinfo(vc, info, unit); +- if (!err) +- con2fb_map[unit] = newidx; ++ if (err) ++ return err; ++ ++ con2fb_map[unit] = newidx; ++ fbcon_add_cursor_work(info); + } + + /* + * If old fb is not mapped to any of the consoles, + * fbcon should release it. + */ +- if (!err && oldinfo && !search_fb_in_map(oldidx)) ++ if (oldinfo && !search_fb_in_map(oldidx)) + con2fb_release_oldinfo(vc, oldinfo, info); + + show_logo = (fg_console == 0 && !user && + logo_shown != FBCON_LOGO_DONTSHOW); + +- if (!found) +- fbcon_add_cursor_work(info); + con2fb_map_boot[unit] = newidx; + con2fb_init_display(vc, info, unit, show_logo); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-027-fbcon-set_con2fb_map-needs-to-set-con2fb_map.patch b/patches.kernel.org/6.2.12-027-fbcon-set_con2fb_map-needs-to-set-con2fb_map.patch new file mode 100644 index 0000000..d9f78d5 --- /dev/null +++ b/patches.kernel.org/6.2.12-027-fbcon-set_con2fb_map-needs-to-set-con2fb_map.patch @@ -0,0 +1,60 @@ +From: Daniel Vetter +Date: Wed, 12 Apr 2023 17:31:46 +0200 +Subject: [PATCH] fbcon: set_con2fb_map needs to set con2fb_map! +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: fffb0b52d5258554c645c966c6cbef7de50b851d + +commit fffb0b52d5258554c645c966c6cbef7de50b851d upstream. + +I got really badly confused in d443d9386472 ("fbcon: move more common +code into fb_open()") because we set the con2fb_map before the failure +points, which didn't look good. + +But in trying to fix that I moved the assignment into the wrong path - +we need to do it for _all_ vc we take over, not just the first one +(which additionally requires the call to con2fb_acquire_newinfo). + +I've figured this out because of a KASAN bug report, where the +fbcon_registered_fb and fbcon_display arrays went out of sync in +fbcon_mode_deleted() because the con2fb_map pointed at the old +fb_info, but the modes and everything was updated for the new one. + +Signed-off-by: Daniel Vetter +Reviewed-by: Javier Martinez Canillas +Acked-by: Helge Deller +Tested-by: Xingyuan Mo +Fixes: d443d9386472 ("fbcon: move more common code into fb_open()") +Reported-by: Xingyuan Mo +Cc: Thomas Zimmermann +Cc: Sam Ravnborg +Cc: Xingyuan Mo +Cc: Thomas Zimmermann +Cc: Helge Deller +Cc: # v5.19+ +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/video/fbdev/core/fbcon.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index b9dc29d6..fa205be9 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -846,10 +846,11 @@ static int set_con2fb_map(int unit, int newidx, int user) + if (err) + return err; + +- con2fb_map[unit] = newidx; + fbcon_add_cursor_work(info); + } + ++ con2fb_map[unit] = newidx; ++ + /* + * If old fb is not mapped to any of the consoles, + * fbcon should release it. +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-028-drm-i915-dsi-fix-DSS-CTL-register-offsets-for-.patch b/patches.kernel.org/6.2.12-028-drm-i915-dsi-fix-DSS-CTL-register-offsets-for-.patch new file mode 100644 index 0000000..c07ae10 --- /dev/null +++ b/patches.kernel.org/6.2.12-028-drm-i915-dsi-fix-DSS-CTL-register-offsets-for-.patch @@ -0,0 +1,82 @@ +From: Jani Nikula +Date: Wed, 1 Mar 2023 17:14:09 +0200 +Subject: [PATCH] drm/i915/dsi: fix DSS CTL register offsets for TGL+ +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 6b8446859c971a5783a2cdc90adf32e64de3bd23 + +commit 6b8446859c971a5783a2cdc90adf32e64de3bd23 upstream. + +On TGL+ the DSS control registers are at different offsets, and there's +one per pipe. Fix the offsets to fix dual link DSI for TGL+. + +There would be helpers for this in the DSC code, but just do the quick +fix now for DSI. Long term, we should probably move all the DSS handling +into intel_vdsc.c, so exporting the helpers seems counter-productive. + +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8232 +Cc: Ville Syrjala +Cc: stable@vger.kernel.org +Signed-off-by: Jani Nikula +Reviewed-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20230301151409.1581574-1-jani.nikula@intel.com +(cherry picked from commit 1a62dd9895dca78bee28bba3a36f08836fdd143d) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/display/icl_dsi.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/icl_dsi.c b/drivers/gpu/drm/i915/display/icl_dsi.c +index cf5d2f88..c62bb9e2 100644 +--- a/drivers/gpu/drm/i915/display/icl_dsi.c ++++ b/drivers/gpu/drm/i915/display/icl_dsi.c +@@ -300,9 +300,21 @@ static void configure_dual_link_mode(struct intel_encoder *encoder, + { + struct drm_i915_private *dev_priv = to_i915(encoder->base.dev); + struct intel_dsi *intel_dsi = enc_to_intel_dsi(encoder); ++ i915_reg_t dss_ctl1_reg, dss_ctl2_reg; + u32 dss_ctl1; + +- dss_ctl1 = intel_de_read(dev_priv, DSS_CTL1); ++ /* FIXME: Move all DSS handling to intel_vdsc.c */ ++ if (DISPLAY_VER(dev_priv) >= 12) { ++ struct intel_crtc *crtc = to_intel_crtc(pipe_config->uapi.crtc); ++ ++ dss_ctl1_reg = ICL_PIPE_DSS_CTL1(crtc->pipe); ++ dss_ctl2_reg = ICL_PIPE_DSS_CTL2(crtc->pipe); ++ } else { ++ dss_ctl1_reg = DSS_CTL1; ++ dss_ctl2_reg = DSS_CTL2; ++ } ++ ++ dss_ctl1 = intel_de_read(dev_priv, dss_ctl1_reg); + dss_ctl1 |= SPLITTER_ENABLE; + dss_ctl1 &= ~OVERLAP_PIXELS_MASK; + dss_ctl1 |= OVERLAP_PIXELS(intel_dsi->pixel_overlap); +@@ -323,16 +335,16 @@ static void configure_dual_link_mode(struct intel_encoder *encoder, + + dss_ctl1 &= ~LEFT_DL_BUF_TARGET_DEPTH_MASK; + dss_ctl1 |= LEFT_DL_BUF_TARGET_DEPTH(dl_buffer_depth); +- dss_ctl2 = intel_de_read(dev_priv, DSS_CTL2); ++ dss_ctl2 = intel_de_read(dev_priv, dss_ctl2_reg); + dss_ctl2 &= ~RIGHT_DL_BUF_TARGET_DEPTH_MASK; + dss_ctl2 |= RIGHT_DL_BUF_TARGET_DEPTH(dl_buffer_depth); +- intel_de_write(dev_priv, DSS_CTL2, dss_ctl2); ++ intel_de_write(dev_priv, dss_ctl2_reg, dss_ctl2); + } else { + /* Interleave */ + dss_ctl1 |= DUAL_LINK_MODE_INTERLEAVE; + } + +- intel_de_write(dev_priv, DSS_CTL1, dss_ctl1); ++ intel_de_write(dev_priv, dss_ctl1_reg, dss_ctl1); + } + + /* aka DSI 8X clock */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-029-io_uring-complete-request-via-task-work-in-cas.patch b/patches.kernel.org/6.2.12-029-io_uring-complete-request-via-task-work-in-cas.patch new file mode 100644 index 0000000..79945f6 --- /dev/null +++ b/patches.kernel.org/6.2.12-029-io_uring-complete-request-via-task-work-in-cas.patch @@ -0,0 +1,51 @@ +From: Ming Lei +Date: Fri, 14 Apr 2023 15:53:13 +0800 +Subject: [PATCH] io_uring: complete request via task work in case of + DEFER_TASKRUN +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 860e1c7f8b0b43fbf91b4d689adfaa13adb89452 + +commit 860e1c7f8b0b43fbf91b4d689adfaa13adb89452 upstream. + +So far io_req_complete_post() only covers DEFER_TASKRUN by completing +request via task work when the request is completed from IOWQ. + +However, uring command could be completed from any context, and if io +uring is setup with DEFER_TASKRUN, the command is required to be +completed from current context, otherwise wait on IORING_ENTER_GETEVENTS +can't be wakeup, and may hang forever. + +The issue can be observed on removing ublk device, but turns out it is +one generic issue for uring command & DEFER_TASKRUN, so solve it in +io_uring core code. + +Fixes: e6aeb2721d3b ("io_uring: complete all requests in task context") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/linux-block/b3fc9991-4c53-9218-a8cc-5b4dd3952108@kernel.dk/ +Reported-by: Jens Axboe +Cc: Kanchan Joshi +Signed-off-by: Ming Lei +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + io_uring/io_uring.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index add5cff7..14d4fa64 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -962,7 +962,7 @@ static void __io_req_complete_post(struct io_kiocb *req) + + void io_req_complete_post(struct io_kiocb *req, unsigned issue_flags) + { +- if (req->ctx->task_complete && (issue_flags & IO_URING_F_IOWQ)) { ++ if (req->ctx->task_complete && req->ctx->submitter_task != current) { + req->io_task_work.func = io_req_task_complete; + io_req_task_work_add(req); + } else if (!(issue_flags & IO_URING_F_UNLOCKED) || +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-030-clk-sprd-set-max_register-according-to-mapping.patch b/patches.kernel.org/6.2.12-030-clk-sprd-set-max_register-according-to-mapping.patch new file mode 100644 index 0000000..bb134c9 --- /dev/null +++ b/patches.kernel.org/6.2.12-030-clk-sprd-set-max_register-according-to-mapping.patch @@ -0,0 +1,64 @@ +From: Chunyan Zhang +Date: Thu, 16 Mar 2023 10:36:24 +0800 +Subject: [PATCH] clk: sprd: set max_register according to mapping range +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 47d43086531f10539470a63e8ad92803e686a3dd + +[ Upstream commit 47d43086531f10539470a63e8ad92803e686a3dd ] + +In sprd clock driver, regmap_config.max_register was set to a fixed value +which is likely larger than the address range configured in device tree, +when reading registers through debugfs it would cause access violation. + +Fixes: d41f59fd92f2 ("clk: sprd: Add common infrastructure") +Signed-off-by: Chunyan Zhang +Link: https://lore.kernel.org/r/20230316023624.758204-1-chunyan.zhang@unisoc.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/clk/sprd/common.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/clk/sprd/common.c b/drivers/clk/sprd/common.c +index ce81e408..2bfbab8d 100644 +--- a/drivers/clk/sprd/common.c ++++ b/drivers/clk/sprd/common.c +@@ -17,7 +17,6 @@ static const struct regmap_config sprdclk_regmap_config = { + .reg_bits = 32, + .reg_stride = 4, + .val_bits = 32, +- .max_register = 0xffff, + .fast_io = true, + }; + +@@ -43,6 +42,8 @@ int sprd_clk_regmap_init(struct platform_device *pdev, + struct device *dev = &pdev->dev; + struct device_node *node = dev->of_node, *np; + struct regmap *regmap; ++ struct resource *res; ++ struct regmap_config reg_config = sprdclk_regmap_config; + + if (of_find_property(node, "sprd,syscon", NULL)) { + regmap = syscon_regmap_lookup_by_phandle(node, "sprd,syscon"); +@@ -59,12 +60,14 @@ int sprd_clk_regmap_init(struct platform_device *pdev, + return PTR_ERR(regmap); + } + } else { +- base = devm_platform_ioremap_resource(pdev, 0); ++ base = devm_platform_get_and_ioremap_resource(pdev, 0, &res); + if (IS_ERR(base)) + return PTR_ERR(base); + ++ reg_config.max_register = resource_size(res) - reg_config.reg_stride; ++ + regmap = devm_regmap_init_mmio(&pdev->dev, base, +- &sprdclk_regmap_config); ++ ®_config); + if (IS_ERR(regmap)) { + pr_err("failed to init regmap\n"); + return PTR_ERR(regmap); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-031-RDMA-irdma-Do-not-generate-SW-completions-for-.patch b/patches.kernel.org/6.2.12-031-RDMA-irdma-Do-not-generate-SW-completions-for-.patch new file mode 100644 index 0000000..e6f1841 --- /dev/null +++ b/patches.kernel.org/6.2.12-031-RDMA-irdma-Do-not-generate-SW-completions-for-.patch @@ -0,0 +1,43 @@ +From: Mustafa Ismail +Date: Wed, 15 Mar 2023 09:52:28 -0500 +Subject: [PATCH] RDMA/irdma: Do not generate SW completions for NOPs +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 30ed9ee9a10a90ae719dcfcacead1d0506fa45ed + +[ Upstream commit 30ed9ee9a10a90ae719dcfcacead1d0506fa45ed ] + +Currently, artificial SW completions are generated for NOP wqes which can +generate unexpected completions with wr_id = 0. Skip the generation of +artificial completions for NOPs. + +Fixes: 81091d7696ae ("RDMA/irdma: Add SW mechanism to generate completions on error") +Signed-off-by: Mustafa Ismail +Signed-off-by: Shiraz Saleem +Link: https://lore.kernel.org/r/20230315145231.931-2-shiraz.saleem@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/hw/irdma/utils.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/irdma/utils.c b/drivers/infiniband/hw/irdma/utils.c +index 445e69e8..7887230c 100644 +--- a/drivers/infiniband/hw/irdma/utils.c ++++ b/drivers/infiniband/hw/irdma/utils.c +@@ -2595,7 +2595,10 @@ void irdma_generate_flush_completions(struct irdma_qp *iwqp) + /* remove the SQ WR by moving SQ tail*/ + IRDMA_RING_SET_TAIL(*sq_ring, + sq_ring->tail + qp->sq_wrtrk_array[sq_ring->tail].quanta); +- ++ if (cmpl->cpi.op_type == IRDMAQP_OP_NOP) { ++ kfree(cmpl); ++ continue; ++ } + ibdev_dbg(iwqp->iwscq->ibcq.device, + "DEV: %s: adding wr_id = 0x%llx SQ Completion to list qp_id=%d\n", + __func__, cmpl->cpi.wr_id, qp->qp_id); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-032-RDMA-irdma-Fix-memory-leak-of-PBLE-objects.patch b/patches.kernel.org/6.2.12-032-RDMA-irdma-Fix-memory-leak-of-PBLE-objects.patch new file mode 100644 index 0000000..580b5ae --- /dev/null +++ b/patches.kernel.org/6.2.12-032-RDMA-irdma-Fix-memory-leak-of-PBLE-objects.patch @@ -0,0 +1,53 @@ +From: Mustafa Ismail +Date: Wed, 15 Mar 2023 09:52:29 -0500 +Subject: [PATCH] RDMA/irdma: Fix memory leak of PBLE objects +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: b69a6979dbaa2453675fe9c71bdc2497fedb11f9 + +[ Upstream commit b69a6979dbaa2453675fe9c71bdc2497fedb11f9 ] + +On rmmod of irdma, the PBLE object memory is not being freed. PBLE object +memory are not statically pre-allocated at function initialization time +unlike other HMC objects. PBLEs objects and the Segment Descriptors (SD) +for it can be dynamically allocated during scale up and SD's remain +allocated till function deinitialization. + +Fix this leak by adding IRDMA_HMC_IW_PBLE to the iw_hmc_obj_types[] table +and skip pbles in irdma_create_hmc_obj but not in irdma_del_hmc_objects(). + +Fixes: 44d9e52977a1 ("RDMA/irdma: Implement device initialization definitions") +Signed-off-by: Mustafa Ismail +Signed-off-by: Shiraz Saleem +Link: https://lore.kernel.org/r/20230315145231.931-3-shiraz.saleem@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/hw/irdma/hw.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c +index 2e1e2bad..43dfa476 100644 +--- a/drivers/infiniband/hw/irdma/hw.c ++++ b/drivers/infiniband/hw/irdma/hw.c +@@ -41,6 +41,7 @@ static enum irdma_hmc_rsrc_type iw_hmc_obj_types[] = { + IRDMA_HMC_IW_XFFL, + IRDMA_HMC_IW_Q1, + IRDMA_HMC_IW_Q1FL, ++ IRDMA_HMC_IW_PBLE, + IRDMA_HMC_IW_TIMER, + IRDMA_HMC_IW_FSIMC, + IRDMA_HMC_IW_FSIAV, +@@ -827,6 +828,8 @@ static int irdma_create_hmc_objs(struct irdma_pci_f *rf, bool privileged, + info.entry_type = rf->sd_type; + + for (i = 0; i < IW_HMC_OBJ_TYPE_NUM; i++) { ++ if (iw_hmc_obj_types[i] == IRDMA_HMC_IW_PBLE) ++ continue; + if (dev->hmc_info->hmc_obj[iw_hmc_obj_types[i]].cnt) { + info.rsrc_type = iw_hmc_obj_types[i]; + info.count = dev->hmc_info->hmc_obj[info.rsrc_type].cnt; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-033-RDMA-irdma-Increase-iWARP-CM-default-rexmit-co.patch b/patches.kernel.org/6.2.12-033-RDMA-irdma-Increase-iWARP-CM-default-rexmit-co.patch new file mode 100644 index 0000000..26ec586 --- /dev/null +++ b/patches.kernel.org/6.2.12-033-RDMA-irdma-Increase-iWARP-CM-default-rexmit-co.patch @@ -0,0 +1,40 @@ +From: Mustafa Ismail +Date: Wed, 15 Mar 2023 09:52:30 -0500 +Subject: [PATCH] RDMA/irdma: Increase iWARP CM default rexmit count +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 8385a875c9eecc429b2f72970efcbb0e5cb5b547 + +[ Upstream commit 8385a875c9eecc429b2f72970efcbb0e5cb5b547 ] + +When running perftest with large number of connections in iWARP mode, the +passive side could be slow to respond. Increase the rexmit counter default +to allow scaling connections. + +Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager") +Signed-off-by: Mustafa Ismail +Signed-off-by: Shiraz Saleem +Link: https://lore.kernel.org/r/20230315145231.931-4-shiraz.saleem@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/hw/irdma/cm.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/irdma/cm.h b/drivers/infiniband/hw/irdma/cm.h +index 19c28497..7feadb3e 100644 +--- a/drivers/infiniband/hw/irdma/cm.h ++++ b/drivers/infiniband/hw/irdma/cm.h +@@ -41,7 +41,7 @@ + #define TCP_OPTIONS_PADDING 3 + + #define IRDMA_DEFAULT_RETRYS 64 +-#define IRDMA_DEFAULT_RETRANS 8 ++#define IRDMA_DEFAULT_RETRANS 32 + #define IRDMA_DEFAULT_TTL 0x40 + #define IRDMA_DEFAULT_RTT_VAR 6 + #define IRDMA_DEFAULT_SS_THRESH 0x3fffffff +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-034-RDMA-irdma-Add-ipv4-check-to-irdma_find_listen.patch b/patches.kernel.org/6.2.12-034-RDMA-irdma-Add-ipv4-check-to-irdma_find_listen.patch new file mode 100644 index 0000000..4b32217 --- /dev/null +++ b/patches.kernel.org/6.2.12-034-RDMA-irdma-Add-ipv4-check-to-irdma_find_listen.patch @@ -0,0 +1,81 @@ +From: Tatyana Nikolova +Date: Wed, 15 Mar 2023 09:52:31 -0500 +Subject: [PATCH] RDMA/irdma: Add ipv4 check to irdma_find_listener() +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: e4522c097ec10f23ea0933e9e69d4fa9d8ae9441 + +[ Upstream commit e4522c097ec10f23ea0933e9e69d4fa9d8ae9441 ] + +Add ipv4 check to irdma_find_listener(). Otherwise the function +incorrectly finds and returns a listener with a different addr family for +the zero IP addr, if a listener with a zero IP addr and the same port as +the one searched for has already been created. + +Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager") +Signed-off-by: Tatyana Nikolova +Signed-off-by: Shiraz Saleem +Link: https://lore.kernel.org/r/20230315145231.931-5-shiraz.saleem@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/hw/irdma/cm.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/drivers/infiniband/hw/irdma/cm.c b/drivers/infiniband/hw/irdma/cm.c +index 195aa9ea..88178641 100644 +--- a/drivers/infiniband/hw/irdma/cm.c ++++ b/drivers/infiniband/hw/irdma/cm.c +@@ -1458,13 +1458,15 @@ static int irdma_send_fin(struct irdma_cm_node *cm_node) + * irdma_find_listener - find a cm node listening on this addr-port pair + * @cm_core: cm's core + * @dst_addr: listener ip addr ++ * @ipv4: flag indicating IPv4 when true + * @dst_port: listener tcp port num + * @vlan_id: virtual LAN ID + * @listener_state: state to match with listen node's + */ + static struct irdma_cm_listener * +-irdma_find_listener(struct irdma_cm_core *cm_core, u32 *dst_addr, u16 dst_port, +- u16 vlan_id, enum irdma_cm_listener_state listener_state) ++irdma_find_listener(struct irdma_cm_core *cm_core, u32 *dst_addr, bool ipv4, ++ u16 dst_port, u16 vlan_id, ++ enum irdma_cm_listener_state listener_state) + { + struct irdma_cm_listener *listen_node; + static const u32 ip_zero[4] = { 0, 0, 0, 0 }; +@@ -1477,7 +1479,7 @@ irdma_find_listener(struct irdma_cm_core *cm_core, u32 *dst_addr, u16 dst_port, + list_for_each_entry (listen_node, &cm_core->listen_list, list) { + memcpy(listen_addr, listen_node->loc_addr, sizeof(listen_addr)); + listen_port = listen_node->loc_port; +- if (listen_port != dst_port || ++ if (listen_node->ipv4 != ipv4 || listen_port != dst_port || + !(listener_state & listen_node->listener_state)) + continue; + /* compare node pair, return node handle if a match */ +@@ -2902,9 +2904,10 @@ irdma_make_listen_node(struct irdma_cm_core *cm_core, + unsigned long flags; + + /* cannot have multiple matching listeners */ +- listener = irdma_find_listener(cm_core, cm_info->loc_addr, +- cm_info->loc_port, cm_info->vlan_id, +- IRDMA_CM_LISTENER_EITHER_STATE); ++ listener = ++ irdma_find_listener(cm_core, cm_info->loc_addr, cm_info->ipv4, ++ cm_info->loc_port, cm_info->vlan_id, ++ IRDMA_CM_LISTENER_EITHER_STATE); + if (listener && + listener->listener_state == IRDMA_CM_LISTENER_ACTIVE_STATE) { + refcount_dec(&listener->refcnt); +@@ -3153,6 +3156,7 @@ void irdma_receive_ilq(struct irdma_sc_vsi *vsi, struct irdma_puda_buf *rbuf) + + listener = irdma_find_listener(cm_core, + cm_info.loc_addr, ++ cm_info.ipv4, + cm_info.loc_port, + cm_info.vlan_id, + IRDMA_CM_LISTENER_ACTIVE_STATE); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-035-IB-mlx5-Add-support-for-400G_8X-lane-speed.patch b/patches.kernel.org/6.2.12-035-IB-mlx5-Add-support-for-400G_8X-lane-speed.patch new file mode 100644 index 0000000..b943c8b --- /dev/null +++ b/patches.kernel.org/6.2.12-035-IB-mlx5-Add-support-for-400G_8X-lane-speed.patch @@ -0,0 +1,47 @@ +From: Maher Sanalla +Date: Thu, 16 Mar 2023 15:40:49 +0200 +Subject: [PATCH] IB/mlx5: Add support for 400G_8X lane speed +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 88c9483faf15ada14eca82714114656893063458 + +[ Upstream commit 88c9483faf15ada14eca82714114656893063458 ] + +Currently, when driver queries PTYS to report which link speed is being +used on its RoCE ports, it does not check the case of having 400Gbps +transmitted over 8 lanes. Thus it fails to report the said speed and +instead it defaults to report 10G over 4 lanes. + +Add a check for the said speed when querying PTYS and report it back +correctly when needed. + +Fixes: 08e8676f1607 ("IB/mlx5: Add support for 50Gbps per lane link modes") +Signed-off-by: Maher Sanalla +Reviewed-by: Aya Levin +Reviewed-by: Saeed Mahameed +Link: https://lore.kernel.org/r/ec9040548d119d22557d6a4b4070d6f421701fd4.1678973994.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/hw/mlx5/main.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index c669ef6e..eaa35e1d 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -442,6 +442,10 @@ static int translate_eth_ext_proto_oper(u32 eth_proto_oper, u16 *active_speed, + *active_width = IB_WIDTH_2X; + *active_speed = IB_SPEED_NDR; + break; ++ case MLX5E_PROT_MASK(MLX5E_400GAUI_8): ++ *active_width = IB_WIDTH_8X; ++ *active_speed = IB_SPEED_HDR; ++ break; + case MLX5E_PROT_MASK(MLX5E_400GAUI_4_400GBASE_CR4_KR4): + *active_width = IB_WIDTH_4X; + *active_speed = IB_SPEED_NDR; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-036-RDMA-erdma-Fix-some-typos.patch b/patches.kernel.org/6.2.12-036-RDMA-erdma-Fix-some-typos.patch new file mode 100644 index 0000000..76a21ff --- /dev/null +++ b/patches.kernel.org/6.2.12-036-RDMA-erdma-Fix-some-typos.patch @@ -0,0 +1,65 @@ +From: Cheng Xu +Date: Mon, 20 Mar 2023 16:46:49 +0800 +Subject: [PATCH] RDMA/erdma: Fix some typos +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 3fe26c0493e4c2da4b7d8ba8c975a6f48fb75ec2 + +[ Upstream commit 3fe26c0493e4c2da4b7d8ba8c975a6f48fb75ec2 ] + +FAA is short for atomic fetch and add, not FAD. Fix this. + +Fixes: 0ca9c2e2844a ("RDMA/erdma: Implement atomic operations support") +Signed-off-by: Cheng Xu +Link: https://lore.kernel.org/r/20230320084652.16807-2-chengyou@linux.alibaba.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/hw/erdma/erdma_cq.c | 2 +- + drivers/infiniband/hw/erdma/erdma_hw.h | 2 +- + drivers/infiniband/hw/erdma/erdma_qp.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/erdma/erdma_cq.c b/drivers/infiniband/hw/erdma/erdma_cq.c +index cabd8678..7bc35427 100644 +--- a/drivers/infiniband/hw/erdma/erdma_cq.c ++++ b/drivers/infiniband/hw/erdma/erdma_cq.c +@@ -65,7 +65,7 @@ static const enum ib_wc_opcode wc_mapping_table[ERDMA_NUM_OPCODES] = { + [ERDMA_OP_LOCAL_INV] = IB_WC_LOCAL_INV, + [ERDMA_OP_READ_WITH_INV] = IB_WC_RDMA_READ, + [ERDMA_OP_ATOMIC_CAS] = IB_WC_COMP_SWAP, +- [ERDMA_OP_ATOMIC_FAD] = IB_WC_FETCH_ADD, ++ [ERDMA_OP_ATOMIC_FAA] = IB_WC_FETCH_ADD, + }; + + static const struct { +diff --git a/drivers/infiniband/hw/erdma/erdma_hw.h b/drivers/infiniband/hw/erdma/erdma_hw.h +index ab371fec..cbeb6909 100644 +--- a/drivers/infiniband/hw/erdma/erdma_hw.h ++++ b/drivers/infiniband/hw/erdma/erdma_hw.h +@@ -491,7 +491,7 @@ enum erdma_opcode { + ERDMA_OP_LOCAL_INV = 15, + ERDMA_OP_READ_WITH_INV = 16, + ERDMA_OP_ATOMIC_CAS = 17, +- ERDMA_OP_ATOMIC_FAD = 18, ++ ERDMA_OP_ATOMIC_FAA = 18, + ERDMA_NUM_OPCODES = 19, + ERDMA_OP_INVALID = ERDMA_NUM_OPCODES + 1 + }; +diff --git a/drivers/infiniband/hw/erdma/erdma_qp.c b/drivers/infiniband/hw/erdma/erdma_qp.c +index d088d6be..ff473b20 100644 +--- a/drivers/infiniband/hw/erdma/erdma_qp.c ++++ b/drivers/infiniband/hw/erdma/erdma_qp.c +@@ -439,7 +439,7 @@ static int erdma_push_one_sqe(struct erdma_qp *qp, u16 *pi, + cpu_to_le64(atomic_wr(send_wr)->compare_add); + } else { + wqe_hdr |= FIELD_PREP(ERDMA_SQE_HDR_OPCODE_MASK, +- ERDMA_OP_ATOMIC_FAD); ++ ERDMA_OP_ATOMIC_FAA); + atomic_sqe->fetchadd_swap_data = + cpu_to_le64(atomic_wr(send_wr)->compare_add); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-037-RDMA-erdma-Update-default-EQ-depth-to-4096-and.patch b/patches.kernel.org/6.2.12-037-RDMA-erdma-Update-default-EQ-depth-to-4096-and.patch new file mode 100644 index 0000000..44e0efc --- /dev/null +++ b/patches.kernel.org/6.2.12-037-RDMA-erdma-Update-default-EQ-depth-to-4096-and.patch @@ -0,0 +1,56 @@ +From: Cheng Xu +Date: Mon, 20 Mar 2023 16:46:50 +0800 +Subject: [PATCH] RDMA/erdma: Update default EQ depth to 4096 and max_send_wr + to 8192 +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 6256aa9ae955d10ec73a434533ca62034eff1b76 + +[ Upstream commit 6256aa9ae955d10ec73a434533ca62034eff1b76 ] + +Max EQ depth of hardware is 32K, the current default EQ depth is too small +for some applications, so change the default depth to 4096. +Max send WRs the hardware can support is 8K, but the driver limits the +value to 4K. Remove this limitation. + +Fixes: be3cff0f242d ("RDMA/erdma: Add the hardware related definitions") +Fixes: db23ae64caac ("RDMA/erdma: Add verbs header file") +Signed-off-by: Cheng Xu +Link: https://lore.kernel.org/r/20230320084652.16807-3-chengyou@linux.alibaba.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/hw/erdma/erdma_hw.h | 2 +- + drivers/infiniband/hw/erdma/erdma_verbs.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/erdma/erdma_hw.h b/drivers/infiniband/hw/erdma/erdma_hw.h +index cbeb6909..8a8d4539 100644 +--- a/drivers/infiniband/hw/erdma/erdma_hw.h ++++ b/drivers/infiniband/hw/erdma/erdma_hw.h +@@ -441,7 +441,7 @@ struct erdma_reg_mr_sqe { + }; + + /* EQ related. */ +-#define ERDMA_DEFAULT_EQ_DEPTH 256 ++#define ERDMA_DEFAULT_EQ_DEPTH 4096 + + /* ceqe */ + #define ERDMA_CEQE_HDR_DB_MASK BIT_ULL(63) +diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.h b/drivers/infiniband/hw/erdma/erdma_verbs.h +index e0a993bc..131cf5f4 100644 +--- a/drivers/infiniband/hw/erdma/erdma_verbs.h ++++ b/drivers/infiniband/hw/erdma/erdma_verbs.h +@@ -11,7 +11,7 @@ + + /* RDMA Capability. */ + #define ERDMA_MAX_PD (128 * 1024) +-#define ERDMA_MAX_SEND_WR 4096 ++#define ERDMA_MAX_SEND_WR 8192 + #define ERDMA_MAX_ORD 128 + #define ERDMA_MAX_IRD 128 + #define ERDMA_MAX_SGE_RD 1 +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-038-RDMA-erdma-Inline-mtt-entries-into-WQE-if-supp.patch b/patches.kernel.org/6.2.12-038-RDMA-erdma-Inline-mtt-entries-into-WQE-if-supp.patch new file mode 100644 index 0000000..3d7ad9b --- /dev/null +++ b/patches.kernel.org/6.2.12-038-RDMA-erdma-Inline-mtt-entries-into-WQE-if-supp.patch @@ -0,0 +1,39 @@ +From: Cheng Xu +Date: Mon, 20 Mar 2023 16:46:51 +0800 +Subject: [PATCH] RDMA/erdma: Inline mtt entries into WQE if supported +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 0dd83a4d7756713f81990d6c5547500f212a1190 + +[ Upstream commit 0dd83a4d7756713f81990d6c5547500f212a1190 ] + +The max inline mtt count supported is ERDMA_MAX_INLINE_MTT_ENTRIES. +When mr->mem.mtt_nents == ERDMA_MAX_INLINE_MTT_ENTRIES, inline mtt +is also supported, fix it. + +Fixes: 155055771704 ("RDMA/erdma: Add verbs implementation") +Signed-off-by: Cheng Xu +Link: https://lore.kernel.org/r/20230320084652.16807-4-chengyou@linux.alibaba.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/hw/erdma/erdma_qp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/erdma/erdma_qp.c b/drivers/infiniband/hw/erdma/erdma_qp.c +index ff473b20..44923c51 100644 +--- a/drivers/infiniband/hw/erdma/erdma_qp.c ++++ b/drivers/infiniband/hw/erdma/erdma_qp.c +@@ -405,7 +405,7 @@ static int erdma_push_one_sqe(struct erdma_qp *qp, u16 *pi, + FIELD_PREP(ERDMA_SQE_MR_MTT_CNT_MASK, + mr->mem.mtt_nents); + +- if (mr->mem.mtt_nents < ERDMA_MAX_INLINE_MTT_ENTRIES) { ++ if (mr->mem.mtt_nents <= ERDMA_MAX_INLINE_MTT_ENTRIES) { + attrs |= FIELD_PREP(ERDMA_SQE_MR_MTT_TYPE_MASK, 0); + /* Copy SGLs to SQE content to accelerate */ + memcpy(get_queue_entry(qp->kern_qp.sq_buf, idx + 1, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-039-RDMA-erdma-Defer-probing-if-netdevice-can-not-.patch b/patches.kernel.org/6.2.12-039-RDMA-erdma-Defer-probing-if-netdevice-can-not-.patch new file mode 100644 index 0000000..6a2cdfb --- /dev/null +++ b/patches.kernel.org/6.2.12-039-RDMA-erdma-Defer-probing-if-netdevice-can-not-.patch @@ -0,0 +1,38 @@ +From: Cheng Xu +Date: Mon, 20 Mar 2023 16:46:52 +0800 +Subject: [PATCH] RDMA/erdma: Defer probing if netdevice can not be found +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 6bd1bca858f1734a75572a788213d1e1143f2f0a + +[ Upstream commit 6bd1bca858f1734a75572a788213d1e1143f2f0a ] + +ERDMA device may be probed before its associated netdevice, returning +-EPROBE_DEFER allows OS try to probe erdma device later. + +Fixes: d55e6fb4803c ("RDMA/erdma: Add the erdma module") +Signed-off-by: Cheng Xu +Link: https://lore.kernel.org/r/20230320084652.16807-5-chengyou@linux.alibaba.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/hw/erdma/erdma_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/erdma/erdma_main.c b/drivers/infiniband/hw/erdma/erdma_main.c +index 5dc31e5d..4a29a53a 100644 +--- a/drivers/infiniband/hw/erdma/erdma_main.c ++++ b/drivers/infiniband/hw/erdma/erdma_main.c +@@ -56,7 +56,7 @@ static int erdma_netdev_event(struct notifier_block *nb, unsigned long event, + static int erdma_enum_and_get_netdev(struct erdma_dev *dev) + { + struct net_device *netdev; +- int ret = -ENODEV; ++ int ret = -EPROBE_DEFER; + + /* Already binded to a net_device, so we skip. */ + if (dev->netdev) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-040-clk-rs9-Fix-suspend-resume.patch b/patches.kernel.org/6.2.12-040-clk-rs9-Fix-suspend-resume.patch new file mode 100644 index 0000000..6db7fe9 --- /dev/null +++ b/patches.kernel.org/6.2.12-040-clk-rs9-Fix-suspend-resume.patch @@ -0,0 +1,44 @@ +From: Alexander Stein +Date: Fri, 10 Mar 2023 08:49:40 +0100 +Subject: [PATCH] clk: rs9: Fix suspend/resume +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 632e04739c8f45c2d9ca4d4c5bd18d80c2ac9296 + +[ Upstream commit 632e04739c8f45c2d9ca4d4c5bd18d80c2ac9296 ] + +Disabling the cache in commit 2ff4ba9e3702 ("clk: rs9: Fix I2C accessors") +without removing cache synchronization in resume path results in a +kernel panic as map->cache_ops is unset, due to REGCACHE_NONE. +Enable flat cache again to support resume again. num_reg_defaults_raw +is necessary to read the cache defaults from hardware. Some registers +are strapped in hardware and cannot be provided in software. + +Fixes: 2ff4ba9e3702 ("clk: rs9: Fix I2C accessors") +Signed-off-by: Alexander Stein +Link: https://lore.kernel.org/r/20230310074940.3475703-1-alexander.stein@ew.tq-group.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/clk/clk-renesas-pcie.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/clk-renesas-pcie.c b/drivers/clk/clk-renesas-pcie.c +index e6247141..3e98a16e 100644 +--- a/drivers/clk/clk-renesas-pcie.c ++++ b/drivers/clk/clk-renesas-pcie.c +@@ -144,8 +144,9 @@ static int rs9_regmap_i2c_read(void *context, + static const struct regmap_config rs9_regmap_config = { + .reg_bits = 8, + .val_bits = 8, +- .cache_type = REGCACHE_NONE, ++ .cache_type = REGCACHE_FLAT, + .max_register = RS9_REG_BCP, ++ .num_reg_defaults_raw = 0x8, + .rd_table = &rs9_readable_table, + .wr_table = &rs9_writeable_table, + .reg_write = rs9_regmap_i2c_write, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-041-RDMA-cma-Allow-UD-qp_type-to-join-multicast-on.patch b/patches.kernel.org/6.2.12-041-RDMA-cma-Allow-UD-qp_type-to-join-multicast-on.patch new file mode 100644 index 0000000..868c700 --- /dev/null +++ b/patches.kernel.org/6.2.12-041-RDMA-cma-Allow-UD-qp_type-to-join-multicast-on.patch @@ -0,0 +1,209 @@ +From: Mark Zhang +Date: Mon, 20 Mar 2023 12:59:55 +0200 +Subject: [PATCH] RDMA/cma: Allow UD qp_type to join multicast only +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 58e84f6b3e84e46524b7e5a916b53c1ad798bc8f + +[ Upstream commit 58e84f6b3e84e46524b7e5a916b53c1ad798bc8f ] + +As for multicast: +- The SIDR is the only mode that makes sense; +- Besides PS_UDP, other port spaces like PS_IB is also allowed, as it is + UD compatible. In this case qkey also needs to be set [1]. + +This patch allows only UD qp_type to join multicast, and set qkey to +default if it's not set, to fix an uninit-value error: the ib->rec.qkey +field is accessed without being initialized. + +===================================================== +BUG: KMSAN: uninit-value in cma_set_qkey drivers/infiniband/core/cma.c:510 [inline] +BUG: KMSAN: uninit-value in cma_make_mc_event+0xb73/0xe00 drivers/infiniband/core/cma.c:4570 + cma_set_qkey drivers/infiniband/core/cma.c:510 [inline] + cma_make_mc_event+0xb73/0xe00 drivers/infiniband/core/cma.c:4570 + cma_iboe_join_multicast drivers/infiniband/core/cma.c:4782 [inline] + rdma_join_multicast+0x2b83/0x30a0 drivers/infiniband/core/cma.c:4814 + ucma_process_join+0xa76/0xf60 drivers/infiniband/core/ucma.c:1479 + ucma_join_multicast+0x1e3/0x250 drivers/infiniband/core/ucma.c:1546 + ucma_write+0x639/0x6d0 drivers/infiniband/core/ucma.c:1732 + vfs_write+0x8ce/0x2030 fs/read_write.c:588 + ksys_write+0x28c/0x520 fs/read_write.c:643 + __do_sys_write fs/read_write.c:655 [inline] + __se_sys_write fs/read_write.c:652 [inline] + __ia32_sys_write+0xdb/0x120 fs/read_write.c:652 + do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline] + __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180 + do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205 + do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248 + entry_SYSENTER_compat_after_hwframe+0x4d/0x5c + +Local variable ib.i created at: +cma_iboe_join_multicast drivers/infiniband/core/cma.c:4737 [inline] +rdma_join_multicast+0x586/0x30a0 drivers/infiniband/core/cma.c:4814 +ucma_process_join+0xa76/0xf60 drivers/infiniband/core/ucma.c:1479 + +CPU: 0 PID: 29874 Comm: syz-executor.3 Not tainted 5.16.0-rc3-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +===================================================== + +[1] https://lore.kernel.org/linux-rdma/20220117183832.GD84788@nvidia.com/ + +Fixes: b5de0c60cc30 ("RDMA/cma: Fix use after free race in roce multicast join") +Reported-by: syzbot+8fcbb77276d43cc8b693@syzkaller.appspotmail.com +Signed-off-by: Mark Zhang +Link: https://lore.kernel.org/r/58a4a98323b5e6b1282e83f6b76960d06e43b9fa.1679309909.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/core/cma.c | 60 ++++++++++++++++++++--------------- + 1 file changed, 34 insertions(+), 26 deletions(-) + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 7e508b15..00c9529c 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -624,22 +624,11 @@ static inline unsigned short cma_family(struct rdma_id_private *id_priv) + return id_priv->id.route.addr.src_addr.ss_family; + } + +-static int cma_set_qkey(struct rdma_id_private *id_priv, u32 qkey) ++static int cma_set_default_qkey(struct rdma_id_private *id_priv) + { + struct ib_sa_mcmember_rec rec; + int ret = 0; + +- if (id_priv->qkey) { +- if (qkey && id_priv->qkey != qkey) +- return -EINVAL; +- return 0; +- } +- +- if (qkey) { +- id_priv->qkey = qkey; +- return 0; +- } +- + switch (id_priv->id.ps) { + case RDMA_PS_UDP: + case RDMA_PS_IB: +@@ -659,6 +648,16 @@ static int cma_set_qkey(struct rdma_id_private *id_priv, u32 qkey) + return ret; + } + ++static int cma_set_qkey(struct rdma_id_private *id_priv, u32 qkey) ++{ ++ if (!qkey || ++ (id_priv->qkey && (id_priv->qkey != qkey))) ++ return -EINVAL; ++ ++ id_priv->qkey = qkey; ++ return 0; ++} ++ + static void cma_translate_ib(struct sockaddr_ib *sib, struct rdma_dev_addr *dev_addr) + { + dev_addr->dev_type = ARPHRD_INFINIBAND; +@@ -1229,7 +1228,7 @@ static int cma_ib_init_qp_attr(struct rdma_id_private *id_priv, + *qp_attr_mask = IB_QP_STATE | IB_QP_PKEY_INDEX | IB_QP_PORT; + + if (id_priv->id.qp_type == IB_QPT_UD) { +- ret = cma_set_qkey(id_priv, 0); ++ ret = cma_set_default_qkey(id_priv); + if (ret) + return ret; + +@@ -4558,7 +4557,10 @@ static int cma_send_sidr_rep(struct rdma_id_private *id_priv, + memset(&rep, 0, sizeof rep); + rep.status = status; + if (status == IB_SIDR_SUCCESS) { +- ret = cma_set_qkey(id_priv, qkey); ++ if (qkey) ++ ret = cma_set_qkey(id_priv, qkey); ++ else ++ ret = cma_set_default_qkey(id_priv); + if (ret) + return ret; + rep.qp_num = id_priv->qp_num; +@@ -4763,9 +4765,7 @@ static void cma_make_mc_event(int status, struct rdma_id_private *id_priv, + enum ib_gid_type gid_type; + struct net_device *ndev; + +- if (!status) +- status = cma_set_qkey(id_priv, be32_to_cpu(multicast->rec.qkey)); +- else ++ if (status) + pr_debug_ratelimited("RDMA CM: MULTICAST_ERROR: failed to join multicast. status %d\n", + status); + +@@ -4793,7 +4793,7 @@ static void cma_make_mc_event(int status, struct rdma_id_private *id_priv, + } + + event->param.ud.qp_num = 0xFFFFFF; +- event->param.ud.qkey = be32_to_cpu(multicast->rec.qkey); ++ event->param.ud.qkey = id_priv->qkey; + + out: + if (ndev) +@@ -4812,8 +4812,11 @@ static int cma_ib_mc_handler(int status, struct ib_sa_multicast *multicast) + READ_ONCE(id_priv->state) == RDMA_CM_DESTROYING) + goto out; + +- cma_make_mc_event(status, id_priv, multicast, &event, mc); +- ret = cma_cm_event_handler(id_priv, &event); ++ ret = cma_set_qkey(id_priv, be32_to_cpu(multicast->rec.qkey)); ++ if (!ret) { ++ cma_make_mc_event(status, id_priv, multicast, &event, mc); ++ ret = cma_cm_event_handler(id_priv, &event); ++ } + rdma_destroy_ah_attr(&event.param.ud.ah_attr); + WARN_ON(ret); + +@@ -4866,9 +4869,11 @@ static int cma_join_ib_multicast(struct rdma_id_private *id_priv, + if (ret) + return ret; + +- ret = cma_set_qkey(id_priv, 0); +- if (ret) +- return ret; ++ if (!id_priv->qkey) { ++ ret = cma_set_default_qkey(id_priv); ++ if (ret) ++ return ret; ++ } + + cma_set_mgid(id_priv, (struct sockaddr *) &mc->addr, &rec.mgid); + rec.qkey = cpu_to_be32(id_priv->qkey); +@@ -4945,9 +4950,6 @@ static int cma_iboe_join_multicast(struct rdma_id_private *id_priv, + cma_iboe_set_mgid(addr, &ib.rec.mgid, gid_type); + + ib.rec.pkey = cpu_to_be16(0xffff); +- if (id_priv->id.ps == RDMA_PS_UDP) +- ib.rec.qkey = cpu_to_be32(RDMA_UDP_QKEY); +- + if (dev_addr->bound_dev_if) + ndev = dev_get_by_index(dev_addr->net, dev_addr->bound_dev_if); + if (!ndev) +@@ -4973,6 +4975,9 @@ static int cma_iboe_join_multicast(struct rdma_id_private *id_priv, + if (err || !ib.rec.mtu) + return err ?: -EINVAL; + ++ if (!id_priv->qkey) ++ cma_set_default_qkey(id_priv); ++ + rdma_ip2gid((struct sockaddr *)&id_priv->id.route.addr.src_addr, + &ib.rec.port_gid); + INIT_WORK(&mc->iboe_join.work, cma_iboe_join_work_handler); +@@ -4998,6 +5003,9 @@ int rdma_join_multicast(struct rdma_cm_id *id, struct sockaddr *addr, + READ_ONCE(id_priv->state) != RDMA_CM_ADDR_RESOLVED)) + return -EINVAL; + ++ if (id_priv->id.qp_type != IB_QPT_UD) ++ return -EINVAL; ++ + mc = kzalloc(sizeof(*mc), GFP_KERNEL); + if (!mc) + return -ENOMEM; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-042-bpf-tcp-Use-sock_gen_put-instead-of-sock_put-i.patch b/patches.kernel.org/6.2.12-042-bpf-tcp-Use-sock_gen_put-instead-of-sock_put-i.patch new file mode 100644 index 0000000..ef32ef9 --- /dev/null +++ b/patches.kernel.org/6.2.12-042-bpf-tcp-Use-sock_gen_put-instead-of-sock_put-i.patch @@ -0,0 +1,51 @@ +From: Martin KaFai Lau +Date: Mon, 27 Mar 2023 17:42:32 -0700 +Subject: [PATCH] bpf: tcp: Use sock_gen_put instead of sock_put in + bpf_iter_tcp +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 580031ff9952b7dbf48dedba6b56a100ae002bef + +[ Upstream commit 580031ff9952b7dbf48dedba6b56a100ae002bef ] + +While reviewing the udp-iter batching patches, noticed the bpf_iter_tcp +calling sock_put() is incorrect. It should call sock_gen_put instead +because bpf_iter_tcp is iterating the ehash table which has the req sk +and tw sk. This patch replaces all sock_put with sock_gen_put in the +bpf_iter_tcp codepath. + +Fixes: 04c7820b776f ("bpf: tcp: Bpf iter batching and lock_sock") +Signed-off-by: Martin KaFai Lau +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20230328004232.2134233-1-martin.lau@linux.dev +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/ipv4/tcp_ipv4.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 8320d0ec..339a9cea 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -2779,7 +2779,7 @@ static int tcp_prog_seq_show(struct bpf_prog *prog, struct bpf_iter_meta *meta, + static void bpf_iter_tcp_put_batch(struct bpf_tcp_iter_state *iter) + { + while (iter->cur_sk < iter->end_sk) +- sock_put(iter->batch[iter->cur_sk++]); ++ sock_gen_put(iter->batch[iter->cur_sk++]); + } + + static int bpf_iter_tcp_realloc_batch(struct bpf_tcp_iter_state *iter, +@@ -2940,7 +2940,7 @@ static void *bpf_iter_tcp_seq_next(struct seq_file *seq, void *v, loff_t *pos) + * st->bucket. See tcp_seek_last_pos(). + */ + st->offset++; +- sock_put(iter->batch[iter->cur_sk++]); ++ sock_gen_put(iter->batch[iter->cur_sk++]); + } + + if (iter->cur_sk < iter->end_sk) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-043-LoongArch-bpf-Fix-jit-to-skip-speculation-barr.patch b/patches.kernel.org/6.2.12-043-LoongArch-bpf-Fix-jit-to-skip-speculation-barr.patch new file mode 100644 index 0000000..1a7d222 --- /dev/null +++ b/patches.kernel.org/6.2.12-043-LoongArch-bpf-Fix-jit-to-skip-speculation-barr.patch @@ -0,0 +1,75 @@ +From: George Guo +Date: Tue, 28 Mar 2023 15:13:35 +0800 +Subject: [PATCH] LoongArch, bpf: Fix jit to skip speculation barrier opcode +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: a6f6a95f25803500079513780d11a911ce551d76 + +[ Upstream commit a6f6a95f25803500079513780d11a911ce551d76 ] + +Just skip the opcode(BPF_ST | BPF_NOSPEC) in the BPF JIT instead of +failing to JIT the entire program, given LoongArch currently has no +couterpart of a speculation barrier instruction. To verify the issue, +use the ltp testcase as shown below. + +Also, Wang says: + + I can confirm there's currently no speculation barrier equivalent + on LonogArch. (Loongson says there are builtin mitigations for + Spectre-V1 and V2 on their chips, and AFAIK efforts to port the + exploits to mips/LoongArch have all failed a few years ago.) + +Without this patch: + + $ ./bpf_prog02 + [...] + bpf_common.c:123: TBROK: Failed verification: ??? (524) + [...] + Summary: + passed 0 + failed 0 + broken 1 + skipped 0 + warnings 0 + +With this patch: + + $ ./bpf_prog02 + [...] + Summary: + passed 0 + failed 0 + broken 0 + skipped 0 + warnings 0 + +Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support") +Signed-off-by: George Guo +Signed-off-by: Daniel Borkmann +Acked-by: WANG Xuerui +Cc: Tiezhu Yang +Link: https://lore.kernel.org/bpf/20230328071335.2664966-1-guodongtai@kylinos.cn +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/loongarch/net/bpf_jit.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c +index 288003a9..d586df48 100644 +--- a/arch/loongarch/net/bpf_jit.c ++++ b/arch/loongarch/net/bpf_jit.c +@@ -1022,6 +1022,10 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext + emit_atomic(insn, ctx); + break; + ++ /* Speculation barrier */ ++ case BPF_ST | BPF_NOSPEC: ++ break; ++ + default: + pr_err("bpf_jit: unknown opcode %02x\n", code); + return -EINVAL; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-044-dmaengine-apple-admac-Handle-global-interrupt-.patch b/patches.kernel.org/6.2.12-044-dmaengine-apple-admac-Handle-global-interrupt-.patch new file mode 100644 index 0000000..e8e7f0f --- /dev/null +++ b/patches.kernel.org/6.2.12-044-dmaengine-apple-admac-Handle-global-interrupt-.patch @@ -0,0 +1,73 @@ +From: =?UTF-8?q?Martin=20Povi=C5=A1er?= +Date: Fri, 24 Feb 2023 16:22:20 +0100 +Subject: [PATCH] dmaengine: apple-admac: Handle 'global' interrupt flags +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: a288fd158fbf85c06a9ac01cecabf97ac5d962e7 + +[ Upstream commit a288fd158fbf85c06a9ac01cecabf97ac5d962e7 ] + +In addition to TX channel and RX channel interrupt flags there's +another class of 'global' interrupt flags with unknown semantics. Those +weren't being handled up to now, and they are the suspected cause of +stuck IRQ states that have been sporadically occurring. Check the global +flags and clear them if raised. + +Fixes: b127315d9a78 ("dmaengine: apple-admac: Add Apple ADMAC driver") +Signed-off-by: Martin Povišer +Link: https://lore.kernel.org/r/20230224152222.26732-1-povik+lin@cutebit.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/dma/apple-admac.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/apple-admac.c b/drivers/dma/apple-admac.c +index 90f28bda..00cbfafe 100644 +--- a/drivers/dma/apple-admac.c ++++ b/drivers/dma/apple-admac.c +@@ -75,6 +75,7 @@ + + #define REG_TX_INTSTATE(idx) (0x0030 + (idx) * 4) + #define REG_RX_INTSTATE(idx) (0x0040 + (idx) * 4) ++#define REG_GLOBAL_INTSTATE(idx) (0x0050 + (idx) * 4) + #define REG_CHAN_INTSTATUS(ch, idx) (0x8010 + (ch) * 0x200 + (idx) * 4) + #define REG_CHAN_INTMASK(ch, idx) (0x8020 + (ch) * 0x200 + (idx) * 4) + +@@ -672,13 +673,14 @@ static void admac_handle_chan_int(struct admac_data *ad, int no) + static irqreturn_t admac_interrupt(int irq, void *devid) + { + struct admac_data *ad = devid; +- u32 rx_intstate, tx_intstate; ++ u32 rx_intstate, tx_intstate, global_intstate; + int i; + + rx_intstate = readl_relaxed(ad->base + REG_RX_INTSTATE(ad->irq_index)); + tx_intstate = readl_relaxed(ad->base + REG_TX_INTSTATE(ad->irq_index)); ++ global_intstate = readl_relaxed(ad->base + REG_GLOBAL_INTSTATE(ad->irq_index)); + +- if (!tx_intstate && !rx_intstate) ++ if (!tx_intstate && !rx_intstate && !global_intstate) + return IRQ_NONE; + + for (i = 0; i < ad->nchannels; i += 2) { +@@ -693,6 +695,12 @@ static irqreturn_t admac_interrupt(int irq, void *devid) + rx_intstate >>= 1; + } + ++ if (global_intstate) { ++ dev_warn(ad->dev, "clearing unknown global interrupt flag: %x\n", ++ global_intstate); ++ writel_relaxed(~(u32) 0, ad->base + REG_GLOBAL_INTSTATE(ad->irq_index)); ++ } ++ + return IRQ_HANDLED; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-045-dmaengine-apple-admac-Set-src_addr_widths-capa.patch b/patches.kernel.org/6.2.12-045-dmaengine-apple-admac-Set-src_addr_widths-capa.patch new file mode 100644 index 0000000..678de14 --- /dev/null +++ b/patches.kernel.org/6.2.12-045-dmaengine-apple-admac-Set-src_addr_widths-capa.patch @@ -0,0 +1,42 @@ +From: =?UTF-8?q?Martin=20Povi=C5=A1er?= +Date: Fri, 24 Feb 2023 16:22:22 +0100 +Subject: [PATCH] dmaengine: apple-admac: Set src_addr_widths capability +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 6e96adcaa7a29827ac8ee8df290a44957a4823ec + +[ Upstream commit 6e96adcaa7a29827ac8ee8df290a44957a4823ec ] + +Add missing setting of 'src_addr_widths', which is the same as for the +other direction. + +Fixes: b127315d9a78 ("dmaengine: apple-admac: Add Apple ADMAC driver") +Signed-off-by: Martin Povišer +Link: https://lore.kernel.org/r/20230224152222.26732-3-povik+lin@cutebit.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/dma/apple-admac.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/dma/apple-admac.c b/drivers/dma/apple-admac.c +index 00cbfafe..b9132b49 100644 +--- a/drivers/dma/apple-admac.c ++++ b/drivers/dma/apple-admac.c +@@ -858,6 +858,9 @@ static int admac_probe(struct platform_device *pdev) + + dma->directions = BIT(DMA_MEM_TO_DEV) | BIT(DMA_DEV_TO_MEM); + dma->residue_granularity = DMA_RESIDUE_GRANULARITY_BURST; ++ dma->src_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_1_BYTE) | ++ BIT(DMA_SLAVE_BUSWIDTH_2_BYTES) | ++ BIT(DMA_SLAVE_BUSWIDTH_4_BYTES); + dma->dst_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_1_BYTE) | + BIT(DMA_SLAVE_BUSWIDTH_2_BYTES) | + BIT(DMA_SLAVE_BUSWIDTH_4_BYTES); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-046-dmaengine-apple-admac-Fix-current_tx-not-getti.patch b/patches.kernel.org/6.2.12-046-dmaengine-apple-admac-Fix-current_tx-not-getti.patch new file mode 100644 index 0000000..5622a22 --- /dev/null +++ b/patches.kernel.org/6.2.12-046-dmaengine-apple-admac-Fix-current_tx-not-getti.patch @@ -0,0 +1,48 @@ +From: =?UTF-8?q?Martin=20Povi=C5=A1er?= +Date: Fri, 24 Feb 2023 16:22:21 +0100 +Subject: [PATCH] dmaengine: apple-admac: Fix 'current_tx' not getting freed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: d9503be5a100c553731c0e8a82c7b4201e8a970c + +[ Upstream commit d9503be5a100c553731c0e8a82c7b4201e8a970c ] + +In terminate_all we should queue up all submitted descriptors to be +freed. We do that for the content of the 'issued' and 'submitted' lists, +but the 'current_tx' descriptor falls through the cracks as it's +removed from the 'issued' list once it gets assigned to be the current +descriptor. Explicitly queue up freeing of the 'current_tx' descriptor +to address a memory leak that is otherwise present. + +Fixes: b127315d9a78 ("dmaengine: apple-admac: Add Apple ADMAC driver") +Signed-off-by: Martin Povišer +Link: https://lore.kernel.org/r/20230224152222.26732-2-povik+lin@cutebit.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/dma/apple-admac.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/apple-admac.c b/drivers/dma/apple-admac.c +index b9132b49..4cf8da77 100644 +--- a/drivers/dma/apple-admac.c ++++ b/drivers/dma/apple-admac.c +@@ -512,7 +512,10 @@ static int admac_terminate_all(struct dma_chan *chan) + admac_stop_chan(adchan); + admac_reset_rings(adchan); + +- adchan->current_tx = NULL; ++ if (adchan->current_tx) { ++ list_add_tail(&adchan->current_tx->node, &adchan->to_free); ++ adchan->current_tx = NULL; ++ } + /* + * Descriptors can only be freed after the tasklet + * has been killed (in admac_synchronize). +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-047-9p-xen-Fix-use-after-free-bug-in-xen_9pfs_fron.patch b/patches.kernel.org/6.2.12-047-9p-xen-Fix-use-after-free-bug-in-xen_9pfs_fron.patch new file mode 100644 index 0000000..526a18b --- /dev/null +++ b/patches.kernel.org/6.2.12-047-9p-xen-Fix-use-after-free-bug-in-xen_9pfs_fron.patch @@ -0,0 +1,62 @@ +From: Zheng Wang +Date: Mon, 13 Mar 2023 22:43:25 +0800 +Subject: [PATCH] 9p/xen : Fix use after free bug in xen_9pfs_front_remove due + to race condition +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: ea4f1009408efb4989a0f139b70fb338e7f687d0 + +[ Upstream commit ea4f1009408efb4989a0f139b70fb338e7f687d0 ] + +In xen_9pfs_front_probe, it calls xen_9pfs_front_alloc_dataring +to init priv->rings and bound &ring->work with p9_xen_response. + +When it calls xen_9pfs_front_event_handler to handle IRQ requests, +it will finally call schedule_work to start the work. + +When we call xen_9pfs_front_remove to remove the driver, there +may be a sequence as follows: + +Fix it by finishing the work before cleanup in xen_9pfs_front_free. + +Note that, this bug is found by static analysis, which might be +false positive. + +CPU0 CPU1 + + |p9_xen_response +xen_9pfs_front_remove| + xen_9pfs_front_free| +kfree(priv) | +//free priv | + |p9_tag_lookup + |//use priv->client + +Fixes: 71ebd71921e4 ("xen/9pfs: connect to the backend") +Signed-off-by: Zheng Wang +Reviewed-by: Michal Swiatkowski +Signed-off-by: Eric Van Hensbergen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/9p/trans_xen.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c +index c64050e8..1fffe2be 100644 +--- a/net/9p/trans_xen.c ++++ b/net/9p/trans_xen.c +@@ -280,6 +280,10 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv) + write_unlock(&xen_9pfs_lock); + + for (i = 0; i < priv->num_rings; i++) { ++ struct xen_9pfs_dataring *ring = &priv->rings[i]; ++ ++ cancel_work_sync(&ring->work); ++ + if (!priv->rings[i].intf) + break; + if (priv->rings[i].irq > 0) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-048-bpf-arm64-Fixed-a-BTI-error-on-returning-to-pa.patch b/patches.kernel.org/6.2.12-048-bpf-arm64-Fixed-a-BTI-error-on-returning-to-pa.patch new file mode 100644 index 0000000..34a3f31 --- /dev/null +++ b/patches.kernel.org/6.2.12-048-bpf-arm64-Fixed-a-BTI-error-on-returning-to-pa.patch @@ -0,0 +1,121 @@ +From: Xu Kuohai +Date: Sat, 1 Apr 2023 19:41:44 -0400 +Subject: [PATCH] bpf, arm64: Fixed a BTI error on returning to patched + function +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 738a96c4a8c36950803fdd27e7c30aca92dccefd + +[ Upstream commit 738a96c4a8c36950803fdd27e7c30aca92dccefd ] + +When BPF_TRAMP_F_CALL_ORIG is set, BPF trampoline uses BLR to jump +back to the instruction next to call site to call the patched function. +For BTI-enabled kernel, the instruction next to call site is usually +PACIASP, in this case, it's safe to jump back with BLR. But when +the call site is not followed by a PACIASP or bti, a BTI exception +is triggered. + +Here is a fault log: + + Unhandled 64-bit el1h sync exception on CPU0, ESR 0x0000000034000002 -- BTI + CPU: 0 PID: 263 Comm: test_progs Tainted: GF + Hardware name: linux,dummy-virt (DT) + pstate: 40400805 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=-c) + pc : bpf_fentry_test1+0xc/0x30 + lr : bpf_trampoline_6442573892_0+0x48/0x1000 + sp : ffff80000c0c3a50 + x29: ffff80000c0c3a90 x28: ffff0000c2e6c080 x27: 0000000000000000 + x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000050 + x23: 0000000000000000 x22: 0000ffffcfd2a7f0 x21: 000000000000000a + x20: 0000ffffcfd2a7f0 x19: 0000000000000000 x18: 0000000000000000 + x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffcfd2a7f0 + x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 + x11: 0000000000000000 x10: ffff80000914f5e4 x9 : ffff8000082a1528 + x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0101010101010101 + x5 : 0000000000000000 x4 : 00000000fffffff2 x3 : 0000000000000001 + x2 : ffff8001f4b82000 x1 : 0000000000000000 x0 : 0000000000000001 + Kernel panic - not syncing: Unhandled exception + CPU: 0 PID: 263 Comm: test_progs Tainted: GF + Hardware name: linux,dummy-virt (DT) + Call trace: + dump_backtrace+0xec/0x144 + show_stack+0x24/0x7c + dump_stack_lvl+0x8c/0xb8 + dump_stack+0x18/0x34 + panic+0x1cc/0x3ec + __el0_error_handler_common+0x0/0x130 + el1h_64_sync_handler+0x60/0xd0 + el1h_64_sync+0x78/0x7c + bpf_fentry_test1+0xc/0x30 + bpf_fentry_test1+0xc/0x30 + bpf_prog_test_run_tracing+0xdc/0x2a0 + __sys_bpf+0x438/0x22a0 + __arm64_sys_bpf+0x30/0x54 + invoke_syscall+0x78/0x110 + el0_svc_common.constprop.0+0x6c/0x1d0 + do_el0_svc+0x38/0xe0 + el0_svc+0x30/0xd0 + el0t_64_sync_handler+0x1ac/0x1b0 + el0t_64_sync+0x1a0/0x1a4 + Kernel Offset: disabled + CPU features: 0x0000,00034c24,f994fdab + Memory Limit: none + +And the instruction next to call site of bpf_fentry_test1 is ADD, +not PACIASP: + +: + bti c + nop + nop + add w0, w0, #0x1 + paciasp + +For BPF prog, JIT always puts a PACIASP after call site for BTI-enabled +kernel, so there is no problem. To fix it, replace BLR with RET to bypass +the branch target check. + +Fixes: efc9909fdce0 ("bpf, arm64: Add bpf trampoline for arm64") +Reported-by: Florent Revest +Signed-off-by: Xu Kuohai +Signed-off-by: Daniel Borkmann +Tested-by: Florent Revest +Acked-by: Florent Revest +Link: https://lore.kernel.org/bpf/20230401234144.3719742-1-xukuohai@huaweicloud.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/net/bpf_jit.h | 4 ++++ + arch/arm64/net/bpf_jit_comp.c | 3 ++- + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/net/bpf_jit.h b/arch/arm64/net/bpf_jit.h +index a6acb94e..c2edadb8 100644 +--- a/arch/arm64/net/bpf_jit.h ++++ b/arch/arm64/net/bpf_jit.h +@@ -281,4 +281,8 @@ + /* DMB */ + #define A64_DMB_ISH aarch64_insn_gen_dmb(AARCH64_INSN_MB_ISH) + ++/* ADR */ ++#define A64_ADR(Rd, offset) \ ++ aarch64_insn_gen_adr(0, offset, Rd, AARCH64_INSN_ADR_TYPE_ADR) ++ + #endif /* _BPF_JIT_H */ +diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c +index 62f805f4..b26da8ef 100644 +--- a/arch/arm64/net/bpf_jit_comp.c ++++ b/arch/arm64/net/bpf_jit_comp.c +@@ -1900,7 +1900,8 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im, + restore_args(ctx, args_off, nargs); + /* call original func */ + emit(A64_LDR64I(A64_R(10), A64_SP, retaddr_off), ctx); +- emit(A64_BLR(A64_R(10)), ctx); ++ emit(A64_ADR(A64_LR, AARCH64_INSN_SIZE * 2), ctx); ++ emit(A64_RET(A64_R(10)), ctx); + /* store return value */ + emit(A64_STR64I(A64_R(0), A64_SP, retval_off), ctx); + /* reserve a nop for bpf_tramp_image_put */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-049-KVM-arm64-Advertise-ID_AA64PFR0_EL1.CSV2-3-to-.patch b/patches.kernel.org/6.2.12-049-KVM-arm64-Advertise-ID_AA64PFR0_EL1.CSV2-3-to-.patch new file mode 100644 index 0000000..b37236d --- /dev/null +++ b/patches.kernel.org/6.2.12-049-KVM-arm64-Advertise-ID_AA64PFR0_EL1.CSV2-3-to-.patch @@ -0,0 +1,115 @@ +From: Fuad Tabba +Date: Tue, 4 Apr 2023 16:23:21 +0100 +Subject: [PATCH] KVM: arm64: Advertise ID_AA64PFR0_EL1.CSV2/3 to protected VMs +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: e81625218bf7986ba1351a98c43d346b15601d26 + +[ Upstream commit e81625218bf7986ba1351a98c43d346b15601d26 ] + +The existing pKVM code attempts to advertise CSV2/3 using values +initialized to 0, but never set. To advertise CSV2/3 to protected +guests, pass the CSV2/3 values to hyp when initializing hyp's +view of guests' ID_AA64PFR0_EL1. + +Similar to non-protected KVM, these are system-wide, rather than +per cpu, for simplicity. + +Fixes: 6c30bfb18d0b ("KVM: arm64: Add handlers for protected VM System Registers") +Signed-off-by: Fuad Tabba +Link: https://lore.kernel.org/r/20230404152321.413064-1-tabba@google.com +Signed-off-by: Oliver Upton +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/kvm/arm.c | 26 ++++++++++++++++++- + .../arm64/kvm/hyp/include/nvhe/fixed_config.h | 5 +++- + arch/arm64/kvm/hyp/nvhe/sys_regs.c | 7 ----- + 3 files changed, 29 insertions(+), 9 deletions(-) + +diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c +index 9c5573bc..e57f8ae0 100644 +--- a/arch/arm64/kvm/arm.c ++++ b/arch/arm64/kvm/arm.c +@@ -1877,9 +1877,33 @@ static int do_pkvm_init(u32 hyp_va_bits) + return ret; + } + ++static u64 get_hyp_id_aa64pfr0_el1(void) ++{ ++ /* ++ * Track whether the system isn't affected by spectre/meltdown in the ++ * hypervisor's view of id_aa64pfr0_el1, used for protected VMs. ++ * Although this is per-CPU, we make it global for simplicity, e.g., not ++ * to have to worry about vcpu migration. ++ * ++ * Unlike for non-protected VMs, userspace cannot override this for ++ * protected VMs. ++ */ ++ u64 val = read_sanitised_ftr_reg(SYS_ID_AA64PFR0_EL1); ++ ++ val &= ~(ARM64_FEATURE_MASK(ID_AA64PFR0_EL1_CSV2) | ++ ARM64_FEATURE_MASK(ID_AA64PFR0_EL1_CSV3)); ++ ++ val |= FIELD_PREP(ARM64_FEATURE_MASK(ID_AA64PFR0_EL1_CSV2), ++ arm64_get_spectre_v2_state() == SPECTRE_UNAFFECTED); ++ val |= FIELD_PREP(ARM64_FEATURE_MASK(ID_AA64PFR0_EL1_CSV3), ++ arm64_get_meltdown_state() == SPECTRE_UNAFFECTED); ++ ++ return val; ++} ++ + static void kvm_hyp_init_symbols(void) + { +- kvm_nvhe_sym(id_aa64pfr0_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64PFR0_EL1); ++ kvm_nvhe_sym(id_aa64pfr0_el1_sys_val) = get_hyp_id_aa64pfr0_el1(); + kvm_nvhe_sym(id_aa64pfr1_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64PFR1_EL1); + kvm_nvhe_sym(id_aa64isar0_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64ISAR0_EL1); + kvm_nvhe_sym(id_aa64isar1_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64ISAR1_EL1); +diff --git a/arch/arm64/kvm/hyp/include/nvhe/fixed_config.h b/arch/arm64/kvm/hyp/include/nvhe/fixed_config.h +index 07edfc75..37440e1d 100644 +--- a/arch/arm64/kvm/hyp/include/nvhe/fixed_config.h ++++ b/arch/arm64/kvm/hyp/include/nvhe/fixed_config.h +@@ -33,11 +33,14 @@ + * Allow for protected VMs: + * - Floating-point and Advanced SIMD + * - Data Independent Timing ++ * - Spectre/Meltdown Mitigation + */ + #define PVM_ID_AA64PFR0_ALLOW (\ + ARM64_FEATURE_MASK(ID_AA64PFR0_EL1_FP) | \ + ARM64_FEATURE_MASK(ID_AA64PFR0_EL1_AdvSIMD) | \ +- ARM64_FEATURE_MASK(ID_AA64PFR0_EL1_DIT) \ ++ ARM64_FEATURE_MASK(ID_AA64PFR0_EL1_DIT) | \ ++ ARM64_FEATURE_MASK(ID_AA64PFR0_EL1_CSV2) | \ ++ ARM64_FEATURE_MASK(ID_AA64PFR0_EL1_CSV3) \ + ) + + /* +diff --git a/arch/arm64/kvm/hyp/nvhe/sys_regs.c b/arch/arm64/kvm/hyp/nvhe/sys_regs.c +index 0f9ac25a..3d5121ee 100644 +--- a/arch/arm64/kvm/hyp/nvhe/sys_regs.c ++++ b/arch/arm64/kvm/hyp/nvhe/sys_regs.c +@@ -84,19 +84,12 @@ static u64 get_restricted_features_unsigned(u64 sys_reg_val, + + static u64 get_pvm_id_aa64pfr0(const struct kvm_vcpu *vcpu) + { +- const struct kvm *kvm = (const struct kvm *)kern_hyp_va(vcpu->kvm); + u64 set_mask = 0; + u64 allow_mask = PVM_ID_AA64PFR0_ALLOW; + + set_mask |= get_restricted_features_unsigned(id_aa64pfr0_el1_sys_val, + PVM_ID_AA64PFR0_RESTRICT_UNSIGNED); + +- /* Spectre and Meltdown mitigation in KVM */ +- set_mask |= FIELD_PREP(ARM64_FEATURE_MASK(ID_AA64PFR0_EL1_CSV2), +- (u64)kvm->arch.pfr0_csv2); +- set_mask |= FIELD_PREP(ARM64_FEATURE_MASK(ID_AA64PFR0_EL1_CSV3), +- (u64)kvm->arch.pfr0_csv3); +- + return (id_aa64pfr0_el1_sys_val & allow_mask) | set_mask; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-050-niu-Fix-missing-unwind-goto-in-niu_alloc_chann.patch b/patches.kernel.org/6.2.12-050-niu-Fix-missing-unwind-goto-in-niu_alloc_chann.patch new file mode 100644 index 0000000..a7753a5 --- /dev/null +++ b/patches.kernel.org/6.2.12-050-niu-Fix-missing-unwind-goto-in-niu_alloc_chann.patch @@ -0,0 +1,43 @@ +From: Harshit Mogalapalli +Date: Wed, 5 Apr 2023 23:31:18 -0700 +Subject: [PATCH] niu: Fix missing unwind goto in niu_alloc_channels() +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 8ce07be703456acb00e83d99f3b8036252c33b02 + +[ Upstream commit 8ce07be703456acb00e83d99f3b8036252c33b02 ] + +Smatch reports: drivers/net/ethernet/sun/niu.c:4525 + niu_alloc_channels() warn: missing unwind goto? + +If niu_rbr_fill() fails, then we are directly returning 'err' without +freeing the channels. + +Fix this by changing direct return to a goto 'out_err'. + +Fixes: a3138df9f20e ("[NIU]: Add Sun Neptune ethernet driver.") +Signed-off-by: Harshit Mogalapalli +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/sun/niu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c +index e6144d96..4bbf011d 100644 +--- a/drivers/net/ethernet/sun/niu.c ++++ b/drivers/net/ethernet/sun/niu.c +@@ -4522,7 +4522,7 @@ static int niu_alloc_channels(struct niu *np) + + err = niu_rbr_fill(np, rp, GFP_KERNEL); + if (err) +- return err; ++ goto out_err; + } + + tx_rings = kcalloc(num_tx_rings, sizeof(struct tx_ring_info), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-051-tcp-restrict-net.ipv4.tcp_app_win.patch b/patches.kernel.org/6.2.12-051-tcp-restrict-net.ipv4.tcp_app_win.patch new file mode 100644 index 0000000..b6f3e8d --- /dev/null +++ b/patches.kernel.org/6.2.12-051-tcp-restrict-net.ipv4.tcp_app_win.patch @@ -0,0 +1,75 @@ +From: YueHaibing +Date: Thu, 6 Apr 2023 14:34:50 +0800 +Subject: [PATCH] tcp: restrict net.ipv4.tcp_app_win +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: dc5110c2d959c1707e12df5f792f41d90614adaa + +[ Upstream commit dc5110c2d959c1707e12df5f792f41d90614adaa ] + +UBSAN: shift-out-of-bounds in net/ipv4/tcp_input.c:555:23 +shift exponent 255 is too large for 32-bit type 'int' +CPU: 1 PID: 7907 Comm: ssh Not tainted 6.3.0-rc4-00161-g62bad54b26db-dirty #206 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 +Call Trace: + + dump_stack_lvl+0x136/0x150 + __ubsan_handle_shift_out_of_bounds+0x21f/0x5a0 + tcp_init_transfer.cold+0x3a/0xb9 + tcp_finish_connect+0x1d0/0x620 + tcp_rcv_state_process+0xd78/0x4d60 + tcp_v4_do_rcv+0x33d/0x9d0 + __release_sock+0x133/0x3b0 + release_sock+0x58/0x1b0 + +'maxwin' is int, shifting int for 32 or more bits is undefined behaviour. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: YueHaibing +Reviewed-by: Eric Dumazet +Reviewed-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + Documentation/networking/ip-sysctl.rst | 2 ++ + net/ipv4/sysctl_net_ipv4.c | 3 +++ + 2 files changed, 5 insertions(+) + +diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst +index 7fbd060d..afed4928 100644 +--- a/Documentation/networking/ip-sysctl.rst ++++ b/Documentation/networking/ip-sysctl.rst +@@ -337,6 +337,8 @@ tcp_app_win - INTEGER + Reserve max(window/2^tcp_app_win, mss) of window for application + buffer. Value 0 is special, it means that nothing is reserved. + ++ Possible values are [0, 31], inclusive. ++ + Default: 31 + + tcp_autocorking - BOOLEAN +diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c +index 0d0cc4ef..40fe70fc 100644 +--- a/net/ipv4/sysctl_net_ipv4.c ++++ b/net/ipv4/sysctl_net_ipv4.c +@@ -25,6 +25,7 @@ static int ip_local_port_range_min[] = { 1, 1 }; + static int ip_local_port_range_max[] = { 65535, 65535 }; + static int tcp_adv_win_scale_min = -31; + static int tcp_adv_win_scale_max = 31; ++static int tcp_app_win_max = 31; + static int tcp_min_snd_mss_min = TCP_MIN_SND_MSS; + static int tcp_min_snd_mss_max = 65535; + static int ip_privileged_port_min; +@@ -1198,6 +1199,8 @@ static struct ctl_table ipv4_net_table[] = { + .maxlen = sizeof(u8), + .mode = 0644, + .proc_handler = proc_dou8vec_minmax, ++ .extra1 = SYSCTL_ZERO, ++ .extra2 = &tcp_app_win_max, + }, + { + .procname = "tcp_adv_win_scale", +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-052-bonding-fix-ns-validation-on-backup-slaves.patch b/patches.kernel.org/6.2.12-052-bonding-fix-ns-validation-on-backup-slaves.patch new file mode 100644 index 0000000..eba1dca --- /dev/null +++ b/patches.kernel.org/6.2.12-052-bonding-fix-ns-validation-on-backup-slaves.patch @@ -0,0 +1,89 @@ +From: Hangbin Liu +Date: Thu, 6 Apr 2023 16:23:50 +0800 +Subject: [PATCH] bonding: fix ns validation on backup slaves +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 4598380f9c548aa161eb4e990a1583f0a7d1e0d7 + +[ Upstream commit 4598380f9c548aa161eb4e990a1583f0a7d1e0d7 ] + +When arp_validate is set to 2, 3, or 6, validation is performed for +backup slaves as well. As stated in the bond documentation, validation +involves checking the broadcast ARP request sent out via the active +slave. This helps determine which slaves are more likely to function in +the event of an active slave failure. + +However, when the target is an IPv6 address, the NS message sent from +the active interface is not checked on backup slaves. Additionally, +based on the bond_arp_rcv() rule b, we must reverse the saddr and daddr +when checking the NS message. + +Note that when checking the NS message, the destination address is a +multicast address. Therefore, we must convert the target address to +solicited multicast in the bond_get_targets_ip6() function. + +Prior to the fix, the backup slaves had a mii status of "down", but +after the fix, all of the slaves' mii status was updated to "UP". + +Fixes: 4e24be018eb9 ("bonding: add new parameter ns_targets") +Reviewed-by: Jonathan Toppins +Acked-by: Jay Vosburgh +Signed-off-by: Hangbin Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/bonding/bond_main.c | 5 +++-- + include/net/bonding.h | 8 ++++++-- + 2 files changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 116d295d..415cd95f 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3267,7 +3267,8 @@ static int bond_na_rcv(const struct sk_buff *skb, struct bonding *bond, + + combined = skb_header_pointer(skb, 0, sizeof(_combined), &_combined); + if (!combined || combined->ip6.nexthdr != NEXTHDR_ICMP || +- combined->icmp6.icmp6_type != NDISC_NEIGHBOUR_ADVERTISEMENT) ++ (combined->icmp6.icmp6_type != NDISC_NEIGHBOUR_SOLICITATION && ++ combined->icmp6.icmp6_type != NDISC_NEIGHBOUR_ADVERTISEMENT)) + goto out; + + saddr = &combined->ip6.saddr; +@@ -3289,7 +3290,7 @@ static int bond_na_rcv(const struct sk_buff *skb, struct bonding *bond, + else if (curr_active_slave && + time_after(slave_last_rx(bond, curr_active_slave), + curr_active_slave->last_link_up)) +- bond_validate_na(bond, slave, saddr, daddr); ++ bond_validate_na(bond, slave, daddr, saddr); + else if (curr_arp_slave && + bond_time_in_interval(bond, slave_last_tx(curr_arp_slave), 1)) + bond_validate_na(bond, slave, saddr, daddr); +diff --git a/include/net/bonding.h b/include/net/bonding.h +index ea36ab7f..c3843239 100644 +--- a/include/net/bonding.h ++++ b/include/net/bonding.h +@@ -761,13 +761,17 @@ static inline int bond_get_targets_ip(__be32 *targets, __be32 ip) + #if IS_ENABLED(CONFIG_IPV6) + static inline int bond_get_targets_ip6(struct in6_addr *targets, struct in6_addr *ip) + { ++ struct in6_addr mcaddr; + int i; + +- for (i = 0; i < BOND_MAX_NS_TARGETS; i++) +- if (ipv6_addr_equal(&targets[i], ip)) ++ for (i = 0; i < BOND_MAX_NS_TARGETS; i++) { ++ addrconf_addr_solict_mult(&targets[i], &mcaddr); ++ if ((ipv6_addr_equal(&targets[i], ip)) || ++ (ipv6_addr_equal(&mcaddr, ip))) + return i; + else if (ipv6_addr_any(&targets[i])) + break; ++ } + + return -1; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-053-iavf-refactor-VLAN-filter-states.patch b/patches.kernel.org/6.2.12-053-iavf-refactor-VLAN-filter-states.patch new file mode 100644 index 0000000..3f03b2c --- /dev/null +++ b/patches.kernel.org/6.2.12-053-iavf-refactor-VLAN-filter-states.patch @@ -0,0 +1,211 @@ +From: Ahmed Zaki +Date: Thu, 6 Apr 2023 15:35:27 -0600 +Subject: [PATCH] iavf: refactor VLAN filter states +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 0c0da0e951053fda20412cd284e2714bbbb31bff + +[ Upstream commit 0c0da0e951053fda20412cd284e2714bbbb31bff ] + +The VLAN filter states are currently being saved as individual bits. +This is error prone as multiple bits might be mistakenly set. + +Fix by replacing the bits with a single state enum. Also, add an +"ACTIVE" state for filters that are accepted by the PF. + +Signed-off-by: Ahmed Zaki +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Stable-dep-of: 9c85b7fa12ef ("iavf: remove active_cvlans and active_svlans bitmaps") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/intel/iavf/iavf.h | 15 +++++---- + drivers/net/ethernet/intel/iavf/iavf_main.c | 8 ++--- + .../net/ethernet/intel/iavf/iavf_virtchnl.c | 31 +++++++++---------- + 3 files changed, 28 insertions(+), 26 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h +index 2a9f1eee..fdbb5d9a 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf.h ++++ b/drivers/net/ethernet/intel/iavf/iavf.h +@@ -157,15 +157,18 @@ struct iavf_vlan { + u16 tpid; + }; + ++enum iavf_vlan_state_t { ++ IAVF_VLAN_INVALID, ++ IAVF_VLAN_ADD, /* filter needs to be added */ ++ IAVF_VLAN_IS_NEW, /* filter is new, wait for PF answer */ ++ IAVF_VLAN_ACTIVE, /* filter is accepted by PF */ ++ IAVF_VLAN_REMOVE, /* filter needs to be removed */ ++}; ++ + struct iavf_vlan_filter { + struct list_head list; + struct iavf_vlan vlan; +- struct { +- u8 is_new_vlan:1; /* filter is new, wait for PF answer */ +- u8 remove:1; /* filter needs to be removed */ +- u8 add:1; /* filter needs to be added */ +- u8 padding:5; +- }; ++ enum iavf_vlan_state_t state; + }; + + #define IAVF_MAX_TRAFFIC_CLASS 4 +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 8bbdf66c..3faa9e4d 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -791,7 +791,7 @@ iavf_vlan_filter *iavf_add_vlan(struct iavf_adapter *adapter, + f->vlan = vlan; + + list_add_tail(&f->list, &adapter->vlan_filter_list); +- f->add = true; ++ f->state = IAVF_VLAN_ADD; + adapter->aq_required |= IAVF_FLAG_AQ_ADD_VLAN_FILTER; + } + +@@ -813,7 +813,7 @@ static void iavf_del_vlan(struct iavf_adapter *adapter, struct iavf_vlan vlan) + + f = iavf_find_vlan(adapter, vlan); + if (f) { +- f->remove = true; ++ f->state = IAVF_VLAN_REMOVE; + adapter->aq_required |= IAVF_FLAG_AQ_DEL_VLAN_FILTER; + } + +@@ -1296,11 +1296,11 @@ static void iavf_clear_mac_vlan_filters(struct iavf_adapter *adapter) + /* remove all VLAN filters */ + list_for_each_entry_safe(vlf, vlftmp, &adapter->vlan_filter_list, + list) { +- if (vlf->add) { ++ if (vlf->state == IAVF_VLAN_ADD) { + list_del(&vlf->list); + kfree(vlf); + } else { +- vlf->remove = true; ++ vlf->state = IAVF_VLAN_REMOVE; + } + } + spin_unlock_bh(&adapter->mac_vlan_list_lock); +diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +index 0fea6b9b..fd023983 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +@@ -642,7 +642,7 @@ static void iavf_vlan_add_reject(struct iavf_adapter *adapter) + + spin_lock_bh(&adapter->mac_vlan_list_lock); + list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, list) { +- if (f->is_new_vlan) { ++ if (f->state == IAVF_VLAN_IS_NEW) { + if (f->vlan.tpid == ETH_P_8021Q) + clear_bit(f->vlan.vid, + adapter->vsi.active_cvlans); +@@ -679,7 +679,7 @@ void iavf_add_vlans(struct iavf_adapter *adapter) + spin_lock_bh(&adapter->mac_vlan_list_lock); + + list_for_each_entry(f, &adapter->vlan_filter_list, list) { +- if (f->add) ++ if (f->state == IAVF_VLAN_ADD) + count++; + } + if (!count || !VLAN_FILTERING_ALLOWED(adapter)) { +@@ -710,11 +710,10 @@ void iavf_add_vlans(struct iavf_adapter *adapter) + vvfl->vsi_id = adapter->vsi_res->vsi_id; + vvfl->num_elements = count; + list_for_each_entry(f, &adapter->vlan_filter_list, list) { +- if (f->add) { ++ if (f->state == IAVF_VLAN_ADD) { + vvfl->vlan_id[i] = f->vlan.vid; + i++; +- f->add = false; +- f->is_new_vlan = true; ++ f->state = IAVF_VLAN_IS_NEW; + if (i == count) + break; + } +@@ -760,7 +759,7 @@ void iavf_add_vlans(struct iavf_adapter *adapter) + vvfl_v2->vport_id = adapter->vsi_res->vsi_id; + vvfl_v2->num_elements = count; + list_for_each_entry(f, &adapter->vlan_filter_list, list) { +- if (f->add) { ++ if (f->state == IAVF_VLAN_ADD) { + struct virtchnl_vlan_supported_caps *filtering_support = + &adapter->vlan_v2_caps.filtering.filtering_support; + struct virtchnl_vlan *vlan; +@@ -778,8 +777,7 @@ void iavf_add_vlans(struct iavf_adapter *adapter) + vlan->tpid = f->vlan.tpid; + + i++; +- f->add = false; +- f->is_new_vlan = true; ++ f->state = IAVF_VLAN_IS_NEW; + } + } + +@@ -822,10 +820,11 @@ void iavf_del_vlans(struct iavf_adapter *adapter) + * filters marked for removal to enable bailing out before + * sending a virtchnl message + */ +- if (f->remove && !VLAN_FILTERING_ALLOWED(adapter)) { ++ if (f->state == IAVF_VLAN_REMOVE && ++ !VLAN_FILTERING_ALLOWED(adapter)) { + list_del(&f->list); + kfree(f); +- } else if (f->remove) { ++ } else if (f->state == IAVF_VLAN_REMOVE) { + count++; + } + } +@@ -857,7 +856,7 @@ void iavf_del_vlans(struct iavf_adapter *adapter) + vvfl->vsi_id = adapter->vsi_res->vsi_id; + vvfl->num_elements = count; + list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, list) { +- if (f->remove) { ++ if (f->state == IAVF_VLAN_REMOVE) { + vvfl->vlan_id[i] = f->vlan.vid; + i++; + list_del(&f->list); +@@ -901,7 +900,7 @@ void iavf_del_vlans(struct iavf_adapter *adapter) + vvfl_v2->vport_id = adapter->vsi_res->vsi_id; + vvfl_v2->num_elements = count; + list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, list) { +- if (f->remove) { ++ if (f->state == IAVF_VLAN_REMOVE) { + struct virtchnl_vlan_supported_caps *filtering_support = + &adapter->vlan_v2_caps.filtering.filtering_support; + struct virtchnl_vlan *vlan; +@@ -2192,7 +2191,7 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, + list_for_each_entry(vlf, + &adapter->vlan_filter_list, + list) +- vlf->add = true; ++ vlf->state = IAVF_VLAN_ADD; + + adapter->aq_required |= + IAVF_FLAG_AQ_ADD_VLAN_FILTER; +@@ -2260,7 +2259,7 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, + list_for_each_entry(vlf, + &adapter->vlan_filter_list, + list) +- vlf->add = true; ++ vlf->state = IAVF_VLAN_ADD; + + aq_required |= IAVF_FLAG_AQ_ADD_VLAN_FILTER; + } +@@ -2444,8 +2443,8 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, + + spin_lock_bh(&adapter->mac_vlan_list_lock); + list_for_each_entry(f, &adapter->vlan_filter_list, list) { +- if (f->is_new_vlan) { +- f->is_new_vlan = false; ++ if (f->state == IAVF_VLAN_IS_NEW) { ++ f->state = IAVF_VLAN_ACTIVE; + if (f->vlan.tpid == ETH_P_8021Q) + set_bit(f->vlan.vid, + adapter->vsi.active_cvlans); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-054-iavf-remove-active_cvlans-and-active_svlans-bi.patch b/patches.kernel.org/6.2.12-054-iavf-remove-active_cvlans-and-active_svlans-bi.patch new file mode 100644 index 0000000..8480b36 --- /dev/null +++ b/patches.kernel.org/6.2.12-054-iavf-remove-active_cvlans-and-active_svlans-bi.patch @@ -0,0 +1,276 @@ +From: Ahmed Zaki +Date: Thu, 6 Apr 2023 15:35:28 -0600 +Subject: [PATCH] iavf: remove active_cvlans and active_svlans bitmaps +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 9c85b7fa12ef2e4fc11a4e31ac595fb5f9d0ddf9 + +[ Upstream commit 9c85b7fa12ef2e4fc11a4e31ac595fb5f9d0ddf9 ] + +The VLAN filters info is currently being held in a list and 2 bitmaps +(active_cvlans and active_svlans). We are experiencing some racing where +data is not in sync in the list and bitmaps. For example, the VLAN is +initially added to the list but only when the PF replies, it is added to +the bitmap. If a user adds many V2 VLANS before the PF responds: + + while [ $((i++)) ] + ip l add l eth0 name eth0.$i type vlan id $i + +we might end up with more VLAN list entries than the designated limit. +Also, The "ip link show" will show more links added than the PF limit. + +On the other and, the bitmaps are only used to check the number of VLAN +filters and to re-enable the filters when the interface goes from DOWN to +UP. + +This patch gets rid of the bitmaps and uses the list only. To do that, +the states of the VLAN filter are modified: +1 - IAVF_VLAN_REMOVE: the entry needs to be totally removed after informing + the PF. This is the "ip link del eth0.$i" path. +2 - IAVF_VLAN_DISABLE: (new) the netdev went down. The filter needs to be + removed from the PF and then marked INACTIVE. +3 - IAVF_VLAN_INACTIVE: (new) no PF filter exists, but the user did not + delete the VLAN. + +Fixes: 48ccc43ecf10 ("iavf: Add support VIRTCHNL_VF_OFFLOAD_VLAN_V2 during netdev config") +Signed-off-by: Ahmed Zaki +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/intel/iavf/iavf.h | 7 +-- + drivers/net/ethernet/intel/iavf/iavf_main.c | 40 +++++++---------- + .../net/ethernet/intel/iavf/iavf_virtchnl.c | 45 ++++++++++--------- + 3 files changed, 45 insertions(+), 47 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h +index fdbb5d9a..93a998f1 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf.h ++++ b/drivers/net/ethernet/intel/iavf/iavf.h +@@ -58,8 +58,6 @@ enum iavf_vsi_state_t { + struct iavf_vsi { + struct iavf_adapter *back; + struct net_device *netdev; +- unsigned long active_cvlans[BITS_TO_LONGS(VLAN_N_VID)]; +- unsigned long active_svlans[BITS_TO_LONGS(VLAN_N_VID)]; + u16 seid; + u16 id; + DECLARE_BITMAP(state, __IAVF_VSI_STATE_SIZE__); +@@ -162,7 +160,9 @@ enum iavf_vlan_state_t { + IAVF_VLAN_ADD, /* filter needs to be added */ + IAVF_VLAN_IS_NEW, /* filter is new, wait for PF answer */ + IAVF_VLAN_ACTIVE, /* filter is accepted by PF */ +- IAVF_VLAN_REMOVE, /* filter needs to be removed */ ++ IAVF_VLAN_DISABLE, /* filter needs to be deleted by PF, then marked INACTIVE */ ++ IAVF_VLAN_INACTIVE, /* filter is inactive, we are in IFF_DOWN */ ++ IAVF_VLAN_REMOVE, /* filter needs to be removed from list */ + }; + + struct iavf_vlan_filter { +@@ -260,6 +260,7 @@ struct iavf_adapter { + wait_queue_head_t vc_waitqueue; + struct iavf_q_vector *q_vectors; + struct list_head vlan_filter_list; ++ int num_vlan_filters; + struct list_head mac_filter_list; + struct mutex crit_lock; + struct mutex client_lock; +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 3faa9e4d..05a0ea96 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -792,6 +792,7 @@ iavf_vlan_filter *iavf_add_vlan(struct iavf_adapter *adapter, + + list_add_tail(&f->list, &adapter->vlan_filter_list); + f->state = IAVF_VLAN_ADD; ++ adapter->num_vlan_filters++; + adapter->aq_required |= IAVF_FLAG_AQ_ADD_VLAN_FILTER; + } + +@@ -828,14 +829,18 @@ static void iavf_del_vlan(struct iavf_adapter *adapter, struct iavf_vlan vlan) + **/ + static void iavf_restore_filters(struct iavf_adapter *adapter) + { +- u16 vid; ++ struct iavf_vlan_filter *f; + + /* re-add all VLAN filters */ +- for_each_set_bit(vid, adapter->vsi.active_cvlans, VLAN_N_VID) +- iavf_add_vlan(adapter, IAVF_VLAN(vid, ETH_P_8021Q)); ++ spin_lock_bh(&adapter->mac_vlan_list_lock); + +- for_each_set_bit(vid, adapter->vsi.active_svlans, VLAN_N_VID) +- iavf_add_vlan(adapter, IAVF_VLAN(vid, ETH_P_8021AD)); ++ list_for_each_entry(f, &adapter->vlan_filter_list, list) { ++ if (f->state == IAVF_VLAN_INACTIVE) ++ f->state = IAVF_VLAN_ADD; ++ } ++ ++ spin_unlock_bh(&adapter->mac_vlan_list_lock); ++ adapter->aq_required |= IAVF_FLAG_AQ_ADD_VLAN_FILTER; + } + + /** +@@ -844,8 +849,7 @@ static void iavf_restore_filters(struct iavf_adapter *adapter) + */ + u16 iavf_get_num_vlans_added(struct iavf_adapter *adapter) + { +- return bitmap_weight(adapter->vsi.active_cvlans, VLAN_N_VID) + +- bitmap_weight(adapter->vsi.active_svlans, VLAN_N_VID); ++ return adapter->num_vlan_filters; + } + + /** +@@ -928,11 +932,6 @@ static int iavf_vlan_rx_kill_vid(struct net_device *netdev, + return 0; + + iavf_del_vlan(adapter, IAVF_VLAN(vid, be16_to_cpu(proto))); +- if (proto == cpu_to_be16(ETH_P_8021Q)) +- clear_bit(vid, adapter->vsi.active_cvlans); +- else +- clear_bit(vid, adapter->vsi.active_svlans); +- + return 0; + } + +@@ -1293,16 +1292,11 @@ static void iavf_clear_mac_vlan_filters(struct iavf_adapter *adapter) + } + } + +- /* remove all VLAN filters */ ++ /* disable all VLAN filters */ + list_for_each_entry_safe(vlf, vlftmp, &adapter->vlan_filter_list, +- list) { +- if (vlf->state == IAVF_VLAN_ADD) { +- list_del(&vlf->list); +- kfree(vlf); +- } else { +- vlf->state = IAVF_VLAN_REMOVE; +- } +- } ++ list) ++ vlf->state = IAVF_VLAN_DISABLE; ++ + spin_unlock_bh(&adapter->mac_vlan_list_lock); + } + +@@ -2914,6 +2908,7 @@ static void iavf_disable_vf(struct iavf_adapter *adapter) + list_del(&fv->list); + kfree(fv); + } ++ adapter->num_vlan_filters = 0; + + spin_unlock_bh(&adapter->mac_vlan_list_lock); + +@@ -3131,9 +3126,6 @@ static void iavf_reset_task(struct work_struct *work) + adapter->aq_required |= IAVF_FLAG_AQ_ADD_CLOUD_FILTER; + iavf_misc_irq_enable(adapter); + +- bitmap_clear(adapter->vsi.active_cvlans, 0, VLAN_N_VID); +- bitmap_clear(adapter->vsi.active_svlans, 0, VLAN_N_VID); +- + mod_delayed_work(adapter->wq, &adapter->watchdog_task, 2); + + /* We were running when the reset started, so we need to restore some +diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +index fd023983..07d37402 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +@@ -643,15 +643,9 @@ static void iavf_vlan_add_reject(struct iavf_adapter *adapter) + spin_lock_bh(&adapter->mac_vlan_list_lock); + list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, list) { + if (f->state == IAVF_VLAN_IS_NEW) { +- if (f->vlan.tpid == ETH_P_8021Q) +- clear_bit(f->vlan.vid, +- adapter->vsi.active_cvlans); +- else +- clear_bit(f->vlan.vid, +- adapter->vsi.active_svlans); +- + list_del(&f->list); + kfree(f); ++ adapter->num_vlan_filters--; + } + } + spin_unlock_bh(&adapter->mac_vlan_list_lock); +@@ -824,7 +818,12 @@ void iavf_del_vlans(struct iavf_adapter *adapter) + !VLAN_FILTERING_ALLOWED(adapter)) { + list_del(&f->list); + kfree(f); +- } else if (f->state == IAVF_VLAN_REMOVE) { ++ adapter->num_vlan_filters--; ++ } else if (f->state == IAVF_VLAN_DISABLE && ++ !VLAN_FILTERING_ALLOWED(adapter)) { ++ f->state = IAVF_VLAN_INACTIVE; ++ } else if (f->state == IAVF_VLAN_REMOVE || ++ f->state == IAVF_VLAN_DISABLE) { + count++; + } + } +@@ -856,11 +855,18 @@ void iavf_del_vlans(struct iavf_adapter *adapter) + vvfl->vsi_id = adapter->vsi_res->vsi_id; + vvfl->num_elements = count; + list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, list) { +- if (f->state == IAVF_VLAN_REMOVE) { ++ if (f->state == IAVF_VLAN_DISABLE) { + vvfl->vlan_id[i] = f->vlan.vid; ++ f->state = IAVF_VLAN_INACTIVE; + i++; ++ if (i == count) ++ break; ++ } else if (f->state == IAVF_VLAN_REMOVE) { ++ vvfl->vlan_id[i] = f->vlan.vid; + list_del(&f->list); + kfree(f); ++ adapter->num_vlan_filters--; ++ i++; + if (i == count) + break; + } +@@ -900,7 +906,8 @@ void iavf_del_vlans(struct iavf_adapter *adapter) + vvfl_v2->vport_id = adapter->vsi_res->vsi_id; + vvfl_v2->num_elements = count; + list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, list) { +- if (f->state == IAVF_VLAN_REMOVE) { ++ if (f->state == IAVF_VLAN_DISABLE || ++ f->state == IAVF_VLAN_REMOVE) { + struct virtchnl_vlan_supported_caps *filtering_support = + &adapter->vlan_v2_caps.filtering.filtering_support; + struct virtchnl_vlan *vlan; +@@ -914,8 +921,13 @@ void iavf_del_vlans(struct iavf_adapter *adapter) + vlan->tci = f->vlan.vid; + vlan->tpid = f->vlan.tpid; + +- list_del(&f->list); +- kfree(f); ++ if (f->state == IAVF_VLAN_DISABLE) { ++ f->state = IAVF_VLAN_INACTIVE; ++ } else { ++ list_del(&f->list); ++ kfree(f); ++ adapter->num_vlan_filters--; ++ } + i++; + if (i == count) + break; +@@ -2443,15 +2455,8 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, + + spin_lock_bh(&adapter->mac_vlan_list_lock); + list_for_each_entry(f, &adapter->vlan_filter_list, list) { +- if (f->state == IAVF_VLAN_IS_NEW) { ++ if (f->state == IAVF_VLAN_IS_NEW) + f->state = IAVF_VLAN_ACTIVE; +- if (f->vlan.tpid == ETH_P_8021Q) +- set_bit(f->vlan.vid, +- adapter->vsi.active_cvlans); +- else +- set_bit(f->vlan.vid, +- adapter->vsi.active_svlans); +- } + } + spin_unlock_bh(&adapter->mac_vlan_list_lock); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-055-net-openvswitch-fix-race-on-port-output.patch b/patches.kernel.org/6.2.12-055-net-openvswitch-fix-race-on-port-output.patch new file mode 100644 index 0000000..b9cae5e --- /dev/null +++ b/patches.kernel.org/6.2.12-055-net-openvswitch-fix-race-on-port-output.patch @@ -0,0 +1,241 @@ +From: Felix Huettner +Date: Wed, 5 Apr 2023 07:53:41 +0000 +Subject: [PATCH] net: openvswitch: fix race on port output +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 066b86787fa3d97b7aefb5ac0a99a22dad2d15f8 + +[ Upstream commit 066b86787fa3d97b7aefb5ac0a99a22dad2d15f8 ] + +assume the following setup on a single machine: +1. An openvswitch instance with one bridge and default flows +2. two network namespaces "server" and "client" +3. two ovs interfaces "server" and "client" on the bridge +4. for each ovs interface a veth pair with a matching name and 32 rx and + tx queues +5. move the ends of the veth pairs to the respective network namespaces +6. assign ip addresses to each of the veth ends in the namespaces (needs + to be the same subnet) +7. start some http server on the server network namespace +8. test if a client in the client namespace can reach the http server + +when following the actions below the host has a chance of getting a cpu +stuck in a infinite loop: +1. send a large amount of parallel requests to the http server (around + 3000 curls should work) +2. in parallel delete the network namespace (do not delete interfaces or + stop the server, just kill the namespace) + +there is a low chance that this will cause the below kernel cpu stuck +message. If this does not happen just retry. +Below there is also the output of bpftrace for the functions mentioned +in the output. + +The series of events happening here is: +1. the network namespace is deleted calling + `unregister_netdevice_many_notify` somewhere in the process +2. this sets first `NETREG_UNREGISTERING` on both ends of the veth and + then runs `synchronize_net` +3. it then calls `call_netdevice_notifiers` with `NETDEV_UNREGISTER` +4. this is then handled by `dp_device_event` which calls + `ovs_netdev_detach_dev` (if a vport is found, which is the case for + the veth interface attached to ovs) +5. this removes the rx_handlers of the device but does not prevent + packages to be sent to the device +6. `dp_device_event` then queues the vport deletion to work in + background as a ovs_lock is needed that we do not hold in the + unregistration path +7. `unregister_netdevice_many_notify` continues to call + `netdev_unregister_kobject` which sets `real_num_tx_queues` to 0 +8. port deletion continues (but details are not relevant for this issue) +9. at some future point the background task deletes the vport + +If after 7. but before 9. a packet is send to the ovs vport (which is +not deleted at this point in time) which forwards it to the +`dev_queue_xmit` flow even though the device is unregistering. +In `skb_tx_hash` (which is called in the `dev_queue_xmit`) path there is +a while loop (if the packet has a rx_queue recorded) that is infinite if +`dev->real_num_tx_queues` is zero. + +To prevent this from happening we update `do_output` to handle devices +without carrier the same as if the device is not found (which would +be the code path after 9. is done). + +Additionally we now produce a warning in `skb_tx_hash` if we will hit +the infinite loop. + +bpftrace (first word is function name): + +__dev_queue_xmit server: real_num_tx_queues: 1, cpu: 2, pid: 28024, tid: 28024, skb_addr: 0xffff9edb6f207000, reg_state: 1 +netdev_core_pick_tx server: addr: 0xffff9f0a46d4a000 real_num_tx_queues: 1, cpu: 2, pid: 28024, tid: 28024, skb_addr: 0xffff9edb6f207000, reg_state: 1 +dp_device_event server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, event 2, reg_state: 1 +synchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024 +synchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024 +synchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024 +synchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024 +dp_device_event server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, event 6, reg_state: 2 +ovs_netdev_detach_dev server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, reg_state: 2 +netdev_rx_handler_unregister server: real_num_tx_queues: 1, cpu: 9, pid: 21024, tid: 21024, reg_state: 2 +synchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024 +netdev_rx_handler_unregister ret server: real_num_tx_queues: 1, cpu: 9, pid: 21024, tid: 21024, reg_state: 2 +dp_device_event server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, event 27, reg_state: 2 +dp_device_event server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, event 22, reg_state: 2 +dp_device_event server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, event 18, reg_state: 2 +netdev_unregister_kobject: real_num_tx_queues: 1, cpu: 9, pid: 21024, tid: 21024 +synchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024 +ovs_vport_send server: real_num_tx_queues: 0, cpu: 2, pid: 28024, tid: 28024, skb_addr: 0xffff9edb6f207000, reg_state: 2 +__dev_queue_xmit server: real_num_tx_queues: 0, cpu: 2, pid: 28024, tid: 28024, skb_addr: 0xffff9edb6f207000, reg_state: 2 +netdev_core_pick_tx server: addr: 0xffff9f0a46d4a000 real_num_tx_queues: 0, cpu: 2, pid: 28024, tid: 28024, skb_addr: 0xffff9edb6f207000, reg_state: 2 +broken device server: real_num_tx_queues: 0, cpu: 2, pid: 28024, tid: 28024 +ovs_dp_detach_port server: real_num_tx_queues: 0 cpu 9, pid: 9124, tid: 9124, reg_state: 2 +synchronize_rcu_expedited: cpu 9, pid: 33604, tid: 33604 + +stuck message: + +watchdog: BUG: soft lockup - CPU#5 stuck for 26s! [curl:1929279] +Modules linked in: veth pktgen bridge stp llc ip_set_hash_net nft_counter xt_set nft_compat nf_tables ip_set_hash_ip ip_set nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 tls binfmt_misc nls_iso8859_1 input_leds joydev serio_raw dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua sch_fq_codel drm efi_pstore virtio_rng ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear hid_generic usbhid hid crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel virtio_net ahci net_failover crypto_simd cryptd psmouse libahci virtio_blk failover +CPU: 5 PID: 1929279 Comm: curl Not tainted 5.15.0-67-generic #74-Ubuntu +Hardware name: OpenStack Foundation OpenStack Nova, BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 +RIP: 0010:netdev_pick_tx+0xf1/0x320 +Code: 00 00 8d 48 ff 0f b7 c1 66 39 ca 0f 86 e9 01 00 00 45 0f b7 ff 41 39 c7 0f 87 5b 01 00 00 44 29 f8 41 39 c7 0f 87 4f 01 00 00 f2 0f 1f 44 00 00 49 8b 94 24 28 04 00 00 48 85 d2 0f 84 53 01 +RSP: 0018:ffffb78b40298820 EFLAGS: 00000246 +RAX: 0000000000000000 RBX: ffff9c8773adc2e0 RCX: 000000000000083f +RDX: 0000000000000000 RSI: ffff9c8773adc2e0 RDI: ffff9c870a25e000 +RBP: ffffb78b40298858 R08: 0000000000000001 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000000 R12: ffff9c870a25e000 +R13: ffff9c870a25e000 R14: ffff9c87fe043480 R15: 0000000000000000 +FS: 00007f7b80008f00(0000) GS:ffff9c8e5f740000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f7b80f6a0b0 CR3: 0000000329d66000 CR4: 0000000000350ee0 +Call Trace: + + netdev_core_pick_tx+0xa4/0xb0 + __dev_queue_xmit+0xf8/0x510 + ? __bpf_prog_exit+0x1e/0x30 + dev_queue_xmit+0x10/0x20 + ovs_vport_send+0xad/0x170 [openvswitch] + do_output+0x59/0x180 [openvswitch] + do_execute_actions+0xa80/0xaa0 [openvswitch] + ? kfree+0x1/0x250 + ? kfree+0x1/0x250 + ? kprobe_perf_func+0x4f/0x2b0 + ? flow_lookup.constprop.0+0x5c/0x110 [openvswitch] + ovs_execute_actions+0x4c/0x120 [openvswitch] + ovs_dp_process_packet+0xa1/0x200 [openvswitch] + ? ovs_ct_update_key.isra.0+0xa8/0x120 [openvswitch] + ? ovs_ct_fill_key+0x1d/0x30 [openvswitch] + ? ovs_flow_key_extract+0x2db/0x350 [openvswitch] + ovs_vport_receive+0x77/0xd0 [openvswitch] + ? __htab_map_lookup_elem+0x4e/0x60 + ? bpf_prog_680e8aff8547aec1_kfree+0x3b/0x714 + ? trace_call_bpf+0xc8/0x150 + ? kfree+0x1/0x250 + ? kfree+0x1/0x250 + ? kprobe_perf_func+0x4f/0x2b0 + ? kprobe_perf_func+0x4f/0x2b0 + ? __mod_memcg_lruvec_state+0x63/0xe0 + netdev_port_receive+0xc4/0x180 [openvswitch] + ? netdev_port_receive+0x180/0x180 [openvswitch] + netdev_frame_hook+0x1f/0x40 [openvswitch] + __netif_receive_skb_core.constprop.0+0x23d/0xf00 + __netif_receive_skb_one_core+0x3f/0xa0 + __netif_receive_skb+0x15/0x60 + process_backlog+0x9e/0x170 + __napi_poll+0x33/0x180 + net_rx_action+0x126/0x280 + ? ttwu_do_activate+0x72/0xf0 + __do_softirq+0xd9/0x2e7 + ? rcu_report_exp_cpu_mult+0x1b0/0x1b0 + do_softirq+0x7d/0xb0 + + + __local_bh_enable_ip+0x54/0x60 + ip_finish_output2+0x191/0x460 + __ip_finish_output+0xb7/0x180 + ip_finish_output+0x2e/0xc0 + ip_output+0x78/0x100 + ? __ip_finish_output+0x180/0x180 + ip_local_out+0x5e/0x70 + __ip_queue_xmit+0x184/0x440 + ? tcp_syn_options+0x1f9/0x300 + ip_queue_xmit+0x15/0x20 + __tcp_transmit_skb+0x910/0x9c0 + ? __mod_memcg_state+0x44/0xa0 + tcp_connect+0x437/0x4e0 + ? ktime_get_with_offset+0x60/0xf0 + tcp_v4_connect+0x436/0x530 + __inet_stream_connect+0xd4/0x3a0 + ? kprobe_perf_func+0x4f/0x2b0 + ? aa_sk_perm+0x43/0x1c0 + inet_stream_connect+0x3b/0x60 + __sys_connect_file+0x63/0x70 + __sys_connect+0xa6/0xd0 + ? setfl+0x108/0x170 + ? do_fcntl+0xe8/0x5a0 + __x64_sys_connect+0x18/0x20 + do_syscall_64+0x5c/0xc0 + ? __x64_sys_fcntl+0xa9/0xd0 + ? exit_to_user_mode_prepare+0x37/0xb0 + ? syscall_exit_to_user_mode+0x27/0x50 + ? do_syscall_64+0x69/0xc0 + ? __sys_setsockopt+0xea/0x1e0 + ? exit_to_user_mode_prepare+0x37/0xb0 + ? syscall_exit_to_user_mode+0x27/0x50 + ? __x64_sys_setsockopt+0x1f/0x30 + ? do_syscall_64+0x69/0xc0 + ? irqentry_exit+0x1d/0x30 + ? exc_page_fault+0x89/0x170 + entry_SYSCALL_64_after_hwframe+0x61/0xcb +RIP: 0033:0x7f7b8101c6a7 +Code: 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2a 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 18 89 54 24 0c 48 89 34 24 89 +RSP: 002b:00007ffffd6b2198 EFLAGS: 00000246 ORIG_RAX: 000000000000002a +RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7b8101c6a7 +RDX: 0000000000000010 RSI: 00007ffffd6b2360 RDI: 0000000000000005 +RBP: 0000561f1370d560 R08: 00002795ad21d1ac R09: 0030312e302e302e +R10: 00007ffffd73f080 R11: 0000000000000246 R12: 0000561f1370c410 +R13: 0000000000000000 R14: 0000000000000005 R15: 0000000000000000 + + +Fixes: 7f8a436eaa2c ("openvswitch: Add conntrack action") +Co-developed-by: Luca Czesla +Signed-off-by: Luca Czesla +Signed-off-by: Felix Huettner +Reviewed-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/ZC0pBXBAgh7c76CA@kernel-bug-kernel-bug +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/core/dev.c | 1 + + net/openvswitch/actions.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/core/dev.c b/net/core/dev.c +index fce980d5..12781527 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -3196,6 +3196,7 @@ static u16 skb_tx_hash(const struct net_device *dev, + } + + if (skb_rx_queue_recorded(skb)) { ++ DEBUG_NET_WARN_ON_ONCE(qcount == 0); + hash = skb_get_rx_queue(skb); + if (hash >= qoffset) + hash -= qoffset; +diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c +index ca3ebfdb..a8cf9a88 100644 +--- a/net/openvswitch/actions.c ++++ b/net/openvswitch/actions.c +@@ -913,7 +913,7 @@ static void do_output(struct datapath *dp, struct sk_buff *skb, int out_port, + { + struct vport *vport = ovs_vport_rcu(dp, out_port); + +- if (likely(vport)) { ++ if (likely(vport && netif_carrier_ok(vport->dev))) { + u16 mru = OVS_CB(skb)->mru; + u32 cutlen = OVS_CB(skb)->cutlen; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-056-Bluetooth-hci_conn-Fix-not-cleaning-up-on-LE-C.patch b/patches.kernel.org/6.2.12-056-Bluetooth-hci_conn-Fix-not-cleaning-up-on-LE-C.patch new file mode 100644 index 0000000..128538b --- /dev/null +++ b/patches.kernel.org/6.2.12-056-Bluetooth-hci_conn-Fix-not-cleaning-up-on-LE-C.patch @@ -0,0 +1,120 @@ +From: Luiz Augusto von Dentz +Date: Fri, 24 Mar 2023 10:57:55 -0700 +Subject: [PATCH] Bluetooth: hci_conn: Fix not cleaning up on LE Connection + failure +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 19cf60bf63cbaf5262eac400c707966e19999b83 + +[ Upstream commit 19cf60bf63cbaf5262eac400c707966e19999b83 ] + +hci_connect_le_scan_cleanup shall always be invoked to cleanup the +states and re-enable passive scanning if necessary, otherwise it may +cause the pending action to stay active causing multiple attempts to +connect. + +Fixes: 9b3628d79b46 ("Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/bluetooth/hci_conn.c | 52 +++++++++++++++++++--------------------- + 1 file changed, 24 insertions(+), 28 deletions(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 17baea2b..6fbc1fe7 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -68,7 +68,7 @@ static const struct sco_param esco_param_msbc[] = { + }; + + /* This function requires the caller holds hdev->lock */ +-static void hci_connect_le_scan_cleanup(struct hci_conn *conn) ++static void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status) + { + struct hci_conn_params *params; + struct hci_dev *hdev = conn->hdev; +@@ -88,9 +88,28 @@ static void hci_connect_le_scan_cleanup(struct hci_conn *conn) + + params = hci_pend_le_action_lookup(&hdev->pend_le_conns, bdaddr, + bdaddr_type); +- if (!params || !params->explicit_connect) ++ if (!params) + return; + ++ if (params->conn) { ++ hci_conn_drop(params->conn); ++ hci_conn_put(params->conn); ++ params->conn = NULL; ++ } ++ ++ if (!params->explicit_connect) ++ return; ++ ++ /* If the status indicates successful cancellation of ++ * the attempt (i.e. Unknown Connection Id) there's no point of ++ * notifying failure since we'll go back to keep trying to ++ * connect. The only exception is explicit connect requests ++ * where a timeout + cancel does indicate an actual failure. ++ */ ++ if (status && status != HCI_ERROR_UNKNOWN_CONN_ID) ++ mgmt_connect_failed(hdev, &conn->dst, conn->type, ++ conn->dst_type, status); ++ + /* The connection attempt was doing scan for new RPA, and is + * in scan phase. If params are not associated with any other + * autoconnect action, remove them completely. If they are, just unmark +@@ -178,7 +197,7 @@ static void le_scan_cleanup(struct work_struct *work) + rcu_read_unlock(); + + if (c == conn) { +- hci_connect_le_scan_cleanup(conn); ++ hci_connect_le_scan_cleanup(conn, 0x00); + hci_conn_cleanup(conn); + } + +@@ -1191,31 +1210,8 @@ EXPORT_SYMBOL(hci_get_route); + static void hci_le_conn_failed(struct hci_conn *conn, u8 status) + { + struct hci_dev *hdev = conn->hdev; +- struct hci_conn_params *params; + +- params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst, +- conn->dst_type); +- if (params && params->conn) { +- hci_conn_drop(params->conn); +- hci_conn_put(params->conn); +- params->conn = NULL; +- } +- +- /* If the status indicates successful cancellation of +- * the attempt (i.e. Unknown Connection Id) there's no point of +- * notifying failure since we'll go back to keep trying to +- * connect. The only exception is explicit connect requests +- * where a timeout + cancel does indicate an actual failure. +- */ +- if (status != HCI_ERROR_UNKNOWN_CONN_ID || +- (params && params->explicit_connect)) +- mgmt_connect_failed(hdev, &conn->dst, conn->type, +- conn->dst_type, status); +- +- /* Since we may have temporarily stopped the background scanning in +- * favor of connection establishment, we should restart it. +- */ +- hci_update_passive_scan(hdev); ++ hci_connect_le_scan_cleanup(conn, status); + + /* Enable advertising in case this was a failed connection + * attempt as a peripheral. +@@ -1252,7 +1248,7 @@ static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err) + hci_dev_lock(hdev); + + if (!err) { +- hci_connect_le_scan_cleanup(conn); ++ hci_connect_le_scan_cleanup(conn, 0x00); + goto done; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-057-Bluetooth-Fix-printing-errors-if-LE-Connection.patch b/patches.kernel.org/6.2.12-057-Bluetooth-Fix-printing-errors-if-LE-Connection.patch new file mode 100644 index 0000000..cd7310b --- /dev/null +++ b/patches.kernel.org/6.2.12-057-Bluetooth-Fix-printing-errors-if-LE-Connection.patch @@ -0,0 +1,150 @@ +From: Luiz Augusto von Dentz +Date: Fri, 24 Mar 2023 13:18:20 -0700 +Subject: [PATCH] Bluetooth: Fix printing errors if LE Connection times out +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: b62e72200eaad523f08d8319bba50fc652e032a8 + +[ Upstream commit b62e72200eaad523f08d8319bba50fc652e032a8 ] + +This fixes errors like bellow when LE Connection times out since that +is actually not a controller error: + + Bluetooth: hci0: Opcode 0x200d failed: -110 + Bluetooth: hci0: request failed to create LE connection: err -110 + +Instead the code shall properly detect if -ETIMEDOUT is returned and +send HCI_OP_LE_CREATE_CONN_CANCEL to give up on the connection. + +Link: https://github.com/bluez/bluez/issues/340 +Fixes: 8e8b92ee60de ("Bluetooth: hci_sync: Add hci_le_create_conn_sync") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + include/net/bluetooth/hci_core.h | 1 + + net/bluetooth/hci_conn.c | 7 +++++-- + net/bluetooth/hci_event.c | 16 ++++++---------- + net/bluetooth/hci_sync.c | 13 ++++++++++--- + 4 files changed, 22 insertions(+), 15 deletions(-) + +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index 7254edfb..ffb89b98 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -954,6 +954,7 @@ enum { + HCI_CONN_STK_ENCRYPT, + HCI_CONN_AUTH_INITIATOR, + HCI_CONN_DROP, ++ HCI_CONN_CANCEL, + HCI_CONN_PARAM_REMOVAL_PEND, + HCI_CONN_NEW_LINK_KEY, + HCI_CONN_SCANNING, +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 6fbc1fe7..bd38e36e 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -1245,6 +1245,8 @@ static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err) + { + struct hci_conn *conn = data; + ++ bt_dev_dbg(hdev, "err %d", err); ++ + hci_dev_lock(hdev); + + if (!err) { +@@ -1252,8 +1254,6 @@ static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err) + goto done; + } + +- bt_dev_err(hdev, "request failed to create LE connection: err %d", err); +- + /* Check if connection is still pending */ + if (conn != hci_lookup_le_connect(hdev)) + goto done; +@@ -2787,6 +2787,9 @@ int hci_abort_conn(struct hci_conn *conn, u8 reason) + { + int r = 0; + ++ if (test_and_set_bit(HCI_CONN_CANCEL, &conn->flags)) ++ return 0; ++ + switch (conn->state) { + case BT_CONNECTED: + case BT_CONFIG: +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index ad92a4be..e68f2a7d 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -2881,16 +2881,6 @@ static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr, + + conn->resp_addr_type = peer_addr_type; + bacpy(&conn->resp_addr, peer_addr); +- +- /* We don't want the connection attempt to stick around +- * indefinitely since LE doesn't have a page timeout concept +- * like BR/EDR. Set a timer for any connection that doesn't use +- * the accept list for connecting. +- */ +- if (filter_policy == HCI_LE_USE_PEER_ADDR) +- queue_delayed_work(conn->hdev->workqueue, +- &conn->le_conn_timeout, +- conn->conn_timeout); + } + + static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status) +@@ -5902,6 +5892,12 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, + if (status) + goto unlock; + ++ /* Drop the connection if it has been aborted */ ++ if (test_bit(HCI_CONN_CANCEL, &conn->flags)) { ++ hci_conn_drop(conn); ++ goto unlock; ++ } ++ + if (conn->dst_type == ADDR_LE_DEV_PUBLIC) + addr_type = BDADDR_LE_PUBLIC; + else +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 5a6aa162..632be126 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -246,8 +246,9 @@ int __hci_cmd_sync_status_sk(struct hci_dev *hdev, u16 opcode, u32 plen, + + skb = __hci_cmd_sync_sk(hdev, opcode, plen, param, event, timeout, sk); + if (IS_ERR(skb)) { +- bt_dev_err(hdev, "Opcode 0x%4x failed: %ld", opcode, +- PTR_ERR(skb)); ++ if (!event) ++ bt_dev_err(hdev, "Opcode 0x%4x failed: %ld", opcode, ++ PTR_ERR(skb)); + return PTR_ERR(skb); + } + +@@ -5126,8 +5127,11 @@ static int hci_le_connect_cancel_sync(struct hci_dev *hdev, + if (test_bit(HCI_CONN_SCANNING, &conn->flags)) + return 0; + ++ if (test_and_set_bit(HCI_CONN_CANCEL, &conn->flags)) ++ return 0; ++ + return __hci_cmd_sync_status(hdev, HCI_OP_LE_CREATE_CONN_CANCEL, +- 6, &conn->dst, HCI_CMD_TIMEOUT); ++ 0, NULL, HCI_CMD_TIMEOUT); + } + + static int hci_connect_cancel_sync(struct hci_dev *hdev, struct hci_conn *conn) +@@ -6102,6 +6106,9 @@ int hci_le_create_conn_sync(struct hci_dev *hdev, struct hci_conn *conn) + conn->conn_timeout, NULL); + + done: ++ if (err == -ETIMEDOUT) ++ hci_le_connect_cancel_sync(hdev, conn); ++ + /* Re-enable advertising after the connection attempt is finished. */ + hci_resume_advertising_sync(hdev); + return err; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-058-Bluetooth-SCO-Fix-possible-circular-locking-de.patch b/patches.kernel.org/6.2.12-058-Bluetooth-SCO-Fix-possible-circular-locking-de.patch new file mode 100644 index 0000000..cc085fc --- /dev/null +++ b/patches.kernel.org/6.2.12-058-Bluetooth-SCO-Fix-possible-circular-locking-de.patch @@ -0,0 +1,139 @@ +From: Luiz Augusto von Dentz +Date: Thu, 30 Mar 2023 14:45:03 -0700 +Subject: [PATCH] Bluetooth: SCO: Fix possible circular locking dependency + sco_sock_getsockopt +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 975abc0c90fc485ff9b4a6afa475c3b1398d5d47 + +[ Upstream commit 975abc0c90fc485ff9b4a6afa475c3b1398d5d47 ] + +This attempts to fix the following trace: + +====================================================== +WARNING: possible circular locking dependency detected +6.3.0-rc2-g68fcb3a7bf97 #4706 Not tainted +------------------------------------------------------ +sco-tester/31 is trying to acquire lock: +ffff8880025b8070 (&hdev->lock){+.+.}-{3:3}, at: +sco_sock_getsockopt+0x1fc/0xa90 + +but task is already holding lock: +ffff888001eeb130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: +sco_sock_getsockopt+0x104/0xa90 + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #2 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}: + lock_sock_nested+0x32/0x80 + sco_connect_cfm+0x118/0x4a0 + hci_sync_conn_complete_evt+0x1e6/0x3d0 + hci_event_packet+0x55c/0x7c0 + hci_rx_work+0x34c/0xa00 + process_one_work+0x575/0x910 + worker_thread+0x89/0x6f0 + kthread+0x14e/0x180 + ret_from_fork+0x2b/0x50 + +-> #1 (hci_cb_list_lock){+.+.}-{3:3}: + __mutex_lock+0x13b/0xcc0 + hci_sync_conn_complete_evt+0x1ad/0x3d0 + hci_event_packet+0x55c/0x7c0 + hci_rx_work+0x34c/0xa00 + process_one_work+0x575/0x910 + worker_thread+0x89/0x6f0 + kthread+0x14e/0x180 + ret_from_fork+0x2b/0x50 + +-> #0 (&hdev->lock){+.+.}-{3:3}: + __lock_acquire+0x18cc/0x3740 + lock_acquire+0x151/0x3a0 + __mutex_lock+0x13b/0xcc0 + sco_sock_getsockopt+0x1fc/0xa90 + __sys_getsockopt+0xe9/0x190 + __x64_sys_getsockopt+0x5b/0x70 + do_syscall_64+0x42/0x90 + entry_SYSCALL_64_after_hwframe+0x70/0xda + +other info that might help us debug this: + +Chain exists of: + &hdev->lock --> hci_cb_list_lock --> sk_lock-AF_BLUETOOTH-BTPROTO_SCO + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO); + lock(hci_cb_list_lock); + lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO); + lock(&hdev->lock); + + *** DEADLOCK *** + +1 lock held by sco-tester/31: + #0: ffff888001eeb130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, + at: sco_sock_getsockopt+0x104/0xa90 + +Fixes: 248733e87d50 ("Bluetooth: Allow querying of supported offload codecs over SCO socket") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/bluetooth/sco.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c +index 1111da4e..1755f91a 100644 +--- a/net/bluetooth/sco.c ++++ b/net/bluetooth/sco.c +@@ -1129,6 +1129,8 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname, + break; + } + ++ release_sock(sk); ++ + /* find total buffer size required to copy codec + caps */ + hci_dev_lock(hdev); + list_for_each_entry(c, &hdev->local_codecs, list) { +@@ -1146,15 +1148,13 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname, + buf_len += sizeof(struct bt_codecs); + if (buf_len > len) { + hci_dev_put(hdev); +- err = -ENOBUFS; +- break; ++ return -ENOBUFS; + } + ptr = optval; + + if (put_user(num_codecs, ptr)) { + hci_dev_put(hdev); +- err = -EFAULT; +- break; ++ return -EFAULT; + } + ptr += sizeof(num_codecs); + +@@ -1194,12 +1194,14 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname, + ptr += len; + } + +- if (!err && put_user(buf_len, optlen)) +- err = -EFAULT; +- + hci_dev_unlock(hdev); + hci_dev_put(hdev); + ++ lock_sock(sk); ++ ++ if (!err && put_user(buf_len, optlen)) ++ err = -EFAULT; ++ + break; + + default: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-059-Bluetooth-Set-ISO-Data-Path-on-broadcast-sink.patch b/patches.kernel.org/6.2.12-059-Bluetooth-Set-ISO-Data-Path-on-broadcast-sink.patch new file mode 100644 index 0000000..4874987 --- /dev/null +++ b/patches.kernel.org/6.2.12-059-Bluetooth-Set-ISO-Data-Path-on-broadcast-sink.patch @@ -0,0 +1,36 @@ +From: Claudia Draghicescu +Date: Wed, 5 Apr 2023 14:19:18 +0300 +Subject: [PATCH] Bluetooth: Set ISO Data Path on broadcast sink +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: d2e4f1b1cba8742db66aaf77374cab7c0c7c8656 + +[ Upstream commit d2e4f1b1cba8742db66aaf77374cab7c0c7c8656 ] + +This patch enables ISO data rx on broadcast sink. + +Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections") +Signed-off-by: Claudia Draghicescu +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/bluetooth/hci_event.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index e68f2a7d..e87c928c 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -6991,7 +6991,7 @@ static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data, + bis->iso_qos.in.latency = le16_to_cpu(ev->interval) * 125 / 100; + bis->iso_qos.in.sdu = le16_to_cpu(ev->max_pdu); + +- hci_connect_cfm(bis, ev->status); ++ hci_iso_setup_path(bis); + } + + hci_dev_unlock(hdev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-060-drm-nouveau-fb-add-missing-sysmen-flush-callba.patch b/patches.kernel.org/6.2.12-060-drm-nouveau-fb-add-missing-sysmen-flush-callba.patch new file mode 100644 index 0000000..d52e882 --- /dev/null +++ b/patches.kernel.org/6.2.12-060-drm-nouveau-fb-add-missing-sysmen-flush-callba.patch @@ -0,0 +1,75 @@ +From: Karol Herbst +Date: Wed, 5 Apr 2023 13:04:55 +0200 +Subject: [PATCH] drm/nouveau/fb: add missing sysmen flush callbacks +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 86d8740dae5a397d8344ae75f8758103c1fcba97 + +[ Upstream commit 86d8740dae5a397d8344ae75f8758103c1fcba97 ] + +Closes: https://gitlab.freedesktop.org/drm/nouveau/-/issues/203 +Fixes: 5728d064190e1 ("drm/nouveau/fb: handle sysmem flush page from common code") +Signed-off-by: Karol Herbst +Reviewed-by: Lyude Paul +Reviewed-by: Ben Skeggs +Link: https://patchwork.freedesktop.org/patch/msgid/20230405110455.1368428-1-kherbst@redhat.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/nouveau/nvkm/subdev/fb/gf108.c | 1 + + drivers/gpu/drm/nouveau/nvkm/subdev/fb/gk104.c | 1 + + drivers/gpu/drm/nouveau/nvkm/subdev/fb/gk110.c | 1 + + drivers/gpu/drm/nouveau/nvkm/subdev/fb/gm107.c | 1 + + 4 files changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gf108.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gf108.c +index 76678dd6..c4c6f67a 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gf108.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gf108.c +@@ -31,6 +31,7 @@ gf108_fb = { + .init = gf100_fb_init, + .init_page = gf100_fb_init_page, + .intr = gf100_fb_intr, ++ .sysmem.flush_page_init = gf100_fb_sysmem_flush_page_init, + .ram_new = gf108_ram_new, + .default_bigpage = 17, + }; +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gk104.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gk104.c +index f73442cc..433fa966 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gk104.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gk104.c +@@ -77,6 +77,7 @@ gk104_fb = { + .init = gf100_fb_init, + .init_page = gf100_fb_init_page, + .intr = gf100_fb_intr, ++ .sysmem.flush_page_init = gf100_fb_sysmem_flush_page_init, + .ram_new = gk104_ram_new, + .default_bigpage = 17, + .clkgate_pack = gk104_fb_clkgate_pack, +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gk110.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gk110.c +index 45d6cdff..4dc283de 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gk110.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gk110.c +@@ -59,6 +59,7 @@ gk110_fb = { + .init = gf100_fb_init, + .init_page = gf100_fb_init_page, + .intr = gf100_fb_intr, ++ .sysmem.flush_page_init = gf100_fb_sysmem_flush_page_init, + .ram_new = gk104_ram_new, + .default_bigpage = 17, + .clkgate_pack = gk110_fb_clkgate_pack, +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gm107.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gm107.c +index de52462a..90bfff61 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gm107.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gm107.c +@@ -31,6 +31,7 @@ gm107_fb = { + .init = gf100_fb_init, + .init_page = gf100_fb_init_page, + .intr = gf100_fb_intr, ++ .sysmem.flush_page_init = gf100_fb_sysmem_flush_page_init, + .ram_new = gm107_ram_new, + .default_bigpage = 17, + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-061-drm-armada-Fix-a-potential-double-free-in-an-e.patch b/patches.kernel.org/6.2.12-061-drm-armada-Fix-a-potential-double-free-in-an-e.patch new file mode 100644 index 0000000..36e15f9 --- /dev/null +++ b/patches.kernel.org/6.2.12-061-drm-armada-Fix-a-potential-double-free-in-an-e.patch @@ -0,0 +1,38 @@ +From: Christophe JAILLET +Date: Sun, 26 Dec 2021 17:34:16 +0100 +Subject: [PATCH] drm/armada: Fix a potential double free in an error handling + path +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: b89ce1177d42d5c124e83f3858818cd4e6a2c46f + +[ Upstream commit b89ce1177d42d5c124e83f3858818cd4e6a2c46f ] + +'priv' is a managed resource, so there is no need to free it explicitly or +there will be a double free(). + +Fixes: 90ad200b4cbc ("drm/armada: Use devm_drm_dev_alloc") +Signed-off-by: Christophe JAILLET +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/c4f3c9207a9fce35cb6dd2cc60e755275961588a.1640536364.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/armada/armada_drv.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/armada/armada_drv.c b/drivers/gpu/drm/armada/armada_drv.c +index 06438878..142668cd 100644 +--- a/drivers/gpu/drm/armada/armada_drv.c ++++ b/drivers/gpu/drm/armada/armada_drv.c +@@ -99,7 +99,6 @@ static int armada_drm_bind(struct device *dev) + if (ret) { + dev_err(dev, "[" DRM_NAME ":%s] can't kick out simple-fb: %d\n", + __func__, ret); +- kfree(priv); + return ret; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-062-qlcnic-check-pci_reset_function-result.patch b/patches.kernel.org/6.2.12-062-qlcnic-check-pci_reset_function-result.patch new file mode 100644 index 0000000..f1913a8 --- /dev/null +++ b/patches.kernel.org/6.2.12-062-qlcnic-check-pci_reset_function-result.patch @@ -0,0 +1,50 @@ +From: Denis Plotnikov +Date: Fri, 7 Apr 2023 10:18:49 +0300 +Subject: [PATCH] qlcnic: check pci_reset_function result +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 7573099e10ca69c3be33995c1fcd0d241226816d + +[ Upstream commit 7573099e10ca69c3be33995c1fcd0d241226816d ] + +Static code analyzer complains to unchecked return value. +The result of pci_reset_function() is unchecked. +Despite, the issue is on the FLR supported code path and in that +case reset can be done with pcie_flr(), the patch uses less invasive +approach by adding the result check of pci_reset_function(). + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 7e2cf4feba05 ("qlcnic: change driver hardware interface mechanism") +Signed-off-by: Denis Plotnikov +Reviewed-by: Simon Horman +Reviewed-by: Bjorn Helgaas +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c +index 87f76bac..eb827b86 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c +@@ -628,7 +628,13 @@ int qlcnic_fw_create_ctx(struct qlcnic_adapter *dev) + int i, err, ring; + + if (dev->flags & QLCNIC_NEED_FLR) { +- pci_reset_function(dev->pdev); ++ err = pci_reset_function(dev->pdev); ++ if (err) { ++ dev_err(&dev->pdev->dev, ++ "Adapter reset failed (%d). Please reboot\n", ++ err); ++ return err; ++ } + dev->flags &= ~QLCNIC_NEED_FLR; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-063-smc-Fix-use-after-free-in-tcp_write_timer_hand.patch b/patches.kernel.org/6.2.12-063-smc-Fix-use-after-free-in-tcp_write_timer_hand.patch new file mode 100644 index 0000000..b3670eb --- /dev/null +++ b/patches.kernel.org/6.2.12-063-smc-Fix-use-after-free-in-tcp_write_timer_hand.patch @@ -0,0 +1,96 @@ +From: Kuniyuki Iwashima +Date: Sat, 8 Apr 2023 11:49:43 -0700 +Subject: [PATCH] smc: Fix use-after-free in tcp_write_timer_handler(). +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 9744d2bf19762703704ecba885b7ac282c02eacf + +[ Upstream commit 9744d2bf19762703704ecba885b7ac282c02eacf ] + +With Eric's ref tracker, syzbot finally found a repro for +use-after-free in tcp_write_timer_handler() by kernel TCP +sockets. [0] + +If SMC creates a kernel socket in __smc_create(), the kernel +socket is supposed to be freed in smc_clcsock_release() by +calling sock_release() when we close() the parent SMC socket. + +However, at the end of smc_clcsock_release(), the kernel +socket's sk_state might not be TCP_CLOSE. This means that +we have not called inet_csk_destroy_sock() in __tcp_close() +and have not stopped the TCP timers. + +The kernel socket's TCP timers can be fired later, so we +need to hold a refcnt for net as we do for MPTCP subflows +in mptcp_subflow_create_socket(). + +[0]: +leaked reference. + sk_alloc (./include/net/net_namespace.h:335 net/core/sock.c:2108) + inet_create (net/ipv4/af_inet.c:319 net/ipv4/af_inet.c:244) + __sock_create (net/socket.c:1546) + smc_create (net/smc/af_smc.c:3269 net/smc/af_smc.c:3284) + __sock_create (net/socket.c:1546) + __sys_socket (net/socket.c:1634 net/socket.c:1618 net/socket.c:1661) + __x64_sys_socket (net/socket.c:1672) + do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) + entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) +================================================================== +BUG: KASAN: slab-use-after-free in tcp_write_timer_handler (net/ipv4/tcp_timer.c:378 net/ipv4/tcp_timer.c:624 net/ipv4/tcp_timer.c:594) +Read of size 1 at addr ffff888052b65e0d by task syzrepro/18091 + +CPU: 0 PID: 18091 Comm: syzrepro Tainted: G W 6.3.0-rc4-01174-gb5d54eb5899a #7 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.amzn2022.0.1 04/01/2014 +Call Trace: + + dump_stack_lvl (lib/dump_stack.c:107) + print_report (mm/kasan/report.c:320 mm/kasan/report.c:430) + kasan_report (mm/kasan/report.c:538) + tcp_write_timer_handler (net/ipv4/tcp_timer.c:378 net/ipv4/tcp_timer.c:624 net/ipv4/tcp_timer.c:594) + tcp_write_timer (./include/linux/spinlock.h:390 net/ipv4/tcp_timer.c:643) + call_timer_fn (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/timer.h:127 kernel/time/timer.c:1701) + __run_timers.part.0 (kernel/time/timer.c:1752 kernel/time/timer.c:2022) + run_timer_softirq (kernel/time/timer.c:2037) + __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:572) + __irq_exit_rcu (kernel/softirq.c:445 kernel/softirq.c:650) + irq_exit_rcu (kernel/softirq.c:664) + sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1107 (discriminator 14)) + + +Fixes: ac7138746e14 ("smc: establish new socket family") +Reported-by: syzbot+7e1e1bdb852961150198@syzkaller.appspotmail.com +Link: https://lore.kernel.org/netdev/000000000000a3f51805f8bcc43a@google.com/ +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Tony Lu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/smc/af_smc.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index e8018b0f..bdeaee72 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -3257,6 +3257,17 @@ static int __smc_create(struct net *net, struct socket *sock, int protocol, + sk_common_release(sk); + goto out; + } ++ ++ /* smc_clcsock_release() does not wait smc->clcsock->sk's ++ * destruction; its sk_state might not be TCP_CLOSE after ++ * smc->sk is close()d, and TCP timers can be fired later, ++ * which need net ref. ++ */ ++ sk = smc->clcsock->sk; ++ __netns_tracker_free(net, &sk->ns_tracker, false); ++ sk->sk_net_refcnt = 1; ++ get_net_track(net, &sk->ns_tracker, GFP_KERNEL); ++ sock_inuse_add(net, 1); + } else { + smc->clcsock = clcsock; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-064-net-wwan-iosm-Fix-error-handling-path-in-ipc_p.patch b/patches.kernel.org/6.2.12-064-net-wwan-iosm-Fix-error-handling-path-in-ipc_p.patch new file mode 100644 index 0000000..e61c9f8 --- /dev/null +++ b/patches.kernel.org/6.2.12-064-net-wwan-iosm-Fix-error-handling-path-in-ipc_p.patch @@ -0,0 +1,57 @@ +From: Harshit Mogalapalli +Date: Sat, 8 Apr 2023 12:43:21 -0700 +Subject: [PATCH] net: wwan: iosm: Fix error handling path in ipc_pcie_probe() +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: a56ef25619e079bd7d744636cf18d054d1e91982 + +[ Upstream commit a56ef25619e079bd7d744636cf18d054d1e91982 ] + +Smatch reports: + drivers/net/wwan/iosm/iosm_ipc_pcie.c:298 ipc_pcie_probe() + warn: missing unwind goto? + +When dma_set_mask fails it directly returns without disabling pci +device and freeing ipc_pcie. Fix this my calling a correct goto label + +As dma_set_mask returns either 0 or -EIO, we can use a goto label, as +it finally returns -EIO. + +Add a set_mask_fail goto label which stands consistent with other goto +labels in this function.. + +Fixes: 035e3befc191 ("net: wwan: iosm: fix driver not working with INTEL_IOMMU disabled") +Reviewed-by: Simon Horman +Signed-off-by: Harshit Mogalapalli +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wwan/iosm/iosm_ipc_pcie.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wwan/iosm/iosm_ipc_pcie.c b/drivers/net/wwan/iosm/iosm_ipc_pcie.c +index 5bf5a939..04517bd3 100644 +--- a/drivers/net/wwan/iosm/iosm_ipc_pcie.c ++++ b/drivers/net/wwan/iosm/iosm_ipc_pcie.c +@@ -295,7 +295,7 @@ static int ipc_pcie_probe(struct pci_dev *pci, + ret = dma_set_mask(ipc_pcie->dev, DMA_BIT_MASK(64)); + if (ret) { + dev_err(ipc_pcie->dev, "Could not set PCI DMA mask: %d", ret); +- return ret; ++ goto set_mask_fail; + } + + ipc_pcie_config_aspm(ipc_pcie); +@@ -323,6 +323,7 @@ static int ipc_pcie_probe(struct pci_dev *pci, + imem_init_fail: + ipc_pcie_resources_release(ipc_pcie); + resources_req_fail: ++set_mask_fail: + pci_disable_device(pci); + pci_enable_fail: + kfree(ipc_pcie); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-065-cgroup-freezer-hold-cpu_hotplug_lock-before-fr.patch b/patches.kernel.org/6.2.12-065-cgroup-freezer-hold-cpu_hotplug_lock-before-fr.patch new file mode 100644 index 0000000..f761156 --- /dev/null +++ b/patches.kernel.org/6.2.12-065-cgroup-freezer-hold-cpu_hotplug_lock-before-fr.patch @@ -0,0 +1,128 @@ +From: Tetsuo Handa +Date: Wed, 5 Apr 2023 22:15:32 +0900 +Subject: [PATCH] cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 57dcd64c7e036299ef526b400a8d12b8a2352f26 + +[ Upstream commit 57dcd64c7e036299ef526b400a8d12b8a2352f26 ] + +syzbot is reporting circular locking dependency between cpu_hotplug_lock +and freezer_mutex, for commit f5d39b020809 ("freezer,sched: Rewrite core +freezer logic") replaced atomic_inc() in freezer_apply_state() with +static_branch_inc() which holds cpu_hotplug_lock. + +cpu_hotplug_lock => cgroup_threadgroup_rwsem => freezer_mutex + + cgroup_file_write() { + cgroup_procs_write() { + __cgroup_procs_write() { + cgroup_procs_write_start() { + cgroup_attach_lock() { + cpus_read_lock() { + percpu_down_read(&cpu_hotplug_lock); + } + percpu_down_write(&cgroup_threadgroup_rwsem); + } + } + cgroup_attach_task() { + cgroup_migrate() { + cgroup_migrate_execute() { + freezer_attach() { + mutex_lock(&freezer_mutex); + (...snipped...) + } + } + } + } + (...snipped...) + } + } + } + +freezer_mutex => cpu_hotplug_lock + + cgroup_file_write() { + freezer_write() { + freezer_change_state() { + mutex_lock(&freezer_mutex); + freezer_apply_state() { + static_branch_inc(&freezer_active) { + static_key_slow_inc() { + cpus_read_lock(); + static_key_slow_inc_cpuslocked(); + cpus_read_unlock(); + } + } + } + mutex_unlock(&freezer_mutex); + } + } + } + +Swap locking order by moving cpus_read_lock() in freezer_apply_state() +to before mutex_lock(&freezer_mutex) in freezer_change_state(). + +Reported-by: syzbot +Link: https://syzkaller.appspot.com/bug?extid=c39682e86c9d84152f93 +Suggested-by: Hillf Danton +Fixes: f5d39b020809 ("freezer,sched: Rewrite core freezer logic") +Signed-off-by: Tetsuo Handa +Acked-by: Peter Zijlstra (Intel) +Reviewed-by: Mukesh Ojha +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/cgroup/legacy_freezer.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/kernel/cgroup/legacy_freezer.c b/kernel/cgroup/legacy_freezer.c +index 1b6b2185..93647320 100644 +--- a/kernel/cgroup/legacy_freezer.c ++++ b/kernel/cgroup/legacy_freezer.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + + /* + * A cgroup is freezing if any FREEZING flags are set. FREEZING_SELF is +@@ -350,7 +351,7 @@ static void freezer_apply_state(struct freezer *freezer, bool freeze, + + if (freeze) { + if (!(freezer->state & CGROUP_FREEZING)) +- static_branch_inc(&freezer_active); ++ static_branch_inc_cpuslocked(&freezer_active); + freezer->state |= state; + freeze_cgroup(freezer); + } else { +@@ -361,7 +362,7 @@ static void freezer_apply_state(struct freezer *freezer, bool freeze, + if (!(freezer->state & CGROUP_FREEZING)) { + freezer->state &= ~CGROUP_FROZEN; + if (was_freezing) +- static_branch_dec(&freezer_active); ++ static_branch_dec_cpuslocked(&freezer_active); + unfreeze_cgroup(freezer); + } + } +@@ -379,6 +380,7 @@ static void freezer_change_state(struct freezer *freezer, bool freeze) + { + struct cgroup_subsys_state *pos; + ++ cpus_read_lock(); + /* + * Update all its descendants in pre-order traversal. Each + * descendant will try to inherit its parent's FREEZING state as +@@ -407,6 +409,7 @@ static void freezer_change_state(struct freezer *freezer, bool freeze) + } + rcu_read_unlock(); + mutex_unlock(&freezer_mutex); ++ cpus_read_unlock(); + } + + static ssize_t freezer_write(struct kernfs_open_file *of, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-066-rtnetlink-Restore-RTM_NEW-DELLINK-notification.patch b/patches.kernel.org/6.2.12-066-rtnetlink-Restore-RTM_NEW-DELLINK-notification.patch new file mode 100644 index 0000000..b629f88 --- /dev/null +++ b/patches.kernel.org/6.2.12-066-rtnetlink-Restore-RTM_NEW-DELLINK-notification.patch @@ -0,0 +1,112 @@ +From: Martin Willi +Date: Tue, 11 Apr 2023 09:43:19 +0200 +Subject: [PATCH] rtnetlink: Restore RTM_NEW/DELLINK notification behavior +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 59d3efd27c11c59b32291e5ebc307bed2edb65ee + +[ Upstream commit 59d3efd27c11c59b32291e5ebc307bed2edb65ee ] + +The commits referenced below allows userspace to use the NLM_F_ECHO flag +for RTM_NEW/DELLINK operations to receive unicast notifications for the +affected link. Prior to these changes, applications may have relied on +multicast notifications to learn the same information without specifying +the NLM_F_ECHO flag. + +For such applications, the mentioned commits changed the behavior for +requests not using NLM_F_ECHO. Multicast notifications are still received, +but now use the portid of the requester and the sequence number of the +request instead of zero values used previously. For the application, this +message may be unexpected and likely handled as a response to the +NLM_F_ACKed request, especially if it uses the same socket to handle +requests and notifications. + +To fix existing applications relying on the old notification behavior, +set the portid and sequence number in the notification only if the +request included the NLM_F_ECHO flag. This restores the old behavior +for applications not using it, but allows unicasted notifications for +others. + +Fixes: f3a63cce1b4f ("rtnetlink: Honour NLM_F_ECHO flag in rtnl_delete_link") +Fixes: d88e136cab37 ("rtnetlink: Honour NLM_F_ECHO flag in rtnl_newlink_create") +Signed-off-by: Martin Willi +Acked-by: Guillaume Nault +Acked-by: Hangbin Liu +Link: https://lore.kernel.org/r/20230411074319.24133-1-martin@strongswan.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + include/linux/rtnetlink.h | 3 ++- + net/core/dev.c | 2 +- + net/core/rtnetlink.c | 11 +++++++++-- + 3 files changed, 12 insertions(+), 4 deletions(-) + +diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h +index 92ad7554..b6e6378d 100644 +--- a/include/linux/rtnetlink.h ++++ b/include/linux/rtnetlink.h +@@ -25,7 +25,8 @@ void rtmsg_ifinfo_newnet(int type, struct net_device *dev, unsigned int change, + struct sk_buff *rtmsg_ifinfo_build_skb(int type, struct net_device *dev, + unsigned change, u32 event, + gfp_t flags, int *new_nsid, +- int new_ifindex, u32 portid, u32 seq); ++ int new_ifindex, u32 portid, ++ const struct nlmsghdr *nlh); + void rtmsg_ifinfo_send(struct sk_buff *skb, struct net_device *dev, + gfp_t flags, u32 portid, const struct nlmsghdr *nlh); + +diff --git a/net/core/dev.c b/net/core/dev.c +index 12781527..404125e7 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -10837,7 +10837,7 @@ void unregister_netdevice_many_notify(struct list_head *head, + dev->rtnl_link_state == RTNL_LINK_INITIALIZED) + skb = rtmsg_ifinfo_build_skb(RTM_DELLINK, dev, ~0U, 0, + GFP_KERNEL, NULL, 0, +- portid, nlmsg_seq(nlh)); ++ portid, nlh); + + /* + * Flush the unicast and multicast chains +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 64289bc9..f5114b23 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -3939,16 +3939,23 @@ static int rtnl_dump_all(struct sk_buff *skb, struct netlink_callback *cb) + struct sk_buff *rtmsg_ifinfo_build_skb(int type, struct net_device *dev, + unsigned int change, + u32 event, gfp_t flags, int *new_nsid, +- int new_ifindex, u32 portid, u32 seq) ++ int new_ifindex, u32 portid, ++ const struct nlmsghdr *nlh) + { + struct net *net = dev_net(dev); + struct sk_buff *skb; + int err = -ENOBUFS; ++ u32 seq = 0; + + skb = nlmsg_new(if_nlmsg_size(dev, 0), flags); + if (skb == NULL) + goto errout; + ++ if (nlmsg_report(nlh)) ++ seq = nlmsg_seq(nlh); ++ else ++ portid = 0; ++ + err = rtnl_fill_ifinfo(skb, dev, dev_net(dev), + type, portid, seq, change, 0, 0, event, + new_nsid, new_ifindex, -1, flags); +@@ -3984,7 +3991,7 @@ static void rtmsg_ifinfo_event(int type, struct net_device *dev, + return; + + skb = rtmsg_ifinfo_build_skb(type, dev, change, event, flags, new_nsid, +- new_ifindex, portid, nlmsg_seq(nlh)); ++ new_ifindex, portid, nlh); + if (skb) + rtmsg_ifinfo_send(skb, dev, flags, portid, nlh); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-067-net-qrtr-Fix-an-uninit-variable-access-bug-in-.patch b/patches.kernel.org/6.2.12-067-net-qrtr-Fix-an-uninit-variable-access-bug-in-.patch new file mode 100644 index 0000000..03f288d --- /dev/null +++ b/patches.kernel.org/6.2.12-067-net-qrtr-Fix-an-uninit-variable-access-bug-in-.patch @@ -0,0 +1,100 @@ +From: Ziyang Xuan +Date: Mon, 10 Apr 2023 09:23:52 +0800 +Subject: [PATCH] net: qrtr: Fix an uninit variable access bug in + qrtr_tx_resume() +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 6417070918de3bcdbe0646e7256dae58fd8083ba + +[ Upstream commit 6417070918de3bcdbe0646e7256dae58fd8083ba ] + +Syzbot reported a bug as following: + +===================================================== +BUG: KMSAN: uninit-value in qrtr_tx_resume+0x185/0x1f0 net/qrtr/af_qrtr.c:230 + qrtr_tx_resume+0x185/0x1f0 net/qrtr/af_qrtr.c:230 + qrtr_endpoint_post+0xf85/0x11b0 net/qrtr/af_qrtr.c:519 + qrtr_tun_write_iter+0x270/0x400 net/qrtr/tun.c:108 + call_write_iter include/linux/fs.h:2189 [inline] + aio_write+0x63a/0x950 fs/aio.c:1600 + io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 + __do_sys_io_submit fs/aio.c:2078 [inline] + __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 + __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Uninit was created at: + slab_post_alloc_hook mm/slab.h:766 [inline] + slab_alloc_node mm/slub.c:3452 [inline] + __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491 + __do_kmalloc_node mm/slab_common.c:967 [inline] + __kmalloc_node_track_caller+0x114/0x3b0 mm/slab_common.c:988 + kmalloc_reserve net/core/skbuff.c:492 [inline] + __alloc_skb+0x3af/0x8f0 net/core/skbuff.c:565 + __netdev_alloc_skb+0x120/0x7d0 net/core/skbuff.c:630 + qrtr_endpoint_post+0xbd/0x11b0 net/qrtr/af_qrtr.c:446 + qrtr_tun_write_iter+0x270/0x400 net/qrtr/tun.c:108 + call_write_iter include/linux/fs.h:2189 [inline] + aio_write+0x63a/0x950 fs/aio.c:1600 + io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 + __do_sys_io_submit fs/aio.c:2078 [inline] + __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 + __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +It is because that skb->len requires at least sizeof(struct qrtr_ctrl_pkt) +in qrtr_tx_resume(). And skb->len equals to size in qrtr_endpoint_post(). +But size is less than sizeof(struct qrtr_ctrl_pkt) when qrtr_cb->type +equals to QRTR_TYPE_RESUME_TX in qrtr_endpoint_post() under the syzbot +scenario. This triggers the uninit variable access bug. + +Add size check when qrtr_cb->type equals to QRTR_TYPE_RESUME_TX in +qrtr_endpoint_post() to fix the bug. + +Fixes: 5fdeb0d372ab ("net: qrtr: Implement outgoing flow control") +Reported-by: syzbot+4436c9630a45820fda76@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?id=c14607f0963d27d5a3d5f4c8639b500909e43540 +Suggested-by: Manivannan Sadhasivam +Signed-off-by: Ziyang Xuan +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230410012352.3997823-1-william.xuanziyang@huawei.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/qrtr/af_qrtr.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c +index 3a70255c..76f0434d 100644 +--- a/net/qrtr/af_qrtr.c ++++ b/net/qrtr/af_qrtr.c +@@ -498,6 +498,11 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) + if (!size || len != ALIGN(size, 4) + hdrlen) + goto err; + ++ if ((cb->type == QRTR_TYPE_NEW_SERVER || ++ cb->type == QRTR_TYPE_RESUME_TX) && ++ size < sizeof(struct qrtr_ctrl_pkt)) ++ goto err; ++ + if (cb->dst_port != QRTR_PORT_CTRL && cb->type != QRTR_TYPE_DATA && + cb->type != QRTR_TYPE_RESUME_TX) + goto err; +@@ -510,9 +515,6 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) + /* Remote node endpoint can bridge other distant nodes */ + const struct qrtr_ctrl_pkt *pkt; + +- if (size < sizeof(*pkt)) +- goto err; +- + pkt = data + hdrlen; + qrtr_node_assign(node, le32_to_cpu(pkt->server.node)); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-068-sctp-fix-a-potential-overflow-in-sctp_ifwdtsn_.patch b/patches.kernel.org/6.2.12-068-sctp-fix-a-potential-overflow-in-sctp_ifwdtsn_.patch new file mode 100644 index 0000000..f6c1152 --- /dev/null +++ b/patches.kernel.org/6.2.12-068-sctp-fix-a-potential-overflow-in-sctp_ifwdtsn_.patch @@ -0,0 +1,45 @@ +From: Xin Long +Date: Mon, 10 Apr 2023 15:43:30 -0400 +Subject: [PATCH] sctp: fix a potential overflow in sctp_ifwdtsn_skip +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 32832a2caf82663870126c5186cf8f86c8b2a649 + +[ Upstream commit 32832a2caf82663870126c5186cf8f86c8b2a649 ] + +Currently, when traversing ifwdtsn skips with _sctp_walk_ifwdtsn, it only +checks the pos against the end of the chunk. However, the data left for +the last pos may be < sizeof(struct sctp_ifwdtsn_skip), and dereference +it as struct sctp_ifwdtsn_skip may cause coverflow. + +This patch fixes it by checking the pos against "the end of the chunk - +sizeof(struct sctp_ifwdtsn_skip)" in sctp_ifwdtsn_skip, similar to +sctp_fwdtsn_skip. + +Fixes: 0fc2ea922c8a ("sctp: implement validate_ftsn for sctp_stream_interleave") +Signed-off-by: Xin Long +Link: https://lore.kernel.org/r/2a71bffcd80b4f2c61fac6d344bb2f11c8fd74f7.1681155810.git.lucien.xin@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/sctp/stream_interleave.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/sctp/stream_interleave.c b/net/sctp/stream_interleave.c +index 94727feb..b046b112 100644 +--- a/net/sctp/stream_interleave.c ++++ b/net/sctp/stream_interleave.c +@@ -1154,7 +1154,8 @@ static void sctp_generate_iftsn(struct sctp_outq *q, __u32 ctsn) + + #define _sctp_walk_ifwdtsn(pos, chunk, end) \ + for (pos = chunk->subh.ifwdtsn_hdr->skip; \ +- (void *)pos < (void *)chunk->subh.ifwdtsn_hdr->skip + (end); pos++) ++ (void *)pos <= (void *)chunk->subh.ifwdtsn_hdr->skip + (end) - \ ++ sizeof(struct sctp_ifwdtsn_skip); pos++) + + #define sctp_walk_ifwdtsn(pos, ch) \ + _sctp_walk_ifwdtsn((pos), (ch), ntohs((ch)->chunk_hdr->length) - \ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-069-RDMA-core-Fix-GID-entry-ref-leak-when-create_a.patch b/patches.kernel.org/6.2.12-069-RDMA-core-Fix-GID-entry-ref-leak-when-create_a.patch new file mode 100644 index 0000000..2bbd356 --- /dev/null +++ b/patches.kernel.org/6.2.12-069-RDMA-core-Fix-GID-entry-ref-leak-when-create_a.patch @@ -0,0 +1,39 @@ +From: Saravanan Vajravel +Date: Fri, 31 Mar 2023 23:34:24 -0700 +Subject: [PATCH] RDMA/core: Fix GID entry ref leak when create_ah fails +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: aca3b0fa3d04b40c96934d86cc224cccfa7ea8e0 + +[ Upstream commit aca3b0fa3d04b40c96934d86cc224cccfa7ea8e0 ] + +If AH create request fails, release sgid_attr to avoid GID entry +referrence leak reported while releasing GID table + +Fixes: 1a1f460ff151 ("RDMA: Hold the sgid_attr inside the struct ib_ah/qp") +Link: https://lore.kernel.org/r/20230401063424.342204-1-saravanan.vajravel@broadcom.com +Reviewed-by: Selvin Xavier +Signed-off-by: Saravanan Vajravel +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/core/verbs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c +index 11b1c160..b99b3cc2 100644 +--- a/drivers/infiniband/core/verbs.c ++++ b/drivers/infiniband/core/verbs.c +@@ -532,6 +532,8 @@ static struct ib_ah *_rdma_create_ah(struct ib_pd *pd, + else + ret = device->ops.create_ah(ah, &init_attr, NULL); + if (ret) { ++ if (ah->sgid_attr) ++ rdma_put_gid_attr(ah->sgid_attr); + kfree(ah); + return ERR_PTR(ret); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-070-selftests-openvswitch-adjust-datapath-NL-messa.patch b/patches.kernel.org/6.2.12-070-selftests-openvswitch-adjust-datapath-NL-messa.patch new file mode 100644 index 0000000..0940fd6 --- /dev/null +++ b/patches.kernel.org/6.2.12-070-selftests-openvswitch-adjust-datapath-NL-messa.patch @@ -0,0 +1,41 @@ +From: Aaron Conole +Date: Wed, 12 Apr 2023 07:58:28 -0400 +Subject: [PATCH] selftests: openvswitch: adjust datapath NL message + declaration +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 306dc21361993f4fe50a15d4db6b1a4de5d0adb0 + +[ Upstream commit 306dc21361993f4fe50a15d4db6b1a4de5d0adb0 ] + +The netlink message for creating a new datapath takes an array +of ports for the PID creation. This shouldn't cause much issue +but correct it for future cases where we need to do decode of +datapath information that could include the per-cpu PID map. + +Fixes: 25f16c873fb1 ("selftests: add openvswitch selftest suite") +Signed-off-by: Aaron Conole +Link: https://lore.kernel.org/r/20230412115828.3991806-1-aconole@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/net/openvswitch/ovs-dpctl.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/openvswitch/ovs-dpctl.py b/tools/testing/selftests/net/openvswitch/ovs-dpctl.py +index 3243c90d..5d467d19 100644 +--- a/tools/testing/selftests/net/openvswitch/ovs-dpctl.py ++++ b/tools/testing/selftests/net/openvswitch/ovs-dpctl.py +@@ -62,7 +62,7 @@ class OvsDatapath(GenericNetlinkSocket): + nla_map = ( + ("OVS_DP_ATTR_UNSPEC", "none"), + ("OVS_DP_ATTR_NAME", "asciiz"), +- ("OVS_DP_ATTR_UPCALL_PID", "uint32"), ++ ("OVS_DP_ATTR_UPCALL_PID", "array(uint32)"), + ("OVS_DP_ATTR_STATS", "dpstats"), + ("OVS_DP_ATTR_MEGAFLOW_STATS", "megaflowstats"), + ("OVS_DP_ATTR_USER_FEATURES", "uint32"), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-071-udp6-fix-potential-access-to-stale-information.patch b/patches.kernel.org/6.2.12-071-udp6-fix-potential-access-to-stale-information.patch new file mode 100644 index 0000000..f4d27c1 --- /dev/null +++ b/patches.kernel.org/6.2.12-071-udp6-fix-potential-access-to-stale-information.patch @@ -0,0 +1,69 @@ +From: Eric Dumazet +Date: Wed, 12 Apr 2023 13:03:08 +0000 +Subject: [PATCH] udp6: fix potential access to stale information +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 1c5950fc6fe996235f1d18539b9c6b64b597f50f + +[ Upstream commit 1c5950fc6fe996235f1d18539b9c6b64b597f50f ] + +lena wang reported an issue caused by udpv6_sendmsg() +mangling msg->msg_name and msg->msg_namelen, which +are later read from ____sys_sendmsg() : + + /* + * If this is sendmmsg() and sending to current destination address was + * successful, remember it. + */ + if (used_address && err >= 0) { + used_address->name_len = msg_sys->msg_namelen; + if (msg_sys->msg_name) + memcpy(&used_address->name, msg_sys->msg_name, + used_address->name_len); + } + +udpv6_sendmsg() wants to pretend the remote address family +is AF_INET in order to call udp_sendmsg(). + +A fix would be to modify the address in-place, instead +of using a local variable, but this could have other side effects. + +Instead, restore initial values before we return from udpv6_sendmsg(). + +Fixes: c71d8ebe7a44 ("net: Fix security_socket_sendmsg() bypass problem.") +Reported-by: lena wang +Signed-off-by: Eric Dumazet +Reviewed-by: Maciej Żenczykowski +Link: https://lore.kernel.org/r/20230412130308.1202254-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/ipv6/udp.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 9fb2f33e..a675acfb 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -1395,9 +1395,11 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + msg->msg_name = &sin; + msg->msg_namelen = sizeof(sin); + do_udp_sendmsg: +- if (ipv6_only_sock(sk)) +- return -ENETUNREACH; +- return udp_sendmsg(sk, msg, len); ++ err = ipv6_only_sock(sk) ? ++ -ENETUNREACH : udp_sendmsg(sk, msg, len); ++ msg->msg_name = sin6; ++ msg->msg_namelen = addr_len; ++ return err; + } + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-072-selftests-add-the-missing-CONFIG_IP_SCTP-in-ne.patch b/patches.kernel.org/6.2.12-072-selftests-add-the-missing-CONFIG_IP_SCTP-in-ne.patch new file mode 100644 index 0000000..0ca22c2 --- /dev/null +++ b/patches.kernel.org/6.2.12-072-selftests-add-the-missing-CONFIG_IP_SCTP-in-ne.patch @@ -0,0 +1,36 @@ +From: Xin Long +Date: Wed, 12 Apr 2023 11:13:06 -0400 +Subject: [PATCH] selftests: add the missing CONFIG_IP_SCTP in net config +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 3a0385be133e7091cc9a9a998c7ec712bb9585db + +[ Upstream commit 3a0385be133e7091cc9a9a998c7ec712bb9585db ] + +The selftest sctp_vrf needs CONFIG_IP_SCTP set in config +when building the kernel, so add it. + +Fixes: a61bd7b9fef3 ("selftests: add a selftest for sctp vrf") +Reported-by: Naresh Kamboju +Signed-off-by: Xin Long +Reviewed-by: Sridhar Samudrala +Link: https://lore.kernel.org/r/61dddebc4d2dd98fe7fb145e24d4b2430e42b572.1681312386.git.lucien.xin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/net/config | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/net/config b/tools/testing/selftests/net/config +index bd89198c..84833cb4 100644 +--- a/tools/testing/selftests/net/config ++++ b/tools/testing/selftests/net/config +@@ -45,3 +45,4 @@ CONFIG_BAREUDP=m + CONFIG_IPV6_IOAM6_LWTUNNEL=y + CONFIG_CRYPTO_SM4_GENERIC=y + CONFIG_AMT=m ++CONFIG_IP_SCTP=m +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-073-net-macb-fix-a-memory-corruption-in-extended-b.patch b/patches.kernel.org/6.2.12-073-net-macb-fix-a-memory-corruption-in-extended-b.patch new file mode 100644 index 0000000..817e848 --- /dev/null +++ b/patches.kernel.org/6.2.12-073-net-macb-fix-a-memory-corruption-in-extended-b.patch @@ -0,0 +1,152 @@ +From: Roman Gushchin +Date: Wed, 12 Apr 2023 16:21:44 -0700 +Subject: [PATCH] net: macb: fix a memory corruption in extended buffer + descriptor mode +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: e8b74453555872851bdd7ea43a7c0ec39659834f + +[ Upstream commit e8b74453555872851bdd7ea43a7c0ec39659834f ] + +For quite some time we were chasing a bug which looked like a sudden +permanent failure of networking and mmc on some of our devices. +The bug was very sensitive to any software changes and even more to +any kernel debug options. + +Finally we got a setup where the problem was reproducible with +CONFIG_DMA_API_DEBUG=y and it revealed the issue with the rx dma: + +[ 16.992082] ------------[ cut here ]------------ +[ 16.996779] DMA-API: macb ff0b0000.ethernet: device driver tries to free DMA memory it has not allocated [device address=0x0000000875e3e244] [size=1536 bytes] +[ 17.011049] WARNING: CPU: 0 PID: 85 at kernel/dma/debug.c:1011 check_unmap+0x6a0/0x900 +[ 17.018977] Modules linked in: xxxxx +[ 17.038823] CPU: 0 PID: 85 Comm: irq/55-8000f000 Not tainted 5.4.0 #28 +[ 17.045345] Hardware name: xxxxx +[ 17.049528] pstate: 60000005 (nZCv daif -PAN -UAO) +[ 17.054322] pc : check_unmap+0x6a0/0x900 +[ 17.058243] lr : check_unmap+0x6a0/0x900 +[ 17.062163] sp : ffffffc010003c40 +[ 17.065470] x29: ffffffc010003c40 x28: 000000004000c03c +[ 17.070783] x27: ffffffc010da7048 x26: ffffff8878e38800 +[ 17.076095] x25: ffffff8879d22810 x24: ffffffc010003cc8 +[ 17.081407] x23: 0000000000000000 x22: ffffffc010a08750 +[ 17.086719] x21: ffffff8878e3c7c0 x20: ffffffc010acb000 +[ 17.092032] x19: 0000000875e3e244 x18: 0000000000000010 +[ 17.097343] x17: 0000000000000000 x16: 0000000000000000 +[ 17.102647] x15: ffffff8879e4a988 x14: 0720072007200720 +[ 17.107959] x13: 0720072007200720 x12: 0720072007200720 +[ 17.113261] x11: 0720072007200720 x10: 0720072007200720 +[ 17.118565] x9 : 0720072007200720 x8 : 000000000000022d +[ 17.123869] x7 : 0000000000000015 x6 : 0000000000000098 +[ 17.129173] x5 : 0000000000000000 x4 : 0000000000000000 +[ 17.134475] x3 : 00000000ffffffff x2 : ffffffc010a1d370 +[ 17.139778] x1 : b420c9d75d27bb00 x0 : 0000000000000000 +[ 17.145082] Call trace: +[ 17.147524] check_unmap+0x6a0/0x900 +[ 17.151091] debug_dma_unmap_page+0x88/0x90 +[ 17.155266] gem_rx+0x114/0x2f0 +[ 17.158396] macb_poll+0x58/0x100 +[ 17.161705] net_rx_action+0x118/0x400 +[ 17.165445] __do_softirq+0x138/0x36c +[ 17.169100] irq_exit+0x98/0xc0 +[ 17.172234] __handle_domain_irq+0x64/0xc0 +[ 17.176320] gic_handle_irq+0x5c/0xc0 +[ 17.179974] el1_irq+0xb8/0x140 +[ 17.183109] xiic_process+0x5c/0xe30 +[ 17.186677] irq_thread_fn+0x28/0x90 +[ 17.190244] irq_thread+0x208/0x2a0 +[ 17.193724] kthread+0x130/0x140 +[ 17.196945] ret_from_fork+0x10/0x20 +[ 17.200510] ---[ end trace 7240980785f81d6f ]--- + +[ 237.021490] ------------[ cut here ]------------ +[ 237.026129] DMA-API: exceeded 7 overlapping mappings of cacheline 0x0000000021d79e7b +[ 237.033886] WARNING: CPU: 0 PID: 0 at kernel/dma/debug.c:499 add_dma_entry+0x214/0x240 +[ 237.041802] Modules linked in: xxxxx +[ 237.061637] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 5.4.0 #28 +[ 237.068941] Hardware name: xxxxx +[ 237.073116] pstate: 80000085 (Nzcv daIf -PAN -UAO) +[ 237.077900] pc : add_dma_entry+0x214/0x240 +[ 237.081986] lr : add_dma_entry+0x214/0x240 +[ 237.086072] sp : ffffffc010003c30 +[ 237.089379] x29: ffffffc010003c30 x28: ffffff8878a0be00 +[ 237.094683] x27: 0000000000000180 x26: ffffff8878e387c0 +[ 237.099987] x25: 0000000000000002 x24: 0000000000000000 +[ 237.105290] x23: 000000000000003b x22: ffffffc010a0fa00 +[ 237.110594] x21: 0000000021d79e7b x20: ffffffc010abe600 +[ 237.115897] x19: 00000000ffffffef x18: 0000000000000010 +[ 237.121201] x17: 0000000000000000 x16: 0000000000000000 +[ 237.126504] x15: ffffffc010a0fdc8 x14: 0720072007200720 +[ 237.131807] x13: 0720072007200720 x12: 0720072007200720 +[ 237.137111] x11: 0720072007200720 x10: 0720072007200720 +[ 237.142415] x9 : 0720072007200720 x8 : 0000000000000259 +[ 237.147718] x7 : 0000000000000001 x6 : 0000000000000000 +[ 237.153022] x5 : ffffffc010003a20 x4 : 0000000000000001 +[ 237.158325] x3 : 0000000000000006 x2 : 0000000000000007 +[ 237.163628] x1 : 8ac721b3a7dc1c00 x0 : 0000000000000000 +[ 237.168932] Call trace: +[ 237.171373] add_dma_entry+0x214/0x240 +[ 237.175115] debug_dma_map_page+0xf8/0x120 +[ 237.179203] gem_rx_refill+0x190/0x280 +[ 237.182942] gem_rx+0x224/0x2f0 +[ 237.186075] macb_poll+0x58/0x100 +[ 237.189384] net_rx_action+0x118/0x400 +[ 237.193125] __do_softirq+0x138/0x36c +[ 237.196780] irq_exit+0x98/0xc0 +[ 237.199914] __handle_domain_irq+0x64/0xc0 +[ 237.204000] gic_handle_irq+0x5c/0xc0 +[ 237.207654] el1_irq+0xb8/0x140 +[ 237.210789] arch_cpu_idle+0x40/0x200 +[ 237.214444] default_idle_call+0x18/0x30 +[ 237.218359] do_idle+0x200/0x280 +[ 237.221578] cpu_startup_entry+0x20/0x30 +[ 237.225493] rest_init+0xe4/0xf0 +[ 237.228713] arch_call_rest_init+0xc/0x14 +[ 237.232714] start_kernel+0x47c/0x4a8 +[ 237.236367] ---[ end trace 7240980785f81d70 ]--- + +Lars was fast to find an explanation: according to the datasheet +bit 2 of the rx buffer descriptor entry has a different meaning in the +extended mode: + Address [2] of beginning of buffer, or + in extended buffer descriptor mode (DMA configuration register [28] = 1), + indicates a valid timestamp in the buffer descriptor entry. + +The macb driver didn't mask this bit while getting an address and it +eventually caused a memory corruption and a dma failure. + +The problem is resolved by explicitly clearing the problematic bit +if hw timestamping is used. + +Fixes: 7b4296148066 ("net: macb: Add support for PTP timestamps in DMA descriptors") +Signed-off-by: Roman Gushchin +Co-developed-by: Lars-Peter Clausen +Signed-off-by: Lars-Peter Clausen +Acked-by: Nicolas Ferre +Reviewed-by: Jacob Keller +Link: https://lore.kernel.org/r/20230412232144.770336-1-roman.gushchin@linux.dev +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/cadence/macb_main.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index 6cda3152..5b230831 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -1009,6 +1009,10 @@ static dma_addr_t macb_get_addr(struct macb *bp, struct macb_dma_desc *desc) + } + #endif + addr |= MACB_BF(RX_WADDR, MACB_BFEXT(RX_WADDR, desc->addr)); ++#ifdef CONFIG_MACB_USE_HWSTAMP ++ if (bp->hw_dma_cap & HW_DMA_CAP_PTP) ++ addr &= ~GEM_BIT(DMA_RXVALID); ++#endif + return addr; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-074-skbuff-Fix-a-race-between-coalescing-and-relea.patch b/patches.kernel.org/6.2.12-074-skbuff-Fix-a-race-between-coalescing-and-relea.patch new file mode 100644 index 0000000..ebb2560 --- /dev/null +++ b/patches.kernel.org/6.2.12-074-skbuff-Fix-a-race-between-coalescing-and-relea.patch @@ -0,0 +1,99 @@ +From: Liang Chen +Date: Thu, 13 Apr 2023 17:03:53 +0800 +Subject: [PATCH] skbuff: Fix a race between coalescing and releasing SKBs +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 0646dc31ca886693274df5749cd0c8c1eaaeb5ca + +[ Upstream commit 0646dc31ca886693274df5749cd0c8c1eaaeb5ca ] + +Commit 1effe8ca4e34 ("skbuff: fix coalescing for page_pool fragment +recycling") allowed coalescing to proceed with non page pool page and page +pool page when @from is cloned, i.e. + +to->pp_recycle --> false +from->pp_recycle --> true +skb_cloned(from) --> true + +However, it actually requires skb_cloned(@from) to hold true until +coalescing finishes in this situation. If the other cloned SKB is +released while the merging is in process, from_shinfo->nr_frags will be +set to 0 toward the end of the function, causing the increment of frag +page _refcount to be unexpectedly skipped resulting in inconsistent +reference counts. Later when SKB(@to) is released, it frees the page +directly even though the page pool page is still in use, leading to +use-after-free or double-free errors. So it should be prohibited. + +The double-free error message below prompted us to investigate: +BUG: Bad page state in process swapper/1 pfn:0e0d1 +page:00000000c6548b28 refcount:-1 mapcount:0 mapping:0000000000000000 +index:0x2 pfn:0xe0d1 +flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) +raw: 000fffffc0000000 0000000000000000 ffffffff00000101 0000000000000000 +raw: 0000000000000002 0000000000000000 ffffffffffffffff 0000000000000000 +page dumped because: nonzero _refcount + +CPU: 1 PID: 0 Comm: swapper/1 Tainted: G E 6.2.0+ +Call Trace: + +dump_stack_lvl+0x32/0x50 +bad_page+0x69/0xf0 +free_pcp_prepare+0x260/0x2f0 +free_unref_page+0x20/0x1c0 +skb_release_data+0x10b/0x1a0 +napi_consume_skb+0x56/0x150 +net_rx_action+0xf0/0x350 +? __napi_schedule+0x79/0x90 +__do_softirq+0xc8/0x2b1 +__irq_exit_rcu+0xb9/0xf0 +common_interrupt+0x82/0xa0 + + +asm_common_interrupt+0x22/0x40 +RIP: 0010:default_idle+0xb/0x20 + +Fixes: 53e0961da1c7 ("page_pool: add frag page recycling support in page pool") +Signed-off-by: Liang Chen +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/20230413090353.14448-1-liangchen.linux@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/core/skbuff.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index a31ff4d8..43e1b896 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -5475,18 +5475,18 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from, + if (skb_cloned(to)) + return false; + +- /* In general, avoid mixing slab allocated and page_pool allocated +- * pages within the same SKB. However when @to is not pp_recycle and +- * @from is cloned, we can transition frag pages from page_pool to +- * reference counted. +- * +- * On the other hand, don't allow coalescing two pp_recycle SKBs if +- * @from is cloned, in case the SKB is using page_pool fragment ++ /* In general, avoid mixing page_pool and non-page_pool allocated ++ * pages within the same SKB. Additionally avoid dealing with clones ++ * with page_pool pages, in case the SKB is using page_pool fragment + * references (PP_FLAG_PAGE_FRAG). Since we only take full page + * references for cloned SKBs at the moment that would result in + * inconsistent reference counts. ++ * In theory we could take full references if @from is cloned and ++ * !@to->pp_recycle but its tricky (due to potential race with ++ * the clone disappearing) and rare, so not worth dealing with. + */ +- if (to->pp_recycle != (from->pp_recycle && !skb_cloned(from))) ++ if (to->pp_recycle != from->pp_recycle || ++ (from->pp_recycle && skb_cloned(from))) + return false; + + if (len <= skb_tailroom(to)) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-075-ARM-9290-1-uaccess-Fix-KASAN-false-positives.patch b/patches.kernel.org/6.2.12-075-ARM-9290-1-uaccess-Fix-KASAN-false-positives.patch new file mode 100644 index 0000000..5990896 --- /dev/null +++ b/patches.kernel.org/6.2.12-075-ARM-9290-1-uaccess-Fix-KASAN-false-positives.patch @@ -0,0 +1,57 @@ +From: Andrew Jeffery +Date: Wed, 22 Feb 2023 00:10:14 +0100 +Subject: [PATCH] ARM: 9290/1: uaccess: Fix KASAN false-positives +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: ceac10c83b330680cc01ceaaab86cd49f4f30d81 + +[ Upstream commit ceac10c83b330680cc01ceaaab86cd49f4f30d81 ] + +__copy_to_user_memcpy() and __clear_user_memset() had been calling +memcpy() and memset() respectively, leading to false-positive KASAN +reports when starting userspace: + + [ 10.707901] Run /init as init process + [ 10.731892] process '/bin/busybox' started with executable stack + [ 10.745234] ================================================================== + [ 10.745796] BUG: KASAN: user-memory-access in __clear_user_memset+0x258/0x3ac + [ 10.747260] Write of size 2687 at addr 000de581 by task init/1 + +Use __memcpy() and __memset() instead to allow userspace access, which +is of course the intent of these functions. + +Signed-off-by: Andrew Jeffery +Signed-off-by: Zev Weiss +Reviewed-by: Arnd Bergmann +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm/lib/uaccess_with_memcpy.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c +index 14eecaaf..e4c2677c 100644 +--- a/arch/arm/lib/uaccess_with_memcpy.c ++++ b/arch/arm/lib/uaccess_with_memcpy.c +@@ -116,7 +116,7 @@ __copy_to_user_memcpy(void __user *to, const void *from, unsigned long n) + tocopy = n; + + ua_flags = uaccess_save_and_enable(); +- memcpy((void *)to, from, tocopy); ++ __memcpy((void *)to, from, tocopy); + uaccess_restore(ua_flags); + to += tocopy; + from += tocopy; +@@ -178,7 +178,7 @@ __clear_user_memset(void __user *addr, unsigned long n) + tocopy = n; + + ua_flags = uaccess_save_and_enable(); +- memset((void *)addr, 0, tocopy); ++ __memset((void *)addr, 0, tocopy); + uaccess_restore(ua_flags); + addr += tocopy; + n -= tocopy; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-076-ARM-dts-qcom-apq8026-lg-lenok-add-missing-rese.patch b/patches.kernel.org/6.2.12-076-ARM-dts-qcom-apq8026-lg-lenok-add-missing-rese.patch new file mode 100644 index 0000000..83c20b5 --- /dev/null +++ b/patches.kernel.org/6.2.12-076-ARM-dts-qcom-apq8026-lg-lenok-add-missing-rese.patch @@ -0,0 +1,46 @@ +From: Luca Weiss +Date: Wed, 8 Mar 2023 22:06:03 +0100 +Subject: [PATCH] ARM: dts: qcom: apq8026-lg-lenok: add missing reserved memory +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: ecd240875e877d78fd03efbc62292f550872df3f + +[ Upstream commit ecd240875e877d78fd03efbc62292f550872df3f ] + +Turns out these two memory regions also need to be avoided, otherwise +weird things will happen when Linux tries to use this memory. + +Signed-off-by: Luca Weiss +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230308-lenok-reserved-memory-v1-1-b8bf6ff01207@z3ntu.xyz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm/boot/dts/qcom-apq8026-lg-lenok.dts | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/arch/arm/boot/dts/qcom-apq8026-lg-lenok.dts b/arch/arm/boot/dts/qcom-apq8026-lg-lenok.dts +index de2fb1c0..b8238122 100644 +--- a/arch/arm/boot/dts/qcom-apq8026-lg-lenok.dts ++++ b/arch/arm/boot/dts/qcom-apq8026-lg-lenok.dts +@@ -27,6 +27,16 @@ chosen { + }; + + reserved-memory { ++ sbl_region: sbl@2f00000 { ++ reg = <0x02f00000 0x100000>; ++ no-map; ++ }; ++ ++ external_image_region: external-image@3100000 { ++ reg = <0x03100000 0x200000>; ++ no-map; ++ }; ++ + adsp_region: adsp@3300000 { + reg = <0x03300000 0x1400000>; + no-map; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-077-arm64-dts-qcom-sa8540p-ride-correct-name-of-re.patch b/patches.kernel.org/6.2.12-077-arm64-dts-qcom-sa8540p-ride-correct-name-of-re.patch new file mode 100644 index 0000000..e44c815 --- /dev/null +++ b/patches.kernel.org/6.2.12-077-arm64-dts-qcom-sa8540p-ride-correct-name-of-re.patch @@ -0,0 +1,39 @@ +From: Brian Masney +Date: Tue, 7 Mar 2023 18:23:40 -0500 +Subject: [PATCH] arm64: dts: qcom: sa8540p-ride: correct name of + remoteproc_nsp0 firmware +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: b891251b40d4dc4cfd28341f62f6784c02ad3a78 + +[ Upstream commit b891251b40d4dc4cfd28341f62f6784c02ad3a78 ] + +The cdsp.mbn firmware that's referenced in sa8540p-ride.dts is actually +named cdsp0.mbn in the deliverables from Qualcomm. Let's go ahead and +correct the name to match what's in Qualcomm's deliverable. + +Signed-off-by: Brian Masney +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230307232340.2370476-1-bmasney@redhat.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sa8540p-ride.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sa8540p-ride.dts b/arch/arm64/boot/dts/qcom/sa8540p-ride.dts +index 6c547f1b..0f560a46 100644 +--- a/arch/arm64/boot/dts/qcom/sa8540p-ride.dts ++++ b/arch/arm64/boot/dts/qcom/sa8540p-ride.dts +@@ -177,7 +177,7 @@ &qup2_uart17 { + }; + + &remoteproc_nsp0 { +- firmware-name = "qcom/sa8540p/cdsp.mbn"; ++ firmware-name = "qcom/sa8540p/cdsp0.mbn"; + status = "okay"; + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-078-power-supply-rk817-Fix-unsigned-comparison-wit.patch b/patches.kernel.org/6.2.12-078-power-supply-rk817-Fix-unsigned-comparison-wit.patch new file mode 100644 index 0000000..4e8df5d --- /dev/null +++ b/patches.kernel.org/6.2.12-078-power-supply-rk817-Fix-unsigned-comparison-wit.patch @@ -0,0 +1,53 @@ +From: Jiapeng Chong +Date: Wed, 14 Dec 2022 11:23:16 +0800 +Subject: [PATCH] power: supply: rk817: Fix unsigned comparison with less than + zero +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 3268a4d9b0b85a4382e93bdf7be5400a73db74c5 + +[ Upstream commit 3268a4d9b0b85a4382e93bdf7be5400a73db74c5 ] + +The tmp is defined as u32 type, which results in invalid processing of +tmp<0 in function rk817_read_or_set_full_charge_on_boot(). Therefore, +drop the comparison. + +drivers/power/supply/rk817_charger.c:828 rk817_read_or_set_full_charge_on_boot() warn: unsigned 'tmp' is never less than zero. +drivers/power/supply/rk817_charger.c:788 rk817_read_or_set_full_charge_on_boot() warn: unsigned 'tmp' is never less than zero. + +Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3444 +Reported-by: Abaci Robot +Signed-off-by: Jiapeng Chong +Tested-by: Chris Morgan +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/power/supply/rk817_charger.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/power/supply/rk817_charger.c b/drivers/power/supply/rk817_charger.c +index 4f9c1c41..36f807b5 100644 +--- a/drivers/power/supply/rk817_charger.c ++++ b/drivers/power/supply/rk817_charger.c +@@ -785,8 +785,6 @@ rk817_read_or_set_full_charge_on_boot(struct rk817_charger *charger, + regmap_bulk_read(rk808->regmap, RK817_GAS_GAUGE_Q_PRES_H3, + bulk_reg, 4); + tmp = get_unaligned_be32(bulk_reg); +- if (tmp < 0) +- tmp = 0; + boot_charge_mah = ADC_TO_CHARGE_UAH(tmp, + charger->res_div) / 1000; + /* +@@ -825,8 +823,6 @@ rk817_read_or_set_full_charge_on_boot(struct rk817_charger *charger, + regmap_bulk_read(rk808->regmap, RK817_GAS_GAUGE_Q_PRES_H3, + bulk_reg, 4); + tmp = get_unaligned_be32(bulk_reg); +- if (tmp < 0) +- tmp = 0; + boot_charge_mah = ADC_TO_CHARGE_UAH(tmp, charger->res_div) / 1000; + regmap_bulk_read(rk808->regmap, RK817_GAS_GAUGE_OCV_VOL_H, + bulk_reg, 2); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-079-power-supply-cros_usbpd-reclassify-default-cas.patch b/patches.kernel.org/6.2.12-079-power-supply-cros_usbpd-reclassify-default-cas.patch new file mode 100644 index 0000000..043b6d2 --- /dev/null +++ b/patches.kernel.org/6.2.12-079-power-supply-cros_usbpd-reclassify-default-cas.patch @@ -0,0 +1,44 @@ +From: Grant Grundler +Date: Mon, 12 Dec 2022 13:38:57 -0800 +Subject: [PATCH] power: supply: cros_usbpd: reclassify "default case!" as + debug +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 14c76b2e75bca4d96e2b85a0c12aa43e84fe3f74 + +[ Upstream commit 14c76b2e75bca4d96e2b85a0c12aa43e84fe3f74 ] + +This doesn't need to be printed every second as an error: +... +<3>[17438.628385] cros-usbpd-charger cros-usbpd-charger.3.auto: Port 1: default case! +<3>[17439.634176] cros-usbpd-charger cros-usbpd-charger.3.auto: Port 1: default case! +<3>[17440.640298] cros-usbpd-charger cros-usbpd-charger.3.auto: Port 1: default case! +... + +Reduce priority from ERROR to DEBUG. + +Signed-off-by: Grant Grundler +Reviewed-by: Guenter Roeck +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/power/supply/cros_usbpd-charger.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/power/supply/cros_usbpd-charger.c b/drivers/power/supply/cros_usbpd-charger.c +index cadb6a0c..b6c96376 100644 +--- a/drivers/power/supply/cros_usbpd-charger.c ++++ b/drivers/power/supply/cros_usbpd-charger.c +@@ -276,7 +276,7 @@ static int cros_usbpd_charger_get_power_info(struct port_data *port) + port->psy_current_max = 0; + break; + default: +- dev_err(dev, "Port %d: default case!\n", port->port_number); ++ dev_dbg(dev, "Port %d: default case!\n", port->port_number); + port->psy_usb_type = POWER_SUPPLY_USB_TYPE_SDP; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-080-power-supply-axp288_fuel_gauge-Added-check-for.patch b/patches.kernel.org/6.2.12-080-power-supply-axp288_fuel_gauge-Added-check-for.patch new file mode 100644 index 0000000..4b3260b --- /dev/null +++ b/patches.kernel.org/6.2.12-080-power-supply-axp288_fuel_gauge-Added-check-for.patch @@ -0,0 +1,41 @@ +From: Denis Arefev +Date: Tue, 6 Dec 2022 12:17:23 +0300 +Subject: [PATCH] power: supply: axp288_fuel_gauge: Added check for negative + values +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: bf6c880d5d1448489ebf92e2d13d5713ff644930 + +[ Upstream commit bf6c880d5d1448489ebf92e2d13d5713ff644930 ] + +Variable 'pirq', which may receive negative value +in platform_get_irq(). +Used as an index in a function regmap_irq_get_virq(). + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Denis Arefev +Reviewed-by: Hans de Goede +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/power/supply/axp288_fuel_gauge.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/power/supply/axp288_fuel_gauge.c b/drivers/power/supply/axp288_fuel_gauge.c +index 8e6f8a65..05f41317 100644 +--- a/drivers/power/supply/axp288_fuel_gauge.c ++++ b/drivers/power/supply/axp288_fuel_gauge.c +@@ -724,6 +724,8 @@ static int axp288_fuel_gauge_probe(struct platform_device *pdev) + + for (i = 0; i < AXP288_FG_INTR_NUM; i++) { + pirq = platform_get_irq(pdev, i); ++ if (pirq < 0) ++ continue; + ret = regmap_irq_get_virq(axp20x->regmap_irqc, pirq); + if (ret < 0) + return dev_err_probe(dev, ret, "getting vIRQ %d\n", pirq); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-081-selftests-bpf-Fix-progs-find_vma_fail1.c-build.patch b/patches.kernel.org/6.2.12-081-selftests-bpf-Fix-progs-find_vma_fail1.c-build.patch new file mode 100644 index 0000000..2bf6a3b --- /dev/null +++ b/patches.kernel.org/6.2.12-081-selftests-bpf-Fix-progs-find_vma_fail1.c-build.patch @@ -0,0 +1,35 @@ +From: Alexei Starovoitov +Date: Fri, 10 Mar 2023 12:41:18 -0800 +Subject: [PATCH] selftests/bpf: Fix progs/find_vma_fail1.c build error. +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 32513d40d908b267508d37994753d9bd1600914b + +[ Upstream commit 32513d40d908b267508d37994753d9bd1600914b ] + +The commit 11e456cae91e ("selftests/bpf: Fix compilation errors: Assign a value to a constant") +fixed the issue cleanly in bpf-next. +This is an alternative fix in bpf tree to avoid merge conflict between bpf and bpf-next. + +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/bpf/progs/find_vma_fail1.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/bpf/progs/find_vma_fail1.c b/tools/testing/selftests/bpf/progs/find_vma_fail1.c +index b3b326b8..6dab9cff 100644 +--- a/tools/testing/selftests/bpf/progs/find_vma_fail1.c ++++ b/tools/testing/selftests/bpf/progs/find_vma_fail1.c +@@ -2,6 +2,7 @@ + /* Copyright (c) 2021 Facebook */ + #include "vmlinux.h" + #include ++#define vm_flags vm_start + + char _license[] SEC("license") = "GPL"; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-082-wifi-mwifiex-mark-OF-related-data-as-maybe-unu.patch b/patches.kernel.org/6.2.12-082-wifi-mwifiex-mark-OF-related-data-as-maybe-unu.patch new file mode 100644 index 0000000..40f6f2c --- /dev/null +++ b/patches.kernel.org/6.2.12-082-wifi-mwifiex-mark-OF-related-data-as-maybe-unu.patch @@ -0,0 +1,58 @@ +From: Krzysztof Kozlowski +Date: Sun, 12 Mar 2023 14:25:23 +0100 +Subject: [PATCH] wifi: mwifiex: mark OF related data as maybe unused +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 139f6973bf140c65d4d1d4bde5485badb4454d7a + +[ Upstream commit 139f6973bf140c65d4d1d4bde5485badb4454d7a ] + +The driver can be compile tested with !CONFIG_OF making certain data +unused: + + drivers/net/wireless/marvell/mwifiex/sdio.c:498:34: error: ‘mwifiex_sdio_of_match_table’ defined but not used [-Werror=unused-const-variable=] + drivers/net/wireless/marvell/mwifiex/pcie.c:175:34: error: ‘mwifiex_pcie_of_match_table’ defined but not used [-Werror=unused-const-variable=] + +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230312132523.352182-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/marvell/mwifiex/pcie.c | 2 +- + drivers/net/wireless/marvell/mwifiex/sdio.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c +index 5dcf6176..9a698a16 100644 +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -172,7 +172,7 @@ static const struct mwifiex_pcie_device mwifiex_pcie8997 = { + .can_ext_scan = true, + }; + +-static const struct of_device_id mwifiex_pcie_of_match_table[] = { ++static const struct of_device_id mwifiex_pcie_of_match_table[] __maybe_unused = { + { .compatible = "pci11ab,2b42" }, + { .compatible = "pci1b4b,2b42" }, + { } +diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c +index 9f506efa..ea1c1c24 100644 +--- a/drivers/net/wireless/marvell/mwifiex/sdio.c ++++ b/drivers/net/wireless/marvell/mwifiex/sdio.c +@@ -479,7 +479,7 @@ static struct memory_type_mapping mem_type_mapping_tbl[] = { + {"EXTLAST", NULL, 0, 0xFE}, + }; + +-static const struct of_device_id mwifiex_sdio_of_match_table[] = { ++static const struct of_device_id mwifiex_sdio_of_match_table[] __maybe_unused = { + { .compatible = "marvell,sd8787" }, + { .compatible = "marvell,sd8897" }, + { .compatible = "marvell,sd8997" }, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-083-i2c-imx-lpi2c-clean-rx-tx-buffers-upon-new-mes.patch b/patches.kernel.org/6.2.12-083-i2c-imx-lpi2c-clean-rx-tx-buffers-upon-new-mes.patch new file mode 100644 index 0000000..6f11315 --- /dev/null +++ b/patches.kernel.org/6.2.12-083-i2c-imx-lpi2c-clean-rx-tx-buffers-upon-new-mes.patch @@ -0,0 +1,37 @@ +From: Alexander Stein +Date: Mon, 30 Jan 2023 16:32:46 +0100 +Subject: [PATCH] i2c: imx-lpi2c: clean rx/tx buffers upon new message +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 987dd36c0141f6ab9f0fbf14d6b2ec3342dedb2f + +[ Upstream commit 987dd36c0141f6ab9f0fbf14d6b2ec3342dedb2f ] + +When start sending a new message clear the Rx & Tx buffer pointers in +order to avoid using stale pointers. + +Signed-off-by: Alexander Stein +Tested-by: Emanuele Ghidoli +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/i2c/busses/i2c-imx-lpi2c.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-imx-lpi2c.c b/drivers/i2c/busses/i2c-imx-lpi2c.c +index 9b2f9544..a49b14d5 100644 +--- a/drivers/i2c/busses/i2c-imx-lpi2c.c ++++ b/drivers/i2c/busses/i2c-imx-lpi2c.c +@@ -463,6 +463,8 @@ static int lpi2c_imx_xfer(struct i2c_adapter *adapter, + if (num == 1 && msgs[0].len == 0) + goto stop; + ++ lpi2c_imx->rx_buf = NULL; ++ lpi2c_imx->tx_buf = NULL; + lpi2c_imx->delivered = 0; + lpi2c_imx->msglen = msgs[i].len; + init_completion(&lpi2c_imx->complete); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-084-i2c-hisi-Avoid-redundant-interrupts.patch b/patches.kernel.org/6.2.12-084-i2c-hisi-Avoid-redundant-interrupts.patch new file mode 100644 index 0000000..a819d5e --- /dev/null +++ b/patches.kernel.org/6.2.12-084-i2c-hisi-Avoid-redundant-interrupts.patch @@ -0,0 +1,44 @@ +From: Yicong Yang +Date: Mon, 13 Mar 2023 15:45:51 +0800 +Subject: [PATCH] i2c: hisi: Avoid redundant interrupts +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: cc9812a3096d1986caca9a23bee99effc45c08df + +[ Upstream commit cc9812a3096d1986caca9a23bee99effc45c08df ] + +After issuing all the messages we can disable the TX_EMPTY interrupts +to avoid handling redundant interrupts. For doing a sinlge bus +detection (i2cdetect -y -r 0) we can reduce ~97% interrupts (before +~12000 after ~400). + +Signed-off-by: Sheng Feng +Signed-off-by: Yicong Yang +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/i2c/busses/i2c-hisi.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-hisi.c b/drivers/i2c/busses/i2c-hisi.c +index f5c37d2f..e067671b 100644 +--- a/drivers/i2c/busses/i2c-hisi.c ++++ b/drivers/i2c/busses/i2c-hisi.c +@@ -316,6 +316,13 @@ static void hisi_i2c_xfer_msg(struct hisi_i2c_controller *ctlr) + max_write == 0) + break; + } ++ ++ /* ++ * Disable the TX_EMPTY interrupt after finishing all the messages to ++ * avoid overwhelming the CPU. ++ */ ++ if (ctlr->msg_tx_idx == ctlr->msg_num) ++ hisi_i2c_disable_int(ctlr, HISI_I2C_INT_TX_EMPTY); + } + + static irqreturn_t hisi_i2c_irq(int irq, void *context) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-085-efi-sysfb_efi-Add-quirk-for-Lenovo-Yoga-Book-X.patch b/patches.kernel.org/6.2.12-085-efi-sysfb_efi-Add-quirk-for-Lenovo-Yoga-Book-X.patch new file mode 100644 index 0000000..38ef9aa --- /dev/null +++ b/patches.kernel.org/6.2.12-085-efi-sysfb_efi-Add-quirk-for-Lenovo-Yoga-Book-X.patch @@ -0,0 +1,44 @@ +From: Hans de Goede +Date: Tue, 14 Mar 2023 13:31:03 +0100 +Subject: [PATCH] efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 5ed213dd64681f84a01ceaa82fb336cf7d59ddcf + +[ Upstream commit 5ed213dd64681f84a01ceaa82fb336cf7d59ddcf ] + +Another Lenovo convertable which reports a landscape resolution of +1920x1200 with a pitch of (1920 * 4) bytes, while the actual framebuffer +has a resolution of 1200x1920 with a pitch of (1200 * 4) bytes. + +Signed-off-by: Hans de Goede +Reviewed-by: Javier Martinez Canillas +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/firmware/efi/sysfb_efi.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/firmware/efi/sysfb_efi.c b/drivers/firmware/efi/sysfb_efi.c +index e76d6803..456d0e5e 100644 +--- a/drivers/firmware/efi/sysfb_efi.c ++++ b/drivers/firmware/efi/sysfb_efi.c +@@ -272,6 +272,14 @@ static const struct dmi_system_id efifb_dmi_swap_width_height[] __initconst = { + "IdeaPad Duet 3 10IGL5"), + }, + }, ++ { ++ /* Lenovo Yoga Book X91F / X91L */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ /* Non exact match to match F + L versions */ ++ DMI_MATCH(DMI_PRODUCT_NAME, "Lenovo YB1-X91"), ++ }, ++ }, + {}, + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-086-block-ublk_drv-mark-device-as-LIVE-before-addi.patch b/patches.kernel.org/6.2.12-086-block-ublk_drv-mark-device-as-LIVE-before-addi.patch new file mode 100644 index 0000000..b8c8b88 --- /dev/null +++ b/patches.kernel.org/6.2.12-086-block-ublk_drv-mark-device-as-LIVE-before-addi.patch @@ -0,0 +1,53 @@ +From: Ming Lei +Date: Sat, 18 Mar 2023 22:12:31 +0800 +Subject: [PATCH] block: ublk_drv: mark device as LIVE before adding disk +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 4985e7b2c002eb4c5c794a1d3acd91b82c89a0fd + +[ Upstream commit 4985e7b2c002eb4c5c794a1d3acd91b82c89a0fd ] + +IO can be started before add_disk() returns, such as reading parititon table, +then the monitor work should work for making forward progress. + +So mark device as LIVE before adding disk, meantime change to +DEAD if add_disk() fails. + +Fixed: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") +Reviewed-by: Ziyang Zhang +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20230318141231.55562-1-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/block/ublk_drv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c +index 2ed994a3..c0cbc5f3 100644 +--- a/drivers/block/ublk_drv.c ++++ b/drivers/block/ublk_drv.c +@@ -1571,17 +1571,18 @@ static int ublk_ctrl_start_dev(struct io_uring_cmd *cmd) + set_bit(GD_SUPPRESS_PART_SCAN, &disk->state); + + get_device(&ub->cdev_dev); ++ ub->dev_info.state = UBLK_S_DEV_LIVE; + ret = add_disk(disk); + if (ret) { + /* + * Has to drop the reference since ->free_disk won't be + * called in case of add_disk failure. + */ ++ ub->dev_info.state = UBLK_S_DEV_DEAD; + ublk_put_device(ub); + goto out_put_disk; + } + set_bit(UB_STATE_USED, &ub->state); +- ub->dev_info.state = UBLK_S_DEV_LIVE; + out_put_disk: + if (ret) + put_disk(disk); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-087-ACPI-video-Add-backlight-native-DMI-quirk-for-.patch b/patches.kernel.org/6.2.12-087-ACPI-video-Add-backlight-native-DMI-quirk-for-.patch new file mode 100644 index 0000000..1c053ae --- /dev/null +++ b/patches.kernel.org/6.2.12-087-ACPI-video-Add-backlight-native-DMI-quirk-for-.patch @@ -0,0 +1,47 @@ +From: Hans de Goede +Date: Mon, 20 Mar 2023 16:59:46 +0100 +Subject: [PATCH] ACPI: video: Add backlight=native DMI quirk for Acer Aspire + 3830TG +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 5e7a3bf65db57461d0f47955248fcadf37321a74 + +[ Upstream commit 5e7a3bf65db57461d0f47955248fcadf37321a74 ] + +The Acer Aspire 3830TG predates Windows 8, so it defaults to using +acpi_video# for backlight control, but this is non functional on +this model. + +Add a DMI quirk to use the native backlight interface which does +work properly. + +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/acpi/video_detect.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c +index b3b0b069..e85729fc 100644 +--- a/drivers/acpi/video_detect.c ++++ b/drivers/acpi/video_detect.c +@@ -532,6 +532,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Precision 7510"), + }, + }, ++ { ++ .callback = video_detect_force_native, ++ /* Acer Aspire 3830TG */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 3830TG"), ++ }, ++ }, + { + .callback = video_detect_force_native, + /* Acer Aspire 4810T */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-088-drm-panel-orientation-quirks-Add-quirk-for-Len.patch b/patches.kernel.org/6.2.12-088-drm-panel-orientation-quirks-Add-quirk-for-Len.patch new file mode 100644 index 0000000..38672c6 --- /dev/null +++ b/patches.kernel.org/6.2.12-088-drm-panel-orientation-quirks-Add-quirk-for-Len.patch @@ -0,0 +1,57 @@ +From: Hans de Goede +Date: Wed, 1 Mar 2023 10:52:18 +0100 +Subject: [PATCH] drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Book + X90F +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 03aecb1acbcd7a660f97d645ca6c09d9de27ff9d + +[ Upstream commit 03aecb1acbcd7a660f97d645ca6c09d9de27ff9d ] + +Like the Windows Lenovo Yoga Book X91F/L the Android Lenovo Yoga Book +X90F/L has a portrait 1200x1920 screen used in landscape mode, +add a quirk for this. + +When the quirk for the X91F/L was initially added it was written to +also apply to the X90F/L but this does not work because the Android +version of the Yoga Book uses completely different DMI strings. +Also adjust the X91F/L quirk to reflect that it only applies to +the X91F/L models. + +Signed-off-by: Hans de Goede +Reviewed-by: Javier Martinez Canillas +Link: https://patchwork.freedesktop.org/patch/msgid/20230301095218.28457-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 5522d610..b1a38e6c 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -328,10 +328,17 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "IdeaPad Duet 3 10IGL5"), + }, + .driver_data = (void *)&lcd1200x1920_rightside_up, +- }, { /* Lenovo Yoga Book X90F / X91F / X91L */ ++ }, { /* Lenovo Yoga Book X90F / X90L */ + .matches = { +- /* Non exact match to match all versions */ +- DMI_MATCH(DMI_PRODUCT_NAME, "Lenovo YB1-X9"), ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "YETI-11"), ++ }, ++ .driver_data = (void *)&lcd1200x1920_rightside_up, ++ }, { /* Lenovo Yoga Book X91F / X91L */ ++ .matches = { ++ /* Non exact match to match F + L versions */ ++ DMI_MATCH(DMI_PRODUCT_NAME, "Lenovo YB1-X91"), + }, + .driver_data = (void *)&lcd1200x1920_rightside_up, + }, { /* Lenovo Yoga Tablet 2 830F / 830L */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-089-hwmon-peci-cputemp-Fix-miscalculated-DTS-for-S.patch b/patches.kernel.org/6.2.12-089-hwmon-peci-cputemp-Fix-miscalculated-DTS-for-S.patch new file mode 100644 index 0000000..7c0df4b --- /dev/null +++ b/patches.kernel.org/6.2.12-089-hwmon-peci-cputemp-Fix-miscalculated-DTS-for-S.patch @@ -0,0 +1,52 @@ +From: Iwona Winiarska +Date: Tue, 21 Mar 2023 10:04:10 +0100 +Subject: [PATCH] hwmon: (peci/cputemp) Fix miscalculated DTS for SKX +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 2b91c4a870c9830eaf95e744454c9c218cccb736 + +[ Upstream commit 2b91c4a870c9830eaf95e744454c9c218cccb736 ] + +For Skylake, DTS temperature of the CPU is reported in S10.6 format +instead of S8.8. + +Reported-by: Paul Fertser +Link: https://lore.kernel.org/lkml/ZBhHS7v+98NK56is@home.paul.comp/ +Signed-off-by: Iwona Winiarska +Link: https://lore.kernel.org/r/20230321090410.866766-1-iwona.winiarska@intel.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hwmon/peci/cputemp.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwmon/peci/cputemp.c b/drivers/hwmon/peci/cputemp.c +index 30850a47..87d56f0f 100644 +--- a/drivers/hwmon/peci/cputemp.c ++++ b/drivers/hwmon/peci/cputemp.c +@@ -537,6 +537,12 @@ static const struct cpu_info cpu_hsx = { + .thermal_margin_to_millidegree = &dts_eight_dot_eight_to_millidegree, + }; + ++static const struct cpu_info cpu_skx = { ++ .reg = &resolved_cores_reg_hsx, ++ .min_peci_revision = 0x33, ++ .thermal_margin_to_millidegree = &dts_ten_dot_six_to_millidegree, ++}; ++ + static const struct cpu_info cpu_icx = { + .reg = &resolved_cores_reg_icx, + .min_peci_revision = 0x40, +@@ -558,7 +564,7 @@ static const struct auxiliary_device_id peci_cputemp_ids[] = { + }, + { + .name = "peci_cpu.cputemp.skx", +- .driver_data = (kernel_ulong_t)&cpu_hsx, ++ .driver_data = (kernel_ulong_t)&cpu_skx, + }, + { + .name = "peci_cpu.cputemp.icx", +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-090-hwmon-xgene-Fix-ioremap-and-memremap-leak.patch b/patches.kernel.org/6.2.12-090-hwmon-xgene-Fix-ioremap-and-memremap-leak.patch new file mode 100644 index 0000000..d1d49cc --- /dev/null +++ b/patches.kernel.org/6.2.12-090-hwmon-xgene-Fix-ioremap-and-memremap-leak.patch @@ -0,0 +1,60 @@ +From: Tianyi Jing +Date: Sat, 18 Mar 2023 22:38:51 +0800 +Subject: [PATCH] hwmon: (xgene) Fix ioremap and memremap leak +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 813cc94c7847ae4a17e9f744fb4dbdf7df6bd732 + +[ Upstream commit 813cc94c7847ae4a17e9f744fb4dbdf7df6bd732 ] + +Smatch reports: + +drivers/hwmon/xgene-hwmon.c:757 xgene_hwmon_probe() warn: +'ctx->pcc_comm_addr' from ioremap() not released on line: 757. + +This is because in drivers/hwmon/xgene-hwmon.c:701 xgene_hwmon_probe(), +ioremap and memremap is not released, which may cause a leak. + +To fix this, ioremap and memremap is modified to devm_ioremap and +devm_memremap. + +Signed-off-by: Tianyi Jing +Reviewed-by: Dongliang Mu +Link: https://lore.kernel.org/r/20230318143851.2191625-1-jingfelix@hust.edu.cn +[groeck: Fixed formatting and subject] +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hwmon/xgene-hwmon.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/hwmon/xgene-hwmon.c b/drivers/hwmon/xgene-hwmon.c +index d1abea49..78d9f52e 100644 +--- a/drivers/hwmon/xgene-hwmon.c ++++ b/drivers/hwmon/xgene-hwmon.c +@@ -698,14 +698,14 @@ static int xgene_hwmon_probe(struct platform_device *pdev) + ctx->comm_base_addr = pcc_chan->shmem_base_addr; + if (ctx->comm_base_addr) { + if (version == XGENE_HWMON_V2) +- ctx->pcc_comm_addr = (void __force *)ioremap( +- ctx->comm_base_addr, +- pcc_chan->shmem_size); ++ ctx->pcc_comm_addr = (void __force *)devm_ioremap(&pdev->dev, ++ ctx->comm_base_addr, ++ pcc_chan->shmem_size); + else +- ctx->pcc_comm_addr = memremap( +- ctx->comm_base_addr, +- pcc_chan->shmem_size, +- MEMREMAP_WB); ++ ctx->pcc_comm_addr = devm_memremap(&pdev->dev, ++ ctx->comm_base_addr, ++ pcc_chan->shmem_size, ++ MEMREMAP_WB); + } else { + dev_err(&pdev->dev, "Failed to get PCC comm region\n"); + rc = -ENODEV; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-091-verify_pefile-relax-wrapper-length-check.patch b/patches.kernel.org/6.2.12-091-verify_pefile-relax-wrapper-length-check.patch new file mode 100644 index 0000000..6038e0c --- /dev/null +++ b/patches.kernel.org/6.2.12-091-verify_pefile-relax-wrapper-length-check.patch @@ -0,0 +1,62 @@ +From: Robbie Harwood +Date: Mon, 20 Feb 2023 12:12:53 -0500 +Subject: [PATCH] verify_pefile: relax wrapper length check +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 4fc5c74dde69a7eda172514aaeb5a7df3600adb3 + +[ Upstream commit 4fc5c74dde69a7eda172514aaeb5a7df3600adb3 ] + +The PE Format Specification (section "The Attribute Certificate Table +(Image Only)") states that `dwLength` is to be rounded up to 8-byte +alignment when used for traversal. Therefore, the field is not required +to be an 8-byte multiple in the first place. + +Accordingly, pesign has not performed this alignment since version +0.110. This causes kexec failure on pesign'd binaries with "PEFILE: +Signature wrapper len wrong". Update the comment and relax the check. + +Signed-off-by: Robbie Harwood +Signed-off-by: David Howells +cc: Jarkko Sakkinen +cc: Eric Biederman +cc: Herbert Xu +cc: keyrings@vger.kernel.org +cc: linux-crypto@vger.kernel.org +cc: kexec@lists.infradead.org +Link: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#the-attribute-certificate-table-image-only +Link: https://github.com/rhboot/pesign +Link: https://lore.kernel.org/r/20230220171254.592347-2-rharwood@redhat.com/ # v2 +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + crypto/asymmetric_keys/verify_pefile.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/crypto/asymmetric_keys/verify_pefile.c b/crypto/asymmetric_keys/verify_pefile.c +index 7553ab18..fe1bb374 100644 +--- a/crypto/asymmetric_keys/verify_pefile.c ++++ b/crypto/asymmetric_keys/verify_pefile.c +@@ -135,11 +135,15 @@ static int pefile_strip_sig_wrapper(const void *pebuf, + pr_debug("sig wrapper = { %x, %x, %x }\n", + wrapper.length, wrapper.revision, wrapper.cert_type); + +- /* Both pesign and sbsign round up the length of certificate table +- * (in optional header data directories) to 8 byte alignment. ++ /* sbsign rounds up the length of certificate table (in optional ++ * header data directories) to 8 byte alignment. However, the PE ++ * specification states that while entries are 8-byte aligned, this is ++ * not included in their length, and as a result, pesign has not ++ * rounded up since 0.110. + */ +- if (round_up(wrapper.length, 8) != ctx->sig_len) { +- pr_debug("Signature wrapper len wrong\n"); ++ if (wrapper.length > ctx->sig_len) { ++ pr_debug("Signature wrapper bigger than sig len (%x > %x)\n", ++ ctx->sig_len, wrapper.length); + return -ELIBBAD; + } + if (wrapper.revision != WIN_CERT_REVISION_2_0) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-092-asymmetric_keys-log-on-fatal-failures-in-PE-pk.patch b/patches.kernel.org/6.2.12-092-asymmetric_keys-log-on-fatal-failures-in-PE-pk.patch new file mode 100644 index 0000000..8d4fac5 --- /dev/null +++ b/patches.kernel.org/6.2.12-092-asymmetric_keys-log-on-fatal-failures-in-PE-pk.patch @@ -0,0 +1,159 @@ +From: Robbie Harwood +Date: Mon, 20 Feb 2023 12:12:54 -0500 +Subject: [PATCH] asymmetric_keys: log on fatal failures in PE/pkcs7 +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 3584c1dbfffdabf8e3dc1dd25748bb38dd01cd43 + +[ Upstream commit 3584c1dbfffdabf8e3dc1dd25748bb38dd01cd43 ] + +These particular errors can be encountered while trying to kexec when +secureboot lockdown is in place. Without this change, even with a +signed debug build, one still needs to reboot the machine to add the +appropriate dyndbg parameters (since lockdown blocks debugfs). + +Accordingly, upgrade all pr_debug() before fatal error into pr_warn(). + +Signed-off-by: Robbie Harwood +Signed-off-by: David Howells +cc: Jarkko Sakkinen +cc: Eric Biederman +cc: Herbert Xu +cc: keyrings@vger.kernel.org +cc: linux-crypto@vger.kernel.org +cc: kexec@lists.infradead.org +Link: https://lore.kernel.org/r/20230220171254.592347-3-rharwood@redhat.com/ # v2 +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + crypto/asymmetric_keys/pkcs7_verify.c | 10 +++++----- + crypto/asymmetric_keys/verify_pefile.c | 24 ++++++++++++------------ + 2 files changed, 17 insertions(+), 17 deletions(-) + +diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c +index f6321c78..3da32813 100644 +--- a/crypto/asymmetric_keys/pkcs7_verify.c ++++ b/crypto/asymmetric_keys/pkcs7_verify.c +@@ -79,16 +79,16 @@ static int pkcs7_digest(struct pkcs7_message *pkcs7, + } + + if (sinfo->msgdigest_len != sig->digest_size) { +- pr_debug("Sig %u: Invalid digest size (%u)\n", +- sinfo->index, sinfo->msgdigest_len); ++ pr_warn("Sig %u: Invalid digest size (%u)\n", ++ sinfo->index, sinfo->msgdigest_len); + ret = -EBADMSG; + goto error; + } + + if (memcmp(sig->digest, sinfo->msgdigest, + sinfo->msgdigest_len) != 0) { +- pr_debug("Sig %u: Message digest doesn't match\n", +- sinfo->index); ++ pr_warn("Sig %u: Message digest doesn't match\n", ++ sinfo->index); + ret = -EKEYREJECTED; + goto error; + } +@@ -478,7 +478,7 @@ int pkcs7_supply_detached_data(struct pkcs7_message *pkcs7, + const void *data, size_t datalen) + { + if (pkcs7->data) { +- pr_debug("Data already supplied\n"); ++ pr_warn("Data already supplied\n"); + return -EINVAL; + } + pkcs7->data = data; +diff --git a/crypto/asymmetric_keys/verify_pefile.c b/crypto/asymmetric_keys/verify_pefile.c +index fe1bb374..22beaf22 100644 +--- a/crypto/asymmetric_keys/verify_pefile.c ++++ b/crypto/asymmetric_keys/verify_pefile.c +@@ -74,7 +74,7 @@ static int pefile_parse_binary(const void *pebuf, unsigned int pelen, + break; + + default: +- pr_debug("Unknown PEOPT magic = %04hx\n", pe32->magic); ++ pr_warn("Unknown PEOPT magic = %04hx\n", pe32->magic); + return -ELIBBAD; + } + +@@ -95,7 +95,7 @@ static int pefile_parse_binary(const void *pebuf, unsigned int pelen, + ctx->certs_size = ddir->certs.size; + + if (!ddir->certs.virtual_address || !ddir->certs.size) { +- pr_debug("Unsigned PE binary\n"); ++ pr_warn("Unsigned PE binary\n"); + return -ENODATA; + } + +@@ -127,7 +127,7 @@ static int pefile_strip_sig_wrapper(const void *pebuf, + unsigned len; + + if (ctx->sig_len < sizeof(wrapper)) { +- pr_debug("Signature wrapper too short\n"); ++ pr_warn("Signature wrapper too short\n"); + return -ELIBBAD; + } + +@@ -142,16 +142,16 @@ static int pefile_strip_sig_wrapper(const void *pebuf, + * rounded up since 0.110. + */ + if (wrapper.length > ctx->sig_len) { +- pr_debug("Signature wrapper bigger than sig len (%x > %x)\n", +- ctx->sig_len, wrapper.length); ++ pr_warn("Signature wrapper bigger than sig len (%x > %x)\n", ++ ctx->sig_len, wrapper.length); + return -ELIBBAD; + } + if (wrapper.revision != WIN_CERT_REVISION_2_0) { +- pr_debug("Signature is not revision 2.0\n"); ++ pr_warn("Signature is not revision 2.0\n"); + return -ENOTSUPP; + } + if (wrapper.cert_type != WIN_CERT_TYPE_PKCS_SIGNED_DATA) { +- pr_debug("Signature certificate type is not PKCS\n"); ++ pr_warn("Signature certificate type is not PKCS\n"); + return -ENOTSUPP; + } + +@@ -164,7 +164,7 @@ static int pefile_strip_sig_wrapper(const void *pebuf, + ctx->sig_offset += sizeof(wrapper); + ctx->sig_len -= sizeof(wrapper); + if (ctx->sig_len < 4) { +- pr_debug("Signature data missing\n"); ++ pr_warn("Signature data missing\n"); + return -EKEYREJECTED; + } + +@@ -198,7 +198,7 @@ static int pefile_strip_sig_wrapper(const void *pebuf, + return 0; + } + not_pkcs7: +- pr_debug("Signature data not PKCS#7\n"); ++ pr_warn("Signature data not PKCS#7\n"); + return -ELIBBAD; + } + +@@ -341,8 +341,8 @@ static int pefile_digest_pe(const void *pebuf, unsigned int pelen, + digest_size = crypto_shash_digestsize(tfm); + + if (digest_size != ctx->digest_len) { +- pr_debug("Digest size mismatch (%zx != %x)\n", +- digest_size, ctx->digest_len); ++ pr_warn("Digest size mismatch (%zx != %x)\n", ++ digest_size, ctx->digest_len); + ret = -EBADMSG; + goto error_no_desc; + } +@@ -373,7 +373,7 @@ static int pefile_digest_pe(const void *pebuf, unsigned int pelen, + * PKCS#7 certificate. + */ + if (memcmp(digest, ctx->digest, ctx->digest_len) != 0) { +- pr_debug("Digest mismatch\n"); ++ pr_warn("Digest mismatch\n"); + ret = -EKEYREJECTED; + } else { + pr_debug("The digests match!\n"); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-093-nvme-send-Identify-with-CNS-06h-only-to-I-O-co.patch b/patches.kernel.org/6.2.12-093-nvme-send-Identify-with-CNS-06h-only-to-I-O-co.patch new file mode 100644 index 0000000..efa9da6 --- /dev/null +++ b/patches.kernel.org/6.2.12-093-nvme-send-Identify-with-CNS-06h-only-to-I-O-co.patch @@ -0,0 +1,41 @@ +From: Martin George +Date: Thu, 16 Mar 2023 17:20:09 +0530 +Subject: [PATCH] nvme: send Identify with CNS 06h only to I/O controllers +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: def84ab600b71ea3fcc422a876d5d0d0daa7d4f3 + +[ Upstream commit def84ab600b71ea3fcc422a876d5d0d0daa7d4f3 ] + +Identify CNS 06h (I/O Command Set Specific Identify Controller data +structure) is supported only on i/o controllers. + +But nvme_init_non_mdts_limits() currently invokes this on all +controllers. Correct this by ensuring this is sent to I/O +controllers only. + +Signed-off-by: Martin George +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/nvme/host/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index ee1b075d..c0429f9f 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3106,7 +3106,8 @@ static int nvme_init_non_mdts_limits(struct nvme_ctrl *ctrl) + else + ctrl->max_zeroes_sectors = 0; + +- if (nvme_ctrl_limited_cns(ctrl)) ++ if (ctrl->subsys->subtype != NVME_NQN_NVME || ++ nvme_ctrl_limited_cns(ctrl)) + return 0; + + id = kzalloc(sizeof(*id), GFP_KERNEL); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-094-wifi-iwlwifi-mvm-fix-mvmtxq-stopped-handling.patch b/patches.kernel.org/6.2.12-094-wifi-iwlwifi-mvm-fix-mvmtxq-stopped-handling.patch new file mode 100644 index 0000000..2b9b634 --- /dev/null +++ b/patches.kernel.org/6.2.12-094-wifi-iwlwifi-mvm-fix-mvmtxq-stopped-handling.patch @@ -0,0 +1,98 @@ +From: Johannes Berg +Date: Fri, 17 Mar 2023 10:53:24 +0100 +Subject: [PATCH] wifi: iwlwifi: mvm: fix mvmtxq->stopped handling +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: b58e3d4311b54b6dd0e37165277965da0c9eb21d + +[ Upstream commit b58e3d4311b54b6dd0e37165277965da0c9eb21d ] + +This could race if the queue is redirected while full, then +the flushing internally would start it while it's not yet +usable again. Fix it by using two state bits instead of just +one. + +Reviewed-by: Benjamin Berg +Tested-by: Jose Ignacio Tornos Martinez +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 5 ++++- + drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 4 +++- + drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 5 ++++- + drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 4 ++-- + 4 files changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index 5273ade7..5b497418 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -732,7 +732,10 @@ void iwl_mvm_mac_itxq_xmit(struct ieee80211_hw *hw, struct ieee80211_txq *txq) + + rcu_read_lock(); + do { +- while (likely(!mvmtxq->stopped && ++ while (likely(!test_bit(IWL_MVM_TXQ_STATE_STOP_FULL, ++ &mvmtxq->state) && ++ !test_bit(IWL_MVM_TXQ_STATE_STOP_REDIRECT, ++ &mvmtxq->state) && + !test_bit(IWL_MVM_STATUS_IN_D3, &mvm->status))) { + skb = ieee80211_tx_dequeue(hw, txq); + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +index ce6b701f..3146b3d0 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +@@ -729,7 +729,9 @@ struct iwl_mvm_txq { + struct list_head list; + u16 txq_id; + atomic_t tx_request; +- bool stopped; ++#define IWL_MVM_TXQ_STATE_STOP_FULL 0 ++#define IWL_MVM_TXQ_STATE_STOP_REDIRECT 1 ++ unsigned long state; + }; + + static inline struct iwl_mvm_txq * +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +index ebe6d9c4..f43e617f 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +@@ -1690,7 +1690,10 @@ static void iwl_mvm_queue_state_change(struct iwl_op_mode *op_mode, + + txq = sta->txq[tid]; + mvmtxq = iwl_mvm_txq_from_mac80211(txq); +- mvmtxq->stopped = !start; ++ if (start) ++ clear_bit(IWL_MVM_TXQ_STATE_STOP_FULL, &mvmtxq->state); ++ else ++ set_bit(IWL_MVM_TXQ_STATE_STOP_FULL, &mvmtxq->state); + + if (start && mvmsta->sta_state != IEEE80211_STA_NOTEXIST) + iwl_mvm_mac_itxq_xmit(mvm->hw, txq); +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +index 69634fb8..21ad7b85 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +@@ -693,7 +693,7 @@ static int iwl_mvm_redirect_queue(struct iwl_mvm *mvm, int queue, int tid, + queue, iwl_mvm_ac_to_tx_fifo[ac]); + + /* Stop the queue and wait for it to empty */ +- txq->stopped = true; ++ set_bit(IWL_MVM_TXQ_STATE_STOP_REDIRECT, &txq->state); + + ret = iwl_trans_wait_tx_queues_empty(mvm->trans, BIT(queue)); + if (ret) { +@@ -736,7 +736,7 @@ static int iwl_mvm_redirect_queue(struct iwl_mvm *mvm, int queue, int tid, + + out: + /* Continue using the queue */ +- txq->stopped = false; ++ clear_bit(IWL_MVM_TXQ_STATE_STOP_REDIRECT, &txq->state); + + return ret; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-095-wifi-iwlwifi-mvm-protect-TXQ-list-manipulation.patch b/patches.kernel.org/6.2.12-095-wifi-iwlwifi-mvm-protect-TXQ-list-manipulation.patch new file mode 100644 index 0000000..b7547cd --- /dev/null +++ b/patches.kernel.org/6.2.12-095-wifi-iwlwifi-mvm-protect-TXQ-list-manipulation.patch @@ -0,0 +1,190 @@ +From: Johannes Berg +Date: Fri, 17 Mar 2023 10:53:25 +0100 +Subject: [PATCH] wifi: iwlwifi: mvm: protect TXQ list manipulation +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 923bf981eb6ecc027227716e30701bdcc1845fbf + +[ Upstream commit 923bf981eb6ecc027227716e30701bdcc1845fbf ] + +Some recent upstream debugging uncovered the fact that in +iwlwifi, the TXQ list manipulation is racy. + +Introduce a new state bit for when the TXQ is completely +ready and can be used without locking, and if that's not +set yet acquire the lock to check everything correctly. + +Reviewed-by: Benjamin Berg +Tested-by: Jose Ignacio Tornos Martinez +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 45 ++++++------------- + drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 2 + + drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 1 + + drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 25 +++++++++-- + 4 files changed, 39 insertions(+), 34 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index 5b497418..1d46a2b3 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -760,42 +760,25 @@ static void iwl_mvm_mac_wake_tx_queue(struct ieee80211_hw *hw, + struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw); + struct iwl_mvm_txq *mvmtxq = iwl_mvm_txq_from_mac80211(txq); + +- /* +- * Please note that racing is handled very carefully here: +- * mvmtxq->txq_id is updated during allocation, and mvmtxq->list is +- * deleted afterwards. +- * This means that if: +- * mvmtxq->txq_id != INVALID_QUEUE && list_empty(&mvmtxq->list): +- * queue is allocated and we can TX. +- * mvmtxq->txq_id != INVALID_QUEUE && !list_empty(&mvmtxq->list): +- * a race, should defer the frame. +- * mvmtxq->txq_id == INVALID_QUEUE && list_empty(&mvmtxq->list): +- * need to allocate the queue and defer the frame. +- * mvmtxq->txq_id == INVALID_QUEUE && !list_empty(&mvmtxq->list): +- * queue is already scheduled for allocation, no need to allocate, +- * should defer the frame. +- */ +- +- /* If the queue is allocated TX and return. */ +- if (!txq->sta || mvmtxq->txq_id != IWL_MVM_INVALID_QUEUE) { +- /* +- * Check that list is empty to avoid a race where txq_id is +- * already updated, but the queue allocation work wasn't +- * finished +- */ +- if (unlikely(txq->sta && !list_empty(&mvmtxq->list))) +- return; +- ++ if (likely(test_bit(IWL_MVM_TXQ_STATE_READY, &mvmtxq->state)) || ++ !txq->sta) { + iwl_mvm_mac_itxq_xmit(hw, txq); + return; + } + +- /* The list is being deleted only after the queue is fully allocated. */ +- if (!list_empty(&mvmtxq->list)) +- return; ++ /* iwl_mvm_mac_itxq_xmit() will later be called by the worker ++ * to handle any packets we leave on the txq now ++ */ + +- list_add_tail(&mvmtxq->list, &mvm->add_stream_txqs); +- schedule_work(&mvm->add_stream_wk); ++ spin_lock_bh(&mvm->add_stream_lock); ++ /* The list is being deleted only after the queue is fully allocated. */ ++ if (list_empty(&mvmtxq->list) && ++ /* recheck under lock */ ++ !test_bit(IWL_MVM_TXQ_STATE_READY, &mvmtxq->state)) { ++ list_add_tail(&mvmtxq->list, &mvm->add_stream_txqs); ++ schedule_work(&mvm->add_stream_wk); ++ } ++ spin_unlock_bh(&mvm->add_stream_lock); + } + + #define CHECK_BA_TRIGGER(_mvm, _trig, _tid_bm, _tid, _fmt...) \ +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +index 3146b3d0..157de77e 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +@@ -731,6 +731,7 @@ struct iwl_mvm_txq { + atomic_t tx_request; + #define IWL_MVM_TXQ_STATE_STOP_FULL 0 + #define IWL_MVM_TXQ_STATE_STOP_REDIRECT 1 ++#define IWL_MVM_TXQ_STATE_READY 2 + unsigned long state; + }; + +@@ -829,6 +830,7 @@ struct iwl_mvm { + struct iwl_mvm_tvqm_txq_info tvqm_info[IWL_MAX_TVQM_QUEUES]; + }; + struct work_struct add_stream_wk; /* To add streams to queues */ ++ spinlock_t add_stream_lock; + + const char *nvm_file_name; + struct iwl_nvm_data *nvm_data; +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +index f43e617f..c49a2a1e 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +@@ -1194,6 +1194,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg, + INIT_DELAYED_WORK(&mvm->scan_timeout_dwork, iwl_mvm_scan_timeout_wk); + INIT_WORK(&mvm->add_stream_wk, iwl_mvm_add_new_dqa_stream_wk); + INIT_LIST_HEAD(&mvm->add_stream_txqs); ++ spin_lock_init(&mvm->add_stream_lock); + + init_waitqueue_head(&mvm->rx_sync_waitq); + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +index 21ad7b85..9caae779 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +@@ -384,8 +384,11 @@ static int iwl_mvm_disable_txq(struct iwl_mvm *mvm, struct ieee80211_sta *sta, + struct iwl_mvm_txq *mvmtxq = + iwl_mvm_txq_from_tid(sta, tid); + +- mvmtxq->txq_id = IWL_MVM_INVALID_QUEUE; ++ spin_lock_bh(&mvm->add_stream_lock); + list_del_init(&mvmtxq->list); ++ clear_bit(IWL_MVM_TXQ_STATE_READY, &mvmtxq->state); ++ mvmtxq->txq_id = IWL_MVM_INVALID_QUEUE; ++ spin_unlock_bh(&mvm->add_stream_lock); + } + + /* Regardless if this is a reserved TXQ for a STA - mark it as false */ +@@ -479,8 +482,11 @@ static int iwl_mvm_remove_sta_queue_marking(struct iwl_mvm *mvm, int queue) + disable_agg_tids |= BIT(tid); + mvmsta->tid_data[tid].txq_id = IWL_MVM_INVALID_QUEUE; + +- mvmtxq->txq_id = IWL_MVM_INVALID_QUEUE; ++ spin_lock_bh(&mvm->add_stream_lock); + list_del_init(&mvmtxq->list); ++ clear_bit(IWL_MVM_TXQ_STATE_READY, &mvmtxq->state); ++ mvmtxq->txq_id = IWL_MVM_INVALID_QUEUE; ++ spin_unlock_bh(&mvm->add_stream_lock); + } + + mvmsta->tfd_queue_msk &= ~BIT(queue); /* Don't use this queue anymore */ +@@ -1444,12 +1450,22 @@ void iwl_mvm_add_new_dqa_stream_wk(struct work_struct *wk) + * a queue in the function itself. + */ + if (iwl_mvm_sta_alloc_queue(mvm, txq->sta, txq->ac, tid)) { ++ spin_lock_bh(&mvm->add_stream_lock); + list_del_init(&mvmtxq->list); ++ spin_unlock_bh(&mvm->add_stream_lock); + continue; + } + +- list_del_init(&mvmtxq->list); ++ /* now we're ready, any remaining races/concurrency will be ++ * handled in iwl_mvm_mac_itxq_xmit() ++ */ ++ set_bit(IWL_MVM_TXQ_STATE_READY, &mvmtxq->state); ++ + local_bh_disable(); ++ spin_lock(&mvm->add_stream_lock); ++ list_del_init(&mvmtxq->list); ++ spin_unlock(&mvm->add_stream_lock); ++ + iwl_mvm_mac_itxq_xmit(mvm->hw, txq); + local_bh_enable(); + } +@@ -1864,8 +1880,11 @@ static void iwl_mvm_disable_sta_queues(struct iwl_mvm *mvm, + struct iwl_mvm_txq *mvmtxq = + iwl_mvm_txq_from_mac80211(sta->txq[i]); + ++ spin_lock_bh(&mvm->add_stream_lock); + mvmtxq->txq_id = IWL_MVM_INVALID_QUEUE; + list_del_init(&mvmtxq->list); ++ clear_bit(IWL_MVM_TXQ_STATE_READY, &mvmtxq->state); ++ spin_unlock_bh(&mvm->add_stream_lock); + } + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-096-drm-amdgpu-add-mes-resume-when-do-gfx-post-sof.patch b/patches.kernel.org/6.2.12-096-drm-amdgpu-add-mes-resume-when-do-gfx-post-sof.patch new file mode 100644 index 0000000..3d4b138 --- /dev/null +++ b/patches.kernel.org/6.2.12-096-drm-amdgpu-add-mes-resume-when-do-gfx-post-sof.patch @@ -0,0 +1,56 @@ +From: Tong Liu01 +Date: Wed, 15 Mar 2023 15:24:22 +0800 +Subject: [PATCH] drm/amdgpu: add mes resume when do gfx post soft reset +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 4eb0b49a0ad3e004a6a65b84efe37bc7e66d560f + +[ Upstream commit 4eb0b49a0ad3e004a6a65b84efe37bc7e66d560f ] + +[why] +when gfx do soft reset, mes will also do reset, if mes is not +resumed when do recover from soft reset, mes is unable to respond +in later sequence + +[how] +resume mes when do gfx post soft reset + +Signed-off-by: Tong Liu01 +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +index 66eb102c..c748d92c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +@@ -4625,6 +4625,14 @@ static bool gfx_v11_0_check_soft_reset(void *handle) + return false; + } + ++static int gfx_v11_0_post_soft_reset(void *handle) ++{ ++ /** ++ * GFX soft reset will impact MES, need resume MES when do GFX soft reset ++ */ ++ return amdgpu_mes_resume((struct amdgpu_device *)handle); ++} ++ + static uint64_t gfx_v11_0_get_gpu_clock_counter(struct amdgpu_device *adev) + { + uint64_t clock; +@@ -6096,6 +6104,7 @@ static const struct amd_ip_funcs gfx_v11_0_ip_funcs = { + .wait_for_idle = gfx_v11_0_wait_for_idle, + .soft_reset = gfx_v11_0_soft_reset, + .check_soft_reset = gfx_v11_0_check_soft_reset, ++ .post_soft_reset = gfx_v11_0_post_soft_reset, + .set_clockgating_state = gfx_v11_0_set_clockgating_state, + .set_powergating_state = gfx_v11_0_set_powergating_state, + .get_clockgating_state = gfx_v11_0_get_clockgating_state, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-097-drm-amdgpu-Force-signal-hw_fences-that-are-emb.patch b/patches.kernel.org/6.2.12-097-drm-amdgpu-Force-signal-hw_fences-that-are-emb.patch new file mode 100644 index 0000000..4d04925 --- /dev/null +++ b/patches.kernel.org/6.2.12-097-drm-amdgpu-Force-signal-hw_fences-that-are-emb.patch @@ -0,0 +1,56 @@ +From: YuBiao Wang +Date: Thu, 16 Mar 2023 11:30:32 +0800 +Subject: [PATCH] drm/amdgpu: Force signal hw_fences that are embedded in + non-sched jobs +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 033c56474acf567a450f8bafca50e0b610f2b716 + +[ Upstream commit 033c56474acf567a450f8bafca50e0b610f2b716 ] + +[Why] +For engines not supporting soft reset, i.e. VCN, there will be a failed +ib test before mode 1 reset during asic reset. The fences in this case +are never signaled and next time when we try to free the sa_bo, kernel +will hang. + +[How] +During pre_asic_reset, driver will clear job fences and afterwards the +fences' refcount will be reduced to 1. For drm_sched_jobs it will be +released in job_free_cb, and for non-sched jobs like ib_test, it's meant +to be released in sa_bo_free but only when the fences are signaled. So +we have to force signal the non_sched bad job's fence during +pre_asic_reset or the clear is not complete. + +Signed-off-by: YuBiao Wang +Acked-by: Luben Tuikov +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +index faff4a3f..f52d0ba9 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +@@ -678,6 +678,15 @@ void amdgpu_fence_driver_clear_job_fences(struct amdgpu_ring *ring) + ptr = &ring->fence_drv.fences[i]; + old = rcu_dereference_protected(*ptr, 1); + if (old && old->ops == &amdgpu_job_fence_ops) { ++ struct amdgpu_job *job; ++ ++ /* For non-scheduler bad job, i.e. failed ib test, we need to signal ++ * it right here or we won't be able to track them in fence_drv ++ * and they will remain unsignaled during sa_bo free. ++ */ ++ job = container_of(old, struct amdgpu_job, hw_fence); ++ if (!job->base.s_fence && !dma_fence_is_signaled(old)) ++ dma_fence_signal(old); + RCU_INIT_POINTER(*ptr, NULL); + dma_fence_put(old); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-098-drm-amdgpu-gfx-set-cg-flags-to-enter-exit-safe.patch b/patches.kernel.org/6.2.12-098-drm-amdgpu-gfx-set-cg-flags-to-enter-exit-safe.patch new file mode 100644 index 0000000..4882ac8 --- /dev/null +++ b/patches.kernel.org/6.2.12-098-drm-amdgpu-gfx-set-cg-flags-to-enter-exit-safe.patch @@ -0,0 +1,40 @@ +From: Jane Jian +Date: Wed, 15 Mar 2023 18:59:59 +0800 +Subject: [PATCH] drm/amdgpu/gfx: set cg flags to enter/exit safe mode +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: e06bfcc1a1c41bcb8c31470d437e147ce9f0acfd + +[ Upstream commit e06bfcc1a1c41bcb8c31470d437e147ce9f0acfd ] + +sriov needs to enter/exit safe mode in update umd p state +add the cg flag to let it enter or exit while needed + +Signed-off-by: Jane Jian +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +index c748d92c..ddb7b865 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +@@ -1315,6 +1315,11 @@ static int gfx_v11_0_sw_init(void *handle) + break; + } + ++ /* Enable CG flag in one VF mode for enabling RLC safe mode enter/exit */ ++ if (adev->ip_versions[GC_HWIP][0] == IP_VERSION(11, 0, 3) && ++ amdgpu_sriov_is_pp_one_vf(adev)) ++ adev->cg_flags = AMD_CG_SUPPORT_GFX_CGCG; ++ + /* EOP Event */ + r = amdgpu_irq_add_id(adev, SOC21_IH_CLIENTID_GRBM_CP, + GFX_11_0_0__SRCID__CP_EOP_INTERRUPT, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-099-ACPI-resource-Add-Medion-S17413-to-IRQ-overrid.patch b/patches.kernel.org/6.2.12-099-ACPI-resource-Add-Medion-S17413-to-IRQ-overrid.patch new file mode 100644 index 0000000..ab66c38 --- /dev/null +++ b/patches.kernel.org/6.2.12-099-ACPI-resource-Add-Medion-S17413-to-IRQ-overrid.patch @@ -0,0 +1,43 @@ +From: Aymeric Wibo +Date: Sun, 19 Mar 2023 03:12:05 +0100 +Subject: [PATCH] ACPI: resource: Add Medion S17413 to IRQ override quirk +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 2d0ab14634a26e54f8d6d231b47b7ef233e84599 + +[ Upstream commit 2d0ab14634a26e54f8d6d231b47b7ef233e84599 ] + +Add DMI info of the Medion S17413 (board M1xA) to the IRQ override +quirk table. This fixes the keyboard not working on these laptops. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=213031 +Signed-off-by: Aymeric Wibo +[ rjw: Fixed up white space ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/acpi/resource.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index a222bda7..d08818ba 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -400,6 +400,13 @@ static const struct dmi_system_id medion_laptop[] = { + DMI_MATCH(DMI_BOARD_NAME, "M17T"), + }, + }, ++ { ++ .ident = "MEDION S17413", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "MEDION"), ++ DMI_MATCH(DMI_BOARD_NAME, "M1xA"), ++ }, ++ }, + { } + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-100-tracing-Add-trace_array_puts-to-write-into-ins.patch b/patches.kernel.org/6.2.12-100-tracing-Add-trace_array_puts-to-write-into-ins.patch new file mode 100644 index 0000000..c757e96 --- /dev/null +++ b/patches.kernel.org/6.2.12-100-tracing-Add-trace_array_puts-to-write-into-ins.patch @@ -0,0 +1,116 @@ +From: "Steven Rostedt (Google)" +Date: Tue, 7 Feb 2023 12:28:52 -0500 +Subject: [PATCH] tracing: Add trace_array_puts() to write into instance +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: d503b8f7474fe7ac616518f7fc49773cbab49f36 + +[ Upstream commit d503b8f7474fe7ac616518f7fc49773cbab49f36 ] + +Add a generic trace_array_puts() that can be used to "trace_puts()" into +an allocated trace_array instance. This is just another variant of +trace_array_printk(). + +Link: https://lkml.kernel.org/r/20230207173026.584717290@goodmis.org + +Cc: Masami Hiramatsu +Cc: Andrew Morton +Reviewed-by: Ross Zwisler +Signed-off-by: Steven Rostedt (Google) +Stable-dep-of: 9d52727f8043 ("tracing: Have tracing_snapshot_instance_cond() write errors to the appropriate instance") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + include/linux/trace.h | 12 ++++++++++++ + kernel/trace/trace.c | 27 +++++++++++++++++---------- + 2 files changed, 29 insertions(+), 10 deletions(-) + +diff --git a/include/linux/trace.h b/include/linux/trace.h +index 80ffda87..2a70a447 100644 +--- a/include/linux/trace.h ++++ b/include/linux/trace.h +@@ -33,6 +33,18 @@ struct trace_array; + int register_ftrace_export(struct trace_export *export); + int unregister_ftrace_export(struct trace_export *export); + ++/** ++ * trace_array_puts - write a constant string into the trace buffer. ++ * @tr: The trace array to write to ++ * @str: The constant string to write ++ */ ++#define trace_array_puts(tr, str) \ ++ ({ \ ++ str ? __trace_array_puts(tr, _THIS_IP_, str, strlen(str)) : -1; \ ++ }) ++int __trace_array_puts(struct trace_array *tr, unsigned long ip, ++ const char *str, int size); ++ + void trace_printk_init_buffers(void); + __printf(3, 4) + int trace_array_printk(struct trace_array *tr, unsigned long ip, +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 1a931896..13c46787 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -1001,13 +1001,8 @@ __buffer_unlock_commit(struct trace_buffer *buffer, struct ring_buffer_event *ev + ring_buffer_unlock_commit(buffer); + } + +-/** +- * __trace_puts - write a constant string into the trace buffer. +- * @ip: The address of the caller +- * @str: The constant string to write +- * @size: The size of the string. +- */ +-int __trace_puts(unsigned long ip, const char *str, int size) ++int __trace_array_puts(struct trace_array *tr, unsigned long ip, ++ const char *str, int size) + { + struct ring_buffer_event *event; + struct trace_buffer *buffer; +@@ -1015,7 +1010,7 @@ int __trace_puts(unsigned long ip, const char *str, int size) + unsigned int trace_ctx; + int alloc; + +- if (!(global_trace.trace_flags & TRACE_ITER_PRINTK)) ++ if (!(tr->trace_flags & TRACE_ITER_PRINTK)) + return 0; + + if (unlikely(tracing_selftest_running || tracing_disabled)) +@@ -1024,7 +1019,7 @@ int __trace_puts(unsigned long ip, const char *str, int size) + alloc = sizeof(*entry) + size + 2; /* possible \n added */ + + trace_ctx = tracing_gen_ctx(); +- buffer = global_trace.array_buffer.buffer; ++ buffer = tr->array_buffer.buffer; + ring_buffer_nest_start(buffer); + event = __trace_buffer_lock_reserve(buffer, TRACE_PRINT, alloc, + trace_ctx); +@@ -1046,11 +1041,23 @@ int __trace_puts(unsigned long ip, const char *str, int size) + entry->buf[size] = '\0'; + + __buffer_unlock_commit(buffer, event); +- ftrace_trace_stack(&global_trace, buffer, trace_ctx, 4, NULL); ++ ftrace_trace_stack(tr, buffer, trace_ctx, 4, NULL); + out: + ring_buffer_nest_end(buffer); + return size; + } ++EXPORT_SYMBOL_GPL(__trace_array_puts); ++ ++/** ++ * __trace_puts - write a constant string into the trace buffer. ++ * @ip: The address of the caller ++ * @str: The constant string to write ++ * @size: The size of the string. ++ */ ++int __trace_puts(unsigned long ip, const char *str, int size) ++{ ++ return __trace_array_puts(&global_trace, ip, str, size); ++} + EXPORT_SYMBOL_GPL(__trace_puts); + + /** +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-101-tracing-Have-tracing_snapshot_instance_cond-wr.patch b/patches.kernel.org/6.2.12-101-tracing-Have-tracing_snapshot_instance_cond-wr.patch new file mode 100644 index 0000000..02ea21b --- /dev/null +++ b/patches.kernel.org/6.2.12-101-tracing-Have-tracing_snapshot_instance_cond-wr.patch @@ -0,0 +1,67 @@ +From: "Steven Rostedt (Google)" +Date: Tue, 4 Apr 2023 22:21:14 -0400 +Subject: [PATCH] tracing: Have tracing_snapshot_instance_cond() write errors + to the appropriate instance +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 9d52727f8043cfda241ae96896628d92fa9c50bb + +[ Upstream commit 9d52727f8043cfda241ae96896628d92fa9c50bb ] + +If a trace instance has a failure with its snapshot code, the error +message is to be written to that instance's buffer. But currently, the +message is written to the top level buffer. Worse yet, it may also disable +the top level buffer and not the instance that had the issue. + +Link: https://lkml.kernel.org/r/20230405022341.688730321@goodmis.org + +Cc: stable@vger.kernel.org +Cc: Masami Hiramatsu +Cc: Mark Rutland +Cc: Andrew Morton +Cc: Ross Zwisler +Fixes: 2824f50332486 ("tracing: Make the snapshot trigger work with instances") +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/trace/trace.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 13c46787..13b324f0 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -1111,22 +1111,22 @@ static void tracing_snapshot_instance_cond(struct trace_array *tr, + unsigned long flags; + + if (in_nmi()) { +- internal_trace_puts("*** SNAPSHOT CALLED FROM NMI CONTEXT ***\n"); +- internal_trace_puts("*** snapshot is being ignored ***\n"); ++ trace_array_puts(tr, "*** SNAPSHOT CALLED FROM NMI CONTEXT ***\n"); ++ trace_array_puts(tr, "*** snapshot is being ignored ***\n"); + return; + } + + if (!tr->allocated_snapshot) { +- internal_trace_puts("*** SNAPSHOT NOT ALLOCATED ***\n"); +- internal_trace_puts("*** stopping trace here! ***\n"); +- tracing_off(); ++ trace_array_puts(tr, "*** SNAPSHOT NOT ALLOCATED ***\n"); ++ trace_array_puts(tr, "*** stopping trace here! ***\n"); ++ tracer_tracing_off(tr); + return; + } + + /* Note, snapshot can not be used when the tracer uses it */ + if (tracer->use_max_tr) { +- internal_trace_puts("*** LATENCY TRACER ACTIVE ***\n"); +- internal_trace_puts("*** Can not use snapshot (sorry) ***\n"); ++ trace_array_puts(tr, "*** LATENCY TRACER ACTIVE ***\n"); ++ trace_array_puts(tr, "*** Can not use snapshot (sorry) ***\n"); + return; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-102-maple_tree-fix-write-memory-barrier-of-nodes-o.patch b/patches.kernel.org/6.2.12-102-maple_tree-fix-write-memory-barrier-of-nodes-o.patch new file mode 100644 index 0000000..c5ee398 --- /dev/null +++ b/patches.kernel.org/6.2.12-102-maple_tree-fix-write-memory-barrier-of-nodes-o.patch @@ -0,0 +1,196 @@ +From: "Liam R. Howlett" +Date: Mon, 27 Feb 2023 09:36:04 -0800 +Subject: [PATCH] maple_tree: fix write memory barrier of nodes once dead for + RCU mode +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: c13af03de46ba27674dd9fb31a17c0d480081139 + +[ Upstream commit c13af03de46ba27674dd9fb31a17c0d480081139 ] + +During the development of the maple tree, the strategy of freeing multiple +nodes changed and, in the process, the pivots were reused to store +pointers to dead nodes. To ensure the readers see accurate pivots, the +writers need to mark the nodes as dead and call smp_wmb() to ensure any +readers can identify the node as dead before using the pivot values. + +There were two places where the old method of marking the node as dead +without smp_wmb() were being used, which resulted in RCU readers seeing +the wrong pivot value before seeing the node was dead. Fix this race +condition by using mte_set_node_dead() which has the smp_wmb() call to +ensure the race is closed. + +Add a WARN_ON() to the ma_free_rcu() call to ensure all nodes being freed +are marked as dead to ensure there are no other call paths besides the two +updated paths. + +This is necessary for the RCU mode of the maple tree. + +Link: https://lkml.kernel.org/r/20230227173632.3292573-6-surenb@google.com +Fixes: 54a611b60590 ("Maple Tree: add new data structure") +Signed-off-by: Liam R. Howlett +Signed-off-by: Suren Baghdasaryan +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + lib/maple_tree.c | 7 +++++-- + tools/testing/radix-tree/maple.c | 16 ++++++++++++++++ + 2 files changed, 21 insertions(+), 2 deletions(-) + +diff --git a/lib/maple_tree.c b/lib/maple_tree.c +index fb452873..022573f4 100644 +--- a/lib/maple_tree.c ++++ b/lib/maple_tree.c +@@ -178,7 +178,7 @@ static void mt_free_rcu(struct rcu_head *head) + */ + static void ma_free_rcu(struct maple_node *node) + { +- node->parent = ma_parent_ptr(node); ++ WARN_ON(node->parent != ma_parent_ptr(node)); + call_rcu(&node->rcu, mt_free_rcu); + } + +@@ -1785,8 +1785,10 @@ static inline void mas_replace(struct ma_state *mas, bool advanced) + rcu_assign_pointer(slots[offset], mas->node); + } + +- if (!advanced) ++ if (!advanced) { ++ mte_set_node_dead(old_enode); + mas_free(mas, old_enode); ++ } + } + + /* +@@ -4221,6 +4223,7 @@ static inline bool mas_wr_node_store(struct ma_wr_state *wr_mas) + done: + mas_leaf_set_meta(mas, newnode, dst_pivots, maple_leaf_64, new_end); + if (in_rcu) { ++ mte_set_node_dead(mas->node); + mas->node = mt_mk_node(newnode, wr_mas->type); + mas_replace(mas, false); + } else { +diff --git a/tools/testing/radix-tree/maple.c b/tools/testing/radix-tree/maple.c +index 1f36bc1c..2a16939c 100644 +--- a/tools/testing/radix-tree/maple.c ++++ b/tools/testing/radix-tree/maple.c +@@ -108,6 +108,7 @@ static noinline void check_new_node(struct maple_tree *mt) + MT_BUG_ON(mt, mn->slot[1] != NULL); + MT_BUG_ON(mt, mas_allocated(&mas) != 0); + ++ mn->parent = ma_parent_ptr(mn); + ma_free_rcu(mn); + mas.node = MAS_START; + mas_nomem(&mas, GFP_KERNEL); +@@ -160,6 +161,7 @@ static noinline void check_new_node(struct maple_tree *mt) + MT_BUG_ON(mt, mas_allocated(&mas) != i); + MT_BUG_ON(mt, !mn); + MT_BUG_ON(mt, not_empty(mn)); ++ mn->parent = ma_parent_ptr(mn); + ma_free_rcu(mn); + } + +@@ -192,6 +194,7 @@ static noinline void check_new_node(struct maple_tree *mt) + MT_BUG_ON(mt, not_empty(mn)); + MT_BUG_ON(mt, mas_allocated(&mas) != i - 1); + MT_BUG_ON(mt, !mn); ++ mn->parent = ma_parent_ptr(mn); + ma_free_rcu(mn); + } + +@@ -210,6 +213,7 @@ static noinline void check_new_node(struct maple_tree *mt) + mn = mas_pop_node(&mas); + MT_BUG_ON(mt, not_empty(mn)); + MT_BUG_ON(mt, mas_allocated(&mas) != j - 1); ++ mn->parent = ma_parent_ptr(mn); + ma_free_rcu(mn); + } + MT_BUG_ON(mt, mas_allocated(&mas) != 0); +@@ -233,6 +237,7 @@ static noinline void check_new_node(struct maple_tree *mt) + MT_BUG_ON(mt, mas_allocated(&mas) != i - j); + mn = mas_pop_node(&mas); + MT_BUG_ON(mt, not_empty(mn)); ++ mn->parent = ma_parent_ptr(mn); + ma_free_rcu(mn); + MT_BUG_ON(mt, mas_allocated(&mas) != i - j - 1); + } +@@ -269,6 +274,7 @@ static noinline void check_new_node(struct maple_tree *mt) + mn = mas_pop_node(&mas); /* get the next node. */ + MT_BUG_ON(mt, mn == NULL); + MT_BUG_ON(mt, not_empty(mn)); ++ mn->parent = ma_parent_ptr(mn); + ma_free_rcu(mn); + } + MT_BUG_ON(mt, mas_allocated(&mas) != 0); +@@ -294,6 +300,7 @@ static noinline void check_new_node(struct maple_tree *mt) + mn = mas_pop_node(&mas2); /* get the next node. */ + MT_BUG_ON(mt, mn == NULL); + MT_BUG_ON(mt, not_empty(mn)); ++ mn->parent = ma_parent_ptr(mn); + ma_free_rcu(mn); + } + MT_BUG_ON(mt, mas_allocated(&mas2) != 0); +@@ -334,10 +341,12 @@ static noinline void check_new_node(struct maple_tree *mt) + MT_BUG_ON(mt, mas_allocated(&mas) != MAPLE_ALLOC_SLOTS + 2); + mn = mas_pop_node(&mas); + MT_BUG_ON(mt, not_empty(mn)); ++ mn->parent = ma_parent_ptr(mn); + ma_free_rcu(mn); + for (i = 1; i <= MAPLE_ALLOC_SLOTS + 1; i++) { + mn = mas_pop_node(&mas); + MT_BUG_ON(mt, not_empty(mn)); ++ mn->parent = ma_parent_ptr(mn); + ma_free_rcu(mn); + } + MT_BUG_ON(mt, mas_allocated(&mas) != 0); +@@ -375,6 +384,7 @@ static noinline void check_new_node(struct maple_tree *mt) + mas_node_count(&mas, i); /* Request */ + mas_nomem(&mas, GFP_KERNEL); /* Fill request */ + mn = mas_pop_node(&mas); /* get the next node. */ ++ mn->parent = ma_parent_ptr(mn); + ma_free_rcu(mn); + mas_destroy(&mas); + +@@ -382,10 +392,13 @@ static noinline void check_new_node(struct maple_tree *mt) + mas_node_count(&mas, i); /* Request */ + mas_nomem(&mas, GFP_KERNEL); /* Fill request */ + mn = mas_pop_node(&mas); /* get the next node. */ ++ mn->parent = ma_parent_ptr(mn); + ma_free_rcu(mn); + mn = mas_pop_node(&mas); /* get the next node. */ ++ mn->parent = ma_parent_ptr(mn); + ma_free_rcu(mn); + mn = mas_pop_node(&mas); /* get the next node. */ ++ mn->parent = ma_parent_ptr(mn); + ma_free_rcu(mn); + mas_destroy(&mas); + } +@@ -35369,6 +35382,7 @@ static noinline void check_prealloc(struct maple_tree *mt) + MT_BUG_ON(mt, allocated != 1 + height * 3); + mn = mas_pop_node(&mas); + MT_BUG_ON(mt, mas_allocated(&mas) != allocated - 1); ++ mn->parent = ma_parent_ptr(mn); + ma_free_rcu(mn); + MT_BUG_ON(mt, mas_preallocate(&mas, ptr, GFP_KERNEL) != 0); + mas_destroy(&mas); +@@ -35386,6 +35400,7 @@ static noinline void check_prealloc(struct maple_tree *mt) + mas_destroy(&mas); + allocated = mas_allocated(&mas); + MT_BUG_ON(mt, allocated != 0); ++ mn->parent = ma_parent_ptr(mn); + ma_free_rcu(mn); + + MT_BUG_ON(mt, mas_preallocate(&mas, ptr, GFP_KERNEL) != 0); +@@ -35756,6 +35771,7 @@ void farmer_tests(void) + tree.ma_root = mt_mk_node(node, maple_leaf_64); + mt_dump(&tree); + ++ node->parent = ma_parent_ptr(node); + ma_free_rcu(node); + + /* Check things that will make lockdep angry */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-103-ksmbd-avoid-out-of-bounds-access-in-decode_pre.patch b/patches.kernel.org/6.2.12-103-ksmbd-avoid-out-of-bounds-access-in-decode_pre.patch new file mode 100644 index 0000000..2a1bec6 --- /dev/null +++ b/patches.kernel.org/6.2.12-103-ksmbd-avoid-out-of-bounds-access-in-decode_pre.patch @@ -0,0 +1,74 @@ +From: David Disseldorp +Date: Thu, 13 Apr 2023 23:49:57 +0900 +Subject: [PATCH] ksmbd: avoid out of bounds access in decode_preauth_ctxt() +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: e7067a446264a7514fa1cfaa4052cdb6803bc6a2 + +commit e7067a446264a7514fa1cfaa4052cdb6803bc6a2 upstream. + +Confirm that the accessed pneg_ctxt->HashAlgorithms address sits within +the SMB request boundary; deassemble_neg_contexts() only checks that the +eight byte smb2_neg_context header + (client controlled) DataLength are +within the packet boundary, which is insufficient. + +Checking for sizeof(struct smb2_preauth_neg_context) is overkill given +that the type currently assumes SMB311_SALT_SIZE bytes of trailing Salt. + +Signed-off-by: David Disseldorp +Acked-by: Namjae Jeon +Cc: +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/ksmbd/smb2pdu.c | 23 ++++++++++++++--------- + 1 file changed, 14 insertions(+), 9 deletions(-) + +diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c +index 7e0b62f9..32a83701 100644 +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -872,17 +872,21 @@ static void assemble_neg_contexts(struct ksmbd_conn *conn, + } + + static __le32 decode_preauth_ctxt(struct ksmbd_conn *conn, +- struct smb2_preauth_neg_context *pneg_ctxt) ++ struct smb2_preauth_neg_context *pneg_ctxt, ++ int len_of_ctxts) + { +- __le32 err = STATUS_NO_PREAUTH_INTEGRITY_HASH_OVERLAP; ++ /* ++ * sizeof(smb2_preauth_neg_context) assumes SMB311_SALT_SIZE Salt, ++ * which may not be present. Only check for used HashAlgorithms[1]. ++ */ ++ if (len_of_ctxts < MIN_PREAUTH_CTXT_DATA_LEN) ++ return STATUS_INVALID_PARAMETER; + +- if (pneg_ctxt->HashAlgorithms == SMB2_PREAUTH_INTEGRITY_SHA512) { +- conn->preauth_info->Preauth_HashId = +- SMB2_PREAUTH_INTEGRITY_SHA512; +- err = STATUS_SUCCESS; +- } ++ if (pneg_ctxt->HashAlgorithms != SMB2_PREAUTH_INTEGRITY_SHA512) ++ return STATUS_NO_PREAUTH_INTEGRITY_HASH_OVERLAP; + +- return err; ++ conn->preauth_info->Preauth_HashId = SMB2_PREAUTH_INTEGRITY_SHA512; ++ return STATUS_SUCCESS; + } + + static void decode_encrypt_ctxt(struct ksmbd_conn *conn, +@@ -1010,7 +1014,8 @@ static __le32 deassemble_neg_contexts(struct ksmbd_conn *conn, + break; + + status = decode_preauth_ctxt(conn, +- (struct smb2_preauth_neg_context *)pctx); ++ (struct smb2_preauth_neg_context *)pctx, ++ len_of_ctxts); + if (status != STATUS_SUCCESS) + break; + } else if (pctx->ContextType == SMB2_ENCRYPTION_CAPABILITIES) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-104-riscv-add-icache-flush-for-nommu-sigreturn-tra.patch b/patches.kernel.org/6.2.12-104-riscv-add-icache-flush-for-nommu-sigreturn-tra.patch new file mode 100644 index 0000000..3c7fc8d --- /dev/null +++ b/patches.kernel.org/6.2.12-104-riscv-add-icache-flush-for-nommu-sigreturn-tra.patch @@ -0,0 +1,64 @@ +From: Mathis Salmen +Date: Thu, 6 Apr 2023 12:11:31 +0200 +Subject: [PATCH] riscv: add icache flush for nommu sigreturn trampoline +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 8d736482749f6d350892ef83a7a11d43cd49981e + +commit 8d736482749f6d350892ef83a7a11d43cd49981e upstream. + +In a NOMMU kernel, sigreturn trampolines are generated on the user +stack by setup_rt_frame. Currently, these trampolines are not instruction +fenced, thus their visibility to ifetch is not guaranteed. + +This patch adds a flush_icache_range in setup_rt_frame to fix this +problem. + +Signed-off-by: Mathis Salmen +Fixes: 6bd33e1ece52 ("riscv: add nommu support") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230406101130.82304-1-mathis.salmen@matsal.de +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/riscv/kernel/signal.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/arch/riscv/kernel/signal.c b/arch/riscv/kernel/signal.c +index bfb2afa4..dee66c92 100644 +--- a/arch/riscv/kernel/signal.c ++++ b/arch/riscv/kernel/signal.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + + extern u32 __user_rt_sigreturn[2]; + +@@ -181,6 +182,7 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set, + { + struct rt_sigframe __user *frame; + long err = 0; ++ unsigned long __maybe_unused addr; + + frame = get_sigframe(ksig, regs, sizeof(*frame)); + if (!access_ok(frame, sizeof(*frame))) +@@ -209,7 +211,12 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set, + if (copy_to_user(&frame->sigreturn_code, __user_rt_sigreturn, + sizeof(frame->sigreturn_code))) + return -EFAULT; +- regs->ra = (unsigned long)&frame->sigreturn_code; ++ ++ addr = (unsigned long)&frame->sigreturn_code; ++ /* Make sure the two instructions are pushed to icache. */ ++ flush_icache_range(addr, addr + sizeof(frame->sigreturn_code)); ++ ++ regs->ra = addr; + #endif /* CONFIG_MMU */ + + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-105-HID-intel-ish-hid-Fix-kernel-panic-during-warm.patch b/patches.kernel.org/6.2.12-105-HID-intel-ish-hid-Fix-kernel-panic-during-warm.patch new file mode 100644 index 0000000..40888ff --- /dev/null +++ b/patches.kernel.org/6.2.12-105-HID-intel-ish-hid-Fix-kernel-panic-during-warm.patch @@ -0,0 +1,65 @@ +From: Tanu Malhotra +Date: Mon, 27 Mar 2023 11:58:38 -0700 +Subject: [PATCH] HID: intel-ish-hid: Fix kernel panic during warm reset +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 38518593ec55e897abda4b4be77b2ec8ec4447d1 + +commit 38518593ec55e897abda4b4be77b2ec8ec4447d1 upstream. + +During warm reset device->fw_client is set to NULL. If a bus driver is +registered after this NULL setting and before new firmware clients are +enumerated by ISHTP, kernel panic will result in the function +ishtp_cl_bus_match(). This is because of reference to +device->fw_client->props.protocol_name. + +ISH firmware after getting successfully loaded, sends a warm reset +notification to remove all clients from the bus and sets +device->fw_client to NULL. Until kernel v5.15, all enabled ISHTP kernel +module drivers were loaded right after any of the first ISHTP device was +registered, regardless of whether it was a matched or an unmatched +device. This resulted in all drivers getting registered much before the +warm reset notification from ISH. + +Starting kernel v5.16, this issue got exposed after the change was +introduced to load only bus drivers for the respective matching devices. +In this scenario, cros_ec_ishtp device and cros_ec_ishtp driver are +registered after the warm reset device fw_client NULL setting. +cros_ec_ishtp driver_register() triggers the callback to +ishtp_cl_bus_match() to match ISHTP driver to the device and causes kernel +panic in guid_equal() when dereferencing fw_client NULL pointer to get +protocol_name. + +Fixes: f155dfeaa4ee ("platform/x86: isthp_eclite: only load for matching devices") +Fixes: facfe0a4fdce ("platform/chrome: chros_ec_ishtp: only load for matching devices") +Fixes: 0d0cccc0fd83 ("HID: intel-ish-hid: hid-client: only load for matching devices") +Fixes: 44e2a58cb880 ("HID: intel-ish-hid: fw-loader: only load for matching devices") +Cc: # 5.16+ +Signed-off-by: Tanu Malhotra +Tested-by: Shaunak Saha +Acked-by: Srinivas Pandruvada +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/hid/intel-ish-hid/ishtp/bus.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/intel-ish-hid/ishtp/bus.c b/drivers/hid/intel-ish-hid/ishtp/bus.c +index f68aba87..d4296681 100644 +--- a/drivers/hid/intel-ish-hid/ishtp/bus.c ++++ b/drivers/hid/intel-ish-hid/ishtp/bus.c +@@ -241,8 +241,8 @@ static int ishtp_cl_bus_match(struct device *dev, struct device_driver *drv) + struct ishtp_cl_device *device = to_ishtp_cl_device(dev); + struct ishtp_cl_driver *driver = to_ishtp_cl_driver(drv); + +- return guid_equal(&driver->id[0].guid, +- &device->fw_client->props.protocol_name); ++ return(device->fw_client ? guid_equal(&driver->id[0].guid, ++ &device->fw_client->props.protocol_name) : 0); + } + + /** +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-106-net-sfp-initialize-sfp-i2c_block_size-at-sfp-a.patch b/patches.kernel.org/6.2.12-106-net-sfp-initialize-sfp-i2c_block_size-at-sfp-a.patch new file mode 100644 index 0000000..a156efa --- /dev/null +++ b/patches.kernel.org/6.2.12-106-net-sfp-initialize-sfp-i2c_block_size-at-sfp-a.patch @@ -0,0 +1,84 @@ +From: Ivan Bornyakov +Date: Thu, 6 Apr 2023 16:08:32 +0300 +Subject: [PATCH] net: sfp: initialize sfp->i2c_block_size at sfp allocation +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 813c2dd78618f108fdcf9cd726ea90f081ee2881 + +commit 813c2dd78618f108fdcf9cd726ea90f081ee2881 upstream. + +sfp->i2c_block_size is initialized at SFP module insertion in +sfp_sm_mod_probe(). Because of that, if SFP module was never inserted +since boot, sfp_read() call will lead to zero-length I2C read attempt, +and not all I2C controllers are happy with zero-length reads. + +One way to issue sfp_read() on empty SFP cage is to execute ethtool -m. +If SFP module was never plugged since boot, there will be a zero-length +I2C read attempt. + + # ethtool -m xge0 + i2c i2c-3: adapter quirk: no zero length (addr 0x0050, size 0, read) + Cannot get Module EEPROM data: Operation not supported + +If SFP module was plugged then removed at least once, +sfp->i2c_block_size will be initialized and ethtool -m will fail with +different exit code and without I2C error + + # ethtool -m xge0 + Cannot get Module EEPROM data: Remote I/O error + +Fix this by initializing sfp->i2_block_size at struct sfp allocation +stage so no wild sfp_read() could issue zero-length I2C read. + +Signed-off-by: Ivan Bornyakov +Fixes: 0d035bed2a4a ("net: sfp: VSOL V2801F / CarlitoxxPro CPGOS03-0490 v2.0 workaround") +Cc: stable@vger.kernel.org +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/net/phy/sfp.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c +index 83b99d95..b224800d 100644 +--- a/drivers/net/phy/sfp.c ++++ b/drivers/net/phy/sfp.c +@@ -212,6 +212,12 @@ static const enum gpiod_flags gpio_flags[] = { + #define SFP_PHY_ADDR 22 + #define SFP_PHY_ADDR_ROLLBALL 17 + ++/* SFP_EEPROM_BLOCK_SIZE is the size of data chunk to read the EEPROM ++ * at a time. Some SFP modules and also some Linux I2C drivers do not like ++ * reads longer than 16 bytes. ++ */ ++#define SFP_EEPROM_BLOCK_SIZE 16 ++ + struct sff_data { + unsigned int gpios; + bool (*module_supported)(const struct sfp_eeprom_id *id); +@@ -1927,11 +1933,7 @@ static int sfp_sm_mod_probe(struct sfp *sfp, bool report) + u8 check; + int ret; + +- /* Some SFP modules and also some Linux I2C drivers do not like reads +- * longer than 16 bytes, so read the EEPROM in chunks of 16 bytes at +- * a time. +- */ +- sfp->i2c_block_size = 16; ++ sfp->i2c_block_size = SFP_EEPROM_BLOCK_SIZE; + + ret = sfp_read(sfp, false, 0, &id.base, sizeof(id.base)); + if (ret < 0) { +@@ -2614,6 +2616,7 @@ static struct sfp *sfp_alloc(struct device *dev) + return ERR_PTR(-ENOMEM); + + sfp->dev = dev; ++ sfp->i2c_block_size = SFP_EEPROM_BLOCK_SIZE; + + mutex_init(&sfp->sm_mutex); + mutex_init(&sfp->st_mutex); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-107-net-phy-nxp-c45-tja11xx-add-remove-callback.patch b/patches.kernel.org/6.2.12-107-net-phy-nxp-c45-tja11xx-add-remove-callback.patch new file mode 100644 index 0000000..66967a7 --- /dev/null +++ b/patches.kernel.org/6.2.12-107-net-phy-nxp-c45-tja11xx-add-remove-callback.patch @@ -0,0 +1,57 @@ +From: "Radu Pirea (OSS)" +Date: Thu, 6 Apr 2023 12:59:04 +0300 +Subject: [PATCH] net: phy: nxp-c45-tja11xx: add remove callback +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: a4506722dc39ca840593f14e3faa4c9ba9408211 + +commit a4506722dc39ca840593f14e3faa4c9ba9408211 upstream. + +Unregister PTP clock when the driver is removed. +Purge the RX and TX skb queues. + +Fixes: 514def5dd339 ("phy: nxp-c45-tja11xx: add timestamping support") +CC: stable@vger.kernel.org # 5.15+ +Signed-off-by: Radu Pirea (OSS) +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20230406095904.75456-1-radu-nicolae.pirea@oss.nxp.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/net/phy/nxp-c45-tja11xx.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/net/phy/nxp-c45-tja11xx.c b/drivers/net/phy/nxp-c45-tja11xx.c +index 5813b072..27738d1a 100644 +--- a/drivers/net/phy/nxp-c45-tja11xx.c ++++ b/drivers/net/phy/nxp-c45-tja11xx.c +@@ -1337,6 +1337,17 @@ static int nxp_c45_probe(struct phy_device *phydev) + return ret; + } + ++static void nxp_c45_remove(struct phy_device *phydev) ++{ ++ struct nxp_c45_phy *priv = phydev->priv; ++ ++ if (priv->ptp_clock) ++ ptp_clock_unregister(priv->ptp_clock); ++ ++ skb_queue_purge(&priv->tx_queue); ++ skb_queue_purge(&priv->rx_queue); ++} ++ + static struct phy_driver nxp_c45_driver[] = { + { + PHY_ID_MATCH_MODEL(PHY_ID_TJA_1103), +@@ -1359,6 +1370,7 @@ static struct phy_driver nxp_c45_driver[] = { + .set_loopback = genphy_c45_loopback, + .get_sqi = nxp_c45_get_sqi, + .get_sqi_max = nxp_c45_get_sqi_max, ++ .remove = nxp_c45_remove, + }, + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-108-net-phy-nxp-c45-tja11xx-fix-unsigned-long-mult.patch b/patches.kernel.org/6.2.12-108-net-phy-nxp-c45-tja11xx-fix-unsigned-long-mult.patch new file mode 100644 index 0000000..cc5d88d --- /dev/null +++ b/patches.kernel.org/6.2.12-108-net-phy-nxp-c45-tja11xx-fix-unsigned-long-mult.patch @@ -0,0 +1,45 @@ +From: "Radu Pirea (OSS)" +Date: Thu, 6 Apr 2023 12:59:53 +0300 +Subject: [PATCH] net: phy: nxp-c45-tja11xx: fix unsigned long multiplication + overflow +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: bdaaecc127d471c422ee9e994978617c8aa79e1e + +commit bdaaecc127d471c422ee9e994978617c8aa79e1e upstream. + +Any multiplication between GENMASK(31, 0) and a number bigger than 1 +will be truncated because of the overflow, if the size of unsigned long +is 32 bits. + +Replaced GENMASK with GENMASK_ULL to make sure that multiplication will +be between 64 bits values. + +Cc: # 5.15+ +Fixes: 514def5dd339 ("phy: nxp-c45-tja11xx: add timestamping support") +Signed-off-by: Radu Pirea (OSS) +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20230406095953.75622-1-radu-nicolae.pirea@oss.nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/net/phy/nxp-c45-tja11xx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/phy/nxp-c45-tja11xx.c b/drivers/net/phy/nxp-c45-tja11xx.c +index 27738d1a..029875a5 100644 +--- a/drivers/net/phy/nxp-c45-tja11xx.c ++++ b/drivers/net/phy/nxp-c45-tja11xx.c +@@ -191,7 +191,7 @@ + #define MAX_ID_PS 2260U + #define DEFAULT_ID_PS 2000U + +-#define PPM_TO_SUBNS_INC(ppb) div_u64(GENMASK(31, 0) * (ppb) * \ ++#define PPM_TO_SUBNS_INC(ppb) div_u64(GENMASK_ULL(31, 0) * (ppb) * \ + PTP_CLK_PERIOD_100BT1, NSEC_PER_SEC) + + #define NXP_C45_SKB_CB(skb) ((struct nxp_c45_skb_cb *)(skb)->cb) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-109-scsi-ses-Handle-enclosure-with-just-a-primary-.patch b/patches.kernel.org/6.2.12-109-scsi-ses-Handle-enclosure-with-just-a-primary-.patch new file mode 100644 index 0000000..e5c8633 --- /dev/null +++ b/patches.kernel.org/6.2.12-109-scsi-ses-Handle-enclosure-with-just-a-primary-.patch @@ -0,0 +1,148 @@ +From: Jiri Kosina +Date: Tue, 4 Apr 2023 21:23:42 +0200 +Subject: [PATCH] scsi: ses: Handle enclosure with just a primary component + gracefully +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: c8e22b7a1694bb8d025ea636816472739d859145 + +commit c8e22b7a1694bb8d025ea636816472739d859145 upstream. + +This reverts commit 3fe97ff3d949 ("scsi: ses: Don't attach if enclosure +has no components") and introduces proper handling of case where there are +no detected secondary components, but primary component (enumerated in +num_enclosures) does exist. That fix was originally proposed by Ding Hui +. + +Completely ignoring devices that have one primary enclosure and no +secondary one results in ses_intf_add() bailing completely + + scsi 2:0:0:254: enclosure has no enumerated components + scsi 2:0:0:254: Failed to bind enclosure -12ven in valid configurations such + +even on valid configurations with 1 primary and 0 secondary enclosures as +below: + + # sg_ses /dev/sg0 + 3PARdata SES 3321 + Supported diagnostic pages: + Supported Diagnostic Pages [sdp] [0x0] + Configuration (SES) [cf] [0x1] + Short Enclosure Status (SES) [ses] [0x8] + # sg_ses -p cf /dev/sg0 + 3PARdata SES 3321 + Configuration diagnostic page: + number of secondary subenclosures: 0 + generation code: 0x0 + enclosure descriptor list + Subenclosure identifier: 0 [primary] + relative ES process id: 0, number of ES processes: 1 + number of type descriptor headers: 1 + enclosure logical identifier (hex): 20000002ac02068d + enclosure vendor: 3PARdata product: VV rev: 3321 + type descriptor header and text list + Element type: Unspecified, subenclosure id: 0 + number of possible elements: 1 + +The changelog for the original fix follows + +===== +We can get a crash when disconnecting the iSCSI session, +the call trace like this: + + [ffff00002a00fb70] kfree at ffff00000830e224 + [ffff00002a00fba0] ses_intf_remove at ffff000001f200e4 + [ffff00002a00fbd0] device_del at ffff0000086b6a98 + [ffff00002a00fc50] device_unregister at ffff0000086b6d58 + [ffff00002a00fc70] __scsi_remove_device at ffff00000870608c + [ffff00002a00fca0] scsi_remove_device at ffff000008706134 + [ffff00002a00fcc0] __scsi_remove_target at ffff0000087062e4 + [ffff00002a00fd10] scsi_remove_target at ffff0000087064c0 + [ffff00002a00fd70] __iscsi_unbind_session at ffff000001c872c4 + [ffff00002a00fdb0] process_one_work at ffff00000810f35c + [ffff00002a00fe00] worker_thread at ffff00000810f648 + [ffff00002a00fe70] kthread at ffff000008116e98 + +In ses_intf_add, components count could be 0, and kcalloc 0 size scomp, +but not saved in edev->component[i].scratch + +In this situation, edev->component[0].scratch is an invalid pointer, +when kfree it in ses_intf_remove_enclosure, a crash like above would happen +The call trace also could be other random cases when kfree cannot catch +the invalid pointer + +We should not use edev->component[] array when the components count is 0 +We also need check index when use edev->component[] array in +ses_enclosure_data_process +===== + +Reported-by: Michal Kolar +Originally-by: Ding Hui +Cc: stable@vger.kernel.org +Fixes: 3fe97ff3d949 ("scsi: ses: Don't attach if enclosure has no components") +Signed-off-by: Jiri Kosina +Link: https://lore.kernel.org/r/nycvar.YFH.7.76.2304042122270.29760@cbobk.fhfr.pm +Tested-by: Michal Kolar +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/scsi/ses.c | 20 ++++++++------------ + 1 file changed, 8 insertions(+), 12 deletions(-) + +diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c +index 1707d6d1..6a1428d4 100644 +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -503,9 +503,6 @@ static int ses_enclosure_find_by_addr(struct enclosure_device *edev, + int i; + struct ses_component *scomp; + +- if (!edev->component[0].scratch) +- return 0; +- + for (i = 0; i < edev->components; i++) { + scomp = edev->component[i].scratch; + if (scomp->addr != efd->addr) +@@ -596,8 +593,10 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, + components++, + type_ptr[0], + name); +- else ++ else if (components < edev->components) + ecomp = &edev->component[components++]; ++ else ++ ecomp = ERR_PTR(-EINVAL); + + if (!IS_ERR(ecomp)) { + if (addl_desc_ptr) { +@@ -728,11 +727,6 @@ static int ses_intf_add(struct device *cdev, + components += type_ptr[1]; + } + +- if (components == 0) { +- sdev_printk(KERN_WARNING, sdev, "enclosure has no enumerated components\n"); +- goto err_free; +- } +- + ses_dev->page1 = buf; + ses_dev->page1_len = len; + buf = NULL; +@@ -774,9 +768,11 @@ static int ses_intf_add(struct device *cdev, + buf = NULL; + } + page2_not_supported: +- scomp = kcalloc(components, sizeof(struct ses_component), GFP_KERNEL); +- if (!scomp) +- goto err_free; ++ if (components > 0) { ++ scomp = kcalloc(components, sizeof(struct ses_component), GFP_KERNEL); ++ if (!scomp) ++ goto err_free; ++ } + + edev = enclosure_register(cdev->parent, dev_name(&sdev->sdev_gendev), + components, &ses_enclosure_callbacks); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-110-thermal-intel-Avoid-updating-unsupported-THERM.patch b/patches.kernel.org/6.2.12-110-thermal-intel-Avoid-updating-unsupported-THERM.patch new file mode 100644 index 0000000..2fdd44c --- /dev/null +++ b/patches.kernel.org/6.2.12-110-thermal-intel-Avoid-updating-unsupported-THERM.patch @@ -0,0 +1,144 @@ +From: Srinivas Pandruvada +Date: Mon, 10 Apr 2023 10:35:01 -0700 +Subject: [PATCH] thermal: intel: Avoid updating unsupported THERM_STATUS_CLEAR + mask bits +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 117e4e5bd9d47b89777dbf6b37a709dcfe59520f + +commit 117e4e5bd9d47b89777dbf6b37a709dcfe59520f upstream. + +Some older processors don't allow BIT(13) and BIT(15) in the current +mask set by "THERM_STATUS_CLEAR_CORE_MASK". This results in: + +unchecked MSR access error: WRMSR to 0x19c (tried to +write 0x000000000000aaa8) at rIP: 0xffffffff816f66a6 +(throttle_active_work+0xa6/0x1d0) + +To avoid unchecked MSR issues, check CPUID for each relevant feature and +use that information to set the supported feature bits only in the +"clear" mask for cores. Do the same for the analogous package mask set +by "THERM_STATUS_CLEAR_PKG_MASK". + +Introduce functions thermal_intr_init_core_clear_mask() and +thermal_intr_init_pkg_clear_mask() to set core and package mask bits, +respectively. These functions are called during initialization. + +Fixes: 6fe1e64b6026 ("thermal: intel: Prevent accidental clearing of HFI status") +Reported-by: Rui Salvaterra +Link: https://lore.kernel.org/lkml/cdf43fb423368ee3994124a9e8c9b4f8d00712c6.camel@linux.intel.com/T/ +Tested-by: Rui Salvaterra +Signed-off-by: Srinivas Pandruvada +Cc: 6.2+ # 6.2+ +[ rjw: Renamed 2 funtions and 2 static variables, edited subject and + changelog ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/thermal/intel/therm_throt.c | 73 ++++++++++++++++++++++++++--- + 1 file changed, 66 insertions(+), 7 deletions(-) + +diff --git a/drivers/thermal/intel/therm_throt.c b/drivers/thermal/intel/therm_throt.c +index 2e22bb82..e69868e8 100644 +--- a/drivers/thermal/intel/therm_throt.c ++++ b/drivers/thermal/intel/therm_throt.c +@@ -193,8 +193,67 @@ static const struct attribute_group thermal_attr_group = { + #define THERM_THROT_POLL_INTERVAL HZ + #define THERM_STATUS_PROCHOT_LOG BIT(1) + +-#define THERM_STATUS_CLEAR_CORE_MASK (BIT(1) | BIT(3) | BIT(5) | BIT(7) | BIT(9) | BIT(11) | BIT(13) | BIT(15)) +-#define THERM_STATUS_CLEAR_PKG_MASK (BIT(1) | BIT(3) | BIT(5) | BIT(7) | BIT(9) | BIT(11)) ++static u64 therm_intr_core_clear_mask; ++static u64 therm_intr_pkg_clear_mask; ++ ++static void thermal_intr_init_core_clear_mask(void) ++{ ++ if (therm_intr_core_clear_mask) ++ return; ++ ++ /* ++ * Reference: Intel SDM Volume 4 ++ * "Table 2-2. IA-32 Architectural MSRs", MSR 0x19C ++ * IA32_THERM_STATUS. ++ */ ++ ++ /* ++ * Bit 1, 3, 5: CPUID.01H:EDX[22] = 1. This driver will not ++ * enable interrupts, when 0 as it checks for X86_FEATURE_ACPI. ++ */ ++ therm_intr_core_clear_mask = (BIT(1) | BIT(3) | BIT(5)); ++ ++ /* ++ * Bit 7 and 9: Thermal Threshold #1 and #2 log ++ * If CPUID.01H:ECX[8] = 1 ++ */ ++ if (boot_cpu_has(X86_FEATURE_TM2)) ++ therm_intr_core_clear_mask |= (BIT(7) | BIT(9)); ++ ++ /* Bit 11: Power Limitation log (R/WC0) If CPUID.06H:EAX[4] = 1 */ ++ if (boot_cpu_has(X86_FEATURE_PLN)) ++ therm_intr_core_clear_mask |= BIT(11); ++ ++ /* ++ * Bit 13: Current Limit log (R/WC0) If CPUID.06H:EAX[7] = 1 ++ * Bit 15: Cross Domain Limit log (R/WC0) If CPUID.06H:EAX[7] = 1 ++ */ ++ if (boot_cpu_has(X86_FEATURE_HWP)) ++ therm_intr_core_clear_mask |= (BIT(13) | BIT(15)); ++} ++ ++static void thermal_intr_init_pkg_clear_mask(void) ++{ ++ if (therm_intr_pkg_clear_mask) ++ return; ++ ++ /* ++ * Reference: Intel SDM Volume 4 ++ * "Table 2-2. IA-32 Architectural MSRs", MSR 0x1B1 ++ * IA32_PACKAGE_THERM_STATUS. ++ */ ++ ++ /* All bits except BIT 26 depend on CPUID.06H: EAX[6] = 1 */ ++ if (boot_cpu_has(X86_FEATURE_PTS)) ++ therm_intr_pkg_clear_mask = (BIT(1) | BIT(3) | BIT(5) | BIT(7) | BIT(9) | BIT(11)); ++ ++ /* ++ * Intel SDM Volume 2A: Thermal and Power Management Leaf ++ * Bit 26: CPUID.06H: EAX[19] = 1 ++ */ ++ if (boot_cpu_has(X86_FEATURE_HFI)) ++ therm_intr_pkg_clear_mask |= BIT(26); ++} + + /* + * Clear the bits in package thermal status register for bit = 1 +@@ -207,13 +266,10 @@ void thermal_clear_package_intr_status(int level, u64 bit_mask) + + if (level == CORE_LEVEL) { + msr = MSR_IA32_THERM_STATUS; +- msr_val = THERM_STATUS_CLEAR_CORE_MASK; ++ msr_val = therm_intr_core_clear_mask; + } else { + msr = MSR_IA32_PACKAGE_THERM_STATUS; +- msr_val = THERM_STATUS_CLEAR_PKG_MASK; +- if (boot_cpu_has(X86_FEATURE_HFI)) +- msr_val |= BIT(26); +- ++ msr_val = therm_intr_pkg_clear_mask; + } + + msr_val &= ~bit_mask; +@@ -708,6 +764,9 @@ void intel_init_thermal(struct cpuinfo_x86 *c) + h = THERMAL_APIC_VECTOR | APIC_DM_FIXED | APIC_LVT_MASKED; + apic_write(APIC_LVTTHMR, h); + ++ thermal_intr_init_core_clear_mask(); ++ thermal_intr_init_pkg_clear_mask(); ++ + rdmsr(MSR_IA32_THERM_INTERRUPT, l, h); + if (cpu_has(c, X86_FEATURE_PLN) && !int_pln_enable) + wrmsr(MSR_IA32_THERM_INTERRUPT, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-111-drm-amd-pm-correct-the-pcie-link-state-check-f.patch b/patches.kernel.org/6.2.12-111-drm-amd-pm-correct-the-pcie-link-state-check-f.patch new file mode 100644 index 0000000..696837a --- /dev/null +++ b/patches.kernel.org/6.2.12-111-drm-amd-pm-correct-the-pcie-link-state-check-f.patch @@ -0,0 +1,74 @@ +From: Evan Quan +Date: Fri, 7 Apr 2023 17:12:15 +0800 +Subject: [PATCH] drm/amd/pm: correct the pcie link state check for SMU13 +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: b9a24d8bd51e2db425602fa82d7f4c06aa3db852 + +commit b9a24d8bd51e2db425602fa82d7f4c06aa3db852 upstream. + +Update the driver implementations to fit those data exposed +by PMFW. + +Signed-off-by: Evan Quan +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.1.x +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 6 ++++++ + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 4 ++-- + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 4 ++-- + 3 files changed, 10 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h b/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h +index bffa6247..61210053 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h ++++ b/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h +@@ -61,6 +61,12 @@ + #define CTF_OFFSET_HOTSPOT 5 + #define CTF_OFFSET_MEM 5 + ++static const int pmfw_decoded_link_speed[5] = {1, 2, 3, 4, 5}; ++static const int pmfw_decoded_link_width[7] = {0, 1, 2, 4, 8, 12, 16}; ++ ++#define DECODE_GEN_SPEED(gen_speed_idx) (pmfw_decoded_link_speed[gen_speed_idx]) ++#define DECODE_LANE_WIDTH(lane_width_idx) (pmfw_decoded_link_width[lane_width_idx]) ++ + struct smu_13_0_max_sustainable_clocks { + uint32_t display_clock; + uint32_t phy_clock; +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +index 508e3925..9431f2cb 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +@@ -1125,8 +1125,8 @@ static int smu_v13_0_0_print_clk_levels(struct smu_context *smu, + (pcie_table->pcie_lane[i] == 5) ? "x12" : + (pcie_table->pcie_lane[i] == 6) ? "x16" : "", + pcie_table->clk_freq[i], +- ((gen_speed - 1) == pcie_table->pcie_gen[i]) && +- (lane_width == link_width[pcie_table->pcie_lane[i]]) ? ++ (gen_speed == DECODE_GEN_SPEED(pcie_table->pcie_gen[i])) && ++ (lane_width == DECODE_LANE_WIDTH(link_width[pcie_table->pcie_lane[i]])) ? + "*" : ""); + break; + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c +index 9e1967d8..8432357e 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c +@@ -1074,8 +1074,8 @@ static int smu_v13_0_7_print_clk_levels(struct smu_context *smu, + (pcie_table->pcie_lane[i] == 5) ? "x12" : + (pcie_table->pcie_lane[i] == 6) ? "x16" : "", + pcie_table->clk_freq[i], +- (gen_speed == pcie_table->pcie_gen[i]) && +- (lane_width == pcie_table->pcie_lane[i]) ? ++ (gen_speed == DECODE_GEN_SPEED(pcie_table->pcie_gen[i])) && ++ (lane_width == DECODE_LANE_WIDTH(pcie_table->pcie_lane[i])) ? + "*" : ""); + break; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-112-PCI-Fix-use-after-free-in-pci_bus_release_doma.patch b/patches.kernel.org/6.2.12-112-PCI-Fix-use-after-free-in-pci_bus_release_doma.patch new file mode 100644 index 0000000..0a26cdd --- /dev/null +++ b/patches.kernel.org/6.2.12-112-PCI-Fix-use-after-free-in-pci_bus_release_doma.patch @@ -0,0 +1,106 @@ +From: Rob Herring +Date: Wed, 29 Mar 2023 07:38:35 -0500 +Subject: [PATCH] PCI: Fix use-after-free in pci_bus_release_domain_nr() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 30ba2d09edb5ea857a1473ae3d820911347ada62 + +commit 30ba2d09edb5ea857a1473ae3d820911347ada62 upstream. + +Commit c14f7ccc9f5d ("PCI: Assign PCI domain IDs by ida_alloc()") +introduced a use-after-free bug in the bus removal cleanup. The issue was +found with kfence: + + [ 19.293351] BUG: KFENCE: use-after-free read in pci_bus_release_domain_nr+0x10/0x70 + + [ 19.302817] Use-after-free read at 0x000000007f3b80eb (in kfence-#115): + [ 19.309677] pci_bus_release_domain_nr+0x10/0x70 + [ 19.309691] dw_pcie_host_deinit+0x28/0x78 + [ 19.309702] tegra_pcie_deinit_controller+0x1c/0x38 [pcie_tegra194] + [ 19.309734] tegra_pcie_dw_probe+0x648/0xb28 [pcie_tegra194] + [ 19.309752] platform_probe+0x90/0xd8 + ... + + [ 19.311457] kfence-#115: 0x00000000063a155a-0x00000000ba698da8, size=1072, cache=kmalloc-2k + + [ 19.311469] allocated by task 96 on cpu 10 at 19.279323s: + [ 19.311562] __kmem_cache_alloc_node+0x260/0x278 + [ 19.311571] kmalloc_trace+0x24/0x30 + [ 19.311580] pci_alloc_bus+0x24/0xa0 + [ 19.311590] pci_register_host_bridge+0x48/0x4b8 + [ 19.311601] pci_scan_root_bus_bridge+0xc0/0xe8 + [ 19.311613] pci_host_probe+0x18/0xc0 + [ 19.311623] dw_pcie_host_init+0x2c0/0x568 + [ 19.311630] tegra_pcie_dw_probe+0x610/0xb28 [pcie_tegra194] + [ 19.311647] platform_probe+0x90/0xd8 + ... + + [ 19.311782] freed by task 96 on cpu 10 at 19.285833s: + [ 19.311799] release_pcibus_dev+0x30/0x40 + [ 19.311808] device_release+0x30/0x90 + [ 19.311814] kobject_put+0xa8/0x120 + [ 19.311832] device_unregister+0x20/0x30 + [ 19.311839] pci_remove_bus+0x78/0x88 + [ 19.311850] pci_remove_root_bus+0x5c/0x98 + [ 19.311860] dw_pcie_host_deinit+0x28/0x78 + [ 19.311866] tegra_pcie_deinit_controller+0x1c/0x38 [pcie_tegra194] + [ 19.311883] tegra_pcie_dw_probe+0x648/0xb28 [pcie_tegra194] + [ 19.311900] platform_probe+0x90/0xd8 + ... + + [ 19.313579] CPU: 10 PID: 96 Comm: kworker/u24:2 Not tainted 6.2.0 #4 + [ 19.320171] Hardware name: /, BIOS 1.0-d7fb19b 08/10/2022 + [ 19.325852] Workqueue: events_unbound deferred_probe_work_func + +The stack trace is a bit misleading as dw_pcie_host_deinit() doesn't +directly call pci_bus_release_domain_nr(). The issue turns out to be in +pci_remove_root_bus() which first calls pci_remove_bus() which frees the +struct pci_bus when its struct device is released. Then +pci_bus_release_domain_nr() is called and accesses the freed struct +pci_bus. Reordering these fixes the issue. + +Fixes: c14f7ccc9f5d ("PCI: Assign PCI domain IDs by ida_alloc()") +Link: https://lore.kernel.org/r/20230329123835.2724518-1-robh@kernel.org +Link: https://lore.kernel.org/r/b529cb69-0602-9eed-fc02-2f068707a006@nvidia.com +Reported-by: Jon Hunter +Tested-by: Jon Hunter +Signed-off-by: Rob Herring +Signed-off-by: Bjorn Helgaas +Reviewed-by: Kuppuswamy Sathyanarayanan +Cc: stable@vger.kernel.org # v6.2+ +Cc: Pali Rohár +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/pci/remove.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c +index 0145aef1..22d39e12 100644 +--- a/drivers/pci/remove.c ++++ b/drivers/pci/remove.c +@@ -157,8 +157,6 @@ void pci_remove_root_bus(struct pci_bus *bus) + list_for_each_entry_safe(child, tmp, + &bus->devices, bus_list) + pci_remove_bus_device(child); +- pci_remove_bus(bus); +- host_bridge->bus = NULL; + + #ifdef CONFIG_PCI_DOMAINS_GENERIC + /* Release domain_nr if it was dynamically allocated */ +@@ -166,6 +164,9 @@ void pci_remove_root_bus(struct pci_bus *bus) + pci_bus_release_domain_nr(bus, host_bridge->dev.parent); + #endif + ++ pci_remove_bus(bus); ++ host_bridge->bus = NULL; ++ + /* remove the host bridge */ + device_del(&host_bridge->dev); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-113-PCI-MSI-Provide-missing-stub-for-pci_msix_can_.patch b/patches.kernel.org/6.2.12-113-PCI-MSI-Provide-missing-stub-for-pci_msix_can_.patch new file mode 100644 index 0000000..ff6d324 --- /dev/null +++ b/patches.kernel.org/6.2.12-113-PCI-MSI-Provide-missing-stub-for-pci_msix_can_.patch @@ -0,0 +1,54 @@ +From: Reinette Chatre +Date: Wed, 29 Mar 2023 13:13:11 -0700 +Subject: [PATCH] PCI/MSI: Provide missing stub for pci_msix_can_alloc_dyn() +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 195d8e5da3acb17c5357526494f818a21e97cd10 + +commit 195d8e5da3acb17c5357526494f818a21e97cd10 upstream. + +pci_msix_can_alloc_dyn() is not declared when CONFIG_PCI_MSI is disabled. + +There is no existing user of pci_msix_can_alloc_dyn() but work is in +progress to change this. This work encounters the following error when +CONFIG_PCI_MSI is disabled: + + drivers/vfio/pci/vfio_pci_intrs.c:427:21: error: implicit declaration of function 'pci_msix_can_alloc_dyn' [-Werror=implicit-function-declaration] + +Provide definition for pci_msix_can_alloc_dyn() in preparation for users +that need to compile when CONFIG_PCI_MSI is disabled. + +[bhelgaas: Also reported by Arnd Bergmann in +drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c; added his Fixes: line] + +Fixes: fb0a6a268dcd ("net/mlx5: Provide external API for allocating vectors") +Fixes: 34026364df8e ("PCI/MSI: Provide post-enable dynamic allocation interfaces for MSI-X") +Link: https://lore.kernel.org/oe-kbuild-all/202303291000.PWFqGCxH-lkp@intel.com/ +Link: https://lore.kernel.org/r/310ecc4815dae4174031062f525245f0755c70e2.1680119924.git.reinette.chatre@intel.com +Reported-by: kernel test robot +Signed-off-by: Reinette Chatre +Signed-off-by: Bjorn Helgaas +Reviewed-by: Kuppuswamy Sathyanarayanan +Cc: stable@vger.kernel.org # v6.2+ +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + include/linux/pci.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/include/linux/pci.h b/include/linux/pci.h +index db6ec828..7e8e8633 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -1623,6 +1623,8 @@ pci_alloc_irq_vectors(struct pci_dev *dev, unsigned int min_vecs, + flags, NULL); + } + ++static inline bool pci_msix_can_alloc_dyn(struct pci_dev *dev) ++{ return false; } + static inline struct msi_map pci_msix_alloc_irq_at(struct pci_dev *dev, unsigned int index, + const struct irq_affinity_desc *affdesc) + { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-114-x86-PCI-Add-quirk-for-AMD-XHCI-controller-that.patch b/patches.kernel.org/6.2.12-114-x86-PCI-Add-quirk-for-AMD-XHCI-controller-that.patch new file mode 100644 index 0000000..552e854 --- /dev/null +++ b/patches.kernel.org/6.2.12-114-x86-PCI-Add-quirk-for-AMD-XHCI-controller-that.patch @@ -0,0 +1,72 @@ +From: Basavaraj Natikar +Date: Wed, 29 Mar 2023 22:58:59 +0530 +Subject: [PATCH] x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X + state in D3hot +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: f195fc1e9715ba826c3b62d58038f760f66a4fe9 + +commit f195fc1e9715ba826c3b62d58038f760f66a4fe9 upstream. + +The AMD [1022:15b8] USB controller loses some internal functional MSI-X +context when transitioning from D0 to D3hot. BIOS normally traps D0->D3hot +and D3hot->D0 transitions so it can save and restore that internal context, +but some firmware in the field can't do this because it fails to clear the +AMD_15B8_RCC_DEV2_EPF0_STRAP2 NO_SOFT_RESET bit. + +Clear AMD_15B8_RCC_DEV2_EPF0_STRAP2 NO_SOFT_RESET bit before USB controller +initialization during boot. + +Link: https://lore.kernel.org/linux-usb/Y%2Fz9GdHjPyF2rNG3@glanzmann.de/T/#u +Link: https://lore.kernel.org/r/20230329172859.699743-1-Basavaraj.Natikar@amd.com +Reported-by: Thomas Glanzmann +Tested-by: Thomas Glanzmann +Signed-off-by: Basavaraj Natikar +Signed-off-by: Bjorn Helgaas +Reviewed-by: Mario Limonciello +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/pci/fixup.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c +index 615a76d7..bf5161dc 100644 +--- a/arch/x86/pci/fixup.c ++++ b/arch/x86/pci/fixup.c +@@ -7,6 +7,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -824,3 +825,23 @@ static void rs690_fix_64bit_dma(struct pci_dev *pdev) + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7910, rs690_fix_64bit_dma); + + #endif ++ ++#ifdef CONFIG_AMD_NB ++ ++#define AMD_15B8_RCC_DEV2_EPF0_STRAP2 0x10136008 ++#define AMD_15B8_RCC_DEV2_EPF0_STRAP2_NO_SOFT_RESET_DEV2_F0_MASK 0x00000080L ++ ++static void quirk_clear_strap_no_soft_reset_dev2_f0(struct pci_dev *dev) ++{ ++ u32 data; ++ ++ if (!amd_smn_read(0, AMD_15B8_RCC_DEV2_EPF0_STRAP2, &data)) { ++ data &= ~AMD_15B8_RCC_DEV2_EPF0_STRAP2_NO_SOFT_RESET_DEV2_F0_MASK; ++ if (amd_smn_write(0, AMD_15B8_RCC_DEV2_EPF0_STRAP2, data)) ++ pci_err(dev, "Failed to write data 0x%x\n", data); ++ } else { ++ pci_err(dev, "Failed to read data\n"); ++ } ++} ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x15b8, quirk_clear_strap_no_soft_reset_dev2_f0); ++#endif +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-115-cgroup-fix-display-of-forceidle-time-at-root.patch b/patches.kernel.org/6.2.12-115-cgroup-fix-display-of-forceidle-time-at-root.patch new file mode 100644 index 0000000..9a51dd2 --- /dev/null +++ b/patches.kernel.org/6.2.12-115-cgroup-fix-display-of-forceidle-time-at-root.patch @@ -0,0 +1,43 @@ +From: Josh Don +Date: Wed, 15 Mar 2023 14:40:29 -0700 +Subject: [PATCH] cgroup: fix display of forceidle time at root +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: fcdb1eda5302599045bb366e679cccb4216f3873 + +commit fcdb1eda5302599045bb366e679cccb4216f3873 upstream. + +We need to reset forceidle_sum to 0 when reading from root, since the +bstat we accumulate into is stack allocated. + +To make this more robust, just replace the existing cputime reset with a +memset of the overall bstat. + +Signed-off-by: Josh Don +Fixes: 1fcf54deb767 ("sched/core: add forced idle accounting for cgroups") +Cc: stable@vger.kernel.org # v6.0+ +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/cgroup/rstat.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/kernel/cgroup/rstat.c b/kernel/cgroup/rstat.c +index 793ecff2..7006fc8d 100644 +--- a/kernel/cgroup/rstat.c ++++ b/kernel/cgroup/rstat.c +@@ -457,9 +457,7 @@ static void root_cgroup_cputime(struct cgroup_base_stat *bstat) + struct task_cputime *cputime = &bstat->cputime; + int i; + +- cputime->stime = 0; +- cputime->utime = 0; +- cputime->sum_exec_runtime = 0; ++ memset(bstat, 0, sizeof(*bstat)); + for_each_possible_cpu(i) { + struct kernel_cpustat kcpustat; + u64 *cpustat = kcpustat.cpustat; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-116-cgroup-cpuset-Fix-partition-root-s-cpuset.cpus.patch b/patches.kernel.org/6.2.12-116-cgroup-cpuset-Fix-partition-root-s-cpuset.cpus.patch new file mode 100644 index 0000000..5ee1a4a --- /dev/null +++ b/patches.kernel.org/6.2.12-116-cgroup-cpuset-Fix-partition-root-s-cpuset.cpus.patch @@ -0,0 +1,74 @@ +From: Waiman Long +Date: Fri, 17 Mar 2023 11:15:05 -0400 +Subject: [PATCH] cgroup/cpuset: Fix partition root's cpuset.cpus update bug +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 292fd843de26c551856e66faf134512c52dd78b4 + +commit 292fd843de26c551856e66faf134512c52dd78b4 upstream. + +It was found that commit 7a2127e66a00 ("cpuset: Call +set_cpus_allowed_ptr() with appropriate mask for task") introduced a bug +that corrupted "cpuset.cpus" of a partition root when it was updated. + +It is because the tmp->new_cpus field of the passed tmp parameter +of update_parent_subparts_cpumask() should not be used at all as +it contains important cpumask data that should not be overwritten. +Fix it by using tmp->addmask instead. + +Also update update_cpumask() to make sure that trialcs->cpu_allowed +will not be corrupted until it is no longer needed. + +Fixes: 7a2127e66a00 ("cpuset: Call set_cpus_allowed_ptr() with appropriate mask for task") +Signed-off-by: Waiman Long +Cc: stable@vger.kernel.org # v6.2+ +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/cgroup/cpuset.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index ca826bd1..56fb79a4 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -1513,7 +1513,7 @@ static int update_parent_subparts_cpumask(struct cpuset *cs, int cmd, + spin_unlock_irq(&callback_lock); + + if (adding || deleting) +- update_tasks_cpumask(parent, tmp->new_cpus); ++ update_tasks_cpumask(parent, tmp->addmask); + + /* + * Set or clear CS_SCHED_LOAD_BALANCE when partcmd_update, if necessary. +@@ -1770,10 +1770,13 @@ static int update_cpumask(struct cpuset *cs, struct cpuset *trialcs, + /* + * Use the cpumasks in trialcs for tmpmasks when they are pointers + * to allocated cpumasks. ++ * ++ * Note that update_parent_subparts_cpumask() uses only addmask & ++ * delmask, but not new_cpus. + */ + tmp.addmask = trialcs->subparts_cpus; + tmp.delmask = trialcs->effective_cpus; +- tmp.new_cpus = trialcs->cpus_allowed; ++ tmp.new_cpus = NULL; + #endif + + retval = validate_change(cs, trialcs); +@@ -1838,6 +1841,11 @@ static int update_cpumask(struct cpuset *cs, struct cpuset *trialcs, + } + spin_unlock_irq(&callback_lock); + ++#ifdef CONFIG_CPUMASK_OFFSTACK ++ /* Now trialcs->cpus_allowed is available */ ++ tmp.new_cpus = trialcs->cpus_allowed; ++#endif ++ + /* effective_cpus will be updated here */ + update_cpumasks_hier(cs, &tmp, false); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-117-cgroup-cpuset-Wake-up-cpuset_attach_wq-tasks-i.patch b/patches.kernel.org/6.2.12-117-cgroup-cpuset-Wake-up-cpuset_attach_wq-tasks-i.patch new file mode 100644 index 0000000..5bbe2c4 --- /dev/null +++ b/patches.kernel.org/6.2.12-117-cgroup-cpuset-Wake-up-cpuset_attach_wq-tasks-i.patch @@ -0,0 +1,56 @@ +From: Waiman Long +Date: Tue, 11 Apr 2023 09:35:57 -0400 +Subject: [PATCH] cgroup/cpuset: Wake up cpuset_attach_wq tasks in + cpuset_cancel_attach() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: ba9182a89626d5f83c2ee4594f55cb9c1e60f0e2 + +commit ba9182a89626d5f83c2ee4594f55cb9c1e60f0e2 upstream. + +After a successful cpuset_can_attach() call which increments the +attach_in_progress flag, either cpuset_cancel_attach() or cpuset_attach() +will be called later. In cpuset_attach(), tasks in cpuset_attach_wq, +if present, will be woken up at the end. That is not the case in +cpuset_cancel_attach(). So missed wakeup is possible if the attach +operation is somehow cancelled. Fix that by doing the wakeup in +cpuset_cancel_attach() as well. + +Fixes: e44193d39e8d ("cpuset: let hotplug propagation work wait for task attaching") +Signed-off-by: Waiman Long +Reviewed-by: Michal Koutný +Cc: stable@vger.kernel.org # v3.11+ +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/cgroup/cpuset.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index 56fb79a4..86cd79e8 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -2502,11 +2502,15 @@ static int cpuset_can_attach(struct cgroup_taskset *tset) + static void cpuset_cancel_attach(struct cgroup_taskset *tset) + { + struct cgroup_subsys_state *css; ++ struct cpuset *cs; + + cgroup_taskset_first(tset, &css); ++ cs = css_cs(css); + + percpu_down_write(&cpuset_rwsem); +- css_cs(css)->attach_in_progress--; ++ cs->attach_in_progress--; ++ if (!cs->attach_in_progress) ++ wake_up(&cpuset_attach_wq); + percpu_up_write(&cpuset_rwsem); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-118-cgroup-cpuset-Make-cpuset_fork-handle-CLONE_IN.patch b/patches.kernel.org/6.2.12-118-cgroup-cpuset-Make-cpuset_fork-handle-CLONE_IN.patch new file mode 100644 index 0000000..0a6bd79 --- /dev/null +++ b/patches.kernel.org/6.2.12-118-cgroup-cpuset-Make-cpuset_fork-handle-CLONE_IN.patch @@ -0,0 +1,135 @@ +From: Waiman Long +Date: Tue, 11 Apr 2023 09:35:58 -0400 +Subject: [PATCH] cgroup/cpuset: Make cpuset_fork() handle CLONE_INTO_CGROUP + properly +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 42a11bf5c5436e91b040aeb04063be1710bb9f9c + +commit 42a11bf5c5436e91b040aeb04063be1710bb9f9c upstream. + +By default, the clone(2) syscall spawn a child process into the same +cgroup as its parent. With the use of the CLONE_INTO_CGROUP flag +introduced by commit ef2c41cf38a7 ("clone3: allow spawning processes +into cgroups"), the child will be spawned into a different cgroup which +is somewhat similar to writing the child's tid into "cgroup.threads". + +The current cpuset_fork() method does not properly handle the +CLONE_INTO_CGROUP case where the cpuset of the child may be different +from that of its parent. Update the cpuset_fork() method to treat the +CLONE_INTO_CGROUP case similar to cpuset_attach(). + +Since the newly cloned task has not been running yet, its actual +memory usage isn't known. So it is not necessary to make change to mm +in cpuset_fork(). + +Fixes: ef2c41cf38a7 ("clone3: allow spawning processes into cgroups") +Reported-by: Giuseppe Scrivano +Signed-off-by: Waiman Long +Cc: stable@vger.kernel.org # v5.7+ +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/cgroup/cpuset.c | 62 ++++++++++++++++++++++++++++-------------- + 1 file changed, 42 insertions(+), 20 deletions(-) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index 86cd79e8..9714fd65 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -2515,16 +2515,33 @@ static void cpuset_cancel_attach(struct cgroup_taskset *tset) + } + + /* +- * Protected by cpuset_rwsem. cpus_attach is used only by cpuset_attach() ++ * Protected by cpuset_rwsem. cpus_attach is used only by cpuset_attach_task() + * but we can't allocate it dynamically there. Define it global and + * allocate from cpuset_init(). + */ + static cpumask_var_t cpus_attach; ++static nodemask_t cpuset_attach_nodemask_to; ++ ++static void cpuset_attach_task(struct cpuset *cs, struct task_struct *task) ++{ ++ percpu_rwsem_assert_held(&cpuset_rwsem); ++ ++ if (cs != &top_cpuset) ++ guarantee_online_cpus(task, cpus_attach); ++ else ++ cpumask_copy(cpus_attach, task_cpu_possible_mask(task)); ++ /* ++ * can_attach beforehand should guarantee that this doesn't ++ * fail. TODO: have a better way to handle failure here ++ */ ++ WARN_ON_ONCE(set_cpus_allowed_ptr(task, cpus_attach)); ++ ++ cpuset_change_task_nodemask(task, &cpuset_attach_nodemask_to); ++ cpuset_update_task_spread_flags(cs, task); ++} + + static void cpuset_attach(struct cgroup_taskset *tset) + { +- /* static buf protected by cpuset_rwsem */ +- static nodemask_t cpuset_attach_nodemask_to; + struct task_struct *task; + struct task_struct *leader; + struct cgroup_subsys_state *css; +@@ -2555,20 +2572,8 @@ static void cpuset_attach(struct cgroup_taskset *tset) + + guarantee_online_mems(cs, &cpuset_attach_nodemask_to); + +- cgroup_taskset_for_each(task, css, tset) { +- if (cs != &top_cpuset) +- guarantee_online_cpus(task, cpus_attach); +- else +- cpumask_copy(cpus_attach, task_cpu_possible_mask(task)); +- /* +- * can_attach beforehand should guarantee that this doesn't +- * fail. TODO: have a better way to handle failure here +- */ +- WARN_ON_ONCE(set_cpus_allowed_ptr(task, cpus_attach)); +- +- cpuset_change_task_nodemask(task, &cpuset_attach_nodemask_to); +- cpuset_update_task_spread_flags(cs, task); +- } ++ cgroup_taskset_for_each(task, css, tset) ++ cpuset_attach_task(cs, task); + + /* + * Change mm for all threadgroup leaders. This is expensive and may +@@ -3266,11 +3271,28 @@ static void cpuset_bind(struct cgroup_subsys_state *root_css) + */ + static void cpuset_fork(struct task_struct *task) + { +- if (task_css_is_root(task, cpuset_cgrp_id)) ++ struct cpuset *cs; ++ bool same_cs; ++ ++ rcu_read_lock(); ++ cs = task_cs(task); ++ same_cs = (cs == task_cs(current)); ++ rcu_read_unlock(); ++ ++ if (same_cs) { ++ if (cs == &top_cpuset) ++ return; ++ ++ set_cpus_allowed_ptr(task, current->cpus_ptr); ++ task->mems_allowed = current->mems_allowed; + return; ++ } + +- set_cpus_allowed_ptr(task, current->cpus_ptr); +- task->mems_allowed = current->mems_allowed; ++ /* CLONE_INTO_CGROUP */ ++ percpu_down_write(&cpuset_rwsem); ++ guarantee_online_mems(cs, &cpuset_attach_nodemask_to); ++ cpuset_attach_task(cs, task); ++ percpu_up_write(&cpuset_rwsem); + } + + struct cgroup_subsys cpuset_cgrp_subsys = { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-119-cgroup-cpuset-Add-cpuset_can_fork-and-cpuset_c.patch b/patches.kernel.org/6.2.12-119-cgroup-cpuset-Add-cpuset_can_fork-and-cpuset_c.patch new file mode 100644 index 0000000..b13e850 --- /dev/null +++ b/patches.kernel.org/6.2.12-119-cgroup-cpuset-Add-cpuset_can_fork-and-cpuset_c.patch @@ -0,0 +1,178 @@ +From: Waiman Long +Date: Tue, 11 Apr 2023 09:35:59 -0400 +Subject: [PATCH] cgroup/cpuset: Add cpuset_can_fork() and cpuset_cancel_fork() + methods +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: eee87853794187f6adbe19533ed79c8b44b36a91 + +commit eee87853794187f6adbe19533ed79c8b44b36a91 upstream. + +In the case of CLONE_INTO_CGROUP, not all cpusets are ready to accept +new tasks. It is too late to check that in cpuset_fork(). So we need +to add the cpuset_can_fork() and cpuset_cancel_fork() methods to +pre-check it before we can allow attachment to a different cpuset. + +We also need to set the attach_in_progress flag to alert other code +that a new task is going to be added to the cpuset. + +Fixes: ef2c41cf38a7 ("clone3: allow spawning processes into cgroups") +Suggested-by: Michal Koutný +Signed-off-by: Waiman Long +Cc: stable@vger.kernel.org # v5.7+ +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/cgroup/cpuset.c | 97 +++++++++++++++++++++++++++++++++++++----- + 1 file changed, 86 insertions(+), 11 deletions(-) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index 9714fd65..e89af77e 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -2453,6 +2453,20 @@ static int fmeter_getrate(struct fmeter *fmp) + + static struct cpuset *cpuset_attach_old_cs; + ++/* ++ * Check to see if a cpuset can accept a new task ++ * For v1, cpus_allowed and mems_allowed can't be empty. ++ * For v2, effective_cpus can't be empty. ++ * Note that in v1, effective_cpus = cpus_allowed. ++ */ ++static int cpuset_can_attach_check(struct cpuset *cs) ++{ ++ if (cpumask_empty(cs->effective_cpus) || ++ (!is_in_v2_mode() && nodes_empty(cs->mems_allowed))) ++ return -ENOSPC; ++ return 0; ++} ++ + /* Called by cgroups to determine if a cpuset is usable; cpuset_rwsem held */ + static int cpuset_can_attach(struct cgroup_taskset *tset) + { +@@ -2467,16 +2481,9 @@ static int cpuset_can_attach(struct cgroup_taskset *tset) + + percpu_down_write(&cpuset_rwsem); + +- /* allow moving tasks into an empty cpuset if on default hierarchy */ +- ret = -ENOSPC; +- if (!is_in_v2_mode() && +- (cpumask_empty(cs->cpus_allowed) || nodes_empty(cs->mems_allowed))) +- goto out_unlock; +- +- /* +- * Task cannot be moved to a cpuset with empty effective cpus. +- */ +- if (cpumask_empty(cs->effective_cpus)) ++ /* Check to see if task is allowed in the cpuset */ ++ ret = cpuset_can_attach_check(cs); ++ if (ret) + goto out_unlock; + + cgroup_taskset_for_each(task, css, tset) { +@@ -2493,7 +2500,6 @@ static int cpuset_can_attach(struct cgroup_taskset *tset) + * changes which zero cpus/mems_allowed. + */ + cs->attach_in_progress++; +- ret = 0; + out_unlock: + percpu_up_write(&cpuset_rwsem); + return ret; +@@ -3264,6 +3270,68 @@ static void cpuset_bind(struct cgroup_subsys_state *root_css) + percpu_up_write(&cpuset_rwsem); + } + ++/* ++ * In case the child is cloned into a cpuset different from its parent, ++ * additional checks are done to see if the move is allowed. ++ */ ++static int cpuset_can_fork(struct task_struct *task, struct css_set *cset) ++{ ++ struct cpuset *cs = css_cs(cset->subsys[cpuset_cgrp_id]); ++ bool same_cs; ++ int ret; ++ ++ rcu_read_lock(); ++ same_cs = (cs == task_cs(current)); ++ rcu_read_unlock(); ++ ++ if (same_cs) ++ return 0; ++ ++ lockdep_assert_held(&cgroup_mutex); ++ percpu_down_write(&cpuset_rwsem); ++ ++ /* Check to see if task is allowed in the cpuset */ ++ ret = cpuset_can_attach_check(cs); ++ if (ret) ++ goto out_unlock; ++ ++ ret = task_can_attach(task, cs->effective_cpus); ++ if (ret) ++ goto out_unlock; ++ ++ ret = security_task_setscheduler(task); ++ if (ret) ++ goto out_unlock; ++ ++ /* ++ * Mark attach is in progress. This makes validate_change() fail ++ * changes which zero cpus/mems_allowed. ++ */ ++ cs->attach_in_progress++; ++out_unlock: ++ percpu_up_write(&cpuset_rwsem); ++ return ret; ++} ++ ++static void cpuset_cancel_fork(struct task_struct *task, struct css_set *cset) ++{ ++ struct cpuset *cs = css_cs(cset->subsys[cpuset_cgrp_id]); ++ bool same_cs; ++ ++ rcu_read_lock(); ++ same_cs = (cs == task_cs(current)); ++ rcu_read_unlock(); ++ ++ if (same_cs) ++ return; ++ ++ percpu_down_write(&cpuset_rwsem); ++ cs->attach_in_progress--; ++ if (!cs->attach_in_progress) ++ wake_up(&cpuset_attach_wq); ++ percpu_up_write(&cpuset_rwsem); ++} ++ + /* + * Make sure the new task conform to the current state of its parent, + * which could have been changed by cpuset just after it inherits the +@@ -3292,6 +3360,11 @@ static void cpuset_fork(struct task_struct *task) + percpu_down_write(&cpuset_rwsem); + guarantee_online_mems(cs, &cpuset_attach_nodemask_to); + cpuset_attach_task(cs, task); ++ ++ cs->attach_in_progress--; ++ if (!cs->attach_in_progress) ++ wake_up(&cpuset_attach_wq); ++ + percpu_up_write(&cpuset_rwsem); + } + +@@ -3305,6 +3378,8 @@ struct cgroup_subsys cpuset_cgrp_subsys = { + .attach = cpuset_attach, + .post_attach = cpuset_post_attach, + .bind = cpuset_bind, ++ .can_fork = cpuset_can_fork, ++ .cancel_fork = cpuset_cancel_fork, + .fork = cpuset_fork, + .legacy_cftypes = legacy_files, + .dfl_cftypes = dfl_files, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-120-drm-amd-pm-correct-SMU13.0.7-pstate-profiling-.patch b/patches.kernel.org/6.2.12-120-drm-amd-pm-correct-SMU13.0.7-pstate-profiling-.patch new file mode 100644 index 0000000..deac7ad --- /dev/null +++ b/patches.kernel.org/6.2.12-120-drm-amd-pm-correct-SMU13.0.7-pstate-profiling-.patch @@ -0,0 +1,67 @@ +From: Horatio Zhang +Date: Thu, 6 Apr 2023 11:17:38 +0800 +Subject: [PATCH] drm/amd/pm: correct SMU13.0.7 pstate profiling clock settings +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: f06b8887e3ef4f50098d3a949aef392c529c831a + +commit f06b8887e3ef4f50098d3a949aef392c529c831a upstream. + +Correct the pstate standard/peak profiling mode clock +settings for SMU13.0.7. + +Signed-off-by: Horatio Zhang +Reviewed-by: Kenneth Feng +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.1.x +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + .../drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 22 +++++++++++++------ + 1 file changed, 15 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c +index 8432357e..37739f5e 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c +@@ -1329,9 +1329,17 @@ static int smu_v13_0_7_populate_umd_state_clk(struct smu_context *smu) + &dpm_context->dpm_tables.fclk_table; + struct smu_umd_pstate_table *pstate_table = + &smu->pstate_table; ++ struct smu_table_context *table_context = &smu->smu_table; ++ PPTable_t *pptable = table_context->driver_pptable; ++ DriverReportedClocks_t driver_clocks = ++ pptable->SkuTable.DriverReportedClocks; + + pstate_table->gfxclk_pstate.min = gfx_table->min; +- pstate_table->gfxclk_pstate.peak = gfx_table->max; ++ if (driver_clocks.GameClockAc && ++ (driver_clocks.GameClockAc < gfx_table->max)) ++ pstate_table->gfxclk_pstate.peak = driver_clocks.GameClockAc; ++ else ++ pstate_table->gfxclk_pstate.peak = gfx_table->max; + + pstate_table->uclk_pstate.min = mem_table->min; + pstate_table->uclk_pstate.peak = mem_table->max; +@@ -1348,12 +1356,12 @@ static int smu_v13_0_7_populate_umd_state_clk(struct smu_context *smu) + pstate_table->fclk_pstate.min = fclk_table->min; + pstate_table->fclk_pstate.peak = fclk_table->max; + +- /* +- * For now, just use the mininum clock frequency. +- * TODO: update them when the real pstate settings available +- */ +- pstate_table->gfxclk_pstate.standard = gfx_table->min; +- pstate_table->uclk_pstate.standard = mem_table->min; ++ if (driver_clocks.BaseClockAc && ++ driver_clocks.BaseClockAc < gfx_table->max) ++ pstate_table->gfxclk_pstate.standard = driver_clocks.BaseClockAc; ++ else ++ pstate_table->gfxclk_pstate.standard = gfx_table->max; ++ pstate_table->uclk_pstate.standard = mem_table->max; + pstate_table->socclk_pstate.standard = soc_table->min; + pstate_table->vclk_pstate.standard = vclk_table->min; + pstate_table->dclk_pstate.standard = dclk_table->min; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-121-drm-amd-pm-correct-SMU13.0.7-max-shader-clock-.patch b/patches.kernel.org/6.2.12-121-drm-amd-pm-correct-SMU13.0.7-max-shader-clock-.patch new file mode 100644 index 0000000..38171f2 --- /dev/null +++ b/patches.kernel.org/6.2.12-121-drm-amd-pm-correct-SMU13.0.7-max-shader-clock-.patch @@ -0,0 +1,111 @@ +From: Horatio Zhang +Date: Thu, 6 Apr 2023 13:32:14 +0800 +Subject: [PATCH] drm/amd/pm: correct SMU13.0.7 max shader clock reporting +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 85e0689eb6b10cd3b2fb455d1b3f4d4d0b13ff78 + +commit 85e0689eb6b10cd3b2fb455d1b3f4d4d0b13ff78 upstream. + +Correct the max shader clock reporting on SMU +13.0.7. + +Signed-off-by: Horatio Zhang +Reviewed-by: Kenneth Feng +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.1.x +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + .../drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 61 ++++++++++++++++++- + 1 file changed, 60 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c +index 37739f5e..4399416d 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c +@@ -575,6 +575,14 @@ static int smu_v13_0_7_set_default_dpm_table(struct smu_context *smu) + dpm_table); + if (ret) + return ret; ++ ++ if (skutable->DriverReportedClocks.GameClockAc && ++ (dpm_table->dpm_levels[dpm_table->count - 1].value > ++ skutable->DriverReportedClocks.GameClockAc)) { ++ dpm_table->dpm_levels[dpm_table->count - 1].value = ++ skutable->DriverReportedClocks.GameClockAc; ++ dpm_table->max = skutable->DriverReportedClocks.GameClockAc; ++ } + } else { + dpm_table->count = 1; + dpm_table->dpm_levels[0].value = smu->smu_table.boot_values.gfxclk / 100; +@@ -828,6 +836,57 @@ static int smu_v13_0_7_get_smu_metrics_data(struct smu_context *smu, + return ret; + } + ++static int smu_v13_0_7_get_dpm_ultimate_freq(struct smu_context *smu, ++ enum smu_clk_type clk_type, ++ uint32_t *min, ++ uint32_t *max) ++{ ++ struct smu_13_0_dpm_context *dpm_context = ++ smu->smu_dpm.dpm_context; ++ struct smu_13_0_dpm_table *dpm_table; ++ ++ switch (clk_type) { ++ case SMU_MCLK: ++ case SMU_UCLK: ++ /* uclk dpm table */ ++ dpm_table = &dpm_context->dpm_tables.uclk_table; ++ break; ++ case SMU_GFXCLK: ++ case SMU_SCLK: ++ /* gfxclk dpm table */ ++ dpm_table = &dpm_context->dpm_tables.gfx_table; ++ break; ++ case SMU_SOCCLK: ++ /* socclk dpm table */ ++ dpm_table = &dpm_context->dpm_tables.soc_table; ++ break; ++ case SMU_FCLK: ++ /* fclk dpm table */ ++ dpm_table = &dpm_context->dpm_tables.fclk_table; ++ break; ++ case SMU_VCLK: ++ case SMU_VCLK1: ++ /* vclk dpm table */ ++ dpm_table = &dpm_context->dpm_tables.vclk_table; ++ break; ++ case SMU_DCLK: ++ case SMU_DCLK1: ++ /* dclk dpm table */ ++ dpm_table = &dpm_context->dpm_tables.dclk_table; ++ break; ++ default: ++ dev_err(smu->adev->dev, "Unsupported clock type!\n"); ++ return -EINVAL; ++ } ++ ++ if (min) ++ *min = dpm_table->min; ++ if (max) ++ *max = dpm_table->max; ++ ++ return 0; ++} ++ + static int smu_v13_0_7_read_sensor(struct smu_context *smu, + enum amd_pp_sensors sensor, + void *data, +@@ -1684,7 +1743,7 @@ static const struct pptable_funcs smu_v13_0_7_ppt_funcs = { + .dpm_set_jpeg_enable = smu_v13_0_set_jpeg_enable, + .init_pptable_microcode = smu_v13_0_init_pptable_microcode, + .populate_umd_state_clk = smu_v13_0_7_populate_umd_state_clk, +- .get_dpm_ultimate_freq = smu_v13_0_get_dpm_ultimate_freq, ++ .get_dpm_ultimate_freq = smu_v13_0_7_get_dpm_ultimate_freq, + .get_vbios_bootup_values = smu_v13_0_get_vbios_bootup_values, + .read_sensor = smu_v13_0_7_read_sensor, + .feature_is_enabled = smu_cmn_feature_is_enabled, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-122-mptcp-use-mptcp_schedule_work-instead-of-open-.patch b/patches.kernel.org/6.2.12-122-mptcp-use-mptcp_schedule_work-instead-of-open-.patch new file mode 100644 index 0000000..f45457e --- /dev/null +++ b/patches.kernel.org/6.2.12-122-mptcp-use-mptcp_schedule_work-instead-of-open-.patch @@ -0,0 +1,94 @@ +From: Paolo Abeni +Date: Tue, 11 Apr 2023 22:42:09 +0200 +Subject: [PATCH] mptcp: use mptcp_schedule_work instead of open-coding it +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: a5cb752b125766524c921faab1a45cc96065b0a7 + +commit a5cb752b125766524c921faab1a45cc96065b0a7 upstream. + +Beyond reducing code duplication this also avoids scheduling +the mptcp_worker on a closed socket on some edge scenarios. + +The addressed issue is actually older than the blamed commit +below, but this fix needs it as a pre-requisite. + +Fixes: ba8f48f7a4d7 ("mptcp: introduce mptcp_schedule_work") +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Abeni +Reviewed-by: Matthieu Baerts +Signed-off-by: Matthieu Baerts +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + net/mptcp/options.c | 5 ++--- + net/mptcp/subflow.c | 18 ++++++------------ + 2 files changed, 8 insertions(+), 15 deletions(-) + +diff --git a/net/mptcp/options.c b/net/mptcp/options.c +index 5ded85e2..3872eadb 100644 +--- a/net/mptcp/options.c ++++ b/net/mptcp/options.c +@@ -1192,9 +1192,8 @@ bool mptcp_incoming_options(struct sock *sk, struct sk_buff *skb) + */ + if (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq) { + if (mp_opt.data_fin && mp_opt.data_len == 1 && +- mptcp_update_rcv_data_fin(msk, mp_opt.data_seq, mp_opt.dsn64) && +- schedule_work(&msk->work)) +- sock_hold(subflow->conn); ++ mptcp_update_rcv_data_fin(msk, mp_opt.data_seq, mp_opt.dsn64)) ++ mptcp_schedule_work((struct sock *)msk); + + return true; + } +diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c +index 8f6e48e5..dbc02c2c 100644 +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -407,9 +407,8 @@ void mptcp_subflow_reset(struct sock *ssk) + + tcp_send_active_reset(ssk, GFP_ATOMIC); + tcp_done(ssk); +- if (!test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW, &mptcp_sk(sk)->flags) && +- schedule_work(&mptcp_sk(sk)->work)) +- return; /* worker will put sk for us */ ++ if (!test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW, &mptcp_sk(sk)->flags)) ++ mptcp_schedule_work(sk); + + sock_put(sk); + } +@@ -1117,8 +1116,8 @@ static enum mapping_status get_mapping_status(struct sock *ssk, + skb_ext_del(skb, SKB_EXT_MPTCP); + return MAPPING_OK; + } else { +- if (updated && schedule_work(&msk->work)) +- sock_hold((struct sock *)msk); ++ if (updated) ++ mptcp_schedule_work((struct sock *)msk); + + return MAPPING_DATA_FIN; + } +@@ -1221,17 +1220,12 @@ static void mptcp_subflow_discard_data(struct sock *ssk, struct sk_buff *skb, + /* sched mptcp worker to remove the subflow if no more data is pending */ + static void subflow_sched_work_if_closed(struct mptcp_sock *msk, struct sock *ssk) + { +- struct sock *sk = (struct sock *)msk; +- + if (likely(ssk->sk_state != TCP_CLOSE)) + return; + + if (skb_queue_empty(&ssk->sk_receive_queue) && +- !test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW, &msk->flags)) { +- sock_hold(sk); +- if (!schedule_work(&msk->work)) +- sock_put(sk); +- } ++ !test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW, &msk->flags)) ++ mptcp_schedule_work((struct sock *)msk); + } + + static bool subflow_can_fallback(struct mptcp_subflow_context *subflow) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-123-mptcp-stricter-state-check-in-mptcp_worker.patch b/patches.kernel.org/6.2.12-123-mptcp-stricter-state-check-in-mptcp_worker.patch new file mode 100644 index 0000000..0e4bd9b --- /dev/null +++ b/patches.kernel.org/6.2.12-123-mptcp-stricter-state-check-in-mptcp_worker.patch @@ -0,0 +1,86 @@ +From: Paolo Abeni +Date: Tue, 11 Apr 2023 22:42:10 +0200 +Subject: [PATCH] mptcp: stricter state check in mptcp_worker +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: d6a0443733434408f2cbd4c53fea6910599bab9e + +commit d6a0443733434408f2cbd4c53fea6910599bab9e upstream. + +As reported by Christoph, the mptcp protocol can run the +worker when the relevant msk socket is in an unexpected state: + +connect() +// incoming reset + fastclose +// the mptcp worker is scheduled +mptcp_disconnect() +// msk is now CLOSED +listen() +mptcp_worker() + +Leading to the following splat: + +divide error: 0000 [#1] PREEMPT SMP +CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 6.3.0-rc1-gde5e8fd0123c #11 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 +Workqueue: events mptcp_worker +RIP: 0010:__tcp_select_window+0x22c/0x4b0 net/ipv4/tcp_output.c:3018 +RSP: 0018:ffffc900000b3c98 EFLAGS: 00010293 +RAX: 000000000000ffd7 RBX: 000000000000ffd7 RCX: 0000000000000000 +RDX: 0000000000000000 RSI: ffffffff8214ce97 RDI: 0000000000000004 +RBP: 000000000000ffd7 R08: 0000000000000004 R09: 0000000000010000 +R10: 000000000000ffd7 R11: ffff888005afa148 R12: 000000000000ffd7 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 +FS: 0000000000000000(0000) GS:ffff88803ed00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000405270 CR3: 000000003011e006 CR4: 0000000000370ee0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + tcp_select_window net/ipv4/tcp_output.c:262 [inline] + __tcp_transmit_skb+0x356/0x1280 net/ipv4/tcp_output.c:1345 + tcp_transmit_skb net/ipv4/tcp_output.c:1417 [inline] + tcp_send_active_reset+0x13e/0x320 net/ipv4/tcp_output.c:3459 + mptcp_check_fastclose net/mptcp/protocol.c:2530 [inline] + mptcp_worker+0x6c7/0x800 net/mptcp/protocol.c:2705 + process_one_work+0x3bd/0x950 kernel/workqueue.c:2390 + worker_thread+0x5b/0x610 kernel/workqueue.c:2537 + kthread+0x138/0x170 kernel/kthread.c:376 + ret_from_fork+0x2c/0x50 arch/x86/entry/entry_64.S:308 + + +This change addresses the issue explicitly checking for bad states +before running the mptcp worker. + +Fixes: e16163b6e2b7 ("mptcp: refactor shutdown and close") +Cc: stable@vger.kernel.org +Reported-by: Christoph Paasch +Link: https://github.com/multipath-tcp/mptcp_net-next/issues/374 +Signed-off-by: Paolo Abeni +Reviewed-by: Matthieu Baerts +Tested-by: Christoph Paasch +Signed-off-by: Matthieu Baerts +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + net/mptcp/protocol.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c +index 6c2577b9..0fbcb8f4 100644 +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -2627,7 +2627,7 @@ static void mptcp_worker(struct work_struct *work) + + lock_sock(sk); + state = sk->sk_state; +- if (unlikely(state == TCP_CLOSE)) ++ if (unlikely((1 << state) & (TCPF_CLOSE | TCPF_LISTEN))) + goto unlock; + + mptcp_check_data_fin_ack(sk); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-124-mptcp-fix-NULL-pointer-dereference-on-fastopen.patch b/patches.kernel.org/6.2.12-124-mptcp-fix-NULL-pointer-dereference-on-fastopen.patch new file mode 100644 index 0000000..0481979 --- /dev/null +++ b/patches.kernel.org/6.2.12-124-mptcp-fix-NULL-pointer-dereference-on-fastopen.patch @@ -0,0 +1,57 @@ +From: Paolo Abeni +Date: Tue, 11 Apr 2023 22:42:11 +0200 +Subject: [PATCH] mptcp: fix NULL pointer dereference on fastopen early + fallback +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: c0ff6f6da66a7791a32c0234388b1bdc00244917 + +commit c0ff6f6da66a7791a32c0234388b1bdc00244917 upstream. + +In case of early fallback to TCP, subflow_syn_recv_sock() deletes +the subflow context before returning the newly allocated sock to +the caller. + +The fastopen path does not cope with the above unconditionally +dereferencing the subflow context. + +Fixes: 36b122baf6a8 ("mptcp: add subflow_v(4,6)_send_synack()") +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Abeni +Reviewed-by: Matthieu Baerts +Signed-off-by: Matthieu Baerts +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + net/mptcp/fastopen.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/net/mptcp/fastopen.c b/net/mptcp/fastopen.c +index d237d142..bceaab8d 100644 +--- a/net/mptcp/fastopen.c ++++ b/net/mptcp/fastopen.c +@@ -9,11 +9,18 @@ + void mptcp_fastopen_subflow_synack_set_params(struct mptcp_subflow_context *subflow, + struct request_sock *req) + { +- struct sock *ssk = subflow->tcp_sock; +- struct sock *sk = subflow->conn; ++ struct sock *sk, *ssk; + struct sk_buff *skb; + struct tcp_sock *tp; + ++ /* on early fallback the subflow context is deleted by ++ * subflow_syn_recv_sock() ++ */ ++ if (!subflow) ++ return; ++ ++ ssk = subflow->tcp_sock; ++ sk = subflow->conn; + tp = tcp_sk(ssk); + + subflow->is_mptfo = 1; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-125-selftests-mptcp-userspace-pm-uniform-verify-ev.patch b/patches.kernel.org/6.2.12-125-selftests-mptcp-userspace-pm-uniform-verify-ev.patch new file mode 100644 index 0000000..c271af3 --- /dev/null +++ b/patches.kernel.org/6.2.12-125-selftests-mptcp-userspace-pm-uniform-verify-ev.patch @@ -0,0 +1,58 @@ +From: Matthieu Baerts +Date: Tue, 11 Apr 2023 22:42:12 +0200 +Subject: [PATCH] selftests: mptcp: userspace pm: uniform verify events +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 711ae788cbbb82818531b55e32b09518ee09a11a + +commit 711ae788cbbb82818531b55e32b09518ee09a11a upstream. + +Simply adding a "sleep" before checking something is usually not a good +idea because the time that has been picked can not be enough or too +much. The best is to wait for events with a timeout. + +In this selftest, 'sleep 0.5' is used more than 40 times. It is always +used before calling a 'verify_*' function except for this +verify_listener_events which has been added later. + +At the end, using all these 'sleep 0.5' seems to work: the slow CIs +don't complain so far. Also because it doesn't take too much time, we +can just add two more 'sleep 0.5' to uniform what is done before calling +a 'verify_*' function. For the same reasons, we can also delay a bigger +refactoring to replace all these 'sleep 0.5' by functions waiting for +events instead of waiting for a fix time and hope for the best. + +Fixes: 6c73008aa301 ("selftests: mptcp: listener test for userspace PM") +Cc: stable@vger.kernel.org +Suggested-by: Paolo Abeni +Signed-off-by: Matthieu Baerts +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/net/mptcp/userspace_pm.sh | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/testing/selftests/net/mptcp/userspace_pm.sh b/tools/testing/selftests/net/mptcp/userspace_pm.sh +index ab2d581f..c61f3aea 100755 +--- a/tools/testing/selftests/net/mptcp/userspace_pm.sh ++++ b/tools/testing/selftests/net/mptcp/userspace_pm.sh +@@ -884,6 +884,7 @@ test_listener() + $client4_port > /dev/null 2>&1 & + local listener_pid=$! + ++ sleep 0.5 + verify_listener_events $client_evts $LISTENER_CREATED $AF_INET 10.0.2.2 $client4_port + + # ADD_ADDR from client to server machine reusing the subflow port +@@ -899,6 +900,7 @@ test_listener() + # Delete the listener from the client ns, if one was created + kill_wait $listener_pid + ++ sleep 0.5 + verify_listener_events $client_evts $LISTENER_CLOSED $AF_INET 10.0.2.2 $client4_port + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-126-ubi-Fix-failure-attaching-when-vid_hdr-offset-.patch b/patches.kernel.org/6.2.12-126-ubi-Fix-failure-attaching-when-vid_hdr-offset-.patch new file mode 100644 index 0000000..4c7ab0f --- /dev/null +++ b/patches.kernel.org/6.2.12-126-ubi-Fix-failure-attaching-when-vid_hdr-offset-.patch @@ -0,0 +1,80 @@ +From: Zhihao Cheng +Date: Mon, 6 Mar 2023 09:33:08 +0800 +Subject: [PATCH] ubi: Fix failure attaching when vid_hdr offset equals to + (sub)page size +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 1e020e1b96afdecd20680b5b5be2a6ffc3d27628 + +commit 1e020e1b96afdecd20680b5b5be2a6ffc3d27628 upstream. + +Following process will make ubi attaching failed since commit +1b42b1a36fc946 ("ubi: ensure that VID header offset ... size"): + +ID="0xec,0xa1,0x00,0x15" # 128M 128KB 2KB +modprobe nandsim id_bytes=$ID +flash_eraseall /dev/mtd0 +modprobe ubi mtd="0,2048" # set vid_hdr offset as 2048 (one page) +(dmesg): + ubi0 error: ubi_attach_mtd_dev [ubi]: VID header offset 2048 too large. + UBI error: cannot attach mtd0 + UBI error: cannot initialize UBI, error -22 + +Rework original solution, the key point is making sure +'vid_hdr_shift + UBI_VID_HDR_SIZE < ubi->vid_hdr_alsize', +so we should check vid_hdr_shift rather not vid_hdr_offset. +Then, ubi still support (sub)page aligined VID header offset. + +Fixes: 1b42b1a36fc946 ("ubi: ensure that VID header offset ... size") +Signed-off-by: Zhihao Cheng +Tested-by: Nicolas Schichan +Tested-by: Miquel Raynal # v5.10, v4.19 +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/mtd/ubi/build.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c +index 7f65af16..1662c12e 100644 +--- a/drivers/mtd/ubi/build.c ++++ b/drivers/mtd/ubi/build.c +@@ -664,12 +664,6 @@ static int io_init(struct ubi_device *ubi, int max_beb_per1024) + ubi->ec_hdr_alsize = ALIGN(UBI_EC_HDR_SIZE, ubi->hdrs_min_io_size); + ubi->vid_hdr_alsize = ALIGN(UBI_VID_HDR_SIZE, ubi->hdrs_min_io_size); + +- if (ubi->vid_hdr_offset && ((ubi->vid_hdr_offset + UBI_VID_HDR_SIZE) > +- ubi->vid_hdr_alsize)) { +- ubi_err(ubi, "VID header offset %d too large.", ubi->vid_hdr_offset); +- return -EINVAL; +- } +- + dbg_gen("min_io_size %d", ubi->min_io_size); + dbg_gen("max_write_size %d", ubi->max_write_size); + dbg_gen("hdrs_min_io_size %d", ubi->hdrs_min_io_size); +@@ -687,6 +681,21 @@ static int io_init(struct ubi_device *ubi, int max_beb_per1024) + ubi->vid_hdr_aloffset; + } + ++ /* ++ * Memory allocation for VID header is ubi->vid_hdr_alsize ++ * which is described in comments in io.c. ++ * Make sure VID header shift + UBI_VID_HDR_SIZE not exceeds ++ * ubi->vid_hdr_alsize, so that all vid header operations ++ * won't access memory out of bounds. ++ */ ++ if ((ubi->vid_hdr_shift + UBI_VID_HDR_SIZE) > ubi->vid_hdr_alsize) { ++ ubi_err(ubi, "Invalid VID header offset %d, VID header shift(%d)" ++ " + VID header size(%zu) > VID header aligned size(%d).", ++ ubi->vid_hdr_offset, ubi->vid_hdr_shift, ++ UBI_VID_HDR_SIZE, ubi->vid_hdr_alsize); ++ return -EINVAL; ++ } ++ + /* Similar for the data offset */ + ubi->leb_start = ubi->vid_hdr_offset + UBI_VID_HDR_SIZE; + ubi->leb_start = ALIGN(ubi->leb_start, ubi->min_io_size); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-127-ubi-Fix-deadlock-caused-by-recursively-holding.patch b/patches.kernel.org/6.2.12-127-ubi-Fix-deadlock-caused-by-recursively-holding.patch new file mode 100644 index 0000000..fcfcac9 --- /dev/null +++ b/patches.kernel.org/6.2.12-127-ubi-Fix-deadlock-caused-by-recursively-holding.patch @@ -0,0 +1,67 @@ +From: ZhaoLong Wang +Date: Sat, 4 Mar 2023 09:41:41 +0800 +Subject: [PATCH] ubi: Fix deadlock caused by recursively holding work_sem +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: f773f0a331d6c41733b17bebbc1b6cae12e016f5 + +[ Upstream commit f773f0a331d6c41733b17bebbc1b6cae12e016f5 ] + +During the processing of the bgt, if the sync_erase() return -EBUSY +or some other error code in __erase_worker(),schedule_erase() called +again lead to the down_read(ubi->work_sem) hold twice and may get +block by down_write(ubi->work_sem) in ubi_update_fastmap(), +which cause deadlock. + + ubi bgt other task + do_work + down_read(&ubi->work_sem) ubi_update_fastmap + erase_worker # Blocked by down_read + __erase_worker down_write(&ubi->work_sem) + schedule_erase + schedule_ubi_work + down_read(&ubi->work_sem) + +Fix this by changing input parameter @nested of the schedule_erase() to +'true' to avoid recursively acquiring the down_read(&ubi->work_sem). + +Also, fix the incorrect comment about @nested parameter of the +schedule_erase() because when down_write(ubi->work_sem) is held, the +@nested is also need be true. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217093 +Fixes: 2e8f08deabbc ("ubi: Fix races around ubi_refill_pools()") +Signed-off-by: ZhaoLong Wang +Reviewed-by: Zhihao Cheng +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/mtd/ubi/wl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c +index 9e143192..6049ab9e 100644 +--- a/drivers/mtd/ubi/wl.c ++++ b/drivers/mtd/ubi/wl.c +@@ -575,7 +575,7 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk, + * @vol_id: the volume ID that last used this PEB + * @lnum: the last used logical eraseblock number for the PEB + * @torture: if the physical eraseblock has to be tortured +- * @nested: denotes whether the work_sem is already held in read mode ++ * @nested: denotes whether the work_sem is already held + * + * This function returns zero in case of success and a %-ENOMEM in case of + * failure. +@@ -1131,7 +1131,7 @@ static int __erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk) + int err1; + + /* Re-schedule the LEB for erasure */ +- err1 = schedule_erase(ubi, e, vol_id, lnum, 0, false); ++ err1 = schedule_erase(ubi, e, vol_id, lnum, 0, true); + if (err1) { + spin_lock(&ubi->wl_lock); + wl_entry_destroy(ubi, e); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-128-i2c-mchp-pci1xxxx-Update-Timing-registers.patch b/patches.kernel.org/6.2.12-128-i2c-mchp-pci1xxxx-Update-Timing-registers.patch new file mode 100644 index 0000000..e1f9289 --- /dev/null +++ b/patches.kernel.org/6.2.12-128-i2c-mchp-pci1xxxx-Update-Timing-registers.patch @@ -0,0 +1,174 @@ +From: Tharun Kumar P +Date: Mon, 20 Mar 2023 19:52:37 +0530 +Subject: [PATCH] i2c: mchp-pci1xxxx: Update Timing registers +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: aa874cdfec07d4dd9c6f0c356d65c609ba31a26f + +[ Upstream commit aa874cdfec07d4dd9c6f0c356d65c609ba31a26f ] + +Update I2C timing registers based on latest hardware design. +This fix does not break functionality of chips with older design and +existing users will not be affected. + +Fixes: 361693697249 ("i2c: microchip: pci1xxxx: Add driver for I2C host controller in multifunction endpoint of pci1xxxx switch") +Signed-off-by: Tharun Kumar P +Reviewed-by: Andy Shevchenko +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/i2c/busses/i2c-mchp-pci1xxxx.c | 60 +++++++++++++------------- + 1 file changed, 30 insertions(+), 30 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-mchp-pci1xxxx.c b/drivers/i2c/busses/i2c-mchp-pci1xxxx.c +index 09af7592..b21ffd6d 100644 +--- a/drivers/i2c/busses/i2c-mchp-pci1xxxx.c ++++ b/drivers/i2c/busses/i2c-mchp-pci1xxxx.c +@@ -48,9 +48,9 @@ + * SR_HOLD_TIME_XK_TICKS field will indicate the number of ticks of the + * baud clock required to program 'Hold Time' at X KHz. + */ +-#define SR_HOLD_TIME_100K_TICKS 133 +-#define SR_HOLD_TIME_400K_TICKS 20 +-#define SR_HOLD_TIME_1000K_TICKS 11 ++#define SR_HOLD_TIME_100K_TICKS 150 ++#define SR_HOLD_TIME_400K_TICKS 20 ++#define SR_HOLD_TIME_1000K_TICKS 12 + + #define SMB_CORE_COMPLETION_REG_OFF3 (SMBUS_MAST_CORE_ADDR_BASE + 0x23) + +@@ -65,17 +65,17 @@ + * the baud clock required to program 'fair idle delay' at X KHz. Fair idle + * delay establishes the MCTP T(IDLE_DELAY) period. + */ +-#define FAIR_BUS_IDLE_MIN_100K_TICKS 969 +-#define FAIR_BUS_IDLE_MIN_400K_TICKS 157 +-#define FAIR_BUS_IDLE_MIN_1000K_TICKS 157 ++#define FAIR_BUS_IDLE_MIN_100K_TICKS 992 ++#define FAIR_BUS_IDLE_MIN_400K_TICKS 500 ++#define FAIR_BUS_IDLE_MIN_1000K_TICKS 500 + + /* + * FAIR_IDLE_DELAY_XK_TICKS field will indicate the number of ticks of the + * baud clock required to satisfy the fairness protocol at X KHz. + */ +-#define FAIR_IDLE_DELAY_100K_TICKS 1000 +-#define FAIR_IDLE_DELAY_400K_TICKS 500 +-#define FAIR_IDLE_DELAY_1000K_TICKS 500 ++#define FAIR_IDLE_DELAY_100K_TICKS 963 ++#define FAIR_IDLE_DELAY_400K_TICKS 156 ++#define FAIR_IDLE_DELAY_1000K_TICKS 156 + + #define SMB_IDLE_SCALING_100K \ + ((FAIR_IDLE_DELAY_100K_TICKS << 16) | FAIR_BUS_IDLE_MIN_100K_TICKS) +@@ -105,7 +105,7 @@ + */ + #define BUS_CLK_100K_LOW_PERIOD_TICKS 156 + #define BUS_CLK_400K_LOW_PERIOD_TICKS 41 +-#define BUS_CLK_1000K_LOW_PERIOD_TICKS 15 ++#define BUS_CLK_1000K_LOW_PERIOD_TICKS 15 + + /* + * BUS_CLK_XK_HIGH_PERIOD_TICKS field defines the number of I2C Baud Clock +@@ -131,7 +131,7 @@ + */ + #define CLK_SYNC_100K 4 + #define CLK_SYNC_400K 4 +-#define CLK_SYNC_1000K 4 ++#define CLK_SYNC_1000K 4 + + #define SMB_CORE_DATA_TIMING_REG_OFF (SMBUS_MAST_CORE_ADDR_BASE + 0x40) + +@@ -142,25 +142,25 @@ + * determines the SCLK hold time following SDAT driven low during the first + * START bit in a transfer. + */ +-#define FIRST_START_HOLD_100K_TICKS 22 +-#define FIRST_START_HOLD_400K_TICKS 16 +-#define FIRST_START_HOLD_1000K_TICKS 6 ++#define FIRST_START_HOLD_100K_TICKS 23 ++#define FIRST_START_HOLD_400K_TICKS 8 ++#define FIRST_START_HOLD_1000K_TICKS 12 + + /* + * STOP_SETUP_XK_TICKS will indicate the number of ticks of the baud clock + * required to program 'STOP_SETUP' timer at X KHz. This timer determines the + * SDAT setup time from the rising edge of SCLK for a STOP condition. + */ +-#define STOP_SETUP_100K_TICKS 157 ++#define STOP_SETUP_100K_TICKS 150 + #define STOP_SETUP_400K_TICKS 20 +-#define STOP_SETUP_1000K_TICKS 12 ++#define STOP_SETUP_1000K_TICKS 12 + + /* + * RESTART_SETUP_XK_TICKS will indicate the number of ticks of the baud clock + * required to program 'RESTART_SETUP' timer at X KHz. This timer determines the + * SDAT setup time from the rising edge of SCLK for a repeated START condition. + */ +-#define RESTART_SETUP_100K_TICKS 157 ++#define RESTART_SETUP_100K_TICKS 156 + #define RESTART_SETUP_400K_TICKS 20 + #define RESTART_SETUP_1000K_TICKS 12 + +@@ -169,7 +169,7 @@ + * required to program 'DATA_HOLD' timer at X KHz. This timer determines the + * SDAT hold time following SCLK driven low. + */ +-#define DATA_HOLD_100K_TICKS 2 ++#define DATA_HOLD_100K_TICKS 12 + #define DATA_HOLD_400K_TICKS 2 + #define DATA_HOLD_1000K_TICKS 2 + +@@ -190,35 +190,35 @@ + * Bus Idle Minimum time = BUS_IDLE_MIN[7:0] x Baud_Clock_Period x + * (BUS_IDLE_MIN_XK_TICKS[7] ? 4,1) + */ +-#define BUS_IDLE_MIN_100K_TICKS 167UL +-#define BUS_IDLE_MIN_400K_TICKS 139UL +-#define BUS_IDLE_MIN_1000K_TICKS 133UL ++#define BUS_IDLE_MIN_100K_TICKS 36UL ++#define BUS_IDLE_MIN_400K_TICKS 10UL ++#define BUS_IDLE_MIN_1000K_TICKS 4UL + + /* + * CTRL_CUM_TIME_OUT_XK_TICKS defines SMBus Controller Cumulative Time-Out. + * SMBus Controller Cumulative Time-Out duration = + * CTRL_CUM_TIME_OUT_XK_TICKS[7:0] x Baud_Clock_Period x 2048 + */ +-#define CTRL_CUM_TIME_OUT_100K_TICKS 159 +-#define CTRL_CUM_TIME_OUT_400K_TICKS 159 +-#define CTRL_CUM_TIME_OUT_1000K_TICKS 159 ++#define CTRL_CUM_TIME_OUT_100K_TICKS 76 ++#define CTRL_CUM_TIME_OUT_400K_TICKS 76 ++#define CTRL_CUM_TIME_OUT_1000K_TICKS 76 + + /* + * TARGET_CUM_TIME_OUT_XK_TICKS defines SMBus Target Cumulative Time-Out duration. + * SMBus Target Cumulative Time-Out duration = TARGET_CUM_TIME_OUT_XK_TICKS[7:0] x + * Baud_Clock_Period x 4096 + */ +-#define TARGET_CUM_TIME_OUT_100K_TICKS 199 +-#define TARGET_CUM_TIME_OUT_400K_TICKS 199 +-#define TARGET_CUM_TIME_OUT_1000K_TICKS 199 ++#define TARGET_CUM_TIME_OUT_100K_TICKS 95 ++#define TARGET_CUM_TIME_OUT_400K_TICKS 95 ++#define TARGET_CUM_TIME_OUT_1000K_TICKS 95 + + /* + * CLOCK_HIGH_TIME_OUT_XK defines Clock High time out period. + * Clock High time out period = CLOCK_HIGH_TIME_OUT_XK[7:0] x Baud_Clock_Period x 8 + */ +-#define CLOCK_HIGH_TIME_OUT_100K_TICKS 204 +-#define CLOCK_HIGH_TIME_OUT_400K_TICKS 204 +-#define CLOCK_HIGH_TIME_OUT_1000K_TICKS 204 ++#define CLOCK_HIGH_TIME_OUT_100K_TICKS 97 ++#define CLOCK_HIGH_TIME_OUT_400K_TICKS 97 ++#define CLOCK_HIGH_TIME_OUT_1000K_TICKS 97 + + #define TO_SCALING_100K \ + ((BUS_IDLE_MIN_100K_TICKS << 24) | (CTRL_CUM_TIME_OUT_100K_TICKS << 16) | \ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-129-powerpc-papr_scm-Update-the-NUMA-distance-tabl.patch b/patches.kernel.org/6.2.12-129-powerpc-papr_scm-Update-the-NUMA-distance-tabl.patch new file mode 100644 index 0000000..9632378 --- /dev/null +++ b/patches.kernel.org/6.2.12-129-powerpc-papr_scm-Update-the-NUMA-distance-tabl.patch @@ -0,0 +1,86 @@ +From: "Aneesh Kumar K.V" +Date: Tue, 4 Apr 2023 09:44:33 +0530 +Subject: [PATCH] powerpc/papr_scm: Update the NUMA distance table for the + target node +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: b277fc793daf258877b4c0744b52f69d6e6ba22e + +[ Upstream commit b277fc793daf258877b4c0744b52f69d6e6ba22e ] + +Platform device helper routines won't update the NUMA distance table +while creating a platform device, even if the device is present on a +NUMA node that doesn't have memory or CPU. This is especially true for +pmem devices. If the target node of the pmem device is not online, we +find the nearest online node to the device and associate the pmem device +with that online node. To find the nearest online node, we should have +the numa distance table updated correctly. Update the distance +information during the device probe. + +For a papr scm device on NUMA node 3 distance_lookup_table value for +distance_ref_points_depth = 2 before and after fix is below: + +Before fix: + node 3 distance depth 0 - 0 + node 3 distance depth 1 - 0 + node 4 distance depth 0 - 4 + node 4 distance depth 1 - 2 + node 5 distance depth 0 - 5 + node 5 distance depth 1 - 1 + +After fix + node 3 distance depth 0 - 3 + node 3 distance depth 1 - 1 + node 4 distance depth 0 - 4 + node 4 distance depth 1 - 2 + node 5 distance depth 0 - 5 + node 5 distance depth 1 - 1 + +Without the fix, the nearest numa node to the pmem device (NUMA node 3) +will be picked as 4. After the fix, we get the correct numa node which +is 5. + +Fixes: da1115fdbd6e ("powerpc/nvdimm: Pick nearby online node if the device node is not online") +Signed-off-by: Aneesh Kumar K.V +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230404041433.1781804-1-aneesh.kumar@linux.ibm.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/powerpc/mm/numa.c | 1 + + arch/powerpc/platforms/pseries/papr_scm.c | 7 +++++++ + 2 files changed, 8 insertions(+) + +diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c +index b44ce719..16cfe56b 100644 +--- a/arch/powerpc/mm/numa.c ++++ b/arch/powerpc/mm/numa.c +@@ -366,6 +366,7 @@ void update_numa_distance(struct device_node *node) + WARN(numa_distance_table[nid][nid] == -1, + "NUMA distance details for node %d not provided\n", nid); + } ++EXPORT_SYMBOL_GPL(update_numa_distance); + + /* + * ibm,numa-lookup-index-table= {N, domainid1, domainid2, ..... domainidN} +diff --git a/arch/powerpc/platforms/pseries/papr_scm.c b/arch/powerpc/platforms/pseries/papr_scm.c +index 2f838552..1a53e048 100644 +--- a/arch/powerpc/platforms/pseries/papr_scm.c ++++ b/arch/powerpc/platforms/pseries/papr_scm.c +@@ -1428,6 +1428,13 @@ static int papr_scm_probe(struct platform_device *pdev) + return -ENODEV; + } + ++ /* ++ * open firmware platform device create won't update the NUMA ++ * distance table. For PAPR SCM devices we use numa_map_to_online_node() ++ * to find the nearest online NUMA node and that requires correct ++ * distance table information. ++ */ ++ update_numa_distance(dn); + + p = kzalloc(sizeof(*p), GFP_KERNEL); + if (!p) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-130-sched-fair-Fix-imbalance-overflow.patch b/patches.kernel.org/6.2.12-130-sched-fair-Fix-imbalance-overflow.patch new file mode 100644 index 0000000..c87a4c7 --- /dev/null +++ b/patches.kernel.org/6.2.12-130-sched-fair-Fix-imbalance-overflow.patch @@ -0,0 +1,49 @@ +From: Vincent Guittot +Date: Tue, 11 Apr 2023 11:06:11 +0200 +Subject: [PATCH] sched/fair: Fix imbalance overflow +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 91dcf1e8068e9a8823e419a7a34ff4341275fb70 + +[ Upstream commit 91dcf1e8068e9a8823e419a7a34ff4341275fb70 ] + +When local group is fully busy but its average load is above system load, +computing the imbalance will overflow and local group is not the best +target for pulling this load. + +Fixes: 0b0695f2b34a ("sched/fair: Rework load_balance()") +Reported-by: Tingjia Cao +Signed-off-by: Vincent Guittot +Signed-off-by: Peter Zijlstra (Intel) +Tested-by: Tingjia Cao +Link: https://lore.kernel.org/lkml/CABcWv9_DAhVBOq2=W=2ypKE9dKM5s2DvoV8-U0+GDwwuKZ89jQ@mail.gmail.com/T/ +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/sched/fair.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index e046a2bf..661226e3 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -10123,6 +10123,16 @@ static inline void calculate_imbalance(struct lb_env *env, struct sd_lb_stats *s + + sds->avg_load = (sds->total_load * SCHED_CAPACITY_SCALE) / + sds->total_capacity; ++ ++ /* ++ * If the local group is more loaded than the average system ++ * load, don't try to pull any tasks. ++ */ ++ if (local->avg_load >= sds->avg_load) { ++ env->imbalance = 0; ++ return; ++ } ++ + } + + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-131-x86-rtc-Remove-__init-for-runtime-functions.patch b/patches.kernel.org/6.2.12-131-x86-rtc-Remove-__init-for-runtime-functions.patch new file mode 100644 index 0000000..e860263 --- /dev/null +++ b/patches.kernel.org/6.2.12-131-x86-rtc-Remove-__init-for-runtime-functions.patch @@ -0,0 +1,54 @@ +From: Matija Glavinic Pecotic +Date: Thu, 6 Apr 2023 08:26:52 +0200 +Subject: [PATCH] x86/rtc: Remove __init for runtime functions +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 775d3c514c5b2763a50ab7839026d7561795924d + +[ Upstream commit 775d3c514c5b2763a50ab7839026d7561795924d ] + +set_rtc_noop(), get_rtc_noop() are after booting, therefore their __init +annotation is wrong. + +A crash was observed on an x86 platform where CMOS RTC is unused and +disabled via device tree. set_rtc_noop() was invoked from ntp: +sync_hw_clock(), although CONFIG_RTC_SYSTOHC=n, however sync_cmos_clock() +doesn't honour that. + + Workqueue: events_power_efficient sync_hw_clock + RIP: 0010:set_rtc_noop + Call Trace: + update_persistent_clock64 + sync_hw_clock + +Fix this by dropping the __init annotation from set/get_rtc_noop(). + +Fixes: c311ed6183f4 ("x86/init: Allow DT configured systems to disable RTC at boot time") +Signed-off-by: Matija Glavinic Pecotic +Signed-off-by: Thomas Gleixner +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/59f7ceb1-446b-1d3d-0bc8-1f0ee94b1e18@nokia.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/x86/kernel/x86_init.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kernel/x86_init.c b/arch/x86/kernel/x86_init.c +index ef80d361..10622cf2 100644 +--- a/arch/x86/kernel/x86_init.c ++++ b/arch/x86/kernel/x86_init.c +@@ -33,8 +33,8 @@ static int __init iommu_init_noop(void) { return 0; } + static void iommu_shutdown_noop(void) { } + bool __init bool_x86_init_noop(void) { return false; } + void x86_op_int_noop(int cpu) { } +-static __init int set_rtc_noop(const struct timespec64 *now) { return -EINVAL; } +-static __init void get_rtc_noop(struct timespec64 *now) { } ++static int set_rtc_noop(const struct timespec64 *now) { return -EINVAL; } ++static void get_rtc_noop(struct timespec64 *now) { } + + static __initconst const struct of_device_id of_cmos_match[] = { + { .compatible = "motorola,mc146818" }, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-132-i2c-ocores-generate-stop-condition-after-timeo.patch b/patches.kernel.org/6.2.12-132-i2c-ocores-generate-stop-condition-after-timeo.patch new file mode 100644 index 0000000..bd55f46 --- /dev/null +++ b/patches.kernel.org/6.2.12-132-i2c-ocores-generate-stop-condition-after-timeo.patch @@ -0,0 +1,108 @@ +From: Gregor Herburger +Date: Thu, 13 Apr 2023 11:37:37 +0200 +Subject: [PATCH] i2c: ocores: generate stop condition after timeout in polling + mode +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: f8160d3b35fc94491bb0cb974dbda310ef96c0e2 + +[ Upstream commit f8160d3b35fc94491bb0cb974dbda310ef96c0e2 ] + +In polling mode, no stop condition is generated after a timeout. This +causes SCL to remain low and thereby block the bus. If this happens +during a transfer it can cause slaves to misinterpret the subsequent +transfer and return wrong values. + +To solve this, pass the ETIMEDOUT error up from ocores_process_polling() +instead of setting STATE_ERROR directly. The caller is adjusted to call +ocores_process_timeout() on error both in polling and in IRQ mode, which +will set STATE_ERROR and generate a stop condition. + +Fixes: 69c8c0c0efa8 ("i2c: ocores: add polling interface") +Signed-off-by: Gregor Herburger +Signed-off-by: Matthias Schiffer +Acked-by: Peter Korsgaard +Reviewed-by: Andrew Lunn +Reviewed-by: Federico Vaga +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/i2c/busses/i2c-ocores.c | 35 ++++++++++++++++++--------------- + 1 file changed, 19 insertions(+), 16 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-ocores.c b/drivers/i2c/busses/i2c-ocores.c +index a0af027d..2e575856 100644 +--- a/drivers/i2c/busses/i2c-ocores.c ++++ b/drivers/i2c/busses/i2c-ocores.c +@@ -342,18 +342,18 @@ static int ocores_poll_wait(struct ocores_i2c *i2c) + * ocores_isr(), we just add our polling code around it. + * + * It can run in atomic context ++ * ++ * Return: 0 on success, -ETIMEDOUT on timeout + */ +-static void ocores_process_polling(struct ocores_i2c *i2c) ++static int ocores_process_polling(struct ocores_i2c *i2c) + { +- while (1) { +- irqreturn_t ret; +- int err; ++ irqreturn_t ret; ++ int err = 0; + ++ while (1) { + err = ocores_poll_wait(i2c); +- if (err) { +- i2c->state = STATE_ERROR; ++ if (err) + break; /* timeout */ +- } + + ret = ocores_isr(-1, i2c); + if (ret == IRQ_NONE) +@@ -364,13 +364,15 @@ static void ocores_process_polling(struct ocores_i2c *i2c) + break; + } + } ++ ++ return err; + } + + static int ocores_xfer_core(struct ocores_i2c *i2c, + struct i2c_msg *msgs, int num, + bool polling) + { +- int ret; ++ int ret = 0; + u8 ctrl; + + ctrl = oc_getreg(i2c, OCI2C_CONTROL); +@@ -388,15 +390,16 @@ static int ocores_xfer_core(struct ocores_i2c *i2c, + oc_setreg(i2c, OCI2C_CMD, OCI2C_CMD_START); + + if (polling) { +- ocores_process_polling(i2c); ++ ret = ocores_process_polling(i2c); + } else { +- ret = wait_event_timeout(i2c->wait, +- (i2c->state == STATE_ERROR) || +- (i2c->state == STATE_DONE), HZ); +- if (ret == 0) { +- ocores_process_timeout(i2c); +- return -ETIMEDOUT; +- } ++ if (wait_event_timeout(i2c->wait, ++ (i2c->state == STATE_ERROR) || ++ (i2c->state == STATE_DONE), HZ) == 0) ++ ret = -ETIMEDOUT; ++ } ++ if (ret) { ++ ocores_process_timeout(i2c); ++ return ret; + } + + return (i2c->state == STATE_DONE) ? num : -EIO; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-133-cifs-fix-negotiate-context-parsing.patch b/patches.kernel.org/6.2.12-133-cifs-fix-negotiate-context-parsing.patch new file mode 100644 index 0000000..adf6db1 --- /dev/null +++ b/patches.kernel.org/6.2.12-133-cifs-fix-negotiate-context-parsing.patch @@ -0,0 +1,125 @@ +From: David Disseldorp +Date: Fri, 7 Apr 2023 00:34:11 +0200 +Subject: [PATCH] cifs: fix negotiate context parsing +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 5105a7ffce19160e7062aee67fb6b3b8a1b56d78 + +[ Upstream commit 5105a7ffce19160e7062aee67fb6b3b8a1b56d78 ] + +smb311_decode_neg_context() doesn't properly check against SMB packet +boundaries prior to accessing individual negotiate context entries. This +is due to the length check omitting the eight byte smb2_neg_context +header, as well as incorrect decrementing of len_of_ctxts. + +Fixes: 5100d8a3fe03 ("SMB311: Improve checking of negotiate security contexts") +Reported-by: Volker Lendecke +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: David Disseldorp +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/cifs/smb2pdu.c | 41 +++++++++++++++++++++++++++++++---------- + 1 file changed, 31 insertions(+), 10 deletions(-) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index b37379b6..ab59faf8 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -588,11 +588,15 @@ assemble_neg_contexts(struct smb2_negotiate_req *req, + + } + ++/* If invalid preauth context warn but use what we requested, SHA-512 */ + static void decode_preauth_context(struct smb2_preauth_neg_context *ctxt) + { + unsigned int len = le16_to_cpu(ctxt->DataLength); + +- /* If invalid preauth context warn but use what we requested, SHA-512 */ ++ /* ++ * Caller checked that DataLength remains within SMB boundary. We still ++ * need to confirm that one HashAlgorithms member is accounted for. ++ */ + if (len < MIN_PREAUTH_CTXT_DATA_LEN) { + pr_warn_once("server sent bad preauth context\n"); + return; +@@ -611,7 +615,11 @@ static void decode_compress_ctx(struct TCP_Server_Info *server, + { + unsigned int len = le16_to_cpu(ctxt->DataLength); + +- /* sizeof compress context is a one element compression capbility struct */ ++ /* ++ * Caller checked that DataLength remains within SMB boundary. We still ++ * need to confirm that one CompressionAlgorithms member is accounted ++ * for. ++ */ + if (len < 10) { + pr_warn_once("server sent bad compression cntxt\n"); + return; +@@ -633,6 +641,11 @@ static int decode_encrypt_ctx(struct TCP_Server_Info *server, + unsigned int len = le16_to_cpu(ctxt->DataLength); + + cifs_dbg(FYI, "decode SMB3.11 encryption neg context of len %d\n", len); ++ /* ++ * Caller checked that DataLength remains within SMB boundary. We still ++ * need to confirm that one Cipher flexible array member is accounted ++ * for. ++ */ + if (len < MIN_ENCRYPT_CTXT_DATA_LEN) { + pr_warn_once("server sent bad crypto ctxt len\n"); + return -EINVAL; +@@ -679,6 +692,11 @@ static void decode_signing_ctx(struct TCP_Server_Info *server, + { + unsigned int len = le16_to_cpu(pctxt->DataLength); + ++ /* ++ * Caller checked that DataLength remains within SMB boundary. We still ++ * need to confirm that one SigningAlgorithms flexible array member is ++ * accounted for. ++ */ + if ((len < 4) || (len > 16)) { + pr_warn_once("server sent bad signing negcontext\n"); + return; +@@ -720,14 +738,19 @@ static int smb311_decode_neg_context(struct smb2_negotiate_rsp *rsp, + for (i = 0; i < ctxt_cnt; i++) { + int clen; + /* check that offset is not beyond end of SMB */ +- if (len_of_ctxts == 0) +- break; +- + if (len_of_ctxts < sizeof(struct smb2_neg_context)) + break; + + pctx = (struct smb2_neg_context *)(offset + (char *)rsp); +- clen = le16_to_cpu(pctx->DataLength); ++ clen = sizeof(struct smb2_neg_context) ++ + le16_to_cpu(pctx->DataLength); ++ /* ++ * 2.2.4 SMB2 NEGOTIATE Response ++ * Subsequent negotiate contexts MUST appear at the first 8-byte ++ * aligned offset following the previous negotiate context. ++ */ ++ if (i + 1 != ctxt_cnt) ++ clen = ALIGN(clen, 8); + if (clen > len_of_ctxts) + break; + +@@ -748,12 +771,10 @@ static int smb311_decode_neg_context(struct smb2_negotiate_rsp *rsp, + else + cifs_server_dbg(VFS, "unknown negcontext of type %d ignored\n", + le16_to_cpu(pctx->ContextType)); +- + if (rc) + break; +- /* offsets must be 8 byte aligned */ +- clen = ALIGN(clen, 8); +- offset += clen + sizeof(struct smb2_neg_context); ++ ++ offset += clen; + len_of_ctxts -= clen; + } + return rc; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-134-nvme-pci-mark-Lexar-NM760-as-IGNORE_DEV_SUBNQN.patch b/patches.kernel.org/6.2.12-134-nvme-pci-mark-Lexar-NM760-as-IGNORE_DEV_SUBNQN.patch new file mode 100644 index 0000000..41dca27 --- /dev/null +++ b/patches.kernel.org/6.2.12-134-nvme-pci-mark-Lexar-NM760-as-IGNORE_DEV_SUBNQN.patch @@ -0,0 +1,65 @@ +From: Juraj Pecigos +Date: Sun, 26 Mar 2023 11:29:49 +0200 +Subject: [PATCH] nvme-pci: mark Lexar NM760 as IGNORE_DEV_SUBNQN +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 1231363aec86704a6b0467a12e3ca7bdf890e01d + +[ Upstream commit 1231363aec86704a6b0467a12e3ca7bdf890e01d ] + +A system with more than one of these SSDs will only have one usable. +The kernel fails to detect more than one nvme device due to duplicate +cntlids. + +before: +[ 9.395229] nvme 0000:01:00.0: platform quirk: setting simple suspend +[ 9.395262] nvme nvme0: pci function 0000:01:00.0 +[ 9.395282] nvme 0000:03:00.0: platform quirk: setting simple suspend +[ 9.395305] nvme nvme1: pci function 0000:03:00.0 +[ 9.409873] nvme nvme0: Duplicate cntlid 1 with nvme1, subsys nqn.2022-07.com.siliconmotion:nvm-subsystem-sn- , rejecting +[ 9.409982] nvme nvme0: Removing after probe failure status: -22 +[ 9.427487] nvme nvme1: allocated 64 MiB host memory buffer. +[ 9.445088] nvme nvme1: 16/0/0 default/read/poll queues +[ 9.449898] nvme nvme1: Ignoring bogus Namespace Identifiers + +after: +[ 1.161890] nvme 0000:01:00.0: platform quirk: setting simple suspend +[ 1.162660] nvme nvme0: pci function 0000:01:00.0 +[ 1.162684] nvme 0000:03:00.0: platform quirk: setting simple suspend +[ 1.162707] nvme nvme1: pci function 0000:03:00.0 +[ 1.191354] nvme nvme0: allocated 64 MiB host memory buffer. +[ 1.193378] nvme nvme1: allocated 64 MiB host memory buffer. +[ 1.211044] nvme nvme1: 16/0/0 default/read/poll queues +[ 1.211080] nvme nvme0: 16/0/0 default/read/poll queues +[ 1.216145] nvme nvme0: Ignoring bogus Namespace Identifiers +[ 1.216261] nvme nvme1: Ignoring bogus Namespace Identifiers + +Adding the NVME_QUIRK_IGNORE_DEV_SUBNQN quirk to resolves the issue. + +Signed-off-by: Juraj Pecigos +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Stable-dep-of: 74391b3e6985 ("nvme-pci: add NVME_QUIRK_BOGUS_NID for T-FORCE Z330 SSD") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/nvme/host/pci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index ea3f0806..2e3fae6e 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -3494,7 +3494,8 @@ static const struct pci_device_id nvme_id_table[] = { + { PCI_DEVICE(0x1d97, 0x1d97), /* Lexar NM620 */ + .driver_data = NVME_QUIRK_BOGUS_NID, }, + { PCI_DEVICE(0x1d97, 0x2269), /* Lexar NM760 */ +- .driver_data = NVME_QUIRK_BOGUS_NID, }, ++ .driver_data = NVME_QUIRK_BOGUS_NID | ++ NVME_QUIRK_IGNORE_DEV_SUBNQN, }, + { PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0x0061), + .driver_data = NVME_QUIRK_DMA_ADDRESS_BITS_48, }, + { PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0x0065), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-135-nvme-pci-add-NVME_QUIRK_BOGUS_NID-for-T-FORCE-.patch b/patches.kernel.org/6.2.12-135-nvme-pci-add-NVME_QUIRK_BOGUS_NID-for-T-FORCE-.patch new file mode 100644 index 0000000..c78c3fb --- /dev/null +++ b/patches.kernel.org/6.2.12-135-nvme-pci-add-NVME_QUIRK_BOGUS_NID-for-T-FORCE-.patch @@ -0,0 +1,37 @@ +From: Duy Truong +Date: Thu, 13 Apr 2023 17:55:48 -0700 +Subject: [PATCH] nvme-pci: add NVME_QUIRK_BOGUS_NID for T-FORCE Z330 SSD +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: 74391b3e69855e7dd65a9cef36baf5fc1345affd + +[ Upstream commit 74391b3e69855e7dd65a9cef36baf5fc1345affd ] + +Added a quirk to fix the TeamGroup T-Force Cardea Zero Z330 SSDs reporting +duplicate NGUIDs. + +Signed-off-by: Duy Truong +Cc: stable@vger.kernel.org +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/nvme/host/pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 2e3fae6e..989f3147 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -3496,6 +3496,8 @@ static const struct pci_device_id nvme_id_table[] = { + { PCI_DEVICE(0x1d97, 0x2269), /* Lexar NM760 */ + .driver_data = NVME_QUIRK_BOGUS_NID | + NVME_QUIRK_IGNORE_DEV_SUBNQN, }, ++ { PCI_DEVICE(0x10ec, 0x5763), /* TEAMGROUP T-FORCE CARDEA ZERO Z330 SSD */ ++ .driver_data = NVME_QUIRK_BOGUS_NID, }, + { PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0x0061), + .driver_data = NVME_QUIRK_DMA_ADDRESS_BITS_48, }, + { PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0x0065), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.12-136-Linux-6.2.12.patch b/patches.kernel.org/6.2.12-136-Linux-6.2.12.patch new file mode 100644 index 0000000..e528519 --- /dev/null +++ b/patches.kernel.org/6.2.12-136-Linux-6.2.12.patch @@ -0,0 +1,50 @@ +From: Greg Kroah-Hartman +Date: Thu, 20 Apr 2023 12:37:00 +0200 +Subject: [PATCH] Linux 6.2.12 +References: bsc#1012628 +Patch-mainline: 6.2.12 +Git-commit: e0ee50101346ca9cef52da75e3fb4380c27c042a + +Link: https://lore.kernel.org/r/20230418120313.725598495@linuxfoundation.org +Tested-by: Chris Paterson (CIP) +Tested-by: Ronald Warsow +Tested-by: Markus Reichelt +Tested-by: Shuah Khan +Tested-by: Justin M. Forbes +Tested-by: Ron Economos +Tested-by: Florian Fainelli +Tested-by: Guenter Roeck +Tested-by: Bagas Sanjaya +Tested-by: Linux Kernel Functional Testing +Link: https://lore.kernel.org/r/20230419093655.693770727@linuxfoundation.org +Link: https://lore.kernel.org/r/20230419132054.228391649@linuxfoundation.org +Tested-by: Ron Economos +Tested-by: Markus Reichelt +Tested-by: Conor Dooley +Tested-by: Florian Fainelli +Tested-by: Jon Hunter +Tested-by: Guenter Roeck +Tested-by: Bagas Sanjaya +Tested-by: Linux Kernel Functional Testing +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Makefile b/Makefile +index 416490da..068374cc 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 6 + PATCHLEVEL = 2 +-SUBLEVEL = 11 ++SUBLEVEL = 12 + EXTRAVERSION = + NAME = Hurr durr I'ma ninja sloth + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-001-interconnect-qcom-osm-l3-fix-icc_onecell_data-a.patch b/patches.kernel.org/6.2.9-001-interconnect-qcom-osm-l3-fix-icc_onecell_data-a.patch new file mode 100644 index 0000000..b060811 --- /dev/null +++ b/patches.kernel.org/6.2.9-001-interconnect-qcom-osm-l3-fix-icc_onecell_data-a.patch @@ -0,0 +1,44 @@ +From: Dmitry Baryshkov +Date: Thu, 5 Jan 2023 02:22:19 +0200 +Subject: [PATCH] interconnect: qcom: osm-l3: fix icc_onecell_data allocation +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: f77ebdda0ee652124061c2ac42399bb6c367e729 + +[ Upstream commit f77ebdda0ee652124061c2ac42399bb6c367e729 ] + +This is a struct with a trailing zero-length array of icc_node pointers +but it's allocated as if it were a single array of icc_nodes instead. + +Fortunately this overallocates memory rather then allocating less memory +than required. + +Fix by replacing devm_kcalloc() with devm_kzalloc() and struct_size() +macro. + +Fixes: 5bc9900addaf ("interconnect: qcom: Add OSM L3 interconnect provider support") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20230105002221.1416479-2-dmitry.baryshkov@linaro.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/interconnect/qcom/osm-l3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/interconnect/qcom/osm-l3.c b/drivers/interconnect/qcom/osm-l3.c +index 3a1cbfe3..1bafb54f 100644 +--- a/drivers/interconnect/qcom/osm-l3.c ++++ b/drivers/interconnect/qcom/osm-l3.c +@@ -236,7 +236,7 @@ static int qcom_osm_l3_probe(struct platform_device *pdev) + qnodes = desc->nodes; + num_nodes = desc->num_nodes; + +- data = devm_kcalloc(&pdev->dev, num_nodes, sizeof(*node), GFP_KERNEL); ++ data = devm_kzalloc(&pdev->dev, struct_size(data, nodes, num_nodes), GFP_KERNEL); + if (!data) + return -ENOMEM; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-002-interconnect-qcom-sm8450-switch-to-qcom_icc_rpm.patch b/patches.kernel.org/6.2.9-002-interconnect-qcom-sm8450-switch-to-qcom_icc_rpm.patch new file mode 100644 index 0000000..9ea5f7e --- /dev/null +++ b/patches.kernel.org/6.2.9-002-interconnect-qcom-sm8450-switch-to-qcom_icc_rpm.patch @@ -0,0 +1,143 @@ +From: Dmitry Baryshkov +Date: Thu, 5 Jan 2023 02:22:20 +0200 +Subject: [PATCH] interconnect: qcom: sm8450: switch to qcom_icc_rpmh_* + function +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 87e8fab1917a2b3f6e3dedfd1cdf22a1416e6676 + +[ Upstream commit 87e8fab1917a2b3f6e3dedfd1cdf22a1416e6676 ] + +Change sm8450 interconnect driver to use generic qcom_icc_rpmh_* +functions rather than embedding a copy of thema. This also fixes an +overallocation of memory for icc_onecell_data structure. + +Fixes: fafc114a468e ("interconnect: qcom: Add SM8450 interconnect provider driver") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20230105002221.1416479-3-dmitry.baryshkov@linaro.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/interconnect/qcom/sm8450.c | 98 +----------------------------- + 1 file changed, 2 insertions(+), 96 deletions(-) + +diff --git a/drivers/interconnect/qcom/sm8450.c b/drivers/interconnect/qcom/sm8450.c +index e3a12e3d..2d7a8e7b 100644 +--- a/drivers/interconnect/qcom/sm8450.c ++++ b/drivers/interconnect/qcom/sm8450.c +@@ -1844,100 +1844,6 @@ static const struct qcom_icc_desc sm8450_system_noc = { + .num_bcms = ARRAY_SIZE(system_noc_bcms), + }; + +-static int qnoc_probe(struct platform_device *pdev) +-{ +- const struct qcom_icc_desc *desc; +- struct icc_onecell_data *data; +- struct icc_provider *provider; +- struct qcom_icc_node * const *qnodes; +- struct qcom_icc_provider *qp; +- struct icc_node *node; +- size_t num_nodes, i; +- int ret; +- +- desc = device_get_match_data(&pdev->dev); +- if (!desc) +- return -EINVAL; +- +- qnodes = desc->nodes; +- num_nodes = desc->num_nodes; +- +- qp = devm_kzalloc(&pdev->dev, sizeof(*qp), GFP_KERNEL); +- if (!qp) +- return -ENOMEM; +- +- data = devm_kcalloc(&pdev->dev, num_nodes, sizeof(*node), GFP_KERNEL); +- if (!data) +- return -ENOMEM; +- +- provider = &qp->provider; +- provider->dev = &pdev->dev; +- provider->set = qcom_icc_set; +- provider->pre_aggregate = qcom_icc_pre_aggregate; +- provider->aggregate = qcom_icc_aggregate; +- provider->xlate_extended = qcom_icc_xlate_extended; +- INIT_LIST_HEAD(&provider->nodes); +- provider->data = data; +- +- qp->dev = &pdev->dev; +- qp->bcms = desc->bcms; +- qp->num_bcms = desc->num_bcms; +- +- qp->voter = of_bcm_voter_get(qp->dev, NULL); +- if (IS_ERR(qp->voter)) +- return PTR_ERR(qp->voter); +- +- ret = icc_provider_add(provider); +- if (ret) { +- dev_err(&pdev->dev, "error adding interconnect provider\n"); +- return ret; +- } +- +- for (i = 0; i < qp->num_bcms; i++) +- qcom_icc_bcm_init(qp->bcms[i], &pdev->dev); +- +- for (i = 0; i < num_nodes; i++) { +- size_t j; +- +- if (!qnodes[i]) +- continue; +- +- node = icc_node_create(qnodes[i]->id); +- if (IS_ERR(node)) { +- ret = PTR_ERR(node); +- goto err; +- } +- +- node->name = qnodes[i]->name; +- node->data = qnodes[i]; +- icc_node_add(node, provider); +- +- for (j = 0; j < qnodes[i]->num_links; j++) +- icc_link_create(node, qnodes[i]->links[j]); +- +- data->nodes[i] = node; +- } +- data->num_nodes = num_nodes; +- +- platform_set_drvdata(pdev, qp); +- +- return 0; +-err: +- icc_nodes_remove(provider); +- icc_provider_del(provider); +- return ret; +-} +- +-static int qnoc_remove(struct platform_device *pdev) +-{ +- struct qcom_icc_provider *qp = platform_get_drvdata(pdev); +- +- icc_nodes_remove(&qp->provider); +- icc_provider_del(&qp->provider); +- +- return 0; +-} +- + static const struct of_device_id qnoc_of_match[] = { + { .compatible = "qcom,sm8450-aggre1-noc", + .data = &sm8450_aggre1_noc}, +@@ -1966,8 +1872,8 @@ static const struct of_device_id qnoc_of_match[] = { + MODULE_DEVICE_TABLE(of, qnoc_of_match); + + static struct platform_driver qnoc_driver = { +- .probe = qnoc_probe, +- .remove = qnoc_remove, ++ .probe = qcom_icc_rpmh_probe, ++ .remove = qcom_icc_rpmh_remove, + .driver = { + .name = "qnoc-sm8450", + .of_match_table = qnoc_of_match, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-003-interconnect-qcom-qcm2290-Fix-MASTER_SNOC_BIMC_.patch b/patches.kernel.org/6.2.9-003-interconnect-qcom-qcm2290-Fix-MASTER_SNOC_BIMC_.patch new file mode 100644 index 0000000..d1b9f49 --- /dev/null +++ b/patches.kernel.org/6.2.9-003-interconnect-qcom-qcm2290-Fix-MASTER_SNOC_BIMC_.patch @@ -0,0 +1,44 @@ +From: Konrad Dybcio +Date: Tue, 3 Jan 2023 15:21:20 +0100 +Subject: [PATCH] interconnect: qcom: qcm2290: Fix MASTER_SNOC_BIMC_NRT +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 633a12fda6536a1a17bcea29502e777e86a4547e + +[ Upstream commit 633a12fda6536a1a17bcea29502e777e86a4547e ] + +Due to what seems to be a copy-paste error, the _NRT master was +identical to the _RT master, which should not be the case.. Fix it +using the values available from the downstream kernel [1]. + +[1] https://android.googlesource.com/kernel/msm-extra/devicetree/+/refs/heads/android-msm-bramble-4.19-android11-qpr1/qcom/scuba-bus.dtsi#127 +Fixes: 1a14b1ac3935 ("interconnect: qcom: Add QCM2290 driver support") +Signed-off-by: Konrad Dybcio +Acked-by: Shawn Guo +Link: https://lore.kernel.org/r/20230103142120.15605-1-konrad.dybcio@linaro.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/interconnect/qcom/qcm2290.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/interconnect/qcom/qcm2290.c b/drivers/interconnect/qcom/qcm2290.c +index 0da612d6..a29cdb4f 100644 +--- a/drivers/interconnect/qcom/qcm2290.c ++++ b/drivers/interconnect/qcom/qcm2290.c +@@ -147,9 +147,9 @@ static struct qcom_icc_node mas_snoc_bimc_nrt = { + .name = "mas_snoc_bimc_nrt", + .buswidth = 16, + .qos.ap_owned = true, +- .qos.qos_port = 2, ++ .qos.qos_port = 3, + .qos.qos_mode = NOC_QOS_MODE_BYPASS, +- .mas_rpm_id = 163, ++ .mas_rpm_id = 164, + .slv_rpm_id = -1, + .num_links = ARRAY_SIZE(mas_snoc_bimc_nrt_links), + .links = mas_snoc_bimc_nrt_links, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-004-perf-core-Fix-perf_output_begin-parameter-is-in.patch b/patches.kernel.org/6.2.9-004-perf-core-Fix-perf_output_begin-parameter-is-in.patch new file mode 100644 index 0000000..d4b2732 --- /dev/null +++ b/patches.kernel.org/6.2.9-004-perf-core-Fix-perf_output_begin-parameter-is-in.patch @@ -0,0 +1,65 @@ +From: Yang Jihong +Date: Tue, 14 Mar 2023 04:47:35 +0000 +Subject: [PATCH] perf/core: Fix perf_output_begin parameter is incorrectly + invoked in perf_event_bpf_output +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: eb81a2ed4f52be831c9fb879752d89645a312c13 + +[ Upstream commit eb81a2ed4f52be831c9fb879752d89645a312c13 ] + +syzkaller reportes a KASAN issue with stack-out-of-bounds. +The call trace is as follows: + dump_stack+0x9c/0xd3 + print_address_description.constprop.0+0x19/0x170 + __kasan_report.cold+0x6c/0x84 + kasan_report+0x3a/0x50 + __perf_event_header__init_id+0x34/0x290 + perf_event_header__init_id+0x48/0x60 + perf_output_begin+0x4a4/0x560 + perf_event_bpf_output+0x161/0x1e0 + perf_iterate_sb_cpu+0x29e/0x340 + perf_iterate_sb+0x4c/0xc0 + perf_event_bpf_event+0x194/0x2c0 + __bpf_prog_put.constprop.0+0x55/0xf0 + __cls_bpf_delete_prog+0xea/0x120 [cls_bpf] + cls_bpf_delete_prog_work+0x1c/0x30 [cls_bpf] + process_one_work+0x3c2/0x730 + worker_thread+0x93/0x650 + kthread+0x1b8/0x210 + ret_from_fork+0x1f/0x30 + +commit 267fb27352b6 ("perf: Reduce stack usage of perf_output_begin()") +use on-stack struct perf_sample_data of the caller function. + +However, perf_event_bpf_output uses incorrect parameter to convert +small-sized data (struct perf_bpf_event) into large-sized data +(struct perf_sample_data), which causes memory overwriting occurs in +__perf_event_header__init_id. + +Fixes: 267fb27352b6 ("perf: Reduce stack usage of perf_output_begin()") +Signed-off-by: Yang Jihong +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20230314044735.56551-1-yangjihong1@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/events/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 8ae8a505..002eb9b9 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -9163,7 +9163,7 @@ static void perf_event_bpf_output(struct perf_event *event, void *data) + + perf_event_header__init_id(&bpf_event->event_id.header, + &sample, event); +- ret = perf_output_begin(&handle, data, event, ++ ret = perf_output_begin(&handle, &sample, event, + bpf_event->event_id.header.size); + if (ret) + return; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-005-perf-fix-perf_event_context-time.patch b/patches.kernel.org/6.2.9-005-perf-fix-perf_event_context-time.patch new file mode 100644 index 0000000..965ec30 --- /dev/null +++ b/patches.kernel.org/6.2.9-005-perf-fix-perf_event_context-time.patch @@ -0,0 +1,43 @@ +From: Song Liu +Date: Mon, 13 Mar 2023 10:16:08 -0700 +Subject: [PATCH] perf: fix perf_event_context->time +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: baf1b12a67f5b24f395baca03e442ce27cab0c18 + +[ Upstream commit baf1b12a67f5b24f395baca03e442ce27cab0c18 ] + +Time readers rely on perf_event_context->[time|timestamp|timeoffset] to get +accurate time_enabled and time_running for an event. The difference between +ctx->timestamp and ctx->time is the among of time when the context is not +enabled. __update_context_time(ctx, false) is used to increase timestamp, +but not time. Therefore, it should only be called in ctx_sched_in() when +EVENT_TIME was not enabled. + +Fixes: 09f5e7dc7ad7 ("perf: Fix perf_event_read_local() time") +Signed-off-by: Song Liu +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Namhyung Kim +Link: https://lkml.kernel.org/r/20230313171608.298734-1-song@kernel.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/events/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 002eb9b9..fad170b4 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -3872,7 +3872,7 @@ ctx_sched_in(struct perf_event_context *ctx, enum event_type_t event_type) + if (likely(!ctx->nr_events)) + return; + +- if (is_active ^ EVENT_TIME) { ++ if (!(is_active & EVENT_TIME)) { + /* start ctx time */ + __update_context_time(ctx, false); + perf_cgroup_set_timestamp(cpuctx); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-006-tracing-hwlat-Replace-sched_setaffinity-with-se.patch b/patches.kernel.org/6.2.9-006-tracing-hwlat-Replace-sched_setaffinity-with-se.patch new file mode 100644 index 0000000..892c49e --- /dev/null +++ b/patches.kernel.org/6.2.9-006-tracing-hwlat-Replace-sched_setaffinity-with-se.patch @@ -0,0 +1,72 @@ +From: Costa Shulyupin +Date: Thu, 16 Mar 2023 16:45:35 +0200 +Subject: [PATCH] tracing/hwlat: Replace sched_setaffinity with + set_cpus_allowed_ptr +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 71c7a30442b724717a30d5e7d1662ba4904eb3d4 + +[ Upstream commit 71c7a30442b724717a30d5e7d1662ba4904eb3d4 ] + +There is a problem with the behavior of hwlat in a container, +resulting in incorrect output. A warning message is generated: +"cpumask changed while in round-robin mode, switching to mode none", +and the tracing_cpumask is ignored. This issue arises because +the kernel thread, hwlatd, is not a part of the container, and +the function sched_setaffinity is unable to locate it using its PID. +Additionally, the task_struct of hwlatd is already known. +Ultimately, the function set_cpus_allowed_ptr achieves +the same outcome as sched_setaffinity, but employs task_struct +instead of PID. + +Test case: + + # cd /sys/kernel/tracing + # echo 0 > tracing_on + # echo round-robin > hwlat_detector/mode + # echo hwlat > current_tracer + # unshare --fork --pid bash -c 'echo 1 > tracing_on' + # dmesg -c + +Actual behavior: + +[573502.809060] hwlat_detector: cpumask changed while in round-robin mode, switching to mode none + +Link: https://lore.kernel.org/linux-trace-kernel/20230316144535.1004952-1-costa.shul@redhat.com + +Cc: Masami Hiramatsu +Fixes: 0330f7aa8ee63 ("tracing: Have hwlat trace migrate across tracing_cpumask CPUs") +Signed-off-by: Costa Shulyupin +Acked-by: Daniel Bristot de Oliveira +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/trace/trace_hwlat.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c +index c4945f8a..2f37a6e6 100644 +--- a/kernel/trace/trace_hwlat.c ++++ b/kernel/trace/trace_hwlat.c +@@ -339,7 +339,7 @@ static void move_to_next_cpu(void) + cpumask_clear(current_mask); + cpumask_set_cpu(next_cpu, current_mask); + +- sched_setaffinity(0, current_mask); ++ set_cpus_allowed_ptr(current, current_mask); + return; + + change_mode: +@@ -446,7 +446,7 @@ static int start_single_kthread(struct trace_array *tr) + + } + +- sched_setaffinity(kthread->pid, current_mask); ++ set_cpus_allowed_ptr(kthread, current_mask); + + kdata->kthread = kthread; + wake_up_process(kthread); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-007-drm-amd-display-fix-k1-k2-divider-programming-f.patch b/patches.kernel.org/6.2.9-007-drm-amd-display-fix-k1-k2-divider-programming-f.patch new file mode 100644 index 0000000..bd77c25 --- /dev/null +++ b/patches.kernel.org/6.2.9-007-drm-amd-display-fix-k1-k2-divider-programming-f.patch @@ -0,0 +1,51 @@ +From: Aurabindo Pillai +Date: Mon, 30 Jan 2023 13:07:59 -0500 +Subject: [PATCH] drm/amd/display: fix k1 k2 divider programming for phantom + streams +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 3b214bb7185d8284d7d4c53e15127f69a375abf6 + +[ Upstream commit 3b214bb7185d8284d7d4c53e15127f69a375abf6 ] + +[Why & How] +When k1 and k2 divider programming logic is executed for a phantom +stream, the corresponding master stream should be used for the +calculation. Fix the if condition to use the master stream for checking +signal type instead of the phantom stream. + +Reviewed-by: Alvin Lee +Acked-by: Qingqing Zhuo +Signed-off-by: Aurabindo Pillai +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Stable-dep-of: 709671ffb15d ("drm/amd/display: Remove OTG DIV register write for Virtual signals.") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c +index b8767be1..e119f4f7 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c +@@ -1178,13 +1178,13 @@ unsigned int dcn32_calculate_dccg_k1_k2_values(struct pipe_ctx *pipe_ctx, unsign + if (is_dp_128b_132b_signal(pipe_ctx)) { + *k1_div = PIXEL_RATE_DIV_BY_1; + *k2_div = PIXEL_RATE_DIV_BY_1; +- } else if (dc_is_hdmi_tmds_signal(pipe_ctx->stream->signal) || dc_is_dvi_signal(pipe_ctx->stream->signal)) { ++ } else if (dc_is_hdmi_tmds_signal(stream->signal) || dc_is_dvi_signal(stream->signal)) { + *k1_div = PIXEL_RATE_DIV_BY_1; + if (stream->timing.pixel_encoding == PIXEL_ENCODING_YCBCR420) + *k2_div = PIXEL_RATE_DIV_BY_2; + else + *k2_div = PIXEL_RATE_DIV_BY_4; +- } else if (dc_is_dp_signal(pipe_ctx->stream->signal) || dc_is_virtual_signal(pipe_ctx->stream->signal)) { ++ } else if (dc_is_dp_signal(stream->signal) || dc_is_virtual_signal(stream->signal)) { + if (two_pix_per_container) { + *k1_div = PIXEL_RATE_DIV_BY_1; + *k2_div = PIXEL_RATE_DIV_BY_2; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-008-drm-amd-display-Remove-OTG-DIV-register-write-f.patch b/patches.kernel.org/6.2.9-008-drm-amd-display-Remove-OTG-DIV-register-write-f.patch new file mode 100644 index 0000000..bf092c3 --- /dev/null +++ b/patches.kernel.org/6.2.9-008-drm-amd-display-Remove-OTG-DIV-register-write-f.patch @@ -0,0 +1,51 @@ +From: Saaem Rizvi +Date: Mon, 27 Feb 2023 18:55:07 -0500 +Subject: [PATCH] drm/amd/display: Remove OTG DIV register write for Virtual + signals. +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 709671ffb15dcd1b4f6afe2a9d8c67c7c4ead4a1 + +[ Upstream commit 709671ffb15dcd1b4f6afe2a9d8c67c7c4ead4a1 ] + +[WHY] +Hot plugging and then hot unplugging leads to k1 and k2 values to +change, as signal is detected as a virtual signal on hot unplug. Writing +these values to OTG_PIXEL_RATE_DIV register might cause primary display +to blank (known hw bug). + +[HOW] +No longer write k1 and k2 values to register if signal is virtual, we +have safe guards in place in the case that k1 and k2 is unassigned so +that an unknown value is not written to the register either. + +Cc: stable@vger.kernel.org +Cc: Mario Limonciello +Reviewed-by: Samson Tam +Reviewed-by: Alvin Lee +Acked-by: Qingqing Zhuo +Signed-off-by: Saaem Rizvi +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c +index e119f4f7..30d15a94 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c +@@ -1184,7 +1184,7 @@ unsigned int dcn32_calculate_dccg_k1_k2_values(struct pipe_ctx *pipe_ctx, unsign + *k2_div = PIXEL_RATE_DIV_BY_2; + else + *k2_div = PIXEL_RATE_DIV_BY_4; +- } else if (dc_is_dp_signal(stream->signal) || dc_is_virtual_signal(stream->signal)) { ++ } else if (dc_is_dp_signal(stream->signal)) { + if (two_pix_per_container) { + *k1_div = PIXEL_RATE_DIV_BY_1; + *k2_div = PIXEL_RATE_DIV_BY_2; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-009-drm-amd-display-Fix-DP-MST-sinks-removal-issue.patch b/patches.kernel.org/6.2.9-009-drm-amd-display-Fix-DP-MST-sinks-removal-issue.patch new file mode 100644 index 0000000..3f5440c --- /dev/null +++ b/patches.kernel.org/6.2.9-009-drm-amd-display-Fix-DP-MST-sinks-removal-issue.patch @@ -0,0 +1,80 @@ +From: Cruise Hung +Date: Wed, 22 Mar 2023 17:08:41 -0500 +Subject: [PATCH] drm/amd/display: Fix DP MST sinks removal issue +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: cbd6c1b17d3b42b7935526a86ad5f66838767d03 + +[ Upstream commit cbd6c1b17d3b42b7935526a86ad5f66838767d03 ] + +[Why] +In USB4 DP tunneling, it's possible to have this scenario that +the path becomes unavailable and CM tears down the path a little bit late. +So, in this case, the HPD is high but fails to read any DPCD register. +That causes the link connection type to be set to sst. +And not all sinks are removed behind the MST branch. + +[How] +Restore the link connection type if it fails to read DPCD register. + +Cc: stable@vger.kernel.org +Cc: Mario Limonciello +Reviewed-by: Wenjing Liu +Acked-by: Qingqing Zhuo +Signed-off-by: Cruise Hung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit cbd6c1b17d3b42b7935526a86ad5f66838767d03) +Modified for stable backport as a lot of the code in this file was moved +in 6.3 to drivers/gpu/drm/amd/display/dc/link/link_detection.c. +Signed-off-by: Mario Limonciello +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/display/dc/core/dc_link.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +index 754fc863..54656fca 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +@@ -1016,6 +1016,7 @@ static bool detect_link_and_local_sink(struct dc_link *link, + struct dc_sink *prev_sink = NULL; + struct dpcd_caps prev_dpcd_caps; + enum dc_connection_type new_connection_type = dc_connection_none; ++ enum dc_connection_type pre_connection_type = link->type; + const uint32_t post_oui_delay = 30; // 30ms + + DC_LOGGER_INIT(link->ctx->logger); +@@ -1118,6 +1119,8 @@ static bool detect_link_and_local_sink(struct dc_link *link, + } + + if (!detect_dp(link, &sink_caps, reason)) { ++ link->type = pre_connection_type; ++ + if (prev_sink) + dc_sink_release(prev_sink); + return false; +@@ -1349,6 +1352,8 @@ bool dc_link_detect(struct dc_link *link, enum dc_detect_reason reason) + bool is_delegated_to_mst_top_mgr = false; + enum dc_connection_type pre_link_type = link->type; + ++ DC_LOGGER_INIT(link->ctx->logger); ++ + is_local_sink_detect_success = detect_link_and_local_sink(link, reason); + + if (is_local_sink_detect_success && link->local_sink) +@@ -1359,6 +1364,10 @@ bool dc_link_detect(struct dc_link *link, enum dc_detect_reason reason) + link->dpcd_caps.is_mst_capable) + is_delegated_to_mst_top_mgr = discover_dp_mst_topology(link, reason); + ++ DC_LOG_DC("%s: link_index=%d is_local_sink_detect_success=%d pre_link_type=%d link_type=%d\n", __func__, ++ link->link_index, is_local_sink_detect_success, pre_link_type, link->type); ++ ++ + if (is_local_sink_detect_success && + pre_link_type == dc_connection_mst_branch && + link->type != dc_connection_mst_branch) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-010-arm64-dts-freescale-imx8-ss-lsio-Fix-flexspi-cl.patch b/patches.kernel.org/6.2.9-010-arm64-dts-freescale-imx8-ss-lsio-Fix-flexspi-cl.patch new file mode 100644 index 0000000..2eb9d22 --- /dev/null +++ b/patches.kernel.org/6.2.9-010-arm64-dts-freescale-imx8-ss-lsio-Fix-flexspi-cl.patch @@ -0,0 +1,37 @@ +From: Alexander Stein +Date: Tue, 31 Jan 2023 11:35:58 +0100 +Subject: [PATCH] arm64: dts: freescale: imx8-ss-lsio: Fix flexspi clock order +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: fd4334a06d452ce89a0bb831b03130c51331d927 + +[ Upstream commit fd4334a06d452ce89a0bb831b03130c51331d927 ] + +The correct clock order is "fspi_en" and "fspi". As they are identical +just reordering the names is sufficient. + +Fixes: 6276d66984e9 ("arm64: dts: imx8dxl: add flexspi0 support") +Signed-off-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi b/arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi +index 1f3d225e..06b94bbc 100644 +--- a/arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi +@@ -117,7 +117,7 @@ flexspi0: spi@5d120000 { + interrupts = ; + clocks = <&clk IMX_SC_R_FSPI_0 IMX_SC_PM_CLK_PER>, + <&clk IMX_SC_R_FSPI_0 IMX_SC_PM_CLK_PER>; +- clock-names = "fspi", "fspi_en"; ++ clock-names = "fspi_en", "fspi"; + power-domains = <&pd IMX_SC_R_FSPI_0>; + status = "disabled"; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-011-arm64-dts-qcom-sc8280xp-Add-label-property-to-v.patch b/patches.kernel.org/6.2.9-011-arm64-dts-qcom-sc8280xp-Add-label-property-to-v.patch new file mode 100644 index 0000000..9f47b0b --- /dev/null +++ b/patches.kernel.org/6.2.9-011-arm64-dts-qcom-sc8280xp-Add-label-property-to-v.patch @@ -0,0 +1,138 @@ +From: Manivannan Sadhasivam +Date: Sat, 11 Feb 2023 10:54:15 +0530 +Subject: [PATCH] arm64: dts: qcom: sc8280xp: Add label property to vadc + channel nodes +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 8013295662f55696e5953ef14c31ba03721adf8f + +[ Upstream commit 8013295662f55696e5953ef14c31ba03721adf8f ] + +For uniquely identifying the vadc channels, label property has to be used. +The initial commit adding vadc support assumed that the driver will use the +unit address along with the node name to identify the channels. But this +assumption is now broken by, +commit 701c875aded8 ("iio: adc: qcom-spmi-adc5: Fix the channel name") that +stripped unit address from channel names. This results in probe failure of +the vadc driver: + +[ 8.380370] iio iio:device0: tried to double register : in_temp_pmic-die-temp_input +[ 8.380383] qcom-spmi-adc5 c440000.spmi:pmic@0:adc@3100: Failed to register sysfs interfaces +[ 8.380386] qcom-spmi-adc5: probe of c440000.spmi:pmic@0:adc@3100 failed with error -16 + +Hence, let's get rid of the assumption about drivers and rely on label +property to uniquely identify the channels. + +The labels are derived from the schematics for each PMIC. For internal adc +channels such as die and xo, the PMIC names are used as a prefix. + +Fixes: 7c0151347401 ("arm64: dts: qcom: sc8280xp-x13s: Add PM8280_{1/2} ADC_TM5 channels") +Fixes: 9d41cd17394a ("arm64: dts: qcom: sc8280xp-x13s: Add PMR735A VADC channel") +Fixes: 3375151a7185 ("arm64: dts: qcom: sc8280xp-x13s: Add PM8280_{1/2} VADC channels") +Fixes: 9a6b3042c533 ("arm64: dts: qcom: sc8280xp-x13s: Add PMK8280 VADC channels") +Reported-by: Steev Klimaszewski +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230211052415.14581-1-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts +index 568c6be1..a0eb1b34 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts ++++ b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts +@@ -425,75 +425,88 @@ &pmk8280_vadc { + pmic-die-temp@3 { + reg = ; + qcom,pre-scaling = <1 1>; ++ label = "pmk8350_die_temp"; + }; + + xo-therm@44 { + reg = ; + qcom,hw-settle-time = <200>; + qcom,ratiometric; ++ label = "pmk8350_xo_therm"; + }; + + pmic-die-temp@103 { + reg = ; + qcom,pre-scaling = <1 1>; ++ label = "pmc8280_1_die_temp"; + }; + + sys-therm@144 { + reg = ; + qcom,hw-settle-time = <200>; + qcom,ratiometric; ++ label = "sys_therm1"; + }; + + sys-therm@145 { + reg = ; + qcom,hw-settle-time = <200>; + qcom,ratiometric; ++ label = "sys_therm2"; + }; + + sys-therm@146 { + reg = ; + qcom,hw-settle-time = <200>; + qcom,ratiometric; ++ label = "sys_therm3"; + }; + + sys-therm@147 { + reg = ; + qcom,hw-settle-time = <200>; + qcom,ratiometric; ++ label = "sys_therm4"; + }; + + pmic-die-temp@303 { + reg = ; + qcom,pre-scaling = <1 1>; ++ label = "pmc8280_2_die_temp"; + }; + + sys-therm@344 { + reg = ; + qcom,hw-settle-time = <200>; + qcom,ratiometric; ++ label = "sys_therm5"; + }; + + sys-therm@345 { + reg = ; + qcom,hw-settle-time = <200>; + qcom,ratiometric; ++ label = "sys_therm6"; + }; + + sys-therm@346 { + reg = ; + qcom,hw-settle-time = <200>; + qcom,ratiometric; ++ label = "sys_therm7"; + }; + + sys-therm@347 { + reg = ; + qcom,hw-settle-time = <200>; + qcom,ratiometric; ++ label = "sys_therm8"; + }; + + pmic-die-temp@403 { + reg = ; + qcom,pre-scaling = <1 1>; ++ label = "pmr735a_die_temp"; + }; + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-012-arm64-dts-qcom-sm6375-Add-missing-power-domain-.patch b/patches.kernel.org/6.2.9-012-arm64-dts-qcom-sm6375-Add-missing-power-domain-.patch new file mode 100644 index 0000000..23bcc25 --- /dev/null +++ b/patches.kernel.org/6.2.9-012-arm64-dts-qcom-sm6375-Add-missing-power-domain-.patch @@ -0,0 +1,37 @@ +From: Konrad Dybcio +Date: Mon, 9 Jan 2023 14:56:47 +0100 +Subject: [PATCH] arm64: dts: qcom: sm6375: Add missing power-domain-named to + CDSP +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 11d5e41f5e129e39bddedc7244a0946a802d2e8e + +[ Upstream commit 11d5e41f5e129e39bddedc7244a0946a802d2e8e ] + +This was omitted when first introducing the node. Fix it. + +Fixes: fe6fd26aeddf ("arm64: dts: qcom: sm6375: Add ADSP&CDSP") +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230109135647.339224-5-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sm6375.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm6375.dtsi b/arch/arm64/boot/dts/qcom/sm6375.dtsi +index 12cf5dbe..419df4e3 100644 +--- a/arch/arm64/boot/dts/qcom/sm6375.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6375.dtsi +@@ -1209,6 +1209,7 @@ remoteproc_cdsp: remoteproc@b000000 { + clock-names = "xo"; + + power-domains = <&rpmpd SM6375_VDDCX>; ++ power-domain-names = "cx"; + + memory-region = <&pil_cdsp_mem>; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-013-arm64-dts-qcom-sm8450-correct-WSA2-assigned-clo.patch b/patches.kernel.org/6.2.9-013-arm64-dts-qcom-sm8450-correct-WSA2-assigned-clo.patch new file mode 100644 index 0000000..8909415 --- /dev/null +++ b/patches.kernel.org/6.2.9-013-arm64-dts-qcom-sm8450-correct-WSA2-assigned-clo.patch @@ -0,0 +1,41 @@ +From: Krzysztof Kozlowski +Date: Wed, 8 Mar 2023 13:31:29 +0100 +Subject: [PATCH] arm64: dts: qcom: sm8450: correct WSA2 assigned clocks +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 6df6fab9320bc9ebdf50136a01e7bf0ee5984c62 + +[ Upstream commit 6df6fab9320bc9ebdf50136a01e7bf0ee5984c62 ] + +The WSA2 assigned-clocks were copied from WSA, but the WSA2 uses its +own. + +Fixes: 14341e76dbc7 ("arm64: dts: qcom: sm8450: add Soundwire and LPASS") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230308123129.232642-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sm8450.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi +index f57980a3..40348bb6 100644 +--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi +@@ -2104,8 +2104,8 @@ wsa2macro: codec@31e0000 { + <&q6prmcc LPASS_HW_DCODEC_VOTE LPASS_CLK_ATTRIBUTE_COUPLE_NO>, + <&vamacro>; + clock-names = "mclk", "npl", "macro", "dcodec", "fsgen"; +- assigned-clocks = <&q6prmcc LPASS_CLK_ID_WSA_CORE_TX_MCLK LPASS_CLK_ATTRIBUTE_COUPLE_NO>, +- <&q6prmcc LPASS_CLK_ID_WSA_CORE_TX_2X_MCLK LPASS_CLK_ATTRIBUTE_COUPLE_NO>; ++ assigned-clocks = <&q6prmcc LPASS_CLK_ID_WSA2_CORE_TX_MCLK LPASS_CLK_ATTRIBUTE_COUPLE_NO>, ++ <&q6prmcc LPASS_CLK_ID_WSA2_CORE_TX_2X_MCLK LPASS_CLK_ATTRIBUTE_COUPLE_NO>; + assigned-clock-rates = <19200000>, <19200000>; + + #clock-cells = <0>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-014-arm64-dts-qcom-sm8450-Mark-UFS-controller-as-ca.patch b/patches.kernel.org/6.2.9-014-arm64-dts-qcom-sm8450-Mark-UFS-controller-as-ca.patch new file mode 100644 index 0000000..e2d2c8b --- /dev/null +++ b/patches.kernel.org/6.2.9-014-arm64-dts-qcom-sm8450-Mark-UFS-controller-as-ca.patch @@ -0,0 +1,39 @@ +From: Manivannan Sadhasivam +Date: Tue, 7 Mar 2023 21:02:01 +0530 +Subject: [PATCH] arm64: dts: qcom: sm8450: Mark UFS controller as cache + coherent +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 8ba961d4339c5db0e69ff6627606fe1f34c838e5 + +[ Upstream commit 8ba961d4339c5db0e69ff6627606fe1f34c838e5 ] + +The UFS controller on SM8450 supports cache coherency, hence add the +"dma-coherent" property to mark it as such. + +Fixes: 07fa917a335e ("arm64: dts: qcom: sm8450: add ufs nodes") +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Neil Armstrong +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230307153201.180626-2-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sm8450.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi +index 40348bb6..16a73288 100644 +--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi +@@ -3658,6 +3658,7 @@ ufs_mem_hc: ufshc@1d84000 { + power-domains = <&gcc UFS_PHY_GDSC>; + + iommus = <&apps_smmu 0xe0 0x0>; ++ dma-coherent; + + interconnects = <&aggre1_noc MASTER_UFS_MEM 0 &mc_virt SLAVE_EBI1 0>, + <&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_UFS_MEM_CFG 0>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-015-power-supply-bq24190-Fix-use-after-free-bug-in-.patch b/patches.kernel.org/6.2.9-015-power-supply-bq24190-Fix-use-after-free-bug-in-.patch new file mode 100644 index 0000000..bc4e148 --- /dev/null +++ b/patches.kernel.org/6.2.9-015-power-supply-bq24190-Fix-use-after-free-bug-in-.patch @@ -0,0 +1,57 @@ +From: Zheng Wang +Date: Fri, 10 Mar 2023 01:47:28 +0800 +Subject: [PATCH] power: supply: bq24190: Fix use after free bug in + bq24190_remove due to race condition +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 47c29d69212911f50bdcdd0564b5999a559010d4 + +[ Upstream commit 47c29d69212911f50bdcdd0564b5999a559010d4 ] + +In bq24190_probe, &bdi->input_current_limit_work is bound +with bq24190_input_current_limit_work. When external power +changed, it will call bq24190_charger_external_power_changed + to start the work. + +If we remove the module which will call bq24190_remove to make +cleanup, there may be a unfinished work. The possible +sequence is as follows: + +CPU0 CPUc1 + + |bq24190_input_current_limit_work +bq24190_remove | +power_supply_unregister | +device_unregister | +power_supply_dev_release| +kfree(psy) | + | + | power_supply_get_property_from_supplier + | //use + +Fix it by finishing the work before cleanup in the bq24190_remove + +Fixes: 97774672573a ("power_supply: Initialize changed_work before calling device_add") +Signed-off-by: Zheng Wang +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/power/supply/bq24190_charger.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c +index 2b2c3a43..6bd71193 100644 +--- a/drivers/power/supply/bq24190_charger.c ++++ b/drivers/power/supply/bq24190_charger.c +@@ -1906,6 +1906,7 @@ static void bq24190_remove(struct i2c_client *client) + struct bq24190_dev_info *bdi = i2c_get_clientdata(client); + int error; + ++ cancel_delayed_work_sync(&bdi->input_current_limit_work); + error = pm_runtime_resume_and_get(bdi->dev); + if (error < 0) + dev_warn(bdi->dev, "pm_runtime_get failed: %i\n", error); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-016-power-supply-da9150-Fix-use-after-free-bug-in-d.patch b/patches.kernel.org/6.2.9-016-power-supply-da9150-Fix-use-after-free-bug-in-d.patch new file mode 100644 index 0000000..f032c4e --- /dev/null +++ b/patches.kernel.org/6.2.9-016-power-supply-da9150-Fix-use-after-free-bug-in-d.patch @@ -0,0 +1,56 @@ +From: Zheng Wang +Date: Sun, 12 Mar 2023 01:46:50 +0800 +Subject: [PATCH] power: supply: da9150: Fix use after free bug in + da9150_charger_remove due to race condition +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 06615d11cc78162dfd5116efb71f29eb29502d37 + +[ Upstream commit 06615d11cc78162dfd5116efb71f29eb29502d37 ] + +In da9150_charger_probe, &charger->otg_work is bound with +da9150_charger_otg_work. da9150_charger_otg_ncb may be +called to start the work. + +If we remove the module which will call da9150_charger_remove +to make cleanup, there may be a unfinished work. The possible +sequence is as follows: + +Fix it by canceling the work before cleanup in the da9150_charger_remove + +CPU0 CPUc1 + + |da9150_charger_otg_work +da9150_charger_remove | +power_supply_unregister | +device_unregister | +power_supply_dev_release| +kfree(psy) | + | + | power_supply_changed(charger->usb); + | //use + +Fixes: c1a281e34dae ("power: Add support for DA9150 Charger") +Signed-off-by: Zheng Wang +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/power/supply/da9150-charger.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/power/supply/da9150-charger.c b/drivers/power/supply/da9150-charger.c +index f9314cc0..6b987da5 100644 +--- a/drivers/power/supply/da9150-charger.c ++++ b/drivers/power/supply/da9150-charger.c +@@ -662,6 +662,7 @@ static int da9150_charger_remove(struct platform_device *pdev) + + if (!IS_ERR_OR_NULL(charger->usb_phy)) + usb_unregister_notifier(charger->usb_phy, &charger->otg_nb); ++ cancel_work_sync(&charger->otg_work); + + power_supply_unregister(charger->battery); + power_supply_unregister(charger->usb); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-017-wifi-mt76-do-not-run-mt76_unregister_device-on-.patch b/patches.kernel.org/6.2.9-017-wifi-mt76-do-not-run-mt76_unregister_device-on-.patch new file mode 100644 index 0000000..5d301ba --- /dev/null +++ b/patches.kernel.org/6.2.9-017-wifi-mt76-do-not-run-mt76_unregister_device-on-.patch @@ -0,0 +1,87 @@ +From: Lorenzo Bianconi +Date: Thu, 23 Feb 2023 00:10:25 +0100 +Subject: [PATCH] wifi: mt76: do not run mt76_unregister_device() on + unregistered hw +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 41130c32f3a18fcc930316da17f3a5f3bc326aa1 + +[ Upstream commit 41130c32f3a18fcc930316da17f3a5f3bc326aa1 ] + +Trying to probe a mt7921e pci card without firmware results in a +successful probe where ieee80211_register_hw hasn't been called. When +removing the driver, ieee802111_unregister_hw is called unconditionally +leading to a kernel NULL pointer dereference. +Fix the issue running mt76_unregister_device routine just for registered +hw. + +Link: https://bugs.debian.org/1029116 +Link: https://bugs.kali.org/view.php?id=8140 +Reported-by: Stuart Hayhurst +Fixes: 1c71e03afe4b ("mt76: mt7921: move mt7921_init_hw in a dedicated work") +Tested-by: Helmut Grohne +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/be3457d82f4e44bb71a22b2b5db27b644a37b1e1.1677107277.git.lorenzo@kernel.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mac80211.c | 8 ++++++++ + drivers/net/wireless/mediatek/mt76/mt76.h | 1 + + 2 files changed, 9 insertions(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c +index fc608b36..d75e999a 100644 +--- a/drivers/net/wireless/mediatek/mt76/mac80211.c ++++ b/drivers/net/wireless/mediatek/mt76/mac80211.c +@@ -526,6 +526,7 @@ int mt76_register_phy(struct mt76_phy *phy, bool vht, + if (ret) + return ret; + ++ set_bit(MT76_STATE_REGISTERED, &phy->state); + phy->dev->phys[phy->band_idx] = phy; + + return 0; +@@ -536,6 +537,9 @@ void mt76_unregister_phy(struct mt76_phy *phy) + { + struct mt76_dev *dev = phy->dev; + ++ if (!test_bit(MT76_STATE_REGISTERED, &phy->state)) ++ return; ++ + mt76_tx_status_check(dev, true); + ieee80211_unregister_hw(phy->hw); + dev->phys[phy->band_idx] = NULL; +@@ -663,6 +667,7 @@ int mt76_register_device(struct mt76_dev *dev, bool vht, + return ret; + + WARN_ON(mt76_worker_setup(hw, &dev->tx_worker, NULL, "tx")); ++ set_bit(MT76_STATE_REGISTERED, &phy->state); + sched_set_fifo_low(dev->tx_worker.task); + + return 0; +@@ -673,6 +678,9 @@ void mt76_unregister_device(struct mt76_dev *dev) + { + struct ieee80211_hw *hw = dev->hw; + ++ if (!test_bit(MT76_STATE_REGISTERED, &dev->phy.state)) ++ return; ++ + if (IS_ENABLED(CONFIG_MT76_LEDS)) + mt76_led_cleanup(dev); + mt76_tx_status_check(dev, true); +diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h +index 32a77a0a..d8216243 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76.h ++++ b/drivers/net/wireless/mediatek/mt76/mt76.h +@@ -399,6 +399,7 @@ struct mt76_tx_cb { + + enum { + MT76_STATE_INITIALIZED, ++ MT76_STATE_REGISTERED, + MT76_STATE_RUNNING, + MT76_STATE_MCU_RUNNING, + MT76_SCANNING, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-018-wifi-mt76-connac-do-not-check-WED-status-for-no.patch b/patches.kernel.org/6.2.9-018-wifi-mt76-connac-do-not-check-WED-status-for-no.patch new file mode 100644 index 0000000..47b2833 --- /dev/null +++ b/patches.kernel.org/6.2.9-018-wifi-mt76-connac-do-not-check-WED-status-for-no.patch @@ -0,0 +1,122 @@ +From: Lorenzo Bianconi +Date: Mon, 6 Mar 2023 18:42:51 +0100 +Subject: [PATCH] wifi: mt76: connac: do not check WED status for non-mmio + devices +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 5683e1488aa9b0805a9403d215e48fed29d6d923 + +[ Upstream commit 5683e1488aa9b0805a9403d215e48fed29d6d923 ] + +WED is supported just for mmio devices, so do not check it for usb or +sdio devices. This patch fixes the crash reported below: + +[ 21.946627] wlp0s3u1i3: authenticate with c4:41:1e:f5:2b:1d +[ 22.525298] wlp0s3u1i3: send auth to c4:41:1e:f5:2b:1d (try 1/3) +[ 22.548274] wlp0s3u1i3: authenticate with c4:41:1e:f5:2b:1d +[ 22.557694] wlp0s3u1i3: send auth to c4:41:1e:f5:2b:1d (try 1/3) +[ 22.565885] wlp0s3u1i3: authenticated +[ 22.569502] wlp0s3u1i3: associate with c4:41:1e:f5:2b:1d (try 1/3) +[ 22.578966] wlp0s3u1i3: RX AssocResp from c4:41:1e:f5:2b:1d (capab=0x11 status=30 aid=3) +[ 22.579113] wlp0s3u1i3: c4:41:1e:f5:2b:1d rejected association temporarily; comeback duration 1000 TU (1024 ms) +[ 23.649518] wlp0s3u1i3: associate with c4:41:1e:f5:2b:1d (try 2/3) +[ 23.752528] wlp0s3u1i3: RX AssocResp from c4:41:1e:f5:2b:1d (capab=0x11 status=0 aid=3) +[ 23.797450] wlp0s3u1i3: associated +[ 24.959527] kernel tried to execute NX-protected page - exploit attempt? (uid: 0) +[ 24.959640] BUG: unable to handle page fault for address: ffff88800c223200 +[ 24.959706] #PF: supervisor instruction fetch in kernel mode +[ 24.959788] #PF: error_code(0x0011) - permissions violation +[ 24.959846] PGD 2c01067 P4D 2c01067 PUD 2c02067 PMD c2a8063 PTE 800000000c223163 +[ 24.959957] Oops: 0011 [#1] PREEMPT SMP +[ 24.960009] CPU: 0 PID: 391 Comm: wpa_supplicant Not tainted 6.2.0-kvm #18 +[ 24.960089] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc37 04/01/2014 +[ 24.960191] RIP: 0010:0xffff88800c223200 +[ 24.960446] RSP: 0018:ffffc90000ff7698 EFLAGS: 00010282 +[ 24.960513] RAX: ffff888028397010 RBX: ffff88800c26e630 RCX: 0000000000000058 +[ 24.960598] RDX: ffff88800c26f844 RSI: 0000000000000006 RDI: ffff888028397010 +[ 24.960682] RBP: ffff88800ea72f00 R08: 18b873fbab2b964c R09: be06b38235f3c63c +[ 24.960766] R10: 18b873fbab2b964c R11: be06b38235f3c63c R12: 0000000000000001 +[ 24.960853] R13: ffff88800c26f84c R14: ffff8880063f0ff8 R15: ffff88800c26e644 +[ 24.960950] FS: 00007effcea327c0(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 +[ 24.961036] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 24.961106] CR2: ffff88800c223200 CR3: 000000000eaa2000 CR4: 00000000000006b0 +[ 24.961190] Call Trace: +[ 24.961219] +[ 24.961245] ? mt76_connac_mcu_add_key+0x2cf/0x310 +[ 24.961313] ? mt7921_set_key+0x150/0x200 +[ 24.961365] ? drv_set_key+0xa9/0x1b0 +[ 24.961418] ? ieee80211_key_enable_hw_accel+0xd9/0x240 +[ 24.961485] ? ieee80211_key_replace+0x3f3/0x730 +[ 24.961541] ? crypto_shash_setkey+0x89/0xd0 +[ 24.961597] ? ieee80211_key_link+0x2d7/0x3a0 +[ 24.961664] ? crypto_aead_setauthsize+0x31/0x50 +[ 24.961730] ? sta_info_hash_lookup+0xa6/0xf0 +[ 24.961785] ? ieee80211_add_key+0x1fc/0x250 +[ 24.961842] ? rdev_add_key+0x41/0x140 +[ 24.961882] ? nl80211_parse_key+0x6c/0x2f0 +[ 24.961940] ? nl80211_new_key+0x24a/0x290 +[ 24.961984] ? genl_rcv_msg+0x36c/0x3a0 +[ 24.962036] ? rdev_mod_link_station+0xe0/0xe0 +[ 24.962102] ? nl80211_set_key+0x410/0x410 +[ 24.962143] ? nl80211_pre_doit+0x200/0x200 +[ 24.962187] ? genl_bind+0xc0/0xc0 +[ 24.962217] ? netlink_rcv_skb+0xaa/0xd0 +[ 24.962259] ? genl_rcv+0x24/0x40 +[ 24.962300] ? netlink_unicast+0x224/0x2f0 +[ 24.962345] ? netlink_sendmsg+0x30b/0x3d0 +[ 24.962388] ? ____sys_sendmsg+0x109/0x1b0 +[ 24.962388] ? ____sys_sendmsg+0x109/0x1b0 +[ 24.962440] ? __import_iovec+0x2e/0x110 +[ 24.962482] ? ___sys_sendmsg+0xbe/0xe0 +[ 24.962525] ? mod_objcg_state+0x25c/0x330 +[ 24.962576] ? __dentry_kill+0x19e/0x1d0 +[ 24.962618] ? call_rcu+0x18f/0x270 +[ 24.962660] ? __dentry_kill+0x19e/0x1d0 +[ 24.962702] ? __x64_sys_sendmsg+0x70/0x90 +[ 24.962744] ? do_syscall_64+0x3d/0x80 +[ 24.962796] ? exit_to_user_mode_prepare+0x1b/0x70 +[ 24.962852] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 +[ 24.962913] +[ 24.962939] Modules linked in: +[ 24.962981] CR2: ffff88800c223200 +[ 24.963022] ---[ end trace 0000000000000000 ]--- +[ 24.963087] RIP: 0010:0xffff88800c223200 +[ 24.963323] RSP: 0018:ffffc90000ff7698 EFLAGS: 00010282 +[ 24.963376] RAX: ffff888028397010 RBX: ffff88800c26e630 RCX: 0000000000000058 +[ 24.963458] RDX: ffff88800c26f844 RSI: 0000000000000006 RDI: ffff888028397010 +[ 24.963538] RBP: ffff88800ea72f00 R08: 18b873fbab2b964c R09: be06b38235f3c63c +[ 24.963622] R10: 18b873fbab2b964c R11: be06b38235f3c63c R12: 0000000000000001 +[ 24.963705] R13: ffff88800c26f84c R14: ffff8880063f0ff8 R15: ffff88800c26e644 +[ 24.963788] FS: 00007effcea327c0(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 +[ 24.963871] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 24.963941] CR2: ffff88800c223200 CR3: 000000000eaa2000 CR4: 00000000000006b0 +[ 24.964018] note: wpa_supplicant[391] exited with irqs disabled + +Fixes: d1369e515efe ("wifi: mt76: connac: introduce mt76_connac_mcu_sta_wed_update utility routine") +Signed-off-by: Lorenzo Bianconi +Acked-by: Felix Fietkau +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/c42168429453474213fa8244bf4b069de4531f40.1678124335.git.lorenzo@kernel.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c +index 5a047e63..d106cbfc 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c +@@ -1221,6 +1221,9 @@ EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_ba_tlv); + + int mt76_connac_mcu_sta_wed_update(struct mt76_dev *dev, struct sk_buff *skb) + { ++ if (!mt76_is_mmio(dev)) ++ return 0; ++ + if (!mtk_wed_device_active(&dev->mmio.wed)) + return 0; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-019-efi-earlycon-Reprobe-after-parsing-config-table.patch b/patches.kernel.org/6.2.9-019-efi-earlycon-Reprobe-after-parsing-config-table.patch new file mode 100644 index 0000000..c982d82 --- /dev/null +++ b/patches.kernel.org/6.2.9-019-efi-earlycon-Reprobe-after-parsing-config-table.patch @@ -0,0 +1,105 @@ +From: Ard Biesheuvel +Date: Sun, 12 Mar 2023 23:00:03 +0100 +Subject: [PATCH] efi: earlycon: Reprobe after parsing config tables +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 8b3a149db461d3286d1e211112de3b44ccaeaf71 + +[ Upstream commit 8b3a149db461d3286d1e211112de3b44ccaeaf71 ] + +Commit 732ea9db9d8a ("efi: libstub: Move screen_info handling to common +code") reorganized the earlycon handling so that all architectures pass +the screen_info data via a EFI config table instead of populating struct +screen_info directly, as the latter is only possible when the EFI stub +is baked into the kernel (and not into the decompressor). + +However, this means that struct screen_info may not have been populated +yet by the time the earlycon probe takes place, and this results in a +non-functional early console. + +So let's probe again right after parsing the config tables and +populating struct screen_info. Note that this means that earlycon output +starts a bit later than before, and so it may fail to capture issues +that occur while doing the early EFI initialization. + +Fixes: 732ea9db9d8a ("efi: libstub: Move screen_info handling to common code") +Reported-by: Shawn Guo +Tested-by: Shawn Guo +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/firmware/efi/earlycon.c | 16 +++++++++++++--- + drivers/firmware/efi/efi-init.c | 3 +++ + include/linux/efi.h | 1 + + 3 files changed, 17 insertions(+), 3 deletions(-) + +diff --git a/drivers/firmware/efi/earlycon.c b/drivers/firmware/efi/earlycon.c +index 4d6c5327..1bc63286 100644 +--- a/drivers/firmware/efi/earlycon.c ++++ b/drivers/firmware/efi/earlycon.c +@@ -204,6 +204,14 @@ efi_earlycon_write(struct console *con, const char *str, unsigned int num) + } + } + ++static bool __initdata fb_probed; ++ ++void __init efi_earlycon_reprobe(void) ++{ ++ if (fb_probed) ++ setup_earlycon("efifb"); ++} ++ + static int __init efi_earlycon_setup(struct earlycon_device *device, + const char *opt) + { +@@ -211,15 +219,17 @@ static int __init efi_earlycon_setup(struct earlycon_device *device, + u16 xres, yres; + u32 i; + +- if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI) ++ fb_wb = opt && !strcmp(opt, "ram"); ++ ++ if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI) { ++ fb_probed = true; + return -ENODEV; ++ } + + fb_base = screen_info.lfb_base; + if (screen_info.capabilities & VIDEO_CAPABILITY_64BIT_BASE) + fb_base |= (u64)screen_info.ext_lfb_base << 32; + +- fb_wb = opt && !strcmp(opt, "ram"); +- + si = &screen_info; + xres = si->lfb_width; + yres = si->lfb_height; +diff --git a/drivers/firmware/efi/efi-init.c b/drivers/firmware/efi/efi-init.c +index 16391594..5cb7fb45 100644 +--- a/drivers/firmware/efi/efi-init.c ++++ b/drivers/firmware/efi/efi-init.c +@@ -72,6 +72,9 @@ static void __init init_screen_info(void) + if (memblock_is_map_memory(screen_info.lfb_base)) + memblock_mark_nomap(screen_info.lfb_base, + screen_info.lfb_size); ++ ++ if (IS_ENABLED(CONFIG_EFI_EARLYCON)) ++ efi_earlycon_reprobe(); + } + } + +diff --git a/include/linux/efi.h b/include/linux/efi.h +index 98598bd1..ac22f7ca 100644 +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -688,6 +688,7 @@ efi_guid_to_str(efi_guid_t *guid, char *out) + } + + extern void efi_init (void); ++extern void efi_earlycon_reprobe(void); + #ifdef CONFIG_EFI + extern void efi_enter_virtual_mode (void); /* switch EFI to virtual mode, if possible */ + #else +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-020-arm64-dts-imx8dxl-evk-Disable-hibernation-mode-.patch b/patches.kernel.org/6.2.9-020-arm64-dts-imx8dxl-evk-Disable-hibernation-mode-.patch new file mode 100644 index 0000000..6c61812 --- /dev/null +++ b/patches.kernel.org/6.2.9-020-arm64-dts-imx8dxl-evk-Disable-hibernation-mode-.patch @@ -0,0 +1,75 @@ +From: Wei Fang +Date: Fri, 16 Dec 2022 09:14:34 +0800 +Subject: [PATCH] arm64: dts: imx8dxl-evk: Disable hibernation mode of AR8031 + for EQOS +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 0deefb5bd1382aae0aed7c8b266d5088a5308a26 + +[ Upstream commit 0deefb5bd1382aae0aed7c8b266d5088a5308a26 ] + +The hibernation mode of AR8031 PHY defaults to be enabled after hardware +reset. When the cable is unplugged, the PHY will enter hibernation mode +after about 10 senconds and the PHY clocks will be stopped to save +power. However, due to the design of EQOS, the mac needs the RX_CLK of +PHY for software reset to complete. Otherwise the software reset of EQOS +will be failed and do not work correctly. The only way is to disable +hibernation mode of AR8031 PHY for EQOS, the "qca,disable-hibernation-mode" +property is used for this purpose and has already been submitted to the +upstream, for more details please refer to the below link: +https://lore.kernel.org/netdev/20220818030054.1010660-2-wei.fang@nxp.com/ + +This issue is easy to reproduce, just unplug the cable and "ifconfig eth0 +down", after about 10 senconds, then "ifconfig eth0 up", you will see +failure log on the serial port. The log is shown as following: +root@imx8dxlevk:~# +[34.941970] imx-dwmac 5b050000.ethernet eth0: Link is Down +root@imx8dxlevk:~# ifconfig eth0 down +[35.437814] imx-dwmac 5b050000.ethernet eth0: FPE workqueue stop +[35.507913] imx-dwmac 5b050000.ethernet eth0: PHY [stmmac-1:00] driver [Qualcomm Atheros AR8031/AR8033] (irq=POLL) +[35.518613] imx-dwmac 5b050000.ethernet eth0: configuring for phy/rgmii-id link mode +root@imx8dxlevk:~# ifconfig eth0 up +[71.143044] imx-dwmac 5b050000.ethernet eth0: Register MEM_TYPE_PAGE_POOL RxQ-0 +[71.215855] imx-dwmac 5b050000.ethernet eth0: PHY [stmmac-1:00] driver [Qualcomm Atheros AR8031/AR8033] (irq=POLL) +[72.230417] imx-dwmac 5b050000.ethernet: Failed to reset the dma +[72.236512] imx-dwmac 5b050000.ethernet eth0: stmmac_hw_setup: DMA engine initialization failed +[72.245258] imx-dwmac 5b050000.ethernet eth0: __stmmac_open: Hw setup failed +SIOCSIFFLAGS: Connection timed out + +After applying this patch, the software reset of EQOS will be +successful. And the log is shown as below. +root@imx8dxlevk:~# ifconfig eth0 up +[96.114344] imx-dwmac 5b050000.ethernet eth0: Register MEM_TYPE_PAGE_POOL RxQ-0 +[96.171466] imx-dwmac 5b050000.ethernet eth0: PHY [stmmac-1:00] driver [Qualcomm Atheros AR8031/AR8033] (irq=POLL) +[96.188883] imx-dwmac 5b050000.ethernet eth0: No Safety Features support found +[96.196221] imx-dwmac 5b050000.ethernet eth0: IEEE 1588-2008 Advanced Timestamp supported +[96.204846] imx-dwmac 5b050000.ethernet eth0: registered PTP clock +[96.225558] imx-dwmac 5b050000.ethernet eth0: FPE workqueue start +[96.236858] imx-dwmac 5b050000.ethernet eth0: configuring for phy/rgmii-id link mode +[96.249358] 8021q: adding VLAN 0 to HW filter on device eth0 + +Signed-off-by: Wei Fang +Reviewed-by: Clark Wang +Signed-off-by: Shawn Guo +Stable-dep-of: feafeb53140a ("arm64: dts: imx8dxl-evk: Fix eqos phy reset gpio") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/freescale/imx8dxl-evk.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8dxl-evk.dts b/arch/arm64/boot/dts/freescale/imx8dxl-evk.dts +index 280a9c9d..1bcf228a 100644 +--- a/arch/arm64/boot/dts/freescale/imx8dxl-evk.dts ++++ b/arch/arm64/boot/dts/freescale/imx8dxl-evk.dts +@@ -135,6 +135,7 @@ ethphy0: ethernet-phy@0 { + reg = <0>; + eee-broken-1000t; + qca,disable-smarteee; ++ qca,disable-hibernation-mode; + vddio-supply = <&vddio0>; + + vddio0: vddio-regulator { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-021-arm64-dts-imx8dxl-evk-Fix-eqos-phy-reset-gpio.patch b/patches.kernel.org/6.2.9-021-arm64-dts-imx8dxl-evk-Fix-eqos-phy-reset-gpio.patch new file mode 100644 index 0000000..3483c96 --- /dev/null +++ b/patches.kernel.org/6.2.9-021-arm64-dts-imx8dxl-evk-Fix-eqos-phy-reset-gpio.patch @@ -0,0 +1,57 @@ +From: Andrew Halaney +Date: Tue, 14 Feb 2023 11:15:05 -0600 +Subject: [PATCH] arm64: dts: imx8dxl-evk: Fix eqos phy reset gpio +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: feafeb53140af3cde3fba46b292b15b3a0c0635c + +[ Upstream commit feafeb53140af3cde3fba46b292b15b3a0c0635c ] + +The deprecated property is named snps,reset-gpio, but this devicetree +used snps,reset-gpios instead which results in the reset not being used +and the following make dtbs_check error: + + ./arch/arm64/boot/dts/freescale/imx8dxl-evk.dtb: ethernet@5b050000: 'snps,reset-gpio' is a dependency of 'snps,reset-delays-us' + From schema: ./Documentation/devicetree/bindings/net/snps,dwmac.yaml + +Use the preferred method of defining the reset gpio in the phy node +itself. Note that this drops the 10 us pre-delay, but prior this wasn't +used at all and a pre-delay doesn't make much sense in this context so +it should be fine. + +Fixes: 8dd495d12374 ("arm64: dts: freescale: add support for i.MX8DXL EVK board") +Signed-off-by: Andrew Halaney +Acked-by: Krzysztof Kozlowski +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/freescale/imx8dxl-evk.dts | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8dxl-evk.dts b/arch/arm64/boot/dts/freescale/imx8dxl-evk.dts +index 1bcf228a..85242034 100644 +--- a/arch/arm64/boot/dts/freescale/imx8dxl-evk.dts ++++ b/arch/arm64/boot/dts/freescale/imx8dxl-evk.dts +@@ -121,8 +121,6 @@ &eqos { + phy-handle = <ðphy0>; + nvmem-cells = <&fec_mac1>; + nvmem-cell-names = "mac-address"; +- snps,reset-gpios = <&pca6416_1 2 GPIO_ACTIVE_LOW>; +- snps,reset-delays-us = <10 20 200000>; + status = "okay"; + + mdio { +@@ -136,6 +134,9 @@ ethphy0: ethernet-phy@0 { + eee-broken-1000t; + qca,disable-smarteee; + qca,disable-hibernation-mode; ++ reset-gpios = <&pca6416_1 2 GPIO_ACTIVE_LOW>; ++ reset-assert-us = <20>; ++ reset-deassert-us = <200000>; + vddio-supply = <&vddio0>; + + vddio0: vddio-regulator { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-022-ARM-dts-imx6sll-e70k02-fix-usbotg1-pinctrl.patch b/patches.kernel.org/6.2.9-022-ARM-dts-imx6sll-e70k02-fix-usbotg1-pinctrl.patch new file mode 100644 index 0000000..0e7a971 --- /dev/null +++ b/patches.kernel.org/6.2.9-022-ARM-dts-imx6sll-e70k02-fix-usbotg1-pinctrl.patch @@ -0,0 +1,35 @@ +From: Peng Fan +Date: Sun, 26 Feb 2023 21:12:12 +0800 +Subject: [PATCH] ARM: dts: imx6sll: e70k02: fix usbotg1 pinctrl +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 3d37f7685d525e58674c23d607020e66d501dcd1 + +[ Upstream commit 3d37f7685d525e58674c23d607020e66d501dcd1 ] + +usb@2184000: 'pinctrl-0' is a dependency of 'pinctrl-names' + +Signed-off-by: Peng Fan +Fixes: 3bb3fd856505 ("ARM: dts: add Netronix E70K02 board common file") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm/boot/dts/e70k02.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/e70k02.dtsi b/arch/arm/boot/dts/e70k02.dtsi +index 27ef9a62..a1f9fbd6 100644 +--- a/arch/arm/boot/dts/e70k02.dtsi ++++ b/arch/arm/boot/dts/e70k02.dtsi +@@ -312,6 +312,7 @@ &usdhc3 { + + &usbotg1 { + pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_usbotg1>; + disable-over-current; + srp-disable; + hnp-disable; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-023-ARM-dts-imx6sll-e60k02-fix-usbotg1-pinctrl.patch b/patches.kernel.org/6.2.9-023-ARM-dts-imx6sll-e60k02-fix-usbotg1-pinctrl.patch new file mode 100644 index 0000000..f0d4035 --- /dev/null +++ b/patches.kernel.org/6.2.9-023-ARM-dts-imx6sll-e60k02-fix-usbotg1-pinctrl.patch @@ -0,0 +1,35 @@ +From: Peng Fan +Date: Sun, 26 Feb 2023 21:12:13 +0800 +Subject: [PATCH] ARM: dts: imx6sll: e60k02: fix usbotg1 pinctrl +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 957c04e9784c7c757e8cc293d7fb2a60cdf461b6 + +[ Upstream commit 957c04e9784c7c757e8cc293d7fb2a60cdf461b6 ] + +usb@2184000: 'pinctrl-0' is a dependency of 'pinctrl-names' + +Signed-off-by: Peng Fan +Fixes: c100ea86e6ab ("ARM: dts: add Netronix E60K02 board common file") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm/boot/dts/e60k02.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/e60k02.dtsi b/arch/arm/boot/dts/e60k02.dtsi +index 94944cc2..dd03e386 100644 +--- a/arch/arm/boot/dts/e60k02.dtsi ++++ b/arch/arm/boot/dts/e60k02.dtsi +@@ -311,6 +311,7 @@ &usdhc3 { + + &usbotg1 { + pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_usbotg1>; + disable-over-current; + srp-disable; + hnp-disable; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-024-ARM-dts-imx6sl-tolino-shine2hd-fix-usbotg1-pinc.patch b/patches.kernel.org/6.2.9-024-ARM-dts-imx6sl-tolino-shine2hd-fix-usbotg1-pinc.patch new file mode 100644 index 0000000..7d2fe7f --- /dev/null +++ b/patches.kernel.org/6.2.9-024-ARM-dts-imx6sl-tolino-shine2hd-fix-usbotg1-pinc.patch @@ -0,0 +1,35 @@ +From: Peng Fan +Date: Sun, 26 Feb 2023 21:12:14 +0800 +Subject: [PATCH] ARM: dts: imx6sl: tolino-shine2hd: fix usbotg1 pinctrl +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 1cd489e1ada1cffa56bd06fd4609f5a60a985d43 + +[ Upstream commit 1cd489e1ada1cffa56bd06fd4609f5a60a985d43 ] + +usb@2184000: 'pinctrl-0' is a dependency of 'pinctrl-names' + +Signed-off-by: Peng Fan +Fixes: 9c7016f1ca6d ("ARM: dts: imx: add devicetree for Tolino Shine 2 HD") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm/boot/dts/imx6sl-tolino-shine2hd.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/imx6sl-tolino-shine2hd.dts b/arch/arm/boot/dts/imx6sl-tolino-shine2hd.dts +index da139905..815119c1 100644 +--- a/arch/arm/boot/dts/imx6sl-tolino-shine2hd.dts ++++ b/arch/arm/boot/dts/imx6sl-tolino-shine2hd.dts +@@ -625,6 +625,7 @@ &usdhc3 { + + &usbotg1 { + pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_usbotg1>; + disable-over-current; + srp-disable; + hnp-disable; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-025-arm64-dts-imx8mn-specify-sound-dai-cells-for-SA.patch b/patches.kernel.org/6.2.9-025-arm64-dts-imx8mn-specify-sound-dai-cells-for-SA.patch new file mode 100644 index 0000000..726e44b --- /dev/null +++ b/patches.kernel.org/6.2.9-025-arm64-dts-imx8mn-specify-sound-dai-cells-for-SA.patch @@ -0,0 +1,70 @@ +From: Marek Vasut +Date: Tue, 28 Feb 2023 22:52:44 +0100 +Subject: [PATCH] arm64: dts: imx8mn: specify #sound-dai-cells for SAI nodes +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 62fb54148cd6eb456ff031be8fb447c98cf0bd9b + +[ Upstream commit 62fb54148cd6eb456ff031be8fb447c98cf0bd9b ] + +Add #sound-dai-cells properties to SAI nodes. + +Reviewed-by: Adam Ford +Reviewed-by: Fabio Estevam +Fixes: 9e9860069725 ("arm64: dts: imx8mn: Add SAI nodes") +Signed-off-by: Marek Vasut +Reviewed-by: Marco Felsch +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/freescale/imx8mn.dtsi | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +index 7601a031..b3120b49 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +@@ -296,6 +296,7 @@ spba2: spba-bus@30000000 { + sai2: sai@30020000 { + compatible = "fsl,imx8mn-sai", "fsl,imx8mq-sai"; + reg = <0x30020000 0x10000>; ++ #sound-dai-cells = <0>; + interrupts = ; + clocks = <&clk IMX8MN_CLK_SAI2_IPG>, + <&clk IMX8MN_CLK_DUMMY>, +@@ -310,6 +311,7 @@ sai2: sai@30020000 { + sai3: sai@30030000 { + compatible = "fsl,imx8mn-sai", "fsl,imx8mq-sai"; + reg = <0x30030000 0x10000>; ++ #sound-dai-cells = <0>; + interrupts = ; + clocks = <&clk IMX8MN_CLK_SAI3_IPG>, + <&clk IMX8MN_CLK_DUMMY>, +@@ -324,6 +326,7 @@ sai3: sai@30030000 { + sai5: sai@30050000 { + compatible = "fsl,imx8mn-sai", "fsl,imx8mq-sai"; + reg = <0x30050000 0x10000>; ++ #sound-dai-cells = <0>; + interrupts = ; + clocks = <&clk IMX8MN_CLK_SAI5_IPG>, + <&clk IMX8MN_CLK_DUMMY>, +@@ -340,6 +343,7 @@ sai5: sai@30050000 { + sai6: sai@30060000 { + compatible = "fsl,imx8mn-sai", "fsl,imx8mq-sai"; + reg = <0x30060000 0x10000>; ++ #sound-dai-cells = <0>; + interrupts = ; + clocks = <&clk IMX8MN_CLK_SAI6_IPG>, + <&clk IMX8MN_CLK_DUMMY>, +@@ -397,6 +401,7 @@ spdif1: spdif@30090000 { + sai7: sai@300b0000 { + compatible = "fsl,imx8mn-sai", "fsl,imx8mq-sai"; + reg = <0x300b0000 0x10000>; ++ #sound-dai-cells = <0>; + interrupts = ; + clocks = <&clk IMX8MN_CLK_SAI7_IPG>, + <&clk IMX8MN_CLK_DUMMY>, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-026-arm64-dts-imx93-add-missing-address-cells-and-s.patch b/patches.kernel.org/6.2.9-026-arm64-dts-imx93-add-missing-address-cells-and-s.patch new file mode 100644 index 0000000..3fb5566 --- /dev/null +++ b/patches.kernel.org/6.2.9-026-arm64-dts-imx93-add-missing-address-cells-and-s.patch @@ -0,0 +1,100 @@ +From: Alexander Stein +Date: Wed, 8 Mar 2023 11:17:20 +0100 +Subject: [PATCH] arm64: dts: imx93: add missing #address-cells and #size-cells + to i2c nodes +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: b3cdf730486b048ca0bf23bef050550d9fd40422 + +[ Upstream commit b3cdf730486b048ca0bf23bef050550d9fd40422 ] + +Add them to the SoC .dtsi, so that not every board has to specify them. + +Fixes: 1225396fefea ("arm64: dts: imx93: add lpi2c nodes") +Signed-off-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/freescale/imx93.dtsi | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx93.dtsi b/arch/arm64/boot/dts/freescale/imx93.dtsi +index 5d79663b..d1b34d9d 100644 +--- a/arch/arm64/boot/dts/freescale/imx93.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx93.dtsi +@@ -164,6 +164,8 @@ tpm2: pwm@44320000 { + lpi2c1: i2c@44340000 { + compatible = "fsl,imx93-lpi2c", "fsl,imx7ulp-lpi2c"; + reg = <0x44340000 0x10000>; ++ #address-cells = <1>; ++ #size-cells = <0>; + interrupts = ; + clocks = <&clk IMX93_CLK_LPI2C1_GATE>, + <&clk IMX93_CLK_BUS_AON>; +@@ -174,6 +176,8 @@ lpi2c1: i2c@44340000 { + lpi2c2: i2c@44350000 { + compatible = "fsl,imx93-lpi2c", "fsl,imx7ulp-lpi2c"; + reg = <0x44350000 0x10000>; ++ #address-cells = <1>; ++ #size-cells = <0>; + interrupts = ; + clocks = <&clk IMX93_CLK_LPI2C2_GATE>, + <&clk IMX93_CLK_BUS_AON>; +@@ -316,6 +320,8 @@ tpm6: pwm@42510000 { + lpi2c3: i2c@42530000 { + compatible = "fsl,imx93-lpi2c", "fsl,imx7ulp-lpi2c"; + reg = <0x42530000 0x10000>; ++ #address-cells = <1>; ++ #size-cells = <0>; + interrupts = ; + clocks = <&clk IMX93_CLK_LPI2C3_GATE>, + <&clk IMX93_CLK_BUS_WAKEUP>; +@@ -326,6 +332,8 @@ lpi2c3: i2c@42530000 { + lpi2c4: i2c@42540000 { + compatible = "fsl,imx93-lpi2c", "fsl,imx7ulp-lpi2c"; + reg = <0x42540000 0x10000>; ++ #address-cells = <1>; ++ #size-cells = <0>; + interrupts = ; + clocks = <&clk IMX93_CLK_LPI2C4_GATE>, + <&clk IMX93_CLK_BUS_WAKEUP>; +@@ -414,6 +422,8 @@ lpuart8: serial@426a0000 { + lpi2c5: i2c@426b0000 { + compatible = "fsl,imx93-lpi2c", "fsl,imx7ulp-lpi2c"; + reg = <0x426b0000 0x10000>; ++ #address-cells = <1>; ++ #size-cells = <0>; + interrupts = ; + clocks = <&clk IMX93_CLK_LPI2C5_GATE>, + <&clk IMX93_CLK_BUS_WAKEUP>; +@@ -424,6 +434,8 @@ lpi2c5: i2c@426b0000 { + lpi2c6: i2c@426c0000 { + compatible = "fsl,imx93-lpi2c", "fsl,imx7ulp-lpi2c"; + reg = <0x426c0000 0x10000>; ++ #address-cells = <1>; ++ #size-cells = <0>; + interrupts = ; + clocks = <&clk IMX93_CLK_LPI2C6_GATE>, + <&clk IMX93_CLK_BUS_WAKEUP>; +@@ -434,6 +446,8 @@ lpi2c6: i2c@426c0000 { + lpi2c7: i2c@426d0000 { + compatible = "fsl,imx93-lpi2c", "fsl,imx7ulp-lpi2c"; + reg = <0x426d0000 0x10000>; ++ #address-cells = <1>; ++ #size-cells = <0>; + interrupts = ; + clocks = <&clk IMX93_CLK_LPI2C7_GATE>, + <&clk IMX93_CLK_BUS_WAKEUP>; +@@ -444,6 +458,8 @@ lpi2c7: i2c@426d0000 { + lpi2c8: i2c@426e0000 { + compatible = "fsl,imx93-lpi2c", "fsl,imx7ulp-lpi2c"; + reg = <0x426e0000 0x10000>; ++ #address-cells = <1>; ++ #size-cells = <0>; + interrupts = ; + clocks = <&clk IMX93_CLK_LPI2C8_GATE>, + <&clk IMX93_CLK_BUS_WAKEUP>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-027-NFS-Fix-proc-PID-io-read_bytes-for-buffered-rea.patch b/patches.kernel.org/6.2.9-027-NFS-Fix-proc-PID-io-read_bytes-for-buffered-rea.patch new file mode 100644 index 0000000..08aa13e --- /dev/null +++ b/patches.kernel.org/6.2.9-027-NFS-Fix-proc-PID-io-read_bytes-for-buffered-rea.patch @@ -0,0 +1,59 @@ +From: Dave Wysochanski +Date: Thu, 9 Mar 2023 13:58:52 -0500 +Subject: [PATCH] NFS: Fix /proc/PID/io read_bytes for buffered reads +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 9c88ea00fef03031ce6554531e89be82f6a42835 + +[ Upstream commit 9c88ea00fef03031ce6554531e89be82f6a42835 ] + +Prior to commit 8786fde8421c ("Convert NFS from readpages to +readahead"), nfs_readpages() used the old mm interface read_cache_pages() +which called task_io_account_read() for each NFS page read. After +this commit, nfs_readpages() is converted to nfs_readahead(), which +now uses the new mm interface readahead_page(). The new interface +requires callers to call task_io_account_read() themselves. +In addition, to nfs_readahead() task_io_account_read() should also +be called from nfs_read_folio(). + +Fixes: 8786fde8421c ("Convert NFS from readpages to readahead") +Link: https://lore.kernel.org/linux-nfs/CAPt2mGNEYUk5u8V4abe=5MM5msZqmvzCVrtCP4Qw1n=gCHCnww@mail.gmail.com/ +Signed-off-by: Dave Wysochanski +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/nfs/read.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/nfs/read.c b/fs/nfs/read.c +index 8ae2c8d1..cd970ce6 100644 +--- a/fs/nfs/read.c ++++ b/fs/nfs/read.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -338,6 +339,7 @@ int nfs_read_folio(struct file *file, struct folio *folio) + + trace_nfs_aop_readpage(inode, page); + nfs_inc_stats(inode, NFSIOS_VFSREADPAGE); ++ task_io_account_read(folio_size(folio)); + + /* + * Try to flush any pending writes to the file.. +@@ -400,6 +402,7 @@ void nfs_readahead(struct readahead_control *ractl) + + trace_nfs_aop_readahead(inode, readahead_pos(ractl), nr_pages); + nfs_inc_stats(inode, NFSIOS_VFSREADPAGES); ++ task_io_account_read(readahead_length(ractl)); + + ret = -ESTALE; + if (NFS_STALE(inode)) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-028-NFS-Correct-timing-for-assigning-access-cache-t.patch b/patches.kernel.org/6.2.9-028-NFS-Correct-timing-for-assigning-access-cache-t.patch new file mode 100644 index 0000000..1798154 --- /dev/null +++ b/patches.kernel.org/6.2.9-028-NFS-Correct-timing-for-assigning-access-cache-t.patch @@ -0,0 +1,52 @@ +From: Chengen Du +Date: Wed, 8 Mar 2023 16:03:27 +0800 +Subject: [PATCH] NFS: Correct timing for assigning access cache timestamp +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 21fd9e8700de86d1169f6336e97d7a74916ed04a + +[ Upstream commit 21fd9e8700de86d1169f6336e97d7a74916ed04a ] + +When the user's login time is newer than the cache's timestamp, +the original entry in the RB-tree will be replaced by a new entry. +Currently, the timestamp is only set if the entry is not found in +the RB-tree, which can cause the timestamp to be undefined when +the entry exists. This may result in a significant increase in +ACCESS operations if the timestamp is set to zero. + +Signed-off-by: Chengen Du +Fixes: 0eb43812c027 ("NFS: Clear the file access cache upon login”) +Reviewed-by: Benjamin Coddington +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/nfs/dir.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c +index f7e4a88d..e28dd647 100644 +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -3089,7 +3089,6 @@ static void nfs_access_add_rbtree(struct inode *inode, + else + goto found; + } +- set->timestamp = ktime_get_ns(); + rb_link_node(&set->rb_node, parent, p); + rb_insert_color(&set->rb_node, root_node); + list_add_tail(&set->lru, &nfsi->access_cache_entry_lru); +@@ -3114,6 +3113,7 @@ void nfs_access_add_cache(struct inode *inode, struct nfs_access_entry *set, + cache->fsgid = cred->fsgid; + cache->group_info = get_group_info(cred->group_info); + cache->mask = set->mask; ++ cache->timestamp = ktime_get_ns(); + + /* The above field assignments must be visible + * before this item appears on the lru. We cannot easily +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-029-xsk-Add-missing-overflow-check-in-xdp_umem_reg.patch b/patches.kernel.org/6.2.9-029-xsk-Add-missing-overflow-check-in-xdp_umem_reg.patch new file mode 100644 index 0000000..9e5492c --- /dev/null +++ b/patches.kernel.org/6.2.9-029-xsk-Add-missing-overflow-check-in-xdp_umem_reg.patch @@ -0,0 +1,65 @@ +From: Kal Conley +Date: Wed, 8 Mar 2023 18:40:13 +0100 +Subject: [PATCH] xsk: Add missing overflow check in xdp_umem_reg +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: c7df4813b149362248d6ef7be41a311e27bf75fe + +[ Upstream commit c7df4813b149362248d6ef7be41a311e27bf75fe ] + +The number of chunks can overflow u32. Make sure to return -EINVAL on +overflow. Also remove a redundant u32 cast assigning umem->npgs. + +Fixes: bbff2f321a86 ("xsk: new descriptor addressing scheme") +Signed-off-by: Kal Conley +Signed-off-by: Daniel Borkmann +Acked-by: Magnus Karlsson +Link: https://lore.kernel.org/bpf/20230308174013.1114745-1-kal.conley@dectris.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/xdp/xdp_umem.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c +index 4681e8e8..02207e85 100644 +--- a/net/xdp/xdp_umem.c ++++ b/net/xdp/xdp_umem.c +@@ -150,10 +150,11 @@ static int xdp_umem_account_pages(struct xdp_umem *umem) + + static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr) + { +- u32 npgs_rem, chunk_size = mr->chunk_size, headroom = mr->headroom; + bool unaligned_chunks = mr->flags & XDP_UMEM_UNALIGNED_CHUNK_FLAG; +- u64 npgs, addr = mr->addr, size = mr->len; +- unsigned int chunks, chunks_rem; ++ u32 chunk_size = mr->chunk_size, headroom = mr->headroom; ++ u64 addr = mr->addr, size = mr->len; ++ u32 chunks_rem, npgs_rem; ++ u64 chunks, npgs; + int err; + + if (chunk_size < XDP_UMEM_MIN_CHUNK_SIZE || chunk_size > PAGE_SIZE) { +@@ -188,8 +189,8 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr) + if (npgs > U32_MAX) + return -EINVAL; + +- chunks = (unsigned int)div_u64_rem(size, chunk_size, &chunks_rem); +- if (chunks == 0) ++ chunks = div_u64_rem(size, chunk_size, &chunks_rem); ++ if (!chunks || chunks > U32_MAX) + return -EINVAL; + + if (!unaligned_chunks && chunks_rem) +@@ -202,7 +203,7 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr) + umem->headroom = headroom; + umem->chunk_size = chunk_size; + umem->chunks = chunks; +- umem->npgs = (u32)npgs; ++ umem->npgs = npgs; + umem->pgs = NULL; + umem->user = NULL; + umem->flags = mr->flags; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-030-iavf-fix-inverted-Rx-hash-condition-leading-to-.patch b/patches.kernel.org/6.2.9-030-iavf-fix-inverted-Rx-hash-condition-leading-to-.patch new file mode 100644 index 0000000..62e1672 --- /dev/null +++ b/patches.kernel.org/6.2.9-030-iavf-fix-inverted-Rx-hash-condition-leading-to-.patch @@ -0,0 +1,45 @@ +From: Alexander Lobakin +Date: Wed, 1 Mar 2023 12:59:07 +0100 +Subject: [PATCH] iavf: fix inverted Rx hash condition leading to disabled hash +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 32d57f667f871bc5a8babbe27ea4c5e668ee0ea8 + +[ Upstream commit 32d57f667f871bc5a8babbe27ea4c5e668ee0ea8 ] + +Condition, which checks whether the netdev has hashing enabled is +inverted. Basically, the tagged commit effectively disabled passing flow +hash from descriptor to skb, unless user *disables* it via Ethtool. +Commit a876c3ba59a6 ("i40e/i40evf: properly report Rx packet hash") +fixed this problem, but only for i40e. +Invert the condition now in iavf and unblock passing hash to skbs again. + +Fixes: 857942fd1aa1 ("i40e: Fix Rx hash reported to the stack by our driver") +Reviewed-by: Larysa Zaremba +Reviewed-by: Michal Kubiak +Signed-off-by: Alexander Lobakin +Tested-by: Rafal Romanowski +Reviewed-by: Leon Romanovsky +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/intel/iavf/iavf_txrx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_txrx.c b/drivers/net/ethernet/intel/iavf/iavf_txrx.c +index 18b6a702..e989feda 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_txrx.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_txrx.c +@@ -1096,7 +1096,7 @@ static inline void iavf_rx_hash(struct iavf_ring *ring, + cpu_to_le64((u64)IAVF_RX_DESC_FLTSTAT_RSS_HASH << + IAVF_RX_DESC_STATUS_FLTSTAT_SHIFT); + +- if (ring->netdev->features & NETIF_F_RXHASH) ++ if (!(ring->netdev->features & NETIF_F_RXHASH)) + return; + + if ((rx_desc->wb.qword1.status_error_len & rss_mask) == rss_mask) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-031-iavf-fix-non-tunneled-IPv6-UDP-packet-type-and-.patch b/patches.kernel.org/6.2.9-031-iavf-fix-non-tunneled-IPv6-UDP-packet-type-and-.patch new file mode 100644 index 0000000..16b3156 --- /dev/null +++ b/patches.kernel.org/6.2.9-031-iavf-fix-non-tunneled-IPv6-UDP-packet-type-and-.patch @@ -0,0 +1,49 @@ +From: Alexander Lobakin +Date: Wed, 1 Mar 2023 12:59:08 +0100 +Subject: [PATCH] iavf: fix non-tunneled IPv6 UDP packet type and hashing +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: de58647b4301fe181f9c38e8b46f7021584ae427 + +[ Upstream commit de58647b4301fe181f9c38e8b46f7021584ae427 ] + +Currently, IAVF's decode_rx_desc_ptype() correctly reports payload type +of L4 for IPv4 UDP packets and IPv{4,6} TCP, but only L3 for IPv6 UDP. +Originally, i40e, ice and iavf were affected. +Commit 73df8c9e3e3d ("i40e: Correct UDP packet header for non_tunnel-ipv6") +fixed that in i40e, then +commit 638a0c8c8861 ("ice: fix incorrect payload indicator on PTYPE") +fixed that for ice. +IPv6 UDP is L4 obviously. Fix it and make iavf report correct L4 hash +type for such packets, so that the stack won't calculate it on CPU when +needs it. + +Fixes: 206812b5fccb ("i40e/i40evf: i40e implementation for skb_set_hash") +Reviewed-by: Larysa Zaremba +Reviewed-by: Michal Kubiak +Signed-off-by: Alexander Lobakin +Tested-by: Rafal Romanowski +Reviewed-by: Leon Romanovsky +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/intel/iavf/iavf_common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_common.c b/drivers/net/ethernet/intel/iavf/iavf_common.c +index 34e46a23..43148c07 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_common.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_common.c +@@ -661,7 +661,7 @@ struct iavf_rx_ptype_decoded iavf_ptype_lookup[BIT(8)] = { + /* Non Tunneled IPv6 */ + IAVF_PTT(88, IP, IPV6, FRG, NONE, NONE, NOF, NONE, PAY3), + IAVF_PTT(89, IP, IPV6, NOF, NONE, NONE, NOF, NONE, PAY3), +- IAVF_PTT(90, IP, IPV6, NOF, NONE, NONE, NOF, UDP, PAY3), ++ IAVF_PTT(90, IP, IPV6, NOF, NONE, NONE, NOF, UDP, PAY4), + IAVF_PTT_UNUSED_ENTRY(91), + IAVF_PTT(92, IP, IPV6, NOF, NONE, NONE, NOF, TCP, PAY4), + IAVF_PTT(93, IP, IPV6, NOF, NONE, NONE, NOF, SCTP, PAY4), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-032-iavf-do-not-track-VLAN-0-filters.patch b/patches.kernel.org/6.2.9-032-iavf-do-not-track-VLAN-0-filters.patch new file mode 100644 index 0000000..fb76505 --- /dev/null +++ b/patches.kernel.org/6.2.9-032-iavf-do-not-track-VLAN-0-filters.patch @@ -0,0 +1,79 @@ +From: Ahmed Zaki +Date: Wed, 15 Mar 2023 13:59:25 -0600 +Subject: [PATCH] iavf: do not track VLAN 0 filters +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 964290ff32d132bf971d45b29f7de39756dab7c8 + +[ Upstream commit 964290ff32d132bf971d45b29f7de39756dab7c8 ] + +When an interface with the maximum number of VLAN filters is brought up, +a spurious error is logged: + + [257.483082] 8021q: adding VLAN 0 to HW filter on device enp0s3 + [257.483094] iavf 0000:00:03.0 enp0s3: Max allowed VLAN filters 8. Remove existing VLANs or disable filtering via Ethtool if supported. + +The VF driver complains that it cannot add the VLAN 0 filter. + +On the other hand, the PF driver always adds VLAN 0 filter on VF +initialization. The VF does not need to ask the PF for that filter at +all. + +Fix the error by not tracking VLAN 0 filters altogether. With that, the +check added by commit 0e710a3ffd0c ("iavf: Fix VF driver counting VLAN 0 +filters") in iavf_virtchnl.c is useless and might be confusing if left as +it suggests that we track VLAN 0. + +Fixes: 0e710a3ffd0c ("iavf: Fix VF driver counting VLAN 0 filters") +Signed-off-by: Ahmed Zaki +Reviewed-by: Michal Kubiak +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 8 ++++++++ + drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 2 -- + 2 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 4b09785d..01e73415 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -893,6 +893,10 @@ static int iavf_vlan_rx_add_vid(struct net_device *netdev, + { + struct iavf_adapter *adapter = netdev_priv(netdev); + ++ /* Do not track VLAN 0 filter, always added by the PF on VF init */ ++ if (!vid) ++ return 0; ++ + if (!VLAN_FILTERING_ALLOWED(adapter)) + return -EIO; + +@@ -919,6 +923,10 @@ static int iavf_vlan_rx_kill_vid(struct net_device *netdev, + { + struct iavf_adapter *adapter = netdev_priv(netdev); + ++ /* We do not track VLAN 0 filter */ ++ if (!vid) ++ return 0; ++ + iavf_del_vlan(adapter, IAVF_VLAN(vid, be16_to_cpu(proto))); + if (proto == cpu_to_be16(ETH_P_8021Q)) + clear_bit(vid, adapter->vsi.active_cvlans); +diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +index 365ca0c7..0fea6b9b 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +@@ -2446,8 +2446,6 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, + list_for_each_entry(f, &adapter->vlan_filter_list, list) { + if (f->is_new_vlan) { + f->is_new_vlan = false; +- if (!f->vlan.vid) +- continue; + if (f->vlan.tpid == ETH_P_8021Q) + set_bit(f->vlan.vid, + adapter->vsi.active_cvlans); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-033-intel-igbvf-free-irq-on-the-error-path-in-igbvf.patch b/patches.kernel.org/6.2.9-033-intel-igbvf-free-irq-on-the-error-path-in-igbvf.patch new file mode 100644 index 0000000..657e3ef --- /dev/null +++ b/patches.kernel.org/6.2.9-033-intel-igbvf-free-irq-on-the-error-path-in-igbvf.patch @@ -0,0 +1,56 @@ +From: Gaosheng Cui +Date: Tue, 22 Nov 2022 10:28:52 +0800 +Subject: [PATCH] intel/igbvf: free irq on the error path in + igbvf_request_msix() +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 85eb39bb39cbb5c086df1e19ba67cc1366693a77 + +[ Upstream commit 85eb39bb39cbb5c086df1e19ba67cc1366693a77 ] + +In igbvf_request_msix(), irqs have not been freed on the err path, +we need to free it. Fix it. + +Fixes: d4e0fe01a38a ("igbvf: add new driver to support 82576 virtual functions") +Signed-off-by: Gaosheng Cui +Reviewed-by: Maciej Fijalkowski +Tested-by: Marek Szlosek +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/intel/igbvf/netdev.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c +index 3a328095..72cb1b56 100644 +--- a/drivers/net/ethernet/intel/igbvf/netdev.c ++++ b/drivers/net/ethernet/intel/igbvf/netdev.c +@@ -1074,7 +1074,7 @@ static int igbvf_request_msix(struct igbvf_adapter *adapter) + igbvf_intr_msix_rx, 0, adapter->rx_ring->name, + netdev); + if (err) +- goto out; ++ goto free_irq_tx; + + adapter->rx_ring->itr_register = E1000_EITR(vector); + adapter->rx_ring->itr_val = adapter->current_itr; +@@ -1083,10 +1083,14 @@ static int igbvf_request_msix(struct igbvf_adapter *adapter) + err = request_irq(adapter->msix_entries[vector].vector, + igbvf_msix_other, 0, netdev->name, netdev); + if (err) +- goto out; ++ goto free_irq_rx; + + igbvf_configure_msix(adapter); + return 0; ++free_irq_rx: ++ free_irq(adapter->msix_entries[--vector].vector, netdev); ++free_irq_tx: ++ free_irq(adapter->msix_entries[--vector].vector, netdev); + out: + return err; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-034-igbvf-Regard-vf-reset-nack-as-success.patch b/patches.kernel.org/6.2.9-034-igbvf-Regard-vf-reset-nack-as-success.patch new file mode 100644 index 0000000..e7155e5 --- /dev/null +++ b/patches.kernel.org/6.2.9-034-igbvf-Regard-vf-reset-nack-as-success.patch @@ -0,0 +1,63 @@ +From: Akihiko Odaki +Date: Thu, 1 Dec 2022 19:20:03 +0900 +Subject: [PATCH] igbvf: Regard vf reset nack as success +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 02c83791ef969c6a8a150b4927193d0d0e50fb23 + +[ Upstream commit 02c83791ef969c6a8a150b4927193d0d0e50fb23 ] + +vf reset nack actually represents the reset operation itself is +performed but no address is assigned. Therefore, e1000_reset_hw_vf +should fill the "perm_addr" with the zero address and return success on +such an occasion. This prevents its callers in netdev.c from saying PF +still resetting, and instead allows them to correctly report that no +address is assigned. + +Fixes: 6ddbc4cf1f4d ("igb: Indicate failure on vf reset for empty mac address") +Signed-off-by: Akihiko Odaki +Reviewed-by: Leon Romanovsky +Tested-by: Marek Szlosek +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/intel/igbvf/vf.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igbvf/vf.c b/drivers/net/ethernet/intel/igbvf/vf.c +index b8ba3f94..a47a2e3e 100644 +--- a/drivers/net/ethernet/intel/igbvf/vf.c ++++ b/drivers/net/ethernet/intel/igbvf/vf.c +@@ -1,6 +1,8 @@ + // SPDX-License-Identifier: GPL-2.0 + /* Copyright(c) 2009 - 2018 Intel Corporation. */ + ++#include ++ + #include "vf.h" + + static s32 e1000_check_for_link_vf(struct e1000_hw *hw); +@@ -131,11 +133,16 @@ static s32 e1000_reset_hw_vf(struct e1000_hw *hw) + /* set our "perm_addr" based on info provided by PF */ + ret_val = mbx->ops.read_posted(hw, msgbuf, 3); + if (!ret_val) { +- if (msgbuf[0] == (E1000_VF_RESET | +- E1000_VT_MSGTYPE_ACK)) ++ switch (msgbuf[0]) { ++ case E1000_VF_RESET | E1000_VT_MSGTYPE_ACK: + memcpy(hw->mac.perm_addr, addr, ETH_ALEN); +- else ++ break; ++ case E1000_VF_RESET | E1000_VT_MSGTYPE_NACK: ++ eth_zero_addr(hw->mac.perm_addr); ++ break; ++ default: + ret_val = -E1000_ERR_MAC_INIT; ++ } + } + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-035-igc-fix-the-validation-logic-for-taprio-s-gate-.patch b/patches.kernel.org/6.2.9-035-igc-fix-the-validation-logic-for-taprio-s-gate-.patch new file mode 100644 index 0000000..19e4cb7 --- /dev/null +++ b/patches.kernel.org/6.2.9-035-igc-fix-the-validation-logic-for-taprio-s-gate-.patch @@ -0,0 +1,77 @@ +From: AKASHI Takahiro +Date: Tue, 7 Mar 2023 15:45:31 +0900 +Subject: [PATCH] igc: fix the validation logic for taprio's gate list +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 2b4cc3d3f4d8ec42961e98568a0afeee96a943ab + +[ Upstream commit 2b4cc3d3f4d8ec42961e98568a0afeee96a943ab ] + +The check introduced in the commit a5fd39464a40 ("igc: Lift TAPRIO schedule +restriction") can detect a false positive error in some corner case. +For instance, + tc qdisc replace ... taprio num_tc 4 + ... + sched-entry S 0x01 100000 # slot#1 + sched-entry S 0x03 100000 # slot#2 + sched-entry S 0x04 100000 # slot#3 + sched-entry S 0x08 200000 # slot#4 + flags 0x02 # hardware offload + +Here the queue#0 (the first queue) is on at the slot#1 and #2, +and off at the slot#3 and #4. Under the current logic, when the slot#4 +is examined, validate_schedule() returns *false* since the enablement +count for the queue#0 is two and it is already off at the previous slot +(i.e. #3). But this definition is truely correct. + +Let's fix the logic to enforce a strict validation for consecutively-opened +slots. + +Fixes: a5fd39464a40 ("igc: Lift TAPRIO schedule restriction") +Signed-off-by: AKASHI Takahiro +Reviewed-by: Kurt Kanzenbach +Acked-by: Vinicius Costa Gomes +Tested-by: Naama Meir +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/intel/igc/igc_main.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c +index 1dd2a7fe..bcd62b36 100644 +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -6007,18 +6007,18 @@ static bool validate_schedule(struct igc_adapter *adapter, + if (e->command != TC_TAPRIO_CMD_SET_GATES) + return false; + +- for (i = 0; i < adapter->num_tx_queues; i++) { +- if (e->gate_mask & BIT(i)) ++ for (i = 0; i < adapter->num_tx_queues; i++) ++ if (e->gate_mask & BIT(i)) { + queue_uses[i]++; + +- /* There are limitations: A single queue cannot be +- * opened and closed multiple times per cycle unless the +- * gate stays open. Check for it. +- */ +- if (queue_uses[i] > 1 && +- !(prev->gate_mask & BIT(i))) +- return false; +- } ++ /* There are limitations: A single queue cannot ++ * be opened and closed multiple times per cycle ++ * unless the gate stays open. Check for it. ++ */ ++ if (queue_uses[i] > 1 && ++ !(prev->gate_mask & BIT(i))) ++ return false; ++ } + } + + return true; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-036-i2c-imx-lpi2c-check-only-for-enabled-interrupt-.patch b/patches.kernel.org/6.2.9-036-i2c-imx-lpi2c-check-only-for-enabled-interrupt-.patch new file mode 100644 index 0000000..cf265f9 --- /dev/null +++ b/patches.kernel.org/6.2.9-036-i2c-imx-lpi2c-check-only-for-enabled-interrupt-.patch @@ -0,0 +1,48 @@ +From: Alexander Stein +Date: Mon, 30 Jan 2023 16:32:47 +0100 +Subject: [PATCH] i2c: imx-lpi2c: check only for enabled interrupt flags +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 1c7885004567e8951d65a983be095f254dd20bef + +[ Upstream commit 1c7885004567e8951d65a983be095f254dd20bef ] + +When reading from I2C, the Tx watermark is set to 0. Unfortunately the +TDF (transmit data flag) is enabled when Tx FIFO entries is equal or less +than watermark. So it is set in every case, hence the reset default of 1. +This results in the MSR_RDF _and_ MSR_TDF flags to be set thus trying +to send Tx data on a read message. +Mask the IRQ status to filter for wanted flags only. + +Fixes: a55fa9d0e42e ("i2c: imx-lpi2c: add low power i2c bus driver") +Signed-off-by: Alexander Stein +Tested-by: Emanuele Ghidoli +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/i2c/busses/i2c-imx-lpi2c.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-imx-lpi2c.c b/drivers/i2c/busses/i2c-imx-lpi2c.c +index 188f2a36..9b2f9544 100644 +--- a/drivers/i2c/busses/i2c-imx-lpi2c.c ++++ b/drivers/i2c/busses/i2c-imx-lpi2c.c +@@ -503,10 +503,14 @@ static int lpi2c_imx_xfer(struct i2c_adapter *adapter, + static irqreturn_t lpi2c_imx_isr(int irq, void *dev_id) + { + struct lpi2c_imx_struct *lpi2c_imx = dev_id; ++ unsigned int enabled; + unsigned int temp; + ++ enabled = readl(lpi2c_imx->base + LPI2C_MIER); ++ + lpi2c_imx_intctrl(lpi2c_imx, 0); + temp = readl(lpi2c_imx->base + LPI2C_MSR); ++ temp &= enabled; + + if (temp & MSR_RDF) + lpi2c_imx_read_rxfifo(lpi2c_imx); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-037-i2c-mxs-ensure-that-DMA-buffers-are-safe-for-DM.patch b/patches.kernel.org/6.2.9-037-i2c-mxs-ensure-that-DMA-buffers-are-safe-for-DM.patch new file mode 100644 index 0000000..b2cbe8a --- /dev/null +++ b/patches.kernel.org/6.2.9-037-i2c-mxs-ensure-that-DMA-buffers-are-safe-for-DM.patch @@ -0,0 +1,94 @@ +From: Matthias Schiffer +Date: Mon, 13 Feb 2023 16:25:50 +0100 +Subject: [PATCH] i2c: mxs: ensure that DMA buffers are safe for DMA +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 5190417bdf72c71b65bd9892103c6186816a6e8b + +[ Upstream commit 5190417bdf72c71b65bd9892103c6186816a6e8b ] + +We found that after commit 9c46929e7989 +("ARM: implement THREAD_INFO_IN_TASK for uniprocessor systems"), the +PCF85063 RTC driver stopped working on i.MX28 due to regmap_bulk_read() +reading bogus data into a stack buffer. This is caused by the i2c-mxs +driver using DMA transfers even for messages without the I2C_M_DMA_SAFE +flag, and the aforementioned commit enabling vmapped stacks. + +As the MXS I2C controller requires DMA for reads of >4 bytes, DMA can't be +disabled, so the issue is fixed by using i2c_get_dma_safe_msg_buf() to +create a bounce buffer when needed. + +Fixes: 9c46929e7989 ("ARM: implement THREAD_INFO_IN_TASK for uniprocessor systems") +Signed-off-by: Matthias Schiffer +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/i2c/busses/i2c-mxs.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c +index d113bed7..e0f3b354 100644 +--- a/drivers/i2c/busses/i2c-mxs.c ++++ b/drivers/i2c/busses/i2c-mxs.c +@@ -171,7 +171,7 @@ static void mxs_i2c_dma_irq_callback(void *param) + } + + static int mxs_i2c_dma_setup_xfer(struct i2c_adapter *adap, +- struct i2c_msg *msg, uint32_t flags) ++ struct i2c_msg *msg, u8 *buf, uint32_t flags) + { + struct dma_async_tx_descriptor *desc; + struct mxs_i2c_dev *i2c = i2c_get_adapdata(adap); +@@ -226,7 +226,7 @@ static int mxs_i2c_dma_setup_xfer(struct i2c_adapter *adap, + } + + /* Queue the DMA data transfer. */ +- sg_init_one(&i2c->sg_io[1], msg->buf, msg->len); ++ sg_init_one(&i2c->sg_io[1], buf, msg->len); + dma_map_sg(i2c->dev, &i2c->sg_io[1], 1, DMA_FROM_DEVICE); + desc = dmaengine_prep_slave_sg(i2c->dmach, &i2c->sg_io[1], 1, + DMA_DEV_TO_MEM, +@@ -259,7 +259,7 @@ static int mxs_i2c_dma_setup_xfer(struct i2c_adapter *adap, + /* Queue the DMA data transfer. */ + sg_init_table(i2c->sg_io, 2); + sg_set_buf(&i2c->sg_io[0], &i2c->addr_data, 1); +- sg_set_buf(&i2c->sg_io[1], msg->buf, msg->len); ++ sg_set_buf(&i2c->sg_io[1], buf, msg->len); + dma_map_sg(i2c->dev, i2c->sg_io, 2, DMA_TO_DEVICE); + desc = dmaengine_prep_slave_sg(i2c->dmach, i2c->sg_io, 2, + DMA_MEM_TO_DEV, +@@ -563,6 +563,7 @@ static int mxs_i2c_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, + struct mxs_i2c_dev *i2c = i2c_get_adapdata(adap); + int ret; + int flags; ++ u8 *dma_buf; + int use_pio = 0; + unsigned long time_left; + +@@ -588,13 +589,20 @@ static int mxs_i2c_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, + if (ret && (ret != -ENXIO)) + mxs_i2c_reset(i2c); + } else { ++ dma_buf = i2c_get_dma_safe_msg_buf(msg, 1); ++ if (!dma_buf) ++ return -ENOMEM; ++ + reinit_completion(&i2c->cmd_complete); +- ret = mxs_i2c_dma_setup_xfer(adap, msg, flags); +- if (ret) ++ ret = mxs_i2c_dma_setup_xfer(adap, msg, dma_buf, flags); ++ if (ret) { ++ i2c_put_dma_safe_msg_buf(dma_buf, msg, false); + return ret; ++ } + + time_left = wait_for_completion_timeout(&i2c->cmd_complete, + msecs_to_jiffies(1000)); ++ i2c_put_dma_safe_msg_buf(dma_buf, msg, true); + if (!time_left) + goto timeout; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-038-i2c-hisi-Only-use-the-completion-interrupt-to-f.patch b/patches.kernel.org/6.2.9-038-i2c-hisi-Only-use-the-completion-interrupt-to-f.patch new file mode 100644 index 0000000..0ed97e4 --- /dev/null +++ b/patches.kernel.org/6.2.9-038-i2c-hisi-Only-use-the-completion-interrupt-to-f.patch @@ -0,0 +1,49 @@ +From: Yicong Yang +Date: Mon, 13 Mar 2023 15:45:52 +0800 +Subject: [PATCH] i2c: hisi: Only use the completion interrupt to finish the + transfer +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: d98263512684a47e81bcb72a5408958ecd1e60b0 + +[ Upstream commit d98263512684a47e81bcb72a5408958ecd1e60b0 ] + +The controller will always generate a completion interrupt when the +transfer is finished normally or not. Currently we use either error or +completion interrupt to finish, this may result the completion +interrupt unhandled and corrupt the next transfer, especially at low +speed mode. Since on error case, the error interrupt will come first +then is the completion interrupt. So only use the completion interrupt +to finish the whole transfer process. + +Fixes: d62fbdb99a85 ("i2c: add support for HiSilicon I2C controller") +Reported-by: Sheng Feng +Signed-off-by: Sheng Feng +Signed-off-by: Yicong Yang +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/i2c/busses/i2c-hisi.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-hisi.c b/drivers/i2c/busses/i2c-hisi.c +index 8c6c7075..f5c37d2f 100644 +--- a/drivers/i2c/busses/i2c-hisi.c ++++ b/drivers/i2c/busses/i2c-hisi.c +@@ -341,7 +341,11 @@ static irqreturn_t hisi_i2c_irq(int irq, void *context) + hisi_i2c_read_rx_fifo(ctlr); + + out: +- if (int_stat & HISI_I2C_INT_TRANS_CPLT || ctlr->xfer_err) { ++ /* ++ * Only use TRANS_CPLT to indicate the completion. On error cases we'll ++ * get two interrupts, INT_ERR first then TRANS_CPLT. ++ */ ++ if (int_stat & HISI_I2C_INT_TRANS_CPLT) { + hisi_i2c_disable_int(ctlr, HISI_I2C_INT_ALL); + hisi_i2c_clear_int(ctlr, HISI_I2C_INT_ALL); + complete(ctlr->completion); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-039-scsi-scsi_dh_alua-Fix-memleak-for-qdata-in-alua.patch b/patches.kernel.org/6.2.9-039-scsi-scsi_dh_alua-Fix-memleak-for-qdata-in-alua.patch new file mode 100644 index 0000000..5458a06 --- /dev/null +++ b/patches.kernel.org/6.2.9-039-scsi-scsi_dh_alua-Fix-memleak-for-qdata-in-alua.patch @@ -0,0 +1,63 @@ +From: Yu Kuai +Date: Wed, 15 Mar 2023 14:21:54 +0800 +Subject: [PATCH] scsi: scsi_dh_alua: Fix memleak for 'qdata' in + alua_activate() +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: a13faca032acbf2699293587085293bdfaafc8ae + +[ Upstream commit a13faca032acbf2699293587085293bdfaafc8ae ] + +If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not +freed, which will cause following memleak: + +unreferenced object 0xffff88810b2c6980 (size 32): + comm "kworker/u16:2", pid 635322, jiffies 4355801099 (age 1216426.076s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff @9$............. + backtrace: + [<0000000098f3a26d>] alua_activate+0xb0/0x320 + [<000000003b529641>] scsi_dh_activate+0xb2/0x140 + [<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath] + [<000000007adc9ace>] process_one_work+0x3c5/0x730 + [<00000000c457a985>] worker_thread+0x93/0x650 + [<00000000cb80e628>] kthread+0x1ba/0x210 + [<00000000a1e61077>] ret_from_fork+0x22/0x30 + +Fix the problem by freeing 'qdata' in error path. + +Fixes: 625fe857e4fa ("scsi: scsi_dh_alua: Check scsi_device_get() return value") +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20230315062154.668812-1-yukuai1@huaweicloud.com +Reviewed-by: Benjamin Block +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/device_handler/scsi_dh_alua.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c +index 29a2865b..e436eaa3 100644 +--- a/drivers/scsi/device_handler/scsi_dh_alua.c ++++ b/drivers/scsi/device_handler/scsi_dh_alua.c +@@ -1139,10 +1139,12 @@ static int alua_activate(struct scsi_device *sdev, + rcu_read_unlock(); + mutex_unlock(&h->init_mutex); + +- if (alua_rtpg_queue(pg, sdev, qdata, true)) ++ if (alua_rtpg_queue(pg, sdev, qdata, true)) { + fn = NULL; +- else ++ } else { ++ kfree(qdata); + err = SCSI_DH_DEV_OFFLINED; ++ } + kref_put(&pg->kref, release_port_group); + out: + if (fn) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-040-nfsd-don-t-replace-page-in-rq_pages-if-it-s-a-c.patch b/patches.kernel.org/6.2.9-040-nfsd-don-t-replace-page-in-rq_pages-if-it-s-a-c.patch new file mode 100644 index 0000000..f0ee571 --- /dev/null +++ b/patches.kernel.org/6.2.9-040-nfsd-don-t-replace-page-in-rq_pages-if-it-s-a-c.patch @@ -0,0 +1,66 @@ +From: Jeff Layton +Date: Fri, 17 Mar 2023 13:13:08 -0400 +Subject: [PATCH] nfsd: don't replace page in rq_pages if it's a continuation + of last page +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 27c934dd8832dd40fd34776f916dc201e18b319b + +[ Upstream commit 27c934dd8832dd40fd34776f916dc201e18b319b ] + +The splice read calls nfsd_splice_actor to put the pages containing file +data into the svc_rqst->rq_pages array. It's possible however to get a +splice result that only has a partial page at the end, if (e.g.) the +filesystem hands back a short read that doesn't cover the whole page. + +nfsd_splice_actor will plop the partial page into its rq_pages array and +return. Then later, when nfsd_splice_actor is called again, the +remainder of the page may end up being filled out. At this point, +nfsd_splice_actor will put the page into the array _again_ corrupting +the reply. If this is done enough times, rq_next_page will overrun the +array and corrupt the trailing fields -- the rq_respages and +rq_next_page pointers themselves. + +If we've already added the page to the array in the last pass, don't add +it to the array a second time when dealing with a splice continuation. +This was originally handled properly in nfsd_splice_actor, but commit +91e23b1c3982 ("NFSD: Clean up nfsd_splice_actor()") removed the check +for it. + +Fixes: 91e23b1c3982 ("NFSD: Clean up nfsd_splice_actor()") +Cc: Al Viro +Reported-by: Dario Lesca +Tested-by: David Critch +Link: https://bugzilla.redhat.com/show_bug.cgi?id=2150630 +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/nfsd/vfs.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c +index bb1e8558..5308070a 100644 +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -937,8 +937,15 @@ nfsd_splice_actor(struct pipe_inode_info *pipe, struct pipe_buffer *buf, + struct page *last_page; + + last_page = page + (offset + sd->len - 1) / PAGE_SIZE; +- for (page += offset / PAGE_SIZE; page <= last_page; page++) ++ for (page += offset / PAGE_SIZE; page <= last_page; page++) { ++ /* ++ * Skip page replacement when extending the contents ++ * of the current page. ++ */ ++ if (page == *(rqstp->rq_next_page - 1)) ++ continue; + svc_rqst_replace_page(rqstp, page); ++ } + if (rqstp->rq_res.page_len == 0) // first call + rqstp->rq_res.page_base = offset % PAGE_SIZE; + rqstp->rq_res.page_len += sd->len; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-041-net-dsa-b53-mmap-fix-device-tree-support.patch b/patches.kernel.org/6.2.9-041-net-dsa-b53-mmap-fix-device-tree-support.patch new file mode 100644 index 0000000..edb7a79 --- /dev/null +++ b/patches.kernel.org/6.2.9-041-net-dsa-b53-mmap-fix-device-tree-support.patch @@ -0,0 +1,41 @@ +From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= +Date: Thu, 16 Mar 2023 18:28:07 +0100 +Subject: [PATCH] net: dsa: b53: mmap: fix device tree support +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 30796d0dcb6e41c6558a07950f2ce60c209da867 + +[ Upstream commit 30796d0dcb6e41c6558a07950f2ce60c209da867 ] + +CPU port should also be enabled in order to get a working switch. + +Fixes: a5538a777b73 ("net: dsa: b53: mmap: Add device tree support") +Signed-off-by: Álvaro Fernández Rojas +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20230316172807.460146-1-noltari@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/dsa/b53/b53_mmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/b53/b53_mmap.c b/drivers/net/dsa/b53/b53_mmap.c +index e968322d..70887e0a 100644 +--- a/drivers/net/dsa/b53/b53_mmap.c ++++ b/drivers/net/dsa/b53/b53_mmap.c +@@ -263,7 +263,7 @@ static int b53_mmap_probe_of(struct platform_device *pdev, + if (of_property_read_u32(of_port, "reg", ®)) + continue; + +- if (reg < B53_CPU_PORT) ++ if (reg < B53_N_PORTS) + pdata->enabled_ports |= BIT(reg); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-042-net-usb-smsc95xx-Limit-packet-length-to-skb-len.patch b/patches.kernel.org/6.2.9-042-net-usb-smsc95xx-Limit-packet-length-to-skb-len.patch new file mode 100644 index 0000000..394faf9 --- /dev/null +++ b/patches.kernel.org/6.2.9-042-net-usb-smsc95xx-Limit-packet-length-to-skb-len.patch @@ -0,0 +1,44 @@ +From: Szymon Heidrich +Date: Thu, 16 Mar 2023 11:19:54 +0100 +Subject: [PATCH] net: usb: smsc95xx: Limit packet length to skb->len +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: ff821092cf02a70c2bccd2d19269f01e29aa52cf + +[ Upstream commit ff821092cf02a70c2bccd2d19269f01e29aa52cf ] + +Packet length retrieved from descriptor may be larger than +the actual socket buffer length. In such case the cloned +skb passed up the network stack will leak kernel memory contents. + +Fixes: 2f7ca802bdae ("net: Add SMSC LAN9500 USB2.0 10/100 ethernet adapter driver") +Signed-off-by: Szymon Heidrich +Reviewed-by: Jakub Kicinski +Link: https://lore.kernel.org/r/20230316101954.75836-1-szymon.heidrich@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/usb/smsc95xx.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index 32d2c60d..563ecd27 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -1833,6 +1833,12 @@ static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + size = (u16)((header & RX_STS_FL_) >> 16); + align_count = (4 - ((size + NET_IP_ALIGN) % 4)) % 4; + ++ if (unlikely(size > skb->len)) { ++ netif_dbg(dev, rx_err, dev->net, ++ "size err header=0x%08x\n", header); ++ return 0; ++ } ++ + if (unlikely(header & RX_STS_ES_)) { + netif_dbg(dev, rx_err, dev->net, + "Error header=0x%08x\n", header); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-043-efi-libstub-smbios-Use-length-member-instead-of.patch b/patches.kernel.org/6.2.9-043-efi-libstub-smbios-Use-length-member-instead-of.patch new file mode 100644 index 0000000..0cf5975 --- /dev/null +++ b/patches.kernel.org/6.2.9-043-efi-libstub-smbios-Use-length-member-instead-of.patch @@ -0,0 +1,39 @@ +From: Ard Biesheuvel +Date: Tue, 28 Feb 2023 19:23:09 +0100 +Subject: [PATCH] efi/libstub: smbios: Use length member instead of record + struct size +Patch-mainline: 6.2.9 +References: bsc#1012628 bsc#1208750 +Git-commit: 34343eb06afc04af9178a9883d9354dc12beede0 + +[ Upstream commit 34343eb06afc04af9178a9883d9354dc12beede0 ] + +The type 1 SMBIOS record happens to always be the same size, but there +are other record types which have been augmented over time, and so we +should really use the length field in the header to decide where the +string table starts. + +Fixes: 550b33cfd4452968 ("arm64: efi: Force the use of ...") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/firmware/efi/libstub/smbios.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/efi/libstub/smbios.c b/drivers/firmware/efi/libstub/smbios.c +index 460418b7..aadb422b 100644 +--- a/drivers/firmware/efi/libstub/smbios.c ++++ b/drivers/firmware/efi/libstub/smbios.c +@@ -36,7 +36,7 @@ const u8 *__efi_get_smbios_string(u8 type, int offset, int recsize) + if (status != EFI_SUCCESS) + return NULL; + +- strtable = (u8 *)record + recsize; ++ strtable = (u8 *)record + record->length; + for (int i = 1; i < ((u8 *)record)[offset]; i++) { + int len = strlen(strtable); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-044-arm64-efi-Use-SMBIOS-processor-version-to-key-o.patch b/patches.kernel.org/6.2.9-044-arm64-efi-Use-SMBIOS-processor-version-to-key-o.patch new file mode 100644 index 0000000..1fcb10e --- /dev/null +++ b/patches.kernel.org/6.2.9-044-arm64-efi-Use-SMBIOS-processor-version-to-key-o.patch @@ -0,0 +1,183 @@ +From: Ard Biesheuvel +Date: Tue, 28 Feb 2023 17:00:49 +0100 +Subject: [PATCH] arm64: efi: Use SMBIOS processor version to key off Ampere + quirk +Patch-mainline: 6.2.9 +References: bsc#1012628 bsc#1208750 +Git-commit: eb684408f3ea4856639675d6465f0024e498e4b1 + +[ Upstream commit eb684408f3ea4856639675d6465f0024e498e4b1 ] + +Instead of using the SMBIOS type 1 record 'family' field, which is often +modified by OEMs, use the type 4 'processor ID' and 'processor version' +fields, which are set to a small set of probe-able values on all known +Ampere EFI systems in the field. + +Fixes: 550b33cfd4452968 ("arm64: efi: Force the use of ...") +Tested-by: Andrea Righi +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/firmware/efi/libstub/arm64.c | 39 +++++++++++++++++++----- + drivers/firmware/efi/libstub/efistub.h | 41 ++++++++++++++++++++++++-- + drivers/firmware/efi/libstub/smbios.c | 13 ++++++-- + 3 files changed, 80 insertions(+), 13 deletions(-) + +diff --git a/drivers/firmware/efi/libstub/arm64.c b/drivers/firmware/efi/libstub/arm64.c +index 4501652e..84d94443 100644 +--- a/drivers/firmware/efi/libstub/arm64.c ++++ b/drivers/firmware/efi/libstub/arm64.c +@@ -16,20 +16,43 @@ + + static bool system_needs_vamap(void) + { +- const u8 *type1_family = efi_get_smbios_string(1, family); ++ const struct efi_smbios_type4_record *record; ++ const u32 __aligned(1) *socid; ++ const u8 *version; + + /* + * Ampere eMAG, Altra, and Altra Max machines crash in SetTime() if +- * SetVirtualAddressMap() has not been called prior. ++ * SetVirtualAddressMap() has not been called prior. Most Altra systems ++ * can be identified by the SMCCC soc ID, which is conveniently exposed ++ * via the type 4 SMBIOS records. Otherwise, test the processor version ++ * field. eMAG systems all appear to have the processor version field ++ * set to "eMAG". + */ +- if (!type1_family || ( +- strcmp(type1_family, "eMAG") && +- strcmp(type1_family, "Altra") && +- strcmp(type1_family, "Altra Max"))) ++ record = (struct efi_smbios_type4_record *)efi_get_smbios_record(4); ++ if (!record) + return false; + +- efi_warn("Working around broken SetVirtualAddressMap()\n"); +- return true; ++ socid = (u32 *)record->processor_id; ++ switch (*socid & 0xffff000f) { ++ static char const altra[] = "Ampere(TM) Altra(TM) Processor"; ++ static char const emag[] = "eMAG"; ++ ++ default: ++ version = efi_get_smbios_string(&record->header, 4, ++ processor_version); ++ if (!version || (strncmp(version, altra, sizeof(altra) - 1) && ++ strncmp(version, emag, sizeof(emag) - 1))) ++ break; ++ ++ fallthrough; ++ ++ case 0x0a160001: // Altra ++ case 0x0a160002: // Altra Max ++ efi_warn("Working around broken SetVirtualAddressMap()\n"); ++ return true; ++ } ++ ++ return false; + } + + efi_status_t check_platform_features(void) +diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h +index 5b8f2c41..f527816a 100644 +--- a/drivers/firmware/efi/libstub/efistub.h ++++ b/drivers/firmware/efi/libstub/efistub.h +@@ -1054,6 +1054,8 @@ struct efi_smbios_record { + u16 handle; + }; + ++const struct efi_smbios_record *efi_get_smbios_record(u8 type); ++ + struct efi_smbios_type1_record { + struct efi_smbios_record header; + +@@ -1067,13 +1069,46 @@ struct efi_smbios_type1_record { + u8 family; + }; + +-#define efi_get_smbios_string(__type, __name) ({ \ ++struct efi_smbios_type4_record { ++ struct efi_smbios_record header; ++ ++ u8 socket; ++ u8 processor_type; ++ u8 processor_family; ++ u8 processor_manufacturer; ++ u8 processor_id[8]; ++ u8 processor_version; ++ u8 voltage; ++ u16 external_clock; ++ u16 max_speed; ++ u16 current_speed; ++ u8 status; ++ u8 processor_upgrade; ++ u16 l1_cache_handle; ++ u16 l2_cache_handle; ++ u16 l3_cache_handle; ++ u8 serial_number; ++ u8 asset_tag; ++ u8 part_number; ++ u8 core_count; ++ u8 enabled_core_count; ++ u8 thread_count; ++ u16 processor_characteristics; ++ u16 processor_family2; ++ u16 core_count2; ++ u16 enabled_core_count2; ++ u16 thread_count2; ++ u16 thread_enabled; ++}; ++ ++#define efi_get_smbios_string(__record, __type, __name) ({ \ + int size = sizeof(struct efi_smbios_type ## __type ## _record); \ + int off = offsetof(struct efi_smbios_type ## __type ## _record, \ + __name); \ +- __efi_get_smbios_string(__type, off, size); \ ++ __efi_get_smbios_string((__record), __type, off, size); \ + }) + +-const u8 *__efi_get_smbios_string(u8 type, int offset, int recsize); ++const u8 *__efi_get_smbios_string(const struct efi_smbios_record *record, ++ u8 type, int offset, int recsize); + + #endif +diff --git a/drivers/firmware/efi/libstub/smbios.c b/drivers/firmware/efi/libstub/smbios.c +index aadb422b..f9c159c2 100644 +--- a/drivers/firmware/efi/libstub/smbios.c ++++ b/drivers/firmware/efi/libstub/smbios.c +@@ -22,19 +22,28 @@ struct efi_smbios_protocol { + u8 minor_version; + }; + +-const u8 *__efi_get_smbios_string(u8 type, int offset, int recsize) ++const struct efi_smbios_record *efi_get_smbios_record(u8 type) + { + struct efi_smbios_record *record; + efi_smbios_protocol_t *smbios; + efi_status_t status; + u16 handle = 0xfffe; +- const u8 *strtable; + + status = efi_bs_call(locate_protocol, &EFI_SMBIOS_PROTOCOL_GUID, NULL, + (void **)&smbios) ?: + efi_call_proto(smbios, get_next, &handle, &type, &record, NULL); + if (status != EFI_SUCCESS) + return NULL; ++ return record; ++} ++ ++const u8 *__efi_get_smbios_string(const struct efi_smbios_record *record, ++ u8 type, int offset, int recsize) ++{ ++ const u8 *strtable; ++ ++ if (!record) ++ return NULL; + + strtable = (u8 *)record + record->length; + for (int i = 1; i < ((u8 *)record)[offset]; i++) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-045-qed-qed_sriov-guard-against-NULL-derefs-from-qe.patch b/patches.kernel.org/6.2.9-045-qed-qed_sriov-guard-against-NULL-derefs-from-qe.patch new file mode 100644 index 0000000..2340856 --- /dev/null +++ b/patches.kernel.org/6.2.9-045-qed-qed_sriov-guard-against-NULL-derefs-from-qe.patch @@ -0,0 +1,53 @@ +From: Daniil Tatianin +Date: Thu, 16 Mar 2023 13:29:21 +0300 +Subject: [PATCH] qed/qed_sriov: guard against NULL derefs from + qed_iov_get_vf_info +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 25143b6a01d0cc5319edd3de22ffa2578b045550 + +[ Upstream commit 25143b6a01d0cc5319edd3de22ffa2578b045550 ] + +We have to make sure that the info returned by the helper is valid +before using it. + +Found by Linux Verification Center (linuxtesting.org) with the SVACE +static analysis tool. + +Fixes: f990c82c385b ("qed*: Add support for ndo_set_vf_trust") +Fixes: 733def6a04bf ("qed*: IOV link control") +Signed-off-by: Daniil Tatianin +Reviewed-by: Michal Swiatkowski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/qlogic/qed/qed_sriov.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +index 0848b552..911509c2 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +@@ -4404,6 +4404,9 @@ qed_iov_configure_min_tx_rate(struct qed_dev *cdev, int vfid, u32 rate) + } + + vf = qed_iov_get_vf_info(QED_LEADING_HWFN(cdev), (u16)vfid, true); ++ if (!vf) ++ return -EINVAL; ++ + vport_id = vf->vport_id; + + return qed_configure_vport_wfq(cdev, vport_id, rate); +@@ -5152,7 +5155,7 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn) + + /* Validate that the VF has a configured vport */ + vf = qed_iov_get_vf_info(hwfn, i, true); +- if (!vf->vport_instance) ++ if (!vf || !vf->vport_instance) + continue; + + memset(¶ms, 0, sizeof(params)); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-046-xirc2ps_cs-Fix-use-after-free-bug-in-xirc2ps_de.patch b/patches.kernel.org/6.2.9-046-xirc2ps_cs-Fix-use-after-free-bug-in-xirc2ps_de.patch new file mode 100644 index 0000000..96fdde9 --- /dev/null +++ b/patches.kernel.org/6.2.9-046-xirc2ps_cs-Fix-use-after-free-bug-in-xirc2ps_de.patch @@ -0,0 +1,59 @@ +From: Zheng Wang +Date: Fri, 17 Mar 2023 00:15:26 +0800 +Subject: [PATCH] xirc2ps_cs: Fix use after free bug in xirc2ps_detach +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: e8d20c3ded59a092532513c9bd030d1ea66f5f44 + +[ Upstream commit e8d20c3ded59a092532513c9bd030d1ea66f5f44 ] + +In xirc2ps_probe, the local->tx_timeout_task was bounded +with xirc2ps_tx_timeout_task. When timeout occurs, +it will call xirc_tx_timeout->schedule_work to start the +work. + +When we call xirc2ps_detach to remove the driver, there +may be a sequence as follows: + +Stop responding to timeout tasks and complete scheduled +tasks before cleanup in xirc2ps_detach, which will fix +the problem. + +CPU0 CPU1 + + |xirc2ps_tx_timeout_task +xirc2ps_detach | + free_netdev | + kfree(dev); | + | + | do_reset + | //use dev + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Zheng Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/xircom/xirc2ps_cs.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/xircom/xirc2ps_cs.c b/drivers/net/ethernet/xircom/xirc2ps_cs.c +index 894e92ef..9f505cf0 100644 +--- a/drivers/net/ethernet/xircom/xirc2ps_cs.c ++++ b/drivers/net/ethernet/xircom/xirc2ps_cs.c +@@ -503,6 +503,11 @@ static void + xirc2ps_detach(struct pcmcia_device *link) + { + struct net_device *dev = link->priv; ++ struct local_info *local = netdev_priv(dev); ++ ++ netif_carrier_off(dev); ++ netif_tx_disable(dev); ++ cancel_work_sync(&local->tx_timeout_task); + + dev_dbg(&link->dev, "detach\n"); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-047-net-phy-Ensure-state-transitions-are-processed-.patch b/patches.kernel.org/6.2.9-047-net-phy-Ensure-state-transitions-are-processed-.patch new file mode 100644 index 0000000..3e0d390 --- /dev/null +++ b/patches.kernel.org/6.2.9-047-net-phy-Ensure-state-transitions-are-processed-.patch @@ -0,0 +1,93 @@ +From: Florian Fainelli +Date: Thu, 16 Mar 2023 13:33:24 -0700 +Subject: [PATCH] net: phy: Ensure state transitions are processed from + phy_stop() +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 4203d84032e28f893594a453bd8bc9c3b15c7334 + +[ Upstream commit 4203d84032e28f893594a453bd8bc9c3b15c7334 ] + +In the phy_disconnect() -> phy_stop() path, we will be forcibly setting +the PHY state machine to PHY_HALTED. This invalidates the old_state != +phydev->state condition in phy_state_machine() such that we will neither +display the state change for debugging, nor will we invoke the +link_change_notify() callback. + +Factor the code by introducing phy_process_state_change(), and ensure +that we process the state change from phy_stop() as well. + +Fixes: 5c5f626bcace ("net: phy: improve handling link_change_notify callback") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/phy/phy.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c +index e5b6cb1a..a8bf3c75 100644 +--- a/drivers/net/phy/phy.c ++++ b/drivers/net/phy/phy.c +@@ -57,6 +57,18 @@ static const char *phy_state_to_str(enum phy_state st) + return NULL; + } + ++static void phy_process_state_change(struct phy_device *phydev, ++ enum phy_state old_state) ++{ ++ if (old_state != phydev->state) { ++ phydev_dbg(phydev, "PHY state change %s -> %s\n", ++ phy_state_to_str(old_state), ++ phy_state_to_str(phydev->state)); ++ if (phydev->drv && phydev->drv->link_change_notify) ++ phydev->drv->link_change_notify(phydev); ++ } ++} ++ + static void phy_link_up(struct phy_device *phydev) + { + phydev->phy_link_change(phydev, true); +@@ -1094,6 +1106,7 @@ EXPORT_SYMBOL(phy_free_interrupt); + void phy_stop(struct phy_device *phydev) + { + struct net_device *dev = phydev->attached_dev; ++ enum phy_state old_state; + + if (!phy_is_started(phydev) && phydev->state != PHY_DOWN) { + WARN(1, "called from state %s\n", +@@ -1102,6 +1115,7 @@ void phy_stop(struct phy_device *phydev) + } + + mutex_lock(&phydev->lock); ++ old_state = phydev->state; + + if (phydev->state == PHY_CABLETEST) { + phy_abort_cable_test(phydev); +@@ -1112,6 +1126,7 @@ void phy_stop(struct phy_device *phydev) + sfp_upstream_stop(phydev->sfp_bus); + + phydev->state = PHY_HALTED; ++ phy_process_state_change(phydev, old_state); + + mutex_unlock(&phydev->lock); + +@@ -1229,13 +1244,7 @@ void phy_state_machine(struct work_struct *work) + if (err < 0) + phy_error(phydev); + +- if (old_state != phydev->state) { +- phydev_dbg(phydev, "PHY state change %s -> %s\n", +- phy_state_to_str(old_state), +- phy_state_to_str(phydev->state)); +- if (phydev->drv && phydev->drv->link_change_notify) +- phydev->drv->link_change_notify(phydev); +- } ++ phy_process_state_change(phydev, old_state); + + /* Only re-schedule a PHY state machine change if we are polling the + * PHY, if PHY_MAC_INTERRUPT is set, then we will be moving +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-048-net-mdio-fix-owner-field-for-mdio-buses-registe.patch b/patches.kernel.org/6.2.9-048-net-mdio-fix-owner-field-for-mdio-buses-registe.patch new file mode 100644 index 0000000..e8740bb --- /dev/null +++ b/patches.kernel.org/6.2.9-048-net-mdio-fix-owner-field-for-mdio-buses-registe.patch @@ -0,0 +1,153 @@ +From: Maxime Bizon +Date: Thu, 16 Mar 2023 16:33:16 -0700 +Subject: [PATCH] net: mdio: fix owner field for mdio buses registered using + device-tree +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 99669259f3361d759219811e670b7e0742668556 + +[ Upstream commit 99669259f3361d759219811e670b7e0742668556 ] + +Bus ownership is wrong when using of_mdiobus_register() to register an mdio +bus. That function is not inline, so when it calls mdiobus_register() the wrong +THIS_MODULE value is captured. + +Signed-off-by: Maxime Bizon +Fixes: 90eff9096c01 ("net: phy: Allow splitting MDIO bus/device support from PHYs") +[florian: fix kdoc, added Fixes tag] +Signed-off-by: Florian Fainelli +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/mdio/of_mdio.c | 12 +++++++----- + drivers/net/phy/mdio_devres.c | 11 ++++++----- + include/linux/of_mdio.h | 22 +++++++++++++++++++--- + 3 files changed, 32 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/mdio/of_mdio.c b/drivers/net/mdio/of_mdio.c +index 510822d6..1e46e39f 100644 +--- a/drivers/net/mdio/of_mdio.c ++++ b/drivers/net/mdio/of_mdio.c +@@ -139,21 +139,23 @@ bool of_mdiobus_child_is_phy(struct device_node *child) + EXPORT_SYMBOL(of_mdiobus_child_is_phy); + + /** +- * of_mdiobus_register - Register mii_bus and create PHYs from the device tree ++ * __of_mdiobus_register - Register mii_bus and create PHYs from the device tree + * @mdio: pointer to mii_bus structure + * @np: pointer to device_node of MDIO bus. ++ * @owner: module owning the @mdio object. + * + * This function registers the mii_bus structure and registers a phy_device + * for each child node of @np. + */ +-int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np) ++int __of_mdiobus_register(struct mii_bus *mdio, struct device_node *np, ++ struct module *owner) + { + struct device_node *child; + bool scanphys = false; + int addr, rc; + + if (!np) +- return mdiobus_register(mdio); ++ return __mdiobus_register(mdio, owner); + + /* Do not continue if the node is disabled */ + if (!of_device_is_available(np)) +@@ -172,7 +174,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np) + of_property_read_u32(np, "reset-post-delay-us", &mdio->reset_post_delay_us); + + /* Register the MDIO bus */ +- rc = mdiobus_register(mdio); ++ rc = __mdiobus_register(mdio, owner); + if (rc) + return rc; + +@@ -236,7 +238,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np) + mdiobus_unregister(mdio); + return rc; + } +-EXPORT_SYMBOL(of_mdiobus_register); ++EXPORT_SYMBOL(__of_mdiobus_register); + + /** + * of_mdio_find_device - Given a device tree node, find the mdio_device +diff --git a/drivers/net/phy/mdio_devres.c b/drivers/net/phy/mdio_devres.c +index b560e996..69b829e6 100644 +--- a/drivers/net/phy/mdio_devres.c ++++ b/drivers/net/phy/mdio_devres.c +@@ -98,13 +98,14 @@ EXPORT_SYMBOL(__devm_mdiobus_register); + + #if IS_ENABLED(CONFIG_OF_MDIO) + /** +- * devm_of_mdiobus_register - Resource managed variant of of_mdiobus_register() ++ * __devm_of_mdiobus_register - Resource managed variant of of_mdiobus_register() + * @dev: Device to register mii_bus for + * @mdio: MII bus structure to register + * @np: Device node to parse ++ * @owner: Owning module + */ +-int devm_of_mdiobus_register(struct device *dev, struct mii_bus *mdio, +- struct device_node *np) ++int __devm_of_mdiobus_register(struct device *dev, struct mii_bus *mdio, ++ struct device_node *np, struct module *owner) + { + struct mdiobus_devres *dr; + int ret; +@@ -117,7 +118,7 @@ int devm_of_mdiobus_register(struct device *dev, struct mii_bus *mdio, + if (!dr) + return -ENOMEM; + +- ret = of_mdiobus_register(mdio, np); ++ ret = __of_mdiobus_register(mdio, np, owner); + if (ret) { + devres_free(dr); + return ret; +@@ -127,7 +128,7 @@ int devm_of_mdiobus_register(struct device *dev, struct mii_bus *mdio, + devres_add(dev, dr); + return 0; + } +-EXPORT_SYMBOL(devm_of_mdiobus_register); ++EXPORT_SYMBOL(__devm_of_mdiobus_register); + #endif /* CONFIG_OF_MDIO */ + + MODULE_LICENSE("GPL"); +diff --git a/include/linux/of_mdio.h b/include/linux/of_mdio.h +index da633d34..8a52ef2e 100644 +--- a/include/linux/of_mdio.h ++++ b/include/linux/of_mdio.h +@@ -14,9 +14,25 @@ + + #if IS_ENABLED(CONFIG_OF_MDIO) + bool of_mdiobus_child_is_phy(struct device_node *child); +-int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np); +-int devm_of_mdiobus_register(struct device *dev, struct mii_bus *mdio, +- struct device_node *np); ++int __of_mdiobus_register(struct mii_bus *mdio, struct device_node *np, ++ struct module *owner); ++ ++static inline int of_mdiobus_register(struct mii_bus *mdio, ++ struct device_node *np) ++{ ++ return __of_mdiobus_register(mdio, np, THIS_MODULE); ++} ++ ++int __devm_of_mdiobus_register(struct device *dev, struct mii_bus *mdio, ++ struct device_node *np, struct module *owner); ++ ++static inline int devm_of_mdiobus_register(struct device *dev, ++ struct mii_bus *mdio, ++ struct device_node *np) ++{ ++ return __devm_of_mdiobus_register(dev, mdio, np, THIS_MODULE); ++} ++ + struct mdio_device *of_mdio_find_device(struct device_node *np); + struct phy_device *of_phy_find_device(struct device_node *phy_np); + struct phy_device * +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-049-net-mdio-fix-owner-field-for-mdio-buses-registe.patch b/patches.kernel.org/6.2.9-049-net-mdio-fix-owner-field-for-mdio-buses-registe.patch new file mode 100644 index 0000000..c7f481d --- /dev/null +++ b/patches.kernel.org/6.2.9-049-net-mdio-fix-owner-field-for-mdio-buses-registe.patch @@ -0,0 +1,89 @@ +From: Florian Fainelli +Date: Thu, 16 Mar 2023 16:33:17 -0700 +Subject: [PATCH] net: mdio: fix owner field for mdio buses registered using + ACPI +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 30b605b8501e321f79e19c3238aa6ca31da6087c + +[ Upstream commit 30b605b8501e321f79e19c3238aa6ca31da6087c ] + +Bus ownership is wrong when using acpi_mdiobus_register() to register an +mdio bus. That function is not inline, so when it calls +mdiobus_register() the wrong THIS_MODULE value is captured. + +CC: Maxime Bizon +Fixes: 803ca24d2f92 ("net: mdio: Add ACPI support code for mdio") +Signed-off-by: Florian Fainelli +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/mdio/acpi_mdio.c | 10 ++++++---- + include/linux/acpi_mdio.h | 9 ++++++++- + 2 files changed, 14 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/mdio/acpi_mdio.c b/drivers/net/mdio/acpi_mdio.c +index d77c987f..4630dde0 100644 +--- a/drivers/net/mdio/acpi_mdio.c ++++ b/drivers/net/mdio/acpi_mdio.c +@@ -18,16 +18,18 @@ MODULE_AUTHOR("Calvin Johnson "); + MODULE_LICENSE("GPL"); + + /** +- * acpi_mdiobus_register - Register mii_bus and create PHYs from the ACPI ASL. ++ * __acpi_mdiobus_register - Register mii_bus and create PHYs from the ACPI ASL. + * @mdio: pointer to mii_bus structure + * @fwnode: pointer to fwnode of MDIO bus. This fwnode is expected to represent ++ * @owner: module owning this @mdio object. + * an ACPI device object corresponding to the MDIO bus and its children are + * expected to correspond to the PHY devices on that bus. + * + * This function registers the mii_bus structure and registers a phy_device + * for each child node of @fwnode. + */ +-int acpi_mdiobus_register(struct mii_bus *mdio, struct fwnode_handle *fwnode) ++int __acpi_mdiobus_register(struct mii_bus *mdio, struct fwnode_handle *fwnode, ++ struct module *owner) + { + struct fwnode_handle *child; + u32 addr; +@@ -35,7 +37,7 @@ int acpi_mdiobus_register(struct mii_bus *mdio, struct fwnode_handle *fwnode) + + /* Mask out all PHYs from auto probing. */ + mdio->phy_mask = GENMASK(31, 0); +- ret = mdiobus_register(mdio); ++ ret = __mdiobus_register(mdio, owner); + if (ret) + return ret; + +@@ -55,4 +57,4 @@ int acpi_mdiobus_register(struct mii_bus *mdio, struct fwnode_handle *fwnode) + } + return 0; + } +-EXPORT_SYMBOL(acpi_mdiobus_register); ++EXPORT_SYMBOL(__acpi_mdiobus_register); +diff --git a/include/linux/acpi_mdio.h b/include/linux/acpi_mdio.h +index 0a24ab7c..8e2eefa9 100644 +--- a/include/linux/acpi_mdio.h ++++ b/include/linux/acpi_mdio.h +@@ -9,7 +9,14 @@ + #include + + #if IS_ENABLED(CONFIG_ACPI_MDIO) +-int acpi_mdiobus_register(struct mii_bus *mdio, struct fwnode_handle *fwnode); ++int __acpi_mdiobus_register(struct mii_bus *mdio, struct fwnode_handle *fwnode, ++ struct module *owner); ++ ++static inline int ++acpi_mdiobus_register(struct mii_bus *mdio, struct fwnode_handle *handle) ++{ ++ return __acpi_mdiobus_register(mdio, handle, THIS_MODULE); ++} + #else /* CONFIG_ACPI_MDIO */ + static inline int + acpi_mdiobus_register(struct mii_bus *mdio, struct fwnode_handle *fwnode) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-050-net-stmmac-Fix-for-mismatched-host-device-DMA-a.patch b/patches.kernel.org/6.2.9-050-net-stmmac-Fix-for-mismatched-host-device-DMA-a.patch new file mode 100644 index 0000000..da74af2 --- /dev/null +++ b/patches.kernel.org/6.2.9-050-net-stmmac-Fix-for-mismatched-host-device-DMA-a.patch @@ -0,0 +1,195 @@ +From: Jochen Henneberg +Date: Fri, 17 Mar 2023 09:08:17 +0100 +Subject: [PATCH] net: stmmac: Fix for mismatched host/device DMA address width +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 070246e4674b125860d311c18ce2623e73e2bd51 + +[ Upstream commit 070246e4674b125860d311c18ce2623e73e2bd51 ] + +Currently DMA address width is either read from a RO device register +or force set from the platform data. This breaks DMA when the host DMA +address width is <=32it but the device is >32bit. + +Right now the driver may decide to use a 2nd DMA descriptor for +another buffer (happens in case of TSO xmit) assuming that 32bit +addressing is used due to platform configuration but the device will +still use both descriptor addresses as one address. + +This can be observed with the Intel EHL platform driver that sets +32bit for addr64 but the MAC reports 40bit. The TX queue gets stuck in +case of TCP with iptables NAT configuration on TSO packets. + +The logic should be like this: Whatever we do on the host side (memory +allocation GFP flags) should happen with the host DMA width, whenever +we decide how to set addresses on the device registers we must use the +device DMA address width. + +This patch renames the platform address width field from addr64 (term +used in device datasheet) to host_addr and uses this value exclusively +for host side operations while all chip operations consider the device +DMA width as read from the device register. + +Fixes: 7cfc4486e7ea ("stmmac: intel: Configure EHL PSE0 GbE and PSE1 GbE to 32 bits DMA addressing") +Signed-off-by: Jochen Henneberg +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/stmicro/stmmac/common.h | 1 + + .../net/ethernet/stmicro/stmmac/dwmac-imx.c | 2 +- + .../net/ethernet/stmicro/stmmac/dwmac-intel.c | 4 +-- + .../ethernet/stmicro/stmmac/dwmac-mediatek.c | 2 +- + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 30 ++++++++++--------- + include/linux/stmmac.h | 2 +- + 6 files changed, 22 insertions(+), 19 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h +index 6b5d96bc..ec9c1302 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/common.h ++++ b/drivers/net/ethernet/stmicro/stmmac/common.h +@@ -418,6 +418,7 @@ struct dma_features { + unsigned int frpbs; + unsigned int frpes; + unsigned int addr64; ++ unsigned int host_dma_width; + unsigned int rssen; + unsigned int vlhash; + unsigned int sphen; +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-imx.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-imx.c +index bd52fb7c..0d6a8419 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-imx.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-imx.c +@@ -251,7 +251,7 @@ static int imx_dwmac_probe(struct platform_device *pdev) + goto err_parse_dt; + } + +- plat_dat->addr64 = dwmac->ops->addr_width; ++ plat_dat->host_dma_width = dwmac->ops->addr_width; + plat_dat->init = imx_dwmac_init; + plat_dat->exit = imx_dwmac_exit; + plat_dat->clks_config = imx_dwmac_clks_config; +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c +index 7deb1f81..13aa9196 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c +@@ -684,7 +684,7 @@ static int ehl_pse0_common_data(struct pci_dev *pdev, + + intel_priv->is_pse = true; + plat->bus_id = 2; +- plat->addr64 = 32; ++ plat->host_dma_width = 32; + + plat->clk_ptp_rate = 200000000; + +@@ -725,7 +725,7 @@ static int ehl_pse1_common_data(struct pci_dev *pdev, + + intel_priv->is_pse = true; + plat->bus_id = 3; +- plat->addr64 = 32; ++ plat->host_dma_width = 32; + + plat->clk_ptp_rate = 200000000; + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c +index 2f7d8e45..9ae31e3d 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c +@@ -591,7 +591,7 @@ static int mediatek_dwmac_common_data(struct platform_device *pdev, + plat->use_phy_wol = priv_plat->mac_wol ? 0 : 1; + plat->riwt_off = 1; + plat->maxmtu = ETH_DATA_LEN; +- plat->addr64 = priv_plat->variant->dma_bit_mask; ++ plat->host_dma_width = priv_plat->variant->dma_bit_mask; + plat->bsp_priv = priv_plat; + plat->init = mediatek_dwmac_init; + plat->clks_config = mediatek_dwmac_clks_config; +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 01f7e19a..7389718b 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -1431,7 +1431,7 @@ static int stmmac_init_rx_buffers(struct stmmac_priv *priv, + struct stmmac_rx_buffer *buf = &rx_q->buf_pool[i]; + gfp_t gfp = (GFP_ATOMIC | __GFP_NOWARN); + +- if (priv->dma_cap.addr64 <= 32) ++ if (priv->dma_cap.host_dma_width <= 32) + gfp |= GFP_DMA32; + + if (!buf->page) { +@@ -4587,7 +4587,7 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv, u32 queue) + unsigned int entry = rx_q->dirty_rx; + gfp_t gfp = (GFP_ATOMIC | __GFP_NOWARN); + +- if (priv->dma_cap.addr64 <= 32) ++ if (priv->dma_cap.host_dma_width <= 32) + gfp |= GFP_DMA32; + + while (dirty-- > 0) { +@@ -6203,7 +6203,7 @@ static int stmmac_dma_cap_show(struct seq_file *seq, void *v) + seq_printf(seq, "\tFlexible RX Parser: %s\n", + priv->dma_cap.frpsel ? "Y" : "N"); + seq_printf(seq, "\tEnhanced Addressing: %d\n", +- priv->dma_cap.addr64); ++ priv->dma_cap.host_dma_width); + seq_printf(seq, "\tReceive Side Scaling: %s\n", + priv->dma_cap.rssen ? "Y" : "N"); + seq_printf(seq, "\tVLAN Hash Filtering: %s\n", +@@ -7173,20 +7173,22 @@ int stmmac_dvr_probe(struct device *device, + dev_info(priv->device, "SPH feature enabled\n"); + } + +- /* The current IP register MAC_HW_Feature1[ADDR64] only define +- * 32/40/64 bit width, but some SOC support others like i.MX8MP +- * support 34 bits but it map to 40 bits width in MAC_HW_Feature1[ADDR64]. +- * So overwrite dma_cap.addr64 according to HW real design. ++ /* Ideally our host DMA address width is the same as for the ++ * device. However, it may differ and then we have to use our ++ * host DMA width for allocation and the device DMA width for ++ * register handling. + */ +- if (priv->plat->addr64) +- priv->dma_cap.addr64 = priv->plat->addr64; ++ if (priv->plat->host_dma_width) ++ priv->dma_cap.host_dma_width = priv->plat->host_dma_width; ++ else ++ priv->dma_cap.host_dma_width = priv->dma_cap.addr64; + +- if (priv->dma_cap.addr64) { ++ if (priv->dma_cap.host_dma_width) { + ret = dma_set_mask_and_coherent(device, +- DMA_BIT_MASK(priv->dma_cap.addr64)); ++ DMA_BIT_MASK(priv->dma_cap.host_dma_width)); + if (!ret) { +- dev_info(priv->device, "Using %d bits DMA width\n", +- priv->dma_cap.addr64); ++ dev_info(priv->device, "Using %d/%d bits DMA host/device width\n", ++ priv->dma_cap.host_dma_width, priv->dma_cap.addr64); + + /* + * If more than 32 bits can be addressed, make sure to +@@ -7201,7 +7203,7 @@ int stmmac_dvr_probe(struct device *device, + goto error_hw_init; + } + +- priv->dma_cap.addr64 = 32; ++ priv->dma_cap.host_dma_width = 32; + } + } + +diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h +index a152678b..a2414c18 100644 +--- a/include/linux/stmmac.h ++++ b/include/linux/stmmac.h +@@ -215,7 +215,7 @@ struct plat_stmmacenet_data { + int unicast_filter_entries; + int tx_fifo_size; + int rx_fifo_size; +- u32 addr64; ++ u32 host_dma_width; + u32 rx_queues_to_use; + u32 tx_queues_to_use; + u8 rx_sched_algorithm; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-051-thermal-drivers-mellanox-Use-generic-thermal_zo.patch b/patches.kernel.org/6.2.9-051-thermal-drivers-mellanox-Use-generic-thermal_zo.patch new file mode 100644 index 0000000..f4a66c2 --- /dev/null +++ b/patches.kernel.org/6.2.9-051-thermal-drivers-mellanox-Use-generic-thermal_zo.patch @@ -0,0 +1,385 @@ +From: Daniel Lezcano +Date: Fri, 14 Oct 2022 09:32:51 +0200 +Subject: [PATCH] thermal/drivers/mellanox: Use generic thermal_zone_get_trip() + function +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 44a29a4dab73411671e0b84817a5f07e291b1501 + +[ Upstream commit 44a29a4dab73411671e0b84817a5f07e291b1501 ] + +The thermal framework gives the possibility to register the trip +points with the thermal zone. When that is done, no get_trip_* ops are +needed and they can be removed. + +Convert ops content logic into generic trip points and register them with the +thermal zone. + +Signed-off-by: Daniel Lezcano +Signed-off-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20221014073253.3719911-2-daniel.lezcano@linaro.org +Stable-dep-of: 6d206b1ea9f4 ("mlxsw: core_thermal: Fix fan speed in maximum cooling state") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../ethernet/mellanox/mlxsw/core_thermal.c | 209 ++++-------------- + 1 file changed, 48 insertions(+), 161 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c b/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c +index 987fe5c9..c5240d38 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c +@@ -36,33 +36,39 @@ enum mlxsw_thermal_trips { + MLXSW_THERMAL_TEMP_TRIP_HOT, + }; + +-struct mlxsw_thermal_trip { +- int type; +- int temp; +- int hyst; ++struct mlxsw_cooling_states { + int min_state; + int max_state; + }; + +-static const struct mlxsw_thermal_trip default_thermal_trips[] = { ++static const struct thermal_trip default_thermal_trips[] = { + { /* In range - 0-40% PWM */ + .type = THERMAL_TRIP_ACTIVE, +- .temp = MLXSW_THERMAL_ASIC_TEMP_NORM, +- .hyst = MLXSW_THERMAL_HYSTERESIS_TEMP, +- .min_state = 0, +- .max_state = (4 * MLXSW_THERMAL_MAX_STATE) / 10, ++ .temperature = MLXSW_THERMAL_ASIC_TEMP_NORM, ++ .hysteresis = MLXSW_THERMAL_HYSTERESIS_TEMP, + }, + { + /* In range - 40-100% PWM */ + .type = THERMAL_TRIP_ACTIVE, +- .temp = MLXSW_THERMAL_ASIC_TEMP_HIGH, +- .hyst = MLXSW_THERMAL_HYSTERESIS_TEMP, +- .min_state = (4 * MLXSW_THERMAL_MAX_STATE) / 10, +- .max_state = MLXSW_THERMAL_MAX_STATE, ++ .temperature = MLXSW_THERMAL_ASIC_TEMP_HIGH, ++ .hysteresis = MLXSW_THERMAL_HYSTERESIS_TEMP, + }, + { /* Warning */ + .type = THERMAL_TRIP_HOT, +- .temp = MLXSW_THERMAL_ASIC_TEMP_HOT, ++ .temperature = MLXSW_THERMAL_ASIC_TEMP_HOT, ++ }, ++}; ++ ++static const struct mlxsw_cooling_states default_cooling_states[] = { ++ { ++ .min_state = 0, ++ .max_state = (4 * MLXSW_THERMAL_MAX_STATE) / 10, ++ }, ++ { ++ .min_state = (4 * MLXSW_THERMAL_MAX_STATE) / 10, ++ .max_state = MLXSW_THERMAL_MAX_STATE, ++ }, ++ { + .min_state = MLXSW_THERMAL_MAX_STATE, + .max_state = MLXSW_THERMAL_MAX_STATE, + }, +@@ -78,7 +84,8 @@ struct mlxsw_thermal; + struct mlxsw_thermal_module { + struct mlxsw_thermal *parent; + struct thermal_zone_device *tzdev; +- struct mlxsw_thermal_trip trips[MLXSW_THERMAL_NUM_TRIPS]; ++ struct thermal_trip trips[MLXSW_THERMAL_NUM_TRIPS]; ++ struct mlxsw_cooling_states cooling_states[MLXSW_THERMAL_NUM_TRIPS]; + int module; /* Module or gearbox number */ + u8 slot_index; + }; +@@ -99,7 +106,8 @@ struct mlxsw_thermal { + int polling_delay; + struct thermal_cooling_device *cdevs[MLXSW_MFCR_PWMS_MAX]; + u8 cooling_levels[MLXSW_THERMAL_MAX_STATE + 1]; +- struct mlxsw_thermal_trip trips[MLXSW_THERMAL_NUM_TRIPS]; ++ struct thermal_trip trips[MLXSW_THERMAL_NUM_TRIPS]; ++ struct mlxsw_cooling_states cooling_states[MLXSW_THERMAL_NUM_TRIPS]; + struct mlxsw_thermal_area line_cards[]; + }; + +@@ -136,9 +144,9 @@ static int mlxsw_get_cooling_device_idx(struct mlxsw_thermal *thermal, + static void + mlxsw_thermal_module_trips_reset(struct mlxsw_thermal_module *tz) + { +- tz->trips[MLXSW_THERMAL_TEMP_TRIP_NORM].temp = 0; +- tz->trips[MLXSW_THERMAL_TEMP_TRIP_HIGH].temp = 0; +- tz->trips[MLXSW_THERMAL_TEMP_TRIP_HOT].temp = 0; ++ tz->trips[MLXSW_THERMAL_TEMP_TRIP_NORM].temperature = 0; ++ tz->trips[MLXSW_THERMAL_TEMP_TRIP_HIGH].temperature = 0; ++ tz->trips[MLXSW_THERMAL_TEMP_TRIP_HOT].temperature = 0; + } + + static int +@@ -180,12 +188,12 @@ mlxsw_thermal_module_trips_update(struct device *dev, struct mlxsw_core *core, + * by subtracting double hysteresis value. + */ + if (crit_temp >= MLXSW_THERMAL_MODULE_TEMP_SHIFT) +- tz->trips[MLXSW_THERMAL_TEMP_TRIP_NORM].temp = crit_temp - ++ tz->trips[MLXSW_THERMAL_TEMP_TRIP_NORM].temperature = crit_temp - + MLXSW_THERMAL_MODULE_TEMP_SHIFT; + else +- tz->trips[MLXSW_THERMAL_TEMP_TRIP_NORM].temp = crit_temp; +- tz->trips[MLXSW_THERMAL_TEMP_TRIP_HIGH].temp = crit_temp; +- tz->trips[MLXSW_THERMAL_TEMP_TRIP_HOT].temp = emerg_temp; ++ tz->trips[MLXSW_THERMAL_TEMP_TRIP_NORM].temperature = crit_temp; ++ tz->trips[MLXSW_THERMAL_TEMP_TRIP_HIGH].temperature = crit_temp; ++ tz->trips[MLXSW_THERMAL_TEMP_TRIP_HOT].temperature = emerg_temp; + + return 0; + } +@@ -202,11 +210,11 @@ static int mlxsw_thermal_bind(struct thermal_zone_device *tzdev, + return 0; + + for (i = 0; i < MLXSW_THERMAL_NUM_TRIPS; i++) { +- const struct mlxsw_thermal_trip *trip = &thermal->trips[i]; ++ const struct mlxsw_cooling_states *state = &thermal->cooling_states[i]; + + err = thermal_zone_bind_cooling_device(tzdev, i, cdev, +- trip->max_state, +- trip->min_state, ++ state->max_state, ++ state->min_state, + THERMAL_WEIGHT_DEFAULT); + if (err < 0) { + dev_err(dev, "Failed to bind cooling device to trip %d\n", i); +@@ -260,61 +268,6 @@ static int mlxsw_thermal_get_temp(struct thermal_zone_device *tzdev, + return 0; + } + +-static int mlxsw_thermal_get_trip_type(struct thermal_zone_device *tzdev, +- int trip, +- enum thermal_trip_type *p_type) +-{ +- struct mlxsw_thermal *thermal = tzdev->devdata; +- +- if (trip < 0 || trip >= MLXSW_THERMAL_NUM_TRIPS) +- return -EINVAL; +- +- *p_type = thermal->trips[trip].type; +- return 0; +-} +- +-static int mlxsw_thermal_get_trip_temp(struct thermal_zone_device *tzdev, +- int trip, int *p_temp) +-{ +- struct mlxsw_thermal *thermal = tzdev->devdata; +- +- if (trip < 0 || trip >= MLXSW_THERMAL_NUM_TRIPS) +- return -EINVAL; +- +- *p_temp = thermal->trips[trip].temp; +- return 0; +-} +- +-static int mlxsw_thermal_set_trip_temp(struct thermal_zone_device *tzdev, +- int trip, int temp) +-{ +- struct mlxsw_thermal *thermal = tzdev->devdata; +- +- if (trip < 0 || trip >= MLXSW_THERMAL_NUM_TRIPS) +- return -EINVAL; +- +- thermal->trips[trip].temp = temp; +- return 0; +-} +- +-static int mlxsw_thermal_get_trip_hyst(struct thermal_zone_device *tzdev, +- int trip, int *p_hyst) +-{ +- struct mlxsw_thermal *thermal = tzdev->devdata; +- +- *p_hyst = thermal->trips[trip].hyst; +- return 0; +-} +- +-static int mlxsw_thermal_set_trip_hyst(struct thermal_zone_device *tzdev, +- int trip, int hyst) +-{ +- struct mlxsw_thermal *thermal = tzdev->devdata; +- +- thermal->trips[trip].hyst = hyst; +- return 0; +-} +- + static struct thermal_zone_params mlxsw_thermal_params = { + .no_hwmon = true, + }; +@@ -323,11 +276,6 @@ static struct thermal_zone_device_ops mlxsw_thermal_ops = { + .bind = mlxsw_thermal_bind, + .unbind = mlxsw_thermal_unbind, + .get_temp = mlxsw_thermal_get_temp, +- .get_trip_type = mlxsw_thermal_get_trip_type, +- .get_trip_temp = mlxsw_thermal_get_trip_temp, +- .set_trip_temp = mlxsw_thermal_set_trip_temp, +- .get_trip_hyst = mlxsw_thermal_get_trip_hyst, +- .set_trip_hyst = mlxsw_thermal_set_trip_hyst, + }; + + static int mlxsw_thermal_module_bind(struct thermal_zone_device *tzdev, +@@ -342,11 +290,11 @@ static int mlxsw_thermal_module_bind(struct thermal_zone_device *tzdev, + return 0; + + for (i = 0; i < MLXSW_THERMAL_NUM_TRIPS; i++) { +- const struct mlxsw_thermal_trip *trip = &tz->trips[i]; ++ const struct mlxsw_cooling_states *state = &tz->cooling_states[i]; + + err = thermal_zone_bind_cooling_device(tzdev, i, cdev, +- trip->max_state, +- trip->min_state, ++ state->max_state, ++ state->min_state, + THERMAL_WEIGHT_DEFAULT); + if (err < 0) + goto err_thermal_zone_bind_cooling_device; +@@ -434,74 +382,10 @@ static int mlxsw_thermal_module_temp_get(struct thermal_zone_device *tzdev, + return 0; + } + +-static int +-mlxsw_thermal_module_trip_type_get(struct thermal_zone_device *tzdev, int trip, +- enum thermal_trip_type *p_type) +-{ +- struct mlxsw_thermal_module *tz = tzdev->devdata; +- +- if (trip < 0 || trip >= MLXSW_THERMAL_NUM_TRIPS) +- return -EINVAL; +- +- *p_type = tz->trips[trip].type; +- return 0; +-} +- +-static int +-mlxsw_thermal_module_trip_temp_get(struct thermal_zone_device *tzdev, +- int trip, int *p_temp) +-{ +- struct mlxsw_thermal_module *tz = tzdev->devdata; +- +- if (trip < 0 || trip >= MLXSW_THERMAL_NUM_TRIPS) +- return -EINVAL; +- +- *p_temp = tz->trips[trip].temp; +- return 0; +-} +- +-static int +-mlxsw_thermal_module_trip_temp_set(struct thermal_zone_device *tzdev, +- int trip, int temp) +-{ +- struct mlxsw_thermal_module *tz = tzdev->devdata; +- +- if (trip < 0 || trip >= MLXSW_THERMAL_NUM_TRIPS) +- return -EINVAL; +- +- tz->trips[trip].temp = temp; +- return 0; +-} +- +-static int +-mlxsw_thermal_module_trip_hyst_get(struct thermal_zone_device *tzdev, int trip, +- int *p_hyst) +-{ +- struct mlxsw_thermal_module *tz = tzdev->devdata; +- +- *p_hyst = tz->trips[trip].hyst; +- return 0; +-} +- +-static int +-mlxsw_thermal_module_trip_hyst_set(struct thermal_zone_device *tzdev, int trip, +- int hyst) +-{ +- struct mlxsw_thermal_module *tz = tzdev->devdata; +- +- tz->trips[trip].hyst = hyst; +- return 0; +-} +- + static struct thermal_zone_device_ops mlxsw_thermal_module_ops = { + .bind = mlxsw_thermal_module_bind, + .unbind = mlxsw_thermal_module_unbind, + .get_temp = mlxsw_thermal_module_temp_get, +- .get_trip_type = mlxsw_thermal_module_trip_type_get, +- .get_trip_temp = mlxsw_thermal_module_trip_temp_get, +- .set_trip_temp = mlxsw_thermal_module_trip_temp_set, +- .get_trip_hyst = mlxsw_thermal_module_trip_hyst_get, +- .set_trip_hyst = mlxsw_thermal_module_trip_hyst_set, + }; + + static int mlxsw_thermal_gearbox_temp_get(struct thermal_zone_device *tzdev, +@@ -531,11 +415,6 @@ static struct thermal_zone_device_ops mlxsw_thermal_gearbox_ops = { + .bind = mlxsw_thermal_module_bind, + .unbind = mlxsw_thermal_module_unbind, + .get_temp = mlxsw_thermal_gearbox_temp_get, +- .get_trip_type = mlxsw_thermal_module_trip_type_get, +- .get_trip_temp = mlxsw_thermal_module_trip_temp_get, +- .set_trip_temp = mlxsw_thermal_module_trip_temp_set, +- .get_trip_hyst = mlxsw_thermal_module_trip_hyst_get, +- .set_trip_hyst = mlxsw_thermal_module_trip_hyst_set, + }; + + static int mlxsw_thermal_get_max_state(struct thermal_cooling_device *cdev, +@@ -617,7 +496,8 @@ mlxsw_thermal_module_tz_init(struct mlxsw_thermal_module *module_tz) + else + snprintf(tz_name, sizeof(tz_name), "mlxsw-module%d", + module_tz->module + 1); +- module_tz->tzdev = thermal_zone_device_register(tz_name, ++ module_tz->tzdev = thermal_zone_device_register_with_trips(tz_name, ++ module_tz->trips, + MLXSW_THERMAL_NUM_TRIPS, + MLXSW_THERMAL_TRIP_MASK, + module_tz, +@@ -661,6 +541,8 @@ mlxsw_thermal_module_init(struct device *dev, struct mlxsw_core *core, + module_tz->parent = thermal; + memcpy(module_tz->trips, default_thermal_trips, + sizeof(thermal->trips)); ++ memcpy(module_tz->cooling_states, default_cooling_states, ++ sizeof(thermal->cooling_states)); + /* Initialize all trip point. */ + mlxsw_thermal_module_trips_reset(module_tz); + /* Read module temperature and thresholds. */ +@@ -756,7 +638,8 @@ mlxsw_thermal_gearbox_tz_init(struct mlxsw_thermal_module *gearbox_tz) + else + snprintf(tz_name, sizeof(tz_name), "mlxsw-gearbox%d", + gearbox_tz->module + 1); +- gearbox_tz->tzdev = thermal_zone_device_register(tz_name, ++ gearbox_tz->tzdev = thermal_zone_device_register_with_trips(tz_name, ++ gearbox_tz->trips, + MLXSW_THERMAL_NUM_TRIPS, + MLXSW_THERMAL_TRIP_MASK, + gearbox_tz, +@@ -813,6 +696,8 @@ mlxsw_thermal_gearboxes_init(struct device *dev, struct mlxsw_core *core, + gearbox_tz = &area->tz_gearbox_arr[i]; + memcpy(gearbox_tz->trips, default_thermal_trips, + sizeof(thermal->trips)); ++ memcpy(gearbox_tz->cooling_states, default_cooling_states, ++ sizeof(thermal->cooling_states)); + gearbox_tz->module = i; + gearbox_tz->parent = thermal; + gearbox_tz->slot_index = area->slot_index; +@@ -928,6 +813,7 @@ int mlxsw_thermal_init(struct mlxsw_core *core, + thermal->core = core; + thermal->bus_info = bus_info; + memcpy(thermal->trips, default_thermal_trips, sizeof(thermal->trips)); ++ memcpy(thermal->cooling_states, default_cooling_states, sizeof(thermal->cooling_states)); + thermal->line_cards[0].slot_index = 0; + + err = mlxsw_reg_query(thermal->core, MLXSW_REG(mfcr), mfcr_pl); +@@ -981,7 +867,8 @@ int mlxsw_thermal_init(struct mlxsw_core *core, + MLXSW_THERMAL_SLOW_POLL_INT : + MLXSW_THERMAL_POLL_INT; + +- thermal->tzdev = thermal_zone_device_register("mlxsw", ++ thermal->tzdev = thermal_zone_device_register_with_trips("mlxsw", ++ thermal->trips, + MLXSW_THERMAL_NUM_TRIPS, + MLXSW_THERMAL_TRIP_MASK, + thermal, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-052-mlxsw-core_thermal-Fix-fan-speed-in-maximum-coo.patch b/patches.kernel.org/6.2.9-052-mlxsw-core_thermal-Fix-fan-speed-in-maximum-coo.patch new file mode 100644 index 0000000..083a191 --- /dev/null +++ b/patches.kernel.org/6.2.9-052-mlxsw-core_thermal-Fix-fan-speed-in-maximum-coo.patch @@ -0,0 +1,96 @@ +From: Ido Schimmel +Date: Fri, 17 Mar 2023 16:32:59 +0100 +Subject: [PATCH] mlxsw: core_thermal: Fix fan speed in maximum cooling state +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 6d206b1ea9f48433a96edec7028586db1d947911 + +[ Upstream commit 6d206b1ea9f48433a96edec7028586db1d947911 ] + +The cooling levels array is supposed to prevent the system fans from +being configured below a 20% duty cycle as otherwise some of them get +stuck at 0 RPM. + +Due to an off-by-one error, the last element in the array was not +initialized, causing it to be set to zero, which in turn lead to fans +being configured with a 0% duty cycle in maximum cooling state. + +Since commit 332fdf951df8 ("mlxsw: thermal: Fix out-of-bounds memory +accesses") the contents of the array are static. Therefore, instead of +fixing the initialization of the array, simply remove it and adjust +thermal_cooling_device_ops::set_cur_state() so that the configured duty +cycle is never set below 20%. + +Before: + + # cat /sys/class/thermal/thermal_zone0/cdev0/type + mlxsw_fan + # echo 10 > /sys/class/thermal/thermal_zone0/cdev0/cur_state + # cat /sys/class/hwmon/hwmon0/name + mlxsw + # cat /sys/class/hwmon/hwmon0/pwm1 + 0 + +After: + + # cat /sys/class/thermal/thermal_zone0/cdev0/type + mlxsw_fan + # echo 10 > /sys/class/thermal/thermal_zone0/cdev0/cur_state + # cat /sys/class/hwmon/hwmon0/name + mlxsw + # cat /sys/class/hwmon/hwmon0/pwm1 + 255 + +This bug was uncovered when the thermal subsystem repeatedly tried to +configure the cooling devices to their maximum state due to another +issue [1]. This resulted in the fans being stuck at 0 RPM, which +eventually lead to the system undergoing thermal shutdown. + +[1] https://lore.kernel.org/netdev/ZA3CFNhU4AbtsP4G@shredder/ + +Fixes: a421ce088ac8 ("mlxsw: core: Extend cooling device with cooling levels") +Signed-off-by: Ido Schimmel +Reviewed-by: Vadim Pasternak +Signed-off-by: Petr Machata +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/mellanox/mlxsw/core_thermal.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c b/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c +index c5240d38..09ed6e5f 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c +@@ -105,7 +105,6 @@ struct mlxsw_thermal { + struct thermal_zone_device *tzdev; + int polling_delay; + struct thermal_cooling_device *cdevs[MLXSW_MFCR_PWMS_MAX]; +- u8 cooling_levels[MLXSW_THERMAL_MAX_STATE + 1]; + struct thermal_trip trips[MLXSW_THERMAL_NUM_TRIPS]; + struct mlxsw_cooling_states cooling_states[MLXSW_THERMAL_NUM_TRIPS]; + struct mlxsw_thermal_area line_cards[]; +@@ -468,7 +467,7 @@ static int mlxsw_thermal_set_cur_state(struct thermal_cooling_device *cdev, + return idx; + + /* Normalize the state to the valid speed range. */ +- state = thermal->cooling_levels[state]; ++ state = max_t(unsigned long, MLXSW_THERMAL_MIN_STATE, state); + mlxsw_reg_mfsc_pack(mfsc_pl, idx, mlxsw_state_to_duty(state)); + err = mlxsw_reg_write(thermal->core, MLXSW_REG(mfsc), mfsc_pl); + if (err) { +@@ -859,10 +858,6 @@ int mlxsw_thermal_init(struct mlxsw_core *core, + } + } + +- /* Initialize cooling levels per PWM state. */ +- for (i = 0; i < MLXSW_THERMAL_MAX_STATE; i++) +- thermal->cooling_levels[i] = max(MLXSW_THERMAL_MIN_STATE, i); +- + thermal->polling_delay = bus_info->low_frequency ? + MLXSW_THERMAL_SLOW_POLL_INT : + MLXSW_THERMAL_POLL_INT; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-053-drm-i915-fbdev-lock-the-fbdev-obj-before-vma-pi.patch b/patches.kernel.org/6.2.9-053-drm-i915-fbdev-lock-the-fbdev-obj-before-vma-pi.patch new file mode 100644 index 0000000..029b4d0 --- /dev/null +++ b/patches.kernel.org/6.2.9-053-drm-i915-fbdev-lock-the-fbdev-obj-before-vma-pi.patch @@ -0,0 +1,78 @@ +From: Tejas Upadhyay +Date: Wed, 1 Mar 2023 12:10:52 -0800 +Subject: [PATCH] drm/i915/fbdev: lock the fbdev obj before vma pin +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: ed00eba03474adbf525ff03d69705d8c78b76456 + +[ Upstream commit ed00eba03474adbf525ff03d69705d8c78b76456 ] + +lock the fbdev obj before calling into +i915_vma_pin_iomap(). This helps to solve below : + +<7>[ 93.563308] i915 0000:00:02.0: [drm:intelfb_create [i915]] no BIOS fb, allocating a new one +<4>[ 93.581844] ------------[ cut here ]------------ +<4>[ 93.581855] WARNING: CPU: 12 PID: 625 at drivers/gpu/drm/i915/gem/i915_gem_pages.c:424 i915_gem_object_pin_map+0x152/0x1c0 [i915] + +Fixes: f0b6b01b3efe ("drm/i915: Add ww context to intel_dpt_pin, v2.") +Cc: Chris Wilson +Cc: Matthew Auld +Cc: Maarten Lankhorst +Signed-off-by: Tejas Upadhyay +Signed-off-by: Radhakrishna Sripada +Reviewed-by: Andi Shyti +Link: https://patchwork.freedesktop.org/patch/msgid/20230301201053.928709-5-radhakrishna.sripada@intel.com +(cherry picked from commit 561b31acfd65502a2cda2067513240fc57ccdbdc) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/display/intel_fbdev.c | 24 ++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_fbdev.c b/drivers/gpu/drm/i915/display/intel_fbdev.c +index 17e8bf2a..3a708bd7 100644 +--- a/drivers/gpu/drm/i915/display/intel_fbdev.c ++++ b/drivers/gpu/drm/i915/display/intel_fbdev.c +@@ -210,6 +210,7 @@ static int intelfb_create(struct drm_fb_helper *helper, + bool prealloc = false; + void __iomem *vaddr; + struct drm_i915_gem_object *obj; ++ struct i915_gem_ww_ctx ww; + int ret; + + mutex_lock(&ifbdev->hpd_lock); +@@ -290,13 +291,24 @@ static int intelfb_create(struct drm_fb_helper *helper, + info->fix.smem_len = vma->size; + } + +- vaddr = i915_vma_pin_iomap(vma); +- if (IS_ERR(vaddr)) { +- drm_err(&dev_priv->drm, +- "Failed to remap framebuffer into virtual memory (%pe)\n", vaddr); +- ret = PTR_ERR(vaddr); +- goto out_unpin; ++ for_i915_gem_ww(&ww, ret, false) { ++ ret = i915_gem_object_lock(vma->obj, &ww); ++ ++ if (ret) ++ continue; ++ ++ vaddr = i915_vma_pin_iomap(vma); ++ if (IS_ERR(vaddr)) { ++ drm_err(&dev_priv->drm, ++ "Failed to remap framebuffer into virtual memory (%pe)\n", vaddr); ++ ret = PTR_ERR(vaddr); ++ continue; ++ } + } ++ ++ if (ret) ++ goto out_unpin; ++ + info->screen_base = vaddr; + info->screen_size = vma->size; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-054-drm-i915-mtl-Disable-MC6-for-MTL-A-step.patch b/patches.kernel.org/6.2.9-054-drm-i915-mtl-Disable-MC6-for-MTL-A-step.patch new file mode 100644 index 0000000..f3eed51 --- /dev/null +++ b/patches.kernel.org/6.2.9-054-drm-i915-mtl-Disable-MC6-for-MTL-A-step.patch @@ -0,0 +1,167 @@ +From: Badal Nilawar +Date: Fri, 10 Mar 2023 11:43:39 +0530 +Subject: [PATCH] drm/i915/mtl: Disable MC6 for MTL A step +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 088a422c3fa3ee9268d400078626b0c202cfe9dd + +[ Upstream commit 088a422c3fa3ee9268d400078626b0c202cfe9dd ] + +The Wa_14017073508 require to send Media Busy/Idle mailbox while +accessing Media tile. As of now it is getting handled while __gt_unpark, +__gt_park. But there are various corner cases where forcewakes are taken +without __gt_unpark i.e. without sending Busy Mailbox especially during +register reads. Forcewakes are taken without busy mailbox leads to +GPU HANG. So bringing mailbox calls under forcewake calls are no feasible +option as forcewake calls are atomic and mailbox calls are blocking. +The issue already fixed in B step so disabling MC6 on A step and +reverting previous commit which handles Wa_14017073508 + +Fixes: 8f70f1ec587d ("drm/i915/mtl: Add Wa_14017073508 for SAMedia") +Cc: Rodrigo Vivi +Signed-off-by: Badal Nilawar +Reviewed-by: Rodrigo Vivi +Signed-off-by: Anshuman Gupta +Link: https://patchwork.freedesktop.org/patch/msgid/20230310061339.2495416-2-badal.nilawar@intel.com +(cherry picked from commit 038a24835ab68f341eaa7a0e3bcc6ce0f9b22e17) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/gt/intel_gt_pm.c | 27 ----------------------- + drivers/gpu/drm/i915/gt/intel_rc6.c | 8 +++++++ + drivers/gpu/drm/i915/gt/uc/intel_guc_rc.c | 13 +---------- + drivers/gpu/drm/i915/i915_reg.h | 9 -------- + 4 files changed, 9 insertions(+), 48 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_gt_pm.c b/drivers/gpu/drm/i915/gt/intel_gt_pm.c +index 16db85fa..3fbf70a5 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gt_pm.c ++++ b/drivers/gpu/drm/i915/gt/intel_gt_pm.c +@@ -20,31 +20,10 @@ + #include "intel_rc6.h" + #include "intel_rps.h" + #include "intel_wakeref.h" +-#include "intel_pcode.h" + #include "pxp/intel_pxp_pm.h" + + #define I915_GT_SUSPEND_IDLE_TIMEOUT (HZ / 2) + +-static void mtl_media_busy(struct intel_gt *gt) +-{ +- /* Wa_14017073508: mtl */ +- if (IS_MTL_GRAPHICS_STEP(gt->i915, P, STEP_A0, STEP_B0) && +- gt->type == GT_MEDIA) +- snb_pcode_write_p(gt->uncore, PCODE_MBOX_GT_STATE, +- PCODE_MBOX_GT_STATE_MEDIA_BUSY, +- PCODE_MBOX_GT_STATE_DOMAIN_MEDIA, 0); +-} +- +-static void mtl_media_idle(struct intel_gt *gt) +-{ +- /* Wa_14017073508: mtl */ +- if (IS_MTL_GRAPHICS_STEP(gt->i915, P, STEP_A0, STEP_B0) && +- gt->type == GT_MEDIA) +- snb_pcode_write_p(gt->uncore, PCODE_MBOX_GT_STATE, +- PCODE_MBOX_GT_STATE_MEDIA_NOT_BUSY, +- PCODE_MBOX_GT_STATE_DOMAIN_MEDIA, 0); +-} +- + static void user_forcewake(struct intel_gt *gt, bool suspend) + { + int count = atomic_read(>->user_wakeref); +@@ -92,9 +71,6 @@ static int __gt_unpark(struct intel_wakeref *wf) + + GT_TRACE(gt, "\n"); + +- /* Wa_14017073508: mtl */ +- mtl_media_busy(gt); +- + /* + * It seems that the DMC likes to transition between the DC states a lot + * when there are no connected displays (no active power domains) during +@@ -144,9 +120,6 @@ static int __gt_park(struct intel_wakeref *wf) + GEM_BUG_ON(!wakeref); + intel_display_power_put_async(i915, POWER_DOMAIN_GT_IRQ, wakeref); + +- /* Wa_14017073508: mtl */ +- mtl_media_idle(gt); +- + return 0; + } + +diff --git a/drivers/gpu/drm/i915/gt/intel_rc6.c b/drivers/gpu/drm/i915/gt/intel_rc6.c +index 2ee4051e..6184fcc1 100644 +--- a/drivers/gpu/drm/i915/gt/intel_rc6.c ++++ b/drivers/gpu/drm/i915/gt/intel_rc6.c +@@ -486,6 +486,7 @@ static bool bxt_check_bios_rc6_setup(struct intel_rc6 *rc6) + static bool rc6_supported(struct intel_rc6 *rc6) + { + struct drm_i915_private *i915 = rc6_to_i915(rc6); ++ struct intel_gt *gt = rc6_to_gt(rc6); + + if (!HAS_RC6(i915)) + return false; +@@ -502,6 +503,13 @@ static bool rc6_supported(struct intel_rc6 *rc6) + return false; + } + ++ if (IS_MTL_MEDIA_STEP(gt->i915, STEP_A0, STEP_B0) && ++ gt->type == GT_MEDIA) { ++ drm_notice(&i915->drm, ++ "Media RC6 disabled on A step\n"); ++ return false; ++ } ++ + return true; + } + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_rc.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_rc.c +index b5855091..8f8dd058 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_rc.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_rc.c +@@ -11,20 +11,9 @@ + + static bool __guc_rc_supported(struct intel_guc *guc) + { +- struct intel_gt *gt = guc_to_gt(guc); +- +- /* +- * Wa_14017073508: mtl +- * Do not enable gucrc to avoid additional interrupts which +- * may disrupt pcode wa. +- */ +- if (IS_MTL_GRAPHICS_STEP(gt->i915, P, STEP_A0, STEP_B0) && +- gt->type == GT_MEDIA) +- return false; +- + /* GuC RC is unavailable for pre-Gen12 */ + return guc->submission_supported && +- GRAPHICS_VER(gt->i915) >= 12; ++ GRAPHICS_VER(guc_to_gt(guc)->i915) >= 12; + } + + static bool __guc_rc_selected(struct intel_guc *guc) +diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h +index 91617687..4f84cda3 100644 +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -6616,15 +6616,6 @@ + /* XEHP_PCODE_FREQUENCY_CONFIG param2 */ + #define PCODE_MBOX_DOMAIN_NONE 0x0 + #define PCODE_MBOX_DOMAIN_MEDIAFF 0x3 +- +-/* Wa_14017210380: mtl */ +-#define PCODE_MBOX_GT_STATE 0x50 +-/* sub-commands (param1) */ +-#define PCODE_MBOX_GT_STATE_MEDIA_BUSY 0x1 +-#define PCODE_MBOX_GT_STATE_MEDIA_NOT_BUSY 0x2 +-/* param2 */ +-#define PCODE_MBOX_GT_STATE_DOMAIN_MEDIA 0x1 +- + #define GEN6_PCODE_DATA _MMIO(0x138128) + #define GEN6_PCODE_FREQ_IA_RATIO_SHIFT 8 + #define GEN6_PCODE_FREQ_RING_RATIO_SHIFT 16 +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-055-drm-i915-guc-Rename-GuC-register-state-capture-.patch b/patches.kernel.org/6.2.9-055-drm-i915-guc-Rename-GuC-register-state-capture-.patch new file mode 100644 index 0000000..61d9789 --- /dev/null +++ b/patches.kernel.org/6.2.9-055-drm-i915-guc-Rename-GuC-register-state-capture-.patch @@ -0,0 +1,75 @@ +From: John Harrison +Date: Thu, 26 Jan 2023 16:28:42 -0800 +Subject: [PATCH] drm/i915/guc: Rename GuC register state capture node to be + more obvious +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 583ebae783b8241a30581c084ad6226051b594c5 + +[ Upstream commit 583ebae783b8241a30581c084ad6226051b594c5 ] + +The GuC specific register state entry in the error capture object was +just called 'capture'. Although the companion 'node' entry was called +'guc_capture_node'. Rename the base entry to be 'guc_capture' instead +so that it is a) more consistent and b) more obvious what it is. + +Signed-off-by: John Harrison +Reviewed-by: Daniele Ceraolo Spurio +Link: https://patchwork.freedesktop.org/patch/msgid/20230127002842.3169194-9-John.C.Harrison@Intel.com +Stable-dep-of: 8df23e4c4f72 ("drm/i915/guc: Fix missing ecodes") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/gt/uc/intel_guc_capture.c | 8 ++++---- + drivers/gpu/drm/i915/i915_gpu_error.h | 2 +- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_capture.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_capture.c +index 1c1b8507..fc3b9946 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_capture.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_capture.c +@@ -1506,7 +1506,7 @@ int intel_guc_capture_print_engine_node(struct drm_i915_error_state_buf *ebuf, + + if (!ebuf || !ee) + return -EINVAL; +- cap = ee->capture; ++ cap = ee->guc_capture; + if (!cap || !ee->engine) + return -ENODEV; + +@@ -1576,8 +1576,8 @@ void intel_guc_capture_free_node(struct intel_engine_coredump *ee) + if (!ee || !ee->guc_capture_node) + return; + +- guc_capture_add_node_to_cachelist(ee->capture, ee->guc_capture_node); +- ee->capture = NULL; ++ guc_capture_add_node_to_cachelist(ee->guc_capture, ee->guc_capture_node); ++ ee->guc_capture = NULL; + ee->guc_capture_node = NULL; + } + +@@ -1611,7 +1611,7 @@ void intel_guc_capture_get_matching_node(struct intel_gt *gt, + (ce->lrc.lrca & CTX_GTT_ADDRESS_MASK)) { + list_del(&n->link); + ee->guc_capture_node = n; +- ee->capture = guc->capture; ++ ee->guc_capture = guc->capture; + return; + } + } +diff --git a/drivers/gpu/drm/i915/i915_gpu_error.h b/drivers/gpu/drm/i915/i915_gpu_error.h +index efc75cc2..56027ffb 100644 +--- a/drivers/gpu/drm/i915/i915_gpu_error.h ++++ b/drivers/gpu/drm/i915/i915_gpu_error.h +@@ -94,7 +94,7 @@ struct intel_engine_coredump { + struct intel_instdone instdone; + + /* GuC matched capture-lists info */ +- struct intel_guc_state_capture *capture; ++ struct intel_guc_state_capture *guc_capture; + struct __guc_capture_parsed_output *guc_capture_node; + + struct i915_gem_context_coredump { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-056-drm-i915-guc-Fix-missing-ecodes.patch b/patches.kernel.org/6.2.9-056-drm-i915-guc-Fix-missing-ecodes.patch new file mode 100644 index 0000000..4100f6b --- /dev/null +++ b/patches.kernel.org/6.2.9-056-drm-i915-guc-Fix-missing-ecodes.patch @@ -0,0 +1,89 @@ +From: John Harrison +Date: Fri, 10 Mar 2023 22:37:12 -0800 +Subject: [PATCH] drm/i915/guc: Fix missing ecodes +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 8df23e4c4f72f4e201c28e6fb0a67e2dbf30628a + +[ Upstream commit 8df23e4c4f72f4e201c28e6fb0a67e2dbf30628a ] + +Error captures are tagged with an 'ecode'. This is a pseduo-unique magic +number that is meant to distinguish similar seeming bugs with +different underlying signatures. It is a combination of two ring state +registers. Unfortunately, the register state being used is only valid +in execlist mode. In GuC mode, the register state exists in a separate +list of arbitrary register address/value pairs rather than the named +entry structure. So, search through that list to find the two exciting +registers and copy them over to the structure's named members. + +v2: if else if instead of if if (Alan) + +Signed-off-by: John Harrison +Reviewed-by: Alan Previn +Fixes: a6f0f9cf330a ("drm/i915/guc: Plumb GuC-capture into gpu_coredump") +Cc: Alan Previn +Cc: Umesh Nerlige Ramappa +Cc: Lucas De Marchi +Cc: Jani Nikula +Cc: Joonas Lahtinen +Cc: Rodrigo Vivi +Cc: Tvrtko Ursulin +Cc: Matt Roper +Cc: Aravind Iddamsetty +Cc: Michael Cheng +Cc: Matthew Brost +Cc: Bruce Chang +Cc: Daniele Ceraolo Spurio +Cc: Matthew Auld +Link: https://patchwork.freedesktop.org/patch/msgid/20230311063714.570389-2-John.C.Harrison@Intel.com +(cherry picked from commit 9724ecdbb9ddd6da3260e4a442574b90fc75188a) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../gpu/drm/i915/gt/uc/intel_guc_capture.c | 22 +++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_capture.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_capture.c +index fc3b9946..710999d7 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_capture.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_capture.c +@@ -1571,6 +1571,27 @@ int intel_guc_capture_print_engine_node(struct drm_i915_error_state_buf *ebuf, + + #endif //CONFIG_DRM_I915_CAPTURE_ERROR + ++static void guc_capture_find_ecode(struct intel_engine_coredump *ee) ++{ ++ struct gcap_reg_list_info *reginfo; ++ struct guc_mmio_reg *regs; ++ i915_reg_t reg_ipehr = RING_IPEHR(0); ++ i915_reg_t reg_instdone = RING_INSTDONE(0); ++ int i; ++ ++ if (!ee->guc_capture_node) ++ return; ++ ++ reginfo = ee->guc_capture_node->reginfo + GUC_CAPTURE_LIST_TYPE_ENGINE_INSTANCE; ++ regs = reginfo->regs; ++ for (i = 0; i < reginfo->num_regs; i++) { ++ if (regs[i].offset == reg_ipehr.reg) ++ ee->ipehr = regs[i].value; ++ else if (regs[i].offset == reg_instdone.reg) ++ ee->instdone.instdone = regs[i].value; ++ } ++} ++ + void intel_guc_capture_free_node(struct intel_engine_coredump *ee) + { + if (!ee || !ee->guc_capture_node) +@@ -1612,6 +1633,7 @@ void intel_guc_capture_get_matching_node(struct intel_gt *gt, + list_del(&n->link); + ee->guc_capture_node = n; + ee->guc_capture = guc->capture; ++ guc_capture_find_ecode(ee); + return; + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-057-drm-i915-gt-perform-uc-late-init-after-probe-er.patch b/patches.kernel.org/6.2.9-057-drm-i915-gt-perform-uc-late-init-after-probe-er.patch new file mode 100644 index 0000000..4a7ee98 --- /dev/null +++ b/patches.kernel.org/6.2.9-057-drm-i915-gt-perform-uc-late-init-after-probe-er.patch @@ -0,0 +1,50 @@ +From: Andrzej Hajda +Date: Tue, 14 Mar 2023 16:19:20 +0100 +Subject: [PATCH] drm/i915/gt: perform uc late init after probe error injection +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 150784f9285e656373cf3953ef4a7663f1e1a0f2 + +[ Upstream commit 150784f9285e656373cf3953ef4a7663f1e1a0f2 ] + +Probe pseudo errors should be injected only in places where real errors +can be encountered, otherwise unwinding code can be broken. +Placing intel_uc_init_late before i915_inject_probe_error violated +this rule, resulting in following bug: +__intel_gt_disable:655 GEM_BUG_ON(intel_gt_pm_is_awake(gt)) + +Fixes: 481d458caede ("drm/i915/guc: Add golden context to GuC ADS") +Acked-by: Nirmoy Das +Reviewed-by: Andi Shyti +Signed-off-by: Andrzej Hajda +Link: https://patchwork.freedesktop.org/patch/msgid/20230314151920.1065847-1-andrzej.hajda@intel.com +(cherry picked from commit c4252a11131c7f27a158294241466e2a4e7ff94e) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/gt/intel_gt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_gt.c b/drivers/gpu/drm/i915/gt/intel_gt.c +index 9c18b5f2..7868da20 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gt.c ++++ b/drivers/gpu/drm/i915/gt/intel_gt.c +@@ -745,12 +745,12 @@ int intel_gt_init(struct intel_gt *gt) + if (err) + goto err_gt; + +- intel_uc_init_late(>->uc); +- + err = i915_inject_probe_error(gt->i915, -EIO); + if (err) + goto err_gt; + ++ intel_uc_init_late(>->uc); ++ + intel_migrate_init(>->migrate, gt); + + intel_pxp_init(>->pxp); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-058-drm-i915-Fix-format-for-perf_limit_reasons.patch b/patches.kernel.org/6.2.9-058-drm-i915-Fix-format-for-perf_limit_reasons.patch new file mode 100644 index 0000000..a37964e --- /dev/null +++ b/patches.kernel.org/6.2.9-058-drm-i915-Fix-format-for-perf_limit_reasons.patch @@ -0,0 +1,40 @@ +From: Vinay Belgaumkar +Date: Tue, 14 Mar 2023 19:29:06 -0700 +Subject: [PATCH] drm/i915: Fix format for perf_limit_reasons +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: f8d62aa8d24d9883df738e450bfe6be396e11979 + +[ Upstream commit f8d62aa8d24d9883df738e450bfe6be396e11979 ] + +Use hex format so that it is easier to decode. + +Fixes: fe5979665f64 ("drm/i915/debugfs: Add perf_limit_reasons in debugfs") +Signed-off-by: Vinay Belgaumkar +Reviewed-by: Ashutosh Dixit +Signed-off-by: John Harrison +Link: https://patchwork.freedesktop.org/patch/msgid/20230315022906.2467408-1-vinay.belgaumkar@intel.com +(cherry picked from commit 5e008ba67cb80084e99b40ccd46f9029ae421632) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/gt/intel_gt_pm_debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_gt_pm_debugfs.c b/drivers/gpu/drm/i915/gt/intel_gt_pm_debugfs.c +index 83df4cd5..80dbbef8 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gt_pm_debugfs.c ++++ b/drivers/gpu/drm/i915/gt/intel_gt_pm_debugfs.c +@@ -580,7 +580,7 @@ static bool perf_limit_reasons_eval(void *data) + } + + DEFINE_SIMPLE_ATTRIBUTE(perf_limit_reasons_fops, perf_limit_reasons_get, +- perf_limit_reasons_clear, "%llu\n"); ++ perf_limit_reasons_clear, "0x%llx\n"); + + void intel_gt_pm_debugfs_register(struct intel_gt *gt, struct dentry *root) + { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-059-drm-i915-Update-vblank-timestamping-stuff-on-se.patch b/patches.kernel.org/6.2.9-059-drm-i915-Update-vblank-timestamping-stuff-on-se.patch new file mode 100644 index 0000000..57edf2e --- /dev/null +++ b/patches.kernel.org/6.2.9-059-drm-i915-Update-vblank-timestamping-stuff-on-se.patch @@ -0,0 +1,73 @@ +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Sat, 11 Mar 2023 01:58:25 +0200 +Subject: [PATCH] drm/i915: Update vblank timestamping stuff on seamless M/N + change +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 59ad01c786a4c94afacc7feb0ab97bf8d6672a46 + +[ Upstream commit 59ad01c786a4c94afacc7feb0ab97bf8d6672a46 ] + +When we change the M/N values seamlessly during a fastset we should +also update the vblank timestamping stuff to make sure the vblank +timestamp corrections/guesstimations come out exact. + +Note that only crtc_clock and framedur_ns can actually end up +changing here during fastsets. Everything else we touch can +only change during full modesets. + +Technically we should try to do this exactly at the start of +vblank, but that would require some kind of double buffering +scheme. Let's skip that for now and just update things right +after the commit has been submitted to the hardware. This +means the information will be properly up to date when the +vblank irq handler goes to work. Only if someone ends up +querying some vblanky stuff in between the commit and start +of vblank may we see a slight discrepancy. + +Also this same problem really exists for the DRRS downclocking +stuff. But as that is supposed to be more or less transparent +to the user, and it only drops to low gear after a long delay +(1 sec currently) we probably don't have to worry about it. +Any time something is actively submitting updates DRRS will +remain in high gear and so the timestamping constants will +match the hardware state. + +Reviewed-by: Jani Nikula +Reviewed-by: Mitul Golani +Fixes: e6f29923c048 ("drm/i915: Allow M/N change during fastset on bdw+") +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20230310235828.17439-1-ville.syrjala@linux.intel.com +(cherry picked from commit 8cb1f95cca68421b08333175719fdd3615372ca8) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/display/intel_crtc.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/i915/display/intel_crtc.c b/drivers/gpu/drm/i915/display/intel_crtc.c +index 037fc140..098acef5 100644 +--- a/drivers/gpu/drm/i915/display/intel_crtc.c ++++ b/drivers/gpu/drm/i915/display/intel_crtc.c +@@ -682,6 +682,14 @@ void intel_pipe_update_end(struct intel_crtc_state *new_crtc_state) + */ + intel_vrr_send_push(new_crtc_state); + ++ /* ++ * Seamless M/N update may need to update frame timings. ++ * ++ * FIXME Should be synchronized with the start of vblank somehow... ++ */ ++ if (new_crtc_state->seamless_m_n && intel_crtc_needs_fastset(new_crtc_state)) ++ intel_crtc_update_active_timings(new_crtc_state); ++ + local_irq_enable(); + + if (intel_vgpu_active(dev_priv)) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-060-net-dsa-report-rx_bytes-unadjusted-for-ETH_HLEN.patch b/patches.kernel.org/6.2.9-060-net-dsa-report-rx_bytes-unadjusted-for-ETH_HLEN.patch new file mode 100644 index 0000000..fba4fde --- /dev/null +++ b/patches.kernel.org/6.2.9-060-net-dsa-report-rx_bytes-unadjusted-for-ETH_HLEN.patch @@ -0,0 +1,78 @@ +From: Vladimir Oltean +Date: Sat, 18 Mar 2023 01:19:00 +0200 +Subject: [PATCH] net: dsa: report rx_bytes unadjusted for ETH_HLEN +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: a8eff03545d4cef12ae66a1905627c1818a0f81a + +[ Upstream commit a8eff03545d4cef12ae66a1905627c1818a0f81a ] + +We collect the software statistics counters for RX bytes (reported to +/proc/net/dev and to ethtool -S $dev | grep 'rx_bytes: ") at a time when +skb->len has already been adjusted by the eth_type_trans() -> +skb_pull_inline(skb, ETH_HLEN) call to exclude the L2 header. + +This means that when connecting 2 DSA interfaces back to back and +sending 1 packet with length 100, the sending interface will report +tx_bytes as incrementing by 100, and the receiving interface will report +rx_bytes as incrementing by 86. + +Since accounting for that in scripts is quirky and is something that +would be DSA-specific behavior (requiring users to know that they are +running on a DSA interface in the first place), the proposal is that we +treat it as a bug and fix it. + +This design bug has always existed in DSA, according to my analysis: +commit 91da11f870f0 ("net: Distributed Switch Architecture protocol +support") also updates skb->dev->stats.rx_bytes += skb->len after the +eth_type_trans() call. Technically, prior to Florian's commit +a86d8becc3f0 ("net: dsa: Factor bottom tag receive functions"), each and +every vendor-specific tagging protocol driver open-coded the same bug, +until the buggy code was consolidated into something resembling what can +be seen now. So each and every driver should have its own Fixes: tag, +because of their different histories until the convergence point. +I'm not going to do that, for the sake of simplicity, but just blame the +oldest appearance of buggy code. + +There are 2 ways to fix the problem. One is the obvious way, and the +other is how I ended up doing it. Obvious would have been to move +dev_sw_netstats_rx_add() one line above eth_type_trans(), and below +skb_push(skb, ETH_HLEN). But DSA processing is not as simple as that. +We count the bytes after removing everything DSA-related from the +packet, to emulate what the packet's length was, on the wire, when the +user port received it. + +When eth_type_trans() executes, dsa_untag_bridge_pvid() has not run yet, +so in case the switch driver requests this behavior - commit +412a1526d067 ("net: dsa: untag the bridge pvid from rx skbs") has the +details - the obvious variant of the fix wouldn't have worked, because +the positioning there would have also counted the not-yet-stripped VLAN +header length, something which is absent from the packet as seen on the +wire (there it may be untagged, whereas software will see it as +PVID-tagged). + +Fixes: f613ed665bb3 ("net: dsa: Add support for 64-bit statistics") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/dsa/tag.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/dsa/tag.c b/net/dsa/tag.c +index b2fba1a0..5105a5ff 100644 +--- a/net/dsa/tag.c ++++ b/net/dsa/tag.c +@@ -114,7 +114,7 @@ static int dsa_switch_rcv(struct sk_buff *skb, struct net_device *dev, + skb = nskb; + } + +- dev_sw_netstats_rx_add(skb->dev, skb->len); ++ dev_sw_netstats_rx_add(skb->dev, skb->len + ETH_HLEN); + + if (dsa_skb_defer_rx_timestamp(p, skb)) + return 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-061-net-qcom-emac-Fix-use-after-free-bug-in-emac_re.patch b/patches.kernel.org/6.2.9-061-net-qcom-emac-Fix-use-after-free-bug-in-emac_re.patch new file mode 100644 index 0000000..8eddf4c --- /dev/null +++ b/patches.kernel.org/6.2.9-061-net-qcom-emac-Fix-use-after-free-bug-in-emac_re.patch @@ -0,0 +1,64 @@ +From: Zheng Wang +Date: Sat, 18 Mar 2023 16:05:26 +0800 +Subject: [PATCH] net: qcom/emac: Fix use after free bug in emac_remove due to + race condition +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 6b6bc5b8bd2d4ca9e1efa9ae0f98a0b0687ace75 + +[ Upstream commit 6b6bc5b8bd2d4ca9e1efa9ae0f98a0b0687ace75 ] + +In emac_probe, &adpt->work_thread is bound with +emac_work_thread. Then it will be started by timeout +handler emac_tx_timeout or a IRQ handler emac_isr. + +If we remove the driver which will call emac_remove + to make cleanup, there may be a unfinished work. + +The possible sequence is as follows: + +Fix it by finishing the work before cleanup in the emac_remove +and disable timeout response. + +CPU0 CPU1 + + |emac_work_thread +emac_remove | +free_netdev | +kfree(netdev); | + |emac_reinit_locked + |emac_mac_down + |//use netdev +Fixes: b9b17debc69d ("net: emac: emac gigabit ethernet controller driver") +Signed-off-by: Zheng Wang + +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/qualcomm/emac/emac.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c +index 3115b2c1..eaa50050 100644 +--- a/drivers/net/ethernet/qualcomm/emac/emac.c ++++ b/drivers/net/ethernet/qualcomm/emac/emac.c +@@ -724,9 +724,15 @@ static int emac_remove(struct platform_device *pdev) + struct net_device *netdev = dev_get_drvdata(&pdev->dev); + struct emac_adapter *adpt = netdev_priv(netdev); + ++ netif_carrier_off(netdev); ++ netif_tx_disable(netdev); ++ + unregister_netdev(netdev); + netif_napi_del(&adpt->rx_q.napi); + ++ free_irq(adpt->irq.irq, &adpt->irq); ++ cancel_work_sync(&adpt->work_thread); ++ + emac_clks_teardown(adpt); + + put_device(&adpt->phydev->mdio.dev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-062-net-usb-lan78xx-Limit-packet-length-to-skb-len.patch b/patches.kernel.org/6.2.9-062-net-usb-lan78xx-Limit-packet-length-to-skb-len.patch new file mode 100644 index 0000000..22e0ae3 --- /dev/null +++ b/patches.kernel.org/6.2.9-062-net-usb-lan78xx-Limit-packet-length-to-skb-len.patch @@ -0,0 +1,63 @@ +From: Szymon Heidrich +Date: Sat, 18 Mar 2023 10:25:52 +0100 +Subject: [PATCH] net: usb: lan78xx: Limit packet length to skb->len +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 7f247f5a2c18b3f21206cdd51193df4f38e1b9f5 + +[ Upstream commit 7f247f5a2c18b3f21206cdd51193df4f38e1b9f5 ] + +Packet length retrieved from descriptor may be larger than +the actual socket buffer length. In such case the cloned +skb passed up the network stack will leak kernel memory contents. + +Additionally prevent integer underflow when size is less than +ETH_FCS_LEN. + +Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") +Signed-off-by: Szymon Heidrich +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/usb/lan78xx.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 06848889..c458c030 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -3579,13 +3579,29 @@ static int lan78xx_rx(struct lan78xx_net *dev, struct sk_buff *skb, + size = (rx_cmd_a & RX_CMD_A_LEN_MASK_); + align_count = (4 - ((size + RXW_PADDING) % 4)) % 4; + ++ if (unlikely(size > skb->len)) { ++ netif_dbg(dev, rx_err, dev->net, ++ "size err rx_cmd_a=0x%08x\n", ++ rx_cmd_a); ++ return 0; ++ } ++ + if (unlikely(rx_cmd_a & RX_CMD_A_RED_)) { + netif_dbg(dev, rx_err, dev->net, + "Error rx_cmd_a=0x%08x", rx_cmd_a); + } else { +- u32 frame_len = size - ETH_FCS_LEN; ++ u32 frame_len; + struct sk_buff *skb2; + ++ if (unlikely(size < ETH_FCS_LEN)) { ++ netif_dbg(dev, rx_err, dev->net, ++ "size err rx_cmd_a=0x%08x\n", ++ rx_cmd_a); ++ return 0; ++ } ++ ++ frame_len = size - ETH_FCS_LEN; ++ + skb2 = napi_alloc_skb(&dev->napi, frame_len); + if (!skb2) + return 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-063-net-ps3_gelic_net-Fix-RX-sk_buff-length.patch b/patches.kernel.org/6.2.9-063-net-ps3_gelic_net-Fix-RX-sk_buff-length.patch new file mode 100644 index 0000000..3967a40 --- /dev/null +++ b/patches.kernel.org/6.2.9-063-net-ps3_gelic_net-Fix-RX-sk_buff-length.patch @@ -0,0 +1,107 @@ +From: Geoff Levand +Date: Sat, 18 Mar 2023 17:39:16 +0000 +Subject: [PATCH] net/ps3_gelic_net: Fix RX sk_buff length +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 19b3bb51c3bc288b3f2c6f8c4450b0f548320625 + +[ Upstream commit 19b3bb51c3bc288b3f2c6f8c4450b0f548320625 ] + +The Gelic Ethernet device needs to have the RX sk_buffs aligned to +GELIC_NET_RXBUF_ALIGN, and also the length of the RX sk_buffs must +be a multiple of GELIC_NET_RXBUF_ALIGN. + +The current Gelic Ethernet driver was not allocating sk_buffs large +enough to allow for this alignment. + +Also, correct the maximum and minimum MTU sizes, and add a new +preprocessor macro for the maximum frame size, GELIC_NET_MAX_FRAME. + +Fixes various randomly occurring runtime network errors. + +Fixes: 02c1889166b4 ("ps3: gigabit ethernet driver for PS3, take3") +Signed-off-by: Geoff Levand +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/toshiba/ps3_gelic_net.c | 19 ++++++++++--------- + drivers/net/ethernet/toshiba/ps3_gelic_net.h | 5 +++-- + 2 files changed, 13 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.c b/drivers/net/ethernet/toshiba/ps3_gelic_net.c +index cf8de8a7..dffd664e 100644 +--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.c ++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.c +@@ -365,26 +365,27 @@ static int gelic_card_init_chain(struct gelic_card *card, + * + * allocates a new rx skb, iommu-maps it and attaches it to the descriptor. + * Activate the descriptor state-wise ++ * ++ * Gelic RX sk_buffs must be aligned to GELIC_NET_RXBUF_ALIGN and the length ++ * must be a multiple of GELIC_NET_RXBUF_ALIGN. + */ + static int gelic_descr_prepare_rx(struct gelic_card *card, + struct gelic_descr *descr) + { ++ static const unsigned int rx_skb_size = ++ ALIGN(GELIC_NET_MAX_FRAME, GELIC_NET_RXBUF_ALIGN) + ++ GELIC_NET_RXBUF_ALIGN - 1; + int offset; +- unsigned int bufsize; + + if (gelic_descr_get_status(descr) != GELIC_DESCR_DMA_NOT_IN_USE) + dev_info(ctodev(card), "%s: ERROR status\n", __func__); +- /* we need to round up the buffer size to a multiple of 128 */ +- bufsize = ALIGN(GELIC_NET_MAX_MTU, GELIC_NET_RXBUF_ALIGN); + +- /* and we need to have it 128 byte aligned, therefore we allocate a +- * bit more */ +- descr->skb = dev_alloc_skb(bufsize + GELIC_NET_RXBUF_ALIGN - 1); ++ descr->skb = netdev_alloc_skb(*card->netdev, rx_skb_size); + if (!descr->skb) { + descr->buf_addr = 0; /* tell DMAC don't touch memory */ + return -ENOMEM; + } +- descr->buf_size = cpu_to_be32(bufsize); ++ descr->buf_size = cpu_to_be32(rx_skb_size); + descr->dmac_cmd_status = 0; + descr->result_size = 0; + descr->valid_size = 0; +@@ -397,7 +398,7 @@ static int gelic_descr_prepare_rx(struct gelic_card *card, + /* io-mmu-map the skb */ + descr->buf_addr = cpu_to_be32(dma_map_single(ctodev(card), + descr->skb->data, +- GELIC_NET_MAX_MTU, ++ GELIC_NET_MAX_FRAME, + DMA_FROM_DEVICE)); + if (!descr->buf_addr) { + dev_kfree_skb_any(descr->skb); +@@ -915,7 +916,7 @@ static void gelic_net_pass_skb_up(struct gelic_descr *descr, + data_error = be32_to_cpu(descr->data_error); + /* unmap skb buffer */ + dma_unmap_single(ctodev(card), be32_to_cpu(descr->buf_addr), +- GELIC_NET_MAX_MTU, ++ GELIC_NET_MAX_FRAME, + DMA_FROM_DEVICE); + + skb_put(skb, be32_to_cpu(descr->valid_size)? +diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.h b/drivers/net/ethernet/toshiba/ps3_gelic_net.h +index 68f324ed..0d98defb 100644 +--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.h ++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.h +@@ -19,8 +19,9 @@ + #define GELIC_NET_RX_DESCRIPTORS 128 /* num of descriptors */ + #define GELIC_NET_TX_DESCRIPTORS 128 /* num of descriptors */ + +-#define GELIC_NET_MAX_MTU VLAN_ETH_FRAME_LEN +-#define GELIC_NET_MIN_MTU VLAN_ETH_ZLEN ++#define GELIC_NET_MAX_FRAME 2312 ++#define GELIC_NET_MAX_MTU 2294 ++#define GELIC_NET_MIN_MTU 64 + #define GELIC_NET_RXBUF_ALIGN 128 + #define GELIC_CARD_RX_CSUM_DEFAULT 1 /* hw chksum */ + #define GELIC_NET_WATCHDOG_TIMEOUT 5*HZ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-064-net-ps3_gelic_net-Use-dma_mapping_error.patch b/patches.kernel.org/6.2.9-064-net-ps3_gelic_net-Use-dma_mapping_error.patch new file mode 100644 index 0000000..3bb5384 --- /dev/null +++ b/patches.kernel.org/6.2.9-064-net-ps3_gelic_net-Use-dma_mapping_error.patch @@ -0,0 +1,90 @@ +From: Geoff Levand +Date: Sat, 18 Mar 2023 17:39:16 +0000 +Subject: [PATCH] net/ps3_gelic_net: Use dma_mapping_error +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: bebe933d35a63d4f042fbf4dce4f22e689ba0fcd + +[ Upstream commit bebe933d35a63d4f042fbf4dce4f22e689ba0fcd ] + +The current Gelic Etherenet driver was checking the return value of its +dma_map_single call, and not using the dma_mapping_error() routine. + +Fixes runtime problems like these: + + DMA-API: ps3_gelic_driver sb_05: device driver failed to check map error + WARNING: CPU: 0 PID: 0 at kernel/dma/debug.c:1027 .check_unmap+0x888/0x8dc + +Fixes: 02c1889166b4 ("ps3: gigabit ethernet driver for PS3, take3") +Reviewed-by: Alexander Duyck +Signed-off-by: Geoff Levand +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/toshiba/ps3_gelic_net.c | 24 +++++++++++--------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.c b/drivers/net/ethernet/toshiba/ps3_gelic_net.c +index dffd664e..9d535ae5 100644 +--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.c ++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.c +@@ -317,15 +317,17 @@ static int gelic_card_init_chain(struct gelic_card *card, + + /* set up the hardware pointers in each descriptor */ + for (i = 0; i < no; i++, descr++) { ++ dma_addr_t cpu_addr; ++ + gelic_descr_set_status(descr, GELIC_DESCR_DMA_NOT_IN_USE); +- descr->bus_addr = +- dma_map_single(ctodev(card), descr, +- GELIC_DESCR_SIZE, +- DMA_BIDIRECTIONAL); + +- if (!descr->bus_addr) ++ cpu_addr = dma_map_single(ctodev(card), descr, ++ GELIC_DESCR_SIZE, DMA_BIDIRECTIONAL); ++ ++ if (dma_mapping_error(ctodev(card), cpu_addr)) + goto iommu_error; + ++ descr->bus_addr = cpu_to_be32(cpu_addr); + descr->next = descr + 1; + descr->prev = descr - 1; + } +@@ -375,6 +377,7 @@ static int gelic_descr_prepare_rx(struct gelic_card *card, + static const unsigned int rx_skb_size = + ALIGN(GELIC_NET_MAX_FRAME, GELIC_NET_RXBUF_ALIGN) + + GELIC_NET_RXBUF_ALIGN - 1; ++ dma_addr_t cpu_addr; + int offset; + + if (gelic_descr_get_status(descr) != GELIC_DESCR_DMA_NOT_IN_USE) +@@ -396,11 +399,10 @@ static int gelic_descr_prepare_rx(struct gelic_card *card, + if (offset) + skb_reserve(descr->skb, GELIC_NET_RXBUF_ALIGN - offset); + /* io-mmu-map the skb */ +- descr->buf_addr = cpu_to_be32(dma_map_single(ctodev(card), +- descr->skb->data, +- GELIC_NET_MAX_FRAME, +- DMA_FROM_DEVICE)); +- if (!descr->buf_addr) { ++ cpu_addr = dma_map_single(ctodev(card), descr->skb->data, ++ GELIC_NET_MAX_FRAME, DMA_FROM_DEVICE); ++ descr->buf_addr = cpu_to_be32(cpu_addr); ++ if (dma_mapping_error(ctodev(card), cpu_addr)) { + dev_kfree_skb_any(descr->skb); + descr->skb = NULL; + dev_info(ctodev(card), +@@ -780,7 +782,7 @@ static int gelic_descr_prepare_tx(struct gelic_card *card, + + buf = dma_map_single(ctodev(card), skb->data, skb->len, DMA_TO_DEVICE); + +- if (!buf) { ++ if (dma_mapping_error(ctodev(card), buf)) { + dev_err(ctodev(card), + "dma map 2 failed (%p, %i). Dropping packet\n", + skb->data, skb->len); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-065-octeontx2-vf-Add-missing-free-for-alloc_percpu.patch b/patches.kernel.org/6.2.9-065-octeontx2-vf-Add-missing-free-for-alloc_percpu.patch new file mode 100644 index 0000000..a0bd4bb --- /dev/null +++ b/patches.kernel.org/6.2.9-065-octeontx2-vf-Add-missing-free-for-alloc_percpu.patch @@ -0,0 +1,48 @@ +From: Jiasheng Jiang +Date: Fri, 17 Mar 2023 14:43:37 +0800 +Subject: [PATCH] octeontx2-vf: Add missing free for alloc_percpu +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: f038f3917baf04835ba2b7bcf2a04ac93fbf8a9c + +[ Upstream commit f038f3917baf04835ba2b7bcf2a04ac93fbf8a9c ] + +Add the free_percpu for the allocated "vf->hw.lmt_info" in order to avoid +memory leak, same as the "pf->hw.lmt_info" in +`drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c`. + +Fixes: 5c0512072f65 ("octeontx2-pf: cn10k: Use runtime allocated LMTLINE region") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Michal Swiatkowski +Acked-by: Geethasowjanya Akula +Link: https://lore.kernel.org/r/20230317064337.18198-1-jiasheng@iscas.ac.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +index 7f8ffbf7..ab126f87 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +@@ -709,6 +709,7 @@ static int otx2vf_probe(struct pci_dev *pdev, const struct pci_device_id *id) + err_ptp_destroy: + otx2_ptp_destroy(vf); + err_detach_rsrc: ++ free_percpu(vf->hw.lmt_info); + if (test_bit(CN10K_LMTST, &vf->hw.cap_flag)) + qmem_free(vf->dev, vf->dync_lmt); + otx2_detach_resources(&vf->mbox); +@@ -762,6 +763,7 @@ static void otx2vf_remove(struct pci_dev *pdev) + otx2_shutdown_tc(vf); + otx2vf_disable_mbox_intr(vf); + otx2_detach_resources(&vf->mbox); ++ free_percpu(vf->hw.lmt_info); + if (test_bit(CN10K_LMTST, &vf->hw.cap_flag)) + qmem_free(vf->dev, vf->dync_lmt); + otx2vf_vfaf_mbox_destroy(vf); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-066-bootconfig-Fix-testcase-to-increase-max-node.patch b/patches.kernel.org/6.2.9-066-bootconfig-Fix-testcase-to-increase-max-node.patch new file mode 100644 index 0000000..bcdc902 --- /dev/null +++ b/patches.kernel.org/6.2.9-066-bootconfig-Fix-testcase-to-increase-max-node.patch @@ -0,0 +1,60 @@ +From: "Masami Hiramatsu (Google)" +Date: Wed, 15 Mar 2023 22:54:08 +0900 +Subject: [PATCH] bootconfig: Fix testcase to increase max node +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: b69245126a48e50882021180fa5d264dc7149ccc + +[ Upstream commit b69245126a48e50882021180fa5d264dc7149ccc ] + +Since commit 6c40624930c5 ("bootconfig: Increase max nodes of bootconfig +from 1024 to 8192 for DCC support") increased the max number of bootconfig +node to 8192, the bootconfig testcase of the max number of nodes fails. +To fix this issue, we can not simply increase the number in the test script +because the test bootconfig file becomes too big (>32KB). To fix that, we +can use a combination of three alphabets (26^3 = 17576). But with that, +we can not express the 8193 (just one exceed from the limitation) because +it also exceeds the max size of bootconfig. So, the first 26 nodes will just +use one alphabet. + +With this fix, test-bootconfig.sh passes all tests. + +Link: https://lore.kernel.org/all/167888844790.791176.670805252426835131.stgit@devnote2/ + +Reported-by: Heinz Wiesinger +Link: https://lore.kernel.org/all/2463802.XAFRqVoOGU@amaterasu.liwjatan.org +Fixes: 6c40624930c5 ("bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support") +Signed-off-by: Masami Hiramatsu (Google) +Reviewed-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/bootconfig/test-bootconfig.sh | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/tools/bootconfig/test-bootconfig.sh b/tools/bootconfig/test-bootconfig.sh +index f68e2e9e..a2c484c2 100755 +--- a/tools/bootconfig/test-bootconfig.sh ++++ b/tools/bootconfig/test-bootconfig.sh +@@ -87,10 +87,14 @@ xfail grep -i "error" $OUTFILE + + echo "Max node number check" + +-echo -n > $TEMPCONF +-for i in `seq 1 1024` ; do +- echo "node$i" >> $TEMPCONF +-done ++awk ' ++BEGIN { ++ for (i = 0; i < 26; i += 1) ++ printf("%c\n", 65 + i % 26) ++ for (i = 26; i < 8192; i += 1) ++ printf("%c%c%c\n", 65 + i % 26, 65 + (i / 26) % 26, 65 + (i / 26 / 26)) ++} ++' > $TEMPCONF + xpass $BOOTCONF -a $TEMPCONF $INITRD + + echo "badnode" >> $TEMPCONF +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-067-keys-Do-not-cache-key-in-task-struct-if-key-is-.patch b/patches.kernel.org/6.2.9-067-keys-Do-not-cache-key-in-task-struct-if-key-is-.patch new file mode 100644 index 0000000..074a9f6 --- /dev/null +++ b/patches.kernel.org/6.2.9-067-keys-Do-not-cache-key-in-task-struct-if-key-is-.patch @@ -0,0 +1,65 @@ +From: David Howells +Date: Tue, 14 Mar 2023 15:15:18 +0000 +Subject: [PATCH] keys: Do not cache key in task struct if key is requested + from kernel thread +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 47f9e4c924025c5be87959d3335e66fcbb7f6b5c + +[ Upstream commit 47f9e4c924025c5be87959d3335e66fcbb7f6b5c ] + +The key which gets cached in task structure from a kernel thread does not +get invalidated even after expiry. Due to which, a new key request from +kernel thread will be served with the cached key if it's present in task +struct irrespective of the key validity. The change is to not cache key in +task_struct when key requested from kernel thread so that kernel thread +gets a valid key on every key request. + +The problem has been seen with the cifs module doing DNS lookups from a +kernel thread and the results getting pinned by being attached to that +kernel thread's cache - and thus not something that can be easily got rid +of. The cache would ordinarily be cleared by notify-resume, but kernel +threads don't do that. + +This isn't seen with AFS because AFS is doing request_key() within the +kernel half of a user thread - which will do notify-resume. + +Fixes: 7743c48e54ee ("keys: Cache result of request_key*() temporarily in task_struct") +Signed-off-by: Bharath SM +Signed-off-by: David Howells +Reviewed-by: Jarkko Sakkinen +cc: Shyam Prasad N +cc: Steve French +cc: keyrings@vger.kernel.org +cc: linux-cifs@vger.kernel.org +cc: linux-fsdevel@vger.kernel.org +Link: https://lore.kernel.org/r/CAGypqWw951d=zYRbdgNR4snUDvJhWL=q3=WOyh7HhSJupjz2vA@mail.gmail.com/ +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + security/keys/request_key.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/security/keys/request_key.c b/security/keys/request_key.c +index 2da44042..07a0ef2b 100644 +--- a/security/keys/request_key.c ++++ b/security/keys/request_key.c +@@ -38,9 +38,12 @@ static void cache_requested_key(struct key *key) + #ifdef CONFIG_KEYS_REQUEST_CACHE + struct task_struct *t = current; + +- key_put(t->cached_requested_key); +- t->cached_requested_key = key_get(key); +- set_tsk_thread_flag(t, TIF_NOTIFY_RESUME); ++ /* Do not cache key if it is a kernel thread */ ++ if (!(t->flags & PF_KTHREAD)) { ++ key_put(t->cached_requested_key); ++ t->cached_requested_key = key_get(key); ++ set_tsk_thread_flag(t, TIF_NOTIFY_RESUME); ++ } + #endif + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-068-ice-check-if-VF-exists-before-mode-check.patch b/patches.kernel.org/6.2.9-068-ice-check-if-VF-exists-before-mode-check.patch new file mode 100644 index 0000000..d0a1bae --- /dev/null +++ b/patches.kernel.org/6.2.9-068-ice-check-if-VF-exists-before-mode-check.patch @@ -0,0 +1,50 @@ +From: Michal Swiatkowski +Date: Fri, 10 Mar 2023 12:33:44 +0100 +Subject: [PATCH] ice: check if VF exists before mode check +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 83b49e7f63da88a1544cba2b2e40bfabb24bd203 + +[ Upstream commit 83b49e7f63da88a1544cba2b2e40bfabb24bd203 ] + +Setting trust on VF should return EINVAL when there is no VF. Move +checking for switchdev mode after checking if VF exists. + +Fixes: c54d209c78b8 ("ice: Wait for VF to be reset/ready before configuration") +Signed-off-by: Michal Swiatkowski +Signed-off-by: Kalyan Kodamagula +Tested-by: Sujai Buvaneswaran +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/intel/ice/ice_sriov.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_sriov.c b/drivers/net/ethernet/intel/ice/ice_sriov.c +index 3ba1408c..b3849bc3 100644 +--- a/drivers/net/ethernet/intel/ice/ice_sriov.c ++++ b/drivers/net/ethernet/intel/ice/ice_sriov.c +@@ -1384,15 +1384,15 @@ int ice_set_vf_trust(struct net_device *netdev, int vf_id, bool trusted) + struct ice_vf *vf; + int ret; + ++ vf = ice_get_vf_by_id(pf, vf_id); ++ if (!vf) ++ return -EINVAL; ++ + if (ice_is_eswitch_mode_switchdev(pf)) { + dev_info(ice_pf_to_dev(pf), "Trusted VF is forbidden in switchdev mode\n"); + return -EOPNOTSUPP; + } + +- vf = ice_get_vf_by_id(pf, vf_id); +- if (!vf) +- return -EINVAL; +- + ret = ice_check_vf_ready_for_cfg(vf); + if (ret) + goto out_put_vf; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-069-iavf-fix-hang-on-reboot-with-ice.patch b/patches.kernel.org/6.2.9-069-iavf-fix-hang-on-reboot-with-ice.patch new file mode 100644 index 0000000..97a5ac1 --- /dev/null +++ b/patches.kernel.org/6.2.9-069-iavf-fix-hang-on-reboot-with-ice.patch @@ -0,0 +1,89 @@ +From: Stefan Assmann +Date: Mon, 13 Mar 2023 17:06:45 +0100 +Subject: [PATCH] iavf: fix hang on reboot with ice +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 4e264be98b88a6d6f476c11087fe865696e8bef5 + +[ Upstream commit 4e264be98b88a6d6f476c11087fe865696e8bef5 ] + +When a system with E810 with existing VFs gets rebooted the following +hang may be observed. + + Pid 1 is hung in iavf_remove(), part of a network driver: + PID: 1 TASK: ffff965400e5a340 CPU: 24 COMMAND: "systemd-shutdow" + #0 [ffffaad04005fa50] __schedule at ffffffff8b3239cb + #1 [ffffaad04005fae8] schedule at ffffffff8b323e2d + #2 [ffffaad04005fb00] schedule_hrtimeout_range_clock at ffffffff8b32cebc + #3 [ffffaad04005fb80] usleep_range_state at ffffffff8b32c930 + #4 [ffffaad04005fbb0] iavf_remove at ffffffffc12b9b4c [iavf] + #5 [ffffaad04005fbf0] pci_device_remove at ffffffff8add7513 + #6 [ffffaad04005fc10] device_release_driver_internal at ffffffff8af08baa + #7 [ffffaad04005fc40] pci_stop_bus_device at ffffffff8adcc5fc + #8 [ffffaad04005fc60] pci_stop_and_remove_bus_device at ffffffff8adcc81e + #9 [ffffaad04005fc70] pci_iov_remove_virtfn at ffffffff8adf9429 + #10 [ffffaad04005fca8] sriov_disable at ffffffff8adf98e4 + #11 [ffffaad04005fcc8] ice_free_vfs at ffffffffc04bb2c8 [ice] + #12 [ffffaad04005fd10] ice_remove at ffffffffc04778fe [ice] + #13 [ffffaad04005fd38] ice_shutdown at ffffffffc0477946 [ice] + #14 [ffffaad04005fd50] pci_device_shutdown at ffffffff8add58f1 + #15 [ffffaad04005fd70] device_shutdown at ffffffff8af05386 + #16 [ffffaad04005fd98] kernel_restart at ffffffff8a92a870 + #17 [ffffaad04005fda8] __do_sys_reboot at ffffffff8a92abd6 + #18 [ffffaad04005fee0] do_syscall_64 at ffffffff8b317159 + #19 [ffffaad04005ff08] __context_tracking_enter at ffffffff8b31b6fc + #20 [ffffaad04005ff18] syscall_exit_to_user_mode at ffffffff8b31b50d + #21 [ffffaad04005ff28] do_syscall_64 at ffffffff8b317169 + #22 [ffffaad04005ff50] entry_SYSCALL_64_after_hwframe at ffffffff8b40009b + RIP: 00007f1baa5c13d7 RSP: 00007fffbcc55a98 RFLAGS: 00000202 + RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1baa5c13d7 + RDX: 0000000001234567 RSI: 0000000028121969 RDI: 00000000fee1dead + RBP: 00007fffbcc55ca0 R8: 0000000000000000 R9: 00007fffbcc54e90 + R10: 00007fffbcc55050 R11: 0000000000000202 R12: 0000000000000005 + R13: 0000000000000000 R14: 00007fffbcc55af0 R15: 0000000000000000 + ORIG_RAX: 00000000000000a9 CS: 0033 SS: 002b + +During reboot all drivers PM shutdown callbacks are invoked. +In iavf_shutdown() the adapter state is changed to __IAVF_REMOVE. +In ice_shutdown() the call chain above is executed, which at some point +calls iavf_remove(). However iavf_remove() expects the VF to be in one +of the states __IAVF_RUNNING, __IAVF_DOWN or __IAVF_INIT_FAILED. If +that's not the case it sleeps forever. +So if iavf_shutdown() gets invoked before iavf_remove() the system will +hang indefinitely because the adapter is already in state __IAVF_REMOVE. + +Fix this by returning from iavf_remove() if the state is __IAVF_REMOVE, +as we already went through iavf_shutdown(). + +Fixes: 974578017fc1 ("iavf: Add waiting so the port is initialized in remove") +Fixes: a8417330f8a5 ("iavf: Fix race condition between iavf_shutdown and iavf_remove") +Reported-by: Marius Cornea +Signed-off-by: Stefan Assmann +Reviewed-by: Michal Kubiak +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 01e73415..8bbdf66c 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -5077,6 +5077,11 @@ static void iavf_remove(struct pci_dev *pdev) + mutex_unlock(&adapter->crit_lock); + break; + } ++ /* Simply return if we already went through iavf_shutdown */ ++ if (adapter->state == __IAVF_REMOVE) { ++ mutex_unlock(&adapter->crit_lock); ++ return; ++ } + + mutex_unlock(&adapter->crit_lock); + usleep_range(500, 1000); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-070-i40e-fix-flow-director-packet-filter-programmin.patch b/patches.kernel.org/6.2.9-070-i40e-fix-flow-director-packet-filter-programmin.patch new file mode 100644 index 0000000..fbc4c28 --- /dev/null +++ b/patches.kernel.org/6.2.9-070-i40e-fix-flow-director-packet-filter-programmin.patch @@ -0,0 +1,45 @@ +From: Radoslaw Tyl +Date: Mon, 13 Mar 2023 15:07:33 +0100 +Subject: [PATCH] i40e: fix flow director packet filter programming +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: c672297bbc0e86dbf88396b8053e2fbb173f16ff + +[ Upstream commit c672297bbc0e86dbf88396b8053e2fbb173f16ff ] + +Initialize to zero structures to build a valid +Tx Packet used for the filter programming. + +Fixes: a9219b332f52 ("i40e: VLAN field for flow director") +Signed-off-by: Radoslaw Tyl +Reviewed-by: Michal Swiatkowski +Tested-by: Arpana Arland (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +index 924f972b..72b091f2 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -171,10 +171,10 @@ static char *i40e_create_dummy_packet(u8 *dummy_packet, bool ipv4, u8 l4proto, + struct i40e_fdir_filter *data) + { + bool is_vlan = !!data->vlan_tag; +- struct vlan_hdr vlan; +- struct ipv6hdr ipv6; +- struct ethhdr eth; +- struct iphdr ip; ++ struct vlan_hdr vlan = {}; ++ struct ipv6hdr ipv6 = {}; ++ struct ethhdr eth = {}; ++ struct iphdr ip = {}; + u8 *tmp; + + if (ipv4) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-071-bpf-Adjust-insufficient-default-bpf_jit_limit.patch b/patches.kernel.org/6.2.9-071-bpf-Adjust-insufficient-default-bpf_jit_limit.patch new file mode 100644 index 0000000..5d1900b --- /dev/null +++ b/patches.kernel.org/6.2.9-071-bpf-Adjust-insufficient-default-bpf_jit_limit.patch @@ -0,0 +1,79 @@ +From: Daniel Borkmann +Date: Mon, 20 Mar 2023 15:37:25 +0100 +Subject: [PATCH] bpf: Adjust insufficient default bpf_jit_limit +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 10ec8ca8ec1a2f04c4ed90897225231c58c124a7 + +[ Upstream commit 10ec8ca8ec1a2f04c4ed90897225231c58c124a7 ] + +We've seen recent AWS EKS (Kubernetes) user reports like the following: + + After upgrading EKS nodes from v20230203 to v20230217 on our 1.24 EKS + clusters after a few days a number of the nodes have containers stuck + in ContainerCreating state or liveness/readiness probes reporting the + following error: + + Readiness probe errored: rpc error: code = Unknown desc = failed to + exec in container: failed to start exec "4a11039f730203ffc003b7[...]": + OCI runtime exec failed: exec failed: unable to start container process: + unable to init seccomp: error loading seccomp filter into kernel: + error loading seccomp filter: errno 524: unknown + + However, we had not been seeing this issue on previous AMIs and it only + started to occur on v20230217 (following the upgrade from kernel 5.4 to + 5.10) with no other changes to the underlying cluster or workloads. + + We tried the suggestions from that issue (sysctl net.core.bpf_jit_limit=452534528) + which helped to immediately allow containers to be created and probes to + execute but after approximately a day the issue returned and the value + returned by cat /proc/vmallocinfo | grep bpf_jit | awk '{s+=$2} END {print s}' + was steadily increasing. + +I tested bpf tree to observe bpf_jit_charge_modmem, bpf_jit_uncharge_modmem +their sizes passed in as well as bpf_jit_current under tcpdump BPF filter, +seccomp BPF and native (e)BPF programs, and the behavior all looks sane +and expected, that is nothing "leaking" from an upstream perspective. + +The bpf_jit_limit knob was originally added in order to avoid a situation +where unprivileged applications loading BPF programs (e.g. seccomp BPF +policies) consuming all the module memory space via BPF JIT such that loading +of kernel modules would be prevented. The default limit was defined back in +2018 and while good enough back then, we are generally seeing far more BPF +consumers today. + +Adjust the limit for the BPF JIT pool from originally 1/4 to now 1/2 of the +module memory space to better reflect today's needs and avoid more users +running into potentially hard to debug issues. + +Fixes: fdadd04931c2 ("bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K") +Reported-by: Stephen Haynes +Reported-by: Lefteris Alexakis +Signed-off-by: Daniel Borkmann +Link: https://github.com/awslabs/amazon-eks-ami/issues/1179 +Link: https://github.com/awslabs/amazon-eks-ami/issues/1219 +Reviewed-by: Kuniyuki Iwashima +Link: https://lore.kernel.org/r/20230320143725.8394-1-daniel@iogearbox.net +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/bpf/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index f9c3b103..00d25e8e 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -971,7 +971,7 @@ static int __init bpf_jit_charge_init(void) + { + /* Only used as heuristic here to derive limit. */ + bpf_jit_limit_max = bpf_jit_alloc_exec_limit(); +- bpf_jit_limit = min_t(u64, round_up(bpf_jit_limit_max >> 2, ++ bpf_jit_limit = min_t(u64, round_up(bpf_jit_limit_max >> 1, + PAGE_SIZE), LONG_MAX); + return 0; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-072-net-mlx5e-Set-uplink-rep-as-NETNS_LOCAL.patch b/patches.kernel.org/6.2.9-072-net-mlx5e-Set-uplink-rep-as-NETNS_LOCAL.patch new file mode 100644 index 0000000..0afa5b5 --- /dev/null +++ b/patches.kernel.org/6.2.9-072-net-mlx5e-Set-uplink-rep-as-NETNS_LOCAL.patch @@ -0,0 +1,50 @@ +From: Gavin Li +Date: Fri, 25 Nov 2022 04:15:40 +0200 +Subject: [PATCH] net/mlx5e: Set uplink rep as NETNS_LOCAL +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: c83172b0639c8a005c0dd3b36252dc22ddd9f19c + +[ Upstream commit c83172b0639c8a005c0dd3b36252dc22ddd9f19c ] + +Previously, NETNS_LOCAL was not set for uplink representors, inconsistent +with VF representors, and allowed the uplink representor to be moved +between net namespaces and separated from the VF representors it shares +the core device with. Such usage would break the isolation model of +namespaces, as devices in different namespaces would have access to +shared memory. + +To solve this issue, set NETNS_LOCAL for uplink representors if eswitch is +in switchdev mode. + +Fixes: 7a9fb35e8c3a ("net/mlx5e: Do not reload ethernet ports when changing eswitch mode") +Signed-off-by: Gavin Li +Reviewed-by: Gavi Teitz +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index d6bcbc17..47d4b54d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -4094,8 +4094,12 @@ static netdev_features_t mlx5e_fix_features(struct net_device *netdev, + } + } + +- if (mlx5e_is_uplink_rep(priv)) ++ if (mlx5e_is_uplink_rep(priv)) { + features = mlx5e_fix_uplink_rep_features(netdev, features); ++ features |= NETIF_F_NETNS_LOCAL; ++ } else { ++ features &= ~NETIF_F_NETNS_LOCAL; ++ } + + mutex_unlock(&priv->state_lock); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-073-net-mlx5e-Block-entering-switchdev-mode-with-ns.patch b/patches.kernel.org/6.2.9-073-net-mlx5e-Block-entering-switchdev-mode-with-ns.patch new file mode 100644 index 0000000..fbe1deb --- /dev/null +++ b/patches.kernel.org/6.2.9-073-net-mlx5e-Block-entering-switchdev-mode-with-ns.patch @@ -0,0 +1,71 @@ +From: Gavin Li +Date: Thu, 9 Feb 2023 12:48:52 +0200 +Subject: [PATCH] net/mlx5e: Block entering switchdev mode with ns + inconsistency +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 662404b24a4c4d839839ed25e3097571f5938b9b + +[ Upstream commit 662404b24a4c4d839839ed25e3097571f5938b9b ] + +Upon entering switchdev mode, VF/SF representors are spawned in the +devlink instance's net namespace, whereas the PF net device transforms +into the uplink representor, remaining in the net namespace the PF net +device was in. Therefore, if a PF net device's namespace is different from +its parent devlink net namespace, entering switchdev mode can create an +illegal situation where all representors sharing the same core device +are NOT in the same net namespace. + +To avoid this issue, block entering switchdev mode for devices whose child +netdev net namespace has diverged from the parent devlink's. + +Fixes: 7768d1971de6 ("net/mlx5: E-Switch, Add control for encapsulation") +Signed-off-by: Gavin Li +Reviewed-by: Gavi Teitz +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../mellanox/mlx5/core/eswitch_offloads.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +index 3992bf63..0facc709 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +@@ -3518,6 +3518,18 @@ static int esw_inline_mode_to_devlink(u8 mlx5_mode, u8 *mode) + return 0; + } + ++static bool esw_offloads_devlink_ns_eq_netdev_ns(struct devlink *devlink) ++{ ++ struct net *devl_net, *netdev_net; ++ struct mlx5_eswitch *esw; ++ ++ esw = mlx5_devlink_eswitch_get(devlink); ++ netdev_net = dev_net(esw->dev->mlx5e_res.uplink_netdev); ++ devl_net = devlink_net(devlink); ++ ++ return net_eq(devl_net, netdev_net); ++} ++ + int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode, + struct netlink_ext_ack *extack) + { +@@ -3532,6 +3544,13 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode, + if (esw_mode_from_devlink(mode, &mlx5_mode)) + return -EINVAL; + ++ if (mode == DEVLINK_ESWITCH_MODE_SWITCHDEV && ++ !esw_offloads_devlink_ns_eq_netdev_ns(devlink)) { ++ NL_SET_ERR_MSG_MOD(extack, ++ "Can't change E-Switch mode to switchdev when netdev net namespace has diverged from the devlink's."); ++ return -EPERM; ++ } ++ + mlx5_lag_disable_change(esw->dev); + err = mlx5_esw_try_lock(esw); + if (err < 0) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-074-net-mlx5-Fix-steering-rules-cleanup.patch b/patches.kernel.org/6.2.9-074-net-mlx5-Fix-steering-rules-cleanup.patch new file mode 100644 index 0000000..6bdb498 --- /dev/null +++ b/patches.kernel.org/6.2.9-074-net-mlx5-Fix-steering-rules-cleanup.patch @@ -0,0 +1,66 @@ +From: Lama Kayal +Date: Tue, 31 Jan 2023 14:07:03 +0200 +Subject: [PATCH] net/mlx5: Fix steering rules cleanup +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 922f56e9a795d6f3dd72d3428ebdd7ee040fa855 + +[ Upstream commit 922f56e9a795d6f3dd72d3428ebdd7ee040fa855 ] + +vport's mc, uc and multicast rules are not deleted in teardown path when +EEH happens. Since the vport's promisc settings(uc, mc and all) in +firmware are reset after EEH, mlx5 driver will try to delete the above +rules in the initialization path. This cause kernel crash because these +software rules are no longer valid. + +Fix by nullifying these rules right after delete to avoid accessing any dangling +pointers. + +Call Trace: +__list_del_entry_valid+0xcc/0x100 (unreliable) +tree_put_node+0xf4/0x1b0 [mlx5_core] +tree_remove_node+0x30/0x70 [mlx5_core] +mlx5_del_flow_rules+0x14c/0x1f0 [mlx5_core] +esw_apply_vport_rx_mode+0x10c/0x200 [mlx5_core] +esw_update_vport_rx_mode+0xb4/0x180 [mlx5_core] +esw_vport_change_handle_locked+0x1ec/0x230 [mlx5_core] +esw_enable_vport+0x130/0x260 [mlx5_core] +mlx5_eswitch_enable_sriov+0x2a0/0x2f0 [mlx5_core] +mlx5_device_enable_sriov+0x74/0x440 [mlx5_core] +mlx5_load_one+0x114c/0x1550 [mlx5_core] +mlx5_pci_resume+0x68/0xf0 [mlx5_core] +eeh_report_resume+0x1a4/0x230 +eeh_pe_dev_traverse+0x98/0x170 +eeh_handle_normal_event+0x3e4/0x640 +eeh_handle_event+0x4c/0x370 +eeh_event_handler+0x14c/0x210 +kthread+0x168/0x1b0 +ret_from_kernel_thread+0x5c/0x84 + +Fixes: a35f71f27a61 ("net/mlx5: E-Switch, Implement promiscuous rx modes vf request handling") +Signed-off-by: Huy Nguyen +Signed-off-by: Lama Kayal +Reviewed-by: Tariq Toukan +Reviewed-by: Maor Dickman +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +index 9daf55e9..c8b97801 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +@@ -959,6 +959,7 @@ void mlx5_esw_vport_disable(struct mlx5_eswitch *esw, u16 vport_num) + */ + esw_vport_change_handle_locked(vport); + vport->enabled_events = 0; ++ esw_apply_vport_rx_mode(esw, vport, false, false); + esw_vport_cleanup(esw, vport); + esw->enabled_vports--; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-075-net-mlx5e-Overcome-slow-response-for-first-macs.patch b/patches.kernel.org/6.2.9-075-net-mlx5e-Overcome-slow-response-for-first-macs.patch new file mode 100644 index 0000000..2db9a05 --- /dev/null +++ b/patches.kernel.org/6.2.9-075-net-mlx5e-Overcome-slow-response-for-first-macs.patch @@ -0,0 +1,59 @@ +From: Emeel Hakim +Date: Mon, 20 Mar 2023 13:13:55 +0200 +Subject: [PATCH] net/mlx5e: Overcome slow response for first macsec ASO WQE +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 7e3fce82d945cf6e7f99034b113ff2d250d7524d + +[ Upstream commit 7e3fce82d945cf6e7f99034b113ff2d250d7524d ] + +First ASO WQE poll causes a cache miss in hardware hence the resut is +delayed. It causes to the situation where such WQE is polled earlier +than it is needed. + +Add logic to retry ASO CQ polling operation. + +Fixes: 739cfa34518e ("net/mlx5: Make ASO poll CQ usable in atomic context")  +Signed-off-by: Emeel Hakim +Reviewed-by: Leon Romanovsky +Reviewed-by: Raed Salem +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../net/ethernet/mellanox/mlx5/core/en_accel/macsec.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c +index f84f1cfc..25202cea 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c +@@ -1412,6 +1412,7 @@ static int macsec_aso_query(struct mlx5_core_dev *mdev, struct mlx5e_macsec *mac + struct mlx5e_macsec_aso *aso; + struct mlx5_aso_wqe *aso_wqe; + struct mlx5_aso *maso; ++ unsigned long expires; + int err; + + aso = &macsec->aso; +@@ -1425,7 +1426,13 @@ static int macsec_aso_query(struct mlx5_core_dev *mdev, struct mlx5e_macsec *mac + macsec_aso_build_wqe_ctrl_seg(aso, &aso_wqe->aso_ctrl, NULL); + + mlx5_aso_post_wqe(maso, false, &aso_wqe->ctrl); +- err = mlx5_aso_poll_cq(maso, false); ++ expires = jiffies + msecs_to_jiffies(10); ++ do { ++ err = mlx5_aso_poll_cq(maso, false); ++ if (err) ++ usleep_range(2, 10); ++ } while (err && time_is_after_jiffies(expires)); ++ + if (err) + goto err_out; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-076-net-mlx5-Read-the-TC-mapping-of-all-priorities-.patch b/patches.kernel.org/6.2.9-076-net-mlx5-Read-the-TC-mapping-of-all-priorities-.patch new file mode 100644 index 0000000..fd11d9b --- /dev/null +++ b/patches.kernel.org/6.2.9-076-net-mlx5-Read-the-TC-mapping-of-all-priorities-.patch @@ -0,0 +1,52 @@ +From: Maher Sanalla +Date: Wed, 15 Mar 2023 11:04:38 +0200 +Subject: [PATCH] net/mlx5: Read the TC mapping of all priorities on ETS query +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 44d553188c38ac74b799dfdcebafef2f7bb70942 + +[ Upstream commit 44d553188c38ac74b799dfdcebafef2f7bb70942 ] + +When ETS configurations are queried by the user to get the mapping +assignment between packet priority and traffic class, only priorities up +to maximum TCs are queried from QTCT register in FW to retrieve their +assigned TC, leaving the rest of the priorities mapped to the default +TC #0 which might be misleading. + +Fix by querying the TC mapping of all priorities on each ETS query, +regardless of the maximum number of TCs configured in FW. + +Fixes: 820c2c5e773d ("net/mlx5e: Read ETS settings directly from firmware") +Signed-off-by: Maher Sanalla +Reviewed-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c +index 2449731b..89de92d0 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c +@@ -117,12 +117,14 @@ static int mlx5e_dcbnl_ieee_getets(struct net_device *netdev, + if (!MLX5_CAP_GEN(priv->mdev, ets)) + return -EOPNOTSUPP; + +- ets->ets_cap = mlx5_max_tc(priv->mdev) + 1; +- for (i = 0; i < ets->ets_cap; i++) { ++ for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) { + err = mlx5_query_port_prio_tc(mdev, i, &ets->prio_tc[i]); + if (err) + return err; ++ } + ++ ets->ets_cap = mlx5_max_tc(priv->mdev) + 1; ++ for (i = 0; i < ets->ets_cap; i++) { + err = mlx5_query_port_tc_group(mdev, i, &tc_group[i]); + if (err) + return err; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-077-net-mlx5-E-Switch-Fix-an-Oops-in-error-handling.patch b/patches.kernel.org/6.2.9-077-net-mlx5-E-Switch-Fix-an-Oops-in-error-handling.patch new file mode 100644 index 0000000..eb762aa --- /dev/null +++ b/patches.kernel.org/6.2.9-077-net-mlx5-E-Switch-Fix-an-Oops-in-error-handling.patch @@ -0,0 +1,39 @@ +From: Dan Carpenter +Date: Mon, 27 Feb 2023 14:16:10 +0300 +Subject: [PATCH] net/mlx5: E-Switch, Fix an Oops in error handling code +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 640fcdbcf27fc62de9223f958ceb4e897a00e791 + +[ Upstream commit 640fcdbcf27fc62de9223f958ceb4e897a00e791 ] + +The error handling dereferences "vport". There is nothing we can do if +it is an error pointer except returning the error code. + +Fixes: 133dcfc577ea ("net/mlx5: E-Switch, Alloc and free unique metadata for match") +Signed-off-by: Dan Carpenter +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_ofld.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_ofld.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_ofld.c +index a994e71e..db578a7e 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_ofld.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_ofld.c +@@ -364,8 +364,7 @@ int mlx5_esw_acl_ingress_vport_bond_update(struct mlx5_eswitch *esw, u16 vport_n + + if (WARN_ON_ONCE(IS_ERR(vport))) { + esw_warn(esw->dev, "vport(%d) invalid!\n", vport_num); +- err = PTR_ERR(vport); +- goto out; ++ return PTR_ERR(vport); + } + + esw_acl_ingress_ofld_rules_destroy(esw, vport); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-078-net-dsa-tag_brcm-legacy-fix-daisy-chained-switc.patch b/patches.kernel.org/6.2.9-078-net-dsa-tag_brcm-legacy-fix-daisy-chained-switc.patch new file mode 100644 index 0000000..da22f55 --- /dev/null +++ b/patches.kernel.org/6.2.9-078-net-dsa-tag_brcm-legacy-fix-daisy-chained-switc.patch @@ -0,0 +1,76 @@ +From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= +Date: Sun, 19 Mar 2023 10:55:40 +0100 +Subject: [PATCH] net: dsa: tag_brcm: legacy: fix daisy-chained switches +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 032a954061afd4b7426c3eb6bfd2952ef1e9a384 + +[ Upstream commit 032a954061afd4b7426c3eb6bfd2952ef1e9a384 ] + +When BCM63xx internal switches are connected to switches with a 4-byte +Broadcom tag, it does not identify the packet as VLAN tagged, so it adds one +based on its PVID (which is likely 0). +Right now, the packet is received by the BCM63xx internal switch and the 6-byte +tag is properly processed. The next step would to decode the corresponding +4-byte tag. However, the internal switch adds an invalid VLAN tag after the +6-byte tag and the 4-byte tag handling fails. +In order to fix this we need to remove the invalid VLAN tag after the 6-byte +tag before passing it to the 4-byte tag decoding. + +Fixes: 964dbf186eaa ("net: dsa: tag_brcm: add support for legacy tags") +Signed-off-by: Álvaro Fernández Rojas +Reviewed-by: Michal Swiatkowski +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20230319095540.239064-1-noltari@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/dsa/tag_brcm.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/net/dsa/tag_brcm.c b/net/dsa/tag_brcm.c +index 10239daa..cacdafb4 100644 +--- a/net/dsa/tag_brcm.c ++++ b/net/dsa/tag_brcm.c +@@ -7,6 +7,7 @@ + + #include + #include ++#include + #include + #include + +@@ -252,6 +253,7 @@ static struct sk_buff *brcm_leg_tag_xmit(struct sk_buff *skb, + static struct sk_buff *brcm_leg_tag_rcv(struct sk_buff *skb, + struct net_device *dev) + { ++ int len = BRCM_LEG_TAG_LEN; + int source_port; + u8 *brcm_tag; + +@@ -266,12 +268,16 @@ static struct sk_buff *brcm_leg_tag_rcv(struct sk_buff *skb, + if (!skb->dev) + return NULL; + ++ /* VLAN tag is added by BCM63xx internal switch */ ++ if (netdev_uses_dsa(skb->dev)) ++ len += VLAN_HLEN; ++ + /* Remove Broadcom tag and update checksum */ +- skb_pull_rcsum(skb, BRCM_LEG_TAG_LEN); ++ skb_pull_rcsum(skb, len); + + dsa_default_offload_fwd_mark(skb); + +- dsa_strip_etype_header(skb, BRCM_LEG_TAG_LEN); ++ dsa_strip_etype_header(skb, len); + + return skb; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-079-atm-idt77252-fix-kmemleak-when-rmmod-idt77252.patch b/patches.kernel.org/6.2.9-079-atm-idt77252-fix-kmemleak-when-rmmod-idt77252.patch new file mode 100644 index 0000000..c2e238b --- /dev/null +++ b/patches.kernel.org/6.2.9-079-atm-idt77252-fix-kmemleak-when-rmmod-idt77252.patch @@ -0,0 +1,93 @@ +From: Li Zetao +Date: Mon, 20 Mar 2023 14:33:18 +0000 +Subject: [PATCH] atm: idt77252: fix kmemleak when rmmod idt77252 +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 4fe3c88552a3fbe1944426a4506a18cdeb457b5a + +[ Upstream commit 4fe3c88552a3fbe1944426a4506a18cdeb457b5a ] + +There are memory leaks reported by kmemleak: + + unreferenced object 0xffff888106500800 (size 128): + comm "modprobe", pid 1017, jiffies 4297787785 (age 67.152s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<00000000970ce626>] __kmem_cache_alloc_node+0x20c/0x380 + [<00000000fb5f78d9>] kmalloc_trace+0x2f/0xb0 + [<000000000e947e2a>] idt77252_init_one+0x2847/0x3c90 [idt77252] + [<000000006efb048e>] local_pci_probe+0xeb/0x1a0 + ... + + unreferenced object 0xffff888106500b00 (size 128): + comm "modprobe", pid 1017, jiffies 4297787785 (age 67.152s) + hex dump (first 32 bytes): + 00 20 3d 01 80 88 ff ff 00 20 3d 01 80 88 ff ff . =...... =..... + f0 23 3d 01 80 88 ff ff 00 20 3d 01 00 00 00 00 .#=...... =..... + backtrace: + [<00000000970ce626>] __kmem_cache_alloc_node+0x20c/0x380 + [<00000000fb5f78d9>] kmalloc_trace+0x2f/0xb0 + [<00000000f451c5be>] alloc_scq.constprop.0+0x4a/0x400 [idt77252] + [<00000000e6313849>] idt77252_init_one+0x28cf/0x3c90 [idt77252] + +The root cause is traced to the vc_maps which alloced in open_card_oam() +are not freed in close_card_oam(). The vc_maps are used to record +open connections, so when close a vc_map in close_card_oam(), the memory +should be freed. Moreover, the ubr0 is not closed when close a idt77252 +device, leading to the memory leak of vc_map and scq_info. + +Fix them by adding kfree in close_card_oam() and implementing new +close_card_ubr0() to close ubr0. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Li Zetao +Reviewed-by: Francois Romieu +Link: https://lore.kernel.org/r/20230320143318.2644630-1-lizetao1@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/atm/idt77252.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c +index eec0cc21..e327a022 100644 +--- a/drivers/atm/idt77252.c ++++ b/drivers/atm/idt77252.c +@@ -2909,6 +2909,7 @@ close_card_oam(struct idt77252_dev *card) + + recycle_rx_pool_skb(card, &vc->rcv.rx_pool); + } ++ kfree(vc); + } + } + } +@@ -2952,6 +2953,15 @@ open_card_ubr0(struct idt77252_dev *card) + return 0; + } + ++static void ++close_card_ubr0(struct idt77252_dev *card) ++{ ++ struct vc_map *vc = card->vcs[0]; ++ ++ free_scq(card, vc->scq); ++ kfree(vc); ++} ++ + static int + idt77252_dev_open(struct idt77252_dev *card) + { +@@ -3001,6 +3011,7 @@ static void idt77252_dev_close(struct atm_dev *dev) + struct idt77252_dev *card = dev->dev_data; + u32 conf; + ++ close_card_ubr0(card); + close_card_oam(card); + + conf = SAR_CFG_RXPTH | /* enable receive path */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-080-erspan-do-not-use-skb_mac_header-in-ndo_start_x.patch b/patches.kernel.org/6.2.9-080-erspan-do-not-use-skb_mac_header-in-ndo_start_x.patch new file mode 100644 index 0000000..9a74d8d --- /dev/null +++ b/patches.kernel.org/6.2.9-080-erspan-do-not-use-skb_mac_header-in-ndo_start_x.patch @@ -0,0 +1,123 @@ +From: Eric Dumazet +Date: Mon, 20 Mar 2023 16:34:27 +0000 +Subject: [PATCH] erspan: do not use skb_mac_header() in ndo_start_xmit() +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 8e50ed774554f93d55426039b27b1e38d7fa64d8 + +[ Upstream commit 8e50ed774554f93d55426039b27b1e38d7fa64d8 ] + +Drivers should not assume skb_mac_header(skb) == skb->data in their +ndo_start_xmit(). + +Use skb_network_offset() and skb_transport_offset() which +better describe what is needed in erspan_fb_xmit() and +ip6erspan_tunnel_xmit() + +syzbot reported: +WARNING: CPU: 0 PID: 5083 at include/linux/skbuff.h:2873 skb_mac_header include/linux/skbuff.h:2873 [inline] +WARNING: CPU: 0 PID: 5083 at include/linux/skbuff.h:2873 ip6erspan_tunnel_xmit+0x1d9c/0x2d90 net/ipv6/ip6_gre.c:962 +Modules linked in: +CPU: 0 PID: 5083 Comm: syz-executor406 Not tainted 6.3.0-rc2-syzkaller-00866-gd4671cb96fa3 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 +RIP: 0010:skb_mac_header include/linux/skbuff.h:2873 [inline] +RIP: 0010:ip6erspan_tunnel_xmit+0x1d9c/0x2d90 net/ipv6/ip6_gre.c:962 +Code: 04 02 41 01 de 84 c0 74 08 3c 03 0f 8e 1c 0a 00 00 45 89 b4 24 c8 00 00 00 c6 85 77 fe ff ff 01 e9 33 e7 ff ff e8 b4 27 a1 f8 <0f> 0b e9 b6 e7 ff ff e8 a8 27 a1 f8 49 8d bf f0 0c 00 00 48 b8 00 +RSP: 0018:ffffc90003b2f830 EFLAGS: 00010293 +RAX: 0000000000000000 RBX: 000000000000ffff RCX: 0000000000000000 +RDX: ffff888021273a80 RSI: ffffffff88e1bd4c RDI: 0000000000000003 +RBP: ffffc90003b2f9d8 R08: 0000000000000003 R09: 000000000000ffff +R10: 000000000000ffff R11: 0000000000000000 R12: ffff88802b28da00 +R13: 00000000000000d0 R14: ffff88807e25b6d0 R15: ffff888023408000 +FS: 0000555556a61300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 000055e5b11eb6e8 CR3: 0000000027c1b000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + +__netdev_start_xmit include/linux/netdevice.h:4900 [inline] +netdev_start_xmit include/linux/netdevice.h:4914 [inline] +__dev_direct_xmit+0x504/0x730 net/core/dev.c:4300 +dev_direct_xmit include/linux/netdevice.h:3088 [inline] +packet_xmit+0x20a/0x390 net/packet/af_packet.c:285 +packet_snd net/packet/af_packet.c:3075 [inline] +packet_sendmsg+0x31a0/0x5150 net/packet/af_packet.c:3107 +sock_sendmsg_nosec net/socket.c:724 [inline] +sock_sendmsg+0xde/0x190 net/socket.c:747 +__sys_sendto+0x23a/0x340 net/socket.c:2142 +__do_sys_sendto net/socket.c:2154 [inline] +__se_sys_sendto net/socket.c:2150 [inline] +__x64_sys_sendto+0xe1/0x1b0 net/socket.c:2150 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7f123aaa1039 +Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007ffc15d12058 EFLAGS: 00000246 ORIG_RAX: 000000000000002c +RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f123aaa1039 +RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 +RBP: 0000000000000000 R08: 0000000020000040 R09: 0000000000000014 +R10: 0000000000000000 R11: 0000000000000246 R12: 00007f123aa648c0 +R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000 + +Fixes: 1baf5ebf8954 ("erspan: auto detect truncated packets.") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230320163427.8096-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/ipv4/ip_gre.c | 4 ++-- + net/ipv6/ip6_gre.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index ffff46cd..e55a2026 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -552,7 +552,7 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev) + truncate = true; + } + +- nhoff = skb_network_header(skb) - skb_mac_header(skb); ++ nhoff = skb_network_offset(skb); + if (skb->protocol == htons(ETH_P_IP) && + (ntohs(ip_hdr(skb)->tot_len) > skb->len - nhoff)) + truncate = true; +@@ -561,7 +561,7 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev) + int thoff; + + if (skb_transport_header_was_set(skb)) +- thoff = skb_transport_header(skb) - skb_mac_header(skb); ++ thoff = skb_transport_offset(skb); + else + thoff = nhoff + sizeof(struct ipv6hdr); + if (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff) +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index 89f5f0f3..a4ecfc9d 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -959,7 +959,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, + truncate = true; + } + +- nhoff = skb_network_header(skb) - skb_mac_header(skb); ++ nhoff = skb_network_offset(skb); + if (skb->protocol == htons(ETH_P_IP) && + (ntohs(ip_hdr(skb)->tot_len) > skb->len - nhoff)) + truncate = true; +@@ -968,7 +968,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, + int thoff; + + if (skb_transport_header_was_set(skb)) +- thoff = skb_transport_header(skb) - skb_mac_header(skb); ++ thoff = skb_transport_offset(skb); + else + thoff = nhoff + sizeof(struct ipv6hdr); + if (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-081-net-mscc-ocelot-fix-stats-region-batching.patch b/patches.kernel.org/6.2.9-081-net-mscc-ocelot-fix-stats-region-batching.patch new file mode 100644 index 0000000..0810491 --- /dev/null +++ b/patches.kernel.org/6.2.9-081-net-mscc-ocelot-fix-stats-region-batching.patch @@ -0,0 +1,87 @@ +From: Vladimir Oltean +Date: Tue, 21 Mar 2023 03:03:23 +0200 +Subject: [PATCH] net: mscc: ocelot: fix stats region batching +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 6acc72a43eac78a309160d0a7512bbc59bcdd757 + +[ Upstream commit 6acc72a43eac78a309160d0a7512bbc59bcdd757 ] + +The blamed commit changed struct ocelot_stat_layout :: "u32 offset" to +"u32 reg". + +However, "u32 reg" is not quite a register address, but an enum +ocelot_reg, which in itself encodes an enum ocelot_target target in the +upper bits, and an index into the ocelot->map[target][] array in the +lower bits. + +So, whereas the previous code comparison between stats_layout[i].offset +and last + 1 was correct (because those "offsets" at the time were +32-bit relative addresses), the new code, comparing layout[i].reg to +last + 4 is not correct, because the "reg" here is an enum/index, not an +actual register address. + +What we want to compare are indeed register addresses, but to do that, +we need to actually go through the same motions as +__ocelot_bulk_read_ix() itself. + +With this bug, all statistics counters are deemed by +ocelot_prepare_stats_regions() as constituting their own region. +(Truncated) log on VSC9959 (Felix) below (prints added by me): + +Before: + +region of 1 contiguous counters starting with SYS:STAT:CNT[0x000] +region of 1 contiguous counters starting with SYS:STAT:CNT[0x001] +region of 1 contiguous counters starting with SYS:STAT:CNT[0x002] +... +region of 1 contiguous counters starting with SYS:STAT:CNT[0x041] +region of 1 contiguous counters starting with SYS:STAT:CNT[0x042] +region of 1 contiguous counters starting with SYS:STAT:CNT[0x080] +region of 1 contiguous counters starting with SYS:STAT:CNT[0x081] +... +region of 1 contiguous counters starting with SYS:STAT:CNT[0x0ac] +region of 1 contiguous counters starting with SYS:STAT:CNT[0x100] +region of 1 contiguous counters starting with SYS:STAT:CNT[0x101] +... +region of 1 contiguous counters starting with SYS:STAT:CNT[0x111] + +After: + +region of 67 contiguous counters starting with SYS:STAT:CNT[0x000] +region of 45 contiguous counters starting with SYS:STAT:CNT[0x080] +region of 18 contiguous counters starting with SYS:STAT:CNT[0x100] + +Since commit d87b1c08f38a ("net: mscc: ocelot: use bulk reads for +stats") intended bulking as a performance improvement, and since now, +with trivial-sized regions, performance is even worse than without +bulking at all, this could easily qualify as a performance regression. + +Fixes: d4c367650704 ("net: mscc: ocelot: keep ocelot_stat_layout by reg address, not offset") +Signed-off-by: Vladimir Oltean +Acked-by: Colin Foster +Tested-by: Colin Foster +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/mscc/ocelot_stats.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mscc/ocelot_stats.c b/drivers/net/ethernet/mscc/ocelot_stats.c +index 1478c3b2..cb196775 100644 +--- a/drivers/net/ethernet/mscc/ocelot_stats.c ++++ b/drivers/net/ethernet/mscc/ocelot_stats.c +@@ -611,7 +611,8 @@ static int ocelot_prepare_stats_regions(struct ocelot *ocelot) + if (!ocelot_stats_layout[i].reg) + continue; + +- if (region && ocelot_stats_layout[i].reg == last + 4) { ++ if (region && ocelot->map[SYS][ocelot_stats_layout[i].reg & REG_MASK] == ++ ocelot->map[SYS][last & REG_MASK] + 4) { + region->count++; + } else { + region = devm_kzalloc(ocelot->dev, sizeof(*region), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-082-net-sonic-use-dma_mapping_error-for-error-check.patch b/patches.kernel.org/6.2.9-082-net-sonic-use-dma_mapping_error-for-error-check.patch new file mode 100644 index 0000000..a919444 --- /dev/null +++ b/patches.kernel.org/6.2.9-082-net-sonic-use-dma_mapping_error-for-error-check.patch @@ -0,0 +1,50 @@ +From: Zhang Changzhong +Date: Tue, 21 Mar 2023 14:45:43 +1100 +Subject: [PATCH] net/sonic: use dma_mapping_error() for error check +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 4107b8746d93ace135b8c4da4f19bbae81db785f + +[ Upstream commit 4107b8746d93ace135b8c4da4f19bbae81db785f ] + +The DMA address returned by dma_map_single() should be checked with +dma_mapping_error(). Fix it accordingly. + +Fixes: efcce839360f ("[PATCH] macsonic/jazzsonic network drivers update") +Signed-off-by: Zhang Changzhong +Tested-by: Stan Johnson +Signed-off-by: Finn Thain +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/6645a4b5c1e364312103f48b7b36783b94e197a2.1679370343.git.fthain@linux-m68k.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/natsemi/sonic.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c +index d17d1b4f..825356ee 100644 +--- a/drivers/net/ethernet/natsemi/sonic.c ++++ b/drivers/net/ethernet/natsemi/sonic.c +@@ -292,7 +292,7 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev) + */ + + laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE); +- if (!laddr) { ++ if (dma_mapping_error(lp->device, laddr)) { + pr_err_ratelimited("%s: failed to map tx DMA buffer.\n", dev->name); + dev_kfree_skb_any(skb); + return NETDEV_TX_OK; +@@ -509,7 +509,7 @@ static bool sonic_alloc_rb(struct net_device *dev, struct sonic_local *lp, + + *new_addr = dma_map_single(lp->device, skb_put(*new_skb, SONIC_RBSIZE), + SONIC_RBSIZE, DMA_FROM_DEVICE); +- if (!*new_addr) { ++ if (dma_mapping_error(lp->device, *new_addr)) { + dev_kfree_skb(*new_skb); + *new_skb = NULL; + return false; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-083-nvme-tcp-fix-nvme_tcp_term_pdu-to-match-spec.patch b/patches.kernel.org/6.2.9-083-nvme-tcp-fix-nvme_tcp_term_pdu-to-match-spec.patch new file mode 100644 index 0000000..6bbf7cb --- /dev/null +++ b/patches.kernel.org/6.2.9-083-nvme-tcp-fix-nvme_tcp_term_pdu-to-match-spec.patch @@ -0,0 +1,45 @@ +From: Caleb Sander +Date: Mon, 20 Mar 2023 09:57:36 -0600 +Subject: [PATCH] nvme-tcp: fix nvme_tcp_term_pdu to match spec +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: aa01c67de5926fdb276793180564f172c55fb0d7 + +[ Upstream commit aa01c67de5926fdb276793180564f172c55fb0d7 ] + +The FEI field of C2HTermReq/H2CTermReq is 4 bytes but not 4-byte-aligned +in the NVMe/TCP specification (it is located at offset 10 in the PDU). +Split it into two 16-bit integers in struct nvme_tcp_term_pdu +so no padding is inserted. There should also be 10 reserved bytes after. +There are currently no users of this type. + +Fixes: fc221d05447aa6db ("nvme-tcp: Add protocol header") +Reported-by: Geert Uytterhoeven +Signed-off-by: Caleb Sander +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + include/linux/nvme-tcp.h | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/include/linux/nvme-tcp.h b/include/linux/nvme-tcp.h +index 75470159..57ebe126 100644 +--- a/include/linux/nvme-tcp.h ++++ b/include/linux/nvme-tcp.h +@@ -115,8 +115,9 @@ struct nvme_tcp_icresp_pdu { + struct nvme_tcp_term_pdu { + struct nvme_tcp_hdr hdr; + __le16 fes; +- __le32 fei; +- __u8 rsvd[8]; ++ __le16 feil; ++ __le16 feiu; ++ __u8 rsvd[10]; + }; + + /** +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-084-mlxsw-spectrum_fid-Fix-incorrect-local-port-typ.patch b/patches.kernel.org/6.2.9-084-mlxsw-spectrum_fid-Fix-incorrect-local-port-typ.patch new file mode 100644 index 0000000..8b1104d --- /dev/null +++ b/patches.kernel.org/6.2.9-084-mlxsw-spectrum_fid-Fix-incorrect-local-port-typ.patch @@ -0,0 +1,54 @@ +From: Ido Schimmel +Date: Tue, 21 Mar 2023 12:42:00 +0100 +Subject: [PATCH] mlxsw: spectrum_fid: Fix incorrect local port type +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: bb765a743377d46d8da8e7f7e5128022504741b9 + +[ Upstream commit bb765a743377d46d8da8e7f7e5128022504741b9 ] + +Local port is a 10-bit number, but it was mistakenly stored in a u8, +resulting in firmware errors when using a netdev corresponding to a +local port higher than 255. + +Fix by storing the local port in u16, as is done in the rest of the +code. + +Fixes: bf73904f5fba ("mlxsw: Add support for 802.1Q FID family") +Signed-off-by: Ido Schimmel +Reviewed-by: Danielle Ratson +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/eace1f9d96545ab8a2775db857cb7e291a9b166b.1679398549.git.petrm@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c +index 045a24ca..b6ee2d65 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c +@@ -1354,7 +1354,7 @@ static int mlxsw_sp_fid_8021q_port_vid_map(struct mlxsw_sp_fid *fid, + u16 vid) + { + struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp; +- u8 local_port = mlxsw_sp_port->local_port; ++ u16 local_port = mlxsw_sp_port->local_port; + int err; + + /* In case there are no {Port, VID} => FID mappings on the port, +@@ -1391,7 +1391,7 @@ mlxsw_sp_fid_8021q_port_vid_unmap(struct mlxsw_sp_fid *fid, + struct mlxsw_sp_port *mlxsw_sp_port, u16 vid) + { + struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp; +- u8 local_port = mlxsw_sp_port->local_port; ++ u16 local_port = mlxsw_sp_port->local_port; + + mlxsw_sp_fid_port_vid_list_del(fid, mlxsw_sp_port->local_port, vid); + mlxsw_sp_fid_evid_map(fid, local_port, vid, false); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-085-hvc-xen-prevent-concurrent-accesses-to-the-shar.patch b/patches.kernel.org/6.2.9-085-hvc-xen-prevent-concurrent-accesses-to-the-shar.patch new file mode 100644 index 0000000..e0d567f --- /dev/null +++ b/patches.kernel.org/6.2.9-085-hvc-xen-prevent-concurrent-accesses-to-the-shar.patch @@ -0,0 +1,148 @@ +From: Roger Pau Monne +Date: Wed, 30 Nov 2022 16:09:11 +0100 +Subject: [PATCH] hvc/xen: prevent concurrent accesses to the shared ring +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 6214894f49a967c749ee6c07cb00f9cede748df4 + +[ Upstream commit 6214894f49a967c749ee6c07cb00f9cede748df4 ] + +The hvc machinery registers both a console and a tty device based on +the hv ops provided by the specific implementation. Those two +interfaces however have different locks, and there's no single locks +that's shared between the tty and the console implementations, hence +the driver needs to protect itself against concurrent accesses. +Otherwise concurrent calls using the split interfaces are likely to +corrupt the ring indexes, leaving the console unusable. + +Introduce a lock to xencons_info to serialize accesses to the shared +ring. This is only required when using the shared memory console, +concurrent accesses to the hypercall based console implementation are +not an issue. + +Note the conditional logic in domU_read_console() is slightly modified +so the notify_daemon() call can be done outside of the locked region: +it's an hypercall and there's no need for it to be done with the lock +held. + +Fixes: b536b4b96230 ('xen: use the hvc console infrastructure for Xen console') +Signed-off-by: Roger Pau Monné +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20221130150919.13935-1-roger.pau@citrix.com +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/tty/hvc/hvc_xen.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c +index 5bddb2f5..98764e74 100644 +--- a/drivers/tty/hvc/hvc_xen.c ++++ b/drivers/tty/hvc/hvc_xen.c +@@ -43,6 +43,7 @@ struct xencons_info { + int irq; + int vtermno; + grant_ref_t gntref; ++ spinlock_t ring_lock; + }; + + static LIST_HEAD(xenconsoles); +@@ -89,12 +90,15 @@ static int __write_console(struct xencons_info *xencons, + XENCONS_RING_IDX cons, prod; + struct xencons_interface *intf = xencons->intf; + int sent = 0; ++ unsigned long flags; + ++ spin_lock_irqsave(&xencons->ring_lock, flags); + cons = intf->out_cons; + prod = intf->out_prod; + mb(); /* update queue values before going on */ + + if ((prod - cons) > sizeof(intf->out)) { ++ spin_unlock_irqrestore(&xencons->ring_lock, flags); + pr_err_once("xencons: Illegal ring page indices"); + return -EINVAL; + } +@@ -104,6 +108,7 @@ static int __write_console(struct xencons_info *xencons, + + wmb(); /* write ring before updating pointer */ + intf->out_prod = prod; ++ spin_unlock_irqrestore(&xencons->ring_lock, flags); + + if (sent) + notify_daemon(xencons); +@@ -146,16 +151,19 @@ static int domU_read_console(uint32_t vtermno, char *buf, int len) + int recv = 0; + struct xencons_info *xencons = vtermno_to_xencons(vtermno); + unsigned int eoiflag = 0; ++ unsigned long flags; + + if (xencons == NULL) + return -EINVAL; + intf = xencons->intf; + ++ spin_lock_irqsave(&xencons->ring_lock, flags); + cons = intf->in_cons; + prod = intf->in_prod; + mb(); /* get pointers before reading ring */ + + if ((prod - cons) > sizeof(intf->in)) { ++ spin_unlock_irqrestore(&xencons->ring_lock, flags); + pr_err_once("xencons: Illegal ring page indices"); + return -EINVAL; + } +@@ -179,10 +187,13 @@ static int domU_read_console(uint32_t vtermno, char *buf, int len) + xencons->out_cons = intf->out_cons; + xencons->out_cons_same = 0; + } ++ if (!recv && xencons->out_cons_same++ > 1) { ++ eoiflag = XEN_EOI_FLAG_SPURIOUS; ++ } ++ spin_unlock_irqrestore(&xencons->ring_lock, flags); ++ + if (recv) { + notify_daemon(xencons); +- } else if (xencons->out_cons_same++ > 1) { +- eoiflag = XEN_EOI_FLAG_SPURIOUS; + } + + xen_irq_lateeoi(xencons->irq, eoiflag); +@@ -239,6 +250,7 @@ static int xen_hvm_console_init(void) + info = kzalloc(sizeof(struct xencons_info), GFP_KERNEL); + if (!info) + return -ENOMEM; ++ spin_lock_init(&info->ring_lock); + } else if (info->intf != NULL) { + /* already configured */ + return 0; +@@ -275,6 +287,7 @@ static int xen_hvm_console_init(void) + + static int xencons_info_pv_init(struct xencons_info *info, int vtermno) + { ++ spin_lock_init(&info->ring_lock); + info->evtchn = xen_start_info->console.domU.evtchn; + /* GFN == MFN for PV guest */ + info->intf = gfn_to_virt(xen_start_info->console.domU.mfn); +@@ -325,6 +338,7 @@ static int xen_initial_domain_console_init(void) + info = kzalloc(sizeof(struct xencons_info), GFP_KERNEL); + if (!info) + return -ENOMEM; ++ spin_lock_init(&info->ring_lock); + } + + info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false); +@@ -482,6 +496,7 @@ static int xencons_probe(struct xenbus_device *dev, + info = kzalloc(sizeof(struct xencons_info), GFP_KERNEL); + if (!info) + return -ENOMEM; ++ spin_lock_init(&info->ring_lock); + dev_set_drvdata(&dev->dev, info); + info->xbdev = dev; + info->vtermno = xenbus_devid_to_vtermno(devid); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-086-ksmbd-add-low-bound-validation-to-FSCTL_SET_ZER.patch b/patches.kernel.org/6.2.9-086-ksmbd-add-low-bound-validation-to-FSCTL_SET_ZER.patch new file mode 100644 index 0000000..63c8026 --- /dev/null +++ b/patches.kernel.org/6.2.9-086-ksmbd-add-low-bound-validation-to-FSCTL_SET_ZER.patch @@ -0,0 +1,42 @@ +From: Namjae Jeon +Date: Sun, 5 Mar 2023 21:04:00 +0900 +Subject: [PATCH] ksmbd: add low bound validation to FSCTL_SET_ZERO_DATA +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 2d74ec97131b1179a373b6d521f195c84e894eb6 + +[ Upstream commit 2d74ec97131b1179a373b6d521f195c84e894eb6 ] + +Smatch static checker warning: + fs/ksmbd/smb2pdu.c:7759 smb2_ioctl() + warn: no lower bound on 'off' + +Fix unexpected result that could caused from negative off and bfz. + +Fixes: b5e5f9dfc915 ("ksmbd: check invalid FileOffset and BeyondFinalZero in FSCTL_ZERO_DATA") +Reported-by: Dan Carpenter +Signed-off-by: Namjae Jeon +Reviewed-by: Sergey Senozhatsky +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/ksmbd/smb2pdu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c +index 875eecc6..abe7ea1c 100644 +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -7770,7 +7770,7 @@ int smb2_ioctl(struct ksmbd_work *work) + + off = le64_to_cpu(zero_data->FileOffset); + bfz = le64_to_cpu(zero_data->BeyondFinalZero); +- if (off > bfz) { ++ if (off < 0 || bfz < 0 || off > bfz) { + ret = -EINVAL; + goto out; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-087-ksmbd-add-low-bound-validation-to-FSCTL_QUERY_A.patch b/patches.kernel.org/6.2.9-087-ksmbd-add-low-bound-validation-to-FSCTL_QUERY_A.patch new file mode 100644 index 0000000..106dc1c --- /dev/null +++ b/patches.kernel.org/6.2.9-087-ksmbd-add-low-bound-validation-to-FSCTL_QUERY_A.patch @@ -0,0 +1,54 @@ +From: Namjae Jeon +Date: Tue, 7 Mar 2023 21:56:07 +0900 +Subject: [PATCH] ksmbd: add low bound validation to + FSCTL_QUERY_ALLOCATED_RANGES +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 342edb60dcda7a409430359b0cac2864bb9dfe44 + +[ Upstream commit 342edb60dcda7a409430359b0cac2864bb9dfe44 ] + +Smatch static checker warning: + fs/ksmbd/vfs.c:1040 ksmbd_vfs_fqar_lseek() warn: no lower bound on 'length' + fs/ksmbd/vfs.c:1041 ksmbd_vfs_fqar_lseek() warn: no lower bound on 'start' + +Fix unexpected result that could caused from negative start and length. + +Fixes: f44158485826 ("cifsd: add file operations") +Reported-by: Dan Carpenter +Signed-off-by: Namjae Jeon +Reviewed-by: Sergey Senozhatsky +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/ksmbd/smb2pdu.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c +index abe7ea1c..b553d93a 100644 +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -7463,13 +7463,16 @@ static int fsctl_query_allocated_ranges(struct ksmbd_work *work, u64 id, + if (in_count == 0) + return -EINVAL; + ++ start = le64_to_cpu(qar_req->file_offset); ++ length = le64_to_cpu(qar_req->length); ++ ++ if (start < 0 || length < 0) ++ return -EINVAL; ++ + fp = ksmbd_lookup_fd_fast(work, id); + if (!fp) + return -ENOENT; + +- start = le64_to_cpu(qar_req->file_offset); +- length = le64_to_cpu(qar_req->length); +- + ret = ksmbd_vfs_fqar_lseek(fp, start, length, + qar_rsp, in_count, out_count); + if (ret && ret != -E2BIG) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-088-ksmbd-fix-possible-refcount-leak-in-smb2_open.patch b/patches.kernel.org/6.2.9-088-ksmbd-fix-possible-refcount-leak-in-smb2_open.patch new file mode 100644 index 0000000..c3f0326 --- /dev/null +++ b/patches.kernel.org/6.2.9-088-ksmbd-fix-possible-refcount-leak-in-smb2_open.patch @@ -0,0 +1,42 @@ +From: ChenXiaoSong +Date: Thu, 2 Mar 2023 21:58:04 +0800 +Subject: [PATCH] ksmbd: fix possible refcount leak in smb2_open() +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 2624b445544ffc1472ccabfb6ec867c199d4c95c + +[ Upstream commit 2624b445544ffc1472ccabfb6ec867c199d4c95c ] + +Reference count of acls will leak when memory allocation fails. Fix this +by adding the missing posix_acl_release(). + +Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") +Signed-off-by: ChenXiaoSong +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/ksmbd/smb2pdu.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c +index b553d93a..89724cc6 100644 +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -2996,8 +2996,11 @@ int smb2_open(struct ksmbd_work *work) + sizeof(struct smb_acl) + + sizeof(struct smb_ace) * ace_num * 2, + GFP_KERNEL); +- if (!pntsd) ++ if (!pntsd) { ++ posix_acl_release(fattr.cf_acls); ++ posix_acl_release(fattr.cf_dacls); + goto err_out; ++ } + + rc = build_sec_desc(user_ns, + pntsd, NULL, 0, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-089-Bluetooth-hci_sync-Resume-adv-with-no-RPA-when-.patch b/patches.kernel.org/6.2.9-089-Bluetooth-hci_sync-Resume-adv-with-no-RPA-when-.patch new file mode 100644 index 0000000..5c90c84 --- /dev/null +++ b/patches.kernel.org/6.2.9-089-Bluetooth-hci_sync-Resume-adv-with-no-RPA-when-.patch @@ -0,0 +1,135 @@ +From: Zhengping Jiang +Date: Tue, 21 Feb 2023 16:17:56 -0800 +Subject: [PATCH] Bluetooth: hci_sync: Resume adv with no RPA when active scan +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 3c44a431d62bf4a20d7b901f98266ae3f4676d48 + +[ Upstream commit 3c44a431d62bf4a20d7b901f98266ae3f4676d48 ] + +The address resolution should be disabled during the active scan, +so all the advertisements can reach the host. The advertising +has to be paused before disabling the address resolution, +because the advertising will prevent any changes to the resolving +list and the address resolution status. Skipping this will cause +the hci error and the discovery failure. + +According to the bluetooth specification: +"7.8.44 LE Set Address Resolution Enable command + +This command shall not be used when: +- Advertising (other than periodic advertising) is enabled, +- Scanning is enabled, or +- an HCI_LE_Create_Connection, HCI_LE_Extended_Create_Connection, or + HCI_LE_Periodic_Advertising_Create_Sync command is outstanding." + +If the host is using RPA, the controller needs to generate RPA for +the advertising, so the advertising must remain paused during the +active scan. + +If the host is not using RPA, the advertising can be resumed after +disabling the address resolution. + +Fixes: 9afc675edeeb ("Bluetooth: hci_sync: allow advertise when scan without RPA") +Signed-off-by: Zhengping Jiang +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/bluetooth/hci_sync.c | 64 +++++++++++++++++++++++++++------------- + 1 file changed, 44 insertions(+), 20 deletions(-) + +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 117eedb6..7e152e91 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -2367,6 +2367,45 @@ static int hci_resume_advertising_sync(struct hci_dev *hdev) + return err; + } + ++static int hci_pause_addr_resolution(struct hci_dev *hdev) ++{ ++ int err; ++ ++ if (!use_ll_privacy(hdev)) ++ return 0; ++ ++ if (!hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) ++ return 0; ++ ++ /* Cannot disable addr resolution if scanning is enabled or ++ * when initiating an LE connection. ++ */ ++ if (hci_dev_test_flag(hdev, HCI_LE_SCAN) || ++ hci_lookup_le_connect(hdev)) { ++ bt_dev_err(hdev, "Command not allowed when scan/LE connect"); ++ return -EPERM; ++ } ++ ++ /* Cannot disable addr resolution if advertising is enabled. */ ++ err = hci_pause_advertising_sync(hdev); ++ if (err) { ++ bt_dev_err(hdev, "Pause advertising failed: %d", err); ++ return err; ++ } ++ ++ err = hci_le_set_addr_resolution_enable_sync(hdev, 0x00); ++ if (err) ++ bt_dev_err(hdev, "Unable to disable Address Resolution: %d", ++ err); ++ ++ /* Return if address resolution is disabled and RPA is not used. */ ++ if (!err && scan_use_rpa(hdev)) ++ return err; ++ ++ hci_resume_advertising_sync(hdev); ++ return err; ++} ++ + struct sk_buff *hci_read_local_oob_data_sync(struct hci_dev *hdev, + bool extended, struct sock *sk) + { +@@ -2402,7 +2441,7 @@ static u8 hci_update_accept_list_sync(struct hci_dev *hdev) + u8 filter_policy; + int err; + +- /* Pause advertising if resolving list can be used as controllers are ++ /* Pause advertising if resolving list can be used as controllers + * cannot accept resolving list modifications while advertising. + */ + if (use_ll_privacy(hdev)) { +@@ -5394,27 +5433,12 @@ static int hci_active_scan_sync(struct hci_dev *hdev, uint16_t interval) + + cancel_interleave_scan(hdev); + +- /* Pause advertising since active scanning disables address resolution +- * which advertising depend on in order to generate its RPAs. +- */ +- if (use_ll_privacy(hdev) && hci_dev_test_flag(hdev, HCI_PRIVACY)) { +- err = hci_pause_advertising_sync(hdev); +- if (err) { +- bt_dev_err(hdev, "pause advertising failed: %d", err); +- goto failed; +- } +- } +- +- /* Disable address resolution while doing active scanning since the +- * accept list shall not be used and all reports shall reach the host +- * anyway. ++ /* Pause address resolution for active scan and stop advertising if ++ * privacy is enabled. + */ +- err = hci_le_set_addr_resolution_enable_sync(hdev, 0x00); +- if (err) { +- bt_dev_err(hdev, "Unable to disable Address Resolution: %d", +- err); ++ err = hci_pause_addr_resolution(hdev); ++ if (err) + goto failed; +- } + + /* All active scans will be done with either a resolvable private + * address (when privacy feature has been enabled) or non-resolvable +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-090-Bluetooth-hci_core-Detect-if-an-ACL-packet-is-i.patch b/patches.kernel.org/6.2.9-090-Bluetooth-hci_core-Detect-if-an-ACL-packet-is-i.patch new file mode 100644 index 0000000..e59978c --- /dev/null +++ b/patches.kernel.org/6.2.9-090-Bluetooth-hci_core-Detect-if-an-ACL-packet-is-i.patch @@ -0,0 +1,66 @@ +From: Luiz Augusto von Dentz +Date: Fri, 24 Feb 2023 15:43:31 -0800 +Subject: [PATCH] Bluetooth: hci_core: Detect if an ACL packet is in fact an + ISO packet +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 876e78104f23ce9267822757a63562a609b126c3 + +[ Upstream commit 876e78104f23ce9267822757a63562a609b126c3 ] + +Because some transports don't have a dedicated type for ISO packets +(see 14202eff214e1e941fefa0366d4c3bc4b1a0d500) they may use ACL type +when in fact they are ISO packets. + +In the past this was left for the driver to detect such thing but it +creates a problem when using the likes of btproxy when used by a VM as +the host would not be aware of the connection the guest is doing it +won't be able to detect such behavior, so this make bt_recv_frame +detect when it happens as it is the common interface to all drivers +including guest VMs. + +Fixes: 14202eff214e ("Bluetooth: btusb: Detect if an ACL packet is in fact an ISO packet") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/bluetooth/hci_core.c | 23 +++++++++++++++++++---- + 1 file changed, 19 insertions(+), 4 deletions(-) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index b65c3aab..334e3084 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -2871,10 +2871,25 @@ int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb) + return -ENXIO; + } + +- if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT && +- hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && +- hci_skb_pkt_type(skb) != HCI_SCODATA_PKT && +- hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) { ++ switch (hci_skb_pkt_type(skb)) { ++ case HCI_EVENT_PKT: ++ break; ++ case HCI_ACLDATA_PKT: ++ /* Detect if ISO packet has been sent as ACL */ ++ if (hci_conn_num(hdev, ISO_LINK)) { ++ __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle); ++ __u8 type; ++ ++ type = hci_conn_lookup_type(hdev, hci_handle(handle)); ++ if (type == ISO_LINK) ++ hci_skb_pkt_type(skb) = HCI_ISODATA_PKT; ++ } ++ break; ++ case HCI_SCODATA_PKT: ++ break; ++ case HCI_ISODATA_PKT: ++ break; ++ default: + kfree_skb(skb); + return -EINVAL; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-091-Bluetooth-btusb-Remove-detection-of-ISO-packets.patch b/patches.kernel.org/6.2.9-091-Bluetooth-btusb-Remove-detection-of-ISO-packets.patch new file mode 100644 index 0000000..1369d0c --- /dev/null +++ b/patches.kernel.org/6.2.9-091-Bluetooth-btusb-Remove-detection-of-ISO-packets.patch @@ -0,0 +1,50 @@ +From: Luiz Augusto von Dentz +Date: Fri, 24 Feb 2023 15:54:31 -0800 +Subject: [PATCH] Bluetooth: btusb: Remove detection of ISO packets over bulk +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: efe375b716c1c1c9b52a816f5b933a95421020a2 + +[ Upstream commit efe375b716c1c1c9b52a816f5b933a95421020a2 ] + +This removes the code introduced by +14202eff214e1e941fefa0366d4c3bc4b1a0d500 as hci_recv_frame is now able +to detect ACL packets that are in fact ISO packets. + +Fixes: 14202eff214e ("Bluetooth: btusb: Detect if an ACL packet is in fact an ISO packet") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/bluetooth/btusb.c | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 18bc9471..5c536151 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -1050,21 +1050,11 @@ static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count) + hci_skb_expect(skb) -= len; + + if (skb->len == HCI_ACL_HDR_SIZE) { +- __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle); + __le16 dlen = hci_acl_hdr(skb)->dlen; +- __u8 type; + + /* Complete ACL header */ + hci_skb_expect(skb) = __le16_to_cpu(dlen); + +- /* Detect if ISO packet has been sent over bulk */ +- if (hci_conn_num(data->hdev, ISO_LINK)) { +- type = hci_conn_lookup_type(data->hdev, +- hci_handle(handle)); +- if (type == ISO_LINK) +- hci_skb_pkt_type(skb) = HCI_ISODATA_PKT; +- } +- + if (skb_tailroom(skb) < hci_skb_expect(skb)) { + kfree_skb(skb); + skb = NULL; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-092-Bluetooth-ISO-fix-timestamped-HCI-ISO-data-pack.patch b/patches.kernel.org/6.2.9-092-Bluetooth-ISO-fix-timestamped-HCI-ISO-data-pack.patch new file mode 100644 index 0000000..be15150 --- /dev/null +++ b/patches.kernel.org/6.2.9-092-Bluetooth-ISO-fix-timestamped-HCI-ISO-data-pack.patch @@ -0,0 +1,67 @@ +From: Pauli Virtanen +Date: Mon, 20 Feb 2023 19:38:24 +0000 +Subject: [PATCH] Bluetooth: ISO: fix timestamped HCI ISO data packet parsing +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 2f10e40a948e8a2abe7f983df3959a333ca8955f + +[ Upstream commit 2f10e40a948e8a2abe7f983df3959a333ca8955f ] + +Use correct HCI ISO data packet header struct when the packet has +timestamp. The timestamp, when present, goes before the other fields +(Core v5.3 4E 5.4.5), so the structs are not compatible. + +Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") +Signed-off-by: Pauli Virtanen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/bluetooth/iso.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index 24444b50..8d136a730 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -1620,7 +1620,6 @@ static void iso_disconn_cfm(struct hci_conn *hcon, __u8 reason) + void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) + { + struct iso_conn *conn = hcon->iso_data; +- struct hci_iso_data_hdr *hdr; + __u16 pb, ts, len; + + if (!conn) +@@ -1642,6 +1641,8 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) + } + + if (ts) { ++ struct hci_iso_ts_data_hdr *hdr; ++ + /* TODO: add timestamp to the packet? */ + hdr = skb_pull_data(skb, HCI_ISO_TS_DATA_HDR_SIZE); + if (!hdr) { +@@ -1649,15 +1650,19 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) + goto drop; + } + ++ len = __le16_to_cpu(hdr->slen); + } else { ++ struct hci_iso_data_hdr *hdr; ++ + hdr = skb_pull_data(skb, HCI_ISO_DATA_HDR_SIZE); + if (!hdr) { + BT_ERR("Frame is too short (len %d)", skb->len); + goto drop; + } ++ ++ len = __le16_to_cpu(hdr->slen); + } + +- len = __le16_to_cpu(hdr->slen); + flags = hci_iso_data_flags(len); + len = hci_iso_data_len(len); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-093-Bluetooth-Remove-Power-on-check-from-Mesh-featu.patch b/patches.kernel.org/6.2.9-093-Bluetooth-Remove-Power-on-check-from-Mesh-featu.patch new file mode 100644 index 0000000..6a65b34 --- /dev/null +++ b/patches.kernel.org/6.2.9-093-Bluetooth-Remove-Power-on-check-from-Mesh-featu.patch @@ -0,0 +1,44 @@ +From: Brian Gix +Date: Mon, 6 Mar 2023 14:32:21 -0800 +Subject: [PATCH] Bluetooth: Remove "Power-on" check from Mesh feature +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 52dd5e964a55c98c1b0bcf5fc737a5ddd00e7d4d + +[ Upstream commit 52dd5e964a55c98c1b0bcf5fc737a5ddd00e7d4d ] + +The Bluetooth mesh experimental feature enable was requiring the +controller to be powered off in order for the Enable to work. Mesh is +supposed to be enablable regardless of the controller state, and created +an unintended requirement that the mesh daemon be started before the +classic bluetoothd daemon. + +Fixes: af6bcc1921ff ("Bluetooth: Add experimental wrapper for MGMT based mesh") +Signed-off-by: Brian Gix +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/bluetooth/mgmt.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index d2ea8e19..71b65ac6 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -4627,12 +4627,6 @@ static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev, + MGMT_OP_SET_EXP_FEATURE, + MGMT_STATUS_INVALID_INDEX); + +- /* Changes can only be made when controller is powered down */ +- if (hdev_is_powered(hdev)) +- return mgmt_cmd_status(sk, hdev->id, +- MGMT_OP_SET_EXP_FEATURE, +- MGMT_STATUS_REJECTED); +- + /* Parameters are limited to a single octet */ + if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) + return mgmt_cmd_status(sk, hdev->id, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-094-gve-Cache-link_speed-value-from-device.patch b/patches.kernel.org/6.2.9-094-gve-Cache-link_speed-value-from-device.patch new file mode 100644 index 0000000..74660a1 --- /dev/null +++ b/patches.kernel.org/6.2.9-094-gve-Cache-link_speed-value-from-device.patch @@ -0,0 +1,48 @@ +From: Joshua Washington +Date: Tue, 21 Mar 2023 10:23:32 -0700 +Subject: [PATCH] gve: Cache link_speed value from device +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 68c3e4fc8628b1487c965aabb29207249657eb5f + +[ Upstream commit 68c3e4fc8628b1487c965aabb29207249657eb5f ] + +The link speed is never changed for the uptime of a VM, and the current +implementation sends an admin queue command for each call. Admin queue +command invocations have nontrivial overhead (e.g., VM exits), which can +be disruptive to users if triggered frequently. Our telemetry data shows +that there are VMs that make frequent calls to this admin queue command. +Caching the result of the original admin queue command would eliminate +the need to send multiple admin queue commands on subsequent calls to +retrieve link speed. + +Fixes: 7e074d5a76ca ("gve: Enable Link Speed Reporting in the driver.") +Signed-off-by: Joshua Washington +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230321172332.91678-1-joshwash@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/google/gve/gve_ethtool.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/google/gve/gve_ethtool.c b/drivers/net/ethernet/google/gve/gve_ethtool.c +index ce574d09..5f814708 100644 +--- a/drivers/net/ethernet/google/gve/gve_ethtool.c ++++ b/drivers/net/ethernet/google/gve/gve_ethtool.c +@@ -537,7 +537,10 @@ static int gve_get_link_ksettings(struct net_device *netdev, + struct ethtool_link_ksettings *cmd) + { + struct gve_priv *priv = netdev_priv(netdev); +- int err = gve_adminq_report_link_speed(priv); ++ int err = 0; ++ ++ if (priv->link_speed == 0) ++ err = gve_adminq_report_link_speed(priv); + + cmd->base.speed = priv->link_speed; + return err; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-095-net-asix-fix-modprobe-sysfs-cannot-create-dupli.patch b/patches.kernel.org/6.2.9-095-net-asix-fix-modprobe-sysfs-cannot-create-dupli.patch new file mode 100644 index 0000000..8cc0bd9 --- /dev/null +++ b/patches.kernel.org/6.2.9-095-net-asix-fix-modprobe-sysfs-cannot-create-dupli.patch @@ -0,0 +1,119 @@ +From: Grant Grundler +Date: Tue, 21 Mar 2023 10:05:39 -0700 +Subject: [PATCH] net: asix: fix modprobe "sysfs: cannot create duplicate + filename" +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 8eac0095de355ee31e1b014f79f83d2cd62a2d04 + +[ Upstream commit 8eac0095de355ee31e1b014f79f83d2cd62a2d04 ] + +"modprobe asix ; rmmod asix ; modprobe asix" fails with: + sysfs: cannot create duplicate filename \ + '/devices/virtual/mdio_bus/usb-003:004' + +Issue was originally reported by Anton Lundin on 2022-06-22 (link below). + +Chrome OS team hit the same issue in Feb, 2023 when trying to find +work arounds for other issues with AX88172 devices. + +The use of devm_mdiobus_register() with usbnet devices results in the +MDIO data being associated with the USB device. When the asix driver +is unloaded, the USB device continues to exist and the corresponding +"mdiobus_unregister()" is NOT called until the USB device is unplugged +or unauthorized. So the next "modprobe asix" will fail because the MDIO +phy sysfs attributes still exist. + +The 'easy' (from a design PoV) fix is to use the non-devm variants of +mdiobus_* functions and explicitly manage this use in the asix_bind +and asix_unbind function calls. I've not explored trying to fix usbnet +initialization so devm_* stuff will work. + +Fixes: e532a096be0e5 ("net: usb: asix: ax88772: add phylib support") +Reported-by: Anton Lundin +Link: https://lore.kernel.org/netdev/20220623063649.GD23685@pengutronix.de/T/ +Tested-by: Eizan Miyamoto +Signed-off-by: Grant Grundler +Link: https://lore.kernel.org/r/20230321170539.732147-1-grundler@chromium.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/usb/asix_devices.c | 32 +++++++++++++++++++++++++++----- + 1 file changed, 27 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c +index 743cbf5d..f7cff58f 100644 +--- a/drivers/net/usb/asix_devices.c ++++ b/drivers/net/usb/asix_devices.c +@@ -666,8 +666,9 @@ static int asix_resume(struct usb_interface *intf) + static int ax88772_init_mdio(struct usbnet *dev) + { + struct asix_common_private *priv = dev->driver_priv; ++ int ret; + +- priv->mdio = devm_mdiobus_alloc(&dev->udev->dev); ++ priv->mdio = mdiobus_alloc(); + if (!priv->mdio) + return -ENOMEM; + +@@ -679,7 +680,20 @@ static int ax88772_init_mdio(struct usbnet *dev) + snprintf(priv->mdio->id, MII_BUS_ID_SIZE, "usb-%03d:%03d", + dev->udev->bus->busnum, dev->udev->devnum); + +- return devm_mdiobus_register(&dev->udev->dev, priv->mdio); ++ ret = mdiobus_register(priv->mdio); ++ if (ret) { ++ netdev_err(dev->net, "Could not register MDIO bus (err %d)\n", ret); ++ mdiobus_free(priv->mdio); ++ priv->mdio = NULL; ++ } ++ ++ return ret; ++} ++ ++static void ax88772_mdio_unregister(struct asix_common_private *priv) ++{ ++ mdiobus_unregister(priv->mdio); ++ mdiobus_free(priv->mdio); + } + + static int ax88772_init_phy(struct usbnet *dev) +@@ -896,16 +910,23 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf) + + ret = ax88772_init_mdio(dev); + if (ret) +- return ret; ++ goto mdio_err; + + ret = ax88772_phylink_setup(dev); + if (ret) +- return ret; ++ goto phylink_err; + + ret = ax88772_init_phy(dev); + if (ret) +- phylink_destroy(priv->phylink); ++ goto initphy_err; + ++ return 0; ++ ++initphy_err: ++ phylink_destroy(priv->phylink); ++phylink_err: ++ ax88772_mdio_unregister(priv); ++mdio_err: + return ret; + } + +@@ -926,6 +947,7 @@ static void ax88772_unbind(struct usbnet *dev, struct usb_interface *intf) + phylink_disconnect_phy(priv->phylink); + rtnl_unlock(); + phylink_destroy(priv->phylink); ++ ax88772_mdio_unregister(priv); + asix_rx_fixup_common_free(dev->driver_priv); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-096-net-dsa-mt7530-move-enabling-disabling-core-clo.patch b/patches.kernel.org/6.2.9-096-net-dsa-mt7530-move-enabling-disabling-core-clo.patch new file mode 100644 index 0000000..6cc3a58 --- /dev/null +++ b/patches.kernel.org/6.2.9-096-net-dsa-mt7530-move-enabling-disabling-core-clo.patch @@ -0,0 +1,92 @@ +From: =?UTF-8?q?Ar=C4=B1n=C3=A7=20=C3=9CNAL?= +Date: Mon, 20 Mar 2023 22:05:18 +0300 +Subject: [PATCH] net: dsa: mt7530: move enabling disabling core clock to + mt7530_pll_setup() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 8f058a6ef99f0b88a177b58cc46a44ff5112e40a + +[ Upstream commit 8f058a6ef99f0b88a177b58cc46a44ff5112e40a ] + +Split the code that enables and disables TRGMII clocks and core clock. +Move enabling and disabling core clock to mt7530_pll_setup() as it's +supposed to be run there. + +Add 20 ms delay before enabling the core clock as seen on the U-Boot +MediaTek ethernet driver. + +Change the comment for enabling and disabling TRGMII clocks as the code +seems to affect both TXC and RXC. + +Tested rgmii and trgmii modes of port 6 and rgmii mode of port 5 on MCM +MT7530 on MT7621AT Unielec U7621-06 and standalone MT7530 on MT7623NI +Bananapi BPI-R2. + +Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") +Link: https://source.denx.de/u-boot/u-boot/-/blob/29a48bf9ccba45a5e560bb564bbe76e42629325f/drivers/net/mtk_eth.c#L589 +Tested-by: Arınç ÜNAL +Signed-off-by: Arınç ÜNAL +Link: https://lore.kernel.org/r/20230320190520.124513-1-arinc.unal@arinc9.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/dsa/mt7530.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index 178e5a34..cd0ea03c 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -396,6 +396,9 @@ mt7530_fdb_write(struct mt7530_priv *priv, u16 vid, + /* Set up switch core clock for MT7530 */ + static void mt7530_pll_setup(struct mt7530_priv *priv) + { ++ /* Disable core clock */ ++ core_clear(priv, CORE_TRGMII_GSW_CLK_CG, REG_GSWCK_EN); ++ + /* Disable PLL */ + core_write(priv, CORE_GSWPLL_GRP1, 0); + +@@ -409,6 +412,11 @@ static void mt7530_pll_setup(struct mt7530_priv *priv) + RG_GSWPLL_EN_PRE | + RG_GSWPLL_POSDIV_200M(2) | + RG_GSWPLL_FBKDIV_200M(32)); ++ ++ udelay(20); ++ ++ /* Enable core clock */ ++ core_set(priv, CORE_TRGMII_GSW_CLK_CG, REG_GSWCK_EN); + } + + /* Setup TX circuit including relevant PAD and driving */ +@@ -466,9 +474,8 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface) + mt7530_write(priv, MT7530_TRGMII_TD_ODT(i), + TD_DM_DRVP(8) | TD_DM_DRVN(8)); + +- /* Disable MT7530 core and TRGMII Tx clocks */ +- core_clear(priv, CORE_TRGMII_GSW_CLK_CG, +- REG_GSWCK_EN | REG_TRGMIICK_EN); ++ /* Disable the MT7530 TRGMII clocks */ ++ core_clear(priv, CORE_TRGMII_GSW_CLK_CG, REG_TRGMIICK_EN); + + /* Setup the MT7530 TRGMII Tx Clock */ + core_write(priv, CORE_PLL_GROUP5, RG_LCDDS_PCW_NCPO1(ncpo1)); +@@ -485,9 +492,8 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface) + RG_LCDDS_PCW_NCPO_CHG | RG_LCCDS_C(3) | + RG_LCDDS_PWDB | RG_LCDDS_ISO_EN); + +- /* Enable MT7530 core and TRGMII Tx clocks */ +- core_set(priv, CORE_TRGMII_GSW_CLK_CG, +- REG_GSWCK_EN | REG_TRGMIICK_EN); ++ /* Enable the MT7530 TRGMII clocks */ ++ core_set(priv, CORE_TRGMII_GSW_CLK_CG, REG_TRGMIICK_EN); + } else { + for (i = 0 ; i < NUM_TRGMII_CTRL; i++) + mt7530_rmw(priv, MT7530_TRGMII_RD(i), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-097-net-dsa-mt7530-move-lowering-TRGMII-driving-to-.patch b/patches.kernel.org/6.2.9-097-net-dsa-mt7530-move-lowering-TRGMII-driving-to-.patch new file mode 100644 index 0000000..10cab39 --- /dev/null +++ b/patches.kernel.org/6.2.9-097-net-dsa-mt7530-move-lowering-TRGMII-driving-to-.patch @@ -0,0 +1,102 @@ +From: =?UTF-8?q?Ar=C4=B1n=C3=A7=20=C3=9CNAL?= +Date: Mon, 20 Mar 2023 22:05:19 +0300 +Subject: [PATCH] net: dsa: mt7530: move lowering TRGMII driving to + mt7530_setup() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: fdcc8ccd823740c18e803b886cec461bc0e64201 + +[ Upstream commit fdcc8ccd823740c18e803b886cec461bc0e64201 ] + +Move lowering the TRGMII Tx clock driving to mt7530_setup(), after setting +the core clock, as seen on the U-Boot MediaTek ethernet driver. + +Move the code which looks like it lowers the TRGMII Rx clock driving to +after the TRGMII Tx clock driving is lowered. This is run after lowering +the Tx clock driving on the U-Boot MediaTek ethernet driver as well. + +This way, the switch should consume less power regardless of port 6 being +used. + +Update the comment explaining mt7530_pad_clk_setup(). + +Tested rgmii and trgmii modes of port 6 and rgmii mode of port 5 on MCM +MT7530 on MT7621AT Unielec U7621-06 and standalone MT7530 on MT7623NI +Bananapi BPI-R2. + +Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") +Link: https://source.denx.de/u-boot/u-boot/-/blob/29a48bf9ccba45a5e560bb564bbe76e42629325f/drivers/net/mtk_eth.c#L682 +Tested-by: Arınç ÜNAL +Signed-off-by: Arınç ÜNAL +Link: https://lore.kernel.org/r/20230320190520.124513-2-arinc.unal@arinc9.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/dsa/mt7530.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index cd0ea03c..b0d6ca18 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -419,12 +419,12 @@ static void mt7530_pll_setup(struct mt7530_priv *priv) + core_set(priv, CORE_TRGMII_GSW_CLK_CG, REG_GSWCK_EN); + } + +-/* Setup TX circuit including relevant PAD and driving */ ++/* Setup port 6 interface mode and TRGMII TX circuit */ + static int + mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface) + { + struct mt7530_priv *priv = ds->priv; +- u32 ncpo1, ssc_delta, trgint, i, xtal; ++ u32 ncpo1, ssc_delta, trgint, xtal; + + xtal = mt7530_read(priv, MT7530_MHWTRAP) & HWTRAP_XTAL_MASK; + +@@ -469,11 +469,6 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface) + P6_INTF_MODE(trgint)); + + if (trgint) { +- /* Lower Tx Driving for TRGMII path */ +- for (i = 0 ; i < NUM_TRGMII_CTRL ; i++) +- mt7530_write(priv, MT7530_TRGMII_TD_ODT(i), +- TD_DM_DRVP(8) | TD_DM_DRVN(8)); +- + /* Disable the MT7530 TRGMII clocks */ + core_clear(priv, CORE_TRGMII_GSW_CLK_CG, REG_TRGMIICK_EN); + +@@ -494,10 +489,6 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface) + + /* Enable the MT7530 TRGMII clocks */ + core_set(priv, CORE_TRGMII_GSW_CLK_CG, REG_TRGMIICK_EN); +- } else { +- for (i = 0 ; i < NUM_TRGMII_CTRL; i++) +- mt7530_rmw(priv, MT7530_TRGMII_RD(i), +- RD_TAP_MASK, RD_TAP(16)); + } + + return 0; +@@ -2212,6 +2203,15 @@ mt7530_setup(struct dsa_switch *ds) + + mt7530_pll_setup(priv); + ++ /* Lower Tx driving for TRGMII path */ ++ for (i = 0; i < NUM_TRGMII_CTRL; i++) ++ mt7530_write(priv, MT7530_TRGMII_TD_ODT(i), ++ TD_DM_DRVP(8) | TD_DM_DRVN(8)); ++ ++ for (i = 0; i < NUM_TRGMII_CTRL; i++) ++ mt7530_rmw(priv, MT7530_TRGMII_RD(i), ++ RD_TAP_MASK, RD_TAP(16)); ++ + /* Enable port 6 */ + val = mt7530_read(priv, MT7530_MHWTRAP); + val &= ~MHWTRAP_P6_DIS & ~MHWTRAP_PHY_ACCESS; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-098-net-dsa-mt7530-move-setting-ssc_delta-to-PHY_IN.patch b/patches.kernel.org/6.2.9-098-net-dsa-mt7530-move-setting-ssc_delta-to-PHY_IN.patch new file mode 100644 index 0000000..b012935 --- /dev/null +++ b/patches.kernel.org/6.2.9-098-net-dsa-mt7530-move-setting-ssc_delta-to-PHY_IN.patch @@ -0,0 +1,56 @@ +From: =?UTF-8?q?Ar=C4=B1n=C3=A7=20=C3=9CNAL?= +Date: Mon, 20 Mar 2023 22:05:20 +0300 +Subject: [PATCH] net: dsa: mt7530: move setting ssc_delta to + PHY_INTERFACE_MODE_TRGMII case +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 407b508bdd70b6848993843d96ed49ac4108fb52 + +[ Upstream commit 407b508bdd70b6848993843d96ed49ac4108fb52 ] + +Move setting the ssc_delta variable to under the PHY_INTERFACE_MODE_TRGMII +case as it's only needed when trgmii is used. + +Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") +Signed-off-by: Arınç ÜNAL +Link: https://lore.kernel.org/r/20230320190520.124513-3-arinc.unal@arinc9.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/dsa/mt7530.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index b0d6ca18..326f9925 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -441,6 +441,10 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface) + break; + case PHY_INTERFACE_MODE_TRGMII: + trgint = 1; ++ if (xtal == HWTRAP_XTAL_25MHZ) ++ ssc_delta = 0x57; ++ else ++ ssc_delta = 0x87; + if (priv->id == ID_MT7621) { + /* PLL frequency: 150MHz: 1.2GBit */ + if (xtal == HWTRAP_XTAL_40MHZ) +@@ -460,11 +464,6 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface) + return -EINVAL; + } + +- if (xtal == HWTRAP_XTAL_25MHZ) +- ssc_delta = 0x57; +- else +- ssc_delta = 0x87; +- + mt7530_rmw(priv, MT7530_P6ECR, P6_INTF_MODE_MASK, + P6_INTF_MODE(trgint)); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-099-net-mdio-thunder-Add-missing-fwnode_handle_put.patch b/patches.kernel.org/6.2.9-099-net-mdio-thunder-Add-missing-fwnode_handle_put.patch new file mode 100644 index 0000000..9ea0c49 --- /dev/null +++ b/patches.kernel.org/6.2.9-099-net-mdio-thunder-Add-missing-fwnode_handle_put.patch @@ -0,0 +1,37 @@ +From: Liang He +Date: Wed, 22 Mar 2023 14:20:57 +0800 +Subject: [PATCH] net: mdio: thunder: Add missing fwnode_handle_put() +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: b1de5c78ebe9858ccec9d49af2f76724f1d47e3e + +[ Upstream commit b1de5c78ebe9858ccec9d49af2f76724f1d47e3e ] + +In device_for_each_child_node(), we should add fwnode_handle_put() +when break out of the iteration device_for_each_child_node() +as it will automatically increase and decrease the refcounter. + +Fixes: 379d7ac7ca31 ("phy: mdio-thunder: Add driver for Cavium Thunder SoC MDIO buses.") +Signed-off-by: Liang He +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/mdio/mdio-thunder.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/mdio/mdio-thunder.c b/drivers/net/mdio/mdio-thunder.c +index 822d2cdd..394b864a 100644 +--- a/drivers/net/mdio/mdio-thunder.c ++++ b/drivers/net/mdio/mdio-thunder.c +@@ -104,6 +104,7 @@ static int thunder_mdiobus_pci_probe(struct pci_dev *pdev, + if (i >= ARRAY_SIZE(nexus->buses)) + break; + } ++ fwnode_handle_put(fwn); + return 0; + + err_release_regions: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-100-efi-libstub-Use-relocated-version-of-kernel-s-s.patch b/patches.kernel.org/6.2.9-100-efi-libstub-Use-relocated-version-of-kernel-s-s.patch new file mode 100644 index 0000000..c59b0d8 --- /dev/null +++ b/patches.kernel.org/6.2.9-100-efi-libstub-Use-relocated-version-of-kernel-s-s.patch @@ -0,0 +1,160 @@ +From: Ard Biesheuvel +Date: Wed, 22 Mar 2023 01:11:18 +0100 +Subject: [PATCH] efi/libstub: Use relocated version of kernel's struct + screen_info +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: fc3608aaa5751318837e4bbe0282b3836bca5080 + +[ Upstream commit fc3608aaa5751318837e4bbe0282b3836bca5080 ] + +In some cases, we expose the kernel's struct screen_info to the EFI stub +directly, so it gets populated before even entering the kernel. This +means the early console is available as soon as the early param parsing +happens, which is nice. It also means we need two different ways to pass +this information, as this trick only works if the EFI stub is baked into +the core kernel image, which is not always the case. + +Huacai reports that the preparatory refactoring that was needed to +implement this alternative method for zboot resulted in a non-functional +efifb earlycon for other cases as well, due to the reordering of the +kernel image relocation with the population of the screen_info struct, +and the latter now takes place after copying the image to its new +location, which means we copy the old, uninitialized state. + +So let's ensure that the same-image version of alloc_screen_info() +produces the correct screen_info pointer, by taking the displacement of +the loaded image into account. + +Reported-by: Huacai Chen +Tested-by: Huacai Chen +Link: https://lore.kernel.org/linux-efi/20230310021749.921041-1-chenhuacai@loongson.cn/ +Fixes: 42c8ea3dca094ab8 ("efi: libstub: Factor out EFI stub entrypoint into separate file") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/firmware/efi/libstub/arm64-stub.c | 4 +++- + drivers/firmware/efi/libstub/efi-stub-entry.c | 11 +++++++++++ + drivers/firmware/efi/libstub/efi-stub.c | 5 ----- + drivers/firmware/efi/libstub/efistub.h | 1 + + drivers/firmware/efi/libstub/screen_info.c | 9 +-------- + drivers/firmware/efi/libstub/zboot.c | 5 +++++ + 6 files changed, 21 insertions(+), 14 deletions(-) + +diff --git a/drivers/firmware/efi/libstub/arm64-stub.c b/drivers/firmware/efi/libstub/arm64-stub.c +index 7327b98d..7c502daf 100644 +--- a/drivers/firmware/efi/libstub/arm64-stub.c ++++ b/drivers/firmware/efi/libstub/arm64-stub.c +@@ -85,8 +85,10 @@ efi_status_t handle_kernel_image(unsigned long *image_addr, + } + } + +- if (image->image_base != _text) ++ if (image->image_base != _text) { + efi_err("FIRMWARE BUG: efi_loaded_image_t::image_base has bogus value\n"); ++ image->image_base = _text; ++ } + + if (!IS_ALIGNED((u64)_text, SEGMENT_ALIGN)) + efi_err("FIRMWARE BUG: kernel image not aligned on %dk boundary\n", +diff --git a/drivers/firmware/efi/libstub/efi-stub-entry.c b/drivers/firmware/efi/libstub/efi-stub-entry.c +index 5245c4f0..cc4dcaea 100644 +--- a/drivers/firmware/efi/libstub/efi-stub-entry.c ++++ b/drivers/firmware/efi/libstub/efi-stub-entry.c +@@ -5,6 +5,15 @@ + + #include "efistub.h" + ++static unsigned long screen_info_offset; ++ ++struct screen_info *alloc_screen_info(void) ++{ ++ if (IS_ENABLED(CONFIG_ARM)) ++ return __alloc_screen_info(); ++ return (void *)&screen_info + screen_info_offset; ++} ++ + /* + * EFI entry point for the generic EFI stub used by ARM, arm64, RISC-V and + * LoongArch. This is the entrypoint that is described in the PE/COFF header +@@ -56,6 +65,8 @@ efi_status_t __efiapi efi_pe_entry(efi_handle_t handle, + return status; + } + ++ screen_info_offset = image_addr - (unsigned long)image->image_base; ++ + status = efi_stub_common(handle, image, image_addr, cmdline_ptr); + + efi_free(image_size, image_addr); +diff --git a/drivers/firmware/efi/libstub/efi-stub.c b/drivers/firmware/efi/libstub/efi-stub.c +index 2955c1ac..f9c1e8a2 100644 +--- a/drivers/firmware/efi/libstub/efi-stub.c ++++ b/drivers/firmware/efi/libstub/efi-stub.c +@@ -47,11 +47,6 @@ + static u64 virtmap_base = EFI_RT_VIRTUAL_BASE; + static bool flat_va_mapping = (EFI_RT_VIRTUAL_OFFSET != 0); + +-struct screen_info * __weak alloc_screen_info(void) +-{ +- return &screen_info; +-} +- + void __weak free_screen_info(struct screen_info *si) + { + } +diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h +index f527816a..1926644b 100644 +--- a/drivers/firmware/efi/libstub/efistub.h ++++ b/drivers/firmware/efi/libstub/efistub.h +@@ -1042,6 +1042,7 @@ efi_enable_reset_attack_mitigation(void) { } + void efi_retrieve_tpm2_eventlog(void); + + struct screen_info *alloc_screen_info(void); ++struct screen_info *__alloc_screen_info(void); + void free_screen_info(struct screen_info *si); + + void efi_cache_sync_image(unsigned long image_base, +diff --git a/drivers/firmware/efi/libstub/screen_info.c b/drivers/firmware/efi/libstub/screen_info.c +index 8e76a8b3..4be1c4d1 100644 +--- a/drivers/firmware/efi/libstub/screen_info.c ++++ b/drivers/firmware/efi/libstub/screen_info.c +@@ -15,18 +15,11 @@ + * early, but it only works if the EFI stub is part of the core kernel image + * itself. The zboot decompressor can only use the configuration table + * approach. +- * +- * In order to support both methods from the same build of the EFI stub +- * library, provide this dummy global definition of struct screen_info. If it +- * is required to satisfy a link dependency, it means we need to override the +- * __weak alloc and free methods with the ones below, and those will be pulled +- * in as well. + */ +-struct screen_info screen_info; + + static efi_guid_t screen_info_guid = LINUX_EFI_SCREEN_INFO_TABLE_GUID; + +-struct screen_info *alloc_screen_info(void) ++struct screen_info *__alloc_screen_info(void) + { + struct screen_info *si; + efi_status_t status; +diff --git a/drivers/firmware/efi/libstub/zboot.c b/drivers/firmware/efi/libstub/zboot.c +index 66be5fdc..22c2cf38 100644 +--- a/drivers/firmware/efi/libstub/zboot.c ++++ b/drivers/firmware/efi/libstub/zboot.c +@@ -57,6 +57,11 @@ void __weak efi_cache_sync_image(unsigned long image_base, + // executable code loaded into memory to be safe for execution. + } + ++struct screen_info *alloc_screen_info(void) ++{ ++ return __alloc_screen_info(); ++} ++ + asmlinkage efi_status_t __efiapi + efi_zboot_entry(efi_handle_t handle, efi_system_table_t *systab) + { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-101-drm-amd-display-Set-dcn32-caps.seamless_odm.patch b/patches.kernel.org/6.2.9-101-drm-amd-display-Set-dcn32-caps.seamless_odm.patch new file mode 100644 index 0000000..e6b2106 --- /dev/null +++ b/patches.kernel.org/6.2.9-101-drm-amd-display-Set-dcn32-caps.seamless_odm.patch @@ -0,0 +1,41 @@ +From: Hersen Wu +Date: Thu, 9 Mar 2023 15:58:54 -0500 +Subject: [PATCH] drm/amd/display: Set dcn32 caps.seamless_odm +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: f9537b1fa7fb51c2162bc15ce469cbbf1ca0fbfe + +[ Upstream commit f9537b1fa7fb51c2162bc15ce469cbbf1ca0fbfe ] + +[Why & How] +seamless_odm set was not picked up while +merging commit 2d017189e2b3 ("drm/amd/display: +Blank eDP on enable drv if odm enabled") + +Fixes: 2d017189e2b3 ("drm/amd/display: Blank eDP on enable drv if odm enabled") +Reviewed-by: Qingqing Zhuo +Acked-by: Qingqing Zhuo +Signed-off-by: Hersen Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c +index 252356a8..6187aba1 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c +@@ -2186,6 +2186,7 @@ static bool dcn32_resource_construct( + dc->caps.edp_dsc_support = true; + dc->caps.extended_aux_timeout_support = true; + dc->caps.dmcub_support = true; ++ dc->caps.seamless_odm = true; + + /* Color pipeline capabilities */ + dc->caps.color.dpp.dcn_arch = 1; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-102-Bluetooth-btqcomsmd-Fix-command-timeout-after-s.patch b/patches.kernel.org/6.2.9-102-Bluetooth-btqcomsmd-Fix-command-timeout-after-s.patch new file mode 100644 index 0000000..c80d275 --- /dev/null +++ b/patches.kernel.org/6.2.9-102-Bluetooth-btqcomsmd-Fix-command-timeout-after-s.patch @@ -0,0 +1,76 @@ +From: Stephan Gerhold +Date: Wed, 8 Mar 2023 14:31:55 +0100 +Subject: [PATCH] Bluetooth: btqcomsmd: Fix command timeout after setting BD + address +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 5d44ab9e204200a78ad55cdf185aa2bb109b5950 + +[ Upstream commit 5d44ab9e204200a78ad55cdf185aa2bb109b5950 ] + +On most devices using the btqcomsmd driver (e.g. the DragonBoard 410c +and other devices based on the Qualcomm MSM8916/MSM8909/... SoCs) +the Bluetooth firmware seems to become unresponsive for a while after +setting the BD address. On recent kernel versions (at least 5.17+) +this often causes timeouts for subsequent commands, e.g. the HCI reset +sent by the Bluetooth core during initialization: + + Bluetooth: hci0: Opcode 0x c03 failed: -110 + +Unfortunately this behavior does not seem to be documented anywhere. +Experimentation suggests that the minimum necessary delay to avoid +the problem is ~150us. However, to be sure add a sleep for > 1ms +in case it is a bit longer on other firmware versions. + +Older kernel versions are likely also affected, although perhaps with +slightly different errors or less probability. Side effects can easily +hide the issue in most cases, e.g. unrelated incoming interrupts that +cause the necessary delay. + +Fixes: 1511cc750c3d ("Bluetooth: Introduce Qualcomm WCNSS SMD based HCI driver") +Signed-off-by: Stephan Gerhold +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/bluetooth/btqcomsmd.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/btqcomsmd.c b/drivers/bluetooth/btqcomsmd.c +index 2acb719e..11c7e04b 100644 +--- a/drivers/bluetooth/btqcomsmd.c ++++ b/drivers/bluetooth/btqcomsmd.c +@@ -122,6 +122,21 @@ static int btqcomsmd_setup(struct hci_dev *hdev) + return 0; + } + ++static int btqcomsmd_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) ++{ ++ int ret; ++ ++ ret = qca_set_bdaddr_rome(hdev, bdaddr); ++ if (ret) ++ return ret; ++ ++ /* The firmware stops responding for a while after setting the bdaddr, ++ * causing timeouts for subsequent commands. Sleep a bit to avoid this. ++ */ ++ usleep_range(1000, 10000); ++ return 0; ++} ++ + static int btqcomsmd_probe(struct platform_device *pdev) + { + struct btqcomsmd *btq; +@@ -162,7 +177,7 @@ static int btqcomsmd_probe(struct platform_device *pdev) + hdev->close = btqcomsmd_close; + hdev->send = btqcomsmd_send; + hdev->setup = btqcomsmd_setup; +- hdev->set_bdaddr = qca_set_bdaddr_rome; ++ hdev->set_bdaddr = btqcomsmd_set_bdaddr; + + ret = hci_register_dev(hdev); + if (ret < 0) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-103-Bluetooth-L2CAP-Fix-responding-with-wrong-PDU-t.patch b/patches.kernel.org/6.2.9-103-Bluetooth-L2CAP-Fix-responding-with-wrong-PDU-t.patch new file mode 100644 index 0000000..d57e3e9 --- /dev/null +++ b/patches.kernel.org/6.2.9-103-Bluetooth-L2CAP-Fix-responding-with-wrong-PDU-t.patch @@ -0,0 +1,227 @@ +From: Luiz Augusto von Dentz +Date: Wed, 8 Mar 2023 14:20:34 -0800 +Subject: [PATCH] Bluetooth: L2CAP: Fix responding with wrong PDU type +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 9aa9d9473f1550d1936c31259720b3f1f4690576 + +[ Upstream commit 9aa9d9473f1550d1936c31259720b3f1f4690576 ] + +L2CAP_ECRED_CONN_REQ shall be responded with L2CAP_ECRED_CONN_RSP not +L2CAP_LE_CONN_RSP: + +L2CAP LE EATT Server - Reject - run + Listening for connections + New client connection with handle 0x002a + Sending L2CAP Request from client + Client received response code 0x15 + Unexpected L2CAP response code (expected 0x18) +L2CAP LE EATT Server - Reject - test failed + +> ACL Data RX: Handle 42 flags 0x02 dlen 26 + LE L2CAP: Enhanced Credit Connection Request (0x17) ident 1 len 18 + PSM: 39 (0x0027) + MTU: 64 + MPS: 64 + Credits: 5 + Source CID: 65 + Source CID: 66 + Source CID: 67 + Source CID: 68 + Source CID: 69 +< ACL Data TX: Handle 42 flags 0x00 dlen 16 + LE L2CAP: LE Connection Response (0x15) ident 1 len 8 + invalid size + 00 00 00 00 00 00 06 00 + +L2CAP LE EATT Server - Reject - run + Listening for connections + New client connection with handle 0x002a + Sending L2CAP Request from client + Client received response code 0x18 +L2CAP LE EATT Server - Reject - test passed + +Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/bluetooth/l2cap_core.c | 117 +++++++++++++++++++++++++------------ + 1 file changed, 79 insertions(+), 38 deletions(-) + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index adfc3ea0..49926f59 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -708,6 +708,17 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err) + } + EXPORT_SYMBOL_GPL(l2cap_chan_del); + ++static void __l2cap_chan_list_id(struct l2cap_conn *conn, u16 id, ++ l2cap_chan_func_t func, void *data) ++{ ++ struct l2cap_chan *chan, *l; ++ ++ list_for_each_entry_safe(chan, l, &conn->chan_l, list) { ++ if (chan->ident == id) ++ func(chan, data); ++ } ++} ++ + static void __l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func, + void *data) + { +@@ -775,23 +786,9 @@ static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan) + + static void l2cap_chan_ecred_connect_reject(struct l2cap_chan *chan) + { +- struct l2cap_conn *conn = chan->conn; +- struct l2cap_ecred_conn_rsp rsp; +- u16 result; +- +- if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) +- result = L2CAP_CR_LE_AUTHORIZATION; +- else +- result = L2CAP_CR_LE_BAD_PSM; +- + l2cap_state_change(chan, BT_DISCONN); + +- memset(&rsp, 0, sizeof(rsp)); +- +- rsp.result = cpu_to_le16(result); +- +- l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), +- &rsp); ++ __l2cap_ecred_conn_rsp_defer(chan); + } + + static void l2cap_chan_connect_reject(struct l2cap_chan *chan) +@@ -846,7 +843,7 @@ void l2cap_chan_close(struct l2cap_chan *chan, int reason) + break; + case L2CAP_MODE_EXT_FLOWCTL: + l2cap_chan_ecred_connect_reject(chan); +- break; ++ return; + } + } + } +@@ -3938,43 +3935,86 @@ void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan) + &rsp); + } + +-void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan) ++static void l2cap_ecred_list_defer(struct l2cap_chan *chan, void *data) + { ++ int *result = data; ++ ++ if (*result || test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags)) ++ return; ++ ++ switch (chan->state) { ++ case BT_CONNECT2: ++ /* If channel still pending accept add to result */ ++ (*result)++; ++ return; ++ case BT_CONNECTED: ++ return; ++ default: ++ /* If not connected or pending accept it has been refused */ ++ *result = -ECONNREFUSED; ++ return; ++ } ++} ++ ++struct l2cap_ecred_rsp_data { + struct { + struct l2cap_ecred_conn_rsp rsp; +- __le16 dcid[5]; ++ __le16 scid[L2CAP_ECRED_MAX_CID]; + } __packed pdu; ++ int count; ++}; ++ ++static void l2cap_ecred_rsp_defer(struct l2cap_chan *chan, void *data) ++{ ++ struct l2cap_ecred_rsp_data *rsp = data; ++ ++ if (test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags)) ++ return; ++ ++ /* Reset ident so only one response is sent */ ++ chan->ident = 0; ++ ++ /* Include all channels pending with the same ident */ ++ if (!rsp->pdu.rsp.result) ++ rsp->pdu.rsp.dcid[rsp->count++] = cpu_to_le16(chan->scid); ++ else ++ l2cap_chan_del(chan, ECONNRESET); ++} ++ ++void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan) ++{ + struct l2cap_conn *conn = chan->conn; +- u16 ident = chan->ident; +- int i = 0; ++ struct l2cap_ecred_rsp_data data; ++ u16 id = chan->ident; ++ int result = 0; + +- if (!ident) ++ if (!id) + return; + +- BT_DBG("chan %p ident %d", chan, ident); ++ BT_DBG("chan %p id %d", chan, id); + +- pdu.rsp.mtu = cpu_to_le16(chan->imtu); +- pdu.rsp.mps = cpu_to_le16(chan->mps); +- pdu.rsp.credits = cpu_to_le16(chan->rx_credits); +- pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS); ++ memset(&data, 0, sizeof(data)); + +- mutex_lock(&conn->chan_lock); ++ data.pdu.rsp.mtu = cpu_to_le16(chan->imtu); ++ data.pdu.rsp.mps = cpu_to_le16(chan->mps); ++ data.pdu.rsp.credits = cpu_to_le16(chan->rx_credits); ++ data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS); + +- list_for_each_entry(chan, &conn->chan_l, list) { +- if (chan->ident != ident) +- continue; ++ /* Verify that all channels are ready */ ++ __l2cap_chan_list_id(conn, id, l2cap_ecred_list_defer, &result); + +- /* Reset ident so only one response is sent */ +- chan->ident = 0; ++ if (result > 0) ++ return; + +- /* Include all channels pending with the same ident */ +- pdu.dcid[i++] = cpu_to_le16(chan->scid); +- } ++ if (result < 0) ++ data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_AUTHORIZATION); + +- mutex_unlock(&conn->chan_lock); ++ /* Build response */ ++ __l2cap_chan_list_id(conn, id, l2cap_ecred_rsp_defer, &data); + +- l2cap_send_cmd(conn, ident, L2CAP_ECRED_CONN_RSP, +- sizeof(pdu.rsp) + i * sizeof(__le16), &pdu); ++ l2cap_send_cmd(conn, id, L2CAP_ECRED_CONN_RSP, ++ sizeof(data.pdu.rsp) + (data.count * sizeof(__le16)), ++ &data.pdu); + } + + void __l2cap_connect_rsp_defer(struct l2cap_chan *chan) +@@ -6078,6 +6118,7 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn, + __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); + + chan->ident = cmd->ident; ++ chan->mode = L2CAP_MODE_EXT_FLOWCTL; + + if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { + l2cap_state_change(chan, BT_CONNECT2); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-104-Bluetooth-btsdio-fix-use-after-free-bug-in-btsd.patch b/patches.kernel.org/6.2.9-104-Bluetooth-btsdio-fix-use-after-free-bug-in-btsd.patch new file mode 100644 index 0000000..c119502 --- /dev/null +++ b/patches.kernel.org/6.2.9-104-Bluetooth-btsdio-fix-use-after-free-bug-in-btsd.patch @@ -0,0 +1,40 @@ +From: Zheng Wang +Date: Thu, 9 Mar 2023 16:07:39 +0800 +Subject: [PATCH] Bluetooth: btsdio: fix use after free bug in btsdio_remove + due to unfinished work +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 1e9ac114c4428fdb7ff4635b45d4f46017e8916f + +[ Upstream commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f ] + +In btsdio_probe, &data->work was bound with btsdio_work.In +btsdio_send_frame, it was started by schedule_work. + +If we call btsdio_remove with an unfinished job, there may +be a race condition and cause UAF bug on hdev. + +Fixes: ddbaf13e3609 ("[Bluetooth] Add generic driver for Bluetooth SDIO devices") +Signed-off-by: Zheng Wang +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/bluetooth/btsdio.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c +index 795be33f..02893600 100644 +--- a/drivers/bluetooth/btsdio.c ++++ b/drivers/bluetooth/btsdio.c +@@ -354,6 +354,7 @@ static void btsdio_remove(struct sdio_func *func) + + BT_DBG("func %p", func); + ++ cancel_work_sync(&data->work); + if (!data) + return; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-105-Bluetooth-mgmt-Fix-MGMT-add-advmon-with-RSSI-co.patch b/patches.kernel.org/6.2.9-105-Bluetooth-mgmt-Fix-MGMT-add-advmon-with-RSSI-co.patch new file mode 100644 index 0000000..7c4e0c0 --- /dev/null +++ b/patches.kernel.org/6.2.9-105-Bluetooth-mgmt-Fix-MGMT-add-advmon-with-RSSI-co.patch @@ -0,0 +1,42 @@ +From: Howard Chung +Date: Thu, 16 Mar 2023 18:11:38 +0800 +Subject: [PATCH] Bluetooth: mgmt: Fix MGMT add advmon with RSSI command +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 1a0291f81529e8044fb29845a0196ba47af894ce + +[ Upstream commit 1a0291f81529e8044fb29845a0196ba47af894ce ] + +The MGMT command: MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI uses variable +length argument. This causes host not able to register advmon with rssi. + +This patch has been locally tested by adding monitor with rssi via +btmgmt on a kernel 6.1 machine. + +Reviewed-by: Archie Pusaka +Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh") +Signed-off-by: Howard Chung +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/bluetooth/mgmt.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 71b65ac6..c4a7627b 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -9345,7 +9345,8 @@ static const struct hci_mgmt_handler mgmt_handlers[] = { + { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, + HCI_MGMT_VAR_LEN }, + { add_adv_patterns_monitor_rssi, +- MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE }, ++ MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, ++ HCI_MGMT_VAR_LEN }, + { set_mesh, MGMT_SET_MESH_RECEIVER_SIZE, + HCI_MGMT_VAR_LEN }, + { mesh_features, MGMT_MESH_READ_FEATURES_SIZE }, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-106-Bluetooth-HCI-Fix-global-out-of-bounds.patch b/patches.kernel.org/6.2.9-106-Bluetooth-HCI-Fix-global-out-of-bounds.patch new file mode 100644 index 0000000..73e5680 --- /dev/null +++ b/patches.kernel.org/6.2.9-106-Bluetooth-HCI-Fix-global-out-of-bounds.patch @@ -0,0 +1,124 @@ +From: Sungwoo Kim +Date: Mon, 20 Mar 2023 21:50:18 -0400 +Subject: [PATCH] Bluetooth: HCI: Fix global-out-of-bounds +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: bce56405201111807cc8e4f47c6de3e10b17c1ac + +[ Upstream commit bce56405201111807cc8e4f47c6de3e10b17c1ac ] + +To loop a variable-length array, hci_init_stage_sync(stage) considers +that stage[i] is valid as long as stage[i-1].func is valid. +Thus, the last element of stage[].func should be intentionally invalid +as hci_init0[], le_init2[], and others did. +However, amp_init1[] and amp_init2[] have no invalid element, letting +hci_init_stage_sync() keep accessing amp_init1[] over its valid range. +This patch fixes this by adding {} in the last of amp_init1[] and +amp_init2[]. + +================================================================== +BUG: KASAN: global-out-of-bounds in hci_dev_open_sync ( +/v6.2-bzimage/net/bluetooth/hci_sync.c:3154 +/v6.2-bzimage/net/bluetooth/hci_sync.c:3343 +/v6.2-bzimage/net/bluetooth/hci_sync.c:4418 +/v6.2-bzimage/net/bluetooth/hci_sync.c:4609 +/v6.2-bzimage/net/bluetooth/hci_sync.c:4689) +Read of size 8 at addr ffffffffaed1ab70 by task kworker/u5:0/1032 +CPU: 0 PID: 1032 Comm: kworker/u5:0 Not tainted 6.2.0 #3 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04 +Workqueue: hci1 hci_power_on +Call Trace: + +dump_stack_lvl (/v6.2-bzimage/lib/dump_stack.c:107 (discriminator 1)) +print_report (/v6.2-bzimage/mm/kasan/report.c:307 + /v6.2-bzimage/mm/kasan/report.c:417) +? hci_dev_open_sync (/v6.2-bzimage/net/bluetooth/hci_sync.c:3154 + /v6.2-bzimage/net/bluetooth/hci_sync.c:3343 + /v6.2-bzimage/net/bluetooth/hci_sync.c:4418 + /v6.2-bzimage/net/bluetooth/hci_sync.c:4609 + /v6.2-bzimage/net/bluetooth/hci_sync.c:4689) +kasan_report (/v6.2-bzimage/mm/kasan/report.c:184 + /v6.2-bzimage/mm/kasan/report.c:519) +? hci_dev_open_sync (/v6.2-bzimage/net/bluetooth/hci_sync.c:3154 + /v6.2-bzimage/net/bluetooth/hci_sync.c:3343 + /v6.2-bzimage/net/bluetooth/hci_sync.c:4418 + /v6.2-bzimage/net/bluetooth/hci_sync.c:4609 + /v6.2-bzimage/net/bluetooth/hci_sync.c:4689) +hci_dev_open_sync (/v6.2-bzimage/net/bluetooth/hci_sync.c:3154 + /v6.2-bzimage/net/bluetooth/hci_sync.c:3343 + /v6.2-bzimage/net/bluetooth/hci_sync.c:4418 + /v6.2-bzimage/net/bluetooth/hci_sync.c:4609 + /v6.2-bzimage/net/bluetooth/hci_sync.c:4689) +? __pfx_hci_dev_open_sync (/v6.2-bzimage/net/bluetooth/hci_sync.c:4635) +? mutex_lock (/v6.2-bzimage/./arch/x86/include/asm/atomic64_64.h:190 + /v6.2-bzimage/./include/linux/atomic/atomic-long.h:443 + /v6.2-bzimage/./include/linux/atomic/atomic-instrumented.h:1781 + /v6.2-bzimage/kernel/locking/mutex.c:171 + /v6.2-bzimage/kernel/locking/mutex.c:285) +? __pfx_mutex_lock (/v6.2-bzimage/kernel/locking/mutex.c:282) +hci_power_on (/v6.2-bzimage/net/bluetooth/hci_core.c:485 + /v6.2-bzimage/net/bluetooth/hci_core.c:984) +? __pfx_hci_power_on (/v6.2-bzimage/net/bluetooth/hci_core.c:969) +? read_word_at_a_time (/v6.2-bzimage/./include/asm-generic/rwonce.h:85) +? strscpy (/v6.2-bzimage/./arch/x86/include/asm/word-at-a-time.h:62 + /v6.2-bzimage/lib/string.c:161) +process_one_work (/v6.2-bzimage/kernel/workqueue.c:2294) +worker_thread (/v6.2-bzimage/./include/linux/list.h:292 + /v6.2-bzimage/kernel/workqueue.c:2437) +? __pfx_worker_thread (/v6.2-bzimage/kernel/workqueue.c:2379) +kthread (/v6.2-bzimage/kernel/kthread.c:376) +? __pfx_kthread (/v6.2-bzimage/kernel/kthread.c:331) +ret_from_fork (/v6.2-bzimage/arch/x86/entry/entry_64.S:314) + +The buggy address belongs to the variable: +amp_init1+0x30/0x60 +The buggy address belongs to the physical page: +page:000000003a157ec6 refcount:1 mapcount:0 mapping:0000000000000000 ia +flags: 0x200000000001000(reserved|node=0|zone=2) +raw: 0200000000001000 ffffea0005054688 ffffea0005054688 000000000000000 +raw: 0000000000000000 0000000000000000 00000001ffffffff 000000000000000 +page dumped because: kasan: bad access detected +Memory state around the buggy address: + ffffffffaed1aa00: f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9 00 00 00 00 + ffffffffaed1aa80: 00 00 00 00 f9 f9 f9 f9 00 00 00 00 00 00 00 00 +>ffffffffaed1ab00: 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 + ^ + ffffffffaed1ab80: f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9 00 00 00 f9 + ffffffffaed1ac00: f9 f9 f9 f9 00 06 f9 f9 f9 f9 f9 f9 00 00 02 f9 + +This bug is found by FuzzBT, a modified version of Syzkaller. +Other contributors for this bug are Ruoyu Wu and Peng Hui. + +Fixes: d0b137062b2d ("Bluetooth: hci_sync: Rework init stages") +Signed-off-by: Sungwoo Kim +Reviewed-by: Simon Horman +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/bluetooth/hci_sync.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 7e152e91..9550487f 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -3358,6 +3358,7 @@ static const struct hci_init_stage amp_init1[] = { + HCI_INIT(hci_read_flow_control_mode_sync), + /* HCI_OP_READ_LOCATION_DATA */ + HCI_INIT(hci_read_location_data_sync), ++ {} + }; + + static int hci_init1_sync(struct hci_dev *hdev) +@@ -3392,6 +3393,7 @@ static int hci_init1_sync(struct hci_dev *hdev) + static const struct hci_init_stage amp_init2[] = { + /* HCI_OP_READ_LOCAL_FEATURES */ + HCI_INIT(hci_read_local_features_sync), ++ {} + }; + + /* Read Buffer Size (ACL mtu, max pkt, etc.) */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-107-platform-chrome-cros_ec_chardev-fix-kernel-data.patch b/patches.kernel.org/6.2.9-107-platform-chrome-cros_ec_chardev-fix-kernel-data.patch new file mode 100644 index 0000000..8df0cd3 --- /dev/null +++ b/patches.kernel.org/6.2.9-107-platform-chrome-cros_ec_chardev-fix-kernel-data.patch @@ -0,0 +1,43 @@ +From: Tzung-Bi Shih +Date: Fri, 24 Mar 2023 09:06:58 +0800 +Subject: [PATCH] platform/chrome: cros_ec_chardev: fix kernel data leak from + ioctl +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: b20cf3f89c56b5f6a38b7f76a8128bf9f291bbd3 + +[ Upstream commit b20cf3f89c56b5f6a38b7f76a8128bf9f291bbd3 ] + +It is possible to peep kernel page's data by providing larger `insize` +in struct cros_ec_command[1] when invoking EC host commands. + +Fix it by using zeroed memory. + +[1]: https://elixir.bootlin.com/linux/v6.2/source/include/linux/platform_data/cros_ec_proto.h#L74 + +Fixes: eda2e30c6684 ("mfd / platform: cros_ec: Miscellaneous character device to talk with the EC") +Signed-off-by: Tzung-Bi Shih +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20230324010658.1082361-1-tzungbi@kernel.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/platform/chrome/cros_ec_chardev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/chrome/cros_ec_chardev.c b/drivers/platform/chrome/cros_ec_chardev.c +index 0de7c255..d6de5a29 100644 +--- a/drivers/platform/chrome/cros_ec_chardev.c ++++ b/drivers/platform/chrome/cros_ec_chardev.c +@@ -284,7 +284,7 @@ static long cros_ec_chardev_ioctl_xcmd(struct cros_ec_dev *ec, void __user *arg) + u_cmd.insize > EC_MAX_MSG_BYTES) + return -EINVAL; + +- s_cmd = kmalloc(sizeof(*s_cmd) + max(u_cmd.outsize, u_cmd.insize), ++ s_cmd = kzalloc(sizeof(*s_cmd) + max(u_cmd.outsize, u_cmd.insize), + GFP_KERNEL); + if (!s_cmd) + return -ENOMEM; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-108-entry-Fix-noinstr-warning-in-__enter_from_user_.patch b/patches.kernel.org/6.2.9-108-entry-Fix-noinstr-warning-in-__enter_from_user_.patch new file mode 100644 index 0000000..071eb9a --- /dev/null +++ b/patches.kernel.org/6.2.9-108-entry-Fix-noinstr-warning-in-__enter_from_user_.patch @@ -0,0 +1,80 @@ +From: Josh Poimboeuf +Date: Sat, 25 Feb 2023 16:01:36 -0800 +Subject: [PATCH] entry: Fix noinstr warning in __enter_from_user_mode() +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: f87d28673b71b35b248231a2086f9404afbb7f28 + +[ Upstream commit f87d28673b71b35b248231a2086f9404afbb7f28 ] + +__enter_from_user_mode() is triggering noinstr warnings with +CONFIG_DEBUG_PREEMPT due to its call of preempt_count_add() via +ct_state(). + +The preemption disable isn't needed as interrupts are already disabled. +And the context_tracking_enabled() check in ct_state() also isn't needed +as that's already being done by the CT_WARN_ON(). + +Just use __ct_state() instead. + +Fixes the following warnings: + + vmlinux.o: warning: objtool: enter_from_user_mode+0xba: call to preempt_count_add() leaves .noinstr.text section + vmlinux.o: warning: objtool: syscall_enter_from_user_mode+0xf9: call to preempt_count_add() leaves .noinstr.text section + vmlinux.o: warning: objtool: syscall_enter_from_user_mode_prepare+0xc7: call to preempt_count_add() leaves .noinstr.text section + vmlinux.o: warning: objtool: irqentry_enter_from_user_mode+0xba: call to preempt_count_add() leaves .noinstr.text section + +Fixes: 171476775d32 ("context_tracking: Convert state to atomic_t") +Signed-off-by: Josh Poimboeuf +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/d8955fa6d68dc955dda19baf13ae014ae27926f5.1677369694.git.jpoimboe@kernel.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + include/linux/context_tracking.h | 1 + + include/linux/context_tracking_state.h | 2 ++ + kernel/entry/common.c | 2 +- + 3 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/include/linux/context_tracking.h b/include/linux/context_tracking.h +index d4afa850..3a7909ed 100644 +--- a/include/linux/context_tracking.h ++++ b/include/linux/context_tracking.h +@@ -96,6 +96,7 @@ static inline void user_exit_irqoff(void) { } + static inline int exception_enter(void) { return 0; } + static inline void exception_exit(enum ctx_state prev_ctx) { } + static inline int ct_state(void) { return -1; } ++static inline int __ct_state(void) { return -1; } + static __always_inline bool context_tracking_guest_enter(void) { return false; } + static inline void context_tracking_guest_exit(void) { } + #define CT_WARN_ON(cond) do { } while (0) +diff --git a/include/linux/context_tracking_state.h b/include/linux/context_tracking_state.h +index 4a4d56f7..fdd537ea 100644 +--- a/include/linux/context_tracking_state.h ++++ b/include/linux/context_tracking_state.h +@@ -46,7 +46,9 @@ struct context_tracking { + + #ifdef CONFIG_CONTEXT_TRACKING + DECLARE_PER_CPU(struct context_tracking, context_tracking); ++#endif + ++#ifdef CONFIG_CONTEXT_TRACKING_USER + static __always_inline int __ct_state(void) + { + return arch_atomic_read(this_cpu_ptr(&context_tracking.state)) & CT_STATE_MASK; +diff --git a/kernel/entry/common.c b/kernel/entry/common.c +index 846add83..1314894d 100644 +--- a/kernel/entry/common.c ++++ b/kernel/entry/common.c +@@ -21,7 +21,7 @@ static __always_inline void __enter_from_user_mode(struct pt_regs *regs) + arch_enter_from_user_mode(regs); + lockdep_hardirqs_off(CALLER_ADDR0); + +- CT_WARN_ON(ct_state() != CONTEXT_USER); ++ CT_WARN_ON(__ct_state() != CONTEXT_USER); + user_exit_irqoff(); + + instrumentation_begin(); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-109-perf-x86-amd-core-Always-clear-status-for-idx.patch b/patches.kernel.org/6.2.9-109-perf-x86-amd-core-Always-clear-status-for-idx.patch new file mode 100644 index 0000000..b6944aa --- /dev/null +++ b/patches.kernel.org/6.2.9-109-perf-x86-amd-core-Always-clear-status-for-idx.patch @@ -0,0 +1,58 @@ +From: Breno Leitao +Date: Tue, 21 Mar 2023 04:33:38 -0700 +Subject: [PATCH] perf/x86/amd/core: Always clear status for idx +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 263f5ecaf7080513efc248ec739b6d9e00f4129f + +[ Upstream commit 263f5ecaf7080513efc248ec739b6d9e00f4129f ] + +The variable 'status' (which contains the unhandled overflow bits) is +not being properly masked in some cases, displaying the following +warning: + + WARNING: CPU: 156 PID: 475601 at arch/x86/events/amd/core.c:972 amd_pmu_v2_handle_irq+0x216/0x270 + +This seems to be happening because the loop is being continued before +the status bit being unset, in case x86_perf_event_set_period() +returns 0. This is also causing an inconsistency because the "handled" +counter is incremented, but the status bit is not cleaned. + +Move the bit cleaning together above, together when the "handled" +counter is incremented. + +Fixes: 7685665c390d ("perf/x86/amd/core: Add PerfMonV2 overflow handling") +Signed-off-by: Breno Leitao +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Sandipan Das +Link: https://lore.kernel.org/r/20230321113338.1669660-1-leitao@debian.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/x86/events/amd/core.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c +index 4386b106..8ca5e827 100644 +--- a/arch/x86/events/amd/core.c ++++ b/arch/x86/events/amd/core.c +@@ -923,6 +923,7 @@ static int amd_pmu_v2_handle_irq(struct pt_regs *regs) + + /* Event overflow */ + handled++; ++ status &= ~mask; + perf_sample_data_init(&data, 0, hwc->last_period); + + if (!x86_perf_event_set_period(event)) +@@ -935,8 +936,6 @@ static int amd_pmu_v2_handle_irq(struct pt_regs *regs) + + if (perf_event_overflow(event, &data, regs)) + x86_pmu_stop(event, 0); +- +- status &= ~mask; + } + + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-110-entry-rcu-Check-TIF_RESCHED-_after_-delayed-RCU.patch b/patches.kernel.org/6.2.9-110-entry-rcu-Check-TIF_RESCHED-_after_-delayed-RCU.patch new file mode 100644 index 0000000..073d15d --- /dev/null +++ b/patches.kernel.org/6.2.9-110-entry-rcu-Check-TIF_RESCHED-_after_-delayed-RCU.patch @@ -0,0 +1,57 @@ +From: Frederic Weisbecker +Date: Wed, 15 Mar 2023 19:43:43 +0000 +Subject: [PATCH] entry/rcu: Check TIF_RESCHED _after_ delayed RCU wake-up +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: b416514054810cf2d2cc348ae477cea619b64da7 + +[ Upstream commit b416514054810cf2d2cc348ae477cea619b64da7 ] + +RCU sometimes needs to perform a delayed wake up for specific kthreads +handling offloaded callbacks (RCU_NOCB). These wakeups are performed +by timers and upon entry to idle (also to guest and to user on nohz_full). + +However the delayed wake-up on kernel exit is actually performed after +the thread flags are fetched towards the fast path check for work to +do on exit to user. As a result, and if there is no other pending work +to do upon that kernel exit, the current task will resume to userspace +with TIF_RESCHED set and the pending wake up ignored. + +Fix this with fetching the thread flags _after_ the delayed RCU-nocb +kthread wake-up. + +Fixes: 47b8ff194c1f ("entry: Explicitly flush pending rcuog wakeup before last rescheduling point") +Signed-off-by: Frederic Weisbecker +Signed-off-by: Paul E. McKenney +Signed-off-by: Joel Fernandes (Google) +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20230315194349.10798-3-joel@joelfernandes.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/entry/common.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/entry/common.c b/kernel/entry/common.c +index 1314894d..be61332c 100644 +--- a/kernel/entry/common.c ++++ b/kernel/entry/common.c +@@ -192,13 +192,14 @@ static unsigned long exit_to_user_mode_loop(struct pt_regs *regs, + + static void exit_to_user_mode_prepare(struct pt_regs *regs) + { +- unsigned long ti_work = read_thread_flags(); ++ unsigned long ti_work; + + lockdep_assert_irqs_disabled(); + + /* Flush pending rcuog wakeup before the last need_resched() check */ + tick_nohz_user_enter_prepare(); + ++ ti_work = read_thread_flags(); + if (unlikely(ti_work & EXIT_TO_USER_MODE_WORK)) + ti_work = exit_to_user_mode_loop(regs, ti_work); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-111-hwmon-fix-potential-sensor-registration-fail-if.patch b/patches.kernel.org/6.2.9-111-hwmon-fix-potential-sensor-registration-fail-if.patch new file mode 100644 index 0000000..f235c12 --- /dev/null +++ b/patches.kernel.org/6.2.9-111-hwmon-fix-potential-sensor-registration-fail-if.patch @@ -0,0 +1,60 @@ +From: Phinex Hung +Date: Tue, 21 Mar 2023 14:02:23 +0800 +Subject: [PATCH] hwmon: fix potential sensor registration fail if of_node is + missing +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 2315332efcbe7124252f080e03b57d3d2f1f4771 + +[ Upstream commit 2315332efcbe7124252f080e03b57d3d2f1f4771 ] + +It is not sufficient to check of_node in current device. +In some cases, this would cause the sensor registration to fail. + +This patch looks for device's ancestors to find a valid of_node if any. + +Fixes: d560168b5d0f ("hwmon: (core) New hwmon registration API") +Signed-off-by: Phinex Hung +Link: https://lore.kernel.org/r/20230321060224.3819-1-phinex@realtek.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hwmon/hwmon.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c +index 33edb5c0..d193ed3c 100644 +--- a/drivers/hwmon/hwmon.c ++++ b/drivers/hwmon/hwmon.c +@@ -757,6 +757,7 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata, + struct hwmon_device *hwdev; + const char *label; + struct device *hdev; ++ struct device *tdev = dev; + int i, err, id; + + /* Complain about invalid characters in hwmon name attribute */ +@@ -826,7 +827,9 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata, + hwdev->name = name; + hdev->class = &hwmon_class; + hdev->parent = dev; +- hdev->of_node = dev ? dev->of_node : NULL; ++ while (tdev && !tdev->of_node) ++ tdev = tdev->parent; ++ hdev->of_node = tdev ? tdev->of_node : NULL; + hwdev->chip = chip; + dev_set_drvdata(hdev, drvdata); + dev_set_name(hdev, HWMON_ID_FORMAT, id); +@@ -838,7 +841,7 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata, + + INIT_LIST_HEAD(&hwdev->tzdata); + +- if (dev && dev->of_node && chip && chip->ops->read && ++ if (hdev->of_node && chip && chip->ops->read && + chip->info[0]->type == hwmon_chip && + (chip->info[0]->config[0] & HWMON_C_REGISTER_TZ)) { + err = hwmon_thermal_register_sensors(hdev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-112-hwmon-it87-Fix-voltage-scaling-for-chips-with-1.patch b/patches.kernel.org/6.2.9-112-hwmon-it87-Fix-voltage-scaling-for-chips-with-1.patch new file mode 100644 index 0000000..6692d23 --- /dev/null +++ b/patches.kernel.org/6.2.9-112-hwmon-it87-Fix-voltage-scaling-for-chips-with-1.patch @@ -0,0 +1,48 @@ +From: Frank Crawford +Date: Sat, 18 Mar 2023 19:05:42 +1100 +Subject: [PATCH] hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 968b66ffeb7956acc72836a7797aeb7b2444ec51 + +[ Upstream commit 968b66ffeb7956acc72836a7797aeb7b2444ec51 ] + +Fix voltage scaling for chips that have 10.9mV ADCs, where scaling was +not performed. + +Fixes: ead8080351c9 ("hwmon: (it87) Add support for IT8732F") +Signed-off-by: Frank Crawford +Link: https://lore.kernel.org/r/20230318080543.1226700-2-frank@crawford.emu.id.au +[groeck: Update subject and description to focus on bug fix] +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hwmon/it87.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c +index 9997f76b..b7c7cf21 100644 +--- a/drivers/hwmon/it87.c ++++ b/drivers/hwmon/it87.c +@@ -490,6 +490,8 @@ static const struct it87_devices it87_devices[] = { + #define has_pwm_freq2(data) ((data)->features & FEAT_PWM_FREQ2) + #define has_six_temp(data) ((data)->features & FEAT_SIX_TEMP) + #define has_vin3_5v(data) ((data)->features & FEAT_VIN3_5V) ++#define has_scaling(data) ((data)->features & (FEAT_12MV_ADC | \ ++ FEAT_10_9MV_ADC)) + + struct it87_sio_data { + int sioaddr; +@@ -3100,7 +3102,7 @@ static int it87_probe(struct platform_device *pdev) + "Detected broken BIOS defaults, disabling PWM interface\n"); + + /* Starting with IT8721F, we handle scaling of internal voltages */ +- if (has_12mv_adc(data)) { ++ if (has_scaling(data)) { + if (sio_data->internal & BIT(0)) + data->in_scaled |= BIT(3); /* in3 is AVCC */ + if (sio_data->internal & BIT(1)) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-113-scsi-qla2xxx-Synchronize-the-IOCB-count-to-be-i.patch b/patches.kernel.org/6.2.9-113-scsi-qla2xxx-Synchronize-the-IOCB-count-to-be-i.patch new file mode 100644 index 0000000..aa10750 --- /dev/null +++ b/patches.kernel.org/6.2.9-113-scsi-qla2xxx-Synchronize-the-IOCB-count-to-be-i.patch @@ -0,0 +1,100 @@ +From: Quinn Tran +Date: Sun, 12 Mar 2023 21:37:11 -0700 +Subject: [PATCH] scsi: qla2xxx: Synchronize the IOCB count to be in order +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: d3affdeb400f3adc925bd996f3839481f5291839 + +commit d3affdeb400f3adc925bd996f3839481f5291839 upstream. + +A system hang was observed with the following call trace: + +BUG: kernel NULL pointer dereference, address: 0000000000000000 +PGD 0 P4D 0 +Oops: 0000 [#1] PREEMPT SMP NOPTI +CPU: 15 PID: 86747 Comm: nvme Kdump: loaded Not tainted 6.2.0+ #1 +Hardware name: Dell Inc. PowerEdge R6515/04F3CJ, BIOS 2.7.3 03/31/2022 +RIP: 0010:__wake_up_common+0x55/0x190 +Code: 41 f6 01 04 0f 85 b2 00 00 00 48 8b 43 08 4c 8d + 40 e8 48 8d 43 08 48 89 04 24 48 89 c6\ + 49 8d 40 18 48 39 c6 0f 84 e9 00 00 00 <49> 8b 40 18 89 6c 24 14 31 + ed 4c 8d 60 e8 41 8b 18 f6 c3 04 75 5d +RSP: 0018:ffffb05a82afbba0 EFLAGS: 00010082 +RAX: 0000000000000000 RBX: ffff8f9b83a00018 RCX: 0000000000000000 +RDX: 0000000000000001 RSI: ffff8f9b83a00020 RDI: ffff8f9b83a00018 +RBP: 0000000000000001 R08: ffffffffffffffe8 R09: ffffb05a82afbbf8 +R10: 70735f7472617473 R11: 5f30307832616c71 R12: 0000000000000001 +R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 +FS: 00007f815cf4c740(0000) GS:ffff8f9eeed80000(0000) + knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000000000 CR3: 000000010633a000 CR4: 0000000000350ee0 +Call Trace: + + __wake_up_common_lock+0x83/0xd0 + qla_nvme_ls_req+0x21b/0x2b0 [qla2xxx] + __nvme_fc_send_ls_req+0x1b5/0x350 [nvme_fc] + nvme_fc_xmt_disconnect_assoc+0xca/0x110 [nvme_fc] + nvme_fc_delete_association+0x1bf/0x220 [nvme_fc] + ? nvme_remove_namespaces+0x9f/0x140 [nvme_core] + nvme_do_delete_ctrl+0x5b/0xa0 [nvme_core] + nvme_sysfs_delete+0x5f/0x70 [nvme_core] + kernfs_fop_write_iter+0x12b/0x1c0 + vfs_write+0x2a3/0x3b0 + ksys_write+0x5f/0xe0 + do_syscall_64+0x5c/0x90 + ? syscall_exit_work+0x103/0x130 + ? syscall_exit_to_user_mode+0x12/0x30 + ? do_syscall_64+0x69/0x90 + ? exit_to_user_mode_loop+0xd0/0x130 + ? exit_to_user_mode_prepare+0xec/0x100 + ? syscall_exit_to_user_mode+0x12/0x30 + ? do_syscall_64+0x69/0x90 + ? syscall_exit_to_user_mode+0x12/0x30 + ? do_syscall_64+0x69/0x90 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + RIP: 0033:0x7f815cd3eb97 + +The IOCB counts are out of order and that would block any commands from +going out and subsequently hang the system. Synchronize the IOCB count to +be in correct order. + +Fixes: 5f63a163ed2f ("scsi: qla2xxx: Fix exchange oversubscription for management commands") +Cc: stable@vger.kernel.org +Signed-off-by: Quinn Tran +Signed-off-by: Nilesh Javali +Link: https://lore.kernel.org/r/20230313043711.13500-3-njavali@marvell.com +Reviewed-by: Himanshu Madhani +Reviewed-by: John Meneghini +Tested-by: Lin Li +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/scsi/qla2xxx/qla_isr.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index cbbd7014..86928a76 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -1900,6 +1900,8 @@ qla2x00_get_sp_from_handle(scsi_qla_host_t *vha, const char *func, + } + + req->outstanding_cmds[index] = NULL; ++ ++ qla_put_fw_resources(sp->qpair, &sp->iores); + return sp; + } + +@@ -3112,7 +3114,6 @@ qla25xx_process_bidir_status_iocb(scsi_qla_host_t *vha, void *pkt, + } + bsg_reply->reply_payload_rcv_len = 0; + +- qla_put_fw_resources(sp->qpair, &sp->iores); + done: + /* Return the vendor specific reply to API */ + bsg_reply->reply_data.vendor_reply.vendor_rsp[0] = rval; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-114-scsi-qla2xxx-Perform-lockless-command-completio.patch b/patches.kernel.org/6.2.9-114-scsi-qla2xxx-Perform-lockless-command-completio.patch new file mode 100644 index 0000000..fd0e18b --- /dev/null +++ b/patches.kernel.org/6.2.9-114-scsi-qla2xxx-Perform-lockless-command-completio.patch @@ -0,0 +1,85 @@ +From: Nilesh Javali +Date: Sun, 12 Mar 2023 21:37:10 -0700 +Subject: [PATCH] scsi: qla2xxx: Perform lockless command completion in abort + path +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 0367076b0817d5c75dfb83001ce7ce5c64d803a9 + +commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9 upstream. + +While adding and removing the controller, the following call trace was +observed: + +WARNING: CPU: 3 PID: 623596 at kernel/dma/mapping.c:532 dma_free_attrs+0x33/0x50 +CPU: 3 PID: 623596 Comm: sh Kdump: loaded Not tainted 5.14.0-96.el9.x86_64 #1 +RIP: 0010:dma_free_attrs+0x33/0x50 + +Call Trace: + qla2x00_async_sns_sp_done+0x107/0x1b0 [qla2xxx] + qla2x00_abort_srb+0x8e/0x250 [qla2xxx] + ? ql_dbg+0x70/0x100 [qla2xxx] + __qla2x00_abort_all_cmds+0x108/0x190 [qla2xxx] + qla2x00_abort_all_cmds+0x24/0x70 [qla2xxx] + qla2x00_abort_isp_cleanup+0x305/0x3e0 [qla2xxx] + qla2x00_remove_one+0x364/0x400 [qla2xxx] + pci_device_remove+0x36/0xa0 + __device_release_driver+0x17a/0x230 + device_release_driver+0x24/0x30 + pci_stop_bus_device+0x68/0x90 + pci_stop_and_remove_bus_device_locked+0x16/0x30 + remove_store+0x75/0x90 + kernfs_fop_write_iter+0x11c/0x1b0 + new_sync_write+0x11f/0x1b0 + vfs_write+0x1eb/0x280 + ksys_write+0x5f/0xe0 + do_syscall_64+0x5c/0x80 + ? do_user_addr_fault+0x1d8/0x680 + ? do_syscall_64+0x69/0x80 + ? exc_page_fault+0x62/0x140 + ? asm_exc_page_fault+0x8/0x30 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +The command was completed in the abort path during driver unload with a +lock held, causing the warning in abort path. Hence complete the command +without any lock held. + +Reported-by: Lin Li +Tested-by: Lin Li +Cc: stable@vger.kernel.org +Signed-off-by: Nilesh Javali +Link: https://lore.kernel.org/r/20230313043711.13500-2-njavali@marvell.com +Reviewed-by: Himanshu Madhani +Reviewed-by: John Meneghini +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/scsi/qla2xxx/qla_os.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 2d86f804..37eb235f 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -1848,6 +1848,17 @@ __qla2x00_abort_all_cmds(struct qla_qpair *qp, int res) + for (cnt = 1; cnt < req->num_outstanding_cmds; cnt++) { + sp = req->outstanding_cmds[cnt]; + if (sp) { ++ /* ++ * perform lockless completion during driver unload ++ */ ++ if (qla2x00_chip_is_down(vha)) { ++ req->outstanding_cmds[cnt] = NULL; ++ spin_unlock_irqrestore(qp->qp_lock_ptr, flags); ++ sp->done(sp, res); ++ spin_lock_irqsave(qp->qp_lock_ptr, flags); ++ continue; ++ } ++ + switch (sp->cmd_type) { + case TYPE_SRB: + qla2x00_abort_srb(qp, sp, res, &flags); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-115-smb3-lower-default-deferred-close-timeout-to-ad.patch b/patches.kernel.org/6.2.9-115-smb3-lower-default-deferred-close-timeout-to-ad.patch new file mode 100644 index 0000000..4f6ec18 --- /dev/null +++ b/patches.kernel.org/6.2.9-115-smb3-lower-default-deferred-close-timeout-to-ad.patch @@ -0,0 +1,49 @@ +From: Steve French +Date: Thu, 23 Mar 2023 15:10:26 -0500 +Subject: [PATCH] smb3: lower default deferred close timeout to address perf + regression +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 7e0e76d99079be13c9961dde7c93b2d1ee665af4 + +commit 7e0e76d99079be13c9961dde7c93b2d1ee665af4 upstream. + +Performance tests with large number of threads noted that the change +of the default closetimeo (deferred close timeout between when +close is done by application and when client has to send the close +to the server), to 5 seconds from 1 second, significantly degraded +perf in some cases like this (in the filebench example reported, +the stats show close requests on the wire taking twice as long, +and 50% regression in filebench perf). This is stil configurable +via mount parm closetimeo, but to be safe, decrease default back +to its previous value of 1 second. + +Reported-by: Yin Fengwei +Reported-by: kernel test robot +Link: https://lore.kernel.org/lkml/997614df-10d4-af53-9571-edec36b0e2f3@intel.com/ +Fixes: 5efdd9122eff ("smb3: allow deferred close timeout to be configurable") +Cc: stable@vger.kernel.org # 6.0+ +Tested-by: Yin Fengwei +Reviewed-by: Paulo Alcantara (SUSE) +Reviewed-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cifs/fs_context.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/cifs/fs_context.h b/fs/cifs/fs_context.h +index 1b8d4e27..3de00e71 100644 +--- a/fs/cifs/fs_context.h ++++ b/fs/cifs/fs_context.h +@@ -286,5 +286,5 @@ extern void smb3_update_mnt_flags(struct cifs_sb_info *cifs_sb); + * max deferred close timeout (jiffies) - 2^30 + */ + #define SMB3_MAX_DCLOSETIMEO (1 << 30) +-#define SMB3_DEF_DCLOSETIMEO (5 * HZ) /* Can increase later, other clients use larger */ ++#define SMB3_DEF_DCLOSETIMEO (1 * HZ) /* even 1 sec enough to help eg open/write/close/open/read */ + #endif +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-116-smb3-fix-unusable-share-after-force-unmount-fai.patch b/patches.kernel.org/6.2.9-116-smb3-fix-unusable-share-after-force-unmount-fai.patch new file mode 100644 index 0000000..877f26a --- /dev/null +++ b/patches.kernel.org/6.2.9-116-smb3-fix-unusable-share-after-force-unmount-fai.patch @@ -0,0 +1,116 @@ +From: Steve French +Date: Thu, 23 Mar 2023 16:20:02 -0500 +Subject: [PATCH] smb3: fix unusable share after force unmount failure +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 491eafce1a51c457701351a4bf40733799745314 + +commit 491eafce1a51c457701351a4bf40733799745314 upstream. + +If user does forced unmount ("umount -f") while files are still open +on the share (as was seen in a Kubernetes example running on SMB3.1.1 +mount) then we were marking the share as "TID_EXITING" in umount_begin() +which caused all subsequent operations (except write) to fail ... but +unfortunately when umount_begin() is called we do not know yet that +there are open files or active references on the share that would prevent +unmount from succeeding. Kubernetes had example when they were doing +umount -f when files were open which caused the share to become +unusable until the files were closed (and the umount retried). + +Fix this so that TID_EXITING is not set until we are about to send +the tree disconnect (not at the beginning of forced umounts in +umount_begin) so that if "umount -f" fails (due to open files or +references) the mount is still usable. + +Cc: stable@vger.kernel.org +Reviewed-by: Shyam Prasad N +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cifs/cifsfs.c | 9 ++++++--- + fs/cifs/cifssmb.c | 6 ++---- + fs/cifs/connect.c | 1 + + fs/cifs/smb2pdu.c | 8 ++------ + 4 files changed, 11 insertions(+), 13 deletions(-) + +diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c +index 10e00c62..8485d380 100644 +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -730,13 +730,16 @@ static void cifs_umount_begin(struct super_block *sb) + spin_lock(&tcon->tc_lock); + if ((tcon->tc_count > 1) || (tcon->status == TID_EXITING)) { + /* we have other mounts to same share or we have +- already tried to force umount this and woken up ++ already tried to umount this and woken up + all waiting network requests, nothing to do */ + spin_unlock(&tcon->tc_lock); + spin_unlock(&cifs_tcp_ses_lock); + return; +- } else if (tcon->tc_count == 1) +- tcon->status = TID_EXITING; ++ } ++ /* ++ * can not set tcon->status to TID_EXITING yet since we don't know if umount -f will ++ * fail later (e.g. due to open files). TID_EXITING will be set just before tdis req sent ++ */ + spin_unlock(&tcon->tc_lock); + spin_unlock(&cifs_tcp_ses_lock); + +diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c +index 8c014a3f..566e6a26 100644 +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -85,13 +85,11 @@ cifs_reconnect_tcon(struct cifs_tcon *tcon, int smb_command) + + /* + * only tree disconnect, open, and write, (and ulogoff which does not +- * have tcon) are allowed as we start force umount ++ * have tcon) are allowed as we start umount + */ + spin_lock(&tcon->tc_lock); + if (tcon->status == TID_EXITING) { +- if (smb_command != SMB_COM_WRITE_ANDX && +- smb_command != SMB_COM_OPEN_ANDX && +- smb_command != SMB_COM_TREE_DISCONNECT) { ++ if (smb_command != SMB_COM_TREE_DISCONNECT) { + spin_unlock(&tcon->tc_lock); + cifs_dbg(FYI, "can not send cmd %d while umounting\n", + smb_command); +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 5a889f5f..b41e9472 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -2363,6 +2363,7 @@ cifs_put_tcon(struct cifs_tcon *tcon) + WARN_ON(tcon->tc_count < 0); + + list_del_init(&tcon->tcon_list); ++ tcon->status = TID_EXITING; + spin_unlock(&tcon->tc_lock); + spin_unlock(&cifs_tcp_ses_lock); + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 23926f75..c1aba3dd 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -225,13 +225,9 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + spin_lock(&tcon->tc_lock); + if (tcon->status == TID_EXITING) { + /* +- * only tree disconnect, open, and write, +- * (and ulogoff which does not have tcon) +- * are allowed as we start force umount. ++ * only tree disconnect allowed when disconnecting ... + */ +- if ((smb2_command != SMB2_WRITE) && +- (smb2_command != SMB2_CREATE) && +- (smb2_command != SMB2_TREE_DISCONNECT)) { ++ if (smb2_command != SMB2_TREE_DISCONNECT) { + spin_unlock(&tcon->tc_lock); + cifs_dbg(FYI, "can not send cmd %d while umounting\n", + smb2_command); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-117-uas-Add-US_FL_NO_REPORT_OPCODES-for-JMicron-JMS.patch b/patches.kernel.org/6.2.9-117-uas-Add-US_FL_NO_REPORT_OPCODES-for-JMicron-JMS.patch new file mode 100644 index 0000000..feef5bf --- /dev/null +++ b/patches.kernel.org/6.2.9-117-uas-Add-US_FL_NO_REPORT_OPCODES-for-JMicron-JMS.patch @@ -0,0 +1,42 @@ +From: Yaroslav Furman +Date: Sun, 12 Mar 2023 11:07:45 +0200 +Subject: [PATCH] uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2 +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: a37eb61b6ec064ac794b8a1e89fd33eb582fe51d + +commit a37eb61b6ec064ac794b8a1e89fd33eb582fe51d upstream. + +Just like other JMicron JMS5xx enclosures, it chokes on report-opcodes, +let's avoid them. + +Signed-off-by: Yaroslav Furman +Cc: stable +Link: https://lore.kernel.org/r/20230312090745.47962-1-yaro330@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/storage/unusual_uas.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h +index c7b763d6..1f8c9b16 100644 +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -111,6 +111,13 @@ UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_BROKEN_FUA), + ++/* Reported by: Yaroslav Furman */ ++UNUSUAL_DEV(0x152d, 0x0583, 0x0000, 0x9999, ++ "JMicron", ++ "JMS583Gen 2", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_REPORT_OPCODES), ++ + /* Reported-by: Thinh Nguyen */ + UNUSUAL_DEV(0x154b, 0xf00b, 0x0000, 0x9999, + "PNY", +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-118-thunderbolt-Use-scale-field-when-allocating-USB.patch b/patches.kernel.org/6.2.9-118-thunderbolt-Use-scale-field-when-allocating-USB.patch new file mode 100644 index 0000000..bb767d3 --- /dev/null +++ b/patches.kernel.org/6.2.9-118-thunderbolt-Use-scale-field-when-allocating-USB.patch @@ -0,0 +1,66 @@ +From: Mika Westerberg +Date: Tue, 27 Dec 2022 11:55:26 +0200 +Subject: [PATCH] thunderbolt: Use scale field when allocating USB3 bandwidth +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: c82510b1d87bdebfe916048857d2ef46f1778aa5 + +commit c82510b1d87bdebfe916048857d2ef46f1778aa5 upstream. + +When tunneling aggregated USB3 (20 Gb/s) the bandwidth values that are +programmed to the ADP_USB3_CS_2 go higher than 4096 and that does not +fit anymore to the 12-bit field. Fix this by scaling the value using +the scale field accordingly. + +Fixes: 3b1d8d577ca8 ("thunderbolt: Implement USB3 bandwidth negotiation routines") +Cc: stable@vger.kernel.org +Signed-off-by: Mika Westerberg +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/thunderbolt/usb4.c | 22 +++++++++++++++++----- + 1 file changed, 17 insertions(+), 5 deletions(-) + +diff --git a/drivers/thunderbolt/usb4.c b/drivers/thunderbolt/usb4.c +index 2ed50fcb..ed1622ec 100644 +--- a/drivers/thunderbolt/usb4.c ++++ b/drivers/thunderbolt/usb4.c +@@ -2067,18 +2067,30 @@ static int usb4_usb3_port_write_allocated_bandwidth(struct tb_port *port, + int downstream_bw) + { + u32 val, ubw, dbw, scale; +- int ret; ++ int ret, max_bw; + +- /* Read the used scale, hardware default is 0 */ +- ret = tb_port_read(port, &scale, TB_CFG_PORT, +- port->cap_adap + ADP_USB3_CS_3, 1); ++ /* Figure out suitable scale */ ++ scale = 0; ++ max_bw = max(upstream_bw, downstream_bw); ++ while (scale < 64) { ++ if (mbps_to_usb3_bw(max_bw, scale) < 4096) ++ break; ++ scale++; ++ } ++ ++ if (WARN_ON(scale >= 64)) ++ return -EINVAL; ++ ++ ret = tb_port_write(port, &scale, TB_CFG_PORT, ++ port->cap_adap + ADP_USB3_CS_3, 1); + if (ret) + return ret; + +- scale &= ADP_USB3_CS_3_SCALE_MASK; + ubw = mbps_to_usb3_bw(upstream_bw, scale); + dbw = mbps_to_usb3_bw(downstream_bw, scale); + ++ tb_port_dbg(port, "scaled bandwidth %u/%u, scale %u\n", ubw, dbw, scale); ++ + ret = tb_port_read(port, &val, TB_CFG_PORT, + port->cap_adap + ADP_USB3_CS_2, 1); + if (ret) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-119-thunderbolt-Call-tb_check_quirks-after-initiali.patch b/patches.kernel.org/6.2.9-119-thunderbolt-Call-tb_check_quirks-after-initiali.patch new file mode 100644 index 0000000..913afa3 --- /dev/null +++ b/patches.kernel.org/6.2.9-119-thunderbolt-Call-tb_check_quirks-after-initiali.patch @@ -0,0 +1,47 @@ +From: Mika Westerberg +Date: Fri, 3 Feb 2023 15:55:41 +0200 +Subject: [PATCH] thunderbolt: Call tb_check_quirks() after initializing + adapters +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: d2d6ddf188f609861489d5d188d545856a3ed399 + +commit d2d6ddf188f609861489d5d188d545856a3ed399 upstream. + +In order to apply quirks based on certain adapter types move call to +tb_check_quirks() happen after the adapters are initialized. This should +not affect the existing quirks. + +Cc: stable@vger.kernel.org +Signed-off-by: Mika Westerberg +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/thunderbolt/switch.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c +index 363d712a..302a73cb 100644 +--- a/drivers/thunderbolt/switch.c ++++ b/drivers/thunderbolt/switch.c +@@ -2960,8 +2960,6 @@ int tb_switch_add(struct tb_switch *sw) + dev_warn(&sw->dev, "reading DROM failed: %d\n", ret); + tb_sw_dbg(sw, "uid: %#llx\n", sw->uid); + +- tb_check_quirks(sw); +- + ret = tb_switch_set_uuid(sw); + if (ret) { + dev_err(&sw->dev, "failed to set UUID\n"); +@@ -2980,6 +2978,8 @@ int tb_switch_add(struct tb_switch *sw) + } + } + ++ tb_check_quirks(sw); ++ + tb_switch_default_link_ports(sw); + + ret = tb_switch_update_link_attributes(sw); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-120-thunderbolt-Add-quirk-to-disable-CLx.patch b/patches.kernel.org/6.2.9-120-thunderbolt-Add-quirk-to-disable-CLx.patch new file mode 100644 index 0000000..26ac9a2 --- /dev/null +++ b/patches.kernel.org/6.2.9-120-thunderbolt-Add-quirk-to-disable-CLx.patch @@ -0,0 +1,97 @@ +From: Sanjay R Mehta +Date: Tue, 14 Feb 2023 13:13:50 -0600 +Subject: [PATCH] thunderbolt: Add quirk to disable CLx +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 7af9da8ce8f9a16221ecd8ba4280582f5bd452fc + +commit 7af9da8ce8f9a16221ecd8ba4280582f5bd452fc upstream. + +Add QUIRK_NO_CLX to disable the CLx state for hardware which +doesn't supports it. + +AMD Yellow Carp and Pink Sardine don't support CLx state, +hence disabling it using QUIRK_NO_CLX. + +Cc: stable@vger.kernel.org +Signed-off-by: Sanjay R Mehta +Signed-off-by: Basavaraj Natikar +[mw: added debug log when the quirk is run] +Signed-off-by: Mika Westerberg +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/thunderbolt/quirks.c | 13 +++++++++++++ + drivers/thunderbolt/tb.h | 11 ++++++++--- + 2 files changed, 21 insertions(+), 3 deletions(-) + +diff --git a/drivers/thunderbolt/quirks.c b/drivers/thunderbolt/quirks.c +index b5f2ec79..ae28a03f 100644 +--- a/drivers/thunderbolt/quirks.c ++++ b/drivers/thunderbolt/quirks.c +@@ -20,6 +20,12 @@ static void quirk_dp_credit_allocation(struct tb_switch *sw) + } + } + ++static void quirk_clx_disable(struct tb_switch *sw) ++{ ++ sw->quirks |= QUIRK_NO_CLX; ++ tb_sw_dbg(sw, "disabling CL states\n"); ++} ++ + struct tb_quirk { + u16 hw_vendor_id; + u16 hw_device_id; +@@ -37,6 +43,13 @@ static const struct tb_quirk tb_quirks[] = { + * DP buffers. + */ + { 0x8087, 0x0b26, 0x0000, 0x0000, quirk_dp_credit_allocation }, ++ /* ++ * CLx is not supported on AMD USB4 Yellow Carp and Pink Sardine platforms. ++ */ ++ { 0x0438, 0x0208, 0x0000, 0x0000, quirk_clx_disable }, ++ { 0x0438, 0x0209, 0x0000, 0x0000, quirk_clx_disable }, ++ { 0x0438, 0x020a, 0x0000, 0x0000, quirk_clx_disable }, ++ { 0x0438, 0x020b, 0x0000, 0x0000, quirk_clx_disable }, + }; + + /** +diff --git a/drivers/thunderbolt/tb.h b/drivers/thunderbolt/tb.h +index f9786976..206759ad 100644 +--- a/drivers/thunderbolt/tb.h ++++ b/drivers/thunderbolt/tb.h +@@ -23,6 +23,11 @@ + #define NVM_MAX_SIZE SZ_512K + #define NVM_DATA_DWORDS 16 + ++/* Keep link controller awake during update */ ++#define QUIRK_FORCE_POWER_LINK_CONTROLLER BIT(0) ++/* Disable CLx if not supported */ ++#define QUIRK_NO_CLX BIT(1) ++ + /** + * struct tb_nvm - Structure holding NVM information + * @dev: Owner of the NVM +@@ -997,6 +1002,9 @@ static inline bool tb_switch_is_clx_enabled(const struct tb_switch *sw, + */ + static inline bool tb_switch_is_clx_supported(const struct tb_switch *sw) + { ++ if (sw->quirks & QUIRK_NO_CLX) ++ return false; ++ + return tb_switch_is_usb4(sw) || tb_switch_is_titan_ridge(sw); + } + +@@ -1254,9 +1262,6 @@ struct usb4_port *usb4_port_device_add(struct tb_port *port); + void usb4_port_device_remove(struct usb4_port *usb4); + int usb4_port_device_resume(struct usb4_port *usb4); + +-/* Keep link controller awake during update */ +-#define QUIRK_FORCE_POWER_LINK_CONTROLLER BIT(0) +- + void tb_check_quirks(struct tb_switch *sw); + + #ifdef CONFIG_ACPI +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-121-thunderbolt-Fix-memory-leak-in-margining.patch b/patches.kernel.org/6.2.9-121-thunderbolt-Fix-memory-leak-in-margining.patch new file mode 100644 index 0000000..238be98 --- /dev/null +++ b/patches.kernel.org/6.2.9-121-thunderbolt-Fix-memory-leak-in-margining.patch @@ -0,0 +1,63 @@ +From: Mika Westerberg +Date: Fri, 3 Mar 2023 11:25:08 +0200 +Subject: [PATCH] thunderbolt: Fix memory leak in margining +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: acec726473822bc6b585961f4ca2a11fa7f28341 + +commit acec726473822bc6b585961f4ca2a11fa7f28341 upstream. + +Memory for the usb4->margining needs to be relased for the upstream port +of the router as well, even though the debugfs directory gets released +with the router device removal. Fix this. + +Fixes: d0f1e0c2a699 ("thunderbolt: Add support for receiver lane margining") +Cc: stable@vger.kernel.org +Signed-off-by: Mika Westerberg +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/thunderbolt/debugfs.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/thunderbolt/debugfs.c b/drivers/thunderbolt/debugfs.c +index 834bcad4..d89f9203 100644 +--- a/drivers/thunderbolt/debugfs.c ++++ b/drivers/thunderbolt/debugfs.c +@@ -942,7 +942,8 @@ static void margining_port_remove(struct tb_port *port) + + snprintf(dir_name, sizeof(dir_name), "port%d", port->port); + parent = debugfs_lookup(dir_name, port->sw->debugfs_dir); +- debugfs_remove_recursive(debugfs_lookup("margining", parent)); ++ if (parent) ++ debugfs_remove_recursive(debugfs_lookup("margining", parent)); + + kfree(port->usb4->margining); + port->usb4->margining = NULL; +@@ -967,19 +968,18 @@ static void margining_switch_init(struct tb_switch *sw) + + static void margining_switch_remove(struct tb_switch *sw) + { ++ struct tb_port *upstream, *downstream; + struct tb_switch *parent_sw; +- struct tb_port *downstream; + u64 route = tb_route(sw); + + if (!route) + return; + +- /* +- * Upstream is removed with the router itself but we need to +- * remove the downstream port margining directory. +- */ ++ upstream = tb_upstream_port(sw); + parent_sw = tb_switch_parent(sw); + downstream = tb_port_at(route, parent_sw); ++ ++ margining_port_remove(upstream); + margining_port_remove(downstream); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-122-thunderbolt-Disable-interrupt-auto-clear-for-ri.patch b/patches.kernel.org/6.2.9-122-thunderbolt-Disable-interrupt-auto-clear-for-ri.patch new file mode 100644 index 0000000..84cbb67 --- /dev/null +++ b/patches.kernel.org/6.2.9-122-thunderbolt-Disable-interrupt-auto-clear-for-ri.patch @@ -0,0 +1,133 @@ +From: Mario Limonciello +Date: Fri, 10 Mar 2023 11:20:50 -0600 +Subject: [PATCH] thunderbolt: Disable interrupt auto clear for rings +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 468c49f44759720a312e52d44a71c3949ed63d7c + +commit 468c49f44759720a312e52d44a71c3949ed63d7c upstream. + +When interrupt auto clear is programmed, any read to the interrupt +status register will clear all interrupts. If two interrupts have +come in before one can be serviced then this will cause lost interrupts. + +On AMD USB4 routers this has manifested in odd problems particularly +with long strings of control tranfers such as reading the DROM via bit +banging. + +Instead of clearing interrupts automatically, clear the bit corresponding +to the given ring's interrupt in the ISR. + +Fixes: 7a1808f82a37 ("thunderbolt: Handle ring interrupt by reading interrupt status register") +Cc: Sanju Mehta +Cc: stable@vger.kernel.org +Tested-by: Anson Tsao +Signed-off-by: Mario Limonciello +Signed-off-by: Mika Westerberg +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/thunderbolt/nhi.c | 40 +++++++++++++++++++++------------- + drivers/thunderbolt/nhi_regs.h | 6 +++-- + 2 files changed, 29 insertions(+), 17 deletions(-) + +diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c +index 4dce2edd..6a56293d 100644 +--- a/drivers/thunderbolt/nhi.c ++++ b/drivers/thunderbolt/nhi.c +@@ -71,24 +71,31 @@ static void ring_interrupt_active(struct tb_ring *ring, bool active) + u32 step, shift, ivr, misc; + void __iomem *ivr_base; + int index; ++ int bit; + + if (ring->is_tx) + index = ring->hop; + else + index = ring->hop + ring->nhi->hop_count; + +- if (ring->nhi->quirks & QUIRK_AUTO_CLEAR_INT) { +- /* +- * Ask the hardware to clear interrupt status +- * bits automatically since we already know +- * which interrupt was triggered. +- */ +- misc = ioread32(ring->nhi->iobase + REG_DMA_MISC); +- if (!(misc & REG_DMA_MISC_INT_AUTO_CLEAR)) { +- misc |= REG_DMA_MISC_INT_AUTO_CLEAR; +- iowrite32(misc, ring->nhi->iobase + REG_DMA_MISC); +- } +- } ++ /* ++ * Intel routers support a bit that isn't part of ++ * the USB4 spec to ask the hardware to clear ++ * interrupt status bits automatically since ++ * we already know which interrupt was triggered. ++ * ++ * Other routers explicitly disable auto-clear ++ * to prevent conditions that may occur where two ++ * MSIX interrupts are simultaneously active and ++ * reading the register clears both of them. ++ */ ++ misc = ioread32(ring->nhi->iobase + REG_DMA_MISC); ++ if (ring->nhi->quirks & QUIRK_AUTO_CLEAR_INT) ++ bit = REG_DMA_MISC_INT_AUTO_CLEAR; ++ else ++ bit = REG_DMA_MISC_DISABLE_AUTO_CLEAR; ++ if (!(misc & bit)) ++ iowrite32(misc | bit, ring->nhi->iobase + REG_DMA_MISC); + + ivr_base = ring->nhi->iobase + REG_INT_VEC_ALLOC_BASE; + step = index / REG_INT_VEC_ALLOC_REGS * REG_INT_VEC_ALLOC_BITS; +@@ -393,14 +400,17 @@ EXPORT_SYMBOL_GPL(tb_ring_poll_complete); + + static void ring_clear_msix(const struct tb_ring *ring) + { ++ int bit; ++ + if (ring->nhi->quirks & QUIRK_AUTO_CLEAR_INT) + return; + ++ bit = ring_interrupt_index(ring) & 31; + if (ring->is_tx) +- ioread32(ring->nhi->iobase + REG_RING_NOTIFY_BASE); ++ iowrite32(BIT(bit), ring->nhi->iobase + REG_RING_INT_CLEAR); + else +- ioread32(ring->nhi->iobase + REG_RING_NOTIFY_BASE + +- 4 * (ring->nhi->hop_count / 32)); ++ iowrite32(BIT(bit), ring->nhi->iobase + REG_RING_INT_CLEAR + ++ 4 * (ring->nhi->hop_count / 32)); + } + + static irqreturn_t ring_msix(int irq, void *data) +diff --git a/drivers/thunderbolt/nhi_regs.h b/drivers/thunderbolt/nhi_regs.h +index 0d4970dc..faef165a 100644 +--- a/drivers/thunderbolt/nhi_regs.h ++++ b/drivers/thunderbolt/nhi_regs.h +@@ -77,12 +77,13 @@ struct ring_desc { + + /* + * three bitfields: tx, rx, rx overflow +- * Every bitfield contains one bit for every hop (REG_HOP_COUNT). Registers are +- * cleared on read. New interrupts are fired only after ALL registers have been ++ * Every bitfield contains one bit for every hop (REG_HOP_COUNT). ++ * New interrupts are fired only after ALL registers have been + * read (even those containing only disabled rings). + */ + #define REG_RING_NOTIFY_BASE 0x37800 + #define RING_NOTIFY_REG_COUNT(nhi) ((31 + 3 * nhi->hop_count) / 32) ++#define REG_RING_INT_CLEAR 0x37808 + + /* + * two bitfields: rx, tx +@@ -105,6 +106,7 @@ struct ring_desc { + + #define REG_DMA_MISC 0x39864 + #define REG_DMA_MISC_INT_AUTO_CLEAR BIT(2) ++#define REG_DMA_MISC_DISABLE_AUTO_CLEAR BIT(17) + + #define REG_INMAIL_DATA 0x39900 + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-123-thunderbolt-Add-missing-UNSET_INBOUND_SBTX-for-.patch b/patches.kernel.org/6.2.9-123-thunderbolt-Add-missing-UNSET_INBOUND_SBTX-for-.patch new file mode 100644 index 0000000..789ef79 --- /dev/null +++ b/patches.kernel.org/6.2.9-123-thunderbolt-Add-missing-UNSET_INBOUND_SBTX-for-.patch @@ -0,0 +1,153 @@ +From: Gil Fine +Date: Fri, 3 Mar 2023 00:17:24 +0200 +Subject: [PATCH] thunderbolt: Add missing UNSET_INBOUND_SBTX for retimer + access +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: cd0c1e582b055dea615001b8bd8eccaf6f69f7ce + +commit cd0c1e582b055dea615001b8bd8eccaf6f69f7ce upstream. + +According to USB4 retimer specification, the process of firmware update +sequence requires issuing a SET_INBOUND_SBTX port operation that later +shall be followed by UNSET_INBOUND_SBTX port operation. This last step +is not currently issued by the driver but it is necessary to make sure +the retimers are put back to passthrough mode even during enumeration. + +If this step is missing the link may not come up properly after +soft-reboot for example. + +For this reason issue UNSET_INBOUND_SBTX after SET_INBOUND_SBTX for +enumeration and also when the NVM upgrade is run. + +Reported-by: Christian Schaubschläger +Link: https://lore.kernel.org/linux-usb/b556f5ed-5ee8-9990-9910-afd60db93310@gmx.at/ +Cc: stable@vger.kernel.org +Signed-off-by: Gil Fine +Signed-off-by: Mika Westerberg +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/thunderbolt/retimer.c | 23 +++++++++++++++++++++-- + drivers/thunderbolt/sb_regs.h | 1 + + drivers/thunderbolt/tb.h | 1 + + drivers/thunderbolt/usb4.c | 14 ++++++++++++++ + 4 files changed, 37 insertions(+), 2 deletions(-) + +diff --git a/drivers/thunderbolt/retimer.c b/drivers/thunderbolt/retimer.c +index 56008eb9..9cc28197 100644 +--- a/drivers/thunderbolt/retimer.c ++++ b/drivers/thunderbolt/retimer.c +@@ -187,6 +187,22 @@ static ssize_t nvm_authenticate_show(struct device *dev, + return ret; + } + ++static void tb_retimer_set_inbound_sbtx(struct tb_port *port) ++{ ++ int i; ++ ++ for (i = 1; i <= TB_MAX_RETIMER_INDEX; i++) ++ usb4_port_retimer_set_inbound_sbtx(port, i); ++} ++ ++static void tb_retimer_unset_inbound_sbtx(struct tb_port *port) ++{ ++ int i; ++ ++ for (i = TB_MAX_RETIMER_INDEX; i >= 1; i--) ++ usb4_port_retimer_unset_inbound_sbtx(port, i); ++} ++ + static ssize_t nvm_authenticate_store(struct device *dev, + struct device_attribute *attr, const char *buf, size_t count) + { +@@ -213,6 +229,7 @@ static ssize_t nvm_authenticate_store(struct device *dev, + rt->auth_status = 0; + + if (val) { ++ tb_retimer_set_inbound_sbtx(rt->port); + if (val == AUTHENTICATE_ONLY) { + ret = tb_retimer_nvm_authenticate(rt, true); + } else { +@@ -232,6 +249,7 @@ static ssize_t nvm_authenticate_store(struct device *dev, + } + + exit_unlock: ++ tb_retimer_unset_inbound_sbtx(rt->port); + mutex_unlock(&rt->tb->lock); + exit_rpm: + pm_runtime_mark_last_busy(&rt->dev); +@@ -440,8 +458,7 @@ int tb_retimer_scan(struct tb_port *port, bool add) + * Enable sideband channel for each retimer. We can do this + * regardless whether there is device connected or not. + */ +- for (i = 1; i <= TB_MAX_RETIMER_INDEX; i++) +- usb4_port_retimer_set_inbound_sbtx(port, i); ++ tb_retimer_set_inbound_sbtx(port); + + /* + * Before doing anything else, read the authentication status. +@@ -464,6 +481,8 @@ int tb_retimer_scan(struct tb_port *port, bool add) + break; + } + ++ tb_retimer_unset_inbound_sbtx(port); ++ + if (!last_idx) + return 0; + +diff --git a/drivers/thunderbolt/sb_regs.h b/drivers/thunderbolt/sb_regs.h +index 5185cf3e..f37a4320 100644 +--- a/drivers/thunderbolt/sb_regs.h ++++ b/drivers/thunderbolt/sb_regs.h +@@ -20,6 +20,7 @@ enum usb4_sb_opcode { + USB4_SB_OPCODE_ROUTER_OFFLINE = 0x4e45534c, /* "LSEN" */ + USB4_SB_OPCODE_ENUMERATE_RETIMERS = 0x4d554e45, /* "ENUM" */ + USB4_SB_OPCODE_SET_INBOUND_SBTX = 0x5055534c, /* "LSUP" */ ++ USB4_SB_OPCODE_UNSET_INBOUND_SBTX = 0x50555355, /* "USUP" */ + USB4_SB_OPCODE_QUERY_LAST_RETIMER = 0x5453414c, /* "LAST" */ + USB4_SB_OPCODE_GET_NVM_SECTOR_SIZE = 0x53534e47, /* "GNSS" */ + USB4_SB_OPCODE_NVM_SET_OFFSET = 0x53504f42, /* "BOPS" */ +diff --git a/drivers/thunderbolt/tb.h b/drivers/thunderbolt/tb.h +index 206759ad..e11d973a 100644 +--- a/drivers/thunderbolt/tb.h ++++ b/drivers/thunderbolt/tb.h +@@ -1220,6 +1220,7 @@ int usb4_port_sw_margin(struct tb_port *port, unsigned int lanes, bool timing, + int usb4_port_sw_margin_errors(struct tb_port *port, u32 *errors); + + int usb4_port_retimer_set_inbound_sbtx(struct tb_port *port, u8 index); ++int usb4_port_retimer_unset_inbound_sbtx(struct tb_port *port, u8 index); + int usb4_port_retimer_read(struct tb_port *port, u8 index, u8 reg, void *buf, + u8 size); + int usb4_port_retimer_write(struct tb_port *port, u8 index, u8 reg, +diff --git a/drivers/thunderbolt/usb4.c b/drivers/thunderbolt/usb4.c +index ed1622ec..d5cd219e 100644 +--- a/drivers/thunderbolt/usb4.c ++++ b/drivers/thunderbolt/usb4.c +@@ -1578,6 +1578,20 @@ int usb4_port_retimer_set_inbound_sbtx(struct tb_port *port, u8 index) + 500); + } + ++/** ++ * usb4_port_retimer_unset_inbound_sbtx() - Disable sideband channel transactions ++ * @port: USB4 port ++ * @index: Retimer index ++ * ++ * Disables sideband channel transations on SBTX. The reverse of ++ * usb4_port_retimer_set_inbound_sbtx(). ++ */ ++int usb4_port_retimer_unset_inbound_sbtx(struct tb_port *port, u8 index) ++{ ++ return usb4_port_retimer_op(port, index, ++ USB4_SB_OPCODE_UNSET_INBOUND_SBTX, 500); ++} ++ + /** + * usb4_port_retimer_read() - Read from retimer sideband registers + * @port: USB4 port +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-124-thunderbolt-Use-const-qualifier-for-ring_interr.patch b/patches.kernel.org/6.2.9-124-thunderbolt-Use-const-qualifier-for-ring_interr.patch new file mode 100644 index 0000000..3d809df --- /dev/null +++ b/patches.kernel.org/6.2.9-124-thunderbolt-Use-const-qualifier-for-ring_interr.patch @@ -0,0 +1,39 @@ +From: Mario Limonciello +Date: Fri, 10 Mar 2023 11:20:49 -0600 +Subject: [PATCH] thunderbolt: Use const qualifier for `ring_interrupt_index` +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 1716efdb07938bd6510e1127d02012799112c433 + +commit 1716efdb07938bd6510e1127d02012799112c433 upstream. + +`ring_interrupt_index` doesn't change the data for `ring` so mark it as +const. This is needed by the following patch that disables interrupt +auto clear for rings. + +Cc: Sanju Mehta +Cc: stable@vger.kernel.org +Signed-off-by: Mario Limonciello +Signed-off-by: Mika Westerberg +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/thunderbolt/nhi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c +index 6a56293d..318d20bd 100644 +--- a/drivers/thunderbolt/nhi.c ++++ b/drivers/thunderbolt/nhi.c +@@ -46,7 +46,7 @@ + #define QUIRK_AUTO_CLEAR_INT BIT(0) + #define QUIRK_E2E BIT(1) + +-static int ring_interrupt_index(struct tb_ring *ring) ++static int ring_interrupt_index(const struct tb_ring *ring) + { + int bit = ring->hop; + if (!ring->is_tx) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-125-thunderbolt-Rename-shadowed-variables-bit-to-in.patch b/patches.kernel.org/6.2.9-125-thunderbolt-Rename-shadowed-variables-bit-to-in.patch new file mode 100644 index 0000000..75fcffa --- /dev/null +++ b/patches.kernel.org/6.2.9-125-thunderbolt-Rename-shadowed-variables-bit-to-in.patch @@ -0,0 +1,85 @@ +From: Tom Rix +Date: Wed, 15 Mar 2023 18:04:50 -0400 +Subject: [PATCH] thunderbolt: Rename shadowed variables bit to interrupt_bit + and auto_clear_bit +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 58cdfe6f58b35f17f56386f5fcf937168a423ad1 + +commit 58cdfe6f58b35f17f56386f5fcf937168a423ad1 upstream. + +cppcheck reports +drivers/thunderbolt/nhi.c:74:7: style: Local variable 'bit' shadows outer variable [shadowVariable] + int bit; + ^ +drivers/thunderbolt/nhi.c:66:6: note: Shadowed declaration + int bit = ring_interrupt_index(ring) & 31; + ^ +drivers/thunderbolt/nhi.c:74:7: note: Shadow variable + int bit; + ^ +For readablity rename the outer to interrupt_bit and the innner +to auto_clear_bit. + +Fixes: 468c49f44759 ("thunderbolt: Disable interrupt auto clear for ring") +Cc: stable@vger.kernel.org +Signed-off-by: Tom Rix +Signed-off-by: Mika Westerberg +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/thunderbolt/nhi.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c +index 318d20bd..cfebec10 100644 +--- a/drivers/thunderbolt/nhi.c ++++ b/drivers/thunderbolt/nhi.c +@@ -63,15 +63,15 @@ static void ring_interrupt_active(struct tb_ring *ring, bool active) + { + int reg = REG_RING_INTERRUPT_BASE + + ring_interrupt_index(ring) / 32 * 4; +- int bit = ring_interrupt_index(ring) & 31; +- int mask = 1 << bit; ++ int interrupt_bit = ring_interrupt_index(ring) & 31; ++ int mask = 1 << interrupt_bit; + u32 old, new; + + if (ring->irq > 0) { + u32 step, shift, ivr, misc; + void __iomem *ivr_base; ++ int auto_clear_bit; + int index; +- int bit; + + if (ring->is_tx) + index = ring->hop; +@@ -91,11 +91,12 @@ static void ring_interrupt_active(struct tb_ring *ring, bool active) + */ + misc = ioread32(ring->nhi->iobase + REG_DMA_MISC); + if (ring->nhi->quirks & QUIRK_AUTO_CLEAR_INT) +- bit = REG_DMA_MISC_INT_AUTO_CLEAR; ++ auto_clear_bit = REG_DMA_MISC_INT_AUTO_CLEAR; + else +- bit = REG_DMA_MISC_DISABLE_AUTO_CLEAR; +- if (!(misc & bit)) +- iowrite32(misc | bit, ring->nhi->iobase + REG_DMA_MISC); ++ auto_clear_bit = REG_DMA_MISC_DISABLE_AUTO_CLEAR; ++ if (!(misc & auto_clear_bit)) ++ iowrite32(misc | auto_clear_bit, ++ ring->nhi->iobase + REG_DMA_MISC); + + ivr_base = ring->nhi->iobase + REG_INT_VEC_ALLOC_BASE; + step = index / REG_INT_VEC_ALLOC_REGS * REG_INT_VEC_ALLOC_BITS; +@@ -115,7 +116,7 @@ static void ring_interrupt_active(struct tb_ring *ring, bool active) + + dev_dbg(&ring->nhi->pdev->dev, + "%s interrupt at register %#x bit %d (%#x -> %#x)\n", +- active ? "enabling" : "disabling", reg, bit, old, new); ++ active ? "enabling" : "disabling", reg, interrupt_bit, old, new); + + if (new == old) + dev_WARN(&ring->nhi->pdev->dev, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-126-ASoC-amd-yp-Add-OMEN-by-HP-Gaming-Laptop-16z-n0.patch b/patches.kernel.org/6.2.9-126-ASoC-amd-yp-Add-OMEN-by-HP-Gaming-Laptop-16z-n0.patch new file mode 100644 index 0000000..311a902 --- /dev/null +++ b/patches.kernel.org/6.2.9-126-ASoC-amd-yp-Add-OMEN-by-HP-Gaming-Laptop-16z-n0.patch @@ -0,0 +1,42 @@ +From: Joseph Hunkeler +Date: Thu, 16 Feb 2023 10:50:07 -0500 +Subject: [PATCH] ASoC: amd: yp: Add OMEN by HP Gaming Laptop 16z-n000 to + quirks +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 22ce6843abec19270bf69b176d7ee0a4ef781da5 + +[ Upstream commit 22ce6843abec19270bf69b176d7ee0a4ef781da5 ] + +Enables display microphone on the HP OMEN 16z-n000 (8A42) laptop + +Signed-off-by: Joseph Hunkeler +Link: https://lore.kernel.org/r/20230216155007.26143-1-jhunkeler@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 36314753..4e681e9c 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -255,6 +255,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "15NBC1011"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "OMEN by HP Gaming Laptop 16z-n000"), ++ } ++ }, + {} + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-127-ASoC-Intel-sof_rt5682-Add-quirk-for-Rex-board-w.patch b/patches.kernel.org/6.2.9-127-ASoC-Intel-sof_rt5682-Add-quirk-for-Rex-board-w.patch new file mode 100644 index 0000000..dafb27c --- /dev/null +++ b/patches.kernel.org/6.2.9-127-ASoC-Intel-sof_rt5682-Add-quirk-for-Rex-board-w.patch @@ -0,0 +1,99 @@ +From: "Dharageswari.R" +Date: Mon, 20 Feb 2023 10:06:52 +0200 +Subject: [PATCH] ASoC: Intel: sof_rt5682: Add quirk for Rex board with + mx98360a amplifier +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 7e43b75d6a062197b3bf39ddd1b10ce2e2d2a9b0 + +[ Upstream commit 7e43b75d6a062197b3bf39ddd1b10ce2e2d2a9b0 ] + +Add mtl_mx98360a_rt5682 driver data for Chrome Rex board support. + +Signed-off-by: Dharageswari.R +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Ranjani Sridharan +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20230220080652.23136-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/intel/boards/sof_rt5682.c | 23 +++++++++++++++++++ + .../intel/common/soc-acpi-intel-mtl-match.c | 12 ++++++++++ + 2 files changed, 35 insertions(+) + +diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c +index 71a11d74..4fe44829 100644 +--- a/sound/soc/intel/boards/sof_rt5682.c ++++ b/sound/soc/intel/boards/sof_rt5682.c +@@ -223,6 +223,20 @@ static const struct dmi_system_id sof_rt5682_quirk_table[] = { + SOF_RT5682_SSP_AMP(2) | + SOF_RT5682_NUM_HDMIDEV(4)), + }, ++ { ++ .callback = sof_rt5682_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_PRODUCT_FAMILY, "Google_Rex"), ++ DMI_MATCH(DMI_OEM_STRING, "AUDIO-MAX98360_ALC5682I_I2S"), ++ }, ++ .driver_data = (void *)(SOF_RT5682_MCLK_EN | ++ SOF_RT5682_SSP_CODEC(2) | ++ SOF_SPEAKER_AMP_PRESENT | ++ SOF_MAX98360A_SPEAKER_AMP_PRESENT | ++ SOF_RT5682_SSP_AMP(0) | ++ SOF_RT5682_NUM_HDMIDEV(4) ++ ), ++ }, + { + .callback = sof_rt5682_quirk_cb, + .matches = { +@@ -1105,6 +1119,15 @@ static const struct platform_device_id board_ids[] = { + SOF_RT5682_SSP_AMP(1) | + SOF_RT5682_NUM_HDMIDEV(4)), + }, ++ { ++ .name = "mtl_mx98360_rt5682", ++ .driver_data = (kernel_ulong_t)(SOF_RT5682_MCLK_EN | ++ SOF_RT5682_SSP_CODEC(0) | ++ SOF_SPEAKER_AMP_PRESENT | ++ SOF_MAX98360A_SPEAKER_AMP_PRESENT | ++ SOF_RT5682_SSP_AMP(1) | ++ SOF_RT5682_NUM_HDMIDEV(4)), ++ }, + { + .name = "jsl_rt5682", + .driver_data = (kernel_ulong_t)(SOF_RT5682_MCLK_EN | +diff --git a/sound/soc/intel/common/soc-acpi-intel-mtl-match.c b/sound/soc/intel/common/soc-acpi-intel-mtl-match.c +index b1a66a0f..7911c3af 100644 +--- a/sound/soc/intel/common/soc-acpi-intel-mtl-match.c ++++ b/sound/soc/intel/common/soc-acpi-intel-mtl-match.c +@@ -15,6 +15,11 @@ static const struct snd_soc_acpi_codecs mtl_max98357a_amp = { + .codecs = {"MX98357A"} + }; + ++static const struct snd_soc_acpi_codecs mtl_max98360a_amp = { ++ .num_codecs = 1, ++ .codecs = {"MX98360A"} ++}; ++ + static const struct snd_soc_acpi_codecs mtl_rt5682_rt5682s_hp = { + .num_codecs = 2, + .codecs = {"10EC5682", "RTL5682"}, +@@ -28,6 +33,13 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_mtl_machines[] = { + .quirk_data = &mtl_max98357a_amp, + .sof_tplg_filename = "sof-mtl-max98357a-rt5682.tplg", + }, ++ { ++ .comp_ids = &mtl_rt5682_rt5682s_hp, ++ .drv_name = "mtl_mx98360_rt5682", ++ .machine_quirk = snd_soc_acpi_codec_list, ++ .quirk_data = &mtl_max98360a_amp, ++ .sof_tplg_filename = "sof-mtl-max98360a-rt5682.tplg", ++ }, + {}, + }; + EXPORT_SYMBOL_GPL(snd_soc_acpi_intel_mtl_machines); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-128-ASoC-amd-yc-Add-DMI-entries-to-support-HP-OMEN-.patch b/patches.kernel.org/6.2.9-128-ASoC-amd-yc-Add-DMI-entries-to-support-HP-OMEN-.patch new file mode 100644 index 0000000..ca01472 --- /dev/null +++ b/patches.kernel.org/6.2.9-128-ASoC-amd-yc-Add-DMI-entries-to-support-HP-OMEN-.patch @@ -0,0 +1,42 @@ +From: Duc Anh Le +Date: Tue, 28 Feb 2023 00:49:21 +0100 +Subject: [PATCH] ASoC: amd: yc: Add DMI entries to support HP OMEN 16-n0xxx + (8A43) +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: d52279d5c9204a041e9ba02a66a353573b2f96e4 + +[ Upstream commit d52279d5c9204a041e9ba02a66a353573b2f96e4 ] + +This model requires an additional detection quirk to enable the internal microphone. + +Signed-off-by: Duc Anh Le +Link: https://lore.kernel.org/r/20230227234921.7784-1-lub.the.studio@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 4e681e9c..4a69ce70 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -262,6 +262,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "OMEN by HP Gaming Laptop 16z-n000"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "HP"), ++ DMI_MATCH(DMI_BOARD_NAME, "8A43"), ++ } ++ }, + {} + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-129-ACPI-x86-Drop-quirk-for-HP-Elitebook.patch b/patches.kernel.org/6.2.9-129-ACPI-x86-Drop-quirk-for-HP-Elitebook.patch new file mode 100644 index 0000000..36dbc58 --- /dev/null +++ b/patches.kernel.org/6.2.9-129-ACPI-x86-Drop-quirk-for-HP-Elitebook.patch @@ -0,0 +1,75 @@ +From: Mario Limonciello +Date: Thu, 23 Feb 2023 14:26:22 -0600 +Subject: [PATCH] ACPI: x86: Drop quirk for HP Elitebook +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: e32d546c483a2a0f607687f5b521c2a2f942ffbe + +[ Upstream commit e32d546c483a2a0f607687f5b521c2a2f942ffbe ] + +There was a quirk in `acpi/x86/s2idle.c` for an HP Elitebook G9 +platforms to force AMD GUID codepath instead of Microsoft codepath. + +This was due to a bug with WCN6855 WLAN firmware interaction with +the system. + +This bug is fixed by WCN6855 firmware: +WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 + +Remove the quirk as it's no longer necessary with this firmware. + +Link: https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=c7a57ef688f7d99d8338a5d8edddc8836ff0e6de +Tested-by: Anson Tsao +Signed-off-by: Mario Limonciello +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/acpi/x86/s2idle.c | 24 ------------------------ + 1 file changed, 24 deletions(-) + +diff --git a/drivers/acpi/x86/s2idle.c b/drivers/acpi/x86/s2idle.c +index c7afce46..e499c60c 100644 +--- a/drivers/acpi/x86/s2idle.c ++++ b/drivers/acpi/x86/s2idle.c +@@ -384,29 +384,6 @@ static const struct acpi_device_id amd_hid_ids[] = { + {} + }; + +-static int lps0_prefer_amd(const struct dmi_system_id *id) +-{ +- pr_debug("Using AMD GUID w/ _REV 2.\n"); +- rev_id = 2; +- return 0; +-} +-static const struct dmi_system_id s2idle_dmi_table[] __initconst = { +- { +- /* +- * AMD Rembrandt based HP EliteBook 835/845/865 G9 +- * Contains specialized AML in AMD/_REV 2 path to avoid +- * triggering a bug in Qualcomm WLAN firmware. This may be +- * removed in the future if that firmware is fixed. +- */ +- .callback = lps0_prefer_amd, +- .matches = { +- DMI_MATCH(DMI_BOARD_VENDOR, "HP"), +- DMI_MATCH(DMI_BOARD_NAME, "8990"), +- }, +- }, +- {} +-}; +- + static int lps0_device_attach(struct acpi_device *adev, + const struct acpi_device_id *not_used) + { +@@ -586,7 +563,6 @@ static const struct platform_s2idle_ops acpi_s2idle_ops_lps0 = { + + void __init acpi_s2idle_setup(void) + { +- dmi_check_system(s2idle_dmi_table); + acpi_scan_add_handler(&lps0_handler); + s2idle_set_ops(&acpi_s2idle_ops_lps0); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-130-ACPI-x86-utils-Add-Cezanne-to-the-list-for-forc.patch b/patches.kernel.org/6.2.9-130-ACPI-x86-utils-Add-Cezanne-to-the-list-for-forc.patch new file mode 100644 index 0000000..ff01439 --- /dev/null +++ b/patches.kernel.org/6.2.9-130-ACPI-x86-utils-Add-Cezanne-to-the-list-for-forc.patch @@ -0,0 +1,97 @@ +From: Mario Limonciello +Date: Tue, 28 Feb 2023 16:11:28 -0600 +Subject: [PATCH] ACPI: x86: utils: Add Cezanne to the list for forcing + StorageD3Enable +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: e2a56364485e7789e7b8f342637c7f3a219f7ede + +[ Upstream commit e2a56364485e7789e7b8f342637c7f3a219f7ede ] + +commit 018d6711c26e4 ("ACPI: x86: Add a quirk for Dell Inspiron 14 2-in-1 +for StorageD3Enable") introduced a quirk to allow a system with ambiguous +use of _ADR 0 to force StorageD3Enable. + +It was reported that several more Dell systems suffered the same symptoms. +As the list is continuing to grow but these are all Cezanne systems, +instead add Cezanne to the CPU list to apply the StorageD3Enable property +and remove the whole list. + +It was also reported that an HP system only has StorageD3Enable on the ACPI +device for the first NVME disk, not the second. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217003 +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216773 +Reported-by: David Alvarez Lombardi +Reported-by: dbilios@stdio.gr +Reported-and-tested-by: Elvis Angelaccio +Tested-by: victor.bonnelle@proton.me +Tested-by: hurricanepootis@protonmail.com +Signed-off-by: Mario Limonciello +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/acpi/x86/utils.c | 37 +++++++++++++------------------------ + 1 file changed, 13 insertions(+), 24 deletions(-) + +diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c +index 4e816bb4..e45285d4 100644 +--- a/drivers/acpi/x86/utils.c ++++ b/drivers/acpi/x86/utils.c +@@ -200,39 +200,28 @@ bool acpi_device_override_status(struct acpi_device *adev, unsigned long long *s + * a hardcoded allowlist for D3 support, which was used for these platforms. + * + * This allows quirking on Linux in a similar fashion. ++ * ++ * Cezanne systems shouldn't *normally* need this as the BIOS includes ++ * StorageD3Enable. But for two reasons we have added it. ++ * 1) The BIOS on a number of Dell systems have ambiguity ++ * between the same value used for _ADR on ACPI nodes GPP1.DEV0 and GPP1.NVME. ++ * GPP1.NVME is needed to get StorageD3Enable node set properly. ++ * https://bugzilla.kernel.org/show_bug.cgi?id=216440 ++ * https://bugzilla.kernel.org/show_bug.cgi?id=216773 ++ * https://bugzilla.kernel.org/show_bug.cgi?id=217003 ++ * 2) On at least one HP system StorageD3Enable is missing on the second NVME ++ disk in the system. + */ + static const struct x86_cpu_id storage_d3_cpu_ids[] = { + X86_MATCH_VENDOR_FAM_MODEL(AMD, 23, 96, NULL), /* Renoir */ + X86_MATCH_VENDOR_FAM_MODEL(AMD, 23, 104, NULL), /* Lucienne */ +- {} +-}; +- +-static const struct dmi_system_id force_storage_d3_dmi[] = { +- { +- /* +- * _ADR is ambiguous between GPP1.DEV0 and GPP1.NVME +- * but .NVME is needed to get StorageD3Enable node +- * https://bugzilla.kernel.org/show_bug.cgi?id=216440 +- */ +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), +- DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 14 7425 2-in-1"), +- } +- }, +- { +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), +- DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 16 5625"), +- } +- }, ++ X86_MATCH_VENDOR_FAM_MODEL(AMD, 25, 80, NULL), /* Cezanne */ + {} + }; + + bool force_storage_d3(void) + { +- const struct dmi_system_id *dmi_id = dmi_first_match(force_storage_d3_dmi); +- +- return dmi_id || x86_match_cpu(storage_d3_cpu_ids); ++ return x86_match_cpu(storage_d3_cpu_ids); + } + + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-131-riscv-Bump-COMMAND_LINE_SIZE-value-to-1024.patch b/patches.kernel.org/6.2.9-131-riscv-Bump-COMMAND_LINE_SIZE-value-to-1024.patch new file mode 100644 index 0000000..004a74a --- /dev/null +++ b/patches.kernel.org/6.2.9-131-riscv-Bump-COMMAND_LINE_SIZE-value-to-1024.patch @@ -0,0 +1,47 @@ +From: Alexandre Ghiti +Date: Tue, 16 Mar 2021 15:34:20 -0400 +Subject: [PATCH] riscv: Bump COMMAND_LINE_SIZE value to 1024 +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 61fc1ee8be26bc192d691932b0a67eabee45d12f + +[ Upstream commit 61fc1ee8be26bc192d691932b0a67eabee45d12f ] + +Increase COMMAND_LINE_SIZE as the current default value is too low +for syzbot kernel command line. + +There has been considerable discussion on this patch that has led to a +larger patch set removing COMMAND_LINE_SIZE from the uapi headers on all +ports. That's not quite done yet, but it's gotten far enough we're +confident this is not a uABI change so this is safe. + +Reported-by: Dmitry Vyukov +Signed-off-by: Alexandre Ghiti +Link: https://lore.kernel.org/r/20210316193420.904-1-alex@ghiti.fr +[Palmer: it's not uabi] +Link: https://lore.kernel.org/linux-riscv/874b8076-b0d1-4aaa-bcd8-05d523060152@app.fastmail.com/#t +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/riscv/include/uapi/asm/setup.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + create mode 100644 arch/riscv/include/uapi/asm/setup.h + +diff --git a/arch/riscv/include/uapi/asm/setup.h b/arch/riscv/include/uapi/asm/setup.h +new file mode 100644 +index 00000000..66b13a52 +--- /dev/null ++++ b/arch/riscv/include/uapi/asm/setup.h +@@ -0,0 +1,8 @@ ++/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */ ++ ++#ifndef _UAPI_ASM_RISCV_SETUP_H ++#define _UAPI_ASM_RISCV_SETUP_H ++ ++#define COMMAND_LINE_SIZE 1024 ++ ++#endif /* _UAPI_ASM_RISCV_SETUP_H */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-132-drm-cirrus-NULL-check-pipe-plane.state-fb-in-ci.patch b/patches.kernel.org/6.2.9-132-drm-cirrus-NULL-check-pipe-plane.state-fb-in-ci.patch new file mode 100644 index 0000000..f53daa9 --- /dev/null +++ b/patches.kernel.org/6.2.9-132-drm-cirrus-NULL-check-pipe-plane.state-fb-in-ci.patch @@ -0,0 +1,46 @@ +From: Alexandr Sapozhnikov +Date: Wed, 15 Feb 2023 20:15:49 +0300 +Subject: [PATCH] drm/cirrus: NULL-check pipe->plane.state->fb in + cirrus_pipe_update() +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 7245e629dcaaf308f1868aeffa218e9849c77893 + +[ Upstream commit 7245e629dcaaf308f1868aeffa218e9849c77893 ] + +After having been compared to NULL value at cirrus.c:455, pointer +'pipe->plane.state->fb' is passed as 1st parameter in call to function +'cirrus_fb_blit_rect' at cirrus.c:461, where it is dereferenced at +cirrus.c:316. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +v2: + * aligned commit message to line-length limits + +Signed-off-by: Alexandr Sapozhnikov +Reviewed-by: Thomas Zimmermann +Signed-off-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20230215171549.16305-1-alsp705@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/tiny/cirrus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/tiny/cirrus.c b/drivers/gpu/drm/tiny/cirrus.c +index 678c2ef1..ffa7e61d 100644 +--- a/drivers/gpu/drm/tiny/cirrus.c ++++ b/drivers/gpu/drm/tiny/cirrus.c +@@ -455,7 +455,7 @@ static void cirrus_pipe_update(struct drm_simple_display_pipe *pipe, + if (state->fb && cirrus->cpp != cirrus_cpp(state->fb)) + cirrus_mode_set(cirrus, &crtc->mode, state->fb); + +- if (drm_atomic_helper_damage_merged(old_state, state, &rect)) ++ if (state->fb && drm_atomic_helper_damage_merged(old_state, state, &rect)) + cirrus_fb_blit_rect(state->fb, &shadow_plane_state->data[0], &rect); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-133-HID-cp2112-Fix-driver-not-registering-GPIO-IRQ-.patch b/patches.kernel.org/6.2.9-133-HID-cp2112-Fix-driver-not-registering-GPIO-IRQ-.patch new file mode 100644 index 0000000..b909ec9 --- /dev/null +++ b/patches.kernel.org/6.2.9-133-HID-cp2112-Fix-driver-not-registering-GPIO-IRQ-.patch @@ -0,0 +1,39 @@ +From: Danny Kaehn +Date: Fri, 10 Feb 2023 11:00:44 -0600 +Subject: [PATCH] HID: cp2112: Fix driver not registering GPIO IRQ chip as + threaded +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 37f5b858a66543b2b67c0288280af623985abc29 + +[ Upstream commit 37f5b858a66543b2b67c0288280af623985abc29 ] + +The CP2112 generates interrupts from a polling routine on a thread, +and can only support threaded interrupts. This patch configures the +gpiochip irq chip with this flag, disallowing consumers to request +a hard IRQ from this driver, which resulted in a segfault previously. + +Signed-off-by: Danny Kaehn +Link: https://lore.kernel.org/r/20230210170044.11835-1-kaehndan@gmail.com +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hid/hid-cp2112.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c +index 1e16b0fa..27cadadd 100644 +--- a/drivers/hid/hid-cp2112.c ++++ b/drivers/hid/hid-cp2112.c +@@ -1354,6 +1354,7 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id) + girq->parents = NULL; + girq->default_type = IRQ_TYPE_NONE; + girq->handler = handle_simple_irq; ++ girq->threaded = true; + + ret = gpiochip_add_data(&dev->gc, dev); + if (ret < 0) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-134-ca8210-fix-mac_len-negative-array-access.patch b/patches.kernel.org/6.2.9-134-ca8210-fix-mac_len-negative-array-access.patch new file mode 100644 index 0000000..45dd8e1 --- /dev/null +++ b/patches.kernel.org/6.2.9-134-ca8210-fix-mac_len-negative-array-access.patch @@ -0,0 +1,38 @@ +From: Alexander Aring +Date: Thu, 16 Feb 2023 23:25:04 -0500 +Subject: [PATCH] ca8210: fix mac_len negative array access +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 6c993779ea1d0cccdb3a5d7d45446dd229e610a3 + +[ Upstream commit 6c993779ea1d0cccdb3a5d7d45446dd229e610a3 ] + +This patch fixes a buffer overflow access of skb->data if +ieee802154_hdr_peek_addrs() fails. + +Reported-by: lianhui tang +Signed-off-by: Alexander Aring +Link: https://lore.kernel.org/r/20230217042504.3303396-1-aahringo@redhat.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ieee802154/ca8210.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c +index e1a569b9..0b0c6c07 100644 +--- a/drivers/net/ieee802154/ca8210.c ++++ b/drivers/net/ieee802154/ca8210.c +@@ -1913,6 +1913,8 @@ static int ca8210_skb_tx( + * packet + */ + mac_len = ieee802154_hdr_peek_addrs(skb, &header); ++ if (mac_len < 0) ++ return mac_len; + + secspec.security_level = header.sec.level; + secspec.key_id_mode = header.sec.key_id_mode; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-135-HID-logitech-hidpp-Add-support-for-Logitech-MX-.patch b/patches.kernel.org/6.2.9-135-HID-logitech-hidpp-Add-support-for-Logitech-MX-.patch new file mode 100644 index 0000000..dd3e34d --- /dev/null +++ b/patches.kernel.org/6.2.9-135-HID-logitech-hidpp-Add-support-for-Logitech-MX-.patch @@ -0,0 +1,40 @@ +From: =?UTF-8?q?Rafa=C5=82=20Szalecki?= +Date: Wed, 1 Mar 2023 02:23:56 +0100 +Subject: [PATCH] HID: logitech-hidpp: Add support for Logitech MX Master 3S + mouse +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: db50f7a3983f0154e730f1147ef729e0c5c2f90c + +[ Upstream commit db50f7a3983f0154e730f1147ef729e0c5c2f90c ] + +Add signature for the Logitech MX Master 3S mouse over Bluetooth. + +Signed-off-by: Rafał Szalecki +Reviewed-by: Bastien Nocera +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hid/hid-logitech-hidpp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index 5efc591a..3c00e6ac 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -4378,6 +4378,8 @@ static const struct hid_device_id hidpp_devices[] = { + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb01e) }, + { /* MX Master 3 mouse over Bluetooth */ + HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb023) }, ++ { /* MX Master 3S mouse over Bluetooth */ ++ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb034) }, + {} + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-136-HID-intel-ish-hid-ipc-Fix-potential-use-after-f.patch b/patches.kernel.org/6.2.9-136-HID-intel-ish-hid-ipc-Fix-potential-use-after-f.patch new file mode 100644 index 0000000..0faf6e4 --- /dev/null +++ b/patches.kernel.org/6.2.9-136-HID-intel-ish-hid-ipc-Fix-potential-use-after-f.patch @@ -0,0 +1,71 @@ +From: Reka Norman +Date: Mon, 27 Feb 2023 13:49:38 +1100 +Subject: [PATCH] HID: intel-ish-hid: ipc: Fix potential use-after-free in work + function +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785 + +[ Upstream commit 8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785 ] + +When a reset notify IPC message is received, the ISR schedules a work +function and passes the ISHTP device to it via a global pointer +ishtp_dev. If ish_probe() fails, the devm-managed device resources +including ishtp_dev are freed, but the work is not cancelled, causing a +use-after-free when the work function tries to access ishtp_dev. Use +devm_work_autocancel() instead, so that the work is automatically +cancelled if probe fails. + +Signed-off-by: Reka Norman +Acked-by: Srinivas Pandruvada +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hid/intel-ish-hid/ipc/ipc.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/intel-ish-hid/ipc/ipc.c b/drivers/hid/intel-ish-hid/ipc/ipc.c +index 15e14239..a49c6aff 100644 +--- a/drivers/hid/intel-ish-hid/ipc/ipc.c ++++ b/drivers/hid/intel-ish-hid/ipc/ipc.c +@@ -5,6 +5,7 @@ + * Copyright (c) 2014-2016, Intel Corporation. + */ + ++#include + #include + #include + #include +@@ -621,7 +622,6 @@ static void recv_ipc(struct ishtp_device *dev, uint32_t doorbell_val) + case MNG_RESET_NOTIFY: + if (!ishtp_dev) { + ishtp_dev = dev; +- INIT_WORK(&fw_reset_work, fw_reset_work_fn); + } + schedule_work(&fw_reset_work); + break; +@@ -940,6 +940,7 @@ struct ishtp_device *ish_dev_init(struct pci_dev *pdev) + { + struct ishtp_device *dev; + int i; ++ int ret; + + dev = devm_kzalloc(&pdev->dev, + sizeof(struct ishtp_device) + sizeof(struct ish_hw), +@@ -975,6 +976,12 @@ struct ishtp_device *ish_dev_init(struct pci_dev *pdev) + list_add_tail(&tx_buf->link, &dev->wr_free_list); + } + ++ ret = devm_work_autocancel(&pdev->dev, &fw_reset_work, fw_reset_work_fn); ++ if (ret) { ++ dev_err(dev->devc, "Failed to initialise FW reset work\n"); ++ return NULL; ++ } ++ + dev->ops = &ish_hw_ops; + dev->devc = &pdev->dev; + dev->mtu = IPC_PAYLOAD_SIZE - sizeof(struct ishtp_msg_hdr); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-137-m68k-mm-Fix-systems-with-memory-at-end-of-32-bi.patch b/patches.kernel.org/6.2.9-137-m68k-mm-Fix-systems-with-memory-at-end-of-32-bi.patch new file mode 100644 index 0000000..5a0481a --- /dev/null +++ b/patches.kernel.org/6.2.9-137-m68k-mm-Fix-systems-with-memory-at-end-of-32-bi.patch @@ -0,0 +1,67 @@ +From: Kars de Jong +Date: Thu, 23 Feb 2023 12:23:49 +0100 +Subject: [PATCH] m68k: mm: Fix systems with memory at end of 32-bit address + space +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 0d9fad91abfd723ea5070a46d98a9f4496c93ba9 + +[ Upstream commit 0d9fad91abfd723ea5070a46d98a9f4496c93ba9 ] + +The calculation of end addresses of memory chunks overflowed to 0 when +a memory chunk is located at the end of 32-bit address space. +This is the case for the HP300 architecture. + +Link: https://lore.kernel.org/linux-m68k/CACz-3rhUo5pgNwdWHaPWmz+30Qo9xCg70wNxdf7o5x-6tXq8QQ@mail.gmail.com/ +Signed-off-by: Kars de Jong +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230223112349.26675-1-jongk@linux-m68k.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/m68k/mm/motorola.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/m68k/mm/motorola.c b/arch/m68k/mm/motorola.c +index 2a375637..91130122 100644 +--- a/arch/m68k/mm/motorola.c ++++ b/arch/m68k/mm/motorola.c +@@ -437,7 +437,7 @@ void __init paging_init(void) + } + + min_addr = m68k_memory[0].addr; +- max_addr = min_addr + m68k_memory[0].size; ++ max_addr = min_addr + m68k_memory[0].size - 1; + memblock_add_node(m68k_memory[0].addr, m68k_memory[0].size, 0, + MEMBLOCK_NONE); + for (i = 1; i < m68k_num_memory;) { +@@ -452,21 +452,21 @@ void __init paging_init(void) + } + memblock_add_node(m68k_memory[i].addr, m68k_memory[i].size, i, + MEMBLOCK_NONE); +- addr = m68k_memory[i].addr + m68k_memory[i].size; ++ addr = m68k_memory[i].addr + m68k_memory[i].size - 1; + if (addr > max_addr) + max_addr = addr; + i++; + } + m68k_memoffset = min_addr - PAGE_OFFSET; +- m68k_virt_to_node_shift = fls(max_addr - min_addr - 1) - 6; ++ m68k_virt_to_node_shift = fls(max_addr - min_addr) - 6; + + module_fixup(NULL, __start_fixup, __stop_fixup); + flush_icache(); + +- high_memory = phys_to_virt(max_addr); ++ high_memory = phys_to_virt(max_addr) + 1; + + min_low_pfn = availmem >> PAGE_SHIFT; +- max_pfn = max_low_pfn = max_addr >> PAGE_SHIFT; ++ max_pfn = max_low_pfn = (max_addr >> PAGE_SHIFT) + 1; + + /* Reserve kernel text/data/bss and the memory allocated in head.S */ + memblock_reserve(m68k_memory[0].addr, availmem - m68k_memory[0].addr); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-138-m68k-Only-force-030-bus-error-if-PC-not-in-exce.patch b/patches.kernel.org/6.2.9-138-m68k-Only-force-030-bus-error-if-PC-not-in-exce.patch new file mode 100644 index 0000000..13efeab --- /dev/null +++ b/patches.kernel.org/6.2.9-138-m68k-Only-force-030-bus-error-if-PC-not-in-exce.patch @@ -0,0 +1,76 @@ +From: Michael Schmitz +Date: Wed, 1 Mar 2023 15:11:07 +1300 +Subject: [PATCH] m68k: Only force 030 bus error if PC not in exception table +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: e36a82bebbf7da814530d5a179bef9df5934b717 + +[ Upstream commit e36a82bebbf7da814530d5a179bef9df5934b717 ] + +__get_kernel_nofault() does copy data in supervisor mode when +forcing a task backtrace log through /proc/sysrq_trigger. +This is expected cause a bus error exception on e.g. NULL +pointer dereferencing when logging a kernel task has no +workqueue associated. This bus error ought to be ignored. + +Our 030 bus error handler is ill equipped to deal with this: + +Whenever ssw indicates a kernel mode access on a data fault, +we don't even attempt to handle the fault and instead always +send a SEGV signal (or panic). As a result, the check +for exception handling at the fault PC (buried in +send_sig_fault() which gets called from do_page_fault() +eventually) is never used. + +In contrast, both 040 and 060 access error handlers do not +care whether a fault happened on supervisor mode access, +and will call do_page_fault() on those, ultimately honoring +the exception table. + +Add a check in bus_error030 to call do_page_fault() in case +we do have an entry for the fault PC in our exception table. + +I had attempted a fix for this earlier in 2019 that did rely +on testing pagefault_disabled() (see link below) to achieve +the same thing, but this patch should be more generic. + +Tested on 030 Atari Falcon. + +Reported-by: Eero Tamminen +Link: https://lore.kernel.org/r/alpine.LNX.2.21.1904091023540.25@nippy.intranet +Link: https://lore.kernel.org/r/63130691-1984-c423-c1f2-73bfd8d3dcd3@gmail.com +Signed-off-by: Michael Schmitz +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230301021107.26307-1-schmitzmic@gmail.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/m68k/kernel/traps.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/m68k/kernel/traps.c b/arch/m68k/kernel/traps.c +index 5c8cba0e..a700807c 100644 +--- a/arch/m68k/kernel/traps.c ++++ b/arch/m68k/kernel/traps.c +@@ -30,6 +30,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -545,7 +546,8 @@ static inline void bus_error030 (struct frame *fp) + errorcode |= 2; + + if (mmusr & (MMU_I | MMU_WP)) { +- if (ssw & 4) { ++ /* We might have an exception table for this PC */ ++ if (ssw & 4 && !search_exception_tables(fp->ptregs.pc)) { + pr_err("Data %s fault at %#010lx in %s (pc=%#lx)\n", + ssw & RW ? "read" : "write", + fp->un.fmtb.daddr, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-139-selftests-bpf-check-that-modifier-resolves-afte.patch b/patches.kernel.org/6.2.9-139-selftests-bpf-check-that-modifier-resolves-afte.patch new file mode 100644 index 0000000..e070c37 --- /dev/null +++ b/patches.kernel.org/6.2.9-139-selftests-bpf-check-that-modifier-resolves-afte.patch @@ -0,0 +1,64 @@ +From: Lorenz Bauer +Date: Mon, 6 Mar 2023 11:21:38 +0000 +Subject: [PATCH] selftests/bpf: check that modifier resolves after pointer +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: dfdd608c3b365f0fd49d7e13911ebcde06b9865b + +[ Upstream commit dfdd608c3b365f0fd49d7e13911ebcde06b9865b ] + +Add a regression test that ensures that a VAR pointing at a +modifier which follows a PTR (or STRUCT or ARRAY) is resolved +correctly by the datasec validator. + +Signed-off-by: Lorenz Bauer +Link: https://lore.kernel.org/r/20230306112138.155352-3-lmb@isovalent.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/bpf/prog_tests/btf.c | 28 ++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/tools/testing/selftests/bpf/prog_tests/btf.c b/tools/testing/selftests/bpf/prog_tests/btf.c +index de1b5b9e..d8d1292e 100644 +--- a/tools/testing/selftests/bpf/prog_tests/btf.c ++++ b/tools/testing/selftests/bpf/prog_tests/btf.c +@@ -879,6 +879,34 @@ static struct btf_raw_test raw_tests[] = { + .btf_load_err = true, + .err_str = "Invalid elem", + }, ++{ ++ .descr = "var after datasec, ptr followed by modifier", ++ .raw_types = { ++ /* .bss section */ /* [1] */ ++ BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_DATASEC, 0, 2), ++ sizeof(void*)+4), ++ BTF_VAR_SECINFO_ENC(4, 0, sizeof(void*)), ++ BTF_VAR_SECINFO_ENC(6, sizeof(void*), 4), ++ /* int */ /* [2] */ ++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), ++ /* int* */ /* [3] */ ++ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 2), ++ BTF_VAR_ENC(NAME_TBD, 3, 0), /* [4] */ ++ /* const int */ /* [5] */ ++ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_CONST, 0, 0), 2), ++ BTF_VAR_ENC(NAME_TBD, 5, 0), /* [6] */ ++ BTF_END_RAW, ++ }, ++ .str_sec = "\0a\0b\0c\0", ++ .str_sec_size = sizeof("\0a\0b\0c\0"), ++ .map_type = BPF_MAP_TYPE_ARRAY, ++ .map_name = ".bss", ++ .key_size = sizeof(int), ++ .value_size = sizeof(void*)+4, ++ .key_type_id = 0, ++ .value_type_id = 1, ++ .max_entries = 1, ++}, + /* Test member exceeds the size of struct. + * + * struct A { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-140-cpumask-fix-incorrect-cpumask-scanning-result-c.patch b/patches.kernel.org/6.2.9-140-cpumask-fix-incorrect-cpumask-scanning-result-c.patch new file mode 100644 index 0000000..a3d469b --- /dev/null +++ b/patches.kernel.org/6.2.9-140-cpumask-fix-incorrect-cpumask-scanning-result-c.patch @@ -0,0 +1,190 @@ +From: Linus Torvalds +Date: Mon, 6 Mar 2023 12:15:13 -0800 +Subject: [PATCH] cpumask: fix incorrect cpumask scanning result checks +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 8ca09d5fa3549d142c2080a72a4c70ce389163cd + +[ Upstream commit 8ca09d5fa3549d142c2080a72a4c70ce389163cd ] + +It turns out that commit 596ff4a09b89 ("cpumask: re-introduce +constant-sized cpumask optimizations") exposed a number of cases of +drivers not checking the result of "cpumask_next()" and friends +correctly. + +The documented correct check for "no more cpus in the cpumask" is to +check for the result being equal or larger than the number of possible +CPU ids, exactly _because_ we've always done those constant-sized +cpumask scans using a widened type before. So the return value of a +cpumask scan should be checked with + + if (cpu >= nr_cpu_ids) + ... + +because the cpumask scan did not necessarily stop exactly *at* that +maximum CPU id. + +But a few cases ended up instead using checks like + + if (cpu == nr_cpumask_bits) + ... + +which used that internal "widened" number of bits. And that used to +work pretty much by accident (ok, in this case "by accident" is simply +because it matched the historical internal implementation of the cpumask +scanning, so it was more of a "intentionally using implementation +details rather than an accident"). + +But the extended constant-sized optimizations then did that internal +implementation differently, and now that code that did things wrong but +matched the old implementation no longer worked at all. + +Which then causes subsequent odd problems due to using what ends up +being an invalid CPU ID. + +Most of these cases require either unusual hardware or special uses to +hit, but the random.c one triggers quite easily. + +All you really need is to have a sufficiently small CONFIG_NR_CPUS value +for the bit scanning optimization to be triggered, but not enough CPUs +to then actually fill that widened cpumask. At that point, the cpumask +scanning will return the NR_CPUS constant, which is _not_ the same as +nr_cpumask_bits. + +This just does the mindless fix with + + sed -i 's/== nr_cpumask_bits/>= nr_cpu_ids/' + +to fix the incorrect uses. + +The ones in the SCSI lpfc driver in particular could probably be fixed +more cleanly by just removing that repeated pattern entirely, but I am +not emptionally invested enough in that driver to care. + +Reported-and-tested-by: Guenter Roeck +Link: https://lore.kernel.org/lkml/481b19b5-83a0-4793-b4fd-194ad7b978c3@roeck-us.net/ +Reported-and-tested-by: Geert Uytterhoeven +Link: https://lore.kernel.org/lkml/CAMuHMdUKo_Sf7TjKzcNDa8Ve+6QrK+P8nSQrSQ=6LTRmcBKNww@mail.gmail.com/ +Reported-by: Vernon Yang +Link: https://lore.kernel.org/lkml/20230306160651.2016767-1-vernon2gm@gmail.com/ +Cc: Yury Norov +Cc: Jason A. Donenfeld +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/powerpc/xmon/xmon.c | 2 +- + drivers/char/random.c | 2 +- + drivers/net/wireguard/queueing.h | 2 +- + drivers/scsi/lpfc/lpfc_init.c | 14 +++++++------- + 4 files changed, 10 insertions(+), 10 deletions(-) + +diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c +index 0da66bc4..3b4e2475 100644 +--- a/arch/powerpc/xmon/xmon.c ++++ b/arch/powerpc/xmon/xmon.c +@@ -1277,7 +1277,7 @@ static int xmon_batch_next_cpu(void) + while (!cpumask_empty(&xmon_batch_cpus)) { + cpu = cpumask_next_wrap(smp_processor_id(), &xmon_batch_cpus, + xmon_batch_start_cpu, true); +- if (cpu == nr_cpumask_bits) ++ if (cpu >= nr_cpu_ids) + break; + if (xmon_batch_start_cpu == -1) + xmon_batch_start_cpu = cpu; +diff --git a/drivers/char/random.c b/drivers/char/random.c +index ce3ccd17..253f2ddb 100644 +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1311,7 +1311,7 @@ static void __cold try_to_generate_entropy(void) + /* Basic CPU round-robin, which avoids the current CPU. */ + do { + cpu = cpumask_next(cpu, &timer_cpus); +- if (cpu == nr_cpumask_bits) ++ if (cpu >= nr_cpu_ids) + cpu = cpumask_first(&timer_cpus); + } while (cpu == smp_processor_id() && num_cpus > 1); + +diff --git a/drivers/net/wireguard/queueing.h b/drivers/net/wireguard/queueing.h +index 583adb37..125284b3 100644 +--- a/drivers/net/wireguard/queueing.h ++++ b/drivers/net/wireguard/queueing.h +@@ -106,7 +106,7 @@ static inline int wg_cpumask_choose_online(int *stored_cpu, unsigned int id) + { + unsigned int cpu = *stored_cpu, cpu_index, i; + +- if (unlikely(cpu == nr_cpumask_bits || ++ if (unlikely(cpu >= nr_cpu_ids || + !cpumask_test_cpu(cpu, cpu_online_mask))) { + cpu_index = id % cpumask_weight(cpu_online_mask); + cpu = cpumask_first(cpu_online_mask); +diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c +index 25ba20e4..3fbd3bec 100644 +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -12507,7 +12507,7 @@ lpfc_cpu_affinity_check(struct lpfc_hba *phba, int vectors) + goto found_same; + new_cpu = cpumask_next( + new_cpu, cpu_present_mask); +- if (new_cpu == nr_cpumask_bits) ++ if (new_cpu >= nr_cpu_ids) + new_cpu = first_cpu; + } + /* At this point, we leave the CPU as unassigned */ +@@ -12521,7 +12521,7 @@ lpfc_cpu_affinity_check(struct lpfc_hba *phba, int vectors) + * selecting the same IRQ. + */ + start_cpu = cpumask_next(new_cpu, cpu_present_mask); +- if (start_cpu == nr_cpumask_bits) ++ if (start_cpu >= nr_cpu_ids) + start_cpu = first_cpu; + + lpfc_printf_log(phba, KERN_INFO, LOG_INIT, +@@ -12557,7 +12557,7 @@ lpfc_cpu_affinity_check(struct lpfc_hba *phba, int vectors) + goto found_any; + new_cpu = cpumask_next( + new_cpu, cpu_present_mask); +- if (new_cpu == nr_cpumask_bits) ++ if (new_cpu >= nr_cpu_ids) + new_cpu = first_cpu; + } + /* We should never leave an entry unassigned */ +@@ -12575,7 +12575,7 @@ lpfc_cpu_affinity_check(struct lpfc_hba *phba, int vectors) + * selecting the same IRQ. + */ + start_cpu = cpumask_next(new_cpu, cpu_present_mask); +- if (start_cpu == nr_cpumask_bits) ++ if (start_cpu >= nr_cpu_ids) + start_cpu = first_cpu; + + lpfc_printf_log(phba, KERN_INFO, LOG_INIT, +@@ -12648,7 +12648,7 @@ lpfc_cpu_affinity_check(struct lpfc_hba *phba, int vectors) + goto found_hdwq; + } + new_cpu = cpumask_next(new_cpu, cpu_present_mask); +- if (new_cpu == nr_cpumask_bits) ++ if (new_cpu >= nr_cpu_ids) + new_cpu = first_cpu; + } + +@@ -12663,7 +12663,7 @@ lpfc_cpu_affinity_check(struct lpfc_hba *phba, int vectors) + goto found_hdwq; + + new_cpu = cpumask_next(new_cpu, cpu_present_mask); +- if (new_cpu == nr_cpumask_bits) ++ if (new_cpu >= nr_cpu_ids) + new_cpu = first_cpu; + } + +@@ -12674,7 +12674,7 @@ lpfc_cpu_affinity_check(struct lpfc_hba *phba, int vectors) + found_hdwq: + /* We found an available entry, copy the IRQ info */ + start_cpu = cpumask_next(new_cpu, cpu_present_mask); +- if (start_cpu == nr_cpumask_bits) ++ if (start_cpu >= nr_cpu_ids) + start_cpu = first_cpu; + cpup->hdwq = new_cpup->hdwq; + logit: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-141-scsi-target-iscsi-Fix-an-error-message-in-iscsi.patch b/patches.kernel.org/6.2.9-141-scsi-target-iscsi-Fix-an-error-message-in-iscsi.patch new file mode 100644 index 0000000..6535a73 --- /dev/null +++ b/patches.kernel.org/6.2.9-141-scsi-target-iscsi-Fix-an-error-message-in-iscsi.patch @@ -0,0 +1,57 @@ +From: Maurizio Lombardi +Date: Tue, 14 Feb 2023 15:15:56 +0100 +Subject: [PATCH] scsi: target: iscsi: Fix an error message in + iscsi_check_key() +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 6cc55c969b7ce8d85e09a636693d4126c3676c11 + +[ Upstream commit 6cc55c969b7ce8d85e09a636693d4126c3676c11 ] + +The first half of the error message is printed by pr_err(), the second half +is printed by pr_debug(). The user will therefore see only the first part +of the message and will miss some useful information. + +Link: https://lore.kernel.org/r/20230214141556.762047-1-mlombard@redhat.com +Signed-off-by: Maurizio Lombardi +Reviewed-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/target/iscsi/iscsi_target_parameters.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c +index 2317fb07..557516c6 100644 +--- a/drivers/target/iscsi/iscsi_target_parameters.c ++++ b/drivers/target/iscsi/iscsi_target_parameters.c +@@ -1262,18 +1262,20 @@ static struct iscsi_param *iscsi_check_key( + return param; + + if (!(param->phase & phase)) { +- pr_err("Key \"%s\" may not be negotiated during ", +- param->name); ++ char *phase_name; ++ + switch (phase) { + case PHASE_SECURITY: +- pr_debug("Security phase.\n"); ++ phase_name = "Security"; + break; + case PHASE_OPERATIONAL: +- pr_debug("Operational phase.\n"); ++ phase_name = "Operational"; + break; + default: +- pr_debug("Unknown phase.\n"); ++ phase_name = "Unknown"; + } ++ pr_err("Key \"%s\" may not be negotiated during %s phase.\n", ++ param->name, phase_name); + return NULL; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-142-scsi-qla2xxx-Add-option-to-disable-FC2-Target-s.patch b/patches.kernel.org/6.2.9-142-scsi-qla2xxx-Add-option-to-disable-FC2-Target-s.patch new file mode 100644 index 0000000..bee2877 --- /dev/null +++ b/patches.kernel.org/6.2.9-142-scsi-qla2xxx-Add-option-to-disable-FC2-Target-s.patch @@ -0,0 +1,84 @@ +From: Daniel Wagner +Date: Wed, 8 Feb 2023 16:20:14 +0100 +Subject: [PATCH] scsi: qla2xxx: Add option to disable FC2 Target support +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 877b03795fcf29ff2e2351f7e574ecc9b9c51732 + +[ Upstream commit 877b03795fcf29ff2e2351f7e574ecc9b9c51732 ] + +Commit 44c57f205876 ("scsi: qla2xxx: Changes to support FCP2 Target") added +support for FC2 Targets. Unfortunately, there are older setups which break +with this new feature enabled. + +Allow to disable it via module option. + +Link: https://lore.kernel.org/r/20230208152014.109214-1-dwagner@suse.de +Signed-off-by: Daniel Wagner +Reviewed-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/qla2xxx/qla_gbl.h | 1 + + drivers/scsi/qla2xxx/qla_init.c | 3 ++- + drivers/scsi/qla2xxx/qla_os.c | 10 +++++++++- + 3 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h +index e3256e72..ee54207f 100644 +--- a/drivers/scsi/qla2xxx/qla_gbl.h ++++ b/drivers/scsi/qla2xxx/qla_gbl.h +@@ -192,6 +192,7 @@ extern int ql2xsecenable; + extern int ql2xenforce_iocb_limit; + extern int ql2xabts_wait_nvme; + extern u32 ql2xnvme_queues; ++extern int ql2xfc2target; + + extern int qla2x00_loop_reset(scsi_qla_host_t *); + extern void qla2x00_abort_all_cmds(scsi_qla_host_t *, int); +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 8f2a9687..d506eb3a 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -1841,7 +1841,8 @@ void qla2x00_handle_rscn(scsi_qla_host_t *vha, struct event_arg *ea) + case RSCN_PORT_ADDR: + fcport = qla2x00_find_fcport_by_nportid(vha, &ea->id, 1); + if (fcport) { +- if (fcport->flags & FCF_FCP2_DEVICE && ++ if (ql2xfc2target && ++ fcport->flags & FCF_FCP2_DEVICE && + atomic_read(&fcport->state) == FCS_ONLINE) { + ql_dbg(ql_dbg_disc, vha, 0x2115, + "Delaying session delete for FCP2 portid=%06x %8phC ", +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 37eb235f..02913cc7 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -360,6 +360,13 @@ MODULE_PARM_DESC(ql2xnvme_queues, + "1 - Minimum number of queues supported\n" + "8 - Default value"); + ++int ql2xfc2target = 1; ++module_param(ql2xfc2target, int, 0444); ++MODULE_PARM_DESC(qla2xfc2target, ++ "Enables FC2 Target support. " ++ "0 - FC2 Target support is disabled. " ++ "1 - FC2 Target support is enabled (default)."); ++ + static struct scsi_transport_template *qla2xxx_transport_template = NULL; + struct scsi_transport_template *qla2xxx_transport_vport_template = NULL; + +@@ -4086,7 +4093,8 @@ qla2x00_mark_all_devices_lost(scsi_qla_host_t *vha) + "Mark all dev lost\n"); + + list_for_each_entry(fcport, &vha->vp_fcports, list) { +- if (fcport->loop_id != FC_NO_LOOP_ID && ++ if (ql2xfc2target && ++ fcport->loop_id != FC_NO_LOOP_ID && + (fcport->flags & FCF_FCP2_DEVICE) && + fcport->port_type == FCT_TARGET && + !qla2x00_reset_active(vha)) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-143-scsi-hisi_sas-Check-devm_add_action-return-valu.patch b/patches.kernel.org/6.2.9-143-scsi-hisi_sas-Check-devm_add_action-return-valu.patch new file mode 100644 index 0000000..99007a1 --- /dev/null +++ b/patches.kernel.org/6.2.9-143-scsi-hisi_sas-Check-devm_add_action-return-valu.patch @@ -0,0 +1,39 @@ +From: Kang Chen +Date: Mon, 27 Feb 2023 11:10:30 +0800 +Subject: [PATCH] scsi: hisi_sas: Check devm_add_action() return value +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 06d1a90de60208054cca15ef200138cfdbb642a9 + +[ Upstream commit 06d1a90de60208054cca15ef200138cfdbb642a9 ] + +In case devm_add_action() fails, check it in the caller of +interrupt_preinit_v3_hw(). + +Link: https://lore.kernel.org/r/20230227031030.893324-1-void0red@gmail.com +Signed-off-by: Kang Chen +Acked-by: Xiang Chen +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index 0c3fcb80..a63279f5 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -2495,8 +2495,7 @@ static int interrupt_preinit_v3_hw(struct hisi_hba *hisi_hba) + hisi_hba->cq_nvecs = vectors - BASE_VECTORS_V3_HW; + shost->nr_hw_queues = hisi_hba->cq_nvecs; + +- devm_add_action(&pdev->dev, hisi_sas_v3_free_vectors, pdev); +- return 0; ++ return devm_add_action(&pdev->dev, hisi_sas_v3_free_vectors, pdev); + } + + static int interrupt_init_v3_hw(struct hisi_hba *hisi_hba) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-144-scsi-ufs-core-Add-soft-dependency-on-governor_s.patch b/patches.kernel.org/6.2.9-144-scsi-ufs-core-Add-soft-dependency-on-governor_s.patch new file mode 100644 index 0000000..a566623 --- /dev/null +++ b/patches.kernel.org/6.2.9-144-scsi-ufs-core-Add-soft-dependency-on-governor_s.patch @@ -0,0 +1,37 @@ +From: Adrien Thierry +Date: Mon, 20 Feb 2023 09:07:40 -0500 +Subject: [PATCH] scsi: ufs: core: Add soft dependency on + governor_simpleondemand +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 2ebe16155dc8bd4e602cad5b5f65458d2eaa1a75 + +[ Upstream commit 2ebe16155dc8bd4e602cad5b5f65458d2eaa1a75 ] + +The ufshcd driver uses simpleondemand governor for devfreq. Add it to the +list of ufshcd softdeps to allow userspace initramfs tools like dracut to +automatically pull the governor module into the initramfs together with UFS +drivers. + +Link: https://lore.kernel.org/r/20230220140740.14379-1-athierry@redhat.com +Signed-off-by: Adrien Thierry +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/ufs/core/ufshcd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 2ddc1aba..edb93d2c 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -10095,4 +10095,5 @@ module_exit(ufshcd_core_exit); + MODULE_AUTHOR("Santosh Yaragnavi "); + MODULE_AUTHOR("Vinayak Holikatti "); + MODULE_DESCRIPTION("Generic UFS host controller driver Core"); ++MODULE_SOFTDEP("pre: governor_simpleondemand"); + MODULE_LICENSE("GPL"); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-145-scsi-lpfc-Check-kzalloc-in-lpfc_sli4_cgn_params.patch b/patches.kernel.org/6.2.9-145-scsi-lpfc-Check-kzalloc-in-lpfc_sli4_cgn_params.patch new file mode 100644 index 0000000..d92821d --- /dev/null +++ b/patches.kernel.org/6.2.9-145-scsi-lpfc-Check-kzalloc-in-lpfc_sli4_cgn_params.patch @@ -0,0 +1,60 @@ +From: Justin Tee +Date: Mon, 27 Feb 2023 20:43:36 -0800 +Subject: [PATCH] scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 312320b0e0ec21249a17645683fe5304d796aec1 + +[ Upstream commit 312320b0e0ec21249a17645683fe5304d796aec1 ] + +If kzalloc() fails in lpfc_sli4_cgn_params_read(), then we rely on +lpfc_read_object()'s routine to NULL check pdata. + +Currently, an early return error is thrown from lpfc_read_object() to +protect us from NULL ptr dereference, but the errno code is -ENODEV. + +Change the errno code to a more appropriate -ENOMEM. + +Reported-by: Kang Chen +Link: https://lore.kernel.org/all/20230226102338.3362585-1-void0red@gmail.com +Signed-off-by: Justin Tee +Link: https://lore.kernel.org/r/20230228044336.5195-1-justintee8345@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/lpfc/lpfc_init.c | 2 ++ + drivers/scsi/lpfc/lpfc_sli.c | 4 ---- + 2 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c +index 3fbd3bec..eeb73da7 100644 +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -7235,6 +7235,8 @@ lpfc_sli4_cgn_params_read(struct lpfc_hba *phba) + /* Find out if the FW has a new set of congestion parameters. */ + len = sizeof(struct lpfc_cgn_param); + pdata = kzalloc(len, GFP_KERNEL); ++ if (!pdata) ++ return -ENOMEM; + ret = lpfc_read_object(phba, (char *)LPFC_PORT_CFG_NAME, + pdata, len); + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 55a0d401..3aa72065 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -22113,10 +22113,6 @@ lpfc_read_object(struct lpfc_hba *phba, char *rdobject, uint32_t *datap, + struct lpfc_dmabuf *pcmd; + u32 rd_object_name[LPFC_MBX_OBJECT_NAME_LEN_DW] = {0}; + +- /* sanity check on queue memory */ +- if (!datap) +- return -ENODEV; +- + mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL); + if (!mbox) + return -ENOMEM; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-146-scsi-lpfc-Avoid-usage-of-list-iterator-variable.patch b/patches.kernel.org/6.2.9-146-scsi-lpfc-Avoid-usage-of-list-iterator-variable.patch new file mode 100644 index 0000000..edee803 --- /dev/null +++ b/patches.kernel.org/6.2.9-146-scsi-lpfc-Avoid-usage-of-list-iterator-variable.patch @@ -0,0 +1,62 @@ +From: Jakob Koschel +Date: Wed, 1 Mar 2023 18:19:14 +0100 +Subject: [PATCH] scsi: lpfc: Avoid usage of list iterator variable after loop +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 2850b23e9f9ae3696e472d2883ea1b43aafa884e + +[ Upstream commit 2850b23e9f9ae3696e472d2883ea1b43aafa884e ] + +If the &epd_pool->list is empty when executing +lpfc_get_io_buf_from_expedite_pool() the function would return an invalid +pointer. Even in the case if the list is guaranteed to be populated, the +iterator variable should not be used after the loop to be more robust for +future changes. + +Linus proposed to avoid any use of the list iterator variable after the +loop, in the attempt to move the list iterator variable declaration into +the macro to avoid any potential misuse after the loop [1]. + +Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1] +Signed-off-by: Jakob Koschel +Link: https://lore.kernel.org/r/20230301-scsi-lpfc-avoid-list-iterator-after-loop-v1-1-325578ae7561@gmail.com +Reviewed-by: Justin Tee +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/lpfc/lpfc_sli.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 3aa72065..c0ddf556 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -21903,20 +21903,20 @@ lpfc_get_io_buf_from_private_pool(struct lpfc_hba *phba, + static struct lpfc_io_buf * + lpfc_get_io_buf_from_expedite_pool(struct lpfc_hba *phba) + { +- struct lpfc_io_buf *lpfc_ncmd; ++ struct lpfc_io_buf *lpfc_ncmd = NULL, *iter; + struct lpfc_io_buf *lpfc_ncmd_next; + unsigned long iflag; + struct lpfc_epd_pool *epd_pool; + + epd_pool = &phba->epd_pool; +- lpfc_ncmd = NULL; + + spin_lock_irqsave(&epd_pool->lock, iflag); + if (epd_pool->count > 0) { +- list_for_each_entry_safe(lpfc_ncmd, lpfc_ncmd_next, ++ list_for_each_entry_safe(iter, lpfc_ncmd_next, + &epd_pool->list, list) { +- list_del(&lpfc_ncmd->list); ++ list_del(&iter->list); + epd_pool->count--; ++ lpfc_ncmd = iter; + break; + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-147-scsi-mpi3mr-Driver-unload-crashes-host-when-enh.patch b/patches.kernel.org/6.2.9-147-scsi-mpi3mr-Driver-unload-crashes-host-when-enh.patch new file mode 100644 index 0000000..bb41154 --- /dev/null +++ b/patches.kernel.org/6.2.9-147-scsi-mpi3mr-Driver-unload-crashes-host-when-enh.patch @@ -0,0 +1,40 @@ +From: Ranjan Kumar +Date: Tue, 28 Feb 2023 06:08:31 -0800 +Subject: [PATCH] scsi: mpi3mr: Driver unload crashes host when enhanced + logging is enabled +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 5b06a7169c59ce0c77ef8b9c82aa07c478f82aac + +[ Upstream commit 5b06a7169c59ce0c77ef8b9c82aa07c478f82aac ] + +Prevent driver from trying to dereference a NULL pointer in a debug print +while removing a device during driver unload. + +Signed-off-by: Ranjan Kumar +Signed-off-by: Sreekanth Reddy +Link: https://lore.kernel.org/r/20230228140835.4075-3-ranjan.kumar@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/mpi3mr/mpi3mr_transport.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpi3mr/mpi3mr_transport.c b/drivers/scsi/mpi3mr/mpi3mr_transport.c +index 50263ba4..90f61a0a 100644 +--- a/drivers/scsi/mpi3mr/mpi3mr_transport.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_transport.c +@@ -1549,7 +1549,8 @@ static void mpi3mr_sas_port_remove(struct mpi3mr_ioc *mrioc, u64 sas_address, + + list_for_each_entry_safe(mr_sas_phy, next_phy, + &mr_sas_port->phy_list, port_siblings) { +- if ((mrioc->logging_level & MPI3_DEBUG_TRANSPORT_INFO)) ++ if ((!mrioc->stop_drv_processing) && ++ (mrioc->logging_level & MPI3_DEBUG_TRANSPORT_INFO)) + dev_info(&mr_sas_port->port->dev, + "remove: sas_address(0x%016llx), phy(%d)\n", + (unsigned long long) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-148-scsi-mpi3mr-Wait-for-diagnostic-save-during-con.patch b/patches.kernel.org/6.2.9-148-scsi-mpi3mr-Wait-for-diagnostic-save-during-con.patch new file mode 100644 index 0000000..6410865 --- /dev/null +++ b/patches.kernel.org/6.2.9-148-scsi-mpi3mr-Wait-for-diagnostic-save-during-con.patch @@ -0,0 +1,63 @@ +From: Ranjan Kumar +Date: Tue, 28 Feb 2023 06:08:32 -0800 +Subject: [PATCH] scsi: mpi3mr: Wait for diagnostic save during controller init +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 0a319f1629495d27879b7ebf6eee62b8cf6e4c37 + +[ Upstream commit 0a319f1629495d27879b7ebf6eee62b8cf6e4c37 ] + +If a controller reset operation is triggered to recover the controller from +a fault state, then wait for the snapdump to be saved in the firmware +region before proceeding to reset the controller. + +Signed-off-by: Ranjan Kumar +Signed-off-by: Sreekanth Reddy +Link: https://lore.kernel.org/r/20230228140835.4075-4-ranjan.kumar@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/mpi3mr/mpi3mr_fw.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpi3mr/mpi3mr_fw.c b/drivers/scsi/mpi3mr/mpi3mr_fw.c +index 28fd90c4..a565817a 100644 +--- a/drivers/scsi/mpi3mr/mpi3mr_fw.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c +@@ -1198,7 +1198,7 @@ mpi3mr_revalidate_factsdata(struct mpi3mr_ioc *mrioc) + */ + static int mpi3mr_bring_ioc_ready(struct mpi3mr_ioc *mrioc) + { +- u32 ioc_config, ioc_status, timeout; ++ u32 ioc_config, ioc_status, timeout, host_diagnostic; + int retval = 0; + enum mpi3mr_iocstate ioc_state; + u64 base_info; +@@ -1252,6 +1252,23 @@ static int mpi3mr_bring_ioc_ready(struct mpi3mr_ioc *mrioc) + retval, mpi3mr_iocstate_name(ioc_state)); + } + if (ioc_state != MRIOC_STATE_RESET) { ++ if (ioc_state == MRIOC_STATE_FAULT) { ++ timeout = MPI3_SYSIF_DIAG_SAVE_TIMEOUT * 10; ++ mpi3mr_print_fault_info(mrioc); ++ do { ++ host_diagnostic = ++ readl(&mrioc->sysif_regs->host_diagnostic); ++ if (!(host_diagnostic & ++ MPI3_SYSIF_HOST_DIAG_SAVE_IN_PROGRESS)) ++ break; ++ if (!pci_device_is_present(mrioc->pdev)) { ++ mrioc->unrecoverable = 1; ++ ioc_err(mrioc, "controller is not present at the bringup\n"); ++ goto out_device_not_present; ++ } ++ msleep(100); ++ } while (--timeout); ++ } + mpi3mr_print_fault_info(mrioc); + ioc_info(mrioc, "issuing soft reset to bring to reset state\n"); + retval = mpi3mr_issue_reset(mrioc, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-149-scsi-mpi3mr-NVMe-command-size-greater-than-8K-f.patch b/patches.kernel.org/6.2.9-149-scsi-mpi3mr-NVMe-command-size-greater-than-8K-f.patch new file mode 100644 index 0000000..5eaf4ca --- /dev/null +++ b/patches.kernel.org/6.2.9-149-scsi-mpi3mr-NVMe-command-size-greater-than-8K-f.patch @@ -0,0 +1,49 @@ +From: Ranjan Kumar +Date: Tue, 28 Feb 2023 06:08:34 -0800 +Subject: [PATCH] scsi: mpi3mr: NVMe command size greater than 8K fails +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 4f297e856a7b5da2f2c66a12e739666e23943560 + +[ Upstream commit 4f297e856a7b5da2f2c66a12e739666e23943560 ] + +A wrong variable is checked while populating PRP entries in the PRP page +and this results in failure. No PRP entries in the PRP page were +successfully created and any NVMe Encapsulated commands with PRP of size +greater than 8K failed. + +Signed-off-by: Ranjan Kumar +Signed-off-by: Sreekanth Reddy +Link: https://lore.kernel.org/r/20230228140835.4075-6-ranjan.kumar@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/mpi3mr/mpi3mr_app.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c +index bff63770..d10c6afb 100644 +--- a/drivers/scsi/mpi3mr/mpi3mr_app.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_app.c +@@ -886,7 +886,7 @@ static int mpi3mr_build_nvme_prp(struct mpi3mr_ioc *mrioc, + * each time through the loop. + */ + *prp_entry = cpu_to_le64(dma_addr); +- if (*prp1_entry & sgemod_mask) { ++ if (*prp_entry & sgemod_mask) { + dprint_bsg_err(mrioc, + "%s: PRP address collides with SGE modifier\n", + __func__); +@@ -895,7 +895,7 @@ static int mpi3mr_build_nvme_prp(struct mpi3mr_ioc *mrioc, + *prp_entry &= ~sgemod_mask; + *prp_entry |= sgemod_val; + prp_entry++; +- prp_entry_dma++; ++ prp_entry_dma += prp_size; + } + + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-150-scsi-mpi3mr-Bad-drive-in-topology-results-kerne.patch b/patches.kernel.org/6.2.9-150-scsi-mpi3mr-Bad-drive-in-topology-results-kerne.patch new file mode 100644 index 0000000..e64dc35 --- /dev/null +++ b/patches.kernel.org/6.2.9-150-scsi-mpi3mr-Bad-drive-in-topology-results-kerne.patch @@ -0,0 +1,71 @@ +From: Ranjan Kumar +Date: Tue, 28 Feb 2023 06:08:35 -0800 +Subject: [PATCH] scsi: mpi3mr: Bad drive in topology results kernel crash +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 8e45183978d64699df639e795235433a60f35047 + +[ Upstream commit 8e45183978d64699df639e795235433a60f35047 ] + +When the SAS Transport Layer support is enabled and a device exposed to +the OS by the driver fails INQUIRY commands, the driver frees up the memory +allocated for an internal HBA port data structure. However, in some places, +the reference to the freed memory is not cleared. When the firmware sends +the Device Info change event for the same device again, the freed memory is +accessed and that leads to memory corruption and OS crash. + +Signed-off-by: Ranjan Kumar +Signed-off-by: Sreekanth Reddy +Link: https://lore.kernel.org/r/20230228140835.4075-7-ranjan.kumar@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/mpi3mr/mpi3mr_transport.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/mpi3mr/mpi3mr_transport.c b/drivers/scsi/mpi3mr/mpi3mr_transport.c +index 90f61a0a..5748bd93 100644 +--- a/drivers/scsi/mpi3mr/mpi3mr_transport.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_transport.c +@@ -2355,15 +2355,16 @@ int mpi3mr_report_tgtdev_to_sas_transport(struct mpi3mr_ioc *mrioc, + tgtdev->host_exposed = 1; + if (!mpi3mr_sas_port_add(mrioc, tgtdev->dev_handle, + sas_address_parent, hba_port)) { +- tgtdev->host_exposed = 0; + retval = -1; +- } else if ((!tgtdev->starget)) { +- if (!mrioc->is_driver_loading) ++ } else if ((!tgtdev->starget) && (!mrioc->is_driver_loading)) { + mpi3mr_sas_port_remove(mrioc, sas_address, + sas_address_parent, hba_port); +- tgtdev->host_exposed = 0; + retval = -1; + } ++ if (retval) { ++ tgtdev->dev_spec.sas_sata_inf.hba_port = NULL; ++ tgtdev->host_exposed = 0; ++ } + return retval; + } + +@@ -2392,6 +2393,7 @@ void mpi3mr_remove_tgtdev_from_sas_transport(struct mpi3mr_ioc *mrioc, + mpi3mr_sas_port_remove(mrioc, sas_address, sas_address_parent, + hba_port); + tgtdev->host_exposed = 0; ++ tgtdev->dev_spec.sas_sata_inf.hba_port = NULL; + } + + /** +@@ -2448,7 +2450,7 @@ static u8 mpi3mr_get_port_id_by_rphy(struct mpi3mr_ioc *mrioc, struct sas_rphy * + + tgtdev = __mpi3mr_get_tgtdev_by_addr_and_rphy(mrioc, + rphy->identify.sas_address, rphy); +- if (tgtdev) { ++ if (tgtdev && tgtdev->dev_spec.sas_sata_inf.hba_port) { + port_id = + tgtdev->dev_spec.sas_sata_inf.hba_port->port_id; + mpi3mr_tgtdev_put(tgtdev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-151-scsi-storvsc-Handle-BlockSize-change-in-Hyper-V.patch b/patches.kernel.org/6.2.9-151-scsi-storvsc-Handle-BlockSize-change-in-Hyper-V.patch new file mode 100644 index 0000000..c462745 --- /dev/null +++ b/patches.kernel.org/6.2.9-151-scsi-storvsc-Handle-BlockSize-change-in-Hyper-V.patch @@ -0,0 +1,91 @@ +From: Michael Kelley +Date: Mon, 27 Feb 2023 08:48:34 -0800 +Subject: [PATCH] scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX + file +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 11d9874c4204a785f43d899a1ab12f9dc8d9de3e + +[ Upstream commit 11d9874c4204a785f43d899a1ab12f9dc8d9de3e ] + +Hyper-V uses a VHD or VHDX file on the host as the underlying storage for a +virtual disk. The VHD/VHDX file format is a sparse format where real disk +space on the host is assigned in chunks that the VHD/VHDX file format calls +the BlockSize. This BlockSize is not to be confused with the 512-byte (or +4096-byte) sector size of the underlying storage device. The default block +size for a new VHD/VHDX file is 32 Mbytes. When a guest VM touches any +disk space within a 32 Mbyte chunk of the VHD/VHDX file, Hyper-V allocates +32 Mbytes of real disk space for that section of the VHD/VHDX. Similarly, +if a discard operation is done that covers an entire 32 Mbyte chunk, +Hyper-V will free the real disk space for that portion of the VHD/VHDX. +This BlockSize is surfaced in Linux as the "discard_granularity" in +/sys/block/sd/queue, which makes sense. + +Hyper-V also has differencing disks that can overlay a VHD/VHDX file to +capture changes to the VHD/VHDX while preserving the original VHD/VHDX. +One example of this differencing functionality is for VM snapshots. When a +snapshot is created, a differencing disk is created. If the snapshot is +rolled back, Hyper-V can just delete the differencing disk, and the VM will +see the original disk contents at the time the snapshot was taken. +Differencing disks are used in other scenarios as well. + +The BlockSize for a differencing disk defaults to 2 Mbytes, not 32 Mbytes. +The smaller default is used because changes to differencing disks are +typically scattered all over, and Hyper-V doesn't want to allocate 32 +Mbytes of real disk space for a stray write here or there. The smaller +BlockSize provides more efficient use of real disk space. + +When a differencing disk is added to a VHD/VHDX, Hyper-V reports +UNIT_ATTENTION with a sense code indicating "Operating parameters have +changed", because the value of discard_granularity should be changed to 2 +Mbytes. When the differencing disk is removed, discard_granularity should +be changed back to 32 Mbytes. However, current code simply reports a +message from scsi_report_sense() and the value of +/sys/block/sd/queue/discard_granularity is not updated. The message +isn't very actionable by a sysadmin. + +Fix this by having the storvsc driver check for the sense code indicating +that the underly VHD/VHDX block size has changed, and do a rescan of the +device to pick up the new discard_granularity. With this change the entire +transition to/from differencing disks is handled automatically and +transparently, with no confusing messages being output. + +Link: https://lore.kernel.org/r/1677516514-86060-1-git-send-email-mikelley@microsoft.com +Signed-off-by: Michael Kelley +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/storvsc_drv.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index 22705eb7..2bf25e80 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -987,6 +987,22 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb, + goto do_work; + } + ++ /* ++ * Check for "Operating parameters have changed" ++ * due to Hyper-V changing the VHD/VHDX BlockSize ++ * when adding/removing a differencing disk. This ++ * causes discard_granularity to change, so do a ++ * rescan to pick up the new granularity. We don't ++ * want scsi_report_sense() to output a message ++ * that a sysadmin wouldn't know what to do with. ++ */ ++ if ((asc == 0x3f) && (ascq != 0x03) && ++ (ascq != 0x0e)) { ++ process_err_fn = storvsc_device_scan; ++ set_host_byte(scmnd, DID_REQUEUE); ++ goto do_work; ++ } ++ + /* + * Otherwise, let upper layer deal with the + * error when sense message is present +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-152-platform-x86-int3472-Add-GPIOs-to-Surface-Go-3-.patch b/patches.kernel.org/6.2.9-152-platform-x86-int3472-Add-GPIOs-to-Surface-Go-3-.patch new file mode 100644 index 0000000..98aced7 --- /dev/null +++ b/patches.kernel.org/6.2.9-152-platform-x86-int3472-Add-GPIOs-to-Surface-Go-3-.patch @@ -0,0 +1,43 @@ +From: Daniel Scally +Date: Thu, 2 Mar 2023 10:26:11 +0000 +Subject: [PATCH] platform/x86: int3472: Add GPIOs to Surface Go 3 Board data +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: e8059d393158e927e36898aca89986a52025b9f3 + +[ Upstream commit e8059d393158e927e36898aca89986a52025b9f3 ] + +Add the INT347E GPIO lookup table to the board data for the Surface +Go 3. This is necessary to allow the ov7251 IR camera to probe +properly on that platform. + +Signed-off-by: Daniel Scally +Link: https://lore.kernel.org/r/20230302102611.314341-1-dan.scally@ideasonboard.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/platform/x86/intel/int3472/tps68470_board_data.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/intel/int3472/tps68470_board_data.c b/drivers/platform/x86/intel/int3472/tps68470_board_data.c +index 309eab9c..322237e0 100644 +--- a/drivers/platform/x86/intel/int3472/tps68470_board_data.c ++++ b/drivers/platform/x86/intel/int3472/tps68470_board_data.c +@@ -159,9 +159,10 @@ static const struct int3472_tps68470_board_data surface_go_tps68470_board_data = + static const struct int3472_tps68470_board_data surface_go3_tps68470_board_data = { + .dev_name = "i2c-INT3472:01", + .tps68470_regulator_pdata = &surface_go_tps68470_pdata, +- .n_gpiod_lookups = 1, ++ .n_gpiod_lookups = 2, + .tps68470_gpio_lookup_tables = { +- &surface_go_int347a_gpios ++ &surface_go_int347a_gpios, ++ &surface_go_int347e_gpios, + }, + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-153-net-usb-cdc_mbim-avoid-altsetting-toggling-for-.patch b/patches.kernel.org/6.2.9-153-net-usb-cdc_mbim-avoid-altsetting-toggling-for-.patch new file mode 100644 index 0000000..4d3817d --- /dev/null +++ b/patches.kernel.org/6.2.9-153-net-usb-cdc_mbim-avoid-altsetting-toggling-for-.patch @@ -0,0 +1,40 @@ +From: Enrico Sau +Date: Mon, 6 Mar 2023 12:59:33 +0100 +Subject: [PATCH] net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 418383e6ed6b4624a54ec05c535f13d184fbf33b + +[ Upstream commit 418383e6ed6b4624a54ec05c535f13d184fbf33b ] + +Add quirk CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE for Telit FE990 +0x1081 composition in order to avoid bind error. + +Signed-off-by: Enrico Sau +Link: https://lore.kernel.org/r/20230306115933.198259-1-enrico.sau@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/usb/cdc_mbim.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c +index c8963938..cd4083e0 100644 +--- a/drivers/net/usb/cdc_mbim.c ++++ b/drivers/net/usb/cdc_mbim.c +@@ -665,6 +665,11 @@ static const struct usb_device_id mbim_devs[] = { + .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle, + }, + ++ /* Telit FE990 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x1081, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), ++ .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle, ++ }, ++ + /* default entry */ + { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), + .driver_info = (unsigned long)&cdc_mbim_info_zlp, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-154-net-usb-qmi_wwan-add-Telit-0x1080-composition.patch b/patches.kernel.org/6.2.9-154-net-usb-qmi_wwan-add-Telit-0x1080-composition.patch new file mode 100644 index 0000000..f42cf40 --- /dev/null +++ b/patches.kernel.org/6.2.9-154-net-usb-qmi_wwan-add-Telit-0x1080-composition.patch @@ -0,0 +1,37 @@ +From: Enrico Sau +Date: Mon, 6 Mar 2023 13:05:28 +0100 +Subject: [PATCH] net: usb: qmi_wwan: add Telit 0x1080 composition +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 382e363d5bed0cec5807b35761d14e55955eee63 + +[ Upstream commit 382e363d5bed0cec5807b35761d14e55955eee63 ] + +Add the following Telit FE990 composition: + +0x1080: tty, adb, rmnet, tty, tty, tty, tty + +Signed-off-by: Enrico Sau +Link: https://lore.kernel.org/r/20230306120528.198842-1-enrico.sau@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index a808d718..571e37e6 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1364,6 +1364,7 @@ static const struct usb_device_id products[] = { + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1057, 2)}, /* Telit FN980 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)}, /* Telit LN920 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)}, /* Telit FN990 */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1080, 2)}, /* Telit FE990 */ + {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ + {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-155-drm-amd-display-Update-clock-table-to-include-h.patch b/patches.kernel.org/6.2.9-155-drm-amd-display-Update-clock-table-to-include-h.patch new file mode 100644 index 0000000..e60a018 --- /dev/null +++ b/patches.kernel.org/6.2.9-155-drm-amd-display-Update-clock-table-to-include-h.patch @@ -0,0 +1,77 @@ +From: Swapnil Patel +Date: Wed, 1 Mar 2023 14:33:33 -0500 +Subject: [PATCH] drm/amd/display: Update clock table to include highest clock + setting +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 2d99a7ec25cf456cd3680eb314d6454138e5aa64 + +[ Upstream commit 2d99a7ec25cf456cd3680eb314d6454138e5aa64 ] + +[Why] +Currently, the clk manager matches SocVoltage with voltage from +fused settings (dfPstate clock table). And then corresponding clocks +are selected. + +However in certain situations, this leads to clk manager not +including at least one entry with highest supported clock setting. + +[How] +Update the clk manager to include at least one entry with highest +supported clock setting. + +Reviewed-by: Pavle Kotarac +Acked-by: Qingqing Zhuo +Signed-off-by: Swapnil Patel +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../display/dc/clk_mgr/dcn301/vg_clk_mgr.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c +index 24715ca2..01383aac 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c +@@ -529,6 +529,19 @@ static struct clk_bw_params vg_bw_params = { + + }; + ++static uint32_t find_max_clk_value(const uint32_t clocks[], uint32_t num_clocks) ++{ ++ uint32_t max = 0; ++ int i; ++ ++ for (i = 0; i < num_clocks; ++i) { ++ if (clocks[i] > max) ++ max = clocks[i]; ++ } ++ ++ return max; ++} ++ + static unsigned int find_dcfclk_for_voltage(const struct vg_dpm_clocks *clock_table, + unsigned int voltage) + { +@@ -572,12 +585,16 @@ static void vg_clk_mgr_helper_populate_bw_params( + + bw_params->clk_table.num_entries = j + 1; + +- for (i = 0; i < bw_params->clk_table.num_entries; i++, j--) { ++ for (i = 0; i < bw_params->clk_table.num_entries - 1; i++, j--) { + bw_params->clk_table.entries[i].fclk_mhz = clock_table->DfPstateTable[j].fclk; + bw_params->clk_table.entries[i].memclk_mhz = clock_table->DfPstateTable[j].memclk; + bw_params->clk_table.entries[i].voltage = clock_table->DfPstateTable[j].voltage; + bw_params->clk_table.entries[i].dcfclk_mhz = find_dcfclk_for_voltage(clock_table, clock_table->DfPstateTable[j].voltage); + } ++ bw_params->clk_table.entries[i].fclk_mhz = clock_table->DfPstateTable[j].fclk; ++ bw_params->clk_table.entries[i].memclk_mhz = clock_table->DfPstateTable[j].memclk; ++ bw_params->clk_table.entries[i].voltage = clock_table->DfPstateTable[j].voltage; ++ bw_params->clk_table.entries[i].dcfclk_mhz = find_max_clk_value(clock_table->DcfClocks, VG_NUM_DCFCLK_DPM_LEVELS); + + bw_params->vram_type = bios_info->memory_type; + bw_params->num_channels = bios_info->ma_channel_number; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-156-sh-sanitize-the-flags-on-sigreturn.patch b/patches.kernel.org/6.2.9-156-sh-sanitize-the-flags-on-sigreturn.patch new file mode 100644 index 0000000..b8c27db --- /dev/null +++ b/patches.kernel.org/6.2.9-156-sh-sanitize-the-flags-on-sigreturn.patch @@ -0,0 +1,59 @@ +From: Al Viro +Date: Mon, 6 Mar 2023 01:20:30 +0000 +Subject: [PATCH] sh: sanitize the flags on sigreturn +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 573b22ccb7ce9ab7f0539a2e11a9d3609a8783f5 + +[ Upstream commit 573b22ccb7ce9ab7f0539a2e11a9d3609a8783f5 ] + +We fetch %SR value from sigframe; it might have been modified by signal +handler, so we can't trust it with any bits that are not modifiable in +user mode. + +Signed-off-by: Al Viro +Cc: Rich Felker +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/sh/include/asm/processor_32.h | 1 + + arch/sh/kernel/signal_32.c | 3 +++ + 2 files changed, 4 insertions(+) + +diff --git a/arch/sh/include/asm/processor_32.h b/arch/sh/include/asm/processor_32.h +index 27aebf1e..3ef7adf7 100644 +--- a/arch/sh/include/asm/processor_32.h ++++ b/arch/sh/include/asm/processor_32.h +@@ -50,6 +50,7 @@ + #define SR_FD 0x00008000 + #define SR_MD 0x40000000 + ++#define SR_USER_MASK 0x00000303 // M, Q, S, T bits + /* + * DSP structure and data + */ +diff --git a/arch/sh/kernel/signal_32.c b/arch/sh/kernel/signal_32.c +index 90f495d3..a6bfc6f3 100644 +--- a/arch/sh/kernel/signal_32.c ++++ b/arch/sh/kernel/signal_32.c +@@ -115,6 +115,7 @@ static int + restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc, int *r0_p) + { + unsigned int err = 0; ++ unsigned int sr = regs->sr & ~SR_USER_MASK; + + #define COPY(x) err |= __get_user(regs->x, &sc->sc_##x) + COPY(regs[1]); +@@ -130,6 +131,8 @@ restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc, int *r0_p + COPY(sr); COPY(pc); + #undef COPY + ++ regs->sr = (regs->sr & SR_USER_MASK) | sr; ++ + #ifdef CONFIG_SH_FPU + if (boot_cpu_data.flags & CPU_HAS_FPU) { + int owned_fp; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-157-drm-amdgpu-Fix-call-trace-warning-and-hang-when.patch b/patches.kernel.org/6.2.9-157-drm-amdgpu-Fix-call-trace-warning-and-hang-when.patch new file mode 100644 index 0000000..345c384 --- /dev/null +++ b/patches.kernel.org/6.2.9-157-drm-amdgpu-Fix-call-trace-warning-and-hang-when.patch @@ -0,0 +1,67 @@ +From: lyndonli +Date: Thu, 2 Mar 2023 14:18:12 +0800 +Subject: [PATCH] drm/amdgpu: Fix call trace warning and hang when removing + amdgpu device +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 93bb18d2a873d2fa9625c8ea927723660a868b95 + +[ Upstream commit 93bb18d2a873d2fa9625c8ea927723660a868b95 ] + +On GPUs with RAS enabled, below call trace and hang are observed when +shutting down device. + +v2: use DRM device unplugged flag instead of shutdown flag as the check to +prevent memory wipe in shutdown stage. + +[ +0.000000] RIP: 0010:amdgpu_vram_mgr_fini+0x18d/0x1c0 [amdgpu] +[ +0.000001] PKRU: 55555554 +[ +0.000001] Call Trace: +[ +0.000001] +[ +0.000002] amdgpu_ttm_fini+0x140/0x1c0 [amdgpu] +[ +0.000183] amdgpu_bo_fini+0x27/0xa0 [amdgpu] +[ +0.000184] gmc_v11_0_sw_fini+0x2b/0x40 [amdgpu] +[ +0.000163] amdgpu_device_fini_sw+0xb6/0x510 [amdgpu] +[ +0.000152] amdgpu_driver_release_kms+0x16/0x30 [amdgpu] +[ +0.000090] drm_dev_release+0x28/0x50 [drm] +[ +0.000016] devm_drm_dev_init_release+0x38/0x60 [drm] +[ +0.000011] devm_action_release+0x15/0x20 +[ +0.000003] release_nodes+0x40/0xc0 +[ +0.000001] devres_release_all+0x9e/0xe0 +[ +0.000001] device_unbind_cleanup+0x12/0x80 +[ +0.000003] device_release_driver_internal+0xff/0x160 +[ +0.000001] driver_detach+0x4a/0x90 +[ +0.000001] bus_remove_driver+0x6c/0xf0 +[ +0.000001] driver_unregister+0x31/0x50 +[ +0.000001] pci_unregister_driver+0x40/0x90 +[ +0.000003] amdgpu_exit+0x15/0x120 [amdgpu] + +Signed-off-by: lyndonli +Reviewed-by: Guchun Chen +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +index 25a68d88..5d4649b8 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +@@ -1315,7 +1315,7 @@ void amdgpu_bo_release_notify(struct ttm_buffer_object *bo) + + if (!bo->resource || bo->resource->mem_type != TTM_PL_VRAM || + !(abo->flags & AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE) || +- adev->in_suspend || adev->shutdown) ++ adev->in_suspend || drm_dev_is_unplugged(adev_to_drm(adev))) + return; + + if (WARN_ON_ONCE(!dma_resv_trylock(bo->base.resv))) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-158-drm-amd-Fix-initialization-mistake-for-NBIO-7.3.patch b/patches.kernel.org/6.2.9-158-drm-amd-Fix-initialization-mistake-for-NBIO-7.3.patch new file mode 100644 index 0000000..d5f8b06 --- /dev/null +++ b/patches.kernel.org/6.2.9-158-drm-amd-Fix-initialization-mistake-for-NBIO-7.3.patch @@ -0,0 +1,64 @@ +From: Mario Limonciello +Date: Wed, 1 Mar 2023 09:36:06 -0600 +Subject: [PATCH] drm/amd: Fix initialization mistake for NBIO 7.3.0 +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 1717cc5f2962a4652c76ed3858b499ccae6c277c + +[ Upstream commit 1717cc5f2962a4652c76ed3858b499ccae6c277c ] + +The same strapping initialization issue that happened on NBIO 7.5.1 +appears to be happening on NBIO 7.3.0. +Apply the same fix to 7.3.0 as well. + +Note: This workaround relies upon the integrated GPU being enabled +in BIOS. If the integrated GPU is disabled in BIOS a different +workaround will be required. + +Reported-by: Thomas Glanzmann +Cc: Basavaraj Natikar +Link: https://lore.kernel.org/linux-usb/Y%2Fz9GdHjPyF2rNG3@glanzmann.de/T/#u +Signed-off-by: Mario Limonciello +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdgpu/nbio_v7_2.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_2.c b/drivers/gpu/drm/amd/amdgpu/nbio_v7_2.c +index 4b0d563c..4ef1fa46 100644 +--- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_2.c ++++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_2.c +@@ -382,11 +382,6 @@ static void nbio_v7_2_init_registers(struct amdgpu_device *adev) + if (def != data) + WREG32_PCIE_PORT(SOC15_REG_OFFSET(NBIO, 0, regBIF1_PCIE_MST_CTRL_3), data); + break; +- case IP_VERSION(7, 5, 1): +- data = RREG32_SOC15(NBIO, 0, regRCC_DEV2_EPF0_STRAP2); +- data &= ~RCC_DEV2_EPF0_STRAP2__STRAP_NO_SOFT_RESET_DEV2_F0_MASK; +- WREG32_SOC15(NBIO, 0, regRCC_DEV2_EPF0_STRAP2, data); +- fallthrough; + default: + def = data = RREG32_PCIE_PORT(SOC15_REG_OFFSET(NBIO, 0, regPCIE_CONFIG_CNTL)); + data = REG_SET_FIELD(data, PCIE_CONFIG_CNTL, +@@ -399,6 +394,15 @@ static void nbio_v7_2_init_registers(struct amdgpu_device *adev) + break; + } + ++ switch (adev->ip_versions[NBIO_HWIP][0]) { ++ case IP_VERSION(7, 3, 0): ++ case IP_VERSION(7, 5, 1): ++ data = RREG32_SOC15(NBIO, 0, regRCC_DEV2_EPF0_STRAP2); ++ data &= ~RCC_DEV2_EPF0_STRAP2__STRAP_NO_SOFT_RESET_DEV2_F0_MASK; ++ WREG32_SOC15(NBIO, 0, regRCC_DEV2_EPF0_STRAP2, data); ++ break; ++ } ++ + if (amdgpu_sriov_vf(adev)) + adev->rmmio_remap.reg_offset = SOC15_REG_OFFSET(NBIO, 0, + regBIF_BX_PF0_HDP_MEM_COHERENCY_FLUSH_CNTL) << 2; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-159-net-sched-act_mirred-better-wording-on-protecti.patch b/patches.kernel.org/6.2.9-159-net-sched-act_mirred-better-wording-on-protecti.patch new file mode 100644 index 0000000..e031fa6 --- /dev/null +++ b/patches.kernel.org/6.2.9-159-net-sched-act_mirred-better-wording-on-protecti.patch @@ -0,0 +1,90 @@ +From: Davide Caratti +Date: Fri, 20 Jan 2023 18:01:39 +0100 +Subject: [PATCH] net/sched: act_mirred: better wording on protection against + excessive stack growth +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 78dcdffe0418ac8f3f057f26fe71ccf4d8ed851f + +[ Upstream commit 78dcdffe0418ac8f3f057f26fe71ccf4d8ed851f ] + +with commit e2ca070f89ec ("net: sched: protect against stack overflow in +TC act_mirred"), act_mirred protected itself against excessive stack growth +using per_cpu counter of nested calls to tcf_mirred_act(), and capping it +to MIRRED_RECURSION_LIMIT. However, such protection does not detect +recursion/loops in case the packet is enqueued to the backlog (for example, +when the mirred target device has RPS or skb timestamping enabled). Change +the wording from "recursion" to "nesting" to make it more clear to readers. + +CC: Jamal Hadi Salim +Signed-off-by: Davide Caratti +Reviewed-by: Marcelo Ricardo Leitner +Acked-by: Jamal Hadi Salim +Signed-off-by: Paolo Abeni +Stable-dep-of: ca22da2fbd69 ("act_mirred: use the backlog for nested calls to mirred ingress") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/sched/act_mirred.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c +index 7284bcea..c8abb513 100644 +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -29,8 +29,8 @@ + static LIST_HEAD(mirred_list); + static DEFINE_SPINLOCK(mirred_list_lock); + +-#define MIRRED_RECURSION_LIMIT 4 +-static DEFINE_PER_CPU(unsigned int, mirred_rec_level); ++#define MIRRED_NEST_LIMIT 4 ++static DEFINE_PER_CPU(unsigned int, mirred_nest_level); + + static bool tcf_mirred_is_act_redirect(int action) + { +@@ -226,7 +226,7 @@ TC_INDIRECT_SCOPE int tcf_mirred_act(struct sk_buff *skb, + struct sk_buff *skb2 = skb; + bool m_mac_header_xmit; + struct net_device *dev; +- unsigned int rec_level; ++ unsigned int nest_level; + int retval, err = 0; + bool use_reinsert; + bool want_ingress; +@@ -237,11 +237,11 @@ TC_INDIRECT_SCOPE int tcf_mirred_act(struct sk_buff *skb, + int mac_len; + bool at_nh; + +- rec_level = __this_cpu_inc_return(mirred_rec_level); +- if (unlikely(rec_level > MIRRED_RECURSION_LIMIT)) { ++ nest_level = __this_cpu_inc_return(mirred_nest_level); ++ if (unlikely(nest_level > MIRRED_NEST_LIMIT)) { + net_warn_ratelimited("Packet exceeded mirred recursion limit on dev %s\n", + netdev_name(skb->dev)); +- __this_cpu_dec(mirred_rec_level); ++ __this_cpu_dec(mirred_nest_level); + return TC_ACT_SHOT; + } + +@@ -310,7 +310,7 @@ TC_INDIRECT_SCOPE int tcf_mirred_act(struct sk_buff *skb, + err = tcf_mirred_forward(want_ingress, skb); + if (err) + tcf_action_inc_overlimit_qstats(&m->common); +- __this_cpu_dec(mirred_rec_level); ++ __this_cpu_dec(mirred_nest_level); + return TC_ACT_CONSUMED; + } + } +@@ -322,7 +322,7 @@ TC_INDIRECT_SCOPE int tcf_mirred_act(struct sk_buff *skb, + if (tcf_mirred_is_act_redirect(m_eaction)) + retval = TC_ACT_SHOT; + } +- __this_cpu_dec(mirred_rec_level); ++ __this_cpu_dec(mirred_nest_level); + + return retval; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-160-act_mirred-use-the-backlog-for-nested-calls-to-.patch b/patches.kernel.org/6.2.9-160-act_mirred-use-the-backlog-for-nested-calls-to-.patch new file mode 100644 index 0000000..5830199 --- /dev/null +++ b/patches.kernel.org/6.2.9-160-act_mirred-use-the-backlog-for-nested-calls-to-.patch @@ -0,0 +1,141 @@ +From: Davide Caratti +Date: Fri, 20 Jan 2023 18:01:40 +0100 +Subject: [PATCH] act_mirred: use the backlog for nested calls to mirred + ingress +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: ca22da2fbd693b54dc8e3b7b54ccc9f7e9ba3640 + +[ Upstream commit ca22da2fbd693b54dc8e3b7b54ccc9f7e9ba3640 ] + +William reports kernel soft-lockups on some OVS topologies when TC mirred +egress->ingress action is hit by local TCP traffic [1]. +The same can also be reproduced with SCTP (thanks Xin for verifying), when +client and server reach themselves through mirred egress to ingress, and +one of the two peers sends a "heartbeat" packet (from within a timer). + +Enqueueing to backlog proved to fix this soft lockup; however, as Cong +noticed [2], we should preserve - when possible - the current mirred +behavior that counts as "overlimits" any eventual packet drop subsequent to +the mirred forwarding action [3]. A compromise solution might use the +backlog only when tcf_mirred_act() has a nest level greater than one: +change tcf_mirred_forward() accordingly. + +Also, add a kselftest that can reproduce the lockup and verifies TC mirred +ability to account for further packet drops after TC mirred egress->ingress +(when the nest level is 1). + + [1] https://lore.kernel.org/netdev/33dc43f587ec1388ba456b4915c75f02a8aae226.1663945716.git.dcaratti@redhat.com/ + [2] https://lore.kernel.org/netdev/Y0w%2FWWY60gqrtGLp@pop-os.localdomain/ + [3] such behavior is not guaranteed: for example, if RPS or skb RX + timestamping is enabled on the mirred target device, the kernel + can defer receiving the skb and return NET_RX_SUCCESS inside + tcf_mirred_forward(). + +Reported-by: William Zhao +CC: Xin Long +Signed-off-by: Davide Caratti +Reviewed-by: Marcelo Ricardo Leitner +Acked-by: Jamal Hadi Salim +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/sched/act_mirred.c | 7 +++ + .../selftests/net/forwarding/tc_actions.sh | 49 ++++++++++++++++++- + 2 files changed, 55 insertions(+), 1 deletion(-) + +diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c +index c8abb513..8037ec9b 100644 +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -206,12 +206,19 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla, + return err; + } + ++static bool is_mirred_nested(void) ++{ ++ return unlikely(__this_cpu_read(mirred_nest_level) > 1); ++} ++ + static int tcf_mirred_forward(bool want_ingress, struct sk_buff *skb) + { + int err; + + if (!want_ingress) + err = tcf_dev_queue_xmit(skb, dev_queue_xmit); ++ else if (is_mirred_nested()) ++ err = netif_rx(skb); + else + err = netif_receive_skb(skb); + +diff --git a/tools/testing/selftests/net/forwarding/tc_actions.sh b/tools/testing/selftests/net/forwarding/tc_actions.sh +index 1e0a62f6..919c0dd9 100755 +--- a/tools/testing/selftests/net/forwarding/tc_actions.sh ++++ b/tools/testing/selftests/net/forwarding/tc_actions.sh +@@ -3,7 +3,8 @@ + + ALL_TESTS="gact_drop_and_ok_test mirred_egress_redirect_test \ + mirred_egress_mirror_test matchall_mirred_egress_mirror_test \ +- gact_trap_test mirred_egress_to_ingress_test" ++ gact_trap_test mirred_egress_to_ingress_test \ ++ mirred_egress_to_ingress_tcp_test" + NUM_NETIFS=4 + source tc_common.sh + source lib.sh +@@ -198,6 +199,52 @@ mirred_egress_to_ingress_test() + log_test "mirred_egress_to_ingress ($tcflags)" + } + ++mirred_egress_to_ingress_tcp_test() ++{ ++ local tmpfile=$(mktemp) tmpfile1=$(mktemp) ++ ++ RET=0 ++ dd conv=sparse status=none if=/dev/zero bs=1M count=2 of=$tmpfile ++ tc filter add dev $h1 protocol ip pref 100 handle 100 egress flower \ ++ $tcflags ip_proto tcp src_ip 192.0.2.1 dst_ip 192.0.2.2 \ ++ action ct commit nat src addr 192.0.2.2 pipe \ ++ action ct clear pipe \ ++ action ct commit nat dst addr 192.0.2.1 pipe \ ++ action ct clear pipe \ ++ action skbedit ptype host pipe \ ++ action mirred ingress redirect dev $h1 ++ tc filter add dev $h1 protocol ip pref 101 handle 101 egress flower \ ++ $tcflags ip_proto icmp \ ++ action mirred ingress redirect dev $h1 ++ tc filter add dev $h1 protocol ip pref 102 handle 102 ingress flower \ ++ ip_proto icmp \ ++ action drop ++ ++ ip vrf exec v$h1 nc --recv-only -w10 -l -p 12345 -o $tmpfile1 & ++ local rpid=$! ++ ip vrf exec v$h1 nc -w1 --send-only 192.0.2.2 12345 <$tmpfile ++ wait -n $rpid ++ cmp -s $tmpfile $tmpfile1 ++ check_err $? "server output check failed" ++ ++ $MZ $h1 -c 10 -p 64 -a $h1mac -b $h1mac -A 192.0.2.1 -B 192.0.2.1 \ ++ -t icmp "ping,id=42,seq=5" -q ++ tc_check_packets "dev $h1 egress" 101 10 ++ check_err $? "didn't mirred redirect ICMP" ++ tc_check_packets "dev $h1 ingress" 102 10 ++ check_err $? "didn't drop mirred ICMP" ++ local overlimits=$(tc_rule_stats_get ${h1} 101 egress .overlimits) ++ test ${overlimits} = 10 ++ check_err $? "wrong overlimits, expected 10 got ${overlimits}" ++ ++ tc filter del dev $h1 egress protocol ip pref 100 handle 100 flower ++ tc filter del dev $h1 egress protocol ip pref 101 handle 101 flower ++ tc filter del dev $h1 ingress protocol ip pref 102 handle 102 flower ++ ++ rm -f $tmpfile $tmpfile1 ++ log_test "mirred_egress_to_ingress_tcp ($tcflags)" ++} ++ + setup_prepare() + { + h1=${NETIFS[p1]} +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-161-cifs-lock-chan_lock-outside-match_session.patch b/patches.kernel.org/6.2.9-161-cifs-lock-chan_lock-outside-match_session.patch new file mode 100644 index 0000000..c6b0372 --- /dev/null +++ b/patches.kernel.org/6.2.9-161-cifs-lock-chan_lock-outside-match_session.patch @@ -0,0 +1,85 @@ +From: Shyam Prasad N +Date: Mon, 20 Feb 2023 13:02:11 +0000 +Subject: [PATCH] cifs: lock chan_lock outside match_session +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 2f4e429c846972c8405951a9ff7a82aceeca7461 + +commit 2f4e429c846972c8405951a9ff7a82aceeca7461 upstream. + +Coverity had rightly indicated a possible deadlock +due to chan_lock being done inside match_session. +All callers of match_* functions should pick up the +necessary locks and call them. + +Signed-off-by: Shyam Prasad N +Reviewed-by: Paulo Alcantara (SUSE) +Cc: stable@vger.kernel.org +Fixes: 724244cdb382 ("cifs: protect session channel fields with chan_lock") +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cifs/connect.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index b41e9472..6da2af97 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -1770,7 +1770,7 @@ cifs_get_tcp_session(struct smb3_fs_context *ctx, + return ERR_PTR(rc); + } + +-/* this function must be called with ses_lock held */ ++/* this function must be called with ses_lock and chan_lock held */ + static int match_session(struct cifs_ses *ses, struct smb3_fs_context *ctx) + { + if (ctx->sectype != Unspecified && +@@ -1781,12 +1781,8 @@ static int match_session(struct cifs_ses *ses, struct smb3_fs_context *ctx) + * If an existing session is limited to less channels than + * requested, it should not be reused + */ +- spin_lock(&ses->chan_lock); +- if (ses->chan_max < ctx->max_channels) { +- spin_unlock(&ses->chan_lock); ++ if (ses->chan_max < ctx->max_channels) + return 0; +- } +- spin_unlock(&ses->chan_lock); + + switch (ses->sectype) { + case Kerberos: +@@ -1914,10 +1910,13 @@ cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb3_fs_context *ctx) + spin_unlock(&ses->ses_lock); + continue; + } ++ spin_lock(&ses->chan_lock); + if (!match_session(ses, ctx)) { ++ spin_unlock(&ses->chan_lock); + spin_unlock(&ses->ses_lock); + continue; + } ++ spin_unlock(&ses->chan_lock); + spin_unlock(&ses->ses_lock); + + ++ses->ses_count; +@@ -2743,6 +2742,7 @@ cifs_match_super(struct super_block *sb, void *data) + + spin_lock(&tcp_srv->srv_lock); + spin_lock(&ses->ses_lock); ++ spin_lock(&ses->chan_lock); + spin_lock(&tcon->tc_lock); + if (!match_server(tcp_srv, ctx, dfs_super_cmp) || + !match_session(ses, ctx) || +@@ -2755,6 +2755,7 @@ cifs_match_super(struct super_block *sb, void *data) + rc = compare_mount_options(sb, mnt_data); + out: + spin_unlock(&tcon->tc_lock); ++ spin_unlock(&ses->chan_lock); + spin_unlock(&ses->ses_lock); + spin_unlock(&tcp_srv->srv_lock); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-162-cifs-append-path-to-open_enter-trace-event.patch b/patches.kernel.org/6.2.9-162-cifs-append-path-to-open_enter-trace-event.patch new file mode 100644 index 0000000..18c8fe4 --- /dev/null +++ b/patches.kernel.org/6.2.9-162-cifs-append-path-to-open_enter-trace-event.patch @@ -0,0 +1,242 @@ +From: Shyam Prasad N +Date: Fri, 17 Mar 2023 12:51:17 +0000 +Subject: [PATCH] cifs: append path to open_enter trace event +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: fddc6ccc487e5de07b98df8d04118d5dcb5e0407 + +commit fddc6ccc487e5de07b98df8d04118d5dcb5e0407 upstream. + +We do not dump the file path for smb3_open_enter ftrace +calls, which is a severe handicap while debugging +using ftrace evens. This change adds that info. + +Unfortunately, we're not updating the path in open params +in many places; which I had to do as a part of this change. +SMB2_open gets path in utf16 format, but it's easier of +path is supplied as char pointer in oparms. + +Signed-off-by: Shyam Prasad N +Reviewed-by: Paulo Alcantara (SUSE) +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cifs/cached_dir.c | 1 + + fs/cifs/link.c | 2 ++ + fs/cifs/smb2inode.c | 1 + + fs/cifs/smb2ops.c | 11 +++++++++++ + fs/cifs/smb2pdu.c | 4 ++-- + fs/cifs/trace.h | 12 ++++++++---- + 6 files changed, 25 insertions(+), 6 deletions(-) + +diff --git a/fs/cifs/cached_dir.c b/fs/cifs/cached_dir.c +index 75d5e063..71fabb4c 100644 +--- a/fs/cifs/cached_dir.c ++++ b/fs/cifs/cached_dir.c +@@ -184,6 +184,7 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + + oparms = (struct cifs_open_parms) { + .tcon = tcon, ++ .path = path, + .create_options = cifs_create_options(cifs_sb, CREATE_NOT_FILE), + .desired_access = FILE_READ_ATTRIBUTES, + .disposition = FILE_OPEN, +diff --git a/fs/cifs/link.c b/fs/cifs/link.c +index d937eedd..c0f101fc 100644 +--- a/fs/cifs/link.c ++++ b/fs/cifs/link.c +@@ -360,6 +360,7 @@ smb3_query_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, ++ .path = path, + .desired_access = GENERIC_READ, + .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), + .disposition = FILE_OPEN, +@@ -427,6 +428,7 @@ smb3_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, ++ .path = path, + .desired_access = GENERIC_WRITE, + .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), + .disposition = FILE_CREATE, +diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c +index 8dd3791b..163a0329 100644 +--- a/fs/cifs/smb2inode.c ++++ b/fs/cifs/smb2inode.c +@@ -107,6 +107,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, + + vars->oparms = (struct cifs_open_parms) { + .tcon = tcon, ++ .path = full_path, + .desired_access = desired_access, + .disposition = create_disposition, + .create_options = cifs_create_options(cifs_sb, create_options), +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index c7f8dba5..a9371f15 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -731,6 +731,7 @@ smb3_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon, + + oparms = (struct cifs_open_parms) { + .tcon = tcon, ++ .path = "", + .desired_access = FILE_READ_ATTRIBUTES, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, 0), +@@ -774,6 +775,7 @@ smb2_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon, + + oparms = (struct cifs_open_parms) { + .tcon = tcon, ++ .path = "", + .desired_access = FILE_READ_ATTRIBUTES, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, 0), +@@ -821,6 +823,7 @@ smb2_is_path_accessible(const unsigned int xid, struct cifs_tcon *tcon, + + oparms = (struct cifs_open_parms) { + .tcon = tcon, ++ .path = full_path, + .desired_access = FILE_READ_ATTRIBUTES, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, 0), +@@ -1105,6 +1108,7 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, + + oparms = (struct cifs_open_parms) { + .tcon = tcon, ++ .path = path, + .desired_access = FILE_WRITE_EA, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, 0), +@@ -2096,6 +2100,7 @@ smb3_notify(const unsigned int xid, struct file *pfile, + tcon = cifs_sb_master_tcon(cifs_sb); + oparms = (struct cifs_open_parms) { + .tcon = tcon, ++ .path = path, + .desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, 0), +@@ -2168,6 +2173,7 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon, + + oparms = (struct cifs_open_parms) { + .tcon = tcon, ++ .path = path, + .desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, 0), +@@ -2500,6 +2506,7 @@ smb2_query_info_compound(const unsigned int xid, struct cifs_tcon *tcon, + + oparms = (struct cifs_open_parms) { + .tcon = tcon, ++ .path = path, + .desired_access = desired_access, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, 0), +@@ -2634,6 +2641,7 @@ smb311_queryfs(const unsigned int xid, struct cifs_tcon *tcon, + + oparms = (struct cifs_open_parms) { + .tcon = tcon, ++ .path = "", + .desired_access = FILE_READ_ATTRIBUTES, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, 0), +@@ -2928,6 +2936,7 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, + + oparms = (struct cifs_open_parms) { + .tcon = tcon, ++ .path = full_path, + .desired_access = FILE_READ_ATTRIBUTES, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, create_options), +@@ -3068,6 +3077,7 @@ smb2_query_reparse_tag(const unsigned int xid, struct cifs_tcon *tcon, + + oparms = (struct cifs_open_parms) { + .tcon = tcon, ++ .path = full_path, + .desired_access = FILE_READ_ATTRIBUTES, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, OPEN_REPARSE_POINT), +@@ -3208,6 +3218,7 @@ get_smb2_acl_by_path(struct cifs_sb_info *cifs_sb, + + oparms = (struct cifs_open_parms) { + .tcon = tcon, ++ .path = path, + .desired_access = READ_CONTROL, + .disposition = FILE_OPEN, + /* +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index c1aba3dd..6e6e44d8 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -2742,7 +2742,7 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, + rqst.rq_nvec = n_iov; + + /* no need to inc num_remote_opens because we close it just below */ +- trace_smb3_posix_mkdir_enter(xid, tcon->tid, ses->Suid, CREATE_NOT_FILE, ++ trace_smb3_posix_mkdir_enter(xid, tcon->tid, ses->Suid, full_path, CREATE_NOT_FILE, + FILE_WRITE_ATTRIBUTES); + /* resource #4: response buffer */ + rc = cifs_send_recv(xid, ses, server, +@@ -3010,7 +3010,7 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, + if (rc) + goto creat_exit; + +- trace_smb3_open_enter(xid, tcon->tid, tcon->ses->Suid, ++ trace_smb3_open_enter(xid, tcon->tid, tcon->ses->Suid, oparms->path, + oparms->create_options, oparms->desired_access); + + rc = cifs_send_recv(xid, ses, server, +diff --git a/fs/cifs/trace.h b/fs/cifs/trace.h +index 110070ba..d3053bd8 100644 +--- a/fs/cifs/trace.h ++++ b/fs/cifs/trace.h +@@ -701,13 +701,15 @@ DECLARE_EVENT_CLASS(smb3_open_enter_class, + TP_PROTO(unsigned int xid, + __u32 tid, + __u64 sesid, ++ const char *full_path, + int create_options, + int desired_access), +- TP_ARGS(xid, tid, sesid, create_options, desired_access), ++ TP_ARGS(xid, tid, sesid, full_path, create_options, desired_access), + TP_STRUCT__entry( + __field(unsigned int, xid) + __field(__u32, tid) + __field(__u64, sesid) ++ __string(path, full_path) + __field(int, create_options) + __field(int, desired_access) + ), +@@ -715,11 +717,12 @@ DECLARE_EVENT_CLASS(smb3_open_enter_class, + __entry->xid = xid; + __entry->tid = tid; + __entry->sesid = sesid; ++ __assign_str(path, full_path); + __entry->create_options = create_options; + __entry->desired_access = desired_access; + ), +- TP_printk("xid=%u sid=0x%llx tid=0x%x cr_opts=0x%x des_access=0x%x", +- __entry->xid, __entry->sesid, __entry->tid, ++ TP_printk("xid=%u sid=0x%llx tid=0x%x path=%s cr_opts=0x%x des_access=0x%x", ++ __entry->xid, __entry->sesid, __entry->tid, __get_str(path), + __entry->create_options, __entry->desired_access) + ) + +@@ -728,9 +731,10 @@ DEFINE_EVENT(smb3_open_enter_class, smb3_##name, \ + TP_PROTO(unsigned int xid, \ + __u32 tid, \ + __u64 sesid, \ ++ const char *full_path, \ + int create_options, \ + int desired_access), \ +- TP_ARGS(xid, tid, sesid, create_options, desired_access)) ++ TP_ARGS(xid, tid, sesid, full_path, create_options, desired_access)) + + DEFINE_SMB3_OPEN_ENTER_EVENT(open_enter); + DEFINE_SMB3_OPEN_ENTER_EVENT(posix_mkdir_enter); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-163-cifs-do-not-poll-server-interfaces-too-regularl.patch b/patches.kernel.org/6.2.9-163-cifs-do-not-poll-server-interfaces-too-regularl.patch new file mode 100644 index 0000000..6d1731c --- /dev/null +++ b/patches.kernel.org/6.2.9-163-cifs-do-not-poll-server-interfaces-too-regularl.patch @@ -0,0 +1,62 @@ +From: Shyam Prasad N +Date: Wed, 8 Mar 2023 12:11:31 +0000 +Subject: [PATCH] cifs: do not poll server interfaces too regularly +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 072a28c8907c841f7d4b56c78bce46d3ee211e73 + +commit 072a28c8907c841f7d4b56c78bce46d3ee211e73 upstream. + +We have the server interface list hanging off the tcon +structure today for reasons unknown. So each tcon which is +connected to a file server can query them separately, +which is really unnecessary. To avoid this, in the query +function, we will check the time of last update of the +interface list, and avoid querying the server if it is +within a certain range. + +Signed-off-by: Shyam Prasad N +Reviewed-by: Paulo Alcantara (SUSE) +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cifs/smb2ops.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index a9371f15..6a1db6ca 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -530,6 +530,14 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + p = buf; + + spin_lock(&ses->iface_lock); ++ /* do not query too frequently, this time with lock held */ ++ if (ses->iface_last_update && ++ time_before(jiffies, ses->iface_last_update + ++ (SMB_INTERFACE_POLL_INTERVAL * HZ))) { ++ spin_unlock(&ses->iface_lock); ++ return 0; ++ } ++ + /* + * Go through iface_list and do kref_put to remove + * any unused ifaces. ifaces in use will be removed +@@ -696,6 +704,12 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_ + struct network_interface_info_ioctl_rsp *out_buf = NULL; + struct cifs_ses *ses = tcon->ses; + ++ /* do not query too frequently */ ++ if (ses->iface_last_update && ++ time_before(jiffies, ses->iface_last_update + ++ (SMB_INTERFACE_POLL_INTERVAL * HZ))) ++ return 0; ++ + rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, + FSCTL_QUERY_NETWORK_INTERFACE_INFO, + NULL /* no data input */, 0 /* no data input */, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-164-cifs-empty-interface-list-when-server-doesn-t-s.patch b/patches.kernel.org/6.2.9-164-cifs-empty-interface-list-when-server-doesn-t-s.patch new file mode 100644 index 0000000..57af900 --- /dev/null +++ b/patches.kernel.org/6.2.9-164-cifs-empty-interface-list-when-server-doesn-t-s.patch @@ -0,0 +1,40 @@ +From: Shyam Prasad N +Date: Thu, 9 Mar 2023 13:23:29 +0000 +Subject: [PATCH] cifs: empty interface list when server doesn't support query + interfaces +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 896cd316b841053f6df95ab77b5f1322c16a8e18 + +commit 896cd316b841053f6df95ab77b5f1322c16a8e18 upstream. + +When querying server interfaces returns -EOPNOTSUPP, +clear the list of interfaces. Assumption is that multichannel +would be disabled too. + +Signed-off-by: Shyam Prasad N +Reviewed-by: Paulo Alcantara (SUSE) +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cifs/smb2ops.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 6a1db6ca..502b6915 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -717,7 +717,7 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_ + if (rc == -EOPNOTSUPP) { + cifs_dbg(FYI, + "server does not support query network interfaces\n"); +- goto out; ++ ret_data_len = 0; + } else if (rc != 0) { + cifs_tcon_dbg(VFS, "error %d on ioctl to get interface list\n", rc); + goto out; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-165-cifs-dump-pending-mids-for-all-channels-in-Debu.patch b/patches.kernel.org/6.2.9-165-cifs-dump-pending-mids-for-all-channels-in-Debu.patch new file mode 100644 index 0000000..c85e971 --- /dev/null +++ b/patches.kernel.org/6.2.9-165-cifs-dump-pending-mids-for-all-channels-in-Debu.patch @@ -0,0 +1,92 @@ +From: Shyam Prasad N +Date: Mon, 13 Mar 2023 11:09:12 +0000 +Subject: [PATCH] cifs: dump pending mids for all channels in DebugData +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: d12bc6d26f92c51b28e8f4a146ffcc630b688198 + +commit d12bc6d26f92c51b28e8f4a146ffcc630b688198 upstream. + +Currently, we only dump the pending mid information only +on the primary channel in /proc/fs/cifs/DebugData. +If multichannel is active, we do not print the pending MID +list on secondary channels. + +This change will dump the pending mids for all the channels +based on server->conn_id. + +Signed-off-by: Shyam Prasad N +Reviewed-by: Paulo Alcantara (SUSE) +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cifs/cifs_debug.c | 41 +++++++++++++++++++++++++++-------------- + 1 file changed, 27 insertions(+), 14 deletions(-) + +diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c +index d9876bd3..325b5bd4 100644 +--- a/fs/cifs/cifs_debug.c ++++ b/fs/cifs/cifs_debug.c +@@ -215,6 +215,7 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v) + { + struct mid_q_entry *mid_entry; + struct TCP_Server_Info *server; ++ struct TCP_Server_Info *chan_server; + struct cifs_ses *ses; + struct cifs_tcon *tcon; + struct cifs_server_iface *iface; +@@ -471,23 +472,35 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v) + seq_puts(m, "\t\t[CONNECTED]\n"); + } + spin_unlock(&ses->iface_lock); ++ ++ seq_puts(m, "\n\n\tMIDs: "); ++ spin_lock(&ses->chan_lock); ++ for (j = 0; j < ses->chan_count; j++) { ++ chan_server = ses->chans[j].server; ++ if (!chan_server) ++ continue; ++ ++ if (list_empty(&chan_server->pending_mid_q)) ++ continue; ++ ++ seq_printf(m, "\n\tServer ConnectionId: 0x%llx", ++ chan_server->conn_id); ++ spin_lock(&chan_server->mid_lock); ++ list_for_each_entry(mid_entry, &chan_server->pending_mid_q, qhead) { ++ seq_printf(m, "\n\t\tState: %d com: %d pid: %d cbdata: %p mid %llu", ++ mid_entry->mid_state, ++ le16_to_cpu(mid_entry->command), ++ mid_entry->pid, ++ mid_entry->callback_data, ++ mid_entry->mid); ++ } ++ spin_unlock(&chan_server->mid_lock); ++ } ++ spin_unlock(&ses->chan_lock); ++ seq_puts(m, "\n--\n"); + } + if (i == 0) + seq_printf(m, "\n\t\t[NONE]"); +- +- seq_puts(m, "\n\n\tMIDs: "); +- spin_lock(&server->mid_lock); +- list_for_each_entry(mid_entry, &server->pending_mid_q, qhead) { +- seq_printf(m, "\n\tState: %d com: %d pid:" +- " %d cbdata: %p mid %llu\n", +- mid_entry->mid_state, +- le16_to_cpu(mid_entry->command), +- mid_entry->pid, +- mid_entry->callback_data, +- mid_entry->mid); +- } +- spin_unlock(&server->mid_lock); +- seq_printf(m, "\n--\n"); + } + if (c == 0) + seq_printf(m, "\n\t[NONE]"); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-166-cifs-print-session-id-while-listing-open-files.patch b/patches.kernel.org/6.2.9-166-cifs-print-session-id-while-listing-open-files.patch new file mode 100644 index 0000000..f485d8a --- /dev/null +++ b/patches.kernel.org/6.2.9-166-cifs-print-session-id-while-listing-open-files.patch @@ -0,0 +1,53 @@ +From: Shyam Prasad N +Date: Mon, 13 Mar 2023 12:17:34 +0000 +Subject: [PATCH] cifs: print session id while listing open files +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 175b54abc443b6965e9379b71ec05f7c73c192e9 + +commit 175b54abc443b6965e9379b71ec05f7c73c192e9 upstream. + +In the output of /proc/fs/cifs/open_files, we only print +the tree id for the tcon of each open file. It becomes +difficult to know which tcon these files belong to with +just the tree id. + +This change dumps ses id in addition to all other data today. + +Signed-off-by: Shyam Prasad N +Reviewed-by: Paulo Alcantara (SUSE) +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cifs/cifs_debug.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c +index 325b5bd4..72e24256 100644 +--- a/fs/cifs/cifs_debug.c ++++ b/fs/cifs/cifs_debug.c +@@ -175,7 +175,7 @@ static int cifs_debug_files_proc_show(struct seq_file *m, void *v) + + seq_puts(m, "# Version:1\n"); + seq_puts(m, "# Format:\n"); +- seq_puts(m, "# "); ++ seq_puts(m, "# "); + #ifdef CONFIG_CIFS_DEBUG2 + seq_printf(m, " \n"); + #else +@@ -188,8 +188,9 @@ static int cifs_debug_files_proc_show(struct seq_file *m, void *v) + spin_lock(&tcon->open_file_lock); + list_for_each_entry(cfile, &tcon->openFileList, tlist) { + seq_printf(m, +- "0x%x 0x%llx 0x%x %d %d %d %pd", ++ "0x%x 0x%llx 0x%llx 0x%x %d %d %d %pd", + tcon->tid, ++ ses->Suid, + cfile->fid.persistent_fid, + cfile->f_flags, + cfile->count, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-167-cifs-fix-dentry-lookups-in-directory-handle-cac.patch b/patches.kernel.org/6.2.9-167-cifs-fix-dentry-lookups-in-directory-handle-cac.patch new file mode 100644 index 0000000..4f6e9b1 --- /dev/null +++ b/patches.kernel.org/6.2.9-167-cifs-fix-dentry-lookups-in-directory-handle-cac.patch @@ -0,0 +1,103 @@ +From: Paulo Alcantara +Date: Fri, 24 Mar 2023 13:56:33 -0300 +Subject: [PATCH] cifs: fix dentry lookups in directory handle cache +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: be4fde79812f02914e350bde0bc4cfeae8429378 + +commit be4fde79812f02914e350bde0bc4cfeae8429378 upstream. + +Get rid of any prefix paths in @path before lookup_positive_unlocked() +as it will call ->lookup() which already adds those prefix paths +through build_path_from_dentry(). + +This has caused a performance regression when mounting shares with a +prefix path where readdir(2) would end up retrying several times to +open bad directory names that contained duplicate prefix paths. + +Fix this by skipping any prefix paths in @path before calling +lookup_positive_unlocked(). + +Fixes: e4029e072673 ("cifs: find and use the dentry for cached non-root directories also") +Cc: stable@vger.kernel.org # 6.1+ +Signed-off-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cifs/cached_dir.c | 36 ++++++++++++++++++++++++++++++++++-- + 1 file changed, 34 insertions(+), 2 deletions(-) + +diff --git a/fs/cifs/cached_dir.c b/fs/cifs/cached_dir.c +index 71fabb4c..bfc964b3 100644 +--- a/fs/cifs/cached_dir.c ++++ b/fs/cifs/cached_dir.c +@@ -99,6 +99,23 @@ path_to_dentry(struct cifs_sb_info *cifs_sb, const char *path) + return dentry; + } + ++static const char *path_no_prefix(struct cifs_sb_info *cifs_sb, ++ const char *path) ++{ ++ size_t len = 0; ++ ++ if (!*path) ++ return path; ++ ++ if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) && ++ cifs_sb->prepath) { ++ len = strlen(cifs_sb->prepath) + 1; ++ if (unlikely(len > strlen(path))) ++ return ERR_PTR(-EINVAL); ++ } ++ return path + len; ++} ++ + /* + * Open the and cache a directory handle. + * If error then *cfid is not initialized. +@@ -125,6 +142,7 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + struct dentry *dentry = NULL; + struct cached_fid *cfid; + struct cached_fids *cfids; ++ const char *npath; + + if (tcon == NULL || tcon->cfids == NULL || tcon->nohandlecache || + is_smb1_server(tcon->ses->server)) +@@ -160,6 +178,20 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + return 0; + } + ++ /* ++ * Skip any prefix paths in @path as lookup_positive_unlocked() ends up ++ * calling ->lookup() which already adds those through ++ * build_path_from_dentry(). Also, do it earlier as we might reconnect ++ * below when trying to send compounded request and then potentially ++ * having a different prefix path (e.g. after DFS failover). ++ */ ++ npath = path_no_prefix(cifs_sb, path); ++ if (IS_ERR(npath)) { ++ rc = PTR_ERR(npath); ++ kfree(utf16_path); ++ return rc; ++ } ++ + /* + * We do not hold the lock for the open because in case + * SMB2_open needs to reconnect. +@@ -252,10 +284,10 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + (char *)&cfid->file_all_info)) + cfid->file_all_info_is_valid = true; + +- if (!path[0]) ++ if (!npath[0]) + dentry = dget(cifs_sb->root); + else { +- dentry = path_to_dentry(cifs_sb, path); ++ dentry = path_to_dentry(cifs_sb, npath); + if (IS_ERR(dentry)) { + rc = -ENOENT; + goto oshr_free; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-168-x86-mm-Do-not-shuffle-CPU-entry-areas-without-K.patch b/patches.kernel.org/6.2.9-168-x86-mm-Do-not-shuffle-CPU-entry-areas-without-K.patch new file mode 100644 index 0000000..5fe4061 --- /dev/null +++ b/patches.kernel.org/6.2.9-168-x86-mm-Do-not-shuffle-CPU-entry-areas-without-K.patch @@ -0,0 +1,63 @@ +From: =?UTF-8?q?Michal=20Koutn=C3=BD?= +Date: Mon, 6 Mar 2023 20:31:44 +0100 +Subject: [PATCH] x86/mm: Do not shuffle CPU entry areas without KASLR +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: a3f547addcaa10df5a226526bc9e2d9a94542344 + +commit a3f547addcaa10df5a226526bc9e2d9a94542344 upstream. + +The commit 97e3d26b5e5f ("x86/mm: Randomize per-cpu entry area") fixed +an omission of KASLR on CPU entry areas. It doesn't take into account +KASLR switches though, which may result in unintended non-determinism +when a user wants to avoid it (e.g. debugging, benchmarking). + +Generate only a single combination of CPU entry areas offsets -- the +linear array that existed prior randomization when KASLR is turned off. + +Since we have 3f148f331814 ("x86/kasan: Map shadow for percpu pages on +demand") and followups, we can use the more relaxed guard +kasrl_enabled() (in contrast to kaslr_memory_enabled()). + +Fixes: 97e3d26b5e5f ("x86/mm: Randomize per-cpu entry area") +Signed-off-by: Michal Koutný +Signed-off-by: Dave Hansen +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/all/20230306193144.24605-1-mkoutny%40suse.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/mm/cpu_entry_area.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/x86/mm/cpu_entry_area.c b/arch/x86/mm/cpu_entry_area.c +index 7316a822..e91500a8 100644 +--- a/arch/x86/mm/cpu_entry_area.c ++++ b/arch/x86/mm/cpu_entry_area.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + + static DEFINE_PER_CPU_PAGE_ALIGNED(struct entry_stack_page, entry_stack_storage); + +@@ -29,6 +30,12 @@ static __init void init_cea_offsets(void) + unsigned int max_cea; + unsigned int i, j; + ++ if (!kaslr_enabled()) { ++ for_each_possible_cpu(i) ++ per_cpu(_cea_offset, i) = i; ++ return; ++ } ++ + max_cea = (CPU_ENTRY_AREA_MAP_SIZE - PAGE_SIZE) / CPU_ENTRY_AREA_SIZE; + + /* O(sodding terrible) */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-169-x86-fpu-xstate-Prevent-false-positive-warning-i.patch b/patches.kernel.org/6.2.9-169-x86-fpu-xstate-Prevent-false-positive-warning-i.patch new file mode 100644 index 0000000..7843190 --- /dev/null +++ b/patches.kernel.org/6.2.9-169-x86-fpu-xstate-Prevent-false-positive-warning-i.patch @@ -0,0 +1,96 @@ +From: "Chang S. Bae" +Date: Mon, 27 Feb 2023 13:05:03 -0800 +Subject: [PATCH] x86/fpu/xstate: Prevent false-positive warning in + __copy_xstate_uabi_buf() +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: b15888840207c2bfe678dd1f68a32db54315e71f + +commit b15888840207c2bfe678dd1f68a32db54315e71f upstream. + +__copy_xstate_to_uabi_buf() copies either from the tasks XSAVE buffer +or from init_fpstate into the ptrace buffer. Dynamic features, like +XTILEDATA, have an all zeroes init state and are not saved in +init_fpstate, which means the corresponding bit is not set in the +xfeatures bitmap of the init_fpstate header. + +But __copy_xstate_to_uabi_buf() retrieves addresses for both the tasks +xstate and init_fpstate unconditionally via __raw_xsave_addr(). + +So if the tasks XSAVE buffer has a dynamic feature set, then the +address retrieval for init_fpstate triggers the warning in +__raw_xsave_addr() which checks the feature bit in the init_fpstate +header. + +Remove the address retrieval from init_fpstate for extended features. +They have an all zeroes init state so init_fpstate has zeros for them. +Then zeroing the user buffer for the init state is the same as copying +them from init_fpstate. + +Fixes: 2308ee57d93d ("x86/fpu/amx: Enable the AMX feature in 64-bit mode") +Reported-by: Mingwei Zhang +Link: https://lore.kernel.org/kvm/20230221163655.920289-2-mizhang@google.com/ +Signed-off-by: Chang S. Bae +Signed-off-by: Dave Hansen +Tested-by: Mingwei Zhang +Link: https://lore.kernel.org/all/20230227210504.18520-2-chang.seok.bae%40intel.com +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kernel/fpu/xstate.c | 30 ++++++++++++++---------------- + 1 file changed, 14 insertions(+), 16 deletions(-) + +diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c +index 714166cc..0bab497c 100644 +--- a/arch/x86/kernel/fpu/xstate.c ++++ b/arch/x86/kernel/fpu/xstate.c +@@ -1118,21 +1118,20 @@ void __copy_xstate_to_uabi_buf(struct membuf to, struct fpstate *fpstate, + zerofrom = offsetof(struct xregs_state, extended_state_area); + + /* +- * The ptrace buffer is in non-compacted XSAVE format. In +- * non-compacted format disabled features still occupy state space, +- * but there is no state to copy from in the compacted +- * init_fpstate. The gap tracking will zero these states. +- */ +- mask = fpstate->user_xfeatures; +- +- /* +- * Dynamic features are not present in init_fpstate. When they are +- * in an all zeros init state, remove those from 'mask' to zero +- * those features in the user buffer instead of retrieving them +- * from init_fpstate. ++ * This 'mask' indicates which states to copy from fpstate. ++ * Those extended states that are not present in fpstate are ++ * either disabled or initialized: ++ * ++ * In non-compacted format, disabled features still occupy ++ * state space but there is no state to copy from in the ++ * compacted init_fpstate. The gap tracking will zero these ++ * states. ++ * ++ * The extended features have an all zeroes init state. Thus, ++ * remove them from 'mask' to zero those features in the user ++ * buffer instead of retrieving them from init_fpstate. + */ +- if (fpu_state_size_dynamic()) +- mask &= (header.xfeatures | xinit->header.xcomp_bv); ++ mask = header.xfeatures; + + for_each_extended_xfeature(i, mask) { + /* +@@ -1151,9 +1150,8 @@ void __copy_xstate_to_uabi_buf(struct membuf to, struct fpstate *fpstate, + pkru.pkru = pkru_val; + membuf_write(&to, &pkru, sizeof(pkru)); + } else { +- copy_feature(header.xfeatures & BIT_ULL(i), &to, ++ membuf_write(&to, + __raw_xsave_addr(xsave, i), +- __raw_xsave_addr(xinit, i), + xstate_sizes[i]); + } + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-170-selftests-x86-amx-Add-a-ptrace-test.patch b/patches.kernel.org/6.2.9-170-selftests-x86-amx-Add-a-ptrace-test.patch new file mode 100644 index 0000000..84e3fd7 --- /dev/null +++ b/patches.kernel.org/6.2.9-170-selftests-x86-amx-Add-a-ptrace-test.patch @@ -0,0 +1,178 @@ +From: "Chang S. Bae" +Date: Mon, 27 Feb 2023 13:05:04 -0800 +Subject: [PATCH] selftests/x86/amx: Add a ptrace test +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 62faca1ca10cc84e99ae7f38aa28df2bc945369b + +commit 62faca1ca10cc84e99ae7f38aa28df2bc945369b upstream. + +Include a test case to validate the XTILEDATA injection to the target. + +Also, it ensures the kernel's ability to copy states between different +XSAVE formats. + +Refactor the memcmp() code to be usable for the state validation. + +Signed-off-by: Chang S. Bae +Signed-off-by: Dave Hansen +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/all/20230227210504.18520-3-chang.seok.bae%40intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/x86/amx.c | 108 +++++++++++++++++++++++++++++- + 1 file changed, 105 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/x86/amx.c b/tools/testing/selftests/x86/amx.c +index 625e4290..d884fd69 100644 +--- a/tools/testing/selftests/x86/amx.c ++++ b/tools/testing/selftests/x86/amx.c +@@ -14,8 +14,10 @@ + #include + #include + #include ++#include + #include + #include ++#include + + #include "../kselftest.h" /* For __cpuid_count() */ + +@@ -583,6 +585,13 @@ static void test_dynamic_state(void) + _exit(0); + } + ++static inline int __compare_tiledata_state(struct xsave_buffer *xbuf1, struct xsave_buffer *xbuf2) ++{ ++ return memcmp(&xbuf1->bytes[xtiledata.xbuf_offset], ++ &xbuf2->bytes[xtiledata.xbuf_offset], ++ xtiledata.size); ++} ++ + /* + * Save current register state and compare it to @xbuf1.' + * +@@ -599,9 +608,7 @@ static inline bool __validate_tiledata_regs(struct xsave_buffer *xbuf1) + fatal_error("failed to allocate XSAVE buffer\n"); + + xsave(xbuf2, XFEATURE_MASK_XTILEDATA); +- ret = memcmp(&xbuf1->bytes[xtiledata.xbuf_offset], +- &xbuf2->bytes[xtiledata.xbuf_offset], +- xtiledata.size); ++ ret = __compare_tiledata_state(xbuf1, xbuf2); + + free(xbuf2); + +@@ -826,6 +833,99 @@ static void test_context_switch(void) + free(finfo); + } + ++/* Ptrace test */ ++ ++/* ++ * Make sure the ptracee has the expanded kernel buffer on the first ++ * use. Then, initialize the state before performing the state ++ * injection from the ptracer. ++ */ ++static inline void ptracee_firstuse_tiledata(void) ++{ ++ load_rand_tiledata(stashed_xsave); ++ init_xtiledata(); ++} ++ ++/* ++ * Ptracer injects the randomized tile data state. It also reads ++ * before and after that, which will execute the kernel's state copy ++ * functions. So, the tester is advised to double-check any emitted ++ * kernel messages. ++ */ ++static void ptracer_inject_tiledata(pid_t target) ++{ ++ struct xsave_buffer *xbuf; ++ struct iovec iov; ++ ++ xbuf = alloc_xbuf(); ++ if (!xbuf) ++ fatal_error("unable to allocate XSAVE buffer"); ++ ++ printf("\tRead the init'ed tiledata via ptrace().\n"); ++ ++ iov.iov_base = xbuf; ++ iov.iov_len = xbuf_size; ++ ++ memset(stashed_xsave, 0, xbuf_size); ++ ++ if (ptrace(PTRACE_GETREGSET, target, (uint32_t)NT_X86_XSTATE, &iov)) ++ fatal_error("PTRACE_GETREGSET"); ++ ++ if (!__compare_tiledata_state(stashed_xsave, xbuf)) ++ printf("[OK]\tThe init'ed tiledata was read from ptracee.\n"); ++ else ++ printf("[FAIL]\tThe init'ed tiledata was not read from ptracee.\n"); ++ ++ printf("\tInject tiledata via ptrace().\n"); ++ ++ load_rand_tiledata(xbuf); ++ ++ memcpy(&stashed_xsave->bytes[xtiledata.xbuf_offset], ++ &xbuf->bytes[xtiledata.xbuf_offset], ++ xtiledata.size); ++ ++ if (ptrace(PTRACE_SETREGSET, target, (uint32_t)NT_X86_XSTATE, &iov)) ++ fatal_error("PTRACE_SETREGSET"); ++ ++ if (ptrace(PTRACE_GETREGSET, target, (uint32_t)NT_X86_XSTATE, &iov)) ++ fatal_error("PTRACE_GETREGSET"); ++ ++ if (!__compare_tiledata_state(stashed_xsave, xbuf)) ++ printf("[OK]\tTiledata was correctly written to ptracee.\n"); ++ else ++ printf("[FAIL]\tTiledata was not correctly written to ptracee.\n"); ++} ++ ++static void test_ptrace(void) ++{ ++ pid_t child; ++ int status; ++ ++ child = fork(); ++ if (child < 0) { ++ err(1, "fork"); ++ } else if (!child) { ++ if (ptrace(PTRACE_TRACEME, 0, NULL, NULL)) ++ err(1, "PTRACE_TRACEME"); ++ ++ ptracee_firstuse_tiledata(); ++ ++ raise(SIGTRAP); ++ _exit(0); ++ } ++ ++ do { ++ wait(&status); ++ } while (WSTOPSIG(status) != SIGTRAP); ++ ++ ptracer_inject_tiledata(child); ++ ++ ptrace(PTRACE_DETACH, child, NULL, NULL); ++ wait(&status); ++ if (!WIFEXITED(status) || WEXITSTATUS(status)) ++ err(1, "ptrace test"); ++} ++ + int main(void) + { + /* Check hardware availability at first */ +@@ -846,6 +946,8 @@ int main(void) + ctxtswtest_config.num_threads = 5; + test_context_switch(); + ++ test_ptrace(); ++ + clearhandler(SIGILL); + free_stashed_xsave(); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-171-scsi-core-Add-BLIST_SKIP_VPD_PAGES-for-SKhynix-.patch b/patches.kernel.org/6.2.9-171-scsi-core-Add-BLIST_SKIP_VPD_PAGES-for-SKhynix-.patch new file mode 100644 index 0000000..cf636a4 --- /dev/null +++ b/patches.kernel.org/6.2.9-171-scsi-core-Add-BLIST_SKIP_VPD_PAGES-for-SKhynix-.patch @@ -0,0 +1,43 @@ +From: Joel Selvaraj +Date: Sun, 12 Mar 2023 23:14:02 -0500 +Subject: [PATCH] scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: a204b490595de71016b2360a1886ec8c12d0afac + +commit a204b490595de71016b2360a1886ec8c12d0afac upstream. + +Xiaomi Poco F1 (qcom/sdm845-xiaomi-beryllium*.dts) comes with a SKhynix +H28U74301AMR UFS. The sd_read_cpr() operation leads to a 120 second +timeout, making the device bootup very slow: + +[ 121.457736] sd 0:0:0:1: [sdb] tag#23 timing out command, waited 120s + +Setting the BLIST_SKIP_VPD_PAGES allows the device to skip the failing +sd_read_cpr operation and boot normally. + +Signed-off-by: Joel Selvaraj +Link: https://lore.kernel.org/r/20230313041402.39330-1-joelselvaraj.oss@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/scsi/scsi_devinfo.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c +index bc9d2804..3fcaf10a 100644 +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -234,6 +234,7 @@ static struct { + {"SGI", "RAID5", "*", BLIST_SPARSELUN}, + {"SGI", "TP9100", "*", BLIST_REPORTLUN2}, + {"SGI", "Universal Xport", "*", BLIST_NO_ULD_ATTACH}, ++ {"SKhynix", "H28U74301AMR", NULL, BLIST_SKIP_VPD_PAGES}, + {"IBM", "Universal Xport", "*", BLIST_NO_ULD_ATTACH}, + {"SUN", "Universal Xport", "*", BLIST_NO_ULD_ATTACH}, + {"DELL", "Universal Xport", "*", BLIST_NO_ULD_ATTACH}, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-172-usb-misc-onboard-hub-add-support-for-Microchip-.patch b/patches.kernel.org/6.2.9-172-usb-misc-onboard-hub-add-support-for-Microchip-.patch new file mode 100644 index 0000000..04438ac --- /dev/null +++ b/patches.kernel.org/6.2.9-172-usb-misc-onboard-hub-add-support-for-Microchip-.patch @@ -0,0 +1,53 @@ +From: Alexander Stein +Date: Thu, 23 Feb 2023 08:39:20 +0100 +Subject: [PATCH] usb: misc: onboard-hub: add support for Microchip USB2517 USB + 2.0 hub +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: f7c13cb48e85538709850589b496c4ddb3d3898e + +commit f7c13cb48e85538709850589b496c4ddb3d3898e upstream. + +Add support for Microchip USB2517 USB 2.0 hub to the onboard usb hub +driver. Adopt the generic usb-device compatible ("usbVID,PID"). +This hub has the same reset timings as USB2514, so reuse that one. +There is also an USB2517I which just has industrial temperature range. + +Signed-off-by: Alexander Stein +Cc: stable +Acked-by: Matthias Kaehlcke +Link: https://lore.kernel.org/r/20230223073920.2912298-1-alexander.stein@ew.tq-group.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/misc/onboard_usb_hub.c | 1 + + drivers/usb/misc/onboard_usb_hub.h | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/usb/misc/onboard_usb_hub.c b/drivers/usb/misc/onboard_usb_hub.c +index 969c4c4f..87df2742 100644 +--- a/drivers/usb/misc/onboard_usb_hub.c ++++ b/drivers/usb/misc/onboard_usb_hub.c +@@ -408,6 +408,7 @@ static void onboard_hub_usbdev_disconnect(struct usb_device *udev) + static const struct usb_device_id onboard_hub_id_table[] = { + { USB_DEVICE(VENDOR_ID_GENESYS, 0x0608) }, /* Genesys Logic GL850G USB 2.0 */ + { USB_DEVICE(VENDOR_ID_MICROCHIP, 0x2514) }, /* USB2514B USB 2.0 */ ++ { USB_DEVICE(VENDOR_ID_MICROCHIP, 0x2517) }, /* USB2517 USB 2.0 */ + { USB_DEVICE(VENDOR_ID_REALTEK, 0x0411) }, /* RTS5411 USB 3.1 */ + { USB_DEVICE(VENDOR_ID_REALTEK, 0x5411) }, /* RTS5411 USB 2.1 */ + { USB_DEVICE(VENDOR_ID_REALTEK, 0x0414) }, /* RTS5414 USB 3.2 */ +diff --git a/drivers/usb/misc/onboard_usb_hub.h b/drivers/usb/misc/onboard_usb_hub.h +index 62129a6a..a97b0594 100644 +--- a/drivers/usb/misc/onboard_usb_hub.h ++++ b/drivers/usb/misc/onboard_usb_hub.h +@@ -28,6 +28,7 @@ static const struct onboard_hub_pdata genesys_gl850g_data = { + + static const struct of_device_id onboard_hub_match[] = { + { .compatible = "usb424,2514", .data = µchip_usb424_data, }, ++ { .compatible = "usb424,2517", .data = µchip_usb424_data, }, + { .compatible = "usb451,8140", .data = &ti_tusb8041_data, }, + { .compatible = "usb451,8142", .data = &ti_tusb8041_data, }, + { .compatible = "usb5e3,608", .data = &genesys_gl850g_data, }, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-173-usb-dwc2-fix-a-race-don-t-power-off-on-phy-for-.patch b/patches.kernel.org/6.2.9-173-usb-dwc2-fix-a-race-don-t-power-off-on-phy-for-.patch new file mode 100644 index 0000000..46c7c69 --- /dev/null +++ b/patches.kernel.org/6.2.9-173-usb-dwc2-fix-a-race-don-t-power-off-on-phy-for-.patch @@ -0,0 +1,109 @@ +From: Fabrice Gasnier +Date: Wed, 15 Mar 2023 15:44:33 +0100 +Subject: [PATCH] usb: dwc2: fix a race, don't power off/on phy for dual-role + mode +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 5021383242ada277a38bd052a4c12ed4707faccb + +commit 5021383242ada277a38bd052a4c12ed4707faccb upstream. + +When in dual role mode (dr_mode == USB_DR_MODE_OTG), platform probe +successively basically calls: +- dwc2_gadget_init() +- dwc2_hcd_init() +- dwc2_lowlevel_hw_disable() since recent change [1] +- usb_add_gadget_udc() + +The PHYs (and so the clocks it may provide) shouldn't be disabled for all +SoCs, in OTG mode, as the HCD part has been initialized. + +On STM32 this creates some weird race condition upon boot, when: +- initially attached as a device, to a HOST +- and there is a gadget script invoked to setup the device part. +Below issue becomes systematic, as long as the gadget script isn't +started by userland: the hardware PHYs (and so the clocks provided by the +PHYs) remains disabled. +It ends up in having an endless interrupt storm, before the watchdog +resets the platform. + +[ 16.924163] dwc2 49000000.usb-otg: EPs: 9, dedicated fifos, 952 entries in SPRAM +[ 16.962704] dwc2 49000000.usb-otg: DWC OTG Controller +[ 16.966488] dwc2 49000000.usb-otg: new USB bus registered, assigned bus number 2 +[ 16.974051] dwc2 49000000.usb-otg: irq 77, io mem 0x49000000 +[ 17.032170] hub 2-0:1.0: USB hub found +[ 17.042299] hub 2-0:1.0: 1 port detected +[ 17.175408] dwc2 49000000.usb-otg: Mode Mismatch Interrupt: currently in Host mode +[ 17.181741] dwc2 49000000.usb-otg: Mode Mismatch Interrupt: currently in Host mode +[ 17.189303] dwc2 49000000.usb-otg: Mode Mismatch Interrupt: currently in Host mode +... + +The host part is also not functional, until the gadget part is configured. + +The HW may only be disabled for peripheral mode (original init), e.g. +dr_mode == USB_DR_MODE_PERIPHERAL, until the gadget driver initializes. + +But when in USB_DR_MODE_OTG, the HW should remain enabled, as the HCD part +is able to run, while the gadget part isn't necessarily configured. + +I don't fully get the of purpose the original change, that claims disabling +the hardware is missing. It creates conditions on SOCs using the PHY +initialization to be completely non working in OTG mode. Original +change [1] should be reworked to be platform specific. + +[1] https://lore.kernel.org/r/20221206-dwc2-gadget-dual-role-v1-2-36515e1092cd@theobroma-systems.com + +Fixes: ade23d7b7ec5 ("usb: dwc2: power on/off phy for peripheral mode in dual-role mode") +Cc: stable +Signed-off-by: Fabrice Gasnier +Reviewed-by: Quentin Schulz +Tested-by: Quentin Schulz +Link: https://lore.kernel.org/r/20230315144433.3095859-1-fabrice.gasnier@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/dwc2/gadget.c | 6 ++---- + drivers/usb/dwc2/platform.c | 3 +-- + 2 files changed, 3 insertions(+), 6 deletions(-) + +diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c +index 62fa6378..8b15742d 100644 +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -4549,8 +4549,7 @@ static int dwc2_hsotg_udc_start(struct usb_gadget *gadget, + hsotg->gadget.dev.of_node = hsotg->dev->of_node; + hsotg->gadget.speed = USB_SPEED_UNKNOWN; + +- if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL || +- (hsotg->dr_mode == USB_DR_MODE_OTG && dwc2_is_device_mode(hsotg))) { ++ if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL) { + ret = dwc2_lowlevel_hw_enable(hsotg); + if (ret) + goto err; +@@ -4612,8 +4611,7 @@ static int dwc2_hsotg_udc_stop(struct usb_gadget *gadget) + if (!IS_ERR_OR_NULL(hsotg->uphy)) + otg_set_peripheral(hsotg->uphy->otg, NULL); + +- if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL || +- (hsotg->dr_mode == USB_DR_MODE_OTG && dwc2_is_device_mode(hsotg))) ++ if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL) + dwc2_lowlevel_hw_disable(hsotg); + + return 0; +diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c +index 23ef7599..262c13b6 100644 +--- a/drivers/usb/dwc2/platform.c ++++ b/drivers/usb/dwc2/platform.c +@@ -576,8 +576,7 @@ static int dwc2_driver_probe(struct platform_device *dev) + dwc2_debugfs_init(hsotg); + + /* Gadget code manages lowlevel hw on its own */ +- if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL || +- (hsotg->dr_mode == USB_DR_MODE_OTG && dwc2_is_device_mode(hsotg))) ++ if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL) + dwc2_lowlevel_hw_disable(hsotg); + + #if IS_ENABLED(CONFIG_USB_DWC2_PERIPHERAL) || \ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-174-usb-dwc2-drd-fix-inconsistent-mode-if-role-swit.patch b/patches.kernel.org/6.2.9-174-usb-dwc2-drd-fix-inconsistent-mode-if-role-swit.patch new file mode 100644 index 0000000..1419da7 --- /dev/null +++ b/patches.kernel.org/6.2.9-174-usb-dwc2-drd-fix-inconsistent-mode-if-role-swit.patch @@ -0,0 +1,62 @@ +From: Ziyang Huang +Date: Tue, 21 Feb 2023 18:30:04 +0800 +Subject: [PATCH] usb: dwc2: drd: fix inconsistent mode if + role-switch-default-mode="host" +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 82f5332d3b9872ab5b287e85c57b76d8bb640cd1 + +commit 82f5332d3b9872ab5b287e85c57b76d8bb640cd1 upstream. + +Some boards might use USB-A female connector for USB ports, however, +the port could be connected to a dual-mode USB controller, making it +also behaves as a peripheral device if male-to-male cable is connected. + +In this case, the dts looks like this: + + &usb0 { + status = "okay"; + dr_mode = "otg"; + usb-role-switch; + role-switch-default-mode = "host"; + }; + +After boot, dwc2_ovr_init() sets GOTGCTL to GOTGCTL_AVALOVAL and call +dwc2_force_mode() with parameter host=false, which causes inconsistent +mode - The hardware is in peripheral mode while the kernel status is +in host mode. + +What we can do now is to call dwc2_drd_role_sw_set() to switch to +device mode, and everything should work just fine now, even switching +back to none(default) mode afterwards. + +Fixes: e14acb876985 ("usb: dwc2: drd: add role-switch-default-node support") +Cc: stable +Signed-off-by: Ziyang Huang +Tested-by: Fabrice Gasnier +Acked-by: Minas Harutyunyan +Reviewed-by: Amelie Delaunay +Link: https://lore.kernel.org/r/SG2PR01MB204837BF68EDB0E343D2A375C9A59@SG2PR01MB2048.apcprd01.prod.exchangelabs.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/dwc2/drd.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc2/drd.c b/drivers/usb/dwc2/drd.c +index d8d6493b..a8605b02 100644 +--- a/drivers/usb/dwc2/drd.c ++++ b/drivers/usb/dwc2/drd.c +@@ -35,7 +35,8 @@ static void dwc2_ovr_init(struct dwc2_hsotg *hsotg) + + spin_unlock_irqrestore(&hsotg->lock, flags); + +- dwc2_force_mode(hsotg, (hsotg->dr_mode == USB_DR_MODE_HOST)); ++ dwc2_force_mode(hsotg, (hsotg->dr_mode == USB_DR_MODE_HOST) || ++ (hsotg->role_sw_default_mode == USB_DR_MODE_HOST)); + } + + static int dwc2_ovr_avalid(struct dwc2_hsotg *hsotg, bool valid) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-175-usb-dwc2-fix-a-devres-leak-in-hw_enable-upon-su.patch b/patches.kernel.org/6.2.9-175-usb-dwc2-fix-a-devres-leak-in-hw_enable-upon-su.patch new file mode 100644 index 0000000..398e941 --- /dev/null +++ b/patches.kernel.org/6.2.9-175-usb-dwc2-fix-a-devres-leak-in-hw_enable-upon-su.patch @@ -0,0 +1,106 @@ +From: Fabrice Gasnier +Date: Thu, 16 Mar 2023 09:41:27 +0100 +Subject: [PATCH] usb: dwc2: fix a devres leak in hw_enable upon suspend resume +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: f747313249b74f323ddf841a9c8db14d989f296a + +commit f747313249b74f323ddf841a9c8db14d989f296a upstream. + +Each time the platform goes to low power, PM suspend / resume routines +call: __dwc2_lowlevel_hw_enable -> devm_add_action_or_reset(). +This adds a new devres each time. +This may also happen at runtime, as dwc2_lowlevel_hw_enable() can be +called from udc_start(). + +This can be seen with tracing: +- echo 1 > /sys/kernel/debug/tracing/events/dev/devres_log/enable +- go to low power +- cat /sys/kernel/debug/tracing/trace + +A new "ADD" entry is found upon each low power cycle: +... devres_log: 49000000.usb-otg ADD 82a13bba devm_action_release (8 bytes) +... devres_log: 49000000.usb-otg ADD 49889daf devm_action_release (8 bytes) +... + +A second issue is addressed here: +- regulator_bulk_enable() is called upon each PM cycle (suspend/resume). +- regulator_bulk_disable() never gets called. + +So the reference count for these regulators constantly increase, by one +upon each low power cycle, due to missing regulator_bulk_disable() call +in __dwc2_lowlevel_hw_disable(). + +The original fix that introduced the devm_add_action_or_reset() call, +fixed an issue during probe, that happens due to other errors in +dwc2_driver_probe() -> dwc2_core_reset(). Then the probe fails without +disabling regulators, when dr_mode == USB_DR_MODE_PERIPHERAL. + +Rather fix the error path: disable all the low level hardware in the +error path, by using the "hsotg->ll_hw_enabled" flag. Checking dr_mode +has been introduced to avoid a dual call to dwc2_lowlevel_hw_disable(). +"ll_hw_enabled" should achieve the same (and is used currently in the +remove() routine). + +Fixes: 54c196060510 ("usb: dwc2: Always disable regulators on driver teardown") +Fixes: 33a06f1300a7 ("usb: dwc2: Fix error path in gadget registration") +Cc: stable +Signed-off-by: Fabrice Gasnier +Link: https://lore.kernel.org/r/20230316084127.126084-1-fabrice.gasnier@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/dwc2/platform.c | 16 ++-------------- + 1 file changed, 2 insertions(+), 14 deletions(-) + +diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c +index 262c13b6..d1589ba7 100644 +--- a/drivers/usb/dwc2/platform.c ++++ b/drivers/usb/dwc2/platform.c +@@ -91,13 +91,6 @@ static int dwc2_get_dr_mode(struct dwc2_hsotg *hsotg) + return 0; + } + +-static void __dwc2_disable_regulators(void *data) +-{ +- struct dwc2_hsotg *hsotg = data; +- +- regulator_bulk_disable(ARRAY_SIZE(hsotg->supplies), hsotg->supplies); +-} +- + static int __dwc2_lowlevel_hw_enable(struct dwc2_hsotg *hsotg) + { + struct platform_device *pdev = to_platform_device(hsotg->dev); +@@ -108,11 +101,6 @@ static int __dwc2_lowlevel_hw_enable(struct dwc2_hsotg *hsotg) + if (ret) + return ret; + +- ret = devm_add_action_or_reset(&pdev->dev, +- __dwc2_disable_regulators, hsotg); +- if (ret) +- return ret; +- + if (hsotg->clk) { + ret = clk_prepare_enable(hsotg->clk); + if (ret) +@@ -168,7 +156,7 @@ static int __dwc2_lowlevel_hw_disable(struct dwc2_hsotg *hsotg) + if (hsotg->clk) + clk_disable_unprepare(hsotg->clk); + +- return 0; ++ return regulator_bulk_disable(ARRAY_SIZE(hsotg->supplies), hsotg->supplies); + } + + /** +@@ -607,7 +595,7 @@ static int dwc2_driver_probe(struct platform_device *dev) + if (hsotg->params.activate_stm_id_vb_detection) + regulator_disable(hsotg->usb33d); + error: +- if (hsotg->dr_mode != USB_DR_MODE_PERIPHERAL) ++ if (hsotg->ll_hw_enabled) + dwc2_lowlevel_hw_disable(hsotg); + return retval; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-176-block-io_uring-pass-in-issue_flags-for-uring_cm.patch b/patches.kernel.org/6.2.9-176-block-io_uring-pass-in-issue_flags-for-uring_cm.patch new file mode 100644 index 0000000..675cc58 --- /dev/null +++ b/patches.kernel.org/6.2.9-176-block-io_uring-pass-in-issue_flags-for-uring_cm.patch @@ -0,0 +1,282 @@ +From: Jens Axboe +Date: Mon, 20 Mar 2023 20:01:25 -0600 +Subject: [PATCH] block/io_uring: pass in issue_flags for uring_cmd task_work + handling +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 9d2789ac9d60c049d26ef6d3005d9c94c5a559e9 + +commit 9d2789ac9d60c049d26ef6d3005d9c94c5a559e9 upstream. + +io_uring_cmd_done() currently assumes that the uring_lock is held +when invoked, and while it generally is, this is not guaranteed. +Pass in the issue_flags associated with it, so that we have +IO_URING_F_UNLOCKED available to be able to lock the CQ ring +appropriately when completing events. + +Cc: stable@vger.kernel.org +Fixes: ee692a21e9bf ("fs,io_uring: add infrastructure for uring-cmd") +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/block/ublk_drv.c | 31 ++++++++++++++++++------------- + drivers/nvme/host/ioctl.c | 14 ++++++++------ + include/linux/io_uring.h | 11 ++++++----- + io_uring/uring_cmd.c | 10 ++++++---- + 4 files changed, 38 insertions(+), 28 deletions(-) + +diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c +index 4aec9be0..22a790d5 100644 +--- a/drivers/block/ublk_drv.c ++++ b/drivers/block/ublk_drv.c +@@ -656,7 +656,8 @@ static void __ublk_fail_req(struct ublk_queue *ubq, struct ublk_io *io, + } + } + +-static void ubq_complete_io_cmd(struct ublk_io *io, int res) ++static void ubq_complete_io_cmd(struct ublk_io *io, int res, ++ unsigned issue_flags) + { + /* mark this cmd owned by ublksrv */ + io->flags |= UBLK_IO_FLAG_OWNED_BY_SRV; +@@ -668,7 +669,7 @@ static void ubq_complete_io_cmd(struct ublk_io *io, int res) + io->flags &= ~UBLK_IO_FLAG_ACTIVE; + + /* tell ublksrv one io request is coming */ +- io_uring_cmd_done(io->cmd, res, 0); ++ io_uring_cmd_done(io->cmd, res, 0, issue_flags); + } + + #define UBLK_REQUEUE_DELAY_MS 3 +@@ -685,7 +686,8 @@ static inline void __ublk_abort_rq(struct ublk_queue *ubq, + mod_delayed_work(system_wq, &ubq->dev->monitor_work, 0); + } + +-static inline void __ublk_rq_task_work(struct request *req) ++static inline void __ublk_rq_task_work(struct request *req, ++ unsigned issue_flags) + { + struct ublk_queue *ubq = req->mq_hctx->driver_data; + int tag = req->tag; +@@ -723,7 +725,7 @@ static inline void __ublk_rq_task_work(struct request *req) + pr_devel("%s: need get data. op %d, qid %d tag %d io_flags %x\n", + __func__, io->cmd->cmd_op, ubq->q_id, + req->tag, io->flags); +- ubq_complete_io_cmd(io, UBLK_IO_RES_NEED_GET_DATA); ++ ubq_complete_io_cmd(io, UBLK_IO_RES_NEED_GET_DATA, issue_flags); + return; + } + /* +@@ -761,17 +763,18 @@ static inline void __ublk_rq_task_work(struct request *req) + mapped_bytes >> 9; + } + +- ubq_complete_io_cmd(io, UBLK_IO_RES_OK); ++ ubq_complete_io_cmd(io, UBLK_IO_RES_OK, issue_flags); + } + +-static inline void ublk_forward_io_cmds(struct ublk_queue *ubq) ++static inline void ublk_forward_io_cmds(struct ublk_queue *ubq, ++ unsigned issue_flags) + { + struct llist_node *io_cmds = llist_del_all(&ubq->io_cmds); + struct ublk_rq_data *data, *tmp; + + io_cmds = llist_reverse_order(io_cmds); + llist_for_each_entry_safe(data, tmp, io_cmds, node) +- __ublk_rq_task_work(blk_mq_rq_from_pdu(data)); ++ __ublk_rq_task_work(blk_mq_rq_from_pdu(data), issue_flags); + } + + static inline void ublk_abort_io_cmds(struct ublk_queue *ubq) +@@ -783,12 +786,12 @@ static inline void ublk_abort_io_cmds(struct ublk_queue *ubq) + __ublk_abort_rq(ubq, blk_mq_rq_from_pdu(data)); + } + +-static void ublk_rq_task_work_cb(struct io_uring_cmd *cmd) ++static void ublk_rq_task_work_cb(struct io_uring_cmd *cmd, unsigned issue_flags) + { + struct ublk_uring_cmd_pdu *pdu = ublk_get_uring_cmd_pdu(cmd); + struct ublk_queue *ubq = pdu->ubq; + +- ublk_forward_io_cmds(ubq); ++ ublk_forward_io_cmds(ubq, issue_flags); + } + + static void ublk_rq_task_work_fn(struct callback_head *work) +@@ -797,8 +800,9 @@ static void ublk_rq_task_work_fn(struct callback_head *work) + struct ublk_rq_data, work); + struct request *req = blk_mq_rq_from_pdu(data); + struct ublk_queue *ubq = req->mq_hctx->driver_data; ++ unsigned issue_flags = IO_URING_F_UNLOCKED; + +- ublk_forward_io_cmds(ubq); ++ ublk_forward_io_cmds(ubq, issue_flags); + } + + static void ublk_queue_cmd(struct ublk_queue *ubq, struct request *rq) +@@ -1052,7 +1056,8 @@ static void ublk_cancel_queue(struct ublk_queue *ubq) + struct ublk_io *io = &ubq->ios[i]; + + if (io->flags & UBLK_IO_FLAG_ACTIVE) +- io_uring_cmd_done(io->cmd, UBLK_IO_RES_ABORT, 0); ++ io_uring_cmd_done(io->cmd, UBLK_IO_RES_ABORT, 0, ++ IO_URING_F_UNLOCKED); + } + + /* all io commands are canceled */ +@@ -1295,7 +1300,7 @@ static int ublk_ch_uring_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags) + return -EIOCBQUEUED; + + out: +- io_uring_cmd_done(cmd, ret, 0); ++ io_uring_cmd_done(cmd, ret, 0, issue_flags); + pr_devel("%s: complete: cmd op %d, tag %d ret %x io_flags %x\n", + __func__, cmd_op, tag, ret, io->flags); + return -EIOCBQUEUED; +@@ -2053,7 +2058,7 @@ static int ublk_ctrl_uring_cmd(struct io_uring_cmd *cmd, + break; + } + out: +- io_uring_cmd_done(cmd, ret, 0); ++ io_uring_cmd_done(cmd, ret, 0, issue_flags); + pr_devel("%s: cmd done ret %d cmd_op %x, dev id %d qid %d\n", + __func__, ret, cmd->cmd_op, header->dev_id, header->queue_id); + return -EIOCBQUEUED; +diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c +index 06f52db3..3a6f41a4 100644 +--- a/drivers/nvme/host/ioctl.c ++++ b/drivers/nvme/host/ioctl.c +@@ -463,7 +463,8 @@ static inline struct nvme_uring_cmd_pdu *nvme_uring_cmd_pdu( + return (struct nvme_uring_cmd_pdu *)&ioucmd->pdu; + } + +-static void nvme_uring_task_meta_cb(struct io_uring_cmd *ioucmd) ++static void nvme_uring_task_meta_cb(struct io_uring_cmd *ioucmd, ++ unsigned issue_flags) + { + struct nvme_uring_cmd_pdu *pdu = nvme_uring_cmd_pdu(ioucmd); + struct request *req = pdu->req; +@@ -484,17 +485,18 @@ static void nvme_uring_task_meta_cb(struct io_uring_cmd *ioucmd) + blk_rq_unmap_user(req->bio); + blk_mq_free_request(req); + +- io_uring_cmd_done(ioucmd, status, result); ++ io_uring_cmd_done(ioucmd, status, result, issue_flags); + } + +-static void nvme_uring_task_cb(struct io_uring_cmd *ioucmd) ++static void nvme_uring_task_cb(struct io_uring_cmd *ioucmd, ++ unsigned issue_flags) + { + struct nvme_uring_cmd_pdu *pdu = nvme_uring_cmd_pdu(ioucmd); + + if (pdu->bio) + blk_rq_unmap_user(pdu->bio); + +- io_uring_cmd_done(ioucmd, pdu->nvme_status, pdu->u.result); ++ io_uring_cmd_done(ioucmd, pdu->nvme_status, pdu->u.result, issue_flags); + } + + static enum rq_end_io_ret nvme_uring_cmd_end_io(struct request *req, +@@ -516,7 +518,7 @@ static enum rq_end_io_ret nvme_uring_cmd_end_io(struct request *req, + * Otherwise, move the completion to task work. + */ + if (cookie != NULL && blk_rq_is_poll(req)) +- nvme_uring_task_cb(ioucmd); ++ nvme_uring_task_cb(ioucmd, IO_URING_F_UNLOCKED); + else + io_uring_cmd_complete_in_task(ioucmd, nvme_uring_task_cb); + +@@ -538,7 +540,7 @@ static enum rq_end_io_ret nvme_uring_cmd_end_io_meta(struct request *req, + * Otherwise, move the completion to task work. + */ + if (cookie != NULL && blk_rq_is_poll(req)) +- nvme_uring_task_meta_cb(ioucmd); ++ nvme_uring_task_meta_cb(ioucmd, IO_URING_F_UNLOCKED); + else + io_uring_cmd_complete_in_task(ioucmd, nvme_uring_task_meta_cb); + +diff --git a/include/linux/io_uring.h b/include/linux/io_uring.h +index 934e5dd4..35b9328c 100644 +--- a/include/linux/io_uring.h ++++ b/include/linux/io_uring.h +@@ -27,7 +27,7 @@ struct io_uring_cmd { + const void *cmd; + union { + /* callback to defer completions to task context */ +- void (*task_work_cb)(struct io_uring_cmd *cmd); ++ void (*task_work_cb)(struct io_uring_cmd *cmd, unsigned); + /* used for polled completion */ + void *cookie; + }; +@@ -39,9 +39,10 @@ struct io_uring_cmd { + #if defined(CONFIG_IO_URING) + int io_uring_cmd_import_fixed(u64 ubuf, unsigned long len, int rw, + struct iov_iter *iter, void *ioucmd); +-void io_uring_cmd_done(struct io_uring_cmd *cmd, ssize_t ret, ssize_t res2); ++void io_uring_cmd_done(struct io_uring_cmd *cmd, ssize_t ret, ssize_t res2, ++ unsigned issue_flags); + void io_uring_cmd_complete_in_task(struct io_uring_cmd *ioucmd, +- void (*task_work_cb)(struct io_uring_cmd *)); ++ void (*task_work_cb)(struct io_uring_cmd *, unsigned)); + struct sock *io_uring_get_socket(struct file *file); + void __io_uring_cancel(bool cancel_all); + void __io_uring_free(struct task_struct *tsk); +@@ -72,11 +73,11 @@ static inline int io_uring_cmd_import_fixed(u64 ubuf, unsigned long len, int rw, + return -EOPNOTSUPP; + } + static inline void io_uring_cmd_done(struct io_uring_cmd *cmd, ssize_t ret, +- ssize_t ret2) ++ ssize_t ret2, unsigned issue_flags) + { + } + static inline void io_uring_cmd_complete_in_task(struct io_uring_cmd *ioucmd, +- void (*task_work_cb)(struct io_uring_cmd *)) ++ void (*task_work_cb)(struct io_uring_cmd *, unsigned)) + { + } + static inline struct sock *io_uring_get_socket(struct file *file) +diff --git a/io_uring/uring_cmd.c b/io_uring/uring_cmd.c +index 2e4c4830..9a1dee57 100644 +--- a/io_uring/uring_cmd.c ++++ b/io_uring/uring_cmd.c +@@ -15,12 +15,13 @@ + static void io_uring_cmd_work(struct io_kiocb *req, bool *locked) + { + struct io_uring_cmd *ioucmd = io_kiocb_to_cmd(req, struct io_uring_cmd); ++ unsigned issue_flags = *locked ? 0 : IO_URING_F_UNLOCKED; + +- ioucmd->task_work_cb(ioucmd); ++ ioucmd->task_work_cb(ioucmd, issue_flags); + } + + void io_uring_cmd_complete_in_task(struct io_uring_cmd *ioucmd, +- void (*task_work_cb)(struct io_uring_cmd *)) ++ void (*task_work_cb)(struct io_uring_cmd *, unsigned)) + { + struct io_kiocb *req = cmd_to_io_kiocb(ioucmd); + +@@ -42,7 +43,8 @@ static inline void io_req_set_cqe32_extra(struct io_kiocb *req, + * Called by consumers of io_uring_cmd, if they originally returned + * -EIOCBQUEUED upon receiving the command. + */ +-void io_uring_cmd_done(struct io_uring_cmd *ioucmd, ssize_t ret, ssize_t res2) ++void io_uring_cmd_done(struct io_uring_cmd *ioucmd, ssize_t ret, ssize_t res2, ++ unsigned issue_flags) + { + struct io_kiocb *req = cmd_to_io_kiocb(ioucmd); + +@@ -56,7 +58,7 @@ void io_uring_cmd_done(struct io_uring_cmd *ioucmd, ssize_t ret, ssize_t res2) + /* order with io_iopoll_req_issued() checking ->iopoll_complete */ + smp_store_release(&req->iopoll_completed, 1); + else +- io_req_complete_post(req, 0); ++ io_req_complete_post(req, issue_flags); + } + EXPORT_SYMBOL_GPL(io_uring_cmd_done); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-177-usb-gadget-u_audio-don-t-let-userspace-block-dr.patch b/patches.kernel.org/6.2.9-177-usb-gadget-u_audio-don-t-let-userspace-block-dr.patch new file mode 100644 index 0000000..fb00ec3 --- /dev/null +++ b/patches.kernel.org/6.2.9-177-usb-gadget-u_audio-don-t-let-userspace-block-dr.patch @@ -0,0 +1,78 @@ +From: =?UTF-8?q?Alvin=20=C5=A0ipraga?= +Date: Thu, 2 Mar 2023 17:36:47 +0100 +Subject: [PATCH] usb: gadget: u_audio: don't let userspace block driver unbind +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 6c67ed9ad9b83e453e808f9b31a931a20a25629b + +commit 6c67ed9ad9b83e453e808f9b31a931a20a25629b upstream. + +In the unbind callback for f_uac1 and f_uac2, a call to snd_card_free() +via g_audio_cleanup() will disconnect the card and then wait for all +resources to be released, which happens when the refcount falls to zero. +Since userspace can keep the refcount incremented by not closing the +relevant file descriptor, the call to unbind may block indefinitely. +This can cause a deadlock during reboot, as evidenced by the following +blocked task observed on my machine: + + task:reboot state:D stack:0 pid:2827 ppid:569 flags:0x0000000c + Call trace: + __switch_to+0xc8/0x140 + __schedule+0x2f0/0x7c0 + schedule+0x60/0xd0 + schedule_timeout+0x180/0x1d4 + wait_for_completion+0x78/0x180 + snd_card_free+0x90/0xa0 + g_audio_cleanup+0x2c/0x64 + afunc_unbind+0x28/0x60 + ... + kernel_restart+0x4c/0xac + __do_sys_reboot+0xcc/0x1ec + __arm64_sys_reboot+0x28/0x30 + invoke_syscall+0x4c/0x110 + ... + +The issue can also be observed by opening the card with arecord and +then stopping the process through the shell before unbinding: + + # arecord -D hw:UAC2Gadget -f S32_LE -c 2 -r 48000 /dev/null + Recording WAVE '/dev/null' : Signed 32 bit Little Endian, Rate 48000 Hz, Stereo + ^Z[1]+ Stopped arecord -D hw:UAC2Gadget -f S32_LE -c 2 -r 48000 /dev/null + # echo gadget.0 > /sys/bus/gadget/drivers/configfs-gadget/unbind + (observe that the unbind command never finishes) + +Fix the problem by using snd_card_free_when_closed() instead, which will +still disconnect the card as desired, but defer the task of freeing the +resources to the core once userspace closes its file descriptor. + +Fixes: 132fcb460839 ("usb: gadget: Add Audio Class 2.0 Driver") +Cc: stable@vger.kernel.org +Signed-off-by: Alvin Šipraga +Reviewed-by: Ruslan Bilovol +Reviewed-by: John Keeping +Link: https://lore.kernel.org/r/20230302163648.3349669-1-alvin@pqrs.dk +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/gadget/function/u_audio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c +index c1f62e91..4a42574b 100644 +--- a/drivers/usb/gadget/function/u_audio.c ++++ b/drivers/usb/gadget/function/u_audio.c +@@ -1422,7 +1422,7 @@ void g_audio_cleanup(struct g_audio *g_audio) + uac = g_audio->uac; + card = uac->card; + if (card) +- snd_card_free(card); ++ snd_card_free_when_closed(card); + + kfree(uac->p_prm.reqs); + kfree(uac->c_prm.reqs); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-178-btrfs-zoned-fix-btrfs_can_activate_zone-to-supp.patch b/patches.kernel.org/6.2.9-178-btrfs-zoned-fix-btrfs_can_activate_zone-to-supp.patch new file mode 100644 index 0000000..b0bd9fe --- /dev/null +++ b/patches.kernel.org/6.2.9-178-btrfs-zoned-fix-btrfs_can_activate_zone-to-supp.patch @@ -0,0 +1,58 @@ +From: Naohiro Aota +Date: Mon, 13 Mar 2023 16:29:49 +0900 +Subject: [PATCH] btrfs: zoned: fix btrfs_can_activate_zone() to support DUP + profile +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 9e1cdf0c354e46e428c0e0cab008abbe81b6013d + +commit 9e1cdf0c354e46e428c0e0cab008abbe81b6013d upstream. + +btrfs_can_activate_zone() returns true if at least one device has one zone +available for activation. This is OK for the single profile, but not OK for +DUP profile. We need two zones to create a DUP block group. Fix it by +properly handling the case with the profile flags. + +Fixes: 265f7237dd25 ("btrfs: zoned: allow DUP on meta-data block groups") +CC: stable@vger.kernel.org # 6.1+ +Reviewed-by: Johannes Thumshirn +Signed-off-by: Naohiro Aota +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/btrfs/zoned.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c +index 1f503e8e..f3b7d8ae 100644 +--- a/fs/btrfs/zoned.c ++++ b/fs/btrfs/zoned.c +@@ -2100,11 +2100,21 @@ bool btrfs_can_activate_zone(struct btrfs_fs_devices *fs_devices, u64 flags) + if (!device->bdev) + continue; + +- if (!zinfo->max_active_zones || +- atomic_read(&zinfo->active_zones_left)) { ++ if (!zinfo->max_active_zones) { + ret = true; + break; + } ++ ++ switch (flags & BTRFS_BLOCK_GROUP_PROFILE_MASK) { ++ case 0: /* single */ ++ ret = (atomic_read(&zinfo->active_zones_left) >= 1); ++ break; ++ case BTRFS_BLOCK_GROUP_DUP: ++ ret = (atomic_read(&zinfo->active_zones_left) >= 2); ++ break; ++ } ++ if (ret) ++ break; + } + mutex_unlock(&fs_info->chunk_mutex); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-179-Bluetooth-Fix-race-condition-in-hci_cmd_sync_cl.patch b/patches.kernel.org/6.2.9-179-Bluetooth-Fix-race-condition-in-hci_cmd_sync_cl.patch new file mode 100644 index 0000000..db58238 --- /dev/null +++ b/patches.kernel.org/6.2.9-179-Bluetooth-Fix-race-condition-in-hci_cmd_sync_cl.patch @@ -0,0 +1,105 @@ +From: Min Li +Date: Sat, 4 Mar 2023 21:50:35 +0800 +Subject: [PATCH] Bluetooth: Fix race condition in hci_cmd_sync_clear +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 1c66bee492a5fe00ae3fe890bb693bfc99f994c6 + +commit 1c66bee492a5fe00ae3fe890bb693bfc99f994c6 upstream. + +There is a potential race condition in hci_cmd_sync_work and +hci_cmd_sync_clear, and could lead to use-after-free. For instance, +hci_cmd_sync_work is added to the 'req_workqueue' after cancel_work_sync +The entry of 'cmd_sync_work_list' may be freed in hci_cmd_sync_clear, and +causing kernel panic when it is used in 'hci_cmd_sync_work'. + +Here's the call trace: + +dump_stack_lvl+0x49/0x63 +print_report.cold+0x5e/0x5d3 +? hci_cmd_sync_work+0x282/0x320 +kasan_report+0xaa/0x120 +? hci_cmd_sync_work+0x282/0x320 +__asan_report_load8_noabort+0x14/0x20 +hci_cmd_sync_work+0x282/0x320 +process_one_work+0x77b/0x11c0 +? _raw_spin_lock_irq+0x8e/0xf0 +worker_thread+0x544/0x1180 +? poll_idle+0x1e0/0x1e0 +kthread+0x285/0x320 +? process_one_work+0x11c0/0x11c0 +? kthread_complete_and_exit+0x30/0x30 +ret_from_fork+0x22/0x30 + + +Allocated by task 266: +kasan_save_stack+0x26/0x50 +__kasan_kmalloc+0xae/0xe0 +kmem_cache_alloc_trace+0x191/0x350 +hci_cmd_sync_queue+0x97/0x2b0 +hci_update_passive_scan+0x176/0x1d0 +le_conn_complete_evt+0x1b5/0x1a00 +hci_le_conn_complete_evt+0x234/0x340 +hci_le_meta_evt+0x231/0x4e0 +hci_event_packet+0x4c5/0xf00 +hci_rx_work+0x37d/0x880 +process_one_work+0x77b/0x11c0 +worker_thread+0x544/0x1180 +kthread+0x285/0x320 +ret_from_fork+0x22/0x30 + +Freed by task 269: +kasan_save_stack+0x26/0x50 +kasan_set_track+0x25/0x40 +kasan_set_free_info+0x24/0x40 +____kasan_slab_free+0x176/0x1c0 +__kasan_slab_free+0x12/0x20 +slab_free_freelist_hook+0x95/0x1a0 +kfree+0xba/0x2f0 +hci_cmd_sync_clear+0x14c/0x210 +hci_unregister_dev+0xff/0x440 +vhci_release+0x7b/0xf0 +__fput+0x1f3/0x970 +____fput+0xe/0x20 +task_work_run+0xd4/0x160 +do_exit+0x8b0/0x22a0 +do_group_exit+0xba/0x2a0 +get_signal+0x1e4a/0x25b0 +arch_do_signal_or_restart+0x93/0x1f80 +exit_to_user_mode_prepare+0xf5/0x1a0 +syscall_exit_to_user_mode+0x26/0x50 +ret_from_fork+0x15/0x30 + +Fixes: 6a98e3836fa2 ("Bluetooth: Add helper for serialized HCI command execution") +Cc: stable@vger.kernel.org +Signed-off-by: Min Li +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + net/bluetooth/hci_sync.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 9550487f..5a6aa162 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -643,6 +643,7 @@ void hci_cmd_sync_clear(struct hci_dev *hdev) + cancel_work_sync(&hdev->cmd_sync_work); + cancel_work_sync(&hdev->reenable_adv_work); + ++ mutex_lock(&hdev->cmd_sync_work_lock); + list_for_each_entry_safe(entry, tmp, &hdev->cmd_sync_work_list, list) { + if (entry->destroy) + entry->destroy(hdev, entry->data, -ECANCELED); +@@ -650,6 +651,7 @@ void hci_cmd_sync_clear(struct hci_dev *hdev) + list_del(&entry->list); + kfree(entry); + } ++ mutex_unlock(&hdev->cmd_sync_work_lock); + } + + void __hci_cmd_sync_cancel(struct hci_dev *hdev, int err) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-180-efi-sysfb_efi-Fix-DMI-quirks-not-working-for-si.patch b/patches.kernel.org/6.2.9-180-efi-sysfb_efi-Fix-DMI-quirks-not-working-for-si.patch new file mode 100644 index 0000000..62961a0 --- /dev/null +++ b/patches.kernel.org/6.2.9-180-efi-sysfb_efi-Fix-DMI-quirks-not-working-for-si.patch @@ -0,0 +1,124 @@ +From: Hans de Goede +Date: Tue, 14 Mar 2023 13:31:02 +0100 +Subject: [PATCH] efi: sysfb_efi: Fix DMI quirks not working for simpledrm +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 3615c78673c332b69aaacefbcde5937c5c706686 + +commit 3615c78673c332b69aaacefbcde5937c5c706686 upstream. + +Commit 8633ef82f101 ("drivers/firmware: consolidate EFI framebuffer setup +for all arches") moved the sysfb_apply_efi_quirks() call in sysfb_init() +from before the [sysfb_]parse_mode() call to after it. +But sysfb_apply_efi_quirks() modifies the global screen_info struct which +[sysfb_]parse_mode() parses, so doing it later is too late. + +This has broken all DMI based quirks for correcting wrong firmware efifb +settings when simpledrm is used. + +To fix this move the sysfb_apply_efi_quirks() call back to its old place +and split the new setup of the efifb_fwnode (which requires +the platform_device) into its own function and call that at +the place of the moved sysfb_apply_efi_quirks(pd) calls. + +Fixes: 8633ef82f101 ("drivers/firmware: consolidate EFI framebuffer setup for all arches") +Cc: stable@vger.kernel.org +Cc: Javier Martinez Canillas +Cc: Thomas Zimmermann +Signed-off-by: Hans de Goede +Reviewed-by: Javier Martinez Canillas +Signed-off-by: Ard Biesheuvel +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/firmware/efi/sysfb_efi.c | 5 ++++- + drivers/firmware/sysfb.c | 4 +++- + drivers/firmware/sysfb_simplefb.c | 2 +- + include/linux/sysfb.h | 9 +++++++-- + 4 files changed, 15 insertions(+), 5 deletions(-) + +diff --git a/drivers/firmware/efi/sysfb_efi.c b/drivers/firmware/efi/sysfb_efi.c +index f06fdacc..e76d6803 100644 +--- a/drivers/firmware/efi/sysfb_efi.c ++++ b/drivers/firmware/efi/sysfb_efi.c +@@ -341,7 +341,7 @@ static const struct fwnode_operations efifb_fwnode_ops = { + #ifdef CONFIG_EFI + static struct fwnode_handle efifb_fwnode; + +-__init void sysfb_apply_efi_quirks(struct platform_device *pd) ++__init void sysfb_apply_efi_quirks(void) + { + if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI || + !(screen_info.capabilities & VIDEO_CAPABILITY_SKIP_QUIRKS)) +@@ -355,7 +355,10 @@ __init void sysfb_apply_efi_quirks(struct platform_device *pd) + screen_info.lfb_height = temp; + screen_info.lfb_linelength = 4 * screen_info.lfb_width; + } ++} + ++__init void sysfb_set_efifb_fwnode(struct platform_device *pd) ++{ + if (screen_info.orig_video_isVGA == VIDEO_TYPE_EFI && IS_ENABLED(CONFIG_PCI)) { + fwnode_init(&efifb_fwnode, &efifb_fwnode_ops); + pd->dev.fwnode = &efifb_fwnode; +diff --git a/drivers/firmware/sysfb.c b/drivers/firmware/sysfb.c +index 3fd3563d..3c197db4 100644 +--- a/drivers/firmware/sysfb.c ++++ b/drivers/firmware/sysfb.c +@@ -81,6 +81,8 @@ static __init int sysfb_init(void) + if (disabled) + goto unlock_mutex; + ++ sysfb_apply_efi_quirks(); ++ + /* try to create a simple-framebuffer device */ + compatible = sysfb_parse_mode(si, &mode); + if (compatible) { +@@ -107,7 +109,7 @@ static __init int sysfb_init(void) + goto unlock_mutex; + } + +- sysfb_apply_efi_quirks(pd); ++ sysfb_set_efifb_fwnode(pd); + + ret = platform_device_add_data(pd, si, sizeof(*si)); + if (ret) +diff --git a/drivers/firmware/sysfb_simplefb.c b/drivers/firmware/sysfb_simplefb.c +index a353e27f..ca907f7e 100644 +--- a/drivers/firmware/sysfb_simplefb.c ++++ b/drivers/firmware/sysfb_simplefb.c +@@ -110,7 +110,7 @@ __init struct platform_device *sysfb_create_simplefb(const struct screen_info *s + if (!pd) + return ERR_PTR(-ENOMEM); + +- sysfb_apply_efi_quirks(pd); ++ sysfb_set_efifb_fwnode(pd); + + ret = platform_device_add_resources(pd, &res, 1); + if (ret) +diff --git a/include/linux/sysfb.h b/include/linux/sysfb.h +index 8ba8b5be..c1ef5fc6 100644 +--- a/include/linux/sysfb.h ++++ b/include/linux/sysfb.h +@@ -70,11 +70,16 @@ static inline void sysfb_disable(void) + #ifdef CONFIG_EFI + + extern struct efifb_dmi_info efifb_dmi_list[]; +-void sysfb_apply_efi_quirks(struct platform_device *pd); ++void sysfb_apply_efi_quirks(void); ++void sysfb_set_efifb_fwnode(struct platform_device *pd); + + #else /* CONFIG_EFI */ + +-static inline void sysfb_apply_efi_quirks(struct platform_device *pd) ++static inline void sysfb_apply_efi_quirks(void) ++{ ++} ++ ++static inline void sysfb_set_efifb_fwnode(struct platform_device *pd) + { + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-181-mm-slab-Fix-undefined-init_cache_node_node-for-.patch b/patches.kernel.org/6.2.9-181-mm-slab-Fix-undefined-init_cache_node_node-for-.patch new file mode 100644 index 0000000..1714fa2 --- /dev/null +++ b/patches.kernel.org/6.2.9-181-mm-slab-Fix-undefined-init_cache_node_node-for-.patch @@ -0,0 +1,56 @@ +From: Geert Uytterhoeven +Date: Tue, 21 Mar 2023 09:30:59 +0100 +Subject: [PATCH] mm/slab: Fix undefined init_cache_node_node() for NUMA and + !SMP +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 66a1c22b709178e7b823d44465d0c2e5ed7492fb + +commit 66a1c22b709178e7b823d44465d0c2e5ed7492fb upstream. + +sh/migor_defconfig: + + mm/slab.c: In function ‘slab_memory_callback’: + mm/slab.c:1127:23: error: implicit declaration of function ‘init_cache_node_node’; did you mean ‘drain_cache_node_node’? [-Werror=implicit-function-declaration] + 1127 | ret = init_cache_node_node(nid); + | ^~~~~~~~~~~~~~~~~~~~ + | drain_cache_node_node + +The #ifdef condition protecting the definition of init_cache_node_node() +no longer matches the conditions protecting the (multiple) users. + +Fix this by syncing the conditions. + +Fixes: 76af6a054da40553 ("mm/migrate: add CPU hotplug to demotion #ifdef") +Reported-by: Randy Dunlap +Link: https://lore.kernel.org/r/b5bdea22-ed2f-3187-6efe-0c72330270a4@infradead.org +Signed-off-by: Geert Uytterhoeven +Reviewed-by: John Paul Adrian Glaubitz +Acked-by: Randy Dunlap +Cc: +Signed-off-by: Vlastimil Babka +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + mm/slab.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/mm/slab.c b/mm/slab.c +index 29300fc1..ae625e76 100644 +--- a/mm/slab.c ++++ b/mm/slab.c +@@ -840,7 +840,7 @@ static int init_cache_node(struct kmem_cache *cachep, int node, gfp_t gfp) + return 0; + } + +-#if (defined(CONFIG_NUMA) && defined(CONFIG_MEMORY_HOTPLUG)) || defined(CONFIG_SMP) ++#if defined(CONFIG_NUMA) || defined(CONFIG_SMP) + /* + * Allocates and initializes node for a node on each slab cache, used for + * either memory or cpu hotplug. If memory is being hot-added, the kmem_cache_node +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-182-efi-libstub-zboot-Mark-zboot-EFI-application-as.patch b/patches.kernel.org/6.2.9-182-efi-libstub-zboot-Mark-zboot-EFI-application-as.patch new file mode 100644 index 0000000..9b72c48 --- /dev/null +++ b/patches.kernel.org/6.2.9-182-efi-libstub-zboot-Mark-zboot-EFI-application-as.patch @@ -0,0 +1,40 @@ +From: Ard Biesheuvel +Date: Fri, 10 Mar 2023 12:15:24 +0100 +Subject: [PATCH] efi/libstub: zboot: Mark zboot EFI application as NX + compatible +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: c7d9e628b8ff4d52a365a441bdacb3209ee83c81 + +commit c7d9e628b8ff4d52a365a441bdacb3209ee83c81 upstream. + +Now that the zboot loader will invoke the EFI memory attributes protocol +to remap the decompressed code and rodata as read-only/executable, we +can set the PE/COFF header flag that indicates to the firmware that the +application does not rely on writable memory being executable at the +same time. + +Cc: # v6.2+ +Signed-off-by: Ard Biesheuvel +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/firmware/efi/libstub/zboot-header.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/efi/libstub/zboot-header.S b/drivers/firmware/efi/libstub/zboot-header.S +index ec4525d4..445cb646 100644 +--- a/drivers/firmware/efi/libstub/zboot-header.S ++++ b/drivers/firmware/efi/libstub/zboot-header.S +@@ -63,7 +63,7 @@ __efistub_efi_zboot_header: + .long .Lefi_header_end - .Ldoshdr + .long 0 + .short IMAGE_SUBSYSTEM_EFI_APPLICATION +- .short 0 ++ .short IMAGE_DLL_CHARACTERISTICS_NX_COMPAT + #ifdef CONFIG_64BIT + .quad 0, 0, 0, 0 + #else +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-183-arm64-efi-Set-NX-compat-flag-in-PE-COFF-header.patch b/patches.kernel.org/6.2.9-183-arm64-efi-Set-NX-compat-flag-in-PE-COFF-header.patch new file mode 100644 index 0000000..94fd00d --- /dev/null +++ b/patches.kernel.org/6.2.9-183-arm64-efi-Set-NX-compat-flag-in-PE-COFF-header.patch @@ -0,0 +1,50 @@ +From: Ard Biesheuvel +Date: Fri, 10 Mar 2023 13:30:05 +0100 +Subject: [PATCH] arm64: efi: Set NX compat flag in PE/COFF header +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 3c66bb1918c262dd52fb4221a8d372619c5da70a + +commit 3c66bb1918c262dd52fb4221a8d372619c5da70a upstream. + +The PE/COFF header has a NX compat flag which informs the firmware that +the application does not rely on memory regions being mapped with both +executable and writable permissions at the same time. + +This is typically used by the firmware to decide whether it can set the +NX attribute on all allocations it returns, but going forward, it may be +used to enforce a policy that only permits applications with the NX flag +set to be loaded to begin wiht in some configurations, e.g., when Secure +Boot is in effect. + +Even though the arm64 version of the EFI stub may relocate the kernel +before executing it, it always did so after disabling the MMU, and so we +were always in line with what the NX compat flag conveys, we just never +bothered to set it. + +So let's set the flag now. + +Cc: +Signed-off-by: Ard Biesheuvel +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm64/kernel/efi-header.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/kernel/efi-header.S b/arch/arm64/kernel/efi-header.S +index 28d8a5dc..d731b465 100644 +--- a/arch/arm64/kernel/efi-header.S ++++ b/arch/arm64/kernel/efi-header.S +@@ -66,7 +66,7 @@ + .long .Lefi_header_end - .L_head // SizeOfHeaders + .long 0 // CheckSum + .short IMAGE_SUBSYSTEM_EFI_APPLICATION // Subsystem +- .short 0 // DllCharacteristics ++ .short IMAGE_DLL_CHARACTERISTICS_NX_COMPAT // DllCharacteristics + .quad 0 // SizeOfStackReserve + .quad 0 // SizeOfStackCommit + .quad 0 // SizeOfHeapReserve +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-184-fscrypt-destroy-keyring-after-security_sb_delet.patch b/patches.kernel.org/6.2.9-184-fscrypt-destroy-keyring-after-security_sb_delet.patch new file mode 100644 index 0000000..39b74fe --- /dev/null +++ b/patches.kernel.org/6.2.9-184-fscrypt-destroy-keyring-after-security_sb_delet.patch @@ -0,0 +1,64 @@ +From: Eric Biggers +Date: Mon, 13 Mar 2023 15:12:29 -0700 +Subject: [PATCH] fscrypt: destroy keyring after security_sb_delete() +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: ccb820dc7d2236b1af0d54ae038a27b5b6d5ae5a + +commit ccb820dc7d2236b1af0d54ae038a27b5b6d5ae5a upstream. + +fscrypt_destroy_keyring() must be called after all potentially-encrypted +inodes were evicted; otherwise it cannot safely destroy the keyring. +Since inodes that are in-use by the Landlock LSM don't get evicted until +security_sb_delete(), this means that fscrypt_destroy_keyring() must be +called *after* security_sb_delete(). + +This fixes a WARN_ON followed by a NULL dereference, only possible if +Landlock was being used on encrypted files. + +Fixes: d7e7b9af104c ("fscrypt: stop using keyrings subsystem for fscrypt_master_key") +Cc: stable@vger.kernel.org +Reported-by: syzbot+93e495f6a4f748827c88@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/00000000000044651705f6ca1e30@google.com +Reviewed-by: Christian Brauner +Link: https://lore.kernel.org/r/20230313221231.272498-2-ebiggers@kernel.org +Signed-off-by: Eric Biggers +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/super.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/fs/super.c b/fs/super.c +index cf737ec2..e35f601e 100644 +--- a/fs/super.c ++++ b/fs/super.c +@@ -476,13 +476,22 @@ void generic_shutdown_super(struct super_block *sb) + + cgroup_writeback_umount(); + +- /* evict all inodes with zero refcount */ ++ /* Evict all inodes with zero refcount. */ + evict_inodes(sb); +- /* only nonzero refcount inodes can have marks */ ++ ++ /* ++ * Clean up and evict any inodes that still have references due ++ * to fsnotify or the security policy. ++ */ + fsnotify_sb_delete(sb); +- fscrypt_destroy_keyring(sb); + security_sb_delete(sb); + ++ /* ++ * Now that all potentially-encrypted inodes have been evicted, ++ * the fscrypt keyring can be destroyed. ++ */ ++ fscrypt_destroy_keyring(sb); ++ + if (sb->s_dio_done_wq) { + destroy_workqueue(sb->s_dio_done_wq); + sb->s_dio_done_wq = NULL; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-185-fsverity-Remove-WQ_UNBOUND-from-fsverity-read-w.patch b/patches.kernel.org/6.2.9-185-fsverity-Remove-WQ_UNBOUND-from-fsverity-read-w.patch new file mode 100644 index 0000000..3804306 --- /dev/null +++ b/patches.kernel.org/6.2.9-185-fsverity-Remove-WQ_UNBOUND-from-fsverity-read-w.patch @@ -0,0 +1,68 @@ +From: Nathan Huckleberry +Date: Fri, 10 Mar 2023 11:33:25 -0800 +Subject: [PATCH] fsverity: Remove WQ_UNBOUND from fsverity read workqueue +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: f959325e6ac3f499450088b8d9c626d1177be160 + +commit f959325e6ac3f499450088b8d9c626d1177be160 upstream. + +WQ_UNBOUND causes significant scheduler latency on ARM64/Android. This +is problematic for latency sensitive workloads, like I/O +post-processing. + +Removing WQ_UNBOUND gives a 96% reduction in fsverity workqueue related +scheduler latency and improves app cold startup times by ~30ms. +WQ_UNBOUND was also removed from the dm-verity workqueue for the same +reason [1]. + +This code was tested by running Android app startup benchmarks and +measuring how long the fsverity workqueue spent in the runnable state. + +Before +Total workqueue scheduler latency: 553800us +After +Total workqueue scheduler latency: 18962us + +[1]: https://lore.kernel.org/all/20230202012348.885402-1-nhuck@google.com/ + +Signed-off-by: Nathan Huckleberry +Fixes: 8a1d0f9cacc9 ("fs-verity: add data verification hooks for ->readpages()") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230310193325.620493-1-nhuck@google.com +Signed-off-by: Eric Biggers +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/verity/verify.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/fs/verity/verify.c b/fs/verity/verify.c +index 961ba248..ffac380b 100644 +--- a/fs/verity/verify.c ++++ b/fs/verity/verify.c +@@ -269,15 +269,15 @@ EXPORT_SYMBOL_GPL(fsverity_enqueue_verify_work); + int __init fsverity_init_workqueue(void) + { + /* +- * Use an unbound workqueue to allow bios to be verified in parallel +- * even when they happen to complete on the same CPU. This sacrifices +- * locality, but it's worthwhile since hashing is CPU-intensive. ++ * Use a high-priority workqueue to prioritize verification work, which ++ * blocks reads from completing, over regular application tasks. + * +- * Also use a high-priority workqueue to prioritize verification work, +- * which blocks reads from completing, over regular application tasks. ++ * For performance reasons, don't use an unbound workqueue. Using an ++ * unbound workqueue for crypto operations causes excessive scheduler ++ * latency on ARM64. + */ + fsverity_read_workqueue = alloc_workqueue("fsverity_read_queue", +- WQ_UNBOUND | WQ_HIGHPRI, ++ WQ_HIGHPRI, + num_online_cpus()); + if (!fsverity_read_workqueue) + return -ENOMEM; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-186-lockd-set-file_lock-start-and-end-when-decoding.patch b/patches.kernel.org/6.2.9-186-lockd-set-file_lock-start-and-end-when-decoding.patch new file mode 100644 index 0000000..47513bb --- /dev/null +++ b/patches.kernel.org/6.2.9-186-lockd-set-file_lock-start-and-end-when-decoding.patch @@ -0,0 +1,106 @@ +From: Jeff Layton +Date: Tue, 14 Mar 2023 06:20:58 -0400 +Subject: [PATCH] lockd: set file_lock start and end when decoding nlm4 + testargs +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 7ff84910c66c9144cc0de9d9deed9fb84c03aff0 + +commit 7ff84910c66c9144cc0de9d9deed9fb84c03aff0 upstream. + +Commit 6930bcbfb6ce dropped the setting of the file_lock range when +decoding a nlm_lock off the wire. This causes the client side grant +callback to miss matching blocks and reject the lock, only to rerequest +it 30s later. + +Add a helper function to set the file_lock range from the start and end +values that the protocol uses, and have the nlm_lock decoder call that to +set up the file_lock args properly. + +Fixes: 6930bcbfb6ce ("lockd: detect and reject lock arguments that overflow") +Reported-by: Amir Goldstein +Signed-off-by: Jeff Layton +Tested-by: Amir Goldstein +Cc: stable@vger.kernel.org #6.0 +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/lockd/clnt4xdr.c | 9 +-------- + fs/lockd/xdr4.c | 13 ++++++++++++- + include/linux/lockd/xdr4.h | 1 + + 3 files changed, 14 insertions(+), 9 deletions(-) + +diff --git a/fs/lockd/clnt4xdr.c b/fs/lockd/clnt4xdr.c +index 7df6324c..8161667c 100644 +--- a/fs/lockd/clnt4xdr.c ++++ b/fs/lockd/clnt4xdr.c +@@ -261,7 +261,6 @@ static int decode_nlm4_holder(struct xdr_stream *xdr, struct nlm_res *result) + u32 exclusive; + int error; + __be32 *p; +- s32 end; + + memset(lock, 0, sizeof(*lock)); + locks_init_lock(fl); +@@ -285,13 +284,7 @@ static int decode_nlm4_holder(struct xdr_stream *xdr, struct nlm_res *result) + fl->fl_type = exclusive != 0 ? F_WRLCK : F_RDLCK; + p = xdr_decode_hyper(p, &l_offset); + xdr_decode_hyper(p, &l_len); +- end = l_offset + l_len - 1; +- +- fl->fl_start = (loff_t)l_offset; +- if (l_len == 0 || end < 0) +- fl->fl_end = OFFSET_MAX; +- else +- fl->fl_end = (loff_t)end; ++ nlm4svc_set_file_lock_range(fl, l_offset, l_len); + error = 0; + out: + return error; +diff --git a/fs/lockd/xdr4.c b/fs/lockd/xdr4.c +index 712fdfeb..5fcbf30c 100644 +--- a/fs/lockd/xdr4.c ++++ b/fs/lockd/xdr4.c +@@ -33,6 +33,17 @@ loff_t_to_s64(loff_t offset) + return res; + } + ++void nlm4svc_set_file_lock_range(struct file_lock *fl, u64 off, u64 len) ++{ ++ s64 end = off + len - 1; ++ ++ fl->fl_start = off; ++ if (len == 0 || end < 0) ++ fl->fl_end = OFFSET_MAX; ++ else ++ fl->fl_end = end; ++} ++ + /* + * NLM file handles are defined by specification to be a variable-length + * XDR opaque no longer than 1024 bytes. However, this implementation +@@ -80,7 +91,7 @@ svcxdr_decode_lock(struct xdr_stream *xdr, struct nlm_lock *lock) + locks_init_lock(fl); + fl->fl_flags = FL_POSIX; + fl->fl_type = F_RDLCK; +- ++ nlm4svc_set_file_lock_range(fl, lock->lock_start, lock->lock_len); + return true; + } + +diff --git a/include/linux/lockd/xdr4.h b/include/linux/lockd/xdr4.h +index 9a6b55da..72831e35 100644 +--- a/include/linux/lockd/xdr4.h ++++ b/include/linux/lockd/xdr4.h +@@ -22,6 +22,7 @@ + #define nlm4_fbig cpu_to_be32(NLM_FBIG) + #define nlm4_failed cpu_to_be32(NLM_FAILED) + ++void nlm4svc_set_file_lock_range(struct file_lock *fl, u64 off, u64 len); + bool nlm4svc_decode_void(struct svc_rqst *rqstp, struct xdr_stream *xdr); + bool nlm4svc_decode_testargs(struct svc_rqst *rqstp, struct xdr_stream *xdr); + bool nlm4svc_decode_lockargs(struct svc_rqst *rqstp, struct xdr_stream *xdr); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-187-arm64-dts-imx8mm-nitrogen-r2-fix-WM8960-clock-n.patch b/patches.kernel.org/6.2.9-187-arm64-dts-imx8mm-nitrogen-r2-fix-WM8960-clock-n.patch new file mode 100644 index 0000000..6f1fa44 --- /dev/null +++ b/patches.kernel.org/6.2.9-187-arm64-dts-imx8mm-nitrogen-r2-fix-WM8960-clock-n.patch @@ -0,0 +1,38 @@ +From: Krzysztof Kozlowski +Date: Fri, 17 Feb 2023 16:06:26 +0100 +Subject: [PATCH] arm64: dts: imx8mm-nitrogen-r2: fix WM8960 clock name +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 32f86da7c86b27ebed31c24453a0713f612e43fb + +commit 32f86da7c86b27ebed31c24453a0713f612e43fb upstream. + +The WM8960 Linux driver expects the clock to be named "mclk". Otherwise +the clock will be ignored and not prepared/enabled by the driver. + +Fixes: 40ba2eda0a7b ("arm64: dts: imx8mm-nitrogen-r2: add audio") +Cc: +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/freescale/imx8mm-nitrogen-r2.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-nitrogen-r2.dts b/arch/arm64/boot/dts/freescale/imx8mm-nitrogen-r2.dts +index 63570781..0e8f0d71 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-nitrogen-r2.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-nitrogen-r2.dts +@@ -247,7 +247,7 @@ wm8960: codec@1a { + compatible = "wlf,wm8960"; + reg = <0x1a>; + clocks = <&clk IMX8MM_CLK_SAI1_ROOT>; +- clock-names = "mclk1"; ++ clock-names = "mclk"; + wlf,shared-lrclk; + #sound-dai-cells = <0>; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-188-igb-revert-rtnl_lock-that-causes-deadlock.patch b/patches.kernel.org/6.2.9-188-igb-revert-rtnl_lock-that-causes-deadlock.patch new file mode 100644 index 0000000..7d4c0f2 --- /dev/null +++ b/patches.kernel.org/6.2.9-188-igb-revert-rtnl_lock-that-causes-deadlock.patch @@ -0,0 +1,93 @@ +From: Lin Ma +Date: Tue, 7 Mar 2023 23:29:17 +0800 +Subject: [PATCH] igb: revert rtnl_lock() that causes deadlock +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 65f69851e44d71248b952a687e44759a7abb5016 + +commit 65f69851e44d71248b952a687e44759a7abb5016 upstream. + +The commit 6faee3d4ee8b ("igb: Add lock to avoid data race") adds +rtnl_lock to eliminate a false data race shown below + + (FREE from device detaching) | (USE from netdev core) +igb_remove | igb_ndo_get_vf_config + igb_disable_sriov | vf >= adapter->vfs_allocated_count? + kfree(adapter->vf_data) | + adapter->vfs_allocated_count = 0 | + | memcpy(... adapter->vf_data[vf] + +The above race will never happen and the extra rtnl_lock causes deadlock +below + +[ 141.420169] +[ 141.420672] __schedule+0x2dd/0x840 +[ 141.421427] schedule+0x50/0xc0 +[ 141.422041] schedule_preempt_disabled+0x11/0x20 +[ 141.422678] __mutex_lock.isra.13+0x431/0x6b0 +[ 141.423324] unregister_netdev+0xe/0x20 +[ 141.423578] igbvf_remove+0x45/0xe0 [igbvf] +[ 141.423791] pci_device_remove+0x36/0xb0 +[ 141.423990] device_release_driver_internal+0xc1/0x160 +[ 141.424270] pci_stop_bus_device+0x6d/0x90 +[ 141.424507] pci_stop_and_remove_bus_device+0xe/0x20 +[ 141.424789] pci_iov_remove_virtfn+0xba/0x120 +[ 141.425452] sriov_disable+0x2f/0xf0 +[ 141.425679] igb_disable_sriov+0x4e/0x100 [igb] +[ 141.426353] igb_remove+0xa0/0x130 [igb] +[ 141.426599] pci_device_remove+0x36/0xb0 +[ 141.426796] device_release_driver_internal+0xc1/0x160 +[ 141.427060] driver_detach+0x44/0x90 +[ 141.427253] bus_remove_driver+0x55/0xe0 +[ 141.427477] pci_unregister_driver+0x2a/0xa0 +[ 141.428296] __x64_sys_delete_module+0x141/0x2b0 +[ 141.429126] ? mntput_no_expire+0x4a/0x240 +[ 141.429363] ? syscall_trace_enter.isra.19+0x126/0x1a0 +[ 141.429653] do_syscall_64+0x5b/0x80 +[ 141.429847] ? exit_to_user_mode_prepare+0x14d/0x1c0 +[ 141.430109] ? syscall_exit_to_user_mode+0x12/0x30 +[ 141.430849] ? do_syscall_64+0x67/0x80 +[ 141.431083] ? syscall_exit_to_user_mode_prepare+0x183/0x1b0 +[ 141.431770] ? syscall_exit_to_user_mode+0x12/0x30 +[ 141.432482] ? do_syscall_64+0x67/0x80 +[ 141.432714] ? exc_page_fault+0x64/0x140 +[ 141.432911] entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Since the igb_disable_sriov() will call pci_disable_sriov() before +releasing any resources, the netdev core will synchronize the cleanup to +avoid any races. This patch removes the useless rtnl_(un)lock to guarantee +correctness. + +CC: stable@vger.kernel.org +Fixes: 6faee3d4ee8b ("igb: Add lock to avoid data race") +Reported-by: Corinna Vinschen +Link: https://lore.kernel.org/intel-wired-lan/ZAcJvkEPqWeJHO2r@calimero.vinschen.de/ +Signed-off-by: Lin Ma +Tested-by: Corinna Vinschen +Reviewed-by: Jacob Keller +Reviewed-by: Simon Horman +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/intel/igb/igb_main.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index b5b44388..c4258468 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -3841,9 +3841,7 @@ static void igb_remove(struct pci_dev *pdev) + igb_release_hw_control(adapter); + + #ifdef CONFIG_PCI_IOV +- rtnl_lock(); + igb_disable_sriov(pdev); +- rtnl_unlock(); + #endif + + unregister_netdev(netdev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-189-dm-thin-fix-deadlock-when-swapping-to-thin-devi.patch b/patches.kernel.org/6.2.9-189-dm-thin-fix-deadlock-when-swapping-to-thin-devi.patch new file mode 100644 index 0000000..61c8576 --- /dev/null +++ b/patches.kernel.org/6.2.9-189-dm-thin-fix-deadlock-when-swapping-to-thin-devi.patch @@ -0,0 +1,76 @@ +From: Coly Li +Date: Mon, 27 Feb 2023 23:23:17 +0800 +Subject: [PATCH] dm thin: fix deadlock when swapping to thin device +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 9bbf5feecc7eab2c370496c1c161bbfe62084028 + +commit 9bbf5feecc7eab2c370496c1c161bbfe62084028 upstream. + +This is an already known issue that dm-thin volume cannot be used as +swap, otherwise a deadlock may happen when dm-thin internal memory +demand triggers swap I/O on the dm-thin volume itself. + +But thanks to commit a666e5c05e7c ("dm: fix deadlock when swapping to +encrypted device"), the limit_swap_bios target flag can also be used +for dm-thin to avoid the recursive I/O when it is used as swap. + +Fix is to simply set ti->limit_swap_bios to true in both pool_ctr() +and thin_ctr(). + +In my test, I create a dm-thin volume /dev/vg/swap and use it as swap +device. Then I run fio on another dm-thin volume /dev/vg/main and use +large --blocksize to trigger swap I/O onto /dev/vg/swap. + +The following fio command line is used in my test, + fio --name recursive-swap-io --lockmem 1 --iodepth 128 \ + --ioengine libaio --filename /dev/vg/main --rw randrw \ + --blocksize 1M --numjobs 32 --time_based --runtime=12h + +Without this fix, the whole system can be locked up within 15 seconds. + +With this fix, there is no any deadlock or hung task observed after +2 hours of running fio. + +Furthermore, if blocksize is changed from 1M to 128M, after around 30 +seconds fio has no visible I/O, and the out-of-memory killer message +shows up in kernel message. After around 20 minutes all fio processes +are killed and the whole system is back to being alive. + +This is exactly what is expected when recursive I/O happens on dm-thin +volume when it is used as swap. + +Depends-on: a666e5c05e7c ("dm: fix deadlock when swapping to encrypted device") +Cc: stable@vger.kernel.org +Signed-off-by: Coly Li +Acked-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/md/dm-thin.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index e4c1a8a2..e6e5ab29 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -3357,6 +3357,7 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv) + pt->low_water_blocks = low_water_blocks; + pt->adjusted_pf = pt->requested_pf = pf; + ti->num_flush_bios = 1; ++ ti->limit_swap_bios = true; + + /* + * Only need to enable discards if the pool should pass +@@ -4235,6 +4236,7 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv) + goto bad; + + ti->num_flush_bios = 1; ++ ti->limit_swap_bios = true; + ti->flush_supported = true; + ti->accounts_remapped_io = true; + ti->per_io_data_size = sizeof(struct dm_thin_endio_hook); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-190-usb-typec-tcpm-fix-create-duplicate-source-capa.patch b/patches.kernel.org/6.2.9-190-usb-typec-tcpm-fix-create-duplicate-source-capa.patch new file mode 100644 index 0000000..f3a0dc7 --- /dev/null +++ b/patches.kernel.org/6.2.9-190-usb-typec-tcpm-fix-create-duplicate-source-capa.patch @@ -0,0 +1,70 @@ +From: Xu Yang +Date: Wed, 15 Feb 2023 13:49:51 +0800 +Subject: [PATCH] usb: typec: tcpm: fix create duplicate source-capabilities + file +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: a826492fc9dfe32afd70fff93955ae8174bbf14b + +commit a826492fc9dfe32afd70fff93955ae8174bbf14b upstream. + +The kernel will dump in the below cases: +sysfs: cannot create duplicate filename +'/devices/virtual/usb_power_delivery/pd1/source-capabilities' + +1. After soft reset has completed, an Explicit Contract negotiation occurs. +The sink device will receive source capabilitys again. This will cause +a duplicate source-capabilities file be created. +2. Power swap twice on a device that is initailly sink role. + +This will unregister existing capabilities when above cases occurs. + +Fixes: 8203d26905ee ("usb: typec: tcpm: Register USB Power Delivery Capabilities") +cc: +Signed-off-by: Xu Yang +Reviewed-by: Heikki Krogerus +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20230215054951.238394-1-xu.yang_2@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/typec/tcpm/tcpm.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c +index 59b366b5..9e981da2 100644 +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -4547,6 +4547,9 @@ static void run_state_machine(struct tcpm_port *port) + case SOFT_RESET: + port->message_id = 0; + port->rx_msgid = -1; ++ /* remove existing capabilities */ ++ usb_power_delivery_unregister_capabilities(port->partner_source_caps); ++ port->partner_source_caps = NULL; + tcpm_pd_send_control(port, PD_CTRL_ACCEPT); + tcpm_ams_finish(port); + if (port->pwr_role == TYPEC_SOURCE) { +@@ -4566,6 +4569,9 @@ static void run_state_machine(struct tcpm_port *port) + case SOFT_RESET_SEND: + port->message_id = 0; + port->rx_msgid = -1; ++ /* remove existing capabilities */ ++ usb_power_delivery_unregister_capabilities(port->partner_source_caps); ++ port->partner_source_caps = NULL; + if (tcpm_pd_send_control(port, PD_CTRL_SOFT_RESET)) + tcpm_set_state_cond(port, hard_reset_state(port), 0); + else +@@ -4695,6 +4701,9 @@ static void run_state_machine(struct tcpm_port *port) + tcpm_set_state(port, SNK_STARTUP, 0); + break; + case PR_SWAP_SNK_SRC_SINK_OFF: ++ /* will be source, remove existing capabilities */ ++ usb_power_delivery_unregister_capabilities(port->partner_source_caps); ++ port->partner_source_caps = NULL; + /* + * Prevent vbus discharge circuit from turning on during PR_SWAP + * as this is not a disconnect. +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-191-usb-typec-tcpm-fix-warning-when-handle-discover.patch b/patches.kernel.org/6.2.9-191-usb-typec-tcpm-fix-warning-when-handle-discover.patch new file mode 100644 index 0000000..d35b296 --- /dev/null +++ b/patches.kernel.org/6.2.9-191-usb-typec-tcpm-fix-warning-when-handle-discover.patch @@ -0,0 +1,129 @@ +From: Xu Yang +Date: Thu, 16 Feb 2023 11:15:15 +0800 +Subject: [PATCH] usb: typec: tcpm: fix warning when handle discover_identity + message +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: abfc4fa28f0160df61c7149567da4f6494dfb488 + +commit abfc4fa28f0160df61c7149567da4f6494dfb488 upstream. + +Since both source and sink device can send discover_identity message in +PD3, kernel may dump below warning: + +------------[ cut here ]------------ +WARNING: CPU: 0 PID: 169 at drivers/usb/typec/tcpm/tcpm.c:1446 tcpm_queue_vdm+0xe0/0xf0 +Modules linked in: +CPU: 0 PID: 169 Comm: 1-0050 Not tainted 6.1.1-00038-g6a3c36cf1da2-dirty #567 +Hardware name: NXP i.MX8MPlus EVK board (DT) +pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : tcpm_queue_vdm+0xe0/0xf0 +lr : tcpm_queue_vdm+0x2c/0xf0 +sp : ffff80000c19bcd0 +x29: ffff80000c19bcd0 x28: 0000000000000001 x27: ffff0000d11c8ab8 +x26: ffff0000d11cc000 x25: 0000000000000000 x24: 00000000ff008081 +x23: 0000000000000001 x22: 00000000ff00a081 x21: ffff80000c19bdbc +x20: 0000000000000000 x19: ffff0000d11c8080 x18: ffffffffffffffff +x17: 0000000000000000 x16: 0000000000000000 x15: ffff0000d716f580 +x14: 0000000000000001 x13: ffff0000d716f507 x12: 0000000000000001 +x11: 0000000000000000 x10: 0000000000000020 x9 : 00000000000ee098 +x8 : 00000000ffffffff x7 : 000000000000001c x6 : ffff0000d716f580 +x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 +x2 : ffff80000c19bdbc x1 : 00000000ff00a081 x0 : 0000000000000004 +Call trace: +tcpm_queue_vdm+0xe0/0xf0 +tcpm_pd_rx_handler+0x340/0x1ab0 +kthread_worker_fn+0xcc/0x18c +kthread+0x10c/0x110 +ret_from_fork+0x10/0x20 +---[ end trace 0000000000000000 ]--- + +Below sequences may trigger this warning: + +tcpm_send_discover_work(work) + tcpm_send_vdm(port, USB_SID_PD, CMD_DISCOVER_IDENT, NULL, 0); + tcpm_queue_vdm(port, header, data, count); + port->vdm_state = VDM_STATE_READY; + +vdm_state_machine_work(work); + <-- received discover_identity from partner + vdm_run_state_machine(port); + port->vdm_state = VDM_STATE_SEND_MESSAGE; + mod_vdm_delayed_work(port, x); + +tcpm_pd_rx_handler(work); + tcpm_pd_data_request(port, msg); + tcpm_handle_vdm_request(port, msg->payload, cnt); + tcpm_queue_vdm(port, response[0], &response[1], rlen - 1); +--> WARN_ON(port->vdm_state > VDM_STATE_DONE); + +For this case, the state machine could still send out discover +identity message later if we skip current discover_identity message. +So we should handle the received message firstly and override the pending +discover_identity message without warning in this case. Then, a delayed +send_discover work will send discover_identity message again. + +Fixes: e00943e91678 ("usb: typec: tcpm: PD3.0 sinks can send Discover Identity even in device mode") +cc: +Signed-off-by: Xu Yang +Reviewed-by: Guenter Roeck +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20230216031515.4151117-1-xu.yang_2@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/typec/tcpm/tcpm.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c +index 9e981da2..032d21a9 100644 +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -1436,10 +1436,18 @@ static int tcpm_ams_start(struct tcpm_port *port, enum tcpm_ams ams) + static void tcpm_queue_vdm(struct tcpm_port *port, const u32 header, + const u32 *data, int cnt) + { ++ u32 vdo_hdr = port->vdo_data[0]; ++ + WARN_ON(!mutex_is_locked(&port->lock)); + +- /* Make sure we are not still processing a previous VDM packet */ +- WARN_ON(port->vdm_state > VDM_STATE_DONE); ++ /* If is sending discover_identity, handle received message first */ ++ if (PD_VDO_SVDM(vdo_hdr) && PD_VDO_CMD(vdo_hdr) == CMD_DISCOVER_IDENT) { ++ port->send_discover = true; ++ mod_send_discover_delayed_work(port, SEND_DISCOVER_RETRY_MS); ++ } else { ++ /* Make sure we are not still processing a previous VDM packet */ ++ WARN_ON(port->vdm_state > VDM_STATE_DONE); ++ } + + port->vdo_count = cnt + 1; + port->vdo_data[0] = header; +@@ -1942,11 +1950,13 @@ static void vdm_run_state_machine(struct tcpm_port *port) + switch (PD_VDO_CMD(vdo_hdr)) { + case CMD_DISCOVER_IDENT: + res = tcpm_ams_start(port, DISCOVER_IDENTITY); +- if (res == 0) ++ if (res == 0) { + port->send_discover = false; +- else if (res == -EAGAIN) ++ } else if (res == -EAGAIN) { ++ port->vdo_data[0] = 0; + mod_send_discover_delayed_work(port, + SEND_DISCOVER_RETRY_MS); ++ } + break; + case CMD_DISCOVER_SVID: + res = tcpm_ams_start(port, DISCOVER_SVIDS); +@@ -2029,6 +2039,7 @@ static void vdm_run_state_machine(struct tcpm_port *port) + unsigned long timeout; + + port->vdm_retries = 0; ++ port->vdo_data[0] = 0; + port->vdm_state = VDM_STATE_BUSY; + timeout = vdm_ready_timeout(vdo_hdr); + mod_vdm_delayed_work(port, timeout); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-192-usb-cdns3-Fix-issue-with-using-incorrect-PCI-de.patch b/patches.kernel.org/6.2.9-192-usb-cdns3-Fix-issue-with-using-incorrect-PCI-de.patch new file mode 100644 index 0000000..adc913d --- /dev/null +++ b/patches.kernel.org/6.2.9-192-usb-cdns3-Fix-issue-with-using-incorrect-PCI-de.patch @@ -0,0 +1,46 @@ +From: Pawel Laszczak +Date: Wed, 8 Mar 2023 07:44:27 -0500 +Subject: [PATCH] usb: cdns3: Fix issue with using incorrect PCI device + function +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 1272fd652a226ccb34e9f47371b6121948048438 + +commit 1272fd652a226ccb34e9f47371b6121948048438 upstream. + +PCI based platform can have more than two PCI functions. +USBSS PCI Glue driver during initialization should +consider only DRD/HOST/DEVICE PCI functions and +all other should be ignored. This patch adds additional +condition which causes that only DRD and HOST/DEVICE +function will be accepted. + +cc: +Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") +Signed-off-by: Pawel Laszczak +Link: https://lore.kernel.org/r/20230308124427.311245-1-pawell@cadence.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/cdns3/cdns3-pci-wrap.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/usb/cdns3/cdns3-pci-wrap.c b/drivers/usb/cdns3/cdns3-pci-wrap.c +index deeea618..1f6320d9 100644 +--- a/drivers/usb/cdns3/cdns3-pci-wrap.c ++++ b/drivers/usb/cdns3/cdns3-pci-wrap.c +@@ -60,6 +60,11 @@ static struct pci_dev *cdns3_get_second_fun(struct pci_dev *pdev) + return NULL; + } + ++ if (func->devfn != PCI_DEV_FN_HOST_DEVICE && ++ func->devfn != PCI_DEV_FN_OTG) { ++ return NULL; ++ } ++ + return func; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-193-usb-cdnsp-Fixes-issue-with-redundant-Status-Sta.patch b/patches.kernel.org/6.2.9-193-usb-cdnsp-Fixes-issue-with-redundant-Status-Sta.patch new file mode 100644 index 0000000..1361664 --- /dev/null +++ b/patches.kernel.org/6.2.9-193-usb-cdnsp-Fixes-issue-with-redundant-Status-Sta.patch @@ -0,0 +1,73 @@ +From: Pawel Laszczak +Date: Tue, 7 Mar 2023 06:14:20 -0500 +Subject: [PATCH] usb: cdnsp: Fixes issue with redundant Status Stage +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 5bc38d33a5a1209fd4de65101d1ae8255ea12c6e + +commit 5bc38d33a5a1209fd4de65101d1ae8255ea12c6e upstream. + +In some cases, driver trees to send Status Stage twice. +The first one from upper layer of gadget usb subsystem and +second time from controller driver. +This patch fixes this issue and remove tricky handling of +SET_INTERFACE from controller driver which is no longer +needed. + +cc: +Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") +Signed-off-by: Pawel Laszczak +Link: https://lore.kernel.org/r/20230307111420.376056-1-pawell@cadence.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/cdns3/cdnsp-ep0.c | 19 +------------------ + 1 file changed, 1 insertion(+), 18 deletions(-) + +diff --git a/drivers/usb/cdns3/cdnsp-ep0.c b/drivers/usb/cdns3/cdnsp-ep0.c +index 9b8325f8..d63d5d92 100644 +--- a/drivers/usb/cdns3/cdnsp-ep0.c ++++ b/drivers/usb/cdns3/cdnsp-ep0.c +@@ -403,20 +403,6 @@ static int cdnsp_ep0_std_request(struct cdnsp_device *pdev, + case USB_REQ_SET_ISOCH_DELAY: + ret = cdnsp_ep0_set_isoch_delay(pdev, ctrl); + break; +- case USB_REQ_SET_INTERFACE: +- /* +- * Add request into pending list to block sending status stage +- * by libcomposite. +- */ +- list_add_tail(&pdev->ep0_preq.list, +- &pdev->ep0_preq.pep->pending_list); +- +- ret = cdnsp_ep0_delegate_req(pdev, ctrl); +- if (ret == -EBUSY) +- ret = 0; +- +- list_del(&pdev->ep0_preq.list); +- break; + default: + ret = cdnsp_ep0_delegate_req(pdev, ctrl); + break; +@@ -474,9 +460,6 @@ void cdnsp_setup_analyze(struct cdnsp_device *pdev) + else + ret = cdnsp_ep0_delegate_req(pdev, ctrl); + +- if (!len) +- pdev->ep0_stage = CDNSP_STATUS_STAGE; +- + if (ret == USB_GADGET_DELAYED_STATUS) { + trace_cdnsp_ep0_status_stage("delayed"); + return; +@@ -484,6 +467,6 @@ void cdnsp_setup_analyze(struct cdnsp_device *pdev) + out: + if (ret < 0) + cdnsp_ep0_stall(pdev); +- else if (pdev->ep0_stage == CDNSP_STATUS_STAGE) ++ else if (!len && pdev->ep0_stage != CDNSP_STATUS_STAGE) + cdnsp_status_stage(pdev); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-194-usb-cdnsp-changes-PCI-Device-ID-to-fix-conflict.patch b/patches.kernel.org/6.2.9-194-usb-cdnsp-changes-PCI-Device-ID-to-fix-conflict.patch new file mode 100644 index 0000000..1d88e43 --- /dev/null +++ b/patches.kernel.org/6.2.9-194-usb-cdnsp-changes-PCI-Device-ID-to-fix-conflict.patch @@ -0,0 +1,79 @@ +From: Pawel Laszczak +Date: Thu, 9 Mar 2023 01:30:48 -0500 +Subject: [PATCH] usb: cdnsp: changes PCI Device ID to fix conflict with CNDS3 + driver +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 96b96b2a567fb34dd41c87e6cf01f6902ce8cae4 + +commit 96b96b2a567fb34dd41c87e6cf01f6902ce8cae4 upstream. + +Patch changes CDNS_DEVICE_ID in USBSSP PCI Glue driver to remove +the conflict with Cadence USBSS driver. + +cc: +Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") +Signed-off-by: Pawel Laszczak +Link: https://lore.kernel.org/r/20230309063048.299378-1-pawell@cadence.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/cdns3/cdnsp-pci.c | 27 +++++++++++---------------- + 1 file changed, 11 insertions(+), 16 deletions(-) + +diff --git a/drivers/usb/cdns3/cdnsp-pci.c b/drivers/usb/cdns3/cdnsp-pci.c +index efd54ed9..7b151f5a 100644 +--- a/drivers/usb/cdns3/cdnsp-pci.c ++++ b/drivers/usb/cdns3/cdnsp-pci.c +@@ -29,30 +29,23 @@ + #define PLAT_DRIVER_NAME "cdns-usbssp" + + #define CDNS_VENDOR_ID 0x17cd +-#define CDNS_DEVICE_ID 0x0100 ++#define CDNS_DEVICE_ID 0x0200 ++#define CDNS_DRD_ID 0x0100 + #define CDNS_DRD_IF (PCI_CLASS_SERIAL_USB << 8 | 0x80) + + static struct pci_dev *cdnsp_get_second_fun(struct pci_dev *pdev) + { +- struct pci_dev *func; +- + /* + * Gets the second function. +- * It's little tricky, but this platform has two function. +- * The fist keeps resources for Host/Device while the second +- * keeps resources for DRD/OTG. ++ * Platform has two function. The fist keeps resources for ++ * Host/Device while the secon keeps resources for DRD/OTG. + */ +- func = pci_get_device(pdev->vendor, pdev->device, NULL); +- if (!func) +- return NULL; ++ if (pdev->device == CDNS_DEVICE_ID) ++ return pci_get_device(pdev->vendor, CDNS_DRD_ID, NULL); ++ else if (pdev->device == CDNS_DRD_ID) ++ return pci_get_device(pdev->vendor, CDNS_DEVICE_ID, NULL); + +- if (func->devfn == pdev->devfn) { +- func = pci_get_device(pdev->vendor, pdev->device, func); +- if (!func) +- return NULL; +- } +- +- return func; ++ return NULL; + } + + static int cdnsp_pci_probe(struct pci_dev *pdev, +@@ -230,6 +223,8 @@ static const struct pci_device_id cdnsp_pci_ids[] = { + PCI_CLASS_SERIAL_USB_DEVICE, PCI_ANY_ID }, + { PCI_VENDOR_ID_CDNS, CDNS_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, + CDNS_DRD_IF, PCI_ANY_ID }, ++ { PCI_VENDOR_ID_CDNS, CDNS_DRD_ID, PCI_ANY_ID, PCI_ANY_ID, ++ CDNS_DRD_IF, PCI_ANY_ID }, + { 0, } + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-195-usb-chipdea-core-fix-return-EINVAL-if-request-r.patch b/patches.kernel.org/6.2.9-195-usb-chipdea-core-fix-return-EINVAL-if-request-r.patch new file mode 100644 index 0000000..e2e55ca --- /dev/null +++ b/patches.kernel.org/6.2.9-195-usb-chipdea-core-fix-return-EINVAL-if-request-r.patch @@ -0,0 +1,45 @@ +From: Xu Yang +Date: Fri, 17 Mar 2023 14:15:15 +0800 +Subject: [PATCH] usb: chipdea: core: fix return -EINVAL if request role is the + same with current role +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 3670de80678961eda7fa2220883fc77c16868951 + +commit 3670de80678961eda7fa2220883fc77c16868951 upstream. + +It should not return -EINVAL if the request role is the same with current +role, return non-error and without do anything instead. + +Fixes: a932a8041ff9 ("usb: chipidea: core: add sysfs group") +cc: +Acked-by: Peter Chen +Signed-off-by: Xu Yang +Link: https://lore.kernel.org/r/20230317061516.2451728-1-xu.yang_2@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/chipidea/core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c +index 27c60129..b6f2a41d 100644 +--- a/drivers/usb/chipidea/core.c ++++ b/drivers/usb/chipidea/core.c +@@ -984,9 +984,12 @@ static ssize_t role_store(struct device *dev, + strlen(ci->roles[role]->name))) + break; + +- if (role == CI_ROLE_END || role == ci->role) ++ if (role == CI_ROLE_END) + return -EINVAL; + ++ if (role == ci->role) ++ return n; ++ + pm_runtime_get_sync(dev); + disable_irq(ci->irq); + ci_role_stop(ci); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-196-usb-chipidea-core-fix-possible-concurrent-when-.patch b/patches.kernel.org/6.2.9-196-usb-chipidea-core-fix-possible-concurrent-when-.patch new file mode 100644 index 0000000..71a7923 --- /dev/null +++ b/patches.kernel.org/6.2.9-196-usb-chipidea-core-fix-possible-concurrent-when-.patch @@ -0,0 +1,108 @@ +From: Xu Yang +Date: Fri, 17 Mar 2023 14:15:16 +0800 +Subject: [PATCH] usb: chipidea: core: fix possible concurrent when switch role +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 451b15ed138ec15bffbebb58a00ebdd884c3e659 + +commit 451b15ed138ec15bffbebb58a00ebdd884c3e659 upstream. + +The user may call role_store() when driver is handling +ci_handle_id_switch() which is triggerred by otg event or power lost +event. Unfortunately, the controller may go into chaos in this case. +Fix this by protecting it with mutex lock. + +Fixes: a932a8041ff9 ("usb: chipidea: core: add sysfs group") +cc: +Acked-by: Peter Chen +Signed-off-by: Xu Yang +Link: https://lore.kernel.org/r/20230317061516.2451728-2-xu.yang_2@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/chipidea/ci.h | 2 ++ + drivers/usb/chipidea/core.c | 8 +++++++- + drivers/usb/chipidea/otg.c | 5 ++++- + 3 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/chipidea/ci.h b/drivers/usb/chipidea/ci.h +index 005c67cb..f210b748 100644 +--- a/drivers/usb/chipidea/ci.h ++++ b/drivers/usb/chipidea/ci.h +@@ -208,6 +208,7 @@ struct hw_bank { + * @in_lpm: if the core in low power mode + * @wakeup_int: if wakeup interrupt occur + * @rev: The revision number for controller ++ * @mutex: protect code from concorrent running when doing role switch + */ + struct ci_hdrc { + struct device *dev; +@@ -260,6 +261,7 @@ struct ci_hdrc { + bool in_lpm; + bool wakeup_int; + enum ci_revision rev; ++ struct mutex mutex; + }; + + static inline struct ci_role_driver *ci_role(struct ci_hdrc *ci) +diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c +index b6f2a41d..281fc517 100644 +--- a/drivers/usb/chipidea/core.c ++++ b/drivers/usb/chipidea/core.c +@@ -987,8 +987,12 @@ static ssize_t role_store(struct device *dev, + if (role == CI_ROLE_END) + return -EINVAL; + +- if (role == ci->role) ++ mutex_lock(&ci->mutex); ++ ++ if (role == ci->role) { ++ mutex_unlock(&ci->mutex); + return n; ++ } + + pm_runtime_get_sync(dev); + disable_irq(ci->irq); +@@ -998,6 +1002,7 @@ static ssize_t role_store(struct device *dev, + ci_handle_vbus_change(ci); + enable_irq(ci->irq); + pm_runtime_put_sync(dev); ++ mutex_unlock(&ci->mutex); + + return (ret == 0) ? n : ret; + } +@@ -1033,6 +1038,7 @@ static int ci_hdrc_probe(struct platform_device *pdev) + return -ENOMEM; + + spin_lock_init(&ci->lock); ++ mutex_init(&ci->mutex); + ci->dev = dev; + ci->platdata = dev_get_platdata(dev); + ci->imx28_write_fix = !!(ci->platdata->flags & +diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c +index 622c3b68..f5490f2a 100644 +--- a/drivers/usb/chipidea/otg.c ++++ b/drivers/usb/chipidea/otg.c +@@ -167,8 +167,10 @@ static int hw_wait_vbus_lower_bsv(struct ci_hdrc *ci) + + void ci_handle_id_switch(struct ci_hdrc *ci) + { +- enum ci_role role = ci_otg_role(ci); ++ enum ci_role role; + ++ mutex_lock(&ci->mutex); ++ role = ci_otg_role(ci); + if (role != ci->role) { + dev_dbg(ci->dev, "switching from %s to %s\n", + ci_role(ci)->name, ci->roles[role]->name); +@@ -198,6 +200,7 @@ void ci_handle_id_switch(struct ci_hdrc *ci) + if (role == CI_ROLE_GADGET) + ci_handle_vbus_change(ci); + } ++ mutex_unlock(&ci->mutex); + } + /** + * ci_otg_work - perform otg (vbus/id) event handle +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-197-usb-dwc3-gadget-Add-1ms-delay-after-end-transfe.patch b/patches.kernel.org/6.2.9-197-usb-dwc3-gadget-Add-1ms-delay-after-end-transfe.patch new file mode 100644 index 0000000..690455d --- /dev/null +++ b/patches.kernel.org/6.2.9-197-usb-dwc3-gadget-Add-1ms-delay-after-end-transfe.patch @@ -0,0 +1,87 @@ +From: Wesley Cheng +Date: Mon, 6 Mar 2023 12:05:57 -0800 +Subject: [PATCH] usb: dwc3: gadget: Add 1ms delay after end transfer command + without IOC +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: d8a2bb4eb75866275b5cf7de2e593ac3449643e2 + +commit d8a2bb4eb75866275b5cf7de2e593ac3449643e2 upstream. + +Previously, there was a 100uS delay inserted after issuing an end transfer +command for specific controller revisions. This was due to the fact that +there was a GUCTL2 bit field which enabled synchronous completion of the +end transfer command once the CMDACT bit was cleared in the DEPCMD +register. Since this bit does not exist for all controller revisions and +the current implementation heavily relies on utizling the EndTransfer +command completion interrupt, add the delay back in for uses where the +interrupt on completion bit is not set, and increase the duration to 1ms +for the controller to complete the command. + +An issue was seen where the USB request buffer was unmapped while the DWC3 +controller was still accessing the TRB. However, it was confirmed that the +end transfer command was successfully submitted. (no end transfer timeout) +In situations, such as dwc3_gadget_soft_disconnect() and +__dwc3_gadget_ep_disable(), the dwc3_remove_request() is utilized, which +will issue the end transfer command, and follow up with +dwc3_gadget_giveback(). At least for the USB ep disable path, it is +required for any pending and started requests to be completed and returned +to the function driver in the same context of the disable call. Without +the GUCTL2 bit, it is not ensured that the end transfer is completed before +the buffers are unmapped. + +Fixes: cf2f8b63f7f1 ("usb: dwc3: gadget: Remove END_TRANSFER delay") +Cc: stable +Signed-off-by: Wesley Cheng +Acked-by: Thinh Nguyen +Link: https://lore.kernel.org/r/20230306200557.29387-1-quic_wcheng@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/dwc3/gadget.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 3c63fa97..cf5b4f49 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1699,6 +1699,7 @@ static int __dwc3_gadget_get_frame(struct dwc3 *dwc) + */ + static int __dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force, bool interrupt) + { ++ struct dwc3 *dwc = dep->dwc; + struct dwc3_gadget_ep_cmd_params params; + u32 cmd; + int ret; +@@ -1722,10 +1723,13 @@ static int __dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force, bool int + WARN_ON_ONCE(ret); + dep->resource_index = 0; + +- if (!interrupt) ++ if (!interrupt) { ++ if (!DWC3_IP_IS(DWC3) || DWC3_VER_IS_PRIOR(DWC3, 310A)) ++ mdelay(1); + dep->flags &= ~DWC3_EP_TRANSFER_STARTED; +- else if (!ret) ++ } else if (!ret) { + dep->flags |= DWC3_EP_END_TRANSFER_PENDING; ++ } + + dep->flags &= ~DWC3_EP_DELAY_STOP; + return ret; +@@ -3774,7 +3778,11 @@ void dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force, + * enabled, the EndTransfer command will have completed upon + * returning from this function. + * +- * This mode is NOT available on the DWC_usb31 IP. ++ * This mode is NOT available on the DWC_usb31 IP. In this ++ * case, if the IOC bit is not set, then delay by 1ms ++ * after issuing the EndTransfer command. This allows for the ++ * controller to handle the command completely before DWC3 ++ * remove requests attempts to unmap USB request buffers. + */ + + __dwc3_stop_active_transfer(dep, force, interrupt); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-198-usb-ucsi-Fix-NULL-pointer-deref-in-ucsi_connect.patch b/patches.kernel.org/6.2.9-198-usb-ucsi-Fix-NULL-pointer-deref-in-ucsi_connect.patch new file mode 100644 index 0000000..d6019bc --- /dev/null +++ b/patches.kernel.org/6.2.9-198-usb-ucsi-Fix-NULL-pointer-deref-in-ucsi_connect.patch @@ -0,0 +1,73 @@ +From: Hans de Goede +Date: Wed, 8 Mar 2023 16:42:42 +0100 +Subject: [PATCH] usb: ucsi: Fix NULL pointer deref in ucsi_connector_change() +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: f87fb985452ab2083967103ac00bfd68fb182764 + +commit f87fb985452ab2083967103ac00bfd68fb182764 upstream. + +When ucsi_init() fails, ucsi->connector is NULL, yet in case of +ucsi_acpi we may still get events which cause the ucs_acpi code to call +ucsi_connector_change(), which then derefs the NULL ucsi->connector +pointer. + +Fix this by not setting ucsi->ntfy inside ucsi_init() until ucsi_init() +has succeeded, so that ucsi_connector_change() ignores the events +because UCSI_ENABLE_NTFY_CONNECTOR_CHANGE is not set in the ntfy mask. + +Fixes: bdc62f2bae8f ("usb: typec: ucsi: Simplified registration and I/O API") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217106 +Cc: stable@vger.kernel.org +Reviewed-by: Heikki Krogerus +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20230308154244.722337-2-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/typec/ucsi/ucsi.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c +index 1cf8947c..8cbbb002 100644 +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -1205,7 +1205,7 @@ static int ucsi_register_port(struct ucsi *ucsi, int index) + static int ucsi_init(struct ucsi *ucsi) + { + struct ucsi_connector *con; +- u64 command; ++ u64 command, ntfy; + int ret; + int i; + +@@ -1217,8 +1217,8 @@ static int ucsi_init(struct ucsi *ucsi) + } + + /* Enable basic notifications */ +- ucsi->ntfy = UCSI_ENABLE_NTFY_CMD_COMPLETE | UCSI_ENABLE_NTFY_ERROR; +- command = UCSI_SET_NOTIFICATION_ENABLE | ucsi->ntfy; ++ ntfy = UCSI_ENABLE_NTFY_CMD_COMPLETE | UCSI_ENABLE_NTFY_ERROR; ++ command = UCSI_SET_NOTIFICATION_ENABLE | ntfy; + ret = ucsi_send_command(ucsi, command, NULL, 0); + if (ret < 0) + goto err_reset; +@@ -1250,12 +1250,13 @@ static int ucsi_init(struct ucsi *ucsi) + } + + /* Enable all notifications */ +- ucsi->ntfy = UCSI_ENABLE_NTFY_ALL; +- command = UCSI_SET_NOTIFICATION_ENABLE | ucsi->ntfy; ++ ntfy = UCSI_ENABLE_NTFY_ALL; ++ command = UCSI_SET_NOTIFICATION_ENABLE | ntfy; + ret = ucsi_send_command(ucsi, command, NULL, 0); + if (ret < 0) + goto err_unregister; + ++ ucsi->ntfy = ntfy; + return 0; + + err_unregister: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-199-usb-ucsi_acpi-Increase-the-command-completion-t.patch b/patches.kernel.org/6.2.9-199-usb-ucsi_acpi-Increase-the-command-completion-t.patch new file mode 100644 index 0000000..8e691bc --- /dev/null +++ b/patches.kernel.org/6.2.9-199-usb-ucsi_acpi-Increase-the-command-completion-t.patch @@ -0,0 +1,57 @@ +From: Hans de Goede +Date: Wed, 8 Mar 2023 16:42:44 +0100 +Subject: [PATCH] usb: ucsi_acpi: Increase the command completion timeout +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 02d210f434249a7edbc160969b75df030dc6934d + +commit 02d210f434249a7edbc160969b75df030dc6934d upstream. + +Commit 130a96d698d7 ("usb: typec: ucsi: acpi: Increase command +completion timeout value") increased the timeout from 5 seconds +to 60 seconds due to issues related to alternate mode discovery. + +After the alternate mode discovery switch to polled mode +the timeout was reduced, but instead of being set back to +5 seconds it was reduced to 1 second. + +This is causing problems when using a Lenovo ThinkPad X1 yoga gen7 +connected over Type-C to a LG 27UL850-W (charging DP over Type-C). + +When the monitor is already connected at boot the following error +is logged: "PPM init failed (-110)", /sys/class/typec is empty and +on unplugging the NULL pointer deref fixed earlier in this series +happens. + +When the monitor is connected after boot the following error +is logged instead: "GET_CONNECTOR_STATUS failed (-110)". + +Setting the timeout back to 5 seconds fixes both cases. + +Fixes: e08065069fc7 ("usb: typec: ucsi: acpi: Reduce the command completion timeout") +Cc: stable@vger.kernel.org +Reviewed-by: Heikki Krogerus +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20230308154244.722337-4-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/usb/typec/ucsi/ucsi_acpi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/typec/ucsi/ucsi_acpi.c b/drivers/usb/typec/ucsi/ucsi_acpi.c +index ce0c8ef8..62206a6b 100644 +--- a/drivers/usb/typec/ucsi/ucsi_acpi.c ++++ b/drivers/usb/typec/ucsi/ucsi_acpi.c +@@ -78,7 +78,7 @@ static int ucsi_acpi_sync_write(struct ucsi *ucsi, unsigned int offset, + if (ret) + goto out_clear_bit; + +- if (!wait_for_completion_timeout(&ua->complete, HZ)) ++ if (!wait_for_completion_timeout(&ua->complete, 5 * HZ)) + ret = -ETIMEDOUT; + + out_clear_bit: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-200-mm-kfence-fix-using-kfence_metadata-without-ini.patch b/patches.kernel.org/6.2.9-200-mm-kfence-fix-using-kfence_metadata-without-ini.patch new file mode 100644 index 0000000..5c2b8c9 --- /dev/null +++ b/patches.kernel.org/6.2.9-200-mm-kfence-fix-using-kfence_metadata-without-ini.patch @@ -0,0 +1,67 @@ +From: Muchun Song +Date: Wed, 15 Mar 2023 11:44:41 +0800 +Subject: [PATCH] mm: kfence: fix using kfence_metadata without initialization + in show_object() +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 1c86a188e03156223a34d09ce290b49bd4dd0403 + +commit 1c86a188e03156223a34d09ce290b49bd4dd0403 upstream. + +The variable kfence_metadata is initialized in kfence_init_pool(), then, +it is not initialized if kfence is disabled after booting. In this case, +kfence_metadata will be used (e.g. ->lock and ->state fields) without +initialization when reading /sys/kernel/debug/kfence/objects. There will +be a warning if you enable CONFIG_DEBUG_SPINLOCK. Fix it by creating +debugfs files when necessary. + +Link: https://lkml.kernel.org/r/20230315034441.44321-1-songmuchun@bytedance.com +Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure") +Signed-off-by: Muchun Song +Tested-by: Marco Elver +Reviewed-by: Marco Elver +Cc: Alexander Potapenko +Cc: Dmitry Vyukov +Cc: Jann Horn +Cc: SeongJae Park +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + mm/kfence/core.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/mm/kfence/core.c b/mm/kfence/core.c +index 5349c37a..79c94ee5 100644 +--- a/mm/kfence/core.c ++++ b/mm/kfence/core.c +@@ -726,10 +726,14 @@ static const struct seq_operations objects_sops = { + }; + DEFINE_SEQ_ATTRIBUTE(objects); + +-static int __init kfence_debugfs_init(void) ++static int kfence_debugfs_init(void) + { +- struct dentry *kfence_dir = debugfs_create_dir("kfence", NULL); ++ struct dentry *kfence_dir; + ++ if (!READ_ONCE(kfence_enabled)) ++ return 0; ++ ++ kfence_dir = debugfs_create_dir("kfence", NULL); + debugfs_create_file("stats", 0444, kfence_dir, NULL, &stats_fops); + debugfs_create_file("objects", 0400, kfence_dir, NULL, &objects_fops); + return 0; +@@ -883,6 +887,8 @@ static int kfence_init_late(void) + } + + kfence_init_enable(); ++ kfence_debugfs_init(); ++ + return 0; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-201-kfence-avoid-passing-g-for-test.patch b/patches.kernel.org/6.2.9-201-kfence-avoid-passing-g-for-test.patch new file mode 100644 index 0000000..1d45fa3 --- /dev/null +++ b/patches.kernel.org/6.2.9-201-kfence-avoid-passing-g-for-test.patch @@ -0,0 +1,59 @@ +From: Marco Elver +Date: Thu, 16 Mar 2023 23:47:04 +0100 +Subject: [PATCH] kfence: avoid passing -g for test +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 2e08ca1802441224f5b7cc6bffbb687f7406de95 + +commit 2e08ca1802441224f5b7cc6bffbb687f7406de95 upstream. + +Nathan reported that when building with GNU as and a version of clang that +defaults to DWARF5: + + $ make -skj"$(nproc)" ARCH=riscv CROSS_COMPILE=riscv64-linux-gnu- \ + LLVM=1 LLVM_IAS=0 O=build \ + mrproper allmodconfig mm/kfence/kfence_test.o + /tmp/kfence_test-08a0a0.s: Assembler messages: + /tmp/kfence_test-08a0a0.s:14627: Error: non-constant .uleb128 is not supported + /tmp/kfence_test-08a0a0.s:14628: Error: non-constant .uleb128 is not supported + /tmp/kfence_test-08a0a0.s:14632: Error: non-constant .uleb128 is not supported + /tmp/kfence_test-08a0a0.s:14633: Error: non-constant .uleb128 is not supported + /tmp/kfence_test-08a0a0.s:14639: Error: non-constant .uleb128 is not supported + ... + +This is because `-g` defaults to the compiler debug info default. If the +assembler does not support some of the directives used, the above errors +occur. To fix, remove the explicit passing of `-g`. + +All the test wants is that stack traces print valid function names, and +debug info is not required for that. (I currently cannot recall why I +added the explicit `-g`.) + +Link: https://lkml.kernel.org/r/20230316224705.709984-1-elver@google.com +Fixes: bc8fbc5f305a ("kfence: add test suite") +Signed-off-by: Marco Elver +Reported-by: Nathan Chancellor +Cc: Alexander Potapenko +Cc: Dmitry Vyukov +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + mm/kfence/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/mm/kfence/Makefile b/mm/kfence/Makefile +index 0bb95728..2de2a58d 100644 +--- a/mm/kfence/Makefile ++++ b/mm/kfence/Makefile +@@ -2,5 +2,5 @@ + + obj-y := core.o report.o + +-CFLAGS_kfence_test.o := -g -fno-omit-frame-pointer -fno-optimize-sibling-calls ++CFLAGS_kfence_test.o := -fno-omit-frame-pointer -fno-optimize-sibling-calls + obj-$(CONFIG_KFENCE_KUNIT_TEST) += kfence_test.o +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-202-io_uring-net-avoid-sending-ECONNABORTED-on-repe.patch b/patches.kernel.org/6.2.9-202-io_uring-net-avoid-sending-ECONNABORTED-on-repe.patch new file mode 100644 index 0000000..ba0615e --- /dev/null +++ b/patches.kernel.org/6.2.9-202-io_uring-net-avoid-sending-ECONNABORTED-on-repe.patch @@ -0,0 +1,83 @@ +From: Jens Axboe +Date: Mon, 20 Mar 2023 11:13:49 -0600 +Subject: [PATCH] io_uring/net: avoid sending -ECONNABORTED on repeated + connection requests +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 74e2e17ee1f8d8a0928b90434ad7e2df70f8483e + +commit 74e2e17ee1f8d8a0928b90434ad7e2df70f8483e upstream. + +Since io_uring does nonblocking connect requests, if we do two repeated +ones without having a listener, the second will get -ECONNABORTED rather +than the expected -ECONNREFUSED. Treat -ECONNABORTED like a normal retry +condition if we're nonblocking, if we haven't already seen it. + +Cc: stable@vger.kernel.org +Fixes: 3fb1bd688172 ("io_uring/net: handle -EINPROGRESS correct for IORING_OP_CONNECT") +Link: https://github.com/axboe/liburing/issues/828 +Reported-by: Hui, Chunyang +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + io_uring/net.c | 25 ++++++++++++++++--------- + 1 file changed, 16 insertions(+), 9 deletions(-) + +diff --git a/io_uring/net.c b/io_uring/net.c +index 02587f7d..d474cad6 100644 +--- a/io_uring/net.c ++++ b/io_uring/net.c +@@ -47,6 +47,7 @@ struct io_connect { + struct sockaddr __user *addr; + int addr_len; + bool in_progress; ++ bool seen_econnaborted; + }; + + struct io_sr_msg { +@@ -1431,7 +1432,7 @@ int io_connect_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) + + conn->addr = u64_to_user_ptr(READ_ONCE(sqe->addr)); + conn->addr_len = READ_ONCE(sqe->addr2); +- conn->in_progress = false; ++ conn->in_progress = conn->seen_econnaborted = false; + return 0; + } + +@@ -1468,18 +1469,24 @@ int io_connect(struct io_kiocb *req, unsigned int issue_flags) + + ret = __sys_connect_file(req->file, &io->address, + connect->addr_len, file_flags); +- if ((ret == -EAGAIN || ret == -EINPROGRESS) && force_nonblock) { ++ if ((ret == -EAGAIN || ret == -EINPROGRESS || ret == -ECONNABORTED) ++ && force_nonblock) { + if (ret == -EINPROGRESS) { + connect->in_progress = true; +- } else { +- if (req_has_async_data(req)) +- return -EAGAIN; +- if (io_alloc_async_data(req)) { +- ret = -ENOMEM; ++ return -EAGAIN; ++ } ++ if (ret == -ECONNABORTED) { ++ if (connect->seen_econnaborted) + goto out; +- } +- memcpy(req->async_data, &__io, sizeof(__io)); ++ connect->seen_econnaborted = true; ++ } ++ if (req_has_async_data(req)) ++ return -EAGAIN; ++ if (io_alloc_async_data(req)) { ++ ret = -ENOMEM; ++ goto out; + } ++ memcpy(req->async_data, &__io, sizeof(__io)); + return -EAGAIN; + } + if (ret == -ERESTARTSYS) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-203-io_uring-rsrc-fix-null-ptr-deref-in-io_file_bit.patch b/patches.kernel.org/6.2.9-203-io_uring-rsrc-fix-null-ptr-deref-in-io_file_bit.patch new file mode 100644 index 0000000..250883a --- /dev/null +++ b/patches.kernel.org/6.2.9-203-io_uring-rsrc-fix-null-ptr-deref-in-io_file_bit.patch @@ -0,0 +1,77 @@ +From: Savino Dicanosa +Date: Tue, 21 Mar 2023 19:44:02 +0000 +Subject: [PATCH] io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get() +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 02a4d923e4400a36d340ea12d8058f69ebf3a383 + +commit 02a4d923e4400a36d340ea12d8058f69ebf3a383 upstream. + +When fixed files are unregistered, file_alloc_end and alloc_hint +are not cleared. This can later cause a NULL pointer dereference in +io_file_bitmap_get() if auto index selection is enabled via +IORING_FILE_INDEX_ALLOC: + +[ 6.519129] BUG: kernel NULL pointer dereference, address: 0000000000000000 +[...] +[ 6.541468] RIP: 0010:_find_next_zero_bit+0x1a/0x70 +[...] +[ 6.560906] Call Trace: +[ 6.561322] +[ 6.561672] io_file_bitmap_get+0x38/0x60 +[ 6.562281] io_fixed_fd_install+0x63/0xb0 +[ 6.562851] ? __pfx_io_socket+0x10/0x10 +[ 6.563396] io_socket+0x93/0xf0 +[ 6.563855] ? __pfx_io_socket+0x10/0x10 +[ 6.564411] io_issue_sqe+0x5b/0x3d0 +[ 6.564914] io_submit_sqes+0x1de/0x650 +[ 6.565452] __do_sys_io_uring_enter+0x4fc/0xb20 +[ 6.566083] ? __do_sys_io_uring_register+0x11e/0xd80 +[ 6.566779] do_syscall_64+0x3c/0x90 +[ 6.567247] entry_SYSCALL_64_after_hwframe+0x72/0xdc +[...] + +To fix the issue, set file alloc range and alloc_hint to zero after +file tables are freed. + +Cc: stable@vger.kernel.org +Fixes: 4278a0deb1f6 ("io_uring: defer alloc_hint update to io_file_bitmap_set()") +Signed-off-by: Savino Dicanosa +[axboe: add explicit bitmap == NULL check as well] +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + io_uring/filetable.c | 3 +++ + io_uring/rsrc.c | 1 + + 2 files changed, 4 insertions(+) + +diff --git a/io_uring/filetable.c b/io_uring/filetable.c +index 68dfc693..b80614e7 100644 +--- a/io_uring/filetable.c ++++ b/io_uring/filetable.c +@@ -19,6 +19,9 @@ static int io_file_bitmap_get(struct io_ring_ctx *ctx) + unsigned long nr = ctx->file_alloc_end; + int ret; + ++ if (!table->bitmap) ++ return -ENFILE; ++ + do { + ret = find_next_zero_bit(table->bitmap, nr, table->alloc_hint); + if (ret != nr) +diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c +index 4cbf3ad7..4ccfc292 100644 +--- a/io_uring/rsrc.c ++++ b/io_uring/rsrc.c +@@ -794,6 +794,7 @@ void __io_sqe_files_unregister(struct io_ring_ctx *ctx) + } + #endif + io_free_file_tables(&ctx->file_table); ++ io_file_table_set_alloc_range(ctx, 0, 0); + io_rsrc_data_free(ctx->file_data); + ctx->file_data = NULL; + ctx->nr_user_files = 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-204-Revert-kasan-drop-skip_kasan_poison-variable-in.patch b/patches.kernel.org/6.2.9-204-Revert-kasan-drop-skip_kasan_poison-variable-in.patch new file mode 100644 index 0000000..8477ec5 --- /dev/null +++ b/patches.kernel.org/6.2.9-204-Revert-kasan-drop-skip_kasan_poison-variable-in.patch @@ -0,0 +1,73 @@ +From: Peter Collingbourne +Date: Thu, 9 Mar 2023 20:29:13 -0800 +Subject: [PATCH] Revert "kasan: drop skip_kasan_poison variable in + free_pages_prepare" +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: f446883d12b8bfa486f7c98d403054d61d38c989 + +commit f446883d12b8bfa486f7c98d403054d61d38c989 upstream. + +This reverts commit 487a32ec24be819e747af8c2ab0d5c515508086a. + +should_skip_kasan_poison() reads the PG_skip_kasan_poison flag from +page->flags. However, this line of code in free_pages_prepare(): + + page->flags &= ~PAGE_FLAGS_CHECK_AT_PREP; + +clears most of page->flags, including PG_skip_kasan_poison, before calling +should_skip_kasan_poison(), which meant that it would never return true as +a result of the page flag being set. Therefore, fix the code to call +should_skip_kasan_poison() before clearing the flags, as we were doing +before the reverted patch. + +This fixes a measurable performance regression introduced in the reverted +commit, where munmap() takes longer than intended if HW tags KASAN is +supported and enabled at runtime. Without this patch, we see a +single-digit percentage performance regression in a particular +mmap()-heavy benchmark when enabling HW tags KASAN, and with the patch, +there is no statistically significant performance impact when enabling HW +tags KASAN. + +Link: https://lkml.kernel.org/r/20230310042914.3805818-2-pcc@google.com +Fixes: 487a32ec24be ("kasan: drop skip_kasan_poison variable in free_pages_prepare") + Link: https://linux-review.googlesource.com/id/Ic4f13affeebd20548758438bb9ed9ca40e312b79 +Signed-off-by: Peter Collingbourne +Reviewed-by: Andrey Konovalov +Cc: Andrey Ryabinin +Cc: Catalin Marinas [arm64] +Cc: Evgenii Stepanov +Cc: Vincenzo Frascino +Cc: Will Deacon +Cc: [6.1] +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + mm/page_alloc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 3bb34845..dab67b14 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -1391,6 +1391,7 @@ static __always_inline bool free_pages_prepare(struct page *page, + unsigned int order, bool check_free, fpi_t fpi_flags) + { + int bad = 0; ++ bool skip_kasan_poison = should_skip_kasan_poison(page, fpi_flags); + bool init = want_init_on_free(); + + VM_BUG_ON_PAGE(PageTail(page), page); +@@ -1463,7 +1464,7 @@ static __always_inline bool free_pages_prepare(struct page *page, + * With hardware tag-based KASAN, memory tags must be set before the + * page becomes unavailable via debug_pagealloc or arch_free_page. + */ +- if (!should_skip_kasan_poison(page, fpi_flags)) { ++ if (!skip_kasan_poison) { + kasan_poison_pages(page, order, init); + + /* Memory is already initialized if KASAN did it internally. */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-205-kcsan-avoid-passing-g-for-test.patch b/patches.kernel.org/6.2.9-205-kcsan-avoid-passing-g-for-test.patch new file mode 100644 index 0000000..30863ea --- /dev/null +++ b/patches.kernel.org/6.2.9-205-kcsan-avoid-passing-g-for-test.patch @@ -0,0 +1,51 @@ +From: Marco Elver +Date: Thu, 16 Mar 2023 23:47:05 +0100 +Subject: [PATCH] kcsan: avoid passing -g for test +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 5eb39cde1e2487ba5ec1802dc5e58a77e700d99e + +commit 5eb39cde1e2487ba5ec1802dc5e58a77e700d99e upstream. + +Nathan reported that when building with GNU as and a version of clang that +defaults to DWARF5, the assembler will complain with: + + Error: non-constant .uleb128 is not supported + +This is because `-g` defaults to the compiler debug info default. If the +assembler does not support some of the directives used, the above errors +occur. To fix, remove the explicit passing of `-g`. + +All the test wants is that stack traces print valid function names, and +debug info is not required for that. (I currently cannot recall why I +added the explicit `-g`.) + +Link: https://lkml.kernel.org/r/20230316224705.709984-2-elver@google.com +Fixes: 1fe84fd4a402 ("kcsan: Add test suite") +Signed-off-by: Marco Elver +Reported-by: Nathan Chancellor +Cc: Alexander Potapenko +Cc: Dmitry Vyukov +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/kcsan/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/kcsan/Makefile b/kernel/kcsan/Makefile +index 8cf70f06..a45f3dfc 100644 +--- a/kernel/kcsan/Makefile ++++ b/kernel/kcsan/Makefile +@@ -16,6 +16,6 @@ obj-y := core.o debugfs.o report.o + KCSAN_INSTRUMENT_BARRIERS_selftest.o := y + obj-$(CONFIG_KCSAN_SELFTEST) += selftest.o + +-CFLAGS_kcsan_test.o := $(CFLAGS_KCSAN) -g -fno-omit-frame-pointer ++CFLAGS_kcsan_test.o := $(CFLAGS_KCSAN) -fno-omit-frame-pointer + CFLAGS_kcsan_test.o += $(DISABLE_STRUCTLEAK_PLUGIN) + obj-$(CONFIG_KCSAN_KUNIT_TEST) += kcsan_test.o +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-206-test_maple_tree-add-more-testing-for-mas_empty_.patch b/patches.kernel.org/6.2.9-206-test_maple_tree-add-more-testing-for-mas_empty_.patch new file mode 100644 index 0000000..0e38132 --- /dev/null +++ b/patches.kernel.org/6.2.9-206-test_maple_tree-add-more-testing-for-mas_empty_.patch @@ -0,0 +1,102 @@ +From: "Liam R. Howlett" +Date: Tue, 7 Mar 2023 13:02:47 -0500 +Subject: [PATCH] test_maple_tree: add more testing for mas_empty_area() +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 4bd6dded6318dc8e2514d74868c1f8fb38b61a60 + +commit 4bd6dded6318dc8e2514d74868c1f8fb38b61a60 upstream. + +Test robust filling of an entire area of the tree, then test one beyond. +This is to test the walking back up the tree at the end of nodes and error +condition. Test inspired by the reproducer code provided by Snild Dolkow. + +The last test in the function tests for the case of a corrupted maple +state caused by the incorrect limits set during mas_skip_node(). There +needs to be a gap in the second last child and last child, but the search +must rule out the second last child's gap. This would avoid correcting +the maple state to the correct max limit and return an error. + +Link: https://lkml.kernel.org/r/20230307180247.2220303-3-Liam.Howlett@oracle.com +Cc: Snild Dolkow +Link: https://lore.kernel.org/linux-mm/cb8dc31a-fef2-1d09-f133-e9f7b9f9e77a@sony.com/ +Fixes: e15e06a83923 ("lib/test_maple_tree: add testing for maple tree") +Signed-off-by: Liam R. Howlett +Cc: Peng Zhang +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + lib/test_maple_tree.c | 48 +++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 48 insertions(+) + +diff --git a/lib/test_maple_tree.c b/lib/test_maple_tree.c +index ec847bf4..f7364b9f 100644 +--- a/lib/test_maple_tree.c ++++ b/lib/test_maple_tree.c +@@ -2602,6 +2602,49 @@ static noinline void check_empty_area_window(struct maple_tree *mt) + rcu_read_unlock(); + } + ++static noinline void check_empty_area_fill(struct maple_tree *mt) ++{ ++ const unsigned long max = 0x25D78000; ++ unsigned long size; ++ int loop, shift; ++ MA_STATE(mas, mt, 0, 0); ++ ++ mt_set_non_kernel(99999); ++ for (shift = 12; shift <= 16; shift++) { ++ loop = 5000; ++ size = 1 << shift; ++ while (loop--) { ++ mas_set(&mas, 0); ++ mas_lock(&mas); ++ MT_BUG_ON(mt, mas_empty_area(&mas, 0, max, size) != 0); ++ MT_BUG_ON(mt, mas.last != mas.index + size - 1); ++ mas_store_gfp(&mas, (void *)size, GFP_KERNEL); ++ mas_unlock(&mas); ++ mas_reset(&mas); ++ } ++ } ++ ++ /* No space left. */ ++ size = 0x1000; ++ rcu_read_lock(); ++ MT_BUG_ON(mt, mas_empty_area(&mas, 0, max, size) != -EBUSY); ++ rcu_read_unlock(); ++ ++ /* Fill a depth 3 node to the maximum */ ++ for (unsigned long i = 629440511; i <= 629440800; i += 6) ++ mtree_store_range(mt, i, i + 5, (void *)i, GFP_KERNEL); ++ /* Make space in the second-last depth 4 node */ ++ mtree_erase(mt, 631668735); ++ /* Make space in the last depth 4 node */ ++ mtree_erase(mt, 629506047); ++ mas_reset(&mas); ++ /* Search from just after the gap in the second-last depth 4 */ ++ rcu_read_lock(); ++ MT_BUG_ON(mt, mas_empty_area(&mas, 629506048, 690000000, 0x5000) != 0); ++ rcu_read_unlock(); ++ mt_set_non_kernel(0); ++} ++ + static DEFINE_MTREE(tree); + static int maple_tree_seed(void) + { +@@ -2854,6 +2897,11 @@ static int maple_tree_seed(void) + check_empty_area_window(&tree); + mtree_destroy(&tree); + ++ mt_init_flags(&tree, MT_FLAGS_ALLOC_RANGE); ++ check_empty_area_fill(&tree); ++ mtree_destroy(&tree); ++ ++ + #if defined(BENCH) + skip: + #endif +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-207-maple_tree-fix-mas_skip_node-end-slot-detection.patch b/patches.kernel.org/6.2.9-207-maple_tree-fix-mas_skip_node-end-slot-detection.patch new file mode 100644 index 0000000..7b4f207 --- /dev/null +++ b/patches.kernel.org/6.2.9-207-maple_tree-fix-mas_skip_node-end-slot-detection.patch @@ -0,0 +1,119 @@ +From: "Liam R. Howlett" +Date: Tue, 7 Mar 2023 13:02:46 -0500 +Subject: [PATCH] maple_tree: fix mas_skip_node() end slot detection +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 0fa99fdfe1b38da396d0b2d1496a823bcd0ebea0 + +commit 0fa99fdfe1b38da396d0b2d1496a823bcd0ebea0 upstream. + +Patch series "Fix mas_skip_node() for mas_empty_area()", v2. + +mas_empty_area() was incorrectly returning an error when there was room. +The issue was tracked down to mas_skip_node() using the incorrect +end-of-slot count. Instead of using the nodes hard limit, the limit of +data should be used. + +mas_skip_node() was also setting the min and max to that of the child +node, which was unnecessary. Within these limits being set, there was +also a bug that corrupted the maple state's max if the offset was set to +the maximum node pivot. The bug was without consequence unless there was +a sufficient gap in the next child node which would cause an error to be +returned. + +This patch set fixes these errors by removing the limit setting from +mas_skip_node() and uses the mas_data_end() for slot limits, and adds +tests for all failures discovered. + + +This patch (of 2): + +mas_skip_node() is used to move the maple state to the node with a higher +limit. It does this by walking up the tree and increasing the slot count. +Since slot count may not be able to be increased, it may need to walk up +multiple times to find room to walk right to a higher limit node. The +limit of slots that was being used was the node limit and not the last +location of data in the node. This would cause the maple state to be +shifted outside actual data and enter an error state, thus returning +-EBUSY. + +The result of the incorrect error state means that mas_awalk() would +return an error instead of finding the allocation space. + +The fix is to use mas_data_end() in mas_skip_node() to detect the nodes +data end point and continue walking the tree up until it is safe to move +to a node with a higher limit. + +The walk up the tree also sets the maple state limits so remove the buggy +code from mas_skip_node(). Setting the limits had the unfortunate side +effect of triggering another bug if the parent node was full and the there +was no suitable gap in the second last child, but room in the next child. + +mas_skip_node() may also be passed a maple state in an error state from +mas_anode_descend() when no allocations are available. Return on such an +error state immediately. + +Link: https://lkml.kernel.org/r/20230307180247.2220303-1-Liam.Howlett@oracle.com +Link: https://lkml.kernel.org/r/20230307180247.2220303-2-Liam.Howlett@oracle.com +Fixes: 54a611b60590 ("Maple Tree: add new data structure") +Signed-off-by: Liam R. Howlett +Reported-by: Snild Dolkow + Link: https://lore.kernel.org/linux-mm/cb8dc31a-fef2-1d09-f133-e9f7b9f9e77a@sony.com/ +Tested-by: Snild Dolkow +Cc: Peng Zhang +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + lib/maple_tree.c | 24 +++++------------------- + 1 file changed, 5 insertions(+), 19 deletions(-) + +diff --git a/lib/maple_tree.c b/lib/maple_tree.c +index 5a976393..a63594be 100644 +--- a/lib/maple_tree.c ++++ b/lib/maple_tree.c +@@ -5093,35 +5093,21 @@ static inline bool mas_rewind_node(struct ma_state *mas) + */ + static inline bool mas_skip_node(struct ma_state *mas) + { +- unsigned char slot, slot_count; +- unsigned long *pivots; +- enum maple_type mt; ++ if (mas_is_err(mas)) ++ return false; + +- mt = mte_node_type(mas->node); +- slot_count = mt_slots[mt] - 1; + do { + if (mte_is_root(mas->node)) { +- slot = mas->offset; +- if (slot > slot_count) { ++ if (mas->offset >= mas_data_end(mas)) { + mas_set_err(mas, -EBUSY); + return false; + } + } else { + mas_ascend(mas); +- slot = mas->offset; +- mt = mte_node_type(mas->node); +- slot_count = mt_slots[mt] - 1; + } +- } while (slot > slot_count); +- +- mas->offset = ++slot; +- pivots = ma_pivots(mas_mn(mas), mt); +- if (slot > 0) +- mas->min = pivots[slot - 1] + 1; +- +- if (slot <= slot_count) +- mas->max = pivots[slot]; ++ } while (mas->offset >= mas_data_end(mas)); + ++ mas->offset++; + return true; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-208-ksmbd-fix-wrong-signingkey-creation-when-encryp.patch b/patches.kernel.org/6.2.9-208-ksmbd-fix-wrong-signingkey-creation-when-encryp.patch new file mode 100644 index 0000000..9b5d1b4 --- /dev/null +++ b/patches.kernel.org/6.2.9-208-ksmbd-fix-wrong-signingkey-creation-when-encryp.patch @@ -0,0 +1,49 @@ +From: Namjae Jeon +Date: Wed, 1 Mar 2023 00:01:21 +0900 +Subject: [PATCH] ksmbd: fix wrong signingkey creation when encryption is + AES256 +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 7a891d4b62d62566323676cb0e922ded4f37afe1 + +commit 7a891d4b62d62566323676cb0e922ded4f37afe1 upstream. + +MacOS and Win11 support AES256 encrytion and it is included in the cipher +array of encryption context. Especially on macOS, The most preferred +cipher is AES256. Connecting to ksmbd fails on newer MacOS clients that +support AES256 encryption. MacOS send disconnect request after receiving +final session setup response from ksmbd. Because final session setup is +signed with signing key was generated incorrectly. +For signging key, 'L' value should be initialized to 128 if key size is +16bytes. + +Cc: stable@vger.kernel.org +Reported-by: Miao Lihua <441884205@qq.com> +Tested-by: Miao Lihua <441884205@qq.com> +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/ksmbd/auth.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/ksmbd/auth.c b/fs/ksmbd/auth.c +index 6e61b5bc..cead696b 100644 +--- a/fs/ksmbd/auth.c ++++ b/fs/ksmbd/auth.c +@@ -727,8 +727,9 @@ static int generate_key(struct ksmbd_conn *conn, struct ksmbd_session *sess, + goto smb3signkey_ret; + } + +- if (conn->cipher_type == SMB2_ENCRYPTION_AES256_CCM || +- conn->cipher_type == SMB2_ENCRYPTION_AES256_GCM) ++ if (key_size == SMB3_ENC_DEC_KEY_SIZE && ++ (conn->cipher_type == SMB2_ENCRYPTION_AES256_CCM || ++ conn->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) + rc = crypto_shash_update(CRYPTO_HMACSHA256(ctx), L256, 4); + else + rc = crypto_shash_update(CRYPTO_HMACSHA256(ctx), L128, 4); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-209-ksmbd-set-FILE_NAMED_STREAMS-attribute-in-FS_AT.patch b/patches.kernel.org/6.2.9-209-ksmbd-set-FILE_NAMED_STREAMS-attribute-in-FS_AT.patch new file mode 100644 index 0000000..b221b93 --- /dev/null +++ b/patches.kernel.org/6.2.9-209-ksmbd-set-FILE_NAMED_STREAMS-attribute-in-FS_AT.patch @@ -0,0 +1,43 @@ +From: Namjae Jeon +Date: Wed, 1 Mar 2023 00:02:30 +0900 +Subject: [PATCH] ksmbd: set FILE_NAMED_STREAMS attribute in + FS_ATTRIBUTE_INFORMATION +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 728f14c72b71a19623df329c1c7c9d1452e56f1e + +commit 728f14c72b71a19623df329c1c7c9d1452e56f1e upstream. + +If vfs objects = streams_xattr in ksmbd.conf FILE_NAMED_STREAMS should +be set to Attributes in FS_ATTRIBUTE_INFORMATION. MacOS client show +"Format: SMB (Unknown)" on faked NTFS and no streams support. + +Cc: stable@vger.kernel.org +Reported-by: Miao Lihua <441884205@qq.com> +Tested-by: Miao Lihua <441884205@qq.com> +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/ksmbd/smb2pdu.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c +index 89724cc6..d0e76e2a 100644 +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -4956,6 +4956,10 @@ static int smb2_get_info_filesystem(struct ksmbd_work *work, + + info->Attributes |= cpu_to_le32(server_conf.share_fake_fscaps); + ++ if (test_share_config_flag(work->tcon->share_conf, ++ KSMBD_SHARE_FLAG_STREAMS)) ++ info->Attributes |= cpu_to_le32(FILE_NAMED_STREAMS); ++ + info->MaxPathNameComponentLength = cpu_to_le32(stfs.f_namelen); + len = smbConvertToUTF16((__le16 *)info->FileSystemName, + "NTFS", PATH_MAX, conn->local_nls, 0); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-210-ksmbd-don-t-terminate-inactive-sessions-after-a.patch b/patches.kernel.org/6.2.9-210-ksmbd-don-t-terminate-inactive-sessions-after-a.patch new file mode 100644 index 0000000..c47d92d --- /dev/null +++ b/patches.kernel.org/6.2.9-210-ksmbd-don-t-terminate-inactive-sessions-after-a.patch @@ -0,0 +1,162 @@ +From: Namjae Jeon +Date: Tue, 21 Mar 2023 15:25:34 +0900 +Subject: [PATCH] ksmbd: don't terminate inactive sessions after a few seconds +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: be6f42fad5f5fd1fea9d562df82c38ad6ed3bfe9 + +commit be6f42fad5f5fd1fea9d562df82c38ad6ed3bfe9 upstream. + +Steve reported that inactive sessions are terminated after a few +seconds. ksmbd terminate when receiving -EAGAIN error from +kernel_recvmsg(). -EAGAIN means there is no data available in timeout. +So ksmbd should keep connection with unlimited retries instead of +terminating inactive sessions. + +Cc: stable@vger.kernel.org +Reported-by: Steve French +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/ksmbd/connection.c | 4 ++-- + fs/ksmbd/connection.h | 3 ++- + fs/ksmbd/transport_rdma.c | 2 +- + fs/ksmbd/transport_tcp.c | 35 +++++++++++++++++++++++------------ + 4 files changed, 28 insertions(+), 16 deletions(-) + +diff --git a/fs/ksmbd/connection.c b/fs/ksmbd/connection.c +index 56be077e..0c9a5a84 100644 +--- a/fs/ksmbd/connection.c ++++ b/fs/ksmbd/connection.c +@@ -298,7 +298,7 @@ int ksmbd_conn_handler_loop(void *p) + kvfree(conn->request_buf); + conn->request_buf = NULL; + +- size = t->ops->read(t, hdr_buf, sizeof(hdr_buf)); ++ size = t->ops->read(t, hdr_buf, sizeof(hdr_buf), -1); + if (size != sizeof(hdr_buf)) + break; + +@@ -344,7 +344,7 @@ int ksmbd_conn_handler_loop(void *p) + * We already read 4 bytes to find out PDU size, now + * read in PDU + */ +- size = t->ops->read(t, conn->request_buf + 4, pdu_size); ++ size = t->ops->read(t, conn->request_buf + 4, pdu_size, 2); + if (size < 0) { + pr_err("sock_read failed: %d\n", size); + break; +diff --git a/fs/ksmbd/connection.h b/fs/ksmbd/connection.h +index 3643354a..0e3a848d 100644 +--- a/fs/ksmbd/connection.h ++++ b/fs/ksmbd/connection.h +@@ -114,7 +114,8 @@ struct ksmbd_transport_ops { + int (*prepare)(struct ksmbd_transport *t); + void (*disconnect)(struct ksmbd_transport *t); + void (*shutdown)(struct ksmbd_transport *t); +- int (*read)(struct ksmbd_transport *t, char *buf, unsigned int size); ++ int (*read)(struct ksmbd_transport *t, char *buf, ++ unsigned int size, int max_retries); + int (*writev)(struct ksmbd_transport *t, struct kvec *iovs, int niov, + int size, bool need_invalidate_rkey, + unsigned int remote_key); +diff --git a/fs/ksmbd/transport_rdma.c b/fs/ksmbd/transport_rdma.c +index 096eda9e..c06efc02 100644 +--- a/fs/ksmbd/transport_rdma.c ++++ b/fs/ksmbd/transport_rdma.c +@@ -670,7 +670,7 @@ static int smb_direct_post_recv(struct smb_direct_transport *t, + } + + static int smb_direct_read(struct ksmbd_transport *t, char *buf, +- unsigned int size) ++ unsigned int size, int unused) + { + struct smb_direct_recvmsg *recvmsg; + struct smb_direct_data_transfer *data_transfer; +diff --git a/fs/ksmbd/transport_tcp.c b/fs/ksmbd/transport_tcp.c +index 603893fd..20e85e27 100644 +--- a/fs/ksmbd/transport_tcp.c ++++ b/fs/ksmbd/transport_tcp.c +@@ -291,16 +291,18 @@ static int ksmbd_tcp_run_kthread(struct interface *iface) + + /** + * ksmbd_tcp_readv() - read data from socket in given iovec +- * @t: TCP transport instance +- * @iov_orig: base IO vector +- * @nr_segs: number of segments in base iov +- * @to_read: number of bytes to read from socket ++ * @t: TCP transport instance ++ * @iov_orig: base IO vector ++ * @nr_segs: number of segments in base iov ++ * @to_read: number of bytes to read from socket ++ * @max_retries: maximum retry count + * + * Return: on success return number of bytes read from socket, + * otherwise return error number + */ + static int ksmbd_tcp_readv(struct tcp_transport *t, struct kvec *iov_orig, +- unsigned int nr_segs, unsigned int to_read) ++ unsigned int nr_segs, unsigned int to_read, ++ int max_retries) + { + int length = 0; + int total_read; +@@ -308,7 +310,6 @@ static int ksmbd_tcp_readv(struct tcp_transport *t, struct kvec *iov_orig, + struct msghdr ksmbd_msg; + struct kvec *iov; + struct ksmbd_conn *conn = KSMBD_TRANS(t)->conn; +- int max_retry = 2; + + iov = get_conn_iovec(t, nr_segs); + if (!iov) +@@ -335,14 +336,23 @@ static int ksmbd_tcp_readv(struct tcp_transport *t, struct kvec *iov_orig, + } else if (conn->status == KSMBD_SESS_NEED_RECONNECT) { + total_read = -EAGAIN; + break; +- } else if ((length == -ERESTARTSYS || length == -EAGAIN) && +- max_retry) { ++ } else if (length == -ERESTARTSYS || length == -EAGAIN) { ++ /* ++ * If max_retries is negative, Allow unlimited ++ * retries to keep connection with inactive sessions. ++ */ ++ if (max_retries == 0) { ++ total_read = length; ++ break; ++ } else if (max_retries > 0) { ++ max_retries--; ++ } ++ + usleep_range(1000, 2000); + length = 0; +- max_retry--; + continue; + } else if (length <= 0) { +- total_read = -EAGAIN; ++ total_read = length; + break; + } + } +@@ -358,14 +368,15 @@ static int ksmbd_tcp_readv(struct tcp_transport *t, struct kvec *iov_orig, + * Return: on success return number of bytes read from socket, + * otherwise return error number + */ +-static int ksmbd_tcp_read(struct ksmbd_transport *t, char *buf, unsigned int to_read) ++static int ksmbd_tcp_read(struct ksmbd_transport *t, char *buf, ++ unsigned int to_read, int max_retries) + { + struct kvec iov; + + iov.iov_base = buf; + iov.iov_len = to_read; + +- return ksmbd_tcp_readv(TCP_TRANS(t), &iov, 1, to_read); ++ return ksmbd_tcp_readv(TCP_TRANS(t), &iov, 1, to_read, max_retries); + } + + static int ksmbd_tcp_writev(struct ksmbd_transport *t, struct kvec *iov, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-211-ksmbd-return-STATUS_NOT_SUPPORTED-on-unsupporte.patch b/patches.kernel.org/6.2.9-211-ksmbd-return-STATUS_NOT_SUPPORTED-on-unsupporte.patch new file mode 100644 index 0000000..964020b --- /dev/null +++ b/patches.kernel.org/6.2.9-211-ksmbd-return-STATUS_NOT_SUPPORTED-on-unsupporte.patch @@ -0,0 +1,49 @@ +From: Namjae Jeon +Date: Tue, 21 Mar 2023 15:36:40 +0900 +Subject: [PATCH] ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 + dialect +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: b53e8cfec30b93c120623232ba27c041b1ef8f1a + +commit b53e8cfec30b93c120623232ba27c041b1ef8f1a upstream. + +ksmbd returned "Input/output error" when mounting with vers=2.0 to +ksmbd. It should return STATUS_NOT_SUPPORTED on unsupported smb2.0 +dialect. + +Cc: stable@vger.kernel.org +Reported-by: Steve French +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/ksmbd/smb_common.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/ksmbd/smb_common.c b/fs/ksmbd/smb_common.c +index 2a4fbbd5..538c6151 100644 +--- a/fs/ksmbd/smb_common.c ++++ b/fs/ksmbd/smb_common.c +@@ -434,7 +434,7 @@ int ksmbd_extract_shortname(struct ksmbd_conn *conn, const char *longname, + + static int __smb2_negotiate(struct ksmbd_conn *conn) + { +- return (conn->dialect >= SMB21_PROT_ID && ++ return (conn->dialect >= SMB20_PROT_ID && + conn->dialect <= SMB311_PROT_ID); + } + +@@ -465,7 +465,7 @@ int ksmbd_smb_negotiate_common(struct ksmbd_work *work, unsigned int command) + } + } + +- if (command == SMB2_NEGOTIATE_HE && __smb2_negotiate(conn)) { ++ if (command == SMB2_NEGOTIATE_HE) { + ret = smb2_handle_negotiate(work); + init_smb2_neg_rsp(work); + return ret; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-212-ksmbd-return-unsupported-error-on-smb1-mount.patch b/patches.kernel.org/6.2.9-212-ksmbd-return-unsupported-error-on-smb1-mount.patch new file mode 100644 index 0000000..f2dfbbf --- /dev/null +++ b/patches.kernel.org/6.2.9-212-ksmbd-return-unsupported-error-on-smb1-mount.patch @@ -0,0 +1,134 @@ +From: Namjae Jeon +Date: Thu, 23 Mar 2023 21:15:52 +0900 +Subject: [PATCH] ksmbd: return unsupported error on smb1 mount +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 39b291b86b5988bf8753c3874d5c773399d09b96 + +commit 39b291b86b5988bf8753c3874d5c773399d09b96 upstream. + +ksmbd disconnect connection when mounting with vers=smb1. +ksmbd should send smb1 negotiate response to client for correct +unsupported error return. This patch add needed SMB1 macros and fill +NegProt part of the response for smb1 negotiate response. + +Cc: stable@vger.kernel.org +Reported-by: Steve French +Reviewed-by: Sergey Senozhatsky +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/ksmbd/connection.c | 7 ++----- + fs/ksmbd/smb_common.c | 23 ++++++++++++++++++++--- + fs/ksmbd/smb_common.h | 30 ++++++++---------------------- + 3 files changed, 30 insertions(+), 30 deletions(-) + +diff --git a/fs/ksmbd/connection.c b/fs/ksmbd/connection.c +index 0c9a5a84..2be9d746 100644 +--- a/fs/ksmbd/connection.c ++++ b/fs/ksmbd/connection.c +@@ -319,13 +319,10 @@ int ksmbd_conn_handler_loop(void *p) + } + + /* +- * Check if pdu size is valid (min : smb header size, +- * max : 0x00FFFFFF). ++ * Check maximum pdu size(0x00FFFFFF). + */ +- if (pdu_size < __SMB2_HEADER_STRUCTURE_SIZE || +- pdu_size > MAX_STREAM_PROT_LEN) { ++ if (pdu_size > MAX_STREAM_PROT_LEN) + break; +- } + + /* 4 for rfc1002 length field */ + size = pdu_size + 4; +diff --git a/fs/ksmbd/smb_common.c b/fs/ksmbd/smb_common.c +index 538c6151..5ab93fe0 100644 +--- a/fs/ksmbd/smb_common.c ++++ b/fs/ksmbd/smb_common.c +@@ -442,9 +442,26 @@ static int smb_handle_negotiate(struct ksmbd_work *work) + { + struct smb_negotiate_rsp *neg_rsp = work->response_buf; + +- ksmbd_debug(SMB, "Unsupported SMB protocol\n"); +- neg_rsp->hdr.Status.CifsError = STATUS_INVALID_LOGON_TYPE; +- return -EINVAL; ++ ksmbd_debug(SMB, "Unsupported SMB1 protocol\n"); ++ ++ /* ++ * Remove 4 byte direct TCP header, add 2 byte bcc and ++ * 2 byte DialectIndex. ++ */ ++ *(__be32 *)work->response_buf = ++ cpu_to_be32(sizeof(struct smb_hdr) - 4 + 2 + 2); ++ neg_rsp->hdr.Status.CifsError = STATUS_SUCCESS; ++ ++ neg_rsp->hdr.Command = SMB_COM_NEGOTIATE; ++ *(__le32 *)neg_rsp->hdr.Protocol = SMB1_PROTO_NUMBER; ++ neg_rsp->hdr.Flags = SMBFLG_RESPONSE; ++ neg_rsp->hdr.Flags2 = SMBFLG2_UNICODE | SMBFLG2_ERR_STATUS | ++ SMBFLG2_EXT_SEC | SMBFLG2_IS_LONG_NAME; ++ ++ neg_rsp->hdr.WordCount = 1; ++ neg_rsp->DialectIndex = cpu_to_le16(work->conn->dialect); ++ neg_rsp->ByteCount = 0; ++ return 0; + } + + int ksmbd_smb_negotiate_common(struct ksmbd_work *work, unsigned int command) +diff --git a/fs/ksmbd/smb_common.h b/fs/ksmbd/smb_common.h +index e663ab9e..d30ce4c1 100644 +--- a/fs/ksmbd/smb_common.h ++++ b/fs/ksmbd/smb_common.h +@@ -158,8 +158,15 @@ + + #define SMB1_PROTO_NUMBER cpu_to_le32(0x424d53ff) + #define SMB_COM_NEGOTIATE 0x72 +- + #define SMB1_CLIENT_GUID_SIZE (16) ++ ++#define SMBFLG_RESPONSE 0x80 /* this PDU is a response from server */ ++ ++#define SMBFLG2_IS_LONG_NAME cpu_to_le16(0x40) ++#define SMBFLG2_EXT_SEC cpu_to_le16(0x800) ++#define SMBFLG2_ERR_STATUS cpu_to_le16(0x4000) ++#define SMBFLG2_UNICODE cpu_to_le16(0x8000) ++ + struct smb_hdr { + __be32 smb_buf_length; + __u8 Protocol[4]; +@@ -199,28 +206,7 @@ struct smb_negotiate_req { + struct smb_negotiate_rsp { + struct smb_hdr hdr; /* wct = 17 */ + __le16 DialectIndex; /* 0xFFFF = no dialect acceptable */ +- __u8 SecurityMode; +- __le16 MaxMpxCount; +- __le16 MaxNumberVcs; +- __le32 MaxBufferSize; +- __le32 MaxRawSize; +- __le32 SessionKey; +- __le32 Capabilities; /* see below */ +- __le32 SystemTimeLow; +- __le32 SystemTimeHigh; +- __le16 ServerTimeZone; +- __u8 EncryptionKeyLength; + __le16 ByteCount; +- union { +- unsigned char EncryptionKey[8]; /* cap extended security off */ +- /* followed by Domain name - if extended security is off */ +- /* followed by 16 bytes of server GUID */ +- /* then security blob if cap_extended_security negotiated */ +- struct { +- unsigned char GUID[SMB1_CLIENT_GUID_SIZE]; +- unsigned char SecurityBlob[1]; +- } __packed extended_response; +- } __packed u; + } __packed; + + struct filesystem_attribute_info { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-213-wifi-mac80211-fix-qos-on-mesh-interfaces.patch b/patches.kernel.org/6.2.9-213-wifi-mac80211-fix-qos-on-mesh-interfaces.patch new file mode 100644 index 0000000..09a8dd4 --- /dev/null +++ b/patches.kernel.org/6.2.9-213-wifi-mac80211-fix-qos-on-mesh-interfaces.patch @@ -0,0 +1,52 @@ +From: Felix Fietkau +Date: Tue, 14 Mar 2023 10:59:50 +0100 +Subject: [PATCH] wifi: mac80211: fix qos on mesh interfaces +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 4e348c6c6e23491ae6eb5e077848a42d0562339c + +commit 4e348c6c6e23491ae6eb5e077848a42d0562339c upstream. + +When ieee80211_select_queue is called for mesh, the sta pointer is usually +NULL, since the nexthop is looked up much later in the tx path. +Explicitly check for unicast address in that case in order to make qos work +again. + +Cc: stable@vger.kernel.org +Fixes: 50e2ab392919 ("wifi: mac80211: fix queue selection for mesh/OCB interfaces") +Signed-off-by: Felix Fietkau +Link: https://lore.kernel.org/r/20230314095956.62085-1-nbd@nbd.name +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + net/mac80211/wme.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c +index a12c6363..1601be57 100644 +--- a/net/mac80211/wme.c ++++ b/net/mac80211/wme.c +@@ -147,6 +147,7 @@ u16 ieee80211_select_queue_80211(struct ieee80211_sub_if_data *sdata, + u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata, + struct sta_info *sta, struct sk_buff *skb) + { ++ const struct ethhdr *eth = (void *)skb->data; + struct mac80211_qos_map *qos_map; + bool qos; + +@@ -154,8 +155,9 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata, + skb_get_hash(skb); + + /* all mesh/ocb stations are required to support WME */ +- if (sta && (sdata->vif.type == NL80211_IFTYPE_MESH_POINT || +- sdata->vif.type == NL80211_IFTYPE_OCB)) ++ if ((sdata->vif.type == NL80211_IFTYPE_MESH_POINT && ++ !is_multicast_ether_addr(eth->h_dest)) || ++ (sdata->vif.type == NL80211_IFTYPE_OCB && sta)) + qos = true; + else if (sta) + qos = sta->sta.wme; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-214-wifi-mac80211-Serialize-ieee80211_handle_wake_t.patch b/patches.kernel.org/6.2.9-214-wifi-mac80211-Serialize-ieee80211_handle_wake_t.patch new file mode 100644 index 0000000..a9cd7d1 --- /dev/null +++ b/patches.kernel.org/6.2.9-214-wifi-mac80211-Serialize-ieee80211_handle_wake_t.patch @@ -0,0 +1,91 @@ +From: Alexander Wetzel +Date: Tue, 14 Mar 2023 22:11:22 +0100 +Subject: [PATCH] wifi: mac80211: Serialize ieee80211_handle_wake_tx_queue() +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 007ae9b268ba7553e479608cf9735d3c4672a2ab + +commit 007ae9b268ba7553e479608cf9735d3c4672a2ab upstream. + +ieee80211_handle_wake_tx_queue must not run concurrent multiple times. +It calls ieee80211_txq_schedule_start() and the drivers migrated to iTXQ +do not expect overlapping drv_tx() calls. + +This fixes 'c850e31f79f0 ("wifi: mac80211: add internal handler for +wake_tx_queue")', which introduced ieee80211_handle_wake_tx_queue. +Drivers started to use it with 'a790cc3a4fad ("wifi: mac80211: add +wake_tx_queue callback to drivers")'. +But only after fixing an independent bug with +'4444bc2116ae ("wifi: mac80211: Proper mark iTXQs for resumption")' +problematic concurrent calls really happened and exposed the initial +issue. + +Fixes: c850e31f79f0 ("wifi: mac80211: add internal handler for wake_tx_queue") +Reported-by: Thomas Mann +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217119 +Link: https://lore.kernel.org/r/b8efebc6-4399-d0b8-b2a0-66843314616b@leemhuis.info/ +Link: https://lore.kernel.org/r/b7445607128a6b9ed7c17fcdcf3679bfaf4aaea.camel@sipsolutions.net> +CC: +Signed-off-by: Alexander Wetzel +Link: https://lore.kernel.org/r/20230314211122.111688-1-alexander@wetzel-home.de +[add missing spin_lock_init() noticed by Felix] +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + net/mac80211/ieee80211_i.h | 3 +++ + net/mac80211/main.c | 2 ++ + net/mac80211/util.c | 3 +++ + 3 files changed, 8 insertions(+) + +diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h +index 7ca9bde3..ba6bbb6b 100644 +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -1285,6 +1285,9 @@ struct ieee80211_local { + struct list_head active_txqs[IEEE80211_NUM_ACS]; + u16 schedule_round[IEEE80211_NUM_ACS]; + ++ /* serializes ieee80211_handle_wake_tx_queue */ ++ spinlock_t handle_wake_tx_queue_lock; ++ + u16 airtime_flags; + u32 aql_txq_limit_low[IEEE80211_NUM_ACS]; + u32 aql_txq_limit_high[IEEE80211_NUM_ACS]; +diff --git a/net/mac80211/main.c b/net/mac80211/main.c +index 84652885..ddf2b781 100644 +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -802,6 +802,8 @@ struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len, + local->aql_threshold = IEEE80211_AQL_THRESHOLD; + atomic_set(&local->aql_total_pending_airtime, 0); + ++ spin_lock_init(&local->handle_wake_tx_queue_lock); ++ + INIT_LIST_HEAD(&local->chanctx_list); + mutex_init(&local->chanctx_mtx); + +diff --git a/net/mac80211/util.c b/net/mac80211/util.c +index 261ac667..9c219e52 100644 +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -314,6 +314,8 @@ void ieee80211_handle_wake_tx_queue(struct ieee80211_hw *hw, + struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->vif); + struct ieee80211_txq *queue; + ++ spin_lock(&local->handle_wake_tx_queue_lock); ++ + /* Use ieee80211_next_txq() for airtime fairness accounting */ + ieee80211_txq_schedule_start(hw, txq->ac); + while ((queue = ieee80211_next_txq(hw, txq->ac))) { +@@ -321,6 +323,7 @@ void ieee80211_handle_wake_tx_queue(struct ieee80211_hw *hw, + ieee80211_return_txq(hw, queue, false); + } + ieee80211_txq_schedule_end(hw, txq->ac); ++ spin_unlock(&local->handle_wake_tx_queue_lock); + } + EXPORT_SYMBOL(ieee80211_handle_wake_tx_queue); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-215-nilfs2-fix-kernel-infoleak-in-nilfs_ioctl_wrap_.patch b/patches.kernel.org/6.2.9-215-nilfs2-fix-kernel-infoleak-in-nilfs_ioctl_wrap_.patch new file mode 100644 index 0000000..0bf2398 --- /dev/null +++ b/patches.kernel.org/6.2.9-215-nilfs2-fix-kernel-infoleak-in-nilfs_ioctl_wrap_.patch @@ -0,0 +1,92 @@ +From: Ryusuke Konishi +Date: Tue, 7 Mar 2023 17:55:48 +0900 +Subject: [PATCH] nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 003587000276f81d0114b5ce773d80c119d8cb30 + +commit 003587000276f81d0114b5ce773d80c119d8cb30 upstream. + +The ioctl helper function nilfs_ioctl_wrap_copy(), which exchanges a +metadata array to/from user space, may copy uninitialized buffer regions +to user space memory for read-only ioctl commands NILFS_IOCTL_GET_SUINFO +and NILFS_IOCTL_GET_CPINFO. + +This can occur when the element size of the user space metadata given by +the v_size member of the argument nilfs_argv structure is larger than the +size of the metadata element (nilfs_suinfo structure or nilfs_cpinfo +structure) on the file system side. + +KMSAN-enabled kernels detect this issue as follows: + + BUG: KMSAN: kernel-infoleak in instrument_copy_to_user + include/linux/instrumented.h:121 [inline] + BUG: KMSAN: kernel-infoleak in _copy_to_user+0xc0/0x100 lib/usercopy.c:33 + instrument_copy_to_user include/linux/instrumented.h:121 [inline] + _copy_to_user+0xc0/0x100 lib/usercopy.c:33 + copy_to_user include/linux/uaccess.h:169 [inline] + nilfs_ioctl_wrap_copy+0x6fa/0xc10 fs/nilfs2/ioctl.c:99 + nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline] + nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290 + nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343 + __do_compat_sys_ioctl fs/ioctl.c:968 [inline] + __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910 + __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910 + do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] + __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 + do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 + do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 + entry_SYSENTER_compat_after_hwframe+0x70/0x82 + + Uninit was created at: + __alloc_pages+0x9f6/0xe90 mm/page_alloc.c:5572 + alloc_pages+0xab0/0xd80 mm/mempolicy.c:2287 + __get_free_pages+0x34/0xc0 mm/page_alloc.c:5599 + nilfs_ioctl_wrap_copy+0x223/0xc10 fs/nilfs2/ioctl.c:74 + nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline] + nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290 + nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343 + __do_compat_sys_ioctl fs/ioctl.c:968 [inline] + __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910 + __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910 + do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] + __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 + do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 + do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 + entry_SYSENTER_compat_after_hwframe+0x70/0x82 + + Bytes 16-127 of 3968 are uninitialized + ... + +This eliminates the leak issue by initializing the page allocated as +buffer using get_zeroed_page(). + +Link: https://lkml.kernel.org/r/20230307085548.6290-1-konishi.ryusuke@gmail.com +Signed-off-by: Ryusuke Konishi +Reported-by: syzbot+132fdd2f1e1805fdc591@syzkaller.appspotmail.com + Link: https://lkml.kernel.org/r/000000000000a5bd2d05f63f04ae@google.com +Tested-by: Ryusuke Konishi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/nilfs2/ioctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c +index b4041d05..ef9f9a25 100644 +--- a/fs/nilfs2/ioctl.c ++++ b/fs/nilfs2/ioctl.c +@@ -71,7 +71,7 @@ static int nilfs_ioctl_wrap_copy(struct the_nilfs *nilfs, + if (argv->v_index > ~(__u64)0 - argv->v_nmembs) + return -EINVAL; + +- buf = (void *)__get_free_pages(GFP_NOFS, 0); ++ buf = (void *)get_zeroed_page(GFP_NOFS); + if (unlikely(!buf)) + return -ENOMEM; + maxmembs = PAGE_SIZE / argv->v_size; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-216-drm-bridge-lt8912b-return-EPROBE_DEFER-if-bridg.patch b/patches.kernel.org/6.2.9-216-drm-bridge-lt8912b-return-EPROBE_DEFER-if-bridg.patch new file mode 100644 index 0000000..9a90487 --- /dev/null +++ b/patches.kernel.org/6.2.9-216-drm-bridge-lt8912b-return-EPROBE_DEFER-if-bridg.patch @@ -0,0 +1,47 @@ +From: Matheus Castello +Date: Wed, 22 Mar 2023 15:38:21 +0100 +Subject: [PATCH] drm/bridge: lt8912b: return EPROBE_DEFER if bridge is not + found +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 1a70ca89d59c7c8af006d29b965a95ede0abb0da + +commit 1a70ca89d59c7c8af006d29b965a95ede0abb0da upstream. + +Returns EPROBE_DEFER when of_drm_find_bridge() fails, this is consistent +with what all the other DRM bridge drivers are doing and this is +required since the bridge might not be there when the driver is probed +and this should not be a fatal failure. + +Cc: +Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge") +Signed-off-by: Matheus Castello +Signed-off-by: Francesco Dolcini +Reviewed-by: Laurent Pinchart +Reviewed-by: Andrzej Hajda +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230322143821.109744-1-francesco@dolcini.it +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/bridge/lontium-lt8912b.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c +index a98efef0..1b74a913 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c ++++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c +@@ -659,8 +659,8 @@ static int lt8912_parse_dt(struct lt8912 *lt) + + lt->hdmi_port = of_drm_find_bridge(port_node); + if (!lt->hdmi_port) { +- dev_err(lt->dev, "%s: Failed to get hdmi port\n", __func__); +- ret = -ENODEV; ++ ret = -EPROBE_DEFER; ++ dev_err_probe(lt->dev, ret, "%s: Failed to get hdmi port\n", __func__); + goto err_free_host_node; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-217-drm-amd-display-fix-wrong-index-used-in-dccg32_.patch b/patches.kernel.org/6.2.9-217-drm-amd-display-fix-wrong-index-used-in-dccg32_.patch new file mode 100644 index 0000000..51b4890 --- /dev/null +++ b/patches.kernel.org/6.2.9-217-drm-amd-display-fix-wrong-index-used-in-dccg32_.patch @@ -0,0 +1,46 @@ +From: Hersen Wu +Date: Thu, 9 Mar 2023 16:14:08 -0500 +Subject: [PATCH] drm/amd/display: fix wrong index used in + dccg32_set_dpstreamclk +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 4c94e57c258cb7800aa5f3a9d9597d91291407a9 + +commit 4c94e57c258cb7800aa5f3a9d9597d91291407a9 upstream. + +[Why & How] +When merging commit 9af611f29034 +("drm/amd/display: Fix DCN32 DPSTREAMCLK_CNTL programming"), +index change was not picked up. + +Cc: stable@vger.kernel.org +Cc: Mario Limonciello +Fixes: 9af611f29034 ("drm/amd/display: Fix DCN32 DPSTREAMCLK_CNTL programming") +Reviewed-by: Qingqing Zhuo +Acked-by: Qingqing Zhuo +Signed-off-by: Hersen Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c +index e4472c6b..3fb4bcc3 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c +@@ -271,8 +271,7 @@ static void dccg32_set_dpstreamclk( + dccg32_set_dtbclk_p_src(dccg, src, otg_inst); + + /* enabled to select one of the DTBCLKs for pipe */ +- switch (otg_inst) +- { ++ switch (dp_hpo_inst) { + case 0: + REG_UPDATE_2(DPSTREAMCLK_CNTL, + DPSTREAMCLK0_EN, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-218-drm-meson-fix-missing-component-unbind-on-bind-.patch b/patches.kernel.org/6.2.9-218-drm-meson-fix-missing-component-unbind-on-bind-.patch new file mode 100644 index 0000000..7f617e9 --- /dev/null +++ b/patches.kernel.org/6.2.9-218-drm-meson-fix-missing-component-unbind-on-bind-.patch @@ -0,0 +1,71 @@ +From: Johan Hovold +Date: Mon, 6 Mar 2023 11:35:33 +0100 +Subject: [PATCH] drm/meson: fix missing component unbind on bind errors +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: ba98413bf45edbf33672e2539e321b851b2cfbd1 + +commit ba98413bf45edbf33672e2539e321b851b2cfbd1 upstream. + +Make sure to unbind all subcomponents when binding the aggregate device +fails. + +Fixes: a41e82e6c457 ("drm/meson: Add support for components") +Cc: stable@vger.kernel.org # 4.12 +Cc: Neil Armstrong +Signed-off-by: Johan Hovold +Acked-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230306103533.4915-1-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/meson/meson_drv.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c +index 79bfe393..7caf937c 100644 +--- a/drivers/gpu/drm/meson/meson_drv.c ++++ b/drivers/gpu/drm/meson/meson_drv.c +@@ -325,23 +325,23 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) + + ret = meson_encoder_hdmi_init(priv); + if (ret) +- goto exit_afbcd; ++ goto unbind_all; + + ret = meson_plane_create(priv); + if (ret) +- goto exit_afbcd; ++ goto unbind_all; + + ret = meson_overlay_create(priv); + if (ret) +- goto exit_afbcd; ++ goto unbind_all; + + ret = meson_crtc_create(priv); + if (ret) +- goto exit_afbcd; ++ goto unbind_all; + + ret = request_irq(priv->vsync_irq, meson_irq, 0, drm->driver->name, drm); + if (ret) +- goto exit_afbcd; ++ goto unbind_all; + + drm_mode_config_reset(drm); + +@@ -359,6 +359,9 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) + + uninstall_irq: + free_irq(priv->vsync_irq, drm); ++unbind_all: ++ if (has_components) ++ component_unbind_all(drm->dev, drm); + exit_afbcd: + if (priv->afbcd.ops) + priv->afbcd.ops->exit(priv); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-219-drm-amdgpu-nv-Apply-ASPM-quirk-on-Intel-ADL-AMD.patch b/patches.kernel.org/6.2.9-219-drm-amdgpu-nv-Apply-ASPM-quirk-on-Intel-ADL-AMD.patch new file mode 100644 index 0000000..c61bb26 --- /dev/null +++ b/patches.kernel.org/6.2.9-219-drm-amdgpu-nv-Apply-ASPM-quirk-on-Intel-ADL-AMD.patch @@ -0,0 +1,136 @@ +From: Kai-Heng Feng +Date: Wed, 15 Mar 2023 20:07:23 +0800 +Subject: [PATCH] drm/amdgpu/nv: Apply ASPM quirk on Intel ADL + AMD Navi +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 2b072442f4962231a8516485012bb2d2551ef2fe + +commit 2b072442f4962231a8516485012bb2d2551ef2fe upstream. + +S2idle resume freeze can be observed on Intel ADL + AMD WX5500. This is +caused by commit 0064b0ce85bb ("drm/amd/pm: enable ASPM by default"). + +The root cause is still not clear for now. + +So extend and apply the ASPM quirk from commit e02fe3bc7aba +("drm/amdgpu: vi: disable ASPM on Intel Alder Lake based systems"), to +workaround the issue on Navi cards too. + +Fixes: 0064b0ce85bb ("drm/amd/pm: enable ASPM by default") +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2458 +Reviewed-by: Alex Deucher +Signed-off-by: Kai-Heng Feng +Reviewed-by: Mario Limonciello +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 15 +++++++++++++++ + drivers/gpu/drm/amd/amdgpu/nv.c | 2 +- + drivers/gpu/drm/amd/amdgpu/vi.c | 17 +---------------- + 4 files changed, 18 insertions(+), 17 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +index d148a1bd..c2d12661 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +@@ -1268,6 +1268,7 @@ void amdgpu_device_pci_config_reset(struct amdgpu_device *adev); + int amdgpu_device_pci_reset(struct amdgpu_device *adev); + bool amdgpu_device_need_post(struct amdgpu_device *adev); + bool amdgpu_device_should_use_aspm(struct amdgpu_device *adev); ++bool amdgpu_device_aspm_support_quirk(void); + + void amdgpu_cs_report_moved_bytes(struct amdgpu_device *adev, u64 num_bytes, + u64 num_vis_bytes); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index d8e79de8..d5e14a3a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -79,6 +79,10 @@ + + #include + ++#if IS_ENABLED(CONFIG_X86) ++#include ++#endif ++ + MODULE_FIRMWARE("amdgpu/vega10_gpu_info.bin"); + MODULE_FIRMWARE("amdgpu/vega12_gpu_info.bin"); + MODULE_FIRMWARE("amdgpu/raven_gpu_info.bin"); +@@ -1354,6 +1358,17 @@ bool amdgpu_device_should_use_aspm(struct amdgpu_device *adev) + return pcie_aspm_enabled(adev->pdev); + } + ++bool amdgpu_device_aspm_support_quirk(void) ++{ ++#if IS_ENABLED(CONFIG_X86) ++ struct cpuinfo_x86 *c = &cpu_data(0); ++ ++ return !(c->x86 == 6 && c->x86_model == INTEL_FAM6_ALDERLAKE); ++#else ++ return true; ++#endif ++} ++ + /* if we get transitioned to only one device, take VGA back */ + /** + * amdgpu_device_vga_set_decode - enable/disable vga decode +diff --git a/drivers/gpu/drm/amd/amdgpu/nv.c b/drivers/gpu/drm/amd/amdgpu/nv.c +index df3388e8..87798927 100644 +--- a/drivers/gpu/drm/amd/amdgpu/nv.c ++++ b/drivers/gpu/drm/amd/amdgpu/nv.c +@@ -527,7 +527,7 @@ static void nv_pcie_gen3_enable(struct amdgpu_device *adev) + + static void nv_program_aspm(struct amdgpu_device *adev) + { +- if (!amdgpu_device_should_use_aspm(adev)) ++ if (!amdgpu_device_should_use_aspm(adev) || !amdgpu_device_aspm_support_quirk()) + return; + + if (!(adev->flags & AMD_IS_APU) && +diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c +index 12ef782e..ceab8783 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vi.c ++++ b/drivers/gpu/drm/amd/amdgpu/vi.c +@@ -81,10 +81,6 @@ + #include "mxgpu_vi.h" + #include "amdgpu_dm.h" + +-#if IS_ENABLED(CONFIG_X86) +-#include +-#endif +- + #define ixPCIE_LC_L1_PM_SUBSTATE 0x100100C6 + #define PCIE_LC_L1_PM_SUBSTATE__LC_L1_SUBSTATES_OVERRIDE_EN_MASK 0x00000001L + #define PCIE_LC_L1_PM_SUBSTATE__LC_PCI_PM_L1_2_OVERRIDE_MASK 0x00000002L +@@ -1138,24 +1134,13 @@ static void vi_enable_aspm(struct amdgpu_device *adev) + WREG32_PCIE(ixPCIE_LC_CNTL, data); + } + +-static bool aspm_support_quirk_check(void) +-{ +-#if IS_ENABLED(CONFIG_X86) +- struct cpuinfo_x86 *c = &cpu_data(0); +- +- return !(c->x86 == 6 && c->x86_model == INTEL_FAM6_ALDERLAKE); +-#else +- return true; +-#endif +-} +- + static void vi_program_aspm(struct amdgpu_device *adev) + { + u32 data, data1, orig; + bool bL1SS = false; + bool bClkReqSupport = true; + +- if (!amdgpu_device_should_use_aspm(adev) || !aspm_support_quirk_check()) ++ if (!amdgpu_device_should_use_aspm(adev) || !amdgpu_device_aspm_support_quirk()) + return; + + if (adev->flags & AMD_IS_APU || +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-220-drm-i915-active-Fix-missing-debug-object-activa.patch b/patches.kernel.org/6.2.9-220-drm-i915-active-Fix-missing-debug-object-activa.patch new file mode 100644 index 0000000..1b1de2f --- /dev/null +++ b/patches.kernel.org/6.2.9-220-drm-i915-active-Fix-missing-debug-object-activa.patch @@ -0,0 +1,57 @@ +From: Nirmoy Das +Date: Tue, 14 Mar 2023 15:29:14 +0100 +Subject: [PATCH] drm/i915/active: Fix missing debug object activation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: e92eb246feb9019b0b137706c934b8891cdfe3c2 + +commit e92eb246feb9019b0b137706c934b8891cdfe3c2 upstream. + +debug_active_activate() expected ref->count to be zero +which is not true anymore as __i915_active_activate() calls +debug_active_activate() after incrementing the count. + +v2: No need to check for "ref->count == 1" as __i915_active_activate() +already make sure of that(Janusz). + +References: https://gitlab.freedesktop.org/drm/intel/-/issues/6733 +Fixes: 04240e30ed06 ("drm/i915: Skip taking acquire mutex for no ref->active callback") +Cc: Chris Wilson +Cc: Tvrtko Ursulin +Cc: Thomas Hellström +Cc: Andi Shyti +Cc: intel-gfx@lists.freedesktop.org +Cc: Janusz Krzysztofik +Cc: # v5.10+ +Signed-off-by: Nirmoy Das +Reviewed-by: Janusz Krzysztofik +Reviewed-by: Andrzej Hajda +Link: https://patchwork.freedesktop.org/patch/msgid/20230313114613.9874-1-nirmoy.das@intel.com +(cherry picked from commit bfad380c542438a9b642f8190b7fd37bc77e2723) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/i915_active.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/i915_active.c b/drivers/gpu/drm/i915/i915_active.c +index a9fea115..8ef93889 100644 +--- a/drivers/gpu/drm/i915/i915_active.c ++++ b/drivers/gpu/drm/i915/i915_active.c +@@ -92,8 +92,7 @@ static void debug_active_init(struct i915_active *ref) + static void debug_active_activate(struct i915_active *ref) + { + lockdep_assert_held(&ref->tree_lock); +- if (!atomic_read(&ref->count)) /* before the first inc */ +- debug_object_activate(ref, &active_debug_desc); ++ debug_object_activate(ref, &active_debug_desc); + } + + static void debug_active_deactivate(struct i915_active *ref) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-221-drm-i915-Preserve-crtc_state-inherited-during-s.patch b/patches.kernel.org/6.2.9-221-drm-i915-Preserve-crtc_state-inherited-during-s.patch new file mode 100644 index 0000000..d89776a --- /dev/null +++ b/patches.kernel.org/6.2.9-221-drm-i915-Preserve-crtc_state-inherited-during-s.patch @@ -0,0 +1,52 @@ +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Thu, 23 Feb 2023 17:20:48 +0200 +Subject: [PATCH] drm/i915: Preserve crtc_state->inherited during state + clearing +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 3a84f2c6c9558c554a90ec26ad25df92fc5e05b7 + +commit 3a84f2c6c9558c554a90ec26ad25df92fc5e05b7 upstream. + +intel_crtc_prepare_cleared_state() is unintentionally losing +the "inherited" flag. This will happen if intel_initial_commit() +is forced to go through the full modeset calculations for +whatever reason. + +Afterwards the first real commit from userspace will not get +forced to the full modeset path, and thus eg. audio state may +not get recomputed properly. So if the monitor was already +enabled during boot audio will not work until userspace itself +does an explicit full modeset. + +Cc: stable@vger.kernel.org +Tested-by: Lee Shawn C +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20230223152048.20878-1-ville.syrjala@linux.intel.com +Reviewed-by: Uma Shankar +(cherry picked from commit 2553bacaf953b48c59357f5a622282bc0c45adae) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/display/intel_display.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c +index dedbdb17..8b699485 100644 +--- a/drivers/gpu/drm/i915/display/intel_display.c ++++ b/drivers/gpu/drm/i915/display/intel_display.c +@@ -5195,6 +5195,7 @@ intel_crtc_prepare_cleared_state(struct intel_atomic_state *state, + * only fields that are know to not cause problems are preserved. */ + + saved_state->uapi = crtc_state->uapi; ++ saved_state->inherited = crtc_state->inherited; + saved_state->scaler_state = crtc_state->scaler_state; + saved_state->shared_dpll = crtc_state->shared_dpll; + saved_state->dpll_hw_state = crtc_state->dpll_hw_state; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-222-drm-amdgpu-skip-ASIC-reset-for-APUs-when-go-to-.patch b/patches.kernel.org/6.2.9-222-drm-amdgpu-skip-ASIC-reset-for-APUs-when-go-to-.patch new file mode 100644 index 0000000..a1a7f60 --- /dev/null +++ b/patches.kernel.org/6.2.9-222-drm-amdgpu-skip-ASIC-reset-for-APUs-when-go-to-.patch @@ -0,0 +1,53 @@ +From: Tim Huang +Date: Thu, 9 Mar 2023 16:27:51 +0800 +Subject: [PATCH] drm/amdgpu: skip ASIC reset for APUs when go to S4 +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: b589626674de94d977e81c99bf7905872b991197 + +commit b589626674de94d977e81c99bf7905872b991197 upstream. + +For GC IP v11.0.4/11, PSP TMR need to be reserved +for ASIC mode2 reset. But for S4, when psp suspend, +it will destroy the TMR that fails the ASIC reset. + +[ 96.006101] amdgpu 0000:62:00.0: amdgpu: MODE2 reset +[ 100.409717] amdgpu 0000:62:00.0: amdgpu: SMU: I'm not done with your previous command: SMN_C2PMSG_66:0x00000011 SMN_C2PMSG_82:0x00000002 +[ 100.411593] amdgpu 0000:62:00.0: amdgpu: Mode2 reset failed! +[ 100.412470] amdgpu 0000:62:00.0: PM: pci_pm_freeze(): amdgpu_pmops_freeze+0x0/0x50 [amdgpu] returns -62 +[ 100.414020] amdgpu 0000:62:00.0: PM: dpm_run_callback(): pci_pm_freeze+0x0/0xd0 returns -62 +[ 100.415311] amdgpu 0000:62:00.0: PM: pci_pm_freeze+0x0/0xd0 returned -62 after 4623202 usecs +[ 100.416608] amdgpu 0000:62:00.0: PM: failed to freeze async: error -62 + +We can skip the reset on APUs, assuming we can resume them +properly. Verified on some GFX11, GFX10 and old GFX9 APUs. + +Signed-off-by: Tim Huang +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.1.x +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +index 7f598977..d9e8579e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -2457,7 +2457,10 @@ static int amdgpu_pmops_freeze(struct device *dev) + adev->in_s4 = false; + if (r) + return r; +- return amdgpu_asic_reset(adev); ++ ++ if (amdgpu_acpi_should_gpu_reset(adev)) ++ return amdgpu_asic_reset(adev); ++ return 0; + } + + static int amdgpu_pmops_thaw(struct device *dev) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-223-drm-amdgpu-reposition-the-gpu-reset-checking-fo.patch b/patches.kernel.org/6.2.9-223-drm-amdgpu-reposition-the-gpu-reset-checking-fo.patch new file mode 100644 index 0000000..892b9f9 --- /dev/null +++ b/patches.kernel.org/6.2.9-223-drm-amdgpu-reposition-the-gpu-reset-checking-fo.patch @@ -0,0 +1,114 @@ +From: Tim Huang +Date: Wed, 15 Mar 2023 15:52:09 +0800 +Subject: [PATCH] drm/amdgpu: reposition the gpu reset checking for reuse +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: aaee0ce460b954e08b6e630d7e54b2abb672feb8 + +commit aaee0ce460b954e08b6e630d7e54b2abb672feb8 upstream. + +Move the amdgpu_acpi_should_gpu_reset out of +CONFIG_SUSPEND to share it with hibernate case. + +Signed-off-by: Tim Huang +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.1.x +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdgpu/amdgpu.h | 4 +-- + drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 41 +++++++++++++----------- + 2 files changed, 25 insertions(+), 20 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +index c2d12661..c26e3505 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +@@ -1388,10 +1388,12 @@ int amdgpu_acpi_smart_shift_update(struct drm_device *dev, enum amdgpu_ss ss_sta + int amdgpu_acpi_pcie_notify_device_ready(struct amdgpu_device *adev); + + void amdgpu_acpi_get_backlight_caps(struct amdgpu_dm_backlight_caps *caps); ++bool amdgpu_acpi_should_gpu_reset(struct amdgpu_device *adev); + void amdgpu_acpi_detect(void); + #else + static inline int amdgpu_acpi_init(struct amdgpu_device *adev) { return 0; } + static inline void amdgpu_acpi_fini(struct amdgpu_device *adev) { } ++static inline bool amdgpu_acpi_should_gpu_reset(struct amdgpu_device *adev) { return false; } + static inline void amdgpu_acpi_detect(void) { } + static inline bool amdgpu_acpi_is_power_shift_control_supported(void) { return false; } + static inline int amdgpu_acpi_power_shift_control(struct amdgpu_device *adev, +@@ -1402,11 +1404,9 @@ static inline int amdgpu_acpi_smart_shift_update(struct drm_device *dev, + + #if defined(CONFIG_ACPI) && defined(CONFIG_SUSPEND) + bool amdgpu_acpi_is_s3_active(struct amdgpu_device *adev); +-bool amdgpu_acpi_should_gpu_reset(struct amdgpu_device *adev); + bool amdgpu_acpi_is_s0ix_active(struct amdgpu_device *adev); + #else + static inline bool amdgpu_acpi_is_s0ix_active(struct amdgpu_device *adev) { return false; } +-static inline bool amdgpu_acpi_should_gpu_reset(struct amdgpu_device *adev) { return false; } + static inline bool amdgpu_acpi_is_s3_active(struct amdgpu_device *adev) { return false; } + #endif + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +index 57b5e114..f8736920 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +@@ -971,6 +971,29 @@ static bool amdgpu_atcs_pci_probe_handle(struct pci_dev *pdev) + return true; + } + ++ ++/** ++ * amdgpu_acpi_should_gpu_reset ++ * ++ * @adev: amdgpu_device_pointer ++ * ++ * returns true if should reset GPU, false if not ++ */ ++bool amdgpu_acpi_should_gpu_reset(struct amdgpu_device *adev) ++{ ++ if (adev->flags & AMD_IS_APU) ++ return false; ++ ++ if (amdgpu_sriov_vf(adev)) ++ return false; ++ ++#if IS_ENABLED(CONFIG_SUSPEND) ++ return pm_suspend_target_state != PM_SUSPEND_TO_IDLE; ++#else ++ return true; ++#endif ++} ++ + /* + * amdgpu_acpi_detect - detect ACPI ATIF/ATCS methods + * +@@ -1042,24 +1065,6 @@ bool amdgpu_acpi_is_s3_active(struct amdgpu_device *adev) + (pm_suspend_target_state == PM_SUSPEND_MEM); + } + +-/** +- * amdgpu_acpi_should_gpu_reset +- * +- * @adev: amdgpu_device_pointer +- * +- * returns true if should reset GPU, false if not +- */ +-bool amdgpu_acpi_should_gpu_reset(struct amdgpu_device *adev) +-{ +- if (adev->flags & AMD_IS_APU) +- return false; +- +- if (amdgpu_sriov_vf(adev)) +- return false; +- +- return pm_suspend_target_state != PM_SUSPEND_TO_IDLE; +-} +- + /** + * amdgpu_acpi_is_s0ix_active + * +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-224-riscv-mm-Fix-incorrect-ASID-argument-when-flush.patch b/patches.kernel.org/6.2.9-224-riscv-mm-Fix-incorrect-ASID-argument-when-flush.patch new file mode 100644 index 0000000..33cfef3 --- /dev/null +++ b/patches.kernel.org/6.2.9-224-riscv-mm-Fix-incorrect-ASID-argument-when-flush.patch @@ -0,0 +1,69 @@ +From: Dylan Jhong +Date: Mon, 13 Mar 2023 11:49:06 +0800 +Subject: [PATCH] riscv: mm: Fix incorrect ASID argument when flushing TLB +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 9a801afd3eb95e1a89aba17321062df06fb49d98 + +commit 9a801afd3eb95e1a89aba17321062df06fb49d98 upstream. + +Currently, we pass the CONTEXTID instead of the ASID to the TLB flush +function. We should only take the ASID field to prevent from touching +the reserved bit field. + +Fixes: 3f1e782998cd ("riscv: add ASID-based tlbflushing methods") +Signed-off-by: Dylan Jhong +Reviewed-by: Sergey Matyukevich +Link: https://lore.kernel.org/r/20230313034906.2401730-1-dylan@andestech.com +Cc: stable@vger.kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/riscv/include/asm/tlbflush.h | 2 ++ + arch/riscv/mm/context.c | 2 +- + arch/riscv/mm/tlbflush.c | 2 +- + 3 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/riscv/include/asm/tlbflush.h b/arch/riscv/include/asm/tlbflush.h +index 80101938..a09196f8 100644 +--- a/arch/riscv/include/asm/tlbflush.h ++++ b/arch/riscv/include/asm/tlbflush.h +@@ -12,6 +12,8 @@ + #include + + #ifdef CONFIG_MMU ++extern unsigned long asid_mask; ++ + static inline void local_flush_tlb_all(void) + { + __asm__ __volatile__ ("sfence.vma" : : : "memory"); +diff --git a/arch/riscv/mm/context.c b/arch/riscv/mm/context.c +index 0f784e3d..12e22e73 100644 +--- a/arch/riscv/mm/context.c ++++ b/arch/riscv/mm/context.c +@@ -22,7 +22,7 @@ DEFINE_STATIC_KEY_FALSE(use_asid_allocator); + + static unsigned long asid_bits; + static unsigned long num_asids; +-static unsigned long asid_mask; ++unsigned long asid_mask; + + static atomic_long_t current_version; + +diff --git a/arch/riscv/mm/tlbflush.c b/arch/riscv/mm/tlbflush.c +index 37ed760d..ef701fa8 100644 +--- a/arch/riscv/mm/tlbflush.c ++++ b/arch/riscv/mm/tlbflush.c +@@ -42,7 +42,7 @@ static void __sbi_tlb_flush_range(struct mm_struct *mm, unsigned long start, + /* check if the tlbflush needs to be sent to other CPUs */ + broadcast = cpumask_any_but(cmask, cpuid) < nr_cpu_ids; + if (static_branch_unlikely(&use_asid_allocator)) { +- unsigned long asid = atomic_long_read(&mm->context.id); ++ unsigned long asid = atomic_long_read(&mm->context.id) & asid_mask; + + if (broadcast) { + sbi_remote_sfence_vma_asid(cmask, start, size, asid); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-225-riscv-Handle-zicsr-zifencei-issues-between-clan.patch b/patches.kernel.org/6.2.9-225-riscv-Handle-zicsr-zifencei-issues-between-clan.patch new file mode 100644 index 0000000..476b6ab --- /dev/null +++ b/patches.kernel.org/6.2.9-225-riscv-Handle-zicsr-zifencei-issues-between-clan.patch @@ -0,0 +1,131 @@ +From: Nathan Chancellor +Date: Mon, 13 Mar 2023 16:00:23 -0700 +Subject: [PATCH] riscv: Handle zicsr/zifencei issues between clang and + binutils +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: e89c2e815e76471cb507bd95728bf26da7976430 + +commit e89c2e815e76471cb507bd95728bf26da7976430 upstream. + +There are two related issues that appear in certain combinations with +clang and GNU binutils. + +The first occurs when a version of clang that supports zicsr or zifencei +via '-march=' [1] (i.e, >= 17.x) is used in combination with a version +of GNU binutils that do not recognize zicsr and zifencei in the +'-march=' value (i.e., < 2.36): + + riscv64-linux-gnu-ld: -march=rv64i2p0_m2p0_a2p0_c2p0_zicsr2p0_zifencei2p0: Invalid or unknown z ISA extension: 'zifencei' + riscv64-linux-gnu-ld: failed to merge target specific data of file fs/efivarfs/file.o + riscv64-linux-gnu-ld: -march=rv64i2p0_m2p0_a2p0_c2p0_zicsr2p0_zifencei2p0: Invalid or unknown z ISA extension: 'zifencei' + riscv64-linux-gnu-ld: failed to merge target specific data of file fs/efivarfs/super.o + +The second occurs when a version of clang that does not support zicsr or +zifencei via '-march=' (i.e., <= 16.x) is used in combination with a +version of GNU as that defaults to a newer ISA base spec, which requires +specifying zicsr and zifencei in the '-march=' value explicitly (i.e, >= +2.38): + + ../arch/riscv/kernel/kexec_relocate.S: Assembler messages: + ../arch/riscv/kernel/kexec_relocate.S:147: Error: unrecognized opcode `fence.i', extension `zifencei' required + clang-12: error: assembler command failed with exit code 1 (use -v to see invocation) + +This is the same issue addressed by commit 6df2a016c0c8 ("riscv: fix +build with binutils 2.38") (see [2] for additional information) but +older versions of clang miss out on it because the cc-option check +fails: + + clang-12: error: invalid arch name 'rv64imac_zicsr_zifencei', unsupported standard user-level extension 'zicsr' + clang-12: error: invalid arch name 'rv64imac_zicsr_zifencei', unsupported standard user-level extension 'zicsr' + +To resolve the first issue, only attempt to add zicsr and zifencei to +the march string when using the GNU assembler 2.38 or newer, which is +when the default ISA spec was updated, requiring these extensions to be +specified explicitly. LLVM implements an older version of the base +specification for all currently released versions, so these instructions +are available as part of the 'i' extension. If LLVM's implementation is +updated in the future, a CONFIG_AS_IS_LLVM condition can be added to +CONFIG_TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI. + +To resolve the second issue, use version 2.2 of the base ISA spec when +using an older version of clang that does not support zicsr or zifencei +via '-march=', as that is the spec version most compatible with the one +clang/LLVM implements and avoids the need to specify zicsr and zifencei +explicitly due to still being a part of 'i'. + +[1]: https://github.com/llvm/llvm-project/commit/22e199e6afb1263c943c0c0d4498694e15bf8a16 +[2]: https://lore.kernel.org/ZAxT7T9Xy1Fo3d5W@aurel32.net/ + +Cc: stable@vger.kernel.org +Link: https://github.com/ClangBuiltLinux/linux/issues/1808 +Co-developed-by: Conor Dooley +Signed-off-by: Conor Dooley +Signed-off-by: Nathan Chancellor +Acked-by: Conor Dooley +Link: https://lore.kernel.org/r/20230313-riscv-zicsr-zifencei-fiasco-v1-1-dd1b7840a551@kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/riscv/Kconfig | 22 ++++++++++++++++++++++ + arch/riscv/Makefile | 10 ++++++---- + 2 files changed, 28 insertions(+), 4 deletions(-) + +diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig +index ee0d39b2..08a0f0c2 100644 +--- a/arch/riscv/Kconfig ++++ b/arch/riscv/Kconfig +@@ -447,6 +447,28 @@ config TOOLCHAIN_HAS_ZIHINTPAUSE + depends on !32BIT || $(cc-option,-mabi=ilp32 -march=rv32ima_zihintpause) + depends on LLD_VERSION >= 150000 || LD_VERSION >= 23600 + ++config TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI ++ def_bool y ++ # https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=aed44286efa8ae8717a77d94b51ac3614e2ca6dc ++ depends on AS_IS_GNU && AS_VERSION >= 23800 ++ help ++ Newer binutils versions default to ISA spec version 20191213 which ++ moves some instructions from the I extension to the Zicsr and Zifencei ++ extensions. ++ ++config TOOLCHAIN_NEEDS_OLD_ISA_SPEC ++ def_bool y ++ depends on TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI ++ # https://github.com/llvm/llvm-project/commit/22e199e6afb1263c943c0c0d4498694e15bf8a16 ++ depends on CC_IS_CLANG && CLANG_VERSION < 170000 ++ help ++ Certain versions of clang do not support zicsr and zifencei via -march ++ but newer versions of binutils require it for the reasons noted in the ++ help text of CONFIG_TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI. This ++ option causes an older ISA spec compatible with these older versions ++ of clang to be passed to GAS, which has the same result as passing zicsr ++ and zifencei to -march. ++ + config FPU + bool "FPU support" + default y +diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile +index 5931a0ff..0d196e01 100644 +--- a/arch/riscv/Makefile ++++ b/arch/riscv/Makefile +@@ -57,10 +57,12 @@ riscv-march-$(CONFIG_ARCH_RV64I) := rv64ima + riscv-march-$(CONFIG_FPU) := $(riscv-march-y)fd + riscv-march-$(CONFIG_RISCV_ISA_C) := $(riscv-march-y)c + +-# Newer binutils versions default to ISA spec version 20191213 which moves some +-# instructions from the I extension to the Zicsr and Zifencei extensions. +-toolchain-need-zicsr-zifencei := $(call cc-option-yn, -march=$(riscv-march-y)_zicsr_zifencei) +-riscv-march-$(toolchain-need-zicsr-zifencei) := $(riscv-march-y)_zicsr_zifencei ++ifdef CONFIG_TOOLCHAIN_NEEDS_OLD_ISA_SPEC ++KBUILD_CFLAGS += -Wa,-misa-spec=2.2 ++KBUILD_AFLAGS += -Wa,-misa-spec=2.2 ++else ++riscv-march-$(CONFIG_TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI) := $(riscv-march-y)_zicsr_zifencei ++endif + + # Check if the toolchain supports Zicbom extension + riscv-march-$(CONFIG_TOOLCHAIN_HAS_ZICBOM) := $(riscv-march-y)_zicbom +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-226-tee-amdtee-fix-race-condition-in-amdtee_open_se.patch b/patches.kernel.org/6.2.9-226-tee-amdtee-fix-race-condition-in-amdtee_open_se.patch new file mode 100644 index 0000000..a3638be --- /dev/null +++ b/patches.kernel.org/6.2.9-226-tee-amdtee-fix-race-condition-in-amdtee_open_se.patch @@ -0,0 +1,90 @@ +From: Rijo Thomas +Date: Tue, 28 Feb 2023 15:11:20 +0530 +Subject: [PATCH] tee: amdtee: fix race condition in amdtee_open_session +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: f8502fba45bd30e1a6a354d9d898bc99d1a11e6d + +commit f8502fba45bd30e1a6a354d9d898bc99d1a11e6d upstream. + +There is a potential race condition in amdtee_open_session that may +lead to use-after-free. For instance, in amdtee_open_session() after +sess->sess_mask is set, and before setting: + + sess->session_info[i] = session_info; + +if amdtee_close_session() closes this same session, then 'sess' data +structure will be released, causing kernel panic when 'sess' is +accessed within amdtee_open_session(). + +The solution is to set the bit sess->sess_mask as the last step in +amdtee_open_session(). + +Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") +Cc: stable@vger.kernel.org +Signed-off-by: Rijo Thomas +Acked-by: Sumit Garg +Signed-off-by: Jens Wiklander +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/tee/amdtee/core.c | 29 ++++++++++++++--------------- + 1 file changed, 14 insertions(+), 15 deletions(-) + +diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c +index 297dc62b..372d6475 100644 +--- a/drivers/tee/amdtee/core.c ++++ b/drivers/tee/amdtee/core.c +@@ -267,35 +267,34 @@ int amdtee_open_session(struct tee_context *ctx, + goto out; + } + ++ /* Open session with loaded TA */ ++ handle_open_session(arg, &session_info, param); ++ if (arg->ret != TEEC_SUCCESS) { ++ pr_err("open_session failed %d\n", arg->ret); ++ handle_unload_ta(ta_handle); ++ kref_put(&sess->refcount, destroy_session); ++ goto out; ++ } ++ + /* Find an empty session index for the given TA */ + spin_lock(&sess->lock); + i = find_first_zero_bit(sess->sess_mask, TEE_NUM_SESSIONS); +- if (i < TEE_NUM_SESSIONS) ++ if (i < TEE_NUM_SESSIONS) { ++ sess->session_info[i] = session_info; ++ set_session_id(ta_handle, i, &arg->session); + set_bit(i, sess->sess_mask); ++ } + spin_unlock(&sess->lock); + + if (i >= TEE_NUM_SESSIONS) { + pr_err("reached maximum session count %d\n", TEE_NUM_SESSIONS); ++ handle_close_session(ta_handle, session_info); + handle_unload_ta(ta_handle); + kref_put(&sess->refcount, destroy_session); + rc = -ENOMEM; + goto out; + } + +- /* Open session with loaded TA */ +- handle_open_session(arg, &session_info, param); +- if (arg->ret != TEEC_SUCCESS) { +- pr_err("open_session failed %d\n", arg->ret); +- spin_lock(&sess->lock); +- clear_bit(i, sess->sess_mask); +- spin_unlock(&sess->lock); +- handle_unload_ta(ta_handle); +- kref_put(&sess->refcount, destroy_session); +- goto out; +- } +- +- sess->session_info[i] = session_info; +- set_session_id(ta_handle, i, &arg->session); + out: + free_pages((u64)ta, get_order(ta_size)); + return rc; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-227-firmware-arm_scmi-Fix-device-node-validation-fo.patch b/patches.kernel.org/6.2.9-227-firmware-arm_scmi-Fix-device-node-validation-fo.patch new file mode 100644 index 0000000..02d2335 --- /dev/null +++ b/patches.kernel.org/6.2.9-227-firmware-arm_scmi-Fix-device-node-validation-fo.patch @@ -0,0 +1,86 @@ +From: Cristian Marussi +Date: Tue, 7 Mar 2023 16:23:24 +0000 +Subject: [PATCH] firmware: arm_scmi: Fix device node validation for mailbox + transport +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 2ab4f4018cb6b8010ca5002c3bdc37783b5d28c2 + +commit 2ab4f4018cb6b8010ca5002c3bdc37783b5d28c2 upstream. + +When mailboxes are used as a transport it is possible to setup the SCMI +transport layer, depending on the underlying channels configuration, to use +one or two mailboxes, associated, respectively, to one or two, distinct, +shared memory areas: any other combination should be treated as invalid. + +Add more strict checking of SCMI mailbox transport device node descriptors. + +Fixes: 5c8a47a5a91d ("firmware: arm_scmi: Make scmi core independent of the transport type") +Cc: # 4.19 +Signed-off-by: Cristian Marussi +Link: https://lore.kernel.org/r/20230307162324.891866-1-cristian.marussi@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/firmware/arm_scmi/mailbox.c | 37 +++++++++++++++++++++++++++++ + 1 file changed, 37 insertions(+) + +diff --git a/drivers/firmware/arm_scmi/mailbox.c b/drivers/firmware/arm_scmi/mailbox.c +index 1e40cb03..a455f3c0 100644 +--- a/drivers/firmware/arm_scmi/mailbox.c ++++ b/drivers/firmware/arm_scmi/mailbox.c +@@ -52,6 +52,39 @@ static bool mailbox_chan_available(struct device *dev, int idx) + "#mbox-cells", idx, NULL); + } + ++static int mailbox_chan_validate(struct device *cdev) ++{ ++ int num_mb, num_sh, ret = 0; ++ struct device_node *np = cdev->of_node; ++ ++ num_mb = of_count_phandle_with_args(np, "mboxes", "#mbox-cells"); ++ num_sh = of_count_phandle_with_args(np, "shmem", NULL); ++ /* Bail out if mboxes and shmem descriptors are inconsistent */ ++ if (num_mb <= 0 || num_sh > 2 || num_mb != num_sh) { ++ dev_warn(cdev, "Invalid channel descriptor for '%s'\n", ++ of_node_full_name(np)); ++ return -EINVAL; ++ } ++ ++ if (num_sh > 1) { ++ struct device_node *np_tx, *np_rx; ++ ++ np_tx = of_parse_phandle(np, "shmem", 0); ++ np_rx = of_parse_phandle(np, "shmem", 1); ++ /* SCMI Tx and Rx shared mem areas have to be distinct */ ++ if (!np_tx || !np_rx || np_tx == np_rx) { ++ dev_warn(cdev, "Invalid shmem descriptor for '%s'\n", ++ of_node_full_name(np)); ++ ret = -EINVAL; ++ } ++ ++ of_node_put(np_tx); ++ of_node_put(np_rx); ++ } ++ ++ return ret; ++} ++ + static int mailbox_chan_setup(struct scmi_chan_info *cinfo, struct device *dev, + bool tx) + { +@@ -64,6 +97,10 @@ static int mailbox_chan_setup(struct scmi_chan_info *cinfo, struct device *dev, + resource_size_t size; + struct resource res; + ++ ret = mailbox_chan_validate(cdev); ++ if (ret) ++ return ret; ++ + smbox = devm_kzalloc(dev, sizeof(*smbox), GFP_KERNEL); + if (!smbox) + return -ENOMEM; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-228-arm64-dts-qcom-sc8280xp-x13s-mark-s11b-regulato.patch b/patches.kernel.org/6.2.9-228-arm64-dts-qcom-sc8280xp-x13s-mark-s11b-regulato.patch new file mode 100644 index 0000000..583e5a3 --- /dev/null +++ b/patches.kernel.org/6.2.9-228-arm64-dts-qcom-sc8280xp-x13s-mark-s11b-regulato.patch @@ -0,0 +1,41 @@ +From: Johan Hovold +Date: Wed, 22 Mar 2023 12:33:13 +0100 +Subject: [PATCH] arm64: dts: qcom: sc8280xp-x13s: mark s11b regulator as + always-on +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: b8838e653034425cd26983c7d96535e2742a6212 + +commit b8838e653034425cd26983c7d96535e2742a6212 upstream. + +The s11b supply is used by the wlan module (as well as some of the +pmics) which are not yet fully described in the devicetree. + +Mark the regulator as always-on for now. + +Fixes: 123b30a75623 ("arm64: dts: qcom: sc8280xp-x13s: enable WiFi controller") +Cc: stable@vger.kernel.org # 6.2 +Signed-off-by: Johan Hovold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230322113318.17908-2-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts +index a0eb1b34..d21bb7f3 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts ++++ b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts +@@ -186,6 +186,7 @@ vreg_s11b: smps11 { + regulator-min-microvolt = <1272000>; + regulator-max-microvolt = <1272000>; + regulator-initial-mode = ; ++ regulator-always-on; + }; + + vreg_l3b: ldo3 { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-229-arm64-dts-qcom-sc7280-Mark-PCIe-controller-as-c.patch b/patches.kernel.org/6.2.9-229-arm64-dts-qcom-sc7280-Mark-PCIe-controller-as-c.patch new file mode 100644 index 0000000..2db2adc --- /dev/null +++ b/patches.kernel.org/6.2.9-229-arm64-dts-qcom-sc7280-Mark-PCIe-controller-as-c.patch @@ -0,0 +1,42 @@ +From: Krishna chaitanya chundru +Date: Tue, 28 Feb 2023 17:19:12 +0530 +Subject: [PATCH] arm64: dts: qcom: sc7280: Mark PCIe controller as cache + coherent +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 8a63441e83724fee1ef3fd37b237d40d90780766 + +commit 8a63441e83724fee1ef3fd37b237d40d90780766 upstream. + +If the controller is not marked as cache coherent, then kernel will +try to ensure coherency during dma-ops and that may cause data corruption. +So, mark the PCIe node as dma-coherent as the devices on PCIe bus are +cache coherent. + +Cc: stable@vger.kernel.org +Fixes: 92e0ee9f83b3 ("arm64: dts: qcom: sc7280: Add PCIe and PHY related node") +Signed-off-by: Krishna chaitanya chundru +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/1677584952-17496-1-git-send-email-quic_krichai@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi +index 3bedd45e..a407cd25 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi +@@ -2122,6 +2122,8 @@ pcie1: pci@1c08000 { + pinctrl-names = "default"; + pinctrl-0 = <&pcie1_clkreq_n>; + ++ dma-coherent; ++ + iommus = <&apps_smmu 0x1c80 0x1>; + + iommu-map = <0x0 &apps_smmu 0x1c80 0x1>, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-230-arm64-dts-qcom-sm8150-Fix-the-iommu-mask-used-f.patch b/patches.kernel.org/6.2.9-230-arm64-dts-qcom-sm8150-Fix-the-iommu-mask-used-f.patch new file mode 100644 index 0000000..d77624c --- /dev/null +++ b/patches.kernel.org/6.2.9-230-arm64-dts-qcom-sm8150-Fix-the-iommu-mask-used-f.patch @@ -0,0 +1,52 @@ +From: Manivannan Sadhasivam +Date: Fri, 24 Feb 2023 13:30:45 +0530 +Subject: [PATCH] arm64: dts: qcom: sm8150: Fix the iommu mask used for PCIe + controllers +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 672a58fc7c477e59981653a11241566870fff852 + +commit 672a58fc7c477e59981653a11241566870fff852 upstream. + +The iommu mask should be 0x3f as per Qualcomm internal documentation. +Without the correct mask, the PCIe transactions from the endpoint will +result in SMMU faults. Hence, fix it! + +Cc: stable@vger.kernel.org # 5.19 +Fixes: a1c86c680533 ("arm64: dts: qcom: sm8150: Add PCIe nodes") +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Konrad Dybcio +Reviewed-by: Bhupesh Sharma +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230224080045.6577-1-manivannan.sadhasivam@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sm8150.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi +index a0c57fb7..f790223e 100644 +--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi +@@ -1810,7 +1810,7 @@ pcie0: pci@1c00000 { + "slave_q2a", + "tbu"; + +- iommus = <&apps_smmu 0x1d80 0x7f>; ++ iommus = <&apps_smmu 0x1d80 0x3f>; + iommu-map = <0x0 &apps_smmu 0x1d80 0x1>, + <0x100 &apps_smmu 0x1d81 0x1>; + +@@ -1909,7 +1909,7 @@ pcie1: pci@1c08000 { + assigned-clocks = <&gcc GCC_PCIE_1_AUX_CLK>; + assigned-clock-rates = <19200000>; + +- iommus = <&apps_smmu 0x1e00 0x7f>; ++ iommus = <&apps_smmu 0x1e00 0x3f>; + iommu-map = <0x0 &apps_smmu 0x1e00 0x1>, + <0x100 &apps_smmu 0x1e01 0x1>; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-231-soc-qcom-llcc-Fix-slice-configuration-values-fo.patch b/patches.kernel.org/6.2.9-231-soc-qcom-llcc-Fix-slice-configuration-values-fo.patch new file mode 100644 index 0000000..f4e0b36 --- /dev/null +++ b/patches.kernel.org/6.2.9-231-soc-qcom-llcc-Fix-slice-configuration-values-fo.patch @@ -0,0 +1,51 @@ +From: Abel Vesa +Date: Mon, 6 Mar 2023 15:55:27 +0200 +Subject: [PATCH] soc: qcom: llcc: Fix slice configuration values for SC8280XP +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 77bf4b3ed42e31d29b255fcd6530fb7a1e217e89 + +commit 77bf4b3ed42e31d29b255fcd6530fb7a1e217e89 upstream. + +The slice IDs for CVPFW, CPUSS1 and CPUWHT currently overflow the 32bit +LLCC config registers, which means it is writing beyond the upper limit +of the ATTR0_CFGn and ATTR1_CFGn range of registers. But the most obvious +impact is the fact that the mentioned slices do not get configured at all, +which will result in reduced performance. Fix that by using the slice ID +values taken from the latest LLCC SC table. + +Fixes: ec69dfbdc426 ("soc: qcom: llcc: Add sc8180x and sc8280xp configurations") +Cc: stable@vger.kernel.org # 5.19+ +Signed-off-by: Abel Vesa +Tested-by: Juerg Haefliger +Reviewed-by: Sai Prakash Ranjan +Acked-by: Konrad Dybcio +Reviewed-by: Johan Hovold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230306135527.509796-1-abel.vesa@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/soc/qcom/llcc-qcom.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/soc/qcom/llcc-qcom.c b/drivers/soc/qcom/llcc-qcom.c +index 23ce2f78..26efe120 100644 +--- a/drivers/soc/qcom/llcc-qcom.c ++++ b/drivers/soc/qcom/llcc-qcom.c +@@ -191,9 +191,9 @@ static const struct llcc_slice_config sc8280xp_data[] = { + { LLCC_CVP, 28, 512, 3, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 }, + { LLCC_APTCM, 30, 1024, 3, 1, 0x0, 0x1, 1, 0, 0, 1, 0, 0 }, + { LLCC_WRCACHE, 31, 1024, 1, 1, 0xfff, 0x0, 0, 0, 0, 0, 1, 0 }, +- { LLCC_CVPFW, 32, 512, 1, 0, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 }, +- { LLCC_CPUSS1, 33, 2048, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 }, +- { LLCC_CPUHWT, 36, 512, 1, 1, 0xfff, 0x0, 0, 0, 0, 0, 1, 0 }, ++ { LLCC_CVPFW, 17, 512, 1, 0, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 }, ++ { LLCC_CPUSS1, 3, 2048, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 }, ++ { LLCC_CPUHWT, 5, 512, 1, 1, 0xfff, 0x0, 0, 0, 0, 0, 1, 0 }, + }; + + static const struct llcc_slice_config sdm845_data[] = { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-232-mm-ksm-fix-race-with-VMA-iteration-and-mm_struc.patch b/patches.kernel.org/6.2.9-232-mm-ksm-fix-race-with-VMA-iteration-and-mm_struc.patch new file mode 100644 index 0000000..07349af --- /dev/null +++ b/patches.kernel.org/6.2.9-232-mm-ksm-fix-race-with-VMA-iteration-and-mm_struc.patch @@ -0,0 +1,70 @@ +From: "Liam R. Howlett" +Date: Wed, 8 Mar 2023 17:03:10 -0500 +Subject: [PATCH] mm/ksm: fix race with VMA iteration and mm_struct teardown +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 6db504ce55bdbc575723938fc480713c9183f6a2 + +commit 6db504ce55bdbc575723938fc480713c9183f6a2 upstream. + +exit_mmap() will tear down the VMAs and maple tree with the mmap_lock held +in write mode. Ensure that the maple tree is still valid by checking +ksm_test_exit() after taking the mmap_lock in read mode, but before the +for_each_vma() iterator dereferences a destroyed maple tree. + +Since the maple tree is destroyed, the flags telling lockdep to check an +external lock has been cleared. Skip the for_each_vma() iterator to avoid +dereferencing a maple tree without the external lock flag, which would +create a lockdep warning. + +Link: https://lkml.kernel.org/r/20230308220310.3119196-1-Liam.Howlett@oracle.com +Fixes: a5f18ba07276 ("mm/ksm: use vma iterators instead of vma linked list") +Signed-off-by: Liam R. Howlett +Reported-by: Pengfei Xu + Link: https://lore.kernel.org/lkml/ZAdUUhSbaa6fHS36@xpf.sh.intel.com/ +Reported-by: syzbot+2ee18845e89ae76342c5@syzkaller.appspotmail.com + Link: https://syzkaller.appspot.com/bug?id=64a3e95957cd3deab99df7cd7b5a9475af92c93e +Acked-by: David Hildenbrand +Cc: Matthew Wilcox (Oracle) +Cc: +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + mm/ksm.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/mm/ksm.c b/mm/ksm.c +index addf490d..83450d32 100644 +--- a/mm/ksm.c ++++ b/mm/ksm.c +@@ -988,9 +988,15 @@ static int unmerge_and_remove_all_rmap_items(void) + + mm = mm_slot->slot.mm; + mmap_read_lock(mm); ++ ++ /* ++ * Exit right away if mm is exiting to avoid lockdep issue in ++ * the maple tree ++ */ ++ if (ksm_test_exit(mm)) ++ goto mm_exiting; ++ + for_each_vma(vmi, vma) { +- if (ksm_test_exit(mm)) +- break; + if (!(vma->vm_flags & VM_MERGEABLE) || !vma->anon_vma) + continue; + err = unmerge_ksm_pages(vma, +@@ -999,6 +1005,7 @@ static int unmerge_and_remove_all_rmap_items(void) + goto error; + } + ++mm_exiting: + remove_trailing_rmap_items(&mm_slot->rmap_list); + mmap_read_unlock(mm); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-233-bus-imx-weim-fix-branch-condition-evaluates-to-.patch b/patches.kernel.org/6.2.9-233-bus-imx-weim-fix-branch-condition-evaluates-to-.patch new file mode 100644 index 0000000..1e7d117 --- /dev/null +++ b/patches.kernel.org/6.2.9-233-bus-imx-weim-fix-branch-condition-evaluates-to-.patch @@ -0,0 +1,46 @@ +From: Ivan Bornyakov +Date: Mon, 6 Mar 2023 16:25:26 +0300 +Subject: [PATCH] bus: imx-weim: fix branch condition evaluates to a garbage + value +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 1adab2922c58e7ff4fa9f0b43695079402cce876 + +commit 1adab2922c58e7ff4fa9f0b43695079402cce876 upstream. + +If bus type is other than imx50_weim_devtype and have no child devices, +variable 'ret' in function weim_parse_dt() will not be initialized, but +will be used as branch condition and return value. Fix this by +initializing 'ret' with 0. + +This was discovered with help of clang-analyzer, but the situation is +quite possible in real life. + +Fixes: 52c47b63412b ("bus: imx-weim: improve error handling upon child probe-failure") +Signed-off-by: Ivan Bornyakov +Cc: stable@vger.kernel.org +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/bus/imx-weim.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bus/imx-weim.c b/drivers/bus/imx-weim.c +index 828c66bb..55d917bd 100644 +--- a/drivers/bus/imx-weim.c ++++ b/drivers/bus/imx-weim.c +@@ -204,8 +204,8 @@ static int weim_parse_dt(struct platform_device *pdev) + const struct of_device_id *of_id = of_match_device(weim_id_table, + &pdev->dev); + const struct imx_weim_devtype *devtype = of_id->data; ++ int ret = 0, have_child = 0; + struct device_node *child; +- int ret, have_child = 0; + struct weim_priv *priv; + void __iomem *base; + u32 reg; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-234-i2c-xgene-slimpro-Fix-out-of-bounds-bug-in-xgen.patch b/patches.kernel.org/6.2.9-234-i2c-xgene-slimpro-Fix-out-of-bounds-bug-in-xgen.patch new file mode 100644 index 0000000..1240fe6 --- /dev/null +++ b/patches.kernel.org/6.2.9-234-i2c-xgene-slimpro-Fix-out-of-bounds-bug-in-xgen.patch @@ -0,0 +1,44 @@ +From: Wei Chen +Date: Tue, 14 Mar 2023 16:54:21 +0000 +Subject: [PATCH] i2c: xgene-slimpro: Fix out-of-bounds bug in + xgene_slimpro_i2c_xfer() +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 92fbb6d1296f81f41f65effd7f5f8c0f74943d15 + +commit 92fbb6d1296f81f41f65effd7f5f8c0f74943d15 upstream. + +The data->block[0] variable comes from user and is a number between +0-255. Without proper check, the variable may be very large to cause +an out-of-bounds when performing memcpy in slimpro_i2c_blkwr. + +Fix this bug by checking the value of writelen. + +Fixes: f6505fbabc42 ("i2c: add SLIMpro I2C device driver on APM X-Gene platform") +Signed-off-by: Wei Chen +Cc: stable@vger.kernel.org +Reviewed-by: Andi Shyti +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/i2c/busses/i2c-xgene-slimpro.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-xgene-slimpro.c b/drivers/i2c/busses/i2c-xgene-slimpro.c +index 63259b3e..3538d363 100644 +--- a/drivers/i2c/busses/i2c-xgene-slimpro.c ++++ b/drivers/i2c/busses/i2c-xgene-slimpro.c +@@ -308,6 +308,9 @@ static int slimpro_i2c_blkwr(struct slimpro_i2c_dev *ctx, u32 chip, + u32 msg[3]; + int rc; + ++ if (writelen > I2C_SMBUS_BLOCK_MAX) ++ return -EINVAL; ++ + memcpy(ctx->dma_buffer, data, writelen); + paddr = dma_map_single(ctx->dev, ctx->dma_buffer, writelen, + DMA_TO_DEVICE); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-235-dm-stats-check-for-and-propagate-alloc_percpu-f.patch b/patches.kernel.org/6.2.9-235-dm-stats-check-for-and-propagate-alloc_percpu-f.patch new file mode 100644 index 0000000..cb96821 --- /dev/null +++ b/patches.kernel.org/6.2.9-235-dm-stats-check-for-and-propagate-alloc_percpu-f.patch @@ -0,0 +1,89 @@ +From: Jiasheng Jiang +Date: Thu, 16 Mar 2023 14:55:06 +0800 +Subject: [PATCH] dm stats: check for and propagate alloc_percpu failure +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: d3aa3e060c4a80827eb801fc448debc9daa7c46b + +commit d3aa3e060c4a80827eb801fc448debc9daa7c46b upstream. + +Check alloc_precpu()'s return value and return an error from +dm_stats_init() if it fails. Update alloc_dev() to fail if +dm_stats_init() does. + +Otherwise, a NULL pointer dereference will occur in dm_stats_cleanup() +even if dm-stats isn't being actively used. + +Fixes: fd2ed4d25270 ("dm: add statistics support") +Cc: stable@vger.kernel.org +Signed-off-by: Jiasheng Jiang +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/md/dm-stats.c | 7 ++++++- + drivers/md/dm-stats.h | 2 +- + drivers/md/dm.c | 4 +++- + 3 files changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c +index f105a719..d12ba9bc 100644 +--- a/drivers/md/dm-stats.c ++++ b/drivers/md/dm-stats.c +@@ -188,7 +188,7 @@ static int dm_stat_in_flight(struct dm_stat_shared *shared) + atomic_read(&shared->in_flight[WRITE]); + } + +-void dm_stats_init(struct dm_stats *stats) ++int dm_stats_init(struct dm_stats *stats) + { + int cpu; + struct dm_stats_last_position *last; +@@ -197,11 +197,16 @@ void dm_stats_init(struct dm_stats *stats) + INIT_LIST_HEAD(&stats->list); + stats->precise_timestamps = false; + stats->last = alloc_percpu(struct dm_stats_last_position); ++ if (!stats->last) ++ return -ENOMEM; ++ + for_each_possible_cpu(cpu) { + last = per_cpu_ptr(stats->last, cpu); + last->last_sector = (sector_t)ULLONG_MAX; + last->last_rw = UINT_MAX; + } ++ ++ return 0; + } + + void dm_stats_cleanup(struct dm_stats *stats) +diff --git a/drivers/md/dm-stats.h b/drivers/md/dm-stats.h +index 09c81a1e..ee32b099 100644 +--- a/drivers/md/dm-stats.h ++++ b/drivers/md/dm-stats.h +@@ -21,7 +21,7 @@ struct dm_stats_aux { + unsigned long long duration_ns; + }; + +-void dm_stats_init(struct dm_stats *st); ++int dm_stats_init(struct dm_stats *st); + void dm_stats_cleanup(struct dm_stats *st); + + struct mapped_device; +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index fdcf4255..fc953013 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -2092,7 +2092,9 @@ static struct mapped_device *alloc_dev(int minor) + if (!md->pending_io) + goto bad; + +- dm_stats_init(&md->stats); ++ r = dm_stats_init(&md->stats); ++ if (r < 0) ++ goto bad; + + /* Populate the mapping, nobody knows we exist yet */ + spin_lock(&_minor_lock); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-236-dm-crypt-add-cond_resched-to-dmcrypt_write.patch b/patches.kernel.org/6.2.9-236-dm-crypt-add-cond_resched-to-dmcrypt_write.patch new file mode 100644 index 0000000..21c26d1 --- /dev/null +++ b/patches.kernel.org/6.2.9-236-dm-crypt-add-cond_resched-to-dmcrypt_write.patch @@ -0,0 +1,51 @@ +From: Mikulas Patocka +Date: Mon, 6 Mar 2023 11:17:58 -0500 +Subject: [PATCH] dm crypt: add cond_resched() to dmcrypt_write() +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: fb294b1c0ba982144ca467a75e7d01ff26304e2b + +commit fb294b1c0ba982144ca467a75e7d01ff26304e2b upstream. + +The loop in dmcrypt_write may be running for unbounded amount of time, +thus we need cond_resched() in it. + +This commit fixes the following warning: + +[ 3391.153255][ C12] watchdog: BUG: soft lockup - CPU#12 stuck for 23s! [dmcrypt_write/2:2897] +... +[ 3391.387210][ C12] Call trace: +[ 3391.390338][ C12] blk_attempt_bio_merge.part.6+0x38/0x158 +[ 3391.395970][ C12] blk_attempt_plug_merge+0xc0/0x1b0 +[ 3391.401085][ C12] blk_mq_submit_bio+0x398/0x550 +[ 3391.405856][ C12] submit_bio_noacct+0x308/0x380 +[ 3391.410630][ C12] dmcrypt_write+0x1e4/0x208 [dm_crypt] +[ 3391.416005][ C12] kthread+0x130/0x138 +[ 3391.419911][ C12] ret_from_fork+0x10/0x18 + +Reported-by: yangerkun +Fixes: dc2676210c42 ("dm crypt: offload writes to thread") +Cc: stable@vger.kernel.org +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/md/dm-crypt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 2653516b..6c43ac38 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -1933,6 +1933,7 @@ static int dmcrypt_write(void *data) + io = crypt_io_from_node(rb_first(&write_tree)); + rb_erase(&io->rb_node, &write_tree); + kcryptd_io_write(io); ++ cond_resched(); + } while (!RB_EMPTY_ROOT(&write_tree)); + blk_finish_plug(&plug); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-237-dm-crypt-avoid-accessing-uninitialized-tasklet.patch b/patches.kernel.org/6.2.9-237-dm-crypt-avoid-accessing-uninitialized-tasklet.patch new file mode 100644 index 0000000..37d28e9 --- /dev/null +++ b/patches.kernel.org/6.2.9-237-dm-crypt-avoid-accessing-uninitialized-tasklet.patch @@ -0,0 +1,87 @@ +From: Mike Snitzer +Date: Wed, 8 Mar 2023 14:39:54 -0500 +Subject: [PATCH] dm crypt: avoid accessing uninitialized tasklet +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: d9a02e016aaf5a57fb44e9a5e6da8ccd3b9e2e70 + +commit d9a02e016aaf5a57fb44e9a5e6da8ccd3b9e2e70 upstream. + +When neither "no_read_workqueue" nor "no_write_workqueue" are enabled, +tasklet_trylock() in crypt_dec_pending() may still return false due to +an uninitialized state, and dm-crypt will unnecessarily do io completion +in io_queue workqueue instead of current context. + +Fix this by adding an 'in_tasklet' flag to dm_crypt_io struct and +initialize it to false in crypt_io_init(). Set this flag to true in +kcryptd_queue_crypt() before calling tasklet_schedule(). If set +crypt_dec_pending() will punt io completion to a workqueue. + +This also nicely avoids the tasklet_trylock/unlock hack when tasklets +aren't in use. + +Fixes: 8e14f610159d ("dm crypt: do not call bio_endio() from the dm-crypt tasklet") +Cc: stable@vger.kernel.org +Reported-by: Hou Tao +Suggested-by: Ignat Korchagin +Reviewed-by: Ignat Korchagin +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/md/dm-crypt.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 6c43ac38..dc2d0d61 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -71,7 +71,9 @@ struct dm_crypt_io { + struct crypt_config *cc; + struct bio *base_bio; + u8 *integrity_metadata; +- bool integrity_metadata_from_pool; ++ bool integrity_metadata_from_pool:1; ++ bool in_tasklet:1; ++ + struct work_struct work; + struct tasklet_struct tasklet; + +@@ -1728,6 +1730,7 @@ static void crypt_io_init(struct dm_crypt_io *io, struct crypt_config *cc, + io->ctx.r.req = NULL; + io->integrity_metadata = NULL; + io->integrity_metadata_from_pool = false; ++ io->in_tasklet = false; + atomic_set(&io->io_pending, 0); + } + +@@ -1773,14 +1776,13 @@ static void crypt_dec_pending(struct dm_crypt_io *io) + * our tasklet. In this case we need to delay bio_endio() + * execution to after the tasklet is done and dequeued. + */ +- if (tasklet_trylock(&io->tasklet)) { +- tasklet_unlock(&io->tasklet); +- bio_endio(base_bio); ++ if (io->in_tasklet) { ++ INIT_WORK(&io->work, kcryptd_io_bio_endio); ++ queue_work(cc->io_queue, &io->work); + return; + } + +- INIT_WORK(&io->work, kcryptd_io_bio_endio); +- queue_work(cc->io_queue, &io->work); ++ bio_endio(base_bio); + } + + /* +@@ -2229,6 +2231,7 @@ static void kcryptd_queue_crypt(struct dm_crypt_io *io) + * it is being executed with irqs disabled. + */ + if (in_hardirq() || irqs_disabled()) { ++ io->in_tasklet = true; + tasklet_init(&io->tasklet, kcryptd_crypt_tasklet, (unsigned long)&io->work); + tasklet_schedule(&io->tasklet); + return; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-238-sched-fair-sanitize-vruntime-of-entity-being-pl.patch b/patches.kernel.org/6.2.9-238-sched-fair-sanitize-vruntime-of-entity-being-pl.patch new file mode 100644 index 0000000..e839b9a --- /dev/null +++ b/patches.kernel.org/6.2.9-238-sched-fair-sanitize-vruntime-of-entity-being-pl.patch @@ -0,0 +1,71 @@ +From: Zhang Qiao +Date: Mon, 30 Jan 2023 13:22:16 +0100 +Subject: [PATCH] sched/fair: sanitize vruntime of entity being placed +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: 829c1651e9c4a6f78398d3e67651cef9bb6b42cc + +commit 829c1651e9c4a6f78398d3e67651cef9bb6b42cc upstream. + +When a scheduling entity is placed onto cfs_rq, its vruntime is pulled +to the base level (around cfs_rq->min_vruntime), so that the entity +doesn't gain extra boost when placed backwards. + +However, if the entity being placed wasn't executed for a long time, its +vruntime may get too far behind (e.g. while cfs_rq was executing a +low-weight hog), which can inverse the vruntime comparison due to s64 +overflow. This results in the entity being placed with its original +vruntime way forwards, so that it will effectively never get to the cpu. + +To prevent that, ignore the vruntime of the entity being placed if it +didn't execute for much longer than the characteristic sheduler time +scale. + +[rkagan: formatted, adjusted commit log, comments, cutoff value] +Signed-off-by: Zhang Qiao +Co-developed-by: Roman Kagan +Signed-off-by: Roman Kagan +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20230130122216.3555094-1-rkagan@amazon.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/sched/fair.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 0f873699..717c3ca9 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -4656,6 +4656,7 @@ static void + place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int initial) + { + u64 vruntime = cfs_rq->min_vruntime; ++ u64 sleep_time; + + /* + * The 'current' period is already promised to the current tasks, +@@ -4685,8 +4686,18 @@ place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int initial) + vruntime -= thresh; + } + +- /* ensure we never gain time by being placed backwards. */ +- se->vruntime = max_vruntime(se->vruntime, vruntime); ++ /* ++ * Pull vruntime of the entity being placed to the base level of ++ * cfs_rq, to prevent boosting it if placed backwards. If the entity ++ * slept for a long time, don't even try to compare its vruntime with ++ * the base as it may be too far off and the comparison may get ++ * inversed due to s64 overflow. ++ */ ++ sleep_time = rq_clock_task(rq_of(cfs_rq)) - se->exec_start; ++ if ((s64)sleep_time > 60LL * NSEC_PER_SEC) ++ se->vruntime = vruntime; ++ else ++ se->vruntime = max_vruntime(se->vruntime, vruntime); + } + + static void check_enqueue_throttle(struct cfs_rq *cfs_rq); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-239-sched-fair-Sanitize-vruntime-of-entity-being-mi.patch b/patches.kernel.org/6.2.9-239-sched-fair-Sanitize-vruntime-of-entity-being-mi.patch new file mode 100644 index 0000000..1b7eb13 --- /dev/null +++ b/patches.kernel.org/6.2.9-239-sched-fair-Sanitize-vruntime-of-entity-being-mi.patch @@ -0,0 +1,140 @@ +From: Vincent Guittot +Date: Fri, 17 Mar 2023 17:08:10 +0100 +Subject: [PATCH] sched/fair: Sanitize vruntime of entity being migrated +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: a53ce18cacb477dd0513c607f187d16f0fa96f71 + +commit a53ce18cacb477dd0513c607f187d16f0fa96f71 upstream. + +Commit 829c1651e9c4 ("sched/fair: sanitize vruntime of entity being placed") +fixes an overflowing bug, but ignore a case that se->exec_start is reset +after a migration. + +For fixing this case, we delay the reset of se->exec_start after +placing the entity which se->exec_start to detect long sleeping task. + +In order to take into account a possible divergence between the clock_task +of 2 rqs, we increase the threshold to around 104 days. + +Fixes: 829c1651e9c4 ("sched/fair: sanitize vruntime of entity being placed") +Originally-by: Zhang Qiao +Signed-off-by: Vincent Guittot +Signed-off-by: Peter Zijlstra (Intel) +Tested-by: Zhang Qiao +Link: https://lore.kernel.org/r/20230317160810.107988-1-vincent.guittot@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/sched/core.c | 3 +++ + kernel/sched/fair.c | 55 ++++++++++++++++++++++++++++++++++++--------- + 2 files changed, 47 insertions(+), 11 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 2a4918a1..9a069835 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -2082,6 +2082,9 @@ static inline void dequeue_task(struct rq *rq, struct task_struct *p, int flags) + + void activate_task(struct rq *rq, struct task_struct *p, int flags) + { ++ if (task_on_rq_migrating(p)) ++ flags |= ENQUEUE_MIGRATED; ++ + enqueue_task(rq, p, flags); + + p->on_rq = TASK_ON_RQ_QUEUED; +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 717c3ca9..e046a2bf 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -4652,11 +4652,33 @@ static void check_spread(struct cfs_rq *cfs_rq, struct sched_entity *se) + #endif + } + ++static inline bool entity_is_long_sleeper(struct sched_entity *se) ++{ ++ struct cfs_rq *cfs_rq; ++ u64 sleep_time; ++ ++ if (se->exec_start == 0) ++ return false; ++ ++ cfs_rq = cfs_rq_of(se); ++ ++ sleep_time = rq_clock_task(rq_of(cfs_rq)); ++ ++ /* Happen while migrating because of clock task divergence */ ++ if (sleep_time <= se->exec_start) ++ return false; ++ ++ sleep_time -= se->exec_start; ++ if (sleep_time > ((1ULL << 63) / scale_load_down(NICE_0_LOAD))) ++ return true; ++ ++ return false; ++} ++ + static void + place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int initial) + { + u64 vruntime = cfs_rq->min_vruntime; +- u64 sleep_time; + + /* + * The 'current' period is already promised to the current tasks, +@@ -4688,13 +4710,24 @@ place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int initial) + + /* + * Pull vruntime of the entity being placed to the base level of +- * cfs_rq, to prevent boosting it if placed backwards. If the entity +- * slept for a long time, don't even try to compare its vruntime with +- * the base as it may be too far off and the comparison may get +- * inversed due to s64 overflow. +- */ +- sleep_time = rq_clock_task(rq_of(cfs_rq)) - se->exec_start; +- if ((s64)sleep_time > 60LL * NSEC_PER_SEC) ++ * cfs_rq, to prevent boosting it if placed backwards. ++ * However, min_vruntime can advance much faster than real time, with ++ * the extreme being when an entity with the minimal weight always runs ++ * on the cfs_rq. If the waking entity slept for a long time, its ++ * vruntime difference from min_vruntime may overflow s64 and their ++ * comparison may get inversed, so ignore the entity's original ++ * vruntime in that case. ++ * The maximal vruntime speedup is given by the ratio of normal to ++ * minimal weight: scale_load_down(NICE_0_LOAD) / MIN_SHARES. ++ * When placing a migrated waking entity, its exec_start has been set ++ * from a different rq. In order to take into account a possible ++ * divergence between new and prev rq's clocks task because of irq and ++ * stolen time, we take an additional margin. ++ * So, cutting off on the sleep time of ++ * 2^63 / scale_load_down(NICE_0_LOAD) ~ 104 days ++ * should be safe. ++ */ ++ if (entity_is_long_sleeper(se)) + se->vruntime = vruntime; + else + se->vruntime = max_vruntime(se->vruntime, vruntime); +@@ -4774,6 +4807,9 @@ enqueue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags) + + if (flags & ENQUEUE_WAKEUP) + place_entity(cfs_rq, se, 0); ++ /* Entity has migrated, no longer consider this task hot */ ++ if (flags & ENQUEUE_MIGRATED) ++ se->exec_start = 0; + + check_schedstat_required(); + update_stats_enqueue_fair(cfs_rq, se, flags); +@@ -7476,9 +7512,6 @@ static void migrate_task_rq_fair(struct task_struct *p, int new_cpu) + /* Tell new CPU we are migrated */ + se->avg.last_update_time = 0; + +- /* We have migrated, no longer consider this task hot */ +- se->exec_start = 0; +- + update_scan_period(p, new_cpu); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.9-240-Linux-6.2.9.patch b/patches.kernel.org/6.2.9-240-Linux-6.2.9.patch new file mode 100644 index 0000000..459e72d --- /dev/null +++ b/patches.kernel.org/6.2.9-240-Linux-6.2.9.patch @@ -0,0 +1,42 @@ +From: Greg Kroah-Hartman +Date: Thu, 30 Mar 2023 12:51:43 +0200 +Subject: [PATCH] Linux 6.2.9 +References: bsc#1012628 +Patch-mainline: 6.2.9 +Git-commit: e128ce12e29c5a6d9a88c7b8a1c8e07402c38fed + +Link: https://lore.kernel.org/r/20230328142619.643313678@linuxfoundation.org +Tested-by: Ronald Warsow +Tested-by: Markus Reichelt +Tested-by: Justin M. Forbes +Tested-by: Shuah Khan +Tested-by: Bagas Sanjaya +Tested-by: Ron Economos +Tested-by: Chris Paterson (CIP) +Tested-by: Jon Hunter +Tested-by: Linux Kernel Functional Testing +Tested-by: Conor Dooley +Tested-by: Florian Fainelli +Tested-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Makefile b/Makefile +index 2c90d9b0..8732f720 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 6 + PATCHLEVEL = 2 +-SUBLEVEL = 8 ++SUBLEVEL = 9 + EXTRAVERSION = + NAME = Hurr durr I'ma ninja sloth + +-- +2.35.3 + diff --git a/patches.rpmify/net-wwan-t7xx-disable-Werror.patch b/patches.rpmify/net-wwan-t7xx-disable-Werror.patch index e1d0678..4979050 100644 --- a/patches.rpmify/net-wwan-t7xx-disable-Werror.patch +++ b/patches.rpmify/net-wwan-t7xx-disable-Werror.patch @@ -1,11 +1,12 @@ From: "Jiri Slaby (SUSE)" -Date: Thu, 16 Mar 2023 12:05:08 +0100 -Subject: net/wwan/t7xx: disable Werror -Patch-mainline: never, gcc will be fixed: PR#109215 +Date: Fri, 31 Mar 2023 08:35:15 +0200 +Subject: net: wwan: t7xx: do not compile with -Werror +Git-commit: 362f0b6678ad1377c322a7dd237ea6785efc7342 +Patch-mainline: 6.3-rc6 References: bsc#1209724 -The t7xx driver is built with -Werror, but this causes issues with -gcc-13: +When playing with various compilers or their versions, some choke on +the t7xx code. For example (with gcc 13): In file included from ./arch/s390/include/generated/asm/rwonce.h:1, from ../include/linux/compiler.h:247, from ../include/linux/build_bug.h:5, @@ -14,17 +15,28 @@ gcc-13: In function 'preempt_count', inlined from 't7xx_fsm_append_event' at ../drivers/net/wwan/t7xx/t7xx_state_monitor.c:439:43: ../include/asm-generic/rwonce.h:44:26: error: array subscript 0 is outside array bounds of 'const volatile int[0]' [-Werror=array-bounds=] - 44 | #define __READ_ONCE(x) (*(const volatile __unqual_scalar_typeof(x) *)&(x)) - | ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - ../include/asm-generic/rwonce.h:50:9: note: in expansion of macro '__READ_ONCE' - 50 | __READ_ONCE(x); \ - | ^~~~~~~~~~~ - ../arch/s390/include/asm/preempt.h:17:16: note: in expansion of macro 'READ_ONCE' - 17 | return READ_ONCE(S390_lowcore.preempt_count) & ~PREEMPT_NEED_RESCHED; - | ^~~~~~~~~ -Let's drop -Werror until gcc is fixed. +There is no reason for any code in the kernel to be built with -Werror +by default. Note that we have generic CONFIG_WERROR. So if anyone wants +-Werror, they can enable that. +Signed-off-by: Jiri Slaby (SUSE) +Link: https://lore.kernel.org/all/20230330232717.1f8bf5ea@kernel.org/ +Cc: Chandrashekar Devegowda +Cc: Intel Corporation +Cc: Chiranjeevi Rapolu +Cc: Liu Haijun +Cc: M Chetan Kumar +Cc: Ricardo Martinez +Cc: Loic Poulain +Cc: Sergey Ryazanov +Cc: Johannes Berg +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: netdev@vger.kernel.org +Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby --- drivers/net/wwan/t7xx/Makefile | 2 -- diff --git a/patches.rpmify/s390-reintroduce-expoline-dependence-to-scripts.patch b/patches.rpmify/s390-reintroduce-expoline-dependence-to-scripts.patch deleted file mode 100644 index bfbe644..0000000 --- a/patches.rpmify/s390-reintroduce-expoline-dependence-to-scripts.patch +++ /dev/null @@ -1,47 +0,0 @@ -From: "Jiri Slaby (SUSE)" -Date: Thu, 16 Mar 2023 12:05:08 +0100 -Subject: s390: reintroduce expoline dependence to scripts -Patch-mainline: submitted <20230316112809.7903-1-jirislaby@kernel.org> -References: s390 expolines & fixdep - -Expolines depend on scripts/basic/fixdep. And build of expolines can now -race with the fixdep build: - - make[1]: *** Deleting file 'arch/s390/lib/expoline/expoline.o' - /bin/sh: line 1: scripts/basic/fixdep: Permission denied - make[1]: *** [../scripts/Makefile.build:385: arch/s390/lib/expoline/expoline.o] Error 126 - make: *** [../arch/s390/Makefile:166: expoline_prepare] Error 2 - -The dependence was removed in the below Fixes: commit. So reintroduce -the dependence on scripts. - -Fixes: a0b0987a7811 ("s390/nospec: remove unneeded header includes") -Cc: Joe Lawrence -Cc: stable@vger.kernel.org -Cc: Heiko Carstens -Cc: Vasily Gorbik -Cc: Alexander Gordeev -Cc: Christian Borntraeger -Cc: Sven Schnelle -Cc: linux-s390@vger.kernel.org -Signed-off-by: Jiri Slaby ---- - arch/s390/Makefile | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/s390/Makefile b/arch/s390/Makefile -index b3235ab0ace8..ed646c583e4f 100644 ---- a/arch/s390/Makefile -+++ b/arch/s390/Makefile -@@ -162,7 +162,7 @@ vdso_prepare: prepare0 - - ifdef CONFIG_EXPOLINE_EXTERN - modules_prepare: expoline_prepare --expoline_prepare: -+expoline_prepare: scripts - $(Q)$(MAKE) $(build)=arch/s390/lib/expoline arch/s390/lib/expoline/expoline.o - endif - endif --- -2.40.0 - diff --git a/patches.rt/drm-i915-Don-t-disable-interrupts-on-PREEMPT_RT-duri.patch b/patches.rt/drm-i915-Don-t-disable-interrupts-on-PREEMPT_RT-duri.patch index ea419a2..dd8e304 100644 --- a/patches.rt/drm-i915-Don-t-disable-interrupts-on-PREEMPT_RT-duri.patch +++ b/patches.rt/drm-i915-Don-t-disable-interrupts-on-PREEMPT_RT-duri.patch @@ -81,8 +81,8 @@ index 037fc140b585..b617b27577ef 100644 #if IS_ENABLED(CONFIG_DRM_I915_DEBUG_VBLANK_EVADE) @@ -682,7 +686,8 @@ void intel_pipe_update_end(struct intel_crtc_state *new_crtc_state) - */ - intel_vrr_send_push(new_crtc_state); + if (new_crtc_state->seamless_m_n && intel_crtc_needs_fastset(new_crtc_state)) + intel_crtc_update_active_timings(new_crtc_state); - local_irq_enable(); + if (!IS_ENABLED(CONFIG_PREEMPT_RT)) diff --git a/patches.suse/arm64-efi-Use-SMBIOS-processor-version-to-key-off-Am.patch b/patches.suse/arm64-efi-Use-SMBIOS-processor-version-to-key-off-Am.patch deleted file mode 100644 index cbd48b2..0000000 --- a/patches.suse/arm64-efi-Use-SMBIOS-processor-version-to-key-off-Am.patch +++ /dev/null @@ -1,170 +0,0 @@ -From: Ard Biesheuvel -Date: Tue, 28 Feb 2023 17:00:49 +0100 -Subject: arm64: efi: Use SMBIOS processor version to key off Ampere quirk -Git-commit: eb684408f3ea4856639675d6465f0024e498e4b1 -Patch-mainline: 6.3-rc4 -References: bsc#1208750 - -Instead of using the SMBIOS type 1 record 'family' field, which is often -modified by OEMs, use the type 4 'processor ID' and 'processor version' -fields, which are set to a small set of probe-able values on all known -Ampere EFI systems in the field. - -Fixes: 550b33cfd4452968 ("arm64: efi: Force the use of ...") -Tested-by: Andrea Righi -Signed-off-by: Ard Biesheuvel -Signed-off-by: Jiri Slaby ---- - drivers/firmware/efi/libstub/arm64.c | 39 ++++++++++++++++++++++++------- - drivers/firmware/efi/libstub/efistub.h | 41 ++++++++++++++++++++++++++++++--- - drivers/firmware/efi/libstub/smbios.c | 13 ++++++++-- - 3 files changed, 80 insertions(+), 13 deletions(-) - ---- a/drivers/firmware/efi/libstub/arm64.c -+++ b/drivers/firmware/efi/libstub/arm64.c -@@ -16,20 +16,43 @@ - - static bool system_needs_vamap(void) - { -- const u8 *type1_family = efi_get_smbios_string(1, family); -+ const struct efi_smbios_type4_record *record; -+ const u32 __aligned(1) *socid; -+ const u8 *version; - - /* - * Ampere eMAG, Altra, and Altra Max machines crash in SetTime() if -- * SetVirtualAddressMap() has not been called prior. -+ * SetVirtualAddressMap() has not been called prior. Most Altra systems -+ * can be identified by the SMCCC soc ID, which is conveniently exposed -+ * via the type 4 SMBIOS records. Otherwise, test the processor version -+ * field. eMAG systems all appear to have the processor version field -+ * set to "eMAG". - */ -- if (!type1_family || ( -- strcmp(type1_family, "eMAG") && -- strcmp(type1_family, "Altra") && -- strcmp(type1_family, "Altra Max"))) -+ record = (struct efi_smbios_type4_record *)efi_get_smbios_record(4); -+ if (!record) - return false; - -- efi_warn("Working around broken SetVirtualAddressMap()\n"); -- return true; -+ socid = (u32 *)record->processor_id; -+ switch (*socid & 0xffff000f) { -+ static char const altra[] = "Ampere(TM) Altra(TM) Processor"; -+ static char const emag[] = "eMAG"; -+ -+ default: -+ version = efi_get_smbios_string(&record->header, 4, -+ processor_version); -+ if (!version || (strncmp(version, altra, sizeof(altra) - 1) && -+ strncmp(version, emag, sizeof(emag) - 1))) -+ break; -+ -+ fallthrough; -+ -+ case 0x0a160001: // Altra -+ case 0x0a160002: // Altra Max -+ efi_warn("Working around broken SetVirtualAddressMap()\n"); -+ return true; -+ } -+ -+ return false; - } - - efi_status_t check_platform_features(void) ---- a/drivers/firmware/efi/libstub/efistub.h -+++ b/drivers/firmware/efi/libstub/efistub.h -@@ -1054,6 +1054,8 @@ struct efi_smbios_record { - u16 handle; - }; - -+const struct efi_smbios_record *efi_get_smbios_record(u8 type); -+ - struct efi_smbios_type1_record { - struct efi_smbios_record header; - -@@ -1067,13 +1069,46 @@ struct efi_smbios_type1_record { - u8 family; - }; - --#define efi_get_smbios_string(__type, __name) ({ \ -+struct efi_smbios_type4_record { -+ struct efi_smbios_record header; -+ -+ u8 socket; -+ u8 processor_type; -+ u8 processor_family; -+ u8 processor_manufacturer; -+ u8 processor_id[8]; -+ u8 processor_version; -+ u8 voltage; -+ u16 external_clock; -+ u16 max_speed; -+ u16 current_speed; -+ u8 status; -+ u8 processor_upgrade; -+ u16 l1_cache_handle; -+ u16 l2_cache_handle; -+ u16 l3_cache_handle; -+ u8 serial_number; -+ u8 asset_tag; -+ u8 part_number; -+ u8 core_count; -+ u8 enabled_core_count; -+ u8 thread_count; -+ u16 processor_characteristics; -+ u16 processor_family2; -+ u16 core_count2; -+ u16 enabled_core_count2; -+ u16 thread_count2; -+ u16 thread_enabled; -+}; -+ -+#define efi_get_smbios_string(__record, __type, __name) ({ \ - int size = sizeof(struct efi_smbios_type ## __type ## _record); \ - int off = offsetof(struct efi_smbios_type ## __type ## _record, \ - __name); \ -- __efi_get_smbios_string(__type, off, size); \ -+ __efi_get_smbios_string((__record), __type, off, size); \ - }) - --const u8 *__efi_get_smbios_string(u8 type, int offset, int recsize); -+const u8 *__efi_get_smbios_string(const struct efi_smbios_record *record, -+ u8 type, int offset, int recsize); - - #endif ---- a/drivers/firmware/efi/libstub/smbios.c -+++ b/drivers/firmware/efi/libstub/smbios.c -@@ -22,19 +22,28 @@ struct efi_smbios_protocol { - u8 minor_version; - }; - --const u8 *__efi_get_smbios_string(u8 type, int offset, int recsize) -+const struct efi_smbios_record *efi_get_smbios_record(u8 type) - { - struct efi_smbios_record *record; - efi_smbios_protocol_t *smbios; - efi_status_t status; - u16 handle = 0xfffe; -- const u8 *strtable; - - status = efi_bs_call(locate_protocol, &EFI_SMBIOS_PROTOCOL_GUID, NULL, - (void **)&smbios) ?: - efi_call_proto(smbios, get_next, &handle, &type, &record, NULL); - if (status != EFI_SUCCESS) - return NULL; -+ return record; -+} -+ -+const u8 *__efi_get_smbios_string(const struct efi_smbios_record *record, -+ u8 type, int offset, int recsize) -+{ -+ const u8 *strtable; -+ -+ if (!record) -+ return NULL; - - strtable = (u8 *)record + record->length; - for (int i = 1; i < ((u8 *)record)[offset]; i++) { diff --git a/patches.suse/ath11k-pci-Add-more-MODULE_FIRMWARE-entries.patch b/patches.suse/ath11k-pci-Add-more-MODULE_FIRMWARE-entries.patch new file mode 100644 index 0000000..b8e36a0 --- /dev/null +++ b/patches.suse/ath11k-pci-Add-more-MODULE_FIRMWARE-entries.patch @@ -0,0 +1,39 @@ +From: Takashi Iwai +Date: Thu, 30 Mar 2023 16:37:18 +0200 +Subject: wifi: ath11k: pci: Add more MODULE_FIRMWARE() entries +Git-commit: 06c58473969239e00d76b683edd511952060ca56 +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git#for-next +Patch-mainline: Queued in subsystem maintainer repository +References: bsc#1209965 + +As there are a few more models supported by the driver, let's add the +missing MODULE_FIRMWARE() entries for them. The lack of them resulted +in the missing device enablement on some systems, such as the +installation image of openSUSE. + +While we are at it, use the wildcard instead of listing each firmware +files individually for each. + +Signed-off-by: Takashi Iwai +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230330143718.19511-1-tiwai@suse.de +--- + drivers/net/wireless/ath/ath11k/pci.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/ath/ath11k/pci.c ++++ b/drivers/net/wireless/ath/ath11k/pci.c +@@ -1037,7 +1037,8 @@ module_exit(ath11k_pci_exit); + MODULE_DESCRIPTION("Driver support for Qualcomm Technologies 802.11ax WLAN PCIe devices"); + MODULE_LICENSE("Dual BSD/GPL"); + +-/* QCA639x 2.0 firmware files */ +-MODULE_FIRMWARE(ATH11K_FW_DIR "/QCA6390/hw2.0/" ATH11K_BOARD_API2_FILE); +-MODULE_FIRMWARE(ATH11K_FW_DIR "/QCA6390/hw2.0/" ATH11K_AMSS_FILE); +-MODULE_FIRMWARE(ATH11K_FW_DIR "/QCA6390/hw2.0/" ATH11K_M3_FILE); ++/* firmware files */ ++MODULE_FIRMWARE(ATH11K_FW_DIR "/QCA6390/hw2.0/*"); ++MODULE_FIRMWARE(ATH11K_FW_DIR "/QCN9074/hw1.0/*"); ++MODULE_FIRMWARE(ATH11K_FW_DIR "/WCN6855/hw2.0/*"); ++MODULE_FIRMWARE(ATH11K_FW_DIR "/WCN6855/hw2.1/*"); diff --git a/patches.suse/drm-nouveau-kms-Fix-backlight-registration.patch b/patches.suse/drm-nouveau-kms-Fix-backlight-registration.patch deleted file mode 100644 index b1757bb..0000000 --- a/patches.suse/drm-nouveau-kms-Fix-backlight-registration.patch +++ /dev/null @@ -1,61 +0,0 @@ -From: Hans de Goede -Subject: [PATCH] drm/nouveau/kms: Fix backlight registration -Date: Sun, 26 Mar 2023 22:54:33 +0200 -Message-id: <20230326205433.36485-1-hdegoede@redhat.com> -Patch-mainline: Submitted, dri-devel ML -References: bsc#1209296 - -The nouveau code used to call drm_fb_helper_initial_config() from -nouveau_fbcon_init() before calling drm_dev_register(). This would -probe all connectors so that drm_connector->status could be used during -backlight registration which runs from nouveau_connector_late_register(). - -After commit 4a16dd9d18a0 ("drm/nouveau/kms: switch to drm fbdev helpers") -the fbdev emulation code, which now is a drm-client, can only run after -drm_dev_register(). So during backlight registration the connectors are -not probed yet and the drm_connector->status == connected check in -nv50_backlight_init() would now always fail. - -Replace the drm_connector->status == connected check with -a drm_helper_probe_detect() == connected check to fix nv_backlight -no longer getting registered because of this. - -Fixes: 4a16dd9d18a0 ("drm/nouveau/kms: switch to drm fbdev helpers") -Link: https://gitlab.freedesktop.org/drm/nouveau/-/issues/202 -Signed-off-by: Hans de Goede -Acked-by: Takashi Iwai - ---- - drivers/gpu/drm/nouveau/nouveau_backlight.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c -index 40409a29f5b6..91b5ecc57538 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_backlight.c -+++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c -@@ -33,6 +33,7 @@ - #include - #include - #include -+#include - - #include "nouveau_drv.h" - #include "nouveau_reg.h" -@@ -299,8 +300,12 @@ nv50_backlight_init(struct nouveau_backlight *bl, - struct nouveau_drm *drm = nouveau_drm(nv_encoder->base.base.dev); - struct nvif_object *device = &drm->client.device.object; - -+ /* -+ * Note when this runs the connectors have not been probed yet, -+ * so nv_conn->base.status is not set yet. -+ */ - if (!nvif_rd32(device, NV50_PDISP_SOR_PWM_CTL(ffs(nv_encoder->dcb->or) - 1)) || -- nv_conn->base.status != connector_status_connected) -+ drm_helper_probe_detect(&nv_conn->base, NULL, false) != connector_status_connected) - return -ENODEV; - - if (nv_conn->type == DCB_CONNECTOR_eDP) { --- -2.39.1 - - diff --git a/patches.suse/efi-libstub-smbios-Use-length-member-instead-of-reco.patch b/patches.suse/efi-libstub-smbios-Use-length-member-instead-of-reco.patch deleted file mode 100644 index 95d82c7..0000000 --- a/patches.suse/efi-libstub-smbios-Use-length-member-instead-of-reco.patch +++ /dev/null @@ -1,30 +0,0 @@ -From: Ard Biesheuvel -Date: Tue, 28 Feb 2023 19:23:09 +0100 -Subject: efi/libstub: smbios: Use length member instead of record struct size -Git-commit: 34343eb06afc04af9178a9883d9354dc12beede0 -Patch-mainline: 6.3-rc4 -References: bsc#1208750 - -The type 1 SMBIOS record happens to always be the same size, but there -are other record types which have been augmented over time, and so we -should really use the length field in the header to decide where the -string table starts. - -Fixes: 550b33cfd4452968 ("arm64: efi: Force the use of ...") -Signed-off-by: Ard Biesheuvel -Signed-off-by: Jiri Slaby ---- - drivers/firmware/efi/libstub/smbios.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/firmware/efi/libstub/smbios.c -+++ b/drivers/firmware/efi/libstub/smbios.c -@@ -36,7 +36,7 @@ const u8 *__efi_get_smbios_string(u8 typ - if (status != EFI_SUCCESS) - return NULL; - -- strtable = (u8 *)record + recsize; -+ strtable = (u8 *)record + record->length; - for (int i = 1; i < ((u8 *)record)[offset]; i++) { - int len = strlen(strtable); - diff --git a/patches.suse/iwlwifi-cfg-Add-missing-MODULE_FIRMWARE-for-pnvm.patch b/patches.suse/iwlwifi-cfg-Add-missing-MODULE_FIRMWARE-for-pnvm.patch new file mode 100644 index 0000000..22a09fb --- /dev/null +++ b/patches.suse/iwlwifi-cfg-Add-missing-MODULE_FIRMWARE-for-pnvm.patch @@ -0,0 +1,38 @@ +From: Takashi Iwai +Subject: [PATCH] iwlwifi: cfg: Add missing MODULE_FIRMWARE() for *.pnvm +Date: Wed, 5 Apr 2023 08:35:46 +0200 +Message-id: <20230405063546.12439-1-tiwai@suse.de> +Patch-mainline: Submitted, linux-wireless ML +References: bsc#1207553 + +A few models require *.pnvm files while we don't declare them via +MODULE_FIRMWARE(). This resulted in the breakage of WiFi on the +system that relies on the information from modinfo (e.g. openSUSE +installer image). + +This patch adds those missing MODULE_FIRMWARE() entries for *.pnvm +files. + +Link: https://bugzilla.opensuse.org/show_bug.cgi?id=1207553 +Signed-off-by: Takashi Iwai + +--- + + drivers/net/wireless/intel/iwlwifi/cfg/22000.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c +index 3bdd6774716d..3c6dc3601784 100644 +--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c ++++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c +@@ -1065,3 +1065,7 @@ MODULE_FIRMWARE(IWL_BNJ_A_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_BZ_A_FM4_A_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_GL_B_FM_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_BNJ_B_FM_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); ++ ++MODULE_FIRMWARE("iwlwifi-so-a0-gf4-a0.pnvm"); ++MODULE_FIRMWARE("iwlwifi-so-a0-gf-a0.pnvm"); ++MODULE_FIRMWARE("iwlwifi-ty-a0-gf-a0.pnvm"); +-- +2.35.3 + diff --git a/patches.suse/wifi-ath11k-reduce-the-MHI-timeout-to-20s.patch b/patches.suse/wifi-ath11k-reduce-the-MHI-timeout-to-20s.patch new file mode 100644 index 0000000..6c67ced --- /dev/null +++ b/patches.suse/wifi-ath11k-reduce-the-MHI-timeout-to-20s.patch @@ -0,0 +1,45 @@ +From: Kalle Valo +Date: Wed, 29 Mar 2023 19:20:38 +0300 +Subject: wifi: ath11k: reduce the MHI timeout to 20s +Git-commit: cf5fa3ca0552f1b7ba8490de40700bbfb6979b17 +Patch-mainline: 6.3-rc6 +References: bsc#1207948 + +Currently ath11k breaks after hibernation, the reason being that ath11k expects +that the wireless device will have power during suspend and the firmware will +continue running. But of course during hibernation the power from the device is +cut off and firmware is not running when resuming, so ath11k will fail. + +(The reason why ath11k needs the firmware running is the interaction between +mac80211 and MHI stack, it's a long story and more info in the bugzilla report.) + +In SUSE kernels the watchdog timeout is reduced from the default 120 to 60 seconds: + +CONFIG_DPM_WATCHDOG_TIMEOUT=60 + +But as the ath11k MHI timeout is 90 seconds the kernel will crash before will +ath11k will recover in resume callback. To avoid the crash reduce the MHI +timeout to just 20 seconds. + +Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.9 + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=214649 +Signed-off-by: Kalle Valo +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230329162038.8637-1-kvalo@kernel.org +Acked-by: Takashi Iwai +--- + drivers/net/wireless/ath/ath11k/mhi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath11k/mhi.c ++++ b/drivers/net/wireless/ath/ath11k/mhi.c +@@ -16,7 +16,7 @@ + #include "pci.h" + #include "pcic.h" + +-#define MHI_TIMEOUT_DEFAULT_MS 90000 ++#define MHI_TIMEOUT_DEFAULT_MS 20000 + #define RDDM_DUMP_SIZE 0x420000 + + static struct mhi_channel_config ath11k_mhi_channels_qca6390[] = { diff --git a/rpm/constraints.in b/rpm/constraints.in index 712a0f8..dc46dfc 100644 --- a/rpm/constraints.in +++ b/rpm/constraints.in @@ -54,7 +54,7 @@ - + armv7l @@ -63,7 +63,7 @@ - 20 + 24 diff --git a/rpm/kernel-binary.spec.in b/rpm/kernel-binary.spec.in index 119e148..641d919 100644 --- a/rpm/kernel-binary.spec.in +++ b/rpm/kernel-binary.spec.in @@ -20,7 +20,6 @@ %define srcversion @SRCVERSION@ %define patchversion @PATCHVERSION@ %define variant @VARIANT@%{nil} -%define vanilla_only @VANILLA_ONLY@ %define compress_modules @COMPRESS_MODULES@ %define compress_vmlinux @COMPRESS_VMLINUX@ %define livepatch @LIVEPATCH@%{nil} @@ -31,6 +30,7 @@ %define build_flavor @FLAVOR@ %define build_default ("%build_flavor" == "default") %define build_vanilla ("%build_flavor" == "vanilla") +%define vanilla_only %{lua: if (rpm.expand("%variant") == "-vanilla") then print(1) else print(0) end} %if ! %build_vanilla %define src_install_dir /usr/src/linux-%kernelrelease%variant @@ -338,7 +338,7 @@ awk '{ cd linux-%srcversion %_sourcedir/apply-patches \ -%if %{build_vanilla} +%if %{build_vanilla} && ! %vanilla_only --vanilla \ %endif %_sourcedir/series.conf .. $SYMBOLS @@ -1272,7 +1272,7 @@ Summary: Development files necessary for building kernel modules Group: Development/Sources Provides: %name-devel = %version-%source_rel Provides: multiversion(kernel) -%if ! %build_vanilla +%if ! %build_vanilla && ! %vanilla_only Requires: kernel-devel%variant = %version-%source_rel Recommends: make Recommends: gcc diff --git a/rpm/kernel-module-subpackage b/rpm/kernel-module-subpackage index 61bedf6..749ed17 100644 --- a/rpm/kernel-module-subpackage +++ b/rpm/kernel-module-subpackage @@ -1,5 +1,5 @@ %package -n %{-n*}-kmp-%1 -%define _this_kmp_kernel_version k%(echo %2 | sed -r 'y/-/_/; s/^(2\.6\.[0-9]+)_/\\1.0_/; # use 2.6.x.0 for mainline kernels') +%define _this_kmp_kernel_version k%(echo %2 | sed -r 'y/-/_/') %define _this_kmp_version %{-v*}_%_this_kmp_kernel_version Version: %_this_kmp_version Release: %{-r*} @@ -35,21 +35,6 @@ Requires(postun): suse-kernel-rpm-scriptlets Enhances: kernel-%1 Supplements: packageand(kernel-%1:%{-n*}) Conflicts: %{-n*}-kmp-%1-%_this_kmp_kernel_version -%if "%1" == "default" -Obsoletes: %{-n*}-kmp-trace -%ifarch %ix86 -Obsoletes: %{-n*}-kmp-vmi -%endif -%ifarch x86_64 -Obsoletes: %{-n*}-kmp-desktop -%endif -%ifarch %ix86 x86_64 -Obsoletes: %{-n*}-kmp-xen -%endif -%endif -%if "%1" == "pae" -Obsoletes: %{-n*}-kmp-desktop -%endif AutoReqProv: on %define run_if_exists run_if_exists() { \ diff --git a/rpm/kernel-obs-build.spec.in b/rpm/kernel-obs-build.spec.in index 7f50d2a..2d05718 100644 --- a/rpm/kernel-obs-build.spec.in +++ b/rpm/kernel-obs-build.spec.in @@ -21,7 +21,6 @@ %define patchversion @PATCHVERSION@ %define variant @VARIANT@%{nil} -%define vanilla_only @VANILLA_ONLY@ %include %_sourcedir/kernel-spec-macros @@ -31,8 +30,8 @@ BuildRequires: device-mapper BuildRequires: util-linux %if 0%{?suse_version} -%if %vanilla_only -%define kernel_flavor -vanilla +%if "@OBS_BUILD_VARIANT@" +%define kernel_flavor @OBS_BUILD_VARIANT@ %else %ifarch %ix86 %define kernel_flavor -pae diff --git a/rpm/kernel-source.spec.in b/rpm/kernel-source.spec.in index 0754cb7..0f74e3d 100644 --- a/rpm/kernel-source.spec.in +++ b/rpm/kernel-source.spec.in @@ -19,7 +19,6 @@ %define srcversion @SRCVERSION@ %define patchversion @PATCHVERSION@ %define variant @VARIANT@%{nil} -%define vanilla_only @VANILLA_ONLY@ %include %_sourcedir/kernel-spec-macros @@ -231,11 +230,7 @@ sed -ie 's,/lib/modules/,%{kernel_module_directory}/,' linux-%kernelrelease%vari %endif %if %do_vanilla -%if %vanilla_only - mv \ -%else cp -al \ -%endif linux-%kernelrelease%variant linux-%kernelrelease-vanilla cd linux-%kernelrelease-vanilla %_sourcedir/apply-patches --vanilla %_sourcedir/series.conf %my_builddir %symbols @@ -245,7 +240,6 @@ rm -f $(find . -name ".gitignore") cd .. %endif -%if ! %vanilla_only cd linux-%kernelrelease%variant %_sourcedir/apply-patches %_sourcedir/series.conf %my_builddir %symbols rm -f $(find . -name ".gitignore") @@ -256,10 +250,8 @@ fi # Hardlink duplicate files automatically (from package fdupes). %fdupes $PWD cd .. -%endif popd -%if ! %vanilla_only # Install the documentation and example Kernel Module Package. DOC=/usr/share/doc/packages/%name-%kernelrelease mkdir -p %buildroot/$DOC @@ -286,7 +278,6 @@ perl "%_sourcedir/group-source-files.pl" \ -D "$OLDPWD/devel.files" -N "$OLDPWD/nondevel.files" \ -L "%src_install_dir" popd -%endif find %{buildroot}/usr/src/linux* -type f -name '*.[ch]' -perm /0111 -exec chmod -v a-x {} + # OBS checks don't like /usr/bin/env in script interpreter lines @@ -301,7 +292,6 @@ done ts="$(head -n1 %_sourcedir/source-timestamp)" find %buildroot/usr/src/linux* ! -type l | xargs touch -d "$ts" -%if ! %vanilla_only %post %relink_function @@ -329,7 +319,6 @@ relink linux-%kernelrelease%variant /usr/src/linux%variant /usr/lib/rpm/kernel/* %endif -%endif %if %do_vanilla diff --git a/rpm/mkspec b/rpm/mkspec index c415073..0e21c34 100755 --- a/rpm/mkspec +++ b/rpm/mkspec @@ -35,8 +35,9 @@ my @kmps = read_kmps(); # config.sh variables my %vars = parse_config_sh(); -my ($srcversion, $variant, $vanilla_only) = - ($vars{'SRCVERSION'}, $vars{'VARIANT'}, $vars{'VANILLA_ONLY'}); +my ($srcversion, $variant, $obs_build_variant) = + ($vars{'SRCVERSION'}, $vars{'VARIANT'}, $vars{'OBS_BUILD_VARIANT'}); +$obs_build_variant = ($obs_build_variant ? $variant : "" ); my $compress_modules = 'none'; my $compress_vmlinux = 'gz'; my $build_dtbs = (); @@ -60,7 +61,6 @@ if (defined($vars{'LIVEPATCH_RT'})) { $livepatch_rt = $vars{'LIVEPATCH_RT'}; $livepatch_rt = "" if $livepatch_rt =~ /^(0+|no|none)$/i; } -$vanilla_only ||= "0"; if (!defined ($rpmrelease)) { $rpmrelease = $vars{'RELEASE'} || 0; } @@ -114,7 +114,7 @@ my $commit_full = get_commit(1); my %macros = ( VARIANT => $variant, - VANILLA_ONLY => $vanilla_only, + OBS_BUILD_VARIANT => $obs_build_variant . "%{nil}", SRCVERSION => $srcversion, PATCHVERSION => $patchversion, RPMVERSION => $rpmversion, @@ -216,14 +216,16 @@ if ($variant eq "") { } # kernel-obs-*.spec -if (!$variant) { +if (!$variant || $obs_build_variant) { my @default_archs; - - if ($vanilla_only) { - @default_archs = arch2rpm(@{$flavor_archs{vanilla}}); + my $flavor = $obs_build_variant; + if ($flavor) { + $flavor =~ s/^-//; } else { - @default_archs = arch2rpm(@{$flavor_archs{default}}); + $flavor = 'default'; } + + @default_archs = arch2rpm(@{$flavor_archs{$flavor}}); # No kernel-obs-* for 32bit ppc and x86 @default_archs = grep { $_ ne "ppc" && $_ ne '%ix86' } @default_archs; my $default_archs = join(" ", @default_archs); @@ -234,7 +236,7 @@ if (!$variant) { } # dtb-*.spec -if (!$variant && $build_dtbs) { +if ((!$variant || $obs_build_variant) && $build_dtbs) { do_spec('dtb', "dtb.spec.in", %macros); print "./mkspec-dtb $all_archs\n"; system("./mkspec-dtb $all_archs\n"); diff --git a/scripts/bugzilla-cli b/scripts/bugzilla-cli index c1eca50..f122f47 100755 --- a/scripts/bugzilla-cli +++ b/scripts/bugzilla-cli @@ -12,7 +12,7 @@ if scriptdir[0] != '/': sys.path.insert(0, scriptdir) from bugzilla import _cli -if _cli.DEFAULT_BZ != "https://apibugzilla.suse.com/xmlrpc.cgi": +if _cli.DEFAULT_BZ != "https://apibugzilla.suse.com": raise RuntimeError("Use of this script requires the SUSE version of python-bugzilla.") _cli.main() diff --git a/scripts/bugzilla-create b/scripts/bugzilla-create index 5d6de3c..c643f39 100755 --- a/scripts/bugzilla-create +++ b/scripts/bugzilla-create @@ -1,6 +1,5 @@ #!/bin/bash -URL="https://apibugzilla.suse.com/xmlrpc.cgi" COMPONENT="Kernel" COMMENT="This is an automated report for a proactive fix, documented below." @@ -176,7 +175,7 @@ if [ ! -e "${DIR}/bugzilla-cli" ]; then exit 1 fi -BUGZILLA="${DIR}/bugzilla-cli --bugzilla ${URL} --ensure-logged-in" +BUGZILLA="${DIR}/bugzilla-cli --ensure-logged-in" cleanup () { rm -rf ${tmpdir} diff --git a/scripts/bugzilla-resolve b/scripts/bugzilla-resolve index 7fd6237..f2d1fd6 100755 --- a/scripts/bugzilla-resolve +++ b/scripts/bugzilla-resolve @@ -1,7 +1,5 @@ #!/bin/bash -URL="https://apibugzilla.suse.com/xmlrpc.cgi" - resolve_one() { ${BUGZILLA} modify -l "Automated update: This patch was committed to the kernel git repository. Closing as FIXED." -k FIXED $1 } @@ -12,7 +10,7 @@ if [ ! -e "${DIR}/bugzilla-cli" ]; then exit 1 fi -BUGZILLA="${DIR}/bugzilla-cli --bugzilla ${URL} --ensure-logged-in" +BUGZILLA="${DIR}/bugzilla-cli --ensure-logged-in" if [ "$#" -eq 0 ]; then echo "usage: $(basename $0) [bug ids ...]" >&2 diff --git a/scripts/bugzilla/__init__.py b/scripts/bugzilla/__init__.py index 74f5514..95a52cd 100644 --- a/scripts/bugzilla/__init__.py +++ b/scripts/bugzilla/__init__.py @@ -3,19 +3,15 @@ # Copyright (C) 2007, 2008 Red Hat Inc. # Author: Will Woods # -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See http://www.gnu.org/copyleft/gpl.html for -# the full text of the license. +# This work is licensed under the GNU GPLv2 or later. +# See the COPYING file in the top-level directory. from .apiversion import version, __version__ from .base import Bugzilla -from .transport import BugzillaError -from .rhbugzilla import RHBugzilla +from .exceptions import BugzillaError from .oldclasses import (Bugzilla3, Bugzilla32, Bugzilla34, Bugzilla36, Bugzilla4, Bugzilla42, Bugzilla44, - NovellBugzilla, RHBugzilla3, RHBugzilla4) + NovellBugzilla, RHBugzilla, RHBugzilla3, RHBugzilla4) # This is the public API. If you are explicitly instantiating any other diff --git a/scripts/bugzilla/_authfiles.py b/scripts/bugzilla/_authfiles.py new file mode 100644 index 0000000..bdb977e --- /dev/null +++ b/scripts/bugzilla/_authfiles.py @@ -0,0 +1,179 @@ +# This work is licensed under the GNU GPLv2 or later. +# See the COPYING file in the top-level directory. + +import configparser +import os +from logging import getLogger +import urllib.parse + +from ._util import listify + +log = getLogger(__name__) + + +def _parse_hostname(url): + # If http://example.com is passed, netloc=example.com path="" + # If just example.com is passed, netloc="" path=example.com + parsedbits = urllib.parse.urlparse(url) + return parsedbits.netloc or parsedbits.path + + +def _makedirs(path): + if os.path.exists(os.path.dirname(path)): + return + os.makedirs(os.path.dirname(path), 0o700) + + +def _default_cache_location(filename): + """ + Determine default location for passed xdg filename. + example: ~/.cache/python-bugzilla/bugzillarc + """ + return os.path.expanduser("~/.cache/python-bugzilla/%s" % filename) + + +class _BugzillaRCFile(object): + """ + Helper class for interacting with bugzillarc files + """ + @staticmethod + def get_default_configpaths(): + paths = [ + '/etc/bugzillarc', + '~/.bugzillarc', + '~/.config/python-bugzilla/bugzillarc', + ] + return paths + + def __init__(self): + self._cfg = None + self._configpaths = None + self.set_configpaths(None) + + def set_configpaths(self, configpaths): + configpaths = [os.path.expanduser(p) for p in + listify(configpaths or [])] + + cfg = configparser.ConfigParser() + read_files = cfg.read(configpaths) + if read_files: + log.info("Found bugzillarc files: %s", read_files) + + self._cfg = cfg + self._configpaths = configpaths or [] + + def get_configpaths(self): + return self._configpaths[:] + + def get_default_url(self): + """ + Grab a default URL from bugzillarc [DEFAULT] url=X + """ + cfgurl = self._cfg.defaults().get("url", None) + if cfgurl is not None: + log.debug("bugzillarc: found cli url=%s", cfgurl) + return cfgurl + + def parse(self, url): + """ + Find the section for the passed URL domain, and return all the fields + """ + section = "" + log.debug("bugzillarc: Searching for config section matching %s", url) + + urlhost = _parse_hostname(url) + for sectionhost in sorted(self._cfg.sections()): + # If the section is just a hostname, make it match + # If the section has a / in it, do a substring match + if "/" not in sectionhost: + if sectionhost == urlhost: + section = sectionhost + elif sectionhost in url: + section = sectionhost + if section: + log.debug("bugzillarc: Found matching section: %s", section) + break + + if not section: + log.debug("bugzillarc: No section found") + return {} + return dict(self._cfg.items(section)) + + + def save_api_key(self, url, api_key): + """ + Save the API_KEY in the config file. We use the last file + in the configpaths list, which is the one with the highest + precedence. + """ + configpaths = self.get_configpaths() + if not configpaths: + return None + + config_filename = configpaths[-1] + section = _parse_hostname(url) + cfg = configparser.ConfigParser() + cfg.read(config_filename) + + if section not in cfg.sections(): + cfg.add_section(section) + + cfg.set(section, 'api_key', api_key.strip()) + + _makedirs(config_filename) + with open(config_filename, 'w') as configfile: + cfg.write(configfile) + + return config_filename + + +class _BugzillaTokenCache(object): + """ + Class for interacting with a .bugzillatoken cache file + """ + @staticmethod + def get_default_path(): + return _default_cache_location("bugzillatoken") + + def __init__(self): + self._filename = None + self._cfg = None + + def _get_domain(self, url): + domain = urllib.parse.urlparse(url)[1] + if domain and domain not in self._cfg.sections(): + self._cfg.add_section(domain) + return domain + + def get_value(self, url): + domain = self._get_domain(url) + if domain and self._cfg.has_option(domain, 'token'): + return self._cfg.get(domain, 'token') + return None + + def set_value(self, url, value): + if self.get_value(url) == value: + return + + domain = self._get_domain(url) + if value is None: + self._cfg.remove_option(domain, 'token') + else: + self._cfg.set(domain, 'token', value) + + if self._filename: + _makedirs(self._filename) + with open(self._filename, 'w') as _cfg: + log.debug("Saving to _cfg") + self._cfg.write(_cfg) + + def get_filename(self): + return self._filename + + def set_filename(self, filename): + log.debug("Using tokenfile=%s", filename) + cfg = configparser.ConfigParser() + if filename: + cfg.read(filename) + self._filename = filename + self._cfg = cfg diff --git a/scripts/bugzilla/_backendbase.py b/scripts/bugzilla/_backendbase.py new file mode 100644 index 0000000..b81e108 --- /dev/null +++ b/scripts/bugzilla/_backendbase.py @@ -0,0 +1,288 @@ +# This work is licensed under the GNU GPLv2 or later. +# See the COPYING file in the top-level directory. + +from logging import getLogger + +import requests + +log = getLogger(__name__) + + +class _BackendBase(object): + """ + Backends are thin wrappers around the different bugzilla API paradigms + (XMLRPC, REST). This base class defines the public API for the rest of + the code, but this is all internal to the library. + """ + def __init__(self, url, bugzillasession): + self._url = url + self._bugzillasession = bugzillasession + + + @staticmethod + def probe(url): + try: + requests.head(url).raise_for_status() + return True # pragma: no cover + except Exception as e: + log.debug("Failed to probe url=%s : %s", url, str(e)) + return False + + + ################# + # Internal APIs # + ################# + + def get_xmlrpc_proxy(self): + """ + Provides the raw XMLRPC proxy to API users of Bugzilla._proxy + """ + raise NotImplementedError() + + def is_rest(self): + """ + :returns: True if this is the REST backend + """ + return False + + def is_xmlrpc(self): + """ + :returns: True if this is the XMLRPC backend + """ + return False + + + ###################### + # Bugzilla info APIs # + ###################### + + def bugzilla_version(self): + """ + Fetch bugzilla version string + http://bugzilla.readthedocs.io/en/latest/api/core/v1/bugzilla.html#version + """ + raise NotImplementedError() + + + ####################### + # Bug attachment APIs # + ####################### + + def bug_attachment_get(self, attachment_ids, paramdict): + """ + Fetch bug attachments IDs. One part of: + http://bugzilla.readthedocs.io/en/latest/api/core/v1/attachment.html#get-attachment + """ + raise NotImplementedError() + + def bug_attachment_get_all(self, bug_ids, paramdict): + """ + Fetch all bug attachments IDs. One part of + http://bugzilla.readthedocs.io/en/latest/api/core/v1/attachment.html#get-attachment + """ + raise NotImplementedError() + + def bug_attachment_create(self, bug_ids, data, paramdict): + """ + Create a bug attachment + http://bugzilla.readthedocs.io/en/latest/api/core/v1/attachment.html#create-attachment + + :param data: raw Bytes data of the attachment to attach. API will + encode this correctly if you pass it in and 'data' is not in + paramdict. + """ + raise NotImplementedError() + + def bug_attachment_update(self, attachment_ids, paramdict): + """ + Update a bug attachment + http://bugzilla.readthedocs.io/en/latest/api/core/v1/attachment.html#update-attachment + """ + raise NotImplementedError() + + + ############ + # bug APIs # + ############ + + def bug_comments(self, bug_ids, paramdict): + """ + Fetch bug comments + http://bugzilla.readthedocs.io/en/latest/api/core/v1/comment.html#get-comments + """ + raise NotImplementedError() + + def bug_create(self, paramdict): + """ + Create a new bug + http://bugzilla.readthedocs.io/en/latest/api/core/v1/bug.html#create-bug + """ + raise NotImplementedError() + + def bug_fields(self, paramdict): + """ + Query available bug field values + http://bugzilla.readthedocs.io/en/latest/api/core/v1/field.html#fields + """ + raise NotImplementedError() + + def bug_get(self, bug_ids, aliases, paramdict): + """ + Lookup bug data by ID + http://bugzilla.readthedocs.io/en/latest/api/core/v1/bug.html#get-bug + """ + raise NotImplementedError() + + def bug_history(self, bug_ids, paramdict): + """ + Lookup bug history + http://bugzilla.readthedocs.io/en/latest/api/core/v1/bug.html#bug-history + """ + raise NotImplementedError() + + def bug_search(self, paramdict): + """ + Search/query bugs + http://bugzilla.readthedocs.io/en/latest/api/core/v1/bug.html#search-bugs + """ + raise NotImplementedError() + + def bug_update(self, bug_ids, paramdict): + """ + Update bugs + http://bugzilla.readthedocs.io/en/latest/api/core/v1/bug.html#update-bug + """ + raise NotImplementedError() + + def bug_update_tags(self, bug_ids, paramdict): + """ + Update bug tags + https://www.bugzilla.org/docs/4.4/en/html/api/Bugzilla/WebService/Bug.html#update_tags + """ + raise NotImplementedError() + + + ################## + # Component APIs # + ################## + + def component_create(self, paramdict): + """ + Create component + https://bugzilla.readthedocs.io/en/latest/api/core/v1/component.html#create-component + """ + raise NotImplementedError() + + def component_update(self, paramdict): + """ + Update component + https://bugzilla.readthedocs.io/en/latest/api/core/v1/component.html#update-component + """ + raise NotImplementedError() + + + ############################### + # ExternalBugs extension APIs # + ############################### + + def externalbugs_add(self, paramdict): + """ + https://bugzilla.redhat.com/docs/en/html/integrating/api/Bugzilla/Extension/ExternalBugs/WebService.html#add-external-bug + """ + raise NotImplementedError() + + def externalbugs_update(self, paramdict): + """ + https://bugzilla.redhat.com/docs/en/html/integrating/api/Bugzilla/Extension/ExternalBugs/WebService.html#update-external-bug + """ + raise NotImplementedError() + + def externalbugs_remove(self, paramdict): + """ + https://bugzilla.redhat.com/docs/en/html/integrating/api/Bugzilla/Extension/ExternalBugs/WebService.html#remove-external-bug + """ + raise NotImplementedError() + + + ############## + # Group APIs # + ############## + + def group_get(self, paramdict): + """ + https://bugzilla.readthedocs.io/en/latest/api/core/v1/group.html#get-group + """ + raise NotImplementedError() + + + ################ + # Product APIs # + ################ + + def product_get(self, paramdict): + """ + Fetch product details + http://bugzilla.readthedocs.io/en/latest/api/core/v1/product.html#get-product + """ + raise NotImplementedError() + + def product_get_accessible(self): + """ + List accessible products + http://bugzilla.readthedocs.io/en/latest/api/core/v1/product.html#list-products + """ + raise NotImplementedError() + + def product_get_enterable(self): + """ + List enterable products + http://bugzilla.readthedocs.io/en/latest/api/core/v1/product.html#list-products + """ + raise NotImplementedError() + + def product_get_selectable(self): + """ + List selectable products + http://bugzilla.readthedocs.io/en/latest/api/core/v1/product.html#list-products + """ + raise NotImplementedError() + + + ############# + # User APIs # + ############# + + def user_create(self, paramdict): + """ + Create user + http://bugzilla.readthedocs.io/en/latest/api/core/v1/user.html#create-user + """ + raise NotImplementedError() + + def user_get(self, paramdict): + """ + Get user info + http://bugzilla.readthedocs.io/en/latest/api/core/v1/user.html#get-user + """ + raise NotImplementedError() + + def user_login(self, paramdict): + """ + Log in to bugzilla + http://bugzilla.readthedocs.io/en/latest/api/core/v1/user.html#login + """ + raise NotImplementedError() + + def user_logout(self): + """ + Log out of bugzilla + http://bugzilla.readthedocs.io/en/latest/api/core/v1/user.html#logout + """ + raise NotImplementedError() + + def user_update(self, paramdict): + """ + Update user + http://bugzilla.readthedocs.io/en/latest/api/core/v1/user.html#update-user + """ + raise NotImplementedError() diff --git a/scripts/bugzilla/_backendrest.py b/scripts/bugzilla/_backendrest.py new file mode 100644 index 0000000..3abe49c --- /dev/null +++ b/scripts/bugzilla/_backendrest.py @@ -0,0 +1,193 @@ +# This work is licensed under the GNU GPLv2 or later. +# See the COPYING file in the top-level directory. + +import base64 +import json +import logging +import os + +from ._backendbase import _BackendBase +from .exceptions import BugzillaError +from ._util import listify + + +log = logging.getLogger(__name__) + + +def _update_key(indict, updict, key): + if key not in indict: + indict[key] = {} + indict[key].update(updict.get(key, {})) + + +class _BackendREST(_BackendBase): + """ + Internal interface for direct calls to bugzilla's REST API + """ + def __init__(self, url, bugzillasession): + _BackendBase.__init__(self, url, bugzillasession) + self._bugzillasession.set_rest_defaults() + + + ######################### + # Internal REST helpers # + ######################### + + def _handle_response(self, text): + try: + ret = dict(json.loads(text)) + except Exception: # pragma: no cover + log.debug("Failed to parse REST response. Output is:\n%s", text) + raise + + if ret.get("error", False): + raise BugzillaError(ret["message"], code=ret["code"]) + return ret + + def _op(self, method, apiurl, paramdict=None): + fullurl = os.path.join(self._url, apiurl.lstrip("/")) + log.debug("Bugzilla REST %s %s params=%s", method, fullurl, paramdict) + + data = None + authparams = self._bugzillasession.get_auth_params() + if method == "GET": + authparams.update(paramdict or {}) + else: + data = json.dumps(paramdict or {}) + + response = self._bugzillasession.request(method, fullurl, data=data, + params=authparams) + return self._handle_response(response.text) + + def _get(self, *args, **kwargs): + return self._op("GET", *args, **kwargs) + def _put(self, *args, **kwargs): + return self._op("PUT", *args, **kwargs) + def _post(self, *args, **kwargs): + return self._op("POST", *args, **kwargs) + + + ####################### + # API implementations # + ####################### + + def get_xmlrpc_proxy(self): + raise BugzillaError("You are using the bugzilla REST API, " + "so raw XMLRPC access is not provided.") + def is_rest(self): + return True + + def bugzilla_version(self): + return self._get("/version") + + def bug_create(self, paramdict): + return self._post("/bug", paramdict) + def bug_fields(self, paramdict): + return self._get("/field/bug", paramdict) + def bug_get(self, bug_ids, aliases, paramdict): + data = paramdict.copy() + data["id"] = listify(bug_ids) + data["alias"] = listify(aliases) + ret = self._get("/bug", data) + return ret + + def bug_attachment_get(self, attachment_ids, paramdict): + # XMLRPC supported mutiple fetch at once, but not REST + ret = {} + for attid in listify(attachment_ids): + out = self._get("/bug/attachment/%s" % attid, paramdict) + _update_key(ret, out, "attachments") + _update_key(ret, out, "bugs") + return ret + + def bug_attachment_get_all(self, bug_ids, paramdict): + # XMLRPC supported mutiple fetch at once, but not REST + ret = {} + for bugid in listify(bug_ids): + out = self._get("/bug/%s/attachment" % bugid, paramdict) + _update_key(ret, out, "attachments") + _update_key(ret, out, "bugs") + return ret + + def bug_attachment_create(self, bug_ids, data, paramdict): + if data is not None and "data" not in paramdict: + paramdict["data"] = base64.b64encode(data).decode("utf-8") + paramdict["ids"] = listify(bug_ids) + return self._post("/bug/%s/attachment" % paramdict["ids"][0], + paramdict) + + def bug_attachment_update(self, attachment_ids, paramdict): + paramdict["ids"] = listify(attachment_ids) + return self._put("/bug/attachment/%s" % paramdict["ids"][0], paramdict) + + def bug_comments(self, bug_ids, paramdict): + # XMLRPC supported mutiple fetch at once, but not REST + ret = {} + for bugid in bug_ids: + out = self._get("/bug/%s/comment" % bugid, paramdict) + _update_key(ret, out, "bugs") + return ret + def bug_history(self, bug_ids, paramdict): + # XMLRPC supported mutiple fetch at once, but not REST + ret = {"bugs": []} + for bugid in bug_ids: + out = self._get("/bug/%s/history" % bugid, paramdict) + ret["bugs"].extend(out.get("bugs", [])) + return ret + + def bug_search(self, paramdict): + return self._get("/bug", paramdict) + def bug_update(self, bug_ids, paramdict): + data = paramdict.copy() + data["ids"] = listify(bug_ids) + return self._put("/bug/%s" % data["ids"][0], data) + def bug_update_tags(self, bug_ids, paramdict): + raise BugzillaError("No REST API available for bug_update_tags") + + def component_create(self, paramdict): + return self._post("/component", paramdict) + def component_update(self, paramdict): + if "ids" in paramdict: + apiurl = str(listify(paramdict["ids"])[0]) # pragma: no cover + if "names" in paramdict: + apiurl = ("%(product)s/%(component)s" % + listify(paramdict["names"])[0]) + return self._put("/component/%s" % apiurl, paramdict) + + def externalbugs_add(self, paramdict): # pragma: no cover + raise BugzillaError( + "No REST API available yet for externalbugs_add") + def externalbugs_remove(self, paramdict): # pragma: no cover + raise BugzillaError( + "No REST API available yet for externalbugs_remove") + def externalbugs_update(self, paramdict): # pragma: no cover + raise BugzillaError( + "No REST API available yet for externalbugs_update") + + def group_get(self, paramdict): + return self._get("/group", paramdict) + + def product_get(self, paramdict): + return self._get("/product/get", paramdict) + def product_get_accessible(self): + return self._get("/product_accessible") + def product_get_enterable(self): + return self._get("/product_enterable") + def product_get_selectable(self): + return self._get("/product_selectable") + + def user_create(self, paramdict): + return self._post("/user", paramdict) + def user_get(self, paramdict): + return self._get("/user", paramdict) + def user_login(self, paramdict): + return self._get("/login", paramdict) + def user_logout(self): + return self._get("/logout") + def user_update(self, paramdict): + urlid = None + if "ids" in paramdict: + urlid = listify(paramdict["ids"])[0] # pragma: no cover + if "names" in paramdict: + urlid = listify(paramdict["names"])[0] + return self._put("/user/%s" % urlid, paramdict) diff --git a/scripts/bugzilla/_backendxmlrpc.py b/scripts/bugzilla/_backendxmlrpc.py new file mode 100644 index 0000000..0558b35 --- /dev/null +++ b/scripts/bugzilla/_backendxmlrpc.py @@ -0,0 +1,228 @@ +# This work is licensed under the GNU GPLv2 or later. +# See the COPYING file in the top-level directory. + +from logging import getLogger +import sys +from xmlrpc.client import (Binary, Fault, ProtocolError, + ServerProxy, Transport) + +from requests import RequestException + +from ._backendbase import _BackendBase +from .exceptions import BugzillaError +from ._util import listify + + +log = getLogger(__name__) + + +class _BugzillaXMLRPCTransport(Transport): + def __init__(self, bugzillasession): + if hasattr(Transport, "__init__"): + Transport.__init__(self, use_datetime=False) + + self.__bugzillasession = bugzillasession + self.__bugzillasession.set_xmlrpc_defaults() + self.__seen_valid_xml = False + + # Override Transport.user_agent + self.user_agent = self.__bugzillasession.get_user_agent() + + + ############################ + # Bugzilla private helpers # + ############################ + + def __request_helper(self, url, request_body): + """ + A helper method to assist in making a request and parsing the response. + """ + response = None + # pylint: disable=try-except-raise + # pylint: disable=raise-missing-from + try: + response = self.__bugzillasession.request( + "POST", url, data=request_body) + + return self.parse_response(response) + except RequestException as e: + if not response: + raise + raise ProtocolError( # pragma: no cover + url, response.status_code, str(e), response.headers) + except Fault: + raise + except Exception: + msg = str(sys.exc_info()[1]) + if not self.__seen_valid_xml: + msg += "\nThe URL may not be an XMLRPC URL: %s" % url + e = BugzillaError(msg) + # pylint: disable=attribute-defined-outside-init + e.__traceback__ = sys.exc_info()[2] + # pylint: enable=attribute-defined-outside-init + raise e + + + ###################### + # Tranport overrides # + ###################### + + def parse_response(self, response): + """ + Override Transport.parse_response + """ + parser, unmarshaller = self.getparser() + msg = response.text.encode('utf-8') + try: + parser.feed(msg) + except Exception: # pragma: no cover + log.debug("Failed to parse this XMLRPC response:\n%s", msg) + raise + + self.__seen_valid_xml = True + parser.close() + return unmarshaller.close() + + def request(self, host, handler, request_body, verbose=0): + """ + Override Transport.request + """ + # Setting self.verbose here matches overrided request() behavior + # pylint: disable=attribute-defined-outside-init + self.verbose = verbose + + url = "%s://%s%s" % (self.__bugzillasession.get_scheme(), + host, handler) + + # xmlrpclib fails to escape \r + request_body = request_body.replace(b'\r', b' ') + + return self.__request_helper(url, request_body) + + +class _BugzillaXMLRPCProxy(ServerProxy, object): + """ + Override of xmlrpc ServerProxy, to insert bugzilla API auth + into the XMLRPC request data + """ + def __init__(self, uri, bugzillasession, *args, **kwargs): + self.__bugzillasession = bugzillasession + transport = _BugzillaXMLRPCTransport(self.__bugzillasession) + ServerProxy.__init__(self, uri, transport, *args, **kwargs) + + def _ServerProxy__request(self, methodname, params): + """ + Overrides ServerProxy _request method + """ + # params is a singleton tuple, enforced by xmlrpc.client.dumps + newparams = params and params[0].copy() or {} + + log.debug("XMLRPC call: %s(%s)", methodname, newparams) + authparams = self.__bugzillasession.get_auth_params() + authparams.update(newparams) + + # pylint: disable=no-member + ret = ServerProxy._ServerProxy__request( + self, methodname, (authparams,)) + # pylint: enable=no-member + + return ret + + +class _BackendXMLRPC(_BackendBase): + """ + Internal interface for direct calls to bugzilla's XMLRPC API + """ + def __init__(self, url, bugzillasession): + _BackendBase.__init__(self, url, bugzillasession) + self._xmlrpc_proxy = _BugzillaXMLRPCProxy(url, self._bugzillasession) + + def get_xmlrpc_proxy(self): + return self._xmlrpc_proxy + def is_xmlrpc(self): + return True + + def bugzilla_version(self): + return self._xmlrpc_proxy.Bugzilla.version() + + def bug_attachment_get(self, attachment_ids, paramdict): + data = paramdict.copy() + data["attachment_ids"] = listify(attachment_ids) + return self._xmlrpc_proxy.Bug.attachments(data) + def bug_attachment_get_all(self, bug_ids, paramdict): + data = paramdict.copy() + data["ids"] = listify(bug_ids) + return self._xmlrpc_proxy.Bug.attachments(data) + def bug_attachment_create(self, bug_ids, data, paramdict): + pdata = paramdict.copy() + pdata["ids"] = listify(bug_ids) + if data is not None and "data" not in paramdict: + pdata["data"] = Binary(data) + return self._xmlrpc_proxy.Bug.add_attachment(pdata) + def bug_attachment_update(self, attachment_ids, paramdict): + data = paramdict.copy() + data["ids"] = listify(attachment_ids) + return self._xmlrpc_proxy.Bug.update_attachment(data) + + def bug_comments(self, bug_ids, paramdict): + data = paramdict.copy() + data["ids"] = listify(bug_ids) + return self._xmlrpc_proxy.Bug.comments(data) + def bug_create(self, paramdict): + return self._xmlrpc_proxy.Bug.create(paramdict) + def bug_fields(self, paramdict): + return self._xmlrpc_proxy.Bug.fields(paramdict) + def bug_get(self, bug_ids, aliases, paramdict): + data = paramdict.copy() + data["ids"] = listify(bug_ids) or [] + data["ids"] += listify(aliases) or [] + return self._xmlrpc_proxy.Bug.get(data) + def bug_history(self, bug_ids, paramdict): + data = paramdict.copy() + data["ids"] = listify(bug_ids) + return self._xmlrpc_proxy.Bug.history(data) + def bug_search(self, paramdict): + return self._xmlrpc_proxy.Bug.search(paramdict) + def bug_update(self, bug_ids, paramdict): + data = paramdict.copy() + data["ids"] = listify(bug_ids) + return self._xmlrpc_proxy.Bug.update(data) + def bug_update_tags(self, bug_ids, paramdict): + data = paramdict.copy() + data["ids"] = listify(bug_ids) + return self._xmlrpc_proxy.Bug.update_tags(data) + + def component_create(self, paramdict): + return self._xmlrpc_proxy.Component.create(paramdict) + def component_update(self, paramdict): + return self._xmlrpc_proxy.Component.update(paramdict) + + def externalbugs_add(self, paramdict): + return self._xmlrpc_proxy.ExternalBugs.add_external_bug(paramdict) + def externalbugs_update(self, paramdict): + return self._xmlrpc_proxy.ExternalBugs.update_external_bug(paramdict) + def externalbugs_remove(self, paramdict): + return self._xmlrpc_proxy.ExternalBugs.remove_external_bug(paramdict) + + def group_get(self, paramdict): + return self._xmlrpc_proxy.Group.get(paramdict) + + def product_get(self, paramdict): + return self._xmlrpc_proxy.Product.get(paramdict) + def product_get_accessible(self): + return self._xmlrpc_proxy.Product.get_accessible_products() + def product_get_enterable(self): + return self._xmlrpc_proxy.Product.get_enterable_products() + def product_get_selectable(self): + return self._xmlrpc_proxy.Product.get_selectable_products() + + def user_create(self, paramdict): + return self._xmlrpc_proxy.User.create(paramdict) + def user_get(self, paramdict): + return self._xmlrpc_proxy.User.get(paramdict) + def user_login(self, paramdict): + return self._xmlrpc_proxy.User.login(paramdict) + def user_logout(self): + return self._xmlrpc_proxy.User.logout() + def user_update(self, paramdict): + return self._xmlrpc_proxy.User.update(paramdict) diff --git a/scripts/bugzilla/_cli.py b/scripts/bugzilla/_cli.py index 1c10586..e0b4924 100644 --- a/scripts/bugzilla/_cli.py +++ b/scripts/bugzilla/_cli.py @@ -1,4 +1,4 @@ -#!/usr/bin/python3 +#!/usr/bin/env python3 # # bugzilla - a commandline frontend for the python bugzilla module # @@ -6,39 +6,30 @@ # Author: Will Woods # Author: Cole Robinson # -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See http://www.gnu.org/copyleft/gpl.html for -# the full text of the license. - -from __future__ import print_function +# This work is licensed under the GNU GPLv2 or later. +# See the COPYING file in the top-level directory. +import argparse +import base64 +import datetime +import errno +import json import locale from logging import getLogger, DEBUG, INFO, WARN, StreamHandler, Formatter -import argparse import os import re import socket import sys import tempfile - -# pylint: disable=import-error -if sys.version_info[0] >= 3: - # pylint: disable=no-name-in-module,redefined-builtin - from xmlrpc.client import Fault, ProtocolError - from urllib.parse import urlparse - basestring = (str, bytes) -else: - from xmlrpclib import Fault, ProtocolError - from urlparse import urlparse -# pylint: enable=import-error +import urllib.parse +import xmlrpc.client import requests.exceptions import bugzilla -DEFAULT_BZ = 'https://apibugzilla.suse.com/xmlrpc.cgi' + +DEFAULT_BZ = 'https://apibugzilla.suse.com' format_field_re = re.compile("%{([a-z0-9_]+)(?::([^}]*))?}") @@ -49,33 +40,15 @@ log = getLogger(bugzilla.__name__) # Util helpers # ################ -def _is_unittest(): - return bool(os.getenv("__BUGZILLA_UNITTEST")) - - def _is_unittest_debug(): return bool(os.getenv("__BUGZILLA_UNITTEST_DEBUG")) -def to_encoding(ustring): - string = '' - if isinstance(ustring, basestring): - string = ustring - elif ustring is not None: - string = str(ustring) - - if sys.version_info[0] >= 3: - return string - - preferred = locale.getpreferredencoding() - if _is_unittest(): - preferred = "UTF-8" - return string.encode(preferred, 'replace') - - def open_without_clobber(name, *args): - '''Try to open the given file with the given mode; if that filename exists, - try "name.1", "name.2", etc. until we find an unused filename.''' + """ + Try to open the given file with the given mode; if that filename exists, + try "name.1", "name.2", etc. until we find an unused filename. + """ fd = None count = 1 orig_name = name @@ -83,31 +56,17 @@ def open_without_clobber(name, *args): try: fd = os.open(name, os.O_CREAT | os.O_EXCL, 0o666) except OSError as err: - if err.errno == os.errno.EEXIST: + if err.errno == errno.EEXIST: name = "%s.%i" % (orig_name, count) count += 1 - else: - raise IOError(err.errno, err.strerror, err.filename) + else: # pragma: no cover + raise IOError(err.errno, err.strerror, err.filename) from None fobj = open(name, *args) if fd != fobj.fileno(): os.close(fd) return fobj -def get_default_url(): - """ - Grab a default URL from bugzillarc [DEFAULT] url=X - """ - from bugzilla.base import _open_bugzillarc - cfg = _open_bugzillarc() - if cfg: - cfgurl = cfg.defaults().get("url", None) - if cfgurl is not None: - log.debug("bugzillarc: found cli url=%s", cfgurl) - return cfgurl - return DEFAULT_BZ - - def setup_logging(debug, verbose): handler = StreamHandler(sys.stderr) handler.setFormatter(Formatter( @@ -123,7 +82,7 @@ def setup_logging(debug, verbose): log.setLevel(WARN) if _is_unittest_debug(): - log.setLevel(DEBUG) + log.setLevel(DEBUG) # pragma: no cover ################## @@ -134,11 +93,13 @@ def _setup_root_parser(): epilog = 'Try "bugzilla COMMAND --help" for command-specific help.' p = argparse.ArgumentParser(epilog=epilog) - default_url = get_default_url() + default_url = bugzilla.Bugzilla.get_rcfile_default_url() + if not default_url: + default_url = DEFAULT_BZ # General bugzilla connection options p.add_argument('--bugzilla', default=default_url, - help="bugzilla XMLRPC URI. default: %s" % default_url) + help="bugzilla URI. default: %s" % default_url) p.add_argument("--nosslverify", dest="sslverify", action="store_false", default=True, help="Don't error on invalid bugzilla SSL certificate") @@ -150,6 +111,9 @@ def _setup_root_parser(): 'specified command.') p.add_argument('--username', help="Log in with this username") p.add_argument('--password', help="Log in with this password") + p.add_argument('--restrict-login', action="store_true", + help="The session (login token) will be restricted to " + "the current IP address.") p.add_argument('--ensure-logged-in', action="store_true", help="Raise an error if we aren't logged in to bugzilla. " @@ -161,8 +125,7 @@ def _setup_root_parser(): help="Don't save any bugzilla cookies or tokens to disk, and " "don't use any pre-existing credentials.") - p.add_argument('--cookiefile', default=None, - help="cookie file to use for bugzilla authentication") + p.add_argument('--cookiefile', default=None, help=argparse.SUPPRESS) p.add_argument('--tokenfile', default=None, help="token file to use for bugzilla authentication") @@ -195,8 +158,26 @@ def _parser_add_output_options(p): outg.add_argument('--oneline', action='store_const', dest='output', const='oneline', help="one line summary of the bug (useful for scripts)") + outg.add_argument('--json', action='store_const', dest='output', + const='json', help="output contents in json format") + outg.add_argument("--includefield", action="append", + help="Pass the field name to bugzilla include_fields list. " + "Only the fields passed to include_fields are returned " + "by the bugzilla server. " + "This can be specified multiple times.") + outg.add_argument("--extrafield", action="append", + help="Pass the field name to bugzilla extra_fields list. " + "When used with --json this can be used to request " + "bugzilla to return values for non-default fields. " + "This can be specified multiple times.") + outg.add_argument("--excludefield", action="append", + help="Pass the field name to bugzilla exclude_fields list. " + "When used with --json this can be used to request " + "bugzilla to not return values for a field. " + "This can be specified multiple times.") outg.add_argument('--raw', action='store_const', dest='output', - const='raw', help="raw output of the bugzilla contents") + const='raw', help="raw output of the bugzilla contents. This " + "format is unstable and difficult to parse. Use --json instead.") outg.add_argument('--outputformat', help="Print output in the form given. " "You can use RPM-style tags that match bug " @@ -250,6 +231,10 @@ def _parser_add_bz_fields(rootp, command): p.add_argument('--cc', action="append", help="CC list") p.add_argument('-a', '--assigned_to', '--assignee', help="Bug assignee") p.add_argument('-q', '--qa_contact', help='QA contact') + if cmd_modify: + p.add_argument("--minor-update", action="store_true", + help="Request bugzilla to not send any " + "email about this change") if not cmd_new: p.add_argument('-f', '--flag', action='append', @@ -274,15 +259,11 @@ def _parser_add_bz_fields(rootp, command): # Put this at the end, so it sticks out more p.add_argument('--field', metavar="FIELD=VALUE", action="append", dest="fields", - help="Manually specify a bugzilla XMLRPC field. FIELD is " - "the raw name used by the bugzilla instance. For example if your " + help="Manually specify a bugzilla API field. FIELD is " + "the raw name used by the bugzilla instance. For example, if your " "bugzilla instance has a custom field cf_my_field, do:\n" " --field cf_my_field=VALUE") - # Used by unit tests, not for end user consumption - p.add_argument('--__test-return-result', action="store_true", - dest="test_return_result", help=argparse.SUPPRESS) - if not cmd_modify: _parser_add_output_options(rootp) @@ -294,11 +275,14 @@ def _setup_action_new_parser(subparsers): "Options that take multiple values accept comma separated lists, " "including --cc, --blocks, --dependson, --groups, and --keywords.") p = subparsers.add_parser("new", description=description) - - _parser_add_bz_fields(p, "new") p.add_argument('--no-refresh', action='store_true', help='Do not refresh bug after creating') + _parser_add_bz_fields(p, "new") + g = p.add_argument_group("'new' specific options") + g.add_argument('--private', action='store_true', default=False, + help='Mark new comment as private') + def _setup_action_query_parser(subparsers): description = ("List bug reports that match the given criteria. " @@ -344,10 +328,6 @@ def _setup_action_query_parser(subparsers): help=argparse.SUPPRESS) p.add_argument('-W', '--status_whiteboard_type', help=argparse.SUPPRESS) - p.add_argument('-B', '--booleantype', - help=argparse.SUPPRESS) - p.add_argument('--boolean_query', action="append", - help=argparse.SUPPRESS) p.add_argument('--fixed_in_type', help=argparse.SUPPRESS) @@ -399,7 +379,7 @@ def _setup_action_modify_parser(subparsers): def _setup_action_attach_parser(subparsers): usage = """ bugzilla attach --file=FILE --desc=DESC [--type=TYPE] BUGID [BUGID...] -bugzilla attach --get=ATTACHID --getall=BUGID [...] +bugzilla attach --get=ATTACHID --getall=BUGID [--ignore-obsolete] [...] bugzilla attach --type=TYPE BUGID [BUGID...]""" description = "Attach files or download attachments." p = subparsers.add_parser("attach", description=description, usage=usage) @@ -416,17 +396,29 @@ bugzilla attach --type=TYPE BUGID [BUGID...]""" default=[], help="Download the attachment with the given ID") p.add_argument("--getall", "--get-all", metavar="BUGID", action="append", default=[], help="Download all attachments on the given bug") - p.add_argument('-l', '--comment', '--long_desc', help="Add comment with attachment") + p.add_argument('--ignore-obsolete', action="store_true", + help='Do not download attachments marked as obsolete.') + p.add_argument('-l', '--comment', '--long_desc', + help="Add comment with attachment") + p.add_argument('--private', action='store_true', default=False, + help='Mark new comment as private') def _setup_action_login_parser(subparsers): - usage = 'bugzilla login [username [password]]' - description = "Log into bugzilla and save a login cookie or token." + usage = 'bugzilla login [--api-key] [username [password]]' + description = """Log into bugzilla and save a login cookie or token. +Note: These tokens are short-lived, and future Bugzilla versions will no +longer support token authentication at all. Please use a +~/.config/python-bugzilla/bugzillarc file with an API key instead, or +use 'bugzilla login --api-key' and we will save it for you.""" p = subparsers.add_parser("login", description=description, usage=usage) - p.add_argument("pos_username", nargs="?", help="Optional username", - metavar="username") - p.add_argument("pos_password", nargs="?", help="Optional password", - metavar="password") + p.add_argument('--api-key', action='store_true', default=False, + help='Prompt for and save an API key into bugzillarc, ' + 'rather than prompt for username and password.') + p.add_argument("pos_username", nargs="?", help="Optional username ", + metavar="username") + p.add_argument("pos_password", nargs="?", help="Optional password ", + metavar="password") def setup_parser(): @@ -446,12 +438,9 @@ def setup_parser(): # Command routines # #################### -def _merge_field_opts(query, opt, parser): +def _merge_field_opts(query, fields, parser): # Add any custom fields if specified - if opt.fields is None: - return - - for f in opt.fields: + for f in fields: try: f, v = f.split('=', 1) query[f] = v @@ -494,7 +483,7 @@ def _do_query(bz, opt, parser): # Alias for EndOfLife bug statuses stat = ['VERIFIED', 'RELEASE_PENDING', 'RESOLVED'] elif val == 'OPEN': - # non-Closed statuses + # non-RESOLVED statuses stat = ['NEW', 'ASSIGNED', 'MODIFIED', 'ON_DEV', 'ON_QA', 'VERIFIED', 'RELEASE_PENDING', 'POST'] opt.status = stat @@ -512,7 +501,7 @@ def _do_query(bz, opt, parser): setattr(opt, optname, val.split(",")) include_fields = None - if opt.output == 'raw': + if opt.output in ['raw', 'json']: # 'raw' always does a getbug() call anyways, so just ask for ID back include_fields = ['id'] @@ -537,55 +526,89 @@ def _do_query(bz, opt, parser): if include_fields is not None: include_fields.sort() - built_query = bz.build_query( - product=opt.product or None, - component=opt.component or None, - sub_component=opt.sub_component or None, - version=opt.version or None, - reporter=opt.reporter or None, - bug_id=opt.id or None, - short_desc=opt.summary or None, - long_desc=opt.comment or None, - cc=opt.cc or None, - assigned_to=opt.assigned_to or None, - qa_contact=opt.qa_contact or None, - status=opt.status or None, - blocked=opt.blocked or None, - dependson=opt.dependson or None, - keywords=opt.keywords or None, - keywords_type=opt.keywords_type or None, - url=opt.url or None, - url_type=opt.url_type or None, - status_whiteboard=opt.whiteboard or None, - status_whiteboard_type=opt.status_whiteboard_type or None, - fixed_in=opt.fixed_in or None, - fixed_in_type=opt.fixed_in_type or None, - flag=opt.flag or None, - alias=opt.alias or None, - qa_whiteboard=opt.qa_whiteboard or None, - devel_whiteboard=opt.devel_whiteboard or None, - boolean_query=opt.boolean_query or None, - bug_severity=opt.severity or None, - priority=opt.priority or None, - target_release=opt.target_release or None, - target_milestone=opt.target_milestone or None, - emailtype=opt.emailtype or None, - booleantype=opt.booleantype or None, - include_fields=include_fields, - quicksearch=opt.quicksearch or None, - savedsearch=opt.savedsearch or None, - savedsearch_sharer_id=opt.savedsearch_sharer_id or None, - tags=opt.tags or None) - - _merge_field_opts(built_query, opt, parser) + kwopts = {} + if opt.product: + kwopts["product"] = opt.product + if opt.component: + kwopts["component"] = opt.component + if opt.sub_component: + kwopts["sub_component"] = opt.sub_component + if opt.version: + kwopts["version"] = opt.version + if opt.reporter: + kwopts["reporter"] = opt.reporter + if opt.id: + kwopts["bug_id"] = opt.id + if opt.summary: + kwopts["short_desc"] = opt.summary + if opt.comment: + kwopts["long_desc"] = opt.comment + if opt.cc: + kwopts["cc"] = opt.cc + if opt.assigned_to: + kwopts["assigned_to"] = opt.assigned_to + if opt.qa_contact: + kwopts["qa_contact"] = opt.qa_contact + if opt.status: + kwopts["status"] = opt.status + if opt.blocked: + kwopts["blocked"] = opt.blocked + if opt.dependson: + kwopts["dependson"] = opt.dependson + if opt.keywords: + kwopts["keywords"] = opt.keywords + if opt.keywords_type: + kwopts["keywords_type"] = opt.keywords_type + if opt.url: + kwopts["url"] = opt.url + if opt.url_type: + kwopts["url_type"] = opt.url_type + if opt.whiteboard: + kwopts["status_whiteboard"] = opt.whiteboard + if opt.status_whiteboard_type: + kwopts["status_whiteboard_type"] = opt.status_whiteboard_type + if opt.fixed_in: + kwopts["fixed_in"] = opt.fixed_in + if opt.fixed_in_type: + kwopts["fixed_in_type"] = opt.fixed_in_type + if opt.flag: + kwopts["flag"] = opt.flag + if opt.alias: + kwopts["alias"] = opt.alias + if opt.qa_whiteboard: + kwopts["qa_whiteboard"] = opt.qa_whiteboard + if opt.devel_whiteboard: + kwopts["devel_whiteboard"] = opt.devel_whiteboard + if opt.severity: + kwopts["bug_severity"] = opt.severity + if opt.priority: + kwopts["priority"] = opt.priority + if opt.target_release: + kwopts["target_release"] = opt.target_release + if opt.target_milestone: + kwopts["target_milestone"] = opt.target_milestone + if opt.emailtype: + kwopts["emailtype"] = opt.emailtype + if include_fields: + kwopts["include_fields"] = include_fields + if opt.quicksearch: + kwopts["quicksearch"] = opt.quicksearch + if opt.savedsearch: + kwopts["savedsearch"] = opt.savedsearch + if opt.savedsearch_sharer_id: + kwopts["savedsearch_sharer_id"] = opt.savedsearch_sharer_id + if opt.tags: + kwopts["tags"] = opt.tags + + built_query = bz.build_query(**kwopts) + if opt.fields: + _merge_field_opts(built_query, opt.fields, parser) built_query.update(q) q = built_query - if not q: + if not q: # pragma: no cover parser.error("'query' command requires additional arguments") - if opt.test_return_result: - return q return bz.query(q) @@ -603,18 +626,18 @@ def _do_info(bz, opt): return ret productname = (opt.components or opt.component_owners or opt.versions) - include_fields = ["name", "id"] fastcomponents = (opt.components and not opt.active_components) + + include_fields = ["name", "id"] + if opt.components or opt.component_owners: + include_fields += ["components.name"] + if opt.component_owners: + include_fields += ["components.default_assigned_to"] + if opt.active_components: + include_fields += ["components.is_active"] + if opt.versions: include_fields += ["versions"] - if opt.component_owners: - include_fields += [ - "components.default_assigned_to", - "components.name", - ] - if (opt.active_components and - any(["components" in i for i in include_fields])): - include_fields += ["components.is_active"] bz.refresh_products(names=productname and [productname] or None, include_fields=include_fields) @@ -635,14 +658,12 @@ def _do_info(bz, opt): elif opt.versions: proddict = bz.getproducts()[0] for v in proddict['versions']: - if v["is_active"]: - print(to_encoding(v["name"])) + print(str(v["name"] or '')) elif opt.component_owners: details = bz.getcomponentsdetails(productname) for c in sorted(_filter_components(details)): - print(to_encoding(u"%s: %s" % (c, - details[c]['default_assigned_to']))) + print("%s: %s" % (c, details[c]['default_assigned_to'])) def _convert_to_outputformat(output): @@ -673,92 +694,139 @@ def _convert_to_outputformat(output): fmt += "#%{bug_id} %{status} %{assigned_to} %{component}\t" fmt += "[%{target_milestone}] %{flags} %{cve}" - else: + else: # pragma: no cover raise RuntimeError("Unknown output type '%s'" % output) return fmt -def _format_output(bz, opt, buglist): - if opt.output == 'raw': - buglist = bz.getbugs([b.bug_id for b in buglist]) - for b in buglist: - print("Bugzilla %s: " % b.bug_id) - for attrname in sorted(b.__dict__): - print(to_encoding(u"ATTRIBUTE[%s]: %s" % - (attrname, b.__dict__[attrname]))) - print("\n\n") - return +def _xmlrpc_converter(obj): + if "DateTime" in str(obj.__class__): + # xmlrpc DateTime object. Convert to date format that + # bugzilla REST API outputs + dobj = datetime.datetime.strptime(str(obj), '%Y%m%dT%H:%M:%S') + return dobj.isoformat() + "Z" + if "Binary" in str(obj.__class__): + # xmlrpc Binary object. Convert to base64 + return base64.b64encode(obj.data).decode("utf-8") + raise RuntimeError( + "Unexpected JSON conversion class=%s" % obj.__class__) + - def bug_field(matchobj): - # whiteboard and flag allow doing - # %{whiteboard:devel} and %{flag:needinfo} - # That's what 'rest' matches - (fieldname, rest) = matchobj.groups() - - if fieldname == "whiteboard" and rest: - fieldname = rest + "_" + fieldname - - if fieldname == "flag" and rest: - val = b.get_flag_status(rest) - - elif fieldname == "flags" or fieldname == "flags_requestee": - tmpstr = [] - for f in getattr(b, "flags", []): - requestee = f.get('requestee', "") - if fieldname == "flags": - requestee = "" - if fieldname == "flags_requestee": - if requestee == "": - continue - tmpstr.append("%s" % requestee) - else: - tmpstr.append("%s%s%s" % - (f['name'], f['status'], requestee)) - - val = ",".join(tmpstr) - - elif fieldname == "cve": - cves = [] - for key in getattr(b, "keywords", []): - # grab CVE from keywords and blockers - if key.find("Security") == -1: +def _format_output_json(buglist): + out = {"bugs": [b.get_raw_data() for b in buglist]} + s = json.dumps(out, default=_xmlrpc_converter, indent=2, sort_keys=True) + print(s) + + +def _format_output_raw(buglist): + for b in buglist: + print("Bugzilla %s: " % b.bug_id) + SKIP_NAMES = ["bugzilla"] + for attrname in sorted(b.__dict__): + if attrname in SKIP_NAMES: + continue + if attrname.startswith("_"): + continue + print("ATTRIBUTE[%s]: %s" % (attrname, b.__dict__[attrname])) + print("\n\n") + + +def _bug_field_repl_cb(bz, b, matchobj): + # whiteboard and flag allow doing + # %{whiteboard:devel} and %{flag:needinfo} + # That's what 'rest' matches + (fieldname, rest) = matchobj.groups() + + if fieldname == "whiteboard" and rest: + fieldname = rest + "_" + fieldname + + if fieldname == "flag" and rest: + val = b.get_flag_status(rest) + + elif fieldname in ["flags", "flags_requestee"]: + tmpstr = [] + for f in getattr(b, "flags", []): + requestee = f.get('requestee', "") + if fieldname == "flags": + requestee = "" + if fieldname == "flags_requestee": + if requestee == "": continue - for bl in b.blocks: - cvebug = bz.getbug(bl) - for cb in cvebug.alias: - if cb.find("CVE") == -1: - continue - if cb.strip() not in cves: - cves.append(cb) - val = ",".join(cves) - - elif fieldname == "comments": - val = "" - for c in getattr(b, "comments", []): - val += ("\n* %s - %s:\n%s\n" % (c['time'], - c.get("creator", c.get("author", "")), c['text'])) - - elif fieldname == "external_bugs": - val = "" - for e in getattr(b, "external_bugs", []): - url = e["type"]["full_url"].replace("%id%", e["ext_bz_bug_id"]) - if not val: - val += "\n" - val += "External bug: %s\n" % url - - elif fieldname == "__unicode__": - val = b.__unicode__() - else: - val = getattr(b, fieldname, "") + tmpstr.append("%s" % requestee) + else: + tmpstr.append("%s%s%s" % + (f['name'], f['status'], requestee)) + + val = ",".join(tmpstr) + + elif fieldname == "cve": + cves = [] + for key in getattr(b, "keywords", []): + # grab CVE from keywords and blockers + if key.find("Security") == -1: + continue + for bl in b.blocks: + cvebug = bz.getbug(bl) + for cb in cvebug.alias: + if (cb.find("CVE") != -1 and + cb.strip() not in cves): + cves.append(cb) + val = ",".join(cves) + + elif fieldname == "comments": + val = "" + for c in getattr(b, "comments", []): + val += ("\n* %s - %s:\n%s\n" % (c['time'], + c.get("creator", c.get("author", "")), c['text'])) + + elif fieldname == "external_bugs": + val = "" + for e in getattr(b, "external_bugs", []): + url = e["type"]["full_url"].replace("%id%", e["ext_bz_bug_id"]) + if not val: + val += "\n" + val += "External bug: %s\n" % url + + elif fieldname == "__unicode__": + val = b.__unicode__() + else: + val = getattr(b, fieldname, "") + + vallist = isinstance(val, list) and val or [val] + val = ','.join([str(v or '') for v in vallist]) - vallist = isinstance(val, list) and val or [val] - val = ','.join([to_encoding(v) for v in vallist]) + return val - return val + +def _format_output(bz, opt, buglist): + if opt.output in ['raw', 'json']: + include_fields = None + exclude_fields = None + extra_fields = None + + if opt.includefield: + include_fields = opt.includefield + if opt.excludefield: + exclude_fields = opt.excludefield + if opt.extrafield: + extra_fields = opt.extrafield + + buglist = bz.getbugs([b.bug_id for b in buglist], + include_fields=include_fields, + exclude_fields=exclude_fields, + extra_fields=extra_fields) + if opt.output == 'json': + _format_output_json(buglist) + if opt.output == 'raw': + _format_output_raw(buglist) + return for b in buglist: - print(format_field_re.sub(bug_field, opt.outputformat)) + # pylint: disable=cell-var-from-loop + def cb(matchobj): + return _bug_field_repl_cb(bz, b, matchobj) + print(format_field_re.sub(cb, opt.outputformat)) def _parse_triset(vallist, checkplus=True, checkminus=True, checkequal=True, @@ -796,33 +864,53 @@ def _do_new(bz, opt, parser): return _parse_triset(val, checkplus=False, checkminus=False, checkequal=False, splitcomma=True)[0] - ret = bz.build_createbug( - blocks=parse_multi(opt.blocked) or None, - cc=parse_multi(opt.cc) or None, - component=opt.component or None, - depends_on=parse_multi(opt.dependson) or None, - description=opt.comment or None, - groups=parse_multi(opt.groups) or None, - keywords=parse_multi(opt.keywords) or None, - op_sys=opt.os or None, - platform=opt.arch or None, - priority=opt.priority or None, - product=opt.product or None, - severity=opt.severity or None, - summary=opt.summary or None, - url=opt.url or None, - version=opt.version or None, - assigned_to=opt.assigned_to or None, - qa_contact=opt.qa_contact or None, - sub_component=opt.sub_component or None, - alias=opt.alias or None, - comment_tags=opt.comment_tag or None, - ) - - _merge_field_opts(ret, opt, parser) - - if opt.test_return_result: - return ret + kwopts = {} + if opt.blocked: + kwopts["blocks"] = parse_multi(opt.blocked) + if opt.cc: + kwopts["cc"] = parse_multi(opt.cc) + if opt.component: + kwopts["component"] = opt.component + if opt.dependson: + kwopts["depends_on"] = parse_multi(opt.dependson) + if opt.comment: + kwopts["description"] = opt.comment + if opt.groups: + kwopts["groups"] = parse_multi(opt.groups) + if opt.keywords: + kwopts["keywords"] = parse_multi(opt.keywords) + if opt.os: + kwopts["op_sys"] = opt.os + if opt.arch: + kwopts["platform"] = opt.arch + if opt.priority: + kwopts["priority"] = opt.priority + if opt.product: + kwopts["product"] = opt.product + if opt.severity: + kwopts["severity"] = opt.severity + if opt.summary: + kwopts["summary"] = opt.summary + if opt.url: + kwopts["url"] = opt.url + if opt.version: + kwopts["version"] = opt.version + if opt.assigned_to: + kwopts["assigned_to"] = opt.assigned_to + if opt.qa_contact: + kwopts["qa_contact"] = opt.qa_contact + if opt.sub_component: + kwopts["sub_component"] = opt.sub_component + if opt.alias: + kwopts["alias"] = opt.alias + if opt.comment_tag: + kwopts["comment_tags"] = opt.comment_tag + if opt.private: + kwopts["comment_private"] = opt.private + + ret = bz.build_createbug(**kwopts) + if opt.fields: + _merge_field_opts(ret, opt.fields, parser) b = bz.createbug(ret) if not opt.no_refresh: @@ -861,50 +949,96 @@ def _do_modify(bz, parser, opt): for f in opt.flag: flags.append({"name": f[:-1], "status": f[-1]}) - update = bz.build_update( - assigned_to=opt.assigned_to or None, - comment=opt.comment or None, - comment_private=opt.private or None, - component=opt.component or None, - product=opt.product or None, - blocks_add=add_blk or None, - blocks_remove=rm_blk or None, - blocks_set=set_blk, - url=opt.url or None, - cc_add=add_cc or None, - cc_remove=rm_cc or None, - depends_on_add=add_deps or None, - depends_on_remove=rm_deps or None, - depends_on_set=set_deps, - groups_add=add_groups or None, - groups_remove=rm_groups or None, - keywords_add=add_key or None, - keywords_remove=rm_key or None, - keywords_set=set_key, - op_sys=opt.os or None, - platform=opt.arch or None, - priority=opt.priority or None, - qa_contact=opt.qa_contact or None, - severity=opt.severity or None, - status=status, - summary=opt.summary or None, - version=opt.version or None, - reset_assigned_to=opt.reset_assignee or None, - reset_qa_contact=opt.reset_qa_contact or None, - resolution=opt.close or None, - target_release=opt.target_release or None, - target_milestone=opt.target_milestone or None, - dupe_of=opt.dupeid or None, - fixed_in=opt.fixed_in or None, - whiteboard=set_wb and set_wb[0] or None, - devel_whiteboard=set_devwb and set_devwb[0] or None, - internal_whiteboard=set_intwb and set_intwb[0] or None, - qa_whiteboard=set_qawb and set_qawb[0] or None, - sub_component=opt.sub_component or None, - alias=opt.alias or None, - flags=flags or None, - comment_tags=opt.comment_tag or None, - ) + update_opts = {} + + if opt.assigned_to: + update_opts["assigned_to"] = opt.assigned_to + if opt.comment: + update_opts["comment"] = opt.comment + if opt.private: + update_opts["comment_private"] = opt.private + if opt.component: + update_opts["component"] = opt.component + if opt.product: + update_opts["product"] = opt.product + if add_blk: + update_opts["blocks_add"] = add_blk + if rm_blk: + update_opts["blocks_remove"] = rm_blk + if set_blk is not None: + update_opts["blocks_set"] = set_blk + if opt.url: + update_opts["url"] = opt.url + if add_cc: + update_opts["cc_add"] = add_cc + if rm_cc: + update_opts["cc_remove"] = rm_cc + if add_deps: + update_opts["depends_on_add"] = add_deps + if rm_deps: + update_opts["depends_on_remove"] = rm_deps + if set_deps is not None: + update_opts["depends_on_set"] = set_deps + if add_groups: + update_opts["groups_add"] = add_groups + if rm_groups: + update_opts["groups_remove"] = rm_groups + if add_key: + update_opts["keywords_add"] = add_key + if rm_key: + update_opts["keywords_remove"] = rm_key + if set_key is not None: + update_opts["keywords_set"] = set_key + if opt.os: + update_opts["op_sys"] = opt.os + if opt.arch: + update_opts["platform"] = opt.arch + if opt.priority: + update_opts["priority"] = opt.priority + if opt.qa_contact: + update_opts["qa_contact"] = opt.qa_contact + if opt.severity: + update_opts["severity"] = opt.severity + if status: + update_opts["status"] = status + if opt.summary: + update_opts["summary"] = opt.summary + if opt.version: + update_opts["version"] = opt.version + if opt.reset_assignee: + update_opts["reset_assigned_to"] = opt.reset_assignee + if opt.reset_qa_contact: + update_opts["reset_qa_contact"] = opt.reset_qa_contact + if opt.close: + update_opts["resolution"] = opt.close + if opt.target_release: + update_opts["target_release"] = opt.target_release + if opt.target_milestone: + update_opts["target_milestone"] = opt.target_milestone + if opt.dupeid: + update_opts["dupe_of"] = opt.dupeid + if opt.fixed_in: + update_opts["fixed_in"] = opt.fixed_in + if set_wb and set_wb[0]: + update_opts["whiteboard"] = set_wb and set_wb[0] + if set_devwb and set_devwb[0]: + update_opts["devel_whiteboard"] = set_devwb and set_devwb[0] + if set_intwb and set_intwb[0]: + update_opts["internal_whiteboard"] = set_intwb and set_intwb[0] + if set_qawb and set_qawb[0]: + update_opts["qa_whiteboard"] = set_qawb and set_qawb[0] + if opt.sub_component: + update_opts["sub_component"] = opt.sub_component + if opt.alias: + update_opts["alias"] = opt.alias + if flags: + update_opts["flags"] = flags + if opt.comment_tag: + update_opts["comment_tags"] = opt.comment_tag + if opt.minor_update: + update_opts["minor_update"] = opt.minor_update + + update = bz.build_update(**update_opts) # We make this a little convoluted to facilitate unit testing wbmap = { @@ -918,7 +1052,8 @@ def _do_modify(bz, parser, opt): if not v[0] and not v[1]: del(wbmap[k]) - _merge_field_opts(update, opt, parser) + if opt.fields: + _merge_field_opts(update, opt.fields, parser) log.debug("update bug dict=%s", update) log.debug("update whiteboard dict=%s", wbmap) @@ -926,9 +1061,6 @@ def _do_modify(bz, parser, opt): if not any([update, wbmap, add_tags, rm_tags]): parser.error("'modify' command requires additional arguments") - if opt.test_return_result: - return (update, wbmap, add_tags, rm_tags) - if add_tags or rm_tags: ret = bz.update_tags(bugid_list, tags_add=add_tags, tags_remove=rm_tags) @@ -943,33 +1075,49 @@ def _do_modify(bz, parser, opt): # Now for the things we can't blindly batch. # Being able to prepend/append to whiteboards, which are just # plain string values, is an old rhbz semantic that we try to maintain - # here. This is a bit weird for traditional bugzilla XMLRPC + # here. This is a bit weird for traditional bugzilla API log.debug("Adjusting whiteboard fields one by one") for bug in bz.getbugs(bugid_list): - for wb, (add_list, rm_list) in wbmap.items(): + update_kwargs = {} + for wbkey, (add_list, rm_list) in wbmap.items(): + bugval = getattr(bug, wbkey) or "" for tag in add_list: - newval = getattr(bug, wb) or "" - if newval: - newval += " " - newval += tag - bz.update_bugs([bug.id], - bz.build_update(**{wb: newval})) + if bugval: + bugval += " " + bugval += tag for tag in rm_list: - newval = (getattr(bug, wb) or "").split() - for t in newval[:]: + bugsplit = bugval.split() + for t in bugsplit[:]: if t == tag: - newval.remove(t) - bz.update_bugs([bug.id], - bz.build_update(**{wb: " ".join(newval)})) + bugsplit.remove(t) + bugval = " ".join(bugsplit) + + update_kwargs[wbkey] = bugval + + bz.update_bugs([bug.id], bz.build_update(**update_kwargs)) def _do_get_attach(bz, opt): - for bug in bz.getbugs(opt.getall): - opt.get += bug.get_attachment_ids() + data = {} + + def _process_attachment_data(_attlist): + for _att in _attlist: + data[_att["id"]] = _att + + if opt.getall: + for attlist in bz.get_attachments(opt.getall, None)["bugs"].values(): + _process_attachment_data(attlist) + if opt.get: + _process_attachment_data( + bz.get_attachments(None, opt.get)["attachments"].values()) + + for attdata in data.values(): + is_obsolete = attdata.get("is_obsolete", None) == 1 + if opt.ignore_obsolete and is_obsolete: + continue - for attid in set(opt.get): - att = bz.openattachment(attid) + att = bz.openattachment_data(attdata) outfile = open_without_clobber(att.name, "wb") data = att.read(4096) while data: @@ -977,8 +1125,6 @@ def _do_get_attach(bz, opt): data = att.read(4096) print("Wrote %s" % outfile.name) - return - def _do_set_attach(bz, opt, parser): if not opt.ids: @@ -1011,6 +1157,8 @@ def _do_set_attach(bz, opt, parser): kwargs["ispatch"] = True if opt.comment: kwargs["comment"] = opt.comment + if opt.private: + kwargs["is_private"] = True desc = opt.desc or os.path.basename(fileobj.name) # Upload attachments @@ -1032,17 +1180,19 @@ def _make_bz_instance(opt): cookiefile = None tokenfile = None + use_creds = False if opt.cache_credentials: cookiefile = opt.cookiefile or -1 tokenfile = opt.tokenfile or -1 + use_creds = True - bz = bugzilla.Bugzilla( + return bugzilla.Bugzilla( url=opt.bugzilla, cookiefile=cookiefile, tokenfile=tokenfile, sslverify=opt.sslverify, + use_creds=use_creds, cert=opt.cert) - return bz def _handle_login(opt, action, bz): @@ -1055,12 +1205,19 @@ def _handle_login(opt, action, bz): opt.login or opt.username or opt.password) username = getattr(opt, "pos_username", None) or opt.username password = getattr(opt, "pos_password", None) or opt.password + use_key = getattr(opt, "api_key", False) try: - if do_interactive_login: - if bz.url: - print("Logging into %s" % urlparse(bz.url)[1]) - bz.interactive_login(username, password) + if use_key: + bz.interactive_save_api_key() + elif do_interactive_login: + if bz.api_key: + print("You already have an API key configured for %s" % bz.url) + print("There is no need to cache a login token. Exiting.") + sys.exit(0) + print("Logging into %s" % urllib.parse.urlparse(bz.url)[1]) + bz.interactive_login(username, password, + restrict_login=opt.restrict_login) except bugzilla.BugzillaError as e: print(str(e)) sys.exit(1) @@ -1071,11 +1228,6 @@ def _handle_login(opt, action, bz): sys.exit(1) if is_login_command: - msg = "Login successful." - if bz.cookiefile or bz.tokenfile: - msg = "Login successful, token cache updated." - - print(msg) sys.exit(0) @@ -1086,9 +1238,7 @@ def _main(unittest_bz_instance): setup_logging(opt.debug, opt.verbose) log.debug("Launched with command line: %s", " ".join(sys.argv)) - - # Connect to bugzilla - log.info('Connecting to %s', opt.bugzilla) + log.debug("Bugzilla module: %s", bugzilla) if unittest_bz_instance: bz = unittest_bz_instance @@ -1104,28 +1254,18 @@ def _main(unittest_bz_instance): ########################### if hasattr(opt, "outputformat"): - if not opt.outputformat and opt.output not in ['raw', None]: + if not opt.outputformat and opt.output not in ['raw', 'json', None]: opt.outputformat = _convert_to_outputformat(opt.output) buglist = [] if action == 'info': - if not (opt.products or - opt.components or - opt.component_owners or - opt.versions): - parser.error("'info' command requires additional arguments") - _do_info(bz, opt) elif action == 'query': buglist = _do_query(bz, opt, parser) - if opt.test_return_result: - return buglist elif action == 'new': buglist = _do_new(bz, opt, parser) - if opt.test_return_result: - return buglist elif action == 'attach': if opt.get or opt.getall: @@ -1137,10 +1277,8 @@ def _main(unittest_bz_instance): _do_set_attach(bz, opt, parser) elif action == 'modify': - modout = _do_modify(bz, parser, opt) - if opt.test_return_result: - return modout - else: + _do_modify(bz, parser, opt) + else: # pragma: no cover raise RuntimeError("Unexpected action '%s'" % action) # If we're doing new/query/modify, output our results @@ -1155,7 +1293,10 @@ def main(unittest_bz_instance=None): except (Exception, KeyboardInterrupt): log.debug("", exc_info=True) raise - except (Fault, bugzilla.BugzillaError) as e: + except KeyboardInterrupt: + print("\nExited at user request.") + sys.exit(1) + except (xmlrpc.client.Fault, bugzilla.BugzillaError) as e: print("\nServer error: %s" % str(e)) sys.exit(3) except requests.exceptions.SSLError as e: @@ -1168,15 +1309,11 @@ def main(unittest_bz_instance=None): except (socket.error, requests.exceptions.HTTPError, requests.exceptions.ConnectionError, - ProtocolError) as e: + requests.exceptions.InvalidURL, + xmlrpc.client.ProtocolError) as e: print("\nConnection lost/failed: %s" % str(e)) sys.exit(2) def cli(): - try: - main() - except KeyboardInterrupt: - log.debug("", exc_info=True) - print("\nExited at user request.") - sys.exit(1) + main() diff --git a/scripts/bugzilla/_rhconverters.py b/scripts/bugzilla/_rhconverters.py new file mode 100644 index 0000000..fb371cd --- /dev/null +++ b/scripts/bugzilla/_rhconverters.py @@ -0,0 +1,128 @@ +# rhbugzilla.py - a Python interface to Red Hat Bugzilla using xmlrpclib. +# +# Copyright (C) 2008-2012 Red Hat Inc. +# Author: Will Woods +# +# This work is licensed under the GNU GPLv2 or later. +# See the COPYING file in the top-level directory. + +from logging import getLogger + +from ._util import listify + +log = getLogger(__name__) + + +class _RHBugzillaConverters(object): + """ + Static class that holds functional Red Hat back compat converters. + Called inline in Bugzilla + """ + @staticmethod + def convert_build_update( + component=None, + fixed_in=None, + qa_whiteboard=None, + devel_whiteboard=None, + internal_whiteboard=None, + sub_component=None): + adddict = {} + + def get_alias(): + # RHBZ has a custom extension to allow a bug to have multiple + # aliases, so the format of aliases is + # {"add": [...], "remove": [...]} + # But that means in order to approximate upstream, behavior + # which just overwrites the existing alias, we need to read + # the bug's state first to know what string to remove. Which + # we can't do, since we don't know the bug numbers at this point. + # So fail for now. + # + # The API should provide {"set": [...]} + # https://bugzilla.redhat.com/show_bug.cgi?id=1173114 + # + # Implementation will go here when it's available + pass + + if fixed_in is not None: + adddict["cf_fixed_in"] = fixed_in + if qa_whiteboard is not None: + adddict["cf_qa_whiteboard"] = qa_whiteboard + if devel_whiteboard is not None: + adddict["cf_devel_whiteboard"] = devel_whiteboard + if internal_whiteboard is not None: + adddict["cf_internal_whiteboard"] = internal_whiteboard + + if sub_component: + if not isinstance(sub_component, dict): + component = listify(component) + if not component: + raise ValueError("component must be specified if " + "specifying sub_component") + sub_component = {component[0]: sub_component} + adddict["sub_components"] = sub_component + + get_alias() + + return adddict + + + ################# + # Query methods # + ################# + + @staticmethod + def pre_translation(query): + """ + Translates the query for possible aliases + """ + old = query.copy() + + def split_comma(_v): + if isinstance(_v, list): + return _v + return _v.split(",") + + if 'bug_id' in query: + query['id'] = split_comma(query.pop('bug_id')) + + if 'component' in query: + query['component'] = split_comma(query['component']) + + if 'include_fields' not in query and 'column_list' in query: + query['include_fields'] = query.pop('column_list') + + if old != query: + log.debug("RHBugzilla pretranslated query to: %s", query) + + @staticmethod + def post_translation(query, bug): + """ + Convert the results of getbug back to the ancient RHBZ value + formats + """ + ignore = query + + # RHBZ _still_ returns component and version as lists, which + # deviates from upstream. Copy the list values to components + # and versions respectively. + if 'component' in bug and "components" not in bug: + val = bug['component'] + bug['components'] = isinstance(val, list) and val or [val] + bug['component'] = bug['components'][0] + + if 'version' in bug and "versions" not in bug: + val = bug['version'] + bug['versions'] = isinstance(val, list) and val or [val] + bug['version'] = bug['versions'][0] + + # sub_components isn't too friendly of a format, add a simpler + # sub_component value + if 'sub_components' in bug and 'sub_component' not in bug: + val = bug['sub_components'] + bug['sub_component'] = "" + if isinstance(val, dict): + values = [] + for vallist in val.values(): + values += vallist + bug['sub_component'] = " ".join(values) diff --git a/scripts/bugzilla/_session.py b/scripts/bugzilla/_session.py new file mode 100644 index 0000000..ce03051 --- /dev/null +++ b/scripts/bugzilla/_session.py @@ -0,0 +1,114 @@ +# This work is licensed under the GNU GPLv2 or later. +# See the COPYING file in the top-level directory. + +from logging import getLogger + +import os +import sys +import urllib.parse + +import requests + + +log = getLogger(__name__) + + +class _BugzillaSession(object): + """ + Class to handle the backend agnostic 'requests' setup + """ + def __init__(self, url, user_agent, + sslverify, cert, tokencache, api_key, + is_redhat_bugzilla, + requests_session=None): + self._url = url + self._user_agent = user_agent + self._scheme = urllib.parse.urlparse(url)[0] + self._tokencache = tokencache + self._api_key = api_key + self._is_xmlrpc = False + self._use_auth_bearer = False + + if self._scheme not in ["http", "https"]: + raise Exception("Invalid URL scheme: %s (%s)" % ( + self._scheme, url)) + + self._session = requests_session + if not self._session: + self._session = requests.Session() + + if cert: + self._session.cert = cert + if sslverify is False: + self._session.verify = False + self._session.headers["User-Agent"] = self._user_agent + + if is_redhat_bugzilla and self._api_key: + self._use_auth_bearer = True + self._session.headers["Authorization"] = ( + "Bearer %s" % self._api_key) + + def _get_timeout(self): + # Default to 5 minutes. This is longer than bugzilla.redhat.com's + # apparent 3 minute timeout so shouldn't affect legitimate usage, + # but saves us from indefinite hangs + DEFAULT_TIMEOUT = 300 + envtimeout = os.environ.get("PYTHONBUGZILLA_REQUESTS_TIMEOUT") + return float(envtimeout or DEFAULT_TIMEOUT) + + def set_rest_defaults(self): + self._session.headers["Content-Type"] = "application/json" + def set_xmlrpc_defaults(self): + self._is_xmlrpc = True + self._session.headers["Content-Type"] = "text/xml" + + def get_user_agent(self): + return self._user_agent + def get_scheme(self): + return self._scheme + + def get_auth_params(self): + # bugzilla.redhat.com will error if there's auth bits in params + # when Authorization header is used + if self._use_auth_bearer: + return {} + + # Don't add a token to the params list if an API key is set. + # Keeping API key solo means bugzilla will definitely fail + # if the key expires. Passing in a token could hide that + # fact, which could make it confusing to pinpoint the issue. + if self._api_key: + # Bugzilla 5.0 only supports api_key as a query parameter. + # Bugzilla 5.1+ takes it as a X-BUGZILLA-API-KEY header as well, + # with query param taking preference. + return {"Bugzilla_api_key": self._api_key} + + token = self._tokencache.get_value(self._url) + if token: + return {"Bugzilla_token": token} + + return {} + + def get_requests_session(self): + return self._session + + def request(self, *args, **kwargs): + timeout = self._get_timeout() + if "timeout" not in kwargs: + kwargs["timeout"] = timeout + + response = self._session.request(*args, **kwargs) + + if self._is_xmlrpc: + # Yes this still appears to matter for properly decoding unicode + # code points in bugzilla.redhat.com content + response.encoding = "UTF-8" + + try: + response.raise_for_status() + except Exception as e: + # Scrape the api key out of the returned exception string + message = str(e).replace(self._api_key or "", "") + raise type(e)(message).with_traceback(sys.exc_info()[2]) + + return response diff --git a/scripts/bugzilla/_util.py b/scripts/bugzilla/_util.py new file mode 100644 index 0000000..0455577 --- /dev/null +++ b/scripts/bugzilla/_util.py @@ -0,0 +1,12 @@ +# This work is licensed under the GNU GPLv2 or later. +# See the COPYING file in the top-level directory. + + +def listify(val): + """Ensure that value is either None or a list, converting single values + into 1-element lists""" + if val is None: + return val + if isinstance(val, list): + return val + return [val] diff --git a/scripts/bugzilla/apiversion.py b/scripts/bugzilla/apiversion.py index 4e6e2c1..3a6d3e8 100644 --- a/scripts/bugzilla/apiversion.py +++ b/scripts/bugzilla/apiversion.py @@ -1,11 +1,8 @@ # # Copyright (C) 2014 Red Hat Inc. # -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See http://www.gnu.org/copyleft/gpl.html for -# the full text of the license. +# This work is licensed under the GNU GPLv2 or later. +# See the COPYING file in the top-level directory. -version = "2.2.0.dev0" +version = "3.2.0" __version__ = version diff --git a/scripts/bugzilla/base.py b/scripts/bugzilla/base.py index 483b0ee..68b3683 100644 --- a/scripts/bugzilla/base.py +++ b/scripts/bugzilla/base.py @@ -3,143 +3,44 @@ # Copyright (C) 2007, 2008, 2009, 2010 Red Hat Inc. # Author: Will Woods # -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See http://www.gnu.org/copyleft/gpl.html for -# the full text of the license. +# This work is licensed under the GNU GPLv2 or later. +# See the COPYING file in the top-level directory. import collections import getpass import locale from logging import getLogger +import mimetypes import os import sys +import urllib.parse from io import BytesIO -# pylint: disable=import-error -if sys.version_info[0] >= 3: - # pylint: disable=no-name-in-module - from configparser import SafeConfigParser - from http.cookiejar import LoadError, MozillaCookieJar - from urllib.parse import urlparse, parse_qsl - from xmlrpc.client import Binary, Fault -else: - from ConfigParser import SafeConfigParser - from cookielib import LoadError, MozillaCookieJar - from urlparse import urlparse, parse_qsl - from xmlrpclib import Binary, Fault -# pylint: enable=import-error - - +from ._authfiles import _BugzillaRCFile, _BugzillaTokenCache from .apiversion import __version__ -from .bug import Bug, User -from .transport import BugzillaError, _BugzillaServerProxy, _RequestsTransport +from ._backendrest import _BackendREST +from ._backendxmlrpc import _BackendXMLRPC +from .bug import Bug, Group, User +from .exceptions import BugzillaError +from ._rhconverters import _RHBugzillaConverters +from ._session import _BugzillaSession +from ._util import listify log = getLogger(__name__) -mimemagic = None - - -def _detect_filetype(fname): - global mimemagic - - if mimemagic is None: - try: - # pylint: disable=import-error - import magic - mimemagic = magic.open(getattr(magic, "MAGIC_MIME_TYPE", 16)) - mimemagic.load() - except ImportError as e: - log.debug("Could not load python-magic: %s", e) - mimemagic = None - if not mimemagic: - return None - - if not os.path.isabs(fname): - return None - - try: - return mimemagic.file(fname) - except Exception as e: - log.debug("Could not detect content_type: %s", e) - return None - def _nested_update(d, u): # Helper for nested dict update() - # https://stackoverflow.com/questions/3232943/update-value-of-a-nested-dictionary-of-varying-depth for k, v in list(u.items()): - if isinstance(v, collections.Mapping): + if isinstance(v, collections.abc.Mapping): d[k] = _nested_update(d.get(k, {}), v) else: d[k] = v return d -def _default_auth_location(filename): - """ - Determine auth location for filename, like 'bugzillacookies'. If - old style ~/.bugzillacookies exists, we use that, otherwise we - use ~/.cache/python-bugzilla/bugzillacookies. Same for bugzillatoken - """ - homepath = os.path.expanduser("~/.%s" % filename) - xdgpath = os.path.expanduser("~/.cache/python-bugzilla/%s" % filename) - if os.path.exists(xdgpath): - return xdgpath - if os.path.exists(homepath): - return homepath - - if not os.path.exists(os.path.dirname(xdgpath)): - os.makedirs(os.path.dirname(xdgpath), 0o700) - return xdgpath - - -def _build_cookiejar(cookiefile): - cj = MozillaCookieJar(cookiefile) - if cookiefile is None: - return cj - if not os.path.exists(cookiefile): - # Make sure a new file has correct permissions - open(cookiefile, 'a').close() - os.chmod(cookiefile, 0o600) - cj.save() - return cj - - try: - cj.load() - return cj - except LoadError: - raise BugzillaError("cookiefile=%s not in Mozilla format" % - cookiefile) - - -_default_configpaths = [ - '/etc/bugzillarc', - '~/.bugzillarc', - '~/.config/python-bugzilla/bugzillarc', -] - - -def _open_bugzillarc(configpaths=-1): - if configpaths == -1: - configpaths = _default_configpaths[:] - - # pylint: disable=protected-access - configpaths = [os.path.expanduser(p) for p in - Bugzilla._listify(configpaths)] - # pylint: enable=protected-access - cfg = SafeConfigParser() - read_files = cfg.read(configpaths) - if not read_files: - return - - log.info("Found bugzillarc files: %s", read_files) - return cfg - - class _FieldAlias(object): """ Track API attribute names that differ from what we expose in users. @@ -171,6 +72,8 @@ class _BugzillaAPICache(object): self.products = [] self.component_names = {} self.bugfields = [] + self.version_raw = None + self.version_parsed = (0, 0) class Bugzilla(object): @@ -183,11 +86,11 @@ class Bugzilla(object): bzapi = Bugzilla("http://bugzilla.example.com") If you have previously logged into that URL, and have cached login - cookies/tokens, you will automatically be logged in. Otherwise to + tokens, you will automatically be logged in. Otherwise to log in, you can either pass auth options to __init__, or call a login helper like interactive_login(). - If you are not logged in, you won be able to access restricted data like + If you are not logged in, you won't be able to access restricted data like user email, or perform write actions like bug create/update. But simple querys will work correctly. @@ -197,29 +100,23 @@ class Bugzilla(object): Another way to specify auth credentials is via a 'bugzillarc' file. See readconfig() documentation for details. """ - - # bugzilla version that the class is targeting. filled in by - # subclasses - bz_ver_major = 0 - bz_ver_minor = 0 - @staticmethod def url_to_query(url): - ''' + """ Given a big huge bugzilla query URL, returns a query dict that can be passed along to the Bugzilla.query() method. - ''' + """ q = {} # pylint: disable=unpacking-non-sequence - (ignore, ignore, path, - ignore, query, ignore) = urlparse(url) + (ignore1, ignore2, path, + ignore, query, ignore3) = urllib.parse.urlparse(url) base = os.path.basename(path) if base not in ('buglist.cgi', 'query.cgi'): return {} - for (k, v) in parse_qsl(query): + for (k, v) in urllib.parse.parse_qsl(query): if k not in q: q[k] = v elif isinstance(q[k], list): @@ -238,30 +135,46 @@ class Bugzilla(object): return q @staticmethod - def fix_url(url): + def fix_url(url, force_rest=False): """ Turn passed url into a bugzilla XMLRPC web url + + :param force_rest: If True, generate a REST API url """ - if '://' not in url: - log.debug('No scheme given for url, assuming https') - url = 'https://' + url - if url.count('/') < 3: - log.debug('No path given for url, assuming /xmlrpc.cgi') - url = url + '/xmlrpc.cgi' - return url + (scheme, netloc, path, + params, query, fragment) = urllib.parse.urlparse(url) + if not scheme: + scheme = 'https' + + if path and not netloc: + netloc = path.split("/", 1)[0] + path = "/".join(path.split("/")[1:]) or None + + if not path: + path = 'xmlrpc.cgi' + if force_rest: + path = "rest/" + + newurl = urllib.parse.urlunparse( + (scheme, netloc, path, params, query, fragment)) + return newurl @staticmethod - def _listify(val): - if val is None: - return val - if isinstance(val, list): - return val - return [val] + def get_rcfile_default_url(): + """ + Helper to check all the default bugzillarc file paths for + a [DEFAULT] url=X section, and if found, return it. + """ + configpaths = _BugzillaRCFile.get_default_configpaths() + rcfile = _BugzillaRCFile() + rcfile.set_configpaths(configpaths) + return rcfile.get_default_url() def __init__(self, url=-1, user=None, password=None, cookiefile=-1, sslverify=True, tokenfile=-1, use_creds=True, api_key=None, - cert=None, authtype=None): + cert=None, configpaths=-1, + force_rest=False, force_xmlrpc=False, requests_session=None): """ :param url: The bugzilla instance URL, which we will connect to immediately. Most users will want to specify this at @@ -271,25 +184,29 @@ class Bugzilla(object): :param password: optional password for the connecting user :param cert: optional certificate file for client side certificate authentication - :param cookiefile: Location to cache the login session cookies so you - don't have to keep specifying username/password. Bugzilla 5+ will - use tokens instead of cookies. - If -1, use the default path. If None, don't use or save - any cookiefile. + :param cookiefile: Deprecated, raises an error if not -1 or None :param sslverify: Set this to False to skip SSL hostname and CA validation checks, like out of date certificate :param tokenfile: Location to cache the API login token so youi don't have to keep specifying username/password. If -1, use the default path. If None, don't use or save any tokenfile. - :param use_creds: If False, this disables cookiefile, tokenfile, - and any bugzillarc reading. This overwrites any tokenfile - or cookiefile settings + :param use_creds: If False, this disables tokenfile + and configpaths by default. This is a convenience option to + unset those values at init time. If those values are later + changed, they may be used for future operations. :param sslverify: Maps to 'requests' sslverify parameter. Set to False to disable SSL verification, but it can also be a path to file or directory for custom certs. - :param api_key: A bugzilla - :param authtype: Authentication type: empty or 'basic' + :param api_key: A bugzilla5+ API key + :param configpaths: A list of possible bugzillarc locations. + :param force_rest: Force use of the REST API + :param force_xmlrpc: Force use of the XMLRPC API. If neither force_X + parameter are specified, heuristics will be used to determine + which API to use, with XMLRPC preferred for back compatability. + :param requests_session: An optional requests.Session object the + API will use to contact the remote bugzilla instance. This + way the API user can set up whatever auth bits they may need. """ if url == -1: raise TypeError("Specify a valid bugzilla url, or pass url=None") @@ -298,158 +215,177 @@ class Bugzilla(object): self.user = user or '' self.password = password or '' self.api_key = api_key - self.cert = cert or '' + self.cert = cert or None self.url = '' - self.authtype = authtype or '' - self._proxy = None - self._transport = None - self._cookiejar = None + self._backend = None + self._session = None + self._user_requests_session = requests_session self._sslverify = sslverify self._cache = _BugzillaAPICache() self._bug_autorefresh = False + self._is_redhat_bugzilla = False + + self._rcfile = _BugzillaRCFile() + self._tokencache = _BugzillaTokenCache() - self._field_aliases = [] - self._init_field_aliases() + self._force_rest = force_rest + self._force_xmlrpc = force_xmlrpc + + if cookiefile not in [None, -1]: + raise TypeError("cookiefile is deprecated, don't pass any value.") - self.configpath = _default_configpaths[:] if not use_creds: - cookiefile = None tokenfile = None - self.configpath = [] + configpaths = [] - if cookiefile == -1: - cookiefile = _default_auth_location("bugzillacookies") if tokenfile == -1: - tokenfile = _default_auth_location("bugzillatoken") - log.debug("Using tokenfile=%s", tokenfile) - self.cookiefile = cookiefile - self.tokenfile = tokenfile + tokenfile = self._tokencache.get_default_path() + if configpaths == -1: + configpaths = _BugzillaRCFile.get_default_configpaths() + + self._settokenfile(tokenfile) + self._setconfigpath(configpaths) if url: self.connect(url) - self._init_class_from_url() - self._init_class_state() + + def _detect_is_redhat_bugzilla(self): + if self._is_redhat_bugzilla: + return True + + match = ".redhat.com" + if match in self.url: + log.info("Using RHBugzilla for URL containing %s", match) + return True + + return False def _init_class_from_url(self): """ Detect if we should use RHBugzilla class, and if so, set it """ - from bugzilla import RHBugzilla - if isinstance(self, RHBugzilla): - return + from .oldclasses import RHBugzilla # pylint: disable=cyclic-import - c = None - if "bugzilla.redhat.com" in self.url: - log.info("Using RHBugzilla for URL containing bugzilla.redhat.com") - c = RHBugzilla - else: - try: - extensions = self._proxy.Bugzilla.extensions() - if "RedHat" in extensions.get('extensions', {}): - log.info("Found RedHat bugzilla extension, " - "using RHBugzilla") - c = RHBugzilla - except Fault: - log.debug("Failed to fetch bugzilla extensions", exc_info=True) - - if not c: + if not self._detect_is_redhat_bugzilla(): return - self.__class__ = c + self._is_redhat_bugzilla = True + if self.__class__ == Bugzilla: + # Overriding the class doesn't have any functional effect, + # but we continue to do it for API back compat incase anyone + # is doing any class comparison. We should drop this in the future + self.__class__ = RHBugzilla - def _init_class_state(self): - """ - Hook for subclasses to do any __init__ time setup - """ - pass - - def _init_field_aliases(self): + def _get_field_aliases(self): # List of field aliases. Maps old style RHBZ parameter # names to actual upstream values. Used for createbug() and # query include_fields at least. - self._add_field_alias('summary', 'short_desc') - self._add_field_alias('description', 'comment') - self._add_field_alias('platform', 'rep_platform') - self._add_field_alias('severity', 'bug_severity') - self._add_field_alias('status', 'bug_status') - self._add_field_alias('id', 'bug_id') - self._add_field_alias('blocks', 'blockedby') - self._add_field_alias('blocks', 'blocked') - self._add_field_alias('depends_on', 'dependson') - self._add_field_alias('creator', 'reporter') - self._add_field_alias('url', 'bug_file_loc') - self._add_field_alias('dupe_of', 'dupe_id') - self._add_field_alias('dupe_of', 'dup_id') - self._add_field_alias('comments', 'longdescs') - self._add_field_alias('creation_time', 'opendate') - self._add_field_alias('creation_time', 'creation_ts') - self._add_field_alias('whiteboard', 'status_whiteboard') - self._add_field_alias('last_change_time', 'delta_ts') + ret = [] + + def _add(*args, **kwargs): + ret.append(_FieldAlias(*args, **kwargs)) + + def _add_both(newname, origname): + _add(newname, origname, is_api=False) + _add(origname, newname, is_bug=False) + + _add('summary', 'short_desc') + _add('description', 'comment') + _add('platform', 'rep_platform') + _add('severity', 'bug_severity') + _add('status', 'bug_status') + _add('id', 'bug_id') + _add('blocks', 'blockedby') + _add('blocks', 'blocked') + _add('depends_on', 'dependson') + _add('creator', 'reporter') + _add('url', 'bug_file_loc') + _add('dupe_of', 'dupe_id') + _add('dupe_of', 'dup_id') + _add('comments', 'longdescs') + _add('creation_time', 'opendate') + _add('creation_time', 'creation_ts') + _add('whiteboard', 'status_whiteboard') + _add('last_change_time', 'delta_ts') + + if self._is_redhat_bugzilla: + _add_both('fixed_in', 'cf_fixed_in') + _add_both('qa_whiteboard', 'cf_qa_whiteboard') + _add_both('devel_whiteboard', 'cf_devel_whiteboard') + _add_both('internal_whiteboard', 'cf_internal_whiteboard') + + _add('component', 'components', is_bug=False) + _add('version', 'versions', is_bug=False) + # Yes, sub_components is the field name the API expects + _add('sub_components', 'sub_component', is_bug=False) + # flags format isn't exactly the same but it's the closest approx + _add('flags', 'flag_types') + + return ret def _get_user_agent(self): return 'python-bugzilla/%s' % __version__ user_agent = property(_get_user_agent) + @property + def bz_ver_major(self): + return self._cache.version_parsed[0] + + @property + def bz_ver_minor(self): + return self._cache.version_parsed[1] + ################### # Private helpers # ################### - def _check_version(self, major, minor): + def _get_version(self): """ - Check if the detected bugzilla version is >= passed major/minor pair. + Return version number as a float """ - if major < self.bz_ver_major: - return True - if (major == self.bz_ver_major and minor <= self.bz_ver_minor): - return True - return False - - def _add_field_alias(self, *args, **kwargs): - self._field_aliases.append(_FieldAlias(*args, **kwargs)) + return float("%d.%d" % (self.bz_ver_major, self.bz_ver_minor)) def _get_bug_aliases(self): return [(f.newname, f.oldname) - for f in self._field_aliases if f.is_bug] + for f in self._get_field_aliases() if f.is_bug] def _get_api_aliases(self): return [(f.newname, f.oldname) - for f in self._field_aliases if f.is_api] + for f in self._get_field_aliases() if f.is_api] - ################### - # Cookie handling # - ################### + ################# + # Auth handling # + ################# def _getcookiefile(self): - '''cookiefile is the file that bugzilla session cookies are loaded - and saved from. - ''' - return self._cookiejar.filename - - def _delcookiefile(self): - self._cookiejar = None - - def _setcookiefile(self, cookiefile): - if (self._cookiejar and cookiefile == self._cookiejar.filename): - return - - if self._proxy is not None: - raise RuntimeError("Can't set cookies with an open connection, " - "disconnect() first.") + return None + cookiefile = property(_getcookiefile) - log.debug("Using cookiefile=%s", cookiefile) - self._cookiejar = _build_cookiejar(cookiefile) + def _gettokenfile(self): + return self._tokencache.get_filename() + def _settokenfile(self, filename): + self._tokencache.set_filename(filename) + def _deltokenfile(self): + self._settokenfile(None) + tokenfile = property(_gettokenfile, _settokenfile, _deltokenfile) - cookiefile = property(_getcookiefile, _setcookiefile, _delcookiefile) + def _getconfigpath(self): + return self._rcfile.get_configpaths() + def _setconfigpath(self, configpaths): + return self._rcfile.set_configpaths(configpaths) + def _delconfigpath(self): + return self._rcfile.set_configpaths(None) + configpath = property(_getconfigpath, _setconfigpath, _delconfigpath) ############################# # Login/connection handling # ############################# - def readconfig(self, configpath=None): + def readconfig(self, configpath=None, overwrite=True): """ :param configpath: Optional bugzillarc path to read, instead of the default list. @@ -478,55 +414,73 @@ class Bugzilla(object): Be sure to set appropriate permissions on bugzillarc if you choose to store your password in it! - """ - cfg = _open_bugzillarc(configpath or self.configpath) - if not cfg: - return - section = "" - log.debug("bugzillarc: Searching for config section matching %s", - self.url) - for s in sorted(cfg.sections()): - # Substring match - prefer the longest match found - if s in self.url: - log.debug("bugzillarc: Found matching section: %s", s) - section = s - - if not section: - log.debug("bugzillarc: No section found") - return + :param overwrite: If True, bugzillarc will clobber any already + set self.user/password/api_key/cert value. + """ + if configpath: + self._setconfigpath(configpath) + data = self._rcfile.parse(self.url) - for key, val in cfg.items(section): - if key == "api_key": + for key, val in data.items(): + if key == "api_key" and (overwrite or not self.api_key): log.debug("bugzillarc: setting api_key") self.api_key = val - elif key == "user": + elif key == "user" and (overwrite or not self.user): log.debug("bugzillarc: setting user=%s", val) self.user = val - elif key == "password": + elif key == "password" and (overwrite or not self.password): log.debug("bugzillarc: setting password") self.password = val - elif key == "cert": + elif key == "cert" and (overwrite or not self.cert): log.debug("bugzillarc: setting cert") self.cert = val - elif key == "authtype": - log.debug("bugzillarc: setting authtype=%s", val) - self.authtype = val else: log.debug("bugzillarc: unknown key=%s", key) def _set_bz_version(self, version): + self._cache.version_raw = version try: - self.bz_ver_major, self.bz_ver_minor = [ - int(i) for i in version.split(".")[0:2]] + major, minor = [int(i) for i in version.split(".")[0:2]] except Exception: log.debug("version doesn't match expected format X.Y.Z, " "assuming 5.0", exc_info=True) - self.bz_ver_major = 5 - self.bz_ver_minor = 0 + major = 5 + minor = 0 + self._cache.version_parsed = (major, minor) + + def _get_backend_class(self, url): # pragma: no cover + # This is a hook for the test suite to do some mock hackery + if self._force_rest and self._force_xmlrpc: + raise BugzillaError( + "Cannot specify both force_rest and force_xmlrpc") + + xmlurl = self.fix_url(url) + if self._force_xmlrpc: + return _BackendXMLRPC, xmlurl + + resturl = self.fix_url(url, force_rest=self._force_rest) + if self._force_rest: + return _BackendREST, resturl + + # Simple heuristic if the original url has a path in it + if "/xmlrpc" in url: + return _BackendXMLRPC, xmlurl + if "/rest" in url: + return _BackendREST, resturl + + # We were passed something like bugzilla.example.com but we + # aren't sure which method to use, try probing + if _BackendXMLRPC.probe(xmlurl): + return _BackendXMLRPC, xmlurl + if _BackendREST.probe(resturl): + return _BackendREST, resturl + + # Otherwise fallback to XMLRPC default and let it fail + return _BackendXMLRPC, xmlurl def connect(self, url=None): - ''' + """ Connect to the bugzilla instance with the given url. This is called by __init__ if a URL is passed. Or it can be called manually at any time with a passed URL. @@ -536,57 +490,87 @@ class Bugzilla(object): If 'user' and 'password' are both set, we'll run login(). Otherwise you'll have to login() yourself before some methods will work. - ''' - if self._transport: + """ + if self._session: self.disconnect() - if url is None and self.url: - url = self.url - url = self.fix_url(url) + url = url or self.url + backendclass, newurl = self._get_backend_class(url) + if url != newurl: + log.debug("Converted url=%s to fixed url=%s", url, newurl) + self.url = newurl + log.debug("Connecting with URL %s", self.url) - self.url = url # we've changed URLs - reload config - self.readconfig() + self.readconfig(overwrite=False) - self._transport = _RequestsTransport( - url, self._cookiejar, sslverify=self._sslverify, cert=self.cert) - if self.authtype == 'basic' and self.user and self.password: - self._transport.session.auth = (self.user, self.password) - self._transport.user_agent = self.user_agent - self._proxy = _BugzillaServerProxy(url, self.tokenfile, - self._transport) + # Detect if connecting to redhat bugzilla + self._init_class_from_url() - if (self.authtype == '' and self.user and self.password): + self._session = _BugzillaSession(self.url, self.user_agent, + sslverify=self._sslverify, + cert=self.cert, + tokencache=self._tokencache, + api_key=self.api_key, + is_redhat_bugzilla=self._is_redhat_bugzilla, + requests_session=self._user_requests_session) + self._backend = backendclass(self.url, self._session) + + if (self.user and self.password): log.info("user and password present - doing login()") self.login() if self.api_key: log.debug("using API key") - self._proxy.use_api_key(self.api_key) - version = self._proxy.Bugzilla.version()["version"] + version = self._backend.bugzilla_version()["version"] log.debug("Bugzilla version string: %s", version) self._set_bz_version(version) - def disconnect(self): - ''' - Disconnect from the given bugzilla instance. - ''' - self._proxy = None - self._transport = None - self._cache = _BugzillaAPICache() + @property + def _proxy(self): + """ + Return an xmlrpc ServerProxy instance that will work seamlessly + with bugzilla + + Some apps have historically accessed _proxy directly, like + fedora infrastrucutre pieces. So we consider it part of the API + """ + return self._backend.get_xmlrpc_proxy() + + def is_xmlrpc(self): + """ + :returns: True if using the XMLRPC API + """ + return self._backend.is_xmlrpc() + + def is_rest(self): + """ + :returns: True if using the REST API + """ + return self._backend.is_rest() + + def get_requests_session(self): + """ + Give API users access to the Requests.session object we use for + talking to the remote bugzilla instance. - def _login(self, user, password): - '''Backend login method for Bugzilla3''' - return self._proxy.User.login({'login': user, 'password': password}) + :returns: The Requests.session object backing the open connection. + """ + return self._session.get_requests_session() - def _logout(self): - '''Backend login method for Bugzilla3''' - return self._proxy.User.logout() + def disconnect(self): + """ + Disconnect from the given bugzilla instance. + """ + self._backend = None + self._session = None + self._cache = _BugzillaAPICache() - def login(self, user=None, password=None): - '''Attempt to log in using the given username and password. Subsequent + def login(self, user=None, password=None, restrict_login=None): + """ + Attempt to log in using the given username and password. Subsequent method calls will use this username and password. Returns False if login fails, otherwise returns some kind of login info - typically either a numeric userid, or a dict of user info. @@ -595,10 +579,13 @@ class Bugzilla(object): is not set, ValueError will be raised. If login fails, BugzillaError will be raised. + The login session can be restricted to current user IP address + with restrict_login argument. (Bugzilla 4.4+) + This method will be called implicitly at the end of connect() if user and password are both set. So under most circumstances you won't need to call this yourself. - ''' + """ if self.api_key: raise ValueError("cannot login when using an API key") @@ -612,21 +599,61 @@ class Bugzilla(object): if not self.password: raise ValueError("missing password") + payload = {"login": self.user} + if restrict_login: + payload['restrict_login'] = True + log.debug("logging in with options %s", str(payload)) + payload['password'] = self.password + try: - ret = self._login(self.user, self.password) + ret = self._backend.user_login(payload) self.password = '' - log.info("login successful for user=%s", self.user) + log.info("login succeeded for user=%s", self.user) + if "token" in ret: + self._tokencache.set_value(self.url, ret["token"]) return ret - except Fault as e: - raise BugzillaError("Login failed: %s" % str(e.faultString)) + except Exception as e: + log.debug("Login exception: %s", str(e), exc_info=True) + raise BugzillaError("Login failed: %s" % + BugzillaError.get_bugzilla_error_string(e)) from None + + def interactive_save_api_key(self): + """ + Helper method to interactively ask for an API key, verify it + is valid, and save it to a bugzillarc file referenced via + self.configpaths + """ + sys.stdout.write('API Key: ') + sys.stdout.flush() + api_key = sys.stdin.readline().strip() + + self.disconnect() + self.api_key = api_key + + log.info('Checking API key... ') + self.connect() + + if not self.logged_in: # pragma: no cover + raise BugzillaError("Login with API_KEY failed") + log.info('API Key accepted') - def interactive_login(self, user=None, password=None, force=False): + wrote_filename = self._rcfile.save_api_key(self.url, self.api_key) + log.info("API key written to filename=%s", wrote_filename) + + msg = "Login successful." + if wrote_filename: + msg += " API key written to %s" % wrote_filename + print(msg) + + def interactive_login(self, user=None, password=None, force=False, + restrict_login=None): """ Helper method to handle login for this bugzilla instance. :param user: bugzilla username. If not specified, prompt for it. :param password: bugzilla password. If not specified, prompt for it. :param force: Unused + :param restrict_login: restricts session to IP address """ ignore = force log.debug('Calling interactive_login') @@ -639,13 +666,27 @@ class Bugzilla(object): password = getpass.getpass('Bugzilla Password: ') log.info('Logging in... ') - self.login(user, password) - log.info('Authorization cookie received.') + out = self.login(user, password, restrict_login) + msg = "Login successful." + if "token" not in out: + msg += " However no token was returned." + else: + if not self.tokenfile: + msg += " Token not saved to disk." + else: + msg += " Token cache saved to %s" % self.tokenfile + if self._get_version() >= 5.0: + msg += "\nToken usage is deprecated. " + msg += "Consider using bugzilla API keys instead. " + msg += "See `man bugzilla` for more details." + print(msg) def logout(self): - '''Log out of bugzilla. Drops server connection and user info, and - destroys authentication cookies.''' - self._logout() + """ + Log out of bugzilla. Drops server connection and user info, and + destroys authentication cache + """ + self._backend.user_logout() self.disconnect() self.user = '' self.password = '' @@ -670,10 +711,11 @@ class Bugzilla(object): http://bugzilla.readthedocs.org/en/latest/api/core/v1/user.html#valid-login """ try: - self._proxy.User.get({'ids': []}) + self._backend.user_get({"ids": [1]}) return True - except Fault as e: - if e.faultCode == 505 or e.faultCode == 32000: + except Exception as e: + code = BugzillaError.get_bugzilla_error_code(e) + if code in [505, 32000]: return False raise e @@ -682,22 +724,26 @@ class Bugzilla(object): # Bugfields querying # ###################### - def _getbugfields(self): - ''' - Get the list of valid fields for Bug objects - ''' - r = self._proxy.Bug.fields({'include_fields': ['name']}) - return [f['name'] for f in r['fields']] - - def getbugfields(self, force_refresh=False): - ''' + def getbugfields(self, force_refresh=False, names=None): + """ Calls getBugFields, which returns a list of fields in each bug for this bugzilla instance. This can be used to set the list of attrs on the Bug object. - ''' + + :param force_refresh: If True, overwrite the bugfield cache + with these newly checked values. + :param names: Only check for the passed bug field names + """ + def _fieldnames(): + data = {"include_fields": ["name"]} + if names: + data["names"] = names + r = self._backend.bug_fields(data) + return [f['name'] for f in r['fields']] + if force_refresh or not self._cache.bugfields: log.debug("Refreshing bugfields") - self._cache.bugfields = self._getbugfields() + self._cache.bugfields = _fieldnames() self._cache.bugfields.sort() log.debug("bugfields = %s", self._cache.bugfields) @@ -734,11 +780,11 @@ class Bugzilla(object): if ptype: raw = None if ptype == "accessible": - raw = self._proxy.Product.get_accessible_products() - elif ptype == "selectable": - raw = self._proxy.Product.get_selectable_products() + raw = self._backend.product_get_accessible() elif ptype == "enterable": - raw = self._proxy.Product.get_enterable_products() + raw = self._backend.product_get_enterable() + elif ptype == "selectable": + raw = self._backend.product_get_selectable() if raw is None: raise RuntimeError("Unknown ptype=%s" % ptype) @@ -747,16 +793,15 @@ class Bugzilla(object): kwargs = {} if ids: - kwargs["ids"] = self._listify(ids) + kwargs["ids"] = listify(ids) if names: - kwargs["names"] = self._listify(names) + kwargs["names"] = listify(names) if include_fields: kwargs["include_fields"] = include_fields if exclude_fields: kwargs["exclude_fields"] = exclude_fields - log.debug("Calling Product.get with: %s", kwargs) - ret = self._proxy.Product.get(kwargs) + ret = self._backend.product_get(kwargs) return ret['products'] def refresh_products(self, **kwargs): @@ -857,12 +902,6 @@ class Bugzilla(object): """ Return a list of component names for the passed product. - This can be implemented with Product.get, but behind the - scenes it uses Bug.legal_values. Reason being that on bugzilla - instances with tons of components, like bugzilla.redhat.com - Product=Fedora for example, there's a 10x speed difference - even with properly limited Product.get calls. - On first invocation the value is cached, and subsequent calls will return the cached data. @@ -872,17 +911,22 @@ class Bugzilla(object): proddict = self._lookup_product_in_cache(product) product_id = proddict.get("id", None) - if (force_refresh or - product_id is None or - product_id not in self._cache.component_names): - self.refresh_products(names=[product], - include_fields=["names", "id"]) + if (force_refresh or product_id is None or + "components" not in proddict): + self.refresh_products( + names=[product], + include_fields=["name", "id", "components.name"]) proddict = self._lookup_product_in_cache(product) + if "id" not in proddict: + raise BugzillaError("Product '%s' not found" % product) product_id = proddict["id"] - opts = {'product_id': product_id, 'field': 'component'} - log.debug("Calling Bug.legal_values with: %s", opts) - names = self._proxy.Bug.legal_values(opts)["values"] + if product_id not in self._cache.component_names: + names = [] + for comp in proddict.get("components", []): + name = comp.get("name") + if name: + names.append(name) self._cache.component_names[product_id] = names return self._cache.component_names[product_id] @@ -915,13 +959,13 @@ class Bugzilla(object): def addcomponent(self, data): - ''' + """ A method to create a component in Bugzilla. Takes a dict, with the following elements: product: The product to create the component in component: The name of the component to create - desription: A one sentence summary of the component + description: A one sentence summary of the component default_assignee: The bugzilla login (email address) of the initial owner of the component default_qa_contact (optional): The bugzilla login of the @@ -930,23 +974,21 @@ class Bugzilla(object): new bugs for the component. is_active: (optional) If False, the component is hidden from the component list when filing new bugs. - ''' + """ data = data.copy() self._component_data_convert(data) - log.debug("Calling Component.create with: %s", data) - return self._proxy.Component.create(data) + return self._backend.component_create(data) def editcomponent(self, data): - ''' + """ A method to edit a component in Bugzilla. Takes a dict, with mandatory elements of product. component, and initialowner. All other elements are optional and use the same names as the addcomponent() method. - ''' + """ data = data.copy() self._component_data_convert(data, update=True) - log.debug("Calling Component.update with: %s", data) - return self._proxy.Component.update(data) + return self._backend.component_update(data) ################### @@ -959,9 +1001,6 @@ class Bugzilla(object): Internal helper to process include_fields lists """ def _convert_fields(_in): - if not _in: - return _in - for newname, oldname in self._get_api_aliases(): if oldname in _in: _in.remove(oldname) @@ -970,16 +1009,15 @@ class Bugzilla(object): return _in ret = {} - if self._check_version(4, 0): - if include_fields: - include_fields = _convert_fields(include_fields) - if "id" not in include_fields: - include_fields.append("id") - ret["include_fields"] = include_fields - if exclude_fields: - exclude_fields = _convert_fields(exclude_fields) - ret["exclude_fields"] = exclude_fields - if self._supports_getbug_extra_fields: + if include_fields: + include_fields = _convert_fields(include_fields) + if "id" not in include_fields: + include_fields.append("id") + ret["include_fields"] = include_fields + if exclude_fields: + exclude_fields = _convert_fields(exclude_fields) + ret["exclude_fields"] = exclude_fields + if self._supports_getbug_extra_fields(): if extra_fields: ret["extra_fields"] = _convert_fields(extra_fields) return ret @@ -997,61 +1035,78 @@ class Bugzilla(object): bug_autorefresh = property(_get_bug_autorefresh, _set_bug_autorefresh) - # getbug_extra_fields: Extra fields that need to be explicitly - # requested from Bug.get in order for the data to be returned. - # - # As of Dec 2012 it seems like only RH bugzilla actually has behavior - # like this, for upstream bz it returns all info for every Bug.get() - _getbug_extra_fields = [] - _supports_getbug_extra_fields = False + def _getbug_extra_fields(self): + """ + Extra fields that need to be explicitly + requested from Bug.get in order for the data to be returned. + """ + rhbz_extra_fields = [ + "comments", "description", + "external_bugs", "flags", "sub_components", + "tags", + ] + if self._is_redhat_bugzilla: + return rhbz_extra_fields + return [] + + def _supports_getbug_extra_fields(self): + """ + Return True if the bugzilla instance supports passing + extra_fields to getbug + + As of Dec 2012 it seems like only RH bugzilla actually has behavior + like this, for upstream bz it returns all info for every Bug.get() + """ + return self._is_redhat_bugzilla + def _getbugs(self, idlist, permissive, include_fields=None, exclude_fields=None, extra_fields=None): - ''' + """ Return a list of dicts of full bug info for each given bug id. bug ids that couldn't be found will return None instead of a dict. - ''' - oldidlist = idlist - idlist = [] - for i in oldidlist: - try: - idlist.append(int(i)) - except ValueError: - # String aliases can be passed as well - idlist.append(i) - - extra_fields = self._listify(extra_fields or []) - extra_fields += self._getbug_extra_fields - - getbugdata = {"ids": idlist} + """ + ids = [] + aliases = [] + + def _alias_or_int(_v): + if str(_v).isdigit(): + return int(_v), None + return None, str(_v) + + for idstr in idlist: + idint, alias = _alias_or_int(idstr) + if alias: + aliases.append(alias) + else: + ids.append(idstr) + + extra_fields = listify(extra_fields or []) + extra_fields += self._getbug_extra_fields() + + getbugdata = {} if permissive: getbugdata["permissive"] = 1 getbugdata.update(self._process_include_fields( include_fields, exclude_fields, extra_fields)) - log.debug("Calling Bug.get with: %s", getbugdata) - r = self._proxy.Bug.get(getbugdata) - - if self._check_version(4, 0): - bugdict = dict([(b['id'], b) for b in r['bugs']]) - else: - bugdict = dict([(b['id'], b['internals']) for b in r['bugs']]) + r = self._backend.bug_get(ids, aliases, getbugdata) + # Do some wrangling to ensure we return bugs in the same order + # the were passed in, for historical reasons ret = [] - for i in idlist: - found = None - if i in bugdict: - found = bugdict[i] - else: - # Need to map an alias - for valdict in bugdict.values(): - if i in self._listify(valdict.get("alias", None)): - found = valdict - break - - ret.append(found) + for idval in idlist: + idint, alias = _alias_or_int(idval) + for bugdict in r["bugs"]: + if idint and idint != bugdict.get("id", None): + continue + aliaslist = listify(bugdict.get("alias", None) or []) + if alias and alias not in aliaslist: + continue + ret.append(bugdict) + break return ret def _getbug(self, objid, **kwargs): @@ -1067,8 +1122,10 @@ class Bugzilla(object): def getbug(self, objid, include_fields=None, exclude_fields=None, extra_fields=None): - '''Return a Bug object with the full complement of bug data - already loaded.''' + """ + Return a Bug object with the full complement of bug data + already loaded. + """ data = self._getbug(objid, include_fields=include_fields, exclude_fields=exclude_fields, extra_fields=extra_fields) @@ -1077,9 +1134,11 @@ class Bugzilla(object): def getbugs(self, idlist, include_fields=None, exclude_fields=None, extra_fields=None, permissive=True): - '''Return a list of Bug objects with the full complement of bug data + """ + Return a list of Bug objects with the full complement of bug data already loaded. If there's a problem getting the data for a given id, - the corresponding item in the returned list will be None.''' + the corresponding item in the returned list will be None. + """ data = self._getbugs(idlist, include_fields=include_fields, exclude_fields=exclude_fields, extra_fields=extra_fields, permissive=permissive) @@ -1088,9 +1147,11 @@ class Bugzilla(object): for b in data] def get_comments(self, idlist): - '''Returns a dictionary of bugs and comments. The comments key will - be empty. See bugzilla docs for details''' - return self._proxy.Bug.comments({'ids': idlist}) + """ + Returns a dictionary of bugs and comments. The comments key will + be empty. See bugzilla docs for details + """ + return self._backend.bug_comments(idlist, {}) ################# @@ -1123,13 +1184,11 @@ class Bugzilla(object): alias=None, qa_whiteboard=None, devel_whiteboard=None, - boolean_query=None, bug_severity=None, priority=None, target_release=None, target_milestone=None, emailtype=None, - booleantype=None, include_fields=None, quicksearch=None, savedsearch=None, @@ -1137,12 +1196,13 @@ class Bugzilla(object): sub_component=None, tags=None, exclude_fields=None, - extra_fields=None): + extra_fields=None, + limit=None): """ Build a query string from passed arguments. Will handle query parameter differences between various bugzilla versions. - Most of the parameters should be self explanatory. However + Most of the parameters should be self-explanatory. However, if you want to perform a complex query, and easy way is to create it with the bugzilla web UI, copy the entire URL it generates, and pass it to the static method @@ -1154,15 +1214,10 @@ class Bugzilla(object): For details about the specific argument formats, see the bugzilla docs: https://bugzilla.readthedocs.io/en/latest/api/core/v1/bug.html#search-bugs """ - if boolean_query or booleantype: - raise RuntimeError("boolean_query format is no longer supported. " - "If you need complicated URL queries, look into " - "query --from-url/url_to_query().") - query = { "alias": alias, - "product": self._listify(product), - "component": self._listify(component), + "product": listify(product), + "component": listify(component), "version": version, "id": bug_id, "short_desc": short_desc, @@ -1171,17 +1226,18 @@ class Bugzilla(object): "priority": priority, "target_release": target_release, "target_milestone": target_milestone, - "tag": self._listify(tags), + "tag": listify(tags), "quicksearch": quicksearch, "savedsearch": savedsearch, "sharer_id": savedsearch_sharer_id, + "limit": limit, # RH extensions... don't add any more. See comment below - "sub_components": self._listify(sub_component), + "sub_components": listify(sub_component), } def add_bool(bzkey, value, bool_id, booltype=None): - value = self._listify(value) + value = listify(value) if value is None: return bool_id @@ -1252,49 +1308,55 @@ class Bugzilla(object): return query def query(self, query): - '''Query bugzilla and return a list of matching bugs. + """ + Query bugzilla and return a list of matching bugs. query must be a dict with fields like those in in querydata['fields']. Returns a list of Bug objects. Also see the _query() method for details about the underlying implementation. - ''' - log.debug("Calling Bug.search with: %s", query) + """ try: - r = self._proxy.Bug.search(query) - except Fault as e: - + r = self._backend.bug_search(query) + log.debug("bug_search returned:\n%s", str(r)) + except Exception as e: # Try to give a hint in the error message if url_to_query # isn't supported by this bugzilla instance if ("query_format" not in str(e) or - "RHBugzilla" in str(e.__class__) or - self._check_version(5, 0)): + not BugzillaError.get_bugzilla_error_code(e) or + self._get_version() >= 5.0): raise raise BugzillaError("%s\nYour bugzilla instance does not " "appear to support API queries derived from bugzilla " - "web URL queries." % e) + "web URL queries." % e) from None log.debug("Query returned %s bugs", len(r['bugs'])) return [Bug(self, dict=b, autorefresh=self.bug_autorefresh) for b in r['bugs']] def pre_translation(self, query): - '''In order to keep the API the same, Bugzilla4 needs to process the + """ + In order to keep the API the same, Bugzilla4 needs to process the query and the result. This also applies to the refresh() function - ''' - pass + """ + if self._is_redhat_bugzilla: + _RHBugzillaConverters.pre_translation(query) + query.update(self._process_include_fields( + query.get("include_fields", []), None, None)) def post_translation(self, query, bug): - '''In order to keep the API the same, Bugzilla4 needs to process the + """ + In order to keep the API the same, Bugzilla4 needs to process the query and the result. This also applies to the refresh() function - ''' - pass + """ + if self._is_redhat_bugzilla: + _RHBugzillaConverters.post_translation(query, bug) def bugs_history_raw(self, bug_ids): - ''' + """ Experimental. Gets the history of changes for particular bugs in the database. - ''' - return self._proxy.Bug.history({'ids': bug_ids}) + """ + return self._backend.bug_history(bug_ids, {}) ####################################### @@ -1312,28 +1374,23 @@ class Bugzilla(object): build_update(), otherwise we cannot guarantee back compatibility. """ tmp = updates.copy() - tmp["ids"] = self._listify(ids) - - log.debug("Calling Bug.update with: %s", tmp) - return self._proxy.Bug.update(tmp) + return self._backend.bug_update(listify(ids), tmp) def update_tags(self, idlist, tags_add=None, tags_remove=None): - ''' + """ Updates the 'tags' field for a bug. - ''' + """ tags = {} if tags_add: - tags["add"] = self._listify(tags_add) + tags["add"] = listify(tags_add) if tags_remove: - tags["remove"] = self._listify(tags_remove) + tags["remove"] = listify(tags_remove) d = { - "ids": self._listify(idlist), "tags": tags, } - log.debug("Calling Bug.update_tags with: %s", d) - return self._proxy.Bug.update_tags(d) + return self._backend.bug_update_tags(listify(idlist), d) def update_flags(self, idlist, flags): """ @@ -1392,7 +1449,8 @@ class Bugzilla(object): internal_whiteboard=None, sub_component=None, flags=None, - comment_tags=None): + comment_tags=None, + minor_update=None): """ Returns a python dict() with properly formatted parameters to pass to update_bugs(). See bugzilla documentation for the format @@ -1401,18 +1459,28 @@ class Bugzilla(object): https://bugzilla.readthedocs.io/en/latest/api/core/v1/bug.html#create-bug """ ret = {} + rhbzret = {} # These are only supported for rhbugzilla - for key, val in [ - ("fixed_in", fixed_in), - ("devel_whiteboard", devel_whiteboard), - ("qa_whiteboard", qa_whiteboard), - ("internal_whiteboard", internal_whiteboard), - ("sub_component", sub_component), - ]: - if val is not None: - raise ValueError("bugzilla instance does not support " - "updating '%s'" % key) + # + # This should not be extended any more. + # If people want to handle custom fields, manually extend the + # returned dictionary. + rhbzargs = { + "fixed_in": fixed_in, + "devel_whiteboard": devel_whiteboard, + "qa_whiteboard": qa_whiteboard, + "internal_whiteboard": internal_whiteboard, + "sub_component": sub_component, + } + if self._is_redhat_bugzilla: + rhbzret = _RHBugzillaConverters.convert_build_update( + component=component, **rhbzargs) + else: + for key, val in rhbzargs.items(): + if val is not None: + raise ValueError("bugzilla instance does not support " + "updating '%s'" % key) def s(key, val, convert=None): if val is None: @@ -1426,7 +1494,7 @@ class Bugzilla(object): return def c(val): - val = self._listify(val) + val = listify(val) if convert: val = [convert(v) for v in val] return val @@ -1468,7 +1536,8 @@ class Bugzilla(object): s("whiteboard", whiteboard) s("work_time", work_time, float) s("flags", flags) - s("comment_tags", comment_tags, self._listify) + s("comment_tags", comment_tags, listify) + s("minor_update", minor_update, bool) add_dict("blocks", blocks_add, blocks_remove, blocks_set, convert=int) @@ -1484,6 +1553,7 @@ class Bugzilla(object): if comment_private: ret["comment"]["is_private"] = comment_private + ret.update(rhbzret) return ret @@ -1491,14 +1561,8 @@ class Bugzilla(object): # Methods for working with attachments # ######################################## - def _attachment_uri(self, attachid): - '''Returns the URI for the given attachment ID.''' - att_uri = self.url.replace('xmlrpc.cgi', 'attachment.cgi') - att_uri = att_uri + '?id=%s' % attachid - return att_uri - def attachfile(self, idlist, attachfile, description, **kwargs): - ''' + """ Attach a file to the given bug IDs. Returns the ID of the attachment or raises XMLRPC Fault if something goes wrong. @@ -1522,7 +1586,7 @@ class Bugzilla(object): Returns the list of attachment ids that were added. If only one attachment was added, we return the single int ID for back compat - ''' + """ if isinstance(attachfile, str): f = open(attachfile, "rb") elif hasattr(attachfile, 'read'): @@ -1543,21 +1607,20 @@ class Bugzilla(object): kwargs['summary'] = description data = f.read() - if not isinstance(data, bytes): + if not isinstance(data, bytes): # pragma: no cover data = data.encode(locale.getpreferredencoding()) - kwargs['data'] = Binary(data) - - kwargs['ids'] = self._listify(idlist) if 'file_name' not in kwargs and hasattr(f, "name"): kwargs['file_name'] = os.path.basename(f.name) if 'content_type' not in kwargs: - ctype = _detect_filetype(getattr(f, "name", None)) - if not ctype: - ctype = 'application/octet-stream' - kwargs['content_type'] = ctype + ctype = None + if kwargs['file_name']: + ctype = mimetypes.guess_type( + kwargs['file_name'], strict=False)[0] + kwargs['content_type'] = ctype or 'application/octet-stream' - ret = self._proxy.Bug.add_attachment(kwargs) + ret = self._backend.bug_attachment_create( + listify(idlist), data, kwargs) if "attachments" in ret: # Up to BZ 4.2 @@ -1570,37 +1633,52 @@ class Bugzilla(object): ret = ret[0] return ret + def openattachment_data(self, attachment_dict): + """ + Helper for turning passed API attachment dictionary into a + filelike object + """ + ret = BytesIO() + data = attachment_dict["data"] - def openattachment(self, attachid): - '''Get the contents of the attachment with the given attachment ID. - Returns a file-like object.''' - attachments = self.get_attachments(None, attachid) - data = attachments["attachments"][str(attachid)] - xmlrpcbinary = data["data"] + if hasattr(data, "data"): + # This is for xmlrpc Binary + content = data.data # pragma: no cover + else: + import base64 + content = base64.b64decode(data) - ret = BytesIO() - ret.write(xmlrpcbinary.data) - ret.name = data["file_name"] + ret.write(content) + ret.name = attachment_dict["file_name"] ret.seek(0) return ret + def openattachment(self, attachid): + """ + Get the contents of the attachment with the given attachment ID. + Returns a file-like object. + """ + attachments = self.get_attachments(None, attachid) + data = attachments["attachments"][str(attachid)] + return self.openattachment_data(data) + def updateattachmentflags(self, bugid, attachid, flagname, **kwargs): - ''' + """ Updates a flag for the given attachment ID. Optional keyword args are: status: new status for the flag ('-', '+', '?', 'X') requestee: new requestee for the flag - ''' + """ # Bug ID was used for the original custom redhat API, no longer # needed though ignore = bugid flags = {"name": flagname} flags.update(kwargs) - update = {'ids': [int(attachid)], 'flags': [flags]} + attachment_ids = [int(attachid)] + update = {'flags': [flags]} - log.debug("Calling Bug.update_attachment(%s)", update) - return self._proxy.Bug.update_attachment(update) + return self._backend.bug_attachment_update(attachment_ids, update) def get_attachments(self, ids, attachment_ids, include_fields=None, exclude_fields=None): @@ -1612,17 +1690,15 @@ class Bugzilla(object): https://bugzilla.readthedocs.io/en/latest/api/core/v1/attachment.html#get-attachment """ - params = { - "ids": self._listify(ids) or [], - "attachment_ids": self._listify(attachment_ids) or [], - } + params = {} if include_fields: - params["include_fields"] = self._listify(include_fields) + params["include_fields"] = listify(include_fields) if exclude_fields: - params["exclude_fields"] = self._listify(exclude_fields) + params["exclude_fields"] = listify(exclude_fields) - log.debug("Calling Bug.attachments(%s)", params) - return self._proxy.Bug.attachments(params) + if attachment_ids: + return self._backend.bug_attachment_get(attachment_ids, params) + return self._backend.bug_attachment_get_all(ids, params) ##################### @@ -1658,7 +1734,7 @@ class Bugzilla(object): sub_component=None, alias=None, comment_tags=None): - """" + """ Returns a python dict() with properly formatted parameters to pass to createbug(). See bugzilla documentation for the format of the individual fields: @@ -1668,15 +1744,15 @@ class Bugzilla(object): localdict = {} if blocks: - localdict["blocks"] = self._listify(blocks) + localdict["blocks"] = listify(blocks) if cc: - localdict["cc"] = self._listify(cc) + localdict["cc"] = listify(cc) if depends_on: - localdict["depends_on"] = self._listify(depends_on) + localdict["depends_on"] = listify(depends_on) if groups: - localdict["groups"] = self._listify(groups) + localdict["groups"] = listify(groups) if keywords: - localdict["keywords"] = self._listify(keywords) + localdict["keywords"] = listify(keywords) if description: localdict["description"] = description if comment_private: @@ -1700,14 +1776,15 @@ class Bugzilla(object): # Previous API required users specifying keyword args that mapped # to the XMLRPC arg names. Maintain that bad compat, but also allow # receiving a single dictionary like query() does - if kwargs and args: + if kwargs and args: # pragma: no cover raise BugzillaError("createbug: cannot specify positional " "args=%s with kwargs=%s, must be one or the " "other." % (args, kwargs)) if args: if len(args) > 1 or not isinstance(args[0], dict): - raise BugzillaError("createbug: positional arguments only " - "accept a single dictionary.") + raise BugzillaError( # pragma: no cover + "createbug: positional arguments only " + "accept a single dictionary.") data = args[0] else: data = kwargs @@ -1727,15 +1804,14 @@ class Bugzilla(object): return data def createbug(self, *args, **kwargs): - ''' + """ Create a bug with the given info. Returns a new Bug object. Check bugzilla API documentation for valid values, at least product, component, summary, version, and description need to be passed. - ''' + """ data = self._validate_createbug(*args, **kwargs) - log.debug("Calling Bug.create with: %s", data) - rawbug = self._proxy.Bug.create(data) + rawbug = self._backend.bug_create(data) return Bug(self, bug_id=rawbug["id"], autorefresh=self.bug_autorefresh) @@ -1744,54 +1820,28 @@ class Bugzilla(object): # Methods for handling Users # ############################## - def _getusers(self, ids=None, names=None, match=None): - '''Return a list of users that match criteria. - - :kwarg ids: list of user ids to return data on - :kwarg names: list of user names to return data on - :kwarg match: list of patterns. Returns users whose real name or - login name match the pattern. - :raises XMLRPC Fault: Code 51: if a Bad Login Name was sent to the - names array. - Code 304: if the user was not authorized to see user they - requested. - Code 505: user is logged out and can't use the match or ids - parameter. - - Available in Bugzilla-3.4+ - ''' - params = {} - if ids: - params['ids'] = self._listify(ids) - if names: - params['names'] = self._listify(names) - if match: - params['match'] = self._listify(match) - if not params: - raise BugzillaError('_get() needs one of ids, ' - ' names, or match kwarg.') - - log.debug("Calling User.get with: %s", params) - return self._proxy.User.get(params) - def getuser(self, username): - '''Return a bugzilla User for the given username + """ + Return a bugzilla User for the given username :arg username: The username used in bugzilla. :raises XMLRPC Fault: Code 51 if the username does not exist :returns: User record for the username - ''' + """ ret = self.getusers(username) return ret and ret[0] def getusers(self, userlist): - '''Return a list of Users from . + """ + Return a list of Users from . :userlist: List of usernames to lookup :returns: List of User records - ''' + """ + userlist = listify(userlist) + rawusers = self._backend.user_get({"names": userlist}) userobjs = [User(self, **rawuser) for rawuser in - self._getusers(names=userlist).get('users', [])] + rawusers.get('users', [])] # Return users in same order they were passed in ret = [] @@ -1806,16 +1856,19 @@ class Bugzilla(object): def searchusers(self, pattern): - '''Return a bugzilla User for the given list of patterns + """ + Return a bugzilla User for the given list of patterns :arg pattern: List of patterns to match against. :returns: List of User records - ''' + """ + rawusers = self._backend.user_get({"match": listify(pattern)}) return [User(self, **rawuser) for rawuser in - self._getusers(match=pattern).get('users', [])] + rawusers.get('users', [])] def createuser(self, email, name='', password=''): - '''Return a bugzilla User for the given username + """ + Return a bugzilla User for the given username :arg email: The email address to use in bugzilla :kwarg name: Real name to associate with the account @@ -1825,12 +1878,17 @@ class Bugzilla(object): Code 502 if the password is too short Code 503 if the password is too long :return: User record for the username - ''' - self._proxy.User.create(email, name, password) + """ + args = {"email": email} + if name: + args["name"] = name + if password: + args["password"] = password + self._backend.user_create(args) return self.getuser(email) def updateperms(self, user, action, groups): - ''' + """ A method to update the permissions (group membership) of a bugzilla user. @@ -1838,19 +1896,211 @@ class Bugzilla(object): also be a list of emails. :arg action: add, remove, or set :arg groups: list of groups to be added to (i.e. ['fedora_contrib']) - ''' - groups = self._listify(groups) + """ + groups = listify(groups) if action == "rem": action = "remove" if action not in ["add", "remove", "set"]: raise BugzillaError("Unknown user permission action '%s'" % action) update = { - "names": self._listify(user), + "names": listify(user), "groups": { action: groups, } } - log.debug("Call User.update with: %s", update) - return self._proxy.User.update(update) + return self._backend.user_update(update) + + + ############################### + # Methods for handling Groups # + ############################### + + def _getgroups(self, names, membership=False): + """ + Return a list of groups that match criteria. + + :kwarg ids: list of group ids to return data on + :kwarg membership: boolean specifying wether to query the members + of the group or not. + :raises XMLRPC Fault: Code 51: if a Bad Login Name was sent to the + names array. + Code 304: if the user was not authorized to see user they + requested. + Code 505: user is logged out and can't use the match or ids + parameter. + Code 805: logged in user do not have enough priviledges to view + groups. + """ + params = {"membership": membership} + params['names'] = listify(names) + return self._backend.group_get(params) + + def getgroup(self, name, membership=False): + """ + Return a bugzilla Group for the given name + + :arg name: The group name used in bugzilla. + :raises XMLRPC Fault: Code 51 if the name does not exist + :raises XMLRPC Fault: Code 805 if the user does not have enough + permissions to view groups + :returns: Group record for the name + """ + ret = self.getgroups(name, membership=membership) + return ret and ret[0] + + def getgroups(self, grouplist, membership=False): + """ + Return a list of Groups from . + + :userlist: List of group names to lookup + :returns: List of Group records + """ + grouplist = listify(grouplist) + groupobjs = [ + Group(self, **rawgroup) + for rawgroup in self._getgroups( + names=grouplist, membership=membership).get('groups', []) + ] + + # Return in same order they were passed in + ret = [] + for g in grouplist: + for gobj in groupobjs[:]: + if gobj.name == g: + groupobjs.remove(gobj) + ret.append(gobj) + break + ret += groupobjs + return ret + + + ############################# + # ExternalBugs API wrappers # + ############################# + + def add_external_tracker(self, bug_ids, ext_bz_bug_id, ext_type_id=None, + ext_type_description=None, ext_type_url=None, + ext_status=None, ext_description=None, + ext_priority=None): + """ + Wrapper method to allow adding of external tracking bugs using the + ExternalBugs::WebService::add_external_bug method. + + This is documented at + https://bugzilla.redhat.com/docs/en/html/integrating/api/Bugzilla/Extension/ExternalBugs/WebService.html#add-external-bug + + bug_ids: A single bug id or list of bug ids to have external trackers + added. + ext_bz_bug_id: The external bug id (ie: the bug number in the + external tracker). + ext_type_id: The external tracker id as used by Bugzilla. + ext_type_description: The external tracker description as used by + Bugzilla. + ext_type_url: The external tracker url as used by Bugzilla. + ext_status: The status of the external bug. + ext_description: The description of the external bug. + ext_priority: The priority of the external bug. + """ + param_dict = {'ext_bz_bug_id': ext_bz_bug_id} + if ext_type_id is not None: + param_dict['ext_type_id'] = ext_type_id + if ext_type_description is not None: + param_dict['ext_type_description'] = ext_type_description + if ext_type_url is not None: + param_dict['ext_type_url'] = ext_type_url + if ext_status is not None: + param_dict['ext_status'] = ext_status + if ext_description is not None: + param_dict['ext_description'] = ext_description + if ext_priority is not None: + param_dict['ext_priority'] = ext_priority + params = { + 'bug_ids': listify(bug_ids), + 'external_bugs': [param_dict], + } + return self._backend.externalbugs_add(params) + + def update_external_tracker(self, ids=None, ext_type_id=None, + ext_type_description=None, ext_type_url=None, + ext_bz_bug_id=None, bug_ids=None, + ext_status=None, ext_description=None, + ext_priority=None): + """ + Wrapper method to allow adding of external tracking bugs using the + ExternalBugs::WebService::update_external_bug method. + + This is documented at + https://bugzilla.redhat.com/docs/en/html/integrating/api/Bugzilla/Extension/ExternalBugs/WebService.html#update-external-bug + + ids: A single external tracker bug id or list of external tracker bug + ids. + ext_type_id: The external tracker id as used by Bugzilla. + ext_type_description: The external tracker description as used by + Bugzilla. + ext_type_url: The external tracker url as used by Bugzilla. + ext_bz_bug_id: A single external bug id or list of external bug ids + (ie: the bug number in the external tracker). + bug_ids: A single bug id or list of bug ids to have external tracker + info updated. + ext_status: The status of the external bug. + ext_description: The description of the external bug. + ext_priority: The priority of the external bug. + """ + params = {} + if ids is not None: + params['ids'] = listify(ids) + if ext_type_id is not None: + params['ext_type_id'] = ext_type_id + if ext_type_description is not None: + params['ext_type_description'] = ext_type_description + if ext_type_url is not None: + params['ext_type_url'] = ext_type_url + if ext_bz_bug_id is not None: + params['ext_bz_bug_id'] = listify(ext_bz_bug_id) + if bug_ids is not None: + params['bug_ids'] = listify(bug_ids) + if ext_status is not None: + params['ext_status'] = ext_status + if ext_description is not None: + params['ext_description'] = ext_description + if ext_priority is not None: + params['ext_priority'] = ext_priority + return self._backend.externalbugs_update(params) + + def remove_external_tracker(self, ids=None, ext_type_id=None, + ext_type_description=None, ext_type_url=None, + ext_bz_bug_id=None, bug_ids=None): + """ + Wrapper method to allow removal of external tracking bugs using the + ExternalBugs::WebService::remove_external_bug method. + + This is documented at + https://bugzilla.redhat.com/docs/en/html/integrating/api/Bugzilla/Extension/ExternalBugs/WebService.html#remove-external-bug + + ids: A single external tracker bug id or list of external tracker bug + ids. + ext_type_id: The external tracker id as used by Bugzilla. + ext_type_description: The external tracker description as used by + Bugzilla. + ext_type_url: The external tracker url as used by Bugzilla. + ext_bz_bug_id: A single external bug id or list of external bug ids + (ie: the bug number in the external tracker). + bug_ids: A single bug id or list of bug ids to have external tracker + info updated. + """ + params = {} + if ids is not None: + params['ids'] = listify(ids) + if ext_type_id is not None: + params['ext_type_id'] = ext_type_id + if ext_type_description is not None: + params['ext_type_description'] = ext_type_description + if ext_type_url is not None: + params['ext_type_url'] = ext_type_url + if ext_bz_bug_id is not None: + params['ext_bz_bug_id'] = listify(ext_bz_bug_id) + if bug_ids is not None: + params['bug_ids'] = listify(bug_ids) + return self._backend.externalbugs_remove(params) diff --git a/scripts/bugzilla/bug.py b/scripts/bugzilla/bug.py index e586e7f..f5c5f80 100644 --- a/scripts/bugzilla/bug.py +++ b/scripts/bugzilla/bug.py @@ -1,71 +1,65 @@ -# base.py - the base classes etc. for a Python interface to bugzilla -# # Copyright (C) 2007, 2008, 2009, 2010 Red Hat Inc. # Author: Will Woods # -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See http://www.gnu.org/copyleft/gpl.html for -# the full text of the license. - -from __future__ import unicode_literals -import locale +# This work is licensed under the GNU GPLv2 or later. +# See the COPYING file in the top-level directory. + +import copy from logging import getLogger -import sys + log = getLogger(__name__) class Bug(object): - '''A container object for a bug report. Requires a Bugzilla instance - + """ + A container object for a bug report. Requires a Bugzilla instance - every Bug is on a Bugzilla, obviously. Optional keyword args: dict=DICT - populate attributes with the result of a getBug() call bug_id=ID - if dict does not contain bug_id, this is required before you can read any attributes or make modifications to this bug. - ''' + """ def __init__(self, bugzilla, bug_id=None, dict=None, autorefresh=False): # pylint: disable=redefined-builtin # API had pre-existing issue that we can't change ('dict' usage) self.bugzilla = bugzilla - self._bug_fields = [] + self._rawdata = {} self.autorefresh = autorefresh + # pylint: disable=protected-access + self._aliases = self.bugzilla._get_bug_aliases() + # pylint: enable=protected-access + if not dict: dict = {} if bug_id: dict["id"] = bug_id - log.debug("Bug(%s)", sorted(dict.keys())) self._update_dict(dict) - self.weburl = bugzilla.url.replace('xmlrpc.cgi', 'show_bug.cgi?id=%i' % self.bug_id) def __str__(self): - '''Return a simple string representation of this bug - - This is available only for compatibility. Using 'str(bug)' and - 'print(bug)' is not recommended because of potential encoding issues. - Please use unicode(bug) where possible. - ''' - if sys.version_info[0] >= 3: - return self.__unicode__() - else: - return self.__unicode__().encode( - locale.getpreferredencoding(), 'replace') + """ + Return a simple string representation of this bug + """ + return self.__unicode__() def __unicode__(self): - '''Return a simple unicode string representation of this bug''' + """ + Return a simple unicode string representation of this bug + """ return "#%-6s %-10s - %s - %s" % (self.bug_id, self.bug_status, self.assigned_to, self.summary) def __repr__(self): - return '' % (self.bug_id, self.bugzilla.url, - id(self)) + url = "" + if self.bugzilla: + url = self.bugzilla.url + return '' % (self.bug_id, url, id(self)) def __getattr__(self, name): refreshed = False @@ -75,11 +69,7 @@ class Bug(object): # have never been called. return self.__dict__[name] - # pylint: disable=protected-access - aliases = self.bugzilla._get_bug_aliases() - # pylint: enable=protected-access - - for newname, oldname in aliases: + for newname, oldname in self._aliases: if name == oldname and newname in self.__dict__: return self.__dict__[newname] @@ -110,47 +100,52 @@ class Bug(object): "to adjust your include_fields for getbug/query." % name) raise AttributeError(msg) + def get_raw_data(self): + """ + Return the raw API dictionary data that has been used to + populate this bug + """ + return copy.deepcopy(self._rawdata) + def refresh(self, include_fields=None, exclude_fields=None, extra_fields=None): - ''' + """ Refresh the bug with the latest data from bugzilla - ''' + """ # pylint: disable=protected-access + extra_fields = list(self._rawdata.keys()) + (extra_fields or []) r = self.bugzilla._getbug(self.bug_id, include_fields=include_fields, exclude_fields=exclude_fields, - extra_fields=self._bug_fields + (extra_fields or [])) + extra_fields=extra_fields) # pylint: enable=protected-access self._update_dict(r) reload = refresh - def _update_dict(self, newdict): - ''' - Update internal dictionary, in a way that ensures no duplicate - entries are stored WRT field aliases - ''' + def _translate_dict(self, newdict): if self.bugzilla: self.bugzilla.post_translation({}, newdict) - # pylint: disable=protected-access - aliases = self.bugzilla._get_bug_aliases() - # pylint: enable=protected-access - - for newname, oldname in aliases: - if oldname not in newdict: - continue - - if newname not in newdict: - newdict[newname] = newdict[oldname] - elif newdict[newname] != newdict[oldname]: - log.debug("Update dict contained differing alias values " - "d[%s]=%s and d[%s]=%s , dropping the value " - "d[%s]", newname, newdict[newname], oldname, - newdict[oldname], oldname) - del(newdict[oldname]) - - for key in newdict.keys(): - if key not in self._bug_fields: - self._bug_fields.append(key) + for newname, oldname in self._aliases: + if oldname not in newdict: + continue + + if newname not in newdict: + newdict[newname] = newdict[oldname] + elif newdict[newname] != newdict[oldname]: + log.debug("Update dict contained differing alias values " + "d[%s]=%s and d[%s]=%s , dropping the value " + "d[%s]", newname, newdict[newname], oldname, + newdict[oldname], oldname) + del(newdict[oldname]) + + + def _update_dict(self, newdict): + """ + Update internal dictionary, in a way that ensures no duplicate + entries are stored WRT field aliases + """ + self._translate_dict(newdict) + self._rawdata.update(newdict) self.__dict__.update(newdict) if 'id' not in self.__dict__ and 'bug_id' not in self.__dict__: @@ -162,14 +157,15 @@ class Bug(object): ################## def __getstate__(self): - ret = {} - for key in self._bug_fields: - ret[key] = self.__dict__[key] + ret = self._rawdata.copy() + ret["_aliases"] = self._aliases return ret def __setstate__(self, vals): - self._bug_fields = [] + self._rawdata = {} self.bugzilla = None + self._aliases = vals.get("_aliases", []) + self.autorefresh = False self._update_dict(vals) @@ -178,12 +174,12 @@ class Bug(object): ##################### def setstatus(self, status, comment=None, private=False): - ''' + """ Update the status for this bug report. Commonly-used values are ASSIGNED, MODIFIED, and NEEDINFO. To change bugs to RESOLVED, use .close() instead. - ''' + """ # Note: fedora bodhi uses this function vals = self.bugzilla.build_update(status=status, comment=comment, @@ -194,7 +190,8 @@ class Bug(object): def close(self, resolution, dupeid=None, fixedin=None, comment=None, isprivate=False): - '''Close this bug. + """ + Close this bug. Valid values for resolution are in bz.querydefaults['resolution_list'] For bugzilla.redhat.com that's: ['NOTABUG', 'WONTFIX', 'DEFERRED', 'WORKSFORME', 'CURRENTRELEASE', @@ -206,14 +203,14 @@ class Bug(object): version that fixes the bug. You can optionally add a comment while closing the bug. Set 'isprivate' to True if you want that comment to be private. - ''' + """ # Note: fedora bodhi uses this function vals = self.bugzilla.build_update(comment=comment, comment_private=isprivate, resolution=resolution, dupe_of=dupeid, fixed_in=fixedin, - status="RESOLVED") + status=str("RESOLVED")) log.debug("close: update=%s", vals) return self.bugzilla.update_bugs(self.bug_id, vals) @@ -225,7 +222,7 @@ class Bug(object): def setassignee(self, assigned_to=None, qa_contact=None, comment=None): - ''' + """ Set any of the assigned_to or qa_contact fields to a new bugzilla account, with an optional comment, e.g. setassignee(assigned_to='wwoods@redhat.com') @@ -235,7 +232,7 @@ class Bug(object): will throw a ValueError. Returns [bug_id, mailresults]. - ''' + """ if not (assigned_to or qa_contact): raise ValueError("You must set one of assigned_to " " or qa_contact") @@ -248,11 +245,11 @@ class Bug(object): return self.bugzilla.update_bugs(self.bug_id, vals) def addcc(self, cclist, comment=None): - ''' + """ Adds the given email addresses to the CC list for this bug. cclist: list of email addresses (strings) comment: optional comment to add to the bug - ''' + """ vals = self.bugzilla.build_update(comment=comment, cc_add=cclist) log.debug("addcc: update=%s", vals) @@ -260,9 +257,9 @@ class Bug(object): return self.bugzilla.update_bugs(self.bug_id, vals) def deletecc(self, cclist, comment=None): - ''' + """ Removes the given email addresses from the CC list for this bug. - ''' + """ vals = self.bugzilla.build_update(comment=comment, cc_remove=cclist) log.debug("deletecc: update=%s", vals) @@ -275,10 +272,10 @@ class Bug(object): #################### def addcomment(self, comment, private=False): - ''' + """ Add the given comment to this bug. Set private to True to mark this comment as private. - ''' + """ # Note: fedora bodhi uses this function vals = self.bugzilla.build_update(comment=comment, comment_private=private) @@ -287,9 +284,9 @@ class Bug(object): return self.bugzilla.update_bugs(self.bug_id, vals) def getcomments(self): - ''' + """ Returns an array of comment dictionaries for this bug - ''' + """ comment_list = self.bugzilla.get_comments([self.bug_id]) return comment_list['bugs'][str(self.bug_id)]['comments'] @@ -377,18 +374,19 @@ class Bug(object): return [a["id"] for a in self.get_attachments(exclude_fields=["data"])] def get_history_raw(self): - ''' + """ Experimental. Get the history of changes for this bug. - ''' + """ return self.bugzilla.bugs_history_raw([self.bug_id]) class User(object): - '''Container object for a bugzilla User. + """ + Container object for a bugzilla User. :arg bugzilla: Bugzilla instance that this User belongs to. Rest of the params come straight from User.get() - ''' + """ def __init__(self, bugzilla, **kwargs): self.bugzilla = bugzilla self.__userid = kwargs.get('id') @@ -440,11 +438,74 @@ class User(object): self.__dict__.update(newuser.__dict__) def updateperms(self, action, groups): - ''' + """ A method to update the permissions (group membership) of a bugzilla user. :arg action: add, remove, or set :arg groups: list of groups to be added to (i.e. ['fedora_contrib']) - ''' + """ self.bugzilla.updateperms(self.name, action, groups) + + +class Group(object): + """ + Container object for a bugzilla Group. + + :arg bugzilla: Bugzilla instance that this Group belongs to. + Rest of the params come straight from Group.get() + """ + def __init__(self, bugzilla, **kwargs): + self.bugzilla = bugzilla + self.__groupid = kwargs.get('id') + + self.name = kwargs.get('name') + self.description = kwargs.get('description', self.name) + self.is_active = kwargs.get('is_active', False) + self.icon_url = kwargs.get('icon_url', None) + self.is_active_bug_group = kwargs.get('is_active_bug_group', None) + + self.membership = kwargs.get('membership', []) + self.__member_emails = set() + self._refresh_member_emails_list() + + ######################## + # Read-only attributes # + ######################## + + # We make these properties so that the user cannot set them. They are + # unaffected by the update() method so it would be misleading to let them + # be changed. + @property + def groupid(self): + return self.__groupid + + @property + def member_emails(self): + return sorted(self.__member_emails) + + def _refresh_member_emails_list(self): + """ + Refresh the list of emails of the members of the group. + """ + if self.membership: + for m in self.membership: + if "email" in m: + self.__member_emails.add(m["email"]) + + def refresh(self, membership=False): + """ + Update Group object with latest info from bugzilla + """ + newgroup = self.bugzilla.getgroup( + self.name, membership=membership) + self.__dict__.update(newgroup.__dict__) + self._refresh_member_emails_list() + + def members(self): + """ + Retrieve the members of this Group from bugzilla + """ + if not self.membership: + self.refresh(membership=True) + return self.membership diff --git a/scripts/bugzilla/exceptions.py b/scripts/bugzilla/exceptions.py new file mode 100644 index 0000000..d884df0 --- /dev/null +++ b/scripts/bugzilla/exceptions.py @@ -0,0 +1,38 @@ +# This work is licensed under the GNU GPLv2 or later. +# See the COPYING file in the top-level directory. + + +class BugzillaError(Exception): + """ + Error raised in the Bugzilla client code. + """ + @staticmethod + def get_bugzilla_error_string(exc): + """ + Helper to return the bugzilla instance error message from an + XMLRPC Fault, or any other exception type that's raised from bugzilla + interaction + """ + return getattr(exc, "faultString", str(exc)) + + @staticmethod + def get_bugzilla_error_code(exc): + """ + Helper to return the bugzilla instance error code from an + XMLRPC Fault, or any other exception type that's raised from bugzilla + interaction + """ + for propname in ["faultCode", "code"]: + if hasattr(exc, propname): + return getattr(exc, propname) + return None + + def __init__(self, message, code=None): + """ + :param code: The error code from the remote bugzilla instance. Only + set if the error came directly from the remove bugzilla + """ + self.code = code + if self.code: + message += " (code=%s)" % self.code + Exception.__init__(self, message) diff --git a/scripts/bugzilla/oldclasses.py b/scripts/bugzilla/oldclasses.py index 18169e7..e579fb9 100644 --- a/scripts/bugzilla/oldclasses.py +++ b/scripts/bugzilla/oldclasses.py @@ -1,23 +1,64 @@ -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See http://www.gnu.org/copyleft/gpl.html for -# the full text of the license. +# This work is licensed under the GNU GPLv2 or later. +# See the COPYING file in the top-level directory. from .base import Bugzilla -from .rhbugzilla import RHBugzilla - # These are old compat classes. Nothing new should be added here, # and these should not be altered -class Bugzilla3(Bugzilla): pass -class Bugzilla32(Bugzilla): pass -class Bugzilla34(Bugzilla): pass -class Bugzilla36(Bugzilla): pass -class Bugzilla4(Bugzilla): pass -class Bugzilla42(Bugzilla): pass -class Bugzilla44(Bugzilla): pass -class NovellBugzilla(Bugzilla): pass -class RHBugzilla3(RHBugzilla): pass -class RHBugzilla4(RHBugzilla): pass + +class Bugzilla3(Bugzilla): + pass + + +class Bugzilla32(Bugzilla): + pass + + +class Bugzilla34(Bugzilla): + pass + + +class Bugzilla36(Bugzilla): + pass + + +class Bugzilla4(Bugzilla): + pass + + +class Bugzilla42(Bugzilla): + pass + + +class Bugzilla44(Bugzilla): + pass + + +class NovellBugzilla(Bugzilla): + pass + + +class RHBugzilla(Bugzilla): + """ + Helper class for historical bugzilla.redhat.com back compat + + Historically this class used many more non-upstream methods, but + in 2012 RH started dropping most of its custom bits. By that time, + upstream BZ had most of the important functionality. + + Much of the remaining code here is just trying to keep things operating + in python-bugzilla back compatible manner. + + This class was written using bugzilla.redhat.com's API docs: + https://bugzilla.redhat.com/docs/en/html/api/ + """ + _is_redhat_bugzilla = True + + +class RHBugzilla3(RHBugzilla): + pass + + +class RHBugzilla4(RHBugzilla): + pass diff --git a/scripts/bugzilla/rhbugzilla.py b/scripts/bugzilla/rhbugzilla.py index 55ee601..10b4594 100644 --- a/scripts/bugzilla/rhbugzilla.py +++ b/scripts/bugzilla/rhbugzilla.py @@ -1,352 +1,7 @@ -# rhbugzilla.py - a Python interface to Red Hat Bugzilla using xmlrpclib. -# -# Copyright (C) 2008-2012 Red Hat Inc. -# Author: Will Woods -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See http://www.gnu.org/copyleft/gpl.html for -# the full text of the license. +# This work is licensed under the GNU GPLv2 or later. +# See the COPYING file in the top-level directory. -from logging import getLogger +# This class needs to live in rhbugzilla.py to preserve historical +# 'bugzilla.rhbugzilla' import compat -from .base import Bugzilla - -log = getLogger(__name__) - - -class RHBugzilla(Bugzilla): - ''' - Bugzilla class for connecting Red Hat's forked bugzilla instance, - bugzilla.redhat.com - - Historically this class used many more non-upstream methods, but - in 2012 RH started dropping most of its custom bits. By that time, - upstream BZ had most of the important functionality. - - Much of the remaining code here is just trying to keep things operating - in python-bugzilla back compatible manner. - - This class was written using bugzilla.redhat.com's API docs: - https://bugzilla.redhat.com/docs/en/html/api/ - ''' - def _init_class_state(self): - def _add_both_alias(newname, origname): - self._add_field_alias(newname, origname, is_api=False) - self._add_field_alias(origname, newname, is_bug=False) - - _add_both_alias('fixed_in', 'cf_fixed_in') - _add_both_alias('qa_whiteboard', 'cf_qa_whiteboard') - _add_both_alias('devel_whiteboard', 'cf_devel_whiteboard') - _add_both_alias('internal_whiteboard', 'cf_internal_whiteboard') - - self._add_field_alias('component', 'components', is_bug=False) - self._add_field_alias('version', 'versions', is_bug=False) - # Yes, sub_components is the field name the API expects - self._add_field_alias('sub_components', 'sub_component', is_bug=False) - - # flags format isn't exactly the same but it's the closest approx - self._add_field_alias('flags', 'flag_types') - - self._getbug_extra_fields = self._getbug_extra_fields + [ - "comments", "description", - "external_bugs", "flags", "sub_components", - "tags", - ] - self._supports_getbug_extra_fields = True - - - ###################### - # Bug update methods # - ###################### - - def build_update(self, **kwargs): - # pylint: disable=arguments-differ - adddict = {} - - def pop(key, destkey): - val = kwargs.pop(key, None) - if val is None: - return - adddict[destkey] = val - - def get_sub_component(): - val = kwargs.pop("sub_component", None) - if val is None: - return - - if not isinstance(val, dict): - component = self._listify(kwargs.get("component")) - if not component: - raise ValueError("component must be specified if " - "specifying sub_component") - val = {component[0]: val} - adddict["sub_components"] = val - - def get_alias(): - # RHBZ has a custom extension to allow a bug to have multiple - # aliases, so the format of aliases is - # {"add": [...], "remove": [...]} - # But that means in order to approximate upstream, behavior - # which just overwrites the existing alias, we need to read - # the bug's state first to know what string to remove. Which - # we can't do, since we don't know the bug numbers at this point. - # So fail for now. - # - # The API should provide {"set": [...]} - # https://bugzilla.redhat.com/show_bug.cgi?id=1173114 - # - # Implementation will go here when it's available - pass - - pop("fixed_in", "cf_fixed_in") - pop("qa_whiteboard", "cf_qa_whiteboard") - pop("devel_whiteboard", "cf_devel_whiteboard") - pop("internal_whiteboard", "cf_internal_whiteboard") - - get_sub_component() - get_alias() - - vals = Bugzilla.build_update(self, **kwargs) - vals.update(adddict) - - return vals - - def add_external_tracker(self, bug_ids, ext_bz_bug_id, ext_type_id=None, - ext_type_description=None, ext_type_url=None, - ext_status=None, ext_description=None, - ext_priority=None): - """ - Wrapper method to allow adding of external tracking bugs using the - ExternalBugs::WebService::add_external_bug method. - - This is documented at - https://bugzilla.redhat.com/docs/en/html/api/extensions/ExternalBugs/lib/WebService.html#add_external_bug - - bug_ids: A single bug id or list of bug ids to have external trackers - added. - ext_bz_bug_id: The external bug id (ie: the bug number in the - external tracker). - ext_type_id: The external tracker id as used by Bugzilla. - ext_type_description: The external tracker description as used by - Bugzilla. - ext_type_url: The external tracker url as used by Bugzilla. - ext_status: The status of the external bug. - ext_description: The description of the external bug. - ext_priority: The priority of the external bug. - """ - param_dict = {'ext_bz_bug_id': ext_bz_bug_id} - if ext_type_id is not None: - param_dict['ext_type_id'] = ext_type_id - if ext_type_description is not None: - param_dict['ext_type_description'] = ext_type_description - if ext_type_url is not None: - param_dict['ext_type_url'] = ext_type_url - if ext_status is not None: - param_dict['ext_status'] = ext_status - if ext_description is not None: - param_dict['ext_description'] = ext_description - if ext_priority is not None: - param_dict['ext_priority'] = ext_priority - params = { - 'bug_ids': self._listify(bug_ids), - 'external_bugs': [param_dict], - } - - log.debug("Calling ExternalBugs.add_external_bug(%s)", params) - return self._proxy.ExternalBugs.add_external_bug(params) - - def update_external_tracker(self, ids=None, ext_type_id=None, - ext_type_description=None, ext_type_url=None, - ext_bz_bug_id=None, bug_ids=None, - ext_status=None, ext_description=None, - ext_priority=None): - """ - Wrapper method to allow adding of external tracking bugs using the - ExternalBugs::WebService::update_external_bug method. - - This is documented at - https://bugzilla.redhat.com/docs/en/html/api/extensions/ExternalBugs/lib/WebService.html#update_external_bug - - ids: A single external tracker bug id or list of external tracker bug - ids. - ext_type_id: The external tracker id as used by Bugzilla. - ext_type_description: The external tracker description as used by - Bugzilla. - ext_type_url: The external tracker url as used by Bugzilla. - ext_bz_bug_id: A single external bug id or list of external bug ids - (ie: the bug number in the external tracker). - bug_ids: A single bug id or list of bug ids to have external tracker - info updated. - ext_status: The status of the external bug. - ext_description: The description of the external bug. - ext_priority: The priority of the external bug. - """ - params = {} - if ids is not None: - params['ids'] = self._listify(ids) - if ext_type_id is not None: - params['ext_type_id'] = ext_type_id - if ext_type_description is not None: - params['ext_type_description'] = ext_type_description - if ext_type_url is not None: - params['ext_type_url'] = ext_type_url - if ext_bz_bug_id is not None: - params['ext_bz_bug_id'] = self._listify(ext_bz_bug_id) - if bug_ids is not None: - params['bug_ids'] = self._listify(bug_ids) - if ext_status is not None: - params['ext_status'] = ext_status - if ext_description is not None: - params['ext_description'] = ext_description - if ext_priority is not None: - params['ext_priority'] = ext_priority - - log.debug("Calling ExternalBugs.update_external_bug(%s)", params) - return self._proxy.ExternalBugs.update_external_bug(params) - - def remove_external_tracker(self, ids=None, ext_type_id=None, - ext_type_description=None, ext_type_url=None, - ext_bz_bug_id=None, bug_ids=None): - """ - Wrapper method to allow removal of external tracking bugs using the - ExternalBugs::WebService::remove_external_bug method. - - This is documented at - https://bugzilla.redhat.com/docs/en/html/api/extensions/ExternalBugs/lib/WebService.html#remove_external_bug - - ids: A single external tracker bug id or list of external tracker bug - ids. - ext_type_id: The external tracker id as used by Bugzilla. - ext_type_description: The external tracker description as used by - Bugzilla. - ext_type_url: The external tracker url as used by Bugzilla. - ext_bz_bug_id: A single external bug id or list of external bug ids - (ie: the bug number in the external tracker). - bug_ids: A single bug id or list of bug ids to have external tracker - info updated. - """ - params = {} - if ids is not None: - params['ids'] = self._listify(ids) - if ext_type_id is not None: - params['ext_type_id'] = ext_type_id - if ext_type_description is not None: - params['ext_type_description'] = ext_type_description - if ext_type_url is not None: - params['ext_type_url'] = ext_type_url - if ext_bz_bug_id is not None: - params['ext_bz_bug_id'] = self._listify(ext_bz_bug_id) - if bug_ids is not None: - params['bug_ids'] = self._listify(bug_ids) - - log.debug("Calling ExternalBugs.remove_external_bug(%s)", params) - return self._proxy.ExternalBugs.remove_external_bug(params) - - - ################# - # Query methods # - ################# - - def pre_translation(self, query): - '''Translates the query for possible aliases''' - old = query.copy() - - if 'bug_id' in query: - if not isinstance(query['bug_id'], list): - query['id'] = query['bug_id'].split(',') - else: - query['id'] = query['bug_id'] - del query['bug_id'] - - if 'component' in query: - if not isinstance(query['component'], list): - query['component'] = query['component'].split(',') - - if 'include_fields' not in query and 'column_list' not in query: - return - - if 'include_fields' not in query: - query['include_fields'] = [] - if 'column_list' in query: - query['include_fields'] = query['column_list'] - del query['column_list'] - - # We need to do this for users here for users that - # don't call build_query - query.update(self._process_include_fields(query["include_fields"], - None, None)) - - if old != query: - log.debug("RHBugzilla pretranslated query to: %s", query) - - def post_translation(self, query, bug): - ''' - Convert the results of getbug back to the ancient RHBZ value - formats - ''' - ignore = query - - # RHBZ _still_ returns component and version as lists, which - # deviates from upstream. Copy the list values to components - # and versions respectively. - if 'component' in bug and "components" not in bug: - val = bug['component'] - bug['components'] = isinstance(val, list) and val or [val] - bug['component'] = bug['components'][0] - - if 'version' in bug and "versions" not in bug: - val = bug['version'] - bug['versions'] = isinstance(val, list) and val or [val] - bug['version'] = bug['versions'][0] - - # sub_components isn't too friendly of a format, add a simpler - # sub_component value - if 'sub_components' in bug and 'sub_component' not in bug: - val = bug['sub_components'] - bug['sub_component'] = "" - if isinstance(val, dict): - values = [] - for vallist in val.values(): - values += vallist - bug['sub_component'] = " ".join(values) - - def build_external_tracker_boolean_query(self, *args, **kwargs): - ignore1 = args - ignore2 = kwargs - raise RuntimeError("Building external boolean queries is " - "no longer supported. Please build a URL query " - "via the bugzilla web UI and pass it to 'query --from-url' " - "or url_to_query()") - - - def build_query(self, **kwargs): - # pylint: disable=arguments-differ - - # We previously accepted a text format to approximate boolean - # queries, and only for RHBugzilla. Upstream bz has --from-url - # support now, so point people to that instead so we don't have - # to document and maintain this logic anymore - def _warn_bool(kwkey): - vallist = self._listify(kwargs.get(kwkey, None)) - for value in vallist or []: - for s in value.split(" "): - if s not in ["|", "&", "!"]: - continue - log.warning("%s value '%s' appears to use the now " - "unsupported boolean formatting, your query may " - "be incorrect. If you need complicated URL queries, " - "look into bugzilla --from-url/url_to_query().", - kwkey, value) - return - - _warn_bool("fixed_in") - _warn_bool("blocked") - _warn_bool("dependson") - _warn_bool("flag") - _warn_bool("qa_whiteboard") - _warn_bool("devel_whiteboard") - _warn_bool("alias") - - return Bugzilla.build_query(self, **kwargs) +from .oldclasses import RHBugzilla # pylint: disable=unused-import diff --git a/scripts/git_sort/tests/Docker/opensuse-15.4.Dockerfile b/scripts/git_sort/tests/Docker/opensuse-15.4.Dockerfile new file mode 100644 index 0000000..1d5cbc7 --- /dev/null +++ b/scripts/git_sort/tests/Docker/opensuse-15.4.Dockerfile @@ -0,0 +1,24 @@ +# https://hub.docker.com/r/opensuse/leap/ +FROM opensuse/leap:15.4 AS base + +RUN zypper -n ref + +FROM base AS packages + +RUN zypper -n in git python3 python3-dbm rcs + +RUN git config --global user.email "you@example.com" +RUN git config --global user.name "Your Name" + +COPY Kernel.gpg /tmp +RUN rpmkeys --import /tmp/Kernel.gpg +RUN zypper -n ar https://download.opensuse.org/repositories/Kernel:/tools/SLE_15_SP4/Kernel:tools.repo +RUN zypper -n in python3-pygit2 quilt + +FROM packages + +VOLUME /scripts + +WORKDIR /scripts/git_sort + +CMD python3 -m unittest discover -v diff --git a/scripts/git_sort/tests/Docker/opensuse-tumbleweed.Dockerfile b/scripts/git_sort/tests/Docker/opensuse-tumbleweed.Dockerfile new file mode 100644 index 0000000..af6cfbc --- /dev/null +++ b/scripts/git_sort/tests/Docker/opensuse-tumbleweed.Dockerfile @@ -0,0 +1,24 @@ +# https://hub.docker.com/r/opensuse/tumbleweed/ +FROM opensuse/tumbleweed AS base + +RUN zypper -n ref + +FROM base AS packages + +RUN zypper -n in git python3 python3-dbm python3-pygit2 rcs util-linux + +RUN git config --global user.email "you@example.com" +RUN git config --global user.name "Your Name" + +COPY Kernel.gpg /tmp +RUN rpmkeys --import /tmp/Kernel.gpg +RUN zypper -n ar https://download.opensuse.org/repositories/Kernel:/tools/openSUSE_Factory/Kernel:tools.repo +RUN zypper -n in --from Kernel_tools quilt + +FROM packages + +VOLUME /scripts + +WORKDIR /scripts/git_sort + +CMD python3 -m unittest discover -v diff --git a/scripts/git_sort/tests/Docker/sle12-sp4.Dockerfile b/scripts/git_sort/tests/Docker/sle12-sp4.Dockerfile new file mode 100644 index 0000000..49d8f9c --- /dev/null +++ b/scripts/git_sort/tests/Docker/sle12-sp4.Dockerfile @@ -0,0 +1,33 @@ +# http://registry.suse.de/ +FROM registry.suse.de/suse/containers/sle-server/12-sp4/containers/suse/sles12sp4:latest AS base + +RUN rpm -e container-suseconnect +RUN zypper -n ar http://download.suse.de/ibs/SUSE:/SLE-12:/GA/standard/SUSE:SLE-12:GA.repo +RUN zypper -n ar http://download.suse.de/ibs/SUSE:/SLE-12:/Update/standard/SUSE:SLE-12:Update.repo +RUN zypper -n ar http://download.suse.de/install/SLP/SLE-12-SP4-Server-GM/$(rpm -E %_arch)/DVD1/ DVD1 +RUN zypper -n ar http://download.suse.de/install/SLP/SLE-12-SP4-Server-GM/$(rpm -E %_arch)/DVD2/ DVD2 +RUN zypper -n ar http://download.suse.de/install/SLP/SLE-12-SP4-Server-GM/$(rpm -E %_arch)/DVD3/ DVD3 +# RUN zypper -n ar -G http://updates.suse.de/SUSE/Products/SLE-SDK/12-SP4/$(rpm -E %_arch)/product/ SDK +RUN zypper -n ar http://download.suse.de/update/build.suse.de/SUSE/Updates/SLE-SERVER/12-SP4/$(rpm -E %_arch)/update/SUSE:Updates:SLE-SERVER:12-SP4:$(rpm -E %_arch).repo + +RUN zypper -n ref + +FROM base AS packages + +RUN zypper -n in git-core python3 python3-dbm rcs + +RUN git config --global user.email "you@example.com" +RUN git config --global user.name "Your Name" + +COPY Kernel.gpg /tmp +RUN rpmkeys --import /tmp/Kernel.gpg +RUN zypper -n ar https://download.opensuse.org/repositories/Kernel:/tools/SLE_12_SP4/Kernel:tools.repo +RUN zypper -n in python3-pygit2 quilt + +FROM packages + +VOLUME /scripts + +WORKDIR /scripts/git_sort + +CMD python3 -m unittest discover -v diff --git a/scripts/git_sort/tests/Docker/sle12-sp5.Dockerfile b/scripts/git_sort/tests/Docker/sle12-sp5.Dockerfile new file mode 100644 index 0000000..f5e2f58 --- /dev/null +++ b/scripts/git_sort/tests/Docker/sle12-sp5.Dockerfile @@ -0,0 +1,33 @@ +# http://registry.suse.de/ +FROM registry.suse.de/suse/containers/sle-server/12-sp5/containers/suse/sles12sp5:latest AS base + +RUN rpm -e container-suseconnect +RUN zypper -n ar http://download.suse.de/ibs/SUSE:/SLE-12:/GA/standard/SUSE:SLE-12:GA.repo +RUN zypper -n ar http://download.suse.de/ibs/SUSE:/SLE-12:/Update/standard/SUSE:SLE-12:Update.repo +RUN zypper -n ar http://download.suse.de/install/SLP/SLE-12-SP5-Server-GM/$(rpm -E %_arch)/DVD1/ DVD1 +RUN zypper -n ar http://download.suse.de/install/SLP/SLE-12-SP5-Server-GM/$(rpm -E %_arch)/DVD2/ DVD2 +RUN zypper -n ar http://download.suse.de/install/SLP/SLE-12-SP5-Server-GM/$(rpm -E %_arch)/DVD3/ DVD3 +# RUN zypper -n ar -G http://updates.suse.de/SUSE/Products/SLE-SDK/12-SP5/$(rpm -E %_arch)/product/ SDK +RUN zypper -n ar http://download.suse.de/update/build.suse.de/SUSE/Updates/SLE-SERVER/12-SP5/$(rpm -E %_arch)/update/SUSE:Updates:SLE-SERVER:12-SP5:$(rpm -E %_arch).repo + +RUN zypper -n ref + +FROM base AS packages + +RUN zypper -n in git-core python3 python3-dbm rcs + +RUN git config --global user.email "you@example.com" +RUN git config --global user.name "Your Name" + +COPY Kernel.gpg /tmp +RUN rpmkeys --import /tmp/Kernel.gpg +RUN zypper -n ar https://download.opensuse.org/repositories/Kernel:/tools/SLE_12_SP5/Kernel:tools.repo +RUN zypper -n in python3-pygit2 quilt + +FROM packages + +VOLUME /scripts + +WORKDIR /scripts/git_sort + +CMD python3 -m unittest discover -v diff --git a/scripts/git_sort/tests/Docker/sle15.Dockerfile b/scripts/git_sort/tests/Docker/sle15.Dockerfile new file mode 100644 index 0000000..4d1cc54 --- /dev/null +++ b/scripts/git_sort/tests/Docker/sle15.Dockerfile @@ -0,0 +1,27 @@ +# http://registry.suse.de/ +FROM registry.suse.de/suse/sle-15/update/images/suse/sle15:latest AS base + +RUN rpm -e container-suseconnect +RUN zypper -n ar http://download.suse.de/ibs/SUSE:/SLE-15:/GA/standard/SUSE:SLE-15:GA.repo +RUN zypper -n ar http://download.suse.de/ibs/SUSE:/SLE-15:/Update/standard/SUSE:SLE-15:Update.repo +RUN zypper -n ref + +FROM base AS packages + +RUN zypper -n in git-core python3 python3-dbm rcs awk + +RUN git config --global user.email "you@example.com" +RUN git config --global user.name "Your Name" + +COPY Kernel.gpg /tmp +RUN rpmkeys --import /tmp/Kernel.gpg +RUN zypper -n ar https://download.opensuse.org/repositories/Kernel:/tools/SLE_15/Kernel:tools.repo +RUN zypper -n in python3-pygit2 quilt + +FROM packages + +VOLUME /scripts + +WORKDIR /scripts/git_sort + +CMD python3 -m unittest discover -v diff --git a/scripts/git_sort/tests/opensuse-15.4/Dockerfile b/scripts/git_sort/tests/opensuse-15.4/Dockerfile deleted file mode 100644 index 1d5cbc7..0000000 --- a/scripts/git_sort/tests/opensuse-15.4/Dockerfile +++ /dev/null @@ -1,24 +0,0 @@ -# https://hub.docker.com/r/opensuse/leap/ -FROM opensuse/leap:15.4 AS base - -RUN zypper -n ref - -FROM base AS packages - -RUN zypper -n in git python3 python3-dbm rcs - -RUN git config --global user.email "you@example.com" -RUN git config --global user.name "Your Name" - -COPY Kernel.gpg /tmp -RUN rpmkeys --import /tmp/Kernel.gpg -RUN zypper -n ar https://download.opensuse.org/repositories/Kernel:/tools/SLE_15_SP4/Kernel:tools.repo -RUN zypper -n in python3-pygit2 quilt - -FROM packages - -VOLUME /scripts - -WORKDIR /scripts/git_sort - -CMD python3 -m unittest discover -v diff --git a/scripts/git_sort/tests/opensuse-tumbleweed/Dockerfile b/scripts/git_sort/tests/opensuse-tumbleweed/Dockerfile deleted file mode 100644 index af6cfbc..0000000 --- a/scripts/git_sort/tests/opensuse-tumbleweed/Dockerfile +++ /dev/null @@ -1,24 +0,0 @@ -# https://hub.docker.com/r/opensuse/tumbleweed/ -FROM opensuse/tumbleweed AS base - -RUN zypper -n ref - -FROM base AS packages - -RUN zypper -n in git python3 python3-dbm python3-pygit2 rcs util-linux - -RUN git config --global user.email "you@example.com" -RUN git config --global user.name "Your Name" - -COPY Kernel.gpg /tmp -RUN rpmkeys --import /tmp/Kernel.gpg -RUN zypper -n ar https://download.opensuse.org/repositories/Kernel:/tools/openSUSE_Factory/Kernel:tools.repo -RUN zypper -n in --from Kernel_tools quilt - -FROM packages - -VOLUME /scripts - -WORKDIR /scripts/git_sort - -CMD python3 -m unittest discover -v diff --git a/scripts/git_sort/tests/run_all.sh b/scripts/git_sort/tests/run_all.sh index f63ab5b..e0109b1 100755 --- a/scripts/git_sort/tests/run_all.sh +++ b/scripts/git_sort/tests/run_all.sh @@ -1,6 +1,28 @@ -#!/bin/bash +#!/bin/sh -libdir=$(dirname "$(readlink -f "$0")") +enable_x() { + local enable=true + while [ $# -gt 0 ] ; do + { [ "$1" = "-q" ] || [ "$1" = "--quiet" ] ; } && enable=false + shift + done + $enable && set -x + } + +enable_x "$@" + +testdir=$(dirname "$(readlink -f "$0")") +keys="Kernel.gpg" + +for key in $keys ; do + cp -a $testdir/../../lib/SUSE/$key $testdir/Docker +done + +trap ' +for key in $keys ; do + rm $testdir/Docker/$key +done +' EXIT for release in \ sle12-sp4 \ @@ -10,14 +32,12 @@ for release in \ opensuse-tumbleweed \ ; do echo "Building container image for $release..." - cp -a $libdir/../../lib/SUSE/Kernel.gpg $libdir/$release - docker build -q -t gs-test-$release "$libdir/$release" + docker build "$@" -t gs-test-$release -f $testdir/Docker/$release.Dockerfile --build-arg release=$release $testdir/Docker ret=$? - rm -f $libdir/$release/Kernel.gpg [ $ret -eq 0 ] || exit $? echo "Running tests in $release:" docker run --rm --name=gs-test-$release \ - --mount type=bind,source="$libdir/../../",target=/scripts,readonly \ + --mount type=bind,source="$testdir/../../",target=/scripts,readonly \ gs-test-$release ret=$? [ $ret -eq 0 ] || exit $? diff --git a/scripts/git_sort/tests/sle12-sp4/Dockerfile b/scripts/git_sort/tests/sle12-sp4/Dockerfile deleted file mode 100644 index 49d8f9c..0000000 --- a/scripts/git_sort/tests/sle12-sp4/Dockerfile +++ /dev/null @@ -1,33 +0,0 @@ -# http://registry.suse.de/ -FROM registry.suse.de/suse/containers/sle-server/12-sp4/containers/suse/sles12sp4:latest AS base - -RUN rpm -e container-suseconnect -RUN zypper -n ar http://download.suse.de/ibs/SUSE:/SLE-12:/GA/standard/SUSE:SLE-12:GA.repo -RUN zypper -n ar http://download.suse.de/ibs/SUSE:/SLE-12:/Update/standard/SUSE:SLE-12:Update.repo -RUN zypper -n ar http://download.suse.de/install/SLP/SLE-12-SP4-Server-GM/$(rpm -E %_arch)/DVD1/ DVD1 -RUN zypper -n ar http://download.suse.de/install/SLP/SLE-12-SP4-Server-GM/$(rpm -E %_arch)/DVD2/ DVD2 -RUN zypper -n ar http://download.suse.de/install/SLP/SLE-12-SP4-Server-GM/$(rpm -E %_arch)/DVD3/ DVD3 -# RUN zypper -n ar -G http://updates.suse.de/SUSE/Products/SLE-SDK/12-SP4/$(rpm -E %_arch)/product/ SDK -RUN zypper -n ar http://download.suse.de/update/build.suse.de/SUSE/Updates/SLE-SERVER/12-SP4/$(rpm -E %_arch)/update/SUSE:Updates:SLE-SERVER:12-SP4:$(rpm -E %_arch).repo - -RUN zypper -n ref - -FROM base AS packages - -RUN zypper -n in git-core python3 python3-dbm rcs - -RUN git config --global user.email "you@example.com" -RUN git config --global user.name "Your Name" - -COPY Kernel.gpg /tmp -RUN rpmkeys --import /tmp/Kernel.gpg -RUN zypper -n ar https://download.opensuse.org/repositories/Kernel:/tools/SLE_12_SP4/Kernel:tools.repo -RUN zypper -n in python3-pygit2 quilt - -FROM packages - -VOLUME /scripts - -WORKDIR /scripts/git_sort - -CMD python3 -m unittest discover -v diff --git a/scripts/git_sort/tests/sle12-sp5/Dockerfile b/scripts/git_sort/tests/sle12-sp5/Dockerfile deleted file mode 100644 index f5e2f58..0000000 --- a/scripts/git_sort/tests/sle12-sp5/Dockerfile +++ /dev/null @@ -1,33 +0,0 @@ -# http://registry.suse.de/ -FROM registry.suse.de/suse/containers/sle-server/12-sp5/containers/suse/sles12sp5:latest AS base - -RUN rpm -e container-suseconnect -RUN zypper -n ar http://download.suse.de/ibs/SUSE:/SLE-12:/GA/standard/SUSE:SLE-12:GA.repo -RUN zypper -n ar http://download.suse.de/ibs/SUSE:/SLE-12:/Update/standard/SUSE:SLE-12:Update.repo -RUN zypper -n ar http://download.suse.de/install/SLP/SLE-12-SP5-Server-GM/$(rpm -E %_arch)/DVD1/ DVD1 -RUN zypper -n ar http://download.suse.de/install/SLP/SLE-12-SP5-Server-GM/$(rpm -E %_arch)/DVD2/ DVD2 -RUN zypper -n ar http://download.suse.de/install/SLP/SLE-12-SP5-Server-GM/$(rpm -E %_arch)/DVD3/ DVD3 -# RUN zypper -n ar -G http://updates.suse.de/SUSE/Products/SLE-SDK/12-SP5/$(rpm -E %_arch)/product/ SDK -RUN zypper -n ar http://download.suse.de/update/build.suse.de/SUSE/Updates/SLE-SERVER/12-SP5/$(rpm -E %_arch)/update/SUSE:Updates:SLE-SERVER:12-SP5:$(rpm -E %_arch).repo - -RUN zypper -n ref - -FROM base AS packages - -RUN zypper -n in git-core python3 python3-dbm rcs - -RUN git config --global user.email "you@example.com" -RUN git config --global user.name "Your Name" - -COPY Kernel.gpg /tmp -RUN rpmkeys --import /tmp/Kernel.gpg -RUN zypper -n ar https://download.opensuse.org/repositories/Kernel:/tools/SLE_12_SP5/Kernel:tools.repo -RUN zypper -n in python3-pygit2 quilt - -FROM packages - -VOLUME /scripts - -WORKDIR /scripts/git_sort - -CMD python3 -m unittest discover -v diff --git a/scripts/git_sort/tests/sle15/Dockerfile b/scripts/git_sort/tests/sle15/Dockerfile deleted file mode 100644 index 002074f..0000000 --- a/scripts/git_sort/tests/sle15/Dockerfile +++ /dev/null @@ -1,27 +0,0 @@ -# http://registry.suse.de/ -FROM registry.suse.de/suse/containers/sle-server/15/containers/bci/python:3.6 AS base - -RUN rpm -e container-suseconnect -RUN zypper -n ar http://download.suse.de/ibs/SUSE:/SLE-15:/GA/standard/SUSE:SLE-15:GA.repo -RUN zypper -n ar http://download.suse.de/ibs/SUSE:/SLE-15:/Update/standard/SUSE:SLE-15:Update.repo -RUN zypper -n ref - -FROM base AS packages - -RUN zypper -n in git-core python3 python3-dbm rcs awk - -RUN git config --global user.email "you@example.com" -RUN git config --global user.name "Your Name" - -COPY Kernel.gpg /tmp -RUN rpmkeys --import /tmp/Kernel.gpg -RUN zypper -n ar https://download.opensuse.org/repositories/Kernel:/tools/SLE_15/Kernel:tools.repo -RUN zypper -n in python3-pygit2 quilt - -FROM packages - -VOLUME /scripts - -WORKDIR /scripts/git_sort - -CMD python3 -m unittest discover -v diff --git a/scripts/run_oldconfig.sh b/scripts/run_oldconfig.sh index 357692a..d18aa1f 100755 --- a/scripts/run_oldconfig.sh +++ b/scripts/run_oldconfig.sh @@ -254,6 +254,9 @@ scripts="${prefix}scripts" if test -e "${prefix}rpm/config.sh"; then source "$_" fi +if [ "$VARIANT" = "-vanilla" ] ; then + VANILLA_ONLY=1 +fi if test -z "$set_flavor" && test "$VANILLA_ONLY" = 1 -o -e .is_vanilla; then set_flavor=vanilla fi diff --git a/scripts/tar-up.sh b/scripts/tar-up.sh index 2ea9a1a..01f5d03 100755 --- a/scripts/tar-up.sh +++ b/scripts/tar-up.sh @@ -191,7 +191,7 @@ CLEANFILES=() trap 'if test -n "$CLEANFILES"; then rm -rf "${CLEANFILES[@]}"; fi' EXIT tmpdir=$(mktemp -dt ${0##*/}.XXXXXX) CLEANFILES=("${CLEANFILES[@]}" "$tmpdir") -rpmfiles=$(ls rpm/* | grep -v "~$") +rpmfiles=$(ls -d rpm/* | grep -v -e "~$" -e "[.]orig$" -e "[.]rej$" | { while read x ; do [ -d "$x" ] || echo "$x" ; done ; } ) rpmstatus=$(for i in $rpmfiles ; do git status -s $i ; done) [ -z "$rpmstatus" ] || { inconsistent=true ; echo "$rpmstatus" ; } diff --git a/series.conf b/series.conf index 83225d5..f713ec3 100644 --- a/series.conf +++ b/series.conf @@ -1627,6 +1627,743 @@ patches.kernel.org/6.2.8-213-powerpc-Disable-CPU-unknown-by-CLANG-when-CC_IS.patch patches.kernel.org/6.2.8-214-powerpc-64-Replace-mcpu-e500mc64-by-mcpu-e5500.patch patches.kernel.org/6.2.8-215-Linux-6.2.8.patch + patches.kernel.org/6.2.9-001-interconnect-qcom-osm-l3-fix-icc_onecell_data-a.patch + patches.kernel.org/6.2.9-002-interconnect-qcom-sm8450-switch-to-qcom_icc_rpm.patch + patches.kernel.org/6.2.9-003-interconnect-qcom-qcm2290-Fix-MASTER_SNOC_BIMC_.patch + patches.kernel.org/6.2.9-004-perf-core-Fix-perf_output_begin-parameter-is-in.patch + patches.kernel.org/6.2.9-005-perf-fix-perf_event_context-time.patch + patches.kernel.org/6.2.9-006-tracing-hwlat-Replace-sched_setaffinity-with-se.patch + patches.kernel.org/6.2.9-007-drm-amd-display-fix-k1-k2-divider-programming-f.patch + patches.kernel.org/6.2.9-008-drm-amd-display-Remove-OTG-DIV-register-write-f.patch + patches.kernel.org/6.2.9-009-drm-amd-display-Fix-DP-MST-sinks-removal-issue.patch + patches.kernel.org/6.2.9-010-arm64-dts-freescale-imx8-ss-lsio-Fix-flexspi-cl.patch + patches.kernel.org/6.2.9-011-arm64-dts-qcom-sc8280xp-Add-label-property-to-v.patch + patches.kernel.org/6.2.9-012-arm64-dts-qcom-sm6375-Add-missing-power-domain-.patch + patches.kernel.org/6.2.9-013-arm64-dts-qcom-sm8450-correct-WSA2-assigned-clo.patch + patches.kernel.org/6.2.9-014-arm64-dts-qcom-sm8450-Mark-UFS-controller-as-ca.patch + patches.kernel.org/6.2.9-015-power-supply-bq24190-Fix-use-after-free-bug-in-.patch + patches.kernel.org/6.2.9-016-power-supply-da9150-Fix-use-after-free-bug-in-d.patch + patches.kernel.org/6.2.9-017-wifi-mt76-do-not-run-mt76_unregister_device-on-.patch + patches.kernel.org/6.2.9-018-wifi-mt76-connac-do-not-check-WED-status-for-no.patch + patches.kernel.org/6.2.9-019-efi-earlycon-Reprobe-after-parsing-config-table.patch + patches.kernel.org/6.2.9-020-arm64-dts-imx8dxl-evk-Disable-hibernation-mode-.patch + patches.kernel.org/6.2.9-021-arm64-dts-imx8dxl-evk-Fix-eqos-phy-reset-gpio.patch + patches.kernel.org/6.2.9-022-ARM-dts-imx6sll-e70k02-fix-usbotg1-pinctrl.patch + patches.kernel.org/6.2.9-023-ARM-dts-imx6sll-e60k02-fix-usbotg1-pinctrl.patch + patches.kernel.org/6.2.9-024-ARM-dts-imx6sl-tolino-shine2hd-fix-usbotg1-pinc.patch + patches.kernel.org/6.2.9-025-arm64-dts-imx8mn-specify-sound-dai-cells-for-SA.patch + patches.kernel.org/6.2.9-026-arm64-dts-imx93-add-missing-address-cells-and-s.patch + patches.kernel.org/6.2.9-027-NFS-Fix-proc-PID-io-read_bytes-for-buffered-rea.patch + patches.kernel.org/6.2.9-028-NFS-Correct-timing-for-assigning-access-cache-t.patch + patches.kernel.org/6.2.9-029-xsk-Add-missing-overflow-check-in-xdp_umem_reg.patch + patches.kernel.org/6.2.9-030-iavf-fix-inverted-Rx-hash-condition-leading-to-.patch + patches.kernel.org/6.2.9-031-iavf-fix-non-tunneled-IPv6-UDP-packet-type-and-.patch + patches.kernel.org/6.2.9-032-iavf-do-not-track-VLAN-0-filters.patch + patches.kernel.org/6.2.9-033-intel-igbvf-free-irq-on-the-error-path-in-igbvf.patch + patches.kernel.org/6.2.9-034-igbvf-Regard-vf-reset-nack-as-success.patch + patches.kernel.org/6.2.9-035-igc-fix-the-validation-logic-for-taprio-s-gate-.patch + patches.kernel.org/6.2.9-036-i2c-imx-lpi2c-check-only-for-enabled-interrupt-.patch + patches.kernel.org/6.2.9-037-i2c-mxs-ensure-that-DMA-buffers-are-safe-for-DM.patch + patches.kernel.org/6.2.9-038-i2c-hisi-Only-use-the-completion-interrupt-to-f.patch + patches.kernel.org/6.2.9-039-scsi-scsi_dh_alua-Fix-memleak-for-qdata-in-alua.patch + patches.kernel.org/6.2.9-040-nfsd-don-t-replace-page-in-rq_pages-if-it-s-a-c.patch + patches.kernel.org/6.2.9-041-net-dsa-b53-mmap-fix-device-tree-support.patch + patches.kernel.org/6.2.9-042-net-usb-smsc95xx-Limit-packet-length-to-skb-len.patch + patches.kernel.org/6.2.9-043-efi-libstub-smbios-Use-length-member-instead-of.patch + patches.kernel.org/6.2.9-044-arm64-efi-Use-SMBIOS-processor-version-to-key-o.patch + patches.kernel.org/6.2.9-045-qed-qed_sriov-guard-against-NULL-derefs-from-qe.patch + patches.kernel.org/6.2.9-046-xirc2ps_cs-Fix-use-after-free-bug-in-xirc2ps_de.patch + patches.kernel.org/6.2.9-047-net-phy-Ensure-state-transitions-are-processed-.patch + patches.kernel.org/6.2.9-048-net-mdio-fix-owner-field-for-mdio-buses-registe.patch + patches.kernel.org/6.2.9-049-net-mdio-fix-owner-field-for-mdio-buses-registe.patch + patches.kernel.org/6.2.9-050-net-stmmac-Fix-for-mismatched-host-device-DMA-a.patch + patches.kernel.org/6.2.9-051-thermal-drivers-mellanox-Use-generic-thermal_zo.patch + patches.kernel.org/6.2.9-052-mlxsw-core_thermal-Fix-fan-speed-in-maximum-coo.patch + patches.kernel.org/6.2.9-053-drm-i915-fbdev-lock-the-fbdev-obj-before-vma-pi.patch + patches.kernel.org/6.2.9-054-drm-i915-mtl-Disable-MC6-for-MTL-A-step.patch + patches.kernel.org/6.2.9-055-drm-i915-guc-Rename-GuC-register-state-capture-.patch + patches.kernel.org/6.2.9-056-drm-i915-guc-Fix-missing-ecodes.patch + patches.kernel.org/6.2.9-057-drm-i915-gt-perform-uc-late-init-after-probe-er.patch + patches.kernel.org/6.2.9-058-drm-i915-Fix-format-for-perf_limit_reasons.patch + patches.kernel.org/6.2.9-059-drm-i915-Update-vblank-timestamping-stuff-on-se.patch + patches.kernel.org/6.2.9-060-net-dsa-report-rx_bytes-unadjusted-for-ETH_HLEN.patch + patches.kernel.org/6.2.9-061-net-qcom-emac-Fix-use-after-free-bug-in-emac_re.patch + patches.kernel.org/6.2.9-062-net-usb-lan78xx-Limit-packet-length-to-skb-len.patch + patches.kernel.org/6.2.9-063-net-ps3_gelic_net-Fix-RX-sk_buff-length.patch + patches.kernel.org/6.2.9-064-net-ps3_gelic_net-Use-dma_mapping_error.patch + patches.kernel.org/6.2.9-065-octeontx2-vf-Add-missing-free-for-alloc_percpu.patch + patches.kernel.org/6.2.9-066-bootconfig-Fix-testcase-to-increase-max-node.patch + patches.kernel.org/6.2.9-067-keys-Do-not-cache-key-in-task-struct-if-key-is-.patch + patches.kernel.org/6.2.9-068-ice-check-if-VF-exists-before-mode-check.patch + patches.kernel.org/6.2.9-069-iavf-fix-hang-on-reboot-with-ice.patch + patches.kernel.org/6.2.9-070-i40e-fix-flow-director-packet-filter-programmin.patch + patches.kernel.org/6.2.9-071-bpf-Adjust-insufficient-default-bpf_jit_limit.patch + patches.kernel.org/6.2.9-072-net-mlx5e-Set-uplink-rep-as-NETNS_LOCAL.patch + patches.kernel.org/6.2.9-073-net-mlx5e-Block-entering-switchdev-mode-with-ns.patch + patches.kernel.org/6.2.9-074-net-mlx5-Fix-steering-rules-cleanup.patch + patches.kernel.org/6.2.9-075-net-mlx5e-Overcome-slow-response-for-first-macs.patch + patches.kernel.org/6.2.9-076-net-mlx5-Read-the-TC-mapping-of-all-priorities-.patch + patches.kernel.org/6.2.9-077-net-mlx5-E-Switch-Fix-an-Oops-in-error-handling.patch + patches.kernel.org/6.2.9-078-net-dsa-tag_brcm-legacy-fix-daisy-chained-switc.patch + patches.kernel.org/6.2.9-079-atm-idt77252-fix-kmemleak-when-rmmod-idt77252.patch + patches.kernel.org/6.2.9-080-erspan-do-not-use-skb_mac_header-in-ndo_start_x.patch + patches.kernel.org/6.2.9-081-net-mscc-ocelot-fix-stats-region-batching.patch + patches.kernel.org/6.2.9-082-net-sonic-use-dma_mapping_error-for-error-check.patch + patches.kernel.org/6.2.9-083-nvme-tcp-fix-nvme_tcp_term_pdu-to-match-spec.patch + patches.kernel.org/6.2.9-084-mlxsw-spectrum_fid-Fix-incorrect-local-port-typ.patch + patches.kernel.org/6.2.9-085-hvc-xen-prevent-concurrent-accesses-to-the-shar.patch + patches.kernel.org/6.2.9-086-ksmbd-add-low-bound-validation-to-FSCTL_SET_ZER.patch + patches.kernel.org/6.2.9-087-ksmbd-add-low-bound-validation-to-FSCTL_QUERY_A.patch + patches.kernel.org/6.2.9-088-ksmbd-fix-possible-refcount-leak-in-smb2_open.patch + patches.kernel.org/6.2.9-089-Bluetooth-hci_sync-Resume-adv-with-no-RPA-when-.patch + patches.kernel.org/6.2.9-090-Bluetooth-hci_core-Detect-if-an-ACL-packet-is-i.patch + patches.kernel.org/6.2.9-091-Bluetooth-btusb-Remove-detection-of-ISO-packets.patch + patches.kernel.org/6.2.9-092-Bluetooth-ISO-fix-timestamped-HCI-ISO-data-pack.patch + patches.kernel.org/6.2.9-093-Bluetooth-Remove-Power-on-check-from-Mesh-featu.patch + patches.kernel.org/6.2.9-094-gve-Cache-link_speed-value-from-device.patch + patches.kernel.org/6.2.9-095-net-asix-fix-modprobe-sysfs-cannot-create-dupli.patch + patches.kernel.org/6.2.9-096-net-dsa-mt7530-move-enabling-disabling-core-clo.patch + patches.kernel.org/6.2.9-097-net-dsa-mt7530-move-lowering-TRGMII-driving-to-.patch + patches.kernel.org/6.2.9-098-net-dsa-mt7530-move-setting-ssc_delta-to-PHY_IN.patch + patches.kernel.org/6.2.9-099-net-mdio-thunder-Add-missing-fwnode_handle_put.patch + patches.kernel.org/6.2.9-100-efi-libstub-Use-relocated-version-of-kernel-s-s.patch + patches.kernel.org/6.2.9-101-drm-amd-display-Set-dcn32-caps.seamless_odm.patch + patches.kernel.org/6.2.9-102-Bluetooth-btqcomsmd-Fix-command-timeout-after-s.patch + patches.kernel.org/6.2.9-103-Bluetooth-L2CAP-Fix-responding-with-wrong-PDU-t.patch + patches.kernel.org/6.2.9-104-Bluetooth-btsdio-fix-use-after-free-bug-in-btsd.patch + patches.kernel.org/6.2.9-105-Bluetooth-mgmt-Fix-MGMT-add-advmon-with-RSSI-co.patch + patches.kernel.org/6.2.9-106-Bluetooth-HCI-Fix-global-out-of-bounds.patch + patches.kernel.org/6.2.9-107-platform-chrome-cros_ec_chardev-fix-kernel-data.patch + patches.kernel.org/6.2.9-108-entry-Fix-noinstr-warning-in-__enter_from_user_.patch + patches.kernel.org/6.2.9-109-perf-x86-amd-core-Always-clear-status-for-idx.patch + patches.kernel.org/6.2.9-110-entry-rcu-Check-TIF_RESCHED-_after_-delayed-RCU.patch + patches.kernel.org/6.2.9-111-hwmon-fix-potential-sensor-registration-fail-if.patch + patches.kernel.org/6.2.9-112-hwmon-it87-Fix-voltage-scaling-for-chips-with-1.patch + patches.kernel.org/6.2.9-113-scsi-qla2xxx-Synchronize-the-IOCB-count-to-be-i.patch + patches.kernel.org/6.2.9-114-scsi-qla2xxx-Perform-lockless-command-completio.patch + patches.kernel.org/6.2.9-115-smb3-lower-default-deferred-close-timeout-to-ad.patch + patches.kernel.org/6.2.9-116-smb3-fix-unusable-share-after-force-unmount-fai.patch + patches.kernel.org/6.2.9-117-uas-Add-US_FL_NO_REPORT_OPCODES-for-JMicron-JMS.patch + patches.kernel.org/6.2.9-118-thunderbolt-Use-scale-field-when-allocating-USB.patch + patches.kernel.org/6.2.9-119-thunderbolt-Call-tb_check_quirks-after-initiali.patch + patches.kernel.org/6.2.9-120-thunderbolt-Add-quirk-to-disable-CLx.patch + patches.kernel.org/6.2.9-121-thunderbolt-Fix-memory-leak-in-margining.patch + patches.kernel.org/6.2.9-122-thunderbolt-Disable-interrupt-auto-clear-for-ri.patch + patches.kernel.org/6.2.9-123-thunderbolt-Add-missing-UNSET_INBOUND_SBTX-for-.patch + patches.kernel.org/6.2.9-124-thunderbolt-Use-const-qualifier-for-ring_interr.patch + patches.kernel.org/6.2.9-125-thunderbolt-Rename-shadowed-variables-bit-to-in.patch + patches.kernel.org/6.2.9-126-ASoC-amd-yp-Add-OMEN-by-HP-Gaming-Laptop-16z-n0.patch + patches.kernel.org/6.2.9-127-ASoC-Intel-sof_rt5682-Add-quirk-for-Rex-board-w.patch + patches.kernel.org/6.2.9-128-ASoC-amd-yc-Add-DMI-entries-to-support-HP-OMEN-.patch + patches.kernel.org/6.2.9-129-ACPI-x86-Drop-quirk-for-HP-Elitebook.patch + patches.kernel.org/6.2.9-130-ACPI-x86-utils-Add-Cezanne-to-the-list-for-forc.patch + patches.kernel.org/6.2.9-131-riscv-Bump-COMMAND_LINE_SIZE-value-to-1024.patch + patches.kernel.org/6.2.9-132-drm-cirrus-NULL-check-pipe-plane.state-fb-in-ci.patch + patches.kernel.org/6.2.9-133-HID-cp2112-Fix-driver-not-registering-GPIO-IRQ-.patch + patches.kernel.org/6.2.9-134-ca8210-fix-mac_len-negative-array-access.patch + patches.kernel.org/6.2.9-135-HID-logitech-hidpp-Add-support-for-Logitech-MX-.patch + patches.kernel.org/6.2.9-136-HID-intel-ish-hid-ipc-Fix-potential-use-after-f.patch + patches.kernel.org/6.2.9-137-m68k-mm-Fix-systems-with-memory-at-end-of-32-bi.patch + patches.kernel.org/6.2.9-138-m68k-Only-force-030-bus-error-if-PC-not-in-exce.patch + patches.kernel.org/6.2.9-139-selftests-bpf-check-that-modifier-resolves-afte.patch + patches.kernel.org/6.2.9-140-cpumask-fix-incorrect-cpumask-scanning-result-c.patch + patches.kernel.org/6.2.9-141-scsi-target-iscsi-Fix-an-error-message-in-iscsi.patch + patches.kernel.org/6.2.9-142-scsi-qla2xxx-Add-option-to-disable-FC2-Target-s.patch + patches.kernel.org/6.2.9-143-scsi-hisi_sas-Check-devm_add_action-return-valu.patch + patches.kernel.org/6.2.9-144-scsi-ufs-core-Add-soft-dependency-on-governor_s.patch + patches.kernel.org/6.2.9-145-scsi-lpfc-Check-kzalloc-in-lpfc_sli4_cgn_params.patch + patches.kernel.org/6.2.9-146-scsi-lpfc-Avoid-usage-of-list-iterator-variable.patch + patches.kernel.org/6.2.9-147-scsi-mpi3mr-Driver-unload-crashes-host-when-enh.patch + patches.kernel.org/6.2.9-148-scsi-mpi3mr-Wait-for-diagnostic-save-during-con.patch + patches.kernel.org/6.2.9-149-scsi-mpi3mr-NVMe-command-size-greater-than-8K-f.patch + patches.kernel.org/6.2.9-150-scsi-mpi3mr-Bad-drive-in-topology-results-kerne.patch + patches.kernel.org/6.2.9-151-scsi-storvsc-Handle-BlockSize-change-in-Hyper-V.patch + patches.kernel.org/6.2.9-152-platform-x86-int3472-Add-GPIOs-to-Surface-Go-3-.patch + patches.kernel.org/6.2.9-153-net-usb-cdc_mbim-avoid-altsetting-toggling-for-.patch + patches.kernel.org/6.2.9-154-net-usb-qmi_wwan-add-Telit-0x1080-composition.patch + patches.kernel.org/6.2.9-155-drm-amd-display-Update-clock-table-to-include-h.patch + patches.kernel.org/6.2.9-156-sh-sanitize-the-flags-on-sigreturn.patch + patches.kernel.org/6.2.9-157-drm-amdgpu-Fix-call-trace-warning-and-hang-when.patch + patches.kernel.org/6.2.9-158-drm-amd-Fix-initialization-mistake-for-NBIO-7.3.patch + patches.kernel.org/6.2.9-159-net-sched-act_mirred-better-wording-on-protecti.patch + patches.kernel.org/6.2.9-160-act_mirred-use-the-backlog-for-nested-calls-to-.patch + patches.kernel.org/6.2.9-161-cifs-lock-chan_lock-outside-match_session.patch + patches.kernel.org/6.2.9-162-cifs-append-path-to-open_enter-trace-event.patch + patches.kernel.org/6.2.9-163-cifs-do-not-poll-server-interfaces-too-regularl.patch + patches.kernel.org/6.2.9-164-cifs-empty-interface-list-when-server-doesn-t-s.patch + patches.kernel.org/6.2.9-165-cifs-dump-pending-mids-for-all-channels-in-Debu.patch + patches.kernel.org/6.2.9-166-cifs-print-session-id-while-listing-open-files.patch + patches.kernel.org/6.2.9-167-cifs-fix-dentry-lookups-in-directory-handle-cac.patch + patches.kernel.org/6.2.9-168-x86-mm-Do-not-shuffle-CPU-entry-areas-without-K.patch + patches.kernel.org/6.2.9-169-x86-fpu-xstate-Prevent-false-positive-warning-i.patch + patches.kernel.org/6.2.9-170-selftests-x86-amx-Add-a-ptrace-test.patch + patches.kernel.org/6.2.9-171-scsi-core-Add-BLIST_SKIP_VPD_PAGES-for-SKhynix-.patch + patches.kernel.org/6.2.9-172-usb-misc-onboard-hub-add-support-for-Microchip-.patch + patches.kernel.org/6.2.9-173-usb-dwc2-fix-a-race-don-t-power-off-on-phy-for-.patch + patches.kernel.org/6.2.9-174-usb-dwc2-drd-fix-inconsistent-mode-if-role-swit.patch + patches.kernel.org/6.2.9-175-usb-dwc2-fix-a-devres-leak-in-hw_enable-upon-su.patch + patches.kernel.org/6.2.9-176-block-io_uring-pass-in-issue_flags-for-uring_cm.patch + patches.kernel.org/6.2.9-177-usb-gadget-u_audio-don-t-let-userspace-block-dr.patch + patches.kernel.org/6.2.9-178-btrfs-zoned-fix-btrfs_can_activate_zone-to-supp.patch + patches.kernel.org/6.2.9-179-Bluetooth-Fix-race-condition-in-hci_cmd_sync_cl.patch + patches.kernel.org/6.2.9-180-efi-sysfb_efi-Fix-DMI-quirks-not-working-for-si.patch + patches.kernel.org/6.2.9-181-mm-slab-Fix-undefined-init_cache_node_node-for-.patch + patches.kernel.org/6.2.9-182-efi-libstub-zboot-Mark-zboot-EFI-application-as.patch + patches.kernel.org/6.2.9-183-arm64-efi-Set-NX-compat-flag-in-PE-COFF-header.patch + patches.kernel.org/6.2.9-184-fscrypt-destroy-keyring-after-security_sb_delet.patch + patches.kernel.org/6.2.9-185-fsverity-Remove-WQ_UNBOUND-from-fsverity-read-w.patch + patches.kernel.org/6.2.9-186-lockd-set-file_lock-start-and-end-when-decoding.patch + patches.kernel.org/6.2.9-187-arm64-dts-imx8mm-nitrogen-r2-fix-WM8960-clock-n.patch + patches.kernel.org/6.2.9-188-igb-revert-rtnl_lock-that-causes-deadlock.patch + patches.kernel.org/6.2.9-189-dm-thin-fix-deadlock-when-swapping-to-thin-devi.patch + patches.kernel.org/6.2.9-190-usb-typec-tcpm-fix-create-duplicate-source-capa.patch + patches.kernel.org/6.2.9-191-usb-typec-tcpm-fix-warning-when-handle-discover.patch + patches.kernel.org/6.2.9-192-usb-cdns3-Fix-issue-with-using-incorrect-PCI-de.patch + patches.kernel.org/6.2.9-193-usb-cdnsp-Fixes-issue-with-redundant-Status-Sta.patch + patches.kernel.org/6.2.9-194-usb-cdnsp-changes-PCI-Device-ID-to-fix-conflict.patch + patches.kernel.org/6.2.9-195-usb-chipdea-core-fix-return-EINVAL-if-request-r.patch + patches.kernel.org/6.2.9-196-usb-chipidea-core-fix-possible-concurrent-when-.patch + patches.kernel.org/6.2.9-197-usb-dwc3-gadget-Add-1ms-delay-after-end-transfe.patch + patches.kernel.org/6.2.9-198-usb-ucsi-Fix-NULL-pointer-deref-in-ucsi_connect.patch + patches.kernel.org/6.2.9-199-usb-ucsi_acpi-Increase-the-command-completion-t.patch + patches.kernel.org/6.2.9-200-mm-kfence-fix-using-kfence_metadata-without-ini.patch + patches.kernel.org/6.2.9-201-kfence-avoid-passing-g-for-test.patch + patches.kernel.org/6.2.9-202-io_uring-net-avoid-sending-ECONNABORTED-on-repe.patch + patches.kernel.org/6.2.9-203-io_uring-rsrc-fix-null-ptr-deref-in-io_file_bit.patch + patches.kernel.org/6.2.9-204-Revert-kasan-drop-skip_kasan_poison-variable-in.patch + patches.kernel.org/6.2.9-205-kcsan-avoid-passing-g-for-test.patch + patches.kernel.org/6.2.9-206-test_maple_tree-add-more-testing-for-mas_empty_.patch + patches.kernel.org/6.2.9-207-maple_tree-fix-mas_skip_node-end-slot-detection.patch + patches.kernel.org/6.2.9-208-ksmbd-fix-wrong-signingkey-creation-when-encryp.patch + patches.kernel.org/6.2.9-209-ksmbd-set-FILE_NAMED_STREAMS-attribute-in-FS_AT.patch + patches.kernel.org/6.2.9-210-ksmbd-don-t-terminate-inactive-sessions-after-a.patch + patches.kernel.org/6.2.9-211-ksmbd-return-STATUS_NOT_SUPPORTED-on-unsupporte.patch + patches.kernel.org/6.2.9-212-ksmbd-return-unsupported-error-on-smb1-mount.patch + patches.kernel.org/6.2.9-213-wifi-mac80211-fix-qos-on-mesh-interfaces.patch + patches.kernel.org/6.2.9-214-wifi-mac80211-Serialize-ieee80211_handle_wake_t.patch + patches.kernel.org/6.2.9-215-nilfs2-fix-kernel-infoleak-in-nilfs_ioctl_wrap_.patch + patches.kernel.org/6.2.9-216-drm-bridge-lt8912b-return-EPROBE_DEFER-if-bridg.patch + patches.kernel.org/6.2.9-217-drm-amd-display-fix-wrong-index-used-in-dccg32_.patch + patches.kernel.org/6.2.9-218-drm-meson-fix-missing-component-unbind-on-bind-.patch + patches.kernel.org/6.2.9-219-drm-amdgpu-nv-Apply-ASPM-quirk-on-Intel-ADL-AMD.patch + patches.kernel.org/6.2.9-220-drm-i915-active-Fix-missing-debug-object-activa.patch + patches.kernel.org/6.2.9-221-drm-i915-Preserve-crtc_state-inherited-during-s.patch + patches.kernel.org/6.2.9-222-drm-amdgpu-skip-ASIC-reset-for-APUs-when-go-to-.patch + patches.kernel.org/6.2.9-223-drm-amdgpu-reposition-the-gpu-reset-checking-fo.patch + patches.kernel.org/6.2.9-224-riscv-mm-Fix-incorrect-ASID-argument-when-flush.patch + patches.kernel.org/6.2.9-225-riscv-Handle-zicsr-zifencei-issues-between-clan.patch + patches.kernel.org/6.2.9-226-tee-amdtee-fix-race-condition-in-amdtee_open_se.patch + patches.kernel.org/6.2.9-227-firmware-arm_scmi-Fix-device-node-validation-fo.patch + patches.kernel.org/6.2.9-228-arm64-dts-qcom-sc8280xp-x13s-mark-s11b-regulato.patch + patches.kernel.org/6.2.9-229-arm64-dts-qcom-sc7280-Mark-PCIe-controller-as-c.patch + patches.kernel.org/6.2.9-230-arm64-dts-qcom-sm8150-Fix-the-iommu-mask-used-f.patch + patches.kernel.org/6.2.9-231-soc-qcom-llcc-Fix-slice-configuration-values-fo.patch + patches.kernel.org/6.2.9-232-mm-ksm-fix-race-with-VMA-iteration-and-mm_struc.patch + patches.kernel.org/6.2.9-233-bus-imx-weim-fix-branch-condition-evaluates-to-.patch + patches.kernel.org/6.2.9-234-i2c-xgene-slimpro-Fix-out-of-bounds-bug-in-xgen.patch + patches.kernel.org/6.2.9-235-dm-stats-check-for-and-propagate-alloc_percpu-f.patch + patches.kernel.org/6.2.9-236-dm-crypt-add-cond_resched-to-dmcrypt_write.patch + patches.kernel.org/6.2.9-237-dm-crypt-avoid-accessing-uninitialized-tasklet.patch + patches.kernel.org/6.2.9-238-sched-fair-sanitize-vruntime-of-entity-being-pl.patch + patches.kernel.org/6.2.9-239-sched-fair-Sanitize-vruntime-of-entity-being-mi.patch + patches.kernel.org/6.2.9-240-Linux-6.2.9.patch + patches.kernel.org/6.2.10-001-thunderbolt-Limit-USB3-bandwidth-of-certain-In.patch + patches.kernel.org/6.2.10-002-cifs-update-ip_addr-for-ses-only-for-primary-c.patch + patches.kernel.org/6.2.10-003-cifs-prevent-data-race-in-cifs_reconnect_tcon.patch + patches.kernel.org/6.2.10-004-cifs-avoid-race-conditions-with-parallel-recon.patch + patches.kernel.org/6.2.10-005-zonefs-Reorganize-code.patch + patches.kernel.org/6.2.10-006-zonefs-Simplify-IO-error-handling.patch + patches.kernel.org/6.2.10-007-zonefs-Reduce-struct-zonefs_inode_info-size.patch + patches.kernel.org/6.2.10-008-zonefs-Separate-zone-information-from-inode-in.patch + patches.kernel.org/6.2.10-009-zonefs-Fix-error-message-in-zonefs_file_dio_ap.patch + patches.kernel.org/6.2.10-010-btrfs-rename-BTRFS_FS_NO_OVERCOMMIT-to-BTRFS_F.patch + patches.kernel.org/6.2.10-011-btrfs-zoned-count-fresh-BG-region-as-zone-unus.patch + patches.kernel.org/6.2.10-012-btrfs-zoned-drop-space_info-active_total_bytes.patch + patches.kernel.org/6.2.10-013-fsverity-don-t-drop-pagecache-at-end-of-FS_IOC.patch + patches.kernel.org/6.2.10-014-cifs-fix-missing-unload_nls-in-smb2_reconnect.patch + patches.kernel.org/6.2.10-015-xfrm-Zero-padding-when-dumping-algos-and-encap.patch + patches.kernel.org/6.2.10-016-ASoC-codecs-tx-macro-Fix-for-KASAN-slab-out-of.patch + patches.kernel.org/6.2.10-017-ASoC-Intel-avs-max98357a-Explicitly-define-cod.patch + patches.kernel.org/6.2.10-018-ASoC-Intel-avs-da7219-Explicitly-define-codec-.patch + patches.kernel.org/6.2.10-019-ASoC-Intel-avs-rt5682-Explicitly-define-codec-.patch + patches.kernel.org/6.2.10-020-ASoC-Intel-avs-ssm4567-Remove-nau8825-bits.patch + patches.kernel.org/6.2.10-021-ASoC-Intel-avs-nau8825-Adjust-clock-control.patch + patches.kernel.org/6.2.10-022-lib-zstd-Backport-fix-for-in-place-decompressi.patch + patches.kernel.org/6.2.10-023-zstd-Fix-definition-of-assert.patch + patches.kernel.org/6.2.10-024-ACPI-video-Add-backlight-native-DMI-quirk-for-.patch + patches.kernel.org/6.2.10-025-ACPI-x86-Introduce-an-acpi_quirk_skip_gpio_eve.patch + patches.kernel.org/6.2.10-026-ACPI-x86-Add-skip-i2c-clients-quirk-for-Acer-I.patch + patches.kernel.org/6.2.10-027-ACPI-x86-Add-skip-i2c-clients-quirk-for-Lenovo.patch + patches.kernel.org/6.2.10-028-ASoC-SOF-ipc3-Check-for-upper-size-limit-for-t.patch + patches.kernel.org/6.2.10-029-ASoC-SOF-ipc4-topology-Fix-incorrect-sample-ra.patch + patches.kernel.org/6.2.10-030-ASoC-SOF-Intel-pci-tng-revert-invalid-bar-size.patch + patches.kernel.org/6.2.10-031-ASoC-SOF-Intel-hda-dsp-harden-D0i3-programming.patch + patches.kernel.org/6.2.10-032-ASoC-SOF-Intel-hda-ctrl-re-add-sleep-after-ent.patch + patches.kernel.org/6.2.10-033-ASoC-SOF-IPC4-update-gain-ipc-msg-definition-t.patch + patches.kernel.org/6.2.10-034-ASoC-hdmi-codec-only-startup-shutdown-on-suppo.patch + patches.kernel.org/6.2.10-035-wifi-mac80211-check-basic-rates-validity.patch + patches.kernel.org/6.2.10-036-md-avoid-signed-overflow-in-slot_store.patch + patches.kernel.org/6.2.10-037-x86-PVH-obtain-VGA-console-info-in-Dom0.patch + patches.kernel.org/6.2.10-038-drm-amdkfd-Fix-BO-offset-for-multi-VMA-page-mi.patch + patches.kernel.org/6.2.10-039-drm-amdkfd-fix-a-potential-double-free-in-pqm_.patch + patches.kernel.org/6.2.10-040-drm-amdgpu-vcn-custom-video-info-caps-for-srio.patch + patches.kernel.org/6.2.10-041-drm-amdkfd-fix-potential-kgd_mem-UAFs.patch + patches.kernel.org/6.2.10-042-drm-amd-display-Fix-HDCP-failing-to-enable-aft.patch + patches.kernel.org/6.2.10-043-net-hsr-Don-t-log-netdev_err-message-on-unknow.patch + patches.kernel.org/6.2.10-044-ALSA-asihpi-check-pao-in-control_message.patch + patches.kernel.org/6.2.10-045-ALSA-hda-ca0132-fixup-buffer-overrun-at-tuning.patch + patches.kernel.org/6.2.10-046-fbdev-tgafb-Fix-potential-divide-by-zero.patch + patches.kernel.org/6.2.10-047-ACPI-tools-pfrut-Check-if-the-input-of-level-a.patch + patches.kernel.org/6.2.10-048-sched_getaffinity-don-t-assume-cpumask_size-is.patch + patches.kernel.org/6.2.10-049-nvme-pci-fixing-memory-leak-in-probe-teardown-.patch + patches.kernel.org/6.2.10-050-nvme-pci-add-NVME_QUIRK_BOGUS_NID-for-Lexar-NM.patch + patches.kernel.org/6.2.10-051-drm-amdkfd-Fixed-kfd_process-cleanup-on-module.patch + patches.kernel.org/6.2.10-052-net-mlx5e-Lower-maximum-allowed-MTU-in-XSK-to-.patch + patches.kernel.org/6.2.10-053-fbdev-nvidia-Fix-potential-divide-by-zero.patch + patches.kernel.org/6.2.10-054-fbdev-intelfb-Fix-potential-divide-by-zero.patch + patches.kernel.org/6.2.10-055-fbdev-lxfb-Fix-potential-divide-by-zero.patch + patches.kernel.org/6.2.10-056-fbdev-au1200fb-Fix-potential-divide-by-zero.patch + patches.kernel.org/6.2.10-057-tools-power-turbostat-Fix-dev-cpu_dma_latency-.patch + patches.kernel.org/6.2.10-058-tools-power-turbostat-fix-decoding-of-HWP_STAT.patch + patches.kernel.org/6.2.10-059-tracing-Fix-wrong-return-in-kprobe_event_gen_t.patch + patches.kernel.org/6.2.10-060-btrfs-fix-uninitialized-variable-warning-in-bt.patch + patches.kernel.org/6.2.10-061-btrfs-use-temporary-variable-for-space_info-in.patch + patches.kernel.org/6.2.10-062-mtd-rawnand-meson-initialize-struct-with-zeroe.patch + patches.kernel.org/6.2.10-063-mtd-nand-mxic-ecc-Fix-mxic_ecc_data_xfer_wait_.patch + patches.kernel.org/6.2.10-064-ca8210-Fix-unsigned-mac_len-comparison-with-ze.patch + patches.kernel.org/6.2.10-065-riscv-kvm-Fix-VM-hang-in-case-of-timer-delta-b.patch + patches.kernel.org/6.2.10-066-mips-bmips-BCM6358-disable-RAC-flush-for-TP1.patch + patches.kernel.org/6.2.10-067-ALSA-usb-audio-Fix-recursive-locking-at-XRUN-d.patch + patches.kernel.org/6.2.10-068-PCI-dwc-Fix-PORT_LINK_CONTROL-update-when-CDM-.patch + patches.kernel.org/6.2.10-069-platform-x86-think-lmi-add-missing-type-attrib.patch + patches.kernel.org/6.2.10-070-platform-x86-think-lmi-use-correct-possible_va.patch + patches.kernel.org/6.2.10-071-platform-x86-think-lmi-only-display-possible_v.patch + patches.kernel.org/6.2.10-072-platform-x86-think-lmi-Add-possible_values-for.patch + patches.kernel.org/6.2.10-073-platform-surface-aggregator-Add-missing-fwnode.patch + patches.kernel.org/6.2.10-074-mtd-rawnand-meson-invalidate-cache-on-polling-.patch + patches.kernel.org/6.2.10-075-SUNRPC-fix-shutdown-of-NFS-TCP-client-socket.patch + patches.kernel.org/6.2.10-076-sfc-ef10-don-t-overwrite-offload-features-at-N.patch + patches.kernel.org/6.2.10-077-scsi-megaraid_sas-Fix-crash-after-a-double-com.patch + patches.kernel.org/6.2.10-078-scsi-mpt3sas-Don-t-print-sense-pool-info-twice.patch + patches.kernel.org/6.2.10-079-net-dsa-realtek-fix-out-of-bounds-access.patch + patches.kernel.org/6.2.10-080-ptp_qoriq-fix-memory-leak-in-probe.patch + patches.kernel.org/6.2.10-081-net-dsa-microchip-ksz8-fix-ksz8_fdb_dump.patch + patches.kernel.org/6.2.10-082-net-dsa-microchip-ksz8-fix-ksz8_fdb_dump-to-ex.patch + patches.kernel.org/6.2.10-083-net-dsa-microchip-ksz8-fix-offset-for-the-time.patch + patches.kernel.org/6.2.10-084-net-dsa-microchip-ksz8-ksz8_fdb_dump-avoid-ext.patch + patches.kernel.org/6.2.10-085-net-dsa-microchip-ksz8863_smi-fix-bulk-access.patch + patches.kernel.org/6.2.10-086-net-dsa-microchip-ksz8-fix-MDB-configuration-w.patch + patches.kernel.org/6.2.10-087-r8169-fix-RTL8168H-and-RTL8107E-rx-crc-error.patch + patches.kernel.org/6.2.10-088-regulator-Handle-deferred-clk.patch + patches.kernel.org/6.2.10-089-net-net_failover-fix-txq-exceeding-warning.patch + patches.kernel.org/6.2.10-090-net-stmmac-don-t-reject-VLANs-when-IFF_PROMISC.patch + patches.kernel.org/6.2.10-091-drm-i915-pmu-Use-functions-common-with-sysfs-t.patch + patches.kernel.org/6.2.10-092-drm-i915-tc-Fix-the-ICL-PHY-ownership-check-in.patch + patches.kernel.org/6.2.10-093-drm-i915-perf-Drop-wakeref-on-GuC-RC-error.patch + patches.kernel.org/6.2.10-094-platform-x86-intel-pmc-Alder-Lake-PCH-slp_s0_r.patch + patches.kernel.org/6.2.10-095-can-bcm-bcm_tx_setup-fix-KMSAN-uninit-value-in.patch + patches.kernel.org/6.2.10-096-s390-vfio-ap-fix-memory-leak-in-vfio_ap-device.patch + patches.kernel.org/6.2.10-097-ACPI-bus-Rework-system-level-device-notificati.patch + patches.kernel.org/6.2.10-098-loop-LOOP_CONFIGURE-send-uevents-for-partition.patch + patches.kernel.org/6.2.10-099-net-mvpp2-classifier-flow-fix-fragmentation-fl.patch + patches.kernel.org/6.2.10-100-net-mvpp2-parser-fix-QinQ.patch + patches.kernel.org/6.2.10-101-net-mvpp2-parser-fix-PPPoE.patch + patches.kernel.org/6.2.10-102-smsc911x-avoid-PHY-being-resumed-when-interfac.patch + patches.kernel.org/6.2.10-103-ice-Fix-ice_cfg_rdma_fltr-to-only-update-relev.patch + patches.kernel.org/6.2.10-104-ice-add-profile-conflict-check-for-AVF-FDIR.patch + patches.kernel.org/6.2.10-105-ice-fix-invalid-check-for-empty-list-in-ice_sc.patch + patches.kernel.org/6.2.10-106-net-ethernet-mtk_eth_soc-fix-tx-throughput-reg.patch + patches.kernel.org/6.2.10-107-ALSA-ymfpci-Create-card-with-device-managed-sn.patch + patches.kernel.org/6.2.10-108-ALSA-ymfpci-Fix-BUG_ON-in-probe-function.patch + patches.kernel.org/6.2.10-109-net-wwan-iosm-fixes-7560-modem-crash.patch + patches.kernel.org/6.2.10-110-drm-nouveau-kms-Fix-backlight-registration.patch + patches.kernel.org/6.2.10-111-net-ipa-compute-DMA-pool-size-properly.patch + patches.kernel.org/6.2.10-112-bnx2x-use-the-right-build_skb-helper.patch + patches.kernel.org/6.2.10-113-i40e-fix-registers-dump-after-run-ethtool-adap.patch + patches.kernel.org/6.2.10-114-bnxt_en-Fix-reporting-of-test-result-in-ethtoo.patch + patches.kernel.org/6.2.10-115-bnxt_en-Fix-typo-in-PCI-id-to-device-descripti.patch + patches.kernel.org/6.2.10-116-bnxt_en-Add-missing-200G-link-speed-reporting.patch + patches.kernel.org/6.2.10-117-net-dsa-mv88e6xxx-Enable-IGMP-snooping-on-user.patch + patches.kernel.org/6.2.10-118-net-dsa-sync-unicast-and-multicast-addresses-f.patch + patches.kernel.org/6.2.10-119-net-ethernet-mtk_eth_soc-fix-flow-block-refcou.patch + patches.kernel.org/6.2.10-120-net-ethernet-mtk_eth_soc-fix-L2-offloading-wit.patch + patches.kernel.org/6.2.10-121-net-ethernet-mtk_eth_soc-add-missing-ppe-cache.patch + patches.kernel.org/6.2.10-122-pinctrl-ocelot-Fix-alt-mode-for-ocelot.patch + patches.kernel.org/6.2.10-123-Input-xpad-fix-incorrectly-applied-patch-for-M.patch + patches.kernel.org/6.2.10-124-iommu-vt-d-Allow-zero-SAGAW-if-second-stage-no.patch + patches.kernel.org/6.2.10-125-Revert-venus-firmware-Correct-non-pix-start-an.patch + patches.kernel.org/6.2.10-126-Input-i8042-add-TUXEDO-devices-to-i8042-quirk-.patch + patches.kernel.org/6.2.10-127-Input-alps-fix-compatibility-with-funsigned-ch.patch + patches.kernel.org/6.2.10-128-Input-focaltech-use-explicitly-signed-char-typ.patch + patches.kernel.org/6.2.10-129-cifs-prevent-infinite-recursion-in-CIFSGetDFSR.patch + patches.kernel.org/6.2.10-130-cifs-fix-DFS-traversal-oops-without-CONFIG_CIF.patch + patches.kernel.org/6.2.10-131-Input-i8042-add-quirk-for-Fujitsu-Lifebook-A57.patch + patches.kernel.org/6.2.10-132-Input-goodix-add-Lenovo-Yoga-Book-X90F-to-nine.patch + patches.kernel.org/6.2.10-133-btrfs-fix-deadlock-when-aborting-transaction-d.patch + patches.kernel.org/6.2.10-134-btrfs-fix-race-between-quota-disable-and-quota.patch + patches.kernel.org/6.2.10-135-btrfs-scan-device-in-non-exclusive-mode.patch + patches.kernel.org/6.2.10-136-btrfs-ignore-fiemap-path-cache-when-there-are-.patch + patches.kernel.org/6.2.10-137-zonefs-Do-not-propagate-iomap_dio_rw-ENOTBLK-e.patch + patches.kernel.org/6.2.10-138-io_uring-poll-clear-single-double-poll-flags-o.patch + patches.kernel.org/6.2.10-139-io_uring-rsrc-fix-rogue-rsrc-node-grabbing.patch + patches.kernel.org/6.2.10-140-io_uring-fix-poll-netmsg-alloc-caches.patch + patches.kernel.org/6.2.10-141-vmxnet3-use-gro-callback-when-UPT-is-enabled.patch + patches.kernel.org/6.2.10-142-zonefs-Always-invalidate-last-cached-page-on-a.patch + patches.kernel.org/6.2.10-143-dm-fix-__send_duplicate_bios-to-always-allow-f.patch + patches.kernel.org/6.2.10-144-can-j1939-prevent-deadlock-by-moving-j1939_sk_.patch + patches.kernel.org/6.2.10-145-xen-netback-don-t-do-grant-copy-across-page-bo.patch + patches.kernel.org/6.2.10-146-net-phy-dp83869-fix-default-value-for-tx-rx-in.patch + patches.kernel.org/6.2.10-147-modpost-Fix-processing-of-CRCs-on-32-bit-build.patch + patches.kernel.org/6.2.10-148-pinctrl-amd-Disable-and-mask-interrupts-on-res.patch + patches.kernel.org/6.2.10-149-pinctrl-at91-pio4-fix-domain-name-assignment.patch + patches.kernel.org/6.2.10-150-platform-x86-ideapad-laptop-Stop-sending-KEY_T.patch + patches.kernel.org/6.2.10-151-thermal-intel-int340x-processor_thermal-Fix-ad.patch + patches.kernel.org/6.2.10-152-powerpc-Don-t-try-to-copy-PPR-for-task-with-NU.patch + patches.kernel.org/6.2.10-153-powerpc-pseries-vas-Ignore-VAS-update-for-DLPA.patch + patches.kernel.org/6.2.10-154-powerpc-64s-Fix-__pte_needs_flush-false-positi.patch + patches.kernel.org/6.2.10-155-NFSv4-Fix-hangs-when-recovering-open-state-aft.patch + patches.kernel.org/6.2.10-156-ALSA-hda-conexant-Partial-revert-of-a-quirk-fo.patch + patches.kernel.org/6.2.10-157-ALSA-usb-audio-Fix-regression-on-detection-of-.patch + patches.kernel.org/6.2.10-158-ALSA-hda-realtek-Add-quirks-for-some-Clevo-lap.patch + patches.kernel.org/6.2.10-159-ALSA-hda-realtek-Add-quirk-for-Lenovo-ZhaoYang.patch + patches.kernel.org/6.2.10-160-xtensa-fix-KASAN-report-for-show_stack.patch + patches.kernel.org/6.2.10-161-rcu-Fix-rcu_torture_read-ftrace-event.patch + patches.kernel.org/6.2.10-162-dt-bindings-mtd-jedec-spi-nor-Document-CPOL-CP.patch + patches.kernel.org/6.2.10-163-s390-uaccess-add-missing-earlyclobber-annotati.patch + patches.kernel.org/6.2.10-164-s390-reintroduce-expoline-dependence-to-script.patch + patches.kernel.org/6.2.10-165-drm-etnaviv-fix-reference-leak-when-mmaping-im.patch + patches.kernel.org/6.2.10-166-drm-amdgpu-allow-more-APUs-to-do-mode2-reset-w.patch + patches.kernel.org/6.2.10-167-drm-amd-display-Add-DSC-Support-for-Synaptics-.patch + patches.kernel.org/6.2.10-168-drm-amd-display-Take-FEC-Overhead-into-Timeslo.patch + patches.kernel.org/6.2.10-169-drm-i915-gem-Flush-lmem-contents-after-constru.patch + patches.kernel.org/6.2.10-170-drm-i915-dpt-Treat-the-DPT-BO-as-a-framebuffer.patch + patches.kernel.org/6.2.10-171-drm-i915-Disable-DC-states-for-all-commits.patch + patches.kernel.org/6.2.10-172-drm-i915-Split-icl_color_commit_noarm-from-skl.patch + patches.kernel.org/6.2.10-173-drm-i915-Move-CSC-load-back-into-.color_commit.patch + patches.kernel.org/6.2.10-174-KVM-arm64-PMU-Fix-GET_ONE_REG-for-vPMC-regs-to.patch + patches.kernel.org/6.2.10-175-KVM-arm64-PMU-Don-t-save-PMCR_EL0.-C-P-for-the.patch + patches.kernel.org/6.2.10-176-KVM-arm64-Retry-fault-if-vma_lookup-results-be.patch + patches.kernel.org/6.2.10-177-KVM-arm64-Disable-interrupts-while-walking-use.patch + patches.kernel.org/6.2.10-178-KVM-arm64-Check-for-kvm_vma_mte_allowed-in-the.patch + patches.kernel.org/6.2.10-179-usb-ucsi-Fix-ucsi-connector-race.patch + patches.kernel.org/6.2.10-180-libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch + patches.kernel.org/6.2.10-181-selftests-bpf-Add-few-corner-cases-to-test-pad.patch + patches.kernel.org/6.2.10-182-libbpf-Fix-btf_dump-s-packed-struct-determinat.patch + patches.kernel.org/6.2.10-183-drm-amdkfd-Get-prange-offset-after-svm_range_v.patch + patches.kernel.org/6.2.10-184-hsr-ratelimit-only-when-errors-are-printed.patch + patches.kernel.org/6.2.10-185-x86-PVH-avoid-32-bit-build-warning-when-obtain.patch + patches.kernel.org/6.2.10-186-Revert-cpuidle-intel_idle-Fix-CPUIDLE_FLAG_IRQ.patch + patches.kernel.org/6.2.10-187-Linux-6.2.10.patch + patches.kernel.org/6.2.11-001-dm-cache-Add-some-documentation-to-dm-cache-ba.patch + patches.kernel.org/6.2.11-002-dm-integrity-Remove-bi_sector-that-s-only-used.patch + patches.kernel.org/6.2.11-003-dm-change-unsigned-to-unsigned-int.patch + patches.kernel.org/6.2.11-004-dm-fix-improper-splitting-for-abnormal-bios.patch + patches.kernel.org/6.2.11-005-drm-i915-Move-the-DSB-setup-cleaup-into-the-co.patch + patches.kernel.org/6.2.11-006-drm-i915-Add-a-.color_post_update-hook.patch + patches.kernel.org/6.2.11-007-gpio-GPIO_REGMAP-select-REGMAP-instead-of-depe.patch + patches.kernel.org/6.2.11-008-Drivers-vmbus-Check-for-channel-allocation-bef.patch + patches.kernel.org/6.2.11-009-ASoC-SOF-ipc4-Ensure-DSP-is-in-D0I0-during-sof.patch + patches.kernel.org/6.2.11-010-pwm-hibvt-Explicitly-set-.polarity-in-.get_sta.patch + patches.kernel.org/6.2.11-011-pwm-cros-ec-Explicitly-set-.polarity-in-.get_s.patch + patches.kernel.org/6.2.11-012-pwm-iqs620a-Explicitly-set-.polarity-in-.get_s.patch + patches.kernel.org/6.2.11-013-pwm-sprd-Explicitly-set-.polarity-in-.get_stat.patch + patches.kernel.org/6.2.11-014-pwm-meson-Explicitly-set-.polarity-in-.get_sta.patch + patches.kernel.org/6.2.11-015-ASoC-codecs-lpass-fix-the-order-or-clks-turn-o.patch + patches.kernel.org/6.2.11-016-KVM-s390-pv-fix-external-interruption-loop-not.patch + patches.kernel.org/6.2.11-017-wifi-mac80211-fix-the-size-calculation-of-ieee.patch + patches.kernel.org/6.2.11-018-wifi-mac80211-fix-invalid-drv_sta_pre_rcu_remo.patch + patches.kernel.org/6.2.11-019-net-qrtr-Fix-a-refcount-bug-in-qrtr_recvmsg.patch + patches.kernel.org/6.2.11-020-net-phylink-add-phylink_expects_phy-method.patch + patches.kernel.org/6.2.11-021-net-stmmac-check-if-MAC-needs-to-attach-to-a-P.patch + patches.kernel.org/6.2.11-022-net-stmmac-remove-redundant-fixup-to-support-f.patch + patches.kernel.org/6.2.11-023-l2tp-generate-correct-module-alias-strings.patch + patches.kernel.org/6.2.11-024-wifi-brcmfmac-Fix-SDIO-suspend-resume-regressi.patch + patches.kernel.org/6.2.11-025-NFSD-Avoid-calling-OPDESC-with-ops-opnum-OP_IL.patch + patches.kernel.org/6.2.11-026-nfsd-call-op_release-even-when-op_func-returns.patch + patches.kernel.org/6.2.11-027-icmp-guard-against-too-small-mtu.patch + patches.kernel.org/6.2.11-028-ALSA-hda-hdmi-Preserve-the-previous-PCM-device.patch + patches.kernel.org/6.2.11-029-net-don-t-let-netpoll-invoke-NAPI-if-in-xmit-c.patch + patches.kernel.org/6.2.11-030-net-dsa-mv88e6xxx-Reset-mv88e6393x-force-WD-ev.patch + patches.kernel.org/6.2.11-031-net-ethernet-mtk_eth_soc-fix-remaining-through.patch + patches.kernel.org/6.2.11-032-sctp-check-send-stream-number-after-wait_for_s.patch + patches.kernel.org/6.2.11-033-drm-i915-huc-Cancel-HuC-delayed-load-timer-on-.patch + patches.kernel.org/6.2.11-034-net-qrtr-Do-not-do-DEL_SERVER-broadcast-after-.patch + patches.kernel.org/6.2.11-035-ipv6-Fix-an-uninit-variable-access-bug-in-__ip.patch + patches.kernel.org/6.2.11-036-platform-x86-think-lmi-Fix-memory-leak-when-sh.patch + patches.kernel.org/6.2.11-037-platform-x86-think-lmi-Fix-memory-leaks-when-p.patch + patches.kernel.org/6.2.11-038-platform-x86-think-lmi-Clean-up-display-of-cur.patch + patches.kernel.org/6.2.11-039-gpio-davinci-Do-not-clear-the-bank-intr-enable.patch + patches.kernel.org/6.2.11-040-gpio-davinci-Add-irq-chip-flag-to-skip-set-wak.patch + patches.kernel.org/6.2.11-041-net-ethernet-ti-am65-cpsw-Fix-mdio-cleanup-in-.patch + patches.kernel.org/6.2.11-042-net-stmmac-fix-up-RX-flow-hash-indirection-tab.patch + patches.kernel.org/6.2.11-043-sunrpc-only-free-unix-grouplist-after-RCU-sett.patch + patches.kernel.org/6.2.11-044-NFSD-callback-request-does-not-use-correct-cre.patch + patches.kernel.org/6.2.11-045-ice-fix-wrong-fallback-logic-for-FDIR.patch + patches.kernel.org/6.2.11-046-ice-Reset-FDIR-counter-in-FDIR-init-stage.patch + patches.kernel.org/6.2.11-047-raw-use-net_hash_mix-in-hash-function.patch + patches.kernel.org/6.2.11-048-raw-Fix-NULL-deref-in-raw_get_next.patch + patches.kernel.org/6.2.11-049-ping-Fix-potentail-NULL-deref-for-proc-net-icm.patch + patches.kernel.org/6.2.11-050-ethtool-reset-lanes-when-lanes-is-omitted.patch + patches.kernel.org/6.2.11-051-netlink-annotate-lockless-accesses-to-nlk-max_.patch + patches.kernel.org/6.2.11-052-gve-Secure-enough-bytes-in-the-first-TX-desc-f.patch + patches.kernel.org/6.2.11-053-arm64-compat-Work-around-uninitialized-variabl.patch + patches.kernel.org/6.2.11-054-net-stmmac-check-fwnode-for-phy-device-before-.patch + patches.kernel.org/6.2.11-055-cxl-pci-Fix-CDAT-retrieval-on-big-endian.patch + patches.kernel.org/6.2.11-056-cxl-pci-Handle-truncated-CDAT-header.patch + patches.kernel.org/6.2.11-057-cxl-pci-Handle-truncated-CDAT-entries.patch + patches.kernel.org/6.2.11-058-cxl-pci-Handle-excessive-CDAT-length.patch + patches.kernel.org/6.2.11-059-PCI-DOE-Silence-WARN-splat-with-CONFIG_DEBUG_O.patch + patches.kernel.org/6.2.11-060-PCI-DOE-Fix-memory-leak-with-CONFIG_DEBUG_OBJE.patch + patches.kernel.org/6.2.11-061-Revert-usb-xhci-pci-Set-PROBE_PREFER_ASYNCHRON.patch + patches.kernel.org/6.2.11-062-usb-xhci-tegra-fix-sleep-in-atomic-call.patch + patches.kernel.org/6.2.11-063-xhci-Free-the-command-allocated-for-setting-LP.patch + patches.kernel.org/6.2.11-064-xhci-also-avoid-the-XHCI_ZERO_64B_REGS-quirk-w.patch + patches.kernel.org/6.2.11-065-usb-cdnsp-Fixes-error-uninitialized-symbol-len.patch + patches.kernel.org/6.2.11-066-usb-dwc3-pci-add-support-for-the-Intel-Meteor-.patch + patches.kernel.org/6.2.11-067-USB-serial-cp210x-add-Silicon-Labs-IFS-USB-DAT.patch + patches.kernel.org/6.2.11-068-usb-typec-altmodes-displayport-Fix-configure-i.patch + patches.kernel.org/6.2.11-069-USB-serial-option-add-Telit-FE990-compositions.patch + patches.kernel.org/6.2.11-070-USB-serial-option-add-Quectel-RM500U-CN-modem.patch + patches.kernel.org/6.2.11-071-drivers-iio-adc-ltc2497-fix-LSB-shift.patch + patches.kernel.org/6.2.11-072-iio-adis16480-select-CONFIG_CRC32.patch + patches.kernel.org/6.2.11-073-iio-adc-qcom-spmi-adc5-Fix-the-channel-name.patch + patches.kernel.org/6.2.11-074-iio-adc-ti-ads7950-Set-can_sleep-flag-for-GPIO.patch + patches.kernel.org/6.2.11-075-iio-dac-cio-dac-Fix-max-DAC-write-value-check-.patch + patches.kernel.org/6.2.11-076-iio-adc-max11410-fix-read_poll_timeout-usage.patch + patches.kernel.org/6.2.11-077-iio-accel-kionix-kx022a-Get-the-timestamp-from.patch + patches.kernel.org/6.2.11-078-iio-buffer-correctly-return-bytes-written-in-o.patch + patches.kernel.org/6.2.11-079-iio-buffer-make-sure-O_NONBLOCK-is-respected.patch + patches.kernel.org/6.2.11-080-iio-light-cm32181-Unregister-second-I2C-client.patch + patches.kernel.org/6.2.11-081-iio-light-vcnl4000-Fix-WARN_ON-on-uninitialize.patch + patches.kernel.org/6.2.11-082-tty-serial-sh-sci-Fix-transmit-end-interrupt-h.patch + patches.kernel.org/6.2.11-083-tty-serial-sh-sci-Fix-Rx-on-RZ-G2L-SCI.patch + patches.kernel.org/6.2.11-084-tty-serial-fsl_lpuart-avoid-checking-for-trans.patch + patches.kernel.org/6.2.11-085-tty-serial-fsl_lpuart-fix-crash-in-lpuart_upor.patch + patches.kernel.org/6.2.11-086-nilfs2-fix-potential-UAF-of-struct-nilfs_sc_in.patch + patches.kernel.org/6.2.11-087-nilfs2-fix-sysfs-interface-lifetime.patch + patches.kernel.org/6.2.11-088-fsdax-dedupe-should-compare-the-min-of-two-ite.patch + patches.kernel.org/6.2.11-089-fsdax-unshare-zero-destination-if-srcmap-is-HO.patch + patches.kernel.org/6.2.11-090-fsdax-force-clear-dirty-mark-if-CoW.patch + patches.kernel.org/6.2.11-091-dt-bindings-serial-renesas-scif-Fix-4th-IRQ-fo.patch + patches.kernel.org/6.2.11-092-serial-8250-Prevent-starting-up-DMA-Rx-on-THRI.patch + patches.kernel.org/6.2.11-093-ksmbd-do-not-call-kvmalloc-with-__GFP_NORETRY-.patch + patches.kernel.org/6.2.11-094-ksmbd-fix-slab-out-of-bounds-in-init_smb2_rsp_.patch + patches.kernel.org/6.2.11-095-ALSA-hda-realtek-Add-quirk-for-Clevo-X370SNW.patch + patches.kernel.org/6.2.11-096-ALSA-hda-realtek-fix-mute-micmute-LEDs-for-a-H.patch + patches.kernel.org/6.2.11-097-x86-acpi-boot-Correct-acpi_is_processor_usable.patch + patches.kernel.org/6.2.11-098-x86-ACPI-boot-Use-FADT-version-to-check-suppor.patch + patches.kernel.org/6.2.11-099-KVM-x86-Clear-has_error_code-not-error_code-fo.patch + patches.kernel.org/6.2.11-100-KVM-nVMX-Do-not-report-error-code-when-synthes.patch + patches.kernel.org/6.2.11-101-KVM-SVM-Flush-Hyper-V-TLB-when-required.patch + patches.kernel.org/6.2.11-102-mm-kfence-fix-PG_slab-and-memcg_data-clearing.patch + patches.kernel.org/6.2.11-103-mm-kfence-fix-handling-discontiguous-page.patch + patches.kernel.org/6.2.11-104-coresight-etm4x-Do-not-access-TRCIDR1-for-iden.patch + patches.kernel.org/6.2.11-105-coresight-etm4-Fix-for-loop-drvdata-nr_addr_cm.patch + patches.kernel.org/6.2.11-106-counter-104-quad-8-Fix-race-condition-between-.patch + patches.kernel.org/6.2.11-107-counter-104-quad-8-Fix-Synapse-action-reported.patch + patches.kernel.org/6.2.11-108-blk-mq-directly-poll-requests.patch + patches.kernel.org/6.2.11-109-ftrace-Mark-get_lock_parent_ip-__always_inline.patch + patches.kernel.org/6.2.11-110-ftrace-Fix-issue-that-direct-addr-not-restored.patch + patches.kernel.org/6.2.11-111-fs-drop-peer-group-ids-under-namespace-lock.patch + patches.kernel.org/6.2.11-112-can-j1939-j1939_tp_tx_dat_new-fix-out-of-bound.patch + patches.kernel.org/6.2.11-113-can-isotp-fix-race-between-isotp_sendsmg-and-i.patch + patches.kernel.org/6.2.11-114-can-isotp-isotp_ops-fix-poll-to-not-report-fal.patch + patches.kernel.org/6.2.11-115-can-isotp-isotp_recvmsg-use-sock_recv_cmsgs-to.patch + patches.kernel.org/6.2.11-116-ACPI-video-Add-auto_detect-arg-to-__acpi_video.patch + patches.kernel.org/6.2.11-117-ACPI-video-Make-acpi_backlight-video-work-inde.patch + patches.kernel.org/6.2.11-118-ACPI-video-Add-acpi_backlight-video-quirk-for-.patch + patches.kernel.org/6.2.11-119-ACPI-video-Add-acpi_backlight-video-quirk-for-.patch + patches.kernel.org/6.2.11-120-net-stmmac-Add-queue-reset-into-stmmac_xdp_ope.patch + patches.kernel.org/6.2.11-121-tracing-synthetic-Fix-races-on-freeing-last_cm.patch + patches.kernel.org/6.2.11-122-tracing-timerlat-Notify-new-max-thread-latency.patch + patches.kernel.org/6.2.11-123-tracing-osnoise-Fix-notify-new-tracing_max_lat.patch + patches.kernel.org/6.2.11-124-tracing-Free-error-logs-of-tracing-instances.patch + patches.kernel.org/6.2.11-125-iommufd-Check-for-uptr-overflow.patch + patches.kernel.org/6.2.11-126-iommufd-Fix-unpinning-of-pages-when-an-access-.patch + patches.kernel.org/6.2.11-127-iommufd-Do-not-corrupt-the-pfn-list-when-doing.patch + patches.kernel.org/6.2.11-128-ASoC-hdac_hdmi-use-set_stream-instead-of-set_t.patch + patches.kernel.org/6.2.11-129-ASoC-SOF-avoid-a-NULL-dereference-with-unsuppo.patch + patches.kernel.org/6.2.11-130-iio-adc-ad7791-fix-IRQ-flags.patch + patches.kernel.org/6.2.11-131-io_uring-fix-return-value-when-removing-provid.patch + patches.kernel.org/6.2.11-132-io_uring-fix-memory-leak-when-removing-provide.patch + patches.kernel.org/6.2.11-133-scsi-qla2xxx-Fix-memory-leak-in-qla2x00_probe_.patch + patches.kernel.org/6.2.11-134-scsi-iscsi_tcp-Check-that-sock-is-valid-before.patch + patches.kernel.org/6.2.11-135-nvme-fix-discard-support-without-oncs.patch + patches.kernel.org/6.2.11-136-cifs-sanitize-paths-in-cifs_update_super_prepa.patch + patches.kernel.org/6.2.11-137-block-ublk-make-sure-that-block-size-is-set-co.patch + patches.kernel.org/6.2.11-138-block-don-t-set-GD_NEED_PART_SCAN-if-scan-part.patch + patches.kernel.org/6.2.11-139-perf-Optimize-perf_pmu_migrate_context.patch + patches.kernel.org/6.2.11-140-perf-core-Fix-the-same-task-check-in-perf_even.patch + patches.kernel.org/6.2.11-141-tracing-synthetic-Make-lastcmd_mutex-static.patch + patches.kernel.org/6.2.11-142-zsmalloc-document-freeable-stats.patch + patches.kernel.org/6.2.11-143-mm-vmalloc-avoid-warn_alloc-noise-caused-by-fa.patch + patches.kernel.org/6.2.11-144-wifi-mt76-mt7921-fix-fw-used-for-offload-check.patch + patches.kernel.org/6.2.11-145-wifi-mt76-ignore-key-disable-commands.patch + patches.kernel.org/6.2.11-146-ublk-read-any-SQE-values-upfront.patch + patches.kernel.org/6.2.11-147-drm-panfrost-Fix-the-panfrost_mmu_map_fault_ad.patch + patches.kernel.org/6.2.11-148-drm-nouveau-disp-Support-more-modes-by-checkin.patch + patches.kernel.org/6.2.11-149-drm-i915-Fix-context-runtime-accounting.patch + patches.kernel.org/6.2.11-150-drm-i915-fix-race-condition-UAF-in-i915_perf_a.patch + patches.kernel.org/6.2.11-151-ring-buffer-Fix-race-while-reader-and-writer-a.patch + patches.kernel.org/6.2.11-152-mm-swap-fix-swap_info_struct-race-between-swap.patch + patches.kernel.org/6.2.11-153-mm-hugetlb-fix-uffd-wr-protection-for-CoW-opti.patch + patches.kernel.org/6.2.11-154-maple_tree-fix-get-wrong-data_end-in-mtree_loo.patch + patches.kernel.org/6.2.11-155-maple_tree-fix-a-potential-concurrency-bug-in-.patch + patches.kernel.org/6.2.11-156-drm-amd-display-Clear-MST-topology-if-it-fails.patch + patches.kernel.org/6.2.11-157-drm-amdgpu-for-S0ix-skip-SDMA-5.x-suspend-resu.patch + patches.kernel.org/6.2.11-158-drm-amdgpu-skip-psp-suspend-for-IMU-enabled-AS.patch + patches.kernel.org/6.2.11-159-drm-bridge-lt9611-Fix-PLL-being-unable-to-lock.patch + patches.kernel.org/6.2.11-160-mm-take-a-page-reference-when-removing-device-.patch + patches.kernel.org/6.2.11-161-maple_tree-remove-GFP_ZERO-from-kmem_cache_all.patch + patches.kernel.org/6.2.11-162-maple_tree-fix-potential-rcu-issue.patch + patches.kernel.org/6.2.11-163-maple_tree-reduce-user-error-potential.patch + patches.kernel.org/6.2.11-164-maple_tree-fix-handle-of-invalidated-state-in-.patch + patches.kernel.org/6.2.11-165-maple_tree-fix-mas_prev-and-mas_find-state-han.patch + patches.kernel.org/6.2.11-166-maple_tree-be-more-cautious-about-dead-nodes.patch + patches.kernel.org/6.2.11-167-maple_tree-refine-ma_state-init-from-mas_start.patch + patches.kernel.org/6.2.11-168-maple_tree-detect-dead-nodes-in-mas_start.patch + patches.kernel.org/6.2.11-169-maple_tree-fix-freeing-of-nodes-in-rcu-mode.patch + patches.kernel.org/6.2.11-170-maple_tree-remove-extra-smp_wmb-from-mas_dead_.patch + patches.kernel.org/6.2.11-171-maple_tree-add-smp_rmb-to-dead-node-detection.patch + patches.kernel.org/6.2.11-172-maple_tree-add-RCU-lock-checking-to-rcu-callba.patch + patches.kernel.org/6.2.11-173-mm-enable-maple-tree-RCU-mode-by-default.patch + patches.kernel.org/6.2.11-174-Linux-6.2.11.patch + patches.kernel.org/6.2.12-001-Revert-pinctrl-amd-Disable-and-mask-interrupts.patch + patches.kernel.org/6.2.12-002-drm-amd-display-Pass-the-right-info-to-drm_dp_.patch + patches.kernel.org/6.2.12-003-drm-i915-Workaround-ICL-CSC_MODE-sticky-arming.patch + patches.kernel.org/6.2.12-004-ALSA-emu10k1-fix-capture-interrupt-handler-unl.patch + patches.kernel.org/6.2.12-005-ALSA-hda-sigmatel-add-pin-overrides-for-Intel-.patch + patches.kernel.org/6.2.12-006-ALSA-i2c-cs8427-fix-iec958-mixer-control-deact.patch + patches.kernel.org/6.2.12-007-ALSA-hda-patch_realtek-add-quirk-for-Asus-N760.patch + patches.kernel.org/6.2.12-008-ALSA-hda-realtek-Add-quirks-for-Lenovo-Z13-Z16.patch + patches.kernel.org/6.2.12-009-ALSA-firewire-tascam-add-missing-unwind-goto-i.patch + patches.kernel.org/6.2.12-010-ALSA-emu10k1-don-t-create-old-pass-through-pla.patch + patches.kernel.org/6.2.12-011-ALSA-hda-sigmatel-fix-S-PDIF-out-on-Intel-D-45.patch + patches.kernel.org/6.2.12-012-ALSA-hda-hdmi-disable-KAE-for-Intel-DG2.patch + patches.kernel.org/6.2.12-013-Bluetooth-L2CAP-Fix-use-after-free-in-l2cap_di.patch + patches.kernel.org/6.2.12-014-Bluetooth-Fix-race-condition-in-hidp_session_t.patch + patches.kernel.org/6.2.12-015-bluetooth-btbcm-Fix-logic-error-in-forming-the.patch + patches.kernel.org/6.2.12-016-Bluetooth-Free-potentially-unfreed-SCO-connect.patch + patches.kernel.org/6.2.12-017-Bluetooth-hci_conn-Fix-possible-UAF.patch + patches.kernel.org/6.2.12-018-btrfs-restore-the-thread_pool-behavior-in-remo.patch + patches.kernel.org/6.2.12-019-btrfs-fix-fast-csum-implementation-detection.patch + patches.kernel.org/6.2.12-020-fbmem-Reject-FB_ACTIVATE_KD_TEXT-from-userspac.patch + patches.kernel.org/6.2.12-021-mtdblock-tolerate-corrected-bit-flips.patch + patches.kernel.org/6.2.12-022-mtd-rawnand-meson-fix-bitmask-for-length-in-co.patch + patches.kernel.org/6.2.12-023-mtd-rawnand-stm32_fmc2-remove-unsupported-EDO-.patch + patches.kernel.org/6.2.12-024-mtd-rawnand-stm32_fmc2-use-timings.mode-instea.patch + patches.kernel.org/6.2.12-025-KVM-arm64-PMU-Restore-the-guest-s-EL0-event-co.patch + patches.kernel.org/6.2.12-026-fbcon-Fix-error-paths-in-set_con2fb_map.patch + patches.kernel.org/6.2.12-027-fbcon-set_con2fb_map-needs-to-set-con2fb_map.patch + patches.kernel.org/6.2.12-028-drm-i915-dsi-fix-DSS-CTL-register-offsets-for-.patch + patches.kernel.org/6.2.12-029-io_uring-complete-request-via-task-work-in-cas.patch + patches.kernel.org/6.2.12-030-clk-sprd-set-max_register-according-to-mapping.patch + patches.kernel.org/6.2.12-031-RDMA-irdma-Do-not-generate-SW-completions-for-.patch + patches.kernel.org/6.2.12-032-RDMA-irdma-Fix-memory-leak-of-PBLE-objects.patch + patches.kernel.org/6.2.12-033-RDMA-irdma-Increase-iWARP-CM-default-rexmit-co.patch + patches.kernel.org/6.2.12-034-RDMA-irdma-Add-ipv4-check-to-irdma_find_listen.patch + patches.kernel.org/6.2.12-035-IB-mlx5-Add-support-for-400G_8X-lane-speed.patch + patches.kernel.org/6.2.12-036-RDMA-erdma-Fix-some-typos.patch + patches.kernel.org/6.2.12-037-RDMA-erdma-Update-default-EQ-depth-to-4096-and.patch + patches.kernel.org/6.2.12-038-RDMA-erdma-Inline-mtt-entries-into-WQE-if-supp.patch + patches.kernel.org/6.2.12-039-RDMA-erdma-Defer-probing-if-netdevice-can-not-.patch + patches.kernel.org/6.2.12-040-clk-rs9-Fix-suspend-resume.patch + patches.kernel.org/6.2.12-041-RDMA-cma-Allow-UD-qp_type-to-join-multicast-on.patch + patches.kernel.org/6.2.12-042-bpf-tcp-Use-sock_gen_put-instead-of-sock_put-i.patch + patches.kernel.org/6.2.12-043-LoongArch-bpf-Fix-jit-to-skip-speculation-barr.patch + patches.kernel.org/6.2.12-044-dmaengine-apple-admac-Handle-global-interrupt-.patch + patches.kernel.org/6.2.12-045-dmaengine-apple-admac-Set-src_addr_widths-capa.patch + patches.kernel.org/6.2.12-046-dmaengine-apple-admac-Fix-current_tx-not-getti.patch + patches.kernel.org/6.2.12-047-9p-xen-Fix-use-after-free-bug-in-xen_9pfs_fron.patch + patches.kernel.org/6.2.12-048-bpf-arm64-Fixed-a-BTI-error-on-returning-to-pa.patch + patches.kernel.org/6.2.12-049-KVM-arm64-Advertise-ID_AA64PFR0_EL1.CSV2-3-to-.patch + patches.kernel.org/6.2.12-050-niu-Fix-missing-unwind-goto-in-niu_alloc_chann.patch + patches.kernel.org/6.2.12-051-tcp-restrict-net.ipv4.tcp_app_win.patch + patches.kernel.org/6.2.12-052-bonding-fix-ns-validation-on-backup-slaves.patch + patches.kernel.org/6.2.12-053-iavf-refactor-VLAN-filter-states.patch + patches.kernel.org/6.2.12-054-iavf-remove-active_cvlans-and-active_svlans-bi.patch + patches.kernel.org/6.2.12-055-net-openvswitch-fix-race-on-port-output.patch + patches.kernel.org/6.2.12-056-Bluetooth-hci_conn-Fix-not-cleaning-up-on-LE-C.patch + patches.kernel.org/6.2.12-057-Bluetooth-Fix-printing-errors-if-LE-Connection.patch + patches.kernel.org/6.2.12-058-Bluetooth-SCO-Fix-possible-circular-locking-de.patch + patches.kernel.org/6.2.12-059-Bluetooth-Set-ISO-Data-Path-on-broadcast-sink.patch + patches.kernel.org/6.2.12-060-drm-nouveau-fb-add-missing-sysmen-flush-callba.patch + patches.kernel.org/6.2.12-061-drm-armada-Fix-a-potential-double-free-in-an-e.patch + patches.kernel.org/6.2.12-062-qlcnic-check-pci_reset_function-result.patch + patches.kernel.org/6.2.12-063-smc-Fix-use-after-free-in-tcp_write_timer_hand.patch + patches.kernel.org/6.2.12-064-net-wwan-iosm-Fix-error-handling-path-in-ipc_p.patch + patches.kernel.org/6.2.12-065-cgroup-freezer-hold-cpu_hotplug_lock-before-fr.patch + patches.kernel.org/6.2.12-066-rtnetlink-Restore-RTM_NEW-DELLINK-notification.patch + patches.kernel.org/6.2.12-067-net-qrtr-Fix-an-uninit-variable-access-bug-in-.patch + patches.kernel.org/6.2.12-068-sctp-fix-a-potential-overflow-in-sctp_ifwdtsn_.patch + patches.kernel.org/6.2.12-069-RDMA-core-Fix-GID-entry-ref-leak-when-create_a.patch + patches.kernel.org/6.2.12-070-selftests-openvswitch-adjust-datapath-NL-messa.patch + patches.kernel.org/6.2.12-071-udp6-fix-potential-access-to-stale-information.patch + patches.kernel.org/6.2.12-072-selftests-add-the-missing-CONFIG_IP_SCTP-in-ne.patch + patches.kernel.org/6.2.12-073-net-macb-fix-a-memory-corruption-in-extended-b.patch + patches.kernel.org/6.2.12-074-skbuff-Fix-a-race-between-coalescing-and-relea.patch + patches.kernel.org/6.2.12-075-ARM-9290-1-uaccess-Fix-KASAN-false-positives.patch + patches.kernel.org/6.2.12-076-ARM-dts-qcom-apq8026-lg-lenok-add-missing-rese.patch + patches.kernel.org/6.2.12-077-arm64-dts-qcom-sa8540p-ride-correct-name-of-re.patch + patches.kernel.org/6.2.12-078-power-supply-rk817-Fix-unsigned-comparison-wit.patch + patches.kernel.org/6.2.12-079-power-supply-cros_usbpd-reclassify-default-cas.patch + patches.kernel.org/6.2.12-080-power-supply-axp288_fuel_gauge-Added-check-for.patch + patches.kernel.org/6.2.12-081-selftests-bpf-Fix-progs-find_vma_fail1.c-build.patch + patches.kernel.org/6.2.12-082-wifi-mwifiex-mark-OF-related-data-as-maybe-unu.patch + patches.kernel.org/6.2.12-083-i2c-imx-lpi2c-clean-rx-tx-buffers-upon-new-mes.patch + patches.kernel.org/6.2.12-084-i2c-hisi-Avoid-redundant-interrupts.patch + patches.kernel.org/6.2.12-085-efi-sysfb_efi-Add-quirk-for-Lenovo-Yoga-Book-X.patch + patches.kernel.org/6.2.12-086-block-ublk_drv-mark-device-as-LIVE-before-addi.patch + patches.kernel.org/6.2.12-087-ACPI-video-Add-backlight-native-DMI-quirk-for-.patch + patches.kernel.org/6.2.12-088-drm-panel-orientation-quirks-Add-quirk-for-Len.patch + patches.kernel.org/6.2.12-089-hwmon-peci-cputemp-Fix-miscalculated-DTS-for-S.patch + patches.kernel.org/6.2.12-090-hwmon-xgene-Fix-ioremap-and-memremap-leak.patch + patches.kernel.org/6.2.12-091-verify_pefile-relax-wrapper-length-check.patch + patches.kernel.org/6.2.12-092-asymmetric_keys-log-on-fatal-failures-in-PE-pk.patch + patches.kernel.org/6.2.12-093-nvme-send-Identify-with-CNS-06h-only-to-I-O-co.patch + patches.kernel.org/6.2.12-094-wifi-iwlwifi-mvm-fix-mvmtxq-stopped-handling.patch + patches.kernel.org/6.2.12-095-wifi-iwlwifi-mvm-protect-TXQ-list-manipulation.patch + patches.kernel.org/6.2.12-096-drm-amdgpu-add-mes-resume-when-do-gfx-post-sof.patch + patches.kernel.org/6.2.12-097-drm-amdgpu-Force-signal-hw_fences-that-are-emb.patch + patches.kernel.org/6.2.12-098-drm-amdgpu-gfx-set-cg-flags-to-enter-exit-safe.patch + patches.kernel.org/6.2.12-099-ACPI-resource-Add-Medion-S17413-to-IRQ-overrid.patch + patches.kernel.org/6.2.12-100-tracing-Add-trace_array_puts-to-write-into-ins.patch + patches.kernel.org/6.2.12-101-tracing-Have-tracing_snapshot_instance_cond-wr.patch + patches.kernel.org/6.2.12-102-maple_tree-fix-write-memory-barrier-of-nodes-o.patch + patches.kernel.org/6.2.12-103-ksmbd-avoid-out-of-bounds-access-in-decode_pre.patch + patches.kernel.org/6.2.12-104-riscv-add-icache-flush-for-nommu-sigreturn-tra.patch + patches.kernel.org/6.2.12-105-HID-intel-ish-hid-Fix-kernel-panic-during-warm.patch + patches.kernel.org/6.2.12-106-net-sfp-initialize-sfp-i2c_block_size-at-sfp-a.patch + patches.kernel.org/6.2.12-107-net-phy-nxp-c45-tja11xx-add-remove-callback.patch + patches.kernel.org/6.2.12-108-net-phy-nxp-c45-tja11xx-fix-unsigned-long-mult.patch + patches.kernel.org/6.2.12-109-scsi-ses-Handle-enclosure-with-just-a-primary-.patch + patches.kernel.org/6.2.12-110-thermal-intel-Avoid-updating-unsupported-THERM.patch + patches.kernel.org/6.2.12-111-drm-amd-pm-correct-the-pcie-link-state-check-f.patch + patches.kernel.org/6.2.12-112-PCI-Fix-use-after-free-in-pci_bus_release_doma.patch + patches.kernel.org/6.2.12-113-PCI-MSI-Provide-missing-stub-for-pci_msix_can_.patch + patches.kernel.org/6.2.12-114-x86-PCI-Add-quirk-for-AMD-XHCI-controller-that.patch + patches.kernel.org/6.2.12-115-cgroup-fix-display-of-forceidle-time-at-root.patch + patches.kernel.org/6.2.12-116-cgroup-cpuset-Fix-partition-root-s-cpuset.cpus.patch + patches.kernel.org/6.2.12-117-cgroup-cpuset-Wake-up-cpuset_attach_wq-tasks-i.patch + patches.kernel.org/6.2.12-118-cgroup-cpuset-Make-cpuset_fork-handle-CLONE_IN.patch + patches.kernel.org/6.2.12-119-cgroup-cpuset-Add-cpuset_can_fork-and-cpuset_c.patch + patches.kernel.org/6.2.12-120-drm-amd-pm-correct-SMU13.0.7-pstate-profiling-.patch + patches.kernel.org/6.2.12-121-drm-amd-pm-correct-SMU13.0.7-max-shader-clock-.patch + patches.kernel.org/6.2.12-122-mptcp-use-mptcp_schedule_work-instead-of-open-.patch + patches.kernel.org/6.2.12-123-mptcp-stricter-state-check-in-mptcp_worker.patch + patches.kernel.org/6.2.12-124-mptcp-fix-NULL-pointer-dereference-on-fastopen.patch + patches.kernel.org/6.2.12-125-selftests-mptcp-userspace-pm-uniform-verify-ev.patch + patches.kernel.org/6.2.12-126-ubi-Fix-failure-attaching-when-vid_hdr-offset-.patch + patches.kernel.org/6.2.12-127-ubi-Fix-deadlock-caused-by-recursively-holding.patch + patches.kernel.org/6.2.12-128-i2c-mchp-pci1xxxx-Update-Timing-registers.patch + patches.kernel.org/6.2.12-129-powerpc-papr_scm-Update-the-NUMA-distance-tabl.patch + patches.kernel.org/6.2.12-130-sched-fair-Fix-imbalance-overflow.patch + patches.kernel.org/6.2.12-131-x86-rtc-Remove-__init-for-runtime-functions.patch + patches.kernel.org/6.2.12-132-i2c-ocores-generate-stop-condition-after-timeo.patch + patches.kernel.org/6.2.12-133-cifs-fix-negotiate-context-parsing.patch + patches.kernel.org/6.2.12-134-nvme-pci-mark-Lexar-NM760-as-IGNORE_DEV_SUBNQN.patch + patches.kernel.org/6.2.12-135-nvme-pci-add-NVME_QUIRK_BOGUS_NID-for-T-FORCE-.patch + patches.kernel.org/6.2.12-136-Linux-6.2.12.patch ######################################################## # Build fixes that apply to the vanilla kernel too. @@ -1636,7 +2373,6 @@ patches.rpmify/Add-ksym-provides-tool.patch patches.rpmify/Revert-kconfig-only-write-CONFIG_FOO-is-not-set-for-.patch patches.rpmify/BTF-Don-t-break-ABI-when-debuginfo-is-disabled.patch - patches.rpmify/s390-reintroduce-expoline-dependence-to-scripts.patch patches.rpmify/net-wwan-t7xx-disable-Werror.patch ######################################################## @@ -1656,8 +2392,7 @@ # sorted patches ######################################################## patches.suse/objtool-Check-that-module-init-exit-function-is-an-i.patch - patches.suse/efi-libstub-smbios-Use-length-member-instead-of-reco.patch - patches.suse/arm64-efi-Use-SMBIOS-processor-version-to-key-off-Am.patch + patches.suse/wifi-ath11k-reduce-the-MHI-timeout-to-20s.patch ######################################################## # end of sorted patches ######################################################## @@ -1773,7 +2508,6 @@ patches.suse/drivers-firmware-skip-simpledrm-if-nvidia-drm.modese.patch patches.suse/Add-parameter-to-disable-simple-framebuffer-devices.patch patches.suse/0001-bsc-1204315-Disable-sysfb-before-creating-simple-fra.patch - patches.suse/drm-nouveau-kms-Fix-backlight-registration.patch ######################################################## # Storage @@ -1788,6 +2522,8 @@ # Wireless networking drivers ######################################################## patches.suse/b43-missing-firmware-info.patch + patches.suse/ath11k-pci-Add-more-MODULE_FIRMWARE-entries.patch + patches.suse/iwlwifi-cfg-Add-missing-MODULE_FIRMWARE-for-pnvm.patch ######################################################## # USB diff --git a/supported.conf b/supported.conf index d112981..95248b0 100644 --- a/supported.conf +++ b/supported.conf @@ -1654,7 +1654,7 @@ drivers/media/common/videobuf2/videobuf2-common drivers/media/common/videobuf2/videobuf2-dma-contig drivers/media/common/videobuf2/videobuf2-dma-sg -- drivers/media/common/videobuf2/videobuf2-dvb +- drivers/media/common/videobuf2/videobuf2-dvb # review CVE-2022-45885/bsc#120758 before marking supported drivers/media/common/videobuf2/videobuf2-memops drivers/media/common/videobuf2/videobuf2-v4l2 drivers/media/common/videobuf2/videobuf2-vmalloc @@ -3211,7 +3211,7 @@ - drivers/usb/dwc3/dwc3-exynos drivers/usb/dwc3/* - drivers/usb/gadget/function/u_audio -- drivers/usb/gadget/function/u_ether + drivers/usb/gadget/function/u_ether - drivers/usb/gadget/function/u_serial - drivers/usb/gadget/function/usb_f_acm - drivers/usb/gadget/function/usb_f_ecm @@ -3221,7 +3221,7 @@ - drivers/usb/gadget/function/usb_f_hid - drivers/usb/gadget/function/usb_f_mass_storage - drivers/usb/gadget/function/usb_f_midi -- drivers/usb/gadget/function/usb_f_ncm + drivers/usb/gadget/function/usb_f_ncm - drivers/usb/gadget/function/usb_f_obex - drivers/usb/gadget/function/usb_f_phonet - drivers/usb/gadget/function/usb_f_printer @@ -3249,7 +3249,7 @@ - drivers/usb/gadget/legacy/g_webcam - drivers/usb/gadget/legacy/gadgetfs - drivers/usb/gadget/legacy/tcm_usb_gadget -- drivers/usb/gadget/libcomposite + drivers/usb/gadget/libcomposite - drivers/usb/gadget/udc/bdc/bdc - drivers/usb/gadget/udc/bdc/bdc_pci - drivers/usb/gadget/udc/fsl_usb2_udc @@ -3611,6 +3611,7 @@ fs/ecryptfs/ecryptfs fs/efivarfs/efivarfs # Support for EFI Variables filesystem - fs/efs/efs ++base fs/exfat/exfat fs/exportfs/exportfs +base fs/ext4/ext4 fs/fat/fat @@ -3715,7 +3716,7 @@ - fs/sysv/sysv - fs/ubifs/ubifs fs/udf/udf # Universal Disk Format Filesystem - fs/ufs/ufs +- fs/ufs/ufs +base fs/xfs/xfs # bsc#457668 - kernel/rcu/rcuperf - kernel/rcu/rcutorture # Read-Copy Update /proc-based torture test facility