From 439f4ca4ffb76d682098229ed12514fa70e35c7d Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sat, 31 Jul 2021 22:52:09 -0400 Subject: [PATCH] Fixes for 5.13 Signed-off-by: Sasha Levin --- .../block-delay-freeing-the-gendisk.patch | 59 +++ ...b-read-when-printing-xdp-link-fdinfo.patch | 77 ++++ ...ingress-queues-after-stopping-strpar.patch | 53 +++ ...x-fix-a-signedness-bug-in-hi3110_cmd.patch | 38 ++ ...p251xfd_irq-stop-timestamping-worker.patch | 42 +++ queue-5.13/drm-i915-bios-fix-ports-mask.patch | 58 +++ ...-initialize-the-intf_config-register.patch | 38 ++ ...p_ctrl_off_link_stream-during-phy-co.patch | 46 +++ ...m-dpu-fix-sm8250_mdp-register-length.patch | 39 ++ ...simple-fix-proper-bpc-for-ytc700tlag.patch | 39 ++ ...-firmware-lldp-agent-related-warning.patch | 49 +++ ...creation-failure-when-max-num-of-que.patch | 38 ++ .../i40e-fix-logic-of-disabling-queues.patch | 159 ++++++++ .../i40e-fix-queue-to-tc-mapping-on-tx.patch | 118 ++++++ .../ionic-catch-no-ptp-support-earlier.patch | 92 +++++ ...count-csum_none-when-offload-enabled.patch | 45 +++ ...-fix-up-dim-accounting-for-tx-and-rx.patch | 96 +++++ ...nic-make-all-rx_mode-work-threadsafe.patch | 352 ++++++++++++++++++ ...emove-intr-coalesce-update-from-napi.patch | 65 ++++ ...x-missing-break-in-dirty_log_perf_te.patch | 38 ++ ...e-right-feature-bit-for-msr_kvm_asyn.patch | 49 +++ ...-global-lock-for-safe-loop_validate_.patch | 264 +++++++++++++ ...bling-4-address-mode-on-a-sta-vif-af.patch | 92 +++++ ...-missing-error-code-in-mlx4_load_one.patch | 42 +++ ...x-silently-accept-the-deletion-of-vi.patch | 40 ++ queue-5.13/net-llc-fix-skb_over_panic.patch | 161 ++++++++ ...h-handle-devcom-events-only-for-port.patch | 61 +++ ...h-set-destination-vport-vhca-id-only.patch | 45 +++ .../net-mlx5-fix-flow-table-chaining.patch | 88 +++++ ...5_vport_tbl_attr-chain-from-u16-to-u.patch | 38 ++ ...oad-device-upon-firmware-fatal-error.patch | 49 +++ ...tif_f_hw_tc-to-hw_features-when-htb-.patch | 51 +++ ...e-rx-ntuple-offload-for-uplink-repre.patch | 125 +++++++ ...ix-nullptr-in-mlx5e_hairpin_get_mdev.patch | 97 +++++ ...ge-allocation-failure-for-ptp-rq-ove.patch | 37 ++ ...ge-allocation-failure-for-trap-rq-ov.patch | 54 +++ ...id-possible-data-corruption-when-rel.patch | 71 ++++ ...-re-add-check-for-phy_brcm_dis_txcrx.patch | 37 ++ queue-5.13/net-qrtr-fix-memory-leaks.patch | 66 ++++ ...network-header-for-ecn-decapsulation.patch | 97 +++++ ...ack-adjust-stop-timestamp-to-real-ex.patch | 44 +++ ...les-fix-audit-memory-leak-in-nf_tabl.patch | 79 ++++ ...t-allow-to-specify-layer-4-protocol-.patch | 36 ++ ...ont-enable-backpressure-on-lbk-links.patch | 73 ++++ ...-pf-fix-interface-down-flag-on-error.patch | 89 +++++ ...-amd-pmc-fix-command-completion-code.patch | 113 ++++++ ...-pmc-fix-missing-unlock-on-error-in-.patch | 39 ++ ...-pmc-fix-smu-firmware-reporting-mech.patch | 63 ++++ .../rdma-bnxt_re-fix-stats-counters.patch | 110 ++++++ ...e-fix-memory-leak-in-error-path-code.patch | 96 +++++ ...value-check-in-__sctp_rcv_asconf_loo.patch | 38 ++ queue-5.13/series | 56 +++ ...ng-pci_disable_device-in-probe-and-r.patch | 64 ++++ ...e-skb_shinfo-frags-when-doing-decryt.patch | 60 +++ .../tipc-fix-implicit-connect-for-syn.patch | 109 ++++++ ...-fix-sleeping-in-tipc-accept-routine.patch | 62 +++ ...40-fix-missing-pci_disable_device-in.patch | 65 ++++ 57 files changed, 4301 insertions(+) create mode 100644 queue-5.13/block-delay-freeing-the-gendisk.patch create mode 100644 queue-5.13/bpf-fix-oob-read-when-printing-xdp-link-fdinfo.patch create mode 100644 queue-5.13/bpf-sockmap-zap-ingress-queues-after-stopping-strpar.patch create mode 100644 queue-5.13/can-hi311x-fix-a-signedness-bug-in-hi3110_cmd.patch create mode 100644 queue-5.13/can-mcp251xfd-mcp251xfd_irq-stop-timestamping-worker.patch create mode 100644 queue-5.13/drm-i915-bios-fix-ports-mask.patch create mode 100644 queue-5.13/drm-msm-dp-initialize-the-intf_config-register.patch create mode 100644 queue-5.13/drm-msm-dp-use-dp_ctrl_off_link_stream-during-phy-co.patch create mode 100644 queue-5.13/drm-msm-dpu-fix-sm8250_mdp-register-length.patch create mode 100644 queue-5.13/drm-panel-panel-simple-fix-proper-bpc-for-ytc700tlag.patch create mode 100644 queue-5.13/i40e-fix-firmware-lldp-agent-related-warning.patch create mode 100644 queue-5.13/i40e-fix-log-tc-creation-failure-when-max-num-of-que.patch create mode 100644 queue-5.13/i40e-fix-logic-of-disabling-queues.patch create mode 100644 queue-5.13/i40e-fix-queue-to-tc-mapping-on-tx.patch create mode 100644 queue-5.13/ionic-catch-no-ptp-support-earlier.patch create mode 100644 queue-5.13/ionic-count-csum_none-when-offload-enabled.patch create mode 100644 queue-5.13/ionic-fix-up-dim-accounting-for-tx-and-rx.patch create mode 100644 queue-5.13/ionic-make-all-rx_mode-work-threadsafe.patch create mode 100644 queue-5.13/ionic-remove-intr-coalesce-update-from-napi.patch create mode 100644 queue-5.13/kvm-selftests-fix-missing-break-in-dirty_log_perf_te.patch create mode 100644 queue-5.13/kvm-x86-check-the-right-feature-bit-for-msr_kvm_asyn.patch create mode 100644 queue-5.13/loop-reintroduce-global-lock-for-safe-loop_validate_.patch create mode 100644 queue-5.13/mac80211-fix-enabling-4-address-mode-on-a-sta-vif-af.patch create mode 100644 queue-5.13/mlx4-fix-missing-error-code-in-mlx4_load_one.patch create mode 100644 queue-5.13/net-dsa-mv88e6xxx-silently-accept-the-deletion-of-vi.patch create mode 100644 queue-5.13/net-llc-fix-skb_over_panic.patch create mode 100644 queue-5.13/net-mlx5-e-switch-handle-devcom-events-only-for-port.patch create mode 100644 queue-5.13/net-mlx5-e-switch-set-destination-vport-vhca-id-only.patch create mode 100644 queue-5.13/net-mlx5-fix-flow-table-chaining.patch create mode 100644 queue-5.13/net-mlx5-fix-mlx5_vport_tbl_attr-chain-from-u16-to-u.patch create mode 100644 queue-5.13/net-mlx5-unload-device-upon-firmware-fatal-error.patch create mode 100644 queue-5.13/net-mlx5e-add-netif_f_hw_tc-to-hw_features-when-htb-.patch create mode 100644 queue-5.13/net-mlx5e-disable-rx-ntuple-offload-for-uplink-repre.patch create mode 100644 queue-5.13/net-mlx5e-fix-nullptr-in-mlx5e_hairpin_get_mdev.patch create mode 100644 queue-5.13/net-mlx5e-fix-page-allocation-failure-for-ptp-rq-ove.patch create mode 100644 queue-5.13/net-mlx5e-fix-page-allocation-failure-for-trap-rq-ov.patch create mode 100644 queue-5.13/net-mlx5e-rx-avoid-possible-data-corruption-when-rel.patch create mode 100644 queue-5.13/net-phy-broadcom-re-add-check-for-phy_brcm_dis_txcrx.patch create mode 100644 queue-5.13/net-qrtr-fix-memory-leaks.patch create mode 100644 queue-5.13/net-set-true-network-header-for-ecn-decapsulation.patch create mode 100644 queue-5.13/netfilter-conntrack-adjust-stop-timestamp-to-real-ex.patch create mode 100644 queue-5.13/netfilter-nf_tables-fix-audit-memory-leak-in-nf_tabl.patch create mode 100644 queue-5.13/netfilter-nft_nat-allow-to-specify-layer-4-protocol-.patch create mode 100644 queue-5.13/octeontx2-pf-dont-enable-backpressure-on-lbk-links.patch create mode 100644 queue-5.13/octeontx2-pf-fix-interface-down-flag-on-error.patch create mode 100644 queue-5.13/platform-x86-amd-pmc-fix-command-completion-code.patch create mode 100644 queue-5.13/platform-x86-amd-pmc-fix-missing-unlock-on-error-in-.patch create mode 100644 queue-5.13/platform-x86-amd-pmc-fix-smu-firmware-reporting-mech.patch create mode 100644 queue-5.13/rdma-bnxt_re-fix-stats-counters.patch create mode 100644 queue-5.13/rdma-rxe-fix-memory-leak-in-error-path-code.patch create mode 100644 queue-5.13/sctp-fix-return-value-check-in-__sctp_rcv_asconf_loo.patch create mode 100644 queue-5.13/sis900-fix-missing-pci_disable_device-in-probe-and-r.patch create mode 100644 queue-5.13/tipc-do-not-write-skb_shinfo-frags-when-doing-decryt.patch create mode 100644 queue-5.13/tipc-fix-implicit-connect-for-syn.patch create mode 100644 queue-5.13/tipc-fix-sleeping-in-tipc-accept-routine.patch create mode 100644 queue-5.13/tulip-windbond-840-fix-missing-pci_disable_device-in.patch diff --git a/queue-5.13/block-delay-freeing-the-gendisk.patch b/queue-5.13/block-delay-freeing-the-gendisk.patch new file mode 100644 index 00000000000..f1dc8f253a5 --- /dev/null +++ b/queue-5.13/block-delay-freeing-the-gendisk.patch @@ -0,0 +1,59 @@ +From cd8e94958e22589bf6b6e5caa46fdcdecb1b3585 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jul 2021 09:53:54 +0200 +Subject: block: delay freeing the gendisk + +From: Christoph Hellwig + +[ Upstream commit 340e84573878b2b9d63210482af46883366361b9 ] + +blkdev_get_no_open acquires a reference to the block_device through +the block device inode and then tries to acquire a device model +reference to the gendisk. But at this point the disk migh already +be freed (although the race is free). Fix this by only freeing the +gendisk from the whole device bdevs ->free_inode callback as well. + +Fixes: 22ae8ce8b892 ("block: simplify bdev/disk lookup in blkdev_get") +Signed-off-by: Christoph Hellwig +Reviewed-by: Josef Bacik +Reviewed-by: Ming Lei +Link: https://lore.kernel.org/r/20210722075402.983367-2-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/genhd.c | 3 +-- + fs/block_dev.c | 2 ++ + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/block/genhd.c b/block/genhd.c +index ad7436bd60c1..e8968fd30b2b 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -1124,10 +1124,9 @@ static void disk_release(struct device *dev) + disk_release_events(disk); + kfree(disk->random); + xa_destroy(&disk->part_tbl); +- bdput(disk->part0); + if (disk->queue) + blk_put_queue(disk->queue); +- kfree(disk); ++ bdput(disk->part0); /* frees the disk */ + } + struct class block_class = { + .name = "block", +diff --git a/fs/block_dev.c b/fs/block_dev.c +index 6cc4d4cfe0c2..e4a80bd4ddf1 100644 +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -812,6 +812,8 @@ static void bdev_free_inode(struct inode *inode) + free_percpu(bdev->bd_stats); + kfree(bdev->bd_meta_info); + ++ if (!bdev_is_partition(bdev)) ++ kfree(bdev->bd_disk); + kmem_cache_free(bdev_cachep, BDEV_I(inode)); + } + +-- +2.30.2 + diff --git a/queue-5.13/bpf-fix-oob-read-when-printing-xdp-link-fdinfo.patch b/queue-5.13/bpf-fix-oob-read-when-printing-xdp-link-fdinfo.patch new file mode 100644 index 00000000000..ed80e7339d5 --- /dev/null +++ b/queue-5.13/bpf-fix-oob-read-when-printing-xdp-link-fdinfo.patch @@ -0,0 +1,77 @@ +From 19df349ad0da3687ed66f8094fa4e30e987ecf86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jul 2021 09:51:34 +0100 +Subject: bpf: Fix OOB read when printing XDP link fdinfo + +From: Lorenz Bauer + +[ Upstream commit d6371c76e20d7d3f61b05fd67b596af4d14a8886 ] + +We got the following UBSAN report on one of our testing machines: + + ================================================================================ + UBSAN: array-index-out-of-bounds in kernel/bpf/syscall.c:2389:24 + index 6 is out of range for type 'char *[6]' + CPU: 43 PID: 930921 Comm: systemd-coredum Tainted: G O 5.10.48-cloudflare-kasan-2021.7.0 #1 + Hardware name: + Call Trace: + dump_stack+0x7d/0xa3 + ubsan_epilogue+0x5/0x40 + __ubsan_handle_out_of_bounds.cold+0x43/0x48 + ? seq_printf+0x17d/0x250 + bpf_link_show_fdinfo+0x329/0x380 + ? bpf_map_value_size+0xe0/0xe0 + ? put_files_struct+0x20/0x2d0 + ? __kasan_kmalloc.constprop.0+0xc2/0xd0 + seq_show+0x3f7/0x540 + seq_read_iter+0x3f8/0x1040 + seq_read+0x329/0x500 + ? seq_read_iter+0x1040/0x1040 + ? __fsnotify_parent+0x80/0x820 + ? __fsnotify_update_child_dentry_flags+0x380/0x380 + vfs_read+0x123/0x460 + ksys_read+0xed/0x1c0 + ? __x64_sys_pwrite64+0x1f0/0x1f0 + do_syscall_64+0x33/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + + ================================================================================ + ================================================================================ + UBSAN: object-size-mismatch in kernel/bpf/syscall.c:2384:2 + +From the report, we can infer that some array access in bpf_link_show_fdinfo at index 6 +is out of bounds. The obvious candidate is bpf_link_type_strs[BPF_LINK_TYPE_XDP] with +BPF_LINK_TYPE_XDP == 6. It turns out that BPF_LINK_TYPE_XDP is missing from bpf_types.h +and therefore doesn't have an entry in bpf_link_type_strs: + + pos: 0 + flags: 02000000 + mnt_id: 13 + link_type: (null) + link_id: 4 + prog_tag: bcf7977d3b93787c + prog_id: 4 + ifindex: 1 + +Fixes: aa8d3a716b59 ("bpf, xdp: Add bpf_link-based XDP attachment API") +Signed-off-by: Lorenz Bauer +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20210719085134.43325-2-lmb@cloudflare.com +Signed-off-by: Sasha Levin +--- + include/linux/bpf_types.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/linux/bpf_types.h b/include/linux/bpf_types.h +index f883f01a5061..def596a85752 100644 +--- a/include/linux/bpf_types.h ++++ b/include/linux/bpf_types.h +@@ -132,4 +132,5 @@ BPF_LINK_TYPE(BPF_LINK_TYPE_CGROUP, cgroup) + BPF_LINK_TYPE(BPF_LINK_TYPE_ITER, iter) + #ifdef CONFIG_NET + BPF_LINK_TYPE(BPF_LINK_TYPE_NETNS, netns) ++BPF_LINK_TYPE(BPF_LINK_TYPE_XDP, xdp) + #endif +-- +2.30.2 + diff --git a/queue-5.13/bpf-sockmap-zap-ingress-queues-after-stopping-strpar.patch b/queue-5.13/bpf-sockmap-zap-ingress-queues-after-stopping-strpar.patch new file mode 100644 index 00000000000..c4a981bdfb6 --- /dev/null +++ b/queue-5.13/bpf-sockmap-zap-ingress-queues-after-stopping-strpar.patch @@ -0,0 +1,53 @@ +From b194c2cdc8d1cc96eb6e4f922eabd1f179bdc78f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jul 2021 09:04:58 -0700 +Subject: bpf, sockmap: Zap ingress queues after stopping strparser + +From: John Fastabend + +[ Upstream commit 343597d558e79fe704ba8846b5b2ed24056b89c2 ] + +We don't want strparser to run and pass skbs into skmsg handlers when +the psock is null. We just sk_drop them in this case. When removing +a live socket from map it means extra drops that we do not need to +incur. Move the zap below strparser close to avoid this condition. + +This way we stop the stream parser first stopping it from processing +packets and then delete the psock. + +Fixes: a136678c0bdbb ("bpf: sk_msg, zap ingress queue on psock down") +Signed-off-by: John Fastabend +Signed-off-by: Andrii Nakryiko +Acked-by: Jakub Sitnicki +Acked-by: Martin KaFai Lau +Link: https://lore.kernel.org/bpf/20210727160500.1713554-2-john.fastabend@gmail.com +Signed-off-by: Sasha Levin +--- + net/core/skmsg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/core/skmsg.c b/net/core/skmsg.c +index b2410a1bfa23..45b3a3adc886 100644 +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -790,8 +790,6 @@ static void sk_psock_destroy(struct work_struct *work) + + void sk_psock_drop(struct sock *sk, struct sk_psock *psock) + { +- sk_psock_stop(psock, false); +- + write_lock_bh(&sk->sk_callback_lock); + sk_psock_restore_proto(sk, psock); + rcu_assign_sk_user_data(sk, NULL); +@@ -801,6 +799,8 @@ void sk_psock_drop(struct sock *sk, struct sk_psock *psock) + sk_psock_stop_verdict(sk, psock); + write_unlock_bh(&sk->sk_callback_lock); + ++ sk_psock_stop(psock, false); ++ + INIT_RCU_WORK(&psock->rwork, sk_psock_destroy); + queue_rcu_work(system_wq, &psock->rwork); + } +-- +2.30.2 + diff --git a/queue-5.13/can-hi311x-fix-a-signedness-bug-in-hi3110_cmd.patch b/queue-5.13/can-hi311x-fix-a-signedness-bug-in-hi3110_cmd.patch new file mode 100644 index 00000000000..71b07ad094c --- /dev/null +++ b/queue-5.13/can-hi311x-fix-a-signedness-bug-in-hi3110_cmd.patch @@ -0,0 +1,38 @@ +From 3e40236ea55e5702d3d9c2cd4ad51e7a2a3f0384 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jul 2021 17:12:46 +0300 +Subject: can: hi311x: fix a signedness bug in hi3110_cmd() + +From: Dan Carpenter + +[ Upstream commit f6b3c7848e66e9046c8a79a5b88fd03461cc252b ] + +The hi3110_cmd() is supposed to return zero on success and negative +error codes on failure, but it was accidentally declared as a u8 when +it needs to be an int type. + +Fixes: 57e83fb9b746 ("can: hi311x: Add Holt HI-311x CAN driver") +Link: https://lore.kernel.org/r/20210729141246.GA1267@kili +Signed-off-by: Dan Carpenter +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/spi/hi311x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c +index 6f5d6d04a8b9..c84a198776c7 100644 +--- a/drivers/net/can/spi/hi311x.c ++++ b/drivers/net/can/spi/hi311x.c +@@ -218,7 +218,7 @@ static int hi3110_spi_trans(struct spi_device *spi, int len) + return ret; + } + +-static u8 hi3110_cmd(struct spi_device *spi, u8 command) ++static int hi3110_cmd(struct spi_device *spi, u8 command) + { + struct hi3110_priv *priv = spi_get_drvdata(spi); + +-- +2.30.2 + diff --git a/queue-5.13/can-mcp251xfd-mcp251xfd_irq-stop-timestamping-worker.patch b/queue-5.13/can-mcp251xfd-mcp251xfd_irq-stop-timestamping-worker.patch new file mode 100644 index 00000000000..4d597566694 --- /dev/null +++ b/queue-5.13/can-mcp251xfd-mcp251xfd_irq-stop-timestamping-worker.patch @@ -0,0 +1,42 @@ +From 401c2b55364c62d8d3a5affd5a2b69aeebf6e5e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Apr 2021 16:20:39 +0200 +Subject: can: mcp251xfd: mcp251xfd_irq(): stop timestamping worker in case + error in IRQ + +From: Marc Kleine-Budde + +[ Upstream commit ef68a717960658e6a1e5f08adb0574326e9a12c2 ] + +In case an error occurred in the IRQ handler, the chip status is +dumped via devcoredump and all IRQs are disabled, but the chip stays +powered for further analysis. + +The chip is in an undefined state and will not receive any CAN frames, +so shut down the timestamping worker, which reads the TBC register +regularly, too. This avoids any CRC read error messages if there is a +communication problem with the chip. + +Fixes: efd8d98dfb90 ("can: mcp251xfd: add HW timestamp infrastructure") +Link: https://lore.kernel.org/r/20210724155131.471303-1-mkl@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c +index e0ae00e34c7b..d371af7ab496 100644 +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c +@@ -2300,6 +2300,7 @@ static irqreturn_t mcp251xfd_irq(int irq, void *dev_id) + err, priv->regs_status.intf); + mcp251xfd_dump(priv); + mcp251xfd_chip_interrupts_disable(priv); ++ mcp251xfd_timestamp_stop(priv); + + return handled; + } +-- +2.30.2 + diff --git a/queue-5.13/drm-i915-bios-fix-ports-mask.patch b/queue-5.13/drm-i915-bios-fix-ports-mask.patch new file mode 100644 index 00000000000..e670eaf4b7a --- /dev/null +++ b/queue-5.13/drm-i915-bios-fix-ports-mask.patch @@ -0,0 +1,58 @@ +From 3659ec9d82c02483f95bd1e546369f2e52d8adbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jul 2021 05:52:25 -0400 +Subject: drm/i915/bios: Fix ports mask +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rodrigo Vivi + +[ Upstream commit d7f237df53457cf0cbdb9943b9b7c93a05e2fdb6 ] + +PORT_A to PORT_F are regular integers defined in the enum port, +while for_each_port_masked requires a bit mask for the ports. + +Current given mask: 0b111 +Desired mask: 0b111111 + +I noticed this while Christoph was reporting a bug found on headless +GVT configuration which bisect blamed commit 3ae04c0c7e63 ("drm/i915/bios: +limit default outputs to ports A through F") + +v2: Avoid unnecessary line continuations as pointed by CI and Christoph + +Cc: Christoph Hellwig +Fixes: 3ae04c0c7e63 ("drm/i915/bios: limit default outputs to ports A through F") +Cc: Lucas De Marchi +Cc: Ville Syrjälä +Cc: Jani Nikula +Signed-off-by: Rodrigo Vivi +Reviewed-by: José Roberto de Souza +Reviewed-by: Lucas De Marchi +Tested-by: Christoph Hellwig +Link: https://patchwork.freedesktop.org/patch/msgid/20210723095225.562913-1-rodrigo.vivi@intel.com +(cherry picked from commit 9b52aa720168859526bf90d77fa210fc0336f170) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_bios.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c +index 3d0c035b5e38..04c8d2ff7867 100644 +--- a/drivers/gpu/drm/i915/display/intel_bios.c ++++ b/drivers/gpu/drm/i915/display/intel_bios.c +@@ -2130,7 +2130,8 @@ static void + init_vbt_missing_defaults(struct drm_i915_private *i915) + { + enum port port; +- int ports = PORT_A | PORT_B | PORT_C | PORT_D | PORT_E | PORT_F; ++ int ports = BIT(PORT_A) | BIT(PORT_B) | BIT(PORT_C) | ++ BIT(PORT_D) | BIT(PORT_E) | BIT(PORT_F); + + if (!HAS_DDI(i915) && !IS_CHERRYVIEW(i915)) + return; +-- +2.30.2 + diff --git a/queue-5.13/drm-msm-dp-initialize-the-intf_config-register.patch b/queue-5.13/drm-msm-dp-initialize-the-intf_config-register.patch new file mode 100644 index 00000000000..a7bbcb5f41b --- /dev/null +++ b/queue-5.13/drm-msm-dp-initialize-the-intf_config-register.patch @@ -0,0 +1,38 @@ +From 640b07b158d6373a5ee1b3916ed1b4d86d9112de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jul 2021 19:44:34 -0700 +Subject: drm/msm/dp: Initialize the INTF_CONFIG register + +From: Bjorn Andersson + +[ Upstream commit f9a39932fa54b6421e751ada7a285da809146421 ] + +Some bootloaders set the widebus enable bit in the INTF_CONFIG register, +but configuration of widebus isn't yet supported ensure that the +register has a known value, with widebus disabled. + +Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support") +Signed-off-by: Bjorn Andersson +Reviewed-by: Stephen Boyd +Link: https://lore.kernel.org/r/20210722024434.3313167-1-bjorn.andersson@linaro.org +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dp/dp_catalog.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/msm/dp/dp_catalog.c b/drivers/gpu/drm/msm/dp/dp_catalog.c +index f4f53f23e331..146a223a997a 100644 +--- a/drivers/gpu/drm/msm/dp/dp_catalog.c ++++ b/drivers/gpu/drm/msm/dp/dp_catalog.c +@@ -762,6 +762,7 @@ int dp_catalog_panel_timing_cfg(struct dp_catalog *dp_catalog) + dp_write_link(catalog, REG_DP_HSYNC_VSYNC_WIDTH_POLARITY, + dp_catalog->width_blanking); + dp_write_link(catalog, REG_DP_ACTIVE_HOR_VER, dp_catalog->dp_active); ++ dp_write_p0(catalog, MMSS_DP_INTF_CONFIG, 0); + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.13/drm-msm-dp-use-dp_ctrl_off_link_stream-during-phy-co.patch b/queue-5.13/drm-msm-dp-use-dp_ctrl_off_link_stream-during-phy-co.patch new file mode 100644 index 00000000000..59c2d44e4c5 --- /dev/null +++ b/queue-5.13/drm-msm-dp-use-dp_ctrl_off_link_stream-during-phy-co.patch @@ -0,0 +1,46 @@ +From e39c4508e79d9e8bf77455c7573ce52c4a8510a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jul 2021 08:54:01 -0700 +Subject: drm/msm/dp: use dp_ctrl_off_link_stream during PHY compliance test + run + +From: Kuogee Hsieh + +[ Upstream commit 7591c532b818ef4b8e3e635d842547c08b3a32b4 ] + +DP cable should always connect to DPU during the entire PHY compliance +testing run. Since DP PHY compliance test is executed at irq_hpd event +context, dp_ctrl_off_link_stream() should be used instead of dp_ctrl_off(). +dp_ctrl_off() is used for unplug event which is triggered when DP cable is +dis connected. + +Changes in V2: +-- add fixes statement + +Fixes: f21c8a276c2d ("drm/msm/dp: handle irq_hpd with sink_count = 0 correctly") + +Signed-off-by: Kuogee Hsieh +Reviewed-by: Stephen Boyd +Link: https://lore.kernel.org/r/1626191647-13901-2-git-send-email-khsieh@codeaurora.org +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dp/dp_ctrl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c +index 2a8955ca70d1..6856223e91e1 100644 +--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c ++++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c +@@ -1528,7 +1528,7 @@ static int dp_ctrl_process_phy_test_request(struct dp_ctrl_private *ctrl) + * running. Add the global reset just before disabling the + * link clocks and core clocks. + */ +- ret = dp_ctrl_off(&ctrl->dp_ctrl); ++ ret = dp_ctrl_off_link_stream(&ctrl->dp_ctrl); + if (ret) { + DRM_ERROR("failed to disable DP controller\n"); + return ret; +-- +2.30.2 + diff --git a/queue-5.13/drm-msm-dpu-fix-sm8250_mdp-register-length.patch b/queue-5.13/drm-msm-dpu-fix-sm8250_mdp-register-length.patch new file mode 100644 index 00000000000..b4a43b6d2bb --- /dev/null +++ b/queue-5.13/drm-msm-dpu-fix-sm8250_mdp-register-length.patch @@ -0,0 +1,39 @@ +From c11afb63198e5e394b3aea9ca642e4c7802a254d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jun 2021 10:50:33 +0200 +Subject: drm/msm/dpu: Fix sm8250_mdp register length + +From: Robert Foss + +[ Upstream commit b910a0206b59eb90ea8ff76d146f4c3156da61e9 ] + +The downstream dts lists this value as 0x494, and not +0x45c. + +Fixes: af776a3e1c30 ("drm/msm/dpu: add SM8250 to hw catalog") +Signed-off-by: Robert Foss +Reviewed-by: Dmitry Baryshkov +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20210628085033.9905-1-robert.foss@linaro.org +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c +index b569030a0847..2daf81f63076 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c +@@ -268,7 +268,7 @@ static const struct dpu_mdp_cfg sc7180_mdp[] = { + static const struct dpu_mdp_cfg sm8250_mdp[] = { + { + .name = "top_0", .id = MDP_TOP, +- .base = 0x0, .len = 0x45C, ++ .base = 0x0, .len = 0x494, + .features = 0, + .highest_bank_bit = 0x3, /* TODO: 2 for LP_DDR4 */ + .clk_ctrls[DPU_CLK_CTRL_VIG0] = { +-- +2.30.2 + diff --git a/queue-5.13/drm-panel-panel-simple-fix-proper-bpc-for-ytc700tlag.patch b/queue-5.13/drm-panel-panel-simple-fix-proper-bpc-for-ytc700tlag.patch new file mode 100644 index 00000000000..2d8262a8f57 --- /dev/null +++ b/queue-5.13/drm-panel-panel-simple-fix-proper-bpc-for-ytc700tlag.patch @@ -0,0 +1,39 @@ +From 6c3529cdbf54167e9850422a34a5cd77948d15cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jul 2021 23:17:37 +0530 +Subject: drm/panel: panel-simple: Fix proper bpc for ytc700tlag_05_201c + +From: Jagan Teki + +[ Upstream commit 44379b986424b02acfa6e8c85ec5d68d89d3ccc4 ] + +ytc700tlag_05_201c panel support 8 bpc not 6 bpc as per +recent testing in i.MX8MM platform. + +Fix it. + +Fixes: 7a1f4fa4a629 ("drm/panel: simple: Add YTC700TLAG-05-201C") +Signed-off-by: Jagan Teki +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20210725174737.891106-1-jagan@amarulasolutions.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-simple.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index be312b5c04dd..1301d42cfffb 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -4124,7 +4124,7 @@ static const struct drm_display_mode yes_optoelectronics_ytc700tlag_05_201c_mode + static const struct panel_desc yes_optoelectronics_ytc700tlag_05_201c = { + .modes = &yes_optoelectronics_ytc700tlag_05_201c_mode, + .num_modes = 1, +- .bpc = 6, ++ .bpc = 8, + .size = { + .width = 154, + .height = 90, +-- +2.30.2 + diff --git a/queue-5.13/i40e-fix-firmware-lldp-agent-related-warning.patch b/queue-5.13/i40e-fix-firmware-lldp-agent-related-warning.patch new file mode 100644 index 00000000000..ca4b96d4f20 --- /dev/null +++ b/queue-5.13/i40e-fix-firmware-lldp-agent-related-warning.patch @@ -0,0 +1,49 @@ +From 125381ba7ef4bb25c878a0779e16ef2296287375 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 18:41:26 +0200 +Subject: i40e: Fix firmware LLDP agent related warning + +From: Arkadiusz Kubalewski + +[ Upstream commit 71d6fdba4b2d82fdd883fec31dee77fbcf59773a ] + +Make warning meaningful for the user. + +Previously the trace: +"Starting FW LLDP agent failed: error: I40E_ERR_ADMIN_QUEUE_ERROR, I40E_AQ_RC_EAGAIN" +was produced when user tried to start Firmware LLDP agent, +just after it was stopped with sequence: +ethtool --set-priv-flags disable-fw-lldp on +ethtool --set-priv-flags disable-fw-lldp off +(without any delay between the commands) +At that point the firmware is still processing stop command, the behavior +is expected. + +Fixes: c1041d070437 ("i40e: Missing response checks in driver when starting/stopping FW LLDP") +Signed-off-by: Aleksandr Loktionov +Signed-off-by: Arkadiusz Kubalewski +Tested-by: Imam Hassan Reza Biswas +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index 3e822bad4851..d9e26f9713a5 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -5294,6 +5294,10 @@ flags_complete: + dev_warn(&pf->pdev->dev, + "Device configuration forbids SW from starting the LLDP agent.\n"); + return -EINVAL; ++ case I40E_AQ_RC_EAGAIN: ++ dev_warn(&pf->pdev->dev, ++ "Stop FW LLDP agent command is still being processed, please try again in a second.\n"); ++ return -EBUSY; + default: + dev_warn(&pf->pdev->dev, + "Starting FW LLDP agent failed: error: %s, %s\n", +-- +2.30.2 + diff --git a/queue-5.13/i40e-fix-log-tc-creation-failure-when-max-num-of-que.patch b/queue-5.13/i40e-fix-log-tc-creation-failure-when-max-num-of-que.patch new file mode 100644 index 00000000000..1d5ac48a454 --- /dev/null +++ b/queue-5.13/i40e-fix-log-tc-creation-failure-when-max-num-of-que.patch @@ -0,0 +1,38 @@ +From d0e972ca2e573eaaff268df430d2f961d19ffbe5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 08:49:49 +0000 +Subject: i40e: Fix log TC creation failure when max num of queues is exceeded + +From: Jedrzej Jagielski + +[ Upstream commit ea52faae1d17cd3048681d86d2e8641f44de484d ] + +Fix missing failed message if driver does not have enough queues to +complete TC command. Without this fix no message is displayed in dmesg. + +Fixes: a9ce82f744dc ("i40e: Enable 'channel' mode in mqprio for TC configs") +Signed-off-by: Grzegorz Szczurek +Signed-off-by: Jedrzej Jagielski +Tested-by: Imam Hassan Reza Biswas +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 0207c5ceecf6..4e5c53a6265c 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -7290,6 +7290,8 @@ static int i40e_validate_mqprio_qopt(struct i40e_vsi *vsi, + } + if (vsi->num_queue_pairs < + (mqprio_qopt->qopt.offset[i] + mqprio_qopt->qopt.count[i])) { ++ dev_err(&vsi->back->pdev->dev, ++ "Failed to create traffic channel, insufficient number of queues.\n"); + return -EINVAL; + } + if (sum_max_rate > i40e_get_link_speed(vsi)) { +-- +2.30.2 + diff --git a/queue-5.13/i40e-fix-logic-of-disabling-queues.patch b/queue-5.13/i40e-fix-logic-of-disabling-queues.patch new file mode 100644 index 00000000000..85acae93ff5 --- /dev/null +++ b/queue-5.13/i40e-fix-logic-of-disabling-queues.patch @@ -0,0 +1,159 @@ +From 1c137ab14a89e743077a85ef8d5573d8c71b0e0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 19:49:47 +0200 +Subject: i40e: Fix logic of disabling queues + +From: Arkadiusz Kubalewski + +[ Upstream commit 65662a8dcdd01342b71ee44234bcfd0162e195af ] + +Correct the message flow between driver and firmware when disabling +queues. + +Previously in case of PF reset (due to required reinit after reconfig), +the error like: "VSI seid 397 Tx ring 60 disable timeout" could show up +occasionally. The error was not a real issue of hardware or firmware, +it was caused by wrong sequence of messages invoked by the driver. + +Fixes: 41c445ff0f48 ("i40e: main driver core") +Signed-off-by: Aleksandr Loktionov +Signed-off-by: Arkadiusz Kubalewski +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 58 ++++++++++++--------- + 1 file changed, 34 insertions(+), 24 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index f9fe500d4ec4..951423e5f2c0 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -4454,11 +4454,10 @@ int i40e_control_wait_tx_q(int seid, struct i40e_pf *pf, int pf_q, + } + + /** +- * i40e_vsi_control_tx - Start or stop a VSI's rings ++ * i40e_vsi_enable_tx - Start a VSI's rings + * @vsi: the VSI being configured +- * @enable: start or stop the rings + **/ +-static int i40e_vsi_control_tx(struct i40e_vsi *vsi, bool enable) ++static int i40e_vsi_enable_tx(struct i40e_vsi *vsi) + { + struct i40e_pf *pf = vsi->back; + int i, pf_q, ret = 0; +@@ -4467,7 +4466,7 @@ static int i40e_vsi_control_tx(struct i40e_vsi *vsi, bool enable) + for (i = 0; i < vsi->num_queue_pairs; i++, pf_q++) { + ret = i40e_control_wait_tx_q(vsi->seid, pf, + pf_q, +- false /*is xdp*/, enable); ++ false /*is xdp*/, true); + if (ret) + break; + +@@ -4476,7 +4475,7 @@ static int i40e_vsi_control_tx(struct i40e_vsi *vsi, bool enable) + + ret = i40e_control_wait_tx_q(vsi->seid, pf, + pf_q + vsi->alloc_queue_pairs, +- true /*is xdp*/, enable); ++ true /*is xdp*/, true); + if (ret) + break; + } +@@ -4574,32 +4573,25 @@ int i40e_control_wait_rx_q(struct i40e_pf *pf, int pf_q, bool enable) + } + + /** +- * i40e_vsi_control_rx - Start or stop a VSI's rings ++ * i40e_vsi_enable_rx - Start a VSI's rings + * @vsi: the VSI being configured +- * @enable: start or stop the rings + **/ +-static int i40e_vsi_control_rx(struct i40e_vsi *vsi, bool enable) ++static int i40e_vsi_enable_rx(struct i40e_vsi *vsi) + { + struct i40e_pf *pf = vsi->back; + int i, pf_q, ret = 0; + + pf_q = vsi->base_queue; + for (i = 0; i < vsi->num_queue_pairs; i++, pf_q++) { +- ret = i40e_control_wait_rx_q(pf, pf_q, enable); ++ ret = i40e_control_wait_rx_q(pf, pf_q, true); + if (ret) { + dev_info(&pf->pdev->dev, +- "VSI seid %d Rx ring %d %sable timeout\n", +- vsi->seid, pf_q, (enable ? "en" : "dis")); ++ "VSI seid %d Rx ring %d enable timeout\n", ++ vsi->seid, pf_q); + break; + } + } + +- /* Due to HW errata, on Rx disable only, the register can indicate done +- * before it really is. Needs 50ms to be sure +- */ +- if (!enable) +- mdelay(50); +- + return ret; + } + +@@ -4612,29 +4604,47 @@ int i40e_vsi_start_rings(struct i40e_vsi *vsi) + int ret = 0; + + /* do rx first for enable and last for disable */ +- ret = i40e_vsi_control_rx(vsi, true); ++ ret = i40e_vsi_enable_rx(vsi); + if (ret) + return ret; +- ret = i40e_vsi_control_tx(vsi, true); ++ ret = i40e_vsi_enable_tx(vsi); + + return ret; + } + ++#define I40E_DISABLE_TX_GAP_MSEC 50 ++ + /** + * i40e_vsi_stop_rings - Stop a VSI's rings + * @vsi: the VSI being configured + **/ + void i40e_vsi_stop_rings(struct i40e_vsi *vsi) + { ++ struct i40e_pf *pf = vsi->back; ++ int pf_q, err, q_end; ++ + /* When port TX is suspended, don't wait */ + if (test_bit(__I40E_PORT_SUSPENDED, vsi->back->state)) + return i40e_vsi_stop_rings_no_wait(vsi); + +- /* do rx first for enable and last for disable +- * Ignore return value, we need to shutdown whatever we can +- */ +- i40e_vsi_control_tx(vsi, false); +- i40e_vsi_control_rx(vsi, false); ++ q_end = vsi->base_queue + vsi->num_queue_pairs; ++ for (pf_q = vsi->base_queue; pf_q < q_end; pf_q++) ++ i40e_pre_tx_queue_cfg(&pf->hw, (u32)pf_q, false); ++ ++ for (pf_q = vsi->base_queue; pf_q < q_end; pf_q++) { ++ err = i40e_control_wait_rx_q(pf, pf_q, false); ++ if (err) ++ dev_info(&pf->pdev->dev, ++ "VSI seid %d Rx ring %d dissable timeout\n", ++ vsi->seid, pf_q); ++ } ++ ++ msleep(I40E_DISABLE_TX_GAP_MSEC); ++ pf_q = vsi->base_queue; ++ for (pf_q = vsi->base_queue; pf_q < q_end; pf_q++) ++ wr32(&pf->hw, I40E_QTX_ENA(pf_q), 0); ++ ++ i40e_vsi_wait_queues_disabled(vsi); + } + + /** +-- +2.30.2 + diff --git a/queue-5.13/i40e-fix-queue-to-tc-mapping-on-tx.patch b/queue-5.13/i40e-fix-queue-to-tc-mapping-on-tx.patch new file mode 100644 index 00000000000..fcc5e51c0c4 --- /dev/null +++ b/queue-5.13/i40e-fix-queue-to-tc-mapping-on-tx.patch @@ -0,0 +1,118 @@ +From d36683f1f00a8c4a68d0b828ad0583e5ead05814 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jun 2021 00:47:03 +0000 +Subject: i40e: Fix queue-to-TC mapping on Tx + +From: Jedrzej Jagielski + +[ Upstream commit 89ec1f0886c127c7e41ac61a6b6d539f4fb2510b ] + +In SW DCB mode the packets sent receive incorrect UP tags. They are +constructed correctly and put into tx_ring, but UP is later remapped by +HW on the basis of TCTUPR register contents according to Tx queue +selected, and BW used is consistent with the new UP values. This is +caused by Tx queue selection in kernel not taking into account DCB +configuration. This patch fixes the issue by implementing the +ndo_select_queue NDO callback. + +Fixes: fd0a05ce74ef ("i40e: transmit, receive, and NAPI") +Signed-off-by: Arkadiusz Kubalewski +Signed-off-by: Jedrzej Jagielski +Tested-by: Imam Hassan Reza Biswas +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 1 + + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 50 +++++++++++++++++++++ + drivers/net/ethernet/intel/i40e/i40e_txrx.h | 2 + + 3 files changed, 53 insertions(+) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 951423e5f2c0..0207c5ceecf6 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -13271,6 +13271,7 @@ static const struct net_device_ops i40e_netdev_ops = { + .ndo_poll_controller = i40e_netpoll, + #endif + .ndo_setup_tc = __i40e_setup_tc, ++ .ndo_select_queue = i40e_lan_select_queue, + .ndo_set_features = i40e_set_features, + .ndo_set_vf_mac = i40e_ndo_set_vf_mac, + .ndo_set_vf_vlan = i40e_ndo_set_vf_port_vlan, +diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +index b883ab809df3..107fb472319e 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -3633,6 +3633,56 @@ dma_error: + return -1; + } + ++static u16 i40e_swdcb_skb_tx_hash(struct net_device *dev, ++ const struct sk_buff *skb, ++ u16 num_tx_queues) ++{ ++ u32 jhash_initval_salt = 0xd631614b; ++ u32 hash; ++ ++ if (skb->sk && skb->sk->sk_hash) ++ hash = skb->sk->sk_hash; ++ else ++ hash = (__force u16)skb->protocol ^ skb->hash; ++ ++ hash = jhash_1word(hash, jhash_initval_salt); ++ ++ return (u16)(((u64)hash * num_tx_queues) >> 32); ++} ++ ++u16 i40e_lan_select_queue(struct net_device *netdev, ++ struct sk_buff *skb, ++ struct net_device __always_unused *sb_dev) ++{ ++ struct i40e_netdev_priv *np = netdev_priv(netdev); ++ struct i40e_vsi *vsi = np->vsi; ++ struct i40e_hw *hw; ++ u16 qoffset; ++ u16 qcount; ++ u8 tclass; ++ u16 hash; ++ u8 prio; ++ ++ /* is DCB enabled at all? */ ++ if (vsi->tc_config.numtc == 1) ++ return i40e_swdcb_skb_tx_hash(netdev, skb, ++ netdev->real_num_tx_queues); ++ ++ prio = skb->priority; ++ hw = &vsi->back->hw; ++ tclass = hw->local_dcbx_config.etscfg.prioritytable[prio]; ++ /* sanity check */ ++ if (unlikely(!(vsi->tc_config.enabled_tc & BIT(tclass)))) ++ tclass = 0; ++ ++ /* select a queue assigned for the given TC */ ++ qcount = vsi->tc_config.tc_info[tclass].qcount; ++ hash = i40e_swdcb_skb_tx_hash(netdev, skb, qcount); ++ ++ qoffset = vsi->tc_config.tc_info[tclass].qoffset; ++ return qoffset + hash; ++} ++ + /** + * i40e_xmit_xdp_ring - transmits an XDP buffer to an XDP Tx ring + * @xdpf: data to transmit +diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.h b/drivers/net/ethernet/intel/i40e/i40e_txrx.h +index 86fed05b4f19..bfc2845c99d1 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.h +@@ -451,6 +451,8 @@ static inline unsigned int i40e_rx_pg_order(struct i40e_ring *ring) + + bool i40e_alloc_rx_buffers(struct i40e_ring *rxr, u16 cleaned_count); + netdev_tx_t i40e_lan_xmit_frame(struct sk_buff *skb, struct net_device *netdev); ++u16 i40e_lan_select_queue(struct net_device *netdev, struct sk_buff *skb, ++ struct net_device *sb_dev); + void i40e_clean_tx_ring(struct i40e_ring *tx_ring); + void i40e_clean_rx_ring(struct i40e_ring *rx_ring); + int i40e_setup_tx_descriptors(struct i40e_ring *tx_ring); +-- +2.30.2 + diff --git a/queue-5.13/ionic-catch-no-ptp-support-earlier.patch b/queue-5.13/ionic-catch-no-ptp-support-earlier.patch new file mode 100644 index 00000000000..fe1ab60953c --- /dev/null +++ b/queue-5.13/ionic-catch-no-ptp-support-earlier.patch @@ -0,0 +1,92 @@ +From f0e37ac0c12251f14f2f52ec135e1e4ba74a9f70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jul 2021 11:02:46 -0700 +Subject: ionic: catch no ptp support earlier + +From: Shannon Nelson + +[ Upstream commit f79eef711eb57d56874b08ea11db69221de54a6d ] + +If PTP configuration is attempted on ports that don't support +it, such as VF ports, the driver will return an error status +-95, or EOPNOSUPP and print an error message + enp98s0: hwstamp set failed: -95 + +Because some daemons can retry every few seconds, this can end +up filling the dmesg log and pushing out other more useful +messages. + +We can catch this issue earlier in our handling and return +the error without a log message. + +Fixes: 829600ce5e4e ("ionic: add ts_config replay") +Signed-off-by: Shannon Nelson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_lif.h | 7 ++----- + drivers/net/ethernet/pensando/ionic/ionic_phc.c | 10 +++++++--- + 2 files changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.h b/drivers/net/ethernet/pensando/ionic/ionic_lif.h +index af291303bd7a..69ab59fedb6c 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.h ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.h +@@ -302,7 +302,7 @@ int ionic_lif_identify(struct ionic *ionic, u8 lif_type, + int ionic_lif_size(struct ionic *ionic); + + #if IS_ENABLED(CONFIG_PTP_1588_CLOCK) +-int ionic_lif_hwstamp_replay(struct ionic_lif *lif); ++void ionic_lif_hwstamp_replay(struct ionic_lif *lif); + int ionic_lif_hwstamp_set(struct ionic_lif *lif, struct ifreq *ifr); + int ionic_lif_hwstamp_get(struct ionic_lif *lif, struct ifreq *ifr); + ktime_t ionic_lif_phc_ktime(struct ionic_lif *lif, u64 counter); +@@ -311,10 +311,7 @@ void ionic_lif_unregister_phc(struct ionic_lif *lif); + void ionic_lif_alloc_phc(struct ionic_lif *lif); + void ionic_lif_free_phc(struct ionic_lif *lif); + #else +-static inline int ionic_lif_hwstamp_replay(struct ionic_lif *lif) +-{ +- return -EOPNOTSUPP; +-} ++static inline void ionic_lif_hwstamp_replay(struct ionic_lif *lif) {} + + static inline int ionic_lif_hwstamp_set(struct ionic_lif *lif, struct ifreq *ifr) + { +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_phc.c b/drivers/net/ethernet/pensando/ionic/ionic_phc.c +index a87c87e86aef..6e2403c71608 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_phc.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_phc.c +@@ -188,6 +188,9 @@ int ionic_lif_hwstamp_set(struct ionic_lif *lif, struct ifreq *ifr) + struct hwtstamp_config config; + int err; + ++ if (!lif->phc || !lif->phc->ptp) ++ return -EOPNOTSUPP; ++ + if (copy_from_user(&config, ifr->ifr_data, sizeof(config))) + return -EFAULT; + +@@ -203,15 +206,16 @@ int ionic_lif_hwstamp_set(struct ionic_lif *lif, struct ifreq *ifr) + return 0; + } + +-int ionic_lif_hwstamp_replay(struct ionic_lif *lif) ++void ionic_lif_hwstamp_replay(struct ionic_lif *lif) + { + int err; + ++ if (!lif->phc || !lif->phc->ptp) ++ return; ++ + err = ionic_lif_hwstamp_set_ts_config(lif, NULL); + if (err) + netdev_info(lif->netdev, "hwstamp replay failed: %d\n", err); +- +- return err; + } + + int ionic_lif_hwstamp_get(struct ionic_lif *lif, struct ifreq *ifr) +-- +2.30.2 + diff --git a/queue-5.13/ionic-count-csum_none-when-offload-enabled.patch b/queue-5.13/ionic-count-csum_none-when-offload-enabled.patch new file mode 100644 index 00000000000..5b53a976b48 --- /dev/null +++ b/queue-5.13/ionic-count-csum_none-when-offload-enabled.patch @@ -0,0 +1,45 @@ +From 8cc0938a2254faa499d0fc7ad74f330a801073bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jul 2021 11:02:49 -0700 +Subject: ionic: count csum_none when offload enabled + +From: Shannon Nelson + +[ Upstream commit f07f9815b7046e25cc32bf8542c9c0bbc5eb6e0e ] + +Be sure to count the csum_none cases when csum offload is +enabled. + +Fixes: 0f3154e6bcb3 ("ionic: Add Tx and Rx handling") +Signed-off-by: Shannon Nelson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +index 1c6e2b9fc96b..08870190e4d2 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +@@ -274,12 +274,11 @@ static void ionic_rx_clean(struct ionic_queue *q, + } + } + +- if (likely(netdev->features & NETIF_F_RXCSUM)) { +- if (comp->csum_flags & IONIC_RXQ_COMP_CSUM_F_CALC) { +- skb->ip_summed = CHECKSUM_COMPLETE; +- skb->csum = (__force __wsum)le16_to_cpu(comp->csum); +- stats->csum_complete++; +- } ++ if (likely(netdev->features & NETIF_F_RXCSUM) && ++ (comp->csum_flags & IONIC_RXQ_COMP_CSUM_F_CALC)) { ++ skb->ip_summed = CHECKSUM_COMPLETE; ++ skb->csum = (__force __wsum)le16_to_cpu(comp->csum); ++ stats->csum_complete++; + } else { + stats->csum_none++; + } +-- +2.30.2 + diff --git a/queue-5.13/ionic-fix-up-dim-accounting-for-tx-and-rx.patch b/queue-5.13/ionic-fix-up-dim-accounting-for-tx-and-rx.patch new file mode 100644 index 00000000000..1491e79ab03 --- /dev/null +++ b/queue-5.13/ionic-fix-up-dim-accounting-for-tx-and-rx.patch @@ -0,0 +1,96 @@ +From 15ac39d7de6136ccf9d3512783ccfad2803af041 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jul 2021 11:02:48 -0700 +Subject: ionic: fix up dim accounting for tx and rx + +From: Shannon Nelson + +[ Upstream commit 76ed8a4a00b484dcccef819ef2618bcf8e46f560 ] + +We need to count the correct Tx and/or Rx packets for dynamic +interrupt moderation, depending on which we're processing on +the queue interrupt. + +Fixes: 04a834592bf5 ("ionic: dynamic interrupt moderation") +Signed-off-by: Shannon Nelson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/pensando/ionic/ionic_txrx.c | 28 ++++++++++++++----- + 1 file changed, 21 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +index 9d3a04110685..1c6e2b9fc96b 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +@@ -451,11 +451,12 @@ void ionic_rx_empty(struct ionic_queue *q) + q->tail_idx = 0; + } + +-static void ionic_dim_update(struct ionic_qcq *qcq) ++static void ionic_dim_update(struct ionic_qcq *qcq, int napi_mode) + { + struct dim_sample dim_sample; + struct ionic_lif *lif; + unsigned int qi; ++ u64 pkts, bytes; + + if (!qcq->intr.dim_coal_hw) + return; +@@ -463,10 +464,23 @@ static void ionic_dim_update(struct ionic_qcq *qcq) + lif = qcq->q.lif; + qi = qcq->cq.bound_q->index; + ++ switch (napi_mode) { ++ case IONIC_LIF_F_TX_DIM_INTR: ++ pkts = lif->txqstats[qi].pkts; ++ bytes = lif->txqstats[qi].bytes; ++ break; ++ case IONIC_LIF_F_RX_DIM_INTR: ++ pkts = lif->rxqstats[qi].pkts; ++ bytes = lif->rxqstats[qi].bytes; ++ break; ++ default: ++ pkts = lif->txqstats[qi].pkts + lif->rxqstats[qi].pkts; ++ bytes = lif->txqstats[qi].bytes + lif->rxqstats[qi].bytes; ++ break; ++ } ++ + dim_update_sample(qcq->cq.bound_intr->rearm_count, +- lif->txqstats[qi].pkts, +- lif->txqstats[qi].bytes, +- &dim_sample); ++ pkts, bytes, &dim_sample); + + net_dim(&qcq->dim, dim_sample); + } +@@ -487,7 +501,7 @@ int ionic_tx_napi(struct napi_struct *napi, int budget) + ionic_tx_service, NULL, NULL); + + if (work_done < budget && napi_complete_done(napi, work_done)) { +- ionic_dim_update(qcq); ++ ionic_dim_update(qcq, IONIC_LIF_F_TX_DIM_INTR); + flags |= IONIC_INTR_CRED_UNMASK; + cq->bound_intr->rearm_count++; + } +@@ -526,7 +540,7 @@ int ionic_rx_napi(struct napi_struct *napi, int budget) + ionic_rx_fill(cq->bound_q); + + if (work_done < budget && napi_complete_done(napi, work_done)) { +- ionic_dim_update(qcq); ++ ionic_dim_update(qcq, IONIC_LIF_F_RX_DIM_INTR); + flags |= IONIC_INTR_CRED_UNMASK; + cq->bound_intr->rearm_count++; + } +@@ -572,7 +586,7 @@ int ionic_txrx_napi(struct napi_struct *napi, int budget) + ionic_rx_fill(rxcq->bound_q); + + if (rx_work_done < budget && napi_complete_done(napi, rx_work_done)) { +- ionic_dim_update(qcq); ++ ionic_dim_update(qcq, 0); + flags |= IONIC_INTR_CRED_UNMASK; + rxcq->bound_intr->rearm_count++; + } +-- +2.30.2 + diff --git a/queue-5.13/ionic-make-all-rx_mode-work-threadsafe.patch b/queue-5.13/ionic-make-all-rx_mode-work-threadsafe.patch new file mode 100644 index 00000000000..0ba4de5428e --- /dev/null +++ b/queue-5.13/ionic-make-all-rx_mode-work-threadsafe.patch @@ -0,0 +1,352 @@ +From d7d158582d3155a516255efbea11a56d5fda8fff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jul 2021 11:02:45 -0700 +Subject: ionic: make all rx_mode work threadsafe + +From: Shannon Nelson + +[ Upstream commit 6840e17b8ea992453e2d6f460d403cb05d194e76 ] + +Move the bulk of the code from ionic_set_rx_mode(), which +can be called from atomic context, into ionic_lif_rx_mode() +which is a safe context. + +A call from the stack will get pushed off into a work thread, +but it is also possible to simultaneously have a call driven +by a queue reconfig request from an ethtool command or fw +recovery event. We add a mutex around the rx_mode work to be +sure they don't collide. + +Fixes: 81dbc24147f9 ("ionic: change set_rx_mode from_ndo to can_sleep") +Signed-off-by: Shannon Nelson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/pensando/ionic/ionic_lif.c | 183 ++++++++---------- + .../net/ethernet/pensando/ionic/ionic_lif.h | 4 +- + 2 files changed, 85 insertions(+), 102 deletions(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +index af3a5368529c..7815e9034fb8 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +@@ -29,7 +29,7 @@ static const u8 ionic_qtype_versions[IONIC_QTYPE_MAX] = { + */ + }; + +-static void ionic_lif_rx_mode(struct ionic_lif *lif, unsigned int rx_mode); ++static void ionic_lif_rx_mode(struct ionic_lif *lif); + static int ionic_lif_addr_add(struct ionic_lif *lif, const u8 *addr); + static int ionic_lif_addr_del(struct ionic_lif *lif, const u8 *addr); + static void ionic_link_status_check(struct ionic_lif *lif); +@@ -77,7 +77,7 @@ static void ionic_lif_deferred_work(struct work_struct *work) + + switch (w->type) { + case IONIC_DW_TYPE_RX_MODE: +- ionic_lif_rx_mode(lif, w->rx_mode); ++ ionic_lif_rx_mode(lif); + break; + case IONIC_DW_TYPE_RX_ADDR_ADD: + ionic_lif_addr_add(lif, w->addr); +@@ -1301,10 +1301,8 @@ static int ionic_lif_addr_del(struct ionic_lif *lif, const u8 *addr) + return 0; + } + +-static int ionic_lif_addr(struct ionic_lif *lif, const u8 *addr, bool add, +- bool can_sleep) ++static int ionic_lif_addr(struct ionic_lif *lif, const u8 *addr, bool add) + { +- struct ionic_deferred_work *work; + unsigned int nmfilters; + unsigned int nufilters; + +@@ -1330,97 +1328,46 @@ static int ionic_lif_addr(struct ionic_lif *lif, const u8 *addr, bool add, + lif->nucast--; + } + +- if (!can_sleep) { +- work = kzalloc(sizeof(*work), GFP_ATOMIC); +- if (!work) +- return -ENOMEM; +- work->type = add ? IONIC_DW_TYPE_RX_ADDR_ADD : +- IONIC_DW_TYPE_RX_ADDR_DEL; +- memcpy(work->addr, addr, ETH_ALEN); +- netdev_dbg(lif->netdev, "deferred: rx_filter %s %pM\n", +- add ? "add" : "del", addr); +- ionic_lif_deferred_enqueue(&lif->deferred, work); +- } else { +- netdev_dbg(lif->netdev, "rx_filter %s %pM\n", +- add ? "add" : "del", addr); +- if (add) +- return ionic_lif_addr_add(lif, addr); +- else +- return ionic_lif_addr_del(lif, addr); +- } ++ netdev_dbg(lif->netdev, "rx_filter %s %pM\n", ++ add ? "add" : "del", addr); ++ if (add) ++ return ionic_lif_addr_add(lif, addr); ++ else ++ return ionic_lif_addr_del(lif, addr); + + return 0; + } + + static int ionic_addr_add(struct net_device *netdev, const u8 *addr) + { +- return ionic_lif_addr(netdev_priv(netdev), addr, ADD_ADDR, CAN_SLEEP); +-} +- +-static int ionic_ndo_addr_add(struct net_device *netdev, const u8 *addr) +-{ +- return ionic_lif_addr(netdev_priv(netdev), addr, ADD_ADDR, CAN_NOT_SLEEP); ++ return ionic_lif_addr(netdev_priv(netdev), addr, ADD_ADDR); + } + + static int ionic_addr_del(struct net_device *netdev, const u8 *addr) + { +- return ionic_lif_addr(netdev_priv(netdev), addr, DEL_ADDR, CAN_SLEEP); ++ return ionic_lif_addr(netdev_priv(netdev), addr, DEL_ADDR); + } + +-static int ionic_ndo_addr_del(struct net_device *netdev, const u8 *addr) ++static void ionic_lif_rx_mode(struct ionic_lif *lif) + { +- return ionic_lif_addr(netdev_priv(netdev), addr, DEL_ADDR, CAN_NOT_SLEEP); +-} +- +-static void ionic_lif_rx_mode(struct ionic_lif *lif, unsigned int rx_mode) +-{ +- struct ionic_admin_ctx ctx = { +- .work = COMPLETION_INITIALIZER_ONSTACK(ctx.work), +- .cmd.rx_mode_set = { +- .opcode = IONIC_CMD_RX_MODE_SET, +- .lif_index = cpu_to_le16(lif->index), +- .rx_mode = cpu_to_le16(rx_mode), +- }, +- }; ++ struct net_device *netdev = lif->netdev; ++ unsigned int nfilters; ++ unsigned int nd_flags; + char buf[128]; +- int err; ++ u16 rx_mode; + int i; + #define REMAIN(__x) (sizeof(buf) - (__x)) + +- i = scnprintf(buf, sizeof(buf), "rx_mode 0x%04x -> 0x%04x:", +- lif->rx_mode, rx_mode); +- if (rx_mode & IONIC_RX_MODE_F_UNICAST) +- i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_UNICAST"); +- if (rx_mode & IONIC_RX_MODE_F_MULTICAST) +- i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_MULTICAST"); +- if (rx_mode & IONIC_RX_MODE_F_BROADCAST) +- i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_BROADCAST"); +- if (rx_mode & IONIC_RX_MODE_F_PROMISC) +- i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_PROMISC"); +- if (rx_mode & IONIC_RX_MODE_F_ALLMULTI) +- i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_ALLMULTI"); +- netdev_dbg(lif->netdev, "lif%d %s\n", lif->index, buf); +- +- err = ionic_adminq_post_wait(lif, &ctx); +- if (err) +- netdev_warn(lif->netdev, "set rx_mode 0x%04x failed: %d\n", +- rx_mode, err); +- else +- lif->rx_mode = rx_mode; +-} ++ mutex_lock(&lif->config_lock); + +-static void ionic_set_rx_mode(struct net_device *netdev, bool can_sleep) +-{ +- struct ionic_lif *lif = netdev_priv(netdev); +- struct ionic_deferred_work *work; +- unsigned int nfilters; +- unsigned int rx_mode; ++ /* grab the flags once for local use */ ++ nd_flags = netdev->flags; + + rx_mode = IONIC_RX_MODE_F_UNICAST; +- rx_mode |= (netdev->flags & IFF_MULTICAST) ? IONIC_RX_MODE_F_MULTICAST : 0; +- rx_mode |= (netdev->flags & IFF_BROADCAST) ? IONIC_RX_MODE_F_BROADCAST : 0; +- rx_mode |= (netdev->flags & IFF_PROMISC) ? IONIC_RX_MODE_F_PROMISC : 0; +- rx_mode |= (netdev->flags & IFF_ALLMULTI) ? IONIC_RX_MODE_F_ALLMULTI : 0; ++ rx_mode |= (nd_flags & IFF_MULTICAST) ? IONIC_RX_MODE_F_MULTICAST : 0; ++ rx_mode |= (nd_flags & IFF_BROADCAST) ? IONIC_RX_MODE_F_BROADCAST : 0; ++ rx_mode |= (nd_flags & IFF_PROMISC) ? IONIC_RX_MODE_F_PROMISC : 0; ++ rx_mode |= (nd_flags & IFF_ALLMULTI) ? IONIC_RX_MODE_F_ALLMULTI : 0; + + /* sync unicast addresses + * next check to see if we're in an overflow state +@@ -1429,49 +1376,83 @@ static void ionic_set_rx_mode(struct net_device *netdev, bool can_sleep) + * we remove our overflow flag and check the netdev flags + * to see if we can disable NIC PROMISC + */ +- if (can_sleep) +- __dev_uc_sync(netdev, ionic_addr_add, ionic_addr_del); +- else +- __dev_uc_sync(netdev, ionic_ndo_addr_add, ionic_ndo_addr_del); ++ __dev_uc_sync(netdev, ionic_addr_add, ionic_addr_del); + nfilters = le32_to_cpu(lif->identity->eth.max_ucast_filters); + if (netdev_uc_count(netdev) + 1 > nfilters) { + rx_mode |= IONIC_RX_MODE_F_PROMISC; + lif->uc_overflow = true; + } else if (lif->uc_overflow) { + lif->uc_overflow = false; +- if (!(netdev->flags & IFF_PROMISC)) ++ if (!(nd_flags & IFF_PROMISC)) + rx_mode &= ~IONIC_RX_MODE_F_PROMISC; + } + + /* same for multicast */ +- if (can_sleep) +- __dev_mc_sync(netdev, ionic_addr_add, ionic_addr_del); +- else +- __dev_mc_sync(netdev, ionic_ndo_addr_add, ionic_ndo_addr_del); ++ __dev_mc_sync(netdev, ionic_addr_add, ionic_addr_del); + nfilters = le32_to_cpu(lif->identity->eth.max_mcast_filters); + if (netdev_mc_count(netdev) > nfilters) { + rx_mode |= IONIC_RX_MODE_F_ALLMULTI; + lif->mc_overflow = true; + } else if (lif->mc_overflow) { + lif->mc_overflow = false; +- if (!(netdev->flags & IFF_ALLMULTI)) ++ if (!(nd_flags & IFF_ALLMULTI)) + rx_mode &= ~IONIC_RX_MODE_F_ALLMULTI; + } + ++ i = scnprintf(buf, sizeof(buf), "rx_mode 0x%04x -> 0x%04x:", ++ lif->rx_mode, rx_mode); ++ if (rx_mode & IONIC_RX_MODE_F_UNICAST) ++ i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_UNICAST"); ++ if (rx_mode & IONIC_RX_MODE_F_MULTICAST) ++ i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_MULTICAST"); ++ if (rx_mode & IONIC_RX_MODE_F_BROADCAST) ++ i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_BROADCAST"); ++ if (rx_mode & IONIC_RX_MODE_F_PROMISC) ++ i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_PROMISC"); ++ if (rx_mode & IONIC_RX_MODE_F_ALLMULTI) ++ i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_ALLMULTI"); ++ if (rx_mode & IONIC_RX_MODE_F_RDMA_SNIFFER) ++ i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_RDMA_SNIFFER"); ++ netdev_dbg(netdev, "lif%d %s\n", lif->index, buf); ++ + if (lif->rx_mode != rx_mode) { +- if (!can_sleep) { +- work = kzalloc(sizeof(*work), GFP_ATOMIC); +- if (!work) { +- netdev_err(lif->netdev, "rxmode change dropped\n"); +- return; +- } +- work->type = IONIC_DW_TYPE_RX_MODE; +- work->rx_mode = rx_mode; +- netdev_dbg(lif->netdev, "deferred: rx_mode\n"); +- ionic_lif_deferred_enqueue(&lif->deferred, work); +- } else { +- ionic_lif_rx_mode(lif, rx_mode); ++ struct ionic_admin_ctx ctx = { ++ .work = COMPLETION_INITIALIZER_ONSTACK(ctx.work), ++ .cmd.rx_mode_set = { ++ .opcode = IONIC_CMD_RX_MODE_SET, ++ .lif_index = cpu_to_le16(lif->index), ++ }, ++ }; ++ int err; ++ ++ ctx.cmd.rx_mode_set.rx_mode = cpu_to_le16(rx_mode); ++ err = ionic_adminq_post_wait(lif, &ctx); ++ if (err) ++ netdev_warn(netdev, "set rx_mode 0x%04x failed: %d\n", ++ rx_mode, err); ++ else ++ lif->rx_mode = rx_mode; ++ } ++ ++ mutex_unlock(&lif->config_lock); ++} ++ ++static void ionic_set_rx_mode(struct net_device *netdev, bool can_sleep) ++{ ++ struct ionic_lif *lif = netdev_priv(netdev); ++ struct ionic_deferred_work *work; ++ ++ if (!can_sleep) { ++ work = kzalloc(sizeof(*work), GFP_ATOMIC); ++ if (!work) { ++ netdev_err(lif->netdev, "rxmode change dropped\n"); ++ return; + } ++ work->type = IONIC_DW_TYPE_RX_MODE; ++ netdev_dbg(lif->netdev, "deferred: rx_mode\n"); ++ ionic_lif_deferred_enqueue(&lif->deferred, work); ++ } else { ++ ionic_lif_rx_mode(lif); + } + } + +@@ -3058,6 +3039,7 @@ void ionic_lif_deinit(struct ionic_lif *lif) + ionic_lif_qcq_deinit(lif, lif->notifyqcq); + ionic_lif_qcq_deinit(lif, lif->adminqcq); + ++ mutex_destroy(&lif->config_lock); + mutex_destroy(&lif->queue_lock); + ionic_lif_reset(lif); + } +@@ -3185,7 +3167,7 @@ static int ionic_station_set(struct ionic_lif *lif) + */ + if (!ether_addr_equal(ctx.comp.lif_getattr.mac, + netdev->dev_addr)) +- ionic_lif_addr(lif, netdev->dev_addr, ADD_ADDR, CAN_SLEEP); ++ ionic_lif_addr(lif, netdev->dev_addr, ADD_ADDR); + } else { + /* Update the netdev mac with the device's mac */ + memcpy(addr.sa_data, ctx.comp.lif_getattr.mac, netdev->addr_len); +@@ -3202,7 +3184,7 @@ static int ionic_station_set(struct ionic_lif *lif) + + netdev_dbg(lif->netdev, "adding station MAC addr %pM\n", + netdev->dev_addr); +- ionic_lif_addr(lif, netdev->dev_addr, ADD_ADDR, CAN_SLEEP); ++ ionic_lif_addr(lif, netdev->dev_addr, ADD_ADDR); + + return 0; + } +@@ -3225,6 +3207,7 @@ int ionic_lif_init(struct ionic_lif *lif) + + lif->hw_index = le16_to_cpu(comp.hw_index); + mutex_init(&lif->queue_lock); ++ mutex_init(&lif->config_lock); + + /* now that we have the hw_index we can figure out our doorbell page */ + lif->dbid_count = le32_to_cpu(lif->ionic->ident.dev.ndbpgs_per_lif); +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.h b/drivers/net/ethernet/pensando/ionic/ionic_lif.h +index 346506f01715..af291303bd7a 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.h ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.h +@@ -108,7 +108,6 @@ struct ionic_deferred_work { + struct list_head list; + enum ionic_deferred_work_type type; + union { +- unsigned int rx_mode; + u8 addr[ETH_ALEN]; + u8 fw_status; + }; +@@ -179,6 +178,7 @@ struct ionic_lif { + unsigned int index; + unsigned int hw_index; + struct mutex queue_lock; /* lock for queue structures */ ++ struct mutex config_lock; /* lock for config actions */ + spinlock_t adminq_lock; /* lock for AdminQ operations */ + struct ionic_qcq *adminqcq; + struct ionic_qcq *notifyqcq; +@@ -199,7 +199,7 @@ struct ionic_lif { + unsigned int nrxq_descs; + u32 rx_copybreak; + u64 rxq_features; +- unsigned int rx_mode; ++ u16 rx_mode; + u64 hw_features; + bool registered; + bool mc_overflow; +-- +2.30.2 + diff --git a/queue-5.13/ionic-remove-intr-coalesce-update-from-napi.patch b/queue-5.13/ionic-remove-intr-coalesce-update-from-napi.patch new file mode 100644 index 00000000000..dc0fc36b17f --- /dev/null +++ b/queue-5.13/ionic-remove-intr-coalesce-update-from-napi.patch @@ -0,0 +1,65 @@ +From e52d69cf8302984bec1c8a731acfefe6953b3255 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jul 2021 11:02:47 -0700 +Subject: ionic: remove intr coalesce update from napi + +From: Shannon Nelson + +[ Upstream commit a6ff85e0a2d9d074a4b4c291ba9ec1e5b0aba22b ] + +Move the interrupt coalesce value update out of the napi +thread and into the dim_work thread and set it only when it +has actually changed. + +Fixes: 04a834592bf5 ("ionic: dynamic interrupt moderation") +Signed-off-by: Shannon Nelson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 14 +++++++++++++- + drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 4 ---- + 2 files changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +index 7815e9034fb8..e795fa63ca12 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +@@ -53,7 +53,19 @@ static void ionic_dim_work(struct work_struct *work) + cur_moder = net_dim_get_rx_moderation(dim->mode, dim->profile_ix); + qcq = container_of(dim, struct ionic_qcq, dim); + new_coal = ionic_coal_usec_to_hw(qcq->q.lif->ionic, cur_moder.usec); +- qcq->intr.dim_coal_hw = new_coal ? new_coal : 1; ++ new_coal = new_coal ? new_coal : 1; ++ ++ if (qcq->intr.dim_coal_hw != new_coal) { ++ unsigned int qi = qcq->cq.bound_q->index; ++ struct ionic_lif *lif = qcq->q.lif; ++ ++ qcq->intr.dim_coal_hw = new_coal; ++ ++ ionic_intr_coal_init(lif->ionic->idev.intr_ctrl, ++ lif->rxqcqs[qi]->intr.index, ++ qcq->intr.dim_coal_hw); ++ } ++ + dim->state = DIM_START_MEASURE; + } + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +index 08934888575c..9d3a04110685 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +@@ -463,10 +463,6 @@ static void ionic_dim_update(struct ionic_qcq *qcq) + lif = qcq->q.lif; + qi = qcq->cq.bound_q->index; + +- ionic_intr_coal_init(lif->ionic->idev.intr_ctrl, +- lif->rxqcqs[qi]->intr.index, +- qcq->intr.dim_coal_hw); +- + dim_update_sample(qcq->cq.bound_intr->rearm_count, + lif->txqstats[qi].pkts, + lif->txqstats[qi].bytes, +-- +2.30.2 + diff --git a/queue-5.13/kvm-selftests-fix-missing-break-in-dirty_log_perf_te.patch b/queue-5.13/kvm-selftests-fix-missing-break-in-dirty_log_perf_te.patch new file mode 100644 index 00000000000..a35562cfe0f --- /dev/null +++ b/queue-5.13/kvm-selftests-fix-missing-break-in-dirty_log_perf_te.patch @@ -0,0 +1,38 @@ +From bc9f8e9ac210584710bfadcfd415150a5c00e022 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jul 2021 22:09:56 +0000 +Subject: KVM: selftests: Fix missing break in dirty_log_perf_test arg parsing + +From: David Matlack + +[ Upstream commit 15b7b737deb30e1f8f116a08e723173b55ebd2f3 ] + +There is a missing break statement which causes a fallthrough to the +next statement where optarg will be null and a segmentation fault will +be generated. + +Fixes: 9e965bb75aae ("KVM: selftests: Add backing src parameter to dirty_log_perf_test") +Reviewed-by: Ben Gardon +Signed-off-by: David Matlack +Message-Id: <20210713220957.3493520-6-dmatlack@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kvm/dirty_log_perf_test.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/kvm/dirty_log_perf_test.c b/tools/testing/selftests/kvm/dirty_log_perf_test.c +index 04a2641261be..80cbd3a748c0 100644 +--- a/tools/testing/selftests/kvm/dirty_log_perf_test.c ++++ b/tools/testing/selftests/kvm/dirty_log_perf_test.c +@@ -312,6 +312,7 @@ int main(int argc, char *argv[]) + break; + case 'o': + p.partition_vcpu_memory_access = false; ++ break; + case 's': + p.backing_src = parse_backing_src_type(optarg); + break; +-- +2.30.2 + diff --git a/queue-5.13/kvm-x86-check-the-right-feature-bit-for-msr_kvm_asyn.patch b/queue-5.13/kvm-x86-check-the-right-feature-bit-for-msr_kvm_asyn.patch new file mode 100644 index 00000000000..95c9ed8cf7e --- /dev/null +++ b/queue-5.13/kvm-x86-check-the-right-feature-bit-for-msr_kvm_asyn.patch @@ -0,0 +1,49 @@ +From d3070ba46927dc5bf476ea620153e70106dff9a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jul 2021 14:30:18 +0200 +Subject: KVM: x86: Check the right feature bit for MSR_KVM_ASYNC_PF_ACK access + +From: Vitaly Kuznetsov + +[ Upstream commit 0a31df6823232516f61f174907e444f710941dfe ] + +MSR_KVM_ASYNC_PF_ACK MSR is part of interrupt based asynchronous page fault +interface and not the original (deprecated) KVM_FEATURE_ASYNC_PF. This is +stated in Documentation/virt/kvm/msr.rst. + +Fixes: 66570e966dd9 ("kvm: x86: only provide PV features if enabled in guest's CPUID") +Signed-off-by: Vitaly Kuznetsov +Reviewed-by: Maxim Levitsky +Reviewed-by: Oliver Upton +Message-Id: <20210722123018.260035-1-vkuznets@redhat.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/x86.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index b5a3de788b5f..d6a9f0518784 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -3314,7 +3314,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + return 1; + break; + case MSR_KVM_ASYNC_PF_ACK: +- if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF)) ++ if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF_INT)) + return 1; + if (data & 0x1) { + vcpu->arch.apf.pageready_pending = false; +@@ -3646,7 +3646,7 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + msr_info->data = vcpu->arch.apf.msr_int_val; + break; + case MSR_KVM_ASYNC_PF_ACK: +- if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF)) ++ if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF_INT)) + return 1; + + msr_info->data = 0; +-- +2.30.2 + diff --git a/queue-5.13/loop-reintroduce-global-lock-for-safe-loop_validate_.patch b/queue-5.13/loop-reintroduce-global-lock-for-safe-loop_validate_.patch new file mode 100644 index 00000000000..ea7378bffcd --- /dev/null +++ b/queue-5.13/loop-reintroduce-global-lock-for-safe-loop_validate_.patch @@ -0,0 +1,264 @@ +From 64d638da22c887cd929ca0aa651c6412f7ae8edc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jul 2021 23:40:34 +0900 +Subject: loop: reintroduce global lock for safe loop_validate_file() traversal + +From: Tetsuo Handa + +[ Upstream commit 3ce6e1f662a910970880188ea7bfd00542bd3934 ] + +Commit 6cc8e7430801fa23 ("loop: scale loop device by introducing per +device lock") re-opened a race window for NULL pointer dereference at +loop_validate_file() where commit 310ca162d779efee ("block/loop: Use +global lock for ioctl() operation.") has closed. + +Although we need to guarantee that other loop devices will not change +during traversal, we can't take remote "struct loop_device"->lo_mutex +inside loop_validate_file() in order to avoid AB-BA deadlock. Therefore, +introduce a global lock dedicated for loop_validate_file() which is +conditionally taken before local "struct loop_device"->lo_mutex is taken. + +Signed-off-by: Tetsuo Handa +Fixes: 6cc8e7430801fa23 ("loop: scale loop device by introducing per device lock") +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/loop.c | 128 ++++++++++++++++++++++++++++++++----------- + 1 file changed, 97 insertions(+), 31 deletions(-) + +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 8271df125153..e81298b91227 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -86,6 +86,47 @@ + + static DEFINE_IDR(loop_index_idr); + static DEFINE_MUTEX(loop_ctl_mutex); ++static DEFINE_MUTEX(loop_validate_mutex); ++ ++/** ++ * loop_global_lock_killable() - take locks for safe loop_validate_file() test ++ * ++ * @lo: struct loop_device ++ * @global: true if @lo is about to bind another "struct loop_device", false otherwise ++ * ++ * Returns 0 on success, -EINTR otherwise. ++ * ++ * Since loop_validate_file() traverses on other "struct loop_device" if ++ * is_loop_device() is true, we need a global lock for serializing concurrent ++ * loop_configure()/loop_change_fd()/__loop_clr_fd() calls. ++ */ ++static int loop_global_lock_killable(struct loop_device *lo, bool global) ++{ ++ int err; ++ ++ if (global) { ++ err = mutex_lock_killable(&loop_validate_mutex); ++ if (err) ++ return err; ++ } ++ err = mutex_lock_killable(&lo->lo_mutex); ++ if (err && global) ++ mutex_unlock(&loop_validate_mutex); ++ return err; ++} ++ ++/** ++ * loop_global_unlock() - release locks taken by loop_global_lock_killable() ++ * ++ * @lo: struct loop_device ++ * @global: true if @lo was about to bind another "struct loop_device", false otherwise ++ */ ++static void loop_global_unlock(struct loop_device *lo, bool global) ++{ ++ mutex_unlock(&lo->lo_mutex); ++ if (global) ++ mutex_unlock(&loop_validate_mutex); ++} + + static int max_part; + static int part_shift; +@@ -676,13 +717,15 @@ static int loop_validate_file(struct file *file, struct block_device *bdev) + while (is_loop_device(f)) { + struct loop_device *l; + ++ lockdep_assert_held(&loop_validate_mutex); + if (f->f_mapping->host->i_rdev == bdev->bd_dev) + return -EBADF; + + l = I_BDEV(f->f_mapping->host)->bd_disk->private_data; +- if (l->lo_state != Lo_bound) { ++ if (l->lo_state != Lo_bound) + return -EINVAL; +- } ++ /* Order wrt setting lo->lo_backing_file in loop_configure(). */ ++ rmb(); + f = l->lo_backing_file; + } + if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode)) +@@ -701,13 +744,18 @@ static int loop_validate_file(struct file *file, struct block_device *bdev) + static int loop_change_fd(struct loop_device *lo, struct block_device *bdev, + unsigned int arg) + { +- struct file *file = NULL, *old_file; +- int error; +- bool partscan; ++ struct file *file = fget(arg); ++ struct file *old_file; ++ int error; ++ bool partscan; ++ bool is_loop; + +- error = mutex_lock_killable(&lo->lo_mutex); ++ if (!file) ++ return -EBADF; ++ is_loop = is_loop_device(file); ++ error = loop_global_lock_killable(lo, is_loop); + if (error) +- return error; ++ goto out_putf; + error = -ENXIO; + if (lo->lo_state != Lo_bound) + goto out_err; +@@ -717,11 +765,6 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev, + if (!(lo->lo_flags & LO_FLAGS_READ_ONLY)) + goto out_err; + +- error = -EBADF; +- file = fget(arg); +- if (!file) +- goto out_err; +- + error = loop_validate_file(file, bdev); + if (error) + goto out_err; +@@ -744,7 +787,16 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev, + loop_update_dio(lo); + blk_mq_unfreeze_queue(lo->lo_queue); + partscan = lo->lo_flags & LO_FLAGS_PARTSCAN; +- mutex_unlock(&lo->lo_mutex); ++ loop_global_unlock(lo, is_loop); ++ ++ /* ++ * Flush loop_validate_file() before fput(), for l->lo_backing_file ++ * might be pointing at old_file which might be the last reference. ++ */ ++ if (!is_loop) { ++ mutex_lock(&loop_validate_mutex); ++ mutex_unlock(&loop_validate_mutex); ++ } + /* + * We must drop file reference outside of lo_mutex as dropping + * the file ref can take bd_mutex which creates circular locking +@@ -756,9 +808,9 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev, + return 0; + + out_err: +- mutex_unlock(&lo->lo_mutex); +- if (file) +- fput(file); ++ loop_global_unlock(lo, is_loop); ++out_putf: ++ fput(file); + return error; + } + +@@ -1067,22 +1119,22 @@ static int loop_configure(struct loop_device *lo, fmode_t mode, + struct block_device *bdev, + const struct loop_config *config) + { +- struct file *file; +- struct inode *inode; ++ struct file *file = fget(config->fd); ++ struct inode *inode; + struct address_space *mapping; +- int error; +- loff_t size; +- bool partscan; +- unsigned short bsize; ++ int error; ++ loff_t size; ++ bool partscan; ++ unsigned short bsize; ++ bool is_loop; ++ ++ if (!file) ++ return -EBADF; ++ is_loop = is_loop_device(file); + + /* This is safe, since we have a reference from open(). */ + __module_get(THIS_MODULE); + +- error = -EBADF; +- file = fget(config->fd); +- if (!file) +- goto out; +- + /* + * If we don't hold exclusive handle for the device, upgrade to it + * here to avoid changing device under exclusive owner. +@@ -1093,7 +1145,7 @@ static int loop_configure(struct loop_device *lo, fmode_t mode, + goto out_putf; + } + +- error = mutex_lock_killable(&lo->lo_mutex); ++ error = loop_global_lock_killable(lo, is_loop); + if (error) + goto out_bdev; + +@@ -1162,6 +1214,9 @@ static int loop_configure(struct loop_device *lo, fmode_t mode, + size = get_loop_size(lo, file); + loop_set_size(lo, size); + ++ /* Order wrt reading lo_state in loop_validate_file(). */ ++ wmb(); ++ + lo->lo_state = Lo_bound; + if (part_shift) + lo->lo_flags |= LO_FLAGS_PARTSCAN; +@@ -1173,7 +1228,7 @@ static int loop_configure(struct loop_device *lo, fmode_t mode, + * put /dev/loopXX inode. Later in __loop_clr_fd() we bdput(bdev). + */ + bdgrab(bdev); +- mutex_unlock(&lo->lo_mutex); ++ loop_global_unlock(lo, is_loop); + if (partscan) + loop_reread_partitions(lo, bdev); + if (!(mode & FMODE_EXCL)) +@@ -1181,13 +1236,12 @@ static int loop_configure(struct loop_device *lo, fmode_t mode, + return 0; + + out_unlock: +- mutex_unlock(&lo->lo_mutex); ++ loop_global_unlock(lo, is_loop); + out_bdev: + if (!(mode & FMODE_EXCL)) + bd_abort_claiming(bdev, loop_configure); + out_putf: + fput(file); +-out: + /* This is safe: open() is still holding a reference. */ + module_put(THIS_MODULE); + return error; +@@ -1202,6 +1256,18 @@ static int __loop_clr_fd(struct loop_device *lo, bool release) + bool partscan = false; + int lo_number; + ++ /* ++ * Flush loop_configure() and loop_change_fd(). It is acceptable for ++ * loop_validate_file() to succeed, for actual clear operation has not ++ * started yet. ++ */ ++ mutex_lock(&loop_validate_mutex); ++ mutex_unlock(&loop_validate_mutex); ++ /* ++ * loop_validate_file() now fails because l->lo_state != Lo_bound ++ * became visible. ++ */ ++ + mutex_lock(&lo->lo_mutex); + if (WARN_ON_ONCE(lo->lo_state != Lo_rundown)) { + err = -ENXIO; +-- +2.30.2 + diff --git a/queue-5.13/mac80211-fix-enabling-4-address-mode-on-a-sta-vif-af.patch b/queue-5.13/mac80211-fix-enabling-4-address-mode-on-a-sta-vif-af.patch new file mode 100644 index 00000000000..a67547980b7 --- /dev/null +++ b/queue-5.13/mac80211-fix-enabling-4-address-mode-on-a-sta-vif-af.patch @@ -0,0 +1,92 @@ +From b06b38f1ea0e2bc1e1fb672827ae24a840aebd0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jul 2021 07:01:11 +0200 +Subject: mac80211: fix enabling 4-address mode on a sta vif after assoc + +From: Felix Fietkau + +[ Upstream commit a5d3cbdb09ff1f52cbe040932e06c8b9915c6dad ] + +Notify the driver about the 4-address mode change and also send a nulldata +packet to the AP to notify it about the change + +Fixes: 1ff4e8f2dec8 ("mac80211: notify the driver when a sta uses 4-address mode") +Signed-off-by: Felix Fietkau +Link: https://lore.kernel.org/r/20210702050111.47546-1-nbd@nbd.name +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/cfg.c | 19 +++++++++++++++++++ + net/mac80211/ieee80211_i.h | 2 ++ + net/mac80211/mlme.c | 4 ++-- + 3 files changed, 23 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 7a99892e5aba..9f1443459852 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -152,6 +152,8 @@ static int ieee80211_change_iface(struct wiphy *wiphy, + struct vif_params *params) + { + struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); ++ struct ieee80211_local *local = sdata->local; ++ struct sta_info *sta; + int ret; + + ret = ieee80211_if_change_type(sdata, type); +@@ -162,7 +164,24 @@ static int ieee80211_change_iface(struct wiphy *wiphy, + RCU_INIT_POINTER(sdata->u.vlan.sta, NULL); + ieee80211_check_fast_rx_iface(sdata); + } else if (type == NL80211_IFTYPE_STATION && params->use_4addr >= 0) { ++ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; ++ ++ if (params->use_4addr == ifmgd->use_4addr) ++ return 0; ++ + sdata->u.mgd.use_4addr = params->use_4addr; ++ if (!ifmgd->associated) ++ return 0; ++ ++ mutex_lock(&local->sta_mtx); ++ sta = sta_info_get(sdata, ifmgd->bssid); ++ if (sta) ++ drv_sta_set_4addr(local, sdata, &sta->sta, ++ params->use_4addr); ++ mutex_unlock(&local->sta_mtx); ++ ++ if (params->use_4addr) ++ ieee80211_send_4addr_nullfunc(local, sdata); + } + + if (sdata->vif.type == NL80211_IFTYPE_MONITOR) { +diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h +index 648696b49f89..1e1d2e72de4a 100644 +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -2045,6 +2045,8 @@ void ieee80211_dynamic_ps_timer(struct timer_list *t); + void ieee80211_send_nullfunc(struct ieee80211_local *local, + struct ieee80211_sub_if_data *sdata, + bool powersave); ++void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local, ++ struct ieee80211_sub_if_data *sdata); + void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata, + struct ieee80211_hdr *hdr, bool ack, u16 tx_time); + +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index b1c44fa63a06..9bed6464c5bd 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -1115,8 +1115,8 @@ void ieee80211_send_nullfunc(struct ieee80211_local *local, + ieee80211_tx_skb(sdata, skb); + } + +-static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local, +- struct ieee80211_sub_if_data *sdata) ++void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local, ++ struct ieee80211_sub_if_data *sdata) + { + struct sk_buff *skb; + struct ieee80211_hdr *nullfunc; +-- +2.30.2 + diff --git a/queue-5.13/mlx4-fix-missing-error-code-in-mlx4_load_one.patch b/queue-5.13/mlx4-fix-missing-error-code-in-mlx4_load_one.patch new file mode 100644 index 00000000000..a4c55c8404f --- /dev/null +++ b/queue-5.13/mlx4-fix-missing-error-code-in-mlx4_load_one.patch @@ -0,0 +1,42 @@ +From df288123e2debce17e266f291cf07134d8c357f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jul 2021 18:36:09 +0800 +Subject: mlx4: Fix missing error code in mlx4_load_one() + +From: Jiapeng Chong + +[ Upstream commit 7e4960b3d66d7248b23de3251118147812b42da2 ] + +The error code is missing in this code scenario, add the error code +'-EINVAL' to the return value 'err'. + +Eliminate the follow smatch warning: + +drivers/net/ethernet/mellanox/mlx4/main.c:3538 mlx4_load_one() warn: +missing error code 'err'. + +Reported-by: Abaci Robot +Fixes: 7ae0e400cd93 ("net/mlx4_core: Flexible (asymmetric) allocation of EQs and MSI-X vectors for PF/VFs") +Signed-off-by: Jiapeng Chong +Reviewed-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c +index 00c84656b2e7..28ac4693da3c 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/main.c ++++ b/drivers/net/ethernet/mellanox/mlx4/main.c +@@ -3535,6 +3535,7 @@ slave_start: + + if (!SRIOV_VALID_STATE(dev->flags)) { + mlx4_err(dev, "Invalid SRIOV state\n"); ++ err = -EINVAL; + goto err_close; + } + } +-- +2.30.2 + diff --git a/queue-5.13/net-dsa-mv88e6xxx-silently-accept-the-deletion-of-vi.patch b/queue-5.13/net-dsa-mv88e6xxx-silently-accept-the-deletion-of-vi.patch new file mode 100644 index 00000000000..89f35e2ca52 --- /dev/null +++ b/queue-5.13/net-dsa-mv88e6xxx-silently-accept-the-deletion-of-vi.patch @@ -0,0 +1,40 @@ +From 091898ed8648a9262b997d12d0d9f202a35e4af3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jul 2021 16:05:51 +0300 +Subject: net: dsa: mv88e6xxx: silently accept the deletion of VID 0 too + +From: Vladimir Oltean + +[ Upstream commit c92c74131a84b508aa8f079a25d7bbe10748449e ] + +The blamed commit modified the driver to accept the addition of VID 0 +without doing anything, but deleting that VID still fails: + +[ 32.080780] mv88e6085 d0032004.mdio-mii:10 lan8: failed to kill vid 0081/0 + +Modify mv88e6xxx_port_vlan_leave() to do the same thing as the addition. + +Fixes: b8b79c414eca ("net: dsa: mv88e6xxx: Fix adding vlan 0") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index beb41572d04e..272b0535d946 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -2155,7 +2155,7 @@ static int mv88e6xxx_port_vlan_leave(struct mv88e6xxx_chip *chip, + int i, err; + + if (!vid) +- return -EOPNOTSUPP; ++ return 0; + + err = mv88e6xxx_vtu_get(chip, vid, &vlan); + if (err) +-- +2.30.2 + diff --git a/queue-5.13/net-llc-fix-skb_over_panic.patch b/queue-5.13/net-llc-fix-skb_over_panic.patch new file mode 100644 index 00000000000..cd6fca442ec --- /dev/null +++ b/queue-5.13/net-llc-fix-skb_over_panic.patch @@ -0,0 +1,161 @@ +From d8daab303926bc7009fe012b8b9d4223cddeee1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jul 2021 00:11:59 +0300 +Subject: net: llc: fix skb_over_panic + +From: Pavel Skripkin + +[ Upstream commit c7c9d2102c9c098916ab9e0ab248006107d00d6c ] + +Syzbot reported skb_over_panic() in llc_pdu_init_as_xid_cmd(). The +problem was in wrong LCC header manipulations. + +Syzbot's reproducer tries to send XID packet. llc_ui_sendmsg() is +doing following steps: + + 1. skb allocation with size = len + header size + len is passed from userpace and header size + is 3 since addr->sllc_xid is set. + + 2. skb_reserve() for header_len = 3 + 3. filling all other space with memcpy_from_msg() + +Ok, at this moment we have fully loaded skb, only headers needs to be +filled. + +Then code comes to llc_sap_action_send_xid_c(). This function pushes 3 +bytes for LLC PDU header and initializes it. Then comes +llc_pdu_init_as_xid_cmd(). It initalizes next 3 bytes *AFTER* LLC PDU +header and call skb_push(skb, 3). This looks wrong for 2 reasons: + + 1. Bytes rigth after LLC header are user data, so this function + was overwriting payload. + + 2. skb_push(skb, 3) call can cause skb_over_panic() since + all free space was filled in llc_ui_sendmsg(). (This can + happen is user passed 686 len: 686 + 14 (eth header) + 3 (LLC + header) = 703. SKB_DATA_ALIGN(703) = 704) + +So, in this patch I added 2 new private constansts: LLC_PDU_TYPE_U_XID +and LLC_PDU_LEN_U_XID. LLC_PDU_LEN_U_XID is used to correctly reserve +header size to handle LLC + XID case. LLC_PDU_TYPE_U_XID is used by +llc_pdu_header_init() function to push 6 bytes instead of 3. And finally +I removed skb_push() call from llc_pdu_init_as_xid_cmd(). + +This changes should not affect other parts of LLC, since after +all steps we just transmit buffer. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-and-tested-by: syzbot+5e5a981ad7cc54c4b2b4@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/llc_pdu.h | 31 +++++++++++++++++++++++-------- + net/llc/af_llc.c | 10 +++++++++- + net/llc/llc_s_ac.c | 2 +- + 3 files changed, 33 insertions(+), 10 deletions(-) + +diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h +index c0f0a13ed818..49aa79c7b278 100644 +--- a/include/net/llc_pdu.h ++++ b/include/net/llc_pdu.h +@@ -15,9 +15,11 @@ + #include + + /* Lengths of frame formats */ +-#define LLC_PDU_LEN_I 4 /* header and 2 control bytes */ +-#define LLC_PDU_LEN_S 4 +-#define LLC_PDU_LEN_U 3 /* header and 1 control byte */ ++#define LLC_PDU_LEN_I 4 /* header and 2 control bytes */ ++#define LLC_PDU_LEN_S 4 ++#define LLC_PDU_LEN_U 3 /* header and 1 control byte */ ++/* header and 1 control byte and XID info */ ++#define LLC_PDU_LEN_U_XID (LLC_PDU_LEN_U + sizeof(struct llc_xid_info)) + /* Known SAP addresses */ + #define LLC_GLOBAL_SAP 0xFF + #define LLC_NULL_SAP 0x00 /* not network-layer visible */ +@@ -50,9 +52,10 @@ + #define LLC_PDU_TYPE_U_MASK 0x03 /* 8-bit control field */ + #define LLC_PDU_TYPE_MASK 0x03 + +-#define LLC_PDU_TYPE_I 0 /* first bit */ +-#define LLC_PDU_TYPE_S 1 /* first two bits */ +-#define LLC_PDU_TYPE_U 3 /* first two bits */ ++#define LLC_PDU_TYPE_I 0 /* first bit */ ++#define LLC_PDU_TYPE_S 1 /* first two bits */ ++#define LLC_PDU_TYPE_U 3 /* first two bits */ ++#define LLC_PDU_TYPE_U_XID 4 /* private type for detecting XID commands */ + + #define LLC_PDU_TYPE_IS_I(pdu) \ + ((!(pdu->ctrl_1 & LLC_PDU_TYPE_I_MASK)) ? 1 : 0) +@@ -230,9 +233,18 @@ static inline struct llc_pdu_un *llc_pdu_un_hdr(struct sk_buff *skb) + static inline void llc_pdu_header_init(struct sk_buff *skb, u8 type, + u8 ssap, u8 dsap, u8 cr) + { +- const int hlen = type == LLC_PDU_TYPE_U ? 3 : 4; ++ int hlen = 4; /* default value for I and S types */ + struct llc_pdu_un *pdu; + ++ switch (type) { ++ case LLC_PDU_TYPE_U: ++ hlen = 3; ++ break; ++ case LLC_PDU_TYPE_U_XID: ++ hlen = 6; ++ break; ++ } ++ + skb_push(skb, hlen); + skb_reset_network_header(skb); + pdu = llc_pdu_un_hdr(skb); +@@ -374,7 +386,10 @@ static inline void llc_pdu_init_as_xid_cmd(struct sk_buff *skb, + xid_info->fmt_id = LLC_XID_FMT_ID; /* 0x81 */ + xid_info->type = svcs_supported; + xid_info->rw = rx_window << 1; /* size of receive window */ +- skb_put(skb, sizeof(struct llc_xid_info)); ++ ++ /* no need to push/put since llc_pdu_header_init() has already ++ * pushed 3 + 3 bytes ++ */ + } + + /** +diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c +index 7180979114e4..ac5cadd02cfa 100644 +--- a/net/llc/af_llc.c ++++ b/net/llc/af_llc.c +@@ -98,8 +98,16 @@ static inline u8 llc_ui_header_len(struct sock *sk, struct sockaddr_llc *addr) + { + u8 rc = LLC_PDU_LEN_U; + +- if (addr->sllc_test || addr->sllc_xid) ++ if (addr->sllc_test) + rc = LLC_PDU_LEN_U; ++ else if (addr->sllc_xid) ++ /* We need to expand header to sizeof(struct llc_xid_info) ++ * since llc_pdu_init_as_xid_cmd() sets 4,5,6 bytes of LLC header ++ * as XID PDU. In llc_ui_sendmsg() we reserved header size and then ++ * filled all other space with user data. If we won't reserve this ++ * bytes, llc_pdu_init_as_xid_cmd() will overwrite user data ++ */ ++ rc = LLC_PDU_LEN_U_XID; + else if (sk->sk_type == SOCK_STREAM) + rc = LLC_PDU_LEN_I; + return rc; +diff --git a/net/llc/llc_s_ac.c b/net/llc/llc_s_ac.c +index b554f26c68ee..79d1cef8f15a 100644 +--- a/net/llc/llc_s_ac.c ++++ b/net/llc/llc_s_ac.c +@@ -79,7 +79,7 @@ int llc_sap_action_send_xid_c(struct llc_sap *sap, struct sk_buff *skb) + struct llc_sap_state_ev *ev = llc_sap_ev(skb); + int rc; + +- llc_pdu_header_init(skb, LLC_PDU_TYPE_U, ev->saddr.lsap, ++ llc_pdu_header_init(skb, LLC_PDU_TYPE_U_XID, ev->saddr.lsap, + ev->daddr.lsap, LLC_PDU_CMD); + llc_pdu_init_as_xid_cmd(skb, LLC_XID_NULL_CLASS_2, 0); + rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac); +-- +2.30.2 + diff --git a/queue-5.13/net-mlx5-e-switch-handle-devcom-events-only-for-port.patch b/queue-5.13/net-mlx5-e-switch-handle-devcom-events-only-for-port.patch new file mode 100644 index 00000000000..526943b2541 --- /dev/null +++ b/queue-5.13/net-mlx5-e-switch-handle-devcom-events-only-for-port.patch @@ -0,0 +1,61 @@ +From 1ee60f00843b2653828d15c31aa3138cd1bb0170 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jun 2021 14:17:07 +0300 +Subject: net/mlx5: E-Switch, handle devcom events only for ports on the same + device + +From: Roi Dayan + +[ Upstream commit dd3fddb82780bfa24124834edd90bbc63bd689cc ] + +This is the same check as LAG mode checks if to enable lag. +This will fix adding peer miss rules if lag is not supported +and even an incorrect rules in socket direct mode. + +Also fix the incorrect comment on mlx5_get_next_phys_dev() as flow #1 +doesn't exists. + +Fixes: ac004b832128 ("net/mlx5e: E-Switch, Add peer miss rules") +Signed-off-by: Roi Dayan +Reviewed-by: Maor Dickman +Reviewed-by: Mark Bloch +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/dev.c | 5 +---- + drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 3 +++ + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c +index ceebfc20f65e..def2156e50ee 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c +@@ -500,10 +500,7 @@ static int next_phys_dev(struct device *dev, const void *data) + return 1; + } + +-/* This function is called with two flows: +- * 1. During initialization of mlx5_core_dev and we don't need to lock it. +- * 2. During LAG configure stage and caller holds &mlx5_intf_mutex. +- */ ++/* Must be called with intf_mutex held */ + struct mlx5_core_dev *mlx5_get_next_phys_dev(struct mlx5_core_dev *dev) + { + struct auxiliary_device *adev; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +index 91571156a89d..b66e12753f37 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +@@ -2351,6 +2351,9 @@ static int mlx5_esw_offloads_devcom_event(int event, + + switch (event) { + case ESW_OFFLOADS_DEVCOM_PAIR: ++ if (mlx5_get_next_phys_dev(esw->dev) != peer_esw->dev) ++ break; ++ + if (mlx5_eswitch_vport_match_metadata_enabled(esw) != + mlx5_eswitch_vport_match_metadata_enabled(peer_esw)) + break; +-- +2.30.2 + diff --git a/queue-5.13/net-mlx5-e-switch-set-destination-vport-vhca-id-only.patch b/queue-5.13/net-mlx5-e-switch-set-destination-vport-vhca-id-only.patch new file mode 100644 index 00000000000..22f917791d2 --- /dev/null +++ b/queue-5.13/net-mlx5-e-switch-set-destination-vport-vhca-id-only.patch @@ -0,0 +1,45 @@ +From 1ee570fe0021e6bf695c5c05fa8f457c0b2beff1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 17:07:02 +0300 +Subject: net/mlx5: E-Switch, Set destination vport vhca id only when merged + eswitch is supported + +From: Maor Dickman + +[ Upstream commit c671972534c6f7fce789ac8156a2bc3bd146f806 ] + +Destination vport vhca id is valid flag is set only merged eswitch isn't supported. +Change destination vport vhca id value to be set also only when merged eswitch +is supported. + +Fixes: e4ad91f23f10 ("net/mlx5e: Split offloaded eswitch TC rules for port mirroring") +Signed-off-by: Maor Dickman +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +index d18a28a6e9a6..91571156a89d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +@@ -382,10 +382,11 @@ esw_setup_vport_dest(struct mlx5_flow_destination *dest, struct mlx5_flow_act *f + { + dest[dest_idx].type = MLX5_FLOW_DESTINATION_TYPE_VPORT; + dest[dest_idx].vport.num = esw_attr->dests[attr_idx].rep->vport; +- dest[dest_idx].vport.vhca_id = +- MLX5_CAP_GEN(esw_attr->dests[attr_idx].mdev, vhca_id); +- if (MLX5_CAP_ESW(esw->dev, merged_eswitch)) ++ if (MLX5_CAP_ESW(esw->dev, merged_eswitch)) { ++ dest[dest_idx].vport.vhca_id = ++ MLX5_CAP_GEN(esw_attr->dests[attr_idx].mdev, vhca_id); + dest[dest_idx].vport.flags |= MLX5_FLOW_DEST_VPORT_VHCA_ID; ++ } + if (esw_attr->dests[attr_idx].flags & MLX5_ESW_DEST_ENCAP) { + if (pkt_reformat) { + flow_act->action |= MLX5_FLOW_CONTEXT_ACTION_PACKET_REFORMAT; +-- +2.30.2 + diff --git a/queue-5.13/net-mlx5-fix-flow-table-chaining.patch b/queue-5.13/net-mlx5-fix-flow-table-chaining.patch new file mode 100644 index 00000000000..d86b724b179 --- /dev/null +++ b/queue-5.13/net-mlx5-fix-flow-table-chaining.patch @@ -0,0 +1,88 @@ +From a4f73c16f44be72a3577dd9b6f4d5ca33d9376a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jul 2021 09:20:14 +0300 +Subject: net/mlx5: Fix flow table chaining + +From: Maor Gottlieb + +[ Upstream commit 8b54874ef1617185048029a3083d510569e93751 ] + +Fix a bug when flow table is created in priority that already +has other flow tables as shown in the below diagram. +If the new flow table (FT-B) has the lowest level in the priority, +we need to connect the flow tables from the previous priority (p0) +to this new table. In addition when this flow table is destroyed +(FT-B), we need to connect the flow tables from the previous +priority (p0) to the next level flow table (FT-C) in the same +priority of the destroyed table (if exists). + + --------- + |root_ns| + --------- + | + -------------------------------- + | | | + ---------- ---------- --------- + |p(prio)-x| | p-y | | p-n | + ---------- ---------- --------- + | | + ---------------- ------------------ + |ns(e.g bypass)| |ns(e.g. kernel) | + ---------------- ------------------ + | | | + ------- ------ ---- + | p0 | | p1 | |p2| + ------- ------ ---- + | | \ + -------- ------- ------ + | FT-A | |FT-B | |FT-C| + -------- ------- ------ + +Fixes: f90edfd279f3 ("net/mlx5_core: Connect flow tables") +Signed-off-by: Maor Gottlieb +Reviewed-by: Mark Bloch +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +index f74d2c834037..48fc242e066f 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +@@ -1024,17 +1024,19 @@ static int connect_fwd_rules(struct mlx5_core_dev *dev, + static int connect_flow_table(struct mlx5_core_dev *dev, struct mlx5_flow_table *ft, + struct fs_prio *prio) + { +- struct mlx5_flow_table *next_ft; ++ struct mlx5_flow_table *next_ft, *first_ft; + int err = 0; + + /* Connect_prev_fts and update_root_ft_create are mutually exclusive */ + +- if (list_empty(&prio->node.children)) { ++ first_ft = list_first_entry_or_null(&prio->node.children, ++ struct mlx5_flow_table, node.list); ++ if (!first_ft || first_ft->level > ft->level) { + err = connect_prev_fts(dev, ft, prio); + if (err) + return err; + +- next_ft = find_next_chained_ft(prio); ++ next_ft = first_ft ? first_ft : find_next_chained_ft(prio); + err = connect_fwd_rules(dev, ft, next_ft); + if (err) + return err; +@@ -2109,7 +2111,7 @@ static int disconnect_flow_table(struct mlx5_flow_table *ft) + node.list) == ft)) + return 0; + +- next_ft = find_next_chained_ft(prio); ++ next_ft = find_next_ft(ft); + err = connect_fwd_rules(dev, next_ft, ft); + if (err) + return err; +-- +2.30.2 + diff --git a/queue-5.13/net-mlx5-fix-mlx5_vport_tbl_attr-chain-from-u16-to-u.patch b/queue-5.13/net-mlx5-fix-mlx5_vport_tbl_attr-chain-from-u16-to-u.patch new file mode 100644 index 00000000000..9f63199465c --- /dev/null +++ b/queue-5.13/net-mlx5-fix-mlx5_vport_tbl_attr-chain-from-u16-to-u.patch @@ -0,0 +1,38 @@ +From 2842ac999696a610c981afc65f4ade679cf47524 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Apr 2021 11:06:37 +0800 +Subject: net/mlx5: Fix mlx5_vport_tbl_attr chain from u16 to u32 + +From: Chris Mi + +[ Upstream commit 740452e09cf5fc489ce60831cf11abef117b5d26 ] + +The offending refactor commit uses u16 chain wrongly. Actually, it +should be u32. + +Fixes: c620b772152b ("net/mlx5: Refactor tc flow attributes structure") +CC: Ariel Levkovich +Signed-off-by: Chris Mi +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +index 64ccb2bc0b58..e0f6f75fd9d6 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +@@ -629,7 +629,7 @@ struct esw_vport_tbl_namespace { + }; + + struct mlx5_vport_tbl_attr { +- u16 chain; ++ u32 chain; + u16 prio; + u16 vport; + const struct esw_vport_tbl_namespace *vport_ns; +-- +2.30.2 + diff --git a/queue-5.13/net-mlx5-unload-device-upon-firmware-fatal-error.patch b/queue-5.13/net-mlx5-unload-device-upon-firmware-fatal-error.patch new file mode 100644 index 00000000000..2917ccbc939 --- /dev/null +++ b/queue-5.13/net-mlx5-unload-device-upon-firmware-fatal-error.patch @@ -0,0 +1,49 @@ +From ce19066721f4c0d3c33f08afe63ac808e39ae8f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jun 2021 19:11:03 +0300 +Subject: net/mlx5: Unload device upon firmware fatal error + +From: Aya Levin + +[ Upstream commit 7f331bf0f060c2727e36d64f9b098b4ee5f3dfad ] + +When fw_fatal reporter reports an error, the firmware in not responding. +Unload the device to ensure that the driver closes all its resources, +even if recovery is not due (user disabled auto-recovery or reporter is +in grace period). On successful recovery the device is loaded back up. + +Fixes: b3bd076f7501 ("net/mlx5: Report devlink health on FW fatal issues") +Signed-off-by: Aya Levin +Reviewed-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/health.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c +index 9ff163c5bcde..9abeb80ffa31 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c +@@ -626,8 +626,16 @@ static void mlx5_fw_fatal_reporter_err_work(struct work_struct *work) + } + fw_reporter_ctx.err_synd = health->synd; + fw_reporter_ctx.miss_counter = health->miss_counter; +- devlink_health_report(health->fw_fatal_reporter, +- "FW fatal error reported", &fw_reporter_ctx); ++ if (devlink_health_report(health->fw_fatal_reporter, ++ "FW fatal error reported", &fw_reporter_ctx) == -ECANCELED) { ++ /* If recovery wasn't performed, due to grace period, ++ * unload the driver. This ensures that the driver ++ * closes all its resources and it is not subjected to ++ * requests from the kernel. ++ */ ++ mlx5_core_err(dev, "Driver is in error state. Unloading\n"); ++ mlx5_unload_one(dev); ++ } + } + + static const struct devlink_health_reporter_ops mlx5_fw_fatal_reporter_ops = { +-- +2.30.2 + diff --git a/queue-5.13/net-mlx5e-add-netif_f_hw_tc-to-hw_features-when-htb-.patch b/queue-5.13/net-mlx5e-add-netif_f_hw_tc-to-hw_features-when-htb-.patch new file mode 100644 index 00000000000..f80ef552e12 --- /dev/null +++ b/queue-5.13/net-mlx5e-add-netif_f_hw_tc-to-hw_features-when-htb-.patch @@ -0,0 +1,51 @@ +From 16394c1f921e186045dcd73d5aa0043443c20b4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 13:33:31 +0300 +Subject: net/mlx5e: Add NETIF_F_HW_TC to hw_features when HTB offload is + available + +From: Maxim Mikityanskiy + +[ Upstream commit 9841d58f3550d11c6181424427e8ad8c9c80f1b6 ] + +If a feature flag is only present in features, but not in hw_features, +the user can't reset it. Although hw_features may contain NETIF_F_HW_TC +by the point where the driver checks whether HTB offload is supported, +this flag is controlled by another condition that may not hold. Set it +explicitly to make sure the user can disable it. + +Fixes: 214baf22870c ("net/mlx5e: Support HTB offload") +Signed-off-by: Maxim Mikityanskiy +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 86a27b0b42cb..d0d9acb17253 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -4866,6 +4866,9 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev) + if (MLX5_CAP_ETH(mdev, scatter_fcs)) + netdev->hw_features |= NETIF_F_RXFCS; + ++ if (mlx5_qos_is_supported(mdev)) ++ netdev->hw_features |= NETIF_F_HW_TC; ++ + netdev->features = netdev->hw_features; + + /* Defaults */ +@@ -4886,8 +4889,6 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev) + netdev->hw_features |= NETIF_F_NTUPLE; + #endif + } +- if (mlx5_qos_is_supported(mdev)) +- netdev->features |= NETIF_F_HW_TC; + + netdev->features |= NETIF_F_HIGHDMA; + netdev->features |= NETIF_F_HW_VLAN_STAG_FILTER; +-- +2.30.2 + diff --git a/queue-5.13/net-mlx5e-disable-rx-ntuple-offload-for-uplink-repre.patch b/queue-5.13/net-mlx5e-disable-rx-ntuple-offload-for-uplink-repre.patch new file mode 100644 index 00000000000..3883db277a5 --- /dev/null +++ b/queue-5.13/net-mlx5e-disable-rx-ntuple-offload-for-uplink-repre.patch @@ -0,0 +1,125 @@ +From 192caa212e56bcf4aa6f39ecb848dc41223f10c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jul 2021 15:24:58 +0300 +Subject: net/mlx5e: Disable Rx ntuple offload for uplink representor + +From: Maor Dickman + +[ Upstream commit 90b22b9bcd242a3ba238f2c6f7eab771799001f8 ] + +Rx ntuple offload is not supported in switchdev mode. +Tryng to enable it cause kernel panic. + + BUG: kernel NULL pointer dereference, address: 0000000000000008 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 80000001065a5067 P4D 80000001065a5067 PUD 106594067 PMD 0 + Oops: 0000 [#1] SMP PTI + CPU: 7 PID: 1089 Comm: ethtool Not tainted 5.13.0-rc7_for_upstream_min_debug_2021_06_23_16_44 #1 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 + RIP: 0010:mlx5e_arfs_enable+0x70/0xd0 [mlx5_core] + Code: 44 24 10 00 00 00 00 48 c7 44 24 18 00 00 00 00 49 63 c4 48 89 e2 44 89 e6 48 69 c0 20 08 00 00 48 89 ef 48 03 85 68 ac 00 00 <48> 8b 40 08 48 89 44 24 08 e8 d2 aa fd ff 48 83 05 82 96 18 00 01 + RSP: 0018:ffff8881047679e0 EFLAGS: 00010246 + RAX: 0000000000000000 RBX: 0000004000000000 RCX: 0000004000000000 + RDX: ffff8881047679e0 RSI: 0000000000000000 RDI: ffff888115100880 + RBP: ffff888115100880 R08: ffffffffa00f6cb0 R09: ffff888104767a18 + R10: ffff8881151000a0 R11: ffff888109479540 R12: 0000000000000000 + R13: ffff888104767bb8 R14: ffff888115100000 R15: ffff8881151000a0 + FS: 00007f41a64ab740(0000) GS:ffff8882f5dc0000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000008 CR3: 0000000104cbc005 CR4: 0000000000370ea0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + set_feature_arfs+0x1e/0x40 [mlx5_core] + mlx5e_handle_feature+0x43/0xa0 [mlx5_core] + mlx5e_set_features+0x139/0x1b0 [mlx5_core] + __netdev_update_features+0x2b3/0xaf0 + ethnl_set_features+0x176/0x3a0 + ? __nla_parse+0x22/0x30 + genl_family_rcv_msg_doit+0xe2/0x140 + genl_rcv_msg+0xde/0x1d0 + ? features_reply_size+0xe0/0xe0 + ? genl_get_cmd+0xd0/0xd0 + netlink_rcv_skb+0x4e/0xf0 + genl_rcv+0x24/0x40 + netlink_unicast+0x1f6/0x2b0 + netlink_sendmsg+0x225/0x450 + sock_sendmsg+0x33/0x40 + __sys_sendto+0xd4/0x120 + ? __sys_recvmsg+0x4e/0x90 + ? exc_page_fault+0x219/0x740 + __x64_sys_sendto+0x25/0x30 + do_syscall_64+0x3f/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + RIP: 0033:0x7f41a65b0cba + Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 76 c3 0f 1f 44 00 00 55 48 83 ec 30 44 89 4c + RSP: 002b:00007ffd8d688358 EFLAGS: 00000246 ORIG_RAX: 000000000000002c + RAX: ffffffffffffffda RBX: 00000000010f42a0 RCX: 00007f41a65b0cba + RDX: 0000000000000058 RSI: 00000000010f43b0 RDI: 0000000000000003 + RBP: 000000000047ae60 R08: 00007f41a667c000 R09: 000000000000000c + R10: 0000000000000000 R11: 0000000000000246 R12: 00000000010f4340 + R13: 00000000010f4350 R14: 00007ffd8d688400 R15: 00000000010f42a0 + Modules linked in: mlx5_vdpa vhost_iotlb vdpa xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad ib_ipoib rdma_cm iw_cm ib_cm mlx5_ib ib_uverbs ib_core overlay mlx5_core ptp pps_core fuse + CR2: 0000000000000008 + ---[ end trace c66523f2aba94b43 ]--- + +Fixes: 7a9fb35e8c3a ("net/mlx5e: Do not reload ethernet ports when changing eswitch mode") +Signed-off-by: Maor Dickman +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/en_main.c | 29 +++++++++++++------ + 1 file changed, 20 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index d26b8ed51195..86a27b0b42cb 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -3825,6 +3825,24 @@ int mlx5e_set_features(struct net_device *netdev, netdev_features_t features) + return 0; + } + ++static netdev_features_t mlx5e_fix_uplink_rep_features(struct net_device *netdev, ++ netdev_features_t features) ++{ ++ features &= ~NETIF_F_HW_TLS_RX; ++ if (netdev->features & NETIF_F_HW_TLS_RX) ++ netdev_warn(netdev, "Disabling hw_tls_rx, not supported in switchdev mode\n"); ++ ++ features &= ~NETIF_F_HW_TLS_TX; ++ if (netdev->features & NETIF_F_HW_TLS_TX) ++ netdev_warn(netdev, "Disabling hw_tls_tx, not supported in switchdev mode\n"); ++ ++ features &= ~NETIF_F_NTUPLE; ++ if (netdev->features & NETIF_F_NTUPLE) ++ netdev_warn(netdev, "Disabling ntuple, not supported in switchdev mode\n"); ++ ++ return features; ++} ++ + static netdev_features_t mlx5e_fix_features(struct net_device *netdev, + netdev_features_t features) + { +@@ -3856,15 +3874,8 @@ static netdev_features_t mlx5e_fix_features(struct net_device *netdev, + netdev_warn(netdev, "Disabling rxhash, not supported when CQE compress is active\n"); + } + +- if (mlx5e_is_uplink_rep(priv)) { +- features &= ~NETIF_F_HW_TLS_RX; +- if (netdev->features & NETIF_F_HW_TLS_RX) +- netdev_warn(netdev, "Disabling hw_tls_rx, not supported in switchdev mode\n"); +- +- features &= ~NETIF_F_HW_TLS_TX; +- if (netdev->features & NETIF_F_HW_TLS_TX) +- netdev_warn(netdev, "Disabling hw_tls_tx, not supported in switchdev mode\n"); +- } ++ if (mlx5e_is_uplink_rep(priv)) ++ features = mlx5e_fix_uplink_rep_features(netdev, features); + + mutex_unlock(&priv->state_lock); + +-- +2.30.2 + diff --git a/queue-5.13/net-mlx5e-fix-nullptr-in-mlx5e_hairpin_get_mdev.patch b/queue-5.13/net-mlx5e-fix-nullptr-in-mlx5e_hairpin_get_mdev.patch new file mode 100644 index 00000000000..5511de9274c --- /dev/null +++ b/queue-5.13/net-mlx5e-fix-nullptr-in-mlx5e_hairpin_get_mdev.patch @@ -0,0 +1,97 @@ +From f5add50d0963ba6c34ccf93dfaf56751e68ae0bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Apr 2021 15:16:26 +0300 +Subject: net/mlx5e: Fix nullptr in mlx5e_hairpin_get_mdev() + +From: Dima Chumak + +[ Upstream commit b1c2f6312c5005c928a72e668bf305a589d828d4 ] + +The result of __dev_get_by_index() is not checked for NULL and then gets +dereferenced immediately. + +Also, __dev_get_by_index() must be called while holding either RTNL lock +or @dev_base_lock, which isn't satisfied by mlx5e_hairpin_get_mdev() or +its callers. This makes the underlying hlist_for_each_entry() loop not +safe, and can have adverse effects in itself. + +Fix by using dev_get_by_index() and handling nullptr return value when +ifindex device is not found. Update mlx5e_hairpin_get_mdev() callers to +check for possible PTR_ERR() result. + +Fixes: 77ab67b7f0f9 ("net/mlx5e: Basic setup of hairpin object") +Addresses-Coverity: ("Dereference null return value") +Signed-off-by: Dima Chumak +Reviewed-by: Vlad Buslov +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/en_tc.c | 33 +++++++++++++++++-- + 1 file changed, 31 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index d4b0f270b6bb..47bd20ad8108 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -424,12 +424,32 @@ static void mlx5e_detach_mod_hdr(struct mlx5e_priv *priv, + static + struct mlx5_core_dev *mlx5e_hairpin_get_mdev(struct net *net, int ifindex) + { ++ struct mlx5_core_dev *mdev; + struct net_device *netdev; + struct mlx5e_priv *priv; + +- netdev = __dev_get_by_index(net, ifindex); ++ netdev = dev_get_by_index(net, ifindex); ++ if (!netdev) ++ return ERR_PTR(-ENODEV); ++ + priv = netdev_priv(netdev); +- return priv->mdev; ++ mdev = priv->mdev; ++ dev_put(netdev); ++ ++ /* Mirred tc action holds a refcount on the ifindex net_device (see ++ * net/sched/act_mirred.c:tcf_mirred_get_dev). So, it's okay to continue using mdev ++ * after dev_put(netdev), while we're in the context of adding a tc flow. ++ * ++ * The mdev pointer corresponds to the peer/out net_device of a hairpin. It is then ++ * stored in a hairpin object, which exists until all flows, that refer to it, get ++ * removed. ++ * ++ * On the other hand, after a hairpin object has been created, the peer net_device may ++ * be removed/unbound while there are still some hairpin flows that are using it. This ++ * case is handled by mlx5e_tc_hairpin_update_dead_peer, which is hooked to ++ * NETDEV_UNREGISTER event of the peer net_device. ++ */ ++ return mdev; + } + + static int mlx5e_hairpin_create_transport(struct mlx5e_hairpin *hp) +@@ -638,6 +658,10 @@ mlx5e_hairpin_create(struct mlx5e_priv *priv, struct mlx5_hairpin_params *params + + func_mdev = priv->mdev; + peer_mdev = mlx5e_hairpin_get_mdev(dev_net(priv->netdev), peer_ifindex); ++ if (IS_ERR(peer_mdev)) { ++ err = PTR_ERR(peer_mdev); ++ goto create_pair_err; ++ } + + pair = mlx5_core_hairpin_create(func_mdev, peer_mdev, params); + if (IS_ERR(pair)) { +@@ -776,6 +800,11 @@ static int mlx5e_hairpin_flow_add(struct mlx5e_priv *priv, + int err; + + peer_mdev = mlx5e_hairpin_get_mdev(dev_net(priv->netdev), peer_ifindex); ++ if (IS_ERR(peer_mdev)) { ++ NL_SET_ERR_MSG_MOD(extack, "invalid ifindex of mirred device"); ++ return PTR_ERR(peer_mdev); ++ } ++ + if (!MLX5_CAP_GEN(priv->mdev, hairpin) || !MLX5_CAP_GEN(peer_mdev, hairpin)) { + NL_SET_ERR_MSG_MOD(extack, "hairpin is not supported"); + return -EOPNOTSUPP; +-- +2.30.2 + diff --git a/queue-5.13/net-mlx5e-fix-page-allocation-failure-for-ptp-rq-ove.patch b/queue-5.13/net-mlx5e-fix-page-allocation-failure-for-ptp-rq-ove.patch new file mode 100644 index 00000000000..77a1dc94e98 --- /dev/null +++ b/queue-5.13/net-mlx5e-fix-page-allocation-failure-for-ptp-rq-ove.patch @@ -0,0 +1,37 @@ +From cf46a8d652afa87428ff3d0365daeff7c1fc55da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 10:24:17 +0300 +Subject: net/mlx5e: Fix page allocation failure for ptp-RQ over SF + +From: Aya Levin + +[ Upstream commit 678b1ae1af4aef488fcc42baa663e737b9a531ba ] + +Set the correct pci-device pointer to the ptp-RQ. This allows access to +dma_mask and avoids allocation request with wrong pci-device. + +Fixes: a099da8ffcf6 ("net/mlx5e: Add RQ to PTP channel") +Signed-off-by: Aya Levin +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c +index 778e229310a9..0f6b3231ca1d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c +@@ -494,7 +494,7 @@ static int mlx5e_init_ptp_rq(struct mlx5e_ptp *c, struct mlx5e_params *params, + int err; + + rq->wq_type = params->rq_wq_type; +- rq->pdev = mdev->device; ++ rq->pdev = c->pdev; + rq->netdev = priv->netdev; + rq->priv = priv; + rq->clock = &mdev->clock; +-- +2.30.2 + diff --git a/queue-5.13/net-mlx5e-fix-page-allocation-failure-for-trap-rq-ov.patch b/queue-5.13/net-mlx5e-fix-page-allocation-failure-for-trap-rq-ov.patch new file mode 100644 index 00000000000..e060f8ea402 --- /dev/null +++ b/queue-5.13/net-mlx5e-fix-page-allocation-failure-for-trap-rq-ov.patch @@ -0,0 +1,54 @@ +From 9872b1b1cfac02b15d2a6ffed783aaa8fc3aec1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 18:04:07 +0300 +Subject: net/mlx5e: Fix page allocation failure for trap-RQ over SF + +From: Aya Levin + +[ Upstream commit 497008e783452a2ec45c7ec5835cfe6950dcb097 ] + +Set the correct device pointer to the trap-RQ, to allow access to +dma_mask and avoid allocation request with the wrong pci-dev. + +WARNING: CPU: 1 PID: 12005 at kernel/dma/mapping.c:151 dma_map_page_attrs+0x139/0x1c0 +... +all Trace: + +? __page_pool_alloc_pages_slow+0x5a/0x210 +mlx5e_post_rx_wqes+0x258/0x400 [mlx5_core] +mlx5e_trap_napi_poll+0x44/0xc0 [mlx5_core] +__napi_poll+0x24/0x150 +net_rx_action+0x22b/0x280 +__do_softirq+0xc7/0x27e +do_softirq+0x61/0x80 + +__local_bh_enable_ip+0x4b/0x50 +mlx5e_handle_action_trap+0x2dd/0x4d0 [mlx5_core] +blocking_notifier_call_chain+0x5a/0x80 +mlx5_devlink_trap_action_set+0x8b/0x100 [mlx5_core] + +Fixes: 5543e989fe5e ("net/mlx5e: Add trap entity to ETH driver") +Signed-off-by: Aya Levin +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en/trap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/trap.c b/drivers/net/ethernet/mellanox/mlx5/core/en/trap.c +index 86ab4e864fe6..7f94508594fb 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/trap.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/trap.c +@@ -37,7 +37,7 @@ static void mlx5e_init_trap_rq(struct mlx5e_trap *t, struct mlx5e_params *params + struct mlx5e_priv *priv = t->priv; + + rq->wq_type = params->rq_wq_type; +- rq->pdev = mdev->device; ++ rq->pdev = t->pdev; + rq->netdev = priv->netdev; + rq->priv = priv; + rq->clock = &mdev->clock; +-- +2.30.2 + diff --git a/queue-5.13/net-mlx5e-rx-avoid-possible-data-corruption-when-rel.patch b/queue-5.13/net-mlx5e-rx-avoid-possible-data-corruption-when-rel.patch new file mode 100644 index 00000000000..fcb1d9e3217 --- /dev/null +++ b/queue-5.13/net-mlx5e-rx-avoid-possible-data-corruption-when-rel.patch @@ -0,0 +1,71 @@ +From c36d07fd753e4acf3b94b628bb3e4833f7a4b571 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 13:45:05 +0300 +Subject: net/mlx5e: RX, Avoid possible data corruption when relaxed ordering + and LRO combined + +From: Tariq Toukan + +[ Upstream commit e2351e517068718724f1d3b4010e2a41ec91fa76 ] + +When HW aggregates packets for an LRO session, it writes the payload +of two consecutive packets of a flow contiguously, so that they usually +share a cacheline. + +The first byte of a packet's payload is written immediately after +the last byte of the preceding packet. +In this flow, there are two consecutive write requests to the shared +cacheline: +1. Regular write for the earlier packet. +2. Read-modify-write for the following packet. + +In case of relaxed-ordering on, these two writes might be re-ordered. +Using the end padding optimization (to avoid partial write for the last +cacheline of a packet) becomes problematic if the two writes occur +out-of-order, as the padding would overwrite payload that belongs to +the following packet, causing data corruption. + +Avoid this by disabling the end padding optimization when both +LRO and relaxed-ordering are enabled. + +Fixes: 17347d5430c4 ("net/mlx5e: Add support for PCI relaxed ordering") +Signed-off-by: Tariq Toukan +Reviewed-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en/params.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c +index f410c1268422..133eb13facfd 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c +@@ -471,6 +471,15 @@ static void mlx5e_build_rx_cq_param(struct mlx5_core_dev *mdev, + param->cq_period_mode = params->rx_cq_moderation.cq_period_mode; + } + ++static u8 rq_end_pad_mode(struct mlx5_core_dev *mdev, struct mlx5e_params *params) ++{ ++ bool ro = pcie_relaxed_ordering_enabled(mdev->pdev) && ++ MLX5_CAP_GEN(mdev, relaxed_ordering_write); ++ ++ return ro && params->lro_en ? ++ MLX5_WQ_END_PAD_MODE_NONE : MLX5_WQ_END_PAD_MODE_ALIGN; ++} ++ + int mlx5e_build_rq_param(struct mlx5_core_dev *mdev, + struct mlx5e_params *params, + struct mlx5e_xsk_param *xsk, +@@ -508,7 +517,7 @@ int mlx5e_build_rq_param(struct mlx5_core_dev *mdev, + } + + MLX5_SET(wq, wq, wq_type, params->rq_wq_type); +- MLX5_SET(wq, wq, end_padding_mode, MLX5_WQ_END_PAD_MODE_ALIGN); ++ MLX5_SET(wq, wq, end_padding_mode, rq_end_pad_mode(mdev, params)); + MLX5_SET(wq, wq, log_wq_stride, + mlx5e_get_rqwq_log_stride(params->rq_wq_type, ndsegs)); + MLX5_SET(wq, wq, pd, mdev->mlx5e_res.hw_objs.pdn); +-- +2.30.2 + diff --git a/queue-5.13/net-phy-broadcom-re-add-check-for-phy_brcm_dis_txcrx.patch b/queue-5.13/net-phy-broadcom-re-add-check-for-phy_brcm_dis_txcrx.patch new file mode 100644 index 00000000000..8db1456a82f --- /dev/null +++ b/queue-5.13/net-phy-broadcom-re-add-check-for-phy_brcm_dis_txcrx.patch @@ -0,0 +1,37 @@ +From 36ae64557a2a273c3a85403cc344c72d4e50b815 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jul 2021 21:59:27 +0800 +Subject: net: phy: broadcom: re-add check for PHY_BRCM_DIS_TXCRXC_NOENRGY on + the BCM54811 PHY + +From: Kevin Lo + +[ Upstream commit ad4e1e48a6291f7fb53fbef38ca264966ffd65c9 ] + +Restore PHY_ID_BCM54811 accidently removed by commit 5d4358ede8eb. + +Fixes: 5d4358ede8eb ("net: phy: broadcom: Allow BCM54210E to configure APD") +Signed-off-by: Kevin Lo +Acked-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/broadcom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c +index 7bf3011b8e77..83aea5c5cd03 100644 +--- a/drivers/net/phy/broadcom.c ++++ b/drivers/net/phy/broadcom.c +@@ -288,7 +288,7 @@ static void bcm54xx_adjust_rxrefclk(struct phy_device *phydev) + if (phydev->dev_flags & PHY_BRCM_DIS_TXCRXC_NOENRGY) { + if (BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54210E || + BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54810 || +- BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54210E) ++ BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54811) + val |= BCM54XX_SHD_SCR3_RXCTXC_DIS; + else + val |= BCM54XX_SHD_SCR3_TRDDAPD; +-- +2.30.2 + diff --git a/queue-5.13/net-qrtr-fix-memory-leaks.patch b/queue-5.13/net-qrtr-fix-memory-leaks.patch new file mode 100644 index 00000000000..fbf467e5e96 --- /dev/null +++ b/queue-5.13/net-qrtr-fix-memory-leaks.patch @@ -0,0 +1,66 @@ +From 6de346802514bd123bdde033625c65b0f0bd84d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jul 2021 18:31:32 +0300 +Subject: net: qrtr: fix memory leaks + +From: Pavel Skripkin + +[ Upstream commit 52f3456a96c06760b9bfae460e39596fec7af22e ] + +Syzbot reported memory leak in qrtr. The problem was in unputted +struct sock. qrtr_local_enqueue() function calls qrtr_port_lookup() +which takes sock reference if port was found. Then there is the following +check: + +if (!ipc || &ipc->sk == skb->sk) { + ... + return -ENODEV; +} + +Since we should drop the reference before returning from this function and +ipc can be non-NULL inside this if, we should add qrtr_port_put() inside +this if. + +The similar corner case is in qrtr_endpoint_post() as Manivannan +reported. In case of sock_queue_rcv_skb() failure we need to put +port reference to avoid leaking struct sock pointer. + +Fixes: e04df98adf7d ("net: qrtr: Remove receive worker") +Fixes: bdabad3e363d ("net: Add Qualcomm IPC router") +Reported-and-tested-by: syzbot+35a511c72ea7356cdcf3@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/qrtr/qrtr.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c +index f2efaa4225f9..67993bcfecde 100644 +--- a/net/qrtr/qrtr.c ++++ b/net/qrtr/qrtr.c +@@ -518,8 +518,10 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) + if (!ipc) + goto err; + +- if (sock_queue_rcv_skb(&ipc->sk, skb)) ++ if (sock_queue_rcv_skb(&ipc->sk, skb)) { ++ qrtr_port_put(ipc); + goto err; ++ } + + qrtr_port_put(ipc); + } +@@ -839,6 +841,8 @@ static int qrtr_local_enqueue(struct qrtr_node *node, struct sk_buff *skb, + + ipc = qrtr_port_lookup(to->sq_port); + if (!ipc || &ipc->sk == skb->sk) { /* do not send to self */ ++ if (ipc) ++ qrtr_port_put(ipc); + kfree_skb(skb); + return -ENODEV; + } +-- +2.30.2 + diff --git a/queue-5.13/net-set-true-network-header-for-ecn-decapsulation.patch b/queue-5.13/net-set-true-network-header-for-ecn-decapsulation.patch new file mode 100644 index 00000000000..176db2743b3 --- /dev/null +++ b/queue-5.13/net-set-true-network-header-for-ecn-decapsulation.patch @@ -0,0 +1,97 @@ +From 8918836b629ee3a46baa6e27cc623e371a5d42c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jul 2021 20:01:28 +0300 +Subject: net: Set true network header for ECN decapsulation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Gilad Naaman + +[ Upstream commit 227adfb2b1dfbc53dfc53b9dd7a93a6298ff7c56 ] + +In cases where the header straight after the tunnel header was +another ethernet header (TEB), instead of the network header, +the ECN decapsulation code would treat the ethernet header as if +it was an IP header, resulting in mishandling and possible +wrong drops or corruption of the IP header. + +In this case, ECT(1) is sent, so IP_ECN_decapsulate tries to copy it to the +inner IPv4 header, and correct its checksum. + +The offset of the ECT bits in an IPv4 header corresponds to the +lower 2 bits of the second octet of the destination MAC address +in the ethernet header. +The IPv4 checksum corresponds to end of the source address. + +In order to reproduce: + + $ ip netns add A + $ ip netns add B + $ ip -n A link add _v0 type veth peer name _v1 netns B + $ ip -n A link set _v0 up + $ ip -n A addr add dev _v0 10.254.3.1/24 + $ ip -n A route add default dev _v0 scope global + $ ip -n B link set _v1 up + $ ip -n B addr add dev _v1 10.254.1.6/24 + $ ip -n B route add default dev _v1 scope global + $ ip -n B link add gre1 type gretap local 10.254.1.6 remote 10.254.3.1 key 0x49000000 + $ ip -n B link set gre1 up + + # Now send an IPv4/GRE/Eth/IPv4 frame where the outer header has ECT(1), + # and the inner header has no ECT bits set: + + $ cat send_pkt.py + #!/usr/bin/env python3 + from scapy.all import * + + pkt = IP(b'E\x01\x00\xa7\x00\x00\x00\x00@/`%\n\xfe\x03\x01\n\xfe\x01\x06 \x00eXI\x00' + b'\x00\x00\x18\xbe\x92\xa0\xee&\x18\xb0\x92\xa0l&\x08\x00E\x00\x00}\x8b\x85' + b'@\x00\x01\x01\xe4\xf2\x82\x82\x82\x01\x82\x82\x82\x02\x08\x00d\x11\xa6\xeb' + b'3\x1e\x1e\\xf3\\xf7`\x00\x00\x00\x00ZN\x00\x00\x00\x00\x00\x00\x10\x11\x12' + b'\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !"#$%&\'()*+,-./01234' + b'56789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ') + + send(pkt) + $ sudo ip netns exec B tcpdump -neqlllvi gre1 icmp & ; sleep 1 + $ sudo ip netns exec A python3 send_pkt.py + +In the original packet, the source/destinatio MAC addresses are +dst=18:be:92:a0:ee:26 src=18:b0:92:a0:6c:26 + +In the received packet, they are +dst=18:bd:92:a0:ee:26 src=18:b0:92:a0:6c:27 + +Thanks to Lahav Schlesinger and Isaac Garzon +for helping me pinpoint the origin. + +Fixes: b723748750ec ("tunnel: Propagate ECT(1) when decapsulating as recommended by RFC6040") +Cc: David S. Miller +Cc: Hideaki YOSHIFUJI +Cc: David Ahern +Cc: Jakub Kicinski +Cc: Toke Høiland-Jørgensen +Signed-off-by: Gilad Naaman +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_tunnel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 0dca00745ac3..be75b409445c 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -390,7 +390,7 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb, + tunnel->i_seqno = ntohl(tpi->seq) + 1; + } + +- skb_reset_network_header(skb); ++ skb_set_network_header(skb, (tunnel->dev->type == ARPHRD_ETHER) ? ETH_HLEN : 0); + + err = IP_ECN_decapsulate(iph, skb); + if (unlikely(err)) { +-- +2.30.2 + diff --git a/queue-5.13/netfilter-conntrack-adjust-stop-timestamp-to-real-ex.patch b/queue-5.13/netfilter-conntrack-adjust-stop-timestamp-to-real-ex.patch new file mode 100644 index 00000000000..6d9bd677718 --- /dev/null +++ b/queue-5.13/netfilter-conntrack-adjust-stop-timestamp-to-real-ex.patch @@ -0,0 +1,44 @@ +From e7f4a0954957e0190ac9194edecea001a3f263bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Jul 2021 18:36:00 +0200 +Subject: netfilter: conntrack: adjust stop timestamp to real expiry value + +From: Florian Westphal + +[ Upstream commit 30a56a2b881821625f79837d4d968c679852444e ] + +In case the entry is evicted via garbage collection there is +delay between the timeout value and the eviction event. + +This adjusts the stop value based on how much time has passed. + +Fixes: b87a2f9199ea82 ("netfilter: conntrack: add gc worker to remove timed-out entries") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_core.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index e0befcf8113a..69079a382d3a 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -666,8 +666,13 @@ bool nf_ct_delete(struct nf_conn *ct, u32 portid, int report) + return false; + + tstamp = nf_conn_tstamp_find(ct); +- if (tstamp && tstamp->stop == 0) ++ if (tstamp) { ++ s32 timeout = ct->timeout - nfct_time_stamp; ++ + tstamp->stop = ktime_get_real_ns(); ++ if (timeout < 0) ++ tstamp->stop -= jiffies_to_nsecs(-timeout); ++ } + + if (nf_conntrack_event_report(IPCT_DESTROY, ct, + portid, report) < 0) { +-- +2.30.2 + diff --git a/queue-5.13/netfilter-nf_tables-fix-audit-memory-leak-in-nf_tabl.patch b/queue-5.13/netfilter-nf_tables-fix-audit-memory-leak-in-nf_tabl.patch new file mode 100644 index 00000000000..75dd3690c62 --- /dev/null +++ b/queue-5.13/netfilter-nf_tables-fix-audit-memory-leak-in-nf_tabl.patch @@ -0,0 +1,79 @@ +From 5aff144014312f2980cdc094e91bea4984d85ee0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jul 2021 11:27:03 +0800 +Subject: netfilter: nf_tables: fix audit memory leak in nf_tables_commit + +From: Dongliang Mu + +[ Upstream commit cfbe3650dd3ef2ea9a4420ca89d9a4df98af3fb6 ] + +In nf_tables_commit, if nf_tables_commit_audit_alloc fails, it does not +free the adp variable. + +Fix this by adding nf_tables_commit_audit_free which frees +the linked list with the head node adl. + +backtrace: + kmalloc include/linux/slab.h:591 [inline] + kzalloc include/linux/slab.h:721 [inline] + nf_tables_commit_audit_alloc net/netfilter/nf_tables_api.c:8439 [inline] + nf_tables_commit+0x16e/0x1760 net/netfilter/nf_tables_api.c:8508 + nfnetlink_rcv_batch+0x512/0xa80 net/netfilter/nfnetlink.c:562 + nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] + nfnetlink_rcv+0x1fa/0x220 net/netfilter/nfnetlink.c:652 + netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] + netlink_unicast+0x2c7/0x3e0 net/netlink/af_netlink.c:1340 + netlink_sendmsg+0x36b/0x6b0 net/netlink/af_netlink.c:1929 + sock_sendmsg_nosec net/socket.c:702 [inline] + sock_sendmsg+0x56/0x80 net/socket.c:722 + +Reported-by: syzbot +Reported-by: kernel test robot +Fixes: c520292f29b8 ("audit: log nftables configuration change events once per table") +Signed-off-by: Dongliang Mu +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index a5db7c59ad4e..7512bb819dff 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -8479,6 +8479,16 @@ static int nf_tables_commit_audit_alloc(struct list_head *adl, + return 0; + } + ++static void nf_tables_commit_audit_free(struct list_head *adl) ++{ ++ struct nft_audit_data *adp, *adn; ++ ++ list_for_each_entry_safe(adp, adn, adl, list) { ++ list_del(&adp->list); ++ kfree(adp); ++ } ++} ++ + static void nf_tables_commit_audit_collect(struct list_head *adl, + struct nft_table *table, u32 op) + { +@@ -8543,6 +8553,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) + ret = nf_tables_commit_audit_alloc(&adl, trans->ctx.table); + if (ret) { + nf_tables_commit_chain_prepare_cancel(net); ++ nf_tables_commit_audit_free(&adl); + return ret; + } + if (trans->msg_type == NFT_MSG_NEWRULE || +@@ -8552,6 +8563,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) + ret = nf_tables_commit_chain_prepare(net, chain); + if (ret < 0) { + nf_tables_commit_chain_prepare_cancel(net); ++ nf_tables_commit_audit_free(&adl); + return ret; + } + } +-- +2.30.2 + diff --git a/queue-5.13/netfilter-nft_nat-allow-to-specify-layer-4-protocol-.patch b/queue-5.13/netfilter-nft_nat-allow-to-specify-layer-4-protocol-.patch new file mode 100644 index 00000000000..1ddef8d8921 --- /dev/null +++ b/queue-5.13/netfilter-nft_nat-allow-to-specify-layer-4-protocol-.patch @@ -0,0 +1,36 @@ +From b4b27be804d551c94395673715be1fc0bf98ad2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jul 2021 18:22:50 +0200 +Subject: netfilter: nft_nat: allow to specify layer 4 protocol NAT only + +From: Pablo Neira Ayuso + +[ Upstream commit a33f387ecd5aafae514095c2c4a8c24f7aea7e8b ] + +nft_nat reports a bogus EAFNOSUPPORT if no layer 3 information is specified. + +Fixes: d07db9884a5f ("netfilter: nf_tables: introduce nft_validate_register_load()") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_nat.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c +index 0840c635b752..be1595d6979d 100644 +--- a/net/netfilter/nft_nat.c ++++ b/net/netfilter/nft_nat.c +@@ -201,7 +201,9 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr, + alen = sizeof_field(struct nf_nat_range, min_addr.ip6); + break; + default: +- return -EAFNOSUPPORT; ++ if (tb[NFTA_NAT_REG_ADDR_MIN]) ++ return -EAFNOSUPPORT; ++ break; + } + priv->family = family; + +-- +2.30.2 + diff --git a/queue-5.13/octeontx2-pf-dont-enable-backpressure-on-lbk-links.patch b/queue-5.13/octeontx2-pf-dont-enable-backpressure-on-lbk-links.patch new file mode 100644 index 00000000000..75f410d72b5 --- /dev/null +++ b/queue-5.13/octeontx2-pf-dont-enable-backpressure-on-lbk-links.patch @@ -0,0 +1,73 @@ +From 4fc951136053697a9f7888b85df1165e09196dd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jul 2021 13:29:37 +0530 +Subject: octeontx2-pf: Dont enable backpressure on LBK links + +From: Hariprasad Kelam + +[ Upstream commit 4c85e57575fb9e6405d02d55aef8025c60abb824 ] + +Avoid configure backpressure for LBK links as they +don't support it and enable lmacs before configuration +pause frames. + +Fixes: 75f36270990c ("octeontx2-pf: Support to enable/disable pause frames via ethtool") +Signed-off-by: Geetha sowjanya +Signed-off-by: Hariprasad Kelam +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 2 +- + .../ethernet/marvell/octeontx2/nic/otx2_common.c | 14 ++++++++------ + 2 files changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +index fac6474ad694..f43cb1407e8c 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +@@ -1243,8 +1243,8 @@ static int cgx_lmac_init(struct cgx *cgx) + + /* Add reference */ + cgx->lmac_idmap[lmac->lmac_id] = lmac; +- cgx->mac_ops->mac_pause_frm_config(cgx, lmac->lmac_id, true); + set_bit(lmac->lmac_id, &cgx->lmac_bmap); ++ cgx->mac_ops->mac_pause_frm_config(cgx, lmac->lmac_id, true); + } + + return cgx_lmac_verify_fwi_version(cgx); +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +index cf7875d51d87..16ba457197a2 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +@@ -921,12 +921,14 @@ static int otx2_cq_init(struct otx2_nic *pfvf, u16 qidx) + aq->cq.drop = RQ_DROP_LVL_CQ(pfvf->hw.rq_skid, cq->cqe_cnt); + aq->cq.drop_ena = 1; + +- /* Enable receive CQ backpressure */ +- aq->cq.bp_ena = 1; +- aq->cq.bpid = pfvf->bpid[0]; ++ if (!is_otx2_lbkvf(pfvf->pdev)) { ++ /* Enable receive CQ backpressure */ ++ aq->cq.bp_ena = 1; ++ aq->cq.bpid = pfvf->bpid[0]; + +- /* Set backpressure level is same as cq pass level */ +- aq->cq.bp = RQ_PASS_LVL_CQ(pfvf->hw.rq_skid, qset->rqe_cnt); ++ /* Set backpressure level is same as cq pass level */ ++ aq->cq.bp = RQ_PASS_LVL_CQ(pfvf->hw.rq_skid, qset->rqe_cnt); ++ } + } + + /* Fill AQ info */ +@@ -1183,7 +1185,7 @@ static int otx2_aura_init(struct otx2_nic *pfvf, int aura_id, + aq->aura.fc_hyst_bits = 0; /* Store count on all updates */ + + /* Enable backpressure for RQ aura */ +- if (aura_id < pfvf->hw.rqpool_cnt) { ++ if (aura_id < pfvf->hw.rqpool_cnt && !is_otx2_lbkvf(pfvf->pdev)) { + aq->aura.bp_ena = 0; + aq->aura.nix0_bpid = pfvf->bpid[0]; + /* Set backpressure level for RQ's Aura */ +-- +2.30.2 + diff --git a/queue-5.13/octeontx2-pf-fix-interface-down-flag-on-error.patch b/queue-5.13/octeontx2-pf-fix-interface-down-flag-on-error.patch new file mode 100644 index 00000000000..e82ae04614a --- /dev/null +++ b/queue-5.13/octeontx2-pf-fix-interface-down-flag-on-error.patch @@ -0,0 +1,89 @@ +From 583a5c3779329e19e2df3c2074043c9ab7a20999 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jul 2021 13:29:03 +0530 +Subject: octeontx2-pf: Fix interface down flag on error + +From: Geetha sowjanya + +[ Upstream commit 69f0aeb13bb548e2d5710a350116e03f0273302e ] + +In the existing code while changing the number of TX/RX +queues using ethtool the PF/VF interface resources are +freed and reallocated (otx2_stop and otx2_open is called) +if the device is in running state. If any resource allocation +fails in otx2_open, driver free already allocated resources +and return. But again, when the number of queues changes +as the device state still running oxt2_stop is called. +In which we try to free already freed resources leading +to driver crash. +This patch fixes the issue by setting the INTF_DOWN flag on +error and free the resources in otx2_stop only if the flag is +not set. + +Fixes: 50fe6c02e5ad ("octeontx2-pf: Register and handle link notifications") +Signed-off-by: Geetha sowjanya +Signed-off-by: Sunil Kovvuri Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 7 +++---- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 5 +++++ + 2 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c +index 9d9a2e438acf..ae06eeeb5a45 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c +@@ -292,15 +292,14 @@ static int otx2_set_channels(struct net_device *dev, + err = otx2_set_real_num_queues(dev, channel->tx_count, + channel->rx_count); + if (err) +- goto fail; ++ return err; + + pfvf->hw.rx_queues = channel->rx_count; + pfvf->hw.tx_queues = channel->tx_count; + pfvf->qset.cq_cnt = pfvf->hw.tx_queues + pfvf->hw.rx_queues; + +-fail: + if (if_up) +- dev->netdev_ops->ndo_open(dev); ++ err = dev->netdev_ops->ndo_open(dev); + + netdev_info(dev, "Setting num Tx rings to %d, Rx rings to %d success\n", + pfvf->hw.tx_queues, pfvf->hw.rx_queues); +@@ -404,7 +403,7 @@ static int otx2_set_ringparam(struct net_device *netdev, + qs->rqe_cnt = rx_count; + + if (if_up) +- netdev->netdev_ops->ndo_open(netdev); ++ return netdev->netdev_ops->ndo_open(netdev); + + return 0; + } +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +index 03004fdac0c6..2af50250d13c 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +@@ -1648,6 +1648,7 @@ int otx2_open(struct net_device *netdev) + err_tx_stop_queues: + netif_tx_stop_all_queues(netdev); + netif_carrier_off(netdev); ++ pf->flags |= OTX2_FLAG_INTF_DOWN; + err_free_cints: + otx2_free_cints(pf, qidx); + vec = pci_irq_vector(pf->pdev, +@@ -1675,6 +1676,10 @@ int otx2_stop(struct net_device *netdev) + struct otx2_rss_info *rss; + int qidx, vec, wrk; + ++ /* If the DOWN flag is set resources are already freed */ ++ if (pf->flags & OTX2_FLAG_INTF_DOWN) ++ return 0; ++ + netif_carrier_off(netdev); + netif_tx_stop_all_queues(netdev); + +-- +2.30.2 + diff --git a/queue-5.13/platform-x86-amd-pmc-fix-command-completion-code.patch b/queue-5.13/platform-x86-amd-pmc-fix-command-completion-code.patch new file mode 100644 index 00000000000..2d4406312a7 --- /dev/null +++ b/queue-5.13/platform-x86-amd-pmc-fix-command-completion-code.patch @@ -0,0 +1,113 @@ +From e5774522943df92f9b87e69663811b4d6dcbd3e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jun 2021 14:17:57 +0530 +Subject: platform/x86: amd-pmc: Fix command completion code + +From: Shyam Sundar S K + +[ Upstream commit 95e1b60f8dc8f225b14619e9aca9bdd7d99167db ] + +The protocol to submit a job request to SMU is to wait for +AMD_PMC_REGISTER_RESPONSE to return 1,meaning SMU is ready to take +requests. PMC driver has to make sure that the response code is always +AMD_PMC_RESULT_OK before making any command submissions. + +When we submit a message to SMU, we have to wait until it processes +the request. Adding a read_poll_timeout() check as this was missing in +the existing code. + +Also, add a mutex to protect amd_pmc_send_cmd() calls to SMU. + +Fixes: 156ec4731cb2 ("platform/x86: amd-pmc: Add AMD platform support for S2Idle") +Signed-off-by: Shyam Sundar S K +Acked-by: Raul E Rangel +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20210629084803.248498-2-Shyam-sundar.S-k@amd.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd-pmc.c | 38 ++++++++++++++++++++++++++++++++-- + 1 file changed, 36 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/amd-pmc.c b/drivers/platform/x86/amd-pmc.c +index b9da58ee9b1e..1b5f149932c1 100644 +--- a/drivers/platform/x86/amd-pmc.c ++++ b/drivers/platform/x86/amd-pmc.c +@@ -68,6 +68,7 @@ struct amd_pmc_dev { + u32 base_addr; + u32 cpu_id; + struct device *dev; ++ struct mutex lock; /* generic mutex lock */ + #if IS_ENABLED(CONFIG_DEBUG_FS) + struct dentry *dbgfs_dir; + #endif /* CONFIG_DEBUG_FS */ +@@ -138,9 +139,10 @@ static int amd_pmc_send_cmd(struct amd_pmc_dev *dev, bool set) + u8 msg; + u32 val; + ++ mutex_lock(&dev->lock); + /* Wait until we get a valid response */ + rc = readx_poll_timeout(ioread32, dev->regbase + AMD_PMC_REGISTER_RESPONSE, +- val, val > 0, PMC_MSG_DELAY_MIN_US, ++ val, val != 0, PMC_MSG_DELAY_MIN_US, + PMC_MSG_DELAY_MIN_US * RESPONSE_REGISTER_LOOP_MAX); + if (rc) { + dev_err(dev->dev, "failed to talk to SMU\n"); +@@ -156,7 +158,37 @@ static int amd_pmc_send_cmd(struct amd_pmc_dev *dev, bool set) + /* Write message ID to message ID register */ + msg = (dev->cpu_id == AMD_CPU_ID_RN) ? MSG_OS_HINT_RN : MSG_OS_HINT_PCO; + amd_pmc_reg_write(dev, AMD_PMC_REGISTER_MESSAGE, msg); +- return 0; ++ /* Wait until we get a valid response */ ++ rc = readx_poll_timeout(ioread32, dev->regbase + AMD_PMC_REGISTER_RESPONSE, ++ val, val != 0, PMC_MSG_DELAY_MIN_US, ++ PMC_MSG_DELAY_MIN_US * RESPONSE_REGISTER_LOOP_MAX); ++ if (rc) { ++ dev_err(dev->dev, "SMU response timed out\n"); ++ goto out_unlock; ++ } ++ ++ switch (val) { ++ case AMD_PMC_RESULT_OK: ++ break; ++ case AMD_PMC_RESULT_CMD_REJECT_BUSY: ++ dev_err(dev->dev, "SMU not ready. err: 0x%x\n", val); ++ rc = -EBUSY; ++ goto out_unlock; ++ case AMD_PMC_RESULT_CMD_UNKNOWN: ++ dev_err(dev->dev, "SMU cmd unknown. err: 0x%x\n", val); ++ rc = -EINVAL; ++ goto out_unlock; ++ case AMD_PMC_RESULT_CMD_REJECT_PREREQ: ++ case AMD_PMC_RESULT_FAILED: ++ default: ++ dev_err(dev->dev, "SMU cmd failed. err: 0x%x\n", val); ++ rc = -EIO; ++ goto out_unlock; ++ } ++ ++out_unlock: ++ mutex_unlock(&dev->lock); ++ return rc; + } + + static int __maybe_unused amd_pmc_suspend(struct device *dev) +@@ -259,6 +291,7 @@ static int amd_pmc_probe(struct platform_device *pdev) + + amd_pmc_dump_registers(dev); + ++ mutex_init(&dev->lock); + platform_set_drvdata(pdev, dev); + amd_pmc_dbgfs_register(dev); + return 0; +@@ -269,6 +302,7 @@ static int amd_pmc_remove(struct platform_device *pdev) + struct amd_pmc_dev *dev = platform_get_drvdata(pdev); + + amd_pmc_dbgfs_unregister(dev); ++ mutex_destroy(&dev->lock); + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.13/platform-x86-amd-pmc-fix-missing-unlock-on-error-in-.patch b/queue-5.13/platform-x86-amd-pmc-fix-missing-unlock-on-error-in-.patch new file mode 100644 index 00000000000..795c8fc3986 --- /dev/null +++ b/queue-5.13/platform-x86-amd-pmc-fix-missing-unlock-on-error-in-.patch @@ -0,0 +1,39 @@ +From 4ebc30769e598815b3aaffb89ae4cd2f02ec9eeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jul 2021 15:43:27 +0800 +Subject: platform/x86: amd-pmc: Fix missing unlock on error in + amd_pmc_send_cmd() + +From: Yang Yingliang + +[ Upstream commit 95edbbf78c3bdbd1daa921dd4a2e61c751e469ba ] + +Add the missing unlock before return from function amd_pmc_send_cmd() +in the error handling case. + +Fixes: 95e1b60f8dc8 ("platform/x86: amd-pmc: Fix command completion code") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20210715074327.1966083-1-yangyingliang@huawei.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd-pmc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/amd-pmc.c b/drivers/platform/x86/amd-pmc.c +index b1d6175a13b2..ca95c2a52e26 100644 +--- a/drivers/platform/x86/amd-pmc.c ++++ b/drivers/platform/x86/amd-pmc.c +@@ -140,7 +140,7 @@ static int amd_pmc_send_cmd(struct amd_pmc_dev *dev, bool set) + PMC_MSG_DELAY_MIN_US * RESPONSE_REGISTER_LOOP_MAX); + if (rc) { + dev_err(dev->dev, "failed to talk to SMU\n"); +- return rc; ++ goto out_unlock; + } + + /* Write zero to response register */ +-- +2.30.2 + diff --git a/queue-5.13/platform-x86-amd-pmc-fix-smu-firmware-reporting-mech.patch b/queue-5.13/platform-x86-amd-pmc-fix-smu-firmware-reporting-mech.patch new file mode 100644 index 00000000000..aa5e8a38219 --- /dev/null +++ b/queue-5.13/platform-x86-amd-pmc-fix-smu-firmware-reporting-mech.patch @@ -0,0 +1,63 @@ +From debcf394b0c81aaa8e9be0910808cde1e2c982cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jun 2021 14:17:58 +0530 +Subject: platform/x86: amd-pmc: Fix SMU firmware reporting mechanism + +From: Shyam Sundar S K + +[ Upstream commit 4c06d35dfedf4c1fd03702e0f05292a69d020e21 ] + +It was lately understood that the current mechanism available in the +driver to get SMU firmware info works only on internal SMU builds and +there is a separate way to get all the SMU logging counters (addressed +in the next patch). Hence remove all the smu info shown via debugfs as it +is no more useful. + +Fixes: 156ec4731cb2 ("platform/x86: amd-pmc: Add AMD platform support for S2Idle") +Signed-off-by: Shyam Sundar S K +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20210629084803.248498-3-Shyam-sundar.S-k@amd.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd-pmc.c | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/drivers/platform/x86/amd-pmc.c b/drivers/platform/x86/amd-pmc.c +index 1b5f149932c1..b1d6175a13b2 100644 +--- a/drivers/platform/x86/amd-pmc.c ++++ b/drivers/platform/x86/amd-pmc.c +@@ -52,7 +52,6 @@ + #define AMD_CPU_ID_PCO AMD_CPU_ID_RV + #define AMD_CPU_ID_CZN AMD_CPU_ID_RN + +-#define AMD_SMU_FW_VERSION 0x0 + #define PMC_MSG_DELAY_MIN_US 100 + #define RESPONSE_REGISTER_LOOP_MAX 200 + +@@ -89,11 +88,6 @@ static inline void amd_pmc_reg_write(struct amd_pmc_dev *dev, int reg_offset, u3 + #ifdef CONFIG_DEBUG_FS + static int smu_fw_info_show(struct seq_file *s, void *unused) + { +- struct amd_pmc_dev *dev = s->private; +- u32 value; +- +- value = ioread32(dev->smu_base + AMD_SMU_FW_VERSION); +- seq_printf(s, "SMU FW Info: %x\n", value); + return 0; + } + DEFINE_SHOW_ATTRIBUTE(smu_fw_info); +@@ -280,10 +274,6 @@ static int amd_pmc_probe(struct platform_device *pdev) + pci_dev_put(rdev); + base_addr = ((u64)base_addr_hi << 32 | base_addr_lo); + +- dev->smu_base = devm_ioremap(dev->dev, base_addr, AMD_PMC_MAPPING_SIZE); +- if (!dev->smu_base) +- return -ENOMEM; +- + dev->regbase = devm_ioremap(dev->dev, base_addr + AMD_PMC_BASE_ADDR_OFFSET, + AMD_PMC_MAPPING_SIZE); + if (!dev->regbase) +-- +2.30.2 + diff --git a/queue-5.13/rdma-bnxt_re-fix-stats-counters.patch b/queue-5.13/rdma-bnxt_re-fix-stats-counters.patch new file mode 100644 index 00000000000..c5ef7def90f --- /dev/null +++ b/queue-5.13/rdma-bnxt_re-fix-stats-counters.patch @@ -0,0 +1,110 @@ +From 60a6256aa322258c3aa37f09fa948dfe5a553df3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Jul 2021 06:31:36 -0700 +Subject: RDMA/bnxt_re: Fix stats counters + +From: Naresh Kumar PBS + +[ Upstream commit 0c23af52ccd1605926480b5dfd1dd857ef604611 ] + +Statistical counters are not incrementing in some adapter versions with +newer FW. This is due to the stats context length mismatch between FW and +driver. Since the L2 driver updates the length correctly, use the stats +length from L2 driver while allocating the DMA'able memory and creating +the stats context. + +Fixes: 9d6b648c3112 ("bnxt_en: Update firmware interface spec to 1.10.1.65.") +Link: https://lore.kernel.org/r/1626010296-6076-1-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Naresh Kumar PBS +Signed-off-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/main.c | 4 +++- + drivers/infiniband/hw/bnxt_re/qplib_res.c | 10 ++++------ + drivers/infiniband/hw/bnxt_re/qplib_res.h | 1 + + 3 files changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c +index 8bfbf0231a9e..25550d982238 100644 +--- a/drivers/infiniband/hw/bnxt_re/main.c ++++ b/drivers/infiniband/hw/bnxt_re/main.c +@@ -120,6 +120,7 @@ static int bnxt_re_setup_chip_ctx(struct bnxt_re_dev *rdev, u8 wqe_mode) + if (!chip_ctx) + return -ENOMEM; + chip_ctx->chip_num = bp->chip_num; ++ chip_ctx->hw_stats_size = bp->hw_ring_stats_size; + + rdev->chip_ctx = chip_ctx; + /* rest members to follow eventually */ +@@ -547,6 +548,7 @@ static int bnxt_re_net_stats_ctx_alloc(struct bnxt_re_dev *rdev, + dma_addr_t dma_map, + u32 *fw_stats_ctx_id) + { ++ struct bnxt_qplib_chip_ctx *chip_ctx = rdev->chip_ctx; + struct hwrm_stat_ctx_alloc_output resp = {0}; + struct hwrm_stat_ctx_alloc_input req = {0}; + struct bnxt_en_dev *en_dev = rdev->en_dev; +@@ -563,7 +565,7 @@ static int bnxt_re_net_stats_ctx_alloc(struct bnxt_re_dev *rdev, + bnxt_re_init_hwrm_hdr(rdev, (void *)&req, HWRM_STAT_CTX_ALLOC, -1, -1); + req.update_period_ms = cpu_to_le32(1000); + req.stats_dma_addr = cpu_to_le64(dma_map); +- req.stats_dma_length = cpu_to_le16(sizeof(struct ctx_hw_stats_ext)); ++ req.stats_dma_length = cpu_to_le16(chip_ctx->hw_stats_size); + req.stat_ctx_flags = STAT_CTX_ALLOC_REQ_STAT_CTX_FLAGS_ROCE; + bnxt_re_fill_fw_msg(&fw_msg, (void *)&req, sizeof(req), (void *)&resp, + sizeof(resp), DFLT_HWRM_CMD_TIMEOUT); +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c +index 3ca47004b752..754dcebeb4ca 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_res.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c +@@ -56,6 +56,7 @@ + static void bnxt_qplib_free_stats_ctx(struct pci_dev *pdev, + struct bnxt_qplib_stats *stats); + static int bnxt_qplib_alloc_stats_ctx(struct pci_dev *pdev, ++ struct bnxt_qplib_chip_ctx *cctx, + struct bnxt_qplib_stats *stats); + + /* PBL */ +@@ -559,7 +560,7 @@ int bnxt_qplib_alloc_ctx(struct bnxt_qplib_res *res, + goto fail; + stats_alloc: + /* Stats */ +- rc = bnxt_qplib_alloc_stats_ctx(res->pdev, &ctx->stats); ++ rc = bnxt_qplib_alloc_stats_ctx(res->pdev, res->cctx, &ctx->stats); + if (rc) + goto fail; + +@@ -889,15 +890,12 @@ static void bnxt_qplib_free_stats_ctx(struct pci_dev *pdev, + } + + static int bnxt_qplib_alloc_stats_ctx(struct pci_dev *pdev, ++ struct bnxt_qplib_chip_ctx *cctx, + struct bnxt_qplib_stats *stats) + { + memset(stats, 0, sizeof(*stats)); + stats->fw_id = -1; +- /* 128 byte aligned context memory is required only for 57500. +- * However making this unconditional, it does not harm previous +- * generation. +- */ +- stats->size = ALIGN(sizeof(struct ctx_hw_stats), 128); ++ stats->size = cctx->hw_stats_size; + stats->dma = dma_alloc_coherent(&pdev->dev, stats->size, + &stats->dma_map, GFP_KERNEL); + if (!stats->dma) { +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.h b/drivers/infiniband/hw/bnxt_re/qplib_res.h +index 7a1ab38b95da..58bad6f78456 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_res.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_res.h +@@ -60,6 +60,7 @@ struct bnxt_qplib_chip_ctx { + u16 chip_num; + u8 chip_rev; + u8 chip_metal; ++ u16 hw_stats_size; + struct bnxt_qplib_drv_modes modes; + }; + +-- +2.30.2 + diff --git a/queue-5.13/rdma-rxe-fix-memory-leak-in-error-path-code.patch b/queue-5.13/rdma-rxe-fix-memory-leak-in-error-path-code.patch new file mode 100644 index 00000000000..5657aca14bd --- /dev/null +++ b/queue-5.13/rdma-rxe-fix-memory-leak-in-error-path-code.patch @@ -0,0 +1,96 @@ +From ff5a0a2107ead65bef19c2563f242a5954d52613 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jul 2021 11:41:54 -0500 +Subject: RDMA/rxe: Fix memory leak in error path code +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bob Pearson + +[ Upstream commit b18c7da63fcb46e2f9a093cc18d7c219e13a887c ] + +In rxe_mr_init_user() at the third error the driver fails to free the +memory at mr->map. This patch adds code to do that. This error only +occurs if page_address() fails to return a non zero address which should +never happen for 64 bit architectures. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Link: https://lore.kernel.org/r/20210705164153.17652-1-rpearsonhpe@gmail.com +Reported by: Haakon Bugge +Signed-off-by: Bob Pearson +Reviewed-by: Zhu Yanjun +Reviewed-by: Håkon Bugge +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_mr.c | 27 +++++++++++++++++---------- + 1 file changed, 17 insertions(+), 10 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c +index fe2b7d223183..fa3d29825ef6 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mr.c ++++ b/drivers/infiniband/sw/rxe/rxe_mr.c +@@ -130,13 +130,14 @@ int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova, + int num_buf; + void *vaddr; + int err; ++ int i; + + umem = ib_umem_get(pd->ibpd.device, start, length, access); + if (IS_ERR(umem)) { +- pr_warn("err %d from rxe_umem_get\n", +- (int)PTR_ERR(umem)); ++ pr_warn("%s: Unable to pin memory region err = %d\n", ++ __func__, (int)PTR_ERR(umem)); + err = PTR_ERR(umem); +- goto err1; ++ goto err_out; + } + + mr->umem = umem; +@@ -146,9 +147,9 @@ int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova, + + err = rxe_mr_alloc(mr, num_buf); + if (err) { +- pr_warn("err %d from rxe_mr_alloc\n", err); +- ib_umem_release(umem); +- goto err1; ++ pr_warn("%s: Unable to allocate memory for map\n", ++ __func__); ++ goto err_release_umem; + } + + mr->page_shift = PAGE_SHIFT; +@@ -168,10 +169,10 @@ int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova, + + vaddr = page_address(sg_page_iter_page(&sg_iter)); + if (!vaddr) { +- pr_warn("null vaddr\n"); +- ib_umem_release(umem); ++ pr_warn("%s: Unable to get virtual address\n", ++ __func__); + err = -ENOMEM; +- goto err1; ++ goto err_cleanup_map; + } + + buf->addr = (uintptr_t)vaddr; +@@ -194,7 +195,13 @@ int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova, + + return 0; + +-err1: ++err_cleanup_map: ++ for (i = 0; i < mr->num_map; i++) ++ kfree(mr->map[i]); ++ kfree(mr->map); ++err_release_umem: ++ ib_umem_release(umem); ++err_out: + return err; + } + +-- +2.30.2 + diff --git a/queue-5.13/sctp-fix-return-value-check-in-__sctp_rcv_asconf_loo.patch b/queue-5.13/sctp-fix-return-value-check-in-__sctp_rcv_asconf_loo.patch new file mode 100644 index 00000000000..d01ee2d8b3a --- /dev/null +++ b/queue-5.13/sctp-fix-return-value-check-in-__sctp_rcv_asconf_loo.patch @@ -0,0 +1,38 @@ +From 6c32b0406eb2253056b7584985cafd0275256a54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jul 2021 23:40:54 -0300 +Subject: sctp: fix return value check in __sctp_rcv_asconf_lookup + +From: Marcelo Ricardo Leitner + +[ Upstream commit 557fb5862c9272ad9b21407afe1da8acfd9b53eb ] + +As Ben Hutchings noticed, this check should have been inverted: the call +returns true in case of success. + +Reported-by: Ben Hutchings +Fixes: 0c5dc070ff3d ("sctp: validate from_addr_param return") +Signed-off-by: Marcelo Ricardo Leitner +Reviewed-by: Xin Long +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sctp/input.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sctp/input.c b/net/sctp/input.c +index f72bff93745c..ddb5b5c2550e 100644 +--- a/net/sctp/input.c ++++ b/net/sctp/input.c +@@ -1175,7 +1175,7 @@ static struct sctp_association *__sctp_rcv_asconf_lookup( + if (unlikely(!af)) + return NULL; + +- if (af->from_addr_param(&paddr, param, peer_port, 0)) ++ if (!af->from_addr_param(&paddr, param, peer_port, 0)) + return NULL; + + return __sctp_lookup_association(net, laddr, &paddr, transportp); +-- +2.30.2 + diff --git a/queue-5.13/series b/queue-5.13/series index a02203e2e93..502733d923b 100644 --- a/queue-5.13/series +++ b/queue-5.13/series @@ -32,3 +32,59 @@ io_uring-fix-io_prep_async_link-locking.patch io_uring-don-t-block-level-reissue-off-completion-path.patch io_uring-fix-poll-requests-leaking-second-poll-entries.patch cfg80211-fix-possible-memory-leak-in-function-cfg80211_bss_update.patch +rdma-bnxt_re-fix-stats-counters.patch +platform-x86-amd-pmc-fix-command-completion-code.patch +platform-x86-amd-pmc-fix-smu-firmware-reporting-mech.patch +platform-x86-amd-pmc-fix-missing-unlock-on-error-in-.patch +rdma-rxe-fix-memory-leak-in-error-path-code.patch +netfilter-nf_tables-fix-audit-memory-leak-in-nf_tabl.patch +bpf-fix-oob-read-when-printing-xdp-link-fdinfo.patch +mac80211-fix-enabling-4-address-mode-on-a-sta-vif-af.patch +netfilter-conntrack-adjust-stop-timestamp-to-real-ex.patch +netfilter-nft_nat-allow-to-specify-layer-4-protocol-.patch +i40e-fix-logic-of-disabling-queues.patch +i40e-fix-firmware-lldp-agent-related-warning.patch +i40e-fix-queue-to-tc-mapping-on-tx.patch +i40e-fix-log-tc-creation-failure-when-max-num-of-que.patch +tipc-fix-implicit-connect-for-syn.patch +tipc-fix-sleeping-in-tipc-accept-routine.patch +net-set-true-network-header-for-ecn-decapsulation.patch +net-dsa-mv88e6xxx-silently-accept-the-deletion-of-vi.patch +loop-reintroduce-global-lock-for-safe-loop_validate_.patch +net-qrtr-fix-memory-leaks.patch +ionic-make-all-rx_mode-work-threadsafe.patch +ionic-catch-no-ptp-support-earlier.patch +ionic-remove-intr-coalesce-update-from-napi.patch +ionic-fix-up-dim-accounting-for-tx-and-rx.patch +ionic-count-csum_none-when-offload-enabled.patch +can-mcp251xfd-mcp251xfd_irq-stop-timestamping-worker.patch +tipc-do-not-write-skb_shinfo-frags-when-doing-decryt.patch +octeontx2-pf-fix-interface-down-flag-on-error.patch +octeontx2-pf-dont-enable-backpressure-on-lbk-links.patch +net-phy-broadcom-re-add-check-for-phy_brcm_dis_txcrx.patch +mlx4-fix-missing-error-code-in-mlx4_load_one.patch +drm-panel-panel-simple-fix-proper-bpc-for-ytc700tlag.patch +drm-i915-bios-fix-ports-mask.patch +kvm-x86-check-the-right-feature-bit-for-msr_kvm_asyn.patch +net-llc-fix-skb_over_panic.patch +drm-msm-dpu-fix-sm8250_mdp-register-length.patch +drm-msm-dp-use-dp_ctrl_off_link_stream-during-phy-co.patch +drm-msm-dp-initialize-the-intf_config-register.patch +kvm-selftests-fix-missing-break-in-dirty_log_perf_te.patch +bpf-sockmap-zap-ingress-queues-after-stopping-strpar.patch +net-mlx5-fix-flow-table-chaining.patch +net-mlx5e-disable-rx-ntuple-offload-for-uplink-repre.patch +net-mlx5-e-switch-set-destination-vport-vhca-id-only.patch +net-mlx5-e-switch-handle-devcom-events-only-for-port.patch +net-mlx5e-rx-avoid-possible-data-corruption-when-rel.patch +net-mlx5e-add-netif_f_hw_tc-to-hw_features-when-htb-.patch +net-mlx5e-fix-page-allocation-failure-for-trap-rq-ov.patch +net-mlx5e-fix-page-allocation-failure-for-ptp-rq-ove.patch +net-mlx5-unload-device-upon-firmware-fatal-error.patch +net-mlx5e-fix-nullptr-in-mlx5e_hairpin_get_mdev.patch +net-mlx5-fix-mlx5_vport_tbl_attr-chain-from-u16-to-u.patch +block-delay-freeing-the-gendisk.patch +sctp-fix-return-value-check-in-__sctp_rcv_asconf_loo.patch +tulip-windbond-840-fix-missing-pci_disable_device-in.patch +sis900-fix-missing-pci_disable_device-in-probe-and-r.patch +can-hi311x-fix-a-signedness-bug-in-hi3110_cmd.patch diff --git a/queue-5.13/sis900-fix-missing-pci_disable_device-in-probe-and-r.patch b/queue-5.13/sis900-fix-missing-pci_disable_device-in-probe-and-r.patch new file mode 100644 index 00000000000..c623feddb45 --- /dev/null +++ b/queue-5.13/sis900-fix-missing-pci_disable_device-in-probe-and-r.patch @@ -0,0 +1,64 @@ +From a6eb0dfb37233f98c61f0c8dbfbeb5aebfc11b80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jul 2021 20:11:07 +0800 +Subject: sis900: Fix missing pci_disable_device() in probe and remove + +From: Wang Hai + +[ Upstream commit 89fb62fde3b226f99b7015280cf132e2a7438edf ] + +Replace pci_enable_device() with pcim_enable_device(), +pci_disable_device() and pci_release_regions() will be +called in release automatically. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sis/sis900.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/sis/sis900.c b/drivers/net/ethernet/sis/sis900.c +index 620c26f71be8..e267b7ce3a45 100644 +--- a/drivers/net/ethernet/sis/sis900.c ++++ b/drivers/net/ethernet/sis/sis900.c +@@ -443,7 +443,7 @@ static int sis900_probe(struct pci_dev *pci_dev, + #endif + + /* setup various bits in PCI command register */ +- ret = pci_enable_device(pci_dev); ++ ret = pcim_enable_device(pci_dev); + if(ret) return ret; + + i = dma_set_mask(&pci_dev->dev, DMA_BIT_MASK(32)); +@@ -469,7 +469,7 @@ static int sis900_probe(struct pci_dev *pci_dev, + ioaddr = pci_iomap(pci_dev, 0, 0); + if (!ioaddr) { + ret = -ENOMEM; +- goto err_out_cleardev; ++ goto err_out; + } + + sis_priv = netdev_priv(net_dev); +@@ -581,8 +581,6 @@ err_unmap_tx: + sis_priv->tx_ring_dma); + err_out_unmap: + pci_iounmap(pci_dev, ioaddr); +-err_out_cleardev: +- pci_release_regions(pci_dev); + err_out: + free_netdev(net_dev); + return ret; +@@ -2499,7 +2497,6 @@ static void sis900_remove(struct pci_dev *pci_dev) + sis_priv->tx_ring_dma); + pci_iounmap(pci_dev, sis_priv->ioaddr); + free_netdev(net_dev); +- pci_release_regions(pci_dev); + } + + static int __maybe_unused sis900_suspend(struct device *dev) +-- +2.30.2 + diff --git a/queue-5.13/tipc-do-not-write-skb_shinfo-frags-when-doing-decryt.patch b/queue-5.13/tipc-do-not-write-skb_shinfo-frags-when-doing-decryt.patch new file mode 100644 index 00000000000..684791d6160 --- /dev/null +++ b/queue-5.13/tipc-do-not-write-skb_shinfo-frags-when-doing-decryt.patch @@ -0,0 +1,60 @@ +From 218166b8d4ae742060f8aef1aef759797ce5c99e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jul 2021 18:46:01 -0400 +Subject: tipc: do not write skb_shinfo frags when doing decrytion + +From: Xin Long + +[ Upstream commit 3cf4375a090473d240281a0d2b04a3a5aaeac34b ] + +One skb's skb_shinfo frags are not writable, and they can be shared with +other skbs' like by pskb_copy(). To write the frags may cause other skb's +data crash. + +So before doing en/decryption, skb_cow_data() should always be called for +a cloned or nonlinear skb if req dst is using the same sg as req src. +While at it, the likely branch can be removed, as it will be covered +by skb_cow_data(). + +Note that esp_input() has the same issue, and I will fix it in another +patch. tipc_aead_encrypt() doesn't have this issue, as it only processes +linear data in the unlikely branch. + +Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication") +Reported-by: Shuang Li +Signed-off-by: Xin Long +Acked-by: Jon Maloy +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/crypto.c | 14 ++++---------- + 1 file changed, 4 insertions(+), 10 deletions(-) + +diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c +index e5c43d4d5a75..c9391d38de85 100644 +--- a/net/tipc/crypto.c ++++ b/net/tipc/crypto.c +@@ -898,16 +898,10 @@ static int tipc_aead_decrypt(struct net *net, struct tipc_aead *aead, + if (unlikely(!aead)) + return -ENOKEY; + +- /* Cow skb data if needed */ +- if (likely(!skb_cloned(skb) && +- (!skb_is_nonlinear(skb) || !skb_has_frag_list(skb)))) { +- nsg = 1 + skb_shinfo(skb)->nr_frags; +- } else { +- nsg = skb_cow_data(skb, 0, &unused); +- if (unlikely(nsg < 0)) { +- pr_err("RX: skb_cow_data() returned %d\n", nsg); +- return nsg; +- } ++ nsg = skb_cow_data(skb, 0, &unused); ++ if (unlikely(nsg < 0)) { ++ pr_err("RX: skb_cow_data() returned %d\n", nsg); ++ return nsg; + } + + /* Allocate memory for the AEAD operation */ +-- +2.30.2 + diff --git a/queue-5.13/tipc-fix-implicit-connect-for-syn.patch b/queue-5.13/tipc-fix-implicit-connect-for-syn.patch new file mode 100644 index 00000000000..3a3531b3ec6 --- /dev/null +++ b/queue-5.13/tipc-fix-implicit-connect-for-syn.patch @@ -0,0 +1,109 @@ +From 24144554c03425fc1cf6470810b9d6ed0a16fb5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jul 2021 12:05:41 -0400 +Subject: tipc: fix implicit-connect for SYN+ + +From: Xin Long + +[ Upstream commit f8dd60de194817c86bf812700980762bb5a8d9a4 ] + +For implicit-connect, when it's either SYN- or SYN+, an ACK should +be sent back to the client immediately. It's not appropriate for +the client to enter established state only after receiving data +from the server. + +On client side, after the SYN is sent out, tipc_wait_for_connect() +should be called to wait for the ACK if timeout is set. + +This patch also restricts __tipc_sendstream() to call __sendmsg() +only when it's in TIPC_OPEN state, so that the client can program +in a single loop doing both connecting and data sending like: + + for (...) + sendmsg(dest, buf); + +This makes the implicit-connect more implicit. + +Fixes: b97bf3fd8f6a ("[TIPC] Initial merge") +Signed-off-by: Xin Long +Acked-by: Jon Maloy +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/socket.c | 21 +++++++++++++-------- + 1 file changed, 13 insertions(+), 8 deletions(-) + +diff --git a/net/tipc/socket.c b/net/tipc/socket.c +index 53af72824c9c..c52b0d00887b 100644 +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -160,6 +160,7 @@ static void tipc_sk_remove(struct tipc_sock *tsk); + static int __tipc_sendstream(struct socket *sock, struct msghdr *m, size_t dsz); + static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dsz); + static void tipc_sk_push_backlog(struct tipc_sock *tsk, bool nagle_ack); ++static int tipc_wait_for_connect(struct socket *sock, long *timeo_p); + + static const struct proto_ops packet_ops; + static const struct proto_ops stream_ops; +@@ -1525,8 +1526,13 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dlen) + rc = 0; + } + +- if (unlikely(syn && !rc)) ++ if (unlikely(syn && !rc)) { + tipc_set_sk_state(sk, TIPC_CONNECTING); ++ if (timeout) { ++ timeout = msecs_to_jiffies(timeout); ++ tipc_wait_for_connect(sock, &timeout); ++ } ++ } + + return rc ? rc : dlen; + } +@@ -1574,7 +1580,7 @@ static int __tipc_sendstream(struct socket *sock, struct msghdr *m, size_t dlen) + return -EMSGSIZE; + + /* Handle implicit connection setup */ +- if (unlikely(dest)) { ++ if (unlikely(dest && sk->sk_state == TIPC_OPEN)) { + rc = __tipc_sendmsg(sock, m, dlen); + if (dlen && dlen == rc) { + tsk->peer_caps = tipc_node_get_capabilities(net, dnode); +@@ -2708,9 +2714,10 @@ static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags, + bool kern) + { + struct sock *new_sk, *sk = sock->sk; +- struct sk_buff *buf; + struct tipc_sock *new_tsock; ++ struct msghdr m = {NULL,}; + struct tipc_msg *msg; ++ struct sk_buff *buf; + long timeo; + int res; + +@@ -2755,19 +2762,17 @@ static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags, + } + + /* +- * Respond to 'SYN-' by discarding it & returning 'ACK'-. +- * Respond to 'SYN+' by queuing it on new socket. ++ * Respond to 'SYN-' by discarding it & returning 'ACK'. ++ * Respond to 'SYN+' by queuing it on new socket & returning 'ACK'. + */ + if (!msg_data_sz(msg)) { +- struct msghdr m = {NULL,}; +- + tsk_advance_rx_queue(sk); +- __tipc_sendstream(new_sock, &m, 0); + } else { + __skb_dequeue(&sk->sk_receive_queue); + __skb_queue_head(&new_sk->sk_receive_queue, buf); + skb_set_owner_r(buf, new_sk); + } ++ __tipc_sendstream(new_sock, &m, 0); + release_sock(new_sk); + exit: + release_sock(sk); +-- +2.30.2 + diff --git a/queue-5.13/tipc-fix-sleeping-in-tipc-accept-routine.patch b/queue-5.13/tipc-fix-sleeping-in-tipc-accept-routine.patch new file mode 100644 index 00000000000..6c0eede55eb --- /dev/null +++ b/queue-5.13/tipc-fix-sleeping-in-tipc-accept-routine.patch @@ -0,0 +1,62 @@ +From 8b4b9b3971199d0cf55f92accadf85a522f23398 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jul 2021 09:25:34 +0700 +Subject: tipc: fix sleeping in tipc accept routine + +From: Hoang Le + +[ Upstream commit d237a7f11719ff9320721be5818352e48071aab6 ] + +The release_sock() is blocking function, it would change the state +after sleeping. In order to evaluate the stated condition outside +the socket lock context, switch to use wait_woken() instead. + +Fixes: 6398e23cdb1d8 ("tipc: standardize accept routine") +Acked-by: Jon Maloy +Signed-off-by: Hoang Le +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/socket.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/net/tipc/socket.c b/net/tipc/socket.c +index c52b0d00887b..9bdc5147a65a 100644 +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -2671,7 +2671,7 @@ static int tipc_listen(struct socket *sock, int len) + static int tipc_wait_for_accept(struct socket *sock, long timeo) + { + struct sock *sk = sock->sk; +- DEFINE_WAIT(wait); ++ DEFINE_WAIT_FUNC(wait, woken_wake_function); + int err; + + /* True wake-one mechanism for incoming connections: only +@@ -2680,12 +2680,12 @@ static int tipc_wait_for_accept(struct socket *sock, long timeo) + * anymore, the common case will execute the loop only once. + */ + for (;;) { +- prepare_to_wait_exclusive(sk_sleep(sk), &wait, +- TASK_INTERRUPTIBLE); + if (timeo && skb_queue_empty(&sk->sk_receive_queue)) { ++ add_wait_queue(sk_sleep(sk), &wait); + release_sock(sk); +- timeo = schedule_timeout(timeo); ++ timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); + lock_sock(sk); ++ remove_wait_queue(sk_sleep(sk), &wait); + } + err = 0; + if (!skb_queue_empty(&sk->sk_receive_queue)) +@@ -2697,7 +2697,6 @@ static int tipc_wait_for_accept(struct socket *sock, long timeo) + if (signal_pending(current)) + break; + } +- finish_wait(sk_sleep(sk), &wait); + return err; + } + +-- +2.30.2 + diff --git a/queue-5.13/tulip-windbond-840-fix-missing-pci_disable_device-in.patch b/queue-5.13/tulip-windbond-840-fix-missing-pci_disable_device-in.patch new file mode 100644 index 00000000000..8fae5a9ec90 --- /dev/null +++ b/queue-5.13/tulip-windbond-840-fix-missing-pci_disable_device-in.patch @@ -0,0 +1,65 @@ +From 9c0b7ef4719cb57643102ccb53da28bd1a8792bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jul 2021 15:43:13 +0800 +Subject: tulip: windbond-840: Fix missing pci_disable_device() in probe and + remove + +From: Wang Hai + +[ Upstream commit 76a16be07b209a3f507c72abe823bd3af1c8661a ] + +Replace pci_enable_device() with pcim_enable_device(), +pci_disable_device() and pci_release_regions() will be +called in release automatically. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dec/tulip/winbond-840.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/dec/tulip/winbond-840.c b/drivers/net/ethernet/dec/tulip/winbond-840.c +index 514df170ec5d..c967e0e859e5 100644 +--- a/drivers/net/ethernet/dec/tulip/winbond-840.c ++++ b/drivers/net/ethernet/dec/tulip/winbond-840.c +@@ -357,7 +357,7 @@ static int w840_probe1(struct pci_dev *pdev, const struct pci_device_id *ent) + int i, option = find_cnt < MAX_UNITS ? options[find_cnt] : 0; + void __iomem *ioaddr; + +- i = pci_enable_device(pdev); ++ i = pcim_enable_device(pdev); + if (i) return i; + + pci_set_master(pdev); +@@ -379,7 +379,7 @@ static int w840_probe1(struct pci_dev *pdev, const struct pci_device_id *ent) + + ioaddr = pci_iomap(pdev, TULIP_BAR, netdev_res_size); + if (!ioaddr) +- goto err_out_free_res; ++ goto err_out_netdev; + + for (i = 0; i < 3; i++) + ((__le16 *)dev->dev_addr)[i] = cpu_to_le16(eeprom_read(ioaddr, i)); +@@ -458,8 +458,6 @@ static int w840_probe1(struct pci_dev *pdev, const struct pci_device_id *ent) + + err_out_cleardev: + pci_iounmap(pdev, ioaddr); +-err_out_free_res: +- pci_release_regions(pdev); + err_out_netdev: + free_netdev (dev); + return -ENODEV; +@@ -1526,7 +1524,6 @@ static void w840_remove1(struct pci_dev *pdev) + if (dev) { + struct netdev_private *np = netdev_priv(dev); + unregister_netdev(dev); +- pci_release_regions(pdev); + pci_iounmap(pdev, np->base_addr); + free_netdev(dev); + } +-- +2.30.2 + -- 2.47.3