From: Sasha Levin Date: Mon, 23 May 2022 03:03:27 +0000 (-0400) Subject: Fixes for 5.17 X-Git-Tag: v4.9.316~29 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9b17a0723377bf661b0203b734c412a35f25cfc6;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.17 Signed-off-by: Sasha Levin --- diff --git a/queue-5.17/alsa-hda-fix-unused-realtek-function-when-pm-is-not-.patch b/queue-5.17/alsa-hda-fix-unused-realtek-function-when-pm-is-not-.patch new file mode 100644 index 00000000000..ca4aa32ca8e --- /dev/null +++ b/queue-5.17/alsa-hda-fix-unused-realtek-function-when-pm-is-not-.patch @@ -0,0 +1,63 @@ +From 09b6cafa627c6f3a7351fc8e9878aac0ee18c39d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Apr 2022 12:33:18 -0700 +Subject: ALSA: hda - fix unused Realtek function when PM is not enabled + +From: Randy Dunlap + +[ Upstream commit c3d9ca93f1e3bd3d1adfc4479a12c82fed424c87 ] + +When CONFIG_PM is not enabled, alc_shutup() is not needed, +so move it inside the #ifdef CONFIG_PM guard. +Also drop some contiguous #endif / #ifdef CONFIG_PM for simplicity. + +Fixes this build warning: +sound/pci/hda/patch_realtek.c:886:20: warning: unused function 'alc_shutup' + +Fixes: 08c189f2c552 ("ALSA: hda - Use generic parser codes for Realtek driver") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Link: https://lore.kernel.org/r/20220430193318.29024-1-rdunlap@infradead.org +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 779205bf5862..e38acdbe1a3b 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -937,6 +937,9 @@ static int alc_init(struct hda_codec *codec) + return 0; + } + ++#define alc_free snd_hda_gen_free ++ ++#ifdef CONFIG_PM + static inline void alc_shutup(struct hda_codec *codec) + { + struct alc_spec *spec = codec->spec; +@@ -950,9 +953,6 @@ static inline void alc_shutup(struct hda_codec *codec) + alc_shutup_pins(codec); + } + +-#define alc_free snd_hda_gen_free +- +-#ifdef CONFIG_PM + static void alc_power_eapd(struct hda_codec *codec) + { + alc_auto_setup_eapd(codec, false); +@@ -966,9 +966,7 @@ static int alc_suspend(struct hda_codec *codec) + spec->power_hook(codec); + return 0; + } +-#endif + +-#ifdef CONFIG_PM + static int alc_resume(struct hda_codec *codec) + { + struct alc_spec *spec = codec->spec; +-- +2.35.1 + diff --git a/queue-5.17/arm-9196-1-spectre-bhb-enable-for-cortex-a15.patch b/queue-5.17/arm-9196-1-spectre-bhb-enable-for-cortex-a15.patch new file mode 100644 index 00000000000..cc5e027fb59 --- /dev/null +++ b/queue-5.17/arm-9196-1-spectre-bhb-enable-for-cortex-a15.patch @@ -0,0 +1,36 @@ +From 0c4b9326d8fede6f2a89fec9da11a17a4bc2f64b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Apr 2022 09:44:51 +0100 +Subject: ARM: 9196/1: spectre-bhb: enable for Cortex-A15 + +From: Ard Biesheuvel + +[ Upstream commit 0dc14aa94ccd8ba35eb17a0f9b123d1566efd39e ] + +The Spectre-BHB mitigations were inadvertently left disabled for +Cortex-A15, due to the fact that cpu_v7_bugs_init() is not called in +that case. So fix that. + +Fixes: b9baf5c8c5c3 ("ARM: Spectre-BHB workaround") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/mm/proc-v7-bugs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c +index 06dbfb968182..fb9f3eb6bf48 100644 +--- a/arch/arm/mm/proc-v7-bugs.c ++++ b/arch/arm/mm/proc-v7-bugs.c +@@ -288,6 +288,7 @@ void cpu_v7_ca15_ibe(void) + { + if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(0))) + cpu_v7_spectre_v2_init(); ++ cpu_v7_spectre_bhb_init(); + } + + void cpu_v7_bugs_init(void) +-- +2.35.1 + diff --git a/queue-5.17/arm-9197-1-spectre-bhb-fix-loop8-sequence-for-thumb2.patch b/queue-5.17/arm-9197-1-spectre-bhb-fix-loop8-sequence-for-thumb2.patch new file mode 100644 index 00000000000..0ab9bf6929e --- /dev/null +++ b/queue-5.17/arm-9197-1-spectre-bhb-fix-loop8-sequence-for-thumb2.patch @@ -0,0 +1,37 @@ +From 89fab676e9afd9efcf241c0e26026dba8f927eff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Apr 2022 09:46:17 +0100 +Subject: ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2 + +From: Ard Biesheuvel + +[ Upstream commit 3cfb3019979666bdf33a1010147363cf05e0f17b ] + +In Thumb2, 'b . + 4' produces a branch instruction that uses a narrow +encoding, and so it does not jump to the following instruction as +expected. So use W(b) instead. + +Fixes: 6c7cb60bff7a ("ARM: fix Thumb2 regression with Spectre BHB") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/kernel/entry-armv.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S +index ee3f7a599181..4bbd92d41031 100644 +--- a/arch/arm/kernel/entry-armv.S ++++ b/arch/arm/kernel/entry-armv.S +@@ -1040,7 +1040,7 @@ vector_bhb_loop8_\name: + + @ bhb workaround + mov r0, #8 +-3: b . + 4 ++3: W(b) . + 4 + subs r0, r0, #1 + bne 3b + dsb +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-aspeed-add-video-engine-to-g6.patch b/queue-5.17/arm-dts-aspeed-add-video-engine-to-g6.patch new file mode 100644 index 00000000000..f477641cd32 --- /dev/null +++ b/queue-5.17/arm-dts-aspeed-add-video-engine-to-g6.patch @@ -0,0 +1,45 @@ +From 5f897874defd302ca0f4df4ba4a4336e12c791a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Mar 2022 03:23:51 +0000 +Subject: ARM: dts: aspeed: Add video engine to g6 + +From: Howard Chiu + +[ Upstream commit 32e62d1beab70d485980013312e747a25c4e13f7 ] + +This node was accidentally removed by commit 645afe73f951 ("ARM: dts: +aspeed: ast2600: Update XDMA engine node"). + +Fixes: 645afe73f951 ("ARM: dts: aspeed: ast2600: Update XDMA engine node") +Signed-off-by: Howard Chiu +Link: https://lore.kernel.org/r/SG2PR06MB2315C57600A0132FEF40F21EE61E9@SG2PR06MB2315.apcprd06.prod.outlook.com +Signed-off-by: Joel Stanley +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/aspeed-g6.dtsi | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/arch/arm/boot/dts/aspeed-g6.dtsi b/arch/arm/boot/dts/aspeed-g6.dtsi +index c32e87fad4dc..aac55b3aeded 100644 +--- a/arch/arm/boot/dts/aspeed-g6.dtsi ++++ b/arch/arm/boot/dts/aspeed-g6.dtsi +@@ -389,6 +389,16 @@ sbc: secure-boot-controller@1e6f2000 { + reg = <0x1e6f2000 0x1000>; + }; + ++ video: video@1e700000 { ++ compatible = "aspeed,ast2600-video-engine"; ++ reg = <0x1e700000 0x1000>; ++ clocks = <&syscon ASPEED_CLK_GATE_VCLK>, ++ <&syscon ASPEED_CLK_GATE_ECLK>; ++ clock-names = "vclk", "eclk"; ++ interrupts = ; ++ status = "disabled"; ++ }; ++ + gpio0: gpio@1e780000 { + #gpio-cells = <2>; + gpio-controller; +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-aspeed-g6-fix-spi1-spi2-quad-pin-group.patch b/queue-5.17/arm-dts-aspeed-g6-fix-spi1-spi2-quad-pin-group.patch new file mode 100644 index 00000000000..6caeef8bca2 --- /dev/null +++ b/queue-5.17/arm-dts-aspeed-g6-fix-spi1-spi2-quad-pin-group.patch @@ -0,0 +1,45 @@ +From 0a924260a7731f361d86da6d33b237c9f9cdd849 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Mar 2022 10:39:32 -0700 +Subject: ARM: dts: aspeed-g6: fix SPI1/SPI2 quad pin group + +From: Jae Hyun Yoo + +[ Upstream commit 890362d41b244536ab63591f813393f5fdf59ed7 ] + +Fix incorrect function mappings in pinctrl_qspi1_default and +pinctrl_qspi2_default since their function should be SPI1 and +SPI2 respectively. + +Fixes: f510f04c8c83 ("ARM: dts: aspeed: Add AST2600 pinmux nodes") +Signed-off-by: Jae Hyun Yoo +Reviewed-by: Andrew Jeffery +Link: https://lore.kernel.org/r/20220329173932.2588289-8-quic_jaehyoo@quicinc.com +Signed-off-by: Joel Stanley +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi +index 06d60a8540e9..ac07c240419a 100644 +--- a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi ++++ b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi +@@ -648,12 +648,12 @@ pinctrl_pwm9g1_default: pwm9g1_default { + }; + + pinctrl_qspi1_default: qspi1_default { +- function = "QSPI1"; ++ function = "SPI1"; + groups = "QSPI1"; + }; + + pinctrl_qspi2_default: qspi2_default { +- function = "QSPI2"; ++ function = "SPI2"; + groups = "QSPI2"; + }; + +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-aspeed-g6-remove-fwqspid-group-in-pinctrl-dt.patch b/queue-5.17/arm-dts-aspeed-g6-remove-fwqspid-group-in-pinctrl-dt.patch new file mode 100644 index 00000000000..1a5309fcbe2 --- /dev/null +++ b/queue-5.17/arm-dts-aspeed-g6-remove-fwqspid-group-in-pinctrl-dt.patch @@ -0,0 +1,43 @@ +From 98d1e0ad2ed5bcdaa1d2f9d9665bb7e0edbec959 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Mar 2022 10:39:26 -0700 +Subject: ARM: dts: aspeed-g6: remove FWQSPID group in pinctrl dtsi + +From: Jae Hyun Yoo + +[ Upstream commit efddaa397cceefb61476e383c26fafd1f8ab6356 ] + +FWSPIDQ2 and FWSPIDQ3 are not part of FWSPI18 interface so remove +FWQSPID group in pinctrl dtsi. These pins must be used with the +FWSPI pins that are dedicated for boot SPI interface which provides +same 3.3v logic level. + +Fixes: 2f6edb6bcb2f ("ARM: dts: aspeed: Fix AST2600 quad spi group") +Signed-off-by: Jae Hyun Yoo +Reviewed-by: Andrew Jeffery +Link: https://lore.kernel.org/r/20220329173932.2588289-2-quic_jaehyoo@quicinc.com +Signed-off-by: Joel Stanley +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi +index e4775bbceecc..06d60a8540e9 100644 +--- a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi ++++ b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi +@@ -117,11 +117,6 @@ pinctrl_fwspid_default: fwspid_default { + groups = "FWSPID"; + }; + +- pinctrl_fwqspid_default: fwqspid_default { +- function = "FWSPID"; +- groups = "FWQSPID"; +- }; +- + pinctrl_fwspiwp_default: fwspiwp_default { + function = "FWSPIWP"; + groups = "FWSPIWP"; +-- +2.35.1 + diff --git a/queue-5.17/arm64-dts-qcom-sm8250-don-t-enable-rx-tx-macro-by-de.patch b/queue-5.17/arm64-dts-qcom-sm8250-don-t-enable-rx-tx-macro-by-de.patch new file mode 100644 index 00000000000..e6fe68b989d --- /dev/null +++ b/queue-5.17/arm64-dts-qcom-sm8250-don-t-enable-rx-tx-macro-by-de.patch @@ -0,0 +1,108 @@ +From 0f2e00e1e9d5f925467f1580fdd103e4c0bddf18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Apr 2022 21:58:14 +0300 +Subject: arm64: dts: qcom: sm8250: don't enable rx/tx macro by default + +From: Dmitry Baryshkov + +[ Upstream commit 18019eb62efb68c9b365acca9c4fcb2e0d459487 ] + +Enabling rxmacro and txmacro nodes by defaults makes Qualcomm RB5 to +crash and reboot while probing audio devices. Disable these device tree +nodes by default and enabled them only when necessary (for the +SM8250-MTP board). + +Fixes: 24f52ef0c4bf ("arm64: dts: qcom: sm8250: Add nodes for tx and rx macros with soundwire masters") +Cc: Srinivas Kandagatla +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220401185814.519653-1-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250-mtp.dts | 12 ++++++++++++ + arch/arm64/boot/dts/qcom/sm8250.dtsi | 4 ++++ + 2 files changed, 16 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250-mtp.dts b/arch/arm64/boot/dts/qcom/sm8250-mtp.dts +index fb99cc2827c7..7ab3627cc347 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250-mtp.dts ++++ b/arch/arm64/boot/dts/qcom/sm8250-mtp.dts +@@ -622,6 +622,10 @@ &qupv3_id_2 { + status = "okay"; + }; + ++&rxmacro { ++ status = "okay"; ++}; ++ + &slpi { + status = "okay"; + firmware-name = "qcom/sm8250/slpi.mbn"; +@@ -773,6 +777,8 @@ right_spkr: wsa8810-left@0,4{ + }; + + &swr1 { ++ status = "okay"; ++ + wcd_rx: wcd9380-rx@0,4 { + compatible = "sdw20217010d00"; + reg = <0 4>; +@@ -781,6 +787,8 @@ wcd_rx: wcd9380-rx@0,4 { + }; + + &swr2 { ++ status = "okay"; ++ + wcd_tx: wcd9380-tx@0,3 { + compatible = "sdw20217010d00"; + reg = <0 3>; +@@ -819,6 +827,10 @@ config { + }; + }; + ++&txmacro { ++ status = "okay"; ++}; ++ + &uart12 { + status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi +index a92230bec1dd..bd212f6c351f 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -2150,6 +2150,7 @@ rxmacro: rxmacro@3200000 { + pinctrl-0 = <&rx_swr_active>; + compatible = "qcom,sm8250-lpass-rx-macro"; + reg = <0 0x3200000 0 0x1000>; ++ status = "disabled"; + + clocks = <&q6afecc LPASS_CLK_ID_TX_CORE_MCLK LPASS_CLK_ATTRIBUTE_COUPLE_NO>, + <&q6afecc LPASS_CLK_ID_TX_CORE_NPL_MCLK LPASS_CLK_ATTRIBUTE_COUPLE_NO>, +@@ -2168,6 +2169,7 @@ rxmacro: rxmacro@3200000 { + swr1: soundwire-controller@3210000 { + reg = <0 0x3210000 0 0x2000>; + compatible = "qcom,soundwire-v1.5.1"; ++ status = "disabled"; + interrupts = ; + clocks = <&rxmacro>; + clock-names = "iface"; +@@ -2195,6 +2197,7 @@ txmacro: txmacro@3220000 { + pinctrl-0 = <&tx_swr_active>; + compatible = "qcom,sm8250-lpass-tx-macro"; + reg = <0 0x3220000 0 0x1000>; ++ status = "disabled"; + + clocks = <&q6afecc LPASS_CLK_ID_TX_CORE_MCLK LPASS_CLK_ATTRIBUTE_COUPLE_NO>, + <&q6afecc LPASS_CLK_ID_TX_CORE_NPL_MCLK LPASS_CLK_ATTRIBUTE_COUPLE_NO>, +@@ -2218,6 +2221,7 @@ swr2: soundwire-controller@3230000 { + compatible = "qcom,soundwire-v1.5.1"; + interrupts-extended = <&intc GIC_SPI 297 IRQ_TYPE_LEVEL_HIGH>; + interrupt-names = "core"; ++ status = "disabled"; + + clocks = <&txmacro>; + clock-names = "iface"; +-- +2.35.1 + diff --git a/queue-5.17/arm64-enable-repeat-tlbi-workaround-on-kryo4xx-gold-.patch b/queue-5.17/arm64-enable-repeat-tlbi-workaround-on-kryo4xx-gold-.patch new file mode 100644 index 00000000000..2eb7098fff4 --- /dev/null +++ b/queue-5.17/arm64-enable-repeat-tlbi-workaround-on-kryo4xx-gold-.patch @@ -0,0 +1,57 @@ +From faddba1d5fd4ef8af3740fa1cac74fdd3296af36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 16:31:34 +0530 +Subject: arm64: Enable repeat tlbi workaround on KRYO4XX gold CPUs + +From: Shreyas K K + +[ Upstream commit 51f559d66527e238f9a5f82027bff499784d4eac ] + +Add KRYO4XX gold/big cores to the list of CPUs that need the +repeat TLBI workaround. Apply this to the affected +KRYO4XX cores (rcpe to rfpe). + +The variant and revision bits are implementation defined and are +different from the their Cortex CPU counterparts on which they are +based on, i.e., (r0p0 to r3p0) is equivalent to (rcpe to rfpe). + +Signed-off-by: Shreyas K K +Reviewed-by: Sai Prakash Ranjan +Link: https://lore.kernel.org/r/20220512110134.12179-1-quic_shrekk@quicinc.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + Documentation/arm64/silicon-errata.rst | 3 +++ + arch/arm64/kernel/cpu_errata.c | 2 ++ + 2 files changed, 5 insertions(+) + +diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst +index ea281dd75517..29b136849d30 100644 +--- a/Documentation/arm64/silicon-errata.rst ++++ b/Documentation/arm64/silicon-errata.rst +@@ -189,6 +189,9 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | Qualcomm Tech. | Kryo4xx Silver | N/A | ARM64_ERRATUM_1024718 | + +----------------+-----------------+-----------------+-----------------------------+ ++| Qualcomm Tech. | Kryo4xx Gold | N/A | ARM64_ERRATUM_1286807 | +++----------------+-----------------+-----------------+-----------------------------+ ++ + +----------------+-----------------+-----------------+-----------------------------+ + | Fujitsu | A64FX | E#010001 | FUJITSU_ERRATUM_010001 | + +----------------+-----------------+-----------------+-----------------------------+ +diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c +index 146fa2e76834..10c865e311a0 100644 +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -208,6 +208,8 @@ static const struct arm64_cpu_capabilities arm64_repeat_tlbi_list[] = { + #ifdef CONFIG_ARM64_ERRATUM_1286807 + { + ERRATA_MIDR_RANGE(MIDR_CORTEX_A76, 0, 0, 3, 0), ++ /* Kryo4xx Gold (rcpe to rfpe) => (r0p0 to r3p0) */ ++ ERRATA_MIDR_RANGE(MIDR_QCOM_KRYO_4XX_GOLD, 0xc, 0xe, 0xf, 0xe), + }, + #endif + {}, +-- +2.35.1 + diff --git a/queue-5.17/arm64-kexec-load-from-kimage-prior-to-clobbering.patch b/queue-5.17/arm64-kexec-load-from-kimage-prior-to-clobbering.patch new file mode 100644 index 00000000000..142360ff67c --- /dev/null +++ b/queue-5.17/arm64-kexec-load-from-kimage-prior-to-clobbering.patch @@ -0,0 +1,90 @@ +From 94f293dc2cfe4939d3588589de8bf15441c778d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 May 2022 17:07:35 +0100 +Subject: arm64: kexec: load from kimage prior to clobbering + +From: Mark Rutland + +[ Upstream commit eb3d8ea3e1f03f4b0b72d8f5ed9eb7c3165862e8 ] + +In arm64_relocate_new_kernel() we load some fields out of the kimage +structure after relocation has occurred. As the kimage structure isn't +allocated to be relocation-safe, it may be clobbered during relocation, +and we may load junk values out of the structure. + +Due to this, kexec may fail when the kimage allocation happens to fall +within a PA range that an object will be relocated to. This has been +observed to occur for regular kexec on a QEMU TCG 'virt' machine with +2GiB of RAM, where the PA range of the new kernel image overlaps the +kimage structure. + +Avoid this by ensuring we load all values from the kimage structure +prior to relocation. + +I've tested this atop v5.16 and v5.18-rc6. + +Fixes: 878fdbd70486 ("arm64: kexec: pass kimage as the only argument to relocation function") +Signed-off-by: Mark Rutland +Cc: Catalin Marinas +Cc: James Morse +Cc: Pasha Tatashin +Cc: Will Deacon +Reviewed-by: Pasha Tatashin +Link: https://lore.kernel.org/r/20220516160735.731404-1-mark.rutland@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/relocate_kernel.S | 22 +++++++++++++++------- + 1 file changed, 15 insertions(+), 7 deletions(-) + +diff --git a/arch/arm64/kernel/relocate_kernel.S b/arch/arm64/kernel/relocate_kernel.S +index f0a3df9e18a3..413f899e4ac6 100644 +--- a/arch/arm64/kernel/relocate_kernel.S ++++ b/arch/arm64/kernel/relocate_kernel.S +@@ -37,6 +37,15 @@ + * safe memory that has been set up to be preserved during the copy operation. + */ + SYM_CODE_START(arm64_relocate_new_kernel) ++ /* ++ * The kimage structure isn't allocated specially and may be clobbered ++ * during relocation. We must load any values we need from it prior to ++ * any relocation occurring. ++ */ ++ ldr x28, [x0, #KIMAGE_START] ++ ldr x27, [x0, #KIMAGE_ARCH_EL2_VECTORS] ++ ldr x26, [x0, #KIMAGE_ARCH_DTB_MEM] ++ + /* Setup the list loop variables. */ + ldr x18, [x0, #KIMAGE_ARCH_ZERO_PAGE] /* x18 = zero page for BBM */ + ldr x17, [x0, #KIMAGE_ARCH_TTBR1] /* x17 = linear map copy */ +@@ -72,21 +81,20 @@ SYM_CODE_START(arm64_relocate_new_kernel) + ic iallu + dsb nsh + isb +- ldr x4, [x0, #KIMAGE_START] /* relocation start */ +- ldr x1, [x0, #KIMAGE_ARCH_EL2_VECTORS] /* relocation start */ +- ldr x0, [x0, #KIMAGE_ARCH_DTB_MEM] /* dtb address */ + turn_off_mmu x12, x13 + + /* Start new image. */ +- cbz x1, .Lel1 +- mov x1, x4 /* relocation start */ +- mov x2, x0 /* dtb address */ ++ cbz x27, .Lel1 ++ mov x1, x28 /* kernel entry point */ ++ mov x2, x26 /* dtb address */ + mov x3, xzr + mov x4, xzr + mov x0, #HVC_SOFT_RESTART + hvc #0 /* Jumps from el2 */ + .Lel1: ++ mov x0, x26 /* dtb address */ ++ mov x1, xzr + mov x2, xzr + mov x3, xzr +- br x4 /* Jumps from el1 */ ++ br x28 /* Jumps from el1 */ + SYM_CODE_END(arm64_relocate_new_kernel) +-- +2.35.1 + diff --git a/queue-5.17/block-mq-deadline-set-the-fifo_time-member-also-if-i.patch b/queue-5.17/block-mq-deadline-set-the-fifo_time-member-also-if-i.patch new file mode 100644 index 00000000000..2c55944b1b5 --- /dev/null +++ b/queue-5.17/block-mq-deadline-set-the-fifo_time-member-also-if-i.patch @@ -0,0 +1,41 @@ +From fad78d1779995d356f0d4e575e3964e75d7aac68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 May 2022 10:13:07 -0700 +Subject: block/mq-deadline: Set the fifo_time member also if inserting at head + +From: Bart Van Assche + +[ Upstream commit 725f22a1477c9c15aa67ad3af96fe28ec4fe72d2 ] + +Before commit 322cff70d46c the fifo_time member of requests on a dispatch +list was not used. Commit 322cff70d46c introduces code that reads the +fifo_time member of requests on dispatch lists. Hence this patch that sets +the fifo_time member when adding a request to a dispatch list. + +Cc: Christoph Hellwig +Cc: Ming Lei +Cc: Damien Le Moal +Fixes: 322cff70d46c ("block/mq-deadline: Prioritize high-priority requests") +Signed-off-by: Bart Van Assche +Link: https://lore.kernel.org/r/20220513171307.32564-1-bvanassche@acm.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/mq-deadline.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/block/mq-deadline.c b/block/mq-deadline.c +index 3ed5eaf3446a..6ed602b2f80a 100644 +--- a/block/mq-deadline.c ++++ b/block/mq-deadline.c +@@ -742,6 +742,7 @@ static void dd_insert_request(struct blk_mq_hw_ctx *hctx, struct request *rq, + + if (at_head) { + list_add(&rq->queuelist, &per_prio->dispatch); ++ rq->fifo_time = jiffies; + } else { + deadline_add_rq_rb(per_prio, rq); + +-- +2.35.1 + diff --git a/queue-5.17/cfg80211-retrieve-s1g-operating-channel-number.patch b/queue-5.17/cfg80211-retrieve-s1g-operating-channel-number.patch new file mode 100644 index 00000000000..7c4591ae8d0 --- /dev/null +++ b/queue-5.17/cfg80211-retrieve-s1g-operating-channel-number.patch @@ -0,0 +1,40 @@ +From 32c1dcaab7e48463f712a3059df18df419ea4b7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Apr 2022 04:13:20 +0000 +Subject: cfg80211: retrieve S1G operating channel number + +From: Kieran Frewen + +[ Upstream commit e847ffe2d146cfd52980ca688d84358e024a6e70 ] + +When retrieving the S1G channel number from IEs, we should retrieve +the operating channel instead of the primary channel. The S1G operation +element specifies the main channel of operation as the oper channel, +unlike for HT and HE which specify their main channel of operation as +the primary channel. + +Signed-off-by: Kieran Frewen +Signed-off-by: Bassem Dawood +Link: https://lore.kernel.org/r/20220420041321.3788789-1-kieran.frewen@morsemicro.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/scan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/wireless/scan.c b/net/wireless/scan.c +index 4a6d86432910..6d82bd9eaf8c 100644 +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -1829,7 +1829,7 @@ int cfg80211_get_ies_channel_number(const u8 *ie, size_t ielen, + if (tmp && tmp->datalen >= sizeof(struct ieee80211_s1g_oper_ie)) { + struct ieee80211_s1g_oper_ie *s1gop = (void *)tmp->data; + +- return s1gop->primary_ch; ++ return s1gop->oper_ch; + } + } else { + tmp = cfg80211_find_elem(WLAN_EID_DS_PARAMS, ie, ielen); +-- +2.35.1 + diff --git a/queue-5.17/clk-at91-generated-consider-range-when-calculating-b.patch b/queue-5.17/clk-at91-generated-consider-range-when-calculating-b.patch new file mode 100644 index 00000000000..208c3011448 --- /dev/null +++ b/queue-5.17/clk-at91-generated-consider-range-when-calculating-b.patch @@ -0,0 +1,42 @@ +From 4e636dfbae904babd95d26eae073c6a6d26f15d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Apr 2022 10:13:18 +0300 +Subject: clk: at91: generated: consider range when calculating best rate + +From: Codrin Ciubotariu + +[ Upstream commit d0031e6fbed955ff8d5f5bbc8fe7382482559cec ] + +clk_generated_best_diff() helps in finding the parent and the divisor to +compute a rate closest to the required one. However, it doesn't take into +account the request's range for the new rate. Make sure the new rate +is within the required range. + +Fixes: 8a8f4bf0c480 ("clk: at91: clk-generated: create function to find best_diff") +Signed-off-by: Codrin Ciubotariu +Link: https://lore.kernel.org/r/20220413071318.244912-1-codrin.ciubotariu@microchip.com +Reviewed-by: Claudiu Beznea +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-generated.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/clk/at91/clk-generated.c b/drivers/clk/at91/clk-generated.c +index 23cc8297ec4c..d429ba52a719 100644 +--- a/drivers/clk/at91/clk-generated.c ++++ b/drivers/clk/at91/clk-generated.c +@@ -117,6 +117,10 @@ static void clk_generated_best_diff(struct clk_rate_request *req, + tmp_rate = parent_rate; + else + tmp_rate = parent_rate / div; ++ ++ if (tmp_rate < req->min_rate || tmp_rate > req->max_rate) ++ return; ++ + tmp_diff = abs(req->rate - tmp_rate); + + if (*best_diff < 0 || *best_diff >= tmp_diff) { +-- +2.35.1 + diff --git a/queue-5.17/drm-amd-display-undo-clearing-of-z10-related-functio.patch b/queue-5.17/drm-amd-display-undo-clearing-of-z10-related-functio.patch new file mode 100644 index 00000000000..8df9cfa218f --- /dev/null +++ b/queue-5.17/drm-amd-display-undo-clearing-of-z10-related-functio.patch @@ -0,0 +1,42 @@ +From 030fc735932ad571a12a691fae8e821fd3e0300b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Mar 2022 16:34:24 -0400 +Subject: drm/amd/display: undo clearing of z10 related function pointers + +From: Eric Yang + +[ Upstream commit 9b9bd3f640640f94272a461b2dfe558f91b322c5 ] + +[Why] +Z10 and S0i3 have some shared path. Previous code clean up , +incorrectly removed these pointers, which breaks s0i3 restore + +[How] +Do not clear the function pointers based on Z10 disable. + +Reviewed-by: Nicholas Kazlauskas +Acked-by: Pavle Kotarac +Signed-off-by: Eric Yang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn31/dcn31_init.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_init.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_init.c +index d7559e5a99ce..e708f07fe75a 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_init.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_init.c +@@ -153,9 +153,4 @@ void dcn31_hw_sequencer_construct(struct dc *dc) + dc->hwss.init_hw = dcn20_fpga_init_hw; + dc->hwseq->funcs.init_pipes = NULL; + } +- if (dc->debug.disable_z10) { +- /*hw not support z10 or sw disable it*/ +- dc->hwss.z10_restore = NULL; +- dc->hwss.z10_save_init = NULL; +- } + } +-- +2.35.1 + diff --git a/queue-5.17/ethernet-tulip-fix-missing-pci_disable_device-on-err.patch b/queue-5.17/ethernet-tulip-fix-missing-pci_disable_device-on-err.patch new file mode 100644 index 00000000000..a7d122590ea --- /dev/null +++ b/queue-5.17/ethernet-tulip-fix-missing-pci_disable_device-on-err.patch @@ -0,0 +1,49 @@ +From 9bb00bb90329f88284d7041e413605ca532b2801 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 May 2022 17:42:50 +0800 +Subject: ethernet: tulip: fix missing pci_disable_device() on error in + tulip_init_one() + +From: Yang Yingliang + +[ Upstream commit 51ca86b4c9c7c75f5630fa0dbe5f8f0bd98e3c3e ] + +Fix the missing pci_disable_device() before return +from tulip_init_one() in the error handling case. + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20220506094250.3630615-1-yangyingliang@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dec/tulip/tulip_core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/dec/tulip/tulip_core.c b/drivers/net/ethernet/dec/tulip/tulip_core.c +index 79df5a72877b..0040dcaab945 100644 +--- a/drivers/net/ethernet/dec/tulip/tulip_core.c ++++ b/drivers/net/ethernet/dec/tulip/tulip_core.c +@@ -1399,8 +1399,10 @@ static int tulip_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + + /* alloc_etherdev ensures aligned and zeroed private structures */ + dev = alloc_etherdev (sizeof (*tp)); +- if (!dev) ++ if (!dev) { ++ pci_disable_device(pdev); + return -ENOMEM; ++ } + + SET_NETDEV_DEV(dev, &pdev->dev); + if (pci_resource_len (pdev, 0) < tulip_tbl[chip_idx].io_size) { +@@ -1785,6 +1787,7 @@ static int tulip_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + + err_out_free_netdev: + free_netdev (dev); ++ pci_disable_device(pdev); + return -ENODEV; + } + +-- +2.35.1 + diff --git a/queue-5.17/fbdev-prevent-possible-use-after-free-in-fb_release.patch b/queue-5.17/fbdev-prevent-possible-use-after-free-in-fb_release.patch new file mode 100644 index 00000000000..52dfd73000b --- /dev/null +++ b/queue-5.17/fbdev-prevent-possible-use-after-free-in-fb_release.patch @@ -0,0 +1,47 @@ +From 389b61343bbcd31b27e73ba7ef7e189c996166e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 May 2022 00:04:13 +0200 +Subject: fbdev: Prevent possible use-after-free in fb_release() + +From: Daniel Vetter + +[ Upstream commit 89bfd4017e58faaf70411555e7f508495114e90b ] + +Most fbdev drivers have issues with the fb_info lifetime, because call to +framebuffer_release() from their driver's .remove callback, rather than +doing from fbops.fb_destroy callback. + +Doing that will destroy the fb_info too early, while references to it may +still exist, leading to a use-after-free error. + +To prevent this, check the fb_info reference counter when attempting to +kfree the data structure in framebuffer_release(). That will leak it but +at least will prevent the mentioned error. + +Signed-off-by: Daniel Vetter +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20220505220413.365977-1-javierm@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/fbsysfs.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/video/fbdev/core/fbsysfs.c b/drivers/video/fbdev/core/fbsysfs.c +index 26892940c213..82e31a2d845e 100644 +--- a/drivers/video/fbdev/core/fbsysfs.c ++++ b/drivers/video/fbdev/core/fbsysfs.c +@@ -80,6 +80,10 @@ void framebuffer_release(struct fb_info *info) + { + if (!info) + return; ++ ++ if (WARN_ON(refcount_read(&info->count))) ++ return; ++ + kfree(info->apertures); + kfree(info); + } +-- +2.35.1 + diff --git a/queue-5.17/gpio-gpio-vf610-do-not-touch-other-bits-when-set-the.patch b/queue-5.17/gpio-gpio-vf610-do-not-touch-other-bits-when-set-the.patch new file mode 100644 index 00000000000..734e9c6f1d0 --- /dev/null +++ b/queue-5.17/gpio-gpio-vf610-do-not-touch-other-bits-when-set-the.patch @@ -0,0 +1,45 @@ +From 331f68136039f44c2b9a8eef5f7497c563cc80b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 10:15:04 +0800 +Subject: gpio: gpio-vf610: do not touch other bits when set the target bit + +From: Haibo Chen + +[ Upstream commit 9bf3ac466faa83d51a8fe9212131701e58fdef74 ] + +For gpio controller contain register PDDR, when set one target bit, +current logic will clear all other bits, this is wrong. Use operator +'|=' to fix it. + +Fixes: 659d8a62311f ("gpio: vf610: add imx7ulp support") +Reviewed-by: Peng Fan +Signed-off-by: Haibo Chen +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-vf610.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c +index 20780c35da1b..23cddb265a0d 100644 +--- a/drivers/gpio/gpio-vf610.c ++++ b/drivers/gpio/gpio-vf610.c +@@ -125,9 +125,13 @@ static int vf610_gpio_direction_output(struct gpio_chip *chip, unsigned gpio, + { + struct vf610_gpio_port *port = gpiochip_get_data(chip); + unsigned long mask = BIT(gpio); ++ u32 val; + +- if (port->sdata && port->sdata->have_paddr) +- vf610_gpio_writel(mask, port->gpio_base + GPIO_PDDR); ++ if (port->sdata && port->sdata->have_paddr) { ++ val = vf610_gpio_readl(port->gpio_base + GPIO_PDDR); ++ val |= mask; ++ vf610_gpio_writel(val, port->gpio_base + GPIO_PDDR); ++ } + + vf610_gpio_set(chip, gpio, value); + +-- +2.35.1 + diff --git a/queue-5.17/gpio-mvebu-pwm-refuse-requests-with-inverted-polarit.patch b/queue-5.17/gpio-mvebu-pwm-refuse-requests-with-inverted-polarit.patch new file mode 100644 index 00000000000..0d63fce68fe --- /dev/null +++ b/queue-5.17/gpio-mvebu-pwm-refuse-requests-with-inverted-polarit.patch @@ -0,0 +1,40 @@ +From 606c7db2662668a209ce8501276e9d6379dcebea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 09:58:56 +0200 +Subject: gpio: mvebu/pwm: Refuse requests with inverted polarity +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 3ecb10175b1f776f076553c24e2689e42953fef5 ] + +The driver doesn't take struct pwm_state::polarity into account when +configuring the hardware, so refuse requests for inverted polarity. + +Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support") +Signed-off-by: Uwe Kleine-König +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-mvebu.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c +index a2c8dd329b31..2db19cd640a4 100644 +--- a/drivers/gpio/gpio-mvebu.c ++++ b/drivers/gpio/gpio-mvebu.c +@@ -707,6 +707,9 @@ static int mvebu_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + unsigned long flags; + unsigned int on, off; + ++ if (state->polarity != PWM_POLARITY_NORMAL) ++ return -EINVAL; ++ + val = (unsigned long long) mvpwm->clk_rate * state->duty_cycle; + do_div(val, NSEC_PER_SEC); + if (val > UINT_MAX + 1ULL) +-- +2.35.1 + diff --git a/queue-5.17/i915-guc-reset-make-__guc_reset_context-aware-of-gui.patch b/queue-5.17/i915-guc-reset-make-__guc_reset_context-aware-of-gui.patch new file mode 100644 index 00000000000..b1b0e3e964f --- /dev/null +++ b/queue-5.17/i915-guc-reset-make-__guc_reset_context-aware-of-gui.patch @@ -0,0 +1,155 @@ +From 2c7e9b10dba4d2a708a5210a820432e4a8b66bd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 17:30:45 -0700 +Subject: i915/guc/reset: Make __guc_reset_context aware of guilty engines + +From: Umesh Nerlige Ramappa + +[ Upstream commit 89e96d822bd51f7afe2d3e95a34099480b5c3d55 ] + +There are 2 ways an engine can get reset in i915 and the method of reset +affects how KMD labels a context as guilty/innocent. + +(1) GuC initiated engine-reset: GuC resets a hung engine and notifies +KMD. The context that hung on the engine is marked guilty and all other +contexts are innocent. The innocent contexts are resubmitted. + +(2) GT based reset: When an engine heartbeat fails to tick, KMD +initiates a gt/chip reset. All active contexts are marked as guilty and +discarded. + +In order to correctly mark the contexts as guilty/innocent, pass a mask +of engines that were reset to __guc_reset_context. + +Fixes: eb5e7da736f3 ("drm/i915/guc: Reset implementation for new GuC interface") +Signed-off-by: Umesh Nerlige Ramappa +Reviewed-by: Alan Previn +Signed-off-by: John Harrison +Link: https://patchwork.freedesktop.org/patch/msgid/20220426003045.3929439-1-umesh.nerlige.ramappa@intel.com +(cherry picked from commit 303760aa914b7f5ac9602dbb4b471a2ad52eeb3e) +Signed-off-by: Joonas Lahtinen +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_reset.c | 2 +- + drivers/gpu/drm/i915/gt/uc/intel_guc.h | 2 +- + .../gpu/drm/i915/gt/uc/intel_guc_submission.c | 16 ++++++++-------- + drivers/gpu/drm/i915/gt/uc/intel_uc.c | 2 +- + drivers/gpu/drm/i915/gt/uc/intel_uc.h | 2 +- + 5 files changed, 12 insertions(+), 12 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_reset.c b/drivers/gpu/drm/i915/gt/intel_reset.c +index 7be0002d9d70..f577582ddd9f 100644 +--- a/drivers/gpu/drm/i915/gt/intel_reset.c ++++ b/drivers/gpu/drm/i915/gt/intel_reset.c +@@ -791,7 +791,7 @@ static int gt_reset(struct intel_gt *gt, intel_engine_mask_t stalled_mask) + __intel_engine_reset(engine, stalled_mask & engine->mask); + local_bh_enable(); + +- intel_uc_reset(>->uc, true); ++ intel_uc_reset(>->uc, ALL_ENGINES); + + intel_ggtt_restore_fences(gt->ggtt); + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc.h b/drivers/gpu/drm/i915/gt/uc/intel_guc.h +index 3aabe164c329..e1fb8e1da128 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc.h ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc.h +@@ -417,7 +417,7 @@ int intel_guc_global_policies_update(struct intel_guc *guc); + void intel_guc_context_ban(struct intel_context *ce, struct i915_request *rq); + + void intel_guc_submission_reset_prepare(struct intel_guc *guc); +-void intel_guc_submission_reset(struct intel_guc *guc, bool stalled); ++void intel_guc_submission_reset(struct intel_guc *guc, intel_engine_mask_t stalled); + void intel_guc_submission_reset_finish(struct intel_guc *guc); + void intel_guc_submission_cancel_requests(struct intel_guc *guc); + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +index 154ad726e266..1e51a365833b 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +@@ -1603,9 +1603,9 @@ __unwind_incomplete_requests(struct intel_context *ce) + spin_unlock_irqrestore(&sched_engine->lock, flags); + } + +-static void __guc_reset_context(struct intel_context *ce, bool stalled) ++static void __guc_reset_context(struct intel_context *ce, intel_engine_mask_t stalled) + { +- bool local_stalled; ++ bool guilty; + struct i915_request *rq; + unsigned long flags; + u32 head; +@@ -1647,7 +1647,7 @@ static void __guc_reset_context(struct intel_context *ce, bool stalled) + if (!intel_context_is_pinned(ce)) + goto next_context; + +- local_stalled = false; ++ guilty = false; + rq = intel_context_find_active_request(ce); + if (!rq) { + head = ce->ring->tail; +@@ -1655,14 +1655,14 @@ static void __guc_reset_context(struct intel_context *ce, bool stalled) + } + + if (i915_request_started(rq)) +- local_stalled = true; ++ guilty = stalled & ce->engine->mask; + + GEM_BUG_ON(i915_active_is_idle(&ce->active)); + head = intel_ring_wrap(ce->ring, rq->head); + +- __i915_request_reset(rq, local_stalled && stalled); ++ __i915_request_reset(rq, guilty); + out_replay: +- guc_reset_state(ce, head, local_stalled && stalled); ++ guc_reset_state(ce, head, guilty); + next_context: + if (i != number_children) + ce = list_next_entry(ce, parallel.child_link); +@@ -1673,7 +1673,7 @@ static void __guc_reset_context(struct intel_context *ce, bool stalled) + intel_context_put(parent); + } + +-void intel_guc_submission_reset(struct intel_guc *guc, bool stalled) ++void intel_guc_submission_reset(struct intel_guc *guc, intel_engine_mask_t stalled) + { + struct intel_context *ce; + unsigned long index; +@@ -4042,7 +4042,7 @@ static void guc_context_replay(struct intel_context *ce) + { + struct i915_sched_engine *sched_engine = ce->engine->sched_engine; + +- __guc_reset_context(ce, true); ++ __guc_reset_context(ce, ce->engine->mask); + tasklet_hi_schedule(&sched_engine->tasklet); + } + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_uc.c b/drivers/gpu/drm/i915/gt/uc/intel_uc.c +index 09ed29df67bc..cbfb5a01cc1d 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_uc.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_uc.c +@@ -592,7 +592,7 @@ void intel_uc_reset_prepare(struct intel_uc *uc) + __uc_sanitize(uc); + } + +-void intel_uc_reset(struct intel_uc *uc, bool stalled) ++void intel_uc_reset(struct intel_uc *uc, intel_engine_mask_t stalled) + { + struct intel_guc *guc = &uc->guc; + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_uc.h b/drivers/gpu/drm/i915/gt/uc/intel_uc.h +index 866b462821c0..a8f38c2c60e2 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_uc.h ++++ b/drivers/gpu/drm/i915/gt/uc/intel_uc.h +@@ -42,7 +42,7 @@ void intel_uc_driver_late_release(struct intel_uc *uc); + void intel_uc_driver_remove(struct intel_uc *uc); + void intel_uc_init_mmio(struct intel_uc *uc); + void intel_uc_reset_prepare(struct intel_uc *uc); +-void intel_uc_reset(struct intel_uc *uc, bool stalled); ++void intel_uc_reset(struct intel_uc *uc, intel_engine_mask_t stalled); + void intel_uc_reset_finish(struct intel_uc *uc); + void intel_uc_cancel_requests(struct intel_uc *uc); + void intel_uc_suspend(struct intel_uc *uc); +-- +2.35.1 + diff --git a/queue-5.17/ice-fix-crash-when-writing-timestamp-on-rx-rings.patch b/queue-5.17/ice-fix-crash-when-writing-timestamp-on-rx-rings.patch new file mode 100644 index 00000000000..425ddb21736 --- /dev/null +++ b/queue-5.17/ice-fix-crash-when-writing-timestamp-on-rx-rings.patch @@ -0,0 +1,107 @@ +From b29e9579672c22ae69594d64cd944f47978b4358 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 10:33:50 +0200 +Subject: ice: fix crash when writing timestamp on RX rings + +From: Arkadiusz Kubalewski + +[ Upstream commit 4503cc7fdf9a84cd631b0cb8ecb3c9b1bdbf3594 ] + +Do not allow to write timestamps on RX rings if PF is being configured. +When PF is being configured RX rings can be freed or rebuilt. If at the +same time timestamps are updated, the kernel will crash by dereferencing +null RX ring pointer. + +PID: 1449 TASK: ff187d28ed658040 CPU: 34 COMMAND: "ice-ptp-0000:51" + #0 [ff1966a94a713bb0] machine_kexec at ffffffff9d05a0be + #1 [ff1966a94a713c08] __crash_kexec at ffffffff9d192e9d + #2 [ff1966a94a713cd0] crash_kexec at ffffffff9d1941bd + #3 [ff1966a94a713ce8] oops_end at ffffffff9d01bd54 + #4 [ff1966a94a713d08] no_context at ffffffff9d06bda4 + #5 [ff1966a94a713d60] __bad_area_nosemaphore at ffffffff9d06c10c + #6 [ff1966a94a713da8] do_page_fault at ffffffff9d06cae4 + #7 [ff1966a94a713de0] page_fault at ffffffff9da0107e + [exception RIP: ice_ptp_update_cached_phctime+91] + RIP: ffffffffc076db8b RSP: ff1966a94a713e98 RFLAGS: 00010246 + RAX: 16e3db9c6b7ccae4 RBX: ff187d269dd3c180 RCX: ff187d269cd4d018 + RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 + RBP: ff187d269cfcc644 R8: ff187d339b9641b0 R9: 0000000000000000 + R10: 0000000000000002 R11: 0000000000000000 R12: ff187d269cfcc648 + R13: ffffffff9f128784 R14: ffffffff9d101b70 R15: ff187d269cfcc640 + ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 + #8 [ff1966a94a713ea0] ice_ptp_periodic_work at ffffffffc076dbef [ice] + #9 [ff1966a94a713ee0] kthread_worker_fn at ffffffff9d101c1b + #10 [ff1966a94a713f10] kthread at ffffffff9d101b4d + #11 [ff1966a94a713f50] ret_from_fork at ffffffff9da0023f + +Fixes: 77a781155a65 ("ice: enable receive hardware timestamping") +Signed-off-by: Arkadiusz Kubalewski +Reviewed-by: Michal Schmidt +Tested-by: Dave Cain +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_ptp.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c +index 45ae97b8b97d..836c67f1aa46 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ptp.c ++++ b/drivers/net/ethernet/intel/ice/ice_ptp.c +@@ -499,12 +499,19 @@ ice_ptp_read_src_clk_reg(struct ice_pf *pf, struct ptp_system_timestamp *sts) + * This function must be called periodically to ensure that the cached value + * is never more than 2 seconds old. It must also be called whenever the PHC + * time has been changed. ++ * ++ * Return: ++ * * 0 - OK, successfully updated ++ * * -EAGAIN - PF was busy, need to reschedule the update + */ +-static void ice_ptp_update_cached_phctime(struct ice_pf *pf) ++static int ice_ptp_update_cached_phctime(struct ice_pf *pf) + { + u64 systime; + int i; + ++ if (test_and_set_bit(ICE_CFG_BUSY, pf->state)) ++ return -EAGAIN; ++ + /* Read the current PHC time */ + systime = ice_ptp_read_src_clk_reg(pf, NULL); + +@@ -527,6 +534,9 @@ static void ice_ptp_update_cached_phctime(struct ice_pf *pf) + WRITE_ONCE(vsi->rx_rings[j]->cached_phctime, systime); + } + } ++ clear_bit(ICE_CFG_BUSY, pf->state); ++ ++ return 0; + } + + /** +@@ -2322,17 +2332,18 @@ static void ice_ptp_periodic_work(struct kthread_work *work) + { + struct ice_ptp *ptp = container_of(work, struct ice_ptp, work.work); + struct ice_pf *pf = container_of(ptp, struct ice_pf, ptp); ++ int err; + + if (!test_bit(ICE_FLAG_PTP, pf->flags)) + return; + +- ice_ptp_update_cached_phctime(pf); ++ err = ice_ptp_update_cached_phctime(pf); + + ice_ptp_tx_tstamp_cleanup(&pf->hw, &pf->ptp.port.tx); + +- /* Run twice a second */ ++ /* Run twice a second or reschedule if phc update failed */ + kthread_queue_delayed_work(ptp->kworker, &ptp->work, +- msecs_to_jiffies(500)); ++ msecs_to_jiffies(err ? 10 : 500)); + } + + /** +-- +2.35.1 + diff --git a/queue-5.17/ice-fix-interrupt-moderation-settings-getting-cleare.patch b/queue-5.17/ice-fix-interrupt-moderation-settings-getting-cleare.patch new file mode 100644 index 00000000000..097f0c96dc5 --- /dev/null +++ b/queue-5.17/ice-fix-interrupt-moderation-settings-getting-cleare.patch @@ -0,0 +1,116 @@ +From 95f90d95c3fe55e3b9c8d6627aae482166398563 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 May 2022 19:33:48 -0400 +Subject: ice: Fix interrupt moderation settings getting cleared + +From: Michal Wilczynski + +[ Upstream commit bf13502ed5f941b0777b3fd1e24dac5d93f3886c ] + +Adaptive-rx and Adaptive-tx are interrupt moderation settings +that can be enabled/disabled using ethtool: +ethtool -C ethX adaptive-rx on/off adaptive-tx on/off + +Unfortunately those settings are getting cleared after +changing number of queues, or in ethtool world 'channels': +ethtool -L ethX rx 1 tx 1 + +Clearing was happening due to introduction of bit fields +in ice_ring_container struct. This way only itr_setting +bits were rebuilt during ice_vsi_rebuild_set_coalesce(). + +Introduce an anonymous struct of bitfields and create a +union to refer to them as a single variable. +This way variable can be easily saved and restored. + +Fixes: 61dc79ced7aa ("ice: Restore interrupt throttle settings after VSI rebuild") +Signed-off-by: Michal Wilczynski +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_lib.c | 16 ++++++++-------- + drivers/net/ethernet/intel/ice/ice_txrx.h | 11 ++++++++--- + 2 files changed, 16 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c +index 15bb6f001a04..5f86cc1cfd09 100644 +--- a/drivers/net/ethernet/intel/ice/ice_lib.c ++++ b/drivers/net/ethernet/intel/ice/ice_lib.c +@@ -3207,8 +3207,8 @@ ice_vsi_rebuild_get_coalesce(struct ice_vsi *vsi, + ice_for_each_q_vector(vsi, i) { + struct ice_q_vector *q_vector = vsi->q_vectors[i]; + +- coalesce[i].itr_tx = q_vector->tx.itr_setting; +- coalesce[i].itr_rx = q_vector->rx.itr_setting; ++ coalesce[i].itr_tx = q_vector->tx.itr_settings; ++ coalesce[i].itr_rx = q_vector->rx.itr_settings; + coalesce[i].intrl = q_vector->intrl; + + if (i < vsi->num_txq) +@@ -3264,21 +3264,21 @@ ice_vsi_rebuild_set_coalesce(struct ice_vsi *vsi, + */ + if (i < vsi->alloc_rxq && coalesce[i].rx_valid) { + rc = &vsi->q_vectors[i]->rx; +- rc->itr_setting = coalesce[i].itr_rx; ++ rc->itr_settings = coalesce[i].itr_rx; + ice_write_itr(rc, rc->itr_setting); + } else if (i < vsi->alloc_rxq) { + rc = &vsi->q_vectors[i]->rx; +- rc->itr_setting = coalesce[0].itr_rx; ++ rc->itr_settings = coalesce[0].itr_rx; + ice_write_itr(rc, rc->itr_setting); + } + + if (i < vsi->alloc_txq && coalesce[i].tx_valid) { + rc = &vsi->q_vectors[i]->tx; +- rc->itr_setting = coalesce[i].itr_tx; ++ rc->itr_settings = coalesce[i].itr_tx; + ice_write_itr(rc, rc->itr_setting); + } else if (i < vsi->alloc_txq) { + rc = &vsi->q_vectors[i]->tx; +- rc->itr_setting = coalesce[0].itr_tx; ++ rc->itr_settings = coalesce[0].itr_tx; + ice_write_itr(rc, rc->itr_setting); + } + +@@ -3292,12 +3292,12 @@ ice_vsi_rebuild_set_coalesce(struct ice_vsi *vsi, + for (; i < vsi->num_q_vectors; i++) { + /* transmit */ + rc = &vsi->q_vectors[i]->tx; +- rc->itr_setting = coalesce[0].itr_tx; ++ rc->itr_settings = coalesce[0].itr_tx; + ice_write_itr(rc, rc->itr_setting); + + /* receive */ + rc = &vsi->q_vectors[i]->rx; +- rc->itr_setting = coalesce[0].itr_rx; ++ rc->itr_settings = coalesce[0].itr_rx; + ice_write_itr(rc, rc->itr_setting); + + vsi->q_vectors[i]->intrl = coalesce[0].intrl; +diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.h b/drivers/net/ethernet/intel/ice/ice_txrx.h +index b7b3bd4816f0..ec4733272034 100644 +--- a/drivers/net/ethernet/intel/ice/ice_txrx.h ++++ b/drivers/net/ethernet/intel/ice/ice_txrx.h +@@ -379,9 +379,14 @@ struct ice_ring_container { + /* this matches the maximum number of ITR bits, but in usec + * values, so it is shifted left one bit (bit zero is ignored) + */ +- u16 itr_setting:13; +- u16 itr_reserved:2; +- u16 itr_mode:1; ++ union { ++ struct { ++ u16 itr_setting:13; ++ u16 itr_reserved:2; ++ u16 itr_mode:1; ++ }; ++ u16 itr_settings; ++ }; + enum ice_container_type type; + }; + +-- +2.35.1 + diff --git a/queue-5.17/ice-fix-possible-under-reporting-of-ethtool-tx-and-r.patch b/queue-5.17/ice-fix-possible-under-reporting-of-ethtool-tx-and-r.patch new file mode 100644 index 00000000000..6fa43d40c2e --- /dev/null +++ b/queue-5.17/ice-fix-possible-under-reporting-of-ethtool-tx-and-r.patch @@ -0,0 +1,51 @@ +From c6696a222e424f910946ad65a927c21eee514137 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 14:11:42 -0700 +Subject: ice: fix possible under reporting of ethtool Tx and Rx statistics + +From: Paul Greenwalt + +[ Upstream commit 31b6298fd8e29effe9ed6b77351ac5969be56ce0 ] + +The hardware statistics counters are not cleared during resets so the +drivers first access is to initialize the baseline and then subsequent +reads are for reporting the counters. The statistics counters are read +during the watchdog subtask when the interface is up. If the baseline +is not initialized before the interface is up, then there can be a brief +window in which some traffic can be transmitted/received before the +initial baseline reading takes place. + +Directly initialize ethtool statistics in driver open so the baseline will +be initialized when the interface is up, and any dropped packets +incremented before the interface is up won't be reported. + +Fixes: 28dc1b86f8ea9 ("ice: ignore dropped packets during init") +Signed-off-by: Paul Greenwalt +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_main.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 7f6715eb862f..30f055e1a92a 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -5907,9 +5907,10 @@ static int ice_up_complete(struct ice_vsi *vsi) + ice_ptp_link_change(pf, pf->hw.pf_id, true); + } + +- /* clear this now, and the first stats read will be used as baseline */ +- vsi->stat_offsets_loaded = false; +- ++ /* Perform an initial read of the statistics registers now to ++ * set the baseline so counters are ready when interface is up ++ */ ++ ice_update_eth_stats(vsi); + ice_service_task_schedule(pf); + + return 0; +-- +2.35.1 + diff --git a/queue-5.17/igb-skip-phy-status-check-where-unavailable.patch b/queue-5.17/igb-skip-phy-status-check-where-unavailable.patch new file mode 100644 index 00000000000..93fcead7392 --- /dev/null +++ b/queue-5.17/igb-skip-phy-status-check-where-unavailable.patch @@ -0,0 +1,46 @@ +From b361eb5f8ebd93bb3cbff1791411a89be8baee05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 May 2022 11:01:05 -0700 +Subject: igb: skip phy status check where unavailable + +From: Kevin Mitchell + +[ Upstream commit 942d2ad5d2e0df758a645ddfadffde2795322728 ] + +igb_read_phy_reg() will silently return, leaving phy_data untouched, if +hw->ops.read_reg isn't set. Depending on the uninitialized value of +phy_data, this led to the phy status check either succeeding immediately +or looping continuously for 2 seconds before emitting a noisy err-level +timeout. This message went out to the console even though there was no +actual problem. + +Instead, first check if there is read_reg function pointer. If not, +proceed without trying to check the phy status register. + +Fixes: b72f3f72005d ("igb: When GbE link up, wait for Remote receiver status condition") +Signed-off-by: Kevin Mitchell +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igb/igb_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index c1e4ad65b02d..4e0abfe68cfd 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -5512,7 +5512,8 @@ static void igb_watchdog_task(struct work_struct *work) + break; + } + +- if (adapter->link_speed != SPEED_1000) ++ if (adapter->link_speed != SPEED_1000 || ++ !hw->phy.ops.read_reg) + goto no_wait; + + /* wait for Remote receiver status OK */ +-- +2.35.1 + diff --git a/queue-5.17/kvm-x86-pmu-fix-the-compare-function-used-by-the-pmu.patch b/queue-5.17/kvm-x86-pmu-fix-the-compare-function-used-by-the-pmu.patch new file mode 100644 index 00000000000..e706e057adc --- /dev/null +++ b/queue-5.17/kvm-x86-pmu-fix-the-compare-function-used-by-the-pmu.patch @@ -0,0 +1,49 @@ +From 60a912e144bc006f5ab66c298f5457a25c909eff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 May 2022 05:12:36 +0000 +Subject: kvm: x86/pmu: Fix the compare function used by the pmu event filter + +From: Aaron Lewis + +[ Upstream commit 4ac19ead0dfbabd8e0bfc731f507cfb0b95d6c99 ] + +When returning from the compare function the u64 is truncated to an +int. This results in a loss of the high nybble[1] in the event select +and its sign if that nybble is in use. Switch from using a result that +can end up being truncated to a result that can only be: 1, 0, -1. + +[1] bits 35:32 in the event select register and bits 11:8 in the event + select. + +Fixes: 7ff775aca48ad ("KVM: x86/pmu: Use binary search to check filtered events") +Signed-off-by: Aaron Lewis +Reviewed-by: Sean Christopherson +Message-Id: <20220517051238.2566934-1-aaronlewis@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/pmu.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c +index eca39f56c231..0604bc29f0b8 100644 +--- a/arch/x86/kvm/pmu.c ++++ b/arch/x86/kvm/pmu.c +@@ -171,9 +171,12 @@ static bool pmc_resume_counter(struct kvm_pmc *pmc) + return true; + } + +-static int cmp_u64(const void *a, const void *b) ++static int cmp_u64(const void *pa, const void *pb) + { +- return *(__u64 *)a - *(__u64 *)b; ++ u64 a = *(u64 *)pa; ++ u64 b = *(u64 *)pb; ++ ++ return (a > b) - (a < b); + } + + void reprogram_gp_counter(struct kvm_pmc *pmc, u64 eventsel) +-- +2.35.1 + diff --git a/queue-5.17/mac80211-fix-rx-reordering-with-non-explicit-psmp-ac.patch b/queue-5.17/mac80211-fix-rx-reordering-with-non-explicit-psmp-ac.patch new file mode 100644 index 00000000000..b201b3e7bc0 --- /dev/null +++ b/queue-5.17/mac80211-fix-rx-reordering-with-non-explicit-psmp-ac.patch @@ -0,0 +1,38 @@ +From 779fc8a271f3339a89823a1b06c10ec25b35bfe4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Apr 2022 12:50:38 +0200 +Subject: mac80211: fix rx reordering with non explicit / psmp ack policy + +From: Felix Fietkau + +[ Upstream commit 5e469ed9764d4722c59562da13120bd2dc6834c5 ] + +When the QoS ack policy was set to non explicit / psmp ack, frames are treated +as not being part of a BA session, which causes extra latency on reordering. +Fix this by only bypassing reordering for packets with no-ack policy + +Signed-off-by: Felix Fietkau +Link: https://lore.kernel.org/r/20220420105038.36443-1-nbd@nbd.name +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rx.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 48d9553dafe3..7e2404fd85b6 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -1405,8 +1405,7 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx, + goto dont_reorder; + + /* not part of a BA session */ +- if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK && +- ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL) ++ if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_NOACK) + goto dont_reorder; + + /* new, potentially un-ordered, ampdu frame - process it */ +-- +2.35.1 + diff --git a/queue-5.17/mptcp-do-tcp-fallback-on-early-dss-checksum-failure.patch b/queue-5.17/mptcp-do-tcp-fallback-on-early-dss-checksum-failure.patch new file mode 100644 index 00000000000..ed2e7a2d024 --- /dev/null +++ b/queue-5.17/mptcp-do-tcp-fallback-on-early-dss-checksum-failure.patch @@ -0,0 +1,105 @@ +From eefba3dc384cddc4489efcd6b32d9e05f38d00d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 May 2022 11:02:12 -0700 +Subject: mptcp: Do TCP fallback on early DSS checksum failure + +From: Mat Martineau + +[ Upstream commit ae66fb2ba6c3dcaf8b9612b65aa949a1a4bed150 ] + +RFC 8684 section 3.7 describes several opportunities for a MPTCP +connection to "fall back" to regular TCP early in the connection +process, before it has been confirmed that MPTCP options can be +successfully propagated on all SYN, SYN/ACK, and data packets. If a peer +acknowledges the first received data packet with a regular TCP header +(no MPTCP options), fallback is allowed. + +If the recipient of that first data packet finds a MPTCP DSS checksum +error, this provides an opportunity to fail gracefully with a TCP +fallback rather than resetting the connection (as might happen if a +checksum failure were detected later). + +This commit modifies the checksum failure code to attempt fallback on +the initial subflow of a MPTCP connection, only if it's a failure in the +first data mapping. In cases where the peer initiates the connection, +requests checksums, is the first to send data, and the peer is sending +incorrect checksums (see +https://github.com/multipath-tcp/mptcp_net-next/issues/275), this allows +the connection to proceed as TCP rather than reset. + +Fixes: dd8bcd1768ff ("mptcp: validate the data checksum") +Acked-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/mptcp/protocol.h | 3 ++- + net/mptcp/subflow.c | 21 ++++++++++++++++++--- + 2 files changed, 20 insertions(+), 4 deletions(-) + +diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h +index e4413b3e50c2..8015389859d9 100644 +--- a/net/mptcp/protocol.h ++++ b/net/mptcp/protocol.h +@@ -443,7 +443,8 @@ struct mptcp_subflow_context { + can_ack : 1, /* only after processing the remote a key */ + disposable : 1, /* ctx can be free at ulp release time */ + stale : 1, /* unable to snd/rcv data, do not use for xmit */ +- local_id_valid : 1; /* local_id is correctly initialized */ ++ local_id_valid : 1, /* local_id is correctly initialized */ ++ valid_csum_seen : 1; /* at least one csum validated */ + enum mptcp_data_avail data_avail; + u32 remote_nonce; + u64 thmac; +diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c +index e27574e9f969..7a3a70067c80 100644 +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -958,11 +958,14 @@ static enum mapping_status validate_data_csum(struct sock *ssk, struct sk_buff * + subflow->map_data_csum); + if (unlikely(csum)) { + MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_DATACSUMERR); +- subflow->send_mp_fail = 1; +- MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_MPFAILTX); ++ if (subflow->mp_join || subflow->valid_csum_seen) { ++ subflow->send_mp_fail = 1; ++ MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_MPFAILTX); ++ } + return subflow->mp_join ? MAPPING_INVALID : MAPPING_DUMMY; + } + ++ subflow->valid_csum_seen = 1; + return MAPPING_OK; + } + +@@ -1144,6 +1147,18 @@ static void subflow_sched_work_if_closed(struct mptcp_sock *msk, struct sock *ss + } + } + ++static bool subflow_can_fallback(struct mptcp_subflow_context *subflow) ++{ ++ struct mptcp_sock *msk = mptcp_sk(subflow->conn); ++ ++ if (subflow->mp_join) ++ return false; ++ else if (READ_ONCE(msk->csum_enabled)) ++ return !subflow->valid_csum_seen; ++ else ++ return !subflow->fully_established; ++} ++ + static bool subflow_check_data_avail(struct sock *ssk) + { + struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk); +@@ -1221,7 +1236,7 @@ static bool subflow_check_data_avail(struct sock *ssk) + return true; + } + +- if (subflow->mp_join || subflow->fully_established) { ++ if (!subflow_can_fallback(subflow)) { + /* fatal protocol error, close the socket. + * subflow_error_report() will introduce the appropriate barriers + */ +-- +2.35.1 + diff --git a/queue-5.17/mptcp-fix-checksum-byte-order.patch b/queue-5.17/mptcp-fix-checksum-byte-order.patch new file mode 100644 index 00000000000..3ff6abf1c1f --- /dev/null +++ b/queue-5.17/mptcp-fix-checksum-byte-order.patch @@ -0,0 +1,153 @@ +From 89427fa0094e7fdd9425733a3f6f38853874085b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 May 2022 11:02:11 -0700 +Subject: mptcp: fix checksum byte order + +From: Paolo Abeni + +[ Upstream commit ba2c89e0ea74a904d5231643245753d77422e7f5 ] + +The MPTCP code typecasts the checksum value to u16 and +then converts it to big endian while storing the value into +the MPTCP option. + +As a result, the wire encoding for little endian host is +wrong, and that causes interoperabilty interoperability +issues with other implementation or host with different endianness. + +Address the issue writing in the packet the unmodified __sum16 value. + +MPTCP checksum is disabled by default, interoperating with systems +with bad mptcp-level csum encoding should cause fallback to TCP. + +Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/275 +Fixes: c5b39e26d003 ("mptcp: send out checksum for DSS") +Fixes: 390b95a5fb84 ("mptcp: receive checksum for DSS") +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/mptcp/options.c | 36 ++++++++++++++++++++++++------------ + net/mptcp/protocol.h | 2 +- + net/mptcp/subflow.c | 2 +- + 3 files changed, 26 insertions(+), 14 deletions(-) + +diff --git a/net/mptcp/options.c b/net/mptcp/options.c +index 645dd984fef0..9ac75689a99d 100644 +--- a/net/mptcp/options.c ++++ b/net/mptcp/options.c +@@ -107,7 +107,7 @@ static void mptcp_parse_option(const struct sk_buff *skb, + ptr += 2; + } + if (opsize == TCPOLEN_MPTCP_MPC_ACK_DATA_CSUM) { +- mp_opt->csum = (__force __sum16)get_unaligned_be16(ptr); ++ mp_opt->csum = get_unaligned((__force __sum16 *)ptr); + mp_opt->suboptions |= OPTION_MPTCP_CSUMREQD; + ptr += 2; + } +@@ -221,7 +221,7 @@ static void mptcp_parse_option(const struct sk_buff *skb, + + if (opsize == expected_opsize + TCPOLEN_MPTCP_DSS_CHECKSUM) { + mp_opt->suboptions |= OPTION_MPTCP_CSUMREQD; +- mp_opt->csum = (__force __sum16)get_unaligned_be16(ptr); ++ mp_opt->csum = get_unaligned((__force __sum16 *)ptr); + ptr += 2; + } + +@@ -1236,7 +1236,7 @@ static void mptcp_set_rwin(const struct tcp_sock *tp) + WRITE_ONCE(msk->rcv_wnd_sent, ack_seq); + } + +-u16 __mptcp_make_csum(u64 data_seq, u32 subflow_seq, u16 data_len, __wsum sum) ++__sum16 __mptcp_make_csum(u64 data_seq, u32 subflow_seq, u16 data_len, __wsum sum) + { + struct csum_pseudo_header header; + __wsum csum; +@@ -1252,15 +1252,25 @@ u16 __mptcp_make_csum(u64 data_seq, u32 subflow_seq, u16 data_len, __wsum sum) + header.csum = 0; + + csum = csum_partial(&header, sizeof(header), sum); +- return (__force u16)csum_fold(csum); ++ return csum_fold(csum); + } + +-static u16 mptcp_make_csum(const struct mptcp_ext *mpext) ++static __sum16 mptcp_make_csum(const struct mptcp_ext *mpext) + { + return __mptcp_make_csum(mpext->data_seq, mpext->subflow_seq, mpext->data_len, + ~csum_unfold(mpext->csum)); + } + ++static void put_len_csum(u16 len, __sum16 csum, void *data) ++{ ++ __sum16 *sumptr = data + 2; ++ __be16 *ptr = data; ++ ++ put_unaligned_be16(len, ptr); ++ ++ put_unaligned(csum, sumptr); ++} ++ + void mptcp_write_options(__be32 *ptr, const struct tcp_sock *tp, + struct mptcp_out_options *opts) + { +@@ -1328,8 +1338,9 @@ void mptcp_write_options(__be32 *ptr, const struct tcp_sock *tp, + put_unaligned_be32(mpext->subflow_seq, ptr); + ptr += 1; + if (opts->csum_reqd) { +- put_unaligned_be32(mpext->data_len << 16 | +- mptcp_make_csum(mpext), ptr); ++ put_len_csum(mpext->data_len, ++ mptcp_make_csum(mpext), ++ ptr); + } else { + put_unaligned_be32(mpext->data_len << 16 | + TCPOPT_NOP << 8 | TCPOPT_NOP, ptr); +@@ -1376,11 +1387,12 @@ void mptcp_write_options(__be32 *ptr, const struct tcp_sock *tp, + goto mp_capable_done; + + if (opts->csum_reqd) { +- put_unaligned_be32(opts->data_len << 16 | +- __mptcp_make_csum(opts->data_seq, +- opts->subflow_seq, +- opts->data_len, +- ~csum_unfold(opts->csum)), ptr); ++ put_len_csum(opts->data_len, ++ __mptcp_make_csum(opts->data_seq, ++ opts->subflow_seq, ++ opts->data_len, ++ ~csum_unfold(opts->csum)), ++ ptr); + } else { + put_unaligned_be32(opts->data_len << 16 | + TCPOPT_NOP << 8 | TCPOPT_NOP, ptr); +diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h +index a1c845eb47bd..aec767ee047a 100644 +--- a/net/mptcp/protocol.h ++++ b/net/mptcp/protocol.h +@@ -725,7 +725,7 @@ void mptcp_token_destroy(struct mptcp_sock *msk); + void mptcp_crypto_key_sha(u64 key, u32 *token, u64 *idsn); + + void mptcp_crypto_hmac_sha(u64 key1, u64 key2, u8 *msg, int len, void *hmac); +-u16 __mptcp_make_csum(u64 data_seq, u32 subflow_seq, u16 data_len, __wsum sum); ++__sum16 __mptcp_make_csum(u64 data_seq, u32 subflow_seq, u16 data_len, __wsum sum); + + void __init mptcp_pm_init(void); + void mptcp_pm_data_init(struct mptcp_sock *msk); +diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c +index 1d4d84efe8f5..651f01d13191 100644 +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -846,7 +846,7 @@ static enum mapping_status validate_data_csum(struct sock *ssk, struct sk_buff * + { + struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk); + u32 offset, seq, delta; +- u16 csum; ++ __sum16 csum; + int len; + + if (!csum_reqd) +-- +2.35.1 + diff --git a/queue-5.17/mptcp-fix-subflow-accounting-on-close.patch b/queue-5.17/mptcp-fix-subflow-accounting-on-close.patch new file mode 100644 index 00000000000..3077658e531 --- /dev/null +++ b/queue-5.17/mptcp-fix-subflow-accounting-on-close.patch @@ -0,0 +1,117 @@ +From 45cb208a5cd6f0e32e06789c20f0349c3aa5fc8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 16:26:41 -0700 +Subject: mptcp: fix subflow accounting on close + +From: Paolo Abeni + +[ Upstream commit 95d686517884a403412b000361cee2b08b2ed1e6 ] + +If the PM closes a fully established MPJ subflow or the subflow +creation errors out in it's early stage the subflows counter is +not bumped accordingly. + +This change adds the missing accounting, additionally taking care +of updating accordingly the 'accept_subflow' flag. + +Fixes: a88c9e496937 ("mptcp: do not block subflows creation on errors") +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mptcp/pm.c | 5 ++--- + net/mptcp/protocol.h | 14 ++++++++++++++ + net/mptcp/subflow.c | 12 +++++++++--- + 3 files changed, 25 insertions(+), 6 deletions(-) + +diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c +index 7bea318ac5f2..1eb83cbe8aae 100644 +--- a/net/mptcp/pm.c ++++ b/net/mptcp/pm.c +@@ -178,14 +178,13 @@ void mptcp_pm_subflow_check_next(struct mptcp_sock *msk, const struct sock *ssk, + struct mptcp_pm_data *pm = &msk->pm; + bool update_subflows; + +- update_subflows = (ssk->sk_state == TCP_CLOSE) && +- (subflow->request_join || subflow->mp_join); ++ update_subflows = subflow->request_join || subflow->mp_join; + if (!READ_ONCE(pm->work_pending) && !update_subflows) + return; + + spin_lock_bh(&pm->lock); + if (update_subflows) +- pm->subflows--; ++ __mptcp_pm_close_subflow(msk); + + /* Even if this subflow is not really established, tell the PM to try + * to pick the next ones, if possible. +diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h +index 85317ce38e3f..a1c845eb47bd 100644 +--- a/net/mptcp/protocol.h ++++ b/net/mptcp/protocol.h +@@ -835,6 +835,20 @@ unsigned int mptcp_pm_get_add_addr_accept_max(struct mptcp_sock *msk); + unsigned int mptcp_pm_get_subflows_max(struct mptcp_sock *msk); + unsigned int mptcp_pm_get_local_addr_max(struct mptcp_sock *msk); + ++/* called under PM lock */ ++static inline void __mptcp_pm_close_subflow(struct mptcp_sock *msk) ++{ ++ if (--msk->pm.subflows < mptcp_pm_get_subflows_max(msk)) ++ WRITE_ONCE(msk->pm.accept_subflow, true); ++} ++ ++static inline void mptcp_pm_close_subflow(struct mptcp_sock *msk) ++{ ++ spin_lock_bh(&msk->pm.lock); ++ __mptcp_pm_close_subflow(msk); ++ spin_unlock_bh(&msk->pm.lock); ++} ++ + void mptcp_sockopt_sync(struct mptcp_sock *msk, struct sock *ssk); + void mptcp_sockopt_sync_locked(struct mptcp_sock *msk, struct sock *ssk); + +diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c +index bea47a1180dc..1d4d84efe8f5 100644 +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -1380,20 +1380,20 @@ int __mptcp_subflow_connect(struct sock *sk, const struct mptcp_addr_info *loc, + struct sockaddr_storage addr; + int remote_id = remote->id; + int local_id = loc->id; ++ int err = -ENOTCONN; + struct socket *sf; + struct sock *ssk; + u32 remote_token; + int addrlen; + int ifindex; + u8 flags; +- int err; + + if (!mptcp_is_fully_established(sk)) +- return -ENOTCONN; ++ goto err_out; + + err = mptcp_subflow_create_socket(sk, &sf); + if (err) +- return err; ++ goto err_out; + + ssk = sf->sk; + subflow = mptcp_subflow_ctx(ssk); +@@ -1456,6 +1456,12 @@ int __mptcp_subflow_connect(struct sock *sk, const struct mptcp_addr_info *loc, + failed: + subflow->disposable = 1; + sock_release(sf); ++ ++err_out: ++ /* we account subflows before the creation, and this failures will not ++ * be caught by sk_state_change() ++ */ ++ mptcp_pm_close_subflow(msk); + return err; + } + +-- +2.35.1 + diff --git a/queue-5.17/mptcp-strict-local-address-id-selection.patch b/queue-5.17/mptcp-strict-local-address-id-selection.patch new file mode 100644 index 00000000000..12d3ada4de5 --- /dev/null +++ b/queue-5.17/mptcp-strict-local-address-id-selection.patch @@ -0,0 +1,224 @@ +From dd874ab95a2df6fce00831bf16a06ed827639f6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 12:44:37 -0800 +Subject: mptcp: strict local address ID selection + +From: Paolo Abeni + +[ Upstream commit 4cf86ae84c718333928fd2d43168a1e359a28329 ] + +The address ID selection for MPJ subflows created in response +to incoming ADD_ADDR option is currently unreliable: it happens +at MPJ socket creation time, when the local address could be +unknown. + +Additionally, if the no local endpoint is available for the local +address, a new dummy endpoint is created, confusing the user-land. + +This change refactor the code to move the address ID selection inside +the rebuild_header() helper, when the local address eventually +selected by the route lookup is finally known. If the address used +is not mapped by any endpoint - and thus can't be advertised/removed +pick the id 0 instead of allocate a new endpoint. + +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mptcp/pm_netlink.c | 13 -------- + net/mptcp/protocol.c | 3 ++ + net/mptcp/protocol.h | 3 +- + net/mptcp/subflow.c | 67 ++++++++++++++++++++++++++++++++++++------ + 4 files changed, 63 insertions(+), 23 deletions(-) + +diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c +index 4b5d795383cd..ec73bd4be0a8 100644 +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -83,16 +83,6 @@ static bool addresses_equal(const struct mptcp_addr_info *a, + return a->port == b->port; + } + +-static bool address_zero(const struct mptcp_addr_info *addr) +-{ +- struct mptcp_addr_info zero; +- +- memset(&zero, 0, sizeof(zero)); +- zero.family = addr->family; +- +- return addresses_equal(addr, &zero, true); +-} +- + static void local_address(const struct sock_common *skc, + struct mptcp_addr_info *addr) + { +@@ -1011,9 +1001,6 @@ int mptcp_pm_nl_get_local_id(struct mptcp_sock *msk, struct sock_common *skc) + if (addresses_equal(&msk_local, &skc_local, false)) + return 0; + +- if (address_zero(&skc_local)) +- return 0; +- + pernet = net_generic(sock_net((struct sock *)msk), pm_nl_pernet_id); + + rcu_read_lock(); +diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c +index 014c9d88f947..cb90941840b1 100644 +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -117,6 +117,9 @@ static int __mptcp_socket_create(struct mptcp_sock *msk) + list_add(&subflow->node, &msk->conn_list); + sock_hold(ssock->sk); + subflow->request_mptcp = 1; ++ ++ /* This is the first subflow, always with id 0 */ ++ subflow->local_id_valid = 1; + mptcp_sock_graft(msk->first, sk->sk_socket); + + return 0; +diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h +index aec767ee047a..e4413b3e50c2 100644 +--- a/net/mptcp/protocol.h ++++ b/net/mptcp/protocol.h +@@ -442,7 +442,8 @@ struct mptcp_subflow_context { + rx_eof : 1, + can_ack : 1, /* only after processing the remote a key */ + disposable : 1, /* ctx can be free at ulp release time */ +- stale : 1; /* unable to snd/rcv data, do not use for xmit */ ++ stale : 1, /* unable to snd/rcv data, do not use for xmit */ ++ local_id_valid : 1; /* local_id is correctly initialized */ + enum mptcp_data_avail data_avail; + u32 remote_nonce; + u64 thmac; +diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c +index 651f01d13191..e27574e9f969 100644 +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -483,6 +483,51 @@ static void subflow_finish_connect(struct sock *sk, const struct sk_buff *skb) + mptcp_subflow_reset(sk); + } + ++static void subflow_set_local_id(struct mptcp_subflow_context *subflow, int local_id) ++{ ++ subflow->local_id = local_id; ++ subflow->local_id_valid = 1; ++} ++ ++static int subflow_chk_local_id(struct sock *sk) ++{ ++ struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk); ++ struct mptcp_sock *msk = mptcp_sk(subflow->conn); ++ int err; ++ ++ if (likely(subflow->local_id_valid)) ++ return 0; ++ ++ err = mptcp_pm_get_local_id(msk, (struct sock_common *)sk); ++ if (err < 0) ++ return err; ++ ++ subflow_set_local_id(subflow, err); ++ return 0; ++} ++ ++static int subflow_rebuild_header(struct sock *sk) ++{ ++ int err = subflow_chk_local_id(sk); ++ ++ if (unlikely(err < 0)) ++ return err; ++ ++ return inet_sk_rebuild_header(sk); ++} ++ ++#if IS_ENABLED(CONFIG_MPTCP_IPV6) ++static int subflow_v6_rebuild_header(struct sock *sk) ++{ ++ int err = subflow_chk_local_id(sk); ++ ++ if (unlikely(err < 0)) ++ return err; ++ ++ return inet6_sk_rebuild_header(sk); ++} ++#endif ++ + struct request_sock_ops mptcp_subflow_request_sock_ops; + EXPORT_SYMBOL_GPL(mptcp_subflow_request_sock_ops); + static struct tcp_request_sock_ops subflow_request_sock_ipv4_ops; +@@ -1401,13 +1446,8 @@ int __mptcp_subflow_connect(struct sock *sk, const struct mptcp_addr_info *loc, + get_random_bytes(&subflow->local_nonce, sizeof(u32)); + } while (!subflow->local_nonce); + +- if (!local_id) { +- err = mptcp_pm_get_local_id(msk, (struct sock_common *)ssk); +- if (err < 0) +- goto failed; +- +- local_id = err; +- } ++ if (local_id) ++ subflow_set_local_id(subflow, local_id); + + mptcp_pm_get_flags_and_ifindex_by_id(sock_net(sk), local_id, + &flags, &ifindex); +@@ -1432,7 +1472,6 @@ int __mptcp_subflow_connect(struct sock *sk, const struct mptcp_addr_info *loc, + pr_debug("msk=%p remote_token=%u local_id=%d remote_id=%d", msk, + remote_token, local_id, remote_id); + subflow->remote_token = remote_token; +- subflow->local_id = local_id; + subflow->remote_id = remote_id; + subflow->request_join = 1; + subflow->request_bkup = !!(flags & MPTCP_PM_ADDR_FLAG_BACKUP); +@@ -1737,15 +1776,22 @@ static void subflow_ulp_clone(const struct request_sock *req, + new_ctx->token = subflow_req->token; + new_ctx->ssn_offset = subflow_req->ssn_offset; + new_ctx->idsn = subflow_req->idsn; ++ ++ /* this is the first subflow, id is always 0 */ ++ new_ctx->local_id_valid = 1; + } else if (subflow_req->mp_join) { + new_ctx->ssn_offset = subflow_req->ssn_offset; + new_ctx->mp_join = 1; + new_ctx->fully_established = 1; + new_ctx->backup = subflow_req->backup; +- new_ctx->local_id = subflow_req->local_id; + new_ctx->remote_id = subflow_req->remote_id; + new_ctx->token = subflow_req->token; + new_ctx->thmac = subflow_req->thmac; ++ ++ /* the subflow req id is valid, fetched via subflow_check_req() ++ * and subflow_token_join_request() ++ */ ++ subflow_set_local_id(new_ctx, subflow_req->local_id); + } + } + +@@ -1798,6 +1844,7 @@ void __init mptcp_subflow_init(void) + subflow_specific.conn_request = subflow_v4_conn_request; + subflow_specific.syn_recv_sock = subflow_syn_recv_sock; + subflow_specific.sk_rx_dst_set = subflow_finish_connect; ++ subflow_specific.rebuild_header = subflow_rebuild_header; + + tcp_prot_override = tcp_prot; + tcp_prot_override.release_cb = tcp_release_cb_override; +@@ -1810,6 +1857,7 @@ void __init mptcp_subflow_init(void) + subflow_v6_specific.conn_request = subflow_v6_conn_request; + subflow_v6_specific.syn_recv_sock = subflow_syn_recv_sock; + subflow_v6_specific.sk_rx_dst_set = subflow_finish_connect; ++ subflow_v6_specific.rebuild_header = subflow_v6_rebuild_header; + + subflow_v6m_specific = subflow_v6_specific; + subflow_v6m_specific.queue_xmit = ipv4_specific.queue_xmit; +@@ -1817,6 +1865,7 @@ void __init mptcp_subflow_init(void) + subflow_v6m_specific.net_header_len = ipv4_specific.net_header_len; + subflow_v6m_specific.mtu_reduced = ipv4_specific.mtu_reduced; + subflow_v6m_specific.net_frag_header_len = 0; ++ subflow_v6m_specific.rebuild_header = subflow_rebuild_header; + + tcpv6_prot_override = tcpv6_prot; + tcpv6_prot_override.release_cb = tcp_release_cb_override; +-- +2.35.1 + diff --git a/queue-5.17/net-af_key-add-check-for-pfkey_broadcast-in-function.patch b/queue-5.17/net-af_key-add-check-for-pfkey_broadcast-in-function.patch new file mode 100644 index 00000000000..7c92f7cd250 --- /dev/null +++ b/queue-5.17/net-af_key-add-check-for-pfkey_broadcast-in-function.patch @@ -0,0 +1,42 @@ +From 4bb9576383ad1ee46094b25f016c58ddf735f223 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 May 2022 17:42:31 +0800 +Subject: net: af_key: add check for pfkey_broadcast in function pfkey_process + +From: Jiasheng Jiang + +[ Upstream commit 4dc2a5a8f6754492180741facf2a8787f2c415d7 ] + +If skb_clone() returns null pointer, pfkey_broadcast() will +return error. +Therefore, it should be better to check the return value of +pfkey_broadcast() and return error if fails. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/key/af_key.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/key/af_key.c b/net/key/af_key.c +index fd51db3be91c..92e9d75dba2f 100644 +--- a/net/key/af_key.c ++++ b/net/key/af_key.c +@@ -2826,8 +2826,10 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb + void *ext_hdrs[SADB_EXT_MAX]; + int err; + +- pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, +- BROADCAST_PROMISC_ONLY, NULL, sock_net(sk)); ++ err = pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, ++ BROADCAST_PROMISC_ONLY, NULL, sock_net(sk)); ++ if (err) ++ return err; + + memset(ext_hdrs, 0, sizeof(ext_hdrs)); + err = parse_exthdrs(skb, hdr, ext_hdrs); +-- +2.35.1 + diff --git a/queue-5.17/net-atlantic-add-check-for-max_skb_frags.patch b/queue-5.17/net-atlantic-add-check-for-max_skb_frags.patch new file mode 100644 index 00000000000..bb88fe16260 --- /dev/null +++ b/queue-5.17/net-atlantic-add-check-for-max_skb_frags.patch @@ -0,0 +1,55 @@ +From f8253e9358afd00b506c956882d073a007c949ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 May 2022 19:28:25 -0700 +Subject: net: atlantic: add check for MAX_SKB_FRAGS + +From: Grant Grundler + +[ Upstream commit 6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f ] + +Enforce that the CPU can not get stuck in an infinite loop. + +Reported-by: Aashay Shringarpure +Reported-by: Yi Chou +Reported-by: Shervin Oloumi +Signed-off-by: Grant Grundler +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +index bc1952131799..8201ce7adb77 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +@@ -363,6 +363,7 @@ int aq_ring_rx_clean(struct aq_ring_s *self, + continue; + + if (!buff->is_eop) { ++ unsigned int frag_cnt = 0U; + buff_ = buff; + do { + bool is_rsc_completed = true; +@@ -371,6 +372,8 @@ int aq_ring_rx_clean(struct aq_ring_s *self, + err = -EIO; + goto err_exit; + } ++ ++ frag_cnt++; + next_ = buff_->next, + buff_ = &self->buff_ring[next_]; + is_rsc_completed = +@@ -378,7 +381,8 @@ int aq_ring_rx_clean(struct aq_ring_s *self, + next_, + self->hw_head); + +- if (unlikely(!is_rsc_completed)) { ++ if (unlikely(!is_rsc_completed) || ++ frag_cnt > MAX_SKB_FRAGS) { + err = 0; + goto err_exit; + } +-- +2.35.1 + diff --git a/queue-5.17/net-atlantic-fix-frag-0-not-initialized.patch b/queue-5.17/net-atlantic-fix-frag-0-not-initialized.patch new file mode 100644 index 00000000000..36f390de14e --- /dev/null +++ b/queue-5.17/net-atlantic-fix-frag-0-not-initialized.patch @@ -0,0 +1,53 @@ +From b0475af0b123b7aec80cc671cb12cdedeec15b02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 May 2022 19:28:23 -0700 +Subject: net: atlantic: fix "frag[0] not initialized" + +From: Grant Grundler + +[ Upstream commit 62e0ae0f4020250f961cf8d0103a4621be74e077 ] + +In aq_ring_rx_clean(), if buff->is_eop is not set AND +buff->len < AQ_CFG_RX_HDR_SIZE, then hdr_len remains equal to +buff->len and skb_add_rx_frag(xxx, *0*, ...) is not called. + +The loop following this code starts calling skb_add_rx_frag() starting +with i=1 and thus frag[0] is never initialized. Since i is initialized +to zero at the top of the primary loop, we can just reference and +post-increment i instead of hardcoding the 0 when calling +skb_add_rx_frag() the first time. + +Reported-by: Aashay Shringarpure +Reported-by: Yi Chou +Reported-by: Shervin Oloumi +Signed-off-by: Grant Grundler +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +index 77e76c9efd32..440423b0e8ea 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +@@ -446,7 +446,7 @@ int aq_ring_rx_clean(struct aq_ring_s *self, + ALIGN(hdr_len, sizeof(long))); + + if (buff->len - hdr_len > 0) { +- skb_add_rx_frag(skb, 0, buff->rxdata.page, ++ skb_add_rx_frag(skb, i++, buff->rxdata.page, + buff->rxdata.pg_off + hdr_len, + buff->len - hdr_len, + AQ_CFG_RX_FRAME_MAX); +@@ -455,7 +455,6 @@ int aq_ring_rx_clean(struct aq_ring_s *self, + + if (!buff->is_eop) { + buff_ = buff; +- i = 1U; + do { + next_ = buff_->next; + buff_ = &self->buff_ring[next_]; +-- +2.35.1 + diff --git a/queue-5.17/net-atlantic-reduce-scope-of-is_rsc_complete.patch b/queue-5.17/net-atlantic-reduce-scope-of-is_rsc_complete.patch new file mode 100644 index 00000000000..49a0a38f88e --- /dev/null +++ b/queue-5.17/net-atlantic-reduce-scope-of-is_rsc_complete.patch @@ -0,0 +1,68 @@ +From 26c2988c1a8aa774ffed68964aa189d093dafdb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 May 2022 19:28:24 -0700 +Subject: net: atlantic: reduce scope of is_rsc_complete + +From: Grant Grundler + +[ Upstream commit 79784d77ebbd3ec516b7a5ce555d979fb7946202 ] + +Don't defer handling the err case outside the loop. That's pointless. + +And since is_rsc_complete is only used inside this loop, declare +it inside the loop to reduce it's scope. + +Signed-off-by: Grant Grundler +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +index 440423b0e8ea..bc1952131799 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +@@ -346,7 +346,6 @@ int aq_ring_rx_clean(struct aq_ring_s *self, + int budget) + { + struct net_device *ndev = aq_nic_get_ndev(self->aq_nic); +- bool is_rsc_completed = true; + int err = 0; + + for (; (self->sw_head != self->hw_head) && budget; +@@ -366,6 +365,8 @@ int aq_ring_rx_clean(struct aq_ring_s *self, + if (!buff->is_eop) { + buff_ = buff; + do { ++ bool is_rsc_completed = true; ++ + if (buff_->next >= self->size) { + err = -EIO; + goto err_exit; +@@ -377,18 +378,16 @@ int aq_ring_rx_clean(struct aq_ring_s *self, + next_, + self->hw_head); + +- if (unlikely(!is_rsc_completed)) +- break; ++ if (unlikely(!is_rsc_completed)) { ++ err = 0; ++ goto err_exit; ++ } + + buff->is_error |= buff_->is_error; + buff->is_cso_err |= buff_->is_cso_err; + + } while (!buff_->is_eop); + +- if (!is_rsc_completed) { +- err = 0; +- goto err_exit; +- } + if (buff->is_error || + (buff->is_lro && buff->is_cso_err)) { + buff_ = buff; +-- +2.35.1 + diff --git a/queue-5.17/net-atlantic-verify-hw_head_-lies-within-tx-buffer-r.patch b/queue-5.17/net-atlantic-verify-hw_head_-lies-within-tx-buffer-r.patch new file mode 100644 index 00000000000..339e6dc838e --- /dev/null +++ b/queue-5.17/net-atlantic-verify-hw_head_-lies-within-tx-buffer-r.patch @@ -0,0 +1,43 @@ +From b20077c1b4ac38dcd05896fc988b980c73225e1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 May 2022 19:28:26 -0700 +Subject: net: atlantic: verify hw_head_ lies within TX buffer ring + +From: Grant Grundler + +[ Upstream commit 2120b7f4d128433ad8c5f503a9584deba0684901 ] + +Bounds check hw_head index provided by NIC to verify it lies +within the TX buffer ring. + +Reported-by: Aashay Shringarpure +Reported-by: Yi Chou +Reported-by: Shervin Oloumi +Signed-off-by: Grant Grundler +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +index d875ce3ec759..15ede7285fb5 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +@@ -889,6 +889,13 @@ int hw_atl_b0_hw_ring_tx_head_update(struct aq_hw_s *self, + err = -ENXIO; + goto err_exit; + } ++ ++ /* Validate that the new hw_head_ is reasonable. */ ++ if (hw_head_ >= ring->size) { ++ err = -ENXIO; ++ goto err_exit; ++ } ++ + ring->hw_head = hw_head_; + err = aq_hw_err_from_flags(self); + +-- +2.35.1 + diff --git a/queue-5.17/net-bridge-clear-offload_fwd_mark-when-passing-frame.patch b/queue-5.17/net-bridge-clear-offload_fwd_mark-when-passing-frame.patch new file mode 100644 index 00000000000..26f64efbc46 --- /dev/null +++ b/queue-5.17/net-bridge-clear-offload_fwd_mark-when-passing-frame.patch @@ -0,0 +1,72 @@ +From b7612f970fa2ea34e1537c0e375e207f40cfdef6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 02:58:40 +0200 +Subject: net: bridge: Clear offload_fwd_mark when passing frame up bridge + interface. + +From: Andrew Lunn + +[ Upstream commit fbb3abdf2223cd0dfc07de85fe5a43ba7f435bdf ] + +It is possible to stack bridges on top of each other. Consider the +following which makes use of an Ethernet switch: + + br1 + / \ + / \ + / \ + br0.11 wlan0 + | + br0 + / | \ +p1 p2 p3 + +br0 is offloaded to the switch. Above br0 is a vlan interface, for +vlan 11. This vlan interface is then a slave of br1. br1 also has a +wireless interface as a slave. This setup trunks wireless lan traffic +over the copper network inside a VLAN. + +A frame received on p1 which is passed up to the bridge has the +skb->offload_fwd_mark flag set to true, indicating that the switch has +dealt with forwarding the frame out ports p2 and p3 as needed. This +flag instructs the software bridge it does not need to pass the frame +back down again. However, the flag is not getting reset when the frame +is passed upwards. As a result br1 sees the flag, wrongly interprets +it, and fails to forward the frame to wlan0. + +When passing a frame upwards, clear the flag. This is the Rx +equivalent of br_switchdev_frame_unmark() in br_dev_xmit(). + +Fixes: f1c2eddf4cb6 ("bridge: switchdev: Use an helper to clear forward mark") +Signed-off-by: Andrew Lunn +Reviewed-by: Ido Schimmel +Tested-by: Ido Schimmel +Acked-by: Nikolay Aleksandrov +Link: https://lore.kernel.org/r/20220518005840.771575-1-andrew@lunn.ch +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/bridge/br_input.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c +index b50382f957c1..6743c8a0fe8e 100644 +--- a/net/bridge/br_input.c ++++ b/net/bridge/br_input.c +@@ -39,6 +39,13 @@ static int br_pass_frame_up(struct sk_buff *skb) + dev_sw_netstats_rx_add(brdev, skb->len); + + vg = br_vlan_group_rcu(br); ++ ++ /* Reset the offload_fwd_mark because there could be a stacked ++ * bridge above, and it should not think this bridge it doing ++ * that bridge's work forwarding out its ports. ++ */ ++ br_switchdev_frame_unmark(skb); ++ + /* Bridge is just like any other port. Make sure the + * packet is allowed except in promisc mode when someone + * may be running packet capture. +-- +2.35.1 + diff --git a/queue-5.17/net-fix-dev_fill_forward_path-with-pppoe-bridge.patch b/queue-5.17/net-fix-dev_fill_forward_path-with-pppoe-bridge.patch new file mode 100644 index 00000000000..9b4769026d7 --- /dev/null +++ b/queue-5.17/net-fix-dev_fill_forward_path-with-pppoe-bridge.patch @@ -0,0 +1,69 @@ +From 74418e577755a8e710b5609b49222cfd6f31da4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 May 2022 14:26:15 +0200 +Subject: net: fix dev_fill_forward_path with pppoe + bridge + +From: Felix Fietkau + +[ Upstream commit cf2df74e202d81b09f09d84c2d8903e0e87e9274 ] + +When calling dev_fill_forward_path on a pppoe device, the provided destination +address is invalid. In order for the bridge fdb lookup to succeed, the pppoe +code needs to update ctx->daddr to the correct value. +Fix this by storing the address inside struct net_device_path_ctx + +Fixes: f6efc675c9dd ("net: ppp: resolve forwarding path for bridge pppoe devices") +Signed-off-by: Felix Fietkau +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + drivers/net/ppp/pppoe.c | 1 + + include/linux/netdevice.h | 2 +- + net/core/dev.c | 2 +- + 3 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c +index 3619520340b7..e172743948ed 100644 +--- a/drivers/net/ppp/pppoe.c ++++ b/drivers/net/ppp/pppoe.c +@@ -988,6 +988,7 @@ static int pppoe_fill_forward_path(struct net_device_path_ctx *ctx, + path->encap.proto = htons(ETH_P_PPP_SES); + path->encap.id = be16_to_cpu(po->num); + memcpy(path->encap.h_dest, po->pppoe_pa.remote, ETH_ALEN); ++ memcpy(ctx->daddr, po->pppoe_pa.remote, ETH_ALEN); + path->dev = ctx->dev; + ctx->dev = dev; + +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index f53ea7038441..dadd4d2f6d8a 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -891,7 +891,7 @@ struct net_device_path_stack { + + struct net_device_path_ctx { + const struct net_device *dev; +- const u8 *daddr; ++ u8 daddr[ETH_ALEN]; + + int num_vlans; + struct { +diff --git a/net/core/dev.c b/net/core/dev.c +index 91cf709c98b3..5f1ac4812277 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -663,11 +663,11 @@ int dev_fill_forward_path(const struct net_device *dev, const u8 *daddr, + const struct net_device *last_dev; + struct net_device_path_ctx ctx = { + .dev = dev, +- .daddr = daddr, + }; + struct net_device_path *path; + int ret = 0; + ++ memcpy(ctx.daddr, daddr, sizeof(ctx.daddr)); + stack->num_paths = 0; + while (ctx.dev && ctx.dev->netdev_ops->ndo_fill_forward_path) { + last_dev = ctx.dev; +-- +2.35.1 + diff --git a/queue-5.17/net-fix-wrong-network-header-length.patch b/queue-5.17/net-fix-wrong-network-header-length.patch new file mode 100644 index 00000000000..89b4bcd67df --- /dev/null +++ b/queue-5.17/net-fix-wrong-network-header-length.patch @@ -0,0 +1,71 @@ +From f054b20cd89fcc8876a786b8567f6e21078070d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 May 2022 13:48:49 +0800 +Subject: net: fix wrong network header length + +From: Lina Wang + +[ Upstream commit cf3ab8d4a797960b4be20565abb3bcd227b18a68 ] + +When clatd starts with ebpf offloaing, and NETIF_F_GRO_FRAGLIST is enable, +several skbs are gathered in skb_shinfo(skb)->frag_list. The first skb's +ipv6 header will be changed to ipv4 after bpf_skb_proto_6_to_4, +network_header\transport_header\mac_header have been updated as ipv4 acts, +but other skbs in frag_list didnot update anything, just ipv6 packets. + +udp_queue_rcv_skb will call skb_segment_list to traverse other skbs in +frag_list and make sure right udp payload is delivered to user space. +Unfortunately, other skbs in frag_list who are still ipv6 packets are +updated like the first skb and will have wrong transport header length. + +e.g.before bpf_skb_proto_6_to_4,the first skb and other skbs in frag_list +has the same network_header(24)& transport_header(64), after +bpf_skb_proto_6_to_4, ipv6 protocol has been changed to ipv4, the first +skb's network_header is 44,transport_header is 64, other skbs in frag_list +didnot change.After skb_segment_list, the other skbs in frag_list has +different network_header(24) and transport_header(44), so there will be 20 +bytes different from original,that is difference between ipv6 header and +ipv4 header. Just change transport_header to be the same with original. + +Actually, there are two solutions to fix it, one is traversing all skbs +and changing every skb header in bpf_skb_proto_6_to_4, the other is +modifying frag_list skb's header in skb_segment_list. Considering +efficiency, adopt the second one--- when the first skb and other skbs in +frag_list has different network_header length, restore them to make sure +right udp payload is delivered to user space. + +Signed-off-by: Lina Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/skbuff.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 180fa6a26ad4..708cc9b1b176 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -3896,7 +3896,7 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb, + unsigned int delta_len = 0; + struct sk_buff *tail = NULL; + struct sk_buff *nskb, *tmp; +- int err; ++ int len_diff, err; + + skb_push(skb, -skb_network_offset(skb) + offset); + +@@ -3936,9 +3936,11 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb, + skb_push(nskb, -skb_network_offset(nskb) + offset); + + skb_release_head_state(nskb); ++ len_diff = skb_network_header_len(nskb) - skb_network_header_len(skb); + __copy_skb_header(nskb, skb); + + skb_headers_offset_update(nskb, skb_headroom(nskb) - skb_headroom(skb)); ++ nskb->transport_header += len_diff; + skb_copy_from_linear_data_offset(skb, -tnl_hlen, + nskb->data - tnl_hlen, + offset + tnl_hlen); +-- +2.35.1 + diff --git a/queue-5.17/net-ipa-certain-dropped-packets-aren-t-accounted-for.patch b/queue-5.17/net-ipa-certain-dropped-packets-aren-t-accounted-for.patch new file mode 100644 index 00000000000..49752fc4c78 --- /dev/null +++ b/queue-5.17/net-ipa-certain-dropped-packets-aren-t-accounted-for.patch @@ -0,0 +1,56 @@ +From 7feaa42b0b802e9f0b50eb77ae0bab95559a2b57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 10:10:31 -0500 +Subject: net: ipa: certain dropped packets aren't accounted for + +From: Alex Elder + +[ Upstream commit 30b338ff7998b6ed7a90815870cd5db725f87168 ] + +If an RX endpoint receives packets containing status headers, and a +packet in the buffer is not dropped, ipa_endpoint_skb_copy() is +responsible for wrapping the packet data in an SKB and forwarding it +to ipa_modem_skb_rx() for further processing. + +If ipa_endpoint_skb_copy() gets a null pointer from build_skb(), it +just returns early. But in the process it doesn't record that as a +dropped packet in the network device statistics. + +Instead, call ipa_modem_skb_rx() whether or not the SKB pointer is +NULL; that function ensures the statistics are properly updated. + +Fixes: 1b65bbcc9a710 ("net: ipa: skip SKB copy if no netdev") +Signed-off-by: Alex Elder +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ipa/ipa_endpoint.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ipa/ipa_endpoint.c b/drivers/net/ipa/ipa_endpoint.c +index 68291a3efd04..2ecfc17544a6 100644 +--- a/drivers/net/ipa/ipa_endpoint.c ++++ b/drivers/net/ipa/ipa_endpoint.c +@@ -1169,13 +1169,12 @@ static void ipa_endpoint_skb_copy(struct ipa_endpoint *endpoint, + return; + + skb = __dev_alloc_skb(len, GFP_ATOMIC); +- if (!skb) +- return; +- +- /* Copy the data into the socket buffer and receive it */ +- skb_put(skb, len); +- memcpy(skb->data, data, len); +- skb->truesize += extra; ++ if (skb) { ++ /* Copy the data into the socket buffer and receive it */ ++ skb_put(skb, len); ++ memcpy(skb->data, data, len); ++ skb->truesize += extra; ++ } + + ipa_modem_skb_rx(endpoint->netdev, skb); + } +-- +2.35.1 + diff --git a/queue-5.17/net-ipa-record-proper-rx-transaction-count.patch b/queue-5.17/net-ipa-record-proper-rx-transaction-count.patch new file mode 100644 index 00000000000..1faa6a5119a --- /dev/null +++ b/queue-5.17/net-ipa-record-proper-rx-transaction-count.patch @@ -0,0 +1,61 @@ +From c8235b53fc4275203fed3fd21879d904f70650bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 10:10:32 -0500 +Subject: net: ipa: record proper RX transaction count + +From: Alex Elder + +[ Upstream commit d8290cbe1111105f92f0c8ab455bec8bf98d0630 ] + +Each time we are notified that some number of transactions on an RX +channel has completed, we record the number of bytes that have been +transferred since the previous notification. We also track the +number of transactions completed, but that is not currently being +calculated correctly; we're currently counting the number of such +notifications, but each notification can represent many transaction +completions. Fix this. + +Fixes: 650d1603825d8 ("soc: qcom: ipa: the generic software interface") +Signed-off-by: Alex Elder +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ipa/gsi.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ipa/gsi.c b/drivers/net/ipa/gsi.c +index bc981043cc80..a701178a1d13 100644 +--- a/drivers/net/ipa/gsi.c ++++ b/drivers/net/ipa/gsi.c +@@ -1367,9 +1367,10 @@ static void gsi_evt_ring_rx_update(struct gsi_evt_ring *evt_ring, u32 index) + struct gsi_event *event_done; + struct gsi_event *event; + struct gsi_trans *trans; ++ u32 trans_count = 0; + u32 byte_count = 0; +- u32 old_index; + u32 event_avail; ++ u32 old_index; + + trans_info = &channel->trans_info; + +@@ -1390,6 +1391,7 @@ static void gsi_evt_ring_rx_update(struct gsi_evt_ring *evt_ring, u32 index) + do { + trans->len = __le16_to_cpu(event->len); + byte_count += trans->len; ++ trans_count++; + + /* Move on to the next event and transaction */ + if (--event_avail) +@@ -1401,7 +1403,7 @@ static void gsi_evt_ring_rx_update(struct gsi_evt_ring *evt_ring, u32 index) + + /* We record RX bytes when they are received */ + channel->byte_count += byte_count; +- channel->trans_count++; ++ channel->trans_count += trans_count; + } + + /* Initialize a ring, including allocating DMA memory for its entries */ +-- +2.35.1 + diff --git a/queue-5.17/net-lan966x-fix-assignment-of-the-mac-address.patch b/queue-5.17/net-lan966x-fix-assignment-of-the-mac-address.patch new file mode 100644 index 00000000000..4a5073c9aee --- /dev/null +++ b/queue-5.17/net-lan966x-fix-assignment-of-the-mac-address.patch @@ -0,0 +1,90 @@ +From 23ddbd55c2bd2ea8e4dce92db9f6ad661debf92a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 May 2022 20:00:30 +0200 +Subject: net: lan966x: Fix assignment of the MAC address + +From: Horatiu Vultur + +[ Upstream commit af8ca6eaa9b24a90484218e356f959a94bff22fa ] + +The following two scenarios were failing for lan966x. +1. If the port had the address X and then trying to assign the same + address, then the HW was just removing this address because first it + tries to learn new address and then delete the old one. As they are + the same the HW remove it. +2. If the port eth0 was assigned the same address as one of the other + ports eth1 then when assigning back the address to eth0 then the HW + was deleting the address of eth1. + +The case 1. is fixed by checking if the port has already the same +address while case 2. is fixed by checking if the address is used by any +other port. + +Fixes: e18aba8941b40b ("net: lan966x: add mactable support") +Signed-off-by: Horatiu Vultur +Link: https://lore.kernel.org/r/20220513180030.3076793-1-horatiu.vultur@microchip.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../ethernet/microchip/lan966x/lan966x_main.c | 28 +++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_main.c b/drivers/net/ethernet/microchip/lan966x/lan966x_main.c +index 1f60fd125a1d..fee148bbf13e 100644 +--- a/drivers/net/ethernet/microchip/lan966x/lan966x_main.c ++++ b/drivers/net/ethernet/microchip/lan966x/lan966x_main.c +@@ -100,6 +100,24 @@ static int lan966x_create_targets(struct platform_device *pdev, + return 0; + } + ++static bool lan966x_port_unique_address(struct net_device *dev) ++{ ++ struct lan966x_port *port = netdev_priv(dev); ++ struct lan966x *lan966x = port->lan966x; ++ int p; ++ ++ for (p = 0; p < lan966x->num_phys_ports; ++p) { ++ port = lan966x->ports[p]; ++ if (!port || port->dev == dev) ++ continue; ++ ++ if (ether_addr_equal(dev->dev_addr, port->dev->dev_addr)) ++ return false; ++ } ++ ++ return true; ++} ++ + static int lan966x_port_set_mac_address(struct net_device *dev, void *p) + { + struct lan966x_port *port = netdev_priv(dev); +@@ -107,16 +125,26 @@ static int lan966x_port_set_mac_address(struct net_device *dev, void *p) + const struct sockaddr *addr = p; + int ret; + ++ if (ether_addr_equal(addr->sa_data, dev->dev_addr)) ++ return 0; ++ + /* Learn the new net device MAC address in the mac table. */ + ret = lan966x_mac_cpu_learn(lan966x, addr->sa_data, HOST_PVID); + if (ret) + return ret; + ++ /* If there is another port with the same address as the dev, then don't ++ * delete it from the MAC table ++ */ ++ if (!lan966x_port_unique_address(dev)) ++ goto out; ++ + /* Then forget the previous one. */ + ret = lan966x_mac_cpu_forget(lan966x, dev->dev_addr, HOST_PVID); + if (ret) + return ret; + ++out: + eth_hw_addr_set(dev, addr->sa_data); + return ret; + } +-- +2.35.1 + diff --git a/queue-5.17/net-macb-increment-rx-bd-head-after-allocating-skb-a.patch b/queue-5.17/net-macb-increment-rx-bd-head-after-allocating-skb-a.patch new file mode 100644 index 00000000000..7bf2fb2dc62 --- /dev/null +++ b/queue-5.17/net-macb-increment-rx-bd-head-after-allocating-skb-a.patch @@ -0,0 +1,53 @@ +From 5d75c47d7a8d39457c7a9046ed17eaefb8b676c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 22:49:00 +0530 +Subject: net: macb: Increment rx bd head after allocating skb and buffer + +From: Harini Katakam + +[ Upstream commit 9500acc631dbb8b73166e25700e656b11f6007b6 ] + +In gem_rx_refill rx_prepared_head is incremented at the beginning of +the while loop preparing the skb and data buffers. If the skb or data +buffer allocation fails, this BD will be unusable BDs until the head +loops back to the same BD (and obviously buffer allocation succeeds). +In the unlikely event that there's a string of allocation failures, +there will be an equal number of unusable BDs and an inconsistent RX +BD chain. Hence increment the head at the end of the while loop to be +clean. + +Fixes: 4df95131ea80 ("net/macb: change RX path for GEM") +Signed-off-by: Harini Katakam +Signed-off-by: Michal Simek +Signed-off-by: Radhey Shyam Pandey +Reviewed-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20220512171900.32593-1-harini.katakam@xilinx.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cadence/macb_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index c4f4b13ac469..c1100af5666b 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -1217,7 +1217,6 @@ static void gem_rx_refill(struct macb_queue *queue) + /* Make hw descriptor updates visible to CPU */ + rmb(); + +- queue->rx_prepared_head++; + desc = macb_rx_desc(queue, entry); + + if (!queue->rx_skbuff[entry]) { +@@ -1256,6 +1255,7 @@ static void gem_rx_refill(struct macb_queue *queue) + dma_wmb(); + desc->addr &= ~MACB_BIT(RX_USED); + } ++ queue->rx_prepared_head++; + } + + /* Make descriptor updates visible to hardware */ +-- +2.35.1 + diff --git a/queue-5.17/net-mlx5-dr-fix-missing-flow_source-when-creating-mu.patch b/queue-5.17/net-mlx5-dr-fix-missing-flow_source-when-creating-mu.patch new file mode 100644 index 00000000000..75603b311aa --- /dev/null +++ b/queue-5.17/net-mlx5-dr-fix-missing-flow_source-when-creating-mu.patch @@ -0,0 +1,130 @@ +From 5a73835859bf34f79392b7753dd4e5d9f328e3fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Mar 2022 10:07:44 +0200 +Subject: net/mlx5: DR, Fix missing flow_source when creating multi-destination + FW table + +From: Maor Dickman + +[ Upstream commit 2c5fc6cd269ad3476da99dad02521d2af4a8e906 ] + +In order to support multiple destination FTEs with SW steering +FW table is created with single FTE with multiple actions and +SW steering rule forward to it. When creating this table, flow +source isn't set according to the original FTE. + +Fix this by passing the original FTE flow source to the created +FW table. + +Fixes: 34583beea4b7 ("net/mlx5: DR, Create multi-destination table for SW-steering use") +Signed-off-by: Maor Dickman +Reviewed-by: Yevgeny Kliteynik +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/steering/dr_action.c | 6 ++++-- + drivers/net/ethernet/mellanox/mlx5/core/steering/dr_fw.c | 4 +++- + drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h | 3 ++- + drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c | 4 +++- + drivers/net/ethernet/mellanox/mlx5/core/steering/mlx5dr.h | 3 ++- + 5 files changed, 14 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c +index c61a5e83c78c..5d1caf97a8fc 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c +@@ -847,7 +847,8 @@ struct mlx5dr_action * + mlx5dr_action_create_mult_dest_tbl(struct mlx5dr_domain *dmn, + struct mlx5dr_action_dest *dests, + u32 num_of_dests, +- bool ignore_flow_level) ++ bool ignore_flow_level, ++ u32 flow_source) + { + struct mlx5dr_cmd_flow_destination_hw_info *hw_dests; + struct mlx5dr_action **ref_actions; +@@ -919,7 +920,8 @@ mlx5dr_action_create_mult_dest_tbl(struct mlx5dr_domain *dmn, + reformat_req, + &action->dest_tbl->fw_tbl.id, + &action->dest_tbl->fw_tbl.group_id, +- ignore_flow_level); ++ ignore_flow_level, ++ flow_source); + if (ret) + goto free_action; + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_fw.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_fw.c +index 68a4c32d5f34..f05ef0cd54ba 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_fw.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_fw.c +@@ -104,7 +104,8 @@ int mlx5dr_fw_create_md_tbl(struct mlx5dr_domain *dmn, + bool reformat_req, + u32 *tbl_id, + u32 *group_id, +- bool ignore_flow_level) ++ bool ignore_flow_level, ++ u32 flow_source) + { + struct mlx5dr_cmd_create_flow_table_attr ft_attr = {}; + struct mlx5dr_cmd_fte_info fte_info = {}; +@@ -139,6 +140,7 @@ int mlx5dr_fw_create_md_tbl(struct mlx5dr_domain *dmn, + fte_info.val = val; + fte_info.dest_arr = dest; + fte_info.ignore_flow_level = ignore_flow_level; ++ fte_info.flow_context.flow_source = flow_source; + + ret = mlx5dr_cmd_set_fte(dmn->mdev, 0, 0, &ft_info, *group_id, &fte_info); + if (ret) { +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h +index 55fcb751e24a..64f41e7938e1 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h +@@ -1463,7 +1463,8 @@ int mlx5dr_fw_create_md_tbl(struct mlx5dr_domain *dmn, + bool reformat_req, + u32 *tbl_id, + u32 *group_id, +- bool ignore_flow_level); ++ bool ignore_flow_level, ++ u32 flow_source); + void mlx5dr_fw_destroy_md_tbl(struct mlx5dr_domain *dmn, u32 tbl_id, + u32 group_id); + #endif /* _DR_TYPES_H_ */ +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c +index 3f311462bedf..05393fe11132 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c +@@ -520,6 +520,7 @@ static int mlx5_cmd_dr_create_fte(struct mlx5_flow_root_namespace *ns, + } else if (num_term_actions > 1) { + bool ignore_flow_level = + !!(fte->action.flags & FLOW_ACT_IGNORE_FLOW_LEVEL); ++ u32 flow_source = fte->flow_context.flow_source; + + if (num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX || + fs_dr_num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX) { +@@ -529,7 +530,8 @@ static int mlx5_cmd_dr_create_fte(struct mlx5_flow_root_namespace *ns, + tmp_action = mlx5dr_action_create_mult_dest_tbl(domain, + term_actions, + num_term_actions, +- ignore_flow_level); ++ ignore_flow_level, ++ flow_source); + if (!tmp_action) { + err = -EOPNOTSUPP; + goto free_actions; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/mlx5dr.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/mlx5dr.h +index dfa223415fe2..74a7a2f4d50d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/mlx5dr.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/mlx5dr.h +@@ -96,7 +96,8 @@ struct mlx5dr_action * + mlx5dr_action_create_mult_dest_tbl(struct mlx5dr_domain *dmn, + struct mlx5dr_action_dest *dests, + u32 num_of_dests, +- bool ignore_flow_level); ++ bool ignore_flow_level, ++ u32 flow_source); + + struct mlx5dr_action *mlx5dr_action_create_drop(void); + +-- +2.35.1 + diff --git a/queue-5.17/net-mlx5-dr-ignore-modify-ttl-on-rx-if-device-doesn-.patch b/queue-5.17/net-mlx5-dr-ignore-modify-ttl-on-rx-if-device-doesn-.patch new file mode 100644 index 00000000000..47ea6b41e6f --- /dev/null +++ b/queue-5.17/net-mlx5-dr-ignore-modify-ttl-on-rx-if-device-doesn-.patch @@ -0,0 +1,176 @@ +From 7d98679d33534ae54f697dbc34901f04c04108db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Apr 2022 23:18:10 +0300 +Subject: net/mlx5: DR, Ignore modify TTL on RX if device doesn't support it + +From: Yevgeny Kliteynik + +[ Upstream commit 785d7ed295513bd3374095304b7034fd65c123b0 ] + +When modifying TTL, packet's csum has to be recalculated. +Due to HW issue in ConnectX-5, csum recalculation for modify +TTL on RX is supported through a work-around that is specifically +enabled by configuration. +If the work-around isn't enabled, rather than adding an unsupported +action the modify TTL action on RX should be ignored. +Ignoring modify TTL action might result in zero actions, so in such +cases we will not convert the match STE to modify STE, as it is done +by FW in DMFS. + +This patch fixes an issue where modify TTL action was ignored both +on RX and TX instead of only on RX. + +Fixes: 4ff725e1d4ad ("net/mlx5: DR, Ignore modify TTL if device doesn't support it") +Signed-off-by: Yevgeny Kliteynik +Reviewed-by: Alex Vesker +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../mellanox/mlx5/core/steering/dr_action.c | 65 +++++++++++++------ + .../mellanox/mlx5/core/steering/dr_ste_v0.c | 4 +- + 2 files changed, 48 insertions(+), 21 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c +index 5d1caf97a8fc..8622af6d6bf8 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c +@@ -530,6 +530,37 @@ static int dr_action_handle_cs_recalc(struct mlx5dr_domain *dmn, + return 0; + } + ++static void dr_action_modify_ttl_adjust(struct mlx5dr_domain *dmn, ++ struct mlx5dr_ste_actions_attr *attr, ++ bool rx_rule, ++ bool *recalc_cs_required) ++{ ++ *recalc_cs_required = false; ++ ++ /* if device supports csum recalculation - no adjustment needed */ ++ if (mlx5dr_ste_supp_ttl_cs_recalc(&dmn->info.caps)) ++ return; ++ ++ /* no adjustment needed on TX rules */ ++ if (!rx_rule) ++ return; ++ ++ if (!MLX5_CAP_ESW_FLOWTABLE(dmn->mdev, fdb_ipv4_ttl_modify)) { ++ /* Ignore the modify TTL action. ++ * It is always kept as last HW action. ++ */ ++ attr->modify_actions--; ++ return; ++ } ++ ++ if (dmn->type == MLX5DR_DOMAIN_TYPE_FDB) ++ /* Due to a HW bug on some devices, modifying TTL on RX flows ++ * will cause an incorrect checksum calculation. In such cases ++ * we will use a FW table to recalculate the checksum. ++ */ ++ *recalc_cs_required = true; ++} ++ + static void dr_action_print_sequence(struct mlx5dr_domain *dmn, + struct mlx5dr_action *actions[], + int last_idx) +@@ -649,8 +680,9 @@ int mlx5dr_actions_build_ste_arr(struct mlx5dr_matcher *matcher, + case DR_ACTION_TYP_MODIFY_HDR: + attr.modify_index = action->rewrite->index; + attr.modify_actions = action->rewrite->num_of_actions; +- recalc_cs_required = action->rewrite->modify_ttl && +- !mlx5dr_ste_supp_ttl_cs_recalc(&dmn->info.caps); ++ if (action->rewrite->modify_ttl) ++ dr_action_modify_ttl_adjust(dmn, &attr, rx_rule, ++ &recalc_cs_required); + break; + case DR_ACTION_TYP_L2_TO_TNL_L2: + case DR_ACTION_TYP_L2_TO_TNL_L3: +@@ -737,12 +769,7 @@ int mlx5dr_actions_build_ste_arr(struct mlx5dr_matcher *matcher, + *new_hw_ste_arr_sz = nic_matcher->num_of_builders; + last_ste = ste_arr + DR_STE_SIZE * (nic_matcher->num_of_builders - 1); + +- /* Due to a HW bug in some devices, modifying TTL on RX flows will +- * cause an incorrect checksum calculation. In this case we will +- * use a FW table to recalculate. +- */ +- if (dmn->type == MLX5DR_DOMAIN_TYPE_FDB && +- rx_rule && recalc_cs_required && dest_action) { ++ if (recalc_cs_required && dest_action) { + ret = dr_action_handle_cs_recalc(dmn, dest_action, &attr.final_icm_addr); + if (ret) { + mlx5dr_err(dmn, +@@ -1562,12 +1589,6 @@ dr_action_modify_check_is_ttl_modify(const void *sw_action) + return sw_field == MLX5_ACTION_IN_FIELD_OUT_IP_TTL; + } + +-static bool dr_action_modify_ttl_ignore(struct mlx5dr_domain *dmn) +-{ +- return !mlx5dr_ste_supp_ttl_cs_recalc(&dmn->info.caps) && +- !MLX5_CAP_ESW_FLOWTABLE(dmn->mdev, fdb_ipv4_ttl_modify); +-} +- + static int dr_actions_convert_modify_header(struct mlx5dr_action *action, + u32 max_hw_actions, + u32 num_sw_actions, +@@ -1579,6 +1600,7 @@ static int dr_actions_convert_modify_header(struct mlx5dr_action *action, + const struct mlx5dr_ste_action_modify_field *hw_dst_action_info; + const struct mlx5dr_ste_action_modify_field *hw_src_action_info; + struct mlx5dr_domain *dmn = action->rewrite->dmn; ++ __be64 *modify_ttl_sw_action = NULL; + int ret, i, hw_idx = 0; + __be64 *sw_action; + __be64 hw_action; +@@ -1591,8 +1613,14 @@ static int dr_actions_convert_modify_header(struct mlx5dr_action *action, + action->rewrite->allow_rx = 1; + action->rewrite->allow_tx = 1; + +- for (i = 0; i < num_sw_actions; i++) { +- sw_action = &sw_actions[i]; ++ for (i = 0; i < num_sw_actions || modify_ttl_sw_action; i++) { ++ /* modify TTL is handled separately, as a last action */ ++ if (i == num_sw_actions) { ++ sw_action = modify_ttl_sw_action; ++ modify_ttl_sw_action = NULL; ++ } else { ++ sw_action = &sw_actions[i]; ++ } + + ret = dr_action_modify_check_field_limitation(action, + sw_action); +@@ -1601,10 +1629,9 @@ static int dr_actions_convert_modify_header(struct mlx5dr_action *action, + + if (!(*modify_ttl) && + dr_action_modify_check_is_ttl_modify(sw_action)) { +- if (dr_action_modify_ttl_ignore(dmn)) +- continue; +- ++ modify_ttl_sw_action = sw_action; + *modify_ttl = true; ++ continue; + } + + /* Convert SW action to HW action */ +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste_v0.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste_v0.c +index 2d62950f7a29..134c8484c901 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste_v0.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste_v0.c +@@ -419,7 +419,7 @@ dr_ste_v0_set_actions_tx(struct mlx5dr_domain *dmn, + * encapsulation. The reason for that is that we support + * modify headers for outer headers only + */ +- if (action_type_set[DR_ACTION_TYP_MODIFY_HDR]) { ++ if (action_type_set[DR_ACTION_TYP_MODIFY_HDR] && attr->modify_actions) { + dr_ste_v0_set_entry_type(last_ste, DR_STE_TYPE_MODIFY_PKT); + dr_ste_v0_set_rewrite_actions(last_ste, + attr->modify_actions, +@@ -511,7 +511,7 @@ dr_ste_v0_set_actions_rx(struct mlx5dr_domain *dmn, + } + } + +- if (action_type_set[DR_ACTION_TYP_MODIFY_HDR]) { ++ if (action_type_set[DR_ACTION_TYP_MODIFY_HDR] && attr->modify_actions) { + if (dr_ste_v0_get_entry_type(last_ste) == DR_STE_TYPE_MODIFY_PKT) + dr_ste_v0_arr_init_next(&last_ste, + added_stes, +-- +2.35.1 + diff --git a/queue-5.17/net-mlx5-drain-fw_reset-when-removing-device.patch b/queue-5.17/net-mlx5-drain-fw_reset-when-removing-device.patch new file mode 100644 index 00000000000..9d903c4ab75 --- /dev/null +++ b/queue-5.17/net-mlx5-drain-fw_reset-when-removing-device.patch @@ -0,0 +1,128 @@ +From 599bfae0c914e96ca4099df361d8342b9c7987b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Apr 2022 10:47:36 +0300 +Subject: net/mlx5: Drain fw_reset when removing device + +From: Shay Drory + +[ Upstream commit 16d42d313350946f4b9a8b74a13c99f0461a6572 ] + +In case fw sync reset is called in parallel to device removal, device +might stuck in the following deadlock: + CPU 0 CPU 1 + ----- ----- + remove_one + uninit_one (locks intf_state_mutex) +mlx5_sync_reset_now_event() +work in fw_reset->wq. + mlx5_enter_error_state() + mutex_lock (intf_state_mutex) + cleanup_once + fw_reset_cleanup() + destroy_workqueue(fw_reset->wq) + +Drain the fw_reset WQ, and make sure no new work is being queued, before +entering uninit_one(). +The Drain is done before devlink_unregister() since fw_reset, in some +flows, is using devlink API devlink_remote_reload_actions_performed(). + +Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event") +Signed-off-by: Shay Drory +Reviewed-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlx5/core/fw_reset.c | 25 ++++++++++++++++--- + .../ethernet/mellanox/mlx5/core/fw_reset.h | 1 + + .../net/ethernet/mellanox/mlx5/core/main.c | 4 +++ + 3 files changed, 27 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +index 862f5b7cb210..1c771287bee5 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +@@ -8,7 +8,8 @@ + enum { + MLX5_FW_RESET_FLAGS_RESET_REQUESTED, + MLX5_FW_RESET_FLAGS_NACK_RESET_REQUEST, +- MLX5_FW_RESET_FLAGS_PENDING_COMP ++ MLX5_FW_RESET_FLAGS_PENDING_COMP, ++ MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS + }; + + struct mlx5_fw_reset { +@@ -165,7 +166,10 @@ static void poll_sync_reset(struct timer_list *t) + + if (fatal_error) { + mlx5_core_warn(dev, "Got Device Reset\n"); +- queue_work(fw_reset->wq, &fw_reset->reset_reload_work); ++ if (!test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS, &fw_reset->reset_flags)) ++ queue_work(fw_reset->wq, &fw_reset->reset_reload_work); ++ else ++ mlx5_core_err(dev, "Device is being removed, Drop new reset work\n"); + return; + } + +@@ -390,9 +394,12 @@ static int fw_reset_event_notifier(struct notifier_block *nb, unsigned long acti + struct mlx5_fw_reset *fw_reset = mlx5_nb_cof(nb, struct mlx5_fw_reset, nb); + struct mlx5_eqe *eqe = data; + ++ if (test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS, &fw_reset->reset_flags)) ++ return NOTIFY_DONE; ++ + switch (eqe->sub_type) { + case MLX5_GENERAL_SUBTYPE_FW_LIVE_PATCH_EVENT: +- queue_work(fw_reset->wq, &fw_reset->fw_live_patch_work); ++ queue_work(fw_reset->wq, &fw_reset->fw_live_patch_work); + break; + case MLX5_GENERAL_SUBTYPE_PCI_SYNC_FOR_FW_UPDATE_EVENT: + mlx5_sync_reset_events_handle(fw_reset, eqe); +@@ -436,6 +443,18 @@ void mlx5_fw_reset_events_stop(struct mlx5_core_dev *dev) + mlx5_eq_notifier_unregister(dev, &dev->priv.fw_reset->nb); + } + ++void mlx5_drain_fw_reset(struct mlx5_core_dev *dev) ++{ ++ struct mlx5_fw_reset *fw_reset = dev->priv.fw_reset; ++ ++ set_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS, &fw_reset->reset_flags); ++ cancel_work_sync(&fw_reset->fw_live_patch_work); ++ cancel_work_sync(&fw_reset->reset_request_work); ++ cancel_work_sync(&fw_reset->reset_reload_work); ++ cancel_work_sync(&fw_reset->reset_now_work); ++ cancel_work_sync(&fw_reset->reset_abort_work); ++} ++ + int mlx5_fw_reset_init(struct mlx5_core_dev *dev) + { + struct mlx5_fw_reset *fw_reset = kzalloc(sizeof(*fw_reset), GFP_KERNEL); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h +index 7761ee5fc7d0..372046e173e7 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h +@@ -15,6 +15,7 @@ int mlx5_fw_reset_set_live_patch(struct mlx5_core_dev *dev); + int mlx5_fw_reset_wait_reset_done(struct mlx5_core_dev *dev); + void mlx5_fw_reset_events_start(struct mlx5_core_dev *dev); + void mlx5_fw_reset_events_stop(struct mlx5_core_dev *dev); ++void mlx5_drain_fw_reset(struct mlx5_core_dev *dev); + int mlx5_fw_reset_init(struct mlx5_core_dev *dev); + void mlx5_fw_reset_cleanup(struct mlx5_core_dev *dev); + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index f1437b6d4418..4e49dca94bc3 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -1628,6 +1628,10 @@ static void remove_one(struct pci_dev *pdev) + struct mlx5_core_dev *dev = pci_get_drvdata(pdev); + struct devlink *devlink = priv_to_devlink(dev); + ++ /* mlx5_drain_fw_reset() is using devlink APIs. Hence, we must drain ++ * fw_reset before unregistering the devlink. ++ */ ++ mlx5_drain_fw_reset(dev); + devlink_unregister(devlink); + mlx5_crdump_disable(dev); + mlx5_drain_health_wq(dev); +-- +2.35.1 + diff --git a/queue-5.17/net-mlx5-initialize-flow-steering-during-driver-prob.patch b/queue-5.17/net-mlx5-initialize-flow-steering-during-driver-prob.patch new file mode 100644 index 00000000000..14c05af1707 --- /dev/null +++ b/queue-5.17/net-mlx5-initialize-flow-steering-during-driver-prob.patch @@ -0,0 +1,397 @@ +From a63eef70b4ed8584c74752ee6d38451d1982a731 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Mar 2022 14:45:58 +0200 +Subject: net/mlx5: Initialize flow steering during driver probe + +From: Shay Drory + +[ Upstream commit b33886971dbc4a86d1ec5369a2aaefc60a7cd72d ] + +Currently, software objects of flow steering are created and destroyed +during reload flow. In case a device is unloaded, the following error +is printed during grace period: + + mlx5_core 0000:00:0b.0: mlx5_fw_fatal_reporter_err_work:690:(pid 95): + Driver is in error state. Unloading + +As a solution to fix use-after-free bugs, where we try to access +these objects, when reading the value of flow_steering_mode devlink +param[1], let's split flow steering creation and destruction into two +routines: + * init and cleanup: memory, cache, and pools allocation/free. + * create and destroy: namespaces initialization and cleanup. + +While at it, re-order the cleanup function to mirror the init function. + +[1] +Kasan trace: + +[ 385.119849 ] BUG: KASAN: use-after-free in mlx5_devlink_fs_mode_get+0x3b/0xa0 +[ 385.119849 ] Read of size 4 at addr ffff888104b79308 by task bash/291 +[ 385.119849 ] +[ 385.119849 ] CPU: 1 PID: 291 Comm: bash Not tainted 5.17.0-rc1+ #2 +[ 385.119849 ] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-2.fc32 04/01/2014 +[ 385.119849 ] Call Trace: +[ 385.119849 ] +[ 385.119849 ] dump_stack_lvl+0x6e/0x91 +[ 385.119849 ] print_address_description.constprop.0+0x1f/0x160 +[ 385.119849 ] ? mlx5_devlink_fs_mode_get+0x3b/0xa0 +[ 385.119849 ] ? mlx5_devlink_fs_mode_get+0x3b/0xa0 +[ 385.119849 ] kasan_report.cold+0x83/0xdf +[ 385.119849 ] ? devlink_param_notify+0x20/0x190 +[ 385.119849 ] ? mlx5_devlink_fs_mode_get+0x3b/0xa0 +[ 385.119849 ] mlx5_devlink_fs_mode_get+0x3b/0xa0 +[ 385.119849 ] devlink_nl_param_fill+0x18a/0xa50 +[ 385.119849 ] ? _raw_spin_lock_irqsave+0x8d/0xe0 +[ 385.119849 ] ? devlink_flash_update_timeout_notify+0xf0/0xf0 +[ 385.119849 ] ? __wake_up_common+0x4b/0x1e0 +[ 385.119849 ] ? preempt_count_sub+0x14/0xc0 +[ 385.119849 ] ? _raw_spin_unlock_irqrestore+0x28/0x40 +[ 385.119849 ] ? __wake_up_common_lock+0xe3/0x140 +[ 385.119849 ] ? __wake_up_common+0x1e0/0x1e0 +[ 385.119849 ] ? __sanitizer_cov_trace_const_cmp8+0x27/0x80 +[ 385.119849 ] ? __rcu_read_unlock+0x48/0x70 +[ 385.119849 ] ? kasan_unpoison+0x23/0x50 +[ 385.119849 ] ? __kasan_slab_alloc+0x2c/0x80 +[ 385.119849 ] ? memset+0x20/0x40 +[ 385.119849 ] ? __sanitizer_cov_trace_const_cmp4+0x25/0x80 +[ 385.119849 ] devlink_param_notify+0xce/0x190 +[ 385.119849 ] devlink_unregister+0x92/0x2b0 +[ 385.119849 ] remove_one+0x41/0x140 +[ 385.119849 ] pci_device_remove+0x68/0x140 +[ 385.119849 ] ? pcibios_free_irq+0x10/0x10 +[ 385.119849 ] __device_release_driver+0x294/0x3f0 +[ 385.119849 ] device_driver_detach+0x82/0x130 +[ 385.119849 ] unbind_store+0x193/0x1b0 +[ 385.119849 ] ? subsys_interface_unregister+0x270/0x270 +[ 385.119849 ] drv_attr_store+0x4e/0x70 +[ 385.119849 ] ? drv_attr_show+0x60/0x60 +[ 385.119849 ] sysfs_kf_write+0xa7/0xc0 +[ 385.119849 ] kernfs_fop_write_iter+0x23a/0x2f0 +[ 385.119849 ] ? sysfs_kf_bin_read+0x160/0x160 +[ 385.119849 ] new_sync_write+0x311/0x430 +[ 385.119849 ] ? new_sync_read+0x480/0x480 +[ 385.119849 ] ? _raw_spin_lock+0x87/0xe0 +[ 385.119849 ] ? __sanitizer_cov_trace_cmp4+0x25/0x80 +[ 385.119849 ] ? security_file_permission+0x94/0xa0 +[ 385.119849 ] vfs_write+0x4c7/0x590 +[ 385.119849 ] ksys_write+0xf6/0x1e0 +[ 385.119849 ] ? __x64_sys_read+0x50/0x50 +[ 385.119849 ] ? fpregs_assert_state_consistent+0x99/0xa0 +[ 385.119849 ] do_syscall_64+0x3d/0x90 +[ 385.119849 ] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ 385.119849 ] RIP: 0033:0x7fc36ef38504 +[ 385.119849 ] Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b3 0f 1f +80 00 00 00 00 48 8d 05 f9 61 0d 00 8b 00 85 c0 75 13 b8 01 00 00 00 0f +05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 41 54 49 89 d4 55 48 89 f5 53 +[ 385.119849 ] RSP: 002b:00007ffde0ff3d08 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 +[ 385.119849 ] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007fc36ef38504 +[ 385.119849 ] RDX: 000000000000000c RSI: 00007fc370521040 RDI: 0000000000000001 +[ 385.119849 ] RBP: 00007fc370521040 R08: 00007fc36f00b8c0 R09: 00007fc36ee4b740 +[ 385.119849 ] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc36f00a760 +[ 385.119849 ] R13: 000000000000000c R14: 00007fc36f005760 R15: 000000000000000c +[ 385.119849 ] +[ 385.119849 ] +[ 385.119849 ] Allocated by task 65: +[ 385.119849 ] kasan_save_stack+0x1e/0x40 +[ 385.119849 ] __kasan_kmalloc+0x81/0xa0 +[ 385.119849 ] mlx5_init_fs+0x11b/0x1160 +[ 385.119849 ] mlx5_load+0x13c/0x220 +[ 385.119849 ] mlx5_load_one+0xda/0x160 +[ 385.119849 ] mlx5_recover_device+0xb8/0x100 +[ 385.119849 ] mlx5_health_try_recover+0x2f9/0x3a1 +[ 385.119849 ] devlink_health_reporter_recover+0x75/0x100 +[ 385.119849 ] devlink_health_report+0x26c/0x4b0 +[ 385.275909 ] mlx5_fw_fatal_reporter_err_work+0x11e/0x1b0 +[ 385.275909 ] process_one_work+0x520/0x970 +[ 385.275909 ] worker_thread+0x378/0x950 +[ 385.275909 ] kthread+0x1bb/0x200 +[ 385.275909 ] ret_from_fork+0x1f/0x30 +[ 385.275909 ] +[ 385.275909 ] Freed by task 65: +[ 385.275909 ] kasan_save_stack+0x1e/0x40 +[ 385.275909 ] kasan_set_track+0x21/0x30 +[ 385.275909 ] kasan_set_free_info+0x20/0x30 +[ 385.275909 ] __kasan_slab_free+0xfc/0x140 +[ 385.275909 ] kfree+0xa5/0x3b0 +[ 385.275909 ] mlx5_unload+0x2e/0xb0 +[ 385.275909 ] mlx5_unload_one+0x86/0xb0 +[ 385.275909 ] mlx5_fw_fatal_reporter_err_work.cold+0xca/0xcf +[ 385.275909 ] process_one_work+0x520/0x970 +[ 385.275909 ] worker_thread+0x378/0x950 +[ 385.275909 ] kthread+0x1bb/0x200 +[ 385.275909 ] ret_from_fork+0x1f/0x30 +[ 385.275909 ] +[ 385.275909 ] The buggy address belongs to the object at ffff888104b79300 +[ 385.275909 ] which belongs to the cache kmalloc-128 of size 128 +[ 385.275909 ] The buggy address is located 8 bytes inside of +[ 385.275909 ] 128-byte region [ffff888104b79300, ffff888104b79380) +[ 385.275909 ] The buggy address belongs to the page: +[ 385.275909 ] page:00000000de44dd39 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104b78 +[ 385.275909 ] head:00000000de44dd39 order:1 compound_mapcount:0 +[ 385.275909 ] flags: 0x8000000000010200(slab|head|zone=2) +[ 385.275909 ] raw: 8000000000010200 0000000000000000 dead000000000122 ffff8881000428c0 +[ 385.275909 ] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 +[ 385.275909 ] page dumped because: kasan: bad access detected +[ 385.275909 ] +[ 385.275909 ] Memory state around the buggy address: +[ 385.275909 ] ffff888104b79200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc +[ 385.275909 ] ffff888104b79280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +[ 385.275909 ] >ffff888104b79300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 385.275909 ] ^ +[ 385.275909 ] ffff888104b79380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +[ 385.275909 ] ffff888104b79400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 385.275909 ]] + +Fixes: e890acd5ff18 ("net/mlx5: Add devlink flow_steering_mode parameter") +Signed-off-by: Shay Drory +Reviewed-by: Mark Bloch +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/fs_core.c | 131 ++++++++++-------- + .../net/ethernet/mellanox/mlx5/core/fs_core.h | 6 +- + .../net/ethernet/mellanox/mlx5/core/main.c | 15 +- + 3 files changed, 91 insertions(+), 61 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +index 537c82b9aa53..b6f58d16d145 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +@@ -2656,28 +2656,6 @@ static void cleanup_root_ns(struct mlx5_flow_root_namespace *root_ns) + clean_tree(&root_ns->ns.node); + } + +-void mlx5_cleanup_fs(struct mlx5_core_dev *dev) +-{ +- struct mlx5_flow_steering *steering = dev->priv.steering; +- +- cleanup_root_ns(steering->root_ns); +- cleanup_root_ns(steering->fdb_root_ns); +- steering->fdb_root_ns = NULL; +- kfree(steering->fdb_sub_ns); +- steering->fdb_sub_ns = NULL; +- cleanup_root_ns(steering->port_sel_root_ns); +- cleanup_root_ns(steering->sniffer_rx_root_ns); +- cleanup_root_ns(steering->sniffer_tx_root_ns); +- cleanup_root_ns(steering->rdma_rx_root_ns); +- cleanup_root_ns(steering->rdma_tx_root_ns); +- cleanup_root_ns(steering->egress_root_ns); +- mlx5_cleanup_fc_stats(dev); +- kmem_cache_destroy(steering->ftes_cache); +- kmem_cache_destroy(steering->fgs_cache); +- mlx5_ft_pool_destroy(dev); +- kfree(steering); +-} +- + static int init_sniffer_tx_root_ns(struct mlx5_flow_steering *steering) + { + struct fs_prio *prio; +@@ -3063,42 +3041,27 @@ static int init_egress_root_ns(struct mlx5_flow_steering *steering) + return err; + } + +-int mlx5_init_fs(struct mlx5_core_dev *dev) ++void mlx5_fs_core_cleanup(struct mlx5_core_dev *dev) + { +- struct mlx5_flow_steering *steering; +- int err = 0; +- +- err = mlx5_init_fc_stats(dev); +- if (err) +- return err; +- +- err = mlx5_ft_pool_init(dev); +- if (err) +- return err; +- +- steering = kzalloc(sizeof(*steering), GFP_KERNEL); +- if (!steering) { +- err = -ENOMEM; +- goto err; +- } +- +- steering->dev = dev; +- dev->priv.steering = steering; ++ struct mlx5_flow_steering *steering = dev->priv.steering; + +- if (mlx5_fs_dr_is_supported(dev)) +- steering->mode = MLX5_FLOW_STEERING_MODE_SMFS; +- else +- steering->mode = MLX5_FLOW_STEERING_MODE_DMFS; ++ cleanup_root_ns(steering->root_ns); ++ cleanup_root_ns(steering->fdb_root_ns); ++ steering->fdb_root_ns = NULL; ++ kfree(steering->fdb_sub_ns); ++ steering->fdb_sub_ns = NULL; ++ cleanup_root_ns(steering->port_sel_root_ns); ++ cleanup_root_ns(steering->sniffer_rx_root_ns); ++ cleanup_root_ns(steering->sniffer_tx_root_ns); ++ cleanup_root_ns(steering->rdma_rx_root_ns); ++ cleanup_root_ns(steering->rdma_tx_root_ns); ++ cleanup_root_ns(steering->egress_root_ns); ++} + +- steering->fgs_cache = kmem_cache_create("mlx5_fs_fgs", +- sizeof(struct mlx5_flow_group), 0, +- 0, NULL); +- steering->ftes_cache = kmem_cache_create("mlx5_fs_ftes", sizeof(struct fs_fte), 0, +- 0, NULL); +- if (!steering->ftes_cache || !steering->fgs_cache) { +- err = -ENOMEM; +- goto err; +- } ++int mlx5_fs_core_init(struct mlx5_core_dev *dev) ++{ ++ struct mlx5_flow_steering *steering = dev->priv.steering; ++ int err = 0; + + if ((((MLX5_CAP_GEN(dev, port_type) == MLX5_CAP_PORT_TYPE_ETH) && + (MLX5_CAP_GEN(dev, nic_flow_table))) || +@@ -3157,8 +3120,64 @@ int mlx5_init_fs(struct mlx5_core_dev *dev) + } + + return 0; ++ ++err: ++ mlx5_fs_core_cleanup(dev); ++ return err; ++} ++ ++void mlx5_fs_core_free(struct mlx5_core_dev *dev) ++{ ++ struct mlx5_flow_steering *steering = dev->priv.steering; ++ ++ kmem_cache_destroy(steering->ftes_cache); ++ kmem_cache_destroy(steering->fgs_cache); ++ kfree(steering); ++ mlx5_ft_pool_destroy(dev); ++ mlx5_cleanup_fc_stats(dev); ++} ++ ++int mlx5_fs_core_alloc(struct mlx5_core_dev *dev) ++{ ++ struct mlx5_flow_steering *steering; ++ int err = 0; ++ ++ err = mlx5_init_fc_stats(dev); ++ if (err) ++ return err; ++ ++ err = mlx5_ft_pool_init(dev); ++ if (err) ++ goto err; ++ ++ steering = kzalloc(sizeof(*steering), GFP_KERNEL); ++ if (!steering) { ++ err = -ENOMEM; ++ goto err; ++ } ++ ++ steering->dev = dev; ++ dev->priv.steering = steering; ++ ++ if (mlx5_fs_dr_is_supported(dev)) ++ steering->mode = MLX5_FLOW_STEERING_MODE_SMFS; ++ else ++ steering->mode = MLX5_FLOW_STEERING_MODE_DMFS; ++ ++ steering->fgs_cache = kmem_cache_create("mlx5_fs_fgs", ++ sizeof(struct mlx5_flow_group), 0, ++ 0, NULL); ++ steering->ftes_cache = kmem_cache_create("mlx5_fs_ftes", sizeof(struct fs_fte), 0, ++ 0, NULL); ++ if (!steering->ftes_cache || !steering->fgs_cache) { ++ err = -ENOMEM; ++ goto err; ++ } ++ ++ return 0; ++ + err: +- mlx5_cleanup_fs(dev); ++ mlx5_fs_core_free(dev); + return err; + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h +index 5469b08d635f..6366bf50a564 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h +@@ -293,8 +293,10 @@ int mlx5_flow_namespace_set_peer(struct mlx5_flow_root_namespace *ns, + int mlx5_flow_namespace_set_mode(struct mlx5_flow_namespace *ns, + enum mlx5_flow_steering_mode mode); + +-int mlx5_init_fs(struct mlx5_core_dev *dev); +-void mlx5_cleanup_fs(struct mlx5_core_dev *dev); ++int mlx5_fs_core_alloc(struct mlx5_core_dev *dev); ++void mlx5_fs_core_free(struct mlx5_core_dev *dev); ++int mlx5_fs_core_init(struct mlx5_core_dev *dev); ++void mlx5_fs_core_cleanup(struct mlx5_core_dev *dev); + + int mlx5_fs_egress_acls_init(struct mlx5_core_dev *dev, int total_vports); + void mlx5_fs_egress_acls_cleanup(struct mlx5_core_dev *dev); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index bba72b220cc3..f1437b6d4418 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -939,6 +939,12 @@ static int mlx5_init_once(struct mlx5_core_dev *dev) + goto err_sf_table_cleanup; + } + ++ err = mlx5_fs_core_alloc(dev); ++ if (err) { ++ mlx5_core_err(dev, "Failed to alloc flow steering\n"); ++ goto err_fs; ++ } ++ + dev->dm = mlx5_dm_create(dev); + if (IS_ERR(dev->dm)) + mlx5_core_warn(dev, "Failed to init device memory%d\n", err); +@@ -949,6 +955,8 @@ static int mlx5_init_once(struct mlx5_core_dev *dev) + + return 0; + ++err_fs: ++ mlx5_sf_table_cleanup(dev); + err_sf_table_cleanup: + mlx5_sf_hw_table_cleanup(dev); + err_sf_hw_table_cleanup: +@@ -986,6 +994,7 @@ static void mlx5_cleanup_once(struct mlx5_core_dev *dev) + mlx5_hv_vhca_destroy(dev->hv_vhca); + mlx5_fw_tracer_destroy(dev->tracer); + mlx5_dm_cleanup(dev); ++ mlx5_fs_core_free(dev); + mlx5_sf_table_cleanup(dev); + mlx5_sf_hw_table_cleanup(dev); + mlx5_vhca_event_cleanup(dev); +@@ -1192,7 +1201,7 @@ static int mlx5_load(struct mlx5_core_dev *dev) + goto err_tls_start; + } + +- err = mlx5_init_fs(dev); ++ err = mlx5_fs_core_init(dev); + if (err) { + mlx5_core_err(dev, "Failed to init flow steering\n"); + goto err_fs; +@@ -1237,7 +1246,7 @@ static int mlx5_load(struct mlx5_core_dev *dev) + err_vhca: + mlx5_vhca_event_stop(dev); + err_set_hca: +- mlx5_cleanup_fs(dev); ++ mlx5_fs_core_cleanup(dev); + err_fs: + mlx5_accel_tls_cleanup(dev); + err_tls_start: +@@ -1266,7 +1275,7 @@ static void mlx5_unload(struct mlx5_core_dev *dev) + mlx5_ec_cleanup(dev); + mlx5_sf_hw_table_destroy(dev); + mlx5_vhca_event_stop(dev); +- mlx5_cleanup_fs(dev); ++ mlx5_fs_core_cleanup(dev); + mlx5_accel_ipsec_cleanup(dev); + mlx5_accel_tls_cleanup(dev); + mlx5_fpga_device_stop(dev); +-- +2.35.1 + diff --git a/queue-5.17/net-mlx5e-block-rx-gro-hw-feature-in-switchdev-mode.patch b/queue-5.17/net-mlx5e-block-rx-gro-hw-feature-in-switchdev-mode.patch new file mode 100644 index 00000000000..84d5d382c9b --- /dev/null +++ b/queue-5.17/net-mlx5e-block-rx-gro-hw-feature-in-switchdev-mode.patch @@ -0,0 +1,41 @@ +From 597bbccebfc6be8c463a77e0f5fe6d39dfe36d2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 17:29:08 +0300 +Subject: net/mlx5e: Block rx-gro-hw feature in switchdev mode + +From: Aya Levin + +[ Upstream commit 15a5078cab30d7aa02ad14bfadebf247d95fc239 ] + +When the driver is in switchdev mode and rx-gro-hw is set, the RQ needs +special CQE handling. Till then, block setting of rx-gro-hw feature in +switchdev mode, to avoid failure while setting the feature due to +failure while opening the RQ. + +Fixes: f97d5c2a453e ("net/mlx5e: Add handle SHAMPO cqe support") +Signed-off-by: Aya Levin +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 169e3524bb1c..d468daa7dc20 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -3829,6 +3829,10 @@ static netdev_features_t mlx5e_fix_uplink_rep_features(struct net_device *netdev + if (netdev->features & NETIF_F_NTUPLE) + netdev_warn(netdev, "Disabling ntuple, not supported in switchdev mode\n"); + ++ features &= ~NETIF_F_GRO_HW; ++ if (netdev->features & NETIF_F_GRO_HW) ++ netdev_warn(netdev, "Disabling HW_GRO, not supported in switchdev mode\n"); ++ + return features; + } + +-- +2.35.1 + diff --git a/queue-5.17/net-mlx5e-properly-block-hw-gro-when-xdp-is-enabled.patch b/queue-5.17/net-mlx5e-properly-block-hw-gro-when-xdp-is-enabled.patch new file mode 100644 index 00000000000..e61e029d946 --- /dev/null +++ b/queue-5.17/net-mlx5e-properly-block-hw-gro-when-xdp-is-enabled.patch @@ -0,0 +1,52 @@ +From 583ffb01346f07604fe03b6fb417bd466d872c24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Apr 2022 18:54:26 +0300 +Subject: net/mlx5e: Properly block HW GRO when XDP is enabled + +From: Maxim Mikityanskiy + +[ Upstream commit b0617e7b35001c92c8fa777e1a095d3e693813df ] + +HW GRO is incompatible and mutually exclusive with XDP and XSK. However, +the needed checks are only made when enabling XDP. If HW GRO is enabled +when XDP is already active, the command will succeed, and XDP will be +skipped in the data path, although still enabled. + +This commit fixes the bug by checking the XDP and XSK status in +mlx5e_fix_features and disabling HW GRO if XDP is enabled. + +Fixes: 83439f3c37aa ("net/mlx5e: Add HW-GRO offload") +Signed-off-by: Maxim Mikityanskiy +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 1f8fc8d77bc3..4b83dd05afcd 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -3870,6 +3870,18 @@ static netdev_features_t mlx5e_fix_features(struct net_device *netdev, + netdev_warn(netdev, "LRO is incompatible with XDP\n"); + features &= ~NETIF_F_LRO; + } ++ if (features & NETIF_F_GRO_HW) { ++ netdev_warn(netdev, "HW GRO is incompatible with XDP\n"); ++ features &= ~NETIF_F_GRO_HW; ++ } ++ } ++ ++ if (priv->xsk.refcnt) { ++ if (features & NETIF_F_GRO_HW) { ++ netdev_warn(netdev, "HW GRO is incompatible with AF_XDP (%u XSKs are active)\n", ++ priv->xsk.refcnt); ++ features &= ~NETIF_F_GRO_HW; ++ } + } + + if (MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_CQE_COMPRESS)) { +-- +2.35.1 + diff --git a/queue-5.17/net-mlx5e-properly-block-lro-when-xdp-is-enabled.patch b/queue-5.17/net-mlx5e-properly-block-lro-when-xdp-is-enabled.patch new file mode 100644 index 00000000000..e5a91af13e3 --- /dev/null +++ b/queue-5.17/net-mlx5e-properly-block-lro-when-xdp-is-enabled.patch @@ -0,0 +1,47 @@ +From f20ddffd8d0a355eef3c43fbbf2c46125b135ae5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Apr 2022 18:37:03 +0300 +Subject: net/mlx5e: Properly block LRO when XDP is enabled + +From: Maxim Mikityanskiy + +[ Upstream commit cf6e34c8c22fba66bd21244b95ea47e235f68974 ] + +LRO is incompatible and mutually exclusive with XDP. However, the needed +checks are only made when enabling XDP. If LRO is enabled when XDP is +already active, the command will succeed, and XDP will be skipped in the +data path, although still enabled. + +This commit fixes the bug by checking the XDP status in +mlx5e_fix_features and disabling LRO if XDP is enabled. + +Fixes: 86994156c736 ("net/mlx5e: XDP fast RX drop bpf programs support") +Signed-off-by: Maxim Mikityanskiy +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index d468daa7dc20..1f8fc8d77bc3 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -3865,6 +3865,13 @@ static netdev_features_t mlx5e_fix_features(struct net_device *netdev, + } + } + ++ if (params->xdp_prog) { ++ if (features & NETIF_F_LRO) { ++ netdev_warn(netdev, "LRO is incompatible with XDP\n"); ++ features &= ~NETIF_F_LRO; ++ } ++ } ++ + if (MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_CQE_COMPRESS)) { + features &= ~NETIF_F_RXHASH; + if (netdev->features & NETIF_F_RXHASH) +-- +2.35.1 + diff --git a/queue-5.17/net-mlx5e-remove-hw-gro-from-reported-features.patch b/queue-5.17/net-mlx5e-remove-hw-gro-from-reported-features.patch new file mode 100644 index 00000000000..52743f9ea47 --- /dev/null +++ b/queue-5.17/net-mlx5e-remove-hw-gro-from-reported-features.patch @@ -0,0 +1,39 @@ +From b0a858df9ac13ae4c22a1f85eeefd1b72fa84ee9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Apr 2022 15:50:42 +0300 +Subject: net/mlx5e: Remove HW-GRO from reported features + +From: Gal Pressman + +[ Upstream commit 6bbd723035badafe4a8eb17ccdecd96eae7a96d5 ] + +We got reports of certain HW-GRO flows causing kernel call traces, which +might be related to firmware. To be on the safe side, disable the +feature for now and re-enable it once a driver/firmware fix is found. + +Fixes: 83439f3c37aa ("net/mlx5e: Add HW-GRO offload") +Signed-off-by: Gal Pressman +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 4b83dd05afcd..3500faf08671 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -4828,10 +4828,6 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev) + netdev->hw_features |= NETIF_F_HW_VLAN_CTAG_FILTER; + netdev->hw_features |= NETIF_F_HW_VLAN_STAG_TX; + +- if (!!MLX5_CAP_GEN(mdev, shampo) && +- mlx5e_check_fragmented_striding_rq_cap(mdev)) +- netdev->hw_features |= NETIF_F_GRO_HW; +- + if (mlx5e_tunnel_any_tx_proto_supported(mdev)) { + netdev->hw_enc_features |= NETIF_F_HW_CSUM; + netdev->hw_enc_features |= NETIF_F_TSO; +-- +2.35.1 + diff --git a/queue-5.17/net-qla3xxx-fix-a-test-in-ql_reset_work.patch b/queue-5.17/net-qla3xxx-fix-a-test-in-ql_reset_work.patch new file mode 100644 index 00000000000..f6f8800e7c4 --- /dev/null +++ b/queue-5.17/net-qla3xxx-fix-a-test-in-ql_reset_work.patch @@ -0,0 +1,48 @@ +From 39b6f8ba9533de8205e9a3f4151b0abafdca365b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 May 2022 20:07:02 +0200 +Subject: net/qla3xxx: Fix a test in ql_reset_work() + +From: Christophe JAILLET + +[ Upstream commit 5361448e45fac6fb96738df748229432a62d78b6 ] + +test_bit() tests if one bit is set or not. +Here the logic seems to check of bit QL_RESET_PER_SCSI (i.e. 4) OR bit +QL_RESET_START (i.e. 3) is set. + +In fact, it checks if bit 7 (4 | 3 = 7) is set, that is to say +QL_ADAPTER_UP. + +This looks harmless, because this bit is likely be set, and when the +ql_reset_work() delayed work is scheduled in ql3xxx_isr() (the only place +that schedule this work), QL_RESET_START or QL_RESET_PER_SCSI is set. + +This has been spotted by smatch. + +Fixes: 5a4faa873782 ("[PATCH] qla3xxx NIC driver") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/80e73e33f390001d9c0140ffa9baddf6466a41a2.1652637337.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qla3xxx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c +index b30589a135c2..06f4d9a9e938 100644 +--- a/drivers/net/ethernet/qlogic/qla3xxx.c ++++ b/drivers/net/ethernet/qlogic/qla3xxx.c +@@ -3614,7 +3614,8 @@ static void ql_reset_work(struct work_struct *work) + qdev->mem_map_registers; + unsigned long hw_flags; + +- if (test_bit((QL_RESET_PER_SCSI | QL_RESET_START), &qdev->flags)) { ++ if (test_bit(QL_RESET_PER_SCSI, &qdev->flags) || ++ test_bit(QL_RESET_START, &qdev->flags)) { + clear_bit(QL_LINK_MASTER, &qdev->flags); + + /* +-- +2.35.1 + diff --git a/queue-5.17/net-sched-act_pedit-sanitize-shift-argument-before-u.patch b/queue-5.17/net-sched-act_pedit-sanitize-shift-argument-before-u.patch new file mode 100644 index 00000000000..f3ece2a8753 --- /dev/null +++ b/queue-5.17/net-sched-act_pedit-sanitize-shift-argument-before-u.patch @@ -0,0 +1,84 @@ +From 253dcaab7f8f8f2ea29e8a0948f4b4b912bd2dc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 May 2022 11:27:06 +0200 +Subject: net/sched: act_pedit: sanitize shift argument before usage + +From: Paolo Abeni + +[ Upstream commit 4d42d54a7d6aa6d29221d3fd4f2ae9503e94f011 ] + +syzbot was able to trigger an Out-of-Bound on the pedit action: + +UBSAN: shift-out-of-bounds in net/sched/act_pedit.c:238:43 +shift exponent 1400735974 is too large for 32-bit type 'unsigned int' +CPU: 0 PID: 3606 Comm: syz-executor151 Not tainted 5.18.0-rc5-syzkaller-00165-g810c2f0a3f86 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 + ubsan_epilogue+0xb/0x50 lib/ubsan.c:151 + __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x187 lib/ubsan.c:322 + tcf_pedit_init.cold+0x1a/0x1f net/sched/act_pedit.c:238 + tcf_action_init_1+0x414/0x690 net/sched/act_api.c:1367 + tcf_action_init+0x530/0x8d0 net/sched/act_api.c:1432 + tcf_action_add+0xf9/0x480 net/sched/act_api.c:1956 + tc_ctl_action+0x346/0x470 net/sched/act_api.c:2015 + rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5993 + netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502 + netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] + netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345 + netlink_sendmsg+0x904/0xe00 net/netlink/af_netlink.c:1921 + sock_sendmsg_nosec net/socket.c:705 [inline] + sock_sendmsg+0xcf/0x120 net/socket.c:725 + ____sys_sendmsg+0x6e2/0x800 net/socket.c:2413 + ___sys_sendmsg+0xf3/0x170 net/socket.c:2467 + __sys_sendmsg+0xe5/0x1b0 net/socket.c:2496 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae +RIP: 0033:0x7fe36e9e1b59 +Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007ffef796fe88 EFLAGS: 00000246 ORIG_RAX: 000000000000002e +RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe36e9e1b59 +RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000003 +RBP: 00007fe36e9a5d00 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe36e9a5d90 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 + + +The 'shift' field is not validated, and any value above 31 will +trigger out-of-bounds. The issue predates the git history, but +syzbot was able to trigger it only after the commit mentioned in +the fixes tag, and this change only applies on top of such commit. + +Address the issue bounding the 'shift' value to the maximum allowed +by the relevant operator. + +Reported-and-tested-by: syzbot+8ed8fc4c57e9dcf23ca6@syzkaller.appspotmail.com +Fixes: 8b796475fd78 ("net/sched: act_pedit: really ensure the skb is writable") +Signed-off-by: Paolo Abeni +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/act_pedit.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c +index 0eaaf1f45de1..211c757bfc3c 100644 +--- a/net/sched/act_pedit.c ++++ b/net/sched/act_pedit.c +@@ -232,6 +232,10 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla, + for (i = 0; i < p->tcfp_nkeys; ++i) { + u32 cur = p->tcfp_keys[i].off; + ++ /* sanitize the shift value for any later use */ ++ p->tcfp_keys[i].shift = min_t(size_t, BITS_PER_TYPE(int) - 1, ++ p->tcfp_keys[i].shift); ++ + /* The AT option can read a single byte, we can bound the actual + * value with uchar max. + */ +-- +2.35.1 + diff --git a/queue-5.17/net-stmmac-fix-missing-pci_disable_device-on-error-i.patch b/queue-5.17/net-stmmac-fix-missing-pci_disable_device-on-error-i.patch new file mode 100644 index 00000000000..3cecd0ec8e6 --- /dev/null +++ b/queue-5.17/net-stmmac-fix-missing-pci_disable_device-on-error-i.patch @@ -0,0 +1,46 @@ +From a1c583ea666642665252fe37010edfacf3b1d6e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 May 2022 11:13:16 +0800 +Subject: net: stmmac: fix missing pci_disable_device() on error in + stmmac_pci_probe() + +From: Yang Yingliang + +[ Upstream commit 0807ce0b010418a191e0e4009803b2d74c3245d5 ] + +Switch to using pcim_enable_device() to avoid missing pci_disable_device(). + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20220510031316.1780409-1-yangyingliang@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c +index fcf17d8a0494..644bb54f5f02 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c +@@ -181,7 +181,7 @@ static int stmmac_pci_probe(struct pci_dev *pdev, + return -ENOMEM; + + /* Enable pci device */ +- ret = pci_enable_device(pdev); ++ ret = pcim_enable_device(pdev); + if (ret) { + dev_err(&pdev->dev, "%s: ERROR: failed to enable device\n", + __func__); +@@ -241,8 +241,6 @@ static void stmmac_pci_remove(struct pci_dev *pdev) + pcim_iounmap_regions(pdev, BIT(i)); + break; + } +- +- pci_disable_device(pdev); + } + + static int __maybe_unused stmmac_pci_suspend(struct device *dev) +-- +2.35.1 + diff --git a/queue-5.17/net-systemport-fix-an-error-handling-path-in-bcm_sys.patch b/queue-5.17/net-systemport-fix-an-error-handling-path-in-bcm_sys.patch new file mode 100644 index 00000000000..446321de0c1 --- /dev/null +++ b/queue-5.17/net-systemport-fix-an-error-handling-path-in-bcm_sys.patch @@ -0,0 +1,44 @@ +From ac5391cbdaf4b40666786587997e752785515f97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 May 2022 19:01:56 +0200 +Subject: net: systemport: Fix an error handling path in bcm_sysport_probe() + +From: Christophe JAILLET + +[ Upstream commit ef6b1cd11962aec21c58d137006ab122dbc8d6fd ] + +if devm_clk_get_optional() fails, we still need to go through the error +handling path. + +Add the missing goto. + +Fixes: 6328a126896ea ("net: systemport: Manage Wake-on-LAN clock") +Signed-off-by: Christophe JAILLET +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/99d70634a81c229885ae9e4ee69b2035749f7edc.1652634040.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bcmsysport.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c +index 60dde29974bf..df51be3cbe06 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -2585,8 +2585,10 @@ static int bcm_sysport_probe(struct platform_device *pdev) + device_set_wakeup_capable(&pdev->dev, 1); + + priv->wol_clk = devm_clk_get_optional(&pdev->dev, "sw_sysportwol"); +- if (IS_ERR(priv->wol_clk)) +- return PTR_ERR(priv->wol_clk); ++ if (IS_ERR(priv->wol_clk)) { ++ ret = PTR_ERR(priv->wol_clk); ++ goto err_deregister_fixed_link; ++ } + + /* Set the needed headroom once and for all */ + BUILD_BUG_ON(sizeof(struct bcm_tsb) != 8); +-- +2.35.1 + diff --git a/queue-5.17/net-vmxnet3-fix-possible-null-pointer-dereference-in.patch b/queue-5.17/net-vmxnet3-fix-possible-null-pointer-dereference-in.patch new file mode 100644 index 00000000000..c85445a2493 --- /dev/null +++ b/queue-5.17/net-vmxnet3-fix-possible-null-pointer-dereference-in.patch @@ -0,0 +1,68 @@ +From 93fe6d07b5c67364675191b0fe6bdc54c567258e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 May 2022 13:07:11 +0800 +Subject: net: vmxnet3: fix possible NULL pointer dereference in + vmxnet3_rq_cleanup() + +From: Zixuan Fu + +[ Upstream commit edf410cb74dc612fd47ef5be319c5a0bcd6e6ccd ] + +In vmxnet3_rq_create(), when dma_alloc_coherent() fails, +vmxnet3_rq_destroy() is called. It sets rq->rx_ring[i].base to NULL. Then +vmxnet3_rq_create() returns an error to its callers mxnet3_rq_create_all() +-> vmxnet3_change_mtu(). Then vmxnet3_change_mtu() calls +vmxnet3_force_close() -> dev_close() in error handling code. And the driver +calls vmxnet3_close() -> vmxnet3_quiesce_dev() -> vmxnet3_rq_cleanup_all() +-> vmxnet3_rq_cleanup(). In vmxnet3_rq_cleanup(), +rq->rx_ring[ring_idx].base is accessed, but this variable is NULL, causing +a NULL pointer dereference. + +To fix this possible bug, an if statement is added to check whether +rq->rx_ring[0].base is NULL in vmxnet3_rq_cleanup() and exit early if so. + +The error log in our fault-injection testing is shown as follows: + +[ 65.220135] BUG: kernel NULL pointer dereference, address: 0000000000000008 +... +[ 65.222633] RIP: 0010:vmxnet3_rq_cleanup_all+0x396/0x4e0 [vmxnet3] +... +[ 65.227977] Call Trace: +... +[ 65.228262] vmxnet3_quiesce_dev+0x80f/0x8a0 [vmxnet3] +[ 65.228580] vmxnet3_close+0x2c4/0x3f0 [vmxnet3] +[ 65.228866] __dev_close_many+0x288/0x350 +[ 65.229607] dev_close_many+0xa4/0x480 +[ 65.231124] dev_close+0x138/0x230 +[ 65.231933] vmxnet3_force_close+0x1f0/0x240 [vmxnet3] +[ 65.232248] vmxnet3_change_mtu+0x75d/0x920 [vmxnet3] +... + +Fixes: d1a890fa37f27 ("net: VMware virtual Ethernet NIC driver: vmxnet3") +Reported-by: TOTE Robot +Signed-off-by: Zixuan Fu +Link: https://lore.kernel.org/r/20220514050711.2636709-1-r33s3n6@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/vmxnet3/vmxnet3_drv.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c +index 1154f1884212..93e8d119d45f 100644 +--- a/drivers/net/vmxnet3/vmxnet3_drv.c ++++ b/drivers/net/vmxnet3/vmxnet3_drv.c +@@ -1668,6 +1668,10 @@ vmxnet3_rq_cleanup(struct vmxnet3_rx_queue *rq, + u32 i, ring_idx; + struct Vmxnet3_RxDesc *rxd; + ++ /* ring has already been cleaned up */ ++ if (!rq->rx_ring[0].base) ++ return; ++ + for (ring_idx = 0; ring_idx < 2; ring_idx++) { + for (i = 0; i < rq->rx_ring[ring_idx].size; i++) { + #ifdef __BIG_ENDIAN_BITFIELD +-- +2.35.1 + diff --git a/queue-5.17/net-vmxnet3-fix-possible-use-after-free-bugs-in-vmxn.patch b/queue-5.17/net-vmxnet3-fix-possible-use-after-free-bugs-in-vmxn.patch new file mode 100644 index 00000000000..7a96925bc04 --- /dev/null +++ b/queue-5.17/net-vmxnet3-fix-possible-use-after-free-bugs-in-vmxn.patch @@ -0,0 +1,94 @@ +From bce0cc1981c0da5bcc087c346bc40e4487ca5406 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 May 2022 13:06:56 +0800 +Subject: net: vmxnet3: fix possible use-after-free bugs in + vmxnet3_rq_alloc_rx_buf() + +From: Zixuan Fu + +[ Upstream commit 9e7fef9521e73ca8afd7da9e58c14654b02dfad8 ] + +In vmxnet3_rq_alloc_rx_buf(), when dma_map_single() fails, rbi->skb is +freed immediately. Similarly, in another branch, when dma_map_page() fails, +rbi->page is also freed. In the two cases, vmxnet3_rq_alloc_rx_buf() +returns an error to its callers vmxnet3_rq_init() -> vmxnet3_rq_init_all() +-> vmxnet3_activate_dev(). Then vmxnet3_activate_dev() calls +vmxnet3_rq_cleanup_all() in error handling code, and rbi->skb or rbi->page +are freed again in vmxnet3_rq_cleanup_all(), causing use-after-free bugs. + +To fix these possible bugs, rbi->skb and rbi->page should be cleared after +they are freed. + +The error log in our fault-injection testing is shown as follows: + +[ 14.319016] BUG: KASAN: use-after-free in consume_skb+0x2f/0x150 +... +[ 14.321586] Call Trace: +... +[ 14.325357] consume_skb+0x2f/0x150 +[ 14.325671] vmxnet3_rq_cleanup_all+0x33a/0x4e0 [vmxnet3] +[ 14.326150] vmxnet3_activate_dev+0xb9d/0x2ca0 [vmxnet3] +[ 14.326616] vmxnet3_open+0x387/0x470 [vmxnet3] +... +[ 14.361675] Allocated by task 351: +... +[ 14.362688] __netdev_alloc_skb+0x1b3/0x6f0 +[ 14.362960] vmxnet3_rq_alloc_rx_buf+0x1b0/0x8d0 [vmxnet3] +[ 14.363317] vmxnet3_activate_dev+0x3e3/0x2ca0 [vmxnet3] +[ 14.363661] vmxnet3_open+0x387/0x470 [vmxnet3] +... +[ 14.367309] +[ 14.367412] Freed by task 351: +... +[ 14.368932] __dev_kfree_skb_any+0xd2/0xe0 +[ 14.369193] vmxnet3_rq_alloc_rx_buf+0x71e/0x8d0 [vmxnet3] +[ 14.369544] vmxnet3_activate_dev+0x3e3/0x2ca0 [vmxnet3] +[ 14.369883] vmxnet3_open+0x387/0x470 [vmxnet3] +[ 14.370174] __dev_open+0x28a/0x420 +[ 14.370399] __dev_change_flags+0x192/0x590 +[ 14.370667] dev_change_flags+0x7a/0x180 +[ 14.370919] do_setlink+0xb28/0x3570 +[ 14.371150] rtnl_newlink+0x1160/0x1740 +[ 14.371399] rtnetlink_rcv_msg+0x5bf/0xa50 +[ 14.371661] netlink_rcv_skb+0x1cd/0x3e0 +[ 14.371913] netlink_unicast+0x5dc/0x840 +[ 14.372169] netlink_sendmsg+0x856/0xc40 +[ 14.372420] ____sys_sendmsg+0x8a7/0x8d0 +[ 14.372673] __sys_sendmsg+0x1c2/0x270 +[ 14.372914] do_syscall_64+0x41/0x90 +[ 14.373145] entry_SYSCALL_64_after_hwframe+0x44/0xae +... + +Fixes: 5738a09d58d5a ("vmxnet3: fix checks for dma mapping errors") +Reported-by: TOTE Robot +Signed-off-by: Zixuan Fu +Link: https://lore.kernel.org/r/20220514050656.2636588-1-r33s3n6@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/vmxnet3/vmxnet3_drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c +index d9d90baac72a..1154f1884212 100644 +--- a/drivers/net/vmxnet3/vmxnet3_drv.c ++++ b/drivers/net/vmxnet3/vmxnet3_drv.c +@@ -589,6 +589,7 @@ vmxnet3_rq_alloc_rx_buf(struct vmxnet3_rx_queue *rq, u32 ring_idx, + if (dma_mapping_error(&adapter->pdev->dev, + rbi->dma_addr)) { + dev_kfree_skb_any(rbi->skb); ++ rbi->skb = NULL; + rq->stats.rx_buf_alloc_failure++; + break; + } +@@ -613,6 +614,7 @@ vmxnet3_rq_alloc_rx_buf(struct vmxnet3_rx_queue *rq, u32 ring_idx, + if (dma_mapping_error(&adapter->pdev->dev, + rbi->dma_addr)) { + put_page(rbi->page); ++ rbi->page = NULL; + rq->stats.rx_buf_alloc_failure++; + break; + } +-- +2.35.1 + diff --git a/queue-5.17/netfilter-flowtable-fix-excessive-hw-offload-attempt.patch b/queue-5.17/netfilter-flowtable-fix-excessive-hw-offload-attempt.patch new file mode 100644 index 00000000000..b7792ca4c26 --- /dev/null +++ b/queue-5.17/netfilter-flowtable-fix-excessive-hw-offload-attempt.patch @@ -0,0 +1,41 @@ +From 79a6349a75068045678bc4a482e19dc70c458db1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 May 2022 14:26:13 +0200 +Subject: netfilter: flowtable: fix excessive hw offload attempts after failure + +From: Felix Fietkau + +[ Upstream commit 396ef64113a8ba01c46315d67a99db8dde3eef51 ] + +If a flow cannot be offloaded, the code currently repeatedly tries again as +quickly as possible, which can significantly increase system load. +Fix this by limiting flow timeout update and hardware offload retry to once +per second. + +Fixes: c07531c01d82 ("netfilter: flowtable: Remove redundant hw refresh bit") +Signed-off-by: Felix Fietkau +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_flow_table_core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c +index b90eca7a2f22..52e7f94d2450 100644 +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -329,8 +329,10 @@ void flow_offload_refresh(struct nf_flowtable *flow_table, + u32 timeout; + + timeout = nf_flowtable_time_stamp + flow_offload_get_timeout(flow); +- if (READ_ONCE(flow->timeout) != timeout) ++ if (timeout - READ_ONCE(flow->timeout) > HZ) + WRITE_ONCE(flow->timeout, timeout); ++ else ++ return; + + if (likely(!nf_flowtable_hw_offload(flow_table))) + return; +-- +2.35.1 + diff --git a/queue-5.17/netfilter-flowtable-fix-tcp-flow-teardown.patch b/queue-5.17/netfilter-flowtable-fix-tcp-flow-teardown.patch new file mode 100644 index 00000000000..62d4576ec3d --- /dev/null +++ b/queue-5.17/netfilter-flowtable-fix-tcp-flow-teardown.patch @@ -0,0 +1,162 @@ +From b27a108487a65557916c53708728ad3aa8d2dbe6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 May 2022 10:44:14 +0200 +Subject: netfilter: flowtable: fix TCP flow teardown + +From: Pablo Neira Ayuso + +[ Upstream commit e5eaac2beb54f0a16ff851125082d9faeb475572 ] + +This patch addresses three possible problems: + +1. ct gc may race to undo the timeout adjustment of the packet path, leaving + the conntrack entry in place with the internal offload timeout (one day). + +2. ct gc removes the ct because the IPS_OFFLOAD_BIT is not set and the CLOSE + timeout is reached before the flow offload del. + +3. tcp ct is always set to ESTABLISHED with a very long timeout + in flow offload teardown/delete even though the state might be already + CLOSED. Also as a remark we cannot assume that the FIN or RST packet + is hitting flow table teardown as the packet might get bumped to the + slow path in nftables. + +This patch resets IPS_OFFLOAD_BIT from flow_offload_teardown(), so +conntrack handles the tcp rst/fin packet which triggers the CLOSE/FIN +state transition. + +Moreover, teturn the connection's ownership to conntrack upon teardown +by clearing the offload flag and fixing the established timeout value. +The flow table GC thread will asynchonrnously free the flow table and +hardware offload entries. + +Before this patch, the IPS_OFFLOAD_BIT remained set for expired flows on +which is also misleading since the flow is back to classic conntrack +path. + +If nf_ct_delete() removes the entry from the conntrack table, then it +calls nf_ct_put() which decrements the refcnt. This is not a problem +because the flowtable holds a reference to the conntrack object from +flow_offload_alloc() path which is released via flow_offload_free(). + +This patch also updates nft_flow_offload to skip packets in SYN_RECV +state. Since we might miss or bump packets to slow path, we do not know +what will happen there while we are still in SYN_RECV, this patch +postpones offload up to the next packet which also aligns to the +existing behaviour in tc-ct. + +flow_offload_teardown() does not reset the existing tcp state from +flow_offload_fixup_tcp() to ESTABLISHED anymore, packets bump to slow +path might have already update the state to CLOSE/FIN. + +Joint work with Oz and Sven. + +Fixes: 1e5b2471bcc4 ("netfilter: nf_flow_table: teardown flow timeout race") +Signed-off-by: Oz Shlomo +Signed-off-by: Sven Auhagen +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_flow_table_core.c | 33 +++++++----------------------- + net/netfilter/nft_flow_offload.c | 3 ++- + 2 files changed, 9 insertions(+), 27 deletions(-) + +diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c +index 52e7f94d2450..58f3f77b3eb2 100644 +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -173,12 +173,11 @@ EXPORT_SYMBOL_GPL(flow_offload_route_init); + + static void flow_offload_fixup_tcp(struct ip_ct_tcp *tcp) + { +- tcp->state = TCP_CONNTRACK_ESTABLISHED; + tcp->seen[0].td_maxwin = 0; + tcp->seen[1].td_maxwin = 0; + } + +-static void flow_offload_fixup_ct_timeout(struct nf_conn *ct) ++static void flow_offload_fixup_ct(struct nf_conn *ct) + { + struct net *net = nf_ct_net(ct); + int l4num = nf_ct_protonum(ct); +@@ -187,7 +186,9 @@ static void flow_offload_fixup_ct_timeout(struct nf_conn *ct) + if (l4num == IPPROTO_TCP) { + struct nf_tcp_net *tn = nf_tcp_pernet(net); + +- timeout = tn->timeouts[TCP_CONNTRACK_ESTABLISHED]; ++ flow_offload_fixup_tcp(&ct->proto.tcp); ++ ++ timeout = tn->timeouts[ct->proto.tcp.state]; + timeout -= tn->offload_timeout; + } else if (l4num == IPPROTO_UDP) { + struct nf_udp_net *tn = nf_udp_pernet(net); +@@ -205,18 +206,6 @@ static void flow_offload_fixup_ct_timeout(struct nf_conn *ct) + WRITE_ONCE(ct->timeout, nfct_time_stamp + timeout); + } + +-static void flow_offload_fixup_ct_state(struct nf_conn *ct) +-{ +- if (nf_ct_protonum(ct) == IPPROTO_TCP) +- flow_offload_fixup_tcp(&ct->proto.tcp); +-} +- +-static void flow_offload_fixup_ct(struct nf_conn *ct) +-{ +- flow_offload_fixup_ct_state(ct); +- flow_offload_fixup_ct_timeout(ct); +-} +- + static void flow_offload_route_release(struct flow_offload *flow) + { + nft_flow_dst_release(flow, FLOW_OFFLOAD_DIR_ORIGINAL); +@@ -355,22 +344,14 @@ static void flow_offload_del(struct nf_flowtable *flow_table, + rhashtable_remove_fast(&flow_table->rhashtable, + &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node, + nf_flow_offload_rhash_params); +- +- clear_bit(IPS_OFFLOAD_BIT, &flow->ct->status); +- +- if (nf_flow_has_expired(flow)) +- flow_offload_fixup_ct(flow->ct); +- else +- flow_offload_fixup_ct_timeout(flow->ct); +- + flow_offload_free(flow); + } + + void flow_offload_teardown(struct flow_offload *flow) + { ++ clear_bit(IPS_OFFLOAD_BIT, &flow->ct->status); + set_bit(NF_FLOW_TEARDOWN, &flow->flags); +- +- flow_offload_fixup_ct_state(flow->ct); ++ flow_offload_fixup_ct(flow->ct); + } + EXPORT_SYMBOL_GPL(flow_offload_teardown); + +@@ -460,7 +441,7 @@ static void nf_flow_offload_gc_step(struct flow_offload *flow, void *data) + if (nf_flow_has_expired(flow) || + nf_ct_is_dying(flow->ct) || + nf_flow_has_stale_dst(flow)) +- set_bit(NF_FLOW_TEARDOWN, &flow->flags); ++ flow_offload_teardown(flow); + + if (test_bit(NF_FLOW_TEARDOWN, &flow->flags)) { + if (test_bit(NF_FLOW_HW, &flow->flags)) { +diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c +index 12145a80ef03..aac6db8680d4 100644 +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -298,7 +298,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, + case IPPROTO_TCP: + tcph = skb_header_pointer(pkt->skb, nft_thoff(pkt), + sizeof(_tcph), &_tcph); +- if (unlikely(!tcph || tcph->fin || tcph->rst)) ++ if (unlikely(!tcph || tcph->fin || tcph->rst || ++ !nf_conntrack_tcp_established(ct))) + goto out; + break; + case IPPROTO_UDP: +-- +2.35.1 + diff --git a/queue-5.17/netfilter-flowtable-move-dst_check-to-packet-path.patch b/queue-5.17/netfilter-flowtable-move-dst_check-to-packet-path.patch new file mode 100644 index 00000000000..0fa2645c7be --- /dev/null +++ b/queue-5.17/netfilter-flowtable-move-dst_check-to-packet-path.patch @@ -0,0 +1,110 @@ +From 222bf14fd42ef0d6de2f4da0ae33cf59a8f84b89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 May 2022 12:55:30 +0200 +Subject: netfilter: flowtable: move dst_check to packet path + +From: Ritaro Takenaka + +[ Upstream commit 2738d9d963bd1f06d5114c2b4fa5771a95703991 ] + +Fixes sporadic IPv6 packet loss when flow offloading is enabled. + +IPv6 route GC and flowtable GC are not synchronized. +When dst_cache becomes stale and a packet passes through the flow before +the flowtable GC teardowns it, the packet can be dropped. +So, it is necessary to check dst every time in packet path. + +Fixes: 227e1e4d0d6c ("netfilter: nf_flowtable: skip device lookup from interface index") +Signed-off-by: Ritaro Takenaka +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_flow_table_core.c | 23 +---------------------- + net/netfilter/nf_flow_table_ip.c | 19 +++++++++++++++++++ + 2 files changed, 20 insertions(+), 22 deletions(-) + +diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c +index de783c9094d7..9fb407084c50 100644 +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -415,32 +415,11 @@ nf_flow_table_iterate(struct nf_flowtable *flow_table, + return err; + } + +-static bool flow_offload_stale_dst(struct flow_offload_tuple *tuple) +-{ +- struct dst_entry *dst; +- +- if (tuple->xmit_type == FLOW_OFFLOAD_XMIT_NEIGH || +- tuple->xmit_type == FLOW_OFFLOAD_XMIT_XFRM) { +- dst = tuple->dst_cache; +- if (!dst_check(dst, tuple->dst_cookie)) +- return true; +- } +- +- return false; +-} +- +-static bool nf_flow_has_stale_dst(struct flow_offload *flow) +-{ +- return flow_offload_stale_dst(&flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple) || +- flow_offload_stale_dst(&flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple); +-} +- + static void nf_flow_offload_gc_step(struct nf_flowtable *flow_table, + struct flow_offload *flow, void *data) + { + if (nf_flow_has_expired(flow) || +- nf_ct_is_dying(flow->ct) || +- nf_flow_has_stale_dst(flow)) ++ nf_ct_is_dying(flow->ct)) + flow_offload_teardown(flow); + + if (test_bit(NF_FLOW_TEARDOWN, &flow->flags)) { +diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c +index 6257d87c3a56..28026467b54c 100644 +--- a/net/netfilter/nf_flow_table_ip.c ++++ b/net/netfilter/nf_flow_table_ip.c +@@ -227,6 +227,15 @@ static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu) + return true; + } + ++static inline bool nf_flow_dst_check(struct flow_offload_tuple *tuple) ++{ ++ if (tuple->xmit_type != FLOW_OFFLOAD_XMIT_NEIGH && ++ tuple->xmit_type != FLOW_OFFLOAD_XMIT_XFRM) ++ return true; ++ ++ return dst_check(tuple->dst_cache, tuple->dst_cookie); ++} ++ + static unsigned int nf_flow_xmit_xfrm(struct sk_buff *skb, + const struct nf_hook_state *state, + struct dst_entry *dst) +@@ -346,6 +355,11 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb, + if (nf_flow_state_check(flow, iph->protocol, skb, thoff)) + return NF_ACCEPT; + ++ if (!nf_flow_dst_check(&tuplehash->tuple)) { ++ flow_offload_teardown(flow); ++ return NF_ACCEPT; ++ } ++ + if (skb_try_make_writable(skb, thoff + hdrsize)) + return NF_DROP; + +@@ -582,6 +596,11 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb, + if (nf_flow_state_check(flow, ip6h->nexthdr, skb, thoff)) + return NF_ACCEPT; + ++ if (!nf_flow_dst_check(&tuplehash->tuple)) { ++ flow_offload_teardown(flow); ++ return NF_ACCEPT; ++ } ++ + if (skb_try_make_writable(skb, thoff + hdrsize)) + return NF_DROP; + +-- +2.35.1 + diff --git a/queue-5.17/netfilter-flowtable-pass-flowtable-to-nf_flow_table_.patch b/queue-5.17/netfilter-flowtable-pass-flowtable-to-nf_flow_table_.patch new file mode 100644 index 00000000000..99f27eb59e1 --- /dev/null +++ b/queue-5.17/netfilter-flowtable-pass-flowtable-to-nf_flow_table_.patch @@ -0,0 +1,90 @@ +From 240f631beee3dc1c8f3fddab6e048a8c85018c40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Mar 2022 13:11:24 +0100 +Subject: netfilter: flowtable: pass flowtable to nf_flow_table_iterate() + +From: Pablo Neira Ayuso + +[ Upstream commit 217cff36e885627c41a14e803fc44f9cbc945767 ] + +The flowtable object is already passed as argument to +nf_flow_table_iterate(), do use not data pointer to pass flowtable. + +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_flow_table_core.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c +index 58f3f77b3eb2..de783c9094d7 100644 +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -382,7 +382,8 @@ EXPORT_SYMBOL_GPL(flow_offload_lookup); + + static int + nf_flow_table_iterate(struct nf_flowtable *flow_table, +- void (*iter)(struct flow_offload *flow, void *data), ++ void (*iter)(struct nf_flowtable *flowtable, ++ struct flow_offload *flow, void *data), + void *data) + { + struct flow_offload_tuple_rhash *tuplehash; +@@ -406,7 +407,7 @@ nf_flow_table_iterate(struct nf_flowtable *flow_table, + + flow = container_of(tuplehash, struct flow_offload, tuplehash[0]); + +- iter(flow, data); ++ iter(flow_table, flow, data); + } + rhashtable_walk_stop(&hti); + rhashtable_walk_exit(&hti); +@@ -434,10 +435,9 @@ static bool nf_flow_has_stale_dst(struct flow_offload *flow) + flow_offload_stale_dst(&flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple); + } + +-static void nf_flow_offload_gc_step(struct flow_offload *flow, void *data) ++static void nf_flow_offload_gc_step(struct nf_flowtable *flow_table, ++ struct flow_offload *flow, void *data) + { +- struct nf_flowtable *flow_table = data; +- + if (nf_flow_has_expired(flow) || + nf_ct_is_dying(flow->ct) || + nf_flow_has_stale_dst(flow)) +@@ -462,7 +462,7 @@ static void nf_flow_offload_work_gc(struct work_struct *work) + struct nf_flowtable *flow_table; + + flow_table = container_of(work, struct nf_flowtable, gc_work.work); +- nf_flow_table_iterate(flow_table, nf_flow_offload_gc_step, flow_table); ++ nf_flow_table_iterate(flow_table, nf_flow_offload_gc_step, NULL); + queue_delayed_work(system_power_efficient_wq, &flow_table->gc_work, HZ); + } + +@@ -578,7 +578,8 @@ int nf_flow_table_init(struct nf_flowtable *flowtable) + } + EXPORT_SYMBOL_GPL(nf_flow_table_init); + +-static void nf_flow_table_do_cleanup(struct flow_offload *flow, void *data) ++static void nf_flow_table_do_cleanup(struct nf_flowtable *flow_table, ++ struct flow_offload *flow, void *data) + { + struct net_device *dev = data; + +@@ -620,11 +621,10 @@ void nf_flow_table_free(struct nf_flowtable *flow_table) + + cancel_delayed_work_sync(&flow_table->gc_work); + nf_flow_table_iterate(flow_table, nf_flow_table_do_cleanup, NULL); +- nf_flow_table_iterate(flow_table, nf_flow_offload_gc_step, flow_table); ++ nf_flow_table_iterate(flow_table, nf_flow_offload_gc_step, NULL); + nf_flow_table_offload_flush(flow_table); + if (nf_flowtable_hw_offload(flow_table)) +- nf_flow_table_iterate(flow_table, nf_flow_offload_gc_step, +- flow_table); ++ nf_flow_table_iterate(flow_table, nf_flow_offload_gc_step, NULL); + rhashtable_destroy(&flow_table->rhashtable); + } + EXPORT_SYMBOL_GPL(nf_flow_table_free); +-- +2.35.1 + diff --git a/queue-5.17/netfilter-nft_flow_offload-fix-offload-with-pppoe-vl.patch b/queue-5.17/netfilter-nft_flow_offload-fix-offload-with-pppoe-vl.patch new file mode 100644 index 00000000000..f7bbc233287 --- /dev/null +++ b/queue-5.17/netfilter-nft_flow_offload-fix-offload-with-pppoe-vl.patch @@ -0,0 +1,38 @@ +From 83ae80890b58a2ea0ed64d2c49749d100adb7830 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 May 2022 14:26:16 +0200 +Subject: netfilter: nft_flow_offload: fix offload with pppoe + vlan + +From: Felix Fietkau + +[ Upstream commit 2456074935003b66c40f78df6adfc722435d43ea ] + +When running a combination of PPPoE on top of a VLAN, we need to set +info->outdev to the PPPoE device, otherwise PPPoE encap is skipped +during software offload. + +Fixes: 72efd585f714 ("netfilter: flowtable: add pppoe support") +Signed-off-by: Felix Fietkau +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_flow_offload.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c +index dd824193c920..12145a80ef03 100644 +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -123,7 +123,8 @@ static void nft_dev_path_info(const struct net_device_path_stack *stack, + info->indev = NULL; + break; + } +- info->outdev = path->dev; ++ if (!info->outdev) ++ info->outdev = path->dev; + info->encap[info->num_encaps].id = path->encap.id; + info->encap[info->num_encaps].proto = path->encap.proto; + info->num_encaps++; +-- +2.35.1 + diff --git a/queue-5.17/netfilter-nft_flow_offload-skip-dst-neigh-lookup-for.patch b/queue-5.17/netfilter-nft_flow_offload-skip-dst-neigh-lookup-for.patch new file mode 100644 index 00000000000..738d083c5dd --- /dev/null +++ b/queue-5.17/netfilter-nft_flow_offload-skip-dst-neigh-lookup-for.patch @@ -0,0 +1,78 @@ +From 029bf5f7fed2d19250a34a8e9ddbaa20871e267c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 May 2022 14:26:14 +0200 +Subject: netfilter: nft_flow_offload: skip dst neigh lookup for ppp devices + +From: Felix Fietkau + +[ Upstream commit 45ca3e61999e9a30ca2b7cfbf9da8a9f8d13be31 ] + +The dst entry does not contain a valid hardware address, so skip the lookup +in order to avoid running into errors here. +The proper hardware address is filled in from nft_dev_path_info + +Fixes: 72efd585f714 ("netfilter: flowtable: add pppoe support") +Signed-off-by: Felix Fietkau +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_flow_offload.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c +index 0af34ad41479..dd824193c920 100644 +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -36,6 +36,15 @@ static void nft_default_forward_path(struct nf_flow_route *route, + route->tuple[dir].xmit_type = nft_xmit_type(dst_cache); + } + ++static bool nft_is_valid_ether_device(const struct net_device *dev) ++{ ++ if (!dev || (dev->flags & IFF_LOOPBACK) || dev->type != ARPHRD_ETHER || ++ dev->addr_len != ETH_ALEN || !is_valid_ether_addr(dev->dev_addr)) ++ return false; ++ ++ return true; ++} ++ + static int nft_dev_fill_forward_path(const struct nf_flow_route *route, + const struct dst_entry *dst_cache, + const struct nf_conn *ct, +@@ -47,6 +56,9 @@ static int nft_dev_fill_forward_path(const struct nf_flow_route *route, + struct neighbour *n; + u8 nud_state; + ++ if (!nft_is_valid_ether_device(dev)) ++ goto out; ++ + n = dst_neigh_lookup(dst_cache, daddr); + if (!n) + return -1; +@@ -60,6 +72,7 @@ static int nft_dev_fill_forward_path(const struct nf_flow_route *route, + if (!(nud_state & NUD_VALID)) + return -1; + ++out: + return dev_fill_forward_path(dev, ha, stack); + } + +@@ -78,15 +91,6 @@ struct nft_forward_info { + enum flow_offload_xmit_type xmit_type; + }; + +-static bool nft_is_valid_ether_device(const struct net_device *dev) +-{ +- if (!dev || (dev->flags & IFF_LOOPBACK) || dev->type != ARPHRD_ETHER || +- dev->addr_len != ETH_ALEN || !is_valid_ether_addr(dev->dev_addr)) +- return false; +- +- return true; +-} +- + static void nft_dev_path_info(const struct net_device_path_stack *stack, + struct nft_forward_info *info, + unsigned char *ha, struct nf_flowtable *flowtable) +-- +2.35.1 + diff --git a/queue-5.17/nfc-nci-fix-sleep-in-atomic-context-bugs-caused-by-n.patch b/queue-5.17/nfc-nci-fix-sleep-in-atomic-context-bugs-caused-by-n.patch new file mode 100644 index 00000000000..11d7453a30c --- /dev/null +++ b/queue-5.17/nfc-nci-fix-sleep-in-atomic-context-bugs-caused-by-n.patch @@ -0,0 +1,81 @@ +From bb20d4ba7e65492e8b1df076f3d2ecd30c4d6ffe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 May 2022 09:25:30 +0800 +Subject: NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc + +From: Duoming Zhou + +[ Upstream commit 23dd4581350d4ffa23d58976ec46408f8f4c1e16 ] + +There are sleep in atomic context bugs when the request to secure +element of st-nci is timeout. The root cause is that nci_skb_alloc +with GFP_KERNEL parameter is called in st_nci_se_wt_timeout which is +a timer handler. The call paths that could trigger bugs are shown below: + + (interrupt context 1) +st_nci_se_wt_timeout + nci_hci_send_event + nci_hci_send_data + nci_skb_alloc(..., GFP_KERNEL) //may sleep + + (interrupt context 2) +st_nci_se_wt_timeout + nci_hci_send_event + nci_hci_send_data + nci_send_data + nci_queue_tx_data_frags + nci_skb_alloc(..., GFP_KERNEL) //may sleep + +This patch changes allocation mode of nci_skb_alloc from GFP_KERNEL to +GFP_ATOMIC in order to prevent atomic context sleeping. The GFP_ATOMIC +flag makes memory allocation operation could be used in atomic context. + +Fixes: ed06aeefdac3 ("nfc: st-nci: Rename st21nfcb to st-nci") +Signed-off-by: Duoming Zhou +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20220517012530.75714-1-duoming@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/nfc/nci/data.c | 2 +- + net/nfc/nci/hci.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/nfc/nci/data.c b/net/nfc/nci/data.c +index 6055dc9a82aa..aa5e712adf07 100644 +--- a/net/nfc/nci/data.c ++++ b/net/nfc/nci/data.c +@@ -118,7 +118,7 @@ static int nci_queue_tx_data_frags(struct nci_dev *ndev, + + skb_frag = nci_skb_alloc(ndev, + (NCI_DATA_HDR_SIZE + frag_len), +- GFP_KERNEL); ++ GFP_ATOMIC); + if (skb_frag == NULL) { + rc = -ENOMEM; + goto free_exit; +diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c +index 19703a649b5a..78c4b6addf15 100644 +--- a/net/nfc/nci/hci.c ++++ b/net/nfc/nci/hci.c +@@ -153,7 +153,7 @@ static int nci_hci_send_data(struct nci_dev *ndev, u8 pipe, + + i = 0; + skb = nci_skb_alloc(ndev, conn_info->max_pkt_payload_len + +- NCI_DATA_HDR_SIZE, GFP_KERNEL); ++ NCI_DATA_HDR_SIZE, GFP_ATOMIC); + if (!skb) + return -ENOMEM; + +@@ -184,7 +184,7 @@ static int nci_hci_send_data(struct nci_dev *ndev, u8 pipe, + if (i < data_len) { + skb = nci_skb_alloc(ndev, + conn_info->max_pkt_payload_len + +- NCI_DATA_HDR_SIZE, GFP_KERNEL); ++ NCI_DATA_HDR_SIZE, GFP_ATOMIC); + if (!skb) + return -ENOMEM; + +-- +2.35.1 + diff --git a/queue-5.17/nl80211-fix-locking-in-nl80211_set_tx_bitrate_mask.patch b/queue-5.17/nl80211-fix-locking-in-nl80211_set_tx_bitrate_mask.patch new file mode 100644 index 00000000000..7f4a457cfd4 --- /dev/null +++ b/queue-5.17/nl80211-fix-locking-in-nl80211_set_tx_bitrate_mask.patch @@ -0,0 +1,53 @@ +From b1a0e7dff325444744e3c2290991a7012803c407 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 May 2022 10:21:38 +0200 +Subject: nl80211: fix locking in nl80211_set_tx_bitrate_mask() + +From: Johannes Berg + +[ Upstream commit f971e1887fdb3ab500c9bebf4b98f62d49a20655 ] + +This accesses the wdev's chandef etc., so cannot safely +be used without holding the lock. + +Signed-off-by: Johannes Berg +Link: https://lore.kernel.org/r/20220506102136.06b7205419e6.I2a87c05fbd8bc5e565e84d190d4cfd2e92695a90@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/nl80211.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 06a35f1bec23..0c20df052db3 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -11573,18 +11573,23 @@ static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb, + struct cfg80211_bitrate_mask mask; + struct cfg80211_registered_device *rdev = info->user_ptr[0]; + struct net_device *dev = info->user_ptr[1]; ++ struct wireless_dev *wdev = dev->ieee80211_ptr; + int err; + + if (!rdev->ops->set_bitrate_mask) + return -EOPNOTSUPP; + ++ wdev_lock(wdev); + err = nl80211_parse_tx_bitrate_mask(info, info->attrs, + NL80211_ATTR_TX_RATES, &mask, + dev, true); + if (err) +- return err; ++ goto out; + +- return rdev_set_bitrate_mask(rdev, dev, NULL, &mask); ++ err = rdev_set_bitrate_mask(rdev, dev, NULL, &mask); ++out: ++ wdev_unlock(wdev); ++ return err; + } + + static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info) +-- +2.35.1 + diff --git a/queue-5.17/nl80211-validate-s1g-channel-width.patch b/queue-5.17/nl80211-validate-s1g-channel-width.patch new file mode 100644 index 00000000000..d67f21d8c8e --- /dev/null +++ b/queue-5.17/nl80211-validate-s1g-channel-width.patch @@ -0,0 +1,44 @@ +From e64d735f33e05d8f5d080d6e8582d5405eb3f1e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Apr 2022 04:13:21 +0000 +Subject: nl80211: validate S1G channel width + +From: Kieran Frewen + +[ Upstream commit 5d087aa759eb82b8208411913f6c2158bd85abc0 ] + +Validate the S1G channel width input by user to ensure it matches +that of the requested channel + +Signed-off-by: Kieran Frewen +Signed-off-by: Bassem Dawood +Link: https://lore.kernel.org/r/20220420041321.3788789-2-kieran.frewen@morsemicro.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/nl80211.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index dc171ca0d1b1..06a35f1bec23 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -3128,6 +3128,15 @@ int nl80211_parse_chandef(struct cfg80211_registered_device *rdev, + } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) { + chandef->width = + nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]); ++ if (chandef->chan->band == NL80211_BAND_S1GHZ) { ++ /* User input error for channel width doesn't match channel */ ++ if (chandef->width != ieee80211_s1g_channel_width(chandef->chan)) { ++ NL_SET_ERR_MSG_ATTR(extack, ++ attrs[NL80211_ATTR_CHANNEL_WIDTH], ++ "bad channel width"); ++ return -EINVAL; ++ } ++ } + if (attrs[NL80211_ATTR_CENTER_FREQ1]) { + chandef->center_freq1 = + nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]); +-- +2.35.1 + diff --git a/queue-5.17/perf-bench-numa-address-compiler-error-on-s390.patch b/queue-5.17/perf-bench-numa-address-compiler-error-on-s390.patch new file mode 100644 index 00000000000..ae0b19c3c76 --- /dev/null +++ b/queue-5.17/perf-bench-numa-address-compiler-error-on-s390.patch @@ -0,0 +1,67 @@ +From 859f6624f033d62feaec818a9d6212dd14703236 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 May 2022 10:11:58 +0200 +Subject: perf bench numa: Address compiler error on s390 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Richter + +[ Upstream commit f8ac1c478424a9a14669b8cef7389b1e14e5229d ] + +The compilation on s390 results in this error: + + # make DEBUG=y bench/numa.o + ... + bench/numa.c: In function ‘__bench_numa’: + bench/numa.c:1749:81: error: ‘%d’ directive output may be truncated + writing between 1 and 11 bytes into a region of size between + 10 and 20 [-Werror=format-truncation=] + 1749 | snprintf(tname, sizeof(tname), "process%d:thread%d", p, t); + ^~ + ... + bench/numa.c:1749:64: note: directive argument in the range + [-2147483647, 2147483646] + ... + # + +The maximum length of the %d replacement is 11 characters because of the +negative sign. Therefore extend the array by two more characters. + +Output after: + + # make DEBUG=y bench/numa.o > /dev/null 2>&1; ll bench/numa.o + -rw-r--r-- 1 root root 418320 May 19 09:11 bench/numa.o + # + +Fixes: 3aff8ba0a4c9c919 ("perf bench numa: Avoid possible truncation when using snprintf()") +Suggested-by: Namhyung Kim +Signed-off-by: Thomas Richter +Cc: Heiko Carstens +Cc: Sumanth Korikkar +Cc: Sven Schnelle +Cc: Vasily Gorbik +Link: https://lore.kernel.org/r/20220520081158.2990006-1-tmricht@linux.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/bench/numa.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c +index f2640179ada9..c2c81567afa5 100644 +--- a/tools/perf/bench/numa.c ++++ b/tools/perf/bench/numa.c +@@ -1672,7 +1672,7 @@ static int __bench_numa(const char *name) + "GB/sec,", "total-speed", "GB/sec total speed"); + + if (g->p.show_details >= 2) { +- char tname[14 + 2 * 10 + 1]; ++ char tname[14 + 2 * 11 + 1]; + struct thread_data *td; + for (p = 0; p < g->p.nr_proc; p++) { + for (t = 0; t < g->p.nr_threads; t++) { +-- +2.35.1 + diff --git a/queue-5.17/perf-build-fix-check-for-btf__load_from_kernel_by_id.patch b/queue-5.17/perf-build-fix-check-for-btf__load_from_kernel_by_id.patch new file mode 100644 index 00000000000..ce94b1f131b --- /dev/null +++ b/queue-5.17/perf-build-fix-check-for-btf__load_from_kernel_by_id.patch @@ -0,0 +1,186 @@ +From 785d8d20e567a9e0137c49ab187fa998cb0082df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 21:25:12 -0300 +Subject: perf build: Fix check for btf__load_from_kernel_by_id() in libbpf +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 0ae065a5d265bc5ada13e350015458e0c5e5c351 ] + +Avi Kivity reported a problem where the __weak +btf__load_from_kernel_by_id() in tools/perf/util/bpf-event.c was being +used and it called btf__get_from_id() in tools/lib/bpf/btf.c that in +turn called back to btf__load_from_kernel_by_id(), resulting in an +endless loop. + +Fix this by adding a feature test to check if +btf__load_from_kernel_by_id() is available when building perf with +LIBBPF_DYNAMIC=1, and if not then provide the fallback to the old +btf__get_from_id(), that doesn't call back to btf__load_from_kernel_by_id() +since at that time it didn't exist at all. + +Tested on Fedora 35 where we have libbpf-devel 0.4.0 with LIBBPF_DYNAMIC +where we don't have btf__load_from_kernel_by_id() and thus its feature +test fail, not defining HAVE_LIBBPF_BTF__LOAD_FROM_KERNEL_BY_ID: + + $ cat /tmp/build/perf-urgent/feature/test-libbpf-btf__load_from_kernel_by_id.make.output + test-libbpf-btf__load_from_kernel_by_id.c: In function ‘main’: + test-libbpf-btf__load_from_kernel_by_id.c:6:16: error: implicit declaration of function ‘btf__load_from_kernel_by_id’ [-Werror=implicit-function-declaration] + 6 | return btf__load_from_kernel_by_id(20151128, NULL); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ + cc1: all warnings being treated as errors + $ + + $ nm /tmp/build/perf-urgent/perf | grep btf__load_from_kernel_by_id + 00000000005ba180 T btf__load_from_kernel_by_id + $ + + $ objdump --disassemble=btf__load_from_kernel_by_id -S /tmp/build/perf-urgent/perf + + /tmp/build/perf-urgent/perf: file format elf64-x86-64 + + 00000000005ba180 : + #include "record.h" + #include "util/synthetic-events.h" + + #ifndef HAVE_LIBBPF_BTF__LOAD_FROM_KERNEL_BY_ID + struct btf *btf__load_from_kernel_by_id(__u32 id) + { + 5ba180: 55 push %rbp + 5ba181: 48 89 e5 mov %rsp,%rbp + 5ba184: 48 83 ec 10 sub $0x10,%rsp + 5ba188: 64 48 8b 04 25 28 00 mov %fs:0x28,%rax + 5ba18f: 00 00 + 5ba191: 48 89 45 f8 mov %rax,-0x8(%rbp) + 5ba195: 31 c0 xor %eax,%eax + struct btf *btf; + #pragma GCC diagnostic push + #pragma GCC diagnostic ignored "-Wdeprecated-declarations" + int err = btf__get_from_id(id, &btf); + 5ba197: 48 8d 75 f0 lea -0x10(%rbp),%rsi + 5ba19b: e8 a0 57 e5 ff call 40f940 + 5ba1a0: 89 c2 mov %eax,%edx + #pragma GCC diagnostic pop + + return err ? ERR_PTR(err) : btf; + 5ba1a2: 48 98 cltq + 5ba1a4: 85 d2 test %edx,%edx + 5ba1a6: 48 0f 44 45 f0 cmove -0x10(%rbp),%rax + } + + +Fixes: 218e7b775d368f38 ("perf bpf: Provide a weak btf__load_from_kernel_by_id() for older libbpf versions") +Reported-by: Avi Kivity +Link: https://lore.kernel.org/linux-perf-users/f0add43b-3de5-20c5-22c4-70aff4af959f@scylladb.com +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: https://lore.kernel.org/linux-perf-users/YobjjFOblY4Xvwo7@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/build/Makefile.feature | 1 + + tools/build/feature/Makefile | 4 ++++ + .../feature/test-libbpf-btf__load_from_kernel_by_id.c | 7 +++++++ + tools/perf/Makefile.config | 7 +++++++ + tools/perf/util/bpf-event.c | 4 +++- + 5 files changed, 22 insertions(+), 1 deletion(-) + create mode 100644 tools/build/feature/test-libbpf-btf__load_from_kernel_by_id.c + +diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature +index ae61f464043a..c6a48d0ef9ff 100644 +--- a/tools/build/Makefile.feature ++++ b/tools/build/Makefile.feature +@@ -98,6 +98,7 @@ FEATURE_TESTS_EXTRA := \ + llvm-version \ + clang \ + libbpf \ ++ libbpf-btf__load_from_kernel_by_id \ + libpfm4 \ + libdebuginfod \ + clang-bpf-co-re +diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile +index de66e1cc0734..cb4a2a4fa2e4 100644 +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -57,6 +57,7 @@ FILES= \ + test-lzma.bin \ + test-bpf.bin \ + test-libbpf.bin \ ++ test-libbpf-btf__load_from_kernel_by_id.bin \ + test-get_cpuid.bin \ + test-sdt.bin \ + test-cxx.bin \ +@@ -287,6 +288,9 @@ $(OUTPUT)test-bpf.bin: + $(OUTPUT)test-libbpf.bin: + $(BUILD) -lbpf + ++$(OUTPUT)test-libbpf-btf__load_from_kernel_by_id.bin: ++ $(BUILD) -lbpf ++ + $(OUTPUT)test-sdt.bin: + $(BUILD) + +diff --git a/tools/build/feature/test-libbpf-btf__load_from_kernel_by_id.c b/tools/build/feature/test-libbpf-btf__load_from_kernel_by_id.c +new file mode 100644 +index 000000000000..f7c084428735 +--- /dev/null ++++ b/tools/build/feature/test-libbpf-btf__load_from_kernel_by_id.c +@@ -0,0 +1,7 @@ ++// SPDX-License-Identifier: GPL-2.0 ++#include ++ ++int main(void) ++{ ++ return btf__load_from_kernel_by_id(20151128, NULL); ++} +diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config +index f3bf9297bcc0..1bd64e7404b9 100644 +--- a/tools/perf/Makefile.config ++++ b/tools/perf/Makefile.config +@@ -553,9 +553,16 @@ ifndef NO_LIBELF + ifeq ($(feature-libbpf), 1) + EXTLIBS += -lbpf + $(call detected,CONFIG_LIBBPF_DYNAMIC) ++ ++ $(call feature_check,libbpf-btf__load_from_kernel_by_id) ++ ifeq ($(feature-libbpf-btf__load_from_kernel_by_id), 1) ++ CFLAGS += -DHAVE_LIBBPF_BTF__LOAD_FROM_KERNEL_BY_ID ++ endif + else + dummy := $(error Error: No libbpf devel library found, please install libbpf-devel); + endif ++ else ++ CFLAGS += -DHAVE_LIBBPF_BTF__LOAD_FROM_KERNEL_BY_ID + endif + endif + +diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c +index a517eaa51eb3..65dfd2c70246 100644 +--- a/tools/perf/util/bpf-event.c ++++ b/tools/perf/util/bpf-event.c +@@ -22,7 +22,8 @@ + #include "record.h" + #include "util/synthetic-events.h" + +-struct btf * __weak btf__load_from_kernel_by_id(__u32 id) ++#ifndef HAVE_LIBBPF_BTF__LOAD_FROM_KERNEL_BY_ID ++struct btf *btf__load_from_kernel_by_id(__u32 id) + { + struct btf *btf; + #pragma GCC diagnostic push +@@ -32,6 +33,7 @@ struct btf * __weak btf__load_from_kernel_by_id(__u32 id) + + return err ? ERR_PTR(err) : btf; + } ++#endif + + struct bpf_program * __weak + bpf_object__next_program(const struct bpf_object *obj, struct bpf_program *prev) +-- +2.35.1 + diff --git a/queue-5.17/perf-regs-x86-fix-arch__intr_reg_mask-for-the-hybrid.patch b/queue-5.17/perf-regs-x86-fix-arch__intr_reg_mask-for-the-hybrid.patch new file mode 100644 index 00000000000..366fee81cd2 --- /dev/null +++ b/queue-5.17/perf-regs-x86-fix-arch__intr_reg_mask-for-the-hybrid.patch @@ -0,0 +1,90 @@ +From 2bcd703c4666a75d9186d11e8317b2aa41e3fa72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 07:51:25 -0700 +Subject: perf regs x86: Fix arch__intr_reg_mask() for the hybrid platform + +From: Kan Liang + +[ Upstream commit 01b28e4a58152e8906eeb5f1b55a0c404c48c7c8 ] + +The X86 specific arch__intr_reg_mask() is to check whether the kernel +and hardware can collect XMM registers. But it doesn't work on some +hybrid platform. + +Without the patch on ADL-N: + + $ perf record -I? + available registers: AX BX CX DX SI DI BP SP IP FLAGS CS SS R8 R9 R10 + R11 R12 R13 R14 R15 + +The config of the test event doesn't contain the PMU information. The +kernel may fail to initialize it on the correct hybrid PMU and return +the wrong non-supported information. + +Add the PMU information into the config for the hybrid platform. The +same register set is supported among different hybrid PMUs. Checking +the first available one is good enough. + +With the patch on ADL-N: + + $ perf record -I? + available registers: AX BX CX DX SI DI BP SP IP FLAGS CS SS R8 R9 R10 + R11 R12 R13 R14 R15 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 XMM9 + XMM10 XMM11 XMM12 XMM13 XMM14 XMM15 + +Fixes: 6466ec14aaf44ff1 ("perf regs x86: Add X86 specific arch__intr_reg_mask()") +Reported-by: Ammy Yi +Signed-off-by: Kan Liang +Acked-by: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Xing Zhengjun +Link: https://lore.kernel.org/r/20220518145125.1494156-1-kan.liang@linux.intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/arch/x86/util/perf_regs.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/tools/perf/arch/x86/util/perf_regs.c b/tools/perf/arch/x86/util/perf_regs.c +index 207c56805c55..0ed177991ad0 100644 +--- a/tools/perf/arch/x86/util/perf_regs.c ++++ b/tools/perf/arch/x86/util/perf_regs.c +@@ -9,6 +9,8 @@ + #include "../../../util/perf_regs.h" + #include "../../../util/debug.h" + #include "../../../util/event.h" ++#include "../../../util/pmu.h" ++#include "../../../util/pmu-hybrid.h" + + const struct sample_reg sample_reg_masks[] = { + SMPL_REG(AX, PERF_REG_X86_AX), +@@ -284,12 +286,22 @@ uint64_t arch__intr_reg_mask(void) + .disabled = 1, + .exclude_kernel = 1, + }; ++ struct perf_pmu *pmu; + int fd; + /* + * In an unnamed union, init it here to build on older gcc versions + */ + attr.sample_period = 1; + ++ if (perf_pmu__has_hybrid()) { ++ /* ++ * The same register set is supported among different hybrid PMUs. ++ * Only check the first available one. ++ */ ++ pmu = list_first_entry(&perf_pmu__hybrid_pmus, typeof(*pmu), hybrid_list); ++ attr.config |= (__u64)pmu->type << PERF_PMU_TYPE_SHIFT; ++ } ++ + event_attr_init(&attr); + + fd = sys_perf_event_open(&attr, 0, -1, -1, 0); +-- +2.35.1 + diff --git a/queue-5.17/perf-stat-fix-and-validate-cpu-map-inputs-in-synthet.patch b/queue-5.17/perf-stat-fix-and-validate-cpu-map-inputs-in-synthet.patch new file mode 100644 index 00000000000..854688a108f --- /dev/null +++ b/queue-5.17/perf-stat-fix-and-validate-cpu-map-inputs-in-synthet.patch @@ -0,0 +1,93 @@ +From f473626d9825cb552ac80d519489a96c1040d552 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 20:20:01 -0700 +Subject: perf stat: Fix and validate CPU map inputs in synthetic + PERF_RECORD_STAT events + +From: Ian Rogers + +[ Upstream commit 92d579ea3279aa87392b862df5810f0a7e30fcc6 ] + +Stat events can come from disk and so need a degree of validation. They +contain a CPU which needs looking up via CPU map to access a counter. + +Add the CPU to index translation, alongside validity checking. + +Discussion thread: + + https://lore.kernel.org/linux-perf-users/CAP-5=fWQR=sCuiSMktvUtcbOLidEpUJLCybVF6=BRvORcDOq+g@mail.gmail.com/ + +Fixes: 7ac0089d138f80dc ("perf evsel: Pass cpu not cpu map index to synthesize") +Reported-by: Michael Petlan +Suggested-by: Michael Petlan +Signed-off-by: Ian Rogers +Cc: Alexander Shishkin +Cc: Alexei Starovoitov +Cc: Andrii Nakryiko +Cc: Daniel Borkmann +Cc: Dave Marchevsky +Cc: Ian Rogers +Cc: James Clark +Cc: Jiri Olsa +Cc: John Fastabend +Cc: Kan Liang +Cc: KP Singh +Cc: Lv Ruyi +Cc: Mark Rutland +Cc: Martin KaFai Lau +Cc: Michael Petlan +Cc: Namhyung Kim +Cc: netdev@vger.kernel.org +Cc: Peter Zijlstra +Cc: Quentin Monnet +Cc: Song Liu +Cc: Stephane Eranian +Cc: Xing Zhengjun +Cc: Yonghong Song +Link: http://lore.kernel.org/lkml/20220519032005.1273691-2-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/stat.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/util/stat.c b/tools/perf/util/stat.c +index ee6f03481215..9c230b908b76 100644 +--- a/tools/perf/util/stat.c ++++ b/tools/perf/util/stat.c +@@ -471,9 +471,10 @@ int perf_stat_process_counter(struct perf_stat_config *config, + int perf_event__process_stat_event(struct perf_session *session, + union perf_event *event) + { +- struct perf_counts_values count; ++ struct perf_counts_values count, *ptr; + struct perf_record_stat *st = &event->stat; + struct evsel *counter; ++ int cpu_map_idx; + + count.val = st->val; + count.ena = st->ena; +@@ -484,8 +485,18 @@ int perf_event__process_stat_event(struct perf_session *session, + pr_err("Failed to resolve counter for stat event.\n"); + return -EINVAL; + } +- +- *perf_counts(counter->counts, st->cpu, st->thread) = count; ++ cpu_map_idx = perf_cpu_map__idx(evsel__cpus(counter), (struct perf_cpu){.cpu = st->cpu}); ++ if (cpu_map_idx == -1) { ++ pr_err("Invalid CPU %d for event %s.\n", st->cpu, evsel__name(counter)); ++ return -EINVAL; ++ } ++ ptr = perf_counts(counter->counts, cpu_map_idx, st->thread); ++ if (ptr == NULL) { ++ pr_err("Failed to find perf count for CPU %d thread %d on event %s.\n", ++ st->cpu, st->thread, evsel__name(counter)); ++ return -EINVAL; ++ } ++ *ptr = count; + counter->supported = true; + return 0; + } +-- +2.35.1 + diff --git a/queue-5.17/perf-test-bpf-skip-test-if-clang-is-not-present.patch b/queue-5.17/perf-test-bpf-skip-test-if-clang-is-not-present.patch new file mode 100644 index 00000000000..b3992a88238 --- /dev/null +++ b/queue-5.17/perf-test-bpf-skip-test-if-clang-is-not-present.patch @@ -0,0 +1,127 @@ +From 4edaac11d7cc4bb9243e80bb13c7ff50eb7e1c2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 17:24:38 +0530 +Subject: perf test bpf: Skip test if clang is not present + +From: Athira Rajeev + +[ Upstream commit 8994e97be3eb3c3a7b59d6223018ffab8c272e2d ] + +Perf BPF filter test fails in environment where "clang" is not +installed. + +Test failure logs: + +<<>> + 42: BPF filter : + 42.1: Basic BPF filtering : Skip + 42.2: BPF pinning : FAILED! + 42.3: BPF prologue generation : FAILED! +<<>> + +Enabling verbose option provided debug logs which says clang/llvm needs +to be installed. Snippet of verbose logs: + +<<>> + 42.2: BPF pinning : + --- start --- +test child forked, pid 61423 +ERROR: unable to find clang. +Hint: Try to install latest clang/llvm to support BPF. + Check your $PATH + +<> + +Failed to compile test case: 'Basic BPF llvm compile' +Unable to get BPF object, fix kbuild first +test child finished with -1 + ---- end ---- +BPF filter subtest 2: FAILED! +<<>> + +Here subtests, "BPF pinning" and "BPF prologue generation" failed and +logs shows clang/llvm is needed. After installing clang, testcase +passes. + +Reason on why subtest failure happens though logs has proper debug +information: + +Main function __test__bpf calls test_llvm__fetch_bpf_obj by +passing 4th argument as true ( 4th arguments maps to parameter +"force" in test_llvm__fetch_bpf_obj ). But this will cause +test_llvm__fetch_bpf_obj to skip the check for clang/llvm. + +Snippet of code part which checks for clang based on +parameter "force" in test_llvm__fetch_bpf_obj: + +<<>> +if (!force && (!llvm_param.user_set_param && +<<>> + +Since force is set to "false", test won't get skipped and fails to +compile test case. The BPF code compilation needs clang, So pass the +fourth argument as "false" and also skip the test if reason for return +is "TEST_SKIP" + +After the patch: + +<<>> + 42: BPF filter : + 42.1: Basic BPF filtering : Skip + 42.2: BPF pinning : Skip + 42.3: BPF prologue generation : Skip +<<>> + +Fixes: ba1fae431e74bb42 ("perf test: Add 'perf test BPF'") +Reviewed-by: Kajol Jain +Signed-off-by: Athira Jajeev +Acked-by: Ian Rogers +Cc: Disha Goel +Cc: Jiri Olsa +Cc: linuxppc-dev@lists.ozlabs.org +Cc: Madhavan Srinivasan +Cc: Michael Ellerman +Cc: Nageswara R Sastry +Cc: Wang Nan +Link: https://lore.kernel.org/r/20220511115438.84032-1-atrajeev@linux.vnet.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/bpf.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/tools/perf/tests/bpf.c b/tools/perf/tests/bpf.c +index 573490530194..592ab02d5ba3 100644 +--- a/tools/perf/tests/bpf.c ++++ b/tools/perf/tests/bpf.c +@@ -222,11 +222,11 @@ static int __test__bpf(int idx) + + ret = test_llvm__fetch_bpf_obj(&obj_buf, &obj_buf_sz, + bpf_testcase_table[idx].prog_id, +- true, NULL); ++ false, NULL); + if (ret != TEST_OK || !obj_buf || !obj_buf_sz) { + pr_debug("Unable to get BPF object, %s\n", + bpf_testcase_table[idx].msg_compile_fail); +- if (idx == 0) ++ if ((idx == 0) || (ret == TEST_SKIP)) + return TEST_SKIP; + else + return TEST_FAIL; +@@ -370,9 +370,11 @@ static int test__bpf_prologue_test(struct test_suite *test __maybe_unused, + static struct test_case bpf_tests[] = { + #ifdef HAVE_LIBBPF_SUPPORT + TEST_CASE("Basic BPF filtering", basic_bpf_test), +- TEST_CASE("BPF pinning", bpf_pinning), ++ TEST_CASE_REASON("BPF pinning", bpf_pinning, ++ "clang isn't installed or environment missing BPF support"), + #ifdef HAVE_BPF_PROLOGUE +- TEST_CASE("BPF prologue generation", bpf_prologue_test), ++ TEST_CASE_REASON("BPF prologue generation", bpf_prologue_test, ++ "clang isn't installed or environment missing BPF support"), + #else + TEST_CASE_REASON("BPF prologue generation", bpf_prologue_test, "not compiled in"), + #endif +-- +2.35.1 + diff --git a/queue-5.17/perf-test-fix-all-pmu-test-to-skip-hv_24x7-hv_gpci-t.patch b/queue-5.17/perf-test-fix-all-pmu-test-to-skip-hv_24x7-hv_gpci-t.patch new file mode 100644 index 00000000000..ed7812749d5 --- /dev/null +++ b/queue-5.17/perf-test-fix-all-pmu-test-to-skip-hv_24x7-hv_gpci-t.patch @@ -0,0 +1,66 @@ +From 773a7de040f954ab5165d8aca89d8a7047b00410 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 May 2022 15:42:36 +0530 +Subject: perf test: Fix "all PMU test" to skip hv_24x7/hv_gpci tests on + powerpc + +From: Athira Rajeev + +[ Upstream commit 451ed8058c69a3fee29fa9e2967a4e22a221fe75 ] + +"perf all PMU test" picks the input events from "perf list --raw-dump +pmu" list and runs "perf stat -e" for each of the event in the list. In +case of powerpc, the PowerVM environment supports events from hv_24x7 +and hv_gpci PMU which is of example format like below: + +- hv_24x7/CPM_ADJUNCT_INST,domain=?,core=?/ +- hv_gpci/event,partition_id=?/ + +The value for "?" needs to be filled in depending on system and +respective event. CPM_ADJUNCT_INST needs have core value and domain +value. hv_gpci event needs partition_id. Similarly, there are other +events for hv_24x7 and hv_gpci having "?" in event format. Hence skip +these events on powerpc platform since values like partition_id, domain +is specific to system and event. + +Fixes: 3d5ac9effcc640d5 ("perf test: Workload test of all PMUs") +Signed-off-by: Athira Jajeev +Acked-by: Ian Rogers +Cc: Disha Goel +Cc: Jiri Olsa +Cc: Kajol Jain +Cc: linuxppc-dev@lists.ozlabs.org +Cc: Madhavan Srinivasan +Cc: Michael Ellerman +Cc: Nageswara R Sastry +Link: https://lore.kernel.org/r/20220520101236.17249-1-atrajeev@linux.vnet.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/stat_all_pmu.sh | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/tools/perf/tests/shell/stat_all_pmu.sh b/tools/perf/tests/shell/stat_all_pmu.sh +index b30dba455f36..9c9ef33e0b3c 100755 +--- a/tools/perf/tests/shell/stat_all_pmu.sh ++++ b/tools/perf/tests/shell/stat_all_pmu.sh +@@ -5,6 +5,16 @@ + set -e + + for p in $(perf list --raw-dump pmu); do ++ # In powerpc, skip the events for hv_24x7 and hv_gpci. ++ # These events needs input values to be filled in for ++ # core, chip, partition id based on system. ++ # Example: hv_24x7/CPM_ADJUNCT_INST,domain=?,core=?/ ++ # hv_gpci/event,partition_id=?/ ++ # Hence skip these events for ppc. ++ if echo "$p" |grep -Eq 'hv_24x7|hv_gpci' ; then ++ echo "Skipping: Event '$p' in powerpc" ++ continue ++ fi + echo "Testing $p" + result=$(perf stat -e "$p" true 2>&1) + if ! echo "$result" | grep -q "$p" && ! echo "$result" | grep -q "" ; then +-- +2.35.1 + diff --git a/queue-5.17/pinctrl-mediatek-mt8365-fix-ies-control-pins.patch b/queue-5.17/pinctrl-mediatek-mt8365-fix-ies-control-pins.patch new file mode 100644 index 00000000000..66b85be3f93 --- /dev/null +++ b/queue-5.17/pinctrl-mediatek-mt8365-fix-ies-control-pins.patch @@ -0,0 +1,45 @@ +From 859bc822a1eda18be1231b757e4973fa3f80a575 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 14:57:14 +0200 +Subject: pinctrl: mediatek: mt8365: fix IES control pins + +From: Mattijs Korpershoek + +[ Upstream commit f680058f406863b55ac226d1c157701939c63db4 ] + +IES26 (BIT 16 of IES1_CFG_ADDR) controls the following pads: + +- PAD_I2S_DATA_IN (GPIO114) +- PAD_I2S_LRCK (GPIO115) +- PAD_I2S_BCK (GPIO116) + +The pinctrl table is wrong since it lists pins 114 to 112. + +Update the table with the correct values. + +Fixes: e94d8b6fb83a ("pinctrl: mediatek: add support for mt8365 SoC") +Reported-by: Youngmin Han +Signed-off-by: Mattijs Korpershoek +Link: https://lore.kernel.org/r/20220426125714.298907-1-mkorpershoek@baylibre.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mediatek/pinctrl-mt8365.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/mediatek/pinctrl-mt8365.c b/drivers/pinctrl/mediatek/pinctrl-mt8365.c +index 79b1fee5a1eb..ddee0db72d26 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-mt8365.c ++++ b/drivers/pinctrl/mediatek/pinctrl-mt8365.c +@@ -259,7 +259,7 @@ static const struct mtk_pin_ies_smt_set mt8365_ies_set[] = { + MTK_PIN_IES_SMT_SPEC(104, 104, 0x420, 13), + MTK_PIN_IES_SMT_SPEC(105, 109, 0x420, 14), + MTK_PIN_IES_SMT_SPEC(110, 113, 0x420, 15), +- MTK_PIN_IES_SMT_SPEC(114, 112, 0x420, 16), ++ MTK_PIN_IES_SMT_SPEC(114, 116, 0x420, 16), + MTK_PIN_IES_SMT_SPEC(117, 119, 0x420, 17), + MTK_PIN_IES_SMT_SPEC(120, 122, 0x420, 18), + MTK_PIN_IES_SMT_SPEC(123, 125, 0x420, 19), +-- +2.35.1 + diff --git a/queue-5.17/pinctrl-ocelot-fix-for-lan966x-alt-mode.patch b/queue-5.17/pinctrl-ocelot-fix-for-lan966x-alt-mode.patch new file mode 100644 index 00000000000..9d53778436c --- /dev/null +++ b/queue-5.17/pinctrl-ocelot-fix-for-lan966x-alt-mode.patch @@ -0,0 +1,54 @@ +From 44b1774037c39c63dafae730fb688482f3d9885f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Apr 2022 21:29:18 +0200 +Subject: pinctrl: ocelot: Fix for lan966x alt mode + +From: Horatiu Vultur + +[ Upstream commit d3683eeb9d2b4aa5256f830721655ef2ee97e324 ] + +For lan966x, the GPIO 35 has the wrong function for alternate mode 2. +The mode is not none but is PTP sync. + +Fixes: 531d6ab36571c2 ("pinctrl: ocelot: Extend support for lan966x") +Signed-off-by: Horatiu Vultur +Reviewed-by: Kavyasree Kotagiri +Link: https://lore.kernel.org/r/20220413192918.3777234-1-horatiu.vultur@microchip.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-ocelot.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/pinctrl-ocelot.c b/drivers/pinctrl/pinctrl-ocelot.c +index 370459243007..61e3844cddbf 100644 +--- a/drivers/pinctrl/pinctrl-ocelot.c ++++ b/drivers/pinctrl/pinctrl-ocelot.c +@@ -129,6 +129,7 @@ enum { + FUNC_PTP1, + FUNC_PTP2, + FUNC_PTP3, ++ FUNC_PTPSYNC_0, + FUNC_PTPSYNC_1, + FUNC_PTPSYNC_2, + FUNC_PTPSYNC_3, +@@ -252,6 +253,7 @@ static const char *const ocelot_function_names[] = { + [FUNC_PTP1] = "ptp1", + [FUNC_PTP2] = "ptp2", + [FUNC_PTP3] = "ptp3", ++ [FUNC_PTPSYNC_0] = "ptpsync_0", + [FUNC_PTPSYNC_1] = "ptpsync_1", + [FUNC_PTPSYNC_2] = "ptpsync_2", + [FUNC_PTPSYNC_3] = "ptpsync_3", +@@ -891,7 +893,7 @@ LAN966X_P(31, GPIO, FC3_c, CAN1, NONE, OB_TRG, RECO_b, NON + LAN966X_P(32, GPIO, FC3_c, NONE, SGPIO_a, NONE, MIIM_Sa, NONE, R); + LAN966X_P(33, GPIO, FC1_b, NONE, SGPIO_a, NONE, MIIM_Sa, MIIM_b, R); + LAN966X_P(34, GPIO, FC1_b, NONE, SGPIO_a, NONE, MIIM_Sa, MIIM_b, R); +-LAN966X_P(35, GPIO, FC1_b, NONE, SGPIO_a, CAN0_b, NONE, NONE, R); ++LAN966X_P(35, GPIO, FC1_b, PTPSYNC_0, SGPIO_a, CAN0_b, NONE, NONE, R); + LAN966X_P(36, GPIO, NONE, PTPSYNC_1, NONE, CAN0_b, NONE, NONE, R); + LAN966X_P(37, GPIO, FC_SHRD0, PTPSYNC_2, TWI_SLC_GATE_AD, NONE, NONE, NONE, R); + LAN966X_P(38, GPIO, NONE, PTPSYNC_3, NONE, NONE, NONE, NONE, R); +-- +2.35.1 + diff --git a/queue-5.17/pinctrl-pinctrl-aspeed-g6-remove-fwqspid-group-in-pi.patch b/queue-5.17/pinctrl-pinctrl-aspeed-g6-remove-fwqspid-group-in-pi.patch new file mode 100644 index 00000000000..f7466d6936b --- /dev/null +++ b/queue-5.17/pinctrl-pinctrl-aspeed-g6-remove-fwqspid-group-in-pi.patch @@ -0,0 +1,71 @@ +From 8fb23352e0542d28b0b5799f154e488b80ae2400 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Mar 2022 10:39:27 -0700 +Subject: pinctrl: pinctrl-aspeed-g6: remove FWQSPID group in pinctrl + +From: Jae Hyun Yoo + +[ Upstream commit 3eef2f48ba0933ba995529f522554ad5c276c39b ] + +FWSPIDQ2 and FWSPIDQ3 are not part of FWSPI18 interface so remove +FWQSPID group in pinctrl. These pins must be used with the FWSPI +pins that are dedicated for boot SPI interface which provides +same 3.3v logic level. + +Fixes: 2eda1cdec49f ("pinctrl: aspeed: Add AST2600 pinmux support") +Signed-off-by: Jae Hyun Yoo +Reviewed-by: Andrew Jeffery +Link: https://lore.kernel.org/r/20220329173932.2588289-3-quic_jaehyoo@quicinc.com +Signed-off-by: Joel Stanley +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c | 14 +++----------- + 1 file changed, 3 insertions(+), 11 deletions(-) + +diff --git a/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c b/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c +index a3fa03bcd9a3..54064714d73f 100644 +--- a/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c ++++ b/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c +@@ -1236,18 +1236,12 @@ FUNC_GROUP_DECL(SALT8, AA12); + FUNC_GROUP_DECL(WDTRST4, AA12); + + #define AE12 196 +-SIG_EXPR_LIST_DECL_SEMG(AE12, FWSPIDQ2, FWQSPID, FWSPID, +- SIG_DESC_SET(SCU438, 4)); + SIG_EXPR_LIST_DECL_SESG(AE12, GPIOY4, GPIOY4); +-PIN_DECL_(AE12, SIG_EXPR_LIST_PTR(AE12, FWSPIDQ2), +- SIG_EXPR_LIST_PTR(AE12, GPIOY4)); ++PIN_DECL_(AE12, SIG_EXPR_LIST_PTR(AE12, GPIOY4)); + + #define AF12 197 +-SIG_EXPR_LIST_DECL_SEMG(AF12, FWSPIDQ3, FWQSPID, FWSPID, +- SIG_DESC_SET(SCU438, 5)); + SIG_EXPR_LIST_DECL_SESG(AF12, GPIOY5, GPIOY5); +-PIN_DECL_(AF12, SIG_EXPR_LIST_PTR(AF12, FWSPIDQ3), +- SIG_EXPR_LIST_PTR(AF12, GPIOY5)); ++PIN_DECL_(AF12, SIG_EXPR_LIST_PTR(AF12, GPIOY5)); + + #define AC12 198 + SSSF_PIN_DECL(AC12, GPIOY6, FWSPIABR, SIG_DESC_SET(SCU438, 6)); +@@ -1520,9 +1514,8 @@ SIG_EXPR_LIST_DECL_SEMG(Y4, EMMCDAT7, EMMCG8, EMMC, SIG_DESC_SET(SCU404, 3)); + PIN_DECL_3(Y4, GPIO18E3, FWSPIDMISO, VBMISO, EMMCDAT7); + + GROUP_DECL(FWSPID, Y1, Y2, Y3, Y4); +-GROUP_DECL(FWQSPID, Y1, Y2, Y3, Y4, AE12, AF12); + GROUP_DECL(EMMCG8, AB4, AA4, AC4, AA5, Y5, AB5, AB6, AC5, Y1, Y2, Y3, Y4); +-FUNC_DECL_2(FWSPID, FWSPID, FWQSPID); ++FUNC_DECL_1(FWSPID, FWSPID); + FUNC_GROUP_DECL(VB, Y1, Y2, Y3, Y4); + FUNC_DECL_3(EMMC, EMMCG1, EMMCG4, EMMCG8); + /* +@@ -1918,7 +1911,6 @@ static const struct aspeed_pin_group aspeed_g6_groups[] = { + ASPEED_PINCTRL_GROUP(FSI2), + ASPEED_PINCTRL_GROUP(FWSPIABR), + ASPEED_PINCTRL_GROUP(FWSPID), +- ASPEED_PINCTRL_GROUP(FWQSPID), + ASPEED_PINCTRL_GROUP(FWSPIWP), + ASPEED_PINCTRL_GROUP(GPIT0), + ASPEED_PINCTRL_GROUP(GPIT1), +-- +2.35.1 + diff --git a/queue-5.17/platform-surface-gpe-add-support-for-surface-pro-8.patch b/queue-5.17/platform-surface-gpe-add-support-for-surface-pro-8.patch new file mode 100644 index 00000000000..7c251c5d1bb --- /dev/null +++ b/queue-5.17/platform-surface-gpe-add-support-for-surface-pro-8.patch @@ -0,0 +1,43 @@ +From 2358a2f8fc09fe6c39c1f95d02abff4556c10f51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Apr 2022 20:00:49 +0200 +Subject: platform/surface: gpe: Add support for Surface Pro 8 + +From: Maximilian Luz + +[ Upstream commit ed13d4ac57474d959c40fd05d8860e2b1607becb ] + +The new Surface Pro 8 uses GPEs for lid events as well. Add an entry for +that so that the lid can be used to wake the device. Note that this is a +device with a keyboard type-cover, where this acts as the "lid". + +Signed-off-by: Maximilian Luz +Link: https://lore.kernel.org/r/20220429180049.1282447-1-luzmaximilian@gmail.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/surface/surface_gpe.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/platform/surface/surface_gpe.c b/drivers/platform/surface/surface_gpe.c +index c1775db29efb..ec66fde28e75 100644 +--- a/drivers/platform/surface/surface_gpe.c ++++ b/drivers/platform/surface/surface_gpe.c +@@ -99,6 +99,14 @@ static const struct dmi_system_id dmi_lid_device_table[] = { + }, + .driver_data = (void *)lid_device_props_l4D, + }, ++ { ++ .ident = "Surface Pro 8", ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Pro 8"), ++ }, ++ .driver_data = (void *)lid_device_props_l4B, ++ }, + { + .ident = "Surface Book 1", + .matches = { +-- +2.35.1 + diff --git a/queue-5.17/platform-x86-intel-fix-rmmod-pmt_telemetry-panic.patch b/queue-5.17/platform-x86-intel-fix-rmmod-pmt_telemetry-panic.patch new file mode 100644 index 00000000000..e6d285ca20a --- /dev/null +++ b/queue-5.17/platform-x86-intel-fix-rmmod-pmt_telemetry-panic.patch @@ -0,0 +1,95 @@ +From de277bd10fd6156d82ee7452b19724b46b694ad9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Apr 2022 08:23:22 -0400 +Subject: platform/x86/intel: Fix 'rmmod pmt_telemetry' panic + +From: Prarit Bhargava + +[ Upstream commit 2cdfa0c20d58da3757054797c2974c967035926a ] + +'rmmod pmt_telemetry' panics with: + + BUG: kernel NULL pointer dereference, address: 0000000000000040 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 0 P4D 0 + Oops: 0000 [#1] PREEMPT SMP NOPTI + CPU: 4 PID: 1697 Comm: rmmod Tainted: G S W -------- --- 5.18.0-rc4 #3 + Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.3056.B00.2201310233 01/31/2022 + RIP: 0010:device_del+0x1b/0x3d0 + Code: e8 1a d9 e9 ff e9 58 ff ff ff 48 8b 08 eb dc 0f 1f 44 00 00 41 56 41 55 41 54 55 48 8d af 80 00 00 00 53 48 89 fb 48 83 ec 18 <4c> 8b 67 40 48 89 ef 65 48 8b 04 25 28 00 00 00 48 89 44 24 10 31 + RSP: 0018:ffffb520415cfd60 EFLAGS: 00010286 + RAX: 0000000000000070 RBX: 0000000000000000 RCX: 0000000000000000 + RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 + RBP: 0000000000000080 R08: ffffffffffffffff R09: ffffb520415cfd78 + R10: 0000000000000002 R11: ffffb520415cfd78 R12: 0000000000000000 + R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 + FS: 00007f7e198e5740(0000) GS:ffff905c9f700000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000040 CR3: 000000010782a005 CR4: 0000000000770ee0 + PKRU: 55555554 + Call Trace: + + ? __xa_erase+0x53/0xb0 + device_unregister+0x13/0x50 + intel_pmt_dev_destroy+0x34/0x60 [pmt_class] + pmt_telem_remove+0x40/0x50 [pmt_telemetry] + auxiliary_bus_remove+0x18/0x30 + device_release_driver_internal+0xc1/0x150 + driver_detach+0x44/0x90 + bus_remove_driver+0x74/0xd0 + auxiliary_driver_unregister+0x12/0x20 + pmt_telem_exit+0xc/0xe4a [pmt_telemetry] + __x64_sys_delete_module+0x13a/0x250 + ? syscall_trace_enter.isra.19+0x11e/0x1a0 + do_syscall_64+0x58/0x80 + ? syscall_exit_to_user_mode+0x12/0x30 + ? do_syscall_64+0x67/0x80 + ? syscall_exit_to_user_mode+0x12/0x30 + ? do_syscall_64+0x67/0x80 + ? syscall_exit_to_user_mode+0x12/0x30 + ? do_syscall_64+0x67/0x80 + ? exc_page_fault+0x64/0x140 + entry_SYSCALL_64_after_hwframe+0x44/0xae + RIP: 0033:0x7f7e1803a05b + Code: 73 01 c3 48 8b 0d 2d 4e 38 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d fd 4d 38 00 f7 d8 64 89 01 48 + +The probe function, pmt_telem_probe(), adds an entry for devices even if +they have not been initialized. This results in the array of initialized +devices containing both initialized and uninitialized entries. This +causes a panic in the remove function, pmt_telem_remove() which expects +the array to only contain initialized entries. + +Only use an entry when a device is initialized. + +Cc: "David E. Box" +Cc: Hans de Goede +Cc: Mark Gross +Cc: platform-driver-x86@vger.kernel.org +Signed-off-by: David Arcari +Signed-off-by: Prarit Bhargava +Reviewed-by: David E. Box +Link: https://lore.kernel.org/r/20220429122322.2550003-1-prarit@redhat.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/pmt/telemetry.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/intel/pmt/telemetry.c b/drivers/platform/x86/intel/pmt/telemetry.c +index 6b6f3e2a617a..f73ecfd4a309 100644 +--- a/drivers/platform/x86/intel/pmt/telemetry.c ++++ b/drivers/platform/x86/intel/pmt/telemetry.c +@@ -103,7 +103,7 @@ static int pmt_telem_probe(struct auxiliary_device *auxdev, const struct auxilia + auxiliary_set_drvdata(auxdev, priv); + + for (i = 0; i < intel_vsec_dev->num_resources; i++) { +- struct intel_pmt_entry *entry = &priv->entry[i]; ++ struct intel_pmt_entry *entry = &priv->entry[priv->num_entries]; + + ret = intel_pmt_dev_create(entry, &pmt_telem_ns, intel_vsec_dev, i); + if (ret < 0) +-- +2.35.1 + diff --git a/queue-5.17/platform-x86-thinkpad_acpi-convert-btusb-dmi-list-to.patch b/queue-5.17/platform-x86-thinkpad_acpi-convert-btusb-dmi-list-to.patch new file mode 100644 index 00000000000..ad95642fe55 --- /dev/null +++ b/queue-5.17/platform-x86-thinkpad_acpi-convert-btusb-dmi-list-to.patch @@ -0,0 +1,137 @@ +From acfcca17c46a4e95afaa792d54ee2f71148da2ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 22:05:00 -0500 +Subject: platform/x86: thinkpad_acpi: Convert btusb DMI list to quirks + +From: Mario Limonciello + +[ Upstream commit c25d7f32e3e209462cd82e6e93e66b72dbb2308f ] + +DMI matching in thinkpad_acpi happens local to a function meaning +quirks can only match that function. + +Future changes to thinkpad_acpi may need to quirk other code, so +change this to use a quirk infrastructure. + +Signed-off-by: Mario Limonciello +Tested-by: Mark Pearson +Link: https://lore.kernel.org/r/20220429030501.1909-2-mario.limonciello@amd.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/thinkpad_acpi.c | 26 ++++++++++++++++++++++++-- + 1 file changed, 24 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index 3fb8cda31eb9..c43586f1cb4b 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -309,6 +309,15 @@ struct ibm_init_struct { + struct ibm_struct *data; + }; + ++/* DMI Quirks */ ++struct quirk_entry { ++ bool btusb_bug; ++}; ++ ++static struct quirk_entry quirk_btusb_bug = { ++ .btusb_bug = true, ++}; ++ + static struct { + u32 bluetooth:1; + u32 hotkey:1; +@@ -338,6 +347,7 @@ static struct { + u32 hotkey_poll_active:1; + u32 has_adaptive_kbd:1; + u32 kbd_lang:1; ++ struct quirk_entry *quirks; + } tp_features; + + static struct { +@@ -4361,9 +4371,10 @@ static void bluetooth_exit(void) + bluetooth_shutdown(); + } + +-static const struct dmi_system_id bt_fwbug_list[] __initconst = { ++static const struct dmi_system_id fwbug_list[] __initconst = { + { + .ident = "ThinkPad E485", ++ .driver_data = &quirk_btusb_bug, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_BOARD_NAME, "20KU"), +@@ -4371,6 +4382,7 @@ static const struct dmi_system_id bt_fwbug_list[] __initconst = { + }, + { + .ident = "ThinkPad E585", ++ .driver_data = &quirk_btusb_bug, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_BOARD_NAME, "20KV"), +@@ -4378,6 +4390,7 @@ static const struct dmi_system_id bt_fwbug_list[] __initconst = { + }, + { + .ident = "ThinkPad A285 - 20MW", ++ .driver_data = &quirk_btusb_bug, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_BOARD_NAME, "20MW"), +@@ -4385,6 +4398,7 @@ static const struct dmi_system_id bt_fwbug_list[] __initconst = { + }, + { + .ident = "ThinkPad A285 - 20MX", ++ .driver_data = &quirk_btusb_bug, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_BOARD_NAME, "20MX"), +@@ -4392,6 +4406,7 @@ static const struct dmi_system_id bt_fwbug_list[] __initconst = { + }, + { + .ident = "ThinkPad A485 - 20MU", ++ .driver_data = &quirk_btusb_bug, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_BOARD_NAME, "20MU"), +@@ -4399,6 +4414,7 @@ static const struct dmi_system_id bt_fwbug_list[] __initconst = { + }, + { + .ident = "ThinkPad A485 - 20MV", ++ .driver_data = &quirk_btusb_bug, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_BOARD_NAME, "20MV"), +@@ -4421,7 +4437,8 @@ static int __init have_bt_fwbug(void) + * Some AMD based ThinkPads have a firmware bug that calling + * "GBDC" will cause bluetooth on Intel wireless cards blocked + */ +- if (dmi_check_system(bt_fwbug_list) && pci_dev_present(fwbug_cards_ids)) { ++ if (tp_features.quirks && tp_features.quirks->btusb_bug && ++ pci_dev_present(fwbug_cards_ids)) { + vdbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_RFKILL, + FW_BUG "disable bluetooth subdriver for Intel cards\n"); + return 1; +@@ -11438,6 +11455,7 @@ static void thinkpad_acpi_module_exit(void) + + static int __init thinkpad_acpi_module_init(void) + { ++ const struct dmi_system_id *dmi_id; + int ret, i; + + tpacpi_lifecycle = TPACPI_LIFE_INIT; +@@ -11477,6 +11495,10 @@ static int __init thinkpad_acpi_module_init(void) + return -ENODEV; + } + ++ dmi_id = dmi_first_match(fwbug_list); ++ if (dmi_id) ++ tp_features.quirks = dmi_id->driver_data; ++ + /* Device initialization */ + tpacpi_pdev = platform_device_register_simple(TPACPI_DRVR_NAME, -1, + NULL, 0); +-- +2.35.1 + diff --git a/queue-5.17/platform-x86-thinkpad_acpi-correct-dual-fan-probe.patch b/queue-5.17/platform-x86-thinkpad_acpi-correct-dual-fan-probe.patch new file mode 100644 index 00000000000..de4fa1c851c --- /dev/null +++ b/queue-5.17/platform-x86-thinkpad_acpi-correct-dual-fan-probe.patch @@ -0,0 +1,71 @@ +From 2bd1c7e4632733c08cfb2aa43724a21685e7ec8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 May 2022 15:12:00 -0400 +Subject: platform/x86: thinkpad_acpi: Correct dual fan probe + +From: Mark Pearson + +[ Upstream commit aa2fef6f40e6ccc22e932b36898f260f0e5a021a ] + +There was an issue with the dual fan probe whereby the probe was +failing as it assuming that second_fan support was not available. + +Corrected the logic so the probe works correctly. Cleaned up so +quirks only used if 2nd fan not detected. + +Tested on X1 Carbon 10 (2 fans), X1 Carbon 9 (2 fans) and T490 (1 fan) + +Signed-off-by: Mark Pearson +Link: https://lore.kernel.org/r/20220502191200.63470-1-markpearson@lenovo.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/thinkpad_acpi.c | 23 +++++++++++++---------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index c43586f1cb4b..0ea71416d292 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -8766,24 +8766,27 @@ static int __init fan_init(struct ibm_init_struct *iibm) + fan_status_access_mode = TPACPI_FAN_RD_TPEC; + if (quirks & TPACPI_FAN_Q1) + fan_quirk1_setup(); +- if (quirks & TPACPI_FAN_2FAN) { +- tp_features.second_fan = 1; +- pr_info("secondary fan support enabled\n"); +- } +- if (quirks & TPACPI_FAN_2CTL) { +- tp_features.second_fan = 1; +- tp_features.second_fan_ctl = 1; +- pr_info("secondary fan control enabled\n"); +- } + /* Try and probe the 2nd fan */ ++ tp_features.second_fan = 1; /* needed for get_speed to work */ + res = fan2_get_speed(&speed); + if (res >= 0) { + /* It responded - so let's assume it's there */ + tp_features.second_fan = 1; + tp_features.second_fan_ctl = 1; + pr_info("secondary fan control detected & enabled\n"); ++ } else { ++ /* Fan not auto-detected */ ++ tp_features.second_fan = 0; ++ if (quirks & TPACPI_FAN_2FAN) { ++ tp_features.second_fan = 1; ++ pr_info("secondary fan support enabled\n"); ++ } ++ if (quirks & TPACPI_FAN_2CTL) { ++ tp_features.second_fan = 1; ++ tp_features.second_fan_ctl = 1; ++ pr_info("secondary fan control enabled\n"); ++ } + } +- + } else { + pr_err("ThinkPad ACPI EC access misbehaving, fan status and control unavailable\n"); + return -ENODEV; +-- +2.35.1 + diff --git a/queue-5.17/ptp-ocp-have-adjtime-handle-negative-delta_ns-correc.patch b/queue-5.17/ptp-ocp-have-adjtime-handle-negative-delta_ns-correc.patch new file mode 100644 index 00000000000..914154ef01f --- /dev/null +++ b/queue-5.17/ptp-ocp-have-adjtime-handle-negative-delta_ns-correc.patch @@ -0,0 +1,50 @@ +From 0ec7ee6ee82f9d3aa4c4234283dea94e77df2867 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 May 2022 15:52:31 -0700 +Subject: ptp: ocp: have adjtime handle negative delta_ns correctly + +From: Jonathan Lemon + +[ Upstream commit da2172a9bfec858ceeb0271b9d444378490398c8 ] + +delta_ns is a s64, but it was being passed ptp_ocp_adjtime_coarse +as an u64. Also, it turns out that timespec64_add_ns() only handles +positive values, so perform the math with set_normalized_timespec(). + +Fixes: 90f8f4c0e3ce ("ptp: ocp: Add ptp_ocp_adjtime_coarse for large adjustments") +Suggested-by: Vadim Fedorenko +Signed-off-by: Jonathan Lemon +Acked-by: Vadim Fedorenko +Link: https://lore.kernel.org/r/20220513225231.1412-1-jonathan.lemon@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_ocp.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/ptp/ptp_ocp.c b/drivers/ptp/ptp_ocp.c +index 17ad5f0d13b2..6585789ed695 100644 +--- a/drivers/ptp/ptp_ocp.c ++++ b/drivers/ptp/ptp_ocp.c +@@ -625,7 +625,7 @@ __ptp_ocp_adjtime_locked(struct ptp_ocp *bp, u32 adj_val) + } + + static void +-ptp_ocp_adjtime_coarse(struct ptp_ocp *bp, u64 delta_ns) ++ptp_ocp_adjtime_coarse(struct ptp_ocp *bp, s64 delta_ns) + { + struct timespec64 ts; + unsigned long flags; +@@ -634,7 +634,8 @@ ptp_ocp_adjtime_coarse(struct ptp_ocp *bp, u64 delta_ns) + spin_lock_irqsave(&bp->lock, flags); + err = __ptp_ocp_gettime_locked(bp, &ts, NULL); + if (likely(!err)) { +- timespec64_add_ns(&ts, delta_ns); ++ set_normalized_timespec64(&ts, ts.tv_sec, ++ ts.tv_nsec + delta_ns); + __ptp_ocp_settime_locked(bp, &ts); + } + spin_unlock_irqrestore(&bp->lock, flags); +-- +2.35.1 + diff --git a/queue-5.17/revert-fbdev-make-fb_release-return-enodev-if-fbdev-.patch b/queue-5.17/revert-fbdev-make-fb_release-return-enodev-if-fbdev-.patch new file mode 100644 index 00000000000..259a9c5dda6 --- /dev/null +++ b/queue-5.17/revert-fbdev-make-fb_release-return-enodev-if-fbdev-.patch @@ -0,0 +1,57 @@ +From 5fa79a6d23839675f1bc1026be450c68b9bc4131 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 13:59:17 +0200 +Subject: Revert "fbdev: Make fb_release() return -ENODEV if fbdev was + unregistered" + +From: Javier Martinez Canillas + +[ Upstream commit 135332f34ba2662bc1e32b5c612e06a8cc41a053 ] + +This reverts commit aafa025c76dcc7d1a8c8f0bdefcbe4eb480b2f6a. That commit +attempted to fix a NULL pointer dereference, caused by the struct fb_info +associated with a framebuffer device to not longer be valid when the file +descriptor was closed. + +The issue was exposed by commit 27599aacbaef ("fbdev: Hot-unplug firmware +fb devices on forced removal"), which added a new path that goes through +the struct device removal instead of directly unregistering the fb. + +Most fbdev drivers have issues with the fb_info lifetime, because call to +framebuffer_release() from their driver's .remove callback, rather than +doing from fbops.fb_destroy callback. This meant that due to this switch, +the fb_info was now destroyed too early, while references still existed, +while before it was simply leaked. + +The patch we're reverting here reinstated that leak, hence "fixed" the +regression. But the proper solution is to fix the drivers to not release +the fb_info too soon. + +Suggested-by: Daniel Vetter +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20220504115917.758787-1-javierm@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/fbmem.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c +index 10a9369c9dea..00f0f282e7a1 100644 +--- a/drivers/video/fbdev/core/fbmem.c ++++ b/drivers/video/fbdev/core/fbmem.c +@@ -1438,10 +1438,7 @@ fb_release(struct inode *inode, struct file *file) + __acquires(&info->lock) + __releases(&info->lock) + { +- struct fb_info * const info = file_fb_info(file); +- +- if (!info) +- return -ENODEV; ++ struct fb_info * const info = file->private_data; + + lock_fb_info(info); + if (info->fbops->fb_release) +-- +2.35.1 + diff --git a/queue-5.17/revert-pci-aardvark-rewrite-irq-code-to-chained-irq-.patch b/queue-5.17/revert-pci-aardvark-rewrite-irq-code-to-chained-irq-.patch new file mode 100644 index 00000000000..08884a80eb9 --- /dev/null +++ b/queue-5.17/revert-pci-aardvark-rewrite-irq-code-to-chained-irq-.patch @@ -0,0 +1,135 @@ +From 1254058fad380e5e123541aa4337c2ca586dffe3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 May 2022 14:58:15 +0200 +Subject: Revert "PCI: aardvark: Rewrite IRQ code to chained IRQ handler" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit a3b69dd0ad6265c29c4b6fb381cd76fb3bebdf8c ] + +This reverts commit 1571d67dc190e50c6c56e8f88cdc39f7cc53166e. + +This commit broke support for setting interrupt affinity. It looks like +that it is related to the chained IRQ handler. Revert this commit until +issue with setting interrupt affinity is fixed. + +Fixes: 1571d67dc190 ("PCI: aardvark: Rewrite IRQ code to chained IRQ handler") +Link: https://lore.kernel.org/r/20220515125815.30157-1-pali@kernel.org +Signed-off-by: Pali Rohár +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-aardvark.c | 48 ++++++++++++--------------- + 1 file changed, 22 insertions(+), 26 deletions(-) + +diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c +index 5be382b19d9a..27169c023180 100644 +--- a/drivers/pci/controller/pci-aardvark.c ++++ b/drivers/pci/controller/pci-aardvark.c +@@ -272,7 +272,6 @@ struct advk_pcie { + u32 actions; + } wins[OB_WIN_COUNT]; + u8 wins_count; +- int irq; + struct irq_domain *rp_irq_domain; + struct irq_domain *irq_domain; + struct irq_chip irq_chip; +@@ -1570,26 +1569,21 @@ static void advk_pcie_handle_int(struct advk_pcie *pcie) + } + } + +-static void advk_pcie_irq_handler(struct irq_desc *desc) ++static irqreturn_t advk_pcie_irq_handler(int irq, void *arg) + { +- struct advk_pcie *pcie = irq_desc_get_handler_data(desc); +- struct irq_chip *chip = irq_desc_get_chip(desc); +- u32 val, mask, status; ++ struct advk_pcie *pcie = arg; ++ u32 status; + +- chained_irq_enter(chip, desc); ++ status = advk_readl(pcie, HOST_CTRL_INT_STATUS_REG); ++ if (!(status & PCIE_IRQ_CORE_INT)) ++ return IRQ_NONE; + +- val = advk_readl(pcie, HOST_CTRL_INT_STATUS_REG); +- mask = advk_readl(pcie, HOST_CTRL_INT_MASK_REG); +- status = val & ((~mask) & PCIE_IRQ_ALL_MASK); ++ advk_pcie_handle_int(pcie); + +- if (status & PCIE_IRQ_CORE_INT) { +- advk_pcie_handle_int(pcie); ++ /* Clear interrupt */ ++ advk_writel(pcie, PCIE_IRQ_CORE_INT, HOST_CTRL_INT_STATUS_REG); + +- /* Clear interrupt */ +- advk_writel(pcie, PCIE_IRQ_CORE_INT, HOST_CTRL_INT_STATUS_REG); +- } +- +- chained_irq_exit(chip, desc); ++ return IRQ_HANDLED; + } + + static int advk_pcie_map_irq(const struct pci_dev *dev, u8 slot, u8 pin) +@@ -1671,7 +1665,7 @@ static int advk_pcie_probe(struct platform_device *pdev) + struct advk_pcie *pcie; + struct pci_host_bridge *bridge; + struct resource_entry *entry; +- int ret; ++ int ret, irq; + + bridge = devm_pci_alloc_host_bridge(dev, sizeof(struct advk_pcie)); + if (!bridge) +@@ -1757,9 +1751,17 @@ static int advk_pcie_probe(struct platform_device *pdev) + if (IS_ERR(pcie->base)) + return PTR_ERR(pcie->base); + +- pcie->irq = platform_get_irq(pdev, 0); +- if (pcie->irq < 0) +- return pcie->irq; ++ irq = platform_get_irq(pdev, 0); ++ if (irq < 0) ++ return irq; ++ ++ ret = devm_request_irq(dev, irq, advk_pcie_irq_handler, ++ IRQF_SHARED | IRQF_NO_THREAD, "advk-pcie", ++ pcie); ++ if (ret) { ++ dev_err(dev, "Failed to register interrupt\n"); ++ return ret; ++ } + + pcie->reset_gpio = devm_gpiod_get_from_of_node(dev, dev->of_node, + "reset-gpios", 0, +@@ -1816,15 +1818,12 @@ static int advk_pcie_probe(struct platform_device *pdev) + return ret; + } + +- irq_set_chained_handler_and_data(pcie->irq, advk_pcie_irq_handler, pcie); +- + bridge->sysdata = pcie; + bridge->ops = &advk_pcie_ops; + bridge->map_irq = advk_pcie_map_irq; + + ret = pci_host_probe(bridge); + if (ret < 0) { +- irq_set_chained_handler_and_data(pcie->irq, NULL, NULL); + advk_pcie_remove_rp_irq_domain(pcie); + advk_pcie_remove_msi_irq_domain(pcie); + advk_pcie_remove_irq_domain(pcie); +@@ -1873,9 +1872,6 @@ static int advk_pcie_remove(struct platform_device *pdev) + advk_writel(pcie, PCIE_ISR1_ALL_MASK, PCIE_ISR1_REG); + advk_writel(pcie, PCIE_IRQ_ALL_MASK, HOST_CTRL_INT_STATUS_REG); + +- /* Remove IRQ handler */ +- irq_set_chained_handler_and_data(pcie->irq, NULL, NULL); +- + /* Remove IRQ domains */ + advk_pcie_remove_rp_irq_domain(pcie); + advk_pcie_remove_msi_irq_domain(pcie); +-- +2.35.1 + diff --git a/queue-5.17/riscv-dts-sifive-fu540-c000-align-dma-node-name-with.patch b/queue-5.17/riscv-dts-sifive-fu540-c000-align-dma-node-name-with.patch new file mode 100644 index 00000000000..44d2ff2ae87 --- /dev/null +++ b/queue-5.17/riscv-dts-sifive-fu540-c000-align-dma-node-name-with.patch @@ -0,0 +1,38 @@ +From e94f819bac2949208deb4851b10b8011a997209c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 21:38:56 +0200 +Subject: riscv: dts: sifive: fu540-c000: align dma node name with dtschema + +From: Krzysztof Kozlowski + +[ Upstream commit b17410182b6f98191fbf7f42d3b4a78512769d29 ] + +Fixes dtbs_check warnings like: + + dma@3000000: $nodename:0: 'dma@3000000' does not match '^dma-controller(@.*)?$' + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20220407193856.18223-1-krzysztof.kozlowski@linaro.org +Fixes: c5ab54e9945b ("riscv: dts: add support for PDMA device of HiFive Unleashed Rev A00") +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/boot/dts/sifive/fu540-c000.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/riscv/boot/dts/sifive/fu540-c000.dtsi b/arch/riscv/boot/dts/sifive/fu540-c000.dtsi +index 3eef52b1a59b..fd93fdadd28c 100644 +--- a/arch/riscv/boot/dts/sifive/fu540-c000.dtsi ++++ b/arch/riscv/boot/dts/sifive/fu540-c000.dtsi +@@ -167,7 +167,7 @@ uart0: serial@10010000 { + clocks = <&prci PRCI_CLK_TLCLK>; + status = "disabled"; + }; +- dma: dma@3000000 { ++ dma: dma-controller@3000000 { + compatible = "sifive,fu540-c000-pdma"; + reg = <0x0 0x3000000 0x0 0x8000>; + interrupt-parent = <&plic0>; +-- +2.35.1 + diff --git a/queue-5.17/scsi-qla2xxx-fix-missed-dma-unmap-for-aborted-comman.patch b/queue-5.17/scsi-qla2xxx-fix-missed-dma-unmap-for-aborted-comman.patch new file mode 100644 index 00000000000..98b2843084e --- /dev/null +++ b/queue-5.17/scsi-qla2xxx-fix-missed-dma-unmap-for-aborted-comman.patch @@ -0,0 +1,51 @@ +From f29c3587b51d999fbcf0e8039ab67ef35a64212b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Apr 2022 12:42:29 +0000 +Subject: scsi: qla2xxx: Fix missed DMA unmap for aborted commands + +From: Gleb Chesnokov + +[ Upstream commit 26f9ce53817a8fd84b69a73473a7de852a24c897 ] + +Aborting commands that have already been sent to the firmware can +cause BUG in qlt_free_cmd(): BUG_ON(cmd->sg_mapped) + +For instance: + + - Command passes rdx_to_xfer state, maps sgl, sends to the firmware + + - Reset occurs, qla2xxx performs ISP error recovery, aborts the command + + - Target stack calls qlt_abort_cmd() and then qlt_free_cmd() + + - BUG_ON(cmd->sg_mapped) in qlt_free_cmd() occurs because sgl was not + unmapped + +Thus, unmap sgl in qlt_abort_cmd() for commands with the aborted flag set. + +Link: https://lore.kernel.org/r/AS8PR10MB4952D545F84B6B1DFD39EC1E9DEE9@AS8PR10MB4952.EURPRD10.PROD.OUTLOOK.COM +Reviewed-by: Himanshu Madhani +Signed-off-by: Gleb Chesnokov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_target.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index b109716d44fb..7ab3c9e4d478 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -3837,6 +3837,9 @@ int qlt_abort_cmd(struct qla_tgt_cmd *cmd) + + spin_lock_irqsave(&cmd->cmd_lock, flags); + if (cmd->aborted) { ++ if (cmd->sg_mapped) ++ qlt_unmap_sg(vha, cmd); ++ + spin_unlock_irqrestore(&cmd->cmd_lock, flags); + /* + * It's normal to see 2 calls in this path: +-- +2.35.1 + diff --git a/queue-5.17/scsi-scsi_dh_alua-properly-handle-the-alua-transitio.patch b/queue-5.17/scsi-scsi_dh_alua-properly-handle-the-alua-transitio.patch new file mode 100644 index 00000000000..b9ddb212e56 --- /dev/null +++ b/queue-5.17/scsi-scsi_dh_alua-properly-handle-the-alua-transitio.patch @@ -0,0 +1,59 @@ +From e2425df3796f1ebf7db0321820cb6e68b0a29f6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 May 2022 08:09:17 -0700 +Subject: scsi: scsi_dh_alua: Properly handle the ALUA transitioning state + +From: Brian Bunker + +[ Upstream commit 6056a92ceb2a7705d61df7ec5370548e96aee258 ] + +The handling of the ALUA transitioning state is currently broken. When a +target goes into this state, it is expected that the target is allowed to +stay in this state for the implicit transition timeout without a path +failure. The handler has this logic, but it gets skipped currently. + +When the target transitions, there is in-flight I/O from the initiator. The +first of these responses from the target will be a unit attention letting +the initiator know that the ALUA state has changed. The remaining +in-flight I/Os, before the initiator finds out that the portal state has +changed, will return not ready, ALUA state is transitioning. The portal +state will change to SCSI_ACCESS_STATE_TRANSITIONING. This will lead to all +new I/O immediately failing the path unexpectedly. The path failure happens +in less than a second instead of the expected successes until the +transition timer is exceeded. + +Allow I/Os to continue while the path is in the ALUA transitioning +state. The handler already takes care of a target that stays in the +transitioning state for too long by changing the state to ALUA state +standby once the transition timeout is exceeded at which point the path +will fail. + +Link: https://lore.kernel.org/r/CAHZQxy+4sTPz9+pY3=7VJH+CLUJsDct81KtnR2be8ycN5mhqTg@mail.gmail.com +Reviewed-by: Hannes Reinecke +Acked-by: Krishna Kant +Acked-by: Seamus Connor +Signed-off-by: Brian Bunker +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/device_handler/scsi_dh_alua.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c +index 37d06f993b76..1d9be771f3ee 100644 +--- a/drivers/scsi/device_handler/scsi_dh_alua.c ++++ b/drivers/scsi/device_handler/scsi_dh_alua.c +@@ -1172,9 +1172,8 @@ static blk_status_t alua_prep_fn(struct scsi_device *sdev, struct request *req) + case SCSI_ACCESS_STATE_OPTIMAL: + case SCSI_ACCESS_STATE_ACTIVE: + case SCSI_ACCESS_STATE_LBA: +- return BLK_STS_OK; + case SCSI_ACCESS_STATE_TRANSITIONING: +- return BLK_STS_AGAIN; ++ return BLK_STS_OK; + default: + req->rq_flags |= RQF_QUIET; + return BLK_STS_IOERR; +-- +2.35.1 + diff --git a/queue-5.17/scsi-ufs-core-fix-referencing-invalid-rsp-field.patch b/queue-5.17/scsi-ufs-core-fix-referencing-invalid-rsp-field.patch new file mode 100644 index 00000000000..aeb27a6ac02 --- /dev/null +++ b/queue-5.17/scsi-ufs-core-fix-referencing-invalid-rsp-field.patch @@ -0,0 +1,63 @@ +From 174ceeb3fed5abcc435dfee6ff0e87801dafcfcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 15:05:29 +0900 +Subject: scsi: ufs: core: Fix referencing invalid rsp field + +From: Daejun Park + +[ Upstream commit d5d92b64408443e113b9742f8f1c35278910dd4d ] + +Fix referencing sense data when it is invalid. When the length of the data +segment is 0, there is no valid information in the rsp field, so +ufshpb_rsp_upiu() is returned without additional operation. + +Link: https://lore.kernel.org/r/252651381.41652940482659.JavaMail.epsvc@epcpadp4 +Fixes: 4b5f49079c52 ("scsi: ufs: ufshpb: L2P map management for HPB read") +Acked-by: Avri Altman +Signed-off-by: Daejun Park +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshpb.c | 19 +++++++------------ + 1 file changed, 7 insertions(+), 12 deletions(-) + +diff --git a/drivers/scsi/ufs/ufshpb.c b/drivers/scsi/ufs/ufshpb.c +index b34feba1f53d..8dc818b03939 100644 +--- a/drivers/scsi/ufs/ufshpb.c ++++ b/drivers/scsi/ufs/ufshpb.c +@@ -1256,6 +1256,13 @@ void ufshpb_rsp_upiu(struct ufs_hba *hba, struct ufshcd_lrb *lrbp) + struct utp_hpb_rsp *rsp_field = &lrbp->ucd_rsp_ptr->hr; + int data_seg_len; + ++ data_seg_len = be32_to_cpu(lrbp->ucd_rsp_ptr->header.dword_2) ++ & MASK_RSP_UPIU_DATA_SEG_LEN; ++ ++ /* If data segment length is zero, rsp_field is not valid */ ++ if (!data_seg_len) ++ return; ++ + if (unlikely(lrbp->lun != rsp_field->lun)) { + struct scsi_device *sdev; + bool found = false; +@@ -1290,18 +1297,6 @@ void ufshpb_rsp_upiu(struct ufs_hba *hba, struct ufshcd_lrb *lrbp) + return; + } + +- data_seg_len = be32_to_cpu(lrbp->ucd_rsp_ptr->header.dword_2) +- & MASK_RSP_UPIU_DATA_SEG_LEN; +- +- /* To flush remained rsp_list, we queue the map_work task */ +- if (!data_seg_len) { +- if (!ufshpb_is_general_lun(hpb->lun)) +- return; +- +- ufshpb_kick_map_work(hpb); +- return; +- } +- + BUILD_BUG_ON(sizeof(struct utp_hpb_rsp) != UTP_HPB_RSP_SIZE); + + if (!ufshpb_is_hpb_rsp_valid(hba, lrbp, rsp_field)) +-- +2.35.1 + diff --git a/queue-5.17/selftests-add-ping-test-with-ping_group_range-tuned.patch b/queue-5.17/selftests-add-ping-test-with-ping_group_range-tuned.patch new file mode 100644 index 00000000000..9ba5370a7e2 --- /dev/null +++ b/queue-5.17/selftests-add-ping-test-with-ping_group_range-tuned.patch @@ -0,0 +1,67 @@ +From 32779761e91ba0ecc19000e5690a69df55e60135 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 11:07:39 +0200 +Subject: selftests: add ping test with ping_group_range tuned + +From: Nicolas Dichtel + +[ Upstream commit e71b7f1f44d3d88c677769c85ef0171caf9fc89f ] + +The 'ping' utility is able to manage two kind of sockets (raw or icmp), +depending on the sysctl ping_group_range. By default, ping_group_range is +set to '1 0', which forces ping to use an ip raw socket. + +Let's replay the ping tests by allowing 'ping' to use the ip icmp socket. +After the previous patch, ipv4 tests results are the same with both kinds +of socket. For ipv6, there are a lot a new failures (the previous patch +fixes only two cases). + +Signed-off-by: Nicolas Dichtel +Reviewed-by: David Ahern +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/fcnal-test.sh | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh +index 3f4c8cfe7aca..7cd9b31d0307 100755 +--- a/tools/testing/selftests/net/fcnal-test.sh ++++ b/tools/testing/selftests/net/fcnal-test.sh +@@ -810,10 +810,16 @@ ipv4_ping() + setup + set_sysctl net.ipv4.raw_l3mdev_accept=1 2>/dev/null + ipv4_ping_novrf ++ setup ++ set_sysctl net.ipv4.ping_group_range='0 2147483647' 2>/dev/null ++ ipv4_ping_novrf + + log_subsection "With VRF" + setup "yes" + ipv4_ping_vrf ++ setup "yes" ++ set_sysctl net.ipv4.ping_group_range='0 2147483647' 2>/dev/null ++ ipv4_ping_vrf + } + + ################################################################################ +@@ -2348,10 +2354,16 @@ ipv6_ping() + log_subsection "No VRF" + setup + ipv6_ping_novrf ++ setup ++ set_sysctl net.ipv4.ping_group_range='0 2147483647' 2>/dev/null ++ ipv6_ping_novrf + + log_subsection "With VRF" + setup "yes" + ipv6_ping_vrf ++ setup "yes" ++ set_sysctl net.ipv4.ping_group_range='0 2147483647' 2>/dev/null ++ ipv6_ping_vrf + } + + ################################################################################ +-- +2.35.1 + diff --git a/queue-5.17/series b/queue-5.17/series index d8b041d7d3b..b678f2bd507 100644 --- a/queue-5.17/series +++ b/queue-5.17/series @@ -65,3 +65,90 @@ drm-i915-dmc-add-mmio-range-restrictions.patch drm-dp-mst-fix-a-possible-memory-leak-in-fetch_monitor_name.patch dma-buf-fix-use-of-dma_buf_set_name_-a-b-in-userspace.patch dma-buf-ensure-unique-directory-name-for-dmabuf-stats.patch +arm64-dts-qcom-sm8250-don-t-enable-rx-tx-macro-by-de.patch +arm-dts-aspeed-g6-remove-fwqspid-group-in-pinctrl-dt.patch +pinctrl-pinctrl-aspeed-g6-remove-fwqspid-group-in-pi.patch +arm-dts-aspeed-g6-fix-spi1-spi2-quad-pin-group.patch +arm-dts-aspeed-add-video-engine-to-g6.patch +pinctrl-ocelot-fix-for-lan966x-alt-mode.patch +pinctrl-mediatek-mt8365-fix-ies-control-pins.patch +alsa-hda-fix-unused-realtek-function-when-pm-is-not-.patch +net-ipa-certain-dropped-packets-aren-t-accounted-for.patch +net-ipa-record-proper-rx-transaction-count.patch +block-mq-deadline-set-the-fifo_time-member-also-if-i.patch +mptcp-fix-subflow-accounting-on-close.patch +net-macb-increment-rx-bd-head-after-allocating-skb-a.patch +i915-guc-reset-make-__guc_reset_context-aware-of-gui.patch +xfrm-rework-default-policy-structure.patch +xfrm-fix-disable_policy-flag-use-when-arriving-from-.patch +net-sched-act_pedit-sanitize-shift-argument-before-u.patch +netfilter-flowtable-fix-excessive-hw-offload-attempt.patch +netfilter-nft_flow_offload-skip-dst-neigh-lookup-for.patch +net-fix-dev_fill_forward_path-with-pppoe-bridge.patch +netfilter-nft_flow_offload-fix-offload-with-pppoe-vl.patch +ptp-ocp-have-adjtime-handle-negative-delta_ns-correc.patch +revert-pci-aardvark-rewrite-irq-code-to-chained-irq-.patch +net-lan966x-fix-assignment-of-the-mac-address.patch +net-systemport-fix-an-error-handling-path-in-bcm_sys.patch +net-vmxnet3-fix-possible-use-after-free-bugs-in-vmxn.patch +net-vmxnet3-fix-possible-null-pointer-dereference-in.patch +arm64-kexec-load-from-kimage-prior-to-clobbering.patch +ice-fix-crash-when-writing-timestamp-on-rx-rings.patch +ice-fix-possible-under-reporting-of-ethtool-tx-and-r.patch +ice-fix-interrupt-moderation-settings-getting-cleare.patch +clk-at91-generated-consider-range-when-calculating-b.patch +net-qla3xxx-fix-a-test-in-ql_reset_work.patch +nfc-nci-fix-sleep-in-atomic-context-bugs-caused-by-n.patch +net-mlx5-dr-fix-missing-flow_source-when-creating-mu.patch +net-mlx5-initialize-flow-steering-during-driver-prob.patch +net-mlx5-dr-ignore-modify-ttl-on-rx-if-device-doesn-.patch +net-mlx5e-block-rx-gro-hw-feature-in-switchdev-mode.patch +net-mlx5e-properly-block-lro-when-xdp-is-enabled.patch +net-mlx5e-properly-block-hw-gro-when-xdp-is-enabled.patch +net-mlx5e-remove-hw-gro-from-reported-features.patch +net-mlx5-drain-fw_reset-when-removing-device.patch +net-af_key-add-check-for-pfkey_broadcast-in-function.patch +arm-9196-1-spectre-bhb-enable-for-cortex-a15.patch +arm-9197-1-spectre-bhb-fix-loop8-sequence-for-thumb2.patch +mptcp-fix-checksum-byte-order.patch +mptcp-strict-local-address-id-selection.patch +mptcp-do-tcp-fallback-on-early-dss-checksum-failure.patch +igb-skip-phy-status-check-where-unavailable.patch +netfilter-flowtable-fix-tcp-flow-teardown.patch +netfilter-flowtable-pass-flowtable-to-nf_flow_table_.patch +netfilter-flowtable-move-dst_check-to-packet-path.patch +vdpa-mlx5-use-consistent-rqt-size.patch +net-bridge-clear-offload_fwd_mark-when-passing-frame.patch +riscv-dts-sifive-fu540-c000-align-dma-node-name-with.patch +scsi-ufs-core-fix-referencing-invalid-rsp-field.patch +kvm-x86-pmu-fix-the-compare-function-used-by-the-pmu.patch +perf-build-fix-check-for-btf__load_from_kernel_by_id.patch +perf-stat-fix-and-validate-cpu-map-inputs-in-synthet.patch +gpio-gpio-vf610-do-not-touch-other-bits-when-set-the.patch +gpio-mvebu-pwm-refuse-requests-with-inverted-polarit.patch +perf-test-fix-all-pmu-test-to-skip-hv_24x7-hv_gpci-t.patch +perf-regs-x86-fix-arch__intr_reg_mask-for-the-hybrid.patch +perf-bench-numa-address-compiler-error-on-s390.patch +perf-test-bpf-skip-test-if-clang-is-not-present.patch +scsi-scsi_dh_alua-properly-handle-the-alua-transitio.patch +scsi-qla2xxx-fix-missed-dma-unmap-for-aborted-comman.patch +mac80211-fix-rx-reordering-with-non-explicit-psmp-ac.patch +nl80211-validate-s1g-channel-width.patch +cfg80211-retrieve-s1g-operating-channel-number.patch +selftests-add-ping-test-with-ping_group_range-tuned.patch +revert-fbdev-make-fb_release-return-enodev-if-fbdev-.patch +fbdev-prevent-possible-use-after-free-in-fb_release.patch +platform-x86-thinkpad_acpi-convert-btusb-dmi-list-to.patch +platform-x86-thinkpad_acpi-correct-dual-fan-probe.patch +platform-x86-intel-fix-rmmod-pmt_telemetry-panic.patch +platform-surface-gpe-add-support-for-surface-pro-8.patch +drm-amd-display-undo-clearing-of-z10-related-functio.patch +net-fix-wrong-network-header-length.patch +nl80211-fix-locking-in-nl80211_set_tx_bitrate_mask.patch +ethernet-tulip-fix-missing-pci_disable_device-on-err.patch +net-stmmac-fix-missing-pci_disable_device-on-error-i.patch +net-atlantic-fix-frag-0-not-initialized.patch +net-atlantic-reduce-scope-of-is_rsc_complete.patch +net-atlantic-add-check-for-max_skb_frags.patch +net-atlantic-verify-hw_head_-lies-within-tx-buffer-r.patch +arm64-enable-repeat-tlbi-workaround-on-kryo4xx-gold-.patch diff --git a/queue-5.17/vdpa-mlx5-use-consistent-rqt-size.patch b/queue-5.17/vdpa-mlx5-use-consistent-rqt-size.patch new file mode 100644 index 00000000000..ec487f75de0 --- /dev/null +++ b/queue-5.17/vdpa-mlx5-use-consistent-rqt-size.patch @@ -0,0 +1,223 @@ +From 89d8069ddaafcc1310ba6d335ccf29f3e13de70a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 May 2022 11:47:35 +0300 +Subject: vdpa/mlx5: Use consistent RQT size + +From: Eli Cohen + +[ Upstream commit acde3929492bcb9ceb0df1270230c422b1013798 ] + +The current code evaluates RQT size based on the configured number of +virtqueues. This can raise an issue in the following scenario: + +Assume MQ was negotiated. +1. mlx5_vdpa_set_map() gets called. +2. handle_ctrl_mq() is called setting cur_num_vqs to some value, lower + than the configured max VQs. +3. A second set_map gets called, but now a smaller number of VQs is used + to evaluate the size of the RQT. +4. handle_ctrl_mq() is called with a value larger than what the RQT can + hold. This will emit errors and the driver state is compromised. + +To fix this, we use a new field in struct mlx5_vdpa_net to hold the +required number of entries in the RQT. This value is evaluated in +mlx5_vdpa_set_driver_features() where we have the negotiated features +all set up. + +In addition to that, we take into consideration the max capability of RQT +entries early when the device is added so we don't need to take consider +it when creating the RQT. + +Last, we remove the use of mlx5_vdpa_max_qps() which just returns the +max_vas / 2 and make the code clearer. + +Fixes: 52893733f2c5 ("vdpa/mlx5: Add multiqueue support") +Acked-by: Jason Wang +Signed-off-by: Eli Cohen +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vdpa/mlx5/net/mlx5_vnet.c | 61 +++++++++++-------------------- + 1 file changed, 21 insertions(+), 40 deletions(-) + +diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c +index 1b5de3af1a62..9c45be8ab178 100644 +--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c ++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c +@@ -161,6 +161,7 @@ struct mlx5_vdpa_net { + struct mlx5_flow_handle *rx_rule_mcast; + bool setup; + u32 cur_num_vqs; ++ u32 rqt_size; + struct notifier_block nb; + struct vdpa_callback config_cb; + struct mlx5_vdpa_wq_ent cvq_ent; +@@ -204,17 +205,12 @@ static __virtio16 cpu_to_mlx5vdpa16(struct mlx5_vdpa_dev *mvdev, u16 val) + return __cpu_to_virtio16(mlx5_vdpa_is_little_endian(mvdev), val); + } + +-static inline u32 mlx5_vdpa_max_qps(int max_vqs) +-{ +- return max_vqs / 2; +-} +- + static u16 ctrl_vq_idx(struct mlx5_vdpa_dev *mvdev) + { + if (!(mvdev->actual_features & BIT_ULL(VIRTIO_NET_F_MQ))) + return 2; + +- return 2 * mlx5_vdpa_max_qps(mvdev->max_vqs); ++ return mvdev->max_vqs; + } + + static bool is_ctrl_vq_idx(struct mlx5_vdpa_dev *mvdev, u16 idx) +@@ -1236,25 +1232,13 @@ static void teardown_vq(struct mlx5_vdpa_net *ndev, struct mlx5_vdpa_virtqueue * + static int create_rqt(struct mlx5_vdpa_net *ndev) + { + __be32 *list; +- int max_rqt; + void *rqtc; + int inlen; + void *in; + int i, j; + int err; +- int num; +- +- if (!(ndev->mvdev.actual_features & BIT_ULL(VIRTIO_NET_F_MQ))) +- num = 1; +- else +- num = ndev->cur_num_vqs / 2; + +- max_rqt = min_t(int, roundup_pow_of_two(num), +- 1 << MLX5_CAP_GEN(ndev->mvdev.mdev, log_max_rqt_size)); +- if (max_rqt < 1) +- return -EOPNOTSUPP; +- +- inlen = MLX5_ST_SZ_BYTES(create_rqt_in) + max_rqt * MLX5_ST_SZ_BYTES(rq_num); ++ inlen = MLX5_ST_SZ_BYTES(create_rqt_in) + ndev->rqt_size * MLX5_ST_SZ_BYTES(rq_num); + in = kzalloc(inlen, GFP_KERNEL); + if (!in) + return -ENOMEM; +@@ -1263,12 +1247,12 @@ static int create_rqt(struct mlx5_vdpa_net *ndev) + rqtc = MLX5_ADDR_OF(create_rqt_in, in, rqt_context); + + MLX5_SET(rqtc, rqtc, list_q_type, MLX5_RQTC_LIST_Q_TYPE_VIRTIO_NET_Q); +- MLX5_SET(rqtc, rqtc, rqt_max_size, max_rqt); ++ MLX5_SET(rqtc, rqtc, rqt_max_size, ndev->rqt_size); + list = MLX5_ADDR_OF(rqtc, rqtc, rq_num[0]); +- for (i = 0, j = 0; i < max_rqt; i++, j += 2) +- list[i] = cpu_to_be32(ndev->vqs[j % (2 * num)].virtq_id); ++ for (i = 0, j = 0; i < ndev->rqt_size; i++, j += 2) ++ list[i] = cpu_to_be32(ndev->vqs[j % ndev->cur_num_vqs].virtq_id); + +- MLX5_SET(rqtc, rqtc, rqt_actual_size, max_rqt); ++ MLX5_SET(rqtc, rqtc, rqt_actual_size, ndev->rqt_size); + err = mlx5_vdpa_create_rqt(&ndev->mvdev, in, inlen, &ndev->res.rqtn); + kfree(in); + if (err) +@@ -1282,19 +1266,13 @@ static int create_rqt(struct mlx5_vdpa_net *ndev) + static int modify_rqt(struct mlx5_vdpa_net *ndev, int num) + { + __be32 *list; +- int max_rqt; + void *rqtc; + int inlen; + void *in; + int i, j; + int err; + +- max_rqt = min_t(int, roundup_pow_of_two(ndev->cur_num_vqs / 2), +- 1 << MLX5_CAP_GEN(ndev->mvdev.mdev, log_max_rqt_size)); +- if (max_rqt < 1) +- return -EOPNOTSUPP; +- +- inlen = MLX5_ST_SZ_BYTES(modify_rqt_in) + max_rqt * MLX5_ST_SZ_BYTES(rq_num); ++ inlen = MLX5_ST_SZ_BYTES(modify_rqt_in) + ndev->rqt_size * MLX5_ST_SZ_BYTES(rq_num); + in = kzalloc(inlen, GFP_KERNEL); + if (!in) + return -ENOMEM; +@@ -1305,10 +1283,10 @@ static int modify_rqt(struct mlx5_vdpa_net *ndev, int num) + MLX5_SET(rqtc, rqtc, list_q_type, MLX5_RQTC_LIST_Q_TYPE_VIRTIO_NET_Q); + + list = MLX5_ADDR_OF(rqtc, rqtc, rq_num[0]); +- for (i = 0, j = 0; i < max_rqt; i++, j += 2) ++ for (i = 0, j = 0; i < ndev->rqt_size; i++, j += 2) + list[i] = cpu_to_be32(ndev->vqs[j % num].virtq_id); + +- MLX5_SET(rqtc, rqtc, rqt_actual_size, max_rqt); ++ MLX5_SET(rqtc, rqtc, rqt_actual_size, ndev->rqt_size); + err = mlx5_vdpa_modify_rqt(&ndev->mvdev, in, inlen, ndev->res.rqtn); + kfree(in); + if (err) +@@ -1582,7 +1560,7 @@ static virtio_net_ctrl_ack handle_ctrl_mq(struct mlx5_vdpa_dev *mvdev, u8 cmd) + + newqps = mlx5vdpa16_to_cpu(mvdev, mq.virtqueue_pairs); + if (newqps < VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MIN || +- newqps > mlx5_vdpa_max_qps(mvdev->max_vqs)) ++ newqps > ndev->rqt_size) + break; + + if (ndev->cur_num_vqs == 2 * newqps) { +@@ -1937,7 +1915,7 @@ static int setup_virtqueues(struct mlx5_vdpa_dev *mvdev) + int err; + int i; + +- for (i = 0; i < 2 * mlx5_vdpa_max_qps(mvdev->max_vqs); i++) { ++ for (i = 0; i < mvdev->max_vqs; i++) { + err = setup_vq(ndev, &ndev->vqs[i]); + if (err) + goto err_vq; +@@ -2008,9 +1986,11 @@ static int mlx5_vdpa_set_driver_features(struct vdpa_device *vdev, u64 features) + + ndev->mvdev.actual_features = features & ndev->mvdev.mlx_features; + if (ndev->mvdev.actual_features & BIT_ULL(VIRTIO_NET_F_MQ)) +- ndev->cur_num_vqs = 2 * mlx5vdpa16_to_cpu(mvdev, ndev->config.max_virtqueue_pairs); ++ ndev->rqt_size = mlx5vdpa16_to_cpu(mvdev, ndev->config.max_virtqueue_pairs); + else +- ndev->cur_num_vqs = 2; ++ ndev->rqt_size = 1; ++ ++ ndev->cur_num_vqs = 2 * ndev->rqt_size; + + update_cvq_info(mvdev); + return err; +@@ -2463,7 +2443,7 @@ static void init_mvqs(struct mlx5_vdpa_net *ndev) + struct mlx5_vdpa_virtqueue *mvq; + int i; + +- for (i = 0; i < 2 * mlx5_vdpa_max_qps(ndev->mvdev.max_vqs); ++i) { ++ for (i = 0; i < ndev->mvdev.max_vqs; ++i) { + mvq = &ndev->vqs[i]; + memset(mvq, 0, offsetof(struct mlx5_vdpa_virtqueue, ri)); + mvq->index = i; +@@ -2583,7 +2563,8 @@ static int mlx5_vdpa_dev_add(struct vdpa_mgmt_dev *v_mdev, const char *name, + return -EOPNOTSUPP; + } + +- max_vqs = MLX5_CAP_DEV_VDPA_EMULATION(mdev, max_num_virtio_queues); ++ max_vqs = min_t(int, MLX5_CAP_DEV_VDPA_EMULATION(mdev, max_num_virtio_queues), ++ 1 << MLX5_CAP_GEN(mdev, log_max_rqt_size)); + if (max_vqs < 2) { + dev_warn(mdev->device, + "%d virtqueues are supported. At least 2 are required\n", +@@ -2647,7 +2628,7 @@ static int mlx5_vdpa_dev_add(struct vdpa_mgmt_dev *v_mdev, const char *name, + ndev->mvdev.mlx_features |= BIT_ULL(VIRTIO_NET_F_MAC); + } + +- config->max_virtqueue_pairs = cpu_to_mlx5vdpa16(mvdev, mlx5_vdpa_max_qps(max_vqs)); ++ config->max_virtqueue_pairs = cpu_to_mlx5vdpa16(mvdev, max_vqs / 2); + mvdev->vdev.dma_dev = &mdev->pdev->dev; + err = mlx5_vdpa_alloc_resources(&ndev->mvdev); + if (err) +@@ -2674,7 +2655,7 @@ static int mlx5_vdpa_dev_add(struct vdpa_mgmt_dev *v_mdev, const char *name, + ndev->nb.notifier_call = event_handler; + mlx5_notifier_register(mdev, &ndev->nb); + mvdev->vdev.mdev = &mgtdev->mgtdev; +- err = _vdpa_register_device(&mvdev->vdev, 2 * mlx5_vdpa_max_qps(max_vqs) + 1); ++ err = _vdpa_register_device(&mvdev->vdev, max_vqs + 1); + if (err) + goto err_reg; + +-- +2.35.1 + diff --git a/queue-5.17/xfrm-fix-disable_policy-flag-use-when-arriving-from-.patch b/queue-5.17/xfrm-fix-disable_policy-flag-use-when-arriving-from-.patch new file mode 100644 index 00000000000..c9bbac45946 --- /dev/null +++ b/queue-5.17/xfrm-fix-disable_policy-flag-use-when-arriving-from-.patch @@ -0,0 +1,183 @@ +From 306a7682e53557656e82564c04fc458dc4aeb81e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 May 2022 23:34:02 +0300 +Subject: xfrm: fix "disable_policy" flag use when arriving from different + devices + +From: Eyal Birger + +[ Upstream commit e6175a2ed1f18bf2f649625bf725e07adcfa6a28 ] + +In IPv4 setting the "disable_policy" flag on a device means no policy +should be enforced for traffic originating from the device. This was +implemented by seting the DST_NOPOLICY flag in the dst based on the +originating device. + +However, dsts are cached in nexthops regardless of the originating +devices, in which case, the DST_NOPOLICY flag value may be incorrect. + +Consider the following setup: + + +------------------------------+ + | ROUTER | + +-------------+ | +-----------------+ | + | ipsec src |----|-|ipsec0 | | + +-------------+ | |disable_policy=0 | +----+ | + | +-----------------+ |eth1|-|----- + +-------------+ | +-----------------+ +----+ | + | noipsec src |----|-|eth0 | | + +-------------+ | |disable_policy=1 | | + | +-----------------+ | + +------------------------------+ + +Where ROUTER has a default route towards eth1. + +dst entries for traffic arriving from eth0 would have DST_NOPOLICY +and would be cached and therefore can be reused by traffic originating +from ipsec0, skipping policy check. + +Fix by setting a IPSKB_NOPOLICY flag in IPCB and observing it instead +of the DST in IN/FWD IPv4 policy checks. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: Shmulik Ladkani +Signed-off-by: Eyal Birger +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + include/net/ip.h | 1 + + include/net/xfrm.h | 14 +++++++++++++- + net/ipv4/route.c | 23 ++++++++++++++++++----- + 3 files changed, 32 insertions(+), 6 deletions(-) + +diff --git a/include/net/ip.h b/include/net/ip.h +index b51bae43b0dd..9fba950fdf12 100644 +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -56,6 +56,7 @@ struct inet_skb_parm { + #define IPSKB_DOREDIRECT BIT(5) + #define IPSKB_FRAG_PMTU BIT(6) + #define IPSKB_L3SLAVE BIT(7) ++#define IPSKB_NOPOLICY BIT(8) + + u16 frag_max_size; + }; +diff --git a/include/net/xfrm.h b/include/net/xfrm.h +index 6fb899ff5afc..d2efddce65d4 100644 +--- a/include/net/xfrm.h ++++ b/include/net/xfrm.h +@@ -1093,6 +1093,18 @@ static inline bool __xfrm_check_nopolicy(struct net *net, struct sk_buff *skb, + return false; + } + ++static inline bool __xfrm_check_dev_nopolicy(struct sk_buff *skb, ++ int dir, unsigned short family) ++{ ++ if (dir != XFRM_POLICY_OUT && family == AF_INET) { ++ /* same dst may be used for traffic originating from ++ * devices with different policy settings. ++ */ ++ return IPCB(skb)->flags & IPSKB_NOPOLICY; ++ } ++ return skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY); ++} ++ + static inline int __xfrm_policy_check2(struct sock *sk, int dir, + struct sk_buff *skb, + unsigned int family, int reverse) +@@ -1104,7 +1116,7 @@ static inline int __xfrm_policy_check2(struct sock *sk, int dir, + return __xfrm_policy_check(sk, ndir, skb, family); + + return __xfrm_check_nopolicy(net, skb, dir) || +- (skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY)) || ++ __xfrm_check_dev_nopolicy(skb, dir, family) || + __xfrm_policy_check(sk, ndir, skb, family); + } + +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index eef07b62b2d8..1cdfac733bd8 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -1721,6 +1721,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr, + struct in_device *in_dev = __in_dev_get_rcu(dev); + unsigned int flags = RTCF_MULTICAST; + struct rtable *rth; ++ bool no_policy; + u32 itag = 0; + int err; + +@@ -1731,8 +1732,12 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr, + if (our) + flags |= RTCF_LOCAL; + ++ no_policy = IN_DEV_ORCONF(in_dev, NOPOLICY); ++ if (no_policy) ++ IPCB(skb)->flags |= IPSKB_NOPOLICY; ++ + rth = rt_dst_alloc(dev_net(dev)->loopback_dev, flags, RTN_MULTICAST, +- IN_DEV_ORCONF(in_dev, NOPOLICY), false); ++ no_policy, false); + if (!rth) + return -ENOBUFS; + +@@ -1791,7 +1796,7 @@ static int __mkroute_input(struct sk_buff *skb, + struct rtable *rth; + int err; + struct in_device *out_dev; +- bool do_cache; ++ bool do_cache, no_policy; + u32 itag = 0; + + /* get a working reference to the output device */ +@@ -1836,6 +1841,10 @@ static int __mkroute_input(struct sk_buff *skb, + } + } + ++ no_policy = IN_DEV_ORCONF(in_dev, NOPOLICY); ++ if (no_policy) ++ IPCB(skb)->flags |= IPSKB_NOPOLICY; ++ + fnhe = find_exception(nhc, daddr); + if (do_cache) { + if (fnhe) +@@ -1848,8 +1857,7 @@ static int __mkroute_input(struct sk_buff *skb, + } + } + +- rth = rt_dst_alloc(out_dev->dev, 0, res->type, +- IN_DEV_ORCONF(in_dev, NOPOLICY), ++ rth = rt_dst_alloc(out_dev->dev, 0, res->type, no_policy, + IN_DEV_ORCONF(out_dev, NOXFRM)); + if (!rth) { + err = -ENOBUFS; +@@ -2224,6 +2232,7 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr, + struct rtable *rth; + struct flowi4 fl4; + bool do_cache = true; ++ bool no_policy; + + /* IP on this device is disabled. */ + +@@ -2341,6 +2350,10 @@ out: return err; + RT_CACHE_STAT_INC(in_brd); + + local_input: ++ no_policy = IN_DEV_ORCONF(in_dev, NOPOLICY); ++ if (no_policy) ++ IPCB(skb)->flags |= IPSKB_NOPOLICY; ++ + do_cache &= res->fi && !itag; + if (do_cache) { + struct fib_nh_common *nhc = FIB_RES_NHC(*res); +@@ -2355,7 +2368,7 @@ out: return err; + + rth = rt_dst_alloc(ip_rt_get_dev(net, res), + flags | RTCF_LOCAL, res->type, +- IN_DEV_ORCONF(in_dev, NOPOLICY), false); ++ no_policy, false); + if (!rth) + goto e_nobufs; + +-- +2.35.1 + diff --git a/queue-5.17/xfrm-rework-default-policy-structure.patch b/queue-5.17/xfrm-rework-default-policy-structure.patch new file mode 100644 index 00000000000..659f1af5362 --- /dev/null +++ b/queue-5.17/xfrm-rework-default-policy-structure.patch @@ -0,0 +1,237 @@ +From 907016b293f6d252ee94fdfb1fad394fa65003f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Mar 2022 11:38:22 +0100 +Subject: xfrm: rework default policy structure + +From: Nicolas Dichtel + +[ Upstream commit b58b1f563ab78955d37e9e43e02790a85c66ac05 ] + +This is a follow up of commit f8d858e607b2 ("xfrm: make user policy API +complete"). The goal is to align userland API to the internal structures. + +Signed-off-by: Nicolas Dichtel +Reviewed-by: Antony Antony +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + include/net/netns/xfrm.h | 6 +---- + include/net/xfrm.h | 48 +++++++++++++++------------------------- + net/xfrm/xfrm_policy.c | 10 ++++++--- + net/xfrm/xfrm_user.c | 43 +++++++++++++++-------------------- + 4 files changed, 44 insertions(+), 63 deletions(-) + +diff --git a/include/net/netns/xfrm.h b/include/net/netns/xfrm.h +index 947733a639a6..bd7c3be4af5d 100644 +--- a/include/net/netns/xfrm.h ++++ b/include/net/netns/xfrm.h +@@ -66,11 +66,7 @@ struct netns_xfrm { + int sysctl_larval_drop; + u32 sysctl_acq_expires; + +- u8 policy_default; +-#define XFRM_POL_DEFAULT_IN 1 +-#define XFRM_POL_DEFAULT_OUT 2 +-#define XFRM_POL_DEFAULT_FWD 4 +-#define XFRM_POL_DEFAULT_MASK 7 ++ u8 policy_default[XFRM_POLICY_MAX]; + + #ifdef CONFIG_SYSCTL + struct ctl_table_header *sysctl_hdr; +diff --git a/include/net/xfrm.h b/include/net/xfrm.h +index 76aa6f11a540..6fb899ff5afc 100644 +--- a/include/net/xfrm.h ++++ b/include/net/xfrm.h +@@ -1081,25 +1081,18 @@ xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, un + } + + #ifdef CONFIG_XFRM +-static inline bool +-xfrm_default_allow(struct net *net, int dir) +-{ +- u8 def = net->xfrm.policy_default; +- +- switch (dir) { +- case XFRM_POLICY_IN: +- return def & XFRM_POL_DEFAULT_IN ? false : true; +- case XFRM_POLICY_OUT: +- return def & XFRM_POL_DEFAULT_OUT ? false : true; +- case XFRM_POLICY_FWD: +- return def & XFRM_POL_DEFAULT_FWD ? false : true; +- } +- return false; +-} +- + int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, + unsigned short family); + ++static inline bool __xfrm_check_nopolicy(struct net *net, struct sk_buff *skb, ++ int dir) ++{ ++ if (!net->xfrm.policy_count[dir] && !secpath_exists(skb)) ++ return net->xfrm.policy_default[dir] == XFRM_USERPOLICY_ACCEPT; ++ ++ return false; ++} ++ + static inline int __xfrm_policy_check2(struct sock *sk, int dir, + struct sk_buff *skb, + unsigned int family, int reverse) +@@ -1110,13 +1103,9 @@ static inline int __xfrm_policy_check2(struct sock *sk, int dir, + if (sk && sk->sk_policy[XFRM_POLICY_IN]) + return __xfrm_policy_check(sk, ndir, skb, family); + +- if (xfrm_default_allow(net, dir)) +- return (!net->xfrm.policy_count[dir] && !secpath_exists(skb)) || +- (skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY)) || +- __xfrm_policy_check(sk, ndir, skb, family); +- else +- return (skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY)) || +- __xfrm_policy_check(sk, ndir, skb, family); ++ return __xfrm_check_nopolicy(net, skb, dir) || ++ (skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY)) || ++ __xfrm_policy_check(sk, ndir, skb, family); + } + + static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) +@@ -1168,13 +1157,12 @@ static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family) + { + struct net *net = dev_net(skb->dev); + +- if (xfrm_default_allow(net, XFRM_POLICY_OUT)) +- return !net->xfrm.policy_count[XFRM_POLICY_OUT] || +- (skb_dst(skb)->flags & DST_NOXFRM) || +- __xfrm_route_forward(skb, family); +- else +- return (skb_dst(skb)->flags & DST_NOXFRM) || +- __xfrm_route_forward(skb, family); ++ if (!net->xfrm.policy_count[XFRM_POLICY_OUT] && ++ net->xfrm.policy_default[XFRM_POLICY_OUT] == XFRM_USERPOLICY_ACCEPT) ++ return true; ++ ++ return (skb_dst(skb)->flags & DST_NOXFRM) || ++ __xfrm_route_forward(skb, family); + } + + static inline int xfrm4_route_forward(struct sk_buff *skb) +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 882526159d3a..19aa994f5d2c 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -3158,7 +3158,7 @@ struct dst_entry *xfrm_lookup_with_ifid(struct net *net, + + nopol: + if (!(dst_orig->dev->flags & IFF_LOOPBACK) && +- !xfrm_default_allow(net, dir)) { ++ net->xfrm.policy_default[dir] == XFRM_USERPOLICY_BLOCK) { + err = -EPERM; + goto error; + } +@@ -3569,7 +3569,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, + } + + if (!pol) { +- if (!xfrm_default_allow(net, dir)) { ++ if (net->xfrm.policy_default[dir] == XFRM_USERPOLICY_BLOCK) { + XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOPOLS); + return 0; + } +@@ -3629,7 +3629,8 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, + } + xfrm_nr = ti; + +- if (!xfrm_default_allow(net, dir) && !xfrm_nr) { ++ if (net->xfrm.policy_default[dir] == XFRM_USERPOLICY_BLOCK && ++ !xfrm_nr) { + XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES); + goto reject; + } +@@ -4118,6 +4119,9 @@ static int __net_init xfrm_net_init(struct net *net) + spin_lock_init(&net->xfrm.xfrm_policy_lock); + seqcount_spinlock_init(&net->xfrm.xfrm_policy_hash_generation, &net->xfrm.xfrm_policy_lock); + mutex_init(&net->xfrm.xfrm_cfg_mutex); ++ net->xfrm.policy_default[XFRM_POLICY_IN] = XFRM_USERPOLICY_ACCEPT; ++ net->xfrm.policy_default[XFRM_POLICY_FWD] = XFRM_USERPOLICY_ACCEPT; ++ net->xfrm.policy_default[XFRM_POLICY_OUT] = XFRM_USERPOLICY_ACCEPT; + + rv = xfrm_statistics_init(net); + if (rv < 0) +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index 72b2f173aac8..64fa8fdd6bbd 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -1994,12 +1994,9 @@ static int xfrm_notify_userpolicy(struct net *net) + } + + up = nlmsg_data(nlh); +- up->in = net->xfrm.policy_default & XFRM_POL_DEFAULT_IN ? +- XFRM_USERPOLICY_BLOCK : XFRM_USERPOLICY_ACCEPT; +- up->fwd = net->xfrm.policy_default & XFRM_POL_DEFAULT_FWD ? +- XFRM_USERPOLICY_BLOCK : XFRM_USERPOLICY_ACCEPT; +- up->out = net->xfrm.policy_default & XFRM_POL_DEFAULT_OUT ? +- XFRM_USERPOLICY_BLOCK : XFRM_USERPOLICY_ACCEPT; ++ up->in = net->xfrm.policy_default[XFRM_POLICY_IN]; ++ up->fwd = net->xfrm.policy_default[XFRM_POLICY_FWD]; ++ up->out = net->xfrm.policy_default[XFRM_POLICY_OUT]; + + nlmsg_end(skb, nlh); + +@@ -2010,26 +2007,26 @@ static int xfrm_notify_userpolicy(struct net *net) + return err; + } + ++static bool xfrm_userpolicy_is_valid(__u8 policy) ++{ ++ return policy == XFRM_USERPOLICY_BLOCK || ++ policy == XFRM_USERPOLICY_ACCEPT; ++} ++ + static int xfrm_set_default(struct sk_buff *skb, struct nlmsghdr *nlh, + struct nlattr **attrs) + { + struct net *net = sock_net(skb->sk); + struct xfrm_userpolicy_default *up = nlmsg_data(nlh); + +- if (up->in == XFRM_USERPOLICY_BLOCK) +- net->xfrm.policy_default |= XFRM_POL_DEFAULT_IN; +- else if (up->in == XFRM_USERPOLICY_ACCEPT) +- net->xfrm.policy_default &= ~XFRM_POL_DEFAULT_IN; ++ if (xfrm_userpolicy_is_valid(up->in)) ++ net->xfrm.policy_default[XFRM_POLICY_IN] = up->in; + +- if (up->fwd == XFRM_USERPOLICY_BLOCK) +- net->xfrm.policy_default |= XFRM_POL_DEFAULT_FWD; +- else if (up->fwd == XFRM_USERPOLICY_ACCEPT) +- net->xfrm.policy_default &= ~XFRM_POL_DEFAULT_FWD; ++ if (xfrm_userpolicy_is_valid(up->fwd)) ++ net->xfrm.policy_default[XFRM_POLICY_FWD] = up->fwd; + +- if (up->out == XFRM_USERPOLICY_BLOCK) +- net->xfrm.policy_default |= XFRM_POL_DEFAULT_OUT; +- else if (up->out == XFRM_USERPOLICY_ACCEPT) +- net->xfrm.policy_default &= ~XFRM_POL_DEFAULT_OUT; ++ if (xfrm_userpolicy_is_valid(up->out)) ++ net->xfrm.policy_default[XFRM_POLICY_OUT] = up->out; + + rt_genid_bump_all(net); + +@@ -2059,13 +2056,9 @@ static int xfrm_get_default(struct sk_buff *skb, struct nlmsghdr *nlh, + } + + r_up = nlmsg_data(r_nlh); +- +- r_up->in = net->xfrm.policy_default & XFRM_POL_DEFAULT_IN ? +- XFRM_USERPOLICY_BLOCK : XFRM_USERPOLICY_ACCEPT; +- r_up->fwd = net->xfrm.policy_default & XFRM_POL_DEFAULT_FWD ? +- XFRM_USERPOLICY_BLOCK : XFRM_USERPOLICY_ACCEPT; +- r_up->out = net->xfrm.policy_default & XFRM_POL_DEFAULT_OUT ? +- XFRM_USERPOLICY_BLOCK : XFRM_USERPOLICY_ACCEPT; ++ r_up->in = net->xfrm.policy_default[XFRM_POLICY_IN]; ++ r_up->fwd = net->xfrm.policy_default[XFRM_POLICY_FWD]; ++ r_up->out = net->xfrm.policy_default[XFRM_POLICY_OUT]; + nlmsg_end(r_skb, r_nlh); + + return nlmsg_unicast(net->xfrm.nlsk, r_skb, portid); +-- +2.35.1 +