From: Greg Kroah-Hartman Date: Sat, 18 Feb 2023 11:11:46 +0000 (+0100) Subject: 6.1-stable patches X-Git-Tag: v4.14.306~39 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8a5413ec2301c9e91f3229552cbd6af276c11873;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: drm-i915-gen11-wa_1408615072-wa_1407596294-should-be-on-gt-list.patch drm-vc4-crtc-increase-setup-cost-in-core-clock-calculation-to-handle-extreme-reduced-blanking.patch drm-vc4-fix-yuv-plane-handling-when-planes-are-in-different-buffers.patch i40e-add-double-of-vlan-header-when-computing-the-max-mtu.patch ice-fix-lost-multicast-packets-in-promisc-mode.patch ice-xsk-fix-cleaning-of-xdp_tx-frames.patch ixgbe-allow-to-increase-mtu-to-3k-with-xdp-enabled.patch net-bgmac-fix-bcm5358-support-by-setting-correct-flags.patch net-ethernet-ti-am65-cpsw-add-rx-dma-channel-teardown-quirk.patch net-sched-tcindex-update-imperfect-hash-filters-respecting-rcu.patch revert-squashfs-harden-sanity-check-in-squashfs_read_xattr_id_table.patch sctp-sctp_sock_filter-avoid-list_entry-on-possibly-empty-list.patch --- diff --git a/queue-6.1/drm-i915-gen11-wa_1408615072-wa_1407596294-should-be-on-gt-list.patch b/queue-6.1/drm-i915-gen11-wa_1408615072-wa_1407596294-should-be-on-gt-list.patch new file mode 100644 index 00000000000..a6d5a140916 --- /dev/null +++ b/queue-6.1/drm-i915-gen11-wa_1408615072-wa_1407596294-should-be-on-gt-list.patch @@ -0,0 +1,58 @@ +From d5a1224aa68c8b124a4c5c390186e571815ed390 Mon Sep 17 00:00:00 2001 +From: Matt Roper +Date: Wed, 1 Feb 2023 14:28:29 -0800 +Subject: drm/i915/gen11: Wa_1408615072/Wa_1407596294 should be on GT list + +From: Matt Roper + +commit d5a1224aa68c8b124a4c5c390186e571815ed390 upstream. + +The UNSLICE_UNIT_LEVEL_CLKGATE register programmed by this workaround +has 'BUS' style reset, indicating that it does not lose its value on +engine resets. Furthermore, this register is part of the GT forcewake +domain rather than the RENDER domain, so it should not be impacted by +RCS engine resets. As such, we should implement this on the GT +workaround list rather than an engine list. + +Bspec: 19219 +Fixes: 3551ff928744 ("drm/i915/gen11: Moving WAs to rcs_engine_wa_init()") +Signed-off-by: Matt Roper +Reviewed-by: Gustavo Sousa +Link: https://patchwork.freedesktop.org/patch/msgid/20230201222831.608281-2-matthew.d.roper@intel.com +(cherry picked from commit 5f21dc07b52eb54a908e66f5d6e05a87bcb5b049) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gt/intel_workarounds.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c ++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c +@@ -1249,6 +1249,13 @@ icl_gt_workarounds_init(struct intel_gt + GAMT_CHKN_BIT_REG, + GAMT_CHKN_DISABLE_L3_COH_PIPE); + ++ /* ++ * Wa_1408615072:icl,ehl (vsunit) ++ * Wa_1407596294:icl,ehl (hsunit) ++ */ ++ wa_write_or(wal, UNSLICE_UNIT_LEVEL_CLKGATE, ++ VSUNIT_CLKGATE_DIS | HSUNIT_CLKGATE_DIS); ++ + /* Wa_1407352427:icl,ehl */ + wa_write_or(wal, UNSLICE_UNIT_LEVEL_CLKGATE2, + PSDUNIT_CLKGATE_DIS); +@@ -2369,13 +2376,6 @@ rcs_engine_wa_init(struct intel_engine_c + GEN11_ENABLE_32_PLANE_MODE); + + /* +- * Wa_1408615072:icl,ehl (vsunit) +- * Wa_1407596294:icl,ehl (hsunit) +- */ +- wa_write_or(wal, UNSLICE_UNIT_LEVEL_CLKGATE, +- VSUNIT_CLKGATE_DIS | HSUNIT_CLKGATE_DIS); +- +- /* + * Wa_1408767742:icl[a2..forever],ehl[all] + * Wa_1605460711:icl[a0..c0] + */ diff --git a/queue-6.1/drm-vc4-crtc-increase-setup-cost-in-core-clock-calculation-to-handle-extreme-reduced-blanking.patch b/queue-6.1/drm-vc4-crtc-increase-setup-cost-in-core-clock-calculation-to-handle-extreme-reduced-blanking.patch new file mode 100644 index 00000000000..8592fd8c644 --- /dev/null +++ b/queue-6.1/drm-vc4-crtc-increase-setup-cost-in-core-clock-calculation-to-handle-extreme-reduced-blanking.patch @@ -0,0 +1,43 @@ +From 247a631f9c0ffb37ed0786a94cb4c5f2b6fc7ab1 Mon Sep 17 00:00:00 2001 +From: Dom Cobley +Date: Fri, 27 Jan 2023 15:55:58 +0100 +Subject: drm/vc4: crtc: Increase setup cost in core clock calculation to handle extreme reduced blanking + +From: Dom Cobley + +commit 247a631f9c0ffb37ed0786a94cb4c5f2b6fc7ab1 upstream. + +The formula that determines the core clock requirement based on pixel +clock and blanking has been determined experimentally to minimise the +clock while supporting all modes we've seen. + +A new reduced blanking mode (4kp60 at 533MHz rather than the standard +594MHz) has been seen that doesn't produce a high enough clock and +results in "flip_done timed out" error. + +Increase the setup cost in the formula to make this work. The result is +a reduced blanking mode increases by up to 7MHz while leaving the +standard timing +mode untouched + +Link: https://github.com/raspberrypi/linux/issues/4446 +Fixes: 16e101051f32 ("drm/vc4: Increase the core clock based on HVS load") +Signed-off-by: Dom Cobley +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20230127145558.446123-1-maxime@cerno.tech +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vc4/vc4_crtc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vc4/vc4_crtc.c ++++ b/drivers/gpu/drm/vc4/vc4_crtc.c +@@ -711,7 +711,7 @@ static int vc4_crtc_atomic_check(struct + struct vc4_encoder *vc4_encoder = to_vc4_encoder(encoder); + + if (vc4_encoder->type == VC4_ENCODER_TYPE_HDMI0) { +- vc4_state->hvs_load = max(mode->clock * mode->hdisplay / mode->htotal + 1000, ++ vc4_state->hvs_load = max(mode->clock * mode->hdisplay / mode->htotal + 8000, + mode->clock * 9 / 10) * 1000; + } else { + vc4_state->hvs_load = mode->clock * 1000; diff --git a/queue-6.1/drm-vc4-fix-yuv-plane-handling-when-planes-are-in-different-buffers.patch b/queue-6.1/drm-vc4-fix-yuv-plane-handling-when-planes-are-in-different-buffers.patch new file mode 100644 index 00000000000..eaeba7b7465 --- /dev/null +++ b/queue-6.1/drm-vc4-fix-yuv-plane-handling-when-planes-are-in-different-buffers.patch @@ -0,0 +1,51 @@ +From 6b77b16de75a6efc0870b1fa467209387cbee8f3 Mon Sep 17 00:00:00 2001 +From: Dave Stevenson +Date: Fri, 27 Jan 2023 16:57:08 +0100 +Subject: drm/vc4: Fix YUV plane handling when planes are in different buffers + +From: Dave Stevenson + +commit 6b77b16de75a6efc0870b1fa467209387cbee8f3 upstream. + +YUV images can either be presented as one allocation with offsets +for the different planes, or multiple allocations with 0 offsets. + +The driver only ever calls drm_fb_[dma|cma]_get_gem_obj with plane +index 0, therefore any application using the second approach was +incorrectly rendered. + +Correctly determine the address for each plane, removing the +assumption that the base address is the same for each. + +Fixes: fc04023fafec ("drm/vc4: Add support for YUV planes.") +Signed-off-by: Dave Stevenson +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20230127155708.454704-1-maxime@cerno.tech +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vc4/vc4_plane.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/vc4/vc4_plane.c ++++ b/drivers/gpu/drm/vc4/vc4_plane.c +@@ -340,7 +340,7 @@ static int vc4_plane_setup_clipping_and_ + { + struct vc4_plane_state *vc4_state = to_vc4_plane_state(state); + struct drm_framebuffer *fb = state->fb; +- struct drm_gem_dma_object *bo = drm_fb_dma_get_gem_obj(fb, 0); ++ struct drm_gem_dma_object *bo; + int num_planes = fb->format->num_planes; + struct drm_crtc_state *crtc_state; + u32 h_subsample = fb->format->hsub; +@@ -359,8 +359,10 @@ static int vc4_plane_setup_clipping_and_ + if (ret) + return ret; + +- for (i = 0; i < num_planes; i++) ++ for (i = 0; i < num_planes; i++) { ++ bo = drm_fb_dma_get_gem_obj(fb, i); + vc4_state->offsets[i] = bo->dma_addr + fb->offsets[i]; ++ } + + /* + * We don't support subpixel source positioning for scaling, diff --git a/queue-6.1/i40e-add-double-of-vlan-header-when-computing-the-max-mtu.patch b/queue-6.1/i40e-add-double-of-vlan-header-when-computing-the-max-mtu.patch new file mode 100644 index 00000000000..3045ad03512 --- /dev/null +++ b/queue-6.1/i40e-add-double-of-vlan-header-when-computing-the-max-mtu.patch @@ -0,0 +1,33 @@ +From ce45ffb815e8e238f05de1630be3969b6bb15e4e Mon Sep 17 00:00:00 2001 +From: Jason Xing +Date: Wed, 8 Feb 2023 10:43:33 +0800 +Subject: i40e: add double of VLAN header when computing the max MTU + +From: Jason Xing + +commit ce45ffb815e8e238f05de1630be3969b6bb15e4e upstream. + +Include the second VLAN HLEN into account when computing the maximum +MTU size as other drivers do. + +Fixes: 0c8493d90b6b ("i40e: add XDP support for pass and drop actions") +Signed-off-by: Jason Xing +Reviewed-by: Alexander Duyck +Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -2921,7 +2921,7 @@ static int i40e_change_mtu(struct net_de + struct i40e_pf *pf = vsi->back; + + if (i40e_enabled_xdp_vsi(vsi)) { +- int frame_size = new_mtu + ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN; ++ int frame_size = new_mtu + I40E_PACKET_HDR_PAD; + + if (frame_size > i40e_max_xdp_frame_size(vsi)) + return -EINVAL; diff --git a/queue-6.1/ice-fix-lost-multicast-packets-in-promisc-mode.patch b/queue-6.1/ice-fix-lost-multicast-packets-in-promisc-mode.patch new file mode 100644 index 00000000000..42ebbac5e03 --- /dev/null +++ b/queue-6.1/ice-fix-lost-multicast-packets-in-promisc-mode.patch @@ -0,0 +1,99 @@ +From 43fbca02c2ddc39ff5879b6f3a4a097b1ba02098 Mon Sep 17 00:00:00 2001 +From: Jesse Brandeburg +Date: Mon, 6 Feb 2023 15:54:36 -0800 +Subject: ice: fix lost multicast packets in promisc mode + +From: Jesse Brandeburg + +commit 43fbca02c2ddc39ff5879b6f3a4a097b1ba02098 upstream. + +There was a problem reported to us where the addition of a VF with an IPv6 +address ending with a particular sequence would cause the parent device on +the PF to no longer be able to respond to neighbor discovery packets. + +In this case, we had an ovs-bridge device living on top of a VLAN, which +was on top of a PF, and it would not be able to talk anymore (the neighbor +entry would expire and couldn't be restored). + +The root cause of the issue is that if the PF is asked to be in IFF_PROMISC +mode (promiscuous mode) and it had an ipv6 address that needed the +33:33:ff:00:00:04 multicast address to work, then when the VF was added +with the need for the same multicast address, the VF would steal all the +traffic destined for that address. + +The ice driver didn't auto-subscribe a request of IFF_PROMISC to the +"multicast replication from other port's traffic" meaning that it won't get +for instance, packets with an exact destination in the VF, as above. + +The VF's IPv6 address, which adds a "perfect filter" for 33:33:ff:00:00:04, +results in no packets for that multicast address making it to the PF (which +is in promisc but NOT "multicast replication"). + +The fix is to enable "multicast promiscuous" whenever the driver is asked +to enable IFF_PROMISC, and make sure to disable it when appropriate. + +Fixes: e94d44786693 ("ice: Implement filter sync, NDO operations and bump version") +Signed-off-by: Jesse Brandeburg +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_main.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -270,6 +270,8 @@ static int ice_set_promisc(struct ice_vs + if (status && status != -EEXIST) + return status; + ++ netdev_dbg(vsi->netdev, "set promisc filter bits for VSI %i: 0x%x\n", ++ vsi->vsi_num, promisc_m); + return 0; + } + +@@ -295,6 +297,8 @@ static int ice_clear_promisc(struct ice_ + promisc_m, 0); + } + ++ netdev_dbg(vsi->netdev, "clear promisc filter bits for VSI %i: 0x%x\n", ++ vsi->vsi_num, promisc_m); + return status; + } + +@@ -423,6 +427,16 @@ static int ice_vsi_sync_fltr(struct ice_ + } + err = 0; + vlan_ops->dis_rx_filtering(vsi); ++ ++ /* promiscuous mode implies allmulticast so ++ * that VSIs that are in promiscuous mode are ++ * subscribed to multicast packets coming to ++ * the port ++ */ ++ err = ice_set_promisc(vsi, ++ ICE_MCAST_PROMISC_BITS); ++ if (err) ++ goto out_promisc; + } + } else { + /* Clear Rx filter to remove traffic from wire */ +@@ -439,6 +453,18 @@ static int ice_vsi_sync_fltr(struct ice_ + NETIF_F_HW_VLAN_CTAG_FILTER) + vlan_ops->ena_rx_filtering(vsi); + } ++ ++ /* disable allmulti here, but only if allmulti is not ++ * still enabled for the netdev ++ */ ++ if (!(vsi->current_netdev_flags & IFF_ALLMULTI)) { ++ err = ice_clear_promisc(vsi, ++ ICE_MCAST_PROMISC_BITS); ++ if (err) { ++ netdev_err(netdev, "Error %d clearing multicast promiscuous on VSI %i\n", ++ err, vsi->vsi_num); ++ } ++ } + } + } + goto exit; diff --git a/queue-6.1/ice-xsk-fix-cleaning-of-xdp_tx-frames.patch b/queue-6.1/ice-xsk-fix-cleaning-of-xdp_tx-frames.patch new file mode 100644 index 00000000000..2f2378ea396 --- /dev/null +++ b/queue-6.1/ice-xsk-fix-cleaning-of-xdp_tx-frames.patch @@ -0,0 +1,74 @@ +From 1f090494170ea298530cf1285fb8d078e355b4c0 Mon Sep 17 00:00:00 2001 +From: Larysa Zaremba +Date: Thu, 9 Feb 2023 17:01:30 +0100 +Subject: ice: xsk: Fix cleaning of XDP_TX frames + +From: Larysa Zaremba + +commit 1f090494170ea298530cf1285fb8d078e355b4c0 upstream. + +Incrementation of xsk_frames inside the for-loop produces +infinite loop, if we have both normal AF_XDP-TX and XDP_TXed +buffers to complete. + +Split xsk_frames into 2 variables (xsk_frames and completed_frames) +to eliminate this bug. + +Fixes: 29322791bc8b ("ice: xsk: change batched Tx descriptor cleaning") +Acked-by: Maciej Fijalkowski +Signed-off-by: Larysa Zaremba +Reviewed-by: Alexander Duyck +Acked-by: Tony Nguyen +Link: https://lore.kernel.org/r/20230209160130.1779890-1-larysa.zaremba@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_xsk.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/intel/ice/ice_xsk.c ++++ b/drivers/net/ethernet/intel/ice/ice_xsk.c +@@ -789,6 +789,7 @@ static void ice_clean_xdp_irq_zc(struct + struct ice_tx_desc *tx_desc; + u16 cnt = xdp_ring->count; + struct ice_tx_buf *tx_buf; ++ u16 completed_frames = 0; + u16 xsk_frames = 0; + u16 last_rs; + int i; +@@ -798,19 +799,21 @@ static void ice_clean_xdp_irq_zc(struct + if ((tx_desc->cmd_type_offset_bsz & + cpu_to_le64(ICE_TX_DESC_DTYPE_DESC_DONE))) { + if (last_rs >= ntc) +- xsk_frames = last_rs - ntc + 1; ++ completed_frames = last_rs - ntc + 1; + else +- xsk_frames = last_rs + cnt - ntc + 1; ++ completed_frames = last_rs + cnt - ntc + 1; + } + +- if (!xsk_frames) ++ if (!completed_frames) + return; + +- if (likely(!xdp_ring->xdp_tx_active)) ++ if (likely(!xdp_ring->xdp_tx_active)) { ++ xsk_frames = completed_frames; + goto skip; ++ } + + ntc = xdp_ring->next_to_clean; +- for (i = 0; i < xsk_frames; i++) { ++ for (i = 0; i < completed_frames; i++) { + tx_buf = &xdp_ring->tx_buf[ntc]; + + if (tx_buf->raw_buf) { +@@ -826,7 +829,7 @@ static void ice_clean_xdp_irq_zc(struct + } + skip: + tx_desc->cmd_type_offset_bsz = 0; +- xdp_ring->next_to_clean += xsk_frames; ++ xdp_ring->next_to_clean += completed_frames; + if (xdp_ring->next_to_clean >= cnt) + xdp_ring->next_to_clean -= cnt; + if (xsk_frames) diff --git a/queue-6.1/ixgbe-allow-to-increase-mtu-to-3k-with-xdp-enabled.patch b/queue-6.1/ixgbe-allow-to-increase-mtu-to-3k-with-xdp-enabled.patch new file mode 100644 index 00000000000..f185e9182ec --- /dev/null +++ b/queue-6.1/ixgbe-allow-to-increase-mtu-to-3k-with-xdp-enabled.patch @@ -0,0 +1,75 @@ +From f9cd6a4418bac6a046ee78382423b1ae7565fb24 Mon Sep 17 00:00:00 2001 +From: Jason Xing +Date: Wed, 8 Feb 2023 10:43:32 +0800 +Subject: ixgbe: allow to increase MTU to 3K with XDP enabled + +From: Jason Xing + +commit f9cd6a4418bac6a046ee78382423b1ae7565fb24 upstream. + +Recently I encountered one case where I cannot increase the MTU size +directly from 1500 to a much bigger value with XDP enabled if the +server is equipped with IXGBE card, which happened on thousands of +servers in production environment. After applying the current patch, +we can set the maximum MTU size to 3K. + +This patch follows the behavior of changing MTU as i40e/ice does. + +References: +[1] commit 23b44513c3e6 ("ice: allow 3k MTU for XDP") +[2] commit 0c8493d90b6b ("i40e: add XDP support for pass and drop actions") + +Fixes: fabf1bce103a ("ixgbe: Prevent unsupported configurations with XDP") +Signed-off-by: Jason Xing +Reviewed-by: Alexander Duyck +Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 25 ++++++++++++++++--------- + 1 file changed, 16 insertions(+), 9 deletions(-) + +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -6778,6 +6778,18 @@ static void ixgbe_free_all_rx_resources( + } + + /** ++ * ixgbe_max_xdp_frame_size - returns the maximum allowed frame size for XDP ++ * @adapter: device handle, pointer to adapter ++ */ ++static int ixgbe_max_xdp_frame_size(struct ixgbe_adapter *adapter) ++{ ++ if (PAGE_SIZE >= 8192 || adapter->flags2 & IXGBE_FLAG2_RX_LEGACY) ++ return IXGBE_RXBUFFER_2K; ++ else ++ return IXGBE_RXBUFFER_3K; ++} ++ ++/** + * ixgbe_change_mtu - Change the Maximum Transfer Unit + * @netdev: network interface device structure + * @new_mtu: new value for maximum frame size +@@ -6788,18 +6800,13 @@ static int ixgbe_change_mtu(struct net_d + { + struct ixgbe_adapter *adapter = netdev_priv(netdev); + +- if (adapter->xdp_prog) { ++ if (ixgbe_enabled_xdp_adapter(adapter)) { + int new_frame_size = new_mtu + ETH_HLEN + ETH_FCS_LEN + + VLAN_HLEN; +- int i; +- +- for (i = 0; i < adapter->num_rx_queues; i++) { +- struct ixgbe_ring *ring = adapter->rx_ring[i]; + +- if (new_frame_size > ixgbe_rx_bufsz(ring)) { +- e_warn(probe, "Requested MTU size is not supported with XDP\n"); +- return -EINVAL; +- } ++ if (new_frame_size > ixgbe_max_xdp_frame_size(adapter)) { ++ e_warn(probe, "Requested MTU size is not supported with XDP\n"); ++ return -EINVAL; + } + } + diff --git a/queue-6.1/net-bgmac-fix-bcm5358-support-by-setting-correct-flags.patch b/queue-6.1/net-bgmac-fix-bcm5358-support-by-setting-correct-flags.patch new file mode 100644 index 00000000000..bd01e356c87 --- /dev/null +++ b/queue-6.1/net-bgmac-fix-bcm5358-support-by-setting-correct-flags.patch @@ -0,0 +1,51 @@ +From d61615c366a489646a1bfe5b33455f916762d5f4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= +Date: Wed, 8 Feb 2023 10:16:37 +0100 +Subject: net: bgmac: fix BCM5358 support by setting correct flags +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +commit d61615c366a489646a1bfe5b33455f916762d5f4 upstream. + +Code blocks handling BCMA_CHIP_ID_BCM5357 and BCMA_CHIP_ID_BCM53572 were +incorrectly unified. Chip package values are not unique and cannot be +checked independently. They are meaningful only in a context of a given +chip. + +Packages BCM5358 and BCM47188 share the same value but then belong to +different chips. Code unification resulted in treating BCM5358 as +BCM47188 and broke its initialization. + +Link: https://github.com/openwrt/openwrt/issues/8278 +Fixes: cb1b0f90acfe ("net: ethernet: bgmac: unify code of the same family") +Cc: Jon Mason +Signed-off-by: Rafał Miłecki +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20230208091637.16291-1-zajec5@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bgmac-bcma.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bgmac-bcma.c ++++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c +@@ -240,12 +240,12 @@ static int bgmac_probe(struct bcma_devic + bgmac->feature_flags |= BGMAC_FEAT_CLKCTLST; + bgmac->feature_flags |= BGMAC_FEAT_FLW_CTRL1; + bgmac->feature_flags |= BGMAC_FEAT_SW_TYPE_PHY; +- if (ci->pkg == BCMA_PKG_ID_BCM47188 || +- ci->pkg == BCMA_PKG_ID_BCM47186) { ++ if ((ci->id == BCMA_CHIP_ID_BCM5357 && ci->pkg == BCMA_PKG_ID_BCM47186) || ++ (ci->id == BCMA_CHIP_ID_BCM53572 && ci->pkg == BCMA_PKG_ID_BCM47188)) { + bgmac->feature_flags |= BGMAC_FEAT_SW_TYPE_RGMII; + bgmac->feature_flags |= BGMAC_FEAT_IOST_ATTACHED; + } +- if (ci->pkg == BCMA_PKG_ID_BCM5358) ++ if (ci->id == BCMA_CHIP_ID_BCM5357 && ci->pkg == BCMA_PKG_ID_BCM5358) + bgmac->feature_flags |= BGMAC_FEAT_SW_TYPE_EPHYRMII; + break; + case BCMA_CHIP_ID_BCM53573: diff --git a/queue-6.1/net-ethernet-ti-am65-cpsw-add-rx-dma-channel-teardown-quirk.patch b/queue-6.1/net-ethernet-ti-am65-cpsw-add-rx-dma-channel-teardown-quirk.patch new file mode 100644 index 00000000000..c52bf9cee90 --- /dev/null +++ b/queue-6.1/net-ethernet-ti-am65-cpsw-add-rx-dma-channel-teardown-quirk.patch @@ -0,0 +1,82 @@ +From 0ed577e7e8e508c24e22ba07713ecc4903e147c3 Mon Sep 17 00:00:00 2001 +From: Siddharth Vadapalli +Date: Thu, 9 Feb 2023 14:14:32 +0530 +Subject: net: ethernet: ti: am65-cpsw: Add RX DMA Channel Teardown Quirk + +From: Siddharth Vadapalli + +commit 0ed577e7e8e508c24e22ba07713ecc4903e147c3 upstream. + +In TI's AM62x/AM64x SoCs, successful teardown of RX DMA Channel raises an +interrupt. The process of servicing this interrupt involves flushing all +pending RX DMA descriptors and clearing the teardown completion marker +(TDCM). The am65_cpsw_nuss_rx_packets() function invoked from the RX +NAPI callback services the interrupt. Thus, it is necessary to wait for +this handler to run, drain all packets and clear TDCM, before calling +napi_disable() in am65_cpsw_nuss_common_stop() function post channel +teardown. If napi_disable() executes before ensuring that TDCM is +cleared, the TDCM remains set when the interfaces are down, resulting in +an interrupt storm when the interfaces are brought up again. + +Since the interrupt raised to indicate the RX DMA Channel teardown is +specific to the AM62x and AM64x SoCs, add a quirk for it. + +Fixes: 4f7cce272403 ("net: ethernet: ti: am65-cpsw: add support for am64x cpsw3g") +Co-developed-by: Vignesh Raghavendra +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Siddharth Vadapalli +Reviewed-by: Roger Quadros +Link: https://lore.kernel.org/r/20230209084432.189222-1-s-vadapalli@ti.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 12 +++++++++++- + drivers/net/ethernet/ti/am65-cpsw-nuss.h | 1 + + 2 files changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c ++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +@@ -500,7 +500,15 @@ static int am65_cpsw_nuss_common_stop(st + k3_udma_glue_disable_tx_chn(common->tx_chns[i].tx_chn); + } + ++ reinit_completion(&common->tdown_complete); + k3_udma_glue_tdown_rx_chn(common->rx_chns.rx_chn, true); ++ ++ if (common->pdata.quirks & AM64_CPSW_QUIRK_DMA_RX_TDOWN_IRQ) { ++ i = wait_for_completion_timeout(&common->tdown_complete, msecs_to_jiffies(1000)); ++ if (!i) ++ dev_err(common->dev, "rx teardown timeout\n"); ++ } ++ + napi_disable(&common->napi_rx); + + for (i = 0; i < AM65_CPSW_MAX_RX_FLOWS; i++) +@@ -704,6 +712,8 @@ static int am65_cpsw_nuss_rx_packets(str + + if (cppi5_desc_is_tdcm(desc_dma)) { + dev_dbg(dev, "%s RX tdown flow: %u\n", __func__, flow_idx); ++ if (common->pdata.quirks & AM64_CPSW_QUIRK_DMA_RX_TDOWN_IRQ) ++ complete(&common->tdown_complete); + return 0; + } + +@@ -2634,7 +2644,7 @@ static const struct am65_cpsw_pdata j721 + }; + + static const struct am65_cpsw_pdata am64x_cpswxg_pdata = { +- .quirks = 0, ++ .quirks = AM64_CPSW_QUIRK_DMA_RX_TDOWN_IRQ, + .ale_dev_id = "am64-cpswxg", + .fdqring_mode = K3_RINGACC_RING_MODE_RING, + }; +--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.h ++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.h +@@ -86,6 +86,7 @@ struct am65_cpsw_rx_chn { + }; + + #define AM65_CPSW_QUIRK_I2027_NO_TX_CSUM BIT(0) ++#define AM64_CPSW_QUIRK_DMA_RX_TDOWN_IRQ BIT(1) + + struct am65_cpsw_pdata { + u32 quirks; diff --git a/queue-6.1/net-sched-tcindex-update-imperfect-hash-filters-respecting-rcu.patch b/queue-6.1/net-sched-tcindex-update-imperfect-hash-filters-respecting-rcu.patch new file mode 100644 index 00000000000..49ad05bed4b --- /dev/null +++ b/queue-6.1/net-sched-tcindex-update-imperfect-hash-filters-respecting-rcu.patch @@ -0,0 +1,101 @@ +From ee059170b1f7e94e55fa6cadee544e176a6e59c2 Mon Sep 17 00:00:00 2001 +From: Pedro Tammela +Date: Thu, 9 Feb 2023 11:37:39 -0300 +Subject: net/sched: tcindex: update imperfect hash filters respecting rcu + +From: Pedro Tammela + +commit ee059170b1f7e94e55fa6cadee544e176a6e59c2 upstream. + +The imperfect hash area can be updated while packets are traversing, +which will cause a use-after-free when 'tcf_exts_exec()' is called +with the destroyed tcf_ext. + +CPU 0: CPU 1: +tcindex_set_parms tcindex_classify +tcindex_lookup + tcindex_lookup +tcf_exts_change + tcf_exts_exec [UAF] + +Stop operating on the shared area directly, by using a local copy, +and update the filter with 'rcu_replace_pointer()'. Delete the old +filter version only after a rcu grace period elapsed. + +Fixes: 9b0d4446b569 ("net: sched: avoid atomic swap in tcf_exts_change") +Reported-by: valis +Suggested-by: valis +Signed-off-by: Jamal Hadi Salim +Signed-off-by: Pedro Tammela +Link: https://lore.kernel.org/r/20230209143739.279867-1-pctammela@mojatatu.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/cls_tcindex.c | 34 ++++++++++++++++++++++++++++++---- + 1 file changed, 30 insertions(+), 4 deletions(-) + +--- a/net/sched/cls_tcindex.c ++++ b/net/sched/cls_tcindex.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -338,6 +339,7 @@ tcindex_set_parms(struct net *net, struc + struct tcf_result cr = {}; + int err, balloc = 0; + struct tcf_exts e; ++ bool update_h = false; + + err = tcf_exts_init(&e, net, TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE); + if (err < 0) +@@ -455,10 +457,13 @@ tcindex_set_parms(struct net *net, struc + } + } + +- if (cp->perfect) ++ if (cp->perfect) { + r = cp->perfect + handle; +- else +- r = tcindex_lookup(cp, handle) ? : &new_filter_result; ++ } else { ++ /* imperfect area is updated in-place using rcu */ ++ update_h = !!tcindex_lookup(cp, handle); ++ r = &new_filter_result; ++ } + + if (r == &new_filter_result) { + f = kzalloc(sizeof(*f), GFP_KERNEL); +@@ -484,7 +489,28 @@ tcindex_set_parms(struct net *net, struc + + rcu_assign_pointer(tp->root, cp); + +- if (r == &new_filter_result) { ++ if (update_h) { ++ struct tcindex_filter __rcu **fp; ++ struct tcindex_filter *cf; ++ ++ f->result.res = r->res; ++ tcf_exts_change(&f->result.exts, &r->exts); ++ ++ /* imperfect area bucket */ ++ fp = cp->h + (handle % cp->hash); ++ ++ /* lookup the filter, guaranteed to exist */ ++ for (cf = rcu_dereference_bh_rtnl(*fp); cf; ++ fp = &cf->next, cf = rcu_dereference_bh_rtnl(*fp)) ++ if (cf->key == handle) ++ break; ++ ++ f->next = cf->next; ++ ++ cf = rcu_replace_pointer(*fp, f, 1); ++ tcf_exts_get_net(&cf->result.exts); ++ tcf_queue_work(&cf->rwork, tcindex_destroy_fexts_work); ++ } else if (r == &new_filter_result) { + struct tcindex_filter *nfp; + struct tcindex_filter __rcu **fp; + diff --git a/queue-6.1/revert-squashfs-harden-sanity-check-in-squashfs_read_xattr_id_table.patch b/queue-6.1/revert-squashfs-harden-sanity-check-in-squashfs_read_xattr_id_table.patch new file mode 100644 index 00000000000..974691a3a2d --- /dev/null +++ b/queue-6.1/revert-squashfs-harden-sanity-check-in-squashfs_read_xattr_id_table.patch @@ -0,0 +1,34 @@ +From a5b21d8d791cd4db609d0bbcaa9e0c7e019888d1 Mon Sep 17 00:00:00 2001 +From: Andrew Morton +Date: Thu, 2 Feb 2023 18:07:35 -0800 +Subject: revert "squashfs: harden sanity check in squashfs_read_xattr_id_table" + +From: Andrew Morton + +commit a5b21d8d791cd4db609d0bbcaa9e0c7e019888d1 upstream. + +This fix was nacked by Philip, for reasons identified in the email linked +below. + +Link: https://lkml.kernel.org/r/68f15d67-8945-2728-1f17-5b53a80ec52d@squashfs.org.uk +Fixes: 72e544b1b28325 ("squashfs: harden sanity check in squashfs_read_xattr_id_table") +Cc: Alexey Khoroshilov +Cc: Fedor Pchelkin +Cc: Phillip Lougher +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/squashfs/xattr_id.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/squashfs/xattr_id.c ++++ b/fs/squashfs/xattr_id.c +@@ -76,7 +76,7 @@ __le64 *squashfs_read_xattr_id_table(str + /* Sanity check values */ + + /* there is always at least one xattr id */ +- if (*xattr_ids <= 0) ++ if (*xattr_ids == 0) + return ERR_PTR(-EINVAL); + + len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids); diff --git a/queue-6.1/sctp-sctp_sock_filter-avoid-list_entry-on-possibly-empty-list.patch b/queue-6.1/sctp-sctp_sock_filter-avoid-list_entry-on-possibly-empty-list.patch new file mode 100644 index 00000000000..39aa765c864 --- /dev/null +++ b/queue-6.1/sctp-sctp_sock_filter-avoid-list_entry-on-possibly-empty-list.patch @@ -0,0 +1,37 @@ +From a1221703a0f75a9d81748c516457e0fc76951496 Mon Sep 17 00:00:00 2001 +From: Pietro Borrello +Date: Thu, 9 Feb 2023 12:13:05 +0000 +Subject: sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list + +From: Pietro Borrello + +commit a1221703a0f75a9d81748c516457e0fc76951496 upstream. + +Use list_is_first() to check whether tsp->asoc matches the first +element of ep->asocs, as the list is not guaranteed to have an entry. + +Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file") +Signed-off-by: Pietro Borrello +Acked-by: Xin Long +Link: https://lore.kernel.org/r/20230208-sctp-filter-v2-1-6e1f4017f326@diag.uniroma1.it +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/diag.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/net/sctp/diag.c ++++ b/net/sctp/diag.c +@@ -343,11 +343,9 @@ static int sctp_sock_filter(struct sctp_ + struct sctp_comm_param *commp = p; + struct sock *sk = ep->base.sk; + const struct inet_diag_req_v2 *r = commp->r; +- struct sctp_association *assoc = +- list_entry(ep->asocs.next, struct sctp_association, asocs); + + /* find the ep only once through the transports by this condition */ +- if (tsp->asoc != assoc) ++ if (!list_is_first(&tsp->asoc->asocs, &ep->asocs)) + return 0; + + if (r->sdiag_family != AF_UNSPEC && sk->sk_family != r->sdiag_family) diff --git a/queue-6.1/series b/queue-6.1/series index cc92563a31c..c4ebf714bd6 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -74,3 +74,15 @@ freezer-umh-fix-call_usermode_helper_exec-vs-sigkill.patch coredump-move-dump_emit_page-to-kill-unused-warning.patch revert-mm-always-release-pages-to-the-buddy-allocator-in-memblock_free_late.patch net-fix-unwanted-sign-extension-in-netdev_stats_to_stats64.patch +revert-squashfs-harden-sanity-check-in-squashfs_read_xattr_id_table.patch +drm-vc4-crtc-increase-setup-cost-in-core-clock-calculation-to-handle-extreme-reduced-blanking.patch +drm-vc4-fix-yuv-plane-handling-when-planes-are-in-different-buffers.patch +drm-i915-gen11-wa_1408615072-wa_1407596294-should-be-on-gt-list.patch +ice-fix-lost-multicast-packets-in-promisc-mode.patch +ixgbe-allow-to-increase-mtu-to-3k-with-xdp-enabled.patch +i40e-add-double-of-vlan-header-when-computing-the-max-mtu.patch +net-bgmac-fix-bcm5358-support-by-setting-correct-flags.patch +net-ethernet-ti-am65-cpsw-add-rx-dma-channel-teardown-quirk.patch +sctp-sctp_sock_filter-avoid-list_entry-on-possibly-empty-list.patch +net-sched-tcindex-update-imperfect-hash-filters-respecting-rcu.patch +ice-xsk-fix-cleaning-of-xdp_tx-frames.patch