From: Sasha Levin Date: Mon, 29 Nov 2021 00:40:59 +0000 (-0500) Subject: Fixes for 5.15 X-Git-Tag: v5.15.6~51 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=01d29117e9f947229d9409009f1d1397788b0f99;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/af_unix-fix-regression-in-read-after-shutdown.patch b/queue-5.15/af_unix-fix-regression-in-read-after-shutdown.patch new file mode 100644 index 00000000000..3eddabb1103 --- /dev/null +++ b/queue-5.15/af_unix-fix-regression-in-read-after-shutdown.patch @@ -0,0 +1,53 @@ +From fc94d972d32fd0916c18fad71ce000f97fdfc1b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Nov 2021 13:05:21 +0100 +Subject: af_unix: fix regression in read after shutdown + +From: Vincent Whitchurch + +[ Upstream commit f9390b249c90a15a4d9e69fbfb7a53c860b1fcaf ] + +On kernels before v5.15, calling read() on a unix socket after +shutdown(SHUT_RD) or shutdown(SHUT_RDWR) would return the data +previously written or EOF. But now, while read() after +shutdown(SHUT_RD) still behaves the same way, read() after +shutdown(SHUT_RDWR) always fails with -EINVAL. + +This behaviour change was apparently inadvertently introduced as part of +a bug fix for a different regression caused by the commit adding sockmap +support to af_unix, commit 94531cfcbe79c359 ("af_unix: Add +unix_stream_proto for sockmap"). Those commits, for unclear reasons, +started setting the socket state to TCP_CLOSE on shutdown(SHUT_RDWR), +while this state change had previously only been done in +unix_release_sock(). + +Restore the original behaviour. The sockmap tests in +tests/selftests/bpf continue to pass after this patch. + +Fixes: d0c6416bd7091647f60 ("unix: Fix an issue in unix_shutdown causing the other end read/write failures") +Link: https://lore.kernel.org/lkml/20211111140000.GA10779@axis.com/ +Signed-off-by: Vincent Whitchurch +Tested-by: Casey Schaufler +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/unix/af_unix.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index 78e08e82c08c4..b0bfc78e421ce 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -2882,9 +2882,6 @@ static int unix_shutdown(struct socket *sock, int mode) + + unix_state_lock(sk); + sk->sk_shutdown |= mode; +- if ((sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) && +- mode == SHUTDOWN_MASK) +- sk->sk_state = TCP_CLOSE; + other = unix_peer(sk); + if (other) + sock_hold(other); +-- +2.33.0 + diff --git a/queue-5.15/alsa-intel-dsp-config-add-quirk-for-jsl-devices-base.patch b/queue-5.15/alsa-intel-dsp-config-add-quirk-for-jsl-devices-base.patch new file mode 100644 index 00000000000..123eaa9987c --- /dev/null +++ b/queue-5.15/alsa-intel-dsp-config-add-quirk-for-jsl-devices-base.patch @@ -0,0 +1,52 @@ +From 6ff76ca5b1d37969809e5eb2ac065011e4692f97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Oct 2021 10:32:54 +0800 +Subject: ALSA: intel-dsp-config: add quirk for JSL devices based on ES8336 + codec + +From: Pierre-Louis Bossart + +[ Upstream commit fa9730b4f28b7bd183d28a0bf636ab7108de35d7 ] + +These devices are based on an I2C/I2S device, we need to force the use +of the SOF driver otherwise the legacy HDaudio driver will be loaded - +only HDMI will be supported. + +We previously added support for other Intel platforms but missed +JasperLake. + +BugLink: https://github.com/thesofproject/linux/issues/3210 +Fixes: 9d36ceab9415 ('ALSA: intel-dsp-config: add quirk for APL/GLK/TGL devices based on ES8336 codec') +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Kai Vehmanen +Signed-off-by: Bard Liao +Link: https://lore.kernel.org/r/20211027023254.24955-1-yung-chuan.liao@linux.intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/intel-dsp-config.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/sound/hda/intel-dsp-config.c b/sound/hda/intel-dsp-config.c +index b9ac9e9e45a48..10a0bffc3cf6c 100644 +--- a/sound/hda/intel-dsp-config.c ++++ b/sound/hda/intel-dsp-config.c +@@ -299,6 +299,15 @@ static const struct config_entry config_table[] = { + }, + #endif + ++/* JasperLake */ ++#if IS_ENABLED(CONFIG_SND_SOC_SOF_JASPERLAKE) ++ { ++ .flags = FLAG_SOF, ++ .device = 0x4dc8, ++ .codec_hid = "ESSX8336", ++ }, ++#endif ++ + /* Tigerlake */ + #if IS_ENABLED(CONFIG_SND_SOC_SOF_TIGERLAKE) + { +-- +2.33.0 + diff --git a/queue-5.15/arm-dts-bcm2711-fix-pcie-interrupts.patch b/queue-5.15/arm-dts-bcm2711-fix-pcie-interrupts.patch new file mode 100644 index 00000000000..7859a39d57a --- /dev/null +++ b/queue-5.15/arm-dts-bcm2711-fix-pcie-interrupts.patch @@ -0,0 +1,51 @@ +From 06148eb18b192ec18af8040ef232ef7768f5ded1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Oct 2021 14:09:26 -0700 +Subject: ARM: dts: bcm2711: Fix PCIe interrupts + +From: Florian Fainelli + +[ Upstream commit 98481f3d72fb88cb5b973153434061015f094925 ] + +The PCIe host bridge has two interrupt lines, one that goes towards it +PCIE_INTR2 second level interrupt controller and one for its MSI second +level interrupt controller. The first interrupt line is not currently +managed by the driver, which is why it was not a functional problem. + +The interrupt-map property was also only listing the PCI_INTA interrupts +when there are also the INTB, C and D. + +Reported-by: Jim Quinlan +Fixes: d5c8dc0d4c88 ("ARM: dts: bcm2711: Enable PCIe controller") +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2711.dtsi | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/bcm2711.dtsi b/arch/arm/boot/dts/bcm2711.dtsi +index 3b60297af7f60..9e01dbca4a011 100644 +--- a/arch/arm/boot/dts/bcm2711.dtsi ++++ b/arch/arm/boot/dts/bcm2711.dtsi +@@ -506,11 +506,17 @@ pcie0: pcie@7d500000 { + #address-cells = <3>; + #interrupt-cells = <1>; + #size-cells = <2>; +- interrupts = , ++ interrupts = , + ; + interrupt-names = "pcie", "msi"; + interrupt-map-mask = <0x0 0x0 0x0 0x7>; + interrupt-map = <0 0 0 1 &gicv2 GIC_SPI 143 ++ IRQ_TYPE_LEVEL_HIGH>, ++ <0 0 0 2 &gicv2 GIC_SPI 144 ++ IRQ_TYPE_LEVEL_HIGH>, ++ <0 0 0 3 &gicv2 GIC_SPI 145 ++ IRQ_TYPE_LEVEL_HIGH>, ++ <0 0 0 4 &gicv2 GIC_SPI 146 + IRQ_TYPE_LEVEL_HIGH>; + msi-controller; + msi-parent = <&pcie0>; +-- +2.33.0 + diff --git a/queue-5.15/arm-dts-bcm5301x-add-interrupt-properties-to-gpio-no.patch b/queue-5.15/arm-dts-bcm5301x-add-interrupt-properties-to-gpio-no.patch new file mode 100644 index 00000000000..b2940fc2a8d --- /dev/null +++ b/queue-5.15/arm-dts-bcm5301x-add-interrupt-properties-to-gpio-no.patch @@ -0,0 +1,36 @@ +From a70b13ce0ed4594393953b6c8add57327bafe595 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Oct 2021 09:46:53 -0700 +Subject: ARM: dts: BCM5301X: Add interrupt properties to GPIO node + +From: Florian Fainelli + +[ Upstream commit 40f7342f0587639e5ad625adaa15efdd3cffb18f ] + +The GPIO controller is also an interrupt controller provider and is +currently missing the appropriate 'interrupt-controller' and +'#interrupt-cells' properties to denote that. + +Fixes: fb026d3de33b ("ARM: BCM5301X: Add Broadcom's bus-axi to the DTS file") +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm5301x.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi +index 437a2b0f68de3..f69d2af3c1fa4 100644 +--- a/arch/arm/boot/dts/bcm5301x.dtsi ++++ b/arch/arm/boot/dts/bcm5301x.dtsi +@@ -242,6 +242,8 @@ chipcommon: chipcommon@0 { + + gpio-controller; + #gpio-cells = <2>; ++ interrupt-controller; ++ #interrupt-cells = <2>; + }; + + pcie0: pcie@12000 { +-- +2.33.0 + diff --git a/queue-5.15/arm-dts-bcm5301x-fix-i2c-controller-interrupt.patch b/queue-5.15/arm-dts-bcm5301x-fix-i2c-controller-interrupt.patch new file mode 100644 index 00000000000..8d882fc08ac --- /dev/null +++ b/queue-5.15/arm-dts-bcm5301x-fix-i2c-controller-interrupt.patch @@ -0,0 +1,38 @@ +From 335b273dcc3fb2f7cf9ddb6d9c71c374087b715b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Oct 2021 12:37:29 -0700 +Subject: ARM: dts: BCM5301X: Fix I2C controller interrupt + +From: Florian Fainelli + +[ Upstream commit 754c4050a00e802e122690112fc2c3a6abafa7e2 ] + +The I2C interrupt controller line is off by 32 because the datasheet +describes interrupt inputs into the GIC which are for Shared Peripheral +Interrupts and are starting at offset 32. The ARM GIC binding expects +the SPI interrupts to be numbered from 0 relative to the SPI base. + +Fixes: bb097e3e0045 ("ARM: dts: BCM5301X: Add I2C support to the DT") +Tested-by: Christian Lamparter +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm5301x.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi +index d4f355015e3ca..437a2b0f68de3 100644 +--- a/arch/arm/boot/dts/bcm5301x.dtsi ++++ b/arch/arm/boot/dts/bcm5301x.dtsi +@@ -408,7 +408,7 @@ uart2: serial@18008000 { + i2c0: i2c@18009000 { + compatible = "brcm,iproc-i2c"; + reg = <0x18009000 0x50>; +- interrupts = ; ++ interrupts = ; + #address-cells = <1>; + #size-cells = <0>; + clock-frequency = <100000>; +-- +2.33.0 + diff --git a/queue-5.15/arm-socfpga-fix-crash-with-config_fortiry_source.patch b/queue-5.15/arm-socfpga-fix-crash-with-config_fortiry_source.patch new file mode 100644 index 00000000000..01d5ba65465 --- /dev/null +++ b/queue-5.15/arm-socfpga-fix-crash-with-config_fortiry_source.patch @@ -0,0 +1,81 @@ +From 86885d83f583073ea63eb023c14a3a8da0fbb2ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Nov 2021 15:25:08 +0100 +Subject: ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE + +From: Takashi Iwai + +[ Upstream commit 187bea472600dcc8d2eb714335053264dd437172 ] + +When CONFIG_FORTIFY_SOURCE is set, memcpy() checks the potential +buffer overflow and panics. The code in sofcpga bootstrapping +contains the memcpy() calls are mistakenly translated as the shorter +size, hence it triggers a panic as if it were overflowing. + +This patch changes the secondary_trampoline and *_end definitions +to arrays for avoiding the false-positive crash above. + +Fixes: 9c4566a117a6 ("ARM: socfpga: Enable SMP for socfpga") +Suggested-by: Kees Cook +Buglink: https://bugzilla.suse.com/show_bug.cgi?id=1192473 +Link: https://lore.kernel.org/r/20211117193244.31162-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Dinh Nguyen +Signed-off-by: Sasha Levin +--- + arch/arm/mach-socfpga/core.h | 2 +- + arch/arm/mach-socfpga/platsmp.c | 8 ++++---- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/mach-socfpga/core.h b/arch/arm/mach-socfpga/core.h +index fc2608b18a0d0..18f01190dcfd4 100644 +--- a/arch/arm/mach-socfpga/core.h ++++ b/arch/arm/mach-socfpga/core.h +@@ -33,7 +33,7 @@ extern void __iomem *sdr_ctl_base_addr; + u32 socfpga_sdram_self_refresh(u32 sdr_base); + extern unsigned int socfpga_sdram_self_refresh_sz; + +-extern char secondary_trampoline, secondary_trampoline_end; ++extern char secondary_trampoline[], secondary_trampoline_end[]; + + extern unsigned long socfpga_cpu1start_addr; + +diff --git a/arch/arm/mach-socfpga/platsmp.c b/arch/arm/mach-socfpga/platsmp.c +index fbb80b883e5dd..201191cf68f32 100644 +--- a/arch/arm/mach-socfpga/platsmp.c ++++ b/arch/arm/mach-socfpga/platsmp.c +@@ -20,14 +20,14 @@ + + static int socfpga_boot_secondary(unsigned int cpu, struct task_struct *idle) + { +- int trampoline_size = &secondary_trampoline_end - &secondary_trampoline; ++ int trampoline_size = secondary_trampoline_end - secondary_trampoline; + + if (socfpga_cpu1start_addr) { + /* This will put CPU #1 into reset. */ + writel(RSTMGR_MPUMODRST_CPU1, + rst_manager_base_addr + SOCFPGA_RSTMGR_MODMPURST); + +- memcpy(phys_to_virt(0), &secondary_trampoline, trampoline_size); ++ memcpy(phys_to_virt(0), secondary_trampoline, trampoline_size); + + writel(__pa_symbol(secondary_startup), + sys_manager_base_addr + (socfpga_cpu1start_addr & 0x000000ff)); +@@ -45,12 +45,12 @@ static int socfpga_boot_secondary(unsigned int cpu, struct task_struct *idle) + + static int socfpga_a10_boot_secondary(unsigned int cpu, struct task_struct *idle) + { +- int trampoline_size = &secondary_trampoline_end - &secondary_trampoline; ++ int trampoline_size = secondary_trampoline_end - secondary_trampoline; + + if (socfpga_cpu1start_addr) { + writel(RSTMGR_MPUMODRST_CPU1, rst_manager_base_addr + + SOCFPGA_A10_RSTMGR_MODMPURST); +- memcpy(phys_to_virt(0), &secondary_trampoline, trampoline_size); ++ memcpy(phys_to_virt(0), secondary_trampoline, trampoline_size); + + writel(__pa_symbol(secondary_startup), + sys_manager_base_addr + (socfpga_cpu1start_addr & 0x00000fff)); +-- +2.33.0 + diff --git a/queue-5.15/arm64-uaccess-avoid-blocking-within-critical-section.patch b/queue-5.15/arm64-uaccess-avoid-blocking-within-critical-section.patch new file mode 100644 index 00000000000..33bf3bf8fc3 --- /dev/null +++ b/queue-5.15/arm64-uaccess-avoid-blocking-within-critical-section.patch @@ -0,0 +1,188 @@ +From 5706c919993f965f42d44b67742c2245ea0431df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Nov 2021 12:58:20 +0000 +Subject: arm64: uaccess: avoid blocking within critical sections + +From: Mark Rutland + +[ Upstream commit 94902d849e85093aafcdbea2be8e2beff47233e6 ] + +As Vincent reports in: + + https://lore.kernel.org/r/20211118163417.21617-1-vincent.whitchurch@axis.com + +The put_user() in schedule_tail() can get stuck in a livelock, similar +to a problem recently fixed on riscv in commit: + + 285a76bb2cf51b0c ("riscv: evaluate put_user() arg before enabling user access") + +In __raw_put_user() we have a critical section between +uaccess_ttbr0_enable() and uaccess_ttbr0_disable() where we cannot +safely call into the scheduler without having taken an exception, as +schedule() and other scheduling functions will not save/restore the +TTBR0 state. If either of the `x` or `ptr` arguments to __raw_put_user() +contain a blocking call, we may call into the scheduler within the +critical section. This can result in two problems: + +1) The access within the critical section will occur without the + required TTBR0 tables installed. This will fault, and where the + required tables permit access, the access will be retried without the + required tables, resulting in a livelock. + +2) When TTBR0 SW PAN is in use, check_and_switch_context() does not + modify TTBR0, leaving a stale value installed. The mappings of the + blocked task will erroneously be accessible to regular accesses in + the context of the new task. Additionally, if the tables are + subsequently freed, local TLB maintenance required to reuse the ASID + may be lost, potentially resulting in TLB corruption (e.g. in the + presence of CnP). + +The same issue exists for __raw_get_user() in the critical section +between uaccess_ttbr0_enable() and uaccess_ttbr0_disable(). + +A similar issue exists for __get_kernel_nofault() and +__put_kernel_nofault() for the critical section between +__uaccess_enable_tco_async() and __uaccess_disable_tco_async(), as the +TCO state is not context-switched by direct calls into the scheduler. +Here the TCO state may be lost from the context of the current task, +resulting in unexpected asynchronous tag check faults. It may also be +leaked to another task, suppressing expected tag check faults. + +To fix all of these cases, we must ensure that we do not directly call +into the scheduler in their respective critical sections. This patch +reworks __raw_put_user(), __raw_get_user(), __get_kernel_nofault(), and +__put_kernel_nofault(), ensuring that parameters are evaluated outside +of the critical sections. To make this requirement clear, comments are +added describing the problem, and line spaces added to separate the +critical sections from other portions of the macros. + +For __raw_get_user() and __raw_put_user() the `err` parameter is +conditionally assigned to, and we must currently evaluate this in the +critical section. This behaviour is relied upon by the signal code, +which uses chains of put_user_error() and get_user_error(), checking the +return value at the end. In all cases, the `err` parameter is a plain +int rather than a more complex expression with a blocking call, so this +is safe. + +In future we should try to clean up the `err` usage to remove the +potential for this to be a problem. + +Aside from the changes to time of evaluation, there should be no +functional change as a result of this patch. + +Reported-by: Vincent Whitchurch +Link: https://lore.kernel.org/r/20211118163417.21617-1-vincent.whitchurch@axis.com +Fixes: f253d827f33c ("arm64: uaccess: refactor __{get,put}_user") +Signed-off-by: Mark Rutland +Cc: Will Deacon +Cc: Catalin Marinas +Link: https://lore.kernel.org/r/20211122125820.55286-1-mark.rutland@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/uaccess.h | 48 +++++++++++++++++++++++++++----- + 1 file changed, 41 insertions(+), 7 deletions(-) + +diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h +index 190b494e22ab9..0fd6056ba412b 100644 +--- a/arch/arm64/include/asm/uaccess.h ++++ b/arch/arm64/include/asm/uaccess.h +@@ -292,12 +292,22 @@ do { \ + (x) = (__force __typeof__(*(ptr)))__gu_val; \ + } while (0) + ++/* ++ * We must not call into the scheduler between uaccess_ttbr0_enable() and ++ * uaccess_ttbr0_disable(). As `x` and `ptr` could contain blocking functions, ++ * we must evaluate these outside of the critical section. ++ */ + #define __raw_get_user(x, ptr, err) \ + do { \ ++ __typeof__(*(ptr)) __user *__rgu_ptr = (ptr); \ ++ __typeof__(x) __rgu_val; \ + __chk_user_ptr(ptr); \ ++ \ + uaccess_ttbr0_enable(); \ +- __raw_get_mem("ldtr", x, ptr, err); \ ++ __raw_get_mem("ldtr", __rgu_val, __rgu_ptr, err); \ + uaccess_ttbr0_disable(); \ ++ \ ++ (x) = __rgu_val; \ + } while (0) + + #define __get_user_error(x, ptr, err) \ +@@ -321,14 +331,22 @@ do { \ + + #define get_user __get_user + ++/* ++ * We must not call into the scheduler between __uaccess_enable_tco_async() and ++ * __uaccess_disable_tco_async(). As `dst` and `src` may contain blocking ++ * functions, we must evaluate these outside of the critical section. ++ */ + #define __get_kernel_nofault(dst, src, type, err_label) \ + do { \ ++ __typeof__(dst) __gkn_dst = (dst); \ ++ __typeof__(src) __gkn_src = (src); \ + int __gkn_err = 0; \ + \ + __uaccess_enable_tco_async(); \ +- __raw_get_mem("ldr", *((type *)(dst)), \ +- (__force type *)(src), __gkn_err); \ ++ __raw_get_mem("ldr", *((type *)(__gkn_dst)), \ ++ (__force type *)(__gkn_src), __gkn_err); \ + __uaccess_disable_tco_async(); \ ++ \ + if (unlikely(__gkn_err)) \ + goto err_label; \ + } while (0) +@@ -367,11 +385,19 @@ do { \ + } \ + } while (0) + ++/* ++ * We must not call into the scheduler between uaccess_ttbr0_enable() and ++ * uaccess_ttbr0_disable(). As `x` and `ptr` could contain blocking functions, ++ * we must evaluate these outside of the critical section. ++ */ + #define __raw_put_user(x, ptr, err) \ + do { \ +- __chk_user_ptr(ptr); \ ++ __typeof__(*(ptr)) __user *__rpu_ptr = (ptr); \ ++ __typeof__(*(ptr)) __rpu_val = (x); \ ++ __chk_user_ptr(__rpu_ptr); \ ++ \ + uaccess_ttbr0_enable(); \ +- __raw_put_mem("sttr", x, ptr, err); \ ++ __raw_put_mem("sttr", __rpu_val, __rpu_ptr, err); \ + uaccess_ttbr0_disable(); \ + } while (0) + +@@ -396,14 +422,22 @@ do { \ + + #define put_user __put_user + ++/* ++ * We must not call into the scheduler between __uaccess_enable_tco_async() and ++ * __uaccess_disable_tco_async(). As `dst` and `src` may contain blocking ++ * functions, we must evaluate these outside of the critical section. ++ */ + #define __put_kernel_nofault(dst, src, type, err_label) \ + do { \ ++ __typeof__(dst) __pkn_dst = (dst); \ ++ __typeof__(src) __pkn_src = (src); \ + int __pkn_err = 0; \ + \ + __uaccess_enable_tco_async(); \ +- __raw_put_mem("str", *((type *)(src)), \ +- (__force type *)(dst), __pkn_err); \ ++ __raw_put_mem("str", *((type *)(__pkn_src)), \ ++ (__force type *)(__pkn_dst), __pkn_err); \ + __uaccess_disable_tco_async(); \ ++ \ + if (unlikely(__pkn_err)) \ + goto err_label; \ + } while(0) +-- +2.33.0 + diff --git a/queue-5.15/asoc-codecs-lpass-rx-macro-fix-hphr-setting-clsh-mas.patch b/queue-5.15/asoc-codecs-lpass-rx-macro-fix-hphr-setting-clsh-mas.patch new file mode 100644 index 00000000000..e8c845d2135 --- /dev/null +++ b/queue-5.15/asoc-codecs-lpass-rx-macro-fix-hphr-setting-clsh-mas.patch @@ -0,0 +1,37 @@ +From 2c671a2726c6c81b9f1da5bebf1dbba646128076 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 11:46:23 +0000 +Subject: ASoC: codecs: lpass-rx-macro: fix HPHR setting CLSH mask + +From: Srinivas Kandagatla + +[ Upstream commit cb04d8cd0bb0b82acc34cc73cb33ae77cbfb020d ] + +For some reason we ended up using snd_soc_component_write_field +for HPHL and snd_soc_component_update_bits for HPHR, so fix this. + +Fixes: af3d54b99764 ("ASoC: codecs: lpass-rx-macro: add support for lpass rx macro") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20211116114623.11891-4-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/lpass-rx-macro.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c +index 196b06898eeb2..07894ec5e7a61 100644 +--- a/sound/soc/codecs/lpass-rx-macro.c ++++ b/sound/soc/codecs/lpass-rx-macro.c +@@ -2188,7 +2188,7 @@ static int rx_macro_config_classh(struct snd_soc_component *component, + snd_soc_component_update_bits(component, + CDC_RX_CLSH_DECAY_CTRL, + CDC_RX_CLSH_DECAY_RATE_MASK, 0x0); +- snd_soc_component_update_bits(component, ++ snd_soc_component_write_field(component, + CDC_RX_RX1_RX_PATH_CFG0, + CDC_RX_RXn_CLSH_EN_MASK, 0x1); + break; +-- +2.33.0 + diff --git a/queue-5.15/asoc-codecs-wcd934x-return-error-code-correctly-from.patch b/queue-5.15/asoc-codecs-wcd934x-return-error-code-correctly-from.patch new file mode 100644 index 00000000000..61bdfc74b09 --- /dev/null +++ b/queue-5.15/asoc-codecs-wcd934x-return-error-code-correctly-from.patch @@ -0,0 +1,42 @@ +From 300064c7ed1ae5787900bc0e8a8ef0affaee7c95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 11:46:22 +0000 +Subject: ASoC: codecs: wcd934x: return error code correctly from hw_params + +From: Srinivas Kandagatla + +[ Upstream commit 006ea27c4e7037369085755c7b5389effa508c04 ] + +Error returned from wcd934x_slim_set_hw_params() are not passed to upper layer, +this could be misleading to the user which can start sending stream leading +to unnecessary errors. + +Fix this by properly returning the errors. + +Fixes: a61f3b4f476e ("ASoC: wcd934x: add support to wcd9340/wcd9341 codec") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20211116114623.11891-3-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wcd934x.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/wcd934x.c b/sound/soc/codecs/wcd934x.c +index c496b359f2f40..4f568abd59e24 100644 +--- a/sound/soc/codecs/wcd934x.c ++++ b/sound/soc/codecs/wcd934x.c +@@ -1896,9 +1896,8 @@ static int wcd934x_hw_params(struct snd_pcm_substream *substream, + } + + wcd->dai[dai->id].sconfig.rate = params_rate(params); +- wcd934x_slim_set_hw_params(wcd, &wcd->dai[dai->id], substream->stream); + +- return 0; ++ return wcd934x_slim_set_hw_params(wcd, &wcd->dai[dai->id], substream->stream); + } + + static int wcd934x_hw_free(struct snd_pcm_substream *substream, +-- +2.33.0 + diff --git a/queue-5.15/asoc-codecs-wcd938x-fix-volatile-register-range.patch b/queue-5.15/asoc-codecs-wcd938x-fix-volatile-register-range.patch new file mode 100644 index 00000000000..84d0fc14c0e --- /dev/null +++ b/queue-5.15/asoc-codecs-wcd938x-fix-volatile-register-range.patch @@ -0,0 +1,47 @@ +From ea4682fe4ea3e4d17fc681e66f75a6b29d0198f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 11:46:21 +0000 +Subject: ASoC: codecs: wcd938x: fix volatile register range + +From: Srinivas Kandagatla + +[ Upstream commit ea157c2ba821dab789a544cd9fbe44dc07036ff8 ] + +Interrupt Clear registers WCD938X_INTR_CLEAR_0 - WCD938X_INTR_CLEAR_2 +are not marked as volatile. This has resulted in a missing interrupt bug +while performing runtime pm. regcache_sync() during runtime pm resume path +will write to Interrupt clear registers with previous values which basically +clears the pending interrupt and actual interrupt handler never sees this +interrupt. + +This issue is more visible with headset plug-in plug-out case compared to +headset button. + +Fix this by adding the Interrupt clear registers to volatile range + +Fixes: 8d78602aa87a ("ASoC: codecs: wcd938x: add basic driver") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20211116114623.11891-2-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wcd938x.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/codecs/wcd938x.c b/sound/soc/codecs/wcd938x.c +index 52de7d14b1398..67151c7770c65 100644 +--- a/sound/soc/codecs/wcd938x.c ++++ b/sound/soc/codecs/wcd938x.c +@@ -1174,6 +1174,9 @@ static bool wcd938x_readonly_register(struct device *dev, unsigned int reg) + case WCD938X_DIGITAL_INTR_STATUS_0: + case WCD938X_DIGITAL_INTR_STATUS_1: + case WCD938X_DIGITAL_INTR_STATUS_2: ++ case WCD938X_DIGITAL_INTR_CLEAR_0: ++ case WCD938X_DIGITAL_INTR_CLEAR_1: ++ case WCD938X_DIGITAL_INTR_CLEAR_2: + case WCD938X_DIGITAL_SWR_HM_TEST_0: + case WCD938X_DIGITAL_SWR_HM_TEST_1: + case WCD938X_DIGITAL_EFUSE_T_DATA_0: +-- +2.33.0 + diff --git a/queue-5.15/asoc-qdsp6-q6asm-fix-q6asm_dai_prepare-error-handlin.patch b/queue-5.15/asoc-qdsp6-q6asm-fix-q6asm_dai_prepare-error-handlin.patch new file mode 100644 index 00000000000..6a2d2baf465 --- /dev/null +++ b/queue-5.15/asoc-qdsp6-q6asm-fix-q6asm_dai_prepare-error-handlin.patch @@ -0,0 +1,70 @@ +From a4d7e9c1957e8f4b3496a60fd67de711688c67d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 11:47:19 +0000 +Subject: ASoC: qdsp6: q6asm: fix q6asm_dai_prepare error handling + +From: Srinivas Kandagatla + +[ Upstream commit 721a94b4352dc8e47bff90b549a0118c39776756 ] + +Error handling in q6asm_dai_prepare() seems to be completely broken, +Fix this by handling it properly. + +Fixes: 2a9e92d371db ("ASoC: qdsp6: q6asm: Add q6asm dai driver") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20211116114721.12517-4-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/qcom/qdsp6/q6asm-dai.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/qcom/qdsp6/q6asm-dai.c b/sound/soc/qcom/qdsp6/q6asm-dai.c +index 46f365528d501..b74b67720ef43 100644 +--- a/sound/soc/qcom/qdsp6/q6asm-dai.c ++++ b/sound/soc/qcom/qdsp6/q6asm-dai.c +@@ -269,9 +269,7 @@ static int q6asm_dai_prepare(struct snd_soc_component *component, + + if (ret < 0) { + dev_err(dev, "%s: q6asm_open_write failed\n", __func__); +- q6asm_audio_client_free(prtd->audio_client); +- prtd->audio_client = NULL; +- return -ENOMEM; ++ goto open_err; + } + + prtd->session_id = q6asm_get_session_id(prtd->audio_client); +@@ -279,7 +277,7 @@ static int q6asm_dai_prepare(struct snd_soc_component *component, + prtd->session_id, substream->stream); + if (ret) { + dev_err(dev, "%s: stream reg failed ret:%d\n", __func__, ret); +- return ret; ++ goto routing_err; + } + + if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) { +@@ -301,10 +299,19 @@ static int q6asm_dai_prepare(struct snd_soc_component *component, + } + if (ret < 0) + dev_info(dev, "%s: CMD Format block failed\n", __func__); ++ else ++ prtd->state = Q6ASM_STREAM_RUNNING; + +- prtd->state = Q6ASM_STREAM_RUNNING; ++ return ret; + +- return 0; ++routing_err: ++ q6asm_cmd(prtd->audio_client, prtd->stream_id, CMD_CLOSE); ++open_err: ++ q6asm_unmap_memory_regions(substream->stream, prtd->audio_client); ++ q6asm_audio_client_free(prtd->audio_client); ++ prtd->audio_client = NULL; ++ ++ return ret; + } + + static int q6asm_dai_trigger(struct snd_soc_component *component, +-- +2.33.0 + diff --git a/queue-5.15/asoc-qdsp6-q6routing-conditionally-reset-frontend-mi.patch b/queue-5.15/asoc-qdsp6-q6routing-conditionally-reset-frontend-mi.patch new file mode 100644 index 00000000000..7c571a8ca2e --- /dev/null +++ b/queue-5.15/asoc-qdsp6-q6routing-conditionally-reset-frontend-mi.patch @@ -0,0 +1,55 @@ +From 79f1916ed21d39434f25cc9d219b29de331dc79d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 11:47:18 +0000 +Subject: ASoC: qdsp6: q6routing: Conditionally reset FrontEnd Mixer + +From: Srinivas Kandagatla + +[ Upstream commit 861afeac7990587588d057b2c0b3222331c3da29 ] + +Stream IDs are reused across multiple BackEnd mixers, do not reset the +stream mixers if they are not already set for that particular FrontEnd. + +Ex: +amixer cset iface=MIXER,name='SLIMBUS_0_RX Audio Mixer MultiMedia1' 1 + +would set the MultiMedia1 steam for SLIMBUS_0_RX, however doing below +command will reset previously setup MultiMedia1 stream, because both of them +are using MultiMedia1 PCM stream. + +amixer cset iface=MIXER,name='SLIMBUS_2_RX Audio Mixer MultiMedia1' 0 + +reset the FrontEnd Mixers conditionally to fix this issue. + +This is more noticeable in desktop setup, where in alsactl tries to restore +the alsa state and overwriting the previous mixer settings. + +Fixes: e3a33673e845 ("ASoC: qdsp6: q6routing: Add q6routing driver") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20211116114721.12517-3-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/qcom/qdsp6/q6routing.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/qcom/qdsp6/q6routing.c b/sound/soc/qcom/qdsp6/q6routing.c +index 3390ebef9549d..243b8179e59df 100644 +--- a/sound/soc/qcom/qdsp6/q6routing.c ++++ b/sound/soc/qcom/qdsp6/q6routing.c +@@ -495,7 +495,11 @@ static int msm_routing_put_audio_mixer(struct snd_kcontrol *kcontrol, + session->port_id = be_id; + snd_soc_dapm_mixer_update_power(dapm, kcontrol, 1, update); + } else { +- session->port_id = -1; ++ if (session->port_id == be_id) { ++ session->port_id = -1; ++ return 0; ++ } ++ + snd_soc_dapm_mixer_update_power(dapm, kcontrol, 0, update); + } + +-- +2.33.0 + diff --git a/queue-5.15/asoc-sof-intel-hda-fix-hotplug-when-only-codec-is-su.patch b/queue-5.15/asoc-sof-intel-hda-fix-hotplug-when-only-codec-is-su.patch new file mode 100644 index 00000000000..f208f6f8fcd --- /dev/null +++ b/queue-5.15/asoc-sof-intel-hda-fix-hotplug-when-only-codec-is-su.patch @@ -0,0 +1,135 @@ +From 23d134346a0c040abe15b990f8308b08d093f74c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Nov 2021 13:16:55 +0200 +Subject: ASoC: SOF: Intel: hda: fix hotplug when only codec is suspended +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kai Vehmanen + +[ Upstream commit fd572393baf0350835e8d822db588f679dc7bcb8 ] + +If codec is in runtime suspend, but controller is not, hotplug events +are missed as the codec has no way to alert the controller. Problem does +not occur if both controller and codec are active, or when both are +suspended. + +An easy way to reproduce is to play an audio stream on one codec (e.g. +to HDMI/DP display codec), wait for other HDA codec to go to runtime +suspend, and then plug in a headset to the suspended codec. The jack +event is not reported correctly in this case. Another way to reproduce +is to force controller to stay active with +"snd_sof_pci.sof_pci_debug=0x1" + +Fix the issue by reconfiguring the WAKEEN register when powering up/down +individual links, and handling control events in the interrupt handler. + +Fixes: 87fc20e4a0cb ("ASoC: SOF: Intel: hda: use hdac_ext fine-grained link management") +Reported-by: Hui Wang +Signed-off-by: Kai Vehmanen +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Ranjani Sridharan +Reviewed-by: Péter Ujfalusi +Link: https://lore.kernel.org/r/20211105111655.668777-1-kai.vehmanen@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-bus.c | 17 +++++++++++++++++ + sound/soc/sof/intel/hda-dsp.c | 3 +-- + sound/soc/sof/intel/hda.c | 16 ++++++++++++++++ + 3 files changed, 34 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sof/intel/hda-bus.c b/sound/soc/sof/intel/hda-bus.c +index 30025d3c16b6e..0862ff8b66273 100644 +--- a/sound/soc/sof/intel/hda-bus.c ++++ b/sound/soc/sof/intel/hda-bus.c +@@ -10,6 +10,8 @@ + #include + #include + #include ++#include ++#include + #include "../sof-priv.h" + #include "hda.h" + +@@ -21,6 +23,18 @@ + #endif + + #if IS_ENABLED(CONFIG_SND_SOC_SOF_HDA) ++static void update_codec_wake_enable(struct hdac_bus *bus, unsigned int addr, bool link_power) ++{ ++ unsigned int mask = snd_hdac_chip_readw(bus, WAKEEN); ++ ++ if (link_power) ++ mask &= ~BIT(addr); ++ else ++ mask |= BIT(addr); ++ ++ snd_hdac_chip_updatew(bus, WAKEEN, STATESTS_INT_MASK, mask); ++} ++ + static void sof_hda_bus_link_power(struct hdac_device *codec, bool enable) + { + struct hdac_bus *bus = codec->bus; +@@ -41,6 +55,9 @@ static void sof_hda_bus_link_power(struct hdac_device *codec, bool enable) + */ + if (codec->addr == HDA_IDISP_ADDR && !enable) + snd_hdac_display_power(bus, HDA_CODEC_IDX_CONTROLLER, false); ++ ++ /* WAKEEN needs to be set for disabled links */ ++ update_codec_wake_enable(bus, codec->addr, enable); + } + + static const struct hdac_bus_ops bus_core_ops = { +diff --git a/sound/soc/sof/intel/hda-dsp.c b/sound/soc/sof/intel/hda-dsp.c +index 623cf291e2074..262a70791a8f8 100644 +--- a/sound/soc/sof/intel/hda-dsp.c ++++ b/sound/soc/sof/intel/hda-dsp.c +@@ -623,8 +623,7 @@ static int hda_suspend(struct snd_sof_dev *sdev, bool runtime_suspend) + hda_dsp_ipc_int_disable(sdev); + + #if IS_ENABLED(CONFIG_SND_SOC_SOF_HDA) +- if (runtime_suspend) +- hda_codec_jack_wake_enable(sdev, true); ++ hda_codec_jack_wake_enable(sdev, runtime_suspend); + + /* power down all hda link */ + snd_hdac_ext_bus_link_power_down_all(bus); +diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c +index f60e2c57d3d0c..ef92cca7ae01e 100644 +--- a/sound/soc/sof/intel/hda.c ++++ b/sound/soc/sof/intel/hda.c +@@ -696,6 +696,20 @@ static int hda_init_caps(struct snd_sof_dev *sdev) + return 0; + } + ++static void hda_check_for_state_change(struct snd_sof_dev *sdev) ++{ ++#if IS_ENABLED(CONFIG_SND_SOC_SOF_HDA) ++ struct hdac_bus *bus = sof_to_bus(sdev); ++ unsigned int codec_mask; ++ ++ codec_mask = snd_hdac_chip_readw(bus, STATESTS); ++ if (codec_mask) { ++ hda_codec_jack_check(sdev); ++ snd_hdac_chip_writew(bus, STATESTS, codec_mask); ++ } ++#endif ++} ++ + static irqreturn_t hda_dsp_interrupt_handler(int irq, void *context) + { + struct snd_sof_dev *sdev = context; +@@ -737,6 +751,8 @@ static irqreturn_t hda_dsp_interrupt_thread(int irq, void *context) + if (hda_sdw_check_wakeen_irq(sdev)) + hda_sdw_process_wakeen(sdev); + ++ hda_check_for_state_change(sdev); ++ + /* enable GIE interrupt */ + snd_sof_dsp_update_bits(sdev, HDA_DSP_HDA_BAR, + SOF_HDA_INTCTL, +-- +2.33.0 + diff --git a/queue-5.15/asoc-stm32-i2s-fix-32-bits-channel-length-without-mc.patch b/queue-5.15/asoc-stm32-i2s-fix-32-bits-channel-length-without-mc.patch new file mode 100644 index 00000000000..614dc610cbb --- /dev/null +++ b/queue-5.15/asoc-stm32-i2s-fix-32-bits-channel-length-without-mc.patch @@ -0,0 +1,38 @@ +From 836fbe64f43c824e996a45fdf81d58b06bcb9cba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Nov 2021 11:44:04 +0100 +Subject: ASoC: stm32: i2s: fix 32 bits channel length without mclk + +From: Olivier Moysan + +[ Upstream commit 424fe7edbed18d47f7b97f7e1322a6f8969b77ae ] + +Fix divider calculation in the case of 32 bits channel +configuration, when no master clock is used. + +Fixes: e4e6ec7b127c ("ASoC: stm32: Add I2S driver") + +Signed-off-by: Olivier Moysan +Link: https://lore.kernel.org/r/20211117104404.3832-1-olivier.moysan@foss.st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/stm/stm32_i2s.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/stm/stm32_i2s.c b/sound/soc/stm/stm32_i2s.c +index 6254bacad6eb7..717f45a83445c 100644 +--- a/sound/soc/stm/stm32_i2s.c ++++ b/sound/soc/stm/stm32_i2s.c +@@ -700,7 +700,7 @@ static int stm32_i2s_configure_clock(struct snd_soc_dai *cpu_dai, + if (ret < 0) + return ret; + +- nb_bits = frame_len * ((cgfr & I2S_CGFR_CHLEN) + 1); ++ nb_bits = frame_len * (FIELD_GET(I2S_CGFR_CHLEN, cgfr) + 1); + ret = stm32_i2s_calc_clk_div(i2s, i2s_clock_rate, + (nb_bits * rate)); + if (ret) +-- +2.33.0 + diff --git a/queue-5.15/asoc-topology-add-missing-rwsem-around-snd_ctl_remov.patch b/queue-5.15/asoc-topology-add-missing-rwsem-around-snd_ctl_remov.patch new file mode 100644 index 00000000000..d709e73d8e9 --- /dev/null +++ b/queue-5.15/asoc-topology-add-missing-rwsem-around-snd_ctl_remov.patch @@ -0,0 +1,53 @@ +From c723f24c78a01ffae4e7fe2241bd522183b110bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 08:18:12 +0100 +Subject: ASoC: topology: Add missing rwsem around snd_ctl_remove() calls + +From: Takashi Iwai + +[ Upstream commit 7e567b5ae06315ef2d70666b149962e2bb4b97af ] + +snd_ctl_remove() has to be called with card->controls_rwsem held (when +called after the card instantiation). This patch add the missing +rwsem calls around it. + +Fixes: 8a9782346dcc ("ASoC: topology: Add topology core") +Signed-off-by: Takashi Iwai +Link: https://lore.kernel.org/r/20211116071812.18109-1-tiwai@suse.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-topology.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c +index f6e5ac3e03140..7459956d62b99 100644 +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -2674,6 +2674,7 @@ EXPORT_SYMBOL_GPL(snd_soc_tplg_component_load); + /* remove dynamic controls from the component driver */ + int snd_soc_tplg_component_remove(struct snd_soc_component *comp) + { ++ struct snd_card *card = comp->card->snd_card; + struct snd_soc_dobj *dobj, *next_dobj; + int pass = SOC_TPLG_PASS_END; + +@@ -2681,6 +2682,7 @@ int snd_soc_tplg_component_remove(struct snd_soc_component *comp) + while (pass >= SOC_TPLG_PASS_START) { + + /* remove mixer controls */ ++ down_write(&card->controls_rwsem); + list_for_each_entry_safe(dobj, next_dobj, &comp->dobj_list, + list) { + +@@ -2719,6 +2721,7 @@ int snd_soc_tplg_component_remove(struct snd_soc_component *comp) + break; + } + } ++ up_write(&card->controls_rwsem); + pass--; + } + +-- +2.33.0 + diff --git a/queue-5.15/cpufreq-intel_pstate-add-ice-lake-server-to-out-of-b.patch b/queue-5.15/cpufreq-intel_pstate-add-ice-lake-server-to-out-of-b.patch new file mode 100644 index 00000000000..04089e0243b --- /dev/null +++ b/queue-5.15/cpufreq-intel_pstate-add-ice-lake-server-to-out-of-b.patch @@ -0,0 +1,42 @@ +From 23fb47b706b4e6cc7850575c92fed6295b9a6fc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Nov 2021 09:16:57 +0000 +Subject: cpufreq: intel_pstate: Add Ice Lake server to out-of-band IDs + +From: Adamos Ttofari + +[ Upstream commit cd23f02f166892603eb9f2d488152b975872b682 ] + +Commit fbdc21e9b038 ("cpufreq: intel_pstate: Add Icelake servers +support in no-HWP mode") enabled the use of Intel P-State driver +for Ice Lake servers. + +But it doesn't cover the case when OS can't control P-States. + +Therefore, for Ice Lake server, if MSR_MISC_PWR_MGMT bits 8 or 18 +are enabled, then the Intel P-State driver should exit as OS can't +control P-States. + +Fixes: fbdc21e9b038 ("cpufreq: intel_pstate: Add Icelake servers support in no-HWP mode") +Signed-off-by: Adamos Ttofari +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/intel_pstate.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index 3e56a4a1d1d3a..e15c3bc17a55c 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -2255,6 +2255,7 @@ static const struct x86_cpu_id intel_pstate_cpu_oob_ids[] __initconst = { + X86_MATCH(BROADWELL_D, core_funcs), + X86_MATCH(BROADWELL_X, core_funcs), + X86_MATCH(SKYLAKE_X, core_funcs), ++ X86_MATCH(ICELAKE_X, core_funcs), + {} + }; + +-- +2.33.0 + diff --git a/queue-5.15/drm-amd-display-fix-dpia-outbox-timeout-after-gpu-re.patch b/queue-5.15/drm-amd-display-fix-dpia-outbox-timeout-after-gpu-re.patch new file mode 100644 index 00000000000..add65a75d4d --- /dev/null +++ b/queue-5.15/drm-amd-display-fix-dpia-outbox-timeout-after-gpu-re.patch @@ -0,0 +1,46 @@ +From d40b1ddc7440fb9e0af6e6dfce61122f46715fbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Nov 2021 16:49:48 -0500 +Subject: drm/amd/display: Fix DPIA outbox timeout after GPU reset + +From: Nicholas Kazlauskas + +[ Upstream commit 6eff272dbee7ad444c491c9a96d49e78e91e2161 ] + +[Why] +The HW interrupt gets disabled after GPU reset so we don't receive +notifications for HPD or AUX from DMUB - leading to timeout and +black screen with (or without) DPIA links connected. + +[How] +Re-enable the interrupt after GPU reset like we do for the other +DC interrupts. + +Fixes: 81927e2808be ("drm/amd/display: Support for DMUB AUX") + +Reviewed-by: Jude Shih +Acked-by: Qingqing Zhuo +Signed-off-by: Nicholas Kazlauskas +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index d15967239474e..56f4569da2f7d 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -2213,6 +2213,8 @@ static int dm_resume(void *handle) + if (amdgpu_in_reset(adev)) { + dc_state = dm->cached_dc_state; + ++ amdgpu_dm_outbox_init(adev); ++ + r = dm_dmub_hw_init(adev); + if (r) + DRM_ERROR("DMUB interface failed to initialize: status=%d\n", r); +-- +2.33.0 + diff --git a/queue-5.15/drm-amd-display-set-plane-update-flags-for-all-plane.patch b/queue-5.15/drm-amd-display-set-plane-update-flags-for-all-plane.patch new file mode 100644 index 00000000000..ac1ab416203 --- /dev/null +++ b/queue-5.15/drm-amd-display-set-plane-update-flags-for-all-plane.patch @@ -0,0 +1,50 @@ +From 3d17a3f9a4c87efd41dded5ca616d6f3604052d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Nov 2021 11:24:10 -0500 +Subject: drm/amd/display: Set plane update flags for all planes in reset + +From: Nicholas Kazlauskas + +[ Upstream commit 21431f70f6014f81b0d118ff4fcee12b00b9dd70 ] + +[Why] +We're only setting the flags on stream[0]'s planes so this logic fails +if we have more than one stream in the state. + +This can cause a page flip timeout with multiple displays in the +configuration. + +[How] +Index into the stream_status array using the stream index - it's a 1:1 +mapping. + +Fixes: cdaae8371aa9 ("drm/amd/display: Handle GPU reset for DC block") + +Reviewed-by: Harry Wentland +Acked-by: Qingqing Zhuo +Signed-off-by: Nicholas Kazlauskas +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 56f4569da2f7d..dc995ce52eff2 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -2226,8 +2226,8 @@ static int dm_resume(void *handle) + + for (i = 0; i < dc_state->stream_count; i++) { + dc_state->streams[i]->mode_changed = true; +- for (j = 0; j < dc_state->stream_status->plane_count; j++) { +- dc_state->stream_status->plane_states[j]->update_flags.raw ++ for (j = 0; j < dc_state->stream_status[i].plane_count; j++) { ++ dc_state->stream_status[i].plane_states[j]->update_flags.raw + = 0xffffffff; + } + } +-- +2.33.0 + diff --git a/queue-5.15/drm-aspeed-fix-vga_pw-sysfs-output.patch b/queue-5.15/drm-aspeed-fix-vga_pw-sysfs-output.patch new file mode 100644 index 00000000000..2ec2db206af --- /dev/null +++ b/queue-5.15/drm-aspeed-fix-vga_pw-sysfs-output.patch @@ -0,0 +1,47 @@ +From 5de6961f47de61566fe48e743ec1b70f3c7ab954 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Nov 2021 09:01:45 +0800 +Subject: drm/aspeed: Fix vga_pw sysfs output + +From: Joel Stanley + +[ Upstream commit b4a6aaeaf4aa79f23775f6688a7e8db3ee1c1303 ] + +Before the drm driver had support for this file there was a driver that +exposed the contents of the vga password register to userspace. It would +present the entire register instead of interpreting it. + +The drm implementation chose to mask of the lower bit, without explaining +why. This breaks the existing userspace, which is looking for 0xa8 in +the lower byte. + +Change our implementation to expose the entire register. + +Fixes: 696029eb36c0 ("drm/aspeed: Add sysfs for output settings") +Reported-by: Oskar Senft +Signed-off-by: Joel Stanley +Reviewed-by: Jeremy Kerr +Tested-by: Oskar Senft +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20211117010145.297253-1-joel@jms.id.au +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/aspeed/aspeed_gfx_drv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/aspeed/aspeed_gfx_drv.c b/drivers/gpu/drm/aspeed/aspeed_gfx_drv.c +index b53fee6f1c170..65f172807a0d5 100644 +--- a/drivers/gpu/drm/aspeed/aspeed_gfx_drv.c ++++ b/drivers/gpu/drm/aspeed/aspeed_gfx_drv.c +@@ -291,7 +291,7 @@ vga_pw_show(struct device *dev, struct device_attribute *attr, char *buf) + if (rc) + return rc; + +- return sprintf(buf, "%u\n", reg & 1); ++ return sprintf(buf, "%u\n", reg); + } + static DEVICE_ATTR_RO(vga_pw); + +-- +2.33.0 + diff --git a/queue-5.15/drm-hyperv-fix-device-removal-on-gen1-vms.patch b/queue-5.15/drm-hyperv-fix-device-removal-on-gen1-vms.patch new file mode 100644 index 00000000000..dad426af16b --- /dev/null +++ b/queue-5.15/drm-hyperv-fix-device-removal-on-gen1-vms.patch @@ -0,0 +1,65 @@ +From 46ce27a07c8ecbaf4dfcb5130f3650276175975f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Nov 2021 12:29:00 +0100 +Subject: drm/hyperv: Fix device removal on Gen1 VMs + +From: Mohammed Gamal + +[ Upstream commit e048834c209a02e3776bcc47d43c6d863e3a67ca ] + +The Hyper-V DRM driver tries to free MMIO region on removing +the device regardless of VM type, while Gen1 VMs don't use MMIO +and hence causing the kernel to crash on a NULL pointer dereference. + +Fix this by making deallocating MMIO only on Gen2 machines and implement +removal for Gen1 + +Fixes: 76c56a5affeb ("drm/hyperv: Add DRM driver for hyperv synthetic video device") + +Signed-off-by: Mohammed Gamal +Reviewed-by: Deepak Rawat +Signed-off-by: Deepak Rawat +Link: https://patchwork.freedesktop.org/patch/msgid/20211119112900.300537-1-mgamal@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/hyperv/hyperv_drm_drv.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/hyperv/hyperv_drm_drv.c b/drivers/gpu/drm/hyperv/hyperv_drm_drv.c +index cd818a6291835..00e53de4812bb 100644 +--- a/drivers/gpu/drm/hyperv/hyperv_drm_drv.c ++++ b/drivers/gpu/drm/hyperv/hyperv_drm_drv.c +@@ -225,12 +225,29 @@ static int hyperv_vmbus_remove(struct hv_device *hdev) + { + struct drm_device *dev = hv_get_drvdata(hdev); + struct hyperv_drm_device *hv = to_hv(dev); ++ struct pci_dev *pdev; + + drm_dev_unplug(dev); + drm_atomic_helper_shutdown(dev); + vmbus_close(hdev->channel); + hv_set_drvdata(hdev, NULL); +- vmbus_free_mmio(hv->mem->start, hv->fb_size); ++ ++ /* ++ * Free allocated MMIO memory only on Gen2 VMs. ++ * On Gen1 VMs, release the PCI device ++ */ ++ if (efi_enabled(EFI_BOOT)) { ++ vmbus_free_mmio(hv->mem->start, hv->fb_size); ++ } else { ++ pdev = pci_get_device(PCI_VENDOR_ID_MICROSOFT, ++ PCI_DEVICE_ID_HYPERV_VIDEO, NULL); ++ if (!pdev) { ++ drm_err(dev, "Unable to find PCI Hyper-V video\n"); ++ return -ENODEV; ++ } ++ pci_release_region(pdev, 0); ++ pci_dev_put(pdev); ++ } + + return 0; + } +-- +2.33.0 + diff --git a/queue-5.15/drm-nouveau-acr-fix-a-couple-null-vs-is_err-checks.patch b/queue-5.15/drm-nouveau-acr-fix-a-couple-null-vs-is_err-checks.patch new file mode 100644 index 00000000000..d568c8cf2dc --- /dev/null +++ b/queue-5.15/drm-nouveau-acr-fix-a-couple-null-vs-is_err-checks.patch @@ -0,0 +1,66 @@ +From 05c2c11351e8a9bfce44e8f2b647f92543b35588 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Nov 2021 14:13:14 +0300 +Subject: drm/nouveau/acr: fix a couple NULL vs IS_ERR() checks + +From: Dan Carpenter + +[ Upstream commit b371fd131fcec59f6165c80778bdc2cd1abd616b ] + +The nvkm_acr_lsfw_add() function never returns NULL. It returns error +pointers on error. + +Fixes: 22dcda45a3d1 ("drm/nouveau/acr: implement new subdev to replace "secure boot"") +Signed-off-by: Dan Carpenter +Reviewed-by: Ben Skeggs +Signed-off-by: Karol Herbst +Link: https://patchwork.freedesktop.org/patch/msgid/20211118111314.GB1147@kili +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/subdev/acr/gm200.c | 6 ++++-- + drivers/gpu/drm/nouveau/nvkm/subdev/acr/gp102.c | 6 ++++-- + 2 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/acr/gm200.c b/drivers/gpu/drm/nouveau/nvkm/subdev/acr/gm200.c +index cdb1ead26d84f..82b4c8e1457c2 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/acr/gm200.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/acr/gm200.c +@@ -207,11 +207,13 @@ int + gm200_acr_wpr_parse(struct nvkm_acr *acr) + { + const struct wpr_header *hdr = (void *)acr->wpr_fw->data; ++ struct nvkm_acr_lsfw *lsfw; + + while (hdr->falcon_id != WPR_HEADER_V0_FALCON_ID_INVALID) { + wpr_header_dump(&acr->subdev, hdr); +- if (!nvkm_acr_lsfw_add(NULL, acr, NULL, (hdr++)->falcon_id)) +- return -ENOMEM; ++ lsfw = nvkm_acr_lsfw_add(NULL, acr, NULL, (hdr++)->falcon_id); ++ if (IS_ERR(lsfw)) ++ return PTR_ERR(lsfw); + } + + return 0; +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/acr/gp102.c b/drivers/gpu/drm/nouveau/nvkm/subdev/acr/gp102.c +index fb9132a39bb1a..fd97a935a380e 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/acr/gp102.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/acr/gp102.c +@@ -161,11 +161,13 @@ int + gp102_acr_wpr_parse(struct nvkm_acr *acr) + { + const struct wpr_header_v1 *hdr = (void *)acr->wpr_fw->data; ++ struct nvkm_acr_lsfw *lsfw; + + while (hdr->falcon_id != WPR_HEADER_V1_FALCON_ID_INVALID) { + wpr_header_v1_dump(&acr->subdev, hdr); +- if (!nvkm_acr_lsfw_add(NULL, acr, NULL, (hdr++)->falcon_id)) +- return -ENOMEM; ++ lsfw = nvkm_acr_lsfw_add(NULL, acr, NULL, (hdr++)->falcon_id); ++ if (IS_ERR(lsfw)) ++ return PTR_ERR(lsfw); + } + + return 0; +-- +2.33.0 + diff --git a/queue-5.15/drm-vc4-fix-error-code-in-vc4_create_object.patch b/queue-5.15/drm-vc4-fix-error-code-in-vc4_create_object.patch new file mode 100644 index 00000000000..dbafb2c37f4 --- /dev/null +++ b/queue-5.15/drm-vc4-fix-error-code-in-vc4_create_object.patch @@ -0,0 +1,38 @@ +From e98ec816e57cecca1eef943f6fdc67824e7e43f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Nov 2021 14:14:16 +0300 +Subject: drm/vc4: fix error code in vc4_create_object() + +From: Dan Carpenter + +[ Upstream commit 96c5f82ef0a145d3e56e5b26f2bf6dcd2ffeae1c ] + +The ->gem_create_object() functions are supposed to return NULL if there +is an error. None of the callers expect error pointers so returing one +will lead to an Oops. See drm_gem_vram_create(), for example. + +Fixes: c826a6e10644 ("drm/vc4: Add a BO cache.") +Signed-off-by: Dan Carpenter +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20211118111416.GC1147@kili +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_bo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c +index fddaeb0b09c11..f642bd6e71ff4 100644 +--- a/drivers/gpu/drm/vc4/vc4_bo.c ++++ b/drivers/gpu/drm/vc4/vc4_bo.c +@@ -391,7 +391,7 @@ struct drm_gem_object *vc4_create_object(struct drm_device *dev, size_t size) + + bo = kzalloc(sizeof(*bo), GFP_KERNEL); + if (!bo) +- return ERR_PTR(-ENOMEM); ++ return NULL; + + bo->madv = VC4_MADV_WILLNEED; + refcount_set(&bo->usecnt, 0); +-- +2.33.0 + diff --git a/queue-5.15/erofs-fix-deadlock-when-shrink-erofs-slab.patch b/queue-5.15/erofs-fix-deadlock-when-shrink-erofs-slab.patch new file mode 100644 index 00000000000..c888bb315de --- /dev/null +++ b/queue-5.15/erofs-fix-deadlock-when-shrink-erofs-slab.patch @@ -0,0 +1,83 @@ +From bc30cc84687dd56d79a20c076b31b9ca004161f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Nov 2021 21:58:44 +0800 +Subject: erofs: fix deadlock when shrink erofs slab + +From: Huang Jianan + +[ Upstream commit 57bbeacdbee72a54eb97d56b876cf9c94059fc34 ] + +We observed the following deadlock in the stress test under low +memory scenario: + +Thread A Thread B +- erofs_shrink_scan + - erofs_try_to_release_workgroup + - erofs_workgroup_try_to_freeze -- A + - z_erofs_do_read_page + - z_erofs_collection_begin + - z_erofs_register_collection + - erofs_insert_workgroup + - xa_lock(&sbi->managed_pslots) -- B + - erofs_workgroup_get + - erofs_wait_on_workgroup_freezed -- A + - xa_erase + - xa_lock(&sbi->managed_pslots) -- B + +To fix this, it needs to hold xa_lock before freezing the workgroup +since xarray will be touched then. So let's hold the lock before +accessing each workgroup, just like what we did with the radix tree +before. + +[ Gao Xiang: Jianhua Hao also reports this issue at + https://lore.kernel.org/r/b10b85df30694bac8aadfe43537c897a@xiaomi.com ] + +Link: https://lore.kernel.org/r/20211118135844.3559-1-huangjianan@oppo.com +Fixes: 64094a04414f ("erofs: convert workstn to XArray") +Reviewed-by: Chao Yu +Reviewed-by: Gao Xiang +Signed-off-by: Huang Jianan +Reported-by: Jianhua Hao +Signed-off-by: Gao Xiang +Signed-off-by: Sasha Levin +--- + fs/erofs/utils.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/fs/erofs/utils.c b/fs/erofs/utils.c +index bd86067a63f7f..3ca703cd5b24a 100644 +--- a/fs/erofs/utils.c ++++ b/fs/erofs/utils.c +@@ -141,7 +141,7 @@ static bool erofs_try_to_release_workgroup(struct erofs_sb_info *sbi, + * however in order to avoid some race conditions, add a + * DBG_BUGON to observe this in advance. + */ +- DBG_BUGON(xa_erase(&sbi->managed_pslots, grp->index) != grp); ++ DBG_BUGON(__xa_erase(&sbi->managed_pslots, grp->index) != grp); + + /* last refcount should be connected with its managed pslot. */ + erofs_workgroup_unfreeze(grp, 0); +@@ -156,15 +156,19 @@ static unsigned long erofs_shrink_workstation(struct erofs_sb_info *sbi, + unsigned int freed = 0; + unsigned long index; + ++ xa_lock(&sbi->managed_pslots); + xa_for_each(&sbi->managed_pslots, index, grp) { + /* try to shrink each valid workgroup */ + if (!erofs_try_to_release_workgroup(sbi, grp)) + continue; ++ xa_unlock(&sbi->managed_pslots); + + ++freed; + if (!--nr_shrink) +- break; ++ return freed; ++ xa_lock(&sbi->managed_pslots); + } ++ xa_unlock(&sbi->managed_pslots); + return freed; + } + +-- +2.33.0 + diff --git a/queue-5.15/ethtool-ioctl-fix-potential-null-deref-in-ethtool_se.patch b/queue-5.15/ethtool-ioctl-fix-potential-null-deref-in-ethtool_se.patch new file mode 100644 index 00000000000..fd6b7ad78ce --- /dev/null +++ b/queue-5.15/ethtool-ioctl-fix-potential-null-deref-in-ethtool_se.patch @@ -0,0 +1,55 @@ +From 30e5e8761baef22a22d308f6485bc920d9ce4cbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Nov 2021 18:55:43 +0100 +Subject: ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce() + +From: Julian Wiedmann + +[ Upstream commit 0276af2176c78771da7f311621a25d7608045827 ] + +ethtool_set_coalesce() now uses both the .get_coalesce() and +.set_coalesce() callbacks. But the check for their availability is +buggy, so changing the coalesce settings on a device where the driver +provides only _one_ of the callbacks results in a NULL pointer +dereference instead of an -EOPNOTSUPP. + +Fix the condition so that the availability of both callbacks is +ensured. This also matches the netlink code. + +Note that reproducing this requires some effort - it only affects the +legacy ioctl path, and needs a specific combination of driver options: +- have .get_coalesce() and .coalesce_supported but no + .set_coalesce(), or +- have .set_coalesce() but no .get_coalesce(). Here eg. ethtool doesn't + cause the crash as it first attempts to call ethtool_get_coalesce() + and bails out on error. + +Fixes: f3ccfda19319 ("ethtool: extend coalesce setting uAPI with CQE mode") +Cc: Yufeng Mo +Cc: Huazhong Tan +Cc: Andrew Lunn +Cc: Heiner Kallweit +Signed-off-by: Julian Wiedmann +Link: https://lore.kernel.org/r/20211126175543.28000-1-jwi@linux.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ethtool/ioctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c +index f2abc31528883..e4983f473a3c5 100644 +--- a/net/ethtool/ioctl.c ++++ b/net/ethtool/ioctl.c +@@ -1697,7 +1697,7 @@ static noinline_for_stack int ethtool_set_coalesce(struct net_device *dev, + struct ethtool_coalesce coalesce; + int ret; + +- if (!dev->ethtool_ops->set_coalesce && !dev->ethtool_ops->get_coalesce) ++ if (!dev->ethtool_ops->set_coalesce || !dev->ethtool_ops->get_coalesce) + return -EOPNOTSUPP; + + ret = dev->ethtool_ops->get_coalesce(dev, &coalesce, &kernel_coalesce, +-- +2.33.0 + diff --git a/queue-5.15/firmware-arm_scmi-fix-base-agent-discover-response.patch b/queue-5.15/firmware-arm_scmi-fix-base-agent-discover-response.patch new file mode 100644 index 00000000000..8a25a096f2f --- /dev/null +++ b/queue-5.15/firmware-arm_scmi-fix-base-agent-discover-response.patch @@ -0,0 +1,84 @@ +From 65113340a044b2df06440179237fcf3c3e48dea9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Nov 2021 09:18:56 +0100 +Subject: firmware: arm_scmi: Fix base agent discover response + +From: Vincent Guittot + +[ Upstream commit d1cbd9e0f7e51ae8e3638a36ba884fdbb2fc967e ] + +According to scmi specification, the response of the discover agent request +is made of: +- int32 status +- uint32 agent_id +- uint8 name[16] + +but the current implementation doesn't take into account the agent_id field +and only allocates a rx buffer of SCMI_MAX_STR_SIZE length + +Allocate the correct length for rx buffer and copy the name from the +correct offset in the response. + +While no error were returned until v5.15, v5.16-rc1 fails with virtio_scmi +transport channel: + + | arm-scmi firmware:scmi0: SCMI Notifications - Core Enabled. + | arm-scmi firmware:scmi0: SCMI Protocol v2.0 'Linaro:PMWG' Firmware version 0x2090000 + | scmi-virtio virtio0: tx:used len 28 is larger than in buflen 24 + +Link: https://lore.kernel.org/r/20211117081856.9932-1-vincent.guittot@linaro.org +Fixes: b6f20ff8bd94 ("firmware: arm_scmi: add common infrastructure and support for base protocol") +Tested-by: Cristian Marussi +Reviewed-by: Cristian Marussi +Signed-off-by: Vincent Guittot +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/base.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/base.c b/drivers/firmware/arm_scmi/base.c +index de416f9e79213..f5219334fd3a5 100644 +--- a/drivers/firmware/arm_scmi/base.c ++++ b/drivers/firmware/arm_scmi/base.c +@@ -34,6 +34,12 @@ struct scmi_msg_resp_base_attributes { + __le16 reserved; + }; + ++struct scmi_msg_resp_base_discover_agent { ++ __le32 agent_id; ++ u8 name[SCMI_MAX_STR_SIZE]; ++}; ++ ++ + struct scmi_msg_base_error_notify { + __le32 event_control; + #define BASE_TP_NOTIFY_ALL BIT(0) +@@ -225,18 +231,21 @@ static int scmi_base_discover_agent_get(const struct scmi_protocol_handle *ph, + int id, char *name) + { + int ret; ++ struct scmi_msg_resp_base_discover_agent *agent_info; + struct scmi_xfer *t; + + ret = ph->xops->xfer_get_init(ph, BASE_DISCOVER_AGENT, +- sizeof(__le32), SCMI_MAX_STR_SIZE, &t); ++ sizeof(__le32), sizeof(*agent_info), &t); + if (ret) + return ret; + + put_unaligned_le32(id, t->tx.buf); + + ret = ph->xops->do_xfer(ph, t); +- if (!ret) +- strlcpy(name, t->rx.buf, SCMI_MAX_STR_SIZE); ++ if (!ret) { ++ agent_info = t->rx.buf; ++ strlcpy(name, agent_info->name, SCMI_MAX_STR_SIZE); ++ } + + ph->xops->xfer_put(ph, t); + +-- +2.33.0 + diff --git a/queue-5.15/firmware-arm_scmi-fix-null-de-reference-on-error-pat.patch b/queue-5.15/firmware-arm_scmi-fix-null-de-reference-on-error-pat.patch new file mode 100644 index 00000000000..7445173586f --- /dev/null +++ b/queue-5.15/firmware-arm_scmi-fix-null-de-reference-on-error-pat.patch @@ -0,0 +1,69 @@ +From 44ffc7fc4a6a217c3c0b2cc7edf166f005e50fdb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Nov 2021 18:07:05 +0000 +Subject: firmware: arm_scmi: Fix null de-reference on error path + +From: Cristian Marussi + +[ Upstream commit 95161165727650a707bc34ecfac286a418b6bb00 ] + +During channel setup a failure in the call of scmi_vio_feed_vq_rx() leads +to an attempt to access a dev pointer by dereferencing vioch->cinfo at +a time when vioch->cinfo has still to be initialized. + +Fix it by providing the device reference directly to scmi_vio_feed_vq_rx. + +Link: https://lore.kernel.org/r/20211112180705.41601-1-cristian.marussi@arm.com +Fixes: 46abe13b5e3db ("firmware: arm_scmi: Add virtio transport") +Signed-off-by: Cristian Marussi +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/virtio.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/virtio.c b/drivers/firmware/arm_scmi/virtio.c +index 11e8efb713751..87039c5c03fdb 100644 +--- a/drivers/firmware/arm_scmi/virtio.c ++++ b/drivers/firmware/arm_scmi/virtio.c +@@ -82,7 +82,8 @@ static bool scmi_vio_have_vq_rx(struct virtio_device *vdev) + } + + static int scmi_vio_feed_vq_rx(struct scmi_vio_channel *vioch, +- struct scmi_vio_msg *msg) ++ struct scmi_vio_msg *msg, ++ struct device *dev) + { + struct scatterlist sg_in; + int rc; +@@ -94,8 +95,7 @@ static int scmi_vio_feed_vq_rx(struct scmi_vio_channel *vioch, + + rc = virtqueue_add_inbuf(vioch->vqueue, &sg_in, 1, msg, GFP_ATOMIC); + if (rc) +- dev_err_once(vioch->cinfo->dev, +- "failed to add to virtqueue (%d)\n", rc); ++ dev_err_once(dev, "failed to add to virtqueue (%d)\n", rc); + else + virtqueue_kick(vioch->vqueue); + +@@ -108,7 +108,7 @@ static void scmi_finalize_message(struct scmi_vio_channel *vioch, + struct scmi_vio_msg *msg) + { + if (vioch->is_rx) { +- scmi_vio_feed_vq_rx(vioch, msg); ++ scmi_vio_feed_vq_rx(vioch, msg, vioch->cinfo->dev); + } else { + /* Here IRQs are assumed to be already disabled by the caller */ + spin_lock(&vioch->lock); +@@ -269,7 +269,7 @@ static int virtio_chan_setup(struct scmi_chan_info *cinfo, struct device *dev, + list_add_tail(&msg->list, &vioch->free_list); + spin_unlock_irqrestore(&vioch->lock, flags); + } else { +- scmi_vio_feed_vq_rx(vioch, msg); ++ scmi_vio_feed_vq_rx(vioch, msg, cinfo->dev); + } + } + +-- +2.33.0 + diff --git a/queue-5.15/firmware-arm_scmi-pm-propagate-return-value-to-calle.patch b/queue-5.15/firmware-arm_scmi-pm-propagate-return-value-to-calle.patch new file mode 100644 index 00000000000..4889978e2b6 --- /dev/null +++ b/queue-5.15/firmware-arm_scmi-pm-propagate-return-value-to-calle.patch @@ -0,0 +1,39 @@ +From 100dc0543b0e45b0950b1756c9b0a8ee4885e2d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 14:42:27 +0800 +Subject: firmware: arm_scmi: pm: Propagate return value to caller + +From: Peng Fan + +[ Upstream commit 1446fc6c678e8d8b31606a4b877abe205f344b38 ] + +of_genpd_add_provider_onecell may return error, so let's propagate +its return value to caller + +Link: https://lore.kernel.org/r/20211116064227.20571-1-peng.fan@oss.nxp.com +Fixes: 898216c97ed2 ("firmware: arm_scmi: add device power domain support using genpd") +Signed-off-by: Peng Fan +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/scmi_pm_domain.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/scmi_pm_domain.c b/drivers/firmware/arm_scmi/scmi_pm_domain.c +index 4371fdcd5a73f..581d34c957695 100644 +--- a/drivers/firmware/arm_scmi/scmi_pm_domain.c ++++ b/drivers/firmware/arm_scmi/scmi_pm_domain.c +@@ -138,9 +138,7 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev) + scmi_pd_data->domains = domains; + scmi_pd_data->num_domains = num_domains; + +- of_genpd_add_provider_onecell(np, scmi_pd_data); +- +- return 0; ++ return of_genpd_add_provider_onecell(np, scmi_pd_data); + } + + static const struct scmi_device_id scmi_id_table[] = { +-- +2.33.0 + diff --git a/queue-5.15/firmware-smccc-fix-check-for-arch_soc_id-not-impleme.patch b/queue-5.15/firmware-smccc-fix-check-for-arch_soc_id-not-impleme.patch new file mode 100644 index 00000000000..377b729d64e --- /dev/null +++ b/queue-5.15/firmware-smccc-fix-check-for-arch_soc_id-not-impleme.patch @@ -0,0 +1,43 @@ +From e5ab8a56f83e81e313fb1e947d4149f5cd34ff9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Nov 2021 15:39:01 -0800 +Subject: firmware: smccc: Fix check for ARCH_SOC_ID not implemented + +From: Michael Kelley + +[ Upstream commit e95d8eaee21cd0d117d34125d4cdc97489c1ab82 ] + +The ARCH_FEATURES function ID is a 32-bit SMC call, which returns +a 32-bit result per the SMCCC spec. Current code is doing a 64-bit +comparison against -1 (SMCCC_RET_NOT_SUPPORTED) to detect that the +feature is unimplemented. That check doesn't work in a Hyper-V VM, +where the upper 32-bits are zero as allowed by the spec. + +Cast the result as an 'int' so the comparison works. The change also +makes the code consistent with other similar checks in this file. + +Fixes: 821b67fa4639 ("firmware: smccc: Add ARCH_SOC_ID support") +Signed-off-by: Michael Kelley +Reviewed-by: Sudeep Holla +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/firmware/smccc/soc_id.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/smccc/soc_id.c b/drivers/firmware/smccc/soc_id.c +index 581aa5e9b0778..dd7c3d5e8b0bb 100644 +--- a/drivers/firmware/smccc/soc_id.c ++++ b/drivers/firmware/smccc/soc_id.c +@@ -50,7 +50,7 @@ static int __init smccc_soc_init(void) + arm_smccc_1_1_invoke(ARM_SMCCC_ARCH_FEATURES_FUNC_ID, + ARM_SMCCC_ARCH_SOC_ID, &res); + +- if (res.a0 == SMCCC_RET_NOT_SUPPORTED) { ++ if ((int)res.a0 == SMCCC_RET_NOT_SUPPORTED) { + pr_info("ARCH_SOC_ID not implemented, skipping ....\n"); + return 0; + } +-- +2.33.0 + diff --git a/queue-5.15/hid-input-fix-parsing-of-hid_cp_consumer_control-fie.patch b/queue-5.15/hid-input-fix-parsing-of-hid_cp_consumer_control-fie.patch new file mode 100644 index 00000000000..68c0198c631 --- /dev/null +++ b/queue-5.15/hid-input-fix-parsing-of-hid_cp_consumer_control-fie.patch @@ -0,0 +1,47 @@ +From 0d4500123d6f7b51c6eede9b47d345ecb99b56d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Oct 2021 18:33:30 +0200 +Subject: HID: input: Fix parsing of HID_CP_CONSUMER_CONTROL fields +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +[ Upstream commit 7fc48fd6b2c0acacd8130d83d2a037670d6192d2 ] + +Fix parsing of HID_CP_CONSUMER_CONTROL fields which are not in +the HID_CP_PROGRAMMABLEBUTTONS collection. + +Fixes: bcfa8d14570d ("HID: input: Add support for Programmable Buttons") +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=2018096 +Cc: Thomas Weißschuh +Suggested-by: Benjamin Tissoires +Signed-off-by: Hans de Goede +Reviewed-By: Thomas Weißschuh +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-input.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 4b5ebeacd2836..4b3f4a5e23058 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -650,10 +650,9 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel + code += KEY_MACRO1; + else + code += BTN_TRIGGER_HAPPY - 0x1e; +- } else { +- goto ignore; ++ break; + } +- break; ++ fallthrough; + default: + switch (field->physical) { + case HID_GD_MOUSE: +-- +2.33.0 + diff --git a/queue-5.15/hid-input-set-usage-type-to-key-on-keycode-remap.patch b/queue-5.15/hid-input-set-usage-type-to-key-on-keycode-remap.patch new file mode 100644 index 00000000000..afc3547922e --- /dev/null +++ b/queue-5.15/hid-input-set-usage-type-to-key-on-keycode-remap.patch @@ -0,0 +1,60 @@ +From 5c2c2354de650bd8206c5f46553045ae8047fb21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Oct 2021 22:55:42 +0200 +Subject: HID: input: set usage type to key on keycode remap +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 3e6a950d98366f5e716904e9a7e8ffc7ed638bd6 ] + +When a scancode is manually remapped that previously was not handled as +key, then the old usage type was incorrectly reused. + +This caused issues on a "04b3:301b IBM Corp. SK-8815 Keyboard" which has +marked some of its keys with an invalid HID usage. These invalid usage +keys are being ignored since support for USB programmable buttons was +added. + +The scancodes are however remapped explicitly by the systemd hwdb to the +keycodes that are printed on the physical buttons. During this mapping +step the existing usage is retrieved which will be found with a default +type of 0 (EV_SYN) instead of EV_KEY. + +The events with the correct code but EV_SYN type are not forwarded to +userspace. + +This also leads to a kernel oops when trying to print the report descriptor +via debugfs. hid_resolv_event() tries to resolve a EV_SYN event with an +EV_KEY code which leads to an out-of-bounds access in the EV_SYN names +array. + +Fixes: bcfa8d1457 ("HID: input: Add support for Programmable Buttons") +Fixes: f5854fad39 ("Input: hid-input - allow mapping unknown usages") +Reported-by: Brent Roman +Tested-by: Brent Roman +Signed-off-by: Thomas Weißschuh +Reviewed-by: Dmitry Torokhov +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-input.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 4b3f4a5e23058..6561770f1af55 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -160,6 +160,7 @@ static int hidinput_setkeycode(struct input_dev *dev, + if (usage) { + *old_keycode = usage->type == EV_KEY ? + usage->code : KEY_RESERVED; ++ usage->type = EV_KEY; + usage->code = ke->keycode; + + clear_bit(*old_keycode, dev->keybit); +-- +2.33.0 + diff --git a/queue-5.15/hid-magicmouse-prevent-division-by-0-on-scroll.patch b/queue-5.15/hid-magicmouse-prevent-division-by-0-on-scroll.patch new file mode 100644 index 00000000000..cd1a0aaa9ea --- /dev/null +++ b/queue-5.15/hid-magicmouse-prevent-division-by-0-on-scroll.patch @@ -0,0 +1,64 @@ +From e0026f0006eda25d9354b0b049722d4ffe9526f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Nov 2021 03:53:27 +0100 +Subject: HID: magicmouse: prevent division by 0 on scroll +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Claudia Pellegrino + +[ Upstream commit a1091118e0d6d84c2fdb94e6c397ac790bfb9dd6 ] + +In hid_magicmouse, if the user has set scroll_speed to a value between +55 and 63 and scrolls seven times in quick succession, the +step_hr variable in the magicmouse_emit_touch function becomes 0. + +That causes a division by zero further down in the function when +it does `step_x_hr /= step_hr`. + +To reproduce, create `/etc/modprobe.d/hid_magicmouse.conf` with the +following content: + +``` +options hid_magicmouse scroll_acceleration=1 scroll_speed=55 +``` + +Then reboot, connect a Magic Mouse and scroll seven times quickly. +The system will freeze for a minute, and after that `dmesg` will +confirm that a division by zero occurred. + +Enforce a minimum of 1 for the variable so the high resolution +step count can never reach 0 even at maximum scroll acceleration. + +Fixes: d4b9f10a0eb6 ("HID: magicmouse: enable high-resolution scroll") + +Signed-off-by: Claudia Pellegrino +Tested-by: José Expósito +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-magicmouse.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c +index 686788ebf3e1e..d7687ce706144 100644 +--- a/drivers/hid/hid-magicmouse.c ++++ b/drivers/hid/hid-magicmouse.c +@@ -256,8 +256,11 @@ static void magicmouse_emit_touch(struct magicmouse_sc *msc, int raw_id, u8 *tda + unsigned long now = jiffies; + int step_x = msc->touches[id].scroll_x - x; + int step_y = msc->touches[id].scroll_y - y; +- int step_hr = ((64 - (int)scroll_speed) * msc->scroll_accel) / +- SCROLL_HR_STEPS; ++ int step_hr = ++ max_t(int, ++ ((64 - (int)scroll_speed) * msc->scroll_accel) / ++ SCROLL_HR_STEPS, ++ 1); + int step_x_hr = msc->touches[id].scroll_x_hr - x; + int step_y_hr = msc->touches[id].scroll_y_hr - y; + +-- +2.33.0 + diff --git a/queue-5.15/i2c-virtio-disable-timeout-handling.patch b/queue-5.15/i2c-virtio-disable-timeout-handling.patch new file mode 100644 index 00000000000..a63de1f09c6 --- /dev/null +++ b/queue-5.15/i2c-virtio-disable-timeout-handling.patch @@ -0,0 +1,105 @@ +From 5fd1e6a661fd9abed41bf3667009d30fa426ee4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Nov 2021 17:04:11 +0100 +Subject: i2c: virtio: disable timeout handling + +From: Vincent Whitchurch + +[ Upstream commit 84e1d0bf1d7121759622dabf8fbef4c99ad597c5 ] + +If a timeout is hit, it can result is incorrect data on the I2C bus +and/or memory corruptions in the guest since the device can still be +operating on the buffers it was given while the guest has freed them. + +Here is, for example, the start of a slub_debug splat which was +triggered on the next transfer after one transfer was forced to timeout +by setting a breakpoint in the backend (rust-vmm/vhost-device): + + BUG kmalloc-1k (Not tainted): Poison overwritten + First byte 0x1 instead of 0x6b + Allocated in virtio_i2c_xfer+0x65/0x35c age=350 cpu=0 pid=29 + __kmalloc+0xc2/0x1c9 + virtio_i2c_xfer+0x65/0x35c + __i2c_transfer+0x429/0x57d + i2c_transfer+0x115/0x134 + i2cdev_ioctl_rdwr+0x16a/0x1de + i2cdev_ioctl+0x247/0x2ed + vfs_ioctl+0x21/0x30 + sys_ioctl+0xb18/0xb41 + Freed in virtio_i2c_xfer+0x32e/0x35c age=244 cpu=0 pid=29 + kfree+0x1bd/0x1cc + virtio_i2c_xfer+0x32e/0x35c + __i2c_transfer+0x429/0x57d + i2c_transfer+0x115/0x134 + i2cdev_ioctl_rdwr+0x16a/0x1de + i2cdev_ioctl+0x247/0x2ed + vfs_ioctl+0x21/0x30 + sys_ioctl+0xb18/0xb41 + +There is no simple fix for this (the driver would have to always create +bounce buffers and hold on to them until the device eventually returns +the buffers), so just disable the timeout support for now. + +Fixes: 3cfc88380413d20f ("i2c: virtio: add a virtio i2c frontend driver") +Acked-by: Jie Deng +Signed-off-by: Vincent Whitchurch +Acked-by: Michael S. Tsirkin +Reviewed-by: Viresh Kumar +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-virtio.c | 14 +++++--------- + 1 file changed, 5 insertions(+), 9 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-virtio.c b/drivers/i2c/busses/i2c-virtio.c +index f10a603b13fb0..7b2474e6876f4 100644 +--- a/drivers/i2c/busses/i2c-virtio.c ++++ b/drivers/i2c/busses/i2c-virtio.c +@@ -106,11 +106,10 @@ static int virtio_i2c_prepare_reqs(struct virtqueue *vq, + + static int virtio_i2c_complete_reqs(struct virtqueue *vq, + struct virtio_i2c_req *reqs, +- struct i2c_msg *msgs, int num, +- bool timedout) ++ struct i2c_msg *msgs, int num) + { + struct virtio_i2c_req *req; +- bool failed = timedout; ++ bool failed = false; + unsigned int len; + int i, j = 0; + +@@ -132,7 +131,7 @@ static int virtio_i2c_complete_reqs(struct virtqueue *vq, + j++; + } + +- return timedout ? -ETIMEDOUT : j; ++ return j; + } + + static int virtio_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, +@@ -141,7 +140,6 @@ static int virtio_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, + struct virtio_i2c *vi = i2c_get_adapdata(adap); + struct virtqueue *vq = vi->vq; + struct virtio_i2c_req *reqs; +- unsigned long time_left; + int count; + + reqs = kcalloc(num, sizeof(*reqs), GFP_KERNEL); +@@ -164,11 +162,9 @@ static int virtio_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, + reinit_completion(&vi->completion); + virtqueue_kick(vq); + +- time_left = wait_for_completion_timeout(&vi->completion, adap->timeout); +- if (!time_left) +- dev_err(&adap->dev, "virtio i2c backend timeout.\n"); ++ wait_for_completion(&vi->completion); + +- count = virtio_i2c_complete_reqs(vq, reqs, msgs, count, !time_left); ++ count = virtio_i2c_complete_reqs(vq, reqs, msgs, count); + + err_free: + kfree(reqs); +-- +2.33.0 + diff --git a/queue-5.15/iavf-fix-refreshing-iavf-adapter-stats-on-ethtool-re.patch b/queue-5.15/iavf-fix-refreshing-iavf-adapter-stats-on-ethtool-re.patch new file mode 100644 index 00000000000..a3ca8f8dc38 --- /dev/null +++ b/queue-5.15/iavf-fix-refreshing-iavf-adapter-stats-on-ethtool-re.patch @@ -0,0 +1,114 @@ +From e842683d4a976a3868e600d31a00d916e80262e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Sep 2021 09:01:00 +0000 +Subject: iavf: Fix refreshing iavf adapter stats on ethtool request + +From: Jedrzej Jagielski + +[ Upstream commit 3b5bdd18eb76e7570d9bacbcab6828a9b26ae121 ] + +Currently iavf adapter statistics are refreshed only in a +watchdog task, triggered approximately every two seconds, +which causes some ethtool requests to return outdated values. + +Add explicit statistics refresh when requested by ethtool -S. + +Fixes: b476b0030e61 ("iavf: Move commands processing to the separate function") +Signed-off-by: Jan Sokolowski +Signed-off-by: Jedrzej Jagielski +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf.h | 2 ++ + drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 3 +++ + drivers/net/ethernet/intel/iavf/iavf_main.c | 18 ++++++++++++++++++ + .../net/ethernet/intel/iavf/iavf_virtchnl.c | 2 ++ + 4 files changed, 25 insertions(+) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h +index 46312a4415baf..dd81698f0d596 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf.h ++++ b/drivers/net/ethernet/intel/iavf/iavf.h +@@ -305,6 +305,7 @@ struct iavf_adapter { + #define IAVF_FLAG_AQ_DEL_FDIR_FILTER BIT(26) + #define IAVF_FLAG_AQ_ADD_ADV_RSS_CFG BIT(27) + #define IAVF_FLAG_AQ_DEL_ADV_RSS_CFG BIT(28) ++#define IAVF_FLAG_AQ_REQUEST_STATS BIT(29) + + /* OS defined structs */ + struct net_device *netdev; +@@ -398,6 +399,7 @@ int iavf_up(struct iavf_adapter *adapter); + void iavf_down(struct iavf_adapter *adapter); + int iavf_process_config(struct iavf_adapter *adapter); + void iavf_schedule_reset(struct iavf_adapter *adapter); ++void iavf_schedule_request_stats(struct iavf_adapter *adapter); + void iavf_reset(struct iavf_adapter *adapter); + void iavf_set_ethtool_ops(struct net_device *netdev); + void iavf_update_stats(struct iavf_adapter *adapter); +diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c +index 71b23922089fb..0cecaff38d042 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c +@@ -354,6 +354,9 @@ static void iavf_get_ethtool_stats(struct net_device *netdev, + struct iavf_adapter *adapter = netdev_priv(netdev); + unsigned int i; + ++ /* Explicitly request stats refresh */ ++ iavf_schedule_request_stats(adapter); ++ + iavf_add_ethtool_stats(&data, adapter, iavf_gstrings_stats); + + rcu_read_lock(); +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index aaf8a2f396e46..5173b6293c6d9 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -165,6 +165,19 @@ void iavf_schedule_reset(struct iavf_adapter *adapter) + } + } + ++/** ++ * iavf_schedule_request_stats - Set the flags and schedule statistics request ++ * @adapter: board private structure ++ * ++ * Sets IAVF_FLAG_AQ_REQUEST_STATS flag so iavf_watchdog_task() will explicitly ++ * request and refresh ethtool stats ++ **/ ++void iavf_schedule_request_stats(struct iavf_adapter *adapter) ++{ ++ adapter->aq_required |= IAVF_FLAG_AQ_REQUEST_STATS; ++ mod_delayed_work(iavf_wq, &adapter->watchdog_task, 0); ++} ++ + /** + * iavf_tx_timeout - Respond to a Tx Hang + * @netdev: network interface device structure +@@ -1700,6 +1713,11 @@ static int iavf_process_aq_command(struct iavf_adapter *adapter) + iavf_del_adv_rss_cfg(adapter); + return 0; + } ++ if (adapter->aq_required & IAVF_FLAG_AQ_REQUEST_STATS) { ++ iavf_request_stats(adapter); ++ return 0; ++ } ++ + return -EAGAIN; + } + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +index 3c735968e1b85..33bde032ca37e 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +@@ -784,6 +784,8 @@ void iavf_request_stats(struct iavf_adapter *adapter) + /* no error message, this isn't crucial */ + return; + } ++ ++ adapter->aq_required &= ~IAVF_FLAG_AQ_REQUEST_STATS; + adapter->current_op = VIRTCHNL_OP_GET_STATS; + vqs.vsi_id = adapter->vsi_res->vsi_id; + /* queue maps are ignored for this message - only the vsi is used */ +-- +2.33.0 + diff --git a/queue-5.15/iavf-fix-vlan-feature-flags-after-vfr.patch b/queue-5.15/iavf-fix-vlan-feature-flags-after-vfr.patch new file mode 100644 index 00000000000..e930b8f28e2 --- /dev/null +++ b/queue-5.15/iavf-fix-vlan-feature-flags-after-vfr.patch @@ -0,0 +1,253 @@ +From 23ed9fcff8e715637460fa42fd804fdc9ae70170 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Nov 2021 09:20:25 -0700 +Subject: iavf: Fix VLAN feature flags after VFR + +From: Brett Creeley + +[ Upstream commit 5951a2b9812d8227d33f20d1899fae60e4f72c04 ] + +When a VF goes through a reset, it's possible for the VF's feature set +to change. For example it may lose the VIRTCHNL_VF_OFFLOAD_VLAN +capability after VF reset. Unfortunately, the driver doesn't correctly +deal with this situation and errors are seen from downing/upping the +interface and/or moving the interface in/out of a network namespace. + +When setting the interface down/up we see the following errors after the +VIRTCHNL_VF_OFFLOAD_VLAN capability was taken away from the VF: + +ice 0000:51:00.1: VF 1 failed opcode 12, retval: -64 iavf 0000:51:09.1: +Failed to add VLAN filter, error IAVF_NOT_SUPPORTED ice 0000:51:00.1: VF +1 failed opcode 13, retval: -64 iavf 0000:51:09.1: Failed to delete VLAN +filter, error IAVF_NOT_SUPPORTED + +These add/delete errors are happening because the VLAN filters are +tracked internally to the driver and regardless of the VLAN_ALLOWED() +setting the driver tries to delete/re-add them over virtchnl. + +Fix the delete failure by making sure to delete any VLAN filter tracking +in the driver when a removal request is made, while preventing the +virtchnl request. This makes it so the driver's VLAN list is up to date +and the errors are + +Fix the add failure by making sure the check for VLAN_ALLOWED() during +reset is done after the VF receives its capability list from the PF via +VIRTCHNL_OP_GET_VF_RESOURCES. If VLAN functionality is not allowed, then +prevent requesting re-adding the filters over virtchnl. + +When moving the interface into a network namespace we see the following +errors after the VIRTCHNL_VF_OFFLOAD_VLAN capability was taken away from +the VF: + +iavf 0000:51:09.1 enp81s0f1v1: NIC Link is Up Speed is 25 Gbps Full Duplex +iavf 0000:51:09.1 temp_27: renamed from enp81s0f1v1 +iavf 0000:51:09.1 mgmt: renamed from temp_27 +iavf 0000:51:09.1 dev27: set_features() failed (-22); wanted 0x020190001fd54833, left 0x020190001fd54bb3 + +These errors are happening because we aren't correctly updating the +netdev capabilities and dealing with ndo_fix_features() and +ndo_set_features() correctly. + +Fix this by only reporting errors in the driver's ndo_set_features() +callback when VIRTCHNL_VF_OFFLOAD_VLAN is not allowed and any attempt to +enable the VLAN features is made. Also, make sure to disable VLAN +insertion, filtering, and stripping since the VIRTCHNL_VF_OFFLOAD_VLAN +flag applies to all of them and not just VLAN stripping. + +Also, after we process the capabilities in the VF reset path, make sure +to call netdev_update_features() in case the capabilities have changed +in order to update the netdev's feature set to match the VF's actual +capabilities. + +Lastly, make sure to always report success on VLAN filter delete when +VIRTCHNL_VF_OFFLOAD_VLAN is not supported. The changed flow in +iavf_del_vlans() allows the stack to delete previosly existing VLAN +filters even if VLAN filtering is not allowed. This makes it so the VLAN +filter list is up to date. + +Fixes: 8774370d268f ("i40e/i40evf: support for VF VLAN tag stripping control") +Signed-off-by: Brett Creeley +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf.h | 1 + + drivers/net/ethernet/intel/iavf/iavf_main.c | 33 ++++++-------- + .../net/ethernet/intel/iavf/iavf_virtchnl.c | 45 +++++++++++++++++-- + 3 files changed, 56 insertions(+), 23 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h +index dd81698f0d596..0ae6da2992d01 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf.h ++++ b/drivers/net/ethernet/intel/iavf/iavf.h +@@ -457,4 +457,5 @@ void iavf_add_adv_rss_cfg(struct iavf_adapter *adapter); + void iavf_del_adv_rss_cfg(struct iavf_adapter *adapter); + struct iavf_mac_filter *iavf_add_filter(struct iavf_adapter *adapter, + const u8 *macaddr); ++int iavf_lock_timeout(struct mutex *lock, unsigned int msecs); + #endif /* _IAVF_H_ */ +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 5173b6293c6d9..fd3717ae70ab1 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -138,7 +138,7 @@ enum iavf_status iavf_free_virt_mem_d(struct iavf_hw *hw, + * + * Returns 0 on success, negative on failure + **/ +-static int iavf_lock_timeout(struct mutex *lock, unsigned int msecs) ++int iavf_lock_timeout(struct mutex *lock, unsigned int msecs) + { + unsigned int wait, delay = 10; + +@@ -708,13 +708,11 @@ static void iavf_del_vlan(struct iavf_adapter *adapter, u16 vlan) + **/ + static void iavf_restore_filters(struct iavf_adapter *adapter) + { +- /* re-add all VLAN filters */ +- if (VLAN_ALLOWED(adapter)) { +- u16 vid; ++ u16 vid; + +- for_each_set_bit(vid, adapter->vsi.active_vlans, VLAN_N_VID) +- iavf_add_vlan(adapter, vid); +- } ++ /* re-add all VLAN filters */ ++ for_each_set_bit(vid, adapter->vsi.active_vlans, VLAN_N_VID) ++ iavf_add_vlan(adapter, vid); + } + + /** +@@ -749,9 +747,6 @@ static int iavf_vlan_rx_kill_vid(struct net_device *netdev, + { + struct iavf_adapter *adapter = netdev_priv(netdev); + +- if (!VLAN_ALLOWED(adapter)) +- return -EIO; +- + iavf_del_vlan(adapter, vid); + clear_bit(vid, adapter->vsi.active_vlans); + +@@ -2142,7 +2137,6 @@ static void iavf_reset_task(struct work_struct *work) + struct net_device *netdev = adapter->netdev; + struct iavf_hw *hw = &adapter->hw; + struct iavf_mac_filter *f, *ftmp; +- struct iavf_vlan_filter *vlf; + struct iavf_cloud_filter *cf; + u32 reg_val; + int i = 0, err; +@@ -2282,11 +2276,6 @@ static void iavf_reset_task(struct work_struct *work) + list_for_each_entry(f, &adapter->mac_filter_list, list) { + f->add = true; + } +- /* re-add all VLAN filters */ +- list_for_each_entry(vlf, &adapter->vlan_filter_list, list) { +- vlf->add = true; +- } +- + spin_unlock_bh(&adapter->mac_vlan_list_lock); + + /* check if TCs are running and re-add all cloud filters */ +@@ -2300,7 +2289,6 @@ static void iavf_reset_task(struct work_struct *work) + spin_unlock_bh(&adapter->cloud_filter_list_lock); + + adapter->aq_required |= IAVF_FLAG_AQ_ADD_MAC_FILTER; +- adapter->aq_required |= IAVF_FLAG_AQ_ADD_VLAN_FILTER; + adapter->aq_required |= IAVF_FLAG_AQ_ADD_CLOUD_FILTER; + iavf_misc_irq_enable(adapter); + +@@ -3398,11 +3386,16 @@ static int iavf_set_features(struct net_device *netdev, + { + struct iavf_adapter *adapter = netdev_priv(netdev); + +- /* Don't allow changing VLAN_RX flag when adapter is not capable +- * of VLAN offload ++ /* Don't allow enabling VLAN features when adapter is not capable ++ * of VLAN offload/filtering + */ + if (!VLAN_ALLOWED(adapter)) { +- if ((netdev->features ^ features) & NETIF_F_HW_VLAN_CTAG_RX) ++ netdev->hw_features &= ~(NETIF_F_HW_VLAN_CTAG_RX | ++ NETIF_F_HW_VLAN_CTAG_TX | ++ NETIF_F_HW_VLAN_CTAG_FILTER); ++ if (features & (NETIF_F_HW_VLAN_CTAG_RX | ++ NETIF_F_HW_VLAN_CTAG_TX | ++ NETIF_F_HW_VLAN_CTAG_FILTER)) + return -EINVAL; + } else if ((netdev->features ^ features) & NETIF_F_HW_VLAN_CTAG_RX) { + if (features & NETIF_F_HW_VLAN_CTAG_RX) +diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +index 33bde032ca37e..08302ab35d687 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +@@ -607,7 +607,7 @@ void iavf_add_vlans(struct iavf_adapter *adapter) + if (f->add) + count++; + } +- if (!count) { ++ if (!count || !VLAN_ALLOWED(adapter)) { + adapter->aq_required &= ~IAVF_FLAG_AQ_ADD_VLAN_FILTER; + spin_unlock_bh(&adapter->mac_vlan_list_lock); + return; +@@ -673,9 +673,19 @@ void iavf_del_vlans(struct iavf_adapter *adapter) + + spin_lock_bh(&adapter->mac_vlan_list_lock); + +- list_for_each_entry(f, &adapter->vlan_filter_list, list) { +- if (f->remove) ++ list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, list) { ++ /* since VLAN capabilities are not allowed, we dont want to send ++ * a VLAN delete request because it will most likely fail and ++ * create unnecessary errors/noise, so just free the VLAN ++ * filters marked for removal to enable bailing out before ++ * sending a virtchnl message ++ */ ++ if (f->remove && !VLAN_ALLOWED(adapter)) { ++ list_del(&f->list); ++ kfree(f); ++ } else if (f->remove) { + count++; ++ } + } + if (!count) { + adapter->aq_required &= ~IAVF_FLAG_AQ_DEL_VLAN_FILTER; +@@ -1724,8 +1734,37 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, + } + spin_lock_bh(&adapter->mac_vlan_list_lock); + iavf_add_filter(adapter, adapter->hw.mac.addr); ++ ++ if (VLAN_ALLOWED(adapter)) { ++ if (!list_empty(&adapter->vlan_filter_list)) { ++ struct iavf_vlan_filter *vlf; ++ ++ /* re-add all VLAN filters over virtchnl */ ++ list_for_each_entry(vlf, ++ &adapter->vlan_filter_list, ++ list) ++ vlf->add = true; ++ ++ adapter->aq_required |= ++ IAVF_FLAG_AQ_ADD_VLAN_FILTER; ++ } ++ } ++ + spin_unlock_bh(&adapter->mac_vlan_list_lock); + iavf_process_config(adapter); ++ ++ /* unlock crit_lock before acquiring rtnl_lock as other ++ * processes holding rtnl_lock could be waiting for the same ++ * crit_lock ++ */ ++ mutex_unlock(&adapter->crit_lock); ++ rtnl_lock(); ++ netdev_update_features(adapter->netdev); ++ rtnl_unlock(); ++ if (iavf_lock_timeout(&adapter->crit_lock, 10000)) ++ dev_warn(&adapter->pdev->dev, "failed to acquire crit_lock in %s\n", ++ __FUNCTION__); ++ + } + break; + case VIRTCHNL_OP_ENABLE_QUEUES: +-- +2.33.0 + diff --git a/queue-5.15/iavf-prevent-changing-static-itr-values-if-adaptive-.patch b/queue-5.15/iavf-prevent-changing-static-itr-values-if-adaptive-.patch new file mode 100644 index 00000000000..9601861b2fd --- /dev/null +++ b/queue-5.15/iavf-prevent-changing-static-itr-values-if-adaptive-.patch @@ -0,0 +1,91 @@ +From bfe432f790e9aa54be6705707cd4b50c4519c1f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 09:53:31 -0700 +Subject: iavf: Prevent changing static ITR values if adaptive moderation is on + +From: Nitesh B Venkatesh + +[ Upstream commit e792779e6b639c182df91b46ac1e5803460b0b15 ] + +Resolve being able to change static values on VF when adaptive interrupt +moderation is enabled. + +This problem is fixed by checking the interrupt settings is not +a combination of change of static value while adaptive interrupt +moderation is turned on. + +Without this fix, the user would be able to change static values +on VF with adaptive moderation enabled. + +Fixes: 65e87c0398f5 ("i40evf: support queue-specific settings for interrupt moderation") +Signed-off-by: Nitesh B Venkatesh +Tested-by: George Kuruvinakunnel +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + .../net/ethernet/intel/iavf/iavf_ethtool.c | 30 ++++++++++++++++--- + 1 file changed, 26 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c +index 144a776793597..71b23922089fb 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c +@@ -723,12 +723,31 @@ static int iavf_get_per_queue_coalesce(struct net_device *netdev, u32 queue, + * + * Change the ITR settings for a specific queue. + **/ +-static void iavf_set_itr_per_queue(struct iavf_adapter *adapter, +- struct ethtool_coalesce *ec, int queue) ++static int iavf_set_itr_per_queue(struct iavf_adapter *adapter, ++ struct ethtool_coalesce *ec, int queue) + { + struct iavf_ring *rx_ring = &adapter->rx_rings[queue]; + struct iavf_ring *tx_ring = &adapter->tx_rings[queue]; + struct iavf_q_vector *q_vector; ++ u16 itr_setting; ++ ++ itr_setting = rx_ring->itr_setting & ~IAVF_ITR_DYNAMIC; ++ ++ if (ec->rx_coalesce_usecs != itr_setting && ++ ec->use_adaptive_rx_coalesce) { ++ netif_info(adapter, drv, adapter->netdev, ++ "Rx interrupt throttling cannot be changed if adaptive-rx is enabled\n"); ++ return -EINVAL; ++ } ++ ++ itr_setting = tx_ring->itr_setting & ~IAVF_ITR_DYNAMIC; ++ ++ if (ec->tx_coalesce_usecs != itr_setting && ++ ec->use_adaptive_tx_coalesce) { ++ netif_info(adapter, drv, adapter->netdev, ++ "Tx interrupt throttling cannot be changed if adaptive-tx is enabled\n"); ++ return -EINVAL; ++ } + + rx_ring->itr_setting = ITR_REG_ALIGN(ec->rx_coalesce_usecs); + tx_ring->itr_setting = ITR_REG_ALIGN(ec->tx_coalesce_usecs); +@@ -751,6 +770,7 @@ static void iavf_set_itr_per_queue(struct iavf_adapter *adapter, + * the Tx and Rx ITR values based on the values we have entered + * into the q_vector, no need to write the values now. + */ ++ return 0; + } + + /** +@@ -792,9 +812,11 @@ static int __iavf_set_coalesce(struct net_device *netdev, + */ + if (queue < 0) { + for (i = 0; i < adapter->num_active_queues; i++) +- iavf_set_itr_per_queue(adapter, ec, i); ++ if (iavf_set_itr_per_queue(adapter, ec, i)) ++ return -EINVAL; + } else if (queue < adapter->num_active_queues) { +- iavf_set_itr_per_queue(adapter, ec, queue); ++ if (iavf_set_itr_per_queue(adapter, ec, queue)) ++ return -EINVAL; + } else { + netif_info(adapter, drv, netdev, "Invalid queue value, queue range is 0 - %d\n", + adapter->num_active_queues - 1); +-- +2.33.0 + diff --git a/queue-5.15/ice-avoid-bpf_prog-refcount-underflow.patch b/queue-5.15/ice-avoid-bpf_prog-refcount-underflow.patch new file mode 100644 index 00000000000..53ba1893562 --- /dev/null +++ b/queue-5.15/ice-avoid-bpf_prog-refcount-underflow.patch @@ -0,0 +1,132 @@ +From 8989839c66844ac3a8527b425d990edbc7b95bf4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Oct 2021 18:47:19 +0200 +Subject: ice: avoid bpf_prog refcount underflow + +From: Marta Plantykow + +[ Upstream commit f65ee535df775a13a1046c0a0b2d72db342f8a5b ] + +Ice driver has the routines for managing XDP resources that are shared +between ndo_bpf op and VSI rebuild flow. The latter takes place for +example when user changes queue count on an interface via ethtool's +set_channels(). + +There is an issue around the bpf_prog refcounting when VSI is being +rebuilt - since ice_prepare_xdp_rings() is called with vsi->xdp_prog as +an argument that is used later on by ice_vsi_assign_bpf_prog(), same +bpf_prog pointers are swapped with each other. Then it is also +interpreted as an 'old_prog' which in turn causes us to call +bpf_prog_put on it that will decrement its refcount. + +Below splat can be interpreted in a way that due to zero refcount of a +bpf_prog it is wiped out from the system while kernel still tries to +refer to it: + +[ 481.069429] BUG: unable to handle page fault for address: ffffc9000640f038 +[ 481.077390] #PF: supervisor read access in kernel mode +[ 481.083335] #PF: error_code(0x0000) - not-present page +[ 481.089276] PGD 100000067 P4D 100000067 PUD 1001cb067 PMD 106d2b067 PTE 0 +[ 481.097141] Oops: 0000 [#1] PREEMPT SMP PTI +[ 481.101980] CPU: 12 PID: 3339 Comm: sudo Tainted: G OE 5.15.0-rc5+ #1 +[ 481.110840] Hardware name: Intel Corp. GRANTLEY/GRANTLEY, BIOS GRRFCRB1.86B.0276.D07.1605190235 05/19/2016 +[ 481.122021] RIP: 0010:dev_xdp_prog_id+0x25/0x40 +[ 481.127265] Code: 80 00 00 00 00 0f 1f 44 00 00 89 f6 48 c1 e6 04 48 01 fe 48 8b 86 98 08 00 00 48 85 c0 74 13 48 8b 50 18 31 c0 48 85 d2 74 07 <48> 8b 42 38 8b 40 20 c3 48 8b 96 90 08 00 00 eb e8 66 2e 0f 1f 84 +[ 481.148991] RSP: 0018:ffffc90007b63868 EFLAGS: 00010286 +[ 481.155034] RAX: 0000000000000000 RBX: ffff889080824000 RCX: 0000000000000000 +[ 481.163278] RDX: ffffc9000640f000 RSI: ffff889080824010 RDI: ffff889080824000 +[ 481.171527] RBP: ffff888107af7d00 R08: 0000000000000000 R09: ffff88810db5f6e0 +[ 481.179776] R10: 0000000000000000 R11: ffff8890885b9988 R12: ffff88810db5f4bc +[ 481.188026] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 +[ 481.196276] FS: 00007f5466d5bec0(0000) GS:ffff88903fb00000(0000) knlGS:0000000000000000 +[ 481.205633] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 481.212279] CR2: ffffc9000640f038 CR3: 000000014429c006 CR4: 00000000003706e0 +[ 481.220530] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 481.228771] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 481.237029] Call Trace: +[ 481.239856] rtnl_fill_ifinfo+0x768/0x12e0 +[ 481.244602] rtnl_dump_ifinfo+0x525/0x650 +[ 481.249246] ? __alloc_skb+0xa5/0x280 +[ 481.253484] netlink_dump+0x168/0x3c0 +[ 481.257725] netlink_recvmsg+0x21e/0x3e0 +[ 481.262263] ____sys_recvmsg+0x87/0x170 +[ 481.266707] ? __might_fault+0x20/0x30 +[ 481.271046] ? _copy_from_user+0x66/0xa0 +[ 481.275591] ? iovec_from_user+0xf6/0x1c0 +[ 481.280226] ___sys_recvmsg+0x82/0x100 +[ 481.284566] ? sock_sendmsg+0x5e/0x60 +[ 481.288791] ? __sys_sendto+0xee/0x150 +[ 481.293129] __sys_recvmsg+0x56/0xa0 +[ 481.297267] do_syscall_64+0x3b/0xc0 +[ 481.301395] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ 481.307238] RIP: 0033:0x7f5466f39617 +[ 481.311373] Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb bd 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2f 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 +[ 481.342944] RSP: 002b:00007ffedc7f4308 EFLAGS: 00000246 ORIG_RAX: 000000000000002f +[ 481.361783] RAX: ffffffffffffffda RBX: 00007ffedc7f5460 RCX: 00007f5466f39617 +[ 481.380278] RDX: 0000000000000000 RSI: 00007ffedc7f5360 RDI: 0000000000000003 +[ 481.398500] RBP: 00007ffedc7f53f0 R08: 0000000000000000 R09: 000055d556f04d50 +[ 481.416463] R10: 0000000000000077 R11: 0000000000000246 R12: 00007ffedc7f5360 +[ 481.434131] R13: 00007ffedc7f5350 R14: 00007ffedc7f5344 R15: 0000000000000e98 +[ 481.451520] Modules linked in: ice(OE) af_packet binfmt_misc nls_iso8859_1 ipmi_ssif intel_rapl_msr intel_rapl_common x86_pkg_temp_thermal intel_powerclamp mxm_wmi mei_me coretemp mei ipmi_si ipmi_msghandler wmi acpi_pad acpi_power_meter ip_tables x_tables autofs4 crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel ahci crypto_simd cryptd libahci lpc_ich [last unloaded: ice] +[ 481.528558] CR2: ffffc9000640f038 +[ 481.542041] ---[ end trace d1f24c9ecf5b61c1 ]--- + +Fix this by only calling ice_vsi_assign_bpf_prog() inside +ice_prepare_xdp_rings() when current vsi->xdp_prog pointer is NULL. +This way set_channels() flow will not attempt to swap the vsi->xdp_prog +pointers with itself. + +Also, sprinkle around some comments that provide a reasoning about +correlation between driver and kernel in terms of bpf_prog refcount. + +Fixes: efc2214b6047 ("ice: Add support for XDP") +Reviewed-by: Alexander Lobakin +Signed-off-by: Marta Plantykow +Co-developed-by: Maciej Fijalkowski +Signed-off-by: Maciej Fijalkowski +Tested-by: Kiran Bhandare +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_main.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index a39136b0bd16a..f622ee20ac40d 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -2497,7 +2497,18 @@ int ice_prepare_xdp_rings(struct ice_vsi *vsi, struct bpf_prog *prog) + ice_stat_str(status)); + goto clear_xdp_rings; + } +- ice_vsi_assign_bpf_prog(vsi, prog); ++ ++ /* assign the prog only when it's not already present on VSI; ++ * this flow is a subject of both ethtool -L and ndo_bpf flows; ++ * VSI rebuild that happens under ethtool -L can expose us to ++ * the bpf_prog refcount issues as we would be swapping same ++ * bpf_prog pointers from vsi->xdp_prog and calling bpf_prog_put ++ * on it as it would be treated as an 'old_prog'; for ndo_bpf ++ * this is not harmful as dev_xdp_install bumps the refcount ++ * before calling the op exposed by the driver; ++ */ ++ if (!ice_is_xdp_ena_vsi(vsi)) ++ ice_vsi_assign_bpf_prog(vsi, prog); + + return 0; + clear_xdp_rings: +@@ -2643,6 +2654,11 @@ ice_xdp_setup_prog(struct ice_vsi *vsi, struct bpf_prog *prog, + if (xdp_ring_err) + NL_SET_ERR_MSG_MOD(extack, "Freeing XDP Tx resources failed"); + } else { ++ /* safe to call even when prog == vsi->xdp_prog as ++ * dev_xdp_install in net/core/dev.c incremented prog's ++ * refcount so corresponding bpf_prog_put won't cause ++ * underflow ++ */ + ice_vsi_assign_bpf_prog(vsi, prog); + } + +-- +2.33.0 + diff --git a/queue-5.15/ice-fix-vsi-txq_map-sizing.patch b/queue-5.15/ice-fix-vsi-txq_map-sizing.patch new file mode 100644 index 00000000000..57e7e0a3393 --- /dev/null +++ b/queue-5.15/ice-fix-vsi-txq_map-sizing.patch @@ -0,0 +1,96 @@ +From 9e1f05cadc7bf1850aad3c4d1e96ec13edfb72dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Oct 2021 18:47:18 +0200 +Subject: ice: fix vsi->txq_map sizing + +From: Maciej Fijalkowski + +[ Upstream commit 792b2086584f25d84081a526beee80d103c2a913 ] + +The approach of having XDP queue per CPU regardless of user's setting +exposed a hidden bug that could occur in case when Rx queue count differ +from Tx queue count. Currently vsi->txq_map's size is equal to the +doubled vsi->alloc_txq, which is not correct due to the fact that XDP +rings were previously based on the Rx queue count. Below splat can be +seen when ethtool -L is used and XDP rings are configured: + +[ 682.875339] BUG: kernel NULL pointer dereference, address: 000000000000000f +[ 682.883403] #PF: supervisor read access in kernel mode +[ 682.889345] #PF: error_code(0x0000) - not-present page +[ 682.895289] PGD 0 P4D 0 +[ 682.898218] Oops: 0000 [#1] PREEMPT SMP PTI +[ 682.903055] CPU: 42 PID: 2878 Comm: ethtool Tainted: G OE 5.15.0-rc5+ #1 +[ 682.912214] Hardware name: Intel Corp. GRANTLEY/GRANTLEY, BIOS GRRFCRB1.86B.0276.D07.1605190235 05/19/2016 +[ 682.923380] RIP: 0010:devres_remove+0x44/0x130 +[ 682.928527] Code: 49 89 f4 55 48 89 fd 4c 89 ff 53 48 83 ec 10 e8 92 b9 49 00 48 8b 9d a8 02 00 00 48 8d 8d a0 02 00 00 49 89 c2 48 39 cb 74 0f <4c> 3b 63 10 74 25 48 8b 5b 08 48 39 cb 75 f1 4c 89 ff 4c 89 d6 e8 +[ 682.950237] RSP: 0018:ffffc90006a679f0 EFLAGS: 00010002 +[ 682.956285] RAX: 0000000000000286 RBX: ffffffffffffffff RCX: ffff88908343a370 +[ 682.964538] RDX: 0000000000000001 RSI: ffffffff81690d60 RDI: 0000000000000000 +[ 682.972789] RBP: ffff88908343a0d0 R08: 0000000000000000 R09: 0000000000000000 +[ 682.981040] R10: 0000000000000286 R11: 3fffffffffffffff R12: ffffffff81690d60 +[ 682.989282] R13: ffffffff81690a00 R14: ffff8890819807a8 R15: ffff88908343a36c +[ 682.997535] FS: 00007f08c7bfa740(0000) GS:ffff88a03fd00000(0000) knlGS:0000000000000000 +[ 683.006910] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 683.013557] CR2: 000000000000000f CR3: 0000001080a66003 CR4: 00000000003706e0 +[ 683.021819] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 683.030075] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 683.038336] Call Trace: +[ 683.041167] devm_kfree+0x33/0x50 +[ 683.045004] ice_vsi_free_arrays+0x5e/0xc0 [ice] +[ 683.050380] ice_vsi_rebuild+0x4c8/0x750 [ice] +[ 683.055543] ice_vsi_recfg_qs+0x9a/0x110 [ice] +[ 683.060697] ice_set_channels+0x14f/0x290 [ice] +[ 683.065962] ethnl_set_channels+0x333/0x3f0 +[ 683.070807] genl_family_rcv_msg_doit+0xea/0x150 +[ 683.076152] genl_rcv_msg+0xde/0x1d0 +[ 683.080289] ? channels_prepare_data+0x60/0x60 +[ 683.085432] ? genl_get_cmd+0xd0/0xd0 +[ 683.089667] netlink_rcv_skb+0x50/0xf0 +[ 683.094006] genl_rcv+0x24/0x40 +[ 683.097638] netlink_unicast+0x239/0x340 +[ 683.102177] netlink_sendmsg+0x22e/0x470 +[ 683.106717] sock_sendmsg+0x5e/0x60 +[ 683.110756] __sys_sendto+0xee/0x150 +[ 683.114894] ? handle_mm_fault+0xd0/0x2a0 +[ 683.119535] ? do_user_addr_fault+0x1f3/0x690 +[ 683.134173] __x64_sys_sendto+0x25/0x30 +[ 683.148231] do_syscall_64+0x3b/0xc0 +[ 683.161992] entry_SYSCALL_64_after_hwframe+0x44/0xae + +Fix this by taking into account the value that num_possible_cpus() +yields in addition to vsi->alloc_txq instead of doubling the latter. + +Fixes: efc2214b6047 ("ice: Add support for XDP") +Fixes: 22bf877e528f ("ice: introduce XDP_TX fallback path") +Reviewed-by: Alexander Lobakin +Signed-off-by: Maciej Fijalkowski +Tested-by: Kiran Bhandare +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_lib.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c +index e47920fe73b88..62bf879dc6232 100644 +--- a/drivers/net/ethernet/intel/ice/ice_lib.c ++++ b/drivers/net/ethernet/intel/ice/ice_lib.c +@@ -83,8 +83,13 @@ static int ice_vsi_alloc_arrays(struct ice_vsi *vsi) + if (!vsi->rx_rings) + goto err_rings; + +- /* XDP will have vsi->alloc_txq Tx queues as well, so double the size */ +- vsi->txq_map = devm_kcalloc(dev, (2 * vsi->alloc_txq), ++ /* txq_map needs to have enough space to track both Tx (stack) rings ++ * and XDP rings; at this point vsi->num_xdp_txq might not be set, ++ * so use num_possible_cpus() as we want to always provide XDP ring ++ * per CPU, regardless of queue count settings from user that might ++ * have come from ethtool's set_channels() callback; ++ */ ++ vsi->txq_map = devm_kcalloc(dev, (vsi->alloc_txq + num_possible_cpus()), + sizeof(*vsi->txq_map), GFP_KERNEL); + + if (!vsi->txq_map) +-- +2.33.0 + diff --git a/queue-5.15/igb-fix-netpoll-exit-with-traffic.patch b/queue-5.15/igb-fix-netpoll-exit-with-traffic.patch new file mode 100644 index 00000000000..b8e0a8e47ce --- /dev/null +++ b/queue-5.15/igb-fix-netpoll-exit-with-traffic.patch @@ -0,0 +1,56 @@ +From 02d99a25aadab1196892f887bf07c5784ba976e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Nov 2021 12:40:00 -0800 +Subject: igb: fix netpoll exit with traffic + +From: Jesse Brandeburg + +[ Upstream commit eaeace60778e524a2820d0c0ad60bf80289e292c ] + +Oleksandr brought a bug report where netpoll causes trace +messages in the log on igb. + +Danielle brought this back up as still occurring, so we'll try +again. + +[22038.710800] ------------[ cut here ]------------ +[22038.710801] igb_poll+0x0/0x1440 [igb] exceeded budget in poll +[22038.710802] WARNING: CPU: 12 PID: 40362 at net/core/netpoll.c:155 netpoll_poll_dev+0x18a/0x1a0 + +As Alex suggested, change the driver to return work_done at the +exit of napi_poll, which should be safe to do in this driver +because it is not polling multiple queues in this single napi +context (multiple queues attached to one MSI-X vector). Several +other drivers contain the same simple sequence, so I hope +this will not create new problems. + +Fixes: 16eb8815c235 ("igb: Refactor clean_rx_irq to reduce overhead and improve performance") +Reported-by: Oleksandr Natalenko +Reported-by: Danielle Ratson +Suggested-by: Alexander Duyck +Signed-off-by: Jesse Brandeburg +Tested-by: Oleksandr Natalenko +Tested-by: Danielle Ratson +Link: https://lore.kernel.org/r/20211123204000.1597971-1-jesse.brandeburg@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igb/igb_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index 751de06019a0e..8f30577386b6f 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -8019,7 +8019,7 @@ static int igb_poll(struct napi_struct *napi, int budget) + if (likely(napi_complete_done(napi, work_done))) + igb_ring_irq_enable(q_vector); + +- return min(work_done, budget - 1); ++ return work_done; + } + + /** +-- +2.33.0 + diff --git a/queue-5.15/ipv6-fix-typos-in-__ip6_finish_output.patch b/queue-5.15/ipv6-fix-typos-in-__ip6_finish_output.patch new file mode 100644 index 00000000000..5dc86bf204a --- /dev/null +++ b/queue-5.15/ipv6-fix-typos-in-__ip6_finish_output.patch @@ -0,0 +1,45 @@ +From c1b0076b9e4f87b02b08116221f00eda6014ee27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Nov 2021 17:37:58 -0800 +Subject: ipv6: fix typos in __ip6_finish_output() + +From: Eric Dumazet + +[ Upstream commit 19d36c5f294879949c9d6f57cb61d39cc4c48553 ] + +We deal with IPv6 packets, so we need to use IP6CB(skb)->flags and +IP6SKB_REROUTED, instead of IPCB(skb)->flags and IPSKB_REROUTED + +Found by code inspection, please double check that fixing this bug +does not surface other bugs. + +Fixes: 09ee9dba9611 ("ipv6: Reinject IPv6 packets if IPsec policy matches after SNAT") +Signed-off-by: Eric Dumazet +Cc: Tobias Brunner +Cc: Steffen Klassert +Cc: David Ahern +Reviewed-by: David Ahern +Tested-by: Tobias Brunner +Acked-by: Tobias Brunner +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/ip6_output.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 2f044a49afa8c..ff4e83e2a5068 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -174,7 +174,7 @@ static int __ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff + #if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM) + /* Policy lookup after SNAT yielded a new policy */ + if (skb_dst(skb)->xfrm) { +- IPCB(skb)->flags |= IPSKB_REROUTED; ++ IP6CB(skb)->flags |= IP6SKB_REROUTED; + return dst_output(net, sk, skb); + } + #endif +-- +2.33.0 + diff --git a/queue-5.15/lan743x-fix-deadlock-in-lan743x_phy_link_status_chan.patch b/queue-5.15/lan743x-fix-deadlock-in-lan743x_phy_link_status_chan.patch new file mode 100644 index 00000000000..ea6de6fa10c --- /dev/null +++ b/queue-5.15/lan743x-fix-deadlock-in-lan743x_phy_link_status_chan.patch @@ -0,0 +1,73 @@ +From ab6d62fddedb61f59fc30153473dc3eec29a9455 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Nov 2021 08:16:25 +0100 +Subject: lan743x: fix deadlock in lan743x_phy_link_status_change() + +From: Heiner Kallweit + +[ Upstream commit ddb826c2c92d461f290a7bab89e7c28696191875 ] + +Usage of phy_ethtool_get_link_ksettings() in the link status change +handler isn't needed, and in combination with the referenced change +it results in a deadlock. Simply remove the call and replace it with +direct access to phydev->speed. The duplex argument of +lan743x_phy_update_flowcontrol() isn't used and can be removed. + +Fixes: c10a485c3de5 ("phy: phy_ethtool_ksettings_get: Lock the phy for consistency") +Reported-by: Alessandro B Maurici +Tested-by: Alessandro B Maurici +Signed-off-by: Heiner Kallweit +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/40e27f76-0ba3-dcef-ee32-a78b9df38b0f@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/microchip/lan743x_main.c | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c +index 4d5a5d6595b3b..d64ce65a3c174 100644 +--- a/drivers/net/ethernet/microchip/lan743x_main.c ++++ b/drivers/net/ethernet/microchip/lan743x_main.c +@@ -914,8 +914,7 @@ static int lan743x_phy_reset(struct lan743x_adapter *adapter) + } + + static void lan743x_phy_update_flowcontrol(struct lan743x_adapter *adapter, +- u8 duplex, u16 local_adv, +- u16 remote_adv) ++ u16 local_adv, u16 remote_adv) + { + struct lan743x_phy *phy = &adapter->phy; + u8 cap; +@@ -943,7 +942,6 @@ static void lan743x_phy_link_status_change(struct net_device *netdev) + + phy_print_status(phydev); + if (phydev->state == PHY_RUNNING) { +- struct ethtool_link_ksettings ksettings; + int remote_advertisement = 0; + int local_advertisement = 0; + +@@ -980,18 +978,14 @@ static void lan743x_phy_link_status_change(struct net_device *netdev) + } + lan743x_csr_write(adapter, MAC_CR, data); + +- memset(&ksettings, 0, sizeof(ksettings)); +- phy_ethtool_get_link_ksettings(netdev, &ksettings); + local_advertisement = + linkmode_adv_to_mii_adv_t(phydev->advertising); + remote_advertisement = + linkmode_adv_to_mii_adv_t(phydev->lp_advertising); + +- lan743x_phy_update_flowcontrol(adapter, +- ksettings.base.duplex, +- local_advertisement, ++ lan743x_phy_update_flowcontrol(adapter, local_advertisement, + remote_advertisement); +- lan743x_ptp_update_latency(adapter, ksettings.base.speed); ++ lan743x_ptp_update_latency(adapter, phydev->speed); + } + } + +-- +2.33.0 + diff --git a/queue-5.15/media-v4l2-core-fix-vidioc_dqevent-handling-on-non-x.patch b/queue-5.15/media-v4l2-core-fix-vidioc_dqevent-handling-on-non-x.patch new file mode 100644 index 00000000000..9de918e7094 --- /dev/null +++ b/queue-5.15/media-v4l2-core-fix-vidioc_dqevent-handling-on-non-x.patch @@ -0,0 +1,140 @@ +From 0c52253f277d7f54399e920961aea4ffd628797b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Oct 2021 06:49:54 +0100 +Subject: media: v4l2-core: fix VIDIOC_DQEVENT handling on non-x86 + +From: Arnd Bergmann + +[ Upstream commit 678d92b6126b9f55419b6a51ef0a88bce2ef2f20 ] + +My previous bugfix addressed an API inconsistency found by syzbot, +and it correctly fixed the issue on x86-64 machines, which now behave +correctly for both native and compat tasks. + +Unfortunately, John found that the patch broke compat mode on all other +architectures, as they can no longer rely on the VIDIOC_DQEVENT_TIME32 +code from the native handler as a fallback in the compat code. + +The best way I can see for addressing this is to generalize the +VIDIOC_DQEVENT32_TIME32 code from x86 and use that for all architectures, +leaving only the VIDIOC_DQEVENT32 variant as x86 specific. The original +code was trying to be clever and use the same conversion helper for native +32-bit code and compat mode, but that turned out to be too obscure so +even I missed that bit I had introduced myself when I made the fix. + +Fixes: c344f07aa1b4 ("media: v4l2-core: ignore native time32 ioctls on 64-bit") +Reported-by: John Stultz +Signed-off-by: Arnd Bergmann +Tested-by: John Stultz +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 41 ++++++++----------- + 1 file changed, 17 insertions(+), 24 deletions(-) + +diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +index 47aff3b197426..80aaf07b16f28 100644 +--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c ++++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +@@ -744,10 +744,6 @@ static int put_v4l2_ext_controls32(struct v4l2_ext_controls *p64, + /* + * x86 is the only compat architecture with different struct alignment + * between 32-bit and 64-bit tasks. +- * +- * On all other architectures, v4l2_event32 and v4l2_event32_time32 are +- * the same as v4l2_event and v4l2_event_time32, so we can use the native +- * handlers, converting v4l2_event to v4l2_event_time32 if necessary. + */ + struct v4l2_event32 { + __u32 type; +@@ -765,21 +761,6 @@ struct v4l2_event32 { + __u32 reserved[8]; + }; + +-#ifdef CONFIG_COMPAT_32BIT_TIME +-struct v4l2_event32_time32 { +- __u32 type; +- union { +- compat_s64 value64; +- __u8 data[64]; +- } u; +- __u32 pending; +- __u32 sequence; +- struct old_timespec32 timestamp; +- __u32 id; +- __u32 reserved[8]; +-}; +-#endif +- + static int put_v4l2_event32(struct v4l2_event *p64, + struct v4l2_event32 __user *p32) + { +@@ -795,7 +776,22 @@ static int put_v4l2_event32(struct v4l2_event *p64, + return 0; + } + ++#endif ++ + #ifdef CONFIG_COMPAT_32BIT_TIME ++struct v4l2_event32_time32 { ++ __u32 type; ++ union { ++ compat_s64 value64; ++ __u8 data[64]; ++ } u; ++ __u32 pending; ++ __u32 sequence; ++ struct old_timespec32 timestamp; ++ __u32 id; ++ __u32 reserved[8]; ++}; ++ + static int put_v4l2_event32_time32(struct v4l2_event *p64, + struct v4l2_event32_time32 __user *p32) + { +@@ -811,7 +807,6 @@ static int put_v4l2_event32_time32(struct v4l2_event *p64, + return 0; + } + #endif +-#endif + + struct v4l2_edid32 { + __u32 pad; +@@ -873,9 +868,7 @@ static int put_v4l2_edid32(struct v4l2_edid *p64, + #define VIDIOC_QUERYBUF32_TIME32 _IOWR('V', 9, struct v4l2_buffer32_time32) + #define VIDIOC_QBUF32_TIME32 _IOWR('V', 15, struct v4l2_buffer32_time32) + #define VIDIOC_DQBUF32_TIME32 _IOWR('V', 17, struct v4l2_buffer32_time32) +-#ifdef CONFIG_X86_64 + #define VIDIOC_DQEVENT32_TIME32 _IOR ('V', 89, struct v4l2_event32_time32) +-#endif + #define VIDIOC_PREPARE_BUF32_TIME32 _IOWR('V', 93, struct v4l2_buffer32_time32) + #endif + +@@ -929,10 +922,10 @@ unsigned int v4l2_compat_translate_cmd(unsigned int cmd) + #ifdef CONFIG_X86_64 + case VIDIOC_DQEVENT32: + return VIDIOC_DQEVENT; ++#endif + #ifdef CONFIG_COMPAT_32BIT_TIME + case VIDIOC_DQEVENT32_TIME32: + return VIDIOC_DQEVENT; +-#endif + #endif + } + return cmd; +@@ -1025,10 +1018,10 @@ int v4l2_compat_put_user(void __user *arg, void *parg, unsigned int cmd) + #ifdef CONFIG_X86_64 + case VIDIOC_DQEVENT32: + return put_v4l2_event32(parg, arg); ++#endif + #ifdef CONFIG_COMPAT_32BIT_TIME + case VIDIOC_DQEVENT32_TIME32: + return put_v4l2_event32_time32(parg, arg); +-#endif + #endif + } + return 0; +-- +2.33.0 + diff --git a/queue-5.15/mips-loongson64-fix-ftlb-configuration.patch b/queue-5.15/mips-loongson64-fix-ftlb-configuration.patch new file mode 100644 index 00000000000..c4f8d18753f --- /dev/null +++ b/queue-5.15/mips-loongson64-fix-ftlb-configuration.patch @@ -0,0 +1,47 @@ +From a0d11561f7f5e9c9e475ab13d74cdf758d528d73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Nov 2021 18:59:49 +0800 +Subject: MIPS: loongson64: fix FTLB configuration + +From: Huang Pei + +[ Upstream commit 7db5e9e9e5e6c10d7d26f8df7f8fd8841cb15ee7 ] + +It turns out that 'decode_configs' -> 'set_ftlb_enable' is called under +c->cputype unset, which leaves FTLB disabled on BOTH 3A2000 and 3A3000 + +Fix it by calling "decode_configs" after c->cputype is initialized + +Fixes: da1bd29742b1 ("MIPS: Loongson64: Probe CPU features via CPUCFG") +Signed-off-by: Huang Pei +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/cpu-probe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c +index 630fcb4cb30e7..7c861e6a89529 100644 +--- a/arch/mips/kernel/cpu-probe.c ++++ b/arch/mips/kernel/cpu-probe.c +@@ -1734,8 +1734,6 @@ static inline void decode_cpucfg(struct cpuinfo_mips *c) + + static inline void cpu_probe_loongson(struct cpuinfo_mips *c, unsigned int cpu) + { +- decode_configs(c); +- + /* All Loongson processors covered here define ExcCode 16 as GSExc. */ + c->options |= MIPS_CPU_GSEXCEX; + +@@ -1796,6 +1794,8 @@ static inline void cpu_probe_loongson(struct cpuinfo_mips *c, unsigned int cpu) + panic("Unknown Loongson Processor ID!"); + break; + } ++ ++ decode_configs(c); + } + #else + static inline void cpu_probe_loongson(struct cpuinfo_mips *c, unsigned int cpu) { } +-- +2.33.0 + diff --git a/queue-5.15/mips-use-3-level-pgtable-for-64kb-page-size-on-mips_.patch b/queue-5.15/mips-use-3-level-pgtable-for-64kb-page-size-on-mips_.patch new file mode 100644 index 00000000000..68ac48d18b2 --- /dev/null +++ b/queue-5.15/mips-use-3-level-pgtable-for-64kb-page-size-on-mips_.patch @@ -0,0 +1,39 @@ +From a597c4890f17db6ca040d4bb11feda57d23bfa65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Nov 2021 18:59:48 +0800 +Subject: MIPS: use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48 + +From: Huang Pei + +[ Upstream commit 41ce097f714401e6ad8f3f5eb30d7f91b0b5e495 ] + +It hangup when booting Loongson 3A1000 with BOTH +CONFIG_PAGE_SIZE_64KB and CONFIG_MIPS_VA_BITS_48, that it turn +out to use 2-level pgtable instead of 3-level. 64KB page size +with 2-level pgtable only cover 42 bits VA, use 3-level pgtable +to cover all 48 bits VA(55 bits) + +Fixes: 1e321fa917fb ("MIPS64: Support of at least 48 bits of SEGBITS) +Signed-off-by: Huang Pei +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig +index a917d408d27d8..23654ccdbfb12 100644 +--- a/arch/mips/Kconfig ++++ b/arch/mips/Kconfig +@@ -3189,7 +3189,7 @@ config STACKTRACE_SUPPORT + config PGTABLE_LEVELS + int + default 4 if PAGE_SIZE_4KB && MIPS_VA_BITS_48 +- default 3 if 64BIT && !PAGE_SIZE_64KB ++ default 3 if 64BIT && (!PAGE_SIZE_64KB || MIPS_VA_BITS_48) + default 2 + + config MIPS_AUTO_PFN_OFFSET +-- +2.33.0 + diff --git a/queue-5.15/mlxsw-spectrum-protect-driver-from-buggy-firmware.patch b/queue-5.15/mlxsw-spectrum-protect-driver-from-buggy-firmware.patch new file mode 100644 index 00000000000..714b1ca6468 --- /dev/null +++ b/queue-5.15/mlxsw-spectrum-protect-driver-from-buggy-firmware.patch @@ -0,0 +1,45 @@ +From 7ae3d99e6a47970eba67266aa354f2d920a45ba8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Nov 2021 09:52:56 +0200 +Subject: mlxsw: spectrum: Protect driver from buggy firmware + +From: Amit Cohen + +[ Upstream commit 63b08b1f6834bbb0b4f7783bf63b80c8c8e9a047 ] + +When processing port up/down events generated by the device's firmware, +the driver protects itself from events reported for non-existent local +ports, but not the CPU port (local port 0), which exists, but lacks a +netdev. + +This can result in a NULL pointer dereference when calling +netif_carrier_{on,off}(). + +Fix this by bailing early when processing an event reported for the CPU +port. Problem was only observed when running on top of a buggy emulator. + +Fixes: 28b1987ef506 ("mlxsw: spectrum: Register CPU port with devlink") +Signed-off-by: Amit Cohen +Signed-off-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +index 250c5a24264dc..edfdd44de579c 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +@@ -2131,7 +2131,7 @@ static void mlxsw_sp_pude_event_func(const struct mlxsw_reg_info *reg, + max_ports = mlxsw_core_max_ports(mlxsw_sp->core); + local_port = mlxsw_reg_pude_local_port_get(pude_pl); + +- if (WARN_ON_ONCE(local_port >= max_ports)) ++ if (WARN_ON_ONCE(!local_port || local_port >= max_ports)) + return; + mlxsw_sp_port = mlxsw_sp->ports[local_port]; + if (!mlxsw_sp_port) +-- +2.33.0 + diff --git a/queue-5.15/mptcp-fix-delack-timer.patch b/queue-5.15/mptcp-fix-delack-timer.patch new file mode 100644 index 00000000000..7cecdcdc3f0 --- /dev/null +++ b/queue-5.15/mptcp-fix-delack-timer.patch @@ -0,0 +1,42 @@ +From b5c31d7043e4ae6054fcab2e7c66a2c9d3822477 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Nov 2021 15:27:54 +0100 +Subject: mptcp: fix delack timer + +From: Eric Dumazet + +[ Upstream commit ee50e67ba0e17b1a1a8d76691d02eadf9e0f392c ] + +To compute the rtx timeout schedule_3rdack_retransmission() does multiple +things in the wrong way: srtt_us is measured in usec/8 and the timeout +itself is an absolute value. + +Fixes: ec3edaa7ca6ce02f ("mptcp: Add handling of outgoing MP_JOIN requests") +Acked-by: Paolo Abeni +Reviewed-by: Mat Martineau @linux.intel.com> +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/mptcp/options.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/mptcp/options.c b/net/mptcp/options.c +index 350348f070700..3fcc2e0c8a5df 100644 +--- a/net/mptcp/options.c ++++ b/net/mptcp/options.c +@@ -434,9 +434,10 @@ static void schedule_3rdack_retransmission(struct sock *sk) + + /* reschedule with a timeout above RTT, as we must look only for drop */ + if (tp->srtt_us) +- timeout = tp->srtt_us << 1; ++ timeout = usecs_to_jiffies(tp->srtt_us >> (3 - 1)); + else + timeout = TCP_TIMEOUT_INIT; ++ timeout += jiffies; + + WARN_ON_ONCE(icsk->icsk_ack.pending & ICSK_ACK_TIMER); + icsk->icsk_ack.pending |= ICSK_ACK_SCHED | ICSK_ACK_TIMER; +-- +2.33.0 + diff --git a/queue-5.15/mptcp-use-delegate-action-to-schedule-3rd-ack-retran.patch b/queue-5.15/mptcp-use-delegate-action-to-schedule-3rd-ack-retran.patch new file mode 100644 index 00000000000..bb16c8e51aa --- /dev/null +++ b/queue-5.15/mptcp-use-delegate-action-to-schedule-3rd-ack-retran.patch @@ -0,0 +1,228 @@ +From d8811d0946b5addfd879981a2641005b72ec3f36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Nov 2021 15:27:55 +0100 +Subject: mptcp: use delegate action to schedule 3rd ack retrans + +From: Paolo Abeni + +[ Upstream commit bcd97734318d1d87bb237dbc0a60c81237b0ac50 ] + +Scheduling a delack in mptcp_established_options_mp() is +not a good idea: such function is called by tcp_send_ack() and +the pending delayed ack will be cleared shortly after by the +tcp_event_ack_sent() call in __tcp_transmit_skb(). + +Instead use the mptcp delegated action infrastructure to +schedule the delayed ack after the current bh processing completes. + +Additionally moves the schedule_3rdack_retransmission() helper +into protocol.c to avoid making it visible in a different compilation +unit. + +Fixes: ec3edaa7ca6ce02f ("mptcp: Add handling of outgoing MP_JOIN requests") +Reviewed-by: Mat Martineau @linux.intel.com> +Signed-off-by: Paolo Abeni +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/mptcp/options.c | 33 ++++++++-------------------- + net/mptcp/protocol.c | 51 ++++++++++++++++++++++++++++++++++++-------- + net/mptcp/protocol.h | 17 ++++++++------- + 3 files changed, 60 insertions(+), 41 deletions(-) + +diff --git a/net/mptcp/options.c b/net/mptcp/options.c +index 3fcc2e0c8a5df..0966855a7c251 100644 +--- a/net/mptcp/options.c ++++ b/net/mptcp/options.c +@@ -422,29 +422,6 @@ bool mptcp_syn_options(struct sock *sk, const struct sk_buff *skb, + return false; + } + +-/* MP_JOIN client subflow must wait for 4th ack before sending any data: +- * TCP can't schedule delack timer before the subflow is fully established. +- * MPTCP uses the delack timer to do 3rd ack retransmissions +- */ +-static void schedule_3rdack_retransmission(struct sock *sk) +-{ +- struct inet_connection_sock *icsk = inet_csk(sk); +- struct tcp_sock *tp = tcp_sk(sk); +- unsigned long timeout; +- +- /* reschedule with a timeout above RTT, as we must look only for drop */ +- if (tp->srtt_us) +- timeout = usecs_to_jiffies(tp->srtt_us >> (3 - 1)); +- else +- timeout = TCP_TIMEOUT_INIT; +- timeout += jiffies; +- +- WARN_ON_ONCE(icsk->icsk_ack.pending & ICSK_ACK_TIMER); +- icsk->icsk_ack.pending |= ICSK_ACK_SCHED | ICSK_ACK_TIMER; +- icsk->icsk_ack.timeout = timeout; +- sk_reset_timer(sk, &icsk->icsk_delack_timer, timeout); +-} +- + static void clear_3rdack_retransmission(struct sock *sk) + { + struct inet_connection_sock *icsk = inet_csk(sk); +@@ -527,7 +504,15 @@ static bool mptcp_established_options_mp(struct sock *sk, struct sk_buff *skb, + *size = TCPOLEN_MPTCP_MPJ_ACK; + pr_debug("subflow=%p", subflow); + +- schedule_3rdack_retransmission(sk); ++ /* we can use the full delegate action helper only from BH context ++ * If we are in process context - sk is flushing the backlog at ++ * socket lock release time - just set the appropriate flag, will ++ * be handled by the release callback ++ */ ++ if (sock_owned_by_user(sk)) ++ set_bit(MPTCP_DELEGATE_ACK, &subflow->delegated_status); ++ else ++ mptcp_subflow_delegate(subflow, MPTCP_DELEGATE_ACK); + return true; + } + return false; +diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c +index 4379d69aead7e..421fa62ce5cdf 100644 +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -1621,7 +1621,8 @@ static void __mptcp_subflow_push_pending(struct sock *sk, struct sock *ssk) + if (!xmit_ssk) + goto out; + if (xmit_ssk != ssk) { +- mptcp_subflow_delegate(mptcp_subflow_ctx(xmit_ssk)); ++ mptcp_subflow_delegate(mptcp_subflow_ctx(xmit_ssk), ++ MPTCP_DELEGATE_SEND); + goto out; + } + +@@ -2959,7 +2960,7 @@ void __mptcp_check_push(struct sock *sk, struct sock *ssk) + if (xmit_ssk == ssk) + __mptcp_subflow_push_pending(sk, ssk); + else if (xmit_ssk) +- mptcp_subflow_delegate(mptcp_subflow_ctx(xmit_ssk)); ++ mptcp_subflow_delegate(mptcp_subflow_ctx(xmit_ssk), MPTCP_DELEGATE_SEND); + } else { + set_bit(MPTCP_PUSH_PENDING, &mptcp_sk(sk)->flags); + } +@@ -3013,18 +3014,50 @@ static void mptcp_release_cb(struct sock *sk) + __mptcp_update_rmem(sk); + } + ++/* MP_JOIN client subflow must wait for 4th ack before sending any data: ++ * TCP can't schedule delack timer before the subflow is fully established. ++ * MPTCP uses the delack timer to do 3rd ack retransmissions ++ */ ++static void schedule_3rdack_retransmission(struct sock *ssk) ++{ ++ struct inet_connection_sock *icsk = inet_csk(ssk); ++ struct tcp_sock *tp = tcp_sk(ssk); ++ unsigned long timeout; ++ ++ if (mptcp_subflow_ctx(ssk)->fully_established) ++ return; ++ ++ /* reschedule with a timeout above RTT, as we must look only for drop */ ++ if (tp->srtt_us) ++ timeout = usecs_to_jiffies(tp->srtt_us >> (3 - 1)); ++ else ++ timeout = TCP_TIMEOUT_INIT; ++ timeout += jiffies; ++ ++ WARN_ON_ONCE(icsk->icsk_ack.pending & ICSK_ACK_TIMER); ++ icsk->icsk_ack.pending |= ICSK_ACK_SCHED | ICSK_ACK_TIMER; ++ icsk->icsk_ack.timeout = timeout; ++ sk_reset_timer(ssk, &icsk->icsk_delack_timer, timeout); ++} ++ + void mptcp_subflow_process_delegated(struct sock *ssk) + { + struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk); + struct sock *sk = subflow->conn; + +- mptcp_data_lock(sk); +- if (!sock_owned_by_user(sk)) +- __mptcp_subflow_push_pending(sk, ssk); +- else +- set_bit(MPTCP_PUSH_PENDING, &mptcp_sk(sk)->flags); +- mptcp_data_unlock(sk); +- mptcp_subflow_delegated_done(subflow); ++ if (test_bit(MPTCP_DELEGATE_SEND, &subflow->delegated_status)) { ++ mptcp_data_lock(sk); ++ if (!sock_owned_by_user(sk)) ++ __mptcp_subflow_push_pending(sk, ssk); ++ else ++ set_bit(MPTCP_PUSH_PENDING, &mptcp_sk(sk)->flags); ++ mptcp_data_unlock(sk); ++ mptcp_subflow_delegated_done(subflow, MPTCP_DELEGATE_SEND); ++ } ++ if (test_bit(MPTCP_DELEGATE_ACK, &subflow->delegated_status)) { ++ schedule_3rdack_retransmission(ssk); ++ mptcp_subflow_delegated_done(subflow, MPTCP_DELEGATE_ACK); ++ } + } + + static int mptcp_hash(struct sock *sk) +diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h +index dc984676c5eb1..82c5dc4d6b49d 100644 +--- a/net/mptcp/protocol.h ++++ b/net/mptcp/protocol.h +@@ -401,6 +401,7 @@ struct mptcp_delegated_action { + DECLARE_PER_CPU(struct mptcp_delegated_action, mptcp_delegated_actions); + + #define MPTCP_DELEGATE_SEND 0 ++#define MPTCP_DELEGATE_ACK 1 + + /* MPTCP subflow context */ + struct mptcp_subflow_context { +@@ -506,23 +507,23 @@ static inline void mptcp_add_pending_subflow(struct mptcp_sock *msk, + + void mptcp_subflow_process_delegated(struct sock *ssk); + +-static inline void mptcp_subflow_delegate(struct mptcp_subflow_context *subflow) ++static inline void mptcp_subflow_delegate(struct mptcp_subflow_context *subflow, int action) + { + struct mptcp_delegated_action *delegated; + bool schedule; + ++ /* the caller held the subflow bh socket lock */ ++ lockdep_assert_in_softirq(); ++ + /* The implied barrier pairs with mptcp_subflow_delegated_done(), and + * ensures the below list check sees list updates done prior to status + * bit changes + */ +- if (!test_and_set_bit(MPTCP_DELEGATE_SEND, &subflow->delegated_status)) { ++ if (!test_and_set_bit(action, &subflow->delegated_status)) { + /* still on delegated list from previous scheduling */ + if (!list_empty(&subflow->delegated_node)) + return; + +- /* the caller held the subflow bh socket lock */ +- lockdep_assert_in_softirq(); +- + delegated = this_cpu_ptr(&mptcp_delegated_actions); + schedule = list_empty(&delegated->head); + list_add_tail(&subflow->delegated_node, &delegated->head); +@@ -547,16 +548,16 @@ mptcp_subflow_delegated_next(struct mptcp_delegated_action *delegated) + + static inline bool mptcp_subflow_has_delegated_action(const struct mptcp_subflow_context *subflow) + { +- return test_bit(MPTCP_DELEGATE_SEND, &subflow->delegated_status); ++ return !!READ_ONCE(subflow->delegated_status); + } + +-static inline void mptcp_subflow_delegated_done(struct mptcp_subflow_context *subflow) ++static inline void mptcp_subflow_delegated_done(struct mptcp_subflow_context *subflow, int action) + { + /* pairs with mptcp_subflow_delegate, ensures delegate_node is updated before + * touching the status bit + */ + smp_wmb(); +- clear_bit(MPTCP_DELEGATE_SEND, &subflow->delegated_status); ++ clear_bit(action, &subflow->delegated_status); + } + + int mptcp_is_enabled(const struct net *net); +-- +2.33.0 + diff --git a/queue-5.15/net-hns3-fix-incorrect-components-info-of-ethtool-re.patch b/queue-5.15/net-hns3-fix-incorrect-components-info-of-ethtool-re.patch new file mode 100644 index 00000000000..4fba27c3984 --- /dev/null +++ b/queue-5.15/net-hns3-fix-incorrect-components-info-of-ethtool-re.patch @@ -0,0 +1,56 @@ +From 5fac4459e1030de302b44163702d043c7df407dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Nov 2021 20:03:18 +0800 +Subject: net: hns3: fix incorrect components info of ethtool --reset command + +From: Jie Wang + +[ Upstream commit 82229c4dbb8a2780f05fa1bab29c97ef7bcd21bb ] + +Currently, HNS3 driver doesn't clear the reset flags of components after +successfully executing reset, it causes userspace info of +"Components reset" and "Components not reset" is incorrect. + +So fix this problem by clear corresponding reset flag after reset process. + +Fixes: ddccc5e368a3 ("net: hns3: add support for triggering reset by ethtool") +Signed-off-by: Jie Wang +Signed-off-by: Guangbin Huang +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c +index 5ebd96f6833d6..526fb56c84f24 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c +@@ -985,6 +985,7 @@ static int hns3_set_reset(struct net_device *netdev, u32 *flags) + struct hnae3_ae_dev *ae_dev = pci_get_drvdata(h->pdev); + const struct hnae3_ae_ops *ops = h->ae_algo->ops; + const struct hns3_reset_type_map *rst_type_map; ++ enum ethtool_reset_flags rst_flags; + u32 i, size; + + if (ops->ae_dev_resetting && ops->ae_dev_resetting(h)) +@@ -1004,6 +1005,7 @@ static int hns3_set_reset(struct net_device *netdev, u32 *flags) + for (i = 0; i < size; i++) { + if (rst_type_map[i].rst_flags == *flags) { + rst_type = rst_type_map[i].rst_type; ++ rst_flags = rst_type_map[i].rst_flags; + break; + } + } +@@ -1019,6 +1021,8 @@ static int hns3_set_reset(struct net_device *netdev, u32 *flags) + + ops->reset_event(h->pdev, h); + ++ *flags &= ~rst_flags; ++ + return 0; + } + +-- +2.33.0 + diff --git a/queue-5.15/net-hns3-fix-vf-rss-failed-problem-after-pf-enable-m.patch b/queue-5.15/net-hns3-fix-vf-rss-failed-problem-after-pf-enable-m.patch new file mode 100644 index 00000000000..949b29d2cbc --- /dev/null +++ b/queue-5.15/net-hns3-fix-vf-rss-failed-problem-after-pf-enable-m.patch @@ -0,0 +1,49 @@ +From 2604442f41789795cc712623189f433e66e4b425 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Nov 2021 20:03:15 +0800 +Subject: net: hns3: fix VF RSS failed problem after PF enable multi-TCs + +From: Guangbin Huang + +[ Upstream commit 8d2ad993aa05c0768f00c886c9d369cd97a337ac ] + +When PF is set to multi-TCs and configured mapping relationship between +priorities and TCs, the hardware will active these settings for this PF +and its VFs. + +In this case when VF just uses one TC and its rx packets contain priority, +and if the priority is not mapped to TC0, as other TCs of VF is not valid, +hardware always put this kind of packets to the queue 0. It cause this kind +of packets of VF can not be used RSS function. + +To fix this problem, set tc mode of all unused TCs of VF to the setting of +TC0, then rx packet with priority which map to unused TC will be direct to +TC0. + +Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support") +Signed-off-by: Guangbin Huang +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +index 3b8bde58613a8..fee7d9e79f8c3 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -703,9 +703,9 @@ static int hclgevf_set_rss_tc_mode(struct hclgevf_dev *hdev, u16 rss_size) + roundup_size = ilog2(roundup_size); + + for (i = 0; i < HCLGEVF_MAX_TC_NUM; i++) { +- tc_valid[i] = !!(hdev->hw_tc_map & BIT(i)); ++ tc_valid[i] = 1; + tc_size[i] = roundup_size; +- tc_offset[i] = rss_size * i; ++ tc_offset[i] = (hdev->hw_tc_map & BIT(i)) ? rss_size * i : 0; + } + + hclgevf_cmd_setup_basic_desc(&desc, HCLGEVF_OPC_RSS_TC_MODE, false); +-- +2.33.0 + diff --git a/queue-5.15/net-ieee802154-handle-iftypes-as-u32.patch b/queue-5.15/net-ieee802154-handle-iftypes-as-u32.patch new file mode 100644 index 00000000000..d0f34c126c8 --- /dev/null +++ b/queue-5.15/net-ieee802154-handle-iftypes-as-u32.patch @@ -0,0 +1,56 @@ +From 921a21c979fd53c0980e7c05bf95683cf21f3e0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Nov 2021 22:09:16 -0500 +Subject: net: ieee802154: handle iftypes as u32 + +From: Alexander Aring + +[ Upstream commit 451dc48c806a7ce9fbec5e7a24ccf4b2c936e834 ] + +This patch fixes an issue that an u32 netlink value is handled as a +signed enum value which doesn't fit into the range of u32 netlink type. +If it's handled as -1 value some BIT() evaluation ends in a +shift-out-of-bounds issue. To solve the issue we set the to u32 max which +is s32 "-1" value to keep backwards compatibility and let the followed enum +values start counting at 0. This brings the compiler to never handle the +enum as signed and a check if the value is above NL802154_IFTYPE_MAX should +filter -1 out. + +Fixes: f3ea5e44231a ("ieee802154: add new interface command") +Signed-off-by: Alexander Aring +Link: https://lore.kernel.org/r/20211112030916.685793-1-aahringo@redhat.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +--- + include/net/nl802154.h | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/include/net/nl802154.h b/include/net/nl802154.h +index ddcee128f5d9a..145acb8f25095 100644 +--- a/include/net/nl802154.h ++++ b/include/net/nl802154.h +@@ -19,6 +19,8 @@ + * + */ + ++#include ++ + #define NL802154_GENL_NAME "nl802154" + + enum nl802154_commands { +@@ -150,10 +152,9 @@ enum nl802154_attrs { + }; + + enum nl802154_iftype { +- /* for backwards compatibility TODO */ +- NL802154_IFTYPE_UNSPEC = -1, ++ NL802154_IFTYPE_UNSPEC = (~(__u32)0), + +- NL802154_IFTYPE_NODE, ++ NL802154_IFTYPE_NODE = 0, + NL802154_IFTYPE_MONITOR, + NL802154_IFTYPE_COORD, + +-- +2.33.0 + diff --git a/queue-5.15/net-ipa-directly-disable-ipa-setup-ready-interrupt.patch b/queue-5.15/net-ipa-directly-disable-ipa-setup-ready-interrupt.patch new file mode 100644 index 00000000000..227d0a78bcb --- /dev/null +++ b/queue-5.15/net-ipa-directly-disable-ipa-setup-ready-interrupt.patch @@ -0,0 +1,94 @@ +From 3e1789b99a2df9697ab5ccd2130388bbed5bbabc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Nov 2021 18:15:54 -0600 +Subject: net: ipa: directly disable ipa-setup-ready interrupt + +From: Alex Elder + +[ Upstream commit 33a153100bb3459479bd95d3259c2915b53fefa8 ] + +We currently maintain a "disabled" Boolean flag to determine whether +the "ipa-setup-ready" SMP2P IRQ handler does anything. That flag +must be accessed under protection of a mutex. + +Instead, disable the SMP2P interrupt when requested, which prevents +the interrupt handler from ever being called. More importantly, it +synchronizes a thread disabling the interrupt with the completion of +the interrupt handler in case they run concurrently. + +Use the IPA setup_complete flag rather than the disabled flag in the +handler to determine whether to ignore any interrupts arriving after +the first. + +Rename the "disabled" flag to be "setup_disabled", to be specific +about its purpose. + +Fixes: 530f9216a953 ("soc: qcom: ipa: AP/modem communications") +Signed-off-by: Alex Elder +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ipa/ipa_smp2p.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ipa/ipa_smp2p.c b/drivers/net/ipa/ipa_smp2p.c +index df7639c39d716..24bc112a072c6 100644 +--- a/drivers/net/ipa/ipa_smp2p.c ++++ b/drivers/net/ipa/ipa_smp2p.c +@@ -53,7 +53,7 @@ + * @setup_ready_irq: IPA interrupt triggered by modem to signal GSI ready + * @power_on: Whether IPA power is on + * @notified: Whether modem has been notified of power state +- * @disabled: Whether setup ready interrupt handling is disabled ++ * @setup_disabled: Whether setup ready interrupt handler is disabled + * @mutex: Mutex protecting ready-interrupt/shutdown interlock + * @panic_notifier: Panic notifier structure + */ +@@ -67,7 +67,7 @@ struct ipa_smp2p { + u32 setup_ready_irq; + bool power_on; + bool notified; +- bool disabled; ++ bool setup_disabled; + struct mutex mutex; + struct notifier_block panic_notifier; + }; +@@ -155,11 +155,9 @@ static irqreturn_t ipa_smp2p_modem_setup_ready_isr(int irq, void *dev_id) + struct device *dev; + int ret; + +- mutex_lock(&smp2p->mutex); +- +- if (smp2p->disabled) +- goto out_mutex_unlock; +- smp2p->disabled = true; /* If any others arrive, ignore them */ ++ /* Ignore any (spurious) interrupts received after the first */ ++ if (smp2p->ipa->setup_complete) ++ return IRQ_HANDLED; + + /* Power needs to be active for setup */ + dev = &smp2p->ipa->pdev->dev; +@@ -176,8 +174,6 @@ static irqreturn_t ipa_smp2p_modem_setup_ready_isr(int irq, void *dev_id) + out_power_put: + pm_runtime_mark_last_busy(dev); + (void)pm_runtime_put_autosuspend(dev); +-out_mutex_unlock: +- mutex_unlock(&smp2p->mutex); + + return IRQ_HANDLED; + } +@@ -322,7 +318,10 @@ void ipa_smp2p_disable(struct ipa *ipa) + + mutex_lock(&smp2p->mutex); + +- smp2p->disabled = true; ++ if (!smp2p->setup_disabled) { ++ disable_irq(smp2p->setup_ready_irq); ++ smp2p->setup_disabled = true; ++ } + + mutex_unlock(&smp2p->mutex); + } +-- +2.33.0 + diff --git a/queue-5.15/net-ipa-kill-ipa_cmd_pipeline_clear.patch b/queue-5.15/net-ipa-kill-ipa_cmd_pipeline_clear.patch new file mode 100644 index 00000000000..eed2d67fde2 --- /dev/null +++ b/queue-5.15/net-ipa-kill-ipa_cmd_pipeline_clear.patch @@ -0,0 +1,110 @@ +From 8d1837af0e25540878d99016b5200111f307e7ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Nov 2021 19:16:40 -0600 +Subject: net: ipa: kill ipa_cmd_pipeline_clear() + +From: Alex Elder + +[ Upstream commit e4e9bfb7c93d7e78aa4ad7e1c411a8df15386062 ] + +Calling ipa_cmd_pipeline_clear() after stopping the channel +underlying the AP<-modem RX endpoint can lead to a deadlock. + +This occurs in the ->runtime_suspend device power operation for the +IPA driver. While this callback is in progress, any other requests +for power will block until the callback returns. + +Stopping the AP<-modem RX channel does not prevent the modem from +sending another packet to this endpoint. If a packet arrives for an +RX channel when the channel is stopped, an SUSPEND IPA interrupt +condition will be pending. Handling an IPA interrupt requires +power, so ipa_isr_thread() calls pm_runtime_get_sync() first thing. + +The problem occurs because a "pipeline clear" command will not +complete while such a SUSPEND interrupt condition exists. So the +SUSPEND IPA interrupt handler won't proceed until it gets power; +that won't happen until the ->runtime_suspend callback (and its +"pipeline clear" command) completes; and that can't happen while +the SUSPEND interrupt condition exists. + +It turns out that in this case there is no need to use the "pipeline +clear" command. There are scenarios in which clearing the pipeline +is required while suspending, but those are not (yet) supported +upstream. So a simple fix, avoiding the potential deadlock, is to +stop calling ipa_cmd_pipeline_clear() in ipa_endpoint_suspend(). +This removes the only user of ipa_cmd_pipeline_clear(), so get rid +of that function. It can be restored again whenever it's needed. + +This is basically a manual revert along with an explanation for +commit 6cb63ea6a39ea ("net: ipa: introduce ipa_cmd_tag_process()"). + +Fixes: 6cb63ea6a39ea ("net: ipa: introduce ipa_cmd_tag_process()") +Signed-off-by: Alex Elder +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ipa/ipa_cmd.c | 16 ---------------- + drivers/net/ipa/ipa_cmd.h | 6 ------ + drivers/net/ipa/ipa_endpoint.c | 2 -- + 3 files changed, 24 deletions(-) + +diff --git a/drivers/net/ipa/ipa_cmd.c b/drivers/net/ipa/ipa_cmd.c +index cff51731195aa..d57472ea077f2 100644 +--- a/drivers/net/ipa/ipa_cmd.c ++++ b/drivers/net/ipa/ipa_cmd.c +@@ -661,22 +661,6 @@ void ipa_cmd_pipeline_clear_wait(struct ipa *ipa) + wait_for_completion(&ipa->completion); + } + +-void ipa_cmd_pipeline_clear(struct ipa *ipa) +-{ +- u32 count = ipa_cmd_pipeline_clear_count(); +- struct gsi_trans *trans; +- +- trans = ipa_cmd_trans_alloc(ipa, count); +- if (trans) { +- ipa_cmd_pipeline_clear_add(trans); +- gsi_trans_commit_wait(trans); +- ipa_cmd_pipeline_clear_wait(ipa); +- } else { +- dev_err(&ipa->pdev->dev, +- "error allocating %u entry tag transaction\n", count); +- } +-} +- + static struct ipa_cmd_info * + ipa_cmd_info_alloc(struct ipa_endpoint *endpoint, u32 tre_count) + { +diff --git a/drivers/net/ipa/ipa_cmd.h b/drivers/net/ipa/ipa_cmd.h +index 69cd085d427db..05ed7e42e1842 100644 +--- a/drivers/net/ipa/ipa_cmd.h ++++ b/drivers/net/ipa/ipa_cmd.h +@@ -163,12 +163,6 @@ u32 ipa_cmd_pipeline_clear_count(void); + */ + void ipa_cmd_pipeline_clear_wait(struct ipa *ipa); + +-/** +- * ipa_cmd_pipeline_clear() - Clear the hardware pipeline +- * @ipa: - IPA pointer +- */ +-void ipa_cmd_pipeline_clear(struct ipa *ipa); +- + /** + * ipa_cmd_trans_alloc() - Allocate a transaction for the command TX endpoint + * @ipa: IPA pointer +diff --git a/drivers/net/ipa/ipa_endpoint.c b/drivers/net/ipa/ipa_endpoint.c +index ef790fd0ab56a..03a1709934208 100644 +--- a/drivers/net/ipa/ipa_endpoint.c ++++ b/drivers/net/ipa/ipa_endpoint.c +@@ -1636,8 +1636,6 @@ void ipa_endpoint_suspend(struct ipa *ipa) + if (ipa->modem_netdev) + ipa_modem_suspend(ipa->modem_netdev); + +- ipa_cmd_pipeline_clear(ipa); +- + ipa_endpoint_suspend_one(ipa->name_map[IPA_ENDPOINT_AP_LAN_RX]); + ipa_endpoint_suspend_one(ipa->name_map[IPA_ENDPOINT_AP_COMMAND_TX]); + } +-- +2.33.0 + diff --git a/queue-5.15/net-ipa-separate-disabling-setup-from-modem-stop.patch b/queue-5.15/net-ipa-separate-disabling-setup-from-modem-stop.patch new file mode 100644 index 00000000000..f3728b619a7 --- /dev/null +++ b/queue-5.15/net-ipa-separate-disabling-setup-from-modem-stop.patch @@ -0,0 +1,136 @@ +From 88de7cd248eea915820f21fea69dee84ce45549b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Nov 2021 18:15:55 -0600 +Subject: net: ipa: separate disabling setup from modem stop + +From: Alex Elder + +[ Upstream commit 8afc7e471ad3c92a9c96adc62d1b67de77378bb6 ] + +The IPA setup_complete flag is set at the end of ipa_setup(), when +the setup phase of initialization has completed successfully. This +occurs as part of driver probe processing, or (if "modem-init" is +specified in the DTS file) it is triggered by the "ipa-setup-ready" +SMP2P interrupt generated by the modem. + +In the latter case, it's possible for driver shutdown (or remove) to +begin while setup processing is underway, and this can't be allowed. +The problem is that the setup_complete flag is not adequate to signal +that setup is underway. + +If setup_complete is set, it will never be un-set, so that case is +not a problem. But if setup_complete is false, there's a chance +setup is underway. + +Because setup is triggered by an interrupt on a "modem-init" system, +there is a simple way to ensure the value of setup_complete is safe +to read. The threaded handler--if it is executing--will complete as +part of a request to disable the "ipa-modem-ready" interrupt. This +means that ipa_setup() (which is called from the handler) will run +to completion if it was underway, or will never be called otherwise. + +The request to disable the "ipa-setup-ready" interrupt is currently +made within ipa_modem_stop(). Instead, disable the interrupt +outside that function in the two places it's called. In the case of +ipa_remove(), this ensures the setup_complete flag is safe to read +before we read it. + +Rename ipa_smp2p_disable() to be ipa_smp2p_irq_disable_setup(), to be +more specific about its effect. + +Fixes: 530f9216a953 ("soc: qcom: ipa: AP/modem communications") +Signed-off-by: Alex Elder +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ipa/ipa_main.c | 6 ++++++ + drivers/net/ipa/ipa_modem.c | 6 +++--- + drivers/net/ipa/ipa_smp2p.c | 2 +- + drivers/net/ipa/ipa_smp2p.h | 7 +++---- + 4 files changed, 13 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ipa/ipa_main.c b/drivers/net/ipa/ipa_main.c +index cdfa98a76e1f4..a448ec198bee1 100644 +--- a/drivers/net/ipa/ipa_main.c ++++ b/drivers/net/ipa/ipa_main.c +@@ -28,6 +28,7 @@ + #include "ipa_reg.h" + #include "ipa_mem.h" + #include "ipa_table.h" ++#include "ipa_smp2p.h" + #include "ipa_modem.h" + #include "ipa_uc.h" + #include "ipa_interrupt.h" +@@ -801,6 +802,11 @@ static int ipa_remove(struct platform_device *pdev) + struct device *dev = &pdev->dev; + int ret; + ++ /* Prevent the modem from triggering a call to ipa_setup(). This ++ * also ensures a modem-initiated setup that's underway completes. ++ */ ++ ipa_smp2p_irq_disable_setup(ipa); ++ + ret = pm_runtime_get_sync(dev); + if (WARN_ON(ret < 0)) + goto out_power_put; +diff --git a/drivers/net/ipa/ipa_modem.c b/drivers/net/ipa/ipa_modem.c +index ad116bcc0580e..d0ab4d70c303b 100644 +--- a/drivers/net/ipa/ipa_modem.c ++++ b/drivers/net/ipa/ipa_modem.c +@@ -339,9 +339,6 @@ int ipa_modem_stop(struct ipa *ipa) + if (state != IPA_MODEM_STATE_RUNNING) + return -EBUSY; + +- /* Prevent the modem from triggering a call to ipa_setup() */ +- ipa_smp2p_disable(ipa); +- + /* Clean up the netdev and endpoints if it was started */ + if (netdev) { + struct ipa_priv *priv = netdev_priv(netdev); +@@ -369,6 +366,9 @@ static void ipa_modem_crashed(struct ipa *ipa) + struct device *dev = &ipa->pdev->dev; + int ret; + ++ /* Prevent the modem from triggering a call to ipa_setup() */ ++ ipa_smp2p_irq_disable_setup(ipa); ++ + ret = pm_runtime_get_sync(dev); + if (ret < 0) { + dev_err(dev, "error %d getting power to handle crash\n", ret); +diff --git a/drivers/net/ipa/ipa_smp2p.c b/drivers/net/ipa/ipa_smp2p.c +index 24bc112a072c6..2112336120391 100644 +--- a/drivers/net/ipa/ipa_smp2p.c ++++ b/drivers/net/ipa/ipa_smp2p.c +@@ -309,7 +309,7 @@ void ipa_smp2p_exit(struct ipa *ipa) + kfree(smp2p); + } + +-void ipa_smp2p_disable(struct ipa *ipa) ++void ipa_smp2p_irq_disable_setup(struct ipa *ipa) + { + struct ipa_smp2p *smp2p = ipa->smp2p; + +diff --git a/drivers/net/ipa/ipa_smp2p.h b/drivers/net/ipa/ipa_smp2p.h +index 99a9567896388..59cee31a73836 100644 +--- a/drivers/net/ipa/ipa_smp2p.h ++++ b/drivers/net/ipa/ipa_smp2p.h +@@ -27,13 +27,12 @@ int ipa_smp2p_init(struct ipa *ipa, bool modem_init); + void ipa_smp2p_exit(struct ipa *ipa); + + /** +- * ipa_smp2p_disable() - Prevent "ipa-setup-ready" interrupt handling ++ * ipa_smp2p_irq_disable_setup() - Disable the "setup ready" interrupt + * @ipa: IPA pointer + * +- * Prevent handling of the "setup ready" interrupt from the modem. +- * This is used before initiating shutdown of the driver. ++ * Disable the "ipa-setup-ready" interrupt from the modem. + */ +-void ipa_smp2p_disable(struct ipa *ipa); ++void ipa_smp2p_irq_disable_setup(struct ipa *ipa); + + /** + * ipa_smp2p_notify_reset() - Reset modem notification state +-- +2.33.0 + diff --git a/queue-5.15/net-ipv6-add-fib6_nh_release_dsts-stub.patch b/queue-5.15/net-ipv6-add-fib6_nh_release_dsts-stub.patch new file mode 100644 index 00000000000..6f89d2e63eb --- /dev/null +++ b/queue-5.15/net-ipv6-add-fib6_nh_release_dsts-stub.patch @@ -0,0 +1,97 @@ +From e5da78a633f4f23d4ba18fd87ec6c697d9a26d6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Nov 2021 17:15:12 +0200 +Subject: net: ipv6: add fib6_nh_release_dsts stub + +From: Nikolay Aleksandrov + +[ Upstream commit 8837cbbf854246f5f4d565f21e6baa945d37aded ] + +We need a way to release a fib6_nh's per-cpu dsts when replacing +nexthops otherwise we can end up with stale per-cpu dsts which hold net +device references, so add a new IPv6 stub called fib6_nh_release_dsts. +It must be used after an RCU grace period, so no new dsts can be created +through a group's nexthop entry. +Similar to fib6_nh_release it shouldn't be used if fib6_nh_init has failed +so it doesn't need a dummy stub when IPv6 is not enabled. + +Fixes: 7bf4796dd099 ("nexthops: add support for replace") +Signed-off-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/ip6_fib.h | 1 + + include/net/ipv6_stubs.h | 1 + + net/ipv6/af_inet6.c | 1 + + net/ipv6/route.c | 19 +++++++++++++++++++ + 4 files changed, 22 insertions(+) + +diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h +index c412dde4d67dc..83b8070d1cc93 100644 +--- a/include/net/ip6_fib.h ++++ b/include/net/ip6_fib.h +@@ -485,6 +485,7 @@ int fib6_nh_init(struct net *net, struct fib6_nh *fib6_nh, + struct fib6_config *cfg, gfp_t gfp_flags, + struct netlink_ext_ack *extack); + void fib6_nh_release(struct fib6_nh *fib6_nh); ++void fib6_nh_release_dsts(struct fib6_nh *fib6_nh); + + int call_fib6_entry_notifiers(struct net *net, + enum fib_event_type event_type, +diff --git a/include/net/ipv6_stubs.h b/include/net/ipv6_stubs.h +index afbce90c44808..45e0339be6fa4 100644 +--- a/include/net/ipv6_stubs.h ++++ b/include/net/ipv6_stubs.h +@@ -47,6 +47,7 @@ struct ipv6_stub { + struct fib6_config *cfg, gfp_t gfp_flags, + struct netlink_ext_ack *extack); + void (*fib6_nh_release)(struct fib6_nh *fib6_nh); ++ void (*fib6_nh_release_dsts)(struct fib6_nh *fib6_nh); + void (*fib6_update_sernum)(struct net *net, struct fib6_info *rt); + int (*ip6_del_rt)(struct net *net, struct fib6_info *rt, bool skip_notify); + void (*fib6_rt_update)(struct net *net, struct fib6_info *rt, +diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c +index 0c4da163535ad..dab4a047590b7 100644 +--- a/net/ipv6/af_inet6.c ++++ b/net/ipv6/af_inet6.c +@@ -1026,6 +1026,7 @@ static const struct ipv6_stub ipv6_stub_impl = { + .ip6_mtu_from_fib6 = ip6_mtu_from_fib6, + .fib6_nh_init = fib6_nh_init, + .fib6_nh_release = fib6_nh_release, ++ .fib6_nh_release_dsts = fib6_nh_release_dsts, + .fib6_update_sernum = fib6_update_sernum_stub, + .fib6_rt_update = fib6_rt_update, + .ip6_del_rt = ip6_del_rt, +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 9b9ef09382ab9..79cb5e5a4948b 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -3680,6 +3680,25 @@ void fib6_nh_release(struct fib6_nh *fib6_nh) + fib_nh_common_release(&fib6_nh->nh_common); + } + ++void fib6_nh_release_dsts(struct fib6_nh *fib6_nh) ++{ ++ int cpu; ++ ++ if (!fib6_nh->rt6i_pcpu) ++ return; ++ ++ for_each_possible_cpu(cpu) { ++ struct rt6_info *pcpu_rt, **ppcpu_rt; ++ ++ ppcpu_rt = per_cpu_ptr(fib6_nh->rt6i_pcpu, cpu); ++ pcpu_rt = xchg(ppcpu_rt, NULL); ++ if (pcpu_rt) { ++ dst_dev_put(&pcpu_rt->dst); ++ dst_release(&pcpu_rt->dst); ++ } ++ } ++} ++ + static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg, + gfp_t gfp_flags, + struct netlink_ext_ack *extack) +-- +2.33.0 + diff --git a/queue-5.15/net-marvell-mvpp2-increase-mtu-limit-when-xdp-enable.patch b/queue-5.15/net-marvell-mvpp2-increase-mtu-limit-when-xdp-enable.patch new file mode 100644 index 00000000000..ac996b4cfe8 --- /dev/null +++ b/queue-5.15/net-marvell-mvpp2-increase-mtu-limit-when-xdp-enable.patch @@ -0,0 +1,72 @@ +From 8c67fc399aa0fa3ffbf5dc4ac2cf6d935d6859b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Nov 2021 21:08:34 +0100 +Subject: net: marvell: mvpp2: increase MTU limit when XDP enabled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 7b1b62bc1e6a7b2fd5ee7a4296268eb291d23aeb ] + +Currently mvpp2_xdp_setup won't allow attaching XDP program if + mtu > ETH_DATA_LEN (1500). + +The mvpp2_change_mtu on the other hand checks whether + MVPP2_RX_PKT_SIZE(mtu) > MVPP2_BM_LONG_PKT_SIZE. + +These two checks are semantically different. + +Moreover this limit can be increased to MVPP2_MAX_RX_BUF_SIZE, since in +mvpp2_rx we have + xdp.data = data + MVPP2_MH_SIZE + MVPP2_SKB_HEADROOM; + xdp.frame_sz = PAGE_SIZE; + +Change the checks to check whether + mtu > MVPP2_MAX_RX_BUF_SIZE + +Fixes: 07dd0a7aae7f ("mvpp2: add basic XDP support") +Signed-off-by: Marek Behún +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +index d74d4966b13fc..ed6d0c019573b 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -5017,11 +5017,13 @@ static int mvpp2_change_mtu(struct net_device *dev, int mtu) + mtu = ALIGN(MVPP2_RX_PKT_SIZE(mtu), 8); + } + ++ if (port->xdp_prog && mtu > MVPP2_MAX_RX_BUF_SIZE) { ++ netdev_err(dev, "Illegal MTU value %d (> %d) for XDP mode\n", ++ mtu, (int)MVPP2_MAX_RX_BUF_SIZE); ++ return -EINVAL; ++ } ++ + if (MVPP2_RX_PKT_SIZE(mtu) > MVPP2_BM_LONG_PKT_SIZE) { +- if (port->xdp_prog) { +- netdev_err(dev, "Jumbo frames are not supported with XDP\n"); +- return -EINVAL; +- } + if (priv->percpu_pools) { + netdev_warn(dev, "mtu %d too high, switching to shared buffers", mtu); + mvpp2_bm_switch_buffers(priv, false); +@@ -5307,8 +5309,8 @@ static int mvpp2_xdp_setup(struct mvpp2_port *port, struct netdev_bpf *bpf) + bool running = netif_running(port->dev); + bool reset = !prog != !port->xdp_prog; + +- if (port->dev->mtu > ETH_DATA_LEN) { +- NL_SET_ERR_MSG_MOD(bpf->extack, "XDP is not supported with jumbo frames enabled"); ++ if (port->dev->mtu > MVPP2_MAX_RX_BUF_SIZE) { ++ NL_SET_ERR_MSG_MOD(bpf->extack, "MTU too large for XDP"); + return -EOPNOTSUPP; + } + +-- +2.33.0 + diff --git a/queue-5.15/net-marvell-prestera-fix-brige-port-operation.patch b/queue-5.15/net-marvell-prestera-fix-brige-port-operation.patch new file mode 100644 index 00000000000..8190e683154 --- /dev/null +++ b/queue-5.15/net-marvell-prestera-fix-brige-port-operation.patch @@ -0,0 +1,44 @@ +From 05fb5b6be10a4af6167e59582350172809187780 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Nov 2021 21:48:03 +0200 +Subject: net: marvell: prestera: fix brige port operation + +From: Volodymyr Mytnyk + +[ Upstream commit 253e9b4d11e577bb8cbc77ef68a9ff46438065ca ] + +Return NOTIFY_DONE (dont't care) for switchdev notifications +that prestera driver don't know how to handle them. + +With introduction of SWITCHDEV_BRPORT_[UN]OFFLOADED switchdev +events, the driver rejects adding swport to bridge operation +which is handled by prestera_bridge_port_join() func. The root +cause of this is that prestera driver returns error (EOPNOTSUPP) +in prestera_switchdev_blk_event() handler for unknown swdev +events. This causes switchdev_bridge_port_offload() to fail +when adding port to bridge in prestera_bridge_port_join(). + +Fixes: 957e2235e526 ("net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge") +Signed-off-by: Volodymyr Mytnyk +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/prestera/prestera_switchdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c b/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c +index 3ce6ccd0f5394..79f2fca0d412d 100644 +--- a/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c ++++ b/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c +@@ -1124,7 +1124,7 @@ static int prestera_switchdev_blk_event(struct notifier_block *unused, + prestera_port_obj_attr_set); + break; + default: +- err = -EOPNOTSUPP; ++ return NOTIFY_DONE; + } + + return notifier_from_errno(err); +-- +2.33.0 + diff --git a/queue-5.15/net-marvell-prestera-fix-double-free-issue-on-err-pa.patch b/queue-5.15/net-marvell-prestera-fix-double-free-issue-on-err-pa.patch new file mode 100644 index 00000000000..f44a181a85d --- /dev/null +++ b/queue-5.15/net-marvell-prestera-fix-double-free-issue-on-err-pa.patch @@ -0,0 +1,66 @@ +From 9cee9c082ac2bcfecb05b3e83cd9d2978ef01a07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Nov 2021 21:51:40 +0200 +Subject: net: marvell: prestera: fix double free issue on err path + +From: Volodymyr Mytnyk + +[ Upstream commit e8d032507cb7912baf1d3e0af54516f823befefd ] + +fix error path handling in prestera_bridge_port_join() that +cases prestera driver to crash (see below). + + Trace: + Internal error: Oops: 96000044 [#1] SMP + Modules linked in: prestera_pci prestera uio_pdrv_genirq + CPU: 1 PID: 881 Comm: ip Not tainted 5.15.0 #1 + pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : prestera_bridge_destroy+0x2c/0xb0 [prestera] + lr : prestera_bridge_port_join+0x2cc/0x350 [prestera] + sp : ffff800011a1b0f0 + ... + x2 : ffff000109ca6c80 x1 : dead000000000100 x0 : dead000000000122 + Call trace: + prestera_bridge_destroy+0x2c/0xb0 [prestera] + prestera_bridge_port_join+0x2cc/0x350 [prestera] + prestera_netdev_port_event.constprop.0+0x3c4/0x450 [prestera] + prestera_netdev_event_handler+0xf4/0x110 [prestera] + raw_notifier_call_chain+0x54/0x80 + call_netdevice_notifiers_info+0x54/0xa0 + __netdev_upper_dev_link+0x19c/0x380 + +Fixes: e1189d9a5fbe ("net: marvell: prestera: Add Switchdev driver implementation") +Signed-off-by: Volodymyr Mytnyk +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/prestera/prestera_switchdev.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c b/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c +index 79f2fca0d412d..b4599fe4ca8da 100644 +--- a/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c ++++ b/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c +@@ -497,8 +497,8 @@ int prestera_bridge_port_join(struct net_device *br_dev, + + br_port = prestera_bridge_port_add(bridge, port->dev); + if (IS_ERR(br_port)) { +- err = PTR_ERR(br_port); +- goto err_brport_create; ++ prestera_bridge_put(bridge); ++ return PTR_ERR(br_port); + } + + err = switchdev_bridge_port_offload(br_port->dev, port->dev, NULL, +@@ -519,8 +519,6 @@ int prestera_bridge_port_join(struct net_device *br_dev, + switchdev_bridge_port_unoffload(br_port->dev, NULL, NULL, NULL); + err_switchdev_offload: + prestera_bridge_port_put(br_port); +-err_brport_create: +- prestera_bridge_put(bridge); + return err; + } + +-- +2.33.0 + diff --git a/queue-5.15/net-mscc-ocelot-correctly-report-the-timestamping-rx.patch b/queue-5.15/net-mscc-ocelot-correctly-report-the-timestamping-rx.patch new file mode 100644 index 00000000000..121548f3ec1 --- /dev/null +++ b/queue-5.15/net-mscc-ocelot-correctly-report-the-timestamping-rx.patch @@ -0,0 +1,41 @@ +From 0a250c9f5682f7a94dedfd3e7abb024876680d5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Nov 2021 19:28:45 +0200 +Subject: net: mscc: ocelot: correctly report the timestamping RX filters in + ethtool + +From: Vladimir Oltean + +[ Upstream commit c49a35eedfef08bffd46b53c25dbf9d6016a86ff ] + +The driver doesn't support RX timestamping for non-PTP packets, but it +declares that it does. Restrict the reported RX filters to PTP v2 over +L2 and over L4. + +Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support") +Signed-off-by: Vladimir Oltean +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mscc/ocelot.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c +index 08fafc4a7e813..00b5e6860bf69 100644 +--- a/drivers/net/ethernet/mscc/ocelot.c ++++ b/drivers/net/ethernet/mscc/ocelot.c +@@ -1293,7 +1293,10 @@ int ocelot_get_ts_info(struct ocelot *ocelot, int port, + SOF_TIMESTAMPING_RAW_HARDWARE; + info->tx_types = BIT(HWTSTAMP_TX_OFF) | BIT(HWTSTAMP_TX_ON) | + BIT(HWTSTAMP_TX_ONESTEP_SYNC); +- info->rx_filters = BIT(HWTSTAMP_FILTER_NONE) | BIT(HWTSTAMP_FILTER_ALL); ++ info->rx_filters = BIT(HWTSTAMP_FILTER_NONE) | ++ BIT(HWTSTAMP_FILTER_PTP_V2_EVENT) | ++ BIT(HWTSTAMP_FILTER_PTP_V2_L2_EVENT) | ++ BIT(HWTSTAMP_FILTER_PTP_V2_L4_EVENT); + + return 0; + } +-- +2.33.0 + diff --git a/queue-5.15/net-mscc-ocelot-don-t-downgrade-timestamping-rx-filt.patch b/queue-5.15/net-mscc-ocelot-don-t-downgrade-timestamping-rx-filt.patch new file mode 100644 index 00000000000..fff22383145 --- /dev/null +++ b/queue-5.15/net-mscc-ocelot-don-t-downgrade-timestamping-rx-filt.patch @@ -0,0 +1,49 @@ +From 0c49c7e2c0d8229cb2be016e702d2d33c037870b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Nov 2021 19:28:41 +0200 +Subject: net: mscc: ocelot: don't downgrade timestamping RX filters in + SIOCSHWTSTAMP + +From: Vladimir Oltean + +[ Upstream commit 8a075464d1e9317ffae0973dfe538a7511291a06 ] + +The ocelot driver, when asked to timestamp all receiving packets, 1588 +v1 or NTP, says "nah, here's 1588 v2 for you". + +According to this discussion: +https://patchwork.kernel.org/project/netdevbpf/patch/20211104133204.19757-8-martin.kaistra@linutronix.de/#24577647 +drivers that downgrade from a wider request to a narrower response (or +even a response where the intersection with the request is empty) are +buggy, and should return -ERANGE instead. This patch fixes that. + +Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support") +Suggested-by: Richard Cochran +Signed-off-by: Vladimir Oltean +Acked-by: Richard Cochran +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mscc/ocelot.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c +index a08e4f530c1c1..08fafc4a7e813 100644 +--- a/drivers/net/ethernet/mscc/ocelot.c ++++ b/drivers/net/ethernet/mscc/ocelot.c +@@ -1175,12 +1175,6 @@ int ocelot_hwstamp_set(struct ocelot *ocelot, int port, struct ifreq *ifr) + switch (cfg.rx_filter) { + case HWTSTAMP_FILTER_NONE: + break; +- case HWTSTAMP_FILTER_ALL: +- case HWTSTAMP_FILTER_SOME: +- case HWTSTAMP_FILTER_PTP_V1_L4_EVENT: +- case HWTSTAMP_FILTER_PTP_V1_L4_SYNC: +- case HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ: +- case HWTSTAMP_FILTER_NTP_ALL: + case HWTSTAMP_FILTER_PTP_V2_L4_EVENT: + case HWTSTAMP_FILTER_PTP_V2_L4_SYNC: + case HWTSTAMP_FILTER_PTP_V2_L4_DELAY_REQ: +-- +2.33.0 + diff --git a/queue-5.15/net-ncsi-add-payload-to-be-32-bit-aligned-to-fix-dro.patch b/queue-5.15/net-ncsi-add-payload-to-be-32-bit-aligned-to-fix-dro.patch new file mode 100644 index 00000000000..effd1e42175 --- /dev/null +++ b/queue-5.15/net-ncsi-add-payload-to-be-32-bit-aligned-to-fix-dro.patch @@ -0,0 +1,92 @@ +From 085ad93fd84658ba1a8de9d3ec4970b208a255c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Nov 2021 22:08:18 +0530 +Subject: net/ncsi : Add payload to be 32-bit aligned to fix dropped packets + +From: Kumar Thangavel + +[ Upstream commit ac132852147ad303a938dda318970dd1bbdfda4e ] + +Update NC-SI command handler (both standard and OEM) to take into +account of payload paddings in allocating skb (in case of payload +size is not 32-bit aligned). + +The checksum field follows payload field, without taking payload +padding into account can cause checksum being truncated, leading to +dropped packets. + +Fixes: fb4ee67529ff ("net/ncsi: Add NCSI OEM command support") +Signed-off-by: Kumar Thangavel +Acked-by: Samuel Mendoza-Jonas +Reviewed-by: Paul Menzel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ncsi/ncsi-cmd.c | 24 ++++++++++++++++-------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +diff --git a/net/ncsi/ncsi-cmd.c b/net/ncsi/ncsi-cmd.c +index ba9ae482141b0..dda8b76b77988 100644 +--- a/net/ncsi/ncsi-cmd.c ++++ b/net/ncsi/ncsi-cmd.c +@@ -18,6 +18,8 @@ + #include "internal.h" + #include "ncsi-pkt.h" + ++static const int padding_bytes = 26; ++ + u32 ncsi_calculate_checksum(unsigned char *data, int len) + { + u32 checksum = 0; +@@ -213,12 +215,17 @@ static int ncsi_cmd_handler_oem(struct sk_buff *skb, + { + struct ncsi_cmd_oem_pkt *cmd; + unsigned int len; ++ int payload; ++ /* NC-SI spec DSP_0222_1.2.0, section 8.2.2.2 ++ * requires payload to be padded with 0 to ++ * 32-bit boundary before the checksum field. ++ * Ensure the padding bytes are accounted for in ++ * skb allocation ++ */ + ++ payload = ALIGN(nca->payload, 4); + len = sizeof(struct ncsi_cmd_pkt_hdr) + 4; +- if (nca->payload < 26) +- len += 26; +- else +- len += nca->payload; ++ len += max(payload, padding_bytes); + + cmd = skb_put_zero(skb, len); + memcpy(&cmd->mfr_id, nca->data, nca->payload); +@@ -272,6 +279,7 @@ static struct ncsi_request *ncsi_alloc_command(struct ncsi_cmd_arg *nca) + struct net_device *dev = nd->dev; + int hlen = LL_RESERVED_SPACE(dev); + int tlen = dev->needed_tailroom; ++ int payload; + int len = hlen + tlen; + struct sk_buff *skb; + struct ncsi_request *nr; +@@ -281,14 +289,14 @@ static struct ncsi_request *ncsi_alloc_command(struct ncsi_cmd_arg *nca) + return NULL; + + /* NCSI command packet has 16-bytes header, payload, 4 bytes checksum. ++ * Payload needs padding so that the checksum field following payload is ++ * aligned to 32-bit boundary. + * The packet needs padding if its payload is less than 26 bytes to + * meet 64 bytes minimal ethernet frame length. + */ + len += sizeof(struct ncsi_cmd_pkt_hdr) + 4; +- if (nca->payload < 26) +- len += 26; +- else +- len += nca->payload; ++ payload = ALIGN(nca->payload, 4); ++ len += max(payload, padding_bytes); + + /* Allocate skb */ + skb = alloc_skb(len, GFP_ATOMIC); +-- +2.33.0 + diff --git a/queue-5.15/net-nexthop-release-ipv6-per-cpu-dsts-when-replacing.patch b/queue-5.15/net-nexthop-release-ipv6-per-cpu-dsts-when-replacing.patch new file mode 100644 index 00000000000..4aa6f8af7d2 --- /dev/null +++ b/queue-5.15/net-nexthop-release-ipv6-per-cpu-dsts-when-replacing.patch @@ -0,0 +1,154 @@ +From 0cb1736f5726fa664fe5d7748962781e7a362299 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Nov 2021 17:15:13 +0200 +Subject: net: nexthop: release IPv6 per-cpu dsts when replacing a nexthop + group + +From: Nikolay Aleksandrov + +[ Upstream commit 1005f19b9357b81aa64e1decd08d6e332caaa284 ] + +When replacing a nexthop group, we must release the IPv6 per-cpu dsts of +the removed nexthop entries after an RCU grace period because they +contain references to the nexthop's net device and to the fib6 info. +With specific series of events[1] we can reach net device refcount +imbalance which is unrecoverable. IPv4 is not affected because dsts +don't take a refcount on the route. + +[1] + $ ip nexthop list + id 200 via 2002:db8::2 dev bridge.10 scope link onlink + id 201 via 2002:db8::3 dev bridge scope link onlink + id 203 group 201/200 + $ ip -6 route + 2001:db8::10 nhid 203 metric 1024 pref medium + nexthop via 2002:db8::3 dev bridge weight 1 onlink + nexthop via 2002:db8::2 dev bridge.10 weight 1 onlink + +Create rt6_info through one of the multipath legs, e.g.: + $ taskset -a -c 1 ./pkt_inj 24 bridge.10 2001:db8::10 + (pkt_inj is just a custom packet generator, nothing special) + +Then remove that leg from the group by replace (let's assume it is id +200 in this case): + $ ip nexthop replace id 203 group 201 + +Now remove the IPv6 route: + $ ip -6 route del 2001:db8::10/128 + +The route won't be really deleted due to the stale rt6_info holding 1 +refcnt in nexthop id 200. +At this point we have the following reference count dependency: + (deleted) IPv6 route holds 1 reference over nhid 203 + nh 203 holds 1 ref over id 201 + nh 200 holds 1 ref over the net device and the route due to the stale + rt6_info + +Now to create circular dependency between nh 200 and the IPv6 route, and +also to get a reference over nh 200, restore nhid 200 in the group: + $ ip nexthop replace id 203 group 201/200 + +And now we have a permanent circular dependncy because nhid 203 holds a +reference over nh 200 and 201, but the route holds a ref over nh 203 and +is deleted. + +To trigger the bug just delete the group (nhid 203): + $ ip nexthop del id 203 + +It won't really be deleted due to the IPv6 route dependency, and now we +have 2 unlinked and deleted objects that reference each other: the group +and the IPv6 route. Since the group drops the reference it holds over its +entries at free time (i.e. its own refcount needs to drop to 0) that will +never happen and we get a permanent ref on them, since one of the entries +holds a reference over the IPv6 route it will also never be released. + +At this point the dependencies are: + (deleted, only unlinked) IPv6 route holds reference over group nh 203 + (deleted, only unlinked) group nh 203 holds reference over nh 201 and 200 + nh 200 holds 1 ref over the net device and the route due to the stale + rt6_info + +This is the last point where it can be fixed by running traffic through +nh 200, and specifically through the same CPU so the rt6_info (dst) will +get released due to the IPv6 genid, that in turn will free the IPv6 +route, which in turn will free the ref count over the group nh 203. + +If nh 200 is deleted at this point, it will never be released due to the +ref from the unlinked group 203, it will only be unlinked: + $ ip nexthop del id 200 + $ ip nexthop + $ + +Now we can never release that stale rt6_info, we have IPv6 route with ref +over group nh 203, group nh 203 with ref over nh 200 and 201, nh 200 with +rt6_info (dst) with ref over the net device and the IPv6 route. All of +these objects are only unlinked, and cannot be released, thus they can't +release their ref counts. + + Message from syslogd@dev at Nov 19 14:04:10 ... + kernel:[73501.828730] unregister_netdevice: waiting for bridge.10 to become free. Usage count = 3 + Message from syslogd@dev at Nov 19 14:04:20 ... + kernel:[73512.068811] unregister_netdevice: waiting for bridge.10 to become free. Usage count = 3 + +Fixes: 7bf4796dd099 ("nexthops: add support for replace") +Signed-off-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/nexthop.c | 25 +++++++++++++++++++++++-- + 1 file changed, 23 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c +index 2cc7a7a864c6b..5dbd4b5505eba 100644 +--- a/net/ipv4/nexthop.c ++++ b/net/ipv4/nexthop.c +@@ -1899,15 +1899,36 @@ static void remove_nexthop(struct net *net, struct nexthop *nh, + /* if any FIB entries reference this nexthop, any dst entries + * need to be regenerated + */ +-static void nh_rt_cache_flush(struct net *net, struct nexthop *nh) ++static void nh_rt_cache_flush(struct net *net, struct nexthop *nh, ++ struct nexthop *replaced_nh) + { + struct fib6_info *f6i; ++ struct nh_group *nhg; ++ int i; + + if (!list_empty(&nh->fi_list)) + rt_cache_flush(net); + + list_for_each_entry(f6i, &nh->f6i_list, nh_list) + ipv6_stub->fib6_update_sernum(net, f6i); ++ ++ /* if an IPv6 group was replaced, we have to release all old ++ * dsts to make sure all refcounts are released ++ */ ++ if (!replaced_nh->is_group) ++ return; ++ ++ /* new dsts must use only the new nexthop group */ ++ synchronize_net(); ++ ++ nhg = rtnl_dereference(replaced_nh->nh_grp); ++ for (i = 0; i < nhg->num_nh; i++) { ++ struct nh_grp_entry *nhge = &nhg->nh_entries[i]; ++ struct nh_info *nhi = rtnl_dereference(nhge->nh->nh_info); ++ ++ if (nhi->family == AF_INET6) ++ ipv6_stub->fib6_nh_release_dsts(&nhi->fib6_nh); ++ } + } + + static int replace_nexthop_grp(struct net *net, struct nexthop *old, +@@ -2247,7 +2268,7 @@ static int replace_nexthop(struct net *net, struct nexthop *old, + err = replace_nexthop_single(net, old, new, extack); + + if (!err) { +- nh_rt_cache_flush(net, old); ++ nh_rt_cache_flush(net, old, new); + + __remove_nexthop(net, new, NULL); + nexthop_put(new); +-- +2.33.0 + diff --git a/queue-5.15/net-phylink-force-link-down-and-retrigger-resolve-on.patch b/queue-5.15/net-phylink-force-link-down-and-retrigger-resolve-on.patch new file mode 100644 index 00000000000..912f5cded4e --- /dev/null +++ b/queue-5.15/net-phylink-force-link-down-and-retrigger-resolve-on.patch @@ -0,0 +1,103 @@ +From d631751b9ad652d16d3cba0ff4cf99d062d4bfe3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Nov 2021 16:44:02 +0100 +Subject: net: phylink: Force link down and retrigger resolve on interface + change +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Russell King (Oracle) + +[ Upstream commit 80662f4fd4771bc9c7cc4abdfbe866ebd1179621 ] + +On PHY state change the phylink_resolve() function can read stale +information from the MAC and report incorrect link speed and duplex to +the kernel message log. + +Example with a Marvell 88X3310 PHY connected to a SerDes port on Marvell +88E6393X switch: +- PHY driver triggers state change due to PHY interface mode being + changed from 10gbase-r to 2500base-x due to copper change in speed + from 10Gbps to 2.5Gbps, but the PHY itself either hasn't yet changed + its interface to the host, or the interrupt about loss of SerDes link + hadn't arrived yet (there can be a delay of several milliseconds for + this), so we still think that the 10gbase-r mode is up +- phylink_resolve() + - phylink_mac_pcs_get_state() + - this fills in speed=10g link=up + - interface mode is updated to 2500base-x but speed is left at 10Gbps + - phylink_major_config() + - interface is changed to 2500base-x + - phylink_link_up() + - mv88e6xxx_mac_link_up() + - .port_set_speed_duplex() + - speed is set to 10Gbps + - reports "Link is Up - 10Gbps/Full" to dmesg + +Afterwards when the interrupt finally arrives for mv88e6xxx, another +resolve is forced in which we get the correct speed from +phylink_mac_pcs_get_state(), but since the interface is not being +changed anymore, we don't call phylink_major_config() but only +phylink_mac_config(), which does not set speed/duplex anymore. + +To fix this, we need to force the link down and trigger another resolve +on PHY interface change event. + +Fixes: 9525ae83959b ("phylink: add phylink infrastructure") +Signed-off-by: Russell King (Oracle) +Signed-off-by: Marek Behún +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/phylink.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c +index 7ec3105010ac1..59ee87df5746e 100644 +--- a/drivers/net/phy/phylink.c ++++ b/drivers/net/phy/phylink.c +@@ -657,6 +657,7 @@ static void phylink_resolve(struct work_struct *w) + struct phylink_link_state link_state; + struct net_device *ndev = pl->netdev; + bool mac_config = false; ++ bool retrigger = false; + bool cur_link_state; + + mutex_lock(&pl->state_mutex); +@@ -670,6 +671,7 @@ static void phylink_resolve(struct work_struct *w) + link_state.link = false; + } else if (pl->mac_link_dropped) { + link_state.link = false; ++ retrigger = true; + } else { + switch (pl->cur_link_an_mode) { + case MLO_AN_PHY: +@@ -694,6 +696,15 @@ static void phylink_resolve(struct work_struct *w) + + /* Only update if the PHY link is up */ + if (pl->phydev && pl->phy_state.link) { ++ /* If the interface has changed, force a ++ * link down event if the link isn't already ++ * down, and re-resolve. ++ */ ++ if (link_state.interface != ++ pl->phy_state.interface) { ++ retrigger = true; ++ link_state.link = false; ++ } + link_state.interface = pl->phy_state.interface; + + /* If we have a PHY, we need to update with +@@ -736,7 +747,7 @@ static void phylink_resolve(struct work_struct *w) + else + phylink_link_up(pl, link_state); + } +- if (!link_state.link && pl->mac_link_dropped) { ++ if (!link_state.link && retrigger) { + pl->mac_link_dropped = false; + queue_work(system_power_efficient_wq, &pl->resolve); + } +-- +2.33.0 + diff --git a/queue-5.15/net-phylink-force-retrigger-in-case-of-latched-link-.patch b/queue-5.15/net-phylink-force-retrigger-in-case-of-latched-link-.patch new file mode 100644 index 00000000000..1ac6913f72b --- /dev/null +++ b/queue-5.15/net-phylink-force-retrigger-in-case-of-latched-link-.patch @@ -0,0 +1,66 @@ +From 41f9722aca11c5af26d8cff7cbf1ce24531c6462 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Nov 2021 16:44:03 +0100 +Subject: net: phylink: Force retrigger in case of latched link-fail indicator +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Russell King (Oracle) + +[ Upstream commit dbae3388ea9ca33bd1d5eabc3b0ef17e69c74677 ] + +On mv88e6xxx 1G/2.5G PCS, the SerDes register 4.2001.2 has the following +description: + This register bit indicates when link was lost since the last + read. For the current link status, read this register + back-to-back. + +Thus to get current link state, we need to read the register twice. + +But doing that in the link change interrupt handler would lead to +potentially ignoring link down events, which we really want to avoid. + +Thus this needs to be solved in phylink's resolve, by retriggering +another resolve in the event when PCS reports link down and previous +link was up, and by re-reading PCS state if the previous link was down. + +The wrong value is read when phylink requests change from sgmii to +2500base-x mode, and link won't come up. This fixes the bug. + +Fixes: 9525ae83959b ("phylink: add phylink infrastructure") +Signed-off-by: Russell King (Oracle) +Signed-off-by: Marek Behún +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/phylink.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c +index 59ee87df5746e..fef1416dcee4c 100644 +--- a/drivers/net/phy/phylink.c ++++ b/drivers/net/phy/phylink.c +@@ -688,6 +688,19 @@ static void phylink_resolve(struct work_struct *w) + case MLO_AN_INBAND: + phylink_mac_pcs_get_state(pl, &link_state); + ++ /* The PCS may have a latching link-fail indicator. ++ * If the link was up, bring the link down and ++ * re-trigger the resolve. Otherwise, re-read the ++ * PCS state to get the current status of the link. ++ */ ++ if (!link_state.link) { ++ if (cur_link_state) ++ retrigger = true; ++ else ++ phylink_mac_pcs_get_state(pl, ++ &link_state); ++ } ++ + /* If we have a phy, the "up" state is the union of + * both the PHY and the MAC + */ +-- +2.33.0 + diff --git a/queue-5.15/net-sched-sch_ets-don-t-peek-at-classes-beyond-nband.patch b/queue-5.15/net-sched-sch_ets-don-t-peek-at-classes-beyond-nband.patch new file mode 100644 index 00000000000..0187b75bc53 --- /dev/null +++ b/queue-5.15/net-sched-sch_ets-don-t-peek-at-classes-beyond-nband.patch @@ -0,0 +1,101 @@ +From 829ccfd003a944283533d1c90d7a87e46bcbf14a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Nov 2021 17:14:40 +0100 +Subject: net/sched: sch_ets: don't peek at classes beyond 'nbands' + +From: Davide Caratti + +[ Upstream commit de6d25924c2a8c2988c6a385990cafbe742061bf ] + +when the number of DRR classes decreases, the round-robin active list can +contain elements that have already been freed in ets_qdisc_change(). As a +consequence, it's possible to see a NULL dereference crash, caused by the +attempt to call cl->qdisc->ops->peek(cl->qdisc) when cl->qdisc is NULL: + + BUG: kernel NULL pointer dereference, address: 0000000000000018 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 0 P4D 0 + Oops: 0000 [#1] PREEMPT SMP NOPTI + CPU: 1 PID: 910 Comm: mausezahn Not tainted 5.16.0-rc1+ #475 + Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014 + RIP: 0010:ets_qdisc_dequeue+0x129/0x2c0 [sch_ets] + Code: c5 01 41 39 ad e4 02 00 00 0f 87 18 ff ff ff 49 8b 85 c0 02 00 00 49 39 c4 0f 84 ba 00 00 00 49 8b ad c0 02 00 00 48 8b 7d 10 <48> 8b 47 18 48 8b 40 38 0f ae e8 ff d0 48 89 c3 48 85 c0 0f 84 9d + RSP: 0000:ffffbb36c0b5fdd8 EFLAGS: 00010287 + RAX: ffff956678efed30 RBX: 0000000000000000 RCX: 0000000000000000 + RDX: 0000000000000002 RSI: ffffffff9b938dc9 RDI: 0000000000000000 + RBP: ffff956678efed30 R08: e2f3207fe360129c R09: 0000000000000000 + R10: 0000000000000001 R11: 0000000000000001 R12: ffff956678efeac0 + R13: ffff956678efe800 R14: ffff956611545000 R15: ffff95667ac8f100 + FS: 00007f2aa9120740(0000) GS:ffff95667b800000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000018 CR3: 000000011070c000 CR4: 0000000000350ee0 + Call Trace: + + qdisc_peek_dequeued+0x29/0x70 [sch_ets] + tbf_dequeue+0x22/0x260 [sch_tbf] + __qdisc_run+0x7f/0x630 + net_tx_action+0x290/0x4c0 + __do_softirq+0xee/0x4f8 + irq_exit_rcu+0xf4/0x130 + sysvec_apic_timer_interrupt+0x52/0xc0 + asm_sysvec_apic_timer_interrupt+0x12/0x20 + RIP: 0033:0x7f2aa7fc9ad4 + Code: b9 ff ff 48 8b 54 24 18 48 83 c4 08 48 89 ee 48 89 df 5b 5d e9 ed fc ff ff 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa <53> 48 83 ec 10 48 8b 05 10 64 33 00 48 8b 00 48 85 c0 0f 85 84 00 + RSP: 002b:00007ffe5d33fab8 EFLAGS: 00000202 + RAX: 0000000000000002 RBX: 0000561f72c31460 RCX: 0000561f72c31720 + RDX: 0000000000000002 RSI: 0000561f72c31722 RDI: 0000561f72c31720 + RBP: 000000000000002a R08: 00007ffe5d33fa40 R09: 0000000000000014 + R10: 0000000000000000 R11: 0000000000000246 R12: 0000561f7187e380 + R13: 0000000000000000 R14: 0000000000000000 R15: 0000561f72c31460 + + Modules linked in: sch_ets sch_tbf dummy rfkill iTCO_wdt intel_rapl_msr iTCO_vendor_support intel_rapl_common joydev virtio_balloon lpc_ich i2c_i801 i2c_smbus pcspkr ip_tables xfs libcrc32c crct10dif_pclmul crc32_pclmul crc32c_intel ahci libahci ghash_clmulni_intel serio_raw libata virtio_blk virtio_console virtio_net net_failover failover sunrpc dm_mirror dm_region_hash dm_log dm_mod + CR2: 0000000000000018 + +Ensuring that 'alist' was never zeroed [1] was not sufficient, we need to +remove from the active list those elements that are no more SP nor DRR. + +[1] https://lore.kernel.org/netdev/60d274838bf09777f0371253416e8af71360bc08.1633609148.git.dcaratti@redhat.com/ + +v3: fix race between ets_qdisc_change() and ets_qdisc_dequeue() delisting + DRR classes beyond 'nbands' in ets_qdisc_change() with the qdisc lock + acquired, thanks to Cong Wang. + +v2: when a NULL qdisc is found in the DRR active list, try to dequeue skb + from the next list item. + +Reported-by: Hangbin Liu +Fixes: dcc68b4d8084 ("net: sch_ets: Add a new Qdisc") +Signed-off-by: Davide Caratti +Link: https://lore.kernel.org/r/7a5c496eed2d62241620bdbb83eb03fb9d571c99.1637762721.git.dcaratti@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_ets.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/net/sched/sch_ets.c b/net/sched/sch_ets.c +index 1f857ffd1ac23..92a686807971b 100644 +--- a/net/sched/sch_ets.c ++++ b/net/sched/sch_ets.c +@@ -667,12 +667,14 @@ static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt, + q->classes[i].deficit = quanta[i]; + } + } ++ for (i = q->nbands; i < oldbands; i++) { ++ qdisc_tree_flush_backlog(q->classes[i].qdisc); ++ if (i >= q->nstrict) ++ list_del(&q->classes[i].alist); ++ } + q->nstrict = nstrict; + memcpy(q->prio2band, priomap, sizeof(priomap)); + +- for (i = q->nbands; i < oldbands; i++) +- qdisc_tree_flush_backlog(q->classes[i].qdisc); +- + for (i = 0; i < q->nbands; i++) + q->classes[i].quantum = quanta[i]; + +-- +2.33.0 + diff --git a/queue-5.15/net-smc-don-t-call-clcsock-shutdown-twice-when-smc-s.patch b/queue-5.15/net-smc-don-t-call-clcsock-shutdown-twice-when-smc-s.patch new file mode 100644 index 00000000000..fe9caf2ab6b --- /dev/null +++ b/queue-5.15/net-smc-don-t-call-clcsock-shutdown-twice-when-smc-s.patch @@ -0,0 +1,67 @@ +From 757ca21ba8270bd1d6373a32dcf50d8130cca0f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Nov 2021 10:41:35 +0800 +Subject: net/smc: Don't call clcsock shutdown twice when smc shutdown + +From: Tony Lu + +[ Upstream commit bacb6c1e47691cda4a95056c21b5487fb7199fcc ] + +When applications call shutdown() with SHUT_RDWR in userspace, +smc_close_active() calls kernel_sock_shutdown(), and it is called +twice in smc_shutdown(). + +This fixes this by checking sk_state before do clcsock shutdown, and +avoids missing the application's call of smc_shutdown(). + +Link: https://lore.kernel.org/linux-s390/1f67548e-cbf6-0dce-82b5-10288a4583bd@linux.ibm.com/ +Fixes: 606a63c9783a ("net/smc: Ensure the active closing peer first closes clcsock") +Signed-off-by: Tony Lu +Reviewed-by: Wen Gu +Acked-by: Karsten Graul +Link: https://lore.kernel.org/r/20211126024134.45693-1-tonylu@linux.alibaba.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/smc/af_smc.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 4f1fa1bcb0316..3d8219e3b0264 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -2154,8 +2154,10 @@ static __poll_t smc_poll(struct file *file, struct socket *sock, + static int smc_shutdown(struct socket *sock, int how) + { + struct sock *sk = sock->sk; ++ bool do_shutdown = true; + struct smc_sock *smc; + int rc = -EINVAL; ++ int old_state; + int rc1 = 0; + + smc = smc_sk(sk); +@@ -2182,7 +2184,11 @@ static int smc_shutdown(struct socket *sock, int how) + } + switch (how) { + case SHUT_RDWR: /* shutdown in both directions */ ++ old_state = sk->sk_state; + rc = smc_close_active(smc); ++ if (old_state == SMC_ACTIVE && ++ sk->sk_state == SMC_PEERCLOSEWAIT1) ++ do_shutdown = false; + break; + case SHUT_WR: + rc = smc_close_shutdown_write(smc); +@@ -2192,7 +2198,7 @@ static int smc_shutdown(struct socket *sock, int how) + /* nothing more to do because peer is not involved */ + break; + } +- if (smc->clcsock) ++ if (do_shutdown && smc->clcsock) + rc1 = kernel_sock_shutdown(smc->clcsock, how); + /* map sock_shutdown_cmd constants to sk_shutdown value range */ + sk->sk_shutdown |= how + 1; +-- +2.33.0 + diff --git a/queue-5.15/net-smc-ensure-the-active-closing-peer-first-closes-.patch b/queue-5.15/net-smc-ensure-the-active-closing-peer-first-closes-.patch new file mode 100644 index 00000000000..f90e0655786 --- /dev/null +++ b/queue-5.15/net-smc-ensure-the-active-closing-peer-first-closes-.patch @@ -0,0 +1,77 @@ +From b175d61ed928e417fa67cd1e1a55f94d8aa0e64d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Nov 2021 16:25:18 +0800 +Subject: net/smc: Ensure the active closing peer first closes clcsock + +From: Tony Lu + +[ Upstream commit 606a63c9783a32a45bd2ef0eee393711d75b3284 ] + +The side that actively closed socket, it's clcsock doesn't enter +TIME_WAIT state, but the passive side does it. It should show the same +behavior as TCP sockets. + +Consider this, when client actively closes the socket, the clcsock in +server enters TIME_WAIT state, which means the address is occupied and +won't be reused before TIME_WAIT dismissing. If we restarted server, the +service would be unavailable for a long time. + +To solve this issue, shutdown the clcsock in [A], perform the TCP active +close progress first, before the passive closed side closing it. So that +the actively closed side enters TIME_WAIT, not the passive one. + +Client | Server +close() // client actively close | + smc_release() | + smc_close_active() // PEERCLOSEWAIT1 | + smc_close_final() // abort or closed = 1| + smc_cdc_get_slot_and_msg_send() | + [A] | + |smc_cdc_msg_recv_action() // ACTIVE + | queue_work(smc_close_wq, &conn->close_work) + | smc_close_passive_work() // PROCESSABORT or APPCLOSEWAIT1 + | smc_close_passive_abort_received() // only in abort + | + |close() // server recv zero, close + | smc_release() // PROCESSABORT or APPCLOSEWAIT1 + | smc_close_active() + | smc_close_abort() or smc_close_final() // CLOSED + | smc_cdc_get_slot_and_msg_send() // abort or closed = 1 +smc_cdc_msg_recv_action() | smc_clcsock_release() + queue_work(smc_close_wq, &conn->close_work) | sock_release(tcp) // actively close clc, enter TIME_WAIT + smc_close_passive_work() // PEERCLOSEWAIT1 | smc_conn_free() + smc_close_passive_abort_received() // CLOSED| + smc_conn_free() | + smc_clcsock_release() | + sock_release(tcp) // passive close clc | + +Link: https://www.spinics.net/lists/netdev/msg780407.html +Fixes: b38d732477e4 ("smc: socket closing and linkgroup cleanup") +Signed-off-by: Tony Lu +Reviewed-by: Wen Gu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/smc_close.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c +index 0f9ffba07d268..04620b53b74a7 100644 +--- a/net/smc/smc_close.c ++++ b/net/smc/smc_close.c +@@ -228,6 +228,12 @@ int smc_close_active(struct smc_sock *smc) + /* send close request */ + rc = smc_close_final(conn); + sk->sk_state = SMC_PEERCLOSEWAIT1; ++ ++ /* actively shutdown clcsock before peer close it, ++ * prevent peer from entering TIME_WAIT state. ++ */ ++ if (smc->clcsock && smc->clcsock->sk) ++ rc = kernel_sock_shutdown(smc->clcsock, SHUT_RDWR); + } else { + /* peer event has changed the state */ + goto again; +-- +2.33.0 + diff --git a/queue-5.15/net-smc-fix-loop-in-smc_listen.patch b/queue-5.15/net-smc-fix-loop-in-smc_listen.patch new file mode 100644 index 00000000000..b4ba07a59e0 --- /dev/null +++ b/queue-5.15/net-smc-fix-loop-in-smc_listen.patch @@ -0,0 +1,49 @@ +From 829f99e197a17f464faee2b2564e3f327fe52a64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Nov 2021 13:32:38 +0100 +Subject: net/smc: Fix loop in smc_listen + +From: Guo DaXing + +[ Upstream commit 9ebb0c4b27a6158303b791b5b91e66d7665ee30e ] + +The kernel_listen function in smc_listen will fail when all the available +ports are occupied. At this point smc->clcsock->sk->sk_data_ready has +been changed to smc_clcsock_data_ready. When we call smc_listen again, +now both smc->clcsock->sk->sk_data_ready and smc->clcsk_data_ready point +to the smc_clcsock_data_ready function. + +The smc_clcsock_data_ready() function calls lsmc->clcsk_data_ready which +now points to itself resulting in an infinite loop. + +This patch restores smc->clcsock->sk->sk_data_ready with the old value. + +Fixes: a60a2b1e0af1 ("net/smc: reduce active tcp_listen workers") +Signed-off-by: Guo DaXing +Acked-by: Tony Lu +Signed-off-by: Karsten Graul +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/smc/af_smc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 32c1c7ce856d3..4f1fa1bcb0316 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -1918,8 +1918,10 @@ static int smc_listen(struct socket *sock, int backlog) + smc->clcsock->sk->sk_user_data = + (void *)((uintptr_t)smc | SK_USER_DATA_NOCOPY); + rc = kernel_listen(smc->clcsock, backlog); +- if (rc) ++ if (rc) { ++ smc->clcsock->sk->sk_data_ready = smc->clcsk_data_ready; + goto out; ++ } + sk->sk_max_ack_backlog = backlog; + sk->sk_ack_backlog = 0; + sk->sk_state = SMC_LISTEN; +-- +2.33.0 + diff --git a/queue-5.15/net-smc-fix-null-pointer-dereferencing-in-smc_vlan_b.patch b/queue-5.15/net-smc-fix-null-pointer-dereferencing-in-smc_vlan_b.patch new file mode 100644 index 00000000000..0e6e9aae508 --- /dev/null +++ b/queue-5.15/net-smc-fix-null-pointer-dereferencing-in-smc_vlan_b.patch @@ -0,0 +1,93 @@ +From f52bbacc999cd1d3d406959a5168b869723b5606 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Nov 2021 13:32:37 +0100 +Subject: net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk() + +From: Karsten Graul + +[ Upstream commit 587acad41f1bc48e16f42bb2aca63bf323380be8 ] + +Coverity reports a possible NULL dereferencing problem: + +in smc_vlan_by_tcpsk(): +6. returned_null: netdev_lower_get_next returns NULL (checked 29 out of 30 times). +7. var_assigned: Assigning: ndev = NULL return value from netdev_lower_get_next. +1623 ndev = (struct net_device *)netdev_lower_get_next(ndev, &lower); +CID 1468509 (#1 of 1): Dereference null return value (NULL_RETURNS) +8. dereference: Dereferencing a pointer that might be NULL ndev when calling is_vlan_dev. +1624 if (is_vlan_dev(ndev)) { + +Remove the manual implementation and use netdev_walk_all_lower_dev() to +iterate over the lower devices. While on it remove an obsolete function +parameter comment. + +Fixes: cb9d43f67754 ("net/smc: determine vlan_id of stacked net_device") +Suggested-by: Julian Wiedmann +Signed-off-by: Karsten Graul +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/smc/smc_core.c | 35 ++++++++++++++++++----------------- + 1 file changed, 18 insertions(+), 17 deletions(-) + +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index d672c0f0e247f..508a14fc4f587 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -1596,14 +1596,26 @@ static void smc_link_down_work(struct work_struct *work) + mutex_unlock(&lgr->llc_conf_mutex); + } + +-/* Determine vlan of internal TCP socket. +- * @vlan_id: address to store the determined vlan id into +- */ ++static int smc_vlan_by_tcpsk_walk(struct net_device *lower_dev, ++ struct netdev_nested_priv *priv) ++{ ++ unsigned short *vlan_id = (unsigned short *)priv->data; ++ ++ if (is_vlan_dev(lower_dev)) { ++ *vlan_id = vlan_dev_vlan_id(lower_dev); ++ return 1; ++ } ++ ++ return 0; ++} ++ ++/* Determine vlan of internal TCP socket. */ + int smc_vlan_by_tcpsk(struct socket *clcsock, struct smc_init_info *ini) + { + struct dst_entry *dst = sk_dst_get(clcsock->sk); ++ struct netdev_nested_priv priv; + struct net_device *ndev; +- int i, nest_lvl, rc = 0; ++ int rc = 0; + + ini->vlan_id = 0; + if (!dst) { +@@ -1621,20 +1633,9 @@ int smc_vlan_by_tcpsk(struct socket *clcsock, struct smc_init_info *ini) + goto out_rel; + } + ++ priv.data = (void *)&ini->vlan_id; + rtnl_lock(); +- nest_lvl = ndev->lower_level; +- for (i = 0; i < nest_lvl; i++) { +- struct list_head *lower = &ndev->adj_list.lower; +- +- if (list_empty(lower)) +- break; +- lower = lower->next; +- ndev = (struct net_device *)netdev_lower_get_next(ndev, &lower); +- if (is_vlan_dev(ndev)) { +- ini->vlan_id = vlan_dev_vlan_id(ndev); +- break; +- } +- } ++ netdev_walk_all_lower_dev(ndev, smc_vlan_by_tcpsk_walk, &priv); + rtnl_unlock(); + + out_rel: +-- +2.33.0 + diff --git a/queue-5.15/net-stmmac-disable-tx-queues-when-reconfiguring-the-.patch b/queue-5.15/net-stmmac-disable-tx-queues-when-reconfiguring-the-.patch new file mode 100644 index 00000000000..88642ed3bdf --- /dev/null +++ b/queue-5.15/net-stmmac-disable-tx-queues-when-reconfiguring-the-.patch @@ -0,0 +1,60 @@ +From 8a340b7a5a81f5884399fd47d4c06d510c4eacfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Nov 2021 16:47:31 +0100 +Subject: net: stmmac: Disable Tx queues when reconfiguring the interface + +From: Yannick Vignon + +[ Upstream commit b270bfe697367776eca2e6759a71d700fb8d82a2 ] + +The Tx queues were not disabled in situations where the driver needed to +stop the interface to apply a new configuration. This could result in a +kernel panic when doing any of the 3 following actions: +* reconfiguring the number of queues (ethtool -L) +* reconfiguring the size of the ring buffers (ethtool -G) +* installing/removing an XDP program (ip l set dev ethX xdp) + +Prevent the panic by making sure netif_tx_disable is called when stopping +an interface. + +Without this patch, the following kernel panic can be observed when doing +any of the actions above: + +Unable to handle kernel paging request at virtual address ffff80001238d040 +[....] + Call trace: + dwmac4_set_addr+0x8/0x10 + dev_hard_start_xmit+0xe4/0x1ac + sch_direct_xmit+0xe8/0x39c + __dev_queue_xmit+0x3ec/0xaf0 + dev_queue_xmit+0x14/0x20 +[...] +[ end trace 0000000000000002 ]--- + +Fixes: 5fabb01207a2d ("net: stmmac: Add initial XDP support") +Fixes: aa042f60e4961 ("net: stmmac: Add support to Ethtool get/set ring parameters") +Fixes: 0366f7e06a6be ("net: stmmac: add ethtool support for get/set channels") +Signed-off-by: Yannick Vignon +Link: https://lore.kernel.org/r/20211124154731.1676949-1-yannick.vignon@oss.nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index c18c05f78c208..1cf94248c2217 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -3794,6 +3794,8 @@ int stmmac_release(struct net_device *dev) + struct stmmac_priv *priv = netdev_priv(dev); + u32 chan; + ++ netif_tx_disable(dev); ++ + if (device_may_wakeup(priv->device)) + phylink_speed_down(priv->phylink, false); + /* Stop and disconnect the PHY */ +-- +2.33.0 + diff --git a/queue-5.15/net-stmmac-retain-ptp-clock-time-during-siocshwtstam.patch b/queue-5.15/net-stmmac-retain-ptp-clock-time-during-siocshwtstam.patch new file mode 100644 index 00000000000..e99e45f6210 --- /dev/null +++ b/queue-5.15/net-stmmac-retain-ptp-clock-time-during-siocshwtstam.patch @@ -0,0 +1,261 @@ +From e6efa2b9d598c26c82f4a6fbc447b37f9df99965 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Nov 2021 19:57:04 +0200 +Subject: net: stmmac: retain PTP clock time during SIOCSHWTSTAMP ioctls + +From: Holger Assmann + +[ Upstream commit a6da2bbb0005e6b4909472962c9d0af29e75dd06 ] + +Currently, when user space emits SIOCSHWTSTAMP ioctl calls such as +enabling/disabling timestamping or changing filter settings, the driver +reads the current CLOCK_REALTIME value and programming this into the +NIC's hardware clock. This might be necessary during system +initialization, but at runtime, when the PTP clock has already been +synchronized to a grandmaster, a reset of the timestamp settings might +result in a clock jump. Furthermore, if the clock is also controlled by +phc2sys in automatic mode (where the UTC offset is queried from ptp4l), +that UTC-to-TAI offset (currently 37 seconds in 2021) would be +temporarily reset to 0, and it would take a long time for phc2sys to +readjust so that CLOCK_REALTIME and the PHC are apart by 37 seconds +again. + +To address the issue, we introduce a new function called +stmmac_init_tstamp_counter(), which gets called during ndo_open(). +It contains the code snippet moved from stmmac_hwtstamp_set() that +manages the time synchronization. Besides, the sub second increment +configuration is also moved here since the related values are hardware +dependent and runtime invariant. + +Furthermore, the hardware clock must be kept running even when no time +stamping mode is selected in order to retain the synchronized time base. +That way, timestamping can be enabled again at any time only with the +need to compensate the clock's natural drifting. + +As a side effect, this patch fixes the issue that ptp_clock_info::enable +can be called before SIOCSHWTSTAMP and the driver (which looks at +priv->systime_flags) was not prepared to handle that ordering. + +Fixes: 92ba6888510c ("stmmac: add the support for PTP hw clock driver") +Reported-by: Michael Olbrich +Signed-off-by: Ahmad Fatoum +Signed-off-by: Holger Assmann +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac.h | 1 + + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 125 +++++++++++------- + .../ethernet/stmicro/stmmac/stmmac_platform.c | 2 +- + 3 files changed, 81 insertions(+), 47 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h +index 43eead726886a..5f129733aabd2 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h +@@ -314,6 +314,7 @@ int stmmac_mdio_reset(struct mii_bus *mii); + int stmmac_xpcs_setup(struct mii_bus *mii); + void stmmac_set_ethtool_ops(struct net_device *netdev); + ++int stmmac_init_tstamp_counter(struct stmmac_priv *priv, u32 systime_flags); + void stmmac_ptp_register(struct stmmac_priv *priv); + void stmmac_ptp_unregister(struct stmmac_priv *priv); + int stmmac_open(struct net_device *dev); +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 0ab20e2f984b9..c18c05f78c208 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -50,6 +50,13 @@ + #include "dwxgmac2.h" + #include "hwif.h" + ++/* As long as the interface is active, we keep the timestamping counter enabled ++ * with fine resolution and binary rollover. This avoid non-monotonic behavior ++ * (clock jumps) when changing timestamping settings at runtime. ++ */ ++#define STMMAC_HWTS_ACTIVE (PTP_TCR_TSENA | PTP_TCR_TSCFUPDT | \ ++ PTP_TCR_TSCTRLSSR) ++ + #define STMMAC_ALIGN(x) ALIGN(ALIGN(x, SMP_CACHE_BYTES), 16) + #define TSO_MAX_BUFF_SIZE (SZ_16K - 1) + +@@ -613,8 +620,6 @@ static int stmmac_hwtstamp_set(struct net_device *dev, struct ifreq *ifr) + { + struct stmmac_priv *priv = netdev_priv(dev); + struct hwtstamp_config config; +- struct timespec64 now; +- u64 temp = 0; + u32 ptp_v2 = 0; + u32 tstamp_all = 0; + u32 ptp_over_ipv4_udp = 0; +@@ -623,11 +628,6 @@ static int stmmac_hwtstamp_set(struct net_device *dev, struct ifreq *ifr) + u32 snap_type_sel = 0; + u32 ts_master_en = 0; + u32 ts_event_en = 0; +- u32 sec_inc = 0; +- u32 value = 0; +- bool xmac; +- +- xmac = priv->plat->has_gmac4 || priv->plat->has_xgmac; + + if (!(priv->dma_cap.time_stamp || priv->adv_ts)) { + netdev_alert(priv->dev, "No support for HW time stamping\n"); +@@ -789,42 +789,17 @@ static int stmmac_hwtstamp_set(struct net_device *dev, struct ifreq *ifr) + priv->hwts_rx_en = ((config.rx_filter == HWTSTAMP_FILTER_NONE) ? 0 : 1); + priv->hwts_tx_en = config.tx_type == HWTSTAMP_TX_ON; + +- if (!priv->hwts_tx_en && !priv->hwts_rx_en) +- stmmac_config_hw_tstamping(priv, priv->ptpaddr, 0); +- else { +- value = (PTP_TCR_TSENA | PTP_TCR_TSCFUPDT | PTP_TCR_TSCTRLSSR | +- tstamp_all | ptp_v2 | ptp_over_ethernet | +- ptp_over_ipv6_udp | ptp_over_ipv4_udp | ts_event_en | +- ts_master_en | snap_type_sel); +- stmmac_config_hw_tstamping(priv, priv->ptpaddr, value); +- +- /* program Sub Second Increment reg */ +- stmmac_config_sub_second_increment(priv, +- priv->ptpaddr, priv->plat->clk_ptp_rate, +- xmac, &sec_inc); +- temp = div_u64(1000000000ULL, sec_inc); +- +- /* Store sub second increment and flags for later use */ +- priv->sub_second_inc = sec_inc; +- priv->systime_flags = value; +- +- /* calculate default added value: +- * formula is : +- * addend = (2^32)/freq_div_ratio; +- * where, freq_div_ratio = 1e9ns/sec_inc +- */ +- temp = (u64)(temp << 32); +- priv->default_addend = div_u64(temp, priv->plat->clk_ptp_rate); +- stmmac_config_addend(priv, priv->ptpaddr, priv->default_addend); +- +- /* initialize system time */ +- ktime_get_real_ts64(&now); ++ priv->systime_flags = STMMAC_HWTS_ACTIVE; + +- /* lower 32 bits of tv_sec are safe until y2106 */ +- stmmac_init_systime(priv, priv->ptpaddr, +- (u32)now.tv_sec, now.tv_nsec); ++ if (priv->hwts_tx_en || priv->hwts_rx_en) { ++ priv->systime_flags |= tstamp_all | ptp_v2 | ++ ptp_over_ethernet | ptp_over_ipv6_udp | ++ ptp_over_ipv4_udp | ts_event_en | ++ ts_master_en | snap_type_sel; + } + ++ stmmac_config_hw_tstamping(priv, priv->ptpaddr, priv->systime_flags); ++ + memcpy(&priv->tstamp_config, &config, sizeof(config)); + + return copy_to_user(ifr->ifr_data, &config, +@@ -852,6 +827,66 @@ static int stmmac_hwtstamp_get(struct net_device *dev, struct ifreq *ifr) + sizeof(*config)) ? -EFAULT : 0; + } + ++/** ++ * stmmac_init_tstamp_counter - init hardware timestamping counter ++ * @priv: driver private structure ++ * @systime_flags: timestamping flags ++ * Description: ++ * Initialize hardware counter for packet timestamping. ++ * This is valid as long as the interface is open and not suspended. ++ * Will be rerun after resuming from suspend, case in which the timestamping ++ * flags updated by stmmac_hwtstamp_set() also need to be restored. ++ */ ++int stmmac_init_tstamp_counter(struct stmmac_priv *priv, u32 systime_flags) ++{ ++ bool xmac = priv->plat->has_gmac4 || priv->plat->has_xgmac; ++ struct timespec64 now; ++ u32 sec_inc = 0; ++ u64 temp = 0; ++ int ret; ++ ++ if (!(priv->dma_cap.time_stamp || priv->dma_cap.atime_stamp)) ++ return -EOPNOTSUPP; ++ ++ ret = clk_prepare_enable(priv->plat->clk_ptp_ref); ++ if (ret < 0) { ++ netdev_warn(priv->dev, ++ "failed to enable PTP reference clock: %pe\n", ++ ERR_PTR(ret)); ++ return ret; ++ } ++ ++ stmmac_config_hw_tstamping(priv, priv->ptpaddr, systime_flags); ++ priv->systime_flags = systime_flags; ++ ++ /* program Sub Second Increment reg */ ++ stmmac_config_sub_second_increment(priv, priv->ptpaddr, ++ priv->plat->clk_ptp_rate, ++ xmac, &sec_inc); ++ temp = div_u64(1000000000ULL, sec_inc); ++ ++ /* Store sub second increment for later use */ ++ priv->sub_second_inc = sec_inc; ++ ++ /* calculate default added value: ++ * formula is : ++ * addend = (2^32)/freq_div_ratio; ++ * where, freq_div_ratio = 1e9ns/sec_inc ++ */ ++ temp = (u64)(temp << 32); ++ priv->default_addend = div_u64(temp, priv->plat->clk_ptp_rate); ++ stmmac_config_addend(priv, priv->ptpaddr, priv->default_addend); ++ ++ /* initialize system time */ ++ ktime_get_real_ts64(&now); ++ ++ /* lower 32 bits of tv_sec are safe until y2106 */ ++ stmmac_init_systime(priv, priv->ptpaddr, (u32)now.tv_sec, now.tv_nsec); ++ ++ return 0; ++} ++EXPORT_SYMBOL_GPL(stmmac_init_tstamp_counter); ++ + /** + * stmmac_init_ptp - init PTP + * @priv: driver private structure +@@ -862,9 +897,11 @@ static int stmmac_hwtstamp_get(struct net_device *dev, struct ifreq *ifr) + static int stmmac_init_ptp(struct stmmac_priv *priv) + { + bool xmac = priv->plat->has_gmac4 || priv->plat->has_xgmac; ++ int ret; + +- if (!(priv->dma_cap.time_stamp || priv->dma_cap.atime_stamp)) +- return -EOPNOTSUPP; ++ ret = stmmac_init_tstamp_counter(priv, STMMAC_HWTS_ACTIVE); ++ if (ret) ++ return ret; + + priv->adv_ts = 0; + /* Check if adv_ts can be enabled for dwmac 4.x / xgmac core */ +@@ -3268,10 +3305,6 @@ static int stmmac_hw_setup(struct net_device *dev, bool init_ptp) + stmmac_mmc_setup(priv); + + if (init_ptp) { +- ret = clk_prepare_enable(priv->plat->clk_ptp_ref); +- if (ret < 0) +- netdev_warn(priv->dev, "failed to enable PTP reference clock: %d\n", ret); +- + ret = stmmac_init_ptp(priv); + if (ret == -EOPNOTSUPP) + netdev_warn(priv->dev, "PTP not supported by HW\n"); +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +index 232ac98943cd0..5d29f336315b7 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +@@ -816,7 +816,7 @@ static int __maybe_unused stmmac_pltfr_noirq_resume(struct device *dev) + if (ret) + return ret; + +- clk_prepare_enable(priv->plat->clk_ptp_ref); ++ stmmac_init_tstamp_counter(priv, priv->systime_flags); + } + + return 0; +-- +2.33.0 + diff --git a/queue-5.15/net-vlan-fix-underflow-for-the-real_dev-refcnt.patch b/queue-5.15/net-vlan-fix-underflow-for-the-real_dev-refcnt.patch new file mode 100644 index 00000000000..0041c1a21a7 --- /dev/null +++ b/queue-5.15/net-vlan-fix-underflow-for-the-real_dev-refcnt.patch @@ -0,0 +1,78 @@ +From 04248d72a402e09c09cb11b45cbdc9d63ccf57c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Nov 2021 09:59:42 +0800 +Subject: net: vlan: fix underflow for the real_dev refcnt + +From: Ziyang Xuan + +[ Upstream commit 01d9cc2dea3fde3bad6d27f464eff463496e2b00 ] + +Inject error before dev_hold(real_dev) in register_vlan_dev(), +and execute the following testcase: + +ip link add dev dummy1 type dummy +ip link add name dummy1.100 link dummy1 type vlan id 100 +ip link del dev dummy1 + +When the dummy netdevice is removed, we will get a WARNING as following: + +======================================================================= +refcount_t: decrement hit 0; leaking memory. +WARNING: CPU: 2 PID: 0 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0 + +and an endless loop of: + +======================================================================= +unregister_netdevice: waiting for dummy1 to become free. Usage count = -1073741824 + +That is because dev_put(real_dev) in vlan_dev_free() be called without +dev_hold(real_dev) in register_vlan_dev(). It makes the refcnt of real_dev +underflow. + +Move the dev_hold(real_dev) to vlan_dev_init() which is the call-back of +ndo_init(). That makes dev_hold() and dev_put() for vlan's real_dev +symmetrical. + +Fixes: 563bcbae3ba2 ("net: vlan: fix a UAF in vlan_dev_real_dev()") +Reported-by: Petr Machata +Suggested-by: Jakub Kicinski +Signed-off-by: Ziyang Xuan +Link: https://lore.kernel.org/r/20211126015942.2918542-1-william.xuanziyang@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/8021q/vlan.c | 3 --- + net/8021q/vlan_dev.c | 3 +++ + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c +index a3a0a5e994f5a..abaa5d96ded24 100644 +--- a/net/8021q/vlan.c ++++ b/net/8021q/vlan.c +@@ -184,9 +184,6 @@ int register_vlan_dev(struct net_device *dev, struct netlink_ext_ack *extack) + if (err) + goto out_unregister_netdev; + +- /* Account for reference in struct vlan_dev_priv */ +- dev_hold(real_dev); +- + vlan_stacked_transfer_operstate(real_dev, dev, vlan); + linkwatch_fire_event(dev); /* _MUST_ call rfc2863_policy() */ + +diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c +index aeeb5f90417b5..8602885c8a8e0 100644 +--- a/net/8021q/vlan_dev.c ++++ b/net/8021q/vlan_dev.c +@@ -615,6 +615,9 @@ static int vlan_dev_init(struct net_device *dev) + if (!vlan->vlan_pcpu_stats) + return -ENOMEM; + ++ /* Get vlan's reference to real_dev */ ++ dev_hold(real_dev); ++ + return 0; + } + +-- +2.33.0 + diff --git a/queue-5.15/netfilter-ctnetlink-do-not-erase-error-code-with-ein.patch b/queue-5.15/netfilter-ctnetlink-do-not-erase-error-code-with-ein.patch new file mode 100644 index 00000000000..1aa08453b97 --- /dev/null +++ b/queue-5.15/netfilter-ctnetlink-do-not-erase-error-code-with-ein.patch @@ -0,0 +1,38 @@ +From 270288e21fa713cd1f28d78f073b8552f6374c2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Nov 2021 23:21:55 +0100 +Subject: netfilter: ctnetlink: do not erase error code with EINVAL + +From: Florent Fourcot + +[ Upstream commit 77522ff02f333434612bd72df9b376f8d3836e4d ] + +And be consistent in error management for both orig/reply filtering + +Fixes: cb8aa9a3affb ("netfilter: ctnetlink: add kernel side filtering for dump") +Signed-off-by: Florent Fourcot +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_netlink.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 2663764d0b6ee..c7708bde057cb 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -1012,10 +1012,8 @@ ctnetlink_alloc_filter(const struct nlattr * const cda[], u8 family) + filter->family, + &filter->zone, + filter->reply_flags); +- if (err < 0) { +- err = -EINVAL; ++ if (err < 0) + goto err_filter; +- } + } + + return filter; +-- +2.33.0 + diff --git a/queue-5.15/netfilter-ctnetlink-fix-filtering-with-cta_tuple_rep.patch b/queue-5.15/netfilter-ctnetlink-fix-filtering-with-cta_tuple_rep.patch new file mode 100644 index 00000000000..a2232282707 --- /dev/null +++ b/queue-5.15/netfilter-ctnetlink-fix-filtering-with-cta_tuple_rep.patch @@ -0,0 +1,35 @@ +From 57f7649779f50a658e5df06eb0f2aeb1e7b28997 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Nov 2021 23:21:54 +0100 +Subject: netfilter: ctnetlink: fix filtering with CTA_TUPLE_REPLY + +From: Florent Fourcot + +[ Upstream commit ad81d4daf6a3f4769a346e635d5e1e967ca455d9 ] + +filter->orig_flags was used for a reply context. + +Fixes: cb8aa9a3affb ("netfilter: ctnetlink: add kernel side filtering for dump") +Signed-off-by: Florent Fourcot +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_netlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index f1e5443fe7c74..2663764d0b6ee 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -1011,7 +1011,7 @@ ctnetlink_alloc_filter(const struct nlattr * const cda[], u8 family) + CTA_TUPLE_REPLY, + filter->family, + &filter->zone, +- filter->orig_flags); ++ filter->reply_flags); + if (err < 0) { + err = -EINVAL; + goto err_filter; +-- +2.33.0 + diff --git a/queue-5.15/netfilter-flowtable-fix-ipv6-tunnel-addr-match.patch b/queue-5.15/netfilter-flowtable-fix-ipv6-tunnel-addr-match.patch new file mode 100644 index 00000000000..ff2b7cafc2d --- /dev/null +++ b/queue-5.15/netfilter-flowtable-fix-ipv6-tunnel-addr-match.patch @@ -0,0 +1,45 @@ +From 474a48f51402cb604552556191255ffc39af4962 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Nov 2021 18:28:21 -0700 +Subject: netfilter: flowtable: fix IPv6 tunnel addr match + +From: Will Mortensen + +[ Upstream commit 39f6eed4cb209643f3f8633291854ed7375d7264 ] + +Previously the IPv6 addresses in the key were clobbered and the mask was +left unset. + +I haven't tested this; I noticed it while skimming the code to +understand an unrelated issue. + +Fixes: cfab6dbd0ecf ("netfilter: flowtable: add tunnel match offload support") +Cc: wenxu +Signed-off-by: Will Mortensen +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_flow_table_offload.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c +index d6bf1b2cd541b..b561e0a44a45f 100644 +--- a/net/netfilter/nf_flow_table_offload.c ++++ b/net/netfilter/nf_flow_table_offload.c +@@ -65,11 +65,11 @@ static void nf_flow_rule_lwt_match(struct nf_flow_match *match, + sizeof(struct in6_addr)); + if (memcmp(&key->enc_ipv6.src, &in6addr_any, + sizeof(struct in6_addr))) +- memset(&key->enc_ipv6.src, 0xff, ++ memset(&mask->enc_ipv6.src, 0xff, + sizeof(struct in6_addr)); + if (memcmp(&key->enc_ipv6.dst, &in6addr_any, + sizeof(struct in6_addr))) +- memset(&key->enc_ipv6.dst, 0xff, ++ memset(&mask->enc_ipv6.dst, 0xff, + sizeof(struct in6_addr)); + enc_keys |= BIT(FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS); + key->enc_control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS; +-- +2.33.0 + diff --git a/queue-5.15/netfilter-ipvs-fix-reuse-connection-if-rs-weight-is-.patch b/queue-5.15/netfilter-ipvs-fix-reuse-connection-if-rs-weight-is-.patch new file mode 100644 index 00000000000..2b663434f95 --- /dev/null +++ b/queue-5.15/netfilter-ipvs-fix-reuse-connection-if-rs-weight-is-.patch @@ -0,0 +1,78 @@ +From 7fc97ba11a7d440450fae821caa172ad9bab9237 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Nov 2021 03:10:29 +0100 +Subject: netfilter: ipvs: Fix reuse connection if RS weight is 0 + +From: yangxingwu + +[ Upstream commit c95c07836fa4c1767ed11d8eca0769c652760e32 ] + +We are changing expire_nodest_conn to work even for reused connections when +conn_reuse_mode=0, just as what was done with commit dc7b3eb900aa ("ipvs: +Fix reuse connection if real server is dead"). + +For controlled and persistent connections, the new connection will get the +needed real server depending on the rules in ip_vs_check_template(). + +Fixes: d752c3645717 ("ipvs: allow rescheduling of new connections when port reuse is detected") +Co-developed-by: Chuanqi Liu +Signed-off-by: Chuanqi Liu +Signed-off-by: yangxingwu +Acked-by: Simon Horman +Acked-by: Julian Anastasov +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + Documentation/networking/ipvs-sysctl.rst | 3 +-- + net/netfilter/ipvs/ip_vs_core.c | 8 ++++---- + 2 files changed, 5 insertions(+), 6 deletions(-) + +diff --git a/Documentation/networking/ipvs-sysctl.rst b/Documentation/networking/ipvs-sysctl.rst +index 2afccc63856ee..1cfbf1add2fc9 100644 +--- a/Documentation/networking/ipvs-sysctl.rst ++++ b/Documentation/networking/ipvs-sysctl.rst +@@ -37,8 +37,7 @@ conn_reuse_mode - INTEGER + + 0: disable any special handling on port reuse. The new + connection will be delivered to the same real server that was +- servicing the previous connection. This will effectively +- disable expire_nodest_conn. ++ servicing the previous connection. + + bit 1: enable rescheduling of new connections when it is safe. + That is, whenever expire_nodest_conn and for TCP sockets, when +diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c +index 128690c512dff..393058a43aa73 100644 +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -1964,7 +1964,6 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int + struct ip_vs_proto_data *pd; + struct ip_vs_conn *cp; + int ret, pkts; +- int conn_reuse_mode; + struct sock *sk; + + /* Already marked as IPVS request or reply? */ +@@ -2041,15 +2040,16 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int + cp = INDIRECT_CALL_1(pp->conn_in_get, ip_vs_conn_in_get_proto, + ipvs, af, skb, &iph); + +- conn_reuse_mode = sysctl_conn_reuse_mode(ipvs); +- if (conn_reuse_mode && !iph.fragoffs && is_new_conn(skb, &iph) && cp) { ++ if (!iph.fragoffs && is_new_conn(skb, &iph) && cp) { ++ int conn_reuse_mode = sysctl_conn_reuse_mode(ipvs); + bool old_ct = false, resched = false; + + if (unlikely(sysctl_expire_nodest_conn(ipvs)) && cp->dest && + unlikely(!atomic_read(&cp->dest->weight))) { + resched = true; + old_ct = ip_vs_conn_uses_old_conntrack(cp, skb); +- } else if (is_new_conn_expected(cp, conn_reuse_mode)) { ++ } else if (conn_reuse_mode && ++ is_new_conn_expected(cp, conn_reuse_mode)) { + old_ct = ip_vs_conn_uses_old_conntrack(cp, skb); + if (!atomic_read(&cp->n_control)) { + resched = true; +-- +2.33.0 + diff --git a/queue-5.15/nfp-checking-parameter-process-for-rx-usecs-tx-usecs.patch b/queue-5.15/nfp-checking-parameter-process-for-rx-usecs-tx-usecs.patch new file mode 100644 index 00000000000..3b1554ded48 --- /dev/null +++ b/queue-5.15/nfp-checking-parameter-process-for-rx-usecs-tx-usecs.patch @@ -0,0 +1,64 @@ +From 9c4d4f6126d028f8c3018497a4605a795d01c9bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Nov 2021 14:38:03 +0100 +Subject: nfp: checking parameter process for rx-usecs/tx-usecs is invalid + +From: Diana Wang + +[ Upstream commit 3bd6b2a838ba6a3b86d41b077f570b1b61174def ] + +Use nn->tlv_caps.me_freq_mhz instead of nn->me_freq_mhz to check whether +rx-usecs/tx-usecs is valid. + +This is because nn->tlv_caps.me_freq_mhz represents the clock_freq (MHz) of +the flow processing cores (FPC) on the NIC. While nn->me_freq_mhz is not +be set. + +Fixes: ce991ab6662a ("nfp: read ME frequency from vNIC ctrl memory") +Signed-off-by: Diana Wang +Signed-off-by: Simon Horman +Reviewed-by: Jakub Kicinski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/netronome/nfp/nfp_net.h | 3 --- + drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +- + 2 files changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net.h b/drivers/net/ethernet/netronome/nfp/nfp_net.h +index df203738511bf..0b1865e9f0b59 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net.h ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net.h +@@ -565,7 +565,6 @@ struct nfp_net_dp { + * @exn_name: Name for Exception interrupt + * @shared_handler: Handler for shared interrupts + * @shared_name: Name for shared interrupt +- * @me_freq_mhz: ME clock_freq (MHz) + * @reconfig_lock: Protects @reconfig_posted, @reconfig_timer_active, + * @reconfig_sync_present and HW reconfiguration request + * regs/machinery from async requests (sync must take +@@ -650,8 +649,6 @@ struct nfp_net { + irq_handler_t shared_handler; + char shared_name[IFNAMSIZ + 8]; + +- u32 me_freq_mhz; +- + bool link_up; + spinlock_t link_status_lock; + +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +index 0685ece1f155d..be1a358baadb9 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +@@ -1343,7 +1343,7 @@ static int nfp_net_set_coalesce(struct net_device *netdev, + * ME timestamp ticks. There are 16 ME clock cycles for each timestamp + * count. + */ +- factor = nn->me_freq_mhz / 16; ++ factor = nn->tlv_caps.me_freq_mhz / 16; + + /* Each pair of (usecs, max_frames) fields specifies that interrupts + * should be coalesced until +-- +2.33.0 + diff --git a/queue-5.15/nfsv42-don-t-fail-clone-unless-the-op_clone-operatio.patch b/queue-5.15/nfsv42-don-t-fail-clone-unless-the-op_clone-operatio.patch new file mode 100644 index 00000000000..f1517006f31 --- /dev/null +++ b/queue-5.15/nfsv42-don-t-fail-clone-unless-the-op_clone-operatio.patch @@ -0,0 +1,38 @@ +From 00f88574ca649e28e14056f56fc27404b6732af2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 09:55:01 -0500 +Subject: NFSv42: Don't fail clone() unless the OP_CLONE operation failed + +From: Trond Myklebust + +[ Upstream commit d3c45824ad65aebf765fcf51366d317a29538820 ] + +The failure to retrieve post-op attributes has no bearing on whether or +not the clone operation itself was successful. We must therefore ignore +the return value of decode_getfattr() when looking at the success or +failure of nfs4_xdr_dec_clone(). + +Fixes: 36022770de6c ("nfs42: add CLONE xdr functions") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs42xdr.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c +index c8bad735e4c19..271e5f92ed019 100644 +--- a/fs/nfs/nfs42xdr.c ++++ b/fs/nfs/nfs42xdr.c +@@ -1434,8 +1434,7 @@ static int nfs4_xdr_dec_clone(struct rpc_rqst *rqstp, + status = decode_clone(xdr); + if (status) + goto out; +- status = decode_getfattr(xdr, res->dst_fattr, res->server); +- ++ decode_getfattr(xdr, res->dst_fattr, res->server); + out: + res->rpc_status = status; + return status; +-- +2.33.0 + diff --git a/queue-5.15/nvmet-tcp-fix-incomplete-data-digest-send.patch b/queue-5.15/nvmet-tcp-fix-incomplete-data-digest-send.patch new file mode 100644 index 00000000000..382529cfaa7 --- /dev/null +++ b/queue-5.15/nvmet-tcp-fix-incomplete-data-digest-send.patch @@ -0,0 +1,53 @@ +From 04027dd023bb4fc6a96066f96f9cfed37c42615c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Nov 2021 15:38:41 +0530 +Subject: nvmet-tcp: fix incomplete data digest send + +From: Varun Prakash + +[ Upstream commit 102110efdff6beedece6ab9b51664c32ac01e2db ] + +Current nvmet_try_send_ddgst() code does not check whether +all data digest bytes are transmitted, fix this by returning +-EAGAIN if all data digest bytes are not transmitted. + +Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") +Signed-off-by: Varun Prakash +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/tcp.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index 84c387e4bf431..2b8bab28417b8 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -700,10 +700,11 @@ static int nvmet_try_send_r2t(struct nvmet_tcp_cmd *cmd, bool last_in_batch) + static int nvmet_try_send_ddgst(struct nvmet_tcp_cmd *cmd, bool last_in_batch) + { + struct nvmet_tcp_queue *queue = cmd->queue; ++ int left = NVME_TCP_DIGEST_LENGTH - cmd->offset; + struct msghdr msg = { .msg_flags = MSG_DONTWAIT }; + struct kvec iov = { + .iov_base = (u8 *)&cmd->exp_ddgst + cmd->offset, +- .iov_len = NVME_TCP_DIGEST_LENGTH - cmd->offset ++ .iov_len = left + }; + int ret; + +@@ -717,6 +718,10 @@ static int nvmet_try_send_ddgst(struct nvmet_tcp_cmd *cmd, bool last_in_batch) + return ret; + + cmd->offset += ret; ++ left -= ret; ++ ++ if (left) ++ return -EAGAIN; + + if (queue->nvme_sq.sqhd_disabled) { + cmd->queue->snd_cmd = NULL; +-- +2.33.0 + diff --git a/queue-5.15/nvmet-use-iocb_nowait-only-if-the-filesystem-support.patch b/queue-5.15/nvmet-use-iocb_nowait-only-if-the-filesystem-support.patch new file mode 100644 index 00000000000..63f093b4bf5 --- /dev/null +++ b/queue-5.15/nvmet-use-iocb_nowait-only-if-the-filesystem-support.patch @@ -0,0 +1,46 @@ +From f65cda3ba8bc03d95130d79380dae0adfd0de00e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Nov 2021 11:08:27 +0100 +Subject: nvmet: use IOCB_NOWAIT only if the filesystem supports it + +From: Maurizio Lombardi + +[ Upstream commit c024b226a417c4eb9353ff500b1c823165d4d508 ] + +Submit I/O requests with the IOCB_NOWAIT flag set only if +the underlying filesystem supports it. + +Fixes: 50a909db36f2 ("nvmet: use IOCB_NOWAIT for file-ns buffered I/O") +Signed-off-by: Maurizio Lombardi +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/io-cmd-file.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c +index 1dd1a0fe2e819..df7e033dd2732 100644 +--- a/drivers/nvme/target/io-cmd-file.c ++++ b/drivers/nvme/target/io-cmd-file.c +@@ -8,6 +8,7 @@ + #include + #include + #include ++#include + #include "nvmet.h" + + #define NVMET_MAX_MPOOL_BVEC 16 +@@ -266,7 +267,8 @@ static void nvmet_file_execute_rw(struct nvmet_req *req) + + if (req->ns->buffered_io) { + if (likely(!req->f.mpool_alloc) && +- nvmet_file_execute_io(req, IOCB_NOWAIT)) ++ (req->ns->file->f_mode & FMODE_NOWAIT) && ++ nvmet_file_execute_io(req, IOCB_NOWAIT)) + return; + nvmet_file_submit_buffered_io(req); + } else +-- +2.33.0 + diff --git a/queue-5.15/pm-hibernate-use-correct-mode-for-swsusp_close.patch b/queue-5.15/pm-hibernate-use-correct-mode-for-swsusp_close.patch new file mode 100644 index 00000000000..31a96561a9f --- /dev/null +++ b/queue-5.15/pm-hibernate-use-correct-mode-for-swsusp_close.patch @@ -0,0 +1,62 @@ +From 81f1a46144e2dbc31bf70664ab4ecec77e6b0cf1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Nov 2021 20:18:43 +0100 +Subject: PM: hibernate: use correct mode for swsusp_close() + +From: Thomas Zeitlhofer + +[ Upstream commit cefcf24b4d351daf70ecd945324e200d3736821e ] + +Commit 39fbef4b0f77 ("PM: hibernate: Get block device exclusively in +swsusp_check()") changed the opening mode of the block device to +(FMODE_READ | FMODE_EXCL). + +In the corresponding calls to swsusp_close(), the mode is still just +FMODE_READ which triggers the warning in blkdev_flush_mapping() on +resume from hibernate. + +So, use the mode (FMODE_READ | FMODE_EXCL) also when closing the +device. + +Fixes: 39fbef4b0f77 ("PM: hibernate: Get block device exclusively in swsusp_check()") +Signed-off-by: Thomas Zeitlhofer +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + kernel/power/hibernate.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c +index 559acef3fddb8..b0888e9224da3 100644 +--- a/kernel/power/hibernate.c ++++ b/kernel/power/hibernate.c +@@ -691,7 +691,7 @@ static int load_image_and_restore(void) + goto Unlock; + + error = swsusp_read(&flags); +- swsusp_close(FMODE_READ); ++ swsusp_close(FMODE_READ | FMODE_EXCL); + if (!error) + error = hibernation_restore(flags & SF_PLATFORM_MODE); + +@@ -981,7 +981,7 @@ static int software_resume(void) + /* The snapshot device should not be opened while we're running */ + if (!hibernate_acquire()) { + error = -EBUSY; +- swsusp_close(FMODE_READ); ++ swsusp_close(FMODE_READ | FMODE_EXCL); + goto Unlock; + } + +@@ -1016,7 +1016,7 @@ static int software_resume(void) + pm_pr_dbg("Hibernation image not present or could not be loaded.\n"); + return error; + Close_Finish: +- swsusp_close(FMODE_READ); ++ swsusp_close(FMODE_READ | FMODE_EXCL); + goto Finish; + } + +-- +2.33.0 + diff --git a/queue-5.15/scsi-core-sysfs-fix-setting-device-state-to-sdev_run.patch b/queue-5.15/scsi-core-sysfs-fix-setting-device-state-to-sdev_run.patch new file mode 100644 index 00000000000..d8ededbcbd9 --- /dev/null +++ b/queue-5.15/scsi-core-sysfs-fix-setting-device-state-to-sdev_run.patch @@ -0,0 +1,41 @@ +From 9bb021906d9e861e0ff750746fd034dcbef35ca6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Nov 2021 10:49:17 -0600 +Subject: scsi: core: sysfs: Fix setting device state to SDEV_RUNNING + +From: Mike Christie + +[ Upstream commit eb97545d6264b341b06ba7603f52ff6c0b2af6ea ] + +This fixes an issue added in commit 4edd8cd4e86d ("scsi: core: sysfs: Fix +hang when device state is set via sysfs") where if userspace is requesting +to set the device state to SDEV_RUNNING when the state is already +SDEV_RUNNING, we return -EINVAL instead of count. The commmit above set ret +to count for this case, when it should have set it to 0. + +Link: https://lore.kernel.org/r/20211120164917.4924-1-michael.christie@oracle.com +Fixes: 4edd8cd4e86d ("scsi: core: sysfs: Fix hang when device state is set via sysfs") +Reviewed-by: Lee Duncan +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index 9527e734a999a..920aae661c5b2 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -817,7 +817,7 @@ store_state_field(struct device *dev, struct device_attribute *attr, + + mutex_lock(&sdev->state_mutex); + if (sdev->sdev_state == SDEV_RUNNING && state == SDEV_RUNNING) { +- ret = count; ++ ret = 0; + } else { + ret = scsi_device_set_state(sdev, state); + if (ret == 0 && state == SDEV_RUNNING) +-- +2.33.0 + diff --git a/queue-5.15/scsi-mpt3sas-fix-incorrect-system-timestamp.patch b/queue-5.15/scsi-mpt3sas-fix-incorrect-system-timestamp.patch new file mode 100644 index 00000000000..d9bc0551a2b --- /dev/null +++ b/queue-5.15/scsi-mpt3sas-fix-incorrect-system-timestamp.patch @@ -0,0 +1,42 @@ +From 15e084ef4d3b709d66c01792cc4d88a3ef9dad49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Nov 2021 18:02:15 +0530 +Subject: scsi: mpt3sas: Fix incorrect system timestamp + +From: Sreekanth Reddy + +[ Upstream commit 5ecae9f8c705fae85fe4d2ed9f1b9cddf91e88e9 ] + +For updating the IOC firmware's timestamp with system timestamp, the driver +issues the Mpi26IoUnitControlRequest message. While framing the +Mpi26IoUnitControlRequest, the driver should copy the lower 32 bits of the +current timestamp into IOCParameterValue field and the higher 32 bits into +Reserved7 field. + +Link: https://lore.kernel.org/r/20211117123215.25487-1-sreekanth.reddy@broadcom.com +Fixes: f98790c00375 ("scsi: mpt3sas: Sync time periodically between driver and firmware") +Signed-off-by: Sreekanth Reddy +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 27eb652b564f5..81dab9b82f79f 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -639,8 +639,8 @@ static void _base_sync_drv_fw_timestamp(struct MPT3SAS_ADAPTER *ioc) + mpi_request->IOCParameter = MPI26_SET_IOC_PARAMETER_SYNC_TIMESTAMP; + current_time = ktime_get_real(); + TimeStamp = ktime_to_ms(current_time); +- mpi_request->Reserved7 = cpu_to_le32(TimeStamp & 0xFFFFFFFF); +- mpi_request->IOCParameterValue = cpu_to_le32(TimeStamp >> 32); ++ mpi_request->Reserved7 = cpu_to_le32(TimeStamp >> 32); ++ mpi_request->IOCParameterValue = cpu_to_le32(TimeStamp & 0xFFFFFFFF); + init_completion(&ioc->scsih_cmds.done); + ioc->put_smid_default(ioc, smid); + dinitprintk(ioc, ioc_info(ioc, +-- +2.33.0 + diff --git a/queue-5.15/scsi-mpt3sas-fix-kernel-panic-during-drive-powercycl.patch b/queue-5.15/scsi-mpt3sas-fix-kernel-panic-during-drive-powercycl.patch new file mode 100644 index 00000000000..8a586851d47 --- /dev/null +++ b/queue-5.15/scsi-mpt3sas-fix-kernel-panic-during-drive-powercycl.patch @@ -0,0 +1,42 @@ +From 31aa517bb3b9e1facc01ffdfa2aea2575c5b4c13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Nov 2021 16:19:09 +0530 +Subject: scsi: mpt3sas: Fix kernel panic during drive powercycle test + +From: Sreekanth Reddy + +[ Upstream commit 0ee4ba13e09c9d9c1cb6abb59da8295d9952328b ] + +While looping over shost's sdev list it is possible that one +of the drives is getting removed and its sas_target object is +freed but its sdev object remains intact. + +Consequently, a kernel panic can occur while the driver is trying to access +the sas_address field of sas_target object without also checking the +sas_target object for NULL. + +Link: https://lore.kernel.org/r/20211117104909.2069-1-sreekanth.reddy@broadcom.com +Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") +Signed-off-by: Sreekanth Reddy +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +index ad1b6c2b37a74..1272b5ebea7ae 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -3869,7 +3869,7 @@ _scsih_ublock_io_device(struct MPT3SAS_ADAPTER *ioc, + + shost_for_each_device(sdev, ioc->shost) { + sas_device_priv_data = sdev->hostdata; +- if (!sas_device_priv_data) ++ if (!sas_device_priv_data || !sas_device_priv_data->sas_target) + continue; + if (sas_device_priv_data->sas_target->sas_address + != sas_address) +-- +2.33.0 + diff --git a/queue-5.15/scsi-mpt3sas-fix-system-going-into-read-only-mode.patch b/queue-5.15/scsi-mpt3sas-fix-system-going-into-read-only-mode.patch new file mode 100644 index 00000000000..0bdd018e625 --- /dev/null +++ b/queue-5.15/scsi-mpt3sas-fix-system-going-into-read-only-mode.patch @@ -0,0 +1,159 @@ +From 60dc8805178fff4648be0bc37a328de1be408a7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Nov 2021 16:20:58 +0530 +Subject: scsi: mpt3sas: Fix system going into read-only mode + +From: Sreekanth Reddy + +[ Upstream commit 91202a01a2fb2b78da3d03811b6d3d973ae426aa ] + +While determining the SAS address of a drive, the driver checks whether the +handle number is less than the HBA phy count or not. If the handle number +is less than the HBA phy count then driver assumes that this handle belongs +to HBA and hence it assigns the HBA SAS address. + +During IOC firmware downgrade operation, if the number of HBA phys is +reduced and the OS drive's device handle drops below the phy count while +determining the drive's SAS address, the driver ends up using the HBA's SAS +address. This leads to a mismatch of drive's SAS address and hence the +driver unregisters the OS drive and the system goes into read-only mode. + +Update the IOC's num_phys to the HBA phy count provided by actual loaded +firmware. + +Link: https://lore.kernel.org/r/20211117105058.3505-1-sreekanth.reddy@broadcom.com +Fixes: a5e99fda0172 ("scsi: mpt3sas: Update hba_port objects after host reset") +Signed-off-by: Sreekanth Reddy +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.h | 4 ++ + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 57 +++++++++++++++++++++++++++- + 2 files changed, 60 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h +index f87c0911f66ad..1b3a44ce65aae 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.h ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.h +@@ -142,6 +142,8 @@ + + #define MPT_MAX_CALLBACKS 32 + ++#define MPT_MAX_HBA_NUM_PHYS 32 ++ + #define INTERNAL_CMDS_COUNT 10 /* reserved cmds */ + /* reserved for issuing internally framed scsi io cmds */ + #define INTERNAL_SCSIIO_CMDS_COUNT 3 +@@ -798,6 +800,7 @@ struct _sas_phy { + * @enclosure_handle: handle for this a member of an enclosure + * @device_info: bitwise defining capabilities of this sas_host/expander + * @responding: used in _scsih_expander_device_mark_responding ++ * @nr_phys_allocated: Allocated memory for this many count phys + * @phy: a list of phys that make up this sas_host/expander + * @sas_port_list: list of ports attached to this sas_host/expander + * @port: hba port entry containing node's port number info +@@ -813,6 +816,7 @@ struct _sas_node { + u16 enclosure_handle; + u64 enclosure_logical_id; + u8 responding; ++ u8 nr_phys_allocated; + struct hba_port *port; + struct _sas_phy *phy; + struct list_head sas_port_list; +diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +index 1272b5ebea7ae..c1f900c6ea003 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -6406,11 +6406,26 @@ _scsih_sas_port_refresh(struct MPT3SAS_ADAPTER *ioc) + int i, j, count = 0, lcount = 0; + int ret; + u64 sas_addr; ++ u8 num_phys; + + drsprintk(ioc, ioc_info(ioc, + "updating ports for sas_host(0x%016llx)\n", + (unsigned long long)ioc->sas_hba.sas_address)); + ++ mpt3sas_config_get_number_hba_phys(ioc, &num_phys); ++ if (!num_phys) { ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); ++ return; ++ } ++ ++ if (num_phys > ioc->sas_hba.nr_phys_allocated) { ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); ++ return; ++ } ++ ioc->sas_hba.num_phys = num_phys; ++ + port_table = kcalloc(ioc->sas_hba.num_phys, + sizeof(struct hba_port), GFP_KERNEL); + if (!port_table) +@@ -6611,6 +6626,30 @@ _scsih_sas_host_refresh(struct MPT3SAS_ADAPTER *ioc) + ioc->sas_hba.phy[i].hba_vphy = 1; + } + ++ /* ++ * Add new HBA phys to STL if these new phys got added as part ++ * of HBA Firmware upgrade/downgrade operation. ++ */ ++ if (!ioc->sas_hba.phy[i].phy) { ++ if ((mpt3sas_config_get_phy_pg0(ioc, &mpi_reply, ++ &phy_pg0, i))) { ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); ++ continue; ++ } ++ ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & ++ MPI2_IOCSTATUS_MASK; ++ if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); ++ continue; ++ } ++ ioc->sas_hba.phy[i].phy_id = i; ++ mpt3sas_transport_add_host_phy(ioc, ++ &ioc->sas_hba.phy[i], phy_pg0, ++ ioc->sas_hba.parent_dev); ++ continue; ++ } + ioc->sas_hba.phy[i].handle = ioc->sas_hba.handle; + attached_handle = le16_to_cpu(sas_iounit_pg0->PhyData[i]. + AttachedDevHandle); +@@ -6622,6 +6661,19 @@ _scsih_sas_host_refresh(struct MPT3SAS_ADAPTER *ioc) + attached_handle, i, link_rate, + ioc->sas_hba.phy[i].port); + } ++ /* ++ * Clear the phy details if this phy got disabled as part of ++ * HBA Firmware upgrade/downgrade operation. ++ */ ++ for (i = ioc->sas_hba.num_phys; ++ i < ioc->sas_hba.nr_phys_allocated; i++) { ++ if (ioc->sas_hba.phy[i].phy && ++ ioc->sas_hba.phy[i].phy->negotiated_linkrate >= ++ SAS_LINK_RATE_1_5_GBPS) ++ mpt3sas_transport_update_links(ioc, ++ ioc->sas_hba.sas_address, 0, i, ++ MPI2_SAS_NEG_LINK_RATE_PHY_DISABLED, NULL); ++ } + out: + kfree(sas_iounit_pg0); + } +@@ -6654,7 +6706,10 @@ _scsih_sas_host_add(struct MPT3SAS_ADAPTER *ioc) + __FILE__, __LINE__, __func__); + return; + } +- ioc->sas_hba.phy = kcalloc(num_phys, ++ ++ ioc->sas_hba.nr_phys_allocated = max_t(u8, ++ MPT_MAX_HBA_NUM_PHYS, num_phys); ++ ioc->sas_hba.phy = kcalloc(ioc->sas_hba.nr_phys_allocated, + sizeof(struct _sas_phy), GFP_KERNEL); + if (!ioc->sas_hba.phy) { + ioc_err(ioc, "failure at %s:%d/%s()!\n", +-- +2.33.0 + diff --git a/queue-5.15/scsi-qla2xxx-edif-fix-off-by-one-bug-in-qla_edif_app.patch b/queue-5.15/scsi-qla2xxx-edif-fix-off-by-one-bug-in-qla_edif_app.patch new file mode 100644 index 00000000000..69abe8c9ef2 --- /dev/null +++ b/queue-5.15/scsi-qla2xxx-edif-fix-off-by-one-bug-in-qla_edif_app.patch @@ -0,0 +1,39 @@ +From 882a9381ba7b1eaa7fc58c028ed89506296e29f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Nov 2021 14:52:19 +0300 +Subject: scsi: qla2xxx: edif: Fix off by one bug in qla_edif_app_getfcinfo() + +From: Dan Carpenter + +[ Upstream commit e11e285b9cd132db21568b5d29c291f590841944 ] + +The > comparison needs to be >= to prevent accessing one element beyond the +end of the app_reply->ports[] array. + +Link: https://lore.kernel.org/r/20211109115219.GE16587@kili +Fixes: 7878f22a2e03 ("scsi: qla2xxx: edif: Add getfcinfo and statistic bsgs") +Reviewed-by: Ewan D. Milne +Reviewed-by: Himanshu Madhani +Signed-off-by: Dan Carpenter +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_edif.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c +index 9240e788b011d..a04693498dc01 100644 +--- a/drivers/scsi/qla2xxx/qla_edif.c ++++ b/drivers/scsi/qla2xxx/qla_edif.c +@@ -865,7 +865,7 @@ qla_edif_app_getfcinfo(scsi_qla_host_t *vha, struct bsg_job *bsg_job) + "APP request entry - portid=%06x.\n", tdid.b24); + + /* Ran out of space */ +- if (pcnt > app_req.num_ports) ++ if (pcnt >= app_req.num_ports) + break; + + if (tdid.b24 != 0 && tdid.b24 != fcport->d_id.b24) +-- +2.33.0 + diff --git a/queue-5.15/scsi-scsi_debug-zero-clear-zones-at-reset-write-poin.patch b/queue-5.15/scsi-scsi_debug-zero-clear-zones-at-reset-write-poin.patch new file mode 100644 index 00000000000..9a362756e28 --- /dev/null +++ b/queue-5.15/scsi-scsi_debug-zero-clear-zones-at-reset-write-poin.patch @@ -0,0 +1,54 @@ +From f20f5299fb35ed6f65e12fa15cb5bc99c0709261 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Nov 2021 15:12:23 +0900 +Subject: scsi: scsi_debug: Zero clear zones at reset write pointer + +From: Shin'ichiro Kawasaki + +[ Upstream commit 2d62253eb1b60f4ce8b39125eee282739b519297 ] + +When a reset is requested the position of the write pointer is updated but +the data in the corresponding zone is not cleared. Instead scsi_debug +returns any data written before the write pointer was reset. This is an +error and prevents using scsi_debug for stale page cache testing of the +BLKRESETZONE ioctl. + +Zero written data in the zone when resetting the write pointer. + +Link: https://lore.kernel.org/r/20211122061223.298890-1-shinichiro.kawasaki@wdc.com +Fixes: f0d1cf9378bd ("scsi: scsi_debug: Add ZBC zone commands") +Reviewed-by: Damien Le Moal +Acked-by: Douglas Gilbert +Signed-off-by: Shin'ichiro Kawasaki +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_debug.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c +index ead65cdfb522e..1b1a63a467816 100644 +--- a/drivers/scsi/scsi_debug.c ++++ b/drivers/scsi/scsi_debug.c +@@ -4649,6 +4649,7 @@ static void zbc_rwp_zone(struct sdebug_dev_info *devip, + struct sdeb_zone_state *zsp) + { + enum sdebug_z_cond zc; ++ struct sdeb_store_info *sip = devip2sip(devip, false); + + if (zbc_zone_is_conv(zsp)) + return; +@@ -4660,6 +4661,10 @@ static void zbc_rwp_zone(struct sdebug_dev_info *devip, + if (zsp->z_cond == ZC4_CLOSED) + devip->nr_closed--; + ++ if (zsp->z_wp > zsp->z_start) ++ memset(sip->storep + zsp->z_start * sdebug_sector_size, 0, ++ (zsp->z_wp - zsp->z_start) * sdebug_sector_size); ++ + zsp->z_non_seq_resource = false; + zsp->z_wp = zsp->z_start; + zsp->z_cond = ZC1_EMPTY; +-- +2.33.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 32f38ee0aca..b7b86f03c48 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -61,3 +61,94 @@ pci-aardvark-simplify-initialization-of-rootcap-on-virtual-bridge.patch pci-aardvark-fix-link-training.patch drm-amd-display-fix-oled-brightness-control-on-edp.patch proc-vmcore-fix-clearing-user-buffer-by-properly-using-clear_user.patch +asoc-sof-intel-hda-fix-hotplug-when-only-codec-is-su.patch +netfilter-ctnetlink-fix-filtering-with-cta_tuple_rep.patch +netfilter-ctnetlink-do-not-erase-error-code-with-ein.patch +netfilter-ipvs-fix-reuse-connection-if-rs-weight-is-.patch +netfilter-flowtable-fix-ipv6-tunnel-addr-match.patch +media-v4l2-core-fix-vidioc_dqevent-handling-on-non-x.patch +firmware-arm_scmi-fix-null-de-reference-on-error-pat.patch +arm-dts-bcm5301x-fix-i2c-controller-interrupt.patch +arm-dts-bcm5301x-add-interrupt-properties-to-gpio-no.patch +arm-dts-bcm2711-fix-pcie-interrupts.patch +asoc-qdsp6-q6routing-conditionally-reset-frontend-mi.patch +asoc-qdsp6-q6asm-fix-q6asm_dai_prepare-error-handlin.patch +asoc-topology-add-missing-rwsem-around-snd_ctl_remov.patch +asoc-codecs-wcd938x-fix-volatile-register-range.patch +asoc-codecs-wcd934x-return-error-code-correctly-from.patch +asoc-codecs-lpass-rx-macro-fix-hphr-setting-clsh-mas.patch +net-ieee802154-handle-iftypes-as-u32.patch +firmware-arm_scmi-fix-base-agent-discover-response.patch +firmware-arm_scmi-pm-propagate-return-value-to-calle.patch +asoc-stm32-i2s-fix-32-bits-channel-length-without-mc.patch +nfsv42-don-t-fail-clone-unless-the-op_clone-operatio.patch +arm-socfpga-fix-crash-with-config_fortiry_source.patch +drm-nouveau-acr-fix-a-couple-null-vs-is_err-checks.patch +scsi-qla2xxx-edif-fix-off-by-one-bug-in-qla_edif_app.patch +scsi-mpt3sas-fix-kernel-panic-during-drive-powercycl.patch +scsi-mpt3sas-fix-system-going-into-read-only-mode.patch +scsi-mpt3sas-fix-incorrect-system-timestamp.patch +drm-vc4-fix-error-code-in-vc4_create_object.patch +drm-aspeed-fix-vga_pw-sysfs-output.patch +net-marvell-prestera-fix-brige-port-operation.patch +net-marvell-prestera-fix-double-free-issue-on-err-pa.patch +hid-input-fix-parsing-of-hid_cp_consumer_control-fie.patch +hid-input-set-usage-type-to-key-on-keycode-remap.patch +hid-magicmouse-prevent-division-by-0-on-scroll.patch +iavf-prevent-changing-static-itr-values-if-adaptive-.patch +iavf-fix-refreshing-iavf-adapter-stats-on-ethtool-re.patch +iavf-fix-vlan-feature-flags-after-vfr.patch +x86-pvh-add-prototype-for-xen_pvh_init.patch +xen-pvh-add-missing-prototype-to-header.patch +alsa-intel-dsp-config-add-quirk-for-jsl-devices-base.patch +mptcp-fix-delack-timer.patch +mptcp-use-delegate-action-to-schedule-3rd-ack-retran.patch +af_unix-fix-regression-in-read-after-shutdown.patch +firmware-smccc-fix-check-for-arch_soc_id-not-impleme.patch +ipv6-fix-typos-in-__ip6_finish_output.patch +nfp-checking-parameter-process-for-rx-usecs-tx-usecs.patch +net-stmmac-retain-ptp-clock-time-during-siocshwtstam.patch +net-ipv6-add-fib6_nh_release_dsts-stub.patch +net-nexthop-release-ipv6-per-cpu-dsts-when-replacing.patch +ice-fix-vsi-txq_map-sizing.patch +ice-avoid-bpf_prog-refcount-underflow.patch +scsi-core-sysfs-fix-setting-device-state-to-sdev_run.patch +scsi-scsi_debug-zero-clear-zones-at-reset-write-poin.patch +erofs-fix-deadlock-when-shrink-erofs-slab.patch +i2c-virtio-disable-timeout-handling.patch +net-smc-ensure-the-active-closing-peer-first-closes-.patch +mlxsw-spectrum-protect-driver-from-buggy-firmware.patch +net-ipa-directly-disable-ipa-setup-ready-interrupt.patch +net-ipa-separate-disabling-setup-from-modem-stop.patch +net-ipa-kill-ipa_cmd_pipeline_clear.patch +net-marvell-mvpp2-increase-mtu-limit-when-xdp-enable.patch +cpufreq-intel_pstate-add-ice-lake-server-to-out-of-b.patch +nvmet-tcp-fix-incomplete-data-digest-send.patch +drm-hyperv-fix-device-removal-on-gen1-vms.patch +arm64-uaccess-avoid-blocking-within-critical-section.patch +net-ncsi-add-payload-to-be-32-bit-aligned-to-fix-dro.patch +pm-hibernate-use-correct-mode-for-swsusp_close.patch +drm-amd-display-fix-dpia-outbox-timeout-after-gpu-re.patch +drm-amd-display-set-plane-update-flags-for-all-plane.patch +tcp_cubic-fix-spurious-hystart-ack-train-detections-.patch +lan743x-fix-deadlock-in-lan743x_phy_link_status_chan.patch +net-phylink-force-link-down-and-retrigger-resolve-on.patch +net-phylink-force-retrigger-in-case-of-latched-link-.patch +net-smc-fix-null-pointer-dereferencing-in-smc_vlan_b.patch +net-smc-fix-loop-in-smc_listen.patch +nvmet-use-iocb_nowait-only-if-the-filesystem-support.patch +igb-fix-netpoll-exit-with-traffic.patch +mips-loongson64-fix-ftlb-configuration.patch +mips-use-3-level-pgtable-for-64kb-page-size-on-mips_.patch +tls-splice_read-fix-record-type-check.patch +tls-splice_read-fix-accessing-pre-processed-records.patch +tls-fix-replacing-proto_ops.patch +net-stmmac-disable-tx-queues-when-reconfiguring-the-.patch +net-sched-sch_ets-don-t-peek-at-classes-beyond-nband.patch +ethtool-ioctl-fix-potential-null-deref-in-ethtool_se.patch +net-vlan-fix-underflow-for-the-real_dev-refcnt.patch +net-smc-don-t-call-clcsock-shutdown-twice-when-smc-s.patch +net-hns3-fix-vf-rss-failed-problem-after-pf-enable-m.patch +net-hns3-fix-incorrect-components-info-of-ethtool-re.patch +net-mscc-ocelot-don-t-downgrade-timestamping-rx-filt.patch +net-mscc-ocelot-correctly-report-the-timestamping-rx.patch diff --git a/queue-5.15/tcp_cubic-fix-spurious-hystart-ack-train-detections-.patch b/queue-5.15/tcp_cubic-fix-spurious-hystart-ack-train-detections-.patch new file mode 100644 index 00000000000..7cd55f160f9 --- /dev/null +++ b/queue-5.15/tcp_cubic-fix-spurious-hystart-ack-train-detections-.patch @@ -0,0 +1,88 @@ +From 92fe64b366c1a3d811df66e1e425b84101532d81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Nov 2021 12:25:35 -0800 +Subject: tcp_cubic: fix spurious Hystart ACK train detections for + not-cwnd-limited flows + +From: Eric Dumazet + +[ Upstream commit 4e1fddc98d2585ddd4792b5e44433dcee7ece001 ] + +While testing BIG TCP patch series, I was expecting that TCP_RR workloads +with 80KB requests/answers would send one 80KB TSO packet, +then being received as a single GRO packet. + +It turns out this was not happening, and the root cause was that +cubic Hystart ACK train was triggering after a few (2 or 3) rounds of RPC. + +Hystart was wrongly setting CWND/SSTHRESH to 30, while my RPC +needed a budget of ~20 segments. + +Ideally these TCP_RR flows should not exit slow start. + +Cubic Hystart should reset itself at each round, instead of assuming +every TCP flow is a bulk one. + +Note that even after this patch, Hystart can still trigger, depending +on scheduling artifacts, but at a higher CWND/SSTHRESH threshold, +keeping optimal TSO packet sizes. + +Tested: + +ip link set dev eth0 gro_ipv6_max_size 131072 gso_ipv6_max_size 131072 +nstat -n; netperf -H ... -t TCP_RR -l 5 -- -r 80000,80000 -K cubic; nstat|egrep "Ip6InReceives|Hystart|Ip6OutRequests" + +Before: + + 8605 +Ip6InReceives 87541 0.0 +Ip6OutRequests 129496 0.0 +TcpExtTCPHystartTrainDetect 1 0.0 +TcpExtTCPHystartTrainCwnd 30 0.0 + +After: + + 8760 +Ip6InReceives 88514 0.0 +Ip6OutRequests 87975 0.0 + +Fixes: ae27e98a5152 ("[TCP] CUBIC v2.3") +Co-developed-by: Neal Cardwell +Signed-off-by: Neal Cardwell +Signed-off-by: Eric Dumazet +Cc: Stephen Hemminger +Cc: Yuchung Cheng +Cc: Soheil Hassas Yeganeh +Link: https://lore.kernel.org/r/20211123202535.1843771-1-eric.dumazet@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_cubic.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c +index 4a30deaa9a37f..8d2d4d652f6d4 100644 +--- a/net/ipv4/tcp_cubic.c ++++ b/net/ipv4/tcp_cubic.c +@@ -328,8 +328,6 @@ static void cubictcp_cong_avoid(struct sock *sk, u32 ack, u32 acked) + return; + + if (tcp_in_slow_start(tp)) { +- if (hystart && after(ack, ca->end_seq)) +- bictcp_hystart_reset(sk); + acked = tcp_slow_start(tp, acked); + if (!acked) + return; +@@ -389,6 +387,9 @@ static void hystart_update(struct sock *sk, u32 delay) + struct bictcp *ca = inet_csk_ca(sk); + u32 threshold; + ++ if (after(tp->snd_una, ca->end_seq)) ++ bictcp_hystart_reset(sk); ++ + if (hystart_detect & HYSTART_ACK_TRAIN) { + u32 now = bictcp_clock_us(sk); + +-- +2.33.0 + diff --git a/queue-5.15/tls-fix-replacing-proto_ops.patch b/queue-5.15/tls-fix-replacing-proto_ops.patch new file mode 100644 index 00000000000..628a848d550 --- /dev/null +++ b/queue-5.15/tls-fix-replacing-proto_ops.patch @@ -0,0 +1,132 @@ +From 41e7b0f56f5d162b46485dee5c1f2ff1d32746ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Nov 2021 15:25:56 -0800 +Subject: tls: fix replacing proto_ops + +From: Jakub Kicinski + +[ Upstream commit f3911f73f51d1534f4db70b516cc1fcb6be05bae ] + +We replace proto_ops whenever TLS is configured for RX. But our +replacement also overrides sendpage_locked, which will crash +unless TX is also configured. Similarly we plug both of those +in for TLS_HW (NIC crypto offload) even tho TLS_HW has a completely +different implementation for TX. + +Last but not least we always plug in something based on inet_stream_ops +even though a few of the callbacks differ for IPv6 (getname, release, +bind). + +Use a callback building method similar to what we do for struct proto. + +Fixes: c46234ebb4d1 ("tls: RX path for ktls") +Fixes: d4ffb02dee2f ("net/tls: enable sk_msg redirect to tls socket egress") +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_main.c | 47 +++++++++++++++++++++++++++++++++++++++------- + 1 file changed, 40 insertions(+), 7 deletions(-) + +diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c +index 9ab81db8a6545..9aac9c60d786d 100644 +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -61,7 +61,7 @@ static DEFINE_MUTEX(tcpv6_prot_mutex); + static const struct proto *saved_tcpv4_prot; + static DEFINE_MUTEX(tcpv4_prot_mutex); + static struct proto tls_prots[TLS_NUM_PROTS][TLS_NUM_CONFIG][TLS_NUM_CONFIG]; +-static struct proto_ops tls_sw_proto_ops; ++static struct proto_ops tls_proto_ops[TLS_NUM_PROTS][TLS_NUM_CONFIG][TLS_NUM_CONFIG]; + static void build_protos(struct proto prot[TLS_NUM_CONFIG][TLS_NUM_CONFIG], + const struct proto *base); + +@@ -71,6 +71,8 @@ void update_sk_prot(struct sock *sk, struct tls_context *ctx) + + WRITE_ONCE(sk->sk_prot, + &tls_prots[ip_ver][ctx->tx_conf][ctx->rx_conf]); ++ WRITE_ONCE(sk->sk_socket->ops, ++ &tls_proto_ops[ip_ver][ctx->tx_conf][ctx->rx_conf]); + } + + int wait_on_pending_writer(struct sock *sk, long *timeo) +@@ -581,8 +583,6 @@ static int do_tls_setsockopt_conf(struct sock *sk, sockptr_t optval, + if (tx) { + ctx->sk_write_space = sk->sk_write_space; + sk->sk_write_space = tls_write_space; +- } else { +- sk->sk_socket->ops = &tls_sw_proto_ops; + } + goto out; + +@@ -640,6 +640,39 @@ struct tls_context *tls_ctx_create(struct sock *sk) + return ctx; + } + ++static void build_proto_ops(struct proto_ops ops[TLS_NUM_CONFIG][TLS_NUM_CONFIG], ++ const struct proto_ops *base) ++{ ++ ops[TLS_BASE][TLS_BASE] = *base; ++ ++ ops[TLS_SW ][TLS_BASE] = ops[TLS_BASE][TLS_BASE]; ++ ops[TLS_SW ][TLS_BASE].sendpage_locked = tls_sw_sendpage_locked; ++ ++ ops[TLS_BASE][TLS_SW ] = ops[TLS_BASE][TLS_BASE]; ++ ops[TLS_BASE][TLS_SW ].splice_read = tls_sw_splice_read; ++ ++ ops[TLS_SW ][TLS_SW ] = ops[TLS_SW ][TLS_BASE]; ++ ops[TLS_SW ][TLS_SW ].splice_read = tls_sw_splice_read; ++ ++#ifdef CONFIG_TLS_DEVICE ++ ops[TLS_HW ][TLS_BASE] = ops[TLS_BASE][TLS_BASE]; ++ ops[TLS_HW ][TLS_BASE].sendpage_locked = NULL; ++ ++ ops[TLS_HW ][TLS_SW ] = ops[TLS_BASE][TLS_SW ]; ++ ops[TLS_HW ][TLS_SW ].sendpage_locked = NULL; ++ ++ ops[TLS_BASE][TLS_HW ] = ops[TLS_BASE][TLS_SW ]; ++ ++ ops[TLS_SW ][TLS_HW ] = ops[TLS_SW ][TLS_SW ]; ++ ++ ops[TLS_HW ][TLS_HW ] = ops[TLS_HW ][TLS_SW ]; ++ ops[TLS_HW ][TLS_HW ].sendpage_locked = NULL; ++#endif ++#ifdef CONFIG_TLS_TOE ++ ops[TLS_HW_RECORD][TLS_HW_RECORD] = *base; ++#endif ++} ++ + static void tls_build_proto(struct sock *sk) + { + int ip_ver = sk->sk_family == AF_INET6 ? TLSV6 : TLSV4; +@@ -651,6 +684,8 @@ static void tls_build_proto(struct sock *sk) + mutex_lock(&tcpv6_prot_mutex); + if (likely(prot != saved_tcpv6_prot)) { + build_protos(tls_prots[TLSV6], prot); ++ build_proto_ops(tls_proto_ops[TLSV6], ++ sk->sk_socket->ops); + smp_store_release(&saved_tcpv6_prot, prot); + } + mutex_unlock(&tcpv6_prot_mutex); +@@ -661,6 +696,8 @@ static void tls_build_proto(struct sock *sk) + mutex_lock(&tcpv4_prot_mutex); + if (likely(prot != saved_tcpv4_prot)) { + build_protos(tls_prots[TLSV4], prot); ++ build_proto_ops(tls_proto_ops[TLSV4], ++ sk->sk_socket->ops); + smp_store_release(&saved_tcpv4_prot, prot); + } + mutex_unlock(&tcpv4_prot_mutex); +@@ -871,10 +908,6 @@ static int __init tls_register(void) + if (err) + return err; + +- tls_sw_proto_ops = inet_stream_ops; +- tls_sw_proto_ops.splice_read = tls_sw_splice_read; +- tls_sw_proto_ops.sendpage_locked = tls_sw_sendpage_locked; +- + tls_device_init(); + tcp_register_ulp(&tcp_tls_ulp_ops); + +-- +2.33.0 + diff --git a/queue-5.15/tls-splice_read-fix-accessing-pre-processed-records.patch b/queue-5.15/tls-splice_read-fix-accessing-pre-processed-records.patch new file mode 100644 index 00000000000..8c6f98b36b7 --- /dev/null +++ b/queue-5.15/tls-splice_read-fix-accessing-pre-processed-records.patch @@ -0,0 +1,84 @@ +From 571386ef3f369c6ac14866b837c1b3d9a602fb9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Nov 2021 15:25:54 -0800 +Subject: tls: splice_read: fix accessing pre-processed records + +From: Jakub Kicinski + +[ Upstream commit e062fe99cccd9ff9f232e593d163ecabd244fae8 ] + +recvmsg() will put peek()ed and partially read records onto the rx_list. +splice_read() needs to consult that list otherwise it may miss data. +Align with recvmsg() and also put partially-read records onto rx_list. +tls_sw_advance_skb() is pretty pointless now and will be removed in +net-next. + +Fixes: 692d7b5d1f91 ("tls: Fix recvmsg() to be able to peek across multiple records") +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 33 +++++++++++++++++++++++++-------- + 1 file changed, 25 insertions(+), 8 deletions(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 1715e793c04ba..b0cdcea101806 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1993,6 +1993,7 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos, + struct sock *sk = sock->sk; + struct sk_buff *skb; + ssize_t copied = 0; ++ bool from_queue; + int err = 0; + long timeo; + int chunk; +@@ -2002,14 +2003,20 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos, + + timeo = sock_rcvtimeo(sk, flags & SPLICE_F_NONBLOCK); + +- skb = tls_wait_data(sk, NULL, flags & SPLICE_F_NONBLOCK, timeo, &err); +- if (!skb) +- goto splice_read_end; ++ from_queue = !skb_queue_empty(&ctx->rx_list); ++ if (from_queue) { ++ skb = __skb_dequeue(&ctx->rx_list); ++ } else { ++ skb = tls_wait_data(sk, NULL, flags & SPLICE_F_NONBLOCK, timeo, ++ &err); ++ if (!skb) ++ goto splice_read_end; + +- err = decrypt_skb_update(sk, skb, NULL, &chunk, &zc, false); +- if (err < 0) { +- tls_err_abort(sk, -EBADMSG); +- goto splice_read_end; ++ err = decrypt_skb_update(sk, skb, NULL, &chunk, &zc, false); ++ if (err < 0) { ++ tls_err_abort(sk, -EBADMSG); ++ goto splice_read_end; ++ } + } + + /* splice does not support reading control messages */ +@@ -2025,7 +2032,17 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos, + if (copied < 0) + goto splice_read_end; + +- tls_sw_advance_skb(sk, skb, copied); ++ if (!from_queue) { ++ ctx->recv_pkt = NULL; ++ __strp_unpause(&ctx->strp); ++ } ++ if (chunk < rxm->full_len) { ++ __skb_queue_head(&ctx->rx_list, skb); ++ rxm->offset += len; ++ rxm->full_len -= len; ++ } else { ++ consume_skb(skb); ++ } + + splice_read_end: + release_sock(sk); +-- +2.33.0 + diff --git a/queue-5.15/tls-splice_read-fix-record-type-check.patch b/queue-5.15/tls-splice_read-fix-record-type-check.patch new file mode 100644 index 00000000000..30416a71548 --- /dev/null +++ b/queue-5.15/tls-splice_read-fix-record-type-check.patch @@ -0,0 +1,68 @@ +From 276d176e3b25d706af2936be3af57a5e488d6fc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Nov 2021 15:25:52 -0800 +Subject: tls: splice_read: fix record type check + +From: Jakub Kicinski + +[ Upstream commit 520493f66f6822551aef2879cd40207074fe6980 ] + +We don't support splicing control records. TLS 1.3 changes moved +the record type check into the decrypt if(). The skb may already +be decrypted and still be an alert. + +Note that decrypt_skb_update() is idempotent and updates ctx->decrypted +so the if() is pointless. + +Reorder the check for decryption errors with the content type check +while touching them. This part is not really a bug, because if +decryption failed in TLS 1.3 content type will be DATA, and for +TLS 1.2 it will be correct. Nevertheless its strange to touch output +before checking if the function has failed. + +Fixes: fedf201e1296 ("net: tls: Refactor control message handling on recv") +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 23 ++++++++++------------- + 1 file changed, 10 insertions(+), 13 deletions(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 1b08b877a8900..1715e793c04ba 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -2006,21 +2006,18 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos, + if (!skb) + goto splice_read_end; + +- if (!ctx->decrypted) { +- err = decrypt_skb_update(sk, skb, NULL, &chunk, &zc, false); +- +- /* splice does not support reading control messages */ +- if (ctx->control != TLS_RECORD_TYPE_DATA) { +- err = -EINVAL; +- goto splice_read_end; +- } ++ err = decrypt_skb_update(sk, skb, NULL, &chunk, &zc, false); ++ if (err < 0) { ++ tls_err_abort(sk, -EBADMSG); ++ goto splice_read_end; ++ } + +- if (err < 0) { +- tls_err_abort(sk, -EBADMSG); +- goto splice_read_end; +- } +- ctx->decrypted = 1; ++ /* splice does not support reading control messages */ ++ if (ctx->control != TLS_RECORD_TYPE_DATA) { ++ err = -EINVAL; ++ goto splice_read_end; + } ++ + rxm = strp_msg(skb); + + chunk = min_t(unsigned int, rxm->full_len, len); +-- +2.33.0 + diff --git a/queue-5.15/x86-pvh-add-prototype-for-xen_pvh_init.patch b/queue-5.15/x86-pvh-add-prototype-for-xen_pvh_init.patch new file mode 100644 index 00000000000..3d274049934 --- /dev/null +++ b/queue-5.15/x86-pvh-add-prototype-for-xen_pvh_init.patch @@ -0,0 +1,37 @@ +From 9d99e339ca810133710074d21b846cf15071a193 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Oct 2021 08:19:50 +0200 +Subject: x86/pvh: add prototype for xen_pvh_init() + +From: Juergen Gross + +[ Upstream commit 767216796cb9ae7f1e3bdf43a7b13b2bf100c2d2 ] + +xen_pvh_init() is lacking a prototype in a header, add it. + +Reported-by: kernel test robot +Signed-off-by: Juergen Gross +Link: https://lore.kernel.org/r/20211006061950.9227-1-jgross@suse.com +Reviewed-by: Boris Ostrovsky +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/xen/hypervisor.h | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/x86/include/asm/xen/hypervisor.h b/arch/x86/include/asm/xen/hypervisor.h +index ff4b52e37e60d..4957f59deb40b 100644 +--- a/arch/x86/include/asm/xen/hypervisor.h ++++ b/arch/x86/include/asm/xen/hypervisor.h +@@ -62,4 +62,8 @@ void xen_arch_register_cpu(int num); + void xen_arch_unregister_cpu(int num); + #endif + ++#ifdef CONFIG_PVH ++void __init xen_pvh_init(struct boot_params *boot_params); ++#endif ++ + #endif /* _ASM_X86_XEN_HYPERVISOR_H */ +-- +2.33.0 + diff --git a/queue-5.15/xen-pvh-add-missing-prototype-to-header.patch b/queue-5.15/xen-pvh-add-missing-prototype-to-header.patch new file mode 100644 index 00000000000..1393b8f3bb2 --- /dev/null +++ b/queue-5.15/xen-pvh-add-missing-prototype-to-header.patch @@ -0,0 +1,38 @@ +From b09982c3ba94cb63796d2f6dcd7adfb797768fe9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Nov 2021 16:39:13 +0100 +Subject: xen/pvh: add missing prototype to header + +From: Juergen Gross + +[ Upstream commit 2a0991929aba0a3dd6fe51d1daba06a93a96a021 ] + +The prototype of mem_map_via_hcall() is missing in its header, so add +it. + +Reported-by: kernel test robot +Fixes: a43fb7da53007e67ad ("xen/pvh: Move Xen code for getting mem map via hcall out of common file") +Signed-off-by: Juergen Gross +Link: https://lore.kernel.org/r/20211119153913.21678-1-jgross@suse.com +Reviewed-by: Boris Ostrovsky +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/xen/hypervisor.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/include/asm/xen/hypervisor.h b/arch/x86/include/asm/xen/hypervisor.h +index 4957f59deb40b..5adab895127e1 100644 +--- a/arch/x86/include/asm/xen/hypervisor.h ++++ b/arch/x86/include/asm/xen/hypervisor.h +@@ -64,6 +64,7 @@ void xen_arch_unregister_cpu(int num); + + #ifdef CONFIG_PVH + void __init xen_pvh_init(struct boot_params *boot_params); ++void __init mem_map_via_hcall(struct boot_params *boot_params_p); + #endif + + #endif /* _ASM_X86_XEN_HYPERVISOR_H */ +-- +2.33.0 +