From: Sasha Levin Date: Sun, 24 Mar 2024 18:11:43 +0000 (-0400) Subject: Fixes for 5.15 X-Git-Tag: v6.8.2~47 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b84f0305c5f64be6c5c47ac2fc49e85dfb17a424;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/arm64-dts-broadcom-bcmbca-bcm4908-drop-invalid-switc.patch b/queue-5.15/arm64-dts-broadcom-bcmbca-bcm4908-drop-invalid-switc.patch new file mode 100644 index 00000000000..af817d1df4c --- /dev/null +++ b/queue-5.15/arm64-dts-broadcom-bcmbca-bcm4908-drop-invalid-switc.patch @@ -0,0 +1,44 @@ +From f26a7c7536037890b46385fb62a16badab713df7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jan 2024 12:56:36 +0100 +Subject: arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 27058b95fbb784406ea4c40b20caa3f04937140c ] + +Ethernet switch does not have addressable subnodes. + +This fixes: +arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dtb: ethernet-switch@0: '#address-cells', '#size-cells' do not match any of the regexes: 'pinctrl-[0-9]+' + from schema $id: http://devicetree.org/schemas/net/dsa/brcm,sf2.yaml# + +Fixes: 527a3ac9bdf8 ("arm64: dts: broadcom: bcm4908: describe internal switch") +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20240111115636.12095-1-zajec5@gmail.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi +index b7db95ce0bbf2..d8e5796509fc9 100644 +--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi ++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi +@@ -180,9 +180,6 @@ + brcm,num-gphy = <5>; + brcm,num-rgmii-ports = <2>; + +- #address-cells = <1>; +- #size-cells = <0>; +- + ports: ports { + #address-cells = <1>; + #size-cells = <0>; +-- +2.43.0 + diff --git a/queue-5.15/bpf-report-rcu-qs-in-cpumap-kthread.patch b/queue-5.15/bpf-report-rcu-qs-in-cpumap-kthread.patch new file mode 100644 index 00000000000..d4453a63540 --- /dev/null +++ b/queue-5.15/bpf-report-rcu-qs-in-cpumap-kthread.patch @@ -0,0 +1,55 @@ +From 0eb9577c00e31696eb9d52e77c629849da0a3cfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Mar 2024 13:44:40 -0700 +Subject: bpf: report RCU QS in cpumap kthread + +From: Yan Zhai + +[ Upstream commit 00bf63122459e87193ee7f1bc6161c83a525569f ] + +When there are heavy load, cpumap kernel threads can be busy polling +packets from redirect queues and block out RCU tasks from reaching +quiescent states. It is insufficient to just call cond_resched() in such +context. Periodically raise a consolidated RCU QS before cond_resched +fixes the problem. + +Fixes: 6710e1126934 ("bpf: introduce new bpf cpu map type BPF_MAP_TYPE_CPUMAP") +Reviewed-by: Jesper Dangaard Brouer +Signed-off-by: Yan Zhai +Acked-by: Paul E. McKenney +Acked-by: Jesper Dangaard Brouer +Link: https://lore.kernel.org/r/c17b9f1517e19d813da3ede5ed33ee18496bb5d8.1710877680.git.yan@cloudflare.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + kernel/bpf/cpumap.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c +index f7de5b313cc5b..a8429cfb4ae8c 100644 +--- a/kernel/bpf/cpumap.c ++++ b/kernel/bpf/cpumap.c +@@ -305,6 +305,7 @@ static int cpu_map_bpf_prog_run(struct bpf_cpu_map_entry *rcpu, void **frames, + static int cpu_map_kthread_run(void *data) + { + struct bpf_cpu_map_entry *rcpu = data; ++ unsigned long last_qs = jiffies; + + complete(&rcpu->kthread_running); + set_current_state(TASK_INTERRUPTIBLE); +@@ -330,10 +331,12 @@ static int cpu_map_kthread_run(void *data) + if (__ptr_ring_empty(rcpu->queue)) { + schedule(); + sched = 1; ++ last_qs = jiffies; + } else { + __set_current_state(TASK_RUNNING); + } + } else { ++ rcu_softirq_qs_periodic(last_qs); + sched = cond_resched(); + } + +-- +2.43.0 + diff --git a/queue-5.15/coresight-etm4x-set-skip_power_up-in-etm4_init_arch_.patch b/queue-5.15/coresight-etm4x-set-skip_power_up-in-etm4_init_arch_.patch new file mode 100644 index 00000000000..ec306ee1599 --- /dev/null +++ b/queue-5.15/coresight-etm4x-set-skip_power_up-in-etm4_init_arch_.patch @@ -0,0 +1,59 @@ +From ebc9a2386bb629dca0894b07d6ba27761b648d95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 02:54:19 -0800 +Subject: coresight: etm4x: Set skip_power_up in etm4_init_arch_data function + +From: Mao Jinlong + +[ Upstream commit 1bbe0a247e5d72f723daeecf41596bfa99e199f1 ] + +skip_power_up is used in etm4_init_arch_data when set lpoverride. So +need to set the value of it before calling using it. + +Fixes: 5214b563588e ("coresight: etm4x: Add support for sysreg only devices") +Signed-off-by: Mao Jinlong +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20240131105423.9519-1-quic_jinlmao@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etm4x-core.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index 26d0d4485ae99..35c19c2542cf1 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -1022,6 +1022,7 @@ static void etm4_init_arch_data(void *info) + struct etm4_init_arg *init_arg = info; + struct etmv4_drvdata *drvdata; + struct csdev_access *csa; ++ struct device *dev = init_arg->dev; + int i; + + drvdata = init_arg->drvdata; +@@ -1035,6 +1036,10 @@ static void etm4_init_arch_data(void *info) + if (!etm4_init_csdev_access(drvdata, csa)) + return; + ++ if (!csa->io_mem || ++ fwnode_property_present(dev_fwnode(dev), "qcom,skip-power-up")) ++ drvdata->skip_power_up = true; ++ + /* Detect the support for OS Lock before we actually use it */ + etm_detect_os_lock(drvdata, csa); + +@@ -1921,11 +1926,6 @@ static int etm4_probe(struct device *dev, void __iomem *base, u32 etm_pid) + if (!drvdata->arch) + return -EINVAL; + +- /* TRCPDCR is not accessible with system instructions. */ +- if (!desc.access.io_mem || +- fwnode_property_present(dev_fwnode(dev), "qcom,skip-power-up")) +- drvdata->skip_power_up = true; +- + major = ETM_ARCH_MAJOR_VERSION(drvdata->arch); + minor = ETM_ARCH_MINOR_VERSION(drvdata->arch); + +-- +2.43.0 + diff --git a/queue-5.15/hsr-fix-uninit-value-access-in-hsr_get_node.patch b/queue-5.15/hsr-fix-uninit-value-access-in-hsr_get_node.patch new file mode 100644 index 00000000000..b757a65c150 --- /dev/null +++ b/queue-5.15/hsr-fix-uninit-value-access-in-hsr_get_node.patch @@ -0,0 +1,98 @@ +From a85ad82de10c500b4b21da61d8c0a787e74aa9cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 00:27:19 +0900 +Subject: hsr: Fix uninit-value access in hsr_get_node() + +From: Shigeru Yoshida + +[ Upstream commit ddbec99f58571301679addbc022256970ca3eac6 ] + +KMSAN reported the following uninit-value access issue [1]: + +===================================================== +BUG: KMSAN: uninit-value in hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246 + hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246 + fill_frame_info net/hsr/hsr_forward.c:577 [inline] + hsr_forward_skb+0xe12/0x30e0 net/hsr/hsr_forward.c:615 + hsr_dev_xmit+0x1a1/0x270 net/hsr/hsr_device.c:223 + __netdev_start_xmit include/linux/netdevice.h:4940 [inline] + netdev_start_xmit include/linux/netdevice.h:4954 [inline] + xmit_one net/core/dev.c:3548 [inline] + dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 + __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 + dev_queue_xmit include/linux/netdevice.h:3134 [inline] + packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 + packet_snd net/packet/af_packet.c:3087 [inline] + packet_sendmsg+0x8b1d/0x9f30 net/packet/af_packet.c:3119 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg net/socket.c:745 [inline] + __sys_sendto+0x735/0xa10 net/socket.c:2191 + __do_sys_sendto net/socket.c:2203 [inline] + __se_sys_sendto net/socket.c:2199 [inline] + __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x63/0x6b + +Uninit was created at: + slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 + slab_alloc_node mm/slub.c:3478 [inline] + kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523 + kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560 + __alloc_skb+0x318/0x740 net/core/skbuff.c:651 + alloc_skb include/linux/skbuff.h:1286 [inline] + alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334 + sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2787 + packet_alloc_skb net/packet/af_packet.c:2936 [inline] + packet_snd net/packet/af_packet.c:3030 [inline] + packet_sendmsg+0x70e8/0x9f30 net/packet/af_packet.c:3119 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg net/socket.c:745 [inline] + __sys_sendto+0x735/0xa10 net/socket.c:2191 + __do_sys_sendto net/socket.c:2203 [inline] + __se_sys_sendto net/socket.c:2199 [inline] + __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x63/0x6b + +CPU: 1 PID: 5033 Comm: syz-executor334 Not tainted 6.7.0-syzkaller-00562-g9f8413c4a66f #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 +===================================================== + +If the packet type ID field in the Ethernet header is either ETH_P_PRP or +ETH_P_HSR, but it is not followed by an HSR tag, hsr_get_skb_sequence_nr() +reads an invalid value as a sequence number. This causes the above issue. + +This patch fixes the issue by returning NULL if the Ethernet header is not +followed by an HSR tag. + +Fixes: f266a683a480 ("net/hsr: Better frame dispatch") +Reported-and-tested-by: syzbot+2ef3a8ce8e91b5a50098@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=2ef3a8ce8e91b5a50098 [1] +Signed-off-by: Shigeru Yoshida +Link: https://lore.kernel.org/r/20240312152719.724530-1-syoshida@redhat.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/hsr/hsr_framereg.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c +index 8c9a20e99f0f4..e0aeeeda3c876 100644 +--- a/net/hsr/hsr_framereg.c ++++ b/net/hsr/hsr_framereg.c +@@ -237,6 +237,10 @@ struct hsr_node *hsr_get_node(struct hsr_port *port, struct list_head *node_db, + */ + if (ethhdr->h_proto == htons(ETH_P_PRP) || + ethhdr->h_proto == htons(ETH_P_HSR)) { ++ /* Check if skb contains hsr_ethhdr */ ++ if (skb->mac_len < sizeof(struct hsr_ethhdr)) ++ return NULL; ++ + /* Use the existing sequence_nr from the tag as starting point + * for filtering duplicate frames. + */ +-- +2.43.0 + diff --git a/queue-5.15/hsr-handle-failures-in-module-init.patch b/queue-5.15/hsr-handle-failures-in-module-init.patch new file mode 100644 index 00000000000..475ccc090db --- /dev/null +++ b/queue-5.15/hsr-handle-failures-in-module-init.patch @@ -0,0 +1,61 @@ +From 6d24159b1f9c4a8faa11619089fb1060f233ac51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 13:04:52 +0100 +Subject: hsr: Handle failures in module init + +From: Felix Maurer + +[ Upstream commit 3cf28cd492308e5f63ed00b29ea03ca016264376 ] + +A failure during registration of the netdev notifier was not handled at +all. A failure during netlink initialization did not unregister the netdev +notifier. + +Handle failures of netdev notifier registration and netlink initialization. +Both functions should only return negative values on failure and thereby +lead to the hsr module not being loaded. + +Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)") +Signed-off-by: Felix Maurer +Reviewed-by: Shigeru Yoshida +Reviewed-by: Breno Leitao +Link: https://lore.kernel.org/r/3ce097c15e3f7ace98fc7fd9bcbf299f092e63d1.1710504184.git.fmaurer@redhat.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/hsr/hsr_main.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/net/hsr/hsr_main.c b/net/hsr/hsr_main.c +index b099c31501509..257b50124cee5 100644 +--- a/net/hsr/hsr_main.c ++++ b/net/hsr/hsr_main.c +@@ -148,14 +148,21 @@ static struct notifier_block hsr_nb = { + + static int __init hsr_init(void) + { +- int res; ++ int err; + + BUILD_BUG_ON(sizeof(struct hsr_tag) != HSR_HLEN); + +- register_netdevice_notifier(&hsr_nb); +- res = hsr_netlink_init(); ++ err = register_netdevice_notifier(&hsr_nb); ++ if (err) ++ return err; ++ ++ err = hsr_netlink_init(); ++ if (err) { ++ unregister_netdevice_notifier(&hsr_nb); ++ return err; ++ } + +- return res; ++ return 0; + } + + static void __exit hsr_exit(void) +-- +2.43.0 + diff --git a/queue-5.15/io_uring-don-t-save-restore-iowait-state.patch b/queue-5.15/io_uring-don-t-save-restore-iowait-state.patch new file mode 100644 index 00000000000..61bc7979b20 --- /dev/null +++ b/queue-5.15/io_uring-don-t-save-restore-iowait-state.patch @@ -0,0 +1,52 @@ +From 3439c6654affb3a279928033361c652fe9bd5dc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 13:30:43 -0600 +Subject: io_uring: don't save/restore iowait state + +From: Jens Axboe + +[ Upstream commit 6f0974eccbf78baead1735722c4f1ee3eb9422cd ] + +This kind of state is per-syscall, and since we're doing the waiting off +entering the io_uring_enter(2) syscall, there's no way that iowait can +already be set for this case. Simplify it by setting it if we need to, +and always clearing it to 0 when done. + +Fixes: 7b72d661f1f2 ("io_uring: gate iowait schedule on having pending requests") +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/io_uring.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index 386b32e6fd9a8..a51429c0342e0 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -7815,7 +7815,7 @@ static inline int io_cqring_wait_schedule(struct io_ring_ctx *ctx, + struct io_wait_queue *iowq, + ktime_t *timeout) + { +- int io_wait, ret; ++ int ret; + + /* make sure we run task_work before checking for signals */ + ret = io_run_task_work_sig(); +@@ -7830,13 +7830,12 @@ static inline int io_cqring_wait_schedule(struct io_ring_ctx *ctx, + * can take into account that the task is waiting for IO - turns out + * to be important for low QD IO. + */ +- io_wait = current->in_iowait; + if (current_pending_io()) + current->in_iowait = 1; + ret = 1; + if (!schedule_hrtimeout(timeout, HRTIMER_MODE_ABS)) + ret = -ETIME; +- current->in_iowait = io_wait; ++ current->in_iowait = 0; + return ret; + } + +-- +2.43.0 + diff --git a/queue-5.15/kconfig-fix-infinite-loop-when-expanding-a-macro-at-.patch b/queue-5.15/kconfig-fix-infinite-loop-when-expanding-a-macro-at-.patch new file mode 100644 index 00000000000..2ce84249a53 --- /dev/null +++ b/queue-5.15/kconfig-fix-infinite-loop-when-expanding-a-macro-at-.patch @@ -0,0 +1,47 @@ +From 26cacb142dc60d09df993b59f3afebc057ed46b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Feb 2024 00:57:59 +0900 +Subject: kconfig: fix infinite loop when expanding a macro at the end of file + +From: Masahiro Yamada + +[ Upstream commit af8bbce92044dc58e4cc039ab94ee5d470a621f5 ] + +A macro placed at the end of a file with no newline causes an infinite +loop. + +[Test Kconfig] + $(info,hello) + \ No newline at end of file + +I realized that flex-provided input() returns 0 instead of EOF when it +reaches the end of a file. + +Fixes: 104daea149c4 ("kconfig: reference environment variables directly and remove 'option env='") +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/kconfig/lexer.l | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/scripts/kconfig/lexer.l b/scripts/kconfig/lexer.l +index 312cbad2d34d4..2a76393d52b5b 100644 +--- a/scripts/kconfig/lexer.l ++++ b/scripts/kconfig/lexer.l +@@ -301,8 +301,11 @@ static char *expand_token(const char *in, size_t n) + new_string(); + append_string(in, n); + +- /* get the whole line because we do not know the end of token. */ +- while ((c = input()) != EOF) { ++ /* ++ * get the whole line because we do not know the end of token. ++ * input() returns 0 (not EOF!) when it reachs the end of file. ++ */ ++ while ((c = input()) != 0) { + if (c == '\n') { + unput(c); + break; +-- +2.43.0 + diff --git a/queue-5.15/net-bnx2x-prevent-access-to-a-freed-page-in-page_poo.patch b/queue-5.15/net-bnx2x-prevent-access-to-a-freed-page-in-page_poo.patch new file mode 100644 index 00000000000..c38027f4d99 --- /dev/null +++ b/queue-5.15/net-bnx2x-prevent-access-to-a-freed-page-in-page_poo.patch @@ -0,0 +1,89 @@ +From a344cf011525c7b39b375f16bfa48bd1e76f91bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 15:55:35 -0500 +Subject: net/bnx2x: Prevent access to a freed page in page_pool + +From: Thinh Tran + +[ Upstream commit d27e2da94a42655861ca4baea30c8cd65546f25d ] + +Fix race condition leading to system crash during EEH error handling + +During EEH error recovery, the bnx2x driver's transmit timeout logic +could cause a race condition when handling reset tasks. The +bnx2x_tx_timeout() schedules reset tasks via bnx2x_sp_rtnl_task(), +which ultimately leads to bnx2x_nic_unload(). In bnx2x_nic_unload() +SGEs are freed using bnx2x_free_rx_sge_range(). However, this could +overlap with the EEH driver's attempt to reset the device using +bnx2x_io_slot_reset(), which also tries to free SGEs. This race +condition can result in system crashes due to accessing freed memory +locations in bnx2x_free_rx_sge() + +799 static inline void bnx2x_free_rx_sge(struct bnx2x *bp, +800 struct bnx2x_fastpath *fp, u16 index) +801 { +802 struct sw_rx_page *sw_buf = &fp->rx_page_ring[index]; +803 struct page *page = sw_buf->page; +.... +where sw_buf was set to NULL after the call to dma_unmap_page() +by the preceding thread. + + EEH: Beginning: 'slot_reset' + PCI 0011:01:00.0#10000: EEH: Invoking bnx2x->slot_reset() + bnx2x: [bnx2x_io_slot_reset:14228(eth1)]IO slot reset initializing... + bnx2x 0011:01:00.0: enabling device (0140 -> 0142) + bnx2x: [bnx2x_io_slot_reset:14244(eth1)]IO slot reset --> driver unload + Kernel attempted to read user page (0) - exploit attempt? (uid: 0) + BUG: Kernel NULL pointer dereference on read at 0x00000000 + Faulting instruction address: 0xc0080000025065fc + Oops: Kernel access of bad area, sig: 11 [#1] + ..... + Call Trace: + [c000000003c67a20] [c00800000250658c] bnx2x_io_slot_reset+0x204/0x610 [bnx2x] (unreliable) + [c000000003c67af0] [c0000000000518a8] eeh_report_reset+0xb8/0xf0 + [c000000003c67b60] [c000000000052130] eeh_pe_report+0x180/0x550 + [c000000003c67c70] [c00000000005318c] eeh_handle_normal_event+0x84c/0xa60 + [c000000003c67d50] [c000000000053a84] eeh_event_handler+0xf4/0x170 + [c000000003c67da0] [c000000000194c58] kthread+0x1c8/0x1d0 + [c000000003c67e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64 + +To solve this issue, we need to verify page pool allocations before +freeing. + +Fixes: 4cace675d687 ("bnx2x: Alloc 4k fragment for each rx ring buffer element") +Signed-off-by: Thinh Tran +Reviewed-by: Jiri Pirko +Link: https://lore.kernel.org/r/20240315205535.1321-1-thinhtr@linux.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h +index d8b1824c334d3..0bc1367fd6492 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h +@@ -1002,9 +1002,6 @@ static inline void bnx2x_set_fw_mac_addr(__le16 *fw_hi, __le16 *fw_mid, + static inline void bnx2x_free_rx_mem_pool(struct bnx2x *bp, + struct bnx2x_alloc_pool *pool) + { +- if (!pool->page) +- return; +- + put_page(pool->page); + + pool->page = NULL; +@@ -1015,6 +1012,9 @@ static inline void bnx2x_free_rx_sge_range(struct bnx2x *bp, + { + int i; + ++ if (!fp->page_pool.page) ++ return; ++ + if (fp->mode == TPA_MODE_DISABLED) + return; + +-- +2.43.0 + diff --git a/queue-5.15/net-dsa-mt7530-fix-handling-of-802.1x-pae-frames.patch b/queue-5.15/net-dsa-mt7530-fix-handling-of-802.1x-pae-frames.patch new file mode 100644 index 00000000000..8fd3b434e4d --- /dev/null +++ b/queue-5.15/net-dsa-mt7530-fix-handling-of-802.1x-pae-frames.patch @@ -0,0 +1,59 @@ +From b185524939a3dc9d451961da052a6cdd48b2a0d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Aug 2023 13:59:17 +0300 +Subject: net: dsa: mt7530: fix handling of 802.1X PAE frames +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arınç ÜNAL + +[ Upstream commit e94b590abfff2cdbf0bdaa7d9904364c8d480af5 ] + +802.1X PAE frames are link-local frames, therefore they must be trapped to +the CPU port. Currently, the MT753X switches treat 802.1X PAE frames as +regular multicast frames, therefore flooding them to user ports. To fix +this, set 802.1X PAE frames to be trapped to the CPU port(s). + +Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") +Signed-off-by: Arınç ÜNAL +Reviewed-by: Vladimir Oltean +Signed-off-by: David S. Miller +Stable-dep-of: e8bf353577f3 ("net: dsa: mt7530: fix link-local frames that ingress vlan filtering ports") +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mt7530.c | 4 ++++ + drivers/net/dsa/mt7530.h | 2 ++ + 2 files changed, 6 insertions(+) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index 252e8eaa92767..30570b9dc88f2 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -1000,6 +1000,10 @@ mt753x_trap_frames(struct mt7530_priv *priv) + mt7530_rmw(priv, MT753X_BPC, MT753X_BPDU_PORT_FW_MASK, + MT753X_BPDU_CPU_ONLY); + ++ /* Trap 802.1X PAE frames to the CPU port(s) */ ++ mt7530_rmw(priv, MT753X_BPC, MT753X_PAE_PORT_FW_MASK, ++ MT753X_PAE_PORT_FW(MT753X_BPDU_CPU_ONLY)); ++ + /* Trap LLDP frames with :0E MAC DA to the CPU port(s) */ + mt7530_rmw(priv, MT753X_RGAC2, MT753X_R0E_PORT_FW_MASK, + MT753X_R0E_PORT_FW(MT753X_BPDU_CPU_ONLY)); +diff --git a/drivers/net/dsa/mt7530.h b/drivers/net/dsa/mt7530.h +index 8cee462d5f1cb..2c895f35383e2 100644 +--- a/drivers/net/dsa/mt7530.h ++++ b/drivers/net/dsa/mt7530.h +@@ -65,6 +65,8 @@ enum mt753x_id { + /* Registers for BPDU and PAE frame control*/ + #define MT753X_BPC 0x24 + #define MT753X_BPDU_PORT_FW_MASK GENMASK(2, 0) ++#define MT753X_PAE_PORT_FW_MASK GENMASK(18, 16) ++#define MT753X_PAE_PORT_FW(x) FIELD_PREP(MT753X_PAE_PORT_FW_MASK, x) + + /* Register for :03 and :0E MAC DA frame control */ + #define MT753X_RGAC2 0x2c +-- +2.43.0 + diff --git a/queue-5.15/net-dsa-mt7530-fix-handling-of-all-link-local-frames.patch b/queue-5.15/net-dsa-mt7530-fix-handling-of-all-link-local-frames.patch new file mode 100644 index 00000000000..b0d5a2b470d --- /dev/null +++ b/queue-5.15/net-dsa-mt7530-fix-handling-of-all-link-local-frames.patch @@ -0,0 +1,142 @@ +From aa80c582da195139db0dc441fe3baff9992b3b4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 12:33:42 +0300 +Subject: net: dsa: mt7530: fix handling of all link-local frames +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arınç ÜNAL + +[ Upstream commit 69ddba9d170bdaee1dc0eb4ced38d7e4bb7b92af ] + +Currently, the MT753X switches treat frames with :01-0D and :0F MAC DAs as +regular multicast frames, therefore flooding them to user ports. + +On page 205, section "8.6.3 Frame filtering" of the active standard, IEEE +Std 802.1Q™-2022, it is stated that frames with 01:80:C2:00:00:00-0F as MAC +DA must only be propagated to C-VLAN and MAC Bridge components. That means +VLAN-aware and VLAN-unaware bridges. On the switch designs with CPU ports, +these frames are supposed to be processed by the CPU (software). So we make +the switch only forward them to the CPU port. And if received from a CPU +port, forward to a single port. The software is responsible of making the +switch conform to the latter by setting a single port as destination port +on the special tag. + +This switch intellectual property cannot conform to this part of the +standard fully. Whilst the REV_UN frame tag covers the remaining :04-0D and +:0F MAC DAs, it also includes :22-FF which the scope of propagation is not +supposed to be restricted for these MAC DAs. + +Set frames with :01-03 MAC DAs to be trapped to the CPU port(s). Add a +comment for the remaining MAC DAs. + +Note that the ingress port must have a PVID assigned to it for the switch +to forward untagged frames. A PVID is set by default on VLAN-aware and +VLAN-unaware ports. However, when the network interface that pertains to +the ingress port is attached to a vlan_filtering enabled bridge, the user +can remove the PVID assignment from it which would prevent the link-local +frames from being trapped to the CPU port. I am yet to see a way to forward +link-local frames while preventing other untagged frames from being +forwarded too. + +Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") +Signed-off-by: Arınç ÜNAL +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mt7530.c | 37 +++++++++++++++++++++++++++++++++---- + drivers/net/dsa/mt7530.h | 13 +++++++++++++ + 2 files changed, 46 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index 834bcb9d44fd7..f36aacebb1bc6 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -993,6 +993,21 @@ static void mt7530_setup_port5(struct dsa_switch *ds, phy_interface_t interface) + mutex_unlock(&priv->reg_mutex); + } + ++/* On page 205, section "8.6.3 Frame filtering" of the active standard, IEEE Std ++ * 802.1Q™-2022, it is stated that frames with 01:80:C2:00:00:00-0F as MAC DA ++ * must only be propagated to C-VLAN and MAC Bridge components. That means ++ * VLAN-aware and VLAN-unaware bridges. On the switch designs with CPU ports, ++ * these frames are supposed to be processed by the CPU (software). So we make ++ * the switch only forward them to the CPU port. And if received from a CPU ++ * port, forward to a single port. The software is responsible of making the ++ * switch conform to the latter by setting a single port as destination port on ++ * the special tag. ++ * ++ * This switch intellectual property cannot conform to this part of the standard ++ * fully. Whilst the REV_UN frame tag covers the remaining :04-0D and :0F MAC ++ * DAs, it also includes :22-FF which the scope of propagation is not supposed ++ * to be restricted for these MAC DAs. ++ */ + static void + mt753x_trap_frames(struct mt7530_priv *priv) + { +@@ -1007,13 +1022,27 @@ mt753x_trap_frames(struct mt7530_priv *priv) + MT753X_BPDU_EG_TAG(MT7530_VLAN_EG_UNTAGGED) | + MT753X_BPDU_CPU_ONLY); + +- /* Trap LLDP frames with :0E MAC DA to the CPU port(s) and egress them +- * VLAN-untagged. ++ /* Trap frames with :01 and :02 MAC DAs to the CPU port(s) and egress ++ * them VLAN-untagged. ++ */ ++ mt7530_rmw(priv, MT753X_RGAC1, MT753X_R02_EG_TAG_MASK | ++ MT753X_R02_PORT_FW_MASK | MT753X_R01_EG_TAG_MASK | ++ MT753X_R01_PORT_FW_MASK, ++ MT753X_R02_EG_TAG(MT7530_VLAN_EG_UNTAGGED) | ++ MT753X_R02_PORT_FW(MT753X_BPDU_CPU_ONLY) | ++ MT753X_R01_EG_TAG(MT7530_VLAN_EG_UNTAGGED) | ++ MT753X_BPDU_CPU_ONLY); ++ ++ /* Trap frames with :03 and :0E MAC DAs to the CPU port(s) and egress ++ * them VLAN-untagged. + */ + mt7530_rmw(priv, MT753X_RGAC2, MT753X_R0E_EG_TAG_MASK | +- MT753X_R0E_PORT_FW_MASK, ++ MT753X_R0E_PORT_FW_MASK | MT753X_R03_EG_TAG_MASK | ++ MT753X_R03_PORT_FW_MASK, + MT753X_R0E_EG_TAG(MT7530_VLAN_EG_UNTAGGED) | +- MT753X_R0E_PORT_FW(MT753X_BPDU_CPU_ONLY)); ++ MT753X_R0E_PORT_FW(MT753X_BPDU_CPU_ONLY) | ++ MT753X_R03_EG_TAG(MT7530_VLAN_EG_UNTAGGED) | ++ MT753X_BPDU_CPU_ONLY); + } + + static int +diff --git a/drivers/net/dsa/mt7530.h b/drivers/net/dsa/mt7530.h +index 7c0820d341db7..03598f9ae288c 100644 +--- a/drivers/net/dsa/mt7530.h ++++ b/drivers/net/dsa/mt7530.h +@@ -72,12 +72,25 @@ enum mt753x_id { + #define MT753X_BPDU_EG_TAG(x) FIELD_PREP(MT753X_BPDU_EG_TAG_MASK, x) + #define MT753X_BPDU_PORT_FW_MASK GENMASK(2, 0) + ++/* Register for :01 and :02 MAC DA frame control */ ++#define MT753X_RGAC1 0x28 ++#define MT753X_R02_EG_TAG_MASK GENMASK(24, 22) ++#define MT753X_R02_EG_TAG(x) FIELD_PREP(MT753X_R02_EG_TAG_MASK, x) ++#define MT753X_R02_PORT_FW_MASK GENMASK(18, 16) ++#define MT753X_R02_PORT_FW(x) FIELD_PREP(MT753X_R02_PORT_FW_MASK, x) ++#define MT753X_R01_EG_TAG_MASK GENMASK(8, 6) ++#define MT753X_R01_EG_TAG(x) FIELD_PREP(MT753X_R01_EG_TAG_MASK, x) ++#define MT753X_R01_PORT_FW_MASK GENMASK(2, 0) ++ + /* Register for :03 and :0E MAC DA frame control */ + #define MT753X_RGAC2 0x2c + #define MT753X_R0E_EG_TAG_MASK GENMASK(24, 22) + #define MT753X_R0E_EG_TAG(x) FIELD_PREP(MT753X_R0E_EG_TAG_MASK, x) + #define MT753X_R0E_PORT_FW_MASK GENMASK(18, 16) + #define MT753X_R0E_PORT_FW(x) FIELD_PREP(MT753X_R0E_PORT_FW_MASK, x) ++#define MT753X_R03_EG_TAG_MASK GENMASK(8, 6) ++#define MT753X_R03_EG_TAG(x) FIELD_PREP(MT753X_R03_EG_TAG_MASK, x) ++#define MT753X_R03_PORT_FW_MASK GENMASK(2, 0) + + enum mt753x_bpdu_port_fw { + MT753X_BPDU_FOLLOW_MFC, +-- +2.43.0 + diff --git a/queue-5.15/net-dsa-mt7530-fix-handling-of-lldp-frames.patch b/queue-5.15/net-dsa-mt7530-fix-handling-of-lldp-frames.patch new file mode 100644 index 00000000000..532ffd4e534 --- /dev/null +++ b/queue-5.15/net-dsa-mt7530-fix-handling-of-lldp-frames.patch @@ -0,0 +1,64 @@ +From 9ce07d371973fecc92c617e66a581d30a0da8f08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jun 2023 09:26:47 +0300 +Subject: net: dsa: mt7530: fix handling of LLDP frames +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arınç ÜNAL + +[ Upstream commit 8332cf6fd7c7087dbc2067115b33979c9851bbc4 ] + +LLDP frames are link-local frames, therefore they must be trapped to the +CPU port. Currently, the MT753X switches treat LLDP frames as regular +multicast frames, therefore flooding them to user ports. To fix this, set +LLDP frames to be trapped to the CPU port(s). + +Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") +Signed-off-by: Arınç ÜNAL +Reviewed-by: Vladimir Oltean +Reviewed-by: Russell King (Oracle) +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Stable-dep-of: e8bf353577f3 ("net: dsa: mt7530: fix link-local frames that ingress vlan filtering ports") +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mt7530.c | 4 ++++ + drivers/net/dsa/mt7530.h | 5 +++++ + 2 files changed, 9 insertions(+) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index 636943035c292..252e8eaa92767 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -999,6 +999,10 @@ mt753x_trap_frames(struct mt7530_priv *priv) + /* Trap BPDUs to the CPU port(s) */ + mt7530_rmw(priv, MT753X_BPC, MT753X_BPDU_PORT_FW_MASK, + MT753X_BPDU_CPU_ONLY); ++ ++ /* Trap LLDP frames with :0E MAC DA to the CPU port(s) */ ++ mt7530_rmw(priv, MT753X_RGAC2, MT753X_R0E_PORT_FW_MASK, ++ MT753X_R0E_PORT_FW(MT753X_BPDU_CPU_ONLY)); + } + + static int +diff --git a/drivers/net/dsa/mt7530.h b/drivers/net/dsa/mt7530.h +index 91508e2feef95..8cee462d5f1cb 100644 +--- a/drivers/net/dsa/mt7530.h ++++ b/drivers/net/dsa/mt7530.h +@@ -66,6 +66,11 @@ enum mt753x_id { + #define MT753X_BPC 0x24 + #define MT753X_BPDU_PORT_FW_MASK GENMASK(2, 0) + ++/* Register for :03 and :0E MAC DA frame control */ ++#define MT753X_RGAC2 0x2c ++#define MT753X_R0E_PORT_FW_MASK GENMASK(18, 16) ++#define MT753X_R0E_PORT_FW(x) FIELD_PREP(MT753X_R0E_PORT_FW_MASK, x) ++ + enum mt753x_bpdu_port_fw { + MT753X_BPDU_FOLLOW_MFC, + MT753X_BPDU_CPU_EXCLUDE = 4, +-- +2.43.0 + diff --git a/queue-5.15/net-dsa-mt7530-fix-link-local-frames-that-ingress-vl.patch b/queue-5.15/net-dsa-mt7530-fix-link-local-frames-that-ingress-vl.patch new file mode 100644 index 00000000000..5c3b984661a --- /dev/null +++ b/queue-5.15/net-dsa-mt7530-fix-link-local-frames-that-ingress-vl.patch @@ -0,0 +1,182 @@ +From 6b5798d58a7e4f79819a5078991e2c9bd49b45ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 12:33:41 +0300 +Subject: net: dsa: mt7530: fix link-local frames that ingress vlan filtering + ports +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arınç ÜNAL + +[ Upstream commit e8bf353577f382c7066c661fed41b2adc0fc7c40 ] + +Whether VLAN-aware or not, on every VID VLAN table entry that has the CPU +port as a member of it, frames are set to egress the CPU port with the VLAN +tag stacked. This is so that VLAN tags can be appended after hardware +special tag (called DSA tag in the context of Linux drivers). + +For user ports on a VLAN-unaware bridge, frame ingressing the user port +egresses CPU port with only the special tag. + +For user ports on a VLAN-aware bridge, frame ingressing the user port +egresses CPU port with the special tag and the VLAN tag. + +This causes issues with link-local frames, specifically BPDUs, because the +software expects to receive them VLAN-untagged. + +There are two options to make link-local frames egress untagged. Setting +CONSISTENT or UNTAGGED on the EG_TAG bits on the relevant register. +CONSISTENT means frames egress exactly as they ingress. That means +egressing with the VLAN tag they had at ingress or egressing untagged if +they ingressed untagged. Although link-local frames are not supposed to be +transmitted VLAN-tagged, if they are done so, when egressing through a CPU +port, the special tag field will be broken. + +BPDU egresses CPU port with VLAN tag egressing stacked, received on +software: + +00:01:25.104821 AF Unknown (382365846), length 106: + | STAG | | VLAN | + 0x0000: 0000 6c27 614d 4143 0001 0000 8100 0001 ..l'aMAC........ + 0x0010: 0026 4242 0300 0000 0000 0000 6c27 614d .&BB........l'aM + 0x0020: 4143 0000 0000 0000 6c27 614d 4143 0000 AC......l'aMAC.. + 0x0030: 0000 1400 0200 0f00 0000 0000 0000 0000 ................ + +BPDU egresses CPU port with VLAN tag egressing untagged, received on +software: + +00:23:56.628708 AF Unknown (25215488), length 64: + | STAG | + 0x0000: 0000 6c27 614d 4143 0001 0000 0026 4242 ..l'aMAC.....&BB + 0x0010: 0300 0000 0000 0000 6c27 614d 4143 0000 ........l'aMAC.. + 0x0020: 0000 0000 6c27 614d 4143 0000 0000 1400 ....l'aMAC...... + 0x0030: 0200 0f00 0000 0000 0000 0000 ............ + +BPDU egresses CPU port with VLAN tag egressing tagged, received on +software: + +00:01:34.311963 AF Unknown (25215488), length 64: + | Mess | + 0x0000: 0000 6c27 614d 4143 0001 0001 0026 4242 ..l'aMAC.....&BB + 0x0010: 0300 0000 0000 0000 6c27 614d 4143 0000 ........l'aMAC.. + 0x0020: 0000 0000 6c27 614d 4143 0000 0000 1400 ....l'aMAC...... + 0x0030: 0200 0f00 0000 0000 0000 0000 ............ + +To prevent confusing the software, force the frame to egress UNTAGGED +instead of CONSISTENT. This way, frames can't possibly be received TAGGED +by software which would have the special tag field broken. + +VLAN Tag Egress Procedure + + For all frames, one of these options set the earliest in this order will + apply to the frame: + + - EG_TAG in certain registers for certain frames. + This will apply to frame with matching MAC DA or EtherType. + + - EG_TAG in the address table. + This will apply to frame at its incoming port. + + - EG_TAG in the PVC register. + This will apply to frame at its incoming port. + + - EG_CON and [EG_TAG per port] in the VLAN table. + This will apply to frame at its outgoing port. + + - EG_TAG in the PCR register. + This will apply to frame at its outgoing port. + + EG_TAG in certain registers for certain frames: + + PPPoE Discovery_ARP/RARP: PPP_EG_TAG and ARP_EG_TAG in the APC register. + IGMP_MLD: IGMP_EG_TAG and MLD_EG_TAG in the IMC register. + BPDU and PAE: BPDU_EG_TAG and PAE_EG_TAG in the BPC register. + REV_01 and REV_02: R01_EG_TAG and R02_EG_TAG in the RGAC1 register. + REV_03 and REV_0E: R03_EG_TAG and R0E_EG_TAG in the RGAC2 register. + REV_10 and REV_20: R10_EG_TAG and R20_EG_TAG in the RGAC3 register. + REV_21 and REV_UN: R21_EG_TAG and RUN_EG_TAG in the RGAC4 register. + +With this change, it can be observed that a bridge interface with stp_state +and vlan_filtering enabled will properly block ports now. + +Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") +Signed-off-by: Arınç ÜNAL +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mt7530.c | 23 +++++++++++++++-------- + drivers/net/dsa/mt7530.h | 9 ++++++++- + 2 files changed, 23 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index 30570b9dc88f2..834bcb9d44fd7 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -996,16 +996,23 @@ static void mt7530_setup_port5(struct dsa_switch *ds, phy_interface_t interface) + static void + mt753x_trap_frames(struct mt7530_priv *priv) + { +- /* Trap BPDUs to the CPU port(s) */ +- mt7530_rmw(priv, MT753X_BPC, MT753X_BPDU_PORT_FW_MASK, ++ /* Trap 802.1X PAE frames and BPDUs to the CPU port(s) and egress them ++ * VLAN-untagged. ++ */ ++ mt7530_rmw(priv, MT753X_BPC, MT753X_PAE_EG_TAG_MASK | ++ MT753X_PAE_PORT_FW_MASK | MT753X_BPDU_EG_TAG_MASK | ++ MT753X_BPDU_PORT_FW_MASK, ++ MT753X_PAE_EG_TAG(MT7530_VLAN_EG_UNTAGGED) | ++ MT753X_PAE_PORT_FW(MT753X_BPDU_CPU_ONLY) | ++ MT753X_BPDU_EG_TAG(MT7530_VLAN_EG_UNTAGGED) | + MT753X_BPDU_CPU_ONLY); + +- /* Trap 802.1X PAE frames to the CPU port(s) */ +- mt7530_rmw(priv, MT753X_BPC, MT753X_PAE_PORT_FW_MASK, +- MT753X_PAE_PORT_FW(MT753X_BPDU_CPU_ONLY)); +- +- /* Trap LLDP frames with :0E MAC DA to the CPU port(s) */ +- mt7530_rmw(priv, MT753X_RGAC2, MT753X_R0E_PORT_FW_MASK, ++ /* Trap LLDP frames with :0E MAC DA to the CPU port(s) and egress them ++ * VLAN-untagged. ++ */ ++ mt7530_rmw(priv, MT753X_RGAC2, MT753X_R0E_EG_TAG_MASK | ++ MT753X_R0E_PORT_FW_MASK, ++ MT753X_R0E_EG_TAG(MT7530_VLAN_EG_UNTAGGED) | + MT753X_R0E_PORT_FW(MT753X_BPDU_CPU_ONLY)); + } + +diff --git a/drivers/net/dsa/mt7530.h b/drivers/net/dsa/mt7530.h +index 2c895f35383e2..7c0820d341db7 100644 +--- a/drivers/net/dsa/mt7530.h ++++ b/drivers/net/dsa/mt7530.h +@@ -64,12 +64,18 @@ enum mt753x_id { + + /* Registers for BPDU and PAE frame control*/ + #define MT753X_BPC 0x24 +-#define MT753X_BPDU_PORT_FW_MASK GENMASK(2, 0) ++#define MT753X_PAE_EG_TAG_MASK GENMASK(24, 22) ++#define MT753X_PAE_EG_TAG(x) FIELD_PREP(MT753X_PAE_EG_TAG_MASK, x) + #define MT753X_PAE_PORT_FW_MASK GENMASK(18, 16) + #define MT753X_PAE_PORT_FW(x) FIELD_PREP(MT753X_PAE_PORT_FW_MASK, x) ++#define MT753X_BPDU_EG_TAG_MASK GENMASK(8, 6) ++#define MT753X_BPDU_EG_TAG(x) FIELD_PREP(MT753X_BPDU_EG_TAG_MASK, x) ++#define MT753X_BPDU_PORT_FW_MASK GENMASK(2, 0) + + /* Register for :03 and :0E MAC DA frame control */ + #define MT753X_RGAC2 0x2c ++#define MT753X_R0E_EG_TAG_MASK GENMASK(24, 22) ++#define MT753X_R0E_EG_TAG(x) FIELD_PREP(MT753X_R0E_EG_TAG_MASK, x) + #define MT753X_R0E_PORT_FW_MASK GENMASK(18, 16) + #define MT753X_R0E_PORT_FW(x) FIELD_PREP(MT753X_R0E_PORT_FW_MASK, x) + +@@ -252,6 +258,7 @@ enum mt7530_port_mode { + enum mt7530_vlan_port_eg_tag { + MT7530_VLAN_EG_DISABLED = 0, + MT7530_VLAN_EG_CONSISTENT = 1, ++ MT7530_VLAN_EG_UNTAGGED = 4, + }; + + enum mt7530_vlan_port_attr { +-- +2.43.0 + diff --git a/queue-5.15/net-dsa-mt7530-prevent-possible-incorrect-xtal-frequ.patch b/queue-5.15/net-dsa-mt7530-prevent-possible-incorrect-xtal-frequ.patch new file mode 100644 index 00000000000..dad496a8ac4 --- /dev/null +++ b/queue-5.15/net-dsa-mt7530-prevent-possible-incorrect-xtal-frequ.patch @@ -0,0 +1,178 @@ +From c75670117ceeba713addddf6457f3d5100dc0a4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 12:28:35 +0300 +Subject: net: dsa: mt7530: prevent possible incorrect XTAL frequency selection +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arınç ÜNAL + +[ Upstream commit f490c492e946d8ffbe65ad4efc66de3c5ede30a4 ] + +On MT7530, the HT_XTAL_FSEL field of the HWTRAP register stores a 2-bit +value that represents the frequency of the crystal oscillator connected to +the switch IC. The field is populated by the state of the ESW_P4_LED_0 and +ESW_P4_LED_0 pins, which is done right after reset is deasserted. + + ESW_P4_LED_0 ESW_P3_LED_0 Frequency + ----------------------------------------- + 0 0 Reserved + 0 1 20MHz + 1 0 40MHz + 1 1 25MHz + +On MT7531, the XTAL25 bit of the STRAP register stores this. The LAN0LED0 +pin is used to populate the bit. 25MHz when the pin is high, 40MHz when +it's low. + +These pins are also used with LEDs, therefore, their state can be set to +something other than the bootstrapping configuration. For example, a link +may be established on port 3 before the DSA subdriver takes control of the +switch which would set ESW_P3_LED_0 to high. + +Currently on mt7530_setup() and mt7531_setup(), 1000 - 1100 usec delay is +described between reset assertion and deassertion. Some switch ICs in real +life conditions cannot always have these pins set back to the bootstrapping +configuration before reset deassertion in this amount of delay. This causes +wrong crystal frequency to be selected which puts the switch in a +nonfunctional state after reset deassertion. + +The tests below are conducted on an MT7530 with a 40MHz crystal oscillator +by Justin Swartz. + +With a cable from an active peer connected to port 3 before reset, an +incorrect crystal frequency (0b11 = 25MHz) is selected: + + [1] [3] [5] + : : : + _____________________________ __________________ +ESW_P4_LED_0 |_______| + _____________________________ +ESW_P3_LED_0 |__________________________ + + : : : : + : : [4]...: + : : + [2]................: + +[1] Reset is asserted. +[2] Period of 1000 - 1100 usec. +[3] Reset is deasserted. +[4] Period of 315 usec. HWTRAP register is populated with incorrect + XTAL frequency. +[5] Signals reflect the bootstrapped configuration. + +Increase the delay between reset_control_assert() and +reset_control_deassert(), and gpiod_set_value_cansleep(priv->reset, 0) and +gpiod_set_value_cansleep(priv->reset, 1) to 5000 - 5100 usec. This amount +ensures a higher possibility that the switch IC will have these pins back +to the bootstrapping configuration before reset deassertion. + +With a cable from an active peer connected to port 3 before reset, the +correct crystal frequency (0b10 = 40MHz) is selected: + + [1] [2-1] [3] [5] + : : : : + _____________________________ __________________ +ESW_P4_LED_0 |_______| + ___________________ _______ +ESW_P3_LED_0 |_________| |__________________ + + : : : : : + : [2-2]...: [4]...: + [2]................: + +[1] Reset is asserted. +[2] Period of 5000 - 5100 usec. +[2-1] ESW_P3_LED_0 goes low. +[2-2] Remaining period of 5000 - 5100 usec. +[3] Reset is deasserted. +[4] Period of 310 usec. HWTRAP register is populated with bootstrapped + XTAL frequency. +[5] Signals reflect the bootstrapped configuration. + +ESW_P3_LED_0 low period before reset deassertion: + + 5000 usec + - 5100 usec + TEST RESET HOLD + # (usec) + --------------------- + 1 5410 + 2 5440 + 3 4375 + 4 5490 + 5 5475 + 6 4335 + 7 4370 + 8 5435 + 9 4205 + 10 4335 + 11 3750 + 12 3170 + 13 4395 + 14 4375 + 15 3515 + 16 4335 + 17 4220 + 18 4175 + 19 4175 + 20 4350 + + Min 3170 + Max 5490 + + Median 4342.500 + Avg 4466.500 + +Revert commit 2920dd92b980 ("net: dsa: mt7530: disable LEDs before reset"). +Changing the state of pins via reset assertion is simpler and more +efficient than doing so by setting the LED controller off. + +Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") +Fixes: c288575f7810 ("net: dsa: mt7530: Add the support of MT7531 switch") +Co-developed-by: Justin Swartz +Signed-off-by: Justin Swartz +Signed-off-by: Arınç ÜNAL +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mt7530.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index f74d9fbd08178..636943035c292 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -2154,11 +2154,11 @@ mt7530_setup(struct dsa_switch *ds) + */ + if (priv->mcm) { + reset_control_assert(priv->rstc); +- usleep_range(1000, 1100); ++ usleep_range(5000, 5100); + reset_control_deassert(priv->rstc); + } else { + gpiod_set_value_cansleep(priv->reset, 0); +- usleep_range(1000, 1100); ++ usleep_range(5000, 5100); + gpiod_set_value_cansleep(priv->reset, 1); + } + +@@ -2368,11 +2368,11 @@ mt7531_setup(struct dsa_switch *ds) + */ + if (priv->mcm) { + reset_control_assert(priv->rstc); +- usleep_range(1000, 1100); ++ usleep_range(5000, 5100); + reset_control_deassert(priv->rstc); + } else { + gpiod_set_value_cansleep(priv->reset, 0); +- usleep_range(1000, 1100); ++ usleep_range(5000, 5100); + gpiod_set_value_cansleep(priv->reset, 1); + } + +-- +2.43.0 + diff --git a/queue-5.15/net-ethernet-mtk_eth_soc-fix-ppe-hanging-issue.patch b/queue-5.15/net-ethernet-mtk_eth_soc-fix-ppe-hanging-issue.patch new file mode 100644 index 00000000000..942dab84dde --- /dev/null +++ b/queue-5.15/net-ethernet-mtk_eth_soc-fix-ppe-hanging-issue.patch @@ -0,0 +1,70 @@ +From 3bab6dd090d435dccc60f07ed829cec1ff73ef3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 22:50:40 +0000 +Subject: net: ethernet: mtk_eth_soc: fix PPE hanging issue + +From: Daniel Golle + +[ Upstream commit ea80e3ed09ab2c2b75724faf5484721753e92c31 ] + +A patch to resolve an issue was found in MediaTek's GPL-licensed SDK: +In the mtk_ppe_stop() function, the PPE scan mode is not disabled before +disabling the PPE. This can potentially lead to a hang during the process +of disabling the PPE. + +Without this patch, the PPE may experience a hang during the reboot test. + +Link: https://git01.mediatek.com/plugins/gitiles/openwrt/feeds/mtk-openwrt-feeds/+/b40da332dfe763932a82f9f62a4709457a15dd6c +Fixes: ba37b7caf1ed ("net: ethernet: mtk_eth_soc: add support for initializing the PPE") +Suggested-by: Bc-bocun Chen +Signed-off-by: Daniel Golle +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_ppe.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_ppe.c b/drivers/net/ethernet/mediatek/mtk_ppe.c +index 66298e2235c91..5e7b66846791d 100644 +--- a/drivers/net/ethernet/mediatek/mtk_ppe.c ++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c +@@ -425,7 +425,7 @@ int mtk_ppe_start(struct mtk_ppe *ppe) + MTK_PPE_KEEPALIVE_DISABLE) | + FIELD_PREP(MTK_PPE_TB_CFG_HASH_MODE, 1) | + FIELD_PREP(MTK_PPE_TB_CFG_SCAN_MODE, +- MTK_PPE_SCAN_MODE_KEEPALIVE_AGE) | ++ MTK_PPE_SCAN_MODE_CHECK_AGE) | + FIELD_PREP(MTK_PPE_TB_CFG_ENTRY_NUM, + MTK_PPE_ENTRIES_SHIFT); + ppe_w32(ppe, MTK_PPE_TB_CFG, val); +@@ -493,17 +493,21 @@ int mtk_ppe_stop(struct mtk_ppe *ppe) + + mtk_ppe_cache_enable(ppe, false); + +- /* disable offload engine */ +- ppe_clear(ppe, MTK_PPE_GLO_CFG, MTK_PPE_GLO_CFG_EN); +- ppe_w32(ppe, MTK_PPE_FLOW_CFG, 0); +- + /* disable aging */ + val = MTK_PPE_TB_CFG_AGE_NON_L4 | + MTK_PPE_TB_CFG_AGE_UNBIND | + MTK_PPE_TB_CFG_AGE_TCP | + MTK_PPE_TB_CFG_AGE_UDP | +- MTK_PPE_TB_CFG_AGE_TCP_FIN; ++ MTK_PPE_TB_CFG_AGE_TCP_FIN | ++ MTK_PPE_TB_CFG_SCAN_MODE; + ppe_clear(ppe, MTK_PPE_TB_CFG, val); + +- return mtk_ppe_wait_busy(ppe); ++ if (mtk_ppe_wait_busy(ppe)) ++ return -ETIMEDOUT; ++ ++ /* disable offload engine */ ++ ppe_clear(ppe, MTK_PPE_GLO_CFG, MTK_PPE_GLO_CFG_EN); ++ ppe_w32(ppe, MTK_PPE_FLOW_CFG, 0); ++ ++ return 0; + } +-- +2.43.0 + diff --git a/queue-5.15/net-mediatek-mtk_eth_soc-clear-mac_mcr_force_link-on.patch b/queue-5.15/net-mediatek-mtk_eth_soc-clear-mac_mcr_force_link-on.patch new file mode 100644 index 00000000000..9be76abb803 --- /dev/null +++ b/queue-5.15/net-mediatek-mtk_eth_soc-clear-mac_mcr_force_link-on.patch @@ -0,0 +1,60 @@ +From 30ab674e21e5edaecb2eaab4dfaca027a63c9c41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 22:50:18 +0000 +Subject: net: mediatek: mtk_eth_soc: clear MAC_MCR_FORCE_LINK only when MAC is + up + +From: Daniel Golle + +[ Upstream commit f1b85ef15a99f06ed48871ce933d591127d2dcc0 ] + +Clearing bit MAC_MCR_FORCE_LINK which forces the link down too early +can result in MAC ending up in a broken/blocked state. + +Fix this by handling this bit in the .mac_link_up and .mac_link_down +calls instead of in .mac_finish. + +Fixes: b8fc9f30821e ("net: ethernet: mediatek: Add basic PHYLINK support") +Suggested-by: Mason-cw Chang +Signed-off-by: Daniel Golle +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index c9d9a082c9f83..711acc6059a4f 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -382,8 +382,7 @@ static int mtk_mac_finish(struct phylink_config *config, unsigned int mode, + mcr_cur = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id)); + mcr_new = mcr_cur; + mcr_new |= MAC_MCR_IPG_CFG | MAC_MCR_FORCE_MODE | +- MAC_MCR_BACKOFF_EN | MAC_MCR_BACKPR_EN | MAC_MCR_FORCE_LINK | +- MAC_MCR_RX_FIFO_CLR_DIS; ++ MAC_MCR_BACKOFF_EN | MAC_MCR_BACKPR_EN | MAC_MCR_RX_FIFO_CLR_DIS; + + /* Only update control register when needed! */ + if (mcr_new != mcr_cur) +@@ -439,7 +438,7 @@ static void mtk_mac_link_down(struct phylink_config *config, unsigned int mode, + phylink_config); + u32 mcr = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id)); + +- mcr &= ~(MAC_MCR_TX_EN | MAC_MCR_RX_EN); ++ mcr &= ~(MAC_MCR_TX_EN | MAC_MCR_RX_EN | MAC_MCR_FORCE_LINK); + mtk_w32(mac->hw, mcr, MTK_MAC_MCR(mac->id)); + } + +@@ -477,7 +476,7 @@ static void mtk_mac_link_up(struct phylink_config *config, + if (rx_pause) + mcr |= MAC_MCR_FORCE_RX_FC; + +- mcr |= MAC_MCR_TX_EN | MAC_MCR_RX_EN; ++ mcr |= MAC_MCR_TX_EN | MAC_MCR_RX_EN | MAC_MCR_FORCE_LINK; + mtk_w32(mac->hw, mcr, MTK_MAC_MCR(mac->id)); + } + +-- +2.43.0 + diff --git a/queue-5.15/net-mtk_eth_soc-move-mac_mcr-setting-to-mac_finish.patch b/queue-5.15/net-mtk_eth_soc-move-mac_mcr-setting-to-mac_finish.patch new file mode 100644 index 00000000000..52b5a4f66c0 --- /dev/null +++ b/queue-5.15/net-mtk_eth_soc-move-mac_mcr-setting-to-mac_finish.patch @@ -0,0 +1,90 @@ +From 0b8eb0cd78449044737f67d718bc3c05829b9001 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 15:55:12 +0100 +Subject: net: mtk_eth_soc: move MAC_MCR setting to mac_finish() + +From: Russell King (Oracle) + +[ Upstream commit 0e37ad71b2ff772009595002da2860999e98e14e ] + +Move the setting of the MTK_MAC_MCR register from the end of mac_config +into the phylink mac_finish() method, to keep it as the very last write +that is done during configuration. + +Signed-off-by: Russell King (Oracle) +Signed-off-by: Jakub Kicinski +Stable-dep-of: f1b85ef15a99 ("net: mediatek: mtk_eth_soc: clear MAC_MCR_FORCE_LINK only when MAC is up") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 33 ++++++++++++++------- + 1 file changed, 22 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index 139dfdb1e58bd..c9d9a082c9f83 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -223,8 +223,8 @@ static void mtk_mac_config(struct phylink_config *config, unsigned int mode, + struct mtk_mac *mac = container_of(config, struct mtk_mac, + phylink_config); + struct mtk_eth *eth = mac->hw; +- u32 mcr_cur, mcr_new, sid, i; + int val, ge_mode, err = 0; ++ u32 sid, i; + + /* MT76x8 has no hardware settings between for the MAC */ + if (!MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628) && +@@ -359,6 +359,25 @@ static void mtk_mac_config(struct phylink_config *config, unsigned int mode, + return; + } + ++ return; ++ ++err_phy: ++ dev_err(eth->dev, "%s: GMAC%d mode %s not supported!\n", __func__, ++ mac->id, phy_modes(state->interface)); ++ return; ++ ++init_err: ++ dev_err(eth->dev, "%s: GMAC%d mode %s err: %d!\n", __func__, ++ mac->id, phy_modes(state->interface), err); ++} ++ ++static int mtk_mac_finish(struct phylink_config *config, unsigned int mode, ++ phy_interface_t interface) ++{ ++ struct mtk_mac *mac = container_of(config, struct mtk_mac, ++ phylink_config); ++ u32 mcr_cur, mcr_new; ++ + /* Setup gmac */ + mcr_cur = mtk_r32(mac->hw, MTK_MAC_MCR(mac->id)); + mcr_new = mcr_cur; +@@ -370,16 +389,7 @@ static void mtk_mac_config(struct phylink_config *config, unsigned int mode, + if (mcr_new != mcr_cur) + mtk_w32(mac->hw, mcr_new, MTK_MAC_MCR(mac->id)); + +- return; +- +-err_phy: +- dev_err(eth->dev, "%s: GMAC%d mode %s not supported!\n", __func__, +- mac->id, phy_modes(state->interface)); +- return; +- +-init_err: +- dev_err(eth->dev, "%s: GMAC%d mode %s err: %d!\n", __func__, +- mac->id, phy_modes(state->interface), err); ++ return 0; + } + + static void mtk_mac_pcs_get_state(struct phylink_config *config, +@@ -562,6 +572,7 @@ static const struct phylink_mac_ops mtk_phylink_ops = { + .mac_pcs_get_state = mtk_mac_pcs_get_state, + .mac_an_restart = mtk_mac_an_restart, + .mac_config = mtk_mac_config, ++ .mac_finish = mtk_mac_finish, + .mac_link_down = mtk_mac_link_down, + .mac_link_up = mtk_mac_link_up, + }; +-- +2.43.0 + diff --git a/queue-5.15/net-phy-fix-phy_read_poll_timeout-argument-type-in-g.patch b/queue-5.15/net-phy-fix-phy_read_poll_timeout-argument-type-in-g.patch new file mode 100644 index 00000000000..9bd08151a63 --- /dev/null +++ b/queue-5.15/net-phy-fix-phy_read_poll_timeout-argument-type-in-g.patch @@ -0,0 +1,53 @@ +From 8af7b1b2a81b7a14d427d312fc1bca8516846c56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 20:50:52 +0300 +Subject: net: phy: fix phy_read_poll_timeout argument type in genphy_loopback + +From: Nikita Kiryushin + +[ Upstream commit 32fa4366cc4da1c97b725a0066adf43c6b298f37 ] + +read_poll_timeout inside phy_read_poll_timeout can set val negative +in some cases (for example, __mdiobus_read inside phy_read can return +-EOPNOTSUPP). + +Supposedly, commit 4ec732951702 ("net: phylib: fix phy_read*_poll_timeout()") +should fix problems with wrong-signed vals, but I do not see how +as val is sent to phy_read as is and __val = phy_read (not val) +is checked for sign. + +Change val type for signed to allow better error handling as done in other +phy_read_poll_timeout callers. This will not fix any error handling +by itself, but allows, for example, to modify cond with appropriate +sign check or check resulting val separately. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 014068dcb5b1 ("net: phy: genphy_loopback: add link speed configuration") +Signed-off-by: Nikita Kiryushin +Reviewed-by: Russell King (Oracle) +Link: https://lore.kernel.org/r/20240315175052.8049-1-kiryushin@ancud.ru +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/phy/phy_device.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index c1d6ebf12ec74..523436690adef 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -2645,8 +2645,8 @@ EXPORT_SYMBOL(genphy_resume); + int genphy_loopback(struct phy_device *phydev, bool enable) + { + if (enable) { +- u16 val, ctl = BMCR_LOOPBACK; +- int ret; ++ u16 ctl = BMCR_LOOPBACK; ++ int ret, val; + + if (phydev->speed == SPEED_1000) + ctl |= BMCR_SPEED1000; +-- +2.43.0 + diff --git a/queue-5.15/net-report-rcu-qs-on-threaded-napi-repolling.patch b/queue-5.15/net-report-rcu-qs-on-threaded-napi-repolling.patch new file mode 100644 index 00000000000..4b226107edf --- /dev/null +++ b/queue-5.15/net-report-rcu-qs-on-threaded-napi-repolling.patch @@ -0,0 +1,87 @@ +From 965cd4f6e6706bcd5bd26830c50db69fdf5f05fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Mar 2024 13:44:37 -0700 +Subject: net: report RCU QS on threaded NAPI repolling + +From: Yan Zhai + +[ Upstream commit d6dbbb11247c71203785a2c9da474c36f4b19eae ] + +NAPI threads can keep polling packets under load. Currently it is only +calling cond_resched() before repolling, but it is not sufficient to +clear out the holdout of RCU tasks, which prevent BPF tracing programs +from detaching for long period. This can be reproduced easily with +following set up: + +ip netns add test1 +ip netns add test2 + +ip -n test1 link add veth1 type veth peer name veth2 netns test2 + +ip -n test1 link set veth1 up +ip -n test1 link set lo up +ip -n test2 link set veth2 up +ip -n test2 link set lo up + +ip -n test1 addr add 192.168.1.2/31 dev veth1 +ip -n test1 addr add 1.1.1.1/32 dev lo +ip -n test2 addr add 192.168.1.3/31 dev veth2 +ip -n test2 addr add 2.2.2.2/31 dev lo + +ip -n test1 route add default via 192.168.1.3 +ip -n test2 route add default via 192.168.1.2 + +for i in `seq 10 210`; do + for j in `seq 10 210`; do + ip netns exec test2 iptables -I INPUT -s 3.3.$i.$j -p udp --dport 5201 + done +done + +ip netns exec test2 ethtool -K veth2 gro on +ip netns exec test2 bash -c 'echo 1 > /sys/class/net/veth2/threaded' +ip netns exec test1 ethtool -K veth1 tso off + +Then run an iperf3 client/server and a bpftrace script can trigger it: + +ip netns exec test2 iperf3 -s -B 2.2.2.2 >/dev/null& +ip netns exec test1 iperf3 -c 2.2.2.2 -B 1.1.1.1 -u -l 1500 -b 3g -t 100 >/dev/null& +bpftrace -e 'kfunc:__napi_poll{@=count();} interval:s:1{exit();}' + +Report RCU quiescent states periodically will resolve the issue. + +Fixes: 29863d41bb6e ("net: implement threaded-able napi poll loop support") +Reviewed-by: Jesper Dangaard Brouer +Signed-off-by: Yan Zhai +Acked-by: Paul E. McKenney +Acked-by: Jesper Dangaard Brouer +Link: https://lore.kernel.org/r/4c3b0d3f32d3b18949d75b18e5e1d9f13a24f025.1710877680.git.yan@cloudflare.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/dev.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/core/dev.c b/net/core/dev.c +index 1e41971c06177..f80bc2ca888aa 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -7143,6 +7143,8 @@ static int napi_threaded_poll(void *data) + void *have; + + while (!napi_thread_wait(napi)) { ++ unsigned long last_qs = jiffies; ++ + for (;;) { + bool repoll = false; + +@@ -7157,6 +7159,7 @@ static int napi_threaded_poll(void *data) + if (!repoll) + break; + ++ rcu_softirq_qs_periodic(last_qs); + cond_resched(); + } + } +-- +2.43.0 + diff --git a/queue-5.15/net-veth-do-not-manipulate-gro-when-using-xdp.patch b/queue-5.15/net-veth-do-not-manipulate-gro-when-using-xdp.patch new file mode 100644 index 00000000000..8d13a596c5a --- /dev/null +++ b/queue-5.15/net-veth-do-not-manipulate-gro-when-using-xdp.patch @@ -0,0 +1,85 @@ +From 5c2cb92890cbd6abe8f881466ad30fff23adc0d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 19:37:58 +0100 +Subject: net: veth: do not manipulate GRO when using XDP +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ignat Korchagin + +[ Upstream commit d7db7775ea2e31502d46427f5efd385afc4ff1eb ] + +Commit d3256efd8e8b ("veth: allow enabling NAPI even without XDP") tried to fix +the fact that GRO was not possible without XDP, because veth did not use NAPI +without XDP. However, it also introduced the behaviour that GRO is always +enabled, when XDP is enabled. + +While it might be desired for most cases, it is confusing for the user at best +as the GRO flag suddenly changes, when an XDP program is attached. It also +introduces some complexities in state management as was partially addressed in +commit fe9f801355f0 ("net: veth: clear GRO when clearing XDP even when down"). + +But the biggest problem is that it is not possible to disable GRO at all, when +an XDP program is attached, which might be needed for some use cases. + +Fix this by not touching the GRO flag on XDP enable/disable as the code already +supports switching to NAPI if either GRO or XDP is requested. + +Link: https://lore.kernel.org/lkml/20240311124015.38106-1-ignat@cloudflare.com/ +Fixes: d3256efd8e8b ("veth: allow enabling NAPI even without XDP") +Fixes: fe9f801355f0 ("net: veth: clear GRO when clearing XDP even when down") +Signed-off-by: Ignat Korchagin +Reviewed-by: Toke Høiland-Jørgensen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/veth.c | 18 ------------------ + 1 file changed, 18 deletions(-) + +diff --git a/drivers/net/veth.c b/drivers/net/veth.c +index 0102f86d48676..cfacf8965bc59 100644 +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -1388,8 +1388,6 @@ static netdev_features_t veth_fix_features(struct net_device *dev, + if (peer_priv->_xdp_prog) + features &= ~NETIF_F_GSO_SOFTWARE; + } +- if (priv->_xdp_prog) +- features |= NETIF_F_GRO; + + return features; + } +@@ -1481,14 +1479,6 @@ static int veth_xdp_set(struct net_device *dev, struct bpf_prog *prog, + } + + if (!old_prog) { +- if (!veth_gro_requested(dev)) { +- /* user-space did not require GRO, but adding +- * XDP is supposed to get GRO working +- */ +- dev->features |= NETIF_F_GRO; +- netdev_features_change(dev); +- } +- + peer->hw_features &= ~NETIF_F_GSO_SOFTWARE; + peer->max_mtu = max_mtu; + } +@@ -1499,14 +1489,6 @@ static int veth_xdp_set(struct net_device *dev, struct bpf_prog *prog, + if (dev->flags & IFF_UP) + veth_disable_xdp(dev); + +- /* if user-space did not require GRO, since adding XDP +- * enabled it, clear it now +- */ +- if (!veth_gro_requested(dev)) { +- dev->features &= ~NETIF_F_GRO; +- netdev_features_change(dev); +- } +- + if (peer) { + peer->hw_features |= NETIF_F_GSO_SOFTWARE; + peer->max_mtu = ETH_MAX_MTU; +-- +2.43.0 + diff --git a/queue-5.15/netfilter-nf_tables-do-not-compare-internal-table-fl.patch b/queue-5.15/netfilter-nf_tables-do-not-compare-internal-table-fl.patch new file mode 100644 index 00000000000..76db9dd4aff --- /dev/null +++ b/queue-5.15/netfilter-nf_tables-do-not-compare-internal-table-fl.patch @@ -0,0 +1,34 @@ +From 53bc601f395ba880bcf9f44e4caacbf7f259725a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 18:51:38 +0100 +Subject: netfilter: nf_tables: do not compare internal table flags on updates + +From: Pablo Neira Ayuso + +[ Upstream commit 4a0e7f2decbf9bd72461226f1f5f7dcc4b08f139 ] + +Restore skipping transaction if table update does not modify flags. + +Fixes: 179d9ba5559a ("netfilter: nf_tables: fix table flag updates") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index a5e1468cac5ed..42bf83a20cb52 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -1152,7 +1152,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx) + if (flags & ~NFT_TABLE_F_MASK) + return -EOPNOTSUPP; + +- if (flags == ctx->table->flags) ++ if (flags == (ctx->table->flags & NFT_TABLE_F_MASK)) + return 0; + + if ((nft_table_has_owner(ctx->table) && +-- +2.43.0 + diff --git a/queue-5.15/netfilter-nft_set_pipapo-release-elements-in-clone-o.patch b/queue-5.15/netfilter-nft_set_pipapo-release-elements-in-clone-o.patch new file mode 100644 index 00000000000..c16f293fb86 --- /dev/null +++ b/queue-5.15/netfilter-nft_set_pipapo-release-elements-in-clone-o.patch @@ -0,0 +1,54 @@ +From 0881d63a0674c85c36ae9a538c4ac11abcc260d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Mar 2024 10:02:41 +0100 +Subject: netfilter: nft_set_pipapo: release elements in clone only from + destroy path + +From: Pablo Neira Ayuso + +[ Upstream commit b0e256f3dd2ba6532f37c5c22e07cb07a36031ee ] + +Clone already always provides a current view of the lookup table, use it +to destroy the set, otherwise it is possible to destroy elements twice. + +This fix requires: + + 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol") + +which came after: + + 9827a0e6e23b ("netfilter: nft_set_pipapo: release elements in clone from abort path"). + +Fixes: 9827a0e6e23b ("netfilter: nft_set_pipapo: release elements in clone from abort path") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_set_pipapo.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c +index e1969209b3abb..58eca26162735 100644 +--- a/net/netfilter/nft_set_pipapo.c ++++ b/net/netfilter/nft_set_pipapo.c +@@ -2240,8 +2240,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx, + if (m) { + rcu_barrier(); + +- nft_set_pipapo_match_destroy(ctx, set, m); +- + for_each_possible_cpu(cpu) + pipapo_free_scratch(m, cpu); + free_percpu(m->scratch); +@@ -2253,8 +2251,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx, + if (priv->clone) { + m = priv->clone; + +- if (priv->dirty) +- nft_set_pipapo_match_destroy(ctx, set, m); ++ nft_set_pipapo_match_destroy(ctx, set, m); + + for_each_possible_cpu(cpu) + pipapo_free_scratch(priv->clone, cpu); +-- +2.43.0 + diff --git a/queue-5.15/nouveau-reset-the-bo-resource-bus-info-after-an-evic.patch b/queue-5.15/nouveau-reset-the-bo-resource-bus-info-after-an-evic.patch new file mode 100644 index 00000000000..7e37b8585ef --- /dev/null +++ b/queue-5.15/nouveau-reset-the-bo-resource-bus-info-after-an-evic.patch @@ -0,0 +1,43 @@ +From 093645b79d445cb8cd5cd80e181c91f136c14b67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 17:20:37 +1000 +Subject: nouveau: reset the bo resource bus info after an eviction +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dave Airlie + +[ Upstream commit f35c9af45ea7a4b1115b193d84858b14d13517fc ] + +Later attempts to refault the bo won't happen and the whole +GPU does to lunch. I think Christian's refactoring of this +code out to the driver broke this not very well tested path. + +Fixes: 141b15e59175 ("drm/nouveau: move io_reserve_lru handling into the driver v5") +Cc: Christian König +Signed-off-by: Dave Airlie +Acked-by: Christian König +Signed-off-by: Danilo Krummrich +Link: https://patchwork.freedesktop.org/patch/msgid/20240311072037.287905-1-airlied@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nouveau_bo.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c +index da58230bcb1fc..2048eac841ddf 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_bo.c ++++ b/drivers/gpu/drm/nouveau/nouveau_bo.c +@@ -1186,6 +1186,8 @@ nouveau_ttm_io_mem_reserve(struct ttm_device *bdev, struct ttm_resource *reg) + drm_vma_node_unmap(&nvbo->bo.base.vma_node, + bdev->dev_mapping); + nouveau_ttm_io_mem_free_locked(drm, nvbo->bo.resource); ++ nvbo->bo.resource->bus.offset = 0; ++ nvbo->bo.resource->bus.addr = NULL; + goto retry; + } + +-- +2.43.0 + diff --git a/queue-5.15/nvme-add-common-helpers-to-allocate-and-free-tagsets.patch b/queue-5.15/nvme-add-common-helpers-to-allocate-and-free-tagsets.patch new file mode 100644 index 00000000000..9d1e41bed2a --- /dev/null +++ b/queue-5.15/nvme-add-common-helpers-to-allocate-and-free-tagsets.patch @@ -0,0 +1,156 @@ +From f20f595626d655d422955f1f326614b56da5ac98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Sep 2022 15:18:30 +0300 +Subject: nvme: add common helpers to allocate and free tagsets + +From: Christoph Hellwig + +[ Upstream commit fe60e8c534118a288cd251a59d747cbf5c03e160 ] + +Add common helpers to allocate and tear down the admin and I/O tag sets, +including the special queues allocated with them. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Chaitanya Kulkarni +Stable-dep-of: de105068fead ("nvme: fix reconnection fail due to reserved tag allocation") +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 102 +++++++++++++++++++++++++++++++++++++++ + drivers/nvme/host/nvme.h | 8 +++ + 2 files changed, 110 insertions(+) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 8f06e5c1706ba..d9c7d1cf6bd2a 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -4463,6 +4463,108 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status, + } + EXPORT_SYMBOL_GPL(nvme_complete_async_event); + ++int nvme_alloc_admin_tag_set(struct nvme_ctrl *ctrl, struct blk_mq_tag_set *set, ++ const struct blk_mq_ops *ops, unsigned int flags, ++ unsigned int cmd_size) ++{ ++ int ret; ++ ++ memset(set, 0, sizeof(*set)); ++ set->ops = ops; ++ set->queue_depth = NVME_AQ_MQ_TAG_DEPTH; ++ if (ctrl->ops->flags & NVME_F_FABRICS) ++ set->reserved_tags = NVMF_RESERVED_TAGS; ++ set->numa_node = ctrl->numa_node; ++ set->flags = flags; ++ set->cmd_size = cmd_size; ++ set->driver_data = ctrl; ++ set->nr_hw_queues = 1; ++ set->timeout = NVME_ADMIN_TIMEOUT; ++ ret = blk_mq_alloc_tag_set(set); ++ if (ret) ++ return ret; ++ ++ ctrl->admin_q = blk_mq_init_queue(set); ++ if (IS_ERR(ctrl->admin_q)) { ++ ret = PTR_ERR(ctrl->admin_q); ++ goto out_free_tagset; ++ } ++ ++ if (ctrl->ops->flags & NVME_F_FABRICS) { ++ ctrl->fabrics_q = blk_mq_init_queue(set); ++ if (IS_ERR(ctrl->fabrics_q)) { ++ ret = PTR_ERR(ctrl->fabrics_q); ++ goto out_cleanup_admin_q; ++ } ++ } ++ ++ ctrl->admin_tagset = set; ++ return 0; ++ ++out_cleanup_admin_q: ++ blk_mq_destroy_queue(ctrl->fabrics_q); ++out_free_tagset: ++ blk_mq_free_tag_set(ctrl->admin_tagset); ++ return ret; ++} ++EXPORT_SYMBOL_GPL(nvme_alloc_admin_tag_set); ++ ++void nvme_remove_admin_tag_set(struct nvme_ctrl *ctrl) ++{ ++ blk_mq_destroy_queue(ctrl->admin_q); ++ if (ctrl->ops->flags & NVME_F_FABRICS) ++ blk_mq_destroy_queue(ctrl->fabrics_q); ++ blk_mq_free_tag_set(ctrl->admin_tagset); ++} ++EXPORT_SYMBOL_GPL(nvme_remove_admin_tag_set); ++ ++int nvme_alloc_io_tag_set(struct nvme_ctrl *ctrl, struct blk_mq_tag_set *set, ++ const struct blk_mq_ops *ops, unsigned int flags, ++ unsigned int cmd_size) ++{ ++ int ret; ++ ++ memset(set, 0, sizeof(*set)); ++ set->ops = ops; ++ set->queue_depth = ctrl->sqsize + 1; ++ set->reserved_tags = NVMF_RESERVED_TAGS; ++ set->numa_node = ctrl->numa_node; ++ set->flags = flags; ++ set->cmd_size = cmd_size, ++ set->driver_data = ctrl; ++ set->nr_hw_queues = ctrl->queue_count - 1; ++ set->timeout = NVME_IO_TIMEOUT; ++ if (ops->map_queues) ++ set->nr_maps = ctrl->opts->nr_poll_queues ? HCTX_MAX_TYPES : 2; ++ ret = blk_mq_alloc_tag_set(set); ++ if (ret) ++ return ret; ++ ++ if (ctrl->ops->flags & NVME_F_FABRICS) { ++ ctrl->connect_q = blk_mq_init_queue(set); ++ if (IS_ERR(ctrl->connect_q)) { ++ ret = PTR_ERR(ctrl->connect_q); ++ goto out_free_tag_set; ++ } ++ } ++ ++ ctrl->tagset = set; ++ return 0; ++ ++out_free_tag_set: ++ blk_mq_free_tag_set(set); ++ return ret; ++} ++EXPORT_SYMBOL_GPL(nvme_alloc_io_tag_set); ++ ++void nvme_remove_io_tag_set(struct nvme_ctrl *ctrl) ++{ ++ if (ctrl->ops->flags & NVME_F_FABRICS) ++ blk_mq_destroy_queue(ctrl->connect_q); ++ blk_mq_free_tag_set(ctrl->tagset); ++} ++EXPORT_SYMBOL_GPL(nvme_remove_io_tag_set); ++ + void nvme_stop_ctrl(struct nvme_ctrl *ctrl) + { + nvme_mpath_stop(ctrl); +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index f9bfd6a549f37..a9e4deb1c7d01 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -686,6 +686,14 @@ void nvme_uninit_ctrl(struct nvme_ctrl *ctrl); + void nvme_start_ctrl(struct nvme_ctrl *ctrl); + void nvme_stop_ctrl(struct nvme_ctrl *ctrl); + int nvme_init_ctrl_finish(struct nvme_ctrl *ctrl); ++int nvme_alloc_admin_tag_set(struct nvme_ctrl *ctrl, struct blk_mq_tag_set *set, ++ const struct blk_mq_ops *ops, unsigned int flags, ++ unsigned int cmd_size); ++void nvme_remove_admin_tag_set(struct nvme_ctrl *ctrl); ++int nvme_alloc_io_tag_set(struct nvme_ctrl *ctrl, struct blk_mq_tag_set *set, ++ const struct blk_mq_ops *ops, unsigned int flags, ++ unsigned int cmd_size); ++void nvme_remove_io_tag_set(struct nvme_ctrl *ctrl); + + void nvme_remove_namespaces(struct nvme_ctrl *ctrl); + +-- +2.43.0 + diff --git a/queue-5.15/nvme-add-the-apple-shared-tag-workaround-to-nvme_all.patch b/queue-5.15/nvme-add-the-apple-shared-tag-workaround-to-nvme_all.patch new file mode 100644 index 00000000000..b1642e0edee --- /dev/null +++ b/queue-5.15/nvme-add-the-apple-shared-tag-workaround-to-nvme_all.patch @@ -0,0 +1,43 @@ +From 21780eca45d4ee620b41e8a2b60160bb6ae30866 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Nov 2022 17:28:48 +0100 +Subject: nvme: add the Apple shared tag workaround to nvme_alloc_io_tag_set + +From: Christoph Hellwig + +[ Upstream commit 93b24f579c392bac2e491fee79ad5ce5a131992e ] + +Add the apple shared tag workaround to nvme_alloc_io_tag_set to prepare +for using that helper in the PCIe driver. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Stable-dep-of: de105068fead ("nvme: fix reconnection fail due to reserved tag allocation") +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index a65b35d20c7fb..a13c2f3a043d4 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -4527,7 +4527,13 @@ int nvme_alloc_io_tag_set(struct nvme_ctrl *ctrl, struct blk_mq_tag_set *set, + memset(set, 0, sizeof(*set)); + set->ops = ops; + set->queue_depth = ctrl->sqsize + 1; +- if (ctrl->ops->flags & NVME_F_FABRICS) ++ /* ++ * Some Apple controllers requires tags to be unique across admin and ++ * the (only) I/O queue, so reserve the first 32 tags of the I/O queue. ++ */ ++ if (ctrl->quirks & NVME_QUIRK_SHARED_TAGS) ++ set->reserved_tags = NVME_AQ_DEPTH; ++ else if (ctrl->ops->flags & NVME_F_FABRICS) + set->reserved_tags = NVMF_RESERVED_TAGS; + set->numa_node = ctrl->numa_node; + set->flags = flags; +-- +2.43.0 + diff --git a/queue-5.15/nvme-fix-reconnection-fail-due-to-reserved-tag-alloc.patch b/queue-5.15/nvme-fix-reconnection-fail-due-to-reserved-tag-alloc.patch new file mode 100644 index 00000000000..ef8c4c220ca --- /dev/null +++ b/queue-5.15/nvme-fix-reconnection-fail-due-to-reserved-tag-alloc.patch @@ -0,0 +1,78 @@ +From 2d0d3be103fe6ba53e4ebcb7302e4b524a9099fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 10:09:27 +0800 +Subject: nvme: fix reconnection fail due to reserved tag allocation + +From: Chunguang Xu + +[ Upstream commit de105068fead55ed5c07ade75e9c8e7f86a00d1d ] + +We found a issue on production environment while using NVMe over RDMA, +admin_q reconnect failed forever while remote target and network is ok. +After dig into it, we found it may caused by a ABBA deadlock due to tag +allocation. In my case, the tag was hold by a keep alive request +waiting inside admin_q, as we quiesced admin_q while reset ctrl, so the +request maked as idle and will not process before reset success. As +fabric_q shares tagset with admin_q, while reconnect remote target, we +need a tag for connect command, but the only one reserved tag was held +by keep alive command which waiting inside admin_q. As a result, we +failed to reconnect admin_q forever. In order to fix this issue, I +think we should keep two reserved tags for admin queue. + +Fixes: ed01fee283a0 ("nvme-fabrics: only reserve a single tag") +Signed-off-by: Chunguang Xu +Reviewed-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 6 ++++-- + drivers/nvme/host/fabrics.h | 7 ------- + 2 files changed, 4 insertions(+), 9 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index a13c2f3a043d4..bc4e9d625a61b 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -4473,7 +4473,8 @@ int nvme_alloc_admin_tag_set(struct nvme_ctrl *ctrl, struct blk_mq_tag_set *set, + set->ops = ops; + set->queue_depth = NVME_AQ_MQ_TAG_DEPTH; + if (ctrl->ops->flags & NVME_F_FABRICS) +- set->reserved_tags = NVMF_RESERVED_TAGS; ++ /* Reserved for fabric connect and keep alive */ ++ set->reserved_tags = 2; + set->numa_node = ctrl->numa_node; + set->flags = flags; + set->cmd_size = cmd_size; +@@ -4534,7 +4535,8 @@ int nvme_alloc_io_tag_set(struct nvme_ctrl *ctrl, struct blk_mq_tag_set *set, + if (ctrl->quirks & NVME_QUIRK_SHARED_TAGS) + set->reserved_tags = NVME_AQ_DEPTH; + else if (ctrl->ops->flags & NVME_F_FABRICS) +- set->reserved_tags = NVMF_RESERVED_TAGS; ++ /* Reserved for fabric connect */ ++ set->reserved_tags = 1; + set->numa_node = ctrl->numa_node; + set->flags = flags; + set->cmd_size = cmd_size, +diff --git a/drivers/nvme/host/fabrics.h b/drivers/nvme/host/fabrics.h +index 561c2abd3892b..256bb91d33f2d 100644 +--- a/drivers/nvme/host/fabrics.h ++++ b/drivers/nvme/host/fabrics.h +@@ -18,13 +18,6 @@ + /* default is -1: the fail fast mechanism is disabled */ + #define NVMF_DEF_FAIL_FAST_TMO -1 + +-/* +- * Reserved one command for internal usage. This command is used for sending +- * the connect command, as well as for the keep alive command on the admin +- * queue once live. +- */ +-#define NVMF_RESERVED_TAGS 1 +- + /* + * Define a host as seen by the target. We allocate one at boot, but also + * allow the override it when creating controllers. This is both to provide +-- +2.43.0 + diff --git a/queue-5.15/nvme-only-set-reserved_tags-in-nvme_alloc_io_tag_set.patch b/queue-5.15/nvme-only-set-reserved_tags-in-nvme_alloc_io_tag_set.patch new file mode 100644 index 00000000000..72c3e38fead --- /dev/null +++ b/queue-5.15/nvme-only-set-reserved_tags-in-nvme_alloc_io_tag_set.patch @@ -0,0 +1,40 @@ +From ba17729ae9aaa82d2cb0f6230d60c8dfe957cdad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Nov 2022 17:27:07 +0100 +Subject: nvme: only set reserved_tags in nvme_alloc_io_tag_set for fabrics + controllers + +From: Christoph Hellwig + +[ Upstream commit b794d1c2ad6d7921f2867ce393815ad31b5b5a83 ] + +The reserved_tags are only needed for fabrics controllers. Right now only +fabrics drivers call this helper, so this is harmless, but we'll use it +in the PCIe driver soon. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Stable-dep-of: de105068fead ("nvme: fix reconnection fail due to reserved tag allocation") +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index d9c7d1cf6bd2a..a65b35d20c7fb 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -4527,7 +4527,8 @@ int nvme_alloc_io_tag_set(struct nvme_ctrl *ctrl, struct blk_mq_tag_set *set, + memset(set, 0, sizeof(*set)); + set->ops = ops; + set->queue_depth = ctrl->sqsize + 1; +- set->reserved_tags = NVMF_RESERVED_TAGS; ++ if (ctrl->ops->flags & NVME_F_FABRICS) ++ set->reserved_tags = NVMF_RESERVED_TAGS; + set->numa_node = ctrl->numa_node; + set->flags = flags; + set->cmd_size = cmd_size, +-- +2.43.0 + diff --git a/queue-5.15/octeontx2-af-use-matching-wake_up-api-variant-in-cgx.patch b/queue-5.15/octeontx2-af-use-matching-wake_up-api-variant-in-cgx.patch new file mode 100644 index 00000000000..5f86ecc29b5 --- /dev/null +++ b/queue-5.15/octeontx2-af-use-matching-wake_up-api-variant-in-cgx.patch @@ -0,0 +1,39 @@ +From 03221119e68e6af564d8a2036b2045fd19bb1250 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 12:36:22 +0530 +Subject: octeontx2-af: Use matching wake_up API variant in CGX command + interface + +From: Linu Cherian + +[ Upstream commit e642921dfeed1e15e73f78f2c3b6746f72b6deb2 ] + +Use wake_up API instead of wake_up_interruptible, since +wait_event_timeout API is used for waiting on command completion. + +Fixes: 1463f382f58d ("octeontx2-af: Add support for CGX link management") +Signed-off-by: Linu Cherian +Signed-off-by: Sunil Goutham +Signed-off-by: Subbaraya Sundeep +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +index 1a269a2e61fdb..3ade1a6e2f1e0 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +@@ -1205,7 +1205,7 @@ static irqreturn_t cgx_fwi_event_handler(int irq, void *data) + + /* Release thread waiting for completion */ + lmac->cmd_pend = false; +- wake_up_interruptible(&lmac->wq_cmd_cmplt); ++ wake_up(&lmac->wq_cmd_cmplt); + break; + case CGX_EVT_ASYNC: + if (cgx_event_is_linkevent(event)) +-- +2.43.0 + diff --git a/queue-5.15/octeontx2-af-use-separate-handlers-for-interrupts.patch b/queue-5.15/octeontx2-af-use-separate-handlers-for-interrupts.patch new file mode 100644 index 00000000000..67e5082528c --- /dev/null +++ b/queue-5.15/octeontx2-af-use-separate-handlers-for-interrupts.patch @@ -0,0 +1,69 @@ +From c8a66d25d54332d048fe3269ab71a4ab798e8e58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Mar 2024 14:59:58 +0530 +Subject: octeontx2-af: Use separate handlers for interrupts + +From: Subbaraya Sundeep + +[ Upstream commit 50e60de381c342008c0956fd762e1c26408f372c ] + +For PF to AF interrupt vector and VF to AF vector same +interrupt handler is registered which is causing race condition. +When two interrupts are raised to two CPUs at same time +then two cores serve same event corrupting the data. + +Fixes: 7304ac4567bc ("octeontx2-af: Add mailbox IRQ and msg handlers") +Signed-off-by: Subbaraya Sundeep +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +index f64509b1d120c..bac42e0065c6c 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +@@ -2435,10 +2435,9 @@ static void rvu_queue_work(struct mbox_wq_info *mw, int first, + } + } + +-static irqreturn_t rvu_mbox_intr_handler(int irq, void *rvu_irq) ++static irqreturn_t rvu_mbox_pf_intr_handler(int irq, void *rvu_irq) + { + struct rvu *rvu = (struct rvu *)rvu_irq; +- int vfs = rvu->vfs; + u64 intr; + + intr = rvu_read64(rvu, BLKADDR_RVUM, RVU_AF_PFAF_MBOX_INT); +@@ -2452,6 +2451,18 @@ static irqreturn_t rvu_mbox_intr_handler(int irq, void *rvu_irq) + + rvu_queue_work(&rvu->afpf_wq_info, 0, rvu->hw->total_pfs, intr); + ++ return IRQ_HANDLED; ++} ++ ++static irqreturn_t rvu_mbox_intr_handler(int irq, void *rvu_irq) ++{ ++ struct rvu *rvu = (struct rvu *)rvu_irq; ++ int vfs = rvu->vfs; ++ u64 intr; ++ ++ /* Sync with mbox memory region */ ++ rmb(); ++ + /* Handle VF interrupts */ + if (vfs > 64) { + intr = rvupf_read64(rvu, RVU_PF_VFPF_MBOX_INTX(1)); +@@ -2779,7 +2790,7 @@ static int rvu_register_interrupts(struct rvu *rvu) + /* Register mailbox interrupt handler */ + sprintf(&rvu->irq_name[RVU_AF_INT_VEC_MBOX * NAME_SIZE], "RVUAF Mbox"); + ret = request_irq(pci_irq_vector(rvu->pdev, RVU_AF_INT_VEC_MBOX), +- rvu_mbox_intr_handler, 0, ++ rvu_mbox_pf_intr_handler, 0, + &rvu->irq_name[RVU_AF_INT_VEC_MBOX * NAME_SIZE], rvu); + if (ret) { + dev_err(rvu->dev, +-- +2.43.0 + diff --git a/queue-5.15/packet-annotate-data-races-around-ignore_outgoing.patch b/queue-5.15/packet-annotate-data-races-around-ignore_outgoing.patch new file mode 100644 index 00000000000..9f4e4725691 --- /dev/null +++ b/queue-5.15/packet-annotate-data-races-around-ignore_outgoing.patch @@ -0,0 +1,105 @@ +From 88b3676e6e629e350724b9111cc41c2bb01f8aa6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 14:18:16 +0000 +Subject: packet: annotate data-races around ignore_outgoing + +From: Eric Dumazet + +[ Upstream commit 6ebfad33161afacb3e1e59ed1c2feefef70f9f97 ] + +ignore_outgoing is read locklessly from dev_queue_xmit_nit() +and packet_getsockopt() + +Add appropriate READ_ONCE()/WRITE_ONCE() annotations. + +syzbot reported: + +BUG: KCSAN: data-race in dev_queue_xmit_nit / packet_setsockopt + +write to 0xffff888107804542 of 1 bytes by task 22618 on cpu 0: + packet_setsockopt+0xd83/0xfd0 net/packet/af_packet.c:4003 + do_sock_setsockopt net/socket.c:2311 [inline] + __sys_setsockopt+0x1d8/0x250 net/socket.c:2334 + __do_sys_setsockopt net/socket.c:2343 [inline] + __se_sys_setsockopt net/socket.c:2340 [inline] + __x64_sys_setsockopt+0x66/0x80 net/socket.c:2340 + do_syscall_64+0xd3/0x1d0 + entry_SYSCALL_64_after_hwframe+0x6d/0x75 + +read to 0xffff888107804542 of 1 bytes by task 27 on cpu 1: + dev_queue_xmit_nit+0x82/0x620 net/core/dev.c:2248 + xmit_one net/core/dev.c:3527 [inline] + dev_hard_start_xmit+0xcc/0x3f0 net/core/dev.c:3547 + __dev_queue_xmit+0xf24/0x1dd0 net/core/dev.c:4335 + dev_queue_xmit include/linux/netdevice.h:3091 [inline] + batadv_send_skb_packet+0x264/0x300 net/batman-adv/send.c:108 + batadv_send_broadcast_skb+0x24/0x30 net/batman-adv/send.c:127 + batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:392 [inline] + batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline] + batadv_iv_send_outstanding_bat_ogm_packet+0x3f0/0x4b0 net/batman-adv/bat_iv_ogm.c:1700 + process_one_work kernel/workqueue.c:3254 [inline] + process_scheduled_works+0x465/0x990 kernel/workqueue.c:3335 + worker_thread+0x526/0x730 kernel/workqueue.c:3416 + kthread+0x1d1/0x210 kernel/kthread.c:388 + ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147 + ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 + +value changed: 0x00 -> 0x01 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 PID: 27 Comm: kworker/u8:1 Tainted: G W 6.8.0-syzkaller-08073-g480e035fc4c7 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 +Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet + +Fixes: fa788d986a3a ("packet: add sockopt to ignore outgoing packets") +Reported-by: syzbot+c669c1136495a2e7c31f@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/CANn89i+Z7MfbkBLOv=p7KZ7=K1rKHO4P1OL5LYDCtBiyqsa9oQ@mail.gmail.com/T/#t +Signed-off-by: Eric Dumazet +Cc: Willem de Bruijn +Reviewed-by: Willem de Bruijn +Reviewed-by: Jason Xing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/dev.c | 2 +- + net/packet/af_packet.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/core/dev.c b/net/core/dev.c +index af77dc77eb9c8..1e41971c06177 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -2291,7 +2291,7 @@ void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev) + rcu_read_lock(); + again: + list_for_each_entry_rcu(ptype, ptype_list, list) { +- if (ptype->ignore_outgoing) ++ if (READ_ONCE(ptype->ignore_outgoing)) + continue; + + /* Never send packets back to the socket +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 75fb80717e489..cffa217fb3063 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -3951,7 +3951,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval, + if (val < 0 || val > 1) + return -EINVAL; + +- po->prot_hook.ignore_outgoing = !!val; ++ WRITE_ONCE(po->prot_hook.ignore_outgoing, !!val); + return 0; + } + case PACKET_TX_HAS_OFF: +@@ -4080,7 +4080,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, + 0); + break; + case PACKET_IGNORE_OUTGOING: +- val = po->prot_hook.ignore_outgoing; ++ val = READ_ONCE(po->prot_hook.ignore_outgoing); + break; + case PACKET_ROLLOVER_STATS: + if (!po->rollover) +-- +2.43.0 + diff --git a/queue-5.15/rcu-add-a-helper-to-report-consolidated-flavor-qs.patch b/queue-5.15/rcu-add-a-helper-to-report-consolidated-flavor-qs.patch new file mode 100644 index 00000000000..b5b128dd14f --- /dev/null +++ b/queue-5.15/rcu-add-a-helper-to-report-consolidated-flavor-qs.patch @@ -0,0 +1,76 @@ +From a10d8eddedd137cdc716ea7a63d4442efb68025b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Mar 2024 13:44:34 -0700 +Subject: rcu: add a helper to report consolidated flavor QS + +From: Yan Zhai + +[ Upstream commit 1a77557d48cff187a169c2aec01c0dd78a5e7e50 ] + +When under heavy load, network processing can run CPU-bound for many +tens of seconds. Even in preemptible kernels (non-RT kernel), this can +block RCU Tasks grace periods, which can cause trace-event removal to +take more than a minute, which is unacceptably long. + +This commit therefore creates a new helper function that passes through +both RCU and RCU-Tasks quiescent states every 100 milliseconds. This +hard-coded value suffices for current workloads. + +Suggested-by: Paul E. McKenney +Reviewed-by: Jesper Dangaard Brouer +Signed-off-by: Yan Zhai +Reviewed-by: Paul E. McKenney +Acked-by: Jesper Dangaard Brouer +Link: https://lore.kernel.org/r/90431d46ee112d2b0af04dbfe936faaca11810a5.1710877680.git.yan@cloudflare.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: d6dbbb11247c ("net: report RCU QS on threaded NAPI repolling") +Signed-off-by: Sasha Levin +--- + include/linux/rcupdate.h | 31 +++++++++++++++++++++++++++++++ + 1 file changed, 31 insertions(+) + +diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h +index e3b12de36e924..d908af5917339 100644 +--- a/include/linux/rcupdate.h ++++ b/include/linux/rcupdate.h +@@ -230,6 +230,37 @@ do { \ + cond_resched(); \ + } while (0) + ++/** ++ * rcu_softirq_qs_periodic - Report RCU and RCU-Tasks quiescent states ++ * @old_ts: jiffies at start of processing. ++ * ++ * This helper is for long-running softirq handlers, such as NAPI threads in ++ * networking. The caller should initialize the variable passed in as @old_ts ++ * at the beginning of the softirq handler. When invoked frequently, this macro ++ * will invoke rcu_softirq_qs() every 100 milliseconds thereafter, which will ++ * provide both RCU and RCU-Tasks quiescent states. Note that this macro ++ * modifies its old_ts argument. ++ * ++ * Because regions of code that have disabled softirq act as RCU read-side ++ * critical sections, this macro should be invoked with softirq (and ++ * preemption) enabled. ++ * ++ * The macro is not needed when CONFIG_PREEMPT_RT is defined. RT kernels would ++ * have more chance to invoke schedule() calls and provide necessary quiescent ++ * states. As a contrast, calling cond_resched() only won't achieve the same ++ * effect because cond_resched() does not provide RCU-Tasks quiescent states. ++ */ ++#define rcu_softirq_qs_periodic(old_ts) \ ++do { \ ++ if (!IS_ENABLED(CONFIG_PREEMPT_RT) && \ ++ time_after(jiffies, (old_ts) + HZ / 10)) { \ ++ preempt_disable(); \ ++ rcu_softirq_qs(); \ ++ preempt_enable(); \ ++ (old_ts) = jiffies; \ ++ } \ ++} while (0) ++ + /* + * Infrastructure to implement the synchronize_() primitives in + * TREE_RCU and rcu_barrier_() primitives in TINY_RCU. +-- +2.43.0 + diff --git a/queue-5.15/rds-introduce-acquire-release-ordering-in-acquire-re.patch b/queue-5.15/rds-introduce-acquire-release-ordering-in-acquire-re.patch new file mode 100644 index 00000000000..b3172748a7b --- /dev/null +++ b/queue-5.15/rds-introduce-acquire-release-ordering-in-acquire-re.patch @@ -0,0 +1,51 @@ +From e01f3fa2911f7dce4b1654cbc84738061fea4f03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 18:28:38 +0900 +Subject: rds: introduce acquire/release ordering in acquire/release_in_xmit() + +From: Yewon Choi + +[ Upstream commit 1422f28826d2a0c11e5240b3e951c9e214d8656e ] + +acquire/release_in_xmit() work as bit lock in rds_send_xmit(), so they +are expected to ensure acquire/release memory ordering semantics. +However, test_and_set_bit/clear_bit() don't imply such semantics, on +top of this, following smp_mb__after_atomic() does not guarantee release +ordering (memory barrier actually should be placed before clear_bit()). + +Instead, we use clear_bit_unlock/test_and_set_bit_lock() here. + +Fixes: 0f4b1c7e89e6 ("rds: fix rds_send_xmit() serialization") +Fixes: 1f9ecd7eacfd ("RDS: Pass rds_conn_path to rds_send_xmit()") +Signed-off-by: Yewon Choi +Reviewed-by: Michal Kubiak +Link: https://lore.kernel.org/r/ZfQUxnNTO9AJmzwc@libra05 +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/rds/send.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/net/rds/send.c b/net/rds/send.c +index d6462d1471c14..85c27d9aa33a3 100644 +--- a/net/rds/send.c ++++ b/net/rds/send.c +@@ -103,13 +103,12 @@ EXPORT_SYMBOL_GPL(rds_send_path_reset); + + static int acquire_in_xmit(struct rds_conn_path *cp) + { +- return test_and_set_bit(RDS_IN_XMIT, &cp->cp_flags) == 0; ++ return test_and_set_bit_lock(RDS_IN_XMIT, &cp->cp_flags) == 0; + } + + static void release_in_xmit(struct rds_conn_path *cp) + { +- clear_bit(RDS_IN_XMIT, &cp->cp_flags); +- smp_mb__after_atomic(); ++ clear_bit_unlock(RDS_IN_XMIT, &cp->cp_flags); + /* + * We don't use wait_on_bit()/wake_up_bit() because our waking is in a + * hot path and finding waiters is very rare. We don't want to walk +-- +2.43.0 + diff --git a/queue-5.15/regmap-add-missing-map-bus-check.patch b/queue-5.15/regmap-add-missing-map-bus-check.patch new file mode 100644 index 00000000000..814abeea428 --- /dev/null +++ b/queue-5.15/regmap-add-missing-map-bus-check.patch @@ -0,0 +1,41 @@ +From 2ff59fe40f56d09f27b0104d587c164fe711ad23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 May 2022 02:30:35 +0200 +Subject: regmap: Add missing map->bus check + +From: Marek Vasut + +[ Upstream commit 5c422f0b970d287efa864b8390a02face404db5d ] + +The map->bus can be NULL here, add the missing NULL pointer check. + +Fixes: d77e745613680 ("regmap: Add bulk read/write callbacks into regmap_config") +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Marek Vasut +Cc: Dan Carpenter +Cc: Mark Brown +To: linux-kernel@vger.kernel.org +Link: https://lore.kernel.org/r/20220509003035.225272-1-marex@denx.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index 6adb345866610..893b0615935e9 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -1836,7 +1836,7 @@ static int _regmap_raw_write_impl(struct regmap *map, unsigned int reg, + map->format.reg_bytes + + map->format.pad_bytes + + val_len); +- else if (map->bus->gather_write) ++ else if (map->bus && map->bus->gather_write) + ret = map->bus->gather_write(map->bus_context, map->work_buf, + map->format.reg_bytes + + map->format.pad_bytes, +-- +2.43.0 + diff --git a/queue-5.15/remoteproc-stm32-fix-incorrect-type-assignment-retur.patch b/queue-5.15/remoteproc-stm32-fix-incorrect-type-assignment-retur.patch new file mode 100644 index 00000000000..5fa5c6e721c --- /dev/null +++ b/queue-5.15/remoteproc-stm32-fix-incorrect-type-assignment-retur.patch @@ -0,0 +1,44 @@ +From 9ccf459312114bac21942c337a06a8ffcaf2a66b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jan 2024 14:53:12 +0100 +Subject: remoteproc: stm32: Fix incorrect type assignment returned by + stm32_rproc_get_loaded_rsc_tablef + +From: Arnaud Pouliquen + +[ Upstream commit c77b35ce66af25bdd6fde60b62e35b9b316ea5c2 ] + +The sparse tool complains about the remove of the _iomem attribute. + +stm32_rproc.c:660:17: warning: cast removes address space '__iomem' of expression + +Add '__force' to explicitly specify that the cast is intentional. +This conversion is necessary to cast to addresses pointer, +which are then managed by the remoteproc core as a pointer to a +resource_table structure. + +Fixes: 8a471396d21c ("remoteproc: stm32: Move resource table setup to rproc_ops") +Signed-off-by: Arnaud Pouliquen +Link: https://lore.kernel.org/r/20240117135312.3381936-3-arnaud.pouliquen@foss.st.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/stm32_rproc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/remoteproc/stm32_rproc.c b/drivers/remoteproc/stm32_rproc.c +index e48dce98936ad..4db63e07e1cff 100644 +--- a/drivers/remoteproc/stm32_rproc.c ++++ b/drivers/remoteproc/stm32_rproc.c +@@ -641,7 +641,7 @@ stm32_rproc_get_loaded_rsc_table(struct rproc *rproc, size_t *table_sz) + * entire area by overwriting it with the initial values stored in rproc->clean_table. + */ + *table_sz = RSC_TBL_SIZE; +- return (struct resource_table *)ddata->rsc_va; ++ return (__force struct resource_table *)ddata->rsc_va; + } + + static const struct rproc_ops st_rproc_ops = { +-- +2.43.0 + diff --git a/queue-5.15/remoteproc-stm32-fix-incorrect-type-in-assignment-fo.patch b/queue-5.15/remoteproc-stm32-fix-incorrect-type-in-assignment-fo.patch new file mode 100644 index 00000000000..f15a0c66fca --- /dev/null +++ b/queue-5.15/remoteproc-stm32-fix-incorrect-type-in-assignment-fo.patch @@ -0,0 +1,56 @@ +From fd1bbf946367013743274aac6729e68ef0dadafe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jan 2024 14:53:11 +0100 +Subject: remoteproc: stm32: Fix incorrect type in assignment for va + +From: Arnaud Pouliquen + +[ Upstream commit 32381bbccba4c21145c571701f8f7fb1d9b3a92e ] + +The sparse tool complains about the attribute conversion between +a _iomem void * and a void *: + +stm32_rproc.c:122:12: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *va @@ got void [noderef] __iomem * @@ +stm32_rproc.c:122:12: sparse: expected void *va +stm32_rproc.c:122:12: sparse: got void [noderef] __iomem * + +Add '__force' to explicitly specify that the cast is intentional. +This conversion is necessary to cast to virtual addresses pointer,used, +by the remoteproc core. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202312150052.HCiNKlqB-lkp@intel.com/ +Fixes: 13140de09cc2 ("remoteproc: stm32: add an ST stm32_rproc driver") +Signed-off-by: Arnaud Pouliquen +Link: https://lore.kernel.org/r/20240117135312.3381936-2-arnaud.pouliquen@foss.st.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/stm32_rproc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/remoteproc/stm32_rproc.c b/drivers/remoteproc/stm32_rproc.c +index 43715594bd801..e48dce98936ad 100644 +--- a/drivers/remoteproc/stm32_rproc.c ++++ b/drivers/remoteproc/stm32_rproc.c +@@ -119,7 +119,7 @@ static int stm32_rproc_mem_alloc(struct rproc *rproc, + void *va; + + dev_dbg(dev, "map memory: %pad+%zx\n", &mem->dma, mem->len); +- va = ioremap_wc(mem->dma, mem->len); ++ va = (__force void *)ioremap_wc(mem->dma, mem->len); + if (IS_ERR_OR_NULL(va)) { + dev_err(dev, "Unable to map memory region: %pad+0x%zx\n", + &mem->dma, mem->len); +@@ -136,7 +136,7 @@ static int stm32_rproc_mem_release(struct rproc *rproc, + struct rproc_mem_entry *mem) + { + dev_dbg(rproc->dev.parent, "unmap memory: %pa\n", &mem->dma); +- iounmap(mem->va); ++ iounmap((__force __iomem void *)mem->va); + + return 0; + } +-- +2.43.0 + diff --git a/queue-5.15/remoteproc-stm32-use-correct-format-strings-on-64-bi.patch b/queue-5.15/remoteproc-stm32-use-correct-format-strings-on-64-bi.patch new file mode 100644 index 00000000000..0d863ef48be --- /dev/null +++ b/queue-5.15/remoteproc-stm32-use-correct-format-strings-on-64-bi.patch @@ -0,0 +1,93 @@ +From cbc8e323a51c73541be37f9b4e068042f9eed11e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 12:45:42 +0200 +Subject: remoteproc: stm32: use correct format strings on 64-bit + +From: Arnd Bergmann + +[ Upstream commit 03bd158e1535e68bcd2b1e095b0ebcad7c84bd20 ] + +With CONFIG_ARCH_STM32 making it into arch/arm64, a couple of format +strings no longer work, since they rely on size_t being compatible +with %x, or they print an 'int' using %z: + +drivers/remoteproc/stm32_rproc.c: In function 'stm32_rproc_mem_alloc': +drivers/remoteproc/stm32_rproc.c:122:22: error: format '%x' expects argument of type 'unsigned int', but argument 5 has type 'size_t' {aka 'long unsigned int'} [-Werror=format=] +drivers/remoteproc/stm32_rproc.c:122:40: note: format string is defined here + 122 | dev_dbg(dev, "map memory: %pa+%x\n", &mem->dma, mem->len); + | ~^ + | | + | unsigned int + | %lx +drivers/remoteproc/stm32_rproc.c:125:30: error: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'size_t' {aka 'long unsigned int'} [-Werror=format=] +drivers/remoteproc/stm32_rproc.c:125:65: note: format string is defined here + 125 | dev_err(dev, "Unable to map memory region: %pa+%x\n", + | ~^ + | | + | unsigned int + | %lx +drivers/remoteproc/stm32_rproc.c: In function 'stm32_rproc_get_loaded_rsc_table': +drivers/remoteproc/stm32_rproc.c:646:30: error: format '%zx' expects argument of type 'size_t', but argument 4 has type 'int' [-Werror=format=] +drivers/remoteproc/stm32_rproc.c:646:66: note: format string is defined here + 646 | dev_err(dev, "Unable to map memory region: %pa+%zx\n", + | ~~^ + | | + | long unsigned int + | %x + +Fix up all three instances to work across architectures, and enable +compile testing for this driver to ensure it builds everywhere. + +Reviewed-by: Arnaud Pouliquen +Acked-by: Randy Dunlap +Tested-by: Randy Dunlap +Signed-off-by: Arnd Bergmann +Stable-dep-of: 32381bbccba4 ("remoteproc: stm32: Fix incorrect type in assignment for va") +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/Kconfig | 2 +- + drivers/remoteproc/stm32_rproc.c | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig +index 9a6eedc3994a5..d89460429257e 100644 +--- a/drivers/remoteproc/Kconfig ++++ b/drivers/remoteproc/Kconfig +@@ -276,7 +276,7 @@ config ST_SLIM_REMOTEPROC + + config STM32_RPROC + tristate "STM32 remoteproc support" +- depends on ARCH_STM32 ++ depends on ARCH_STM32 || COMPILE_TEST + depends on REMOTEPROC + select MAILBOX + help +diff --git a/drivers/remoteproc/stm32_rproc.c b/drivers/remoteproc/stm32_rproc.c +index aba3df1d1bf52..43715594bd801 100644 +--- a/drivers/remoteproc/stm32_rproc.c ++++ b/drivers/remoteproc/stm32_rproc.c +@@ -118,10 +118,10 @@ static int stm32_rproc_mem_alloc(struct rproc *rproc, + struct device *dev = rproc->dev.parent; + void *va; + +- dev_dbg(dev, "map memory: %pa+%x\n", &mem->dma, mem->len); ++ dev_dbg(dev, "map memory: %pad+%zx\n", &mem->dma, mem->len); + va = ioremap_wc(mem->dma, mem->len); + if (IS_ERR_OR_NULL(va)) { +- dev_err(dev, "Unable to map memory region: %pa+%x\n", ++ dev_err(dev, "Unable to map memory region: %pad+0x%zx\n", + &mem->dma, mem->len); + return -ENOMEM; + } +@@ -627,7 +627,7 @@ stm32_rproc_get_loaded_rsc_table(struct rproc *rproc, size_t *table_sz) + + ddata->rsc_va = devm_ioremap_wc(dev, rsc_pa, RSC_TBL_SIZE); + if (IS_ERR_OR_NULL(ddata->rsc_va)) { +- dev_err(dev, "Unable to map memory region: %pa+%zx\n", ++ dev_err(dev, "Unable to map memory region: %pa+%x\n", + &rsc_pa, RSC_TBL_SIZE); + ddata->rsc_va = NULL; + return ERR_PTR(-ENOMEM); +-- +2.43.0 + diff --git a/queue-5.15/rtc-mt6397-select-irq_domain-instead-of-depending-on.patch b/queue-5.15/rtc-mt6397-select-irq_domain-instead-of-depending-on.patch new file mode 100644 index 00000000000..89690441b8e --- /dev/null +++ b/queue-5.15/rtc-mt6397-select-irq_domain-instead-of-depending-on.patch @@ -0,0 +1,59 @@ +From dfea7656e932332631e58c9c52240cc8e1b0869c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 21:02:58 -0800 +Subject: rtc: mt6397: select IRQ_DOMAIN instead of depending on it + +From: Randy Dunlap + +[ Upstream commit 544c42f798e1651dcb04fb0395219bf0f1c2607e ] + +IRQ_DOMAIN is a hidden (not user visible) symbol. Users cannot set +it directly thru "make *config", so drivers should select it instead +of depending on it if they need it. +Relying on it being set for a dependency is risky. + +Consistently using "select" or "depends on" can also help reduce +Kconfig circular dependency issues. + +Therefore, change the use of "depends on" for IRQ_DOMAIN to +"select" for RTC_DRV_MT6397. + +Fixes: 04d3ba70a3c9 ("rtc: mt6397: add IRQ domain dependency") +Cc: Arnd Bergmann +Cc: Eddie Huang +Cc: Sean Wang +Cc: Matthias Brugger +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-mediatek@lists.infradead.org +Cc: Alessandro Zummo +Cc: Alexandre Belloni +Cc: linux-rtc@vger.kernel.org +Cc: Marc Zyngier +Cc: Philipp Zabel +Cc: Peter Rosin +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Randy Dunlap +Link: https://lore.kernel.org/r/20240213050258.6167-1-rdunlap@infradead.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig +index e1bc5214494e2..ee59c82f9df18 100644 +--- a/drivers/rtc/Kconfig ++++ b/drivers/rtc/Kconfig +@@ -1814,7 +1814,8 @@ config RTC_DRV_MT2712 + + config RTC_DRV_MT6397 + tristate "MediaTek PMIC based RTC" +- depends on MFD_MT6397 || (COMPILE_TEST && IRQ_DOMAIN) ++ depends on MFD_MT6397 || COMPILE_TEST ++ select IRQ_DOMAIN + help + This selects the MediaTek(R) RTC driver. RTC is part of MediaTek + MT6397 PMIC. You should enable MT6397 PMIC MFD before select +-- +2.43.0 + diff --git a/queue-5.15/s390-vtime-fix-average-steal-time-calculation.patch b/queue-5.15/s390-vtime-fix-average-steal-time-calculation.patch new file mode 100644 index 00000000000..b8549c67e37 --- /dev/null +++ b/queue-5.15/s390-vtime-fix-average-steal-time-calculation.patch @@ -0,0 +1,64 @@ +From cf37610f9a794c534596deb9b7f2fdee069c950d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 12:31:52 +0100 +Subject: s390/vtime: fix average steal time calculation + +From: Mete Durlu + +[ Upstream commit 367c50f78451d3bd7ad70bc5c89f9ba6dec46ca9 ] + +Current average steal timer calculation produces volatile and inflated +values. The only user of this value is KVM so far and it uses that to +decide whether or not to yield the vCPU which is seeing steal time. +KVM compares average steal timer to a threshold and if the threshold +is past then it does not allow CPU polling and yields it to host, else +it keeps the CPU by polling. +Since KVM's steal time threshold is very low by default (%10) it most +likely is not effected much by the bloated average steal timer values +because the operating region is pretty small. However there might be +new users in the future who might rely on this number. Fix average +steal timer calculation by changing the formula from: + + avg_steal_timer = avg_steal_timer / 2 + steal_timer; + +to the following: + + avg_steal_timer = (avg_steal_timer + steal_timer) / 2; + +This ensures that avg_steal_timer is actually a naive average of steal +timer values. It now closely follows steal timer values but of course +in a smoother manner. + +Fixes: 152e9b8676c6 ("s390/vtime: steal time exponential moving average") +Signed-off-by: Mete Durlu +Acked-by: Heiko Carstens +Acked-by: Christian Borntraeger +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/vtime.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c +index f216a1b2f8257..86137029235ac 100644 +--- a/arch/s390/kernel/vtime.c ++++ b/arch/s390/kernel/vtime.c +@@ -211,13 +211,13 @@ void vtime_flush(struct task_struct *tsk) + virt_timer_expire(); + + steal = S390_lowcore.steal_timer; +- avg_steal = S390_lowcore.avg_steal_timer / 2; ++ avg_steal = S390_lowcore.avg_steal_timer; + if ((s64) steal > 0) { + S390_lowcore.steal_timer = 0; + account_steal_time(cputime_to_nsecs(steal)); + avg_steal += steal; + } +- S390_lowcore.avg_steal_timer = avg_steal; ++ S390_lowcore.avg_steal_timer = avg_steal / 2; + } + + static u64 vtime_delta(void) +-- +2.43.0 + diff --git a/queue-5.15/serial-8250_exar-don-t-remove-gpio-device-on-suspend.patch b/queue-5.15/serial-8250_exar-don-t-remove-gpio-device-on-suspend.patch new file mode 100644 index 00000000000..6e50195d500 --- /dev/null +++ b/queue-5.15/serial-8250_exar-don-t-remove-gpio-device-on-suspend.patch @@ -0,0 +1,49 @@ +From cb6e262feab0e05d7df20f9342be87890e664908 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 17:04:57 +0200 +Subject: serial: 8250_exar: Don't remove GPIO device on suspend + +From: Andy Shevchenko + +[ Upstream commit 73b5a5c00be39e23b194bad10e1ea8bb73eee176 ] + +It seems a copy&paste mistake that suspend callback removes the GPIO +device. There is no counterpart of this action, means once suspended +there is no more GPIO device available untile full unbind-bind cycle +is performed. Remove suspicious GPIO device removal in suspend. + +Fixes: d0aeaa83f0b0 ("serial: exar: split out the exar code from 8250_pci") +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20240219150627.2101198-2-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_exar.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c +index ada9666f59889..48769e059772a 100644 +--- a/drivers/tty/serial/8250/8250_exar.c ++++ b/drivers/tty/serial/8250/8250_exar.c +@@ -715,6 +715,7 @@ static void exar_pci_remove(struct pci_dev *pcidev) + for (i = 0; i < priv->nr; i++) + serial8250_unregister_port(priv->line[i]); + ++ /* Ensure that every init quirk is properly torn down */ + if (priv->board->exit) + priv->board->exit(pcidev); + } +@@ -729,10 +730,6 @@ static int __maybe_unused exar_suspend(struct device *dev) + if (priv->line[i] >= 0) + serial8250_suspend_port(priv->line[i]); + +- /* Ensure that every init quirk is properly torn down */ +- if (priv->board->exit) +- priv->board->exit(pcidev); +- + return 0; + } + +-- +2.43.0 + diff --git a/queue-5.15/serial-max310x-fix-syntax-error-in-irq-error-message.patch b/queue-5.15/serial-max310x-fix-syntax-error-in-irq-error-message.patch new file mode 100644 index 00000000000..4b625d01db7 --- /dev/null +++ b/queue-5.15/serial-max310x-fix-syntax-error-in-irq-error-message.patch @@ -0,0 +1,40 @@ +From a09ffc3dc15a5ef9421c7835046f05a1a6bfe2e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 10:22:01 -0500 +Subject: serial: max310x: fix syntax error in IRQ error message + +From: Hugo Villeneuve + +[ Upstream commit 8ede8c6f474255b2213cccd7997b993272a8e2f9 ] + +Replace g with q. + +Helpful when grepping thru source code or logs for +"request" keyword. + +Fixes: f65444187a66 ("serial: New serial driver MAX310X") +Reviewed-by: Andy Shevchenko +Signed-off-by: Hugo Villeneuve +Link: https://lore.kernel.org/r/20240118152213.2644269-6-hugo@hugovil.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/max310x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c +index c122e7e90fc89..714c23f9504fc 100644 +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -1433,7 +1433,7 @@ static int max310x_probe(struct device *dev, const struct max310x_devtype *devty + if (!ret) + return 0; + +- dev_err(dev, "Unable to reguest IRQ %i\n", irq); ++ dev_err(dev, "Unable to request IRQ %i\n", irq); + + out_uart: + for (i = 0; i < devtype->nr; i++) { +-- +2.43.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 5b5820ec608..aeb4abb93b6 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -272,3 +272,50 @@ nfs-fix-an-off-by-one-in-root_nfs_cat.patch f2fs-compress-fix-reserve_cblocks-counting-error-whe.patch afs-revert-afs-hide-silly-rename-files-from-userspac.patch comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch +remoteproc-stm32-use-correct-format-strings-on-64-bi.patch +remoteproc-stm32-fix-incorrect-type-in-assignment-fo.patch +remoteproc-stm32-fix-incorrect-type-assignment-retur.patch +tty-vt-fix-20-vs-0x20-typo-in-escsiignore.patch +serial-max310x-fix-syntax-error-in-irq-error-message.patch +tty-serial-samsung-fix-tx_empty-to-return-tiocser_te.patch +arm64-dts-broadcom-bcmbca-bcm4908-drop-invalid-switc.patch +coresight-etm4x-set-skip_power_up-in-etm4_init_arch_.patch +kconfig-fix-infinite-loop-when-expanding-a-macro-at-.patch +rtc-mt6397-select-irq_domain-instead-of-depending-on.patch +serial-8250_exar-don-t-remove-gpio-device-on-suspend.patch +staging-greybus-fix-get_channel_from_mode-failure-pa.patch +usb-gadget-net2272-use-irqflags-in-the-call-to-net22.patch +io_uring-don-t-save-restore-iowait-state.patch +nouveau-reset-the-bo-resource-bus-info-after-an-evic.patch +octeontx2-af-use-matching-wake_up-api-variant-in-cgx.patch +s390-vtime-fix-average-steal-time-calculation.patch +soc-fsl-dpio-fix-kcalloc-argument-order.patch +hsr-fix-uninit-value-access-in-hsr_get_node.patch +nvme-add-common-helpers-to-allocate-and-free-tagsets.patch +nvme-only-set-reserved_tags-in-nvme_alloc_io_tag_set.patch +nvme-add-the-apple-shared-tag-workaround-to-nvme_all.patch +nvme-fix-reconnection-fail-due-to-reserved-tag-alloc.patch +net-mtk_eth_soc-move-mac_mcr-setting-to-mac_finish.patch +net-mediatek-mtk_eth_soc-clear-mac_mcr_force_link-on.patch +net-ethernet-mtk_eth_soc-fix-ppe-hanging-issue.patch +packet-annotate-data-races-around-ignore_outgoing.patch +net-veth-do-not-manipulate-gro-when-using-xdp.patch +net-dsa-mt7530-prevent-possible-incorrect-xtal-frequ.patch +vdpa-mlx5-allow-cvq-size-changes.patch +wireguard-receive-annotate-data-race-around-receivin.patch +rds-introduce-acquire-release-ordering-in-acquire-re.patch +hsr-handle-failures-in-module-init.patch +net-phy-fix-phy_read_poll_timeout-argument-type-in-g.patch +net-bnx2x-prevent-access-to-a-freed-page-in-page_poo.patch +octeontx2-af-use-separate-handlers-for-interrupts.patch +netfilter-nft_set_pipapo-release-elements-in-clone-o.patch +netfilter-nf_tables-do-not-compare-internal-table-fl.patch +rcu-add-a-helper-to-report-consolidated-flavor-qs.patch +net-report-rcu-qs-on-threaded-napi-repolling.patch +bpf-report-rcu-qs-in-cpumap-kthread.patch +net-dsa-mt7530-fix-handling-of-lldp-frames.patch +net-dsa-mt7530-fix-handling-of-802.1x-pae-frames.patch +net-dsa-mt7530-fix-link-local-frames-that-ingress-vl.patch +net-dsa-mt7530-fix-handling-of-all-link-local-frames.patch +spi-spi-mt65xx-fix-null-pointer-access-in-interrupt-.patch +regmap-add-missing-map-bus-check.patch diff --git a/queue-5.15/soc-fsl-dpio-fix-kcalloc-argument-order.patch b/queue-5.15/soc-fsl-dpio-fix-kcalloc-argument-order.patch new file mode 100644 index 00000000000..9843b3e2e3a --- /dev/null +++ b/queue-5.15/soc-fsl-dpio-fix-kcalloc-argument-order.patch @@ -0,0 +1,47 @@ +From 222edcb3c2c466edee5c1777b4e02d5bdefcb8fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Feb 2024 20:34:36 +0100 +Subject: soc: fsl: dpio: fix kcalloc() argument order + +From: Arnd Bergmann + +[ Upstream commit 72ebb41b88f9d7c10c5e159e0507074af0a22fe2 ] + +A previous bugfix added a call to kcalloc(), which starting in gcc-14 +causes a harmless warning about the argument order: + +drivers/soc/fsl/dpio/dpio-service.c: In function 'dpaa2_io_service_enqueue_multiple_desc_fq': +drivers/soc/fsl/dpio/dpio-service.c:526:29: error: 'kcalloc' sizes specified with 'sizeof' in the earlier argument and not in the later argument [-Werror=calloc-transposed-args] + 526 | ed = kcalloc(sizeof(struct qbman_eq_desc), 32, GFP_KERNEL); + | ^~~~~~ +drivers/soc/fsl/dpio/dpio-service.c:526:29: note: earlier argument should specify number of elements, later size of each element + +Since the two are only multiplied, the order does not change the +behavior, so just fix it now to shut up the compiler warning. + +Dmity independently came up with the same fix. + +Fixes: 5c4a5999b245 ("soc: fsl: dpio: avoid stack usage warning") +Reported-by: Dmitry Antipov +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/soc/fsl/dpio/dpio-service.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/fsl/dpio/dpio-service.c b/drivers/soc/fsl/dpio/dpio-service.c +index 779c319a4b820..6cdd2c517ba68 100644 +--- a/drivers/soc/fsl/dpio/dpio-service.c ++++ b/drivers/soc/fsl/dpio/dpio-service.c +@@ -485,7 +485,7 @@ int dpaa2_io_service_enqueue_multiple_desc_fq(struct dpaa2_io *d, + struct qbman_eq_desc *ed; + int i, ret; + +- ed = kcalloc(sizeof(struct qbman_eq_desc), 32, GFP_KERNEL); ++ ed = kcalloc(32, sizeof(struct qbman_eq_desc), GFP_KERNEL); + if (!ed) + return -ENOMEM; + +-- +2.43.0 + diff --git a/queue-5.15/spi-spi-mt65xx-fix-null-pointer-access-in-interrupt-.patch b/queue-5.15/spi-spi-mt65xx-fix-null-pointer-access-in-interrupt-.patch new file mode 100644 index 00000000000..d782ce1ba61 --- /dev/null +++ b/queue-5.15/spi-spi-mt65xx-fix-null-pointer-access-in-interrupt-.patch @@ -0,0 +1,61 @@ +From aee69ce23208bc407ac60fa51878c21e13940d76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Mar 2024 15:08:57 +0800 +Subject: spi: spi-mt65xx: Fix NULL pointer access in interrupt handler + +From: Fei Shao + +[ Upstream commit a20ad45008a7c82f1184dc6dee280096009ece55 ] + +The TX buffer in spi_transfer can be a NULL pointer, so the interrupt +handler may end up writing to the invalid memory and cause crashes. + +Add a check to trans->tx_buf before using it. + +Fixes: 1ce24864bff4 ("spi: mediatek: Only do dma for 4-byte aligned buffers") +Signed-off-by: Fei Shao +Reviewed-by: AngeloGioacchino Del Regno +Link: https://msgid.link/r/20240321070942.1587146-2-fshao@chromium.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mt65xx.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c +index 49acba1dea1e7..30aac6f093b21 100644 +--- a/drivers/spi/spi-mt65xx.c ++++ b/drivers/spi/spi-mt65xx.c +@@ -659,17 +659,19 @@ static irqreturn_t mtk_spi_interrupt(int irq, void *dev_id) + mdata->xfer_len = min(MTK_SPI_MAX_FIFO_SIZE, len); + mtk_spi_setup_packet(master); + +- cnt = mdata->xfer_len / 4; +- iowrite32_rep(mdata->base + SPI_TX_DATA_REG, +- trans->tx_buf + mdata->num_xfered, cnt); ++ if (trans->tx_buf) { ++ cnt = mdata->xfer_len / 4; ++ iowrite32_rep(mdata->base + SPI_TX_DATA_REG, ++ trans->tx_buf + mdata->num_xfered, cnt); + +- remainder = mdata->xfer_len % 4; +- if (remainder > 0) { +- reg_val = 0; +- memcpy(®_val, +- trans->tx_buf + (cnt * 4) + mdata->num_xfered, +- remainder); +- writel(reg_val, mdata->base + SPI_TX_DATA_REG); ++ remainder = mdata->xfer_len % 4; ++ if (remainder > 0) { ++ reg_val = 0; ++ memcpy(®_val, ++ trans->tx_buf + (cnt * 4) + mdata->num_xfered, ++ remainder); ++ writel(reg_val, mdata->base + SPI_TX_DATA_REG); ++ } + } + + mtk_spi_enable_transfer(master); +-- +2.43.0 + diff --git a/queue-5.15/staging-greybus-fix-get_channel_from_mode-failure-pa.patch b/queue-5.15/staging-greybus-fix-get_channel_from_mode-failure-pa.patch new file mode 100644 index 00000000000..bc3260a3a8f --- /dev/null +++ b/queue-5.15/staging-greybus-fix-get_channel_from_mode-failure-pa.patch @@ -0,0 +1,54 @@ +From 52b7a295a5255a5e63f00955aadc7732e00a1e09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 10:04:48 +0300 +Subject: staging: greybus: fix get_channel_from_mode() failure path + +From: Dan Carpenter + +[ Upstream commit 34164202a5827f60a203ca9acaf2d9f7d432aac8 ] + +The get_channel_from_mode() function is supposed to return the channel +which matches the mode. But it has a bug where if it doesn't find a +matching channel then it returns the last channel. It should return +NULL instead. + +Also remove an unnecessary NULL check on "channel". + +Fixes: 2870b52bae4c ("greybus: lights: add lights implementation") +Signed-off-by: Dan Carpenter +Reviewed-by: Rui Miguel Silva +Reviewed-by: Alex Elder +Link: https://lore.kernel.org/r/379c0cb4-39e0-4293-8a18-c7b1298e5420@moroto.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/greybus/light.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c +index 87d36948c6106..c6bd86a5335ab 100644 +--- a/drivers/staging/greybus/light.c ++++ b/drivers/staging/greybus/light.c +@@ -100,15 +100,15 @@ static struct led_classdev *get_channel_cdev(struct gb_channel *channel) + static struct gb_channel *get_channel_from_mode(struct gb_light *light, + u32 mode) + { +- struct gb_channel *channel = NULL; ++ struct gb_channel *channel; + int i; + + for (i = 0; i < light->channels_count; i++) { + channel = &light->channels[i]; +- if (channel && channel->mode == mode) +- break; ++ if (channel->mode == mode) ++ return channel; + } +- return channel; ++ return NULL; + } + + static int __gb_lights_flash_intensity_set(struct gb_channel *channel, +-- +2.43.0 + diff --git a/queue-5.15/tty-serial-samsung-fix-tx_empty-to-return-tiocser_te.patch b/queue-5.15/tty-serial-samsung-fix-tx_empty-to-return-tiocser_te.patch new file mode 100644 index 00000000000..8068ff09d92 --- /dev/null +++ b/queue-5.15/tty-serial-samsung-fix-tx_empty-to-return-tiocser_te.patch @@ -0,0 +1,45 @@ +From aa45e914704974591c42ae725c5429a12c5becb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 10:45:08 +0000 +Subject: tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT + +From: Tudor Ambarus + +[ Upstream commit 314c2b399288f0058a8c5b6683292cbde5f1531b ] + +The core expects for tx_empty() either TIOCSER_TEMT when the tx is +empty or 0 otherwise. s3c24xx_serial_txempty_nofifo() might return +0x4, and at least uart_get_lsr_info() tries to clear exactly +TIOCSER_TEMT (BIT(1)). Fix tx_empty() to return TIOCSER_TEMT. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Tudor Ambarus +Reviewed-by: Sam Protsenko +Link: https://lore.kernel.org/r/20240119104526.1221243-2-tudor.ambarus@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/samsung_tty.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/tty/serial/samsung_tty.c b/drivers/tty/serial/samsung_tty.c +index 09b2b40b63c4d..7d3630ddebb39 100644 +--- a/drivers/tty/serial/samsung_tty.c ++++ b/drivers/tty/serial/samsung_tty.c +@@ -991,11 +991,10 @@ static unsigned int s3c24xx_serial_tx_empty(struct uart_port *port) + if ((ufstat & info->tx_fifomask) != 0 || + (ufstat & info->tx_fifofull)) + return 0; +- +- return 1; ++ return TIOCSER_TEMT; + } + +- return s3c24xx_serial_txempty_nofifo(port); ++ return s3c24xx_serial_txempty_nofifo(port) ? TIOCSER_TEMT : 0; + } + + /* no modem control lines */ +-- +2.43.0 + diff --git a/queue-5.15/tty-vt-fix-20-vs-0x20-typo-in-escsiignore.patch b/queue-5.15/tty-vt-fix-20-vs-0x20-typo-in-escsiignore.patch new file mode 100644 index 00000000000..20d83d391a3 --- /dev/null +++ b/queue-5.15/tty-vt-fix-20-vs-0x20-typo-in-escsiignore.patch @@ -0,0 +1,45 @@ +From 391029be106248f4bf9270ba2990a68df400039f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 12:03:17 +0100 +Subject: tty: vt: fix 20 vs 0x20 typo in EScsiignore + +From: Jiri Slaby (SUSE) + +[ Upstream commit 0e6a92f67c8a94707f7bb27ac29e2bdf3e7c167d ] + +The if (c >= 20 && c <= 0x3f) test added in commit 7a99565f8732 is +wrong. 20 is DC4 in ascii and it makes no sense to consider that as the +bottom limit. Instead, it should be 0x20 as in the other test in +the commit above. This is supposed to NOT change anything as we handle +interesting 20-0x20 asciis far before this if. + +So for sakeness, change to 0x20 (which is SPACE). + +Signed-off-by: "Jiri Slaby (SUSE)" +Fixes: 7a99565f8732 ("vt: ignore csi sequences with intermediate characters.") +Cc: Martin Hostettler +Link: https://lore.kernel.org/all/ZaP45QY2WEsDqoxg@neutronstar.dyndns.org/ +Tested-by: Helge Deller # parisc STI console +Link: https://lore.kernel.org/r/20240122110401.7289-4-jirislaby@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/vt/vt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index b8f5bc19416d9..442579f087c7c 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -2515,7 +2515,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c) + } + return; + case EScsiignore: +- if (c >= 20 && c <= 0x3f) ++ if (c >= 0x20 && c <= 0x3f) + return; + vc->vc_state = ESnormal; + return; +-- +2.43.0 + diff --git a/queue-5.15/usb-gadget-net2272-use-irqflags-in-the-call-to-net22.patch b/queue-5.15/usb-gadget-net2272-use-irqflags-in-the-call-to-net22.patch new file mode 100644 index 00000000000..08bbbc76eea --- /dev/null +++ b/queue-5.15/usb-gadget-net2272-use-irqflags-in-the-call-to-net22.patch @@ -0,0 +1,47 @@ +From 2c8254fe184b2e68100b0a24e0ea493c818869b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 18:17:34 +0000 +Subject: usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Colin Ian King + +[ Upstream commit 600556809f04eb3bbccd05218215dcd7b285a9a9 ] + +Currently the variable irqflags is being set but is not being used, +it appears it should be used in the call to net2272_probe_fin +rather than IRQF_TRIGGER_LOW being used. Kudos to Uwe Kleine-König +for suggesting the fix. + +Cleans up clang scan build warning: +drivers/usb/gadget/udc/net2272.c:2610:15: warning: variable 'irqflags' +set but not used [-Wunused-but-set-variable] + +Fixes: ceb80363b2ec ("USB: net2272: driver for PLX NET2272 USB device controller") +Signed-off-by: Colin Ian King +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/20240307181734.2034407-1-colin.i.king@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/net2272.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/net2272.c b/drivers/usb/gadget/udc/net2272.c +index 7c38057dcb4ab..e5402e05e7393 100644 +--- a/drivers/usb/gadget/udc/net2272.c ++++ b/drivers/usb/gadget/udc/net2272.c +@@ -2650,7 +2650,7 @@ net2272_plat_probe(struct platform_device *pdev) + goto err_req; + } + +- ret = net2272_probe_fin(dev, IRQF_TRIGGER_LOW); ++ ret = net2272_probe_fin(dev, irqflags); + if (ret) + goto err_io; + +-- +2.43.0 + diff --git a/queue-5.15/vdpa-mlx5-allow-cvq-size-changes.patch b/queue-5.15/vdpa-mlx5-allow-cvq-size-changes.patch new file mode 100644 index 00000000000..8aacaf0f420 --- /dev/null +++ b/queue-5.15/vdpa-mlx5-allow-cvq-size-changes.patch @@ -0,0 +1,83 @@ +From 61d238c157883628f371e45da78a845149963c94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 09:25:02 -0500 +Subject: vdpa/mlx5: Allow CVQ size changes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonah Palmer + +[ Upstream commit 749a4016839270163efc36ecddddd01de491a16b ] + +The MLX driver was not updating its control virtqueue size at set_vq_num +and instead always initialized to MLX5_CVQ_MAX_ENT (16) at +setup_cvq_vring. + +Qemu would try to set the size to 64 by default, however, because the +CVQ size always was initialized to 16, an error would be thrown when +sending >16 control messages (as used-ring entry 17 is initialized to 0). +For example, starting a guest with x-svq=on and then executing the +following command would produce the error below: + + # for i in {1..20}; do ifconfig eth0 hw ether XX:xx:XX:xx:XX:XX; done + + qemu-system-x86_64: Insufficient written data (0) + [ 435.331223] virtio_net virtio0: Failed to set mac address by vq command. + SIOCSIFHWADDR: Invalid argument + +Acked-by: Dragos Tatulea +Acked-by: Eugenio Pérez +Signed-off-by: Jonah Palmer +Message-Id: <20240216142502.78095-1-jonah.palmer@oracle.com> +Signed-off-by: Michael S. Tsirkin +Tested-by: Lei Yang +Fixes: 5262912ef3cf ("vdpa/mlx5: Add support for control VQ and MAC setting") +Signed-off-by: Sasha Levin +--- + drivers/vdpa/mlx5/net/mlx5_vnet.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c +index 46c72e6d3a29b..d9e4a949129a0 100644 +--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c ++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c +@@ -173,8 +173,6 @@ static void teardown_driver(struct mlx5_vdpa_net *ndev); + + static bool mlx5_vdpa_debug; + +-#define MLX5_CVQ_MAX_ENT 16 +- + #define MLX5_LOG_VIO_FLAG(_feature) \ + do { \ + if (features & BIT_ULL(_feature)) \ +@@ -1685,9 +1683,16 @@ static void mlx5_vdpa_set_vq_num(struct vdpa_device *vdev, u16 idx, u32 num) + struct mlx5_vdpa_net *ndev = to_mlx5_vdpa_ndev(mvdev); + struct mlx5_vdpa_virtqueue *mvq; + +- if (!is_index_valid(mvdev, idx) || is_ctrl_vq_idx(mvdev, idx)) ++ if (!is_index_valid(mvdev, idx)) + return; + ++ if (is_ctrl_vq_idx(mvdev, idx)) { ++ struct mlx5_control_vq *cvq = &mvdev->cvq; ++ ++ cvq->vring.vring.num = num; ++ return; ++ } ++ + mvq = &ndev->vqs[idx]; + mvq->num_ent = num; + } +@@ -2182,7 +2187,7 @@ static int setup_cvq_vring(struct mlx5_vdpa_dev *mvdev) + u16 idx = cvq->vring.last_avail_idx; + + err = vringh_init_iotlb(&cvq->vring, mvdev->actual_features, +- MLX5_CVQ_MAX_ENT, false, ++ cvq->vring.vring.num, false, + (struct vring_desc *)(uintptr_t)cvq->desc_addr, + (struct vring_avail *)(uintptr_t)cvq->driver_addr, + (struct vring_used *)(uintptr_t)cvq->device_addr); +-- +2.43.0 + diff --git a/queue-5.15/wireguard-receive-annotate-data-race-around-receivin.patch b/queue-5.15/wireguard-receive-annotate-data-race-around-receivin.patch new file mode 100644 index 00000000000..7eaf43b6733 --- /dev/null +++ b/queue-5.15/wireguard-receive-annotate-data-race-around-receivin.patch @@ -0,0 +1,86 @@ +From 2a61514f673d1292b9e874c38ab06703e9f41f88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 16:49:06 -0600 +Subject: wireguard: receive: annotate data-race around + receiving_counter.counter + +From: Nikita Zhandarovich + +[ Upstream commit bba045dc4d996d03dce6fe45726e78a1a1f6d4c3 ] + +Syzkaller with KCSAN identified a data-race issue when accessing +keypair->receiving_counter.counter. Use READ_ONCE() and WRITE_ONCE() +annotations to mark the data race as intentional. + + BUG: KCSAN: data-race in wg_packet_decrypt_worker / wg_packet_rx_poll + + write to 0xffff888107765888 of 8 bytes by interrupt on cpu 0: + counter_validate drivers/net/wireguard/receive.c:321 [inline] + wg_packet_rx_poll+0x3ac/0xf00 drivers/net/wireguard/receive.c:461 + __napi_poll+0x60/0x3b0 net/core/dev.c:6536 + napi_poll net/core/dev.c:6605 [inline] + net_rx_action+0x32b/0x750 net/core/dev.c:6738 + __do_softirq+0xc4/0x279 kernel/softirq.c:553 + do_softirq+0x5e/0x90 kernel/softirq.c:454 + __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381 + __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] + _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210 + spin_unlock_bh include/linux/spinlock.h:396 [inline] + ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline] + wg_packet_decrypt_worker+0x6c5/0x700 drivers/net/wireguard/receive.c:499 + process_one_work kernel/workqueue.c:2633 [inline] + ... + + read to 0xffff888107765888 of 8 bytes by task 3196 on cpu 1: + decrypt_packet drivers/net/wireguard/receive.c:252 [inline] + wg_packet_decrypt_worker+0x220/0x700 drivers/net/wireguard/receive.c:501 + process_one_work kernel/workqueue.c:2633 [inline] + process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2706 + worker_thread+0x525/0x730 kernel/workqueue.c:2787 + ... + +Fixes: a9e90d9931f3 ("wireguard: noise: separate receive counter from send counter") +Reported-by: syzbot+d1de830e4ecdaac83d89@syzkaller.appspotmail.com +Signed-off-by: Nikita Zhandarovich +Signed-off-by: Jason A. Donenfeld +Reviewed-by: Jiri Pirko +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/wireguard/receive.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireguard/receive.c b/drivers/net/wireguard/receive.c +index d38b24339a1f9..ed274e9bdf3ce 100644 +--- a/drivers/net/wireguard/receive.c ++++ b/drivers/net/wireguard/receive.c +@@ -258,7 +258,7 @@ static bool decrypt_packet(struct sk_buff *skb, struct noise_keypair *keypair) + + if (unlikely(!READ_ONCE(keypair->receiving.is_valid) || + wg_birthdate_has_expired(keypair->receiving.birthdate, REJECT_AFTER_TIME) || +- keypair->receiving_counter.counter >= REJECT_AFTER_MESSAGES)) { ++ READ_ONCE(keypair->receiving_counter.counter) >= REJECT_AFTER_MESSAGES)) { + WRITE_ONCE(keypair->receiving.is_valid, false); + return false; + } +@@ -325,7 +325,7 @@ static bool counter_validate(struct noise_replay_counter *counter, u64 their_cou + for (i = 1; i <= top; ++i) + counter->backtrack[(i + index_current) & + ((COUNTER_BITS_TOTAL / BITS_PER_LONG) - 1)] = 0; +- counter->counter = their_counter; ++ WRITE_ONCE(counter->counter, their_counter); + } + + index &= (COUNTER_BITS_TOTAL / BITS_PER_LONG) - 1; +@@ -470,7 +470,7 @@ int wg_packet_rx_poll(struct napi_struct *napi, int budget) + net_dbg_ratelimited("%s: Packet has invalid nonce %llu (max %llu)\n", + peer->device->dev->name, + PACKET_CB(skb)->nonce, +- keypair->receiving_counter.counter); ++ READ_ONCE(keypair->receiving_counter.counter)); + goto next; + } + +-- +2.43.0 +