From: Sasha Levin Date: Sun, 26 Mar 2023 23:04:13 +0000 (-0400) Subject: Fixes for 6.1 X-Git-Tag: v5.15.105~75 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=511d0fe334386d7f08a83eb65de3ea624553c391;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/arm-dts-imx6sl-tolino-shine2hd-fix-usbotg1-pinctrl.patch b/queue-6.1/arm-dts-imx6sl-tolino-shine2hd-fix-usbotg1-pinctrl.patch new file mode 100644 index 00000000000..16ac3b076ee --- /dev/null +++ b/queue-6.1/arm-dts-imx6sl-tolino-shine2hd-fix-usbotg1-pinctrl.patch @@ -0,0 +1,34 @@ +From adccf89435ac1e5cb4dfa074bb2b8528dbda7da0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Feb 2023 21:12:14 +0800 +Subject: ARM: dts: imx6sl: tolino-shine2hd: fix usbotg1 pinctrl + +From: Peng Fan + +[ Upstream commit 1cd489e1ada1cffa56bd06fd4609f5a60a985d43 ] + +usb@2184000: 'pinctrl-0' is a dependency of 'pinctrl-names' + +Signed-off-by: Peng Fan +Fixes: 9c7016f1ca6d ("ARM: dts: imx: add devicetree for Tolino Shine 2 HD") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6sl-tolino-shine2hd.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/imx6sl-tolino-shine2hd.dts b/arch/arm/boot/dts/imx6sl-tolino-shine2hd.dts +index 663ee9df79e67..d6eee157c63b7 100644 +--- a/arch/arm/boot/dts/imx6sl-tolino-shine2hd.dts ++++ b/arch/arm/boot/dts/imx6sl-tolino-shine2hd.dts +@@ -597,6 +597,7 @@ &usdhc3 { + + &usbotg1 { + pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_usbotg1>; + disable-over-current; + srp-disable; + hnp-disable; +-- +2.39.2 + diff --git a/queue-6.1/arm-dts-imx6sll-e60k02-fix-usbotg1-pinctrl.patch b/queue-6.1/arm-dts-imx6sll-e60k02-fix-usbotg1-pinctrl.patch new file mode 100644 index 00000000000..4fd4f449e61 --- /dev/null +++ b/queue-6.1/arm-dts-imx6sll-e60k02-fix-usbotg1-pinctrl.patch @@ -0,0 +1,34 @@ +From 3934dff4126691ff64f905ce6a5ea0cd98eef9e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Feb 2023 21:12:13 +0800 +Subject: ARM: dts: imx6sll: e60k02: fix usbotg1 pinctrl + +From: Peng Fan + +[ Upstream commit 957c04e9784c7c757e8cc293d7fb2a60cdf461b6 ] + +usb@2184000: 'pinctrl-0' is a dependency of 'pinctrl-names' + +Signed-off-by: Peng Fan +Fixes: c100ea86e6ab ("ARM: dts: add Netronix E60K02 board common file") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/e60k02.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/e60k02.dtsi b/arch/arm/boot/dts/e60k02.dtsi +index 935e2359f8dfa..07ae964863850 100644 +--- a/arch/arm/boot/dts/e60k02.dtsi ++++ b/arch/arm/boot/dts/e60k02.dtsi +@@ -302,6 +302,7 @@ &usdhc3 { + + &usbotg1 { + pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_usbotg1>; + disable-over-current; + srp-disable; + hnp-disable; +-- +2.39.2 + diff --git a/queue-6.1/arm-dts-imx6sll-e70k02-fix-usbotg1-pinctrl.patch b/queue-6.1/arm-dts-imx6sll-e70k02-fix-usbotg1-pinctrl.patch new file mode 100644 index 00000000000..95f7f4f6fe7 --- /dev/null +++ b/queue-6.1/arm-dts-imx6sll-e70k02-fix-usbotg1-pinctrl.patch @@ -0,0 +1,34 @@ +From 4e0b6db524800d4d0a0c84e8e76aa313b0bc8641 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Feb 2023 21:12:12 +0800 +Subject: ARM: dts: imx6sll: e70k02: fix usbotg1 pinctrl + +From: Peng Fan + +[ Upstream commit 3d37f7685d525e58674c23d607020e66d501dcd1 ] + +usb@2184000: 'pinctrl-0' is a dependency of 'pinctrl-names' + +Signed-off-by: Peng Fan +Fixes: 3bb3fd856505 ("ARM: dts: add Netronix E70K02 board common file") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/e70k02.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/e70k02.dtsi b/arch/arm/boot/dts/e70k02.dtsi +index 27ef9a62b23cf..a1f9fbd6004aa 100644 +--- a/arch/arm/boot/dts/e70k02.dtsi ++++ b/arch/arm/boot/dts/e70k02.dtsi +@@ -312,6 +312,7 @@ &usdhc3 { + + &usbotg1 { + pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_usbotg1>; + disable-over-current; + srp-disable; + hnp-disable; +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-imx8dxl-evk-disable-hibernation-mode-of-ar.patch b/queue-6.1/arm64-dts-imx8dxl-evk-disable-hibernation-mode-of-ar.patch new file mode 100644 index 00000000000..d587a7f501e --- /dev/null +++ b/queue-6.1/arm64-dts-imx8dxl-evk-disable-hibernation-mode-of-ar.patch @@ -0,0 +1,73 @@ +From 06199d04929ec479b048474a11750bf0369c0312 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Dec 2022 09:14:34 +0800 +Subject: arm64: dts: imx8dxl-evk: Disable hibernation mode of AR8031 for EQOS + +From: Wei Fang + +[ Upstream commit 0deefb5bd1382aae0aed7c8b266d5088a5308a26 ] + +The hibernation mode of AR8031 PHY defaults to be enabled after hardware +reset. When the cable is unplugged, the PHY will enter hibernation mode +after about 10 senconds and the PHY clocks will be stopped to save +power. However, due to the design of EQOS, the mac needs the RX_CLK of +PHY for software reset to complete. Otherwise the software reset of EQOS +will be failed and do not work correctly. The only way is to disable +hibernation mode of AR8031 PHY for EQOS, the "qca,disable-hibernation-mode" +property is used for this purpose and has already been submitted to the +upstream, for more details please refer to the below link: +https://lore.kernel.org/netdev/20220818030054.1010660-2-wei.fang@nxp.com/ + +This issue is easy to reproduce, just unplug the cable and "ifconfig eth0 +down", after about 10 senconds, then "ifconfig eth0 up", you will see +failure log on the serial port. The log is shown as following: +root@imx8dxlevk:~# +[34.941970] imx-dwmac 5b050000.ethernet eth0: Link is Down +root@imx8dxlevk:~# ifconfig eth0 down +[35.437814] imx-dwmac 5b050000.ethernet eth0: FPE workqueue stop +[35.507913] imx-dwmac 5b050000.ethernet eth0: PHY [stmmac-1:00] driver [Qualcomm Atheros AR8031/AR8033] (irq=POLL) +[35.518613] imx-dwmac 5b050000.ethernet eth0: configuring for phy/rgmii-id link mode +root@imx8dxlevk:~# ifconfig eth0 up +[71.143044] imx-dwmac 5b050000.ethernet eth0: Register MEM_TYPE_PAGE_POOL RxQ-0 +[71.215855] imx-dwmac 5b050000.ethernet eth0: PHY [stmmac-1:00] driver [Qualcomm Atheros AR8031/AR8033] (irq=POLL) +[72.230417] imx-dwmac 5b050000.ethernet: Failed to reset the dma +[72.236512] imx-dwmac 5b050000.ethernet eth0: stmmac_hw_setup: DMA engine initialization failed +[72.245258] imx-dwmac 5b050000.ethernet eth0: __stmmac_open: Hw setup failed +SIOCSIFFLAGS: Connection timed out + +After applying this patch, the software reset of EQOS will be +successful. And the log is shown as below. +root@imx8dxlevk:~# ifconfig eth0 up +[96.114344] imx-dwmac 5b050000.ethernet eth0: Register MEM_TYPE_PAGE_POOL RxQ-0 +[96.171466] imx-dwmac 5b050000.ethernet eth0: PHY [stmmac-1:00] driver [Qualcomm Atheros AR8031/AR8033] (irq=POLL) +[96.188883] imx-dwmac 5b050000.ethernet eth0: No Safety Features support found +[96.196221] imx-dwmac 5b050000.ethernet eth0: IEEE 1588-2008 Advanced Timestamp supported +[96.204846] imx-dwmac 5b050000.ethernet eth0: registered PTP clock +[96.225558] imx-dwmac 5b050000.ethernet eth0: FPE workqueue start +[96.236858] imx-dwmac 5b050000.ethernet eth0: configuring for phy/rgmii-id link mode +[96.249358] 8021q: adding VLAN 0 to HW filter on device eth0 + +Signed-off-by: Wei Fang +Reviewed-by: Clark Wang +Signed-off-by: Shawn Guo +Stable-dep-of: feafeb53140a ("arm64: dts: imx8dxl-evk: Fix eqos phy reset gpio") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8dxl-evk.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8dxl-evk.dts b/arch/arm64/boot/dts/freescale/imx8dxl-evk.dts +index ca2a43e0cbf61..96f5947ed5f41 100644 +--- a/arch/arm64/boot/dts/freescale/imx8dxl-evk.dts ++++ b/arch/arm64/boot/dts/freescale/imx8dxl-evk.dts +@@ -113,6 +113,7 @@ ethphy0: ethernet-phy@0 { + reg = <0>; + eee-broken-1000t; + qca,disable-smarteee; ++ qca,disable-hibernation-mode; + vddio-supply = <&vddio0>; + + vddio0: vddio-regulator { +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-imx8dxl-evk-fix-eqos-phy-reset-gpio.patch b/queue-6.1/arm64-dts-imx8dxl-evk-fix-eqos-phy-reset-gpio.patch new file mode 100644 index 00000000000..3634a7f3294 --- /dev/null +++ b/queue-6.1/arm64-dts-imx8dxl-evk-fix-eqos-phy-reset-gpio.patch @@ -0,0 +1,56 @@ +From 109b37ddb491b628d2ecb04ec1783c67532cecde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Feb 2023 11:15:05 -0600 +Subject: arm64: dts: imx8dxl-evk: Fix eqos phy reset gpio + +From: Andrew Halaney + +[ Upstream commit feafeb53140af3cde3fba46b292b15b3a0c0635c ] + +The deprecated property is named snps,reset-gpio, but this devicetree +used snps,reset-gpios instead which results in the reset not being used +and the following make dtbs_check error: + + ./arch/arm64/boot/dts/freescale/imx8dxl-evk.dtb: ethernet@5b050000: 'snps,reset-gpio' is a dependency of 'snps,reset-delays-us' + From schema: ./Documentation/devicetree/bindings/net/snps,dwmac.yaml + +Use the preferred method of defining the reset gpio in the phy node +itself. Note that this drops the 10 us pre-delay, but prior this wasn't +used at all and a pre-delay doesn't make much sense in this context so +it should be fine. + +Fixes: 8dd495d12374 ("arm64: dts: freescale: add support for i.MX8DXL EVK board") +Signed-off-by: Andrew Halaney +Acked-by: Krzysztof Kozlowski +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8dxl-evk.dts | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8dxl-evk.dts b/arch/arm64/boot/dts/freescale/imx8dxl-evk.dts +index 96f5947ed5f41..3af4c76369741 100644 +--- a/arch/arm64/boot/dts/freescale/imx8dxl-evk.dts ++++ b/arch/arm64/boot/dts/freescale/imx8dxl-evk.dts +@@ -99,8 +99,6 @@ &eqos { + phy-handle = <ðphy0>; + nvmem-cells = <&fec_mac1>; + nvmem-cell-names = "mac-address"; +- snps,reset-gpios = <&pca6416_1 2 GPIO_ACTIVE_LOW>; +- snps,reset-delays-us = <10 20 200000>; + status = "okay"; + + mdio { +@@ -114,6 +112,9 @@ ethphy0: ethernet-phy@0 { + eee-broken-1000t; + qca,disable-smarteee; + qca,disable-hibernation-mode; ++ reset-gpios = <&pca6416_1 2 GPIO_ACTIVE_LOW>; ++ reset-assert-us = <20>; ++ reset-deassert-us = <200000>; + vddio-supply = <&vddio0>; + + vddio0: vddio-regulator { +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-imx8mn-specify-sound-dai-cells-for-sai-nod.patch b/queue-6.1/arm64-dts-imx8mn-specify-sound-dai-cells-for-sai-nod.patch new file mode 100644 index 00000000000..d1b51e4c22f --- /dev/null +++ b/queue-6.1/arm64-dts-imx8mn-specify-sound-dai-cells-for-sai-nod.patch @@ -0,0 +1,69 @@ +From 07e9b6efb7cc430a75485576fe3a6c1f143fa8f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:52:44 +0100 +Subject: arm64: dts: imx8mn: specify #sound-dai-cells for SAI nodes + +From: Marek Vasut + +[ Upstream commit 62fb54148cd6eb456ff031be8fb447c98cf0bd9b ] + +Add #sound-dai-cells properties to SAI nodes. + +Reviewed-by: Adam Ford +Reviewed-by: Fabio Estevam +Fixes: 9e9860069725 ("arm64: dts: imx8mn: Add SAI nodes") +Signed-off-by: Marek Vasut +Reviewed-by: Marco Felsch +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mn.dtsi | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +index ba29b5b556ffa..37246ca9d9075 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +@@ -295,6 +295,7 @@ spba2: spba-bus@30000000 { + sai2: sai@30020000 { + compatible = "fsl,imx8mn-sai", "fsl,imx8mq-sai"; + reg = <0x30020000 0x10000>; ++ #sound-dai-cells = <0>; + interrupts = ; + clocks = <&clk IMX8MN_CLK_SAI2_IPG>, + <&clk IMX8MN_CLK_DUMMY>, +@@ -309,6 +310,7 @@ sai2: sai@30020000 { + sai3: sai@30030000 { + compatible = "fsl,imx8mn-sai", "fsl,imx8mq-sai"; + reg = <0x30030000 0x10000>; ++ #sound-dai-cells = <0>; + interrupts = ; + clocks = <&clk IMX8MN_CLK_SAI3_IPG>, + <&clk IMX8MN_CLK_DUMMY>, +@@ -323,6 +325,7 @@ sai3: sai@30030000 { + sai5: sai@30050000 { + compatible = "fsl,imx8mn-sai", "fsl,imx8mq-sai"; + reg = <0x30050000 0x10000>; ++ #sound-dai-cells = <0>; + interrupts = ; + clocks = <&clk IMX8MN_CLK_SAI5_IPG>, + <&clk IMX8MN_CLK_DUMMY>, +@@ -339,6 +342,7 @@ sai5: sai@30050000 { + sai6: sai@30060000 { + compatible = "fsl,imx8mn-sai", "fsl,imx8mq-sai"; + reg = <0x30060000 0x10000>; ++ #sound-dai-cells = <0>; + interrupts = ; + clocks = <&clk IMX8MN_CLK_SAI6_IPG>, + <&clk IMX8MN_CLK_DUMMY>, +@@ -396,6 +400,7 @@ spdif1: spdif@30090000 { + sai7: sai@300b0000 { + compatible = "fsl,imx8mn-sai", "fsl,imx8mq-sai"; + reg = <0x300b0000 0x10000>; ++ #sound-dai-cells = <0>; + interrupts = ; + clocks = <&clk IMX8MN_CLK_SAI7_IPG>, + <&clk IMX8MN_CLK_DUMMY>, +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-imx93-add-missing-address-cells-and-size-c.patch b/queue-6.1/arm64-dts-imx93-add-missing-address-cells-and-size-c.patch new file mode 100644 index 00000000000..86622b77eca --- /dev/null +++ b/queue-6.1/arm64-dts-imx93-add-missing-address-cells-and-size-c.patch @@ -0,0 +1,99 @@ +From 72b0ae83409d8db5708c8857b27444eeaf19f484 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Mar 2023 11:17:20 +0100 +Subject: arm64: dts: imx93: add missing #address-cells and #size-cells to i2c + nodes + +From: Alexander Stein + +[ Upstream commit b3cdf730486b048ca0bf23bef050550d9fd40422 ] + +Add them to the SoC .dtsi, so that not every board has to specify them. + +Fixes: 1225396fefea ("arm64: dts: imx93: add lpi2c nodes") +Signed-off-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx93.dtsi | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx93.dtsi b/arch/arm64/boot/dts/freescale/imx93.dtsi +index 0247866fc86b0..8ab9f8194702e 100644 +--- a/arch/arm64/boot/dts/freescale/imx93.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx93.dtsi +@@ -150,6 +150,8 @@ system_counter: timer@44290000 { + lpi2c1: i2c@44340000 { + compatible = "fsl,imx93-lpi2c", "fsl,imx7ulp-lpi2c"; + reg = <0x44340000 0x10000>; ++ #address-cells = <1>; ++ #size-cells = <0>; + interrupts = ; + clocks = <&clk IMX93_CLK_LPI2C1_GATE>, + <&clk IMX93_CLK_BUS_AON>; +@@ -160,6 +162,8 @@ lpi2c1: i2c@44340000 { + lpi2c2: i2c@44350000 { + compatible = "fsl,imx93-lpi2c", "fsl,imx7ulp-lpi2c"; + reg = <0x44350000 0x10000>; ++ #address-cells = <1>; ++ #size-cells = <0>; + interrupts = ; + clocks = <&clk IMX93_CLK_LPI2C2_GATE>, + <&clk IMX93_CLK_BUS_AON>; +@@ -277,6 +281,8 @@ mu2: mailbox@42440000 { + lpi2c3: i2c@42530000 { + compatible = "fsl,imx93-lpi2c", "fsl,imx7ulp-lpi2c"; + reg = <0x42530000 0x10000>; ++ #address-cells = <1>; ++ #size-cells = <0>; + interrupts = ; + clocks = <&clk IMX93_CLK_LPI2C3_GATE>, + <&clk IMX93_CLK_BUS_WAKEUP>; +@@ -287,6 +293,8 @@ lpi2c3: i2c@42530000 { + lpi2c4: i2c@42540000 { + compatible = "fsl,imx93-lpi2c", "fsl,imx7ulp-lpi2c"; + reg = <0x42540000 0x10000>; ++ #address-cells = <1>; ++ #size-cells = <0>; + interrupts = ; + clocks = <&clk IMX93_CLK_LPI2C4_GATE>, + <&clk IMX93_CLK_BUS_WAKEUP>; +@@ -351,6 +359,8 @@ lpuart8: serial@426a0000 { + lpi2c5: i2c@426b0000 { + compatible = "fsl,imx93-lpi2c", "fsl,imx7ulp-lpi2c"; + reg = <0x426b0000 0x10000>; ++ #address-cells = <1>; ++ #size-cells = <0>; + interrupts = ; + clocks = <&clk IMX93_CLK_LPI2C5_GATE>, + <&clk IMX93_CLK_BUS_WAKEUP>; +@@ -361,6 +371,8 @@ lpi2c5: i2c@426b0000 { + lpi2c6: i2c@426c0000 { + compatible = "fsl,imx93-lpi2c", "fsl,imx7ulp-lpi2c"; + reg = <0x426c0000 0x10000>; ++ #address-cells = <1>; ++ #size-cells = <0>; + interrupts = ; + clocks = <&clk IMX93_CLK_LPI2C6_GATE>, + <&clk IMX93_CLK_BUS_WAKEUP>; +@@ -371,6 +383,8 @@ lpi2c6: i2c@426c0000 { + lpi2c7: i2c@426d0000 { + compatible = "fsl,imx93-lpi2c", "fsl,imx7ulp-lpi2c"; + reg = <0x426d0000 0x10000>; ++ #address-cells = <1>; ++ #size-cells = <0>; + interrupts = ; + clocks = <&clk IMX93_CLK_LPI2C7_GATE>, + <&clk IMX93_CLK_BUS_WAKEUP>; +@@ -381,6 +395,8 @@ lpi2c7: i2c@426d0000 { + lpi2c8: i2c@426e0000 { + compatible = "fsl,imx93-lpi2c", "fsl,imx7ulp-lpi2c"; + reg = <0x426e0000 0x10000>; ++ #address-cells = <1>; ++ #size-cells = <0>; + interrupts = ; + clocks = <&clk IMX93_CLK_LPI2C8_GATE>, + <&clk IMX93_CLK_BUS_WAKEUP>; +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-qcom-sm8450-mark-ufs-controller-as-cache-c.patch b/queue-6.1/arm64-dts-qcom-sm8450-mark-ufs-controller-as-cache-c.patch new file mode 100644 index 00000000000..822afa6a0bb --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sm8450-mark-ufs-controller-as-cache-c.patch @@ -0,0 +1,37 @@ +From 03130213b56a4af70862866b6411748dec4cea30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 21:02:01 +0530 +Subject: arm64: dts: qcom: sm8450: Mark UFS controller as cache coherent + +From: Manivannan Sadhasivam + +[ Upstream commit 8ba961d4339c5db0e69ff6627606fe1f34c838e5 ] + +The UFS controller on SM8450 supports cache coherency, hence add the +"dma-coherent" property to mark it as such. + +Fixes: 07fa917a335e ("arm64: dts: qcom: sm8450: add ufs nodes") +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Neil Armstrong +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230307153201.180626-2-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8450.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi +index df0d888ffc008..4714d7bf03b9f 100644 +--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi +@@ -3104,6 +3104,7 @@ ufs_mem_hc: ufshc@1d84000 { + power-domains = <&gcc UFS_PHY_GDSC>; + + iommus = <&apps_smmu 0xe0 0x0>; ++ dma-coherent; + + interconnects = <&aggre1_noc MASTER_UFS_MEM 0 &mc_virt SLAVE_EBI1 0>, + <&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_UFS_MEM_CFG 0>; +-- +2.39.2 + diff --git a/queue-6.1/atm-idt77252-fix-kmemleak-when-rmmod-idt77252.patch b/queue-6.1/atm-idt77252-fix-kmemleak-when-rmmod-idt77252.patch new file mode 100644 index 00000000000..01ac264cbe9 --- /dev/null +++ b/queue-6.1/atm-idt77252-fix-kmemleak-when-rmmod-idt77252.patch @@ -0,0 +1,92 @@ +From 7837cd07b55f5e899a1d2e8fe30a2339d48c8754 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 14:33:18 +0000 +Subject: atm: idt77252: fix kmemleak when rmmod idt77252 + +From: Li Zetao + +[ Upstream commit 4fe3c88552a3fbe1944426a4506a18cdeb457b5a ] + +There are memory leaks reported by kmemleak: + + unreferenced object 0xffff888106500800 (size 128): + comm "modprobe", pid 1017, jiffies 4297787785 (age 67.152s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<00000000970ce626>] __kmem_cache_alloc_node+0x20c/0x380 + [<00000000fb5f78d9>] kmalloc_trace+0x2f/0xb0 + [<000000000e947e2a>] idt77252_init_one+0x2847/0x3c90 [idt77252] + [<000000006efb048e>] local_pci_probe+0xeb/0x1a0 + ... + + unreferenced object 0xffff888106500b00 (size 128): + comm "modprobe", pid 1017, jiffies 4297787785 (age 67.152s) + hex dump (first 32 bytes): + 00 20 3d 01 80 88 ff ff 00 20 3d 01 80 88 ff ff . =...... =..... + f0 23 3d 01 80 88 ff ff 00 20 3d 01 00 00 00 00 .#=...... =..... + backtrace: + [<00000000970ce626>] __kmem_cache_alloc_node+0x20c/0x380 + [<00000000fb5f78d9>] kmalloc_trace+0x2f/0xb0 + [<00000000f451c5be>] alloc_scq.constprop.0+0x4a/0x400 [idt77252] + [<00000000e6313849>] idt77252_init_one+0x28cf/0x3c90 [idt77252] + +The root cause is traced to the vc_maps which alloced in open_card_oam() +are not freed in close_card_oam(). The vc_maps are used to record +open connections, so when close a vc_map in close_card_oam(), the memory +should be freed. Moreover, the ubr0 is not closed when close a idt77252 +device, leading to the memory leak of vc_map and scq_info. + +Fix them by adding kfree in close_card_oam() and implementing new +close_card_ubr0() to close ubr0. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Li Zetao +Reviewed-by: Francois Romieu +Link: https://lore.kernel.org/r/20230320143318.2644630-1-lizetao1@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/atm/idt77252.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c +index 681cb3786794d..49cb4537344aa 100644 +--- a/drivers/atm/idt77252.c ++++ b/drivers/atm/idt77252.c +@@ -2909,6 +2909,7 @@ close_card_oam(struct idt77252_dev *card) + + recycle_rx_pool_skb(card, &vc->rcv.rx_pool); + } ++ kfree(vc); + } + } + } +@@ -2952,6 +2953,15 @@ open_card_ubr0(struct idt77252_dev *card) + return 0; + } + ++static void ++close_card_ubr0(struct idt77252_dev *card) ++{ ++ struct vc_map *vc = card->vcs[0]; ++ ++ free_scq(card, vc->scq); ++ kfree(vc); ++} ++ + static int + idt77252_dev_open(struct idt77252_dev *card) + { +@@ -3001,6 +3011,7 @@ static void idt77252_dev_close(struct atm_dev *dev) + struct idt77252_dev *card = dev->dev_data; + u32 conf; + ++ close_card_ubr0(card); + close_card_oam(card); + + conf = SAR_CFG_RXPTH | /* enable receive path */ +-- +2.39.2 + diff --git a/queue-6.1/bluetooth-btqcomsmd-fix-command-timeout-after-settin.patch b/queue-6.1/bluetooth-btqcomsmd-fix-command-timeout-after-settin.patch new file mode 100644 index 00000000000..da9c71b4178 --- /dev/null +++ b/queue-6.1/bluetooth-btqcomsmd-fix-command-timeout-after-settin.patch @@ -0,0 +1,74 @@ +From 01fbbe35ce33fc74f296eb37607d5e7be67c947c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Mar 2023 14:31:55 +0100 +Subject: Bluetooth: btqcomsmd: Fix command timeout after setting BD address + +From: Stephan Gerhold + +[ Upstream commit 5d44ab9e204200a78ad55cdf185aa2bb109b5950 ] + +On most devices using the btqcomsmd driver (e.g. the DragonBoard 410c +and other devices based on the Qualcomm MSM8916/MSM8909/... SoCs) +the Bluetooth firmware seems to become unresponsive for a while after +setting the BD address. On recent kernel versions (at least 5.17+) +this often causes timeouts for subsequent commands, e.g. the HCI reset +sent by the Bluetooth core during initialization: + + Bluetooth: hci0: Opcode 0x c03 failed: -110 + +Unfortunately this behavior does not seem to be documented anywhere. +Experimentation suggests that the minimum necessary delay to avoid +the problem is ~150us. However, to be sure add a sleep for > 1ms +in case it is a bit longer on other firmware versions. + +Older kernel versions are likely also affected, although perhaps with +slightly different errors or less probability. Side effects can easily +hide the issue in most cases, e.g. unrelated incoming interrupts that +cause the necessary delay. + +Fixes: 1511cc750c3d ("Bluetooth: Introduce Qualcomm WCNSS SMD based HCI driver") +Signed-off-by: Stephan Gerhold +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btqcomsmd.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/btqcomsmd.c b/drivers/bluetooth/btqcomsmd.c +index 2acb719e596f5..11c7e04bf3947 100644 +--- a/drivers/bluetooth/btqcomsmd.c ++++ b/drivers/bluetooth/btqcomsmd.c +@@ -122,6 +122,21 @@ static int btqcomsmd_setup(struct hci_dev *hdev) + return 0; + } + ++static int btqcomsmd_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) ++{ ++ int ret; ++ ++ ret = qca_set_bdaddr_rome(hdev, bdaddr); ++ if (ret) ++ return ret; ++ ++ /* The firmware stops responding for a while after setting the bdaddr, ++ * causing timeouts for subsequent commands. Sleep a bit to avoid this. ++ */ ++ usleep_range(1000, 10000); ++ return 0; ++} ++ + static int btqcomsmd_probe(struct platform_device *pdev) + { + struct btqcomsmd *btq; +@@ -162,7 +177,7 @@ static int btqcomsmd_probe(struct platform_device *pdev) + hdev->close = btqcomsmd_close; + hdev->send = btqcomsmd_send; + hdev->setup = btqcomsmd_setup; +- hdev->set_bdaddr = qca_set_bdaddr_rome; ++ hdev->set_bdaddr = btqcomsmd_set_bdaddr; + + ret = hci_register_dev(hdev); + if (ret < 0) +-- +2.39.2 + diff --git a/queue-6.1/bluetooth-btsdio-fix-use-after-free-bug-in-btsdio_re.patch b/queue-6.1/bluetooth-btsdio-fix-use-after-free-bug-in-btsdio_re.patch new file mode 100644 index 00000000000..dae79cbc5df --- /dev/null +++ b/queue-6.1/bluetooth-btsdio-fix-use-after-free-bug-in-btsdio_re.patch @@ -0,0 +1,39 @@ +From c55fda4727bb5ac21f1a3a41c6a88eb8ee7d4cfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Mar 2023 16:07:39 +0800 +Subject: Bluetooth: btsdio: fix use after free bug in btsdio_remove due to + unfinished work + +From: Zheng Wang + +[ Upstream commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f ] + +In btsdio_probe, &data->work was bound with btsdio_work.In +btsdio_send_frame, it was started by schedule_work. + +If we call btsdio_remove with an unfinished job, there may +be a race condition and cause UAF bug on hdev. + +Fixes: ddbaf13e3609 ("[Bluetooth] Add generic driver for Bluetooth SDIO devices") +Signed-off-by: Zheng Wang +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btsdio.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c +index 795be33f2892d..02893600db390 100644 +--- a/drivers/bluetooth/btsdio.c ++++ b/drivers/bluetooth/btsdio.c +@@ -354,6 +354,7 @@ static void btsdio_remove(struct sdio_func *func) + + BT_DBG("func %p", func); + ++ cancel_work_sync(&data->work); + if (!data) + return; + +-- +2.39.2 + diff --git a/queue-6.1/bluetooth-btusb-remove-detection-of-iso-packets-over.patch b/queue-6.1/bluetooth-btusb-remove-detection-of-iso-packets-over.patch new file mode 100644 index 00000000000..e7c7d2341bc --- /dev/null +++ b/queue-6.1/bluetooth-btusb-remove-detection-of-iso-packets-over.patch @@ -0,0 +1,49 @@ +From 136eab2ff34e89033a9ddf77ff9f356a2bbf2222 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Feb 2023 15:54:31 -0800 +Subject: Bluetooth: btusb: Remove detection of ISO packets over bulk + +From: Luiz Augusto von Dentz + +[ Upstream commit efe375b716c1c1c9b52a816f5b933a95421020a2 ] + +This removes the code introduced by +14202eff214e1e941fefa0366d4c3bc4b1a0d500 as hci_recv_frame is now able +to detect ACL packets that are in fact ISO packets. + +Fixes: 14202eff214e ("Bluetooth: btusb: Detect if an ACL packet is in fact an ISO packet") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 952dc9d2404ed..90b85dcb138df 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -1020,21 +1020,11 @@ static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count) + hci_skb_expect(skb) -= len; + + if (skb->len == HCI_ACL_HDR_SIZE) { +- __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle); + __le16 dlen = hci_acl_hdr(skb)->dlen; +- __u8 type; + + /* Complete ACL header */ + hci_skb_expect(skb) = __le16_to_cpu(dlen); + +- /* Detect if ISO packet has been sent over bulk */ +- if (hci_conn_num(data->hdev, ISO_LINK)) { +- type = hci_conn_lookup_type(data->hdev, +- hci_handle(handle)); +- if (type == ISO_LINK) +- hci_skb_pkt_type(skb) = HCI_ISODATA_PKT; +- } +- + if (skb_tailroom(skb) < hci_skb_expect(skb)) { + kfree_skb(skb); + skb = NULL; +-- +2.39.2 + diff --git a/queue-6.1/bluetooth-hci-fix-global-out-of-bounds.patch b/queue-6.1/bluetooth-hci-fix-global-out-of-bounds.patch new file mode 100644 index 00000000000..1a43b97d26b --- /dev/null +++ b/queue-6.1/bluetooth-hci-fix-global-out-of-bounds.patch @@ -0,0 +1,123 @@ +From 4ed3d13e56617c838a73b26e871022316b17bb31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 21:50:18 -0400 +Subject: Bluetooth: HCI: Fix global-out-of-bounds + +From: Sungwoo Kim + +[ Upstream commit bce56405201111807cc8e4f47c6de3e10b17c1ac ] + +To loop a variable-length array, hci_init_stage_sync(stage) considers +that stage[i] is valid as long as stage[i-1].func is valid. +Thus, the last element of stage[].func should be intentionally invalid +as hci_init0[], le_init2[], and others did. +However, amp_init1[] and amp_init2[] have no invalid element, letting +hci_init_stage_sync() keep accessing amp_init1[] over its valid range. +This patch fixes this by adding {} in the last of amp_init1[] and +amp_init2[]. + +================================================================== +BUG: KASAN: global-out-of-bounds in hci_dev_open_sync ( +/v6.2-bzimage/net/bluetooth/hci_sync.c:3154 +/v6.2-bzimage/net/bluetooth/hci_sync.c:3343 +/v6.2-bzimage/net/bluetooth/hci_sync.c:4418 +/v6.2-bzimage/net/bluetooth/hci_sync.c:4609 +/v6.2-bzimage/net/bluetooth/hci_sync.c:4689) +Read of size 8 at addr ffffffffaed1ab70 by task kworker/u5:0/1032 +CPU: 0 PID: 1032 Comm: kworker/u5:0 Not tainted 6.2.0 #3 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04 +Workqueue: hci1 hci_power_on +Call Trace: + +dump_stack_lvl (/v6.2-bzimage/lib/dump_stack.c:107 (discriminator 1)) +print_report (/v6.2-bzimage/mm/kasan/report.c:307 + /v6.2-bzimage/mm/kasan/report.c:417) +? hci_dev_open_sync (/v6.2-bzimage/net/bluetooth/hci_sync.c:3154 + /v6.2-bzimage/net/bluetooth/hci_sync.c:3343 + /v6.2-bzimage/net/bluetooth/hci_sync.c:4418 + /v6.2-bzimage/net/bluetooth/hci_sync.c:4609 + /v6.2-bzimage/net/bluetooth/hci_sync.c:4689) +kasan_report (/v6.2-bzimage/mm/kasan/report.c:184 + /v6.2-bzimage/mm/kasan/report.c:519) +? hci_dev_open_sync (/v6.2-bzimage/net/bluetooth/hci_sync.c:3154 + /v6.2-bzimage/net/bluetooth/hci_sync.c:3343 + /v6.2-bzimage/net/bluetooth/hci_sync.c:4418 + /v6.2-bzimage/net/bluetooth/hci_sync.c:4609 + /v6.2-bzimage/net/bluetooth/hci_sync.c:4689) +hci_dev_open_sync (/v6.2-bzimage/net/bluetooth/hci_sync.c:3154 + /v6.2-bzimage/net/bluetooth/hci_sync.c:3343 + /v6.2-bzimage/net/bluetooth/hci_sync.c:4418 + /v6.2-bzimage/net/bluetooth/hci_sync.c:4609 + /v6.2-bzimage/net/bluetooth/hci_sync.c:4689) +? __pfx_hci_dev_open_sync (/v6.2-bzimage/net/bluetooth/hci_sync.c:4635) +? mutex_lock (/v6.2-bzimage/./arch/x86/include/asm/atomic64_64.h:190 + /v6.2-bzimage/./include/linux/atomic/atomic-long.h:443 + /v6.2-bzimage/./include/linux/atomic/atomic-instrumented.h:1781 + /v6.2-bzimage/kernel/locking/mutex.c:171 + /v6.2-bzimage/kernel/locking/mutex.c:285) +? __pfx_mutex_lock (/v6.2-bzimage/kernel/locking/mutex.c:282) +hci_power_on (/v6.2-bzimage/net/bluetooth/hci_core.c:485 + /v6.2-bzimage/net/bluetooth/hci_core.c:984) +? __pfx_hci_power_on (/v6.2-bzimage/net/bluetooth/hci_core.c:969) +? read_word_at_a_time (/v6.2-bzimage/./include/asm-generic/rwonce.h:85) +? strscpy (/v6.2-bzimage/./arch/x86/include/asm/word-at-a-time.h:62 + /v6.2-bzimage/lib/string.c:161) +process_one_work (/v6.2-bzimage/kernel/workqueue.c:2294) +worker_thread (/v6.2-bzimage/./include/linux/list.h:292 + /v6.2-bzimage/kernel/workqueue.c:2437) +? __pfx_worker_thread (/v6.2-bzimage/kernel/workqueue.c:2379) +kthread (/v6.2-bzimage/kernel/kthread.c:376) +? __pfx_kthread (/v6.2-bzimage/kernel/kthread.c:331) +ret_from_fork (/v6.2-bzimage/arch/x86/entry/entry_64.S:314) + +The buggy address belongs to the variable: +amp_init1+0x30/0x60 +The buggy address belongs to the physical page: +page:000000003a157ec6 refcount:1 mapcount:0 mapping:0000000000000000 ia +flags: 0x200000000001000(reserved|node=0|zone=2) +raw: 0200000000001000 ffffea0005054688 ffffea0005054688 000000000000000 +raw: 0000000000000000 0000000000000000 00000001ffffffff 000000000000000 +page dumped because: kasan: bad access detected +Memory state around the buggy address: + ffffffffaed1aa00: f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9 00 00 00 00 + ffffffffaed1aa80: 00 00 00 00 f9 f9 f9 f9 00 00 00 00 00 00 00 00 +>ffffffffaed1ab00: 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 + ^ + ffffffffaed1ab80: f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9 00 00 00 f9 + ffffffffaed1ac00: f9 f9 f9 f9 00 06 f9 f9 f9 f9 f9 f9 00 00 02 f9 + +This bug is found by FuzzBT, a modified version of Syzkaller. +Other contributors for this bug are Ruoyu Wu and Peng Hui. + +Fixes: d0b137062b2d ("Bluetooth: hci_sync: Rework init stages") +Signed-off-by: Sungwoo Kim +Reviewed-by: Simon Horman +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_sync.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 13ec3c86a0dcf..f886c1d05c882 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -3340,6 +3340,7 @@ static const struct hci_init_stage amp_init1[] = { + HCI_INIT(hci_read_flow_control_mode_sync), + /* HCI_OP_READ_LOCATION_DATA */ + HCI_INIT(hci_read_location_data_sync), ++ {} + }; + + static int hci_init1_sync(struct hci_dev *hdev) +@@ -3374,6 +3375,7 @@ static int hci_init1_sync(struct hci_dev *hdev) + static const struct hci_init_stage amp_init2[] = { + /* HCI_OP_READ_LOCAL_FEATURES */ + HCI_INIT(hci_read_local_features_sync), ++ {} + }; + + /* Read Buffer Size (ACL mtu, max pkt, etc.) */ +-- +2.39.2 + diff --git a/queue-6.1/bluetooth-hci_core-detect-if-an-acl-packet-is-in-fac.patch b/queue-6.1/bluetooth-hci_core-detect-if-an-acl-packet-is-in-fac.patch new file mode 100644 index 00000000000..97b6a51482a --- /dev/null +++ b/queue-6.1/bluetooth-hci_core-detect-if-an-acl-packet-is-in-fac.patch @@ -0,0 +1,64 @@ +From 5b779cdd564062cec3686e3c6e96d17f56e01815 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Feb 2023 15:43:31 -0800 +Subject: Bluetooth: hci_core: Detect if an ACL packet is in fact an ISO packet + +From: Luiz Augusto von Dentz + +[ Upstream commit 876e78104f23ce9267822757a63562a609b126c3 ] + +Because some transports don't have a dedicated type for ISO packets +(see 14202eff214e1e941fefa0366d4c3bc4b1a0d500) they may use ACL type +when in fact they are ISO packets. + +In the past this was left for the driver to detect such thing but it +creates a problem when using the likes of btproxy when used by a VM as +the host would not be aware of the connection the guest is doing it +won't be able to detect such behavior, so this make bt_recv_frame +detect when it happens as it is the common interface to all drivers +including guest VMs. + +Fixes: 14202eff214e ("Bluetooth: btusb: Detect if an ACL packet is in fact an ISO packet") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 23 +++++++++++++++++++---- + 1 file changed, 19 insertions(+), 4 deletions(-) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index b65c3aabcd536..334e308451f53 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -2871,10 +2871,25 @@ int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb) + return -ENXIO; + } + +- if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT && +- hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && +- hci_skb_pkt_type(skb) != HCI_SCODATA_PKT && +- hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) { ++ switch (hci_skb_pkt_type(skb)) { ++ case HCI_EVENT_PKT: ++ break; ++ case HCI_ACLDATA_PKT: ++ /* Detect if ISO packet has been sent as ACL */ ++ if (hci_conn_num(hdev, ISO_LINK)) { ++ __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle); ++ __u8 type; ++ ++ type = hci_conn_lookup_type(hdev, hci_handle(handle)); ++ if (type == ISO_LINK) ++ hci_skb_pkt_type(skb) = HCI_ISODATA_PKT; ++ } ++ break; ++ case HCI_SCODATA_PKT: ++ break; ++ case HCI_ISODATA_PKT: ++ break; ++ default: + kfree_skb(skb); + return -EINVAL; + } +-- +2.39.2 + diff --git a/queue-6.1/bluetooth-hci_sync-resume-adv-with-no-rpa-when-activ.patch b/queue-6.1/bluetooth-hci_sync-resume-adv-with-no-rpa-when-activ.patch new file mode 100644 index 00000000000..3669607e52d --- /dev/null +++ b/queue-6.1/bluetooth-hci_sync-resume-adv-with-no-rpa-when-activ.patch @@ -0,0 +1,134 @@ +From 77f31579590d1185079ccab255dde36c0635849d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Feb 2023 16:17:56 -0800 +Subject: Bluetooth: hci_sync: Resume adv with no RPA when active scan + +From: Zhengping Jiang + +[ Upstream commit 3c44a431d62bf4a20d7b901f98266ae3f4676d48 ] + +The address resolution should be disabled during the active scan, +so all the advertisements can reach the host. The advertising +has to be paused before disabling the address resolution, +because the advertising will prevent any changes to the resolving +list and the address resolution status. Skipping this will cause +the hci error and the discovery failure. + +According to the bluetooth specification: +"7.8.44 LE Set Address Resolution Enable command + +This command shall not be used when: +- Advertising (other than periodic advertising) is enabled, +- Scanning is enabled, or +- an HCI_LE_Create_Connection, HCI_LE_Extended_Create_Connection, or + HCI_LE_Periodic_Advertising_Create_Sync command is outstanding." + +If the host is using RPA, the controller needs to generate RPA for +the advertising, so the advertising must remain paused during the +active scan. + +If the host is not using RPA, the advertising can be resumed after +disabling the address resolution. + +Fixes: 9afc675edeeb ("Bluetooth: hci_sync: allow advertise when scan without RPA") +Signed-off-by: Zhengping Jiang +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_sync.c | 64 +++++++++++++++++++++++++++------------- + 1 file changed, 44 insertions(+), 20 deletions(-) + +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 3eec688a88a92..13ec3c86a0dcf 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -2367,6 +2367,45 @@ static int hci_resume_advertising_sync(struct hci_dev *hdev) + return err; + } + ++static int hci_pause_addr_resolution(struct hci_dev *hdev) ++{ ++ int err; ++ ++ if (!use_ll_privacy(hdev)) ++ return 0; ++ ++ if (!hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) ++ return 0; ++ ++ /* Cannot disable addr resolution if scanning is enabled or ++ * when initiating an LE connection. ++ */ ++ if (hci_dev_test_flag(hdev, HCI_LE_SCAN) || ++ hci_lookup_le_connect(hdev)) { ++ bt_dev_err(hdev, "Command not allowed when scan/LE connect"); ++ return -EPERM; ++ } ++ ++ /* Cannot disable addr resolution if advertising is enabled. */ ++ err = hci_pause_advertising_sync(hdev); ++ if (err) { ++ bt_dev_err(hdev, "Pause advertising failed: %d", err); ++ return err; ++ } ++ ++ err = hci_le_set_addr_resolution_enable_sync(hdev, 0x00); ++ if (err) ++ bt_dev_err(hdev, "Unable to disable Address Resolution: %d", ++ err); ++ ++ /* Return if address resolution is disabled and RPA is not used. */ ++ if (!err && scan_use_rpa(hdev)) ++ return err; ++ ++ hci_resume_advertising_sync(hdev); ++ return err; ++} ++ + struct sk_buff *hci_read_local_oob_data_sync(struct hci_dev *hdev, + bool extended, struct sock *sk) + { +@@ -2402,7 +2441,7 @@ static u8 hci_update_accept_list_sync(struct hci_dev *hdev) + u8 filter_policy; + int err; + +- /* Pause advertising if resolving list can be used as controllers are ++ /* Pause advertising if resolving list can be used as controllers + * cannot accept resolving list modifications while advertising. + */ + if (use_ll_privacy(hdev)) { +@@ -5376,27 +5415,12 @@ static int hci_active_scan_sync(struct hci_dev *hdev, uint16_t interval) + + cancel_interleave_scan(hdev); + +- /* Pause advertising since active scanning disables address resolution +- * which advertising depend on in order to generate its RPAs. +- */ +- if (use_ll_privacy(hdev) && hci_dev_test_flag(hdev, HCI_PRIVACY)) { +- err = hci_pause_advertising_sync(hdev); +- if (err) { +- bt_dev_err(hdev, "pause advertising failed: %d", err); +- goto failed; +- } +- } +- +- /* Disable address resolution while doing active scanning since the +- * accept list shall not be used and all reports shall reach the host +- * anyway. ++ /* Pause address resolution for active scan and stop advertising if ++ * privacy is enabled. + */ +- err = hci_le_set_addr_resolution_enable_sync(hdev, 0x00); +- if (err) { +- bt_dev_err(hdev, "Unable to disable Address Resolution: %d", +- err); ++ err = hci_pause_addr_resolution(hdev); ++ if (err) + goto failed; +- } + + /* All active scans will be done with either a resolvable private + * address (when privacy feature has been enabled) or non-resolvable +-- +2.39.2 + diff --git a/queue-6.1/bluetooth-iso-fix-timestamped-hci-iso-data-packet-pa.patch b/queue-6.1/bluetooth-iso-fix-timestamped-hci-iso-data-packet-pa.patch new file mode 100644 index 00000000000..9c4d5fdf95e --- /dev/null +++ b/queue-6.1/bluetooth-iso-fix-timestamped-hci-iso-data-packet-pa.patch @@ -0,0 +1,66 @@ +From 32328c46eac0c11792a10930dcad7003c9f713c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Feb 2023 19:38:24 +0000 +Subject: Bluetooth: ISO: fix timestamped HCI ISO data packet parsing + +From: Pauli Virtanen + +[ Upstream commit 2f10e40a948e8a2abe7f983df3959a333ca8955f ] + +Use correct HCI ISO data packet header struct when the packet has +timestamp. The timestamp, when present, goes before the other fields +(Core v5.3 4E 5.4.5), so the structs are not compatible. + +Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") +Signed-off-by: Pauli Virtanen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/iso.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index 2dabef488eaae..cb959e8eac185 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -1621,7 +1621,6 @@ static void iso_disconn_cfm(struct hci_conn *hcon, __u8 reason) + void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) + { + struct iso_conn *conn = hcon->iso_data; +- struct hci_iso_data_hdr *hdr; + __u16 pb, ts, len; + + if (!conn) +@@ -1643,6 +1642,8 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) + } + + if (ts) { ++ struct hci_iso_ts_data_hdr *hdr; ++ + /* TODO: add timestamp to the packet? */ + hdr = skb_pull_data(skb, HCI_ISO_TS_DATA_HDR_SIZE); + if (!hdr) { +@@ -1650,15 +1651,19 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) + goto drop; + } + ++ len = __le16_to_cpu(hdr->slen); + } else { ++ struct hci_iso_data_hdr *hdr; ++ + hdr = skb_pull_data(skb, HCI_ISO_DATA_HDR_SIZE); + if (!hdr) { + BT_ERR("Frame is too short (len %d)", skb->len); + goto drop; + } ++ ++ len = __le16_to_cpu(hdr->slen); + } + +- len = __le16_to_cpu(hdr->slen); + flags = hci_iso_data_flags(len); + len = hci_iso_data_len(len); + +-- +2.39.2 + diff --git a/queue-6.1/bluetooth-l2cap-fix-responding-with-wrong-pdu-type.patch b/queue-6.1/bluetooth-l2cap-fix-responding-with-wrong-pdu-type.patch new file mode 100644 index 00000000000..eb51dbdb644 --- /dev/null +++ b/queue-6.1/bluetooth-l2cap-fix-responding-with-wrong-pdu-type.patch @@ -0,0 +1,226 @@ +From 5f0ef604083d45ab669c76d078003f2b6e9d73f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Mar 2023 14:20:34 -0800 +Subject: Bluetooth: L2CAP: Fix responding with wrong PDU type + +From: Luiz Augusto von Dentz + +[ Upstream commit 9aa9d9473f1550d1936c31259720b3f1f4690576 ] + +L2CAP_ECRED_CONN_REQ shall be responded with L2CAP_ECRED_CONN_RSP not +L2CAP_LE_CONN_RSP: + +L2CAP LE EATT Server - Reject - run + Listening for connections + New client connection with handle 0x002a + Sending L2CAP Request from client + Client received response code 0x15 + Unexpected L2CAP response code (expected 0x18) +L2CAP LE EATT Server - Reject - test failed + +> ACL Data RX: Handle 42 flags 0x02 dlen 26 + LE L2CAP: Enhanced Credit Connection Request (0x17) ident 1 len 18 + PSM: 39 (0x0027) + MTU: 64 + MPS: 64 + Credits: 5 + Source CID: 65 + Source CID: 66 + Source CID: 67 + Source CID: 68 + Source CID: 69 +< ACL Data TX: Handle 42 flags 0x00 dlen 16 + LE L2CAP: LE Connection Response (0x15) ident 1 len 8 + invalid size + 00 00 00 00 00 00 06 00 + +L2CAP LE EATT Server - Reject - run + Listening for connections + New client connection with handle 0x002a + Sending L2CAP Request from client + Client received response code 0x18 +L2CAP LE EATT Server - Reject - test passed + +Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/l2cap_core.c | 117 +++++++++++++++++++++++++------------ + 1 file changed, 79 insertions(+), 38 deletions(-) + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index da85768b04b76..b6f69d1feeeec 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -708,6 +708,17 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err) + } + EXPORT_SYMBOL_GPL(l2cap_chan_del); + ++static void __l2cap_chan_list_id(struct l2cap_conn *conn, u16 id, ++ l2cap_chan_func_t func, void *data) ++{ ++ struct l2cap_chan *chan, *l; ++ ++ list_for_each_entry_safe(chan, l, &conn->chan_l, list) { ++ if (chan->ident == id) ++ func(chan, data); ++ } ++} ++ + static void __l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func, + void *data) + { +@@ -775,23 +786,9 @@ static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan) + + static void l2cap_chan_ecred_connect_reject(struct l2cap_chan *chan) + { +- struct l2cap_conn *conn = chan->conn; +- struct l2cap_ecred_conn_rsp rsp; +- u16 result; +- +- if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) +- result = L2CAP_CR_LE_AUTHORIZATION; +- else +- result = L2CAP_CR_LE_BAD_PSM; +- + l2cap_state_change(chan, BT_DISCONN); + +- memset(&rsp, 0, sizeof(rsp)); +- +- rsp.result = cpu_to_le16(result); +- +- l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), +- &rsp); ++ __l2cap_ecred_conn_rsp_defer(chan); + } + + static void l2cap_chan_connect_reject(struct l2cap_chan *chan) +@@ -846,7 +843,7 @@ void l2cap_chan_close(struct l2cap_chan *chan, int reason) + break; + case L2CAP_MODE_EXT_FLOWCTL: + l2cap_chan_ecred_connect_reject(chan); +- break; ++ return; + } + } + } +@@ -3938,43 +3935,86 @@ void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan) + &rsp); + } + +-void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan) ++static void l2cap_ecred_list_defer(struct l2cap_chan *chan, void *data) + { ++ int *result = data; ++ ++ if (*result || test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags)) ++ return; ++ ++ switch (chan->state) { ++ case BT_CONNECT2: ++ /* If channel still pending accept add to result */ ++ (*result)++; ++ return; ++ case BT_CONNECTED: ++ return; ++ default: ++ /* If not connected or pending accept it has been refused */ ++ *result = -ECONNREFUSED; ++ return; ++ } ++} ++ ++struct l2cap_ecred_rsp_data { + struct { + struct l2cap_ecred_conn_rsp rsp; +- __le16 dcid[5]; ++ __le16 scid[L2CAP_ECRED_MAX_CID]; + } __packed pdu; ++ int count; ++}; ++ ++static void l2cap_ecred_rsp_defer(struct l2cap_chan *chan, void *data) ++{ ++ struct l2cap_ecred_rsp_data *rsp = data; ++ ++ if (test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags)) ++ return; ++ ++ /* Reset ident so only one response is sent */ ++ chan->ident = 0; ++ ++ /* Include all channels pending with the same ident */ ++ if (!rsp->pdu.rsp.result) ++ rsp->pdu.rsp.dcid[rsp->count++] = cpu_to_le16(chan->scid); ++ else ++ l2cap_chan_del(chan, ECONNRESET); ++} ++ ++void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan) ++{ + struct l2cap_conn *conn = chan->conn; +- u16 ident = chan->ident; +- int i = 0; ++ struct l2cap_ecred_rsp_data data; ++ u16 id = chan->ident; ++ int result = 0; + +- if (!ident) ++ if (!id) + return; + +- BT_DBG("chan %p ident %d", chan, ident); ++ BT_DBG("chan %p id %d", chan, id); + +- pdu.rsp.mtu = cpu_to_le16(chan->imtu); +- pdu.rsp.mps = cpu_to_le16(chan->mps); +- pdu.rsp.credits = cpu_to_le16(chan->rx_credits); +- pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS); ++ memset(&data, 0, sizeof(data)); + +- mutex_lock(&conn->chan_lock); ++ data.pdu.rsp.mtu = cpu_to_le16(chan->imtu); ++ data.pdu.rsp.mps = cpu_to_le16(chan->mps); ++ data.pdu.rsp.credits = cpu_to_le16(chan->rx_credits); ++ data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS); + +- list_for_each_entry(chan, &conn->chan_l, list) { +- if (chan->ident != ident) +- continue; ++ /* Verify that all channels are ready */ ++ __l2cap_chan_list_id(conn, id, l2cap_ecred_list_defer, &result); + +- /* Reset ident so only one response is sent */ +- chan->ident = 0; ++ if (result > 0) ++ return; + +- /* Include all channels pending with the same ident */ +- pdu.dcid[i++] = cpu_to_le16(chan->scid); +- } ++ if (result < 0) ++ data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_AUTHORIZATION); + +- mutex_unlock(&conn->chan_lock); ++ /* Build response */ ++ __l2cap_chan_list_id(conn, id, l2cap_ecred_rsp_defer, &data); + +- l2cap_send_cmd(conn, ident, L2CAP_ECRED_CONN_RSP, +- sizeof(pdu.rsp) + i * sizeof(__le16), &pdu); ++ l2cap_send_cmd(conn, id, L2CAP_ECRED_CONN_RSP, ++ sizeof(data.pdu.rsp) + (data.count * sizeof(__le16)), ++ &data.pdu); + } + + void __l2cap_connect_rsp_defer(struct l2cap_chan *chan) +@@ -6078,6 +6118,7 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn, + __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); + + chan->ident = cmd->ident; ++ chan->mode = L2CAP_MODE_EXT_FLOWCTL; + + if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { + l2cap_state_change(chan, BT_CONNECT2); +-- +2.39.2 + diff --git a/queue-6.1/bluetooth-mgmt-fix-mgmt-add-advmon-with-rssi-command.patch b/queue-6.1/bluetooth-mgmt-fix-mgmt-add-advmon-with-rssi-command.patch new file mode 100644 index 00000000000..1bf2b88925b --- /dev/null +++ b/queue-6.1/bluetooth-mgmt-fix-mgmt-add-advmon-with-rssi-command.patch @@ -0,0 +1,41 @@ +From 016bbde859b31ce07704b3492fa6e3d222e9df52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 18:11:38 +0800 +Subject: Bluetooth: mgmt: Fix MGMT add advmon with RSSI command + +From: Howard Chung + +[ Upstream commit 1a0291f81529e8044fb29845a0196ba47af894ce ] + +The MGMT command: MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI uses variable +length argument. This causes host not able to register advmon with rssi. + +This patch has been locally tested by adding monitor with rssi via +btmgmt on a kernel 6.1 machine. + +Reviewed-by: Archie Pusaka +Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh") +Signed-off-by: Howard Chung +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 7576db8eb83e2..fc4ba0884da96 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -9346,7 +9346,8 @@ static const struct hci_mgmt_handler mgmt_handlers[] = { + { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, + HCI_MGMT_VAR_LEN }, + { add_adv_patterns_monitor_rssi, +- MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE }, ++ MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, ++ HCI_MGMT_VAR_LEN }, + { set_mesh, MGMT_SET_MESH_RECEIVER_SIZE, + HCI_MGMT_VAR_LEN }, + { mesh_features, MGMT_MESH_READ_FEATURES_SIZE }, +-- +2.39.2 + diff --git a/queue-6.1/bluetooth-remove-power-on-check-from-mesh-feature.patch b/queue-6.1/bluetooth-remove-power-on-check-from-mesh-feature.patch new file mode 100644 index 00000000000..21f62b4b922 --- /dev/null +++ b/queue-6.1/bluetooth-remove-power-on-check-from-mesh-feature.patch @@ -0,0 +1,43 @@ +From e2b89ee8b98d4511ca768001052d59f8699895c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 14:32:21 -0800 +Subject: Bluetooth: Remove "Power-on" check from Mesh feature + +From: Brian Gix + +[ Upstream commit 52dd5e964a55c98c1b0bcf5fc737a5ddd00e7d4d ] + +The Bluetooth mesh experimental feature enable was requiring the +controller to be powered off in order for the Enable to work. Mesh is +supposed to be enablable regardless of the controller state, and created +an unintended requirement that the mesh daemon be started before the +classic bluetoothd daemon. + +Fixes: af6bcc1921ff ("Bluetooth: Add experimental wrapper for MGMT based mesh") +Signed-off-by: Brian Gix +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 0dd30a3beb776..7576db8eb83e2 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -4627,12 +4627,6 @@ static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev, + MGMT_OP_SET_EXP_FEATURE, + MGMT_STATUS_INVALID_INDEX); + +- /* Changes can only be made when controller is powered down */ +- if (hdev_is_powered(hdev)) +- return mgmt_cmd_status(sk, hdev->id, +- MGMT_OP_SET_EXP_FEATURE, +- MGMT_STATUS_REJECTED); +- + /* Parameters are limited to a single octet */ + if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) + return mgmt_cmd_status(sk, hdev->id, +-- +2.39.2 + diff --git a/queue-6.1/bootconfig-fix-testcase-to-increase-max-node.patch b/queue-6.1/bootconfig-fix-testcase-to-increase-max-node.patch new file mode 100644 index 00000000000..d5a42e4bb1e --- /dev/null +++ b/queue-6.1/bootconfig-fix-testcase-to-increase-max-node.patch @@ -0,0 +1,59 @@ +From 0e0242cd124384a7cf6019c65a4221f3129a3ccf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 22:54:08 +0900 +Subject: bootconfig: Fix testcase to increase max node + +From: Masami Hiramatsu (Google) + +[ Upstream commit b69245126a48e50882021180fa5d264dc7149ccc ] + +Since commit 6c40624930c5 ("bootconfig: Increase max nodes of bootconfig +from 1024 to 8192 for DCC support") increased the max number of bootconfig +node to 8192, the bootconfig testcase of the max number of nodes fails. +To fix this issue, we can not simply increase the number in the test script +because the test bootconfig file becomes too big (>32KB). To fix that, we +can use a combination of three alphabets (26^3 = 17576). But with that, +we can not express the 8193 (just one exceed from the limitation) because +it also exceeds the max size of bootconfig. So, the first 26 nodes will just +use one alphabet. + +With this fix, test-bootconfig.sh passes all tests. + +Link: https://lore.kernel.org/all/167888844790.791176.670805252426835131.stgit@devnote2/ + +Reported-by: Heinz Wiesinger +Link: https://lore.kernel.org/all/2463802.XAFRqVoOGU@amaterasu.liwjatan.org +Fixes: 6c40624930c5 ("bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support") +Signed-off-by: Masami Hiramatsu (Google) +Reviewed-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + tools/bootconfig/test-bootconfig.sh | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/tools/bootconfig/test-bootconfig.sh b/tools/bootconfig/test-bootconfig.sh +index f68e2e9eef8b2..a2c484c243f5d 100755 +--- a/tools/bootconfig/test-bootconfig.sh ++++ b/tools/bootconfig/test-bootconfig.sh +@@ -87,10 +87,14 @@ xfail grep -i "error" $OUTFILE + + echo "Max node number check" + +-echo -n > $TEMPCONF +-for i in `seq 1 1024` ; do +- echo "node$i" >> $TEMPCONF +-done ++awk ' ++BEGIN { ++ for (i = 0; i < 26; i += 1) ++ printf("%c\n", 65 + i % 26) ++ for (i = 26; i < 8192; i += 1) ++ printf("%c%c%c\n", 65 + i % 26, 65 + (i / 26) % 26, 65 + (i / 26 / 26)) ++} ++' > $TEMPCONF + xpass $BOOTCONF -a $TEMPCONF $INITRD + + echo "badnode" >> $TEMPCONF +-- +2.39.2 + diff --git a/queue-6.1/bpf-adjust-insufficient-default-bpf_jit_limit.patch b/queue-6.1/bpf-adjust-insufficient-default-bpf_jit_limit.patch new file mode 100644 index 00000000000..4f085f42834 --- /dev/null +++ b/queue-6.1/bpf-adjust-insufficient-default-bpf_jit_limit.patch @@ -0,0 +1,78 @@ +From 38fd429fe24bc66c7bdf98e240a258b6ebd8c142 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 15:37:25 +0100 +Subject: bpf: Adjust insufficient default bpf_jit_limit + +From: Daniel Borkmann + +[ Upstream commit 10ec8ca8ec1a2f04c4ed90897225231c58c124a7 ] + +We've seen recent AWS EKS (Kubernetes) user reports like the following: + + After upgrading EKS nodes from v20230203 to v20230217 on our 1.24 EKS + clusters after a few days a number of the nodes have containers stuck + in ContainerCreating state or liveness/readiness probes reporting the + following error: + + Readiness probe errored: rpc error: code = Unknown desc = failed to + exec in container: failed to start exec "4a11039f730203ffc003b7[...]": + OCI runtime exec failed: exec failed: unable to start container process: + unable to init seccomp: error loading seccomp filter into kernel: + error loading seccomp filter: errno 524: unknown + + However, we had not been seeing this issue on previous AMIs and it only + started to occur on v20230217 (following the upgrade from kernel 5.4 to + 5.10) with no other changes to the underlying cluster or workloads. + + We tried the suggestions from that issue (sysctl net.core.bpf_jit_limit=452534528) + which helped to immediately allow containers to be created and probes to + execute but after approximately a day the issue returned and the value + returned by cat /proc/vmallocinfo | grep bpf_jit | awk '{s+=$2} END {print s}' + was steadily increasing. + +I tested bpf tree to observe bpf_jit_charge_modmem, bpf_jit_uncharge_modmem +their sizes passed in as well as bpf_jit_current under tcpdump BPF filter, +seccomp BPF and native (e)BPF programs, and the behavior all looks sane +and expected, that is nothing "leaking" from an upstream perspective. + +The bpf_jit_limit knob was originally added in order to avoid a situation +where unprivileged applications loading BPF programs (e.g. seccomp BPF +policies) consuming all the module memory space via BPF JIT such that loading +of kernel modules would be prevented. The default limit was defined back in +2018 and while good enough back then, we are generally seeing far more BPF +consumers today. + +Adjust the limit for the BPF JIT pool from originally 1/4 to now 1/2 of the +module memory space to better reflect today's needs and avoid more users +running into potentially hard to debug issues. + +Fixes: fdadd04931c2 ("bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K") +Reported-by: Stephen Haynes +Reported-by: Lefteris Alexakis +Signed-off-by: Daniel Borkmann +Link: https://github.com/awslabs/amazon-eks-ami/issues/1179 +Link: https://github.com/awslabs/amazon-eks-ami/issues/1219 +Reviewed-by: Kuniyuki Iwashima +Link: https://lore.kernel.org/r/20230320143725.8394-1-daniel@iogearbox.net +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index 211f63e87c637..64706723624b9 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -969,7 +969,7 @@ static int __init bpf_jit_charge_init(void) + { + /* Only used as heuristic here to derive limit. */ + bpf_jit_limit_max = bpf_jit_alloc_exec_limit(); +- bpf_jit_limit = min_t(u64, round_up(bpf_jit_limit_max >> 2, ++ bpf_jit_limit = min_t(u64, round_up(bpf_jit_limit_max >> 1, + PAGE_SIZE), LONG_MAX); + return 0; + } +-- +2.39.2 + diff --git a/queue-6.1/drm-amd-display-set-dcn32-caps.seamless_odm.patch b/queue-6.1/drm-amd-display-set-dcn32-caps.seamless_odm.patch new file mode 100644 index 00000000000..5ac31133f13 --- /dev/null +++ b/queue-6.1/drm-amd-display-set-dcn32-caps.seamless_odm.patch @@ -0,0 +1,40 @@ +From 77b6cf8e90e609c71c191f65a97d7339ac431ae6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Mar 2023 15:58:54 -0500 +Subject: drm/amd/display: Set dcn32 caps.seamless_odm + +From: Hersen Wu + +[ Upstream commit f9537b1fa7fb51c2162bc15ce469cbbf1ca0fbfe ] + +[Why & How] +seamless_odm set was not picked up while +merging commit 2d017189e2b3 ("drm/amd/display: +Blank eDP on enable drv if odm enabled") + +Fixes: 2d017189e2b3 ("drm/amd/display: Blank eDP on enable drv if odm enabled") +Reviewed-by: Qingqing Zhuo +Acked-by: Qingqing Zhuo +Signed-off-by: Hersen Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c +index 26fc5cad7a770..a942e2812183a 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c +@@ -2142,6 +2142,7 @@ static bool dcn32_resource_construct( + dc->caps.edp_dsc_support = true; + dc->caps.extended_aux_timeout_support = true; + dc->caps.dmcub_support = true; ++ dc->caps.seamless_odm = true; + + /* Color pipeline capabilities */ + dc->caps.color.dpp.dcn_arch = 1; +-- +2.39.2 + diff --git a/queue-6.1/drm-i915-fbdev-lock-the-fbdev-obj-before-vma-pin.patch b/queue-6.1/drm-i915-fbdev-lock-the-fbdev-obj-before-vma-pin.patch new file mode 100644 index 00000000000..7dba1e9824d --- /dev/null +++ b/queue-6.1/drm-i915-fbdev-lock-the-fbdev-obj-before-vma-pin.patch @@ -0,0 +1,77 @@ +From 272687208b1205b5b05ff8d441889bbc88f325a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 12:10:52 -0800 +Subject: drm/i915/fbdev: lock the fbdev obj before vma pin + +From: Tejas Upadhyay + +[ Upstream commit ed00eba03474adbf525ff03d69705d8c78b76456 ] + +lock the fbdev obj before calling into +i915_vma_pin_iomap(). This helps to solve below : + +<7>[ 93.563308] i915 0000:00:02.0: [drm:intelfb_create [i915]] no BIOS fb, allocating a new one +<4>[ 93.581844] ------------[ cut here ]------------ +<4>[ 93.581855] WARNING: CPU: 12 PID: 625 at drivers/gpu/drm/i915/gem/i915_gem_pages.c:424 i915_gem_object_pin_map+0x152/0x1c0 [i915] + +Fixes: f0b6b01b3efe ("drm/i915: Add ww context to intel_dpt_pin, v2.") +Cc: Chris Wilson +Cc: Matthew Auld +Cc: Maarten Lankhorst +Signed-off-by: Tejas Upadhyay +Signed-off-by: Radhakrishna Sripada +Reviewed-by: Andi Shyti +Link: https://patchwork.freedesktop.org/patch/msgid/20230301201053.928709-5-radhakrishna.sripada@intel.com +(cherry picked from commit 561b31acfd65502a2cda2067513240fc57ccdbdc) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_fbdev.c | 24 ++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_fbdev.c b/drivers/gpu/drm/i915/display/intel_fbdev.c +index d9b42905bad84..968915000519f 100644 +--- a/drivers/gpu/drm/i915/display/intel_fbdev.c ++++ b/drivers/gpu/drm/i915/display/intel_fbdev.c +@@ -208,6 +208,7 @@ static int intelfb_create(struct drm_fb_helper *helper, + bool prealloc = false; + void __iomem *vaddr; + struct drm_i915_gem_object *obj; ++ struct i915_gem_ww_ctx ww; + int ret; + + mutex_lock(&ifbdev->hpd_lock); +@@ -288,13 +289,24 @@ static int intelfb_create(struct drm_fb_helper *helper, + info->fix.smem_len = vma->size; + } + +- vaddr = i915_vma_pin_iomap(vma); +- if (IS_ERR(vaddr)) { +- drm_err(&dev_priv->drm, +- "Failed to remap framebuffer into virtual memory (%pe)\n", vaddr); +- ret = PTR_ERR(vaddr); +- goto out_unpin; ++ for_i915_gem_ww(&ww, ret, false) { ++ ret = i915_gem_object_lock(vma->obj, &ww); ++ ++ if (ret) ++ continue; ++ ++ vaddr = i915_vma_pin_iomap(vma); ++ if (IS_ERR(vaddr)) { ++ drm_err(&dev_priv->drm, ++ "Failed to remap framebuffer into virtual memory (%pe)\n", vaddr); ++ ret = PTR_ERR(vaddr); ++ continue; ++ } + } ++ ++ if (ret) ++ goto out_unpin; ++ + info->screen_base = vaddr; + info->screen_size = vma->size; + +-- +2.39.2 + diff --git a/queue-6.1/drm-i915-gt-perform-uc-late-init-after-probe-error-i.patch b/queue-6.1/drm-i915-gt-perform-uc-late-init-after-probe-error-i.patch new file mode 100644 index 00000000000..cc0c48d92d1 --- /dev/null +++ b/queue-6.1/drm-i915-gt-perform-uc-late-init-after-probe-error-i.patch @@ -0,0 +1,49 @@ +From bf6c8e2694beabd2501908b1b333b61d6ecb3b85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 16:19:20 +0100 +Subject: drm/i915/gt: perform uc late init after probe error injection + +From: Andrzej Hajda + +[ Upstream commit 150784f9285e656373cf3953ef4a7663f1e1a0f2 ] + +Probe pseudo errors should be injected only in places where real errors +can be encountered, otherwise unwinding code can be broken. +Placing intel_uc_init_late before i915_inject_probe_error violated +this rule, resulting in following bug: +__intel_gt_disable:655 GEM_BUG_ON(intel_gt_pm_is_awake(gt)) + +Fixes: 481d458caede ("drm/i915/guc: Add golden context to GuC ADS") +Acked-by: Nirmoy Das +Reviewed-by: Andi Shyti +Signed-off-by: Andrzej Hajda +Link: https://patchwork.freedesktop.org/patch/msgid/20230314151920.1065847-1-andrzej.hajda@intel.com +(cherry picked from commit c4252a11131c7f27a158294241466e2a4e7ff94e) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_gt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_gt.c b/drivers/gpu/drm/i915/gt/intel_gt.c +index c7db49749a636..d12ec092e62df 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gt.c ++++ b/drivers/gpu/drm/i915/gt/intel_gt.c +@@ -691,12 +691,12 @@ int intel_gt_init(struct intel_gt *gt) + if (err) + goto err_gt; + +- intel_uc_init_late(>->uc); +- + err = i915_inject_probe_error(gt->i915, -EIO); + if (err) + goto err_gt; + ++ intel_uc_init_late(>->uc); ++ + intel_migrate_init(>->migrate, gt); + + intel_pxp_init(>->pxp); +-- +2.39.2 + diff --git a/queue-6.1/drm-i915-guc-fix-missing-ecodes.patch b/queue-6.1/drm-i915-guc-fix-missing-ecodes.patch new file mode 100644 index 00000000000..eacf0e99941 --- /dev/null +++ b/queue-6.1/drm-i915-guc-fix-missing-ecodes.patch @@ -0,0 +1,88 @@ +From c1eb875ef23ef0fceec53b170cf0fba94936c31b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 22:37:12 -0800 +Subject: drm/i915/guc: Fix missing ecodes + +From: John Harrison + +[ Upstream commit 8df23e4c4f72f4e201c28e6fb0a67e2dbf30628a ] + +Error captures are tagged with an 'ecode'. This is a pseduo-unique magic +number that is meant to distinguish similar seeming bugs with +different underlying signatures. It is a combination of two ring state +registers. Unfortunately, the register state being used is only valid +in execlist mode. In GuC mode, the register state exists in a separate +list of arbitrary register address/value pairs rather than the named +entry structure. So, search through that list to find the two exciting +registers and copy them over to the structure's named members. + +v2: if else if instead of if if (Alan) + +Signed-off-by: John Harrison +Reviewed-by: Alan Previn +Fixes: a6f0f9cf330a ("drm/i915/guc: Plumb GuC-capture into gpu_coredump") +Cc: Alan Previn +Cc: Umesh Nerlige Ramappa +Cc: Lucas De Marchi +Cc: Jani Nikula +Cc: Joonas Lahtinen +Cc: Rodrigo Vivi +Cc: Tvrtko Ursulin +Cc: Matt Roper +Cc: Aravind Iddamsetty +Cc: Michael Cheng +Cc: Matthew Brost +Cc: Bruce Chang +Cc: Daniele Ceraolo Spurio +Cc: Matthew Auld +Link: https://patchwork.freedesktop.org/patch/msgid/20230311063714.570389-2-John.C.Harrison@Intel.com +(cherry picked from commit 9724ecdbb9ddd6da3260e4a442574b90fc75188a) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + .../gpu/drm/i915/gt/uc/intel_guc_capture.c | 22 +++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_capture.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_capture.c +index 13118609339ac..1e1fa20fb41c9 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_capture.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_capture.c +@@ -1556,6 +1556,27 @@ int intel_guc_capture_print_engine_node(struct drm_i915_error_state_buf *ebuf, + + #endif //CONFIG_DRM_I915_CAPTURE_ERROR + ++static void guc_capture_find_ecode(struct intel_engine_coredump *ee) ++{ ++ struct gcap_reg_list_info *reginfo; ++ struct guc_mmio_reg *regs; ++ i915_reg_t reg_ipehr = RING_IPEHR(0); ++ i915_reg_t reg_instdone = RING_INSTDONE(0); ++ int i; ++ ++ if (!ee->guc_capture_node) ++ return; ++ ++ reginfo = ee->guc_capture_node->reginfo + GUC_CAPTURE_LIST_TYPE_ENGINE_INSTANCE; ++ regs = reginfo->regs; ++ for (i = 0; i < reginfo->num_regs; i++) { ++ if (regs[i].offset == reg_ipehr.reg) ++ ee->ipehr = regs[i].value; ++ else if (regs[i].offset == reg_instdone.reg) ++ ee->instdone.instdone = regs[i].value; ++ } ++} ++ + void intel_guc_capture_free_node(struct intel_engine_coredump *ee) + { + if (!ee || !ee->guc_capture_node) +@@ -1597,6 +1618,7 @@ void intel_guc_capture_get_matching_node(struct intel_gt *gt, + list_del(&n->link); + ee->guc_capture_node = n; + ee->guc_capture = guc->capture; ++ guc_capture_find_ecode(ee); + return; + } + } +-- +2.39.2 + diff --git a/queue-6.1/drm-i915-guc-rename-guc-register-state-capture-node-.patch b/queue-6.1/drm-i915-guc-rename-guc-register-state-capture-node-.patch new file mode 100644 index 00000000000..d6b25dee702 --- /dev/null +++ b/queue-6.1/drm-i915-guc-rename-guc-register-state-capture-node-.patch @@ -0,0 +1,74 @@ +From afbc307f24e22b1fc6a6a33a96d7e390e6450546 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 16:28:42 -0800 +Subject: drm/i915/guc: Rename GuC register state capture node to be more + obvious + +From: John Harrison + +[ Upstream commit 583ebae783b8241a30581c084ad6226051b594c5 ] + +The GuC specific register state entry in the error capture object was +just called 'capture'. Although the companion 'node' entry was called +'guc_capture_node'. Rename the base entry to be 'guc_capture' instead +so that it is a) more consistent and b) more obvious what it is. + +Signed-off-by: John Harrison +Reviewed-by: Daniele Ceraolo Spurio +Link: https://patchwork.freedesktop.org/patch/msgid/20230127002842.3169194-9-John.C.Harrison@Intel.com +Stable-dep-of: 8df23e4c4f72 ("drm/i915/guc: Fix missing ecodes") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/uc/intel_guc_capture.c | 8 ++++---- + drivers/gpu/drm/i915/i915_gpu_error.h | 2 +- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_capture.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_capture.c +index 685ddccc0f26a..13118609339ac 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_capture.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_capture.c +@@ -1491,7 +1491,7 @@ int intel_guc_capture_print_engine_node(struct drm_i915_error_state_buf *ebuf, + + if (!ebuf || !ee) + return -EINVAL; +- cap = ee->capture; ++ cap = ee->guc_capture; + if (!cap || !ee->engine) + return -ENODEV; + +@@ -1561,8 +1561,8 @@ void intel_guc_capture_free_node(struct intel_engine_coredump *ee) + if (!ee || !ee->guc_capture_node) + return; + +- guc_capture_add_node_to_cachelist(ee->capture, ee->guc_capture_node); +- ee->capture = NULL; ++ guc_capture_add_node_to_cachelist(ee->guc_capture, ee->guc_capture_node); ++ ee->guc_capture = NULL; + ee->guc_capture_node = NULL; + } + +@@ -1596,7 +1596,7 @@ void intel_guc_capture_get_matching_node(struct intel_gt *gt, + (ce->lrc.lrca & CTX_GTT_ADDRESS_MASK)) { + list_del(&n->link); + ee->guc_capture_node = n; +- ee->capture = guc->capture; ++ ee->guc_capture = guc->capture; + return; + } + } +diff --git a/drivers/gpu/drm/i915/i915_gpu_error.h b/drivers/gpu/drm/i915/i915_gpu_error.h +index efc75cc2ffdb9..56027ffbce51f 100644 +--- a/drivers/gpu/drm/i915/i915_gpu_error.h ++++ b/drivers/gpu/drm/i915/i915_gpu_error.h +@@ -94,7 +94,7 @@ struct intel_engine_coredump { + struct intel_instdone instdone; + + /* GuC matched capture-lists info */ +- struct intel_guc_state_capture *capture; ++ struct intel_guc_state_capture *guc_capture; + struct __guc_capture_parsed_output *guc_capture_node; + + struct i915_gem_context_coredump { +-- +2.39.2 + diff --git a/queue-6.1/drm-i915-print-return-value-on-error.patch b/queue-6.1/drm-i915-print-return-value-on-error.patch new file mode 100644 index 00000000000..511cf0a66d8 --- /dev/null +++ b/queue-6.1/drm-i915-print-return-value-on-error.patch @@ -0,0 +1,56 @@ +From 9a2587f78f8114c31a85e622c1057fb24b0a9396 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Oct 2022 17:46:55 +0200 +Subject: drm/i915: Print return value on error + +From: Nirmoy Das + +[ Upstream commit 20c68127e8e9d7899001c47465d0b79581f5fdc1 ] + +Print returned error code for better debuggability. + +References: https://gitlab.freedesktop.org/drm/intel/-/issues/7211 +Signed-off-by: Nirmoy Das +Reviewed-by: Andrzej Hajda +Signed-off-by: Matthew Auld +Link: https://patchwork.freedesktop.org/patch/msgid/20221014154655.14075-1-nirmoy.das@intel.com +Stable-dep-of: ed00eba03474 ("drm/i915/fbdev: lock the fbdev obj before vma pin") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_fbdev.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_fbdev.c b/drivers/gpu/drm/i915/display/intel_fbdev.c +index 9899b5dcd291d..d9b42905bad84 100644 +--- a/drivers/gpu/drm/i915/display/intel_fbdev.c ++++ b/drivers/gpu/drm/i915/display/intel_fbdev.c +@@ -175,7 +175,7 @@ static int intelfb_alloc(struct drm_fb_helper *helper, + } + + if (IS_ERR(obj)) { +- drm_err(&dev_priv->drm, "failed to allocate framebuffer\n"); ++ drm_err(&dev_priv->drm, "failed to allocate framebuffer (%pe)\n", obj); + return PTR_ERR(obj); + } + +@@ -256,7 +256,7 @@ static int intelfb_create(struct drm_fb_helper *helper, + + info = drm_fb_helper_alloc_fbi(helper); + if (IS_ERR(info)) { +- drm_err(&dev_priv->drm, "Failed to allocate fb_info\n"); ++ drm_err(&dev_priv->drm, "Failed to allocate fb_info (%pe)\n", info); + ret = PTR_ERR(info); + goto out_unpin; + } +@@ -291,7 +291,7 @@ static int intelfb_create(struct drm_fb_helper *helper, + vaddr = i915_vma_pin_iomap(vma); + if (IS_ERR(vaddr)) { + drm_err(&dev_priv->drm, +- "Failed to remap framebuffer into virtual memory\n"); ++ "Failed to remap framebuffer into virtual memory (%pe)\n", vaddr); + ret = PTR_ERR(vaddr); + goto out_unpin; + } +-- +2.39.2 + diff --git a/queue-6.1/efi-libstub-smbios-use-length-member-instead-of-reco.patch b/queue-6.1/efi-libstub-smbios-use-length-member-instead-of-reco.patch new file mode 100644 index 00000000000..455884b74c5 --- /dev/null +++ b/queue-6.1/efi-libstub-smbios-use-length-member-instead-of-reco.patch @@ -0,0 +1,37 @@ +From cfb8a1876d5e2b48ed62174ae35317a6726aaaba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 19:23:09 +0100 +Subject: efi/libstub: smbios: Use length member instead of record struct size + +From: Ard Biesheuvel + +[ Upstream commit 34343eb06afc04af9178a9883d9354dc12beede0 ] + +The type 1 SMBIOS record happens to always be the same size, but there +are other record types which have been augmented over time, and so we +should really use the length field in the header to decide where the +string table starts. + +Fixes: 550b33cfd4452968 ("arm64: efi: Force the use of ...") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/libstub/smbios.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/efi/libstub/smbios.c b/drivers/firmware/efi/libstub/smbios.c +index 460418b7f5f5e..aadb422b9637d 100644 +--- a/drivers/firmware/efi/libstub/smbios.c ++++ b/drivers/firmware/efi/libstub/smbios.c +@@ -36,7 +36,7 @@ const u8 *__efi_get_smbios_string(u8 type, int offset, int recsize) + if (status != EFI_SUCCESS) + return NULL; + +- strtable = (u8 *)record + recsize; ++ strtable = (u8 *)record + record->length; + for (int i = 1; i < ((u8 *)record)[offset]; i++) { + int len = strlen(strtable); + +-- +2.39.2 + diff --git a/queue-6.1/erspan-do-not-use-skb_mac_header-in-ndo_start_xmit.patch b/queue-6.1/erspan-do-not-use-skb_mac_header-in-ndo_start_xmit.patch new file mode 100644 index 00000000000..769f791f7b4 --- /dev/null +++ b/queue-6.1/erspan-do-not-use-skb_mac_header-in-ndo_start_xmit.patch @@ -0,0 +1,122 @@ +From 459174f537a2cfb3ba7da250736c69f2c02cc1ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 16:34:27 +0000 +Subject: erspan: do not use skb_mac_header() in ndo_start_xmit() + +From: Eric Dumazet + +[ Upstream commit 8e50ed774554f93d55426039b27b1e38d7fa64d8 ] + +Drivers should not assume skb_mac_header(skb) == skb->data in their +ndo_start_xmit(). + +Use skb_network_offset() and skb_transport_offset() which +better describe what is needed in erspan_fb_xmit() and +ip6erspan_tunnel_xmit() + +syzbot reported: +WARNING: CPU: 0 PID: 5083 at include/linux/skbuff.h:2873 skb_mac_header include/linux/skbuff.h:2873 [inline] +WARNING: CPU: 0 PID: 5083 at include/linux/skbuff.h:2873 ip6erspan_tunnel_xmit+0x1d9c/0x2d90 net/ipv6/ip6_gre.c:962 +Modules linked in: +CPU: 0 PID: 5083 Comm: syz-executor406 Not tainted 6.3.0-rc2-syzkaller-00866-gd4671cb96fa3 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 +RIP: 0010:skb_mac_header include/linux/skbuff.h:2873 [inline] +RIP: 0010:ip6erspan_tunnel_xmit+0x1d9c/0x2d90 net/ipv6/ip6_gre.c:962 +Code: 04 02 41 01 de 84 c0 74 08 3c 03 0f 8e 1c 0a 00 00 45 89 b4 24 c8 00 00 00 c6 85 77 fe ff ff 01 e9 33 e7 ff ff e8 b4 27 a1 f8 <0f> 0b e9 b6 e7 ff ff e8 a8 27 a1 f8 49 8d bf f0 0c 00 00 48 b8 00 +RSP: 0018:ffffc90003b2f830 EFLAGS: 00010293 +RAX: 0000000000000000 RBX: 000000000000ffff RCX: 0000000000000000 +RDX: ffff888021273a80 RSI: ffffffff88e1bd4c RDI: 0000000000000003 +RBP: ffffc90003b2f9d8 R08: 0000000000000003 R09: 000000000000ffff +R10: 000000000000ffff R11: 0000000000000000 R12: ffff88802b28da00 +R13: 00000000000000d0 R14: ffff88807e25b6d0 R15: ffff888023408000 +FS: 0000555556a61300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 000055e5b11eb6e8 CR3: 0000000027c1b000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + +__netdev_start_xmit include/linux/netdevice.h:4900 [inline] +netdev_start_xmit include/linux/netdevice.h:4914 [inline] +__dev_direct_xmit+0x504/0x730 net/core/dev.c:4300 +dev_direct_xmit include/linux/netdevice.h:3088 [inline] +packet_xmit+0x20a/0x390 net/packet/af_packet.c:285 +packet_snd net/packet/af_packet.c:3075 [inline] +packet_sendmsg+0x31a0/0x5150 net/packet/af_packet.c:3107 +sock_sendmsg_nosec net/socket.c:724 [inline] +sock_sendmsg+0xde/0x190 net/socket.c:747 +__sys_sendto+0x23a/0x340 net/socket.c:2142 +__do_sys_sendto net/socket.c:2154 [inline] +__se_sys_sendto net/socket.c:2150 [inline] +__x64_sys_sendto+0xe1/0x1b0 net/socket.c:2150 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7f123aaa1039 +Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007ffc15d12058 EFLAGS: 00000246 ORIG_RAX: 000000000000002c +RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f123aaa1039 +RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 +RBP: 0000000000000000 R08: 0000000020000040 R09: 0000000000000014 +R10: 0000000000000000 R11: 0000000000000246 R12: 00007f123aa648c0 +R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000 + +Fixes: 1baf5ebf8954 ("erspan: auto detect truncated packets.") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230320163427.8096-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_gre.c | 4 ++-- + net/ipv6/ip6_gre.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index cae9f1a4e059f..5b8242265617d 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -552,7 +552,7 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev) + truncate = true; + } + +- nhoff = skb_network_header(skb) - skb_mac_header(skb); ++ nhoff = skb_network_offset(skb); + if (skb->protocol == htons(ETH_P_IP) && + (ntohs(ip_hdr(skb)->tot_len) > skb->len - nhoff)) + truncate = true; +@@ -561,7 +561,7 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev) + int thoff; + + if (skb_transport_header_was_set(skb)) +- thoff = skb_transport_header(skb) - skb_mac_header(skb); ++ thoff = skb_transport_offset(skb); + else + thoff = nhoff + sizeof(struct ipv6hdr); + if (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff) +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index c035a96fba3a4..4d5937af08ee9 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -981,7 +981,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, + truncate = true; + } + +- nhoff = skb_network_header(skb) - skb_mac_header(skb); ++ nhoff = skb_network_offset(skb); + if (skb->protocol == htons(ETH_P_IP) && + (ntohs(ip_hdr(skb)->tot_len) > skb->len - nhoff)) + truncate = true; +@@ -990,7 +990,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, + int thoff; + + if (skb_transport_header_was_set(skb)) +- thoff = skb_transport_header(skb) - skb_mac_header(skb); ++ thoff = skb_transport_offset(skb); + else + thoff = nhoff + sizeof(struct ipv6hdr); + if (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff) +-- +2.39.2 + diff --git a/queue-6.1/gve-cache-link_speed-value-from-device.patch b/queue-6.1/gve-cache-link_speed-value-from-device.patch new file mode 100644 index 00000000000..8e7bda03aad --- /dev/null +++ b/queue-6.1/gve-cache-link_speed-value-from-device.patch @@ -0,0 +1,47 @@ +From 685ee8cf5cf09aee395b980594745c54ddee4bc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 10:23:32 -0700 +Subject: gve: Cache link_speed value from device + +From: Joshua Washington + +[ Upstream commit 68c3e4fc8628b1487c965aabb29207249657eb5f ] + +The link speed is never changed for the uptime of a VM, and the current +implementation sends an admin queue command for each call. Admin queue +command invocations have nontrivial overhead (e.g., VM exits), which can +be disruptive to users if triggered frequently. Our telemetry data shows +that there are VMs that make frequent calls to this admin queue command. +Caching the result of the original admin queue command would eliminate +the need to send multiple admin queue commands on subsequent calls to +retrieve link speed. + +Fixes: 7e074d5a76ca ("gve: Enable Link Speed Reporting in the driver.") +Signed-off-by: Joshua Washington +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230321172332.91678-1-joshwash@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/google/gve/gve_ethtool.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/google/gve/gve_ethtool.c b/drivers/net/ethernet/google/gve/gve_ethtool.c +index 7b9a2d9d96243..38df602f2869c 100644 +--- a/drivers/net/ethernet/google/gve/gve_ethtool.c ++++ b/drivers/net/ethernet/google/gve/gve_ethtool.c +@@ -535,7 +535,10 @@ static int gve_get_link_ksettings(struct net_device *netdev, + struct ethtool_link_ksettings *cmd) + { + struct gve_priv *priv = netdev_priv(netdev); +- int err = gve_adminq_report_link_speed(priv); ++ int err = 0; ++ ++ if (priv->link_speed == 0) ++ err = gve_adminq_report_link_speed(priv); + + cmd->base.speed = priv->link_speed; + return err; +-- +2.39.2 + diff --git a/queue-6.1/hvc-xen-prevent-concurrent-accesses-to-the-shared-ri.patch b/queue-6.1/hvc-xen-prevent-concurrent-accesses-to-the-shared-ri.patch new file mode 100644 index 00000000000..05c4dca4d81 --- /dev/null +++ b/queue-6.1/hvc-xen-prevent-concurrent-accesses-to-the-shared-ri.patch @@ -0,0 +1,147 @@ +From 42c56d8f11aec7b1603769af57d84f52037f1d52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Nov 2022 16:09:11 +0100 +Subject: hvc/xen: prevent concurrent accesses to the shared ring +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Roger Pau Monne + +[ Upstream commit 6214894f49a967c749ee6c07cb00f9cede748df4 ] + +The hvc machinery registers both a console and a tty device based on +the hv ops provided by the specific implementation. Those two +interfaces however have different locks, and there's no single locks +that's shared between the tty and the console implementations, hence +the driver needs to protect itself against concurrent accesses. +Otherwise concurrent calls using the split interfaces are likely to +corrupt the ring indexes, leaving the console unusable. + +Introduce a lock to xencons_info to serialize accesses to the shared +ring. This is only required when using the shared memory console, +concurrent accesses to the hypercall based console implementation are +not an issue. + +Note the conditional logic in domU_read_console() is slightly modified +so the notify_daemon() call can be done outside of the locked region: +it's an hypercall and there's no need for it to be done with the lock +held. + +Fixes: b536b4b96230 ('xen: use the hvc console infrastructure for Xen console') +Signed-off-by: Roger Pau Monné +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20221130150919.13935-1-roger.pau@citrix.com +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + drivers/tty/hvc/hvc_xen.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c +index 37809c6c027fc..d9d0232753286 100644 +--- a/drivers/tty/hvc/hvc_xen.c ++++ b/drivers/tty/hvc/hvc_xen.c +@@ -43,6 +43,7 @@ struct xencons_info { + int irq; + int vtermno; + grant_ref_t gntref; ++ spinlock_t ring_lock; + }; + + static LIST_HEAD(xenconsoles); +@@ -89,12 +90,15 @@ static int __write_console(struct xencons_info *xencons, + XENCONS_RING_IDX cons, prod; + struct xencons_interface *intf = xencons->intf; + int sent = 0; ++ unsigned long flags; + ++ spin_lock_irqsave(&xencons->ring_lock, flags); + cons = intf->out_cons; + prod = intf->out_prod; + mb(); /* update queue values before going on */ + + if ((prod - cons) > sizeof(intf->out)) { ++ spin_unlock_irqrestore(&xencons->ring_lock, flags); + pr_err_once("xencons: Illegal ring page indices"); + return -EINVAL; + } +@@ -104,6 +108,7 @@ static int __write_console(struct xencons_info *xencons, + + wmb(); /* write ring before updating pointer */ + intf->out_prod = prod; ++ spin_unlock_irqrestore(&xencons->ring_lock, flags); + + if (sent) + notify_daemon(xencons); +@@ -146,16 +151,19 @@ static int domU_read_console(uint32_t vtermno, char *buf, int len) + int recv = 0; + struct xencons_info *xencons = vtermno_to_xencons(vtermno); + unsigned int eoiflag = 0; ++ unsigned long flags; + + if (xencons == NULL) + return -EINVAL; + intf = xencons->intf; + ++ spin_lock_irqsave(&xencons->ring_lock, flags); + cons = intf->in_cons; + prod = intf->in_prod; + mb(); /* get pointers before reading ring */ + + if ((prod - cons) > sizeof(intf->in)) { ++ spin_unlock_irqrestore(&xencons->ring_lock, flags); + pr_err_once("xencons: Illegal ring page indices"); + return -EINVAL; + } +@@ -179,10 +187,13 @@ static int domU_read_console(uint32_t vtermno, char *buf, int len) + xencons->out_cons = intf->out_cons; + xencons->out_cons_same = 0; + } ++ if (!recv && xencons->out_cons_same++ > 1) { ++ eoiflag = XEN_EOI_FLAG_SPURIOUS; ++ } ++ spin_unlock_irqrestore(&xencons->ring_lock, flags); ++ + if (recv) { + notify_daemon(xencons); +- } else if (xencons->out_cons_same++ > 1) { +- eoiflag = XEN_EOI_FLAG_SPURIOUS; + } + + xen_irq_lateeoi(xencons->irq, eoiflag); +@@ -239,6 +250,7 @@ static int xen_hvm_console_init(void) + info = kzalloc(sizeof(struct xencons_info), GFP_KERNEL); + if (!info) + return -ENOMEM; ++ spin_lock_init(&info->ring_lock); + } else if (info->intf != NULL) { + /* already configured */ + return 0; +@@ -275,6 +287,7 @@ static int xen_hvm_console_init(void) + + static int xencons_info_pv_init(struct xencons_info *info, int vtermno) + { ++ spin_lock_init(&info->ring_lock); + info->evtchn = xen_start_info->console.domU.evtchn; + /* GFN == MFN for PV guest */ + info->intf = gfn_to_virt(xen_start_info->console.domU.mfn); +@@ -325,6 +338,7 @@ static int xen_initial_domain_console_init(void) + info = kzalloc(sizeof(struct xencons_info), GFP_KERNEL); + if (!info) + return -ENOMEM; ++ spin_lock_init(&info->ring_lock); + } + + info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false); +@@ -482,6 +496,7 @@ static int xencons_probe(struct xenbus_device *dev, + info = kzalloc(sizeof(struct xencons_info), GFP_KERNEL); + if (!info) + return -ENOMEM; ++ spin_lock_init(&info->ring_lock); + dev_set_drvdata(&dev->dev, info); + info->xbdev = dev; + info->vtermno = xenbus_devid_to_vtermno(devid); +-- +2.39.2 + diff --git a/queue-6.1/i2c-hisi-only-use-the-completion-interrupt-to-finish.patch b/queue-6.1/i2c-hisi-only-use-the-completion-interrupt-to-finish.patch new file mode 100644 index 00000000000..f4741610e48 --- /dev/null +++ b/queue-6.1/i2c-hisi-only-use-the-completion-interrupt-to-finish.patch @@ -0,0 +1,47 @@ +From f9c82a6de03baad75a459490bf2c06c2c7a40998 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 15:45:52 +0800 +Subject: i2c: hisi: Only use the completion interrupt to finish the transfer + +From: Yicong Yang + +[ Upstream commit d98263512684a47e81bcb72a5408958ecd1e60b0 ] + +The controller will always generate a completion interrupt when the +transfer is finished normally or not. Currently we use either error or +completion interrupt to finish, this may result the completion +interrupt unhandled and corrupt the next transfer, especially at low +speed mode. Since on error case, the error interrupt will come first +then is the completion interrupt. So only use the completion interrupt +to finish the whole transfer process. + +Fixes: d62fbdb99a85 ("i2c: add support for HiSilicon I2C controller") +Reported-by: Sheng Feng +Signed-off-by: Sheng Feng +Signed-off-by: Yicong Yang +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-hisi.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-hisi.c b/drivers/i2c/busses/i2c-hisi.c +index 76c3d8f6fc3c6..d30071f299879 100644 +--- a/drivers/i2c/busses/i2c-hisi.c ++++ b/drivers/i2c/busses/i2c-hisi.c +@@ -339,7 +339,11 @@ static irqreturn_t hisi_i2c_irq(int irq, void *context) + hisi_i2c_read_rx_fifo(ctlr); + + out: +- if (int_stat & HISI_I2C_INT_TRANS_CPLT || ctlr->xfer_err) { ++ /* ++ * Only use TRANS_CPLT to indicate the completion. On error cases we'll ++ * get two interrupts, INT_ERR first then TRANS_CPLT. ++ */ ++ if (int_stat & HISI_I2C_INT_TRANS_CPLT) { + hisi_i2c_disable_int(ctlr, HISI_I2C_INT_ALL); + hisi_i2c_clear_int(ctlr, HISI_I2C_INT_ALL); + complete(ctlr->completion); +-- +2.39.2 + diff --git a/queue-6.1/i2c-imx-lpi2c-check-only-for-enabled-interrupt-flags.patch b/queue-6.1/i2c-imx-lpi2c-check-only-for-enabled-interrupt-flags.patch new file mode 100644 index 00000000000..b473876feec --- /dev/null +++ b/queue-6.1/i2c-imx-lpi2c-check-only-for-enabled-interrupt-flags.patch @@ -0,0 +1,47 @@ +From 75f68fec30322901da65cf03390609fec0205899 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 16:32:47 +0100 +Subject: i2c: imx-lpi2c: check only for enabled interrupt flags + +From: Alexander Stein + +[ Upstream commit 1c7885004567e8951d65a983be095f254dd20bef ] + +When reading from I2C, the Tx watermark is set to 0. Unfortunately the +TDF (transmit data flag) is enabled when Tx FIFO entries is equal or less +than watermark. So it is set in every case, hence the reset default of 1. +This results in the MSR_RDF _and_ MSR_TDF flags to be set thus trying +to send Tx data on a read message. +Mask the IRQ status to filter for wanted flags only. + +Fixes: a55fa9d0e42e ("i2c: imx-lpi2c: add low power i2c bus driver") +Signed-off-by: Alexander Stein +Tested-by: Emanuele Ghidoli +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-imx-lpi2c.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-imx-lpi2c.c b/drivers/i2c/busses/i2c-imx-lpi2c.c +index 188f2a36d2fd6..9b2f9544c5681 100644 +--- a/drivers/i2c/busses/i2c-imx-lpi2c.c ++++ b/drivers/i2c/busses/i2c-imx-lpi2c.c +@@ -503,10 +503,14 @@ static int lpi2c_imx_xfer(struct i2c_adapter *adapter, + static irqreturn_t lpi2c_imx_isr(int irq, void *dev_id) + { + struct lpi2c_imx_struct *lpi2c_imx = dev_id; ++ unsigned int enabled; + unsigned int temp; + ++ enabled = readl(lpi2c_imx->base + LPI2C_MIER); ++ + lpi2c_imx_intctrl(lpi2c_imx, 0); + temp = readl(lpi2c_imx->base + LPI2C_MSR); ++ temp &= enabled; + + if (temp & MSR_RDF) + lpi2c_imx_read_rxfifo(lpi2c_imx); +-- +2.39.2 + diff --git a/queue-6.1/i2c-mxs-ensure-that-dma-buffers-are-safe-for-dma.patch b/queue-6.1/i2c-mxs-ensure-that-dma-buffers-are-safe-for-dma.patch new file mode 100644 index 00000000000..5835259cc32 --- /dev/null +++ b/queue-6.1/i2c-mxs-ensure-that-dma-buffers-are-safe-for-dma.patch @@ -0,0 +1,93 @@ +From 63ed9d2e6c9ef984cc3810531ea3407d60c7f03c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Feb 2023 16:25:50 +0100 +Subject: i2c: mxs: ensure that DMA buffers are safe for DMA + +From: Matthias Schiffer + +[ Upstream commit 5190417bdf72c71b65bd9892103c6186816a6e8b ] + +We found that after commit 9c46929e7989 +("ARM: implement THREAD_INFO_IN_TASK for uniprocessor systems"), the +PCF85063 RTC driver stopped working on i.MX28 due to regmap_bulk_read() +reading bogus data into a stack buffer. This is caused by the i2c-mxs +driver using DMA transfers even for messages without the I2C_M_DMA_SAFE +flag, and the aforementioned commit enabling vmapped stacks. + +As the MXS I2C controller requires DMA for reads of >4 bytes, DMA can't be +disabled, so the issue is fixed by using i2c_get_dma_safe_msg_buf() to +create a bounce buffer when needed. + +Fixes: 9c46929e7989 ("ARM: implement THREAD_INFO_IN_TASK for uniprocessor systems") +Signed-off-by: Matthias Schiffer +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mxs.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c +index d113bed795452..e0f3b3545cfe4 100644 +--- a/drivers/i2c/busses/i2c-mxs.c ++++ b/drivers/i2c/busses/i2c-mxs.c +@@ -171,7 +171,7 @@ static void mxs_i2c_dma_irq_callback(void *param) + } + + static int mxs_i2c_dma_setup_xfer(struct i2c_adapter *adap, +- struct i2c_msg *msg, uint32_t flags) ++ struct i2c_msg *msg, u8 *buf, uint32_t flags) + { + struct dma_async_tx_descriptor *desc; + struct mxs_i2c_dev *i2c = i2c_get_adapdata(adap); +@@ -226,7 +226,7 @@ static int mxs_i2c_dma_setup_xfer(struct i2c_adapter *adap, + } + + /* Queue the DMA data transfer. */ +- sg_init_one(&i2c->sg_io[1], msg->buf, msg->len); ++ sg_init_one(&i2c->sg_io[1], buf, msg->len); + dma_map_sg(i2c->dev, &i2c->sg_io[1], 1, DMA_FROM_DEVICE); + desc = dmaengine_prep_slave_sg(i2c->dmach, &i2c->sg_io[1], 1, + DMA_DEV_TO_MEM, +@@ -259,7 +259,7 @@ static int mxs_i2c_dma_setup_xfer(struct i2c_adapter *adap, + /* Queue the DMA data transfer. */ + sg_init_table(i2c->sg_io, 2); + sg_set_buf(&i2c->sg_io[0], &i2c->addr_data, 1); +- sg_set_buf(&i2c->sg_io[1], msg->buf, msg->len); ++ sg_set_buf(&i2c->sg_io[1], buf, msg->len); + dma_map_sg(i2c->dev, i2c->sg_io, 2, DMA_TO_DEVICE); + desc = dmaengine_prep_slave_sg(i2c->dmach, i2c->sg_io, 2, + DMA_MEM_TO_DEV, +@@ -563,6 +563,7 @@ static int mxs_i2c_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, + struct mxs_i2c_dev *i2c = i2c_get_adapdata(adap); + int ret; + int flags; ++ u8 *dma_buf; + int use_pio = 0; + unsigned long time_left; + +@@ -588,13 +589,20 @@ static int mxs_i2c_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, + if (ret && (ret != -ENXIO)) + mxs_i2c_reset(i2c); + } else { ++ dma_buf = i2c_get_dma_safe_msg_buf(msg, 1); ++ if (!dma_buf) ++ return -ENOMEM; ++ + reinit_completion(&i2c->cmd_complete); +- ret = mxs_i2c_dma_setup_xfer(adap, msg, flags); +- if (ret) ++ ret = mxs_i2c_dma_setup_xfer(adap, msg, dma_buf, flags); ++ if (ret) { ++ i2c_put_dma_safe_msg_buf(dma_buf, msg, false); + return ret; ++ } + + time_left = wait_for_completion_timeout(&i2c->cmd_complete, + msecs_to_jiffies(1000)); ++ i2c_put_dma_safe_msg_buf(dma_buf, msg, true); + if (!time_left) + goto timeout; + +-- +2.39.2 + diff --git a/queue-6.1/i40e-fix-flow-director-packet-filter-programming.patch b/queue-6.1/i40e-fix-flow-director-packet-filter-programming.patch new file mode 100644 index 00000000000..0abc44b612e --- /dev/null +++ b/queue-6.1/i40e-fix-flow-director-packet-filter-programming.patch @@ -0,0 +1,44 @@ +From a1e5d80c92f48e59d0867aa507ecc15d144b9072 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 15:07:33 +0100 +Subject: i40e: fix flow director packet filter programming + +From: Radoslaw Tyl + +[ Upstream commit c672297bbc0e86dbf88396b8053e2fbb173f16ff ] + +Initialize to zero structures to build a valid +Tx Packet used for the filter programming. + +Fixes: a9219b332f52 ("i40e: VLAN field for flow director") +Signed-off-by: Radoslaw Tyl +Reviewed-by: Michal Swiatkowski +Tested-by: Arpana Arland (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +index b97c95f89fa02..494775d65bf28 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -171,10 +171,10 @@ static char *i40e_create_dummy_packet(u8 *dummy_packet, bool ipv4, u8 l4proto, + struct i40e_fdir_filter *data) + { + bool is_vlan = !!data->vlan_tag; +- struct vlan_hdr vlan; +- struct ipv6hdr ipv6; +- struct ethhdr eth; +- struct iphdr ip; ++ struct vlan_hdr vlan = {}; ++ struct ipv6hdr ipv6 = {}; ++ struct ethhdr eth = {}; ++ struct iphdr ip = {}; + u8 *tmp; + + if (ipv4) { +-- +2.39.2 + diff --git a/queue-6.1/iavf-do-not-track-vlan-0-filters.patch b/queue-6.1/iavf-do-not-track-vlan-0-filters.patch new file mode 100644 index 00000000000..5e454ac28bb --- /dev/null +++ b/queue-6.1/iavf-do-not-track-vlan-0-filters.patch @@ -0,0 +1,78 @@ +From eb024c74e1a54a830e40fff565cb3713c53be6ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 13:59:25 -0600 +Subject: iavf: do not track VLAN 0 filters + +From: Ahmed Zaki + +[ Upstream commit 964290ff32d132bf971d45b29f7de39756dab7c8 ] + +When an interface with the maximum number of VLAN filters is brought up, +a spurious error is logged: + + [257.483082] 8021q: adding VLAN 0 to HW filter on device enp0s3 + [257.483094] iavf 0000:00:03.0 enp0s3: Max allowed VLAN filters 8. Remove existing VLANs or disable filtering via Ethtool if supported. + +The VF driver complains that it cannot add the VLAN 0 filter. + +On the other hand, the PF driver always adds VLAN 0 filter on VF +initialization. The VF does not need to ask the PF for that filter at +all. + +Fix the error by not tracking VLAN 0 filters altogether. With that, the +check added by commit 0e710a3ffd0c ("iavf: Fix VF driver counting VLAN 0 +filters") in iavf_virtchnl.c is useless and might be confusing if left as +it suggests that we track VLAN 0. + +Fixes: 0e710a3ffd0c ("iavf: Fix VF driver counting VLAN 0 filters") +Signed-off-by: Ahmed Zaki +Reviewed-by: Michal Kubiak +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 8 ++++++++ + drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 2 -- + 2 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 3dad834b9b8e5..41edcf9e154a3 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -893,6 +893,10 @@ static int iavf_vlan_rx_add_vid(struct net_device *netdev, + { + struct iavf_adapter *adapter = netdev_priv(netdev); + ++ /* Do not track VLAN 0 filter, always added by the PF on VF init */ ++ if (!vid) ++ return 0; ++ + if (!VLAN_FILTERING_ALLOWED(adapter)) + return -EIO; + +@@ -919,6 +923,10 @@ static int iavf_vlan_rx_kill_vid(struct net_device *netdev, + { + struct iavf_adapter *adapter = netdev_priv(netdev); + ++ /* We do not track VLAN 0 filter */ ++ if (!vid) ++ return 0; ++ + iavf_del_vlan(adapter, IAVF_VLAN(vid, be16_to_cpu(proto))); + if (proto == cpu_to_be16(ETH_P_8021Q)) + clear_bit(vid, adapter->vsi.active_cvlans); +diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +index 0752fd67c96e5..2c03ca01fdd9c 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +@@ -2438,8 +2438,6 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, + list_for_each_entry(f, &adapter->vlan_filter_list, list) { + if (f->is_new_vlan) { + f->is_new_vlan = false; +- if (!f->vlan.vid) +- continue; + if (f->vlan.tpid == ETH_P_8021Q) + set_bit(f->vlan.vid, + adapter->vsi.active_cvlans); +-- +2.39.2 + diff --git a/queue-6.1/iavf-fix-hang-on-reboot-with-ice.patch b/queue-6.1/iavf-fix-hang-on-reboot-with-ice.patch new file mode 100644 index 00000000000..01273a532ed --- /dev/null +++ b/queue-6.1/iavf-fix-hang-on-reboot-with-ice.patch @@ -0,0 +1,88 @@ +From 52e211e64ff84be31897cbb423c6e9b7f293b0ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 17:06:45 +0100 +Subject: iavf: fix hang on reboot with ice + +From: Stefan Assmann + +[ Upstream commit 4e264be98b88a6d6f476c11087fe865696e8bef5 ] + +When a system with E810 with existing VFs gets rebooted the following +hang may be observed. + + Pid 1 is hung in iavf_remove(), part of a network driver: + PID: 1 TASK: ffff965400e5a340 CPU: 24 COMMAND: "systemd-shutdow" + #0 [ffffaad04005fa50] __schedule at ffffffff8b3239cb + #1 [ffffaad04005fae8] schedule at ffffffff8b323e2d + #2 [ffffaad04005fb00] schedule_hrtimeout_range_clock at ffffffff8b32cebc + #3 [ffffaad04005fb80] usleep_range_state at ffffffff8b32c930 + #4 [ffffaad04005fbb0] iavf_remove at ffffffffc12b9b4c [iavf] + #5 [ffffaad04005fbf0] pci_device_remove at ffffffff8add7513 + #6 [ffffaad04005fc10] device_release_driver_internal at ffffffff8af08baa + #7 [ffffaad04005fc40] pci_stop_bus_device at ffffffff8adcc5fc + #8 [ffffaad04005fc60] pci_stop_and_remove_bus_device at ffffffff8adcc81e + #9 [ffffaad04005fc70] pci_iov_remove_virtfn at ffffffff8adf9429 + #10 [ffffaad04005fca8] sriov_disable at ffffffff8adf98e4 + #11 [ffffaad04005fcc8] ice_free_vfs at ffffffffc04bb2c8 [ice] + #12 [ffffaad04005fd10] ice_remove at ffffffffc04778fe [ice] + #13 [ffffaad04005fd38] ice_shutdown at ffffffffc0477946 [ice] + #14 [ffffaad04005fd50] pci_device_shutdown at ffffffff8add58f1 + #15 [ffffaad04005fd70] device_shutdown at ffffffff8af05386 + #16 [ffffaad04005fd98] kernel_restart at ffffffff8a92a870 + #17 [ffffaad04005fda8] __do_sys_reboot at ffffffff8a92abd6 + #18 [ffffaad04005fee0] do_syscall_64 at ffffffff8b317159 + #19 [ffffaad04005ff08] __context_tracking_enter at ffffffff8b31b6fc + #20 [ffffaad04005ff18] syscall_exit_to_user_mode at ffffffff8b31b50d + #21 [ffffaad04005ff28] do_syscall_64 at ffffffff8b317169 + #22 [ffffaad04005ff50] entry_SYSCALL_64_after_hwframe at ffffffff8b40009b + RIP: 00007f1baa5c13d7 RSP: 00007fffbcc55a98 RFLAGS: 00000202 + RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1baa5c13d7 + RDX: 0000000001234567 RSI: 0000000028121969 RDI: 00000000fee1dead + RBP: 00007fffbcc55ca0 R8: 0000000000000000 R9: 00007fffbcc54e90 + R10: 00007fffbcc55050 R11: 0000000000000202 R12: 0000000000000005 + R13: 0000000000000000 R14: 00007fffbcc55af0 R15: 0000000000000000 + ORIG_RAX: 00000000000000a9 CS: 0033 SS: 002b + +During reboot all drivers PM shutdown callbacks are invoked. +In iavf_shutdown() the adapter state is changed to __IAVF_REMOVE. +In ice_shutdown() the call chain above is executed, which at some point +calls iavf_remove(). However iavf_remove() expects the VF to be in one +of the states __IAVF_RUNNING, __IAVF_DOWN or __IAVF_INIT_FAILED. If +that's not the case it sleeps forever. +So if iavf_shutdown() gets invoked before iavf_remove() the system will +hang indefinitely because the adapter is already in state __IAVF_REMOVE. + +Fix this by returning from iavf_remove() if the state is __IAVF_REMOVE, +as we already went through iavf_shutdown(). + +Fixes: 974578017fc1 ("iavf: Add waiting so the port is initialized in remove") +Fixes: a8417330f8a5 ("iavf: Fix race condition between iavf_shutdown and iavf_remove") +Reported-by: Marius Cornea +Signed-off-by: Stefan Assmann +Reviewed-by: Michal Kubiak +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 41edcf9e154a3..5f8fff6c701fc 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -5086,6 +5086,11 @@ static void iavf_remove(struct pci_dev *pdev) + mutex_unlock(&adapter->crit_lock); + break; + } ++ /* Simply return if we already went through iavf_shutdown */ ++ if (adapter->state == __IAVF_REMOVE) { ++ mutex_unlock(&adapter->crit_lock); ++ return; ++ } + + mutex_unlock(&adapter->crit_lock); + usleep_range(500, 1000); +-- +2.39.2 + diff --git a/queue-6.1/iavf-fix-inverted-rx-hash-condition-leading-to-disab.patch b/queue-6.1/iavf-fix-inverted-rx-hash-condition-leading-to-disab.patch new file mode 100644 index 00000000000..41428e35fb9 --- /dev/null +++ b/queue-6.1/iavf-fix-inverted-rx-hash-condition-leading-to-disab.patch @@ -0,0 +1,44 @@ +From 0017dc0972c318504aaff8aed47eb2e0a8f4f7ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 12:59:07 +0100 +Subject: iavf: fix inverted Rx hash condition leading to disabled hash + +From: Alexander Lobakin + +[ Upstream commit 32d57f667f871bc5a8babbe27ea4c5e668ee0ea8 ] + +Condition, which checks whether the netdev has hashing enabled is +inverted. Basically, the tagged commit effectively disabled passing flow +hash from descriptor to skb, unless user *disables* it via Ethtool. +Commit a876c3ba59a6 ("i40e/i40evf: properly report Rx packet hash") +fixed this problem, but only for i40e. +Invert the condition now in iavf and unblock passing hash to skbs again. + +Fixes: 857942fd1aa1 ("i40e: Fix Rx hash reported to the stack by our driver") +Reviewed-by: Larysa Zaremba +Reviewed-by: Michal Kubiak +Signed-off-by: Alexander Lobakin +Tested-by: Rafal Romanowski +Reviewed-by: Leon Romanovsky +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_txrx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_txrx.c b/drivers/net/ethernet/intel/iavf/iavf_txrx.c +index 18b6a702a1d6d..e989feda133c1 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_txrx.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_txrx.c +@@ -1096,7 +1096,7 @@ static inline void iavf_rx_hash(struct iavf_ring *ring, + cpu_to_le64((u64)IAVF_RX_DESC_FLTSTAT_RSS_HASH << + IAVF_RX_DESC_STATUS_FLTSTAT_SHIFT); + +- if (ring->netdev->features & NETIF_F_RXHASH) ++ if (!(ring->netdev->features & NETIF_F_RXHASH)) + return; + + if ((rx_desc->wb.qword1.status_error_len & rss_mask) == rss_mask) { +-- +2.39.2 + diff --git a/queue-6.1/iavf-fix-non-tunneled-ipv6-udp-packet-type-and-hashi.patch b/queue-6.1/iavf-fix-non-tunneled-ipv6-udp-packet-type-and-hashi.patch new file mode 100644 index 00000000000..3574fe73d66 --- /dev/null +++ b/queue-6.1/iavf-fix-non-tunneled-ipv6-udp-packet-type-and-hashi.patch @@ -0,0 +1,48 @@ +From dc6dd08623bc8723e52c2ea83b5414bf3db0e208 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 12:59:08 +0100 +Subject: iavf: fix non-tunneled IPv6 UDP packet type and hashing + +From: Alexander Lobakin + +[ Upstream commit de58647b4301fe181f9c38e8b46f7021584ae427 ] + +Currently, IAVF's decode_rx_desc_ptype() correctly reports payload type +of L4 for IPv4 UDP packets and IPv{4,6} TCP, but only L3 for IPv6 UDP. +Originally, i40e, ice and iavf were affected. +Commit 73df8c9e3e3d ("i40e: Correct UDP packet header for non_tunnel-ipv6") +fixed that in i40e, then +commit 638a0c8c8861 ("ice: fix incorrect payload indicator on PTYPE") +fixed that for ice. +IPv6 UDP is L4 obviously. Fix it and make iavf report correct L4 hash +type for such packets, so that the stack won't calculate it on CPU when +needs it. + +Fixes: 206812b5fccb ("i40e/i40evf: i40e implementation for skb_set_hash") +Reviewed-by: Larysa Zaremba +Reviewed-by: Michal Kubiak +Signed-off-by: Alexander Lobakin +Tested-by: Rafal Romanowski +Reviewed-by: Leon Romanovsky +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_common.c b/drivers/net/ethernet/intel/iavf/iavf_common.c +index 34e46a23894f4..43148c07459f8 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_common.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_common.c +@@ -661,7 +661,7 @@ struct iavf_rx_ptype_decoded iavf_ptype_lookup[BIT(8)] = { + /* Non Tunneled IPv6 */ + IAVF_PTT(88, IP, IPV6, FRG, NONE, NONE, NOF, NONE, PAY3), + IAVF_PTT(89, IP, IPV6, NOF, NONE, NONE, NOF, NONE, PAY3), +- IAVF_PTT(90, IP, IPV6, NOF, NONE, NONE, NOF, UDP, PAY3), ++ IAVF_PTT(90, IP, IPV6, NOF, NONE, NONE, NOF, UDP, PAY4), + IAVF_PTT_UNUSED_ENTRY(91), + IAVF_PTT(92, IP, IPV6, NOF, NONE, NONE, NOF, TCP, PAY4), + IAVF_PTT(93, IP, IPV6, NOF, NONE, NONE, NOF, SCTP, PAY4), +-- +2.39.2 + diff --git a/queue-6.1/ice-check-if-vf-exists-before-mode-check.patch b/queue-6.1/ice-check-if-vf-exists-before-mode-check.patch new file mode 100644 index 00000000000..b5cbe7b9fb9 --- /dev/null +++ b/queue-6.1/ice-check-if-vf-exists-before-mode-check.patch @@ -0,0 +1,49 @@ +From d74e2e7cf60321d1f1dc4927ce49b40b7ad93b80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 12:33:44 +0100 +Subject: ice: check if VF exists before mode check + +From: Michal Swiatkowski + +[ Upstream commit 83b49e7f63da88a1544cba2b2e40bfabb24bd203 ] + +Setting trust on VF should return EINVAL when there is no VF. Move +checking for switchdev mode after checking if VF exists. + +Fixes: c54d209c78b8 ("ice: Wait for VF to be reset/ready before configuration") +Signed-off-by: Michal Swiatkowski +Signed-off-by: Kalyan Kodamagula +Tested-by: Sujai Buvaneswaran +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_sriov.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_sriov.c b/drivers/net/ethernet/intel/ice/ice_sriov.c +index 3ba1408c56a9a..b3849bc3d4fc6 100644 +--- a/drivers/net/ethernet/intel/ice/ice_sriov.c ++++ b/drivers/net/ethernet/intel/ice/ice_sriov.c +@@ -1384,15 +1384,15 @@ int ice_set_vf_trust(struct net_device *netdev, int vf_id, bool trusted) + struct ice_vf *vf; + int ret; + ++ vf = ice_get_vf_by_id(pf, vf_id); ++ if (!vf) ++ return -EINVAL; ++ + if (ice_is_eswitch_mode_switchdev(pf)) { + dev_info(ice_pf_to_dev(pf), "Trusted VF is forbidden in switchdev mode\n"); + return -EOPNOTSUPP; + } + +- vf = ice_get_vf_by_id(pf, vf_id); +- if (!vf) +- return -EINVAL; +- + ret = ice_check_vf_ready_for_cfg(vf); + if (ret) + goto out_put_vf; +-- +2.39.2 + diff --git a/queue-6.1/igbvf-regard-vf-reset-nack-as-success.patch b/queue-6.1/igbvf-regard-vf-reset-nack-as-success.patch new file mode 100644 index 00000000000..3db4b2bac9f --- /dev/null +++ b/queue-6.1/igbvf-regard-vf-reset-nack-as-success.patch @@ -0,0 +1,62 @@ +From 5ba0bac0bb9dde44b75e8a592009cf4f8414079d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Dec 2022 19:20:03 +0900 +Subject: igbvf: Regard vf reset nack as success + +From: Akihiko Odaki + +[ Upstream commit 02c83791ef969c6a8a150b4927193d0d0e50fb23 ] + +vf reset nack actually represents the reset operation itself is +performed but no address is assigned. Therefore, e1000_reset_hw_vf +should fill the "perm_addr" with the zero address and return success on +such an occasion. This prevents its callers in netdev.c from saying PF +still resetting, and instead allows them to correctly report that no +address is assigned. + +Fixes: 6ddbc4cf1f4d ("igb: Indicate failure on vf reset for empty mac address") +Signed-off-by: Akihiko Odaki +Reviewed-by: Leon Romanovsky +Tested-by: Marek Szlosek +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igbvf/vf.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igbvf/vf.c b/drivers/net/ethernet/intel/igbvf/vf.c +index b8ba3f94c3632..a47a2e3e548cf 100644 +--- a/drivers/net/ethernet/intel/igbvf/vf.c ++++ b/drivers/net/ethernet/intel/igbvf/vf.c +@@ -1,6 +1,8 @@ + // SPDX-License-Identifier: GPL-2.0 + /* Copyright(c) 2009 - 2018 Intel Corporation. */ + ++#include ++ + #include "vf.h" + + static s32 e1000_check_for_link_vf(struct e1000_hw *hw); +@@ -131,11 +133,16 @@ static s32 e1000_reset_hw_vf(struct e1000_hw *hw) + /* set our "perm_addr" based on info provided by PF */ + ret_val = mbx->ops.read_posted(hw, msgbuf, 3); + if (!ret_val) { +- if (msgbuf[0] == (E1000_VF_RESET | +- E1000_VT_MSGTYPE_ACK)) ++ switch (msgbuf[0]) { ++ case E1000_VF_RESET | E1000_VT_MSGTYPE_ACK: + memcpy(hw->mac.perm_addr, addr, ETH_ALEN); +- else ++ break; ++ case E1000_VF_RESET | E1000_VT_MSGTYPE_NACK: ++ eth_zero_addr(hw->mac.perm_addr); ++ break; ++ default: + ret_val = -E1000_ERR_MAC_INIT; ++ } + } + } + +-- +2.39.2 + diff --git a/queue-6.1/igc-fix-the-validation-logic-for-taprio-s-gate-list.patch b/queue-6.1/igc-fix-the-validation-logic-for-taprio-s-gate-list.patch new file mode 100644 index 00000000000..1c015995c78 --- /dev/null +++ b/queue-6.1/igc-fix-the-validation-logic-for-taprio-s-gate-list.patch @@ -0,0 +1,76 @@ +From 29f70d6384d38f5b90a7c4fa4d134ed4d97fed78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 15:45:31 +0900 +Subject: igc: fix the validation logic for taprio's gate list + +From: AKASHI Takahiro + +[ Upstream commit 2b4cc3d3f4d8ec42961e98568a0afeee96a943ab ] + +The check introduced in the commit a5fd39464a40 ("igc: Lift TAPRIO schedule +restriction") can detect a false positive error in some corner case. +For instance, + tc qdisc replace ... taprio num_tc 4 + ... + sched-entry S 0x01 100000 # slot#1 + sched-entry S 0x03 100000 # slot#2 + sched-entry S 0x04 100000 # slot#3 + sched-entry S 0x08 200000 # slot#4 + flags 0x02 # hardware offload + +Here the queue#0 (the first queue) is on at the slot#1 and #2, +and off at the slot#3 and #4. Under the current logic, when the slot#4 +is examined, validate_schedule() returns *false* since the enablement +count for the queue#0 is two and it is already off at the previous slot +(i.e. #3). But this definition is truely correct. + +Let's fix the logic to enforce a strict validation for consecutively-opened +slots. + +Fixes: a5fd39464a40 ("igc: Lift TAPRIO schedule restriction") +Signed-off-by: AKASHI Takahiro +Reviewed-by: Kurt Kanzenbach +Acked-by: Vinicius Costa Gomes +Tested-by: Naama Meir +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_main.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c +index 3b5b36206c44b..1d9b70e0ff67f 100644 +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -6000,18 +6000,18 @@ static bool validate_schedule(struct igc_adapter *adapter, + if (e->command != TC_TAPRIO_CMD_SET_GATES) + return false; + +- for (i = 0; i < adapter->num_tx_queues; i++) { +- if (e->gate_mask & BIT(i)) ++ for (i = 0; i < adapter->num_tx_queues; i++) ++ if (e->gate_mask & BIT(i)) { + queue_uses[i]++; + +- /* There are limitations: A single queue cannot be +- * opened and closed multiple times per cycle unless the +- * gate stays open. Check for it. +- */ +- if (queue_uses[i] > 1 && +- !(prev->gate_mask & BIT(i))) +- return false; +- } ++ /* There are limitations: A single queue cannot ++ * be opened and closed multiple times per cycle ++ * unless the gate stays open. Check for it. ++ */ ++ if (queue_uses[i] > 1 && ++ !(prev->gate_mask & BIT(i))) ++ return false; ++ } + } + + return true; +-- +2.39.2 + diff --git a/queue-6.1/intel-igbvf-free-irq-on-the-error-path-in-igbvf_requ.patch b/queue-6.1/intel-igbvf-free-irq-on-the-error-path-in-igbvf_requ.patch new file mode 100644 index 00000000000..d30a562bb21 --- /dev/null +++ b/queue-6.1/intel-igbvf-free-irq-on-the-error-path-in-igbvf_requ.patch @@ -0,0 +1,54 @@ +From 283cf427ad1721b573bfaa9e9b09fc80525e00ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 10:28:52 +0800 +Subject: intel/igbvf: free irq on the error path in igbvf_request_msix() + +From: Gaosheng Cui + +[ Upstream commit 85eb39bb39cbb5c086df1e19ba67cc1366693a77 ] + +In igbvf_request_msix(), irqs have not been freed on the err path, +we need to free it. Fix it. + +Fixes: d4e0fe01a38a ("igbvf: add new driver to support 82576 virtual functions") +Signed-off-by: Gaosheng Cui +Reviewed-by: Maciej Fijalkowski +Tested-by: Marek Szlosek +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igbvf/netdev.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c +index 3a32809510fc6..72cb1b56e9f24 100644 +--- a/drivers/net/ethernet/intel/igbvf/netdev.c ++++ b/drivers/net/ethernet/intel/igbvf/netdev.c +@@ -1074,7 +1074,7 @@ static int igbvf_request_msix(struct igbvf_adapter *adapter) + igbvf_intr_msix_rx, 0, adapter->rx_ring->name, + netdev); + if (err) +- goto out; ++ goto free_irq_tx; + + adapter->rx_ring->itr_register = E1000_EITR(vector); + adapter->rx_ring->itr_val = adapter->current_itr; +@@ -1083,10 +1083,14 @@ static int igbvf_request_msix(struct igbvf_adapter *adapter) + err = request_irq(adapter->msix_entries[vector].vector, + igbvf_msix_other, 0, netdev->name, netdev); + if (err) +- goto out; ++ goto free_irq_rx; + + igbvf_configure_msix(adapter); + return 0; ++free_irq_rx: ++ free_irq(adapter->msix_entries[--vector].vector, netdev); ++free_irq_tx: ++ free_irq(adapter->msix_entries[--vector].vector, netdev); + out: + return err; + } +-- +2.39.2 + diff --git a/queue-6.1/keys-do-not-cache-key-in-task-struct-if-key-is-reque.patch b/queue-6.1/keys-do-not-cache-key-in-task-struct-if-key-is-reque.patch new file mode 100644 index 00000000000..3f391f058bf --- /dev/null +++ b/queue-6.1/keys-do-not-cache-key-in-task-struct-if-key-is-reque.patch @@ -0,0 +1,64 @@ +From d6f4d6089a33acaee4f2cd0c1b98e34c5bef69bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 15:15:18 +0000 +Subject: keys: Do not cache key in task struct if key is requested from kernel + thread + +From: David Howells + +[ Upstream commit 47f9e4c924025c5be87959d3335e66fcbb7f6b5c ] + +The key which gets cached in task structure from a kernel thread does not +get invalidated even after expiry. Due to which, a new key request from +kernel thread will be served with the cached key if it's present in task +struct irrespective of the key validity. The change is to not cache key in +task_struct when key requested from kernel thread so that kernel thread +gets a valid key on every key request. + +The problem has been seen with the cifs module doing DNS lookups from a +kernel thread and the results getting pinned by being attached to that +kernel thread's cache - and thus not something that can be easily got rid +of. The cache would ordinarily be cleared by notify-resume, but kernel +threads don't do that. + +This isn't seen with AFS because AFS is doing request_key() within the +kernel half of a user thread - which will do notify-resume. + +Fixes: 7743c48e54ee ("keys: Cache result of request_key*() temporarily in task_struct") +Signed-off-by: Bharath SM +Signed-off-by: David Howells +Reviewed-by: Jarkko Sakkinen +cc: Shyam Prasad N +cc: Steve French +cc: keyrings@vger.kernel.org +cc: linux-cifs@vger.kernel.org +cc: linux-fsdevel@vger.kernel.org +Link: https://lore.kernel.org/r/CAGypqWw951d=zYRbdgNR4snUDvJhWL=q3=WOyh7HhSJupjz2vA@mail.gmail.com/ +Signed-off-by: Sasha Levin +--- + security/keys/request_key.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/security/keys/request_key.c b/security/keys/request_key.c +index 2da4404276f0f..07a0ef2baacd8 100644 +--- a/security/keys/request_key.c ++++ b/security/keys/request_key.c +@@ -38,9 +38,12 @@ static void cache_requested_key(struct key *key) + #ifdef CONFIG_KEYS_REQUEST_CACHE + struct task_struct *t = current; + +- key_put(t->cached_requested_key); +- t->cached_requested_key = key_get(key); +- set_tsk_thread_flag(t, TIF_NOTIFY_RESUME); ++ /* Do not cache key if it is a kernel thread */ ++ if (!(t->flags & PF_KTHREAD)) { ++ key_put(t->cached_requested_key); ++ t->cached_requested_key = key_get(key); ++ set_tsk_thread_flag(t, TIF_NOTIFY_RESUME); ++ } + #endif + } + +-- +2.39.2 + diff --git a/queue-6.1/ksmbd-add-low-bound-validation-to-fsctl_query_alloca.patch b/queue-6.1/ksmbd-add-low-bound-validation-to-fsctl_query_alloca.patch new file mode 100644 index 00000000000..10f37a04cf0 --- /dev/null +++ b/queue-6.1/ksmbd-add-low-bound-validation-to-fsctl_query_alloca.patch @@ -0,0 +1,52 @@ +From 767ad8333156092719ab2af1d1e15335fb7373d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 21:56:07 +0900 +Subject: ksmbd: add low bound validation to FSCTL_QUERY_ALLOCATED_RANGES + +From: Namjae Jeon + +[ Upstream commit 342edb60dcda7a409430359b0cac2864bb9dfe44 ] + +Smatch static checker warning: + fs/ksmbd/vfs.c:1040 ksmbd_vfs_fqar_lseek() warn: no lower bound on 'length' + fs/ksmbd/vfs.c:1041 ksmbd_vfs_fqar_lseek() warn: no lower bound on 'start' + +Fix unexpected result that could caused from negative start and length. + +Fixes: f44158485826 ("cifsd: add file operations") +Reported-by: Dan Carpenter +Signed-off-by: Namjae Jeon +Reviewed-by: Sergey Senozhatsky +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/ksmbd/smb2pdu.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c +index 3bb971831e7ce..61d12eab0be15 100644 +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -7457,13 +7457,16 @@ static int fsctl_query_allocated_ranges(struct ksmbd_work *work, u64 id, + if (in_count == 0) + return -EINVAL; + ++ start = le64_to_cpu(qar_req->file_offset); ++ length = le64_to_cpu(qar_req->length); ++ ++ if (start < 0 || length < 0) ++ return -EINVAL; ++ + fp = ksmbd_lookup_fd_fast(work, id); + if (!fp) + return -ENOENT; + +- start = le64_to_cpu(qar_req->file_offset); +- length = le64_to_cpu(qar_req->length); +- + ret = ksmbd_vfs_fqar_lseek(fp, start, length, + qar_rsp, in_count, out_count); + if (ret && ret != -E2BIG) +-- +2.39.2 + diff --git a/queue-6.1/ksmbd-add-low-bound-validation-to-fsctl_set_zero_dat.patch b/queue-6.1/ksmbd-add-low-bound-validation-to-fsctl_set_zero_dat.patch new file mode 100644 index 00000000000..0c8d55400a3 --- /dev/null +++ b/queue-6.1/ksmbd-add-low-bound-validation-to-fsctl_set_zero_dat.patch @@ -0,0 +1,41 @@ +From 3b98c592cbaffa89771488856b1a91e6545244f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Mar 2023 21:04:00 +0900 +Subject: ksmbd: add low bound validation to FSCTL_SET_ZERO_DATA + +From: Namjae Jeon + +[ Upstream commit 2d74ec97131b1179a373b6d521f195c84e894eb6 ] + +Smatch static checker warning: + fs/ksmbd/smb2pdu.c:7759 smb2_ioctl() + warn: no lower bound on 'off' + +Fix unexpected result that could caused from negative off and bfz. + +Fixes: b5e5f9dfc915 ("ksmbd: check invalid FileOffset and BeyondFinalZero in FSCTL_ZERO_DATA") +Reported-by: Dan Carpenter +Signed-off-by: Namjae Jeon +Reviewed-by: Sergey Senozhatsky +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/ksmbd/smb2pdu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c +index 0f0f1243a9cbf..3bb971831e7ce 100644 +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -7764,7 +7764,7 @@ int smb2_ioctl(struct ksmbd_work *work) + + off = le64_to_cpu(zero_data->FileOffset); + bfz = le64_to_cpu(zero_data->BeyondFinalZero); +- if (off > bfz) { ++ if (off < 0 || bfz < 0 || off > bfz) { + ret = -EINVAL; + goto out; + } +-- +2.39.2 + diff --git a/queue-6.1/ksmbd-fix-possible-refcount-leak-in-smb2_open.patch b/queue-6.1/ksmbd-fix-possible-refcount-leak-in-smb2_open.patch new file mode 100644 index 00000000000..a6e1acc3f49 --- /dev/null +++ b/queue-6.1/ksmbd-fix-possible-refcount-leak-in-smb2_open.patch @@ -0,0 +1,41 @@ +From 84d1504e963aa8d45b08291ecb8fa96c8902c77f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Mar 2023 21:58:04 +0800 +Subject: ksmbd: fix possible refcount leak in smb2_open() + +From: ChenXiaoSong + +[ Upstream commit 2624b445544ffc1472ccabfb6ec867c199d4c95c ] + +Reference count of acls will leak when memory allocation fails. Fix this +by adding the missing posix_acl_release(). + +Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") +Signed-off-by: ChenXiaoSong +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/ksmbd/smb2pdu.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c +index 61d12eab0be15..e8c051a3329ec 100644 +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -2994,8 +2994,11 @@ int smb2_open(struct ksmbd_work *work) + sizeof(struct smb_acl) + + sizeof(struct smb_ace) * ace_num * 2, + GFP_KERNEL); +- if (!pntsd) ++ if (!pntsd) { ++ posix_acl_release(fattr.cf_acls); ++ posix_acl_release(fattr.cf_dacls); + goto err_out; ++ } + + rc = build_sec_desc(user_ns, + pntsd, NULL, 0, +-- +2.39.2 + diff --git a/queue-6.1/mlxsw-core_thermal-fix-fan-speed-in-maximum-cooling-.patch b/queue-6.1/mlxsw-core_thermal-fix-fan-speed-in-maximum-cooling-.patch new file mode 100644 index 00000000000..2cb7fef2fa1 --- /dev/null +++ b/queue-6.1/mlxsw-core_thermal-fix-fan-speed-in-maximum-cooling-.patch @@ -0,0 +1,95 @@ +From b59d9fc7db5535dfcc05edc64fe75d00aeb13684 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 16:32:59 +0100 +Subject: mlxsw: core_thermal: Fix fan speed in maximum cooling state + +From: Ido Schimmel + +[ Upstream commit 6d206b1ea9f48433a96edec7028586db1d947911 ] + +The cooling levels array is supposed to prevent the system fans from +being configured below a 20% duty cycle as otherwise some of them get +stuck at 0 RPM. + +Due to an off-by-one error, the last element in the array was not +initialized, causing it to be set to zero, which in turn lead to fans +being configured with a 0% duty cycle in maximum cooling state. + +Since commit 332fdf951df8 ("mlxsw: thermal: Fix out-of-bounds memory +accesses") the contents of the array are static. Therefore, instead of +fixing the initialization of the array, simply remove it and adjust +thermal_cooling_device_ops::set_cur_state() so that the configured duty +cycle is never set below 20%. + +Before: + + # cat /sys/class/thermal/thermal_zone0/cdev0/type + mlxsw_fan + # echo 10 > /sys/class/thermal/thermal_zone0/cdev0/cur_state + # cat /sys/class/hwmon/hwmon0/name + mlxsw + # cat /sys/class/hwmon/hwmon0/pwm1 + 0 + +After: + + # cat /sys/class/thermal/thermal_zone0/cdev0/type + mlxsw_fan + # echo 10 > /sys/class/thermal/thermal_zone0/cdev0/cur_state + # cat /sys/class/hwmon/hwmon0/name + mlxsw + # cat /sys/class/hwmon/hwmon0/pwm1 + 255 + +This bug was uncovered when the thermal subsystem repeatedly tried to +configure the cooling devices to their maximum state due to another +issue [1]. This resulted in the fans being stuck at 0 RPM, which +eventually lead to the system undergoing thermal shutdown. + +[1] https://lore.kernel.org/netdev/ZA3CFNhU4AbtsP4G@shredder/ + +Fixes: a421ce088ac8 ("mlxsw: core: Extend cooling device with cooling levels") +Signed-off-by: Ido Schimmel +Reviewed-by: Vadim Pasternak +Signed-off-by: Petr Machata +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/core_thermal.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c b/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c +index c5240d38c9dbd..09ed6e5fa6c34 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c +@@ -105,7 +105,6 @@ struct mlxsw_thermal { + struct thermal_zone_device *tzdev; + int polling_delay; + struct thermal_cooling_device *cdevs[MLXSW_MFCR_PWMS_MAX]; +- u8 cooling_levels[MLXSW_THERMAL_MAX_STATE + 1]; + struct thermal_trip trips[MLXSW_THERMAL_NUM_TRIPS]; + struct mlxsw_cooling_states cooling_states[MLXSW_THERMAL_NUM_TRIPS]; + struct mlxsw_thermal_area line_cards[]; +@@ -468,7 +467,7 @@ static int mlxsw_thermal_set_cur_state(struct thermal_cooling_device *cdev, + return idx; + + /* Normalize the state to the valid speed range. */ +- state = thermal->cooling_levels[state]; ++ state = max_t(unsigned long, MLXSW_THERMAL_MIN_STATE, state); + mlxsw_reg_mfsc_pack(mfsc_pl, idx, mlxsw_state_to_duty(state)); + err = mlxsw_reg_write(thermal->core, MLXSW_REG(mfsc), mfsc_pl); + if (err) { +@@ -859,10 +858,6 @@ int mlxsw_thermal_init(struct mlxsw_core *core, + } + } + +- /* Initialize cooling levels per PWM state. */ +- for (i = 0; i < MLXSW_THERMAL_MAX_STATE; i++) +- thermal->cooling_levels[i] = max(MLXSW_THERMAL_MIN_STATE, i); +- + thermal->polling_delay = bus_info->low_frequency ? + MLXSW_THERMAL_SLOW_POLL_INT : + MLXSW_THERMAL_POLL_INT; +-- +2.39.2 + diff --git a/queue-6.1/mlxsw-spectrum_fid-fix-incorrect-local-port-type.patch b/queue-6.1/mlxsw-spectrum_fid-fix-incorrect-local-port-type.patch new file mode 100644 index 00000000000..5bd723fac7c --- /dev/null +++ b/queue-6.1/mlxsw-spectrum_fid-fix-incorrect-local-port-type.patch @@ -0,0 +1,53 @@ +From a1968549798436e0e9d75fc113b39ca8011878be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 12:42:00 +0100 +Subject: mlxsw: spectrum_fid: Fix incorrect local port type + +From: Ido Schimmel + +[ Upstream commit bb765a743377d46d8da8e7f7e5128022504741b9 ] + +Local port is a 10-bit number, but it was mistakenly stored in a u8, +resulting in firmware errors when using a netdev corresponding to a +local port higher than 255. + +Fix by storing the local port in u16, as is done in the rest of the +code. + +Fixes: bf73904f5fba ("mlxsw: Add support for 802.1Q FID family") +Signed-off-by: Ido Schimmel +Reviewed-by: Danielle Ratson +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/eace1f9d96545ab8a2775db857cb7e291a9b166b.1679398549.git.petrm@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c +index 045a24cacfa51..b6ee2d658b0c4 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c +@@ -1354,7 +1354,7 @@ static int mlxsw_sp_fid_8021q_port_vid_map(struct mlxsw_sp_fid *fid, + u16 vid) + { + struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp; +- u8 local_port = mlxsw_sp_port->local_port; ++ u16 local_port = mlxsw_sp_port->local_port; + int err; + + /* In case there are no {Port, VID} => FID mappings on the port, +@@ -1391,7 +1391,7 @@ mlxsw_sp_fid_8021q_port_vid_unmap(struct mlxsw_sp_fid *fid, + struct mlxsw_sp_port *mlxsw_sp_port, u16 vid) + { + struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp; +- u8 local_port = mlxsw_sp_port->local_port; ++ u16 local_port = mlxsw_sp_port->local_port; + + mlxsw_sp_fid_port_vid_list_del(fid, mlxsw_sp_port->local_port, vid); + mlxsw_sp_fid_evid_map(fid, local_port, vid, false); +-- +2.39.2 + diff --git a/queue-6.1/net-asix-fix-modprobe-sysfs-cannot-create-duplicate-.patch b/queue-6.1/net-asix-fix-modprobe-sysfs-cannot-create-duplicate-.patch new file mode 100644 index 00000000000..b1987122c70 --- /dev/null +++ b/queue-6.1/net-asix-fix-modprobe-sysfs-cannot-create-duplicate-.patch @@ -0,0 +1,117 @@ +From 43da3a3a5137510c2d7ca00417c12b79378cbaa9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 10:05:39 -0700 +Subject: net: asix: fix modprobe "sysfs: cannot create duplicate filename" + +From: Grant Grundler + +[ Upstream commit 8eac0095de355ee31e1b014f79f83d2cd62a2d04 ] + +"modprobe asix ; rmmod asix ; modprobe asix" fails with: + sysfs: cannot create duplicate filename \ + '/devices/virtual/mdio_bus/usb-003:004' + +Issue was originally reported by Anton Lundin on 2022-06-22 (link below). + +Chrome OS team hit the same issue in Feb, 2023 when trying to find +work arounds for other issues with AX88172 devices. + +The use of devm_mdiobus_register() with usbnet devices results in the +MDIO data being associated with the USB device. When the asix driver +is unloaded, the USB device continues to exist and the corresponding +"mdiobus_unregister()" is NOT called until the USB device is unplugged +or unauthorized. So the next "modprobe asix" will fail because the MDIO +phy sysfs attributes still exist. + +The 'easy' (from a design PoV) fix is to use the non-devm variants of +mdiobus_* functions and explicitly manage this use in the asix_bind +and asix_unbind function calls. I've not explored trying to fix usbnet +initialization so devm_* stuff will work. + +Fixes: e532a096be0e5 ("net: usb: asix: ax88772: add phylib support") +Reported-by: Anton Lundin +Link: https://lore.kernel.org/netdev/20220623063649.GD23685@pengutronix.de/T/ +Tested-by: Eizan Miyamoto +Signed-off-by: Grant Grundler +Link: https://lore.kernel.org/r/20230321170539.732147-1-grundler@chromium.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/asix_devices.c | 32 +++++++++++++++++++++++++++----- + 1 file changed, 27 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c +index 11f60d32be82e..6eacbf17f1c0c 100644 +--- a/drivers/net/usb/asix_devices.c ++++ b/drivers/net/usb/asix_devices.c +@@ -666,8 +666,9 @@ static int asix_resume(struct usb_interface *intf) + static int ax88772_init_mdio(struct usbnet *dev) + { + struct asix_common_private *priv = dev->driver_priv; ++ int ret; + +- priv->mdio = devm_mdiobus_alloc(&dev->udev->dev); ++ priv->mdio = mdiobus_alloc(); + if (!priv->mdio) + return -ENOMEM; + +@@ -679,7 +680,20 @@ static int ax88772_init_mdio(struct usbnet *dev) + snprintf(priv->mdio->id, MII_BUS_ID_SIZE, "usb-%03d:%03d", + dev->udev->bus->busnum, dev->udev->devnum); + +- return devm_mdiobus_register(&dev->udev->dev, priv->mdio); ++ ret = mdiobus_register(priv->mdio); ++ if (ret) { ++ netdev_err(dev->net, "Could not register MDIO bus (err %d)\n", ret); ++ mdiobus_free(priv->mdio); ++ priv->mdio = NULL; ++ } ++ ++ return ret; ++} ++ ++static void ax88772_mdio_unregister(struct asix_common_private *priv) ++{ ++ mdiobus_unregister(priv->mdio); ++ mdiobus_free(priv->mdio); + } + + static int ax88772_init_phy(struct usbnet *dev) +@@ -897,16 +911,23 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf) + + ret = ax88772_init_mdio(dev); + if (ret) +- return ret; ++ goto mdio_err; + + ret = ax88772_phylink_setup(dev); + if (ret) +- return ret; ++ goto phylink_err; + + ret = ax88772_init_phy(dev); + if (ret) +- phylink_destroy(priv->phylink); ++ goto initphy_err; + ++ return 0; ++ ++initphy_err: ++ phylink_destroy(priv->phylink); ++phylink_err: ++ ax88772_mdio_unregister(priv); ++mdio_err: + return ret; + } + +@@ -927,6 +948,7 @@ static void ax88772_unbind(struct usbnet *dev, struct usb_interface *intf) + phylink_disconnect_phy(priv->phylink); + rtnl_unlock(); + phylink_destroy(priv->phylink); ++ ax88772_mdio_unregister(priv); + asix_rx_fixup_common_free(dev->driver_priv); + } + +-- +2.39.2 + diff --git a/queue-6.1/net-dsa-b53-mmap-fix-device-tree-support.patch b/queue-6.1/net-dsa-b53-mmap-fix-device-tree-support.patch new file mode 100644 index 00000000000..72c0699698d --- /dev/null +++ b/queue-6.1/net-dsa-b53-mmap-fix-device-tree-support.patch @@ -0,0 +1,40 @@ +From 911ad5f2efb35d70f08371e0c67631de5bf9cff0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 18:28:07 +0100 +Subject: net: dsa: b53: mmap: fix device tree support +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Álvaro Fernández Rojas + +[ Upstream commit 30796d0dcb6e41c6558a07950f2ce60c209da867 ] + +CPU port should also be enabled in order to get a working switch. + +Fixes: a5538a777b73 ("net: dsa: b53: mmap: Add device tree support") +Signed-off-by: Álvaro Fernández Rojas +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20230316172807.460146-1-noltari@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/b53/b53_mmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/b53/b53_mmap.c b/drivers/net/dsa/b53/b53_mmap.c +index e968322dfbf0b..70887e0aece33 100644 +--- a/drivers/net/dsa/b53/b53_mmap.c ++++ b/drivers/net/dsa/b53/b53_mmap.c +@@ -263,7 +263,7 @@ static int b53_mmap_probe_of(struct platform_device *pdev, + if (of_property_read_u32(of_port, "reg", ®)) + continue; + +- if (reg < B53_CPU_PORT) ++ if (reg < B53_N_PORTS) + pdata->enabled_ports |= BIT(reg); + } + +-- +2.39.2 + diff --git a/queue-6.1/net-dsa-mt7530-move-enabling-disabling-core-clock-to.patch b/queue-6.1/net-dsa-mt7530-move-enabling-disabling-core-clock-to.patch new file mode 100644 index 00000000000..6ecb520aa15 --- /dev/null +++ b/queue-6.1/net-dsa-mt7530-move-enabling-disabling-core-clock-to.patch @@ -0,0 +1,91 @@ +From 9ba6a0ac4c858c2c2ba4463285018272c832be73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 22:05:18 +0300 +Subject: net: dsa: mt7530: move enabling disabling core clock to + mt7530_pll_setup() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arınç ÜNAL + +[ Upstream commit 8f058a6ef99f0b88a177b58cc46a44ff5112e40a ] + +Split the code that enables and disables TRGMII clocks and core clock. +Move enabling and disabling core clock to mt7530_pll_setup() as it's +supposed to be run there. + +Add 20 ms delay before enabling the core clock as seen on the U-Boot +MediaTek ethernet driver. + +Change the comment for enabling and disabling TRGMII clocks as the code +seems to affect both TXC and RXC. + +Tested rgmii and trgmii modes of port 6 and rgmii mode of port 5 on MCM +MT7530 on MT7621AT Unielec U7621-06 and standalone MT7530 on MT7623NI +Bananapi BPI-R2. + +Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") +Link: https://source.denx.de/u-boot/u-boot/-/blob/29a48bf9ccba45a5e560bb564bbe76e42629325f/drivers/net/mtk_eth.c#L589 +Tested-by: Arınç ÜNAL +Signed-off-by: Arınç ÜNAL +Link: https://lore.kernel.org/r/20230320190520.124513-1-arinc.unal@arinc9.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mt7530.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index 1757d6a2c72ae..2c0387dd3f359 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -396,6 +396,9 @@ mt7530_fdb_write(struct mt7530_priv *priv, u16 vid, + /* Set up switch core clock for MT7530 */ + static void mt7530_pll_setup(struct mt7530_priv *priv) + { ++ /* Disable core clock */ ++ core_clear(priv, CORE_TRGMII_GSW_CLK_CG, REG_GSWCK_EN); ++ + /* Disable PLL */ + core_write(priv, CORE_GSWPLL_GRP1, 0); + +@@ -409,6 +412,11 @@ static void mt7530_pll_setup(struct mt7530_priv *priv) + RG_GSWPLL_EN_PRE | + RG_GSWPLL_POSDIV_200M(2) | + RG_GSWPLL_FBKDIV_200M(32)); ++ ++ udelay(20); ++ ++ /* Enable core clock */ ++ core_set(priv, CORE_TRGMII_GSW_CLK_CG, REG_GSWCK_EN); + } + + /* Setup TX circuit including relevant PAD and driving */ +@@ -466,9 +474,8 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface) + mt7530_write(priv, MT7530_TRGMII_TD_ODT(i), + TD_DM_DRVP(8) | TD_DM_DRVN(8)); + +- /* Disable MT7530 core and TRGMII Tx clocks */ +- core_clear(priv, CORE_TRGMII_GSW_CLK_CG, +- REG_GSWCK_EN | REG_TRGMIICK_EN); ++ /* Disable the MT7530 TRGMII clocks */ ++ core_clear(priv, CORE_TRGMII_GSW_CLK_CG, REG_TRGMIICK_EN); + + /* Setup the MT7530 TRGMII Tx Clock */ + core_write(priv, CORE_PLL_GROUP5, RG_LCDDS_PCW_NCPO1(ncpo1)); +@@ -485,9 +492,8 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface) + RG_LCDDS_PCW_NCPO_CHG | RG_LCCDS_C(3) | + RG_LCDDS_PWDB | RG_LCDDS_ISO_EN); + +- /* Enable MT7530 core and TRGMII Tx clocks */ +- core_set(priv, CORE_TRGMII_GSW_CLK_CG, +- REG_GSWCK_EN | REG_TRGMIICK_EN); ++ /* Enable the MT7530 TRGMII clocks */ ++ core_set(priv, CORE_TRGMII_GSW_CLK_CG, REG_TRGMIICK_EN); + } else { + for (i = 0 ; i < NUM_TRGMII_CTRL; i++) + mt7530_rmw(priv, MT7530_TRGMII_RD(i), +-- +2.39.2 + diff --git a/queue-6.1/net-dsa-mt7530-move-lowering-trgmii-driving-to-mt753.patch b/queue-6.1/net-dsa-mt7530-move-lowering-trgmii-driving-to-mt753.patch new file mode 100644 index 00000000000..ecea4547e70 --- /dev/null +++ b/queue-6.1/net-dsa-mt7530-move-lowering-trgmii-driving-to-mt753.patch @@ -0,0 +1,100 @@ +From 9e94424dbd1c59f370ef30630d7356a3c23037df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 22:05:19 +0300 +Subject: net: dsa: mt7530: move lowering TRGMII driving to mt7530_setup() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arınç ÜNAL + +[ Upstream commit fdcc8ccd823740c18e803b886cec461bc0e64201 ] + +Move lowering the TRGMII Tx clock driving to mt7530_setup(), after setting +the core clock, as seen on the U-Boot MediaTek ethernet driver. + +Move the code which looks like it lowers the TRGMII Rx clock driving to +after the TRGMII Tx clock driving is lowered. This is run after lowering +the Tx clock driving on the U-Boot MediaTek ethernet driver as well. + +This way, the switch should consume less power regardless of port 6 being +used. + +Update the comment explaining mt7530_pad_clk_setup(). + +Tested rgmii and trgmii modes of port 6 and rgmii mode of port 5 on MCM +MT7530 on MT7621AT Unielec U7621-06 and standalone MT7530 on MT7623NI +Bananapi BPI-R2. + +Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") +Link: https://source.denx.de/u-boot/u-boot/-/blob/29a48bf9ccba45a5e560bb564bbe76e42629325f/drivers/net/mtk_eth.c#L682 +Tested-by: Arınç ÜNAL +Signed-off-by: Arınç ÜNAL +Link: https://lore.kernel.org/r/20230320190520.124513-2-arinc.unal@arinc9.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mt7530.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index 2c0387dd3f359..b4a679cbc95cf 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -419,12 +419,12 @@ static void mt7530_pll_setup(struct mt7530_priv *priv) + core_set(priv, CORE_TRGMII_GSW_CLK_CG, REG_GSWCK_EN); + } + +-/* Setup TX circuit including relevant PAD and driving */ ++/* Setup port 6 interface mode and TRGMII TX circuit */ + static int + mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface) + { + struct mt7530_priv *priv = ds->priv; +- u32 ncpo1, ssc_delta, trgint, i, xtal; ++ u32 ncpo1, ssc_delta, trgint, xtal; + + xtal = mt7530_read(priv, MT7530_MHWTRAP) & HWTRAP_XTAL_MASK; + +@@ -469,11 +469,6 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface) + P6_INTF_MODE(trgint)); + + if (trgint) { +- /* Lower Tx Driving for TRGMII path */ +- for (i = 0 ; i < NUM_TRGMII_CTRL ; i++) +- mt7530_write(priv, MT7530_TRGMII_TD_ODT(i), +- TD_DM_DRVP(8) | TD_DM_DRVN(8)); +- + /* Disable the MT7530 TRGMII clocks */ + core_clear(priv, CORE_TRGMII_GSW_CLK_CG, REG_TRGMIICK_EN); + +@@ -494,10 +489,6 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface) + + /* Enable the MT7530 TRGMII clocks */ + core_set(priv, CORE_TRGMII_GSW_CLK_CG, REG_TRGMIICK_EN); +- } else { +- for (i = 0 ; i < NUM_TRGMII_CTRL; i++) +- mt7530_rmw(priv, MT7530_TRGMII_RD(i), +- RD_TAP_MASK, RD_TAP(16)); + } + + return 0; +@@ -2212,6 +2203,15 @@ mt7530_setup(struct dsa_switch *ds) + + mt7530_pll_setup(priv); + ++ /* Lower Tx driving for TRGMII path */ ++ for (i = 0; i < NUM_TRGMII_CTRL; i++) ++ mt7530_write(priv, MT7530_TRGMII_TD_ODT(i), ++ TD_DM_DRVP(8) | TD_DM_DRVN(8)); ++ ++ for (i = 0; i < NUM_TRGMII_CTRL; i++) ++ mt7530_rmw(priv, MT7530_TRGMII_RD(i), ++ RD_TAP_MASK, RD_TAP(16)); ++ + /* Enable port 6 */ + val = mt7530_read(priv, MT7530_MHWTRAP); + val &= ~MHWTRAP_P6_DIS & ~MHWTRAP_PHY_ACCESS; +-- +2.39.2 + diff --git a/queue-6.1/net-dsa-mt7530-move-setting-ssc_delta-to-phy_interfa.patch b/queue-6.1/net-dsa-mt7530-move-setting-ssc_delta-to-phy_interfa.patch new file mode 100644 index 00000000000..7517e634ff6 --- /dev/null +++ b/queue-6.1/net-dsa-mt7530-move-setting-ssc_delta-to-phy_interfa.patch @@ -0,0 +1,55 @@ +From cff2ed8fddfae46c5129a03373b1346052357ae9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 22:05:20 +0300 +Subject: net: dsa: mt7530: move setting ssc_delta to PHY_INTERFACE_MODE_TRGMII + case +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arınç ÜNAL + +[ Upstream commit 407b508bdd70b6848993843d96ed49ac4108fb52 ] + +Move setting the ssc_delta variable to under the PHY_INTERFACE_MODE_TRGMII +case as it's only needed when trgmii is used. + +Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") +Signed-off-by: Arınç ÜNAL +Link: https://lore.kernel.org/r/20230320190520.124513-3-arinc.unal@arinc9.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mt7530.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index b4a679cbc95cf..38bf760b5b5ee 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -441,6 +441,10 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface) + break; + case PHY_INTERFACE_MODE_TRGMII: + trgint = 1; ++ if (xtal == HWTRAP_XTAL_25MHZ) ++ ssc_delta = 0x57; ++ else ++ ssc_delta = 0x87; + if (priv->id == ID_MT7621) { + /* PLL frequency: 150MHz: 1.2GBit */ + if (xtal == HWTRAP_XTAL_40MHZ) +@@ -460,11 +464,6 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface) + return -EINVAL; + } + +- if (xtal == HWTRAP_XTAL_25MHZ) +- ssc_delta = 0x57; +- else +- ssc_delta = 0x87; +- + mt7530_rmw(priv, MT7530_P6ECR, P6_INTF_MODE_MASK, + P6_INTF_MODE(trgint)); + +-- +2.39.2 + diff --git a/queue-6.1/net-dsa-tag_brcm-legacy-fix-daisy-chained-switches.patch b/queue-6.1/net-dsa-tag_brcm-legacy-fix-daisy-chained-switches.patch new file mode 100644 index 00000000000..7d1cfb52ac8 --- /dev/null +++ b/queue-6.1/net-dsa-tag_brcm-legacy-fix-daisy-chained-switches.patch @@ -0,0 +1,75 @@ +From bf1aca181aa41feb3c129727b5dfa1b8a2d8f1cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Mar 2023 10:55:40 +0100 +Subject: net: dsa: tag_brcm: legacy: fix daisy-chained switches +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Álvaro Fernández Rojas + +[ Upstream commit 032a954061afd4b7426c3eb6bfd2952ef1e9a384 ] + +When BCM63xx internal switches are connected to switches with a 4-byte +Broadcom tag, it does not identify the packet as VLAN tagged, so it adds one +based on its PVID (which is likely 0). +Right now, the packet is received by the BCM63xx internal switch and the 6-byte +tag is properly processed. The next step would to decode the corresponding +4-byte tag. However, the internal switch adds an invalid VLAN tag after the +6-byte tag and the 4-byte tag handling fails. +In order to fix this we need to remove the invalid VLAN tag after the 6-byte +tag before passing it to the 4-byte tag decoding. + +Fixes: 964dbf186eaa ("net: dsa: tag_brcm: add support for legacy tags") +Signed-off-by: Álvaro Fernández Rojas +Reviewed-by: Michal Swiatkowski +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20230319095540.239064-1-noltari@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/dsa/tag_brcm.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/net/dsa/tag_brcm.c b/net/dsa/tag_brcm.c +index 16889ea3e0a79..a65d62fb90094 100644 +--- a/net/dsa/tag_brcm.c ++++ b/net/dsa/tag_brcm.c +@@ -7,6 +7,7 @@ + + #include + #include ++#include + #include + #include + +@@ -248,6 +249,7 @@ static struct sk_buff *brcm_leg_tag_xmit(struct sk_buff *skb, + static struct sk_buff *brcm_leg_tag_rcv(struct sk_buff *skb, + struct net_device *dev) + { ++ int len = BRCM_LEG_TAG_LEN; + int source_port; + u8 *brcm_tag; + +@@ -262,12 +264,16 @@ static struct sk_buff *brcm_leg_tag_rcv(struct sk_buff *skb, + if (!skb->dev) + return NULL; + ++ /* VLAN tag is added by BCM63xx internal switch */ ++ if (netdev_uses_dsa(skb->dev)) ++ len += VLAN_HLEN; ++ + /* Remove Broadcom tag and update checksum */ +- skb_pull_rcsum(skb, BRCM_LEG_TAG_LEN); ++ skb_pull_rcsum(skb, len); + + dsa_default_offload_fwd_mark(skb); + +- dsa_strip_etype_header(skb, BRCM_LEG_TAG_LEN); ++ dsa_strip_etype_header(skb, len); + + return skb; + } +-- +2.39.2 + diff --git a/queue-6.1/net-mdio-fix-owner-field-for-mdio-buses-registered-u.patch b/queue-6.1/net-mdio-fix-owner-field-for-mdio-buses-registered-u.patch new file mode 100644 index 00000000000..09c14c87dfa --- /dev/null +++ b/queue-6.1/net-mdio-fix-owner-field-for-mdio-buses-registered-u.patch @@ -0,0 +1,152 @@ +From a74e76060442173c3247a0c5a0d7d7a509f5b6b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 16:33:16 -0700 +Subject: net: mdio: fix owner field for mdio buses registered using + device-tree + +From: Maxime Bizon + +[ Upstream commit 99669259f3361d759219811e670b7e0742668556 ] + +Bus ownership is wrong when using of_mdiobus_register() to register an mdio +bus. That function is not inline, so when it calls mdiobus_register() the wrong +THIS_MODULE value is captured. + +Signed-off-by: Maxime Bizon +Fixes: 90eff9096c01 ("net: phy: Allow splitting MDIO bus/device support from PHYs") +[florian: fix kdoc, added Fixes tag] +Signed-off-by: Florian Fainelli +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/mdio/of_mdio.c | 12 +++++++----- + drivers/net/phy/mdio_devres.c | 11 ++++++----- + include/linux/of_mdio.h | 22 +++++++++++++++++++--- + 3 files changed, 32 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/mdio/of_mdio.c b/drivers/net/mdio/of_mdio.c +index 510822d6d0d90..1e46e39f5f46a 100644 +--- a/drivers/net/mdio/of_mdio.c ++++ b/drivers/net/mdio/of_mdio.c +@@ -139,21 +139,23 @@ bool of_mdiobus_child_is_phy(struct device_node *child) + EXPORT_SYMBOL(of_mdiobus_child_is_phy); + + /** +- * of_mdiobus_register - Register mii_bus and create PHYs from the device tree ++ * __of_mdiobus_register - Register mii_bus and create PHYs from the device tree + * @mdio: pointer to mii_bus structure + * @np: pointer to device_node of MDIO bus. ++ * @owner: module owning the @mdio object. + * + * This function registers the mii_bus structure and registers a phy_device + * for each child node of @np. + */ +-int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np) ++int __of_mdiobus_register(struct mii_bus *mdio, struct device_node *np, ++ struct module *owner) + { + struct device_node *child; + bool scanphys = false; + int addr, rc; + + if (!np) +- return mdiobus_register(mdio); ++ return __mdiobus_register(mdio, owner); + + /* Do not continue if the node is disabled */ + if (!of_device_is_available(np)) +@@ -172,7 +174,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np) + of_property_read_u32(np, "reset-post-delay-us", &mdio->reset_post_delay_us); + + /* Register the MDIO bus */ +- rc = mdiobus_register(mdio); ++ rc = __mdiobus_register(mdio, owner); + if (rc) + return rc; + +@@ -236,7 +238,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np) + mdiobus_unregister(mdio); + return rc; + } +-EXPORT_SYMBOL(of_mdiobus_register); ++EXPORT_SYMBOL(__of_mdiobus_register); + + /** + * of_mdio_find_device - Given a device tree node, find the mdio_device +diff --git a/drivers/net/phy/mdio_devres.c b/drivers/net/phy/mdio_devres.c +index b560e99695dfd..69b829e6ab35b 100644 +--- a/drivers/net/phy/mdio_devres.c ++++ b/drivers/net/phy/mdio_devres.c +@@ -98,13 +98,14 @@ EXPORT_SYMBOL(__devm_mdiobus_register); + + #if IS_ENABLED(CONFIG_OF_MDIO) + /** +- * devm_of_mdiobus_register - Resource managed variant of of_mdiobus_register() ++ * __devm_of_mdiobus_register - Resource managed variant of of_mdiobus_register() + * @dev: Device to register mii_bus for + * @mdio: MII bus structure to register + * @np: Device node to parse ++ * @owner: Owning module + */ +-int devm_of_mdiobus_register(struct device *dev, struct mii_bus *mdio, +- struct device_node *np) ++int __devm_of_mdiobus_register(struct device *dev, struct mii_bus *mdio, ++ struct device_node *np, struct module *owner) + { + struct mdiobus_devres *dr; + int ret; +@@ -117,7 +118,7 @@ int devm_of_mdiobus_register(struct device *dev, struct mii_bus *mdio, + if (!dr) + return -ENOMEM; + +- ret = of_mdiobus_register(mdio, np); ++ ret = __of_mdiobus_register(mdio, np, owner); + if (ret) { + devres_free(dr); + return ret; +@@ -127,7 +128,7 @@ int devm_of_mdiobus_register(struct device *dev, struct mii_bus *mdio, + devres_add(dev, dr); + return 0; + } +-EXPORT_SYMBOL(devm_of_mdiobus_register); ++EXPORT_SYMBOL(__devm_of_mdiobus_register); + #endif /* CONFIG_OF_MDIO */ + + MODULE_LICENSE("GPL"); +diff --git a/include/linux/of_mdio.h b/include/linux/of_mdio.h +index da633d34ab866..8a52ef2e6fa6b 100644 +--- a/include/linux/of_mdio.h ++++ b/include/linux/of_mdio.h +@@ -14,9 +14,25 @@ + + #if IS_ENABLED(CONFIG_OF_MDIO) + bool of_mdiobus_child_is_phy(struct device_node *child); +-int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np); +-int devm_of_mdiobus_register(struct device *dev, struct mii_bus *mdio, +- struct device_node *np); ++int __of_mdiobus_register(struct mii_bus *mdio, struct device_node *np, ++ struct module *owner); ++ ++static inline int of_mdiobus_register(struct mii_bus *mdio, ++ struct device_node *np) ++{ ++ return __of_mdiobus_register(mdio, np, THIS_MODULE); ++} ++ ++int __devm_of_mdiobus_register(struct device *dev, struct mii_bus *mdio, ++ struct device_node *np, struct module *owner); ++ ++static inline int devm_of_mdiobus_register(struct device *dev, ++ struct mii_bus *mdio, ++ struct device_node *np) ++{ ++ return __devm_of_mdiobus_register(dev, mdio, np, THIS_MODULE); ++} ++ + struct mdio_device *of_mdio_find_device(struct device_node *np); + struct phy_device *of_phy_find_device(struct device_node *phy_np); + struct phy_device * +-- +2.39.2 + diff --git a/queue-6.1/net-mdio-fix-owner-field-for-mdio-buses-registered-u.patch-21091 b/queue-6.1/net-mdio-fix-owner-field-for-mdio-buses-registered-u.patch-21091 new file mode 100644 index 00000000000..45a63a159f3 --- /dev/null +++ b/queue-6.1/net-mdio-fix-owner-field-for-mdio-buses-registered-u.patch-21091 @@ -0,0 +1,87 @@ +From e9d7c5ef09cb38b693987a472e8232ace610daa1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 16:33:17 -0700 +Subject: net: mdio: fix owner field for mdio buses registered using ACPI + +From: Florian Fainelli + +[ Upstream commit 30b605b8501e321f79e19c3238aa6ca31da6087c ] + +Bus ownership is wrong when using acpi_mdiobus_register() to register an +mdio bus. That function is not inline, so when it calls +mdiobus_register() the wrong THIS_MODULE value is captured. + +CC: Maxime Bizon +Fixes: 803ca24d2f92 ("net: mdio: Add ACPI support code for mdio") +Signed-off-by: Florian Fainelli +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/mdio/acpi_mdio.c | 10 ++++++---- + include/linux/acpi_mdio.h | 9 ++++++++- + 2 files changed, 14 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/mdio/acpi_mdio.c b/drivers/net/mdio/acpi_mdio.c +index d77c987fda9cd..4630dde019749 100644 +--- a/drivers/net/mdio/acpi_mdio.c ++++ b/drivers/net/mdio/acpi_mdio.c +@@ -18,16 +18,18 @@ MODULE_AUTHOR("Calvin Johnson "); + MODULE_LICENSE("GPL"); + + /** +- * acpi_mdiobus_register - Register mii_bus and create PHYs from the ACPI ASL. ++ * __acpi_mdiobus_register - Register mii_bus and create PHYs from the ACPI ASL. + * @mdio: pointer to mii_bus structure + * @fwnode: pointer to fwnode of MDIO bus. This fwnode is expected to represent ++ * @owner: module owning this @mdio object. + * an ACPI device object corresponding to the MDIO bus and its children are + * expected to correspond to the PHY devices on that bus. + * + * This function registers the mii_bus structure and registers a phy_device + * for each child node of @fwnode. + */ +-int acpi_mdiobus_register(struct mii_bus *mdio, struct fwnode_handle *fwnode) ++int __acpi_mdiobus_register(struct mii_bus *mdio, struct fwnode_handle *fwnode, ++ struct module *owner) + { + struct fwnode_handle *child; + u32 addr; +@@ -35,7 +37,7 @@ int acpi_mdiobus_register(struct mii_bus *mdio, struct fwnode_handle *fwnode) + + /* Mask out all PHYs from auto probing. */ + mdio->phy_mask = GENMASK(31, 0); +- ret = mdiobus_register(mdio); ++ ret = __mdiobus_register(mdio, owner); + if (ret) + return ret; + +@@ -55,4 +57,4 @@ int acpi_mdiobus_register(struct mii_bus *mdio, struct fwnode_handle *fwnode) + } + return 0; + } +-EXPORT_SYMBOL(acpi_mdiobus_register); ++EXPORT_SYMBOL(__acpi_mdiobus_register); +diff --git a/include/linux/acpi_mdio.h b/include/linux/acpi_mdio.h +index 0a24ab7cb66fa..8e2eefa9fbc0f 100644 +--- a/include/linux/acpi_mdio.h ++++ b/include/linux/acpi_mdio.h +@@ -9,7 +9,14 @@ + #include + + #if IS_ENABLED(CONFIG_ACPI_MDIO) +-int acpi_mdiobus_register(struct mii_bus *mdio, struct fwnode_handle *fwnode); ++int __acpi_mdiobus_register(struct mii_bus *mdio, struct fwnode_handle *fwnode, ++ struct module *owner); ++ ++static inline int ++acpi_mdiobus_register(struct mii_bus *mdio, struct fwnode_handle *handle) ++{ ++ return __acpi_mdiobus_register(mdio, handle, THIS_MODULE); ++} + #else /* CONFIG_ACPI_MDIO */ + static inline int + acpi_mdiobus_register(struct mii_bus *mdio, struct fwnode_handle *fwnode) +-- +2.39.2 + diff --git a/queue-6.1/net-mdio-thunder-add-missing-fwnode_handle_put.patch b/queue-6.1/net-mdio-thunder-add-missing-fwnode_handle_put.patch new file mode 100644 index 00000000000..bc85f52d0b2 --- /dev/null +++ b/queue-6.1/net-mdio-thunder-add-missing-fwnode_handle_put.patch @@ -0,0 +1,36 @@ +From fdaac28b8974349518d5506c86aa60a66d313b9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 14:20:57 +0800 +Subject: net: mdio: thunder: Add missing fwnode_handle_put() + +From: Liang He + +[ Upstream commit b1de5c78ebe9858ccec9d49af2f76724f1d47e3e ] + +In device_for_each_child_node(), we should add fwnode_handle_put() +when break out of the iteration device_for_each_child_node() +as it will automatically increase and decrease the refcounter. + +Fixes: 379d7ac7ca31 ("phy: mdio-thunder: Add driver for Cavium Thunder SoC MDIO buses.") +Signed-off-by: Liang He +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/mdio/mdio-thunder.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/mdio/mdio-thunder.c b/drivers/net/mdio/mdio-thunder.c +index 822d2cdd2f359..394b864aaa372 100644 +--- a/drivers/net/mdio/mdio-thunder.c ++++ b/drivers/net/mdio/mdio-thunder.c +@@ -104,6 +104,7 @@ static int thunder_mdiobus_pci_probe(struct pci_dev *pdev, + if (i >= ARRAY_SIZE(nexus->buses)) + break; + } ++ fwnode_handle_put(fwn); + return 0; + + err_release_regions: +-- +2.39.2 + diff --git a/queue-6.1/net-mlx5-e-switch-fix-an-oops-in-error-handling-code.patch b/queue-6.1/net-mlx5-e-switch-fix-an-oops-in-error-handling-code.patch new file mode 100644 index 00000000000..d7b623de6b6 --- /dev/null +++ b/queue-6.1/net-mlx5-e-switch-fix-an-oops-in-error-handling-code.patch @@ -0,0 +1,38 @@ +From 2ed2e87d9ff20b7b29cd45df6035129b116eee81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 14:16:10 +0300 +Subject: net/mlx5: E-Switch, Fix an Oops in error handling code + +From: Dan Carpenter + +[ Upstream commit 640fcdbcf27fc62de9223f958ceb4e897a00e791 ] + +The error handling dereferences "vport". There is nothing we can do if +it is an error pointer except returning the error code. + +Fixes: 133dcfc577ea ("net/mlx5: E-Switch, Alloc and free unique metadata for match") +Signed-off-by: Dan Carpenter +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_ofld.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_ofld.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_ofld.c +index a994e71e05c11..db578a7e7008a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_ofld.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_ofld.c +@@ -364,8 +364,7 @@ int mlx5_esw_acl_ingress_vport_bond_update(struct mlx5_eswitch *esw, u16 vport_n + + if (WARN_ON_ONCE(IS_ERR(vport))) { + esw_warn(esw->dev, "vport(%d) invalid!\n", vport_num); +- err = PTR_ERR(vport); +- goto out; ++ return PTR_ERR(vport); + } + + esw_acl_ingress_ofld_rules_destroy(esw, vport); +-- +2.39.2 + diff --git a/queue-6.1/net-mlx5-fix-steering-rules-cleanup.patch b/queue-6.1/net-mlx5-fix-steering-rules-cleanup.patch new file mode 100644 index 00000000000..1adfa82f4f3 --- /dev/null +++ b/queue-6.1/net-mlx5-fix-steering-rules-cleanup.patch @@ -0,0 +1,65 @@ +From e80ccb8566c9cf31580d2e5198ed86cd6986dbe8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 14:07:03 +0200 +Subject: net/mlx5: Fix steering rules cleanup + +From: Lama Kayal + +[ Upstream commit 922f56e9a795d6f3dd72d3428ebdd7ee040fa855 ] + +vport's mc, uc and multicast rules are not deleted in teardown path when +EEH happens. Since the vport's promisc settings(uc, mc and all) in +firmware are reset after EEH, mlx5 driver will try to delete the above +rules in the initialization path. This cause kernel crash because these +software rules are no longer valid. + +Fix by nullifying these rules right after delete to avoid accessing any dangling +pointers. + +Call Trace: +__list_del_entry_valid+0xcc/0x100 (unreliable) +tree_put_node+0xf4/0x1b0 [mlx5_core] +tree_remove_node+0x30/0x70 [mlx5_core] +mlx5_del_flow_rules+0x14c/0x1f0 [mlx5_core] +esw_apply_vport_rx_mode+0x10c/0x200 [mlx5_core] +esw_update_vport_rx_mode+0xb4/0x180 [mlx5_core] +esw_vport_change_handle_locked+0x1ec/0x230 [mlx5_core] +esw_enable_vport+0x130/0x260 [mlx5_core] +mlx5_eswitch_enable_sriov+0x2a0/0x2f0 [mlx5_core] +mlx5_device_enable_sriov+0x74/0x440 [mlx5_core] +mlx5_load_one+0x114c/0x1550 [mlx5_core] +mlx5_pci_resume+0x68/0xf0 [mlx5_core] +eeh_report_resume+0x1a4/0x230 +eeh_pe_dev_traverse+0x98/0x170 +eeh_handle_normal_event+0x3e4/0x640 +eeh_handle_event+0x4c/0x370 +eeh_event_handler+0x14c/0x210 +kthread+0x168/0x1b0 +ret_from_kernel_thread+0x5c/0x84 + +Fixes: a35f71f27a61 ("net/mlx5: E-Switch, Implement promiscuous rx modes vf request handling") +Signed-off-by: Huy Nguyen +Signed-off-by: Lama Kayal +Reviewed-by: Tariq Toukan +Reviewed-by: Maor Dickman +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +index 43ba00d5e36ec..4b9d567c8f473 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +@@ -916,6 +916,7 @@ void mlx5_esw_vport_disable(struct mlx5_eswitch *esw, u16 vport_num) + */ + esw_vport_change_handle_locked(vport); + vport->enabled_events = 0; ++ esw_apply_vport_rx_mode(esw, vport, false, false); + esw_vport_cleanup(esw, vport); + esw->enabled_vports--; + +-- +2.39.2 + diff --git a/queue-6.1/net-mlx5-read-the-tc-mapping-of-all-priorities-on-et.patch b/queue-6.1/net-mlx5-read-the-tc-mapping-of-all-priorities-on-et.patch new file mode 100644 index 00000000000..7e43b62a31f --- /dev/null +++ b/queue-6.1/net-mlx5-read-the-tc-mapping-of-all-priorities-on-et.patch @@ -0,0 +1,51 @@ +From 3478bb92900d72cf5c169feaa30e5f0c65a9b195 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 11:04:38 +0200 +Subject: net/mlx5: Read the TC mapping of all priorities on ETS query + +From: Maher Sanalla + +[ Upstream commit 44d553188c38ac74b799dfdcebafef2f7bb70942 ] + +When ETS configurations are queried by the user to get the mapping +assignment between packet priority and traffic class, only priorities up +to maximum TCs are queried from QTCT register in FW to retrieve their +assigned TC, leaving the rest of the priorities mapped to the default +TC #0 which might be misleading. + +Fix by querying the TC mapping of all priorities on each ETS query, +regardless of the maximum number of TCs configured in FW. + +Fixes: 820c2c5e773d ("net/mlx5e: Read ETS settings directly from firmware") +Signed-off-by: Maher Sanalla +Reviewed-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c +index 2449731b7d79a..89de92d064836 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c +@@ -117,12 +117,14 @@ static int mlx5e_dcbnl_ieee_getets(struct net_device *netdev, + if (!MLX5_CAP_GEN(priv->mdev, ets)) + return -EOPNOTSUPP; + +- ets->ets_cap = mlx5_max_tc(priv->mdev) + 1; +- for (i = 0; i < ets->ets_cap; i++) { ++ for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) { + err = mlx5_query_port_prio_tc(mdev, i, &ets->prio_tc[i]); + if (err) + return err; ++ } + ++ ets->ets_cap = mlx5_max_tc(priv->mdev) + 1; ++ for (i = 0; i < ets->ets_cap; i++) { + err = mlx5_query_port_tc_group(mdev, i, &tc_group[i]); + if (err) + return err; +-- +2.39.2 + diff --git a/queue-6.1/net-mlx5e-block-entering-switchdev-mode-with-ns-inco.patch b/queue-6.1/net-mlx5e-block-entering-switchdev-mode-with-ns-inco.patch new file mode 100644 index 00000000000..1a5d8fc94f7 --- /dev/null +++ b/queue-6.1/net-mlx5e-block-entering-switchdev-mode-with-ns-inco.patch @@ -0,0 +1,69 @@ +From be4b6a17b11fccb0b4aed4499381d90107d9b71f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 12:48:52 +0200 +Subject: net/mlx5e: Block entering switchdev mode with ns inconsistency + +From: Gavin Li + +[ Upstream commit 662404b24a4c4d839839ed25e3097571f5938b9b ] + +Upon entering switchdev mode, VF/SF representors are spawned in the +devlink instance's net namespace, whereas the PF net device transforms +into the uplink representor, remaining in the net namespace the PF net +device was in. Therefore, if a PF net device's namespace is different from +its parent devlink net namespace, entering switchdev mode can create an +illegal situation where all representors sharing the same core device +are NOT in the same net namespace. + +To avoid this issue, block entering switchdev mode for devices whose child +netdev net namespace has diverged from the parent devlink's. + +Fixes: 7768d1971de6 ("net/mlx5: E-Switch, Add control for encapsulation") +Signed-off-by: Gavin Li +Reviewed-by: Gavi Teitz +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../mellanox/mlx5/core/eswitch_offloads.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +index 34790a82a0976..64e5b9f29206e 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +@@ -3488,6 +3488,18 @@ static int esw_inline_mode_to_devlink(u8 mlx5_mode, u8 *mode) + return 0; + } + ++static bool esw_offloads_devlink_ns_eq_netdev_ns(struct devlink *devlink) ++{ ++ struct net *devl_net, *netdev_net; ++ struct mlx5_eswitch *esw; ++ ++ esw = mlx5_devlink_eswitch_get(devlink); ++ netdev_net = dev_net(esw->dev->mlx5e_res.uplink_netdev); ++ devl_net = devlink_net(devlink); ++ ++ return net_eq(devl_net, netdev_net); ++} ++ + int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode, + struct netlink_ext_ack *extack) + { +@@ -3502,6 +3514,13 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode, + if (esw_mode_from_devlink(mode, &mlx5_mode)) + return -EINVAL; + ++ if (mode == DEVLINK_ESWITCH_MODE_SWITCHDEV && ++ !esw_offloads_devlink_ns_eq_netdev_ns(devlink)) { ++ NL_SET_ERR_MSG_MOD(extack, ++ "Can't change E-Switch mode to switchdev when netdev net namespace has diverged from the devlink's."); ++ return -EPERM; ++ } ++ + mlx5_lag_disable_change(esw->dev); + err = mlx5_esw_try_lock(esw); + if (err < 0) { +-- +2.39.2 + diff --git a/queue-6.1/net-mlx5e-overcome-slow-response-for-first-macsec-as.patch b/queue-6.1/net-mlx5e-overcome-slow-response-for-first-macsec-as.patch new file mode 100644 index 00000000000..0e6ed715203 --- /dev/null +++ b/queue-6.1/net-mlx5e-overcome-slow-response-for-first-macsec-as.patch @@ -0,0 +1,58 @@ +From 4b169baf2a00533f769a9a043333d7ad35243a98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 13:13:55 +0200 +Subject: net/mlx5e: Overcome slow response for first macsec ASO WQE +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Emeel Hakim + +[ Upstream commit 7e3fce82d945cf6e7f99034b113ff2d250d7524d ] + +First ASO WQE poll causes a cache miss in hardware hence the resut is +delayed. It causes to the situation where such WQE is polled earlier +than it is needed. + +Add logic to retry ASO CQ polling operation. + +Fixes: 739cfa34518e ("net/mlx5: Make ASO poll CQ usable in atomic context")  +Signed-off-by: Emeel Hakim +Reviewed-by: Leon Romanovsky +Reviewed-by: Raed Salem +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/en_accel/macsec.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c +index 0c23340bfcc75..0f8f3ce35537d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c +@@ -1412,6 +1412,7 @@ static int macsec_aso_query(struct mlx5_core_dev *mdev, struct mlx5e_macsec *mac + struct mlx5e_macsec_aso *aso; + struct mlx5_aso_wqe *aso_wqe; + struct mlx5_aso *maso; ++ unsigned long expires; + int err; + + aso = &macsec->aso; +@@ -1425,7 +1426,13 @@ static int macsec_aso_query(struct mlx5_core_dev *mdev, struct mlx5e_macsec *mac + macsec_aso_build_wqe_ctrl_seg(aso, &aso_wqe->aso_ctrl, NULL); + + mlx5_aso_post_wqe(maso, false, &aso_wqe->ctrl); +- err = mlx5_aso_poll_cq(maso, false); ++ expires = jiffies + msecs_to_jiffies(10); ++ do { ++ err = mlx5_aso_poll_cq(maso, false); ++ if (err) ++ usleep_range(2, 10); ++ } while (err && time_is_after_jiffies(expires)); ++ + if (err) + goto err_out; + +-- +2.39.2 + diff --git a/queue-6.1/net-mlx5e-set-uplink-rep-as-netns_local.patch b/queue-6.1/net-mlx5e-set-uplink-rep-as-netns_local.patch new file mode 100644 index 00000000000..ff06bbdd6f0 --- /dev/null +++ b/queue-6.1/net-mlx5e-set-uplink-rep-as-netns_local.patch @@ -0,0 +1,49 @@ +From 5db503c287a3d6043e13e8f6be849a6878061010 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Nov 2022 04:15:40 +0200 +Subject: net/mlx5e: Set uplink rep as NETNS_LOCAL + +From: Gavin Li + +[ Upstream commit c83172b0639c8a005c0dd3b36252dc22ddd9f19c ] + +Previously, NETNS_LOCAL was not set for uplink representors, inconsistent +with VF representors, and allowed the uplink representor to be moved +between net namespaces and separated from the VF representors it shares +the core device with. Such usage would break the isolation model of +namespaces, as devices in different namespaces would have access to +shared memory. + +To solve this issue, set NETNS_LOCAL for uplink representors if eswitch is +in switchdev mode. + +Fixes: 7a9fb35e8c3a ("net/mlx5e: Do not reload ethernet ports when changing eswitch mode") +Signed-off-by: Gavin Li +Reviewed-by: Gavi Teitz +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 609a49c1e09e6..3b5c5064cfafc 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -4081,8 +4081,12 @@ static netdev_features_t mlx5e_fix_features(struct net_device *netdev, + } + } + +- if (mlx5e_is_uplink_rep(priv)) ++ if (mlx5e_is_uplink_rep(priv)) { + features = mlx5e_fix_uplink_rep_features(netdev, features); ++ features |= NETIF_F_NETNS_LOCAL; ++ } else { ++ features &= ~NETIF_F_NETNS_LOCAL; ++ } + + mutex_unlock(&priv->state_lock); + +-- +2.39.2 + diff --git a/queue-6.1/net-phy-ensure-state-transitions-are-processed-from-.patch b/queue-6.1/net-phy-ensure-state-transitions-are-processed-from-.patch new file mode 100644 index 00000000000..b457e77d184 --- /dev/null +++ b/queue-6.1/net-phy-ensure-state-transitions-are-processed-from-.patch @@ -0,0 +1,91 @@ +From 12940bcd382fd263c27d2bcaad1584378f855368 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 13:33:24 -0700 +Subject: net: phy: Ensure state transitions are processed from phy_stop() + +From: Florian Fainelli + +[ Upstream commit 4203d84032e28f893594a453bd8bc9c3b15c7334 ] + +In the phy_disconnect() -> phy_stop() path, we will be forcibly setting +the PHY state machine to PHY_HALTED. This invalidates the old_state != +phydev->state condition in phy_state_machine() such that we will neither +display the state change for debugging, nor will we invoke the +link_change_notify() callback. + +Factor the code by introducing phy_process_state_change(), and ensure +that we process the state change from phy_stop() as well. + +Fixes: 5c5f626bcace ("net: phy: improve handling link_change_notify callback") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/phy.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c +index e741d8aebffe1..d1aea767ed09f 100644 +--- a/drivers/net/phy/phy.c ++++ b/drivers/net/phy/phy.c +@@ -57,6 +57,18 @@ static const char *phy_state_to_str(enum phy_state st) + return NULL; + } + ++static void phy_process_state_change(struct phy_device *phydev, ++ enum phy_state old_state) ++{ ++ if (old_state != phydev->state) { ++ phydev_dbg(phydev, "PHY state change %s -> %s\n", ++ phy_state_to_str(old_state), ++ phy_state_to_str(phydev->state)); ++ if (phydev->drv && phydev->drv->link_change_notify) ++ phydev->drv->link_change_notify(phydev); ++ } ++} ++ + static void phy_link_up(struct phy_device *phydev) + { + phydev->phy_link_change(phydev, true); +@@ -1093,6 +1105,7 @@ EXPORT_SYMBOL(phy_free_interrupt); + void phy_stop(struct phy_device *phydev) + { + struct net_device *dev = phydev->attached_dev; ++ enum phy_state old_state; + + if (!phy_is_started(phydev) && phydev->state != PHY_DOWN) { + WARN(1, "called from state %s\n", +@@ -1101,6 +1114,7 @@ void phy_stop(struct phy_device *phydev) + } + + mutex_lock(&phydev->lock); ++ old_state = phydev->state; + + if (phydev->state == PHY_CABLETEST) { + phy_abort_cable_test(phydev); +@@ -1111,6 +1125,7 @@ void phy_stop(struct phy_device *phydev) + sfp_upstream_stop(phydev->sfp_bus); + + phydev->state = PHY_HALTED; ++ phy_process_state_change(phydev, old_state); + + mutex_unlock(&phydev->lock); + +@@ -1228,13 +1243,7 @@ void phy_state_machine(struct work_struct *work) + if (err < 0) + phy_error(phydev); + +- if (old_state != phydev->state) { +- phydev_dbg(phydev, "PHY state change %s -> %s\n", +- phy_state_to_str(old_state), +- phy_state_to_str(phydev->state)); +- if (phydev->drv && phydev->drv->link_change_notify) +- phydev->drv->link_change_notify(phydev); +- } ++ phy_process_state_change(phydev, old_state); + + /* Only re-schedule a PHY state machine change if we are polling the + * PHY, if PHY_MAC_INTERRUPT is set, then we will be moving +-- +2.39.2 + diff --git a/queue-6.1/net-ps3_gelic_net-fix-rx-sk_buff-length.patch b/queue-6.1/net-ps3_gelic_net-fix-rx-sk_buff-length.patch new file mode 100644 index 00000000000..13ae3894f45 --- /dev/null +++ b/queue-6.1/net-ps3_gelic_net-fix-rx-sk_buff-length.patch @@ -0,0 +1,106 @@ +From b2e825fd0c51eb4372871d4512be887a50425cac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 17:39:16 +0000 +Subject: net/ps3_gelic_net: Fix RX sk_buff length + +From: Geoff Levand + +[ Upstream commit 19b3bb51c3bc288b3f2c6f8c4450b0f548320625 ] + +The Gelic Ethernet device needs to have the RX sk_buffs aligned to +GELIC_NET_RXBUF_ALIGN, and also the length of the RX sk_buffs must +be a multiple of GELIC_NET_RXBUF_ALIGN. + +The current Gelic Ethernet driver was not allocating sk_buffs large +enough to allow for this alignment. + +Also, correct the maximum and minimum MTU sizes, and add a new +preprocessor macro for the maximum frame size, GELIC_NET_MAX_FRAME. + +Fixes various randomly occurring runtime network errors. + +Fixes: 02c1889166b4 ("ps3: gigabit ethernet driver for PS3, take3") +Signed-off-by: Geoff Levand +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/toshiba/ps3_gelic_net.c | 19 ++++++++++--------- + drivers/net/ethernet/toshiba/ps3_gelic_net.h | 5 +++-- + 2 files changed, 13 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.c b/drivers/net/ethernet/toshiba/ps3_gelic_net.c +index cf8de8a7a8a1e..dffd664e65f4e 100644 +--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.c ++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.c +@@ -365,26 +365,27 @@ static int gelic_card_init_chain(struct gelic_card *card, + * + * allocates a new rx skb, iommu-maps it and attaches it to the descriptor. + * Activate the descriptor state-wise ++ * ++ * Gelic RX sk_buffs must be aligned to GELIC_NET_RXBUF_ALIGN and the length ++ * must be a multiple of GELIC_NET_RXBUF_ALIGN. + */ + static int gelic_descr_prepare_rx(struct gelic_card *card, + struct gelic_descr *descr) + { ++ static const unsigned int rx_skb_size = ++ ALIGN(GELIC_NET_MAX_FRAME, GELIC_NET_RXBUF_ALIGN) + ++ GELIC_NET_RXBUF_ALIGN - 1; + int offset; +- unsigned int bufsize; + + if (gelic_descr_get_status(descr) != GELIC_DESCR_DMA_NOT_IN_USE) + dev_info(ctodev(card), "%s: ERROR status\n", __func__); +- /* we need to round up the buffer size to a multiple of 128 */ +- bufsize = ALIGN(GELIC_NET_MAX_MTU, GELIC_NET_RXBUF_ALIGN); + +- /* and we need to have it 128 byte aligned, therefore we allocate a +- * bit more */ +- descr->skb = dev_alloc_skb(bufsize + GELIC_NET_RXBUF_ALIGN - 1); ++ descr->skb = netdev_alloc_skb(*card->netdev, rx_skb_size); + if (!descr->skb) { + descr->buf_addr = 0; /* tell DMAC don't touch memory */ + return -ENOMEM; + } +- descr->buf_size = cpu_to_be32(bufsize); ++ descr->buf_size = cpu_to_be32(rx_skb_size); + descr->dmac_cmd_status = 0; + descr->result_size = 0; + descr->valid_size = 0; +@@ -397,7 +398,7 @@ static int gelic_descr_prepare_rx(struct gelic_card *card, + /* io-mmu-map the skb */ + descr->buf_addr = cpu_to_be32(dma_map_single(ctodev(card), + descr->skb->data, +- GELIC_NET_MAX_MTU, ++ GELIC_NET_MAX_FRAME, + DMA_FROM_DEVICE)); + if (!descr->buf_addr) { + dev_kfree_skb_any(descr->skb); +@@ -915,7 +916,7 @@ static void gelic_net_pass_skb_up(struct gelic_descr *descr, + data_error = be32_to_cpu(descr->data_error); + /* unmap skb buffer */ + dma_unmap_single(ctodev(card), be32_to_cpu(descr->buf_addr), +- GELIC_NET_MAX_MTU, ++ GELIC_NET_MAX_FRAME, + DMA_FROM_DEVICE); + + skb_put(skb, be32_to_cpu(descr->valid_size)? +diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.h b/drivers/net/ethernet/toshiba/ps3_gelic_net.h +index 68f324ed4eaf0..0d98defb011ed 100644 +--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.h ++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.h +@@ -19,8 +19,9 @@ + #define GELIC_NET_RX_DESCRIPTORS 128 /* num of descriptors */ + #define GELIC_NET_TX_DESCRIPTORS 128 /* num of descriptors */ + +-#define GELIC_NET_MAX_MTU VLAN_ETH_FRAME_LEN +-#define GELIC_NET_MIN_MTU VLAN_ETH_ZLEN ++#define GELIC_NET_MAX_FRAME 2312 ++#define GELIC_NET_MAX_MTU 2294 ++#define GELIC_NET_MIN_MTU 64 + #define GELIC_NET_RXBUF_ALIGN 128 + #define GELIC_CARD_RX_CSUM_DEFAULT 1 /* hw chksum */ + #define GELIC_NET_WATCHDOG_TIMEOUT 5*HZ +-- +2.39.2 + diff --git a/queue-6.1/net-ps3_gelic_net-use-dma_mapping_error.patch b/queue-6.1/net-ps3_gelic_net-use-dma_mapping_error.patch new file mode 100644 index 00000000000..58854e483db --- /dev/null +++ b/queue-6.1/net-ps3_gelic_net-use-dma_mapping_error.patch @@ -0,0 +1,89 @@ +From 5df92e7071270a475b90f35d48d6737268e2577a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 17:39:16 +0000 +Subject: net/ps3_gelic_net: Use dma_mapping_error + +From: Geoff Levand + +[ Upstream commit bebe933d35a63d4f042fbf4dce4f22e689ba0fcd ] + +The current Gelic Etherenet driver was checking the return value of its +dma_map_single call, and not using the dma_mapping_error() routine. + +Fixes runtime problems like these: + + DMA-API: ps3_gelic_driver sb_05: device driver failed to check map error + WARNING: CPU: 0 PID: 0 at kernel/dma/debug.c:1027 .check_unmap+0x888/0x8dc + +Fixes: 02c1889166b4 ("ps3: gigabit ethernet driver for PS3, take3") +Reviewed-by: Alexander Duyck +Signed-off-by: Geoff Levand +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/toshiba/ps3_gelic_net.c | 24 +++++++++++--------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.c b/drivers/net/ethernet/toshiba/ps3_gelic_net.c +index dffd664e65f4e..9d535ae596266 100644 +--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.c ++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.c +@@ -317,15 +317,17 @@ static int gelic_card_init_chain(struct gelic_card *card, + + /* set up the hardware pointers in each descriptor */ + for (i = 0; i < no; i++, descr++) { ++ dma_addr_t cpu_addr; ++ + gelic_descr_set_status(descr, GELIC_DESCR_DMA_NOT_IN_USE); +- descr->bus_addr = +- dma_map_single(ctodev(card), descr, +- GELIC_DESCR_SIZE, +- DMA_BIDIRECTIONAL); + +- if (!descr->bus_addr) ++ cpu_addr = dma_map_single(ctodev(card), descr, ++ GELIC_DESCR_SIZE, DMA_BIDIRECTIONAL); ++ ++ if (dma_mapping_error(ctodev(card), cpu_addr)) + goto iommu_error; + ++ descr->bus_addr = cpu_to_be32(cpu_addr); + descr->next = descr + 1; + descr->prev = descr - 1; + } +@@ -375,6 +377,7 @@ static int gelic_descr_prepare_rx(struct gelic_card *card, + static const unsigned int rx_skb_size = + ALIGN(GELIC_NET_MAX_FRAME, GELIC_NET_RXBUF_ALIGN) + + GELIC_NET_RXBUF_ALIGN - 1; ++ dma_addr_t cpu_addr; + int offset; + + if (gelic_descr_get_status(descr) != GELIC_DESCR_DMA_NOT_IN_USE) +@@ -396,11 +399,10 @@ static int gelic_descr_prepare_rx(struct gelic_card *card, + if (offset) + skb_reserve(descr->skb, GELIC_NET_RXBUF_ALIGN - offset); + /* io-mmu-map the skb */ +- descr->buf_addr = cpu_to_be32(dma_map_single(ctodev(card), +- descr->skb->data, +- GELIC_NET_MAX_FRAME, +- DMA_FROM_DEVICE)); +- if (!descr->buf_addr) { ++ cpu_addr = dma_map_single(ctodev(card), descr->skb->data, ++ GELIC_NET_MAX_FRAME, DMA_FROM_DEVICE); ++ descr->buf_addr = cpu_to_be32(cpu_addr); ++ if (dma_mapping_error(ctodev(card), cpu_addr)) { + dev_kfree_skb_any(descr->skb); + descr->skb = NULL; + dev_info(ctodev(card), +@@ -780,7 +782,7 @@ static int gelic_descr_prepare_tx(struct gelic_card *card, + + buf = dma_map_single(ctodev(card), skb->data, skb->len, DMA_TO_DEVICE); + +- if (!buf) { ++ if (dma_mapping_error(ctodev(card), buf)) { + dev_err(ctodev(card), + "dma map 2 failed (%p, %i). Dropping packet\n", + skb->data, skb->len); +-- +2.39.2 + diff --git a/queue-6.1/net-qcom-emac-fix-use-after-free-bug-in-emac_remove-.patch b/queue-6.1/net-qcom-emac-fix-use-after-free-bug-in-emac_remove-.patch new file mode 100644 index 00000000000..25d10c585c4 --- /dev/null +++ b/queue-6.1/net-qcom-emac-fix-use-after-free-bug-in-emac_remove-.patch @@ -0,0 +1,63 @@ +From e0f2f5f2300f68111f363f69c3efadf8f78565fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 16:05:26 +0800 +Subject: net: qcom/emac: Fix use after free bug in emac_remove due to race + condition + +From: Zheng Wang + +[ Upstream commit 6b6bc5b8bd2d4ca9e1efa9ae0f98a0b0687ace75 ] + +In emac_probe, &adpt->work_thread is bound with +emac_work_thread. Then it will be started by timeout +handler emac_tx_timeout or a IRQ handler emac_isr. + +If we remove the driver which will call emac_remove + to make cleanup, there may be a unfinished work. + +The possible sequence is as follows: + +Fix it by finishing the work before cleanup in the emac_remove +and disable timeout response. + +CPU0 CPU1 + + |emac_work_thread +emac_remove | +free_netdev | +kfree(netdev); | + |emac_reinit_locked + |emac_mac_down + |//use netdev +Fixes: b9b17debc69d ("net: emac: emac gigabit ethernet controller driver") +Signed-off-by: Zheng Wang + +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qualcomm/emac/emac.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c +index 3115b2c128980..eaa50050aa0b7 100644 +--- a/drivers/net/ethernet/qualcomm/emac/emac.c ++++ b/drivers/net/ethernet/qualcomm/emac/emac.c +@@ -724,9 +724,15 @@ static int emac_remove(struct platform_device *pdev) + struct net_device *netdev = dev_get_drvdata(&pdev->dev); + struct emac_adapter *adpt = netdev_priv(netdev); + ++ netif_carrier_off(netdev); ++ netif_tx_disable(netdev); ++ + unregister_netdev(netdev); + netif_napi_del(&adpt->rx_q.napi); + ++ free_irq(adpt->irq.irq, &adpt->irq); ++ cancel_work_sync(&adpt->work_thread); ++ + emac_clks_teardown(adpt); + + put_device(&adpt->phydev->mdio.dev); +-- +2.39.2 + diff --git a/queue-6.1/net-sonic-use-dma_mapping_error-for-error-check.patch b/queue-6.1/net-sonic-use-dma_mapping_error-for-error-check.patch new file mode 100644 index 00000000000..8bec885b2fa --- /dev/null +++ b/queue-6.1/net-sonic-use-dma_mapping_error-for-error-check.patch @@ -0,0 +1,49 @@ +From 62941bff24f3c295c27b4501e6b014917b530b54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 14:45:43 +1100 +Subject: net/sonic: use dma_mapping_error() for error check + +From: Zhang Changzhong + +[ Upstream commit 4107b8746d93ace135b8c4da4f19bbae81db785f ] + +The DMA address returned by dma_map_single() should be checked with +dma_mapping_error(). Fix it accordingly. + +Fixes: efcce839360f ("[PATCH] macsonic/jazzsonic network drivers update") +Signed-off-by: Zhang Changzhong +Tested-by: Stan Johnson +Signed-off-by: Finn Thain +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/6645a4b5c1e364312103f48b7b36783b94e197a2.1679370343.git.fthain@linux-m68k.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/natsemi/sonic.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c +index d17d1b4f2585f..825356ee3492e 100644 +--- a/drivers/net/ethernet/natsemi/sonic.c ++++ b/drivers/net/ethernet/natsemi/sonic.c +@@ -292,7 +292,7 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev) + */ + + laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE); +- if (!laddr) { ++ if (dma_mapping_error(lp->device, laddr)) { + pr_err_ratelimited("%s: failed to map tx DMA buffer.\n", dev->name); + dev_kfree_skb_any(skb); + return NETDEV_TX_OK; +@@ -509,7 +509,7 @@ static bool sonic_alloc_rb(struct net_device *dev, struct sonic_local *lp, + + *new_addr = dma_map_single(lp->device, skb_put(*new_skb, SONIC_RBSIZE), + SONIC_RBSIZE, DMA_FROM_DEVICE); +- if (!*new_addr) { ++ if (dma_mapping_error(lp->device, *new_addr)) { + dev_kfree_skb(*new_skb); + *new_skb = NULL; + return false; +-- +2.39.2 + diff --git a/queue-6.1/net-stmmac-fix-for-mismatched-host-device-dma-addres.patch b/queue-6.1/net-stmmac-fix-for-mismatched-host-device-dma-addres.patch new file mode 100644 index 00000000000..95178e00f73 --- /dev/null +++ b/queue-6.1/net-stmmac-fix-for-mismatched-host-device-dma-addres.patch @@ -0,0 +1,194 @@ +From ef00da2fc6ba27fe35ef4f8fd4ab816fe434c29c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 09:08:17 +0100 +Subject: net: stmmac: Fix for mismatched host/device DMA address width + +From: Jochen Henneberg + +[ Upstream commit 070246e4674b125860d311c18ce2623e73e2bd51 ] + +Currently DMA address width is either read from a RO device register +or force set from the platform data. This breaks DMA when the host DMA +address width is <=32it but the device is >32bit. + +Right now the driver may decide to use a 2nd DMA descriptor for +another buffer (happens in case of TSO xmit) assuming that 32bit +addressing is used due to platform configuration but the device will +still use both descriptor addresses as one address. + +This can be observed with the Intel EHL platform driver that sets +32bit for addr64 but the MAC reports 40bit. The TX queue gets stuck in +case of TCP with iptables NAT configuration on TSO packets. + +The logic should be like this: Whatever we do on the host side (memory +allocation GFP flags) should happen with the host DMA width, whenever +we decide how to set addresses on the device registers we must use the +device DMA address width. + +This patch renames the platform address width field from addr64 (term +used in device datasheet) to host_addr and uses this value exclusively +for host side operations while all chip operations consider the device +DMA width as read from the device register. + +Fixes: 7cfc4486e7ea ("stmmac: intel: Configure EHL PSE0 GbE and PSE1 GbE to 32 bits DMA addressing") +Signed-off-by: Jochen Henneberg +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/common.h | 1 + + .../net/ethernet/stmicro/stmmac/dwmac-imx.c | 2 +- + .../net/ethernet/stmicro/stmmac/dwmac-intel.c | 4 +-- + .../ethernet/stmicro/stmmac/dwmac-mediatek.c | 2 +- + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 30 ++++++++++--------- + include/linux/stmmac.h | 2 +- + 6 files changed, 22 insertions(+), 19 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h +index 6b5d96bced475..ec9c130276d89 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/common.h ++++ b/drivers/net/ethernet/stmicro/stmmac/common.h +@@ -418,6 +418,7 @@ struct dma_features { + unsigned int frpbs; + unsigned int frpes; + unsigned int addr64; ++ unsigned int host_dma_width; + unsigned int rssen; + unsigned int vlhash; + unsigned int sphen; +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-imx.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-imx.c +index bd52fb7cf4860..0d6a84199fd8a 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-imx.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-imx.c +@@ -251,7 +251,7 @@ static int imx_dwmac_probe(struct platform_device *pdev) + goto err_parse_dt; + } + +- plat_dat->addr64 = dwmac->ops->addr_width; ++ plat_dat->host_dma_width = dwmac->ops->addr_width; + plat_dat->init = imx_dwmac_init; + plat_dat->exit = imx_dwmac_exit; + plat_dat->clks_config = imx_dwmac_clks_config; +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c +index 7deb1f817dacc..13aa919633b47 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c +@@ -684,7 +684,7 @@ static int ehl_pse0_common_data(struct pci_dev *pdev, + + intel_priv->is_pse = true; + plat->bus_id = 2; +- plat->addr64 = 32; ++ plat->host_dma_width = 32; + + plat->clk_ptp_rate = 200000000; + +@@ -725,7 +725,7 @@ static int ehl_pse1_common_data(struct pci_dev *pdev, + + intel_priv->is_pse = true; + plat->bus_id = 3; +- plat->addr64 = 32; ++ plat->host_dma_width = 32; + + plat->clk_ptp_rate = 200000000; + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c +index 2f7d8e4561d92..9ae31e3dc8218 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c +@@ -591,7 +591,7 @@ static int mediatek_dwmac_common_data(struct platform_device *pdev, + plat->use_phy_wol = priv_plat->mac_wol ? 0 : 1; + plat->riwt_off = 1; + plat->maxmtu = ETH_DATA_LEN; +- plat->addr64 = priv_plat->variant->dma_bit_mask; ++ plat->host_dma_width = priv_plat->variant->dma_bit_mask; + plat->bsp_priv = priv_plat; + plat->init = mediatek_dwmac_init; + plat->clks_config = mediatek_dwmac_clks_config; +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 3c1d4b27668fe..93321437f0933 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -1429,7 +1429,7 @@ static int stmmac_init_rx_buffers(struct stmmac_priv *priv, + struct stmmac_rx_buffer *buf = &rx_q->buf_pool[i]; + gfp_t gfp = (GFP_ATOMIC | __GFP_NOWARN); + +- if (priv->dma_cap.addr64 <= 32) ++ if (priv->dma_cap.host_dma_width <= 32) + gfp |= GFP_DMA32; + + if (!buf->page) { +@@ -4585,7 +4585,7 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv, u32 queue) + unsigned int entry = rx_q->dirty_rx; + gfp_t gfp = (GFP_ATOMIC | __GFP_NOWARN); + +- if (priv->dma_cap.addr64 <= 32) ++ if (priv->dma_cap.host_dma_width <= 32) + gfp |= GFP_DMA32; + + while (dirty-- > 0) { +@@ -6201,7 +6201,7 @@ static int stmmac_dma_cap_show(struct seq_file *seq, void *v) + seq_printf(seq, "\tFlexible RX Parser: %s\n", + priv->dma_cap.frpsel ? "Y" : "N"); + seq_printf(seq, "\tEnhanced Addressing: %d\n", +- priv->dma_cap.addr64); ++ priv->dma_cap.host_dma_width); + seq_printf(seq, "\tReceive Side Scaling: %s\n", + priv->dma_cap.rssen ? "Y" : "N"); + seq_printf(seq, "\tVLAN Hash Filtering: %s\n", +@@ -7171,20 +7171,22 @@ int stmmac_dvr_probe(struct device *device, + dev_info(priv->device, "SPH feature enabled\n"); + } + +- /* The current IP register MAC_HW_Feature1[ADDR64] only define +- * 32/40/64 bit width, but some SOC support others like i.MX8MP +- * support 34 bits but it map to 40 bits width in MAC_HW_Feature1[ADDR64]. +- * So overwrite dma_cap.addr64 according to HW real design. ++ /* Ideally our host DMA address width is the same as for the ++ * device. However, it may differ and then we have to use our ++ * host DMA width for allocation and the device DMA width for ++ * register handling. + */ +- if (priv->plat->addr64) +- priv->dma_cap.addr64 = priv->plat->addr64; ++ if (priv->plat->host_dma_width) ++ priv->dma_cap.host_dma_width = priv->plat->host_dma_width; ++ else ++ priv->dma_cap.host_dma_width = priv->dma_cap.addr64; + +- if (priv->dma_cap.addr64) { ++ if (priv->dma_cap.host_dma_width) { + ret = dma_set_mask_and_coherent(device, +- DMA_BIT_MASK(priv->dma_cap.addr64)); ++ DMA_BIT_MASK(priv->dma_cap.host_dma_width)); + if (!ret) { +- dev_info(priv->device, "Using %d bits DMA width\n", +- priv->dma_cap.addr64); ++ dev_info(priv->device, "Using %d/%d bits DMA host/device width\n", ++ priv->dma_cap.host_dma_width, priv->dma_cap.addr64); + + /* + * If more than 32 bits can be addressed, make sure to +@@ -7199,7 +7201,7 @@ int stmmac_dvr_probe(struct device *device, + goto error_hw_init; + } + +- priv->dma_cap.addr64 = 32; ++ priv->dma_cap.host_dma_width = 32; + } + } + +diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h +index 313edd19bf545..d82ff9fa1a6e8 100644 +--- a/include/linux/stmmac.h ++++ b/include/linux/stmmac.h +@@ -215,7 +215,7 @@ struct plat_stmmacenet_data { + int unicast_filter_entries; + int tx_fifo_size; + int rx_fifo_size; +- u32 addr64; ++ u32 host_dma_width; + u32 rx_queues_to_use; + u32 tx_queues_to_use; + u8 rx_sched_algorithm; +-- +2.39.2 + diff --git a/queue-6.1/net-usb-lan78xx-limit-packet-length-to-skb-len.patch b/queue-6.1/net-usb-lan78xx-limit-packet-length-to-skb-len.patch new file mode 100644 index 00000000000..fe77e366378 --- /dev/null +++ b/queue-6.1/net-usb-lan78xx-limit-packet-length-to-skb-len.patch @@ -0,0 +1,62 @@ +From a541cfdc2f2399aa15fbf157f9f304678ff04946 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 10:25:52 +0100 +Subject: net: usb: lan78xx: Limit packet length to skb->len + +From: Szymon Heidrich + +[ Upstream commit 7f247f5a2c18b3f21206cdd51193df4f38e1b9f5 ] + +Packet length retrieved from descriptor may be larger than +the actual socket buffer length. In such case the cloned +skb passed up the network stack will leak kernel memory contents. + +Additionally prevent integer underflow when size is less than +ETH_FCS_LEN. + +Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") +Signed-off-by: Szymon Heidrich +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 068488890d57b..c458c030fadf6 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -3579,13 +3579,29 @@ static int lan78xx_rx(struct lan78xx_net *dev, struct sk_buff *skb, + size = (rx_cmd_a & RX_CMD_A_LEN_MASK_); + align_count = (4 - ((size + RXW_PADDING) % 4)) % 4; + ++ if (unlikely(size > skb->len)) { ++ netif_dbg(dev, rx_err, dev->net, ++ "size err rx_cmd_a=0x%08x\n", ++ rx_cmd_a); ++ return 0; ++ } ++ + if (unlikely(rx_cmd_a & RX_CMD_A_RED_)) { + netif_dbg(dev, rx_err, dev->net, + "Error rx_cmd_a=0x%08x", rx_cmd_a); + } else { +- u32 frame_len = size - ETH_FCS_LEN; ++ u32 frame_len; + struct sk_buff *skb2; + ++ if (unlikely(size < ETH_FCS_LEN)) { ++ netif_dbg(dev, rx_err, dev->net, ++ "size err rx_cmd_a=0x%08x\n", ++ rx_cmd_a); ++ return 0; ++ } ++ ++ frame_len = size - ETH_FCS_LEN; ++ + skb2 = napi_alloc_skb(&dev->napi, frame_len); + if (!skb2) + return 0; +-- +2.39.2 + diff --git a/queue-6.1/net-usb-smsc95xx-limit-packet-length-to-skb-len.patch b/queue-6.1/net-usb-smsc95xx-limit-packet-length-to-skb-len.patch new file mode 100644 index 00000000000..2435d039d6b --- /dev/null +++ b/queue-6.1/net-usb-smsc95xx-limit-packet-length-to-skb-len.patch @@ -0,0 +1,43 @@ +From 89b97ed077d65c645d0e41b049f3516f6bc8b573 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 11:19:54 +0100 +Subject: net: usb: smsc95xx: Limit packet length to skb->len + +From: Szymon Heidrich + +[ Upstream commit ff821092cf02a70c2bccd2d19269f01e29aa52cf ] + +Packet length retrieved from descriptor may be larger than +the actual socket buffer length. In such case the cloned +skb passed up the network stack will leak kernel memory contents. + +Fixes: 2f7ca802bdae ("net: Add SMSC LAN9500 USB2.0 10/100 ethernet adapter driver") +Signed-off-by: Szymon Heidrich +Reviewed-by: Jakub Kicinski +Link: https://lore.kernel.org/r/20230316101954.75836-1-szymon.heidrich@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/smsc95xx.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index 32d2c60d334dc..563ecd27b93ea 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -1833,6 +1833,12 @@ static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + size = (u16)((header & RX_STS_FL_) >> 16); + align_count = (4 - ((size + NET_IP_ALIGN) % 4)) % 4; + ++ if (unlikely(size > skb->len)) { ++ netif_dbg(dev, rx_err, dev->net, ++ "size err header=0x%08x\n", header); ++ return 0; ++ } ++ + if (unlikely(header & RX_STS_ES_)) { + netif_dbg(dev, rx_err, dev->net, + "Error header=0x%08x\n", header); +-- +2.39.2 + diff --git a/queue-6.1/nfs-fix-proc-pid-io-read_bytes-for-buffered-reads.patch b/queue-6.1/nfs-fix-proc-pid-io-read_bytes-for-buffered-reads.patch new file mode 100644 index 00000000000..8b086f9d193 --- /dev/null +++ b/queue-6.1/nfs-fix-proc-pid-io-read_bytes-for-buffered-reads.patch @@ -0,0 +1,58 @@ +From 5d01b67e4f2dc45e7bedb38efe8afa2e930ee842 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Mar 2023 13:58:52 -0500 +Subject: NFS: Fix /proc/PID/io read_bytes for buffered reads + +From: Dave Wysochanski + +[ Upstream commit 9c88ea00fef03031ce6554531e89be82f6a42835 ] + +Prior to commit 8786fde8421c ("Convert NFS from readpages to +readahead"), nfs_readpages() used the old mm interface read_cache_pages() +which called task_io_account_read() for each NFS page read. After +this commit, nfs_readpages() is converted to nfs_readahead(), which +now uses the new mm interface readahead_page(). The new interface +requires callers to call task_io_account_read() themselves. +In addition, to nfs_readahead() task_io_account_read() should also +be called from nfs_read_folio(). + +Fixes: 8786fde8421c ("Convert NFS from readpages to readahead") +Link: https://lore.kernel.org/linux-nfs/CAPt2mGNEYUk5u8V4abe=5MM5msZqmvzCVrtCP4Qw1n=gCHCnww@mail.gmail.com/ +Signed-off-by: Dave Wysochanski +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/read.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/nfs/read.c b/fs/nfs/read.c +index 8ae2c8d1219d8..cd970ce62786b 100644 +--- a/fs/nfs/read.c ++++ b/fs/nfs/read.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -338,6 +339,7 @@ int nfs_read_folio(struct file *file, struct folio *folio) + + trace_nfs_aop_readpage(inode, page); + nfs_inc_stats(inode, NFSIOS_VFSREADPAGE); ++ task_io_account_read(folio_size(folio)); + + /* + * Try to flush any pending writes to the file.. +@@ -400,6 +402,7 @@ void nfs_readahead(struct readahead_control *ractl) + + trace_nfs_aop_readahead(inode, readahead_pos(ractl), nr_pages); + nfs_inc_stats(inode, NFSIOS_VFSREADPAGES); ++ task_io_account_read(readahead_length(ractl)); + + ret = -ESTALE; + if (NFS_STALE(inode)) +-- +2.39.2 + diff --git a/queue-6.1/nfsd-don-t-replace-page-in-rq_pages-if-it-s-a-contin.patch b/queue-6.1/nfsd-don-t-replace-page-in-rq_pages-if-it-s-a-contin.patch new file mode 100644 index 00000000000..738be1012e7 --- /dev/null +++ b/queue-6.1/nfsd-don-t-replace-page-in-rq_pages-if-it-s-a-contin.patch @@ -0,0 +1,65 @@ +From 3dc5b70b658bce992dc64cab9ba3aa893e6c08fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 13:13:08 -0400 +Subject: nfsd: don't replace page in rq_pages if it's a continuation of last + page + +From: Jeff Layton + +[ Upstream commit 27c934dd8832dd40fd34776f916dc201e18b319b ] + +The splice read calls nfsd_splice_actor to put the pages containing file +data into the svc_rqst->rq_pages array. It's possible however to get a +splice result that only has a partial page at the end, if (e.g.) the +filesystem hands back a short read that doesn't cover the whole page. + +nfsd_splice_actor will plop the partial page into its rq_pages array and +return. Then later, when nfsd_splice_actor is called again, the +remainder of the page may end up being filled out. At this point, +nfsd_splice_actor will put the page into the array _again_ corrupting +the reply. If this is done enough times, rq_next_page will overrun the +array and corrupt the trailing fields -- the rq_respages and +rq_next_page pointers themselves. + +If we've already added the page to the array in the last pass, don't add +it to the array a second time when dealing with a splice continuation. +This was originally handled properly in nfsd_splice_actor, but commit +91e23b1c3982 ("NFSD: Clean up nfsd_splice_actor()") removed the check +for it. + +Fixes: 91e23b1c3982 ("NFSD: Clean up nfsd_splice_actor()") +Cc: Al Viro +Reported-by: Dario Lesca +Tested-by: David Critch +Link: https://bugzilla.redhat.com/show_bug.cgi?id=2150630 +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/vfs.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c +index 59f9a8cee012a..dc3ba13546dd6 100644 +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -874,8 +874,15 @@ nfsd_splice_actor(struct pipe_inode_info *pipe, struct pipe_buffer *buf, + struct page *last_page; + + last_page = page + (offset + sd->len - 1) / PAGE_SIZE; +- for (page += offset / PAGE_SIZE; page <= last_page; page++) ++ for (page += offset / PAGE_SIZE; page <= last_page; page++) { ++ /* ++ * Skip page replacement when extending the contents ++ * of the current page. ++ */ ++ if (page == *(rqstp->rq_next_page - 1)) ++ continue; + svc_rqst_replace_page(rqstp, page); ++ } + if (rqstp->rq_res.page_len == 0) // first call + rqstp->rq_res.page_base = offset % PAGE_SIZE; + rqstp->rq_res.page_len += sd->len; +-- +2.39.2 + diff --git a/queue-6.1/nvme-tcp-fix-nvme_tcp_term_pdu-to-match-spec.patch b/queue-6.1/nvme-tcp-fix-nvme_tcp_term_pdu-to-match-spec.patch new file mode 100644 index 00000000000..6e2a7cbd2e0 --- /dev/null +++ b/queue-6.1/nvme-tcp-fix-nvme_tcp_term_pdu-to-match-spec.patch @@ -0,0 +1,44 @@ +From 20c51d6a475286e4c56f2e090ac757f5446226c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 09:57:36 -0600 +Subject: nvme-tcp: fix nvme_tcp_term_pdu to match spec + +From: Caleb Sander + +[ Upstream commit aa01c67de5926fdb276793180564f172c55fb0d7 ] + +The FEI field of C2HTermReq/H2CTermReq is 4 bytes but not 4-byte-aligned +in the NVMe/TCP specification (it is located at offset 10 in the PDU). +Split it into two 16-bit integers in struct nvme_tcp_term_pdu +so no padding is inserted. There should also be 10 reserved bytes after. +There are currently no users of this type. + +Fixes: fc221d05447aa6db ("nvme-tcp: Add protocol header") +Reported-by: Geert Uytterhoeven +Signed-off-by: Caleb Sander +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + include/linux/nvme-tcp.h | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/include/linux/nvme-tcp.h b/include/linux/nvme-tcp.h +index 75470159a194d..57ebe1267f7fb 100644 +--- a/include/linux/nvme-tcp.h ++++ b/include/linux/nvme-tcp.h +@@ -115,8 +115,9 @@ struct nvme_tcp_icresp_pdu { + struct nvme_tcp_term_pdu { + struct nvme_tcp_hdr hdr; + __le16 fes; +- __le32 fei; +- __u8 rsvd[8]; ++ __le16 feil; ++ __le16 feiu; ++ __u8 rsvd[10]; + }; + + /** +-- +2.39.2 + diff --git a/queue-6.1/octeontx2-vf-add-missing-free-for-alloc_percpu.patch b/queue-6.1/octeontx2-vf-add-missing-free-for-alloc_percpu.patch new file mode 100644 index 00000000000..9706cf31e55 --- /dev/null +++ b/queue-6.1/octeontx2-vf-add-missing-free-for-alloc_percpu.patch @@ -0,0 +1,47 @@ +From 861b839c12423ef88625a162ea2ec96d93d8e3ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 14:43:37 +0800 +Subject: octeontx2-vf: Add missing free for alloc_percpu + +From: Jiasheng Jiang + +[ Upstream commit f038f3917baf04835ba2b7bcf2a04ac93fbf8a9c ] + +Add the free_percpu for the allocated "vf->hw.lmt_info" in order to avoid +memory leak, same as the "pf->hw.lmt_info" in +`drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c`. + +Fixes: 5c0512072f65 ("octeontx2-pf: cn10k: Use runtime allocated LMTLINE region") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Michal Swiatkowski +Acked-by: Geethasowjanya Akula +Link: https://lore.kernel.org/r/20230317064337.18198-1-jiasheng@iscas.ac.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +index 7f8ffbf79cf74..ab126f8706c74 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +@@ -709,6 +709,7 @@ static int otx2vf_probe(struct pci_dev *pdev, const struct pci_device_id *id) + err_ptp_destroy: + otx2_ptp_destroy(vf); + err_detach_rsrc: ++ free_percpu(vf->hw.lmt_info); + if (test_bit(CN10K_LMTST, &vf->hw.cap_flag)) + qmem_free(vf->dev, vf->dync_lmt); + otx2_detach_resources(&vf->mbox); +@@ -762,6 +763,7 @@ static void otx2vf_remove(struct pci_dev *pdev) + otx2_shutdown_tc(vf); + otx2vf_disable_mbox_intr(vf); + otx2_detach_resources(&vf->mbox); ++ free_percpu(vf->hw.lmt_info); + if (test_bit(CN10K_LMTST, &vf->hw.cap_flag)) + qmem_free(vf->dev, vf->dync_lmt); + otx2vf_vfaf_mbox_destroy(vf); +-- +2.39.2 + diff --git a/queue-6.1/platform-chrome-cros_ec_chardev-fix-kernel-data-leak.patch b/queue-6.1/platform-chrome-cros_ec_chardev-fix-kernel-data-leak.patch new file mode 100644 index 00000000000..f487360011b --- /dev/null +++ b/queue-6.1/platform-chrome-cros_ec_chardev-fix-kernel-data-leak.patch @@ -0,0 +1,41 @@ +From 23642b9993a21c6348eb2656fda8fe326d2ba6f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 09:06:58 +0800 +Subject: platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl + +From: Tzung-Bi Shih + +[ Upstream commit b20cf3f89c56b5f6a38b7f76a8128bf9f291bbd3 ] + +It is possible to peep kernel page's data by providing larger `insize` +in struct cros_ec_command[1] when invoking EC host commands. + +Fix it by using zeroed memory. + +[1]: https://elixir.bootlin.com/linux/v6.2/source/include/linux/platform_data/cros_ec_proto.h#L74 + +Fixes: eda2e30c6684 ("mfd / platform: cros_ec: Miscellaneous character device to talk with the EC") +Signed-off-by: Tzung-Bi Shih +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20230324010658.1082361-1-tzungbi@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/platform/chrome/cros_ec_chardev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/chrome/cros_ec_chardev.c b/drivers/platform/chrome/cros_ec_chardev.c +index 0de7c255254e0..d6de5a2941282 100644 +--- a/drivers/platform/chrome/cros_ec_chardev.c ++++ b/drivers/platform/chrome/cros_ec_chardev.c +@@ -284,7 +284,7 @@ static long cros_ec_chardev_ioctl_xcmd(struct cros_ec_dev *ec, void __user *arg) + u_cmd.insize > EC_MAX_MSG_BYTES) + return -EINVAL; + +- s_cmd = kmalloc(sizeof(*s_cmd) + max(u_cmd.outsize, u_cmd.insize), ++ s_cmd = kzalloc(sizeof(*s_cmd) + max(u_cmd.outsize, u_cmd.insize), + GFP_KERNEL); + if (!s_cmd) + return -ENOMEM; +-- +2.39.2 + diff --git a/queue-6.1/power-supply-bq24190-fix-use-after-free-bug-in-bq241.patch b/queue-6.1/power-supply-bq24190-fix-use-after-free-bug-in-bq241.patch new file mode 100644 index 00000000000..5520ad590d6 --- /dev/null +++ b/queue-6.1/power-supply-bq24190-fix-use-after-free-bug-in-bq241.patch @@ -0,0 +1,56 @@ +From bd5bde8de14b059ca509d81657aa72c8a5906e7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 01:47:28 +0800 +Subject: power: supply: bq24190: Fix use after free bug in bq24190_remove due + to race condition + +From: Zheng Wang + +[ Upstream commit 47c29d69212911f50bdcdd0564b5999a559010d4 ] + +In bq24190_probe, &bdi->input_current_limit_work is bound +with bq24190_input_current_limit_work. When external power +changed, it will call bq24190_charger_external_power_changed + to start the work. + +If we remove the module which will call bq24190_remove to make +cleanup, there may be a unfinished work. The possible +sequence is as follows: + +CPU0 CPUc1 + + |bq24190_input_current_limit_work +bq24190_remove | +power_supply_unregister | +device_unregister | +power_supply_dev_release| +kfree(psy) | + | + | power_supply_get_property_from_supplier + | //use + +Fix it by finishing the work before cleanup in the bq24190_remove + +Fixes: 97774672573a ("power_supply: Initialize changed_work before calling device_add") +Signed-off-by: Zheng Wang +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/bq24190_charger.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c +index 2274679c5ddd2..d7400b56820d6 100644 +--- a/drivers/power/supply/bq24190_charger.c ++++ b/drivers/power/supply/bq24190_charger.c +@@ -1906,6 +1906,7 @@ static void bq24190_remove(struct i2c_client *client) + struct bq24190_dev_info *bdi = i2c_get_clientdata(client); + int error; + ++ cancel_delayed_work_sync(&bdi->input_current_limit_work); + error = pm_runtime_resume_and_get(bdi->dev); + if (error < 0) + dev_warn(bdi->dev, "pm_runtime_get failed: %i\n", error); +-- +2.39.2 + diff --git a/queue-6.1/power-supply-da9150-fix-use-after-free-bug-in-da9150.patch b/queue-6.1/power-supply-da9150-fix-use-after-free-bug-in-da9150.patch new file mode 100644 index 00000000000..270cb23bac8 --- /dev/null +++ b/queue-6.1/power-supply-da9150-fix-use-after-free-bug-in-da9150.patch @@ -0,0 +1,55 @@ +From cf417861fcd5a87a54cbc6681d9429aa80ddce69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Mar 2023 01:46:50 +0800 +Subject: power: supply: da9150: Fix use after free bug in + da9150_charger_remove due to race condition + +From: Zheng Wang + +[ Upstream commit 06615d11cc78162dfd5116efb71f29eb29502d37 ] + +In da9150_charger_probe, &charger->otg_work is bound with +da9150_charger_otg_work. da9150_charger_otg_ncb may be +called to start the work. + +If we remove the module which will call da9150_charger_remove +to make cleanup, there may be a unfinished work. The possible +sequence is as follows: + +Fix it by canceling the work before cleanup in the da9150_charger_remove + +CPU0 CPUc1 + + |da9150_charger_otg_work +da9150_charger_remove | +power_supply_unregister | +device_unregister | +power_supply_dev_release| +kfree(psy) | + | + | power_supply_changed(charger->usb); + | //use + +Fixes: c1a281e34dae ("power: Add support for DA9150 Charger") +Signed-off-by: Zheng Wang +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/da9150-charger.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/power/supply/da9150-charger.c b/drivers/power/supply/da9150-charger.c +index f9314cc0cd75f..6b987da586556 100644 +--- a/drivers/power/supply/da9150-charger.c ++++ b/drivers/power/supply/da9150-charger.c +@@ -662,6 +662,7 @@ static int da9150_charger_remove(struct platform_device *pdev) + + if (!IS_ERR_OR_NULL(charger->usb_phy)) + usb_unregister_notifier(charger->usb_phy, &charger->otg_nb); ++ cancel_work_sync(&charger->otg_work); + + power_supply_unregister(charger->battery); + power_supply_unregister(charger->usb); +-- +2.39.2 + diff --git a/queue-6.1/qed-qed_sriov-guard-against-null-derefs-from-qed_iov.patch b/queue-6.1/qed-qed_sriov-guard-against-null-derefs-from-qed_iov.patch new file mode 100644 index 00000000000..ea163d4701d --- /dev/null +++ b/queue-6.1/qed-qed_sriov-guard-against-null-derefs-from-qed_iov.patch @@ -0,0 +1,51 @@ +From ed83c4c80312e907b34ee413bfa5f9223cb9e7ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 13:29:21 +0300 +Subject: qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info + +From: Daniil Tatianin + +[ Upstream commit 25143b6a01d0cc5319edd3de22ffa2578b045550 ] + +We have to make sure that the info returned by the helper is valid +before using it. + +Found by Linux Verification Center (linuxtesting.org) with the SVACE +static analysis tool. + +Fixes: f990c82c385b ("qed*: Add support for ndo_set_vf_trust") +Fixes: 733def6a04bf ("qed*: IOV link control") +Signed-off-by: Daniil Tatianin +Reviewed-by: Michal Swiatkowski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_sriov.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +index 0848b5529d48a..911509c2b17d5 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +@@ -4404,6 +4404,9 @@ qed_iov_configure_min_tx_rate(struct qed_dev *cdev, int vfid, u32 rate) + } + + vf = qed_iov_get_vf_info(QED_LEADING_HWFN(cdev), (u16)vfid, true); ++ if (!vf) ++ return -EINVAL; ++ + vport_id = vf->vport_id; + + return qed_configure_vport_wfq(cdev, vport_id, rate); +@@ -5152,7 +5155,7 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn) + + /* Validate that the VF has a configured vport */ + vf = qed_iov_get_vf_info(hwfn, i, true); +- if (!vf->vport_instance) ++ if (!vf || !vf->vport_instance) + continue; + + memset(¶ms, 0, sizeof(params)); +-- +2.39.2 + diff --git a/queue-6.1/scsi-scsi_dh_alua-fix-memleak-for-qdata-in-alua_acti.patch b/queue-6.1/scsi-scsi_dh_alua-fix-memleak-for-qdata-in-alua_acti.patch new file mode 100644 index 00000000000..fddabbb0643 --- /dev/null +++ b/queue-6.1/scsi-scsi_dh_alua-fix-memleak-for-qdata-in-alua_acti.patch @@ -0,0 +1,61 @@ +From 1cb87f8c87cdeac8b5ca466d0a496df7ed57d4da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 14:21:54 +0800 +Subject: scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() + +From: Yu Kuai + +[ Upstream commit a13faca032acbf2699293587085293bdfaafc8ae ] + +If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not +freed, which will cause following memleak: + +unreferenced object 0xffff88810b2c6980 (size 32): + comm "kworker/u16:2", pid 635322, jiffies 4355801099 (age 1216426.076s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff @9$............. + backtrace: + [<0000000098f3a26d>] alua_activate+0xb0/0x320 + [<000000003b529641>] scsi_dh_activate+0xb2/0x140 + [<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath] + [<000000007adc9ace>] process_one_work+0x3c5/0x730 + [<00000000c457a985>] worker_thread+0x93/0x650 + [<00000000cb80e628>] kthread+0x1ba/0x210 + [<00000000a1e61077>] ret_from_fork+0x22/0x30 + +Fix the problem by freeing 'qdata' in error path. + +Fixes: 625fe857e4fa ("scsi: scsi_dh_alua: Check scsi_device_get() return value") +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20230315062154.668812-1-yukuai1@huaweicloud.com +Reviewed-by: Benjamin Block +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/device_handler/scsi_dh_alua.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c +index 610a51538f034..0781f991e7845 100644 +--- a/drivers/scsi/device_handler/scsi_dh_alua.c ++++ b/drivers/scsi/device_handler/scsi_dh_alua.c +@@ -1117,10 +1117,12 @@ static int alua_activate(struct scsi_device *sdev, + rcu_read_unlock(); + mutex_unlock(&h->init_mutex); + +- if (alua_rtpg_queue(pg, sdev, qdata, true)) ++ if (alua_rtpg_queue(pg, sdev, qdata, true)) { + fn = NULL; +- else ++ } else { ++ kfree(qdata); + err = SCSI_DH_DEV_OFFLINED; ++ } + kref_put(&pg->kref, release_port_group); + out: + if (fn) +-- +2.39.2 + diff --git a/queue-6.1/series b/queue-6.1/series index b4e7b682304..3ee5735f763 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -11,3 +11,87 @@ mptcp-refactor-passive-socket-initialization.patch mptcp-use-the-workqueue-to-destroy-unaccepted-socket.patch mptcp-fix-uaf-in-listener-shutdown.patch drm-amd-display-fix-dp-mst-sinks-removal-issue.patch +arm64-dts-qcom-sm8450-mark-ufs-controller-as-cache-c.patch +power-supply-bq24190-fix-use-after-free-bug-in-bq241.patch +power-supply-da9150-fix-use-after-free-bug-in-da9150.patch +arm64-dts-imx8dxl-evk-disable-hibernation-mode-of-ar.patch +arm64-dts-imx8dxl-evk-fix-eqos-phy-reset-gpio.patch +arm-dts-imx6sll-e70k02-fix-usbotg1-pinctrl.patch +arm-dts-imx6sll-e60k02-fix-usbotg1-pinctrl.patch +arm-dts-imx6sl-tolino-shine2hd-fix-usbotg1-pinctrl.patch +arm64-dts-imx8mn-specify-sound-dai-cells-for-sai-nod.patch +arm64-dts-imx93-add-missing-address-cells-and-size-c.patch +nfs-fix-proc-pid-io-read_bytes-for-buffered-reads.patch +xsk-add-missing-overflow-check-in-xdp_umem_reg.patch +iavf-fix-inverted-rx-hash-condition-leading-to-disab.patch +iavf-fix-non-tunneled-ipv6-udp-packet-type-and-hashi.patch +iavf-do-not-track-vlan-0-filters.patch +intel-igbvf-free-irq-on-the-error-path-in-igbvf_requ.patch +igbvf-regard-vf-reset-nack-as-success.patch +igc-fix-the-validation-logic-for-taprio-s-gate-list.patch +i2c-imx-lpi2c-check-only-for-enabled-interrupt-flags.patch +i2c-mxs-ensure-that-dma-buffers-are-safe-for-dma.patch +i2c-hisi-only-use-the-completion-interrupt-to-finish.patch +scsi-scsi_dh_alua-fix-memleak-for-qdata-in-alua_acti.patch +nfsd-don-t-replace-page-in-rq_pages-if-it-s-a-contin.patch +net-dsa-b53-mmap-fix-device-tree-support.patch +net-usb-smsc95xx-limit-packet-length-to-skb-len.patch +efi-libstub-smbios-use-length-member-instead-of-reco.patch +qed-qed_sriov-guard-against-null-derefs-from-qed_iov.patch +xirc2ps_cs-fix-use-after-free-bug-in-xirc2ps_detach.patch +net-phy-ensure-state-transitions-are-processed-from-.patch +net-mdio-fix-owner-field-for-mdio-buses-registered-u.patch +net-mdio-fix-owner-field-for-mdio-buses-registered-u.patch-21091 +net-stmmac-fix-for-mismatched-host-device-dma-addres.patch +thermal-drivers-mellanox-use-generic-thermal_zone_ge.patch +mlxsw-core_thermal-fix-fan-speed-in-maximum-cooling-.patch +drm-i915-print-return-value-on-error.patch +drm-i915-fbdev-lock-the-fbdev-obj-before-vma-pin.patch +drm-i915-guc-rename-guc-register-state-capture-node-.patch +drm-i915-guc-fix-missing-ecodes.patch +drm-i915-gt-perform-uc-late-init-after-probe-error-i.patch +net-qcom-emac-fix-use-after-free-bug-in-emac_remove-.patch +net-usb-lan78xx-limit-packet-length-to-skb-len.patch +net-ps3_gelic_net-fix-rx-sk_buff-length.patch +net-ps3_gelic_net-use-dma_mapping_error.patch +octeontx2-vf-add-missing-free-for-alloc_percpu.patch +bootconfig-fix-testcase-to-increase-max-node.patch +keys-do-not-cache-key-in-task-struct-if-key-is-reque.patch +ice-check-if-vf-exists-before-mode-check.patch +iavf-fix-hang-on-reboot-with-ice.patch +i40e-fix-flow-director-packet-filter-programming.patch +bpf-adjust-insufficient-default-bpf_jit_limit.patch +net-mlx5e-set-uplink-rep-as-netns_local.patch +net-mlx5e-block-entering-switchdev-mode-with-ns-inco.patch +net-mlx5-fix-steering-rules-cleanup.patch +net-mlx5e-overcome-slow-response-for-first-macsec-as.patch +net-mlx5-read-the-tc-mapping-of-all-priorities-on-et.patch +net-mlx5-e-switch-fix-an-oops-in-error-handling-code.patch +net-dsa-tag_brcm-legacy-fix-daisy-chained-switches.patch +atm-idt77252-fix-kmemleak-when-rmmod-idt77252.patch +erspan-do-not-use-skb_mac_header-in-ndo_start_xmit.patch +net-sonic-use-dma_mapping_error-for-error-check.patch +nvme-tcp-fix-nvme_tcp_term_pdu-to-match-spec.patch +mlxsw-spectrum_fid-fix-incorrect-local-port-type.patch +hvc-xen-prevent-concurrent-accesses-to-the-shared-ri.patch +ksmbd-add-low-bound-validation-to-fsctl_set_zero_dat.patch +ksmbd-add-low-bound-validation-to-fsctl_query_alloca.patch +ksmbd-fix-possible-refcount-leak-in-smb2_open.patch +bluetooth-hci_sync-resume-adv-with-no-rpa-when-activ.patch +bluetooth-hci_core-detect-if-an-acl-packet-is-in-fac.patch +bluetooth-btusb-remove-detection-of-iso-packets-over.patch +bluetooth-iso-fix-timestamped-hci-iso-data-packet-pa.patch +bluetooth-remove-power-on-check-from-mesh-feature.patch +gve-cache-link_speed-value-from-device.patch +net-asix-fix-modprobe-sysfs-cannot-create-duplicate-.patch +net-dsa-mt7530-move-enabling-disabling-core-clock-to.patch +net-dsa-mt7530-move-lowering-trgmii-driving-to-mt753.patch +net-dsa-mt7530-move-setting-ssc_delta-to-phy_interfa.patch +net-mdio-thunder-add-missing-fwnode_handle_put.patch +drm-amd-display-set-dcn32-caps.seamless_odm.patch +bluetooth-btqcomsmd-fix-command-timeout-after-settin.patch +bluetooth-l2cap-fix-responding-with-wrong-pdu-type.patch +bluetooth-btsdio-fix-use-after-free-bug-in-btsdio_re.patch +bluetooth-mgmt-fix-mgmt-add-advmon-with-rssi-command.patch +bluetooth-hci-fix-global-out-of-bounds.patch +platform-chrome-cros_ec_chardev-fix-kernel-data-leak.patch diff --git a/queue-6.1/thermal-drivers-mellanox-use-generic-thermal_zone_ge.patch b/queue-6.1/thermal-drivers-mellanox-use-generic-thermal_zone_ge.patch new file mode 100644 index 00000000000..31f1330ee0b --- /dev/null +++ b/queue-6.1/thermal-drivers-mellanox-use-generic-thermal_zone_ge.patch @@ -0,0 +1,384 @@ +From 3bdce0db491613956d42d3d4076a7b5cbc9554e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Oct 2022 09:32:51 +0200 +Subject: thermal/drivers/mellanox: Use generic thermal_zone_get_trip() + function + +From: Daniel Lezcano + +[ Upstream commit 44a29a4dab73411671e0b84817a5f07e291b1501 ] + +The thermal framework gives the possibility to register the trip +points with the thermal zone. When that is done, no get_trip_* ops are +needed and they can be removed. + +Convert ops content logic into generic trip points and register them with the +thermal zone. + +Signed-off-by: Daniel Lezcano +Signed-off-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20221014073253.3719911-2-daniel.lezcano@linaro.org +Stable-dep-of: 6d206b1ea9f4 ("mlxsw: core_thermal: Fix fan speed in maximum cooling state") +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlxsw/core_thermal.c | 209 ++++-------------- + 1 file changed, 48 insertions(+), 161 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c b/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c +index 987fe5c9d5a36..c5240d38c9dbd 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c +@@ -36,33 +36,39 @@ enum mlxsw_thermal_trips { + MLXSW_THERMAL_TEMP_TRIP_HOT, + }; + +-struct mlxsw_thermal_trip { +- int type; +- int temp; +- int hyst; ++struct mlxsw_cooling_states { + int min_state; + int max_state; + }; + +-static const struct mlxsw_thermal_trip default_thermal_trips[] = { ++static const struct thermal_trip default_thermal_trips[] = { + { /* In range - 0-40% PWM */ + .type = THERMAL_TRIP_ACTIVE, +- .temp = MLXSW_THERMAL_ASIC_TEMP_NORM, +- .hyst = MLXSW_THERMAL_HYSTERESIS_TEMP, +- .min_state = 0, +- .max_state = (4 * MLXSW_THERMAL_MAX_STATE) / 10, ++ .temperature = MLXSW_THERMAL_ASIC_TEMP_NORM, ++ .hysteresis = MLXSW_THERMAL_HYSTERESIS_TEMP, + }, + { + /* In range - 40-100% PWM */ + .type = THERMAL_TRIP_ACTIVE, +- .temp = MLXSW_THERMAL_ASIC_TEMP_HIGH, +- .hyst = MLXSW_THERMAL_HYSTERESIS_TEMP, +- .min_state = (4 * MLXSW_THERMAL_MAX_STATE) / 10, +- .max_state = MLXSW_THERMAL_MAX_STATE, ++ .temperature = MLXSW_THERMAL_ASIC_TEMP_HIGH, ++ .hysteresis = MLXSW_THERMAL_HYSTERESIS_TEMP, + }, + { /* Warning */ + .type = THERMAL_TRIP_HOT, +- .temp = MLXSW_THERMAL_ASIC_TEMP_HOT, ++ .temperature = MLXSW_THERMAL_ASIC_TEMP_HOT, ++ }, ++}; ++ ++static const struct mlxsw_cooling_states default_cooling_states[] = { ++ { ++ .min_state = 0, ++ .max_state = (4 * MLXSW_THERMAL_MAX_STATE) / 10, ++ }, ++ { ++ .min_state = (4 * MLXSW_THERMAL_MAX_STATE) / 10, ++ .max_state = MLXSW_THERMAL_MAX_STATE, ++ }, ++ { + .min_state = MLXSW_THERMAL_MAX_STATE, + .max_state = MLXSW_THERMAL_MAX_STATE, + }, +@@ -78,7 +84,8 @@ struct mlxsw_thermal; + struct mlxsw_thermal_module { + struct mlxsw_thermal *parent; + struct thermal_zone_device *tzdev; +- struct mlxsw_thermal_trip trips[MLXSW_THERMAL_NUM_TRIPS]; ++ struct thermal_trip trips[MLXSW_THERMAL_NUM_TRIPS]; ++ struct mlxsw_cooling_states cooling_states[MLXSW_THERMAL_NUM_TRIPS]; + int module; /* Module or gearbox number */ + u8 slot_index; + }; +@@ -99,7 +106,8 @@ struct mlxsw_thermal { + int polling_delay; + struct thermal_cooling_device *cdevs[MLXSW_MFCR_PWMS_MAX]; + u8 cooling_levels[MLXSW_THERMAL_MAX_STATE + 1]; +- struct mlxsw_thermal_trip trips[MLXSW_THERMAL_NUM_TRIPS]; ++ struct thermal_trip trips[MLXSW_THERMAL_NUM_TRIPS]; ++ struct mlxsw_cooling_states cooling_states[MLXSW_THERMAL_NUM_TRIPS]; + struct mlxsw_thermal_area line_cards[]; + }; + +@@ -136,9 +144,9 @@ static int mlxsw_get_cooling_device_idx(struct mlxsw_thermal *thermal, + static void + mlxsw_thermal_module_trips_reset(struct mlxsw_thermal_module *tz) + { +- tz->trips[MLXSW_THERMAL_TEMP_TRIP_NORM].temp = 0; +- tz->trips[MLXSW_THERMAL_TEMP_TRIP_HIGH].temp = 0; +- tz->trips[MLXSW_THERMAL_TEMP_TRIP_HOT].temp = 0; ++ tz->trips[MLXSW_THERMAL_TEMP_TRIP_NORM].temperature = 0; ++ tz->trips[MLXSW_THERMAL_TEMP_TRIP_HIGH].temperature = 0; ++ tz->trips[MLXSW_THERMAL_TEMP_TRIP_HOT].temperature = 0; + } + + static int +@@ -180,12 +188,12 @@ mlxsw_thermal_module_trips_update(struct device *dev, struct mlxsw_core *core, + * by subtracting double hysteresis value. + */ + if (crit_temp >= MLXSW_THERMAL_MODULE_TEMP_SHIFT) +- tz->trips[MLXSW_THERMAL_TEMP_TRIP_NORM].temp = crit_temp - ++ tz->trips[MLXSW_THERMAL_TEMP_TRIP_NORM].temperature = crit_temp - + MLXSW_THERMAL_MODULE_TEMP_SHIFT; + else +- tz->trips[MLXSW_THERMAL_TEMP_TRIP_NORM].temp = crit_temp; +- tz->trips[MLXSW_THERMAL_TEMP_TRIP_HIGH].temp = crit_temp; +- tz->trips[MLXSW_THERMAL_TEMP_TRIP_HOT].temp = emerg_temp; ++ tz->trips[MLXSW_THERMAL_TEMP_TRIP_NORM].temperature = crit_temp; ++ tz->trips[MLXSW_THERMAL_TEMP_TRIP_HIGH].temperature = crit_temp; ++ tz->trips[MLXSW_THERMAL_TEMP_TRIP_HOT].temperature = emerg_temp; + + return 0; + } +@@ -202,11 +210,11 @@ static int mlxsw_thermal_bind(struct thermal_zone_device *tzdev, + return 0; + + for (i = 0; i < MLXSW_THERMAL_NUM_TRIPS; i++) { +- const struct mlxsw_thermal_trip *trip = &thermal->trips[i]; ++ const struct mlxsw_cooling_states *state = &thermal->cooling_states[i]; + + err = thermal_zone_bind_cooling_device(tzdev, i, cdev, +- trip->max_state, +- trip->min_state, ++ state->max_state, ++ state->min_state, + THERMAL_WEIGHT_DEFAULT); + if (err < 0) { + dev_err(dev, "Failed to bind cooling device to trip %d\n", i); +@@ -260,61 +268,6 @@ static int mlxsw_thermal_get_temp(struct thermal_zone_device *tzdev, + return 0; + } + +-static int mlxsw_thermal_get_trip_type(struct thermal_zone_device *tzdev, +- int trip, +- enum thermal_trip_type *p_type) +-{ +- struct mlxsw_thermal *thermal = tzdev->devdata; +- +- if (trip < 0 || trip >= MLXSW_THERMAL_NUM_TRIPS) +- return -EINVAL; +- +- *p_type = thermal->trips[trip].type; +- return 0; +-} +- +-static int mlxsw_thermal_get_trip_temp(struct thermal_zone_device *tzdev, +- int trip, int *p_temp) +-{ +- struct mlxsw_thermal *thermal = tzdev->devdata; +- +- if (trip < 0 || trip >= MLXSW_THERMAL_NUM_TRIPS) +- return -EINVAL; +- +- *p_temp = thermal->trips[trip].temp; +- return 0; +-} +- +-static int mlxsw_thermal_set_trip_temp(struct thermal_zone_device *tzdev, +- int trip, int temp) +-{ +- struct mlxsw_thermal *thermal = tzdev->devdata; +- +- if (trip < 0 || trip >= MLXSW_THERMAL_NUM_TRIPS) +- return -EINVAL; +- +- thermal->trips[trip].temp = temp; +- return 0; +-} +- +-static int mlxsw_thermal_get_trip_hyst(struct thermal_zone_device *tzdev, +- int trip, int *p_hyst) +-{ +- struct mlxsw_thermal *thermal = tzdev->devdata; +- +- *p_hyst = thermal->trips[trip].hyst; +- return 0; +-} +- +-static int mlxsw_thermal_set_trip_hyst(struct thermal_zone_device *tzdev, +- int trip, int hyst) +-{ +- struct mlxsw_thermal *thermal = tzdev->devdata; +- +- thermal->trips[trip].hyst = hyst; +- return 0; +-} +- + static struct thermal_zone_params mlxsw_thermal_params = { + .no_hwmon = true, + }; +@@ -323,11 +276,6 @@ static struct thermal_zone_device_ops mlxsw_thermal_ops = { + .bind = mlxsw_thermal_bind, + .unbind = mlxsw_thermal_unbind, + .get_temp = mlxsw_thermal_get_temp, +- .get_trip_type = mlxsw_thermal_get_trip_type, +- .get_trip_temp = mlxsw_thermal_get_trip_temp, +- .set_trip_temp = mlxsw_thermal_set_trip_temp, +- .get_trip_hyst = mlxsw_thermal_get_trip_hyst, +- .set_trip_hyst = mlxsw_thermal_set_trip_hyst, + }; + + static int mlxsw_thermal_module_bind(struct thermal_zone_device *tzdev, +@@ -342,11 +290,11 @@ static int mlxsw_thermal_module_bind(struct thermal_zone_device *tzdev, + return 0; + + for (i = 0; i < MLXSW_THERMAL_NUM_TRIPS; i++) { +- const struct mlxsw_thermal_trip *trip = &tz->trips[i]; ++ const struct mlxsw_cooling_states *state = &tz->cooling_states[i]; + + err = thermal_zone_bind_cooling_device(tzdev, i, cdev, +- trip->max_state, +- trip->min_state, ++ state->max_state, ++ state->min_state, + THERMAL_WEIGHT_DEFAULT); + if (err < 0) + goto err_thermal_zone_bind_cooling_device; +@@ -434,74 +382,10 @@ static int mlxsw_thermal_module_temp_get(struct thermal_zone_device *tzdev, + return 0; + } + +-static int +-mlxsw_thermal_module_trip_type_get(struct thermal_zone_device *tzdev, int trip, +- enum thermal_trip_type *p_type) +-{ +- struct mlxsw_thermal_module *tz = tzdev->devdata; +- +- if (trip < 0 || trip >= MLXSW_THERMAL_NUM_TRIPS) +- return -EINVAL; +- +- *p_type = tz->trips[trip].type; +- return 0; +-} +- +-static int +-mlxsw_thermal_module_trip_temp_get(struct thermal_zone_device *tzdev, +- int trip, int *p_temp) +-{ +- struct mlxsw_thermal_module *tz = tzdev->devdata; +- +- if (trip < 0 || trip >= MLXSW_THERMAL_NUM_TRIPS) +- return -EINVAL; +- +- *p_temp = tz->trips[trip].temp; +- return 0; +-} +- +-static int +-mlxsw_thermal_module_trip_temp_set(struct thermal_zone_device *tzdev, +- int trip, int temp) +-{ +- struct mlxsw_thermal_module *tz = tzdev->devdata; +- +- if (trip < 0 || trip >= MLXSW_THERMAL_NUM_TRIPS) +- return -EINVAL; +- +- tz->trips[trip].temp = temp; +- return 0; +-} +- +-static int +-mlxsw_thermal_module_trip_hyst_get(struct thermal_zone_device *tzdev, int trip, +- int *p_hyst) +-{ +- struct mlxsw_thermal_module *tz = tzdev->devdata; +- +- *p_hyst = tz->trips[trip].hyst; +- return 0; +-} +- +-static int +-mlxsw_thermal_module_trip_hyst_set(struct thermal_zone_device *tzdev, int trip, +- int hyst) +-{ +- struct mlxsw_thermal_module *tz = tzdev->devdata; +- +- tz->trips[trip].hyst = hyst; +- return 0; +-} +- + static struct thermal_zone_device_ops mlxsw_thermal_module_ops = { + .bind = mlxsw_thermal_module_bind, + .unbind = mlxsw_thermal_module_unbind, + .get_temp = mlxsw_thermal_module_temp_get, +- .get_trip_type = mlxsw_thermal_module_trip_type_get, +- .get_trip_temp = mlxsw_thermal_module_trip_temp_get, +- .set_trip_temp = mlxsw_thermal_module_trip_temp_set, +- .get_trip_hyst = mlxsw_thermal_module_trip_hyst_get, +- .set_trip_hyst = mlxsw_thermal_module_trip_hyst_set, + }; + + static int mlxsw_thermal_gearbox_temp_get(struct thermal_zone_device *tzdev, +@@ -531,11 +415,6 @@ static struct thermal_zone_device_ops mlxsw_thermal_gearbox_ops = { + .bind = mlxsw_thermal_module_bind, + .unbind = mlxsw_thermal_module_unbind, + .get_temp = mlxsw_thermal_gearbox_temp_get, +- .get_trip_type = mlxsw_thermal_module_trip_type_get, +- .get_trip_temp = mlxsw_thermal_module_trip_temp_get, +- .set_trip_temp = mlxsw_thermal_module_trip_temp_set, +- .get_trip_hyst = mlxsw_thermal_module_trip_hyst_get, +- .set_trip_hyst = mlxsw_thermal_module_trip_hyst_set, + }; + + static int mlxsw_thermal_get_max_state(struct thermal_cooling_device *cdev, +@@ -617,7 +496,8 @@ mlxsw_thermal_module_tz_init(struct mlxsw_thermal_module *module_tz) + else + snprintf(tz_name, sizeof(tz_name), "mlxsw-module%d", + module_tz->module + 1); +- module_tz->tzdev = thermal_zone_device_register(tz_name, ++ module_tz->tzdev = thermal_zone_device_register_with_trips(tz_name, ++ module_tz->trips, + MLXSW_THERMAL_NUM_TRIPS, + MLXSW_THERMAL_TRIP_MASK, + module_tz, +@@ -661,6 +541,8 @@ mlxsw_thermal_module_init(struct device *dev, struct mlxsw_core *core, + module_tz->parent = thermal; + memcpy(module_tz->trips, default_thermal_trips, + sizeof(thermal->trips)); ++ memcpy(module_tz->cooling_states, default_cooling_states, ++ sizeof(thermal->cooling_states)); + /* Initialize all trip point. */ + mlxsw_thermal_module_trips_reset(module_tz); + /* Read module temperature and thresholds. */ +@@ -756,7 +638,8 @@ mlxsw_thermal_gearbox_tz_init(struct mlxsw_thermal_module *gearbox_tz) + else + snprintf(tz_name, sizeof(tz_name), "mlxsw-gearbox%d", + gearbox_tz->module + 1); +- gearbox_tz->tzdev = thermal_zone_device_register(tz_name, ++ gearbox_tz->tzdev = thermal_zone_device_register_with_trips(tz_name, ++ gearbox_tz->trips, + MLXSW_THERMAL_NUM_TRIPS, + MLXSW_THERMAL_TRIP_MASK, + gearbox_tz, +@@ -813,6 +696,8 @@ mlxsw_thermal_gearboxes_init(struct device *dev, struct mlxsw_core *core, + gearbox_tz = &area->tz_gearbox_arr[i]; + memcpy(gearbox_tz->trips, default_thermal_trips, + sizeof(thermal->trips)); ++ memcpy(gearbox_tz->cooling_states, default_cooling_states, ++ sizeof(thermal->cooling_states)); + gearbox_tz->module = i; + gearbox_tz->parent = thermal; + gearbox_tz->slot_index = area->slot_index; +@@ -928,6 +813,7 @@ int mlxsw_thermal_init(struct mlxsw_core *core, + thermal->core = core; + thermal->bus_info = bus_info; + memcpy(thermal->trips, default_thermal_trips, sizeof(thermal->trips)); ++ memcpy(thermal->cooling_states, default_cooling_states, sizeof(thermal->cooling_states)); + thermal->line_cards[0].slot_index = 0; + + err = mlxsw_reg_query(thermal->core, MLXSW_REG(mfcr), mfcr_pl); +@@ -981,7 +867,8 @@ int mlxsw_thermal_init(struct mlxsw_core *core, + MLXSW_THERMAL_SLOW_POLL_INT : + MLXSW_THERMAL_POLL_INT; + +- thermal->tzdev = thermal_zone_device_register("mlxsw", ++ thermal->tzdev = thermal_zone_device_register_with_trips("mlxsw", ++ thermal->trips, + MLXSW_THERMAL_NUM_TRIPS, + MLXSW_THERMAL_TRIP_MASK, + thermal, +-- +2.39.2 + diff --git a/queue-6.1/xirc2ps_cs-fix-use-after-free-bug-in-xirc2ps_detach.patch b/queue-6.1/xirc2ps_cs-fix-use-after-free-bug-in-xirc2ps_detach.patch new file mode 100644 index 00000000000..539cf1ebcf1 --- /dev/null +++ b/queue-6.1/xirc2ps_cs-fix-use-after-free-bug-in-xirc2ps_detach.patch @@ -0,0 +1,58 @@ +From 343ba6ba0b6f2d7f23751ed48c6243dbb3ebdc87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 00:15:26 +0800 +Subject: xirc2ps_cs: Fix use after free bug in xirc2ps_detach + +From: Zheng Wang + +[ Upstream commit e8d20c3ded59a092532513c9bd030d1ea66f5f44 ] + +In xirc2ps_probe, the local->tx_timeout_task was bounded +with xirc2ps_tx_timeout_task. When timeout occurs, +it will call xirc_tx_timeout->schedule_work to start the +work. + +When we call xirc2ps_detach to remove the driver, there +may be a sequence as follows: + +Stop responding to timeout tasks and complete scheduled +tasks before cleanup in xirc2ps_detach, which will fix +the problem. + +CPU0 CPU1 + + |xirc2ps_tx_timeout_task +xirc2ps_detach | + free_netdev | + kfree(dev); | + | + | do_reset + | //use dev + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Zheng Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/xircom/xirc2ps_cs.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/xircom/xirc2ps_cs.c b/drivers/net/ethernet/xircom/xirc2ps_cs.c +index 894e92ef415b9..9f505cf02d965 100644 +--- a/drivers/net/ethernet/xircom/xirc2ps_cs.c ++++ b/drivers/net/ethernet/xircom/xirc2ps_cs.c +@@ -503,6 +503,11 @@ static void + xirc2ps_detach(struct pcmcia_device *link) + { + struct net_device *dev = link->priv; ++ struct local_info *local = netdev_priv(dev); ++ ++ netif_carrier_off(dev); ++ netif_tx_disable(dev); ++ cancel_work_sync(&local->tx_timeout_task); + + dev_dbg(&link->dev, "detach\n"); + +-- +2.39.2 + diff --git a/queue-6.1/xsk-add-missing-overflow-check-in-xdp_umem_reg.patch b/queue-6.1/xsk-add-missing-overflow-check-in-xdp_umem_reg.patch new file mode 100644 index 00000000000..eb0b4978774 --- /dev/null +++ b/queue-6.1/xsk-add-missing-overflow-check-in-xdp_umem_reg.patch @@ -0,0 +1,64 @@ +From 9936a8ef698f0412dbcbdeb400164cc9ca061637 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Mar 2023 18:40:13 +0100 +Subject: xsk: Add missing overflow check in xdp_umem_reg + +From: Kal Conley + +[ Upstream commit c7df4813b149362248d6ef7be41a311e27bf75fe ] + +The number of chunks can overflow u32. Make sure to return -EINVAL on +overflow. Also remove a redundant u32 cast assigning umem->npgs. + +Fixes: bbff2f321a86 ("xsk: new descriptor addressing scheme") +Signed-off-by: Kal Conley +Signed-off-by: Daniel Borkmann +Acked-by: Magnus Karlsson +Link: https://lore.kernel.org/bpf/20230308174013.1114745-1-kal.conley@dectris.com +Signed-off-by: Sasha Levin +--- + net/xdp/xdp_umem.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c +index 4681e8e8ad943..02207e852d796 100644 +--- a/net/xdp/xdp_umem.c ++++ b/net/xdp/xdp_umem.c +@@ -150,10 +150,11 @@ static int xdp_umem_account_pages(struct xdp_umem *umem) + + static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr) + { +- u32 npgs_rem, chunk_size = mr->chunk_size, headroom = mr->headroom; + bool unaligned_chunks = mr->flags & XDP_UMEM_UNALIGNED_CHUNK_FLAG; +- u64 npgs, addr = mr->addr, size = mr->len; +- unsigned int chunks, chunks_rem; ++ u32 chunk_size = mr->chunk_size, headroom = mr->headroom; ++ u64 addr = mr->addr, size = mr->len; ++ u32 chunks_rem, npgs_rem; ++ u64 chunks, npgs; + int err; + + if (chunk_size < XDP_UMEM_MIN_CHUNK_SIZE || chunk_size > PAGE_SIZE) { +@@ -188,8 +189,8 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr) + if (npgs > U32_MAX) + return -EINVAL; + +- chunks = (unsigned int)div_u64_rem(size, chunk_size, &chunks_rem); +- if (chunks == 0) ++ chunks = div_u64_rem(size, chunk_size, &chunks_rem); ++ if (!chunks || chunks > U32_MAX) + return -EINVAL; + + if (!unaligned_chunks && chunks_rem) +@@ -202,7 +203,7 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr) + umem->headroom = headroom; + umem->chunk_size = chunk_size; + umem->chunks = chunks; +- umem->npgs = (u32)npgs; ++ umem->npgs = npgs; + umem->pgs = NULL; + umem->user = NULL; + umem->flags = mr->flags; +-- +2.39.2 +