From: Sasha Levin Date: Sun, 12 Feb 2023 19:48:34 +0000 (-0500) Subject: Fixes for 5.15 X-Git-Tag: v6.1.12~35 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=858861738551ae5dec87939d0fc6d8115dc253cd;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/alsa-pci-lx6464es-fix-a-debug-loop.patch b/queue-5.15/alsa-pci-lx6464es-fix-a-debug-loop.patch new file mode 100644 index 00000000000..275ba7291b5 --- /dev/null +++ b/queue-5.15/alsa-pci-lx6464es-fix-a-debug-loop.patch @@ -0,0 +1,52 @@ +From cf4e08bab5099b5df64699ec1c51217829627e83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 13:02:13 +0300 +Subject: ALSA: pci: lx6464es: fix a debug loop + +From: Dan Carpenter + +[ Upstream commit 5dac9f8dc25fefd9d928b98f6477ff3daefd73e3 ] + +This loop accidentally reuses the "i" iterator for both the inside and +the outside loop. The value of MAX_STREAM_BUFFER is 5. I believe that +chip->rmh.stat_len is in the 2-12 range. If the value of .stat_len is +4 or more then it will loop exactly one time, but if it's less then it +is a forever loop. + +It looks like it was supposed to combined into one loop where +conditions are checked. + +Fixes: 8e6320064c33 ("ALSA: lx_core: Remove useless #if 0 .. #endif") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/Y9jnJTis/mRFJAQp@kili +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/lx6464es/lx_core.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c +index d3f58a3d17fbc..b5b0d43bb8dcd 100644 +--- a/sound/pci/lx6464es/lx_core.c ++++ b/sound/pci/lx6464es/lx_core.c +@@ -493,12 +493,11 @@ int lx_buffer_ask(struct lx6464es *chip, u32 pipe, int is_capture, + dev_dbg(chip->card->dev, + "CMD_08_ASK_BUFFERS: needed %d, freed %d\n", + *r_needed, *r_freed); +- for (i = 0; i < MAX_STREAM_BUFFER; ++i) { +- for (i = 0; i != chip->rmh.stat_len; ++i) +- dev_dbg(chip->card->dev, +- " stat[%d]: %x, %x\n", i, +- chip->rmh.stat[i], +- chip->rmh.stat[i] & MASK_DATA_SIZE); ++ for (i = 0; i < MAX_STREAM_BUFFER && i < chip->rmh.stat_len; ++ ++i) { ++ dev_dbg(chip->card->dev, " stat[%d]: %x, %x\n", i, ++ chip->rmh.stat[i], ++ chip->rmh.stat[i] & MASK_DATA_SIZE); + } + } + +-- +2.39.0 + diff --git a/queue-5.15/asoc-topology-return-enomem-on-memory-allocation-fai.patch b/queue-5.15/asoc-topology-return-enomem-on-memory-allocation-fai.patch new file mode 100644 index 00000000000..ac0e7e611a5 --- /dev/null +++ b/queue-5.15/asoc-topology-return-enomem-on-memory-allocation-fai.patch @@ -0,0 +1,53 @@ +From bc778462de163cb08c5c3dfa51e9584fc4746cdf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Feb 2023 22:04:28 +0100 +Subject: ASoC: topology: Return -ENOMEM on memory allocation failure +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Amadeusz Sławiński + +[ Upstream commit c173ee5b2fa6195066674d66d1d7e191010fb1ff ] + +When handling error path, ret needs to be set to correct value. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Fixes: d29d41e28eea ("ASoC: topology: Add support for multiple kcontrol types to a widget") +Reviewed-by: Cezary Rojewski +Signed-off-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20230207210428.2076354-1-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-topology.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c +index eff8d4f715611..55b69e3c67186 100644 +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -1480,13 +1480,17 @@ static int soc_tplg_dapm_widget_create(struct soc_tplg *tplg, + + template.num_kcontrols = le32_to_cpu(w->num_kcontrols); + kc = devm_kcalloc(tplg->dev, le32_to_cpu(w->num_kcontrols), sizeof(*kc), GFP_KERNEL); +- if (!kc) ++ if (!kc) { ++ ret = -ENOMEM; + goto hdr_err; ++ } + + kcontrol_type = devm_kcalloc(tplg->dev, le32_to_cpu(w->num_kcontrols), sizeof(unsigned int), + GFP_KERNEL); +- if (!kcontrol_type) ++ if (!kcontrol_type) { ++ ret = -ENOMEM; + goto hdr_err; ++ } + + for (i = 0; i < w->num_kcontrols; i++) { + control_hdr = (struct snd_soc_tplg_ctl_hdr *)tplg->pos; +-- +2.39.0 + diff --git a/queue-5.15/bonding-fix-error-checking-in-bond_debug_reregister.patch b/queue-5.15/bonding-fix-error-checking-in-bond_debug_reregister.patch new file mode 100644 index 00000000000..ec8b27f384e --- /dev/null +++ b/queue-5.15/bonding-fix-error-checking-in-bond_debug_reregister.patch @@ -0,0 +1,40 @@ +From b80ce135a02bfad0cef814a98804843e03ecaabe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 17:32:55 +0800 +Subject: bonding: fix error checking in bond_debug_reregister() + +From: Qi Zheng + +[ Upstream commit cbe83191d40d8925b7a99969d037d2a0caf69294 ] + +Since commit ff9fb72bc077 ("debugfs: return error values, +not NULL") changed return value of debugfs_rename() in +error cases from %NULL to %ERR_PTR(-ERROR), we should +also check error values instead of NULL. + +Fixes: ff9fb72bc077 ("debugfs: return error values, not NULL") +Signed-off-by: Qi Zheng +Acked-by: Jay Vosburgh +Link: https://lore.kernel.org/r/20230202093256.32458-1-zhengqi.arch@bytedance.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/bonding/bond_debugfs.c b/drivers/net/bonding/bond_debugfs.c +index 4f9b4a18c74cd..5940945266489 100644 +--- a/drivers/net/bonding/bond_debugfs.c ++++ b/drivers/net/bonding/bond_debugfs.c +@@ -76,7 +76,7 @@ void bond_debug_reregister(struct bonding *bond) + + d = debugfs_rename(bonding_debug_root, bond->debug_dir, + bonding_debug_root, bond->dev->name); +- if (d) { ++ if (!IS_ERR(d)) { + bond->debug_dir = d; + } else { + netdev_warn(bond->dev, "failed to reregister, so just unregister old one\n"); +-- +2.39.0 + diff --git a/queue-5.15/ib-hfi1-restore-allocated-resources-on-failed-copyou.patch b/queue-5.15/ib-hfi1-restore-allocated-resources-on-failed-copyou.patch new file mode 100644 index 00000000000..69331a6c03a --- /dev/null +++ b/queue-5.15/ib-hfi1-restore-allocated-resources-on-failed-copyou.patch @@ -0,0 +1,46 @@ +From cd828c5ce15fffda1942e2ddd436bbf4db4f0da1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 13:16:02 -0500 +Subject: IB/hfi1: Restore allocated resources on failed copyout + +From: Dean Luick + +[ Upstream commit 6601fc0d15ffc20654e39486f9bef35567106d68 ] + +Fix a resource leak if an error occurs. + +Fixes: f404ca4c7ea8 ("IB/hfi1: Refactor hfi_user_exp_rcv_setup() IOCTL") +Signed-off-by: Dean Luick +Signed-off-by: Dennis Dalessandro +Link: https://lore.kernel.org/r/167354736291.2132367.10894218740150168180.stgit@awfm-02.cornelisnetworks.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/file_ops.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c +index 686d170a5947e..1c1172aeb36e9 100644 +--- a/drivers/infiniband/hw/hfi1/file_ops.c ++++ b/drivers/infiniband/hw/hfi1/file_ops.c +@@ -1318,12 +1318,15 @@ static int user_exp_rcv_setup(struct hfi1_filedata *fd, unsigned long arg, + addr = arg + offsetof(struct hfi1_tid_info, tidcnt); + if (copy_to_user((void __user *)addr, &tinfo.tidcnt, + sizeof(tinfo.tidcnt))) +- return -EFAULT; ++ ret = -EFAULT; + + addr = arg + offsetof(struct hfi1_tid_info, length); +- if (copy_to_user((void __user *)addr, &tinfo.length, ++ if (!ret && copy_to_user((void __user *)addr, &tinfo.length, + sizeof(tinfo.length))) + ret = -EFAULT; ++ ++ if (ret) ++ hfi1_user_exp_rcv_invalid(fd, &tinfo); + } + + return ret; +-- +2.39.0 + diff --git a/queue-5.15/ib-ipoib-fix-legacy-ipoib-due-to-wrong-number-of-que.patch b/queue-5.15/ib-ipoib-fix-legacy-ipoib-due-to-wrong-number-of-que.patch new file mode 100644 index 00000000000..c85ad765453 --- /dev/null +++ b/queue-5.15/ib-ipoib-fix-legacy-ipoib-due-to-wrong-number-of-que.patch @@ -0,0 +1,98 @@ +From fee0c5d4e9971ac9817e2e0805df71e11ff40b15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 20:24:18 +0200 +Subject: IB/IPoIB: Fix legacy IPoIB due to wrong number of queues + +From: Dragos Tatulea + +[ Upstream commit e632291a2dbce45a24cddeb5fe28fe71d724ba43 ] + +The cited commit creates child PKEY interfaces over netlink will +multiple tx and rx queues, but some devices doesn't support more than 1 +tx and 1 rx queues. This causes to a crash when traffic is sent over the +PKEY interface due to the parent having a single queue but the child +having multiple queues. + +This patch fixes the number of queues to 1 for legacy IPoIB at the +earliest possible point in time. + +BUG: kernel NULL pointer dereference, address: 000000000000036b +PGD 0 P4D 0 +Oops: 0000 [#1] SMP +CPU: 4 PID: 209665 Comm: python3 Not tainted 6.1.0_for_upstream_min_debug_2022_12_12_17_02 #1 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 +RIP: 0010:kmem_cache_alloc+0xcb/0x450 +Code: ce 7e 49 8b 50 08 49 83 78 10 00 4d 8b 28 0f 84 cb 02 00 00 4d 85 ed 0f 84 c2 02 00 00 41 8b 44 24 28 48 8d 4a +01 49 8b 3c 24 <49> 8b 5c 05 00 4c 89 e8 65 48 0f c7 0f 0f 94 c0 84 c0 74 b8 41 8b +RSP: 0018:ffff88822acbbab8 EFLAGS: 00010202 +RAX: 0000000000000070 RBX: ffff8881c28e3e00 RCX: 00000000064f8dae +RDX: 00000000064f8dad RSI: 0000000000000a20 RDI: 0000000000030d00 +RBP: 0000000000000a20 R08: ffff8882f5d30d00 R09: ffff888104032f40 +R10: ffff88810fade828 R11: 736f6d6570736575 R12: ffff88810081c000 +R13: 00000000000002fb R14: ffffffff817fc865 R15: 0000000000000000 +FS: 00007f9324ff9700(0000) GS:ffff8882f5d00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 000000000000036b CR3: 00000001125af004 CR4: 0000000000370ea0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + skb_clone+0x55/0xd0 + ip6_finish_output2+0x3fe/0x690 + ip6_finish_output+0xfa/0x310 + ip6_send_skb+0x1e/0x60 + udp_v6_send_skb+0x1e5/0x420 + udpv6_sendmsg+0xb3c/0xe60 + ? ip_mc_finish_output+0x180/0x180 + ? __switch_to_asm+0x3a/0x60 + ? __switch_to_asm+0x34/0x60 + sock_sendmsg+0x33/0x40 + __sys_sendto+0x103/0x160 + ? _copy_to_user+0x21/0x30 + ? kvm_clock_get_cycles+0xd/0x10 + ? ktime_get_ts64+0x49/0xe0 + __x64_sys_sendto+0x25/0x30 + do_syscall_64+0x3d/0x90 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 +RIP: 0033:0x7f9374f1ed14 +Code: 42 41 f8 ff 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b +7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 68 41 f8 ff 48 8b +RSP: 002b:00007f9324ff7bd0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c +RAX: ffffffffffffffda RBX: 00007f9324ff7cc8 RCX: 00007f9374f1ed14 +RDX: 00000000000002fb RSI: 00007f93000052f0 RDI: 0000000000000030 +RBP: 0000000000000000 R08: 00007f9324ff7d40 R09: 000000000000001c +R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 +R13: 000000012a05f200 R14: 0000000000000001 R15: 00007f9374d57bdc + + +Fixes: dbc94a0fb817 ("IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces") +Signed-off-by: Dragos Tatulea +Link: https://lore.kernel.org/r/95eb6b74c7cf49fa46281f9d056d685c9fa11d38.1674584576.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/ipoib/ipoib_main.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index 0aa8629fdf62e..1ea95f8009b82 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -2197,6 +2197,14 @@ int ipoib_intf_init(struct ib_device *hca, u32 port, const char *name, + rn->attach_mcast = ipoib_mcast_attach; + rn->detach_mcast = ipoib_mcast_detach; + rn->hca = hca; ++ ++ rc = netif_set_real_num_tx_queues(dev, 1); ++ if (rc) ++ goto out; ++ ++ rc = netif_set_real_num_rx_queues(dev, 1); ++ if (rc) ++ goto out; + } + + priv->rn_ops = dev->netdev_ops; +-- +2.39.0 + diff --git a/queue-5.15/ice-do-not-use-wq_mem_reclaim-flag-for-workqueue.patch b/queue-5.15/ice-do-not-use-wq_mem_reclaim-flag-for-workqueue.patch new file mode 100644 index 00000000000..4c4af0d1d63 --- /dev/null +++ b/queue-5.15/ice-do-not-use-wq_mem_reclaim-flag-for-workqueue.patch @@ -0,0 +1,111 @@ +From 21bf121c8133936121a465dcaec544cc67ec0aa9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 14:06:40 -0800 +Subject: ice: Do not use WQ_MEM_RECLAIM flag for workqueue + +From: Anirudh Venkataramanan + +[ Upstream commit 4d159f7884f78b1aacb99b4fc37d1e3cb1194e39 ] + +When both ice and the irdma driver are loaded, a warning in +check_flush_dependency is being triggered. This is due to ice driver +workqueue being allocated with the WQ_MEM_RECLAIM flag and the irdma one +is not. + +According to kernel documentation, this flag should be set if the +workqueue will be involved in the kernel's memory reclamation flow. +Since it is not, there is no need for the ice driver's WQ to have this +flag set so remove it. + +Example trace: + +[ +0.000004] workqueue: WQ_MEM_RECLAIM ice:ice_service_task [ice] is flushing !WQ_MEM_RECLAIM infiniband:0x0 +[ +0.000139] WARNING: CPU: 0 PID: 728 at kernel/workqueue.c:2632 check_flush_dependency+0x178/0x1a0 +[ +0.000011] Modules linked in: bonding tls xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_cha +in_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink bridge stp llc rfkill vfat fat intel_rapl_msr intel +_rapl_common isst_if_common skx_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm irqbypass crct1 +0dif_pclmul crc32_pclmul ghash_clmulni_intel rapl intel_cstate rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_target_mod target_ +core_mod ib_iser libiscsi scsi_transport_iscsi rdma_cm ib_cm iw_cm iTCO_wdt iTCO_vendor_support ipmi_ssif irdma mei_me ib_uverbs +ib_core intel_uncore joydev pcspkr i2c_i801 acpi_ipmi mei lpc_ich i2c_smbus intel_pch_thermal ioatdma ipmi_si acpi_power_meter +acpi_pad xfs libcrc32c sd_mod t10_pi crc64_rocksoft crc64 sg ahci ixgbe libahci ice i40e igb crc32c_intel mdio i2c_algo_bit liba +ta dca wmi dm_mirror dm_region_hash dm_log dm_mod ipmi_devintf ipmi_msghandler fuse +[ +0.000161] [last unloaded: bonding] +[ +0.000006] CPU: 0 PID: 728 Comm: kworker/0:2 Tainted: G S 6.2.0-rc2_next-queue-13jan-00458-gc20aabd57164 #1 +[ +0.000006] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0010.010620200716 01/06/2020 +[ +0.000003] Workqueue: ice ice_service_task [ice] +[ +0.000127] RIP: 0010:check_flush_dependency+0x178/0x1a0 +[ +0.000005] Code: 89 8e 02 01 e8 49 3d 40 00 49 8b 55 18 48 8d 8d d0 00 00 00 48 8d b3 d0 00 00 00 4d 89 e0 48 c7 c7 e0 3b 08 +9f e8 bb d3 07 01 <0f> 0b e9 be fe ff ff 80 3d 24 89 8e 02 00 0f 85 6b ff ff ff e9 06 +[ +0.000004] RSP: 0018:ffff88810a39f990 EFLAGS: 00010282 +[ +0.000005] RAX: 0000000000000000 RBX: ffff888141bc2400 RCX: 0000000000000000 +[ +0.000004] RDX: 0000000000000001 RSI: dffffc0000000000 RDI: ffffffffa1213a80 +[ +0.000003] RBP: ffff888194bf3400 R08: ffffed117b306112 R09: ffffed117b306112 +[ +0.000003] R10: ffff888bd983088b R11: ffffed117b306111 R12: 0000000000000000 +[ +0.000003] R13: ffff888111f84d00 R14: ffff88810a3943ac R15: ffff888194bf3400 +[ +0.000004] FS: 0000000000000000(0000) GS:ffff888bd9800000(0000) knlGS:0000000000000000 +[ +0.000003] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ +0.000003] CR2: 000056035b208b60 CR3: 000000017795e005 CR4: 00000000007706f0 +[ +0.000003] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ +0.000003] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ +0.000002] PKRU: 55555554 +[ +0.000003] Call Trace: +[ +0.000002] +[ +0.000003] __flush_workqueue+0x203/0x840 +[ +0.000006] ? mutex_unlock+0x84/0xd0 +[ +0.000008] ? __pfx_mutex_unlock+0x10/0x10 +[ +0.000004] ? __pfx___flush_workqueue+0x10/0x10 +[ +0.000006] ? mutex_lock+0xa3/0xf0 +[ +0.000005] ib_cache_cleanup_one+0x39/0x190 [ib_core] +[ +0.000174] __ib_unregister_device+0x84/0xf0 [ib_core] +[ +0.000094] ib_unregister_device+0x25/0x30 [ib_core] +[ +0.000093] irdma_ib_unregister_device+0x97/0xc0 [irdma] +[ +0.000064] ? __pfx_irdma_ib_unregister_device+0x10/0x10 [irdma] +[ +0.000059] ? up_write+0x5c/0x90 +[ +0.000005] irdma_remove+0x36/0x90 [irdma] +[ +0.000062] auxiliary_bus_remove+0x32/0x50 +[ +0.000007] device_release_driver_internal+0xfa/0x1c0 +[ +0.000005] bus_remove_device+0x18a/0x260 +[ +0.000007] device_del+0x2e5/0x650 +[ +0.000005] ? __pfx_device_del+0x10/0x10 +[ +0.000003] ? mutex_unlock+0x84/0xd0 +[ +0.000004] ? __pfx_mutex_unlock+0x10/0x10 +[ +0.000004] ? _raw_spin_unlock+0x18/0x40 +[ +0.000005] ice_unplug_aux_dev+0x52/0x70 [ice] +[ +0.000160] ice_service_task+0x1309/0x14f0 [ice] +[ +0.000134] ? __pfx___schedule+0x10/0x10 +[ +0.000006] process_one_work+0x3b1/0x6c0 +[ +0.000008] worker_thread+0x69/0x670 +[ +0.000005] ? __kthread_parkme+0xec/0x110 +[ +0.000007] ? __pfx_worker_thread+0x10/0x10 +[ +0.000005] kthread+0x17f/0x1b0 +[ +0.000005] ? __pfx_kthread+0x10/0x10 +[ +0.000004] ret_from_fork+0x29/0x50 +[ +0.000009] + +Fixes: 940b61af02f4 ("ice: Initialize PF and setup miscellaneous interrupt") +Signed-off-by: Anirudh Venkataramanan +Signed-off-by: Marcin Szycik +Tested-by: Jakub Andrysiak +Signed-off-by: Tony Nguyen +Reviewed-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 348105aa5cf54..6f674cd117d3d 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -5130,7 +5130,7 @@ static int __init ice_module_init(void) + pr_info("%s\n", ice_driver_string); + pr_info("%s\n", ice_copyright); + +- ice_wq = alloc_workqueue("%s", WQ_MEM_RECLAIM, 0, KBUILD_MODNAME); ++ ice_wq = alloc_workqueue("%s", 0, 0, KBUILD_MODNAME); + if (!ice_wq) { + pr_err("Failed to create workqueue\n"); + return -ENOMEM; +-- +2.39.0 + diff --git a/queue-5.15/igc-add-ndo_tx_timeout-support.patch b/queue-5.15/igc-add-ndo_tx_timeout-support.patch new file mode 100644 index 00000000000..bce8194a379 --- /dev/null +++ b/queue-5.15/igc-add-ndo_tx_timeout-support.patch @@ -0,0 +1,94 @@ +From a30da95ce92985ed3449710682b38619c4e621ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Feb 2023 15:58:18 -0800 +Subject: igc: Add ndo_tx_timeout support + +From: Sasha Neftin + +[ Upstream commit 9b275176270efd18f2f4e328b32be1bad34c4c0d ] + +On some platforms, 100/1000/2500 speeds seem to have sometimes problems +reporting false positive tx unit hang during stressful UDP traffic. Likely +other Intel drivers introduce responses to a tx hang. Update the 'tx hang' +comparator with the comparison of the head and tail of ring pointers and +restore the tx_timeout_factor to the previous value (one). + +This can be test by using netperf or iperf3 applications. +Example: +iperf3 -s -p 5001 +iperf3 -c 192.168.0.2 --udp -p 5001 --time 600 -b 0 + +netserver -p 16604 +netperf -H 192.168.0.2 -l 600 -p 16604 -t UDP_STREAM -- -m 64000 + +Fixes: b27b8dc77b5e ("igc: Increase timeout value for Speed 100/1000/2500") +Signed-off-by: Sasha Neftin +Tested-by: Naama Meir +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20230206235818.662384-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_main.c | 25 +++++++++++++++++++++-- + 1 file changed, 23 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c +index 3726c8413c741..bde3fea2c442e 100644 +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -2892,7 +2892,9 @@ static bool igc_clean_tx_irq(struct igc_q_vector *q_vector, int napi_budget) + if (tx_buffer->next_to_watch && + time_after(jiffies, tx_buffer->time_stamp + + (adapter->tx_timeout_factor * HZ)) && +- !(rd32(IGC_STATUS) & IGC_STATUS_TXOFF)) { ++ !(rd32(IGC_STATUS) & IGC_STATUS_TXOFF) && ++ (rd32(IGC_TDH(tx_ring->reg_idx)) != ++ readl(tx_ring->tail))) { + /* detected Tx unit hang */ + netdev_err(tx_ring->netdev, + "Detected Tx Unit Hang\n" +@@ -5019,6 +5021,24 @@ static int igc_change_mtu(struct net_device *netdev, int new_mtu) + return 0; + } + ++/** ++ * igc_tx_timeout - Respond to a Tx Hang ++ * @netdev: network interface device structure ++ * @txqueue: queue number that timed out ++ **/ ++static void igc_tx_timeout(struct net_device *netdev, ++ unsigned int __always_unused txqueue) ++{ ++ struct igc_adapter *adapter = netdev_priv(netdev); ++ struct igc_hw *hw = &adapter->hw; ++ ++ /* Do the reset outside of interrupt context */ ++ adapter->tx_timeout_count++; ++ schedule_work(&adapter->reset_task); ++ wr32(IGC_EICS, ++ (adapter->eims_enable_mask & ~adapter->eims_other)); ++} ++ + /** + * igc_get_stats64 - Get System Network Statistics + * @netdev: network interface device structure +@@ -5446,7 +5466,7 @@ static void igc_watchdog_task(struct work_struct *work) + case SPEED_100: + case SPEED_1000: + case SPEED_2500: +- adapter->tx_timeout_factor = 7; ++ adapter->tx_timeout_factor = 1; + break; + } + +@@ -6264,6 +6284,7 @@ static const struct net_device_ops igc_netdev_ops = { + .ndo_set_rx_mode = igc_set_rx_mode, + .ndo_set_mac_address = igc_set_mac, + .ndo_change_mtu = igc_change_mtu, ++ .ndo_tx_timeout = igc_tx_timeout, + .ndo_get_stats64 = igc_get_stats64, + .ndo_fix_features = igc_fix_features, + .ndo_set_features = igc_set_features, +-- +2.39.0 + diff --git a/queue-5.15/ionic-clean-interrupt-before-enabling-queue-to-avoid.patch b/queue-5.15/ionic-clean-interrupt-before-enabling-queue-to-avoid.patch new file mode 100644 index 00000000000..c8133ac614a --- /dev/null +++ b/queue-5.15/ionic-clean-interrupt-before-enabling-queue-to-avoid.patch @@ -0,0 +1,67 @@ +From 6117cc0f6ab23260060265699a51020133839c1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 13:55:35 -0800 +Subject: ionic: clean interrupt before enabling queue to avoid credit race + +From: Neel Patel + +[ Upstream commit e8797a058466b60fc5a3291b92430c93ba90eaff ] + +Clear the interrupt credits before enabling the queue rather +than after to be sure that the enabled queue starts at 0 and +that we don't wipe away possible credits after enabling the +queue. + +Fixes: 0f3154e6bcb3 ("ionic: Add Tx and Rx handling") +Signed-off-by: Neel Patel +Signed-off-by: Shannon Nelson +Reviewed-by: Leon Romanovsky +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +index 886c997a3ad14..6fbd2a51d66ce 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +@@ -268,6 +268,7 @@ static int ionic_qcq_enable(struct ionic_qcq *qcq) + .oper = IONIC_Q_ENABLE, + }, + }; ++ int ret; + + idev = &lif->ionic->idev; + dev = lif->ionic->dev; +@@ -275,16 +276,24 @@ static int ionic_qcq_enable(struct ionic_qcq *qcq) + dev_dbg(dev, "q_enable.index %d q_enable.qtype %d\n", + ctx.cmd.q_control.index, ctx.cmd.q_control.type); + ++ if (qcq->flags & IONIC_QCQ_F_INTR) ++ ionic_intr_clean(idev->intr_ctrl, qcq->intr.index); ++ ++ ret = ionic_adminq_post_wait(lif, &ctx); ++ if (ret) ++ return ret; ++ ++ if (qcq->napi.poll) ++ napi_enable(&qcq->napi); ++ + if (qcq->flags & IONIC_QCQ_F_INTR) { + irq_set_affinity_hint(qcq->intr.vector, + &qcq->intr.affinity_mask); +- napi_enable(&qcq->napi); +- ionic_intr_clean(idev->intr_ctrl, qcq->intr.index); + ionic_intr_mask(idev->intr_ctrl, qcq->intr.index, + IONIC_INTR_MASK_CLEAR); + } + +- return ionic_adminq_post_wait(lif, &ctx); ++ return 0; + } + + static int ionic_qcq_disable(struct ionic_qcq *qcq, bool send_to_hw) +-- +2.39.0 + diff --git a/queue-5.15/net-dsa-mt7530-don-t-change-pvc_eg_tag-when-cpu-port.patch b/queue-5.15/net-dsa-mt7530-don-t-change-pvc_eg_tag-when-cpu-port.patch new file mode 100644 index 00000000000..3ce162cf3b8 --- /dev/null +++ b/queue-5.15/net-dsa-mt7530-don-t-change-pvc_eg_tag-when-cpu-port.patch @@ -0,0 +1,110 @@ +From 7b49c31c87bdca771508abeaeddfc18d74ba741e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Feb 2023 16:07:13 +0200 +Subject: net: dsa: mt7530: don't change PVC_EG_TAG when CPU port becomes + VLAN-aware +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vladimir Oltean + +[ Upstream commit 0b6d6425103a676e2b6a81f3fd35d7ea4f9b90ec ] + +Frank reports that in a mt7530 setup where some ports are standalone and +some are in a VLAN-aware bridge, 8021q uppers of the standalone ports +lose their VLAN tag on xmit, as seen by the link partner. + +This seems to occur because once the other ports join the VLAN-aware +bridge, mt7530_port_vlan_filtering() also calls +mt7530_port_set_vlan_aware(ds, cpu_dp->index), and this affects the way +that the switch processes the traffic of the standalone port. + +Relevant is the PVC_EG_TAG bit. The MT7530 documentation says about it: + +EG_TAG: Incoming Port Egress Tag VLAN Attribution +0: disabled (system default) +1: consistent (keep the original ingress tag attribute) + +My interpretation is that this setting applies on the ingress port, and +"disabled" is basically the normal behavior, where the egress tag format +of the packet (tagged or untagged) is decided by the VLAN table +(MT7530_VLAN_EGRESS_UNTAG or MT7530_VLAN_EGRESS_TAG). + +But there is also an option of overriding the system default behavior, +and for the egress tagging format of packets to be decided not by the +VLAN table, but simply by copying the ingress tag format (if ingress was +tagged, egress is tagged; if ingress was untagged, egress is untagged; +aka "consistent). This is useful in 2 scenarios: + +- VLAN-unaware bridge ports will always encounter a miss in the VLAN + table. They should forward a packet as-is, though. So we use + "consistent" there. See commit e045124e9399 ("net: dsa: mt7530: fix + tagged frames pass-through in VLAN-unaware mode"). + +- Traffic injected from the CPU port. The operating system is in god + mode; if it wants a packet to exit as VLAN-tagged, it sends it as + VLAN-tagged. Otherwise it sends it as VLAN-untagged*. + +*This is true only if we don't consider the bridge TX forwarding offload +feature, which mt7530 doesn't support. + +So for now, make the CPU port always stay in "consistent" mode to allow +software VLANs to be forwarded to their egress ports with the VLAN tag +intact, and not stripped. + +Link: https://lore.kernel.org/netdev/trinity-e6294d28-636c-4c40-bb8b-b523521b00be-1674233135062@3c-app-gmx-bs36/ +Fixes: e045124e9399 ("net: dsa: mt7530: fix tagged frames pass-through in VLAN-unaware mode") +Reported-by: Frank Wunderlich +Tested-by: Frank Wunderlich +Signed-off-by: Vladimir Oltean +Tested-by: Arınç ÜNAL +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20230205140713.1609281-1-vladimir.oltean@nxp.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mt7530.c | 26 +++++++++++++++++++------- + 1 file changed, 19 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index 704ba461a6000..c1505de23957f 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -1290,14 +1290,26 @@ mt7530_port_set_vlan_aware(struct dsa_switch *ds, int port) + if (!priv->ports[port].pvid) + mt7530_rmw(priv, MT7530_PVC_P(port), ACC_FRM_MASK, + MT7530_VLAN_ACC_TAGGED); +- } + +- /* Set the port as a user port which is to be able to recognize VID +- * from incoming packets before fetching entry within the VLAN table. +- */ +- mt7530_rmw(priv, MT7530_PVC_P(port), VLAN_ATTR_MASK | PVC_EG_TAG_MASK, +- VLAN_ATTR(MT7530_VLAN_USER) | +- PVC_EG_TAG(MT7530_VLAN_EG_DISABLED)); ++ /* Set the port as a user port which is to be able to recognize ++ * VID from incoming packets before fetching entry within the ++ * VLAN table. ++ */ ++ mt7530_rmw(priv, MT7530_PVC_P(port), ++ VLAN_ATTR_MASK | PVC_EG_TAG_MASK, ++ VLAN_ATTR(MT7530_VLAN_USER) | ++ PVC_EG_TAG(MT7530_VLAN_EG_DISABLED)); ++ } else { ++ /* Also set CPU ports to the "user" VLAN port attribute, to ++ * allow VLAN classification, but keep the EG_TAG attribute as ++ * "consistent" (i.o.w. don't change its value) for packets ++ * received by the switch from the CPU, so that tagged packets ++ * are forwarded to user ports as tagged, and untagged as ++ * untagged. ++ */ ++ mt7530_rmw(priv, MT7530_PVC_P(port), VLAN_ATTR_MASK, ++ VLAN_ATTR(MT7530_VLAN_USER)); ++ } + } + + static void +-- +2.39.0 + diff --git a/queue-5.15/net-mlx5-bridge-fix-ageing-of-peer-fdb-entries.patch b/queue-5.15/net-mlx5-bridge-fix-ageing-of-peer-fdb-entries.patch new file mode 100644 index 00000000000..6f999464ebd --- /dev/null +++ b/queue-5.15/net-mlx5-bridge-fix-ageing-of-peer-fdb-entries.patch @@ -0,0 +1,58 @@ +From 36f4d5931715367b252ebb87413a4f740b037010 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 14:47:12 +0100 +Subject: net/mlx5: Bridge, fix ageing of peer FDB entries + +From: Vlad Buslov + +[ Upstream commit da0c52426cd23f8728eff72c2b2d2a3eb6b451f5 ] + +SWITCHDEV_FDB_ADD_TO_BRIDGE event handler that updates FDB entry 'lastuse' +field is only executed for eswitch that owns the entry. However, if peer +entry processed packets at least once it will have hardware counter 'used' +value greater than entry 'lastuse' from that point on, which will cause FDB +entry not being aged out. + +Process the event on all eswitch instances. + +Fixes: ff9b7521468b ("net/mlx5: Bridge, support LAG") +Signed-off-by: Vlad Buslov +Reviewed-by: Maor Dickman +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c | 4 ---- + drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c | 2 +- + 2 files changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c +index 8e7177d4539e3..291bd59639044 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c +@@ -432,10 +432,6 @@ static int mlx5_esw_bridge_switchdev_event(struct notifier_block *nb, + + switch (event) { + case SWITCHDEV_FDB_ADD_TO_BRIDGE: +- /* only handle the event on native eswtich of representor */ +- if (!mlx5_esw_bridge_is_local(dev, rep, esw)) +- break; +- + fdb_info = container_of(info, + struct switchdev_notifier_fdb_info, + info); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c +index 317d76b97c42a..aec0f67cef005 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c +@@ -1270,7 +1270,7 @@ void mlx5_esw_bridge_fdb_update_used(struct net_device *dev, u16 vport_num, u16 + struct mlx5_esw_bridge *bridge; + + port = mlx5_esw_bridge_port_lookup(vport_num, esw_owner_vhca_id, br_offloads); +- if (!port || port->flags & MLX5_ESW_BRIDGE_PORT_FLAG_PEER) ++ if (!port) + return; + + bridge = port->bridge; +-- +2.39.0 + diff --git a/queue-5.15/net-mlx5-fw_tracer-clear-load-bit-when-freeing-strin.patch b/queue-5.15/net-mlx5-fw_tracer-clear-load-bit-when-freeing-strin.patch new file mode 100644 index 00000000000..66c11b6c250 --- /dev/null +++ b/queue-5.15/net-mlx5-fw_tracer-clear-load-bit-when-freeing-strin.patch @@ -0,0 +1,40 @@ +From 7d82638abb46a979d1b4d5af0e2180e07c517348 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 15:27:40 +0200 +Subject: net/mlx5: fw_tracer, Clear load bit when freeing string DBs buffers + +From: Shay Drory + +[ Upstream commit db561fed6b8fa3878e74d5df6512a4a38152b63e ] + +Whenever the driver is reading the string DBs into buffers, the driver +is setting the load bit, but the driver never clears this bit. +As a result, in case load bit is on and the driver query the device for +new string DBs, the driver won't read again the string DBs. +Fix it by clearing the load bit when query the device for new string +DBs. + +Fixes: 2d69356752ff ("net/mlx5: Add support for fw live patch event") +Signed-off-by: Shay Drory +Reviewed-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +index 326e0b170e363..265f4ae835ce5 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +@@ -64,6 +64,7 @@ static int mlx5_query_mtrc_caps(struct mlx5_fw_tracer *tracer) + MLX5_GET(mtrc_cap, out, num_string_trace); + tracer->str_db.num_string_db = MLX5_GET(mtrc_cap, out, num_string_db); + tracer->owner = !!MLX5_GET(mtrc_cap, out, trace_owner); ++ tracer->str_db.loaded = false; + + for (i = 0; i < tracer->str_db.num_string_db; i++) { + mtrc_cap_sp = MLX5_ADDR_OF(mtrc_cap, out, string_db_param[i]); +-- +2.39.0 + diff --git a/queue-5.15/net-mlx5-fw_tracer-zero-consumer-index-when-reloadin.patch b/queue-5.15/net-mlx5-fw_tracer-zero-consumer-index-when-reloadin.patch new file mode 100644 index 00000000000..c4e45ac11dc --- /dev/null +++ b/queue-5.15/net-mlx5-fw_tracer-zero-consumer-index-when-reloadin.patch @@ -0,0 +1,45 @@ +From be549c943bebdebde229f8491834ef0c4533fec1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 17:39:36 +0200 +Subject: net/mlx5: fw_tracer, Zero consumer index when reloading the tracer + +From: Shay Drory + +[ Upstream commit 184e1e4474dbcfebc4dbd1fa823a329978f25506 ] + +When tracer is reloaded, the device will log the traces at the +beginning of the log buffer. Also, driver is reading the log buffer in +chunks in accordance to the consumer index. +Hence, zero consumer index when reloading the tracer. + +Fixes: 4383cfcc65e7 ("net/mlx5: Add devlink reload") +Signed-off-by: Shay Drory +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +index 265f4ae835ce5..1c72fc0b7b68a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +@@ -757,6 +757,7 @@ static int mlx5_fw_tracer_set_mtrc_conf(struct mlx5_fw_tracer *tracer) + if (err) + mlx5_core_warn(dev, "FWTracer: Failed to set tracer configurations %d\n", err); + ++ tracer->buff.consumer_index = 0; + return err; + } + +@@ -821,7 +822,6 @@ static void mlx5_fw_tracer_ownership_change(struct work_struct *work) + mlx5_core_dbg(tracer->dev, "FWTracer: ownership changed, current=(%d)\n", tracer->owner); + if (tracer->owner) { + tracer->owner = false; +- tracer->buff.consumer_index = 0; + return; + } + +-- +2.39.0 + diff --git a/queue-5.15/net-mlx5-serialize-module-cleanup-with-reload-and-re.patch b/queue-5.15/net-mlx5-serialize-module-cleanup-with-reload-and-re.patch new file mode 100644 index 00000000000..3f09aa64562 --- /dev/null +++ b/queue-5.15/net-mlx5-serialize-module-cleanup-with-reload-and-re.patch @@ -0,0 +1,83 @@ +From 67b96dcb0749836125edcb22871e7d97821e36aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Dec 2022 22:16:23 +0200 +Subject: net/mlx5: Serialize module cleanup with reload and remove + +From: Shay Drory + +[ Upstream commit 8f0d1451ecf7b3bd5a06ffc866c753d0f3ab4683 ] + +Currently, remove and reload flows can run in parallel to module cleanup. +This design is error prone. For example: aux_drivers callbacks are called +from both cleanup and remove flows with different lockings, which can +cause a deadlock[1]. +Hence, serialize module cleanup with reload and remove. + +[1] + cleanup remove + ------- ------ + auxiliary_driver_unregister(); + devl_lock() + auxiliary_device_delete(mlx5e_aux) + device_lock(mlx5e_aux) + devl_lock() + device_lock(mlx5e_aux) + +Fixes: 912cebf420c2 ("net/mlx5e: Connect ethernet part to auxiliary bus") +Signed-off-by: Shay Drory +Reviewed-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/main.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index 9e15eea9743fe..485a6a6220f6a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -1862,7 +1862,7 @@ static int __init mlx5_init(void) + mlx5_fpga_ipsec_build_fs_cmds(); + mlx5_register_debugfs(); + +- err = pci_register_driver(&mlx5_core_driver); ++ err = mlx5e_init(); + if (err) + goto err_debug; + +@@ -1870,16 +1870,16 @@ static int __init mlx5_init(void) + if (err) + goto err_sf; + +- err = mlx5e_init(); ++ err = pci_register_driver(&mlx5_core_driver); + if (err) +- goto err_en; ++ goto err_pci; + + return 0; + +-err_en: ++err_pci: + mlx5_sf_driver_unregister(); + err_sf: +- pci_unregister_driver(&mlx5_core_driver); ++ mlx5e_cleanup(); + err_debug: + mlx5_unregister_debugfs(); + return err; +@@ -1887,9 +1887,9 @@ static int __init mlx5_init(void) + + static void __exit mlx5_cleanup(void) + { +- mlx5e_cleanup(); +- mlx5_sf_driver_unregister(); + pci_unregister_driver(&mlx5_core_driver); ++ mlx5_sf_driver_unregister(); ++ mlx5e_cleanup(); + mlx5_unregister_debugfs(); + } + +-- +2.39.0 + diff --git a/queue-5.15/net-mlx5e-introduce-the-mlx5e_flush_rq-function.patch b/queue-5.15/net-mlx5e-introduce-the-mlx5e_flush_rq-function.patch new file mode 100644 index 00000000000..6439f0ec116 --- /dev/null +++ b/queue-5.15/net-mlx5e-introduce-the-mlx5e_flush_rq-function.patch @@ -0,0 +1,128 @@ +From d2e1cbce921950598500053f76e93ad7697640d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Sep 2022 09:29:02 -0700 +Subject: net/mlx5e: Introduce the mlx5e_flush_rq function + +From: Maxim Mikityanskiy + +[ Upstream commit d9ba64deb2f1ad58eb3067c7485518f3e96559ee ] + +Add a function to flush an RQ: clean up descriptors, release pages and +reset the RQ. This procedure is used by the recovery flow, and it will +also be used in a following commit to free some memory when switching a +channel to the XSK mode. + +Signed-off-by: Maxim Mikityanskiy +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Jakub Kicinski +Stable-dep-of: 1e66220948df ("net/mlx5e: Update rx ring hw mtu upon each rx-fcs flag change") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +- + .../mellanox/mlx5/core/en/reporter_rx.c | 23 +-------------- + .../net/ethernet/mellanox/mlx5/core/en_main.c | 28 ++++++++++++++++++- + 3 files changed, 29 insertions(+), 24 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h +index c22a38e5337b2..c822c3ac0544b 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h +@@ -1002,7 +1002,7 @@ void mlx5e_activate_priv_channels(struct mlx5e_priv *priv); + void mlx5e_deactivate_priv_channels(struct mlx5e_priv *priv); + int mlx5e_ptp_rx_manage_fs_ctx(struct mlx5e_priv *priv, void *ctx); + +-int mlx5e_modify_rq_state(struct mlx5e_rq *rq, int curr_state, int next_state); ++int mlx5e_flush_rq(struct mlx5e_rq *rq, int curr_state); + void mlx5e_activate_rq(struct mlx5e_rq *rq); + void mlx5e_deactivate_rq(struct mlx5e_rq *rq); + void mlx5e_activate_icosq(struct mlx5e_icosq *icosq); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c +index 0f1dbad7c9f1a..899a9a73eef68 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c +@@ -129,34 +129,13 @@ static int mlx5e_rx_reporter_err_icosq_cqe_recover(void *ctx) + return err; + } + +-static int mlx5e_rq_to_ready(struct mlx5e_rq *rq, int curr_state) +-{ +- struct net_device *dev = rq->netdev; +- int err; +- +- err = mlx5e_modify_rq_state(rq, curr_state, MLX5_RQC_STATE_RST); +- if (err) { +- netdev_err(dev, "Failed to move rq 0x%x to reset\n", rq->rqn); +- return err; +- } +- err = mlx5e_modify_rq_state(rq, MLX5_RQC_STATE_RST, MLX5_RQC_STATE_RDY); +- if (err) { +- netdev_err(dev, "Failed to move rq 0x%x to ready\n", rq->rqn); +- return err; +- } +- +- return 0; +-} +- + static int mlx5e_rx_reporter_err_rq_cqe_recover(void *ctx) + { + struct mlx5e_rq *rq = ctx; + int err; + + mlx5e_deactivate_rq(rq); +- mlx5e_free_rx_descs(rq); +- +- err = mlx5e_rq_to_ready(rq, MLX5_RQC_STATE_ERR); ++ err = mlx5e_flush_rq(rq, MLX5_RQC_STATE_ERR); + clear_bit(MLX5E_RQ_STATE_RECOVERING, &rq->state); + if (err) + return err; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index be19f5cf9d150..866242ac72c29 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -672,7 +672,7 @@ int mlx5e_create_rq(struct mlx5e_rq *rq, struct mlx5e_rq_param *param) + return err; + } + +-int mlx5e_modify_rq_state(struct mlx5e_rq *rq, int curr_state, int next_state) ++static int mlx5e_modify_rq_state(struct mlx5e_rq *rq, int curr_state, int next_state) + { + struct mlx5_core_dev *mdev = rq->mdev; + +@@ -701,6 +701,32 @@ int mlx5e_modify_rq_state(struct mlx5e_rq *rq, int curr_state, int next_state) + return err; + } + ++static int mlx5e_rq_to_ready(struct mlx5e_rq *rq, int curr_state) ++{ ++ struct net_device *dev = rq->netdev; ++ int err; ++ ++ err = mlx5e_modify_rq_state(rq, curr_state, MLX5_RQC_STATE_RST); ++ if (err) { ++ netdev_err(dev, "Failed to move rq 0x%x to reset\n", rq->rqn); ++ return err; ++ } ++ err = mlx5e_modify_rq_state(rq, MLX5_RQC_STATE_RST, MLX5_RQC_STATE_RDY); ++ if (err) { ++ netdev_err(dev, "Failed to move rq 0x%x to ready\n", rq->rqn); ++ return err; ++ } ++ ++ return 0; ++} ++ ++int mlx5e_flush_rq(struct mlx5e_rq *rq, int curr_state) ++{ ++ mlx5e_free_rx_descs(rq); ++ ++ return mlx5e_rq_to_ready(rq, curr_state); ++} ++ + static int mlx5e_modify_rq_scatter_fcs(struct mlx5e_rq *rq, bool enable) + { + struct mlx5_core_dev *mdev = rq->mdev; +-- +2.39.0 + diff --git a/queue-5.15/net-mlx5e-ipoib-show-unknown-speed-instead-of-error.patch b/queue-5.15/net-mlx5e-ipoib-show-unknown-speed-instead-of-error.patch new file mode 100644 index 00000000000..fbf4ab751d8 --- /dev/null +++ b/queue-5.15/net-mlx5e-ipoib-show-unknown-speed-instead-of-error.patch @@ -0,0 +1,96 @@ +From bbd29846e7b53cdc0aa37dea752869ec72bfd9b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Jan 2023 16:06:32 +0200 +Subject: net/mlx5e: IPoIB, Show unknown speed instead of error + +From: Dragos Tatulea + +[ Upstream commit 8aa5f171d51c1cb69e5e3106df4dd1a446102823 ] + +ethtool is returning an error for unknown speeds for the IPoIB interface: + +$ ethtool ib0 +netlink error: failed to retrieve link settings +netlink error: Invalid argument +netlink error: failed to retrieve link settings +netlink error: Invalid argument +Settings for ib0: +Link detected: no + +After this change, ethtool will return success and show "unknown speed": + +$ ethtool ib0 +Settings for ib0: +Supported ports: [ ] +Supported link modes: Not reported +Supported pause frame use: No +Supports auto-negotiation: No +Supported FEC modes: Not reported +Advertised link modes: Not reported +Advertised pause frame use: No +Advertised auto-negotiation: No +Advertised FEC modes: Not reported +Speed: Unknown! +Duplex: Full +Auto-negotiation: off +Port: Other +PHYAD: 0 +Transceiver: internal +Link detected: no + +Fixes: eb234ee9d541 ("net/mlx5e: IPoIB, Add support for get_link_ksettings in ethtool") +Signed-off-by: Dragos Tatulea +Reviewed-by: Gal Pressman +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c +index 0c8594c7df21d..908e5ee1a30fa 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c +@@ -172,16 +172,16 @@ static inline int mlx5_ptys_rate_enum_to_int(enum mlx5_ptys_rate rate) + } + } + +-static int mlx5i_get_speed_settings(u16 ib_link_width_oper, u16 ib_proto_oper) ++static u32 mlx5i_get_speed_settings(u16 ib_link_width_oper, u16 ib_proto_oper) + { + int rate, width; + + rate = mlx5_ptys_rate_enum_to_int(ib_proto_oper); + if (rate < 0) +- return -EINVAL; ++ return SPEED_UNKNOWN; + width = mlx5_ptys_width_enum_to_int(ib_link_width_oper); + if (width < 0) +- return -EINVAL; ++ return SPEED_UNKNOWN; + + return rate * width; + } +@@ -204,16 +204,13 @@ static int mlx5i_get_link_ksettings(struct net_device *netdev, + ethtool_link_ksettings_zero_link_mode(link_ksettings, advertising); + + speed = mlx5i_get_speed_settings(ib_link_width_oper, ib_proto_oper); +- if (speed < 0) +- return -EINVAL; ++ link_ksettings->base.speed = speed; ++ link_ksettings->base.duplex = speed == SPEED_UNKNOWN ? DUPLEX_UNKNOWN : DUPLEX_FULL; + +- link_ksettings->base.duplex = DUPLEX_FULL; + link_ksettings->base.port = PORT_OTHER; + + link_ksettings->base.autoneg = AUTONEG_DISABLE; + +- link_ksettings->base.speed = speed; +- + return 0; + } + +-- +2.39.0 + diff --git a/queue-5.15/net-mlx5e-move-repeating-clear_bit-in-mlx5e_rx_repor.patch b/queue-5.15/net-mlx5e-move-repeating-clear_bit-in-mlx5e_rx_repor.patch new file mode 100644 index 00000000000..74a33bd29b1 --- /dev/null +++ b/queue-5.15/net-mlx5e-move-repeating-clear_bit-in-mlx5e_rx_repor.patch @@ -0,0 +1,50 @@ +From 0dc602c71bbdddc603408fe147b4f9cd3b1e16e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Sep 2022 00:21:55 -0700 +Subject: net/mlx5e: Move repeating clear_bit in + mlx5e_rx_reporter_err_rq_cqe_recover + +From: Maxim Mikityanskiy + +[ Upstream commit e64d71d055ca01fa5054d25b99fb29b98e543a31 ] + +The same clear_bit is called in both error and success flows. Move the +call to do it only once and remove the out label. + +Signed-off-by: Maxim Mikityanskiy +Reviewed-by: Saeed Mahameed +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Jakub Kicinski +Stable-dep-of: 1e66220948df ("net/mlx5e: Update rx ring hw mtu upon each rx-fcs flag change") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c +index e329158fdc555..0f1dbad7c9f1a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c +@@ -157,16 +157,13 @@ static int mlx5e_rx_reporter_err_rq_cqe_recover(void *ctx) + mlx5e_free_rx_descs(rq); + + err = mlx5e_rq_to_ready(rq, MLX5_RQC_STATE_ERR); ++ clear_bit(MLX5E_RQ_STATE_RECOVERING, &rq->state); + if (err) +- goto out; ++ return err; + +- clear_bit(MLX5E_RQ_STATE_RECOVERING, &rq->state); + mlx5e_activate_rq(rq); + rq->stats->recover++; + return 0; +-out: +- clear_bit(MLX5E_RQ_STATE_RECOVERING, &rq->state); +- return err; + } + + static int mlx5e_rx_reporter_timeout_recover(void *ctx) +-- +2.39.0 + diff --git a/queue-5.15/net-mlx5e-update-rx-ring-hw-mtu-upon-each-rx-fcs-fla.patch b/queue-5.15/net-mlx5e-update-rx-ring-hw-mtu-upon-each-rx-fcs-fla.patch new file mode 100644 index 00000000000..3cccbffffce --- /dev/null +++ b/queue-5.15/net-mlx5e-update-rx-ring-hw-mtu-upon-each-rx-fcs-fla.patch @@ -0,0 +1,165 @@ +From 893a71a8dd17d05ec9f49fd954951808be835a65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Jan 2023 18:09:32 +0200 +Subject: net/mlx5e: Update rx ring hw mtu upon each rx-fcs flag change + +From: Adham Faris + +[ Upstream commit 1e66220948df815d7b37e0ff8b4627ce10433738 ] + +rq->hw_mtu is used in function en_rx.c/mlx5e_skb_from_cqe_mpwrq_linear() +to catch oversized packets. If FCS is concatenated to the end of the +packet then the check should be updated accordingly. + +Rx rings initialization (mlx5e_init_rxq_rq()) invoked for every new set +of channels, as part of mlx5e_safe_switch_params(), unknowingly if it +runs with default configuration or not. Current rq->hw_mtu +initialization assumes default configuration and ignores +params->scatter_fcs_en flag state. +Fix this, by accounting for params->scatter_fcs_en flag state during +rq->hw_mtu initialization. + +In addition, updating rq->hw_mtu value during ingress traffic might +lead to packets drop and oversize_pkts_sw_drop counter increase with no +good reason. Hence we remove this optimization and switch the set of +channels with a new one, to make sure we don't get false positives on +the oversize_pkts_sw_drop counter. + +Fixes: 102722fc6832 ("net/mlx5e: Add support for RXFCS feature flag") +Signed-off-by: Adham Faris +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/en_main.c | 86 ++++--------------- + 1 file changed, 15 insertions(+), 71 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 866242ac72c29..f1dd966e2bdbf 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -392,7 +392,8 @@ static int mlx5e_init_rxq_rq(struct mlx5e_channel *c, struct mlx5e_params *param + rq->icosq = &c->icosq; + rq->ix = c->ix; + rq->mdev = mdev; +- rq->hw_mtu = MLX5E_SW2HW_MTU(params, params->sw_mtu); ++ rq->hw_mtu = ++ MLX5E_SW2HW_MTU(params, params->sw_mtu) - ETH_FCS_LEN * !params->scatter_fcs_en; + rq->xdpsq = &c->rq_xdpsq; + rq->stats = &c->priv->channel_stats[c->ix].rq; + rq->ptp_cyc2time = mlx5_rq_ts_translator(mdev); +@@ -727,35 +728,6 @@ int mlx5e_flush_rq(struct mlx5e_rq *rq, int curr_state) + return mlx5e_rq_to_ready(rq, curr_state); + } + +-static int mlx5e_modify_rq_scatter_fcs(struct mlx5e_rq *rq, bool enable) +-{ +- struct mlx5_core_dev *mdev = rq->mdev; +- +- void *in; +- void *rqc; +- int inlen; +- int err; +- +- inlen = MLX5_ST_SZ_BYTES(modify_rq_in); +- in = kvzalloc(inlen, GFP_KERNEL); +- if (!in) +- return -ENOMEM; +- +- rqc = MLX5_ADDR_OF(modify_rq_in, in, ctx); +- +- MLX5_SET(modify_rq_in, in, rq_state, MLX5_RQC_STATE_RDY); +- MLX5_SET64(modify_rq_in, in, modify_bitmask, +- MLX5_MODIFY_RQ_IN_MODIFY_BITMASK_SCATTER_FCS); +- MLX5_SET(rqc, rqc, scatter_fcs, enable); +- MLX5_SET(rqc, rqc, state, MLX5_RQC_STATE_RDY); +- +- err = mlx5_core_modify_rq(mdev, rq->rqn, in); +- +- kvfree(in); +- +- return err; +-} +- + static int mlx5e_modify_rq_vsd(struct mlx5e_rq *rq, bool vsd) + { + struct mlx5_core_dev *mdev = rq->mdev; +@@ -2876,20 +2848,6 @@ static void mlx5e_cleanup_nic_tx(struct mlx5e_priv *priv) + mlx5e_destroy_tises(priv); + } + +-static int mlx5e_modify_channels_scatter_fcs(struct mlx5e_channels *chs, bool enable) +-{ +- int err = 0; +- int i; +- +- for (i = 0; i < chs->num; i++) { +- err = mlx5e_modify_rq_scatter_fcs(&chs->c[i]->rq, enable); +- if (err) +- return err; +- } +- +- return 0; +-} +- + static int mlx5e_modify_channels_vsd(struct mlx5e_channels *chs, bool vsd) + { + int err; +@@ -3401,41 +3359,27 @@ static int mlx5e_set_rx_port_ts(struct mlx5_core_dev *mdev, bool enable) + return mlx5_set_ports_check(mdev, in, sizeof(in)); + } + ++static int mlx5e_set_rx_port_ts_wrap(struct mlx5e_priv *priv, void *ctx) ++{ ++ struct mlx5_core_dev *mdev = priv->mdev; ++ bool enable = *(bool *)ctx; ++ ++ return mlx5e_set_rx_port_ts(mdev, enable); ++} ++ + static int set_feature_rx_fcs(struct net_device *netdev, bool enable) + { + struct mlx5e_priv *priv = netdev_priv(netdev); + struct mlx5e_channels *chs = &priv->channels; +- struct mlx5_core_dev *mdev = priv->mdev; ++ struct mlx5e_params new_params; + int err; + + mutex_lock(&priv->state_lock); + +- if (enable) { +- err = mlx5e_set_rx_port_ts(mdev, false); +- if (err) +- goto out; +- +- chs->params.scatter_fcs_en = true; +- err = mlx5e_modify_channels_scatter_fcs(chs, true); +- if (err) { +- chs->params.scatter_fcs_en = false; +- mlx5e_set_rx_port_ts(mdev, true); +- } +- } else { +- chs->params.scatter_fcs_en = false; +- err = mlx5e_modify_channels_scatter_fcs(chs, false); +- if (err) { +- chs->params.scatter_fcs_en = true; +- goto out; +- } +- err = mlx5e_set_rx_port_ts(mdev, true); +- if (err) { +- mlx5_core_warn(mdev, "Failed to set RX port timestamp %d\n", err); +- err = 0; +- } +- } +- +-out: ++ new_params = chs->params; ++ new_params.scatter_fcs_en = enable; ++ err = mlx5e_safe_switch_params(priv, &new_params, mlx5e_set_rx_port_ts_wrap, ++ &new_params.scatter_fcs_en, true); + mutex_unlock(&priv->state_lock); + return err; + } +-- +2.39.0 + diff --git a/queue-5.15/net-mscc-ocelot-fix-vcap-filters-not-matching-on-mac.patch b/queue-5.15/net-mscc-ocelot-fix-vcap-filters-not-matching-on-mac.patch new file mode 100644 index 00000000000..9e0cdd11263 --- /dev/null +++ b/queue-5.15/net-mscc-ocelot-fix-vcap-filters-not-matching-on-mac.patch @@ -0,0 +1,113 @@ +From 8237acb2d89d6d865180a482d922bfbed62c7ade Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Feb 2023 21:24:08 +0200 +Subject: net: mscc: ocelot: fix VCAP filters not matching on MAC with + "protocol 802.1Q" + +From: Vladimir Oltean + +[ Upstream commit f964f8399df29d3e3ced77177cf35131cd2491bf ] + +Alternative short title: don't instruct the hardware to match on +EtherType with "protocol 802.1Q" flower filters. It doesn't work for the +reasons detailed below. + +With a command such as the following: + +tc filter add dev $swp1 ingress chain $(IS1 2) pref 3 \ + protocol 802.1Q flower skip_sw vlan_id 200 src_mac $h1_mac \ + action vlan modify id 300 \ + action goto chain $(IS2 0 0) + +the created filter is set by ocelot_flower_parse_key() to be of type +OCELOT_VCAP_KEY_ETYPE, and etype is set to {value=0x8100, mask=0xffff}. +This gets propagated all the way to is1_entry_set() which commits it to +hardware (the VCAP_IS1_HK_ETYPE field of the key). Compare this to the +case where src_mac isn't specified - the key type is OCELOT_VCAP_KEY_ANY, +and is1_entry_set() doesn't populate VCAP_IS1_HK_ETYPE. + +The problem is that for VLAN-tagged frames, the hardware interprets the +ETYPE field as holding the encapsulated VLAN protocol. So the above +filter will only match those packets which have an encapsulated protocol +of 0x8100, rather than all packets with VLAN ID 200 and the given src_mac. + +The reason why this is allowed to occur is because, although we have a +block of code in ocelot_flower_parse_key() which sets "match_protocol" +to false when VLAN keys are present, that code executes too late. +There is another block of code, which executes for Ethernet addresses, +and has a "goto finished_key_parsing" and skips the VLAN header parsing. +By skipping it, "match_protocol" remains with the value it was +initialized with, i.e. "true", and "proto" is set to f->common.protocol, +or 0x8100. + +The concept of ignoring some keys rather than erroring out when they are +present but can't be offloaded is dubious in itself, but is present +since the initial commit fe3490e6107e ("net: mscc: ocelot: Hardware +ofload for tc flower filter"), and it's outside of the scope of this +patch to change that. + +The problem was introduced when the driver started to interpret the +flower filter's protocol, and populate the VCAP filter's ETYPE field +based on it. + +To fix this, it is sufficient to move the code that parses the VLAN keys +earlier than the "goto finished_key_parsing" instruction. This will +ensure that if we have a flower filter with both VLAN and Ethernet +address keys, it won't match on ETYPE 0x8100, because the VLAN key +parsing sets "match_protocol = false". + +Fixes: 86b956de119c ("net: mscc: ocelot: support matching on EtherType") +Signed-off-by: Vladimir Oltean +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230205192409.1796428-1-vladimir.oltean@nxp.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mscc/ocelot_flower.c | 24 +++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/ethernet/mscc/ocelot_flower.c b/drivers/net/ethernet/mscc/ocelot_flower.c +index a3a5ad5dbb0e0..b7e7bd744a1b8 100644 +--- a/drivers/net/ethernet/mscc/ocelot_flower.c ++++ b/drivers/net/ethernet/mscc/ocelot_flower.c +@@ -473,6 +473,18 @@ ocelot_flower_parse_key(struct ocelot *ocelot, int port, bool ingress, + flow_rule_match_control(rule, &match); + } + ++ if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_VLAN)) { ++ struct flow_match_vlan match; ++ ++ flow_rule_match_vlan(rule, &match); ++ filter->key_type = OCELOT_VCAP_KEY_ANY; ++ filter->vlan.vid.value = match.key->vlan_id; ++ filter->vlan.vid.mask = match.mask->vlan_id; ++ filter->vlan.pcp.value[0] = match.key->vlan_priority; ++ filter->vlan.pcp.mask[0] = match.mask->vlan_priority; ++ match_protocol = false; ++ } ++ + if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ETH_ADDRS)) { + struct flow_match_eth_addrs match; + +@@ -605,18 +617,6 @@ ocelot_flower_parse_key(struct ocelot *ocelot, int port, bool ingress, + match_protocol = false; + } + +- if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_VLAN)) { +- struct flow_match_vlan match; +- +- flow_rule_match_vlan(rule, &match); +- filter->key_type = OCELOT_VCAP_KEY_ANY; +- filter->vlan.vid.value = match.key->vlan_id; +- filter->vlan.vid.mask = match.mask->vlan_id; +- filter->vlan.pcp.value[0] = match.key->vlan_priority; +- filter->vlan.pcp.mask[0] = match.mask->vlan_priority; +- match_protocol = false; +- } +- + finished_key_parsing: + if (match_protocol && proto != ETH_P_ALL) { + if (filter->block_id == VCAP_ES0) { +-- +2.39.0 + diff --git a/queue-5.15/net-phy-meson-gxl-use-mmd-access-dummy-stubs-for-gxl.patch b/queue-5.15/net-phy-meson-gxl-use-mmd-access-dummy-stubs-for-gxl.patch new file mode 100644 index 00000000000..f73c1e90ac7 --- /dev/null +++ b/queue-5.15/net-phy-meson-gxl-use-mmd-access-dummy-stubs-for-gxl.patch @@ -0,0 +1,40 @@ +From a0a8eb2205d6d86dfbcbe01ec85a3966c859ea0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 21:45:36 +0100 +Subject: net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY + +From: Heiner Kallweit + +[ Upstream commit 69ff53e4a4c9498eeed7d1441f68a1481dc69251 ] + +Jerome provided the information that also the GXL internal PHY doesn't +support MMD register access and EEE. MMD reads return 0xffff, what +results in e.g. completely wrong ethtool --show-eee output. +Therefore use the MMD dummy stubs. + +Fixes: d853d145ea3e ("net: phy: add an option to disable EEE advertisement") +Suggested-by: Jerome Brunet +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/84432fe4-0be4-bc82-4e5c-557206b40f56@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/meson-gxl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/phy/meson-gxl.c b/drivers/net/phy/meson-gxl.c +index 5e41658b1e2fa..a6015cd03bff8 100644 +--- a/drivers/net/phy/meson-gxl.c ++++ b/drivers/net/phy/meson-gxl.c +@@ -261,6 +261,8 @@ static struct phy_driver meson_gxl_phy[] = { + .handle_interrupt = meson_gxl_handle_interrupt, + .suspend = genphy_suspend, + .resume = genphy_resume, ++ .read_mmd = genphy_read_mmd_unsupported, ++ .write_mmd = genphy_write_mmd_unsupported, + }, { + PHY_ID_MATCH_EXACT(0x01803301), + .name = "Meson G12A Internal PHY", +-- +2.39.0 + diff --git a/queue-5.15/net-phylink-move-phy_device_free-to-correctly-releas.patch b/queue-5.15/net-phylink-move-phy_device_free-to-correctly-releas.patch new file mode 100644 index 00000000000..2af7ecdef21 --- /dev/null +++ b/queue-5.15/net-phylink-move-phy_device_free-to-correctly-releas.patch @@ -0,0 +1,49 @@ +From 69f63675d09ca87bec6df91941dc08ea44ee8212 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 11:02:42 +0100 +Subject: net: phylink: move phy_device_free() to correctly release phy device +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Léger + +[ Upstream commit ce93fdb5f2ca5c9e2a9668411cc39091507f8dc9 ] + +After calling fwnode_phy_find_device(), the phy device refcount is +incremented. Then, when the phy device is attached to a netdev with +phy_attach_direct(), the refcount is also incremented but only +decremented in the caller if phy_attach_direct() fails. Move +phy_device_free() before the "if" to always release it correctly. +Indeed, either phy_attach_direct() failed and we don't want to keep a +reference to the phydev or it succeeded and a reference has been taken +internally. + +Fixes: 25396f680dd6 ("net: phylink: introduce phylink_fwnode_phy_connect()") +Signed-off-by: Clément Léger +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/phylink.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c +index 7afcf6310d59f..422dc92ecac94 100644 +--- a/drivers/net/phy/phylink.c ++++ b/drivers/net/phy/phylink.c +@@ -1166,10 +1166,9 @@ int phylink_fwnode_phy_connect(struct phylink *pl, + + ret = phy_attach_direct(pl->netdev, phy_dev, flags, + pl->link_interface); +- if (ret) { +- phy_device_free(phy_dev); ++ phy_device_free(phy_dev); ++ if (ret) + return ret; +- } + + ret = phylink_bringup_phy(pl, phy_dev, pl->link_config.interface); + if (ret) +-- +2.39.0 + diff --git a/queue-5.15/rdma-irdma-fix-potential-null-ptr-dereference.patch b/queue-5.15/rdma-irdma-fix-potential-null-ptr-dereference.patch new file mode 100644 index 00000000000..ebdc51f806f --- /dev/null +++ b/queue-5.15/rdma-irdma-fix-potential-null-ptr-dereference.patch @@ -0,0 +1,42 @@ +From 56fd8ed7707d46f707b57b30dce7a14b08ebc1b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 10:52:30 -0800 +Subject: RDMA/irdma: Fix potential NULL-ptr-dereference + +From: Nikita Zhandarovich + +[ Upstream commit 5d9745cead1f121974322b94ceadfb4d1e67960e ] + +in_dev_get() can return NULL which will cause a failure once idev is +dereferenced in in_dev_for_each_ifa_rtnl(). This patch adds a +check for NULL value in idev beforehand. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager") +Signed-off-by: Nikita Zhandarovich +Link: https://lore.kernel.org/r/20230126185230.62464-1-n.zhandarovich@fintech.ru +Reviewed-by: Sindhu Devale +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/cm.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/infiniband/hw/irdma/cm.c b/drivers/infiniband/hw/irdma/cm.c +index b08c67bb264c9..a8ec3d8f6e465 100644 +--- a/drivers/infiniband/hw/irdma/cm.c ++++ b/drivers/infiniband/hw/irdma/cm.c +@@ -1723,6 +1723,9 @@ irdma_add_mqh_4(struct irdma_device *iwdev, struct irdma_cm_info *cm_info, + continue; + + idev = in_dev_get(ip_dev); ++ if (!idev) ++ continue; ++ + in_dev_for_each_ifa_rtnl(ifa, idev) { + ibdev_dbg(&iwdev->ibdev, + "CM: Allocating child CM Listener forIP=%pI4, vlan_id=%d, MAC=%pM\n", +-- +2.39.0 + diff --git a/queue-5.15/rdma-usnic-use-iommu_map_atomic-under-spin_lock.patch b/queue-5.15/rdma-usnic-use-iommu_map_atomic-under-spin_lock.patch new file mode 100644 index 00000000000..0290576c9eb --- /dev/null +++ b/queue-5.15/rdma-usnic-use-iommu_map_atomic-under-spin_lock.patch @@ -0,0 +1,51 @@ +From 0f8838afd9936f6b45569e4b4af2b456b10861b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Jan 2023 17:37:57 +0800 +Subject: RDMA/usnic: use iommu_map_atomic() under spin_lock() + +From: Yang Yingliang + +[ Upstream commit b7e08a5a63a11627601915473c3b569c1f6c6c06 ] + +usnic_uiom_map_sorted_intervals() is called under spin_lock(), iommu_map() +might sleep, use iommu_map_atomic() to avoid potential sleep in atomic +context. + +Fixes: e3cf00d0a87f ("IB/usnic: Add Cisco VIC low-level hardware driver") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20230129093757.637354-1-yangyingliang@huawei.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/usnic/usnic_uiom.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/usnic/usnic_uiom.c b/drivers/infiniband/hw/usnic/usnic_uiom.c +index 760b254ba42d6..48a57568cad69 100644 +--- a/drivers/infiniband/hw/usnic/usnic_uiom.c ++++ b/drivers/infiniband/hw/usnic/usnic_uiom.c +@@ -281,8 +281,8 @@ static int usnic_uiom_map_sorted_intervals(struct list_head *intervals, + size = pa_end - pa_start + PAGE_SIZE; + usnic_dbg("va 0x%lx pa %pa size 0x%zx flags 0x%x", + va_start, &pa_start, size, flags); +- err = iommu_map(pd->domain, va_start, pa_start, +- size, flags); ++ err = iommu_map_atomic(pd->domain, va_start, ++ pa_start, size, flags); + if (err) { + usnic_err("Failed to map va 0x%lx pa %pa size 0x%zx with err %d\n", + va_start, &pa_start, size, err); +@@ -298,8 +298,8 @@ static int usnic_uiom_map_sorted_intervals(struct list_head *intervals, + size = pa - pa_start + PAGE_SIZE; + usnic_dbg("va 0x%lx pa %pa size 0x%zx flags 0x%x\n", + va_start, &pa_start, size, flags); +- err = iommu_map(pd->domain, va_start, pa_start, +- size, flags); ++ err = iommu_map_atomic(pd->domain, va_start, ++ pa_start, size, flags); + if (err) { + usnic_err("Failed to map va 0x%lx pa %pa size 0x%zx with err %d\n", + va_start, &pa_start, size, err); +-- +2.39.0 + diff --git a/queue-5.15/rds-rds_rm_zerocopy_callback-use-list_first_entry.patch b/queue-5.15/rds-rds_rm_zerocopy_callback-use-list_first_entry.patch new file mode 100644 index 00000000000..00e9d5ef71b --- /dev/null +++ b/queue-5.15/rds-rds_rm_zerocopy_callback-use-list_first_entry.patch @@ -0,0 +1,44 @@ +From cb33f695162333d6d7625d3c5eacc5b3c3de8fb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Feb 2023 18:26:34 +0000 +Subject: rds: rds_rm_zerocopy_callback() use list_first_entry() + +From: Pietro Borrello + +[ Upstream commit f753a68980cf4b59a80fe677619da2b1804f526d ] + +rds_rm_zerocopy_callback() uses list_entry() on the head of a list +causing a type confusion. +Use list_first_entry() to actually access the first element of the +rs_zcookie_queue list. + +Fixes: 9426bbc6de99 ("rds: use list structure to track information for zerocopy completion notification") +Reviewed-by: Willem de Bruijn +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230202-rds-zerocopy-v3-1-83b0df974f9a@diag.uniroma1.it +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/rds/message.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/rds/message.c b/net/rds/message.c +index 799034e0f513d..b363ef13c75ef 100644 +--- a/net/rds/message.c ++++ b/net/rds/message.c +@@ -104,9 +104,9 @@ static void rds_rm_zerocopy_callback(struct rds_sock *rs, + spin_lock_irqsave(&q->lock, flags); + head = &q->zcookie_head; + if (!list_empty(head)) { +- info = list_entry(head, struct rds_msg_zcopy_info, +- rs_zcookie_next); +- if (info && rds_zcookie_add(info, cookie)) { ++ info = list_first_entry(head, struct rds_msg_zcopy_info, ++ rs_zcookie_next); ++ if (rds_zcookie_add(info, cookie)) { + spin_unlock_irqrestore(&q->lock, flags); + kfree(rds_info_from_znotifier(znotif)); + /* caller invokes rds_wake_sk_sleep() */ +-- +2.39.0 + diff --git a/queue-5.15/riscv-stacktrace-fix-missing-the-first-frame.patch b/queue-5.15/riscv-stacktrace-fix-missing-the-first-frame.patch new file mode 100644 index 00000000000..323f2c34986 --- /dev/null +++ b/queue-5.15/riscv-stacktrace-fix-missing-the-first-frame.patch @@ -0,0 +1,76 @@ +From 91bed2bba786bbe8302cbdcd568c09d57653b62e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 10:50:38 +0800 +Subject: riscv: stacktrace: Fix missing the first frame + +From: Liu Shixin + +[ Upstream commit cb80242cc679d6397e77d8a964deeb3ff218d2b5 ] + +When running kfence_test, I found some testcases failed like this: + + # test_out_of_bounds_read: EXPECTATION FAILED at mm/kfence/kfence_test.c:346 + Expected report_matches(&expect) to be true, but is false + not ok 1 - test_out_of_bounds_read + +The corresponding call-trace is: + + BUG: KFENCE: out-of-bounds read in kunit_try_run_case+0x38/0x84 + + Out-of-bounds read at 0x(____ptrval____) (32B right of kfence-#10): + kunit_try_run_case+0x38/0x84 + kunit_generic_run_threadfn_adapter+0x12/0x1e + kthread+0xc8/0xde + ret_from_exception+0x0/0xc + +The kfence_test using the first frame of call trace to check whether the +testcase is succeed or not. Commit 6a00ef449370 ("riscv: eliminate +unreliable __builtin_frame_address(1)") skip first frame for all +case, which results the kfence_test failed. Indeed, we only need to skip +the first frame for case (task==NULL || task==current). + +With this patch, the call-trace will be: + + BUG: KFENCE: out-of-bounds read in test_out_of_bounds_read+0x88/0x19e + + Out-of-bounds read at 0x(____ptrval____) (1B left of kfence-#7): + test_out_of_bounds_read+0x88/0x19e + kunit_try_run_case+0x38/0x84 + kunit_generic_run_threadfn_adapter+0x12/0x1e + kthread+0xc8/0xde + ret_from_exception+0x0/0xc + +Fixes: 6a00ef449370 ("riscv: eliminate unreliable __builtin_frame_address(1)") +Signed-off-by: Liu Shixin +Tested-by: Samuel Holland +Link: https://lore.kernel.org/r/20221207025038.1022045-1-liushixin2@huawei.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/stacktrace.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/riscv/kernel/stacktrace.c b/arch/riscv/kernel/stacktrace.c +index 811e837a8c4ee..ee8ef91c8aaf4 100644 +--- a/arch/riscv/kernel/stacktrace.c ++++ b/arch/riscv/kernel/stacktrace.c +@@ -32,6 +32,7 @@ void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs, + fp = (unsigned long)__builtin_frame_address(0); + sp = sp_in_global; + pc = (unsigned long)walk_stackframe; ++ level = -1; + } else { + /* task blocked in __switch_to */ + fp = task->thread.s[0]; +@@ -43,7 +44,7 @@ void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs, + unsigned long low, high; + struct stackframe *frame; + +- if (unlikely(!__kernel_text_address(pc) || (level++ >= 1 && !fn(arg, pc)))) ++ if (unlikely(!__kernel_text_address(pc) || (level++ >= 0 && !fn(arg, pc)))) + break; + + /* Validate frame pointer */ +-- +2.39.0 + diff --git a/queue-5.15/selftests-forwarding-lib-quote-the-sysctl-values.patch b/queue-5.15/selftests-forwarding-lib-quote-the-sysctl-values.patch new file mode 100644 index 00000000000..e9c7db1fc87 --- /dev/null +++ b/queue-5.15/selftests-forwarding-lib-quote-the-sysctl-values.patch @@ -0,0 +1,46 @@ +From 24853dee522a046c9992f3b2cad068b8d51a9585 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Feb 2023 11:21:10 +0800 +Subject: selftests: forwarding: lib: quote the sysctl values + +From: Hangbin Liu + +[ Upstream commit 3a082086aa200852545cf15159213582c0c80eba ] + +When set/restore sysctl value, we should quote the value as some keys +may have multi values, e.g. net.ipv4.ping_group_range + +Fixes: f5ae57784ba8 ("selftests: forwarding: lib: Add sysctl_set(), sysctl_restore()") +Signed-off-by: Hangbin Liu +Reviewed-by: Petr Machata +Link: https://lore.kernel.org/r/20230208032110.879205-1-liuhangbin@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/forwarding/lib.sh | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh +index c9507df9c05bc..b7d946cf14eb5 100644 +--- a/tools/testing/selftests/net/forwarding/lib.sh ++++ b/tools/testing/selftests/net/forwarding/lib.sh +@@ -817,14 +817,14 @@ sysctl_set() + local value=$1; shift + + SYSCTL_ORIG[$key]=$(sysctl -n $key) +- sysctl -qw $key=$value ++ sysctl -qw $key="$value" + } + + sysctl_restore() + { + local key=$1; shift + +- sysctl -qw $key=${SYSCTL_ORIG["$key"]} ++ sysctl -qw $key="${SYSCTL_ORIG[$key]}" + } + + forwarding_enable() +-- +2.39.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 25d1d48b108..55a519a7772 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -12,3 +12,32 @@ alsa-hda-realtek-enable-mute-micmute-leds-on-hp-elitebook-645-g9.patch tracing-fix-poll-and-select-do-not-work-on-per_cpu-trace_pipe-and-trace_pipe_raw.patch of-address-return-an-error-when-no-valid-dma-ranges-are-found.patch can-j1939-do-not-wait-250-ms-if-the-same-addr-was-already-claimed.patch +xfrm-compat-change-expression-for-switch-in-xfrm_xla.patch +ib-hfi1-restore-allocated-resources-on-failed-copyou.patch +xfrm-compat-prevent-potential-spectre-v1-gadget-in-x.patch +ib-ipoib-fix-legacy-ipoib-due-to-wrong-number-of-que.patch +rdma-irdma-fix-potential-null-ptr-dereference.patch +rdma-usnic-use-iommu_map_atomic-under-spin_lock.patch +xfrm-fix-bug-with-dscp-copy-to-v6-from-v4-tunnel.patch +net-phylink-move-phy_device_free-to-correctly-releas.patch +bonding-fix-error-checking-in-bond_debug_reregister.patch +net-phy-meson-gxl-use-mmd-access-dummy-stubs-for-gxl.patch +ionic-clean-interrupt-before-enabling-queue-to-avoid.patch +uapi-add-missing-ip-ipv6-header-dependencies-for-lin.patch +ice-do-not-use-wq_mem_reclaim-flag-for-workqueue.patch +net-dsa-mt7530-don-t-change-pvc_eg_tag-when-cpu-port.patch +net-mscc-ocelot-fix-vcap-filters-not-matching-on-mac.patch +net-mlx5e-move-repeating-clear_bit-in-mlx5e_rx_repor.patch +net-mlx5e-introduce-the-mlx5e_flush_rq-function.patch +net-mlx5e-update-rx-ring-hw-mtu-upon-each-rx-fcs-fla.patch +net-mlx5-bridge-fix-ageing-of-peer-fdb-entries.patch +net-mlx5e-ipoib-show-unknown-speed-instead-of-error.patch +net-mlx5-fw_tracer-clear-load-bit-when-freeing-strin.patch +net-mlx5-fw_tracer-zero-consumer-index-when-reloadin.patch +net-mlx5-serialize-module-cleanup-with-reload-and-re.patch +igc-add-ndo_tx_timeout-support.patch +rds-rds_rm_zerocopy_callback-use-list_first_entry.patch +selftests-forwarding-lib-quote-the-sysctl-values.patch +alsa-pci-lx6464es-fix-a-debug-loop.patch +riscv-stacktrace-fix-missing-the-first-frame.patch +asoc-topology-return-enomem-on-memory-allocation-fai.patch diff --git a/queue-5.15/uapi-add-missing-ip-ipv6-header-dependencies-for-lin.patch b/queue-5.15/uapi-add-missing-ip-ipv6-header-dependencies-for-lin.patch new file mode 100644 index 00000000000..c456a77cc11 --- /dev/null +++ b/queue-5.15/uapi-add-missing-ip-ipv6-header-dependencies-for-lin.patch @@ -0,0 +1,70 @@ +From 80d9e865606967ba2f4a57ce2ccf342357ed7cd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Feb 2023 13:04:48 -0300 +Subject: uapi: add missing ip/ipv6 header dependencies for linux/stddef.h +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Herton R. Krzesinski + +[ Upstream commit 03702d4d29be4e2510ec80b248dbbde4e57030d9 ] + +Since commit 58e0be1ef6118 ("net: use struct_group to copy ip/ipv6 +header addresses"), ip and ipv6 headers started to use the __struct_group +definition, which is defined at include/uapi/linux/stddef.h. However, +linux/stddef.h isn't explicitly included in include/uapi/linux/{ip,ipv6}.h, +which breaks build of xskxceiver bpf selftest if you install the uapi +headers in the system: + +$ make V=1 xskxceiver -C tools/testing/selftests/bpf +... +make: Entering directory '(...)/tools/testing/selftests/bpf' +gcc -g -O0 -rdynamic -Wall -Werror (...) +In file included from xskxceiver.c:79: +/usr/include/linux/ip.h:103:9: error: expected specifier-qualifier-list before ‘__struct_group’ + 103 | __struct_group(/* no tag */, addrs, /* no attrs */, + | ^~~~~~~~~~~~~~ +... + +Include the missing dependency in ip.h and do the +same for the ipv6.h header. + +Fixes: 58e0be1ef611 ("net: use struct_group to copy ip/ipv6 header addresses") +Signed-off-by: Herton R. Krzesinski +Reviewed-by: Carlos O'Donell +Tested-by: Carlos O'Donell +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/uapi/linux/ip.h | 1 + + include/uapi/linux/ipv6.h | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/include/uapi/linux/ip.h b/include/uapi/linux/ip.h +index d2f143393780c..860bbf6bf29cb 100644 +--- a/include/uapi/linux/ip.h ++++ b/include/uapi/linux/ip.h +@@ -18,6 +18,7 @@ + #ifndef _UAPI_LINUX_IP_H + #define _UAPI_LINUX_IP_H + #include ++#include + #include + + #define IPTOS_TOS_MASK 0x1E +diff --git a/include/uapi/linux/ipv6.h b/include/uapi/linux/ipv6.h +index 62e5e16ef539d..39c6add59a1a6 100644 +--- a/include/uapi/linux/ipv6.h ++++ b/include/uapi/linux/ipv6.h +@@ -4,6 +4,7 @@ + + #include + #include ++#include + #include + #include + +-- +2.39.0 + diff --git a/queue-5.15/xfrm-compat-change-expression-for-switch-in-xfrm_xla.patch b/queue-5.15/xfrm-compat-change-expression-for-switch-in-xfrm_xla.patch new file mode 100644 index 00000000000..6ef95a970ab --- /dev/null +++ b/queue-5.15/xfrm-compat-change-expression-for-switch-in-xfrm_xla.patch @@ -0,0 +1,41 @@ +From b66b4b828ef3faa861ce30a359cbed7fc64df65d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 12:14:50 +0300 +Subject: xfrm: compat: change expression for switch in xfrm_xlate64 + +From: Anastasia Belova + +[ Upstream commit eb6c59b735aa6cca77cdbb59cc69d69a0d63d986 ] + +Compare XFRM_MSG_NEWSPDINFO (value from netlink +configuration messages enum) with nlh_src->nlmsg_type +instead of nlh_src->nlmsg_type - XFRM_MSG_BASE. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 4e9505064f58 ("net/xfrm/compat: Copy xfrm_spdattr_type_t atributes") +Signed-off-by: Anastasia Belova +Acked-by: Dmitry Safonov <0x7f454c46@gmail.com> +Tested-by: Dmitry Safonov <0x7f454c46@gmail.com> +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_compat.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/xfrm/xfrm_compat.c b/net/xfrm/xfrm_compat.c +index a0f62fa02e06e..12405aa5bce84 100644 +--- a/net/xfrm/xfrm_compat.c ++++ b/net/xfrm/xfrm_compat.c +@@ -302,7 +302,7 @@ static int xfrm_xlate64(struct sk_buff *dst, const struct nlmsghdr *nlh_src) + nla_for_each_attr(nla, attrs, len, remaining) { + int err; + +- switch (type) { ++ switch (nlh_src->nlmsg_type) { + case XFRM_MSG_NEWSPDINFO: + err = xfrm_nla_cpy(dst, nla, nla_len(nla)); + break; +-- +2.39.0 + diff --git a/queue-5.15/xfrm-compat-prevent-potential-spectre-v1-gadget-in-x.patch b/queue-5.15/xfrm-compat-prevent-potential-spectre-v1-gadget-in-x.patch new file mode 100644 index 00000000000..81ca6b8eebc --- /dev/null +++ b/queue-5.15/xfrm-compat-prevent-potential-spectre-v1-gadget-in-x.patch @@ -0,0 +1,58 @@ +From cf66cdd2a9f692b1f9bff5411bbcc71c87244cdb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jan 2023 13:02:49 +0000 +Subject: xfrm/compat: prevent potential spectre v1 gadget in + xfrm_xlate32_attr() + +From: Eric Dumazet + +[ Upstream commit b6ee896385380aa621102e8ea402ba12db1cabff ] + + int type = nla_type(nla); + + if (type > XFRMA_MAX) { + return -EOPNOTSUPP; + } + +@type is then used as an array index and can be used +as a Spectre v1 gadget. + + if (nla_len(nla) < compat_policy[type].len) { + +array_index_nospec() can be used to prevent leaking +content of kernel memory to malicious users. + +Fixes: 5106f4a8acff ("xfrm/compat: Add 32=>64-bit messages translator") +Signed-off-by: Eric Dumazet +Cc: Dmitry Safonov +Cc: Steffen Klassert +Reviewed-by: Dmitry Safonov +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_compat.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/xfrm/xfrm_compat.c b/net/xfrm/xfrm_compat.c +index 12405aa5bce84..8cbf45a8bcdc2 100644 +--- a/net/xfrm/xfrm_compat.c ++++ b/net/xfrm/xfrm_compat.c +@@ -5,6 +5,7 @@ + * Based on code and translator idea by: Florian Westphal + */ + #include ++#include + #include + #include + +@@ -437,6 +438,7 @@ static int xfrm_xlate32_attr(void *dst, const struct nlattr *nla, + NL_SET_ERR_MSG(extack, "Bad attribute"); + return -EOPNOTSUPP; + } ++ type = array_index_nospec(type, XFRMA_MAX + 1); + if (nla_len(nla) < compat_policy[type].len) { + NL_SET_ERR_MSG(extack, "Attribute bad length"); + return -EOPNOTSUPP; +-- +2.39.0 + diff --git a/queue-5.15/xfrm-fix-bug-with-dscp-copy-to-v6-from-v4-tunnel.patch b/queue-5.15/xfrm-fix-bug-with-dscp-copy-to-v6-from-v4-tunnel.patch new file mode 100644 index 00000000000..1f56c37508e --- /dev/null +++ b/queue-5.15/xfrm-fix-bug-with-dscp-copy-to-v6-from-v4-tunnel.patch @@ -0,0 +1,39 @@ +From 36b3842cb3f5a857e965275f42f368f474a53800 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 11:33:50 -0500 +Subject: xfrm: fix bug with DSCP copy to v6 from v4 tunnel + +From: Christian Hopps + +[ Upstream commit 6028da3f125fec34425dbd5fec18e85d372b2af6 ] + +When copying the DSCP bits for decap-dscp into IPv6 don't assume the +outer encap is always IPv6. Instead, as with the inner IPv4 case, copy +the DSCP bits from the correctly saved "tos" value in the control block. + +Fixes: 227620e29509 ("[IPSEC]: Separate inner/outer mode processing on input") +Signed-off-by: Christian Hopps +Acked-by: Herbert Xu +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_input.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c +index 3d8668d62e639..7c5958a2eed46 100644 +--- a/net/xfrm/xfrm_input.c ++++ b/net/xfrm/xfrm_input.c +@@ -278,8 +278,7 @@ static int xfrm6_remove_tunnel_encap(struct xfrm_state *x, struct sk_buff *skb) + goto out; + + if (x->props.flags & XFRM_STATE_DECAP_DSCP) +- ipv6_copy_dscp(ipv6_get_dsfield(ipv6_hdr(skb)), +- ipipv6_hdr(skb)); ++ ipv6_copy_dscp(XFRM_MODE_SKB_CB(skb)->tos, ipipv6_hdr(skb)); + if (!(x->props.flags & XFRM_STATE_NOECN)) + ipip6_ecn_decapsulate(skb); + +-- +2.39.0 +