From: Sasha Levin Date: Sun, 2 Apr 2023 13:40:16 +0000 (-0400) Subject: Fixes for 6.1 X-Git-Tag: v4.14.312~51 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8e1122296916228f5b45c8384f4d709e1eef4215;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/acpi-bus-rework-system-level-device-notification-han.patch b/queue-6.1/acpi-bus-rework-system-level-device-notification-han.patch new file mode 100644 index 00000000000..448e7a813a4 --- /dev/null +++ b/queue-6.1/acpi-bus-rework-system-level-device-notification-han.patch @@ -0,0 +1,237 @@ +From 4a7270461d3dacebc2b65ee2c88df2ab67fae123 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 14:33:42 +0100 +Subject: ACPI: bus: Rework system-level device notification handling + +From: Rafael J. Wysocki + +[ Upstream commit c56610a869bce03490faf4f157076370c71b8ae3 ] + +For ACPI drivers that provide a ->notify() callback and set +ACPI_DRIVER_ALL_NOTIFY_EVENTS in their flags, that callback can be +invoked while either the ->add() or the ->remove() callback is running +without any synchronization at the bus type level which is counter to +the common-sense expectation that notification handling should only be +enabled when the driver is actually bound to the device. As a result, +if the driver is not careful enough, it's ->notify() callback may crash +when it is invoked too early or too late [1]. + +This issue has been amplified by commit d6fb6ee1820c ("ACPI: bus: Drop +driver member of struct acpi_device") that made acpi_bus_notify() check +for the presence of the driver and its ->notify() callback directly +instead of using an extra driver pointer that was only set and cleared +by the bus type code, but it was present before that commit although +it was harder to reproduce then. + +It can be addressed by using the observation that +acpi_device_install_notify_handler() can be modified to install the +handler for all types of events when ACPI_DRIVER_ALL_NOTIFY_EVENTS is +set in the driver flags, in which case acpi_bus_notify() will not need +to invoke the driver's ->notify() callback any more and that callback +will only be invoked after acpi_device_install_notify_handler() has run +and before acpi_device_remove_notify_handler() runs, which implies the +correct ordering with respect to the other ACPI driver callbacks. + +Modify the code accordingly and while at it, drop two redundant local +variables from acpi_bus_notify() and turn its description comment into +a proper kerneldoc one. + +Fixes: d6fb6ee1820c ("ACPI: bus: Drop driver member of struct acpi_device") +Link: https://lore.kernel.org/linux-acpi/9f6cba7a8a57e5a687c934e8e406e28c.squirrel@mail.panix.com # [1] +Reported-by: Pierre Asselin +Signed-off-by: Rafael J. Wysocki +Tested-by: Pierre Asselin +Signed-off-by: Sasha Levin +--- + drivers/acpi/bus.c | 83 +++++++++++++++++++++------------------------- + 1 file changed, 37 insertions(+), 46 deletions(-) + +diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c +index d466c81953146..3b6146b1e25cc 100644 +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -456,85 +456,67 @@ static void acpi_bus_osc_negotiate_usb_control(void) + Notification Handling + -------------------------------------------------------------------------- */ + +-/* +- * acpi_bus_notify +- * --------------- +- * Callback for all 'system-level' device notifications (values 0x00-0x7F). ++/** ++ * acpi_bus_notify - Global system-level (0x00-0x7F) notifications handler ++ * @handle: Target ACPI object. ++ * @type: Notification type. ++ * @data: Ignored. ++ * ++ * This only handles notifications related to device hotplug. + */ + static void acpi_bus_notify(acpi_handle handle, u32 type, void *data) + { + struct acpi_device *adev; +- u32 ost_code = ACPI_OST_SC_NON_SPECIFIC_FAILURE; +- bool hotplug_event = false; + + switch (type) { + case ACPI_NOTIFY_BUS_CHECK: + acpi_handle_debug(handle, "ACPI_NOTIFY_BUS_CHECK event\n"); +- hotplug_event = true; + break; + + case ACPI_NOTIFY_DEVICE_CHECK: + acpi_handle_debug(handle, "ACPI_NOTIFY_DEVICE_CHECK event\n"); +- hotplug_event = true; + break; + + case ACPI_NOTIFY_DEVICE_WAKE: + acpi_handle_debug(handle, "ACPI_NOTIFY_DEVICE_WAKE event\n"); +- break; ++ return; + + case ACPI_NOTIFY_EJECT_REQUEST: + acpi_handle_debug(handle, "ACPI_NOTIFY_EJECT_REQUEST event\n"); +- hotplug_event = true; + break; + + case ACPI_NOTIFY_DEVICE_CHECK_LIGHT: + acpi_handle_debug(handle, "ACPI_NOTIFY_DEVICE_CHECK_LIGHT event\n"); + /* TBD: Exactly what does 'light' mean? */ +- break; ++ return; + + case ACPI_NOTIFY_FREQUENCY_MISMATCH: + acpi_handle_err(handle, "Device cannot be configured due " + "to a frequency mismatch\n"); +- break; ++ return; + + case ACPI_NOTIFY_BUS_MODE_MISMATCH: + acpi_handle_err(handle, "Device cannot be configured due " + "to a bus mode mismatch\n"); +- break; ++ return; + + case ACPI_NOTIFY_POWER_FAULT: + acpi_handle_err(handle, "Device has suffered a power fault\n"); +- break; ++ return; + + default: + acpi_handle_debug(handle, "Unknown event type 0x%x\n", type); +- break; ++ return; + } + + adev = acpi_get_acpi_dev(handle); +- if (!adev) +- goto err; +- +- if (adev->dev.driver) { +- struct acpi_driver *driver = to_acpi_driver(adev->dev.driver); +- +- if (driver && driver->ops.notify && +- (driver->flags & ACPI_DRIVER_ALL_NOTIFY_EVENTS)) +- driver->ops.notify(adev, type); +- } +- +- if (!hotplug_event) { +- acpi_put_acpi_dev(adev); +- return; +- } + +- if (ACPI_SUCCESS(acpi_hotplug_schedule(adev, type))) ++ if (adev && ACPI_SUCCESS(acpi_hotplug_schedule(adev, type))) + return; + + acpi_put_acpi_dev(adev); + +- err: +- acpi_evaluate_ost(handle, type, ost_code, NULL); ++ acpi_evaluate_ost(handle, type, ACPI_OST_SC_NON_SPECIFIC_FAILURE, NULL); + } + + static void acpi_notify_device(acpi_handle handle, u32 event, void *data) +@@ -559,42 +541,51 @@ static u32 acpi_device_fixed_event(void *data) + return ACPI_INTERRUPT_HANDLED; + } + +-static int acpi_device_install_notify_handler(struct acpi_device *device) ++static int acpi_device_install_notify_handler(struct acpi_device *device, ++ struct acpi_driver *acpi_drv) + { + acpi_status status; + +- if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON) ++ if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON) { + status = + acpi_install_fixed_event_handler(ACPI_EVENT_POWER_BUTTON, + acpi_device_fixed_event, + device); +- else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON) ++ } else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON) { + status = + acpi_install_fixed_event_handler(ACPI_EVENT_SLEEP_BUTTON, + acpi_device_fixed_event, + device); +- else +- status = acpi_install_notify_handler(device->handle, +- ACPI_DEVICE_NOTIFY, ++ } else { ++ u32 type = acpi_drv->flags & ACPI_DRIVER_ALL_NOTIFY_EVENTS ? ++ ACPI_ALL_NOTIFY : ACPI_DEVICE_NOTIFY; ++ ++ status = acpi_install_notify_handler(device->handle, type, + acpi_notify_device, + device); ++ } + + if (ACPI_FAILURE(status)) + return -EINVAL; + return 0; + } + +-static void acpi_device_remove_notify_handler(struct acpi_device *device) ++static void acpi_device_remove_notify_handler(struct acpi_device *device, ++ struct acpi_driver *acpi_drv) + { +- if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON) ++ if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON) { + acpi_remove_fixed_event_handler(ACPI_EVENT_POWER_BUTTON, + acpi_device_fixed_event); +- else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON) ++ } else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON) { + acpi_remove_fixed_event_handler(ACPI_EVENT_SLEEP_BUTTON, + acpi_device_fixed_event); +- else +- acpi_remove_notify_handler(device->handle, ACPI_DEVICE_NOTIFY, ++ } else { ++ u32 type = acpi_drv->flags & ACPI_DRIVER_ALL_NOTIFY_EVENTS ? ++ ACPI_ALL_NOTIFY : ACPI_DEVICE_NOTIFY; ++ ++ acpi_remove_notify_handler(device->handle, type, + acpi_notify_device); ++ } + } + + /* Handle events targeting \_SB device (at present only graceful shutdown) */ +@@ -1036,7 +1027,7 @@ static int acpi_device_probe(struct device *dev) + acpi_drv->name, acpi_dev->pnp.bus_id); + + if (acpi_drv->ops.notify) { +- ret = acpi_device_install_notify_handler(acpi_dev); ++ ret = acpi_device_install_notify_handler(acpi_dev, acpi_drv); + if (ret) { + if (acpi_drv->ops.remove) + acpi_drv->ops.remove(acpi_dev); +@@ -1059,7 +1050,7 @@ static void acpi_device_remove(struct device *dev) + struct acpi_driver *acpi_drv = to_acpi_driver(dev->driver); + + if (acpi_drv->ops.notify) +- acpi_device_remove_notify_handler(acpi_dev); ++ acpi_device_remove_notify_handler(acpi_dev, acpi_drv); + + if (acpi_drv->ops.remove) + acpi_drv->ops.remove(acpi_dev); +-- +2.39.2 + diff --git a/queue-6.1/alsa-usb-audio-fix-recursive-locking-at-xrun-during-.patch b/queue-6.1/alsa-usb-audio-fix-recursive-locking-at-xrun-during-.patch new file mode 100644 index 00000000000..7390bc64cfb --- /dev/null +++ b/queue-6.1/alsa-usb-audio-fix-recursive-locking-at-xrun-during-.patch @@ -0,0 +1,144 @@ +From bde6b3f91770a81e71e961a23f1a3400034105a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 15:28:38 +0100 +Subject: ALSA: usb-audio: Fix recursive locking at XRUN during syncing + +From: Takashi Iwai + +[ Upstream commit 8c721c53dda512fdd48eb24d6d99e56deee57898 ] + +The recent support of low latency playback in USB-audio driver made +the snd_usb_queue_pending_output_urbs() function to be called via PCM +ack ops. In the new code path, the function is performed already in +the PCM stream lock. The problem is that, when an XRUN is detected, +the function calls snd_pcm_xrun() to notify, but snd_pcm_xrun() is +supposed to be called only outside the stream lock. As a result, it +leads to a deadlock of PCM stream locking. + +For avoiding such a recursive locking, this patch adds an additional +check to the code paths in PCM core that call the ack callback; now it +checks the error code from the callback, and if it's -EPIPE, the XRUN +is handled in the PCM core side gracefully. Along with it, the +USB-audio driver code is changed to follow that, i.e. -EPIPE is +returned instead of the explicit snd_pcm_xrun() call when the function +is performed already in the stream lock. + +Fixes: d5f871f89e21 ("ALSA: usb-audio: Improved lowlatency playback support") +Reported-and-tested-by: John Keeping +Link: https://lore.kernel.org/r/20230317195128.3911155-1-john@metanate.com +Reviewed-by: Jaroslav Kysela +Reviewed-by; Takashi Sakamoto +Link: https://lore.kernel.org/r/20230320142838.494-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/pcm_lib.c | 2 ++ + sound/usb/endpoint.c | 22 ++++++++++++++-------- + sound/usb/endpoint.h | 4 ++-- + sound/usb/pcm.c | 2 +- + 4 files changed, 19 insertions(+), 11 deletions(-) + +diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c +index 8b6aeb8a78f7d..02fd65993e7e5 100644 +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -2155,6 +2155,8 @@ int pcm_lib_apply_appl_ptr(struct snd_pcm_substream *substream, + ret = substream->ops->ack(substream); + if (ret < 0) { + runtime->control->appl_ptr = old_appl_ptr; ++ if (ret == -EPIPE) ++ __snd_pcm_xrun(substream); + return ret; + } + } +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index 419302e2057e8..647fa054d8b1d 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -455,8 +455,8 @@ static void push_back_to_ready_list(struct snd_usb_endpoint *ep, + * This function is used both for implicit feedback endpoints and in low- + * latency playback mode. + */ +-void snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep, +- bool in_stream_lock) ++int snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep, ++ bool in_stream_lock) + { + bool implicit_fb = snd_usb_endpoint_implicit_feedback_sink(ep); + +@@ -480,7 +480,7 @@ void snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep, + spin_unlock_irqrestore(&ep->lock, flags); + + if (ctx == NULL) +- return; ++ break; + + /* copy over the length information */ + if (implicit_fb) { +@@ -495,11 +495,14 @@ void snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep, + break; + if (err < 0) { + /* push back to ready list again for -EAGAIN */ +- if (err == -EAGAIN) ++ if (err == -EAGAIN) { + push_back_to_ready_list(ep, ctx); +- else ++ break; ++ } ++ ++ if (!in_stream_lock) + notify_xrun(ep); +- return; ++ return -EPIPE; + } + + err = usb_submit_urb(ctx->urb, GFP_ATOMIC); +@@ -507,13 +510,16 @@ void snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep, + usb_audio_err(ep->chip, + "Unable to submit urb #%d: %d at %s\n", + ctx->index, err, __func__); +- notify_xrun(ep); +- return; ++ if (!in_stream_lock) ++ notify_xrun(ep); ++ return -EPIPE; + } + + set_bit(ctx->index, &ep->active_mask); + atomic_inc(&ep->submitted_urbs); + } ++ ++ return 0; + } + + /* +diff --git a/sound/usb/endpoint.h b/sound/usb/endpoint.h +index 924f4351588ce..c09f68ce08b18 100644 +--- a/sound/usb/endpoint.h ++++ b/sound/usb/endpoint.h +@@ -52,7 +52,7 @@ int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep); + int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep, + struct snd_urb_ctx *ctx, int idx, + unsigned int avail); +-void snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep, +- bool in_stream_lock); ++int snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep, ++ bool in_stream_lock); + + #endif /* __USBAUDIO_ENDPOINT_H */ +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index 2c5765cbed2d6..1e1d7458bce10 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -1595,7 +1595,7 @@ static int snd_usb_pcm_playback_ack(struct snd_pcm_substream *substream) + * outputs here + */ + if (!ep->active_mask) +- snd_usb_queue_pending_output_urbs(ep, true); ++ return snd_usb_queue_pending_output_urbs(ep, true); + return 0; + } + +-- +2.39.2 + diff --git a/queue-6.1/alsa-ymfpci-create-card-with-device-managed-snd_devm.patch b/queue-6.1/alsa-ymfpci-create-card-with-device-managed-snd_devm.patch new file mode 100644 index 00000000000..3494679f915 --- /dev/null +++ b/queue-6.1/alsa-ymfpci-create-card-with-device-managed-snd_devm.patch @@ -0,0 +1,89 @@ +From f4521775d0ad9fe4a38daa1e1cb0dec8fe88c9ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Mar 2023 06:24:22 +0300 +Subject: ALSA: ymfpci: Create card with device-managed snd_devm_card_new() + +From: Tasos Sahanidis + +[ Upstream commit f33fc1576757741479452255132d6e3aaf558ffe ] + +snd_card_ymfpci_remove() was removed in commit c6e6bb5eab74 ("ALSA: +ymfpci: Allocate resources with device-managed APIs"), but the call to +snd_card_new() was not replaced with snd_devm_card_new(). + +Since there was no longer a call to snd_card_free, unloading the module +would eventually result in Oops: + +[697561.532887] BUG: unable to handle page fault for address: ffffffffc0924480 +[697561.532893] #PF: supervisor read access in kernel mode +[697561.532896] #PF: error_code(0x0000) - not-present page +[697561.532899] PGD ae1e15067 P4D ae1e15067 PUD ae1e17067 PMD 11a8f5067 PTE 0 +[697561.532905] Oops: 0000 [#1] PREEMPT SMP NOPTI +[697561.532909] CPU: 21 PID: 5080 Comm: wireplumber Tainted: G W OE 6.2.7 #1 +[697561.532914] Hardware name: System manufacturer System Product Name/TUF GAMING X570-PLUS, BIOS 4408 10/28/2022 +[697561.532916] RIP: 0010:try_module_get.part.0+0x1a/0xe0 +[697561.532924] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 49 89 fc bf 01 00 00 00 e8 56 3c f8 ff <41> 83 3c 24 02 0f 84 96 00 00 00 41 8b 84 24 30 03 00 00 85 c0 0f +[697561.532927] RSP: 0018:ffffbe9b858c3bd8 EFLAGS: 00010246 +[697561.532930] RAX: ffff9815d14f1900 RBX: ffff9815c14e6000 RCX: 0000000000000000 +[697561.532933] RDX: 0000000000000000 RSI: ffffffffc055092c RDI: ffffffffb3778c1a +[697561.532935] RBP: ffffbe9b858c3be8 R08: 0000000000000040 R09: ffff981a1a741380 +[697561.532937] R10: ffffbe9b858c3c80 R11: 00000009d56533a6 R12: ffffffffc0924480 +[697561.532939] R13: ffff9823439d8500 R14: 0000000000000025 R15: ffff9815cd109f80 +[697561.532942] FS: 00007f13084f1f80(0000) GS:ffff9824aef40000(0000) knlGS:0000000000000000 +[697561.532945] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[697561.532947] CR2: ffffffffc0924480 CR3: 0000000145344000 CR4: 0000000000350ee0 +[697561.532949] Call Trace: +[697561.532951] +[697561.532955] try_module_get+0x13/0x30 +[697561.532960] snd_ctl_open+0x61/0x1c0 [snd] +[697561.532976] snd_open+0xb4/0x1e0 [snd] +[697561.532989] chrdev_open+0xc7/0x240 +[697561.532995] ? fsnotify_perm.part.0+0x6e/0x160 +[697561.533000] ? __pfx_chrdev_open+0x10/0x10 +[697561.533005] do_dentry_open+0x169/0x440 +[697561.533009] vfs_open+0x2d/0x40 +[697561.533012] path_openat+0xa9d/0x10d0 +[697561.533017] ? debug_smp_processor_id+0x17/0x20 +[697561.533022] ? trigger_load_balance+0x65/0x370 +[697561.533026] do_filp_open+0xb2/0x160 +[697561.533032] ? _raw_spin_unlock+0x19/0x40 +[697561.533036] ? alloc_fd+0xa9/0x190 +[697561.533040] do_sys_openat2+0x9f/0x160 +[697561.533044] __x64_sys_openat+0x55/0x90 +[697561.533048] do_syscall_64+0x3b/0x90 +[697561.533052] entry_SYSCALL_64_after_hwframe+0x72/0xdc +[697561.533056] RIP: 0033:0x7f1308a40db4 +[697561.533059] Code: 24 20 eb 8f 66 90 44 89 54 24 0c e8 46 68 f8 ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 32 44 89 c7 89 44 24 0c e8 78 68 f8 ff 8b 44 +[697561.533062] RSP: 002b:00007ffcce664450 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 +[697561.533066] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f1308a40db4 +[697561.533068] RDX: 0000000000080000 RSI: 00007ffcce664690 RDI: 00000000ffffff9c +[697561.533070] RBP: 00007ffcce664690 R08: 0000000000000000 R09: 0000000000000012 +[697561.533072] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000080000 +[697561.533074] R13: 00007f13054b069b R14: 0000565209f83200 R15: 0000000000000000 +[697561.533078] + +Fixes: c6e6bb5eab74 ("ALSA: ymfpci: Allocate resources with device-managed APIs") +Signed-off-by: Tasos Sahanidis +Link: https://lore.kernel.org/r/20230329032422.170024-1-tasos@tasossah.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/ymfpci/ymfpci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/ymfpci/ymfpci.c b/sound/pci/ymfpci/ymfpci.c +index 1e198e4d57b8d..82d4e0fda91be 100644 +--- a/sound/pci/ymfpci/ymfpci.c ++++ b/sound/pci/ymfpci/ymfpci.c +@@ -170,7 +170,7 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci, + return -ENOENT; + } + +- err = snd_card_new(&pci->dev, index[dev], id[dev], THIS_MODULE, ++ err = snd_devm_card_new(&pci->dev, index[dev], id[dev], THIS_MODULE, + sizeof(*chip), &card); + if (err < 0) + return err; +-- +2.39.2 + diff --git a/queue-6.1/alsa-ymfpci-fix-bug_on-in-probe-function.patch b/queue-6.1/alsa-ymfpci-fix-bug_on-in-probe-function.patch new file mode 100644 index 00000000000..6a24ae09431 --- /dev/null +++ b/queue-6.1/alsa-ymfpci-fix-bug_on-in-probe-function.patch @@ -0,0 +1,69 @@ +From 1ee2c21b5a84d679e0aca8e7f29357c67231540d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Mar 2023 06:28:08 +0300 +Subject: ALSA: ymfpci: Fix BUG_ON in probe function + +From: Tasos Sahanidis + +[ Upstream commit 6be2e7522eb529b41c16d459f33bbdbcddbf5c15 ] + +The snd_dma_buffer.bytes field now contains the aligned size, which this +snd_BUG_ON() did not account for, resulting in the following: + +[ 9.625915] ------------[ cut here ]------------ +[ 9.633440] WARNING: CPU: 0 PID: 126 at sound/pci/ymfpci/ymfpci_main.c:2168 snd_ymfpci_create+0x681/0x698 [snd_ymfpci] +[ 9.648926] Modules linked in: snd_ymfpci(+) snd_intel_dspcfg kvm(+) snd_intel_sdw_acpi snd_ac97_codec snd_mpu401_uart snd_opl3_lib irqbypass snd_hda_codec gameport snd_rawmidi crct10dif_pclmul crc32_pclmul cfg80211 snd_hda_core polyval_clmulni polyval_generic gf128mul snd_seq_device ghash_clmulni_intel snd_hwdep ac97_bus sha512_ssse3 rfkill snd_pcm aesni_intel tg3 snd_timer crypto_simd snd mxm_wmi libphy cryptd k10temp fam15h_power pcspkr soundcore sp5100_tco wmi acpi_cpufreq mac_hid dm_multipath sg loop fuse dm_mod bpf_preload ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 sr_mod cdrom ata_generic pata_acpi firewire_ohci crc32c_intel firewire_core xhci_pci crc_itu_t pata_via xhci_pci_renesas floppy +[ 9.711849] CPU: 0 PID: 126 Comm: kworker/0:2 Not tainted 6.1.21-1-lts #1 08d2e5ece03136efa7c6aeea9a9c40916b1bd8da +[ 9.722200] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./990FX Extreme4, BIOS P2.70 06/05/2014 +[ 9.732204] Workqueue: events work_for_cpu_fn +[ 9.736580] RIP: 0010:snd_ymfpci_create+0x681/0x698 [snd_ymfpci] +[ 9.742594] Code: 8c c0 4c 89 e2 48 89 df 48 c7 c6 92 c6 8c c0 e8 15 d0 e9 ff 48 83 c4 08 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f e9 d3 7a 33 e3 <0f> 0b e9 cb fd ff ff 41 bd fb ff ff ff eb db 41 bd f4 ff ff ff eb +[ 9.761358] RSP: 0018:ffffab64804e7da0 EFLAGS: 00010287 +[ 9.766594] RAX: ffff8fa2df06c400 RBX: ffff8fa3073a8000 RCX: ffff8fa303fbc4a8 +[ 9.773734] RDX: ffff8fa2df06d000 RSI: 0000000000000010 RDI: 0000000000000020 +[ 9.780876] RBP: ffff8fa300b5d0d0 R08: ffff8fa3073a8e50 R09: 00000000df06bf00 +[ 9.788018] R10: ffff8fa2df06bf00 R11: 00000000df068200 R12: ffff8fa3073a8918 +[ 9.795159] R13: 0000000000000000 R14: 0000000000000080 R15: ffff8fa2df068200 +[ 9.802317] FS: 0000000000000000(0000) GS:ffff8fa9fec00000(0000) knlGS:0000000000000000 +[ 9.810414] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 9.816158] CR2: 000055febaf66500 CR3: 0000000101a2e000 CR4: 00000000000406f0 +[ 9.823301] Call Trace: +[ 9.825747] +[ 9.827889] snd_card_ymfpci_probe+0x194/0x950 [snd_ymfpci b78a5fe64b5663a6390a909c67808567e3e73615] +[ 9.837030] ? finish_task_switch.isra.0+0x90/0x2d0 +[ 9.841918] local_pci_probe+0x45/0x80 +[ 9.845680] work_for_cpu_fn+0x1a/0x30 +[ 9.849431] process_one_work+0x1c7/0x380 +[ 9.853464] worker_thread+0x1af/0x390 +[ 9.857225] ? rescuer_thread+0x3b0/0x3b0 +[ 9.861254] kthread+0xde/0x110 +[ 9.864414] ? kthread_complete_and_exit+0x20/0x20 +[ 9.869210] ret_from_fork+0x22/0x30 +[ 9.872792] +[ 9.874985] ---[ end trace 0000000000000000 ]--- + +Fixes: 5c1733e33c88 ("ALSA: memalloc: Align buffer allocations in page size") +Signed-off-by: Tasos Sahanidis +Link: https://lore.kernel.org/r/20230329032808.170403-1-tasos@tasossah.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/ymfpci/ymfpci_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c +index c80114c0ad7bf..b492c32ce0704 100644 +--- a/sound/pci/ymfpci/ymfpci_main.c ++++ b/sound/pci/ymfpci/ymfpci_main.c +@@ -2165,7 +2165,7 @@ static int snd_ymfpci_memalloc(struct snd_ymfpci *chip) + chip->work_base = ptr; + chip->work_base_addr = ptr_addr; + +- snd_BUG_ON(ptr + chip->work_size != ++ snd_BUG_ON(ptr + PAGE_ALIGN(chip->work_size) != + chip->work_ptr->area + chip->work_ptr->bytes); + + snd_ymfpci_writel(chip, YDSXGR_PLAYCTRLBASE, chip->bank_base_playback_addr); +-- +2.39.2 + diff --git a/queue-6.1/bnxt_en-add-missing-200g-link-speed-reporting.patch b/queue-6.1/bnxt_en-add-missing-200g-link-speed-reporting.patch new file mode 100644 index 00000000000..4c7e9a37a1a --- /dev/null +++ b/queue-6.1/bnxt_en-add-missing-200g-link-speed-reporting.patch @@ -0,0 +1,51 @@ +From 55d4f55c51c4cee8ab02bb20473298c0153781ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 18:30:21 -0700 +Subject: bnxt_en: Add missing 200G link speed reporting + +From: Michael Chan + +[ Upstream commit 581bce7bcb7e7f100908728e7b292e266c76895b ] + +bnxt_fw_to_ethtool_speed() is missing the case statement for 200G +link speed reported by firmware. As a result, ethtool will report +unknown speed when the firmware reports 200G link speed. + +Fixes: 532262ba3b84 ("bnxt_en: ethtool: support PAM4 link speeds up to 200G") +Signed-off-by: Michael Chan +Reviewed-by: Simon Horman +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 ++ + 2 files changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index 02741d499bf4a..1d2588c92977e 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -1225,6 +1225,7 @@ struct bnxt_link_info { + #define BNXT_LINK_SPEED_40GB PORT_PHY_QCFG_RESP_LINK_SPEED_40GB + #define BNXT_LINK_SPEED_50GB PORT_PHY_QCFG_RESP_LINK_SPEED_50GB + #define BNXT_LINK_SPEED_100GB PORT_PHY_QCFG_RESP_LINK_SPEED_100GB ++#define BNXT_LINK_SPEED_200GB PORT_PHY_QCFG_RESP_LINK_SPEED_200GB + u16 support_speeds; + u16 support_pam4_speeds; + u16 auto_link_speeds; /* fw adv setting */ +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index cdbc62ad659cb..01b973bc509f5 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -1712,6 +1712,8 @@ u32 bnxt_fw_to_ethtool_speed(u16 fw_link_speed) + return SPEED_50000; + case BNXT_LINK_SPEED_100GB: + return SPEED_100000; ++ case BNXT_LINK_SPEED_200GB: ++ return SPEED_200000; + default: + return SPEED_UNKNOWN; + } +-- +2.39.2 + diff --git a/queue-6.1/bnxt_en-fix-reporting-of-test-result-in-ethtool-self.patch b/queue-6.1/bnxt_en-fix-reporting-of-test-result-in-ethtool-self.patch new file mode 100644 index 00000000000..5a8b0eecf32 --- /dev/null +++ b/queue-6.1/bnxt_en-fix-reporting-of-test-result-in-ethtool-self.patch @@ -0,0 +1,39 @@ +From 384cceff4ad049c4127ee3bd4924986283236b83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 18:30:19 -0700 +Subject: bnxt_en: Fix reporting of test result in ethtool selftest + +From: Kalesh AP + +[ Upstream commit 83714dc3db0e4a088673601bc8099b079bc1a077 ] + +When the selftest command fails, driver is not reporting the failure +by updating the "test->flags" when bnxt_close_nic() fails. + +Fixes: eb51365846bc ("bnxt_en: Add basic ethtool -t selftest support.") +Reviewed-by: Pavan Chebbi +Reviewed-by: Somnath Kotur +Signed-off-by: Kalesh AP +Signed-off-by: Michael Chan +Reviewed-by: Simon Horman +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 703fc163235f9..cdbc62ad659cb 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -3634,6 +3634,7 @@ static void bnxt_self_test(struct net_device *dev, struct ethtool_test *etest, + bnxt_ulp_stop(bp); + rc = bnxt_close_nic(bp, true, false); + if (rc) { ++ etest->flags |= ETH_TEST_FL_FAILED; + bnxt_ulp_start(bp, rc); + return; + } +-- +2.39.2 + diff --git a/queue-6.1/bnxt_en-fix-typo-in-pci-id-to-device-description-str.patch b/queue-6.1/bnxt_en-fix-typo-in-pci-id-to-device-description-str.patch new file mode 100644 index 00000000000..0a1663647e9 --- /dev/null +++ b/queue-6.1/bnxt_en-fix-typo-in-pci-id-to-device-description-str.patch @@ -0,0 +1,47 @@ +From c4a46662f0122b9510294ee90ca283166cf288f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 18:30:20 -0700 +Subject: bnxt_en: Fix typo in PCI id to device description string mapping + +From: Kalesh AP + +[ Upstream commit 62aad36ed31abc80f35db11e187e690448a79f7d ] + +Fix 57502 and 57508 NPAR description string entries. The typos +caused these devices to not match up with lspci output. + +Fixes: 49c98421e6ab ("bnxt_en: Add PCI IDs for 57500 series NPAR devices.") +Reviewed-by: Pavan Chebbi +Signed-off-by: Kalesh AP +Signed-off-by: Michael Chan +Reviewed-by: Simon Horman +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 251b102d2792b..c6e36603bd2db 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -175,12 +175,12 @@ static const struct pci_device_id bnxt_pci_tbl[] = { + { PCI_VDEVICE(BROADCOM, 0x1750), .driver_data = BCM57508 }, + { PCI_VDEVICE(BROADCOM, 0x1751), .driver_data = BCM57504 }, + { PCI_VDEVICE(BROADCOM, 0x1752), .driver_data = BCM57502 }, +- { PCI_VDEVICE(BROADCOM, 0x1800), .driver_data = BCM57508_NPAR }, ++ { PCI_VDEVICE(BROADCOM, 0x1800), .driver_data = BCM57502_NPAR }, + { PCI_VDEVICE(BROADCOM, 0x1801), .driver_data = BCM57504_NPAR }, +- { PCI_VDEVICE(BROADCOM, 0x1802), .driver_data = BCM57502_NPAR }, +- { PCI_VDEVICE(BROADCOM, 0x1803), .driver_data = BCM57508_NPAR }, ++ { PCI_VDEVICE(BROADCOM, 0x1802), .driver_data = BCM57508_NPAR }, ++ { PCI_VDEVICE(BROADCOM, 0x1803), .driver_data = BCM57502_NPAR }, + { PCI_VDEVICE(BROADCOM, 0x1804), .driver_data = BCM57504_NPAR }, +- { PCI_VDEVICE(BROADCOM, 0x1805), .driver_data = BCM57502_NPAR }, ++ { PCI_VDEVICE(BROADCOM, 0x1805), .driver_data = BCM57508_NPAR }, + { PCI_VDEVICE(BROADCOM, 0xd802), .driver_data = BCM58802 }, + { PCI_VDEVICE(BROADCOM, 0xd804), .driver_data = BCM58804 }, + #ifdef CONFIG_BNXT_SRIOV +-- +2.39.2 + diff --git a/queue-6.1/ca8210-fix-unsigned-mac_len-comparison-with-zero-in-.patch b/queue-6.1/ca8210-fix-unsigned-mac_len-comparison-with-zero-in-.patch new file mode 100644 index 00000000000..62956758d53 --- /dev/null +++ b/queue-6.1/ca8210-fix-unsigned-mac_len-comparison-with-zero-in-.patch @@ -0,0 +1,48 @@ +From 159d7c4d3ab2ea72506dfaf28d86194bd01297ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 11:18:24 -0800 +Subject: ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx() + +From: Harshit Mogalapalli + +[ Upstream commit 748b2f5e82d17480404b3e2895388fc2925f7caf ] + +mac_len is of type unsigned, which can never be less than zero. + + mac_len = ieee802154_hdr_peek_addrs(skb, &header); + if (mac_len < 0) + return mac_len; + +Change this to type int as ieee802154_hdr_peek_addrs() can return negative +integers, this is found by static analysis with smatch. + +Fixes: 6c993779ea1d ("ca8210: fix mac_len negative array access") +Signed-off-by: Harshit Mogalapalli +Acked-by: Alexander Aring +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230306191824.4115839-1-harshit.m.mogalapalli@oracle.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +--- + drivers/net/ieee802154/ca8210.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c +index 0b0c6c0764fe9..d0b5129439ed6 100644 +--- a/drivers/net/ieee802154/ca8210.c ++++ b/drivers/net/ieee802154/ca8210.c +@@ -1902,10 +1902,9 @@ static int ca8210_skb_tx( + struct ca8210_priv *priv + ) + { +- int status; + struct ieee802154_hdr header = { }; + struct secspec secspec; +- unsigned int mac_len; ++ int mac_len, status; + + dev_dbg(&priv->spi->dev, "%s called\n", __func__); + +-- +2.39.2 + diff --git a/queue-6.1/can-bcm-bcm_tx_setup-fix-kmsan-uninit-value-in-vfs_w.patch b/queue-6.1/can-bcm-bcm_tx_setup-fix-kmsan-uninit-value-in-vfs_w.patch new file mode 100644 index 00000000000..447f0bd0a54 --- /dev/null +++ b/queue-6.1/can-bcm-bcm_tx_setup-fix-kmsan-uninit-value-in-vfs_w.patch @@ -0,0 +1,118 @@ +From a534ec4746b933fb7919c71167bbf4e603a75802 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 16:04:45 +0400 +Subject: can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write + +From: Ivan Orlov + +[ Upstream commit 2b4c99f7d9a57ecd644eda9b1fb0a1072414959f ] + +Syzkaller reported the following issue: + +===================================================== +BUG: KMSAN: uninit-value in aio_rw_done fs/aio.c:1520 [inline] +BUG: KMSAN: uninit-value in aio_write+0x899/0x950 fs/aio.c:1600 + aio_rw_done fs/aio.c:1520 [inline] + aio_write+0x899/0x950 fs/aio.c:1600 + io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 + __do_sys_io_submit fs/aio.c:2078 [inline] + __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 + __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Uninit was created at: + slab_post_alloc_hook mm/slab.h:766 [inline] + slab_alloc_node mm/slub.c:3452 [inline] + __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491 + __do_kmalloc_node mm/slab_common.c:967 [inline] + __kmalloc+0x11d/0x3b0 mm/slab_common.c:981 + kmalloc_array include/linux/slab.h:636 [inline] + bcm_tx_setup+0x80e/0x29d0 net/can/bcm.c:930 + bcm_sendmsg+0x3a2/0xce0 net/can/bcm.c:1351 + sock_sendmsg_nosec net/socket.c:714 [inline] + sock_sendmsg net/socket.c:734 [inline] + sock_write_iter+0x495/0x5e0 net/socket.c:1108 + call_write_iter include/linux/fs.h:2189 [inline] + aio_write+0x63a/0x950 fs/aio.c:1600 + io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 + __do_sys_io_submit fs/aio.c:2078 [inline] + __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 + __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +CPU: 1 PID: 5034 Comm: syz-executor350 Not tainted 6.2.0-rc6-syzkaller-80422-geda666ff2276 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 +===================================================== + +We can follow the call chain and find that 'bcm_tx_setup' function +calls 'memcpy_from_msg' to copy some content to the newly allocated +frame of 'op->frames'. After that the 'len' field of copied structure +being compared with some constant value (64 or 8). However, if +'memcpy_from_msg' returns an error, we will compare some uninitialized +memory. This triggers 'uninit-value' issue. + +This patch will add 'memcpy_from_msg' possible errors processing to +avoid uninit-value issue. + +Tested via syzkaller + +Reported-by: syzbot+c9bfd85eca611ebf5db1@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?id=47f897f8ad958bbde5790ebf389b5e7e0a345089 +Signed-off-by: Ivan Orlov +Fixes: 6f3b911d5f29b ("can: bcm: add support for CAN FD frames") +Acked-by: Oliver Hartkopp +Link: https://lore.kernel.org/all/20230314120445.12407-1-ivan.orlov0322@gmail.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/bcm.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/net/can/bcm.c b/net/can/bcm.c +index 27706f6ace34a..a962ec2b8ba5b 100644 +--- a/net/can/bcm.c ++++ b/net/can/bcm.c +@@ -941,6 +941,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, + + cf = op->frames + op->cfsiz * i; + err = memcpy_from_msg((u8 *)cf, msg, op->cfsiz); ++ if (err < 0) ++ goto free_op; + + if (op->flags & CAN_FD_FRAME) { + if (cf->len > 64) +@@ -950,12 +952,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, + err = -EINVAL; + } + +- if (err < 0) { +- if (op->frames != &op->sframe) +- kfree(op->frames); +- kfree(op); +- return err; +- } ++ if (err < 0) ++ goto free_op; + + if (msg_head->flags & TX_CP_CAN_ID) { + /* copy can_id into frame */ +@@ -1026,6 +1024,12 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, + bcm_tx_start_timer(op); + + return msg_head->nframes * op->cfsiz + MHSIZ; ++ ++free_op: ++ if (op->frames != &op->sframe) ++ kfree(op->frames); ++ kfree(op); ++ return err; + } + + /* +-- +2.39.2 + diff --git a/queue-6.1/drm-i915-tc-fix-the-icl-phy-ownership-check-in-tc-co.patch b/queue-6.1/drm-i915-tc-fix-the-icl-phy-ownership-check-in-tc-co.patch new file mode 100644 index 00000000000..90709d55058 --- /dev/null +++ b/queue-6.1/drm-i915-tc-fix-the-icl-phy-ownership-check-in-tc-co.patch @@ -0,0 +1,51 @@ +From 84fbca8b2679fdf17da75355ad546ac0689baa38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 15:17:13 +0200 +Subject: drm/i915/tc: Fix the ICL PHY ownership check in TC-cold state +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Imre Deak + +[ Upstream commit 38c583019484f190d5b33f59b8ae810e6b1763c6 ] + +The commit renaming icl_tc_phy_is_in_safe_mode() to +icl_tc_phy_take_ownership() didn't flip the function's return value +accordingly, fix this up. + +This didn't cause an actual problem besides state check errors, since +the function is only used during HW readout. + +Cc: José Roberto de Souza +Fixes: f53979d68a77 ("drm/i915/display/tc: Rename safe_mode functions ownership") +Reviewed-by: José Roberto de Souza +Reviewed-by: Ville Syrjälä +Signed-off-by: Imre Deak +Link: https://patchwork.freedesktop.org/patch/msgid/20230316131724.359612-4-imre.deak@intel.com +(cherry picked from commit f2c7959dda614d9b7c6a41510492de39d31705ec) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_tc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_tc.c b/drivers/gpu/drm/i915/display/intel_tc.c +index e5af955b5600f..8d6dac32c8960 100644 +--- a/drivers/gpu/drm/i915/display/intel_tc.c ++++ b/drivers/gpu/drm/i915/display/intel_tc.c +@@ -440,9 +440,9 @@ static bool icl_tc_phy_is_owned(struct intel_digital_port *dig_port) + PORT_TX_DFLEXDPCSSS(dig_port->tc_phy_fia)); + if (val == 0xffffffff) { + drm_dbg_kms(&i915->drm, +- "Port %s: PHY in TCCOLD, assume safe mode\n", ++ "Port %s: PHY in TCCOLD, assume not owned\n", + dig_port->tc_port_name); +- return true; ++ return false; + } + + return val & DP_PHY_MODE_STATUS_NOT_SAFE(dig_port->tc_phy_fia_idx); +-- +2.39.2 + diff --git a/queue-6.1/i40e-fix-registers-dump-after-run-ethtool-adapter-se.patch b/queue-6.1/i40e-fix-registers-dump-after-run-ethtool-adapter-se.patch new file mode 100644 index 00000000000..54d74ed044f --- /dev/null +++ b/queue-6.1/i40e-fix-registers-dump-after-run-ethtool-adapter-se.patch @@ -0,0 +1,91 @@ +From 4058e3534e79481955e2e23cf5a6dbbb6eace1ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 10:26:59 -0700 +Subject: i40e: fix registers dump after run ethtool adapter self test + +From: Radoslaw Tyl + +[ Upstream commit c5cff16f461a4a434a9915a7be7ac9ced861a8a4 ] + +Fix invalid registers dump from ethtool -d ethX after adapter self test +by ethtool -t ethY. It causes invalid data display. + +The problem was caused by overwriting i40e_reg_list[].elements +which is common for ethtool self test and dump. + +Fixes: 22dd9ae8afcc ("i40e: Rework register diagnostic") +Signed-off-by: Radoslaw Tyl +Reviewed-by: Michal Swiatkowski +Tested-by: Arpana Arland (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20230328172659.3906413-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_diag.c | 11 ++++++----- + drivers/net/ethernet/intel/i40e/i40e_diag.h | 2 +- + 2 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_diag.c b/drivers/net/ethernet/intel/i40e/i40e_diag.c +index ef4d3762bf371..ca229b0efeb65 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_diag.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_diag.c +@@ -44,7 +44,7 @@ static i40e_status i40e_diag_reg_pattern_test(struct i40e_hw *hw, + return 0; + } + +-struct i40e_diag_reg_test_info i40e_reg_list[] = { ++const struct i40e_diag_reg_test_info i40e_reg_list[] = { + /* offset mask elements stride */ + {I40E_QTX_CTL(0), 0x0000FFBF, 1, + I40E_QTX_CTL(1) - I40E_QTX_CTL(0)}, +@@ -78,27 +78,28 @@ i40e_status i40e_diag_reg_test(struct i40e_hw *hw) + { + i40e_status ret_code = 0; + u32 reg, mask; ++ u32 elements; + u32 i, j; + + for (i = 0; i40e_reg_list[i].offset != 0 && + !ret_code; i++) { + ++ elements = i40e_reg_list[i].elements; + /* set actual reg range for dynamically allocated resources */ + if (i40e_reg_list[i].offset == I40E_QTX_CTL(0) && + hw->func_caps.num_tx_qp != 0) +- i40e_reg_list[i].elements = hw->func_caps.num_tx_qp; ++ elements = hw->func_caps.num_tx_qp; + if ((i40e_reg_list[i].offset == I40E_PFINT_ITRN(0, 0) || + i40e_reg_list[i].offset == I40E_PFINT_ITRN(1, 0) || + i40e_reg_list[i].offset == I40E_PFINT_ITRN(2, 0) || + i40e_reg_list[i].offset == I40E_QINT_TQCTL(0) || + i40e_reg_list[i].offset == I40E_QINT_RQCTL(0)) && + hw->func_caps.num_msix_vectors != 0) +- i40e_reg_list[i].elements = +- hw->func_caps.num_msix_vectors - 1; ++ elements = hw->func_caps.num_msix_vectors - 1; + + /* test register access */ + mask = i40e_reg_list[i].mask; +- for (j = 0; j < i40e_reg_list[i].elements && !ret_code; j++) { ++ for (j = 0; j < elements && !ret_code; j++) { + reg = i40e_reg_list[i].offset + + (j * i40e_reg_list[i].stride); + ret_code = i40e_diag_reg_pattern_test(hw, reg, mask); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_diag.h b/drivers/net/ethernet/intel/i40e/i40e_diag.h +index c3340f320a18c..1db7c6d572311 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_diag.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_diag.h +@@ -20,7 +20,7 @@ struct i40e_diag_reg_test_info { + u32 stride; /* bytes between each element */ + }; + +-extern struct i40e_diag_reg_test_info i40e_reg_list[]; ++extern const struct i40e_diag_reg_test_info i40e_reg_list[]; + + i40e_status i40e_diag_reg_test(struct i40e_hw *hw); + i40e_status i40e_diag_eeprom_test(struct i40e_hw *hw); +-- +2.39.2 + diff --git a/queue-6.1/ice-add-profile-conflict-check-for-avf-fdir.patch b/queue-6.1/ice-add-profile-conflict-check-for-avf-fdir.patch new file mode 100644 index 00000000000..b08576b2173 --- /dev/null +++ b/queue-6.1/ice-add-profile-conflict-check-for-avf-fdir.patch @@ -0,0 +1,125 @@ +From 321dae0811e0419626a2c5c459382620827c0853 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 10:03:15 +0800 +Subject: ice: add profile conflict check for AVF FDIR + +From: Junfeng Guo + +[ Upstream commit 29486b6df3e6a63b57d1ed1dce06051267282ff4 ] + +Add profile conflict check while adding some FDIR rules to avoid +unexpected flow behavior, rules may have conflict including: + IPv4 <---> {IPv4_UDP, IPv4_TCP, IPv4_SCTP} + IPv6 <---> {IPv6_UDP, IPv6_TCP, IPv6_SCTP} + +For example, when we create an FDIR rule for IPv4, this rule will work +on packets including IPv4, IPv4_UDP, IPv4_TCP and IPv4_SCTP. But if we +then create an FDIR rule for IPv4_UDP and then destroy it, the first +FDIR rule for IPv4 cannot work on pkt IPv4_UDP then. + +To prevent this unexpected behavior, we add restriction in software +when creating FDIR rules by adding necessary profile conflict check. + +Fixes: 1f7ea1cd6a37 ("ice: Enable FDIR Configure for AVF") +Signed-off-by: Junfeng Guo +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + .../ethernet/intel/ice/ice_virtchnl_fdir.c | 73 +++++++++++++++++++ + 1 file changed, 73 insertions(+) + +diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c +index c6a58343d81d8..a2645ff3100e4 100644 +--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c ++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c +@@ -541,6 +541,72 @@ static void ice_vc_fdir_rem_prof_all(struct ice_vf *vf) + } + } + ++/** ++ * ice_vc_fdir_has_prof_conflict ++ * @vf: pointer to the VF structure ++ * @conf: FDIR configuration for each filter ++ * ++ * Check if @conf has conflicting profile with existing profiles ++ * ++ * Return: true on success, and false on error. ++ */ ++static bool ++ice_vc_fdir_has_prof_conflict(struct ice_vf *vf, ++ struct virtchnl_fdir_fltr_conf *conf) ++{ ++ struct ice_fdir_fltr *desc; ++ ++ list_for_each_entry(desc, &vf->fdir.fdir_rule_list, fltr_node) { ++ struct virtchnl_fdir_fltr_conf *existing_conf; ++ enum ice_fltr_ptype flow_type_a, flow_type_b; ++ struct ice_fdir_fltr *a, *b; ++ ++ existing_conf = to_fltr_conf_from_desc(desc); ++ a = &existing_conf->input; ++ b = &conf->input; ++ flow_type_a = a->flow_type; ++ flow_type_b = b->flow_type; ++ ++ /* No need to compare two rules with different tunnel types or ++ * with the same protocol type. ++ */ ++ if (existing_conf->ttype != conf->ttype || ++ flow_type_a == flow_type_b) ++ continue; ++ ++ switch (flow_type_a) { ++ case ICE_FLTR_PTYPE_NONF_IPV4_UDP: ++ case ICE_FLTR_PTYPE_NONF_IPV4_TCP: ++ case ICE_FLTR_PTYPE_NONF_IPV4_SCTP: ++ if (flow_type_b == ICE_FLTR_PTYPE_NONF_IPV4_OTHER) ++ return true; ++ break; ++ case ICE_FLTR_PTYPE_NONF_IPV4_OTHER: ++ if (flow_type_b == ICE_FLTR_PTYPE_NONF_IPV4_UDP || ++ flow_type_b == ICE_FLTR_PTYPE_NONF_IPV4_TCP || ++ flow_type_b == ICE_FLTR_PTYPE_NONF_IPV4_SCTP) ++ return true; ++ break; ++ case ICE_FLTR_PTYPE_NONF_IPV6_UDP: ++ case ICE_FLTR_PTYPE_NONF_IPV6_TCP: ++ case ICE_FLTR_PTYPE_NONF_IPV6_SCTP: ++ if (flow_type_b == ICE_FLTR_PTYPE_NONF_IPV6_OTHER) ++ return true; ++ break; ++ case ICE_FLTR_PTYPE_NONF_IPV6_OTHER: ++ if (flow_type_b == ICE_FLTR_PTYPE_NONF_IPV6_UDP || ++ flow_type_b == ICE_FLTR_PTYPE_NONF_IPV6_TCP || ++ flow_type_b == ICE_FLTR_PTYPE_NONF_IPV6_SCTP) ++ return true; ++ break; ++ default: ++ break; ++ } ++ } ++ ++ return false; ++} ++ + /** + * ice_vc_fdir_write_flow_prof + * @vf: pointer to the VF structure +@@ -677,6 +743,13 @@ ice_vc_fdir_config_input_set(struct ice_vf *vf, struct virtchnl_fdir_add *fltr, + enum ice_fltr_ptype flow; + int ret; + ++ ret = ice_vc_fdir_has_prof_conflict(vf, conf); ++ if (ret) { ++ dev_dbg(dev, "Found flow profile conflict for VF %d\n", ++ vf->vf_id); ++ return ret; ++ } ++ + flow = input->flow_type; + ret = ice_vc_fdir_alloc_prof(vf, flow); + if (ret) { +-- +2.39.2 + diff --git a/queue-6.1/ice-fix-ice_cfg_rdma_fltr-to-only-update-relevant-fi.patch b/queue-6.1/ice-fix-ice_cfg_rdma_fltr-to-only-update-relevant-fi.patch new file mode 100644 index 00000000000..1629be6b39c --- /dev/null +++ b/queue-6.1/ice-fix-ice_cfg_rdma_fltr-to-only-update-relevant-fi.patch @@ -0,0 +1,78 @@ +From 6b8761cae28c05f80f4b11d682a8cf9fee649026 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 13:36:08 -0700 +Subject: ice: Fix ice_cfg_rdma_fltr() to only update relevant fields + +From: Brett Creeley + +[ Upstream commit d94dbdc4e0209b5e7d736ab696f8d635b034e3ee ] + +The current implementation causes ice_vsi_update() to update all VSI +fields based on the cached VSI context. This also assumes that the +ICE_AQ_VSI_PROP_Q_OPT_VALID bit is set. This can cause problems if the +VSI context is not correctly synced by the driver. Fix this by only +updating the fields that correspond to ICE_AQ_VSI_PROP_Q_OPT_VALID. +Also, make sure to save the updated result in the cached VSI context +on success. + +Fixes: 348048e724a0 ("ice: Implement iidc operations") +Co-developed-by: Robert Malz +Signed-off-by: Robert Malz +Signed-off-by: Brett Creeley +Signed-off-by: Jesse Brandeburg +Reviewed-by: Piotr Raczynski +Tested-by: Jakub Andrysiak +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_switch.c | 26 +++++++++++++++++---- + 1 file changed, 22 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_switch.c b/drivers/net/ethernet/intel/ice/ice_switch.c +index 61f844d225123..46b36851af460 100644 +--- a/drivers/net/ethernet/intel/ice/ice_switch.c ++++ b/drivers/net/ethernet/intel/ice/ice_switch.c +@@ -1780,18 +1780,36 @@ ice_update_vsi(struct ice_hw *hw, u16 vsi_handle, struct ice_vsi_ctx *vsi_ctx, + int + ice_cfg_rdma_fltr(struct ice_hw *hw, u16 vsi_handle, bool enable) + { +- struct ice_vsi_ctx *ctx; ++ struct ice_vsi_ctx *ctx, *cached_ctx; ++ int status; ++ ++ cached_ctx = ice_get_vsi_ctx(hw, vsi_handle); ++ if (!cached_ctx) ++ return -ENOENT; + +- ctx = ice_get_vsi_ctx(hw, vsi_handle); ++ ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); + if (!ctx) +- return -EIO; ++ return -ENOMEM; ++ ++ ctx->info.q_opt_rss = cached_ctx->info.q_opt_rss; ++ ctx->info.q_opt_tc = cached_ctx->info.q_opt_tc; ++ ctx->info.q_opt_flags = cached_ctx->info.q_opt_flags; ++ ++ ctx->info.valid_sections = cpu_to_le16(ICE_AQ_VSI_PROP_Q_OPT_VALID); + + if (enable) + ctx->info.q_opt_flags |= ICE_AQ_VSI_Q_OPT_PE_FLTR_EN; + else + ctx->info.q_opt_flags &= ~ICE_AQ_VSI_Q_OPT_PE_FLTR_EN; + +- return ice_update_vsi(hw, vsi_handle, ctx, NULL); ++ status = ice_update_vsi(hw, vsi_handle, ctx, NULL); ++ if (!status) { ++ cached_ctx->info.q_opt_flags = ctx->info.q_opt_flags; ++ cached_ctx->info.valid_sections |= ctx->info.valid_sections; ++ } ++ ++ kfree(ctx); ++ return status; + } + + /** +-- +2.39.2 + diff --git a/queue-6.1/ice-fix-invalid-check-for-empty-list-in-ice_sched_as.patch b/queue-6.1/ice-fix-invalid-check-for-empty-list-in-ice_sched_as.patch new file mode 100644 index 00000000000..7ee57633fd7 --- /dev/null +++ b/queue-6.1/ice-fix-invalid-check-for-empty-list-in-ice_sched_as.patch @@ -0,0 +1,63 @@ +From d6f8c9ed0b1b934796d77caf250416b7cbe786d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 13:48:15 +0100 +Subject: ice: fix invalid check for empty list in ice_sched_assoc_vsi_to_agg() + +From: Jakob Koschel + +[ Upstream commit e9a1cc2e4c4ee7c7e60fb26345618c2522a2a10f ] + +The code implicitly assumes that the list iterator finds a correct +handle. If 'vsi_handle' is not found the 'old_agg_vsi_info' was +pointing to an bogus memory location. For safety a separate list +iterator variable should be used to make the != NULL check on +'old_agg_vsi_info' correct under any circumstances. + +Additionally Linus proposed to avoid any use of the list iterator +variable after the loop, in the attempt to move the list iterator +variable declaration into the macro to avoid any potential misuse after +the loop. Using it in a pointer comparison after the loop is undefined +behavior and should be omitted if possible [1]. + +Fixes: 37c592062b16 ("ice: remove the VSI info from previous agg") +Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1] +Signed-off-by: Jakob Koschel +Tested-by: Arpana Arland (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_sched.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_sched.c b/drivers/net/ethernet/intel/ice/ice_sched.c +index 118595763bba3..2c62c1763ee0d 100644 +--- a/drivers/net/ethernet/intel/ice/ice_sched.c ++++ b/drivers/net/ethernet/intel/ice/ice_sched.c +@@ -2756,7 +2756,7 @@ static int + ice_sched_assoc_vsi_to_agg(struct ice_port_info *pi, u32 agg_id, + u16 vsi_handle, unsigned long *tc_bitmap) + { +- struct ice_sched_agg_vsi_info *agg_vsi_info, *old_agg_vsi_info = NULL; ++ struct ice_sched_agg_vsi_info *agg_vsi_info, *iter, *old_agg_vsi_info = NULL; + struct ice_sched_agg_info *agg_info, *old_agg_info; + struct ice_hw *hw = pi->hw; + int status = 0; +@@ -2774,11 +2774,13 @@ ice_sched_assoc_vsi_to_agg(struct ice_port_info *pi, u32 agg_id, + if (old_agg_info && old_agg_info != agg_info) { + struct ice_sched_agg_vsi_info *vtmp; + +- list_for_each_entry_safe(old_agg_vsi_info, vtmp, ++ list_for_each_entry_safe(iter, vtmp, + &old_agg_info->agg_vsi_list, + list_entry) +- if (old_agg_vsi_info->vsi_handle == vsi_handle) ++ if (iter->vsi_handle == vsi_handle) { ++ old_agg_vsi_info = iter; + break; ++ } + } + + /* check if entry already exist */ +-- +2.39.2 + diff --git a/queue-6.1/loop-loop_configure-send-uevents-for-partitions.patch b/queue-6.1/loop-loop_configure-send-uevents-for-partitions.patch new file mode 100644 index 00000000000..52e1f2c8050 --- /dev/null +++ b/queue-6.1/loop-loop_configure-send-uevents-for-partitions.patch @@ -0,0 +1,100 @@ +From c74f0a59c90199015d8c7a41d3ec65dcb3d65070 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 13:54:30 +0100 +Subject: loop: LOOP_CONFIGURE: send uevents for partitions + +From: Alyssa Ross + +[ Upstream commit bb430b69422640891b0b8db762885730579a4145 ] + +LOOP_CONFIGURE is, as far as I understand it, supposed to be a way to +combine LOOP_SET_FD and LOOP_SET_STATUS64 into a single syscall. When +using LOOP_SET_FD+LOOP_SET_STATUS64, a single uevent would be sent for +each partition found on the loop device after the second ioctl(), but +when using LOOP_CONFIGURE, no such uevent was being sent. + +In the old setup, uevents are disabled for LOOP_SET_FD, but not for +LOOP_SET_STATUS64. This makes sense, as it prevents uevents being +sent for a partially configured device during LOOP_SET_FD - they're +only sent at the end of LOOP_SET_STATUS64. But for LOOP_CONFIGURE, +uevents were disabled for the entire operation, so that final +notification was never issued. To fix this, reduce the critical +section to exclude the loop_reread_partitions() call, which causes +the uevents to be issued, to after uevents are re-enabled, matching +the behaviour of the LOOP_SET_FD+LOOP_SET_STATUS64 combination. + +I noticed this because Busybox's losetup program recently changed from +using LOOP_SET_FD+LOOP_SET_STATUS64 to LOOP_CONFIGURE, and this broke +my setup, for which I want a notification from the kernel any time a +new partition becomes available. + +Signed-off-by: Alyssa Ross +[hch: reduced the critical section] +Signed-off-by: Christoph Hellwig +Fixes: 3448914e8cc5 ("loop: Add LOOP_CONFIGURE ioctl") +Link: https://lore.kernel.org/r/20230320125430.55367-1-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/loop.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 793ae876918ce..426d0b42685a0 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -1010,9 +1010,6 @@ static int loop_configure(struct loop_device *lo, fmode_t mode, + /* This is safe, since we have a reference from open(). */ + __module_get(THIS_MODULE); + +- /* suppress uevents while reconfiguring the device */ +- dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 1); +- + /* + * If we don't hold exclusive handle for the device, upgrade to it + * here to avoid changing device under exclusive owner. +@@ -1067,6 +1064,9 @@ static int loop_configure(struct loop_device *lo, fmode_t mode, + } + } + ++ /* suppress uevents while reconfiguring the device */ ++ dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 1); ++ + disk_force_media_change(lo->lo_disk, DISK_EVENT_MEDIA_CHANGE); + set_disk_ro(lo->lo_disk, (lo->lo_flags & LO_FLAGS_READ_ONLY) != 0); + +@@ -1109,17 +1109,17 @@ static int loop_configure(struct loop_device *lo, fmode_t mode, + if (partscan) + clear_bit(GD_SUPPRESS_PART_SCAN, &lo->lo_disk->state); + ++ /* enable and uncork uevent now that we are done */ ++ dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 0); ++ + loop_global_unlock(lo, is_loop); + if (partscan) + loop_reread_partitions(lo); ++ + if (!(mode & FMODE_EXCL)) + bd_abort_claiming(bdev, loop_configure); + +- error = 0; +-done: +- /* enable and uncork uevent now that we are done */ +- dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 0); +- return error; ++ return 0; + + out_unlock: + loop_global_unlock(lo, is_loop); +@@ -1130,7 +1130,7 @@ static int loop_configure(struct loop_device *lo, fmode_t mode, + fput(file); + /* This is safe: open() is still holding a reference. */ + module_put(THIS_MODULE); +- goto done; ++ return error; + } + + static void __loop_clr_fd(struct loop_device *lo, bool release) +-- +2.39.2 + diff --git a/queue-6.1/mips-bmips-bcm6358-disable-rac-flush-for-tp1.patch b/queue-6.1/mips-bmips-bcm6358-disable-rac-flush-for-tp1.patch new file mode 100644 index 00000000000..f9bc20fb913 --- /dev/null +++ b/queue-6.1/mips-bmips-bcm6358-disable-rac-flush-for-tp1.patch @@ -0,0 +1,117 @@ +From b30514ff2eacde2f119912f4a77d97419876d277 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 11:20:04 +0100 +Subject: mips: bmips: BCM6358: disable RAC flush for TP1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Álvaro Fernández Rojas + +[ Upstream commit ab327f8acdf8d06601fbf058859a539a9422afff ] + +RAC flush causes kernel panics on BCM6358 with EHCI/OHCI when booting from TP1: +[ 3.881739] usb 1-1: new high-speed USB device number 2 using ehci-platform +[ 3.895011] Reserved instruction in kernel code[#1]: +[ 3.900113] CPU: 0 PID: 1 Comm: init Not tainted 5.10.16 #0 +[ 3.905829] $ 0 : 00000000 10008700 00000000 77d94060 +[ 3.911238] $ 4 : 7fd1f088 00000000 81431cac 81431ca0 +[ 3.916641] $ 8 : 00000000 ffffefff 8075cd34 00000000 +[ 3.922043] $12 : 806f8d40 f3e812b7 00000000 000d9aaa +[ 3.927446] $16 : 7fd1f068 7fd1f080 7ff559b8 81428470 +[ 3.932848] $20 : 00000000 00000000 55590000 77d70000 +[ 3.938251] $24 : 00000018 00000010 +[ 3.943655] $28 : 81430000 81431e60 81431f28 800157fc +[ 3.949058] Hi : 00000000 +[ 3.952013] Lo : 00000000 +[ 3.955019] epc : 80015808 setup_sigcontext+0x54/0x24c +[ 3.960464] ra : 800157fc setup_sigcontext+0x48/0x24c +[ 3.965913] Status: 10008703 KERNEL EXL IE +[ 3.970216] Cause : 00800028 (ExcCode 0a) +[ 3.974340] PrId : 0002a010 (Broadcom BMIPS4350) +[ 3.979170] Modules linked in: ohci_platform ohci_hcd fsl_mph_dr_of ehci_platform ehci_fsl ehci_hcd gpio_button_hotplug usbcore nls_base usb_common +[ 3.992907] Process init (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=77e22ec8) +[ 4.000776] Stack : 81431ef4 7fd1f080 81431f28 81428470 7fd1f068 81431edc 7ff559b8 81428470 +[ 4.009467] 81431f28 7fd1f080 55590000 77d70000 77d5498c 80015c70 806f0000 8063ae74 +[ 4.018149] 08100002 81431f28 0000000a 08100002 81431f28 0000000a 77d6b418 00000003 +[ 4.026831] ffffffff 80016414 80080734 81431ecc 81431ecc 00000001 00000000 04000000 +[ 4.035512] 77d54874 00000000 00000000 00000000 00000000 00000012 00000002 00000000 +[ 4.044196] ... +[ 4.046706] Call Trace: +[ 4.049238] [<80015808>] setup_sigcontext+0x54/0x24c +[ 4.054356] [<80015c70>] setup_frame+0xdc/0x124 +[ 4.059015] [<80016414>] do_notify_resume+0x1dc/0x288 +[ 4.064207] [<80011b50>] work_notifysig+0x10/0x18 +[ 4.069036] +[ 4.070538] Code: 8fc300b4 00001025 26240008 ac830004 3c048063 0c0228aa 24846a00 26240010 +[ 4.080686] +[ 4.082517] ---[ end trace 22a8edb41f5f983b ]--- +[ 4.087374] Kernel panic - not syncing: Fatal exception +[ 4.092753] Rebooting in 1 seconds.. + +Because the bootloader (CFE) is not initializing the Read-ahead cache properly +on the second thread (TP1). Since the RAC was not initialized properly, we +should avoid flushing it at the risk of corrupting the instruction stream as +seen in the trace above. + +Fixes: d59098a0e9cb ("MIPS: bmips: use generic dma noncoherent ops") +Signed-off-by: Álvaro Fernández Rojas +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/bmips/dma.c | 5 +++++ + arch/mips/bmips/setup.c | 8 ++++++++ + 2 files changed, 13 insertions(+) + +diff --git a/arch/mips/bmips/dma.c b/arch/mips/bmips/dma.c +index 33788668cbdbf..3779e7855bd75 100644 +--- a/arch/mips/bmips/dma.c ++++ b/arch/mips/bmips/dma.c +@@ -5,6 +5,8 @@ + #include + #include + ++bool bmips_rac_flush_disable; ++ + void arch_sync_dma_for_cpu_all(void) + { + void __iomem *cbr = BMIPS_GET_CBR(); +@@ -15,6 +17,9 @@ void arch_sync_dma_for_cpu_all(void) + boot_cpu_type() != CPU_BMIPS4380) + return; + ++ if (unlikely(bmips_rac_flush_disable)) ++ return; ++ + /* Flush stale data out of the readahead cache */ + cfg = __raw_readl(cbr + BMIPS_RAC_CONFIG); + __raw_writel(cfg | 0x100, cbr + BMIPS_RAC_CONFIG); +diff --git a/arch/mips/bmips/setup.c b/arch/mips/bmips/setup.c +index e95b3f78e7cd4..549a6392a3d2d 100644 +--- a/arch/mips/bmips/setup.c ++++ b/arch/mips/bmips/setup.c +@@ -35,6 +35,8 @@ + #define REG_BCM6328_OTP ((void __iomem *)CKSEG1ADDR(0x1000062c)) + #define BCM6328_TP1_DISABLED BIT(9) + ++extern bool bmips_rac_flush_disable; ++ + static const unsigned long kbase = VMLINUX_LOAD_ADDRESS & 0xfff00000; + + struct bmips_quirk { +@@ -104,6 +106,12 @@ static void bcm6358_quirks(void) + * disable SMP for now + */ + bmips_smp_enabled = 0; ++ ++ /* ++ * RAC flush causes kernel panics on BCM6358 when booting from TP1 ++ * because the bootloader is not initializing it properly. ++ */ ++ bmips_rac_flush_disable = !!(read_c0_brcm_cmt_local() & (1 << 31)); + } + + static void bcm6368_quirks(void) +-- +2.39.2 + diff --git a/queue-6.1/mtd-nand-mxic-ecc-fix-mxic_ecc_data_xfer_wait_for_co.patch b/queue-6.1/mtd-nand-mxic-ecc-fix-mxic_ecc_data_xfer_wait_for_co.patch new file mode 100644 index 00000000000..a212420cf73 --- /dev/null +++ b/queue-6.1/mtd-nand-mxic-ecc-fix-mxic_ecc_data_xfer_wait_for_co.patch @@ -0,0 +1,44 @@ +From e441ee2a4f0bb1e693950104905178427474d63b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 12:08:45 +0100 +Subject: mtd: nand: mxic-ecc: Fix mxic_ecc_data_xfer_wait_for_completion() + when irq is used + +From: Christophe JAILLET + +[ Upstream commit 75dce6a941e3f16c3b4878c8b2f46d5d07c619ce ] + +wait_for_completion_timeout() and readl_poll_timeout() don't handle their +return value the same way. + +wait_for_completion_timeout() returns 0 on time out (and >0 in all other +cases) +readl_poll_timeout() returns 0 on success and -ETIMEDOUT upon a timeout. + +In order for the error handling path to work in both cases, the logic +against wait_for_completion_timeout() needs to be inverted. + +Fixes: 48e6633a9fa2 ("mtd: nand: mxic-ecc: Add Macronix external ECC engine support") +Signed-off-by: Christophe JAILLET +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/beddbc374557e44ceec897e68c4a5d12764ddbb9.1676459308.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/ecc-mxic.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mtd/nand/ecc-mxic.c b/drivers/mtd/nand/ecc-mxic.c +index 8afdca731b874..6b487ffe2f2dc 100644 +--- a/drivers/mtd/nand/ecc-mxic.c ++++ b/drivers/mtd/nand/ecc-mxic.c +@@ -429,6 +429,7 @@ static int mxic_ecc_data_xfer_wait_for_completion(struct mxic_ecc_engine *mxic) + mxic_ecc_enable_int(mxic); + ret = wait_for_completion_timeout(&mxic->complete, + msecs_to_jiffies(1000)); ++ ret = ret ? 0 : -ETIMEDOUT; + mxic_ecc_disable_int(mxic); + } else { + ret = readl_poll_timeout(mxic->regs + INTRPT_STS, val, +-- +2.39.2 + diff --git a/queue-6.1/mtd-rawnand-meson-initialize-struct-with-zeroes.patch b/queue-6.1/mtd-rawnand-meson-initialize-struct-with-zeroes.patch new file mode 100644 index 00000000000..ccfca9c1f60 --- /dev/null +++ b/queue-6.1/mtd-rawnand-meson-initialize-struct-with-zeroes.patch @@ -0,0 +1,59 @@ +From 912cc0accb86cb57ce65868dce707910bdbae4d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 13:24:25 +0300 +Subject: mtd: rawnand: meson: initialize struct with zeroes + +From: Arseniy Krasnov + +[ Upstream commit 4ce341de6c02d02aba7c78a6447ccfcaa9eeb328 ] + +This structure must be zeroed, because it's field 'hw->core' is used as +'parent' in 'clk_core_fill_parent_index()', but it will be uninitialized. +This happens, because when this struct is not zeroed, pointer 'hw' is +"initialized" by garbage, which is valid pointer, but points to some +garbage. So 'hw' will be dereferenced, but 'core' contains some random +data which will be interpreted as a pointer. The following backtrace is +result of dereference of such pointer: + +[ 1.081319] __clk_register+0x414/0x820 +[ 1.085113] devm_clk_register+0x64/0xd0 +[ 1.088995] meson_nfc_probe+0x258/0x6ec +[ 1.092875] platform_probe+0x70/0xf0 +[ 1.096498] really_probe+0xc8/0x3e0 +[ 1.100034] __driver_probe_device+0x84/0x190 +[ 1.104346] driver_probe_device+0x44/0x120 +[ 1.108487] __driver_attach+0xb4/0x220 +[ 1.112282] bus_for_each_dev+0x78/0xd0 +[ 1.116077] driver_attach+0x2c/0x40 +[ 1.119613] bus_add_driver+0x184/0x240 +[ 1.123408] driver_register+0x80/0x140 +[ 1.127203] __platform_driver_register+0x30/0x40 +[ 1.131860] meson_nfc_driver_init+0x24/0x30 + +Fixes: 1e4d3ba66888 ("mtd: rawnand: meson: fix the clock") +Signed-off-by: Arseniy Krasnov +Acked-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230227102425.793841-1-AVKrasnov@sberdevices.ru +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/meson_nand.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c +index 5ee01231ac4cd..30e326adabfc1 100644 +--- a/drivers/mtd/nand/raw/meson_nand.c ++++ b/drivers/mtd/nand/raw/meson_nand.c +@@ -991,7 +991,7 @@ static const struct mtd_ooblayout_ops meson_ooblayout_ops = { + + static int meson_nfc_clk_init(struct meson_nfc *nfc) + { +- struct clk_parent_data nfc_divider_parent_data[1]; ++ struct clk_parent_data nfc_divider_parent_data[1] = {0}; + struct clk_init_data init = {0}; + int ret; + +-- +2.39.2 + diff --git a/queue-6.1/mtd-rawnand-meson-invalidate-cache-on-polling-ecc-bi.patch b/queue-6.1/mtd-rawnand-meson-invalidate-cache-on-polling-ecc-bi.patch new file mode 100644 index 00000000000..e0bf7fb4dcd --- /dev/null +++ b/queue-6.1/mtd-rawnand-meson-invalidate-cache-on-polling-ecc-bi.patch @@ -0,0 +1,68 @@ +From 8a0c0fe6fd0e4f7b222ca07ba3735eafa86ee333 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 10:32:44 +0300 +Subject: mtd: rawnand: meson: invalidate cache on polling ECC bit + +From: Arseniy Krasnov + +[ Upstream commit e732e39ed9929c05fd219035bc9653ba4100d4fa ] + +'info_buf' memory is cached and driver polls ECC bit in it. This bit +is set by the NAND controller. If 'usleep_range()' returns before device +sets this bit, 'info_buf' will be cached and driver won't see update of +this bit and will loop forever. + +Fixes: 8fae856c5350 ("mtd: rawnand: meson: add support for Amlogic NAND flash controller") +Signed-off-by: Arseniy Krasnov +Reviewed-by: Neil Armstrong +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/d4ef0bd6-816e-f6fa-9385-f05f775f0ae2@sberdevices.ru +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/meson_nand.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c +index 30e326adabfc1..a28574c009003 100644 +--- a/drivers/mtd/nand/raw/meson_nand.c ++++ b/drivers/mtd/nand/raw/meson_nand.c +@@ -176,6 +176,7 @@ struct meson_nfc { + + dma_addr_t daddr; + dma_addr_t iaddr; ++ u32 info_bytes; + + unsigned long assigned_cs; + }; +@@ -503,6 +504,7 @@ static int meson_nfc_dma_buffer_setup(struct nand_chip *nand, void *databuf, + nfc->daddr, datalen, dir); + return ret; + } ++ nfc->info_bytes = infolen; + cmd = GENCMDIADDRL(NFC_CMD_AIL, nfc->iaddr); + writel(cmd, nfc->reg_base + NFC_REG_CMD); + +@@ -520,8 +522,10 @@ static void meson_nfc_dma_buffer_release(struct nand_chip *nand, + struct meson_nfc *nfc = nand_get_controller_data(nand); + + dma_unmap_single(nfc->dev, nfc->daddr, datalen, dir); +- if (infolen) ++ if (infolen) { + dma_unmap_single(nfc->dev, nfc->iaddr, infolen, dir); ++ nfc->info_bytes = 0; ++ } + } + + static int meson_nfc_read_buf(struct nand_chip *nand, u8 *buf, int len) +@@ -710,6 +714,8 @@ static void meson_nfc_check_ecc_pages_valid(struct meson_nfc *nfc, + usleep_range(10, 15); + /* info is updated by nfc dma engine*/ + smp_rmb(); ++ dma_sync_single_for_cpu(nfc->dev, nfc->iaddr, nfc->info_bytes, ++ DMA_FROM_DEVICE); + ret = *info & ECC_COMPLETE; + } while (!ret); + } +-- +2.39.2 + diff --git a/queue-6.1/net-dsa-microchip-ksz8-fix-ksz8_fdb_dump-to-extract-.patch b/queue-6.1/net-dsa-microchip-ksz8-fix-ksz8_fdb_dump-to-extract-.patch new file mode 100644 index 00000000000..302a76f8c73 --- /dev/null +++ b/queue-6.1/net-dsa-microchip-ksz8-fix-ksz8_fdb_dump-to-extract-.patch @@ -0,0 +1,56 @@ +From 88e86126ac0c7be2dd32a7439b26c7b0d8513826 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 09:06:04 +0100 +Subject: net: dsa: microchip: ksz8: fix ksz8_fdb_dump() to extract all 1024 + entries + +From: Oleksij Rempel + +[ Upstream commit 5d90492dd4ff50ad65c582c76c345d0b90001728 ] + +Current ksz8_fdb_dump() is able to extract only max 249 entries on +the ksz8863/ksz8873 series of switches. This happened due to wrong +bit mask and offset calculation. + +This commit corrects the issue and allows for the complete extraction of +all 1024 entries. + +Fixes: 4b20a07e103f ("net: dsa: microchip: ksz8795: add support for ksz88xx chips") +Signed-off-by: Oleksij Rempel +Acked-by: Arun Ramadoss +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz_common.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c +index 07f6776bba12b..b15a0b844c34b 100644 +--- a/drivers/net/dsa/microchip/ksz_common.c ++++ b/drivers/net/dsa/microchip/ksz_common.c +@@ -360,10 +360,10 @@ static const u32 ksz8863_masks[] = { + [STATIC_MAC_TABLE_FID] = GENMASK(29, 26), + [STATIC_MAC_TABLE_OVERRIDE] = BIT(20), + [STATIC_MAC_TABLE_FWD_PORTS] = GENMASK(18, 16), +- [DYNAMIC_MAC_TABLE_ENTRIES_H] = GENMASK(5, 0), ++ [DYNAMIC_MAC_TABLE_ENTRIES_H] = GENMASK(1, 0), + [DYNAMIC_MAC_TABLE_MAC_EMPTY] = BIT(7), + [DYNAMIC_MAC_TABLE_NOT_READY] = BIT(7), +- [DYNAMIC_MAC_TABLE_ENTRIES] = GENMASK(31, 28), ++ [DYNAMIC_MAC_TABLE_ENTRIES] = GENMASK(31, 24), + [DYNAMIC_MAC_TABLE_FID] = GENMASK(19, 16), + [DYNAMIC_MAC_TABLE_SRC_PORT] = GENMASK(21, 20), + [DYNAMIC_MAC_TABLE_TIMESTAMP] = GENMASK(23, 22), +@@ -373,7 +373,7 @@ static u8 ksz8863_shifts[] = { + [VLAN_TABLE_MEMBERSHIP_S] = 16, + [STATIC_MAC_FWD_PORTS] = 16, + [STATIC_MAC_FID] = 22, +- [DYNAMIC_MAC_ENTRIES_H] = 3, ++ [DYNAMIC_MAC_ENTRIES_H] = 8, + [DYNAMIC_MAC_ENTRIES] = 24, + [DYNAMIC_MAC_FID] = 16, + [DYNAMIC_MAC_TIMESTAMP] = 24, +-- +2.39.2 + diff --git a/queue-6.1/net-dsa-microchip-ksz8-fix-ksz8_fdb_dump.patch b/queue-6.1/net-dsa-microchip-ksz8-fix-ksz8_fdb_dump.patch new file mode 100644 index 00000000000..53f942a98f5 --- /dev/null +++ b/queue-6.1/net-dsa-microchip-ksz8-fix-ksz8_fdb_dump.patch @@ -0,0 +1,52 @@ +From 448da3f486b30b6c8c9bacc048a169b32bfc9dd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 09:06:03 +0100 +Subject: net: dsa: microchip: ksz8: fix ksz8_fdb_dump() + +From: Oleksij Rempel + +[ Upstream commit 88e943e83827a349f70c3464b3eba7260be7461d ] + +Before this patch, the ksz8_fdb_dump() function had several issues, such +as uninitialized variables and incorrect usage of source port as a bit +mask. These problems caused inaccurate reporting of vid information and +port assignment in the bridge fdb. + +Fixes: e587be759e6e ("net: dsa: microchip: update fdb add/del/dump in ksz_common") +Signed-off-by: Oleksij Rempel +Acked-by: Arun Ramadoss +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz8795.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/dsa/microchip/ksz8795.c b/drivers/net/dsa/microchip/ksz8795.c +index bd3b133e7085b..22250ae222b5b 100644 +--- a/drivers/net/dsa/microchip/ksz8795.c ++++ b/drivers/net/dsa/microchip/ksz8795.c +@@ -907,15 +907,14 @@ int ksz8_fdb_dump(struct ksz_device *dev, int port, + u16 entries = 0; + u8 timestamp = 0; + u8 fid; +- u8 member; +- struct alu_struct alu; ++ u8 src_port; ++ u8 mac[ETH_ALEN]; + + do { +- alu.is_static = false; +- ret = ksz8_r_dyn_mac_table(dev, i, alu.mac, &fid, &member, ++ ret = ksz8_r_dyn_mac_table(dev, i, mac, &fid, &src_port, + ×tamp, &entries); +- if (!ret && (member & BIT(port))) { +- ret = cb(alu.mac, alu.fid, alu.is_static, data); ++ if (!ret && port == src_port) { ++ ret = cb(mac, fid, false, data); + if (ret) + break; + } +-- +2.39.2 + diff --git a/queue-6.1/net-dsa-microchip-ksz8-fix-mdb-configuration-with-no.patch b/queue-6.1/net-dsa-microchip-ksz8-fix-mdb-configuration-with-no.patch new file mode 100644 index 00000000000..81f173dda07 --- /dev/null +++ b/queue-6.1/net-dsa-microchip-ksz8-fix-mdb-configuration-with-no.patch @@ -0,0 +1,40 @@ +From b7cf29ca0efb19c614734b495236ec10e4fa1198 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 09:06:08 +0100 +Subject: net: dsa: microchip: ksz8: fix MDB configuration with non-zero VID + +From: Oleksij Rempel + +[ Upstream commit 9aa5757e1f71d85facdc3c98028762cbab8d15c7 ] + +FID is directly mapped to VID. However, configuring a MAC address with a +VID != 0 resulted in incorrect configuration due to an incorrect bit +mask. This kernel commit fixed the issue by correcting the bit mask and +ensuring proper configuration of MAC addresses with non-zero VID. + +Fixes: 4b20a07e103f ("net: dsa: microchip: ksz8795: add support for ksz88xx chips") +Signed-off-by: Oleksij Rempel +Acked-by: Arun Ramadoss +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz_common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c +index 286e081830e7c..3d59298eaa5cf 100644 +--- a/drivers/net/dsa/microchip/ksz_common.c ++++ b/drivers/net/dsa/microchip/ksz_common.c +@@ -357,7 +357,7 @@ static const u32 ksz8863_masks[] = { + [VLAN_TABLE_VALID] = BIT(19), + [STATIC_MAC_TABLE_VALID] = BIT(19), + [STATIC_MAC_TABLE_USE_FID] = BIT(21), +- [STATIC_MAC_TABLE_FID] = GENMASK(29, 26), ++ [STATIC_MAC_TABLE_FID] = GENMASK(25, 22), + [STATIC_MAC_TABLE_OVERRIDE] = BIT(20), + [STATIC_MAC_TABLE_FWD_PORTS] = GENMASK(18, 16), + [DYNAMIC_MAC_TABLE_ENTRIES_H] = GENMASK(1, 0), +-- +2.39.2 + diff --git a/queue-6.1/net-dsa-microchip-ksz8-fix-offset-for-the-timestamp-.patch b/queue-6.1/net-dsa-microchip-ksz8-fix-offset-for-the-timestamp-.patch new file mode 100644 index 00000000000..476f799b31e --- /dev/null +++ b/queue-6.1/net-dsa-microchip-ksz8-fix-offset-for-the-timestamp-.patch @@ -0,0 +1,37 @@ +From 1ed643d2938f4141dde8824ecfe1f93b50fdf3a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 09:06:05 +0100 +Subject: net: dsa: microchip: ksz8: fix offset for the timestamp filed + +From: Oleksij Rempel + +[ Upstream commit b3177aab89be540dc50d2328427b073361093e38 ] + +We are using wrong offset, so we will get not a timestamp. + +Fixes: 4b20a07e103f ("net: dsa: microchip: ksz8795: add support for ksz88xx chips") +Signed-off-by: Oleksij Rempel +Acked-by: Arun Ramadoss +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz_common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c +index b15a0b844c34b..160d7ad26ca09 100644 +--- a/drivers/net/dsa/microchip/ksz_common.c ++++ b/drivers/net/dsa/microchip/ksz_common.c +@@ -376,7 +376,7 @@ static u8 ksz8863_shifts[] = { + [DYNAMIC_MAC_ENTRIES_H] = 8, + [DYNAMIC_MAC_ENTRIES] = 24, + [DYNAMIC_MAC_FID] = 16, +- [DYNAMIC_MAC_TIMESTAMP] = 24, ++ [DYNAMIC_MAC_TIMESTAMP] = 22, + [DYNAMIC_MAC_SRC_PORT] = 20, + }; + +-- +2.39.2 + diff --git a/queue-6.1/net-dsa-microchip-ksz8-ksz8_fdb_dump-avoid-extractin.patch b/queue-6.1/net-dsa-microchip-ksz8-ksz8_fdb_dump-avoid-extractin.patch new file mode 100644 index 00000000000..9ecb4358fce --- /dev/null +++ b/queue-6.1/net-dsa-microchip-ksz8-ksz8_fdb_dump-avoid-extractin.patch @@ -0,0 +1,39 @@ +From e06adb99e0789707f57a460d09b6f1e901eca0f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 09:06:06 +0100 +Subject: net: dsa: microchip: ksz8: ksz8_fdb_dump: avoid extracting ghost + entry from empty dynamic MAC table. + +From: Oleksij Rempel + +[ Upstream commit 492606cdc74804d372ab1bdb8f3ef4a6fb6f9f59 ] + +If the dynamic MAC table is empty, we will still extract one outdated +entry. Fix it by using correct bit offset. + +Fixes: 4b20a07e103f ("net: dsa: microchip: ksz8795: add support for ksz88xx chips") +Signed-off-by: Oleksij Rempel +Acked-by: Arun Ramadoss +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz_common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c +index 160d7ad26ca09..286e081830e7c 100644 +--- a/drivers/net/dsa/microchip/ksz_common.c ++++ b/drivers/net/dsa/microchip/ksz_common.c +@@ -361,7 +361,7 @@ static const u32 ksz8863_masks[] = { + [STATIC_MAC_TABLE_OVERRIDE] = BIT(20), + [STATIC_MAC_TABLE_FWD_PORTS] = GENMASK(18, 16), + [DYNAMIC_MAC_TABLE_ENTRIES_H] = GENMASK(1, 0), +- [DYNAMIC_MAC_TABLE_MAC_EMPTY] = BIT(7), ++ [DYNAMIC_MAC_TABLE_MAC_EMPTY] = BIT(2), + [DYNAMIC_MAC_TABLE_NOT_READY] = BIT(7), + [DYNAMIC_MAC_TABLE_ENTRIES] = GENMASK(31, 24), + [DYNAMIC_MAC_TABLE_FID] = GENMASK(19, 16), +-- +2.39.2 + diff --git a/queue-6.1/net-dsa-microchip-ksz8863_smi-fix-bulk-access.patch b/queue-6.1/net-dsa-microchip-ksz8863_smi-fix-bulk-access.patch new file mode 100644 index 00000000000..8de86b9fbdc --- /dev/null +++ b/queue-6.1/net-dsa-microchip-ksz8863_smi-fix-bulk-access.patch @@ -0,0 +1,90 @@ +From 5376e580ebbd4e4bbedd1ba8b156f53bb0ccc291 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 09:06:07 +0100 +Subject: net: dsa: microchip: ksz8863_smi: fix bulk access + +From: Oleksij Rempel + +[ Upstream commit 392ff7a84cbca34118ca286dfbfe8aee24605897 ] + +Current regmap bulk access is broken, resulting to wrong reads/writes +if ksz_read64/ksz_write64 functions are used. +Mostly this issue was visible by using ksz8_fdb_dump(), which returned +corrupt MAC address. + +The reason is that regmap was configured to have max_raw_read/write, +even if ksz8863_mdio_read/write functions are able to handle unlimited +read/write accesses. On ksz_read64 function we are using multiple 32bit +accesses by incrementing each access by 1 instead of 4. Resulting buffer +had 01234567.12345678 instead of 01234567.89abcdef. + +We have multiple ways to fix it: +- enable 4 byte alignment for 32bit accesses. Since the HW do not have + this requirement. It will break driver. +- disable max_raw_* limit. + +This patch is removing max_raw_* limit for regmap accesses in ksz8863_smi. + +Fixes: 60a364760002 ("net: dsa: microchip: Add Microchip KSZ8863 SMI based driver support") +Signed-off-by: Oleksij Rempel +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz8863_smi.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/drivers/net/dsa/microchip/ksz8863_smi.c b/drivers/net/dsa/microchip/ksz8863_smi.c +index ddb40838181ef..ed77ac2228951 100644 +--- a/drivers/net/dsa/microchip/ksz8863_smi.c ++++ b/drivers/net/dsa/microchip/ksz8863_smi.c +@@ -82,22 +82,16 @@ static const struct regmap_bus regmap_smi[] = { + { + .read = ksz8863_mdio_read, + .write = ksz8863_mdio_write, +- .max_raw_read = 1, +- .max_raw_write = 1, + }, + { + .read = ksz8863_mdio_read, + .write = ksz8863_mdio_write, + .val_format_endian_default = REGMAP_ENDIAN_BIG, +- .max_raw_read = 2, +- .max_raw_write = 2, + }, + { + .read = ksz8863_mdio_read, + .write = ksz8863_mdio_write, + .val_format_endian_default = REGMAP_ENDIAN_BIG, +- .max_raw_read = 4, +- .max_raw_write = 4, + } + }; + +@@ -108,7 +102,6 @@ static const struct regmap_config ksz8863_regmap_config[] = { + .pad_bits = 24, + .val_bits = 8, + .cache_type = REGCACHE_NONE, +- .use_single_read = 1, + .lock = ksz_regmap_lock, + .unlock = ksz_regmap_unlock, + }, +@@ -118,7 +111,6 @@ static const struct regmap_config ksz8863_regmap_config[] = { + .pad_bits = 24, + .val_bits = 16, + .cache_type = REGCACHE_NONE, +- .use_single_read = 1, + .lock = ksz_regmap_lock, + .unlock = ksz_regmap_unlock, + }, +@@ -128,7 +120,6 @@ static const struct regmap_config ksz8863_regmap_config[] = { + .pad_bits = 24, + .val_bits = 32, + .cache_type = REGCACHE_NONE, +- .use_single_read = 1, + .lock = ksz_regmap_lock, + .unlock = ksz_regmap_unlock, + } +-- +2.39.2 + diff --git a/queue-6.1/net-dsa-mv88e6xxx-enable-igmp-snooping-on-user-ports.patch b/queue-6.1/net-dsa-mv88e6xxx-enable-igmp-snooping-on-user-ports.patch new file mode 100644 index 00000000000..a905c3bc155 --- /dev/null +++ b/queue-6.1/net-dsa-mv88e6xxx-enable-igmp-snooping-on-user-ports.patch @@ -0,0 +1,55 @@ +From b8de1c4d6934846573ec4c70e9ff0285a9d20879 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Mar 2023 12:01:40 -0300 +Subject: net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Steffen Bätz + +[ Upstream commit 7bcad0f0e6fbc1d613e49e0ee35c8e5f2e685bb0 ] + +Do not set the MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP bit on CPU or DSA ports. + +This allows the host CPU port to be a regular IGMP listener by sending out +IGMP Membership Reports, which would otherwise not be forwarded by the +mv88exxx chip, but directly looped back to the CPU port itself. + +Fixes: 54d792f257c6 ("net: dsa: Centralise global and port setup code into mv88e6xxx.") +Signed-off-by: Steffen Bätz +Signed-off-by: Fabio Estevam +Reviewed-by: Andrew Lunn +Reviewed-by: Vladimir Oltean +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20230329150140.701559-1-festevam@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 3a6db36574ad7..8cf27e2654fcf 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -3354,9 +3354,14 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port) + * If this is the upstream port for this switch, enable + * forwarding of unknown unicasts and multicasts. + */ +- reg = MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP | +- MV88E6185_PORT_CTL0_USE_TAG | MV88E6185_PORT_CTL0_USE_IP | ++ reg = MV88E6185_PORT_CTL0_USE_TAG | MV88E6185_PORT_CTL0_USE_IP | + MV88E6XXX_PORT_CTL0_STATE_FORWARDING; ++ /* Forward any IPv4 IGMP or IPv6 MLD frames received ++ * by a USER port to the CPU port to allow snooping. ++ */ ++ if (dsa_is_user_port(ds, port)) ++ reg |= MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP; ++ + err = mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_CTL0, reg); + if (err) + return err; +-- +2.39.2 + diff --git a/queue-6.1/net-dsa-realtek-fix-out-of-bounds-access.patch b/queue-6.1/net-dsa-realtek-fix-out-of-bounds-access.patch new file mode 100644 index 00000000000..1685507712e --- /dev/null +++ b/queue-6.1/net-dsa-realtek-fix-out-of-bounds-access.patch @@ -0,0 +1,64 @@ +From 6df54d34dda3096c63182093b5f9487aaad1a64f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 11:37:35 +0100 +Subject: net: dsa: realtek: fix out-of-bounds access +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ahmad Fatoum + +[ Upstream commit b93eb564869321d0dffaf23fcc5c88112ed62466 ] + +The probe function sets priv->chip_data to (void *)priv + sizeof(*priv) +with the expectation that priv has enough trailing space. + +However, only realtek-smi actually allocated this chip_data space. +Do likewise in realtek-mdio to fix out-of-bounds accesses. + +These accesses likely went unnoticed so far, because of an (unused) +buf[4096] member in struct realtek_priv, which caused kmalloc to +round up the allocated buffer to a big enough size, so nothing of +value was overwritten. With a different allocator (like in the barebox +bootloader port of the driver) or with KASAN, the memory corruption +becomes quickly apparent. + +Fixes: aac94001067d ("net: dsa: realtek: add new mdio interface for drivers") +Reviewed-by: Florian Fainelli +Reviewed-by: Luiz Angelo Daros de Luca +Reviewed-by: Alvin Å ipraga +Reviewed-by: Linus Walleij +Signed-off-by: Ahmad Fatoum +Link: https://lore.kernel.org/r/20230323103735.2331786-1-a.fatoum@pengutronix.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/realtek/realtek-mdio.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/realtek/realtek-mdio.c b/drivers/net/dsa/realtek/realtek-mdio.c +index 3e54fac5f9027..5a8fe707ca25e 100644 +--- a/drivers/net/dsa/realtek/realtek-mdio.c ++++ b/drivers/net/dsa/realtek/realtek-mdio.c +@@ -21,6 +21,7 @@ + + #include + #include ++#include + #include + + #include "realtek.h" +@@ -152,7 +153,9 @@ static int realtek_mdio_probe(struct mdio_device *mdiodev) + if (!var) + return -EINVAL; + +- priv = devm_kzalloc(&mdiodev->dev, sizeof(*priv), GFP_KERNEL); ++ priv = devm_kzalloc(&mdiodev->dev, ++ size_add(sizeof(*priv), var->chip_data_sz), ++ GFP_KERNEL); + if (!priv) + return -ENOMEM; + +-- +2.39.2 + diff --git a/queue-6.1/net-ethernet-mtk_eth_soc-add-missing-ppe-cache-flush.patch b/queue-6.1/net-ethernet-mtk_eth_soc-add-missing-ppe-cache-flush.patch new file mode 100644 index 00000000000..2270d2511a0 --- /dev/null +++ b/queue-6.1/net-ethernet-mtk_eth_soc-add-missing-ppe-cache-flush.patch @@ -0,0 +1,39 @@ +From 1919ba92d72bd121410a1ef35bb1ab43d4606c1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Mar 2023 14:08:40 +0200 +Subject: net: ethernet: mtk_eth_soc: add missing ppe cache flush when deleting + a flow + +From: Felix Fietkau + +[ Upstream commit 924531326e2dd4ceabe7240f2b55a88e7d894ec2 ] + +The cache needs to be flushed to ensure that the hardware stops offloading +the flow immediately. + +Fixes: 33fc42de3327 ("net: ethernet: mtk_eth_soc: support creating mac address based offload entries") +Reviewed-by: Simon Horman +Signed-off-by: Felix Fietkau +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20230330120840.52079-3-nbd@nbd.name +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_ppe.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mediatek/mtk_ppe.c b/drivers/net/ethernet/mediatek/mtk_ppe.c +index 34ea8af48c3d0..d6eed204574a9 100644 +--- a/drivers/net/ethernet/mediatek/mtk_ppe.c ++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c +@@ -438,6 +438,7 @@ __mtk_foe_entry_clear(struct mtk_ppe *ppe, struct mtk_flow_entry *entry) + hwe->ib1 &= ~MTK_FOE_IB1_STATE; + hwe->ib1 |= FIELD_PREP(MTK_FOE_IB1_STATE, MTK_FOE_STATE_INVALID); + dma_wmb(); ++ mtk_ppe_cache_clear(ppe); + } + entry->hash = 0xffff; + +-- +2.39.2 + diff --git a/queue-6.1/net-ethernet-mtk_eth_soc-fix-flow-block-refcounting-.patch b/queue-6.1/net-ethernet-mtk_eth_soc-fix-flow-block-refcounting-.patch new file mode 100644 index 00000000000..00891637196 --- /dev/null +++ b/queue-6.1/net-ethernet-mtk_eth_soc-fix-flow-block-refcounting-.patch @@ -0,0 +1,48 @@ +From ed4b4e931791b7d6d959179992adf331e0382210 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Mar 2023 14:08:38 +0200 +Subject: net: ethernet: mtk_eth_soc: fix flow block refcounting logic + +From: Felix Fietkau + +[ Upstream commit 8c1cb87c2a5c29da416848451a687473f379611c ] + +Since we call flow_block_cb_decref on FLOW_BLOCK_UNBIND, we also need to +call flow_block_cb_incref for a newly allocated cb. +Also fix the accidentally inverted refcount check on unbind. + +Fixes: 502e84e2382d ("net: ethernet: mtk_eth_soc: add flow offloading support") +Reviewed-by: Simon Horman +Signed-off-by: Felix Fietkau +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20230330120840.52079-1-nbd@nbd.name +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_ppe_offload.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c +index 28bbd1df3e305..6a72687d5b83f 100644 +--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c ++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c +@@ -570,6 +570,7 @@ mtk_eth_setup_tc_block(struct net_device *dev, struct flow_block_offload *f) + if (IS_ERR(block_cb)) + return PTR_ERR(block_cb); + ++ flow_block_cb_incref(block_cb); + flow_block_cb_add(block_cb, f); + list_add_tail(&block_cb->driver_list, &block_cb_list); + return 0; +@@ -578,7 +579,7 @@ mtk_eth_setup_tc_block(struct net_device *dev, struct flow_block_offload *f) + if (!block_cb) + return -ENOENT; + +- if (flow_block_cb_decref(block_cb)) { ++ if (!flow_block_cb_decref(block_cb)) { + flow_block_cb_remove(block_cb, f); + list_del(&block_cb->driver_list); + } +-- +2.39.2 + diff --git a/queue-6.1/net-ipa-compute-dma-pool-size-properly.patch b/queue-6.1/net-ipa-compute-dma-pool-size-properly.patch new file mode 100644 index 00000000000..5615b836e78 --- /dev/null +++ b/queue-6.1/net-ipa-compute-dma-pool-size-properly.patch @@ -0,0 +1,56 @@ +From 59c6fbed5807b3d7aed8000532b7c44884b20234 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 11:27:51 -0500 +Subject: net: ipa: compute DMA pool size properly + +From: Alex Elder + +[ Upstream commit 6c75dc94f2b27fff57b305af9236eea181a00b6c ] + +In gsi_trans_pool_init_dma(), the total size of a pool of memory +used for DMA transactions is calculated. However the calculation is +done incorrectly. + +For 4KB pages, this total size is currently always more than one +page, and as a result, the calculation produces a positive (though +incorrect) total size. The code still works in this case; we just +end up with fewer DMA pool entries than we intended. + +Bjorn Andersson tested booting a kernel with 16KB pages, and hit a +null pointer derereference in sg_alloc_append_table_from_pages(), +descending from gsi_trans_pool_init_dma(). The cause of this was +that a 16KB total size was going to be allocated, and with 16KB +pages the order of that allocation is 0. The total_size calculation +yielded 0, which eventually led to the crash. + +Correcting the total_size calculation fixes the problem. + +Reported-by: Bjorn Andersson +Tested-by: Bjorn Andersson +Fixes: 9dd441e4ed57 ("soc: qcom: ipa: GSI transactions") +Reviewed-by: Mark Bloch +Signed-off-by: Alex Elder +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20230328162751.2861791-1-elder@linaro.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ipa/gsi_trans.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ipa/gsi_trans.c b/drivers/net/ipa/gsi_trans.c +index 26b7f683a3e17..fa6863c265eb9 100644 +--- a/drivers/net/ipa/gsi_trans.c ++++ b/drivers/net/ipa/gsi_trans.c +@@ -153,7 +153,7 @@ int gsi_trans_pool_init_dma(struct device *dev, struct gsi_trans_pool *pool, + * gsi_trans_pool_exit_dma() can assume the total allocated + * size is exactly (count * size). + */ +- total_size = get_order(total_size) << PAGE_SHIFT; ++ total_size = PAGE_SIZE << get_order(total_size); + + virt = dma_alloc_coherent(dev, total_size, &addr, GFP_KERNEL); + if (!virt) +-- +2.39.2 + diff --git a/queue-6.1/net-mvpp2-classifier-flow-fix-fragmentation-flags.patch b/queue-6.1/net-mvpp2-classifier-flow-fix-fragmentation-flags.patch new file mode 100644 index 00000000000..67fa6b61503 --- /dev/null +++ b/queue-6.1/net-mvpp2-classifier-flow-fix-fragmentation-flags.patch @@ -0,0 +1,117 @@ +From b8bdabaab6d6e4bcee059e74c8bd3be1828eda2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Mar 2023 17:40:29 +0100 +Subject: net: mvpp2: classifier flow fix fragmentation flags + +From: Sven Auhagen + +[ Upstream commit 9a251cae51d57289908222e6c322ca61fccc25fd ] + +Add missing IP Fragmentation Flag. + +Fixes: f9358e12a0af ("net: mvpp2: split ingress traffic into multiple flows") +Signed-off-by: Sven Auhagen +Reviewed-by: Marcin Wojtas +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../net/ethernet/marvell/mvpp2/mvpp2_cls.c | 30 +++++++++++-------- + 1 file changed, 18 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c +index 41d935d1aaf6f..40aeaa7bd739f 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c +@@ -62,35 +62,38 @@ static const struct mvpp2_cls_flow cls_flows[MVPP2_N_PRS_FLOWS] = { + MVPP2_DEF_FLOW(MVPP22_FLOW_TCP4, MVPP2_FL_IP4_TCP_FRAG_UNTAG, + MVPP22_CLS_HEK_IP4_2T, + MVPP2_PRS_RI_VLAN_NONE | MVPP2_PRS_RI_L3_IP4 | +- MVPP2_PRS_RI_L4_TCP, ++ MVPP2_PRS_RI_IP_FRAG_TRUE | MVPP2_PRS_RI_L4_TCP, + MVPP2_PRS_IP_MASK | MVPP2_PRS_RI_VLAN_MASK), + + MVPP2_DEF_FLOW(MVPP22_FLOW_TCP4, MVPP2_FL_IP4_TCP_FRAG_UNTAG, + MVPP22_CLS_HEK_IP4_2T, + MVPP2_PRS_RI_VLAN_NONE | MVPP2_PRS_RI_L3_IP4_OPT | +- MVPP2_PRS_RI_L4_TCP, ++ MVPP2_PRS_RI_IP_FRAG_TRUE | MVPP2_PRS_RI_L4_TCP, + MVPP2_PRS_IP_MASK | MVPP2_PRS_RI_VLAN_MASK), + + MVPP2_DEF_FLOW(MVPP22_FLOW_TCP4, MVPP2_FL_IP4_TCP_FRAG_UNTAG, + MVPP22_CLS_HEK_IP4_2T, + MVPP2_PRS_RI_VLAN_NONE | MVPP2_PRS_RI_L3_IP4_OTHER | +- MVPP2_PRS_RI_L4_TCP, ++ MVPP2_PRS_RI_IP_FRAG_TRUE | MVPP2_PRS_RI_L4_TCP, + MVPP2_PRS_IP_MASK | MVPP2_PRS_RI_VLAN_MASK), + + /* TCP over IPv4 flows, fragmented, with vlan tag */ + MVPP2_DEF_FLOW(MVPP22_FLOW_TCP4, MVPP2_FL_IP4_TCP_FRAG_TAG, + MVPP22_CLS_HEK_IP4_2T | MVPP22_CLS_HEK_TAGGED, +- MVPP2_PRS_RI_L3_IP4 | MVPP2_PRS_RI_L4_TCP, ++ MVPP2_PRS_RI_L3_IP4 | MVPP2_PRS_RI_IP_FRAG_TRUE | ++ MVPP2_PRS_RI_L4_TCP, + MVPP2_PRS_IP_MASK), + + MVPP2_DEF_FLOW(MVPP22_FLOW_TCP4, MVPP2_FL_IP4_TCP_FRAG_TAG, + MVPP22_CLS_HEK_IP4_2T | MVPP22_CLS_HEK_TAGGED, +- MVPP2_PRS_RI_L3_IP4_OPT | MVPP2_PRS_RI_L4_TCP, ++ MVPP2_PRS_RI_L3_IP4_OPT | MVPP2_PRS_RI_IP_FRAG_TRUE | ++ MVPP2_PRS_RI_L4_TCP, + MVPP2_PRS_IP_MASK), + + MVPP2_DEF_FLOW(MVPP22_FLOW_TCP4, MVPP2_FL_IP4_TCP_FRAG_TAG, + MVPP22_CLS_HEK_IP4_2T | MVPP22_CLS_HEK_TAGGED, +- MVPP2_PRS_RI_L3_IP4_OTHER | MVPP2_PRS_RI_L4_TCP, ++ MVPP2_PRS_RI_L3_IP4_OTHER | MVPP2_PRS_RI_IP_FRAG_TRUE | ++ MVPP2_PRS_RI_L4_TCP, + MVPP2_PRS_IP_MASK), + + /* UDP over IPv4 flows, Not fragmented, no vlan tag */ +@@ -132,35 +135,38 @@ static const struct mvpp2_cls_flow cls_flows[MVPP2_N_PRS_FLOWS] = { + MVPP2_DEF_FLOW(MVPP22_FLOW_UDP4, MVPP2_FL_IP4_UDP_FRAG_UNTAG, + MVPP22_CLS_HEK_IP4_2T, + MVPP2_PRS_RI_VLAN_NONE | MVPP2_PRS_RI_L3_IP4 | +- MVPP2_PRS_RI_L4_UDP, ++ MVPP2_PRS_RI_IP_FRAG_TRUE | MVPP2_PRS_RI_L4_UDP, + MVPP2_PRS_IP_MASK | MVPP2_PRS_RI_VLAN_MASK), + + MVPP2_DEF_FLOW(MVPP22_FLOW_UDP4, MVPP2_FL_IP4_UDP_FRAG_UNTAG, + MVPP22_CLS_HEK_IP4_2T, + MVPP2_PRS_RI_VLAN_NONE | MVPP2_PRS_RI_L3_IP4_OPT | +- MVPP2_PRS_RI_L4_UDP, ++ MVPP2_PRS_RI_IP_FRAG_TRUE | MVPP2_PRS_RI_L4_UDP, + MVPP2_PRS_IP_MASK | MVPP2_PRS_RI_VLAN_MASK), + + MVPP2_DEF_FLOW(MVPP22_FLOW_UDP4, MVPP2_FL_IP4_UDP_FRAG_UNTAG, + MVPP22_CLS_HEK_IP4_2T, + MVPP2_PRS_RI_VLAN_NONE | MVPP2_PRS_RI_L3_IP4_OTHER | +- MVPP2_PRS_RI_L4_UDP, ++ MVPP2_PRS_RI_IP_FRAG_TRUE | MVPP2_PRS_RI_L4_UDP, + MVPP2_PRS_IP_MASK | MVPP2_PRS_RI_VLAN_MASK), + + /* UDP over IPv4 flows, fragmented, with vlan tag */ + MVPP2_DEF_FLOW(MVPP22_FLOW_UDP4, MVPP2_FL_IP4_UDP_FRAG_TAG, + MVPP22_CLS_HEK_IP4_2T | MVPP22_CLS_HEK_TAGGED, +- MVPP2_PRS_RI_L3_IP4 | MVPP2_PRS_RI_L4_UDP, ++ MVPP2_PRS_RI_L3_IP4 | MVPP2_PRS_RI_IP_FRAG_TRUE | ++ MVPP2_PRS_RI_L4_UDP, + MVPP2_PRS_IP_MASK), + + MVPP2_DEF_FLOW(MVPP22_FLOW_UDP4, MVPP2_FL_IP4_UDP_FRAG_TAG, + MVPP22_CLS_HEK_IP4_2T | MVPP22_CLS_HEK_TAGGED, +- MVPP2_PRS_RI_L3_IP4_OPT | MVPP2_PRS_RI_L4_UDP, ++ MVPP2_PRS_RI_L3_IP4_OPT | MVPP2_PRS_RI_IP_FRAG_TRUE | ++ MVPP2_PRS_RI_L4_UDP, + MVPP2_PRS_IP_MASK), + + MVPP2_DEF_FLOW(MVPP22_FLOW_UDP4, MVPP2_FL_IP4_UDP_FRAG_TAG, + MVPP22_CLS_HEK_IP4_2T | MVPP22_CLS_HEK_TAGGED, +- MVPP2_PRS_RI_L3_IP4_OTHER | MVPP2_PRS_RI_L4_UDP, ++ MVPP2_PRS_RI_L3_IP4_OTHER | MVPP2_PRS_RI_IP_FRAG_TRUE | ++ MVPP2_PRS_RI_L4_UDP, + MVPP2_PRS_IP_MASK), + + /* TCP over IPv6 flows, not fragmented, no vlan tag */ +-- +2.39.2 + diff --git a/queue-6.1/net-mvpp2-parser-fix-pppoe.patch b/queue-6.1/net-mvpp2-parser-fix-pppoe.patch new file mode 100644 index 00000000000..ad21281484a --- /dev/null +++ b/queue-6.1/net-mvpp2-parser-fix-pppoe.patch @@ -0,0 +1,123 @@ +From 7be460475896c9c8f0a03112211ddf20374018a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Mar 2023 17:41:05 +0100 +Subject: net: mvpp2: parser fix PPPoE + +From: Sven Auhagen + +[ Upstream commit 031a416c2170866be5132ae42e14453d669b0cb1 ] + +In PPPoE add all IPv4 header option length to the parser +and adjust the L3 and L4 offset accordingly. +Currently the L4 match does not work with PPPoE and +all packets are matched as L3 IP4 OPT. + +Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit") +Signed-off-by: Sven Auhagen +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../net/ethernet/marvell/mvpp2/mvpp2_prs.c | 82 ++++++++----------- + 1 file changed, 34 insertions(+), 48 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c +index ed8be396428b9..9af22f497a40f 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c +@@ -1607,59 +1607,45 @@ static int mvpp2_prs_vlan_init(struct platform_device *pdev, struct mvpp2 *priv) + static int mvpp2_prs_pppoe_init(struct mvpp2 *priv) + { + struct mvpp2_prs_entry pe; +- int tid; +- +- /* IPv4 over PPPoE with options */ +- tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID, +- MVPP2_PE_LAST_FREE_TID); +- if (tid < 0) +- return tid; +- +- memset(&pe, 0, sizeof(pe)); +- mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_PPPOE); +- pe.index = tid; +- +- mvpp2_prs_match_etype(&pe, 0, PPP_IP); +- +- mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_IP4); +- mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_L3_IP4_OPT, +- MVPP2_PRS_RI_L3_PROTO_MASK); +- /* goto ipv4 dest-address (skip eth_type + IP-header-size - 4) */ +- mvpp2_prs_sram_shift_set(&pe, MVPP2_ETH_TYPE_LEN + +- sizeof(struct iphdr) - 4, +- MVPP2_PRS_SRAM_OP_SEL_SHIFT_ADD); +- /* Set L3 offset */ +- mvpp2_prs_sram_offset_set(&pe, MVPP2_PRS_SRAM_UDF_TYPE_L3, +- MVPP2_ETH_TYPE_LEN, +- MVPP2_PRS_SRAM_OP_SEL_UDF_ADD); +- +- /* Update shadow table and hw entry */ +- mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_PPPOE); +- mvpp2_prs_hw_write(priv, &pe); ++ int tid, ihl; + +- /* IPv4 over PPPoE without options */ +- tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID, +- MVPP2_PE_LAST_FREE_TID); +- if (tid < 0) +- return tid; ++ /* IPv4 over PPPoE with header length >= 5 */ ++ for (ihl = MVPP2_PRS_IPV4_IHL_MIN; ihl <= MVPP2_PRS_IPV4_IHL_MAX; ihl++) { ++ tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID, ++ MVPP2_PE_LAST_FREE_TID); ++ if (tid < 0) ++ return tid; + +- pe.index = tid; ++ memset(&pe, 0, sizeof(pe)); ++ mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_PPPOE); ++ pe.index = tid; + +- mvpp2_prs_tcam_data_byte_set(&pe, MVPP2_ETH_TYPE_LEN, +- MVPP2_PRS_IPV4_HEAD | +- MVPP2_PRS_IPV4_IHL_MIN, +- MVPP2_PRS_IPV4_HEAD_MASK | +- MVPP2_PRS_IPV4_IHL_MASK); ++ mvpp2_prs_match_etype(&pe, 0, PPP_IP); ++ mvpp2_prs_tcam_data_byte_set(&pe, MVPP2_ETH_TYPE_LEN, ++ MVPP2_PRS_IPV4_HEAD | ihl, ++ MVPP2_PRS_IPV4_HEAD_MASK | ++ MVPP2_PRS_IPV4_IHL_MASK); + +- /* Clear ri before updating */ +- pe.sram[MVPP2_PRS_SRAM_RI_WORD] = 0x0; +- pe.sram[MVPP2_PRS_SRAM_RI_CTRL_WORD] = 0x0; +- mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_L3_IP4, +- MVPP2_PRS_RI_L3_PROTO_MASK); ++ mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_IP4); ++ mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_L3_IP4, ++ MVPP2_PRS_RI_L3_PROTO_MASK); ++ /* goto ipv4 dst-address (skip eth_type + IP-header-size - 4) */ ++ mvpp2_prs_sram_shift_set(&pe, MVPP2_ETH_TYPE_LEN + ++ sizeof(struct iphdr) - 4, ++ MVPP2_PRS_SRAM_OP_SEL_SHIFT_ADD); ++ /* Set L3 offset */ ++ mvpp2_prs_sram_offset_set(&pe, MVPP2_PRS_SRAM_UDF_TYPE_L3, ++ MVPP2_ETH_TYPE_LEN, ++ MVPP2_PRS_SRAM_OP_SEL_UDF_ADD); ++ /* Set L4 offset */ ++ mvpp2_prs_sram_offset_set(&pe, MVPP2_PRS_SRAM_UDF_TYPE_L4, ++ MVPP2_ETH_TYPE_LEN + (ihl * 4), ++ MVPP2_PRS_SRAM_OP_SEL_UDF_ADD); + +- /* Update shadow table and hw entry */ +- mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_PPPOE); +- mvpp2_prs_hw_write(priv, &pe); ++ /* Update shadow table and hw entry */ ++ mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_PPPOE); ++ mvpp2_prs_hw_write(priv, &pe); ++ } + + /* IPv6 over PPPoE */ + tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID, +-- +2.39.2 + diff --git a/queue-6.1/net-mvpp2-parser-fix-qinq.patch b/queue-6.1/net-mvpp2-parser-fix-qinq.patch new file mode 100644 index 00000000000..de776bfe88f --- /dev/null +++ b/queue-6.1/net-mvpp2-parser-fix-qinq.patch @@ -0,0 +1,40 @@ +From 03f1651968e750a8988fab71f099e7481b5a56da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Mar 2023 17:40:53 +0100 +Subject: net: mvpp2: parser fix QinQ + +From: Sven Auhagen + +[ Upstream commit a587a84813b90372cb0a7565e201a4075da67919 ] + +The mvpp2 parser entry for QinQ has the inner and outer VLAN +in the wrong order. +Fix the problem by swapping them. + +Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit") +Signed-off-by: Sven Auhagen +Reviewed-by: Marcin Wojtas +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c +index 75ba57bd1d46d..ed8be396428b9 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c +@@ -1539,8 +1539,8 @@ static int mvpp2_prs_vlan_init(struct platform_device *pdev, struct mvpp2 *priv) + if (!priv->prs_double_vlans) + return -ENOMEM; + +- /* Double VLAN: 0x8100, 0x88A8 */ +- err = mvpp2_prs_double_vlan_add(priv, ETH_P_8021Q, ETH_P_8021AD, ++ /* Double VLAN: 0x88A8, 0x8100 */ ++ err = mvpp2_prs_double_vlan_add(priv, ETH_P_8021AD, ETH_P_8021Q, + MVPP2_PRS_PORT_MASK); + if (err) + return err; +-- +2.39.2 + diff --git a/queue-6.1/net-net_failover-fix-txq-exceeding-warning.patch b/queue-6.1/net-net_failover-fix-txq-exceeding-warning.patch new file mode 100644 index 00000000000..bb30ee5c86d --- /dev/null +++ b/queue-6.1/net-net_failover-fix-txq-exceeding-warning.patch @@ -0,0 +1,90 @@ +From 63702331721e7fa402c236d3e6054847395a41d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 17:19:54 +0800 +Subject: net/net_failover: fix txq exceeding warning + +From: Faicker Mo + +[ Upstream commit e3cbdcb0fbb61045ef3ce0e072927cc41737f787 ] + +The failover txq is inited as 16 queues. +when a packet is transmitted from the failover device firstly, +the failover device will select the queue which is returned from +the primary device if the primary device is UP and running. +If the primary device txq is bigger than the default 16, +it can lead to the following warning: +eth0 selects TX queue 18, but real number of TX queues is 16 + +The warning backtrace is: +[ 32.146376] CPU: 18 PID: 9134 Comm: chronyd Tainted: G E 6.2.8-1.el7.centos.x86_64 #1 +[ 32.147175] Hardware name: Red Hat KVM, BIOS 1.10.2-3.el7_4.1 04/01/2014 +[ 32.147730] Call Trace: +[ 32.147971] +[ 32.148183] dump_stack_lvl+0x48/0x70 +[ 32.148514] dump_stack+0x10/0x20 +[ 32.148820] netdev_core_pick_tx+0xb1/0xe0 +[ 32.149180] __dev_queue_xmit+0x529/0xcf0 +[ 32.149533] ? __check_object_size.part.0+0x21c/0x2c0 +[ 32.149967] ip_finish_output2+0x278/0x560 +[ 32.150327] __ip_finish_output+0x1fe/0x2f0 +[ 32.150690] ip_finish_output+0x2a/0xd0 +[ 32.151032] ip_output+0x7a/0x110 +[ 32.151337] ? __pfx_ip_finish_output+0x10/0x10 +[ 32.151733] ip_local_out+0x5e/0x70 +[ 32.152054] ip_send_skb+0x19/0x50 +[ 32.152366] udp_send_skb.isra.0+0x163/0x3a0 +[ 32.152736] udp_sendmsg+0xba8/0xec0 +[ 32.153060] ? __folio_memcg_unlock+0x25/0x60 +[ 32.153445] ? __pfx_ip_generic_getfrag+0x10/0x10 +[ 32.153854] ? sock_has_perm+0x85/0xa0 +[ 32.154190] inet_sendmsg+0x6d/0x80 +[ 32.154508] ? inet_sendmsg+0x6d/0x80 +[ 32.154838] sock_sendmsg+0x62/0x70 +[ 32.155152] ____sys_sendmsg+0x134/0x290 +[ 32.155499] ___sys_sendmsg+0x81/0xc0 +[ 32.155828] ? _get_random_bytes.part.0+0x79/0x1a0 +[ 32.156240] ? ip4_datagram_release_cb+0x5f/0x1e0 +[ 32.156649] ? get_random_u16+0x69/0xf0 +[ 32.156989] ? __fget_light+0xcf/0x110 +[ 32.157326] __sys_sendmmsg+0xc4/0x210 +[ 32.157657] ? __sys_connect+0xb7/0xe0 +[ 32.157995] ? __audit_syscall_entry+0xce/0x140 +[ 32.158388] ? syscall_trace_enter.isra.0+0x12c/0x1a0 +[ 32.158820] __x64_sys_sendmmsg+0x24/0x30 +[ 32.159171] do_syscall_64+0x38/0x90 +[ 32.159493] entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Fix that by reducing txq number as the non-existent primary-dev does. + +Fixes: cfc80d9a1163 ("net: Introduce net_failover driver") +Signed-off-by: Faicker Mo +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/net_failover.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/net_failover.c b/drivers/net/net_failover.c +index 7a28e082436e4..d0c916a53d7ce 100644 +--- a/drivers/net/net_failover.c ++++ b/drivers/net/net_failover.c +@@ -130,14 +130,10 @@ static u16 net_failover_select_queue(struct net_device *dev, + txq = ops->ndo_select_queue(primary_dev, skb, sb_dev); + else + txq = netdev_pick_tx(primary_dev, skb, NULL); +- +- qdisc_skb_cb(skb)->slave_dev_queue_mapping = skb->queue_mapping; +- +- return txq; ++ } else { ++ txq = skb_rx_queue_recorded(skb) ? skb_get_rx_queue(skb) : 0; + } + +- txq = skb_rx_queue_recorded(skb) ? skb_get_rx_queue(skb) : 0; +- + /* Save the original txq to restore before passing to the driver */ + qdisc_skb_cb(skb)->slave_dev_queue_mapping = skb->queue_mapping; + +-- +2.39.2 + diff --git a/queue-6.1/net-stmmac-don-t-reject-vlans-when-iff_promisc-is-se.patch b/queue-6.1/net-stmmac-don-t-reject-vlans-when-iff_promisc-is-se.patch new file mode 100644 index 00000000000..52aeb117f15 --- /dev/null +++ b/queue-6.1/net-stmmac-don-t-reject-vlans-when-iff_promisc-is-se.patch @@ -0,0 +1,289 @@ +From 42736ddc09a1713aa7320defb5afe1341afe0123 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Mar 2023 13:28:15 +0200 +Subject: net: stmmac: don't reject VLANs when IFF_PROMISC is set + +From: Vladimir Oltean + +[ Upstream commit a7602e7332b97cfbec7bacb0f1ade99a575fe104 ] + +The blamed commit has introduced the following tests to +dwmac4_add_hw_vlan_rx_fltr(), called from stmmac_vlan_rx_add_vid(): + + if (hw->promisc) { + netdev_err(dev, + "Adding VLAN in promisc mode not supported\n"); + return -EPERM; + } + +"VLAN promiscuous" mode is keyed in this driver to IFF_PROMISC, and so, +vlan_vid_add() and vlan_vid_del() calls cannot take place in IFF_PROMISC +mode. I have the following 2 arguments that this restriction is.... hm, +how shall I put it nicely... unproductive :) + +First, take the case of a Linux bridge. If the kernel is compiled with +CONFIG_BRIDGE_VLAN_FILTERING=y, then this bridge shall have a VLAN +database. The bridge shall try to call vlan_add_vid() on its bridge +ports for each VLAN in the VLAN table. It will do this irrespectively of +whether that port is *currently* VLAN-aware or not. So it will do this +even when the bridge was created with vlan_filtering 0. +But the Linux bridge, in VLAN-unaware mode, configures its ports in +promiscuous (IFF_PROMISC) mode, so that they accept packets with any +MAC DA (a switch must do this in order to forward those packets which +are not directly targeted to its MAC address). + +As a result, the stmmac driver does not work as a bridge port, when the +kernel is compiled with CONFIG_BRIDGE_VLAN_FILTERING=y. + +$ ip link add br0 type bridge && ip link set br0 up +$ ip link set eth0 master br0 && ip link set eth0 up +[ 2333.943296] br0: port 1(eth0) entered blocking state +[ 2333.943381] br0: port 1(eth0) entered disabled state +[ 2333.943782] device eth0 entered promiscuous mode +[ 2333.944080] 4033c000.ethernet eth0: Adding VLAN in promisc mode not supported +[ 2333.976509] 4033c000.ethernet eth0: failed to initialize vlan filtering on this port +RTNETLINK answers: Operation not permitted + +Secondly, take the case of stmmac as DSA master. Some switch tagging +protocols are based on 802.1Q VLANs (tag_sja1105.c), and as such, +tag_8021q.c uses vlan_vid_add() to work with VLAN-filtering DSA masters. +But also, when a DSA port becomes promiscuous (for example when it joins +a bridge), the DSA framework also makes the DSA master promiscuous. + +Moreover, for every VLAN that a DSA switch sends to the CPU, DSA also +programs a VLAN filter on the DSA master, because if the the DSA switch +uses a tail tag, then the hardware frame parser of the DSA master will +see VLAN as VLAN, and might filter them out, for being unknown. + +Due to the above 2 reasons, my belief is that the stmmac driver does not +get to choose to not accept vlan_vid_add() calls while IFF_PROMISC is +enabled, because the 2 are completely independent and there are code +paths in the network stack which directly lead to this situation +occurring, without the user's direct input. + +In fact, my belief is that "VLAN promiscuous" mode should have never +been keyed on IFF_PROMISC in the first place, but rather, on the +NETIF_F_HW_VLAN_CTAG_FILTER feature flag which can be toggled by the +user through ethtool -k, when present in netdev->hw_features. + +In the stmmac driver, NETIF_F_HW_VLAN_CTAG_FILTER is only present in +"features", making this feature "on [fixed]". + +I have this belief because I am unaware of any definition of promiscuity +which implies having an effect on anything other than MAC DA (therefore +not VLAN). However, I seem to be rather alone in having this opinion, +looking back at the disagreements from this discussion: +https://lore.kernel.org/netdev/20201110153958.ci5ekor3o2ekg3ky@ipetronik.com/ + +In any case, to remove the vlan_vid_add() dependency on !IFF_PROMISC, +one would need to remove the check and see what fails. I guess the test +was there because of the way in which dwmac4_vlan_promisc_enable() is +implemented. + +For context, the dwmac4 supports Perfect Filtering for a limited number +of VLANs - dwmac4_get_num_vlan(), priv->hw->num_vlan, with a fallback on +Hash Filtering - priv->dma_cap.vlhash - see stmmac_vlan_update(), also +visible in cat /sys/kernel/debug/stmmaceth/eth0/dma_cap | grep 'VLAN +Hash Filtering'. + +The perfect filtering is based on MAC_VLAN_Tag_Filter/MAC_VLAN_Tag_Data +registers, accessed in the driver through dwmac4_write_vlan_filter(). + +The hash filtering is based on the MAC_VLAN_Hash_Table register, named +GMAC_VLAN_HASH_TABLE in the driver and accessed by dwmac4_update_vlan_hash(). +The control bit for enabling hash filtering is GMAC_VLAN_VTHM +(MAC_VLAN_Tag_Ctrl bit VTHM: VLAN Tag Hash Table Match Enable). + +Now, the description of dwmac4_vlan_promisc_enable() is that it iterates +through the driver's cache of perfect filter entries (hw->vlan_filter[i], +added by dwmac4_add_hw_vlan_rx_fltr()), and evicts them from hardware by +unsetting their GMAC_VLAN_TAG_DATA_VEN (MAC_VLAN_Tag_Data bit VEN - VLAN +Tag Enable) bit. Then it unsets the GMAC_VLAN_VTHM bit, which disables +hash matching. + +This leaves the MAC, according to table "VLAN Match Status" from the +documentation, to always enter these data paths: + +VID |VLAN Perfect Filter |VTHM Bit |VLAN Hash Filter |Final VLAN Match + |Match Result | |Match Result |Status +-------|--------------------|---------|-----------------|---------------- +VID!=0 |Fail |0 |don't care |Pass + +So, dwmac4_vlan_promisc_enable() does its job, but by unsetting +GMAC_VLAN_VTHM, it conflicts with the other code path which controls +this bit: dwmac4_update_vlan_hash(), called through stmmac_update_vlan_hash() +from stmmac_vlan_rx_add_vid() and from stmmac_vlan_rx_kill_vid(). +This is, I guess, why dwmac4_add_hw_vlan_rx_fltr() is not allowed to run +after dwmac4_vlan_promisc_enable() has unset GMAC_VLAN_VTHM: because if +it did, then dwmac4_update_vlan_hash() would set GMAC_VLAN_VTHM again, +breaking the "VLAN promiscuity". + +It turns out that dwmac4_vlan_promisc_enable() is way too complicated +for what needs to be done. The MAC_Packet_Filter register also has the +VTFE bit (VLAN Tag Filter Enable), which simply controls whether VLAN +tagged packets which don't match the filtering tables (either perfect or +hash) are dropped or not. At the moment, this driver unconditionally +sets GMAC_PACKET_FILTER_VTFE if NETIF_F_HW_VLAN_CTAG_FILTER was detected +through the priv->dma_cap.vlhash capability bits of the device, in +stmmac_dvr_probe(). + +I would suggest deleting the unnecessarily complex logic from +dwmac4_vlan_promisc_enable(), and simply unsetting GMAC_PACKET_FILTER_VTFE +when becoming IFF_PROMISC, which has the same effect of allowing packets +with any VLAN tags, but has the additional benefit of being able to run +concurrently with stmmac_vlan_rx_add_vid() and stmmac_vlan_rx_kill_vid(). + +As much as I believe that the VTFE bit should have been exclusively +controlled by NETIF_F_HW_VLAN_CTAG_FILTER through ethtool, and not by +IFF_PROMISC, changing that is not a punctual fix to the problem, and it +would probably break the VFFQ feature added by the later commit +e0f9956a3862 ("net: stmmac: Add option for VLAN filter fail queue +enable"). From the commit description, VFFQ needs IFF_PROMISC=on and +VTFE=off in order to work (and this change respects that). But if VTFE +was changed to be controlled through ethtool -k, then a user-visible +change would have been introduced in Intel's scripts (a need to run +"ethtool -k eth0 rx-vlan-filter off" which did not exist before). + +The patch was tested with this set of commands: + + ip link set eth0 up + ip link add link eth0 name eth0.100 type vlan id 100 + ip addr add 192.168.100.2/24 dev eth0.100 && ip link set eth0.100 up + ip link set eth0 promisc on + ip link add link eth0 name eth0.101 type vlan id 101 + ip addr add 192.168.101.2/24 dev eth0.101 && ip link set eth0.101 up + ip link set eth0 promisc off + ping -c 5 192.168.100.1 + ping -c 5 192.168.101.1 + ip link set eth0 promisc on + ping -c 5 192.168.100.1 + ping -c 5 192.168.101.1 + ip link del eth0.100 + ip link del eth0.101 + # Wait for VLAN-tagged pings from the other end... + # Check with "tcpdump -i eth0 -e -n -p" and we should see them + ip link set eth0 promisc off + # Wait for VLAN-tagged pings from the other end... + # Check with "tcpdump -i eth0 -e -n -p" and we shouldn't see them + # anymore, but remove the "-p" argument from tcpdump and they're there. + +Fixes: c89f44ff10fd ("net: stmmac: Add support for VLAN promiscuous mode") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/common.h | 1 - + .../net/ethernet/stmicro/stmmac/dwmac4_core.c | 61 +------------------ + 2 files changed, 3 insertions(+), 59 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h +index ec9c130276d89..54bb072aeb2d3 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/common.h ++++ b/drivers/net/ethernet/stmicro/stmmac/common.h +@@ -532,7 +532,6 @@ struct mac_device_info { + unsigned int xlgmac; + unsigned int num_vlan; + u32 vlan_filter[32]; +- unsigned int promisc; + bool vlan_fail_q_en; + u8 vlan_fail_q; + }; +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +index e5cfde1cbd5ce..188a00065f66c 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +@@ -481,12 +481,6 @@ static int dwmac4_add_hw_vlan_rx_fltr(struct net_device *dev, + if (vid > 4095) + return -EINVAL; + +- if (hw->promisc) { +- netdev_err(dev, +- "Adding VLAN in promisc mode not supported\n"); +- return -EPERM; +- } +- + /* Single Rx VLAN Filter */ + if (hw->num_vlan == 1) { + /* For single VLAN filter, VID 0 means VLAN promiscuous */ +@@ -536,12 +530,6 @@ static int dwmac4_del_hw_vlan_rx_fltr(struct net_device *dev, + { + int i, ret = 0; + +- if (hw->promisc) { +- netdev_err(dev, +- "Deleting VLAN in promisc mode not supported\n"); +- return -EPERM; +- } +- + /* Single Rx VLAN Filter */ + if (hw->num_vlan == 1) { + if ((hw->vlan_filter[0] & GMAC_VLAN_TAG_VID) == vid) { +@@ -566,39 +554,6 @@ static int dwmac4_del_hw_vlan_rx_fltr(struct net_device *dev, + return ret; + } + +-static void dwmac4_vlan_promisc_enable(struct net_device *dev, +- struct mac_device_info *hw) +-{ +- void __iomem *ioaddr = hw->pcsr; +- u32 value; +- u32 hash; +- u32 val; +- int i; +- +- /* Single Rx VLAN Filter */ +- if (hw->num_vlan == 1) { +- dwmac4_write_single_vlan(dev, 0); +- return; +- } +- +- /* Extended Rx VLAN Filter Enable */ +- for (i = 0; i < hw->num_vlan; i++) { +- if (hw->vlan_filter[i] & GMAC_VLAN_TAG_DATA_VEN) { +- val = hw->vlan_filter[i] & ~GMAC_VLAN_TAG_DATA_VEN; +- dwmac4_write_vlan_filter(dev, hw, i, val); +- } +- } +- +- hash = readl(ioaddr + GMAC_VLAN_HASH_TABLE); +- if (hash & GMAC_VLAN_VLHT) { +- value = readl(ioaddr + GMAC_VLAN_TAG); +- if (value & GMAC_VLAN_VTHM) { +- value &= ~GMAC_VLAN_VTHM; +- writel(value, ioaddr + GMAC_VLAN_TAG); +- } +- } +-} +- + static void dwmac4_restore_hw_vlan_rx_fltr(struct net_device *dev, + struct mac_device_info *hw) + { +@@ -718,22 +673,12 @@ static void dwmac4_set_filter(struct mac_device_info *hw, + } + + /* VLAN filtering */ +- if (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER) ++ if (dev->flags & IFF_PROMISC && !hw->vlan_fail_q_en) ++ value &= ~GMAC_PACKET_FILTER_VTFE; ++ else if (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER) + value |= GMAC_PACKET_FILTER_VTFE; + + writel(value, ioaddr + GMAC_PACKET_FILTER); +- +- if (dev->flags & IFF_PROMISC && !hw->vlan_fail_q_en) { +- if (!hw->promisc) { +- hw->promisc = 1; +- dwmac4_vlan_promisc_enable(dev, hw); +- } +- } else { +- if (hw->promisc) { +- hw->promisc = 0; +- dwmac4_restore_hw_vlan_rx_fltr(dev, hw); +- } +- } + } + + static void dwmac4_flow_ctrl(struct mac_device_info *hw, unsigned int duplex, +-- +2.39.2 + diff --git a/queue-6.1/pci-dwc-fix-port_link_control-update-when-cdm-check-.patch b/queue-6.1/pci-dwc-fix-port_link_control-update-when-cdm-check-.patch new file mode 100644 index 00000000000..43070f62f60 --- /dev/null +++ b/queue-6.1/pci-dwc-fix-port_link_control-update-when-cdm-check-.patch @@ -0,0 +1,60 @@ +From 4866df8075f3ce36181209d8170d9e605315a6f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 21:34:58 +0900 +Subject: PCI: dwc: Fix PORT_LINK_CONTROL update when CDM check enabled + +From: Yoshihiro Shimoda + +[ Upstream commit cdce67099117ece371582f706c6eff7d3a65326d ] + +If CDM_CHECK is enabled (by the DT "snps,enable-cdm-check" property), 'val' +is overwritten by PCIE_PL_CHK_REG_CONTROL_STATUS initialization. Commit +ec7b952f453c ("PCI: dwc: Always enable CDM check if "snps,enable-cdm-check" +exists") did not account for further usage of 'val', so we wrote improper +values to PCIE_PORT_LINK_CONTROL when the CDM check is enabled. + +Move the PCIE_PORT_LINK_CONTROL update to be completely after the +PCIE_PL_CHK_REG_CONTROL_STATUS register initialization. + +[bhelgaas: commit log adapted from Serge's version] +Fixes: ec7b952f453c ("PCI: dwc: Always enable CDM check if "snps,enable-cdm-check" exists") +Link: https://lore.kernel.org/r/20230310123510.675685-2-yoshihiro.shimoda.uh@renesas.com +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Bjorn Helgaas +Reviewed-by: Serge Semin +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-designware.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-designware.c b/drivers/pci/controller/dwc/pcie-designware.c +index 9e4d96e5a3f5a..575834cae3b9e 100644 +--- a/drivers/pci/controller/dwc/pcie-designware.c ++++ b/drivers/pci/controller/dwc/pcie-designware.c +@@ -645,11 +645,6 @@ void dw_pcie_setup(struct dw_pcie *pci) + dw_pcie_writel_dbi(pci, PCIE_LINK_WIDTH_SPEED_CONTROL, val); + } + +- val = dw_pcie_readl_dbi(pci, PCIE_PORT_LINK_CONTROL); +- val &= ~PORT_LINK_FAST_LINK_MODE; +- val |= PORT_LINK_DLL_LINK_EN; +- dw_pcie_writel_dbi(pci, PCIE_PORT_LINK_CONTROL, val); +- + if (of_property_read_bool(np, "snps,enable-cdm-check")) { + val = dw_pcie_readl_dbi(pci, PCIE_PL_CHK_REG_CONTROL_STATUS); + val |= PCIE_PL_CHK_REG_CHK_REG_CONTINUOUS | +@@ -657,6 +652,11 @@ void dw_pcie_setup(struct dw_pcie *pci) + dw_pcie_writel_dbi(pci, PCIE_PL_CHK_REG_CONTROL_STATUS, val); + } + ++ val = dw_pcie_readl_dbi(pci, PCIE_PORT_LINK_CONTROL); ++ val &= ~PORT_LINK_FAST_LINK_MODE; ++ val |= PORT_LINK_DLL_LINK_EN; ++ dw_pcie_writel_dbi(pci, PCIE_PORT_LINK_CONTROL, val); ++ + of_property_read_u32(np, "num-lanes", &pci->num_lanes); + if (!pci->num_lanes) { + dev_dbg(pci->dev, "Using h/w default number of lanes\n"); +-- +2.39.2 + diff --git a/queue-6.1/platform-surface-aggregator-add-missing-fwnode_handl.patch b/queue-6.1/platform-surface-aggregator-add-missing-fwnode_handl.patch new file mode 100644 index 00000000000..441614a26a0 --- /dev/null +++ b/queue-6.1/platform-surface-aggregator-add-missing-fwnode_handl.patch @@ -0,0 +1,44 @@ +From d20aa194931d9e6bda71a7f9c23d7d506b5d1608 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 11:30:57 +0800 +Subject: platform/surface: aggregator: Add missing fwnode_handle_put() + +From: Liang He + +[ Upstream commit acd0acb802b90f88d19ad4337183e44fd0f77c50 ] + +In fwnode_for_each_child_node(), we should add +fwnode_handle_put() when break out of the iteration +fwnode_for_each_child_node() as it will automatically +increase and decrease the refcounter. + +Fixes: fc622b3d36e6 ("platform/surface: Set up Surface Aggregator device registry") +Signed-off-by: Liang He +Reviewed-by: Maximilian Luz +Link: https://lore.kernel.org/r/20230322033057.1855741-1-windhl@126.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/surface/aggregator/bus.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/surface/aggregator/bus.c b/drivers/platform/surface/aggregator/bus.c +index de539938896e2..b501a79f2a08a 100644 +--- a/drivers/platform/surface/aggregator/bus.c ++++ b/drivers/platform/surface/aggregator/bus.c +@@ -485,8 +485,10 @@ int __ssam_register_clients(struct device *parent, struct ssam_controller *ctrl, + * device, so ignore it and continue with the next one. + */ + status = ssam_add_client_device(parent, ctrl, child); +- if (status && status != -ENODEV) ++ if (status && status != -ENODEV) { ++ fwnode_handle_put(child); + goto err; ++ } + } + + return 0; +-- +2.39.2 + diff --git a/queue-6.1/platform-x86-intel-pmc-alder-lake-pch-slp_s0_residen.patch b/queue-6.1/platform-x86-intel-pmc-alder-lake-pch-slp_s0_residen.patch new file mode 100644 index 00000000000..a8ce514e97d --- /dev/null +++ b/queue-6.1/platform-x86-intel-pmc-alder-lake-pch-slp_s0_residen.patch @@ -0,0 +1,59 @@ +From 0084cada6776a352f69d00b6a86b493736f2deaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 14:20:29 -0700 +Subject: platform/x86/intel/pmc: Alder Lake PCH slp_s0_residency fix + +From: Rajvi Jingar + +[ Upstream commit fb5755100a0a5aa5957bdb204fd1e249684557fc ] + +For platforms with Alder Lake PCH (Alder Lake S and Raptor Lake S) the +slp_s0_residency attribute has been reporting the wrong value. Unlike other +platforms, ADL PCH does not have a counter for the time that the SLP_S0 +signal was asserted. Instead, firmware uses the aggregate of the Low Power +Mode (LPM) substate counters as the S0ix value. Since the LPM counters run +at a different frequency, this lead to misreporting of the S0ix time. + +Add a check for Alder Lake PCH and adjust the frequency accordingly when +display slp_s0_residency. + +Fixes: bbab31101f44 ("platform/x86/intel: pmc/core: Add Alderlake support to pmc core driver") +Signed-off-by: Rajvi Jingar +Signed-off-by: David E. Box +Reviewed-by: Rajneesh Bhardwaj +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230320212029.3154407-1-david.e.box@linux.intel.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/pmc/core.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/intel/pmc/core.c b/drivers/platform/x86/intel/pmc/core.c +index 17ec5825d13d7..be0fb9401202a 100644 +--- a/drivers/platform/x86/intel/pmc/core.c ++++ b/drivers/platform/x86/intel/pmc/core.c +@@ -958,7 +958,18 @@ static inline void pmc_core_reg_write(struct pmc_dev *pmcdev, int reg_offset, + + static inline u64 pmc_core_adjust_slp_s0_step(struct pmc_dev *pmcdev, u32 value) + { +- return (u64)value * pmcdev->map->slp_s0_res_counter_step; ++ /* ++ * ADL PCH does not have the SLP_S0 counter and LPM Residency counters are ++ * used as a workaround which uses 30.5 usec tick. All other client ++ * programs have the legacy SLP_S0 residency counter that is using the 122 ++ * usec tick. ++ */ ++ const int lpm_adj_x2 = pmcdev->map->lpm_res_counter_step_x2; ++ ++ if (pmcdev->map == &adl_reg_map) ++ return (u64)value * GET_X2_COUNTER((u64)lpm_adj_x2); ++ else ++ return (u64)value * pmcdev->map->slp_s0_res_counter_step; + } + + static int set_etr3(struct pmc_dev *pmcdev) +-- +2.39.2 + diff --git a/queue-6.1/platform-x86-think-lmi-add-missing-type-attribute.patch b/queue-6.1/platform-x86-think-lmi-add-missing-type-attribute.patch new file mode 100644 index 00000000000..2c1489c3117 --- /dev/null +++ b/queue-6.1/platform-x86-think-lmi-add-missing-type-attribute.patch @@ -0,0 +1,72 @@ +From 721e429642881d4970498881fb010333e8d56c6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Mar 2023 20:32:18 -0400 +Subject: platform/x86: think-lmi: add missing type attribute +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mark Pearson + +[ Upstream commit 583329dcf22e568a328a944f20427ccfc95dce01 ] + +This driver was missing the mandatory type attribute...oops. + +Add it in along with logic to determine whether the attribute is an +enumeration type or a string by parsing the possible_values attribute. + +Upstream bug https://bugzilla.kernel.org/show_bug.cgi?id=216460 + +Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") +Signed-off-by: Mark Pearson +Link: https://lore.kernel.org/r/20230320003221.561750-1-mpearson-lenovo@squebb.ca +Reviewed-by: Thomas Weißschuh +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/think-lmi.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c +index a01a92769c1a3..07c9dc21eff52 100644 +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -947,6 +947,20 @@ static ssize_t possible_values_show(struct kobject *kobj, struct kobj_attribute + return sysfs_emit(buf, "%s\n", setting->possible_values); + } + ++static ssize_t type_show(struct kobject *kobj, struct kobj_attribute *attr, ++ char *buf) ++{ ++ struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); ++ ++ if (setting->possible_values) { ++ /* Figure out what setting type is as BIOS does not return this */ ++ if (strchr(setting->possible_values, ',')) ++ return sysfs_emit(buf, "enumeration\n"); ++ } ++ /* Anything else is going to be a string */ ++ return sysfs_emit(buf, "string\n"); ++} ++ + static ssize_t current_value_store(struct kobject *kobj, + struct kobj_attribute *attr, + const char *buf, size_t count) +@@ -1036,10 +1050,13 @@ static struct kobj_attribute attr_possible_values = __ATTR_RO(possible_values); + + static struct kobj_attribute attr_current_val = __ATTR_RW_MODE(current_value, 0600); + ++static struct kobj_attribute attr_type = __ATTR_RO(type); ++ + static struct attribute *tlmi_attrs[] = { + &attr_displ_name.attr, + &attr_current_val.attr, + &attr_possible_values.attr, ++ &attr_type.attr, + NULL + }; + +-- +2.39.2 + diff --git a/queue-6.1/platform-x86-think-lmi-add-possible_values-for-think.patch b/queue-6.1/platform-x86-think-lmi-add-possible_values-for-think.patch new file mode 100644 index 00000000000..cb97caff433 --- /dev/null +++ b/queue-6.1/platform-x86-think-lmi-add-possible_values-for-think.patch @@ -0,0 +1,63 @@ +From d60190d06b0f2609aee8d96a4791a09fa57d3e78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Mar 2023 20:32:21 -0400 +Subject: platform/x86: think-lmi: Add possible_values for ThinkStation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mark Pearson + +[ Upstream commit 8a02d70679fc1c434401863333c8ea7dbf201494 ] + +ThinkStation platforms don't support the API to return possible_values +but instead embed it in the settings string. + +Try and extract this information and set the possible_values attribute +appropriately. + +Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") +Signed-off-by: Mark Pearson +Link: https://lore.kernel.org/r/20230320003221.561750-4-mpearson-lenovo@squebb.ca +Reviewed-by: Thomas Weißschuh +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/think-lmi.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c +index ccd085bacf298..74af3e593b2ca 100644 +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -1450,6 +1450,26 @@ static int tlmi_analyze(void) + if (ret || !setting->possible_values) + pr_info("Error retrieving possible values for %d : %s\n", + i, setting->display_name); ++ } else { ++ /* ++ * Older Thinkstations don't support the bios_selections API. ++ * Instead they store this as a [Optional:Option1,Option2] section of the ++ * name string. ++ * Try and pull that out if it's available. ++ */ ++ char *item, *optstart, *optend; ++ ++ if (!tlmi_setting(setting->index, &item, LENOVO_BIOS_SETTING_GUID)) { ++ optstart = strstr(item, "[Optional:"); ++ if (optstart) { ++ optstart += strlen("[Optional:"); ++ optend = strstr(optstart, "]"); ++ if (optend) ++ setting->possible_values = ++ kstrndup(optstart, optend - optstart, ++ GFP_KERNEL); ++ } ++ } + } + /* + * firmware-attributes requires that possible_values are separated by ';' but +-- +2.39.2 + diff --git a/queue-6.1/platform-x86-think-lmi-only-display-possible_values-.patch b/queue-6.1/platform-x86-think-lmi-only-display-possible_values-.patch new file mode 100644 index 00000000000..62be445e3f2 --- /dev/null +++ b/queue-6.1/platform-x86-think-lmi-only-display-possible_values-.patch @@ -0,0 +1,70 @@ +From fd28f861574db9c6c4f9acb29511030ec1d4819f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Mar 2023 20:32:20 -0400 +Subject: platform/x86: think-lmi: only display possible_values if available +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mark Pearson + +[ Upstream commit cf337f27f3bfc4aeab4954c468239fd6233c7638 ] + +Some attributes don't have any values available. In those cases don't +make the possible_values entry visible. + +Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") +Signed-off-by: Mark Pearson +Link: https://lore.kernel.org/r/20230320003221.561750-3-mpearson-lenovo@squebb.ca +Reviewed-by: Thomas Weißschuh +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/think-lmi.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c +index 62241680c8a90..ccd085bacf298 100644 +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -941,9 +941,6 @@ static ssize_t possible_values_show(struct kobject *kobj, struct kobj_attribute + { + struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); + +- if (!tlmi_priv.can_get_bios_selections) +- return -EOPNOTSUPP; +- + return sysfs_emit(buf, "%s\n", setting->possible_values); + } + +@@ -1052,6 +1049,18 @@ static struct kobj_attribute attr_current_val = __ATTR_RW_MODE(current_value, 06 + + static struct kobj_attribute attr_type = __ATTR_RO(type); + ++static umode_t attr_is_visible(struct kobject *kobj, ++ struct attribute *attr, int n) ++{ ++ struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); ++ ++ /* We don't want to display possible_values attributes if not available */ ++ if ((attr == &attr_possible_values.attr) && (!setting->possible_values)) ++ return 0; ++ ++ return attr->mode; ++} ++ + static struct attribute *tlmi_attrs[] = { + &attr_displ_name.attr, + &attr_current_val.attr, +@@ -1061,6 +1070,7 @@ static struct attribute *tlmi_attrs[] = { + }; + + static const struct attribute_group tlmi_attr_group = { ++ .is_visible = attr_is_visible, + .attrs = tlmi_attrs, + }; + +-- +2.39.2 + diff --git a/queue-6.1/platform-x86-think-lmi-use-correct-possible_values-d.patch b/queue-6.1/platform-x86-think-lmi-use-correct-possible_values-d.patch new file mode 100644 index 00000000000..201ba7e8379 --- /dev/null +++ b/queue-6.1/platform-x86-think-lmi-use-correct-possible_values-d.patch @@ -0,0 +1,58 @@ +From f14b14339fd979920623a21c9987f788755d62dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Mar 2023 20:32:19 -0400 +Subject: platform/x86: think-lmi: use correct possible_values delimiters +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mark Pearson + +[ Upstream commit 45e21289bfc6e257885514790a8a8887da822d40 ] + +firmware-attributes class requires that possible values are delimited +using ';' but the Lenovo firmware uses ',' instead. +Parse string and replace where appropriate. + +Suggested-by: Thomas Weißschuh +Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") +Signed-off-by: Mark Pearson +Link: https://lore.kernel.org/r/20230320003221.561750-2-mpearson-lenovo@squebb.ca +Reviewed-by: Thomas Weißschuh +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/think-lmi.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c +index 07c9dc21eff52..62241680c8a90 100644 +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -954,7 +954,7 @@ static ssize_t type_show(struct kobject *kobj, struct kobj_attribute *attr, + + if (setting->possible_values) { + /* Figure out what setting type is as BIOS does not return this */ +- if (strchr(setting->possible_values, ',')) ++ if (strchr(setting->possible_values, ';')) + return sysfs_emit(buf, "enumeration\n"); + } + /* Anything else is going to be a string */ +@@ -1441,6 +1441,13 @@ static int tlmi_analyze(void) + pr_info("Error retrieving possible values for %d : %s\n", + i, setting->display_name); + } ++ /* ++ * firmware-attributes requires that possible_values are separated by ';' but ++ * Lenovo FW uses ','. Replace appropriately. ++ */ ++ if (setting->possible_values) ++ strreplace(setting->possible_values, ',', ';'); ++ + kobject_init(&setting->kobj, &tlmi_attr_setting_ktype); + tlmi_priv.setting[i] = setting; + kfree(item); +-- +2.39.2 + diff --git a/queue-6.1/ptp_qoriq-fix-memory-leak-in-probe.patch b/queue-6.1/ptp_qoriq-fix-memory-leak-in-probe.patch new file mode 100644 index 00000000000..d6a41973afa --- /dev/null +++ b/queue-6.1/ptp_qoriq-fix-memory-leak-in-probe.patch @@ -0,0 +1,46 @@ +From 5ff7753013de9674b790fa7be9114e529b448f51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 11:14:06 +0800 +Subject: ptp_qoriq: fix memory leak in probe() + +From: SongJingyi + +[ Upstream commit f33642224e38d7e0d59336e10e7b4e370b1c4506 ] + +Smatch complains that: +drivers/ptp/ptp_qoriq.c ptp_qoriq_probe() +warn: 'base' from ioremap() not released. + +Fix this by revising the parameter from 'ptp_qoriq->base' to 'base'. +This is only a bug if ptp_qoriq_init() returns on the +first -ENODEV error path. +For other error paths ptp_qoriq->base and base are the same. +And this change makes the code more readable. + +Fixes: 7f4399ba405b ("ptp_qoriq: fix NULL access if ptp dt node missing") +Signed-off-by: SongJingyi +Reviewed-by: Dan Carpenter +Reviewed-by: Dongliang Mu +Link: https://lore.kernel.org/r/20230324031406.1895159-1-u201912584@hust.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_qoriq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/ptp/ptp_qoriq.c b/drivers/ptp/ptp_qoriq.c +index 08f4cf0ad9e3c..8fa9772acf79b 100644 +--- a/drivers/ptp/ptp_qoriq.c ++++ b/drivers/ptp/ptp_qoriq.c +@@ -601,7 +601,7 @@ static int ptp_qoriq_probe(struct platform_device *dev) + return 0; + + no_clock: +- iounmap(ptp_qoriq->base); ++ iounmap(base); + no_ioremap: + release_resource(ptp_qoriq->rsrc); + no_resource: +-- +2.39.2 + diff --git a/queue-6.1/r8169-fix-rtl8168h-and-rtl8107e-rx-crc-error.patch b/queue-6.1/r8169-fix-rtl8168h-and-rtl8107e-rx-crc-error.patch new file mode 100644 index 00000000000..49a929754ea --- /dev/null +++ b/queue-6.1/r8169-fix-rtl8168h-and-rtl8107e-rx-crc-error.patch @@ -0,0 +1,42 @@ +From 7ef0b336fe466e30cb700213373fcc05bd5a862e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 22:33:09 +0800 +Subject: r8169: fix RTL8168H and RTL8107E rx crc error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: ChunHao Lin + +[ Upstream commit 33189f0a94b9639c058781fcf82e4ea3803b1682 ] + +When link speed is 10 Mbps and temperature is under -20°C, RTL8168H and +RTL8107E may have rx crc error. Disable phy 10 Mbps pll off to fix this +issue. + +Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E") +Signed-off-by: ChunHao Lin +Reviewed-by: Heiner Kallweit +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_phy_config.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/realtek/r8169_phy_config.c b/drivers/net/ethernet/realtek/r8169_phy_config.c +index 930496cd34ed0..b50f16786c246 100644 +--- a/drivers/net/ethernet/realtek/r8169_phy_config.c ++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c +@@ -826,6 +826,9 @@ static void rtl8168h_2_hw_phy_config(struct rtl8169_private *tp, + /* disable phy pfm mode */ + phy_modify_paged(phydev, 0x0a44, 0x11, BIT(7), 0); + ++ /* disable 10m pll off */ ++ phy_modify_paged(phydev, 0x0a43, 0x10, BIT(0), 0); ++ + rtl8168g_disable_aldps(phydev); + rtl8168g_config_eee_phy(phydev); + } +-- +2.39.2 + diff --git a/queue-6.1/regulator-handle-deferred-clk.patch b/queue-6.1/regulator-handle-deferred-clk.patch new file mode 100644 index 00000000000..e649767ac43 --- /dev/null +++ b/queue-6.1/regulator-handle-deferred-clk.patch @@ -0,0 +1,39 @@ +From de22acd95a5435ea1ff89604fc7adca7e1aefdea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Mar 2023 10:29:33 +0200 +Subject: regulator: Handle deferred clk + +From: Christophe JAILLET + +[ Upstream commit 02bcba0b9f9da706d5bd1e8cbeb83493863e17b5 ] + +devm_clk_get() can return -EPROBE_DEFER. So it is better to return the +error code from devm_clk_get(), instead of a hard coded -ENOENT. + +This gives more opportunities to successfully probe the driver. + +Fixes: 8959e5324485 ("regulator: fixed: add possibility to enable by clock") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/18459fae3d017a66313699c7c8456b28158b2dd0.1679819354.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/fixed.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c +index 2a9867abba20c..e6724a229d237 100644 +--- a/drivers/regulator/fixed.c ++++ b/drivers/regulator/fixed.c +@@ -215,7 +215,7 @@ static int reg_fixed_voltage_probe(struct platform_device *pdev) + drvdata->enable_clock = devm_clk_get(dev, NULL); + if (IS_ERR(drvdata->enable_clock)) { + dev_err(dev, "Can't get enable-clock from devicetree\n"); +- return -ENOENT; ++ return PTR_ERR(drvdata->enable_clock); + } + } else if (drvtype && drvtype->has_performance_state) { + drvdata->desc.ops = &fixed_voltage_domain_ops; +-- +2.39.2 + diff --git a/queue-6.1/riscv-kvm-fix-vm-hang-in-case-of-timer-delta-being-z.patch b/queue-6.1/riscv-kvm-fix-vm-hang-in-case-of-timer-delta-being-z.patch new file mode 100644 index 00000000000..f90f1dcd160 --- /dev/null +++ b/queue-6.1/riscv-kvm-fix-vm-hang-in-case-of-timer-delta-being-z.patch @@ -0,0 +1,59 @@ +From d3dfce788ffd1dcce0597d066a234ab5d947577e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Feb 2023 14:27:11 +0000 +Subject: riscv/kvm: Fix VM hang in case of timer delta being zero. + +From: Rajnesh Kanwal + +[ Upstream commit 6eff38048944cadc3cddcf117acfa5199ec32490 ] + +In case when VCPU is blocked due to WFI, we schedule the timer +from `kvm_riscv_vcpu_timer_blocking()` to keep timer interrupt +ticking. + +But in case when delta_ns comes to be zero, we never schedule +the timer and VCPU keeps sleeping indefinitely until any activity +is done with VM console. + +This is easily reproduce-able using kvmtool. +./lkvm-static run -c1 --console virtio -p "earlycon root=/dev/vda" \ + -k ./Image -d rootfs.ext4 + +Also, just add a print in kvm_riscv_vcpu_vstimer_expired() to +check the interrupt delivery and run `top` or similar auto-upating +cmd from guest. Within sometime one can notice that print from +timer expiry routine stops and the `top` cmd output will stop +updating. + +This change fixes this by making sure we schedule the timer even +with delta_ns being zero to bring the VCPU out of sleep immediately. + +Fixes: 8f5cb44b1bae ("RISC-V: KVM: Support sstc extension") +Signed-off-by: Rajnesh Kanwal +Reviewed-by: Atish Patra +Signed-off-by: Anup Patel +Signed-off-by: Sasha Levin +--- + arch/riscv/kvm/vcpu_timer.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/arch/riscv/kvm/vcpu_timer.c b/arch/riscv/kvm/vcpu_timer.c +index ad34519c8a13d..3ac2ff6a65dac 100644 +--- a/arch/riscv/kvm/vcpu_timer.c ++++ b/arch/riscv/kvm/vcpu_timer.c +@@ -147,10 +147,8 @@ static void kvm_riscv_vcpu_timer_blocking(struct kvm_vcpu *vcpu) + return; + + delta_ns = kvm_riscv_delta_cycles2ns(t->next_cycles, gt, t); +- if (delta_ns) { +- hrtimer_start(&t->hrt, ktime_set(0, delta_ns), HRTIMER_MODE_REL); +- t->next_set = true; +- } ++ hrtimer_start(&t->hrt, ktime_set(0, delta_ns), HRTIMER_MODE_REL); ++ t->next_set = true; + } + + static void kvm_riscv_vcpu_timer_unblocking(struct kvm_vcpu *vcpu) +-- +2.39.2 + diff --git a/queue-6.1/s390-vfio-ap-fix-memory-leak-in-vfio_ap-device-drive.patch b/queue-6.1/s390-vfio-ap-fix-memory-leak-in-vfio_ap-device-drive.patch new file mode 100644 index 00000000000..d05883fa023 --- /dev/null +++ b/queue-6.1/s390-vfio-ap-fix-memory-leak-in-vfio_ap-device-drive.patch @@ -0,0 +1,48 @@ +From ad003cfb4b79a51657f9024070a79216d2f339c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 11:04:47 -0400 +Subject: s390/vfio-ap: fix memory leak in vfio_ap device driver + +From: Tony Krowiak + +[ Upstream commit 8f8cf767589f2131ae5d40f3758429095c701c84 ] + +The device release callback function invoked to release the matrix device +uses the dev_get_drvdata(device *dev) function to retrieve the +pointer to the vfio_matrix_dev object in order to free its storage. The +problem is, this object is not stored as drvdata with the device; since the +kfree function will accept a NULL pointer, the memory for the +vfio_matrix_dev object is never freed. + +Since the device being released is contained within the vfio_matrix_dev +object, the container_of macro will be used to retrieve its pointer. + +Fixes: 1fde573413b5 ("s390: vfio-ap: base implementation of VFIO AP device driver") +Signed-off-by: Tony Krowiak +Reviewed-by: Harald Freudenberger +Link: https://lore.kernel.org/r/20230320150447.34557-1-akrowiak@linux.ibm.com +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + drivers/s390/crypto/vfio_ap_drv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/s390/crypto/vfio_ap_drv.c b/drivers/s390/crypto/vfio_ap_drv.c +index f43cfeabd2cc8..0afceb63ac43c 100644 +--- a/drivers/s390/crypto/vfio_ap_drv.c ++++ b/drivers/s390/crypto/vfio_ap_drv.c +@@ -54,8 +54,9 @@ static struct ap_driver vfio_ap_drv = { + + static void vfio_ap_matrix_dev_release(struct device *dev) + { +- struct ap_matrix_dev *matrix_dev = dev_get_drvdata(dev); ++ struct ap_matrix_dev *matrix_dev; + ++ matrix_dev = container_of(dev, struct ap_matrix_dev, device); + kfree(matrix_dev); + } + +-- +2.39.2 + diff --git a/queue-6.1/scsi-megaraid_sas-fix-crash-after-a-double-completio.patch b/queue-6.1/scsi-megaraid_sas-fix-crash-after-a-double-completio.patch new file mode 100644 index 00000000000..1e97ba2370d --- /dev/null +++ b/queue-6.1/scsi-megaraid_sas-fix-crash-after-a-double-completio.patch @@ -0,0 +1,47 @@ +From 0f42837de2d4ba63ac839c59f484b5ff459d5d47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 16:01:34 +0100 +Subject: scsi: megaraid_sas: Fix crash after a double completion + +From: Tomas Henzl + +[ Upstream commit 2309df27111a51734cb9240b4d3c25f2f3c6ab06 ] + +When a physical disk is attached directly "without JBOD MAP support" (see +megasas_get_tm_devhandle()) then there is no real error handling in the +driver. Return FAILED instead of SUCCESS. + +Fixes: 18365b138508 ("megaraid_sas: Task management support") +Signed-off-by: Tomas Henzl +Link: https://lore.kernel.org/r/20230324150134.14696-1-thenzl@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid/megaraid_sas_fusion.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c +index 6650f8c8e9b04..af22ffa8f6a25 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -4768,7 +4768,7 @@ int megasas_task_abort_fusion(struct scsi_cmnd *scmd) + devhandle = megasas_get_tm_devhandle(scmd->device); + + if (devhandle == (u16)ULONG_MAX) { +- ret = SUCCESS; ++ ret = FAILED; + sdev_printk(KERN_INFO, scmd->device, + "task abort issued for invalid devhandle\n"); + mutex_unlock(&instance->reset_mutex); +@@ -4838,7 +4838,7 @@ int megasas_reset_target_fusion(struct scsi_cmnd *scmd) + devhandle = megasas_get_tm_devhandle(scmd->device); + + if (devhandle == (u16)ULONG_MAX) { +- ret = SUCCESS; ++ ret = FAILED; + sdev_printk(KERN_INFO, scmd->device, + "target reset issued for invalid devhandle\n"); + mutex_unlock(&instance->reset_mutex); +-- +2.39.2 + diff --git a/queue-6.1/scsi-mpt3sas-don-t-print-sense-pool-info-twice.patch b/queue-6.1/scsi-mpt3sas-don-t-print-sense-pool-info-twice.patch new file mode 100644 index 00000000000..ee5bfaa7e25 --- /dev/null +++ b/queue-6.1/scsi-mpt3sas-don-t-print-sense-pool-info-twice.patch @@ -0,0 +1,50 @@ +From c9b3bfdf30ab72146a2e234d102fa98880912307 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 12:32:04 -0700 +Subject: scsi: mpt3sas: Don't print sense pool info twice + +From: Jerry Snitselaar + +[ Upstream commit d684a7a26f7d2c7122a4581ac966ed64e88fb29c ] + +_base_allocate_sense_dma_pool() already prints out the sense pool +information, so don't print it a second time after calling it in +_base_allocate_memory_pools(). In addition the version in +_base_allocate_memory_pools() was using the wrong size value, sz, which was +last assigned when doing some nvme calculations instead of sense_sz to +determine the pool size in kilobytes. + +Cc: Sathya Prakash +Cc: Sreekanth Reddy +Cc: Suganath Prabu Subramani +Cc: MPT-FusionLinux.pdl@broadcom.com +Cc: "Martin K. Petersen" +Cc: "James E.J. Bottomley" +Fixes: 970ac2bb70e7 ("scsi: mpt3sas: Force sense buffer allocations to be within same 4 GB region") +Signed-off-by: Jerry Snitselaar +Link: https://lore.kernel.org/r/20230324193204.567932-1-jsnitsel@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 2ee9ea57554d7..14ae0a9c5d3d8 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -6616,11 +6616,6 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + else if (rc == -EAGAIN) + goto try_32bit_dma; + total_sz += sense_sz; +- ioc_info(ioc, +- "sense pool(0x%p)- dma(0x%llx): depth(%d)," +- "element_size(%d), pool_size(%d kB)\n", +- ioc->sense, (unsigned long long)ioc->sense_dma, ioc->scsiio_depth, +- SCSI_SENSE_BUFFERSIZE, sz / 1024); + /* reply pool, 4 byte align */ + sz = ioc->reply_free_queue_depth * ioc->reply_sz; + rc = _base_allocate_reply_pool(ioc, sz); +-- +2.39.2 + diff --git a/queue-6.1/series b/queue-6.1/series index 34584a34a32..1e27e6f2677 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -63,3 +63,57 @@ tools-power-turbostat-fix-decoding-of-hwp_status.patch tracing-fix-wrong-return-in-kprobe_event_gen_test.c.patch btrfs-fix-uninitialized-variable-warning-in-btrfs_up.patch btrfs-use-temporary-variable-for-space_info-in-btrfs.patch +mtd-rawnand-meson-initialize-struct-with-zeroes.patch +mtd-nand-mxic-ecc-fix-mxic_ecc_data_xfer_wait_for_co.patch +swiotlb-fix-the-deadlock-in-swiotlb_do_find_slots.patch +ca8210-fix-unsigned-mac_len-comparison-with-zero-in-.patch +riscv-kvm-fix-vm-hang-in-case-of-timer-delta-being-z.patch +mips-bmips-bcm6358-disable-rac-flush-for-tp1.patch +alsa-usb-audio-fix-recursive-locking-at-xrun-during-.patch +pci-dwc-fix-port_link_control-update-when-cdm-check-.patch +swiotlb-fix-slot-alignment-checks.patch +platform-x86-think-lmi-add-missing-type-attribute.patch +platform-x86-think-lmi-use-correct-possible_values-d.patch +platform-x86-think-lmi-only-display-possible_values-.patch +platform-x86-think-lmi-add-possible_values-for-think.patch +platform-surface-aggregator-add-missing-fwnode_handl.patch +mtd-rawnand-meson-invalidate-cache-on-polling-ecc-bi.patch +sunrpc-fix-shutdown-of-nfs-tcp-client-socket.patch +sfc-ef10-don-t-overwrite-offload-features-at-nic-res.patch +scsi-megaraid_sas-fix-crash-after-a-double-completio.patch +scsi-mpt3sas-don-t-print-sense-pool-info-twice.patch +net-dsa-realtek-fix-out-of-bounds-access.patch +ptp_qoriq-fix-memory-leak-in-probe.patch +net-dsa-microchip-ksz8-fix-ksz8_fdb_dump.patch +net-dsa-microchip-ksz8-fix-ksz8_fdb_dump-to-extract-.patch +net-dsa-microchip-ksz8-fix-offset-for-the-timestamp-.patch +net-dsa-microchip-ksz8-ksz8_fdb_dump-avoid-extractin.patch +net-dsa-microchip-ksz8863_smi-fix-bulk-access.patch +net-dsa-microchip-ksz8-fix-mdb-configuration-with-no.patch +r8169-fix-rtl8168h-and-rtl8107e-rx-crc-error.patch +regulator-handle-deferred-clk.patch +net-net_failover-fix-txq-exceeding-warning.patch +net-stmmac-don-t-reject-vlans-when-iff_promisc-is-se.patch +drm-i915-tc-fix-the-icl-phy-ownership-check-in-tc-co.patch +platform-x86-intel-pmc-alder-lake-pch-slp_s0_residen.patch +can-bcm-bcm_tx_setup-fix-kmsan-uninit-value-in-vfs_w.patch +s390-vfio-ap-fix-memory-leak-in-vfio_ap-device-drive.patch +acpi-bus-rework-system-level-device-notification-han.patch +loop-loop_configure-send-uevents-for-partitions.patch +net-mvpp2-classifier-flow-fix-fragmentation-flags.patch +net-mvpp2-parser-fix-qinq.patch +net-mvpp2-parser-fix-pppoe.patch +smsc911x-avoid-phy-being-resumed-when-interface-is-n.patch +ice-fix-ice_cfg_rdma_fltr-to-only-update-relevant-fi.patch +ice-add-profile-conflict-check-for-avf-fdir.patch +ice-fix-invalid-check-for-empty-list-in-ice_sched_as.patch +alsa-ymfpci-create-card-with-device-managed-snd_devm.patch +alsa-ymfpci-fix-bug_on-in-probe-function.patch +net-ipa-compute-dma-pool-size-properly.patch +i40e-fix-registers-dump-after-run-ethtool-adapter-se.patch +bnxt_en-fix-reporting-of-test-result-in-ethtool-self.patch +bnxt_en-fix-typo-in-pci-id-to-device-description-str.patch +bnxt_en-add-missing-200g-link-speed-reporting.patch +net-dsa-mv88e6xxx-enable-igmp-snooping-on-user-ports.patch +net-ethernet-mtk_eth_soc-fix-flow-block-refcounting-.patch +net-ethernet-mtk_eth_soc-add-missing-ppe-cache-flush.patch diff --git a/queue-6.1/sfc-ef10-don-t-overwrite-offload-features-at-nic-res.patch b/queue-6.1/sfc-ef10-don-t-overwrite-offload-features-at-nic-res.patch new file mode 100644 index 00000000000..1e7dae83d8b --- /dev/null +++ b/queue-6.1/sfc-ef10-don-t-overwrite-offload-features-at-nic-res.patch @@ -0,0 +1,147 @@ +From 51c0b9abb89690238026903e183faf637c04acb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 09:34:17 +0100 +Subject: sfc: ef10: don't overwrite offload features at NIC reset +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Íñigo Huguet + +[ Upstream commit ca4a80e4bb7e87daf33b27d2ab9e4f5311018a89 ] + +At NIC reset, some offload features related to encapsulated traffic +might have changed (this mainly happens if the firmware-variant is +changed with the sfboot userspace tool). Because of this, features are +checked and set again at reset time. + +However, this was not done right, and some features were improperly +overwritten at NIC reset: +- Tunneled IPv6 segmentation was always disabled +- Features disabled with ethtool were reenabled +- Features that becomes unsupported after the reset were not disabled + +Also, checking if the device supports IPV6_CSUM to enable TSO6 is no +longer necessary because all currently supported devices support it. +Additionally, move the assignment of some other features to the +EF10_OFFLOAD_FEATURES macro, like it is done in ef100, leaving the +selection of features in efx_pci_probe_post_io a bit cleaner. + +Fixes: ffffd2454a7a ("sfc: correctly advertise tunneled IPv6 segmentation") +Fixes: 24b2c3751aa3 ("sfc: advertise encapsulated offloads on EF10") +Reported-by: Tianhao Zhao +Suggested-by: Jonathan Cooper +Tested-by: Jonathan Cooper +Signed-off-by: Íñigo Huguet +Acked-by: Edward Cree +Link: https://lore.kernel.org/r/20230323083417.7345-1-ihuguet@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/ef10.c | 38 ++++++++++++++++++++++----------- + drivers/net/ethernet/sfc/efx.c | 17 ++++++--------- + 2 files changed, 33 insertions(+), 22 deletions(-) + +diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c +index 7022fb2005a2f..d30459dbfe8f8 100644 +--- a/drivers/net/ethernet/sfc/ef10.c ++++ b/drivers/net/ethernet/sfc/ef10.c +@@ -1304,7 +1304,8 @@ static void efx_ef10_fini_nic(struct efx_nic *efx) + static int efx_ef10_init_nic(struct efx_nic *efx) + { + struct efx_ef10_nic_data *nic_data = efx->nic_data; +- netdev_features_t hw_enc_features = 0; ++ struct net_device *net_dev = efx->net_dev; ++ netdev_features_t tun_feats, tso_feats; + int rc; + + if (nic_data->must_check_datapath_caps) { +@@ -1349,20 +1350,30 @@ static int efx_ef10_init_nic(struct efx_nic *efx) + nic_data->must_restore_piobufs = false; + } + +- /* add encapsulated checksum offload features */ ++ /* encap features might change during reset if fw variant changed */ + if (efx_has_cap(efx, VXLAN_NVGRE) && !efx_ef10_is_vf(efx)) +- hw_enc_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM; +- /* add encapsulated TSO features */ +- if (efx_has_cap(efx, TX_TSO_V2_ENCAP)) { +- netdev_features_t encap_tso_features; ++ net_dev->hw_enc_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM; ++ else ++ net_dev->hw_enc_features &= ~(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM); + +- encap_tso_features = NETIF_F_GSO_UDP_TUNNEL | NETIF_F_GSO_GRE | +- NETIF_F_GSO_UDP_TUNNEL_CSUM | NETIF_F_GSO_GRE_CSUM; ++ tun_feats = NETIF_F_GSO_UDP_TUNNEL | NETIF_F_GSO_GRE | ++ NETIF_F_GSO_UDP_TUNNEL_CSUM | NETIF_F_GSO_GRE_CSUM; ++ tso_feats = NETIF_F_TSO | NETIF_F_TSO6; + +- hw_enc_features |= encap_tso_features | NETIF_F_TSO; +- efx->net_dev->features |= encap_tso_features; ++ if (efx_has_cap(efx, TX_TSO_V2_ENCAP)) { ++ /* If this is first nic_init, or if it is a reset and a new fw ++ * variant has added new features, enable them by default. ++ * If the features are not new, maintain their current value. ++ */ ++ if (!(net_dev->hw_features & tun_feats)) ++ net_dev->features |= tun_feats; ++ net_dev->hw_enc_features |= tun_feats | tso_feats; ++ net_dev->hw_features |= tun_feats; ++ } else { ++ net_dev->hw_enc_features &= ~(tun_feats | tso_feats); ++ net_dev->hw_features &= ~tun_feats; ++ net_dev->features &= ~tun_feats; + } +- efx->net_dev->hw_enc_features = hw_enc_features; + + /* don't fail init if RSS setup doesn't work */ + rc = efx->type->rx_push_rss_config(efx, false, +@@ -4021,7 +4032,10 @@ static unsigned int efx_ef10_recycle_ring_size(const struct efx_nic *efx) + NETIF_F_HW_VLAN_CTAG_FILTER | \ + NETIF_F_IPV6_CSUM | \ + NETIF_F_RXHASH | \ +- NETIF_F_NTUPLE) ++ NETIF_F_NTUPLE | \ ++ NETIF_F_SG | \ ++ NETIF_F_RXCSUM | \ ++ NETIF_F_RXALL) + + const struct efx_nic_type efx_hunt_a0_vf_nic_type = { + .is_vf = true, +diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c +index 3a86f1213a051..6a1bff54bc6c3 100644 +--- a/drivers/net/ethernet/sfc/efx.c ++++ b/drivers/net/ethernet/sfc/efx.c +@@ -1001,21 +1001,18 @@ static int efx_pci_probe_post_io(struct efx_nic *efx) + } + + /* Determine netdevice features */ +- net_dev->features |= (efx->type->offload_features | NETIF_F_SG | +- NETIF_F_TSO | NETIF_F_RXCSUM | NETIF_F_RXALL); +- if (efx->type->offload_features & (NETIF_F_IPV6_CSUM | NETIF_F_HW_CSUM)) { +- net_dev->features |= NETIF_F_TSO6; +- if (efx_has_cap(efx, TX_TSO_V2_ENCAP)) +- net_dev->hw_enc_features |= NETIF_F_TSO6; +- } +- /* Check whether device supports TSO */ +- if (!efx->type->tso_versions || !efx->type->tso_versions(efx)) +- net_dev->features &= ~NETIF_F_ALL_TSO; ++ net_dev->features |= efx->type->offload_features; ++ ++ /* Add TSO features */ ++ if (efx->type->tso_versions && efx->type->tso_versions(efx)) ++ net_dev->features |= NETIF_F_TSO | NETIF_F_TSO6; ++ + /* Mask for features that also apply to VLAN devices */ + net_dev->vlan_features |= (NETIF_F_HW_CSUM | NETIF_F_SG | + NETIF_F_HIGHDMA | NETIF_F_ALL_TSO | + NETIF_F_RXCSUM); + ++ /* Determine user configurable features */ + net_dev->hw_features |= net_dev->features & ~efx->fixed_features; + + /* Disable receiving frames with bad FCS, by default. */ +-- +2.39.2 + diff --git a/queue-6.1/smsc911x-avoid-phy-being-resumed-when-interface-is-n.patch b/queue-6.1/smsc911x-avoid-phy-being-resumed-when-interface-is-n.patch new file mode 100644 index 00000000000..5a2af669d8b --- /dev/null +++ b/queue-6.1/smsc911x-avoid-phy-being-resumed-when-interface-is-n.patch @@ -0,0 +1,60 @@ +From 60facf69dd3d0888c3fbe28a7d9f68512407f0d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Mar 2023 10:31:38 +0200 +Subject: smsc911x: avoid PHY being resumed when interface is not up + +From: Wolfram Sang + +[ Upstream commit f22c993f31fa9615df46e49cd768b713d39a852f ] + +SMSC911x doesn't need mdiobus suspend/resume, that's why it sets +'mac_managed_pm'. However, setting it needs to be moved from init to +probe, so mdiobus PM functions will really never be called (e.g. when +the interface is not up yet during suspend/resume). + +Fixes: 3ce9f2bef755 ("net: smsc911x: Stop and start PHY during suspend and resume") +Suggested-by: Heiner Kallweit +Signed-off-by: Wolfram Sang +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230327083138.6044-1-wsa+renesas@sang-engineering.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/smsc/smsc911x.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c +index a2e511912e6a9..a690d139e1770 100644 +--- a/drivers/net/ethernet/smsc/smsc911x.c ++++ b/drivers/net/ethernet/smsc/smsc911x.c +@@ -1037,8 +1037,6 @@ static int smsc911x_mii_probe(struct net_device *dev) + return ret; + } + +- /* Indicate that the MAC is responsible for managing PHY PM */ +- phydev->mac_managed_pm = true; + phy_attached_info(phydev); + + phy_set_max_speed(phydev, SPEED_100); +@@ -1066,6 +1064,7 @@ static int smsc911x_mii_init(struct platform_device *pdev, + struct net_device *dev) + { + struct smsc911x_data *pdata = netdev_priv(dev); ++ struct phy_device *phydev; + int err = -ENXIO; + + pdata->mii_bus = mdiobus_alloc(); +@@ -1108,6 +1107,10 @@ static int smsc911x_mii_init(struct platform_device *pdev, + goto err_out_free_bus_2; + } + ++ phydev = phy_find_first(pdata->mii_bus); ++ if (phydev) ++ phydev->mac_managed_pm = true; ++ + return 0; + + err_out_free_bus_2: +-- +2.39.2 + diff --git a/queue-6.1/sunrpc-fix-shutdown-of-nfs-tcp-client-socket.patch b/queue-6.1/sunrpc-fix-shutdown-of-nfs-tcp-client-socket.patch new file mode 100644 index 00000000000..ead9ce17f14 --- /dev/null +++ b/queue-6.1/sunrpc-fix-shutdown-of-nfs-tcp-client-socket.patch @@ -0,0 +1,117 @@ +From a1979014c94f8adee2c4531f3835439b56f0d6da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 20:37:40 +0000 +Subject: SUNRPC: fix shutdown of NFS TCP client socket + +From: Siddharth Kawar + +[ Upstream commit 943d045a6d796175e5d08f9973953b1d2c07d797 ] + +NFS server Duplicate Request Cache (DRC) algorithms rely on NFS clients +reconnecting using the same local TCP port. Unique NFS operations are +identified by the per-TCP connection set of XIDs. This prevents file +corruption when non-idempotent NFS operations are retried. + +Currently, NFS client TCP connections are using different local TCP ports +when reconnecting to NFS servers. + +After an NFS server initiates shutdown of the TCP connection, the NFS +client's TCP socket is set to NULL after the socket state has reached +TCP_LAST_ACK(9). When reconnecting, the new socket attempts to reuse +the same local port but fails with EADDRNOTAVAIL (99). This forces the +socket to use a different local TCP port to reconnect to the remote NFS +server. + +State Transition and Events: +TCP_CLOSE_WAIT(8) +TCP_LAST_ACK(9) +connect(fail EADDRNOTAVAIL(99)) +TCP_CLOSE(7) +bind on new port +connect success + +dmesg excerpts showing reconnect switching from TCP local port of 926 to +763 after commit 7c81e6a9d75b: +[13354.947854] NFS call mkdir testW +... +[13405.654781] RPC: xs_tcp_state_change client 00000000037d0f03... +[13405.654813] RPC: state 8 conn 1 dead 0 zapped 1 sk_shutdown 1 +[13405.654826] RPC: xs_data_ready... +[13405.654892] RPC: xs_tcp_state_change client 00000000037d0f03... +[13405.654895] RPC: state 9 conn 0 dead 0 zapped 1 sk_shutdown 3 +[13405.654899] RPC: xs_tcp_state_change client 00000000037d0f03... +[13405.654900] RPC: state 9 conn 0 dead 0 zapped 1 sk_shutdown 3 +[13405.654950] RPC: xs_connect scheduled xprt 00000000037d0f03 +[13405.654975] RPC: xs_bind 0.0.0.0:926: ok (0) +[13405.654980] RPC: worker connecting xprt 00000000037d0f03 via tcp + to 10.101.6.228 (port 2049) +[13405.654991] RPC: 00000000037d0f03 connect status 99 connected 0 + sock state 7 +[13405.655001] RPC: xs_tcp_state_change client 00000000037d0f03... +[13405.655002] RPC: state 7 conn 0 dead 0 zapped 1 sk_shutdown 3 +[13405.655024] RPC: xs_connect scheduled xprt 00000000037d0f03 +[13405.655038] RPC: xs_bind 0.0.0.0:763: ok (0) +[13405.655041] RPC: worker connecting xprt 00000000037d0f03 via tcp + to 10.101.6.228 (port 2049) +[13405.655065] RPC: 00000000037d0f03 connect status 115 connected 0 + sock state 2 + +State Transition and Events with patch applied: +TCP_CLOSE_WAIT(8) +TCP_LAST_ACK(9) +TCP_CLOSE(7) +connect(reuse of port succeeds) + +dmesg excerpts showing reconnect on same TCP local port of 936 with patch +applied: +[ 257.139935] NFS: mkdir(0:59/560857152), testQ +[ 257.139937] NFS call mkdir testQ +... +[ 307.822702] RPC: state 8 conn 1 dead 0 zapped 1 sk_shutdown 1 +[ 307.822714] RPC: xs_data_ready... +[ 307.822817] RPC: xs_tcp_state_change client 00000000ce702f14... +[ 307.822821] RPC: state 9 conn 0 dead 0 zapped 1 sk_shutdown 3 +[ 307.822825] RPC: xs_tcp_state_change client 00000000ce702f14... +[ 307.822826] RPC: state 9 conn 0 dead 0 zapped 1 sk_shutdown 3 +[ 307.823606] RPC: xs_tcp_state_change client 00000000ce702f14... +[ 307.823609] RPC: state 7 conn 0 dead 0 zapped 1 sk_shutdown 3 +[ 307.823629] RPC: xs_tcp_state_change client 00000000ce702f14... +[ 307.823632] RPC: state 7 conn 0 dead 0 zapped 1 sk_shutdown 3 +[ 307.823676] RPC: xs_connect scheduled xprt 00000000ce702f14 +[ 307.823704] RPC: xs_bind 0.0.0.0:936: ok (0) +[ 307.823709] RPC: worker connecting xprt 00000000ce702f14 via tcp + to 10.101.1.30 (port 2049) +[ 307.823748] RPC: 00000000ce702f14 connect status 115 connected 0 + sock state 2 +... +[ 314.916193] RPC: state 7 conn 0 dead 0 zapped 1 sk_shutdown 3 +[ 314.916251] RPC: xs_connect scheduled xprt 00000000ce702f14 +[ 314.916282] RPC: xs_bind 0.0.0.0:936: ok (0) +[ 314.916292] RPC: worker connecting xprt 00000000ce702f14 via tcp + to 10.101.1.30 (port 2049) +[ 314.916342] RPC: 00000000ce702f14 connect status 115 connected 0 + sock state 2 + +Fixes: 7c81e6a9d75b ("SUNRPC: Tweak TCP socket shutdown in the RPC client") +Signed-off-by: Siddharth Rajendra Kawar +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprtsock.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index b3ab6d9d752ea..05aa32696e7c2 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -2153,6 +2153,7 @@ static void xs_tcp_shutdown(struct rpc_xprt *xprt) + switch (skst) { + case TCP_FIN_WAIT1: + case TCP_FIN_WAIT2: ++ case TCP_LAST_ACK: + break; + case TCP_ESTABLISHED: + case TCP_CLOSE_WAIT: +-- +2.39.2 + diff --git a/queue-6.1/swiotlb-fix-slot-alignment-checks.patch b/queue-6.1/swiotlb-fix-slot-alignment-checks.patch new file mode 100644 index 00000000000..babfffcaa17 --- /dev/null +++ b/queue-6.1/swiotlb-fix-slot-alignment-checks.patch @@ -0,0 +1,80 @@ +From 6b19ccf221a13a2afa961c8ffffd7472127e69bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 09:31:27 +0100 +Subject: swiotlb: fix slot alignment checks + +From: Petr Tesarik + +[ Upstream commit 0eee5ae1025699ea93d44fdb6ef2365505082103 ] + +Explicit alignment and page alignment are used only to calculate +the stride, not when checking actual slot physical address. + +Originally, only page alignment was implemented, and that worked, +because the whole SWIOTLB is allocated on a page boundary, so +aligning the start index was sufficient to ensure a page-aligned +slot. + +When commit 1f221a0d0dbf ("swiotlb: respect min_align_mask") added +support for min_align_mask, the index could be incremented in the +search loop, potentially finding an unaligned slot if minimum device +alignment is between IO_TLB_SIZE and PAGE_SIZE. The bug could go +unnoticed, because the slot size is 2 KiB, and the most common page +size is 4 KiB, so there is no alignment value in between. + +IIUC the intention has been to find a slot that conforms to all +alignment constraints: device minimum alignment, an explicit +alignment (given as function parameter) and optionally page +alignment (if allocation size is >= PAGE_SIZE). The most +restrictive mask can be trivially computed with logical AND. The +rest can stay. + +Fixes: 1f221a0d0dbf ("swiotlb: respect min_align_mask") +Fixes: e81e99bacc9f ("swiotlb: Support aligned swiotlb buffers") +Signed-off-by: Petr Tesarik +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/swiotlb.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c +index 1ecd0d1f7231a..eeb5695c3f286 100644 +--- a/kernel/dma/swiotlb.c ++++ b/kernel/dma/swiotlb.c +@@ -626,22 +626,26 @@ static int swiotlb_do_find_slots(struct device *dev, int area_index, + BUG_ON(!nslots); + BUG_ON(area_index >= mem->nareas); + ++ /* ++ * For allocations of PAGE_SIZE or larger only look for page aligned ++ * allocations. ++ */ ++ if (alloc_size >= PAGE_SIZE) ++ iotlb_align_mask &= PAGE_MASK; ++ iotlb_align_mask &= alloc_align_mask; ++ + /* + * For mappings with an alignment requirement don't bother looping to +- * unaligned slots once we found an aligned one. For allocations of +- * PAGE_SIZE or larger only look for page aligned allocations. ++ * unaligned slots once we found an aligned one. + */ + stride = (iotlb_align_mask >> IO_TLB_SHIFT) + 1; +- if (alloc_size >= PAGE_SIZE) +- stride = max(stride, stride << (PAGE_SHIFT - IO_TLB_SHIFT)); +- stride = max(stride, (alloc_align_mask >> IO_TLB_SHIFT) + 1); + + spin_lock_irqsave(&area->lock, flags); + if (unlikely(nslots > mem->area_nslabs - area->used)) + goto not_found; + + slot_base = area_index * mem->area_nslabs; +- index = wrap_area_index(mem, ALIGN(area->index, stride)); ++ index = area->index; + + for (slots_checked = 0; slots_checked < mem->area_nslabs; ) { + slot_index = slot_base + index; +-- +2.39.2 + diff --git a/queue-6.1/swiotlb-fix-the-deadlock-in-swiotlb_do_find_slots.patch b/queue-6.1/swiotlb-fix-the-deadlock-in-swiotlb_do_find_slots.patch new file mode 100644 index 00000000000..4fee09e7730 --- /dev/null +++ b/queue-6.1/swiotlb-fix-the-deadlock-in-swiotlb_do_find_slots.patch @@ -0,0 +1,113 @@ +From 9466c1da4cf8169876da5c26c0e31427150d91cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Feb 2023 00:53:15 +0800 +Subject: swiotlb: fix the deadlock in swiotlb_do_find_slots + +From: GuoRui.Yu + +[ Upstream commit 7c3940bf81e5664cdb50c3fedfec8f0a756a34fb ] + +In general, if swiotlb is sufficient, the logic of index = +wrap_area_index(mem, index + 1) is fine, it will quickly take a slot and +release the area->lock; But if swiotlb is insufficient and the device +has min_align_mask requirements, such as NVME, we may not be able to +satisfy index == wrap and exit the loop properly. In this case, other +kernel threads will not be able to acquire the area->lock and release +the slot, resulting in a deadlock. + +The current implementation of wrap_area_index does not involve a modulo +operation, so adjusting the wrap to ensure the loop ends is not trivial. +Introduce a new variable to record the number of loops and exit the loop +after completing the traversal. + +Backtraces: +Other CPUs are waiting this core to exit the swiotlb_do_find_slots +loop. +[10199.924391] RIP: 0010:swiotlb_do_find_slots+0x1fe/0x3e0 +[10199.924403] Call Trace: +[10199.924404] +[10199.924405] swiotlb_tbl_map_single+0xec/0x1f0 +[10199.924407] swiotlb_map+0x5c/0x260 +[10199.924409] ? nvme_pci_setup_prps+0x1ed/0x340 +[10199.924411] dma_direct_map_page+0x12e/0x1c0 +[10199.924413] nvme_map_data+0x304/0x370 +[10199.924415] nvme_prep_rq.part.0+0x31/0x120 +[10199.924417] nvme_queue_rq+0x77/0x1f0 + +... +[ 9639.596311] NMI backtrace for cpu 48 +[ 9639.596336] Call Trace: +[ 9639.596337] +[ 9639.596338] _raw_spin_lock_irqsave+0x37/0x40 +[ 9639.596341] swiotlb_do_find_slots+0xef/0x3e0 +[ 9639.596344] swiotlb_tbl_map_single+0xec/0x1f0 +[ 9639.596347] swiotlb_map+0x5c/0x260 +[ 9639.596349] dma_direct_map_sg+0x7a/0x280 +[ 9639.596352] __dma_map_sg_attrs+0x30/0x70 +[ 9639.596355] dma_map_sgtable+0x1d/0x30 +[ 9639.596356] nvme_map_data+0xce/0x370 + +... +[ 9639.595665] NMI backtrace for cpu 50 +[ 9639.595682] Call Trace: +[ 9639.595682] +[ 9639.595683] _raw_spin_lock_irqsave+0x37/0x40 +[ 9639.595686] swiotlb_release_slots.isra.0+0x86/0x180 +[ 9639.595688] dma_direct_unmap_sg+0xcf/0x1a0 +[ 9639.595690] nvme_unmap_data.part.0+0x43/0xc0 + +Fixes: 1f221a0d0dbf ("swiotlb: respect min_align_mask") +Signed-off-by: GuoRui.Yu +Signed-off-by: Xiaokang Hu +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/swiotlb.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c +index 339a990554e7f..1ecd0d1f7231a 100644 +--- a/kernel/dma/swiotlb.c ++++ b/kernel/dma/swiotlb.c +@@ -617,8 +617,8 @@ static int swiotlb_do_find_slots(struct device *dev, int area_index, + unsigned int iotlb_align_mask = + dma_get_min_align_mask(dev) & ~(IO_TLB_SIZE - 1); + unsigned int nslots = nr_slots(alloc_size), stride; +- unsigned int index, wrap, count = 0, i; + unsigned int offset = swiotlb_align_offset(dev, orig_addr); ++ unsigned int index, slots_checked, count = 0, i; + unsigned long flags; + unsigned int slot_base; + unsigned int slot_index; +@@ -641,15 +641,16 @@ static int swiotlb_do_find_slots(struct device *dev, int area_index, + goto not_found; + + slot_base = area_index * mem->area_nslabs; +- index = wrap = wrap_area_index(mem, ALIGN(area->index, stride)); ++ index = wrap_area_index(mem, ALIGN(area->index, stride)); + +- do { ++ for (slots_checked = 0; slots_checked < mem->area_nslabs; ) { + slot_index = slot_base + index; + + if (orig_addr && + (slot_addr(tbl_dma_addr, slot_index) & + iotlb_align_mask) != (orig_addr & iotlb_align_mask)) { + index = wrap_area_index(mem, index + 1); ++ slots_checked++; + continue; + } + +@@ -665,7 +666,8 @@ static int swiotlb_do_find_slots(struct device *dev, int area_index, + goto found; + } + index = wrap_area_index(mem, index + stride); +- } while (index != wrap); ++ slots_checked += stride; ++ } + + not_found: + spin_unlock_irqrestore(&area->lock, flags); +-- +2.39.2 +