From: Greg Kroah-Hartman Date: Fri, 25 Feb 2022 16:16:37 +0000 (+0100) Subject: 5.16-stable patches X-Git-Tag: v4.9.304~44 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=29ea6b8e091baddcf5ebece93480a7032e751d88;p=thirdparty%2Fkernel%2Fstable-queue.git 5.16-stable patches added patches: block-clear-iocb-private-in-blkdev_bio_end_io_async.patch bnx2x-fix-driver-load-from-initrd.patch bnxt_en-fix-active-fec-reporting-to-ethtool.patch bnxt_en-fix-devlink-fw_activate.patch bnxt_en-fix-incorrect-multicast-rx-mask-setting-when-not-requested.patch bnxt_en-fix-occasional-ethtool-t-loopback-test-failures.patch bnxt_en-fix-offline-ethtool-selftest-with-rdma-enabled.patch bnxt_en-restore-the-resets_reliable-flag-in-bnxt_open.patch bpf-add-schedule-points-in-batch-ops.patch bpf-do-not-try-bpf_msg_push_data-with-len-0.patch bpf-fix-a-bpf_timer-initialization-issue.patch bpf-fix-crash-due-to-incorrect-copy_map_value.patch clk-qcom-gcc-msm8994-remove-noc-clocks.patch drm-amd-display-for-vblank_disable_immediate-check-psr-is-really-used.patch drm-edid-always-set-rgb444.patch drm-i915-dg2-print-phy-name-properly-on-calibration-error.patch drm-vc4-crtc-fix-runtime_pm-reference-counting.patch gpu-host1x-always-return-syncpoint-value-when-waiting.patch gso-do-not-skip-outer-ip-header-in-case-of-ipip-and-net_failover.patch hwmon-handle-failure-to-register-sensor-with-thermal-zone-correctly.patch ibmvnic-schedule-failover-only-if-vioctl-fails.patch ice-check-the-return-of-ice_ptp_gettimex64.patch ice-fix-concurrent-reset-and-removal-of-vfs.patch ice-fix-setting-l4-port-flag-when-adding-filter.patch ice-initialize-local-variable-tlv.patch io_uring-add-a-schedule-point-in-io_add_buffers.patch mptcp-add-mibs-counter-for-ignored-incoming-options.patch mptcp-fix-race-in-incoming-add_addr-option-processing.patch net-__pskb_pull_tail-pskb_carve_frag_list-drop_monitor-friends.patch net-dsa-avoid-call-to-__dev_set_promiscuity-while-rtnl_mutex-isn-t-held.patch net-force-inlining-of-checksum-functions-in-net-checksum.h.patch net-ll_temac-check-the-return-value-of-devm_kmalloc.patch net-mdio-ipq4019-add-delay-after-clock-enable.patch net-mlx5-dr-cache-ste-shadow-memory.patch net-mlx5-dr-don-t-allow-match-on-ip-w-o-matching-on-full-ethertype-ip_version.patch net-mlx5-dr-fix-slab-out-of-bounds-in-mlx5_cmd_dr_create_fte.patch net-mlx5-dr-fix-the-threshold-that-defines-when-pool-sync-is-initiated.patch net-mlx5-fix-possible-deadlock-on-rule-deletion.patch net-mlx5-fix-tc-max-supported-prio-for-nic-mode.patch net-mlx5-fix-wrong-limitation-of-metadata-match-on-ecpf.patch net-mlx5-update-log_max_qp-value-to-be-17-at-most.patch net-mlx5-update-the-list-of-the-pci-supported-devices.patch net-mlx5e-add-missing-increment-of-count.patch net-mlx5e-fix-wrong-return-value-on-ioctl-eeprom-query-failure.patch net-mlx5e-ktls-use-checksum_unnecessary-for-device-offloaded-packets.patch net-mlx5e-mplsoudp-decap-fix-check-for-unsupported-matches.patch net-mlx5e-tc-reject-rules-with-drop-and-modify-hdr-action.patch net-mlx5e-tc-reject-rules-with-forward-and-drop-actions.patch net-mv643xx_eth-process-retval-from-of_get_mac_address.patch net-sched-act_ct-fix-flow-table-lookup-after-ct-clear-or-switching-zones.patch net-smc-use-a-mutex-for-locking-struct-smc_pnettable.patch netfilter-nf_tables-fix-memory-leak-during-stateful-obj-update.patch netfilter-nf_tables-unregister-flowtable-hooks-on-netns-exit.patch nfp-flower-fix-a-potential-leak-in-nfp_tunnel_add_shared_mac.patch nvme-also-mark-passthrough-only-namespaces-ready-in-nvme_update_ns_info.patch openvswitch-fix-setting-ipv6-fields-causing-hw-csum-failure.patch perf-data-fix-double-free-in-perf_session__delete.patch perf-evlist-fix-failed-to-use-cpu-list-for-uncore-events.patch ping-remove-pr_err-from-ping_lookup.patch revert-i40e-fix-reset-bw-limit-when-dcb-enabled-with-1-tc.patch selftests-bpf-check-bpf_msg_push_data-return-value.patch selftests-mptcp-be-more-conservative-with-cookie-mpj-limits.patch selftests-mptcp-fix-diag-instability.patch surface-surface3_power-fix-battery-readings-on-batteries-without-a-serial-number.patch tipc-fix-end-of-loop-tests-for-list_for_each_entry.patch udp_tunnel-fix-end-of-loop-test-in-udp_tunnel_nic_unregister.patch --- diff --git a/queue-5.16/block-clear-iocb-private-in-blkdev_bio_end_io_async.patch b/queue-5.16/block-clear-iocb-private-in-blkdev_bio_end_io_async.patch new file mode 100644 index 00000000000..fb309d7ddbd --- /dev/null +++ b/queue-5.16/block-clear-iocb-private-in-blkdev_bio_end_io_async.patch @@ -0,0 +1,38 @@ +From bb49c6fa8b845591b317b0d7afea4ae60ec7f3aa Mon Sep 17 00:00:00 2001 +From: Stefano Garzarella +Date: Fri, 11 Feb 2022 10:01:36 +0100 +Subject: block: clear iocb->private in blkdev_bio_end_io_async() + +From: Stefano Garzarella + +commit bb49c6fa8b845591b317b0d7afea4ae60ec7f3aa upstream. + +iocb_bio_iopoll() expects iocb->private to be cleared before +releasing the bio. + +We already do this in blkdev_bio_end_io(), but we forgot in the +recently added blkdev_bio_end_io_async(). + +Fixes: 54a88eb838d3 ("block: add single bio async direct IO helper") +Cc: asml.silence@gmail.com +Signed-off-by: Stefano Garzarella +Reviewed-by: Ming Lei +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20220211090136.44471-1-sgarzare@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/fops.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/block/fops.c ++++ b/block/fops.c +@@ -289,6 +289,8 @@ static void blkdev_bio_end_io_async(stru + struct kiocb *iocb = dio->iocb; + ssize_t ret; + ++ WRITE_ONCE(iocb->private, NULL); ++ + if (likely(!bio->bi_status)) { + ret = dio->size; + iocb->ki_pos += ret; diff --git a/queue-5.16/bnx2x-fix-driver-load-from-initrd.patch b/queue-5.16/bnx2x-fix-driver-load-from-initrd.patch new file mode 100644 index 00000000000..b0150c69046 --- /dev/null +++ b/queue-5.16/bnx2x-fix-driver-load-from-initrd.patch @@ -0,0 +1,40 @@ +From e13ad1443684f7afaff24cf207e85e97885256bd Mon Sep 17 00:00:00 2001 +From: Manish Chopra +Date: Wed, 23 Feb 2022 00:57:20 -0800 +Subject: bnx2x: fix driver load from initrd + +From: Manish Chopra + +commit e13ad1443684f7afaff24cf207e85e97885256bd upstream. + +Commit b7a49f73059f ("bnx2x: Utilize firmware 7.13.21.0") added +new firmware support in the driver with maintaining older firmware +compatibility. However, older firmware was not added in MODULE_FIRMWARE() +which caused missing firmware files in initrd image leading to driver load +failure from initrd. This patch adds MODULE_FIRMWARE() for older firmware +version to have firmware files included in initrd. + +Fixes: b7a49f73059f ("bnx2x: Utilize firmware 7.13.21.0") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215627 +Signed-off-by: Manish Chopra +Signed-off-by: Alok Prasad +Signed-off-by: Ariel Elior +Link: https://lore.kernel.org/r/20220223085720.12021-1-manishc@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -100,6 +100,9 @@ MODULE_LICENSE("GPL"); + MODULE_FIRMWARE(FW_FILE_NAME_E1); + MODULE_FIRMWARE(FW_FILE_NAME_E1H); + MODULE_FIRMWARE(FW_FILE_NAME_E2); ++MODULE_FIRMWARE(FW_FILE_NAME_E1_V15); ++MODULE_FIRMWARE(FW_FILE_NAME_E1H_V15); ++MODULE_FIRMWARE(FW_FILE_NAME_E2_V15); + + int bnx2x_num_queues; + module_param_named(num_queues, bnx2x_num_queues, int, 0444); diff --git a/queue-5.16/bnxt_en-fix-active-fec-reporting-to-ethtool.patch b/queue-5.16/bnxt_en-fix-active-fec-reporting-to-ethtool.patch new file mode 100644 index 00000000000..a0221840b99 --- /dev/null +++ b/queue-5.16/bnxt_en-fix-active-fec-reporting-to-ethtool.patch @@ -0,0 +1,34 @@ +From 84d3c83e6ea7d46cf3de3a54578af73eb24a64f2 Mon Sep 17 00:00:00 2001 +From: Somnath Kotur +Date: Sun, 20 Feb 2022 04:05:47 -0500 +Subject: bnxt_en: Fix active FEC reporting to ethtool + +From: Somnath Kotur + +commit 84d3c83e6ea7d46cf3de3a54578af73eb24a64f2 upstream. + +ethtool --show-fec does not show anything when the Active +FEC setting in the chip is set to None. Fix it to properly return +ETHTOOL_FEC_OFF in that case. + +Fixes: 8b2775890ad8 ("bnxt_en: Report FEC settings to ethtool.") +Signed-off-by: Somnath Kotur +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -1944,6 +1944,9 @@ static int bnxt_get_fecparam(struct net_ + case PORT_PHY_QCFG_RESP_ACTIVE_FEC_FEC_RS272_IEEE_ACTIVE: + fec->active_fec |= ETHTOOL_FEC_LLRS; + break; ++ case PORT_PHY_QCFG_RESP_ACTIVE_FEC_FEC_NONE_ACTIVE: ++ fec->active_fec |= ETHTOOL_FEC_OFF; ++ break; + } + return 0; + } diff --git a/queue-5.16/bnxt_en-fix-devlink-fw_activate.patch b/queue-5.16/bnxt_en-fix-devlink-fw_activate.patch new file mode 100644 index 00000000000..5975cc67091 --- /dev/null +++ b/queue-5.16/bnxt_en-fix-devlink-fw_activate.patch @@ -0,0 +1,121 @@ +From 1278d17a1fb860e7eab4bc3ff4b026a87cbf5105 Mon Sep 17 00:00:00 2001 +From: Kalesh AP +Date: Sun, 20 Feb 2022 04:05:53 -0500 +Subject: bnxt_en: Fix devlink fw_activate + +From: Kalesh AP + +commit 1278d17a1fb860e7eab4bc3ff4b026a87cbf5105 upstream. + +To install a livepatch, first flash the package to NVM, and then +activate the patch through the "HWRM_FW_LIVEPATCH" fw command. +To uninstall a patch from NVM, flash the removal package and then +activate it through the "HWRM_FW_LIVEPATCH" fw command. + +The "HWRM_FW_LIVEPATCH" fw command has to consider following scenarios: + +1. no patch in NVM and no patch active. Do nothing. +2. patch in NVM, but not active. Activate the patch currently in NVM. +3. patch is not in NVM, but active. Deactivate the patch. +4. patch in NVM and the patch active. Do nothing. + +Fix the code to handle these scenarios during devlink "fw_activate". + +To install and activate a live patch: +devlink dev flash pci/0000:c1:00.0 file thor_patch.pkg +devlink -f dev reload pci/0000:c1:00.0 action fw_activate limit no_reset + +To remove and deactivate a live patch: +devlink dev flash pci/0000:c1:00.0 file thor_patch_rem.pkg +devlink -f dev reload pci/0000:c1:00.0 action fw_activate limit no_reset + +Fixes: 3c4153394e2c ("bnxt_en: implement firmware live patching") +Reviewed-by: Vikas Gupta +Reviewed-by: Somnath Kotur +Signed-off-by: Kalesh AP +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 39 +++++++++++++++++----- + 1 file changed, 31 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c +@@ -366,6 +366,16 @@ bnxt_dl_livepatch_report_err(struct bnxt + } + } + ++/* Live patch status in NVM */ ++#define BNXT_LIVEPATCH_NOT_INSTALLED 0 ++#define BNXT_LIVEPATCH_INSTALLED FW_LIVEPATCH_QUERY_RESP_STATUS_FLAGS_INSTALL ++#define BNXT_LIVEPATCH_REMOVED FW_LIVEPATCH_QUERY_RESP_STATUS_FLAGS_ACTIVE ++#define BNXT_LIVEPATCH_MASK (FW_LIVEPATCH_QUERY_RESP_STATUS_FLAGS_INSTALL | \ ++ FW_LIVEPATCH_QUERY_RESP_STATUS_FLAGS_ACTIVE) ++#define BNXT_LIVEPATCH_ACTIVATED BNXT_LIVEPATCH_MASK ++ ++#define BNXT_LIVEPATCH_STATE(flags) ((flags) & BNXT_LIVEPATCH_MASK) ++ + static int + bnxt_dl_livepatch_activate(struct bnxt *bp, struct netlink_ext_ack *extack) + { +@@ -373,8 +383,9 @@ bnxt_dl_livepatch_activate(struct bnxt * + struct hwrm_fw_livepatch_query_input *query_req; + struct hwrm_fw_livepatch_output *patch_resp; + struct hwrm_fw_livepatch_input *patch_req; ++ u16 flags, live_patch_state; ++ bool activated = false; + u32 installed = 0; +- u16 flags; + u8 target; + int rc; + +@@ -393,7 +404,6 @@ bnxt_dl_livepatch_activate(struct bnxt * + hwrm_req_drop(bp, query_req); + return rc; + } +- patch_req->opcode = FW_LIVEPATCH_REQ_OPCODE_ACTIVATE; + patch_req->loadtype = FW_LIVEPATCH_REQ_LOADTYPE_NVM_INSTALL; + patch_resp = hwrm_req_hold(bp, patch_req); + +@@ -406,12 +416,20 @@ bnxt_dl_livepatch_activate(struct bnxt * + } + + flags = le16_to_cpu(query_resp->status_flags); +- if (~flags & FW_LIVEPATCH_QUERY_RESP_STATUS_FLAGS_INSTALL) ++ live_patch_state = BNXT_LIVEPATCH_STATE(flags); ++ ++ if (live_patch_state == BNXT_LIVEPATCH_NOT_INSTALLED) + continue; +- if ((flags & FW_LIVEPATCH_QUERY_RESP_STATUS_FLAGS_ACTIVE) && +- !strncmp(query_resp->active_ver, query_resp->install_ver, +- sizeof(query_resp->active_ver))) ++ ++ if (live_patch_state == BNXT_LIVEPATCH_ACTIVATED) { ++ activated = true; + continue; ++ } ++ ++ if (live_patch_state == BNXT_LIVEPATCH_INSTALLED) ++ patch_req->opcode = FW_LIVEPATCH_REQ_OPCODE_ACTIVATE; ++ else if (live_patch_state == BNXT_LIVEPATCH_REMOVED) ++ patch_req->opcode = FW_LIVEPATCH_REQ_OPCODE_DEACTIVATE; + + patch_req->fw_target = target; + rc = hwrm_req_send(bp, patch_req); +@@ -423,8 +441,13 @@ bnxt_dl_livepatch_activate(struct bnxt * + } + + if (!rc && !installed) { +- NL_SET_ERR_MSG_MOD(extack, "No live patches found"); +- rc = -ENOENT; ++ if (activated) { ++ NL_SET_ERR_MSG_MOD(extack, "Live patch already activated"); ++ rc = -EEXIST; ++ } else { ++ NL_SET_ERR_MSG_MOD(extack, "No live patches found"); ++ rc = -ENOENT; ++ } + } + hwrm_req_drop(bp, query_req); + hwrm_req_drop(bp, patch_req); diff --git a/queue-5.16/bnxt_en-fix-incorrect-multicast-rx-mask-setting-when-not-requested.patch b/queue-5.16/bnxt_en-fix-incorrect-multicast-rx-mask-setting-when-not-requested.patch new file mode 100644 index 00000000000..45d08d8ac15 --- /dev/null +++ b/queue-5.16/bnxt_en-fix-incorrect-multicast-rx-mask-setting-when-not-requested.patch @@ -0,0 +1,68 @@ +From 8cdb15924252e27af16c4a8fe0fc606ce5fd04dc Mon Sep 17 00:00:00 2001 +From: Pavan Chebbi +Date: Sun, 20 Feb 2022 04:05:50 -0500 +Subject: bnxt_en: Fix incorrect multicast rx mask setting when not requested + +From: Pavan Chebbi + +commit 8cdb15924252e27af16c4a8fe0fc606ce5fd04dc upstream. + +We should setup multicast only when net_device flags explicitly +has IFF_MULTICAST set. Otherwise we will incorrectly turn it on +even when not asked. Fix it by only passing the multicast table +to the firmware if IFF_MULTICAST is set. + +Fixes: 7d2837dd7a32 ("bnxt_en: Setup multicast properly after resetting device.") +Signed-off-by: Pavan Chebbi +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -4719,8 +4719,10 @@ static int bnxt_hwrm_cfa_l2_set_rx_mask( + return rc; + + req->vnic_id = cpu_to_le32(vnic->fw_vnic_id); +- req->num_mc_entries = cpu_to_le32(vnic->mc_list_count); +- req->mc_tbl_addr = cpu_to_le64(vnic->mc_list_mapping); ++ if (vnic->rx_mask & CFA_L2_SET_RX_MASK_REQ_MASK_MCAST) { ++ req->num_mc_entries = cpu_to_le32(vnic->mc_list_count); ++ req->mc_tbl_addr = cpu_to_le64(vnic->mc_list_mapping); ++ } + req->mask = cpu_to_le32(vnic->rx_mask); + return hwrm_req_send_silent(bp, req); + } +@@ -8635,7 +8637,7 @@ static int bnxt_init_chip(struct bnxt *b + if (bp->dev->flags & IFF_ALLMULTI) { + vnic->rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST; + vnic->mc_list_count = 0; +- } else { ++ } else if (bp->dev->flags & IFF_MULTICAST) { + u32 mask = 0; + + bnxt_mc_list_updated(bp, &mask); +@@ -10759,7 +10761,7 @@ static void bnxt_set_rx_mode(struct net_ + if (dev->flags & IFF_ALLMULTI) { + mask |= CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST; + vnic->mc_list_count = 0; +- } else { ++ } else if (dev->flags & IFF_MULTICAST) { + mc_update = bnxt_mc_list_updated(bp, &mask); + } + +@@ -10827,9 +10829,10 @@ skip_uc: + !bnxt_promisc_ok(bp)) + vnic->rx_mask &= ~CFA_L2_SET_RX_MASK_REQ_MASK_PROMISCUOUS; + rc = bnxt_hwrm_cfa_l2_set_rx_mask(bp, 0); +- if (rc && vnic->mc_list_count) { ++ if (rc && (vnic->rx_mask & CFA_L2_SET_RX_MASK_REQ_MASK_MCAST)) { + netdev_info(bp->dev, "Failed setting MC filters rc: %d, turning on ALL_MCAST mode\n", + rc); ++ vnic->rx_mask &= ~CFA_L2_SET_RX_MASK_REQ_MASK_MCAST; + vnic->rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST; + vnic->mc_list_count = 0; + rc = bnxt_hwrm_cfa_l2_set_rx_mask(bp, 0); diff --git a/queue-5.16/bnxt_en-fix-occasional-ethtool-t-loopback-test-failures.patch b/queue-5.16/bnxt_en-fix-occasional-ethtool-t-loopback-test-failures.patch new file mode 100644 index 00000000000..c62c499c7d2 --- /dev/null +++ b/queue-5.16/bnxt_en-fix-occasional-ethtool-t-loopback-test-failures.patch @@ -0,0 +1,93 @@ +From cfcab3b3b61584a02bb523ffa99564eafa761dfe Mon Sep 17 00:00:00 2001 +From: Michael Chan +Date: Sun, 20 Feb 2022 04:05:49 -0500 +Subject: bnxt_en: Fix occasional ethtool -t loopback test failures + +From: Michael Chan + +commit cfcab3b3b61584a02bb523ffa99564eafa761dfe upstream. + +In the current code, we setup the port to PHY or MAC loopback mode +and then transmit a test broadcast packet for the loopback test. This +scheme fails sometime if the port is shared with management firmware +that can also send packets. The driver may receive the management +firmware's packet and the test will fail when the contents don't +match the test packet. + +Change the test packet to use it's own MAC address as the destination +and setup the port to only receive it's own MAC address. This should +filter out other packets sent by management firmware. + +Fixes: 91725d89b97a ("bnxt_en: Add PHY loopback to ethtool self-test.") +Reviewed-by: Pavan Chebbi +Reviewed-by: Edwin Peer +Reviewed-by: Andy Gospodarek +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 7 +++++++ + drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- + 3 files changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -8623,6 +8623,9 @@ static int bnxt_init_chip(struct bnxt *b + vnic->uc_filter_count = 1; + + vnic->rx_mask = 0; ++ if (test_bit(BNXT_STATE_HALF_OPEN, &bp->state)) ++ goto skip_rx_mask; ++ + if (bp->dev->flags & IFF_BROADCAST) + vnic->rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_BCAST; + +@@ -8643,6 +8646,7 @@ static int bnxt_init_chip(struct bnxt *b + if (rc) + goto err_out; + ++skip_rx_mask: + rc = bnxt_hwrm_set_coal(bp); + if (rc) + netdev_warn(bp->dev, "HWRM set coalescing failure rc: %x\n", +@@ -10315,8 +10319,10 @@ int bnxt_half_open_nic(struct bnxt *bp) + netdev_err(bp->dev, "bnxt_alloc_mem err: %x\n", rc); + goto half_open_err; + } ++ set_bit(BNXT_STATE_HALF_OPEN, &bp->state); + rc = bnxt_init_nic(bp, true); + if (rc) { ++ clear_bit(BNXT_STATE_HALF_OPEN, &bp->state); + netdev_err(bp->dev, "bnxt_init_nic err: %x\n", rc); + goto half_open_err; + } +@@ -10337,6 +10343,7 @@ void bnxt_half_close_nic(struct bnxt *bp + bnxt_hwrm_resource_free(bp, false, true); + bnxt_free_skbs(bp); + bnxt_free_mem(bp, true); ++ clear_bit(BNXT_STATE_HALF_OPEN, &bp->state); + } + + void bnxt_reenable_sriov(struct bnxt *bp) +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -1919,6 +1919,7 @@ struct bnxt { + #define BNXT_STATE_RECOVER 12 + #define BNXT_STATE_FW_NON_FATAL_COND 13 + #define BNXT_STATE_FW_ACTIVATE_RESET 14 ++#define BNXT_STATE_HALF_OPEN 15 /* For offline ethtool tests */ + + #define BNXT_NO_FW_ACCESS(bp) \ + (test_bit(BNXT_STATE_FW_FATAL_COND, &(bp)->state) || \ +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -3433,7 +3433,7 @@ static int bnxt_run_loopback(struct bnxt + if (!skb) + return -ENOMEM; + data = skb_put(skb, pkt_size); +- eth_broadcast_addr(data); ++ ether_addr_copy(&data[i], bp->dev->dev_addr); + i += ETH_ALEN; + ether_addr_copy(&data[i], bp->dev->dev_addr); + i += ETH_ALEN; diff --git a/queue-5.16/bnxt_en-fix-offline-ethtool-selftest-with-rdma-enabled.patch b/queue-5.16/bnxt_en-fix-offline-ethtool-selftest-with-rdma-enabled.patch new file mode 100644 index 00000000000..cc88cb47574 --- /dev/null +++ b/queue-5.16/bnxt_en-fix-offline-ethtool-selftest-with-rdma-enabled.patch @@ -0,0 +1,110 @@ +From 6758f937669dba14c6aac7ca004edda42ec1b18d Mon Sep 17 00:00:00 2001 +From: Michael Chan +Date: Sun, 20 Feb 2022 04:05:48 -0500 +Subject: bnxt_en: Fix offline ethtool selftest with RDMA enabled + +From: Michael Chan + +commit 6758f937669dba14c6aac7ca004edda42ec1b18d upstream. + +For offline (destructive) self tests, we need to stop the RDMA driver +first. Otherwise, the RDMA driver will run into unrecoverable errors +when destructive firmware tests are being performed. + +The irq_re_init parameter used in the half close and half open +sequence when preparing the NIC for offline tests should be set to +true because the RDMA driver will free all IRQs before the offline +tests begin. + +Fixes: 55fd0cf320c3 ("bnxt_en: Add external loopback test to ethtool selftest.") +Reviewed-by: Edwin Peer +Reviewed-by: Ben Li +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +++++----- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 12 +++++++++--- + 2 files changed, 14 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -10310,12 +10310,12 @@ int bnxt_half_open_nic(struct bnxt *bp) + goto half_open_err; + } + +- rc = bnxt_alloc_mem(bp, false); ++ rc = bnxt_alloc_mem(bp, true); + if (rc) { + netdev_err(bp->dev, "bnxt_alloc_mem err: %x\n", rc); + goto half_open_err; + } +- rc = bnxt_init_nic(bp, false); ++ rc = bnxt_init_nic(bp, true); + if (rc) { + netdev_err(bp->dev, "bnxt_init_nic err: %x\n", rc); + goto half_open_err; +@@ -10324,7 +10324,7 @@ int bnxt_half_open_nic(struct bnxt *bp) + + half_open_err: + bnxt_free_skbs(bp); +- bnxt_free_mem(bp, false); ++ bnxt_free_mem(bp, true); + dev_close(bp->dev); + return rc; + } +@@ -10334,9 +10334,9 @@ half_open_err: + */ + void bnxt_half_close_nic(struct bnxt *bp) + { +- bnxt_hwrm_resource_free(bp, false, false); ++ bnxt_hwrm_resource_free(bp, false, true); + bnxt_free_skbs(bp); +- bnxt_free_mem(bp, false); ++ bnxt_free_mem(bp, true); + } + + void bnxt_reenable_sriov(struct bnxt *bp) +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -25,6 +25,7 @@ + #include "bnxt_hsi.h" + #include "bnxt.h" + #include "bnxt_hwrm.h" ++#include "bnxt_ulp.h" + #include "bnxt_xdp.h" + #include "bnxt_ptp.h" + #include "bnxt_ethtool.h" +@@ -3526,9 +3527,12 @@ static void bnxt_self_test(struct net_de + if (!offline) { + bnxt_run_fw_tests(bp, test_mask, &test_results); + } else { +- rc = bnxt_close_nic(bp, false, false); +- if (rc) ++ bnxt_ulp_stop(bp); ++ rc = bnxt_close_nic(bp, true, false); ++ if (rc) { ++ bnxt_ulp_start(bp, rc); + return; ++ } + bnxt_run_fw_tests(bp, test_mask, &test_results); + + buf[BNXT_MACLPBK_TEST_IDX] = 1; +@@ -3538,6 +3542,7 @@ static void bnxt_self_test(struct net_de + if (rc) { + bnxt_hwrm_mac_loopback(bp, false); + etest->flags |= ETH_TEST_FL_FAILED; ++ bnxt_ulp_start(bp, rc); + return; + } + if (bnxt_run_loopback(bp)) +@@ -3563,7 +3568,8 @@ static void bnxt_self_test(struct net_de + } + bnxt_hwrm_phy_loopback(bp, false, false); + bnxt_half_close_nic(bp); +- rc = bnxt_open_nic(bp, false, true); ++ rc = bnxt_open_nic(bp, true, true); ++ bnxt_ulp_start(bp, rc); + } + if (rc || bnxt_test_irq(bp)) { + buf[BNXT_IRQ_TEST_IDX] = 1; diff --git a/queue-5.16/bnxt_en-restore-the-resets_reliable-flag-in-bnxt_open.patch b/queue-5.16/bnxt_en-restore-the-resets_reliable-flag-in-bnxt_open.patch new file mode 100644 index 00000000000..34e0346a57e --- /dev/null +++ b/queue-5.16/bnxt_en-restore-the-resets_reliable-flag-in-bnxt_open.patch @@ -0,0 +1,65 @@ +From 0e0e3c5358470cbad10bd7ca29f84a44d179d286 Mon Sep 17 00:00:00 2001 +From: Kalesh AP +Date: Sun, 20 Feb 2022 04:05:51 -0500 +Subject: bnxt_en: Restore the resets_reliable flag in bnxt_open() + +From: Kalesh AP + +commit 0e0e3c5358470cbad10bd7ca29f84a44d179d286 upstream. + +During ifdown, we call bnxt_inv_fw_health_reg() which will clear +both the status_reliable and resets_reliable flags if these +registers are mapped. This is correct because a FW reset during +ifdown will clear these register mappings. If we detect that FW +has gone through reset during the next ifup, we will remap these +registers. + +But during normal ifup with no FW reset, we need to restore the +resets_reliable flag otherwise we will not show the reset counter +during devlink diagnose. + +Fixes: 8cc95ceb7087 ("bnxt_en: improve fw diagnose devlink health messages") +Reviewed-by: Vikas Gupta +Reviewed-by: Pavan Chebbi +Reviewed-by: Somnath Kotur +Signed-off-by: Kalesh AP +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -7776,6 +7776,19 @@ static int bnxt_map_fw_health_regs(struc + return 0; + } + ++static void bnxt_remap_fw_health_regs(struct bnxt *bp) ++{ ++ if (!bp->fw_health) ++ return; ++ ++ if (bp->fw_cap & BNXT_FW_CAP_ERROR_RECOVERY) { ++ bp->fw_health->status_reliable = true; ++ bp->fw_health->resets_reliable = true; ++ } else { ++ bnxt_try_map_fw_health_reg(bp); ++ } ++} ++ + static int bnxt_hwrm_error_recovery_qcfg(struct bnxt *bp) + { + struct bnxt_fw_health *fw_health = bp->fw_health; +@@ -9836,8 +9849,8 @@ static int bnxt_hwrm_if_change(struct bn + resc_reinit = true; + if (flags & FUNC_DRV_IF_CHANGE_RESP_FLAGS_HOT_FW_RESET_DONE) + fw_reset = true; +- else if (bp->fw_health && !bp->fw_health->status_reliable) +- bnxt_try_map_fw_health_reg(bp); ++ else ++ bnxt_remap_fw_health_regs(bp); + + if (test_bit(BNXT_STATE_IN_FW_RESET, &bp->state) && !fw_reset) { + netdev_err(bp->dev, "RESET_DONE not set during FW reset.\n"); diff --git a/queue-5.16/bpf-add-schedule-points-in-batch-ops.patch b/queue-5.16/bpf-add-schedule-points-in-batch-ops.patch new file mode 100644 index 00000000000..d22f1c67de8 --- /dev/null +++ b/queue-5.16/bpf-add-schedule-points-in-batch-ops.patch @@ -0,0 +1,63 @@ +From 75134f16e7dd0007aa474b281935c5f42e79f2c8 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 17 Feb 2022 10:19:02 -0800 +Subject: bpf: Add schedule points in batch ops + +From: Eric Dumazet + +commit 75134f16e7dd0007aa474b281935c5f42e79f2c8 upstream. + +syzbot reported various soft lockups caused by bpf batch operations. + + INFO: task kworker/1:1:27 blocked for more than 140 seconds. + INFO: task hung in rcu_barrier + +Nothing prevents batch ops to process huge amount of data, +we need to add schedule points in them. + +Note that maybe_wait_bpf_programs(map) calls from +generic_map_delete_batch() can be factorized by moving +the call after the loop. + +This will be done later in -next tree once we get this fix merged, +unless there is strong opinion doing this optimization sooner. + +Fixes: aa2e93b8e58e ("bpf: Add generic support for update and delete batch ops") +Fixes: cb4d03ab499d ("bpf: Add generic support for lookup batch op") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Signed-off-by: Alexei Starovoitov +Reviewed-by: Stanislav Fomichev +Acked-by: Brian Vazquez +Link: https://lore.kernel.org/bpf/20220217181902.808742-1-eric.dumazet@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + kernel/bpf/syscall.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -1354,6 +1354,7 @@ int generic_map_delete_batch(struct bpf_ + maybe_wait_bpf_programs(map); + if (err) + break; ++ cond_resched(); + } + if (copy_to_user(&uattr->batch.count, &cp, sizeof(cp))) + err = -EFAULT; +@@ -1411,6 +1412,7 @@ int generic_map_update_batch(struct bpf_ + + if (err) + break; ++ cond_resched(); + } + + if (copy_to_user(&uattr->batch.count, &cp, sizeof(cp))) +@@ -1508,6 +1510,7 @@ int generic_map_lookup_batch(struct bpf_ + swap(prev_key, key); + retry = MAP_LOOKUP_RETRIES; + cp++; ++ cond_resched(); + } + + if (err == -EFAULT) diff --git a/queue-5.16/bpf-do-not-try-bpf_msg_push_data-with-len-0.patch b/queue-5.16/bpf-do-not-try-bpf_msg_push_data-with-len-0.patch new file mode 100644 index 00000000000..5b6c96ad2d4 --- /dev/null +++ b/queue-5.16/bpf-do-not-try-bpf_msg_push_data-with-len-0.patch @@ -0,0 +1,43 @@ +From 4a11678f683814df82fca9018d964771e02d7e6d Mon Sep 17 00:00:00 2001 +From: Felix Maurer +Date: Wed, 9 Feb 2022 16:55:26 +0100 +Subject: bpf: Do not try bpf_msg_push_data with len 0 + +From: Felix Maurer + +commit 4a11678f683814df82fca9018d964771e02d7e6d upstream. + +If bpf_msg_push_data() is called with len 0 (as it happens during +selftests/bpf/test_sockmap), we do not need to do anything and can +return early. + +Calling bpf_msg_push_data() with len 0 previously lead to a wrong ENOMEM +error: we later called get_order(copy + len); if len was 0, copy + len +was also often 0 and get_order() returned some undefined value (at the +moment 52). alloc_pages() caught that and failed, but then bpf_msg_push_data() +returned ENOMEM. This was wrong because we are most probably not out of +memory and actually do not need any additional memory. + +Fixes: 6fff607e2f14b ("bpf: sk_msg program helper bpf_msg_push_data") +Signed-off-by: Felix Maurer +Signed-off-by: Daniel Borkmann +Acked-by: Yonghong Song +Acked-by: John Fastabend +Link: https://lore.kernel.org/bpf/df69012695c7094ccb1943ca02b4920db3537466.1644421921.git.fmaurer@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + net/core/filter.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2711,6 +2711,9 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_ + if (unlikely(flags)) + return -EINVAL; + ++ if (unlikely(len == 0)) ++ return 0; ++ + /* First find the starting scatterlist element */ + i = msg->sg.start; + do { diff --git a/queue-5.16/bpf-fix-a-bpf_timer-initialization-issue.patch b/queue-5.16/bpf-fix-a-bpf_timer-initialization-issue.patch new file mode 100644 index 00000000000..2c1a35f1779 --- /dev/null +++ b/queue-5.16/bpf-fix-a-bpf_timer-initialization-issue.patch @@ -0,0 +1,113 @@ +From 5eaed6eedbe9612f642ad2b880f961d1c6c8ec2b Mon Sep 17 00:00:00 2001 +From: Yonghong Song +Date: Fri, 11 Feb 2022 11:49:53 -0800 +Subject: bpf: Fix a bpf_timer initialization issue +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yonghong Song + +commit 5eaed6eedbe9612f642ad2b880f961d1c6c8ec2b upstream. + +The patch in [1] intends to fix a bpf_timer related issue, +but the fix caused existing 'timer' selftest to fail with +hang or some random errors. After some debug, I found +an issue with check_and_init_map_value() in the hashtab.c. +More specifically, in hashtab.c, we have code + l_new = bpf_map_kmalloc_node(&htab->map, ...) + check_and_init_map_value(&htab->map, l_new...) +Note that bpf_map_kmalloc_node() does not do initialization +so l_new contains random value. + +The function check_and_init_map_value() intends to zero the +bpf_spin_lock and bpf_timer if they exist in the map. +But I found bpf_spin_lock is zero'ed but bpf_timer is not zero'ed. +With [1], later copy_map_value() skips copying of +bpf_spin_lock and bpf_timer. The non-zero bpf_timer caused +random failures for 'timer' selftest. +Without [1], for both bpf_spin_lock and bpf_timer case, +bpf_timer will be zero'ed, so 'timer' self test is okay. + +For check_and_init_map_value(), why bpf_spin_lock is zero'ed +properly while bpf_timer not. In bpf uapi header, we have + struct bpf_spin_lock { + __u32 val; + }; + struct bpf_timer { + __u64 :64; + __u64 :64; + } __attribute__((aligned(8))); + +The initialization code: + *(struct bpf_spin_lock *)(dst + map->spin_lock_off) = + (struct bpf_spin_lock){}; + *(struct bpf_timer *)(dst + map->timer_off) = + (struct bpf_timer){}; +It appears the compiler has no obligation to initialize anonymous fields. +For example, let us use clang with bpf target as below: + $ cat t.c + struct bpf_timer { + unsigned long long :64; + }; + struct bpf_timer2 { + unsigned long long a; + }; + + void test(struct bpf_timer *t) { + *t = (struct bpf_timer){}; + } + void test2(struct bpf_timer2 *t) { + *t = (struct bpf_timer2){}; + } + $ clang -target bpf -O2 -c -g t.c + $ llvm-objdump -d t.o + ... + 0000000000000000 : + 0: 95 00 00 00 00 00 00 00 exit + 0000000000000008 : + 1: b7 02 00 00 00 00 00 00 r2 = 0 + 2: 7b 21 00 00 00 00 00 00 *(u64 *)(r1 + 0) = r2 + 3: 95 00 00 00 00 00 00 00 exit + +gcc11.2 does not have the above issue. But from + INTERNATIONAL STANDARD ©ISO/IEC ISO/IEC 9899:201x + Programming languages — C + http://www.open-std.org/Jtc1/sc22/wg14/www/docs/n1547.pdf + page 157: + Except where explicitly stated otherwise, for the purposes of + this subclause unnamed members of objects of structure and union + type do not participate in initialization. Unnamed members of + structure objects have indeterminate value even after initialization. + +To fix the problem, let use memset for bpf_timer case in +check_and_init_map_value(). For consistency, memset is also +used for bpf_spin_lock case. + + [1] https://lore.kernel.org/bpf/20220209070324.1093182-2-memxor@gmail.com/ + +Fixes: 68134668c17f3 ("bpf: Add map side support for bpf timers.") +Signed-off-by: Yonghong Song +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20220211194953.3142152-1-yhs@fb.com +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/bpf.h | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -209,11 +209,9 @@ static inline bool map_value_has_timer(c + static inline void check_and_init_map_value(struct bpf_map *map, void *dst) + { + if (unlikely(map_value_has_spin_lock(map))) +- *(struct bpf_spin_lock *)(dst + map->spin_lock_off) = +- (struct bpf_spin_lock){}; ++ memset(dst + map->spin_lock_off, 0, sizeof(struct bpf_spin_lock)); + if (unlikely(map_value_has_timer(map))) +- *(struct bpf_timer *)(dst + map->timer_off) = +- (struct bpf_timer){}; ++ memset(dst + map->timer_off, 0, sizeof(struct bpf_timer)); + } + + /* copy everything but bpf_spin_lock and bpf_timer. There could be one of each. */ diff --git a/queue-5.16/bpf-fix-crash-due-to-incorrect-copy_map_value.patch b/queue-5.16/bpf-fix-crash-due-to-incorrect-copy_map_value.patch new file mode 100644 index 00000000000..82f6aa148bb --- /dev/null +++ b/queue-5.16/bpf-fix-crash-due-to-incorrect-copy_map_value.patch @@ -0,0 +1,84 @@ +From a8abb0c3dc1e28454851a00f8b7333d9695d566c Mon Sep 17 00:00:00 2001 +From: Kumar Kartikeya Dwivedi +Date: Wed, 9 Feb 2022 12:33:23 +0530 +Subject: bpf: Fix crash due to incorrect copy_map_value + +From: Kumar Kartikeya Dwivedi + +commit a8abb0c3dc1e28454851a00f8b7333d9695d566c upstream. + +When both bpf_spin_lock and bpf_timer are present in a BPF map value, +copy_map_value needs to skirt both objects when copying a value into and +out of the map. However, the current code does not set both s_off and +t_off in copy_map_value, which leads to a crash when e.g. bpf_spin_lock +is placed in map value with bpf_timer, as bpf_map_update_elem call will +be able to overwrite the other timer object. + +When the issue is not fixed, an overwriting can produce the following +splat: + +[root@(none) bpf]# ./test_progs -t timer_crash +[ 15.930339] bpf_testmod: loading out-of-tree module taints kernel. +[ 16.037849] ================================================================== +[ 16.038458] BUG: KASAN: user-memory-access in __pv_queued_spin_lock_slowpath+0x32b/0x520 +[ 16.038944] Write of size 8 at addr 0000000000043ec0 by task test_progs/325 +[ 16.039399] +[ 16.039514] CPU: 0 PID: 325 Comm: test_progs Tainted: G OE 5.16.0+ #278 +[ 16.039983] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ArchLinux 1.15.0-1 04/01/2014 +[ 16.040485] Call Trace: +[ 16.040645] +[ 16.040805] dump_stack_lvl+0x59/0x73 +[ 16.041069] ? __pv_queued_spin_lock_slowpath+0x32b/0x520 +[ 16.041427] kasan_report.cold+0x116/0x11b +[ 16.041673] ? __pv_queued_spin_lock_slowpath+0x32b/0x520 +[ 16.042040] __pv_queued_spin_lock_slowpath+0x32b/0x520 +[ 16.042328] ? memcpy+0x39/0x60 +[ 16.042552] ? pv_hash+0xd0/0xd0 +[ 16.042785] ? lockdep_hardirqs_off+0x95/0xd0 +[ 16.043079] __bpf_spin_lock_irqsave+0xdf/0xf0 +[ 16.043366] ? bpf_get_current_comm+0x50/0x50 +[ 16.043608] ? jhash+0x11a/0x270 +[ 16.043848] bpf_timer_cancel+0x34/0xe0 +[ 16.044119] bpf_prog_c4ea1c0f7449940d_sys_enter+0x7c/0x81 +[ 16.044500] bpf_trampoline_6442477838_0+0x36/0x1000 +[ 16.044836] __x64_sys_nanosleep+0x5/0x140 +[ 16.045119] do_syscall_64+0x59/0x80 +[ 16.045377] ? lock_is_held_type+0xe4/0x140 +[ 16.045670] ? irqentry_exit_to_user_mode+0xa/0x40 +[ 16.046001] ? mark_held_locks+0x24/0x90 +[ 16.046287] ? asm_exc_page_fault+0x1e/0x30 +[ 16.046569] ? asm_exc_page_fault+0x8/0x30 +[ 16.046851] ? lockdep_hardirqs_on+0x7e/0x100 +[ 16.047137] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ 16.047405] RIP: 0033:0x7f9e4831718d +[ 16.047602] Code: b4 0c 00 0f 05 eb a9 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d b3 6c 0c 00 f7 d8 64 89 01 48 +[ 16.048764] RSP: 002b:00007fff488086b8 EFLAGS: 00000206 ORIG_RAX: 0000000000000023 +[ 16.049275] RAX: ffffffffffffffda RBX: 00007f9e48683740 RCX: 00007f9e4831718d +[ 16.049747] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fff488086d0 +[ 16.050225] RBP: 00007fff488086f0 R08: 00007fff488085d7 R09: 00007f9e4cb594a0 +[ 16.050648] R10: 0000000000000000 R11: 0000000000000206 R12: 00007f9e484cde30 +[ 16.051124] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 +[ 16.051608] +[ 16.051762] ================================================================== + +Fixes: 68134668c17f ("bpf: Add map side support for bpf timers.") +Signed-off-by: Kumar Kartikeya Dwivedi +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20220209070324.1093182-2-memxor@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/bpf.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -224,7 +224,8 @@ static inline void copy_map_value(struct + if (unlikely(map_value_has_spin_lock(map))) { + s_off = map->spin_lock_off; + s_sz = sizeof(struct bpf_spin_lock); +- } else if (unlikely(map_value_has_timer(map))) { ++ } ++ if (unlikely(map_value_has_timer(map))) { + t_off = map->timer_off; + t_sz = sizeof(struct bpf_timer); + } diff --git a/queue-5.16/clk-qcom-gcc-msm8994-remove-noc-clocks.patch b/queue-5.16/clk-qcom-gcc-msm8994-remove-noc-clocks.patch new file mode 100644 index 00000000000..b6a3a752d96 --- /dev/null +++ b/queue-5.16/clk-qcom-gcc-msm8994-remove-noc-clocks.patch @@ -0,0 +1,327 @@ +From 3494894afff4ad11f25d8342cc99699be496d082 Mon Sep 17 00:00:00 2001 +From: Konrad Dybcio +Date: Fri, 18 Feb 2022 00:24:08 +0100 +Subject: clk: qcom: gcc-msm8994: Remove NoC clocks + +From: Konrad Dybcio + +commit 3494894afff4ad11f25d8342cc99699be496d082 upstream. + +Just like in commit 05cf3ec00d46 ("clk: qcom: gcc-msm8996: Drop (again) +gcc_aggre1_pnoc_ahb_clk") adding NoC clocks turned out to be a huge +mistake, as they cause a lot of issues at little benefit (basically +letting Linux know about their children's frequencies), especially when +mishandled or misconfigured. + +Adding these ones broke SDCC approx 99 out of 100 times, but that somehow +went unnoticed. To prevent further issues like this one, remove them. + +This commit is effectively a revert of 74a33fac3aab ("clk: qcom: +gcc-msm8994: Add missing NoC clocks") with ABI preservation. + +Fixes: 74a33fac3aab ("clk: qcom: gcc-msm8994: Add missing NoC clocks") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20220217232408.78932-1-konrad.dybcio@somainline.org +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/qcom/gcc-msm8994.c | 106 +++-------------------------------------- + 1 file changed, 9 insertions(+), 97 deletions(-) + +--- a/drivers/clk/qcom/gcc-msm8994.c ++++ b/drivers/clk/qcom/gcc-msm8994.c +@@ -107,42 +107,6 @@ static const struct clk_parent_data gcc_ + { .hw = &gpll4.clkr.hw }, + }; + +-static struct clk_rcg2 system_noc_clk_src = { +- .cmd_rcgr = 0x0120, +- .hid_width = 5, +- .parent_map = gcc_xo_gpll0_map, +- .clkr.hw.init = &(struct clk_init_data){ +- .name = "system_noc_clk_src", +- .parent_data = gcc_xo_gpll0, +- .num_parents = ARRAY_SIZE(gcc_xo_gpll0), +- .ops = &clk_rcg2_ops, +- }, +-}; +- +-static struct clk_rcg2 config_noc_clk_src = { +- .cmd_rcgr = 0x0150, +- .hid_width = 5, +- .parent_map = gcc_xo_gpll0_map, +- .clkr.hw.init = &(struct clk_init_data){ +- .name = "config_noc_clk_src", +- .parent_data = gcc_xo_gpll0, +- .num_parents = ARRAY_SIZE(gcc_xo_gpll0), +- .ops = &clk_rcg2_ops, +- }, +-}; +- +-static struct clk_rcg2 periph_noc_clk_src = { +- .cmd_rcgr = 0x0190, +- .hid_width = 5, +- .parent_map = gcc_xo_gpll0_map, +- .clkr.hw.init = &(struct clk_init_data){ +- .name = "periph_noc_clk_src", +- .parent_data = gcc_xo_gpll0, +- .num_parents = ARRAY_SIZE(gcc_xo_gpll0), +- .ops = &clk_rcg2_ops, +- }, +-}; +- + static struct freq_tbl ftbl_ufs_axi_clk_src[] = { + F(50000000, P_GPLL0, 12, 0, 0), + F(100000000, P_GPLL0, 6, 0, 0), +@@ -1149,8 +1113,6 @@ static struct clk_branch gcc_blsp1_ahb_c + .enable_mask = BIT(17), + .hw.init = &(struct clk_init_data){ + .name = "gcc_blsp1_ahb_clk", +- .parent_hws = (const struct clk_hw *[]){ &periph_noc_clk_src.clkr.hw }, +- .num_parents = 1, + .ops = &clk_branch2_ops, + }, + }, +@@ -1434,8 +1396,6 @@ static struct clk_branch gcc_blsp2_ahb_c + .enable_mask = BIT(15), + .hw.init = &(struct clk_init_data){ + .name = "gcc_blsp2_ahb_clk", +- .parent_hws = (const struct clk_hw *[]){ &periph_noc_clk_src.clkr.hw }, +- .num_parents = 1, + .ops = &clk_branch2_ops, + }, + }, +@@ -1763,8 +1723,6 @@ static struct clk_branch gcc_lpass_q6_ax + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_lpass_q6_axi_clk", +- .parent_hws = (const struct clk_hw *[]){ &system_noc_clk_src.clkr.hw }, +- .num_parents = 1, + .ops = &clk_branch2_ops, + }, + }, +@@ -1777,8 +1735,6 @@ static struct clk_branch gcc_mss_q6_bimc + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_mss_q6_bimc_axi_clk", +- .parent_hws = (const struct clk_hw *[]){ &system_noc_clk_src.clkr.hw }, +- .num_parents = 1, + .ops = &clk_branch2_ops, + }, + }, +@@ -1806,9 +1762,6 @@ static struct clk_branch gcc_pcie_0_cfg_ + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_pcie_0_cfg_ahb_clk", +- .parent_hws = (const struct clk_hw *[]){ &config_noc_clk_src.clkr.hw }, +- .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +@@ -1821,9 +1774,6 @@ static struct clk_branch gcc_pcie_0_mstr + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_pcie_0_mstr_axi_clk", +- .parent_hws = (const struct clk_hw *[]){ &system_noc_clk_src.clkr.hw }, +- .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +@@ -1853,9 +1803,6 @@ static struct clk_branch gcc_pcie_0_slv_ + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_pcie_0_slv_axi_clk", +- .parent_hws = (const struct clk_hw *[]){ &system_noc_clk_src.clkr.hw }, +- .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +@@ -1883,9 +1830,6 @@ static struct clk_branch gcc_pcie_1_cfg_ + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_pcie_1_cfg_ahb_clk", +- .parent_hws = (const struct clk_hw *[]){ &config_noc_clk_src.clkr.hw }, +- .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +@@ -1898,9 +1842,6 @@ static struct clk_branch gcc_pcie_1_mstr + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_pcie_1_mstr_axi_clk", +- .parent_hws = (const struct clk_hw *[]){ &system_noc_clk_src.clkr.hw }, +- .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +@@ -1929,9 +1870,6 @@ static struct clk_branch gcc_pcie_1_slv_ + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_pcie_1_slv_axi_clk", +- .parent_hws = (const struct clk_hw *[]){ &system_noc_clk_src.clkr.hw }, +- .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +@@ -1959,8 +1897,6 @@ static struct clk_branch gcc_pdm_ahb_clk + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_pdm_ahb_clk", +- .parent_hws = (const struct clk_hw *[]){ &periph_noc_clk_src.clkr.hw }, +- .num_parents = 1, + .ops = &clk_branch2_ops, + }, + }, +@@ -1988,9 +1924,6 @@ static struct clk_branch gcc_sdcc1_ahb_c + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_sdcc1_ahb_clk", +- .parent_hws = (const struct clk_hw *[]){ &periph_noc_clk_src.clkr.hw }, +- .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +@@ -2003,9 +1936,6 @@ static struct clk_branch gcc_sdcc2_ahb_c + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_sdcc2_ahb_clk", +- .parent_hws = (const struct clk_hw *[]){ &periph_noc_clk_src.clkr.hw }, +- .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +@@ -2033,9 +1963,6 @@ static struct clk_branch gcc_sdcc3_ahb_c + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_sdcc3_ahb_clk", +- .parent_hws = (const struct clk_hw *[]){ &periph_noc_clk_src.clkr.hw }, +- .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +@@ -2063,9 +1990,6 @@ static struct clk_branch gcc_sdcc4_ahb_c + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_sdcc4_ahb_clk", +- .parent_hws = (const struct clk_hw *[]){ &periph_noc_clk_src.clkr.hw }, +- .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +@@ -2123,8 +2047,6 @@ static struct clk_branch gcc_tsif_ahb_cl + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_tsif_ahb_clk", +- .parent_hws = (const struct clk_hw *[]){ &periph_noc_clk_src.clkr.hw }, +- .num_parents = 1, + .ops = &clk_branch2_ops, + }, + }, +@@ -2152,8 +2074,6 @@ static struct clk_branch gcc_ufs_ahb_clk + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_ufs_ahb_clk", +- .parent_hws = (const struct clk_hw *[]){ &config_noc_clk_src.clkr.hw }, +- .num_parents = 1, + .ops = &clk_branch2_ops, + }, + }, +@@ -2197,8 +2117,6 @@ static struct clk_branch gcc_ufs_rx_symb + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_ufs_rx_symbol_0_clk", +- .parent_hws = (const struct clk_hw *[]){ &system_noc_clk_src.clkr.hw }, +- .num_parents = 1, + .ops = &clk_branch2_ops, + }, + }, +@@ -2212,8 +2130,6 @@ static struct clk_branch gcc_ufs_rx_symb + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_ufs_rx_symbol_1_clk", +- .parent_hws = (const struct clk_hw *[]){ &system_noc_clk_src.clkr.hw }, +- .num_parents = 1, + .ops = &clk_branch2_ops, + }, + }, +@@ -2242,8 +2158,6 @@ static struct clk_branch gcc_ufs_tx_symb + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_ufs_tx_symbol_0_clk", +- .parent_hws = (const struct clk_hw *[]){ &system_noc_clk_src.clkr.hw }, +- .num_parents = 1, + .ops = &clk_branch2_ops, + }, + }, +@@ -2257,8 +2171,6 @@ static struct clk_branch gcc_ufs_tx_symb + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_ufs_tx_symbol_1_clk", +- .parent_hws = (const struct clk_hw *[]){ &system_noc_clk_src.clkr.hw }, +- .num_parents = 1, + .ops = &clk_branch2_ops, + }, + }, +@@ -2363,8 +2275,6 @@ static struct clk_branch gcc_usb_hs_ahb_ + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_usb_hs_ahb_clk", +- .parent_hws = (const struct clk_hw *[]){ &periph_noc_clk_src.clkr.hw }, +- .num_parents = 1, + .ops = &clk_branch2_ops, + }, + }, +@@ -2487,8 +2397,6 @@ static struct clk_branch gcc_boot_rom_ah + .enable_mask = BIT(10), + .hw.init = &(struct clk_init_data){ + .name = "gcc_boot_rom_ahb_clk", +- .parent_hws = (const struct clk_hw *[]){ &config_noc_clk_src.clkr.hw }, +- .num_parents = 1, + .ops = &clk_branch2_ops, + }, + }, +@@ -2502,8 +2410,6 @@ static struct clk_branch gcc_prng_ahb_cl + .enable_mask = BIT(13), + .hw.init = &(struct clk_init_data){ + .name = "gcc_prng_ahb_clk", +- .parent_hws = (const struct clk_hw *[]){ &periph_noc_clk_src.clkr.hw }, +- .num_parents = 1, + .ops = &clk_branch2_ops, + }, + }, +@@ -2546,9 +2452,6 @@ static struct clk_regmap *gcc_msm8994_cl + [GPLL0] = &gpll0.clkr, + [GPLL4_EARLY] = &gpll4_early.clkr, + [GPLL4] = &gpll4.clkr, +- [CONFIG_NOC_CLK_SRC] = &config_noc_clk_src.clkr, +- [PERIPH_NOC_CLK_SRC] = &periph_noc_clk_src.clkr, +- [SYSTEM_NOC_CLK_SRC] = &system_noc_clk_src.clkr, + [UFS_AXI_CLK_SRC] = &ufs_axi_clk_src.clkr, + [USB30_MASTER_CLK_SRC] = &usb30_master_clk_src.clkr, + [BLSP1_QUP1_I2C_APPS_CLK_SRC] = &blsp1_qup1_i2c_apps_clk_src.clkr, +@@ -2695,6 +2598,15 @@ static struct clk_regmap *gcc_msm8994_cl + [USB_SS_PHY_LDO] = &usb_ss_phy_ldo.clkr, + [GCC_BOOT_ROM_AHB_CLK] = &gcc_boot_rom_ahb_clk.clkr, + [GCC_PRNG_AHB_CLK] = &gcc_prng_ahb_clk.clkr, ++ ++ /* ++ * The following clocks should NOT be managed by this driver, but they once were ++ * mistakengly added. Now they are only here to indicate that they are not defined ++ * on purpose, even though the names will stay in the header file (for ABI sanity). ++ */ ++ [CONFIG_NOC_CLK_SRC] = NULL, ++ [PERIPH_NOC_CLK_SRC] = NULL, ++ [SYSTEM_NOC_CLK_SRC] = NULL, + }; + + static struct gdsc *gcc_msm8994_gdscs[] = { diff --git a/queue-5.16/drm-amd-display-for-vblank_disable_immediate-check-psr-is-really-used.patch b/queue-5.16/drm-amd-display-for-vblank_disable_immediate-check-psr-is-really-used.patch new file mode 100644 index 00000000000..bf4e5ece211 --- /dev/null +++ b/queue-5.16/drm-amd-display-for-vblank_disable_immediate-check-psr-is-really-used.patch @@ -0,0 +1,62 @@ +From 4d22336f903930eb94588b939c310743a3640276 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michel=20D=C3=A4nzer?= +Date: Tue, 15 Feb 2022 19:53:37 +0100 +Subject: drm/amd/display: For vblank_disable_immediate, check PSR is really used +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michel Dänzer + +commit 4d22336f903930eb94588b939c310743a3640276 upstream. + +Even if PSR is allowed for a present GPU, there might be no eDP link +which supports PSR. + +Fixes: 708978487304 ("drm/amdgpu/display: Only set vblank_disable_immediate when PSR is not enabled") +Reviewed-by: Harry Wentland +Signed-off-by: Michel Dänzer +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -4232,6 +4232,9 @@ static int amdgpu_dm_initialize_drm_devi + } + #endif + ++ /* Disable vblank IRQs aggressively for power-saving. */ ++ adev_to_drm(adev)->vblank_disable_immediate = true; ++ + /* loops over all connectors on the board */ + for (i = 0; i < link_cnt; i++) { + struct dc_link *link = NULL; +@@ -4277,19 +4280,17 @@ static int amdgpu_dm_initialize_drm_devi + update_connector_ext_caps(aconnector); + if (psr_feature_enabled) + amdgpu_dm_set_psr_caps(link); ++ ++ /* TODO: Fix vblank control helpers to delay PSR entry to allow this when ++ * PSR is also supported. ++ */ ++ if (link->psr_settings.psr_feature_enabled) ++ adev_to_drm(adev)->vblank_disable_immediate = false; + } + + + } + +- /* +- * Disable vblank IRQs aggressively for power-saving. +- * +- * TODO: Fix vblank control helpers to delay PSR entry to allow this when PSR +- * is also supported. +- */ +- adev_to_drm(adev)->vblank_disable_immediate = !psr_feature_enabled; +- + /* Software is initialized. Now we can register interrupt handlers. */ + switch (adev->asic_type) { + #if defined(CONFIG_DRM_AMD_DC_SI) diff --git a/queue-5.16/drm-edid-always-set-rgb444.patch b/queue-5.16/drm-edid-always-set-rgb444.patch new file mode 100644 index 00000000000..1067c117d4d --- /dev/null +++ b/queue-5.16/drm-edid-always-set-rgb444.patch @@ -0,0 +1,65 @@ +From ecbd4912a693b862e25cba0a6990a8c95b00721e Mon Sep 17 00:00:00 2001 +From: Maxime Ripard +Date: Thu, 3 Feb 2022 12:54:16 +0100 +Subject: drm/edid: Always set RGB444 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maxime Ripard + +commit ecbd4912a693b862e25cba0a6990a8c95b00721e upstream. + +In order to fill the drm_display_info structure each time an EDID is +read, the code currently will call drm_add_display_info with the parsed +EDID. + +drm_add_display_info will then call drm_reset_display_info to reset all +the fields to 0, and then set them to the proper value depending on the +EDID. + +In the color_formats case, we will thus report that we don't support any +color format, and then fill it back with RGB444 plus the additional +formats described in the EDID Feature Support byte. + +However, since that byte only contains format-related bits since the 1.4 +specification, this doesn't happen if the EDID is following an earlier +specification. In turn, it means that for one of these EDID, we end up +with color_formats set to 0. + +The EDID 1.3 specification never really specifies what it means by RGB +exactly, but since both HDMI and DVI will use RGB444, it's fairly safe +to assume it's supposed to be RGB444. + +Let's move the addition of RGB444 to color_formats earlier in +drm_add_display_info() so that it's always set for a digital display. + +Fixes: da05a5a71ad8 ("drm: parse color format support for digital displays") +Cc: Ville Syrjälä +Reported-by: Matthias Reichl +Signed-off-by: Maxime Ripard +Reviewed-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20220203115416.1137308-1-maxime@cerno.tech +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_edid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -5345,6 +5345,7 @@ u32 drm_add_display_info(struct drm_conn + if (!(edid->input & DRM_EDID_INPUT_DIGITAL)) + return quirks; + ++ info->color_formats |= DRM_COLOR_FORMAT_RGB444; + drm_parse_cea_ext(connector, edid); + + /* +@@ -5393,7 +5394,6 @@ u32 drm_add_display_info(struct drm_conn + DRM_DEBUG("%s: Assigning EDID-1.4 digital sink color depth as %d bpc.\n", + connector->name, info->bpc); + +- info->color_formats |= DRM_COLOR_FORMAT_RGB444; + if (edid->features & DRM_EDID_FEATURE_RGB_YCRCB444) + info->color_formats |= DRM_COLOR_FORMAT_YCRCB444; + if (edid->features & DRM_EDID_FEATURE_RGB_YCRCB422) diff --git a/queue-5.16/drm-i915-dg2-print-phy-name-properly-on-calibration-error.patch b/queue-5.16/drm-i915-dg2-print-phy-name-properly-on-calibration-error.patch new file mode 100644 index 00000000000..2ee42095d57 --- /dev/null +++ b/queue-5.16/drm-i915-dg2-print-phy-name-properly-on-calibration-error.patch @@ -0,0 +1,34 @@ +From 28adef861233c6fce47372ebd2070b55eaa8e899 Mon Sep 17 00:00:00 2001 +From: Matt Roper +Date: Tue, 15 Feb 2022 08:35:45 -0800 +Subject: drm/i915/dg2: Print PHY name properly on calibration error + +From: Matt Roper + +commit 28adef861233c6fce47372ebd2070b55eaa8e899 upstream. + +We need to use phy_name() to convert the PHY value into a human-readable +character in the error message. + +Fixes: a6a128116e55 ("drm/i915/dg2: Wait for SNPS PHY calibration during display init") +Signed-off-by: Matt Roper +Reviewed-by: Swathi Dhanavanthri +Link: https://patchwork.freedesktop.org/patch/msgid/20220215163545.2175730-1-matthew.d.roper@intel.com +(cherry picked from commit 84073e568eec7b586b2f6fd5fb2fb08f59edec54) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_snps_phy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/display/intel_snps_phy.c ++++ b/drivers/gpu/drm/i915/display/intel_snps_phy.c +@@ -34,7 +34,7 @@ void intel_snps_phy_wait_for_calibration + if (intel_de_wait_for_clear(dev_priv, ICL_PHY_MISC(phy), + DG2_PHY_DP_TX_ACK_MASK, 25)) + DRM_ERROR("SNPS PHY %c failed to calibrate after 25ms.\n", +- phy); ++ phy_name(phy)); + } + } + diff --git a/queue-5.16/drm-vc4-crtc-fix-runtime_pm-reference-counting.patch b/queue-5.16/drm-vc4-crtc-fix-runtime_pm-reference-counting.patch new file mode 100644 index 00000000000..ecea4b111a3 --- /dev/null +++ b/queue-5.16/drm-vc4-crtc-fix-runtime_pm-reference-counting.patch @@ -0,0 +1,54 @@ +From 6764eb690e77ecded48587d6d4e346ba2e196546 Mon Sep 17 00:00:00 2001 +From: Maxime Ripard +Date: Thu, 3 Feb 2022 11:20:03 +0100 +Subject: drm/vc4: crtc: Fix runtime_pm reference counting + +From: Maxime Ripard + +commit 6764eb690e77ecded48587d6d4e346ba2e196546 upstream. + +At boot on the BCM2711, if the HDMI controllers are running, the CRTC +driver will disable itself and its associated HDMI controller to work +around a hardware bug that would leave some pixels stuck in a FIFO. + +In order to avoid that issue, we need to run some operations in lockstep +between the CRTC and HDMI controller, and we need to make sure the HDMI +controller will be powered properly. + +However, since we haven't enabled it through KMS, the runtime_pm state +is off at this point so we need to make sure the device is powered +through pm_runtime_resume_and_get, and once the operations are complete, +we call pm_runtime_put. + +However, the HDMI controller will do that itself in its +post_crtc_powerdown, which means we'll end up calling pm_runtime_put for +a single pm_runtime_get, throwing the reference counting off. Let's +remove the pm_runtime_put call in the CRTC code in order to have the +proper counting. + +Fixes: bca10db67bda ("drm/vc4: crtc: Make sure the HDMI controller is powered when disabling") +Signed-off-by: Maxime Ripard +Reviewed-by: Javier Martinez Canillas +Link: https://patchwork.freedesktop.org/patch/msgid/20220203102003.1114673-1-maxime@cerno.tech +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vc4/vc4_crtc.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/vc4/vc4_crtc.c ++++ b/drivers/gpu/drm/vc4/vc4_crtc.c +@@ -538,9 +538,11 @@ int vc4_crtc_disable_at_boot(struct drm_ + if (ret) + return ret; + +- ret = pm_runtime_put(&vc4_hdmi->pdev->dev); +- if (ret) +- return ret; ++ /* ++ * post_crtc_powerdown will have called pm_runtime_put, so we ++ * don't need it here otherwise we'll get the reference counting ++ * wrong. ++ */ + + return 0; + } diff --git a/queue-5.16/gpu-host1x-always-return-syncpoint-value-when-waiting.patch b/queue-5.16/gpu-host1x-always-return-syncpoint-value-when-waiting.patch new file mode 100644 index 00000000000..de1fb5f1512 --- /dev/null +++ b/queue-5.16/gpu-host1x-always-return-syncpoint-value-when-waiting.patch @@ -0,0 +1,53 @@ +From 184b58fa816fb5ee1854daf0d430766422bf2a77 Mon Sep 17 00:00:00 2001 +From: Mikko Perttunen +Date: Mon, 7 Feb 2022 15:19:31 +0200 +Subject: gpu: host1x: Always return syncpoint value when waiting + +From: Mikko Perttunen + +commit 184b58fa816fb5ee1854daf0d430766422bf2a77 upstream. + +The new TegraDRM UAPI uses syncpoint waiting with timeout set to +zero to indicate reading the syncpoint value. To support that we +need to return the syncpoint value always when waiting. + +Fixes: 44e961381354 ("drm/tegra: Implement syncpoint wait UAPI") +Signed-off-by: Mikko Perttunen +Signed-off-by: Thierry Reding +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/host1x/syncpt.c | 19 ++----------------- + 1 file changed, 2 insertions(+), 17 deletions(-) + +--- a/drivers/gpu/host1x/syncpt.c ++++ b/drivers/gpu/host1x/syncpt.c +@@ -225,27 +225,12 @@ int host1x_syncpt_wait(struct host1x_syn + void *ref; + struct host1x_waitlist *waiter; + int err = 0, check_count = 0; +- u32 val; + + if (value) +- *value = 0; +- +- /* first check cache */ +- if (host1x_syncpt_is_expired(sp, thresh)) { +- if (value) +- *value = host1x_syncpt_load(sp); ++ *value = host1x_syncpt_load(sp); + ++ if (host1x_syncpt_is_expired(sp, thresh)) + return 0; +- } +- +- /* try to read from register */ +- val = host1x_hw_syncpt_load(sp->host, sp); +- if (host1x_syncpt_is_expired(sp, thresh)) { +- if (value) +- *value = val; +- +- goto done; +- } + + if (!timeout) { + err = -EAGAIN; diff --git a/queue-5.16/gso-do-not-skip-outer-ip-header-in-case-of-ipip-and-net_failover.patch b/queue-5.16/gso-do-not-skip-outer-ip-header-in-case-of-ipip-and-net_failover.patch new file mode 100644 index 00000000000..06dfb6e8616 --- /dev/null +++ b/queue-5.16/gso-do-not-skip-outer-ip-header-in-case-of-ipip-and-net_failover.patch @@ -0,0 +1,103 @@ +From cc20cced0598d9a5ff91ae4ab147b3b5e99ee819 Mon Sep 17 00:00:00 2001 +From: Tao Liu +Date: Fri, 18 Feb 2022 22:35:24 +0800 +Subject: gso: do not skip outer ip header in case of ipip and net_failover + +From: Tao Liu + +commit cc20cced0598d9a5ff91ae4ab147b3b5e99ee819 upstream. + +We encounter a tcp drop issue in our cloud environment. Packet GROed in +host forwards to a VM virtio_net nic with net_failover enabled. VM acts +as a IPVS LB with ipip encapsulation. The full path like: +host gro -> vm virtio_net rx -> net_failover rx -> ipvs fullnat + -> ipip encap -> net_failover tx -> virtio_net tx + +When net_failover transmits a ipip pkt (gso_type = 0x0103, which means +SKB_GSO_TCPV4, SKB_GSO_DODGY and SKB_GSO_IPXIP4), there is no gso +did because it supports TSO and GSO_IPXIP4. But network_header points to +inner ip header. + +Call Trace: + tcp4_gso_segment ------> return NULL + inet_gso_segment ------> inner iph, network_header points to + ipip_gso_segment + inet_gso_segment ------> outer iph + skb_mac_gso_segment + +Afterwards virtio_net transmits the pkt, only inner ip header is modified. +And the outer one just keeps unchanged. The pkt will be dropped in remote +host. + +Call Trace: + inet_gso_segment ------> inner iph, outer iph is skipped + skb_mac_gso_segment + __skb_gso_segment + validate_xmit_skb + validate_xmit_skb_list + sch_direct_xmit + __qdisc_run + __dev_queue_xmit ------> virtio_net + dev_hard_start_xmit + __dev_queue_xmit ------> net_failover + ip_finish_output2 + ip_output + iptunnel_xmit + ip_tunnel_xmit + ipip_tunnel_xmit ------> ipip + dev_hard_start_xmit + __dev_queue_xmit + ip_finish_output2 + ip_output + ip_forward + ip_rcv + __netif_receive_skb_one_core + netif_receive_skb_internal + napi_gro_receive + receive_buf + virtnet_poll + net_rx_action + +The root cause of this issue is specific with the rare combination of +SKB_GSO_DODGY and a tunnel device that adds an SKB_GSO_ tunnel option. +SKB_GSO_DODGY is set from external virtio_net. We need to reset network +header when callbacks.gso_segment() returns NULL. + +This patch also includes ipv6_gso_segment(), considering SIT, etc. + +Fixes: cb32f511a70b ("ipip: add GSO/TSO support") +Signed-off-by: Tao Liu +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/af_inet.c | 5 ++++- + net/ipv6/ip6_offload.c | 2 ++ + 2 files changed, 6 insertions(+), 1 deletion(-) + +--- a/net/ipv4/af_inet.c ++++ b/net/ipv4/af_inet.c +@@ -1376,8 +1376,11 @@ struct sk_buff *inet_gso_segment(struct + } + + ops = rcu_dereference(inet_offloads[proto]); +- if (likely(ops && ops->callbacks.gso_segment)) ++ if (likely(ops && ops->callbacks.gso_segment)) { + segs = ops->callbacks.gso_segment(skb, features); ++ if (!segs) ++ skb->network_header = skb_mac_header(skb) + nhoff - skb->head; ++ } + + if (IS_ERR_OR_NULL(segs)) + goto out; +--- a/net/ipv6/ip6_offload.c ++++ b/net/ipv6/ip6_offload.c +@@ -114,6 +114,8 @@ static struct sk_buff *ipv6_gso_segment( + if (likely(ops && ops->callbacks.gso_segment)) { + skb_reset_transport_header(skb); + segs = ops->callbacks.gso_segment(skb, features); ++ if (!segs) ++ skb->network_header = skb_mac_header(skb) + nhoff - skb->head; + } + + if (IS_ERR_OR_NULL(segs)) diff --git a/queue-5.16/hwmon-handle-failure-to-register-sensor-with-thermal-zone-correctly.patch b/queue-5.16/hwmon-handle-failure-to-register-sensor-with-thermal-zone-correctly.patch new file mode 100644 index 00000000000..81de3d3d4f5 --- /dev/null +++ b/queue-5.16/hwmon-handle-failure-to-register-sensor-with-thermal-zone-correctly.patch @@ -0,0 +1,89 @@ +From 1b5f517cca36292076d9e38fa6e33a257703e62e Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Mon, 21 Feb 2022 08:32:14 -0800 +Subject: hwmon: Handle failure to register sensor with thermal zone correctly + +From: Guenter Roeck + +commit 1b5f517cca36292076d9e38fa6e33a257703e62e upstream. + +If an attempt is made to a sensor with a thermal zone and it fails, +the call to devm_thermal_zone_of_sensor_register() may return -ENODEV. +This may result in crashes similar to the following. + +Unable to handle kernel NULL pointer dereference at virtual address 00000000000003cd +... +Internal error: Oops: 96000021 [#1] PREEMPT SMP +... +pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : mutex_lock+0x18/0x60 +lr : thermal_zone_device_update+0x40/0x2e0 +sp : ffff800014c4fc60 +x29: ffff800014c4fc60 x28: ffff365ee3f6e000 x27: ffffdde218426790 +x26: ffff365ee3f6e000 x25: 0000000000000000 x24: ffff365ee3f6e000 +x23: ffffdde218426870 x22: ffff365ee3f6e000 x21: 00000000000003cd +x20: ffff365ee8bf3308 x19: ffffffffffffffed x18: 0000000000000000 +x17: ffffdde21842689c x16: ffffdde1cb7a0b7c x15: 0000000000000040 +x14: ffffdde21a4889a0 x13: 0000000000000228 x12: 0000000000000000 +x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 +x8 : 0000000001120000 x7 : 0000000000000001 x6 : 0000000000000000 +x5 : 0068000878e20f07 x4 : 0000000000000000 x3 : 00000000000003cd +x2 : ffff365ee3f6e000 x1 : 0000000000000000 x0 : 00000000000003cd +Call trace: + mutex_lock+0x18/0x60 + hwmon_notify_event+0xfc/0x110 + 0xffffdde1cb7a0a90 + 0xffffdde1cb7a0b7c + irq_thread_fn+0x2c/0xa0 + irq_thread+0x134/0x240 + kthread+0x178/0x190 + ret_from_fork+0x10/0x20 +Code: d503201f d503201f d2800001 aa0103e4 (c8e47c02) + +Jon Hunter reports that the exact call sequence is: + +hwmon_notify_event() + --> hwmon_thermal_notify() + --> thermal_zone_device_update() + --> update_temperature() + --> mutex_lock() + +The hwmon core needs to handle all errors returned from calls +to devm_thermal_zone_of_sensor_register(). If the call fails +with -ENODEV, report that the sensor was not attached to a +thermal zone but continue to register the hwmon device. + +Reported-by: Jon Hunter +Cc: Dmitry Osipenko +Fixes: 1597b374af222 ("hwmon: Add notification support") +Reviewed-by: Dmitry Osipenko +Tested-by: Jon Hunter +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/hwmon.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/drivers/hwmon/hwmon.c ++++ b/drivers/hwmon/hwmon.c +@@ -214,12 +214,14 @@ static int hwmon_thermal_add_sensor(stru + + tzd = devm_thermal_zone_of_sensor_register(dev, index, tdata, + &hwmon_thermal_ops); +- /* +- * If CONFIG_THERMAL_OF is disabled, this returns -ENODEV, +- * so ignore that error but forward any other error. +- */ +- if (IS_ERR(tzd) && (PTR_ERR(tzd) != -ENODEV)) +- return PTR_ERR(tzd); ++ if (IS_ERR(tzd)) { ++ if (PTR_ERR(tzd) != -ENODEV) ++ return PTR_ERR(tzd); ++ dev_info(dev, "temp%d_input not attached to any thermal zone\n", ++ index + 1); ++ devm_kfree(dev, tdata); ++ return 0; ++ } + + err = devm_add_action(dev, hwmon_thermal_remove_sensor, &tdata->node); + if (err) diff --git a/queue-5.16/ibmvnic-schedule-failover-only-if-vioctl-fails.patch b/queue-5.16/ibmvnic-schedule-failover-only-if-vioctl-fails.patch new file mode 100644 index 00000000000..74b3f9168dd --- /dev/null +++ b/queue-5.16/ibmvnic-schedule-failover-only-if-vioctl-fails.patch @@ -0,0 +1,42 @@ +From 277f2bb14361790a70e4b3c649e794b75a91a597 Mon Sep 17 00:00:00 2001 +From: Sukadev Bhattiprolu +Date: Mon, 21 Feb 2022 15:05:45 -0600 +Subject: ibmvnic: schedule failover only if vioctl fails + +From: Sukadev Bhattiprolu + +commit 277f2bb14361790a70e4b3c649e794b75a91a597 upstream. + +If client is unable to initiate a failover reset via H_VIOCTL hcall, then +it should schedule a failover reset as a last resort. Otherwise, there is +no need to do a last resort. + +Fixes: 334c42414729 ("ibmvnic: improve failover sysfs entry") +Reported-by: Cris Forno +Signed-off-by: Sukadev Bhattiprolu +Signed-off-by: Dany Madden +Link: https://lore.kernel.org/r/20220221210545.115283-1-drt@linux.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ibm/ibmvnic.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -5919,10 +5919,14 @@ static ssize_t failover_store(struct dev + be64_to_cpu(session_token)); + rc = plpar_hcall_norets(H_VIOCTL, adapter->vdev->unit_address, + H_SESSION_ERR_DETECTED, session_token, 0, 0); +- if (rc) ++ if (rc) { + netdev_err(netdev, + "H_VIOCTL initiated failover failed, rc %ld\n", + rc); ++ goto last_resort; ++ } ++ ++ return count; + + last_resort: + netdev_dbg(netdev, "Trying to send CRQ_CMD, the last resort\n"); diff --git a/queue-5.16/ice-check-the-return-of-ice_ptp_gettimex64.patch b/queue-5.16/ice-check-the-return-of-ice_ptp_gettimex64.patch new file mode 100644 index 00000000000..e9c35e7d3fb --- /dev/null +++ b/queue-5.16/ice-check-the-return-of-ice_ptp_gettimex64.patch @@ -0,0 +1,44 @@ +From ed22d9c8d128293fc7b0b086c7d3654bcb99a8dd Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Mon, 14 Feb 2022 06:33:27 -0800 +Subject: ice: check the return of ice_ptp_gettimex64 + +From: Tom Rix + +commit ed22d9c8d128293fc7b0b086c7d3654bcb99a8dd upstream. + +Clang static analysis reports this issue +time64.h:69:50: warning: The left operand of '+' + is a garbage value + set_normalized_timespec64(&ts_delta, lhs.tv_sec + rhs.tv_sec, + ~~~~~~~~~~ ^ +In ice_ptp_adjtime_nonatomic(), the timespec64 variable 'now' +is set by ice_ptp_gettimex64(). This function can fail +with -EBUSY, so 'now' can have a gargbage value. +So check the return. + +Fixes: 06c16d89d2cb ("ice: register 1588 PTP clock device object for E810 devices") +Signed-off-by: Tom Rix +Tested-by: Gurucharan G (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_ptp.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/ice/ice_ptp.c ++++ b/drivers/net/ethernet/intel/ice/ice_ptp.c +@@ -1121,9 +1121,12 @@ exit: + static int ice_ptp_adjtime_nonatomic(struct ptp_clock_info *info, s64 delta) + { + struct timespec64 now, then; ++ int ret; + + then = ns_to_timespec64(delta); +- ice_ptp_gettimex64(info, &now, NULL); ++ ret = ice_ptp_gettimex64(info, &now, NULL); ++ if (ret) ++ return ret; + now = timespec64_add(now, then); + + return ice_ptp_settime64(info, (const struct timespec64 *)&now); diff --git a/queue-5.16/ice-fix-concurrent-reset-and-removal-of-vfs.patch b/queue-5.16/ice-fix-concurrent-reset-and-removal-of-vfs.patch new file mode 100644 index 00000000000..e7609f2727c --- /dev/null +++ b/queue-5.16/ice-fix-concurrent-reset-and-removal-of-vfs.patch @@ -0,0 +1,191 @@ +From fadead80fe4c033b5e514fcbadd20b55c4494112 Mon Sep 17 00:00:00 2001 +From: Jacob Keller +Date: Mon, 7 Feb 2022 10:23:29 -0800 +Subject: ice: fix concurrent reset and removal of VFs + +From: Jacob Keller + +commit fadead80fe4c033b5e514fcbadd20b55c4494112 upstream. + +Commit c503e63200c6 ("ice: Stop processing VF messages during teardown") +introduced a driver state flag, ICE_VF_DEINIT_IN_PROGRESS, which is +intended to prevent some issues with concurrently handling messages from +VFs while tearing down the VFs. + +This change was motivated by crashes caused while tearing down and +bringing up VFs in rapid succession. + +It turns out that the fix actually introduces issues with the VF driver +caused because the PF no longer responds to any messages sent by the VF +during its .remove routine. This results in the VF potentially removing +its DMA memory before the PF has shut down the device queues. + +Additionally, the fix doesn't actually resolve concurrency issues within +the ice driver. It is possible for a VF to initiate a reset just prior +to the ice driver removing VFs. This can result in the remove task +concurrently operating while the VF is being reset. This results in +similar memory corruption and panics purportedly fixed by that commit. + +Fix this concurrency at its root by protecting both the reset and +removal flows using the existing VF cfg_lock. This ensures that we +cannot remove the VF while any outstanding critical tasks such as a +virtchnl message or a reset are occurring. + +This locking change also fixes the root cause originally fixed by commit +c503e63200c6 ("ice: Stop processing VF messages during teardown"), so we +can simply revert it. + +Note that I kept these two changes together because simply reverting the +original commit alone would leave the driver vulnerable to worse race +conditions. + +Fixes: c503e63200c6 ("ice: Stop processing VF messages during teardown") +Signed-off-by: Jacob Keller +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice.h | 1 + drivers/net/ethernet/intel/ice/ice_main.c | 2 + + drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 42 +++++++++++++---------- + 3 files changed, 27 insertions(+), 18 deletions(-) + +--- a/drivers/net/ethernet/intel/ice/ice.h ++++ b/drivers/net/ethernet/intel/ice/ice.h +@@ -280,7 +280,6 @@ enum ice_pf_state { + ICE_VFLR_EVENT_PENDING, + ICE_FLTR_OVERFLOW_PROMISC, + ICE_VF_DIS, +- ICE_VF_DEINIT_IN_PROGRESS, + ICE_CFG_BUSY, + ICE_SERVICE_SCHED, + ICE_SERVICE_DIS, +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -1772,7 +1772,9 @@ static void ice_handle_mdd_event(struct + * reset, so print the event prior to reset. + */ + ice_print_vf_rx_mdd_event(vf); ++ mutex_lock(&pf->vf[i].cfg_lock); + ice_reset_vf(&pf->vf[i], false); ++ mutex_unlock(&pf->vf[i].cfg_lock); + } + } + } +--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c +@@ -617,8 +617,6 @@ void ice_free_vfs(struct ice_pf *pf) + struct ice_hw *hw = &pf->hw; + unsigned int tmp, i; + +- set_bit(ICE_VF_DEINIT_IN_PROGRESS, pf->state); +- + if (!pf->vf) + return; + +@@ -636,22 +634,26 @@ void ice_free_vfs(struct ice_pf *pf) + else + dev_warn(dev, "VFs are assigned - not disabling SR-IOV\n"); + +- /* Avoid wait time by stopping all VFs at the same time */ +- ice_for_each_vf(pf, i) +- ice_dis_vf_qs(&pf->vf[i]); +- + tmp = pf->num_alloc_vfs; + pf->num_qps_per_vf = 0; + pf->num_alloc_vfs = 0; + for (i = 0; i < tmp; i++) { +- if (test_bit(ICE_VF_STATE_INIT, pf->vf[i].vf_states)) { ++ struct ice_vf *vf = &pf->vf[i]; ++ ++ mutex_lock(&vf->cfg_lock); ++ ++ ice_dis_vf_qs(vf); ++ ++ if (test_bit(ICE_VF_STATE_INIT, vf->vf_states)) { + /* disable VF qp mappings and set VF disable state */ +- ice_dis_vf_mappings(&pf->vf[i]); +- set_bit(ICE_VF_STATE_DIS, pf->vf[i].vf_states); +- ice_free_vf_res(&pf->vf[i]); ++ ice_dis_vf_mappings(vf); ++ set_bit(ICE_VF_STATE_DIS, vf->vf_states); ++ ice_free_vf_res(vf); + } + +- mutex_destroy(&pf->vf[i].cfg_lock); ++ mutex_unlock(&vf->cfg_lock); ++ ++ mutex_destroy(&vf->cfg_lock); + } + + if (ice_sriov_free_msix_res(pf)) +@@ -687,7 +689,6 @@ void ice_free_vfs(struct ice_pf *pf) + i); + + clear_bit(ICE_VF_DIS, pf->state); +- clear_bit(ICE_VF_DEINIT_IN_PROGRESS, pf->state); + clear_bit(ICE_FLAG_SRIOV_ENA, pf->flags); + } + +@@ -1613,6 +1614,8 @@ bool ice_reset_all_vfs(struct ice_pf *pf + ice_for_each_vf(pf, v) { + vf = &pf->vf[v]; + ++ mutex_lock(&vf->cfg_lock); ++ + vf->driver_caps = 0; + ice_vc_set_default_allowlist(vf); + +@@ -1627,6 +1630,8 @@ bool ice_reset_all_vfs(struct ice_pf *pf + ice_vf_pre_vsi_rebuild(vf); + ice_vf_rebuild_vsi(vf); + ice_vf_post_vsi_rebuild(vf); ++ ++ mutex_unlock(&vf->cfg_lock); + } + + if (ice_is_eswitch_mode_switchdev(pf)) +@@ -1677,6 +1682,8 @@ bool ice_reset_vf(struct ice_vf *vf, boo + u32 reg; + int i; + ++ lockdep_assert_held(&vf->cfg_lock); ++ + dev = ice_pf_to_dev(pf); + + if (test_bit(ICE_VF_RESETS_DISABLED, pf->state)) { +@@ -2176,9 +2183,12 @@ void ice_process_vflr_event(struct ice_p + bit_idx = (hw->func_caps.vf_base_id + vf_id) % 32; + /* read GLGEN_VFLRSTAT register to find out the flr VFs */ + reg = rd32(hw, GLGEN_VFLRSTAT(reg_idx)); +- if (reg & BIT(bit_idx)) ++ if (reg & BIT(bit_idx)) { + /* GLGEN_VFLRSTAT bit will be cleared in ice_reset_vf */ ++ mutex_lock(&vf->cfg_lock); + ice_reset_vf(vf, true); ++ mutex_unlock(&vf->cfg_lock); ++ } + } + } + +@@ -2255,7 +2265,9 @@ ice_vf_lan_overflow_event(struct ice_pf + if (!vf) + return; + ++ mutex_lock(&vf->cfg_lock); + ice_vc_reset_vf(vf); ++ mutex_unlock(&vf->cfg_lock); + } + + /** +@@ -4651,10 +4663,6 @@ void ice_vc_process_vf_msg(struct ice_pf + struct device *dev; + int err = 0; + +- /* if de-init is underway, don't process messages from VF */ +- if (test_bit(ICE_VF_DEINIT_IN_PROGRESS, pf->state)) +- return; +- + dev = ice_pf_to_dev(pf); + if (ice_validate_vf_id(pf, vf_id)) { + err = -EINVAL; diff --git a/queue-5.16/ice-fix-setting-l4-port-flag-when-adding-filter.patch b/queue-5.16/ice-fix-setting-l4-port-flag-when-adding-filter.patch new file mode 100644 index 00000000000..43a60cd6c6d --- /dev/null +++ b/queue-5.16/ice-fix-setting-l4-port-flag-when-adding-filter.patch @@ -0,0 +1,43 @@ +From 932645c298c41aad64ef13016ff4c2034eef5aed Mon Sep 17 00:00:00 2001 +From: Michal Swiatkowski +Date: Mon, 3 Jan 2022 07:41:21 +0100 +Subject: ice: fix setting l4 port flag when adding filter + +From: Michal Swiatkowski + +commit 932645c298c41aad64ef13016ff4c2034eef5aed upstream. + +Accidentally filter flag for none encapsulated l4 port field is always +set. Even if user wants to add encapsulated l4 port field. + +Remove this unnecessary flag setting. + +Fixes: 9e300987d4a81 ("ice: VXLAN and Geneve TC support") +Signed-off-by: Michal Swiatkowski +Tested-by: Sandeep Penigalapati +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_tc_lib.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/intel/ice/ice_tc_lib.c ++++ b/drivers/net/ethernet/intel/ice/ice_tc_lib.c +@@ -711,7 +711,7 @@ ice_tc_set_port(struct flow_match_ports + fltr->flags |= ICE_TC_FLWR_FIELD_ENC_DEST_L4_PORT; + else + fltr->flags |= ICE_TC_FLWR_FIELD_DEST_L4_PORT; +- fltr->flags |= ICE_TC_FLWR_FIELD_DEST_L4_PORT; ++ + headers->l4_key.dst_port = match.key->dst; + headers->l4_mask.dst_port = match.mask->dst; + } +@@ -720,7 +720,7 @@ ice_tc_set_port(struct flow_match_ports + fltr->flags |= ICE_TC_FLWR_FIELD_ENC_SRC_L4_PORT; + else + fltr->flags |= ICE_TC_FLWR_FIELD_SRC_L4_PORT; +- fltr->flags |= ICE_TC_FLWR_FIELD_SRC_L4_PORT; ++ + headers->l4_key.src_port = match.key->src; + headers->l4_mask.src_port = match.mask->src; + } diff --git a/queue-5.16/ice-initialize-local-variable-tlv.patch b/queue-5.16/ice-initialize-local-variable-tlv.patch new file mode 100644 index 00000000000..059e9217685 --- /dev/null +++ b/queue-5.16/ice-initialize-local-variable-tlv.patch @@ -0,0 +1,39 @@ +From 5950bdc88dd1d158f2845fdff8fb1de86476806c Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Mon, 14 Feb 2022 07:40:43 -0800 +Subject: ice: initialize local variable 'tlv' + +From: Tom Rix + +commit 5950bdc88dd1d158f2845fdff8fb1de86476806c upstream. + +Clang static analysis reports this issues +ice_common.c:5008:21: warning: The left expression of the compound + assignment is an uninitialized value. The computed value will + also be garbage + ldo->phy_type_low |= ((u64)buf << (i * 16)); + ~~~~~~~~~~~~~~~~~ ^ + +When called from ice_cfg_phy_fec() ldo is the uninitialized local +variable tlv. So initialize. + +Fixes: ea78ce4dab05 ("ice: add link lenient and default override support") +Signed-off-by: Tom Rix +Tested-by: Gurucharan G (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/ice/ice_common.c ++++ b/drivers/net/ethernet/intel/ice/ice_common.c +@@ -3319,7 +3319,7 @@ ice_cfg_phy_fec(struct ice_port_info *pi + + if (fec == ICE_FEC_AUTO && ice_fw_supports_link_override(hw) && + !ice_fw_supports_report_dflt_cfg(hw)) { +- struct ice_link_default_override_tlv tlv; ++ struct ice_link_default_override_tlv tlv = { 0 }; + + status = ice_get_link_default_override(&tlv, pi); + if (status) diff --git a/queue-5.16/io_uring-add-a-schedule-point-in-io_add_buffers.patch b/queue-5.16/io_uring-add-a-schedule-point-in-io_add_buffers.patch new file mode 100644 index 00000000000..b265f054a84 --- /dev/null +++ b/queue-5.16/io_uring-add-a-schedule-point-in-io_add_buffers.patch @@ -0,0 +1,87 @@ +From f240762f88b4b1b58561939ffd44837759756477 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Mon, 14 Feb 2022 20:10:03 -0800 +Subject: io_uring: add a schedule point in io_add_buffers() + +From: Eric Dumazet + +commit f240762f88b4b1b58561939ffd44837759756477 upstream. + +Looping ~65535 times doing kmalloc() calls can trigger soft lockups, +especially with DEBUG features (like KASAN). + +[ 253.536212] watchdog: BUG: soft lockup - CPU#64 stuck for 26s! [b219417889:12575] +[ 253.544433] Modules linked in: vfat fat i2c_mux_pca954x i2c_mux spidev cdc_acm xhci_pci xhci_hcd sha3_generic gq(O) +[ 253.544451] CPU: 64 PID: 12575 Comm: b219417889 Tainted: G S O 5.17.0-smp-DEV #801 +[ 253.544457] RIP: 0010:kernel_text_address (./include/asm-generic/sections.h:192 ./include/linux/kallsyms.h:29 kernel/extable.c:67 kernel/extable.c:98) +[ 253.544464] Code: 0f 93 c0 48 c7 c1 e0 63 d7 a4 48 39 cb 0f 92 c1 20 c1 0f b6 c1 5b 5d c3 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 53 48 89 fb <48> c7 c0 00 00 80 a0 41 be 01 00 00 00 48 39 c7 72 0c 48 c7 c0 40 +[ 253.544468] RSP: 0018:ffff8882d8baf4c0 EFLAGS: 00000246 +[ 253.544471] RAX: 1ffff1105b175e00 RBX: ffffffffa13ef09a RCX: 00000000a13ef001 +[ 253.544474] RDX: ffffffffa13ef09a RSI: ffff8882d8baf558 RDI: ffffffffa13ef09a +[ 253.544476] RBP: ffff8882d8baf4d8 R08: ffff8882d8baf5e0 R09: 0000000000000004 +[ 253.544479] R10: ffff8882d8baf5e8 R11: ffffffffa0d59a50 R12: ffff8882eab20380 +[ 253.544481] R13: ffffffffa0d59a50 R14: dffffc0000000000 R15: 1ffff1105b175eb0 +[ 253.544483] FS: 00000000016d3380(0000) GS:ffff88af48c00000(0000) knlGS:0000000000000000 +[ 253.544486] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 253.544488] CR2: 00000000004af0f0 CR3: 00000002eabfa004 CR4: 00000000003706e0 +[ 253.544491] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 253.544492] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 253.544494] Call Trace: +[ 253.544496] +[ 253.544498] ? io_queue_sqe (fs/io_uring.c:7143) +[ 253.544505] __kernel_text_address (kernel/extable.c:78) +[ 253.544508] unwind_get_return_address (arch/x86/kernel/unwind_frame.c:19) +[ 253.544514] arch_stack_walk (arch/x86/kernel/stacktrace.c:27) +[ 253.544517] ? io_queue_sqe (fs/io_uring.c:7143) +[ 253.544521] stack_trace_save (kernel/stacktrace.c:123) +[ 253.544527] ____kasan_kmalloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:515) +[ 253.544531] ? ____kasan_kmalloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:515) +[ 253.544533] ? __kasan_kmalloc (mm/kasan/common.c:524) +[ 253.544535] ? kmem_cache_alloc_trace (./include/linux/kasan.h:270 mm/slab.c:3567) +[ 253.544541] ? io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828) +[ 253.544544] ? __io_queue_sqe (fs/io_uring.c:?) +[ 253.544551] __kasan_kmalloc (mm/kasan/common.c:524) +[ 253.544553] kmem_cache_alloc_trace (./include/linux/kasan.h:270 mm/slab.c:3567) +[ 253.544556] ? io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828) +[ 253.544560] io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828) +[ 253.544564] ? __kasan_slab_alloc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469) +[ 253.544567] ? __kasan_slab_alloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469) +[ 253.544569] ? kmem_cache_alloc_bulk (mm/slab.h:732 mm/slab.c:3546) +[ 253.544573] ? __io_alloc_req_refill (fs/io_uring.c:2078) +[ 253.544578] ? io_submit_sqes (fs/io_uring.c:7441) +[ 253.544581] ? __se_sys_io_uring_enter (fs/io_uring.c:10154 fs/io_uring.c:10096) +[ 253.544584] ? __x64_sys_io_uring_enter (fs/io_uring.c:10096) +[ 253.544587] ? do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) +[ 253.544590] ? entry_SYSCALL_64_after_hwframe (??:?) +[ 253.544596] __io_queue_sqe (fs/io_uring.c:?) +[ 253.544600] io_queue_sqe (fs/io_uring.c:7143) +[ 253.544603] io_submit_sqe (fs/io_uring.c:?) +[ 253.544608] io_submit_sqes (fs/io_uring.c:?) +[ 253.544612] __se_sys_io_uring_enter (fs/io_uring.c:10154 fs/io_uring.c:10096) +[ 253.544616] __x64_sys_io_uring_enter (fs/io_uring.c:10096) +[ 253.544619] do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) +[ 253.544623] entry_SYSCALL_64_after_hwframe (??:?) + +Fixes: ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") +Signed-off-by: Eric Dumazet +Cc: Jens Axboe +Cc: Pavel Begunkov +Cc: io-uring +Reported-by: syzbot +Link: https://lore.kernel.org/r/20220215041003.2394784-1-eric.dumazet@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + fs/io_uring.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -4477,6 +4477,7 @@ static int io_add_buffers(struct io_prov + } else { + list_add_tail(&buf->list, &(*head)->list); + } ++ cond_resched(); + } + + return i ? i : -ENOMEM; diff --git a/queue-5.16/mptcp-add-mibs-counter-for-ignored-incoming-options.patch b/queue-5.16/mptcp-add-mibs-counter-for-ignored-incoming-options.patch new file mode 100644 index 00000000000..e19cdfb4c75 --- /dev/null +++ b/queue-5.16/mptcp-add-mibs-counter-for-ignored-incoming-options.patch @@ -0,0 +1,89 @@ +From f73c1194634506ab60af0debef04671fc431a435 Mon Sep 17 00:00:00 2001 +From: Paolo Abeni +Date: Fri, 18 Feb 2022 13:35:42 -0800 +Subject: mptcp: add mibs counter for ignored incoming options + +From: Paolo Abeni + +commit f73c1194634506ab60af0debef04671fc431a435 upstream. + +The MPTCP in kernel path manager has some constraints on incoming +addresses announce processing, so that in edge scenarios it can +end-up dropping (ignoring) some of such announces. + +The above is not very limiting in practice since such scenarios are +very uncommon and MPTCP will recover due to ADD_ADDR retransmissions. + +This patch adds a few MIB counters to account for such drop events +to allow easier introspection of the critical scenarios. + +Fixes: f7efc7771eac ("mptcp: drop argument port from mptcp_pm_announce_addr") +Reviewed-by: Matthieu Baerts +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/mib.c | 2 ++ + net/mptcp/mib.h | 2 ++ + net/mptcp/pm.c | 8 ++++++-- + 3 files changed, 10 insertions(+), 2 deletions(-) + +--- a/net/mptcp/mib.c ++++ b/net/mptcp/mib.c +@@ -35,12 +35,14 @@ static const struct snmp_mib mptcp_snmp_ + SNMP_MIB_ITEM("AddAddr", MPTCP_MIB_ADDADDR), + SNMP_MIB_ITEM("EchoAdd", MPTCP_MIB_ECHOADD), + SNMP_MIB_ITEM("PortAdd", MPTCP_MIB_PORTADD), ++ SNMP_MIB_ITEM("AddAddrDrop", MPTCP_MIB_ADDADDRDROP), + SNMP_MIB_ITEM("MPJoinPortSynRx", MPTCP_MIB_JOINPORTSYNRX), + SNMP_MIB_ITEM("MPJoinPortSynAckRx", MPTCP_MIB_JOINPORTSYNACKRX), + SNMP_MIB_ITEM("MPJoinPortAckRx", MPTCP_MIB_JOINPORTACKRX), + SNMP_MIB_ITEM("MismatchPortSynRx", MPTCP_MIB_MISMATCHPORTSYNRX), + SNMP_MIB_ITEM("MismatchPortAckRx", MPTCP_MIB_MISMATCHPORTACKRX), + SNMP_MIB_ITEM("RmAddr", MPTCP_MIB_RMADDR), ++ SNMP_MIB_ITEM("RmAddrDrop", MPTCP_MIB_RMADDRDROP), + SNMP_MIB_ITEM("RmSubflow", MPTCP_MIB_RMSUBFLOW), + SNMP_MIB_ITEM("MPPrioTx", MPTCP_MIB_MPPRIOTX), + SNMP_MIB_ITEM("MPPrioRx", MPTCP_MIB_MPPRIORX), +--- a/net/mptcp/mib.h ++++ b/net/mptcp/mib.h +@@ -28,12 +28,14 @@ enum linux_mptcp_mib_field { + MPTCP_MIB_ADDADDR, /* Received ADD_ADDR with echo-flag=0 */ + MPTCP_MIB_ECHOADD, /* Received ADD_ADDR with echo-flag=1 */ + MPTCP_MIB_PORTADD, /* Received ADD_ADDR with a port-number */ ++ MPTCP_MIB_ADDADDRDROP, /* Dropped incoming ADD_ADDR */ + MPTCP_MIB_JOINPORTSYNRX, /* Received a SYN MP_JOIN with a different port-number */ + MPTCP_MIB_JOINPORTSYNACKRX, /* Received a SYNACK MP_JOIN with a different port-number */ + MPTCP_MIB_JOINPORTACKRX, /* Received an ACK MP_JOIN with a different port-number */ + MPTCP_MIB_MISMATCHPORTSYNRX, /* Received a SYN MP_JOIN with a mismatched port-number */ + MPTCP_MIB_MISMATCHPORTACKRX, /* Received an ACK MP_JOIN with a mismatched port-number */ + MPTCP_MIB_RMADDR, /* Received RM_ADDR */ ++ MPTCP_MIB_RMADDRDROP, /* Dropped incoming RM_ADDR */ + MPTCP_MIB_RMSUBFLOW, /* Remove a subflow */ + MPTCP_MIB_MPPRIOTX, /* Transmit a MP_PRIO */ + MPTCP_MIB_MPPRIORX, /* Received a MP_PRIO */ +--- a/net/mptcp/pm.c ++++ b/net/mptcp/pm.c +@@ -194,6 +194,8 @@ void mptcp_pm_add_addr_received(struct m + mptcp_pm_add_addr_send_ack(msk); + } else if (mptcp_pm_schedule_work(msk, MPTCP_PM_ADD_ADDR_RECEIVED)) { + pm->remote = *addr; ++ } else { ++ __MPTCP_INC_STATS(sock_net((struct sock *)msk), MPTCP_MIB_ADDADDRDROP); + } + + spin_unlock_bh(&pm->lock); +@@ -234,8 +236,10 @@ void mptcp_pm_rm_addr_received(struct mp + mptcp_event_addr_removed(msk, rm_list->ids[i]); + + spin_lock_bh(&pm->lock); +- mptcp_pm_schedule_work(msk, MPTCP_PM_RM_ADDR_RECEIVED); +- pm->rm_list_rx = *rm_list; ++ if (mptcp_pm_schedule_work(msk, MPTCP_PM_RM_ADDR_RECEIVED)) ++ pm->rm_list_rx = *rm_list; ++ else ++ __MPTCP_INC_STATS(sock_net((struct sock *)msk), MPTCP_MIB_RMADDRDROP); + spin_unlock_bh(&pm->lock); + } + diff --git a/queue-5.16/mptcp-fix-race-in-incoming-add_addr-option-processing.patch b/queue-5.16/mptcp-fix-race-in-incoming-add_addr-option-processing.patch new file mode 100644 index 00000000000..b1834ed37ca --- /dev/null +++ b/queue-5.16/mptcp-fix-race-in-incoming-add_addr-option-processing.patch @@ -0,0 +1,76 @@ +From 837cf45df163a3780bc04b555700231e95b31dc9 Mon Sep 17 00:00:00 2001 +From: Paolo Abeni +Date: Fri, 18 Feb 2022 13:35:41 -0800 +Subject: mptcp: fix race in incoming ADD_ADDR option processing + +From: Paolo Abeni + +commit 837cf45df163a3780bc04b555700231e95b31dc9 upstream. + +If an MPTCP endpoint received multiple consecutive incoming +ADD_ADDR options, mptcp_pm_add_addr_received() can overwrite +the current remote address value after the PM lock is released +in mptcp_pm_nl_add_addr_received() and before such address +is echoed. + +Fix the issue caching the remote address value a little earlier +and always using the cached value after releasing the PM lock. + +Fixes: f7efc7771eac ("mptcp: drop argument port from mptcp_pm_announce_addr") +Reviewed-by: Matthieu Baerts +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/pm_netlink.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -606,6 +606,7 @@ static void mptcp_pm_nl_add_addr_receive + unsigned int add_addr_accept_max; + struct mptcp_addr_info remote; + unsigned int subflows_max; ++ bool reset_port = false; + int i, nr; + + add_addr_accept_max = mptcp_pm_get_add_addr_accept_max(msk); +@@ -615,15 +616,19 @@ static void mptcp_pm_nl_add_addr_receive + msk->pm.add_addr_accepted, add_addr_accept_max, + msk->pm.remote.family); + +- if (lookup_subflow_by_daddr(&msk->conn_list, &msk->pm.remote)) ++ remote = msk->pm.remote; ++ if (lookup_subflow_by_daddr(&msk->conn_list, &remote)) + goto add_addr_echo; + ++ /* pick id 0 port, if none is provided the remote address */ ++ if (!remote.port) { ++ reset_port = true; ++ remote.port = sk->sk_dport; ++ } ++ + /* connect to the specified remote address, using whatever + * local address the routing configuration will pick. + */ +- remote = msk->pm.remote; +- if (!remote.port) +- remote.port = sk->sk_dport; + nr = fill_local_addresses_vec(msk, addrs); + + msk->pm.add_addr_accepted++; +@@ -636,8 +641,12 @@ static void mptcp_pm_nl_add_addr_receive + __mptcp_subflow_connect(sk, &addrs[i], &remote); + spin_lock_bh(&msk->pm.lock); + ++ /* be sure to echo exactly the received address */ ++ if (reset_port) ++ remote.port = 0; ++ + add_addr_echo: +- mptcp_pm_announce_addr(msk, &msk->pm.remote, true); ++ mptcp_pm_announce_addr(msk, &remote, true); + mptcp_pm_nl_addr_send_ack(msk); + } + diff --git a/queue-5.16/net-__pskb_pull_tail-pskb_carve_frag_list-drop_monitor-friends.patch b/queue-5.16/net-__pskb_pull_tail-pskb_carve_frag_list-drop_monitor-friends.patch new file mode 100644 index 00000000000..2c2a1fa8c9f --- /dev/null +++ b/queue-5.16/net-__pskb_pull_tail-pskb_carve_frag_list-drop_monitor-friends.patch @@ -0,0 +1,42 @@ +From ef527f968ae05c6717c39f49c8709a7e2c19183a Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Sun, 20 Feb 2022 07:40:52 -0800 +Subject: net: __pskb_pull_tail() & pskb_carve_frag_list() drop_monitor friends + +From: Eric Dumazet + +commit ef527f968ae05c6717c39f49c8709a7e2c19183a upstream. + +Whenever one of these functions pull all data from an skb in a frag_list, +use consume_skb() instead of kfree_skb() to avoid polluting drop +monitoring. + +Fixes: 6fa01ccd8830 ("skbuff: Add pskb_extract() helper function") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20220220154052.1308469-1-eric.dumazet@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/core/skbuff.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -2254,7 +2254,7 @@ void *__pskb_pull_tail(struct sk_buff *s + /* Free pulled out fragments. */ + while ((list = skb_shinfo(skb)->frag_list) != insp) { + skb_shinfo(skb)->frag_list = list->next; +- kfree_skb(list); ++ consume_skb(list); + } + /* And insert new clone at head. */ + if (clone) { +@@ -6227,7 +6227,7 @@ static int pskb_carve_frag_list(struct s + /* Free pulled out fragments. */ + while ((list = shinfo->frag_list) != insp) { + shinfo->frag_list = list->next; +- kfree_skb(list); ++ consume_skb(list); + } + /* And insert new clone at head. */ + if (clone) { diff --git a/queue-5.16/net-dsa-avoid-call-to-__dev_set_promiscuity-while-rtnl_mutex-isn-t-held.patch b/queue-5.16/net-dsa-avoid-call-to-__dev_set_promiscuity-while-rtnl_mutex-isn-t-held.patch new file mode 100644 index 00000000000..1aa5c060a7b --- /dev/null +++ b/queue-5.16/net-dsa-avoid-call-to-__dev_set_promiscuity-while-rtnl_mutex-isn-t-held.patch @@ -0,0 +1,119 @@ +From 8940e6b669ca1196ce0a0549c819078096390f76 Mon Sep 17 00:00:00 2001 +From: Vladimir Oltean +Date: Fri, 18 Feb 2022 14:13:02 +0200 +Subject: net: dsa: avoid call to __dev_set_promiscuity() while rtnl_mutex isn't held + +From: Vladimir Oltean + +commit 8940e6b669ca1196ce0a0549c819078096390f76 upstream. + +If the DSA master doesn't support IFF_UNICAST_FLT, then the following +call path is possible: + +dsa_slave_switchdev_event_work +-> dsa_port_host_fdb_add + -> dev_uc_add + -> __dev_set_rx_mode + -> __dev_set_promiscuity + +Since the blamed commit, dsa_slave_switchdev_event_work() no longer +holds rtnl_lock(), which triggers the ASSERT_RTNL() from +__dev_set_promiscuity(). + +Taking rtnl_lock() around dev_uc_add() is impossible, because all the +code paths that call dsa_flush_workqueue() do so from contexts where the +rtnl_mutex is already held - so this would lead to an instant deadlock. + +dev_uc_add() in itself doesn't require the rtnl_mutex for protection. +There is this comment in __dev_set_rx_mode() which assumes so: + + /* Unicast addresses changes may only happen under the rtnl, + * therefore calling __dev_set_promiscuity here is safe. + */ + +but it is from commit 4417da668c00 ("[NET]: dev: secondary unicast +address support") dated June 2007, and in the meantime, commit +f1f28aa3510d ("netdev: Add addr_list_lock to struct net_device."), dated +July 2008, has added &dev->addr_list_lock to protect this instead of the +global rtnl_mutex. + +Nonetheless, __dev_set_promiscuity() does assume rtnl_mutex protection, +but it is the uncommon path of what we typically expect dev_uc_add() +to do. So since only the uncommon path requires rtnl_lock(), just check +ahead of time whether dev_uc_add() would result into a call to +__dev_set_promiscuity(), and handle that condition separately. + +DSA already configures the master interface to be promiscuous if the +tagger requires this. We can extend this to also cover the case where +the master doesn't handle dev_uc_add() (doesn't support IFF_UNICAST_FLT), +and on the premise that we'd end up making it promiscuous during +operation anyway, either if a DSA slave has a non-inherited MAC address, +or if the bridge notifies local FDB entries for its own MAC address, the +address of a station learned on a foreign port, etc. + +Fixes: 0faf890fc519 ("net: dsa: drop rtnl_lock from dsa_slave_switchdev_event_work") +Reported-by: Oleksij Rempel +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/dsa/master.c | 7 ++++++- + net/dsa/port.c | 20 ++++++++++++++------ + 2 files changed, 20 insertions(+), 7 deletions(-) + +--- a/net/dsa/master.c ++++ b/net/dsa/master.c +@@ -260,11 +260,16 @@ static void dsa_netdev_ops_set(struct ne + dev->dsa_ptr->netdev_ops = ops; + } + ++/* Keep the master always promiscuous if the tagging protocol requires that ++ * (garbles MAC DA) or if it doesn't support unicast filtering, case in which ++ * it would revert to promiscuous mode as soon as we call dev_uc_add() on it ++ * anyway. ++ */ + static void dsa_master_set_promiscuity(struct net_device *dev, int inc) + { + const struct dsa_device_ops *ops = dev->dsa_ptr->tag_ops; + +- if (!ops->promisc_on_master) ++ if ((dev->priv_flags & IFF_UNICAST_FLT) && !ops->promisc_on_master) + return; + + rtnl_lock(); +--- a/net/dsa/port.c ++++ b/net/dsa/port.c +@@ -777,9 +777,15 @@ int dsa_port_host_fdb_add(struct dsa_por + struct dsa_port *cpu_dp = dp->cpu_dp; + int err; + +- err = dev_uc_add(cpu_dp->master, addr); +- if (err) +- return err; ++ /* Avoid a call to __dev_set_promiscuity() on the master, which ++ * requires rtnl_lock(), since we can't guarantee that is held here, ++ * and we can't take it either. ++ */ ++ if (cpu_dp->master->priv_flags & IFF_UNICAST_FLT) { ++ err = dev_uc_add(cpu_dp->master, addr); ++ if (err) ++ return err; ++ } + + return dsa_port_notify(dp, DSA_NOTIFIER_HOST_FDB_ADD, &info); + } +@@ -796,9 +802,11 @@ int dsa_port_host_fdb_del(struct dsa_por + struct dsa_port *cpu_dp = dp->cpu_dp; + int err; + +- err = dev_uc_del(cpu_dp->master, addr); +- if (err) +- return err; ++ if (cpu_dp->master->priv_flags & IFF_UNICAST_FLT) { ++ err = dev_uc_del(cpu_dp->master, addr); ++ if (err) ++ return err; ++ } + + return dsa_port_notify(dp, DSA_NOTIFIER_HOST_FDB_DEL, &info); + } diff --git a/queue-5.16/net-force-inlining-of-checksum-functions-in-net-checksum.h.patch b/queue-5.16/net-force-inlining-of-checksum-functions-in-net-checksum.h.patch new file mode 100644 index 00000000000..948ad551a99 --- /dev/null +++ b/queue-5.16/net-force-inlining-of-checksum-functions-in-net-checksum.h.patch @@ -0,0 +1,248 @@ +From 5486f5bf790b5c664913076c3194b8f916a5c7ad Mon Sep 17 00:00:00 2001 +From: Christophe Leroy +Date: Thu, 17 Feb 2022 14:35:49 +0100 +Subject: net: Force inlining of checksum functions in net/checksum.h + +From: Christophe Leroy + +commit 5486f5bf790b5c664913076c3194b8f916a5c7ad upstream. + +All functions defined as static inline in net/checksum.h are +meant to be inlined for performance reason. + +But since commit ac7c3e4ff401 ("compiler: enable +CONFIG_OPTIMIZE_INLINING forcibly") the compiler is allowed to +uninline functions when it wants. + +Fair enough in the general case, but for tiny performance critical +checksum helpers that's counter-productive. + +The problem mainly arises when selecting CONFIG_CC_OPTIMISE_FOR_SIZE, +Those helpers being 'static inline' in header files you suddenly find +them duplicated many times in the resulting vmlinux. + +Here is a typical exemple when building powerpc pmac32_defconfig +with CONFIG_CC_OPTIMISE_FOR_SIZE. csum_sub() appears 4 times: + + c04a23cc : + c04a23cc: 7c 84 20 f8 not r4,r4 + c04a23d0: 7c 63 20 14 addc r3,r3,r4 + c04a23d4: 7c 63 01 94 addze r3,r3 + c04a23d8: 4e 80 00 20 blr + ... + c04a2ce8: 4b ff f6 e5 bl c04a23cc + ... + c04a2d2c: 4b ff f6 a1 bl c04a23cc + ... + c04a2d54: 4b ff f6 79 bl c04a23cc + ... + c04a754c : + c04a754c: 7c 84 20 f8 not r4,r4 + c04a7550: 7c 63 20 14 addc r3,r3,r4 + c04a7554: 7c 63 01 94 addze r3,r3 + c04a7558: 4e 80 00 20 blr + ... + c04ac930: 4b ff ac 1d bl c04a754c + ... + c04ad264: 4b ff a2 e9 bl c04a754c + ... + c04e3b08 : + c04e3b08: 7c 84 20 f8 not r4,r4 + c04e3b0c: 7c 63 20 14 addc r3,r3,r4 + c04e3b10: 7c 63 01 94 addze r3,r3 + c04e3b14: 4e 80 00 20 blr + ... + c04e5788: 4b ff e3 81 bl c04e3b08 + ... + c04e65c8: 4b ff d5 41 bl c04e3b08 + ... + c0512d34 : + c0512d34: 7c 84 20 f8 not r4,r4 + c0512d38: 7c 63 20 14 addc r3,r3,r4 + c0512d3c: 7c 63 01 94 addze r3,r3 + c0512d40: 4e 80 00 20 blr + ... + c0512dfc: 4b ff ff 39 bl c0512d34 + ... + c05138bc: 4b ff f4 79 bl c0512d34 + ... + +Restore the expected behaviour by using __always_inline for all +functions defined in net/checksum.h + +vmlinux size is even reduced by 256 bytes with this patch: + + text data bss dec hex filename + 6980022 2515362 194384 9689768 93daa8 vmlinux.before + 6979862 2515266 194384 9689512 93d9a8 vmlinux.now + +Fixes: ac7c3e4ff401 ("compiler: enable CONFIG_OPTIMIZE_INLINING forcibly") +Cc: Masahiro Yamada +Cc: Nick Desaulniers +Cc: Andrew Morton +Signed-off-by: Christophe Leroy +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/checksum.h | 45 +++++++++++++++++++++++---------------------- + 1 file changed, 23 insertions(+), 22 deletions(-) + +--- a/include/net/checksum.h ++++ b/include/net/checksum.h +@@ -22,7 +22,7 @@ + #include + + #ifndef _HAVE_ARCH_COPY_AND_CSUM_FROM_USER +-static inline ++static __always_inline + __wsum csum_and_copy_from_user (const void __user *src, void *dst, + int len) + { +@@ -33,7 +33,7 @@ __wsum csum_and_copy_from_user (const vo + #endif + + #ifndef HAVE_CSUM_COPY_USER +-static __inline__ __wsum csum_and_copy_to_user ++static __always_inline __wsum csum_and_copy_to_user + (const void *src, void __user *dst, int len) + { + __wsum sum = csum_partial(src, len, ~0U); +@@ -45,7 +45,7 @@ static __inline__ __wsum csum_and_copy_t + #endif + + #ifndef _HAVE_ARCH_CSUM_AND_COPY +-static inline __wsum ++static __always_inline __wsum + csum_partial_copy_nocheck(const void *src, void *dst, int len) + { + memcpy(dst, src, len); +@@ -54,7 +54,7 @@ csum_partial_copy_nocheck(const void *sr + #endif + + #ifndef HAVE_ARCH_CSUM_ADD +-static inline __wsum csum_add(__wsum csum, __wsum addend) ++static __always_inline __wsum csum_add(__wsum csum, __wsum addend) + { + u32 res = (__force u32)csum; + res += (__force u32)addend; +@@ -62,12 +62,12 @@ static inline __wsum csum_add(__wsum csu + } + #endif + +-static inline __wsum csum_sub(__wsum csum, __wsum addend) ++static __always_inline __wsum csum_sub(__wsum csum, __wsum addend) + { + return csum_add(csum, ~addend); + } + +-static inline __sum16 csum16_add(__sum16 csum, __be16 addend) ++static __always_inline __sum16 csum16_add(__sum16 csum, __be16 addend) + { + u16 res = (__force u16)csum; + +@@ -75,12 +75,12 @@ static inline __sum16 csum16_add(__sum16 + return (__force __sum16)(res + (res < (__force u16)addend)); + } + +-static inline __sum16 csum16_sub(__sum16 csum, __be16 addend) ++static __always_inline __sum16 csum16_sub(__sum16 csum, __be16 addend) + { + return csum16_add(csum, ~addend); + } + +-static inline __wsum csum_shift(__wsum sum, int offset) ++static __always_inline __wsum csum_shift(__wsum sum, int offset) + { + /* rotate sum to align it with a 16b boundary */ + if (offset & 1) +@@ -88,42 +88,43 @@ static inline __wsum csum_shift(__wsum s + return sum; + } + +-static inline __wsum ++static __always_inline __wsum + csum_block_add(__wsum csum, __wsum csum2, int offset) + { + return csum_add(csum, csum_shift(csum2, offset)); + } + +-static inline __wsum ++static __always_inline __wsum + csum_block_add_ext(__wsum csum, __wsum csum2, int offset, int len) + { + return csum_block_add(csum, csum2, offset); + } + +-static inline __wsum ++static __always_inline __wsum + csum_block_sub(__wsum csum, __wsum csum2, int offset) + { + return csum_block_add(csum, ~csum2, offset); + } + +-static inline __wsum csum_unfold(__sum16 n) ++static __always_inline __wsum csum_unfold(__sum16 n) + { + return (__force __wsum)n; + } + +-static inline __wsum csum_partial_ext(const void *buff, int len, __wsum sum) ++static __always_inline ++__wsum csum_partial_ext(const void *buff, int len, __wsum sum) + { + return csum_partial(buff, len, sum); + } + + #define CSUM_MANGLED_0 ((__force __sum16)0xffff) + +-static inline void csum_replace_by_diff(__sum16 *sum, __wsum diff) ++static __always_inline void csum_replace_by_diff(__sum16 *sum, __wsum diff) + { + *sum = csum_fold(csum_add(diff, ~csum_unfold(*sum))); + } + +-static inline void csum_replace4(__sum16 *sum, __be32 from, __be32 to) ++static __always_inline void csum_replace4(__sum16 *sum, __be32 from, __be32 to) + { + __wsum tmp = csum_sub(~csum_unfold(*sum), (__force __wsum)from); + +@@ -136,7 +137,7 @@ static inline void csum_replace4(__sum16 + * m : old value of a 16bit field + * m' : new value of a 16bit field + */ +-static inline void csum_replace2(__sum16 *sum, __be16 old, __be16 new) ++static __always_inline void csum_replace2(__sum16 *sum, __be16 old, __be16 new) + { + *sum = ~csum16_add(csum16_sub(~(*sum), old), new); + } +@@ -155,16 +156,16 @@ void inet_proto_csum_replace16(__sum16 * + void inet_proto_csum_replace_by_diff(__sum16 *sum, struct sk_buff *skb, + __wsum diff, bool pseudohdr); + +-static inline void inet_proto_csum_replace2(__sum16 *sum, struct sk_buff *skb, +- __be16 from, __be16 to, +- bool pseudohdr) ++static __always_inline ++void inet_proto_csum_replace2(__sum16 *sum, struct sk_buff *skb, ++ __be16 from, __be16 to, bool pseudohdr) + { + inet_proto_csum_replace4(sum, skb, (__force __be32)from, + (__force __be32)to, pseudohdr); + } + +-static inline __wsum remcsum_adjust(void *ptr, __wsum csum, +- int start, int offset) ++static __always_inline __wsum remcsum_adjust(void *ptr, __wsum csum, ++ int start, int offset) + { + __sum16 *psum = (__sum16 *)(ptr + offset); + __wsum delta; +@@ -180,7 +181,7 @@ static inline __wsum remcsum_adjust(void + return delta; + } + +-static inline void remcsum_unadjust(__sum16 *psum, __wsum delta) ++static __always_inline void remcsum_unadjust(__sum16 *psum, __wsum delta) + { + *psum = csum_fold(csum_sub(delta, (__force __wsum)*psum)); + } diff --git a/queue-5.16/net-ll_temac-check-the-return-value-of-devm_kmalloc.patch b/queue-5.16/net-ll_temac-check-the-return-value-of-devm_kmalloc.patch new file mode 100644 index 00000000000..2d6b460f796 --- /dev/null +++ b/queue-5.16/net-ll_temac-check-the-return-value-of-devm_kmalloc.patch @@ -0,0 +1,33 @@ +From b352c3465bb808ab700d03f5bac2f7a6f37c5350 Mon Sep 17 00:00:00 2001 +From: Xiaoke Wang +Date: Fri, 18 Feb 2022 10:19:39 +0800 +Subject: net: ll_temac: check the return value of devm_kmalloc() + +From: Xiaoke Wang + +commit b352c3465bb808ab700d03f5bac2f7a6f37c5350 upstream. + +devm_kmalloc() returns a pointer to allocated memory on success, NULL +on failure. While lp->indirect_lock is allocated by devm_kmalloc() +without proper check. It is better to check the value of it to +prevent potential wrong memory access. + +Fixes: f14f5c11f051 ("net: ll_temac: Support indirect_mutex share within TEMAC IP") +Signed-off-by: Xiaoke Wang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/xilinx/ll_temac_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ethernet/xilinx/ll_temac_main.c ++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c +@@ -1427,6 +1427,8 @@ static int temac_probe(struct platform_d + lp->indirect_lock = devm_kmalloc(&pdev->dev, + sizeof(*lp->indirect_lock), + GFP_KERNEL); ++ if (!lp->indirect_lock) ++ return -ENOMEM; + spin_lock_init(lp->indirect_lock); + } + diff --git a/queue-5.16/net-mdio-ipq4019-add-delay-after-clock-enable.patch b/queue-5.16/net-mdio-ipq4019-add-delay-after-clock-enable.patch new file mode 100644 index 00000000000..02b937a3060 --- /dev/null +++ b/queue-5.16/net-mdio-ipq4019-add-delay-after-clock-enable.patch @@ -0,0 +1,44 @@ +From b6ad6261d27708567b309fdb3102b12c42a070cc Mon Sep 17 00:00:00 2001 +From: Baruch Siach +Date: Mon, 21 Feb 2022 13:45:57 +0200 +Subject: net: mdio-ipq4019: add delay after clock enable + +From: Baruch Siach + +commit b6ad6261d27708567b309fdb3102b12c42a070cc upstream. + +Experimentation shows that PHY detect might fail when the code attempts +MDIO bus read immediately after clock enable. Add delay to stabilize the +clock before bus access. + +PHY detect failure started to show after commit 7590fc6f80ac ("net: +mdio: Demote probed message to debug print") that removed coincidental +delay between clock enable and bus access. + +10ms is meant to match the time it take to send the probed message over +UART at 115200 bps. This might be a far overshoot. + +Fixes: 23a890d493e3 ("net: mdio: Add the reset function for IPQ MDIO driver") +Signed-off-by: Baruch Siach +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/mdio/mdio-ipq4019.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/net/mdio/mdio-ipq4019.c ++++ b/drivers/net/mdio/mdio-ipq4019.c +@@ -200,7 +200,11 @@ static int ipq_mdio_reset(struct mii_bus + if (ret) + return ret; + +- return clk_prepare_enable(priv->mdio_clk); ++ ret = clk_prepare_enable(priv->mdio_clk); ++ if (ret == 0) ++ mdelay(10); ++ ++ return ret; + } + + static int ipq4019_mdio_probe(struct platform_device *pdev) diff --git a/queue-5.16/net-mlx5-dr-cache-ste-shadow-memory.patch b/queue-5.16/net-mlx5-dr-cache-ste-shadow-memory.patch new file mode 100644 index 00000000000..d8da3d9a64e --- /dev/null +++ b/queue-5.16/net-mlx5-dr-cache-ste-shadow-memory.patch @@ -0,0 +1,214 @@ +From e5b2bc30c21139ae10f0e56989389d0bc7b7b1d6 Mon Sep 17 00:00:00 2001 +From: Yevgeny Kliteynik +Date: Fri, 24 Dec 2021 01:07:30 +0200 +Subject: net/mlx5: DR, Cache STE shadow memory + +From: Yevgeny Kliteynik + +commit e5b2bc30c21139ae10f0e56989389d0bc7b7b1d6 upstream. + +During rule insertion on each ICM memory chunk we also allocate shadow memory +used for management. This includes the hw_ste, dr_ste and miss list per entry. +Since the scale of these allocations is large we noticed a performance hiccup +that happens once malloc and free are stressed. +In extreme usecases when ~1M chunks are freed at once, it might take up to 40 +seconds to complete this, up to the point the kernel sees this as self-detected +stall on CPU: + + rcu: INFO: rcu_sched self-detected stall on CPU + +To resolve this we will increase the reuse of shadow memory. +Doing this we see that a time in the aforementioned usecase dropped from ~40 +seconds to ~8-10 seconds. + +Fixes: 29cf8febd185 ("net/mlx5: DR, ICM pool memory allocator") +Signed-off-by: Alex Vesker +Signed-off-by: Yevgeny Kliteynik +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/steering/dr_icm_pool.c | 109 ++++++---- + drivers/net/ethernet/mellanox/mlx5/core/steering/mlx5dr.h | 5 + 2 files changed, 79 insertions(+), 35 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_icm_pool.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_icm_pool.c +@@ -136,37 +136,35 @@ static void dr_icm_pool_mr_destroy(struc + kvfree(icm_mr); + } + +-static int dr_icm_chunk_ste_init(struct mlx5dr_icm_chunk *chunk) ++static int dr_icm_buddy_get_ste_size(struct mlx5dr_icm_buddy_mem *buddy) + { +- chunk->ste_arr = kvzalloc(chunk->num_of_entries * +- sizeof(chunk->ste_arr[0]), GFP_KERNEL); +- if (!chunk->ste_arr) +- return -ENOMEM; +- +- chunk->hw_ste_arr = kvzalloc(chunk->num_of_entries * +- DR_STE_SIZE_REDUCED, GFP_KERNEL); +- if (!chunk->hw_ste_arr) +- goto out_free_ste_arr; +- +- chunk->miss_list = kvmalloc(chunk->num_of_entries * +- sizeof(chunk->miss_list[0]), GFP_KERNEL); +- if (!chunk->miss_list) +- goto out_free_hw_ste_arr; ++ /* We support only one type of STE size, both for ConnectX-5 and later ++ * devices. Once the support for match STE which has a larger tag is ++ * added (32B instead of 16B), the STE size for devices later than ++ * ConnectX-5 needs to account for that. ++ */ ++ return DR_STE_SIZE_REDUCED; ++} + +- return 0; ++static void dr_icm_chunk_ste_init(struct mlx5dr_icm_chunk *chunk, int offset) ++{ ++ struct mlx5dr_icm_buddy_mem *buddy = chunk->buddy_mem; ++ int index = offset / DR_STE_SIZE; + +-out_free_hw_ste_arr: +- kvfree(chunk->hw_ste_arr); +-out_free_ste_arr: +- kvfree(chunk->ste_arr); +- return -ENOMEM; ++ chunk->ste_arr = &buddy->ste_arr[index]; ++ chunk->miss_list = &buddy->miss_list[index]; ++ chunk->hw_ste_arr = buddy->hw_ste_arr + ++ index * dr_icm_buddy_get_ste_size(buddy); + } + + static void dr_icm_chunk_ste_cleanup(struct mlx5dr_icm_chunk *chunk) + { +- kvfree(chunk->miss_list); +- kvfree(chunk->hw_ste_arr); +- kvfree(chunk->ste_arr); ++ struct mlx5dr_icm_buddy_mem *buddy = chunk->buddy_mem; ++ ++ memset(chunk->hw_ste_arr, 0, ++ chunk->num_of_entries * dr_icm_buddy_get_ste_size(buddy)); ++ memset(chunk->ste_arr, 0, ++ chunk->num_of_entries * sizeof(chunk->ste_arr[0])); + } + + static enum mlx5dr_icm_type +@@ -189,6 +187,44 @@ static void dr_icm_chunk_destroy(struct + kvfree(chunk); + } + ++static int dr_icm_buddy_init_ste_cache(struct mlx5dr_icm_buddy_mem *buddy) ++{ ++ int num_of_entries = ++ mlx5dr_icm_pool_chunk_size_to_entries(buddy->pool->max_log_chunk_sz); ++ ++ buddy->ste_arr = kvcalloc(num_of_entries, ++ sizeof(struct mlx5dr_ste), GFP_KERNEL); ++ if (!buddy->ste_arr) ++ return -ENOMEM; ++ ++ /* Preallocate full STE size on non-ConnectX-5 devices since ++ * we need to support both full and reduced with the same cache. ++ */ ++ buddy->hw_ste_arr = kvcalloc(num_of_entries, ++ dr_icm_buddy_get_ste_size(buddy), GFP_KERNEL); ++ if (!buddy->hw_ste_arr) ++ goto free_ste_arr; ++ ++ buddy->miss_list = kvmalloc(num_of_entries * sizeof(struct list_head), GFP_KERNEL); ++ if (!buddy->miss_list) ++ goto free_hw_ste_arr; ++ ++ return 0; ++ ++free_hw_ste_arr: ++ kvfree(buddy->hw_ste_arr); ++free_ste_arr: ++ kvfree(buddy->ste_arr); ++ return -ENOMEM; ++} ++ ++static void dr_icm_buddy_cleanup_ste_cache(struct mlx5dr_icm_buddy_mem *buddy) ++{ ++ kvfree(buddy->ste_arr); ++ kvfree(buddy->hw_ste_arr); ++ kvfree(buddy->miss_list); ++} ++ + static int dr_icm_buddy_create(struct mlx5dr_icm_pool *pool) + { + struct mlx5dr_icm_buddy_mem *buddy; +@@ -208,11 +244,19 @@ static int dr_icm_buddy_create(struct ml + buddy->icm_mr = icm_mr; + buddy->pool = pool; + ++ if (pool->icm_type == DR_ICM_TYPE_STE) { ++ /* Reduce allocations by preallocating and reusing the STE structures */ ++ if (dr_icm_buddy_init_ste_cache(buddy)) ++ goto err_cleanup_buddy; ++ } ++ + /* add it to the -start- of the list in order to search in it first */ + list_add(&buddy->list_node, &pool->buddy_mem_list); + + return 0; + ++err_cleanup_buddy: ++ mlx5dr_buddy_cleanup(buddy); + err_free_buddy: + kvfree(buddy); + free_mr: +@@ -234,6 +278,9 @@ static void dr_icm_buddy_destroy(struct + + mlx5dr_buddy_cleanup(buddy); + ++ if (buddy->pool->icm_type == DR_ICM_TYPE_STE) ++ dr_icm_buddy_cleanup_ste_cache(buddy); ++ + kvfree(buddy); + } + +@@ -261,26 +308,18 @@ dr_icm_chunk_create(struct mlx5dr_icm_po + chunk->byte_size = + mlx5dr_icm_pool_chunk_size_to_byte(chunk_size, pool->icm_type); + chunk->seg = seg; ++ chunk->buddy_mem = buddy_mem_pool; + +- if (pool->icm_type == DR_ICM_TYPE_STE && dr_icm_chunk_ste_init(chunk)) { +- mlx5dr_err(pool->dmn, +- "Failed to init ste arrays (order: %d)\n", +- chunk_size); +- goto out_free_chunk; +- } ++ if (pool->icm_type == DR_ICM_TYPE_STE) ++ dr_icm_chunk_ste_init(chunk, offset); + + buddy_mem_pool->used_memory += chunk->byte_size; +- chunk->buddy_mem = buddy_mem_pool; + INIT_LIST_HEAD(&chunk->chunk_list); + + /* chunk now is part of the used_list */ + list_add_tail(&chunk->chunk_list, &buddy_mem_pool->used_list); + + return chunk; +- +-out_free_chunk: +- kvfree(chunk); +- return NULL; + } + + static bool dr_icm_pool_is_sync_required(struct mlx5dr_icm_pool *pool) +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/mlx5dr.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/mlx5dr.h +@@ -160,6 +160,11 @@ struct mlx5dr_icm_buddy_mem { + * sync_ste command sets them free. + */ + struct list_head hot_list; ++ ++ /* Memory optimisation */ ++ struct mlx5dr_ste *ste_arr; ++ struct list_head *miss_list; ++ u8 *hw_ste_arr; + }; + + int mlx5dr_buddy_init(struct mlx5dr_icm_buddy_mem *buddy, diff --git a/queue-5.16/net-mlx5-dr-don-t-allow-match-on-ip-w-o-matching-on-full-ethertype-ip_version.patch b/queue-5.16/net-mlx5-dr-don-t-allow-match-on-ip-w-o-matching-on-full-ethertype-ip_version.patch new file mode 100644 index 00000000000..f0d34683e4d --- /dev/null +++ b/queue-5.16/net-mlx5-dr-don-t-allow-match-on-ip-w-o-matching-on-full-ethertype-ip_version.patch @@ -0,0 +1,145 @@ +From ffb0753b954763d94f52c901adfe58ed0d4005e6 Mon Sep 17 00:00:00 2001 +From: Yevgeny Kliteynik +Date: Thu, 13 Jan 2022 14:52:48 +0200 +Subject: net/mlx5: DR, Don't allow match on IP w/o matching on full ethertype/ip_version + +From: Yevgeny Kliteynik + +commit ffb0753b954763d94f52c901adfe58ed0d4005e6 upstream. + +Currently SMFS allows adding rule with matching on src/dst IP w/o matching +on full ethertype or ip_version, which is not supported by HW. +This patch fixes this issue and adds the check as it is done in DMFS. + +Fixes: 26d688e33f88 ("net/mlx5: DR, Add Steering entry (STE) utilities") +Signed-off-by: Yevgeny Kliteynik +Reviewed-by: Alex Vesker +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/steering/dr_matcher.c | 20 +----- + drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste.c | 32 +++++++++- + drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h | 10 +++ + 3 files changed, 45 insertions(+), 17 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_matcher.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_matcher.c +@@ -13,18 +13,6 @@ static bool dr_mask_is_dmac_set(struct m + return (spec->dmac_47_16 || spec->dmac_15_0); + } + +-static bool dr_mask_is_src_addr_set(struct mlx5dr_match_spec *spec) +-{ +- return (spec->src_ip_127_96 || spec->src_ip_95_64 || +- spec->src_ip_63_32 || spec->src_ip_31_0); +-} +- +-static bool dr_mask_is_dst_addr_set(struct mlx5dr_match_spec *spec) +-{ +- return (spec->dst_ip_127_96 || spec->dst_ip_95_64 || +- spec->dst_ip_63_32 || spec->dst_ip_31_0); +-} +- + static bool dr_mask_is_l3_base_set(struct mlx5dr_match_spec *spec) + { + return (spec->ip_protocol || spec->frag || spec->tcp_flags || +@@ -480,11 +468,11 @@ static int dr_matcher_set_ste_builders(s + &mask, inner, rx); + + if (outer_ipv == DR_RULE_IPV6) { +- if (dr_mask_is_dst_addr_set(&mask.outer)) ++ if (DR_MASK_IS_DST_IP_SET(&mask.outer)) + mlx5dr_ste_build_eth_l3_ipv6_dst(ste_ctx, &sb[idx++], + &mask, inner, rx); + +- if (dr_mask_is_src_addr_set(&mask.outer)) ++ if (DR_MASK_IS_SRC_IP_SET(&mask.outer)) + mlx5dr_ste_build_eth_l3_ipv6_src(ste_ctx, &sb[idx++], + &mask, inner, rx); + +@@ -580,11 +568,11 @@ static int dr_matcher_set_ste_builders(s + &mask, inner, rx); + + if (inner_ipv == DR_RULE_IPV6) { +- if (dr_mask_is_dst_addr_set(&mask.inner)) ++ if (DR_MASK_IS_DST_IP_SET(&mask.inner)) + mlx5dr_ste_build_eth_l3_ipv6_dst(ste_ctx, &sb[idx++], + &mask, inner, rx); + +- if (dr_mask_is_src_addr_set(&mask.inner)) ++ if (DR_MASK_IS_SRC_IP_SET(&mask.inner)) + mlx5dr_ste_build_eth_l3_ipv6_src(ste_ctx, &sb[idx++], + &mask, inner, rx); + +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste.c +@@ -602,12 +602,34 @@ int mlx5dr_ste_set_action_decap_l3_list( + used_hw_action_num); + } + ++static int dr_ste_build_pre_check_spec(struct mlx5dr_domain *dmn, ++ struct mlx5dr_match_spec *spec) ++{ ++ if (spec->ip_version) { ++ if (spec->ip_version != 0xf) { ++ mlx5dr_err(dmn, ++ "Partial ip_version mask with src/dst IP is not supported\n"); ++ return -EINVAL; ++ } ++ } else if (spec->ethertype != 0xffff && ++ (DR_MASK_IS_SRC_IP_SET(spec) || DR_MASK_IS_DST_IP_SET(spec))) { ++ mlx5dr_err(dmn, ++ "Partial/no ethertype mask with src/dst IP is not supported\n"); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + int mlx5dr_ste_build_pre_check(struct mlx5dr_domain *dmn, + u8 match_criteria, + struct mlx5dr_match_param *mask, + struct mlx5dr_match_param *value) + { +- if (!value && (match_criteria & DR_MATCHER_CRITERIA_MISC)) { ++ if (value) ++ return 0; ++ ++ if (match_criteria & DR_MATCHER_CRITERIA_MISC) { + if (mask->misc.source_port && mask->misc.source_port != 0xffff) { + mlx5dr_err(dmn, + "Partial mask source_port is not supported\n"); +@@ -621,6 +643,14 @@ int mlx5dr_ste_build_pre_check(struct ml + } + } + ++ if ((match_criteria & DR_MATCHER_CRITERIA_OUTER) && ++ dr_ste_build_pre_check_spec(dmn, &mask->outer)) ++ return -EINVAL; ++ ++ if ((match_criteria & DR_MATCHER_CRITERIA_INNER) && ++ dr_ste_build_pre_check_spec(dmn, &mask->inner)) ++ return -EINVAL; ++ + return 0; + } + +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h +@@ -739,6 +739,16 @@ struct mlx5dr_match_param { + (_misc3)->icmpv4_code || \ + (_misc3)->icmpv4_header_data) + ++#define DR_MASK_IS_SRC_IP_SET(_spec) ((_spec)->src_ip_127_96 || \ ++ (_spec)->src_ip_95_64 || \ ++ (_spec)->src_ip_63_32 || \ ++ (_spec)->src_ip_31_0) ++ ++#define DR_MASK_IS_DST_IP_SET(_spec) ((_spec)->dst_ip_127_96 || \ ++ (_spec)->dst_ip_95_64 || \ ++ (_spec)->dst_ip_63_32 || \ ++ (_spec)->dst_ip_31_0) ++ + struct mlx5dr_esw_caps { + u64 drop_icm_address_rx; + u64 drop_icm_address_tx; diff --git a/queue-5.16/net-mlx5-dr-fix-slab-out-of-bounds-in-mlx5_cmd_dr_create_fte.patch b/queue-5.16/net-mlx5-dr-fix-slab-out-of-bounds-in-mlx5_cmd_dr_create_fte.patch new file mode 100644 index 00000000000..1d233cd7b06 --- /dev/null +++ b/queue-5.16/net-mlx5-dr-fix-slab-out-of-bounds-in-mlx5_cmd_dr_create_fte.patch @@ -0,0 +1,97 @@ +From 0aec12d97b2036af0946e3d582144739860ac07b Mon Sep 17 00:00:00 2001 +From: Yevgeny Kliteynik +Date: Tue, 11 Jan 2022 03:00:03 +0200 +Subject: net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte + +From: Yevgeny Kliteynik + +commit 0aec12d97b2036af0946e3d582144739860ac07b upstream. + +When adding a rule with 32 destinations, we hit the following out-of-band +access issue: + + BUG: KASAN: slab-out-of-bounds in mlx5_cmd_dr_create_fte+0x18ee/0x1e70 + +This patch fixes the issue by both increasing the allocated buffers to +accommodate for the needed actions and by checking the number of actions +to prevent this issue when a rule with too many actions is provided. + +Fixes: 1ffd498901c1 ("net/mlx5: DR, Increase supported num of actions to 32") +Signed-off-by: Yevgeny Kliteynik +Reviewed-by: Alex Vesker +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c | 33 +++++++++++---- + 1 file changed, 26 insertions(+), 7 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c +@@ -222,7 +222,11 @@ static bool contain_vport_reformat_actio + dst->dest_attr.vport.flags & MLX5_FLOW_DEST_VPORT_REFORMAT_ID; + } + +-#define MLX5_FLOW_CONTEXT_ACTION_MAX 32 ++/* We want to support a rule with 32 destinations, which means we need to ++ * account for 32 destinations plus usually a counter plus one more action ++ * for a multi-destination flow table. ++ */ ++#define MLX5_FLOW_CONTEXT_ACTION_MAX 34 + static int mlx5_cmd_dr_create_fte(struct mlx5_flow_root_namespace *ns, + struct mlx5_flow_table *ft, + struct mlx5_flow_group *group, +@@ -392,9 +396,9 @@ static int mlx5_cmd_dr_create_fte(struct + enum mlx5_flow_destination_type type = dst->dest_attr.type; + u32 id; + +- if (num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX || +- num_term_actions >= MLX5_FLOW_CONTEXT_ACTION_MAX) { +- err = -ENOSPC; ++ if (fs_dr_num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX || ++ num_term_actions == MLX5_FLOW_CONTEXT_ACTION_MAX) { ++ err = -EOPNOTSUPP; + goto free_actions; + } + +@@ -464,8 +468,9 @@ static int mlx5_cmd_dr_create_fte(struct + MLX5_FLOW_DESTINATION_TYPE_COUNTER) + continue; + +- if (num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX) { +- err = -ENOSPC; ++ if (num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX || ++ fs_dr_num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX) { ++ err = -EOPNOTSUPP; + goto free_actions; + } + +@@ -485,14 +490,28 @@ static int mlx5_cmd_dr_create_fte(struct + params.match_sz = match_sz; + params.match_buf = (u64 *)fte->val; + if (num_term_actions == 1) { +- if (term_actions->reformat) ++ if (term_actions->reformat) { ++ if (num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX) { ++ err = -EOPNOTSUPP; ++ goto free_actions; ++ } + actions[num_actions++] = term_actions->reformat; ++ } + ++ if (num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX) { ++ err = -EOPNOTSUPP; ++ goto free_actions; ++ } + actions[num_actions++] = term_actions->dest; + } else if (num_term_actions > 1) { + bool ignore_flow_level = + !!(fte->action.flags & FLOW_ACT_IGNORE_FLOW_LEVEL); + ++ if (num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX || ++ fs_dr_num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX) { ++ err = -EOPNOTSUPP; ++ goto free_actions; ++ } + tmp_action = mlx5dr_action_create_mult_dest_tbl(domain, + term_actions, + num_term_actions, diff --git a/queue-5.16/net-mlx5-dr-fix-the-threshold-that-defines-when-pool-sync-is-initiated.patch b/queue-5.16/net-mlx5-dr-fix-the-threshold-that-defines-when-pool-sync-is-initiated.patch new file mode 100644 index 00000000000..32c90662581 --- /dev/null +++ b/queue-5.16/net-mlx5-dr-fix-the-threshold-that-defines-when-pool-sync-is-initiated.patch @@ -0,0 +1,55 @@ +From ecd9c5cd46e013659e2fad433057bad1ba66888e Mon Sep 17 00:00:00 2001 +From: Yevgeny Kliteynik +Date: Wed, 29 Dec 2021 22:22:05 +0200 +Subject: net/mlx5: DR, Fix the threshold that defines when pool sync is initiated + +From: Yevgeny Kliteynik + +commit ecd9c5cd46e013659e2fad433057bad1ba66888e upstream. + +When deciding whether to start syncing and actually free all the "hot" +ICM chunks, we need to consider the type of the ICM chunks that we're +dealing with. For instance, the amount of available ICM for MODIFY_ACTION +is significantly lower than the usual STE ICM, so the threshold should +account for that - otherwise we can deplete MODIFY_ACTION memory just by +creating and deleting the same modify header action in a continuous loop. + +This patch replaces the hard-coded threshold with a dynamic value. + +Fixes: 1c58651412bb ("net/mlx5: DR, ICM memory pools sync optimization") +Signed-off-by: Yevgeny Kliteynik +Reviewed-by: Alex Vesker +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/steering/dr_icm_pool.c | 11 ++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_icm_pool.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_icm_pool.c +@@ -4,7 +4,6 @@ + #include "dr_types.h" + + #define DR_ICM_MODIFY_HDR_ALIGN_BASE 64 +-#define DR_ICM_SYNC_THRESHOLD_POOL (64 * 1024 * 1024) + + struct mlx5dr_icm_pool { + enum mlx5dr_icm_type icm_type; +@@ -324,10 +323,14 @@ dr_icm_chunk_create(struct mlx5dr_icm_po + + static bool dr_icm_pool_is_sync_required(struct mlx5dr_icm_pool *pool) + { +- if (pool->hot_memory_size > DR_ICM_SYNC_THRESHOLD_POOL) +- return true; ++ int allow_hot_size; + +- return false; ++ /* sync when hot memory reaches half of the pool size */ ++ allow_hot_size = ++ mlx5dr_icm_pool_chunk_size_to_byte(pool->max_log_chunk_sz, ++ pool->icm_type) / 2; ++ ++ return pool->hot_memory_size > allow_hot_size; + } + + static int dr_icm_pool_sync_all_buddy_pools(struct mlx5dr_icm_pool *pool) diff --git a/queue-5.16/net-mlx5-fix-possible-deadlock-on-rule-deletion.patch b/queue-5.16/net-mlx5-fix-possible-deadlock-on-rule-deletion.patch new file mode 100644 index 00000000000..e2b811ff3ea --- /dev/null +++ b/queue-5.16/net-mlx5-fix-possible-deadlock-on-rule-deletion.patch @@ -0,0 +1,32 @@ +From b645e57debca846f51b3209907546ea857ddd3f5 Mon Sep 17 00:00:00 2001 +From: Maor Gottlieb +Date: Mon, 24 Jan 2022 21:25:04 +0200 +Subject: net/mlx5: Fix possible deadlock on rule deletion + +From: Maor Gottlieb + +commit b645e57debca846f51b3209907546ea857ddd3f5 upstream. + +Add missing call to up_write_ref_node() which releases the semaphore +in case the FTE doesn't have destinations, such in drop rule case. + +Fixes: 465e7baab6d9 ("net/mlx5: Fix deletion of duplicate rules") +Signed-off-by: Maor Gottlieb +Reviewed-by: Mark Bloch +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +@@ -2073,6 +2073,8 @@ void mlx5_del_flow_rules(struct mlx5_flo + fte->node.del_hw_func = NULL; + up_write_ref_node(&fte->node, false); + tree_put_node(&fte->node, false); ++ } else { ++ up_write_ref_node(&fte->node, false); + } + kfree(handle); + } diff --git a/queue-5.16/net-mlx5-fix-tc-max-supported-prio-for-nic-mode.patch b/queue-5.16/net-mlx5-fix-tc-max-supported-prio-for-nic-mode.patch new file mode 100644 index 00000000000..d9cce334588 --- /dev/null +++ b/queue-5.16/net-mlx5-fix-tc-max-supported-prio-for-nic-mode.patch @@ -0,0 +1,34 @@ +From be7f4b0ab149afd19514929fad824b2117d238c9 Mon Sep 17 00:00:00 2001 +From: Chris Mi +Date: Tue, 14 Dec 2021 03:52:53 +0200 +Subject: net/mlx5: Fix tc max supported prio for nic mode + +From: Chris Mi + +commit be7f4b0ab149afd19514929fad824b2117d238c9 upstream. + +Only prio 1 is supported if firmware doesn't support ignore flow +level for nic mode. The offending commit removed the check wrongly. +Add it back. + +Fixes: 9a99c8f1253a ("net/mlx5e: E-Switch, Offload all chain 0 priorities when modify header and forward action is not supported") +Signed-off-by: Chris Mi +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c +@@ -121,6 +121,9 @@ u32 mlx5_chains_get_nf_ft_chain(struct m + + u32 mlx5_chains_get_prio_range(struct mlx5_fs_chains *chains) + { ++ if (!mlx5_chains_prios_supported(chains)) ++ return 1; ++ + if (mlx5_chains_ignore_flow_level_supported(chains)) + return UINT_MAX; + diff --git a/queue-5.16/net-mlx5-fix-wrong-limitation-of-metadata-match-on-ecpf.patch b/queue-5.16/net-mlx5-fix-wrong-limitation-of-metadata-match-on-ecpf.patch new file mode 100644 index 00000000000..c9e53d1625b --- /dev/null +++ b/queue-5.16/net-mlx5-fix-wrong-limitation-of-metadata-match-on-ecpf.patch @@ -0,0 +1,36 @@ +From 07666c75ad17d7389b18ac0235c8cf41e1504ea8 Mon Sep 17 00:00:00 2001 +From: Ariel Levkovich +Date: Sat, 29 Jan 2022 01:39:24 +0200 +Subject: net/mlx5: Fix wrong limitation of metadata match on ecpf + +From: Ariel Levkovich + +commit 07666c75ad17d7389b18ac0235c8cf41e1504ea8 upstream. + +Match metadata support check returns false for ecpf device. +However, this support does exist for ecpf and therefore this +limitation should be removed to allow feature such as stacked +devices and internal port offloaded to be supported. + +Fixes: 92ab1eb392c6 ("net/mlx5: E-Switch, Enable vport metadata matching if firmware supports it") +Signed-off-by: Ariel Levkovich +Reviewed-by: Maor Dickman +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +@@ -2838,10 +2838,6 @@ bool mlx5_esw_vport_match_metadata_suppo + if (!MLX5_CAP_ESW_FLOWTABLE(esw->dev, flow_source)) + return false; + +- if (mlx5_core_is_ecpf_esw_manager(esw->dev) || +- mlx5_ecpf_vport_exists(esw->dev)) +- return false; +- + return true; + } + diff --git a/queue-5.16/net-mlx5-update-log_max_qp-value-to-be-17-at-most.patch b/queue-5.16/net-mlx5-update-log_max_qp-value-to-be-17-at-most.patch new file mode 100644 index 00000000000..669049065b1 --- /dev/null +++ b/queue-5.16/net-mlx5-update-log_max_qp-value-to-be-17-at-most.patch @@ -0,0 +1,37 @@ +From 7f839965b2d77e1926ad08b23c51d60988f10a99 Mon Sep 17 00:00:00 2001 +From: Maher Sanalla +Date: Wed, 16 Feb 2022 11:01:04 +0200 +Subject: net/mlx5: Update log_max_qp value to be 17 at most + +From: Maher Sanalla + +commit 7f839965b2d77e1926ad08b23c51d60988f10a99 upstream. + +Currently, log_max_qp value is dependent on what FW reports as its max capability. +In reality, due to a bug, some FWs report a value greater than 17, even though they +don't support log_max_qp > 17. + +This FW issue led the driver to exhaust memory on startup. +Thus, log_max_qp value is set to be no more than 17 regardless +of what FW reports, as it was before the cited commit. + +Fixes: f79a609ea6bf ("net/mlx5: Update log_max_qp value to FW max capability") +Signed-off-by: Maher Sanalla +Reviewed-by: Avihai Horon +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -510,7 +510,7 @@ static int handle_hca_cap(struct mlx5_co + + /* Check log_max_qp from HCA caps to set in current profile */ + if (prof->log_max_qp == LOG_MAX_SUPPORTED_QPS) { +- prof->log_max_qp = MLX5_CAP_GEN_MAX(dev, log_max_qp); ++ prof->log_max_qp = min_t(u8, 17, MLX5_CAP_GEN_MAX(dev, log_max_qp)); + } else if (MLX5_CAP_GEN_MAX(dev, log_max_qp) < prof->log_max_qp) { + mlx5_core_warn(dev, "log_max_qp value in current profile is %d, changing it to HCA capability limit (%d)\n", + prof->log_max_qp, diff --git a/queue-5.16/net-mlx5-update-the-list-of-the-pci-supported-devices.patch b/queue-5.16/net-mlx5-update-the-list-of-the-pci-supported-devices.patch new file mode 100644 index 00000000000..4ec7c75176c --- /dev/null +++ b/queue-5.16/net-mlx5-update-the-list-of-the-pci-supported-devices.patch @@ -0,0 +1,36 @@ +From f908a35b22180c4da64cf2647e4f5f0cd3054da7 Mon Sep 17 00:00:00 2001 +From: Meir Lichtinger +Date: Mon, 10 Jan 2022 10:14:41 +0200 +Subject: net/mlx5: Update the list of the PCI supported devices + +From: Meir Lichtinger + +commit f908a35b22180c4da64cf2647e4f5f0cd3054da7 upstream. + +Add the upcoming BlueField-4 and ConnectX-8 device IDs. + +Fixes: 2e9d3e83ab82 ("net/mlx5: Update the list of the PCI supported devices") +Signed-off-by: Meir Lichtinger +Reviewed-by: Gal Pressman +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -1796,10 +1796,12 @@ static const struct pci_device_id mlx5_c + { PCI_VDEVICE(MELLANOX, 0x101e), MLX5_PCI_DEV_IS_VF}, /* ConnectX Family mlx5Gen Virtual Function */ + { PCI_VDEVICE(MELLANOX, 0x101f) }, /* ConnectX-6 LX */ + { PCI_VDEVICE(MELLANOX, 0x1021) }, /* ConnectX-7 */ ++ { PCI_VDEVICE(MELLANOX, 0x1023) }, /* ConnectX-8 */ + { PCI_VDEVICE(MELLANOX, 0xa2d2) }, /* BlueField integrated ConnectX-5 network controller */ + { PCI_VDEVICE(MELLANOX, 0xa2d3), MLX5_PCI_DEV_IS_VF}, /* BlueField integrated ConnectX-5 network controller VF */ + { PCI_VDEVICE(MELLANOX, 0xa2d6) }, /* BlueField-2 integrated ConnectX-6 Dx network controller */ + { PCI_VDEVICE(MELLANOX, 0xa2dc) }, /* BlueField-3 integrated ConnectX-7 network controller */ ++ { PCI_VDEVICE(MELLANOX, 0xa2df) }, /* BlueField-4 integrated ConnectX-8 network controller */ + { 0, } + }; + diff --git a/queue-5.16/net-mlx5e-add-missing-increment-of-count.patch b/queue-5.16/net-mlx5e-add-missing-increment-of-count.patch new file mode 100644 index 00000000000..26b222e9b93 --- /dev/null +++ b/queue-5.16/net-mlx5e-add-missing-increment-of-count.patch @@ -0,0 +1,52 @@ +From 5ee02b7a800654ff9549807bcf0b4c9fd5cf25f9 Mon Sep 17 00:00:00 2001 +From: Lama Kayal +Date: Mon, 21 Feb 2022 12:26:11 +0200 +Subject: net/mlx5e: Add missing increment of count + +From: Lama Kayal + +commit 5ee02b7a800654ff9549807bcf0b4c9fd5cf25f9 upstream. + +Add mistakenly missing increment of count variable when looping over +output buffer in mlx5e_self_test(). + +This resolves the issue of garbage values output when querying with self +test via ethtool. + +before: +$ ethtool -t eth2 +The test result is PASS +The test extra info: +Link Test 0 +Speed Test 1768697188 +Health Test 758528120 +Loopback Test 3288687 + +after: +$ ethtool -t eth2 +The test result is PASS +The test extra info: +Link Test 0 +Speed Test 0 +Health Test 0 +Loopback Test 0 + +Fixes: 7990b1b5e8bd ("net/mlx5e: loopback test is not supported in switchdev mode") +Signed-off-by: Lama Kayal +Reviewed-by: Gal Pressman +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c +@@ -334,6 +334,7 @@ void mlx5e_self_test(struct net_device * + netdev_info(ndev, "\t[%d] %s start..\n", i, st.name); + buf[count] = st.st_func(priv); + netdev_info(ndev, "\t[%d] %s end: result(%lld)\n", i, st.name, buf[count]); ++ count++; + } + + mutex_unlock(&priv->state_lock); diff --git a/queue-5.16/net-mlx5e-fix-wrong-return-value-on-ioctl-eeprom-query-failure.patch b/queue-5.16/net-mlx5e-fix-wrong-return-value-on-ioctl-eeprom-query-failure.patch new file mode 100644 index 00000000000..c8ff7adc920 --- /dev/null +++ b/queue-5.16/net-mlx5e-fix-wrong-return-value-on-ioctl-eeprom-query-failure.patch @@ -0,0 +1,32 @@ +From 0b89429722353d112f8b8b29ca397e95fa994d27 Mon Sep 17 00:00:00 2001 +From: Gal Pressman +Date: Wed, 2 Feb 2022 16:07:21 +0200 +Subject: net/mlx5e: Fix wrong return value on ioctl EEPROM query failure + +From: Gal Pressman + +commit 0b89429722353d112f8b8b29ca397e95fa994d27 upstream. + +The ioctl EEPROM query wrongly returns success on read failures, fix +that by returning the appropriate error code. + +Fixes: bb64143eee8c ("net/mlx5e: Add ethtool support for dump module EEPROM") +Signed-off-by: Gal Pressman +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +@@ -1752,7 +1752,7 @@ static int mlx5e_get_module_eeprom(struc + if (size_read < 0) { + netdev_err(priv->netdev, "%s: mlx5_query_eeprom failed:0x%x\n", + __func__, size_read); +- return 0; ++ return size_read; + } + + i += size_read; diff --git a/queue-5.16/net-mlx5e-ktls-use-checksum_unnecessary-for-device-offloaded-packets.patch b/queue-5.16/net-mlx5e-ktls-use-checksum_unnecessary-for-device-offloaded-packets.patch new file mode 100644 index 00000000000..27fba876d87 --- /dev/null +++ b/queue-5.16/net-mlx5e-ktls-use-checksum_unnecessary-for-device-offloaded-packets.patch @@ -0,0 +1,43 @@ +From 7eaf1f37b8817c608c4e959d69986ef459d345cd Mon Sep 17 00:00:00 2001 +From: Tariq Toukan +Date: Mon, 31 Jan 2022 10:26:19 +0200 +Subject: net/mlx5e: kTLS, Use CHECKSUM_UNNECESSARY for device-offloaded packets + +From: Tariq Toukan + +commit 7eaf1f37b8817c608c4e959d69986ef459d345cd upstream. + +For RX TLS device-offloaded packets, the HW spec guarantees checksum +validation for the offloaded packets, but does not define whether the +CQE.checksum field matches the original packet (ciphertext) or +the decrypted one (plaintext). This latitude allows architetctural +improvements between generations of chips, resulting in different decisions +regarding the value type of CQE.checksum. + +Hence, for these packets, the device driver should not make use of this CQE +field. Here we block CHECKSUM_COMPLETE usage for RX TLS device-offloaded +packets, and use CHECKSUM_UNNECESSARY instead. + +Value of the packet's tcp_hdr.csum is not modified by the HW, and it always +matches the original ciphertext. + +Fixes: 1182f3659357 ("net/mlx5e: kTLS, Add kTLS RX HW offload support") +Signed-off-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +@@ -1348,7 +1348,8 @@ static inline void mlx5e_handle_csum(str + } + + /* True when explicitly set via priv flag, or XDP prog is loaded */ +- if (test_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &rq->state)) ++ if (test_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &rq->state) || ++ get_cqe_tls_offload(cqe)) + goto csum_unnecessary; + + /* CQE csum doesn't cover padding octets in short ethernet diff --git a/queue-5.16/net-mlx5e-mplsoudp-decap-fix-check-for-unsupported-matches.patch b/queue-5.16/net-mlx5e-mplsoudp-decap-fix-check-for-unsupported-matches.patch new file mode 100644 index 00000000000..62e02f75f22 --- /dev/null +++ b/queue-5.16/net-mlx5e-mplsoudp-decap-fix-check-for-unsupported-matches.patch @@ -0,0 +1,76 @@ +From fdc18e4e4bded2a08638cdcd22dc087a64b9ddad Mon Sep 17 00:00:00 2001 +From: Maor Dickman +Date: Thu, 6 Jan 2022 14:46:24 +0200 +Subject: net/mlx5e: MPLSoUDP decap, fix check for unsupported matches + +From: Maor Dickman + +commit fdc18e4e4bded2a08638cdcd22dc087a64b9ddad upstream. + +Currently offload of rule on bareudp device require tunnel key +in order to match on mpls fields and without it the mpls fields +are ignored, this is incorrect due to the fact udp tunnel doesn't +have key to match on. + +Fix by returning error in case flow is matching on tunnel key. + +Fixes: 72046a91d134 ("net/mlx5e: Allow to match on mpls parameters") +Signed-off-by: Maor Dickman +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_mplsoudp.c | 28 ++++------- + 1 file changed, 11 insertions(+), 17 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_mplsoudp.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_mplsoudp.c +@@ -60,37 +60,31 @@ static int parse_tunnel(struct mlx5e_pri + void *headers_v) + { + struct flow_rule *rule = flow_cls_offload_flow_rule(f); +- struct flow_match_enc_keyid enc_keyid; + struct flow_match_mpls match; + void *misc2_c; + void *misc2_v; + +- misc2_c = MLX5_ADDR_OF(fte_match_param, spec->match_criteria, +- misc_parameters_2); +- misc2_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, +- misc_parameters_2); +- +- if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_MPLS)) +- return 0; +- +- if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ENC_KEYID)) +- return 0; +- +- flow_rule_match_enc_keyid(rule, &enc_keyid); +- +- if (!enc_keyid.mask->keyid) +- return 0; +- + if (!MLX5_CAP_ETH(priv->mdev, tunnel_stateless_mpls_over_udp) && + !(MLX5_CAP_GEN(priv->mdev, flex_parser_protocols) & MLX5_FLEX_PROTO_CW_MPLS_UDP)) + return -EOPNOTSUPP; + ++ if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ENC_KEYID)) ++ return -EOPNOTSUPP; ++ ++ if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_MPLS)) ++ return 0; ++ + flow_rule_match_mpls(rule, &match); + + /* Only support matching the first LSE */ + if (match.mask->used_lses != 1) + return -EOPNOTSUPP; + ++ misc2_c = MLX5_ADDR_OF(fte_match_param, spec->match_criteria, ++ misc_parameters_2); ++ misc2_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, ++ misc_parameters_2); ++ + MLX5_SET(fte_match_set_misc2, misc2_c, + outer_first_mpls_over_udp.mpls_label, + match.mask->ls[0].mpls_label); diff --git a/queue-5.16/net-mlx5e-tc-reject-rules-with-drop-and-modify-hdr-action.patch b/queue-5.16/net-mlx5e-tc-reject-rules-with-drop-and-modify-hdr-action.patch new file mode 100644 index 00000000000..c8402f325aa --- /dev/null +++ b/queue-5.16/net-mlx5e-tc-reject-rules-with-drop-and-modify-hdr-action.patch @@ -0,0 +1,39 @@ +From 23216d387c40b090b221ad457c95912fb47eb11e Mon Sep 17 00:00:00 2001 +From: Roi Dayan +Date: Tue, 4 Jan 2022 10:38:02 +0200 +Subject: net/mlx5e: TC, Reject rules with drop and modify hdr action + +From: Roi Dayan + +commit 23216d387c40b090b221ad457c95912fb47eb11e upstream. + +This kind of action is not supported by firmware and generates a +syndrome. + +kernel: mlx5_core 0000:08:00.0: mlx5_cmd_check:777:(pid 102063): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad parameter(0x3), syndrome (0x8708c3) + +Fixes: d7e75a325cb2 ("net/mlx5e: Add offloading of E-Switch TC pedit (header re-write) actions") +Signed-off-by: Roi Dayan +Reviewed-by: Maor Dickman +Reviewed-by: Oz Shlomo +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -3440,6 +3440,12 @@ actions_match_supported(struct mlx5e_pri + } + + if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR && ++ actions & MLX5_FLOW_CONTEXT_ACTION_DROP) { ++ NL_SET_ERR_MSG_MOD(extack, "Drop with modify header action is not supported"); ++ return false; ++ } ++ ++ if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR && + !modify_header_match_supported(priv, &parse_attr->spec, flow_action, + actions, ct_flow, ct_clear, extack)) + return false; diff --git a/queue-5.16/net-mlx5e-tc-reject-rules-with-forward-and-drop-actions.patch b/queue-5.16/net-mlx5e-tc-reject-rules-with-forward-and-drop-actions.patch new file mode 100644 index 00000000000..49995eb31db --- /dev/null +++ b/queue-5.16/net-mlx5e-tc-reject-rules-with-forward-and-drop-actions.patch @@ -0,0 +1,36 @@ +From 3d65492a86d4e6675734646929759138a023d914 Mon Sep 17 00:00:00 2001 +From: Roi Dayan +Date: Mon, 17 Jan 2022 15:00:30 +0200 +Subject: net/mlx5e: TC, Reject rules with forward and drop actions + +From: Roi Dayan + +commit 3d65492a86d4e6675734646929759138a023d914 upstream. + +Such rules are redundant but allowed and passed to the driver. +The driver does not support offloading such rules so return an error. + +Fixes: 03a9d11e6eeb ("net/mlx5e: Add TC drop and mirred/redirect action parsing for SRIOV offloads") +Signed-off-by: Roi Dayan +Reviewed-by: Oz Shlomo +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -3427,6 +3427,12 @@ actions_match_supported(struct mlx5e_pri + return false; + } + ++ if (!(~actions & ++ (MLX5_FLOW_CONTEXT_ACTION_FWD_DEST | MLX5_FLOW_CONTEXT_ACTION_DROP))) { ++ NL_SET_ERR_MSG_MOD(extack, "Rule cannot support forward+drop action"); ++ return false; ++ } ++ + if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR && + actions & MLX5_FLOW_CONTEXT_ACTION_DROP) { + NL_SET_ERR_MSG_MOD(extack, "Drop with modify header action is not supported"); diff --git a/queue-5.16/net-mv643xx_eth-process-retval-from-of_get_mac_address.patch b/queue-5.16/net-mv643xx_eth-process-retval-from-of_get_mac_address.patch new file mode 100644 index 00000000000..a894c800756 --- /dev/null +++ b/queue-5.16/net-mv643xx_eth-process-retval-from-of_get_mac_address.patch @@ -0,0 +1,80 @@ +From 42404d8f1c01861b22ccfa1d70f950242720ae57 Mon Sep 17 00:00:00 2001 +From: Mauri Sandberg +Date: Wed, 23 Feb 2022 16:23:37 +0200 +Subject: net: mv643xx_eth: process retval from of_get_mac_address + +From: Mauri Sandberg + +commit 42404d8f1c01861b22ccfa1d70f950242720ae57 upstream. + +Obtaining a MAC address may be deferred in cases when the MAC is stored +in an NVMEM block, for example, and it may not be ready upon the first +retrieval attempt and return EPROBE_DEFER. + +It is also possible that a port that does not rely on NVMEM has been +already created when getting the defer request. Thus, also the resources +allocated previously must be freed when doing a roll-back. + +Fixes: 76723bca2802 ("net: mv643xx_eth: add DT parsing support") +Signed-off-by: Mauri Sandberg +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20220223142337.41757-1-maukka@ext.kapsi.fi +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/mv643xx_eth.c | 24 ++++++++++++++---------- + 1 file changed, 14 insertions(+), 10 deletions(-) + +--- a/drivers/net/ethernet/marvell/mv643xx_eth.c ++++ b/drivers/net/ethernet/marvell/mv643xx_eth.c +@@ -2700,6 +2700,16 @@ MODULE_DEVICE_TABLE(of, mv643xx_eth_shar + + static struct platform_device *port_platdev[3]; + ++static void mv643xx_eth_shared_of_remove(void) ++{ ++ int n; ++ ++ for (n = 0; n < 3; n++) { ++ platform_device_del(port_platdev[n]); ++ port_platdev[n] = NULL; ++ } ++} ++ + static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev, + struct device_node *pnp) + { +@@ -2736,7 +2746,9 @@ static int mv643xx_eth_shared_of_add_por + return -EINVAL; + } + +- of_get_mac_address(pnp, ppd.mac_addr); ++ ret = of_get_mac_address(pnp, ppd.mac_addr); ++ if (ret) ++ return ret; + + mv643xx_eth_property(pnp, "tx-queue-size", ppd.tx_queue_size); + mv643xx_eth_property(pnp, "tx-sram-addr", ppd.tx_sram_addr); +@@ -2800,21 +2812,13 @@ static int mv643xx_eth_shared_of_probe(s + ret = mv643xx_eth_shared_of_add_port(pdev, pnp); + if (ret) { + of_node_put(pnp); ++ mv643xx_eth_shared_of_remove(); + return ret; + } + } + return 0; + } + +-static void mv643xx_eth_shared_of_remove(void) +-{ +- int n; +- +- for (n = 0; n < 3; n++) { +- platform_device_del(port_platdev[n]); +- port_platdev[n] = NULL; +- } +-} + #else + static inline int mv643xx_eth_shared_of_probe(struct platform_device *pdev) + { diff --git a/queue-5.16/net-sched-act_ct-fix-flow-table-lookup-after-ct-clear-or-switching-zones.patch b/queue-5.16/net-sched-act_ct-fix-flow-table-lookup-after-ct-clear-or-switching-zones.patch new file mode 100644 index 00000000000..0f2d5052ecc --- /dev/null +++ b/queue-5.16/net-sched-act_ct-fix-flow-table-lookup-after-ct-clear-or-switching-zones.patch @@ -0,0 +1,42 @@ +From 2f131de361f6d0eaff17db26efdb844c178432f8 Mon Sep 17 00:00:00 2001 +From: Paul Blakey +Date: Thu, 17 Feb 2022 11:30:48 +0200 +Subject: net/sched: act_ct: Fix flow table lookup after ct clear or switching zones + +From: Paul Blakey + +commit 2f131de361f6d0eaff17db26efdb844c178432f8 upstream. + +Flow table lookup is skipped if packet either went through ct clear +action (which set the IP_CT_UNTRACKED flag on the packet), or while +switching zones and there is already a connection associated with +the packet. This will result in no SW offload of the connection, +and the and connection not being removed from flow table with +TCP teardown (fin/rst packet). + +To fix the above, remove these unneccary checks in flow +table lookup. + +Fixes: 46475bb20f4b ("net/sched: act_ct: Software offload of established flows") +Signed-off-by: Paul Blakey +Acked-by: Marcelo Ricardo Leitner +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/act_ct.c | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/net/sched/act_ct.c ++++ b/net/sched/act_ct.c +@@ -516,11 +516,6 @@ static bool tcf_ct_flow_table_lookup(str + struct nf_conn *ct; + u8 dir; + +- /* Previously seen or loopback */ +- ct = nf_ct_get(skb, &ctinfo); +- if ((ct && !nf_ct_is_template(ct)) || ctinfo == IP_CT_UNTRACKED) +- return false; +- + switch (family) { + case NFPROTO_IPV4: + if (!tcf_ct_flow_table_fill_tuple_ipv4(skb, &tuple, &tcph)) diff --git a/queue-5.16/net-smc-use-a-mutex-for-locking-struct-smc_pnettable.patch b/queue-5.16/net-smc-use-a-mutex-for-locking-struct-smc_pnettable.patch new file mode 100644 index 00000000000..ee3ded12727 --- /dev/null +++ b/queue-5.16/net-smc-use-a-mutex-for-locking-struct-smc_pnettable.patch @@ -0,0 +1,220 @@ +From 7ff57e98fb78ad94edafbdc7435f2d745e9e6bb5 Mon Sep 17 00:00:00 2001 +From: "Fabio M. De Francesco" +Date: Wed, 23 Feb 2022 11:02:52 +0100 +Subject: net/smc: Use a mutex for locking "struct smc_pnettable" + +From: Fabio M. De Francesco + +commit 7ff57e98fb78ad94edafbdc7435f2d745e9e6bb5 upstream. + +smc_pnetid_by_table_ib() uses read_lock() and then it calls smc_pnet_apply_ib() +which, in turn, calls mutex_lock(&smc_ib_devices.mutex). + +read_lock() disables preemption. Therefore, the code acquires a mutex while in +atomic context and it leads to a SAC bug. + +Fix this bug by replacing the rwlock with a mutex. + +Reported-and-tested-by: syzbot+4f322a6d84e991c38775@syzkaller.appspotmail.com +Fixes: 64e28b52c7a6 ("net/smc: add pnet table namespace support") +Confirmed-by: Tony Lu +Signed-off-by: Fabio M. De Francesco +Acked-by: Karsten Graul +Link: https://lore.kernel.org/r/20220223100252.22562-1-fmdefrancesco@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/smc/smc_pnet.c | 42 +++++++++++++++++++++--------------------- + net/smc/smc_pnet.h | 2 +- + 2 files changed, 22 insertions(+), 22 deletions(-) + +--- a/net/smc/smc_pnet.c ++++ b/net/smc/smc_pnet.c +@@ -112,7 +112,7 @@ static int smc_pnet_remove_by_pnetid(str + pnettable = &sn->pnettable; + + /* remove table entry */ +- write_lock(&pnettable->lock); ++ mutex_lock(&pnettable->lock); + list_for_each_entry_safe(pnetelem, tmp_pe, &pnettable->pnetlist, + list) { + if (!pnet_name || +@@ -130,7 +130,7 @@ static int smc_pnet_remove_by_pnetid(str + rc = 0; + } + } +- write_unlock(&pnettable->lock); ++ mutex_unlock(&pnettable->lock); + + /* if this is not the initial namespace, stop here */ + if (net != &init_net) +@@ -191,7 +191,7 @@ static int smc_pnet_add_by_ndev(struct n + sn = net_generic(net, smc_net_id); + pnettable = &sn->pnettable; + +- write_lock(&pnettable->lock); ++ mutex_lock(&pnettable->lock); + list_for_each_entry_safe(pnetelem, tmp_pe, &pnettable->pnetlist, list) { + if (pnetelem->type == SMC_PNET_ETH && !pnetelem->ndev && + !strncmp(pnetelem->eth_name, ndev->name, IFNAMSIZ)) { +@@ -205,7 +205,7 @@ static int smc_pnet_add_by_ndev(struct n + break; + } + } +- write_unlock(&pnettable->lock); ++ mutex_unlock(&pnettable->lock); + return rc; + } + +@@ -223,7 +223,7 @@ static int smc_pnet_remove_by_ndev(struc + sn = net_generic(net, smc_net_id); + pnettable = &sn->pnettable; + +- write_lock(&pnettable->lock); ++ mutex_lock(&pnettable->lock); + list_for_each_entry_safe(pnetelem, tmp_pe, &pnettable->pnetlist, list) { + if (pnetelem->type == SMC_PNET_ETH && pnetelem->ndev == ndev) { + dev_put(pnetelem->ndev); +@@ -236,7 +236,7 @@ static int smc_pnet_remove_by_ndev(struc + break; + } + } +- write_unlock(&pnettable->lock); ++ mutex_unlock(&pnettable->lock); + return rc; + } + +@@ -371,7 +371,7 @@ static int smc_pnet_add_eth(struct smc_p + + rc = -EEXIST; + new_netdev = true; +- write_lock(&pnettable->lock); ++ mutex_lock(&pnettable->lock); + list_for_each_entry(tmp_pe, &pnettable->pnetlist, list) { + if (tmp_pe->type == SMC_PNET_ETH && + !strncmp(tmp_pe->eth_name, eth_name, IFNAMSIZ)) { +@@ -381,9 +381,9 @@ static int smc_pnet_add_eth(struct smc_p + } + if (new_netdev) { + list_add_tail(&new_pe->list, &pnettable->pnetlist); +- write_unlock(&pnettable->lock); ++ mutex_unlock(&pnettable->lock); + } else { +- write_unlock(&pnettable->lock); ++ mutex_unlock(&pnettable->lock); + kfree(new_pe); + goto out_put; + } +@@ -444,7 +444,7 @@ static int smc_pnet_add_ib(struct smc_pn + new_pe->ib_port = ib_port; + + new_ibdev = true; +- write_lock(&pnettable->lock); ++ mutex_lock(&pnettable->lock); + list_for_each_entry(tmp_pe, &pnettable->pnetlist, list) { + if (tmp_pe->type == SMC_PNET_IB && + !strncmp(tmp_pe->ib_name, ib_name, IB_DEVICE_NAME_MAX)) { +@@ -454,9 +454,9 @@ static int smc_pnet_add_ib(struct smc_pn + } + if (new_ibdev) { + list_add_tail(&new_pe->list, &pnettable->pnetlist); +- write_unlock(&pnettable->lock); ++ mutex_unlock(&pnettable->lock); + } else { +- write_unlock(&pnettable->lock); ++ mutex_unlock(&pnettable->lock); + kfree(new_pe); + } + return (new_ibdev) ? 0 : -EEXIST; +@@ -601,7 +601,7 @@ static int _smc_pnet_dump(struct net *ne + pnettable = &sn->pnettable; + + /* dump pnettable entries */ +- read_lock(&pnettable->lock); ++ mutex_lock(&pnettable->lock); + list_for_each_entry(pnetelem, &pnettable->pnetlist, list) { + if (pnetid && !smc_pnet_match(pnetelem->pnet_name, pnetid)) + continue; +@@ -616,7 +616,7 @@ static int _smc_pnet_dump(struct net *ne + break; + } + } +- read_unlock(&pnettable->lock); ++ mutex_unlock(&pnettable->lock); + return idx; + } + +@@ -860,7 +860,7 @@ int smc_pnet_net_init(struct net *net) + struct smc_pnetids_ndev *pnetids_ndev = &sn->pnetids_ndev; + + INIT_LIST_HEAD(&pnettable->pnetlist); +- rwlock_init(&pnettable->lock); ++ mutex_init(&pnettable->lock); + INIT_LIST_HEAD(&pnetids_ndev->list); + rwlock_init(&pnetids_ndev->lock); + +@@ -940,7 +940,7 @@ static int smc_pnet_find_ndev_pnetid_by_ + sn = net_generic(net, smc_net_id); + pnettable = &sn->pnettable; + +- read_lock(&pnettable->lock); ++ mutex_lock(&pnettable->lock); + list_for_each_entry(pnetelem, &pnettable->pnetlist, list) { + if (pnetelem->type == SMC_PNET_ETH && ndev == pnetelem->ndev) { + /* get pnetid of netdev device */ +@@ -949,7 +949,7 @@ static int smc_pnet_find_ndev_pnetid_by_ + break; + } + } +- read_unlock(&pnettable->lock); ++ mutex_unlock(&pnettable->lock); + return rc; + } + +@@ -1141,7 +1141,7 @@ int smc_pnetid_by_table_ib(struct smc_ib + sn = net_generic(&init_net, smc_net_id); + pnettable = &sn->pnettable; + +- read_lock(&pnettable->lock); ++ mutex_lock(&pnettable->lock); + list_for_each_entry(tmp_pe, &pnettable->pnetlist, list) { + if (tmp_pe->type == SMC_PNET_IB && + !strncmp(tmp_pe->ib_name, ib_name, IB_DEVICE_NAME_MAX) && +@@ -1151,7 +1151,7 @@ int smc_pnetid_by_table_ib(struct smc_ib + break; + } + } +- read_unlock(&pnettable->lock); ++ mutex_unlock(&pnettable->lock); + + return rc; + } +@@ -1170,7 +1170,7 @@ int smc_pnetid_by_table_smcd(struct smcd + sn = net_generic(&init_net, smc_net_id); + pnettable = &sn->pnettable; + +- read_lock(&pnettable->lock); ++ mutex_lock(&pnettable->lock); + list_for_each_entry(tmp_pe, &pnettable->pnetlist, list) { + if (tmp_pe->type == SMC_PNET_IB && + !strncmp(tmp_pe->ib_name, ib_name, IB_DEVICE_NAME_MAX)) { +@@ -1179,7 +1179,7 @@ int smc_pnetid_by_table_smcd(struct smcd + break; + } + } +- read_unlock(&pnettable->lock); ++ mutex_unlock(&pnettable->lock); + + return rc; + } +--- a/net/smc/smc_pnet.h ++++ b/net/smc/smc_pnet.h +@@ -29,7 +29,7 @@ struct smc_link_group; + * @pnetlist: List of PNETIDs + */ + struct smc_pnettable { +- rwlock_t lock; ++ struct mutex lock; + struct list_head pnetlist; + }; + diff --git a/queue-5.16/netfilter-nf_tables-fix-memory-leak-during-stateful-obj-update.patch b/queue-5.16/netfilter-nf_tables-fix-memory-leak-during-stateful-obj-update.patch new file mode 100644 index 00000000000..e50748d0959 --- /dev/null +++ b/queue-5.16/netfilter-nf_tables-fix-memory-leak-during-stateful-obj-update.patch @@ -0,0 +1,77 @@ +From dad3bdeef45f81a6e90204bcc85360bb76eccec7 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Mon, 21 Feb 2022 13:31:49 +0100 +Subject: netfilter: nf_tables: fix memory leak during stateful obj update + +From: Florian Westphal + +commit dad3bdeef45f81a6e90204bcc85360bb76eccec7 upstream. + +stateful objects can be updated from the control plane. +The transaction logic allocates a temporary object for this purpose. + +The ->init function was called for this object, so plain kfree() leaks +resources. We must call ->destroy function of the object. + +nft_obj_destroy does this, but it also decrements the module refcount, +but the update path doesn't increment it. + +To avoid special-casing the update object release, do module_get for +the update case too and release it via nft_obj_destroy(). + +Fixes: d62d0ba97b58 ("netfilter: nf_tables: Introduce stateful object update operation") +Cc: Fernando Fernandez Mancera +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -6535,12 +6535,15 @@ static int nf_tables_updobj(const struct + { + struct nft_object *newobj; + struct nft_trans *trans; +- int err; ++ int err = -ENOMEM; ++ ++ if (!try_module_get(type->owner)) ++ return -ENOENT; + + trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ, + sizeof(struct nft_trans_obj)); + if (!trans) +- return -ENOMEM; ++ goto err_trans; + + newobj = nft_obj_init(ctx, type, attr); + if (IS_ERR(newobj)) { +@@ -6557,6 +6560,8 @@ static int nf_tables_updobj(const struct + + err_free_trans: + kfree(trans); ++err_trans: ++ module_put(type->owner); + return err; + } + +@@ -8169,7 +8174,7 @@ static void nft_obj_commit_update(struct + if (obj->ops->update) + obj->ops->update(obj, newobj); + +- kfree(newobj); ++ nft_obj_destroy(&trans->ctx, newobj); + } + + static void nft_commit_release(struct nft_trans *trans) +@@ -8914,7 +8919,7 @@ static int __nf_tables_abort(struct net + break; + case NFT_MSG_NEWOBJ: + if (nft_trans_obj_update(trans)) { +- kfree(nft_trans_obj_newobj(trans)); ++ nft_obj_destroy(&trans->ctx, nft_trans_obj_newobj(trans)); + nft_trans_destroy(trans); + } else { + trans->ctx.table->use--; diff --git a/queue-5.16/netfilter-nf_tables-unregister-flowtable-hooks-on-netns-exit.patch b/queue-5.16/netfilter-nf_tables-unregister-flowtable-hooks-on-netns-exit.patch new file mode 100644 index 00000000000..e23a365a64d --- /dev/null +++ b/queue-5.16/netfilter-nf_tables-unregister-flowtable-hooks-on-netns-exit.patch @@ -0,0 +1,69 @@ +From 6069da443bf65f513bb507bb21e2f87cfb1ad0b6 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Fri, 18 Feb 2022 12:45:32 +0100 +Subject: netfilter: nf_tables: unregister flowtable hooks on netns exit + +From: Pablo Neira Ayuso + +commit 6069da443bf65f513bb507bb21e2f87cfb1ad0b6 upstream. + +Unregister flowtable hooks before they are releases via +nf_tables_flowtable_destroy() otherwise hook core reports UAF. + +BUG: KASAN: use-after-free in nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142 +Read of size 4 at addr ffff8880736f7438 by task syz-executor579/3666 + +CPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + __dump_stack lib/dump_stack.c:88 [inline] lib/dump_stack.c:106 + dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 lib/dump_stack.c:106 + print_address_description+0x65/0x380 mm/kasan/report.c:247 mm/kasan/report.c:247 + __kasan_report mm/kasan/report.c:433 [inline] + __kasan_report mm/kasan/report.c:433 [inline] mm/kasan/report.c:450 + kasan_report+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450 + nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142 + __nf_register_net_hook+0x27e/0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429 + nf_register_net_hook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571 + nft_register_flowtable_net_hooks+0x3c5/0x730 net/netfilter/nf_tables_api.c:7232 net/netfilter/nf_tables_api.c:7232 + nf_tables_newflowtable+0x2022/0x2cf0 net/netfilter/nf_tables_api.c:7430 net/netfilter/nf_tables_api.c:7430 + nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] + nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] + nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] net/netfilter/nfnetlink.c:652 + nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] net/netfilter/nfnetlink.c:652 + nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652 + +__nft_release_hook() calls nft_unregister_flowtable_net_hooks() which +only unregisters the hooks, then after RCU grace period, it is +guaranteed that no packets add new entries to the flowtable (no flow +offload rules and flowtable hooks are reachable from packet path), so it +is safe to call nf_flow_table_free() which cleans up the remaining +entries from the flowtable (both software and hardware) and it unbinds +the flow_block. + +Fixes: ff4bf2f42a40 ("netfilter: nf_tables: add nft_unregister_flowtable_hook()") +Reported-by: syzbot+e918523f77e62790d6d9@syzkaller.appspotmail.com +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -9574,10 +9574,13 @@ EXPORT_SYMBOL_GPL(__nft_release_basechai + + static void __nft_release_hook(struct net *net, struct nft_table *table) + { ++ struct nft_flowtable *flowtable; + struct nft_chain *chain; + + list_for_each_entry(chain, &table->chains, list) + nf_tables_unregister_hook(net, table, chain); ++ list_for_each_entry(flowtable, &table->flowtables, list) ++ nft_unregister_flowtable_net_hooks(net, &flowtable->hook_list); + } + + static void __nft_release_hooks(struct net *net) diff --git a/queue-5.16/nfp-flower-fix-a-potential-leak-in-nfp_tunnel_add_shared_mac.patch b/queue-5.16/nfp-flower-fix-a-potential-leak-in-nfp_tunnel_add_shared_mac.patch new file mode 100644 index 00000000000..77abcd47408 --- /dev/null +++ b/queue-5.16/nfp-flower-fix-a-potential-leak-in-nfp_tunnel_add_shared_mac.patch @@ -0,0 +1,50 @@ +From 3a14d0888eb4b0045884126acc69abfb7b87814d Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Fri, 18 Feb 2022 14:15:35 +0100 +Subject: nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac() + +From: Christophe JAILLET + +commit 3a14d0888eb4b0045884126acc69abfb7b87814d upstream. + +ida_simple_get() returns an id between min (0) and max (NFP_MAX_MAC_INDEX) +inclusive. +So NFP_MAX_MAC_INDEX (0xff) is a valid id. + +In order for the error handling path to work correctly, the 'invalid' +value for 'ida_idx' should not be in the 0..NFP_MAX_MAC_INDEX range, +inclusive. + +So set it to -1. + +Fixes: 20cce8865098 ("nfp: flower: enable MAC address sharing for offloadable devs") +Signed-off-by: Christophe JAILLET +Signed-off-by: Simon Horman +Link: https://lore.kernel.org/r/20220218131535.100258-1-simon.horman@corigine.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c ++++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c +@@ -922,8 +922,8 @@ nfp_tunnel_add_shared_mac(struct nfp_app + int port, bool mod) + { + struct nfp_flower_priv *priv = app->priv; +- int ida_idx = NFP_MAX_MAC_INDEX, err; + struct nfp_tun_offloaded_mac *entry; ++ int ida_idx = -1, err; + u16 nfp_mac_idx = 0; + + entry = nfp_tunnel_lookup_offloaded_macs(app, netdev->dev_addr); +@@ -997,7 +997,7 @@ err_remove_hash: + err_free_entry: + kfree(entry); + err_free_ida: +- if (ida_idx != NFP_MAX_MAC_INDEX) ++ if (ida_idx != -1) + ida_simple_remove(&priv->tun.mac_off_ids, ida_idx); + + return err; diff --git a/queue-5.16/nvme-also-mark-passthrough-only-namespaces-ready-in-nvme_update_ns_info.patch b/queue-5.16/nvme-also-mark-passthrough-only-namespaces-ready-in-nvme_update_ns_info.patch new file mode 100644 index 00000000000..96ad92547f1 --- /dev/null +++ b/queue-5.16/nvme-also-mark-passthrough-only-namespaces-ready-in-nvme_update_ns_info.patch @@ -0,0 +1,57 @@ +From 602e57c9799c19f27e440639deed3ec45cfe1651 Mon Sep 17 00:00:00 2001 +From: Christoph Hellwig +Date: Wed, 16 Feb 2022 14:14:58 +0100 +Subject: nvme: also mark passthrough-only namespaces ready in nvme_update_ns_info + +From: Christoph Hellwig + +commit 602e57c9799c19f27e440639deed3ec45cfe1651 upstream. + +Commit e7d65803e2bb ("nvme-multipath: revalidate paths during rescan") +introduced the NVME_NS_READY flag, which nvme_path_is_disabled() uses +to check if a path can be used or not. We also need to set this flag +for devices that fail the ZNS feature validation and which are available +through passthrough devices only to that they can be used in multipathing +setups. + +Fixes: e7d65803e2bb ("nvme-multipath: revalidate paths during rescan") +Reported-by: Kanchan Joshi +Signed-off-by: Christoph Hellwig +Reviewed-by: Sagi Grimberg +Reviewed-by: Daniel Wagner +Tested-by: Kanchan Joshi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1936,7 +1936,7 @@ static int nvme_update_ns_info(struct nv + if (blk_queue_is_zoned(ns->queue)) { + ret = nvme_revalidate_zones(ns); + if (ret && !nvme_first_scan(ns->disk)) +- goto out; ++ return ret; + } + + if (nvme_ns_head_multipath(ns->head)) { +@@ -1951,16 +1951,16 @@ static int nvme_update_ns_info(struct nv + return 0; + + out_unfreeze: +- blk_mq_unfreeze_queue(ns->disk->queue); +-out: + /* + * If probing fails due an unsupported feature, hide the block device, + * but still allow other access. + */ + if (ret == -ENODEV) { + ns->disk->flags |= GENHD_FL_HIDDEN; ++ set_bit(NVME_NS_READY, &ns->flags); + ret = 0; + } ++ blk_mq_unfreeze_queue(ns->disk->queue); + return ret; + } + diff --git a/queue-5.16/openvswitch-fix-setting-ipv6-fields-causing-hw-csum-failure.patch b/queue-5.16/openvswitch-fix-setting-ipv6-fields-causing-hw-csum-failure.patch new file mode 100644 index 00000000000..6c1561a52a6 --- /dev/null +++ b/queue-5.16/openvswitch-fix-setting-ipv6-fields-causing-hw-csum-failure.patch @@ -0,0 +1,149 @@ +From d9b5ae5c1b241b91480aa30408be12fe91af834a Mon Sep 17 00:00:00 2001 +From: Paul Blakey +Date: Wed, 23 Feb 2022 18:34:16 +0200 +Subject: openvswitch: Fix setting ipv6 fields causing hw csum failure + +From: Paul Blakey + +commit d9b5ae5c1b241b91480aa30408be12fe91af834a upstream. + +Ipv6 ttl, label and tos fields are modified without first +pulling/pushing the ipv6 header, which would have updated +the hw csum (if available). This might cause csum validation +when sending the packet to the stack, as can be seen in +the trace below. + +Fix this by updating skb->csum if available. + +Trace resulted by ipv6 ttl dec and then sending packet +to conntrack [actions: set(ipv6(hlimit=63)),ct(zone=99)]: +[295241.900063] s_pf0vf2: hw csum failure +[295241.923191] Call Trace: +[295241.925728] +[295241.927836] dump_stack+0x5c/0x80 +[295241.931240] __skb_checksum_complete+0xac/0xc0 +[295241.935778] nf_conntrack_tcp_packet+0x398/0xba0 [nf_conntrack] +[295241.953030] nf_conntrack_in+0x498/0x5e0 [nf_conntrack] +[295241.958344] __ovs_ct_lookup+0xac/0x860 [openvswitch] +[295241.968532] ovs_ct_execute+0x4a7/0x7c0 [openvswitch] +[295241.979167] do_execute_actions+0x54a/0xaa0 [openvswitch] +[295242.001482] ovs_execute_actions+0x48/0x100 [openvswitch] +[295242.006966] ovs_dp_process_packet+0x96/0x1d0 [openvswitch] +[295242.012626] ovs_vport_receive+0x6c/0xc0 [openvswitch] +[295242.028763] netdev_frame_hook+0xc0/0x180 [openvswitch] +[295242.034074] __netif_receive_skb_core+0x2ca/0xcb0 +[295242.047498] netif_receive_skb_internal+0x3e/0xc0 +[295242.052291] napi_gro_receive+0xba/0xe0 +[295242.056231] mlx5e_handle_rx_cqe_mpwrq_rep+0x12b/0x250 [mlx5_core] +[295242.062513] mlx5e_poll_rx_cq+0xa0f/0xa30 [mlx5_core] +[295242.067669] mlx5e_napi_poll+0xe1/0x6b0 [mlx5_core] +[295242.077958] net_rx_action+0x149/0x3b0 +[295242.086762] __do_softirq+0xd7/0x2d6 +[295242.090427] irq_exit+0xf7/0x100 +[295242.093748] do_IRQ+0x7f/0xd0 +[295242.096806] common_interrupt+0xf/0xf +[295242.100559] +[295242.102750] RIP: 0033:0x7f9022e88cbd +[295242.125246] RSP: 002b:00007f9022282b20 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffda +[295242.132900] RAX: 0000000000000005 RBX: 0000000000000010 RCX: 0000000000000000 +[295242.140120] RDX: 00007f9022282ba8 RSI: 00007f9022282a30 RDI: 00007f9014005c30 +[295242.147337] RBP: 00007f9014014d60 R08: 0000000000000020 R09: 00007f90254a8340 +[295242.154557] R10: 00007f9022282a28 R11: 0000000000000246 R12: 0000000000000000 +[295242.161775] R13: 00007f902308c000 R14: 000000000000002b R15: 00007f9022b71f40 + +Fixes: 3fdbd1ce11e5 ("openvswitch: add ipv6 'set' action") +Signed-off-by: Paul Blakey +Link: https://lore.kernel.org/r/20220223163416.24096-1-paulb@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + include/net/checksum.h | 5 +++++ + net/openvswitch/actions.c | 46 ++++++++++++++++++++++++++++++++++++++-------- + 2 files changed, 43 insertions(+), 8 deletions(-) + +--- a/include/net/checksum.h ++++ b/include/net/checksum.h +@@ -141,6 +141,11 @@ static inline void csum_replace2(__sum16 + *sum = ~csum16_add(csum16_sub(~(*sum), old), new); + } + ++static inline void csum_replace(__wsum *csum, __wsum old, __wsum new) ++{ ++ *csum = csum_add(csum_sub(*csum, old), new); ++} ++ + struct sk_buff; + void inet_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb, + __be32 from, __be32 to, bool pseudohdr); +--- a/net/openvswitch/actions.c ++++ b/net/openvswitch/actions.c +@@ -423,12 +423,43 @@ static void set_ipv6_addr(struct sk_buff + memcpy(addr, new_addr, sizeof(__be32[4])); + } + +-static void set_ipv6_fl(struct ipv6hdr *nh, u32 fl, u32 mask) ++static void set_ipv6_dsfield(struct sk_buff *skb, struct ipv6hdr *nh, u8 ipv6_tclass, u8 mask) + { ++ u8 old_ipv6_tclass = ipv6_get_dsfield(nh); ++ ++ ipv6_tclass = OVS_MASKED(old_ipv6_tclass, ipv6_tclass, mask); ++ ++ if (skb->ip_summed == CHECKSUM_COMPLETE) ++ csum_replace(&skb->csum, (__force __wsum)(old_ipv6_tclass << 12), ++ (__force __wsum)(ipv6_tclass << 12)); ++ ++ ipv6_change_dsfield(nh, ~mask, ipv6_tclass); ++} ++ ++static void set_ipv6_fl(struct sk_buff *skb, struct ipv6hdr *nh, u32 fl, u32 mask) ++{ ++ u32 ofl; ++ ++ ofl = nh->flow_lbl[0] << 16 | nh->flow_lbl[1] << 8 | nh->flow_lbl[2]; ++ fl = OVS_MASKED(ofl, fl, mask); ++ + /* Bits 21-24 are always unmasked, so this retains their values. */ +- OVS_SET_MASKED(nh->flow_lbl[0], (u8)(fl >> 16), (u8)(mask >> 16)); +- OVS_SET_MASKED(nh->flow_lbl[1], (u8)(fl >> 8), (u8)(mask >> 8)); +- OVS_SET_MASKED(nh->flow_lbl[2], (u8)fl, (u8)mask); ++ nh->flow_lbl[0] = (u8)(fl >> 16); ++ nh->flow_lbl[1] = (u8)(fl >> 8); ++ nh->flow_lbl[2] = (u8)fl; ++ ++ if (skb->ip_summed == CHECKSUM_COMPLETE) ++ csum_replace(&skb->csum, (__force __wsum)htonl(ofl), (__force __wsum)htonl(fl)); ++} ++ ++static void set_ipv6_ttl(struct sk_buff *skb, struct ipv6hdr *nh, u8 new_ttl, u8 mask) ++{ ++ new_ttl = OVS_MASKED(nh->hop_limit, new_ttl, mask); ++ ++ if (skb->ip_summed == CHECKSUM_COMPLETE) ++ csum_replace(&skb->csum, (__force __wsum)(nh->hop_limit << 8), ++ (__force __wsum)(new_ttl << 8)); ++ nh->hop_limit = new_ttl; + } + + static void set_ip_ttl(struct sk_buff *skb, struct iphdr *nh, u8 new_ttl, +@@ -546,18 +577,17 @@ static int set_ipv6(struct sk_buff *skb, + } + } + if (mask->ipv6_tclass) { +- ipv6_change_dsfield(nh, ~mask->ipv6_tclass, key->ipv6_tclass); ++ set_ipv6_dsfield(skb, nh, key->ipv6_tclass, mask->ipv6_tclass); + flow_key->ip.tos = ipv6_get_dsfield(nh); + } + if (mask->ipv6_label) { +- set_ipv6_fl(nh, ntohl(key->ipv6_label), ++ set_ipv6_fl(skb, nh, ntohl(key->ipv6_label), + ntohl(mask->ipv6_label)); + flow_key->ipv6.label = + *(__be32 *)nh & htonl(IPV6_FLOWINFO_FLOWLABEL); + } + if (mask->ipv6_hlimit) { +- OVS_SET_MASKED(nh->hop_limit, key->ipv6_hlimit, +- mask->ipv6_hlimit); ++ set_ipv6_ttl(skb, nh, key->ipv6_hlimit, mask->ipv6_hlimit); + flow_key->ip.ttl = nh->hop_limit; + } + return 0; diff --git a/queue-5.16/perf-data-fix-double-free-in-perf_session__delete.patch b/queue-5.16/perf-data-fix-double-free-in-perf_session__delete.patch new file mode 100644 index 00000000000..1c96ac1f020 --- /dev/null +++ b/queue-5.16/perf-data-fix-double-free-in-perf_session__delete.patch @@ -0,0 +1,58 @@ +From 69560e366fc4d5fca7bebb0e44edbfafc8bcaf05 Mon Sep 17 00:00:00 2001 +From: Alexey Bayduraev +Date: Fri, 18 Feb 2022 18:23:41 +0300 +Subject: perf data: Fix double free in perf_session__delete() + +From: Alexey Bayduraev + +commit 69560e366fc4d5fca7bebb0e44edbfafc8bcaf05 upstream. + +When perf_data__create_dir() fails, it calls close_dir(), but +perf_session__delete() also calls close_dir() and since dir.version and +dir.nr were initialized by perf_data__create_dir(), a double free occurs. + +This patch moves the initialization of dir.version and dir.nr after +successful initialization of dir.files, that prevents double freeing. +This behavior is already implemented in perf_data__open_dir(). + +Fixes: 145520631130bd64 ("perf data: Add perf_data__(create_dir|close_dir) functions") +Signed-off-by: Alexey Bayduraev +Acked-by: Jiri Olsa +Cc: Adrian Hunter +Cc: Alexander Antonov +Cc: Alexander Shishkin +Cc: Alexei Budankov +Cc: Andi Kleen +Cc: Ingo Molnar +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20220218152341.5197-2-alexey.v.bayduraev@linux.intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/data.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/tools/perf/util/data.c ++++ b/tools/perf/util/data.c +@@ -44,10 +44,6 @@ int perf_data__create_dir(struct perf_da + if (!files) + return -ENOMEM; + +- data->dir.version = PERF_DIR_VERSION; +- data->dir.files = files; +- data->dir.nr = nr; +- + for (i = 0; i < nr; i++) { + struct perf_data_file *file = &files[i]; + +@@ -62,6 +58,9 @@ int perf_data__create_dir(struct perf_da + file->fd = ret; + } + ++ data->dir.version = PERF_DIR_VERSION; ++ data->dir.files = files; ++ data->dir.nr = nr; + return 0; + + out_err: diff --git a/queue-5.16/perf-evlist-fix-failed-to-use-cpu-list-for-uncore-events.patch b/queue-5.16/perf-evlist-fix-failed-to-use-cpu-list-for-uncore-events.patch new file mode 100644 index 00000000000..15720433f45 --- /dev/null +++ b/queue-5.16/perf-evlist-fix-failed-to-use-cpu-list-for-uncore-events.patch @@ -0,0 +1,81 @@ +From 8a3d2ee0de3828e0d01f9682d35ee53704659bd0 Mon Sep 17 00:00:00 2001 +From: Zhengjun Xing +Date: Fri, 18 Feb 2022 17:31:27 +0800 +Subject: perf evlist: Fix failed to use cpu list for uncore events + +From: Zhengjun Xing + +commit 8a3d2ee0de3828e0d01f9682d35ee53704659bd0 upstream. + +The 'perf record' and 'perf stat' commands have supported the option +'-C/--cpus' to count or collect only on the list of CPUs provided. + +Commit 1d3351e631fc34d7 ("perf tools: Enable on a list of CPUs for +hybrid") add it to be supported for hybrid. For hybrid support, it +checks the cpu list are available on hybrid PMU. But when we test only +uncore events(or events not in cpu_core and cpu_atom), there is a bug: + +Before: + + # perf stat -C0 -e uncore_clock/clockticks/ sleep 1 + failed to use cpu list 0 + +In this case, for uncore event, its pmu_name is not cpu_core or +cpu_atom, so in evlist__fix_hybrid_cpus, perf_pmu__find_hybrid_pmu +should return NULL,both events_nr and unmatched_count should be 0 ,then +the cpu list check function evlist__fix_hybrid_cpus return -1 and the +error "failed to use cpu list 0" will happen. Bypass "events_nr=0" case +then the issue is fixed. + +After: + + # perf stat -C0 -e uncore_clock/clockticks/ sleep 1 + + Performance counter stats for 'CPU(s) 0': + + 195,476,873 uncore_clock/clockticks/ + + 1.004518677 seconds time elapsed + +When testing with at least one core event and uncore events, it has no +issue. + + # perf stat -C0 -e cpu_core/cpu-cycles/,uncore_clock/clockticks/ sleep 1 + + Performance counter stats for 'CPU(s) 0': + + 5,993,774 cpu_core/cpu-cycles/ + 301,025,912 uncore_clock/clockticks/ + + 1.003964934 seconds time elapsed + +Fixes: 1d3351e631fc34d7 ("perf tools: Enable on a list of CPUs for hybrid") +Reviewed-by: Kan Liang +Signed-off-by: Zhengjun Xing +Cc: Adrian Hunter +Cc: alexander.shishkin@intel.com +Cc: Andi Kleen +Cc: Ian Rogers +Cc: Jin Yao +Cc: Jiri Olsa +Cc: Peter Zijlstra +Link: http://lore.kernel.org/lkml/20220218093127.1844241-1-zhengjun.xing@linux.intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/evlist-hybrid.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/tools/perf/util/evlist-hybrid.c ++++ b/tools/perf/util/evlist-hybrid.c +@@ -153,8 +153,8 @@ int evlist__fix_hybrid_cpus(struct evlis + perf_cpu_map__put(matched_cpus); + perf_cpu_map__put(unmatched_cpus); + } +- +- ret = (unmatched_count == events_nr) ? -1 : 0; ++ if (events_nr) ++ ret = (unmatched_count == events_nr) ? -1 : 0; + out: + perf_cpu_map__put(cpus); + return ret; diff --git a/queue-5.16/ping-remove-pr_err-from-ping_lookup.patch b/queue-5.16/ping-remove-pr_err-from-ping_lookup.patch new file mode 100644 index 00000000000..4eb952560ee --- /dev/null +++ b/queue-5.16/ping-remove-pr_err-from-ping_lookup.patch @@ -0,0 +1,33 @@ +From cd33bdcbead882c2e58fdb4a54a7bd75b610a452 Mon Sep 17 00:00:00 2001 +From: Xin Long +Date: Wed, 23 Feb 2022 22:41:08 -0500 +Subject: ping: remove pr_err from ping_lookup + +From: Xin Long + +commit cd33bdcbead882c2e58fdb4a54a7bd75b610a452 upstream. + +As Jakub noticed, prints should be avoided on the datapath. +Also, as packets would never come to the else branch in +ping_lookup(), remove pr_err() from ping_lookup(). + +Fixes: 35a79e64de29 ("ping: fix the dif and sdif check in ping_lookup") +Reported-by: Jakub Kicinski +Signed-off-by: Xin Long +Link: https://lore.kernel.org/r/1ef3f2fcd31bd681a193b1fcf235eee1603819bd.1645674068.git.lucien.xin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ping.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -187,7 +187,6 @@ static struct sock *ping_lookup(struct n + (int)ident, &ipv6_hdr(skb)->daddr, dif); + #endif + } else { +- pr_err("ping: protocol(%x) is not supported\n", ntohs(skb->protocol)); + return NULL; + } + diff --git a/queue-5.16/revert-i40e-fix-reset-bw-limit-when-dcb-enabled-with-1-tc.patch b/queue-5.16/revert-i40e-fix-reset-bw-limit-when-dcb-enabled-with-1-tc.patch new file mode 100644 index 00000000000..c1f538d3e03 --- /dev/null +++ b/queue-5.16/revert-i40e-fix-reset-bw-limit-when-dcb-enabled-with-1-tc.patch @@ -0,0 +1,60 @@ +From fe20371578ef640069e6ae9fa8038f60e7908565 Mon Sep 17 00:00:00 2001 +From: Mateusz Palczewski +Date: Wed, 23 Feb 2022 09:53:47 -0800 +Subject: Revert "i40e: Fix reset bw limit when DCB enabled with 1 TC" + +From: Mateusz Palczewski + +commit fe20371578ef640069e6ae9fa8038f60e7908565 upstream. + +Revert of a patch that instead of fixing a AQ error when trying +to reset BW limit introduced several regressions related to +creation and managing TC. Currently there are errors when creating +a TC on both PF and VF. + +Error log: +[17428.783095] i40e 0000:3b:00.1: AQ command Config VSI BW allocation per TC failed = 14 +[17428.783107] i40e 0000:3b:00.1: Failed configuring TC map 0 for VSI 391 +[17428.783254] i40e 0000:3b:00.1: AQ command Config VSI BW allocation per TC failed = 14 +[17428.783259] i40e 0000:3b:00.1: Unable to configure TC map 0 for VSI 391 + +This reverts commit 3d2504663c41104b4359a15f35670cfa82de1bbf. + +Fixes: 3d2504663c41 (i40e: Fix reset bw limit when DCB enabled with 1 TC) +Signed-off-by: Mateusz Palczewski +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20220223175347.1690692-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -5372,15 +5372,7 @@ static int i40e_vsi_configure_bw_alloc(s + /* There is no need to reset BW when mqprio mode is on. */ + if (pf->flags & I40E_FLAG_TC_MQPRIO) + return 0; +- +- if (!vsi->mqprio_qopt.qopt.hw) { +- if (pf->flags & I40E_FLAG_DCB_ENABLED) +- goto skip_reset; +- +- if (IS_ENABLED(CONFIG_I40E_DCB) && +- i40e_dcb_hw_get_num_tc(&pf->hw) == 1) +- goto skip_reset; +- ++ if (!vsi->mqprio_qopt.qopt.hw && !(pf->flags & I40E_FLAG_DCB_ENABLED)) { + ret = i40e_set_bw_limit(vsi, vsi->seid, 0); + if (ret) + dev_info(&pf->pdev->dev, +@@ -5388,8 +5380,6 @@ static int i40e_vsi_configure_bw_alloc(s + vsi->seid); + return ret; + } +- +-skip_reset: + memset(&bw_data, 0, sizeof(bw_data)); + bw_data.tc_valid_bits = enabled_tc; + for (i = 0; i < I40E_MAX_TRAFFIC_CLASS; i++) diff --git a/queue-5.16/selftests-bpf-check-bpf_msg_push_data-return-value.patch b/queue-5.16/selftests-bpf-check-bpf_msg_push_data-return-value.patch new file mode 100644 index 00000000000..477e41bf010 --- /dev/null +++ b/queue-5.16/selftests-bpf-check-bpf_msg_push_data-return-value.patch @@ -0,0 +1,97 @@ +From 61d06f01f9710b327a53492e5add9f972eb909b3 Mon Sep 17 00:00:00 2001 +From: Felix Maurer +Date: Fri, 11 Feb 2022 18:43:36 +0100 +Subject: selftests: bpf: Check bpf_msg_push_data return value + +From: Felix Maurer + +commit 61d06f01f9710b327a53492e5add9f972eb909b3 upstream. + +bpf_msg_push_data may return a non-zero value to indicate an error. The +return value should be checked to prevent undetected errors. + +To indicate an error, the BPF programs now perform a different action +than their intended one to make the userspace test program notice the +error, i.e., the programs supposed to pass/redirect drop, the program +supposed to drop passes. + +Fixes: 84fbfe026acaa ("bpf: test_sockmap add options to use msg_push_data") +Signed-off-by: Felix Maurer +Signed-off-by: Alexei Starovoitov +Acked-by: John Fastabend +Link: https://lore.kernel.org/bpf/89f767bb44005d6b4dd1f42038c438f76b3ebfad.1644601294.git.fmaurer@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/bpf/progs/test_sockmap_kern.h | 26 ++++++++++++------ + 1 file changed, 18 insertions(+), 8 deletions(-) + +--- a/tools/testing/selftests/bpf/progs/test_sockmap_kern.h ++++ b/tools/testing/selftests/bpf/progs/test_sockmap_kern.h +@@ -235,7 +235,7 @@ SEC("sk_msg1") + int bpf_prog4(struct sk_msg_md *msg) + { + int *bytes, zero = 0, one = 1, two = 2, three = 3, four = 4, five = 5; +- int *start, *end, *start_push, *end_push, *start_pop, *pop; ++ int *start, *end, *start_push, *end_push, *start_pop, *pop, err = 0; + + bytes = bpf_map_lookup_elem(&sock_apply_bytes, &zero); + if (bytes) +@@ -249,8 +249,11 @@ int bpf_prog4(struct sk_msg_md *msg) + bpf_msg_pull_data(msg, *start, *end, 0); + start_push = bpf_map_lookup_elem(&sock_bytes, &two); + end_push = bpf_map_lookup_elem(&sock_bytes, &three); +- if (start_push && end_push) +- bpf_msg_push_data(msg, *start_push, *end_push, 0); ++ if (start_push && end_push) { ++ err = bpf_msg_push_data(msg, *start_push, *end_push, 0); ++ if (err) ++ return SK_DROP; ++ } + start_pop = bpf_map_lookup_elem(&sock_bytes, &four); + pop = bpf_map_lookup_elem(&sock_bytes, &five); + if (start_pop && pop) +@@ -263,6 +266,7 @@ int bpf_prog6(struct sk_msg_md *msg) + { + int zero = 0, one = 1, two = 2, three = 3, four = 4, five = 5, key = 0; + int *bytes, *start, *end, *start_push, *end_push, *start_pop, *pop, *f; ++ int err = 0; + __u64 flags = 0; + + bytes = bpf_map_lookup_elem(&sock_apply_bytes, &zero); +@@ -279,8 +283,11 @@ int bpf_prog6(struct sk_msg_md *msg) + + start_push = bpf_map_lookup_elem(&sock_bytes, &two); + end_push = bpf_map_lookup_elem(&sock_bytes, &three); +- if (start_push && end_push) +- bpf_msg_push_data(msg, *start_push, *end_push, 0); ++ if (start_push && end_push) { ++ err = bpf_msg_push_data(msg, *start_push, *end_push, 0); ++ if (err) ++ return SK_DROP; ++ } + + start_pop = bpf_map_lookup_elem(&sock_bytes, &four); + pop = bpf_map_lookup_elem(&sock_bytes, &five); +@@ -338,7 +345,7 @@ SEC("sk_msg5") + int bpf_prog10(struct sk_msg_md *msg) + { + int *bytes, *start, *end, *start_push, *end_push, *start_pop, *pop; +- int zero = 0, one = 1, two = 2, three = 3, four = 4, five = 5; ++ int zero = 0, one = 1, two = 2, three = 3, four = 4, five = 5, err = 0; + + bytes = bpf_map_lookup_elem(&sock_apply_bytes, &zero); + if (bytes) +@@ -352,8 +359,11 @@ int bpf_prog10(struct sk_msg_md *msg) + bpf_msg_pull_data(msg, *start, *end, 0); + start_push = bpf_map_lookup_elem(&sock_bytes, &two); + end_push = bpf_map_lookup_elem(&sock_bytes, &three); +- if (start_push && end_push) +- bpf_msg_push_data(msg, *start_push, *end_push, 0); ++ if (start_push && end_push) { ++ err = bpf_msg_push_data(msg, *start_push, *end_push, 0); ++ if (err) ++ return SK_PASS; ++ } + start_pop = bpf_map_lookup_elem(&sock_bytes, &four); + pop = bpf_map_lookup_elem(&sock_bytes, &five); + if (start_pop && pop) diff --git a/queue-5.16/selftests-mptcp-be-more-conservative-with-cookie-mpj-limits.patch b/queue-5.16/selftests-mptcp-be-more-conservative-with-cookie-mpj-limits.patch new file mode 100644 index 00000000000..98370f2d03c --- /dev/null +++ b/queue-5.16/selftests-mptcp-be-more-conservative-with-cookie-mpj-limits.patch @@ -0,0 +1,66 @@ +From e35f885b357d47e04380a2056d1b2cc3e6f4f24b Mon Sep 17 00:00:00 2001 +From: Paolo Abeni +Date: Fri, 18 Feb 2022 13:35:44 -0800 +Subject: selftests: mptcp: be more conservative with cookie MPJ limits + +From: Paolo Abeni + +commit e35f885b357d47e04380a2056d1b2cc3e6f4f24b upstream. + +Since commit 2843ff6f36db ("mptcp: remote addresses fullmesh"), an +MPTCP client can attempt creating multiple MPJ subflow simultaneusly. + +In such scenario the server, when syncookies are enabled, could end-up +accepting incoming MPJ syn even above the configured subflow limit, as +the such limit can be enforced in a reliable way only after the subflow +creation. In case of syncookie, only after the 3rd ack reception. + +As a consequence the related self-tests case sporadically fails, as it +verify that the server always accept the expected number of MPJ syn. + +Address the issues relaxing the MPJ syn number constrain. Note that the +check on the accepted number of MPJ 3rd ack still remains intact. + +Fixes: 2843ff6f36db ("mptcp: remote addresses fullmesh") +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/mptcp/mptcp_join.sh | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh ++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh +@@ -624,6 +624,7 @@ chk_join_nr() + local ack_nr=$4 + local count + local dump_stats ++ local with_cookie + + printf "%02u %-36s %s" "$TEST_COUNT" "$msg" "syn" + count=`ip netns exec $ns1 nstat -as | grep MPTcpExtMPJoinSynRx | awk '{print $2}'` +@@ -637,12 +638,20 @@ chk_join_nr() + fi + + echo -n " - synack" ++ with_cookie=`ip netns exec $ns2 sysctl -n net.ipv4.tcp_syncookies` + count=`ip netns exec $ns2 nstat -as | grep MPTcpExtMPJoinSynAckRx | awk '{print $2}'` + [ -z "$count" ] && count=0 + if [ "$count" != "$syn_ack_nr" ]; then +- echo "[fail] got $count JOIN[s] synack expected $syn_ack_nr" +- ret=1 +- dump_stats=1 ++ # simult connections exceeding the limit with cookie enabled could go up to ++ # synack validation as the conn limit can be enforced reliably only after ++ # the subflow creation ++ if [ "$with_cookie" = 2 ] && [ "$count" -gt "$syn_ack_nr" ] && [ "$count" -le "$syn_nr" ]; then ++ echo -n "[ ok ]" ++ else ++ echo "[fail] got $count JOIN[s] synack expected $syn_ack_nr" ++ ret=1 ++ dump_stats=1 ++ fi + else + echo -n "[ ok ]" + fi diff --git a/queue-5.16/selftests-mptcp-fix-diag-instability.patch b/queue-5.16/selftests-mptcp-fix-diag-instability.patch new file mode 100644 index 00000000000..bd116af4db2 --- /dev/null +++ b/queue-5.16/selftests-mptcp-fix-diag-instability.patch @@ -0,0 +1,112 @@ +From 0cd33c5ffec12bd77a1c02db2469fac08f840939 Mon Sep 17 00:00:00 2001 +From: Paolo Abeni +Date: Fri, 18 Feb 2022 13:35:38 -0800 +Subject: selftests: mptcp: fix diag instability + +From: Paolo Abeni + +commit 0cd33c5ffec12bd77a1c02db2469fac08f840939 upstream. + +Instead of waiting for an arbitrary amount of time for the MPTCP +MP_CAPABLE handshake to complete, explicitly wait for the relevant +socket to enter into the established status. + +Additionally let the data transfer application use the slowest +transfer mode available (-r), to cope with very slow host, or +high jitter caused by hosting VMs. + +Fixes: df62f2ec3df6 ("selftests/mptcp: add diag interface tests") +Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/258 +Reported-and-tested-by: Matthieu Baerts +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/mptcp/diag.sh | 44 +++++++++++++++++++++++++----- + 1 file changed, 37 insertions(+), 7 deletions(-) + +--- a/tools/testing/selftests/net/mptcp/diag.sh ++++ b/tools/testing/selftests/net/mptcp/diag.sh +@@ -71,6 +71,36 @@ chk_msk_remote_key_nr() + __chk_nr "grep -c remote_key" $* + } + ++# $1: ns, $2: port ++wait_local_port_listen() ++{ ++ local listener_ns="${1}" ++ local port="${2}" ++ ++ local port_hex i ++ ++ port_hex="$(printf "%04X" "${port}")" ++ for i in $(seq 10); do ++ ip netns exec "${listener_ns}" cat /proc/net/tcp | \ ++ awk "BEGIN {rc=1} {if (\$2 ~ /:${port_hex}\$/ && \$4 ~ /0A/) {rc=0; exit}} END {exit rc}" && ++ break ++ sleep 0.1 ++ done ++} ++ ++wait_connected() ++{ ++ local listener_ns="${1}" ++ local port="${2}" ++ ++ local port_hex i ++ ++ port_hex="$(printf "%04X" "${port}")" ++ for i in $(seq 10); do ++ ip netns exec ${listener_ns} grep -q " 0100007F:${port_hex} " /proc/net/tcp && break ++ sleep 0.1 ++ done ++} + + trap cleanup EXIT + ip netns add $ns +@@ -81,15 +111,15 @@ echo "a" | \ + ip netns exec $ns \ + ./mptcp_connect -p 10000 -l -t ${timeout_poll} \ + 0.0.0.0 >/dev/null & +-sleep 0.1 ++wait_local_port_listen $ns 10000 + chk_msk_nr 0 "no msk on netns creation" + + echo "b" | \ + timeout ${timeout_test} \ + ip netns exec $ns \ +- ./mptcp_connect -p 10000 -j -t ${timeout_poll} \ ++ ./mptcp_connect -p 10000 -r 0 -t ${timeout_poll} \ + 127.0.0.1 >/dev/null & +-sleep 0.1 ++wait_connected $ns 10000 + chk_msk_nr 2 "after MPC handshake " + chk_msk_remote_key_nr 2 "....chk remote_key" + chk_msk_fallback_nr 0 "....chk no fallback" +@@ -101,13 +131,13 @@ echo "a" | \ + ip netns exec $ns \ + ./mptcp_connect -p 10001 -l -s TCP -t ${timeout_poll} \ + 0.0.0.0 >/dev/null & +-sleep 0.1 ++wait_local_port_listen $ns 10001 + echo "b" | \ + timeout ${timeout_test} \ + ip netns exec $ns \ +- ./mptcp_connect -p 10001 -j -t ${timeout_poll} \ ++ ./mptcp_connect -p 10001 -r 0 -t ${timeout_poll} \ + 127.0.0.1 >/dev/null & +-sleep 0.1 ++wait_connected $ns 10001 + chk_msk_fallback_nr 1 "check fallback" + flush_pids + +@@ -119,7 +149,7 @@ for I in `seq 1 $NR_CLIENTS`; do + ./mptcp_connect -p $((I+10001)) -l -w 10 \ + -t ${timeout_poll} 0.0.0.0 >/dev/null & + done +-sleep 0.1 ++wait_local_port_listen $ns $((NR_CLIENTS + 10001)) + + for I in `seq 1 $NR_CLIENTS`; do + echo "b" | \ diff --git a/queue-5.16/series b/queue-5.16/series index 5508f1abac6..42f8667cc47 100644 --- a/queue-5.16/series +++ b/queue-5.16/series @@ -30,3 +30,69 @@ cdc-ncm-avoid-overflow-in-sanity-checking.patch netfilter-xt_socket-fix-a-typo-in-socket_mt_destroy.patch netfilter-xt_socket-missing-ifdef-config_ip6_nf_iptables-dependency.patch netfilter-nf_tables_offload-incorrect-flow-offload-action-array-size.patch +ping-remove-pr_err-from-ping_lookup.patch +revert-i40e-fix-reset-bw-limit-when-dcb-enabled-with-1-tc.patch +gpu-host1x-always-return-syncpoint-value-when-waiting.patch +perf-evlist-fix-failed-to-use-cpu-list-for-uncore-events.patch +perf-data-fix-double-free-in-perf_session__delete.patch +mptcp-fix-race-in-incoming-add_addr-option-processing.patch +mptcp-add-mibs-counter-for-ignored-incoming-options.patch +selftests-mptcp-fix-diag-instability.patch +selftests-mptcp-be-more-conservative-with-cookie-mpj-limits.patch +bnx2x-fix-driver-load-from-initrd.patch +bnxt_en-fix-devlink-fw_activate.patch +bnxt_en-fix-active-fec-reporting-to-ethtool.patch +bnxt_en-fix-offline-ethtool-selftest-with-rdma-enabled.patch +bnxt_en-fix-occasional-ethtool-t-loopback-test-failures.patch +bnxt_en-fix-incorrect-multicast-rx-mask-setting-when-not-requested.patch +bnxt_en-restore-the-resets_reliable-flag-in-bnxt_open.patch +hwmon-handle-failure-to-register-sensor-with-thermal-zone-correctly.patch +net-mlx5-fix-tc-max-supported-prio-for-nic-mode.patch +ice-fix-setting-l4-port-flag-when-adding-filter.patch +ice-fix-concurrent-reset-and-removal-of-vfs.patch +ice-check-the-return-of-ice_ptp_gettimex64.patch +ice-initialize-local-variable-tlv.patch +net-mlx5-update-the-list-of-the-pci-supported-devices.patch +bpf-fix-crash-due-to-incorrect-copy_map_value.patch +bpf-do-not-try-bpf_msg_push_data-with-len-0.patch +selftests-bpf-check-bpf_msg_push_data-return-value.patch +bpf-fix-a-bpf_timer-initialization-issue.patch +bpf-add-schedule-points-in-batch-ops.patch +io_uring-add-a-schedule-point-in-io_add_buffers.patch +net-__pskb_pull_tail-pskb_carve_frag_list-drop_monitor-friends.patch +nvme-also-mark-passthrough-only-namespaces-ready-in-nvme_update_ns_info.patch +tipc-fix-end-of-loop-tests-for-list_for_each_entry.patch +clk-qcom-gcc-msm8994-remove-noc-clocks.patch +gso-do-not-skip-outer-ip-header-in-case-of-ipip-and-net_failover.patch +net-mv643xx_eth-process-retval-from-of_get_mac_address.patch +openvswitch-fix-setting-ipv6-fields-causing-hw-csum-failure.patch +drm-edid-always-set-rgb444.patch +net-mlx5e-fix-wrong-return-value-on-ioctl-eeprom-query-failure.patch +net-mlx5e-tc-reject-rules-with-forward-and-drop-actions.patch +net-mlx5e-tc-reject-rules-with-drop-and-modify-hdr-action.patch +block-clear-iocb-private-in-blkdev_bio_end_io_async.patch +drm-vc4-crtc-fix-runtime_pm-reference-counting.patch +drm-i915-dg2-print-phy-name-properly-on-calibration-error.patch +drm-amd-display-for-vblank_disable_immediate-check-psr-is-really-used.patch +net-sched-act_ct-fix-flow-table-lookup-after-ct-clear-or-switching-zones.patch +net-ll_temac-check-the-return-value-of-devm_kmalloc.patch +net-force-inlining-of-checksum-functions-in-net-checksum.h.patch +netfilter-nf_tables-unregister-flowtable-hooks-on-netns-exit.patch +net-dsa-avoid-call-to-__dev_set_promiscuity-while-rtnl_mutex-isn-t-held.patch +nfp-flower-fix-a-potential-leak-in-nfp_tunnel_add_shared_mac.patch +net-mdio-ipq4019-add-delay-after-clock-enable.patch +netfilter-nf_tables-fix-memory-leak-during-stateful-obj-update.patch +net-smc-use-a-mutex-for-locking-struct-smc_pnettable.patch +surface-surface3_power-fix-battery-readings-on-batteries-without-a-serial-number.patch +udp_tunnel-fix-end-of-loop-test-in-udp_tunnel_nic_unregister.patch +net-mlx5-dr-cache-ste-shadow-memory.patch +ibmvnic-schedule-failover-only-if-vioctl-fails.patch +net-mlx5-dr-don-t-allow-match-on-ip-w-o-matching-on-full-ethertype-ip_version.patch +net-mlx5-fix-possible-deadlock-on-rule-deletion.patch +net-mlx5-fix-wrong-limitation-of-metadata-match-on-ecpf.patch +net-mlx5-dr-fix-the-threshold-that-defines-when-pool-sync-is-initiated.patch +net-mlx5e-mplsoudp-decap-fix-check-for-unsupported-matches.patch +net-mlx5e-ktls-use-checksum_unnecessary-for-device-offloaded-packets.patch +net-mlx5-dr-fix-slab-out-of-bounds-in-mlx5_cmd_dr_create_fte.patch +net-mlx5-update-log_max_qp-value-to-be-17-at-most.patch +net-mlx5e-add-missing-increment-of-count.patch diff --git a/queue-5.16/surface-surface3_power-fix-battery-readings-on-batteries-without-a-serial-number.patch b/queue-5.16/surface-surface3_power-fix-battery-readings-on-batteries-without-a-serial-number.patch new file mode 100644 index 00000000000..71265297d6f --- /dev/null +++ b/queue-5.16/surface-surface3_power-fix-battery-readings-on-batteries-without-a-serial-number.patch @@ -0,0 +1,57 @@ +From 21d90aaee8d5c2a097ef41f1430d97661233ecc6 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 24 Feb 2022 11:18:48 +0100 +Subject: surface: surface3_power: Fix battery readings on batteries without a serial number + +From: Hans de Goede + +commit 21d90aaee8d5c2a097ef41f1430d97661233ecc6 upstream. + +The battery on the 2nd hand Surface 3 which I recently bought appears to +not have a serial number programmed in. This results in any I2C reads from +the registers containing the serial number failing with an I2C NACK. + +This was causing mshw0011_bix() to fail causing the battery readings to +not work at all. + +Ignore EREMOTEIO (I2C NACK) errors when retrieving the serial number and +continue with an empty serial number to fix this. + +Fixes: b1f81b496b0d ("platform/x86: surface3_power: MSHW0011 rev-eng implementation") +BugLink: https://github.com/linux-surface/linux-surface/issues/608 +Reviewed-by: Benjamin Tissoires +Reviewed-by: Maximilian Luz +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20220224101848.7219-1-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/surface/surface3_power.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/drivers/platform/surface/surface3_power.c ++++ b/drivers/platform/surface/surface3_power.c +@@ -232,14 +232,21 @@ static int mshw0011_bix(struct mshw0011_ + } + bix->last_full_charg_capacity = ret; + +- /* get serial number */ ++ /* ++ * Get serial number, on some devices (with unofficial replacement ++ * battery?) reading any of the serial number range addresses gets ++ * nacked in this case just leave the serial number empty. ++ */ + ret = i2c_smbus_read_i2c_block_data(client, MSHW0011_BAT0_REG_SERIAL_NO, + sizeof(buf), buf); +- if (ret != sizeof(buf)) { ++ if (ret == -EREMOTEIO) { ++ /* no serial number available */ ++ } else if (ret != sizeof(buf)) { + dev_err(&client->dev, "Error reading serial no: %d\n", ret); + return ret; ++ } else { ++ snprintf(bix->serial, ARRAY_SIZE(bix->serial), "%3pE%6pE", buf + 7, buf); + } +- snprintf(bix->serial, ARRAY_SIZE(bix->serial), "%3pE%6pE", buf + 7, buf); + + /* get cycle count */ + ret = i2c_smbus_read_word_data(client, MSHW0011_BAT0_REG_CYCLE_CNT); diff --git a/queue-5.16/tipc-fix-end-of-loop-tests-for-list_for_each_entry.patch b/queue-5.16/tipc-fix-end-of-loop-tests-for-list_for_each_entry.patch new file mode 100644 index 00000000000..d37311f8dc8 --- /dev/null +++ b/queue-5.16/tipc-fix-end-of-loop-tests-for-list_for_each_entry.patch @@ -0,0 +1,47 @@ +From a1f8fec4dac8bc7b172b2bdbd881e015261a6322 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 22 Feb 2022 16:43:12 +0300 +Subject: tipc: Fix end of loop tests for list_for_each_entry() + +From: Dan Carpenter + +commit a1f8fec4dac8bc7b172b2bdbd881e015261a6322 upstream. + +These tests are supposed to check if the loop exited via a break or not. +However the tests are wrong because if we did not exit via a break then +"p" is not a valid pointer. In that case, it's the equivalent of +"if (*(u32 *)sr == *last_key) {". That's going to work most of the time, +but there is a potential for those to be equal. + +Fixes: 1593123a6a49 ("tipc: add name table dump to new netlink api") +Fixes: 1a1a143daf84 ("tipc: add publication dump to new netlink api") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/tipc/name_table.c | 2 +- + net/tipc/socket.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/net/tipc/name_table.c ++++ b/net/tipc/name_table.c +@@ -967,7 +967,7 @@ static int __tipc_nl_add_nametable_publ( + list_for_each_entry(p, &sr->all_publ, all_publ) + if (p->key == *last_key) + break; +- if (p->key != *last_key) ++ if (list_entry_is_head(p, &sr->all_publ, all_publ)) + return -EPIPE; + } else { + p = list_first_entry(&sr->all_publ, +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -3749,7 +3749,7 @@ static int __tipc_nl_list_sk_publ(struct + if (p->key == *last_publ) + break; + } +- if (p->key != *last_publ) { ++ if (list_entry_is_head(p, &tsk->publications, binding_sock)) { + /* We never set seq or call nl_dump_check_consistent() + * this means that setting prev_seq here will cause the + * consistence check to fail in the netlink callback diff --git a/queue-5.16/udp_tunnel-fix-end-of-loop-test-in-udp_tunnel_nic_unregister.patch b/queue-5.16/udp_tunnel-fix-end-of-loop-test-in-udp_tunnel_nic_unregister.patch new file mode 100644 index 00000000000..ab393faef56 --- /dev/null +++ b/queue-5.16/udp_tunnel-fix-end-of-loop-test-in-udp_tunnel_nic_unregister.patch @@ -0,0 +1,35 @@ +From de7b2efacf4e83954aed3f029d347dfc0b7a4f49 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 22 Feb 2022 16:42:51 +0300 +Subject: udp_tunnel: Fix end of loop test in udp_tunnel_nic_unregister() + +From: Dan Carpenter + +commit de7b2efacf4e83954aed3f029d347dfc0b7a4f49 upstream. + +This test is checking if we exited the list via break or not. However +if it did not exit via a break then "node" does not point to a valid +udp_tunnel_nic_shared_node struct. It will work because of the way +the structs are laid out it's the equivalent of +"if (info->shared->udp_tunnel_nic_info != dev)" which will always be +true, but it's not the right way to test. + +Fixes: 74cc6d182d03 ("udp_tunnel: add the ability to share port tables") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/udp_tunnel_nic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/udp_tunnel_nic.c ++++ b/net/ipv4/udp_tunnel_nic.c +@@ -846,7 +846,7 @@ udp_tunnel_nic_unregister(struct net_dev + list_for_each_entry(node, &info->shared->devices, list) + if (node->dev == dev) + break; +- if (node->dev != dev) ++ if (list_entry_is_head(node, &info->shared->devices, list)) + return; + + list_del(&node->list);