From 5a80b7f4bef0792be56238ed87bb1cc1d0bd8403 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 17 Jul 2022 10:52:37 -0400 Subject: [PATCH] Fixes for 5.15 Signed-off-by: Sasha Levin --- ...cpi_video_handles_brightness_key_pre.patch | 99 ++++++++ ...re-bhb-avoid-pr_info-every-time-a-cp.patch | 58 +++++ ...-the-fdt_fixed-sections-as-shareable.patch | 153 ++++++++++++ ...s-at91-sama5d2-fix-typo-in-i2s1-node.patch | 40 ++++ ...6qdl-ts7970-fix-ngpio-typo-and-count.patch | 39 ++++ ...x-spi-nor-campatible-on-orange-pi-ze.patch | 40 ++++ ...om-bcm4908-fix-cpu-node-for-smp-boot.patch | 38 +++ ...om-bcm4908-fix-timer-node-for-bcm490.patch | 43 ++++ ...ke-correct-the-handling-of-fmt_confi.patch | 133 +++++++++++ ...ke-correct-the-ssp-rate-discovery-in.patch | 48 ++++ ...gtl5000-fix-noise-on-shutdown-remove.patch | 79 +++++++ .../asoc-tas2764-add-post-reset-delays.patch | 69 ++++++ ...as2764-correct-playback-volume-range.patch | 43 ++++ ...fix-amp-gain-register-offset-default.patch | 52 +++++ ...x-and-extend-fsync-polarity-handling.patch | 135 +++++++++++ queue-5.15/bnxt_en-fix-bnxt_refclk_read.patch | 60 +++++ ...ix-bnxt_reinit_after_abort-code-path.patch | 52 +++++ ...s-read-ops-to-use-rreq-inode-instead.patch | 54 +++++ .../cipso-fix-data-races-around-sysctl.patch | 95 ++++++++ ...only-use-depth-36-bpp-linebuffers-on.patch | 68 ++++++ .../drm-amd-pm-prevent-divide-by-zero.patch | 46 ++++ .../drm-i915-dg2-add-wa_22011100796.patch | 46 ++++ ...ossible-refcount-leak-in-intel_dp_ad.patch | 44 ++++ ...alize-grdom-access-between-multiple-.patch | 124 ++++++++++ ...alize-tlb-invalidates-with-gt-resets.patch | 76 ++++++ ...err-vs-null-bug-in-intel_gvt_update_.patch | 44 ++++ ...quire-the-vm-mutex-for-i915_vma_bind.patch | 120 ++++++++++ ...ts-fix-a-couple-is_err-vs-null-tests.patch | 53 +++++ ...c-correctly-track-uc_fw-init-failure.patch | 133 +++++++++++ ...race-around-sysctl_icmp_errors_use_i.patch | 50 ++++ ...race-around-sysctl_icmp_ignore_bogus.patch | 51 ++++ ...ta-race-around-sysctl_icmp_ratelimit.patch | 37 +++ ...ata-race-around-sysctl_icmp_ratemask.patch | 36 +++ .../icmp-fix-data-races-around-sysctl.patch | 42 ++++ ...ces-around-sysctl_icmp_echo_enable_p.patch | 51 ++++ ...ial-integer-overflow-in-ima_appraise.patch | 37 +++ ...ntial-memory-leak-in-ima_init_crypto.patch | 36 +++ ...ure-verification-when-config_kexec_s.patch | 87 +++++++ ...netpeer-fix-data-races-around-sysctl.patch | 52 +++++ ...data-race-around-sysctl_fib_sync_mem.patch | 36 +++ ...-data-races-around-sysctl_ip_dynaddr.patch | 59 +++++ ...itialize-struct-kvm_lapic_irq-in-kvm.patch | 60 +++++ queue-5.15/lockd-fix-nlm_close_files.patch | 44 ++++ ...kd-set-fl_owner-when-unlocking-files.patch | 54 +++++ ...ssing-numa_stat-when-config_hugetlb_.patch | 66 ++++++ ...tic-remove-aq_nic_deinit-when-resume.patch | 61 +++++ ...ove-deep-parameter-on-suspend-resume.patch | 101 ++++++++ ...am65-cpsw-fix-devlink-port-register-.patch | 95 ++++++++ ...net-fix-data-races-around-sysctl_mem.patch | 36 +++ ...ld-reference-returned-by-of_get_chil.patch | 57 +++++ ...pability-check-for-updating-vnic-env.patch | 42 ++++ ...abling-sriov-while-tc-nic-rules-are-.patch | 60 +++++ ...s-fix-build-time-constant-test-in-rx.patch | 38 +++ ...s-fix-build-time-constant-test-in-tx.patch | 38 +++ ...e-ring-the-tx-doorbell-on-dma-errors.patch | 123 ++++++++++ ...os-disable-split-header-for-tegra194.patch | 47 ++++ .../net-stmmac-fix-leaks-in-probe.patch | 46 ++++ ...-check-for-errors-in-tls_device_init.patch | 83 +++++++ ...g-incorrect-offset-to-network-header.patch | 70 ++++++ ...les-replace-bug_on-by-element-length.patch | 220 ++++++++++++++++++ ...ata-races-around-nexthop_compat_mode.patch | 74 ++++++ ...race-around-sysctl_raw_l3mdev_accept.patch | 36 +++ ...ulk-optional-exclusive-control-gette.patch | 47 ++++ ...-skb-checksum-in-bpf_push_seg6_encap.patch | 44 ++++ ...cksum-evaluation-in-srh-encapsulatio.patch | 73 ++++++ ...cksum-in-srv6-end.b6-and-end.b6.enca.patch | 51 ++++ queue-5.15/series | 81 +++++++ ...fc-fix-kernel-panic-when-creating-vf.patch | 71 ++++++ ...-use-after-free-when-disabling-sriov.patch | 113 +++++++++ ...-limit-max-transfer-and-message-size.patch | 70 ++++++ ...sctl-fix-data-races-in-proc_dointvec.patch | 51 ++++ ...-data-races-in-proc_dointvec_jiffies.patch | 48 ++++ ...x-data-races-in-proc_dointvec_minmax.patch | 42 ++++ ...ta-races-in-proc_dointvec_ms_jiffies.patch | 56 +++++ ...ix-data-races-in-proc_dou8vec_minmax.patch | 49 ++++ ...ctl-fix-data-races-in-proc_douintvec.patch | 45 ++++ ...-data-races-in-proc_douintvec_minmax.patch | 42 ++++ ...data-races-in-proc_doulongvec_minmax.patch | 45 ++++ ...-race-around-sysctl_tcp_ecn_fallback.patch | 50 ++++ ...a-race-around-sysctl_tcp_max_orphans.patch | 37 +++ ...-sleeping-while-atomic-in-kdb-ftdump.patch | 71 ++++++ ...e-failure-to-unmap-invalid_grant_han.patch | 58 +++++ 82 files changed, 5253 insertions(+) create mode 100644 queue-5.15/acpi-video-fix-acpi_video_handles_brightness_key_pre.patch create mode 100644 queue-5.15/arm-9209-1-spectre-bhb-avoid-pr_info-every-time-a-cp.patch create mode 100644 queue-5.15/arm-9210-1-mark-the-fdt_fixed-sections-as-shareable.patch create mode 100644 queue-5.15/arm-dts-at91-sama5d2-fix-typo-in-i2s1-node.patch create mode 100644 queue-5.15/arm-dts-imx6qdl-ts7970-fix-ngpio-typo-and-count.patch create mode 100644 queue-5.15/arm-dts-sunxi-fix-spi-nor-campatible-on-orange-pi-ze.patch create mode 100644 queue-5.15/arm64-dts-broadcom-bcm4908-fix-cpu-node-for-smp-boot.patch create mode 100644 queue-5.15/arm64-dts-broadcom-bcm4908-fix-timer-node-for-bcm490.patch create mode 100644 queue-5.15/asoc-intel-skylake-correct-the-handling-of-fmt_confi.patch create mode 100644 queue-5.15/asoc-intel-skylake-correct-the-ssp-rate-discovery-in.patch create mode 100644 queue-5.15/asoc-sgtl5000-fix-noise-on-shutdown-remove.patch create mode 100644 queue-5.15/asoc-tas2764-add-post-reset-delays.patch create mode 100644 queue-5.15/asoc-tas2764-correct-playback-volume-range.patch create mode 100644 queue-5.15/asoc-tas2764-fix-amp-gain-register-offset-default.patch create mode 100644 queue-5.15/asoc-tas2764-fix-and-extend-fsync-polarity-handling.patch create mode 100644 queue-5.15/bnxt_en-fix-bnxt_refclk_read.patch create mode 100644 queue-5.15/bnxt_en-fix-bnxt_reinit_after_abort-code-path.patch create mode 100644 queue-5.15/ceph-switch-netfs-read-ops-to-use-rreq-inode-instead.patch create mode 100644 queue-5.15/cipso-fix-data-races-around-sysctl.patch create mode 100644 queue-5.15/drm-amd-display-only-use-depth-36-bpp-linebuffers-on.patch create mode 100644 queue-5.15/drm-amd-pm-prevent-divide-by-zero.patch create mode 100644 queue-5.15/drm-i915-dg2-add-wa_22011100796.patch create mode 100644 queue-5.15/drm-i915-fix-a-possible-refcount-leak-in-intel_dp_ad.patch create mode 100644 queue-5.15/drm-i915-gt-serialize-grdom-access-between-multiple-.patch create mode 100644 queue-5.15/drm-i915-gt-serialize-tlb-invalidates-with-gt-resets.patch create mode 100644 queue-5.15/drm-i915-gvt-is_err-vs-null-bug-in-intel_gvt_update_.patch create mode 100644 queue-5.15/drm-i915-require-the-vm-mutex-for-i915_vma_bind.patch create mode 100644 queue-5.15/drm-i915-selftests-fix-a-couple-is_err-vs-null-tests.patch create mode 100644 queue-5.15/drm-i915-uc-correctly-track-uc_fw-init-failure.patch create mode 100644 queue-5.15/icmp-fix-a-data-race-around-sysctl_icmp_errors_use_i.patch create mode 100644 queue-5.15/icmp-fix-a-data-race-around-sysctl_icmp_ignore_bogus.patch create mode 100644 queue-5.15/icmp-fix-a-data-race-around-sysctl_icmp_ratelimit.patch create mode 100644 queue-5.15/icmp-fix-a-data-race-around-sysctl_icmp_ratemask.patch create mode 100644 queue-5.15/icmp-fix-data-races-around-sysctl.patch create mode 100644 queue-5.15/icmp-fix-data-races-around-sysctl_icmp_echo_enable_p.patch create mode 100644 queue-5.15/ima-fix-a-potential-integer-overflow-in-ima_appraise.patch create mode 100644 queue-5.15/ima-fix-potential-memory-leak-in-ima_init_crypto.patch create mode 100644 queue-5.15/ima-force-signature-verification-when-config_kexec_s.patch create mode 100644 queue-5.15/inetpeer-fix-data-races-around-sysctl.patch create mode 100644 queue-5.15/ipv4-fix-a-data-race-around-sysctl_fib_sync_mem.patch create mode 100644 queue-5.15/ipv4-fix-data-races-around-sysctl_ip_dynaddr.patch create mode 100644 queue-5.15/kvm-x86-fully-initialize-struct-kvm_lapic_irq-in-kvm.patch create mode 100644 queue-5.15/lockd-fix-nlm_close_files.patch create mode 100644 queue-5.15/lockd-set-fl_owner-when-unlocking-files.patch create mode 100644 queue-5.15/mm-sysctl-fix-missing-numa_stat-when-config_hugetlb_.patch create mode 100644 queue-5.15/net-atlantic-remove-aq_nic_deinit-when-resume.patch create mode 100644 queue-5.15/net-atlantic-remove-deep-parameter-on-suspend-resume.patch create mode 100644 queue-5.15/net-ethernet-ti-am65-cpsw-fix-devlink-port-register-.patch create mode 100644 queue-5.15/net-fix-data-races-around-sysctl_mem.patch create mode 100644 queue-5.15/net-ftgmac100-hold-reference-returned-by-of_get_chil.patch create mode 100644 queue-5.15/net-mlx5e-fix-capability-check-for-updating-vnic-env.patch create mode 100644 queue-5.15/net-mlx5e-fix-enabling-sriov-while-tc-nic-rules-are-.patch create mode 100644 queue-5.15/net-mlx5e-ktls-fix-build-time-constant-test-in-rx.patch create mode 100644 queue-5.15/net-mlx5e-ktls-fix-build-time-constant-test-in-tx.patch create mode 100644 queue-5.15/net-mlx5e-ring-the-tx-doorbell-on-dma-errors.patch create mode 100644 queue-5.15/net-stmmac-dwc-qos-disable-split-header-for-tegra194.patch create mode 100644 queue-5.15/net-stmmac-fix-leaks-in-probe.patch create mode 100644 queue-5.15/net-tls-check-for-errors-in-tls_device_init.patch create mode 100644 queue-5.15/netfilter-nf_log-incorrect-offset-to-network-header.patch create mode 100644 queue-5.15/netfilter-nf_tables-replace-bug_on-by-element-length.patch create mode 100644 queue-5.15/nexthop-fix-data-races-around-nexthop_compat_mode.patch create mode 100644 queue-5.15/raw-fix-a-data-race-around-sysctl_raw_l3mdev_accept.patch create mode 100644 queue-5.15/reset-fix-devm-bulk-optional-exclusive-control-gette.patch create mode 100644 queue-5.15/seg6-bpf-fix-skb-checksum-in-bpf_push_seg6_encap.patch create mode 100644 queue-5.15/seg6-fix-skb-checksum-evaluation-in-srh-encapsulatio.patch create mode 100644 queue-5.15/seg6-fix-skb-checksum-in-srv6-end.b6-and-end.b6.enca.patch create mode 100644 queue-5.15/sfc-fix-kernel-panic-when-creating-vf.patch create mode 100644 queue-5.15/sfc-fix-use-after-free-when-disabling-sriov.patch create mode 100644 queue-5.15/spi-amd-limit-max-transfer-and-message-size.patch create mode 100644 queue-5.15/sysctl-fix-data-races-in-proc_dointvec.patch create mode 100644 queue-5.15/sysctl-fix-data-races-in-proc_dointvec_jiffies.patch create mode 100644 queue-5.15/sysctl-fix-data-races-in-proc_dointvec_minmax.patch create mode 100644 queue-5.15/sysctl-fix-data-races-in-proc_dointvec_ms_jiffies.patch create mode 100644 queue-5.15/sysctl-fix-data-races-in-proc_dou8vec_minmax.patch create mode 100644 queue-5.15/sysctl-fix-data-races-in-proc_douintvec.patch create mode 100644 queue-5.15/sysctl-fix-data-races-in-proc_douintvec_minmax.patch create mode 100644 queue-5.15/sysctl-fix-data-races-in-proc_doulongvec_minmax.patch create mode 100644 queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_ecn_fallback.patch create mode 100644 queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_max_orphans.patch create mode 100644 queue-5.15/tracing-fix-sleeping-while-atomic-in-kdb-ftdump.patch create mode 100644 queue-5.15/xen-gntdev-ignore-failure-to-unmap-invalid_grant_han.patch diff --git a/queue-5.15/acpi-video-fix-acpi_video_handles_brightness_key_pre.patch b/queue-5.15/acpi-video-fix-acpi_video_handles_brightness_key_pre.patch new file mode 100644 index 00000000000..e433f99d463 --- /dev/null +++ b/queue-5.15/acpi-video-fix-acpi_video_handles_brightness_key_pre.patch @@ -0,0 +1,99 @@ +From 72f2fec0eb23c5fb21f3d7b2857fb0fa2433a6bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 23:11:01 +0200 +Subject: ACPI: video: Fix acpi_video_handles_brightness_key_presses() + +From: Hans de Goede + +[ Upstream commit 5ad26161a371e4aa2d2553286f0cac580987a493 ] + +Commit 3a0cf7ab8df3 ("ACPI: video: Change how we determine if brightness +key-presses are handled") made acpi_video_handles_brightness_key_presses() +report false when none of the ACPI Video Devices support backlight control. + +But it turns out that at least on a Dell Inspiron N4010 there is no ACPI +backlight control, yet brightness hotkeys are still reported through +the ACPI Video Bus; and since acpi_video_handles_brightness_key_presses() +now returns false, brightness keypresses are now reported twice. + +To fix this rename the has_backlight flag to may_report_brightness_keys and +also set it the first time a brightness key press event is received. + +Depending on the delivery of the other ACPI (WMI) event vs the ACPI Video +Bus event this means that the first brightness key press might still get +reported twice, but all further keypresses will be filtered as before. + +Note that this relies on other drivers reporting brightness key events +calling acpi_video_handles_brightness_key_presses() when delivering +the events (rather then once during driver probe). This is already +required and documented in include/acpi/video.h: + +/* + * Note: The value returned by acpi_video_handles_brightness_key_presses() + * may change over time and should not be cached. + */ + +Fixes: 3a0cf7ab8df3 ("ACPI: video: Change how we determine if brightness key-presses are handled") +Link: https://lore.kernel.org/regressions/CALF=6jEe5G8+r1Wo0vvz4GjNQQhdkLT5p8uCHn6ZXhg4nsOWow@mail.gmail.com/ +Reported-and-tested-by: Ben Greening +Signed-off-by: Hans de Goede +Acked-by: Rafael J. Wysocki +Link: https://lore.kernel.org/r/20220713211101.85547-2-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_video.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c +index 007deb3a8ea3..390af28f6faf 100644 +--- a/drivers/acpi/acpi_video.c ++++ b/drivers/acpi/acpi_video.c +@@ -73,7 +73,7 @@ module_param(device_id_scheme, bool, 0444); + static int only_lcd = -1; + module_param(only_lcd, int, 0444); + +-static bool has_backlight; ++static bool may_report_brightness_keys; + static int register_count; + static DEFINE_MUTEX(register_count_mutex); + static DEFINE_MUTEX(video_list_lock); +@@ -1224,7 +1224,7 @@ acpi_video_bus_get_one_device(struct acpi_device *device, + acpi_video_device_find_cap(data); + + if (data->cap._BCM && data->cap._BCL) +- has_backlight = true; ++ may_report_brightness_keys = true; + + mutex_lock(&video->device_list_lock); + list_add_tail(&data->entry, &video->video_device_list); +@@ -1693,6 +1693,9 @@ static void acpi_video_device_notify(acpi_handle handle, u32 event, void *data) + break; + } + ++ if (keycode) ++ may_report_brightness_keys = true; ++ + acpi_notifier_call_chain(device, event, 0); + + if (keycode && (report_key_events & REPORT_BRIGHTNESS_KEY_EVENTS)) { +@@ -2255,7 +2258,7 @@ void acpi_video_unregister(void) + if (register_count) { + acpi_bus_unregister_driver(&acpi_video_bus); + register_count = 0; +- has_backlight = false; ++ may_report_brightness_keys = false; + } + mutex_unlock(®ister_count_mutex); + } +@@ -2277,7 +2280,7 @@ void acpi_video_unregister_backlight(void) + + bool acpi_video_handles_brightness_key_presses(void) + { +- return has_backlight && ++ return may_report_brightness_keys && + (report_key_events & REPORT_BRIGHTNESS_KEY_EVENTS); + } + EXPORT_SYMBOL(acpi_video_handles_brightness_key_presses); +-- +2.35.1 + diff --git a/queue-5.15/arm-9209-1-spectre-bhb-avoid-pr_info-every-time-a-cp.patch b/queue-5.15/arm-9209-1-spectre-bhb-avoid-pr_info-every-time-a-cp.patch new file mode 100644 index 00000000000..2a093209afa --- /dev/null +++ b/queue-5.15/arm-9209-1-spectre-bhb-avoid-pr_info-every-time-a-cp.patch @@ -0,0 +1,58 @@ +From ea15bbb9014b067a3ef66d986051c0620ce3725f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 May 2022 09:53:42 +0100 +Subject: ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out + of idle + +From: Ard Biesheuvel + +[ Upstream commit 0609e200246bfd3b7516091c491bec4308349055 ] + +Jon reports that the Spectre-BHB init code is filling up the kernel log +with spurious notifications about which mitigation has been enabled, +every time any CPU comes out of a low power state. + +Given that Spectre-BHB mitigations are system wide, only a single +mitigation can be enabled, and we already print an error if two types of +CPUs coexist in a single system that require different Spectre-BHB +mitigations. + +This means that the pr_info() that describes the selected mitigation +does not need to be emitted for each CPU anyway, and so we can simply +emit it only once. + +In order to clarify the above in the log message, update it to describe +that the selected mitigation will be enabled on all CPUs, including ones +that are unaffected. If another CPU comes up later that is affected and +requires a different mitigation, we report an error as before. + +Fixes: b9baf5c8c5c3 ("ARM: Spectre-BHB workaround") +Tested-by: Jon Hunter +Signed-off-by: Ard Biesheuvel +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/mm/proc-v7-bugs.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c +index f9730eba0632..8bc7a2d6d6c7 100644 +--- a/arch/arm/mm/proc-v7-bugs.c ++++ b/arch/arm/mm/proc-v7-bugs.c +@@ -208,10 +208,10 @@ static int spectre_bhb_install_workaround(int method) + return SPECTRE_VULNERABLE; + + spectre_bhb_method = method; +- } + +- pr_info("CPU%u: Spectre BHB: using %s workaround\n", +- smp_processor_id(), spectre_bhb_method_name(method)); ++ pr_info("CPU%u: Spectre BHB: enabling %s workaround for all CPUs\n", ++ smp_processor_id(), spectre_bhb_method_name(method)); ++ } + + return SPECTRE_MITIGATED; + } +-- +2.35.1 + diff --git a/queue-5.15/arm-9210-1-mark-the-fdt_fixed-sections-as-shareable.patch b/queue-5.15/arm-9210-1-mark-the-fdt_fixed-sections-as-shareable.patch new file mode 100644 index 00000000000..7e5aab5c273 --- /dev/null +++ b/queue-5.15/arm-9210-1-mark-the-fdt_fixed-sections-as-shareable.patch @@ -0,0 +1,153 @@ +From 121cf2ea8cf504f707ffb5e70bbda07eb2643780 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 15:05:41 +0100 +Subject: ARM: 9210/1: Mark the FDT_FIXED sections as shareable + +From: Zhen Lei + +[ Upstream commit 598f0a99fa8a35be44b27106b43ddc66417af3b1 ] + +commit 7a1be318f579 ("ARM: 9012/1: move device tree mapping out of linear +region") use FDT_FIXED_BASE to map the whole FDT_FIXED_SIZE memory area +which contains fdt. But it only reserves the exact physical memory that +fdt occupied. Unfortunately, this mapping is non-shareable. An illegal or +speculative read access can bring the RAM content from non-fdt zone into +cache, PIPT makes it to be hit by subsequently read access through +shareable mapping(such as linear mapping), and the cache consistency +between cores is lost due to non-shareable property. + +|<---------FDT_FIXED_SIZE------>| +| | + ------------------------------- +| | | | + ------------------------------- + +1. CoreA read through MT_ROM mapping, the old data is loaded + into the cache. +2. CoreB write to update data through linear mapping. CoreA + received the notification to invalid the corresponding cachelines, but + the property non-shareable makes it to be ignored. +3. CoreA read through linear mapping, cache hit, the old data + is read. + +To eliminate this risk, add a new memory type MT_MEMORY_RO. Compared to +MT_ROM, it is shareable and non-executable. + +Here's an example: + list_del corruption. prev->next should be c0ecbf74, but was c08410dc + kernel BUG at lib/list_debug.c:53! + ... ... + PC is at __list_del_entry_valid+0x58/0x98 + LR is at __list_del_entry_valid+0x58/0x98 + psr: 60000093 + sp : c0ecbf30 ip : 00000000 fp : 00000001 + r10: c08410d0 r9 : 00000001 r8 : c0825e0c + r7 : 20000013 r6 : c08410d0 r5 : c0ecbf74 r4 : c0ecbf74 + r3 : c0825d08 r2 : 00000000 r1 : df7ce6f4 r0 : 00000044 + ... ... + Stack: (0xc0ecbf30 to 0xc0ecc000) + bf20: c0ecbf74 c0164fd0 c0ecbf70 c0165170 + bf40: c0eca000 c0840c00 c0840c00 c0824500 c0825e0c c0189bbc c088f404 60000013 + bf60: 60000013 c0e85100 000004ec 00000000 c0ebcdc0 c0ecbf74 c0ecbf74 c0825d08 + ... ... < next prev > + (__list_del_entry_valid) from (__list_del_entry+0xc/0x20) + (__list_del_entry) from (finish_swait+0x60/0x7c) + (finish_swait) from (rcu_gp_kthread+0x560/0xa20) + (rcu_gp_kthread) from (kthread+0x14c/0x15c) + (kthread) from (ret_from_fork+0x14/0x24) + +The faulty list node to be deleted is a local variable, its address is +c0ecbf74. The dumped stack shows that 'prev' = c0ecbf74, but its value +before lib/list_debug.c:53 is c08410dc. A large amount of printing results +in swapping out the cacheline containing the old data(MT_ROM mapping is +read only, so the cacheline cannot be dirty), and the subsequent dump +operation obtains new data from the DDR. + +Fixes: 7a1be318f579 ("ARM: 9012/1: move device tree mapping out of linear region") +Suggested-by: Ard Biesheuvel +Signed-off-by: Zhen Lei +Reviewed-by: Ard Biesheuvel +Reviewed-by: Kefeng Wang +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/mach/map.h | 1 + + arch/arm/mm/mmu.c | 15 ++++++++++++++- + 2 files changed, 15 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/include/asm/mach/map.h b/arch/arm/include/asm/mach/map.h +index 92282558caf7..2b8970d8e5a2 100644 +--- a/arch/arm/include/asm/mach/map.h ++++ b/arch/arm/include/asm/mach/map.h +@@ -27,6 +27,7 @@ enum { + MT_HIGH_VECTORS, + MT_MEMORY_RWX, + MT_MEMORY_RW, ++ MT_MEMORY_RO, + MT_ROM, + MT_MEMORY_RWX_NONCACHED, + MT_MEMORY_RW_DTCM, +diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c +index 5e2be37a198e..cd17e324aa51 100644 +--- a/arch/arm/mm/mmu.c ++++ b/arch/arm/mm/mmu.c +@@ -296,6 +296,13 @@ static struct mem_type mem_types[] __ro_after_init = { + .prot_sect = PMD_TYPE_SECT | PMD_SECT_AP_WRITE, + .domain = DOMAIN_KERNEL, + }, ++ [MT_MEMORY_RO] = { ++ .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY | ++ L_PTE_XN | L_PTE_RDONLY, ++ .prot_l1 = PMD_TYPE_TABLE, ++ .prot_sect = PMD_TYPE_SECT, ++ .domain = DOMAIN_KERNEL, ++ }, + [MT_ROM] = { + .prot_sect = PMD_TYPE_SECT, + .domain = DOMAIN_KERNEL, +@@ -489,6 +496,7 @@ static void __init build_mem_type_table(void) + + /* Also setup NX memory mapping */ + mem_types[MT_MEMORY_RW].prot_sect |= PMD_SECT_XN; ++ mem_types[MT_MEMORY_RO].prot_sect |= PMD_SECT_XN; + } + if (cpu_arch >= CPU_ARCH_ARMv7 && (cr & CR_TRE)) { + /* +@@ -568,6 +576,7 @@ static void __init build_mem_type_table(void) + mem_types[MT_ROM].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE; + mem_types[MT_MINICLEAN].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE; + mem_types[MT_CACHECLEAN].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE; ++ mem_types[MT_MEMORY_RO].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE; + #endif + + /* +@@ -587,6 +596,8 @@ static void __init build_mem_type_table(void) + mem_types[MT_MEMORY_RWX].prot_pte |= L_PTE_SHARED; + mem_types[MT_MEMORY_RW].prot_sect |= PMD_SECT_S; + mem_types[MT_MEMORY_RW].prot_pte |= L_PTE_SHARED; ++ mem_types[MT_MEMORY_RO].prot_sect |= PMD_SECT_S; ++ mem_types[MT_MEMORY_RO].prot_pte |= L_PTE_SHARED; + mem_types[MT_MEMORY_DMA_READY].prot_pte |= L_PTE_SHARED; + mem_types[MT_MEMORY_RWX_NONCACHED].prot_sect |= PMD_SECT_S; + mem_types[MT_MEMORY_RWX_NONCACHED].prot_pte |= L_PTE_SHARED; +@@ -647,6 +658,8 @@ static void __init build_mem_type_table(void) + mem_types[MT_MEMORY_RWX].prot_pte |= kern_pgprot; + mem_types[MT_MEMORY_RW].prot_sect |= ecc_mask | cp->pmd; + mem_types[MT_MEMORY_RW].prot_pte |= kern_pgprot; ++ mem_types[MT_MEMORY_RO].prot_sect |= ecc_mask | cp->pmd; ++ mem_types[MT_MEMORY_RO].prot_pte |= kern_pgprot; + mem_types[MT_MEMORY_DMA_READY].prot_pte |= kern_pgprot; + mem_types[MT_MEMORY_RWX_NONCACHED].prot_sect |= ecc_mask; + mem_types[MT_ROM].prot_sect |= cp->pmd; +@@ -1360,7 +1373,7 @@ static void __init devicemaps_init(const struct machine_desc *mdesc) + map.pfn = __phys_to_pfn(__atags_pointer & SECTION_MASK); + map.virtual = FDT_FIXED_BASE; + map.length = FDT_FIXED_SIZE; +- map.type = MT_ROM; ++ map.type = MT_MEMORY_RO; + create_mapping(&map); + } + +-- +2.35.1 + diff --git a/queue-5.15/arm-dts-at91-sama5d2-fix-typo-in-i2s1-node.patch b/queue-5.15/arm-dts-at91-sama5d2-fix-typo-in-i2s1-node.patch new file mode 100644 index 00000000000..1d3153a39e4 --- /dev/null +++ b/queue-5.15/arm-dts-at91-sama5d2-fix-typo-in-i2s1-node.patch @@ -0,0 +1,40 @@ +From d5487bcf25cd8f632df688da71c4a2ab92d9403c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jul 2022 14:58:12 -0700 +Subject: ARM: dts: at91: sama5d2: Fix typo in i2s1 node + +From: Ryan Wanner + +[ Upstream commit 2fdf15b50a46e366740df4cccbe2343269b4ff55 ] + +Fix typo in i2s1 causing errors in dt binding validation. +Change assigned-parrents to assigned-clock-parents +to match i2s0 node formatting. + +Fixes: 1ca81883c557 ("ARM: dts: at91: sama5d2: add nodes for I2S controllers") +Signed-off-by: Ryan Wanner +[claudiu.beznea: use imperative addressing in commit description, remove + blank line after fixes tag, fix typo in commit message] +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20220707215812.193008-1-Ryan.Wanner@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sama5d2.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi +index de88eb484718..4c87c2aa8fc8 100644 +--- a/arch/arm/boot/dts/sama5d2.dtsi ++++ b/arch/arm/boot/dts/sama5d2.dtsi +@@ -1125,7 +1125,7 @@ AT91_XDMAC_DT_PERID(33))>, + clocks = <&pmc PMC_TYPE_PERIPHERAL 55>, <&pmc PMC_TYPE_GCK 55>; + clock-names = "pclk", "gclk"; + assigned-clocks = <&pmc PMC_TYPE_CORE PMC_I2S1_MUX>; +- assigned-parrents = <&pmc PMC_TYPE_GCK 55>; ++ assigned-clock-parents = <&pmc PMC_TYPE_GCK 55>; + status = "disabled"; + }; + +-- +2.35.1 + diff --git a/queue-5.15/arm-dts-imx6qdl-ts7970-fix-ngpio-typo-and-count.patch b/queue-5.15/arm-dts-imx6qdl-ts7970-fix-ngpio-typo-and-count.patch new file mode 100644 index 00000000000..0ed10d8c4a9 --- /dev/null +++ b/queue-5.15/arm-dts-imx6qdl-ts7970-fix-ngpio-typo-and-count.patch @@ -0,0 +1,39 @@ +From ebc92ab616f933b83e06d13638224445471d7415 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 14:03:27 -0700 +Subject: ARM: dts: imx6qdl-ts7970: Fix ngpio typo and count + +From: Kris Bahnsen + +[ Upstream commit e95ea0f687e679fcb0a3a67d0755b81ee7d60db0 ] + +Device-tree incorrectly used "ngpio" which caused the driver to +fallback to 32 ngpios. + +This platform has 62 GPIO registers. + +Fixes: 9ff8e9fccef9 ("ARM: dts: TS-7970: add basic device tree") +Signed-off-by: Kris Bahnsen +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-ts7970.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-ts7970.dtsi b/arch/arm/boot/dts/imx6qdl-ts7970.dtsi +index fded07f370b3..d6ba4b2a60f6 100644 +--- a/arch/arm/boot/dts/imx6qdl-ts7970.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-ts7970.dtsi +@@ -226,7 +226,7 @@ gpio8: gpio@28 { + reg = <0x28>; + #gpio-cells = <2>; + gpio-controller; +- ngpio = <32>; ++ ngpios = <62>; + }; + + sgtl5000: codec@a { +-- +2.35.1 + diff --git a/queue-5.15/arm-dts-sunxi-fix-spi-nor-campatible-on-orange-pi-ze.patch b/queue-5.15/arm-dts-sunxi-fix-spi-nor-campatible-on-orange-pi-ze.patch new file mode 100644 index 00000000000..ba5551f2704 --- /dev/null +++ b/queue-5.15/arm-dts-sunxi-fix-spi-nor-campatible-on-orange-pi-ze.patch @@ -0,0 +1,40 @@ +From 8f4fbb74c867288b4aa8c41f8b9759e67c91c3e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 19:45:29 +0200 +Subject: ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero + +From: Michal Suchanek + +[ Upstream commit 884b66976a7279ee889ba885fe364244d50b79e7 ] + +The device tree should include generic "jedec,spi-nor" compatible, and a +manufacturer-specific one. +The macronix part is what is shipped on the boards that come with a +flash chip. + +Fixes: 45857ae95478 ("ARM: dts: orange-pi-zero: add node for SPI NOR") +Signed-off-by: Michal Suchanek +Acked-by: Jernej Skrabec +Signed-off-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20220708174529.3360-1-msuchanek@suse.de +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts b/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts +index f19ed981da9d..3706216ffb40 100644 +--- a/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts ++++ b/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts +@@ -169,7 +169,7 @@ &spi0 { + flash@0 { + #address-cells = <1>; + #size-cells = <1>; +- compatible = "mxicy,mx25l1606e", "winbond,w25q128"; ++ compatible = "mxicy,mx25l1606e", "jedec,spi-nor"; + reg = <0>; + spi-max-frequency = <40000000>; + }; +-- +2.35.1 + diff --git a/queue-5.15/arm64-dts-broadcom-bcm4908-fix-cpu-node-for-smp-boot.patch b/queue-5.15/arm64-dts-broadcom-bcm4908-fix-cpu-node-for-smp-boot.patch new file mode 100644 index 00000000000..4eb1d783bdc --- /dev/null +++ b/queue-5.15/arm64-dts-broadcom-bcm4908-fix-cpu-node-for-smp-boot.patch @@ -0,0 +1,38 @@ +From 3d4fa2b17f93dec047f18700266e6eb335d7dd48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 11:25:07 -0700 +Subject: arm64: dts: broadcom: bcm4908: Fix cpu node for smp boot + +From: William Zhang + +[ Upstream commit 8bd582ae9a71d7f14c4e0c735b2eacaf7516d626 ] + +Add spin-table enable-method and cpu-release-addr properties for +cpu0 node. This is required by all ARMv8 SoC. Otherwise some +bootloader like u-boot can not update cpu-release-addr and linux +fails to start up secondary cpus. + +Fixes: 2961f69f151c ("arm64: dts: broadcom: add BCM4908 and Asus GT-AC5300 early DTS files") +Signed-off-by: William Zhang +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi b/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi +index e8907d3fe2d1..e510a6961cf9 100644 +--- a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi ++++ b/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi +@@ -29,6 +29,8 @@ cpu0: cpu@0 { + device_type = "cpu"; + compatible = "brcm,brahma-b53"; + reg = <0x0>; ++ enable-method = "spin-table"; ++ cpu-release-addr = <0x0 0xfff8>; + next-level-cache = <&l2>; + }; + +-- +2.35.1 + diff --git a/queue-5.15/arm64-dts-broadcom-bcm4908-fix-timer-node-for-bcm490.patch b/queue-5.15/arm64-dts-broadcom-bcm4908-fix-timer-node-for-bcm490.patch new file mode 100644 index 00000000000..4cf009e61d8 --- /dev/null +++ b/queue-5.15/arm64-dts-broadcom-bcm4908-fix-timer-node-for-bcm490.patch @@ -0,0 +1,43 @@ +From 04207188b2247aa7d1abc7f0715b0af42f4837da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 11:25:06 -0700 +Subject: arm64: dts: broadcom: bcm4908: Fix timer node for BCM4906 SoC + +From: William Zhang + +[ Upstream commit b4a544e415e9be33b37d9bfa9d9f9f4d13f553d6 ] + +The cpu mask value in interrupt property inherits from bcm4908.dtsi +which sets to four cpus. Correct the value to two cpus for dual core +BCM4906 SoC. + +Fixes: c8b404fb05dc ("arm64: dts: broadcom: bcm4908: add BCM4906 Netgear R8000P DTS files") +Signed-off-by: William Zhang +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/broadcom/bcm4908/bcm4906.dtsi | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4906.dtsi b/arch/arm64/boot/dts/broadcom/bcm4908/bcm4906.dtsi +index 66023d553524..d084c33d5ca8 100644 +--- a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4906.dtsi ++++ b/arch/arm64/boot/dts/broadcom/bcm4908/bcm4906.dtsi +@@ -9,6 +9,14 @@ cpus { + /delete-node/ cpu@3; + }; + ++ timer { ++ compatible = "arm,armv8-timer"; ++ interrupts = , ++ , ++ , ++ ; ++ }; ++ + pmu { + compatible = "arm,cortex-a53-pmu"; + interrupts = , +-- +2.35.1 + diff --git a/queue-5.15/asoc-intel-skylake-correct-the-handling-of-fmt_confi.patch b/queue-5.15/asoc-intel-skylake-correct-the-handling-of-fmt_confi.patch new file mode 100644 index 00000000000..93ea697e9ae --- /dev/null +++ b/queue-5.15/asoc-intel-skylake-correct-the-handling-of-fmt_confi.patch @@ -0,0 +1,133 @@ +From fc75897b3c73558561bce1c24d99ae6ac8e47085 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 09:56:38 +0300 +Subject: ASoC: Intel: Skylake: Correct the handling of fmt_config flexible + array + +From: Peter Ujfalusi + +[ Upstream commit fc976f5629afb4160ee77798b14a693eac903ffd ] + +The struct nhlt_format's fmt_config is a flexible array, it must not be +used as normal array. +When moving to the next nhlt_fmt_cfg we need to take into account the data +behind the ->config.caps (indicated by ->config.size). + +The logic of the code also changed: it is no longer saves the _last_ +fmt_cfg for all found rates. + +Fixes: bc2bd45b1f7f3 ("ASoC: Intel: Skylake: Parse nhlt and register clock device") +Signed-off-by: Peter Ujfalusi +Reviewed-by: Cezary Rojewski +Link: https://lore.kernel.org/r/20220630065638.11183-3-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/skylake/skl-nhlt.c | 37 ++++++++++++++++++++---------- + 1 file changed, 25 insertions(+), 12 deletions(-) + +diff --git a/sound/soc/intel/skylake/skl-nhlt.c b/sound/soc/intel/skylake/skl-nhlt.c +index cb02ec255728..74f60f5dfaef 100644 +--- a/sound/soc/intel/skylake/skl-nhlt.c ++++ b/sound/soc/intel/skylake/skl-nhlt.c +@@ -213,11 +213,12 @@ static void skl_get_ssp_clks(struct skl_dev *skl, struct skl_ssp_clk *ssp_clks, + if (fmt->fmt_count == 0) + return; + ++ fmt_cfg = (struct nhlt_fmt_cfg *)fmt->fmt_config; + for (i = 0; i < fmt->fmt_count; i++) { ++ struct nhlt_fmt_cfg *saved_fmt_cfg = fmt_cfg; + bool present = false; + +- fmt_cfg = &fmt->fmt_config[i]; +- wav_fmt = &fmt_cfg->fmt_ext; ++ wav_fmt = &saved_fmt_cfg->fmt_ext; + + channels = wav_fmt->fmt.channels; + bps = wav_fmt->fmt.bits_per_sample; +@@ -235,12 +236,18 @@ static void skl_get_ssp_clks(struct skl_dev *skl, struct skl_ssp_clk *ssp_clks, + * derive the rate. + */ + for (j = i; j < fmt->fmt_count; j++) { +- fmt_cfg = &fmt->fmt_config[j]; +- wav_fmt = &fmt_cfg->fmt_ext; ++ struct nhlt_fmt_cfg *tmp_fmt_cfg = fmt_cfg; ++ ++ wav_fmt = &tmp_fmt_cfg->fmt_ext; + if ((fs == wav_fmt->fmt.samples_per_sec) && +- (bps == wav_fmt->fmt.bits_per_sample)) ++ (bps == wav_fmt->fmt.bits_per_sample)) { + channels = max_t(u16, channels, + wav_fmt->fmt.channels); ++ saved_fmt_cfg = tmp_fmt_cfg; ++ } ++ /* Move to the next nhlt_fmt_cfg */ ++ tmp_fmt_cfg = (struct nhlt_fmt_cfg *)(tmp_fmt_cfg->config.caps + ++ tmp_fmt_cfg->config.size); + } + + rate = channels * bps * fs; +@@ -256,8 +263,11 @@ static void skl_get_ssp_clks(struct skl_dev *skl, struct skl_ssp_clk *ssp_clks, + + /* Fill rate and parent for sclk/sclkfs */ + if (!present) { ++ struct nhlt_fmt_cfg *first_fmt_cfg; ++ ++ first_fmt_cfg = (struct nhlt_fmt_cfg *)fmt->fmt_config; + i2s_config_ext = (struct skl_i2s_config_blob_ext *) +- fmt->fmt_config[0].config.caps; ++ first_fmt_cfg->config.caps; + + /* MCLK Divider Source Select */ + if (is_legacy_blob(i2s_config_ext->hdr.sig)) { +@@ -271,6 +281,9 @@ static void skl_get_ssp_clks(struct skl_dev *skl, struct skl_ssp_clk *ssp_clks, + + parent = skl_get_parent_clk(clk_src); + ++ /* Move to the next nhlt_fmt_cfg */ ++ fmt_cfg = (struct nhlt_fmt_cfg *)(fmt_cfg->config.caps + ++ fmt_cfg->config.size); + /* + * Do not copy the config data if there is no parent + * clock available for this clock source select +@@ -279,9 +292,9 @@ static void skl_get_ssp_clks(struct skl_dev *skl, struct skl_ssp_clk *ssp_clks, + continue; + + sclk[id].rate_cfg[rate_index].rate = rate; +- sclk[id].rate_cfg[rate_index].config = fmt_cfg; ++ sclk[id].rate_cfg[rate_index].config = saved_fmt_cfg; + sclkfs[id].rate_cfg[rate_index].rate = rate; +- sclkfs[id].rate_cfg[rate_index].config = fmt_cfg; ++ sclkfs[id].rate_cfg[rate_index].config = saved_fmt_cfg; + sclk[id].parent_name = parent->name; + sclkfs[id].parent_name = parent->name; + +@@ -295,13 +308,13 @@ static void skl_get_mclk(struct skl_dev *skl, struct skl_ssp_clk *mclk, + { + struct skl_i2s_config_blob_ext *i2s_config_ext; + struct skl_i2s_config_blob_legacy *i2s_config; +- struct nhlt_specific_cfg *fmt_cfg; ++ struct nhlt_fmt_cfg *fmt_cfg; + struct skl_clk_parent_src *parent; + u32 clkdiv, div_ratio; + u8 clk_src; + +- fmt_cfg = &fmt->fmt_config[0].config; +- i2s_config_ext = (struct skl_i2s_config_blob_ext *)fmt_cfg->caps; ++ fmt_cfg = (struct nhlt_fmt_cfg *)fmt->fmt_config; ++ i2s_config_ext = (struct skl_i2s_config_blob_ext *)fmt_cfg->config.caps; + + /* MCLK Divider Source Select and divider */ + if (is_legacy_blob(i2s_config_ext->hdr.sig)) { +@@ -330,7 +343,7 @@ static void skl_get_mclk(struct skl_dev *skl, struct skl_ssp_clk *mclk, + return; + + mclk[id].rate_cfg[0].rate = parent->rate/div_ratio; +- mclk[id].rate_cfg[0].config = &fmt->fmt_config[0]; ++ mclk[id].rate_cfg[0].config = fmt_cfg; + mclk[id].parent_name = parent->name; + } + +-- +2.35.1 + diff --git a/queue-5.15/asoc-intel-skylake-correct-the-ssp-rate-discovery-in.patch b/queue-5.15/asoc-intel-skylake-correct-the-ssp-rate-discovery-in.patch new file mode 100644 index 00000000000..19f035bf179 --- /dev/null +++ b/queue-5.15/asoc-intel-skylake-correct-the-ssp-rate-discovery-in.patch @@ -0,0 +1,48 @@ +From b93d8f500161ad5b376a2ed3c2a0ea472208ad2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 09:56:37 +0300 +Subject: ASoC: Intel: Skylake: Correct the ssp rate discovery in + skl_get_ssp_clks() + +From: Peter Ujfalusi + +[ Upstream commit 219af251bd1694bce1f627d238347d2eaf13de61 ] + +The present flag is only set once when one rate has been found to be saved. +This will effectively going to ignore any rate discovered at later time and +based on the code, this is not the intention. + +Fixes: bc2bd45b1f7f3 ("ASoC: Intel: Skylake: Parse nhlt and register clock device") +Signed-off-by: Peter Ujfalusi +Reviewed-by: Cezary Rojewski +Link: https://lore.kernel.org/r/20220630065638.11183-2-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/skylake/skl-nhlt.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/intel/skylake/skl-nhlt.c b/sound/soc/intel/skylake/skl-nhlt.c +index 64226072f0ee..cb02ec255728 100644 +--- a/sound/soc/intel/skylake/skl-nhlt.c ++++ b/sound/soc/intel/skylake/skl-nhlt.c +@@ -201,7 +201,6 @@ static void skl_get_ssp_clks(struct skl_dev *skl, struct skl_ssp_clk *ssp_clks, + struct nhlt_fmt_cfg *fmt_cfg; + struct wav_fmt_ext *wav_fmt; + unsigned long rate; +- bool present = false; + int rate_index = 0; + u16 channels, bps; + u8 clk_src; +@@ -215,6 +214,8 @@ static void skl_get_ssp_clks(struct skl_dev *skl, struct skl_ssp_clk *ssp_clks, + return; + + for (i = 0; i < fmt->fmt_count; i++) { ++ bool present = false; ++ + fmt_cfg = &fmt->fmt_config[i]; + wav_fmt = &fmt_cfg->fmt_ext; + +-- +2.35.1 + diff --git a/queue-5.15/asoc-sgtl5000-fix-noise-on-shutdown-remove.patch b/queue-5.15/asoc-sgtl5000-fix-noise-on-shutdown-remove.patch new file mode 100644 index 00000000000..45b344a2144 --- /dev/null +++ b/queue-5.15/asoc-sgtl5000-fix-noise-on-shutdown-remove.patch @@ -0,0 +1,79 @@ +From cfadb30c38ae9f257aa0ceb77ebbd690dcdcd639 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jun 2022 12:13:01 +0200 +Subject: ASoC: sgtl5000: Fix noise on shutdown/remove + +From: Francesco Dolcini + +[ Upstream commit 040e3360af3736348112d29425bf5d0be5b93115 ] + +Put the SGTL5000 in a silent/safe state on shutdown/remove, this is +required since the SGTL5000 produces a constant noise on its output +after it is configured and its clock is removed. Without this change +this is happening every time the module is unbound/removed or from +reboot till the clock is enabled again. + +The issue was experienced on both a Toradex Colibri/Apalis iMX6, but can +be easily reproduced everywhere just playing something on the codec and +after that removing/unbinding the driver. + +Fixes: 9b34e6cc3bc2 ("ASoC: Add Freescale SGTL5000 codec support") +Signed-off-by: Francesco Dolcini +Reviewed-by: Fabio Estevam +Link: https://lore.kernel.org/r/20220624101301.441314-1-francesco.dolcini@toradex.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/sgtl5000.c | 9 +++++++++ + sound/soc/codecs/sgtl5000.h | 1 + + 2 files changed, 10 insertions(+) + +diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c +index 97bf1f222805..dc56e6c6b668 100644 +--- a/sound/soc/codecs/sgtl5000.c ++++ b/sound/soc/codecs/sgtl5000.c +@@ -1797,6 +1797,9 @@ static int sgtl5000_i2c_remove(struct i2c_client *client) + { + struct sgtl5000_priv *sgtl5000 = i2c_get_clientdata(client); + ++ regmap_write(sgtl5000->regmap, SGTL5000_CHIP_DIG_POWER, SGTL5000_DIG_POWER_DEFAULT); ++ regmap_write(sgtl5000->regmap, SGTL5000_CHIP_ANA_POWER, SGTL5000_ANA_POWER_DEFAULT); ++ + clk_disable_unprepare(sgtl5000->mclk); + regulator_bulk_disable(sgtl5000->num_supplies, sgtl5000->supplies); + regulator_bulk_free(sgtl5000->num_supplies, sgtl5000->supplies); +@@ -1804,6 +1807,11 @@ static int sgtl5000_i2c_remove(struct i2c_client *client) + return 0; + } + ++static void sgtl5000_i2c_shutdown(struct i2c_client *client) ++{ ++ sgtl5000_i2c_remove(client); ++} ++ + static const struct i2c_device_id sgtl5000_id[] = { + {"sgtl5000", 0}, + {}, +@@ -1824,6 +1832,7 @@ static struct i2c_driver sgtl5000_i2c_driver = { + }, + .probe = sgtl5000_i2c_probe, + .remove = sgtl5000_i2c_remove, ++ .shutdown = sgtl5000_i2c_shutdown, + .id_table = sgtl5000_id, + }; + +diff --git a/sound/soc/codecs/sgtl5000.h b/sound/soc/codecs/sgtl5000.h +index 56ec5863f250..3a808c762299 100644 +--- a/sound/soc/codecs/sgtl5000.h ++++ b/sound/soc/codecs/sgtl5000.h +@@ -80,6 +80,7 @@ + /* + * SGTL5000_CHIP_DIG_POWER + */ ++#define SGTL5000_DIG_POWER_DEFAULT 0x0000 + #define SGTL5000_ADC_EN 0x0040 + #define SGTL5000_DAC_EN 0x0020 + #define SGTL5000_DAP_POWERUP 0x0010 +-- +2.35.1 + diff --git a/queue-5.15/asoc-tas2764-add-post-reset-delays.patch b/queue-5.15/asoc-tas2764-add-post-reset-delays.patch new file mode 100644 index 00000000000..7ab482f9307 --- /dev/null +++ b/queue-5.15/asoc-tas2764-add-post-reset-delays.patch @@ -0,0 +1,69 @@ +From d3c069ccd0fa1cd308871595da1b5f4bcf716c6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 09:51:32 +0200 +Subject: ASoC: tas2764: Add post reset delays +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Martin PoviÅ¡er + +[ Upstream commit cd10bb89b0d57bca98eb75e0444854a1c129a14e ] + +Make sure there is at least 1 ms delay from reset to first command as +is specified in the datasheet. This is a fix similar to commit +307f31452078 ("ASoC: tas2770: Insert post reset delay"). + +Fixes: 827ed8a0fa50 ("ASoC: tas2764: Add the driver for the TAS2764") +Signed-off-by: Martin PoviÅ¡er +Link: https://lore.kernel.org/r/20220630075135.2221-1-povik+lin@cutebit.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2764.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/tas2764.c b/sound/soc/codecs/tas2764.c +index 9265af41c235..edc66ff6dc49 100644 +--- a/sound/soc/codecs/tas2764.c ++++ b/sound/soc/codecs/tas2764.c +@@ -42,10 +42,12 @@ static void tas2764_reset(struct tas2764_priv *tas2764) + gpiod_set_value_cansleep(tas2764->reset_gpio, 0); + msleep(20); + gpiod_set_value_cansleep(tas2764->reset_gpio, 1); ++ usleep_range(1000, 2000); + } + + snd_soc_component_write(tas2764->component, TAS2764_SW_RST, + TAS2764_RST); ++ usleep_range(1000, 2000); + } + + static int tas2764_set_bias_level(struct snd_soc_component *component, +@@ -107,8 +109,10 @@ static int tas2764_codec_resume(struct snd_soc_component *component) + struct tas2764_priv *tas2764 = snd_soc_component_get_drvdata(component); + int ret; + +- if (tas2764->sdz_gpio) ++ if (tas2764->sdz_gpio) { + gpiod_set_value_cansleep(tas2764->sdz_gpio, 1); ++ usleep_range(1000, 2000); ++ } + + ret = snd_soc_component_update_bits(component, TAS2764_PWR_CTRL, + TAS2764_PWR_CTRL_MASK, +@@ -501,8 +505,10 @@ static int tas2764_codec_probe(struct snd_soc_component *component) + + tas2764->component = component; + +- if (tas2764->sdz_gpio) ++ if (tas2764->sdz_gpio) { + gpiod_set_value_cansleep(tas2764->sdz_gpio, 1); ++ usleep_range(1000, 2000); ++ } + + tas2764_reset(tas2764); + +-- +2.35.1 + diff --git a/queue-5.15/asoc-tas2764-correct-playback-volume-range.patch b/queue-5.15/asoc-tas2764-correct-playback-volume-range.patch new file mode 100644 index 00000000000..1497c47ddd9 --- /dev/null +++ b/queue-5.15/asoc-tas2764-correct-playback-volume-range.patch @@ -0,0 +1,43 @@ +From b0af31f03e02f63f1429502bc1b87dd00950274a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 09:51:34 +0200 +Subject: ASoC: tas2764: Correct playback volume range +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hector Martin + +[ Upstream commit 3e99e5697e1f7120b5abc755e8a560b22612d6ed ] + +DVC value 0xc8 is -100dB and 0xc9 is mute; this needs to map to +-100.5dB as far as the dB scale is concerned. Fix that and enable +the mute flag, so alsamixer correctly shows the control as +<0 dB .. -100 dB, mute>. + +Signed-off-by: Hector Martin +Fixes: 827ed8a0fa50 ("ASoC: tas2764: Add the driver for the TAS2764") +Signed-off-by: Martin PoviÅ¡er +Link: https://lore.kernel.org/r/20220630075135.2221-3-povik+lin@cutebit.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2764.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/tas2764.c b/sound/soc/codecs/tas2764.c +index 46c815650b2c..bd79bc7ecf6b 100644 +--- a/sound/soc/codecs/tas2764.c ++++ b/sound/soc/codecs/tas2764.c +@@ -536,7 +536,7 @@ static int tas2764_codec_probe(struct snd_soc_component *component) + } + + static DECLARE_TLV_DB_SCALE(tas2764_digital_tlv, 1100, 50, 0); +-static DECLARE_TLV_DB_SCALE(tas2764_playback_volume, -10000, 50, 0); ++static DECLARE_TLV_DB_SCALE(tas2764_playback_volume, -10050, 50, 1); + + static const struct snd_kcontrol_new tas2764_snd_controls[] = { + SOC_SINGLE_TLV("Speaker Volume", TAS2764_DVC, 0, +-- +2.35.1 + diff --git a/queue-5.15/asoc-tas2764-fix-amp-gain-register-offset-default.patch b/queue-5.15/asoc-tas2764-fix-amp-gain-register-offset-default.patch new file mode 100644 index 00000000000..538307f24ce --- /dev/null +++ b/queue-5.15/asoc-tas2764-fix-amp-gain-register-offset-default.patch @@ -0,0 +1,52 @@ +From 231ff5fe52e6bc54f4650ba17906f3aef47dfaa6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 09:51:35 +0200 +Subject: ASoC: tas2764: Fix amp gain register offset & default +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hector Martin + +[ Upstream commit 1c4f29ec878bbf1cc0a1eb54ae7da5ff98e19641 ] + +The register default is 0x28 per the datasheet, and the amp gain field +is supposed to be shifted left by one. With the wrong default, the ALSA +controls lie about the power-up state. With the wrong shift, we get only +half the gain we expect. + +Signed-off-by: Hector Martin +Fixes: 827ed8a0fa50 ("ASoC: tas2764: Add the driver for the TAS2764") +Signed-off-by: Martin PoviÅ¡er +Link: https://lore.kernel.org/r/20220630075135.2221-4-povik+lin@cutebit.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2764.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/tas2764.c b/sound/soc/codecs/tas2764.c +index bd79bc7ecf6b..ec13ba01e522 100644 +--- a/sound/soc/codecs/tas2764.c ++++ b/sound/soc/codecs/tas2764.c +@@ -541,7 +541,7 @@ static DECLARE_TLV_DB_SCALE(tas2764_playback_volume, -10050, 50, 1); + static const struct snd_kcontrol_new tas2764_snd_controls[] = { + SOC_SINGLE_TLV("Speaker Volume", TAS2764_DVC, 0, + TAS2764_DVC_MAX, 1, tas2764_playback_volume), +- SOC_SINGLE_TLV("Amp Gain Volume", TAS2764_CHNL_0, 0, 0x14, 0, ++ SOC_SINGLE_TLV("Amp Gain Volume", TAS2764_CHNL_0, 1, 0x14, 0, + tas2764_digital_tlv), + }; + +@@ -566,7 +566,7 @@ static const struct reg_default tas2764_reg_defaults[] = { + { TAS2764_SW_RST, 0x00 }, + { TAS2764_PWR_CTRL, 0x1a }, + { TAS2764_DVC, 0x00 }, +- { TAS2764_CHNL_0, 0x00 }, ++ { TAS2764_CHNL_0, 0x28 }, + { TAS2764_TDM_CFG0, 0x09 }, + { TAS2764_TDM_CFG1, 0x02 }, + { TAS2764_TDM_CFG2, 0x0a }, +-- +2.35.1 + diff --git a/queue-5.15/asoc-tas2764-fix-and-extend-fsync-polarity-handling.patch b/queue-5.15/asoc-tas2764-fix-and-extend-fsync-polarity-handling.patch new file mode 100644 index 00000000000..c5bff5c8319 --- /dev/null +++ b/queue-5.15/asoc-tas2764-fix-and-extend-fsync-polarity-handling.patch @@ -0,0 +1,135 @@ +From 202a5fb9ae3daaeafb10dbbe1de74989c696dec6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 09:51:33 +0200 +Subject: ASoC: tas2764: Fix and extend FSYNC polarity handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Martin PoviÅ¡er + +[ Upstream commit d1a10f1b48202e2d183cce144c218a211e98d906 ] + +Fix setting of FSYNC polarity in case of LEFT_J and DSP_A/B formats. +Do NOT set the SCFG field as was previously done, because that is not +correct and is also in conflict with the "ASI1 Source" control which +sets the same SCFG field! + +Also add support for explicit polarity inversion. + +Fixes: 827ed8a0fa50 ("ASoC: tas2764: Add the driver for the TAS2764") +Signed-off-by: Martin PoviÅ¡er +Link: https://lore.kernel.org/r/20220630075135.2221-2-povik+lin@cutebit.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2764.c | 30 +++++++++++++++++------------- + sound/soc/codecs/tas2764.h | 6 ++---- + 2 files changed, 19 insertions(+), 17 deletions(-) + +diff --git a/sound/soc/codecs/tas2764.c b/sound/soc/codecs/tas2764.c +index edc66ff6dc49..46c815650b2c 100644 +--- a/sound/soc/codecs/tas2764.c ++++ b/sound/soc/codecs/tas2764.c +@@ -135,7 +135,8 @@ static const char * const tas2764_ASI1_src[] = { + }; + + static SOC_ENUM_SINGLE_DECL( +- tas2764_ASI1_src_enum, TAS2764_TDM_CFG2, 4, tas2764_ASI1_src); ++ tas2764_ASI1_src_enum, TAS2764_TDM_CFG2, TAS2764_TDM_CFG2_SCFG_SHIFT, ++ tas2764_ASI1_src); + + static const struct snd_kcontrol_new tas2764_asi1_mux = + SOC_DAPM_ENUM("ASI1 Source", tas2764_ASI1_src_enum); +@@ -333,20 +334,22 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) + { + struct snd_soc_component *component = dai->component; + struct tas2764_priv *tas2764 = snd_soc_component_get_drvdata(component); +- u8 tdm_rx_start_slot = 0, asi_cfg_1 = 0; +- int iface; ++ u8 tdm_rx_start_slot = 0, asi_cfg_0 = 0, asi_cfg_1 = 0; + int ret; + + switch (fmt & SND_SOC_DAIFMT_INV_MASK) { ++ case SND_SOC_DAIFMT_NB_IF: ++ asi_cfg_0 ^= TAS2764_TDM_CFG0_FRAME_START; ++ fallthrough; + case SND_SOC_DAIFMT_NB_NF: + asi_cfg_1 = TAS2764_TDM_CFG1_RX_RISING; + break; ++ case SND_SOC_DAIFMT_IB_IF: ++ asi_cfg_0 ^= TAS2764_TDM_CFG0_FRAME_START; ++ fallthrough; + case SND_SOC_DAIFMT_IB_NF: + asi_cfg_1 = TAS2764_TDM_CFG1_RX_FALLING; + break; +- default: +- dev_err(tas2764->dev, "ASI format Inverse is not found\n"); +- return -EINVAL; + } + + ret = snd_soc_component_update_bits(component, TAS2764_TDM_CFG1, +@@ -357,13 +360,13 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) + + switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) { + case SND_SOC_DAIFMT_I2S: ++ asi_cfg_0 ^= TAS2764_TDM_CFG0_FRAME_START; ++ fallthrough; + case SND_SOC_DAIFMT_DSP_A: +- iface = TAS2764_TDM_CFG2_SCFG_I2S; + tdm_rx_start_slot = 1; + break; + case SND_SOC_DAIFMT_DSP_B: + case SND_SOC_DAIFMT_LEFT_J: +- iface = TAS2764_TDM_CFG2_SCFG_LEFT_J; + tdm_rx_start_slot = 0; + break; + default: +@@ -372,14 +375,15 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) + return -EINVAL; + } + +- ret = snd_soc_component_update_bits(component, TAS2764_TDM_CFG1, +- TAS2764_TDM_CFG1_MASK, +- (tdm_rx_start_slot << TAS2764_TDM_CFG1_51_SHIFT)); ++ ret = snd_soc_component_update_bits(component, TAS2764_TDM_CFG0, ++ TAS2764_TDM_CFG0_FRAME_START, ++ asi_cfg_0); + if (ret < 0) + return ret; + +- ret = snd_soc_component_update_bits(component, TAS2764_TDM_CFG2, +- TAS2764_TDM_CFG2_SCFG_MASK, iface); ++ ret = snd_soc_component_update_bits(component, TAS2764_TDM_CFG1, ++ TAS2764_TDM_CFG1_MASK, ++ (tdm_rx_start_slot << TAS2764_TDM_CFG1_51_SHIFT)); + if (ret < 0) + return ret; + +diff --git a/sound/soc/codecs/tas2764.h b/sound/soc/codecs/tas2764.h +index 67d6fd903c42..f015f22a083b 100644 +--- a/sound/soc/codecs/tas2764.h ++++ b/sound/soc/codecs/tas2764.h +@@ -47,6 +47,7 @@ + #define TAS2764_TDM_CFG0_MASK GENMASK(3, 1) + #define TAS2764_TDM_CFG0_44_1_48KHZ BIT(3) + #define TAS2764_TDM_CFG0_88_2_96KHZ (BIT(3) | BIT(1)) ++#define TAS2764_TDM_CFG0_FRAME_START BIT(0) + + /* TDM Configuration Reg1 */ + #define TAS2764_TDM_CFG1 TAS2764_REG(0X0, 0x09) +@@ -66,10 +67,7 @@ + #define TAS2764_TDM_CFG2_RXS_16BITS 0x0 + #define TAS2764_TDM_CFG2_RXS_24BITS BIT(0) + #define TAS2764_TDM_CFG2_RXS_32BITS BIT(1) +-#define TAS2764_TDM_CFG2_SCFG_MASK GENMASK(5, 4) +-#define TAS2764_TDM_CFG2_SCFG_I2S 0x0 +-#define TAS2764_TDM_CFG2_SCFG_LEFT_J BIT(4) +-#define TAS2764_TDM_CFG2_SCFG_RIGHT_J BIT(5) ++#define TAS2764_TDM_CFG2_SCFG_SHIFT 4 + + /* TDM Configuration Reg3 */ + #define TAS2764_TDM_CFG3 TAS2764_REG(0X0, 0x0c) +-- +2.35.1 + diff --git a/queue-5.15/bnxt_en-fix-bnxt_refclk_read.patch b/queue-5.15/bnxt_en-fix-bnxt_refclk_read.patch new file mode 100644 index 00000000000..d0c3da83b75 --- /dev/null +++ b/queue-5.15/bnxt_en-fix-bnxt_refclk_read.patch @@ -0,0 +1,60 @@ +From a8831cf824ea5b5ffdc7d6367dd3d9ededb00a66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 22:26:18 -0400 +Subject: bnxt_en: Fix bnxt_refclk_read() + +From: Pavan Chebbi + +[ Upstream commit ddde5412fdaa5048bbca31529d46cb8da882870c ] + +The upper 32-bit PHC register is not latched when reading the lower +32-bit PHC register. Current code leaves a small window where we may +not read correct higher order bits if the lower order bits are just about +to wrap around. + +This patch fixes this by reading higher order bits twice and makes +sure that final value is correctly paired with its lower 32 bits. + +Fixes: 30e96f487f64 ("bnxt_en: Do not read the PTP PHC during chip reset") +Cc: Richard Cochran +Signed-off-by: Pavan Chebbi +Signed-off-by: Michael Chan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c +index 62a931de5b1a..a78cc65a38f2 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c +@@ -61,14 +61,23 @@ static int bnxt_refclk_read(struct bnxt *bp, struct ptp_system_timestamp *sts, + u64 *ns) + { + struct bnxt_ptp_cfg *ptp = bp->ptp_cfg; ++ u32 high_before, high_now, low; + + if (test_bit(BNXT_STATE_IN_FW_RESET, &bp->state)) + return -EIO; + ++ high_before = readl(bp->bar0 + ptp->refclk_mapped_regs[1]); + ptp_read_system_prets(sts); +- *ns = readl(bp->bar0 + ptp->refclk_mapped_regs[0]); ++ low = readl(bp->bar0 + ptp->refclk_mapped_regs[0]); + ptp_read_system_postts(sts); +- *ns |= (u64)readl(bp->bar0 + ptp->refclk_mapped_regs[1]) << 32; ++ high_now = readl(bp->bar0 + ptp->refclk_mapped_regs[1]); ++ if (high_now != high_before) { ++ ptp_read_system_prets(sts); ++ low = readl(bp->bar0 + ptp->refclk_mapped_regs[0]); ++ ptp_read_system_postts(sts); ++ } ++ *ns = ((u64)high_now << 32) | low; ++ + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.15/bnxt_en-fix-bnxt_reinit_after_abort-code-path.patch b/queue-5.15/bnxt_en-fix-bnxt_reinit_after_abort-code-path.patch new file mode 100644 index 00000000000..12f31bba40a --- /dev/null +++ b/queue-5.15/bnxt_en-fix-bnxt_reinit_after_abort-code-path.patch @@ -0,0 +1,52 @@ +From 46b3a5a4cf93a2a4d0b277e25f5aa616684b65c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 22:26:15 -0400 +Subject: bnxt_en: Fix bnxt_reinit_after_abort() code path + +From: Michael Chan + +[ Upstream commit 4279414bff8af9898e8c53ae6c5bc17f68ad67b7 ] + +bnxt_reinit_after_abort() is called during ifup when a previous +FW reset sequence has aborted or a previous ifup has failed after +detecting FW reset. In all cases, it is safe to assume that a +previous FW reset has completed and the driver may not have fully +reinitialized. + +Prior to this patch, it is assumed that the +FUNC_DRV_IF_CHANGE_RESP_FLAGS_HOT_FW_RESET_DONE flag will always be +set by the firmware in bnxt_hwrm_if_change(). This may not be true if +the driver has already attempted to register with the firmware. The +firmware may not set the RESET_DONE flag again after the driver has +registered, assuming that the driver has seen the flag already. + +Fix it to always go through the FW reset initialization path if +the BNXT_STATE_FW_RESET_DET flag is set. This flag is always set +by the driver after successfully going through bnxt_reinit_after_abort(). + +Fixes: 6882c36cf82e ("bnxt_en: attempt to reinitialize after aborted reset") +Reviewed-by: Pavan Chebbi +Signed-off-by: Michael Chan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index cb5314945589..6962abe2358b 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -9806,7 +9806,8 @@ static int bnxt_hwrm_if_change(struct bnxt *bp, bool up) + + if (flags & FUNC_DRV_IF_CHANGE_RESP_FLAGS_RESC_CHANGE) + resc_reinit = true; +- if (flags & FUNC_DRV_IF_CHANGE_RESP_FLAGS_HOT_FW_RESET_DONE) ++ if (flags & FUNC_DRV_IF_CHANGE_RESP_FLAGS_HOT_FW_RESET_DONE || ++ test_bit(BNXT_STATE_FW_RESET_DET, &bp->state)) + fw_reset = true; + else if (bp->fw_health && !bp->fw_health->status_reliable) + bnxt_try_map_fw_health_reg(bp); +-- +2.35.1 + diff --git a/queue-5.15/ceph-switch-netfs-read-ops-to-use-rreq-inode-instead.patch b/queue-5.15/ceph-switch-netfs-read-ops-to-use-rreq-inode-instead.patch new file mode 100644 index 00000000000..9269863e393 --- /dev/null +++ b/queue-5.15/ceph-switch-netfs-read-ops-to-use-rreq-inode-instead.patch @@ -0,0 +1,54 @@ +From efecfeea43fbb44ed23fb8cef2093813b8c42e22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jan 2022 14:32:12 -0500 +Subject: ceph: switch netfs read ops to use rreq->inode instead of + rreq->mapping->host + +From: Jeff Layton + +[ Upstream commit a25cedb4313d35e1f2968105678a47ca28e84d3b ] + +One fewer pointer dereference, and in the future we may not be able to +count on the mapping pointer being populated (e.g. in the DIO case). + +Signed-off-by: Jeff Layton +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/addr.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c +index 99b80b5c7a93..b218a26291b8 100644 +--- a/fs/ceph/addr.c ++++ b/fs/ceph/addr.c +@@ -179,7 +179,7 @@ static int ceph_releasepage(struct page *page, gfp_t gfp) + + static void ceph_netfs_expand_readahead(struct netfs_read_request *rreq) + { +- struct inode *inode = rreq->mapping->host; ++ struct inode *inode = rreq->inode; + struct ceph_inode_info *ci = ceph_inode(inode); + struct ceph_file_layout *lo = &ci->i_layout; + u32 blockoff; +@@ -196,7 +196,7 @@ static void ceph_netfs_expand_readahead(struct netfs_read_request *rreq) + + static bool ceph_netfs_clamp_length(struct netfs_read_subrequest *subreq) + { +- struct inode *inode = subreq->rreq->mapping->host; ++ struct inode *inode = subreq->rreq->inode; + struct ceph_fs_client *fsc = ceph_inode_to_client(inode); + struct ceph_inode_info *ci = ceph_inode(inode); + u64 objno, objoff; +@@ -242,7 +242,7 @@ static void finish_netfs_read(struct ceph_osd_request *req) + static void ceph_netfs_issue_op(struct netfs_read_subrequest *subreq) + { + struct netfs_read_request *rreq = subreq->rreq; +- struct inode *inode = rreq->mapping->host; ++ struct inode *inode = rreq->inode; + struct ceph_inode_info *ci = ceph_inode(inode); + struct ceph_fs_client *fsc = ceph_inode_to_client(inode); + struct ceph_osd_request *req; +-- +2.35.1 + diff --git a/queue-5.15/cipso-fix-data-races-around-sysctl.patch b/queue-5.15/cipso-fix-data-races-around-sysctl.patch new file mode 100644 index 00000000000..3b6096e2ccf --- /dev/null +++ b/queue-5.15/cipso-fix-data-races-around-sysctl.patch @@ -0,0 +1,95 @@ +From 06cdd579d74b8926a3588184590b3940e4f7a408 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:40:01 -0700 +Subject: cipso: Fix data-races around sysctl. + +From: Kuniyuki Iwashima + +[ Upstream commit dd44f04b9214adb68ef5684ae87a81ba03632250 ] + +While reading cipso sysctl variables, they can be changed concurrently. +So, we need to add READ_ONCE() to avoid data-races. + +Fixes: 446fda4f2682 ("[NetLabel]: CIPSOv4 engine") +Signed-off-by: Kuniyuki Iwashima +Acked-by: Paul Moore +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + Documentation/networking/ip-sysctl.rst | 2 +- + net/ipv4/cipso_ipv4.c | 12 +++++++----- + 2 files changed, 8 insertions(+), 6 deletions(-) + +diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst +index d91ab28718d4..8d772484755a 100644 +--- a/Documentation/networking/ip-sysctl.rst ++++ b/Documentation/networking/ip-sysctl.rst +@@ -1063,7 +1063,7 @@ cipso_cache_enable - BOOLEAN + cipso_cache_bucket_size - INTEGER + The CIPSO label cache consists of a fixed size hash table with each + hash bucket containing a number of cache entries. This variable limits +- the number of entries in each hash bucket; the larger the value the ++ the number of entries in each hash bucket; the larger the value is, the + more CIPSO label mappings that can be cached. When the number of + entries in a given hash bucket reaches this limit adding new entries + causes the oldest entry in the bucket to be removed to make room. +diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c +index 099259fc826a..75ac14525344 100644 +--- a/net/ipv4/cipso_ipv4.c ++++ b/net/ipv4/cipso_ipv4.c +@@ -239,7 +239,7 @@ static int cipso_v4_cache_check(const unsigned char *key, + struct cipso_v4_map_cache_entry *prev_entry = NULL; + u32 hash; + +- if (!cipso_v4_cache_enabled) ++ if (!READ_ONCE(cipso_v4_cache_enabled)) + return -ENOENT; + + hash = cipso_v4_map_cache_hash(key, key_len); +@@ -296,13 +296,14 @@ static int cipso_v4_cache_check(const unsigned char *key, + int cipso_v4_cache_add(const unsigned char *cipso_ptr, + const struct netlbl_lsm_secattr *secattr) + { ++ int bkt_size = READ_ONCE(cipso_v4_cache_bucketsize); + int ret_val = -EPERM; + u32 bkt; + struct cipso_v4_map_cache_entry *entry = NULL; + struct cipso_v4_map_cache_entry *old_entry = NULL; + u32 cipso_ptr_len; + +- if (!cipso_v4_cache_enabled || cipso_v4_cache_bucketsize <= 0) ++ if (!READ_ONCE(cipso_v4_cache_enabled) || bkt_size <= 0) + return 0; + + cipso_ptr_len = cipso_ptr[1]; +@@ -322,7 +323,7 @@ int cipso_v4_cache_add(const unsigned char *cipso_ptr, + + bkt = entry->hash & (CIPSO_V4_CACHE_BUCKETS - 1); + spin_lock_bh(&cipso_v4_cache[bkt].lock); +- if (cipso_v4_cache[bkt].size < cipso_v4_cache_bucketsize) { ++ if (cipso_v4_cache[bkt].size < bkt_size) { + list_add(&entry->list, &cipso_v4_cache[bkt].list); + cipso_v4_cache[bkt].size += 1; + } else { +@@ -1199,7 +1200,8 @@ static int cipso_v4_gentag_rbm(const struct cipso_v4_doi *doi_def, + /* This will send packets using the "optimized" format when + * possible as specified in section 3.4.2.6 of the + * CIPSO draft. */ +- if (cipso_v4_rbm_optfmt && ret_val > 0 && ret_val <= 10) ++ if (READ_ONCE(cipso_v4_rbm_optfmt) && ret_val > 0 && ++ ret_val <= 10) + tag_len = 14; + else + tag_len = 4 + ret_val; +@@ -1603,7 +1605,7 @@ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option) + * all the CIPSO validations here but it doesn't + * really specify _exactly_ what we need to validate + * ... so, just make it a sysctl tunable. */ +- if (cipso_v4_rbm_strictvalid) { ++ if (READ_ONCE(cipso_v4_rbm_strictvalid)) { + if (cipso_v4_map_lvl_valid(doi_def, + tag[3]) < 0) { + err_offset = opt_iter + 3; +-- +2.35.1 + diff --git a/queue-5.15/drm-amd-display-only-use-depth-36-bpp-linebuffers-on.patch b/queue-5.15/drm-amd-display-only-use-depth-36-bpp-linebuffers-on.patch new file mode 100644 index 00000000000..ca426534dc7 --- /dev/null +++ b/queue-5.15/drm-amd-display-only-use-depth-36-bpp-linebuffers-on.patch @@ -0,0 +1,68 @@ +From 0ff757f2005a26beb62ec7ebda819bc8d0d88406 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 19:39:28 +0200 +Subject: drm/amd/display: Only use depth 36 bpp linebuffers on DCN display + engines. + +From: Mario Kleiner + +[ Upstream commit add61d3c31de6a4b5e11a2ab96aaf4c873481568 ] + +Various DCE versions had trouble with 36 bpp lb depth, requiring fixes, +last time in commit 353ca0fa5630 ("drm/amd/display: Fix 10bit 4K display +on CIK GPUs") for DCE-8. So far >= DCE-11.2 was considered ok, but now I +found out that on DCE-11.2 it causes dithering when there shouldn't be +any, so identity pixel passthrough with identity gamma LUTs doesn't work +when it should. This breaks various important neuroscience applications, +as reported to me by scientific users of Polaris cards under Ubuntu 22.04 +with Linux 5.15, and confirmed by testing it myself on DCE-11.2. + +Lets only use depth 36 for DCN engines, where my testing showed that it +is both necessary for high color precision output, e.g., RGBA16 fb's, +and not harmful, as far as more than one year in real-world use showed. + +DCE engines seem to work fine for high precision output at 30 bpp, so +this ("famous last words") depth 30 should hopefully fix all known problems +without introducing new ones. + +Successfully retested on DCE-11.2 Polaris and DCN-1.0 Raven Ridge on +top of Linux 5.19.0-rc2 + drm-next. + +Fixes: 353ca0fa5630 ("drm/amd/display: Fix 10bit 4K display on CIK GPUs") +Signed-off-by: Mario Kleiner +Tested-by: Mario Kleiner +Cc: stable@vger.kernel.org # 5.14.0 +Cc: Alex Deucher +Cc: Harry Wentland +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +index 82f1f27baaf3..188556e41b9d 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +@@ -1062,12 +1062,13 @@ bool resource_build_scaling_params(struct pipe_ctx *pipe_ctx) + * on certain displays, such as the Sharp 4k. 36bpp is needed + * to support SURFACE_PIXEL_FORMAT_GRPH_ARGB16161616 and + * SURFACE_PIXEL_FORMAT_GRPH_ABGR16161616 with actual > 10 bpc +- * precision on at least DCN display engines. However, at least +- * Carrizo with DCE_VERSION_11_0 does not like 36 bpp lb depth, +- * so use only 30 bpp on DCE_VERSION_11_0. Testing with DCE 11.2 and 8.3 +- * did not show such problems, so this seems to be the exception. ++ * precision on DCN display engines, but apparently not for DCE, as ++ * far as testing on DCE-11.2 and DCE-8 showed. Various DCE parts have ++ * problems: Carrizo with DCE_VERSION_11_0 does not like 36 bpp lb depth, ++ * neither do DCE-8 at 4k resolution, or DCE-11.2 (broken identify pixel ++ * passthrough). Therefore only use 36 bpp on DCN where it is actually needed. + */ +- if (plane_state->ctx->dce_version > DCE_VERSION_11_0) ++ if (plane_state->ctx->dce_version > DCE_VERSION_MAX) + pipe_ctx->plane_res.scl_data.lb_params.depth = LB_PIXEL_DEPTH_36BPP; + else + pipe_ctx->plane_res.scl_data.lb_params.depth = LB_PIXEL_DEPTH_30BPP; +-- +2.35.1 + diff --git a/queue-5.15/drm-amd-pm-prevent-divide-by-zero.patch b/queue-5.15/drm-amd-pm-prevent-divide-by-zero.patch new file mode 100644 index 00000000000..d446fb80a8b --- /dev/null +++ b/queue-5.15/drm-amd-pm-prevent-divide-by-zero.patch @@ -0,0 +1,46 @@ +From 995e472605ab615b0415c7d8e4463cd66001497c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 14:35:11 -0800 +Subject: drm/amd/pm: Prevent divide by zero +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yefim Barashkin + +[ Upstream commit 0638c98c17aa12fe914459c82cd178247e21fb2b ] + +divide error: 0000 [#1] SMP PTI +CPU: 3 PID: 78925 Comm: tee Not tainted 5.15.50-1-lts #1 +Hardware name: MSI MS-7A59/Z270 SLI PLUS (MS-7A59), BIOS 1.90 01/30/2018 +RIP: 0010:smu_v11_0_set_fan_speed_rpm+0x11/0x110 [amdgpu] + +Speed is user-configurable through a file. +I accidentally set it to zero, and the driver crashed. + +Reviewed-by: Evan Quan +Reviewed-by: André Almeida +Signed-off-by: Yefim Barashkin +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c +index e6c93396434f..614c3d049514 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c +@@ -1235,6 +1235,8 @@ int smu_v11_0_set_fan_speed_rpm(struct smu_context *smu, + uint32_t crystal_clock_freq = 2500; + uint32_t tach_period; + ++ if (speed == 0) ++ return -EINVAL; + /* + * To prevent from possible overheat, some ASICs may have requirement + * for minimum fan speed: +-- +2.35.1 + diff --git a/queue-5.15/drm-i915-dg2-add-wa_22011100796.patch b/queue-5.15/drm-i915-dg2-add-wa_22011100796.patch new file mode 100644 index 00000000000..0fc80064800 --- /dev/null +++ b/queue-5.15/drm-i915-dg2-add-wa_22011100796.patch @@ -0,0 +1,46 @@ +From d2233c2aceb1b18d78a36b0818b26486bc863666 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Jan 2022 00:22:08 +0530 +Subject: drm/i915/dg2: Add Wa_22011100796 + +From: Bruce Chang + +[ Upstream commit 154cfae6158141b18d65abb0db679bb51a8294e7 ] + +Whenever Full soft reset is required, reset all individual engines +first, and then do a full soft reset. + +Signed-off-by: Bruce Chang +cc: Matt Roper +Cc: Rodrigo Vivi +Signed-off-by: Ramalingam C +Reviewed-by: Matthew Auld +Link: https://patchwork.freedesktop.org/patch/msgid/20220128185209.18077-5-ramalingam.c@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_reset.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/i915/gt/intel_reset.c b/drivers/gpu/drm/i915/gt/intel_reset.c +index 91200c43951f..b6697c1d260a 100644 +--- a/drivers/gpu/drm/i915/gt/intel_reset.c ++++ b/drivers/gpu/drm/i915/gt/intel_reset.c +@@ -623,6 +623,15 @@ static int gen8_reset_engines(struct intel_gt *gt, + */ + } + ++ /* ++ * Wa_22011100796:dg2, whenever Full soft reset is required, ++ * reset all individual engines firstly, and then do a full soft reset. ++ * ++ * This is best effort, so ignore any error from the initial reset. ++ */ ++ if (IS_DG2(gt->i915) && engine_mask == ALL_ENGINES) ++ gen11_reset_engines(gt, gt->info.engine_mask, 0); ++ + if (GRAPHICS_VER(gt->i915) >= 11) + ret = gen11_reset_engines(gt, engine_mask, retry); + else +-- +2.35.1 + diff --git a/queue-5.15/drm-i915-fix-a-possible-refcount-leak-in-intel_dp_ad.patch b/queue-5.15/drm-i915-fix-a-possible-refcount-leak-in-intel_dp_ad.patch new file mode 100644 index 00000000000..64a7965020f --- /dev/null +++ b/queue-5.15/drm-i915-fix-a-possible-refcount-leak-in-intel_dp_ad.patch @@ -0,0 +1,44 @@ +From e0856fd21eb5a2dda0433bf9eb773d4d686e438a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jun 2022 06:04:06 -0700 +Subject: drm/i915: fix a possible refcount leak in + intel_dp_add_mst_connector() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hangyu Hua + +[ Upstream commit 85144df9ff4652816448369de76897c57cbb1b93 ] + +If drm_connector_init fails, intel_connector_free will be called to take +care of proper free. So it is necessary to drop the refcount of port +before intel_connector_free. + +Fixes: 091a4f91942a ("drm/i915: Handle drm-layer errors in intel_dp_add_mst_connector") +Signed-off-by: Hangyu Hua +Reviewed-by: José Roberto de Souza +Link: https://patchwork.freedesktop.org/patch/msgid/20220624130406.17996-1-jose.souza@intel.com +Signed-off-by: José Roberto de Souza +(cherry picked from commit cea9ed611e85d36a05db52b6457bf584b7d969e2) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_dp_mst.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/i915/display/intel_dp_mst.c b/drivers/gpu/drm/i915/display/intel_dp_mst.c +index 8d13d7b26a25..2a20487effcc 100644 +--- a/drivers/gpu/drm/i915/display/intel_dp_mst.c ++++ b/drivers/gpu/drm/i915/display/intel_dp_mst.c +@@ -817,6 +817,7 @@ static struct drm_connector *intel_dp_add_mst_connector(struct drm_dp_mst_topolo + ret = drm_connector_init(dev, connector, &intel_dp_mst_connector_funcs, + DRM_MODE_CONNECTOR_DisplayPort); + if (ret) { ++ drm_dp_mst_put_port_malloc(port); + intel_connector_free(intel_connector); + return NULL; + } +-- +2.35.1 + diff --git a/queue-5.15/drm-i915-gt-serialize-grdom-access-between-multiple-.patch b/queue-5.15/drm-i915-gt-serialize-grdom-access-between-multiple-.patch new file mode 100644 index 00000000000..d0383e8c023 --- /dev/null +++ b/queue-5.15/drm-i915-gt-serialize-grdom-access-between-multiple-.patch @@ -0,0 +1,124 @@ +From 7aa0dc6acf0220071e308e8e2b46330d44b3a1a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 16:21:32 +0100 +Subject: drm/i915/gt: Serialize GRDOM access between multiple engine resets +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chris Wilson + +[ Upstream commit b24dcf1dc507f69ed3b5c66c2b6a0209ae80d4d4 ] + +Don't allow two engines to be reset in parallel, as they would both +try to select a reset bit (and send requests to common registers) +and wait on that register, at the same time. Serialize control of +the reset requests/acks using the uncore->lock, which will also ensure +that no other GT state changes at the same time as the actual reset. + +Cc: stable@vger.kernel.org # v4.4 and upper +Reported-by: Mika Kuoppala +Signed-off-by: Chris Wilson +Acked-by: Mika Kuoppala +Reviewed-by: Andi Shyti +Reviewed-by: Andrzej Hajda +Acked-by: Thomas Hellström +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Rodrigo Vivi +Link: https://patchwork.freedesktop.org/patch/msgid/e0a2d894e77aed7c2e36b0d1abdc7dbac3011729.1657639152.git.mchehab@kernel.org +(cherry picked from commit 336561a914fc0c6f1218228718f633b31b7af1c3) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_reset.c | 37 ++++++++++++++++++++------- + 1 file changed, 28 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_reset.c b/drivers/gpu/drm/i915/gt/intel_reset.c +index b6697c1d260a..18b0e57c58c1 100644 +--- a/drivers/gpu/drm/i915/gt/intel_reset.c ++++ b/drivers/gpu/drm/i915/gt/intel_reset.c +@@ -293,9 +293,9 @@ static int gen6_hw_domain_reset(struct intel_gt *gt, u32 hw_domain_mask) + return err; + } + +-static int gen6_reset_engines(struct intel_gt *gt, +- intel_engine_mask_t engine_mask, +- unsigned int retry) ++static int __gen6_reset_engines(struct intel_gt *gt, ++ intel_engine_mask_t engine_mask, ++ unsigned int retry) + { + static const u32 hw_engine_mask[] = { + [RCS0] = GEN6_GRDOM_RENDER, +@@ -322,6 +322,20 @@ static int gen6_reset_engines(struct intel_gt *gt, + return gen6_hw_domain_reset(gt, hw_mask); + } + ++static int gen6_reset_engines(struct intel_gt *gt, ++ intel_engine_mask_t engine_mask, ++ unsigned int retry) ++{ ++ unsigned long flags; ++ int ret; ++ ++ spin_lock_irqsave(>->uncore->lock, flags); ++ ret = __gen6_reset_engines(gt, engine_mask, retry); ++ spin_unlock_irqrestore(>->uncore->lock, flags); ++ ++ return ret; ++} ++ + static struct intel_engine_cs *find_sfc_paired_vecs_engine(struct intel_engine_cs *engine) + { + int vecs_id; +@@ -488,9 +502,9 @@ static void gen11_unlock_sfc(struct intel_engine_cs *engine) + rmw_clear_fw(uncore, sfc_lock.lock_reg, sfc_lock.lock_bit); + } + +-static int gen11_reset_engines(struct intel_gt *gt, +- intel_engine_mask_t engine_mask, +- unsigned int retry) ++static int __gen11_reset_engines(struct intel_gt *gt, ++ intel_engine_mask_t engine_mask, ++ unsigned int retry) + { + static const u32 hw_engine_mask[] = { + [RCS0] = GEN11_GRDOM_RENDER, +@@ -601,8 +615,11 @@ static int gen8_reset_engines(struct intel_gt *gt, + struct intel_engine_cs *engine; + const bool reset_non_ready = retry >= 1; + intel_engine_mask_t tmp; ++ unsigned long flags; + int ret; + ++ spin_lock_irqsave(>->uncore->lock, flags); ++ + for_each_engine_masked(engine, gt, engine_mask, tmp) { + ret = gen8_engine_reset_prepare(engine); + if (ret && !reset_non_ready) +@@ -630,17 +647,19 @@ static int gen8_reset_engines(struct intel_gt *gt, + * This is best effort, so ignore any error from the initial reset. + */ + if (IS_DG2(gt->i915) && engine_mask == ALL_ENGINES) +- gen11_reset_engines(gt, gt->info.engine_mask, 0); ++ __gen11_reset_engines(gt, gt->info.engine_mask, 0); + + if (GRAPHICS_VER(gt->i915) >= 11) +- ret = gen11_reset_engines(gt, engine_mask, retry); ++ ret = __gen11_reset_engines(gt, engine_mask, retry); + else +- ret = gen6_reset_engines(gt, engine_mask, retry); ++ ret = __gen6_reset_engines(gt, engine_mask, retry); + + skip_reset: + for_each_engine_masked(engine, gt, engine_mask, tmp) + gen8_engine_reset_cancel(engine); + ++ spin_unlock_irqrestore(>->uncore->lock, flags); ++ + return ret; + } + +-- +2.35.1 + diff --git a/queue-5.15/drm-i915-gt-serialize-tlb-invalidates-with-gt-resets.patch b/queue-5.15/drm-i915-gt-serialize-tlb-invalidates-with-gt-resets.patch new file mode 100644 index 00000000000..f1210d1c8bc --- /dev/null +++ b/queue-5.15/drm-i915-gt-serialize-tlb-invalidates-with-gt-resets.patch @@ -0,0 +1,76 @@ +From 958c84ce8ec1e809c8a4c2f4beef9f0ea32cd38a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 16:21:33 +0100 +Subject: drm/i915/gt: Serialize TLB invalidates with GT resets +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chris Wilson + +[ Upstream commit a1c5a7bf79c1faa5633b918b5c0666545e84c4d1 ] + +Avoid trying to invalidate the TLB in the middle of performing an +engine reset, as this may result in the reset timing out. Currently, +the TLB invalidate is only serialised by its own mutex, forgoing the +uncore lock, but we can take the uncore->lock as well to serialise +the mmio access, thereby serialising with the GDRST. + +Tested on a NUC5i7RYB, BIOS RYBDWi35.86A.0380.2019.0517.1530 with +i915 selftest/hangcheck. + +Cc: stable@vger.kernel.org # v4.4 and upper +Fixes: 7938d61591d3 ("drm/i915: Flush TLBs before releasing backing store") +Reported-by: Mauro Carvalho Chehab +Tested-by: Mauro Carvalho Chehab +Reviewed-by: Mauro Carvalho Chehab +Signed-off-by: Chris Wilson +Cc: Tvrtko Ursulin +Reviewed-by: Andi Shyti +Acked-by: Thomas Hellström +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Rodrigo Vivi +Link: https://patchwork.freedesktop.org/patch/msgid/1e59a7c45dd919a530256b9ac721ac6ea86c0677.1657639152.git.mchehab@kernel.org +(cherry picked from commit 33da97894758737895e90c909f16786052680ef4) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_gt.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_gt.c b/drivers/gpu/drm/i915/gt/intel_gt.c +index e1e1d17d49fd..3a76000d15bf 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gt.c ++++ b/drivers/gpu/drm/i915/gt/intel_gt.c +@@ -970,6 +970,20 @@ void intel_gt_invalidate_tlbs(struct intel_gt *gt) + mutex_lock(>->tlb_invalidate_lock); + intel_uncore_forcewake_get(uncore, FORCEWAKE_ALL); + ++ spin_lock_irq(&uncore->lock); /* serialise invalidate with GT reset */ ++ ++ for_each_engine(engine, gt, id) { ++ struct reg_and_bit rb; ++ ++ rb = get_reg_and_bit(engine, regs == gen8_regs, regs, num); ++ if (!i915_mmio_reg_offset(rb.reg)) ++ continue; ++ ++ intel_uncore_write_fw(uncore, rb.reg, rb.bit); ++ } ++ ++ spin_unlock_irq(&uncore->lock); ++ + for_each_engine(engine, gt, id) { + /* + * HW architecture suggest typical invalidation time at 40us, +@@ -984,7 +998,6 @@ void intel_gt_invalidate_tlbs(struct intel_gt *gt) + if (!i915_mmio_reg_offset(rb.reg)) + continue; + +- intel_uncore_write_fw(uncore, rb.reg, rb.bit); + if (__intel_wait_for_register_fw(uncore, + rb.reg, rb.bit, 0, + timeout_us, timeout_ms, +-- +2.35.1 + diff --git a/queue-5.15/drm-i915-gvt-is_err-vs-null-bug-in-intel_gvt_update_.patch b/queue-5.15/drm-i915-gvt-is_err-vs-null-bug-in-intel_gvt_update_.patch new file mode 100644 index 00000000000..9ac8b62bf82 --- /dev/null +++ b/queue-5.15/drm-i915-gvt-is_err-vs-null-bug-in-intel_gvt_update_.patch @@ -0,0 +1,44 @@ +From 760b08875bc7c5d9d69af7c889876b5431eee59d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 11:41:06 +0300 +Subject: drm/i915/gvt: IS_ERR() vs NULL bug in + intel_gvt_update_reg_whitelist() + +From: Dan Carpenter + +[ Upstream commit e87197fbd137c888fd6c871c72fe7e89445dd015 ] + +The shmem_pin_map() function returns NULL, it doesn't return error +pointers. + +Fixes: 97ea656521c8 ("drm/i915/gvt: Parse default state to update reg whitelist") +Reviewed-by: Andrzej Hajda +Signed-off-by: Dan Carpenter +Signed-off-by: Zhenyu Wang +Link: http://patchwork.freedesktop.org/patch/msgid/Ysftoia2BPUyqVcD@kili +Acked-by: Zhenyu Wang +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gvt/cmd_parser.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c +index c4118b808268..11971ee929f8 100644 +--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c ++++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c +@@ -3115,9 +3115,9 @@ void intel_gvt_update_reg_whitelist(struct intel_vgpu *vgpu) + continue; + + vaddr = shmem_pin_map(engine->default_state); +- if (IS_ERR(vaddr)) { +- gvt_err("failed to map %s->default state, err:%zd\n", +- engine->name, PTR_ERR(vaddr)); ++ if (!vaddr) { ++ gvt_err("failed to map %s->default state\n", ++ engine->name); + return; + } + +-- +2.35.1 + diff --git a/queue-5.15/drm-i915-require-the-vm-mutex-for-i915_vma_bind.patch b/queue-5.15/drm-i915-require-the-vm-mutex-for-i915_vma_bind.patch new file mode 100644 index 00000000000..bc4f10fad4a --- /dev/null +++ b/queue-5.15/drm-i915-require-the-vm-mutex-for-i915_vma_bind.patch @@ -0,0 +1,120 @@ +From 1a13d3fdac88030984978ce9dd6c6bda348f011d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Dec 2021 21:00:50 +0100 +Subject: drm/i915: Require the vm mutex for i915_vma_bind() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Hellström + +[ Upstream commit c2ea703dcafccf18d7d77d8b68fb08c2d9842b7a ] + +Protect updates of struct i915_vma flags and async binding / unbinding +with the vm::mutex. This means that i915_vma_bind() needs to assert +vm::mutex held. In order to make that possible drop the caching of +kmap_atomic() maps around i915_vma_bind(). + +An alternative would be to use kmap_local() but since we block cpu +unplugging during sleeps inside kmap_local() sections this may have +unwanted side-effects. Particularly since we might wait for gpu while +holding the vm mutex. + +This change may theoretically increase execbuf cpu-usage on snb, but +at least on non-highmem systems that increase should be very small. + +Signed-off-by: Thomas Hellström +Reviewed-by: Matthew Auld +Link: https://patchwork.freedesktop.org/patch/msgid/20211221200050.436316-5-thomas.hellstrom@linux.intel.com +Signed-off-by: Sasha Levin +--- + .../gpu/drm/i915/gem/i915_gem_execbuffer.c | 50 ++++++++++++++++++- + drivers/gpu/drm/i915/i915_vma.c | 1 + + 2 files changed, 50 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c +index 1aa249908b64..0d480867fc0c 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c +@@ -1060,6 +1060,47 @@ static inline struct i915_ggtt *cache_to_ggtt(struct reloc_cache *cache) + return &i915->ggtt; + } + ++static void reloc_cache_unmap(struct reloc_cache *cache) ++{ ++ void *vaddr; ++ ++ if (!cache->vaddr) ++ return; ++ ++ vaddr = unmask_page(cache->vaddr); ++ if (cache->vaddr & KMAP) ++ kunmap_atomic(vaddr); ++ else ++ io_mapping_unmap_atomic((void __iomem *)vaddr); ++} ++ ++static void reloc_cache_remap(struct reloc_cache *cache, ++ struct drm_i915_gem_object *obj) ++{ ++ void *vaddr; ++ ++ if (!cache->vaddr) ++ return; ++ ++ if (cache->vaddr & KMAP) { ++ struct page *page = i915_gem_object_get_page(obj, cache->page); ++ ++ vaddr = kmap_atomic(page); ++ cache->vaddr = unmask_flags(cache->vaddr) | ++ (unsigned long)vaddr; ++ } else { ++ struct i915_ggtt *ggtt = cache_to_ggtt(cache); ++ unsigned long offset; ++ ++ offset = cache->node.start; ++ if (!drm_mm_node_allocated(&cache->node)) ++ offset += cache->page << PAGE_SHIFT; ++ ++ cache->vaddr = (unsigned long) ++ io_mapping_map_atomic_wc(&ggtt->iomap, offset); ++ } ++} ++ + static void reloc_cache_reset(struct reloc_cache *cache, struct i915_execbuffer *eb) + { + void *vaddr; +@@ -1324,10 +1365,17 @@ eb_relocate_entry(struct i915_execbuffer *eb, + * batchbuffers. + */ + if (reloc->write_domain == I915_GEM_DOMAIN_INSTRUCTION && +- GRAPHICS_VER(eb->i915) == 6) { ++ GRAPHICS_VER(eb->i915) == 6 && ++ !i915_vma_is_bound(target->vma, I915_VMA_GLOBAL_BIND)) { ++ struct i915_vma *vma = target->vma; ++ ++ reloc_cache_unmap(&eb->reloc_cache); ++ mutex_lock(&vma->vm->mutex); + err = i915_vma_bind(target->vma, + target->vma->obj->cache_level, + PIN_GLOBAL, NULL); ++ mutex_unlock(&vma->vm->mutex); ++ reloc_cache_remap(&eb->reloc_cache, ev->vma->obj); + if (err) + return err; + } +diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c +index dfd20060812b..3df304edabc7 100644 +--- a/drivers/gpu/drm/i915/i915_vma.c ++++ b/drivers/gpu/drm/i915/i915_vma.c +@@ -376,6 +376,7 @@ int i915_vma_bind(struct i915_vma *vma, + u32 bind_flags; + u32 vma_flags; + ++ lockdep_assert_held(&vma->vm->mutex); + GEM_BUG_ON(!drm_mm_node_allocated(&vma->node)); + GEM_BUG_ON(vma->size > vma->node.size); + +-- +2.35.1 + diff --git a/queue-5.15/drm-i915-selftests-fix-a-couple-is_err-vs-null-tests.patch b/queue-5.15/drm-i915-selftests-fix-a-couple-is_err-vs-null-tests.patch new file mode 100644 index 00000000000..e76ce497fba --- /dev/null +++ b/queue-5.15/drm-i915-selftests-fix-a-couple-is_err-vs-null-tests.patch @@ -0,0 +1,53 @@ +From ac981490645dfb5da3a84cc837f2416861cdd7ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 12:41:04 +0300 +Subject: drm/i915/selftests: fix a couple IS_ERR() vs NULL tests + +From: Dan Carpenter + +[ Upstream commit 896dcabd1f8f613c533d948df17408c41f8929f5 ] + +The shmem_pin_map() function doesn't return error pointers, it returns +NULL. + +Fixes: be1cb55a07bf ("drm/i915/gt: Keep a no-frills swappable copy of the default context state") +Signed-off-by: Dan Carpenter +Reviewed-by: Matthew Auld +Signed-off-by: Matthew Auld +Link: https://patchwork.freedesktop.org/patch/msgid/20220708094104.GL2316@kadam +(cherry picked from commit d50f5a109cf4ed50c5b575c1bb5fc3bd17b23308) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/selftest_lrc.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/selftest_lrc.c b/drivers/gpu/drm/i915/gt/selftest_lrc.c +index b0977a3b699b..bc2950fbbaf9 100644 +--- a/drivers/gpu/drm/i915/gt/selftest_lrc.c ++++ b/drivers/gpu/drm/i915/gt/selftest_lrc.c +@@ -153,8 +153,8 @@ static int live_lrc_layout(void *arg) + continue; + + hw = shmem_pin_map(engine->default_state); +- if (IS_ERR(hw)) { +- err = PTR_ERR(hw); ++ if (!hw) { ++ err = -ENOMEM; + break; + } + hw += LRC_STATE_OFFSET / sizeof(*hw); +@@ -329,8 +329,8 @@ static int live_lrc_fixed(void *arg) + continue; + + hw = shmem_pin_map(engine->default_state); +- if (IS_ERR(hw)) { +- err = PTR_ERR(hw); ++ if (!hw) { ++ err = -ENOMEM; + break; + } + hw += LRC_STATE_OFFSET / sizeof(*hw); +-- +2.35.1 + diff --git a/queue-5.15/drm-i915-uc-correctly-track-uc_fw-init-failure.patch b/queue-5.15/drm-i915-uc-correctly-track-uc_fw-init-failure.patch new file mode 100644 index 00000000000..4aac78db90a --- /dev/null +++ b/queue-5.15/drm-i915-uc-correctly-track-uc_fw-init-failure.patch @@ -0,0 +1,133 @@ +From 291b1cacce5f9c037dcca0963c4ec7031030c703 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Dec 2021 16:07:54 -0800 +Subject: drm/i915/uc: correctly track uc_fw init failure + +From: Daniele Ceraolo Spurio + +[ Upstream commit 35d4efec103e1afde968cfc9305f00f9aceb19cc ] + +The FAILURE state of uc_fw currently implies that the fw is loadable +(i.e init completed), so we can't use it for init failures and instead +need a dedicated error code. + +Note that this currently does not cause any issues because if we fail to +init any of the firmwares we abort the load, but better be accurate +anyway in case things change in the future. + +Signed-off-by: Daniele Ceraolo Spurio +Reviewed-by: Matthew Brost +Link: https://patchwork.freedesktop.org/patch/msgid/20211211000756.1698923-2-daniele.ceraolospurio@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c | 2 +- + drivers/gpu/drm/i915/gt/uc/intel_huc.c | 2 +- + drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c | 4 ++-- + drivers/gpu/drm/i915/gt/uc/intel_uc_fw.h | 17 +++++++++++------ + 4 files changed, 15 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c +index 76fe766ad1bc..bb951b8d5203 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c +@@ -159,6 +159,6 @@ int intel_guc_fw_upload(struct intel_guc *guc) + return 0; + + out: +- intel_uc_fw_change_status(&guc->fw, INTEL_UC_FIRMWARE_FAIL); ++ intel_uc_fw_change_status(&guc->fw, INTEL_UC_FIRMWARE_LOAD_FAIL); + return ret; + } +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_huc.c b/drivers/gpu/drm/i915/gt/uc/intel_huc.c +index fc5387b410a2..9ee22ac92540 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_huc.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_huc.c +@@ -191,7 +191,7 @@ int intel_huc_auth(struct intel_huc *huc) + + fail: + i915_probe_error(gt->i915, "HuC: Authentication failed %d\n", ret); +- intel_uc_fw_change_status(&huc->fw, INTEL_UC_FIRMWARE_FAIL); ++ intel_uc_fw_change_status(&huc->fw, INTEL_UC_FIRMWARE_LOAD_FAIL); + return ret; + } + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c b/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c +index 3a16d08608a5..6be7fbf9d18a 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c +@@ -526,7 +526,7 @@ int intel_uc_fw_upload(struct intel_uc_fw *uc_fw, u32 dst_offset, u32 dma_flags) + i915_probe_error(gt->i915, "Failed to load %s firmware %s (%d)\n", + intel_uc_fw_type_repr(uc_fw->type), uc_fw->path, + err); +- intel_uc_fw_change_status(uc_fw, INTEL_UC_FIRMWARE_FAIL); ++ intel_uc_fw_change_status(uc_fw, INTEL_UC_FIRMWARE_LOAD_FAIL); + return err; + } + +@@ -544,7 +544,7 @@ int intel_uc_fw_init(struct intel_uc_fw *uc_fw) + if (err) { + DRM_DEBUG_DRIVER("%s fw pin-pages err=%d\n", + intel_uc_fw_type_repr(uc_fw->type), err); +- intel_uc_fw_change_status(uc_fw, INTEL_UC_FIRMWARE_FAIL); ++ intel_uc_fw_change_status(uc_fw, INTEL_UC_FIRMWARE_INIT_FAIL); + } + + return err; +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.h b/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.h +index 99bb1fe1af66..c1a7246fb7d6 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.h ++++ b/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.h +@@ -31,11 +31,12 @@ struct intel_gt; + * | | MISSING <--/ | \--> ERROR | + * | fetch | V | + * | | AVAILABLE | +- * +------------+- | -+ ++ * +------------+- | \ -+ ++ * | | | \--> INIT FAIL | + * | init | V | + * | | /------> LOADABLE <----<-----------\ | + * +------------+- \ / \ \ \ -+ +- * | | FAIL <--< \--> TRANSFERRED \ | ++ * | | LOAD FAIL <--< \--> TRANSFERRED \ | + * | upload | \ / \ / | + * | | \---------/ \--> RUNNING | + * +------------+---------------------------------------------------+ +@@ -49,8 +50,9 @@ enum intel_uc_fw_status { + INTEL_UC_FIRMWARE_MISSING, /* blob not found on the system */ + INTEL_UC_FIRMWARE_ERROR, /* invalid format or version */ + INTEL_UC_FIRMWARE_AVAILABLE, /* blob found and copied in mem */ ++ INTEL_UC_FIRMWARE_INIT_FAIL, /* failed to prepare fw objects for load */ + INTEL_UC_FIRMWARE_LOADABLE, /* all fw-required objects are ready */ +- INTEL_UC_FIRMWARE_FAIL, /* failed to xfer or init/auth the fw */ ++ INTEL_UC_FIRMWARE_LOAD_FAIL, /* failed to xfer or init/auth the fw */ + INTEL_UC_FIRMWARE_TRANSFERRED, /* dma xfer done */ + INTEL_UC_FIRMWARE_RUNNING /* init/auth done */ + }; +@@ -121,10 +123,12 @@ const char *intel_uc_fw_status_repr(enum intel_uc_fw_status status) + return "ERROR"; + case INTEL_UC_FIRMWARE_AVAILABLE: + return "AVAILABLE"; ++ case INTEL_UC_FIRMWARE_INIT_FAIL: ++ return "INIT FAIL"; + case INTEL_UC_FIRMWARE_LOADABLE: + return "LOADABLE"; +- case INTEL_UC_FIRMWARE_FAIL: +- return "FAIL"; ++ case INTEL_UC_FIRMWARE_LOAD_FAIL: ++ return "LOAD FAIL"; + case INTEL_UC_FIRMWARE_TRANSFERRED: + return "TRANSFERRED"; + case INTEL_UC_FIRMWARE_RUNNING: +@@ -146,7 +150,8 @@ static inline int intel_uc_fw_status_to_error(enum intel_uc_fw_status status) + return -ENOENT; + case INTEL_UC_FIRMWARE_ERROR: + return -ENOEXEC; +- case INTEL_UC_FIRMWARE_FAIL: ++ case INTEL_UC_FIRMWARE_INIT_FAIL: ++ case INTEL_UC_FIRMWARE_LOAD_FAIL: + return -EIO; + case INTEL_UC_FIRMWARE_SELECTED: + return -ESTALE; +-- +2.35.1 + diff --git a/queue-5.15/icmp-fix-a-data-race-around-sysctl_icmp_errors_use_i.patch b/queue-5.15/icmp-fix-a-data-race-around-sysctl_icmp_errors_use_i.patch new file mode 100644 index 00000000000..2256eeb8b91 --- /dev/null +++ b/queue-5.15/icmp-fix-a-data-race-around-sysctl_icmp_errors_use_i.patch @@ -0,0 +1,50 @@ +From 7b60c9ef476fa93ea8a9b6ca65cb2f1a7f769b32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:26 -0700 +Subject: icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr. + +From: Kuniyuki Iwashima + +[ Upstream commit d2efabce81db7eed1c98fa1a3f203f0edd738ac3 ] + +While reading sysctl_icmp_errors_use_inbound_ifaddr, it can be changed +concurrently. Thus, we need to add READ_ONCE() to its reader. + +Fixes: 1c2fb7f93cb2 ("[IPV4]: Sysctl configurable icmp error source address.") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/icmp.c | 2 +- + net/ipv4/sysctl_net_ipv4.c | 2 ++ + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index 6f444b2b7d1a..e40a79bb0a6e 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -702,7 +702,7 @@ void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info, + + rcu_read_lock(); + if (rt_is_input_route(rt) && +- net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr) ++ READ_ONCE(net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr)) + dev = dev_get_by_index_rcu(net, inet_iif(skb_in)); + + if (dev) +diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c +index 51863031b178..49a8167dda87 100644 +--- a/net/ipv4/sysctl_net_ipv4.c ++++ b/net/ipv4/sysctl_net_ipv4.c +@@ -648,6 +648,8 @@ static struct ctl_table ipv4_net_table[] = { + .maxlen = sizeof(u8), + .mode = 0644, + .proc_handler = proc_dou8vec_minmax, ++ .extra1 = SYSCTL_ZERO, ++ .extra2 = SYSCTL_ONE + }, + { + .procname = "icmp_ratelimit", +-- +2.35.1 + diff --git a/queue-5.15/icmp-fix-a-data-race-around-sysctl_icmp_ignore_bogus.patch b/queue-5.15/icmp-fix-a-data-race-around-sysctl_icmp_ignore_bogus.patch new file mode 100644 index 00000000000..15fc7d32e96 --- /dev/null +++ b/queue-5.15/icmp-fix-a-data-race-around-sysctl_icmp_ignore_bogus.patch @@ -0,0 +1,51 @@ +From 5315d765437835708b1ba2b7d0fb18788a45cc60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:25 -0700 +Subject: icmp: Fix a data-race around + sysctl_icmp_ignore_bogus_error_responses. + +From: Kuniyuki Iwashima + +[ Upstream commit b04f9b7e85c7d7aecbada620e8759a662af068d3 ] + +While reading sysctl_icmp_ignore_bogus_error_responses, it can be changed +concurrently. Thus, we need to add READ_ONCE() to its reader. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/icmp.c | 2 +- + net/ipv4/sysctl_net_ipv4.c | 2 ++ + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index 91be44180dd5..6f444b2b7d1a 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -939,7 +939,7 @@ static bool icmp_unreach(struct sk_buff *skb) + * get the other vendor to fix their kit. + */ + +- if (!net->ipv4.sysctl_icmp_ignore_bogus_error_responses && ++ if (!READ_ONCE(net->ipv4.sysctl_icmp_ignore_bogus_error_responses) && + inet_addr_type_dev_table(net, skb->dev, iph->daddr) == RTN_BROADCAST) { + net_warn_ratelimited("%pI4 sent an invalid ICMP type %u, code %u error to a broadcast: %pI4 on %s\n", + &ip_hdr(skb)->saddr, +diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c +index 6f1e64d49232..51863031b178 100644 +--- a/net/ipv4/sysctl_net_ipv4.c ++++ b/net/ipv4/sysctl_net_ipv4.c +@@ -639,6 +639,8 @@ static struct ctl_table ipv4_net_table[] = { + .maxlen = sizeof(u8), + .mode = 0644, + .proc_handler = proc_dou8vec_minmax, ++ .extra1 = SYSCTL_ZERO, ++ .extra2 = SYSCTL_ONE + }, + { + .procname = "icmp_errors_use_inbound_ifaddr", +-- +2.35.1 + diff --git a/queue-5.15/icmp-fix-a-data-race-around-sysctl_icmp_ratelimit.patch b/queue-5.15/icmp-fix-a-data-race-around-sysctl_icmp_ratelimit.patch new file mode 100644 index 00000000000..f54509103ed --- /dev/null +++ b/queue-5.15/icmp-fix-a-data-race-around-sysctl_icmp_ratelimit.patch @@ -0,0 +1,37 @@ +From 66b85c9975e49702d7708a22a4b33d4cbc61c9c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:27 -0700 +Subject: icmp: Fix a data-race around sysctl_icmp_ratelimit. + +From: Kuniyuki Iwashima + +[ Upstream commit 2a4eb714841f288cf51c7d942d98af6a8c6e4b01 ] + +While reading sysctl_icmp_ratelimit, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/icmp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index e40a79bb0a6e..3a36c198965d 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -328,7 +328,8 @@ static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt, + + vif = l3mdev_master_ifindex(dst->dev); + peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, vif, 1); +- rc = inet_peer_xrlim_allow(peer, net->ipv4.sysctl_icmp_ratelimit); ++ rc = inet_peer_xrlim_allow(peer, ++ READ_ONCE(net->ipv4.sysctl_icmp_ratelimit)); + if (peer) + inet_putpeer(peer); + out: +-- +2.35.1 + diff --git a/queue-5.15/icmp-fix-a-data-race-around-sysctl_icmp_ratemask.patch b/queue-5.15/icmp-fix-a-data-race-around-sysctl_icmp_ratemask.patch new file mode 100644 index 00000000000..055510469e6 --- /dev/null +++ b/queue-5.15/icmp-fix-a-data-race-around-sysctl_icmp_ratemask.patch @@ -0,0 +1,36 @@ +From 0aacdbd11e12dee007c3926011e7f1698691dd8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:28 -0700 +Subject: icmp: Fix a data-race around sysctl_icmp_ratemask. + +From: Kuniyuki Iwashima + +[ Upstream commit 1ebcb25ad6fc3d50fca87350acf451b9a66dd31e ] + +While reading sysctl_icmp_ratemask, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/icmp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index 3a36c198965d..a5cc89506c1e 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -290,7 +290,7 @@ static bool icmpv4_mask_allow(struct net *net, int type, int code) + return true; + + /* Limit if icmp type is enabled in ratemask. */ +- if (!((1 << type) & net->ipv4.sysctl_icmp_ratemask)) ++ if (!((1 << type) & READ_ONCE(net->ipv4.sysctl_icmp_ratemask))) + return true; + + return false; +-- +2.35.1 + diff --git a/queue-5.15/icmp-fix-data-races-around-sysctl.patch b/queue-5.15/icmp-fix-data-races-around-sysctl.patch new file mode 100644 index 00000000000..6ac4000aa8d --- /dev/null +++ b/queue-5.15/icmp-fix-data-races-around-sysctl.patch @@ -0,0 +1,42 @@ +From 7b06e76f6d019b016b52806769ea64556b9ef0cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:40:02 -0700 +Subject: icmp: Fix data-races around sysctl. + +From: Kuniyuki Iwashima + +[ Upstream commit 48d7ee321ea5182c6a70782aa186422a70e67e22 ] + +While reading icmp sysctl variables, they can be changed concurrently. +So, we need to add READ_ONCE() to avoid data-races. + +Fixes: 4cdf507d5452 ("icmp: add a global rate limitation") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/icmp.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index b7e277d8a84d..b5766b62ca97 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -261,11 +261,12 @@ bool icmp_global_allow(void) + spin_lock(&icmp_global.lock); + delta = min_t(u32, now - icmp_global.stamp, HZ); + if (delta >= HZ / 50) { +- incr = sysctl_icmp_msgs_per_sec * delta / HZ ; ++ incr = READ_ONCE(sysctl_icmp_msgs_per_sec) * delta / HZ; + if (incr) + WRITE_ONCE(icmp_global.stamp, now); + } +- credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst); ++ credit = min_t(u32, icmp_global.credit + incr, ++ READ_ONCE(sysctl_icmp_msgs_burst)); + if (credit) { + /* We want to use a credit of one in average, but need to randomize + * it for security reasons. +-- +2.35.1 + diff --git a/queue-5.15/icmp-fix-data-races-around-sysctl_icmp_echo_enable_p.patch b/queue-5.15/icmp-fix-data-races-around-sysctl_icmp_echo_enable_p.patch new file mode 100644 index 00000000000..eb846f69276 --- /dev/null +++ b/queue-5.15/icmp-fix-data-races-around-sysctl_icmp_echo_enable_p.patch @@ -0,0 +1,51 @@ +From 1550d4b5f0878c6ac166dc75fbd8f2d55423b5cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:23 -0700 +Subject: icmp: Fix data-races around sysctl_icmp_echo_enable_probe. + +From: Kuniyuki Iwashima + +[ Upstream commit 4a2f7083cc6cb72dade9a63699ca352fad26d1cd ] + +While reading sysctl_icmp_echo_enable_probe, it can be changed +concurrently. Thus, we need to add READ_ONCE() to its readers. + +Fixes: d329ea5bd884 ("icmp: add response to RFC 8335 PROBE messages") +Fixes: 1fd07f33c3ea ("ipv6: ICMPV6: add response to ICMPV6 RFC 8335 PROBE messages") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/icmp.c | 2 +- + net/ipv6/icmp.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index b5766b62ca97..91be44180dd5 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -1034,7 +1034,7 @@ bool icmp_build_probe(struct sk_buff *skb, struct icmphdr *icmphdr) + u16 ident_len; + u8 status; + +- if (!net->ipv4.sysctl_icmp_echo_enable_probe) ++ if (!READ_ONCE(net->ipv4.sysctl_icmp_echo_enable_probe)) + return false; + + /* We currently only support probing interfaces on the proxy node +diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c +index 96c5cc0f30ce..716e7717fe8f 100644 +--- a/net/ipv6/icmp.c ++++ b/net/ipv6/icmp.c +@@ -927,7 +927,7 @@ static int icmpv6_rcv(struct sk_buff *skb) + break; + case ICMPV6_EXT_ECHO_REQUEST: + if (!net->ipv6.sysctl.icmpv6_echo_ignore_all && +- net->ipv4.sysctl_icmp_echo_enable_probe) ++ READ_ONCE(net->ipv4.sysctl_icmp_echo_enable_probe)) + icmpv6_echo_reply(skb); + break; + +-- +2.35.1 + diff --git a/queue-5.15/ima-fix-a-potential-integer-overflow-in-ima_appraise.patch b/queue-5.15/ima-fix-a-potential-integer-overflow-in-ima_appraise.patch new file mode 100644 index 00000000000..d9dc1b4fd49 --- /dev/null +++ b/queue-5.15/ima-fix-a-potential-integer-overflow-in-ima_appraise.patch @@ -0,0 +1,37 @@ +From 7799e5311bc6a551e9cea6b58efd441e58841120 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jul 2022 13:14:17 +0800 +Subject: ima: Fix a potential integer overflow in ima_appraise_measurement + +From: Huaxin Lu + +[ Upstream commit d2ee2cfc4aa85ff6a2a3b198a3a524ec54e3d999 ] + +When the ima-modsig is enabled, the rc passed to evm_verifyxattr() may be +negative, which may cause the integer overflow problem. + +Fixes: 39b07096364a ("ima: Implement support for module-style appended signatures") +Signed-off-by: Huaxin Lu +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/ima/ima_appraise.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c +index dbba51583e7c..ed04bb7c7512 100644 +--- a/security/integrity/ima/ima_appraise.c ++++ b/security/integrity/ima/ima_appraise.c +@@ -408,7 +408,8 @@ int ima_appraise_measurement(enum ima_hooks func, + goto out; + } + +- status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value, rc, iint); ++ status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value, ++ rc < 0 ? 0 : rc, iint); + switch (status) { + case INTEGRITY_PASS: + case INTEGRITY_PASS_IMMUTABLE: +-- +2.35.1 + diff --git a/queue-5.15/ima-fix-potential-memory-leak-in-ima_init_crypto.patch b/queue-5.15/ima-fix-potential-memory-leak-in-ima_init_crypto.patch new file mode 100644 index 00000000000..4e654f23e93 --- /dev/null +++ b/queue-5.15/ima-fix-potential-memory-leak-in-ima_init_crypto.patch @@ -0,0 +1,36 @@ +From f3796ac080b797420a2c339c850edf83b78a4d74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 09:10:37 +0800 +Subject: ima: Fix potential memory leak in ima_init_crypto() + +From: Jianglei Nie + +[ Upstream commit 067d2521874135267e681c19d42761c601d503d6 ] + +On failure to allocate the SHA1 tfm, IMA fails to initialize and exits +without freeing the ima_algo_array. Add the missing kfree() for +ima_algo_array to avoid the potential memory leak. + +Signed-off-by: Jianglei Nie +Fixes: 6d94809af6b0 ("ima: Allocate and initialize tfm for each PCR bank") +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/ima/ima_crypto.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c +index a7206cc1d7d1..64499056648a 100644 +--- a/security/integrity/ima/ima_crypto.c ++++ b/security/integrity/ima/ima_crypto.c +@@ -205,6 +205,7 @@ int __init ima_init_crypto(void) + + crypto_free_shash(ima_algo_array[i].tfm); + } ++ kfree(ima_algo_array); + out: + crypto_free_shash(ima_shash_tfm); + return rc; +-- +2.35.1 + diff --git a/queue-5.15/ima-force-signature-verification-when-config_kexec_s.patch b/queue-5.15/ima-force-signature-verification-when-config_kexec_s.patch new file mode 100644 index 00000000000..a8fe4dadbce --- /dev/null +++ b/queue-5.15/ima-force-signature-verification-when-config_kexec_s.patch @@ -0,0 +1,87 @@ +From 988a494220428f457e7210b73d8a8b950e224cf9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 15:21:11 +0800 +Subject: ima: force signature verification when CONFIG_KEXEC_SIG is configured + +From: Coiby Xu + +[ Upstream commit af16df54b89dee72df253abc5e7b5e8a6d16c11c ] + +Currently, an unsigned kernel could be kexec'ed when IMA arch specific +policy is configured unless lockdown is enabled. Enforce kernel +signature verification check in the kexec_file_load syscall when IMA +arch specific policy is configured. + +Fixes: 99d5cadfde2b ("kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE") +Reported-and-suggested-by: Mimi Zohar +Signed-off-by: Coiby Xu +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + include/linux/kexec.h | 6 ++++++ + kernel/kexec_file.c | 11 ++++++++++- + security/integrity/ima/ima_efi.c | 2 ++ + 3 files changed, 18 insertions(+), 1 deletion(-) + +diff --git a/include/linux/kexec.h b/include/linux/kexec.h +index 33be67c2f7ff..cf042d41c87b 100644 +--- a/include/linux/kexec.h ++++ b/include/linux/kexec.h +@@ -452,6 +452,12 @@ static inline int kexec_crash_loaded(void) { return 0; } + #define kexec_in_progress false + #endif /* CONFIG_KEXEC_CORE */ + ++#ifdef CONFIG_KEXEC_SIG ++void set_kexec_sig_enforced(void); ++#else ++static inline void set_kexec_sig_enforced(void) {} ++#endif ++ + #endif /* !defined(__ASSEBMLY__) */ + + #endif /* LINUX_KEXEC_H */ +diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c +index e289e60ba3ad..f7a4fd4d243f 100644 +--- a/kernel/kexec_file.c ++++ b/kernel/kexec_file.c +@@ -29,6 +29,15 @@ + #include + #include "kexec_internal.h" + ++#ifdef CONFIG_KEXEC_SIG ++static bool sig_enforce = IS_ENABLED(CONFIG_KEXEC_SIG_FORCE); ++ ++void set_kexec_sig_enforced(void) ++{ ++ sig_enforce = true; ++} ++#endif ++ + static int kexec_calculate_store_digests(struct kimage *image); + + /* +@@ -159,7 +168,7 @@ kimage_validate_signature(struct kimage *image) + image->kernel_buf_len); + if (ret) { + +- if (IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) { ++ if (sig_enforce) { + pr_notice("Enforced kernel signature verification failed (%d).\n", ret); + return ret; + } +diff --git a/security/integrity/ima/ima_efi.c b/security/integrity/ima/ima_efi.c +index 71786d01946f..9db66fe310d4 100644 +--- a/security/integrity/ima/ima_efi.c ++++ b/security/integrity/ima/ima_efi.c +@@ -67,6 +67,8 @@ const char * const *arch_get_ima_policy(void) + if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) { + if (IS_ENABLED(CONFIG_MODULE_SIG)) + set_module_sig_enforced(); ++ if (IS_ENABLED(CONFIG_KEXEC_SIG)) ++ set_kexec_sig_enforced(); + return sb_arch_rules; + } + return NULL; +-- +2.35.1 + diff --git a/queue-5.15/inetpeer-fix-data-races-around-sysctl.patch b/queue-5.15/inetpeer-fix-data-races-around-sysctl.patch new file mode 100644 index 00000000000..b5874ef3f12 --- /dev/null +++ b/queue-5.15/inetpeer-fix-data-races-around-sysctl.patch @@ -0,0 +1,52 @@ +From c4e12952045b8b4fdeeea5d700258d618cb7e161 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:39:59 -0700 +Subject: inetpeer: Fix data-races around sysctl. + +From: Kuniyuki Iwashima + +[ Upstream commit 3d32edf1f3c38d3301f6434e56316f293466d7fb ] + +While reading inetpeer sysctl variables, they can be changed +concurrently. So, we need to add READ_ONCE() to avoid data-races. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/inetpeer.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c +index da21dfce24d7..e9fed83e9b3c 100644 +--- a/net/ipv4/inetpeer.c ++++ b/net/ipv4/inetpeer.c +@@ -141,16 +141,20 @@ static void inet_peer_gc(struct inet_peer_base *base, + struct inet_peer *gc_stack[], + unsigned int gc_cnt) + { ++ int peer_threshold, peer_maxttl, peer_minttl; + struct inet_peer *p; + __u32 delta, ttl; + int i; + +- if (base->total >= inet_peer_threshold) ++ peer_threshold = READ_ONCE(inet_peer_threshold); ++ peer_maxttl = READ_ONCE(inet_peer_maxttl); ++ peer_minttl = READ_ONCE(inet_peer_minttl); ++ ++ if (base->total >= peer_threshold) + ttl = 0; /* be aggressive */ + else +- ttl = inet_peer_maxttl +- - (inet_peer_maxttl - inet_peer_minttl) / HZ * +- base->total / inet_peer_threshold * HZ; ++ ttl = peer_maxttl - (peer_maxttl - peer_minttl) / HZ * ++ base->total / peer_threshold * HZ; + for (i = 0; i < gc_cnt; i++) { + p = gc_stack[i]; + +-- +2.35.1 + diff --git a/queue-5.15/ipv4-fix-a-data-race-around-sysctl_fib_sync_mem.patch b/queue-5.15/ipv4-fix-a-data-race-around-sysctl_fib_sync_mem.patch new file mode 100644 index 00000000000..1abb1cd431d --- /dev/null +++ b/queue-5.15/ipv4-fix-a-data-race-around-sysctl_fib_sync_mem.patch @@ -0,0 +1,36 @@ +From 1de6412cdf69e469304ef50c5db155ccb50bbdb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:40:03 -0700 +Subject: ipv4: Fix a data-race around sysctl_fib_sync_mem. + +From: Kuniyuki Iwashima + +[ Upstream commit 73318c4b7dbd0e781aaababff17376b2894745c0 ] + +While reading sysctl_fib_sync_mem, it can be changed concurrently. +So, we need to add READ_ONCE() to avoid a data-race. + +Fixes: 9ab948a91b2c ("ipv4: Allow amount of dirty memory from fib resizing to be controllable") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/fib_trie.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c +index f7f74d5c14da..a9cd9c2bd84e 100644 +--- a/net/ipv4/fib_trie.c ++++ b/net/ipv4/fib_trie.c +@@ -497,7 +497,7 @@ static void tnode_free(struct key_vector *tn) + tn = container_of(head, struct tnode, rcu)->kv; + } + +- if (tnode_free_size >= sysctl_fib_sync_mem) { ++ if (tnode_free_size >= READ_ONCE(sysctl_fib_sync_mem)) { + tnode_free_size = 0; + synchronize_rcu(); + } +-- +2.35.1 + diff --git a/queue-5.15/ipv4-fix-data-races-around-sysctl_ip_dynaddr.patch b/queue-5.15/ipv4-fix-data-races-around-sysctl_ip_dynaddr.patch new file mode 100644 index 00000000000..c4114a9f891 --- /dev/null +++ b/queue-5.15/ipv4-fix-data-races-around-sysctl_ip_dynaddr.patch @@ -0,0 +1,59 @@ +From b7e3fd73ac98a9d3edfc6355bba23f75b4029453 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:32 -0700 +Subject: ipv4: Fix data-races around sysctl_ip_dynaddr. + +From: Kuniyuki Iwashima + +[ Upstream commit e49e4aff7ec19b2d0d0957ee30e93dade57dab9e ] + +While reading sysctl_ip_dynaddr, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + Documentation/networking/ip-sysctl.rst | 2 +- + net/ipv4/af_inet.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst +index 8d772484755a..b8b67041f955 100644 +--- a/Documentation/networking/ip-sysctl.rst ++++ b/Documentation/networking/ip-sysctl.rst +@@ -1157,7 +1157,7 @@ ip_autobind_reuse - BOOLEAN + option should only be set by experts. + Default: 0 + +-ip_dynaddr - BOOLEAN ++ip_dynaddr - INTEGER + If set non-zero, enables support for dynamic addresses. + If set to a non-zero value larger than 1, a kernel log + message will be printed when dynamic address rewriting +diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c +index 77534b44b8c7..44f21278003d 100644 +--- a/net/ipv4/af_inet.c ++++ b/net/ipv4/af_inet.c +@@ -1251,7 +1251,7 @@ static int inet_sk_reselect_saddr(struct sock *sk) + if (new_saddr == old_saddr) + return 0; + +- if (sock_net(sk)->ipv4.sysctl_ip_dynaddr > 1) { ++ if (READ_ONCE(sock_net(sk)->ipv4.sysctl_ip_dynaddr) > 1) { + pr_info("%s(): shifting inet->saddr from %pI4 to %pI4\n", + __func__, &old_saddr, &new_saddr); + } +@@ -1306,7 +1306,7 @@ int inet_sk_rebuild_header(struct sock *sk) + * Other protocols have to map its equivalent state to TCP_SYN_SENT. + * DCCP maps its DCCP_REQUESTING state to TCP_SYN_SENT. -acme + */ +- if (!sock_net(sk)->ipv4.sysctl_ip_dynaddr || ++ if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_ip_dynaddr) || + sk->sk_state != TCP_SYN_SENT || + (sk->sk_userlocks & SOCK_BINDADDR_LOCK) || + (err = inet_sk_reselect_saddr(sk)) != 0) +-- +2.35.1 + diff --git a/queue-5.15/kvm-x86-fully-initialize-struct-kvm_lapic_irq-in-kvm.patch b/queue-5.15/kvm-x86-fully-initialize-struct-kvm_lapic_irq-in-kvm.patch new file mode 100644 index 00000000000..7c2ef08a352 --- /dev/null +++ b/queue-5.15/kvm-x86-fully-initialize-struct-kvm_lapic_irq-in-kvm.patch @@ -0,0 +1,60 @@ +From 3e765128c1cfd0d4656611c405eab67c16d742b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 14:51:47 +0200 +Subject: KVM: x86: Fully initialize 'struct kvm_lapic_irq' in + kvm_pv_kick_cpu_op() + +From: Vitaly Kuznetsov + +[ Upstream commit 8a414f943f8b5f94bbaafdec863d6f3dbef33f8a ] + +'vector' and 'trig_mode' fields of 'struct kvm_lapic_irq' are left +uninitialized in kvm_pv_kick_cpu_op(). While these fields are normally +not needed for APIC_DM_REMRD, they're still referenced by +__apic_accept_irq() for trace_kvm_apic_accept_irq(). Fully initialize +the structure to avoid consuming random stack memory. + +Fixes: a183b638b61c ("KVM: x86: make apic_accept_irq tracepoint more generic") +Reported-by: syzbot+d6caa905917d353f0d07@syzkaller.appspotmail.com +Signed-off-by: Vitaly Kuznetsov +Reviewed-by: Sean Christopherson +Message-Id: <20220708125147.593975-1-vkuznets@redhat.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/x86.c | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 8974884ef2ad..732c3f2f8ded 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -8713,15 +8713,17 @@ static int kvm_pv_clock_pairing(struct kvm_vcpu *vcpu, gpa_t paddr, + */ + static void kvm_pv_kick_cpu_op(struct kvm *kvm, unsigned long flags, int apicid) + { +- struct kvm_lapic_irq lapic_irq; +- +- lapic_irq.shorthand = APIC_DEST_NOSHORT; +- lapic_irq.dest_mode = APIC_DEST_PHYSICAL; +- lapic_irq.level = 0; +- lapic_irq.dest_id = apicid; +- lapic_irq.msi_redir_hint = false; ++ /* ++ * All other fields are unused for APIC_DM_REMRD, but may be consumed by ++ * common code, e.g. for tracing. Defer initialization to the compiler. ++ */ ++ struct kvm_lapic_irq lapic_irq = { ++ .delivery_mode = APIC_DM_REMRD, ++ .dest_mode = APIC_DEST_PHYSICAL, ++ .shorthand = APIC_DEST_NOSHORT, ++ .dest_id = apicid, ++ }; + +- lapic_irq.delivery_mode = APIC_DM_REMRD; + kvm_irq_delivery_to_apic(kvm, NULL, &lapic_irq, NULL); + } + +-- +2.35.1 + diff --git a/queue-5.15/lockd-fix-nlm_close_files.patch b/queue-5.15/lockd-fix-nlm_close_files.patch new file mode 100644 index 00000000000..2005ae9e948 --- /dev/null +++ b/queue-5.15/lockd-fix-nlm_close_files.patch @@ -0,0 +1,44 @@ +From ca9de3bb5b4d60f91e145be5b480edc08cf41bdf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 14:30:14 -0400 +Subject: lockd: fix nlm_close_files + +From: Jeff Layton + +[ Upstream commit 1197eb5906a5464dbaea24cac296dfc38499cc00 ] + +This loop condition tries a bit too hard to be clever. Just test for +the two indices we care about explicitly. + +Cc: J. Bruce Fields +Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file") +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/lockd/svcsubs.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/fs/lockd/svcsubs.c b/fs/lockd/svcsubs.c +index b2f277727469..e1c4617de771 100644 +--- a/fs/lockd/svcsubs.c ++++ b/fs/lockd/svcsubs.c +@@ -283,11 +283,10 @@ nlm_file_inuse(struct nlm_file *file) + + static void nlm_close_files(struct nlm_file *file) + { +- struct file *f; +- +- for (f = file->f_file[0]; f <= file->f_file[1]; f++) +- if (f) +- nlmsvc_ops->fclose(f); ++ if (file->f_file[O_RDONLY]) ++ nlmsvc_ops->fclose(file->f_file[O_RDONLY]); ++ if (file->f_file[O_WRONLY]) ++ nlmsvc_ops->fclose(file->f_file[O_WRONLY]); + } + + /* +-- +2.35.1 + diff --git a/queue-5.15/lockd-set-fl_owner-when-unlocking-files.patch b/queue-5.15/lockd-set-fl_owner-when-unlocking-files.patch new file mode 100644 index 00000000000..13f7c11180b --- /dev/null +++ b/queue-5.15/lockd-set-fl_owner-when-unlocking-files.patch @@ -0,0 +1,54 @@ +From f218766c3a6d06cd672e4e2940ba7ee410a9e1db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 14:30:13 -0400 +Subject: lockd: set fl_owner when unlocking files + +From: Jeff Layton + +[ Upstream commit aec158242b87a43d83322e99bc71ab4428e5ab79 ] + +Unlocking a POSIX lock on an inode with vfs_lock_file only works if +the owner matches. Ensure we set it in the request. + +Cc: J. Bruce Fields +Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file") +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/lockd/svcsubs.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/lockd/svcsubs.c b/fs/lockd/svcsubs.c +index 0a22a2faf552..b2f277727469 100644 +--- a/fs/lockd/svcsubs.c ++++ b/fs/lockd/svcsubs.c +@@ -176,7 +176,7 @@ nlm_delete_file(struct nlm_file *file) + } + } + +-static int nlm_unlock_files(struct nlm_file *file) ++static int nlm_unlock_files(struct nlm_file *file, fl_owner_t owner) + { + struct file_lock lock; + +@@ -184,6 +184,7 @@ static int nlm_unlock_files(struct nlm_file *file) + lock.fl_type = F_UNLCK; + lock.fl_start = 0; + lock.fl_end = OFFSET_MAX; ++ lock.fl_owner = owner; + if (file->f_file[O_RDONLY] && + vfs_lock_file(file->f_file[O_RDONLY], F_SETLK, &lock, NULL)) + goto out_err; +@@ -225,7 +226,7 @@ nlm_traverse_locks(struct nlm_host *host, struct nlm_file *file, + if (match(lockhost, host)) { + + spin_unlock(&flctx->flc_lock); +- if (nlm_unlock_files(file)) ++ if (nlm_unlock_files(file, fl->fl_owner)) + return 1; + goto again; + } +-- +2.35.1 + diff --git a/queue-5.15/mm-sysctl-fix-missing-numa_stat-when-config_hugetlb_.patch b/queue-5.15/mm-sysctl-fix-missing-numa_stat-when-config_hugetlb_.patch new file mode 100644 index 00000000000..a1c7a95df9d --- /dev/null +++ b/queue-5.15/mm-sysctl-fix-missing-numa_stat-when-config_hugetlb_.patch @@ -0,0 +1,66 @@ +From d157bad63aaa8e9237741f290fcb353c86c86d4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 18:40:32 +0800 +Subject: mm: sysctl: fix missing numa_stat when !CONFIG_HUGETLB_PAGE + +From: Muchun Song + +[ Upstream commit 43b5240ca6b33108998810593248186b1e3ae34a ] + +"numa_stat" should not be included in the scope of CONFIG_HUGETLB_PAGE, if +CONFIG_HUGETLB_PAGE is not configured even if CONFIG_NUMA is configured, +"numa_stat" is missed form /proc. Move it out of CONFIG_HUGETLB_PAGE to +fix it. + +Fixes: 4518085e127d ("mm, sysctl: make NUMA stats configurable") +Signed-off-by: Muchun Song +Cc: +Acked-by: Michal Hocko +Acked-by: Mel Gorman +Signed-off-by: Luis Chamberlain +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 79cbfd0fa3be..25c18b2df684 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -2852,6 +2852,17 @@ static struct ctl_table vm_table[] = { + .extra1 = SYSCTL_ZERO, + .extra2 = &two_hundred, + }, ++#ifdef CONFIG_NUMA ++ { ++ .procname = "numa_stat", ++ .data = &sysctl_vm_numa_stat, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = sysctl_vm_numa_stat_handler, ++ .extra1 = SYSCTL_ZERO, ++ .extra2 = SYSCTL_ONE, ++ }, ++#endif + #ifdef CONFIG_HUGETLB_PAGE + { + .procname = "nr_hugepages", +@@ -2868,15 +2879,6 @@ static struct ctl_table vm_table[] = { + .mode = 0644, + .proc_handler = &hugetlb_mempolicy_sysctl_handler, + }, +- { +- .procname = "numa_stat", +- .data = &sysctl_vm_numa_stat, +- .maxlen = sizeof(int), +- .mode = 0644, +- .proc_handler = sysctl_vm_numa_stat_handler, +- .extra1 = SYSCTL_ZERO, +- .extra2 = SYSCTL_ONE, +- }, + #endif + { + .procname = "hugetlb_shm_group", +-- +2.35.1 + diff --git a/queue-5.15/net-atlantic-remove-aq_nic_deinit-when-resume.patch b/queue-5.15/net-atlantic-remove-aq_nic_deinit-when-resume.patch new file mode 100644 index 00000000000..76f8c16743a --- /dev/null +++ b/queue-5.15/net-atlantic-remove-aq_nic_deinit-when-resume.patch @@ -0,0 +1,61 @@ +From c2e722b47b7c8f31bb74823c6130c59b6f0a5ce3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 19:12:24 +0800 +Subject: net: atlantic: remove aq_nic_deinit() when resume + +From: Chia-Lin Kao (AceLan) + +[ Upstream commit 2e15c51fefaffaf9f72255eaef4fada05055e4c5 ] + +aq_nic_deinit() has been called while suspending, so we don't have to call +it again on resume. +Actually, call it again leads to another hang issue when resuming from +S3. + +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992345] Call Trace: +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992346] +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992348] aq_nic_deinit+0xb4/0xd0 [atlantic] +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992356] aq_pm_thaw+0x7f/0x100 [atlantic] +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992362] pci_pm_resume+0x5c/0x90 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992366] ? pci_pm_thaw+0x80/0x80 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992368] dpm_run_callback+0x4e/0x120 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992371] device_resume+0xad/0x200 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992373] async_resume+0x1e/0x40 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992374] async_run_entry_fn+0x33/0x120 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992377] process_one_work+0x220/0x3c0 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992380] worker_thread+0x4d/0x3f0 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992382] ? process_one_work+0x3c0/0x3c0 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992384] kthread+0x12a/0x150 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992386] ? set_kthread_struct+0x40/0x40 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992387] ret_from_fork+0x22/0x30 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992391] +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992392] ---[ end trace 1ec8c79604ed5e0d ]--- +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992394] PM: dpm_run_callback(): pci_pm_resume+0x0/0x90 returns -110 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992397] atlantic 0000:02:00.0: PM: failed to resume async: error -110 + +Fixes: 1809c30b6e5a ("net: atlantic: always deep reset on pm op, fixing up my null deref regression") +Signed-off-by: Chia-Lin Kao (AceLan) +Link: https://lore.kernel.org/r/20220713111224.1535938-2-acelan.kao@canonical.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +index dbd5263130f9..8647125d60ae 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +@@ -413,9 +413,6 @@ static int atl_resume_common(struct device *dev) + pci_set_power_state(pdev, PCI_D0); + pci_restore_state(pdev); + +- /* Reinitialize Nic/Vecs objects */ +- aq_nic_deinit(nic, !nic->aq_hw->aq_nic_cfg->wol); +- + if (netif_running(nic->ndev)) { + ret = aq_nic_init(nic); + if (ret) +-- +2.35.1 + diff --git a/queue-5.15/net-atlantic-remove-deep-parameter-on-suspend-resume.patch b/queue-5.15/net-atlantic-remove-deep-parameter-on-suspend-resume.patch new file mode 100644 index 00000000000..a43b56a34a1 --- /dev/null +++ b/queue-5.15/net-atlantic-remove-deep-parameter-on-suspend-resume.patch @@ -0,0 +1,101 @@ +From 6ad401e6c1f105ae1bb4ff05728e3c3d627dd308 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 19:12:23 +0800 +Subject: net: atlantic: remove deep parameter on suspend/resume functions + +From: Chia-Lin Kao (AceLan) + +[ Upstream commit 0f33250760384e05c36466b0a2f92f3c6007ba92 ] + +Below commit claims that atlantic NIC requires to reset the device on pm +op, and had set the deep to true for all suspend/resume functions. +commit 1809c30b6e5a ("net: atlantic: always deep reset on pm op, fixing up my null deref regression") +So, we could remove deep parameter on suspend/resume functions without +any functional change. + +Fixes: 1809c30b6e5a ("net: atlantic: always deep reset on pm op, fixing up my null deref regression") +Signed-off-by: Chia-Lin Kao (AceLan) +Link: https://lore.kernel.org/r/20220713111224.1535938-1-acelan.kao@canonical.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../ethernet/aquantia/atlantic/aq_pci_func.c | 24 ++++++++----------- + 1 file changed, 10 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +index 831833911a52..dbd5263130f9 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +@@ -379,7 +379,7 @@ static void aq_pci_shutdown(struct pci_dev *pdev) + } + } + +-static int aq_suspend_common(struct device *dev, bool deep) ++static int aq_suspend_common(struct device *dev) + { + struct aq_nic_s *nic = pci_get_drvdata(to_pci_dev(dev)); + +@@ -392,17 +392,15 @@ static int aq_suspend_common(struct device *dev, bool deep) + if (netif_running(nic->ndev)) + aq_nic_stop(nic); + +- if (deep) { +- aq_nic_deinit(nic, !nic->aq_hw->aq_nic_cfg->wol); +- aq_nic_set_power(nic); +- } ++ aq_nic_deinit(nic, !nic->aq_hw->aq_nic_cfg->wol); ++ aq_nic_set_power(nic); + + rtnl_unlock(); + + return 0; + } + +-static int atl_resume_common(struct device *dev, bool deep) ++static int atl_resume_common(struct device *dev) + { + struct pci_dev *pdev = to_pci_dev(dev); + struct aq_nic_s *nic; +@@ -415,10 +413,8 @@ static int atl_resume_common(struct device *dev, bool deep) + pci_set_power_state(pdev, PCI_D0); + pci_restore_state(pdev); + +- if (deep) { +- /* Reinitialize Nic/Vecs objects */ +- aq_nic_deinit(nic, !nic->aq_hw->aq_nic_cfg->wol); +- } ++ /* Reinitialize Nic/Vecs objects */ ++ aq_nic_deinit(nic, !nic->aq_hw->aq_nic_cfg->wol); + + if (netif_running(nic->ndev)) { + ret = aq_nic_init(nic); +@@ -444,22 +440,22 @@ static int atl_resume_common(struct device *dev, bool deep) + + static int aq_pm_freeze(struct device *dev) + { +- return aq_suspend_common(dev, true); ++ return aq_suspend_common(dev); + } + + static int aq_pm_suspend_poweroff(struct device *dev) + { +- return aq_suspend_common(dev, true); ++ return aq_suspend_common(dev); + } + + static int aq_pm_thaw(struct device *dev) + { +- return atl_resume_common(dev, true); ++ return atl_resume_common(dev); + } + + static int aq_pm_resume_restore(struct device *dev) + { +- return atl_resume_common(dev, true); ++ return atl_resume_common(dev); + } + + static const struct dev_pm_ops aq_pm_ops = { +-- +2.35.1 + diff --git a/queue-5.15/net-ethernet-ti-am65-cpsw-fix-devlink-port-register-.patch b/queue-5.15/net-ethernet-ti-am65-cpsw-fix-devlink-port-register-.patch new file mode 100644 index 00000000000..c8ab31719b8 --- /dev/null +++ b/queue-5.15/net-ethernet-ti-am65-cpsw-fix-devlink-port-register-.patch @@ -0,0 +1,95 @@ +From 8d5e65255a259abfd1d60c49ea67b3d06dcc69a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 12:32:08 +0530 +Subject: net: ethernet: ti: am65-cpsw: Fix devlink port register sequence + +From: Siddharth Vadapalli + +[ Upstream commit 0680e20af5fbf41df8a11b11bd9a7c25b2ca0746 ] + +Renaming interfaces using udevd depends on the interface being registered +before its netdev is registered. Otherwise, udevd reads an empty +phys_port_name value, resulting in the interface not being renamed. + +Fix this by registering the interface before registering its netdev +by invoking am65_cpsw_nuss_register_devlink() before invoking +register_netdev() for the interface. + +Move the function call to devlink_port_type_eth_set(), invoking it after +register_netdev() is invoked, to ensure that netlink notification for the +port state change is generated after the netdev is completely initialized. + +Fixes: 58356eb31d60 ("net: ti: am65-cpsw-nuss: Add devlink support") +Signed-off-by: Siddharth Vadapalli +Link: https://lore.kernel.org/r/20220706070208.12207-1-s-vadapalli@ti.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +index ea9d073e87fa..901571c2626a 100644 +--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c ++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +@@ -2467,7 +2467,6 @@ static int am65_cpsw_nuss_register_devlink(struct am65_cpsw_common *common) + port->port_id, ret); + goto dl_port_unreg; + } +- devlink_port_type_eth_set(dl_port, port->ndev); + } + + return ret; +@@ -2514,6 +2513,7 @@ static void am65_cpsw_unregister_devlink(struct am65_cpsw_common *common) + static int am65_cpsw_nuss_register_ndevs(struct am65_cpsw_common *common) + { + struct device *dev = common->dev; ++ struct devlink_port *dl_port; + struct am65_cpsw_port *port; + int ret = 0, i; + +@@ -2530,6 +2530,10 @@ static int am65_cpsw_nuss_register_ndevs(struct am65_cpsw_common *common) + return ret; + } + ++ ret = am65_cpsw_nuss_register_devlink(common); ++ if (ret) ++ return ret; ++ + for (i = 0; i < common->port_num; i++) { + port = &common->ports[i]; + +@@ -2542,25 +2546,24 @@ static int am65_cpsw_nuss_register_ndevs(struct am65_cpsw_common *common) + i, ret); + goto err_cleanup_ndev; + } ++ ++ dl_port = &port->devlink_port; ++ devlink_port_type_eth_set(dl_port, port->ndev); + } + + ret = am65_cpsw_register_notifiers(common); + if (ret) + goto err_cleanup_ndev; + +- ret = am65_cpsw_nuss_register_devlink(common); +- if (ret) +- goto clean_unregister_notifiers; +- + /* can't auto unregister ndev using devm_add_action() due to + * devres release sequence in DD core for DMA + */ + + return 0; +-clean_unregister_notifiers: +- am65_cpsw_unregister_notifiers(common); ++ + err_cleanup_ndev: + am65_cpsw_nuss_cleanup_ndev(common); ++ am65_cpsw_unregister_devlink(common); + + return ret; + } +-- +2.35.1 + diff --git a/queue-5.15/net-fix-data-races-around-sysctl_mem.patch b/queue-5.15/net-fix-data-races-around-sysctl_mem.patch new file mode 100644 index 00000000000..dea6a1b73ff --- /dev/null +++ b/queue-5.15/net-fix-data-races-around-sysctl_mem.patch @@ -0,0 +1,36 @@ +From a0f9ece12b1ed7b9dee8b5860aeaf0add3a1a023 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:40:00 -0700 +Subject: net: Fix data-races around sysctl_mem. + +From: Kuniyuki Iwashima + +[ Upstream commit 310731e2f1611d1d13aae237abcf8e66d33345d5 ] + +While reading .sysctl_mem, it can be changed concurrently. +So, we need to add READ_ONCE() to avoid data-races. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/sock.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/net/sock.h b/include/net/sock.h +index 7d49196a3880..96f51d4b1649 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1484,7 +1484,7 @@ void __sk_mem_reclaim(struct sock *sk, int amount); + /* sysctl_mem values are in pages, we convert them in SK_MEM_QUANTUM units */ + static inline long sk_prot_mem_limits(const struct sock *sk, int index) + { +- long val = sk->sk_prot->sysctl_mem[index]; ++ long val = READ_ONCE(sk->sk_prot->sysctl_mem[index]); + + #if PAGE_SIZE > SK_MEM_QUANTUM + val <<= PAGE_SHIFT - SK_MEM_QUANTUM_SHIFT; +-- +2.35.1 + diff --git a/queue-5.15/net-ftgmac100-hold-reference-returned-by-of_get_chil.patch b/queue-5.15/net-ftgmac100-hold-reference-returned-by-of_get_chil.patch new file mode 100644 index 00000000000..386fd1b72ca --- /dev/null +++ b/queue-5.15/net-ftgmac100-hold-reference-returned-by-of_get_chil.patch @@ -0,0 +1,57 @@ +From 9351e26940728815972b6dd4953f1684133f9377 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 14:14:17 +0800 +Subject: net: ftgmac100: Hold reference returned by of_get_child_by_name() + +From: Liang He + +[ Upstream commit 49b9f431ff0d845a36be0b3ede35ec324f2e5fee ] + +In ftgmac100_probe(), we should hold the refernece returned by +of_get_child_by_name() and use it to call of_node_put() for +reference balance. + +Fixes: 39bfab8844a0 ("net: ftgmac100: Add support for DT phy-handle property") +Signed-off-by: Liang He +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/faraday/ftgmac100.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c +index 0b833572205f..4a2dadb91f02 100644 +--- a/drivers/net/ethernet/faraday/ftgmac100.c ++++ b/drivers/net/ethernet/faraday/ftgmac100.c +@@ -1746,6 +1746,19 @@ static int ftgmac100_setup_clk(struct ftgmac100 *priv) + return rc; + } + ++static bool ftgmac100_has_child_node(struct device_node *np, const char *name) ++{ ++ struct device_node *child_np = of_get_child_by_name(np, name); ++ bool ret = false; ++ ++ if (child_np) { ++ ret = true; ++ of_node_put(child_np); ++ } ++ ++ return ret; ++} ++ + static int ftgmac100_probe(struct platform_device *pdev) + { + struct resource *res; +@@ -1865,7 +1878,7 @@ static int ftgmac100_probe(struct platform_device *pdev) + + /* Display what we found */ + phy_attached_info(phy); +- } else if (np && !of_get_child_by_name(np, "mdio")) { ++ } else if (np && !ftgmac100_has_child_node(np, "mdio")) { + /* Support legacy ASPEED devicetree descriptions that decribe a + * MAC with an embedded MDIO controller but have no "mdio" + * child node. Automatically scan the MDIO bus for available +-- +2.35.1 + diff --git a/queue-5.15/net-mlx5e-fix-capability-check-for-updating-vnic-env.patch b/queue-5.15/net-mlx5e-fix-capability-check-for-updating-vnic-env.patch new file mode 100644 index 00000000000..3a3f4473c24 --- /dev/null +++ b/queue-5.15/net-mlx5e-fix-capability-check-for-updating-vnic-env.patch @@ -0,0 +1,42 @@ +From e046fe8ed5aff3e06d2fe0ba3e77eb6a8cd8eab4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Jun 2022 15:05:53 +0300 +Subject: net/mlx5e: Fix capability check for updating vnic env counters + +From: Gal Pressman + +[ Upstream commit 452133dd580811f184e76b1402983182ee425298 ] + +The existing capability check for vnic env counters only checks for +receive steering discards, although we need the counters update for the +exposed internal queue oob counter as well. This could result in the +latter counter not being updated correctly when the receive steering +discards counter is not supported. +Fix that by checking whether any counter is supported instead of only +the steering counter capability. + +Fixes: 0cfafd4b4ddf ("net/mlx5e: Add device out of buffer counter") +Signed-off-by: Gal Pressman +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c +index e1dd17019030..5a5c6eda29d2 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c +@@ -614,7 +614,7 @@ static MLX5E_DECLARE_STATS_GRP_OP_UPDATE_STATS(vnic_env) + u32 in[MLX5_ST_SZ_DW(query_vnic_env_in)] = {}; + struct mlx5_core_dev *mdev = priv->mdev; + +- if (!MLX5_CAP_GEN(priv->mdev, nic_receive_steering_discard)) ++ if (!mlx5e_stats_grp_vnic_env_num_stats(priv)) + return; + + MLX5_SET(query_vnic_env_in, in, opcode, MLX5_CMD_OP_QUERY_VNIC_ENV); +-- +2.35.1 + diff --git a/queue-5.15/net-mlx5e-fix-enabling-sriov-while-tc-nic-rules-are-.patch b/queue-5.15/net-mlx5e-fix-enabling-sriov-while-tc-nic-rules-are-.patch new file mode 100644 index 00000000000..3b833dbad94 --- /dev/null +++ b/queue-5.15/net-mlx5e-fix-enabling-sriov-while-tc-nic-rules-are-.patch @@ -0,0 +1,60 @@ +From 0b2164c281cfdc32ea6ff6305a2b42ec8a39c3bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jun 2022 13:11:18 +0300 +Subject: net/mlx5e: Fix enabling sriov while tc nic rules are offloaded + +From: Paul Blakey + +[ Upstream commit 0c9d876545a56aebed30fa306d0460a4d28d271a ] + +There is a total of four 4M entries flow tables. In sriov disabled +mode, ct, ct_nat and post_act take three of them. When adding the +first tc nic rule in this mode, it will take another 4M table +for the tc table. If user then enables sriov, the legacy +flow table tries to take another 4M and fails, and so enablement fails. + +To fix that, have legacy fdb take the next available maximum +size from the fs ft pool. + +Fixes: 4a98544d1827 ("net/mlx5: Move chains ft pool to be used by all firmware steering") +Signed-off-by: Paul Blakey +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c +index 0c4c743ca31e..3a2575dc5355 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c +@@ -11,6 +11,7 @@ + #include "mlx5_core.h" + #include "eswitch.h" + #include "fs_core.h" ++#include "fs_ft_pool.h" + #include "esw/qos.h" + + enum { +@@ -95,8 +96,7 @@ static int esw_create_legacy_fdb_table(struct mlx5_eswitch *esw) + if (!flow_group_in) + return -ENOMEM; + +- table_size = BIT(MLX5_CAP_ESW_FLOWTABLE_FDB(dev, log_max_ft_size)); +- ft_attr.max_fte = table_size; ++ ft_attr.max_fte = POOL_NEXT_SIZE; + ft_attr.prio = LEGACY_FDB_PRIO; + fdb = mlx5_create_flow_table(root_ns, &ft_attr); + if (IS_ERR(fdb)) { +@@ -105,6 +105,7 @@ static int esw_create_legacy_fdb_table(struct mlx5_eswitch *esw) + goto out; + } + esw->fdb_table.legacy.fdb = fdb; ++ table_size = fdb->max_fte; + + /* Addresses group : Full match unicast/multicast addresses */ + MLX5_SET(create_flow_group_in, flow_group_in, match_criteria_enable, +-- +2.35.1 + diff --git a/queue-5.15/net-mlx5e-ktls-fix-build-time-constant-test-in-rx.patch b/queue-5.15/net-mlx5e-ktls-fix-build-time-constant-test-in-rx.patch new file mode 100644 index 00000000000..35cad94e8bc --- /dev/null +++ b/queue-5.15/net-mlx5e-ktls-fix-build-time-constant-test-in-rx.patch @@ -0,0 +1,38 @@ +From 922e0db2b9a78d955230b57376c9589b3b167ea3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jun 2022 21:21:10 +0300 +Subject: net/mlx5e: kTLS, Fix build time constant test in RX + +From: Tariq Toukan + +[ Upstream commit 2ec6cf9b742a5c18982861322fa5de6510f8f57e ] + +Use the correct constant (TLS_DRIVER_STATE_SIZE_RX) in the comparison +against the size of the private RX TLS driver context. + +Fixes: 1182f3659357 ("net/mlx5e: kTLS, Add kTLS RX HW offload support") +Signed-off-by: Tariq Toukan +Reviewed-by: Maxim Mikityanskiy +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c +index 15711814d2d2..d92b97c56f4c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c +@@ -231,8 +231,7 @@ mlx5e_set_ktls_rx_priv_ctx(struct tls_context *tls_ctx, + struct mlx5e_ktls_offload_context_rx **ctx = + __tls_driver_ctx(tls_ctx, TLS_OFFLOAD_CTX_DIR_RX); + +- BUILD_BUG_ON(sizeof(struct mlx5e_ktls_offload_context_rx *) > +- TLS_OFFLOAD_CONTEXT_SIZE_RX); ++ BUILD_BUG_ON(sizeof(priv_rx) > TLS_DRIVER_STATE_SIZE_RX); + + *ctx = priv_rx; + } +-- +2.35.1 + diff --git a/queue-5.15/net-mlx5e-ktls-fix-build-time-constant-test-in-tx.patch b/queue-5.15/net-mlx5e-ktls-fix-build-time-constant-test-in-tx.patch new file mode 100644 index 00000000000..024c46185b4 --- /dev/null +++ b/queue-5.15/net-mlx5e-ktls-fix-build-time-constant-test-in-tx.patch @@ -0,0 +1,38 @@ +From 8b04d72a37cddfe3356905e923552a284aa2f59b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jun 2022 21:20:29 +0300 +Subject: net/mlx5e: kTLS, Fix build time constant test in TX + +From: Tariq Toukan + +[ Upstream commit 6cc2714e85754a621219693ea8aa3077d6fca0cb ] + +Use the correct constant (TLS_DRIVER_STATE_SIZE_TX) in the comparison +against the size of the private TX TLS driver context. + +Fixes: df8d866770f9 ("net/mlx5e: kTLS, Use kernel API to extract private offload context") +Signed-off-by: Tariq Toukan +Reviewed-by: Maxim Mikityanskiy +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c +index 9ad3459fb63a..dadb71081ed0 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c +@@ -68,8 +68,7 @@ mlx5e_set_ktls_tx_priv_ctx(struct tls_context *tls_ctx, + struct mlx5e_ktls_offload_context_tx **ctx = + __tls_driver_ctx(tls_ctx, TLS_OFFLOAD_CTX_DIR_TX); + +- BUILD_BUG_ON(sizeof(struct mlx5e_ktls_offload_context_tx *) > +- TLS_OFFLOAD_CONTEXT_SIZE_TX); ++ BUILD_BUG_ON(sizeof(priv_tx) > TLS_DRIVER_STATE_SIZE_TX); + + *ctx = priv_tx; + } +-- +2.35.1 + diff --git a/queue-5.15/net-mlx5e-ring-the-tx-doorbell-on-dma-errors.patch b/queue-5.15/net-mlx5e-ring-the-tx-doorbell-on-dma-errors.patch new file mode 100644 index 00000000000..864f3197d5d --- /dev/null +++ b/queue-5.15/net-mlx5e-ring-the-tx-doorbell-on-dma-errors.patch @@ -0,0 +1,123 @@ +From 21ae9927bd3863e7e4d68841020c5e29888b35be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 May 2022 14:01:37 +0300 +Subject: net/mlx5e: Ring the TX doorbell on DMA errors + +From: Maxim Mikityanskiy + +[ Upstream commit 5b759bf2f9d73db05369aef2344502095c4e5e73 ] + +TX doorbells may be postponed, because sometimes the driver knows that +another packet follows (for example, when xmit_more is true, or when a +MPWQE session is closed before transmitting a packet). + +However, the DMA mapping may fail for the next packet, in which case a +new WQE is not posted, the doorbell isn't updated either, and the +transmission of the previous packet will be delayed indefinitely. + +This commit fixes the described rare error flow by posting a NOP and +ringing the doorbell on errors to flush all the previous packets. The +MPWQE session is closed before that. DMA mapping in the MPWQE flow is +moved to the beginning of mlx5e_sq_xmit_mpwqe, because empty sessions +are not allowed. Stop room always has enough space for a NOP, because +the actual TX WQE is not posted. + +Fixes: e586b3b0baee ("net/mlx5: Ethernet Datapath files") +Signed-off-by: Maxim Mikityanskiy +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/en_tx.c | 39 ++++++++++++++----- + 1 file changed, 30 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +index 7fd33b356cc8..1544d4c2c636 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +@@ -429,6 +429,26 @@ static void mlx5e_tx_check_stop(struct mlx5e_txqsq *sq) + } + } + ++static void mlx5e_tx_flush(struct mlx5e_txqsq *sq) ++{ ++ struct mlx5e_tx_wqe_info *wi; ++ struct mlx5e_tx_wqe *wqe; ++ u16 pi; ++ ++ /* Must not be called when a MPWQE session is active but empty. */ ++ mlx5e_tx_mpwqe_ensure_complete(sq); ++ ++ pi = mlx5_wq_cyc_ctr2ix(&sq->wq, sq->pc); ++ wi = &sq->db.wqe_info[pi]; ++ ++ *wi = (struct mlx5e_tx_wqe_info) { ++ .num_wqebbs = 1, ++ }; ++ ++ wqe = mlx5e_post_nop(&sq->wq, sq->sqn, &sq->pc); ++ mlx5e_notify_hw(&sq->wq, sq->pc, sq->uar_map, &wqe->ctrl); ++} ++ + static inline void + mlx5e_txwqe_complete(struct mlx5e_txqsq *sq, struct sk_buff *skb, + const struct mlx5e_tx_attr *attr, +@@ -521,6 +541,7 @@ mlx5e_sq_xmit_wqe(struct mlx5e_txqsq *sq, struct sk_buff *skb, + err_drop: + stats->dropped++; + dev_kfree_skb_any(skb); ++ mlx5e_tx_flush(sq); + } + + static bool mlx5e_tx_skb_supports_mpwqe(struct sk_buff *skb, struct mlx5e_tx_attr *attr) +@@ -622,6 +643,13 @@ mlx5e_sq_xmit_mpwqe(struct mlx5e_txqsq *sq, struct sk_buff *skb, + struct mlx5_wqe_ctrl_seg *cseg; + struct mlx5e_xmit_data txd; + ++ txd.data = skb->data; ++ txd.len = skb->len; ++ ++ txd.dma_addr = dma_map_single(sq->pdev, txd.data, txd.len, DMA_TO_DEVICE); ++ if (unlikely(dma_mapping_error(sq->pdev, txd.dma_addr))) ++ goto err_unmap; ++ + if (!mlx5e_tx_mpwqe_session_is_active(sq)) { + mlx5e_tx_mpwqe_session_start(sq, eseg); + } else if (!mlx5e_tx_mpwqe_same_eseg(sq, eseg)) { +@@ -631,18 +659,9 @@ mlx5e_sq_xmit_mpwqe(struct mlx5e_txqsq *sq, struct sk_buff *skb, + + sq->stats->xmit_more += xmit_more; + +- txd.data = skb->data; +- txd.len = skb->len; +- +- txd.dma_addr = dma_map_single(sq->pdev, txd.data, txd.len, DMA_TO_DEVICE); +- if (unlikely(dma_mapping_error(sq->pdev, txd.dma_addr))) +- goto err_unmap; + mlx5e_dma_push(sq, txd.dma_addr, txd.len, MLX5E_DMA_MAP_SINGLE); +- + mlx5e_skb_fifo_push(&sq->db.skb_fifo, skb); +- + mlx5e_tx_mpwqe_add_dseg(sq, &txd); +- + mlx5e_tx_skb_update_hwts_flags(skb); + + if (unlikely(mlx5e_tx_mpwqe_is_full(&sq->mpwqe))) { +@@ -664,6 +683,7 @@ mlx5e_sq_xmit_mpwqe(struct mlx5e_txqsq *sq, struct sk_buff *skb, + mlx5e_dma_unmap_wqe_err(sq, 1); + sq->stats->dropped++; + dev_kfree_skb_any(skb); ++ mlx5e_tx_flush(sq); + } + + void mlx5e_tx_mpwqe_ensure_complete(struct mlx5e_txqsq *sq) +@@ -1033,5 +1053,6 @@ void mlx5i_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb, + err_drop: + stats->dropped++; + dev_kfree_skb_any(skb); ++ mlx5e_tx_flush(sq); + } + #endif +-- +2.35.1 + diff --git a/queue-5.15/net-stmmac-dwc-qos-disable-split-header-for-tegra194.patch b/queue-5.15/net-stmmac-dwc-qos-disable-split-header-for-tegra194.patch new file mode 100644 index 00000000000..8a722771abf --- /dev/null +++ b/queue-5.15/net-stmmac-dwc-qos-disable-split-header-for-tegra194.patch @@ -0,0 +1,47 @@ +From 68fa8ba2f0782ed54f477d03d0f34c054c7211ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 09:39:13 +0100 +Subject: net: stmmac: dwc-qos: Disable split header for Tegra194 + +From: Jon Hunter + +[ Upstream commit 029c1c2059e9c4b38f97a06204cdecd10cfbeb8a ] + +There is a long-standing issue with the Synopsys DWC Ethernet driver +for Tegra194 where random system crashes have been observed [0]. The +problem occurs when the split header feature is enabled in the stmmac +driver. In the bad case, a larger than expected buffer length is +received and causes the calculation of the total buffer length to +overflow. This results in a very large buffer length that causes the +kernel to crash. Why this larger buffer length is received is not clear, +however, the feedback from the NVIDIA design team is that the split +header feature is not supported for Tegra194. Therefore, disable split +header support for Tegra194 to prevent these random crashes from +occurring. + +[0] https://lore.kernel.org/linux-tegra/b0b17697-f23e-8fa5-3757-604a86f3a095@nvidia.com/ + +Fixes: 67afd6d1cfdf ("net: stmmac: Add Split Header support and enable it in XGMAC cores") +Signed-off-by: Jon Hunter +Link: https://lore.kernel.org/r/20220706083913.13750-1-jonathanh@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c +index bc91fd867dcd..358fc26f8d1f 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c +@@ -361,6 +361,7 @@ static int tegra_eqos_probe(struct platform_device *pdev, + data->fix_mac_speed = tegra_eqos_fix_speed; + data->init = tegra_eqos_init; + data->bsp_priv = eqos; ++ data->sph_disable = 1; + + err = tegra_eqos_init(pdev, eqos); + if (err < 0) +-- +2.35.1 + diff --git a/queue-5.15/net-stmmac-fix-leaks-in-probe.patch b/queue-5.15/net-stmmac-fix-leaks-in-probe.patch new file mode 100644 index 00000000000..7f2393a4e13 --- /dev/null +++ b/queue-5.15/net-stmmac-fix-leaks-in-probe.patch @@ -0,0 +1,46 @@ +From 2c1649482928acd0450dc93eaccb099da7cd8dc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 17:42:25 +0300 +Subject: net: stmmac: fix leaks in probe + +From: Dan Carpenter + +[ Upstream commit 23aa6d5088e3bd65de77c5c307237b9937f8b48a ] + +These two error paths should clean up before returning. + +Fixes: 2bb4b98b60d7 ("net: stmmac: Add Ingenic SoCs MAC support.") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c +index 9a6d819b84ae..378b4dd826bb 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c +@@ -273,7 +273,8 @@ static int ingenic_mac_probe(struct platform_device *pdev) + mac->tx_delay = tx_delay_ps * 1000; + } else { + dev_err(&pdev->dev, "Invalid TX clock delay: %dps\n", tx_delay_ps); +- return -EINVAL; ++ ret = -EINVAL; ++ goto err_remove_config_dt; + } + } + +@@ -283,7 +284,8 @@ static int ingenic_mac_probe(struct platform_device *pdev) + mac->rx_delay = rx_delay_ps * 1000; + } else { + dev_err(&pdev->dev, "Invalid RX clock delay: %dps\n", rx_delay_ps); +- return -EINVAL; ++ ret = -EINVAL; ++ goto err_remove_config_dt; + } + } + +-- +2.35.1 + diff --git a/queue-5.15/net-tls-check-for-errors-in-tls_device_init.patch b/queue-5.15/net-tls-check-for-errors-in-tls_device_init.patch new file mode 100644 index 00000000000..16c0dfe6427 --- /dev/null +++ b/queue-5.15/net-tls-check-for-errors-in-tls_device_init.patch @@ -0,0 +1,83 @@ +From 879d842d53b11721a6bb283fb16dd4f7288f5ac1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 10:07:54 +0300 +Subject: net/tls: Check for errors in tls_device_init + +From: Tariq Toukan + +[ Upstream commit 3d8c51b25a235e283e37750943bbf356ef187230 ] + +Add missing error checks in tls_device_init. + +Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure") +Reported-by: Jakub Kicinski +Reviewed-by: Maxim Mikityanskiy +Signed-off-by: Tariq Toukan +Link: https://lore.kernel.org/r/20220714070754.1428-1-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/tls.h | 4 ++-- + net/tls/tls_device.c | 4 ++-- + net/tls/tls_main.c | 7 ++++++- + 3 files changed, 10 insertions(+), 5 deletions(-) + +diff --git a/include/net/tls.h b/include/net/tls.h +index 1fffb206f09f..bf3d63a52788 100644 +--- a/include/net/tls.h ++++ b/include/net/tls.h +@@ -707,7 +707,7 @@ int tls_sw_fallback_init(struct sock *sk, + struct tls_crypto_info *crypto_info); + + #ifdef CONFIG_TLS_DEVICE +-void tls_device_init(void); ++int tls_device_init(void); + void tls_device_cleanup(void); + void tls_device_sk_destruct(struct sock *sk); + int tls_set_device_offload(struct sock *sk, struct tls_context *ctx); +@@ -727,7 +727,7 @@ static inline bool tls_is_sk_rx_device_offloaded(struct sock *sk) + return tls_get_ctx(sk)->rx_conf == TLS_HW; + } + #else +-static inline void tls_device_init(void) {} ++static inline int tls_device_init(void) { return 0; } + static inline void tls_device_cleanup(void) {} + + static inline int +diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c +index f3e3d009cf1c..4775431cbd38 100644 +--- a/net/tls/tls_device.c ++++ b/net/tls/tls_device.c +@@ -1394,9 +1394,9 @@ static struct notifier_block tls_dev_notifier = { + .notifier_call = tls_dev_event, + }; + +-void __init tls_device_init(void) ++int __init tls_device_init(void) + { +- register_netdevice_notifier(&tls_dev_notifier); ++ return register_netdevice_notifier(&tls_dev_notifier); + } + + void __exit tls_device_cleanup(void) +diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c +index 62b1c5e32bbd..a947cfb100bd 100644 +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -910,7 +910,12 @@ static int __init tls_register(void) + if (err) + return err; + +- tls_device_init(); ++ err = tls_device_init(); ++ if (err) { ++ unregister_pernet_subsys(&tls_proc_ops); ++ return err; ++ } ++ + tcp_register_ulp(&tcp_tls_ulp_ops); + + return 0; +-- +2.35.1 + diff --git a/queue-5.15/netfilter-nf_log-incorrect-offset-to-network-header.patch b/queue-5.15/netfilter-nf_log-incorrect-offset-to-network-header.patch new file mode 100644 index 00000000000..3c069f79f72 --- /dev/null +++ b/queue-5.15/netfilter-nf_log-incorrect-offset-to-network-header.patch @@ -0,0 +1,70 @@ +From 81c07451919caaf81638643f3bbb51c2bdec7a26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jul 2022 10:26:15 +0200 +Subject: netfilter: nf_log: incorrect offset to network header + +From: Pablo Neira Ayuso + +[ Upstream commit 7a847c00eeba9744353ecdfad253143b9115678a ] + +NFPROTO_ARP is expecting to find the ARP header at the network offset. + +In the particular case of ARP, HTYPE= field shows the initial bytes of +the ethernet header destination MAC address. + + netdev out: IN= OUT=bridge0 MACSRC=c2:76:e5:71:e1:de MACDST=36:b0:4a:e2:72:ea MACPROTO=0806 ARP HTYPE=14000 PTYPE=0x4ae2 OPCODE=49782 + +NFPROTO_NETDEV egress hook is also expecting to find the IP headers at +the network offset. + +Fixes: 35b9395104d5 ("netfilter: add generic ARP packet logger") +Reported-by: Tom Yan +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_log_syslog.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/nf_log_syslog.c b/net/netfilter/nf_log_syslog.c +index 13234641cdb3..7000e069bc07 100644 +--- a/net/netfilter/nf_log_syslog.c ++++ b/net/netfilter/nf_log_syslog.c +@@ -61,7 +61,7 @@ dump_arp_packet(struct nf_log_buf *m, + unsigned int logflags; + struct arphdr _arph; + +- ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph); ++ ah = skb_header_pointer(skb, nhoff, sizeof(_arph), &_arph); + if (!ah) { + nf_log_buf_add(m, "TRUNCATED"); + return; +@@ -90,7 +90,7 @@ dump_arp_packet(struct nf_log_buf *m, + ah->ar_pln != sizeof(__be32)) + return; + +- ap = skb_header_pointer(skb, sizeof(_arph), sizeof(_arpp), &_arpp); ++ ap = skb_header_pointer(skb, nhoff + sizeof(_arph), sizeof(_arpp), &_arpp); + if (!ap) { + nf_log_buf_add(m, " INCOMPLETE [%zu bytes]", + skb->len - sizeof(_arph)); +@@ -144,7 +144,7 @@ static void nf_log_arp_packet(struct net *net, u_int8_t pf, + + nf_log_dump_packet_common(m, pf, hooknum, skb, in, out, loginfo, + prefix); +- dump_arp_packet(m, loginfo, skb, 0); ++ dump_arp_packet(m, loginfo, skb, skb_network_offset(skb)); + + nf_log_buf_close(m); + } +@@ -829,7 +829,7 @@ static void nf_log_ip_packet(struct net *net, u_int8_t pf, + if (in) + dump_ipv4_mac_header(m, loginfo, skb); + +- dump_ipv4_packet(net, m, loginfo, skb, 0); ++ dump_ipv4_packet(net, m, loginfo, skb, skb_network_offset(skb)); + + nf_log_buf_close(m); + } +-- +2.35.1 + diff --git a/queue-5.15/netfilter-nf_tables-replace-bug_on-by-element-length.patch b/queue-5.15/netfilter-nf_tables-replace-bug_on-by-element-length.patch new file mode 100644 index 00000000000..da24dcfeffc --- /dev/null +++ b/queue-5.15/netfilter-nf_tables-replace-bug_on-by-element-length.patch @@ -0,0 +1,220 @@ +From ed2d8e12d072bd07894dd22fe16f45ab6b13075a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jul 2022 11:41:59 +0200 +Subject: netfilter: nf_tables: replace BUG_ON by element length check + +From: Pablo Neira Ayuso + +[ Upstream commit c39ba4de6b0a843bec5d46c2b6f2064428dada5e ] + +BUG_ON can be triggered from userspace with an element with a large +userdata area. Replace it by length check and return EINVAL instead. +Over time extensions have been growing in size. + +Pick a sufficiently old Fixes: tag to propagate this fix. + +Fixes: 7d7402642eaf ("netfilter: nf_tables: variable sized set element keys / data") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_tables.h | 14 +++--- + net/netfilter/nf_tables_api.c | 72 ++++++++++++++++++++++--------- + 2 files changed, 60 insertions(+), 26 deletions(-) + +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index bcfee89012a1..f56a1071c005 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -642,18 +642,22 @@ static inline void nft_set_ext_prepare(struct nft_set_ext_tmpl *tmpl) + tmpl->len = sizeof(struct nft_set_ext); + } + +-static inline void nft_set_ext_add_length(struct nft_set_ext_tmpl *tmpl, u8 id, +- unsigned int len) ++static inline int nft_set_ext_add_length(struct nft_set_ext_tmpl *tmpl, u8 id, ++ unsigned int len) + { + tmpl->len = ALIGN(tmpl->len, nft_set_ext_types[id].align); +- BUG_ON(tmpl->len > U8_MAX); ++ if (tmpl->len > U8_MAX) ++ return -EINVAL; ++ + tmpl->offset[id] = tmpl->len; + tmpl->len += nft_set_ext_types[id].len + len; ++ ++ return 0; + } + +-static inline void nft_set_ext_add(struct nft_set_ext_tmpl *tmpl, u8 id) ++static inline int nft_set_ext_add(struct nft_set_ext_tmpl *tmpl, u8 id) + { +- nft_set_ext_add_length(tmpl, id, 0); ++ return nft_set_ext_add_length(tmpl, id, 0); + } + + static inline void nft_set_ext_init(struct nft_set_ext *ext, +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 65d96439e2be..a32acf056e32 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -5736,8 +5736,11 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL)) + return -EINVAL; + +- if (flags != 0) +- nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); ++ if (flags != 0) { ++ err = nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); ++ if (err < 0) ++ return err; ++ } + + if (set->flags & NFT_SET_MAP) { + if (nla[NFTA_SET_ELEM_DATA] == NULL && +@@ -5846,7 +5849,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + if (err < 0) + goto err_set_elem_expr; + +- nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); ++ err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); ++ if (err < 0) ++ goto err_parse_key; + } + + if (nla[NFTA_SET_ELEM_KEY_END]) { +@@ -5855,22 +5860,31 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + if (err < 0) + goto err_parse_key; + +- nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen); ++ err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen); ++ if (err < 0) ++ goto err_parse_key_end; + } + + if (timeout > 0) { +- nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION); +- if (timeout != set->timeout) +- nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT); ++ err = nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION); ++ if (err < 0) ++ goto err_parse_key_end; ++ ++ if (timeout != set->timeout) { ++ err = nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT); ++ if (err < 0) ++ goto err_parse_key_end; ++ } + } + + if (num_exprs) { + for (i = 0; i < num_exprs; i++) + size += expr_array[i]->ops->size; + +- nft_set_ext_add_length(&tmpl, NFT_SET_EXT_EXPRESSIONS, +- sizeof(struct nft_set_elem_expr) + +- size); ++ err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_EXPRESSIONS, ++ sizeof(struct nft_set_elem_expr) + size); ++ if (err < 0) ++ goto err_parse_key_end; + } + + if (nla[NFTA_SET_ELEM_OBJREF] != NULL) { +@@ -5885,7 +5899,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + err = PTR_ERR(obj); + goto err_parse_key_end; + } +- nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF); ++ err = nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF); ++ if (err < 0) ++ goto err_parse_key_end; + } + + if (nla[NFTA_SET_ELEM_DATA] != NULL) { +@@ -5919,7 +5935,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + NFT_VALIDATE_NEED); + } + +- nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, desc.len); ++ err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, desc.len); ++ if (err < 0) ++ goto err_parse_data; + } + + /* The full maximum length of userdata can exceed the maximum +@@ -5929,9 +5947,12 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + ulen = 0; + if (nla[NFTA_SET_ELEM_USERDATA] != NULL) { + ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]); +- if (ulen > 0) +- nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA, +- ulen); ++ if (ulen > 0) { ++ err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA, ++ ulen); ++ if (err < 0) ++ goto err_parse_data; ++ } + } + + err = -ENOMEM; +@@ -6157,8 +6178,11 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set, + + nft_set_ext_prepare(&tmpl); + +- if (flags != 0) +- nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); ++ if (flags != 0) { ++ err = nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); ++ if (err < 0) ++ return err; ++ } + + if (nla[NFTA_SET_ELEM_KEY]) { + err = nft_setelem_parse_key(ctx, set, &elem.key.val, +@@ -6166,16 +6190,20 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set, + if (err < 0) + return err; + +- nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); ++ err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); ++ if (err < 0) ++ goto fail_elem; + } + + if (nla[NFTA_SET_ELEM_KEY_END]) { + err = nft_setelem_parse_key(ctx, set, &elem.key_end.val, + nla[NFTA_SET_ELEM_KEY_END]); + if (err < 0) +- return err; ++ goto fail_elem; + +- nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen); ++ err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen); ++ if (err < 0) ++ goto fail_elem_key_end; + } + + err = -ENOMEM; +@@ -6183,7 +6211,7 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set, + elem.key_end.val.data, NULL, 0, 0, + GFP_KERNEL); + if (elem.priv == NULL) +- goto fail_elem; ++ goto fail_elem_key_end; + + ext = nft_set_elem_ext(set, elem.priv); + if (flags) +@@ -6207,6 +6235,8 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set, + kfree(trans); + fail_trans: + kfree(elem.priv); ++fail_elem_key_end: ++ nft_data_release(&elem.key_end.val, NFT_DATA_VALUE); + fail_elem: + nft_data_release(&elem.key.val, NFT_DATA_VALUE); + return err; +-- +2.35.1 + diff --git a/queue-5.15/nexthop-fix-data-races-around-nexthop_compat_mode.patch b/queue-5.15/nexthop-fix-data-races-around-nexthop_compat_mode.patch new file mode 100644 index 00000000000..7ecdf93e81a --- /dev/null +++ b/queue-5.15/nexthop-fix-data-races-around-nexthop_compat_mode.patch @@ -0,0 +1,74 @@ +From 202a5c756581e88131b56e65ff1fd6867ceca171 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:33 -0700 +Subject: nexthop: Fix data-races around nexthop_compat_mode. + +From: Kuniyuki Iwashima + +[ Upstream commit bdf00bf24bef9be1ca641a6390fd5487873e0d2e ] + +While reading nexthop_compat_mode, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +Fixes: 4f80116d3df3 ("net: ipv4: add sysctl for nexthop api compatibility mode") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/fib_semantics.c | 2 +- + net/ipv4/nexthop.c | 5 +++-- + net/ipv6/route.c | 2 +- + 3 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c +index a98350dacbc3..674694d8ac61 100644 +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -1829,7 +1829,7 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event, + goto nla_put_failure; + if (nexthop_is_blackhole(fi->nh)) + rtm->rtm_type = RTN_BLACKHOLE; +- if (!fi->fib_net->ipv4.sysctl_nexthop_compat_mode) ++ if (!READ_ONCE(fi->fib_net->ipv4.sysctl_nexthop_compat_mode)) + goto offload; + } + +diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c +index 5dbd4b5505eb..cc8f120149f6 100644 +--- a/net/ipv4/nexthop.c ++++ b/net/ipv4/nexthop.c +@@ -1857,7 +1857,7 @@ static void __remove_nexthop_fib(struct net *net, struct nexthop *nh) + /* __ip6_del_rt does a release, so do a hold here */ + fib6_info_hold(f6i); + ipv6_stub->ip6_del_rt(net, f6i, +- !net->ipv4.sysctl_nexthop_compat_mode); ++ !READ_ONCE(net->ipv4.sysctl_nexthop_compat_mode)); + } + } + +@@ -2362,7 +2362,8 @@ static int insert_nexthop(struct net *net, struct nexthop *new_nh, + if (!rc) { + nh_base_seq_inc(net); + nexthop_notify(RTM_NEWNEXTHOP, new_nh, &cfg->nlinfo); +- if (replace_notify && net->ipv4.sysctl_nexthop_compat_mode) ++ if (replace_notify && ++ READ_ONCE(net->ipv4.sysctl_nexthop_compat_mode)) + nexthop_replace_notify(net, new_nh, &cfg->nlinfo); + } + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 4ca754c360a3..27274fc3619a 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -5756,7 +5756,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb, + if (nexthop_is_blackhole(rt->nh)) + rtm->rtm_type = RTN_BLACKHOLE; + +- if (net->ipv4.sysctl_nexthop_compat_mode && ++ if (READ_ONCE(net->ipv4.sysctl_nexthop_compat_mode) && + rt6_fill_node_nexthop(skb, rt->nh, &nh_flags) < 0) + goto nla_put_failure; + +-- +2.35.1 + diff --git a/queue-5.15/raw-fix-a-data-race-around-sysctl_raw_l3mdev_accept.patch b/queue-5.15/raw-fix-a-data-race-around-sysctl_raw_l3mdev_accept.patch new file mode 100644 index 00000000000..eda43c4a93e --- /dev/null +++ b/queue-5.15/raw-fix-a-data-race-around-sysctl_raw_l3mdev_accept.patch @@ -0,0 +1,36 @@ +From b54c2b53f302cd15048af8eb74637ec4c62678b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:29 -0700 +Subject: raw: Fix a data-race around sysctl_raw_l3mdev_accept. + +From: Kuniyuki Iwashima + +[ Upstream commit 1dace014928e6e385363032d359a04dee9158af0 ] + +While reading sysctl_raw_l3mdev_accept, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: 6897445fb194 ("net: provide a sysctl raw_l3mdev_accept for raw socket lookup with VRFs") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/raw.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/net/raw.h b/include/net/raw.h +index 8ad8df594853..c51a635671a7 100644 +--- a/include/net/raw.h ++++ b/include/net/raw.h +@@ -75,7 +75,7 @@ static inline bool raw_sk_bound_dev_eq(struct net *net, int bound_dev_if, + int dif, int sdif) + { + #if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV) +- return inet_bound_dev_eq(!!net->ipv4.sysctl_raw_l3mdev_accept, ++ return inet_bound_dev_eq(READ_ONCE(net->ipv4.sysctl_raw_l3mdev_accept), + bound_dev_if, dif, sdif); + #else + return inet_bound_dev_eq(true, bound_dev_if, dif, sdif); +-- +2.35.1 + diff --git a/queue-5.15/reset-fix-devm-bulk-optional-exclusive-control-gette.patch b/queue-5.15/reset-fix-devm-bulk-optional-exclusive-control-gette.patch new file mode 100644 index 00000000000..05d7d9fffd1 --- /dev/null +++ b/queue-5.15/reset-fix-devm-bulk-optional-exclusive-control-gette.patch @@ -0,0 +1,47 @@ +From aa7edb2cd059d46013d6153046fc1aa1afc4056e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jun 2022 17:18:45 +0300 +Subject: reset: Fix devm bulk optional exclusive control getter + +From: Serge Semin + +[ Upstream commit a57f68ddc8865d59a19783080cc52fb4a11dc209 ] + +Most likely due to copy-paste mistake the device managed version of the +denoted reset control getter has been implemented with invalid semantic, +which can be immediately spotted by having "WARN_ON(shared && acquired)" +warning in the system log as soon as the method is called. Anyway let's +fix it by altering the boolean arguments passed to the +__devm_reset_control_bulk_get() method from +- shared = true, optional = false, acquired = true +to ++ shared = false, optional = true, acquired = true +That's what they were supposed to be in the first place (see the non-devm +version of the same method: reset_control_bulk_get_optional_exclusive()). + +Fixes: 48d71395896d ("reset: Add reset_control_bulk API") +Signed-off-by: Serge Semin +Reviewed-by: Dmitry Osipenko +Signed-off-by: Philipp Zabel +Link: https://lore.kernel.org/r/20220624141853.7417-2-Sergey.Semin@baikalelectronics.ru +Signed-off-by: Sasha Levin +--- + include/linux/reset.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/reset.h b/include/linux/reset.h +index db0e6115a2f6..7bb583737528 100644 +--- a/include/linux/reset.h ++++ b/include/linux/reset.h +@@ -711,7 +711,7 @@ static inline int __must_check + devm_reset_control_bulk_get_optional_exclusive(struct device *dev, int num_rstcs, + struct reset_control_bulk_data *rstcs) + { +- return __devm_reset_control_bulk_get(dev, num_rstcs, rstcs, true, false, true); ++ return __devm_reset_control_bulk_get(dev, num_rstcs, rstcs, false, true, true); + } + + /** +-- +2.35.1 + diff --git a/queue-5.15/seg6-bpf-fix-skb-checksum-in-bpf_push_seg6_encap.patch b/queue-5.15/seg6-bpf-fix-skb-checksum-in-bpf_push_seg6_encap.patch new file mode 100644 index 00000000000..5b3a40bdca1 --- /dev/null +++ b/queue-5.15/seg6-bpf-fix-skb-checksum-in-bpf_push_seg6_encap.patch @@ -0,0 +1,44 @@ +From b612a94d127c8d30a8d864df6d3dd90538188084 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 19:58:37 +0200 +Subject: seg6: bpf: fix skb checksum in bpf_push_seg6_encap() + +From: Andrea Mayer + +[ Upstream commit 4889fbd98deaf243c3baadc54e296d71c6af1eb0 ] + +Both helper functions bpf_lwt_seg6_action() and bpf_lwt_push_encap() use +the bpf_push_seg6_encap() to encapsulate the packet in an IPv6 with Segment +Routing Header (SRH) or insert an SRH between the IPv6 header and the +payload. +To achieve this result, such helper functions rely on bpf_push_seg6_encap() +which, in turn, leverages seg6_do_srh_{encap,inline}() to perform the +required operation (i.e. encap/inline). + +This patch removes the initialization of the IPv6 header payload length +from bpf_push_seg6_encap(), as it is now handled properly by +seg6_do_srh_{encap,inline}() to prevent corruption of the skb checksum. + +Fixes: fe94cc290f53 ("bpf: Add IPv6 Segment Routing helpers") +Signed-off-by: Andrea Mayer +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index d1e2ef77ce4c..8b2bc855714b 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -5851,7 +5851,6 @@ static int bpf_push_seg6_encap(struct sk_buff *skb, u32 type, void *hdr, u32 len + if (err) + return err; + +- ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); + skb_set_transport_header(skb, sizeof(struct ipv6hdr)); + + return seg6_lookup_nexthop(skb, NULL, 0); +-- +2.35.1 + diff --git a/queue-5.15/seg6-fix-skb-checksum-evaluation-in-srh-encapsulatio.patch b/queue-5.15/seg6-fix-skb-checksum-evaluation-in-srh-encapsulatio.patch new file mode 100644 index 00000000000..93ab70e83b5 --- /dev/null +++ b/queue-5.15/seg6-fix-skb-checksum-evaluation-in-srh-encapsulatio.patch @@ -0,0 +1,73 @@ +From f263b403ab6c5775d7471f1dfbc9fda83926aeec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 19:58:35 +0200 +Subject: seg6: fix skb checksum evaluation in SRH encapsulation/insertion + +From: Andrea Mayer + +[ Upstream commit df8386d13ea280d55beee1b95f61a59234a3798b ] + +Support for SRH encapsulation and insertion was introduced with +commit 6c8702c60b88 ("ipv6: sr: add support for SRH encapsulation and +injection with lwtunnels"), through the seg6_do_srh_encap() and +seg6_do_srh_inline() functions, respectively. +The former encapsulates the packet in an outer IPv6 header along with +the SRH, while the latter inserts the SRH between the IPv6 header and +the payload. Then, the headers are initialized/updated according to the +operating mode (i.e., encap/inline). +Finally, the skb checksum is calculated to reflect the changes applied +to the headers. + +The IPv6 payload length ('payload_len') is not initialized +within seg6_do_srh_{inline,encap}() but is deferred in seg6_do_srh(), i.e. +the caller of seg6_do_srh_{inline,encap}(). +However, this operation invalidates the skb checksum, since the +'payload_len' is updated only after the checksum is evaluated. + +To solve this issue, the initialization of the IPv6 payload length is +moved from seg6_do_srh() directly into the seg6_do_srh_{inline,encap}() +functions and before the skb checksum update takes place. + +Fixes: 6c8702c60b88 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels") +Reported-by: Paolo Abeni +Link: https://lore.kernel.org/all/20220705190727.69d532417be7438b15404ee1@uniroma2.it +Signed-off-by: Andrea Mayer +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv6/seg6_iptunnel.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c +index d64855010948..e756ba705fd9 100644 +--- a/net/ipv6/seg6_iptunnel.c ++++ b/net/ipv6/seg6_iptunnel.c +@@ -189,6 +189,8 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto) + } + #endif + ++ hdr->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); ++ + skb_postpush_rcsum(skb, hdr, tot_len); + + return 0; +@@ -241,6 +243,8 @@ int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh) + } + #endif + ++ hdr->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); ++ + skb_postpush_rcsum(skb, hdr, sizeof(struct ipv6hdr) + hdrlen); + + return 0; +@@ -302,7 +306,6 @@ static int seg6_do_srh(struct sk_buff *skb) + break; + } + +- ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); + skb_set_transport_header(skb, sizeof(struct ipv6hdr)); + nf_reset_ct(skb); + +-- +2.35.1 + diff --git a/queue-5.15/seg6-fix-skb-checksum-in-srv6-end.b6-and-end.b6.enca.patch b/queue-5.15/seg6-fix-skb-checksum-in-srv6-end.b6-and-end.b6.enca.patch new file mode 100644 index 00000000000..ce98d402ef6 --- /dev/null +++ b/queue-5.15/seg6-fix-skb-checksum-in-srv6-end.b6-and-end.b6.enca.patch @@ -0,0 +1,51 @@ +From 20b51766bea1c84613545010a5cbe8f90dc6ff56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 19:58:36 +0200 +Subject: seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors + +From: Andrea Mayer + +[ Upstream commit f048880fc77058d864aff5c674af7918b30f312a ] + +The SRv6 End.B6 and End.B6.Encaps behaviors rely on functions +seg6_do_srh_{encap,inline}() to, respectively: i) encapsulate the +packet within an outer IPv6 header with the specified Segment Routing +Header (SRH); ii) insert the specified SRH directly after the IPv6 +header of the packet. + +This patch removes the initialization of the IPv6 header payload length +from the input_action_end_b6{_encap}() functions, as it is now handled +properly by seg6_do_srh_{encap,inline}() to avoid corruption of the skb +checksum. + +Fixes: 140f04c33bbc ("ipv6: sr: implement several seg6local actions") +Signed-off-by: Andrea Mayer +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv6/seg6_local.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c +index ef88489c71f5..59454285d5c5 100644 +--- a/net/ipv6/seg6_local.c ++++ b/net/ipv6/seg6_local.c +@@ -824,7 +824,6 @@ static int input_action_end_b6(struct sk_buff *skb, struct seg6_local_lwt *slwt) + if (err) + goto drop; + +- ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); + skb_set_transport_header(skb, sizeof(struct ipv6hdr)); + + seg6_lookup_nexthop(skb, NULL, 0); +@@ -856,7 +855,6 @@ static int input_action_end_b6_encap(struct sk_buff *skb, + if (err) + goto drop; + +- ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); + skb_set_transport_header(skb, sizeof(struct ipv6hdr)); + + seg6_lookup_nexthop(skb, NULL, 0); +-- +2.35.1 + diff --git a/queue-5.15/series b/queue-5.15/series index 673de22c000..6a2f5466fea 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -27,3 +27,84 @@ xfs-only-run-cow-extent-recovery-when-there-are-no-live-extents.patch xfs-don-t-include-bnobt-blocks-when-reserving-free-block-pool.patch xfs-run-callbacks-before-waking-waiters-in-xlog_state_shutdown_callbacks.patch xfs-drop-async-cache-flushes-from-cil-commits.patch +reset-fix-devm-bulk-optional-exclusive-control-gette.patch +arm-dts-imx6qdl-ts7970-fix-ngpio-typo-and-count.patch +spi-amd-limit-max-transfer-and-message-size.patch +arm-9209-1-spectre-bhb-avoid-pr_info-every-time-a-cp.patch +arm-9210-1-mark-the-fdt_fixed-sections-as-shareable.patch +net-mlx5e-ktls-fix-build-time-constant-test-in-tx.patch +net-mlx5e-ktls-fix-build-time-constant-test-in-rx.patch +net-mlx5e-fix-enabling-sriov-while-tc-nic-rules-are-.patch +net-mlx5e-fix-capability-check-for-updating-vnic-env.patch +net-mlx5e-ring-the-tx-doorbell-on-dma-errors.patch +drm-i915-fix-a-possible-refcount-leak-in-intel_dp_ad.patch +ima-fix-a-potential-integer-overflow-in-ima_appraise.patch +asoc-sgtl5000-fix-noise-on-shutdown-remove.patch +asoc-tas2764-add-post-reset-delays.patch +asoc-tas2764-fix-and-extend-fsync-polarity-handling.patch +asoc-tas2764-correct-playback-volume-range.patch +asoc-tas2764-fix-amp-gain-register-offset-default.patch +asoc-intel-skylake-correct-the-ssp-rate-discovery-in.patch +asoc-intel-skylake-correct-the-handling-of-fmt_confi.patch +net-stmmac-dwc-qos-disable-split-header-for-tegra194.patch +net-ethernet-ti-am65-cpsw-fix-devlink-port-register-.patch +sysctl-fix-data-races-in-proc_dointvec.patch +sysctl-fix-data-races-in-proc_douintvec.patch +sysctl-fix-data-races-in-proc_dointvec_minmax.patch +sysctl-fix-data-races-in-proc_douintvec_minmax.patch +sysctl-fix-data-races-in-proc_doulongvec_minmax.patch +sysctl-fix-data-races-in-proc_dointvec_jiffies.patch +tcp-fix-a-data-race-around-sysctl_tcp_max_orphans.patch +inetpeer-fix-data-races-around-sysctl.patch +net-fix-data-races-around-sysctl_mem.patch +cipso-fix-data-races-around-sysctl.patch +icmp-fix-data-races-around-sysctl.patch +ipv4-fix-a-data-race-around-sysctl_fib_sync_mem.patch +arm-dts-at91-sama5d2-fix-typo-in-i2s1-node.patch +arm-dts-sunxi-fix-spi-nor-campatible-on-orange-pi-ze.patch +arm64-dts-broadcom-bcm4908-fix-timer-node-for-bcm490.patch +arm64-dts-broadcom-bcm4908-fix-cpu-node-for-smp-boot.patch +netfilter-nf_log-incorrect-offset-to-network-header.patch +netfilter-nf_tables-replace-bug_on-by-element-length.patch +drm-i915-gvt-is_err-vs-null-bug-in-intel_gvt_update_.patch +xen-gntdev-ignore-failure-to-unmap-invalid_grant_han.patch +lockd-set-fl_owner-when-unlocking-files.patch +lockd-fix-nlm_close_files.patch +tracing-fix-sleeping-while-atomic-in-kdb-ftdump.patch +drm-i915-selftests-fix-a-couple-is_err-vs-null-tests.patch +drm-i915-dg2-add-wa_22011100796.patch +drm-i915-gt-serialize-grdom-access-between-multiple-.patch +drm-i915-gt-serialize-tlb-invalidates-with-gt-resets.patch +drm-i915-uc-correctly-track-uc_fw-init-failure.patch +drm-i915-require-the-vm-mutex-for-i915_vma_bind.patch +bnxt_en-fix-bnxt_reinit_after_abort-code-path.patch +bnxt_en-fix-bnxt_refclk_read.patch +sysctl-fix-data-races-in-proc_dou8vec_minmax.patch +sysctl-fix-data-races-in-proc_dointvec_ms_jiffies.patch +icmp-fix-data-races-around-sysctl_icmp_echo_enable_p.patch +icmp-fix-a-data-race-around-sysctl_icmp_ignore_bogus.patch +icmp-fix-a-data-race-around-sysctl_icmp_errors_use_i.patch +icmp-fix-a-data-race-around-sysctl_icmp_ratelimit.patch +icmp-fix-a-data-race-around-sysctl_icmp_ratemask.patch +raw-fix-a-data-race-around-sysctl_raw_l3mdev_accept.patch +tcp-fix-a-data-race-around-sysctl_tcp_ecn_fallback.patch +ipv4-fix-data-races-around-sysctl_ip_dynaddr.patch +nexthop-fix-data-races-around-nexthop_compat_mode.patch +net-ftgmac100-hold-reference-returned-by-of_get_chil.patch +net-stmmac-fix-leaks-in-probe.patch +ima-force-signature-verification-when-config_kexec_s.patch +ima-fix-potential-memory-leak-in-ima_init_crypto.patch +drm-amd-display-only-use-depth-36-bpp-linebuffers-on.patch +drm-amd-pm-prevent-divide-by-zero.patch +sfc-fix-use-after-free-when-disabling-sriov.patch +ceph-switch-netfs-read-ops-to-use-rreq-inode-instead.patch +seg6-fix-skb-checksum-evaluation-in-srh-encapsulatio.patch +seg6-fix-skb-checksum-in-srv6-end.b6-and-end.b6.enca.patch +seg6-bpf-fix-skb-checksum-in-bpf_push_seg6_encap.patch +sfc-fix-kernel-panic-when-creating-vf.patch +net-atlantic-remove-deep-parameter-on-suspend-resume.patch +net-atlantic-remove-aq_nic_deinit-when-resume.patch +kvm-x86-fully-initialize-struct-kvm_lapic_irq-in-kvm.patch +net-tls-check-for-errors-in-tls_device_init.patch +acpi-video-fix-acpi_video_handles_brightness_key_pre.patch +mm-sysctl-fix-missing-numa_stat-when-config_hugetlb_.patch diff --git a/queue-5.15/sfc-fix-kernel-panic-when-creating-vf.patch b/queue-5.15/sfc-fix-kernel-panic-when-creating-vf.patch new file mode 100644 index 00000000000..3ac0ebbd6f5 --- /dev/null +++ b/queue-5.15/sfc-fix-kernel-panic-when-creating-vf.patch @@ -0,0 +1,71 @@ +From c53320093132cbf530c48c593b90e8445a4788ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 11:21:16 +0200 +Subject: sfc: fix kernel panic when creating VF +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Íñigo Huguet + +[ Upstream commit ada74c5539eba06cf8b47d068f92e0b3963a9a6e ] + +When creating VFs a kernel panic can happen when calling to +efx_ef10_try_update_nic_stats_vf. + +When releasing a DMA coherent buffer, sometimes, I don't know in what +specific circumstances, it has to unmap memory with vunmap. It is +disallowed to do that in IRQ context or with BH disabled. Otherwise, we +hit this line in vunmap, causing the crash: + BUG_ON(in_interrupt()); + +This patch reenables BH to release the buffer. + +Log messages when the bug is hit: + kernel BUG at mm/vmalloc.c:2727! + invalid opcode: 0000 [#1] PREEMPT SMP NOPTI + CPU: 6 PID: 1462 Comm: NetworkManager Kdump: loaded Tainted: G I --------- --- 5.14.0-119.el9.x86_64 #1 + Hardware name: Dell Inc. PowerEdge R740/06WXJT, BIOS 2.8.2 08/27/2020 + RIP: 0010:vunmap+0x2e/0x30 + ...skip... + Call Trace: + __iommu_dma_free+0x96/0x100 + efx_nic_free_buffer+0x2b/0x40 [sfc] + efx_ef10_try_update_nic_stats_vf+0x14a/0x1c0 [sfc] + efx_ef10_update_stats_vf+0x18/0x40 [sfc] + efx_start_all+0x15e/0x1d0 [sfc] + efx_net_open+0x5a/0xe0 [sfc] + __dev_open+0xe7/0x1a0 + __dev_change_flags+0x1d7/0x240 + dev_change_flags+0x21/0x60 + ...skip... + +Fixes: d778819609a2 ("sfc: DMA the VF stats only when requested") +Reported-by: Ma Yuying +Signed-off-by: Íñigo Huguet +Acked-by: Edward Cree +Link: https://lore.kernel.org/r/20220713092116.21238-1-ihuguet@redhat.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/ef10.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c +index c1cd1c97f09d..056c24ec1249 100644 +--- a/drivers/net/ethernet/sfc/ef10.c ++++ b/drivers/net/ethernet/sfc/ef10.c +@@ -1932,7 +1932,10 @@ static int efx_ef10_try_update_nic_stats_vf(struct efx_nic *efx) + + efx_update_sw_stats(efx, stats); + out: ++ /* releasing a DMA coherent buffer with BH disabled can panic */ ++ spin_unlock_bh(&efx->stats_lock); + efx_nic_free_buffer(efx, &stats_buf); ++ spin_lock_bh(&efx->stats_lock); + return rc; + } + +-- +2.35.1 + diff --git a/queue-5.15/sfc-fix-use-after-free-when-disabling-sriov.patch b/queue-5.15/sfc-fix-use-after-free-when-disabling-sriov.patch new file mode 100644 index 00000000000..ce6fed12047 --- /dev/null +++ b/queue-5.15/sfc-fix-use-after-free-when-disabling-sriov.patch @@ -0,0 +1,113 @@ +From 3897dd400a8684a1ffa6f9f1d43da93f5a7ab20d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 08:26:42 +0200 +Subject: sfc: fix use after free when disabling sriov +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Íñigo Huguet + +[ Upstream commit ebe41da5d47ac0fff877e57bd14c54dccf168827 ] + +Use after free is detected by kfence when disabling sriov. What was read +after being freed was vf->pci_dev: it was freed from pci_disable_sriov +and later read in efx_ef10_sriov_free_vf_vports, called from +efx_ef10_sriov_free_vf_vswitching. + +Set the pointer to NULL at release time to not trying to read it later. + +Reproducer and dmesg log (note that kfence doesn't detect it every time): +$ echo 1 > /sys/class/net/enp65s0f0np0/device/sriov_numvfs +$ echo 0 > /sys/class/net/enp65s0f0np0/device/sriov_numvfs + + BUG: KFENCE: use-after-free read in efx_ef10_sriov_free_vf_vswitching+0x82/0x170 [sfc] + + Use-after-free read at 0x00000000ff3c1ba5 (in kfence-#224): + efx_ef10_sriov_free_vf_vswitching+0x82/0x170 [sfc] + efx_ef10_pci_sriov_disable+0x38/0x70 [sfc] + efx_pci_sriov_configure+0x24/0x40 [sfc] + sriov_numvfs_store+0xfe/0x140 + kernfs_fop_write_iter+0x11c/0x1b0 + new_sync_write+0x11f/0x1b0 + vfs_write+0x1eb/0x280 + ksys_write+0x5f/0xe0 + do_syscall_64+0x5c/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + + kfence-#224: 0x00000000edb8ef95-0x00000000671f5ce1, size=2792, cache=kmalloc-4k + + allocated by task 6771 on cpu 10 at 3137.860196s: + pci_alloc_dev+0x21/0x60 + pci_iov_add_virtfn+0x2a2/0x320 + sriov_enable+0x212/0x3e0 + efx_ef10_sriov_configure+0x67/0x80 [sfc] + efx_pci_sriov_configure+0x24/0x40 [sfc] + sriov_numvfs_store+0xba/0x140 + kernfs_fop_write_iter+0x11c/0x1b0 + new_sync_write+0x11f/0x1b0 + vfs_write+0x1eb/0x280 + ksys_write+0x5f/0xe0 + do_syscall_64+0x5c/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + + freed by task 6771 on cpu 12 at 3170.991309s: + device_release+0x34/0x90 + kobject_cleanup+0x3a/0x130 + pci_iov_remove_virtfn+0xd9/0x120 + sriov_disable+0x30/0xe0 + efx_ef10_pci_sriov_disable+0x57/0x70 [sfc] + efx_pci_sriov_configure+0x24/0x40 [sfc] + sriov_numvfs_store+0xfe/0x140 + kernfs_fop_write_iter+0x11c/0x1b0 + new_sync_write+0x11f/0x1b0 + vfs_write+0x1eb/0x280 + ksys_write+0x5f/0xe0 + do_syscall_64+0x5c/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Fixes: 3c5eb87605e85 ("sfc: create vports for VFs and assign random MAC addresses") +Reported-by: Yanghang Liu +Signed-off-by: Íñigo Huguet +Acked-by: Martin Habets +Link: https://lore.kernel.org/r/20220712062642.6915-1-ihuguet@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/ef10_sriov.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/sfc/ef10_sriov.c b/drivers/net/ethernet/sfc/ef10_sriov.c +index 752d6406f07e..f488461a23d1 100644 +--- a/drivers/net/ethernet/sfc/ef10_sriov.c ++++ b/drivers/net/ethernet/sfc/ef10_sriov.c +@@ -408,8 +408,9 @@ static int efx_ef10_pci_sriov_enable(struct efx_nic *efx, int num_vfs) + static int efx_ef10_pci_sriov_disable(struct efx_nic *efx, bool force) + { + struct pci_dev *dev = efx->pci_dev; ++ struct efx_ef10_nic_data *nic_data = efx->nic_data; + unsigned int vfs_assigned = pci_vfs_assigned(dev); +- int rc = 0; ++ int i, rc = 0; + + if (vfs_assigned && !force) { + netif_info(efx, drv, efx->net_dev, "VFs are assigned to guests; " +@@ -417,10 +418,13 @@ static int efx_ef10_pci_sriov_disable(struct efx_nic *efx, bool force) + return -EBUSY; + } + +- if (!vfs_assigned) ++ if (!vfs_assigned) { ++ for (i = 0; i < efx->vf_count; i++) ++ nic_data->vf[i].pci_dev = NULL; + pci_disable_sriov(dev); +- else ++ } else { + rc = -EBUSY; ++ } + + efx_ef10_sriov_free_vf_vswitching(efx); + efx->vf_count = 0; +-- +2.35.1 + diff --git a/queue-5.15/spi-amd-limit-max-transfer-and-message-size.patch b/queue-5.15/spi-amd-limit-max-transfer-and-message-size.patch new file mode 100644 index 00000000000..ec6269a4b9d --- /dev/null +++ b/queue-5.15/spi-amd-limit-max-transfer-and-message-size.patch @@ -0,0 +1,70 @@ +From 9e10a19d51469b4ec52fb41f26b6dc7daca3b854 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 13:06:22 +0300 +Subject: spi: amd: Limit max transfer and message size + +From: Cristian Ciocaltea + +[ Upstream commit 6ece49c56965544262523dae4a071ace3db63507 ] + +Enabling the SPI CS35L41 audio codec driver for Steam Deck [1] +revealed a problem with the current AMD SPI controller driver +implementation, consisting of an unrecoverable system hang. + +The issue can be prevented if we ensure the max transfer size +and the max message size do not exceed the FIFO buffer size. + +According to the implementation of the downstream driver, the +AMD SPI controller is not able to handle more than 70 bytes per +transfer, which corresponds to the size of the FIFO buffer. + +Hence, let's fix this by setting the SPI limits mentioned above. + +[1] https://lore.kernel.org/r/20220621213819.262537-1-cristian.ciocaltea@collabora.com + +Reported-by: Anastasios Vacharakis +Fixes: bbb336f39efc ("spi: spi-amd: Add AMD SPI controller driver support") +Signed-off-by: Cristian Ciocaltea +Link: https://lore.kernel.org/r/20220706100626.1234731-2-cristian.ciocaltea@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-amd.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/spi/spi-amd.c b/drivers/spi/spi-amd.c +index 3cf76096a76d..39dbe9903da2 100644 +--- a/drivers/spi/spi-amd.c ++++ b/drivers/spi/spi-amd.c +@@ -28,6 +28,7 @@ + #define AMD_SPI_RX_COUNT_REG 0x4B + #define AMD_SPI_STATUS_REG 0x4C + ++#define AMD_SPI_FIFO_SIZE 70 + #define AMD_SPI_MEM_SIZE 200 + + /* M_CMD OP codes for SPI */ +@@ -245,6 +246,11 @@ static int amd_spi_master_transfer(struct spi_master *master, + return 0; + } + ++static size_t amd_spi_max_transfer_size(struct spi_device *spi) ++{ ++ return AMD_SPI_FIFO_SIZE; ++} ++ + static int amd_spi_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; +@@ -275,6 +281,8 @@ static int amd_spi_probe(struct platform_device *pdev) + master->flags = SPI_MASTER_HALF_DUPLEX; + master->setup = amd_spi_master_setup; + master->transfer_one_message = amd_spi_master_transfer; ++ master->max_transfer_size = amd_spi_max_transfer_size; ++ master->max_message_size = amd_spi_max_transfer_size; + + /* Register the controller with SPI framework */ + err = devm_spi_register_master(dev, master); +-- +2.35.1 + diff --git a/queue-5.15/sysctl-fix-data-races-in-proc_dointvec.patch b/queue-5.15/sysctl-fix-data-races-in-proc_dointvec.patch new file mode 100644 index 00000000000..759c1e3513f --- /dev/null +++ b/queue-5.15/sysctl-fix-data-races-in-proc_dointvec.patch @@ -0,0 +1,51 @@ +From a112cc9109ba66df22eb5d958ad361fab12f6278 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:39:52 -0700 +Subject: sysctl: Fix data races in proc_dointvec(). + +From: Kuniyuki Iwashima + +[ Upstream commit 1f1be04b4d48a2475ea1aab46a99221bfc5c0968 ] + +A sysctl variable is accessed concurrently, and there is always a chance +of data-race. So, all readers and writers need some basic protection to +avoid load/store-tearing. + +This patch changes proc_dointvec() to use READ_ONCE() and WRITE_ONCE() +internally to fix data-races on the sysctl side. For now, proc_dointvec() +itself is tolerant to a data-race, but we still need to add annotations on +the other subsystem's side. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 0586047f7323..11f0714273ab 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -566,14 +566,14 @@ static int do_proc_dointvec_conv(bool *negp, unsigned long *lvalp, + if (*negp) { + if (*lvalp > (unsigned long) INT_MAX + 1) + return -EINVAL; +- *valp = -*lvalp; ++ WRITE_ONCE(*valp, -*lvalp); + } else { + if (*lvalp > (unsigned long) INT_MAX) + return -EINVAL; +- *valp = *lvalp; ++ WRITE_ONCE(*valp, *lvalp); + } + } else { +- int val = *valp; ++ int val = READ_ONCE(*valp); + if (val < 0) { + *negp = true; + *lvalp = -(unsigned long)val; +-- +2.35.1 + diff --git a/queue-5.15/sysctl-fix-data-races-in-proc_dointvec_jiffies.patch b/queue-5.15/sysctl-fix-data-races-in-proc_dointvec_jiffies.patch new file mode 100644 index 00000000000..6064118f27c --- /dev/null +++ b/queue-5.15/sysctl-fix-data-races-in-proc_dointvec_jiffies.patch @@ -0,0 +1,48 @@ +From e9628c762808146caa9705fc12e2595434c26967 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:39:57 -0700 +Subject: sysctl: Fix data races in proc_dointvec_jiffies(). + +From: Kuniyuki Iwashima + +[ Upstream commit e877820877663fbae8cb9582ea597a7230b94df3 ] + +A sysctl variable is accessed concurrently, and there is always a chance +of data-race. So, all readers and writers need some basic protection to +avoid load/store-tearing. + +This patch changes proc_dointvec_jiffies() to use READ_ONCE() and +WRITE_ONCE() internally to fix data-races on the sysctl side. For now, +proc_dointvec_jiffies() itself is tolerant to a data-race, but we still +need to add annotations on the other subsystem's side. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 9a68da5e1551..5be8108a9a45 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -1364,9 +1364,12 @@ static int do_proc_dointvec_jiffies_conv(bool *negp, unsigned long *lvalp, + if (write) { + if (*lvalp > INT_MAX / HZ) + return 1; +- *valp = *negp ? -(*lvalp*HZ) : (*lvalp*HZ); ++ if (*negp) ++ WRITE_ONCE(*valp, -*lvalp * HZ); ++ else ++ WRITE_ONCE(*valp, *lvalp * HZ); + } else { +- int val = *valp; ++ int val = READ_ONCE(*valp); + unsigned long lval; + if (val < 0) { + *negp = true; +-- +2.35.1 + diff --git a/queue-5.15/sysctl-fix-data-races-in-proc_dointvec_minmax.patch b/queue-5.15/sysctl-fix-data-races-in-proc_dointvec_minmax.patch new file mode 100644 index 00000000000..a4893b2282d --- /dev/null +++ b/queue-5.15/sysctl-fix-data-races-in-proc_dointvec_minmax.patch @@ -0,0 +1,42 @@ +From 58599f2c6821a4bd093f7c9b3bd97d5d9b92fea9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:39:54 -0700 +Subject: sysctl: Fix data races in proc_dointvec_minmax(). + +From: Kuniyuki Iwashima + +[ Upstream commit f613d86d014b6375a4085901de39406598121e35 ] + +A sysctl variable is accessed concurrently, and there is always a chance +of data-race. So, all readers and writers need some basic protection to +avoid load/store-tearing. + +This patch changes proc_dointvec_minmax() to use READ_ONCE() and +WRITE_ONCE() internally to fix data-races on the sysctl side. For now, +proc_dointvec_minmax() itself is tolerant to a data-race, but we still +need to add annotations on the other subsystem's side. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index b152e0a30a2b..f5134435fb9c 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -988,7 +988,7 @@ static int do_proc_dointvec_minmax_conv(bool *negp, unsigned long *lvalp, + if ((param->min && *param->min > tmp) || + (param->max && *param->max < tmp)) + return -EINVAL; +- *valp = tmp; ++ WRITE_ONCE(*valp, tmp); + } + + return 0; +-- +2.35.1 + diff --git a/queue-5.15/sysctl-fix-data-races-in-proc_dointvec_ms_jiffies.patch b/queue-5.15/sysctl-fix-data-races-in-proc_dointvec_ms_jiffies.patch new file mode 100644 index 00000000000..8a98be4118a --- /dev/null +++ b/queue-5.15/sysctl-fix-data-races-in-proc_dointvec_ms_jiffies.patch @@ -0,0 +1,56 @@ +From 0f211f0964f0c5ff42b1a4dd9ec75cfa5ef1f41d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:20 -0700 +Subject: sysctl: Fix data-races in proc_dointvec_ms_jiffies(). + +From: Kuniyuki Iwashima + +[ Upstream commit 7d1025e559782b58824b36cb8ad547a69f2e4b31 ] + +A sysctl variable is accessed concurrently, and there is always a chance +of data-race. So, all readers and writers need some basic protection to +avoid load/store-tearing. + +This patch changes proc_dointvec_ms_jiffies() to use READ_ONCE() and +WRITE_ONCE() internally to fix data-races on the sysctl side. For now, +proc_dointvec_ms_jiffies() itself is tolerant to a data-race, but we still +need to add annotations on the other subsystem's side. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 357900d0cef9..79cbfd0fa3be 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -1415,9 +1415,9 @@ static int do_proc_dointvec_ms_jiffies_conv(bool *negp, unsigned long *lvalp, + + if (jif > INT_MAX) + return 1; +- *valp = (int)jif; ++ WRITE_ONCE(*valp, (int)jif); + } else { +- int val = *valp; ++ int val = READ_ONCE(*valp); + unsigned long lval; + if (val < 0) { + *negp = true; +@@ -1485,8 +1485,8 @@ int proc_dointvec_userhz_jiffies(struct ctl_table *table, int write, + * @ppos: the current position in the file + * + * Reads/writes up to table->maxlen/sizeof(unsigned int) integer +- * values from/to the user buffer, treated as an ASCII string. +- * The values read are assumed to be in 1/1000 seconds, and ++ * values from/to the user buffer, treated as an ASCII string. ++ * The values read are assumed to be in 1/1000 seconds, and + * are converted into jiffies. + * + * Returns 0 on success. +-- +2.35.1 + diff --git a/queue-5.15/sysctl-fix-data-races-in-proc_dou8vec_minmax.patch b/queue-5.15/sysctl-fix-data-races-in-proc_dou8vec_minmax.patch new file mode 100644 index 00000000000..0c2134f3425 --- /dev/null +++ b/queue-5.15/sysctl-fix-data-races-in-proc_dou8vec_minmax.patch @@ -0,0 +1,49 @@ +From cd2bef27ef743fa16e3dbd48ff9e83040a800739 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:19 -0700 +Subject: sysctl: Fix data-races in proc_dou8vec_minmax(). + +From: Kuniyuki Iwashima + +[ Upstream commit 7dee5d7747a69aa2be41f04c6a7ecfe3ac8cdf18 ] + +A sysctl variable is accessed concurrently, and there is always a chance +of data-race. So, all readers and writers need some basic protection to +avoid load/store-tearing. + +This patch changes proc_dou8vec_minmax() to use READ_ONCE() and +WRITE_ONCE() internally to fix data-races on the sysctl side. For now, +proc_dou8vec_minmax() itself is tolerant to a data-race, but we still +need to add annotations on the other subsystem's side. + +Fixes: cb9444130662 ("sysctl: add proc_dou8vec_minmax()") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 5be8108a9a45..357900d0cef9 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -1138,13 +1138,13 @@ int proc_dou8vec_minmax(struct ctl_table *table, int write, + + tmp.maxlen = sizeof(val); + tmp.data = &val; +- val = *data; ++ val = READ_ONCE(*data); + res = do_proc_douintvec(&tmp, write, buffer, lenp, ppos, + do_proc_douintvec_minmax_conv, ¶m); + if (res) + return res; + if (write) +- *data = val; ++ WRITE_ONCE(*data, val); + return 0; + } + EXPORT_SYMBOL_GPL(proc_dou8vec_minmax); +-- +2.35.1 + diff --git a/queue-5.15/sysctl-fix-data-races-in-proc_douintvec.patch b/queue-5.15/sysctl-fix-data-races-in-proc_douintvec.patch new file mode 100644 index 00000000000..8f04a1039a0 --- /dev/null +++ b/queue-5.15/sysctl-fix-data-races-in-proc_douintvec.patch @@ -0,0 +1,45 @@ +From 1081bdcac552d881afb803d05043a3382c9eaeaa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:39:53 -0700 +Subject: sysctl: Fix data races in proc_douintvec(). + +From: Kuniyuki Iwashima + +[ Upstream commit 4762b532ec9539755aab61445d5da6e1926ccb99 ] + +A sysctl variable is accessed concurrently, and there is always a chance +of data-race. So, all readers and writers need some basic protection to +avoid load/store-tearing. + +This patch changes proc_douintvec() to use READ_ONCE() and WRITE_ONCE() +internally to fix data-races on the sysctl side. For now, proc_douintvec() +itself is tolerant to a data-race, but we still need to add annotations on +the other subsystem's side. + +Fixes: e7d316a02f68 ("sysctl: handle error writing UINT_MAX to u32 fields") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 11f0714273ab..b152e0a30a2b 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -592,9 +592,9 @@ static int do_proc_douintvec_conv(unsigned long *lvalp, + if (write) { + if (*lvalp > UINT_MAX) + return -EINVAL; +- *valp = *lvalp; ++ WRITE_ONCE(*valp, *lvalp); + } else { +- unsigned int val = *valp; ++ unsigned int val = READ_ONCE(*valp); + *lvalp = (unsigned long)val; + } + return 0; +-- +2.35.1 + diff --git a/queue-5.15/sysctl-fix-data-races-in-proc_douintvec_minmax.patch b/queue-5.15/sysctl-fix-data-races-in-proc_douintvec_minmax.patch new file mode 100644 index 00000000000..6be290818f7 --- /dev/null +++ b/queue-5.15/sysctl-fix-data-races-in-proc_douintvec_minmax.patch @@ -0,0 +1,42 @@ +From 28f19a92db00eb327883fc9c53413f75d02ee85e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:39:55 -0700 +Subject: sysctl: Fix data races in proc_douintvec_minmax(). + +From: Kuniyuki Iwashima + +[ Upstream commit 2d3b559df3ed39258737789aae2ae7973d205bc1 ] + +A sysctl variable is accessed concurrently, and there is always a chance +of data-race. So, all readers and writers need some basic protection to +avoid load/store-tearing. + +This patch changes proc_douintvec_minmax() to use READ_ONCE() and +WRITE_ONCE() internally to fix data-races on the sysctl side. For now, +proc_douintvec_minmax() itself is tolerant to a data-race, but we still +need to add annotations on the other subsystem's side. + +Fixes: 61d9b56a8920 ("sysctl: add unsigned int range support") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index f5134435fb9c..bdb2f17b723f 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -1054,7 +1054,7 @@ static int do_proc_douintvec_minmax_conv(unsigned long *lvalp, + (param->max && *param->max < tmp)) + return -ERANGE; + +- *valp = tmp; ++ WRITE_ONCE(*valp, tmp); + } + + return 0; +-- +2.35.1 + diff --git a/queue-5.15/sysctl-fix-data-races-in-proc_doulongvec_minmax.patch b/queue-5.15/sysctl-fix-data-races-in-proc_doulongvec_minmax.patch new file mode 100644 index 00000000000..42fa54a64b8 --- /dev/null +++ b/queue-5.15/sysctl-fix-data-races-in-proc_doulongvec_minmax.patch @@ -0,0 +1,45 @@ +From 650c9babe5e6aaedd553118e77d27ef98927d02e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:39:56 -0700 +Subject: sysctl: Fix data races in proc_doulongvec_minmax(). + +From: Kuniyuki Iwashima + +[ Upstream commit c31bcc8fb89fc2812663900589c6325ba35d9a65 ] + +A sysctl variable is accessed concurrently, and there is always a chance +of data-race. So, all readers and writers need some basic protection to +avoid load/store-tearing. + +This patch changes proc_doulongvec_minmax() to use READ_ONCE() and +WRITE_ONCE() internally to fix data-races on the sysctl side. For now, +proc_doulongvec_minmax() itself is tolerant to a data-race, but we still +need to add annotations on the other subsystem's side. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index bdb2f17b723f..9a68da5e1551 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -1281,9 +1281,9 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, + err = -EINVAL; + break; + } +- *i = val; ++ WRITE_ONCE(*i, val); + } else { +- val = convdiv * (*i) / convmul; ++ val = convdiv * READ_ONCE(*i) / convmul; + if (!first) + proc_put_char(&buffer, &left, '\t'); + proc_put_long(&buffer, &left, val, false); +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_ecn_fallback.patch b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_ecn_fallback.patch new file mode 100644 index 00000000000..302203d7a1b --- /dev/null +++ b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_ecn_fallback.patch @@ -0,0 +1,50 @@ +From 321d480c91e92942f815bae7cb41496675a2b8e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:31 -0700 +Subject: tcp: Fix a data-race around sysctl_tcp_ecn_fallback. + +From: Kuniyuki Iwashima + +[ Upstream commit 12b8d9ca7e678abc48195294494f1815b555d658 ] + +While reading sysctl_tcp_ecn_fallback, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: 492135557dc0 ("tcp: add rfc3168, section 6.1.1.1. fallback") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/sysctl_net_ipv4.c | 2 ++ + net/ipv4/tcp_output.c | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c +index 49a8167dda87..616658e7c796 100644 +--- a/net/ipv4/sysctl_net_ipv4.c ++++ b/net/ipv4/sysctl_net_ipv4.c +@@ -696,6 +696,8 @@ static struct ctl_table ipv4_net_table[] = { + .maxlen = sizeof(u8), + .mode = 0644, + .proc_handler = proc_dou8vec_minmax, ++ .extra1 = SYSCTL_ZERO, ++ .extra2 = SYSCTL_ONE, + }, + { + .procname = "ip_dynaddr", +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index dc3b4668fcde..509aab1b7ac9 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -346,7 +346,7 @@ static void tcp_ecn_send_syn(struct sock *sk, struct sk_buff *skb) + + static void tcp_ecn_clear_syn(struct sock *sk, struct sk_buff *skb) + { +- if (sock_net(sk)->ipv4.sysctl_tcp_ecn_fallback) ++ if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_ecn_fallback)) + /* tp->ecn_flags are cleared at a later point in time when + * SYN ACK is ultimatively being received. + */ +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_max_orphans.patch b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_max_orphans.patch new file mode 100644 index 00000000000..4210ce15f9c --- /dev/null +++ b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_max_orphans.patch @@ -0,0 +1,37 @@ +From e9c3bb265aadcc2c0598ec287177d34a8e53211a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:39:58 -0700 +Subject: tcp: Fix a data-race around sysctl_tcp_max_orphans. + +From: Kuniyuki Iwashima + +[ Upstream commit 47e6ab24e8c6e3ca10ceb5835413f401f90de4bf ] + +While reading sysctl_tcp_max_orphans, it can be changed concurrently. +So, we need to add READ_ONCE() to avoid a data-race. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index f79b5a98888c..4ac53c8f0583 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2714,7 +2714,8 @@ static void tcp_orphan_update(struct timer_list *unused) + + static bool tcp_too_many_orphans(int shift) + { +- return READ_ONCE(tcp_orphan_cache) << shift > sysctl_tcp_max_orphans; ++ return READ_ONCE(tcp_orphan_cache) << shift > ++ READ_ONCE(sysctl_tcp_max_orphans); + } + + bool tcp_check_oom(struct sock *sk, int shift) +-- +2.35.1 + diff --git a/queue-5.15/tracing-fix-sleeping-while-atomic-in-kdb-ftdump.patch b/queue-5.15/tracing-fix-sleeping-while-atomic-in-kdb-ftdump.patch new file mode 100644 index 00000000000..647012bd1ba --- /dev/null +++ b/queue-5.15/tracing-fix-sleeping-while-atomic-in-kdb-ftdump.patch @@ -0,0 +1,71 @@ +From f1d2b27b67cffe2a7c38d6503179ad1800000043 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 17:09:52 -0700 +Subject: tracing: Fix sleeping while atomic in kdb ftdump + +From: Douglas Anderson + +[ Upstream commit 495fcec8648cdfb483b5b9ab310f3839f07cb3b8 ] + +If you drop into kdb and type "ftdump" you'll get a sleeping while +atomic warning from memory allocation in trace_find_next_entry(). + +This appears to have been caused by commit ff895103a84a ("tracing: +Save off entry when peeking at next entry"), which added the +allocation in that path. The problematic commit was already fixed by +commit 8e99cf91b99b ("tracing: Do not allocate buffer in +trace_find_next_entry() in atomic") but that fix missed the kdb case. + +The fix here is easy: just move the assignment of the static buffer to +the place where it should have been to begin with: +trace_init_global_iter(). That function is called in two places, once +is right before the assignment of the static buffer added by the +previous fix and once is in kdb. + +Note that it appears that there's a second static buffer that we need +to assign that was added in commit efbbdaa22bb7 ("tracing: Show real +address for trace event arguments"), so we'll move that too. + +Link: https://lkml.kernel.org/r/20220708170919.1.I75844e5038d9425add2ad853a608cb44bb39df40@changeid + +Fixes: ff895103a84a ("tracing: Save off entry when peeking at next entry") +Fixes: efbbdaa22bb7 ("tracing: Show real address for trace event arguments") +Signed-off-by: Douglas Anderson +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 518ce39a878d..f752f2574630 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -9831,6 +9831,12 @@ void trace_init_global_iter(struct trace_iterator *iter) + /* Output in nanoseconds only if we are using a clock in nanoseconds. */ + if (trace_clocks[iter->tr->clock_id].in_ns) + iter->iter_flags |= TRACE_FILE_TIME_IN_NS; ++ ++ /* Can not use kmalloc for iter.temp and iter.fmt */ ++ iter->temp = static_temp_buf; ++ iter->temp_size = STATIC_TEMP_BUF_SIZE; ++ iter->fmt = static_fmt_buf; ++ iter->fmt_size = STATIC_FMT_BUF_SIZE; + } + + void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) +@@ -9863,11 +9869,6 @@ void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) + + /* Simulate the iterator */ + trace_init_global_iter(&iter); +- /* Can not use kmalloc for iter.temp and iter.fmt */ +- iter.temp = static_temp_buf; +- iter.temp_size = STATIC_TEMP_BUF_SIZE; +- iter.fmt = static_fmt_buf; +- iter.fmt_size = STATIC_FMT_BUF_SIZE; + + for_each_tracing_cpu(cpu) { + atomic_inc(&per_cpu_ptr(iter.array_buffer->data, cpu)->disabled); +-- +2.35.1 + diff --git a/queue-5.15/xen-gntdev-ignore-failure-to-unmap-invalid_grant_han.patch b/queue-5.15/xen-gntdev-ignore-failure-to-unmap-invalid_grant_han.patch new file mode 100644 index 00000000000..6f38e3a7d8b --- /dev/null +++ b/queue-5.15/xen-gntdev-ignore-failure-to-unmap-invalid_grant_han.patch @@ -0,0 +1,58 @@ +From 38b434433e43fe506e5e45bb097f926c84085aa3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Jul 2022 19:05:22 -0400 +Subject: xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE + +From: Demi Marie Obenour + +[ Upstream commit 166d3863231667c4f64dee72b77d1102cdfad11f ] + +The error paths of gntdev_mmap() can call unmap_grant_pages() even +though not all of the pages have been successfully mapped. This will +trigger the WARN_ON()s in __unmap_grant_pages_done(). The number of +warnings can be very large; I have observed thousands of lines of +warnings in the systemd journal. + +Avoid this problem by only warning on unmapping failure if the handle +being unmapped is not INVALID_GRANT_HANDLE. The handle field of any +page that was not successfully mapped will be INVALID_GRANT_HANDLE, so +this catches all cases where unmapping can legitimately fail. + +Fixes: dbe97cff7dd9 ("xen/gntdev: Avoid blocking in unmap_grant_pages()") +Cc: stable@vger.kernel.org +Suggested-by: Juergen Gross +Signed-off-by: Demi Marie Obenour +Reviewed-by: Oleksandr Tyshchenko +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20220710230522.1563-1-demi@invisiblethingslab.com +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + drivers/xen/gntdev.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c +index 4b56c39f766d..84b143eef395 100644 +--- a/drivers/xen/gntdev.c ++++ b/drivers/xen/gntdev.c +@@ -396,13 +396,15 @@ static void __unmap_grant_pages_done(int result, + unsigned int offset = data->unmap_ops - map->unmap_ops; + + for (i = 0; i < data->count; i++) { +- WARN_ON(map->unmap_ops[offset+i].status); ++ WARN_ON(map->unmap_ops[offset + i].status != GNTST_okay && ++ map->unmap_ops[offset + i].handle != INVALID_GRANT_HANDLE); + pr_debug("unmap handle=%d st=%d\n", + map->unmap_ops[offset+i].handle, + map->unmap_ops[offset+i].status); + map->unmap_ops[offset+i].handle = INVALID_GRANT_HANDLE; + if (use_ptemod) { +- WARN_ON(map->kunmap_ops[offset+i].status); ++ WARN_ON(map->kunmap_ops[offset + i].status != GNTST_okay && ++ map->kunmap_ops[offset + i].handle != INVALID_GRANT_HANDLE); + pr_debug("kunmap handle=%u st=%d\n", + map->kunmap_ops[offset+i].handle, + map->kunmap_ops[offset+i].status); +-- +2.35.1 + -- 2.47.3