+++ /dev/null
-From bce445e26d49b8b9f04a5486e04f1aaec4475782 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 15 Dec 2021 10:08:23 +0100
-Subject: ARM: 9170/1: fix panic when kasan and kprobe are enabled
-
-From: sparkhuang <huangshaobo6@huawei.com>
-
-[ Upstream commit 8b59b0a53c840921b625378f137e88adfa87647e ]
-
-arm32 uses software to simulate the instruction replaced
-by kprobe. some instructions may be simulated by constructing
-assembly functions. therefore, before executing instruction
-simulation, it is necessary to construct assembly function
-execution environment in C language through binding registers.
-after kasan is enabled, the register binding relationship will
-be destroyed, resulting in instruction simulation errors and
-causing kernel panic.
-
-the kprobe emulate instruction function is distributed in three
-files: actions-common.c actions-arm.c actions-thumb.c, so disable
-KASAN when compiling these files.
-
-for example, use kprobe insert on cap_capable+20 after kasan
-enabled, the cap_capable assembly code is as follows:
-<cap_capable>:
-e92d47f0 push {r4, r5, r6, r7, r8, r9, sl, lr}
-e1a05000 mov r5, r0
-e280006c add r0, r0, #108 ; 0x6c
-e1a04001 mov r4, r1
-e1a06002 mov r6, r2
-e59fa090 ldr sl, [pc, #144] ;
-ebfc7bf8 bl c03aa4b4 <__asan_load4>
-e595706c ldr r7, [r5, #108] ; 0x6c
-e2859014 add r9, r5, #20
-......
-The emulate_ldr assembly code after enabling kasan is as follows:
-c06f1384 <emulate_ldr>:
-e92d47f0 push {r4, r5, r6, r7, r8, r9, sl, lr}
-e282803c add r8, r2, #60 ; 0x3c
-e1a05000 mov r5, r0
-e7e37855 ubfx r7, r5, #16, #4
-e1a00008 mov r0, r8
-e1a09001 mov r9, r1
-e1a04002 mov r4, r2
-ebf35462 bl c03c6530 <__asan_load4>
-e357000f cmp r7, #15
-e7e36655 ubfx r6, r5, #12, #4
-e205a00f and sl, r5, #15
-0a000001 beq c06f13bc <emulate_ldr+0x38>
-e0840107 add r0, r4, r7, lsl #2
-ebf3545c bl c03c6530 <__asan_load4>
-e084010a add r0, r4, sl, lsl #2
-ebf3545a bl c03c6530 <__asan_load4>
-e2890010 add r0, r9, #16
-ebf35458 bl c03c6530 <__asan_load4>
-e5990010 ldr r0, [r9, #16]
-e12fff30 blx r0
-e356000f cm r6, #15
-1a000014 bne c06f1430 <emulate_ldr+0xac>
-e1a06000 mov r6, r0
-e2840040 add r0, r4, #64 ; 0x40
-......
-
-when running in emulate_ldr to simulate the ldr instruction, panic
-occurred, and the log is as follows:
-Unable to handle kernel NULL pointer dereference at virtual address
-00000090
-pgd = ecb46400
-[00000090] *pgd=2e0fa003, *pmd=00000000
-Internal error: Oops: 206 [#1] SMP ARM
-PC is at cap_capable+0x14/0xb0
-LR is at emulate_ldr+0x50/0xc0
-psr: 600d0293 sp : ecd63af8 ip : 00000004 fp : c0a7c30c
-r10: 00000000 r9 : c30897f4 r8 : ecd63cd4
-r7 : 0000000f r6 : 0000000a r5 : e59fa090 r4 : ecd63c98
-r3 : c06ae294 r2 : 00000000 r1 : b7611300 r0 : bf4ec008
-Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user
-Control: 32c5387d Table: 2d546400 DAC: 55555555
-Process bash (pid: 1643, stack limit = 0xecd60190)
-(cap_capable) from (kprobe_handler+0x218/0x340)
-(kprobe_handler) from (kprobe_trap_handler+0x24/0x48)
-(kprobe_trap_handler) from (do_undefinstr+0x13c/0x364)
-(do_undefinstr) from (__und_svc_finish+0x0/0x30)
-(__und_svc_finish) from (cap_capable+0x18/0xb0)
-(cap_capable) from (cap_vm_enough_memory+0x38/0x48)
-(cap_vm_enough_memory) from
-(security_vm_enough_memory_mm+0x48/0x6c)
-(security_vm_enough_memory_mm) from
-(copy_process.constprop.5+0x16b4/0x25c8)
-(copy_process.constprop.5) from (_do_fork+0xe8/0x55c)
-(_do_fork) from (SyS_clone+0x1c/0x24)
-(SyS_clone) from (__sys_trace_return+0x0/0x10)
-Code: 0050a0e1 6c0080e2 0140a0e1 0260a0e1 (f801f0e7)
-
-Fixes: 35aa1df43283 ("ARM kprobes: instruction single-stepping support")
-Fixes: 421015713b30 ("ARM: 9017/2: Enable KASan for ARM")
-Signed-off-by: huangshaobo <huangshaobo6@huawei.com>
-Acked-by: Ard Biesheuvel <ardb@kernel.org>
-Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm/probes/kprobes/Makefile | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/arch/arm/probes/kprobes/Makefile b/arch/arm/probes/kprobes/Makefile
-index 14db56f49f0a3..6159010dac4a6 100644
---- a/arch/arm/probes/kprobes/Makefile
-+++ b/arch/arm/probes/kprobes/Makefile
-@@ -1,4 +1,7 @@
- # SPDX-License-Identifier: GPL-2.0
-+KASAN_SANITIZE_actions-common.o := n
-+KASAN_SANITIZE_actions-arm.o := n
-+KASAN_SANITIZE_actions-thumb.o := n
- obj-$(CONFIG_KPROBES) += core.o actions-common.o checkers-common.o
- obj-$(CONFIG_ARM_KPROBES_TEST) += test-kprobes.o
- test-kprobes-objs := test-core.o
---
-2.34.1
-
+++ /dev/null
-From 90f2c29d576e5d334b8ab4ec4ea7d3cef563db91 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 25 Jan 2022 00:45:25 +0800
-Subject: ata: pata_platform: Fix a NULL pointer dereference in
- __pata_platform_probe()
-
-From: Zhou Qingyang <zhou1615@umn.edu>
-
-[ Upstream commit 9b6d90e2085ca2ce72ef9ea78658bf270855e62e ]
-
-In __pata_platform_probe(), devm_kzalloc() is assigned to ap->ops and
-there is a dereference of it right after that, which could introduce a
-NULL pointer dereference bug.
-
-Fix this by adding a NULL check of ap->ops.
-
-This bug was found by a static analyzer.
-
-Builds with 'make allyesconfig' show no new warnings,
-and our static analyzer no longer warns about this code.
-
-Fixes: f3d5e4f18dba ("ata: pata_of_platform: Allow to use 16-bit wide data transfer")
-Signed-off-by: Zhou Qingyang <zhou1615@umn.edu>
-Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
-Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ata/pata_platform.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/ata/pata_platform.c b/drivers/ata/pata_platform.c
-index 028329428b75d..87c7c90676ca0 100644
---- a/drivers/ata/pata_platform.c
-+++ b/drivers/ata/pata_platform.c
-@@ -128,6 +128,8 @@ int __pata_platform_probe(struct device *dev, struct resource *io_res,
- ap = host->ports[0];
-
- ap->ops = devm_kzalloc(dev, sizeof(*ap->ops), GFP_KERNEL);
-+ if (!ap->ops)
-+ return -ENOMEM;
- ap->ops->inherits = &ata_sff_port_ops;
- ap->ops->cable_detect = ata_cable_unknown;
- ap->ops->set_mode = pata_platform_set_mode;
---
-2.34.1
-
+++ /dev/null
-From ec3d9fff624879b39f8e872ebbc56f7c7f570ad1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 14 Jan 2022 18:50:54 +0100
-Subject: can: tcan4x5x: regmap: fix max register value
-
-From: Marc Kleine-Budde <mkl@pengutronix.de>
-
-[ Upstream commit e59986de5ff701494e14c722b78b6e6d513e0ab5 ]
-
-The MRAM of the tcan4x5x has a size of 2K and starts at 0x8000. There
-are no further registers in the tcan4x5x making 0x87fc the biggest
-addressable register.
-
-This patch fixes the max register value of the regmap config from
-0x8ffc to 0x87fc.
-
-Fixes: 6e1caaf8ed22 ("can: tcan4x5x: fix max register value")
-Link: https://lore.kernel.org/all/20220119064011.2943292-1-mkl@pengutronix.de
-Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/can/m_can/tcan4x5x-regmap.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/net/can/m_can/tcan4x5x-regmap.c b/drivers/net/can/m_can/tcan4x5x-regmap.c
-index ca80dbaf7a3f5..26e212b8ca7a6 100644
---- a/drivers/net/can/m_can/tcan4x5x-regmap.c
-+++ b/drivers/net/can/m_can/tcan4x5x-regmap.c
-@@ -12,7 +12,7 @@
- #define TCAN4X5X_SPI_INSTRUCTION_WRITE (0x61 << 24)
- #define TCAN4X5X_SPI_INSTRUCTION_READ (0x41 << 24)
-
--#define TCAN4X5X_MAX_REGISTER 0x8ffc
-+#define TCAN4X5X_MAX_REGISTER 0x87fc
-
- static int tcan4x5x_regmap_gather_write(void *context,
- const void *reg, size_t reg_len,
---
-2.34.1
-
+++ /dev/null
-From fa611ea6e2b196f27248a05ee59e1d5236bf1796 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 12 Jan 2022 12:29:04 +0800
-Subject: ceph: put the requests/sessions when it fails to alloc memory
-
-From: Xiubo Li <xiubli@redhat.com>
-
-[ Upstream commit 89d43d0551a848e70e63d9ba11534aaeabc82443 ]
-
-When failing to allocate the sessions memory we should make sure
-the req1 and req2 and the sessions get put. And also in case the
-max_sessions decreased so when kreallocate the new memory some
-sessions maybe missed being put.
-
-And if the max_sessions is 0 krealloc will return ZERO_SIZE_PTR,
-which will lead to a distinct access fault.
-
-URL: https://tracker.ceph.com/issues/53819
-Fixes: e1a4541ec0b9 ("ceph: flush the mdlog before waiting on unsafe reqs")
-Signed-off-by: Xiubo Li <xiubli@redhat.com>
-Reviewed-by: Venky Shankar <vshankar@redhat.com>
-Reviewed-by: Jeff Layton <jlayton@kernel.org>
-Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/ceph/caps.c | 55 +++++++++++++++++++++++++++++++++-----------------
- 1 file changed, 37 insertions(+), 18 deletions(-)
-
-diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
-index 8be4da2e2b826..09900a9015ea6 100644
---- a/fs/ceph/caps.c
-+++ b/fs/ceph/caps.c
-@@ -2217,6 +2217,7 @@ static int unsafe_request_wait(struct inode *inode)
- struct ceph_mds_client *mdsc = ceph_sb_to_client(inode->i_sb)->mdsc;
- struct ceph_inode_info *ci = ceph_inode(inode);
- struct ceph_mds_request *req1 = NULL, *req2 = NULL;
-+ unsigned int max_sessions;
- int ret, err = 0;
-
- spin_lock(&ci->i_unsafe_lock);
-@@ -2234,37 +2235,45 @@ static int unsafe_request_wait(struct inode *inode)
- }
- spin_unlock(&ci->i_unsafe_lock);
-
-+ /*
-+ * The mdsc->max_sessions is unlikely to be changed
-+ * mostly, here we will retry it by reallocating the
-+ * sessions array memory to get rid of the mdsc->mutex
-+ * lock.
-+ */
-+retry:
-+ max_sessions = mdsc->max_sessions;
-+
- /*
- * Trigger to flush the journal logs in all the relevant MDSes
- * manually, or in the worst case we must wait at most 5 seconds
- * to wait the journal logs to be flushed by the MDSes periodically.
- */
-- if (req1 || req2) {
-+ if ((req1 || req2) && likely(max_sessions)) {
- struct ceph_mds_session **sessions = NULL;
- struct ceph_mds_session *s;
- struct ceph_mds_request *req;
-- unsigned int max;
- int i;
-
-- /*
-- * The mdsc->max_sessions is unlikely to be changed
-- * mostly, here we will retry it by reallocating the
-- * sessions arrary memory to get rid of the mdsc->mutex
-- * lock.
-- */
--retry:
-- max = mdsc->max_sessions;
-- sessions = krealloc(sessions, max * sizeof(s), __GFP_ZERO);
-- if (!sessions)
-- return -ENOMEM;
-+ sessions = kzalloc(max_sessions * sizeof(s), GFP_KERNEL);
-+ if (!sessions) {
-+ err = -ENOMEM;
-+ goto out;
-+ }
-
- spin_lock(&ci->i_unsafe_lock);
- if (req1) {
- list_for_each_entry(req, &ci->i_unsafe_dirops,
- r_unsafe_dir_item) {
- s = req->r_session;
-- if (unlikely(s->s_mds >= max)) {
-+ if (unlikely(s->s_mds >= max_sessions)) {
- spin_unlock(&ci->i_unsafe_lock);
-+ for (i = 0; i < max_sessions; i++) {
-+ s = sessions[i];
-+ if (s)
-+ ceph_put_mds_session(s);
-+ }
-+ kfree(sessions);
- goto retry;
- }
- if (!sessions[s->s_mds]) {
-@@ -2277,8 +2286,14 @@ retry:
- list_for_each_entry(req, &ci->i_unsafe_iops,
- r_unsafe_target_item) {
- s = req->r_session;
-- if (unlikely(s->s_mds >= max)) {
-+ if (unlikely(s->s_mds >= max_sessions)) {
- spin_unlock(&ci->i_unsafe_lock);
-+ for (i = 0; i < max_sessions; i++) {
-+ s = sessions[i];
-+ if (s)
-+ ceph_put_mds_session(s);
-+ }
-+ kfree(sessions);
- goto retry;
- }
- if (!sessions[s->s_mds]) {
-@@ -2299,7 +2314,7 @@ retry:
- spin_unlock(&ci->i_ceph_lock);
-
- /* send flush mdlog request to MDSes */
-- for (i = 0; i < max; i++) {
-+ for (i = 0; i < max_sessions; i++) {
- s = sessions[i];
- if (s) {
- send_flush_mdlog(s);
-@@ -2316,15 +2331,19 @@ retry:
- ceph_timeout_jiffies(req1->r_timeout));
- if (ret)
- err = -EIO;
-- ceph_mdsc_put_request(req1);
- }
- if (req2) {
- ret = !wait_for_completion_timeout(&req2->r_safe_completion,
- ceph_timeout_jiffies(req2->r_timeout));
- if (ret)
- err = -EIO;
-- ceph_mdsc_put_request(req2);
- }
-+
-+out:
-+ if (req1)
-+ ceph_mdsc_put_request(req1);
-+ if (req2)
-+ ceph_mdsc_put_request(req2);
- return err;
- }
-
---
-2.34.1
-
+++ /dev/null
-From 62f987a974c726b6e4cbefcae0d86cec02b4cbdb Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 20 Jan 2022 04:20:52 +0800
-Subject: Drivers: hv: balloon: account for vmbus packet header in max_pkt_size
-
-From: Yanming Liu <yanminglr@gmail.com>
-
-[ Upstream commit 96d9d1fa5cd505078534113308ced0aa56d8da58 ]
-
-Commit adae1e931acd ("Drivers: hv: vmbus: Copy packets sent by Hyper-V
-out of the ring buffer") introduced a notion of maximum packet size in
-vmbus channel and used that size to initialize a buffer holding all
-incoming packet along with their vmbus packet header. hv_balloon uses
-the default maximum packet size VMBUS_DEFAULT_MAX_PKT_SIZE which matches
-its maximum message size, however vmbus_open expects this size to also
-include vmbus packet header. This leads to 4096 bytes
-dm_unballoon_request messages being truncated to 4080 bytes. When the
-driver tries to read next packet it starts from a wrong read_index,
-receives garbage and prints a lot of "Unhandled message: type:
-<garbage>" in dmesg.
-
-Allocate the buffer with HV_HYP_PAGE_SIZE more bytes to make room for
-the header.
-
-Fixes: adae1e931acd ("Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the ring buffer")
-Suggested-by: Michael Kelley (LINUX) <mikelley@microsoft.com>
-Suggested-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
-Signed-off-by: Yanming Liu <yanminglr@gmail.com>
-Reviewed-by: Michael Kelley <mikelley@microsoft.com>
-Reviewed-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
-Link: https://lore.kernel.org/r/20220119202052.3006981-1-yanminglr@gmail.com
-Signed-off-by: Wei Liu <wei.liu@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hv/hv_balloon.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c
-index ca873a3b98dbe..f2d05bff42453 100644
---- a/drivers/hv/hv_balloon.c
-+++ b/drivers/hv/hv_balloon.c
-@@ -1660,6 +1660,13 @@ static int balloon_connect_vsp(struct hv_device *dev)
- unsigned long t;
- int ret;
-
-+ /*
-+ * max_pkt_size should be large enough for one vmbus packet header plus
-+ * our receive buffer size. Hyper-V sends messages up to
-+ * HV_HYP_PAGE_SIZE bytes long on balloon channel.
-+ */
-+ dev->channel->max_pkt_size = HV_HYP_PAGE_SIZE * 2;
-+
- ret = vmbus_open(dev->channel, dm_ring_size, dm_ring_size, NULL, 0,
- balloon_onchannelcallback, dev);
- if (ret)
---
-2.34.1
-
+++ /dev/null
-From 7c01fa4c86445e6ffc387e53087af2544306c716 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 25 Jan 2022 00:55:51 +0800
-Subject: drm/amd/display/dc/calcs/dce_calcs: Fix a memleak in
- calculate_bandwidth()
-
-From: Zhou Qingyang <zhou1615@umn.edu>
-
-[ Upstream commit ebc77bcc6e1660a011483c035d53c461c8dcc4f5 ]
-
-In calculate_bandwidth(), the tag free_sclk and free_yclk are reversed,
-which could lead to a memory leak of yclk.
-
-Fix this bug by changing the location of free_sclk and free_yclk.
-
-This bug was found by a static analyzer.
-
-Builds with 'make allyesconfig' show no new warnings,
-and our static analyzer no longer warns about this code.
-
-Fixes: 2be8989d0fc2 ("drm/amd/display/dc/calcs/dce_calcs: Move some large variables from the stack to the heap")
-Signed-off-by: Zhou Qingyang <zhou1615@umn.edu>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/display/dc/calcs/dce_calcs.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/gpu/drm/amd/display/dc/calcs/dce_calcs.c b/drivers/gpu/drm/amd/display/dc/calcs/dce_calcs.c
-index ff5bb152ef494..e6ef36de08254 100644
---- a/drivers/gpu/drm/amd/display/dc/calcs/dce_calcs.c
-+++ b/drivers/gpu/drm/amd/display/dc/calcs/dce_calcs.c
-@@ -2033,10 +2033,10 @@ static void calculate_bandwidth(
- kfree(surface_type);
- free_tiling_mode:
- kfree(tiling_mode);
--free_yclk:
-- kfree(yclk);
- free_sclk:
- kfree(sclk);
-+free_yclk:
-+ kfree(yclk);
- }
-
- /*******************************************************************************
---
-2.34.1
-
+++ /dev/null
-From 0824f1aff01d3d3c4a5869423edab659c2373675 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 13 Jan 2022 08:32:13 -0800
-Subject: drm/msm/a6xx: Add missing suspend_count increment
-
-From: Rob Clark <robdclark@chromium.org>
-
-[ Upstream commit 860a7b2a87b7c743154824d0597b6c3eb3b53154 ]
-
-Reported-by: Danylo Piliaiev <dpiliaiev@igalia.com>
-Fixes: 3ab1c5cc3939 ("drm/msm: Add param for userspace to query suspend count")
-Signed-off-by: Rob Clark <robdclark@chromium.org>
-Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
-Link: https://lore.kernel.org/r/20220113163215.215367-1-robdclark@gmail.com
-Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
-index 723074aae5b63..b681c45520bbd 100644
---- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
-+++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
-@@ -1557,6 +1557,8 @@ static int a6xx_pm_suspend(struct msm_gpu *gpu)
- for (i = 0; i < gpu->nr_rings; i++)
- a6xx_gpu->shadow[i] = 0;
-
-+ gpu->suspend_count++;
-+
- return 0;
- }
-
---
-2.34.1
-
+++ /dev/null
-From b680b2ffbc6dd6deae8416a526a860a7833428ce Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 9 Jan 2022 20:24:31 +0100
-Subject: drm/msm/dpu: invalid parameter check in dpu_setup_dspp_pcc
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: José Expósito <jose.exposito89@gmail.com>
-
-[ Upstream commit 170b22234d5495f5e0844246e23f004639ee89ba ]
-
-The function performs a check on the "ctx" input parameter, however, it
-is used before the check.
-
-Initialize the "base" variable after the sanity check to avoid a
-possible NULL pointer dereference.
-
-Fixes: 4259ff7ae509e ("drm/msm/dpu: add support for pcc color block in dpu driver")
-Addresses-Coverity-ID: 1493866 ("Null pointer dereference")
-Signed-off-by: José Expósito <jose.exposito89@gmail.com>
-Link: https://lore.kernel.org/r/20220109192431.135949-1-jose.exposito89@gmail.com
-Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dspp.c | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dspp.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dspp.c
-index a98e964c3b6fa..355894a3b48c3 100644
---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dspp.c
-+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dspp.c
-@@ -26,9 +26,16 @@ static void dpu_setup_dspp_pcc(struct dpu_hw_dspp *ctx,
- struct dpu_hw_pcc_cfg *cfg)
- {
-
-- u32 base = ctx->cap->sblk->pcc.base;
-+ u32 base;
-
-- if (!ctx || !base) {
-+ if (!ctx) {
-+ DRM_ERROR("invalid ctx %pK\n", ctx);
-+ return;
-+ }
-+
-+ base = ctx->cap->sblk->pcc.base;
-+
-+ if (!base) {
- DRM_ERROR("invalid ctx %pK pcc base 0x%x\n", ctx, base);
- return;
- }
---
-2.34.1
-
+++ /dev/null
-From d7838b08fd8f95313b9feb7ed4e1d161a6bb321a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 30 Dec 2021 07:09:40 +0000
-Subject: drm/msm/dsi: Fix missing put_device() call in dsi_get_phy
-
-From: Miaoqian Lin <linmq006@gmail.com>
-
-[ Upstream commit c04c3148ca12227d92f91b355b4538cc333c9922 ]
-
-If of_find_device_by_node() succeeds, dsi_get_phy() doesn't
-a corresponding put_device(). Thus add put_device() to fix the exception
-handling.
-
-Fixes: ec31abf ("drm/msm/dsi: Separate PHY to another platform device")
-Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
-Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
-Link: https://lore.kernel.org/r/20211230070943.18116-1-linmq006@gmail.com
-Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/msm/dsi/dsi.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/msm/dsi/dsi.c b/drivers/gpu/drm/msm/dsi/dsi.c
-index fc280cc434943..122fadcf7cc1e 100644
---- a/drivers/gpu/drm/msm/dsi/dsi.c
-+++ b/drivers/gpu/drm/msm/dsi/dsi.c
-@@ -40,7 +40,12 @@ static int dsi_get_phy(struct msm_dsi *msm_dsi)
-
- of_node_put(phy_node);
-
-- if (!phy_pdev || !msm_dsi->phy) {
-+ if (!phy_pdev) {
-+ DRM_DEV_ERROR(&pdev->dev, "%s: phy driver is not ready\n", __func__);
-+ return -EPROBE_DEFER;
-+ }
-+ if (!msm_dsi->phy) {
-+ put_device(&phy_pdev->dev);
- DRM_DEV_ERROR(&pdev->dev, "%s: phy driver is not ready\n", __func__);
- return -EPROBE_DEFER;
- }
---
-2.34.1
-
+++ /dev/null
-From 9961d8f9538a52b24fa78b37c3307a95887c15de Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 16 Jan 2022 19:18:44 +0100
-Subject: drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: José Expósito <jose.exposito89@gmail.com>
-
-[ Upstream commit 5e761a2287234bc402ba7ef07129f5103bcd775c ]
-
-The function performs a check on the "phy" input parameter, however, it
-is used before the check.
-
-Initialize the "dev" variable after the sanity check to avoid a possible
-NULL pointer dereference.
-
-Fixes: 5c8290284402b ("drm/msm/dsi: Split PHY drivers to separate files")
-Addresses-Coverity-ID: 1493860 ("Null pointer dereference")
-Signed-off-by: José Expósito <jose.exposito89@gmail.com>
-Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
-Link: https://lore.kernel.org/r/20220116181844.7400-1-jose.exposito89@gmail.com
-Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
-index 8c65ef6968caf..a878b8b079c64 100644
---- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
-+++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
-@@ -806,12 +806,14 @@ int msm_dsi_phy_enable(struct msm_dsi_phy *phy,
- struct msm_dsi_phy_clk_request *clk_req,
- struct msm_dsi_phy_shared_timings *shared_timings)
- {
-- struct device *dev = &phy->pdev->dev;
-+ struct device *dev;
- int ret;
-
- if (!phy || !phy->cfg->ops.enable)
- return -EINVAL;
-
-+ dev = &phy->pdev->dev;
-+
- ret = dsi_phy_enable_resource(phy);
- if (ret) {
- DRM_DEV_ERROR(dev, "%s: resource enable failed, %d\n",
---
-2.34.1
-
+++ /dev/null
-From bd23c44878d0ec06fe2eca4d3091a7d9758bb54b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 12 Jan 2022 20:33:34 +0800
-Subject: drm/msm: Fix wrong size calculation
-
-From: Xianting Tian <xianting.tian@linux.alibaba.com>
-
-[ Upstream commit 0a727b459ee39bd4c5ced19d6024258ac87b6b2e ]
-
-For example, memory-region in .dts as below,
- reg = <0x0 0x50000000 0x0 0x20000000>
-
-We can get below values,
-struct resource r;
-r.start = 0x50000000;
-r.end = 0x6fffffff;
-
-So the size should be:
-size = r.end - r.start + 1 = 0x20000000
-
-Signed-off-by: Xianting Tian <xianting.tian@linux.alibaba.com>
-Fixes: 072f1f9168ed ("drm/msm: add support for "stolen" mem")
-Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
-Link: https://lore.kernel.org/r/20220112123334.749776-1-xianting.tian@linux.alibaba.com
-Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/msm/msm_drv.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
-index 27f737a253c77..bbf999c665174 100644
---- a/drivers/gpu/drm/msm/msm_drv.c
-+++ b/drivers/gpu/drm/msm/msm_drv.c
-@@ -437,7 +437,7 @@ static int msm_init_vram(struct drm_device *dev)
- of_node_put(node);
- if (ret)
- return ret;
-- size = r.end - r.start;
-+ size = r.end - r.start + 1;
- DRM_INFO("using VRAM carveout: %lx@%pa\n", size, &r.start);
-
- /* if we have no IOMMU, then we need to use carveout allocator.
---
-2.34.1
-
+++ /dev/null
-From d0414b8100285d629a8bd952e6fdf382c80f65ea Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jan 2022 08:50:22 +0000
-Subject: drm/msm/hdmi: Fix missing put_device() call in msm_hdmi_get_phy
-
-From: Miaoqian Lin <linmq006@gmail.com>
-
-[ Upstream commit 774fe0cd838d1b1419d41ab4ea0613c80d4ecbd7 ]
-
-The reference taken by 'of_find_device_by_node()' must be released when
-not needed anymore.
-Add the corresponding 'put_device()' in the error handling path.
-
-Fixes: e00012b256d4 ("drm/msm/hdmi: Make HDMI core get its PHY")
-Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
-Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
-Link: https://lore.kernel.org/r/20220107085026.23831-1-linmq006@gmail.com
-Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/msm/hdmi/hdmi.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c
-index 737453b6e5966..94f948ef279d1 100644
---- a/drivers/gpu/drm/msm/hdmi/hdmi.c
-+++ b/drivers/gpu/drm/msm/hdmi/hdmi.c
-@@ -97,10 +97,15 @@ static int msm_hdmi_get_phy(struct hdmi *hdmi)
-
- of_node_put(phy_node);
-
-- if (!phy_pdev || !hdmi->phy) {
-+ if (!phy_pdev) {
- DRM_DEV_ERROR(&pdev->dev, "phy driver is not ready\n");
- return -EPROBE_DEFER;
- }
-+ if (!hdmi->phy) {
-+ DRM_DEV_ERROR(&pdev->dev, "phy driver is not ready\n");
-+ put_device(&phy_pdev->dev);
-+ return -EPROBE_DEFER;
-+ }
-
- hdmi->phy_dev = get_device(&phy_pdev->dev);
-
---
-2.34.1
-
+++ /dev/null
-From 33accaea19eb94b30f5d6fbb97589ffedead7e5c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 19 Jan 2022 18:14:27 +0200
-Subject: efi/libstub: arm64: Fix image check alignment at entry
-
-From: Mihai Carabas <mihai.carabas@oracle.com>
-
-[ Upstream commit e9b7c3a4263bdcfd31bc3d03d48ce0ded7a94635 ]
-
-The kernel is aligned at SEGMENT_SIZE and this is the size populated in the PE
-headers:
-
-arch/arm64/kernel/efi-header.S: .long SEGMENT_ALIGN // SectionAlignment
-
-EFI_KIMG_ALIGN is defined as: (SEGMENT_ALIGN > THREAD_ALIGN ? SEGMENT_ALIGN :
-THREAD_ALIGN)
-
-So it depends on THREAD_ALIGN. On newer builds this message started to appear
-even though the loader is taking into account the PE header (which is stating
-SEGMENT_ALIGN).
-
-Fixes: c32ac11da3f8 ("efi/libstub: arm64: Double check image alignment at entry")
-Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
-Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/firmware/efi/libstub/arm64-stub.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/firmware/efi/libstub/arm64-stub.c b/drivers/firmware/efi/libstub/arm64-stub.c
-index 2363fee9211c9..9cc556013d085 100644
---- a/drivers/firmware/efi/libstub/arm64-stub.c
-+++ b/drivers/firmware/efi/libstub/arm64-stub.c
-@@ -119,9 +119,9 @@ efi_status_t handle_kernel_image(unsigned long *image_addr,
- if (image->image_base != _text)
- efi_err("FIRMWARE BUG: efi_loaded_image_t::image_base has bogus value\n");
-
-- if (!IS_ALIGNED((u64)_text, EFI_KIMG_ALIGN))
-- efi_err("FIRMWARE BUG: kernel image not aligned on %ldk boundary\n",
-- EFI_KIMG_ALIGN >> 10);
-+ if (!IS_ALIGNED((u64)_text, SEGMENT_ALIGN))
-+ efi_err("FIRMWARE BUG: kernel image not aligned on %dk boundary\n",
-+ SEGMENT_ALIGN >> 10);
-
- kernel_size = _edata - _text;
- kernel_memsize = kernel_size + (_end - _edata);
---
-2.34.1
-
+++ /dev/null
-From f522aaabd1c4d68d094d7ab0cee33365a0baf272 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 25 Jan 2022 16:38:43 -0800
-Subject: gve: Fix GFP flags when allocing pages
-
-From: Catherine Sullivan <csully@google.com>
-
-[ Upstream commit a92f7a6feeb3884c69c1c7c1f13bccecb2228ad0 ]
-
-Use GFP_ATOMIC when allocating pages out of the hotpath,
-continue to use GFP_KERNEL when allocating pages during setup.
-
-GFP_KERNEL will allow blocking which allows it to succeed
-more often in a low memory enviornment but in the hotpath we do
-not want to allow the allocation to block.
-
-Fixes: f5cedc84a30d2 ("gve: Add transmit and receive support")
-Signed-off-by: Catherine Sullivan <csully@google.com>
-Signed-off-by: David Awogbemila <awogbemila@google.com>
-Link: https://lore.kernel.org/r/20220126003843.3584521-1-awogbemila@google.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/google/gve/gve.h | 2 +-
- drivers/net/ethernet/google/gve/gve_main.c | 6 +++---
- drivers/net/ethernet/google/gve/gve_rx.c | 3 ++-
- drivers/net/ethernet/google/gve/gve_rx_dqo.c | 2 +-
- 4 files changed, 7 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/net/ethernet/google/gve/gve.h b/drivers/net/ethernet/google/gve/gve.h
-index c1d4042671f9f..b1273dce4795b 100644
---- a/drivers/net/ethernet/google/gve/gve.h
-+++ b/drivers/net/ethernet/google/gve/gve.h
-@@ -815,7 +815,7 @@ static inline bool gve_is_gqi(struct gve_priv *priv)
- /* buffers */
- int gve_alloc_page(struct gve_priv *priv, struct device *dev,
- struct page **page, dma_addr_t *dma,
-- enum dma_data_direction);
-+ enum dma_data_direction, gfp_t gfp_flags);
- void gve_free_page(struct device *dev, struct page *page, dma_addr_t dma,
- enum dma_data_direction);
- /* tx handling */
-diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c
-index 959352fceead7..68552848d3888 100644
---- a/drivers/net/ethernet/google/gve/gve_main.c
-+++ b/drivers/net/ethernet/google/gve/gve_main.c
-@@ -746,9 +746,9 @@ static void gve_free_rings(struct gve_priv *priv)
-
- int gve_alloc_page(struct gve_priv *priv, struct device *dev,
- struct page **page, dma_addr_t *dma,
-- enum dma_data_direction dir)
-+ enum dma_data_direction dir, gfp_t gfp_flags)
- {
-- *page = alloc_page(GFP_KERNEL);
-+ *page = alloc_page(gfp_flags);
- if (!*page) {
- priv->page_alloc_fail++;
- return -ENOMEM;
-@@ -792,7 +792,7 @@ static int gve_alloc_queue_page_list(struct gve_priv *priv, u32 id,
- for (i = 0; i < pages; i++) {
- err = gve_alloc_page(priv, &priv->pdev->dev, &qpl->pages[i],
- &qpl->page_buses[i],
-- gve_qpl_dma_dir(priv, id));
-+ gve_qpl_dma_dir(priv, id), GFP_KERNEL);
- /* caller handles clean up */
- if (err)
- return -ENOMEM;
-diff --git a/drivers/net/ethernet/google/gve/gve_rx.c b/drivers/net/ethernet/google/gve/gve_rx.c
-index 16169f291ad9f..629d8ed08fc61 100644
---- a/drivers/net/ethernet/google/gve/gve_rx.c
-+++ b/drivers/net/ethernet/google/gve/gve_rx.c
-@@ -79,7 +79,8 @@ static int gve_rx_alloc_buffer(struct gve_priv *priv, struct device *dev,
- dma_addr_t dma;
- int err;
-
-- err = gve_alloc_page(priv, dev, &page, &dma, DMA_FROM_DEVICE);
-+ err = gve_alloc_page(priv, dev, &page, &dma, DMA_FROM_DEVICE,
-+ GFP_ATOMIC);
- if (err)
- return err;
-
-diff --git a/drivers/net/ethernet/google/gve/gve_rx_dqo.c b/drivers/net/ethernet/google/gve/gve_rx_dqo.c
-index 8500621b2cd41..7b18b4fd9e548 100644
---- a/drivers/net/ethernet/google/gve/gve_rx_dqo.c
-+++ b/drivers/net/ethernet/google/gve/gve_rx_dqo.c
-@@ -157,7 +157,7 @@ static int gve_alloc_page_dqo(struct gve_priv *priv,
- int err;
-
- err = gve_alloc_page(priv, &priv->pdev->dev, &buf_state->page_info.page,
-- &buf_state->addr, DMA_FROM_DEVICE);
-+ &buf_state->addr, DMA_FROM_DEVICE, GFP_KERNEL);
- if (err)
- return err;
-
---
-2.34.1
-
+++ /dev/null
-From c438556b2e12ce6032a9f8b7d35546d477db8392 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 21 Jan 2022 14:55:43 +0300
-Subject: hwmon: (adt7470) Prevent divide by zero in adt7470_fan_write()
-
-From: Dan Carpenter <dan.carpenter@oracle.com>
-
-[ Upstream commit c1ec0cabc36718efc7fe8b4157d41b82d08ec1d2 ]
-
-The "val" variable is controlled by the user and comes from
-hwmon_attr_store(). The FAN_RPM_TO_PERIOD() macro divides by "val"
-so a zero will crash the system. Check for that and return -EINVAL.
-Negatives are also invalid so return -EINVAL for those too.
-
-Fixes: fc958a61ff6d ("hwmon: (adt7470) Convert to devm_hwmon_device_register_with_info API")
-Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hwmon/adt7470.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
-index d519aca4a9d64..fb6d14d213a18 100644
---- a/drivers/hwmon/adt7470.c
-+++ b/drivers/hwmon/adt7470.c
-@@ -662,6 +662,9 @@ static int adt7470_fan_write(struct device *dev, u32 attr, int channel, long val
- struct adt7470_data *data = dev_get_drvdata(dev);
- int err;
-
-+ if (val <= 0)
-+ return -EINVAL;
-+
- val = FAN_RPM_TO_PERIOD(val);
- val = clamp_val(val, 1, 65534);
-
---
-2.34.1
-
+++ /dev/null
-From d6d082f11399d419e7e7918ce829d802e047224f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jan 2022 23:23:31 -0800
-Subject: hwmon: (lm90) Fix sysfs and udev notifications
-
-From: Guenter Roeck <linux@roeck-us.net>
-
-[ Upstream commit d379880d9adb9f1ada3f1266aa49ea2561328e08 ]
-
-sysfs and udev notifications need to be sent to the _alarm
-attributes, not to the value attributes.
-
-Fixes: 94dbd23ed88c ("hwmon: (lm90) Use hwmon_notify_event()")
-Cc: Dmitry Osipenko <digetx@gmail.com>
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hwmon/lm90.c | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
-index ba01127c1deb1..1c9493c708132 100644
---- a/drivers/hwmon/lm90.c
-+++ b/drivers/hwmon/lm90.c
-@@ -1808,22 +1808,22 @@ static bool lm90_is_tripped(struct i2c_client *client, u16 *status)
-
- if (st & LM90_STATUS_LLOW)
- hwmon_notify_event(data->hwmon_dev, hwmon_temp,
-- hwmon_temp_min, 0);
-+ hwmon_temp_min_alarm, 0);
- if (st & LM90_STATUS_RLOW)
- hwmon_notify_event(data->hwmon_dev, hwmon_temp,
-- hwmon_temp_min, 1);
-+ hwmon_temp_min_alarm, 1);
- if (st2 & MAX6696_STATUS2_R2LOW)
- hwmon_notify_event(data->hwmon_dev, hwmon_temp,
-- hwmon_temp_min, 2);
-+ hwmon_temp_min_alarm, 2);
- if (st & LM90_STATUS_LHIGH)
- hwmon_notify_event(data->hwmon_dev, hwmon_temp,
-- hwmon_temp_max, 0);
-+ hwmon_temp_max_alarm, 0);
- if (st & LM90_STATUS_RHIGH)
- hwmon_notify_event(data->hwmon_dev, hwmon_temp,
-- hwmon_temp_max, 1);
-+ hwmon_temp_max_alarm, 1);
- if (st2 & MAX6696_STATUS2_R2HIGH)
- hwmon_notify_event(data->hwmon_dev, hwmon_temp,
-- hwmon_temp_max, 2);
-+ hwmon_temp_max_alarm, 2);
-
- return true;
- }
---
-2.34.1
-
+++ /dev/null
-From d69029476f1d2a61555f5623276fa43a84c0b586 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jan 2022 12:36:41 -0800
-Subject: hwmon: (lm90) Mark alert as broken for MAX6646/6647/6649
-
-From: Guenter Roeck <linux@roeck-us.net>
-
-[ Upstream commit f614629f9c1080dcc844a8430e3fb4c37ebbf05d ]
-
-Experiments with MAX6646 and MAX6648 show that the alert function of those
-chips is broken, similar to other chips supported by the lm90 driver.
-Mark it accordingly.
-
-Fixes: 4667bcb8d8fc ("hwmon: (lm90) Introduce chip parameter structure")
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hwmon/lm90.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
-index 06cb971c889b4..ba01127c1deb1 100644
---- a/drivers/hwmon/lm90.c
-+++ b/drivers/hwmon/lm90.c
-@@ -394,7 +394,7 @@ static const struct lm90_params lm90_params[] = {
- .max_convrate = 9,
- },
- [max6646] = {
-- .flags = LM90_HAVE_CRIT,
-+ .flags = LM90_HAVE_CRIT | LM90_HAVE_BROKEN_ALERT,
- .alert_alarms = 0x7c,
- .max_convrate = 6,
- .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
---
-2.34.1
-
+++ /dev/null
-From cf277c92343c939aec6b98d6cd54fb4a96cd3b8b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jan 2022 11:05:23 -0800
-Subject: hwmon: (lm90) Mark alert as broken for MAX6654
-
-From: Guenter Roeck <linux@roeck-us.net>
-
-[ Upstream commit a53fff96f35763d132a36c620b183fdf11022d7a ]
-
-Experiments with MAX6654 show that its alert function is broken,
-similar to other chips supported by the lm90 driver. Mark it accordingly.
-
-Fixes: 229d495d8189 ("hwmon: (lm90) Add max6654 support to lm90 driver")
-Cc: Josh Lehan <krellan@google.com>
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hwmon/lm90.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
-index e4ecf3440d7cf..280ae5f58187b 100644
---- a/drivers/hwmon/lm90.c
-+++ b/drivers/hwmon/lm90.c
-@@ -400,6 +400,7 @@ static const struct lm90_params lm90_params[] = {
- .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
- },
- [max6654] = {
-+ .flags = LM90_HAVE_BROKEN_ALERT,
- .alert_alarms = 0x7c,
- .max_convrate = 7,
- .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
---
-2.34.1
-
+++ /dev/null
-From 5fed2051ee0a935ae7ed7a286a0d9ff59121e1f0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jan 2022 11:11:00 -0800
-Subject: hwmon: (lm90) Mark alert as broken for MAX6680
-
-From: Guenter Roeck <linux@roeck-us.net>
-
-[ Upstream commit 94746b0ba479743355e0d3cc1cb9cfe3011fb8be ]
-
-Experiments with MAX6680 and MAX6681 show that the alert function of those
-chips is broken, similar to other chips supported by the lm90 driver.
-Mark it accordingly.
-
-Fixes: 4667bcb8d8fc ("hwmon: (lm90) Introduce chip parameter structure")
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hwmon/lm90.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
-index 280ae5f58187b..06cb971c889b4 100644
---- a/drivers/hwmon/lm90.c
-+++ b/drivers/hwmon/lm90.c
-@@ -419,7 +419,7 @@ static const struct lm90_params lm90_params[] = {
- },
- [max6680] = {
- .flags = LM90_HAVE_OFFSET | LM90_HAVE_CRIT
-- | LM90_HAVE_CRIT_ALRM_SWP,
-+ | LM90_HAVE_CRIT_ALRM_SWP | LM90_HAVE_BROKEN_ALERT,
- .alert_alarms = 0x7c,
- .max_convrate = 7,
- },
---
-2.34.1
-
+++ /dev/null
-From feae4d72317cbb8a3145ffbef16924f3646d0ad1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 8 Jan 2022 11:37:19 -0800
-Subject: hwmon: (lm90) Re-enable interrupts after alert clears
-
-From: Guenter Roeck <linux@roeck-us.net>
-
-[ Upstream commit bc341a1a98827925082e95db174734fc8bd68af6 ]
-
-If alert handling is broken, interrupts are disabled after an alert and
-re-enabled after the alert clears. However, if there is an interrupt
-handler, this does not apply if alerts were originally disabled and enabled
-when the driver was loaded. In that case, interrupts will stay disabled
-after an alert was handled though the alert handler even after the alert
-condition clears. Address the situation by always re-enabling interrupts
-after the alert condition clears if there is an interrupt handler.
-
-Fixes: 2abdc357c55d9 ("hwmon: (lm90) Unmask hardware interrupt")
-Cc: Dmitry Osipenko <digetx@gmail.com>
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hwmon/lm90.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
-index cc5e48fe304b1..e4ecf3440d7cf 100644
---- a/drivers/hwmon/lm90.c
-+++ b/drivers/hwmon/lm90.c
-@@ -848,7 +848,7 @@ static int lm90_update_device(struct device *dev)
- * Re-enable ALERT# output if it was originally enabled and
- * relevant alarms are all clear
- */
-- if (!(data->config_orig & 0x80) &&
-+ if ((client->irq || !(data->config_orig & 0x80)) &&
- !(data->alarms & data->alert_alarms)) {
- if (data->config & 0x80) {
- dev_dbg(&client->dev, "Re-enabling ALERT#\n");
---
-2.34.1
-
+++ /dev/null
-From 7f76be2fdd1d2d36a5561f50c5c80309e17ae186 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jan 2022 11:48:52 -0800
-Subject: hwmon: (lm90) Reduce maximum conversion rate for G781
-
-From: Guenter Roeck <linux@roeck-us.net>
-
-[ Upstream commit a66c5ed539277b9f2363bbace0dba88b85b36c26 ]
-
-According to its datasheet, G781 supports a maximum conversion rate value
-of 8 (62.5 ms). However, chips labeled G781 and G780 were found to only
-support a maximum conversion rate value of 7 (125 ms). On the other side,
-chips labeled G781-1 and G784 were found to support a conversion rate value
-of 8. There is no known means to distinguish G780 from G781 or G784; all
-chips report the same manufacturer ID and chip revision.
-Setting the conversion rate register value to 8 on chips not supporting
-it causes unexpected behavior since the real conversion rate is set to 0
-(16 seconds) if a value of 8 is written into the conversion rate register.
-Limit the conversion rate register value to 7 for all G78x chips to avoid
-the problem.
-
-Fixes: ae544f64cc7b ("hwmon: (lm90) Add support for GMT G781")
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hwmon/lm90.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
-index 74019dff2550e..cc5e48fe304b1 100644
---- a/drivers/hwmon/lm90.c
-+++ b/drivers/hwmon/lm90.c
-@@ -373,7 +373,7 @@ static const struct lm90_params lm90_params[] = {
- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
- | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_CRIT,
- .alert_alarms = 0x7c,
-- .max_convrate = 8,
-+ .max_convrate = 7,
- },
- [lm86] = {
- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
---
-2.34.1
-
+++ /dev/null
-From d35bbec57d47838711a17c9444f6e37e81e60a33 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 2 Dec 2021 12:52:01 +0100
-Subject: i40e: Fix for failed to init adminq while VF reset
-
-From: Karen Sornek <karen.sornek@intel.com>
-
-[ Upstream commit 0f344c8129a5337dae50e31b817dd50a60ff238c ]
-
-Fix for failed to init adminq: -53 while VF is resetting via MAC
-address changing procedure.
-Added sync module to avoid reading deadbeef value in reinit adminq
-during software reset.
-Without this patch it is possible to trigger VF reset procedure
-during reinit adminq. This resulted in an incorrect reading of
-value from the AQP registers and generated the -53 error.
-
-Fixes: 5c3c48ac6bf5 ("i40e: implement virtual device interface")
-Signed-off-by: Grzegorz Szczurek <grzegorzx.szczurek@intel.com>
-Signed-off-by: Karen Sornek <karen.sornek@intel.com>
-Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../net/ethernet/intel/i40e/i40e_register.h | 3 ++
- .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 44 ++++++++++++++++++-
- .../ethernet/intel/i40e/i40e_virtchnl_pf.h | 1 +
- 3 files changed, 46 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/intel/i40e/i40e_register.h b/drivers/net/ethernet/intel/i40e/i40e_register.h
-index 8d0588a27a053..1908eed4fa5ee 100644
---- a/drivers/net/ethernet/intel/i40e/i40e_register.h
-+++ b/drivers/net/ethernet/intel/i40e/i40e_register.h
-@@ -413,6 +413,9 @@
- #define I40E_VFINT_DYN_CTLN(_INTVF) (0x00024800 + ((_INTVF) * 4)) /* _i=0...511 */ /* Reset: VFR */
- #define I40E_VFINT_DYN_CTLN_CLEARPBA_SHIFT 1
- #define I40E_VFINT_DYN_CTLN_CLEARPBA_MASK I40E_MASK(0x1, I40E_VFINT_DYN_CTLN_CLEARPBA_SHIFT)
-+#define I40E_VFINT_ICR0_ADMINQ_SHIFT 30
-+#define I40E_VFINT_ICR0_ADMINQ_MASK I40E_MASK(0x1, I40E_VFINT_ICR0_ADMINQ_SHIFT)
-+#define I40E_VFINT_ICR0_ENA(_VF) (0x0002C000 + ((_VF) * 4)) /* _i=0...127 */ /* Reset: CORER */
- #define I40E_VPINT_AEQCTL(_VF) (0x0002B800 + ((_VF) * 4)) /* _i=0...127 */ /* Reset: CORER */
- #define I40E_VPINT_AEQCTL_MSIX_INDX_SHIFT 0
- #define I40E_VPINT_AEQCTL_ITR_INDX_SHIFT 11
-diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
-index 3e88d229b5e0b..c6f643e54c4f7 100644
---- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
-+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
-@@ -1376,6 +1376,32 @@ static i40e_status i40e_config_vf_promiscuous_mode(struct i40e_vf *vf,
- return aq_ret;
- }
-
-+/**
-+ * i40e_sync_vfr_reset
-+ * @hw: pointer to hw struct
-+ * @vf_id: VF identifier
-+ *
-+ * Before trigger hardware reset, we need to know if no other process has
-+ * reserved the hardware for any reset operations. This check is done by
-+ * examining the status of the RSTAT1 register used to signal the reset.
-+ **/
-+static int i40e_sync_vfr_reset(struct i40e_hw *hw, int vf_id)
-+{
-+ u32 reg;
-+ int i;
-+
-+ for (i = 0; i < I40E_VFR_WAIT_COUNT; i++) {
-+ reg = rd32(hw, I40E_VFINT_ICR0_ENA(vf_id)) &
-+ I40E_VFINT_ICR0_ADMINQ_MASK;
-+ if (reg)
-+ return 0;
-+
-+ usleep_range(100, 200);
-+ }
-+
-+ return -EAGAIN;
-+}
-+
- /**
- * i40e_trigger_vf_reset
- * @vf: pointer to the VF structure
-@@ -1390,9 +1416,11 @@ static void i40e_trigger_vf_reset(struct i40e_vf *vf, bool flr)
- struct i40e_pf *pf = vf->pf;
- struct i40e_hw *hw = &pf->hw;
- u32 reg, reg_idx, bit_idx;
-+ bool vf_active;
-+ u32 radq;
-
- /* warn the VF */
-- clear_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states);
-+ vf_active = test_and_clear_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states);
-
- /* Disable VF's configuration API during reset. The flag is re-enabled
- * in i40e_alloc_vf_res(), when it's safe again to access VF's VSI.
-@@ -1406,7 +1434,19 @@ static void i40e_trigger_vf_reset(struct i40e_vf *vf, bool flr)
- * just need to clean up, so don't hit the VFRTRIG register.
- */
- if (!flr) {
-- /* reset VF using VPGEN_VFRTRIG reg */
-+ /* Sync VFR reset before trigger next one */
-+ radq = rd32(hw, I40E_VFINT_ICR0_ENA(vf->vf_id)) &
-+ I40E_VFINT_ICR0_ADMINQ_MASK;
-+ if (vf_active && !radq)
-+ /* waiting for finish reset by virtual driver */
-+ if (i40e_sync_vfr_reset(hw, vf->vf_id))
-+ dev_info(&pf->pdev->dev,
-+ "Reset VF %d never finished\n",
-+ vf->vf_id);
-+
-+ /* Reset VF using VPGEN_VFRTRIG reg. It is also setting
-+ * in progress state in rstat1 register.
-+ */
- reg = rd32(hw, I40E_VPGEN_VFRTRIG(vf->vf_id));
- reg |= I40E_VPGEN_VFRTRIG_VFSWR_MASK;
- wr32(hw, I40E_VPGEN_VFRTRIG(vf->vf_id), reg);
-diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h
-index 49575a640a84c..03c42fd0fea19 100644
---- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h
-+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h
-@@ -19,6 +19,7 @@
- #define I40E_MAX_VF_PROMISC_FLAGS 3
-
- #define I40E_VF_STATE_WAIT_COUNT 20
-+#define I40E_VFR_WAIT_COUNT 100
-
- /* Various queue ctrls */
- enum i40e_queue_ctrl {
---
-2.34.1
-
+++ /dev/null
-From 891c0d054ae3c4b45c924ddcb17910b0da9eedbe Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 5 Nov 2021 11:17:00 +0000
-Subject: i40e: Fix issue when maximum queues is exceeded
-
-From: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
-
-[ Upstream commit d701658a50a471591094b3eb3961b4926cc8f104 ]
-
-Before this patch VF interface vanished when
-maximum queue number was exceeded. Driver tried
-to add next queues even if there was not enough
-space. PF sent incorrect number of queues to
-the VF when there were not enough of them.
-
-Add an additional condition introduced to check
-available space in 'qp_pile' before proceeding.
-This condition makes it impossible to add queues
-if they number is greater than the number resulting
-from available space.
-Also add the search for free space in PF queue
-pair piles.
-
-Without this patch VF interfaces are not seen
-when available space for queues has been
-exceeded and following logs appears permanently
-in dmesg:
-"Unable to get VF config (-32)".
-"VF 62 failed opcode 3, retval: -5"
-"Unable to get VF config due to PF error condition, not retrying"
-
-Fixes: 7daa6bf3294e ("i40e: driver core headers")
-Fixes: 41c445ff0f48 ("i40e: main driver core")
-Signed-off-by: Jaroslaw Gawin <jaroslawx.gawin@intel.com>
-Signed-off-by: Slawomir Laba <slawomirx.laba@intel.com>
-Signed-off-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
-Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/i40e/i40e.h | 1 -
- drivers/net/ethernet/intel/i40e/i40e_main.c | 14 +----
- .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 59 +++++++++++++++++++
- 3 files changed, 61 insertions(+), 13 deletions(-)
-
-diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
-index b10bc59c5700f..5027c7794fb1d 100644
---- a/drivers/net/ethernet/intel/i40e/i40e.h
-+++ b/drivers/net/ethernet/intel/i40e/i40e.h
-@@ -174,7 +174,6 @@ enum i40e_interrupt_policy {
-
- struct i40e_lump_tracking {
- u16 num_entries;
-- u16 search_hint;
- u16 list[0];
- #define I40E_PILE_VALID_BIT 0x8000
- #define I40E_IWARP_IRQ_PILE_ID (I40E_PILE_VALID_BIT - 2)
-diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
-index 0530c20f679f7..783701dcaca29 100644
---- a/drivers/net/ethernet/intel/i40e/i40e_main.c
-+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
-@@ -196,10 +196,6 @@ int i40e_free_virt_mem_d(struct i40e_hw *hw, struct i40e_virt_mem *mem)
- * @id: an owner id to stick on the items assigned
- *
- * Returns the base item index of the lump, or negative for error
-- *
-- * The search_hint trick and lack of advanced fit-finding only work
-- * because we're highly likely to have all the same size lump requests.
-- * Linear search time and any fragmentation should be minimal.
- **/
- static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile,
- u16 needed, u16 id)
-@@ -214,8 +210,7 @@ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile,
- return -EINVAL;
- }
-
-- /* start the linear search with an imperfect hint */
-- i = pile->search_hint;
-+ i = 0;
- while (i < pile->num_entries) {
- /* skip already allocated entries */
- if (pile->list[i] & I40E_PILE_VALID_BIT) {
-@@ -234,7 +229,6 @@ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile,
- for (j = 0; j < needed; j++)
- pile->list[i+j] = id | I40E_PILE_VALID_BIT;
- ret = i;
-- pile->search_hint = i + j;
- break;
- }
-
-@@ -257,7 +251,7 @@ static int i40e_put_lump(struct i40e_lump_tracking *pile, u16 index, u16 id)
- {
- int valid_id = (id | I40E_PILE_VALID_BIT);
- int count = 0;
-- int i;
-+ u16 i;
-
- if (!pile || index >= pile->num_entries)
- return -EINVAL;
-@@ -269,8 +263,6 @@ static int i40e_put_lump(struct i40e_lump_tracking *pile, u16 index, u16 id)
- count++;
- }
-
-- if (count && index < pile->search_hint)
-- pile->search_hint = index;
-
- return count;
- }
-@@ -11786,7 +11778,6 @@ static int i40e_init_interrupt_scheme(struct i40e_pf *pf)
- return -ENOMEM;
-
- pf->irq_pile->num_entries = vectors;
-- pf->irq_pile->search_hint = 0;
-
- /* track first vector for misc interrupts, ignore return */
- (void)i40e_get_lump(pf, pf->irq_pile, 1, I40E_PILE_VALID_BIT - 1);
-@@ -12589,7 +12580,6 @@ static int i40e_sw_init(struct i40e_pf *pf)
- goto sw_init_done;
- }
- pf->qp_pile->num_entries = pf->hw.func_caps.num_tx_qp;
-- pf->qp_pile->search_hint = 0;
-
- pf->tx_timeout_recovery_level = 1;
-
-diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
-index 048f1678ab8ac..3e88d229b5e0b 100644
---- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
-+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
-@@ -2617,6 +2617,59 @@ error_param:
- aq_ret);
- }
-
-+/**
-+ * i40e_check_enough_queue - find big enough queue number
-+ * @vf: pointer to the VF info
-+ * @needed: the number of items needed
-+ *
-+ * Returns the base item index of the queue, or negative for error
-+ **/
-+static int i40e_check_enough_queue(struct i40e_vf *vf, u16 needed)
-+{
-+ unsigned int i, cur_queues, more, pool_size;
-+ struct i40e_lump_tracking *pile;
-+ struct i40e_pf *pf = vf->pf;
-+ struct i40e_vsi *vsi;
-+
-+ vsi = pf->vsi[vf->lan_vsi_idx];
-+ cur_queues = vsi->alloc_queue_pairs;
-+
-+ /* if current allocated queues are enough for need */
-+ if (cur_queues >= needed)
-+ return vsi->base_queue;
-+
-+ pile = pf->qp_pile;
-+ if (cur_queues > 0) {
-+ /* if the allocated queues are not zero
-+ * just check if there are enough queues for more
-+ * behind the allocated queues.
-+ */
-+ more = needed - cur_queues;
-+ for (i = vsi->base_queue + cur_queues;
-+ i < pile->num_entries; i++) {
-+ if (pile->list[i] & I40E_PILE_VALID_BIT)
-+ break;
-+
-+ if (more-- == 1)
-+ /* there is enough */
-+ return vsi->base_queue;
-+ }
-+ }
-+
-+ pool_size = 0;
-+ for (i = 0; i < pile->num_entries; i++) {
-+ if (pile->list[i] & I40E_PILE_VALID_BIT) {
-+ pool_size = 0;
-+ continue;
-+ }
-+ if (needed <= ++pool_size)
-+ /* there is enough */
-+ return i;
-+ }
-+
-+ return -ENOMEM;
-+}
-+
- /**
- * i40e_vc_request_queues_msg
- * @vf: pointer to the VF info
-@@ -2651,6 +2704,12 @@ static int i40e_vc_request_queues_msg(struct i40e_vf *vf, u8 *msg)
- req_pairs - cur_pairs,
- pf->queues_left);
- vfres->num_queue_pairs = pf->queues_left + cur_pairs;
-+ } else if (i40e_check_enough_queue(vf, req_pairs) < 0) {
-+ dev_warn(&pf->pdev->dev,
-+ "VF %d requested %d more queues, but there is not enough for it.\n",
-+ vf->vf_id,
-+ req_pairs - cur_pairs);
-+ vfres->num_queue_pairs = cur_pairs;
- } else {
- /* successful request */
- vf->num_req_queues = req_pairs;
---
-2.34.1
-
+++ /dev/null
-From a0ba11d62fc2b3c484327a6f8387f07987905f72 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 26 Nov 2021 11:11:22 +0100
-Subject: i40e: Fix queues reservation for XDP
-
-From: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
-
-[ Upstream commit 92947844b8beee988c0ce17082b705c2f75f0742 ]
-
-When XDP was configured on a system with large number of CPUs
-and X722 NIC there was a call trace with NULL pointer dereference.
-
-i40e 0000:87:00.0: failed to get tracking for 256 queues for VSI 0 err -12
-i40e 0000:87:00.0: setup of MAIN VSI failed
-
-BUG: kernel NULL pointer dereference, address: 0000000000000000
-RIP: 0010:i40e_xdp+0xea/0x1b0 [i40e]
-Call Trace:
-? i40e_reconfig_rss_queues+0x130/0x130 [i40e]
-dev_xdp_install+0x61/0xe0
-dev_xdp_attach+0x18a/0x4c0
-dev_change_xdp_fd+0x1e6/0x220
-do_setlink+0x616/0x1030
-? ahci_port_stop+0x80/0x80
-? ata_qc_issue+0x107/0x1e0
-? lock_timer_base+0x61/0x80
-? __mod_timer+0x202/0x380
-rtnl_setlink+0xe5/0x170
-? bpf_lsm_binder_transaction+0x10/0x10
-? security_capable+0x36/0x50
-rtnetlink_rcv_msg+0x121/0x350
-? rtnl_calcit.isra.0+0x100/0x100
-netlink_rcv_skb+0x50/0xf0
-netlink_unicast+0x1d3/0x2a0
-netlink_sendmsg+0x22a/0x440
-sock_sendmsg+0x5e/0x60
-__sys_sendto+0xf0/0x160
-? __sys_getsockname+0x7e/0xc0
-? _copy_from_user+0x3c/0x80
-? __sys_setsockopt+0xc8/0x1a0
-__x64_sys_sendto+0x20/0x30
-do_syscall_64+0x33/0x40
-entry_SYSCALL_64_after_hwframe+0x44/0xae
-RIP: 0033:0x7f83fa7a39e0
-
-This was caused by PF queue pile fragmentation due to
-flow director VSI queue being placed right after main VSI.
-Because of this main VSI was not able to resize its
-queue allocation for XDP resulting in no queues allocated
-for main VSI when XDP was turned on.
-
-Fix this by always allocating last queue in PF queue pile
-for a flow director VSI.
-
-Fixes: 41c445ff0f48 ("i40e: main driver core")
-Fixes: 74608d17fe29 ("i40e: add support for XDP_TX action")
-Signed-off-by: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
-Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
-Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
-Tested-by: Kiran Bhandare <kiranx.bhandare@intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/i40e/i40e_main.c | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
-diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
-index 783701dcaca29..14f7effbe3fd0 100644
---- a/drivers/net/ethernet/intel/i40e/i40e_main.c
-+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
-@@ -210,6 +210,20 @@ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile,
- return -EINVAL;
- }
-
-+ /* Allocate last queue in the pile for FDIR VSI queue
-+ * so it doesn't fragment the qp_pile
-+ */
-+ if (pile == pf->qp_pile && pf->vsi[id]->type == I40E_VSI_FDIR) {
-+ if (pile->list[pile->num_entries - 1] & I40E_PILE_VALID_BIT) {
-+ dev_err(&pf->pdev->dev,
-+ "Cannot allocate queue %d for I40E_VSI_FDIR\n",
-+ pile->num_entries - 1);
-+ return -ENOMEM;
-+ }
-+ pile->list[pile->num_entries - 1] = id | I40E_PILE_VALID_BIT;
-+ return pile->num_entries - 1;
-+ }
-+
- i = 0;
- while (i < pile->num_entries) {
- /* skip already allocated entries */
---
-2.34.1
-
+++ /dev/null
-From 9513487e444f7f40b73e4cc5861beab1491f72ab Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 8 Dec 2021 17:56:33 -0800
-Subject: i40e: fix unsigned stat widths
-
-From: Joe Damato <jdamato@fastly.com>
-
-[ Upstream commit 3b8428b84539c78fdc8006c17ebd25afd4722d51 ]
-
-Change i40e_update_vsi_stats and struct i40e_vsi to use u64 fields to match
-the width of the stats counters in struct i40e_rx_queue_stats.
-
-Update debugfs code to use the correct format specifier for u64.
-
-Fixes: 41c445ff0f48 ("i40e: main driver core")
-Signed-off-by: Joe Damato <jdamato@fastly.com>
-Reported-by: kernel test robot <lkp@intel.com>
-Tested-by: Gurucharan G <gurucharanx.g@intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/i40e/i40e.h | 8 ++++----
- drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 2 +-
- drivers/net/ethernet/intel/i40e/i40e_main.c | 4 ++--
- 3 files changed, 7 insertions(+), 7 deletions(-)
-
-diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
-index 5027c7794fb1d..389df4d86ab4c 100644
---- a/drivers/net/ethernet/intel/i40e/i40e.h
-+++ b/drivers/net/ethernet/intel/i40e/i40e.h
-@@ -847,12 +847,12 @@ struct i40e_vsi {
- struct rtnl_link_stats64 net_stats_offsets;
- struct i40e_eth_stats eth_stats;
- struct i40e_eth_stats eth_stats_offsets;
-- u32 tx_restart;
-- u32 tx_busy;
-+ u64 tx_restart;
-+ u64 tx_busy;
- u64 tx_linearize;
- u64 tx_force_wb;
-- u32 rx_buf_failed;
-- u32 rx_page_failed;
-+ u64 rx_buf_failed;
-+ u64 rx_page_failed;
-
- /* These are containers of ring pointers, allocated at run-time */
- struct i40e_ring **rx_rings;
-diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
-index 2c1b1da1220ec..1e57cc8c47d7b 100644
---- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
-+++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
-@@ -240,7 +240,7 @@ static void i40e_dbg_dump_vsi_seid(struct i40e_pf *pf, int seid)
- (unsigned long int)vsi->net_stats_offsets.rx_compressed,
- (unsigned long int)vsi->net_stats_offsets.tx_compressed);
- dev_info(&pf->pdev->dev,
-- " tx_restart = %d, tx_busy = %d, rx_buf_failed = %d, rx_page_failed = %d\n",
-+ " tx_restart = %llu, tx_busy = %llu, rx_buf_failed = %llu, rx_page_failed = %llu\n",
- vsi->tx_restart, vsi->tx_busy,
- vsi->rx_buf_failed, vsi->rx_page_failed);
- rcu_read_lock();
-diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
-index 14f7effbe3fd0..20c8c0231e2c4 100644
---- a/drivers/net/ethernet/intel/i40e/i40e_main.c
-+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
-@@ -778,9 +778,9 @@ static void i40e_update_vsi_stats(struct i40e_vsi *vsi)
- struct rtnl_link_stats64 *ns; /* netdev stats */
- struct i40e_eth_stats *oes;
- struct i40e_eth_stats *es; /* device's eth stats */
-- u32 tx_restart, tx_busy;
-+ u64 tx_restart, tx_busy;
- struct i40e_ring *p;
-- u32 rx_page, rx_buf;
-+ u64 rx_page, rx_buf;
- u64 bytes, packets;
- unsigned int start;
- u64 tx_linearize;
---
-2.34.1
-
+++ /dev/null
-From 4b66f9ad7946829c15d1f1e7366a8023c0fd8565 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 28 Oct 2021 13:51:14 +0000
-Subject: i40e: Increase delay to 1 s after global EMP reset
-
-From: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
-
-[ Upstream commit 9b13bd53134c9ddd544a790125199fdbdb505e67 ]
-
-Recently simplified i40e_rebuild causes that FW sometimes
-is not ready after NVM update, the ping does not return.
-
-Increase the delay in case of EMP reset.
-Old delay of 300 ms was introduced for specific cards for 710 series.
-Now it works for all the cards and delay was increased.
-
-Fixes: 1fa51a650e1d ("i40e: Add delay after EMP reset for firmware to recover")
-Signed-off-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
-Signed-off-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
-Tested-by: Gurucharan G <gurucharanx.g@intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/i40e/i40e_main.c | 12 +++---------
- 1 file changed, 3 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
-index cc1cefdd4cdac..0530c20f679f7 100644
---- a/drivers/net/ethernet/intel/i40e/i40e_main.c
-+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
-@@ -10574,15 +10574,9 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired)
- }
- i40e_get_oem_version(&pf->hw);
-
-- if (test_bit(__I40E_EMP_RESET_INTR_RECEIVED, pf->state) &&
-- ((hw->aq.fw_maj_ver == 4 && hw->aq.fw_min_ver <= 33) ||
-- hw->aq.fw_maj_ver < 4) && hw->mac.type == I40E_MAC_XL710) {
-- /* The following delay is necessary for 4.33 firmware and older
-- * to recover after EMP reset. 200 ms should suffice but we
-- * put here 300 ms to be sure that FW is ready to operate
-- * after reset.
-- */
-- mdelay(300);
-+ if (test_and_clear_bit(__I40E_EMP_RESET_INTR_RECEIVED, pf->state)) {
-+ /* The following delay is necessary for firmware update. */
-+ mdelay(1000);
- }
-
- /* re-verify the eeprom if we just had an EMP reset */
---
-2.34.1
-
+++ /dev/null
-From 789793e8a86796b357702a310fa5a368233ca34d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 21 Jan 2022 18:59:18 -0800
-Subject: ibmvnic: Allow extra failures before disabling
-
-From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
-
-[ Upstream commit db9f0e8bf79e6da7068b5818fea0ffd9d0d4b4da ]
-
-If auto-priority-failover (APF) is enabled and there are at least two
-backing devices of different priorities, some resets like fail-over,
-change-param etc can cause at least two back to back failovers. (Failover
-from high priority backing device to lower priority one and then back
-to the higher priority one if that is still functional).
-
-Depending on the timimg of the two failovers it is possible to trigger
-a "hard" reset and for the hard reset to fail due to failovers. When this
-occurs, the driver assumes that the network is unstable and disables the
-VNIC for a 60-second "settling time". This in turn can cause the ethtool
-command to fail with "No such device" while the vnic automatically recovers
-a little while later.
-
-Given that it's possible to have two back to back failures, allow for extra
-failures before disabling the vnic for the settling time.
-
-Fixes: f15fde9d47b8 ("ibmvnic: delay next reset if hard reset fails")
-Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
-Reviewed-by: Dany Madden <drt@linux.ibm.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/ibm/ibmvnic.c | 21 +++++++++++++++++----
- 1 file changed, 17 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
-index 352ffe982d849..191b3b7350182 100644
---- a/drivers/net/ethernet/ibm/ibmvnic.c
-+++ b/drivers/net/ethernet/ibm/ibmvnic.c
-@@ -2424,6 +2424,7 @@ static void __ibmvnic_reset(struct work_struct *work)
- struct ibmvnic_rwi *rwi;
- unsigned long flags;
- u32 reset_state;
-+ int num_fails = 0;
- int rc = 0;
-
- adapter = container_of(work, struct ibmvnic_adapter, ibmvnic_reset);
-@@ -2477,11 +2478,23 @@ static void __ibmvnic_reset(struct work_struct *work)
- rc = do_hard_reset(adapter, rwi, reset_state);
- rtnl_unlock();
- }
-- if (rc) {
-- /* give backing device time to settle down */
-+ if (rc)
-+ num_fails++;
-+ else
-+ num_fails = 0;
-+
-+ /* If auto-priority-failover is enabled we can get
-+ * back to back failovers during resets, resulting
-+ * in at least two failed resets (from high-priority
-+ * backing device to low-priority one and then back)
-+ * If resets continue to fail beyond that, give the
-+ * adapter some time to settle down before retrying.
-+ */
-+ if (num_fails >= 3) {
- netdev_dbg(adapter->netdev,
-- "[S:%s] Hard reset failed, waiting 60 secs\n",
-- adapter_state_to_string(adapter->state));
-+ "[S:%s] Hard reset failed %d times, waiting 60 secs\n",
-+ adapter_state_to_string(adapter->state),
-+ num_fails);
- set_current_state(TASK_UNINTERRUPTIBLE);
- schedule_timeout(60 * HZ);
- }
---
-2.34.1
-
+++ /dev/null
-From fcf84f906f943dbbfcff3cb32e33da0d51346d84 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 21 Jan 2022 18:59:20 -0800
-Subject: ibmvnic: don't spin in tasklet
-
-From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
-
-[ Upstream commit 48079e7fdd0269d66b1d7d66ae88bd03162464ad ]
-
-ibmvnic_tasklet() continuously spins waiting for responses to all
-capability requests. It does this to avoid encountering an error
-during initialization of the vnic. However if there is a bug in the
-VIOS and we do not receive a response to one or more queries the
-tasklet ends up spinning continuously leading to hard lock ups.
-
-If we fail to receive a message from the VIOS it is reasonable to
-timeout the login attempt rather than spin indefinitely in the tasklet.
-
-Fixes: 249168ad07cd ("ibmvnic: Make CRQ interrupt tasklet wait for all capabilities crqs")
-Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
-Reviewed-by: Dany Madden <drt@linux.ibm.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/ibm/ibmvnic.c | 6 ------
- 1 file changed, 6 deletions(-)
-
-diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
-index a3dd5c648fecd..5c7371dc83848 100644
---- a/drivers/net/ethernet/ibm/ibmvnic.c
-+++ b/drivers/net/ethernet/ibm/ibmvnic.c
-@@ -5317,12 +5317,6 @@ static void ibmvnic_tasklet(struct tasklet_struct *t)
- ibmvnic_handle_crq(crq, adapter);
- crq->generic.first = 0;
- }
--
-- /* remain in tasklet until all
-- * capabilities responses are received
-- */
-- if (!adapter->wait_capability)
-- done = true;
- }
- /* if capabilities CRQ's were sent in this tasklet, the following
- * tasklet must wait until all responses are received
---
-2.34.1
-
+++ /dev/null
-From 97cb9e214950f38276668af4b702802574df035d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 21 Jan 2022 18:59:19 -0800
-Subject: ibmvnic: init ->running_cap_crqs early
-
-From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
-
-[ Upstream commit 151b6a5c06b678687f64f2d9a99fd04d5cd32b72 ]
-
-We use ->running_cap_crqs to determine when the ibmvnic_tasklet() should
-send out the next protocol message type. i.e when we get back responses
-to all our QUERY_CAPABILITY CRQs we send out REQUEST_CAPABILITY crqs.
-Similiary, when we get responses to all the REQUEST_CAPABILITY crqs, we
-send out the QUERY_IP_OFFLOAD CRQ.
-
-We currently increment ->running_cap_crqs as we send out each CRQ and
-have the ibmvnic_tasklet() send out the next message type, when this
-running_cap_crqs count drops to 0.
-
-This assumes that all the CRQs of the current type were sent out before
-the count drops to 0. However it is possible that we send out say 6 CRQs,
-get preempted and receive all the 6 responses before we send out the
-remaining CRQs. This can result in ->running_cap_crqs count dropping to
-zero before all messages of the current type were sent and we end up
-sending the next protocol message too early.
-
-Instead initialize the ->running_cap_crqs upfront so the tasklet will
-only send the next protocol message after all responses are received.
-
-Use the cap_reqs local variable to also detect any discrepancy (either
-now or in future) in the number of capability requests we actually send.
-
-Currently only send_query_cap() is affected by this behavior (of sending
-next message early) since it is called from the worker thread (during
-reset) and from application thread (during ->ndo_open()) and they can be
-preempted. send_request_cap() is only called from the tasklet which
-processes CRQ responses sequentially, is not be affected. But to
-maintain the existing symmtery with send_query_capability() we update
-send_request_capability() also.
-
-Fixes: 249168ad07cd ("ibmvnic: Make CRQ interrupt tasklet wait for all capabilities crqs")
-Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
-Reviewed-by: Dany Madden <drt@linux.ibm.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/ibm/ibmvnic.c | 106 +++++++++++++++++++----------
- 1 file changed, 71 insertions(+), 35 deletions(-)
-
-diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
-index 191b3b7350182..a3dd5c648fecd 100644
---- a/drivers/net/ethernet/ibm/ibmvnic.c
-+++ b/drivers/net/ethernet/ibm/ibmvnic.c
-@@ -3675,11 +3675,25 @@ static void send_request_cap(struct ibmvnic_adapter *adapter, int retry)
- struct device *dev = &adapter->vdev->dev;
- union ibmvnic_crq crq;
- int max_entries;
-+ int cap_reqs;
-+
-+ /* We send out 6 or 7 REQUEST_CAPABILITY CRQs below (depending on
-+ * the PROMISC flag). Initialize this count upfront. When the tasklet
-+ * receives a response to all of these, it will send the next protocol
-+ * message (QUERY_IP_OFFLOAD).
-+ */
-+ if (!(adapter->netdev->flags & IFF_PROMISC) ||
-+ adapter->promisc_supported)
-+ cap_reqs = 7;
-+ else
-+ cap_reqs = 6;
-
- if (!retry) {
- /* Sub-CRQ entries are 32 byte long */
- int entries_page = 4 * PAGE_SIZE / (sizeof(u64) * 4);
-
-+ atomic_set(&adapter->running_cap_crqs, cap_reqs);
-+
- if (adapter->min_tx_entries_per_subcrq > entries_page ||
- adapter->min_rx_add_entries_per_subcrq > entries_page) {
- dev_err(dev, "Fatal, invalid entries per sub-crq\n");
-@@ -3740,44 +3754,45 @@ static void send_request_cap(struct ibmvnic_adapter *adapter, int retry)
- adapter->opt_rx_comp_queues;
-
- adapter->req_rx_add_queues = adapter->max_rx_add_queues;
-+ } else {
-+ atomic_add(cap_reqs, &adapter->running_cap_crqs);
- }
--
- memset(&crq, 0, sizeof(crq));
- crq.request_capability.first = IBMVNIC_CRQ_CMD;
- crq.request_capability.cmd = REQUEST_CAPABILITY;
-
- crq.request_capability.capability = cpu_to_be16(REQ_TX_QUEUES);
- crq.request_capability.number = cpu_to_be64(adapter->req_tx_queues);
-- atomic_inc(&adapter->running_cap_crqs);
-+ cap_reqs--;
- ibmvnic_send_crq(adapter, &crq);
-
- crq.request_capability.capability = cpu_to_be16(REQ_RX_QUEUES);
- crq.request_capability.number = cpu_to_be64(adapter->req_rx_queues);
-- atomic_inc(&adapter->running_cap_crqs);
-+ cap_reqs--;
- ibmvnic_send_crq(adapter, &crq);
-
- crq.request_capability.capability = cpu_to_be16(REQ_RX_ADD_QUEUES);
- crq.request_capability.number = cpu_to_be64(adapter->req_rx_add_queues);
-- atomic_inc(&adapter->running_cap_crqs);
-+ cap_reqs--;
- ibmvnic_send_crq(adapter, &crq);
-
- crq.request_capability.capability =
- cpu_to_be16(REQ_TX_ENTRIES_PER_SUBCRQ);
- crq.request_capability.number =
- cpu_to_be64(adapter->req_tx_entries_per_subcrq);
-- atomic_inc(&adapter->running_cap_crqs);
-+ cap_reqs--;
- ibmvnic_send_crq(adapter, &crq);
-
- crq.request_capability.capability =
- cpu_to_be16(REQ_RX_ADD_ENTRIES_PER_SUBCRQ);
- crq.request_capability.number =
- cpu_to_be64(adapter->req_rx_add_entries_per_subcrq);
-- atomic_inc(&adapter->running_cap_crqs);
-+ cap_reqs--;
- ibmvnic_send_crq(adapter, &crq);
-
- crq.request_capability.capability = cpu_to_be16(REQ_MTU);
- crq.request_capability.number = cpu_to_be64(adapter->req_mtu);
-- atomic_inc(&adapter->running_cap_crqs);
-+ cap_reqs--;
- ibmvnic_send_crq(adapter, &crq);
-
- if (adapter->netdev->flags & IFF_PROMISC) {
-@@ -3785,16 +3800,21 @@ static void send_request_cap(struct ibmvnic_adapter *adapter, int retry)
- crq.request_capability.capability =
- cpu_to_be16(PROMISC_REQUESTED);
- crq.request_capability.number = cpu_to_be64(1);
-- atomic_inc(&adapter->running_cap_crqs);
-+ cap_reqs--;
- ibmvnic_send_crq(adapter, &crq);
- }
- } else {
- crq.request_capability.capability =
- cpu_to_be16(PROMISC_REQUESTED);
- crq.request_capability.number = cpu_to_be64(0);
-- atomic_inc(&adapter->running_cap_crqs);
-+ cap_reqs--;
- ibmvnic_send_crq(adapter, &crq);
- }
-+
-+ /* Keep at end to catch any discrepancy between expected and actual
-+ * CRQs sent.
-+ */
-+ WARN_ON(cap_reqs != 0);
- }
-
- static int pending_scrq(struct ibmvnic_adapter *adapter,
-@@ -4188,118 +4208,132 @@ static void send_query_map(struct ibmvnic_adapter *adapter)
- static void send_query_cap(struct ibmvnic_adapter *adapter)
- {
- union ibmvnic_crq crq;
-+ int cap_reqs;
-+
-+ /* We send out 25 QUERY_CAPABILITY CRQs below. Initialize this count
-+ * upfront. When the tasklet receives a response to all of these, it
-+ * can send out the next protocol messaage (REQUEST_CAPABILITY).
-+ */
-+ cap_reqs = 25;
-+
-+ atomic_set(&adapter->running_cap_crqs, cap_reqs);
-
-- atomic_set(&adapter->running_cap_crqs, 0);
- memset(&crq, 0, sizeof(crq));
- crq.query_capability.first = IBMVNIC_CRQ_CMD;
- crq.query_capability.cmd = QUERY_CAPABILITY;
-
- crq.query_capability.capability = cpu_to_be16(MIN_TX_QUEUES);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability = cpu_to_be16(MIN_RX_QUEUES);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability = cpu_to_be16(MIN_RX_ADD_QUEUES);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability = cpu_to_be16(MAX_TX_QUEUES);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability = cpu_to_be16(MAX_RX_QUEUES);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability = cpu_to_be16(MAX_RX_ADD_QUEUES);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability =
- cpu_to_be16(MIN_TX_ENTRIES_PER_SUBCRQ);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability =
- cpu_to_be16(MIN_RX_ADD_ENTRIES_PER_SUBCRQ);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability =
- cpu_to_be16(MAX_TX_ENTRIES_PER_SUBCRQ);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability =
- cpu_to_be16(MAX_RX_ADD_ENTRIES_PER_SUBCRQ);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability = cpu_to_be16(TCP_IP_OFFLOAD);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability = cpu_to_be16(PROMISC_SUPPORTED);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability = cpu_to_be16(MIN_MTU);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability = cpu_to_be16(MAX_MTU);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability = cpu_to_be16(MAX_MULTICAST_FILTERS);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability = cpu_to_be16(VLAN_HEADER_INSERTION);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability = cpu_to_be16(RX_VLAN_HEADER_INSERTION);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability = cpu_to_be16(MAX_TX_SG_ENTRIES);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability = cpu_to_be16(RX_SG_SUPPORTED);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability = cpu_to_be16(OPT_TX_COMP_SUB_QUEUES);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability = cpu_to_be16(OPT_RX_COMP_QUEUES);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability =
- cpu_to_be16(OPT_RX_BUFADD_Q_PER_RX_COMP_Q);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability =
- cpu_to_be16(OPT_TX_ENTRIES_PER_SUBCRQ);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability =
- cpu_to_be16(OPT_RXBA_ENTRIES_PER_SUBCRQ);
-- atomic_inc(&adapter->running_cap_crqs);
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-
- crq.query_capability.capability = cpu_to_be16(TX_RX_DESC_REQ);
-- atomic_inc(&adapter->running_cap_crqs);
-+
- ibmvnic_send_crq(adapter, &crq);
-+ cap_reqs--;
-+
-+ /* Keep at end to catch any discrepancy between expected and actual
-+ * CRQs sent.
-+ */
-+ WARN_ON(cap_reqs != 0);
- }
-
- static void send_query_ip_offload(struct ibmvnic_adapter *adapter)
-@@ -4604,6 +4638,8 @@ static void handle_request_cap_rsp(union ibmvnic_crq *crq,
- char *name;
-
- atomic_dec(&adapter->running_cap_crqs);
-+ netdev_dbg(adapter->netdev, "Outstanding request-caps: %d\n",
-+ atomic_read(&adapter->running_cap_crqs));
- switch (be16_to_cpu(crq->request_capability_rsp.capability)) {
- case REQ_TX_QUEUES:
- req_value = &adapter->req_tx_queues;
---
-2.34.1
-
+++ /dev/null
-From 17fedcb20213ce347eec38e133cebfa9f200991e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 21 Jan 2022 04:38:56 -0800
-Subject: io_uring: fix bug in slow unregistering of nodes
-
-From: Dylan Yudaken <dylany@fb.com>
-
-[ Upstream commit b36a2050040b2d839bdc044007cdd57101d7f881 ]
-
-In some cases io_rsrc_ref_quiesce will call io_rsrc_node_switch_start,
-and then immediately flush the delayed work queue &ctx->rsrc_put_work.
-
-However the percpu_ref_put does not immediately destroy the node, it
-will be called asynchronously via RCU. That ends up with
-io_rsrc_node_ref_zero only being called after rsrc_put_work has been
-flushed, and so the process ends up sleeping for 1 second unnecessarily.
-
-This patch executes the put code immediately if we are busy
-quiescing.
-
-Fixes: 4a38aed2a0a7 ("io_uring: batch reap of dead file registrations")
-Signed-off-by: Dylan Yudaken <dylany@fb.com>
-Link: https://lore.kernel.org/r/20220121123856.3557884-1-dylany@fb.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/io_uring.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/fs/io_uring.c b/fs/io_uring.c
-index f713b91537f41..993913c585fbf 100644
---- a/fs/io_uring.c
-+++ b/fs/io_uring.c
-@@ -7718,10 +7718,15 @@ static void io_rsrc_node_ref_zero(struct percpu_ref *ref)
- struct io_ring_ctx *ctx = node->rsrc_data->ctx;
- unsigned long flags;
- bool first_add = false;
-+ unsigned long delay = HZ;
-
- spin_lock_irqsave(&ctx->rsrc_ref_lock, flags);
- node->done = true;
-
-+ /* if we are mid-quiesce then do not delay */
-+ if (node->rsrc_data->quiesce)
-+ delay = 0;
-+
- while (!list_empty(&ctx->rsrc_ref_list)) {
- node = list_first_entry(&ctx->rsrc_ref_list,
- struct io_rsrc_node, node);
-@@ -7734,7 +7739,7 @@ static void io_rsrc_node_ref_zero(struct percpu_ref *ref)
- spin_unlock_irqrestore(&ctx->rsrc_ref_lock, flags);
-
- if (first_add)
-- mod_delayed_work(system_wq, &ctx->rsrc_put_work, HZ);
-+ mod_delayed_work(system_wq, &ctx->rsrc_put_work, delay);
- }
-
- static struct io_rsrc_node *io_rsrc_node_alloc(struct io_ring_ctx *ctx)
---
-2.34.1
-
+++ /dev/null
-From f97681895a754f2e044bd5bd0f4b5c6a095100e7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 26 Jan 2022 17:10:22 -0800
-Subject: ipv4: avoid using shared IP generator for connected sockets
-
-From: Eric Dumazet <edumazet@google.com>
-
-[ Upstream commit 23f57406b82de51809d5812afd96f210f8b627f3 ]
-
-ip_select_ident_segs() has been very conservative about using
-the connected socket private generator only for packets with IP_DF
-set, claiming it was needed for some VJ compression implementations.
-
-As mentioned in this referenced document, this can be abused.
-(Ref: Off-Path TCP Exploits of the Mixed IPID Assignment)
-
-Before switching to pure random IPID generation and possibly hurt
-some workloads, lets use the private inet socket generator.
-
-Not only this will remove one vulnerability, this will also
-improve performance of TCP flows using pmtudisc==IP_PMTUDISC_DONT
-
-Fixes: 73f156a6e8c1 ("inetpeer: get rid of ip_id_count")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Reviewed-by: David Ahern <dsahern@kernel.org>
-Reported-by: Ray Che <xijiache@gmail.com>
-Cc: Willy Tarreau <w@1wt.eu>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/net/ip.h | 21 ++++++++++-----------
- 1 file changed, 10 insertions(+), 11 deletions(-)
-
-diff --git a/include/net/ip.h b/include/net/ip.h
-index 9192444f2964e..0106c6590ee7b 100644
---- a/include/net/ip.h
-+++ b/include/net/ip.h
-@@ -520,19 +520,18 @@ static inline void ip_select_ident_segs(struct net *net, struct sk_buff *skb,
- {
- struct iphdr *iph = ip_hdr(skb);
-
-+ /* We had many attacks based on IPID, use the private
-+ * generator as much as we can.
-+ */
-+ if (sk && inet_sk(sk)->inet_daddr) {
-+ iph->id = htons(inet_sk(sk)->inet_id);
-+ inet_sk(sk)->inet_id += segs;
-+ return;
-+ }
- if ((iph->frag_off & htons(IP_DF)) && !skb->ignore_df) {
-- /* This is only to work around buggy Windows95/2000
-- * VJ compression implementations. If the ID field
-- * does not change, they drop every other packet in
-- * a TCP stream using header compression.
-- */
-- if (sk && inet_sk(sk)->inet_daddr) {
-- iph->id = htons(inet_sk(sk)->inet_id);
-- inet_sk(sk)->inet_id += segs;
-- } else {
-- iph->id = 0;
-- }
-+ iph->id = 0;
- } else {
-+ /* Unfortunately we need the big hammer to get a suitable IPID */
- __ip_select_ident(net, iph, segs);
- }
- }
---
-2.34.1
-
+++ /dev/null
-From ce72db6d15ce9ab3779c815b35f339a5a0f58003 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 21 Jan 2022 16:57:31 -0800
-Subject: ipv4: fix ip option filtering for locally generated fragments
-
-From: Jakub Kicinski <kuba@kernel.org>
-
-[ Upstream commit 27a8caa59babb96c5890569e131bc0eb6d45daee ]
-
-During IP fragmentation we sanitize IP options. This means overwriting
-options which should not be copied with NOPs. Only the first fragment
-has the original, full options.
-
-ip_fraglist_prepare() copies the IP header and options from previous
-fragment to the next one. Commit 19c3401a917b ("net: ipv4: place control
-buffer handling away from fragmentation iterators") moved sanitizing
-options before ip_fraglist_prepare() which means options are sanitized
-and then overwritten again with the old values.
-
-Fixing this is not enough, however, nor did the sanitization work
-prior to aforementioned commit.
-
-ip_options_fragment() (which does the sanitization) uses ipcb->opt.optlen
-for the length of the options. ipcb->opt of fragments is not populated
-(it's 0), only the head skb has the state properly built. So even when
-called at the right time ip_options_fragment() does nothing. This seems
-to date back all the way to v2.5.44 when the fast path for pre-fragmented
-skbs had been introduced. Prior to that ip_options_build() would have been
-called for every fragment (in fact ever since v2.5.44 the fragmentation
-handing in ip_options_build() has been dead code, I'll clean it up in
--next).
-
-In the original patch (see Link) caixf mentions fixing the handling
-for fragments other than the second one, but I'm not sure how _any_
-fragment could have had their options sanitized with the code
-as it stood.
-
-Tested with python (MTU on lo lowered to 1000 to force fragmentation):
-
- import socket
- s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
- s.setsockopt(socket.IPPROTO_IP, socket.IP_OPTIONS,
- bytearray([7,4,5,192, 20|0x80,4,1,0]))
- s.sendto(b'1'*2000, ('127.0.0.1', 1234))
-
-Before:
-
-IP (tos 0x0, ttl 64, id 1053, offset 0, flags [+], proto UDP (17), length 996, options (RR [bad length 4] [bad ptr 5] 192.148.4.1,,RA value 256))
- localhost.36500 > localhost.search-agent: UDP, length 2000
-IP (tos 0x0, ttl 64, id 1053, offset 968, flags [+], proto UDP (17), length 996, options (RR [bad length 4] [bad ptr 5] 192.148.4.1,,RA value 256))
- localhost > localhost: udp
-IP (tos 0x0, ttl 64, id 1053, offset 1936, flags [none], proto UDP (17), length 100, options (RR [bad length 4] [bad ptr 5] 192.148.4.1,,RA value 256))
- localhost > localhost: udp
-
-After:
-
-IP (tos 0x0, ttl 96, id 42549, offset 0, flags [+], proto UDP (17), length 996, options (RR [bad length 4] [bad ptr 5] 192.148.4.1,,RA value 256))
- localhost.51607 > localhost.search-agent: UDP, bad length 2000 > 960
-IP (tos 0x0, ttl 96, id 42549, offset 968, flags [+], proto UDP (17), length 996, options (NOP,NOP,NOP,NOP,RA value 256))
- localhost > localhost: udp
-IP (tos 0x0, ttl 96, id 42549, offset 1936, flags [none], proto UDP (17), length 100, options (NOP,NOP,NOP,NOP,RA value 256))
- localhost > localhost: udp
-
-RA (20 | 0x80) is now copied as expected, RR (7) is "NOPed out".
-
-Link: https://lore.kernel.org/netdev/20220107080559.122713-1-ooppublic@163.com/
-Fixes: 19c3401a917b ("net: ipv4: place control buffer handling away from fragmentation iterators")
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Signed-off-by: caixf <ooppublic@163.com>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv4/ip_output.c | 15 ++++++++++++---
- 1 file changed, 12 insertions(+), 3 deletions(-)
-
-diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
-index 9bca57ef8b838..ff38b46bd4b0f 100644
---- a/net/ipv4/ip_output.c
-+++ b/net/ipv4/ip_output.c
-@@ -826,15 +826,24 @@ int ip_do_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
- /* Everything is OK. Generate! */
- ip_fraglist_init(skb, iph, hlen, &iter);
-
-- if (iter.frag)
-- ip_options_fragment(iter.frag);
--
- for (;;) {
- /* Prepare header of the next frame,
- * before previous one went down. */
- if (iter.frag) {
-+ bool first_frag = (iter.offset == 0);
-+
- IPCB(iter.frag)->flags = IPCB(skb)->flags;
- ip_fraglist_prepare(skb, &iter);
-+ if (first_frag && IPCB(skb)->opt.optlen) {
-+ /* ipcb->opt is not populated for frags
-+ * coming from __ip_make_skb(),
-+ * ip_options_fragment() needs optlen
-+ */
-+ IPCB(iter.frag)->opt.optlen =
-+ IPCB(skb)->opt.optlen;
-+ ip_options_fragment(iter.frag);
-+ ip_send_check(iter.iph);
-+ }
- }
-
- skb->tstamp = tstamp;
---
-2.34.1
-
+++ /dev/null
-From 3ec23775ced46061472d84cea9d2459571158fbd Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 26 Jan 2022 16:51:16 -0800
-Subject: ipv4: raw: lock the socket in raw_bind()
-
-From: Eric Dumazet <edumazet@google.com>
-
-[ Upstream commit 153a0d187e767c68733b8e9f46218eb1f41ab902 ]
-
-For some reason, raw_bind() forgot to lock the socket.
-
-BUG: KCSAN: data-race in __ip4_datagram_connect / raw_bind
-
-write to 0xffff8881170d4308 of 4 bytes by task 5466 on cpu 0:
- raw_bind+0x1b0/0x250 net/ipv4/raw.c:739
- inet_bind+0x56/0xa0 net/ipv4/af_inet.c:443
- __sys_bind+0x14b/0x1b0 net/socket.c:1697
- __do_sys_bind net/socket.c:1708 [inline]
- __se_sys_bind net/socket.c:1706 [inline]
- __x64_sys_bind+0x3d/0x50 net/socket.c:1706
- do_syscall_x64 arch/x86/entry/common.c:50 [inline]
- do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
- entry_SYSCALL_64_after_hwframe+0x44/0xae
-
-read to 0xffff8881170d4308 of 4 bytes by task 5468 on cpu 1:
- __ip4_datagram_connect+0xb7/0x7b0 net/ipv4/datagram.c:39
- ip4_datagram_connect+0x2a/0x40 net/ipv4/datagram.c:89
- inet_dgram_connect+0x107/0x190 net/ipv4/af_inet.c:576
- __sys_connect_file net/socket.c:1900 [inline]
- __sys_connect+0x197/0x1b0 net/socket.c:1917
- __do_sys_connect net/socket.c:1927 [inline]
- __se_sys_connect net/socket.c:1924 [inline]
- __x64_sys_connect+0x3d/0x50 net/socket.c:1924
- do_syscall_x64 arch/x86/entry/common.c:50 [inline]
- do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
- entry_SYSCALL_64_after_hwframe+0x44/0xae
-
-value changed: 0x00000000 -> 0x0003007f
-
-Reported by Kernel Concurrency Sanitizer on:
-CPU: 1 PID: 5468 Comm: syz-executor.5 Not tainted 5.17.0-rc1-syzkaller #0
-Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Reported-by: syzbot <syzkaller@googlegroups.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv4/raw.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
-index bb446e60cf580..b8689052079cd 100644
---- a/net/ipv4/raw.c
-+++ b/net/ipv4/raw.c
-@@ -721,6 +721,7 @@ static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
- int ret = -EINVAL;
- int chk_addr_ret;
-
-+ lock_sock(sk);
- if (sk->sk_state != TCP_CLOSE || addr_len < sizeof(struct sockaddr_in))
- goto out;
-
-@@ -740,7 +741,9 @@ static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
- inet->inet_saddr = 0; /* Use device */
- sk_dst_reset(sk);
- ret = 0;
--out: return ret;
-+out:
-+ release_sock(sk);
-+ return ret;
- }
-
- /*
---
-2.34.1
-
+++ /dev/null
-From 2f1ad4d54c0ab45f543d913cf5ebb9056430333c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 26 Jan 2022 17:34:04 -0800
-Subject: ipv4: remove sparse error in ip_neigh_gw4()
-
-From: Eric Dumazet <edumazet@google.com>
-
-[ Upstream commit 3c42b2019863b327caa233072c50739d4144dd16 ]
-
-./include/net/route.h:373:48: warning: incorrect type in argument 2 (different base types)
-./include/net/route.h:373:48: expected unsigned int [usertype] key
-./include/net/route.h:373:48: got restricted __be32 [usertype] daddr
-
-Fixes: 5c9f7c1dfc2e ("ipv4: Add helpers for neigh lookup for nexthop")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Reviewed-by: David Ahern <dsahern@kernel.org>
-Link: https://lore.kernel.org/r/20220127013404.1279313-1-eric.dumazet@gmail.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/net/route.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/net/route.h b/include/net/route.h
-index 2e6c0e153e3a5..2551f3f03b37e 100644
---- a/include/net/route.h
-+++ b/include/net/route.h
-@@ -369,7 +369,7 @@ static inline struct neighbour *ip_neigh_gw4(struct net_device *dev,
- {
- struct neighbour *neigh;
-
-- neigh = __ipv4_neigh_lookup_noref(dev, daddr);
-+ neigh = __ipv4_neigh_lookup_noref(dev, (__force u32)daddr);
- if (unlikely(!neigh))
- neigh = __neigh_create(&arp_tbl, &daddr, dev, false);
-
---
-2.34.1
-
+++ /dev/null
-From abb13d51a34851d59167b049b5ede236e300336f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 26 Jan 2022 17:10:21 -0800
-Subject: ipv4: tcp: send zero IPID in SYNACK messages
-
-From: Eric Dumazet <edumazet@google.com>
-
-[ Upstream commit 970a5a3ea86da637471d3cd04d513a0755aba4bf ]
-
-In commit 431280eebed9 ("ipv4: tcp: send zero IPID for RST and
-ACK sent in SYN-RECV and TIME-WAIT state") we took care of some
-ctl packets sent by TCP.
-
-It turns out we need to use a similar strategy for SYNACK packets.
-
-By default, they carry IP_DF and IPID==0, but there are ways
-to ask them to use the hashed IP ident generator and thus
-be used to build off-path attacks.
-(Ref: Off-Path TCP Exploits of the Mixed IPID Assignment)
-
-One of this way is to force (before listener is started)
-echo 1 >/proc/sys/net/ipv4/ip_no_pmtu_disc
-
-Another way is using forged ICMP ICMP_FRAG_NEEDED
-with a very small MTU (like 68) to force a false return from
-ip_dont_fragment()
-
-In this patch, ip_build_and_send_pkt() uses the following
-heuristics.
-
-1) Most SYNACK packets are smaller than IPV4_MIN_MTU and therefore
-can use IP_DF regardless of the listener or route pmtu setting.
-
-2) In case the SYNACK packet is bigger than IPV4_MIN_MTU,
-we use prandom_u32() generator instead of the IPv4 hashed ident one.
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Reported-by: Ray Che <xijiache@gmail.com>
-Reviewed-by: David Ahern <dsahern@kernel.org>
-Cc: Geoff Alexander <alexandg@cs.unm.edu>
-Cc: Willy Tarreau <w@1wt.eu>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv4/ip_output.c | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
-index ff38b46bd4b0f..a4d2eb691cbc1 100644
---- a/net/ipv4/ip_output.c
-+++ b/net/ipv4/ip_output.c
-@@ -162,12 +162,19 @@ int ip_build_and_send_pkt(struct sk_buff *skb, const struct sock *sk,
- iph->daddr = (opt && opt->opt.srr ? opt->opt.faddr : daddr);
- iph->saddr = saddr;
- iph->protocol = sk->sk_protocol;
-- if (ip_dont_fragment(sk, &rt->dst)) {
-+ /* Do not bother generating IPID for small packets (eg SYNACK) */
-+ if (skb->len <= IPV4_MIN_MTU || ip_dont_fragment(sk, &rt->dst)) {
- iph->frag_off = htons(IP_DF);
- iph->id = 0;
- } else {
- iph->frag_off = 0;
-- __ip_select_ident(net, iph, 1);
-+ /* TCP packets here are SYNACK with fat IPv4/TCP options.
-+ * Avoid using the hashed IP ident generator.
-+ */
-+ if (sk->sk_protocol == IPPROTO_TCP)
-+ iph->id = (__force __be16)prandom_u32();
-+ else
-+ __ip_select_ident(net, iph, 1);
- }
-
- if (opt && opt->opt.optlen) {
---
-2.34.1
-
+++ /dev/null
-From a377f80c55051ac1928348798bdebe7d8ce8de8a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 20 Jan 2022 09:41:12 -0800
-Subject: ipv6: annotate accesses to fn->fn_sernum
-
-From: Eric Dumazet <edumazet@google.com>
-
-[ Upstream commit aafc2e3285c2d7a79b7ee15221c19fbeca7b1509 ]
-
-struct fib6_node's fn_sernum field can be
-read while other threads change it.
-
-Add READ_ONCE()/WRITE_ONCE() annotations.
-
-Do not change existing smp barriers in fib6_get_cookie_safe()
-and __fib6_update_sernum_upto_root()
-
-syzbot reported:
-
-BUG: KCSAN: data-race in fib6_clean_node / inet6_csk_route_socket
-
-write to 0xffff88813df62e2c of 4 bytes by task 1920 on cpu 1:
- fib6_clean_node+0xc2/0x260 net/ipv6/ip6_fib.c:2178
- fib6_walk_continue+0x38e/0x430 net/ipv6/ip6_fib.c:2112
- fib6_walk net/ipv6/ip6_fib.c:2160 [inline]
- fib6_clean_tree net/ipv6/ip6_fib.c:2240 [inline]
- __fib6_clean_all+0x1a9/0x2e0 net/ipv6/ip6_fib.c:2256
- fib6_flush_trees+0x6c/0x80 net/ipv6/ip6_fib.c:2281
- rt_genid_bump_ipv6 include/net/net_namespace.h:488 [inline]
- addrconf_dad_completed+0x57f/0x870 net/ipv6/addrconf.c:4230
- addrconf_dad_work+0x908/0x1170
- process_one_work+0x3f6/0x960 kernel/workqueue.c:2307
- worker_thread+0x616/0xa70 kernel/workqueue.c:2454
- kthread+0x1bf/0x1e0 kernel/kthread.c:359
- ret_from_fork+0x1f/0x30
-
-read to 0xffff88813df62e2c of 4 bytes by task 15701 on cpu 0:
- fib6_get_cookie_safe include/net/ip6_fib.h:285 [inline]
- rt6_get_cookie include/net/ip6_fib.h:306 [inline]
- ip6_dst_store include/net/ip6_route.h:234 [inline]
- inet6_csk_route_socket+0x352/0x3c0 net/ipv6/inet6_connection_sock.c:109
- inet6_csk_xmit+0x91/0x1e0 net/ipv6/inet6_connection_sock.c:121
- __tcp_transmit_skb+0x1323/0x1840 net/ipv4/tcp_output.c:1402
- tcp_transmit_skb net/ipv4/tcp_output.c:1420 [inline]
- tcp_write_xmit+0x1450/0x4460 net/ipv4/tcp_output.c:2680
- __tcp_push_pending_frames+0x68/0x1c0 net/ipv4/tcp_output.c:2864
- tcp_push+0x2d9/0x2f0 net/ipv4/tcp.c:725
- mptcp_push_release net/mptcp/protocol.c:1491 [inline]
- __mptcp_push_pending+0x46c/0x490 net/mptcp/protocol.c:1578
- mptcp_sendmsg+0x9ec/0xa50 net/mptcp/protocol.c:1764
- inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:643
- sock_sendmsg_nosec net/socket.c:705 [inline]
- sock_sendmsg net/socket.c:725 [inline]
- kernel_sendmsg+0x97/0xd0 net/socket.c:745
- sock_no_sendpage+0x84/0xb0 net/core/sock.c:3086
- inet_sendpage+0x9d/0xc0 net/ipv4/af_inet.c:834
- kernel_sendpage+0x187/0x200 net/socket.c:3492
- sock_sendpage+0x5a/0x70 net/socket.c:1007
- pipe_to_sendpage+0x128/0x160 fs/splice.c:364
- splice_from_pipe_feed fs/splice.c:418 [inline]
- __splice_from_pipe+0x207/0x500 fs/splice.c:562
- splice_from_pipe fs/splice.c:597 [inline]
- generic_splice_sendpage+0x94/0xd0 fs/splice.c:746
- do_splice_from fs/splice.c:767 [inline]
- direct_splice_actor+0x80/0xa0 fs/splice.c:936
- splice_direct_to_actor+0x345/0x650 fs/splice.c:891
- do_splice_direct+0x106/0x190 fs/splice.c:979
- do_sendfile+0x675/0xc40 fs/read_write.c:1245
- __do_sys_sendfile64 fs/read_write.c:1310 [inline]
- __se_sys_sendfile64 fs/read_write.c:1296 [inline]
- __x64_sys_sendfile64+0x102/0x140 fs/read_write.c:1296
- do_syscall_x64 arch/x86/entry/common.c:50 [inline]
- do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
- entry_SYSCALL_64_after_hwframe+0x44/0xae
-
-value changed: 0x0000026f -> 0x00000271
-
-Reported by Kernel Concurrency Sanitizer on:
-CPU: 0 PID: 15701 Comm: syz-executor.2 Not tainted 5.16.0-syzkaller #0
-Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
-
-The Fixes tag I chose is probably arbitrary, I do not think
-we need to backport this patch to older kernels.
-
-Fixes: c5cff8561d2d ("ipv6: add rcu grace period before freeing fib6_node")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Reported-by: syzbot <syzkaller@googlegroups.com>
-Link: https://lore.kernel.org/r/20220120174112.1126644-1-eric.dumazet@gmail.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/net/ip6_fib.h | 2 +-
- net/ipv6/ip6_fib.c | 23 +++++++++++++----------
- net/ipv6/route.c | 2 +-
- 3 files changed, 15 insertions(+), 12 deletions(-)
-
-diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
-index 83b8070d1cc93..c85b040728d7e 100644
---- a/include/net/ip6_fib.h
-+++ b/include/net/ip6_fib.h
-@@ -281,7 +281,7 @@ static inline bool fib6_get_cookie_safe(const struct fib6_info *f6i,
- fn = rcu_dereference(f6i->fib6_node);
-
- if (fn) {
-- *cookie = fn->fn_sernum;
-+ *cookie = READ_ONCE(fn->fn_sernum);
- /* pairs with smp_wmb() in __fib6_update_sernum_upto_root() */
- smp_rmb();
- status = true;
-diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
-index 0371d2c141455..a506e57c4032a 100644
---- a/net/ipv6/ip6_fib.c
-+++ b/net/ipv6/ip6_fib.c
-@@ -111,7 +111,7 @@ void fib6_update_sernum(struct net *net, struct fib6_info *f6i)
- fn = rcu_dereference_protected(f6i->fib6_node,
- lockdep_is_held(&f6i->fib6_table->tb6_lock));
- if (fn)
-- fn->fn_sernum = fib6_new_sernum(net);
-+ WRITE_ONCE(fn->fn_sernum, fib6_new_sernum(net));
- }
-
- /*
-@@ -589,12 +589,13 @@ static int fib6_dump_table(struct fib6_table *table, struct sk_buff *skb,
- spin_unlock_bh(&table->tb6_lock);
- if (res > 0) {
- cb->args[4] = 1;
-- cb->args[5] = w->root->fn_sernum;
-+ cb->args[5] = READ_ONCE(w->root->fn_sernum);
- }
- } else {
-- if (cb->args[5] != w->root->fn_sernum) {
-+ int sernum = READ_ONCE(w->root->fn_sernum);
-+ if (cb->args[5] != sernum) {
- /* Begin at the root if the tree changed */
-- cb->args[5] = w->root->fn_sernum;
-+ cb->args[5] = sernum;
- w->state = FWS_INIT;
- w->node = w->root;
- w->skip = w->count;
-@@ -1344,7 +1345,7 @@ static void __fib6_update_sernum_upto_root(struct fib6_info *rt,
- /* paired with smp_rmb() in fib6_get_cookie_safe() */
- smp_wmb();
- while (fn) {
-- fn->fn_sernum = sernum;
-+ WRITE_ONCE(fn->fn_sernum, sernum);
- fn = rcu_dereference_protected(fn->parent,
- lockdep_is_held(&rt->fib6_table->tb6_lock));
- }
-@@ -2173,8 +2174,8 @@ static int fib6_clean_node(struct fib6_walker *w)
- };
-
- if (c->sernum != FIB6_NO_SERNUM_CHANGE &&
-- w->node->fn_sernum != c->sernum)
-- w->node->fn_sernum = c->sernum;
-+ READ_ONCE(w->node->fn_sernum) != c->sernum)
-+ WRITE_ONCE(w->node->fn_sernum, c->sernum);
-
- if (!c->func) {
- WARN_ON_ONCE(c->sernum == FIB6_NO_SERNUM_CHANGE);
-@@ -2542,7 +2543,7 @@ static void ipv6_route_seq_setup_walk(struct ipv6_route_iter *iter,
- iter->w.state = FWS_INIT;
- iter->w.node = iter->w.root;
- iter->w.args = iter;
-- iter->sernum = iter->w.root->fn_sernum;
-+ iter->sernum = READ_ONCE(iter->w.root->fn_sernum);
- INIT_LIST_HEAD(&iter->w.lh);
- fib6_walker_link(net, &iter->w);
- }
-@@ -2570,8 +2571,10 @@ static struct fib6_table *ipv6_route_seq_next_table(struct fib6_table *tbl,
-
- static void ipv6_route_check_sernum(struct ipv6_route_iter *iter)
- {
-- if (iter->sernum != iter->w.root->fn_sernum) {
-- iter->sernum = iter->w.root->fn_sernum;
-+ int sernum = READ_ONCE(iter->w.root->fn_sernum);
-+
-+ if (iter->sernum != sernum) {
-+ iter->sernum = sernum;
- iter->w.state = FWS_INIT;
- iter->w.node = iter->w.root;
- WARN_ON(iter->w.skip);
-diff --git a/net/ipv6/route.c b/net/ipv6/route.c
-index 0632382a5427b..3c5bb49692206 100644
---- a/net/ipv6/route.c
-+++ b/net/ipv6/route.c
-@@ -2802,7 +2802,7 @@ static void ip6_link_failure(struct sk_buff *skb)
- if (from) {
- fn = rcu_dereference(from->fib6_node);
- if (fn && (rt->rt6i_flags & RTF_DEFAULT))
-- fn->fn_sernum = -1;
-+ WRITE_ONCE(fn->fn_sernum, -1);
- }
- }
- rcu_read_unlock();
---
-2.34.1
-
+++ /dev/null
-From fcba6a4cfabbcec46e4042b7967a3c14cdaf690b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 20 Jan 2022 10:05:46 +0200
-Subject: ipv6_tunnel: Rate limit warning messages
-
-From: Ido Schimmel <idosch@nvidia.com>
-
-[ Upstream commit 6cee105e7f2ced596373951d9ea08dacc3883c68 ]
-
-The warning messages can be invoked from the data path for every packet
-transmitted through an ip6gre netdev, leading to high CPU utilization.
-
-Fix that by rate limiting the messages.
-
-Fixes: 09c6bbf090ec ("[IPV6]: Do mandatory IPv6 tunnel endpoint checks in realtime")
-Reported-by: Maksym Yaremchuk <maksymy@nvidia.com>
-Tested-by: Maksym Yaremchuk <maksymy@nvidia.com>
-Signed-off-by: Ido Schimmel <idosch@nvidia.com>
-Reviewed-by: Amit Cohen <amcohen@nvidia.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/ip6_tunnel.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
-index 20a67efda47f5..fa8da8ff35b42 100644
---- a/net/ipv6/ip6_tunnel.c
-+++ b/net/ipv6/ip6_tunnel.c
-@@ -1036,14 +1036,14 @@ int ip6_tnl_xmit_ctl(struct ip6_tnl *t,
-
- if (unlikely(!ipv6_chk_addr_and_flags(net, laddr, ldev, false,
- 0, IFA_F_TENTATIVE)))
-- pr_warn("%s xmit: Local address not yet configured!\n",
-- p->name);
-+ pr_warn_ratelimited("%s xmit: Local address not yet configured!\n",
-+ p->name);
- else if (!(p->flags & IP6_TNL_F_ALLOW_LOCAL_REMOTE) &&
- !ipv6_addr_is_multicast(raddr) &&
- unlikely(ipv6_chk_addr_and_flags(net, raddr, ldev,
- true, 0, IFA_F_TENTATIVE)))
-- pr_warn("%s xmit: Routing loop! Remote address found on this node!\n",
-- p->name);
-+ pr_warn_ratelimited("%s xmit: Routing loop! Remote address found on this node!\n",
-+ p->name);
- else
- ret = 1;
- rcu_read_unlock();
---
-2.34.1
-
+++ /dev/null
-From 41765f8db2c68d1a74aa3fb495b8411b596046ab Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 14 Jan 2022 08:57:58 +0000
-Subject: KVM: arm64: pkvm: Use the mm_ops indirection for cache maintenance
-
-From: Marc Zyngier <maz@kernel.org>
-
-[ Upstream commit 094d00f8ca58c5d29b25e23b4daaed1ff1f13b41 ]
-
-CMOs issued from EL2 cannot directly use the kernel helpers,
-as EL2 doesn't have a mapping of the guest pages. Oops.
-
-Instead, use the mm_ops indirection to use helpers that will
-perform a mapping at EL2 and allow the CMO to be effective.
-
-Fixes: 25aa28691bb9 ("KVM: arm64: Move guest CMOs to the fault handlers")
-Reviewed-by: Quentin Perret <qperret@google.com>
-Signed-off-by: Marc Zyngier <maz@kernel.org>
-Link: https://lore.kernel.org/r/20220114125038.1336965-1-maz@kernel.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm64/kvm/hyp/pgtable.c | 18 ++++++------------
- 1 file changed, 6 insertions(+), 12 deletions(-)
-
-diff --git a/arch/arm64/kvm/hyp/pgtable.c b/arch/arm64/kvm/hyp/pgtable.c
-index f8ceebe4982eb..4c77ff556f0ae 100644
---- a/arch/arm64/kvm/hyp/pgtable.c
-+++ b/arch/arm64/kvm/hyp/pgtable.c
-@@ -921,13 +921,9 @@ static int stage2_unmap_walker(u64 addr, u64 end, u32 level, kvm_pte_t *ptep,
- */
- stage2_put_pte(ptep, mmu, addr, level, mm_ops);
-
-- if (need_flush) {
-- kvm_pte_t *pte_follow = kvm_pte_follow(pte, mm_ops);
--
-- dcache_clean_inval_poc((unsigned long)pte_follow,
-- (unsigned long)pte_follow +
-- kvm_granule_size(level));
-- }
-+ if (need_flush && mm_ops->dcache_clean_inval_poc)
-+ mm_ops->dcache_clean_inval_poc(kvm_pte_follow(pte, mm_ops),
-+ kvm_granule_size(level));
-
- if (childp)
- mm_ops->put_page(childp);
-@@ -1089,15 +1085,13 @@ static int stage2_flush_walker(u64 addr, u64 end, u32 level, kvm_pte_t *ptep,
- struct kvm_pgtable *pgt = arg;
- struct kvm_pgtable_mm_ops *mm_ops = pgt->mm_ops;
- kvm_pte_t pte = *ptep;
-- kvm_pte_t *pte_follow;
-
- if (!kvm_pte_valid(pte) || !stage2_pte_cacheable(pgt, pte))
- return 0;
-
-- pte_follow = kvm_pte_follow(pte, mm_ops);
-- dcache_clean_inval_poc((unsigned long)pte_follow,
-- (unsigned long)pte_follow +
-- kvm_granule_size(level));
-+ if (mm_ops->dcache_clean_inval_poc)
-+ mm_ops->dcache_clean_inval_poc(kvm_pte_follow(pte, mm_ops),
-+ kvm_granule_size(level));
- return 0;
- }
-
---
-2.34.1
-
+++ /dev/null
-From 7b713d1564ff5e689384ebc1786921b365f76215 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 25 Jan 2022 22:17:25 +0000
-Subject: KVM: selftests: Don't skip L2's VMCALL in SMM test for SVM guest
-
-From: Sean Christopherson <seanjc@google.com>
-
-[ Upstream commit 4cf3d3ebe8794c449af3e0e8c1d790c97e461d20 ]
-
-Don't skip the vmcall() in l2_guest_code() prior to re-entering L2, doing
-so will result in L2 running to completion, popping '0' off the stack for
-RET, jumping to address '0', and ultimately dying with a triple fault
-shutdown.
-
-It's not at all obvious why the test re-enters L2 and re-executes VMCALL,
-but presumably it serves a purpose. The VMX path doesn't skip vmcall(),
-and the test can't possibly have passed on SVM, so just do what VMX does.
-
-Fixes: d951b2210c1a ("KVM: selftests: smm_test: Test SMM enter from L2")
-Cc: Maxim Levitsky <mlevitsk@redhat.com>
-Signed-off-by: Sean Christopherson <seanjc@google.com>
-Message-Id: <20220125221725.2101126-1-seanjc@google.com>
-Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
-Tested-by: Vitaly Kuznetsov <vkuznets@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/testing/selftests/kvm/x86_64/smm_test.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/tools/testing/selftests/kvm/x86_64/smm_test.c b/tools/testing/selftests/kvm/x86_64/smm_test.c
-index d0fe2fdce58c4..db2a17559c3d5 100644
---- a/tools/testing/selftests/kvm/x86_64/smm_test.c
-+++ b/tools/testing/selftests/kvm/x86_64/smm_test.c
-@@ -105,7 +105,6 @@ static void guest_code(void *arg)
-
- if (cpu_has_svm()) {
- run_guest(svm->vmcb, svm->vmcb_gpa);
-- svm->vmcb->save.rip += 3;
- run_guest(svm->vmcb, svm->vmcb_gpa);
- } else {
- vmlaunch();
---
-2.34.1
-
+++ /dev/null
-From 2963809f8d48c2726da96f52457b92f3c68f4e29 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 3 Dec 2021 14:35:36 -0800
-Subject: mptcp: allow changing the "backup" bit by endpoint id
-
-From: Davide Caratti <dcaratti@redhat.com>
-
-[ Upstream commit 602837e8479d20d49559b4b97b79d34c0efe7ecb ]
-
-a non-zero 'id' is sufficient to identify MPTCP endpoints: allow changing
-the value of 'backup' bit by simply specifying the endpoint id.
-
-Link: https://github.com/multipath-tcp/mptcp_net-next/issues/158
-Signed-off-by: Davide Caratti <dcaratti@redhat.com>
-Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/mptcp/pm_netlink.c | 14 ++++++++++----
- 1 file changed, 10 insertions(+), 4 deletions(-)
-
-diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c
-index d96860053816a..3be10bf22cf7c 100644
---- a/net/mptcp/pm_netlink.c
-+++ b/net/mptcp/pm_netlink.c
-@@ -1711,22 +1711,28 @@ next:
-
- static int mptcp_nl_cmd_set_flags(struct sk_buff *skb, struct genl_info *info)
- {
-+ struct mptcp_pm_addr_entry addr = { .addr = { .family = AF_UNSPEC }, }, *entry;
- struct nlattr *attr = info->attrs[MPTCP_PM_ATTR_ADDR];
- struct pm_nl_pernet *pernet = genl_info_pm_nl(info);
-- struct mptcp_pm_addr_entry addr, *entry;
- struct net *net = sock_net(skb->sk);
-- u8 bkup = 0;
-+ u8 bkup = 0, lookup_by_id = 0;
- int ret;
-
-- ret = mptcp_pm_parse_addr(attr, info, true, &addr);
-+ ret = mptcp_pm_parse_addr(attr, info, false, &addr);
- if (ret < 0)
- return ret;
-
- if (addr.flags & MPTCP_PM_ADDR_FLAG_BACKUP)
- bkup = 1;
-+ if (addr.addr.family == AF_UNSPEC) {
-+ lookup_by_id = 1;
-+ if (!addr.addr.id)
-+ return -EOPNOTSUPP;
-+ }
-
- list_for_each_entry(entry, &pernet->local_addr_list, list) {
-- if (addresses_equal(&entry->addr, &addr.addr, true)) {
-+ if ((!lookup_by_id && addresses_equal(&entry->addr, &addr.addr, true)) ||
-+ (lookup_by_id && entry->addr.id == addr.addr.id)) {
- mptcp_nl_addr_backup(net, &entry->addr, bkup);
-
- if (bkup)
---
-2.34.1
-
+++ /dev/null
-From 7e75809ad07ed61a034452901fccb24f7f30d974 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 17 Dec 2021 15:37:02 -0800
-Subject: mptcp: clean up harmless false expressions
-
-From: Jean Sacren <sakiwit@gmail.com>
-
-[ Upstream commit 59060a47ca50bbdb1d863b73667a1065873ecc06 ]
-
-entry->addr.id is u8 with a range from 0 to 255 and MAX_ADDR_ID is 255.
-We should drop both false expressions of (entry->addr.id > MAX_ADDR_ID).
-
-We should also remove the obsolete parentheses in the first if branch.
-
-Use U8_MAX for MAX_ADDR_ID and add a comment to show the link to
-mptcp_addr_info.id as suggested by Mr. Matthieu Baerts.
-
-Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
-Signed-off-by: Jean Sacren <sakiwit@gmail.com>
-Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/mptcp/pm_netlink.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c
-index 3be10bf22cf7c..15c89d4fea4d2 100644
---- a/net/mptcp/pm_netlink.c
-+++ b/net/mptcp/pm_netlink.c
-@@ -38,7 +38,8 @@ struct mptcp_pm_add_entry {
- u8 retrans_times;
- };
-
--#define MAX_ADDR_ID 255
-+/* max value of mptcp_addr_info.id */
-+#define MAX_ADDR_ID U8_MAX
- #define BITMAP_SZ DIV_ROUND_UP(MAX_ADDR_ID + 1, BITS_PER_LONG)
-
- struct pm_nl_pernet {
-@@ -831,14 +832,13 @@ find_next:
- entry->addr.id = find_next_zero_bit(pernet->id_bitmap,
- MAX_ADDR_ID + 1,
- pernet->next_id);
-- if ((!entry->addr.id || entry->addr.id > MAX_ADDR_ID) &&
-- pernet->next_id != 1) {
-+ if (!entry->addr.id && pernet->next_id != 1) {
- pernet->next_id = 1;
- goto find_next;
- }
- }
-
-- if (!entry->addr.id || entry->addr.id > MAX_ADDR_ID)
-+ if (!entry->addr.id)
- goto out;
-
- __set_bit(entry->addr.id, pernet->id_bitmap);
---
-2.34.1
-
+++ /dev/null
-From 9c445865282ef2627077e4847dd29b5a59c4bd9f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 20 Jan 2022 16:35:27 -0800
-Subject: mptcp: fix msk traversal in mptcp_nl_cmd_set_flags()
-
-From: Paolo Abeni <pabeni@redhat.com>
-
-[ Upstream commit 8e9eacad7ec7a9cbf262649ebf1fa6e6f6cc7d82 ]
-
-The MPTCP endpoint list is under RCU protection, guarded by the
-pernet spinlock. mptcp_nl_cmd_set_flags() traverses the list
-without acquiring the spin-lock nor under the RCU critical section.
-
-This change addresses the issue performing the lookup and the endpoint
-update under the pernet spinlock.
-
-Fixes: 0f9f696a502e ("mptcp: add set_flags command in PM netlink")
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/mptcp/pm_netlink.c | 37 +++++++++++++++++++++++++++----------
- 1 file changed, 27 insertions(+), 10 deletions(-)
-
-diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c
-index bba166ddacc78..7f11eb3e35137 100644
---- a/net/mptcp/pm_netlink.c
-+++ b/net/mptcp/pm_netlink.c
-@@ -469,6 +469,20 @@ __lookup_addr_by_id(struct pm_nl_pernet *pernet, unsigned int id)
- return NULL;
- }
-
-+static struct mptcp_pm_addr_entry *
-+__lookup_addr(struct pm_nl_pernet *pernet, const struct mptcp_addr_info *info,
-+ bool lookup_by_id)
-+{
-+ struct mptcp_pm_addr_entry *entry;
-+
-+ list_for_each_entry(entry, &pernet->local_addr_list, list) {
-+ if ((!lookup_by_id && addresses_equal(&entry->addr, info, true)) ||
-+ (lookup_by_id && entry->addr.id == info->id))
-+ return entry;
-+ }
-+ return NULL;
-+}
-+
- static int
- lookup_id_by_addr(struct pm_nl_pernet *pernet, const struct mptcp_addr_info *addr)
- {
-@@ -1753,18 +1767,21 @@ static int mptcp_nl_cmd_set_flags(struct sk_buff *skb, struct genl_info *info)
- return -EOPNOTSUPP;
- }
-
-- list_for_each_entry(entry, &pernet->local_addr_list, list) {
-- if ((!lookup_by_id && addresses_equal(&entry->addr, &addr.addr, true)) ||
-- (lookup_by_id && entry->addr.id == addr.addr.id)) {
-- mptcp_nl_addr_backup(net, &entry->addr, bkup);
--
-- if (bkup)
-- entry->flags |= MPTCP_PM_ADDR_FLAG_BACKUP;
-- else
-- entry->flags &= ~MPTCP_PM_ADDR_FLAG_BACKUP;
-- }
-+ spin_lock_bh(&pernet->lock);
-+ entry = __lookup_addr(pernet, &addr.addr, lookup_by_id);
-+ if (!entry) {
-+ spin_unlock_bh(&pernet->lock);
-+ return -EINVAL;
- }
-
-+ if (bkup)
-+ entry->flags |= MPTCP_PM_ADDR_FLAG_BACKUP;
-+ else
-+ entry->flags &= ~MPTCP_PM_ADDR_FLAG_BACKUP;
-+ addr = *entry;
-+ spin_unlock_bh(&pernet->lock);
-+
-+ mptcp_nl_addr_backup(net, &addr.addr, bkup);
- return 0;
- }
-
---
-2.34.1
-
+++ /dev/null
-From 43c052f4d79be30e5443649f7586de9d91e69de1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 20 Jan 2022 16:35:28 -0800
-Subject: mptcp: fix removing ids bitmap setting
-
-From: Geliang Tang <geliang.tang@suse.com>
-
-[ Upstream commit a4c0214fbee97c46e3f41fee37931d66c0fc3cb1 ]
-
-In mptcp_pm_nl_rm_addr_or_subflow(), the bit of rm_list->ids[i] in the
-id_avail_bitmap should be set, not rm_list->ids[1]. This patch fixed it.
-
-Fixes: 86e39e04482b ("mptcp: keep track of local endpoint still available for each msk")
-Acked-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Geliang Tang <geliang.tang@suse.com>
-Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/mptcp/pm_netlink.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c
-index 7f11eb3e35137..84e6b55375e1d 100644
---- a/net/mptcp/pm_netlink.c
-+++ b/net/mptcp/pm_netlink.c
-@@ -781,7 +781,7 @@ static void mptcp_pm_nl_rm_addr_or_subflow(struct mptcp_sock *msk,
- msk->pm.subflows--;
- __MPTCP_INC_STATS(sock_net(sk), rm_type);
- }
-- __set_bit(rm_list->ids[1], msk->pm.id_avail_bitmap);
-+ __set_bit(rm_list->ids[i], msk->pm.id_avail_bitmap);
- if (!removed)
- continue;
-
---
-2.34.1
-
+++ /dev/null
-From 2c3e722a8a559b27f90137d43434103df2f5530a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jan 2022 16:20:22 -0800
-Subject: mptcp: keep track of local endpoint still available for each msk
-
-From: Paolo Abeni <pabeni@redhat.com>
-
-[ Upstream commit 86e39e04482b0aadf3ee3ed5fcf2d63816559d36 ]
-
-Include into the path manager status a bitmap tracking the list
-of local endpoints still available - not yet used - for the
-relevant mptcp socket.
-
-Keep such map updated at endpoint creation/deletion time, so
-that we can easily skip already used endpoint at local address
-selection time.
-
-The endpoint used by the initial subflow is lazyly accounted at
-subflow creation time: the usage bitmap is be up2date before
-endpoint selection and we avoid such unneeded task in some relevant
-scenarios - e.g. busy servers accepting incoming subflows but
-not creating any additional ones nor annuncing additional addresses.
-
-Overall this allows for fair local endpoints usage in case of
-subflow failure.
-
-As a side effect, this patch also enforces that each endpoint
-is used at most once for each mptcp connection.
-
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/mptcp/pm.c | 1 +
- net/mptcp/pm_netlink.c | 125 +++++++++++-------
- net/mptcp/protocol.c | 3 +-
- net/mptcp/protocol.h | 12 +-
- .../testing/selftests/net/mptcp/mptcp_join.sh | 5 +-
- 5 files changed, 91 insertions(+), 55 deletions(-)
-
-diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c
-index 6ab386ff32944..332ac6eda3ba4 100644
---- a/net/mptcp/pm.c
-+++ b/net/mptcp/pm.c
-@@ -370,6 +370,7 @@ void mptcp_pm_data_init(struct mptcp_sock *msk)
- WRITE_ONCE(msk->pm.accept_subflow, false);
- WRITE_ONCE(msk->pm.remote_deny_join_id0, false);
- msk->pm.status = 0;
-+ bitmap_fill(msk->pm.id_avail_bitmap, MPTCP_PM_MAX_ADDR_ID + 1);
-
- spin_lock_init(&msk->pm.lock);
- INIT_LIST_HEAD(&msk->pm.anno_list);
-diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c
-index 15c89d4fea4d2..bba166ddacc78 100644
---- a/net/mptcp/pm_netlink.c
-+++ b/net/mptcp/pm_netlink.c
-@@ -38,10 +38,6 @@ struct mptcp_pm_add_entry {
- u8 retrans_times;
- };
-
--/* max value of mptcp_addr_info.id */
--#define MAX_ADDR_ID U8_MAX
--#define BITMAP_SZ DIV_ROUND_UP(MAX_ADDR_ID + 1, BITS_PER_LONG)
--
- struct pm_nl_pernet {
- /* protects pernet updates */
- spinlock_t lock;
-@@ -53,14 +49,14 @@ struct pm_nl_pernet {
- unsigned int local_addr_max;
- unsigned int subflows_max;
- unsigned int next_id;
-- unsigned long id_bitmap[BITMAP_SZ];
-+ DECLARE_BITMAP(id_bitmap, MPTCP_PM_MAX_ADDR_ID + 1);
- };
-
- #define MPTCP_PM_ADDR_MAX 8
- #define ADD_ADDR_RETRANS_MAX 3
-
- static bool addresses_equal(const struct mptcp_addr_info *a,
-- struct mptcp_addr_info *b, bool use_port)
-+ const struct mptcp_addr_info *b, bool use_port)
- {
- bool addr_equals = false;
-
-@@ -174,6 +170,9 @@ select_local_address(const struct pm_nl_pernet *pernet,
- if (!(entry->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW))
- continue;
-
-+ if (!test_bit(entry->addr.id, msk->pm.id_avail_bitmap))
-+ continue;
-+
- if (entry->addr.family != sk->sk_family) {
- #if IS_ENABLED(CONFIG_MPTCP_IPV6)
- if ((entry->addr.family == AF_INET &&
-@@ -184,23 +183,17 @@ select_local_address(const struct pm_nl_pernet *pernet,
- continue;
- }
-
-- /* avoid any address already in use by subflows and
-- * pending join
-- */
-- if (!lookup_subflow_by_saddr(&msk->conn_list, &entry->addr)) {
-- ret = entry;
-- break;
-- }
-+ ret = entry;
-+ break;
- }
- rcu_read_unlock();
- return ret;
- }
-
- static struct mptcp_pm_addr_entry *
--select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos)
-+select_signal_address(struct pm_nl_pernet *pernet, struct mptcp_sock *msk)
- {
- struct mptcp_pm_addr_entry *entry, *ret = NULL;
-- int i = 0;
-
- rcu_read_lock();
- /* do not keep any additional per socket state, just signal
-@@ -209,12 +202,14 @@ select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos)
- * can lead to additional addresses not being announced.
- */
- list_for_each_entry_rcu(entry, &pernet->local_addr_list, list) {
-+ if (!test_bit(entry->addr.id, msk->pm.id_avail_bitmap))
-+ continue;
-+
- if (!(entry->flags & MPTCP_PM_ADDR_FLAG_SIGNAL))
- continue;
-- if (i++ == pos) {
-- ret = entry;
-- break;
-- }
-+
-+ ret = entry;
-+ break;
- }
- rcu_read_unlock();
- return ret;
-@@ -258,9 +253,11 @@ EXPORT_SYMBOL_GPL(mptcp_pm_get_local_addr_max);
-
- static void check_work_pending(struct mptcp_sock *msk)
- {
-- if (msk->pm.add_addr_signaled == mptcp_pm_get_add_addr_signal_max(msk) &&
-- (msk->pm.local_addr_used == mptcp_pm_get_local_addr_max(msk) ||
-- msk->pm.subflows == mptcp_pm_get_subflows_max(msk)))
-+ struct pm_nl_pernet *pernet = net_generic(sock_net((struct sock *)msk), pm_nl_pernet_id);
-+
-+ if (msk->pm.subflows == mptcp_pm_get_subflows_max(msk) ||
-+ (find_next_and_bit(pernet->id_bitmap, msk->pm.id_avail_bitmap,
-+ MPTCP_PM_MAX_ADDR_ID + 1, 0) == MPTCP_PM_MAX_ADDR_ID + 1))
- WRITE_ONCE(msk->pm.work_pending, false);
- }
-
-@@ -460,6 +457,35 @@ static unsigned int fill_remote_addresses_vec(struct mptcp_sock *msk, bool fullm
- return i;
- }
-
-+static struct mptcp_pm_addr_entry *
-+__lookup_addr_by_id(struct pm_nl_pernet *pernet, unsigned int id)
-+{
-+ struct mptcp_pm_addr_entry *entry;
-+
-+ list_for_each_entry(entry, &pernet->local_addr_list, list) {
-+ if (entry->addr.id == id)
-+ return entry;
-+ }
-+ return NULL;
-+}
-+
-+static int
-+lookup_id_by_addr(struct pm_nl_pernet *pernet, const struct mptcp_addr_info *addr)
-+{
-+ struct mptcp_pm_addr_entry *entry;
-+ int ret = -1;
-+
-+ rcu_read_lock();
-+ list_for_each_entry(entry, &pernet->local_addr_list, list) {
-+ if (addresses_equal(&entry->addr, addr, entry->addr.port)) {
-+ ret = entry->addr.id;
-+ break;
-+ }
-+ }
-+ rcu_read_unlock();
-+ return ret;
-+}
-+
- static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk)
- {
- struct sock *sk = (struct sock *)msk;
-@@ -475,6 +501,19 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk)
- local_addr_max = mptcp_pm_get_local_addr_max(msk);
- subflows_max = mptcp_pm_get_subflows_max(msk);
-
-+ /* do lazy endpoint usage accounting for the MPC subflows */
-+ if (unlikely(!(msk->pm.status & BIT(MPTCP_PM_MPC_ENDPOINT_ACCOUNTED))) && msk->first) {
-+ struct mptcp_addr_info local;
-+ int mpc_id;
-+
-+ local_address((struct sock_common *)msk->first, &local);
-+ mpc_id = lookup_id_by_addr(pernet, &local);
-+ if (mpc_id < 0)
-+ __clear_bit(mpc_id, msk->pm.id_avail_bitmap);
-+
-+ msk->pm.status |= BIT(MPTCP_PM_MPC_ENDPOINT_ACCOUNTED);
-+ }
-+
- pr_debug("local %d:%d signal %d:%d subflows %d:%d\n",
- msk->pm.local_addr_used, local_addr_max,
- msk->pm.add_addr_signaled, add_addr_signal_max,
-@@ -482,21 +521,16 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk)
-
- /* check first for announce */
- if (msk->pm.add_addr_signaled < add_addr_signal_max) {
-- local = select_signal_address(pernet,
-- msk->pm.add_addr_signaled);
-+ local = select_signal_address(pernet, msk);
-
- if (local) {
- if (mptcp_pm_alloc_anno_list(msk, local)) {
-+ __clear_bit(local->addr.id, msk->pm.id_avail_bitmap);
- msk->pm.add_addr_signaled++;
- mptcp_pm_announce_addr(msk, &local->addr, false);
- mptcp_pm_nl_addr_send_ack(msk);
- }
-- } else {
-- /* pick failed, avoid fourther attempts later */
-- msk->pm.local_addr_used = add_addr_signal_max;
- }
--
-- check_work_pending(msk);
- }
-
- /* check if should create a new subflow */
-@@ -510,19 +544,16 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk)
- int i, nr;
-
- msk->pm.local_addr_used++;
-- check_work_pending(msk);
- nr = fill_remote_addresses_vec(msk, fullmesh, addrs);
-+ if (nr)
-+ __clear_bit(local->addr.id, msk->pm.id_avail_bitmap);
- spin_unlock_bh(&msk->pm.lock);
- for (i = 0; i < nr; i++)
- __mptcp_subflow_connect(sk, &local->addr, &addrs[i]);
- spin_lock_bh(&msk->pm.lock);
-- return;
- }
--
-- /* lookup failed, avoid fourther attempts later */
-- msk->pm.local_addr_used = local_addr_max;
-- check_work_pending(msk);
- }
-+ check_work_pending(msk);
- }
-
- static void mptcp_pm_nl_fully_established(struct mptcp_sock *msk)
-@@ -736,6 +767,7 @@ static void mptcp_pm_nl_rm_addr_or_subflow(struct mptcp_sock *msk,
- msk->pm.subflows--;
- __MPTCP_INC_STATS(sock_net(sk), rm_type);
- }
-+ __set_bit(rm_list->ids[1], msk->pm.id_avail_bitmap);
- if (!removed)
- continue;
-
-@@ -765,6 +797,9 @@ void mptcp_pm_nl_work(struct mptcp_sock *msk)
-
- msk_owned_by_me(msk);
-
-+ if (!(pm->status & MPTCP_PM_WORK_MASK))
-+ return;
-+
- spin_lock_bh(&msk->pm.lock);
-
- pr_debug("msk=%p status=%x", msk, pm->status);
-@@ -810,7 +845,7 @@ static int mptcp_pm_nl_append_new_local_addr(struct pm_nl_pernet *pernet,
- /* to keep the code simple, don't do IDR-like allocation for address ID,
- * just bail when we exceed limits
- */
-- if (pernet->next_id == MAX_ADDR_ID)
-+ if (pernet->next_id == MPTCP_PM_MAX_ADDR_ID)
- pernet->next_id = 1;
- if (pernet->addrs >= MPTCP_PM_ADDR_MAX)
- goto out;
-@@ -830,7 +865,7 @@ static int mptcp_pm_nl_append_new_local_addr(struct pm_nl_pernet *pernet,
- if (!entry->addr.id) {
- find_next:
- entry->addr.id = find_next_zero_bit(pernet->id_bitmap,
-- MAX_ADDR_ID + 1,
-+ MPTCP_PM_MAX_ADDR_ID + 1,
- pernet->next_id);
- if (!entry->addr.id && pernet->next_id != 1) {
- pernet->next_id = 1;
-@@ -1197,18 +1232,6 @@ static int mptcp_nl_cmd_add_addr(struct sk_buff *skb, struct genl_info *info)
- return 0;
- }
-
--static struct mptcp_pm_addr_entry *
--__lookup_addr_by_id(struct pm_nl_pernet *pernet, unsigned int id)
--{
-- struct mptcp_pm_addr_entry *entry;
--
-- list_for_each_entry(entry, &pernet->local_addr_list, list) {
-- if (entry->addr.id == id)
-- return entry;
-- }
-- return NULL;
--}
--
- int mptcp_pm_get_flags_and_ifindex_by_id(struct net *net, unsigned int id,
- u8 *flags, int *ifindex)
- {
-@@ -1467,7 +1490,7 @@ static int mptcp_nl_cmd_flush_addrs(struct sk_buff *skb, struct genl_info *info)
- list_splice_init(&pernet->local_addr_list, &free_list);
- __reset_counters(pernet);
- pernet->next_id = 1;
-- bitmap_zero(pernet->id_bitmap, MAX_ADDR_ID + 1);
-+ bitmap_zero(pernet->id_bitmap, MPTCP_PM_MAX_ADDR_ID + 1);
- spin_unlock_bh(&pernet->lock);
- mptcp_nl_remove_addrs_list(sock_net(skb->sk), &free_list);
- synchronize_rcu();
-@@ -1577,7 +1600,7 @@ static int mptcp_nl_cmd_dump_addrs(struct sk_buff *msg,
- pernet = net_generic(net, pm_nl_pernet_id);
-
- spin_lock_bh(&pernet->lock);
-- for (i = id; i < MAX_ADDR_ID + 1; i++) {
-+ for (i = id; i < MPTCP_PM_MAX_ADDR_ID + 1; i++) {
- if (test_bit(i, pernet->id_bitmap)) {
- entry = __lookup_addr_by_id(pernet, i);
- if (!entry)
-diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
-index 4c889552cde77..354f169ca120a 100644
---- a/net/mptcp/protocol.c
-+++ b/net/mptcp/protocol.c
-@@ -2435,8 +2435,7 @@ static void mptcp_worker(struct work_struct *work)
-
- mptcp_check_fastclose(msk);
-
-- if (msk->pm.status)
-- mptcp_pm_nl_work(msk);
-+ mptcp_pm_nl_work(msk);
-
- if (test_and_clear_bit(MPTCP_WORK_EOF, &msk->flags))
- mptcp_check_for_eof(msk);
-diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
-index 82c5dc4d6b49d..9fc6f494075fa 100644
---- a/net/mptcp/protocol.h
-+++ b/net/mptcp/protocol.h
-@@ -174,16 +174,25 @@ enum mptcp_pm_status {
- MPTCP_PM_ADD_ADDR_SEND_ACK,
- MPTCP_PM_RM_ADDR_RECEIVED,
- MPTCP_PM_ESTABLISHED,
-- MPTCP_PM_ALREADY_ESTABLISHED, /* persistent status, set after ESTABLISHED event */
- MPTCP_PM_SUBFLOW_ESTABLISHED,
-+ MPTCP_PM_ALREADY_ESTABLISHED, /* persistent status, set after ESTABLISHED event */
-+ MPTCP_PM_MPC_ENDPOINT_ACCOUNTED /* persistent status, set after MPC local address is
-+ * accounted int id_avail_bitmap
-+ */
- };
-
-+/* Status bits below MPTCP_PM_ALREADY_ESTABLISHED need pm worker actions */
-+#define MPTCP_PM_WORK_MASK ((1 << MPTCP_PM_ALREADY_ESTABLISHED) - 1)
-+
- enum mptcp_addr_signal_status {
- MPTCP_ADD_ADDR_SIGNAL,
- MPTCP_ADD_ADDR_ECHO,
- MPTCP_RM_ADDR_SIGNAL,
- };
-
-+/* max value of mptcp_addr_info.id */
-+#define MPTCP_PM_MAX_ADDR_ID U8_MAX
-+
- struct mptcp_pm_data {
- struct mptcp_addr_info local;
- struct mptcp_addr_info remote;
-@@ -202,6 +211,7 @@ struct mptcp_pm_data {
- u8 local_addr_used;
- u8 subflows;
- u8 status;
-+ DECLARE_BITMAP(id_avail_bitmap, MPTCP_PM_MAX_ADDR_ID + 1);
- struct mptcp_rm_list rm_list_tx;
- struct mptcp_rm_list rm_list_rx;
- };
-diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
-index 586af88194e56..0c12602fa22e8 100755
---- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
-+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
-@@ -1068,7 +1068,10 @@ signal_address_tests()
- ip netns exec $ns2 ./pm_nl_ctl add 10.0.3.2 flags signal
- ip netns exec $ns2 ./pm_nl_ctl add 10.0.4.2 flags signal
- run_tests $ns1 $ns2 10.0.1.1
-- chk_add_nr 4 4
-+
-+ # the server will not signal the address terminating
-+ # the MPC subflow
-+ chk_add_nr 3 3
- }
-
- link_failure_tests()
---
-2.34.1
-
+++ /dev/null
-From 4f1a950f2fa11ae67688bd38151e7fb7382762c7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 27 Jan 2022 15:49:53 +0800
-Subject: net: bridge: vlan: fix memory leak in __allowed_ingress
-
-From: Tim Yi <tim.yi@pica8.com>
-
-[ Upstream commit fd20d9738395cf8e27d0a17eba34169699fccdff ]
-
-When using per-vlan state, if vlan snooping and stats are disabled,
-untagged or priority-tagged ingress frame will go to check pvid state.
-If the port state is forwarding and the pvid state is not
-learning/forwarding, untagged or priority-tagged frame will be dropped
-but skb memory is not freed.
-Should free skb when __allowed_ingress returns false.
-
-Fixes: a580c76d534c ("net: bridge: vlan: add per-vlan state")
-Signed-off-by: Tim Yi <tim.yi@pica8.com>
-Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
-Link: https://lore.kernel.org/r/20220127074953.12632-1-tim.yi@pica8.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/bridge/br_vlan.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
-index 06f5caee495aa..10e63ea6a13e1 100644
---- a/net/bridge/br_vlan.c
-+++ b/net/bridge/br_vlan.c
-@@ -560,10 +560,10 @@ static bool __allowed_ingress(const struct net_bridge *br,
- !br_opt_get(br, BROPT_VLAN_STATS_ENABLED)) {
- if (*state == BR_STATE_FORWARDING) {
- *state = br_vlan_get_pvid_state(vg);
-- return br_vlan_state_allowed(*state, true);
-- } else {
-- return true;
-+ if (!br_vlan_state_allowed(*state, true))
-+ goto drop;
- }
-+ return true;
- }
- }
- v = br_vlan_find(vg, *vid);
---
-2.34.1
-
+++ /dev/null
-From 113191f457d0b915e78f2f0400552adc3eea4ad4 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 26 Jan 2022 15:10:25 +0200
-Subject: net: bridge: vlan: fix single net device option dumping
-
-From: Nikolay Aleksandrov <nikolay@nvidia.com>
-
-[ Upstream commit dcb2c5c6ca9b9177f04abaf76e5a983d177c9414 ]
-
-When dumping vlan options for a single net device we send the same
-entries infinitely because user-space expects a 0 return at the end but
-we keep returning skb->len and restarting the dump on retry. Fix it by
-returning the value from br_vlan_dump_dev() if it completed or there was
-an error. The only case that must return skb->len is when the dump was
-incomplete and needs to continue (-EMSGSIZE).
-
-Reported-by: Benjamin Poirier <bpoirier@nvidia.com>
-Fixes: 8dcea187088b ("net: bridge: vlan: add rtm definitions and dump support")
-Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/bridge/br_vlan.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
-index 19f65ab91a027..06f5caee495aa 100644
---- a/net/bridge/br_vlan.c
-+++ b/net/bridge/br_vlan.c
-@@ -2105,7 +2105,8 @@ static int br_vlan_rtm_dump(struct sk_buff *skb, struct netlink_callback *cb)
- goto out_err;
- }
- err = br_vlan_dump_dev(dev, skb, cb, dump_flags);
-- if (err && err != -EMSGSIZE)
-+ /* if the dump completed without an error we return 0 here */
-+ if (err != -EMSGSIZE)
- goto out_err;
- } else {
- for_each_netdev_rcu(net, dev) {
---
-2.34.1
-
+++ /dev/null
-From 04a3b57d848ce5f7567bcb77637c955d5f744d84 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 24 Jan 2022 15:35:29 +0100
-Subject: net: cpsw: Properly initialise struct page_pool_params
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Toke Høiland-Jørgensen <toke@redhat.com>
-
-[ Upstream commit c63003e3d99761afb280add3b30de1cf30fa522b ]
-
-The cpsw driver didn't properly initialise the struct page_pool_params
-before calling page_pool_create(), which leads to crashes after the struct
-has been expanded with new parameters.
-
-The second Fixes tag below is where the buggy code was introduced, but
-because the code was moved around this patch will only apply on top of the
-commit in the first Fixes tag.
-
-Fixes: c5013ac1dd0e ("net: ethernet: ti: cpsw: move set of common functions in cpsw_priv")
-Fixes: 9ed4050c0d75 ("net: ethernet: ti: cpsw: add XDP support")
-Reported-by: Colin Foster <colin.foster@in-advantage.com>
-Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
-Tested-by: Colin Foster <colin.foster@in-advantage.com>
-Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/ti/cpsw_priv.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/ti/cpsw_priv.c b/drivers/net/ethernet/ti/cpsw_priv.c
-index 6bb5ac51d23c3..f8e591d69d2cb 100644
---- a/drivers/net/ethernet/ti/cpsw_priv.c
-+++ b/drivers/net/ethernet/ti/cpsw_priv.c
-@@ -1144,7 +1144,7 @@ int cpsw_fill_rx_channels(struct cpsw_priv *priv)
- static struct page_pool *cpsw_create_page_pool(struct cpsw_common *cpsw,
- int size)
- {
-- struct page_pool_params pp_params;
-+ struct page_pool_params pp_params = {};
- struct page_pool *pool;
-
- pp_params.order = 0;
---
-2.34.1
-
+++ /dev/null
-From 1c8f5abe6baa18d92ad737468c6f2e22ed33c364 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 18 Jan 2022 14:20:13 -0500
-Subject: net: fix information leakage in /proc/net/ptype
-
-From: Congyu Liu <liu3101@purdue.edu>
-
-[ Upstream commit 47934e06b65637c88a762d9c98329ae6e3238888 ]
-
-In one net namespace, after creating a packet socket without binding
-it to a device, users in other net namespaces can observe the new
-`packet_type` added by this packet socket by reading `/proc/net/ptype`
-file. This is minor information leakage as packet socket is
-namespace aware.
-
-Add a net pointer in `packet_type` to keep the net namespace of
-of corresponding packet socket. In `ptype_seq_show`, this net pointer
-must be checked when it is not NULL.
-
-Fixes: 2feb27dbe00c ("[NETNS]: Minor information leak via /proc/net/ptype file.")
-Signed-off-by: Congyu Liu <liu3101@purdue.edu>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/netdevice.h | 1 +
- net/core/net-procfs.c | 3 ++-
- net/packet/af_packet.c | 2 ++
- 3 files changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
-index ce81cc96a98d9..fba54624191a2 100644
---- a/include/linux/netdevice.h
-+++ b/include/linux/netdevice.h
-@@ -2636,6 +2636,7 @@ struct packet_type {
- struct net_device *);
- bool (*id_match)(struct packet_type *ptype,
- struct sock *sk);
-+ struct net *af_packet_net;
- void *af_packet_priv;
- struct list_head list;
- };
-diff --git a/net/core/net-procfs.c b/net/core/net-procfs.c
-index d8b9dbabd4a43..5b8016335acaf 100644
---- a/net/core/net-procfs.c
-+++ b/net/core/net-procfs.c
-@@ -260,7 +260,8 @@ static int ptype_seq_show(struct seq_file *seq, void *v)
-
- if (v == SEQ_START_TOKEN)
- seq_puts(seq, "Type Device Function\n");
-- else if (pt->dev == NULL || dev_net(pt->dev) == seq_file_net(seq)) {
-+ else if ((!pt->af_packet_net || net_eq(pt->af_packet_net, seq_file_net(seq))) &&
-+ (!pt->dev || net_eq(dev_net(pt->dev), seq_file_net(seq)))) {
- if (pt->type == htons(ETH_P_ALL))
- seq_puts(seq, "ALL ");
- else
-diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 1bc7ef49e1487..1a138e8d32d66 100644
---- a/net/packet/af_packet.c
-+++ b/net/packet/af_packet.c
-@@ -1738,6 +1738,7 @@ static int fanout_add(struct sock *sk, struct fanout_args *args)
- match->prot_hook.dev = po->prot_hook.dev;
- match->prot_hook.func = packet_rcv_fanout;
- match->prot_hook.af_packet_priv = match;
-+ match->prot_hook.af_packet_net = read_pnet(&match->net);
- match->prot_hook.id_match = match_fanout_group;
- match->max_num_members = args->max_num_members;
- list_add(&match->list, &fanout_list);
-@@ -3323,6 +3324,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,
- po->prot_hook.func = packet_rcv_spkt;
-
- po->prot_hook.af_packet_priv = sk;
-+ po->prot_hook.af_packet_net = sock_net(sk);
-
- if (proto) {
- po->prot_hook.type = proto;
---
-2.34.1
-
+++ /dev/null
-From c43216c1722b5e76093a04eadf70b129fda607a4 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 25 Jan 2022 15:03:12 +0800
-Subject: net: hns3: handle empty unknown interrupt for VF
-
-From: Yufeng Mo <moyufeng@huawei.com>
-
-[ Upstream commit 2f61353cd2f789a4229b6f5c1c24a40a613357bb ]
-
-Since some interrupt states may be cleared by hardware, the driver
-may receive an empty interrupt. Currently, the VF driver directly
-disables the vector0 interrupt in this case. As a result, the VF
-is unavailable. Therefore, the vector0 interrupt should be enabled
-in this case.
-
-Fixes: b90fcc5bd904 ("net: hns3: add reset handling for VF when doing Core/Global/IMP reset")
-Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
-Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
-index fee7d9e79f8c3..417a08d600b83 100644
---- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
-+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
-@@ -2496,8 +2496,7 @@ static irqreturn_t hclgevf_misc_irq_handle(int irq, void *data)
- break;
- }
-
-- if (event_cause != HCLGEVF_VECTOR0_EVENT_OTHER)
-- hclgevf_enable_vector(&hdev->misc_vector, true);
-+ hclgevf_enable_vector(&hdev->misc_vector, true);
-
- return IRQ_HANDLED;
- }
---
-2.34.1
-
+++ /dev/null
-From 752519bcd1ec32579aa9bf98d091d762e80ac221 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 18 Jan 2022 15:52:43 -0600
-Subject: net: phy: broadcom: hook up soft_reset for BCM54616S
-
-From: Robert Hancock <robert.hancock@calian.com>
-
-[ Upstream commit d15c7e875d44367005370e6a82e8f3a382a04f9b ]
-
-A problem was encountered with the Bel-Fuse 1GBT-SFP05 SFP module (which
-is a 1 Gbps copper module operating in SGMII mode with an internal
-BCM54616S PHY device) using the Xilinx AXI Ethernet MAC core, where the
-module would work properly on the initial insertion or boot of the
-device, but after the device was rebooted, the link would either only
-come up at 100 Mbps speeds or go up and down erratically.
-
-I found no meaningful changes in the PHY configuration registers between
-the working and non-working boots, but the status registers seemed to
-have a lot of error indications set on the SERDES side of the device on
-the non-working boot. I suspect the problem is that whatever happens on
-the SGMII link when the device is rebooted and the FPGA logic gets
-reloaded ends up putting the module's onboard PHY into a bad state.
-
-Since commit 6e2d85ec0559 ("net: phy: Stop with excessive soft reset")
-the genphy_soft_reset call is not made automatically by the PHY core
-unless the callback is explicitly specified in the driver structure. For
-most of these Broadcom devices, there is probably a hardware reset that
-gets asserted to reset the PHY during boot, however for SFP modules
-(where the BCM54616S is commonly found) no such reset line exists, so if
-the board keeps the SFP cage powered up across a reboot, it will end up
-with no reset occurring during reboots.
-
-Hook up the genphy_soft_reset callback for BCM54616S to ensure that a
-PHY reset is performed before the device is initialized. This appears to
-fix the issue with erratic operation after a reboot with this SFP
-module.
-
-Fixes: 6e2d85ec0559 ("net: phy: Stop with excessive soft reset")
-Signed-off-by: Robert Hancock <robert.hancock@calian.com>
-Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/phy/broadcom.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
-index 83aea5c5cd03c..db26ff8ce7dbb 100644
---- a/drivers/net/phy/broadcom.c
-+++ b/drivers/net/phy/broadcom.c
-@@ -768,6 +768,7 @@ static struct phy_driver broadcom_drivers[] = {
- .phy_id_mask = 0xfffffff0,
- .name = "Broadcom BCM54616S",
- /* PHY_GBIT_FEATURES */
-+ .soft_reset = genphy_soft_reset,
- .config_init = bcm54xx_config_init,
- .config_aneg = bcm54616s_config_aneg,
- .config_intr = bcm_phy_config_intr,
---
-2.34.1
-
+++ /dev/null
-From 691f0c86deb7be37ccea956a7e681cfdbc520907 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 21 Jan 2022 17:15:31 +0800
-Subject: net-procfs: show net devices bound packet types
-
-From: Jianguo Wu <wujianguo@chinatelecom.cn>
-
-[ Upstream commit 1d10f8a1f40b965d449e8f2d5ed7b96a7c138b77 ]
-
-After commit:7866a621043f ("dev: add per net_device packet type chains"),
-we can not get packet types that are bound to a specified net device by
-/proc/net/ptype, this patch fix the regression.
-
-Run "tcpdump -i ens192 udp -nns0" Before and after apply this patch:
-
-Before:
- [root@localhost ~]# cat /proc/net/ptype
- Type Device Function
- 0800 ip_rcv
- 0806 arp_rcv
- 86dd ipv6_rcv
-
-After:
- [root@localhost ~]# cat /proc/net/ptype
- Type Device Function
- ALL ens192 tpacket_rcv
- 0800 ip_rcv
- 0806 arp_rcv
- 86dd ipv6_rcv
-
-v1 -> v2:
- - fix the regression rather than adding new /proc API as
- suggested by Stephen Hemminger.
-
-Fixes: 7866a621043f ("dev: add per net_device packet type chains")
-Signed-off-by: Jianguo Wu <wujianguo@chinatelecom.cn>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/core/net-procfs.c | 35 ++++++++++++++++++++++++++++++++---
- 1 file changed, 32 insertions(+), 3 deletions(-)
-
-diff --git a/net/core/net-procfs.c b/net/core/net-procfs.c
-index 5b8016335acaf..88cc0ad7d386e 100644
---- a/net/core/net-procfs.c
-+++ b/net/core/net-procfs.c
-@@ -190,12 +190,23 @@ static const struct seq_operations softnet_seq_ops = {
- .show = softnet_seq_show,
- };
-
--static void *ptype_get_idx(loff_t pos)
-+static void *ptype_get_idx(struct seq_file *seq, loff_t pos)
- {
-+ struct list_head *ptype_list = NULL;
- struct packet_type *pt = NULL;
-+ struct net_device *dev;
- loff_t i = 0;
- int t;
-
-+ for_each_netdev_rcu(seq_file_net(seq), dev) {
-+ ptype_list = &dev->ptype_all;
-+ list_for_each_entry_rcu(pt, ptype_list, list) {
-+ if (i == pos)
-+ return pt;
-+ ++i;
-+ }
-+ }
-+
- list_for_each_entry_rcu(pt, &ptype_all, list) {
- if (i == pos)
- return pt;
-@@ -216,22 +227,40 @@ static void *ptype_seq_start(struct seq_file *seq, loff_t *pos)
- __acquires(RCU)
- {
- rcu_read_lock();
-- return *pos ? ptype_get_idx(*pos - 1) : SEQ_START_TOKEN;
-+ return *pos ? ptype_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
- }
-
- static void *ptype_seq_next(struct seq_file *seq, void *v, loff_t *pos)
- {
-+ struct net_device *dev;
- struct packet_type *pt;
- struct list_head *nxt;
- int hash;
-
- ++*pos;
- if (v == SEQ_START_TOKEN)
-- return ptype_get_idx(0);
-+ return ptype_get_idx(seq, 0);
-
- pt = v;
- nxt = pt->list.next;
-+ if (pt->dev) {
-+ if (nxt != &pt->dev->ptype_all)
-+ goto found;
-+
-+ dev = pt->dev;
-+ for_each_netdev_continue_rcu(seq_file_net(seq), dev) {
-+ if (!list_empty(&dev->ptype_all)) {
-+ nxt = dev->ptype_all.next;
-+ goto found;
-+ }
-+ }
-+
-+ nxt = ptype_all.next;
-+ goto ptype_all;
-+ }
-+
- if (pt->type == htons(ETH_P_ALL)) {
-+ptype_all:
- if (nxt != &ptype_all)
- goto found;
- hash = 0;
---
-2.34.1
-
+++ /dev/null
-From 48d666a1d617abe5870d514e2c2e084487ffb24b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 22 Jan 2022 17:43:09 +0800
-Subject: net/smc: Transitional solution for clcsock race issue
-
-From: Wen Gu <guwen@linux.alibaba.com>
-
-[ Upstream commit c0bf3d8a943b6f2e912b7c1de03e2ef28e76f760 ]
-
-We encountered a crash in smc_setsockopt() and it is caused by
-accessing smc->clcsock after clcsock was released.
-
- BUG: kernel NULL pointer dereference, address: 0000000000000020
- #PF: supervisor read access in kernel mode
- #PF: error_code(0x0000) - not-present page
- PGD 0 P4D 0
- Oops: 0000 [#1] PREEMPT SMP PTI
- CPU: 1 PID: 50309 Comm: nginx Kdump: loaded Tainted: G E 5.16.0-rc4+ #53
- RIP: 0010:smc_setsockopt+0x59/0x280 [smc]
- Call Trace:
- <TASK>
- __sys_setsockopt+0xfc/0x190
- __x64_sys_setsockopt+0x20/0x30
- do_syscall_64+0x34/0x90
- entry_SYSCALL_64_after_hwframe+0x44/0xae
- RIP: 0033:0x7f16ba83918e
- </TASK>
-
-This patch tries to fix it by holding clcsock_release_lock and
-checking whether clcsock has already been released before access.
-
-In case that a crash of the same reason happens in smc_getsockopt()
-or smc_switch_to_fallback(), this patch also checkes smc->clcsock
-in them too. And the caller of smc_switch_to_fallback() will identify
-whether fallback succeeds according to the return value.
-
-Fixes: fd57770dd198 ("net/smc: wait for pending work before clcsock release_sock")
-Link: https://lore.kernel.org/lkml/5dd7ffd1-28e2-24cc-9442-1defec27375e@linux.ibm.com/T/
-Signed-off-by: Wen Gu <guwen@linux.alibaba.com>
-Acked-by: Karsten Graul <kgraul@linux.ibm.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/smc/af_smc.c | 63 +++++++++++++++++++++++++++++++++++++++---------
- 1 file changed, 51 insertions(+), 12 deletions(-)
-
-diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
-index 07ff719f39077..34608369b426f 100644
---- a/net/smc/af_smc.c
-+++ b/net/smc/af_smc.c
-@@ -548,12 +548,17 @@ static void smc_stat_fallback(struct smc_sock *smc)
- mutex_unlock(&net->smc.mutex_fback_rsn);
- }
-
--static void smc_switch_to_fallback(struct smc_sock *smc, int reason_code)
-+static int smc_switch_to_fallback(struct smc_sock *smc, int reason_code)
- {
- wait_queue_head_t *smc_wait = sk_sleep(&smc->sk);
-- wait_queue_head_t *clc_wait = sk_sleep(smc->clcsock->sk);
-+ wait_queue_head_t *clc_wait;
- unsigned long flags;
-
-+ mutex_lock(&smc->clcsock_release_lock);
-+ if (!smc->clcsock) {
-+ mutex_unlock(&smc->clcsock_release_lock);
-+ return -EBADF;
-+ }
- smc->use_fallback = true;
- smc->fallback_rsn = reason_code;
- smc_stat_fallback(smc);
-@@ -567,18 +572,30 @@ static void smc_switch_to_fallback(struct smc_sock *smc, int reason_code)
- * smc socket->wq, which should be removed
- * to clcsocket->wq during the fallback.
- */
-+ clc_wait = sk_sleep(smc->clcsock->sk);
- spin_lock_irqsave(&smc_wait->lock, flags);
- spin_lock_nested(&clc_wait->lock, SINGLE_DEPTH_NESTING);
- list_splice_init(&smc_wait->head, &clc_wait->head);
- spin_unlock(&clc_wait->lock);
- spin_unlock_irqrestore(&smc_wait->lock, flags);
- }
-+ mutex_unlock(&smc->clcsock_release_lock);
-+ return 0;
- }
-
- /* fall back during connect */
- static int smc_connect_fallback(struct smc_sock *smc, int reason_code)
- {
-- smc_switch_to_fallback(smc, reason_code);
-+ struct net *net = sock_net(&smc->sk);
-+ int rc = 0;
-+
-+ rc = smc_switch_to_fallback(smc, reason_code);
-+ if (rc) { /* fallback fails */
-+ this_cpu_inc(net->smc.smc_stats->clnt_hshake_err_cnt);
-+ if (smc->sk.sk_state == SMC_INIT)
-+ sock_put(&smc->sk); /* passive closing */
-+ return rc;
-+ }
- smc_copy_sock_settings_to_clc(smc);
- smc->connect_nonblock = 0;
- if (smc->sk.sk_state == SMC_INIT)
-@@ -1384,11 +1401,12 @@ static void smc_listen_decline(struct smc_sock *new_smc, int reason_code,
- {
- /* RDMA setup failed, switch back to TCP */
- smc_conn_abort(new_smc, local_first);
-- if (reason_code < 0) { /* error, no fallback possible */
-+ if (reason_code < 0 ||
-+ smc_switch_to_fallback(new_smc, reason_code)) {
-+ /* error, no fallback possible */
- smc_listen_out_err(new_smc);
- return;
- }
-- smc_switch_to_fallback(new_smc, reason_code);
- if (reason_code && reason_code != SMC_CLC_DECL_PEERDECL) {
- if (smc_clc_send_decline(new_smc, reason_code, version) < 0) {
- smc_listen_out_err(new_smc);
-@@ -1761,8 +1779,11 @@ static void smc_listen_work(struct work_struct *work)
-
- /* check if peer is smc capable */
- if (!tcp_sk(newclcsock->sk)->syn_smc) {
-- smc_switch_to_fallback(new_smc, SMC_CLC_DECL_PEERNOSMC);
-- smc_listen_out_connected(new_smc);
-+ rc = smc_switch_to_fallback(new_smc, SMC_CLC_DECL_PEERNOSMC);
-+ if (rc)
-+ smc_listen_out_err(new_smc);
-+ else
-+ smc_listen_out_connected(new_smc);
- return;
- }
-
-@@ -2048,7 +2069,9 @@ static int smc_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
-
- if (msg->msg_flags & MSG_FASTOPEN) {
- if (sk->sk_state == SMC_INIT && !smc->connect_nonblock) {
-- smc_switch_to_fallback(smc, SMC_CLC_DECL_OPTUNSUPP);
-+ rc = smc_switch_to_fallback(smc, SMC_CLC_DECL_OPTUNSUPP);
-+ if (rc)
-+ goto out;
- } else {
- rc = -EINVAL;
- goto out;
-@@ -2241,6 +2264,11 @@ static int smc_setsockopt(struct socket *sock, int level, int optname,
- /* generic setsockopts reaching us here always apply to the
- * CLC socket
- */
-+ mutex_lock(&smc->clcsock_release_lock);
-+ if (!smc->clcsock) {
-+ mutex_unlock(&smc->clcsock_release_lock);
-+ return -EBADF;
-+ }
- if (unlikely(!smc->clcsock->ops->setsockopt))
- rc = -EOPNOTSUPP;
- else
-@@ -2250,6 +2278,7 @@ static int smc_setsockopt(struct socket *sock, int level, int optname,
- sk->sk_err = smc->clcsock->sk->sk_err;
- sk_error_report(sk);
- }
-+ mutex_unlock(&smc->clcsock_release_lock);
-
- if (optlen < sizeof(int))
- return -EINVAL;
-@@ -2266,7 +2295,7 @@ static int smc_setsockopt(struct socket *sock, int level, int optname,
- case TCP_FASTOPEN_NO_COOKIE:
- /* option not supported by SMC */
- if (sk->sk_state == SMC_INIT && !smc->connect_nonblock) {
-- smc_switch_to_fallback(smc, SMC_CLC_DECL_OPTUNSUPP);
-+ rc = smc_switch_to_fallback(smc, SMC_CLC_DECL_OPTUNSUPP);
- } else {
- rc = -EINVAL;
- }
-@@ -2309,13 +2338,23 @@ static int smc_getsockopt(struct socket *sock, int level, int optname,
- char __user *optval, int __user *optlen)
- {
- struct smc_sock *smc;
-+ int rc;
-
- smc = smc_sk(sock->sk);
-+ mutex_lock(&smc->clcsock_release_lock);
-+ if (!smc->clcsock) {
-+ mutex_unlock(&smc->clcsock_release_lock);
-+ return -EBADF;
-+ }
- /* socket options apply to the CLC socket */
-- if (unlikely(!smc->clcsock->ops->getsockopt))
-+ if (unlikely(!smc->clcsock->ops->getsockopt)) {
-+ mutex_unlock(&smc->clcsock_release_lock);
- return -EOPNOTSUPP;
-- return smc->clcsock->ops->getsockopt(smc->clcsock, level, optname,
-- optval, optlen);
-+ }
-+ rc = smc->clcsock->ops->getsockopt(smc->clcsock, level, optname,
-+ optval, optlen);
-+ mutex_unlock(&smc->clcsock_release_lock);
-+ return rc;
- }
-
- static int smc_ioctl(struct socket *sock, unsigned int cmd,
---
-2.34.1
-
+++ /dev/null
-From 9983b4b85bd35c6c35731b7b1507f2ca2042ba10 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 19 Jan 2022 13:46:47 +0900
-Subject: net: stmmac: dwmac-visconti: Fix bit definitions for ETHER_CLK_SEL
-
-From: Yuji Ishikawa <yuji2.ishikawa@toshiba.co.jp>
-
-[ Upstream commit 1ba1a4a90fa416a6f389206416c5f488cf8b1543 ]
-
-just 0 should be used to represent cleared bits
-
-* ETHER_CLK_SEL_DIV_SEL_20
-* ETHER_CLK_SEL_TX_CLK_EXT_SEL_IN
-* ETHER_CLK_SEL_RX_CLK_EXT_SEL_IN
-* ETHER_CLK_SEL_TX_CLK_O_TX_I
-* ETHER_CLK_SEL_RMII_CLK_SEL_IN
-
-Fixes: b38dd98ff8d0 ("net: stmmac: Add Toshiba Visconti SoCs glue driver")
-Signed-off-by: Yuji Ishikawa <yuji2.ishikawa@toshiba.co.jp>
-Reviewed-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c
-index fac788718c045..1c599a005aab6 100644
---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c
-+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c
-@@ -22,21 +22,21 @@
- #define ETHER_CLK_SEL_RMII_CLK_EN BIT(2)
- #define ETHER_CLK_SEL_RMII_CLK_RST BIT(3)
- #define ETHER_CLK_SEL_DIV_SEL_2 BIT(4)
--#define ETHER_CLK_SEL_DIV_SEL_20 BIT(0)
-+#define ETHER_CLK_SEL_DIV_SEL_20 0
- #define ETHER_CLK_SEL_FREQ_SEL_125M (BIT(9) | BIT(8))
- #define ETHER_CLK_SEL_FREQ_SEL_50M BIT(9)
- #define ETHER_CLK_SEL_FREQ_SEL_25M BIT(8)
- #define ETHER_CLK_SEL_FREQ_SEL_2P5M 0
--#define ETHER_CLK_SEL_TX_CLK_EXT_SEL_IN BIT(0)
-+#define ETHER_CLK_SEL_TX_CLK_EXT_SEL_IN 0
- #define ETHER_CLK_SEL_TX_CLK_EXT_SEL_TXC BIT(10)
- #define ETHER_CLK_SEL_TX_CLK_EXT_SEL_DIV BIT(11)
--#define ETHER_CLK_SEL_RX_CLK_EXT_SEL_IN BIT(0)
-+#define ETHER_CLK_SEL_RX_CLK_EXT_SEL_IN 0
- #define ETHER_CLK_SEL_RX_CLK_EXT_SEL_RXC BIT(12)
- #define ETHER_CLK_SEL_RX_CLK_EXT_SEL_DIV BIT(13)
--#define ETHER_CLK_SEL_TX_CLK_O_TX_I BIT(0)
-+#define ETHER_CLK_SEL_TX_CLK_O_TX_I 0
- #define ETHER_CLK_SEL_TX_CLK_O_RMII_I BIT(14)
- #define ETHER_CLK_SEL_TX_O_E_N_IN BIT(15)
--#define ETHER_CLK_SEL_RMII_CLK_SEL_IN BIT(0)
-+#define ETHER_CLK_SEL_RMII_CLK_SEL_IN 0
- #define ETHER_CLK_SEL_RMII_CLK_SEL_RX_C BIT(16)
-
- #define ETHER_CLK_SEL_RX_TX_CLK_EN (ETHER_CLK_SEL_RX_CLK_EN | ETHER_CLK_SEL_TX_CLK_EN)
---
-2.34.1
-
+++ /dev/null
-From faa2d34f5890debd8dab0b4c041529308599e352 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 19 Jan 2022 13:46:48 +0900
-Subject: net: stmmac: dwmac-visconti: Fix clock configuration for RMII mode
-
-From: Yuji Ishikawa <yuji2.ishikawa@toshiba.co.jp>
-
-[ Upstream commit 0959bc4bd4206433ed101a1332a23e93ad16ec77 ]
-
-Bit pattern of the ETHER_CLOCK_SEL register for RMII/MII mode should be fixed.
-Also, some control bits should be modified with a specific sequence.
-
-Fixes: b38dd98ff8d0 ("net: stmmac: Add Toshiba Visconti SoCs glue driver")
-Signed-off-by: Yuji Ishikawa <yuji2.ishikawa@toshiba.co.jp>
-Reviewed-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../ethernet/stmicro/stmmac/dwmac-visconti.c | 32 ++++++++++++-------
- 1 file changed, 21 insertions(+), 11 deletions(-)
-
-diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c
-index 1c599a005aab6..4578c64953eac 100644
---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c
-+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c
-@@ -96,31 +96,41 @@ static void visconti_eth_fix_mac_speed(void *priv, unsigned int speed)
- val |= ETHER_CLK_SEL_TX_O_E_N_IN;
- writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL);
-
-+ /* Set Clock-Mux, Start clock, Set TX_O direction */
- switch (dwmac->phy_intf_sel) {
- case ETHER_CONFIG_INTF_RGMII:
- val = clk_sel_val | ETHER_CLK_SEL_RX_CLK_EXT_SEL_RXC;
-+ writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL);
-+
-+ val |= ETHER_CLK_SEL_RX_TX_CLK_EN;
-+ writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL);
-+
-+ val &= ~ETHER_CLK_SEL_TX_O_E_N_IN;
-+ writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL);
- break;
- case ETHER_CONFIG_INTF_RMII:
- val = clk_sel_val | ETHER_CLK_SEL_RX_CLK_EXT_SEL_DIV |
-- ETHER_CLK_SEL_TX_CLK_EXT_SEL_TXC | ETHER_CLK_SEL_TX_O_E_N_IN |
-+ ETHER_CLK_SEL_TX_CLK_EXT_SEL_DIV | ETHER_CLK_SEL_TX_O_E_N_IN |
- ETHER_CLK_SEL_RMII_CLK_SEL_RX_C;
-+ writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL);
-+
-+ val |= ETHER_CLK_SEL_RMII_CLK_RST;
-+ writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL);
-+
-+ val |= ETHER_CLK_SEL_RMII_CLK_EN | ETHER_CLK_SEL_RX_TX_CLK_EN;
-+ writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL);
- break;
- case ETHER_CONFIG_INTF_MII:
- default:
- val = clk_sel_val | ETHER_CLK_SEL_RX_CLK_EXT_SEL_RXC |
-- ETHER_CLK_SEL_TX_CLK_EXT_SEL_DIV | ETHER_CLK_SEL_TX_O_E_N_IN |
-- ETHER_CLK_SEL_RMII_CLK_EN;
-+ ETHER_CLK_SEL_TX_CLK_EXT_SEL_TXC | ETHER_CLK_SEL_TX_O_E_N_IN;
-+ writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL);
-+
-+ val |= ETHER_CLK_SEL_RX_TX_CLK_EN;
-+ writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL);
- break;
- }
-
-- /* Start clock */
-- writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL);
-- val |= ETHER_CLK_SEL_RX_TX_CLK_EN;
-- writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL);
--
-- val &= ~ETHER_CLK_SEL_TX_O_E_N_IN;
-- writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL);
--
- spin_unlock_irqrestore(&dwmac->lock, flags);
- }
-
---
-2.34.1
-
+++ /dev/null
-From 387d1346cc4eb4608a69f40f34db7165ad5763cb Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 13 Jan 2022 21:37:58 +0100
-Subject: netfilter: conntrack: don't increment invalid counter on NF_REPEAT
-
-From: Florian Westphal <fw@strlen.de>
-
-[ Upstream commit 830af2eba40327abec64325a5b08b1e85c37a2e0 ]
-
-The packet isn't invalid, REPEAT means we're trying again after cleaning
-out a stale connection, e.g. via tcp tracker.
-
-This caused increases of invalid stat counter in a test case involving
-frequent connection reuse, even though no packet is actually invalid.
-
-Fixes: 56a62e2218f5 ("netfilter: conntrack: fix NF_REPEAT handling")
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/netfilter/nf_conntrack_core.c | 8 +++++---
- 1 file changed, 5 insertions(+), 3 deletions(-)
-
-diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
-index 4712a90a1820c..7f79974607643 100644
---- a/net/netfilter/nf_conntrack_core.c
-+++ b/net/netfilter/nf_conntrack_core.c
-@@ -1922,15 +1922,17 @@ repeat:
- pr_debug("nf_conntrack_in: Can't track with proto module\n");
- nf_conntrack_put(&ct->ct_general);
- skb->_nfct = 0;
-- NF_CT_STAT_INC_ATOMIC(state->net, invalid);
-- if (ret == -NF_DROP)
-- NF_CT_STAT_INC_ATOMIC(state->net, drop);
- /* Special case: TCP tracker reports an attempt to reopen a
- * closed/aborted connection. We have to go back and create a
- * fresh conntrack.
- */
- if (ret == -NF_REPEAT)
- goto repeat;
-+
-+ NF_CT_STAT_INC_ATOMIC(state->net, invalid);
-+ if (ret == -NF_DROP)
-+ NF_CT_STAT_INC_ATOMIC(state->net, drop);
-+
- ret = -ret;
- goto out;
- }
---
-2.34.1
-
+++ /dev/null
-From 72f2d6a075c20b2390ee79cce24be5cee46d4ca2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 15 Dec 2021 16:38:16 -0500
-Subject: NFS: Ensure the server has an up to date ctime before renaming
-
-From: Trond Myklebust <trond.myklebust@hammerspace.com>
-
-[ Upstream commit 6ff9d99bb88faebf134ca668842349d9718e5464 ]
-
-Renaming a file is required by POSIX to update the file ctime, so
-ensure that the file data is synced to disk so that we don't clobber the
-updated ctime by writing back after creating the hard link.
-
-Fixes: f2c2c552f119 ("NFS: Move delegation recall into the NFSv4 callback for rename_setup()")
-Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
-Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/nfs/dir.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
-index fdea6ff824cf8..ac0e1ab1b71ba 100644
---- a/fs/nfs/dir.c
-+++ b/fs/nfs/dir.c
-@@ -2472,6 +2472,8 @@ int nfs_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
- }
- }
-
-+ if (S_ISREG(old_inode->i_mode))
-+ nfs_sync_inode(old_inode);
- task = nfs_async_rename(old_dir, new_dir, old_dentry, new_dentry, NULL);
- if (IS_ERR(task)) {
- error = PTR_ERR(task);
---
-2.34.1
-
+++ /dev/null
-From fe5e25698d968672ded4717c806d9c690d215f6f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 15 Dec 2021 16:38:15 -0500
-Subject: NFS: Ensure the server has an up to date ctime before hardlinking
-
-From: Trond Myklebust <trond.myklebust@hammerspace.com>
-
-[ Upstream commit 204975036b34f55237bc44c8a302a88468ef21b5 ]
-
-Creating a hard link is required by POSIX to update the file ctime, so
-ensure that the file data is synced to disk so that we don't clobber the
-updated ctime by writing back after creating the hard link.
-
-Fixes: 9f7682728728 ("NFS: Move the delegation return down into nfs4_proc_link()")
-Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
-Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/nfs/dir.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
-index 5b68c44848caf..fdea6ff824cf8 100644
---- a/fs/nfs/dir.c
-+++ b/fs/nfs/dir.c
-@@ -2382,6 +2382,8 @@ nfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *dentry)
-
- trace_nfs_link_enter(inode, dir, dentry);
- d_drop(dentry);
-+ if (S_ISREG(inode->i_mode))
-+ nfs_sync_inode(inode);
- error = NFS_PROTO(dir)->link(inode, dir, &dentry->d_name);
- if (error == 0) {
- ihold(inode);
---
-2.34.1
-
+++ /dev/null
-From 50a55e2ce229e4b71ee44cd4fe00de4ffab7aed2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jan 2022 18:24:02 -0500
-Subject: NFSv4: Handle case where the lookup of a directory fails
-
-From: Trond Myklebust <trond.myklebust@hammerspace.com>
-
-[ Upstream commit ac795161c93699d600db16c1a8cc23a65a1eceaf ]
-
-If the application sets the O_DIRECTORY flag, and tries to open a
-regular file, nfs_atomic_open() will punt to doing a regular lookup.
-If the server then returns a regular file, we will happily return a
-file descriptor with uninitialised open state.
-
-The fix is to return the expected ENOTDIR error in these cases.
-
-Reported-by: Lyu Tao <tao.lyu@epfl.ch>
-Fixes: 0dd2b474d0b6 ("nfs: implement i_op->atomic_open()")
-Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
-Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/nfs/dir.c | 13 +++++++++++++
- 1 file changed, 13 insertions(+)
-
-diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
-index ac0e1ab1b71ba..2d156311c374d 100644
---- a/fs/nfs/dir.c
-+++ b/fs/nfs/dir.c
-@@ -1982,6 +1982,19 @@ out:
-
- no_open:
- res = nfs_lookup(dir, dentry, lookup_flags);
-+ if (!res) {
-+ inode = d_inode(dentry);
-+ if ((lookup_flags & LOOKUP_DIRECTORY) && inode &&
-+ !S_ISDIR(inode->i_mode))
-+ res = ERR_PTR(-ENOTDIR);
-+ } else if (!IS_ERR(res)) {
-+ inode = d_inode(res);
-+ if ((lookup_flags & LOOKUP_DIRECTORY) && inode &&
-+ !S_ISDIR(inode->i_mode)) {
-+ dput(res);
-+ res = ERR_PTR(-ENOTDIR);
-+ }
-+ }
- if (switched) {
- d_lookup_done(dentry);
- if (!res)
---
-2.34.1
-
+++ /dev/null
-From f53e3532127d8984f21d9b64071647f224ad660a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jan 2022 18:24:03 -0500
-Subject: NFSv4: nfs_atomic_open() can race when looking up a non-regular file
-
-From: Trond Myklebust <trond.myklebust@hammerspace.com>
-
-[ Upstream commit 1751fc1db36f6f411709e143d5393f92d12137a9 ]
-
-If the file type changes back to being a regular file on the server
-between the failed OPEN and our LOOKUP, then we need to re-run the OPEN.
-
-Fixes: 0dd2b474d0b6 ("nfs: implement i_op->atomic_open()")
-Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
-Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/nfs/dir.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
-index 2d156311c374d..ed79c1bd84a29 100644
---- a/fs/nfs/dir.c
-+++ b/fs/nfs/dir.c
-@@ -1987,12 +1987,17 @@ no_open:
- if ((lookup_flags & LOOKUP_DIRECTORY) && inode &&
- !S_ISDIR(inode->i_mode))
- res = ERR_PTR(-ENOTDIR);
-+ else if (inode && S_ISREG(inode->i_mode))
-+ res = ERR_PTR(-EOPENSTALE);
- } else if (!IS_ERR(res)) {
- inode = d_inode(res);
- if ((lookup_flags & LOOKUP_DIRECTORY) && inode &&
- !S_ISDIR(inode->i_mode)) {
- dput(res);
- res = ERR_PTR(-ENOTDIR);
-+ } else if (inode && S_ISREG(inode->i_mode)) {
-+ dput(res);
-+ res = ERR_PTR(-EOPENSTALE);
- }
- }
- if (switched) {
---
-2.34.1
-
+++ /dev/null
-From 228bd0c043c9cec051d787754de2740c45751b9c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 21 Jan 2022 12:04:45 +0530
-Subject: octeontx2-af: cn10k: Do not enable RPM loopback for LPC interfaces
-
-From: Geetha sowjanya <gakula@marvell.com>
-
-[ Upstream commit df66b6ebc5dcf7253e35a640b9ec4add54195c25 ]
-
-Internal looback is not supported to low rate LPCS interface like
-SGMII/QSGMII. Hence don't allow to enable for such interfaces.
-
-Fixes: 3ad3f8f93c81 ("octeontx2-af: cn10k: MAC internal loopback support")
-Signed-off-by: Geetha sowjanya <gakula@marvell.com>
-Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
-Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../net/ethernet/marvell/octeontx2/af/rpm.c | 27 +++++++++----------
- 1 file changed, 12 insertions(+), 15 deletions(-)
-
-diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
-index 07b0eafccad87..b3803577324e6 100644
---- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
-@@ -251,22 +251,19 @@ int rpm_lmac_internal_loopback(void *rpmd, int lmac_id, bool enable)
- if (!rpm || lmac_id >= rpm->lmac_count)
- return -ENODEV;
- lmac_type = rpm->mac_ops->get_lmac_type(rpm, lmac_id);
-- if (lmac_type == LMAC_MODE_100G_R) {
-- cfg = rpm_read(rpm, lmac_id, RPMX_MTI_PCS100X_CONTROL1);
--
-- if (enable)
-- cfg |= RPMX_MTI_PCS_LBK;
-- else
-- cfg &= ~RPMX_MTI_PCS_LBK;
-- rpm_write(rpm, lmac_id, RPMX_MTI_PCS100X_CONTROL1, cfg);
-- } else {
-- cfg = rpm_read(rpm, lmac_id, RPMX_MTI_LPCSX_CONTROL1);
-- if (enable)
-- cfg |= RPMX_MTI_PCS_LBK;
-- else
-- cfg &= ~RPMX_MTI_PCS_LBK;
-- rpm_write(rpm, lmac_id, RPMX_MTI_LPCSX_CONTROL1, cfg);
-+
-+ if (lmac_type == LMAC_MODE_QSGMII || lmac_type == LMAC_MODE_SGMII) {
-+ dev_err(&rpm->pdev->dev, "loopback not supported for LPC mode\n");
-+ return 0;
- }
-
-+ cfg = rpm_read(rpm, lmac_id, RPMX_MTI_PCS100X_CONTROL1);
-+
-+ if (enable)
-+ cfg |= RPMX_MTI_PCS_LBK;
-+ else
-+ cfg &= ~RPMX_MTI_PCS_LBK;
-+ rpm_write(rpm, lmac_id, RPMX_MTI_PCS100X_CONTROL1, cfg);
-+
- return 0;
- }
---
-2.34.1
-
+++ /dev/null
-From 1663a87dacab764a0a42a9ca46e02b2c84a7ac91 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 21 Jan 2022 12:04:39 +0530
-Subject: octeontx2-af: Do not fixup all VF action entries
-
-From: Subbaraya Sundeep <sbhatta@marvell.com>
-
-[ Upstream commit d225c449ab2be25273a3674f476c6c0b57c50254 ]
-
-AF modifies all the rules destined for VF to use
-the action same as default RSS action. This fixup
-was needed because AF only installs default rules with
-RSS action. But the action in rules installed by a PF
-for its VFs should not be changed by this fixup.
-This is because action can be drop or direct to
-queue as specified by user(ntuple filters).
-This patch fixes that problem.
-
-Fixes: 967db3529eca ("octeontx2-af: add support for multicast/promisc packet")
-Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
-Signed-off-by: Naveen Mamindlapalli <naveenm@marvell.com>
-Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../ethernet/marvell/octeontx2/af/rvu_npc.c | 22 ++++++++++++++++---
- .../marvell/octeontx2/af/rvu_npc_fs.c | 20 ++++++++++-------
- 2 files changed, 31 insertions(+), 11 deletions(-)
-
-diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
-index 5efb4174e82df..87f18e32b4634 100644
---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
-@@ -402,6 +402,7 @@ static void npc_fixup_vf_rule(struct rvu *rvu, struct npc_mcam *mcam,
- int blkaddr, int index, struct mcam_entry *entry,
- bool *enable)
- {
-+ struct rvu_npc_mcam_rule *rule;
- u16 owner, target_func;
- struct rvu_pfvf *pfvf;
- u64 rx_action;
-@@ -423,6 +424,12 @@ static void npc_fixup_vf_rule(struct rvu *rvu, struct npc_mcam *mcam,
- test_bit(NIXLF_INITIALIZED, &pfvf->flags)))
- *enable = false;
-
-+ /* fix up not needed for the rules added by user(ntuple filters) */
-+ list_for_each_entry(rule, &mcam->mcam_rules, list) {
-+ if (rule->entry == index)
-+ return;
-+ }
-+
- /* copy VF default entry action to the VF mcam entry */
- rx_action = npc_get_default_entry_action(rvu, mcam, blkaddr,
- target_func);
-@@ -489,8 +496,8 @@ static void npc_config_mcam_entry(struct rvu *rvu, struct npc_mcam *mcam,
- }
-
- /* PF installing VF rule */
-- if (intf == NIX_INTF_RX && actindex < mcam->bmap_entries)
-- npc_fixup_vf_rule(rvu, mcam, blkaddr, index, entry, &enable);
-+ if (is_npc_intf_rx(intf) && actindex < mcam->bmap_entries)
-+ npc_fixup_vf_rule(rvu, mcam, blkaddr, actindex, entry, &enable);
-
- /* Set 'action' */
- rvu_write64(rvu, blkaddr,
-@@ -916,7 +923,8 @@ static void npc_update_vf_flow_entry(struct rvu *rvu, struct npc_mcam *mcam,
- int blkaddr, u16 pcifunc, u64 rx_action)
- {
- int actindex, index, bank, entry;
-- bool enable;
-+ struct rvu_npc_mcam_rule *rule;
-+ bool enable, update;
-
- if (!(pcifunc & RVU_PFVF_FUNC_MASK))
- return;
-@@ -924,6 +932,14 @@ static void npc_update_vf_flow_entry(struct rvu *rvu, struct npc_mcam *mcam,
- mutex_lock(&mcam->lock);
- for (index = 0; index < mcam->bmap_entries; index++) {
- if (mcam->entry2target_pffunc[index] == pcifunc) {
-+ update = true;
-+ /* update not needed for the rules added via ntuple filters */
-+ list_for_each_entry(rule, &mcam->mcam_rules, list) {
-+ if (rule->entry == index)
-+ update = false;
-+ }
-+ if (!update)
-+ continue;
- bank = npc_get_bank(mcam, index);
- actindex = index;
- entry = index & (mcam->banksize - 1);
-diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c
-index 51ddc7b81d0bd..ca404d51d9f56 100644
---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c
-@@ -1098,14 +1098,6 @@ find_rule:
- write_req.cntr = rule->cntr;
- }
-
-- err = rvu_mbox_handler_npc_mcam_write_entry(rvu, &write_req,
-- &write_rsp);
-- if (err) {
-- rvu_mcam_remove_counter_from_rule(rvu, owner, rule);
-- if (new)
-- kfree(rule);
-- return err;
-- }
- /* update rule */
- memcpy(&rule->packet, &dummy.packet, sizeof(rule->packet));
- memcpy(&rule->mask, &dummy.mask, sizeof(rule->mask));
-@@ -1129,6 +1121,18 @@ find_rule:
- if (req->default_rule)
- pfvf->def_ucast_rule = rule;
-
-+ /* write to mcam entry registers */
-+ err = rvu_mbox_handler_npc_mcam_write_entry(rvu, &write_req,
-+ &write_rsp);
-+ if (err) {
-+ rvu_mcam_remove_counter_from_rule(rvu, owner, rule);
-+ if (new) {
-+ list_del(&rule->list);
-+ kfree(rule);
-+ }
-+ return err;
-+ }
-+
- /* VF's MAC address is being changed via PF */
- if (pf_set_vfs_mac) {
- ether_addr_copy(pfvf->default_mac, req->packet.dmac);
---
-2.34.1
-
+++ /dev/null
-From f3eb3a43721712619ad776fc6a02cbb4338a1217 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 21 Jan 2022 12:04:40 +0530
-Subject: octeontx2-af: Fix LBK backpressure id count
-
-From: Sunil Goutham <sgoutham@marvell.com>
-
-[ Upstream commit 00bfe94e388fe12bfd0d4f6361b1b1343374ff5b ]
-
-In rvu_nix_get_bpid() lbk_bpid_cnt is being read from
-wrong register. Due to this backpressure enable is failing
-for LBK VF32 onwards. This patch fixes that.
-
-Fixes: fe1939bb2340 ("octeontx2-af: Add SDP interface support")
-Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
-Signed-off-by: Subbaraya Sundeep <sgoutham@marvell.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
-index 6970540dc4709..8ee324aabf2d6 100644
---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
-@@ -511,11 +511,11 @@ static int rvu_nix_get_bpid(struct rvu *rvu, struct nix_bp_cfg_req *req,
- cfg = rvu_read64(rvu, blkaddr, NIX_AF_CONST);
- lmac_chan_cnt = cfg & 0xFF;
-
-- cfg = rvu_read64(rvu, blkaddr, NIX_AF_CONST1);
-- sdp_chan_cnt = cfg & 0xFFF;
--
- cgx_bpid_cnt = hw->cgx_links * lmac_chan_cnt;
- lbk_bpid_cnt = hw->lbk_links * ((cfg >> 16) & 0xFF);
-+
-+ cfg = rvu_read64(rvu, blkaddr, NIX_AF_CONST1);
-+ sdp_chan_cnt = cfg & 0xFFF;
- sdp_bpid_cnt = hw->sdp_links * sdp_chan_cnt;
-
- pfvf = rvu_get_pfvf(rvu, req->hdr.pcifunc);
---
-2.34.1
-
+++ /dev/null
-From eb983badfee18b9d7f86cc99b328cb4f1e36054b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 21 Jan 2022 12:04:44 +0530
-Subject: octeontx2-af: Increase link credit restore polling timeout
-
-From: Geetha sowjanya <gakula@marvell.com>
-
-[ Upstream commit 1581d61b42d985cefe7b71eea67ab3bfcbf34d0f ]
-
-It's been observed that sometimes link credit restore takes
-a lot of time than the current timeout. This patch increases
-the default timeout value and return the proper error value
-on failure.
-
-Fixes: 1c74b89171c3 ("octeontx2-af: Wait for TX link idle for credits change")
-Signed-off-by: Geetha sowjanya <gakula@marvell.com>
-Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
-Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/marvell/octeontx2/af/mbox.h | 1 +
- drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 4 ++--
- 2 files changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
-index a8618259de943..26ad71842b3b2 100644
---- a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
-+++ b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
-@@ -700,6 +700,7 @@ enum nix_af_status {
- NIX_AF_ERR_BANDPROF_INVAL_REQ = -428,
- NIX_AF_ERR_CQ_CTX_WRITE_ERR = -429,
- NIX_AF_ERR_AQ_CTX_RETRY_WRITE = -430,
-+ NIX_AF_ERR_LINK_CREDITS = -431,
- };
-
- /* For NIX RX vtag action */
-diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
-index 9d4cc0ae61474..959266894cf15 100644
---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
-@@ -3891,8 +3891,8 @@ nix_config_link_credits(struct rvu *rvu, int blkaddr, int link,
- NIX_AF_TL1X_SW_XOFF(schq), BIT_ULL(0));
- }
-
-- rc = -EBUSY;
-- poll_tmo = jiffies + usecs_to_jiffies(10000);
-+ rc = NIX_AF_ERR_LINK_CREDITS;
-+ poll_tmo = jiffies + usecs_to_jiffies(200000);
- /* Wait for credits to return */
- do {
- if (time_after(jiffies, poll_tmo))
---
-2.34.1
-
+++ /dev/null
-From 9d9d8b60bc47fc8652f7b38774019b7c43e02c91 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 21 Jan 2022 12:04:41 +0530
-Subject: octeontx2-af: Retry until RVU block reset complete
-
-From: Geetha sowjanya <gakula@marvell.com>
-
-[ Upstream commit 03ffbc9914bd1130fba464f0a41c01372e5fc359 ]
-
-Few RVU blocks like SSO require more time for reset on some
-silicons. Hence retrying the block reset until success.
-
-Fixes: c0fa2cff8822c ("octeontx2-af: Handle return value in block reset")
-Signed-off-by: Geetha sowjanya <gakula@marvell.com>
-Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
-Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
-index 90dc5343827f0..11ef46e72ddd9 100644
---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
-@@ -520,8 +520,11 @@ static void rvu_block_reset(struct rvu *rvu, int blkaddr, u64 rst_reg)
-
- rvu_write64(rvu, blkaddr, rst_reg, BIT_ULL(0));
- err = rvu_poll_reg(rvu, blkaddr, rst_reg, BIT_ULL(63), true);
-- if (err)
-- dev_err(rvu->dev, "HW block:%d reset failed\n", blkaddr);
-+ if (err) {
-+ dev_err(rvu->dev, "HW block:%d reset timeout retrying again\n", blkaddr);
-+ while (rvu_poll_reg(rvu, blkaddr, rst_reg, BIT_ULL(63), true) == -EBUSY)
-+ ;
-+ }
- }
-
- static void rvu_reset_all_blocks(struct rvu *rvu)
---
-2.34.1
-
+++ /dev/null
-From 653778a728d57071f67f1dc416c4a7334b648d6a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 17 Sep 2021 18:40:24 +0530
-Subject: octeontx2-af: verify CQ context updates
-
-From: Hariprasad Kelam <hkelam@marvell.com>
-
-[ Upstream commit 14e94f9445a9e91d460f5d4b519f8892c3fb14bb ]
-
-As per HW errata AQ modification to CQ could be discarded on heavy
-traffic. This patch implements workaround for the same after each
-CQ write by AQ check whether the requested fields (except those
-which HW can update eg: avg_level) are properly updated or not.
-
-If CQ context is not updated then perform AQ write again.
-
-Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
-Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../net/ethernet/marvell/octeontx2/af/mbox.h | 2 +
- .../ethernet/marvell/octeontx2/af/rvu_nix.c | 78 ++++++++++++++++++-
- 2 files changed, 79 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
-index 154877706a0e1..a8618259de943 100644
---- a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
-+++ b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
-@@ -698,6 +698,8 @@ enum nix_af_status {
- NIX_AF_ERR_INVALID_BANDPROF = -426,
- NIX_AF_ERR_IPOLICER_NOTSUPP = -427,
- NIX_AF_ERR_BANDPROF_INVAL_REQ = -428,
-+ NIX_AF_ERR_CQ_CTX_WRITE_ERR = -429,
-+ NIX_AF_ERR_AQ_CTX_RETRY_WRITE = -430,
- };
-
- /* For NIX RX vtag action */
-diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
-index 8ee324aabf2d6..9d4cc0ae61474 100644
---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
-@@ -28,6 +28,7 @@ static int nix_verify_bandprof(struct nix_cn10k_aq_enq_req *req,
- static int nix_free_all_bandprof(struct rvu *rvu, u16 pcifunc);
- static void nix_clear_ratelimit_aggr(struct rvu *rvu, struct nix_hw *nix_hw,
- u32 leaf_prof);
-+static const char *nix_get_ctx_name(int ctype);
-
- enum mc_tbl_sz {
- MC_TBL_SZ_256,
-@@ -1061,10 +1062,68 @@ static int rvu_nix_blk_aq_enq_inst(struct rvu *rvu, struct nix_hw *nix_hw,
- return 0;
- }
-
-+static int rvu_nix_verify_aq_ctx(struct rvu *rvu, struct nix_hw *nix_hw,
-+ struct nix_aq_enq_req *req, u8 ctype)
-+{
-+ struct nix_cn10k_aq_enq_req aq_req;
-+ struct nix_cn10k_aq_enq_rsp aq_rsp;
-+ int rc, word;
-+
-+ if (req->ctype != NIX_AQ_CTYPE_CQ)
-+ return 0;
-+
-+ rc = nix_aq_context_read(rvu, nix_hw, &aq_req, &aq_rsp,
-+ req->hdr.pcifunc, ctype, req->qidx);
-+ if (rc) {
-+ dev_err(rvu->dev,
-+ "%s: Failed to fetch %s%d context of PFFUNC 0x%x\n",
-+ __func__, nix_get_ctx_name(ctype), req->qidx,
-+ req->hdr.pcifunc);
-+ return rc;
-+ }
-+
-+ /* Make copy of original context & mask which are required
-+ * for resubmission
-+ */
-+ memcpy(&aq_req.cq_mask, &req->cq_mask, sizeof(struct nix_cq_ctx_s));
-+ memcpy(&aq_req.cq, &req->cq, sizeof(struct nix_cq_ctx_s));
-+
-+ /* exclude fields which HW can update */
-+ aq_req.cq_mask.cq_err = 0;
-+ aq_req.cq_mask.wrptr = 0;
-+ aq_req.cq_mask.tail = 0;
-+ aq_req.cq_mask.head = 0;
-+ aq_req.cq_mask.avg_level = 0;
-+ aq_req.cq_mask.update_time = 0;
-+ aq_req.cq_mask.substream = 0;
-+
-+ /* Context mask (cq_mask) holds mask value of fields which
-+ * are changed in AQ WRITE operation.
-+ * for example cq.drop = 0xa;
-+ * cq_mask.drop = 0xff;
-+ * Below logic performs '&' between cq and cq_mask so that non
-+ * updated fields are masked out for request and response
-+ * comparison
-+ */
-+ for (word = 0; word < sizeof(struct nix_cq_ctx_s) / sizeof(u64);
-+ word++) {
-+ *(u64 *)((u8 *)&aq_rsp.cq + word * 8) &=
-+ (*(u64 *)((u8 *)&aq_req.cq_mask + word * 8));
-+ *(u64 *)((u8 *)&aq_req.cq + word * 8) &=
-+ (*(u64 *)((u8 *)&aq_req.cq_mask + word * 8));
-+ }
-+
-+ if (memcmp(&aq_req.cq, &aq_rsp.cq, sizeof(struct nix_cq_ctx_s)))
-+ return NIX_AF_ERR_AQ_CTX_RETRY_WRITE;
-+
-+ return 0;
-+}
-+
- static int rvu_nix_aq_enq_inst(struct rvu *rvu, struct nix_aq_enq_req *req,
- struct nix_aq_enq_rsp *rsp)
- {
- struct nix_hw *nix_hw;
-+ int err, retries = 5;
- int blkaddr;
-
- blkaddr = rvu_get_blkaddr(rvu, BLKTYPE_NIX, req->hdr.pcifunc);
-@@ -1075,7 +1134,24 @@ static int rvu_nix_aq_enq_inst(struct rvu *rvu, struct nix_aq_enq_req *req,
- if (!nix_hw)
- return NIX_AF_ERR_INVALID_NIXBLK;
-
-- return rvu_nix_blk_aq_enq_inst(rvu, nix_hw, req, rsp);
-+retry:
-+ err = rvu_nix_blk_aq_enq_inst(rvu, nix_hw, req, rsp);
-+
-+ /* HW errata 'AQ Modification to CQ could be discarded on heavy traffic'
-+ * As a work around perfrom CQ context read after each AQ write. If AQ
-+ * read shows AQ write is not updated perform AQ write again.
-+ */
-+ if (!err && req->op == NIX_AQ_INSTOP_WRITE) {
-+ err = rvu_nix_verify_aq_ctx(rvu, nix_hw, req, NIX_AQ_CTYPE_CQ);
-+ if (err == NIX_AF_ERR_AQ_CTX_RETRY_WRITE) {
-+ if (retries--)
-+ goto retry;
-+ else
-+ return NIX_AF_ERR_CQ_CTX_WRITE_ERR;
-+ }
-+ }
-+
-+ return err;
- }
-
- static const char *nix_get_ctx_name(int ctype)
---
-2.34.1
-
+++ /dev/null
-From 151827a9c319defea9b62dfd2a7d7f01020d6d4d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 21 Jan 2022 12:04:43 +0530
-Subject: octeontx2-pf: cn10k: Ensure valid pointers are freed to aura
-
-From: Geetha sowjanya <gakula@marvell.com>
-
-[ Upstream commit c5d731c54a17677939bd59ee8be4ed74d7485ba4 ]
-
-While freeing SQB pointers to aura, driver first memcpy to
-target address and then triggers lmtst operation to free pointer
-to the aura. We need to ensure(by adding dmb barrier)that memcpy
-is finished before pointers are freed to the aura. This patch also
-adds the missing sq context structure entry in debugfs.
-
-Fixes: ef6c8da71eaf ("octeontx2-pf: cn10K: Reserve LMTST lines per core")
-Signed-off-by: Geetha sowjanya <gakula@marvell.com>
-Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
-Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 2 ++
- drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h | 1 +
- 2 files changed, 3 insertions(+)
-
-diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
-index 49d822a98adab..f001579569a2b 100644
---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
-@@ -1131,6 +1131,8 @@ static void print_nix_cn10k_sq_ctx(struct seq_file *m,
- seq_printf(m, "W3: head_offset\t\t\t%d\nW3: smenq_next_sqb_vld\t\t%d\n\n",
- sq_ctx->head_offset, sq_ctx->smenq_next_sqb_vld);
-
-+ seq_printf(m, "W3: smq_next_sq_vld\t\t%d\nW3: smq_pend\t\t\t%d\n",
-+ sq_ctx->smq_next_sq_vld, sq_ctx->smq_pend);
- seq_printf(m, "W4: next_sqb \t\t\t%llx\n\n", sq_ctx->next_sqb);
- seq_printf(m, "W5: tail_sqb \t\t\t%llx\n\n", sq_ctx->tail_sqb);
- seq_printf(m, "W6: smenq_sqb \t\t\t%llx\n\n", sq_ctx->smenq_sqb);
-diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
-index a51ecd771d075..637450de189c8 100644
---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
-+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
-@@ -591,6 +591,7 @@ static inline void __cn10k_aura_freeptr(struct otx2_nic *pfvf, u64 aura,
- size++;
- tar_addr |= ((size - 1) & 0x7) << 4;
- }
-+ dma_wmb();
- memcpy((u64 *)lmt_info->lmt_addr, ptrs, sizeof(u64) * num_ptrs);
- /* Perform LMTST flush */
- cn10k_lmt_flush(val, tar_addr);
---
-2.34.1
-
+++ /dev/null
-From 29d56c6e916db60465980559f9b55325de7c712a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 21 Jan 2022 12:04:46 +0530
-Subject: octeontx2-pf: Forward error codes to VF
-
-From: Subbaraya Sundeep <sbhatta@marvell.com>
-
-[ Upstream commit a8db854be28622a2477cb21cdf7f829adbb2c42d ]
-
-PF forwards its VF messages to AF and corresponding
-replies from AF to VF. AF sets proper error code in the
-replies after processing message requests. Currently PF
-checks the error codes in replies and sends invalid
-message to VF. This way VF lacks the information of
-error code set by AF for its messages. This patch
-changes that such that PF simply forwards AF replies
-so that VF can handle error codes.
-
-Fixes: d424b6c02415 ("octeontx2-pf: Enable SRIOV and added VF mbox handling")
-Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
-Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
-index 53a3e8de1a51e..b1894d4045b8d 100644
---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
-@@ -386,7 +386,12 @@ static int otx2_forward_vf_mbox_msgs(struct otx2_nic *pf,
- dst_mdev->msg_size = mbox_hdr->msg_size;
- dst_mdev->num_msgs = num_msgs;
- err = otx2_sync_mbox_msg(dst_mbox);
-- if (err) {
-+ /* Error code -EIO indicate there is a communication failure
-+ * to the AF. Rest of the error codes indicate that AF processed
-+ * VF messages and set the error codes in response messages
-+ * (if any) so simply forward responses to VF.
-+ */
-+ if (err == -EIO) {
- dev_warn(pf->dev,
- "AF not responding to VF%d messages\n", vf);
- /* restore PF mbase and exit */
---
-2.34.1
-
+++ /dev/null
-From 4d6931e6690fd6e284ff921ccf7de74879ff611e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 20 Dec 2021 13:19:52 +0100
-Subject: perf: Fix perf_event_read_local() time
-
-From: Peter Zijlstra <peterz@infradead.org>
-
-[ Upstream commit 09f5e7dc7ad705289e1b1ec065439aa3c42951c4 ]
-
-Time readers that cannot take locks (due to NMI etc..) currently make
-use of perf_event::shadow_ctx_time, which, for that event gives:
-
- time' = now + (time - timestamp)
-
-or, alternatively arranged:
-
- time' = time + (now - timestamp)
-
-IOW, the progression of time since the last time the shadow_ctx_time
-was updated.
-
-There's problems with this:
-
- A) the shadow_ctx_time is per-event, even though the ctx_time it
- reflects is obviously per context. The direct concequence of this
- is that the context needs to iterate all events all the time to
- keep the shadow_ctx_time in sync.
-
- B) even with the prior point, the context itself might not be active
- meaning its time should not advance to begin with.
-
- C) shadow_ctx_time isn't consistently updated when ctx_time is
-
-There are 3 users of this stuff, that suffer differently from this:
-
- - calc_timer_values()
- - perf_output_read()
- - perf_event_update_userpage() /* A */
-
- - perf_event_read_local() /* A,B */
-
-In particular, perf_output_read() doesn't suffer at all, because it's
-sample driven and hence only relevant when the event is actually
-running.
-
-This same was supposed to be true for perf_event_update_userpage(),
-after all self-monitoring implies the context is active *HOWEVER*, as
-per commit f79256532682 ("perf/core: fix userpage->time_enabled of
-inactive events") this goes wrong when combined with counter
-overcommit, in that case those events that do not get scheduled when
-the context becomes active (task events typically) miss out on the
-EVENT_TIME update and ENABLED time is inflated (for a little while)
-with the time the context was inactive. Once the event gets rotated
-in, this gets corrected, leading to a non-monotonic timeflow.
-
-perf_event_read_local() made things even worse, it can request time at
-any point, suffering all the problems perf_event_update_userpage()
-does and more. Because while perf_event_update_userpage() is limited
-by the context being active, perf_event_read_local() users have no
-such constraint.
-
-Therefore, completely overhaul things and do away with
-perf_event::shadow_ctx_time. Instead have regular context time updates
-keep track of this offset directly and provide perf_event_time_now()
-to complement perf_event_time().
-
-perf_event_time_now() will, in adition to being context wide, also
-take into account if the context is active. For inactive context, it
-will not advance time.
-
-This latter property means the cgroup perf_cgroup_info context needs
-to grow addition state to track this.
-
-Additionally, since all this is strictly per-cpu, we can use barrier()
-to order context activity vs context time.
-
-Fixes: 7d9285e82db5 ("perf/bpf: Extend the perf_event_read_local() interface, a.k.a. "bpf: perf event change needed for subsequent bpf helpers"")
-Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
-Tested-by: Song Liu <song@kernel.org>
-Tested-by: Namhyung Kim <namhyung@kernel.org>
-Link: https://lkml.kernel.org/r/YcB06DasOBtU0b00@hirez.programming.kicks-ass.net
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/perf_event.h | 15 +--
- kernel/events/core.c | 246 ++++++++++++++++++++++---------------
- 2 files changed, 149 insertions(+), 112 deletions(-)
-
-diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
-index ae1f0c8b75623..6cce33e7e7acc 100644
---- a/include/linux/perf_event.h
-+++ b/include/linux/perf_event.h
-@@ -680,18 +680,6 @@ struct perf_event {
- u64 total_time_running;
- u64 tstamp;
-
-- /*
-- * timestamp shadows the actual context timing but it can
-- * be safely used in NMI interrupt context. It reflects the
-- * context time as it was when the event was last scheduled in,
-- * or when ctx_sched_in failed to schedule the event because we
-- * run out of PMC.
-- *
-- * ctx_time already accounts for ctx->timestamp. Therefore to
-- * compute ctx_time for a sample, simply add perf_clock().
-- */
-- u64 shadow_ctx_time;
--
- struct perf_event_attr attr;
- u16 header_size;
- u16 id_header_size;
-@@ -838,6 +826,7 @@ struct perf_event_context {
- */
- u64 time;
- u64 timestamp;
-+ u64 timeoffset;
-
- /*
- * These fields let us detect when two contexts have both
-@@ -920,6 +909,8 @@ struct bpf_perf_event_data_kern {
- struct perf_cgroup_info {
- u64 time;
- u64 timestamp;
-+ u64 timeoffset;
-+ int active;
- };
-
- struct perf_cgroup {
-diff --git a/kernel/events/core.c b/kernel/events/core.c
-index 0fe6a65bbd58f..0153f8f972834 100644
---- a/kernel/events/core.c
-+++ b/kernel/events/core.c
-@@ -674,6 +674,23 @@ perf_event_set_state(struct perf_event *event, enum perf_event_state state)
- WRITE_ONCE(event->state, state);
- }
-
-+/*
-+ * UP store-release, load-acquire
-+ */
-+
-+#define __store_release(ptr, val) \
-+do { \
-+ barrier(); \
-+ WRITE_ONCE(*(ptr), (val)); \
-+} while (0)
-+
-+#define __load_acquire(ptr) \
-+({ \
-+ __unqual_scalar_typeof(*(ptr)) ___p = READ_ONCE(*(ptr)); \
-+ barrier(); \
-+ ___p; \
-+})
-+
- #ifdef CONFIG_CGROUP_PERF
-
- static inline bool
-@@ -719,34 +736,51 @@ static inline u64 perf_cgroup_event_time(struct perf_event *event)
- return t->time;
- }
-
--static inline void __update_cgrp_time(struct perf_cgroup *cgrp)
-+static inline u64 perf_cgroup_event_time_now(struct perf_event *event, u64 now)
- {
-- struct perf_cgroup_info *info;
-- u64 now;
--
-- now = perf_clock();
-+ struct perf_cgroup_info *t;
-
-- info = this_cpu_ptr(cgrp->info);
-+ t = per_cpu_ptr(event->cgrp->info, event->cpu);
-+ if (!__load_acquire(&t->active))
-+ return t->time;
-+ now += READ_ONCE(t->timeoffset);
-+ return now;
-+}
-
-- info->time += now - info->timestamp;
-+static inline void __update_cgrp_time(struct perf_cgroup_info *info, u64 now, bool adv)
-+{
-+ if (adv)
-+ info->time += now - info->timestamp;
- info->timestamp = now;
-+ /*
-+ * see update_context_time()
-+ */
-+ WRITE_ONCE(info->timeoffset, info->time - info->timestamp);
- }
-
--static inline void update_cgrp_time_from_cpuctx(struct perf_cpu_context *cpuctx)
-+static inline void update_cgrp_time_from_cpuctx(struct perf_cpu_context *cpuctx, bool final)
- {
- struct perf_cgroup *cgrp = cpuctx->cgrp;
- struct cgroup_subsys_state *css;
-+ struct perf_cgroup_info *info;
-
- if (cgrp) {
-+ u64 now = perf_clock();
-+
- for (css = &cgrp->css; css; css = css->parent) {
- cgrp = container_of(css, struct perf_cgroup, css);
-- __update_cgrp_time(cgrp);
-+ info = this_cpu_ptr(cgrp->info);
-+
-+ __update_cgrp_time(info, now, true);
-+ if (final)
-+ __store_release(&info->active, 0);
- }
- }
- }
-
- static inline void update_cgrp_time_from_event(struct perf_event *event)
- {
-+ struct perf_cgroup_info *info;
- struct perf_cgroup *cgrp;
-
- /*
-@@ -760,8 +794,10 @@ static inline void update_cgrp_time_from_event(struct perf_event *event)
- /*
- * Do not update time when cgroup is not active
- */
-- if (cgroup_is_descendant(cgrp->css.cgroup, event->cgrp->css.cgroup))
-- __update_cgrp_time(event->cgrp);
-+ if (cgroup_is_descendant(cgrp->css.cgroup, event->cgrp->css.cgroup)) {
-+ info = this_cpu_ptr(event->cgrp->info);
-+ __update_cgrp_time(info, perf_clock(), true);
-+ }
- }
-
- static inline void
-@@ -785,7 +821,8 @@ perf_cgroup_set_timestamp(struct task_struct *task,
- for (css = &cgrp->css; css; css = css->parent) {
- cgrp = container_of(css, struct perf_cgroup, css);
- info = this_cpu_ptr(cgrp->info);
-- info->timestamp = ctx->timestamp;
-+ __update_cgrp_time(info, ctx->timestamp, false);
-+ __store_release(&info->active, 1);
- }
- }
-
-@@ -981,14 +1018,6 @@ out:
- return ret;
- }
-
--static inline void
--perf_cgroup_set_shadow_time(struct perf_event *event, u64 now)
--{
-- struct perf_cgroup_info *t;
-- t = per_cpu_ptr(event->cgrp->info, event->cpu);
-- event->shadow_ctx_time = now - t->timestamp;
--}
--
- static inline void
- perf_cgroup_event_enable(struct perf_event *event, struct perf_event_context *ctx)
- {
-@@ -1066,7 +1095,8 @@ static inline void update_cgrp_time_from_event(struct perf_event *event)
- {
- }
-
--static inline void update_cgrp_time_from_cpuctx(struct perf_cpu_context *cpuctx)
-+static inline void update_cgrp_time_from_cpuctx(struct perf_cpu_context *cpuctx,
-+ bool final)
- {
- }
-
-@@ -1098,12 +1128,12 @@ perf_cgroup_switch(struct task_struct *task, struct task_struct *next)
- {
- }
-
--static inline void
--perf_cgroup_set_shadow_time(struct perf_event *event, u64 now)
-+static inline u64 perf_cgroup_event_time(struct perf_event *event)
- {
-+ return 0;
- }
-
--static inline u64 perf_cgroup_event_time(struct perf_event *event)
-+static inline u64 perf_cgroup_event_time_now(struct perf_event *event, u64 now)
- {
- return 0;
- }
-@@ -1525,22 +1555,59 @@ static void perf_unpin_context(struct perf_event_context *ctx)
- /*
- * Update the record of the current time in a context.
- */
--static void update_context_time(struct perf_event_context *ctx)
-+static void __update_context_time(struct perf_event_context *ctx, bool adv)
- {
- u64 now = perf_clock();
-
-- ctx->time += now - ctx->timestamp;
-+ if (adv)
-+ ctx->time += now - ctx->timestamp;
- ctx->timestamp = now;
-+
-+ /*
-+ * The above: time' = time + (now - timestamp), can be re-arranged
-+ * into: time` = now + (time - timestamp), which gives a single value
-+ * offset to compute future time without locks on.
-+ *
-+ * See perf_event_time_now(), which can be used from NMI context where
-+ * it's (obviously) not possible to acquire ctx->lock in order to read
-+ * both the above values in a consistent manner.
-+ */
-+ WRITE_ONCE(ctx->timeoffset, ctx->time - ctx->timestamp);
-+}
-+
-+static void update_context_time(struct perf_event_context *ctx)
-+{
-+ __update_context_time(ctx, true);
- }
-
- static u64 perf_event_time(struct perf_event *event)
- {
- struct perf_event_context *ctx = event->ctx;
-
-+ if (unlikely(!ctx))
-+ return 0;
-+
- if (is_cgroup_event(event))
- return perf_cgroup_event_time(event);
-
-- return ctx ? ctx->time : 0;
-+ return ctx->time;
-+}
-+
-+static u64 perf_event_time_now(struct perf_event *event, u64 now)
-+{
-+ struct perf_event_context *ctx = event->ctx;
-+
-+ if (unlikely(!ctx))
-+ return 0;
-+
-+ if (is_cgroup_event(event))
-+ return perf_cgroup_event_time_now(event, now);
-+
-+ if (!(__load_acquire(&ctx->is_active) & EVENT_TIME))
-+ return ctx->time;
-+
-+ now += READ_ONCE(ctx->timeoffset);
-+ return now;
- }
-
- static enum event_type_t get_event_type(struct perf_event *event)
-@@ -2346,7 +2413,7 @@ __perf_remove_from_context(struct perf_event *event,
-
- if (ctx->is_active & EVENT_TIME) {
- update_context_time(ctx);
-- update_cgrp_time_from_cpuctx(cpuctx);
-+ update_cgrp_time_from_cpuctx(cpuctx, false);
- }
-
- event_sched_out(event, cpuctx, ctx);
-@@ -2357,6 +2424,9 @@ __perf_remove_from_context(struct perf_event *event,
- list_del_event(event, ctx);
-
- if (!ctx->nr_events && ctx->is_active) {
-+ if (ctx == &cpuctx->ctx)
-+ update_cgrp_time_from_cpuctx(cpuctx, true);
-+
- ctx->is_active = 0;
- ctx->rotate_necessary = 0;
- if (ctx->task) {
-@@ -2478,40 +2548,6 @@ void perf_event_disable_inatomic(struct perf_event *event)
- irq_work_queue(&event->pending);
- }
-
--static void perf_set_shadow_time(struct perf_event *event,
-- struct perf_event_context *ctx)
--{
-- /*
-- * use the correct time source for the time snapshot
-- *
-- * We could get by without this by leveraging the
-- * fact that to get to this function, the caller
-- * has most likely already called update_context_time()
-- * and update_cgrp_time_xx() and thus both timestamp
-- * are identical (or very close). Given that tstamp is,
-- * already adjusted for cgroup, we could say that:
-- * tstamp - ctx->timestamp
-- * is equivalent to
-- * tstamp - cgrp->timestamp.
-- *
-- * Then, in perf_output_read(), the calculation would
-- * work with no changes because:
-- * - event is guaranteed scheduled in
-- * - no scheduled out in between
-- * - thus the timestamp would be the same
-- *
-- * But this is a bit hairy.
-- *
-- * So instead, we have an explicit cgroup call to remain
-- * within the time source all along. We believe it
-- * is cleaner and simpler to understand.
-- */
-- if (is_cgroup_event(event))
-- perf_cgroup_set_shadow_time(event, event->tstamp);
-- else
-- event->shadow_ctx_time = event->tstamp - ctx->timestamp;
--}
--
- #define MAX_INTERRUPTS (~0ULL)
-
- static void perf_log_throttle(struct perf_event *event, int enable);
-@@ -2552,8 +2588,6 @@ event_sched_in(struct perf_event *event,
-
- perf_pmu_disable(event->pmu);
-
-- perf_set_shadow_time(event, ctx);
--
- perf_log_itrace_start(event);
-
- if (event->pmu->add(event, PERF_EF_START)) {
-@@ -3247,16 +3281,6 @@ static void ctx_sched_out(struct perf_event_context *ctx,
- return;
- }
-
-- ctx->is_active &= ~event_type;
-- if (!(ctx->is_active & EVENT_ALL))
-- ctx->is_active = 0;
--
-- if (ctx->task) {
-- WARN_ON_ONCE(cpuctx->task_ctx != ctx);
-- if (!ctx->is_active)
-- cpuctx->task_ctx = NULL;
-- }
--
- /*
- * Always update time if it was set; not only when it changes.
- * Otherwise we can 'forget' to update time for any but the last
-@@ -3270,7 +3294,22 @@ static void ctx_sched_out(struct perf_event_context *ctx,
- if (is_active & EVENT_TIME) {
- /* update (and stop) ctx time */
- update_context_time(ctx);
-- update_cgrp_time_from_cpuctx(cpuctx);
-+ update_cgrp_time_from_cpuctx(cpuctx, ctx == &cpuctx->ctx);
-+ /*
-+ * CPU-release for the below ->is_active store,
-+ * see __load_acquire() in perf_event_time_now()
-+ */
-+ barrier();
-+ }
-+
-+ ctx->is_active &= ~event_type;
-+ if (!(ctx->is_active & EVENT_ALL))
-+ ctx->is_active = 0;
-+
-+ if (ctx->task) {
-+ WARN_ON_ONCE(cpuctx->task_ctx != ctx);
-+ if (!ctx->is_active)
-+ cpuctx->task_ctx = NULL;
- }
-
- is_active ^= ctx->is_active; /* changed bits */
-@@ -3707,13 +3746,19 @@ static noinline int visit_groups_merge(struct perf_cpu_context *cpuctx,
- return 0;
- }
-
-+/*
-+ * Because the userpage is strictly per-event (there is no concept of context,
-+ * so there cannot be a context indirection), every userpage must be updated
-+ * when context time starts :-(
-+ *
-+ * IOW, we must not miss EVENT_TIME edges.
-+ */
- static inline bool event_update_userpage(struct perf_event *event)
- {
- if (likely(!atomic_read(&event->mmap_count)))
- return false;
-
- perf_event_update_time(event);
-- perf_set_shadow_time(event, event->ctx);
- perf_event_update_userpage(event);
-
- return true;
-@@ -3797,13 +3842,23 @@ ctx_sched_in(struct perf_event_context *ctx,
- struct task_struct *task)
- {
- int is_active = ctx->is_active;
-- u64 now;
-
- lockdep_assert_held(&ctx->lock);
-
- if (likely(!ctx->nr_events))
- return;
-
-+ if (is_active ^ EVENT_TIME) {
-+ /* start ctx time */
-+ __update_context_time(ctx, false);
-+ perf_cgroup_set_timestamp(task, ctx);
-+ /*
-+ * CPU-release for the below ->is_active store,
-+ * see __load_acquire() in perf_event_time_now()
-+ */
-+ barrier();
-+ }
-+
- ctx->is_active |= (event_type | EVENT_TIME);
- if (ctx->task) {
- if (!is_active)
-@@ -3814,13 +3869,6 @@ ctx_sched_in(struct perf_event_context *ctx,
-
- is_active ^= ctx->is_active; /* changed bits */
-
-- if (is_active & EVENT_TIME) {
-- /* start ctx time */
-- now = perf_clock();
-- ctx->timestamp = now;
-- perf_cgroup_set_timestamp(task, ctx);
-- }
--
- /*
- * First go through the list and put on any pinned groups
- * in order to give them the best chance of going on.
-@@ -4414,6 +4462,18 @@ static inline u64 perf_event_count(struct perf_event *event)
- return local64_read(&event->count) + atomic64_read(&event->child_count);
- }
-
-+static void calc_timer_values(struct perf_event *event,
-+ u64 *now,
-+ u64 *enabled,
-+ u64 *running)
-+{
-+ u64 ctx_time;
-+
-+ *now = perf_clock();
-+ ctx_time = perf_event_time_now(event, *now);
-+ __perf_update_times(event, ctx_time, enabled, running);
-+}
-+
- /*
- * NMI-safe method to read a local event, that is an event that
- * is:
-@@ -4473,10 +4533,9 @@ int perf_event_read_local(struct perf_event *event, u64 *value,
-
- *value = local64_read(&event->count);
- if (enabled || running) {
-- u64 now = event->shadow_ctx_time + perf_clock();
-- u64 __enabled, __running;
-+ u64 __enabled, __running, __now;;
-
-- __perf_update_times(event, now, &__enabled, &__running);
-+ calc_timer_values(event, &__now, &__enabled, &__running);
- if (enabled)
- *enabled = __enabled;
- if (running)
-@@ -5798,18 +5857,6 @@ static int perf_event_index(struct perf_event *event)
- return event->pmu->event_idx(event);
- }
-
--static void calc_timer_values(struct perf_event *event,
-- u64 *now,
-- u64 *enabled,
-- u64 *running)
--{
-- u64 ctx_time;
--
-- *now = perf_clock();
-- ctx_time = event->shadow_ctx_time + *now;
-- __perf_update_times(event, ctx_time, enabled, running);
--}
--
- static void perf_event_init_userpage(struct perf_event *event)
- {
- struct perf_event_mmap_page *userpg;
-@@ -6349,7 +6396,6 @@ accounting:
- ring_buffer_attach(event, rb);
-
- perf_event_update_time(event);
-- perf_set_shadow_time(event, event->ctx);
- perf_event_init_userpage(event);
- perf_event_update_userpage(event);
- } else {
---
-2.34.1
-
+++ /dev/null
-From a44e71ae548daa66922b77370ac4521f5d093e67 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 19 Jan 2022 17:27:48 +0100
-Subject: phylib: fix potential use-after-free
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Marek Behún <kabel@kernel.org>
-
-[ Upstream commit cbda1b16687580d5beee38273f6241ae3725960c ]
-
-Commit bafbdd527d56 ("phylib: Add device reset GPIO support") added call
-to phy_device_reset(phydev) after the put_device() call in phy_detach().
-
-The comment before the put_device() call says that the phydev might go
-away with put_device().
-
-Fix potential use-after-free by calling phy_device_reset() before
-put_device().
-
-Fixes: bafbdd527d56 ("phylib: Add device reset GPIO support")
-Signed-off-by: Marek Behún <kabel@kernel.org>
-Reviewed-by: Andrew Lunn <andrew@lunn.ch>
-Link: https://lore.kernel.org/r/20220119162748.32418-1-kabel@kernel.org
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/phy/phy_device.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
-index 4f9990b47a377..28f4a383aba72 100644
---- a/drivers/net/phy/phy_device.c
-+++ b/drivers/net/phy/phy_device.c
-@@ -1746,6 +1746,9 @@ void phy_detach(struct phy_device *phydev)
- phy_driver_is_genphy_10g(phydev))
- device_release_driver(&phydev->mdio.dev);
-
-+ /* Assert the reset signal */
-+ phy_device_reset(phydev, 1);
-+
- /*
- * The phydev might go away on the put_device() below, so avoid
- * a use-after-free bug by reading the underlying bus first.
-@@ -1757,9 +1760,6 @@ void phy_detach(struct phy_device *phydev)
- ndev_owner = dev->dev.parent->driver->owner;
- if (ndev_owner != bus->owner)
- module_put(bus->owner);
--
-- /* Assert the reset signal */
-- phy_device_reset(phydev, 1);
- }
- EXPORT_SYMBOL(phy_detach);
-
---
-2.34.1
-
+++ /dev/null
-From a60870bb69102260d42727c204b54bab291976ec Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 22 Jan 2022 06:40:56 -0500
-Subject: ping: fix the sk_bound_dev_if match in ping_lookup
-
-From: Xin Long <lucien.xin@gmail.com>
-
-[ Upstream commit 2afc3b5a31f9edf3ef0f374f5d70610c79c93a42 ]
-
-When 'ping' changes to use PING socket instead of RAW socket by:
-
- # sysctl -w net.ipv4.ping_group_range="0 100"
-
-the selftests 'router_broadcast.sh' will fail, as such command
-
- # ip vrf exec vrf-h1 ping -I veth0 198.51.100.255 -b
-
-can't receive the response skb by the PING socket. It's caused by mismatch
-of sk_bound_dev_if and dif in ping_rcv() when looking up the PING socket,
-as dif is vrf-h1 if dif's master was set to vrf-h1.
-
-This patch is to fix this regression by also checking the sk_bound_dev_if
-against sdif so that the packets can stil be received even if the socket
-is not bound to the vrf device but to the real iif.
-
-Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
-Reported-by: Hangbin Liu <liuhangbin@gmail.com>
-Signed-off-by: Xin Long <lucien.xin@gmail.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv4/ping.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
-index 1e44a43acfe2d..086822cb1cc96 100644
---- a/net/ipv4/ping.c
-+++ b/net/ipv4/ping.c
-@@ -220,7 +220,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
- continue;
- }
-
-- if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif)
-+ if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif &&
-+ sk->sk_bound_dev_if != inet_sdif(skb))
- continue;
-
- sock_hold(sk);
---
-2.34.1
-
+++ /dev/null
-From 286b222bff3009546115e507a967084a2e963908 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 17 Jan 2022 23:44:03 +1000
-Subject: powerpc/64s: Mask SRR0 before checking against the masked NIP
-
-From: Nicholas Piggin <npiggin@gmail.com>
-
-[ Upstream commit aee101d7b95a03078945681dd7f7ea5e4a1e7686 ]
-
-Commit 314f6c23dd8d ("powerpc/64s: Mask NIP before checking against
-SRR0") masked off the low 2 bits of the NIP value in the interrupt
-stack frame in case they are non-zero and mis-compare against a SRR0
-register value of a CPU which always reads back 0 from the 2 low bits
-which are reserved.
-
-This now causes the opposite problem that an implementation which does
-implement those bits in SRR0 will mis-compare against the masked NIP
-value in which they have been cleared. QEMU is one such implementation,
-and this is allowed by the architecture.
-
-This can be triggered by sigfuz by setting low bits of PT_NIP in the
-signal context.
-
-Fix this for now by masking the SRR0 bits as well. Cleaner is probably
-to sanitise these values before putting them in registers or stack, but
-this is the quick and backportable fix.
-
-Fixes: 314f6c23dd8d ("powerpc/64s: Mask NIP before checking against SRR0")
-Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
-Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
-Link: https://lore.kernel.org/r/20220117134403.2995059-1-npiggin@gmail.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/powerpc/kernel/interrupt_64.S | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/arch/powerpc/kernel/interrupt_64.S b/arch/powerpc/kernel/interrupt_64.S
-index 4b1ff94e67eb4..4c6d1a8dcefed 100644
---- a/arch/powerpc/kernel/interrupt_64.S
-+++ b/arch/powerpc/kernel/interrupt_64.S
-@@ -30,6 +30,7 @@ COMPAT_SYS_CALL_TABLE:
- .ifc \srr,srr
- mfspr r11,SPRN_SRR0
- ld r12,_NIP(r1)
-+ clrrdi r11,r11,2
- clrrdi r12,r12,2
- 100: tdne r11,r12
- EMIT_WARN_ENTRY 100b,__FILE__,__LINE__,(BUGFLAG_WARNING | BUGFLAG_ONCE)
-@@ -40,6 +41,7 @@ COMPAT_SYS_CALL_TABLE:
- .else
- mfspr r11,SPRN_HSRR0
- ld r12,_NIP(r1)
-+ clrrdi r11,r11,2
- clrrdi r12,r12,2
- 100: tdne r11,r12
- EMIT_WARN_ENTRY 100b,__FILE__,__LINE__,(BUGFLAG_WARNING | BUGFLAG_ONCE)
---
-2.34.1
-
+++ /dev/null
-From 99eb14bfc0d1c0cf5258b18e06599a02f0f7a405 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 22 Jan 2022 09:04:29 +0530
-Subject: powerpc/perf: Fix power_pmu_disable to call clear_pmi_irq_pending
- only if PMI is pending
-
-From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
-
-[ Upstream commit fb6433b48a178d4672cb26632454ee0b21056eaa ]
-
-Running selftest with CONFIG_PPC_IRQ_SOFT_MASK_DEBUG enabled in kernel
-triggered below warning:
-
-[ 172.851380] ------------[ cut here ]------------
-[ 172.851391] WARNING: CPU: 8 PID: 2901 at arch/powerpc/include/asm/hw_irq.h:246 power_pmu_disable+0x270/0x280
-[ 172.851402] Modules linked in: dm_mod bonding nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables rfkill nfnetlink sunrpc xfs libcrc32c pseries_rng xts vmx_crypto uio_pdrv_genirq uio sch_fq_codel ip_tables ext4 mbcache jbd2 sd_mod t10_pi sg ibmvscsi ibmveth scsi_transport_srp fuse
-[ 172.851442] CPU: 8 PID: 2901 Comm: lost_exception_ Not tainted 5.16.0-rc5-03218-g798527287598 #2
-[ 172.851451] NIP: c00000000013d600 LR: c00000000013d5a4 CTR: c00000000013b180
-[ 172.851458] REGS: c000000017687860 TRAP: 0700 Not tainted (5.16.0-rc5-03218-g798527287598)
-[ 172.851465] MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 48004884 XER: 20040000
-[ 172.851482] CFAR: c00000000013d5b4 IRQMASK: 1
-[ 172.851482] GPR00: c00000000013d5a4 c000000017687b00 c000000002a10600 0000000000000004
-[ 172.851482] GPR04: 0000000082004000 c0000008ba08f0a8 0000000000000000 00000008b7ed0000
-[ 172.851482] GPR08: 00000000446194f6 0000000000008000 c00000000013b118 c000000000d58e68
-[ 172.851482] GPR12: c00000000013d390 c00000001ec54a80 0000000000000000 0000000000000000
-[ 172.851482] GPR16: 0000000000000000 0000000000000000 c000000015d5c708 c0000000025396d0
-[ 172.851482] GPR20: 0000000000000000 0000000000000000 c00000000a3bbf40 0000000000000003
-[ 172.851482] GPR24: 0000000000000000 c0000008ba097400 c0000000161e0d00 c00000000a3bb600
-[ 172.851482] GPR28: c000000015d5c700 0000000000000001 0000000082384090 c0000008ba0020d8
-[ 172.851549] NIP [c00000000013d600] power_pmu_disable+0x270/0x280
-[ 172.851557] LR [c00000000013d5a4] power_pmu_disable+0x214/0x280
-[ 172.851565] Call Trace:
-[ 172.851568] [c000000017687b00] [c00000000013d5a4] power_pmu_disable+0x214/0x280 (unreliable)
-[ 172.851579] [c000000017687b40] [c0000000003403ac] perf_pmu_disable+0x4c/0x60
-[ 172.851588] [c000000017687b60] [c0000000003445e4] __perf_event_task_sched_out+0x1d4/0x660
-[ 172.851596] [c000000017687c50] [c000000000d1175c] __schedule+0xbcc/0x12a0
-[ 172.851602] [c000000017687d60] [c000000000d11ea8] schedule+0x78/0x140
-[ 172.851608] [c000000017687d90] [c0000000001a8080] sys_sched_yield+0x20/0x40
-[ 172.851615] [c000000017687db0] [c0000000000334dc] system_call_exception+0x18c/0x380
-[ 172.851622] [c000000017687e10] [c00000000000c74c] system_call_common+0xec/0x268
-
-The warning indicates that MSR_EE being set(interrupt enabled) when
-there was an overflown PMC detected. This could happen in
-power_pmu_disable since it runs under interrupt soft disable
-condition ( local_irq_save ) and not with interrupts hard disabled.
-commit 2c9ac51b850d ("powerpc/perf: Fix PMU callbacks to clear
-pending PMI before resetting an overflown PMC") intended to clear
-PMI pending bit in Paca when disabling the PMU. It could happen
-that PMC gets overflown while code is in power_pmu_disable
-callback function. Hence add a check to see if PMI pending bit
-is set in Paca before clearing it via clear_pmi_pending.
-
-Fixes: 2c9ac51b850d ("powerpc/perf: Fix PMU callbacks to clear pending PMI before resetting an overflown PMC")
-Reported-by: Sachin Sant <sachinp@linux.ibm.com>
-Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
-Tested-by: Sachin Sant <sachinp@linux.ibm.com>
-Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
-Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
-Link: https://lore.kernel.org/r/20220122033429.25395-1-atrajeev@linux.vnet.ibm.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/powerpc/perf/core-book3s.c | 17 ++++++++++++++---
- 1 file changed, 14 insertions(+), 3 deletions(-)
-
-diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
-index bef6b1abce702..e78de70509472 100644
---- a/arch/powerpc/perf/core-book3s.c
-+++ b/arch/powerpc/perf/core-book3s.c
-@@ -1326,9 +1326,20 @@ static void power_pmu_disable(struct pmu *pmu)
- * Otherwise provide a warning if there is PMI pending, but
- * no counter is found overflown.
- */
-- if (any_pmc_overflown(cpuhw))
-- clear_pmi_irq_pending();
-- else
-+ if (any_pmc_overflown(cpuhw)) {
-+ /*
-+ * Since power_pmu_disable runs under local_irq_save, it
-+ * could happen that code hits a PMC overflow without PMI
-+ * pending in paca. Hence only clear PMI pending if it was
-+ * set.
-+ *
-+ * If a PMI is pending, then MSR[EE] must be disabled (because
-+ * the masked PMI handler disabling EE). So it is safe to
-+ * call clear_pmi_irq_pending().
-+ */
-+ if (pmi_irq_pending())
-+ clear_pmi_irq_pending();
-+ } else
- WARN_ON(pmi_irq_pending());
-
- val = mmcra = cpuhw->mmcr.mmcra;
---
-2.34.1
-
+++ /dev/null
-From cb844a2cdd4bb99a71b0fc10505453a5b2b51df0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jan 2022 17:15:12 +0530
-Subject: powerpc64/bpf: Limit 'ldbrx' to processors compliant with ISA v2.06
-
-From: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
-
-[ Upstream commit 3f5f766d5f7f95a69a630da3544a1a0cee1cdddf ]
-
-Johan reported the below crash with test_bpf on ppc64 e5500:
-
- test_bpf: #296 ALU_END_FROM_LE 64: 0x0123456789abcdef -> 0x67452301 jited:1
- Oops: Exception in kernel mode, sig: 4 [#1]
- BE PAGE_SIZE=4K SMP NR_CPUS=24 QEMU e500
- Modules linked in: test_bpf(+)
- CPU: 0 PID: 76 Comm: insmod Not tainted 5.14.0-03771-g98c2059e008a-dirty #1
- NIP: 8000000000061c3c LR: 80000000006dea64 CTR: 8000000000061c18
- REGS: c0000000032d3420 TRAP: 0700 Not tainted (5.14.0-03771-g98c2059e008a-dirty)
- MSR: 0000000080089000 <EE,ME> CR: 88002822 XER: 20000000 IRQMASK: 0
- <...>
- NIP [8000000000061c3c] 0x8000000000061c3c
- LR [80000000006dea64] .__run_one+0x104/0x17c [test_bpf]
- Call Trace:
- .__run_one+0x60/0x17c [test_bpf] (unreliable)
- .test_bpf_init+0x6a8/0xdc8 [test_bpf]
- .do_one_initcall+0x6c/0x28c
- .do_init_module+0x68/0x28c
- .load_module+0x2460/0x2abc
- .__do_sys_init_module+0x120/0x18c
- .system_call_exception+0x110/0x1b8
- system_call_common+0xf0/0x210
- --- interrupt: c00 at 0x101d0acc
- <...>
- ---[ end trace 47b2bf19090bb3d0 ]---
-
- Illegal instruction
-
-The illegal instruction turned out to be 'ldbrx' emitted for
-BPF_FROM_[L|B]E, which was only introduced in ISA v2.06. Guard use of
-the same and implement an alternative approach for older processors.
-
-Fixes: 156d0e290e969c ("powerpc/ebpf/jit: Implement JIT compiler for extended BPF")
-Reported-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
-Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
-Tested-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
-Acked-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
-Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
-Link: https://lore.kernel.org/r/d1e51c6fdf572062cf3009a751c3406bda01b832.1641468127.git.naveen.n.rao@linux.vnet.ibm.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/powerpc/include/asm/ppc-opcode.h | 1 +
- arch/powerpc/net/bpf_jit_comp64.c | 22 +++++++++++++---------
- 2 files changed, 14 insertions(+), 9 deletions(-)
-
-diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h
-index baea657bc8687..bca31a61e57f8 100644
---- a/arch/powerpc/include/asm/ppc-opcode.h
-+++ b/arch/powerpc/include/asm/ppc-opcode.h
-@@ -498,6 +498,7 @@
- #define PPC_RAW_LDX(r, base, b) (0x7c00002a | ___PPC_RT(r) | ___PPC_RA(base) | ___PPC_RB(b))
- #define PPC_RAW_LHZ(r, base, i) (0xa0000000 | ___PPC_RT(r) | ___PPC_RA(base) | IMM_L(i))
- #define PPC_RAW_LHBRX(r, base, b) (0x7c00062c | ___PPC_RT(r) | ___PPC_RA(base) | ___PPC_RB(b))
-+#define PPC_RAW_LWBRX(r, base, b) (0x7c00042c | ___PPC_RT(r) | ___PPC_RA(base) | ___PPC_RB(b))
- #define PPC_RAW_LDBRX(r, base, b) (0x7c000428 | ___PPC_RT(r) | ___PPC_RA(base) | ___PPC_RB(b))
- #define PPC_RAW_STWCX(s, a, b) (0x7c00012d | ___PPC_RS(s) | ___PPC_RA(a) | ___PPC_RB(b))
- #define PPC_RAW_CMPWI(a, i) (0x2c000000 | ___PPC_RA(a) | IMM_L(i))
-diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
-index 95a337b5dc2b4..57e1b6680365c 100644
---- a/arch/powerpc/net/bpf_jit_comp64.c
-+++ b/arch/powerpc/net/bpf_jit_comp64.c
-@@ -633,17 +633,21 @@ bpf_alu32_trunc:
- EMIT(PPC_RAW_MR(dst_reg, b2p[TMP_REG_1]));
- break;
- case 64:
-- /*
-- * Way easier and faster(?) to store the value
-- * into stack and then use ldbrx
-- *
-- * ctx->seen will be reliable in pass2, but
-- * the instructions generated will remain the
-- * same across all passes
-- */
-+ /* Store the value to stack and then use byte-reverse loads */
- PPC_BPF_STL(dst_reg, 1, bpf_jit_stack_local(ctx));
- EMIT(PPC_RAW_ADDI(b2p[TMP_REG_1], 1, bpf_jit_stack_local(ctx)));
-- EMIT(PPC_RAW_LDBRX(dst_reg, 0, b2p[TMP_REG_1]));
-+ if (cpu_has_feature(CPU_FTR_ARCH_206)) {
-+ EMIT(PPC_RAW_LDBRX(dst_reg, 0, b2p[TMP_REG_1]));
-+ } else {
-+ EMIT(PPC_RAW_LWBRX(dst_reg, 0, b2p[TMP_REG_1]));
-+ if (IS_ENABLED(CONFIG_CPU_LITTLE_ENDIAN))
-+ EMIT(PPC_RAW_SLDI(dst_reg, dst_reg, 32));
-+ EMIT(PPC_RAW_LI(b2p[TMP_REG_2], 4));
-+ EMIT(PPC_RAW_LWBRX(b2p[TMP_REG_2], b2p[TMP_REG_2], b2p[TMP_REG_1]));
-+ if (IS_ENABLED(CONFIG_CPU_BIG_ENDIAN))
-+ EMIT(PPC_RAW_SLDI(b2p[TMP_REG_2], b2p[TMP_REG_2], 32));
-+ EMIT(PPC_RAW_OR(dst_reg, dst_reg, b2p[TMP_REG_2]));
-+ }
- break;
- }
- break;
---
-2.34.1
-
+++ /dev/null
-From 5bfe55b74c844c3536e721c4a5fd603828707d31 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 20 Jan 2022 14:05:27 +1000
-Subject: Revert "drm/ast: Support 1600x900 with 108MHz PCLK"
-
-From: Dave Airlie <airlied@redhat.com>
-
-[ Upstream commit 76cea3d95513fe40000d06a3719c4bb6b53275e2 ]
-
-This reverts commit 9bb7b689274b67ecb3641e399e76f84adc627df1.
-
-This caused a regression reported to Red Hat.
-
-Fixes: 9bb7b689274b ("drm/ast: Support 1600x900 with 108MHz PCLK")
-Signed-off-by: Dave Airlie <airlied@redhat.com>
-Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
-Link: https://patchwork.freedesktop.org/patch/msgid/20220120040527.552068-1-airlied@gmail.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/ast/ast_tables.h | 2 --
- 1 file changed, 2 deletions(-)
-
-diff --git a/drivers/gpu/drm/ast/ast_tables.h b/drivers/gpu/drm/ast/ast_tables.h
-index d9eb353a4bf09..dbe1cc620f6e6 100644
---- a/drivers/gpu/drm/ast/ast_tables.h
-+++ b/drivers/gpu/drm/ast/ast_tables.h
-@@ -282,8 +282,6 @@ static const struct ast_vbios_enhtable res_1360x768[] = {
- };
-
- static const struct ast_vbios_enhtable res_1600x900[] = {
-- {1800, 1600, 24, 80, 1000, 900, 1, 3, VCLK108, /* 60Hz */
-- (SyncPP | Charx8Dot | LineCompareOff | WideScreenMode | NewModeInfo), 60, 3, 0x3A },
- {1760, 1600, 48, 32, 926, 900, 3, 5, VCLK97_75, /* 60Hz CVT RB */
- (SyncNP | Charx8Dot | LineCompareOff | WideScreenMode | NewModeInfo |
- AST2500PreCatchCRT), 60, 1, 0x3A },
---
-2.34.1
-
+++ /dev/null
-From 27917ca06508f5c8f3320444564f6c00a56dc638 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 26 Jan 2022 16:38:52 +0100
-Subject: Revert "ipv6: Honor all IPv6 PIO Valid Lifetime values"
-
-From: Guillaume Nault <gnault@redhat.com>
-
-[ Upstream commit 36268983e90316b37000a005642af42234dabb36 ]
-
-This reverts commit b75326c201242de9495ff98e5d5cff41d7fc0d9d.
-
-This commit breaks Linux compatibility with USGv6 tests. The RFC this
-commit was based on is actually an expired draft: no published RFC
-currently allows the new behaviour it introduced.
-
-Without full IETF endorsement, the flash renumbering scenario this
-patch was supposed to enable is never going to work, as other IPv6
-equipements on the same LAN will keep the 2 hours limit.
-
-Fixes: b75326c20124 ("ipv6: Honor all IPv6 PIO Valid Lifetime values")
-Signed-off-by: Guillaume Nault <gnault@redhat.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/net/addrconf.h | 2 ++
- net/ipv6/addrconf.c | 27 ++++++++++++++++++++-------
- 2 files changed, 22 insertions(+), 7 deletions(-)
-
-diff --git a/include/net/addrconf.h b/include/net/addrconf.h
-index 78ea3e332688f..e7ce719838b5e 100644
---- a/include/net/addrconf.h
-+++ b/include/net/addrconf.h
-@@ -6,6 +6,8 @@
- #define RTR_SOLICITATION_INTERVAL (4*HZ)
- #define RTR_SOLICITATION_MAX_INTERVAL (3600*HZ) /* 1 hour */
-
-+#define MIN_VALID_LIFETIME (2*3600) /* 2 hours */
-+
- #define TEMP_VALID_LIFETIME (7*86400)
- #define TEMP_PREFERRED_LIFETIME (86400)
- #define REGEN_MAX_RETRY (3)
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index 846037e73723f..bf13865426340 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -2587,7 +2587,7 @@ int addrconf_prefix_rcv_add_addr(struct net *net, struct net_device *dev,
- __u32 valid_lft, u32 prefered_lft)
- {
- struct inet6_ifaddr *ifp = ipv6_get_ifaddr(net, addr, dev, 1);
-- int create = 0;
-+ int create = 0, update_lft = 0;
-
- if (!ifp && valid_lft) {
- int max_addresses = in6_dev->cnf.max_addresses;
-@@ -2631,19 +2631,32 @@ int addrconf_prefix_rcv_add_addr(struct net *net, struct net_device *dev,
- unsigned long now;
- u32 stored_lft;
-
-- /* Update lifetime (RFC4862 5.5.3 e)
-- * We deviate from RFC4862 by honoring all Valid Lifetimes to
-- * improve the reaction of SLAAC to renumbering events
-- * (draft-gont-6man-slaac-renum-06, Section 4.2)
-- */
-+ /* update lifetime (RFC2462 5.5.3 e) */
- spin_lock_bh(&ifp->lock);
- now = jiffies;
- if (ifp->valid_lft > (now - ifp->tstamp) / HZ)
- stored_lft = ifp->valid_lft - (now - ifp->tstamp) / HZ;
- else
- stored_lft = 0;
--
- if (!create && stored_lft) {
-+ const u32 minimum_lft = min_t(u32,
-+ stored_lft, MIN_VALID_LIFETIME);
-+ valid_lft = max(valid_lft, minimum_lft);
-+
-+ /* RFC4862 Section 5.5.3e:
-+ * "Note that the preferred lifetime of the
-+ * corresponding address is always reset to
-+ * the Preferred Lifetime in the received
-+ * Prefix Information option, regardless of
-+ * whether the valid lifetime is also reset or
-+ * ignored."
-+ *
-+ * So we should always update prefered_lft here.
-+ */
-+ update_lft = 1;
-+ }
-+
-+ if (update_lft) {
- ifp->valid_lft = valid_lft;
- ifp->prefered_lft = prefered_lft;
- ifp->tstamp = now;
---
-2.34.1
-
+++ /dev/null
-From 75aa5e719bf0ac3da503e7606fe603fdffcd12f2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jan 2022 10:47:36 -0800
-Subject: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
-
-From: Sujit Kautkar <sujitka@chromium.org>
-
-[ Upstream commit b7fb2dad571d1e21173c06cef0bced77b323990a ]
-
-struct rpmsg_ctrldev contains a struct cdev. The current code frees
-the rpmsg_ctrldev struct in rpmsg_ctrldev_release_device(), but the
-cdev is a managed object, therefore its release is not predictable
-and the rpmsg_ctrldev could be freed before the cdev is entirely
-released, as in the backtrace below.
-
-[ 93.625603] ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x7c
-[ 93.636115] WARNING: CPU: 0 PID: 12 at lib/debugobjects.c:488 debug_print_object+0x13c/0x1b0
-[ 93.644799] Modules linked in: veth xt_cgroup xt_MASQUERADE rfcomm algif_hash algif_skcipher af_alg uinput ip6table_nat fuse uvcvideo videobuf2_vmalloc venus_enc venus_dec videobuf2_dma_contig hci_uart btandroid btqca snd_soc_rt5682_i2c bluetooth qcom_spmi_temp_alarm snd_soc_rt5682v
-[ 93.715175] CPU: 0 PID: 12 Comm: kworker/0:1 Tainted: G B 5.4.163-lockdep #26
-[ 93.723855] Hardware name: Google Lazor (rev3 - 8) with LTE (DT)
-[ 93.730055] Workqueue: events kobject_delayed_cleanup
-[ 93.735271] pstate: 60c00009 (nZCv daif +PAN +UAO)
-[ 93.740216] pc : debug_print_object+0x13c/0x1b0
-[ 93.744890] lr : debug_print_object+0x13c/0x1b0
-[ 93.749555] sp : ffffffacf5bc7940
-[ 93.752978] x29: ffffffacf5bc7940 x28: dfffffd000000000
-[ 93.758448] x27: ffffffacdb11a800 x26: dfffffd000000000
-[ 93.763916] x25: ffffffd0734f856c x24: dfffffd000000000
-[ 93.769389] x23: 0000000000000000 x22: ffffffd0733c35b0
-[ 93.774860] x21: ffffffd0751994a0 x20: ffffffd075ec27c0
-[ 93.780338] x19: ffffffd075199100 x18: 00000000000276e0
-[ 93.785814] x17: 0000000000000000 x16: dfffffd000000000
-[ 93.791291] x15: ffffffffffffffff x14: 6e6968207473696c
-[ 93.796768] x13: 0000000000000000 x12: ffffffd075e2b000
-[ 93.802244] x11: 0000000000000001 x10: 0000000000000000
-[ 93.807723] x9 : d13400dff1921900 x8 : d13400dff1921900
-[ 93.813200] x7 : 0000000000000000 x6 : 0000000000000000
-[ 93.818676] x5 : 0000000000000080 x4 : 0000000000000000
-[ 93.824152] x3 : ffffffd0732a0fa4 x2 : 0000000000000001
-[ 93.829628] x1 : ffffffacf5bc7580 x0 : 0000000000000061
-[ 93.835104] Call trace:
-[ 93.837644] debug_print_object+0x13c/0x1b0
-[ 93.841963] __debug_check_no_obj_freed+0x25c/0x3c0
-[ 93.846987] debug_check_no_obj_freed+0x18/0x20
-[ 93.851669] slab_free_freelist_hook+0xbc/0x1e4
-[ 93.856346] kfree+0xfc/0x2f4
-[ 93.859416] rpmsg_ctrldev_release_device+0x78/0xb8
-[ 93.864445] device_release+0x84/0x168
-[ 93.868310] kobject_cleanup+0x12c/0x298
-[ 93.872356] kobject_delayed_cleanup+0x10/0x18
-[ 93.876948] process_one_work+0x578/0x92c
-[ 93.881086] worker_thread+0x804/0xcf8
-[ 93.884963] kthread+0x2a8/0x314
-[ 93.888303] ret_from_fork+0x10/0x18
-
-The cdev_device_add/del() API was created to address this issue (see
-commit '233ed09d7fda ("chardev: add helper function to register char
-devs with a struct device")'), use it instead of cdev add/del().
-
-Fixes: c0cdc19f84a4 ("rpmsg: Driver for user space endpoint interface")
-Signed-off-by: Sujit Kautkar <sujitka@chromium.org>
-Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
-Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
-Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
-Reviewed-by: Stephen Boyd <swboyd@chromium.org>
-Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
-Link: https://lore.kernel.org/r/20220110104706.v6.1.Iaac908f3e3149a89190ce006ba166e2d3fd247a3@changeid
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/rpmsg/rpmsg_char.c | 11 ++---------
- 1 file changed, 2 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c
-index 2bebc9b2d1634..ba85f5d11960a 100644
---- a/drivers/rpmsg/rpmsg_char.c
-+++ b/drivers/rpmsg/rpmsg_char.c
-@@ -461,7 +461,6 @@ static void rpmsg_ctrldev_release_device(struct device *dev)
-
- ida_simple_remove(&rpmsg_ctrl_ida, dev->id);
- ida_simple_remove(&rpmsg_minor_ida, MINOR(dev->devt));
-- cdev_del(&ctrldev->cdev);
- kfree(ctrldev);
- }
-
-@@ -496,19 +495,13 @@ static int rpmsg_chrdev_probe(struct rpmsg_device *rpdev)
- dev->id = ret;
- dev_set_name(&ctrldev->dev, "rpmsg_ctrl%d", ret);
-
-- ret = cdev_add(&ctrldev->cdev, dev->devt, 1);
-+ ret = cdev_device_add(&ctrldev->cdev, &ctrldev->dev);
- if (ret)
- goto free_ctrl_ida;
-
- /* We can now rely on the release function for cleanup */
- dev->release = rpmsg_ctrldev_release_device;
-
-- ret = device_add(dev);
-- if (ret) {
-- dev_err(&rpdev->dev, "device_add failed: %d\n", ret);
-- put_device(dev);
-- }
--
- dev_set_drvdata(&rpdev->dev, ctrldev);
-
- return ret;
-@@ -534,7 +527,7 @@ static void rpmsg_chrdev_remove(struct rpmsg_device *rpdev)
- if (ret)
- dev_warn(&rpdev->dev, "failed to nuke endpoints: %d\n", ret);
-
-- device_del(&ctrldev->dev);
-+ cdev_device_del(&ctrldev->cdev, &ctrldev->dev);
- put_device(&ctrldev->dev);
- }
-
---
-2.34.1
-
+++ /dev/null
-From e1be1fecda528542d0570654b43cf543ac682b36 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jan 2022 10:47:37 -0800
-Subject: rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev
-
-From: Matthias Kaehlcke <mka@chromium.org>
-
-[ Upstream commit 7a534ae89e34e9b51acb5a63dd0f88308178b46a ]
-
-struct rpmsg_eptdev contains a struct cdev. The current code frees
-the rpmsg_eptdev struct in rpmsg_eptdev_destroy(), but the cdev is
-a managed object, therefore its release is not predictable and the
-rpmsg_eptdev could be freed before the cdev is entirely released.
-
-The cdev_device_add/del() API was created to address this issue
-(see commit '233ed09d7fda ("chardev: add helper function to register
-char devs with a struct device")'), use it instead of cdev add/del().
-
-Fixes: c0cdc19f84a4 ("rpmsg: Driver for user space endpoint interface")
-Suggested-by: Bjorn Andersson <bjorn.andersson@linaro.org>
-Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
-Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
-Reviewed-by: Stephen Boyd <swboyd@chromium.org>
-Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
-Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
-Link: https://lore.kernel.org/r/20220110104706.v6.2.Idde68b05b88d4a2e6e54766c653f3a6d9e419ce6@changeid
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/rpmsg/rpmsg_char.c | 11 ++---------
- 1 file changed, 2 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c
-index ba85f5d11960a..49dd5a2009982 100644
---- a/drivers/rpmsg/rpmsg_char.c
-+++ b/drivers/rpmsg/rpmsg_char.c
-@@ -92,7 +92,7 @@ static int rpmsg_eptdev_destroy(struct device *dev, void *data)
- /* wake up any blocked readers */
- wake_up_interruptible(&eptdev->readq);
-
-- device_del(&eptdev->dev);
-+ cdev_device_del(&eptdev->cdev, &eptdev->dev);
- put_device(&eptdev->dev);
-
- return 0;
-@@ -335,7 +335,6 @@ static void rpmsg_eptdev_release_device(struct device *dev)
-
- ida_simple_remove(&rpmsg_ept_ida, dev->id);
- ida_simple_remove(&rpmsg_minor_ida, MINOR(eptdev->dev.devt));
-- cdev_del(&eptdev->cdev);
- kfree(eptdev);
- }
-
-@@ -380,19 +379,13 @@ static int rpmsg_eptdev_create(struct rpmsg_ctrldev *ctrldev,
- dev->id = ret;
- dev_set_name(dev, "rpmsg%d", ret);
-
-- ret = cdev_add(&eptdev->cdev, dev->devt, 1);
-+ ret = cdev_device_add(&eptdev->cdev, &eptdev->dev);
- if (ret)
- goto free_ept_ida;
-
- /* We can now rely on the release function for cleanup */
- dev->release = rpmsg_eptdev_release_device;
-
-- ret = device_add(dev);
-- if (ret) {
-- dev_err(dev, "device_add failed: %d\n", ret);
-- put_device(dev);
-- }
--
- return ret;
-
- free_ept_ida:
---
-2.34.1
-
+++ /dev/null
-From e6697c0b22f6d23b23ee3559a8ea965a318dc403 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 21 Jan 2022 23:12:58 +0000
-Subject: rxrpc: Adjust retransmission backoff
-
-From: David Howells <dhowells@redhat.com>
-
-[ Upstream commit 2c13c05c5ff4b9fc907b07f7311821910ebaaf8a ]
-
-Improve retransmission backoff by only backing off when we retransmit data
-packets rather than when we set the lost ack timer.
-
-To this end:
-
- (1) In rxrpc_resend(), use rxrpc_get_rto_backoff() when setting the
- retransmission timer and only tell it that we are retransmitting if we
- actually have things to retransmit.
-
- Note that it's possible for the retransmission algorithm to race with
- the processing of a received ACK, so we may see no packets needing
- retransmission.
-
- (2) In rxrpc_send_data_packet(), don't bump the backoff when setting the
- ack_lost_at timer, as it may then get bumped twice.
-
-With this, when looking at one particular packet, the retransmission
-intervals were seen to be 1.5ms, 2ms, 3ms, 5ms, 9ms, 17ms, 33ms, 71ms,
-136ms, 264ms, 544ms, 1.088s, 2.1s, 4.2s and 8.3s.
-
-Fixes: c410bf01933e ("rxrpc: Fix the excessive initial retransmission timeout")
-Suggested-by: Marc Dionne <marc.dionne@auristor.com>
-Signed-off-by: David Howells <dhowells@redhat.com>
-Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
-Tested-by: Marc Dionne <marc.dionne@auristor.com>
-cc: linux-afs@lists.infradead.org
-Link: https://lore.kernel.org/r/164138117069.2023386.17446904856843997127.stgit@warthog.procyon.org.uk/
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/rxrpc/call_event.c | 8 +++-----
- net/rxrpc/output.c | 2 +-
- 2 files changed, 4 insertions(+), 6 deletions(-)
-
-diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
-index 6be2672a65eab..df864e6922679 100644
---- a/net/rxrpc/call_event.c
-+++ b/net/rxrpc/call_event.c
-@@ -157,7 +157,7 @@ static void rxrpc_congestion_timeout(struct rxrpc_call *call)
- static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j)
- {
- struct sk_buff *skb;
-- unsigned long resend_at, rto_j;
-+ unsigned long resend_at;
- rxrpc_seq_t cursor, seq, top;
- ktime_t now, max_age, oldest, ack_ts;
- int ix;
-@@ -165,10 +165,8 @@ static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j)
-
- _enter("{%d,%d}", call->tx_hard_ack, call->tx_top);
-
-- rto_j = call->peer->rto_j;
--
- now = ktime_get_real();
-- max_age = ktime_sub(now, jiffies_to_usecs(rto_j));
-+ max_age = ktime_sub(now, jiffies_to_usecs(call->peer->rto_j));
-
- spin_lock_bh(&call->lock);
-
-@@ -213,7 +211,7 @@ static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j)
- }
-
- resend_at = nsecs_to_jiffies(ktime_to_ns(ktime_sub(now, oldest)));
-- resend_at += jiffies + rto_j;
-+ resend_at += jiffies + rxrpc_get_rto_backoff(call->peer, retrans);
- WRITE_ONCE(call->resend_at, resend_at);
-
- if (unacked)
-diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
-index 10f2bf2e9068a..a45c83f22236e 100644
---- a/net/rxrpc/output.c
-+++ b/net/rxrpc/output.c
-@@ -468,7 +468,7 @@ done:
- if (call->peer->rtt_count > 1) {
- unsigned long nowj = jiffies, ack_lost_at;
-
-- ack_lost_at = rxrpc_get_rto_backoff(call->peer, retrans);
-+ ack_lost_at = rxrpc_get_rto_backoff(call->peer, false);
- ack_lost_at += nowj;
- WRITE_ONCE(call->ack_lost_at, ack_lost_at);
- rxrpc_reduce_call_timer(call, ack_lost_at, nowj,
---
-2.34.1
-
+++ /dev/null
-From 9f3057ae548371a56ed0063bb48fc514b49b27d5 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 25 Jan 2022 12:06:54 +0200
-Subject: sch_htb: Fail on unsupported parameters when offload is requested
-
-From: Maxim Mikityanskiy <maximmi@nvidia.com>
-
-[ Upstream commit 429c3be8a5e2695b5b92a6a12361eb89eb185495 ]
-
-The current implementation of HTB offload doesn't support some
-parameters. Instead of ignoring them, actively return the EINVAL error
-when they are set to non-defaults.
-
-As this patch goes to stable, the driver API is not changed here. If
-future drivers support more offload parameters, the checks can be moved
-to the driver side.
-
-Note that the buffer and cbuffer parameters are also not supported, but
-the tc userspace tool assigns some default values derived from rate and
-ceil, and identifying these defaults in sch_htb would be unreliable, so
-they are still ignored.
-
-Fixes: d03b195b5aa0 ("sch_htb: Hierarchical QoS hardware offload")
-Reported-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
-Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
-Link: https://lore.kernel.org/r/20220125100654.424570-1-maximmi@nvidia.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/sched/sch_htb.c | 20 ++++++++++++++++++++
- 1 file changed, 20 insertions(+)
-
-diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
-index 5067a6e5d4fde..5cbc32fee8674 100644
---- a/net/sched/sch_htb.c
-+++ b/net/sched/sch_htb.c
-@@ -1803,6 +1803,26 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
- if (!hopt->rate.rate || !hopt->ceil.rate)
- goto failure;
-
-+ if (q->offload) {
-+ /* Options not supported by the offload. */
-+ if (hopt->rate.overhead || hopt->ceil.overhead) {
-+ NL_SET_ERR_MSG(extack, "HTB offload doesn't support the overhead parameter");
-+ goto failure;
-+ }
-+ if (hopt->rate.mpu || hopt->ceil.mpu) {
-+ NL_SET_ERR_MSG(extack, "HTB offload doesn't support the mpu parameter");
-+ goto failure;
-+ }
-+ if (hopt->quantum) {
-+ NL_SET_ERR_MSG(extack, "HTB offload doesn't support the quantum parameter");
-+ goto failure;
-+ }
-+ if (hopt->prio) {
-+ NL_SET_ERR_MSG(extack, "HTB offload doesn't support the prio parameter");
-+ goto failure;
-+ }
-+ }
-+
- /* Keeping backward compatible with rate_table based iproute2 tc */
- if (hopt->rate.linklayer == TC_LINKLAYER_UNAWARE)
- qdisc_put_rtab(qdisc_get_rtab(&hopt->rate, tb[TCA_HTB_RTAB],
---
-2.34.1
-
+++ /dev/null
-From 0a3daca2769fcaf6d499ccee42ae608d1e21a133 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jan 2022 14:46:56 +0100
-Subject: sched/pelt: Relax the sync of util_sum with util_avg
-
-From: Vincent Guittot <vincent.guittot@linaro.org>
-
-[ Upstream commit 98b0d890220d45418cfbc5157b3382e6da5a12ab ]
-
-Rick reported performance regressions in bugzilla because of cpu frequency
-being lower than before:
- https://bugzilla.kernel.org/show_bug.cgi?id=215045
-
-He bisected the problem to:
-commit 1c35b07e6d39 ("sched/fair: Ensure _sum and _avg values stay consistent")
-
-This commit forces util_sum to be synced with the new util_avg after
-removing the contribution of a task and before the next periodic sync. By
-doing so util_sum is rounded to its lower bound and might lost up to
-LOAD_AVG_MAX-1 of accumulated contribution which has not yet been
-reflected in util_avg.
-
-Instead of always setting util_sum to the low bound of util_avg, which can
-significantly lower the utilization of root cfs_rq after propagating the
-change down into the hierarchy, we revert the change of util_sum and
-propagate the difference.
-
-In addition, we also check that cfs's util_sum always stays above the
-lower bound for a given util_avg as it has been observed that
-sched_entity's util_sum is sometimes above cfs one.
-
-Fixes: 1c35b07e6d39 ("sched/fair: Ensure _sum and _avg values stay consistent")
-Reported-by: Rick Yiu <rickyiu@google.com>
-Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
-Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
-Reviewed-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
-Tested-by: Sachin Sant <sachinp@linux.ibm.com>
-Link: https://lkml.kernel.org/r/20220111134659.24961-2-vincent.guittot@linaro.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/sched/fair.c | 16 +++++++++++++---
- kernel/sched/pelt.h | 4 +++-
- 2 files changed, 16 insertions(+), 4 deletions(-)
-
-diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
-index d41f966f5866a..6420580f2730b 100644
---- a/kernel/sched/fair.c
-+++ b/kernel/sched/fair.c
-@@ -3422,7 +3422,6 @@ void set_task_rq_fair(struct sched_entity *se,
- se->avg.last_update_time = n_last_update_time;
- }
-
--
- /*
- * When on migration a sched_entity joins/leaves the PELT hierarchy, we need to
- * propagate its contribution. The key to this propagation is the invariant
-@@ -3490,7 +3489,6 @@ void set_task_rq_fair(struct sched_entity *se,
- * XXX: only do this for the part of runnable > running ?
- *
- */
--
- static inline void
- update_tg_cfs_util(struct cfs_rq *cfs_rq, struct sched_entity *se, struct cfs_rq *gcfs_rq)
- {
-@@ -3722,7 +3720,19 @@ update_cfs_rq_load_avg(u64 now, struct cfs_rq *cfs_rq)
-
- r = removed_util;
- sub_positive(&sa->util_avg, r);
-- sa->util_sum = sa->util_avg * divider;
-+ sub_positive(&sa->util_sum, r * divider);
-+ /*
-+ * Because of rounding, se->util_sum might ends up being +1 more than
-+ * cfs->util_sum. Although this is not a problem by itself, detaching
-+ * a lot of tasks with the rounding problem between 2 updates of
-+ * util_avg (~1ms) can make cfs->util_sum becoming null whereas
-+ * cfs_util_avg is not.
-+ * Check that util_sum is still above its lower bound for the new
-+ * util_avg. Given that period_contrib might have moved since the last
-+ * sync, we are only sure that util_sum must be above or equal to
-+ * util_avg * minimum possible divider
-+ */
-+ sa->util_sum = max_t(u32, sa->util_sum, sa->util_avg * PELT_MIN_DIVIDER);
-
- r = removed_runnable;
- sub_positive(&sa->runnable_avg, r);
-diff --git a/kernel/sched/pelt.h b/kernel/sched/pelt.h
-index e06071bf3472c..c336f5f481bca 100644
---- a/kernel/sched/pelt.h
-+++ b/kernel/sched/pelt.h
-@@ -37,9 +37,11 @@ update_irq_load_avg(struct rq *rq, u64 running)
- }
- #endif
-
-+#define PELT_MIN_DIVIDER (LOAD_AVG_MAX - 1024)
-+
- static inline u32 get_pelt_divider(struct sched_avg *avg)
- {
-- return LOAD_AVG_MAX - 1024 + avg->period_contrib;
-+ return PELT_MIN_DIVIDER + avg->period_contrib;
- }
-
- static inline void cfs_se_util_change(struct sched_avg *avg)
---
-2.34.1
-
+++ /dev/null
-From 2c511279acfc0e87efa86259fcc0572abd12a14b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 14 Jan 2022 23:00:44 -0500
-Subject: scsi: bnx2fc: Flush destroy_work queue before calling
- bnx2fc_interface_put()
-
-From: John Meneghini <jmeneghi@redhat.com>
-
-[ Upstream commit 847f9ea4c5186fdb7b84297e3eeed9e340e83fce ]
-
-The bnx2fc_destroy() functions are removing the interface before calling
-destroy_work. This results multiple WARNings from sysfs_remove_group() as
-the controller rport device attributes are removed too early.
-
-Replace the fcoe_port's destroy_work queue. It's not needed.
-
-The problem is easily reproducible with the following steps.
-
-Example:
-
- $ dmesg -w &
- $ systemctl enable --now fcoe
- $ fipvlan -s -c ens2f1
- $ fcoeadm -d ens2f1.802
- [ 583.464488] host2: libfc: Link down on port (7500a1)
- [ 583.472651] bnx2fc: 7500a1 - rport not created Yet!!
- [ 583.490468] ------------[ cut here ]------------
- [ 583.538725] sysfs group 'power' not found for kobject 'rport-2:0-0'
- [ 583.568814] WARNING: CPU: 3 PID: 192 at fs/sysfs/group.c:279 sysfs_remove_group+0x6f/0x80
- [ 583.607130] Modules linked in: dm_service_time 8021q garp mrp stp llc bnx2fc cnic uio rpcsec_gss_krb5 auth_rpcgss nfsv4 ...
- [ 583.942994] CPU: 3 PID: 192 Comm: kworker/3:2 Kdump: loaded Not tainted 5.14.0-39.el9.x86_64 #1
- [ 583.984105] Hardware name: HP ProLiant DL120 G7, BIOS J01 07/01/2013
- [ 584.016535] Workqueue: fc_wq_2 fc_rport_final_delete [scsi_transport_fc]
- [ 584.050691] RIP: 0010:sysfs_remove_group+0x6f/0x80
- [ 584.074725] Code: ff 5b 48 89 ef 5d 41 5c e9 ee c0 ff ff 48 89 ef e8 f6 b8 ff ff eb d1 49 8b 14 24 48 8b 33 48 c7 c7 ...
- [ 584.162586] RSP: 0018:ffffb567c15afdc0 EFLAGS: 00010282
- [ 584.188225] RAX: 0000000000000000 RBX: ffffffff8eec4220 RCX: 0000000000000000
- [ 584.221053] RDX: ffff8c1586ce84c0 RSI: ffff8c1586cd7cc0 RDI: ffff8c1586cd7cc0
- [ 584.255089] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffb567c15afc00
- [ 584.287954] R10: ffffb567c15afbf8 R11: ffffffff8fbe7f28 R12: ffff8c1486326400
- [ 584.322356] R13: ffff8c1486326480 R14: ffff8c1483a4a000 R15: 0000000000000004
- [ 584.355379] FS: 0000000000000000(0000) GS:ffff8c1586cc0000(0000) knlGS:0000000000000000
- [ 584.394419] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
- [ 584.421123] CR2: 00007fe95a6f7840 CR3: 0000000107674002 CR4: 00000000000606e0
- [ 584.454888] Call Trace:
- [ 584.466108] device_del+0xb2/0x3e0
- [ 584.481701] device_unregister+0x13/0x60
- [ 584.501306] bsg_unregister_queue+0x5b/0x80
- [ 584.522029] bsg_remove_queue+0x1c/0x40
- [ 584.541884] fc_rport_final_delete+0xf3/0x1d0 [scsi_transport_fc]
- [ 584.573823] process_one_work+0x1e3/0x3b0
- [ 584.592396] worker_thread+0x50/0x3b0
- [ 584.609256] ? rescuer_thread+0x370/0x370
- [ 584.628877] kthread+0x149/0x170
- [ 584.643673] ? set_kthread_struct+0x40/0x40
- [ 584.662909] ret_from_fork+0x22/0x30
- [ 584.680002] ---[ end trace 53575ecefa942ece ]---
-
-Link: https://lore.kernel.org/r/20220115040044.1013475-1-jmeneghi@redhat.com
-Fixes: 0cbf32e1681d ("[SCSI] bnx2fc: Avoid calling bnx2fc_if_destroy with unnecessary locks")
-Tested-by: Guangwu Zhang <guazhang@redhat.com>
-Co-developed-by: Maurizio Lombardi <mlombard@redhat.com>
-Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
-Signed-off-by: John Meneghini <jmeneghi@redhat.com>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 20 +++++---------------
- 1 file changed, 5 insertions(+), 15 deletions(-)
-
-diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
-index 8863a74e6c57d..a8ce854c46847 100644
---- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
-+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
-@@ -82,7 +82,7 @@ static int bnx2fc_bind_pcidev(struct bnx2fc_hba *hba);
- static void bnx2fc_unbind_pcidev(struct bnx2fc_hba *hba);
- static struct fc_lport *bnx2fc_if_create(struct bnx2fc_interface *interface,
- struct device *parent, int npiv);
--static void bnx2fc_destroy_work(struct work_struct *work);
-+static void bnx2fc_port_destroy(struct fcoe_port *port);
-
- static struct bnx2fc_hba *bnx2fc_hba_lookup(struct net_device *phys_dev);
- static struct bnx2fc_interface *bnx2fc_interface_lookup(struct net_device
-@@ -907,9 +907,6 @@ static void bnx2fc_indicate_netevent(void *context, unsigned long event,
- __bnx2fc_destroy(interface);
- }
- mutex_unlock(&bnx2fc_dev_lock);
--
-- /* Ensure ALL destroy work has been completed before return */
-- flush_workqueue(bnx2fc_wq);
- return;
-
- default:
-@@ -1215,8 +1212,8 @@ static int bnx2fc_vport_destroy(struct fc_vport *vport)
- mutex_unlock(&n_port->lp_mutex);
- bnx2fc_free_vport(interface->hba, port->lport);
- bnx2fc_port_shutdown(port->lport);
-+ bnx2fc_port_destroy(port);
- bnx2fc_interface_put(interface);
-- queue_work(bnx2fc_wq, &port->destroy_work);
- return 0;
- }
-
-@@ -1525,7 +1522,6 @@ static struct fc_lport *bnx2fc_if_create(struct bnx2fc_interface *interface,
- port->lport = lport;
- port->priv = interface;
- port->get_netdev = bnx2fc_netdev;
-- INIT_WORK(&port->destroy_work, bnx2fc_destroy_work);
-
- /* Configure fcoe_port */
- rc = bnx2fc_lport_config(lport);
-@@ -1653,8 +1649,8 @@ static void __bnx2fc_destroy(struct bnx2fc_interface *interface)
- bnx2fc_interface_cleanup(interface);
- bnx2fc_stop(interface);
- list_del(&interface->list);
-+ bnx2fc_port_destroy(port);
- bnx2fc_interface_put(interface);
-- queue_work(bnx2fc_wq, &port->destroy_work);
- }
-
- /**
-@@ -1694,15 +1690,12 @@ netdev_err:
- return rc;
- }
-
--static void bnx2fc_destroy_work(struct work_struct *work)
-+static void bnx2fc_port_destroy(struct fcoe_port *port)
- {
-- struct fcoe_port *port;
- struct fc_lport *lport;
-
-- port = container_of(work, struct fcoe_port, destroy_work);
- lport = port->lport;
--
-- BNX2FC_HBA_DBG(lport, "Entered bnx2fc_destroy_work\n");
-+ BNX2FC_HBA_DBG(lport, "Entered %s, destroying lport %p\n", __func__, lport);
-
- bnx2fc_if_destroy(lport);
- }
-@@ -2556,9 +2549,6 @@ static void bnx2fc_ulp_exit(struct cnic_dev *dev)
- __bnx2fc_destroy(interface);
- mutex_unlock(&bnx2fc_dev_lock);
-
-- /* Ensure ALL destroy work has been completed before return */
-- flush_workqueue(bnx2fc_wq);
--
- bnx2fc_ulp_stop(hba);
- /* unregister cnic device */
- if (test_and_clear_bit(BNX2FC_CNIC_REGISTERED, &hba->reg_with_cnic))
---
-2.34.1
-
+++ /dev/null
-From 152048e551ef9efa68c219e62fd2adeee06a1ba5 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jan 2022 09:24:41 +0800
-Subject: scsi: elx: efct: Don't use GFP_KERNEL under spin lock
-
-From: Yang Yingliang <yangyingliang@huawei.com>
-
-[ Upstream commit 61263b3a11a2594b4e898f166c31162236182b5c ]
-
-GFP_KERNEL/GFP_DMA can't be used under a spin lock. According the comment,
-els_ios_lock is used to protect els ios list so we can move down the spin
-lock to avoid using this flag under the lock.
-
-Link: https://lore.kernel.org/r/20220111012441.3232527-1-yangyingliang@huawei.com
-Fixes: 8f406ef72859 ("scsi: elx: libefc: Extended link Service I/O handling")
-Reported-by: Hulk Robot <hulkci@huawei.com>
-Reviewed-by: James Smart <jsmart2021@gmail.com>
-Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/elx/libefc/efc_els.c | 8 ++------
- 1 file changed, 2 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/scsi/elx/libefc/efc_els.c b/drivers/scsi/elx/libefc/efc_els.c
-index 24db0accb256e..5f690378fe9a9 100644
---- a/drivers/scsi/elx/libefc/efc_els.c
-+++ b/drivers/scsi/elx/libefc/efc_els.c
-@@ -46,18 +46,14 @@ efc_els_io_alloc_size(struct efc_node *node, u32 reqlen, u32 rsplen)
-
- efc = node->efc;
-
-- spin_lock_irqsave(&node->els_ios_lock, flags);
--
- if (!node->els_io_enabled) {
- efc_log_err(efc, "els io alloc disabled\n");
-- spin_unlock_irqrestore(&node->els_ios_lock, flags);
- return NULL;
- }
-
- els = mempool_alloc(efc->els_io_pool, GFP_ATOMIC);
- if (!els) {
- atomic_add_return(1, &efc->els_io_alloc_failed_count);
-- spin_unlock_irqrestore(&node->els_ios_lock, flags);
- return NULL;
- }
-
-@@ -74,7 +70,6 @@ efc_els_io_alloc_size(struct efc_node *node, u32 reqlen, u32 rsplen)
- &els->io.req.phys, GFP_DMA);
- if (!els->io.req.virt) {
- mempool_free(els, efc->els_io_pool);
-- spin_unlock_irqrestore(&node->els_ios_lock, flags);
- return NULL;
- }
-
-@@ -94,10 +89,11 @@ efc_els_io_alloc_size(struct efc_node *node, u32 reqlen, u32 rsplen)
-
- /* add els structure to ELS IO list */
- INIT_LIST_HEAD(&els->list_entry);
-+ spin_lock_irqsave(&node->els_ios_lock, flags);
- list_add_tail(&els->list_entry, &node->els_ios_list);
-+ spin_unlock_irqrestore(&node->els_ios_lock, flags);
- }
-
-- spin_unlock_irqrestore(&node->els_ios_lock, flags);
- return els;
- }
-
---
-2.34.1
-
+++ /dev/null
-From 5be2934094e59431ac2f6782512f088f48804176 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 20 Jan 2022 16:35:29 -0800
-Subject: selftests: mptcp: fix ipv6 routing setup
-
-From: Paolo Abeni <pabeni@redhat.com>
-
-[ Upstream commit 9846921dba4936d92f7608315b5d1e0a8ec3a538 ]
-
-MPJ ipv6 selftests currently lack per link route to the server
-net. Additionally, ipv6 subflows endpoints are created without any
-interface specified. The end-result is that in ipv6 self-tests
-subflows are created all on the same link, leading to expected delays
-and sporadic self-tests failures.
-
-Fix the issue by adding the missing setup bits.
-
-Fixes: 523514ed0a99 ("selftests: mptcp: add ADD_ADDR IPv6 test cases")
-Reported-and-tested-by: Geliang Tang <geliang.tang@suse.com>
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/testing/selftests/net/mptcp/mptcp_join.sh | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
-index 0c12602fa22e8..38777d1ef766f 100755
---- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
-+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
-@@ -75,6 +75,7 @@ init()
-
- # let $ns2 reach any $ns1 address from any interface
- ip -net "$ns2" route add default via 10.0.$i.1 dev ns2eth$i metric 10$i
-+ ip -net "$ns2" route add default via dead:beef:$i::1 dev ns2eth$i metric 10$i
- done
- }
-
-@@ -1386,7 +1387,7 @@ ipv6_tests()
- reset
- ip netns exec $ns1 ./pm_nl_ctl limits 0 1
- ip netns exec $ns2 ./pm_nl_ctl limits 0 1
-- ip netns exec $ns2 ./pm_nl_ctl add dead:beef:3::2 flags subflow
-+ ip netns exec $ns2 ./pm_nl_ctl add dead:beef:3::2 dev ns2eth3 flags subflow
- run_tests $ns1 $ns2 dead:beef:1::1 0 0 0 slow
- chk_join_nr "single subflow IPv6" 1 1 1
-
-@@ -1421,7 +1422,7 @@ ipv6_tests()
- ip netns exec $ns1 ./pm_nl_ctl limits 0 2
- ip netns exec $ns1 ./pm_nl_ctl add dead:beef:2::1 flags signal
- ip netns exec $ns2 ./pm_nl_ctl limits 1 2
-- ip netns exec $ns2 ./pm_nl_ctl add dead:beef:3::2 flags subflow
-+ ip netns exec $ns2 ./pm_nl_ctl add dead:beef:3::2 dev ns2eth3 flags subflow
- run_tests $ns1 $ns2 dead:beef:1::1 0 -1 -1 slow
- chk_join_nr "remove subflow and signal IPv6" 2 2 2
- chk_add_nr 1 1
---
-2.34.1
-
usb-typec-tcpm-do-not-disconnect-while-receiving-vbus-off.patch
usb-typec-tcpm-do-not-disconnect-when-receiving-vsafe0v.patch
ucsi_ccg-check-dev_int-bit-only-when-starting-ccg4.patch
-nfs-ensure-the-server-has-an-up-to-date-ctime-before.patch
-nfs-ensure-the-server-has-an-up-to-date-ctime-before.patch-12870
-nfsv4-handle-case-where-the-lookup-of-a-directory-fa.patch
-nfsv4-nfs_atomic_open-can-race-when-looking-up-a-non.patch
-kvm-arm64-pkvm-use-the-mm_ops-indirection-for-cache-.patch
-sunrpc-use-bit-macro-in-rpc_show_xprt_state.patch
-sunrpc-don-t-dereference-xprt-snd_task-if-it-s-a-coo.patch
-powerpc64-bpf-limit-ldbrx-to-processors-compliant-wi.patch
-netfilter-conntrack-don-t-increment-invalid-counter-.patch
-rpmsg-char-fix-race-between-the-release-of-rpmsg_ctr.patch
-rpmsg-char-fix-race-between-the-release-of-rpmsg_ept.patch
-powerpc-64s-mask-srr0-before-checking-against-the-ma.patch
-perf-fix-perf_event_read_local-time.patch
-sched-pelt-relax-the-sync-of-util_sum-with-util_avg.patch
-arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabl.patch
-net-fix-information-leakage-in-proc-net-ptype.patch
-net-phy-broadcom-hook-up-soft_reset-for-bcm54616s.patch
-ipv6_tunnel-rate-limit-warning-messages.patch
-net-stmmac-dwmac-visconti-fix-bit-definitions-for-et.patch
-net-stmmac-dwmac-visconti-fix-clock-configuration-fo.patch
-i40e-increase-delay-to-1-s-after-global-emp-reset.patch
-i40e-fix-issue-when-maximum-queues-is-exceeded.patch
-i40e-fix-queues-reservation-for-xdp.patch
-i40e-fix-for-failed-to-init-adminq-while-vf-reset.patch
-i40e-fix-unsigned-stat-widths.patch
-phylib-fix-potential-use-after-free.patch
-ipv6-annotate-accesses-to-fn-fn_sernum.patch
-mptcp-allow-changing-the-backup-bit-by-endpoint-id.patch
-mptcp-clean-up-harmless-false-expressions.patch
-mptcp-keep-track-of-local-endpoint-still-available-f.patch
-mptcp-fix-msk-traversal-in-mptcp_nl_cmd_set_flags.patch
-mptcp-fix-removing-ids-bitmap-setting.patch
-selftests-mptcp-fix-ipv6-routing-setup.patch
-octeontx2-af-do-not-fixup-all-vf-action-entries.patch
-octeontx2-af-fix-lbk-backpressure-id-count.patch
-octeontx2-af-retry-until-rvu-block-reset-complete.patch
-octeontx2-pf-cn10k-ensure-valid-pointers-are-freed-t.patch
-octeontx2-af-verify-cq-context-updates.patch
-octeontx2-af-increase-link-credit-restore-polling-ti.patch
-octeontx2-af-cn10k-do-not-enable-rpm-loopback-for-lp.patch
-octeontx2-pf-forward-error-codes-to-vf.patch
-rxrpc-adjust-retransmission-backoff.patch
-efi-libstub-arm64-fix-image-check-alignment-at-entry.patch
-io_uring-fix-bug-in-slow-unregistering-of-nodes.patch
-drivers-hv-balloon-account-for-vmbus-packet-header-i.patch
-hwmon-lm90-reduce-maximum-conversion-rate-for-g781.patch
-hwmon-lm90-re-enable-interrupts-after-alert-clears.patch
-hwmon-lm90-mark-alert-as-broken-for-max6654.patch
-hwmon-lm90-mark-alert-as-broken-for-max6680.patch
-hwmon-lm90-mark-alert-as-broken-for-max6646-6647-664.patch
-hwmon-lm90-fix-sysfs-and-udev-notifications.patch
-hwmon-adt7470-prevent-divide-by-zero-in-adt7470_fan_.patch
-powerpc-perf-fix-power_pmu_disable-to-call-clear_pmi.patch
-net-procfs-show-net-devices-bound-packet-types.patch
-ipv4-fix-ip-option-filtering-for-locally-generated-f.patch
-ibmvnic-allow-extra-failures-before-disabling.patch
-ibmvnic-init-running_cap_crqs-early.patch
-ibmvnic-don-t-spin-in-tasklet.patch
-net-smc-transitional-solution-for-clcsock-race-issue.patch
-ping-fix-the-sk_bound_dev_if-match-in-ping_lookup.patch
-video-hyperv_fb-fix-validation-of-screen-resolution.patch
-can-tcan4x5x-regmap-fix-max-register-value.patch
-drm-msm-dsi-fix-missing-put_device-call-in-dsi_get_p.patch
-drm-msm-hdmi-fix-missing-put_device-call-in-msm_hdmi.patch
-drm-msm-dpu-invalid-parameter-check-in-dpu_setup_dsp.patch
-drm-msm-fix-wrong-size-calculation.patch
-drm-msm-a6xx-add-missing-suspend_count-increment.patch
-drm-msm-dsi-invalid-parameter-check-in-msm_dsi_phy_e.patch
-scsi-elx-efct-don-t-use-gfp_kernel-under-spin-lock.patch
-scsi-bnx2fc-flush-destroy_work-queue-before-calling-.patch
-yam-fix-a-memory-leak-in-yam_siocdevprivate.patch
-net-cpsw-properly-initialise-struct-page_pool_params.patch
-net-hns3-handle-empty-unknown-interrupt-for-vf.patch
-usb-roles-fix-include-linux-usb-role.h-compile-issue.patch
-drm-amd-display-dc-calcs-dce_calcs-fix-a-memleak-in-.patch
-sch_htb-fail-on-unsupported-parameters-when-offload-.patch
-revert-drm-ast-support-1600x900-with-108mhz-pclk.patch
-kvm-selftests-don-t-skip-l2-s-vmcall-in-smm-test-for.patch
-ceph-put-the-requests-sessions-when-it-fails-to-allo.patch
-ata-pata_platform-fix-a-null-pointer-dereference-in-.patch
-gve-fix-gfp-flags-when-allocing-pages.patch
-revert-ipv6-honor-all-ipv6-pio-valid-lifetime-values.patch
-net-bridge-vlan-fix-single-net-device-option-dumping.patch
-ipv4-raw-lock-the-socket-in-raw_bind.patch
-ipv4-tcp-send-zero-ipid-in-synack-messages.patch
-ipv4-avoid-using-shared-ip-generator-for-connected-s.patch
-ipv4-remove-sparse-error-in-ip_neigh_gw4.patch
-net-bridge-vlan-fix-memory-leak-in-__allowed_ingress.patch
-nfs-ensure-the-server-has-an-up-to-date-ctime-before.patch-4870
-nfs-ensure-the-server-has-an-up-to-date-ctime-before.patch-29801
-nfsv4-handle-case-where-the-lookup-of-a-directory-fa.patch-617
-nfsv4-nfs_atomic_open-can-race-when-looking-up-a-non.patch-30506
-kvm-arm64-pkvm-use-the-mm_ops-indirection-for-cache-.patch-519
-sunrpc-use-bit-macro-in-rpc_show_xprt_state.patch-2477
-sunrpc-don-t-dereference-xprt-snd_task-if-it-s-a-coo.patch-14266
-powerpc64-bpf-limit-ldbrx-to-processors-compliant-wi.patch-7350
-netfilter-conntrack-don-t-increment-invalid-counter-.patch-30305
-rpmsg-char-fix-race-between-the-release-of-rpmsg_ctr.patch-31935
-rpmsg-char-fix-race-between-the-release-of-rpmsg_ept.patch-15635
-powerpc-64s-mask-srr0-before-checking-against-the-ma.patch-32040
-perf-fix-perf_event_read_local-time.patch-9039
-sched-pelt-relax-the-sync-of-util_sum-with-util_avg.patch-21905
-arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabl.patch-24722
-net-fix-information-leakage-in-proc-net-ptype.patch-30768
-net-phy-broadcom-hook-up-soft_reset-for-bcm54616s.patch-6988
-ipv6_tunnel-rate-limit-warning-messages.patch-9903
-net-stmmac-dwmac-visconti-fix-bit-definitions-for-et.patch-30381
-net-stmmac-dwmac-visconti-fix-clock-configuration-fo.patch-22188
-i40e-increase-delay-to-1-s-after-global-emp-reset.patch-21157
-i40e-fix-issue-when-maximum-queues-is-exceeded.patch-2188
-i40e-fix-queues-reservation-for-xdp.patch-5380
-i40e-fix-for-failed-to-init-adminq-while-vf-reset.patch-21431
-i40e-fix-unsigned-stat-widths.patch-3705
-phylib-fix-potential-use-after-free.patch-30543
-ipv6-annotate-accesses-to-fn-fn_sernum.patch-20021
-mptcp-allow-changing-the-backup-bit-by-endpoint-id.patch-12565
-mptcp-clean-up-harmless-false-expressions.patch-6179
-mptcp-keep-track-of-local-endpoint-still-available-f.patch-22146
-mptcp-fix-msk-traversal-in-mptcp_nl_cmd_set_flags.patch-31370
-mptcp-fix-removing-ids-bitmap-setting.patch-16055
-selftests-mptcp-fix-ipv6-routing-setup.patch-14981
-octeontx2-af-do-not-fixup-all-vf-action-entries.patch-11992
-octeontx2-af-fix-lbk-backpressure-id-count.patch-4009
-octeontx2-af-retry-until-rvu-block-reset-complete.patch-31910
-octeontx2-pf-cn10k-ensure-valid-pointers-are-freed-t.patch-21610
-octeontx2-af-verify-cq-context-updates.patch-18014
-octeontx2-af-increase-link-credit-restore-polling-ti.patch-20428
-octeontx2-af-cn10k-do-not-enable-rpm-loopback-for-lp.patch-17229
-octeontx2-pf-forward-error-codes-to-vf.patch-18995
-rxrpc-adjust-retransmission-backoff.patch-11360
-efi-libstub-arm64-fix-image-check-alignment-at-entry.patch-12084
-io_uring-fix-bug-in-slow-unregistering-of-nodes.patch-2277
-drivers-hv-balloon-account-for-vmbus-packet-header-i.patch-24519
-hwmon-lm90-reduce-maximum-conversion-rate-for-g781.patch-6888
-hwmon-lm90-re-enable-interrupts-after-alert-clears.patch-18947
-hwmon-lm90-mark-alert-as-broken-for-max6654.patch-12281
-hwmon-lm90-mark-alert-as-broken-for-max6680.patch-14348
-hwmon-lm90-mark-alert-as-broken-for-max6646-6647-664.patch-14050
-hwmon-lm90-fix-sysfs-and-udev-notifications.patch-19939
-hwmon-adt7470-prevent-divide-by-zero-in-adt7470_fan_.patch-14115
-powerpc-perf-fix-power_pmu_disable-to-call-clear_pmi.patch-7560
-net-procfs-show-net-devices-bound-packet-types.patch-18510
-ipv4-fix-ip-option-filtering-for-locally-generated-f.patch-11644
-ibmvnic-allow-extra-failures-before-disabling.patch-5973
-ibmvnic-init-running_cap_crqs-early.patch-31036
-ibmvnic-don-t-spin-in-tasklet.patch-4625
-net-smc-transitional-solution-for-clcsock-race-issue.patch-31468
-ping-fix-the-sk_bound_dev_if-match-in-ping_lookup.patch-23286
-video-hyperv_fb-fix-validation-of-screen-resolution.patch-15783
-can-tcan4x5x-regmap-fix-max-register-value.patch-23795
-drm-msm-dsi-fix-missing-put_device-call-in-dsi_get_p.patch-15699
-drm-msm-hdmi-fix-missing-put_device-call-in-msm_hdmi.patch-16301
-drm-msm-dpu-invalid-parameter-check-in-dpu_setup_dsp.patch-23101
-drm-msm-fix-wrong-size-calculation.patch-19964
-drm-msm-a6xx-add-missing-suspend_count-increment.patch-21009
-drm-msm-dsi-invalid-parameter-check-in-msm_dsi_phy_e.patch-30234
-scsi-elx-efct-don-t-use-gfp_kernel-under-spin-lock.patch-16685
-scsi-bnx2fc-flush-destroy_work-queue-before-calling-.patch-14591
-yam-fix-a-memory-leak-in-yam_siocdevprivate.patch-11552
-net-cpsw-properly-initialise-struct-page_pool_params.patch-7194
-net-hns3-handle-empty-unknown-interrupt-for-vf.patch-24280
-usb-roles-fix-include-linux-usb-role.h-compile-issue.patch-11756
-drm-amd-display-dc-calcs-dce_calcs-fix-a-memleak-in-.patch-9275
-sch_htb-fail-on-unsupported-parameters-when-offload-.patch-25299
-revert-drm-ast-support-1600x900-with-108mhz-pclk.patch-693
-kvm-selftests-don-t-skip-l2-s-vmcall-in-smm-test-for.patch-3889
-ceph-put-the-requests-sessions-when-it-fails-to-allo.patch-8455
-ata-pata_platform-fix-a-null-pointer-dereference-in-.patch-23100
-gve-fix-gfp-flags-when-allocing-pages.patch-5541
-revert-ipv6-honor-all-ipv6-pio-valid-lifetime-values.patch-13765
-net-bridge-vlan-fix-single-net-device-option-dumping.patch-17025
-ipv4-raw-lock-the-socket-in-raw_bind.patch-8305
-ipv4-tcp-send-zero-ipid-in-synack-messages.patch-23988
-ipv4-avoid-using-shared-ip-generator-for-connected-s.patch-28268
-ipv4-remove-sparse-error-in-ip_neigh_gw4.patch-25185
-net-bridge-vlan-fix-memory-leak-in-__allowed_ingress.patch-16249
+++ /dev/null
-From bbebbc82623295fc708579b3c779eadb61bc0b80 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 13 Jan 2022 12:20:36 -0500
-Subject: SUNRPC: Don't dereference xprt->snd_task if it's a cookie
-
-From: Chuck Lever <chuck.lever@oracle.com>
-
-[ Upstream commit aed28b7a2d620cb5cd0c554cb889075c02e25e8e ]
-
-Fixes: e26d9972720e ("SUNRPC: Clean up scheduling of autoclose")
-Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
-Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/trace/events/sunrpc.h | 18 +++++++++++++-----
- 1 file changed, 13 insertions(+), 5 deletions(-)
-
-diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
-index 312507cb341f4..daaf407e9e494 100644
---- a/include/trace/events/sunrpc.h
-+++ b/include/trace/events/sunrpc.h
-@@ -936,7 +936,8 @@ TRACE_EVENT(rpc_socket_nospace,
- { BIT(XPRT_REMOVE), "REMOVE" }, \
- { BIT(XPRT_CONGESTED), "CONGESTED" }, \
- { BIT(XPRT_CWND_WAIT), "CWND_WAIT" }, \
-- { BIT(XPRT_WRITE_SPACE), "WRITE_SPACE" })
-+ { BIT(XPRT_WRITE_SPACE), "WRITE_SPACE" }, \
-+ { BIT(XPRT_SND_IS_COOKIE), "SND_IS_COOKIE" })
-
- DECLARE_EVENT_CLASS(rpc_xprt_lifetime_class,
- TP_PROTO(
-@@ -1133,8 +1134,11 @@ DECLARE_EVENT_CLASS(xprt_writelock_event,
- __entry->task_id = -1;
- __entry->client_id = -1;
- }
-- __entry->snd_task_id = xprt->snd_task ?
-- xprt->snd_task->tk_pid : -1;
-+ if (xprt->snd_task &&
-+ !test_bit(XPRT_SND_IS_COOKIE, &xprt->state))
-+ __entry->snd_task_id = xprt->snd_task->tk_pid;
-+ else
-+ __entry->snd_task_id = -1;
- ),
-
- TP_printk("task:%u@%u snd_task:%u",
-@@ -1178,8 +1182,12 @@ DECLARE_EVENT_CLASS(xprt_cong_event,
- __entry->task_id = -1;
- __entry->client_id = -1;
- }
-- __entry->snd_task_id = xprt->snd_task ?
-- xprt->snd_task->tk_pid : -1;
-+ if (xprt->snd_task &&
-+ !test_bit(XPRT_SND_IS_COOKIE, &xprt->state))
-+ __entry->snd_task_id = xprt->snd_task->tk_pid;
-+ else
-+ __entry->snd_task_id = -1;
-+
- __entry->cong = xprt->cong;
- __entry->cwnd = xprt->cwnd;
- __entry->wait = test_bit(XPRT_CWND_WAIT, &xprt->state);
---
-2.34.1
-
+++ /dev/null
-From 64fb2e755913532d094264a943b2c79c319354fa Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 16 Oct 2021 18:02:38 -0400
-Subject: SUNRPC: Use BIT() macro in rpc_show_xprt_state()
-
-From: Chuck Lever <chuck.lever@oracle.com>
-
-[ Upstream commit 76497b1adb89175eee85afc437f08a68247314b3 ]
-
-Clean up: BIT() is preferred over open-coding the shift.
-
-Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
-Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/trace/events/sunrpc.h | 24 ++++++++++++------------
- 1 file changed, 12 insertions(+), 12 deletions(-)
-
-diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
-index 2d04eb96d4183..312507cb341f4 100644
---- a/include/trace/events/sunrpc.h
-+++ b/include/trace/events/sunrpc.h
-@@ -925,18 +925,18 @@ TRACE_EVENT(rpc_socket_nospace,
-
- #define rpc_show_xprt_state(x) \
- __print_flags(x, "|", \
-- { (1UL << XPRT_LOCKED), "LOCKED"}, \
-- { (1UL << XPRT_CONNECTED), "CONNECTED"}, \
-- { (1UL << XPRT_CONNECTING), "CONNECTING"}, \
-- { (1UL << XPRT_CLOSE_WAIT), "CLOSE_WAIT"}, \
-- { (1UL << XPRT_BOUND), "BOUND"}, \
-- { (1UL << XPRT_BINDING), "BINDING"}, \
-- { (1UL << XPRT_CLOSING), "CLOSING"}, \
-- { (1UL << XPRT_OFFLINE), "OFFLINE"}, \
-- { (1UL << XPRT_REMOVE), "REMOVE"}, \
-- { (1UL << XPRT_CONGESTED), "CONGESTED"}, \
-- { (1UL << XPRT_CWND_WAIT), "CWND_WAIT"}, \
-- { (1UL << XPRT_WRITE_SPACE), "WRITE_SPACE"})
-+ { BIT(XPRT_LOCKED), "LOCKED" }, \
-+ { BIT(XPRT_CONNECTED), "CONNECTED" }, \
-+ { BIT(XPRT_CONNECTING), "CONNECTING" }, \
-+ { BIT(XPRT_CLOSE_WAIT), "CLOSE_WAIT" }, \
-+ { BIT(XPRT_BOUND), "BOUND" }, \
-+ { BIT(XPRT_BINDING), "BINDING" }, \
-+ { BIT(XPRT_CLOSING), "CLOSING" }, \
-+ { BIT(XPRT_OFFLINE), "OFFLINE" }, \
-+ { BIT(XPRT_REMOVE), "REMOVE" }, \
-+ { BIT(XPRT_CONGESTED), "CONGESTED" }, \
-+ { BIT(XPRT_CWND_WAIT), "CWND_WAIT" }, \
-+ { BIT(XPRT_WRITE_SPACE), "WRITE_SPACE" })
-
- DECLARE_EVENT_CLASS(rpc_xprt_lifetime_class,
- TP_PROTO(
---
-2.34.1
-
+++ /dev/null
-From 6804cfd0c82f897d5b8131d90f4b964c02361114 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jan 2022 20:43:28 +0800
-Subject: usb: roles: fix include/linux/usb/role.h compile issue
-
-From: Linyu Yuan <quic_linyyuan@quicinc.com>
-
-[ Upstream commit 945c37ed564770c78dfe6b9f08bed57a1b4e60ef ]
-
-when CONFIG_USB_ROLE_SWITCH is not defined,
-add usb_role_switch_find_by_fwnode() definition which return NULL.
-
-Fixes: c6919d5e0cd1 ("usb: roles: Add usb_role_switch_find_by_fwnode()")
-Signed-off-by: Linyu Yuan <quic_linyyuan@quicinc.com>
-Link: https://lore.kernel.org/r/1641818608-25039-1-git-send-email-quic_linyyuan@quicinc.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/usb/role.h | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/include/linux/usb/role.h b/include/linux/usb/role.h
-index 031f148ab3734..b5deafd91f67b 100644
---- a/include/linux/usb/role.h
-+++ b/include/linux/usb/role.h
-@@ -91,6 +91,12 @@ fwnode_usb_role_switch_get(struct fwnode_handle *node)
-
- static inline void usb_role_switch_put(struct usb_role_switch *sw) { }
-
-+static inline struct usb_role_switch *
-+usb_role_switch_find_by_fwnode(const struct fwnode_handle *fwnode)
-+{
-+ return NULL;
-+}
-+
- static inline struct usb_role_switch *
- usb_role_switch_register(struct device *parent,
- const struct usb_role_switch_desc *desc)
---
-2.34.1
-
+++ /dev/null
-From 4fbc5a077ddec620d5375ac2d3a8e05cda2a34fb Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 16 Jan 2022 11:18:31 -0800
-Subject: video: hyperv_fb: Fix validation of screen resolution
-
-From: Michael Kelley <mikelley@microsoft.com>
-
-[ Upstream commit 9ff5549b1d1d3c3a9d71220d44bd246586160f1d ]
-
-In the WIN10 version of the Synthetic Video protocol with Hyper-V,
-Hyper-V reports a list of supported resolutions as part of the protocol
-negotiation. The driver calculates the maximum width and height from
-the list of resolutions, and uses those maximums to validate any screen
-resolution specified in the video= option on the kernel boot line.
-
-This method of validation is incorrect. For example, the list of
-supported resolutions could contain 1600x1200 and 1920x1080, both of
-which fit in an 8 Mbyte frame buffer. But calculating the max width
-and height yields 1920 and 1200, and 1920x1200 resolution does not fit
-in an 8 Mbyte frame buffer. Unfortunately, this resolution is accepted,
-causing a kernel fault when the driver accesses memory outside the
-frame buffer.
-
-Instead, validate the specified screen resolution by calculating
-its size, and comparing against the frame buffer size. Delete the
-code for calculating the max width and height from the list of
-resolutions, since these max values have no use. Also add the
-frame buffer size to the info message to aid in understanding why
-a resolution might be rejected.
-
-Fixes: 67e7cdb4829d ("video: hyperv: hyperv_fb: Obtain screen resolution from Hyper-V host")
-Signed-off-by: Michael Kelley <mikelley@microsoft.com>
-Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
-Acked-by: Helge Deller <deller@gmx.de>
-Link: https://lore.kernel.org/r/1642360711-2335-1-git-send-email-mikelley@microsoft.com
-Signed-off-by: Wei Liu <wei.liu@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/video/fbdev/hyperv_fb.c | 16 +++-------------
- 1 file changed, 3 insertions(+), 13 deletions(-)
-
-diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c
-index 23999df527393..c8e0ea27caf1d 100644
---- a/drivers/video/fbdev/hyperv_fb.c
-+++ b/drivers/video/fbdev/hyperv_fb.c
-@@ -287,8 +287,6 @@ struct hvfb_par {
-
- static uint screen_width = HVFB_WIDTH;
- static uint screen_height = HVFB_HEIGHT;
--static uint screen_width_max = HVFB_WIDTH;
--static uint screen_height_max = HVFB_HEIGHT;
- static uint screen_depth;
- static uint screen_fb_size;
- static uint dio_fb_size; /* FB size for deferred IO */
-@@ -582,7 +580,6 @@ static int synthvid_get_supported_resolution(struct hv_device *hdev)
- int ret = 0;
- unsigned long t;
- u8 index;
-- int i;
-
- memset(msg, 0, sizeof(struct synthvid_msg));
- msg->vid_hdr.type = SYNTHVID_RESOLUTION_REQUEST;
-@@ -613,13 +610,6 @@ static int synthvid_get_supported_resolution(struct hv_device *hdev)
- goto out;
- }
-
-- for (i = 0; i < msg->resolution_resp.resolution_count; i++) {
-- screen_width_max = max_t(unsigned int, screen_width_max,
-- msg->resolution_resp.supported_resolution[i].width);
-- screen_height_max = max_t(unsigned int, screen_height_max,
-- msg->resolution_resp.supported_resolution[i].height);
-- }
--
- screen_width =
- msg->resolution_resp.supported_resolution[index].width;
- screen_height =
-@@ -941,7 +931,7 @@ static void hvfb_get_option(struct fb_info *info)
-
- if (x < HVFB_WIDTH_MIN || y < HVFB_HEIGHT_MIN ||
- (synthvid_ver_ge(par->synthvid_version, SYNTHVID_VERSION_WIN10) &&
-- (x > screen_width_max || y > screen_height_max)) ||
-+ (x * y * screen_depth / 8 > screen_fb_size)) ||
- (par->synthvid_version == SYNTHVID_VERSION_WIN8 &&
- x * y * screen_depth / 8 > SYNTHVID_FB_SIZE_WIN8) ||
- (par->synthvid_version == SYNTHVID_VERSION_WIN7 &&
-@@ -1194,8 +1184,8 @@ static int hvfb_probe(struct hv_device *hdev,
- }
-
- hvfb_get_option(info);
-- pr_info("Screen resolution: %dx%d, Color depth: %d\n",
-- screen_width, screen_height, screen_depth);
-+ pr_info("Screen resolution: %dx%d, Color depth: %d, Frame buffer size: %d\n",
-+ screen_width, screen_height, screen_depth, screen_fb_size);
-
- ret = hvfb_getmem(hdev, info);
- if (ret) {
---
-2.34.1
-
+++ /dev/null
-From 50323c79623a664b1f9da6303267078431f3334b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 24 Jan 2022 11:29:54 +0800
-Subject: yam: fix a memory leak in yam_siocdevprivate()
-
-From: Hangyu Hua <hbh25y@gmail.com>
-
-[ Upstream commit 29eb31542787e1019208a2e1047bb7c76c069536 ]
-
-ym needs to be free when ym->cmd != SIOCYAMSMCS.
-
-Fixes: 0781168e23a2 ("yam: fix a missing-check bug")
-Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/hamradio/yam.c | 4 +---
- 1 file changed, 1 insertion(+), 3 deletions(-)
-
-diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
-index 6ddacbdb224ba..528d57a435394 100644
---- a/drivers/net/hamradio/yam.c
-+++ b/drivers/net/hamradio/yam.c
-@@ -950,9 +950,7 @@ static int yam_siocdevprivate(struct net_device *dev, struct ifreq *ifr, void __
- ym = memdup_user(data, sizeof(struct yamdrv_ioctl_mcs));
- if (IS_ERR(ym))
- return PTR_ERR(ym);
-- if (ym->cmd != SIOCYAMSMCS)
-- return -EINVAL;
-- if (ym->bitrate > YAM_MAXBITRATE) {
-+ if (ym->cmd != SIOCYAMSMCS || ym->bitrate > YAM_MAXBITRATE) {
- kfree(ym);
- return -EINVAL;
- }
---
-2.34.1
-
projects / thirdparty / kernel / stable-queue.git / commitdiff
