diff --git a/patches.kabi/hci_chan-amp-kABI-workaround.patch b/patches.kabi/hci_chan-amp-kABI-workaround.patch new file mode 100644 index 0000000..4469a7e --- /dev/null +++ b/patches.kabi/hci_chan-amp-kABI-workaround.patch @@ -0,0 +1,27 @@ +From: Takashi Iwai +Subject: kABI workaround for hci_chan amp field addition +Patch-mainline: Never, kABI workaround +References: CVE-2021-33034 bsc#1186111 + +The newly added amp flag in hci_chan struct breaks kABI. +As the new field fits into a hole, we just need to wrap it with +__GENKSYMS__ ifndef as usual. + +Signed-off-by: Takashi Iwai + +--- + include/net/bluetooth/hci_core.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -540,7 +540,9 @@ struct hci_chan { + struct sk_buff_head data_q; + unsigned int sent; + __u8 state; ++#ifndef __GENKSYMS__ + bool amp; ++#endif + }; + + struct hci_conn_params { diff --git a/patches.suse/Bluetooth-verify-AMP-hci_chan-before-amp_destroy.patch b/patches.suse/Bluetooth-verify-AMP-hci_chan-before-amp_destroy.patch new file mode 100644 index 0000000..8cd50e4 --- /dev/null +++ b/patches.suse/Bluetooth-verify-AMP-hci_chan-before-amp_destroy.patch @@ -0,0 +1,141 @@ +From 5c4c8c9544099bb9043a10a5318130a943e32fc3 Mon Sep 17 00:00:00 2001 +From: Archie Pusaka +Date: Mon, 22 Mar 2021 14:03:11 +0800 +Subject: [PATCH] Bluetooth: verify AMP hci_chan before amp_destroy +Git-commit: 5c4c8c9544099bb9043a10a5318130a943e32fc3 +Patch-mainline: v5.13-rc1 +References: CVE-2021-33034 bsc#1186111 + +hci_chan can be created in 2 places: hci_loglink_complete_evt() if +it is an AMP hci_chan, or l2cap_conn_add() otherwise. In theory, +Only AMP hci_chan should be removed by a call to +hci_disconn_loglink_complete_evt(). However, the controller might mess +up, call that function, and destroy an hci_chan which is not initiated +by hci_loglink_complete_evt(). + +This patch adds a verification that the destroyed hci_chan must have +been init'd by hci_loglink_complete_evt(). + +Example crash call trace: +Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0xe3/0x144 lib/dump_stack.c:118 + print_address_description+0x67/0x22a mm/kasan/report.c:256 + kasan_report_error mm/kasan/report.c:354 [inline] + kasan_report mm/kasan/report.c:412 [inline] + kasan_report+0x251/0x28f mm/kasan/report.c:396 + hci_send_acl+0x3b/0x56e net/bluetooth/hci_core.c:4072 + l2cap_send_cmd+0x5af/0x5c2 net/bluetooth/l2cap_core.c:877 + l2cap_send_move_chan_cfm_icid+0x8e/0xb1 net/bluetooth/l2cap_core.c:4661 + l2cap_move_fail net/bluetooth/l2cap_core.c:5146 [inline] + l2cap_move_channel_rsp net/bluetooth/l2cap_core.c:5185 [inline] + l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:5464 [inline] + l2cap_sig_channel net/bluetooth/l2cap_core.c:5799 [inline] + l2cap_recv_frame+0x1d12/0x51aa net/bluetooth/l2cap_core.c:7023 + l2cap_recv_acldata+0x2ea/0x693 net/bluetooth/l2cap_core.c:7596 + hci_acldata_packet net/bluetooth/hci_core.c:4606 [inline] + hci_rx_work+0x2bd/0x45e net/bluetooth/hci_core.c:4796 + process_one_work+0x6f8/0xb50 kernel/workqueue.c:2175 + worker_thread+0x4fc/0x670 kernel/workqueue.c:2321 + kthread+0x2f0/0x304 kernel/kthread.c:253 + ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415 + +Allocated by task 38: + set_track mm/kasan/kasan.c:460 [inline] + kasan_kmalloc+0x8d/0x9a mm/kasan/kasan.c:553 + kmem_cache_alloc_trace+0x102/0x129 mm/slub.c:2787 + kmalloc include/linux/slab.h:515 [inline] + kzalloc include/linux/slab.h:709 [inline] + hci_chan_create+0x86/0x26d net/bluetooth/hci_conn.c:1674 + l2cap_conn_add.part.0+0x1c/0x814 net/bluetooth/l2cap_core.c:7062 + l2cap_conn_add net/bluetooth/l2cap_core.c:7059 [inline] + l2cap_connect_cfm+0x134/0x852 net/bluetooth/l2cap_core.c:7381 + hci_connect_cfm+0x9d/0x122 include/net/bluetooth/hci_core.h:1404 + hci_remote_ext_features_evt net/bluetooth/hci_event.c:4161 [inline] + hci_event_packet+0x463f/0x72fa net/bluetooth/hci_event.c:5981 + hci_rx_work+0x197/0x45e net/bluetooth/hci_core.c:4791 + process_one_work+0x6f8/0xb50 kernel/workqueue.c:2175 + worker_thread+0x4fc/0x670 kernel/workqueue.c:2321 + kthread+0x2f0/0x304 kernel/kthread.c:253 + ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415 + +Freed by task 1732: + set_track mm/kasan/kasan.c:460 [inline] + __kasan_slab_free mm/kasan/kasan.c:521 [inline] + __kasan_slab_free+0x106/0x128 mm/kasan/kasan.c:493 + slab_free_hook mm/slub.c:1409 [inline] + slab_free_freelist_hook+0xaa/0xf6 mm/slub.c:1436 + slab_free mm/slub.c:3009 [inline] + kfree+0x182/0x21e mm/slub.c:3972 + hci_disconn_loglink_complete_evt net/bluetooth/hci_event.c:4891 [inline] + hci_event_packet+0x6a1c/0x72fa net/bluetooth/hci_event.c:6050 + hci_rx_work+0x197/0x45e net/bluetooth/hci_core.c:4791 + process_one_work+0x6f8/0xb50 kernel/workqueue.c:2175 + worker_thread+0x4fc/0x670 kernel/workqueue.c:2321 + kthread+0x2f0/0x304 kernel/kthread.c:253 + ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415 + +The buggy address belongs to the object at ffff8881d7af9180 + which belongs to the cache kmalloc-128 of size 128 +The buggy address is located 24 bytes inside of + 128-byte region [ffff8881d7af9180, ffff8881d7af9200) +The buggy address belongs to the page: +page:ffffea00075ebe40 count:1 mapcount:0 mapping:ffff8881da403200 index:0x0 +Flags: 0x8000000000000200(slab) +Raw: 8000000000000200 dead000000000100 dead000000000200 ffff8881da403200 +Raw: 0000000000000000 0000000080150015 00000001ffffffff 0000000000000000 +page dumped because: kasan: bad access detected + +Memory state around the buggy address: + ffff8881d7af9080: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb + ffff8881d7af9100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc +>ffff8881d7af9180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881d7af9200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8881d7af9280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + +Signed-off-by: Archie Pusaka +Reported-by: syzbot+98228e7407314d2d4ba2@syzkaller.appspotmail.com +Reviewed-by: Alain Michaud +Reviewed-by: Abhishek Pandit-Subedi +Signed-off-by: Marcel Holtmann +Acked-by: Takashi Iwai + +--- + include/net/bluetooth/hci_core.h | 1 + + net/bluetooth/hci_event.c | 3 ++- + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index ebdd4afe30d2..ca4ac6603b9a 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -704,6 +704,7 @@ struct hci_chan { + struct sk_buff_head data_q; + unsigned int sent; + __u8 state; ++ bool amp; + }; + + struct hci_conn_params { +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index cf2f4a0abdbd..341c8ce93648 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -5032,6 +5032,7 @@ static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb) + return; + + hchan->handle = le16_to_cpu(ev->handle); ++ hchan->amp = true; + + BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan); + +@@ -5064,7 +5065,7 @@ static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev, + hci_dev_lock(hdev); + + hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle)); +- if (!hchan) ++ if (!hchan || !hchan->amp) + goto unlock; + + amp_destroy_logical_link(hchan, ev->reason); +-- +2.26.2 + diff --git a/patches.suse/PCI-Allow-VPD-access-for-QLogic-ISP2722.patch b/patches.suse/PCI-Allow-VPD-access-for-QLogic-ISP2722.patch new file mode 100644 index 0000000..37ca614 --- /dev/null +++ b/patches.suse/PCI-Allow-VPD-access-for-QLogic-ISP2722.patch @@ -0,0 +1,51 @@ +From e00dc69b5f17c444a38cd9745a0f76bc989b3af4 Mon Sep 17 00:00:00 2001 +From: Arun Easi +Date: Fri, 9 Apr 2021 14:51:53 -0700 +Subject: [PATCH] PCI: Allow VPD access for QLogic ISP2722 +Git-commit: e00dc69b5f17c444a38cd9745a0f76bc989b3af4 +Patch-mainline: v5.13-rc1 +References: git-fixes + +0d5370d1d852 ("PCI: Prevent VPD access for QLogic ISP2722") disabled access +to VPD of the ISP2722-based 16/32Gb Fibre Channel to PCIe Adapter because +reading past the end of the VPD caused NMIs. + +104daa71b396 ("PCI: Determine actual VPD size on first access") limits +reads to the actual size of VPD, which should prevent these NMIs. + +104daa71b396 was merged *before* 0d5370d1d852, but we think the testing +that prompted 0d5370d1d852 ("PCI: Prevent VPD access for QLogic ISP2722") +was done with a kernel that lacked 104daa71b396. See [1, 2]. + +Remove the quirk added by 0d5370d1d852 ("PCI: Prevent VPD access for QLogic +ISP2722") so customers can read the HBA VPD. + +[1] https://lore.kernel.org/linux-pci/alpine.LRH.2.21.9999.2012161641230.28924@irv1user01.caveonetworks.com/ +[2] https://lore.kernel.org/linux-pci/alpine.LRH.2.21.9999.2104071535110.13940@irv1user01.caveonetworks.com/ + +[bhelgaas: commit log] +Link: https://lore.kernel.org/r/20210409215153.16569-2-aeasi@marvell.com +Signed-off-by: Arun Easi +Signed-off-by: Bjorn Helgaas +Cc: stable@vger.kernel.org # v4.6+ +Acked-by: Takashi Iwai + +--- + drivers/pci/vpd.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/pci/vpd.c b/drivers/pci/vpd.c +index c6aad87dd0f9..8af31c5eec2d 100644 +--- a/drivers/pci/vpd.c ++++ b/drivers/pci/vpd.c +@@ -500,7 +500,6 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LSI_LOGIC, 0x005d, quirk_blacklist_vpd); + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LSI_LOGIC, 0x005f, quirk_blacklist_vpd); + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATTANSIC, PCI_ANY_ID, + quirk_blacklist_vpd); +-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_QLOGIC, 0x2261, quirk_blacklist_vpd); + /* + * The Amazon Annapurna Labs 0x0031 device id is reused for other non Root Port + * device types, so the quirk is registered for the PCI_CLASS_BRIDGE_PCI class. +-- +2.26.2 + diff --git a/patches.suse/RDMA-hns-Delete-redundant-abnormal-interrupt-status.patch b/patches.suse/RDMA-hns-Delete-redundant-abnormal-interrupt-status.patch new file mode 100644 index 0000000..a5689e0 --- /dev/null +++ b/patches.suse/RDMA-hns-Delete-redundant-abnormal-interrupt-status.patch @@ -0,0 +1,68 @@ +From: Wenpeng Liang +Date: Fri, 2 Apr 2021 17:07:29 +0800 +Subject: RDMA/hns: Delete redundant abnormal interrupt status +Patch-mainline: v5.13-rc1 +Git-commit: 2371efab9794bdf845b03473858a90d65035e331 +References: git-fixes + +The hardware supports only two types of abnormal interrupts. + +Fixes: a5073d6054f7 ("RDMA/hns: Add eq support of hip08") +Link: https://lore.kernel.org/r/1617354454-47840-5-git-send-email-liweihang@huawei.com +Signed-off-by: Wenpeng Liang +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 19 +++++-------------- + drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 3 +-- + 2 files changed, 6 insertions(+), 16 deletions(-) + +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -5585,28 +5585,19 @@ static irqreturn_t hns_roce_v2_msix_inte + roce_write(hr_dev, ROCEE_VF_ABN_INT_EN_REG, int_en); + + int_work = 1; +- } else if (int_st & BIT(HNS_ROCE_V2_VF_INT_ST_BUS_ERR_S)) { +- dev_err(dev, "BUS ERR!\n"); ++ } else if (int_st & BIT(HNS_ROCE_V2_VF_INT_ST_RAS_INT_S)) { ++ dev_err(dev, "RAS interrupt!\n"); + +- int_st |= 1 << HNS_ROCE_V2_VF_INT_ST_BUS_ERR_S; ++ int_st |= 1 << HNS_ROCE_V2_VF_INT_ST_RAS_INT_S; + roce_write(hr_dev, ROCEE_VF_ABN_INT_ST_REG, int_st); + + int_en |= 1 << HNS_ROCE_V2_VF_ABN_INT_EN_S; + roce_write(hr_dev, ROCEE_VF_ABN_INT_EN_REG, int_en); + + int_work = 1; +- } else if (int_st & BIT(HNS_ROCE_V2_VF_INT_ST_OTHER_ERR_S)) { +- dev_err(dev, "OTHER ERR!\n"); +- +- int_st |= 1 << HNS_ROCE_V2_VF_INT_ST_OTHER_ERR_S; +- roce_write(hr_dev, ROCEE_VF_ABN_INT_ST_REG, int_st); +- +- int_en |= 1 << HNS_ROCE_V2_VF_ABN_INT_EN_S; +- roce_write(hr_dev, ROCEE_VF_ABN_INT_EN_REG, int_en); +- +- int_work = 1; +- } else ++ } else { + dev_err(dev, "There is no abnormal irq found!\n"); ++ } + + return IRQ_RETVAL(int_work); + } +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +@@ -1838,8 +1838,7 @@ struct hns_roce_eq_context { + #define HNS_ROCE_V2_ASYNC_EQE_NUM 0x1000 + + #define HNS_ROCE_V2_VF_INT_ST_AEQ_OVERFLOW_S 0 +-#define HNS_ROCE_V2_VF_INT_ST_BUS_ERR_S 1 +-#define HNS_ROCE_V2_VF_INT_ST_OTHER_ERR_S 2 ++#define HNS_ROCE_V2_VF_INT_ST_RAS_INT_S 1 + + #define HNS_ROCE_EQ_DB_CMD_AEQ 0x0 + #define HNS_ROCE_EQ_DB_CMD_AEQ_ARMED 0x1 diff --git a/patches.suse/RDMA-hns-Delete-redundant-condition-judgment-related.patch b/patches.suse/RDMA-hns-Delete-redundant-condition-judgment-related.patch new file mode 100644 index 0000000..61c6894 --- /dev/null +++ b/patches.suse/RDMA-hns-Delete-redundant-condition-judgment-related.patch @@ -0,0 +1,60 @@ +From: Yangyang Li +Date: Fri, 2 Apr 2021 17:07:28 +0800 +Subject: RDMA/hns: Delete redundant condition judgment related to eq +Patch-mainline: v5.13-rc1 +Git-commit: 714a597baab099e728307768e3b5c3b82d7b2ce3 +References: git-fixes + +The register value related to the eq interrupt depends only on +enable_flag, so the redundant condition judgment is deleted. + +Fixes: a5073d6054f7 ("RDMA/hns: Add eq support of hip08") +Link: https://lore.kernel.org/r/1617354454-47840-4-git-send-email-liweihang@huawei.com +Signed-off-by: Yangyang Li +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 27 ++++++--------------------- + 1 file changed, 6 insertions(+), 21 deletions(-) + +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -5612,31 +5612,16 @@ static irqreturn_t hns_roce_v2_msix_inte + } + + static void hns_roce_v2_int_mask_enable(struct hns_roce_dev *hr_dev, +- int eq_num, int enable_flag) ++ int eq_num, u32 enable_flag) + { + int i; + +- if (enable_flag == EQ_ENABLE) { +- for (i = 0; i < eq_num; i++) +- roce_write(hr_dev, ROCEE_VF_EVENT_INT_EN_REG + +- i * EQ_REG_OFFSET, +- HNS_ROCE_V2_VF_EVENT_INT_EN_M); ++ for (i = 0; i < eq_num; i++) ++ roce_write(hr_dev, ROCEE_VF_EVENT_INT_EN_REG + ++ i * EQ_REG_OFFSET, enable_flag); + +- roce_write(hr_dev, ROCEE_VF_ABN_INT_EN_REG, +- HNS_ROCE_V2_VF_ABN_INT_EN_M); +- roce_write(hr_dev, ROCEE_VF_ABN_INT_CFG_REG, +- HNS_ROCE_V2_VF_ABN_INT_CFG_M); +- } else { +- for (i = 0; i < eq_num; i++) +- roce_write(hr_dev, ROCEE_VF_EVENT_INT_EN_REG + +- i * EQ_REG_OFFSET, +- HNS_ROCE_V2_VF_EVENT_INT_EN_M & 0x0); +- +- roce_write(hr_dev, ROCEE_VF_ABN_INT_EN_REG, +- HNS_ROCE_V2_VF_ABN_INT_EN_M & 0x0); +- roce_write(hr_dev, ROCEE_VF_ABN_INT_CFG_REG, +- HNS_ROCE_V2_VF_ABN_INT_CFG_M & 0x0); +- } ++ roce_write(hr_dev, ROCEE_VF_ABN_INT_EN_REG, enable_flag); ++ roce_write(hr_dev, ROCEE_VF_ABN_INT_CFG_REG, enable_flag); + } + + static void hns_roce_v2_destroy_eqc(struct hns_roce_dev *hr_dev, int eqn) diff --git a/patches.suse/RDMA-qedr-Fix-error-return-code-in-qedr_iw_connect.patch b/patches.suse/RDMA-qedr-Fix-error-return-code-in-qedr_iw_connect.patch new file mode 100644 index 0000000..cadf2f3 --- /dev/null +++ b/patches.suse/RDMA-qedr-Fix-error-return-code-in-qedr_iw_connect.patch @@ -0,0 +1,38 @@ +From: Wang Wensheng +Date: Thu, 8 Apr 2021 11:31:35 +0000 +Subject: RDMA/qedr: Fix error return code in qedr_iw_connect() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Patch-mainline: v5.13-rc1 +Git-commit: 10dd83dbcd157baf7a78a09ddb2f84c627bc7f1d +References: jsc#SLE-8215 + +Fix to return a negative error code from the error handling case instead +of 0, as done elsewhere in this function. + +Fixes: 82af6d19d8d9 ("RDMA/qedr: Fix synchronization methods and memory leaks in qedr") +Link: https://lore.kernel.org/r/20210408113135.92165-1-wangwensheng4@huawei.com +Reported-by: Hulk Robot +Signed-off-by: Wang Wensheng +Acked-by: Michal Kalderon  +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/qedr/qedr_iw_cm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/qedr/qedr_iw_cm.c ++++ b/drivers/infiniband/hw/qedr/qedr_iw_cm.c +@@ -636,8 +636,10 @@ int qedr_iw_connect(struct iw_cm_id *cm_ + memcpy(in_params.local_mac_addr, dev->ndev->dev_addr, ETH_ALEN); + + if (test_and_set_bit(QEDR_IWARP_CM_WAIT_FOR_CONNECT, +- &qp->iwarp_cm_flags)) ++ &qp->iwarp_cm_flags)) { ++ rc = -ENODEV; + goto err; /* QP already being destroyed */ ++ } + + rc = dev->ops->iwarp_connect(dev->rdma_ctx, &in_params, &out_params); + if (rc) { diff --git a/patches.suse/RDMA-srpt-Fix-error-return-code-in-srpt_cm_req_recv.patch b/patches.suse/RDMA-srpt-Fix-error-return-code-in-srpt_cm_req_recv.patch new file mode 100644 index 0000000..6aba266 --- /dev/null +++ b/patches.suse/RDMA-srpt-Fix-error-return-code-in-srpt_cm_req_recv.patch @@ -0,0 +1,31 @@ +From: Wang Wensheng +Date: Thu, 8 Apr 2021 11:31:32 +0000 +Subject: RDMA/srpt: Fix error return code in srpt_cm_req_recv() +Patch-mainline: v5.13-rc1 +Git-commit: 6bc950beff0c440ac567cdc4e7f4542a9920953d +References: git-fixes + +Fix to return a negative error code from the error handling case instead +of 0, as done elsewhere in this function. + +Fixes: db7683d7deb2 ("IB/srpt: Fix login-related race conditions") +Link: https://lore.kernel.org/r/20210408113132.87250-1-wangwensheng4@huawei.com +Reported-by: Hulk Robot +Signed-off-by: Wang Wensheng +Reviewed-by: Bart Van Assche +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -2387,6 +2387,7 @@ static int srpt_cm_req_recv(struct srpt_ + pr_info("rejected SRP_LOGIN_REQ because target %s_%d is not enabled\n", + dev_name(&sdev->device->dev), port_num); + mutex_unlock(&sport->mutex); ++ ret = -EINVAL; + goto reject; + } + diff --git a/patches.suse/USB-serial-ti_usb_3410_5052-fix-TIOCSSERIAL-permissi.patch b/patches.suse/USB-serial-ti_usb_3410_5052-fix-TIOCSSERIAL-permissi.patch new file mode 100644 index 0000000..dd84a2c --- /dev/null +++ b/patches.suse/USB-serial-ti_usb_3410_5052-fix-TIOCSSERIAL-permissi.patch @@ -0,0 +1,49 @@ +From d370c90dcd64e427a79a093a070117a1571d4cd8 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 7 Apr 2021 12:39:15 +0200 +Subject: [PATCH] USB: serial: ti_usb_3410_5052: fix TIOCSSERIAL permission check +Git-commit: d370c90dcd64e427a79a093a070117a1571d4cd8 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Changing the port closing-wait parameter is a privileged operation so +make sure to return -EPERM if a regular user tries to change it. + +Cc: stable@vger.kernel.org +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Acked-by: Takashi Iwai + +--- + drivers/usb/serial/ti_usb_3410_5052.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c +index 4b497c1e850b..bb50098a0ce6 100644 +--- a/drivers/usb/serial/ti_usb_3410_5052.c ++++ b/drivers/usb/serial/ti_usb_3410_5052.c +@@ -1418,14 +1418,19 @@ static int ti_set_serial_info(struct tty_struct *tty, + struct serial_struct *ss) + { + struct usb_serial_port *port = tty->driver_data; +- struct ti_port *tport = usb_get_serial_port_data(port); ++ struct tty_port *tport = &port->port; + unsigned cwait; + + cwait = ss->closing_wait; + if (cwait != ASYNC_CLOSING_WAIT_NONE) + cwait = msecs_to_jiffies(10 * ss->closing_wait); + +- tport->tp_port->port.closing_wait = cwait; ++ if (!capable(CAP_SYS_ADMIN)) { ++ if (cwait != tport->closing_wait) ++ return -EPERM; ++ } ++ ++ tport->closing_wait = cwait; + + return 0; + } +-- +2.26.2 + diff --git a/patches.suse/blk-iocost-ioc_pd_free-shouldn-t-assume-irq-disabled.patch b/patches.suse/blk-iocost-ioc_pd_free-shouldn-t-assume-irq-disabled.patch new file mode 100644 index 0000000..f1609a2 --- /dev/null +++ b/patches.suse/blk-iocost-ioc_pd_free-shouldn-t-assume-irq-disabled.patch @@ -0,0 +1,46 @@ +From: Tejun Heo +Date: Tue, 1 Sep 2020 14:52:31 -0400 +Subject: [PATCH] blk-iocost: ioc_pd_free() shouldn't assume irq disabled +Git-commit: 5aeac7c4b16069aae49005f0a8d4526baa83341b +Patch-mainline: v5.9-rc4 +References: git-fixes + +ioc_pd_free() grabs irq-safe ioc->lock without ensuring that irq is disabled +when it can be called with irq disabled or enabled. This has a small chance +of causing A-A deadlocks and triggers lockdep splats. Use irqsave operations +instead. + +Signed-off-by: Tejun Heo +Fixes: 7caa47151ab2 ("blkcg: implement blk-iocost") +Cc: stable@vger.kernel.org # v5.4+ +Signed-off-by: Jens Axboe +Acked-by: Hannes Reinecke +--- + block/blk-iocost.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/block/blk-iocost.c b/block/blk-iocost.c +index 413e0b5c8e6b..d37b55db2409 100644 +--- a/block/blk-iocost.c ++++ b/block/blk-iocost.c +@@ -2092,14 +2092,15 @@ static void ioc_pd_free(struct blkg_policy_data *pd) + { + struct ioc_gq *iocg = pd_to_iocg(pd); + struct ioc *ioc = iocg->ioc; ++ unsigned long flags; + + if (ioc) { +- spin_lock(&ioc->lock); ++ spin_lock_irqsave(&ioc->lock, flags); + if (!list_empty(&iocg->active_list)) { + propagate_active_weight(iocg, 0, 0); + list_del_init(&iocg->active_list); + } +- spin_unlock(&ioc->lock); ++ spin_unlock_irqrestore(&ioc->lock, flags); + + hrtimer_cancel(&iocg->waitq_timer); + hrtimer_cancel(&iocg->delay_timer); +-- +2.29.2 + diff --git a/patches.suse/block-fix-get_max_io_size.patch b/patches.suse/block-fix-get_max_io_size.patch new file mode 100644 index 0000000..2c36630 --- /dev/null +++ b/patches.suse/block-fix-get_max_io_size.patch @@ -0,0 +1,39 @@ +From: Keith Busch +Date: Thu, 6 Aug 2020 14:58:37 -0700 +Subject: [PATCH] block: fix get_max_io_size() +Git-commit: e4b469c66f3cbb81c2e94d31123d7bcdf3c1dabd +Patch-mainline: v5.9-rc3 +References: git-fixes + +A previous commit aligning splits to physical block sizes inadvertently +modified one return case such that that it now returns 0 length splits +when the number of sectors doesn't exceed the physical offset. This +later hits a BUG in bio_split(). Restore the previous working behavior. + +Fixes: 9cc5169cd478b ("block: Improve physical block alignment of split bios") +Reported-by: Eric Deal +Signed-off-by: Keith Busch +Cc: Bart Van Assche +Cc: stable@vger.kernel.org +Signed-off-by: Jens Axboe +Acked-by: Hannes Reinecke +--- + block/blk-merge.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/block/blk-merge.c b/block/blk-merge.c +index 7af1f3668a91..f685d633bcc9 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -154,7 +154,7 @@ static inline unsigned get_max_io_size(struct request_queue *q, + if (max_sectors > start_offset) + return max_sectors - start_offset; + +- return sectors & (lbs - 1); ++ return sectors & ~(lbs - 1); + } + + static inline unsigned get_max_segment_size(const struct request_queue *q, +-- +2.29.2 + diff --git a/patches.suse/bnxt_en-Fix-RX-consumer-index-logic-in-the-error-pat.patch b/patches.suse/bnxt_en-Fix-RX-consumer-index-logic-in-the-error-pat.patch new file mode 100644 index 0000000..2bc40b7 --- /dev/null +++ b/patches.suse/bnxt_en-Fix-RX-consumer-index-logic-in-the-error-pat.patch @@ -0,0 +1,64 @@ +From: Michael Chan +Date: Fri, 23 Apr 2021 18:13:19 -0400 +Subject: bnxt_en: Fix RX consumer index logic in the error path. +Patch-mainline: v5.13-rc1 +Git-commit: bbd6f0a948139970f4a615dff189d9a503681a39 +References: git-fixes + +In bnxt_rx_pkt(), the RX buffers are expected to complete in order. +If the RX consumer index indicates an out of order buffer completion, +it means we are hitting a hardware bug and the driver will abort all +remaining RX packets and reset the RX ring. The RX consumer index +that we pass to bnxt_discard_rx() is not correct. We should be +passing the current index (tmp_raw_cons) instead of the old index +(raw_cons). This bug can cause us to be at the wrong index when +trying to abort the next RX packet. It can crash like this: + + #0 [ffff9bbcdf5c39a8] machine_kexec at ffffffff9b05e007 + #1 [ffff9bbcdf5c3a00] __crash_kexec at ffffffff9b111232 + #2 [ffff9bbcdf5c3ad0] panic at ffffffff9b07d61e + #3 [ffff9bbcdf5c3b50] oops_end at ffffffff9b030978 + #4 [ffff9bbcdf5c3b78] no_context at ffffffff9b06aaf0 + #5 [ffff9bbcdf5c3bd8] __bad_area_nosemaphore at ffffffff9b06ae2e + #6 [ffff9bbcdf5c3c28] bad_area_nosemaphore at ffffffff9b06af24 + #7 [ffff9bbcdf5c3c38] __do_page_fault at ffffffff9b06b67e + #8 [ffff9bbcdf5c3cb0] do_page_fault at ffffffff9b06bb12 + #9 [ffff9bbcdf5c3ce0] page_fault at ffffffff9bc015c5 + [exception RIP: bnxt_rx_pkt+237] + RIP: ffffffffc0259cdd RSP: ffff9bbcdf5c3d98 RFLAGS: 00010213 + RAX: 000000005dd8097f RBX: ffff9ba4cb11b7e0 RCX: ffffa923cf6e9000 + RDX: 0000000000000fff RSI: 0000000000000627 RDI: 0000000000001000 + RBP: ffff9bbcdf5c3e60 R8: 0000000000420003 R9: 000000000000020d + R10: ffffa923cf6ec138 R11: ffff9bbcdf5c3e83 R12: ffff9ba4d6f928c0 + R13: ffff9ba4cac28080 R14: ffff9ba4cb11b7f0 R15: ffff9ba4d5a30000 + ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 + +Fixes: a1b0e4e684e9 ("bnxt_en: Improve RX consumer index validity check.") +Reviewed-by: Pavan Chebbi +Reviewed-by: Andy Gospodarek +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -1730,12 +1730,14 @@ static int bnxt_rx_pkt(struct bnxt *bp, + + cons = rxcmp->rx_cmp_opaque; + if (unlikely(cons != rxr->rx_next_cons)) { +- int rc1 = bnxt_discard_rx(bp, cpr, raw_cons, rxcmp); ++ int rc1 = bnxt_discard_rx(bp, cpr, &tmp_raw_cons, rxcmp); + + netdev_warn(bp->dev, "RX cons %x != expected cons %x\n", + cons, rxr->rx_next_cons); + bnxt_sched_reset(bp, rxr); +- return rc1; ++ if (rc1) ++ return rc1; ++ goto next_rx_no_prod_no_len; + } + rx_buf = &rxr->rx_buf_ring[cons]; + data = rx_buf->data; diff --git a/patches.suse/bnxt_en-fix-ternary-sign-extension-bug-in-bnxt_show_.patch b/patches.suse/bnxt_en-fix-ternary-sign-extension-bug-in-bnxt_show_.patch new file mode 100644 index 0000000..eb9cba6 --- /dev/null +++ b/patches.suse/bnxt_en-fix-ternary-sign-extension-bug-in-bnxt_show_.patch @@ -0,0 +1,36 @@ +From: Dan Carpenter +Date: Thu, 22 Apr 2021 12:10:28 +0300 +Subject: bnxt_en: fix ternary sign extension bug in bnxt_show_temp() +Patch-mainline: v5.13-rc1 +Git-commit: 27537929f30d3136a71ef29db56127a33c92dad7 +References: git-fixes + +The problem is that bnxt_show_temp() returns long but "rc" is an int +and "len" is a u32. With ternary operations the type promotion is quite +tricky. The negative "rc" is first promoted to u32 and then to long so +it ends up being a high positive value instead of a a negative as we +intended. + +Fix this by removing the ternary. + +Fixes: d69753fa1ecb ("bnxt_en: return proper error codes in bnxt_show_temp") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -8978,7 +8978,9 @@ static ssize_t bnxt_show_temp(struct dev + if (!rc) + len = sprintf(buf, "%u\n", resp->temp * 1000); /* display millidegree */ + mutex_unlock(&bp->hwrm_cmd_lock); +- return rc ?: len; ++ if (rc) ++ return rc; ++ return len; + } + static SENSOR_DEVICE_ATTR(temp1_input, 0444, bnxt_show_temp, NULL, 0); + diff --git a/patches.suse/cfg80211-scan-drop-entry-from-hidden_list-on-overflo.patch b/patches.suse/cfg80211-scan-drop-entry-from-hidden_list-on-overflo.patch new file mode 100644 index 0000000..b8db975 --- /dev/null +++ b/patches.suse/cfg80211-scan-drop-entry-from-hidden_list-on-overflo.patch @@ -0,0 +1,38 @@ +From 010bfbe768f7ecc876ffba92db30432de4997e2a Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Fri, 16 Apr 2021 09:42:14 +0200 +Subject: [PATCH] cfg80211: scan: drop entry from hidden_list on overflow +Git-commit: 010bfbe768f7ecc876ffba92db30432de4997e2a +Patch-mainline: v5.13-rc1 +References: git-fixes + +If we overflow the maximum number of BSS entries and free the +new entry, drop it from any hidden_list that it may have been +added to in the code above or in cfg80211_combine_bsses(). + +Reported-by: Dan Carpenter +Link: https://lore.kernel.org/r/20210416094212.5de7d1676ad7.Ied283b0bc5f504845e7d6ab90626bdfa68bb3dc0@changeid +Cc: stable@vger.kernel.org +Signed-off-by: Johannes Berg +Acked-by: Takashi Iwai + +--- + net/wireless/scan.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/wireless/scan.c b/net/wireless/scan.c +index c3b51efff5c6..b21058698a9f 100644 +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -1751,6 +1751,8 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev, + + if (rdev->bss_entries >= bss_entries_limit && + !cfg80211_bss_expire_oldest(rdev)) { ++ if (!list_empty(&new->hidden_list)) ++ list_del(&new->hidden_list); + kfree(new); + goto drop; + } +-- +2.26.2 + diff --git a/patches.suse/cpufreq-intel_pstate-Add-Icelake-servers-support-in-.patch b/patches.suse/cpufreq-intel_pstate-Add-Icelake-servers-support-in-.patch new file mode 100644 index 0000000..4a0ed5a --- /dev/null +++ b/patches.suse/cpufreq-intel_pstate-Add-Icelake-servers-support-in-.patch @@ -0,0 +1,31 @@ +From: Giovanni Gherdovich +Date: Tue, 18 May 2021 14:34:12 +0200 +Subject: cpufreq: intel_pstate: Add Icelake servers support in no-HWP mode +Patch-mainline: Submitted https://lore.kernel.org/lkml/20210518123413.20670-1-ggherdovich@suse.cz +References: bsc#1185758 + +Users may disable HWP in firmware, in which case intel_pstate wouldn't load +unless the CPU model is explicitly supported. + +Add ICELAKE_X to the list of CPUs that can register intel_pstate while not +advertising the HWP capability. Without this change, an ICELAKE_X in no-HWP +mode could only use the acpi_cpufreq frequency scaling driver. + +See also commit d8de7a44e11f ("cpufreq: intel_pstate: Add Skylake servers +support"). + +Signed-off-by: Giovanni Gherdovich +--- + drivers/cpufreq/intel_pstate.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -1970,6 +1970,7 @@ static const struct x86_cpu_id intel_pst + X86_MATCH(ATOM_GOLDMONT, core_funcs), + X86_MATCH(ATOM_GOLDMONT_PLUS, core_funcs), + X86_MATCH(SKYLAKE_X, core_funcs), ++ X86_MATCH(ICELAKE_X, core_funcs), + {} + }; + MODULE_DEVICE_TABLE(x86cpu, intel_pstate_cpu_ids); diff --git a/patches.suse/cxgb4-Fix-unintentional-sign-extension-issues.patch b/patches.suse/cxgb4-Fix-unintentional-sign-extension-issues.patch new file mode 100644 index 0000000..31d1f5d --- /dev/null +++ b/patches.suse/cxgb4-Fix-unintentional-sign-extension-issues.patch @@ -0,0 +1,108 @@ +From: Colin Ian King +Date: Fri, 9 Apr 2021 12:08:57 +0100 +Subject: cxgb4: Fix unintentional sign extension issues +Patch-mainline: v5.13-rc1 +Git-commit: dd2c79677375c37f8f9f8d663eb4708495d595ef +References: git-fixes + +The shifting of the u8 integers f->fs.nat_lip[] by 24 bits to +the left will be promoted to a 32 bit signed int and then +sign-extended to a u64. In the event that the top bit of the u8 +is set then all then all the upper 32 bits of the u64 end up as +also being set because of the sign-extension. Fix this by +casting the u8 values to a u64 before the 24 bit left shift. + +Addresses-Coverity: ("Unintended sign extension") +Fixes: 12b276fbf6e0 ("cxgb4: add support to create hash filters") +Signed-off-by: Colin Ian King +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c +@@ -174,31 +174,31 @@ static void set_nat_params(struct adapte + WORD_MASK, f->fs.nat_lip[15] | + f->fs.nat_lip[14] << 8 | + f->fs.nat_lip[13] << 16 | +- f->fs.nat_lip[12] << 24, 1); ++ (u64)f->fs.nat_lip[12] << 24, 1); + + set_tcb_field(adap, f, tid, TCB_SND_UNA_RAW_W + 1, + WORD_MASK, f->fs.nat_lip[11] | + f->fs.nat_lip[10] << 8 | + f->fs.nat_lip[9] << 16 | +- f->fs.nat_lip[8] << 24, 1); ++ (u64)f->fs.nat_lip[8] << 24, 1); + + set_tcb_field(adap, f, tid, TCB_SND_UNA_RAW_W + 2, + WORD_MASK, f->fs.nat_lip[7] | + f->fs.nat_lip[6] << 8 | + f->fs.nat_lip[5] << 16 | +- f->fs.nat_lip[4] << 24, 1); ++ (u64)f->fs.nat_lip[4] << 24, 1); + + set_tcb_field(adap, f, tid, TCB_SND_UNA_RAW_W + 3, + WORD_MASK, f->fs.nat_lip[3] | + f->fs.nat_lip[2] << 8 | + f->fs.nat_lip[1] << 16 | +- f->fs.nat_lip[0] << 24, 1); ++ (u64)f->fs.nat_lip[0] << 24, 1); + } else { + set_tcb_field(adap, f, tid, TCB_RX_FRAG3_LEN_RAW_W, + WORD_MASK, f->fs.nat_lip[3] | + f->fs.nat_lip[2] << 8 | + f->fs.nat_lip[1] << 16 | +- f->fs.nat_lip[0] << 24, 1); ++ (u64)f->fs.nat_lip[0] << 25, 1); + } + } + +@@ -208,25 +208,25 @@ static void set_nat_params(struct adapte + WORD_MASK, f->fs.nat_fip[15] | + f->fs.nat_fip[14] << 8 | + f->fs.nat_fip[13] << 16 | +- f->fs.nat_fip[12] << 24, 1); ++ (u64)f->fs.nat_fip[12] << 24, 1); + + set_tcb_field(adap, f, tid, TCB_RX_FRAG2_PTR_RAW_W + 1, + WORD_MASK, f->fs.nat_fip[11] | + f->fs.nat_fip[10] << 8 | + f->fs.nat_fip[9] << 16 | +- f->fs.nat_fip[8] << 24, 1); ++ (u64)f->fs.nat_fip[8] << 24, 1); + + set_tcb_field(adap, f, tid, TCB_RX_FRAG2_PTR_RAW_W + 2, + WORD_MASK, f->fs.nat_fip[7] | + f->fs.nat_fip[6] << 8 | + f->fs.nat_fip[5] << 16 | +- f->fs.nat_fip[4] << 24, 1); ++ (u64)f->fs.nat_fip[4] << 24, 1); + + set_tcb_field(adap, f, tid, TCB_RX_FRAG2_PTR_RAW_W + 3, + WORD_MASK, f->fs.nat_fip[3] | + f->fs.nat_fip[2] << 8 | + f->fs.nat_fip[1] << 16 | +- f->fs.nat_fip[0] << 24, 1); ++ (u64)f->fs.nat_fip[0] << 24, 1); + + } else { + set_tcb_field(adap, f, tid, +@@ -234,13 +234,13 @@ static void set_nat_params(struct adapte + WORD_MASK, f->fs.nat_fip[3] | + f->fs.nat_fip[2] << 8 | + f->fs.nat_fip[1] << 16 | +- f->fs.nat_fip[0] << 24, 1); ++ (u64)f->fs.nat_fip[0] << 24, 1); + } + } + + set_tcb_field(adap, f, tid, TCB_PDU_HDR_LEN_W, WORD_MASK, + (dp ? (nat_lp[1] | nat_lp[0] << 8) : 0) | +- (sp ? (nat_fp[1] << 16 | nat_fp[0] << 24) : 0), ++ (sp ? (nat_fp[1] << 16 | (u64)nat_fp[0] << 24) : 0), + 1); + } + diff --git a/patches.suse/dm-avoid-filesystem-lookup-in-dm_get_dev_t.patch b/patches.suse/dm-avoid-filesystem-lookup-in-dm_get_dev_t.patch new file mode 100644 index 0000000..df164ce --- /dev/null +++ b/patches.suse/dm-avoid-filesystem-lookup-in-dm_get_dev_t.patch @@ -0,0 +1,68 @@ +From: Hannes Reinecke +Date: Thu, 21 Jan 2021 18:50:56 +0100 +Subject: [PATCH] dm: avoid filesystem lookup in dm_get_dev_t() +Git-commit: 809b1e4945774c9ec5619a8f4e2189b7b3833c0c +Patch-mainline: v5.11-rc5 +References: git-fixes + +This reverts commit +644bda6f3460 ("dm table: fall back to getting device using name_to_dev_t()") + +dm_get_dev_t() is just used to convert an arbitrary 'path' string +into a dev_t. It doesn't presume that the device is present; that +check will be done later, as the only caller is dm_get_device(), +which does a dm_get_table_device() later on, which will properly +open the device. + +So if the path string already _is_ in major:minor representation +we can convert it directly, avoiding a recursion into the filesystem +to lookup the block device. + +This avoids a hang in multipath_message() when the filesystem is +inaccessible. + +Fixes: 644bda6f3460 ("dm table: fall back to getting device using name_to_dev_t()") +Cc: stable@vger.kernel.org +Signed-off-by: Hannes Reinecke +Signed-off-by: Martin Wilck +Reviewed-by: Christoph Hellwig +Signed-off-by: Mike Snitzer +Acked-by: Hannes Reinecke +--- + drivers/md/dm-table.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c +index 188f41287f18..4acf2342f7ad 100644 +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -363,14 +363,23 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode, + { + int r; + dev_t dev; ++ unsigned int major, minor; ++ char dummy; + struct dm_dev_internal *dd; + struct dm_table *t = ti->table; + + BUG_ON(!t); + +- dev = dm_get_dev_t(path); +- if (!dev) +- return -ENODEV; ++ if (sscanf(path, "%u:%u%c", &major, &minor, &dummy) == 2) { ++ /* Extract the major/minor numbers */ ++ dev = MKDEV(major, minor); ++ if (MAJOR(dev) != major || MINOR(dev) != minor) ++ return -EOVERFLOW; ++ } else { ++ dev = dm_get_dev_t(path); ++ if (!dev) ++ return -ENODEV; ++ } + + dd = find_device(&t->devices, dev); + if (!dd) { +-- +2.29.2 + diff --git a/patches.suse/drm-amd-display-Reject-non-zero-src_y-and-src_x-for-.patch b/patches.suse/drm-amd-display-Reject-non-zero-src_y-and-src_x-for-.patch new file mode 100644 index 0000000..1c51fbd --- /dev/null +++ b/patches.suse/drm-amd-display-Reject-non-zero-src_y-and-src_x-for-.patch @@ -0,0 +1,74 @@ +From d89f6048bdcb6a56abb396c584747d5eeae650db Mon Sep 17 00:00:00 2001 +From: Harry Wentland +Date: Thu, 22 Apr 2021 19:10:52 -0400 +Subject: [PATCH] drm/amd/display: Reject non-zero src_y and src_x for video planes +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: d89f6048bdcb6a56abb396c584747d5eeae650db +Patch-mainline: v5.13-rc1 +References: git-fixes + +[Why] +This hasn't been well tested and leads to complete system hangs on DCN1 +based systems, possibly others. + +The system hang can be reproduced by gesturing the video on the YouTube +Android app on ChromeOS into full screen. + +[How] +Reject atomic commits with non-zero drm_plane_state.src_x or src_y values. + +V2: - Add code comment describing the reason we're rejecting non-zero src_x and src_y - Drop gerrit Change-Id - Add stable CC - Based on amd-staging-drm-next + +V3: removed trailing whitespace + +Signed-off-by: Harry Wentland +Cc: stable@vger.kernel.org +Cc: nicholas.kazlauskas@amd.com +Cc: amd-gfx@lists.freedesktop.org +Cc: alexander.deucher@amd.com +Cc: Roman.Li@amd.com +Cc: hersenxs.wu@amd.com +Cc: danny.wang@amd.com +Reviewed-by: Nicholas Kazlauskas +Acked-by: Christian König +Reviewed-by: Hersen Wu +Signed-off-by: Alex Deucher +Acked-by: Takashi Iwai + +--- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index a0c8c41e4e57..deec7e0466da 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -4008,6 +4008,23 @@ static int fill_dc_scaling_info(const struct drm_plane_state *state, + scaling_info->src_rect.x = state->src_x >> 16; + scaling_info->src_rect.y = state->src_y >> 16; + ++ /* ++ * For reasons we don't (yet) fully understand a non-zero ++ * src_y coordinate into an NV12 buffer can cause a ++ * system hang. To avoid hangs (and maybe be overly cautious) ++ * let's reject both non-zero src_x and src_y. ++ * ++ * We currently know of only one use-case to reproduce a ++ * scenario with non-zero src_x and src_y for NV12, which ++ * is to gesture the YouTube Android app into full screen ++ * on ChromeOS. ++ */ ++ if (state->fb && ++ state->fb->format->format == DRM_FORMAT_NV12 && ++ (scaling_info->src_rect.x != 0 || ++ scaling_info->src_rect.y != 0)) ++ return -EINVAL; ++ + scaling_info->src_rect.width = state->src_w >> 16; + if (scaling_info->src_rect.width == 0) + return -EINVAL; +-- +2.26.2 + diff --git a/patches.suse/ethernet-enic-Fix-a-use-after-free-bug-in-enic_hard_.patch b/patches.suse/ethernet-enic-Fix-a-use-after-free-bug-in-enic_hard_.patch new file mode 100644 index 0000000..e6c91f9 --- /dev/null +++ b/patches.suse/ethernet-enic-Fix-a-use-after-free-bug-in-enic_hard_.patch @@ -0,0 +1,62 @@ +From: Lv Yunlong +Date: Sun, 2 May 2021 04:58:18 -0700 +Subject: ethernet:enic: Fix a use after free bug in enic_hard_start_xmit +Patch-mainline: v5.13-rc1 +Git-commit: 643001b47adc844ae33510c4bb93c236667008a3 +References: git-fixes + +In enic_hard_start_xmit, it calls enic_queue_wq_skb(). Inside +enic_queue_wq_skb, if some error happens, the skb will be freed +by dev_kfree_skb(skb). But the freed skb is still used in +skb_tx_timestamp(skb). + +My patch makes enic_queue_wq_skb() return error and goto spin_unlock() +incase of error. The solution is provided by Govind. +See https://lkml.org/lkml/2021/4/30/961. + +Fixes: fb7516d42478e ("enic: add sw timestamp support") +Signed-off-by: Lv Yunlong +Acked-by: Govindarajulu Varadarajan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/cisco/enic/enic_main.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/cisco/enic/enic_main.c ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c +@@ -803,7 +803,7 @@ static inline int enic_queue_wq_skb_enca + return err; + } + +-static inline void enic_queue_wq_skb(struct enic *enic, ++static inline int enic_queue_wq_skb(struct enic *enic, + struct vnic_wq *wq, struct sk_buff *skb) + { + unsigned int mss = skb_shinfo(skb)->gso_size; +@@ -849,6 +849,7 @@ static inline void enic_queue_wq_skb(str + wq->to_use = buf->next; + dev_kfree_skb(skb); + } ++ return err; + } + + /* netif_tx_lock held, process context with BHs disabled, or BH */ +@@ -892,7 +893,8 @@ static netdev_tx_t enic_hard_start_xmit( + return NETDEV_TX_BUSY; + } + +- enic_queue_wq_skb(enic, wq, skb); ++ if (enic_queue_wq_skb(enic, wq, skb)) ++ goto error; + + if (vnic_wq_desc_avail(wq) < MAX_SKB_FRAGS + ENIC_DESC_MAX_SPLITS) + netif_tx_stop_queue(txq); +@@ -900,6 +902,7 @@ static netdev_tx_t enic_hard_start_xmit( + if (!netdev_xmit_more() || netif_xmit_stopped(txq)) + vnic_wq_doorbell(wq); + ++error: + spin_unlock(&enic->wq_lock[txq_map]); + + return NETDEV_TX_OK; diff --git a/patches.suse/genirq-Disable-interrupts-for-force-threaded-handler.patch b/patches.suse/genirq-Disable-interrupts-for-force-threaded-handler.patch new file mode 100644 index 0000000..01ce13a --- /dev/null +++ b/patches.suse/genirq-Disable-interrupts-for-force-threaded-handler.patch @@ -0,0 +1,74 @@ +From 81e2073c175b887398e5bca6c004efa89983f58d Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Wed, 17 Mar 2021 15:38:52 +0100 +Subject: [PATCH] genirq: Disable interrupts for force threaded handlers +Git-commit: 81e2073c175b887398e5bca6c004efa89983f58d +Patch-mainline: v5.12-rc4 +References: git-fixes + +With interrupt force threading all device interrupt handlers are invoked +from kernel threads. Contrary to hard interrupt context the invocation only +disables bottom halfs, but not interrupts. This was an oversight back then +because any code like this will have an issue: + +thread(irq_A) + irq_handler(A) + spin_lock(&foo->lock); + +interrupt(irq_B) + irq_handler(B) + spin_lock(&foo->lock); + +This has been triggered with networking (NAPI vs. hrtimers) and console +drivers where printk() happens from an interrupt which interrupted the +force threaded handler. + +Now people noticed and started to change the spin_lock() in the handler to +spin_lock_irqsave() which affects performance or add IRQF_NOTHREAD to the +interrupt request which in turn breaks RT. + +Fix the root cause and not the symptom and disable interrupts before +invoking the force threaded handler which preserves the regular semantics +and the usefulness of the interrupt force threading as a general debugging +tool. + +For not RT this is not changing much, except that during the execution of +the threaded handler interrupts are delayed until the handler +returns. Vs. scheduling and softirq processing there is no difference. + +For RT kernels there is no issue. + +Fixes: 8d32a307e4fa ("genirq: Provide forced interrupt threading") +Reported-by: Johan Hovold +Signed-off-by: Thomas Gleixner +Reviewed-by: Johan Hovold +Acked-by: Sebastian Andrzej Siewior +Link: https://lore.kernel.org/r/20210317143859.513307808@linutronix.de +Signed-off-by: Frederic Weisbecker +--- + kernel/irq/manage.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c +index dec3f73e8db9..21ea370fccda 100644 +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -1142,11 +1142,15 @@ irq_forced_thread_fn(struct irq_desc *desc, struct irqaction *action) + irqreturn_t ret; + + local_bh_disable(); ++ if (!IS_ENABLED(CONFIG_PREEMPT_RT)) ++ local_irq_disable(); + ret = action->thread_fn(action->irq, action->dev_id); + if (ret == IRQ_HANDLED) + atomic_inc(&desc->threads_handled); + + irq_finalize_oneshot(desc, action); ++ if (!IS_ENABLED(CONFIG_PREEMPT_RT)) ++ local_irq_enable(); + local_bh_enable(); + return ret; + } +-- +2.25.1 + diff --git a/patches.suse/genirq-irqdomain-Don-t-try-to-free-an-interrupt-that.patch b/patches.suse/genirq-irqdomain-Don-t-try-to-free-an-interrupt-that.patch new file mode 100644 index 0000000..f3803c4 --- /dev/null +++ b/patches.suse/genirq-irqdomain-Don-t-try-to-free-an-interrupt-that.patch @@ -0,0 +1,55 @@ +From 4615fbc3788ddc8e7c6d697714ad35a53729aa2c Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Sun, 29 Nov 2020 13:55:51 +0000 +Subject: [PATCH] genirq/irqdomain: Don't try to free an interrupt that has no + mapping +Git-commit: 4615fbc3788ddc8e7c6d697714ad35a53729aa2c +Patch-mainline: v5.11-rc1 +References: git-fixes + +When an interrupt allocation fails for N interrupts, it is pretty +common for the error handling code to free the same number of interrupts, +no matter how many interrupts have actually been allocated. + +This may result in the domain freeing code to be unexpectedly called +for interrupts that have no mapping in that domain. Things end pretty +badly. + +Instead, add some checks to irq_domain_free_irqs_hierarchy() to make sure +that thiss does not follow the hierarchy if no mapping exists for a given +interrupt. + +Fixes: 6a6544e520abe ("genirq/irqdomain: Remove auto-recursive hierarchy support") +Signed-off-by: Marc Zyngier +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20201129135551.396777-1-maz@kernel.org +Signed-off-by: Frederic Weisbecker +--- + kernel/irq/irqdomain.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c +index 3d7463fd6453..30a78872a5cf 100644 +--- a/kernel/irq/irqdomain.c ++++ b/kernel/irq/irqdomain.c +@@ -1381,8 +1381,15 @@ static void irq_domain_free_irqs_hierarchy(struct irq_domain *domain, + unsigned int irq_base, + unsigned int nr_irqs) + { +- if (domain->ops->free) +- domain->ops->free(domain, irq_base, nr_irqs); ++ unsigned int i; ++ ++ if (!domain->ops->free) ++ return; ++ ++ for (i = 0; i < nr_irqs; i++) { ++ if (irq_domain_get_irq_data(domain, irq_base + i)) ++ domain->ops->free(domain, irq_base + i, 1); ++ } + } + + int irq_domain_alloc_irqs_hierarchy(struct irq_domain *domain, +-- +2.25.1 + diff --git a/patches.suse/hrtimer-Update-softirq_expires_next-correctly-after-.patch b/patches.suse/hrtimer-Update-softirq_expires_next-correctly-after-.patch new file mode 100644 index 0000000..20cd58b --- /dev/null +++ b/patches.suse/hrtimer-Update-softirq_expires_next-correctly-after-.patch @@ -0,0 +1,154 @@ +From 46eb1701c046cc18c032fa68f3c8ccbf24483ee4 Mon Sep 17 00:00:00 2001 +From: Anna-Maria Behnsen +Date: Tue, 23 Feb 2021 17:02:40 +0100 +Subject: [PATCH] hrtimer: Update softirq_expires_next correctly after + __hrtimer_get_next_event() +Git-commit: 46eb1701c046cc18c032fa68f3c8ccbf24483ee4 +Patch-mainline: v5.12-rc3 +References: git-fixes + +hrtimer_force_reprogram() and hrtimer_interrupt() invokes +__hrtimer_get_next_event() to find the earliest expiry time of hrtimer +bases. __hrtimer_get_next_event() does not update +cpu_base::[softirq_]_expires_next to preserve reprogramming logic. That +needs to be done at the callsites. + +hrtimer_force_reprogram() updates cpu_base::softirq_expires_next only when +the first expiring timer is a softirq timer and the soft interrupt is not +activated. That's wrong because cpu_base::softirq_expires_next is left +stale when the first expiring timer of all bases is a timer which expires +in hard interrupt context. hrtimer_interrupt() does never update +cpu_base::softirq_expires_next which is wrong too. + +That becomes a problem when clock_settime() sets CLOCK_REALTIME forward and +the first soft expiring timer is in the CLOCK_REALTIME_SOFT base. Setting +CLOCK_REALTIME forward moves the clock MONOTONIC based expiry time of that +timer before the stale cpu_base::softirq_expires_next. + +cpu_base::softirq_expires_next is cached to make the check for raising the +soft interrupt fast. In the above case the soft interrupt won't be raised +until clock monotonic reaches the stale cpu_base::softirq_expires_next +value. That's incorrect, but what's worse it that if the softirq timer +becomes the first expiring timer of all clock bases after the hard expiry +timer has been handled the reprogramming of the clockevent from +hrtimer_interrupt() will result in an interrupt storm. That happens because +the reprogramming does not use cpu_base::softirq_expires_next, it uses +__hrtimer_get_next_event() which returns the actual expiry time. Once clock +MONOTONIC reaches cpu_base::softirq_expires_next the soft interrupt is +raised and the storm subsides. + +Change the logic in hrtimer_force_reprogram() to evaluate the soft and hard +bases seperately, update softirq_expires_next and handle the case when a +soft expiring timer is the first of all bases by comparing the expiry times +and updating the required cpu base fields. Split this functionality into a +separate function to be able to use it in hrtimer_interrupt() as well +without copy paste. + +Fixes: 5da70160462e ("hrtimer: Implement support for softirq based hrtimers") +Reported-by: Mikael Beckius +Suggested-by: Thomas Gleixner +Tested-by: Mikael Beckius +Signed-off-by: Anna-Maria Behnsen +Signed-off-by: Thomas Gleixner +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20210223160240.27518-1-anna-maria@linutronix.de +Signed-off-by: Frederic Weisbecker +--- + kernel/time/hrtimer.c | 60 ++++++++++++++++++++++++++++--------------- + 1 file changed, 39 insertions(+), 21 deletions(-) + +diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c +index 743c852e10f2..788b9d137de4 100644 +--- a/kernel/time/hrtimer.c ++++ b/kernel/time/hrtimer.c +@@ -546,8 +546,11 @@ static ktime_t __hrtimer_next_event_base(struct hrtimer_cpu_base *cpu_base, + } + + /* +- * Recomputes cpu_base::*next_timer and returns the earliest expires_next but +- * does not set cpu_base::*expires_next, that is done by hrtimer_reprogram. ++ * Recomputes cpu_base::*next_timer and returns the earliest expires_next ++ * but does not set cpu_base::*expires_next, that is done by ++ * hrtimer[_force]_reprogram and hrtimer_interrupt only. When updating ++ * cpu_base::*expires_next right away, reprogramming logic would no longer ++ * work. + * + * When a softirq is pending, we can ignore the HRTIMER_ACTIVE_SOFT bases, + * those timers will get run whenever the softirq gets handled, at the end of +@@ -588,6 +591,37 @@ __hrtimer_get_next_event(struct hrtimer_cpu_base *cpu_base, unsigned int active_ + return expires_next; + } + ++static ktime_t hrtimer_update_next_event(struct hrtimer_cpu_base *cpu_base) ++{ ++ ktime_t expires_next, soft = KTIME_MAX; ++ ++ /* ++ * If the soft interrupt has already been activated, ignore the ++ * soft bases. They will be handled in the already raised soft ++ * interrupt. ++ */ ++ if (!cpu_base->softirq_activated) { ++ soft = __hrtimer_get_next_event(cpu_base, HRTIMER_ACTIVE_SOFT); ++ /* ++ * Update the soft expiry time. clock_settime() might have ++ * affected it. ++ */ ++ cpu_base->softirq_expires_next = soft; ++ } ++ ++ expires_next = __hrtimer_get_next_event(cpu_base, HRTIMER_ACTIVE_HARD); ++ /* ++ * If a softirq timer is expiring first, update cpu_base->next_timer ++ * and program the hardware with the soft expiry time. ++ */ ++ if (expires_next > soft) { ++ cpu_base->next_timer = cpu_base->softirq_next_timer; ++ expires_next = soft; ++ } ++ ++ return expires_next; ++} ++ + static inline ktime_t hrtimer_update_base(struct hrtimer_cpu_base *base) + { + ktime_t *offs_real = &base->clock_base[HRTIMER_BASE_REALTIME].offset; +@@ -628,23 +662,7 @@ hrtimer_force_reprogram(struct hrtimer_cpu_base *cpu_base, int skip_equal) + { + ktime_t expires_next; + +- /* +- * Find the current next expiration time. +- */ +- expires_next = __hrtimer_get_next_event(cpu_base, HRTIMER_ACTIVE_ALL); +- +- if (cpu_base->next_timer && cpu_base->next_timer->is_soft) { +- /* +- * When the softirq is activated, hrtimer has to be +- * programmed with the first hard hrtimer because soft +- * timer interrupt could occur too late. +- */ +- if (cpu_base->softirq_activated) +- expires_next = __hrtimer_get_next_event(cpu_base, +- HRTIMER_ACTIVE_HARD); +- else +- cpu_base->softirq_expires_next = expires_next; +- } ++ expires_next = hrtimer_update_next_event(cpu_base); + + if (skip_equal && expires_next == cpu_base->expires_next) + return; +@@ -1644,8 +1662,8 @@ retry: + + __hrtimer_run_queues(cpu_base, now, flags, HRTIMER_ACTIVE_HARD); + +- /* Reevaluate the clock bases for the next expiry */ +- expires_next = __hrtimer_get_next_event(cpu_base, HRTIMER_ACTIVE_ALL); ++ /* Reevaluate the clock bases for the [soft] next expiry */ ++ expires_next = hrtimer_update_next_event(cpu_base); + /* + * Store the new expiry value so the migration code can verify + * against it. +-- +2.25.1 + diff --git a/patches.suse/i40e-Fix-PHY-type-identifiers-for-2.5G-and-5G-adapte.patch b/patches.suse/i40e-Fix-PHY-type-identifiers-for-2.5G-and-5G-adapte.patch new file mode 100644 index 0000000..a59886d --- /dev/null +++ b/patches.suse/i40e-Fix-PHY-type-identifiers-for-2.5G-and-5G-adapte.patch @@ -0,0 +1,83 @@ +From: Mateusz Palczewski +Date: Tue, 13 Apr 2021 14:43:07 +0000 +Subject: i40e: Fix PHY type identifiers for 2.5G and 5G adapters +Patch-mainline: v5.13-rc1 +Git-commit: 15395ec4685bd45a43d1b54b8fd9846b87e2c621 +References: git-fixes + +Unlike other supported adapters, 2.5G and 5G use different +PHY type identifiers for reading/writing PHY settings +and for reading link status. This commit introduces +separate PHY identifiers for these two operation types. + +Fixes: 2e45d3f4677a ("i40e: Add support for X710 B/P & SFP+ cards") +Signed-off-by: Dawid Lukwinski +Signed-off-by: Mateusz Palczewski +Reviewed-by: Aleksandr Loktionov +Tested-by: Dave Switzer +Signed-off-by: Tony Nguyen +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h | 6 ++++-- + drivers/net/ethernet/intel/i40e/i40e_common.c | 4 ++-- + drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 4 ++-- + drivers/net/ethernet/intel/i40e/i40e_type.h | 7 ++----- + 4 files changed, 10 insertions(+), 11 deletions(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h +@@ -1893,8 +1893,10 @@ enum i40e_aq_phy_type { + I40E_PHY_TYPE_25GBASE_LR = 0x22, + I40E_PHY_TYPE_25GBASE_AOC = 0x23, + I40E_PHY_TYPE_25GBASE_ACC = 0x24, +- I40E_PHY_TYPE_2_5GBASE_T = 0x30, +- I40E_PHY_TYPE_5GBASE_T = 0x31, ++ I40E_PHY_TYPE_2_5GBASE_T = 0x26, ++ I40E_PHY_TYPE_5GBASE_T = 0x27, ++ I40E_PHY_TYPE_2_5GBASE_T_LINK_STATUS = 0x30, ++ I40E_PHY_TYPE_5GBASE_T_LINK_STATUS = 0x31, + I40E_PHY_TYPE_MAX, + I40E_PHY_TYPE_NOT_SUPPORTED_HIGH_TEMP = 0xFD, + I40E_PHY_TYPE_EMPTY = 0xFE, +--- a/drivers/net/ethernet/intel/i40e/i40e_common.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c +@@ -1153,8 +1153,8 @@ static enum i40e_media_type i40e_get_med + break; + case I40E_PHY_TYPE_100BASE_TX: + case I40E_PHY_TYPE_1000BASE_T: +- case I40E_PHY_TYPE_2_5GBASE_T: +- case I40E_PHY_TYPE_5GBASE_T: ++ case I40E_PHY_TYPE_2_5GBASE_T_LINK_STATUS: ++ case I40E_PHY_TYPE_5GBASE_T_LINK_STATUS: + case I40E_PHY_TYPE_10GBASE_T: + media = I40E_MEDIA_TYPE_BASET; + break; +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -839,8 +839,8 @@ static void i40e_get_settings_link_up(st + 10000baseT_Full); + break; + case I40E_PHY_TYPE_10GBASE_T: +- case I40E_PHY_TYPE_5GBASE_T: +- case I40E_PHY_TYPE_2_5GBASE_T: ++ case I40E_PHY_TYPE_5GBASE_T_LINK_STATUS: ++ case I40E_PHY_TYPE_2_5GBASE_T_LINK_STATUS: + case I40E_PHY_TYPE_1000BASE_T: + case I40E_PHY_TYPE_100BASE_TX: + ethtool_link_ksettings_add_link_mode(ks, supported, Autoneg); +--- a/drivers/net/ethernet/intel/i40e/i40e_type.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_type.h +@@ -253,11 +253,8 @@ struct i40e_phy_info { + #define I40E_CAP_PHY_TYPE_25GBASE_ACC BIT_ULL(I40E_PHY_TYPE_25GBASE_ACC + \ + I40E_PHY_TYPE_OFFSET) + /* Offset for 2.5G/5G PHY Types value to bit number conversion */ +-#define I40E_PHY_TYPE_OFFSET2 (-10) +-#define I40E_CAP_PHY_TYPE_2_5GBASE_T BIT_ULL(I40E_PHY_TYPE_2_5GBASE_T + \ +- I40E_PHY_TYPE_OFFSET2) +-#define I40E_CAP_PHY_TYPE_5GBASE_T BIT_ULL(I40E_PHY_TYPE_5GBASE_T + \ +- I40E_PHY_TYPE_OFFSET2) ++#define I40E_CAP_PHY_TYPE_2_5GBASE_T BIT_ULL(I40E_PHY_TYPE_2_5GBASE_T) ++#define I40E_CAP_PHY_TYPE_5GBASE_T BIT_ULL(I40E_PHY_TYPE_5GBASE_T) + #define I40E_HW_CAP_MAX_GPIO 30 + /* Capabilities of a PF or a VF or the whole device */ + struct i40e_hw_capabilities { diff --git a/patches.suse/i40e-Fix-use-after-free-in-i40e_client_subtask.patch b/patches.suse/i40e-Fix-use-after-free-in-i40e_client_subtask.patch new file mode 100644 index 0000000..fc79bc5 --- /dev/null +++ b/patches.suse/i40e-Fix-use-after-free-in-i40e_client_subtask.patch @@ -0,0 +1,30 @@ +From: Yunjian Wang +Date: Mon, 12 Apr 2021 22:41:18 +0800 +Subject: i40e: Fix use-after-free in i40e_client_subtask() +Patch-mainline: v5.13-rc1 +Git-commit: 38318f23a7ef86a8b1862e5e8078c4de121960c3 +References: git-fixes + +Currently the call to i40e_client_del_instance frees the object +pf->cinst, however pf->cinst->lan_info is being accessed after +the free. Fix this by adding the missing return. + +Addresses-Coverity: ("Read from pointer after free") +Fixes: 7b0b1a6d0ac9 ("i40e: Disable iWARP VSI PETCP_ENA flag on netdev down events") +Signed-off-by: Yunjian Wang +Signed-off-by: Tony Nguyen +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/intel/i40e/i40e_client.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/intel/i40e/i40e_client.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_client.c +@@ -377,6 +377,7 @@ void i40e_client_subtask(struct i40e_pf + clear_bit(__I40E_CLIENT_INSTANCE_OPENED, + &cdev->state); + i40e_client_del_instance(pf); ++ return; + } + } + } diff --git a/patches.suse/i40e-fix-broken-XDP-support.patch b/patches.suse/i40e-fix-broken-XDP-support.patch new file mode 100644 index 0000000..e4abeb1 --- /dev/null +++ b/patches.suse/i40e-fix-broken-XDP-support.patch @@ -0,0 +1,70 @@ +From: Magnus Karlsson +Date: Mon, 26 Apr 2021 13:14:01 +0200 +Subject: i40e: fix broken XDP support +Patch-mainline: v5.13-rc1 +Git-commit: ae4393dfd472b194c90d75d2123105fb5ed59b04 +References: git-fixes + +Commit 12738ac4754e ("i40e: Fix sparse errors in i40e_txrx.c") broke +XDP support in the i40e driver. That commit was fixing a sparse error +in the code by introducing a new variable xdp_res instead of +overloading this into the skb pointer. The problem is that the code +later uses the skb pointer in if statements and these where not +extended to also test for the new xdp_res variable. Fix this by adding +the correct tests for xdp_res in these places. + +The skb pointer was used to store the result of the XDP program by +overloading the results in the error pointer +ERR_PTR(-result). Therefore, the allocation failure test that used to +only test for !skb now need to be extended to also consider !xdp_res. + +i40e_cleanup_headers() had a check that based on the skb value being +an error pointer, i.e. a result from the XDP program != XDP_PASS, and +if so start to process a new packet immediately, instead of populating +skb fields and sending the skb to the stack. This check is not needed +anymore, since we have added an explicit test for xdp_res being set +and if so just do continue to pick the next packet from the NIC. + +Fixes: 12738ac4754e ("i40e: Fix sparse errors in i40e_txrx.c") +Acked-by: Jesper Dangaard Brouer +Tested-by: Jesper Dangaard Brouer +Reported-by: Jesper Dangaard Brouer +Reviewed-by: Maciej Fijalkowski +Signed-off-by: Magnus Karlsson +Signed-off-by: Tony Nguyen +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -1824,10 +1824,6 @@ static bool i40e_cleanup_headers(struct + union i40e_rx_desc *rx_desc) + + { +- /* XDP packets use error pointer so abort at this point */ +- if (IS_ERR(skb)) +- return true; +- + /* ERR_MASK will only have valid bits if EOP set, and + * what we are doing here is actually checking + * I40E_RX_DESC_ERROR_RXE_SHIFT, since it is the zeroth bit in +@@ -2424,7 +2420,7 @@ static int i40e_clean_rx_irq(struct i40e + } + + /* exit if we failed to retrieve a buffer */ +- if (!skb) { ++ if (!xdp_res && !skb) { + rx_ring->rx_stats.alloc_buff_failed++; + rx_buffer->pagecnt_bias++; + break; +@@ -2436,7 +2432,7 @@ static int i40e_clean_rx_irq(struct i40e + if (i40e_is_non_eop(rx_ring, rx_desc, skb)) + continue; + +- if (i40e_cleanup_headers(rx_ring, skb, rx_desc)) { ++ if (xdp_res || i40e_cleanup_headers(rx_ring, skb, rx_desc)) { + skb = NULL; + continue; + } diff --git a/patches.suse/i40e-fix-the-restart-auto-negotiation-after-FEC-modi.patch b/patches.suse/i40e-fix-the-restart-auto-negotiation-after-FEC-modi.patch new file mode 100644 index 0000000..591bfd4 --- /dev/null +++ b/patches.suse/i40e-fix-the-restart-auto-negotiation-after-FEC-modi.patch @@ -0,0 +1,34 @@ +From: Jaroslaw Gawin +Date: Tue, 13 Apr 2021 14:19:40 +0000 +Subject: i40e: fix the restart auto-negotiation after FEC modified +Patch-mainline: v5.13-rc1 +Git-commit: 61343e6da7810de81d6b826698946ae4f9070819 +References: git-fixes + +When FEC mode was changed the link didn't know it because +the link was not reset and new parameters were not negotiated. +Set a flag 'I40E_AQ_PHY_ENABLE_ATOMIC_LINK' in 'abilities' +to restart the link and make it run with the new settings. + +Fixes: 1d96340196f1 ("i40e: Add support FEC configuration for Fortville 25G") +Signed-off-by: Jaroslaw Gawin +Signed-off-by: Mateusz Palczewski +Tested-by: Dave Switzer +Signed-off-by: Tony Nguyen +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -1406,7 +1406,8 @@ static int i40e_set_fec_cfg(struct net_d + + memset(&config, 0, sizeof(config)); + config.phy_type = abilities.phy_type; +- config.abilities = abilities.abilities; ++ config.abilities = abilities.abilities | ++ I40E_AQ_PHY_ENABLE_ATOMIC_LINK; + config.phy_type_ext = abilities.phy_type_ext; + config.link_speed = abilities.link_speed; + config.eee_capability = abilities.eee_capability; diff --git a/patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch b/patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch new file mode 100644 index 0000000..d90f1d3 --- /dev/null +++ b/patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch @@ -0,0 +1,59 @@ +From 07b5dc1d515a9a9b3973e0bdc716a78adf6db8f8 Mon Sep 17 00:00:00 2001 +From: Michal Suchanek +Date: Thu, 20 May 2021 08:50:34 +0200 +Subject: [PATCH] ibmvnic: remove default label from to_string switch + +References: bsc#1152457 ltc#174432 git-fixes +Patch-mainline: queued +Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git +Git-commit: 07b5dc1d515a9a9b3973e0bdc716a78adf6db8f8 + +This way the compiler warns when a new value is added to the enum but +not to the string translation like: + +drivers/net/ethernet/ibm/ibmvnic.c: In function 'adapter_state_to_string': +drivers/net/ethernet/ibm/ibmvnic.c:832:2: warning: enumeration value 'VNIC_FOOBAR' not handled in switch [-Wswitch] + switch (state) { + ^~~~~~ +drivers/net/ethernet/ibm/ibmvnic.c: In function 'reset_reason_to_string': +drivers/net/ethernet/ibm/ibmvnic.c:1935:2: warning: enumeration value 'VNIC_RESET_FOOBAR' not handled in switch [-Wswitch] + switch (reason) { + ^~~~~~ + +Signed-off-by: Michal Suchanek +Acked-by: Lijun Pan +Link: https://lore.kernel.org/netdev/CAOhMmr701LecfuNM+EozqbiTxFvDiXjFdY2aYeKJYaXq9kqVDg@mail.gmail.com/ +Signed-off-by: David S. Miller +--- + drivers/net/ethernet/ibm/ibmvnic.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 5788bb956d73..4d439413f6d9 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -846,9 +846,8 @@ static const char *adapter_state_to_string(enum vnic_state state) + return "REMOVING"; + case VNIC_REMOVED: + return "REMOVED"; +- default: +- return "UNKNOWN"; + } ++ return "UNKNOWN"; + } + + static int ibmvnic_login(struct net_device *netdev) +@@ -1946,9 +1945,8 @@ static const char *reset_reason_to_string(enum ibmvnic_reset_reason reason) + return "TIMEOUT"; + case VNIC_RESET_CHANGE_PARAM: + return "CHANGE_PARAM"; +- default: +- return "UNKNOWN"; + } ++ return "UNKNOWN"; + } + + /* +-- +2.26.2 + diff --git a/patches.suse/iio-gyro-mpu3050-Fix-reported-temperature-value.patch b/patches.suse/iio-gyro-mpu3050-Fix-reported-temperature-value.patch new file mode 100644 index 0000000..52f7d03 --- /dev/null +++ b/patches.suse/iio-gyro-mpu3050-Fix-reported-temperature-value.patch @@ -0,0 +1,64 @@ +From f73c730774d88a14d7b60feee6d0e13570f99499 Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Fri, 23 Apr 2021 05:09:59 +0300 +Subject: [PATCH] iio: gyro: mpu3050: Fix reported temperature value +Git-commit: f73c730774d88a14d7b60feee6d0e13570f99499 +Patch-mainline: v5.13-rc2 +References: git-fixes + +The raw temperature value is a 16-bit signed integer. The sign casting +is missing in the code, which results in a wrong temperature reported +by userspace tools, fix it. + +Cc: stable@vger.kernel.org +Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope") +Datasheet: https://www.cdiweb.com/datasheets/invensense/mpu-3000a.pdf +Tested-by: Maxim Schwalm # Asus TF700T +Tested-by: Svyatoslav Ryhel # Asus TF201 +Reported-by: Svyatoslav Ryhel +Reviewed-by: Andy Shevchenko +Reviewed-by: Linus Walleij +Signed-off-by: Dmitry Osipenko +Acked-by: Jean-Baptiste Maneyrol +Link: https://lore.kernel.org/r/20210423020959.5023-1-digetx@gmail.com +Signed-off-by: Jonathan Cameron +Acked-by: Takashi Iwai + +--- + drivers/iio/gyro/mpu3050-core.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/gyro/mpu3050-core.c b/drivers/iio/gyro/mpu3050-core.c +index ac90be03332a..f17a93519535 100644 +--- a/drivers/iio/gyro/mpu3050-core.c ++++ b/drivers/iio/gyro/mpu3050-core.c +@@ -272,7 +272,16 @@ static int mpu3050_read_raw(struct iio_dev *indio_dev, + case IIO_CHAN_INFO_OFFSET: + switch (chan->type) { + case IIO_TEMP: +- /* The temperature scaling is (x+23000)/280 Celsius */ ++ /* ++ * The temperature scaling is (x+23000)/280 Celsius ++ * for the "best fit straight line" temperature range ++ * of -30C..85C. The 23000 includes room temperature ++ * offset of +35C, 280 is the precision scale and x is ++ * the 16-bit signed integer reported by hardware. ++ * ++ * Temperature value itself represents temperature of ++ * the sensor die. ++ */ + *val = 23000; + return IIO_VAL_INT; + default: +@@ -329,7 +338,7 @@ static int mpu3050_read_raw(struct iio_dev *indio_dev, + goto out_read_raw_unlock; + } + +- *val = be16_to_cpu(raw_val); ++ *val = (s16)be16_to_cpu(raw_val); + ret = IIO_VAL_INT; + + goto out_read_raw_unlock; +-- +2.26.2 + diff --git a/patches.suse/iio-proximity-pulsedlight-Fix-rumtime-PM-imbalance-o.patch b/patches.suse/iio-proximity-pulsedlight-Fix-rumtime-PM-imbalance-o.patch new file mode 100644 index 0000000..ee213ce --- /dev/null +++ b/patches.suse/iio-proximity-pulsedlight-Fix-rumtime-PM-imbalance-o.patch @@ -0,0 +1,37 @@ +From a2fa9242e89f27696515699fe0f0296bf1ac1815 Mon Sep 17 00:00:00 2001 +From: Dinghao Liu +Date: Mon, 12 Apr 2021 13:32:02 +0800 +Subject: [PATCH] iio: proximity: pulsedlight: Fix rumtime PM imbalance on error +Git-commit: a2fa9242e89f27696515699fe0f0296bf1ac1815 +Patch-mainline: v5.13-rc2 +References: git-fixes + +When lidar_write_control() fails, a pairing PM usage counter +decrement is needed to keep the counter balanced. + +Fixes: 4ac4e086fd8c5 ("iio: pulsedlight-lidar-lite: add runtime PM") +Signed-off-by: Dinghao Liu +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210412053204.4889-1-dinghao.liu@zju.edu.cn +Signed-off-by: Jonathan Cameron +Acked-by: Takashi Iwai + +--- + drivers/iio/proximity/pulsedlight-lidar-lite-v2.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c +index c685f10b5ae4..cc206bfa09c7 100644 +--- a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c ++++ b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c +@@ -160,6 +160,7 @@ static int lidar_get_measurement(struct lidar_data *data, u16 *reg) + ret = lidar_write_control(data, LIDAR_REG_CONTROL_ACQUIRE); + if (ret < 0) { + dev_err(&client->dev, "cannot send start measurement command"); ++ pm_runtime_put_noidle(&client->dev); + return ret; + } + +-- +2.26.2 + diff --git a/patches.suse/iio-tsl2583-Fix-division-by-a-zero-lux_val.patch b/patches.suse/iio-tsl2583-Fix-division-by-a-zero-lux_val.patch new file mode 100644 index 0000000..f929b21 --- /dev/null +++ b/patches.suse/iio-tsl2583-Fix-division-by-a-zero-lux_val.patch @@ -0,0 +1,50 @@ +From af0e1871d79cfbb91f732d2c6fa7558e45c31038 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Fri, 7 May 2021 19:30:41 +0100 +Subject: [PATCH] iio: tsl2583: Fix division by a zero lux_val +Git-commit: af0e1871d79cfbb91f732d2c6fa7558e45c31038 +Patch-mainline: v5.13-rc2 +References: git-fixes + +The lux_val returned from tsl2583_get_lux can potentially be zero, +so check for this to avoid a division by zero and an overflowed +gain_trim_val. + +Fixes clang scan-build warning: + +drivers/iio/light/tsl2583.c:345:40: warning: Either the +condition 'lux_val<0' is redundant or there is division +by zero at line 345. [zerodivcond] + +Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver") +Signed-off-by: Colin Ian King +Cc: +Signed-off-by: Jonathan Cameron +Acked-by: Takashi Iwai + +--- + drivers/iio/light/tsl2583.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c +index 0f787bfc88fc..c9d8f07a6fcd 100644 +--- a/drivers/iio/light/tsl2583.c ++++ b/drivers/iio/light/tsl2583.c +@@ -341,6 +341,14 @@ static int tsl2583_als_calibrate(struct iio_dev *indio_dev) + return lux_val; + } + ++ /* Avoid division by zero of lux_value later on */ ++ if (lux_val == 0) { ++ dev_err(&chip->client->dev, ++ "%s: lux_val of 0 will produce out of range trim_value\n", ++ __func__); ++ return -ENODATA; ++ } ++ + gain_trim_val = (unsigned int)(((chip->als_settings.als_cal_target) + * chip->als_settings.als_gain_trim) / lux_val); + if ((gain_trim_val < 250) || (gain_trim_val > 4000)) { +-- +2.26.2 + diff --git a/patches.suse/ipc-mqueue-msg-sem-Avoid-relying-on-a-stack-reference.patch b/patches.suse/ipc-mqueue-msg-sem-Avoid-relying-on-a-stack-reference.patch new file mode 100644 index 0000000..b704bd0 --- /dev/null +++ b/patches.suse/ipc-mqueue-msg-sem-Avoid-relying-on-a-stack-reference.patch @@ -0,0 +1,151 @@ +From 60f611fa216cd0b0395499d703215537ed1f0b44 Mon Sep 17 00:00:00 2001 +From: Varad Gautam +Date: Fri, 14 May 2021 10:39:22 +1000 +Subject: ipc/mqueue, msg, sem: Avoid relying on a stack reference past its + expiry +Patch-mainline: Not yet, queued on linux-next via akpm's -mm patchqueue +References: bsc#1185988 + +do_mq_timedreceive calls wq_sleep with a stack local address. The sender +(do_mq_timedsend) uses this address to later call pipelined_send. + +This leads to a very hard to trigger race where a do_mq_timedreceive call +might return and leave do_mq_timedsend to rely on an invalid address, +causing the following crash: + +[ 240.739977] RIP: 0010:wake_q_add_safe+0x13/0x60 +[ 240.739991] Call Trace: +[ 240.739999] __x64_sys_mq_timedsend+0x2a9/0x490 +[ 240.740003] ? auditd_test_task+0x38/0x40 +[ 240.740007] ? auditd_test_task+0x38/0x40 +[ 240.740011] do_syscall_64+0x80/0x680 +[ 240.740017] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +[ 240.740019] RIP: 0033:0x7f5928e40343 + +The race occurs as: + +1. do_mq_timedreceive calls wq_sleep with the address of `struct + ext_wait_queue` on function stack (aliased as `ewq_addr` here) - it + holds a valid `struct ext_wait_queue *` as long as the stack has not + been overwritten. + +2. `ewq_addr` gets added to info->e_wait_q[RECV].list in wq_add, and + do_mq_timedsend receives it via wq_get_first_waiter(info, RECV) to call + __pipelined_op. + +3. Sender calls __pipelined_op::smp_store_release(&this->state, + STATE_READY). Here is where the race window begins. (`this` is + `ewq_addr`.) + +4. If the receiver wakes up now in do_mq_timedreceive::wq_sleep, it + will see `state == STATE_READY` and break. + +5. do_mq_timedreceive returns, and `ewq_addr` is no longer guaranteed + to be a `struct ext_wait_queue *` since it was on do_mq_timedreceive's + stack. (Although the address may not get overwritten until another + function happens to touch it, which means it can persist around for an + indefinite time.) + +6. do_mq_timedsend::__pipelined_op() still believes `ewq_addr` is a + `struct ext_wait_queue *`, and uses it to find a task_struct to pass to + the wake_q_add_safe call. In the lucky case where nothing has + overwritten `ewq_addr` yet, `ewq_addr->task` is the right task_struct. + In the unlucky case, __pipelined_op::wake_q_add_safe gets handed a + bogus address as the receiver's task_struct causing the crash. + +do_mq_timedsend::__pipelined_op() should not dereference `this` after +setting STATE_READY, as the receiver counterpart is now free to return. +Change __pipelined_op to call wake_q_add_safe on the receiver's +task_struct returned by get_task_struct, instead of dereferencing `this` +which sits on the receiver's stack. + +As Manfred pointed out, the race potentially also exists in +ipc/msg.c::expunge_all and ipc/sem.c::wake_up_sem_queue_prepare. Fix +those in the same way. + +Link: https://lkml.kernel.org/r/20210510102950.12551-1-varad.gautam@suse.com +Fixes: c5b2cbdbdac563 ("ipc/mqueue.c: update/document memory barriers") +Fixes: 8116b54e7e23ef ("ipc/sem.c: document and update memory barriers") +Fixes: 0d97a82ba830d8 ("ipc/msg.c: update and document memory barriers") +Signed-off-by: Varad Gautam +Reported-by: Matthias von Faber +Acked-by: Davidlohr Bueso +Acked-by: Manfred Spraul +Cc: Christian Brauner +Cc: Oleg Nesterov +Cc: "Eric W. Biederman" +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Stephen Rothwell + +--- + ipc/mqueue.c | 6 ++++-- + ipc/msg.c | 6 ++++-- + ipc/sem.c | 6 ++++-- + 3 files changed, 12 insertions(+), 6 deletions(-) + +diff --git a/ipc/mqueue.c b/ipc/mqueue.c +index 8031464ed4ae2..4e4e61111500c 100644 +--- a/ipc/mqueue.c ++++ b/ipc/mqueue.c +@@ -1004,12 +1004,14 @@ static inline void __pipelined_op(struct wake_q_head *wake_q, + struct mqueue_inode_info *info, + struct ext_wait_queue *this) + { ++ struct task_struct *task; ++ + list_del(&this->list); +- get_task_struct(this->task); ++ task = get_task_struct(this->task); + + /* see MQ_BARRIER for purpose/pairing */ + smp_store_release(&this->state, STATE_READY); +- wake_q_add_safe(wake_q, this->task); ++ wake_q_add_safe(wake_q, task); + } + + /* pipelined_send() - send a message directly to the task waiting in +diff --git a/ipc/msg.c b/ipc/msg.c +index acd1bc7af55a2..6e6c8e0c9380e 100644 +--- a/ipc/msg.c ++++ b/ipc/msg.c +@@ -251,11 +251,13 @@ static void expunge_all(struct msg_queue *msq, int res, + struct msg_receiver *msr, *t; + + list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) { +- get_task_struct(msr->r_tsk); ++ struct task_struct *r_tsk; ++ ++ r_tsk = get_task_struct(msr->r_tsk); + + /* see MSG_BARRIER for purpose/pairing */ + smp_store_release(&msr->r_msg, ERR_PTR(res)); +- wake_q_add_safe(wake_q, msr->r_tsk); ++ wake_q_add_safe(wake_q, r_tsk); + } + } + +diff --git a/ipc/sem.c b/ipc/sem.c +index e0ec239680cbd..bf534c74293e1 100644 +--- a/ipc/sem.c ++++ b/ipc/sem.c +@@ -784,12 +784,14 @@ would_block: + static inline void wake_up_sem_queue_prepare(struct sem_queue *q, int error, + struct wake_q_head *wake_q) + { +- get_task_struct(q->sleeper); ++ struct task_struct *sleeper; ++ ++ sleeper = get_task_struct(q->sleeper); + + /* see SEM_BARRIER_2 for purpuse/pairing */ + smp_store_release(&q->status, error); + +- wake_q_add_safe(wake_q, q->sleeper); ++ wake_q_add_safe(wake_q, sleeper); + } + + static void unlink_queue(struct sem_array *sma, struct sem_queue *q) +-- +cgit 1.2.3-1.el7 + diff --git a/patches.suse/lpfc-decouple-port_template-and-vport_template.patch b/patches.suse/lpfc-decouple-port_template-and-vport_template.patch new file mode 100644 index 0000000..63757c0 --- /dev/null +++ b/patches.suse/lpfc-decouple-port_template-and-vport_template.patch @@ -0,0 +1,153 @@ +From: Daniel Wagner +Date: Fri, 21 May 2021 14:05:13 +0200 +Subject: [PATCH] lpfc: Decouple port_template and vport_template +Patch-mainline: Not yet, Broadcom will pick the patch up eventually +References: bsc#185032 + +The problem here is that the lpfc_hba structure has been freed but the +Scsi_Host's hostt pointer is still pointing to the (v) port template +area inside the freed hba structure - through which the module is +accessed. + +Basically we need to ensure that the access to the module structure +(via the host template or otherwise) stays valid even after the HBA +structure is freed (or delay that free). + +Patch provided by IBM. + +Signed-off-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc.h | 5 ----- + drivers/scsi/lpfc/lpfc_crtn.h | 1 + + drivers/scsi/lpfc/lpfc_init.c | 22 +++++++--------------- + drivers/scsi/lpfc/lpfc_scsi.c | 27 +++++++++++++++++++++++++++ + 4 files changed, 35 insertions(+), 20 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h +index f8de0d10620b..f8622cd5bb4f 100644 +--- a/drivers/scsi/lpfc/lpfc.h ++++ b/drivers/scsi/lpfc/lpfc.h +@@ -1253,11 +1253,6 @@ struct lpfc_hba { + #define LPFC_POLL_SLOWPATH 1 /* called from slowpath */ + + char os_host_name[MAXHOSTNAMELEN]; +- +- /* SCSI host template information - for physical port */ +- struct scsi_host_template port_template; +- /* SCSI host template information - for all vports */ +- struct scsi_host_template vport_template; + atomic_t dbg_log_idx; + atomic_t dbg_log_cnt; + atomic_t dbg_log_dmping; +diff --git a/drivers/scsi/lpfc/lpfc_crtn.h b/drivers/scsi/lpfc/lpfc_crtn.h +index eb4cf36229d5..672f4e87a20b 100644 +--- a/drivers/scsi/lpfc/lpfc_crtn.h ++++ b/drivers/scsi/lpfc/lpfc_crtn.h +@@ -411,6 +411,7 @@ extern struct device_attribute *lpfc_hba_attrs[]; + extern struct device_attribute *lpfc_vport_attrs[]; + extern struct scsi_host_template lpfc_template; + extern struct scsi_host_template lpfc_template_nvme; ++extern struct scsi_host_template lpfc_vport_template; + extern struct fc_function_template lpfc_transport_functions; + extern struct fc_function_template lpfc_vport_transport_functions; + +diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c +index 5ea43c527e08..f6d10ccf1d26 100644 +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -4339,7 +4339,7 @@ lpfc_create_port(struct lpfc_hba *phba, int instance, struct device *dev) + { + struct lpfc_vport *vport; + struct Scsi_Host *shost = NULL; +- struct scsi_host_template *template; ++ struct scsi_host_template *template, *vport_template; + int error = 0; + int i; + uint64_t wwn; +@@ -4371,42 +4371,34 @@ lpfc_create_port(struct lpfc_hba *phba, int instance, struct device *dev) + + /* Seed template for SCSI host registration */ + if (dev == &phba->pcidev->dev) { +- template = &phba->port_template; +- + if (phba->cfg_enable_fc4_type & LPFC_ENABLE_FCP) { + /* Seed physical port template */ +- memcpy(template, &lpfc_template, sizeof(*template)); ++ template = &lpfc_template; + + if (use_no_reset_hba) + /* template is for a no reset SCSI Host */ + template->eh_host_reset_handler = NULL; + + /* Template for all vports this physical port creates */ +- memcpy(&phba->vport_template, &lpfc_template, +- sizeof(*template)); +- phba->vport_template.shost_attrs = lpfc_vport_attrs; +- phba->vport_template.eh_bus_reset_handler = NULL; +- phba->vport_template.eh_host_reset_handler = NULL; +- phba->vport_template.vendor_id = 0; ++ vport_template = &lpfc_vport_template; + + /* Initialize the host templates with updated value */ + if (phba->sli_rev == LPFC_SLI_REV4) { + template->sg_tablesize = phba->cfg_scsi_seg_cnt; +- phba->vport_template.sg_tablesize = ++ vport_template->sg_tablesize = + phba->cfg_scsi_seg_cnt; + } else { + template->sg_tablesize = phba->cfg_sg_seg_cnt; +- phba->vport_template.sg_tablesize = ++ vport_template->sg_tablesize = + phba->cfg_sg_seg_cnt; + } + + } else { + /* NVMET is for physical port only */ +- memcpy(template, &lpfc_template_nvme, +- sizeof(*template)); ++ template = &lpfc_template_nvme; + } + } else { +- template = &phba->vport_template; ++ template = &lpfc_vport_template; + } + + shost = scsi_host_alloc(template, sizeof(struct lpfc_vport)); +diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c +index ba8908e5d4f1..2ae13df2b218 100644 +--- a/drivers/scsi/lpfc/lpfc_scsi.c ++++ b/drivers/scsi/lpfc/lpfc_scsi.c +@@ -6740,3 +6740,30 @@ struct scsi_host_template lpfc_template = { + .change_queue_depth = scsi_change_queue_depth, + .track_queue_depth = 1, + }; ++ ++/* Template for all vports this physical port creates */ ++struct scsi_host_template lpfc_vport_template = { ++ .module = THIS_MODULE, ++ .name = LPFC_DRIVER_NAME, ++ .proc_name = LPFC_DRIVER_NAME, ++ .info = lpfc_info, ++ .queuecommand = lpfc_queuecommand, ++ .eh_timed_out = fc_eh_timed_out, ++ .eh_abort_handler = lpfc_abort_handler, ++ .eh_device_reset_handler = lpfc_device_reset_handler, ++ .eh_target_reset_handler = lpfc_target_reset_handler, ++ .eh_bus_reset_handler = NULL, ++ .eh_host_reset_handler = NULL, ++ .slave_alloc = lpfc_slave_alloc, ++ .slave_configure = lpfc_slave_configure, ++ .slave_destroy = lpfc_slave_destroy, ++ .scan_finished = lpfc_scan_finished, ++ .this_id = -1, ++ .sg_tablesize = LPFC_DEFAULT_SG_SEG_CNT, ++ .cmd_per_lun = LPFC_CMD_PER_LUN, ++ .shost_attrs = lpfc_vport_attrs, ++ .max_sectors = 0xFFFFFFFF, ++ .vendor_id = 0, ++ .change_queue_depth = scsi_change_queue_depth, ++ .track_queue_depth = 1, ++}; +-- +2.29.2 + diff --git a/patches.suse/mlxsw-spectrum_mr-Update-egress-RIF-list-before-rout.patch b/patches.suse/mlxsw-spectrum_mr-Update-egress-RIF-list-before-rout.patch new file mode 100644 index 0000000..dd80a6f --- /dev/null +++ b/patches.suse/mlxsw-spectrum_mr-Update-egress-RIF-list-before-rout.patch @@ -0,0 +1,97 @@ +From: Ido Schimmel +Date: Thu, 6 May 2021 10:23:08 +0300 +Subject: mlxsw: spectrum_mr: Update egress RIF list before route's action +Patch-mainline: v5.13-rc1 +Git-commit: cbaf3f6af9c268caf558c8e7ec52bcb35c5455dd +References: git-fixes + +Each multicast route that is forwarding packets (as opposed to trapping +them) points to a list of egress router interfaces (RIFs) through which +packets are replicated. + +A route's action can transition from trap to forward when a RIF is +created for one of the route's egress virtual interfaces (eVIF). When +this happens, the route's action is first updated and only later the +list of egress RIFs is committed to the device. + +This results in the route pointing to an invalid list. In case the list +pointer is out of range (due to uninitialized memory), the device will +complain: + +mlxsw_spectrum2 0000:06:00.0: EMAD reg access failed (tid=5733bf490000905c,reg_id=300f(pefa),type=write,status=7(bad parameter)) + +Fix this by first committing the list of egress RIFs to the device and +only later update the route's action. + +Note that a fix is not needed in the reverse function (i.e., +mlxsw_sp_mr_route_evif_unresolve()), as there the route's action is +first updated and only later the RIF is removed from the list. + +Cc: stable@vger.kernel.org +Fixes: c011ec1bbfd6 ("mlxsw: spectrum: Add the multicast routing offloading logic") +Signed-off-by: Ido Schimmel +Reviewed-by: Petr Machata +Link: https://lore.kernel.org/r/20210506072308.3834303-1-idosch@idosch.org +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c | 30 +++++++++++----------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c +@@ -524,6 +524,16 @@ mlxsw_sp_mr_route_evif_resolve(struct ml + u16 erif_index = 0; + int err; + ++ /* Add the eRIF */ ++ if (mlxsw_sp_mr_vif_valid(rve->mr_vif)) { ++ erif_index = mlxsw_sp_rif_index(rve->mr_vif->rif); ++ err = mr->mr_ops->route_erif_add(mlxsw_sp, ++ rve->mr_route->route_priv, ++ erif_index); ++ if (err) ++ return err; ++ } ++ + /* Update the route action, as the new eVIF can be a tunnel or a pimreg + * device which will require updating the action. + */ +@@ -533,17 +543,7 @@ mlxsw_sp_mr_route_evif_resolve(struct ml + rve->mr_route->route_priv, + route_action); + if (err) +- return err; +- } +- +- /* Add the eRIF */ +- if (mlxsw_sp_mr_vif_valid(rve->mr_vif)) { +- erif_index = mlxsw_sp_rif_index(rve->mr_vif->rif); +- err = mr->mr_ops->route_erif_add(mlxsw_sp, +- rve->mr_route->route_priv, +- erif_index); +- if (err) +- goto err_route_erif_add; ++ goto err_route_action_update; + } + + /* Update the minimum MTU */ +@@ -561,14 +561,14 @@ mlxsw_sp_mr_route_evif_resolve(struct ml + return 0; + + err_route_min_mtu_update: +- if (mlxsw_sp_mr_vif_valid(rve->mr_vif)) +- mr->mr_ops->route_erif_del(mlxsw_sp, rve->mr_route->route_priv, +- erif_index); +-err_route_erif_add: + if (route_action != rve->mr_route->route_action) + mr->mr_ops->route_action_update(mlxsw_sp, + rve->mr_route->route_priv, + rve->mr_route->route_action); ++err_route_action_update: ++ if (mlxsw_sp_mr_vif_valid(rve->mr_vif)) ++ mr->mr_ops->route_erif_del(mlxsw_sp, rve->mr_route->route_priv, ++ erif_index); + return err; + } + diff --git a/patches.suse/msft-hv-2051-Drivers-hv-vmbus-Fix-Suspend-to-Idle-for-Generation-.patch b/patches.suse/msft-hv-2051-Drivers-hv-vmbus-Fix-Suspend-to-Idle-for-Generation-.patch new file mode 100644 index 0000000..148bdc5 --- /dev/null +++ b/patches.suse/msft-hv-2051-Drivers-hv-vmbus-Fix-Suspend-to-Idle-for-Generation-.patch @@ -0,0 +1,110 @@ +From: Dexuan Cui +Date: Sat, 11 Apr 2020 20:50:35 -0700 +Patch-mainline: v5.7-rc4 +Subject: Drivers: hv: vmbus: Fix Suspend-to-Idle for Generation-2 VM +Git-commit: 1a06d017fb3f388734ffbe5dedee6f8c3af5f2db +References: git-fixes + +Before the hibernation patchset (e.g. f53335e3289f), in a Generation-2 +Linux VM on Hyper-V, the user can run "echo freeze > /sys/power/state" to +freeze the system, i.e. Suspend-to-Idle. The user can press the keyboard +or move the mouse to wake up the VM. + +With the hibernation patchset, Linux VM on Hyper-V can hibernate to disk, +but Suspend-to-Idle is broken: when the synthetic keyboard/mouse are +suspended, there is no way to wake up the VM. + +Fix the issue by not suspending and resuming the vmbus devices upon +Suspend-to-Idle. + +Fixes: f53335e3289f ("Drivers: hv: vmbus: Suspend/resume the vmbus itself for hibernation") +Cc: stable@vger.kernel.org +Reviewed-by: Michael Kelley +Signed-off-by: Dexuan Cui +Link: https://lore.kernel.org/r/1586663435-36243-1-git-send-email-decui@microsoft.com +Signed-off-by: Wei Liu +Acked-by: Olaf Hering +--- + drivers/hv/vmbus_drv.c | 43 ++++++++++++++++++++++++++++++++++--------- + 1 file changed, 34 insertions(+), 9 deletions(-) + +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -978,6 +978,9 @@ static int vmbus_resume(struct device *child_device) + + return drv->resume(dev); + } ++#else ++#define vmbus_suspend NULL ++#define vmbus_resume NULL + #endif /* CONFIG_PM_SLEEP */ + + /* +@@ -997,11 +1000,22 @@ static void vmbus_device_release(struct device *device) + } + + /* +- * Note: we must use SET_NOIRQ_SYSTEM_SLEEP_PM_OPS rather than +- * SET_SYSTEM_SLEEP_PM_OPS: see the comment before vmbus_bus_pm. ++ * Note: we must use the "noirq" ops: see the comment before vmbus_bus_pm. ++ * ++ * suspend_noirq/resume_noirq are set to NULL to support Suspend-to-Idle: we ++ * shouldn't suspend the vmbus devices upon Suspend-to-Idle, otherwise there ++ * is no way to wake up a Generation-2 VM. ++ * ++ * The other 4 ops are for hibernation. + */ ++ + static const struct dev_pm_ops vmbus_pm = { +- SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(vmbus_suspend, vmbus_resume) ++ .suspend_noirq = NULL, ++ .resume_noirq = NULL, ++ .freeze_noirq = vmbus_suspend, ++ .thaw_noirq = vmbus_resume, ++ .poweroff_noirq = vmbus_suspend, ++ .restore_noirq = vmbus_resume, + }; + + /* The one and only one */ +@@ -2281,6 +2295,9 @@ static int vmbus_bus_resume(struct device *dev) + + return 0; + } ++#else ++#define vmbus_bus_suspend NULL ++#define vmbus_bus_resume NULL + #endif /* CONFIG_PM_SLEEP */ + + static const struct acpi_device_id vmbus_acpi_device_ids[] = { +@@ -2291,16 +2308,24 @@ static const struct acpi_device_id vmbus_acpi_device_ids[] = { + MODULE_DEVICE_TABLE(acpi, vmbus_acpi_device_ids); + + /* +- * Note: we must use SET_NOIRQ_SYSTEM_SLEEP_PM_OPS rather than +- * SET_SYSTEM_SLEEP_PM_OPS, otherwise NIC SR-IOV can not work, because the +- * "pci_dev_pm_ops" uses the "noirq" callbacks: in the resume path, the +- * pci "noirq" restore callback runs before "non-noirq" callbacks (see ++ * Note: we must use the "no_irq" ops, otherwise hibernation can not work with ++ * PCI device assignment, because "pci_dev_pm_ops" uses the "noirq" ops: in ++ * the resume path, the pci "noirq" restore op runs before "non-noirq" op (see + * resume_target_kernel() -> dpm_resume_start(), and hibernation_restore() -> + * dpm_resume_end()). This means vmbus_bus_resume() and the pci-hyperv's +- * resume callback must also run via the "noirq" callbacks. ++ * resume callback must also run via the "noirq" ops. ++ * ++ * Set suspend_noirq/resume_noirq to NULL for Suspend-to-Idle: see the comment ++ * earlier in this file before vmbus_pm. + */ ++ + static const struct dev_pm_ops vmbus_bus_pm = { +- SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(vmbus_bus_suspend, vmbus_bus_resume) ++ .suspend_noirq = NULL, ++ .resume_noirq = NULL, ++ .freeze_noirq = vmbus_bus_suspend, ++ .thaw_noirq = vmbus_bus_resume, ++ .poweroff_noirq = vmbus_bus_suspend, ++ .restore_noirq = vmbus_bus_resume + }; + + static struct acpi_driver vmbus_acpi_driver = { diff --git a/patches.suse/msft-hv-2269-drivers-hv-Fix-whitespace-errors.patch b/patches.suse/msft-hv-2269-drivers-hv-Fix-whitespace-errors.patch new file mode 100644 index 0000000..20f1586 --- /dev/null +++ b/patches.suse/msft-hv-2269-drivers-hv-Fix-whitespace-errors.patch @@ -0,0 +1,31 @@ +From: Vasanth +Date: Fri, 19 Feb 2021 22:43:11 +0530 +Patch-mainline: v5.13-rc1 +Subject: drivers: hv: Fix whitespace errors +Git-commit: f850a4cad27c3cfeb89fd28c768d5e6821bf178f +References: bsc#1185725 + +Fixed checkpatch warning and errors on hv driver. + +Signed-off-by: Vasanth Mathivanan +Link: https://lore.kernel.org/r/20210219171311.421961-1-vasanth3g@gmail.com +Reviewed-by: Michael Kelley +Signed-off-by: Wei Liu +Acked-by: Olaf Hering +--- + drivers/hv/channel.c | 2 +- + drivers/hv/connection.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c +--- a/drivers/hv/connection.c ++++ b/drivers/hv/connection.c +@@ -28,7 +28,7 @@ struct vmbus_connection vmbus_connection = { + .conn_state = DISCONNECTED, + .next_gpadl_handle = ATOMIC_INIT(0xE1E10), + +- .ready_for_suspend_event= COMPLETION_INITIALIZER( ++ .ready_for_suspend_event = COMPLETION_INITIALIZER( + vmbus_connection.ready_for_suspend_event), + .ready_for_resume_event = COMPLETION_INITIALIZER( + vmbus_connection.ready_for_resume_event), diff --git a/patches.suse/msft-hv-2305-Drivers-hv-vmbus-Use-after-free-in-__vmbus_open.patch b/patches.suse/msft-hv-2305-Drivers-hv-vmbus-Use-after-free-in-__vmbus_open.patch new file mode 100644 index 0000000..90dfcd6 --- /dev/null +++ b/patches.suse/msft-hv-2305-Drivers-hv-vmbus-Use-after-free-in-__vmbus_open.patch @@ -0,0 +1,34 @@ +From: Dan Carpenter +Date: Tue, 13 Apr 2021 13:50:04 +0300 +Patch-mainline: v5.13-rc1 +Subject: Drivers: hv: vmbus: Use after free in __vmbus_open() +Git-commit: 3e9bf43f7f7a46f21ec071cb47be92d0874c48da +References: git-fixes + +The "open_info" variable is added to the &vmbus_connection.chn_msg_list, +but the error handling frees "open_info" without removing it from the +list. This will result in a use after free. First remove it from the +list, and then free it. + +Fixes: 6f3d791f3006 ("Drivers: hv: vmbus: Fix rescind handling issues") +Signed-off-by: Dan Carpenter +Reviewed-by: Andrea Parri +Link: https://lore.kernel.org/r/YHV3XLCot6xBS44r@mwanda +Signed-off-by: Wei Liu +Acked-by: Olaf Hering +--- + drivers/hv/channel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c +--- a/drivers/hv/channel.c ++++ b/drivers/hv/channel.c +@@ -653,7 +653,7 @@ static int __vmbus_open(struct vmbus_channel *newchannel, + + if (newchannel->rescind) { + err = -ENODEV; +- goto error_free_info; ++ goto error_clean_msglist; + } + + err = vmbus_post_msg(open_msg, diff --git a/patches.suse/msft-hv-2310-Drivers-hv-vmbus-Initialize-unload_event-statically.patch b/patches.suse/msft-hv-2310-Drivers-hv-vmbus-Initialize-unload_event-statically.patch new file mode 100644 index 0000000..5550006 --- /dev/null +++ b/patches.suse/msft-hv-2310-Drivers-hv-vmbus-Initialize-unload_event-statically.patch @@ -0,0 +1,58 @@ +From: "Andrea Parri (Microsoft)" +Date: Tue, 20 Apr 2021 03:43:50 +0200 +Patch-mainline: v5.13-rc1 +Subject: Drivers: hv: vmbus: Initialize unload_event statically +Git-commit: 8c2d5e0640e53c14b6240e9bf1e32a2226e6e6ca +References: bsc#1185725 + +If a malicious or compromised Hyper-V sends a spurious message of type +CHANNELMSG_UNLOAD_RESPONSE, the function vmbus_unload_response() will +call complete() on an uninitialized event, and cause an oops. + +Reported-by: Michael Kelley +Signed-off-by: Andrea Parri (Microsoft) +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/20210420014350.2002-1-parri.andrea@gmail.com +Signed-off-by: Wei Liu +Acked-by: Olaf Hering +--- + drivers/hv/channel_mgmt.c | 7 ++++++- + drivers/hv/connection.c | 2 ++ + 2 files changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -826,6 +826,11 @@ static void vmbus_unload_response(struct vmbus_channel_message_header *hdr) + /* + * This is a global event; just wakeup the waiting thread. + * Once we successfully unload, we can cleanup the monitor state. ++ * ++ * NB. A malicious or compromised Hyper-V could send a spurious ++ * message of type CHANNELMSG_UNLOAD_RESPONSE, and trigger a call ++ * of the complete() below. Make sure that unload_event has been ++ * initialized by the time this complete() is executed. + */ + complete(&vmbus_connection.unload_event); + } +@@ -841,7 +846,7 @@ void vmbus_initiate_unload(bool crash) + if (vmbus_proto_version < VERSION_WIN8_1) + return; + +- init_completion(&vmbus_connection.unload_event); ++ reinit_completion(&vmbus_connection.unload_event); + memset(&hdr, 0, sizeof(struct vmbus_channel_message_header)); + hdr.msgtype = CHANNELMSG_UNLOAD; + vmbus_post_msg(&hdr, sizeof(struct vmbus_channel_message_header), +diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c +--- a/drivers/hv/connection.c ++++ b/drivers/hv/connection.c +@@ -26,6 +26,8 @@ + + struct vmbus_connection vmbus_connection = { + .conn_state = DISCONNECTED, ++ .unload_event = COMPLETION_INITIALIZER( ++ vmbus_connection.unload_event), + .next_gpadl_handle = ATOMIC_INIT(0xE1E10), + + .ready_for_suspend_event = COMPLETION_INITIALIZER( diff --git a/patches.suse/msft-hv-2311-Drivers-hv-vmbus-Increase-wait-time-for-VMbus-unload.patch b/patches.suse/msft-hv-2311-Drivers-hv-vmbus-Increase-wait-time-for-VMbus-unload.patch new file mode 100644 index 0000000..1ab252a --- /dev/null +++ b/patches.suse/msft-hv-2311-Drivers-hv-vmbus-Increase-wait-time-for-VMbus-unload.patch @@ -0,0 +1,92 @@ +From: Michael Kelley +Date: Mon, 19 Apr 2021 21:48:09 -0700 +Patch-mainline: v5.13-rc1 +Subject: Drivers: hv: vmbus: Increase wait time for VMbus unload +Git-commit: 77db0ec8b7764cb9b09b78066ebfd47b2c0c1909 +References: bsc#1185725 + +When running in Azure, disks may be connected to a Linux VM with +read/write caching enabled. If a VM panics and issues a VMbus +UNLOAD request to Hyper-V, the response is delayed until all dirty +data in the disk cache is flushed. In extreme cases, this flushing +can take 10's of seconds, depending on the disk speed and the amount +of dirty data. If kdump is configured for the VM, the current 10 second +timeout in vmbus_wait_for_unload() may be exceeded, and the UNLOAD +complete message may arrive well after the kdump kernel is already +running, causing problems. Note that no problem occurs if kdump is +not enabled because Hyper-V waits for the cache flush before doing +a reboot through the BIOS/UEFI code. + +Fix this problem by increasing the timeout in vmbus_wait_for_unload() +to 100 seconds. Also output periodic messages so that if anyone is +watching the serial console, they won't think the VM is completely +hung. + +Fixes: 911e1987efc8 ("Drivers: hv: vmbus: Add timeout to vmbus_wait_for_unload") +Signed-off-by: Michael Kelley +Reviewed-by: Vitaly Kuznetsov +Link: https://lore.kernel.org/r/1618894089-126662-1-git-send-email-mikelley@microsoft.com +Signed-off-by: Wei Liu +Acked-by: Olaf Hering +--- + drivers/hv/channel_mgmt.c | 30 +++++++++++++++++++++++++----- + 1 file changed, 25 insertions(+), 5 deletions(-) + +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -755,6 +755,12 @@ static void init_vp_index(struct vmbus_channel *channel) + free_cpumask_var(available_mask); + } + ++#define UNLOAD_DELAY_UNIT_MS 10 /* 10 milliseconds */ ++#define UNLOAD_WAIT_MS (100*1000) /* 100 seconds */ ++#define UNLOAD_WAIT_LOOPS (UNLOAD_WAIT_MS/UNLOAD_DELAY_UNIT_MS) ++#define UNLOAD_MSG_MS (5*1000) /* Every 5 seconds */ ++#define UNLOAD_MSG_LOOPS (UNLOAD_MSG_MS/UNLOAD_DELAY_UNIT_MS) ++ + static void vmbus_wait_for_unload(void) + { + int cpu; +@@ -772,12 +778,17 @@ static void vmbus_wait_for_unload(void) + * vmbus_connection.unload_event. If not, the last thing we can do is + * read message pages for all CPUs directly. + * +- * Wait no more than 10 seconds so that the panic path can't get +- * hung forever in case the response message isn't seen. ++ * Wait up to 100 seconds since an Azure host must writeback any dirty ++ * data in its disk cache before the VMbus UNLOAD request will ++ * complete. This flushing has been empirically observed to take up ++ * to 50 seconds in cases with a lot of dirty data, so allow additional ++ * leeway and for inaccuracies in mdelay(). But eventually time out so ++ * that the panic path can't get hung forever in case the response ++ * message isn't seen. + */ +- for (i = 0; i < 1000; i++) { ++ for (i = 1; i <= UNLOAD_WAIT_LOOPS; i++) { + if (completion_done(&vmbus_connection.unload_event)) +- break; ++ goto completed; + + for_each_online_cpu(cpu) { + struct hv_per_cpu_context *hv_cpu +@@ -800,9 +811,18 @@ static void vmbus_wait_for_unload(void) + vmbus_signal_eom(msg, message_type); + } + +- mdelay(10); ++ /* ++ * Give a notice periodically so someone watching the ++ * serial output won't think it is completely hung. ++ */ ++ if (!(i % UNLOAD_MSG_LOOPS)) ++ pr_notice("Waiting for VMBus UNLOAD to complete\n"); ++ ++ mdelay(UNLOAD_DELAY_UNIT_MS); + } ++ pr_err("Continuing even though VMBus UNLOAD did not complete\n"); + ++completed: + /* + * We're crashing and already got the UNLOAD_RESPONSE, cleanup all + * maybe-pending messages on all CPUs to be able to receive new diff --git a/patches.suse/msft-hv-2312-video-hyperv_fb-Add-ratelimit-on-error-message.patch b/patches.suse/msft-hv-2312-video-hyperv_fb-Add-ratelimit-on-error-message.patch new file mode 100644 index 0000000..0de3d59 --- /dev/null +++ b/patches.suse/msft-hv-2312-video-hyperv_fb-Add-ratelimit-on-error-message.patch @@ -0,0 +1,36 @@ +From: Michael Kelley +Date: Tue, 20 Apr 2021 08:44:19 -0700 +Patch-mainline: v5.13-rc1 +Subject: video: hyperv_fb: Add ratelimit on error message +Git-commit: aa5b7d11c7cb87c266d705b237368985e7171958 +References: bsc#1185725 + +Due to a full ring buffer, the driver may be unable to send updates to +the Hyper-V host. But outputing the error message can make the problem +worse because console output is also typically written to the frame +buffer. As a result, in some circumstances the error message is output +continuously. + +Break the cycle by rate limiting the error message. Also output +the error code for additional diagnosability. + +Signed-off-by: Michael Kelley +Link: https://lore.kernel.org/r/1618933459-10585-1-git-send-email-mikelley@microsoft.com +Signed-off-by: Wei Liu +Acked-by: Olaf Hering +--- + drivers/video/fbdev/hyperv_fb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c +--- a/drivers/video/fbdev/hyperv_fb.c ++++ b/drivers/video/fbdev/hyperv_fb.c +@@ -308,7 +308,7 @@ static inline int synthvid_send(struct hv_device *hdev, + VM_PKT_DATA_INBAND, 0); + + if (ret) +- pr_err("Unable to send packet via vmbus\n"); ++ pr_err_ratelimited("Unable to send packet via vmbus; error %d\n", ret); + + return ret; + } diff --git a/patches.suse/net-hns3-Fix-for-geneve-tx-checksum-bug.patch b/patches.suse/net-hns3-Fix-for-geneve-tx-checksum-bug.patch new file mode 100644 index 0000000..da80179 --- /dev/null +++ b/patches.suse/net-hns3-Fix-for-geneve-tx-checksum-bug.patch @@ -0,0 +1,52 @@ +From: Yi Li +Date: Wed, 26 Aug 2020 13:11:50 +0800 +Subject: net: hns3: Fix for geneve tx checksum bug +Patch-mainline: v5.9-rc4 +Git-commit: a156998fc92d3859c8e820f1583f6d0541d643c3 +References: git-fixes + +when skb->encapsulation is 0, skb->ip_summed is CHECKSUM_PARTIAL +and it is udp packet, which has a dest port as the IANA assigned. +the hardware is expected to do the checksum offload, but the +hardware will not do the checksum offload when udp dest port is +6081. + +This patch fixes it by doing the checksum in software. + +Reported-by: Li Bing +Signed-off-by: Yi Li +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + #include "hnae3.h" + #include "hns3_enet.h" +@@ -785,7 +786,7 @@ static int hns3_get_l4_protocol(struct s + * and it is udp packet, which has a dest port as the IANA assigned. + * the hardware is expected to do the checksum offload, but the + * hardware will not do the checksum offload when udp dest port is +- * 4789. ++ * 4789 or 6081. + */ + static bool hns3_tunnel_csum_bug(struct sk_buff *skb) + { +@@ -794,7 +795,8 @@ static bool hns3_tunnel_csum_bug(struct + l4.hdr = skb_transport_header(skb); + + if (!(!skb->encapsulation && +- l4.udp->dest == htons(IANA_VXLAN_UDP_PORT))) ++ (l4.udp->dest == htons(IANA_VXLAN_UDP_PORT) || ++ l4.udp->dest == htons(GENEVE_UDP_PORT)))) + return false; + + skb_checksum_help(skb); diff --git a/patches.suse/net-hns3-add-check-for-HNS3_NIC_STATE_INITED-in-hns3.patch b/patches.suse/net-hns3-add-check-for-HNS3_NIC_STATE_INITED-in-hns3.patch new file mode 100644 index 0000000..725ebfe --- /dev/null +++ b/patches.suse/net-hns3-add-check-for-HNS3_NIC_STATE_INITED-in-hns3.patch @@ -0,0 +1,37 @@ +From: Jian Shen +Date: Thu, 29 Apr 2021 16:34:52 +0800 +Subject: net: hns3: add check for HNS3_NIC_STATE_INITED in + hns3_reset_notify_up_enet() +Patch-mainline: v5.13-rc1 +Git-commit: b4047aac4ec1066bab6c71950623746d7bcf7154 +References: git-fixes + +In some cases, the device is not initialized because reset failed. +If another task calls hns3_reset_notify_up_enet() before reset +retry, it will cause an error since uninitialized pointer access. +So add check for HNS3_NIC_STATE_INITED before calling +hns3_nic_net_open() in hns3_reset_notify_up_enet(). + +Fixes: bb6b94a896d4 ("net: hns3: Add reset interface implementation in client") +Signed-off-by: Jian Shen +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -4433,6 +4433,11 @@ static int hns3_reset_notify_up_enet(str + struct hns3_nic_priv *priv = netdev_priv(kinfo->netdev); + int ret = 0; + ++ if (!test_bit(HNS3_NIC_STATE_INITED, &priv->state)) { ++ netdev_err(kinfo->netdev, "device is not initialized yet\n"); ++ return -EFAULT; ++ } ++ + clear_bit(HNS3_NIC_STATE_RESETTING, &priv->state); + + if (netif_running(kinfo->netdev)) { diff --git a/patches.suse/net-hns3-clear-unnecessary-reset-request-in-hclge_re.patch b/patches.suse/net-hns3-clear-unnecessary-reset-request-in-hclge_re.patch new file mode 100644 index 0000000..6db6c09 --- /dev/null +++ b/patches.suse/net-hns3-clear-unnecessary-reset-request-in-hclge_re.patch @@ -0,0 +1,37 @@ +From: Yufeng Mo +Date: Fri, 30 Apr 2021 17:06:21 +0800 +Subject: net: hns3: clear unnecessary reset request in hclge_reset_rebuild +Patch-mainline: v5.13-rc1 +Git-commit: 8c9200e387721c597baabb319b4bd1cdf1155e35 +References: git-fixes + +HW error and global reset are reported through MSIX interrupts. +The same error may be reported to different functions at the +same time. When global reset begins, the pending reset request +set by this error is unnecessary. So clear the pending reset +request after the reset is complete to avoid the repeated reset. + +Fixes: f6162d44126c ("net: hns3: add handling of hw errors reported through MSIX") +Signed-off-by: Yufeng Mo +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -3804,6 +3804,12 @@ static int hclge_reset_rebuild(struct hc + ae_dev->reset_type = HNAE3_NONE_RESET; + clear_bit(HCLGE_STATE_RST_FAIL, &hdev->state); + ++ /* reset request will not be set during reset, so clear ++ * pending reset request to avoid unnecessary reset ++ * caused by the same reason. ++ */ ++ hclge_get_reset_level(ae_dev, &hdev->reset_request); ++ + /* if default_reset_request has a higher level reset request, + * it should be handled as soon as possible. since some errors + * need this kind of reset to fix. diff --git a/patches.suse/net-hns3-disable-phy-loopback-setting-in-hclge_mac_s.patch b/patches.suse/net-hns3-disable-phy-loopback-setting-in-hclge_mac_s.patch new file mode 100644 index 0000000..b89c13b --- /dev/null +++ b/patches.suse/net-hns3-disable-phy-loopback-setting-in-hclge_mac_s.patch @@ -0,0 +1,32 @@ +From: Yufeng Mo +Date: Fri, 30 Apr 2021 17:06:22 +0800 +Subject: net: hns3: disable phy loopback setting in hclge_mac_start_phy +Patch-mainline: v5.13-rc1 +Git-commit: 472497d0bdae890a896013332a0b673f9acdf2bf +References: git-fixes + +If selftest and reset are performed at the same time, the phy +loopback setting may be still in enable state after the reset, +and device cannot link up. So fix this issue by disabling phy +loopback before phy_start(). + +Fixes: 256727da7395 ("net: hns3: Add MDIO support to HNS3 Ethernet driver for hip08 SoC") +Signed-off-by: Yufeng Mo +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c +@@ -255,6 +255,8 @@ void hclge_mac_start_phy(struct hclge_de + if (!phydev) + return; + ++ phy_loopback(phydev, false); ++ + phy_start(phydev); + } + diff --git a/patches.suse/net-hns3-fix-for-vxlan-gpe-tx-checksum-bug.patch b/patches.suse/net-hns3-fix-for-vxlan-gpe-tx-checksum-bug.patch new file mode 100644 index 0000000..5f04bd6 --- /dev/null +++ b/patches.suse/net-hns3-fix-for-vxlan-gpe-tx-checksum-bug.patch @@ -0,0 +1,44 @@ +From: Hao Chen +Date: Fri, 30 Apr 2021 17:06:19 +0800 +Subject: net: hns3: fix for vxlan gpe tx checksum bug +Patch-mainline: v5.13-rc1 +Git-commit: 905416f18fe74bdd4de91bf94ef5a790a36e4b99 +References: git-fixes + +When skb->ip_summed is CHECKSUM_PARTIAL, for non-tunnel udp packet, +which has a dest port as the IANA assigned, the hardware is expected +to do the checksum offload, but the hardware whose version is below +V3 will not do the checksum offload when udp dest port is 4790. + +So fixes it by doing the checksum in software for this case. + +Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") +Signed-off-by: Hao Chen +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -786,7 +786,7 @@ static int hns3_get_l4_protocol(struct s + * and it is udp packet, which has a dest port as the IANA assigned. + * the hardware is expected to do the checksum offload, but the + * hardware will not do the checksum offload when udp dest port is +- * 4789 or 6081. ++ * 4789, 4790 or 6081. + */ + static bool hns3_tunnel_csum_bug(struct sk_buff *skb) + { +@@ -796,7 +796,8 @@ static bool hns3_tunnel_csum_bug(struct + + if (!(!skb->encapsulation && + (l4.udp->dest == htons(IANA_VXLAN_UDP_PORT) || +- l4.udp->dest == htons(GENEVE_UDP_PORT)))) ++ l4.udp->dest == htons(GENEVE_UDP_PORT) || ++ l4.udp->dest == htons(4790)))) + return false; + + skb_checksum_help(skb); diff --git a/patches.suse/net-hns3-fix-incorrect-configuration-for-igu_egu_hw_.patch b/patches.suse/net-hns3-fix-incorrect-configuration-for-igu_egu_hw_.patch new file mode 100644 index 0000000..31a3742 --- /dev/null +++ b/patches.suse/net-hns3-fix-incorrect-configuration-for-igu_egu_hw_.patch @@ -0,0 +1,47 @@ +From: Yufeng Mo +Date: Thu, 29 Apr 2021 16:34:50 +0800 +Subject: net: hns3: fix incorrect configuration for igu_egu_hw_err +Patch-mainline: v5.13-rc1 +Git-commit: 2867298dd49ee84214b8721521dc7a5a6382520c +References: git-fixes + +According to the UM, the type and enable status of igu_egu_hw_err +should be configured separately. Currently, the type field is +incorrect when disable this error. So fix it by configuring these +two fields separately. + +Fixes: bf1faf9415dd ("net: hns3: Add enable and process hw errors from IGU, EGU and NCSI") +Signed-off-by: Yufeng Mo +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c | 3 ++- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.h | 3 ++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c +@@ -753,8 +753,9 @@ static int hclge_config_igu_egu_hw_err_i + + /* configure IGU,EGU error interrupts */ + hclge_cmd_setup_basic_desc(&desc, HCLGE_IGU_COMMON_INT_EN, false); ++ desc.data[0] = cpu_to_le32(HCLGE_IGU_ERR_INT_TYPE); + if (en) +- desc.data[0] = cpu_to_le32(HCLGE_IGU_ERR_INT_EN); ++ desc.data[0] |= cpu_to_le32(HCLGE_IGU_ERR_INT_EN); + + desc.data[1] = cpu_to_le32(HCLGE_IGU_ERR_INT_EN_MASK); + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.h +@@ -33,7 +33,8 @@ + #define HCLGE_TQP_ECC_ERR_INT_EN_MASK 0x0FFF + #define HCLGE_MSIX_SRAM_ECC_ERR_INT_EN_MASK 0x0F000000 + #define HCLGE_MSIX_SRAM_ECC_ERR_INT_EN 0x0F000000 +-#define HCLGE_IGU_ERR_INT_EN 0x0000066F ++#define HCLGE_IGU_ERR_INT_EN 0x0000000F ++#define HCLGE_IGU_ERR_INT_TYPE 0x00000660 + #define HCLGE_IGU_ERR_INT_EN_MASK 0x000F + #define HCLGE_IGU_TNL_ERR_INT_EN 0x0002AABF + #define HCLGE_IGU_TNL_ERR_INT_EN_MASK 0x003F diff --git a/patches.suse/net-hns3-initialize-the-message-content-in-hclge_get.patch b/patches.suse/net-hns3-initialize-the-message-content-in-hclge_get.patch new file mode 100644 index 0000000..ebd01fd --- /dev/null +++ b/patches.suse/net-hns3-initialize-the-message-content-in-hclge_get.patch @@ -0,0 +1,31 @@ +From: Yufeng Mo +Date: Thu, 29 Apr 2021 16:34:51 +0800 +Subject: net: hns3: initialize the message content in hclge_get_link_mode() +Patch-mainline: v5.13-rc1 +Git-commit: 568a54bdf70b143f3e0befa298e22ad469ffc732 +References: git-fixes + +The message sent to VF should be initialized, otherwise random +value of some contents may cause improper processing by the target. +So add a initialization to message in hclge_get_link_mode(). + +Fixes: 9194d18b0577 ("net: hns3: fix the problem that the supported port is empty") +Signed-off-by: Yufeng Mo +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +@@ -523,7 +523,7 @@ static void hclge_get_link_mode(struct h + unsigned long advertising; + unsigned long supported; + unsigned long send_data; +- u8 msg_data[10]; ++ u8 msg_data[10] = {}; + u8 dest_vfid; + + advertising = hdev->hw.mac.advertising[0]; diff --git a/patches.suse/net-hns3-use-netif_tx_disable-to-stop-the-transmit-q.patch b/patches.suse/net-hns3-use-netif_tx_disable-to-stop-the-transmit-q.patch new file mode 100644 index 0000000..12831ac --- /dev/null +++ b/patches.suse/net-hns3-use-netif_tx_disable-to-stop-the-transmit-q.patch @@ -0,0 +1,37 @@ +From: Peng Li +Date: Fri, 30 Apr 2021 17:06:20 +0800 +Subject: net: hns3: use netif_tx_disable to stop the transmit queue +Patch-mainline: v5.13-rc1 +Git-commit: b416e872be06fdace3c36cf5210130509d0f0e72 +References: git-fixes + +Currently, netif_tx_stop_all_queues() is used to ensure that +the xmit is not running, but for the concurrent case it will +not take effect, since netif_tx_stop_all_queues() just sets +a flag without locking to indicate that the xmit queue(s) +should not be run. + +So use netif_tx_disable() to replace netif_tx_stop_all_queues(), +it takes the xmit queue lock while marking the queue stopped. + +Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") +Signed-off-by: Peng Li +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -527,8 +527,8 @@ static int hns3_nic_net_stop(struct net_ + if (h->ae_algo->ops->set_timer_task) + h->ae_algo->ops->set_timer_task(priv->ae_handle, false); + +- netif_tx_stop_all_queues(netdev); + netif_carrier_off(netdev); ++ netif_tx_disable(netdev); + + hns3_nic_net_down(netdev); + diff --git a/patches.suse/net-thunderx-Fix-unintentional-sign-extension-issue.patch b/patches.suse/net-thunderx-Fix-unintentional-sign-extension-issue.patch new file mode 100644 index 0000000..0a5db4d --- /dev/null +++ b/patches.suse/net-thunderx-Fix-unintentional-sign-extension-issue.patch @@ -0,0 +1,35 @@ +From: Colin Ian King +Date: Fri, 9 Apr 2021 14:07:26 +0100 +Subject: net: thunderx: Fix unintentional sign extension issue +Patch-mainline: v5.13-rc1 +Git-commit: e701a25840360706fe4cf5de0015913ca19c274b +References: git-fixes + +The shifting of the u8 integers rq->caching by 26 bits to +the left will be promoted to a 32 bit signed int and then +sign-extended to a u64. In the event that rq->caching is +greater than 0x1f then all then all the upper 32 bits of +the u64 end up as also being set because of the int +sign-extension. Fix this by casting the u8 values to a +u64 before the 26 bit left shift. + +Addresses-Coverity: ("Unintended sign extension") +Fixes: 4863dea3fab0 ("net: Adding support for Cavium ThunderX network controller") +Signed-off-by: Colin Ian King +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c ++++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c +@@ -776,7 +776,7 @@ static void nicvf_rcv_queue_config(struc + mbx.rq.msg = NIC_MBOX_MSG_RQ_CFG; + mbx.rq.qs_num = qs->vnic_id; + mbx.rq.rq_num = qidx; +- mbx.rq.cfg = (rq->caching << 26) | (rq->cq_qs << 19) | ++ mbx.rq.cfg = ((u64)rq->caching << 26) | (rq->cq_qs << 19) | + (rq->cq_idx << 16) | (rq->cont_rbdr_qs << 9) | + (rq->cont_qs_rbdr_idx << 8) | + (rq->start_rbdr_qs << 1) | (rq->start_qs_rbdr_idx); diff --git a/patches.suse/net-xdp-Update-pkt_type-if-generic-XDP-changes-unica.patch b/patches.suse/net-xdp-Update-pkt_type-if-generic-XDP-changes-unica.patch new file mode 100644 index 0000000..a7a2afe --- /dev/null +++ b/patches.suse/net-xdp-Update-pkt_type-if-generic-XDP-changes-unica.patch @@ -0,0 +1,68 @@ +From: Martin Willi +Date: Mon, 19 Apr 2021 16:15:59 +0200 +Subject: net, xdp: Update pkt_type if generic XDP changes unicast MAC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Patch-mainline: v5.13-rc1 +Git-commit: 22b6034323fd736f260e00b9ea85c634abeb3446 +References: git-fixes + +If a generic XDP program changes the destination MAC address from/to +multicast/broadcast, the skb->pkt_type is updated to properly handle +the packet when passed up the stack. When changing the MAC from/to +the NICs MAC, PACKET_HOST/OTHERHOST is not updated, though, making +the behavior different from that of native XDP. + +Remember the PACKET_HOST/OTHERHOST state before calling the program +in generic XDP, and update pkt_type accordingly if the destination +MAC address has changed. As eth_type_trans() assumes a default +pkt_type of PACKET_HOST, restore that before calling it. + +The use case for this is when a XDP program wants to push received +packets up the stack by rewriting the MAC to the NICs MAC, for +example by cluster nodes sharing MAC addresses. + +Fixes: 297249569932 ("net: fix generic XDP to handle if eth header was mangled") +Signed-off-by: Martin Willi +Signed-off-by: Daniel Borkmann +Acked-by: Toke Høiland-Jørgensen +Link: https://lore.kernel.org/bpf/20210419141559.8611-1-martin@strongswan.org +Acked-by: Thomas Bogendoerfer +--- + net/core/dev.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -4472,9 +4472,9 @@ static u32 netif_receive_generic_xdp(str + struct netdev_rx_queue *rxqueue; + void *orig_data, *orig_data_end; + u32 metalen, act = XDP_DROP; ++ bool orig_bcast, orig_host; + __be16 orig_eth_type; + struct ethhdr *eth; +- bool orig_bcast; + int hlen, off; + u32 mac_len; + +@@ -4516,6 +4516,7 @@ static u32 netif_receive_generic_xdp(str + orig_data_end = xdp->data_end; + orig_data = xdp->data; + eth = (struct ethhdr *)xdp->data; ++ orig_host = ether_addr_equal_64bits(eth->h_dest, skb->dev->dev_addr); + orig_bcast = is_multicast_ether_addr_64bits(eth->h_dest); + orig_eth_type = eth->h_proto; + +@@ -4549,8 +4550,11 @@ static u32 netif_receive_generic_xdp(str + /* check if XDP changed eth hdr such SKB needs update */ + eth = (struct ethhdr *)xdp->data; + if ((orig_eth_type != eth->h_proto) || ++ (orig_host != ether_addr_equal_64bits(eth->h_dest, ++ skb->dev->dev_addr)) || + (orig_bcast != is_multicast_ether_addr_64bits(eth->h_dest))) { + __skb_push(skb, ETH_HLEN); ++ skb->pkt_type = PACKET_HOST; + skb->protocol = eth_type_trans(skb, skb->dev); + } + diff --git a/patches.suse/netdevice-Add-missing-IFF_PHONY_HEADROOM-self-defini.patch b/patches.suse/netdevice-Add-missing-IFF_PHONY_HEADROOM-self-defini.patch new file mode 100644 index 0000000..73157b5 --- /dev/null +++ b/patches.suse/netdevice-Add-missing-IFF_PHONY_HEADROOM-self-defini.patch @@ -0,0 +1,29 @@ +From: Alexander Lobakin +Date: Thu, 18 Feb 2021 20:49:41 +0000 +Subject: netdevice: Add missing IFF_PHONY_HEADROOM self-definition +Patch-mainline: v5.13-rc1 +Git-commit: 2463e073497385ef63c220571013a2b89e9b95cc +References: git-fixes + +This is harmless for now, but can be fatal for future refactors. + +Fixes: 871b642adebe3 ("netdev: introduce ndo_set_rx_headroom") +Signed-off-by: Alexander Lobakin +Signed-off-by: Daniel Borkmann +Acked-by: John Fastabend +Link: https://lore.kernel.org/bpf/20210218204908.5455-2-alobakin@pm.me +Acked-by: Thomas Bogendoerfer +--- + include/linux/netdevice.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -1562,6 +1562,7 @@ enum netdev_priv_flags { + #define IFF_L3MDEV_SLAVE IFF_L3MDEV_SLAVE + #define IFF_TEAM IFF_TEAM + #define IFF_RXFH_CONFIGURED IFF_RXFH_CONFIGURED ++#define IFF_PHONY_HEADROOM IFF_PHONY_HEADROOM + #define IFF_MACSEC IFF_MACSEC + #define IFF_NO_RX_HANDLER IFF_NO_RX_HANDLER + #define IFF_FAILOVER IFF_FAILOVER diff --git a/patches.suse/nvme-define-constants-for-identification-values.patch b/patches.suse/nvme-define-constants-for-identification-values.patch new file mode 100644 index 0000000..24fbde0 --- /dev/null +++ b/patches.suse/nvme-define-constants-for-identification-values.patch @@ -0,0 +1,122 @@ +From: Keith Busch +Date: Fri, 3 Apr 2020 10:53:46 -0700 +Subject: [PATCH] nvme: define constants for identification values +Git-commit: 92decf118f1da4c866515f80387f9cf4d48611d6 +Patch-mainline: v5.8-rc1 +References: git-fixes + +Improve code readability by defining the specification's constants that +the driver is using when decoding identification payloads. + +Signed-off-by: Keith Busch +Reviewed-by: Bart van Assche +Reviewed-by: Chaitanya Kulkarni +Acked-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/core.c | 10 +++++----- + drivers/nvme/host/multipath.c | 5 +++-- + include/linux/nvme.h | 6 ++++++ + 3 files changed, 14 insertions(+), 7 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 4a124a28118f..805d289e6cd9 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1859,13 +1859,13 @@ static void nvme_update_disk_info(struct gendisk *disk, + * and whether it should be used instead of AWUPF. If NAWUPF == + * 0 then AWUPF must be used instead. + */ +- if (id->nsfeat & (1 << 1) && id->nawupf) ++ if (id->nsfeat & NVME_NS_FEAT_ATOMICS && id->nawupf) + atomic_bs = (1 + le16_to_cpu(id->nawupf)) * bs; + else + atomic_bs = (1 + ns->ctrl->subsys->awupf) * bs; + } + +- if (id->nsfeat & (1 << 4)) { ++ if (id->nsfeat & NVME_NS_FEAT_IO_OPT) { + /* NPWG = Namespace Preferred Write Granularity */ + phys_bs = bs * (1 + le16_to_cpu(id->npwg)); + /* NOWS = Namespace Optimal Write Size */ +@@ -1894,7 +1894,7 @@ static void nvme_update_disk_info(struct gendisk *disk, + nvme_config_discard(disk, ns); + nvme_config_write_zeroes(disk, ns); + +- if (id->nsattr & (1 << 0)) ++ if (id->nsattr & NVME_NS_ATTR_RO) + set_disk_ro(disk, true); + else + set_disk_ro(disk, false); +@@ -2685,7 +2685,7 @@ static bool nvme_validate_cntlid(struct nvme_subsystem *subsys, + return false; + } + +- if ((id->cmic & (1 << 1)) || ++ if ((id->cmic & NVME_CTRL_CMIC_MULTI_CTRL) || + (ctrl->opts && ctrl->opts->discovery_nqn)) + continue; + +@@ -3497,7 +3497,7 @@ static int nvme_init_ns_head(struct nvme_ns *ns, unsigned nsid, + struct nvme_id_ns *id) + { + struct nvme_ctrl *ctrl = ns->ctrl; +- bool is_shared = id->nmic & (1 << 0); ++ bool is_shared = id->nmic & NVME_NS_NMIC_SHARED; + struct nvme_ns_head *head = NULL; + struct nvme_ns_ids ids; + int ret = 0; +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index 5f5537d0a024..da78e499947a 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -372,7 +372,7 @@ int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl, struct nvme_ns_head *head) + * We also do this for private namespaces as the namespace sharing data could + * change after a rescan. + */ +- if (!(ctrl->subsys->cmic & (1 << 1)) || !multipath) ++ if (!(ctrl->subsys->cmic & NVME_CTRL_CMIC_MULTI_CTRL) || !multipath) + return 0; + + q = blk_alloc_queue_node(GFP_KERNEL, ctrl->numa_node); +@@ -694,7 +694,8 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) + int error; + + /* check if multipath is enabled and we have the capability */ +- if (!multipath || !ctrl->subsys || !(ctrl->subsys->cmic & (1 << 3))) ++ if (!multipath || !ctrl->subsys || ++ !(ctrl->subsys->cmic & NVME_CTRL_CMIC_ANA)) + return 0; + + ctrl->anacap = id->anacap; +diff --git a/include/linux/nvme.h b/include/linux/nvme.h +index 2d978d0cbde6..b235a48eac8c 100644 +--- a/include/linux/nvme.h ++++ b/include/linux/nvme.h +@@ -301,6 +301,8 @@ struct nvme_id_ctrl { + }; + + enum { ++ NVME_CTRL_CMIC_MULTI_CTRL = 1 << 1, ++ NVME_CTRL_CMIC_ANA = 1 << 3, + NVME_CTRL_ONCS_COMPARE = 1 << 0, + NVME_CTRL_ONCS_WRITE_UNCORRECTABLE = 1 << 1, + NVME_CTRL_ONCS_DSM = 1 << 2, +@@ -396,8 +398,12 @@ enum { + + enum { + NVME_NS_FEAT_THIN = 1 << 0, ++ NVME_NS_FEAT_ATOMICS = 1 << 1, ++ NVME_NS_FEAT_IO_OPT = 1 << 4, ++ NVME_NS_ATTR_RO = 1 << 0, + NVME_NS_FLBAS_LBA_MASK = 0xf, + NVME_NS_FLBAS_META_EXT = 0x10, ++ NVME_NS_NMIC_SHARED = 1 << 0, + NVME_LBAF_RP_BEST = 0, + NVME_LBAF_RP_BETTER = 1, + NVME_LBAF_RP_GOOD = 2, +-- +2.29.2 + diff --git a/patches.suse/nvme-do-not-update-disk-info-for-multipathed-device.patch b/patches.suse/nvme-do-not-update-disk-info-for-multipathed-device.patch deleted file mode 100644 index 4ff61f9..0000000 --- a/patches.suse/nvme-do-not-update-disk-info-for-multipathed-device.patch +++ /dev/null @@ -1,60 +0,0 @@ -From ac55ebb15df8fab1b30b8bfda2c0f463a162db08 Mon Sep 17 00:00:00 2001 -From: Hannes Reinecke -Date: Tue, 15 Sep 2020 11:49:00 +0200 -Subject: nvme: do not update disk info for multipathed device -References: bsc#1171558 -Patch-mainline: Never, handled differently upstream (> ~v5.8, < SLE15-SP3) - -For a multipathed disk it's actually wrong to update the device -parameter when a path comes back; there is a good chance that the -multipath device will have other paths, and updating the device -characteristics has the potential of corrupting/invalidating the -other paths. -A real fix would be to compare the parameters, and reject this path -if they differ. In the absence of such a check just don't update -the disk characteristics for the multipath device. - -Signed-off-by: Hannes Reinecke ---- - drivers/nvme/host/core.c | 9 +++++---- - 1 file changed, 5 insertions(+), 4 deletions(-) - ---- a/drivers/nvme/host/core.c -+++ b/drivers/nvme/host/core.c -@@ -1769,7 +1769,8 @@ static void nvme_update_disk_info(struct - blk_mq_unfreeze_queue(disk->queue); - } - --static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id) -+static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id, -+ bool first_scan) - { - struct nvme_ns *ns = disk->private_data; - u32 iob; -@@ -1800,7 +1801,7 @@ static void __nvme_revalidate_disk(struc - blk_queue_chunk_sectors(ns->queue, rounddown_pow_of_two(iob)); - nvme_update_disk_info(disk, ns, id); - #ifdef CONFIG_NVME_MULTIPATH -- if (ns->head->disk) { -+ if (ns->head->disk && first_scan) { - nvme_update_disk_info(ns->head->disk, ns, id); - blk_queue_stack_limits(ns->head->disk->queue, ns->queue); - revalidate_disk(ns->head->disk); -@@ -1841,7 +1842,7 @@ static int nvme_revalidate_disk(struct g - goto free_id; - } - -- __nvme_revalidate_disk(disk, id); -+ __nvme_revalidate_disk(disk, id, false); - free_id: - kfree(id); - out: -@@ -3494,7 +3495,7 @@ static void nvme_alloc_ns(struct nvme_ct - memcpy(disk->disk_name, disk_name, DISK_NAME_LEN); - ns->disk = disk; - -- __nvme_revalidate_disk(disk, id); -+ __nvme_revalidate_disk(disk, id, true); - - if ((ctrl->quirks & NVME_QUIRK_LIGHTNVM) && id->vs[0] == 0x1) { - ret = nvme_nvm_register(ns, disk_name, node); diff --git a/patches.suse/nvme-don-t-intialize-hwmon-for-discovery-controllers.patch b/patches.suse/nvme-don-t-intialize-hwmon-for-discovery-controllers.patch new file mode 100644 index 0000000..9ecb3b2 --- /dev/null +++ b/patches.suse/nvme-don-t-intialize-hwmon-for-discovery-controllers.patch @@ -0,0 +1,68 @@ +From: Sagi Grimberg +Date: Wed, 13 Jan 2021 16:00:22 -0800 +Subject: nvme: don't intialize hwmon for discovery controllers +Patch-mainline: v5.11-rc4 +Git-commit: 5ab25a32cd90ce561ac28b9302766e565d61304c +References: bsc#1184259 git-fixes + +Discovery controllers usually don't support smart log page command. +So when we connect to the discovery controller we see this warning: +nvme nvme0: Failed to read smart log (error 24577) +nvme nvme0: new ctrl: NQN "nqn.2014-08.org.nvmexpress.discovery", addr 192.168.123.1:8009 +nvme nvme0: Removing ctrl: NQN "nqn.2014-08.org.nvmexpress.discovery" + +Introduce a new helper to understand if the controller is a discovery +controller and use this helper to skip nvme_init_hwmon (also use it in +other places that we check if the controller is a discovery controller). + +Fixes: 400b6a7b13a3 ("nvme: Add hardware monitoring support") +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Acked-by: Hannes Reinecke +Acked-by: Martin Wilck +[hare: adapt for missing nvme_hwmon_init() return value] +--- + drivers/nvme/host/core.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -2608,6 +2608,11 @@ static const struct attribute_group *nvm + NULL, + }; + ++static inline bool nvme_discovery_ctrl(struct nvme_ctrl *ctrl) ++{ ++ return ctrl->opts && ctrl->opts->discovery_nqn; ++} ++ + static bool nvme_validate_cntlid(struct nvme_subsystem *subsys, + struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) + { +@@ -2875,7 +2880,7 @@ static bool nvme_validate_cntlid(struct nvme_subsystem *subsys, + } + + if ((id->cmic & NVME_CTRL_CMIC_MULTI_CTRL) || +- (ctrl->opts && ctrl->opts->discovery_nqn)) ++ nvme_discovery_ctrl(ctrl)) + continue; + + dev_err(ctrl->device, +@@ -3144,7 +3149,7 @@ int nvme_init_identify(struct nvme_ctrl *ctrl) + goto out_free; + } + +- if (!ctrl->opts->discovery_nqn && !ctrl->kas) { ++ if (!nvme_discovery_ctrl(ctrl) && !ctrl->kas) { + dev_err(ctrl->device, + "keep-alive support is mandatory for fabrics\n"); + ret = -EINVAL; +@@ -3184,7 +3189,7 @@ int nvme_init_identify(struct nvme_ctrl *ctrl) + if (ret < 0) + return ret; + +- if (!ctrl->identified) ++ if (!ctrl->identified && !nvme_discovery_ctrl(ctrl)) + nvme_hwmon_init(ctrl); + + ctrl->identified = true; diff --git a/patches.suse/nvme-explicitly-update-mpath-disk-capacity-on-revali.patch b/patches.suse/nvme-explicitly-update-mpath-disk-capacity-on-revali.patch new file mode 100644 index 0000000..0e8bcb7 --- /dev/null +++ b/patches.suse/nvme-explicitly-update-mpath-disk-capacity-on-revali.patch @@ -0,0 +1,73 @@ +From: Anthony Iliopoulos +Date: Tue, 14 Jul 2020 13:11:59 +0200 +Subject: [PATCH] nvme: explicitly update mpath disk capacity on revalidation +Git-commit: 05b29021fba5e725dd385151ef00b6340229b500 +Patch-mainline: v5.8-rc6 +References: git-fixes + +Commit 3b4b19721ec652 ("nvme: fix possible deadlock when I/O is +blocked") reverted multipath head disk revalidation due to deadlocks +caused by holding the bd_mutex during revalidate. + +Updating the multipath disk blockdev size is still required though for +userspace to be able to observe any resizing while the device is +mounted. Directly update the bdev inode size to avoid unnecessarily +holding the bdev->bd_mutex. + +Fixes: 3b4b19721ec652 ("nvme: fix possible deadlock when I/O is +blocked") + +Signed-off-by: Anthony Iliopoulos +Signed-off-by: Christoph Hellwig +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/core.c | 1 + + drivers/nvme/host/nvme.h | 13 +++++++++++++ + 2 files changed, 14 insertions(+) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 8410d03b940d..add040168e67 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1980,6 +1980,7 @@ static int __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id) + if (ns->head->disk) { + nvme_update_disk_info(ns->head->disk, ns, id); + blk_queue_stack_limits(ns->head->disk->queue, ns->queue); ++ nvme_mpath_update_disk_size(ns->head->disk); + } + #endif + } +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index 2ef8d501e2a8..1de3f9b827aa 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -604,6 +604,16 @@ static inline void nvme_trace_bio_complete(struct request *req, + req->bio, status); + } + ++static inline void nvme_mpath_update_disk_size(struct gendisk *disk) ++{ ++ struct block_device *bdev = bdget_disk(disk, 0); ++ ++ if (bdev) { ++ bd_set_size(bdev, get_capacity(disk) << SECTOR_SHIFT); ++ bdput(bdev); ++ } ++} ++ + extern struct device_attribute dev_attr_ana_grpid; + extern struct device_attribute dev_attr_ana_state; + extern struct device_attribute subsys_attr_iopolicy; +@@ -679,6 +689,9 @@ static inline void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys) + static inline void nvme_mpath_start_freeze(struct nvme_subsystem *subsys) + { + } ++static inline void nvme_mpath_update_disk_size(struct gendisk *disk) ++{ ++} + #endif /* CONFIG_NVME_MULTIPATH */ + + #ifdef CONFIG_NVM +-- +2.29.2 + diff --git a/patches.suse/nvme-fix-controller-instance-leak.patch b/patches.suse/nvme-fix-controller-instance-leak.patch new file mode 100644 index 0000000..1f896c0 --- /dev/null +++ b/patches.suse/nvme-fix-controller-instance-leak.patch @@ -0,0 +1,38 @@ +From: Keith Busch +Date: Wed, 26 Aug 2020 10:53:04 -0700 +Subject: [PATCH] nvme: fix controller instance leak +Git-commit: 192f6c29bb28bfd0a17e6ad331d09f1ec84143d0 +Patch-mainline: v5.9-rc4 +References: git-fixes + +If the driver has to unbind from the controller for an early failure +before the subsystem has been set up, there won't be a subsystem holding +the controller's instance, so the controller needs to free its own +instance in this case. + +Fixes: 733e4b69d508d ("nvme: Assign subsys instance from first ctrl") +Signed-off-by: Keith Busch +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Christoph Hellwig +Signed-off-by: Sagi Grimberg +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index e406c3cf55bc..d6186208abf9 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -4394,7 +4394,7 @@ static void nvme_free_ctrl(struct device *dev) + container_of(dev, struct nvme_ctrl, ctrl_device); + struct nvme_subsystem *subsys = ctrl->subsys; + +- if (subsys && ctrl->instance != subsys->instance) ++ if (!subsys || ctrl->instance != subsys->instance) + ida_simple_remove(&nvme_instance_ida, ctrl->instance); + + kfree(ctrl->effects); +-- +2.29.2 + diff --git a/patches.suse/nvme-fix-possible-deadlock-when-I-O-is-blocked.patch b/patches.suse/nvme-fix-possible-deadlock-when-I-O-is-blocked.patch new file mode 100644 index 0000000..c254a04 --- /dev/null +++ b/patches.suse/nvme-fix-possible-deadlock-when-I-O-is-blocked.patch @@ -0,0 +1,122 @@ +From: Sagi Grimberg +Date: Wed, 24 Jun 2020 01:53:08 -0700 +Subject: [PATCH] nvme: fix possible deadlock when I/O is blocked +Git-commit: 3b4b19721ec652ad2c4fe51dfbe5124212b5f581 +Patch-mainline: v5.8-rc3 +References: git-fixes + +Revert fab7772bfbcf ("nvme-multipath: revalidate nvme_ns_head gendisk +in nvme_validate_ns") + +When adding a new namespace to the head disk (via nvme_mpath_set_live) +we will see partition scan which triggers I/O on the mpath device node. +This process will usually be triggered from the scan_work which holds +the scan_lock. If I/O blocks (if we got ana change currently have only +available paths but none are accessible) this can deadlock on the head +disk bd_mutex as both partition scan I/O takes it, and head disk revalidation +takes it to check for resize (also triggered from scan_work on a different +path). See trace [1]. + +The mpath disk revalidation was originally added to detect online disk +size change, but this is no longer needed since commit cb224c3af4df +("nvme: Convert to use set_capacity_revalidate_and_notify") which already +updates resize info without unnecessarily revalidating the disk (the +mpath disk doesn't even implement .revalidate_disk fop). + +[1]: +-- +kernel: INFO: task kworker/u65:9:494 blocked for more than 241 seconds. +kernel: Tainted: G OE 5.3.5-050305-generic #201910071830 +kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +kernel: kworker/u65:9 D 0 494 2 0x80004000 +kernel: Workqueue: nvme-wq nvme_scan_work [nvme_core] +kernel: Call Trace: +kernel: __schedule+0x2b9/0x6c0 +kernel: schedule+0x42/0xb0 +kernel: schedule_preempt_disabled+0xe/0x10 +kernel: __mutex_lock.isra.0+0x182/0x4f0 +kernel: __mutex_lock_slowpath+0x13/0x20 +kernel: mutex_lock+0x2e/0x40 +kernel: revalidate_disk+0x63/0xa0 +kernel: __nvme_revalidate_disk+0xfe/0x110 [nvme_core] +kernel: nvme_revalidate_disk+0xa4/0x160 [nvme_core] +kernel: ? evict+0x14c/0x1b0 +kernel: revalidate_disk+0x2b/0xa0 +kernel: nvme_validate_ns+0x49/0x940 [nvme_core] +kernel: ? blk_mq_free_request+0xd2/0x100 +kernel: ? __nvme_submit_sync_cmd+0xbe/0x1e0 [nvme_core] +kernel: nvme_scan_work+0x24f/0x380 [nvme_core] +kernel: process_one_work+0x1db/0x380 +kernel: worker_thread+0x249/0x400 +kernel: kthread+0x104/0x140 +kernel: ? process_one_work+0x380/0x380 +kernel: ? kthread_park+0x80/0x80 +kernel: ret_from_fork+0x1f/0x40 +... +kernel: INFO: task kworker/u65:1:2630 blocked for more than 241 seconds. +kernel: Tainted: G OE 5.3.5-050305-generic #201910071830 +kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +kernel: kworker/u65:1 D 0 2630 2 0x80004000 +kernel: Workqueue: nvme-wq nvme_scan_work [nvme_core] +kernel: Call Trace: +kernel: __schedule+0x2b9/0x6c0 +kernel: schedule+0x42/0xb0 +kernel: io_schedule+0x16/0x40 +kernel: do_read_cache_page+0x438/0x830 +kernel: ? __switch_to_asm+0x34/0x70 +kernel: ? file_fdatawait_range+0x30/0x30 +kernel: read_cache_page+0x12/0x20 +kernel: read_dev_sector+0x27/0xc0 +kernel: read_lba+0xc1/0x220 +kernel: ? kmem_cache_alloc_trace+0x19c/0x230 +kernel: efi_partition+0x1e6/0x708 +kernel: ? vsnprintf+0x39e/0x4e0 +kernel: ? snprintf+0x49/0x60 +kernel: check_partition+0x154/0x244 +kernel: rescan_partitions+0xae/0x280 +kernel: __blkdev_get+0x40f/0x560 +kernel: blkdev_get+0x3d/0x140 +kernel: __device_add_disk+0x388/0x480 +kernel: device_add_disk+0x13/0x20 +kernel: nvme_mpath_set_live+0x119/0x140 [nvme_core] +kernel: nvme_update_ns_ana_state+0x5c/0x60 [nvme_core] +kernel: nvme_set_ns_ana_state+0x1e/0x30 [nvme_core] +kernel: nvme_parse_ana_log+0xa1/0x180 [nvme_core] +kernel: ? nvme_update_ns_ana_state+0x60/0x60 [nvme_core] +kernel: nvme_mpath_add_disk+0x47/0x90 [nvme_core] +kernel: nvme_validate_ns+0x396/0x940 [nvme_core] +kernel: ? blk_mq_free_request+0xd2/0x100 +kernel: nvme_scan_work+0x24f/0x380 [nvme_core] +kernel: process_one_work+0x1db/0x380 +kernel: worker_thread+0x249/0x400 +kernel: kthread+0x104/0x140 +kernel: ? process_one_work+0x380/0x380 +kernel: ? kthread_park+0x80/0x80 +kernel: ret_from_fork+0x1f/0x40 +-- + +Fixes: fab7772bfbcf ("nvme-multipath: revalidate nvme_ns_head gendisk +in nvme_validate_ns") +Signed-off-by: Anton Eidelman +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/core.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 915fa2e609eb..28f4388c1337 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1974,7 +1974,6 @@ static int __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id) + if (ns->head->disk) { + nvme_update_disk_info(ns->head->disk, ns, id); + blk_queue_stack_limits(ns->head->disk->queue, ns->queue); +- revalidate_disk(ns->head->disk); + } + #endif + } +-- +2.16.4 + diff --git a/patches.suse/nvme-multipath_fix_double_initialization_of_ANA_state.patch b/patches.suse/nvme-multipath_fix_double_initialization_of_ANA_state.patch new file mode 100644 index 0000000..2ee114d --- /dev/null +++ b/patches.suse/nvme-multipath_fix_double_initialization_of_ANA_state.patch @@ -0,0 +1,190 @@ +From: Christoph Hellwig +To: kbusch@kernel.org, sagi@grimberg.me +Cc: linux-nvme@lists.infradead.org, Martin Wilck +Subject: [PATCH] nvme-multipath: fix double initialization of ANA state +Date: Thu, 6 May 2021 15:48:23 +0200 +Message-Id: <20210506134823.2566853-1-hch@lst.de> +Link: https://lore.kernel.org/linux-nvme/20210506134823.2566853-1-hch@lst.de +References: bsc#1178612, bsc#1184259 +Patch-mainline: v5.13-rc2 +Git-commit: 5e1f689913a4498e3081093670ef9d85b2c60920 + +nvme_init_identify and thus nvme_mpath_init can be called multiple +times and thus must not overwrite potentially initialized or in-use +fields. Split out a helper for the basic initialization when the +controller is initialized and make sure the init_identify path does +not blindly change in-use data structures. + +Fixes: 0d0b660f214d ("nvme: add ANA support") +Reported-by: Martin Wilck +Signed-off-by: Christoph Hellwig +Reviewed-by: Keith Busch +Reviewed-by: Sagi Grimberg +Reviewed-by: Hannes Reinecke +Acked-by: Martin Wilck +--- + drivers/nvme/host/core.c | 20 ++++++------- + drivers/nvme/host/multipath.c | 55 ++++++++++++++++++----------------- + drivers/nvme/host/nvme.h | 8 +++-- + 3 files changed, 44 insertions(+), 39 deletions(-) + +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -2970,11 +2970,9 @@ int nvme_init_identify(struct nvme_ctrl *ctrl) + ctrl->hmmaxd = le16_to_cpu(id->hmmaxd); + } + +- ret = nvme_mpath_init(ctrl, id); +- kfree(id); +- ++ ret = nvme_mpath_init_identify(ctrl, id); + if (ret < 0) +- return ret; ++ goto out_free; + + if (ctrl->apst_enabled && !prev_apst_enabled) + dev_pm_qos_expose_latency_tolerance(ctrl->device); +@@ -2983,26 +2981,25 @@ int nvme_init_identify(struct nvme_ctrl *ctrl) + + ret = nvme_configure_apst(ctrl); + if (ret < 0) +- return ret; +- ++ goto out_free; ++ + ret = nvme_configure_timestamp(ctrl); + if (ret < 0) +- return ret; ++ goto out_free; + + ret = nvme_configure_directives(ctrl); + if (ret < 0) +- return ret; ++ goto out_free; + + ret = nvme_configure_acre(ctrl); + if (ret < 0) +- return ret; ++ goto out_free; + + if (!ctrl->identified && !nvme_discovery_ctrl(ctrl)) + nvme_hwmon_init(ctrl); + + ctrl->identified = true; +- +- return 0; ++ ret = 0; + + out_free: + kfree(id); +@@ -4261,6 +4258,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev, + min(default_ps_max_latency_us, (unsigned long)S32_MAX)); + + nvme_fault_inject_init(&ctrl->fault_inject, dev_name(ctrl->device)); ++ nvme_mpath_init_ctrl(ctrl); + + return 0; + out_free_name: +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -730,9 +730,18 @@ void nvme_mpath_remove_disk(struct nvme_ns_head *head) + put_disk(head->disk); + } + +-int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) ++void nvme_mpath_init_ctrl(struct nvme_ctrl *ctrl) + { +- int error; ++ mutex_init(&ctrl->ana_lock); ++ timer_setup(&ctrl->anatt_timer, nvme_anatt_timeout, 0); ++ INIT_WORK(&ctrl->ana_work, nvme_ana_work); ++} ++ ++int nvme_mpath_init_identify(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) ++{ ++ size_t max_transfer_size = ctrl->max_hw_sectors << SECTOR_SHIFT; ++ size_t ana_log_size; ++ int error = 0; + + /* check if multipath is enabled and we have the capability */ + if (!multipath || !ctrl->subsys || +@@ -744,37 +753,31 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) + ctrl->nanagrpid = le32_to_cpu(id->nanagrpid); + ctrl->anagrpmax = le32_to_cpu(id->anagrpmax); + +- mutex_init(&ctrl->ana_lock); +- timer_setup(&ctrl->anatt_timer, nvme_anatt_timeout, 0); +- ctrl->ana_log_size = sizeof(struct nvme_ana_rsp_hdr) + +- ctrl->nanagrpid * sizeof(struct nvme_ana_group_desc); +- ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32); +- +- if (ctrl->ana_log_size > ctrl->max_hw_sectors << SECTOR_SHIFT) { ++ ana_log_size = sizeof(struct nvme_ana_rsp_hdr) + ++ ctrl->nanagrpid * sizeof(struct nvme_ana_group_desc) + ++ ctrl->max_namespaces * sizeof(__le32); ++ if (ana_log_size > max_transfer_size) { + dev_err(ctrl->device, +- "ANA log page size (%zd) larger than MDTS (%d).\n", +- ctrl->ana_log_size, +- ctrl->max_hw_sectors << SECTOR_SHIFT); ++ "ANA log page size (%zd) larger than MDTS (%zd).\n", ++ ana_log_size, max_transfer_size); + dev_err(ctrl->device, "disabling ANA support.\n"); +- return 0; ++ goto out_uninit; + } +- +- INIT_WORK(&ctrl->ana_work, nvme_ana_work); +- kfree(ctrl->ana_log_buf); +- ctrl->ana_log_buf = kmalloc(ctrl->ana_log_size, GFP_KERNEL); +- if (!ctrl->ana_log_buf) { +- error = -ENOMEM; +- goto out; ++ if (ana_log_size > ctrl->ana_log_size) { ++ nvme_mpath_stop(ctrl); ++ kfree(ctrl->ana_log_buf); ++ ctrl->ana_log_buf = kmalloc(ctrl->ana_log_size, GFP_KERNEL); ++ if (!ctrl->ana_log_buf) ++ return -ENOMEM; + } +- ++ ctrl->ana_log_size = ana_log_size; + error = nvme_read_ana_log(ctrl); + if (error) +- goto out_free_ana_log_buf; ++ goto out_uninit; + return 0; +-out_free_ana_log_buf: +- kfree(ctrl->ana_log_buf); +- ctrl->ana_log_buf = NULL; +-out: ++ ++out_uninit: ++ nvme_mpath_uninit(ctrl); + return error; + } + +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -580,7 +580,8 @@ void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl); + int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl,struct nvme_ns_head *head); + void nvme_mpath_add_disk(struct nvme_ns *ns, struct nvme_id_ns *id); + void nvme_mpath_remove_disk(struct nvme_ns_head *head); +-int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id); ++int nvme_mpath_init_identify(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id); ++void nvme_mpath_init_ctrl(struct nvme_ctrl *ctrl); + void nvme_mpath_uninit(struct nvme_ctrl *ctrl); + void nvme_mpath_stop(struct nvme_ctrl *ctrl); + bool nvme_mpath_clear_current_path(struct nvme_ns *ns); +@@ -667,7 +668,10 @@ static inline void nvme_trace_bio_complete(struct request *req, + blk_status_t status) + { + } +-static inline int nvme_mpath_init(struct nvme_ctrl *ctrl, ++static inline void nvme_mpath_init_ctrl(struct nvme_ctrl *ctrl) ++{ ++} ++static inline int nvme_mpath_init_identify(struct nvme_ctrl *ctrl, + struct nvme_id_ctrl *id) + { + if (ctrl->subsys->cmic & (1 << 3)) diff --git a/patches.suse/nvme-retrigger-ANA-log-update-if-group-descriptor-is.patch b/patches.suse/nvme-retrigger-ANA-log-update-if-group-descriptor-is.patch new file mode 100644 index 0000000..abf6da9 --- /dev/null +++ b/patches.suse/nvme-retrigger-ANA-log-update-if-group-descriptor-is.patch @@ -0,0 +1,42 @@ +From: Hannes Reinecke +Date: Sat, 5 Dec 2020 16:29:01 +0100 +Subject: [PATCH] nvme: retrigger ANA log update if group descriptor isn't +Git-commit: dd8f7fa908f66dd44abcd83cbb50410524b9f8ef +Patch-mainline: v5.13-rc1 +References: git-fixes + found + +If ANA is enabled but no ANA group descriptor is found when creating +a new namespace the ANA log is most likely out of date, so trigger +a re-read. The namespace will be tagged with the NS_ANA_PENDING flag +to exclude it from path selection until the ANA log has been re-read. + +Fixes: 32acab3181c7 ("nvme: implement multipath access to nvme subsystems") +Reported-by: Martin George +Signed-off-by: Hannes Reinecke +Reviewed-by: Keith Busch +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/multipath.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index e62369d3eae3..f2d0ce0f4d38 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -668,6 +668,10 @@ void nvme_mpath_add_disk(struct nvme_ns *ns, struct nvme_id_ns *id) + if (desc.state) { + /* found the group desc: update */ + nvme_update_ns_ana_state(&desc, ns); ++ } else { ++ /* group desc not found: trigger a re-read */ ++ set_bit(NVME_NS_ANA_PENDING, &ns->flags); ++ queue_work(nvme_wq, &ns->ctrl->ana_work); + } + } else { + ns->ana_state = NVME_ANA_OPTIMIZED; +-- +2.29.2 + diff --git a/patches.suse/nvme-retrigger-ana-log-update-if-group-descriptor-isn-t.patch b/patches.suse/nvme-retrigger-ana-log-update-if-group-descriptor-isn-t.patch deleted file mode 100644 index d222222..0000000 --- a/patches.suse/nvme-retrigger-ana-log-update-if-group-descriptor-isn-t.patch +++ /dev/null @@ -1,39 +0,0 @@ -From: Hannes Reinecke -Date: Sat, 5 Dec 2020 16:29:01 +0100 -Subject: [PATCH] nvme: retrigger ANA log update if group descriptor isn't - found -Patch-mainline: Not yet, maintainer has not picked the patch up yet. -References: bsc#1179137 - -If ANA is enabled but no ANA group descriptor is found when creating -a new namespace the ANA log is most likely out of date, so trigger -a re-read. The namespace will be tagged with the NS_ANA_PENDING flag -to exclude it from path selection until the ANA log has been re-read. - -Reported-by: Martin George -Signed-off-by: Hannes Reinecke -Reviewed-by: Keith Busch -Reviewed-by: Sagi Grimberg -Acked-by: Daniel Wagner ---- - drivers/nvme/host/multipath.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c -index 1da61a95f2d3..7a36a5ac0737 100644 ---- a/drivers/nvme/host/multipath.c -+++ b/drivers/nvme/host/multipath.c -@@ -694,6 +694,10 @@ void nvme_mpath_add_disk(struct nvme_ns *ns, struct nvme_id_ns *id) - if (desc.state) { - /* found the group desc: update */ - nvme_update_ns_ana_state(&desc, ns); -+ } else { -+ /* group desc not found: trigger a re-read */ -+ set_bit(NVME_NS_ANA_PENDING, &ns->flags); -+ queue_work(nvme_wq, &ns->ctrl->ana_work); - } - } else { - ns->ana_state = NVME_ANA_OPTIMIZED; --- -2.29.2 - diff --git a/patches.suse/nvme-tcp-Fix-possible-race-of-io_work-and-direct-sen.patch b/patches.suse/nvme-tcp-Fix-possible-race-of-io_work-and-direct-sen.patch new file mode 100644 index 0000000..cbe4bda --- /dev/null +++ b/patches.suse/nvme-tcp-Fix-possible-race-of-io_work-and-direct-sen.patch @@ -0,0 +1,83 @@ +From: Sagi Grimberg +Date: Mon, 21 Dec 2020 00:03:39 -0800 +Subject: [PATCH] nvme-tcp: Fix possible race of io_work and direct send +Git-commit: 5c11f7d9f843bdd24cd29b95401938bc3f168070 +Patch-mainline: v5.11-rc3 +References: git-fixes + +We may send a request (with or without its data) from two paths: + + 1. From our I/O context nvme_tcp_io_work which is triggered from: + - queue_rq + - r2t reception + - socket data_ready and write_space callbacks + 2. Directly from queue_rq if the send_list is empty (because we want to + save the context switch associated with scheduling our io_work). + +However, given that now we have the send_mutex, we may run into a race +condition where none of these contexts will send the pending payload to +the controller. Both io_work send path and queue_rq send path +opportunistically attempt to acquire the send_mutex however queue_rq only +attempts to send a single request, and if io_work context fails to +acquire the send_mutex it will complete without rescheduling itself. + +The race can trigger with the following sequence: + + 1. queue_rq sends request (no incapsule data) and blocks + 2. RX path receives r2t - prepares data PDU to send, adds h2cdata PDU + to the send_list and schedules io_work + 3. io_work triggers and cannot acquire the send_mutex - because of (1), + ends without self rescheduling + 4. queue_rq completes the send, and completes + +==> no context will send the h2cdata - timeout. + +Fix this by having queue_rq sending as much as it can from the send_list +such that if it still has any left, its because the socket buffer is +full and the socket write_space callback will trigger, thus guaranteeing +that a context will be scheduled to send the h2cdata PDU. + +Fixes: db5ad6b7f8cd ("nvme-tcp: try to send request in queue_rq context") +Reported-by: Potnuri Bharat Teja +Reported-by: Samuel Jones +Signed-off-by: Sagi Grimberg +Tested-by: Potnuri Bharat Teja +Signed-off-by: Christoph Hellwig +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/tcp.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 1ba659927442..979ee31b8dd1 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -262,6 +262,16 @@ static inline void nvme_tcp_advance_req(struct nvme_tcp_request *req, + } + } + ++static inline void nvme_tcp_send_all(struct nvme_tcp_queue *queue) ++{ ++ int ret; ++ ++ /* drain the send queue as much as we can... */ ++ do { ++ ret = nvme_tcp_try_send(queue); ++ } while (ret > 0); ++} ++ + static inline void nvme_tcp_queue_request(struct nvme_tcp_request *req, + bool sync, bool last) + { +@@ -279,7 +289,7 @@ static inline void nvme_tcp_queue_request(struct nvme_tcp_request *req, + if (queue->io_cpu == smp_processor_id() && + sync && empty && mutex_trylock(&queue->send_mutex)) { + queue->more_requests = !last; +- nvme_tcp_try_send(queue); ++ nvme_tcp_send_all(queue); + queue->more_requests = false; + mutex_unlock(&queue->send_mutex); + } else if (last) { +-- +2.29.2 + diff --git a/patches.suse/nvme-tcp-Fix-warning-with-CONFIG_DEBUG_PREEMPT.patch b/patches.suse/nvme-tcp-Fix-warning-with-CONFIG_DEBUG_PREEMPT.patch new file mode 100644 index 0000000..fe144f9 --- /dev/null +++ b/patches.suse/nvme-tcp-Fix-warning-with-CONFIG_DEBUG_PREEMPT.patch @@ -0,0 +1,37 @@ +From: Sagi Grimberg +Date: Wed, 13 Jan 2021 14:03:04 -0800 +Subject: [PATCH] nvme-tcp: Fix warning with CONFIG_DEBUG_PREEMPT +Git-commit: ada831772188192243f9ea437c46e37e97a5975d +Patch-mainline: v5.11-rc4 +References: git-fixes + +We shouldn't call smp_processor_id() in a preemptible +context, but this is advisory at best, so instead +call __smp_processor_id(). + +Fixes: db5ad6b7f8cd ("nvme-tcp: try to send request in queue_rq context") +Reported-by: Or Gerlitz +Reported-by: Yi Zhang +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/tcp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 979ee31b8dd1..b2e0865785ef 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -286,7 +286,7 @@ static inline void nvme_tcp_queue_request(struct nvme_tcp_request *req, + * directly, otherwise queue io_work. Also, only do that if we + * are on the same cpu, so we don't introduce contention. + */ +- if (queue->io_cpu == smp_processor_id() && ++ if (queue->io_cpu == __smp_processor_id() && + sync && empty && mutex_trylock(&queue->send_mutex)) { + queue->more_requests = !last; + nvme_tcp_send_all(queue); +-- +2.29.2 + diff --git a/patches.suse/nvme-tcp-fix-kconfig-dependency-warning-when-CRYPTO.patch b/patches.suse/nvme-tcp-fix-kconfig-dependency-warning-when-CRYPTO.patch new file mode 100644 index 0000000..b743ca3 --- /dev/null +++ b/patches.suse/nvme-tcp-fix-kconfig-dependency-warning-when-CRYPTO.patch @@ -0,0 +1,44 @@ +From: Necip Fazil Yildiran +Date: Mon, 14 Sep 2020 18:01:21 +0300 +Subject: [PATCH] nvme-tcp: fix kconfig dependency warning when !CRYPTO +Git-commit: af5ad17854f96a6d3c9775e776bd01ab262672a1 +Patch-mainline: v5.9-rc7 +References: git-fixes + +When NVME_TCP is enabled and CRYPTO is disabled, it results in the +following Kbuild warning: + +WARNING: unmet direct dependencies detected for CRYPTO_CRC32C + Depends on [n]: CRYPTO [=n] + Selected by [y]: + - NVME_TCP [=y] && INET [=y] && BLK_DEV_NVME [=y] + +The reason is that NVME_TCP selects CRYPTO_CRC32C without depending on or +selecting CRYPTO while CRYPTO_CRC32C is subordinate to CRYPTO. + +Honor the kconfig menu hierarchy to remove kconfig dependency warnings. + +Fixes: 79fd751d61aa ("nvme: tcp: selects CRYPTO_CRC32C for nvme-tcp") +Signed-off-by: Necip Fazil Yildiran +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig +index 3ed9786b88d8..a44d49d63968 100644 +--- a/drivers/nvme/host/Kconfig ++++ b/drivers/nvme/host/Kconfig +@@ -73,6 +73,7 @@ config NVME_TCP + depends on INET + depends on BLK_DEV_NVME + select NVME_FABRICS ++ select CRYPTO + select CRYPTO_CRC32C + help + This provides support for the NVMe over Fabrics protocol using +-- +2.29.2 + diff --git a/patches.suse/nvme-tcp-fix-misuse-of-__smp_processor_id-with-preem.patch b/patches.suse/nvme-tcp-fix-misuse-of-__smp_processor_id-with-preem.patch new file mode 100644 index 0000000..4b481d7 --- /dev/null +++ b/patches.suse/nvme-tcp-fix-misuse-of-__smp_processor_id-with-preem.patch @@ -0,0 +1,39 @@ +From: Sagi Grimberg +Date: Mon, 15 Mar 2021 13:53:47 -0700 +Subject: [PATCH] nvme-tcp: fix misuse of __smp_processor_id with preemption +Git-commit: bb83337058a7000644cdeffc67361d2473534756 +Patch-mainline: v5.12-rc4 +References: git-fixes + enabled + +For our pure advisory use-case, we only rely on this call as a hint, so +fix the warning complaints of using the smp_processor_id variants with +preemption enabled. + +Fixes: db5ad6b7f8cd ("nvme-tcp: try to send request in queue_rq context") +Fixes: ada831772188 ("nvme-tcp: Fix warning with CONFIG_DEBUG_PREEMPT") +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Tested-by: Yi Zhang +Signed-off-by: Christoph Hellwig +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/tcp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 5b23e1d52cb3..35a78682f8de 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -287,7 +287,7 @@ static inline void nvme_tcp_queue_request(struct nvme_tcp_request *req, + * directly, otherwise queue io_work. Also, only do that if we + * are on the same cpu, so we don't introduce contention. + */ +- if (queue->io_cpu == __smp_processor_id() && ++ if (queue->io_cpu == raw_smp_processor_id() && + sync && empty && mutex_trylock(&queue->send_mutex)) { + queue->more_requests = !last; + nvme_tcp_send_all(queue); +-- +2.29.2 + diff --git a/patches.suse/nvme-tcp-fix-possible-hang-waiting-for-icresp-respon.patch b/patches.suse/nvme-tcp-fix-possible-hang-waiting-for-icresp-respon.patch new file mode 100644 index 0000000..af3dbe8 --- /dev/null +++ b/patches.suse/nvme-tcp-fix-possible-hang-waiting-for-icresp-respon.patch @@ -0,0 +1,36 @@ +From: Sagi Grimberg +Date: Thu, 23 Jul 2020 16:42:26 -0700 +Subject: [PATCH] nvme-tcp: fix possible hang waiting for icresp response +Git-commit: adc99fd378398f4c58798a1c57889872967d56a6 +Patch-mainline: v5.8 +References: bsc#1179519 + +If the controller died exactly when we are receiving icresp +we hang because icresp may never return. Make sure to set a +high finite limit. + +Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver") +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/tcp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 79ef2b8e2b3c..f3a91818167b 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -1382,6 +1382,9 @@ static int nvme_tcp_alloc_queue(struct nvme_ctrl *nctrl, + } + } + ++ /* Set 10 seconds timeout for icresp recvmsg */ ++ queue->sock->sk->sk_rcvtimeo = 10 * HZ; ++ + queue->sock->sk->sk_allocation = GFP_ATOMIC; + nvme_tcp_set_queue_io_cpu(queue); + queue->request = NULL; +-- +2.16.4 + diff --git a/patches.suse/nvmet-fix-a-memory-leak.patch b/patches.suse/nvmet-fix-a-memory-leak.patch new file mode 100644 index 0000000..cef5cc4 --- /dev/null +++ b/patches.suse/nvmet-fix-a-memory-leak.patch @@ -0,0 +1,33 @@ +From: Sagi Grimberg +Date: Thu, 30 Jul 2020 11:51:00 -0700 +Subject: [PATCH] nvmet: fix a memory leak +Git-commit: 382fee1a8b623e2546a3e15e80517389e0e0673e +Patch-mainline: v5.9-rc3 +References: git-fixes + +We forgot to free new_model_number + +Fixes: 013b7ebe5a0d ("nvmet: make ctrl model configurable") +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Sagi Grimberg +Signed-off-by: Jens Axboe +Acked-by: Hannes Reinecke +--- + drivers/nvme/target/configfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c +index 74b2b61c773b..37e1d7784e17 100644 +--- a/drivers/nvme/target/configfs.c ++++ b/drivers/nvme/target/configfs.c +@@ -1136,6 +1136,7 @@ static ssize_t nvmet_subsys_attr_model_store(struct config_item *item, + up_write(&nvmet_config_sem); + + kfree_rcu(new_model, rcuhead); ++ kfree(new_model_number); + + return count; + } +-- +2.29.2 + diff --git a/patches.suse/nvmet-use-new-ana_log_size-instead-the-old-one.patch b/patches.suse/nvmet-use-new-ana_log_size-instead-the-old-one.patch new file mode 100644 index 0000000..5293ac4 --- /dev/null +++ b/patches.suse/nvmet-use-new-ana_log_size-instead-the-old-one.patch @@ -0,0 +1,69 @@ +From: Hou Pu +Date: Thu, 13 May 2021 21:04:10 +0800 +Subject: nvmet: use new ana_log_size instead the old one +Patch-mainline: v5.13-rc2 +Git-commit: e181811bd04d874fe48bbfa1165a82068b58144d +References: bsc#1184259 + +The new ana_log_size should be used instead of the old one. +Or kernel NULL pointer dereference will happen like below: + +[ 38.957849][ T69] BUG: kernel NULL pointer dereference, address: 000000000000003c +[ 38.975550][ T69] #PF: supervisor write access in kernel mode +[ 38.975955][ T69] #PF: error_code(0x0002) - not-present page +[ 38.976905][ T69] PGD 0 P4D 0 +[ 38.979388][ T69] Oops: 0002 [#1] SMP NOPTI +[ 38.980488][ T69] CPU: 0 PID: 69 Comm: kworker/0:2 Not tainted 5.12.0+ #54 +[ 38.981254][ T69] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 +[ 38.982502][ T69] Workqueue: events nvme_loop_execute_work +[ 38.985219][ T69] RIP: 0010:memcpy_orig+0x68/0x10f +[ 38.986203][ T69] Code: 83 c2 20 eb 44 48 01 d6 48 01 d7 48 83 ea 20 0f 1f 00 48 83 ea 20 4c 8b 46 f8 4c 8b 4e f0 4c 8b 56 e8 4c 8b 5e e0 48 8d 76 e0 <4c> 89 47 f8 4c 89 4f f0 4c 89 57 e8 4c 89 5f e0 48 8d 7f e0 73 d2 +[ 38.987677][ T69] RSP: 0018:ffffc900001b7d48 EFLAGS: 00000287 +[ 38.987996][ T69] RAX: 0000000000000020 RBX: 0000000000000024 RCX: 0000000000000010 +[ 38.988327][ T69] RDX: ffffffffffffffe4 RSI: ffff8881084bc004 RDI: 0000000000000044 +[ 38.988620][ T69] RBP: 0000000000000024 R08: 0000000100000000 R09: 0000000000000000 +[ 38.988991][ T69] R10: 0000000100000000 R11: 0000000000000001 R12: 0000000000000024 +[ 38.989289][ T69] R13: ffff8881084bc000 R14: 0000000000000000 R15: 0000000000000024 +[ 38.989845][ T69] FS: 0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 +[ 38.990234][ T69] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 38.990490][ T69] CR2: 000000000000003c CR3: 00000001085b2000 CR4: 00000000000006f0 +[ 38.991105][ T69] Call Trace: +[ 38.994157][ T69] sg_copy_buffer+0xb8/0xf0 +[ 38.995357][ T69] nvmet_copy_to_sgl+0x48/0x6d +[ 38.995565][ T69] nvmet_execute_get_log_page_ana+0xd4/0x1cb +[ 38.995792][ T69] nvmet_execute_get_log_page+0xc9/0x146 +[ 38.995992][ T69] nvme_loop_execute_work+0x3e/0x44 +[ 38.996181][ T69] process_one_work+0x1c3/0x3c0 +[ 38.996393][ T69] worker_thread+0x44/0x3d0 +[ 38.996600][ T69] ? cancel_delayed_work+0x90/0x90 +[ 38.996804][ T69] kthread+0xf7/0x130 +[ 38.996961][ T69] ? kthread_create_worker_on_cpu+0x70/0x70 +[ 38.997171][ T69] ret_from_fork+0x22/0x30 +[ 38.997705][ T69] Modules linked in: +[ 38.998741][ T69] CR2: 000000000000003c +[ 39.000104][ T69] ---[ end trace e719927b609d0fa0 ]--- + +Fixes: 5e1f689913a4 ("nvme-multipath: fix double initialization of ANA state") +Signed-off-by: Hou Pu +Signed-off-by: Christoph Hellwig +Acked-by: Martin Wilck +--- + drivers/nvme/host/multipath.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index deb14562c96a..f81871c7128a 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -817,7 +817,7 @@ int nvme_mpath_init_identify(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) + if (ana_log_size > ctrl->ana_log_size) { + nvme_mpath_stop(ctrl); + kfree(ctrl->ana_log_buf); +- ctrl->ana_log_buf = kmalloc(ctrl->ana_log_size, GFP_KERNEL); ++ ctrl->ana_log_buf = kmalloc(ana_log_size, GFP_KERNEL); + if (!ctrl->ana_log_buf) + return -ENOMEM; + } +-- +2.31.1 + diff --git a/patches.suse/posix-timers-Preserve-return-value-in-clock_adjtime3.patch b/patches.suse/posix-timers-Preserve-return-value-in-clock_adjtime3.patch new file mode 100644 index 0000000..9478342 --- /dev/null +++ b/patches.suse/posix-timers-Preserve-return-value-in-clock_adjtime3.patch @@ -0,0 +1,46 @@ +From 2d036dfa5f10df9782f5278fc591d79d283c1fad Mon Sep 17 00:00:00 2001 +From: Chen Jun +Date: Wed, 14 Apr 2021 03:04:49 +0000 +Subject: [PATCH] posix-timers: Preserve return value in clock_adjtime32() +Git-commit: 2d036dfa5f10df9782f5278fc591d79d283c1fad +Patch-mainline: v5.13-rc1 +References: git-fixes + +The return value on success (>= 0) is overwritten by the return value of +put_old_timex32(). That works correct in the fault case, but is wrong for +the success case where put_old_timex32() returns 0. + +Just check the return value of put_old_timex32() and return -EFAULT in case +it is not zero. + +[ tglx: Massage changelog ] + +Fixes: 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to native counterparts") +Signed-off-by: Chen Jun +Signed-off-by: Thomas Gleixner +Reviewed-by: Richard Cochran +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20210414030449.90692-1-chenjun102@huawei.com +Signed-off-by: Frederic Weisbecker +--- + kernel/time/posix-timers.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c +index bf540f5a4115..dd5697d7347b 100644 +--- a/kernel/time/posix-timers.c ++++ b/kernel/time/posix-timers.c +@@ -1191,8 +1191,8 @@ SYSCALL_DEFINE2(clock_adjtime32, clockid_t, which_clock, + + err = do_clock_adjtime(which_clock, &ktx); + +- if (err >= 0) +- err = put_old_timex32(utp, &ktx); ++ if (err >= 0 && put_old_timex32(utp, &ktx)) ++ return -EFAULT; + + return err; + } +-- +2.25.1 + diff --git a/patches.suse/powerpc-64s-Fix-crashes-when-toggling-entry-flush-ba.patch b/patches.suse/powerpc-64s-Fix-crashes-when-toggling-entry-flush-ba.patch new file mode 100644 index 0000000..2ee9bb1 --- /dev/null +++ b/patches.suse/powerpc-64s-Fix-crashes-when-toggling-entry-flush-ba.patch @@ -0,0 +1,75 @@ +From aec86b052df6541cc97c5fca44e5934cbea4963b Mon Sep 17 00:00:00 2001 +From: Michael Ellerman +Date: Thu, 6 May 2021 14:49:59 +1000 +Subject: [PATCH] powerpc/64s: Fix crashes when toggling entry flush barrier + +References: bsc#1177666 git-fixes +Patch-mainline: v5.13-rc2 +Git-commit: aec86b052df6541cc97c5fca44e5934cbea4963b + +The entry flush mitigation can be enabled/disabled at runtime via a +debugfs file (entry_flush), which causes the kernel to patch itself to +enable/disable the relevant mitigations. + +However depending on which mitigation we're using, it may not be safe to +do that patching while other CPUs are active. For example the following +crash: + + sleeper[15639]: segfault (11) at c000000000004c20 nip c000000000004c20 lr c000000000004c20 + +Shows that we returned to userspace with a corrupted LR that points into +the kernel, due to executing the partially patched call to the fallback +entry flush (ie. we missed the LR restore). + +Fix it by doing the patching under stop machine. The CPUs that aren't +doing the patching will be spinning in the core of the stop machine +logic. That is currently sufficient for our purposes, because none of +the patching we do is to that code or anywhere in the vicinity. + +Fixes: f79643787e0a ("powerpc/64s: flush L1D on kernel entry") +Cc: stable@vger.kernel.org # v5.10+ +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210506044959.1298123-2-mpe@ellerman.id.au +Acked-by: Michal Suchanek +--- + arch/powerpc/lib/feature-fixups.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/lib/feature-fixups.c b/arch/powerpc/lib/feature-fixups.c +index 10083add8b33..0aefa6a4a259 100644 +--- a/arch/powerpc/lib/feature-fixups.c ++++ b/arch/powerpc/lib/feature-fixups.c +@@ -299,8 +299,9 @@ void do_uaccess_flush_fixups(enum l1d_flush_type types) + : "unknown"); + } + +-void do_entry_flush_fixups(enum l1d_flush_type types) ++static int __do_entry_flush_fixups(void *data) + { ++ enum l1d_flush_type types = *(enum l1d_flush_type *)data; + unsigned int instrs[3], *dest; + long *start, *end; + int i; +@@ -369,6 +370,19 @@ void do_entry_flush_fixups(enum l1d_flush_type types) + : "ori type" : + (types & L1D_FLUSH_MTTRIG) ? "mttrig type" + : "unknown"); ++ ++ return 0; ++} ++ ++void do_entry_flush_fixups(enum l1d_flush_type types) ++{ ++ /* ++ * The call to the fallback flush can not be safely patched in/out while ++ * other CPUs are executing it. So call __do_entry_flush_fixups() on one ++ * CPU while all other CPUs spin in the stop machine core with interrupts ++ * hard disabled. ++ */ ++ stop_machine(__do_entry_flush_fixups, &types, NULL); + } + + void do_rfi_flush_fixups(enum l1d_flush_type types) +-- +2.26.2 + diff --git a/patches.suse/powerpc-64s-Fix-crashes-when-toggling-stf-barrier.patch b/patches.suse/powerpc-64s-Fix-crashes-when-toggling-stf-barrier.patch new file mode 100644 index 0000000..3893ae6 --- /dev/null +++ b/patches.suse/powerpc-64s-Fix-crashes-when-toggling-stf-barrier.patch @@ -0,0 +1,83 @@ +From 8ec7791bae1327b1c279c5cd6e929c3b12daaf0a Mon Sep 17 00:00:00 2001 +From: Michael Ellerman +Date: Thu, 6 May 2021 14:49:58 +1000 +Subject: [PATCH] powerpc/64s: Fix crashes when toggling stf barrier + +References: bsc#1087082 git-fixes +Patch-mainline: v5.13-rc2 +Git-commit: 8ec7791bae1327b1c279c5cd6e929c3b12daaf0a + +The STF (store-to-load forwarding) barrier mitigation can be +enabled/disabled at runtime via a debugfs file (stf_barrier), which +causes the kernel to patch itself to enable/disable the relevant +mitigations. + +However depending on which mitigation we're using, it may not be safe to +do that patching while other CPUs are active. For example the following +crash: + + User access of kernel address (c00000003fff5af0) - exploit attempt? (uid: 0) + segfault (11) at c00000003fff5af0 nip 7fff8ad12198 lr 7fff8ad121f8 code 1 + code: 40820128 e93c00d0 e9290058 7c292840 40810058 38600000 4bfd9a81 e8410018 + code: 2c030006 41810154 3860ffb6 e9210098 7d295279 39400000 40820a3c + +Shows that we returned to userspace without restoring the user r13 +value, due to executing the partially patched STF exit code. + +Fix it by doing the patching under stop machine. The CPUs that aren't +doing the patching will be spinning in the core of the stop machine +logic. That is currently sufficient for our purposes, because none of +the patching we do is to that code or anywhere in the vicinity. + +Fixes: a048a07d7f45 ("powerpc/64s: Add support for a store forwarding barrier at kernel entry/exit") +Cc: stable@vger.kernel.org # v4.17+ +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210506044959.1298123-1-mpe@ellerman.id.au +Acked-by: Michal Suchanek +--- + arch/powerpc/lib/feature-fixups.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/lib/feature-fixups.c b/arch/powerpc/lib/feature-fixups.c +index 1fd31b4b0e13..10083add8b33 100644 +--- a/arch/powerpc/lib/feature-fixups.c ++++ b/arch/powerpc/lib/feature-fixups.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -227,11 +228,25 @@ static void do_stf_exit_barrier_fixups(enum stf_barrier_type types) + : "unknown"); + } + ++static int __do_stf_barrier_fixups(void *data) ++{ ++ enum stf_barrier_type *types = data; ++ ++ do_stf_entry_barrier_fixups(*types); ++ do_stf_exit_barrier_fixups(*types); ++ ++ return 0; ++} + + void do_stf_barrier_fixups(enum stf_barrier_type types) + { +- do_stf_entry_barrier_fixups(types); +- do_stf_exit_barrier_fixups(types); ++ /* ++ * The call to the fallback entry flush, and the fallback/sync-ori exit ++ * flush can not be safely patched in/out while other CPUs are executing ++ * them. So call __do_stf_barrier_fixups() on one CPU while all other CPUs ++ * spin in the stop machine core with interrupts hard disabled. ++ */ ++ stop_machine(__do_stf_barrier_fixups, &types, NULL); + } + + void do_uaccess_flush_fixups(enum l1d_flush_type types) +-- +2.26.2 + diff --git a/patches.suse/sched-eas-Don-t-update-misfit-status-if-the-task-is-.patch b/patches.suse/sched-eas-Don-t-update-misfit-status-if-the-task-is-.patch new file mode 100644 index 0000000..fab24dc --- /dev/null +++ b/patches.suse/sched-eas-Don-t-update-misfit-status-if-the-task-is-.patch @@ -0,0 +1,52 @@ +From 0ae78eec8aa64e645866e75005162603a77a0f49 Mon Sep 17 00:00:00 2001 +From: Qais Yousef +Date: Tue, 19 Jan 2021 12:07:55 +0000 +Subject: [PATCH] sched/eas: Don't update misfit status if the task is pinned +Git-commit: 0ae78eec8aa64e645866e75005162603a77a0f49 +Patch-mainline: v5.12-rc1 +References: git-fixes + +If the task is pinned to a cpu, setting the misfit status means that +we'll unnecessarily continuously attempt to migrate the task but fail. + +This continuous failure will cause the balance_interval to increase to +a high value, and eventually cause unnecessary significant delays in +balancing the system when real imbalance happens. + +Caught while testing uclamp where rt-app calibration loop was pinned to +cpu 0, shortly after which we spawn another task with high util_clamp +value. The task was failing to migrate after over 40ms of runtime due to +balance_interval unnecessary expanded to a very high value from the +calibration loop. + +Not done here, but it could be useful to extend the check for pinning to +verify that the affinity of the task has a cpu that fits. We could end +up in a similar situation otherwise. + +Fixes: 3b1baa6496e6 ("sched/fair: Add 'group_misfit_task' load-balance type") +Signed-off-by: Qais Yousef +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Quentin Perret +Acked-by: Valentin Schneider +Link: https://lkml.kernel.org/r/20210119120755.2425264-1-qais.yousef@arm.com +Signed-off-by: Frederic Weisbecker +--- + kernel/sched/fair.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 197a51473e0c..9379a481dd8c 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -4060,7 +4060,7 @@ static inline void update_misfit_status(struct task_struct *p, struct rq *rq) + if (!static_branch_unlikely(&sched_asym_cpucapacity)) + return; + +- if (!p) { ++ if (!p || p->nr_cpus_allowed == 1) { + rq->misfit_task_load = 0; + return; + } +-- +2.25.1 + diff --git a/patches.suse/sched-fair-Avoid-stale-CPU-util_est-value-for-schedu.patch b/patches.suse/sched-fair-Avoid-stale-CPU-util_est-value-for-schedu.patch new file mode 100644 index 0000000..22c44e7 --- /dev/null +++ b/patches.suse/sched-fair-Avoid-stale-CPU-util_est-value-for-schedu.patch @@ -0,0 +1,154 @@ +From 8c1f560c1ea3f19e22ba356f62680d9d449c9ec2 Mon Sep 17 00:00:00 2001 +From: Xuewen Yan +Date: Fri, 18 Dec 2020 17:27:52 +0800 +Subject: [PATCH] sched/fair: Avoid stale CPU util_est value for schedutil in + task dequeue +Git-commit: 8c1f560c1ea3f19e22ba356f62680d9d449c9ec2 +Patch-mainline: v5.12-rc1 +References: git-fixes + +CPU (root cfs_rq) estimated utilization (util_est) is currently used in +dequeue_task_fair() to drive frequency selection before it is updated. + +With: + +CPU_util : rq->cfs.avg.util_avg +CPU_util_est : rq->cfs.avg.util_est +CPU_utilization : max(CPU_util, CPU_util_est) +task_util : p->se.avg.util_avg +task_util_est : p->se.avg.util_est + +Dequeue_task_fair(): + + /* (1) CPU_util and task_util update + inform schedutil about + CPU_utilization changes */ + for_each_sched_entity() /* 2 loops */ + (dequeue_entity() ->) update_load_avg() -> cfs_rq_util_change() + -> cpufreq_update_util() ->...-> sugov_update_[shared\|single] + -> sugov_get_util() -> cpu_util_cfs() + + /* (2) CPU_util_est and task_util_est update */ + util_est_dequeue() + +cpu_util_cfs() uses CPU_utilization which could lead to a false (too +high) utilization value for schedutil in task ramp-down or ramp-up +scenarios during task dequeue. + +To mitigate the issue split the util_est update (2) into: + + (A) CPU_util_est update in util_est_dequeue() + (B) task_util_est update in util_est_update() + +Place (A) before (1) and keep (B) where (2) is. The latter is necessary +since (B) relies on task_util update in (1). + +Fixes: 7f65ea42eb00 ("sched/fair: Add util_est on top of PELT") +Signed-off-by: Xuewen Yan +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Dietmar Eggemann +Reviewed-by: Vincent Guittot +Link: https://lkml.kernel.org/r/1608283672-18240-1-git-send-email-xuewen.yan94@gmail.com +Signed-off-by: Frederic Weisbecker +--- + kernel/sched/fair.c | 43 ++++++++++++++++++++++++++++--------------- + 1 file changed, 28 insertions(+), 15 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 389cb58655c0..40d3ebfb5a48 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -3943,6 +3943,22 @@ static inline void util_est_enqueue(struct cfs_rq *cfs_rq, + trace_sched_util_est_cfs_tp(cfs_rq); + } + ++static inline void util_est_dequeue(struct cfs_rq *cfs_rq, ++ struct task_struct *p) ++{ ++ unsigned int enqueued; ++ ++ if (!sched_feat(UTIL_EST)) ++ return; ++ ++ /* Update root cfs_rq's estimated utilization */ ++ enqueued = cfs_rq->avg.util_est.enqueued; ++ enqueued -= min_t(unsigned int, enqueued, _task_util_est(p)); ++ WRITE_ONCE(cfs_rq->avg.util_est.enqueued, enqueued); ++ ++ trace_sched_util_est_cfs_tp(cfs_rq); ++} ++ + /* + * Check if a (signed) value is within a specified (unsigned) margin, + * based on the observation that: +@@ -3956,23 +3972,16 @@ static inline bool within_margin(int value, int margin) + return ((unsigned int)(value + margin - 1) < (2 * margin - 1)); + } + +-static void +-util_est_dequeue(struct cfs_rq *cfs_rq, struct task_struct *p, bool task_sleep) ++static inline void util_est_update(struct cfs_rq *cfs_rq, ++ struct task_struct *p, ++ bool task_sleep) + { + long last_ewma_diff; + struct util_est ue; +- int cpu; + + if (!sched_feat(UTIL_EST)) + return; + +- /* Update root cfs_rq's estimated utilization */ +- ue.enqueued = cfs_rq->avg.util_est.enqueued; +- ue.enqueued -= min_t(unsigned int, ue.enqueued, _task_util_est(p)); +- WRITE_ONCE(cfs_rq->avg.util_est.enqueued, ue.enqueued); +- +- trace_sched_util_est_cfs_tp(cfs_rq); +- + /* + * Skip update of task's estimated utilization when the task has not + * yet completed an activation, e.g. being migrated. +@@ -4012,8 +4021,7 @@ util_est_dequeue(struct cfs_rq *cfs_rq, struct task_struct *p, bool task_sleep) + * To avoid overestimation of actual task utilization, skip updates if + * we cannot grant there is idle time in this CPU. + */ +- cpu = cpu_of(rq_of(cfs_rq)); +- if (task_util(p) > capacity_orig_of(cpu)) ++ if (task_util(p) > capacity_orig_of(cpu_of(rq_of(cfs_rq)))) + return; + + /* +@@ -4096,8 +4104,11 @@ static inline void + util_est_enqueue(struct cfs_rq *cfs_rq, struct task_struct *p) {} + + static inline void +-util_est_dequeue(struct cfs_rq *cfs_rq, struct task_struct *p, +- bool task_sleep) {} ++util_est_dequeue(struct cfs_rq *cfs_rq, struct task_struct *p) {} ++ ++static inline void ++util_est_update(struct cfs_rq *cfs_rq, struct task_struct *p, ++ bool task_sleep) {} + static inline void update_misfit_status(struct task_struct *p, struct rq *rq) {} + + #endif /* CONFIG_SMP */ +@@ -5609,6 +5620,8 @@ static void dequeue_task_fair(struct rq *rq, struct task_struct *p, int flags) + int idle_h_nr_running = task_has_idle_policy(p); + bool was_sched_idle = sched_idle_rq(rq); + ++ util_est_dequeue(&rq->cfs, p); ++ + for_each_sched_entity(se) { + cfs_rq = cfs_rq_of(se); + dequeue_entity(cfs_rq, se, flags); +@@ -5659,7 +5672,7 @@ static void dequeue_task_fair(struct rq *rq, struct task_struct *p, int flags) + rq->next_balance = jiffies; + + dequeue_throttle: +- util_est_dequeue(&rq->cfs, p, task_sleep); ++ util_est_update(&rq->cfs, p, task_sleep); + hrtick_update(rq); + } + +-- +2.25.1 + diff --git a/patches.suse/sched-fair-Fix-unfairness-caused-by-missing-load-dec.patch b/patches.suse/sched-fair-Fix-unfairness-caused-by-missing-load-dec.patch new file mode 100644 index 0000000..21e937d --- /dev/null +++ b/patches.suse/sched-fair-Fix-unfairness-caused-by-missing-load-dec.patch @@ -0,0 +1,122 @@ +From 0258bdfaff5bd13c4d2383150b7097aecd6b6d82 Mon Sep 17 00:00:00 2001 +From: Odin Ugedal +Date: Sat, 1 May 2021 16:19:50 +0200 +Subject: [PATCH] sched/fair: Fix unfairness caused by missing load decay +Git-commit: 0258bdfaff5bd13c4d2383150b7097aecd6b6d82 +Patch-mainline: v5.13-rc1 +References: git-fixes + +This fixes an issue where old load on a cfs_rq is not properly decayed, +resulting in strange behavior where fairness can decrease drastically. +Real workloads with equally weighted control groups have ended up +getting a respective 99% and 1%(!!) of cpu time. + +When an idle task is attached to a cfs_rq by attaching a pid to a cgroup, +the old load of the task is attached to the new cfs_rq and sched_entity by +attach_entity_cfs_rq. If the task is then moved to another cpu (and +therefore cfs_rq) before being enqueued/woken up, the load will be moved +to cfs_rq->removed from the sched_entity. Such a move will happen when +enforcing a cpuset on the task (eg. via a cgroup) that force it to move. + +The load will however not be removed from the task_group itself, making +it look like there is a constant load on that cfs_rq. This causes the +vruntime of tasks on other sibling cfs_rq's to increase faster than they +are supposed to; causing severe fairness issues. If no other task is +started on the given cfs_rq, and due to the cpuset it would not happen, +this load would never be properly unloaded. With this patch the load +will be properly removed inside update_blocked_averages. This also +applies to tasks moved to the fair scheduling class and moved to another +cpu, and this path will also fix that. For fork, the entity is queued +right away, so this problem does not affect that. + +This applies to cases where the new process is the first in the cfs_rq, +issue introduced 3d30544f0212 ("sched/fair: Apply more PELT fixes"), and +when there has previously been load on the cgroup but the cgroup was +removed from the leaflist due to having null PELT load, indroduced +in 039ae8bcf7a5 ("sched/fair: Fix O(nr_cgroups) in the load balancing +path"). + +For a simple cgroup hierarchy (as seen below) with two equally weighted +groups, that in theory should get 50/50 of cpu time each, it often leads +to a load of 60/40 or 70/30. + +parent/ + cg-1/ + cpu.weight: 100 + cpuset.cpus: 1 + cg-2/ + cpu.weight: 100 + cpuset.cpus: 1 + +If the hierarchy is deeper (as seen below), while keeping cg-1 and cg-2 +equally weighted, they should still get a 50/50 balance of cpu time. +This however sometimes results in a balance of 10/90 or 1/99(!!) between +the task groups. + +$ ps u -C stress +USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND +root 18568 1.1 0.0 3684 100 pts/12 R+ 13:36 0:00 stress --cpu 1 +root 18580 99.3 0.0 3684 100 pts/12 R+ 13:36 0:09 stress --cpu 1 + +parent/ + cg-1/ + cpu.weight: 100 + sub-group/ + cpu.weight: 1 + cpuset.cpus: 1 + cg-2/ + cpu.weight: 100 + sub-group/ + cpu.weight: 10000 + cpuset.cpus: 1 + +This can be reproduced by attaching an idle process to a cgroup and +moving it to a given cpuset before it wakes up. The issue is evident in +many (if not most) container runtimes, and has been reproduced +with both crun and runc (and therefore docker and all its "derivatives"), +and with both cgroup v1 and v2. + +Fixes: 3d30544f0212 ("sched/fair: Apply more PELT fixes") +Fixes: 039ae8bcf7a5 ("sched/fair: Fix O(nr_cgroups) in the load balancing path") +Signed-off-by: Odin Ugedal +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Vincent Guittot +Link: https://lkml.kernel.org/r/20210501141950.23622-2-odin@uged.al +Signed-off-by: Frederic Weisbecker +--- + kernel/sched/fair.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 1d75af1ecfb4..20aa234ffe04 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -10878,16 +10878,22 @@ static void propagate_entity_cfs_rq(struct sched_entity *se) + { + struct cfs_rq *cfs_rq; + ++ list_add_leaf_cfs_rq(cfs_rq_of(se)); ++ + /* Start to propagate at parent */ + se = se->parent; + + for_each_sched_entity(se) { + cfs_rq = cfs_rq_of(se); + +- if (cfs_rq_throttled(cfs_rq)) +- break; ++ if (!cfs_rq_throttled(cfs_rq)){ ++ update_load_avg(cfs_rq, se, UPDATE_TG); ++ list_add_leaf_cfs_rq(cfs_rq); ++ continue; ++ } + +- update_load_avg(cfs_rq, se, UPDATE_TG); ++ if (list_add_leaf_cfs_rq(cfs_rq)) ++ break; + } + } + #else +-- +2.25.1 + diff --git a/patches.suse/serial-core-return-early-on-unsupported-ioctls.patch b/patches.suse/serial-core-return-early-on-unsupported-ioctls.patch new file mode 100644 index 0000000..b54d2ed --- /dev/null +++ b/patches.suse/serial-core-return-early-on-unsupported-ioctls.patch @@ -0,0 +1,60 @@ +From 79c5966cec7b148199386ef9933c31b999379065 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 7 Apr 2021 11:52:08 +0200 +Subject: [PATCH] serial: core: return early on unsupported ioctls +Git-commit: 79c5966cec7b148199386ef9933c31b999379065 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Drivers can return -ENOIOCTLCMD when an ioctl is not recognised to tell +the upper layers to continue looking for a handler. + +This is not the case for the RS485 and ISO7816 ioctls whose handlers +should return -ENOTTY directly in case a serial driver does not +implement the corresponding methods. + +Fixes: a5f276f10ff7 ("serial_core: Handle TIOC[GS]RS485 ioctls.") +Fixes: ad8c0eaa0a41 ("tty/serial_core: add ISO7816 infrastructure") +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210407095208.31838-9-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/serial/serial_core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index 59336943a86f..87f7127b57e6 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -1303,7 +1303,7 @@ static int uart_set_rs485_config(struct uart_port *port, + unsigned long flags; + + if (!port->rs485_config) +- return -ENOIOCTLCMD; ++ return -ENOTTY; + + if (copy_from_user(&rs485, rs485_user, sizeof(*rs485_user))) + return -EFAULT; +@@ -1327,7 +1327,7 @@ static int uart_get_iso7816_config(struct uart_port *port, + struct serial_iso7816 aux; + + if (!port->iso7816_config) +- return -ENOIOCTLCMD; ++ return -ENOTTY; + + spin_lock_irqsave(&port->lock, flags); + aux = port->iso7816; +@@ -1347,7 +1347,7 @@ static int uart_set_iso7816_config(struct uart_port *port, + unsigned long flags; + + if (!port->iso7816_config) +- return -ENOIOCTLCMD; ++ return -ENOTTY; + + if (copy_from_user(&iso7816, iso7816_user, sizeof(*iso7816_user))) + return -EFAULT; +-- +2.26.2 + diff --git a/patches.suse/serial-stm32-fix-incorrect-characters-on-console.patch b/patches.suse/serial-stm32-fix-incorrect-characters-on-console.patch new file mode 100644 index 0000000..081c9dd --- /dev/null +++ b/patches.suse/serial-stm32-fix-incorrect-characters-on-console.patch @@ -0,0 +1,59 @@ +From f264c6f6aece81a9f8fbdf912b20bd3feb476a7a Mon Sep 17 00:00:00 2001 +From: Erwan Le Ray +Date: Thu, 4 Mar 2021 17:22:58 +0100 +Subject: [PATCH] serial: stm32: fix incorrect characters on console +Git-commit: f264c6f6aece81a9f8fbdf912b20bd3feb476a7a +Patch-mainline: v5.13-rc1 +References: git-fixes + +Incorrect characters are observed on console during boot. This issue occurs +when init/main.c is modifying termios settings to open /dev/console on the +rootfs. + +This patch adds a waiting loop in set_termios to wait for TX shift register +empty (and TX FIFO if any) before stopping serial port. + +Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver") +Signed-off-by: Erwan Le Ray +Link: https://lore.kernel.org/r/20210304162308.8984-4-erwan.leray@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/serial/stm32-usart.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index c6ca8f964c69..eae54b8cf5e2 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -738,8 +738,9 @@ static void stm32_usart_set_termios(struct uart_port *port, + unsigned int baud, bits; + u32 usartdiv, mantissa, fraction, oversampling; + tcflag_t cflag = termios->c_cflag; +- u32 cr1, cr2, cr3; ++ u32 cr1, cr2, cr3, isr; + unsigned long flags; ++ int ret; + + if (!stm32_port->hw_flow_control) + cflag &= ~CRTSCTS; +@@ -748,6 +749,15 @@ static void stm32_usart_set_termios(struct uart_port *port, + + spin_lock_irqsave(&port->lock, flags); + ++ ret = readl_relaxed_poll_timeout_atomic(port->membase + ofs->isr, ++ isr, ++ (isr & USART_SR_TC), ++ 10, 100000); ++ ++ /* Send the TC error message only when ISR_TC is not set. */ ++ if (ret) ++ dev_err(port->dev, "Transmission is not complete\n"); ++ + /* Stop serial port and reset value */ + writel_relaxed(0, port->membase + ofs->cr1); + +-- +2.26.2 + diff --git a/patches.suse/serial-stm32-fix-tx_empty-condition.patch b/patches.suse/serial-stm32-fix-tx_empty-condition.patch new file mode 100644 index 0000000..6b9253a --- /dev/null +++ b/patches.suse/serial-stm32-fix-tx_empty-condition.patch @@ -0,0 +1,54 @@ +From 3db1d52466dc11dca4e47ef12a6e6e97f846af62 Mon Sep 17 00:00:00 2001 +From: Erwan Le Ray +Date: Thu, 4 Mar 2021 17:23:07 +0100 +Subject: [PATCH] serial: stm32: fix tx_empty condition +Git-commit: 3db1d52466dc11dca4e47ef12a6e6e97f846af62 +Patch-mainline: v5.13-rc1 +References: git-fixes + +In "tx_empty", we should poll TC bit in both DMA and PIO modes (instead of +TXE) to check transmission data register has been transmitted independently +of the FIFO mode. TC indicates that both transmit register and shift +register are empty. When shift register is empty, tx_empty should return +TIOCSER_TEMT instead of TC value. + +Cleans the USART_CR_TC TCCF register define (transmission complete clear +flag) as it is duplicate of USART_ICR_TCCF. + +Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver") +Signed-off-by: Erwan Le Ray +Link: https://lore.kernel.org/r/20210304162308.8984-13-erwan.leray@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/serial/stm32-usart.c | 5 ++++- + drivers/tty/serial/stm32-usart.h | 3 --- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -501,7 +501,10 @@ static unsigned int stm32_tx_empty(struc + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + +- return readl_relaxed(port->membase + ofs->isr) & USART_SR_TXE; ++ if (readl_relaxed(port->membase + ofs->isr) & USART_SR_TC) ++ return TIOCSER_TEMT; ++ ++ return 0; + } + + static void stm32_set_mctrl(struct uart_port *port, unsigned int mctrl) +--- a/drivers/tty/serial/stm32-usart.h ++++ b/drivers/tty/serial/stm32-usart.h +@@ -127,9 +127,6 @@ struct stm32_usart_info stm32h7_info = { + /* Dummy bits */ + #define USART_SR_DUMMY_RX BIT(16) + +-/* USART_ICR (F7) */ +-#define USART_CR_TC BIT(6) +- + /* USART_DR */ + #define USART_DR_MASK GENMASK(8, 0) + diff --git a/patches.suse/smc-disallow-TCP_ULP-in-smc_setsockopt.patch b/patches.suse/smc-disallow-TCP_ULP-in-smc_setsockopt.patch new file mode 100644 index 0000000..efd5d87 --- /dev/null +++ b/patches.suse/smc-disallow-TCP_ULP-in-smc_setsockopt.patch @@ -0,0 +1,48 @@ +From: Cong Wang +Date: Wed, 5 May 2021 12:40:48 -0700 +Subject: smc: disallow TCP_ULP in smc_setsockopt() +Patch-mainline: v5.13-rc1 +Git-commit: 8621436671f3a4bba5db57482e1ee604708bf1eb +References: git-fixes + +syzbot is able to setup kTLS on an SMC socket which coincidentally +uses sk_user_data too. Later, kTLS treats it as psock so triggers a +refcnt warning. The root cause is that smc_setsockopt() simply calls +TCP setsockopt() which includes TCP_ULP. I do not think it makes +sense to setup kTLS on top of SMC sockets, so we should just disallow +this setup. + +It is hard to find a commit to blame, but we can apply this patch +since the beginning of TCP_ULP. + +Reported-and-tested-by: syzbot+b54a1ce86ba4a623b7f0@syzkaller.appspotmail.com +Fixes: 734942cc4ea6 ("tcp: ULP infrastructure") +Cc: John Fastabend +Signed-off-by: Karsten Graul +Signed-off-by: Cong Wang +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + net/smc/af_smc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -1721,6 +1721,9 @@ static int smc_setsockopt(struct socket + struct smc_sock *smc; + int val, rc; + ++ if (level == SOL_TCP && optname == TCP_ULP) ++ return -EOPNOTSUPP; ++ + smc = smc_sk(sk); + + /* generic setsockopts reaching us here always apply to the +@@ -1742,7 +1745,6 @@ static int smc_setsockopt(struct socket + if (rc || smc->use_fallback) + goto out; + switch (optname) { +- case TCP_ULP: + case TCP_FASTOPEN: + case TCP_FASTOPEN_CONNECT: + case TCP_FASTOPEN_KEY: diff --git a/patches.suse/tty-amiserial-fix-TIOCSSERIAL-permission-check.patch b/patches.suse/tty-amiserial-fix-TIOCSSERIAL-permission-check.patch new file mode 100644 index 0000000..38f5205 --- /dev/null +++ b/patches.suse/tty-amiserial-fix-TIOCSSERIAL-permission-check.patch @@ -0,0 +1,38 @@ +From 1d31a831cc04f5f942de3e7d91edaa52310d3c99 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 7 Apr 2021 12:23:26 +0200 +Subject: [PATCH] tty: amiserial: fix TIOCSSERIAL permission check +Git-commit: 1d31a831cc04f5f942de3e7d91edaa52310d3c99 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Changing the port closing_wait parameter is a privileged operation. + +Add the missing check to TIOCSSERIAL so that -EPERM is returned in case +an unprivileged user tries to change the closing-wait setting. + +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210407102334.32361-9-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/amiserial.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/tty/amiserial.c b/drivers/tty/amiserial.c +index 0c8157fab17f..ec6802ba2bf8 100644 +--- a/drivers/tty/amiserial.c ++++ b/drivers/tty/amiserial.c +@@ -970,6 +970,7 @@ static int set_serial_info(struct tty_struct *tty, struct serial_struct *ss) + if (!serial_isroot()) { + if ((ss->baud_base != state->baud_base) || + (ss->close_delay != port->close_delay) || ++ (ss->closing_wait != port->closing_wait) || + (ss->xmit_fifo_size != state->xmit_fifo_size) || + ((ss->flags & ~ASYNC_USR_MASK) != + (port->flags & ~ASYNC_USR_MASK))) { +-- +2.26.2 + diff --git a/patches.suse/tty-moxa-fix-TIOCSSERIAL-jiffies-conversions.patch b/patches.suse/tty-moxa-fix-TIOCSSERIAL-jiffies-conversions.patch new file mode 100644 index 0000000..1a303c4 --- /dev/null +++ b/patches.suse/tty-moxa-fix-TIOCSSERIAL-jiffies-conversions.patch @@ -0,0 +1,50 @@ +From 6e70b73ca5240c0059a1fbf8ccd4276d6cf71956 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 7 Apr 2021 12:23:28 +0200 +Subject: [PATCH] tty: moxa: fix TIOCSSERIAL jiffies conversions +Git-commit: 6e70b73ca5240c0059a1fbf8ccd4276d6cf71956 +Patch-mainline: v5.13-rc1 +References: git-fixes + +The port close_delay parameter set by TIOCSSERIAL is specified in +jiffies, while the value returned by TIOCGSERIAL is specified in +centiseconds. + +Add the missing conversions so that TIOCGSERIAL works as expected also +when HZ is not 100. + +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210407102334.32361-11-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/moxa.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/moxa.c b/drivers/tty/moxa.c +index 32eb6b5e510f..5b7bc7af8b1e 100644 +--- a/drivers/tty/moxa.c ++++ b/drivers/tty/moxa.c +@@ -2038,7 +2038,7 @@ static int moxa_get_serial_info(struct tty_struct *tty, + ss->line = info->port.tty->index, + ss->flags = info->port.flags, + ss->baud_base = 921600, +- ss->close_delay = info->port.close_delay; ++ ss->close_delay = jiffies_to_msecs(info->port.close_delay) / 10; + mutex_unlock(&info->port.mutex); + return 0; + } +@@ -2067,7 +2067,7 @@ static int moxa_set_serial_info(struct tty_struct *tty, + return -EPERM; + } + } +- info->port.close_delay = ss->close_delay * HZ / 100; ++ info->port.close_delay = msecs_to_jiffies(ss->close_delay * 10); + + MoxaSetFifo(info, ss->type == PORT_16550A); + +-- +2.26.2 + diff --git a/patches.suse/tty-moxa-fix-TIOCSSERIAL-permission-check.patch b/patches.suse/tty-moxa-fix-TIOCSSERIAL-permission-check.patch new file mode 100644 index 0000000..c95e40d --- /dev/null +++ b/patches.suse/tty-moxa-fix-TIOCSSERIAL-permission-check.patch @@ -0,0 +1,66 @@ +From dc8c8437658667be9b11ec25c4b5482ed2becdaa Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 7 Apr 2021 12:23:29 +0200 +Subject: [PATCH] tty: moxa: fix TIOCSSERIAL permission check +Git-commit: dc8c8437658667be9b11ec25c4b5482ed2becdaa +Patch-mainline: v5.13-rc1 +References: git-fixes + +Changing the port close delay or type are privileged operations so make +sure to return -EPERM if a regular user tries to change them. + +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210407102334.32361-12-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/moxa.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/tty/moxa.c b/drivers/tty/moxa.c +index 5b7bc7af8b1e..63e440d900ff 100644 +--- a/drivers/tty/moxa.c ++++ b/drivers/tty/moxa.c +@@ -2048,6 +2048,7 @@ static int moxa_set_serial_info(struct tty_struct *tty, + struct serial_struct *ss) + { + struct moxa_port *info = tty->driver_data; ++ unsigned int close_delay; + + if (tty->index == MAX_PORTS) + return -EINVAL; +@@ -2059,19 +2060,24 @@ static int moxa_set_serial_info(struct tty_struct *tty, + ss->baud_base != 921600) + return -EPERM; + ++ close_delay = msecs_to_jiffies(ss->close_delay * 10); ++ + mutex_lock(&info->port.mutex); + if (!capable(CAP_SYS_ADMIN)) { +- if (((ss->flags & ~ASYNC_USR_MASK) != ++ if (close_delay != info->port.close_delay || ++ ss->type != info->type || ++ ((ss->flags & ~ASYNC_USR_MASK) != + (info->port.flags & ~ASYNC_USR_MASK))) { + mutex_unlock(&info->port.mutex); + return -EPERM; + } +- } +- info->port.close_delay = msecs_to_jiffies(ss->close_delay * 10); ++ } else { ++ info->port.close_delay = close_delay; + +- MoxaSetFifo(info, ss->type == PORT_16550A); ++ MoxaSetFifo(info, ss->type == PORT_16550A); + +- info->type = ss->type; ++ info->type = ss->type; ++ } + mutex_unlock(&info->port.mutex); + return 0; + } +-- +2.26.2 + diff --git a/patches.suse/usb-dwc2-Fix-gadget-DMA-unmap-direction.patch b/patches.suse/usb-dwc2-Fix-gadget-DMA-unmap-direction.patch new file mode 100644 index 0000000..a393fcd --- /dev/null +++ b/patches.suse/usb-dwc2-Fix-gadget-DMA-unmap-direction.patch @@ -0,0 +1,75 @@ +From 75a41ce46bae6cbe7d3bb2584eb844291d642874 Mon Sep 17 00:00:00 2001 +From: Phil Elwell +Date: Thu, 6 May 2021 12:22:00 +0100 +Subject: [PATCH] usb: dwc2: Fix gadget DMA unmap direction +Git-commit: 75a41ce46bae6cbe7d3bb2584eb844291d642874 +Patch-mainline: v5.13-rc2 +References: git-fixes + +The dwc2 gadget support maps and unmaps DMA buffers as necessary. When +mapping and unmapping it uses the direction of the endpoint to select +the direction of the DMA transfer, but this fails for Control OUT +transfers because the unmap occurs after the endpoint direction has +been reversed for the status phase. + +A possible solution would be to unmap the buffer before the direction +is changed, but a safer, less invasive fix is to remember the buffer +direction independently of the endpoint direction. + +Fixes: fe0b94abcdf6 ("usb: dwc2: gadget: manage ep0 state in software") +Acked-by: Minas Harutyunyan +Cc: stable +Signed-off-by: Phil Elwell +Link: https://lore.kernel.org/r/20210506112200.2893922-1-phil@raspberrypi.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/dwc2/core.h | 2 ++ + drivers/usb/dwc2/gadget.c | 3 ++- + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h +index da5ac4a4595b..ab6b815e0089 100644 +--- a/drivers/usb/dwc2/core.h ++++ b/drivers/usb/dwc2/core.h +@@ -113,6 +113,7 @@ struct dwc2_hsotg_req; + * @debugfs: File entry for debugfs file for this endpoint. + * @dir_in: Set to true if this endpoint is of the IN direction, which + * means that it is sending data to the Host. ++ * @map_dir: Set to the value of dir_in when the DMA buffer is mapped. + * @index: The index for the endpoint registers. + * @mc: Multi Count - number of transactions per microframe + * @interval: Interval for periodic endpoints, in frames or microframes. +@@ -162,6 +163,7 @@ struct dwc2_hsotg_ep { + unsigned short fifo_index; + + unsigned char dir_in; ++ unsigned char map_dir; + unsigned char index; + unsigned char mc; + u16 interval; +diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c +index e6bb1bdb2760..184964174dc0 100644 +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -422,7 +422,7 @@ static void dwc2_hsotg_unmap_dma(struct dwc2_hsotg *hsotg, + { + struct usb_request *req = &hs_req->req; + +- usb_gadget_unmap_request(&hsotg->gadget, req, hs_ep->dir_in); ++ usb_gadget_unmap_request(&hsotg->gadget, req, hs_ep->map_dir); + } + + /* +@@ -1242,6 +1242,7 @@ static int dwc2_hsotg_map_dma(struct dwc2_hsotg *hsotg, + { + int ret; + ++ hs_ep->map_dir = hs_ep->dir_in; + ret = usb_gadget_map_request(&hsotg->gadget, req, hs_ep->dir_in); + if (ret) + goto dma_error; +-- +2.26.2 + diff --git a/patches.suse/usb-dwc3-gadget-Return-success-always-for-kick-trans.patch b/patches.suse/usb-dwc3-gadget-Return-success-always-for-kick-trans.patch new file mode 100644 index 0000000..b041169 --- /dev/null +++ b/patches.suse/usb-dwc3-gadget-Return-success-always-for-kick-trans.patch @@ -0,0 +1,44 @@ +From 18ffa988dbae69cc6e9949cddd9606f6fe533894 Mon Sep 17 00:00:00 2001 +From: Wesley Cheng +Date: Fri, 7 May 2021 10:55:19 -0700 +Subject: [PATCH] usb: dwc3: gadget: Return success always for kick transfer in ep queue +Git-commit: 18ffa988dbae69cc6e9949cddd9606f6fe533894 +Patch-mainline: v5.13-rc2 +References: git-fixes + +If an error is received when issuing a start or update transfer +command, the error handler will stop all active requests (including +the current USB request), and call dwc3_gadget_giveback() to notify +function drivers of the requests which have been stopped. Avoid +returning an error for kick transfer during EP queue, to remove +duplicate cleanup operations on the request being queued. + +Fixes: 8d99087c2db8 ("usb: dwc3: gadget: Properly handle failed kick_transfer") +Cc: stable@vger.kernel.org +Signed-off-by: Wesley Cheng +Link: https://lore.kernel.org/r/1620410119-24971-1-git-send-email-wcheng@codeaurora.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/dwc3/gadget.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index dd1342403bb2..49ca5da5e279 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1684,7 +1684,9 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req) + } + } + +- return __dwc3_gadget_kick_transfer(dep); ++ __dwc3_gadget_kick_transfer(dep); ++ ++ return 0; + } + + static int dwc3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request, +-- +2.26.2 + diff --git a/patches.suse/usb-dwc3-pci-Enable-usb2-gadget-lpm-disable-for-Inte.patch b/patches.suse/usb-dwc3-pci-Enable-usb2-gadget-lpm-disable-for-Inte.patch new file mode 100644 index 0000000..8e2b77e --- /dev/null +++ b/patches.suse/usb-dwc3-pci-Enable-usb2-gadget-lpm-disable-for-Inte.patch @@ -0,0 +1,33 @@ +From 04357fafea9c7ed34525eb9680c760245c3bb958 Mon Sep 17 00:00:00 2001 +From: Ferry Toth +Date: Sun, 25 Apr 2021 17:09:47 +0200 +Subject: [PATCH] usb: dwc3: pci: Enable usb2-gadget-lpm-disable for Intel Merrifield +Git-commit: 04357fafea9c7ed34525eb9680c760245c3bb958 +Patch-mainline: v5.13-rc2 +References: git-fixes + +On Intel Merrifield LPM is causing host to reset port after a timeout. +By disabling LPM entirely this is prevented. + +Fixes: 066c09593454 ("usb: dwc3: pci: Enable extcon driver for Intel Merrifield") +Reviewed-by: Andy Shevchenko +Signed-off-by: Ferry Toth +Cc: stable +Link: https://lore.kernel.org/r/20210425150947.5862-1-ftoth@exalondelft.nl +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/dwc3/dwc3-pci.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -137,6 +137,7 @@ static const struct property_entry dwc3_ + PROPERTY_ENTRY_BOOL("snps,disable_scramble_quirk"), + PROPERTY_ENTRY_BOOL("snps,dis_u3_susphy_quirk"), + PROPERTY_ENTRY_BOOL("snps,dis_u2_susphy_quirk"), ++ PROPERTY_ENTRY_BOOL("snps,usb2-gadget-lpm-disable"), + PROPERTY_ENTRY_BOOL("linux,sysdev_is_parent"), + {} + }; diff --git a/patches.suse/usb-fotg210-hcd-Fix-an-error-message.patch b/patches.suse/usb-fotg210-hcd-Fix-an-error-message.patch new file mode 100644 index 0000000..398f121 --- /dev/null +++ b/patches.suse/usb-fotg210-hcd-Fix-an-error-message.patch @@ -0,0 +1,53 @@ +From a60a34366e0d09ca002c966dd7c43a68c28b1f82 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Thu, 6 May 2021 22:39:10 +0200 +Subject: [PATCH] usb: fotg210-hcd: Fix an error message +Git-commit: a60a34366e0d09ca002c966dd7c43a68c28b1f82 +Patch-mainline: v5.13-rc2 +References: git-fixes + +'retval' is known to be -ENODEV here. +This is a hard-coded default error code which is not useful in the error +message. Moreover, another error message is printed at the end of the +error handling path. The corresponding error code (-ENOMEM) is more +informative. + +So remove simplify the first error message. + +While at it, also remove the useless initialization of 'retval'. + +Fixes: 7d50195f6c50 ("usb: host: Faraday fotg210-hcd driver") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/94531bcff98e46d4f9c20183a90b7f47f699126c.1620333419.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/host/fotg210-hcd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c +index 6cac642520fc..9c2eda0918e1 100644 +--- a/drivers/usb/host/fotg210-hcd.c ++++ b/drivers/usb/host/fotg210-hcd.c +@@ -5568,7 +5568,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev) + struct usb_hcd *hcd; + struct resource *res; + int irq; +- int retval = -ENODEV; ++ int retval; + struct fotg210_hcd *fotg210; + + if (usb_disabled()) +@@ -5588,7 +5588,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev) + hcd = usb_create_hcd(&fotg210_fotg210_hc_driver, dev, + dev_name(dev)); + if (!hcd) { +- dev_err(dev, "failed to create hcd with err %d\n", retval); ++ dev_err(dev, "failed to create hcd\n"); + retval = -ENOMEM; + goto fail_create_hcd; + } +-- +2.26.2 + diff --git a/patches.suse/vrf-fix-a-comment-about-loopback-device.patch b/patches.suse/vrf-fix-a-comment-about-loopback-device.patch new file mode 100644 index 0000000..8895194 --- /dev/null +++ b/patches.suse/vrf-fix-a-comment-about-loopback-device.patch @@ -0,0 +1,44 @@ +From: Nicolas Dichtel +Date: Wed, 14 Apr 2021 12:03:25 +0200 +Subject: vrf: fix a comment about loopback device +Patch-mainline: v5.12-rc8 +Git-commit: 2e1534f395e73152e2051332034bff61a56a8368 +References: git-fixes + +This is a leftover of the below commit. + +Fixes: 4f04256c983a ("net: vrf: Drop local rtable and rt6_info") +Signed-off-by: Nicolas Dichtel +Acked-by: David Ahern +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/vrf.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +--- a/drivers/net/vrf.c ++++ b/drivers/net/vrf.c +@@ -194,9 +194,8 @@ static netdev_tx_t vrf_process_v6_outbou + + skb_dst_drop(skb); + +- /* if dst.dev is loopback or the VRF device again this is locally +- * originated traffic destined to a local address. Short circuit +- * to Rx path ++ /* if dst.dev is the VRF device again this is locally originated traffic ++ * destined to a local address. Short circuit to Rx path. + */ + if (dst->dev == dev) + return vrf_local_xmit(skb, dev, dst); +@@ -270,9 +269,8 @@ static netdev_tx_t vrf_process_v4_outbou + + skb_dst_drop(skb); + +- /* if dst.dev is loopback or the VRF device again this is locally +- * originated traffic destined to a local address. Short circuit +- * to Rx path ++ /* if dst.dev is the VRF device again this is locally originated traffic ++ * destined to a local address. Short circuit to Rx path. + */ + if (rt->dst.dev == vrf_dev) + return vrf_local_xmit(skb, vrf_dev, &rt->dst); diff --git a/patches.suse/workqueue-Minor-follow-ups-to-the-rescuer-destructio.patch b/patches.suse/workqueue-Minor-follow-ups-to-the-rescuer-destructio.patch new file mode 100644 index 0000000..1120336 --- /dev/null +++ b/patches.suse/workqueue-Minor-follow-ups-to-the-rescuer-destructio.patch @@ -0,0 +1,47 @@ +From 30ae2fc0a75eb5f1a38bbee7355d8e3bc823a6e1 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Fri, 20 Sep 2019 14:09:14 -0700 +Subject: [PATCH] workqueue: Minor follow-ups to the rescuer destruction change +Git-commit: 30ae2fc0a75eb5f1a38bbee7355d8e3bc823a6e1 +Patch-mainline: v5.5-rc1 +References: bsc#1185911 + +* Now that wq->rescuer may be cleared while rescuer is still there, + switch show_pwq() debug printout to test worker->rescue_wq to + identify rescuers intead of testing wq->rescuer. + +* Update comment on ->rescuer locking. + +Signed-off-by: Tejun Heo +Suggested-by: Lai Jiangshan +Acked-by: Petr Mladek + +--- + kernel/workqueue.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 3f067f1d72e3..7f7aa45dac37 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -248,7 +248,7 @@ struct workqueue_struct { + struct list_head flusher_overflow; /* WQ: flush overflow list */ + + struct list_head maydays; /* MD: pwqs requesting rescue */ +- struct worker *rescuer; /* I: rescue worker */ ++ struct worker *rescuer; /* MD: rescue worker */ + + int nr_drainers; /* WQ: drain in progress */ + int saved_max_active; /* WQ: saved pwq max_active */ +@@ -4672,7 +4672,7 @@ static void show_pwq(struct pool_workqueue *pwq) + + pr_cont("%s %d%s:%ps", comma ? "," : "", + task_pid_nr(worker->task), +- worker == pwq->wq->rescuer ? "(RESCUER)" : "", ++ worker->rescue_wq ? "(RESCUER)" : "", + worker->current_func); + list_for_each_entry(work, &worker->scheduled, entry) + pr_cont_work(false, work); +-- +2.26.2 + diff --git a/patches.suse/workqueue-more-destroy_workqueue-fixes.patch b/patches.suse/workqueue-more-destroy_workqueue-fixes.patch index 2da36d9..88f7d51 100644 --- a/patches.suse/workqueue-more-destroy_workqueue-fixes.patch +++ b/patches.suse/workqueue-more-destroy_workqueue-fixes.patch @@ -1,9 +1,10 @@ +From c29eb85386880750130a01aabf288408a6614d65 Mon Sep 17 00:00:00 2001 From: Tejun Heo Date: Mon, 23 Sep 2019 11:08:58 -0700 -Subject: workqueue: more destroy_workqueue() fixes -Patch-mainline: v5.5-rc1 +Subject: [PATCH] workqueue: more destroy_workqueue() fixes Git-commit: c29eb85386880750130a01aabf288408a6614d65 -References: bsc#1162702 +Patch-mainline: v5.5-rc1 +References: bsc#1185911 destroy_workqueue() warnings still, at a lower frequency, trigger spuriously. The problem seems to be in-flight operations which @@ -16,14 +17,17 @@ haven't reached put_pwq() yet. Signed-off-by: Tejun Heo Cc: "Williams, Gerald S" -Acked-by: Daniel Wagner +Acked-by: Petr Mladek + --- - kernel/workqueue.c | 45 +++++++++++++++++++++++++++++++-------------- + kernel/workqueue.c | 45 +++++++++++++++++++++++++++++++-------------- 1 file changed, 31 insertions(+), 14 deletions(-) +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 7f7aa45dac37..4a3c30177b94 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c -@@ -355,6 +355,7 @@ EXPORT_SYMBOL_GPL(system_freezable_power +@@ -355,6 +355,7 @@ EXPORT_SYMBOL_GPL(system_freezable_power_efficient_wq); static int worker_thread(void *__worker); static void workqueue_sysfs_unregister(struct workqueue_struct *wq); @@ -31,7 +35,7 @@ Acked-by: Daniel Wagner #define CREATE_TRACE_POINTS #include -@@ -4305,6 +4306,22 @@ struct workqueue_struct *alloc_workqueue +@@ -4314,6 +4315,22 @@ struct workqueue_struct *alloc_workqueue(const char *fmt, } EXPORT_SYMBOL_GPL(alloc_workqueue); @@ -54,7 +58,7 @@ Acked-by: Daniel Wagner /** * destroy_workqueue - safely terminate a workqueue * @wq: target workqueue -@@ -4339,28 +4356,28 @@ void destroy_workqueue(struct workqueue_ +@@ -4348,28 +4365,28 @@ void destroy_workqueue(struct workqueue_struct *wq) kfree(rescuer); } @@ -97,3 +101,6 @@ Acked-by: Daniel Wagner /* * wq list is used to freeze wq, remove from list after +-- +2.26.2 + diff --git a/patches.suse/xhci-Do-not-use-GFP_KERNEL-in-potentially-atomic-con.patch b/patches.suse/xhci-Do-not-use-GFP_KERNEL-in-potentially-atomic-con.patch new file mode 100644 index 0000000..ac686e9 --- /dev/null +++ b/patches.suse/xhci-Do-not-use-GFP_KERNEL-in-potentially-atomic-con.patch @@ -0,0 +1,64 @@ +From dda32c00c9a0fa103b5d54ef72c477b7aa993679 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Wed, 12 May 2021 11:08:14 +0300 +Subject: [PATCH] xhci: Do not use GFP_KERNEL in (potentially) atomic context +Git-commit: dda32c00c9a0fa103b5d54ef72c477b7aa993679 +Patch-mainline: v5.13-rc2 +References: git-fixes + +'xhci_urb_enqueue()' is passed a 'mem_flags' argument, because "URBs may be +submitted in interrupt context" (see comment related to 'usb_submit_urb()' +in 'drivers/usb/core/urb.c') + +So this flag should be used in all the calling chain. +Up to now, 'xhci_check_maxpacket()' which is only called from +'xhci_urb_enqueue()', uses GFP_KERNEL. + +Be safe and pass the mem_flags to this function as well. + +Fixes: ddba5cd0aeff ("xhci: Use command structures when queuing commands on the command ring") +Cc: +Signed-off-by: Christophe JAILLET +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20210512080816.866037-4-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/host/xhci.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index ca9385d22f68..27283654ca08 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1514,7 +1514,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci, + * we need to issue an evaluate context command and wait on it. + */ + static int xhci_check_maxpacket(struct xhci_hcd *xhci, unsigned int slot_id, +- unsigned int ep_index, struct urb *urb) ++ unsigned int ep_index, struct urb *urb, gfp_t mem_flags) + { + struct xhci_container_ctx *out_ctx; + struct xhci_input_control_ctx *ctrl_ctx; +@@ -1545,7 +1545,7 @@ static int xhci_check_maxpacket(struct xhci_hcd *xhci, unsigned int slot_id, + * changes max packet sizes. + */ + +- command = xhci_alloc_command(xhci, true, GFP_KERNEL); ++ command = xhci_alloc_command(xhci, true, mem_flags); + if (!command) + return -ENOMEM; + +@@ -1639,7 +1639,7 @@ static int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + */ + if (urb->dev->speed == USB_SPEED_FULL) { + ret = xhci_check_maxpacket(xhci, slot_id, +- ep_index, urb); ++ ep_index, urb, mem_flags); + if (ret < 0) { + xhci_urb_free_priv(urb_priv); + urb->hcpriv = NULL; +-- +2.26.2 + diff --git a/patches.suse/xsk-Respect-device-s-headroom-and-tailroom-on-generi.patch b/patches.suse/xsk-Respect-device-s-headroom-and-tailroom-on-generi.patch new file mode 100644 index 0000000..d3d5866 --- /dev/null +++ b/patches.suse/xsk-Respect-device-s-headroom-and-tailroom-on-generi.patch @@ -0,0 +1,78 @@ +From: Alexander Lobakin +Date: Thu, 18 Feb 2021 20:50:31 +0000 +Subject: xsk: Respect device's headroom and tailroom on generic xmit path +Patch-mainline: v5.13-rc1 +Git-commit: 3914d88f7608e6c2e80e344474fa289370c32451 +References: git-fixes + +xsk_generic_xmit() allocates a new skb and then queues it for +xmitting. The size of new skb's headroom is desc->len, so it comes +to the driver/device with no reserved headroom and/or tailroom. +Lots of drivers need some headroom (and sometimes tailroom) to +prepend (and/or append) some headers or data, e.g. CPU tags, +device-specific headers/descriptors (LSO, TLS etc.), and if case +of no available space skb_cow_head() will reallocate the skb. +Reallocations are unwanted on fast-path, especially when it comes +to XDP, so generic XSK xmit should reserve the spaces declared in +dev->needed_headroom and dev->needed tailroom to avoid them. + +Note on max(NET_SKB_PAD, L1_CACHE_ALIGN(dev->needed_headroom)): + +Usually, output functions reserve LL_RESERVED_SPACE(dev), which +consists of dev->hard_header_len + dev->needed_headroom, aligned +by 16. + +However, on XSK xmit hard header is already here in the chunk, so +hard_header_len is not needed. But it'd still be better to align +data up to cacheline, while reserving no less than driver requests +for headroom. NET_SKB_PAD here is to double-insure there will be +no reallocations even when the driver advertises no needed_headroom, +but in fact need it (not so rare case). + +Fixes: 35fcde7f8deb ("xsk: support for Tx") +Signed-off-by: Alexander Lobakin +Signed-off-by: Daniel Borkmann +Acked-by: Magnus Karlsson +Acked-by: John Fastabend +Link: https://lore.kernel.org/bpf/20210218204908.5455-5-alobakin@pm.me +Acked-by: Thomas Bogendoerfer +--- + net/xdp/xsk.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/net/xdp/xsk.c ++++ b/net/xdp/xsk.c +@@ -373,12 +373,16 @@ static int xsk_generic_xmit(struct sock + struct xdp_desc desc; + struct sk_buff *skb; + int err = 0; ++ u32 hr, tr; + + mutex_lock(&xs->mutex); + + if (xs->queue_id >= xs->dev->real_num_tx_queues) + goto out; + ++ hr = max(NET_SKB_PAD, L1_CACHE_ALIGN(xs->dev->needed_headroom)); ++ tr = xs->dev->needed_tailroom; ++ + while (xskq_peek_desc(xs->tx, &desc, xs->umem)) { + char *buffer; + u64 addr; +@@ -390,13 +394,15 @@ static int xsk_generic_xmit(struct sock + } + + len = desc.len; +- skb = sock_alloc_send_skb(sk, len, 1, &err); ++ skb = sock_alloc_send_skb(sk, hr + len + tr, 1, &err); + if (unlikely(!skb)) { + err = -EAGAIN; + goto out; + } + ++ skb_reserve(skb, hr); + skb_put(skb, len); ++ + addr = desc.addr; + buffer = xdp_umem_get_data(xs->umem, addr); + err = skb_store_bits(skb, 0, buffer, len); diff --git a/scripts/lib/SUSE/MyBS.pm b/scripts/lib/SUSE/MyBS.pm index dd53462..afb9840 100644 --- a/scripts/lib/SUSE/MyBS.pm +++ b/scripts/lib/SUSE/MyBS.pm @@ -566,6 +566,10 @@ sub upload_package { $self->delete("/source/$project/$link"); &$progresscb('DELETE', "$project/$link"); } + # delete stale kernel-obs-build + my $kob = "kernel-obs-build"; + $self->post("/build/$project?cmd=wipe&package=$kob"); + &$progresscb('WIPE', "$project $kob"); return $revision; } diff --git a/series.conf b/series.conf index 51856b3..4c04f28 100644 --- a/series.conf +++ b/series.conf @@ -5616,6 +5616,7 @@ patches.suse/fork-extend-clone3-to-support-setting-a-PID.patch patches.suse/workqueue-Fix-spurious-sanity-check-failures-in-dest.patch patches.suse/workqueue-Fix-missing-kfree-rescuer-in-destroy_workq.patch + patches.suse/workqueue-Minor-follow-ups-to-the-rescuer-destructio.patch patches.suse/workqueue-more-destroy_workqueue-fixes.patch patches.suse/workqueue-Fix-pwq-ref-leak-in-rescuer_thread.patch patches.suse/0001-cgroup-Optimize-single-thread-migration.patch @@ -12947,6 +12948,7 @@ patches.suse/cifs-do-not-share-tcons-with-DFS.patch patches.suse/cifs-ensure-correct-super-block-for-DFS-reconnect.patch patches.suse/cifs-fix-uninitialised-lease_key-in-open_shroot-.patch + patches.suse/msft-hv-2051-Drivers-hv-vmbus-Fix-Suspend-to-Idle-for-Generation-.patch patches.suse/btrfs-drop-logs-when-we-ve-aborted-a-transaction.patch patches.suse/btrfs-fix-block-group-leak-when-removing-fails.patch patches.suse/s390-mm-fix-page-table-upgrade-vs-2ndary-address-mode @@ -13566,6 +13568,7 @@ patches.suse/nvme-tcp-use-bh_lock-in-data_ready.patch patches.suse/nvme-tcp-avoid-scheduling-io_work-if-we-are-already-.patch patches.suse/nvme-tcp-try-to-send-request-in-queue_rq-context.patch + patches.suse/nvme-define-constants-for-identification-values.patch patches.suse/0001-md-don-t-flush-workqueue-unconditionally-in-md_open.patch patches.suse/0007-raid5-remove-gfp-flags-from-scribble_alloc.patch patches.suse/nvme-tcp-set-MSG_SENDPAGE_NOTLAST-with-MSG_MORE-when.patch @@ -14460,6 +14463,7 @@ patches.suse/0003-dm-writecache-correct-uncommitted_block-when-discard.patch patches.suse/0004-dm-writecache-add-cond_resched-to-loop-in-persistent.patch patches.suse/0001-nvme-pci-override-the-value-of-the-controller-s-numa.patch + patches.suse/nvme-fix-possible-deadlock-when-I-O-is-blocked.patch patches.suse/nvme-multipath-fix-deadlock-between-ana_work-and-sca.patch patches.suse/nvme-don-t-protect-ns-mutation-with-ns-head-lock.patch patches.suse/nvme-multipath-fix-deadlock-due-to-head-lock.patch @@ -14744,6 +14748,7 @@ patches.suse/ovl-fix-unneeded-call-to-ovl_change_flags.patch patches.suse/fuse-don-t-ignore-errors-from-fuse_writepages_fill.patch patches.suse/fuse-fix-parameter-for-fs_ioc_-get-set-flags.patch + patches.suse/nvme-explicitly-update-mpath-disk-capacity-on-revali.patch patches.suse/drivers-perf-Fix-kernel-panic-when-rmmod-PMU-modules.patch patches.suse/bus-ti-sysc-Do-not-disable-on-suspend-for-no-idle.patch patches.suse/NFS-Fix-interrupted-slots-by-sending-a-solo-SEQUENCE.patch @@ -14899,6 +14904,7 @@ patches.suse/9p-trans_fd-Fix-concurrency-del-of-req_list-in-p9_fd.patch patches.suse/random32-remove-net_rand_state-from-the-latent-entro.patch patches.suse/random-fix-circular-include-dependency-on-arm64-afte.patch + patches.suse/nvme-tcp-fix-possible-hang-waiting-for-icresp-respon.patch patches.suse/nvme-add-a-Identify-Namespace-Identification-Descrip.patch patches.suse/PCI-ASPM-Disable-ASPM-on-ASMedia-ASM1083-1085-PCIe-t.patch patches.suse/ARM-percpu.h-fix-build-error.patch @@ -15810,7 +15816,9 @@ patches.suse/block-Fix-page_is_mergeable-for-compound-pages.patch patches.suse/bfq-fix-blkio-cgroup-leakage-v4.patch patches.suse/blk-mq-insert-request-not-through-queue_rq-into-sw-s.patch + patches.suse/block-fix-get_max_io_size.patch patches.suse/0001-blkcg-fix-memleak-for-iolatency.patch + patches.suse/nvmet-fix-a-memory-leak.patch patches.suse/nvme-multipath-round-robin-fix-single-non-optimized-path-case.patch patches.suse/nvme-multipath-round-robin-eliminate-fallback-variable.patch patches.suse/0002-null_blk-fix-passing-of-REQ_FUA-flag-in-null_handle_.patch @@ -15926,6 +15934,7 @@ patches.suse/bnxt_en-Fix-PCI-AER-error-recovery-flow.patch patches.suse/bnxt_en-Fix-possible-crash-in-bnxt_fw_reset_task.patch patches.suse/bnxt_en-fix-HWRM-error-when-querying-VF-temperature.patch + patches.suse/net-hns3-Fix-for-geneve-tx-checksum-bug.patch patches.suse/taprio-Fix-using-wrong-queues-in-gate-mask.patch patches.suse/net-disable-netpoll-on-fresh-napis.patch patches.suse/bnxt-don-t-enable-NAPI-until-rings-are-ready.patch @@ -15980,7 +15989,9 @@ patches.suse/nvme-rdma-fix-timeout-handler.patch patches.suse/nvme-rdma-fix-reset-hang-if-controller-died-in-the-m.patch patches.suse/nvme-Fix-NULL-dereference-for-pci-nvme-controllers.patch + patches.suse/nvme-fix-controller-instance-leak.patch patches.suse/block-ensure-bdi-io_pages-is-always-initialized.patch + patches.suse/blk-iocost-ioc_pd_free-shouldn-t-assume-irq-disabled.patch patches.suse/block-allow-for_each_bvec-to-support-zero-len-bvec.patch patches.suse/ata-ahci-use-ata_link_info-instead-of-ata_link_print.patch patches.suse/libata-implement-ATA_HORKAGE_MAX_TRIM_128M-and-apply.patch @@ -16133,6 +16144,7 @@ patches.suse/tracing-fix-double-free.patch patches.suse/kprobes-tracing-kprobes-Fix-to-kill-kprobes-on-initmem-after-boot.patch patches.suse/s390-dasd-fix-zero-write-for-fba-devices + patches.suse/nvme-tcp-fix-kconfig-dependency-warning-when-CRYPTO.patch patches.suse/act_ife-load-meta-modules-before-tcf_idr_check_alloc.patch patches.suse/cxgb4-Fix-offset-when-clearing-filter-byte-counters.patch patches.suse/net-dsa-rtl8366-Properly-clear-member-config.patch @@ -17673,6 +17685,7 @@ patches.suse/iio-adc-rockchip_saradc-fix-missing-clk_disable_unpr.patch patches.suse/staging-comedi-mf6x4-Fix-AI-end-of-conversion-detect.patch patches.suse/staging-olpc_dcon-Do-not-call-platform_device_unregi.patch + patches.suse/genirq-irqdomain-Don-t-try-to-free-an-interrupt-that.patch patches.suse/irqchip-ls-extirq-Add-LS1043A-LS1088A-external-inter.patch patches.suse/regmap-Remove-duplicate-type-field-from-regmap-regca.patch patches.suse/regulator-axp20x-Fix-DLDO2-voltage-control-register-.patch @@ -18135,6 +18148,7 @@ patches.suse/usb-typec-Fix-copy-paste-error-for-NVIDIA-alt-mode-d.patch patches.suse/0014-block-rsxx-select-CONFIG_CRC32.patch patches.suse/nvme-fc-avoid-calling-_nvme_fc_abort_outstanding_ios-from-interrupt-context.patch + patches.suse/nvme-tcp-Fix-possible-race-of-io_work-and-direct-sen.patch patches.suse/nvmet-rdma-Fix-list_del-corruption-on-queue-establis.patch patches.suse/msft-hv-2201-x86-hyperv-Fix-kexec-panic-hang-issues.patch patches.suse/tracing-kprobes-do-the-notrace-functions-check-without-kprobes-on-ftrace.patch @@ -18186,6 +18200,8 @@ patches.suse/0015-dm-raid-fix-discard-limits-for-raid1.patch patches.suse/0016-dm-zoned-select-CONFIG_CRC32.patch patches.suse/0017-dm-eliminate-potential-source-of-excessive-kernel-lo.patch + patches.suse/nvme-tcp-Fix-warning-with-CONFIG_DEBUG_PREEMPT.patch + patches.suse/nvme-don-t-intialize-hwmon-for-discovery-controllers.patch patches.suse/powerpc-Fix-alignment-bug-within-the-init-sections.patch patches.suse/spi-cadence-cache-reference-clock-rate-during-probe.patch patches.suse/nfsd4-readdirplus-shouldn-t-return-parent-of-export.patch @@ -18222,6 +18238,7 @@ patches.suse/mmc-sdhci-of-dwcmshc-fix-rpmb-access.patch patches.suse/mmc-sdhci-xenon-fix-1.8v-regulator-stabilization.patch patches.suse/mmc-core-don-t-initialize-block-size-from-ext_csd-if.patch + patches.suse/dm-avoid-filesystem-lookup-in-dm_get_dev_t.patch patches.suse/scsi-scsi_transport_srp-Don-t-block-target-in-failfa.patch patches.suse/scsi-ibmvfc-Set-default-timeout-to-avoid-crash-durin.patch patches.suse/i2c-bpmp-tegra-Ignore-unknown-I2C_M-flags.patch @@ -18478,6 +18495,8 @@ patches.suse/nvme-hwmon-rework-to-avoid-devm-allocation.patch patches.suse/irqchip-ls-extirq-add-IRQCHIP_SKIP_SET_WAKE-to-the-i.patch patches.suse/mm-proc-Invalidate-TLB-after-clearing-soft-dirty-pag.patch + patches.suse/sched-fair-Avoid-stale-CPU-util_est-value-for-schedu.patch + patches.suse/sched-eas-Don-t-update-misfit-status-if-the-task-is-.patch patches.suse/rcu-Pull-deferred-rcuog-wake-up-to-rcu_eqs_enter-cal.patch patches.suse/rcu-nocb-Perform-deferred-wake-up-before-last-idle-s.patch patches.suse/rcu-nocb-Trigger-self-IPI-on-late-deferred-wake-up-b.patch @@ -18886,6 +18905,7 @@ patches.suse/kvm-kvmclock-fix-vcpus-64-can-t-be-online-hotpluged.patch patches.suse/powerpc-64s-Fix-instruction-encoding-for-lis-in-ppc_.patch patches.suse/seqlock-lockdep-Fix-seqcount_latch_init.patch + patches.suse/hrtimer-Update-softirq_expires_next-correctly-after-.patch patches.suse/fuse-fix-live-lock-in-fuse_iget.patch patches.suse/thermal-core-Add-NULL-pointer-check-before-using-coo.patch patches.suse/0001-btrfs-track-qgroup-released-data-in-own-variable-in-.patch @@ -18919,6 +18939,7 @@ patches.suse/nvme-fabrics-only-reserve-a-single-tag.patch patches.suse/nvme-merge-nvme_keep_alive-into-nvme_keep_alive_work.patch patches.suse/nvme-allocate-the-keep-alive-request-using-BLK_MQ_RE.patch + patches.suse/nvme-tcp-fix-misuse-of-__smp_processor_id-with-preem.patch patches.suse/0001-nvme-tcp-fix-possible-hang-when-failing-to-set-io-qu.patch patches.suse/scsi-qla2xxx-Fix-broken-endif-placement.patch patches.suse/scsi-lpfc-Fix-some-error-codes-in-debugfs.patch @@ -18928,6 +18949,7 @@ patches.suse/firmware-efi-Fix-a-use-after-bug-in-efi_mem_reserve_.patch patches.suse/efi-use-32-bit-alignment-for-efi_guid_t-literals.patch patches.suse/perf-x86-intel-fix-a-crash-caused-by-zero-pebs-status.patch + patches.suse/genirq-Disable-interrupts-for-force-threaded-handler.patch patches.suse/usbip-Fix-incorrect-double-assignment-to-udc-ud.tcp_.patch patches.suse/usb-gadget-configfs-Fix-KASAN-use-after-free.patch patches.suse/usb-storage-Add-quirk-to-defeat-Kindle-s-automatic-u.patch @@ -19114,6 +19136,7 @@ patches.suse/ibmvnic-avoid-calling-napi_disable-twice.patch patches.suse/ibmvnic-remove-duplicate-napi_schedule-call-in-do_re.patch patches.suse/ibmvnic-remove-duplicate-napi_schedule-call-in-open-.patch + patches.suse/vrf-fix-a-comment-about-loopback-device.patch patches.suse/i40e-fix-the-panic-when-running-bpf-in-xdpdrv-mode.patch patches.suse/net-mlx5e-fix-ingress_ifindex-check-in-mlx5e_flower_.patch patches.suse/bpf-Move-off_reg-into-sanitize_ptr_alu.patch @@ -19140,6 +19163,12 @@ patches.suse/x86-microcode-check-for-offline-cpus-before-requesting-new-microcode.patch patches.suse/x86-platform-uv-set-section-block-size-for-hubless-architectures.patch patches.suse/genirq-Reduce-irqdebug-cacheline-bouncing.patch + patches.suse/posix-timers-Preserve-return-value-in-clock_adjtime3.patch + patches.suse/msft-hv-2269-drivers-hv-Fix-whitespace-errors.patch + patches.suse/msft-hv-2305-Drivers-hv-vmbus-Use-after-free-in-__vmbus_open.patch + patches.suse/msft-hv-2310-Drivers-hv-vmbus-Initialize-unload_event-statically.patch + patches.suse/msft-hv-2311-Drivers-hv-vmbus-Increase-wait-time-for-VMbus-unload.patch + patches.suse/msft-hv-2312-video-hyperv_fb-Add-ratelimit-on-error-message.patch patches.suse/platform-x86-thinkpad_acpi-Correct-thermal-sensor-al.patch patches.suse/platform-x86-pmc_atom-Match-all-Beckhoff-Automation-.patch patches.suse/platform-x86-intel_pmc_core-Don-t-use-global-pmcdev-.patch @@ -19157,11 +19186,17 @@ patches.suse/node-fix-device-cleanups-in-error-handling-code.patch patches.suse/iio-accel-adis16201-Fix-wrong-axis-assignment-that-p.patch patches.suse/staging-rtl8192u-Fix-potential-infinite-loop.patch + patches.suse/serial-stm32-fix-incorrect-characters-on-console.patch + patches.suse/serial-stm32-fix-tx_empty-condition.patch patches.suse/tty-fix-memory-leak-in-vc_deallocate.patch patches.suse/staging-fwserial-fix-TIOCSSERIAL-jiffies-conversions.patch patches.suse/staging-fwserial-fix-TIOCSSERIAL-permission-check.patch patches.suse/staging-fwserial-fix-TIOCSSERIAL-implementation.patch patches.suse/staging-fwserial-fix-TIOCGSERIAL-implementation.patch + patches.suse/tty-amiserial-fix-TIOCSSERIAL-permission-check.patch + patches.suse/tty-moxa-fix-TIOCSSERIAL-jiffies-conversions.patch + patches.suse/tty-moxa-fix-TIOCSSERIAL-permission-check.patch + patches.suse/serial-core-return-early-on-unsupported-ioctls.patch patches.suse/usb-typec-tcpci-Check-ROLE_CONTROL-while-interpretin.patch patches.suse/usb-gadget-uvc-add-bInterval-checking-for-HS-mode.patch patches.suse/usb-webcam-Invalid-size-of-Processing-Unit-Descripto.patch @@ -19206,6 +19241,7 @@ patches.suse/USB-serial-opticon-fix-TIOCGSERIAL-implementation.patch patches.suse/USB-serial-quatech2-fix-TIOCGSERIAL-implementation.patch patches.suse/USB-serial-ssu100-fix-TIOCGSERIAL-implementation.patch + patches.suse/USB-serial-ti_usb_3410_5052-fix-TIOCSSERIAL-permissi.patch patches.suse/USB-serial-usb_wwan-fix-TIOCSSERIAL-jiffies-conversi.patch patches.suse/USB-serial-usb_wwan-fix-unprivileged-TIOCCSERIAL.patch patches.suse/USB-serial-usb_wwan-fix-TIOCGSERIAL-implementation.patch @@ -19287,6 +19323,7 @@ patches.suse/drm-msm-mdp5-Do-not-multiply-vclk-line-count-by-100.patch patches.suse/rsxx-remove-extraneous-const-qualifier.patch patches.suse/nvme-remove-superfluous-else-in-nvme_ctrl_loss_tmo_s.patch + patches.suse/nvme-retrigger-ANA-log-update-if-group-descriptor-is.patch patches.suse/0002-md-md_open-returns-EBUSY-when-entering-racing-area.patch patches.suse/0003-md-factor-out-a-mddev_find_locked-helper-from-mddev_.patch patches.suse/0004-md-split-mddev_find.patch @@ -19399,8 +19436,13 @@ patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.9.patch patches.suse/scsi-lpfc-Copyright-updates-for-12.8.0.9-patches.patch patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch + patches.suse/netdevice-Add-missing-IFF_PHONY_HEADROOM-self-defini.patch + patches.suse/xsk-Respect-device-s-headroom-and-tailroom-on-generi.patch patches.suse/nfc-pn533-prevent-potential-memory-corruption.patch patches.suse/liquidio-Fix-unintented-sign-extension-of-a-left-shi.patch + patches.suse/Bluetooth-verify-AMP-hci_chan-before-amp_destroy.patch + patches.suse/cxgb4-Fix-unintentional-sign-extension-issues.patch + patches.suse/net-thunderx-Fix-unintentional-sign-extension-issue.patch patches.suse/ibmvnic-clean-up-the-remaining-debugfs-data-structur.patch patches.suse/ibmvnic-print-reset-reason-as-a-string.patch patches.suse/ibmvnic-print-adapter-state-as-a-string.patch @@ -19412,12 +19454,16 @@ patches.suse/rsi-Use-resume_noirq-for-SDIO.patch patches.suse/rtw88-Fix-array-overrun-in-rtw_get_tx_power_params.patch patches.suse/mac80211-bail-out-if-cipher-schemes-are-invalid.patch + patches.suse/cfg80211-scan-drop-entry-from-hidden_list-on-overflo.patch patches.suse/ath9k-Fix-error-check-in-ath9k_hw_read_revisions-for.patch patches.suse/ath10k-Fix-ath10k_wmi_tlv_op_pull_peer_stats_info-un.patch + patches.suse/net-xdp-Update-pkt_type-if-generic-XDP-changes-unica.patch patches.suse/net-phy-intel-xway-enable-integrated-led-functions.patch patches.suse/net-phy-marvell-fix-m88e1011_set_downshift.patch patches.suse/net-phy-marvell-fix-m88e1111_set_downshift.patch + patches.suse/bnxt_en-fix-ternary-sign-extension-bug-in-bnxt_show_.patch patches.suse/net-geneve-modify-IP-header-check-in-geneve6_xmit_sk.patch + patches.suse/bnxt_en-Fix-RX-consumer-index-logic-in-the-error-pat.patch patches.suse/net-nfc-digital-Fix-a-double-free-in-digital_tg_recv.patch patches.suse/selftests-powerpc-Fix-L1D-flushing-tests-for-Power10.patch patches.suse/powerpc-fadump-Mark-fadump_calculate_reserve_size-as.patch @@ -19489,6 +19535,10 @@ patches.suse/watchdog-explicitly-update-timestamp-when-reporting-.patch patches.suse/watchdog-softlockup-report-the-overall-time-of-softl.patch patches.suse/mm-memcontrol-fix-cpuhotplug-statistics-flushing.patch + patches.suse/RDMA-hns-Delete-redundant-condition-judgment-related.patch + patches.suse/RDMA-hns-Delete-redundant-abnormal-interrupt-status.patch + patches.suse/RDMA-qedr-Fix-error-return-code-in-qedr_iw_connect.patch + patches.suse/RDMA-srpt-Fix-error-return-code-in-srpt_cm_req_recv.patch patches.suse/KVM-s390-fix-guarded-storage-control-register-handli.patch patches.suse/tracing-map-all-pids-to-command-lines.patch patches.suse/rtc-ds1307-Fix-wday-settings-for-rx8130.patch @@ -19497,6 +19547,7 @@ patches.suse/thermal-drivers-ti-soc-thermal-bandgap-Remove-unused.patch patches.suse/PCI-Release-OF-node-in-pci_scan_device-s-error-path.patch patches.suse/PCI-RCEC-Fix-RCiEP-device-to-RCEC-association.patch + patches.suse/PCI-Allow-VPD-access-for-QLogic-ISP2722.patch patches.suse/PCI-endpoint-Fix-missing-destroy_workqueue.patch patches.suse/PCI-iproc-Fix-return-value-of-iproc_msi_irq_domain_a.patch patches.suse/ACPI-custom_method-fix-potential-use-after-free-issu.patch @@ -19508,19 +19559,50 @@ patches.suse/ALSA-hda-generic-change-the-DAC-ctl-name-for-LO-SPK-.patch patches.suse/ACPI-GTDT-Don-t-corrupt-interrupt-mappings-on-watchd.patch patches.suse/Revert-i3c-master-fix-missing-destroy_workqueue-on-e.patch + patches.suse/net-hns3-fix-incorrect-configuration-for-igu_egu_hw_.patch + patches.suse/net-hns3-initialize-the-message-content-in-hclge_get.patch + patches.suse/net-hns3-add-check-for-HNS3_NIC_STATE_INITED-in-hns3.patch + patches.suse/net-hns3-fix-for-vxlan-gpe-tx-checksum-bug.patch + patches.suse/net-hns3-use-netif_tx_disable-to-stop-the-transmit-q.patch + patches.suse/net-hns3-clear-unnecessary-reset-request-in-hclge_re.patch + patches.suse/net-hns3-disable-phy-loopback-setting-in-hclge_mac_s.patch + patches.suse/ethernet-enic-Fix-a-use-after-free-bug-in-enic_hard_.patch patches.suse/sctp-delay-auto_asconf-init-until-binding-the-first-.patch patches.suse/bpf-Fix-masking-negation-logic-upon-negative-dst-reg.patch patches.suse/bpf-Fix-leakage-of-uninitialized-bpf-stack-under-spe.patch patches.suse/net-nfc-fix-use-after-free-llcp_sock_bind-connect.patch + patches.suse/smc-disallow-TCP_ULP-in-smc_setsockopt.patch + patches.suse/mlxsw-spectrum_mr-Update-egress-RIF-list-before-rout.patch + patches.suse/i40e-fix-broken-XDP-support.patch + patches.suse/i40e-Fix-use-after-free-in-i40e_client_subtask.patch + patches.suse/i40e-fix-the-restart-auto-negotiation-after-FEC-modi.patch + patches.suse/i40e-Fix-PHY-type-identifiers-for-2.5G-and-5G-adapte.patch patches.suse/scsi-lpfc-Fix-illegal-memory-access-on-Abort-IOCBs.patch patches.suse/scsi-lpfc-Fix-DMA-virtual-address-ptr-assignment-in-.patch patches.suse/scsi-fnic-Kill-exclude_id-argument-to-fnic_cleanup_i.patch patches.suse/scsi-fnic-Use-scsi_host_busy_iter-to-traverse-commands.patch patches.suse/Revert-337f13046ff0-futex-Allow-FUTEX_CLOCK_REALTIME.patch + patches.suse/sched-fair-Fix-unfairness-caused-by-missing-load-dec.patch + patches.suse/drm-amd-display-Reject-non-zero-src_y-and-src_x-for-.patch patches.suse/drm-radeon-Fix-off-by-one-power_state-index-heap-ove.patch patches.suse/drm-radeon-Avoid-power-table-parsing-memory-leaks.patch patches.suse/hwmon-occ-Fix-poll-rate-limiting.patch patches.suse/vgacon-Record-video-mode-changes-with-VT_RESIZEX.patch + patches.suse/nvme-multipath_fix_double_initialization_of_ANA_state.patch + patches.suse/nvmet-use-new-ana_log_size-instead-the-old-one.patch + patches.suse/powerpc-64s-Fix-crashes-when-toggling-stf-barrier.patch + patches.suse/powerpc-64s-Fix-crashes-when-toggling-entry-flush-ba.patch + patches.suse/usb-dwc3-pci-Enable-usb2-gadget-lpm-disable-for-Inte.patch + patches.suse/usb-dwc2-Fix-gadget-DMA-unmap-direction.patch + patches.suse/usb-dwc3-gadget-Return-success-always-for-kick-trans.patch + patches.suse/usb-fotg210-hcd-Fix-an-error-message.patch + patches.suse/xhci-Do-not-use-GFP_KERNEL-in-potentially-atomic-con.patch + patches.suse/iio-proximity-pulsedlight-Fix-rumtime-PM-imbalance-o.patch + patches.suse/iio-gyro-mpu3050-Fix-reported-temperature-value.patch + patches.suse/iio-tsl2583-Fix-division-by-a-zero-lux_val.patch + + # netdev/net-next + patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch ######################################################## # end of sorted patches @@ -19566,6 +19648,8 @@ patches.suse/rtc-pcf2127-handle-timestamp-interrupts.patch patches.suse/nvmet-seset-ns-file-when-open-fails.patch patches.suse/proc-Avoid-mixing-integer-types-in-mem_rw.patch + patches.suse/ipc-mqueue-msg-sem-Avoid-relying-on-a-stack-reference.patch + patches.suse/cpufreq-intel_pstate-Add-Icelake-servers-support-in-.patch ######################################################## # kbuild/module infrastructure fixes @@ -19864,8 +19948,6 @@ # NVMe patches.suse/Revert-nvme-allow-64-bit-results-in-passthru-command.patch patches.suse/nvme-multipath-retry-commands-for-dying-queues.patch - patches.suse/nvme-do-not-update-disk-info-for-multipathed-device.patch - patches.suse/nvme-retrigger-ana-log-update-if-group-descriptor-isn-t.patch patches.suse/nvme-return-an-error-if-nvme_set_queue_count-fails.patch # CD-ROM @@ -19899,6 +19981,7 @@ patches.suse/target-disallow-emulate_legacy_capacity-with-RBD-obj.patch patches.suse/qla2xxx-add-module_version-back-to-driver.patch + patches.suse/lpfc-decouple-port_template-and-vport_template.patch ######################################################## # Networking drivers (wired) @@ -20101,6 +20184,7 @@ patches.kabi/reintroduce-cqhci_suspend-for-kABI.patch patches.kabi/cfg80211-kabi-workaround.patch patches.kabi/ath10k-CVE-2020-24588-kABI-workaround.patch + patches.kabi/hci_chan-amp-kABI-workaround.patch ######################################################## # You'd better have a good reason for adding a patch