From 9570e5124c913e9f085e5a1662ae8fa9175a0fa2 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sat, 29 Jan 2022 22:40:45 -0500 Subject: [PATCH] Fixes for 5.16 Signed-off-by: Sasha Levin --- ...-when-kasan-and-kprobe-are-enabl.patch-490 | 119 ++++ ...a-null-pointer-dereference-in-.patch-13236 | 46 ++ ...-in-disk_register_independent_a.patch-1118 | 45 ++ ...x-regmap-fix-max-register-value.patch-2062 | 40 ++ ...-sessions-when-it-fails-to-allo.patch-1486 | 150 +++++ ...ount-for-vmbus-packet-header-i.patch-13116 | 58 ++ ...cs-dce_calcs-fix-a-memleak-in-.patch-32654 | 48 ++ ...issing-suspend_count-increment.patch-12892 | 36 ++ ...arameter-check-in-dpu_setup_dsp.patch-7879 | 54 ++ ...g-put_device-call-in-dsi_get_p.patch-32603 | 44 ++ ...rameter-check-in-msm_dsi_phy_e.patch-19238 | 52 ++ ...-msm-fix-wrong-size-calculation.patch-5782 | 46 ++ ...ng-put_device-call-in-msm_hdmi.patch-25966 | 47 ++ ...image-check-alignment-at-entry.patch-10252 | 49 ++ ...-extended-state-for-big-endian.patch-18835 | 42 ++ ...-gfp-flags-when-allocing-pages.patch-12328 | 97 +++ ...divide-by-zero-in-adt7470_fan_.patch-11929 | 39 ++ ...ix-sysfs-and-udev-notifications.patch-1586 | 56 ++ ...as-broken-for-max6646-6647-664.patch-25810 | 36 ++ ...ark-alert-as-broken-for-max6654.patch-7376 | 35 ++ ...ark-alert-as-broken-for-max6680.patch-6352 | 36 ++ ...-interrupts-after-alert-clears.patch-20612 | 41 ++ ...ximum-conversion-rate-for-g781.patch-12001 | 44 ++ ...75-fix-crash-in-clear_caseopen.patch-28716 | 90 +++ ...-to-init-adminq-while-vf-reset.patch-18848 | 129 ++++ ...hen-maximum-queues-is-exceeded.patch-11503 | 204 +++++++ ...-fix-queues-reservation-for-xdp.patch-4884 | 94 +++ .../i40e-fix-unsigned-stat-widths.patch-11673 | 79 +++ ...-to-1-s-after-global-emp-reset.patch-32655 | 52 ++ ...extra-failures-before-disabling.patch-5412 | 77 +++ .../ibmvnic-don-t-spin-in-tasklet.patch-21382 | 47 ++ ...nic-init-running_cap_crqs-early.patch-9731 | 327 ++++++++++ ...in-slow-unregistering-of-nodes.patch-12857 | 61 ++ ...ed-ip-generator-for-connected-s.patch-8646 | 70 +++ ...tering-for-locally-generated-f.patch-20660 | 111 ++++ ...aw-lock-the-socket-in-raw_bind.patch-29357 | 78 +++ ...e-sparse-error-in-ip_neigh_gw4.patch-21843 | 39 ++ ...nd-zero-ipid-in-synack-messages.patch-9420 | 77 +++ ...otate-accesses-to-fn-fn_sernum.patch-15640 | 197 ++++++ ...el-rate-limit-warning-messages.patch-22703 | 51 ++ ...-mm_ops-indirection-for-cache-.patch-28328 | 67 ++ ...kip-l2-s-vmcall-in-smm-test-for.patch-6280 | 45 ++ ...able-access_tracking_perf_test.patch-24698 | 36 ++ ...-the-backup-bit-by-endpoint-id.patch-27797 | 61 ++ ...-up-harmless-false-expressions.patch-23285 | 60 ++ ...ersal-in-mptcp_nl_cmd_set_flags.patch-4074 | 85 +++ ...fix-removing-ids-bitmap-setting.patch-8263 | 38 ++ ...cal-endpoint-still-available-f.patch-10692 | 404 ++++++++++++ ...mory-leak-in-__allowed_ingress.patch-11369 | 47 ++ ...ngle-net-device-option-dumping.patch-17660 | 42 ++ ...tialise-struct-page_pool_params.patch-1670 | 48 ++ ...tion-leakage-in-proc-net-ptype.patch-29118 | 78 +++ ...empty-unknown-interrupt-for-vf.patch-12360 | 41 ++ ...ook-up-soft_reset-for-bcm54616s.patch-8413 | 61 ++ ...net-devices-bound-packet-types.patch-19867 | 117 ++++ ...solution-for-clcsock-race-issue.patch-3308 | 201 ++++++ ...nti-fix-bit-definitions-for-et.patch-15977 | 60 ++ ...nti-fix-clock-configuration-fo.patch-10364 | 81 +++ ...n-t-increment-invalid-counter-.patch-26784 | 51 ++ ...has-an-up-to-date-ctime-before.patch-13548 | 37 ++ ...has-an-up-to-date-ctime-before.patch-14919 | 37 ++ ...e-the-lookup-of-a-directory-fa.patch-32762 | 52 ++ ...n-can-race-when-looking-up-a-non.patch-311 | 45 ++ ...hanges-to-parse-ngio-as-separa.patch-20656 | 171 ++++++ ...-not-enable-rpm-loopback-for-lp.patch-3928 | 65 ++ ...e-appropriate-register-for-lmac.patch-4264 | 224 +++++++ ...ot-fixup-all-vf-action-entries.patch-25054 | 131 ++++ ...-fix-lbk-backpressure-id-count.patch-21119 | 44 ++ ...link-credit-restore-polling-ti.patch-12708 | 55 ++ ...until-rvu-block-reset-complete.patch-12707 | 43 ++ ...sure-valid-pointers-are-freed-t.patch-5484 | 54 ++ ...x2-pf-forward-error-codes-to-vf.patch-3356 | 48 ++ ...-fix-perf_event_read_local-time.patch-6284 | 575 ++++++++++++++++++ ...ib-fix-potential-use-after-free.patch-4894 | 58 ++ ...nd_dev_if-match-in-ping_lookup.patch-12227 | 51 ++ ...before-checking-against-the-ma.patch-26130 | 59 ++ ..._pmu_disable-to-call-clear_pmi.patch-12087 | 95 +++ ...brx-to-processors-compliant-wi.patch-17391 | 104 ++++ ...ix-service-routines-build-erro.patch-12912 | 99 +++ ...port-1600x900-with-108mhz-pclk.patch-18660 | 38 ++ ...ipv6-pio-valid-lifetime-values.patch-25170 | 96 +++ ...between-the-release-of-rpmsg_ctr.patch-551 | 117 ++++ ...etween-the-release-of-rpmsg_ept.patch-8103 | 76 +++ ...c-adjust-retransmission-backoff.patch-4735 | 93 +++ ...orted-parameters-when-offload-.patch-24755 | 67 ++ ...e-sync-of-util_sum-with-util_avg.patch-619 | 105 ++++ ...troy_work-queue-before-calling-.patch-6652 | 152 +++++ ...use-gfp_kernel-under-spin-lock.patch-21203 | 71 +++ ...ts-mptcp-fix-ipv6-routing-setup.patch-4298 | 60 ++ queue-5.16/series | 186 ++++++ ...nce-xprt-snd_task-if-it-s-a-coo.patch-4302 | 63 ++ ...e-linux-usb-role.h-compile-issue.patch-783 | 41 ++ ...validation-of-screen-resolution.patch-6696 | 99 +++ ...ory-leak-in-yam_siocdevprivate.patch-12557 | 37 ++ 94 files changed, 8014 insertions(+) create mode 100644 queue-5.16/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabl.patch-490 create mode 100644 queue-5.16/ata-pata_platform-fix-a-null-pointer-dereference-in-.patch-13236 create mode 100644 queue-5.16/block-fix-memory-leak-in-disk_register_independent_a.patch-1118 create mode 100644 queue-5.16/can-tcan4x5x-regmap-fix-max-register-value.patch-2062 create mode 100644 queue-5.16/ceph-put-the-requests-sessions-when-it-fails-to-allo.patch-1486 create mode 100644 queue-5.16/drivers-hv-balloon-account-for-vmbus-packet-header-i.patch-13116 create mode 100644 queue-5.16/drm-amd-display-dc-calcs-dce_calcs-fix-a-memleak-in-.patch-32654 create mode 100644 queue-5.16/drm-msm-a6xx-add-missing-suspend_count-increment.patch-12892 create mode 100644 queue-5.16/drm-msm-dpu-invalid-parameter-check-in-dpu_setup_dsp.patch-7879 create mode 100644 queue-5.16/drm-msm-dsi-fix-missing-put_device-call-in-dsi_get_p.patch-32603 create mode 100644 queue-5.16/drm-msm-dsi-invalid-parameter-check-in-msm_dsi_phy_e.patch-19238 create mode 100644 queue-5.16/drm-msm-fix-wrong-size-calculation.patch-5782 create mode 100644 queue-5.16/drm-msm-hdmi-fix-missing-put_device-call-in-msm_hdmi.patch-25966 create mode 100644 queue-5.16/efi-libstub-arm64-fix-image-check-alignment-at-entry.patch-10252 create mode 100644 queue-5.16/ethtool-fix-link-extended-state-for-big-endian.patch-18835 create mode 100644 queue-5.16/gve-fix-gfp-flags-when-allocing-pages.patch-12328 create mode 100644 queue-5.16/hwmon-adt7470-prevent-divide-by-zero-in-adt7470_fan_.patch-11929 create mode 100644 queue-5.16/hwmon-lm90-fix-sysfs-and-udev-notifications.patch-1586 create mode 100644 queue-5.16/hwmon-lm90-mark-alert-as-broken-for-max6646-6647-664.patch-25810 create mode 100644 queue-5.16/hwmon-lm90-mark-alert-as-broken-for-max6654.patch-7376 create mode 100644 queue-5.16/hwmon-lm90-mark-alert-as-broken-for-max6680.patch-6352 create mode 100644 queue-5.16/hwmon-lm90-re-enable-interrupts-after-alert-clears.patch-20612 create mode 100644 queue-5.16/hwmon-lm90-reduce-maximum-conversion-rate-for-g781.patch-12001 create mode 100644 queue-5.16/hwmon-nct6775-fix-crash-in-clear_caseopen.patch-28716 create mode 100644 queue-5.16/i40e-fix-for-failed-to-init-adminq-while-vf-reset.patch-18848 create mode 100644 queue-5.16/i40e-fix-issue-when-maximum-queues-is-exceeded.patch-11503 create mode 100644 queue-5.16/i40e-fix-queues-reservation-for-xdp.patch-4884 create mode 100644 queue-5.16/i40e-fix-unsigned-stat-widths.patch-11673 create mode 100644 queue-5.16/i40e-increase-delay-to-1-s-after-global-emp-reset.patch-32655 create mode 100644 queue-5.16/ibmvnic-allow-extra-failures-before-disabling.patch-5412 create mode 100644 queue-5.16/ibmvnic-don-t-spin-in-tasklet.patch-21382 create mode 100644 queue-5.16/ibmvnic-init-running_cap_crqs-early.patch-9731 create mode 100644 queue-5.16/io_uring-fix-bug-in-slow-unregistering-of-nodes.patch-12857 create mode 100644 queue-5.16/ipv4-avoid-using-shared-ip-generator-for-connected-s.patch-8646 create mode 100644 queue-5.16/ipv4-fix-ip-option-filtering-for-locally-generated-f.patch-20660 create mode 100644 queue-5.16/ipv4-raw-lock-the-socket-in-raw_bind.patch-29357 create mode 100644 queue-5.16/ipv4-remove-sparse-error-in-ip_neigh_gw4.patch-21843 create mode 100644 queue-5.16/ipv4-tcp-send-zero-ipid-in-synack-messages.patch-9420 create mode 100644 queue-5.16/ipv6-annotate-accesses-to-fn-fn_sernum.patch-15640 create mode 100644 queue-5.16/ipv6_tunnel-rate-limit-warning-messages.patch-22703 create mode 100644 queue-5.16/kvm-arm64-pkvm-use-the-mm_ops-indirection-for-cache-.patch-28328 create mode 100644 queue-5.16/kvm-selftests-don-t-skip-l2-s-vmcall-in-smm-test-for.patch-6280 create mode 100644 queue-5.16/kvm-selftests-re-enable-access_tracking_perf_test.patch-24698 create mode 100644 queue-5.16/mptcp-allow-changing-the-backup-bit-by-endpoint-id.patch-27797 create mode 100644 queue-5.16/mptcp-clean-up-harmless-false-expressions.patch-23285 create mode 100644 queue-5.16/mptcp-fix-msk-traversal-in-mptcp_nl_cmd_set_flags.patch-4074 create mode 100644 queue-5.16/mptcp-fix-removing-ids-bitmap-setting.patch-8263 create mode 100644 queue-5.16/mptcp-keep-track-of-local-endpoint-still-available-f.patch-10692 create mode 100644 queue-5.16/net-bridge-vlan-fix-memory-leak-in-__allowed_ingress.patch-11369 create mode 100644 queue-5.16/net-bridge-vlan-fix-single-net-device-option-dumping.patch-17660 create mode 100644 queue-5.16/net-cpsw-properly-initialise-struct-page_pool_params.patch-1670 create mode 100644 queue-5.16/net-fix-information-leakage-in-proc-net-ptype.patch-29118 create mode 100644 queue-5.16/net-hns3-handle-empty-unknown-interrupt-for-vf.patch-12360 create mode 100644 queue-5.16/net-phy-broadcom-hook-up-soft_reset-for-bcm54616s.patch-8413 create mode 100644 queue-5.16/net-procfs-show-net-devices-bound-packet-types.patch-19867 create mode 100644 queue-5.16/net-smc-transitional-solution-for-clcsock-race-issue.patch-3308 create mode 100644 queue-5.16/net-stmmac-dwmac-visconti-fix-bit-definitions-for-et.patch-15977 create mode 100644 queue-5.16/net-stmmac-dwmac-visconti-fix-clock-configuration-fo.patch-10364 create mode 100644 queue-5.16/netfilter-conntrack-don-t-increment-invalid-counter-.patch-26784 create mode 100644 queue-5.16/nfs-ensure-the-server-has-an-up-to-date-ctime-before.patch-13548 create mode 100644 queue-5.16/nfs-ensure-the-server-has-an-up-to-date-ctime-before.patch-14919 create mode 100644 queue-5.16/nfsv4-handle-case-where-the-lookup-of-a-directory-fa.patch-32762 create mode 100644 queue-5.16/nfsv4-nfs_atomic_open-can-race-when-looking-up-a-non.patch-311 create mode 100644 queue-5.16/octeontx2-af-add-kpu-changes-to-parse-ngio-as-separa.patch-20656 create mode 100644 queue-5.16/octeontx2-af-cn10k-do-not-enable-rpm-loopback-for-lp.patch-3928 create mode 100644 queue-5.16/octeontx2-af-cn10k-use-appropriate-register-for-lmac.patch-4264 create mode 100644 queue-5.16/octeontx2-af-do-not-fixup-all-vf-action-entries.patch-25054 create mode 100644 queue-5.16/octeontx2-af-fix-lbk-backpressure-id-count.patch-21119 create mode 100644 queue-5.16/octeontx2-af-increase-link-credit-restore-polling-ti.patch-12708 create mode 100644 queue-5.16/octeontx2-af-retry-until-rvu-block-reset-complete.patch-12707 create mode 100644 queue-5.16/octeontx2-pf-cn10k-ensure-valid-pointers-are-freed-t.patch-5484 create mode 100644 queue-5.16/octeontx2-pf-forward-error-codes-to-vf.patch-3356 create mode 100644 queue-5.16/perf-fix-perf_event_read_local-time.patch-6284 create mode 100644 queue-5.16/phylib-fix-potential-use-after-free.patch-4894 create mode 100644 queue-5.16/ping-fix-the-sk_bound_dev_if-match-in-ping_lookup.patch-12227 create mode 100644 queue-5.16/powerpc-64s-mask-srr0-before-checking-against-the-ma.patch-26130 create mode 100644 queue-5.16/powerpc-perf-fix-power_pmu_disable-to-call-clear_pmi.patch-12087 create mode 100644 queue-5.16/powerpc64-bpf-limit-ldbrx-to-processors-compliant-wi.patch-17391 create mode 100644 queue-5.16/remoteproc-qcom-q6v5-fix-service-routines-build-erro.patch-12912 create mode 100644 queue-5.16/revert-drm-ast-support-1600x900-with-108mhz-pclk.patch-18660 create mode 100644 queue-5.16/revert-ipv6-honor-all-ipv6-pio-valid-lifetime-values.patch-25170 create mode 100644 queue-5.16/rpmsg-char-fix-race-between-the-release-of-rpmsg_ctr.patch-551 create mode 100644 queue-5.16/rpmsg-char-fix-race-between-the-release-of-rpmsg_ept.patch-8103 create mode 100644 queue-5.16/rxrpc-adjust-retransmission-backoff.patch-4735 create mode 100644 queue-5.16/sch_htb-fail-on-unsupported-parameters-when-offload-.patch-24755 create mode 100644 queue-5.16/sched-pelt-relax-the-sync-of-util_sum-with-util_avg.patch-619 create mode 100644 queue-5.16/scsi-bnx2fc-flush-destroy_work-queue-before-calling-.patch-6652 create mode 100644 queue-5.16/scsi-elx-efct-don-t-use-gfp_kernel-under-spin-lock.patch-21203 create mode 100644 queue-5.16/selftests-mptcp-fix-ipv6-routing-setup.patch-4298 create mode 100644 queue-5.16/sunrpc-don-t-dereference-xprt-snd_task-if-it-s-a-coo.patch-4302 create mode 100644 queue-5.16/usb-roles-fix-include-linux-usb-role.h-compile-issue.patch-783 create mode 100644 queue-5.16/video-hyperv_fb-fix-validation-of-screen-resolution.patch-6696 create mode 100644 queue-5.16/yam-fix-a-memory-leak-in-yam_siocdevprivate.patch-12557 diff --git a/queue-5.16/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabl.patch-490 b/queue-5.16/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabl.patch-490 new file mode 100644 index 00000000000..9e91e611ec8 --- /dev/null +++ b/queue-5.16/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabl.patch-490 @@ -0,0 +1,119 @@ +From 1c0fab55a85a329dc4989b6c84312bd053d71840 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Dec 2021 10:08:23 +0100 +Subject: ARM: 9170/1: fix panic when kasan and kprobe are enabled + +From: sparkhuang + +[ Upstream commit 8b59b0a53c840921b625378f137e88adfa87647e ] + +arm32 uses software to simulate the instruction replaced +by kprobe. some instructions may be simulated by constructing +assembly functions. therefore, before executing instruction +simulation, it is necessary to construct assembly function +execution environment in C language through binding registers. +after kasan is enabled, the register binding relationship will +be destroyed, resulting in instruction simulation errors and +causing kernel panic. + +the kprobe emulate instruction function is distributed in three +files: actions-common.c actions-arm.c actions-thumb.c, so disable +KASAN when compiling these files. + +for example, use kprobe insert on cap_capable+20 after kasan +enabled, the cap_capable assembly code is as follows: +: +e92d47f0 push {r4, r5, r6, r7, r8, r9, sl, lr} +e1a05000 mov r5, r0 +e280006c add r0, r0, #108 ; 0x6c +e1a04001 mov r4, r1 +e1a06002 mov r6, r2 +e59fa090 ldr sl, [pc, #144] ; +ebfc7bf8 bl c03aa4b4 <__asan_load4> +e595706c ldr r7, [r5, #108] ; 0x6c +e2859014 add r9, r5, #20 +...... +The emulate_ldr assembly code after enabling kasan is as follows: +c06f1384 : +e92d47f0 push {r4, r5, r6, r7, r8, r9, sl, lr} +e282803c add r8, r2, #60 ; 0x3c +e1a05000 mov r5, r0 +e7e37855 ubfx r7, r5, #16, #4 +e1a00008 mov r0, r8 +e1a09001 mov r9, r1 +e1a04002 mov r4, r2 +ebf35462 bl c03c6530 <__asan_load4> +e357000f cmp r7, #15 +e7e36655 ubfx r6, r5, #12, #4 +e205a00f and sl, r5, #15 +0a000001 beq c06f13bc +e0840107 add r0, r4, r7, lsl #2 +ebf3545c bl c03c6530 <__asan_load4> +e084010a add r0, r4, sl, lsl #2 +ebf3545a bl c03c6530 <__asan_load4> +e2890010 add r0, r9, #16 +ebf35458 bl c03c6530 <__asan_load4> +e5990010 ldr r0, [r9, #16] +e12fff30 blx r0 +e356000f cm r6, #15 +1a000014 bne c06f1430 +e1a06000 mov r6, r0 +e2840040 add r0, r4, #64 ; 0x40 +...... + +when running in emulate_ldr to simulate the ldr instruction, panic +occurred, and the log is as follows: +Unable to handle kernel NULL pointer dereference at virtual address +00000090 +pgd = ecb46400 +[00000090] *pgd=2e0fa003, *pmd=00000000 +Internal error: Oops: 206 [#1] SMP ARM +PC is at cap_capable+0x14/0xb0 +LR is at emulate_ldr+0x50/0xc0 +psr: 600d0293 sp : ecd63af8 ip : 00000004 fp : c0a7c30c +r10: 00000000 r9 : c30897f4 r8 : ecd63cd4 +r7 : 0000000f r6 : 0000000a r5 : e59fa090 r4 : ecd63c98 +r3 : c06ae294 r2 : 00000000 r1 : b7611300 r0 : bf4ec008 +Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user +Control: 32c5387d Table: 2d546400 DAC: 55555555 +Process bash (pid: 1643, stack limit = 0xecd60190) +(cap_capable) from (kprobe_handler+0x218/0x340) +(kprobe_handler) from (kprobe_trap_handler+0x24/0x48) +(kprobe_trap_handler) from (do_undefinstr+0x13c/0x364) +(do_undefinstr) from (__und_svc_finish+0x0/0x30) +(__und_svc_finish) from (cap_capable+0x18/0xb0) +(cap_capable) from (cap_vm_enough_memory+0x38/0x48) +(cap_vm_enough_memory) from +(security_vm_enough_memory_mm+0x48/0x6c) +(security_vm_enough_memory_mm) from +(copy_process.constprop.5+0x16b4/0x25c8) +(copy_process.constprop.5) from (_do_fork+0xe8/0x55c) +(_do_fork) from (SyS_clone+0x1c/0x24) +(SyS_clone) from (__sys_trace_return+0x0/0x10) +Code: 0050a0e1 6c0080e2 0140a0e1 0260a0e1 (f801f0e7) + +Fixes: 35aa1df43283 ("ARM kprobes: instruction single-stepping support") +Fixes: 421015713b30 ("ARM: 9017/2: Enable KASan for ARM") +Signed-off-by: huangshaobo +Acked-by: Ard Biesheuvel +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/probes/kprobes/Makefile | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm/probes/kprobes/Makefile b/arch/arm/probes/kprobes/Makefile +index 14db56f49f0a3..6159010dac4a6 100644 +--- a/arch/arm/probes/kprobes/Makefile ++++ b/arch/arm/probes/kprobes/Makefile +@@ -1,4 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 ++KASAN_SANITIZE_actions-common.o := n ++KASAN_SANITIZE_actions-arm.o := n ++KASAN_SANITIZE_actions-thumb.o := n + obj-$(CONFIG_KPROBES) += core.o actions-common.o checkers-common.o + obj-$(CONFIG_ARM_KPROBES_TEST) += test-kprobes.o + test-kprobes-objs := test-core.o +-- +2.34.1 + diff --git a/queue-5.16/ata-pata_platform-fix-a-null-pointer-dereference-in-.patch-13236 b/queue-5.16/ata-pata_platform-fix-a-null-pointer-dereference-in-.patch-13236 new file mode 100644 index 00000000000..ad82aca3395 --- /dev/null +++ b/queue-5.16/ata-pata_platform-fix-a-null-pointer-dereference-in-.patch-13236 @@ -0,0 +1,46 @@ +From 9e7e3168a4cd14d88b3d494103fc65e4f8ff0067 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jan 2022 00:45:25 +0800 +Subject: ata: pata_platform: Fix a NULL pointer dereference in + __pata_platform_probe() + +From: Zhou Qingyang + +[ Upstream commit 9b6d90e2085ca2ce72ef9ea78658bf270855e62e ] + +In __pata_platform_probe(), devm_kzalloc() is assigned to ap->ops and +there is a dereference of it right after that, which could introduce a +NULL pointer dereference bug. + +Fix this by adding a NULL check of ap->ops. + +This bug was found by a static analyzer. + +Builds with 'make allyesconfig' show no new warnings, +and our static analyzer no longer warns about this code. + +Fixes: f3d5e4f18dba ("ata: pata_of_platform: Allow to use 16-bit wide data transfer") +Signed-off-by: Zhou Qingyang +Signed-off-by: Damien Le Moal +Reviewed-by: Sergey Shtylyov +Signed-off-by: Sasha Levin +--- + drivers/ata/pata_platform.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/ata/pata_platform.c b/drivers/ata/pata_platform.c +index 028329428b75d..87c7c90676ca0 100644 +--- a/drivers/ata/pata_platform.c ++++ b/drivers/ata/pata_platform.c +@@ -128,6 +128,8 @@ int __pata_platform_probe(struct device *dev, struct resource *io_res, + ap = host->ports[0]; + + ap->ops = devm_kzalloc(dev, sizeof(*ap->ops), GFP_KERNEL); ++ if (!ap->ops) ++ return -ENOMEM; + ap->ops->inherits = &ata_sff_port_ops; + ap->ops->cable_detect = ata_cable_unknown; + ap->ops->set_mode = pata_platform_set_mode; +-- +2.34.1 + diff --git a/queue-5.16/block-fix-memory-leak-in-disk_register_independent_a.patch-1118 b/queue-5.16/block-fix-memory-leak-in-disk_register_independent_a.patch-1118 new file mode 100644 index 00000000000..e2613142bdb --- /dev/null +++ b/queue-5.16/block-fix-memory-leak-in-disk_register_independent_a.patch-1118 @@ -0,0 +1,45 @@ +From 6408242ab22060be309736195f5996dc53d4153a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jan 2022 10:10:25 +0000 +Subject: block: fix memory leak in disk_register_independent_access_ranges + +From: Miaoqian Lin + +[ Upstream commit 83114df32ae779df57e0af99a8ba6c3968b2ba3d ] + +kobject_init_and_add() takes reference even when it fails. +According to the doc of kobject_init_and_add() + + If this function returns an error, kobject_put() must be called to + properly clean up the memory associated with the object. + +Fix this issue by adding kobject_put(). +Callback function blk_ia_ranges_sysfs_release() in kobject_put() +can handle the pointer "iars" properly. + +Fixes: a2247f19ee1c ("block: Add independent access ranges support") +Signed-off-by: Miaoqian Lin +Reviewed-by: Damien Le Moal +Link: https://lore.kernel.org/r/20220120101025.22411-1-linmq006@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-ia-ranges.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/block/blk-ia-ranges.c b/block/blk-ia-ranges.c +index b925f3db3ab7a..18c68d8b9138e 100644 +--- a/block/blk-ia-ranges.c ++++ b/block/blk-ia-ranges.c +@@ -144,7 +144,7 @@ int disk_register_independent_access_ranges(struct gendisk *disk, + &q->kobj, "%s", "independent_access_ranges"); + if (ret) { + q->ia_ranges = NULL; +- kfree(iars); ++ kobject_put(&iars->kobj); + return ret; + } + +-- +2.34.1 + diff --git a/queue-5.16/can-tcan4x5x-regmap-fix-max-register-value.patch-2062 b/queue-5.16/can-tcan4x5x-regmap-fix-max-register-value.patch-2062 new file mode 100644 index 00000000000..40e4377b3d6 --- /dev/null +++ b/queue-5.16/can-tcan4x5x-regmap-fix-max-register-value.patch-2062 @@ -0,0 +1,40 @@ +From 83cce9624764d3b1345263f97535c870bfe0b46b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jan 2022 18:50:54 +0100 +Subject: can: tcan4x5x: regmap: fix max register value + +From: Marc Kleine-Budde + +[ Upstream commit e59986de5ff701494e14c722b78b6e6d513e0ab5 ] + +The MRAM of the tcan4x5x has a size of 2K and starts at 0x8000. There +are no further registers in the tcan4x5x making 0x87fc the biggest +addressable register. + +This patch fixes the max register value of the regmap config from +0x8ffc to 0x87fc. + +Fixes: 6e1caaf8ed22 ("can: tcan4x5x: fix max register value") +Link: https://lore.kernel.org/all/20220119064011.2943292-1-mkl@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/tcan4x5x-regmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/m_can/tcan4x5x-regmap.c b/drivers/net/can/m_can/tcan4x5x-regmap.c +index ca80dbaf7a3f5..26e212b8ca7a6 100644 +--- a/drivers/net/can/m_can/tcan4x5x-regmap.c ++++ b/drivers/net/can/m_can/tcan4x5x-regmap.c +@@ -12,7 +12,7 @@ + #define TCAN4X5X_SPI_INSTRUCTION_WRITE (0x61 << 24) + #define TCAN4X5X_SPI_INSTRUCTION_READ (0x41 << 24) + +-#define TCAN4X5X_MAX_REGISTER 0x8ffc ++#define TCAN4X5X_MAX_REGISTER 0x87fc + + static int tcan4x5x_regmap_gather_write(void *context, + const void *reg, size_t reg_len, +-- +2.34.1 + diff --git a/queue-5.16/ceph-put-the-requests-sessions-when-it-fails-to-allo.patch-1486 b/queue-5.16/ceph-put-the-requests-sessions-when-it-fails-to-allo.patch-1486 new file mode 100644 index 00000000000..b7eb9f49e7d --- /dev/null +++ b/queue-5.16/ceph-put-the-requests-sessions-when-it-fails-to-allo.patch-1486 @@ -0,0 +1,150 @@ +From bf4089cf9195d6ba4e37a8b739ead4b8c2f60d07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jan 2022 12:29:04 +0800 +Subject: ceph: put the requests/sessions when it fails to alloc memory + +From: Xiubo Li + +[ Upstream commit 89d43d0551a848e70e63d9ba11534aaeabc82443 ] + +When failing to allocate the sessions memory we should make sure +the req1 and req2 and the sessions get put. And also in case the +max_sessions decreased so when kreallocate the new memory some +sessions maybe missed being put. + +And if the max_sessions is 0 krealloc will return ZERO_SIZE_PTR, +which will lead to a distinct access fault. + +URL: https://tracker.ceph.com/issues/53819 +Fixes: e1a4541ec0b9 ("ceph: flush the mdlog before waiting on unsafe reqs") +Signed-off-by: Xiubo Li +Reviewed-by: Venky Shankar +Reviewed-by: Jeff Layton +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/caps.c | 55 +++++++++++++++++++++++++++++++++----------------- + 1 file changed, 37 insertions(+), 18 deletions(-) + +diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c +index c447fa2e2d1fe..2f8696f3b925d 100644 +--- a/fs/ceph/caps.c ++++ b/fs/ceph/caps.c +@@ -2218,6 +2218,7 @@ static int unsafe_request_wait(struct inode *inode) + struct ceph_mds_client *mdsc = ceph_sb_to_client(inode->i_sb)->mdsc; + struct ceph_inode_info *ci = ceph_inode(inode); + struct ceph_mds_request *req1 = NULL, *req2 = NULL; ++ unsigned int max_sessions; + int ret, err = 0; + + spin_lock(&ci->i_unsafe_lock); +@@ -2235,37 +2236,45 @@ static int unsafe_request_wait(struct inode *inode) + } + spin_unlock(&ci->i_unsafe_lock); + ++ /* ++ * The mdsc->max_sessions is unlikely to be changed ++ * mostly, here we will retry it by reallocating the ++ * sessions array memory to get rid of the mdsc->mutex ++ * lock. ++ */ ++retry: ++ max_sessions = mdsc->max_sessions; ++ + /* + * Trigger to flush the journal logs in all the relevant MDSes + * manually, or in the worst case we must wait at most 5 seconds + * to wait the journal logs to be flushed by the MDSes periodically. + */ +- if (req1 || req2) { ++ if ((req1 || req2) && likely(max_sessions)) { + struct ceph_mds_session **sessions = NULL; + struct ceph_mds_session *s; + struct ceph_mds_request *req; +- unsigned int max; + int i; + +- /* +- * The mdsc->max_sessions is unlikely to be changed +- * mostly, here we will retry it by reallocating the +- * sessions arrary memory to get rid of the mdsc->mutex +- * lock. +- */ +-retry: +- max = mdsc->max_sessions; +- sessions = krealloc(sessions, max * sizeof(s), __GFP_ZERO); +- if (!sessions) +- return -ENOMEM; ++ sessions = kzalloc(max_sessions * sizeof(s), GFP_KERNEL); ++ if (!sessions) { ++ err = -ENOMEM; ++ goto out; ++ } + + spin_lock(&ci->i_unsafe_lock); + if (req1) { + list_for_each_entry(req, &ci->i_unsafe_dirops, + r_unsafe_dir_item) { + s = req->r_session; +- if (unlikely(s->s_mds >= max)) { ++ if (unlikely(s->s_mds >= max_sessions)) { + spin_unlock(&ci->i_unsafe_lock); ++ for (i = 0; i < max_sessions; i++) { ++ s = sessions[i]; ++ if (s) ++ ceph_put_mds_session(s); ++ } ++ kfree(sessions); + goto retry; + } + if (!sessions[s->s_mds]) { +@@ -2278,8 +2287,14 @@ retry: + list_for_each_entry(req, &ci->i_unsafe_iops, + r_unsafe_target_item) { + s = req->r_session; +- if (unlikely(s->s_mds >= max)) { ++ if (unlikely(s->s_mds >= max_sessions)) { + spin_unlock(&ci->i_unsafe_lock); ++ for (i = 0; i < max_sessions; i++) { ++ s = sessions[i]; ++ if (s) ++ ceph_put_mds_session(s); ++ } ++ kfree(sessions); + goto retry; + } + if (!sessions[s->s_mds]) { +@@ -2300,7 +2315,7 @@ retry: + spin_unlock(&ci->i_ceph_lock); + + /* send flush mdlog request to MDSes */ +- for (i = 0; i < max; i++) { ++ for (i = 0; i < max_sessions; i++) { + s = sessions[i]; + if (s) { + send_flush_mdlog(s); +@@ -2317,15 +2332,19 @@ retry: + ceph_timeout_jiffies(req1->r_timeout)); + if (ret) + err = -EIO; +- ceph_mdsc_put_request(req1); + } + if (req2) { + ret = !wait_for_completion_timeout(&req2->r_safe_completion, + ceph_timeout_jiffies(req2->r_timeout)); + if (ret) + err = -EIO; +- ceph_mdsc_put_request(req2); + } ++ ++out: ++ if (req1) ++ ceph_mdsc_put_request(req1); ++ if (req2) ++ ceph_mdsc_put_request(req2); + return err; + } + +-- +2.34.1 + diff --git a/queue-5.16/drivers-hv-balloon-account-for-vmbus-packet-header-i.patch-13116 b/queue-5.16/drivers-hv-balloon-account-for-vmbus-packet-header-i.patch-13116 new file mode 100644 index 00000000000..8ec16b1a38b --- /dev/null +++ b/queue-5.16/drivers-hv-balloon-account-for-vmbus-packet-header-i.patch-13116 @@ -0,0 +1,58 @@ +From fbdf9350d15fbbf52d9154e7a13186598b3b7380 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jan 2022 04:20:52 +0800 +Subject: Drivers: hv: balloon: account for vmbus packet header in max_pkt_size + +From: Yanming Liu + +[ Upstream commit 96d9d1fa5cd505078534113308ced0aa56d8da58 ] + +Commit adae1e931acd ("Drivers: hv: vmbus: Copy packets sent by Hyper-V +out of the ring buffer") introduced a notion of maximum packet size in +vmbus channel and used that size to initialize a buffer holding all +incoming packet along with their vmbus packet header. hv_balloon uses +the default maximum packet size VMBUS_DEFAULT_MAX_PKT_SIZE which matches +its maximum message size, however vmbus_open expects this size to also +include vmbus packet header. This leads to 4096 bytes +dm_unballoon_request messages being truncated to 4080 bytes. When the +driver tries to read next packet it starts from a wrong read_index, +receives garbage and prints a lot of "Unhandled message: type: +" in dmesg. + +Allocate the buffer with HV_HYP_PAGE_SIZE more bytes to make room for +the header. + +Fixes: adae1e931acd ("Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the ring buffer") +Suggested-by: Michael Kelley (LINUX) +Suggested-by: Andrea Parri (Microsoft) +Signed-off-by: Yanming Liu +Reviewed-by: Michael Kelley +Reviewed-by: Andrea Parri (Microsoft) +Link: https://lore.kernel.org/r/20220119202052.3006981-1-yanminglr@gmail.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/hv_balloon.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c +index ca873a3b98dbe..f2d05bff42453 100644 +--- a/drivers/hv/hv_balloon.c ++++ b/drivers/hv/hv_balloon.c +@@ -1660,6 +1660,13 @@ static int balloon_connect_vsp(struct hv_device *dev) + unsigned long t; + int ret; + ++ /* ++ * max_pkt_size should be large enough for one vmbus packet header plus ++ * our receive buffer size. Hyper-V sends messages up to ++ * HV_HYP_PAGE_SIZE bytes long on balloon channel. ++ */ ++ dev->channel->max_pkt_size = HV_HYP_PAGE_SIZE * 2; ++ + ret = vmbus_open(dev->channel, dm_ring_size, dm_ring_size, NULL, 0, + balloon_onchannelcallback, dev); + if (ret) +-- +2.34.1 + diff --git a/queue-5.16/drm-amd-display-dc-calcs-dce_calcs-fix-a-memleak-in-.patch-32654 b/queue-5.16/drm-amd-display-dc-calcs-dce_calcs-fix-a-memleak-in-.patch-32654 new file mode 100644 index 00000000000..8b5584dcc55 --- /dev/null +++ b/queue-5.16/drm-amd-display-dc-calcs-dce_calcs-fix-a-memleak-in-.patch-32654 @@ -0,0 +1,48 @@ +From 4e2284c311f9a53d98decef42a83c7d1029bc446 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jan 2022 00:55:51 +0800 +Subject: drm/amd/display/dc/calcs/dce_calcs: Fix a memleak in + calculate_bandwidth() + +From: Zhou Qingyang + +[ Upstream commit ebc77bcc6e1660a011483c035d53c461c8dcc4f5 ] + +In calculate_bandwidth(), the tag free_sclk and free_yclk are reversed, +which could lead to a memory leak of yclk. + +Fix this bug by changing the location of free_sclk and free_yclk. + +This bug was found by a static analyzer. + +Builds with 'make allyesconfig' show no new warnings, +and our static analyzer no longer warns about this code. + +Fixes: 2be8989d0fc2 ("drm/amd/display/dc/calcs/dce_calcs: Move some large variables from the stack to the heap") +Signed-off-by: Zhou Qingyang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/calcs/dce_calcs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/calcs/dce_calcs.c b/drivers/gpu/drm/amd/display/dc/calcs/dce_calcs.c +index ff5bb152ef494..e6ef36de08254 100644 +--- a/drivers/gpu/drm/amd/display/dc/calcs/dce_calcs.c ++++ b/drivers/gpu/drm/amd/display/dc/calcs/dce_calcs.c +@@ -2033,10 +2033,10 @@ static void calculate_bandwidth( + kfree(surface_type); + free_tiling_mode: + kfree(tiling_mode); +-free_yclk: +- kfree(yclk); + free_sclk: + kfree(sclk); ++free_yclk: ++ kfree(yclk); + } + + /******************************************************************************* +-- +2.34.1 + diff --git a/queue-5.16/drm-msm-a6xx-add-missing-suspend_count-increment.patch-12892 b/queue-5.16/drm-msm-a6xx-add-missing-suspend_count-increment.patch-12892 new file mode 100644 index 00000000000..9b121a5dda8 --- /dev/null +++ b/queue-5.16/drm-msm-a6xx-add-missing-suspend_count-increment.patch-12892 @@ -0,0 +1,36 @@ +From 4f915ebdfae4f2c5a57ee21f99944c1b9b483377 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jan 2022 08:32:13 -0800 +Subject: drm/msm/a6xx: Add missing suspend_count increment + +From: Rob Clark + +[ Upstream commit 860a7b2a87b7c743154824d0597b6c3eb3b53154 ] + +Reported-by: Danylo Piliaiev +Fixes: 3ab1c5cc3939 ("drm/msm: Add param for userspace to query suspend count") +Signed-off-by: Rob Clark +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20220113163215.215367-1-robdclark@gmail.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c +index 78aad5216a613..a305ff7e8c6fb 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c +@@ -1557,6 +1557,8 @@ static int a6xx_pm_suspend(struct msm_gpu *gpu) + for (i = 0; i < gpu->nr_rings; i++) + a6xx_gpu->shadow[i] = 0; + ++ gpu->suspend_count++; ++ + return 0; + } + +-- +2.34.1 + diff --git a/queue-5.16/drm-msm-dpu-invalid-parameter-check-in-dpu_setup_dsp.patch-7879 b/queue-5.16/drm-msm-dpu-invalid-parameter-check-in-dpu_setup_dsp.patch-7879 new file mode 100644 index 00000000000..d5d08dca7aa --- /dev/null +++ b/queue-5.16/drm-msm-dpu-invalid-parameter-check-in-dpu_setup_dsp.patch-7879 @@ -0,0 +1,54 @@ +From c981372ea922a87ddd61f6c1e55c9cd814430818 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Jan 2022 20:24:31 +0100 +Subject: drm/msm/dpu: invalid parameter check in dpu_setup_dspp_pcc +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: José Expósito + +[ Upstream commit 170b22234d5495f5e0844246e23f004639ee89ba ] + +The function performs a check on the "ctx" input parameter, however, it +is used before the check. + +Initialize the "base" variable after the sanity check to avoid a +possible NULL pointer dereference. + +Fixes: 4259ff7ae509e ("drm/msm/dpu: add support for pcc color block in dpu driver") +Addresses-Coverity-ID: 1493866 ("Null pointer dereference") +Signed-off-by: José Expósito +Link: https://lore.kernel.org/r/20220109192431.135949-1-jose.exposito89@gmail.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dspp.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dspp.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dspp.c +index a98e964c3b6fa..355894a3b48c3 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dspp.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dspp.c +@@ -26,9 +26,16 @@ static void dpu_setup_dspp_pcc(struct dpu_hw_dspp *ctx, + struct dpu_hw_pcc_cfg *cfg) + { + +- u32 base = ctx->cap->sblk->pcc.base; ++ u32 base; + +- if (!ctx || !base) { ++ if (!ctx) { ++ DRM_ERROR("invalid ctx %pK\n", ctx); ++ return; ++ } ++ ++ base = ctx->cap->sblk->pcc.base; ++ ++ if (!base) { + DRM_ERROR("invalid ctx %pK pcc base 0x%x\n", ctx, base); + return; + } +-- +2.34.1 + diff --git a/queue-5.16/drm-msm-dsi-fix-missing-put_device-call-in-dsi_get_p.patch-32603 b/queue-5.16/drm-msm-dsi-fix-missing-put_device-call-in-dsi_get_p.patch-32603 new file mode 100644 index 00000000000..965fc792886 --- /dev/null +++ b/queue-5.16/drm-msm-dsi-fix-missing-put_device-call-in-dsi_get_p.patch-32603 @@ -0,0 +1,44 @@ +From 7627434828c9eb6627c4edcc5a46f740a0680b64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Dec 2021 07:09:40 +0000 +Subject: drm/msm/dsi: Fix missing put_device() call in dsi_get_phy + +From: Miaoqian Lin + +[ Upstream commit c04c3148ca12227d92f91b355b4538cc333c9922 ] + +If of_find_device_by_node() succeeds, dsi_get_phy() doesn't +a corresponding put_device(). Thus add put_device() to fix the exception +handling. + +Fixes: ec31abf ("drm/msm/dsi: Separate PHY to another platform device") +Signed-off-by: Miaoqian Lin +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20211230070943.18116-1-linmq006@gmail.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/dsi.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/dsi/dsi.c b/drivers/gpu/drm/msm/dsi/dsi.c +index fc280cc434943..122fadcf7cc1e 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi.c ++++ b/drivers/gpu/drm/msm/dsi/dsi.c +@@ -40,7 +40,12 @@ static int dsi_get_phy(struct msm_dsi *msm_dsi) + + of_node_put(phy_node); + +- if (!phy_pdev || !msm_dsi->phy) { ++ if (!phy_pdev) { ++ DRM_DEV_ERROR(&pdev->dev, "%s: phy driver is not ready\n", __func__); ++ return -EPROBE_DEFER; ++ } ++ if (!msm_dsi->phy) { ++ put_device(&phy_pdev->dev); + DRM_DEV_ERROR(&pdev->dev, "%s: phy driver is not ready\n", __func__); + return -EPROBE_DEFER; + } +-- +2.34.1 + diff --git a/queue-5.16/drm-msm-dsi-invalid-parameter-check-in-msm_dsi_phy_e.patch-19238 b/queue-5.16/drm-msm-dsi-invalid-parameter-check-in-msm_dsi_phy_e.patch-19238 new file mode 100644 index 00000000000..f8243508226 --- /dev/null +++ b/queue-5.16/drm-msm-dsi-invalid-parameter-check-in-msm_dsi_phy_e.patch-19238 @@ -0,0 +1,52 @@ +From 16f7a98ea162128a54e6d28253c1a5acc043a54d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Jan 2022 19:18:44 +0100 +Subject: drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: José Expósito + +[ Upstream commit 5e761a2287234bc402ba7ef07129f5103bcd775c ] + +The function performs a check on the "phy" input parameter, however, it +is used before the check. + +Initialize the "dev" variable after the sanity check to avoid a possible +NULL pointer dereference. + +Fixes: 5c8290284402b ("drm/msm/dsi: Split PHY drivers to separate files") +Addresses-Coverity-ID: 1493860 ("Null pointer dereference") +Signed-off-by: José Expósito +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20220116181844.7400-1-jose.exposito89@gmail.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c +index 9842e04b58580..baa6af0c3bccf 100644 +--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c ++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c +@@ -808,12 +808,14 @@ int msm_dsi_phy_enable(struct msm_dsi_phy *phy, + struct msm_dsi_phy_clk_request *clk_req, + struct msm_dsi_phy_shared_timings *shared_timings) + { +- struct device *dev = &phy->pdev->dev; ++ struct device *dev; + int ret; + + if (!phy || !phy->cfg->ops.enable) + return -EINVAL; + ++ dev = &phy->pdev->dev; ++ + ret = dsi_phy_enable_resource(phy); + if (ret) { + DRM_DEV_ERROR(dev, "%s: resource enable failed, %d\n", +-- +2.34.1 + diff --git a/queue-5.16/drm-msm-fix-wrong-size-calculation.patch-5782 b/queue-5.16/drm-msm-fix-wrong-size-calculation.patch-5782 new file mode 100644 index 00000000000..ddf61ea9764 --- /dev/null +++ b/queue-5.16/drm-msm-fix-wrong-size-calculation.patch-5782 @@ -0,0 +1,46 @@ +From 139564c86fb8df248a6af7b28dc30dbbef7e99d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jan 2022 20:33:34 +0800 +Subject: drm/msm: Fix wrong size calculation + +From: Xianting Tian + +[ Upstream commit 0a727b459ee39bd4c5ced19d6024258ac87b6b2e ] + +For example, memory-region in .dts as below, + reg = <0x0 0x50000000 0x0 0x20000000> + +We can get below values, +struct resource r; +r.start = 0x50000000; +r.end = 0x6fffffff; + +So the size should be: +size = r.end - r.start + 1 = 0x20000000 + +Signed-off-by: Xianting Tian +Fixes: 072f1f9168ed ("drm/msm: add support for "stolen" mem") +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20220112123334.749776-1-xianting.tian@linux.alibaba.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_drv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c +index 892c04365239b..f04a2337da006 100644 +--- a/drivers/gpu/drm/msm/msm_drv.c ++++ b/drivers/gpu/drm/msm/msm_drv.c +@@ -466,7 +466,7 @@ static int msm_init_vram(struct drm_device *dev) + of_node_put(node); + if (ret) + return ret; +- size = r.end - r.start; ++ size = r.end - r.start + 1; + DRM_INFO("using VRAM carveout: %lx@%pa\n", size, &r.start); + + /* if we have no IOMMU, then we need to use carveout allocator. +-- +2.34.1 + diff --git a/queue-5.16/drm-msm-hdmi-fix-missing-put_device-call-in-msm_hdmi.patch-25966 b/queue-5.16/drm-msm-hdmi-fix-missing-put_device-call-in-msm_hdmi.patch-25966 new file mode 100644 index 00000000000..d54930a338b --- /dev/null +++ b/queue-5.16/drm-msm-hdmi-fix-missing-put_device-call-in-msm_hdmi.patch-25966 @@ -0,0 +1,47 @@ +From 7deab9031c345af5be78b070e6051d1e134d7263 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jan 2022 08:50:22 +0000 +Subject: drm/msm/hdmi: Fix missing put_device() call in msm_hdmi_get_phy + +From: Miaoqian Lin + +[ Upstream commit 774fe0cd838d1b1419d41ab4ea0613c80d4ecbd7 ] + +The reference taken by 'of_find_device_by_node()' must be released when +not needed anymore. +Add the corresponding 'put_device()' in the error handling path. + +Fixes: e00012b256d4 ("drm/msm/hdmi: Make HDMI core get its PHY") +Signed-off-by: Miaoqian Lin +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20220107085026.23831-1-linmq006@gmail.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/hdmi/hdmi.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c +index 75b64e6ae0350..a439794a32e81 100644 +--- a/drivers/gpu/drm/msm/hdmi/hdmi.c ++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c +@@ -95,10 +95,15 @@ static int msm_hdmi_get_phy(struct hdmi *hdmi) + + of_node_put(phy_node); + +- if (!phy_pdev || !hdmi->phy) { ++ if (!phy_pdev) { + DRM_DEV_ERROR(&pdev->dev, "phy driver is not ready\n"); + return -EPROBE_DEFER; + } ++ if (!hdmi->phy) { ++ DRM_DEV_ERROR(&pdev->dev, "phy driver is not ready\n"); ++ put_device(&phy_pdev->dev); ++ return -EPROBE_DEFER; ++ } + + hdmi->phy_dev = get_device(&phy_pdev->dev); + +-- +2.34.1 + diff --git a/queue-5.16/efi-libstub-arm64-fix-image-check-alignment-at-entry.patch-10252 b/queue-5.16/efi-libstub-arm64-fix-image-check-alignment-at-entry.patch-10252 new file mode 100644 index 00000000000..3a5ab0c340b --- /dev/null +++ b/queue-5.16/efi-libstub-arm64-fix-image-check-alignment-at-entry.patch-10252 @@ -0,0 +1,49 @@ +From 8d8a7d7f392437374bd41a8a57bc1f711bb85067 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jan 2022 18:14:27 +0200 +Subject: efi/libstub: arm64: Fix image check alignment at entry + +From: Mihai Carabas + +[ Upstream commit e9b7c3a4263bdcfd31bc3d03d48ce0ded7a94635 ] + +The kernel is aligned at SEGMENT_SIZE and this is the size populated in the PE +headers: + +arch/arm64/kernel/efi-header.S: .long SEGMENT_ALIGN // SectionAlignment + +EFI_KIMG_ALIGN is defined as: (SEGMENT_ALIGN > THREAD_ALIGN ? SEGMENT_ALIGN : +THREAD_ALIGN) + +So it depends on THREAD_ALIGN. On newer builds this message started to appear +even though the loader is taking into account the PE header (which is stating +SEGMENT_ALIGN). + +Fixes: c32ac11da3f8 ("efi/libstub: arm64: Double check image alignment at entry") +Signed-off-by: Mihai Carabas +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/libstub/arm64-stub.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/firmware/efi/libstub/arm64-stub.c b/drivers/firmware/efi/libstub/arm64-stub.c +index 2363fee9211c9..9cc556013d085 100644 +--- a/drivers/firmware/efi/libstub/arm64-stub.c ++++ b/drivers/firmware/efi/libstub/arm64-stub.c +@@ -119,9 +119,9 @@ efi_status_t handle_kernel_image(unsigned long *image_addr, + if (image->image_base != _text) + efi_err("FIRMWARE BUG: efi_loaded_image_t::image_base has bogus value\n"); + +- if (!IS_ALIGNED((u64)_text, EFI_KIMG_ALIGN)) +- efi_err("FIRMWARE BUG: kernel image not aligned on %ldk boundary\n", +- EFI_KIMG_ALIGN >> 10); ++ if (!IS_ALIGNED((u64)_text, SEGMENT_ALIGN)) ++ efi_err("FIRMWARE BUG: kernel image not aligned on %dk boundary\n", ++ SEGMENT_ALIGN >> 10); + + kernel_size = _edata - _text; + kernel_memsize = kernel_size + (_end - _edata); +-- +2.34.1 + diff --git a/queue-5.16/ethtool-fix-link-extended-state-for-big-endian.patch-18835 b/queue-5.16/ethtool-fix-link-extended-state-for-big-endian.patch-18835 new file mode 100644 index 00000000000..ef545258914 --- /dev/null +++ b/queue-5.16/ethtool-fix-link-extended-state-for-big-endian.patch-18835 @@ -0,0 +1,42 @@ +From fadb256f111444df356b159a5bb7e7ed1bd1a4d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jan 2022 11:55:50 +0200 +Subject: ethtool: Fix link extended state for big endian + +From: Moshe Tal + +[ Upstream commit e2f08207c558bc0bc8abaa557cdb29bad776ac7b ] + +The link extended sub-states are assigned as enum that is an integer +size but read from a union as u8, this is working for small values on +little endian systems but for big endian this always give 0. Fix the +variable in the union to match the enum size. + +Fixes: ecc31c60240b ("ethtool: Add link extended state") +Signed-off-by: Moshe Tal +Reviewed-by: Ido Schimmel +Tested-by: Ido Schimmel +Reviewed-by: Gal Pressman +Reviewed-by: Amit Cohen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/ethtool.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h +index 845a0ffc16ee8..d8f07baf272ad 100644 +--- a/include/linux/ethtool.h ++++ b/include/linux/ethtool.h +@@ -95,7 +95,7 @@ struct ethtool_link_ext_state_info { + enum ethtool_link_ext_substate_bad_signal_integrity bad_signal_integrity; + enum ethtool_link_ext_substate_cable_issue cable_issue; + enum ethtool_link_ext_substate_module module; +- u8 __link_ext_substate; ++ u32 __link_ext_substate; + }; + }; + +-- +2.34.1 + diff --git a/queue-5.16/gve-fix-gfp-flags-when-allocing-pages.patch-12328 b/queue-5.16/gve-fix-gfp-flags-when-allocing-pages.patch-12328 new file mode 100644 index 00000000000..02b61cf7578 --- /dev/null +++ b/queue-5.16/gve-fix-gfp-flags-when-allocing-pages.patch-12328 @@ -0,0 +1,97 @@ +From 5e12ff5b611d479672b2d7acf0b87918e2bbcff0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jan 2022 16:38:43 -0800 +Subject: gve: Fix GFP flags when allocing pages + +From: Catherine Sullivan + +[ Upstream commit a92f7a6feeb3884c69c1c7c1f13bccecb2228ad0 ] + +Use GFP_ATOMIC when allocating pages out of the hotpath, +continue to use GFP_KERNEL when allocating pages during setup. + +GFP_KERNEL will allow blocking which allows it to succeed +more often in a low memory enviornment but in the hotpath we do +not want to allow the allocation to block. + +Fixes: f5cedc84a30d2 ("gve: Add transmit and receive support") +Signed-off-by: Catherine Sullivan +Signed-off-by: David Awogbemila +Link: https://lore.kernel.org/r/20220126003843.3584521-1-awogbemila@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/google/gve/gve.h | 2 +- + drivers/net/ethernet/google/gve/gve_main.c | 6 +++--- + drivers/net/ethernet/google/gve/gve_rx.c | 3 ++- + drivers/net/ethernet/google/gve/gve_rx_dqo.c | 2 +- + 4 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/google/gve/gve.h b/drivers/net/ethernet/google/gve/gve.h +index b719f72281c44..3d469073fbc54 100644 +--- a/drivers/net/ethernet/google/gve/gve.h ++++ b/drivers/net/ethernet/google/gve/gve.h +@@ -830,7 +830,7 @@ static inline bool gve_is_gqi(struct gve_priv *priv) + /* buffers */ + int gve_alloc_page(struct gve_priv *priv, struct device *dev, + struct page **page, dma_addr_t *dma, +- enum dma_data_direction); ++ enum dma_data_direction, gfp_t gfp_flags); + void gve_free_page(struct device *dev, struct page *page, dma_addr_t dma, + enum dma_data_direction); + /* tx handling */ +diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c +index 59b66f679e46e..28e2d4d8ed7c6 100644 +--- a/drivers/net/ethernet/google/gve/gve_main.c ++++ b/drivers/net/ethernet/google/gve/gve_main.c +@@ -752,9 +752,9 @@ static void gve_free_rings(struct gve_priv *priv) + + int gve_alloc_page(struct gve_priv *priv, struct device *dev, + struct page **page, dma_addr_t *dma, +- enum dma_data_direction dir) ++ enum dma_data_direction dir, gfp_t gfp_flags) + { +- *page = alloc_page(GFP_KERNEL); ++ *page = alloc_page(gfp_flags); + if (!*page) { + priv->page_alloc_fail++; + return -ENOMEM; +@@ -797,7 +797,7 @@ static int gve_alloc_queue_page_list(struct gve_priv *priv, u32 id, + for (i = 0; i < pages; i++) { + err = gve_alloc_page(priv, &priv->pdev->dev, &qpl->pages[i], + &qpl->page_buses[i], +- gve_qpl_dma_dir(priv, id)); ++ gve_qpl_dma_dir(priv, id), GFP_KERNEL); + /* caller handles clean up */ + if (err) + return -ENOMEM; +diff --git a/drivers/net/ethernet/google/gve/gve_rx.c b/drivers/net/ethernet/google/gve/gve_rx.c +index 3d04b5aff331b..04a08904305a9 100644 +--- a/drivers/net/ethernet/google/gve/gve_rx.c ++++ b/drivers/net/ethernet/google/gve/gve_rx.c +@@ -86,7 +86,8 @@ static int gve_rx_alloc_buffer(struct gve_priv *priv, struct device *dev, + dma_addr_t dma; + int err; + +- err = gve_alloc_page(priv, dev, &page, &dma, DMA_FROM_DEVICE); ++ err = gve_alloc_page(priv, dev, &page, &dma, DMA_FROM_DEVICE, ++ GFP_ATOMIC); + if (err) + return err; + +diff --git a/drivers/net/ethernet/google/gve/gve_rx_dqo.c b/drivers/net/ethernet/google/gve/gve_rx_dqo.c +index beb8bb079023c..8c939628e2d85 100644 +--- a/drivers/net/ethernet/google/gve/gve_rx_dqo.c ++++ b/drivers/net/ethernet/google/gve/gve_rx_dqo.c +@@ -157,7 +157,7 @@ static int gve_alloc_page_dqo(struct gve_priv *priv, + int err; + + err = gve_alloc_page(priv, &priv->pdev->dev, &buf_state->page_info.page, +- &buf_state->addr, DMA_FROM_DEVICE); ++ &buf_state->addr, DMA_FROM_DEVICE, GFP_KERNEL); + if (err) + return err; + +-- +2.34.1 + diff --git a/queue-5.16/hwmon-adt7470-prevent-divide-by-zero-in-adt7470_fan_.patch-11929 b/queue-5.16/hwmon-adt7470-prevent-divide-by-zero-in-adt7470_fan_.patch-11929 new file mode 100644 index 00000000000..50703193482 --- /dev/null +++ b/queue-5.16/hwmon-adt7470-prevent-divide-by-zero-in-adt7470_fan_.patch-11929 @@ -0,0 +1,39 @@ +From c4eb88d6023f55e38cfa8abd9bc9fe92143568b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 14:55:43 +0300 +Subject: hwmon: (adt7470) Prevent divide by zero in adt7470_fan_write() + +From: Dan Carpenter + +[ Upstream commit c1ec0cabc36718efc7fe8b4157d41b82d08ec1d2 ] + +The "val" variable is controlled by the user and comes from +hwmon_attr_store(). The FAN_RPM_TO_PERIOD() macro divides by "val" +so a zero will crash the system. Check for that and return -EINVAL. +Negatives are also invalid so return -EINVAL for those too. + +Fixes: fc958a61ff6d ("hwmon: (adt7470) Convert to devm_hwmon_device_register_with_info API") +Signed-off-by: Dan Carpenter +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/adt7470.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c +index d519aca4a9d64..fb6d14d213a18 100644 +--- a/drivers/hwmon/adt7470.c ++++ b/drivers/hwmon/adt7470.c +@@ -662,6 +662,9 @@ static int adt7470_fan_write(struct device *dev, u32 attr, int channel, long val + struct adt7470_data *data = dev_get_drvdata(dev); + int err; + ++ if (val <= 0) ++ return -EINVAL; ++ + val = FAN_RPM_TO_PERIOD(val); + val = clamp_val(val, 1, 65534); + +-- +2.34.1 + diff --git a/queue-5.16/hwmon-lm90-fix-sysfs-and-udev-notifications.patch-1586 b/queue-5.16/hwmon-lm90-fix-sysfs-and-udev-notifications.patch-1586 new file mode 100644 index 00000000000..c226a55fdd6 --- /dev/null +++ b/queue-5.16/hwmon-lm90-fix-sysfs-and-udev-notifications.patch-1586 @@ -0,0 +1,56 @@ +From f5f7ab783bc43648c55b01e15d53ea13ae086efc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jan 2022 23:23:31 -0800 +Subject: hwmon: (lm90) Fix sysfs and udev notifications + +From: Guenter Roeck + +[ Upstream commit d379880d9adb9f1ada3f1266aa49ea2561328e08 ] + +sysfs and udev notifications need to be sent to the _alarm +attributes, not to the value attributes. + +Fixes: 94dbd23ed88c ("hwmon: (lm90) Use hwmon_notify_event()") +Cc: Dmitry Osipenko +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/lm90.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c +index ba01127c1deb1..1c9493c708132 100644 +--- a/drivers/hwmon/lm90.c ++++ b/drivers/hwmon/lm90.c +@@ -1808,22 +1808,22 @@ static bool lm90_is_tripped(struct i2c_client *client, u16 *status) + + if (st & LM90_STATUS_LLOW) + hwmon_notify_event(data->hwmon_dev, hwmon_temp, +- hwmon_temp_min, 0); ++ hwmon_temp_min_alarm, 0); + if (st & LM90_STATUS_RLOW) + hwmon_notify_event(data->hwmon_dev, hwmon_temp, +- hwmon_temp_min, 1); ++ hwmon_temp_min_alarm, 1); + if (st2 & MAX6696_STATUS2_R2LOW) + hwmon_notify_event(data->hwmon_dev, hwmon_temp, +- hwmon_temp_min, 2); ++ hwmon_temp_min_alarm, 2); + if (st & LM90_STATUS_LHIGH) + hwmon_notify_event(data->hwmon_dev, hwmon_temp, +- hwmon_temp_max, 0); ++ hwmon_temp_max_alarm, 0); + if (st & LM90_STATUS_RHIGH) + hwmon_notify_event(data->hwmon_dev, hwmon_temp, +- hwmon_temp_max, 1); ++ hwmon_temp_max_alarm, 1); + if (st2 & MAX6696_STATUS2_R2HIGH) + hwmon_notify_event(data->hwmon_dev, hwmon_temp, +- hwmon_temp_max, 2); ++ hwmon_temp_max_alarm, 2); + + return true; + } +-- +2.34.1 + diff --git a/queue-5.16/hwmon-lm90-mark-alert-as-broken-for-max6646-6647-664.patch-25810 b/queue-5.16/hwmon-lm90-mark-alert-as-broken-for-max6646-6647-664.patch-25810 new file mode 100644 index 00000000000..3f6e2d4eb07 --- /dev/null +++ b/queue-5.16/hwmon-lm90-mark-alert-as-broken-for-max6646-6647-664.patch-25810 @@ -0,0 +1,36 @@ +From fddfe032896e343975c64544df1f28386c1fa424 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jan 2022 12:36:41 -0800 +Subject: hwmon: (lm90) Mark alert as broken for MAX6646/6647/6649 + +From: Guenter Roeck + +[ Upstream commit f614629f9c1080dcc844a8430e3fb4c37ebbf05d ] + +Experiments with MAX6646 and MAX6648 show that the alert function of those +chips is broken, similar to other chips supported by the lm90 driver. +Mark it accordingly. + +Fixes: 4667bcb8d8fc ("hwmon: (lm90) Introduce chip parameter structure") +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/lm90.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c +index 06cb971c889b4..ba01127c1deb1 100644 +--- a/drivers/hwmon/lm90.c ++++ b/drivers/hwmon/lm90.c +@@ -394,7 +394,7 @@ static const struct lm90_params lm90_params[] = { + .max_convrate = 9, + }, + [max6646] = { +- .flags = LM90_HAVE_CRIT, ++ .flags = LM90_HAVE_CRIT | LM90_HAVE_BROKEN_ALERT, + .alert_alarms = 0x7c, + .max_convrate = 6, + .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, +-- +2.34.1 + diff --git a/queue-5.16/hwmon-lm90-mark-alert-as-broken-for-max6654.patch-7376 b/queue-5.16/hwmon-lm90-mark-alert-as-broken-for-max6654.patch-7376 new file mode 100644 index 00000000000..07301f98c13 --- /dev/null +++ b/queue-5.16/hwmon-lm90-mark-alert-as-broken-for-max6654.patch-7376 @@ -0,0 +1,35 @@ +From 5bb6954071aa6d55da834b36c07ac1db81180e7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jan 2022 11:05:23 -0800 +Subject: hwmon: (lm90) Mark alert as broken for MAX6654 + +From: Guenter Roeck + +[ Upstream commit a53fff96f35763d132a36c620b183fdf11022d7a ] + +Experiments with MAX6654 show that its alert function is broken, +similar to other chips supported by the lm90 driver. Mark it accordingly. + +Fixes: 229d495d8189 ("hwmon: (lm90) Add max6654 support to lm90 driver") +Cc: Josh Lehan +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/lm90.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c +index e4ecf3440d7cf..280ae5f58187b 100644 +--- a/drivers/hwmon/lm90.c ++++ b/drivers/hwmon/lm90.c +@@ -400,6 +400,7 @@ static const struct lm90_params lm90_params[] = { + .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, + }, + [max6654] = { ++ .flags = LM90_HAVE_BROKEN_ALERT, + .alert_alarms = 0x7c, + .max_convrate = 7, + .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, +-- +2.34.1 + diff --git a/queue-5.16/hwmon-lm90-mark-alert-as-broken-for-max6680.patch-6352 b/queue-5.16/hwmon-lm90-mark-alert-as-broken-for-max6680.patch-6352 new file mode 100644 index 00000000000..e7d5d66e103 --- /dev/null +++ b/queue-5.16/hwmon-lm90-mark-alert-as-broken-for-max6680.patch-6352 @@ -0,0 +1,36 @@ +From a7efbb208adc494de3addea3e677264bd53eb59d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jan 2022 11:11:00 -0800 +Subject: hwmon: (lm90) Mark alert as broken for MAX6680 + +From: Guenter Roeck + +[ Upstream commit 94746b0ba479743355e0d3cc1cb9cfe3011fb8be ] + +Experiments with MAX6680 and MAX6681 show that the alert function of those +chips is broken, similar to other chips supported by the lm90 driver. +Mark it accordingly. + +Fixes: 4667bcb8d8fc ("hwmon: (lm90) Introduce chip parameter structure") +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/lm90.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c +index 280ae5f58187b..06cb971c889b4 100644 +--- a/drivers/hwmon/lm90.c ++++ b/drivers/hwmon/lm90.c +@@ -419,7 +419,7 @@ static const struct lm90_params lm90_params[] = { + }, + [max6680] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_CRIT +- | LM90_HAVE_CRIT_ALRM_SWP, ++ | LM90_HAVE_CRIT_ALRM_SWP | LM90_HAVE_BROKEN_ALERT, + .alert_alarms = 0x7c, + .max_convrate = 7, + }, +-- +2.34.1 + diff --git a/queue-5.16/hwmon-lm90-re-enable-interrupts-after-alert-clears.patch-20612 b/queue-5.16/hwmon-lm90-re-enable-interrupts-after-alert-clears.patch-20612 new file mode 100644 index 00000000000..ecb89a48f74 --- /dev/null +++ b/queue-5.16/hwmon-lm90-re-enable-interrupts-after-alert-clears.patch-20612 @@ -0,0 +1,41 @@ +From 93a8be3aedccb5021291a5896c77302a93e613eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Jan 2022 11:37:19 -0800 +Subject: hwmon: (lm90) Re-enable interrupts after alert clears + +From: Guenter Roeck + +[ Upstream commit bc341a1a98827925082e95db174734fc8bd68af6 ] + +If alert handling is broken, interrupts are disabled after an alert and +re-enabled after the alert clears. However, if there is an interrupt +handler, this does not apply if alerts were originally disabled and enabled +when the driver was loaded. In that case, interrupts will stay disabled +after an alert was handled though the alert handler even after the alert +condition clears. Address the situation by always re-enabling interrupts +after the alert condition clears if there is an interrupt handler. + +Fixes: 2abdc357c55d9 ("hwmon: (lm90) Unmask hardware interrupt") +Cc: Dmitry Osipenko +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/lm90.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c +index cc5e48fe304b1..e4ecf3440d7cf 100644 +--- a/drivers/hwmon/lm90.c ++++ b/drivers/hwmon/lm90.c +@@ -848,7 +848,7 @@ static int lm90_update_device(struct device *dev) + * Re-enable ALERT# output if it was originally enabled and + * relevant alarms are all clear + */ +- if (!(data->config_orig & 0x80) && ++ if ((client->irq || !(data->config_orig & 0x80)) && + !(data->alarms & data->alert_alarms)) { + if (data->config & 0x80) { + dev_dbg(&client->dev, "Re-enabling ALERT#\n"); +-- +2.34.1 + diff --git a/queue-5.16/hwmon-lm90-reduce-maximum-conversion-rate-for-g781.patch-12001 b/queue-5.16/hwmon-lm90-reduce-maximum-conversion-rate-for-g781.patch-12001 new file mode 100644 index 00000000000..ed493c66cfe --- /dev/null +++ b/queue-5.16/hwmon-lm90-reduce-maximum-conversion-rate-for-g781.patch-12001 @@ -0,0 +1,44 @@ +From 50b7ffc24dbcce5b516dd9a166e4a923a520cfe2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jan 2022 11:48:52 -0800 +Subject: hwmon: (lm90) Reduce maximum conversion rate for G781 + +From: Guenter Roeck + +[ Upstream commit a66c5ed539277b9f2363bbace0dba88b85b36c26 ] + +According to its datasheet, G781 supports a maximum conversion rate value +of 8 (62.5 ms). However, chips labeled G781 and G780 were found to only +support a maximum conversion rate value of 7 (125 ms). On the other side, +chips labeled G781-1 and G784 were found to support a conversion rate value +of 8. There is no known means to distinguish G780 from G781 or G784; all +chips report the same manufacturer ID and chip revision. +Setting the conversion rate register value to 8 on chips not supporting +it causes unexpected behavior since the real conversion rate is set to 0 +(16 seconds) if a value of 8 is written into the conversion rate register. +Limit the conversion rate register value to 7 for all G78x chips to avoid +the problem. + +Fixes: ae544f64cc7b ("hwmon: (lm90) Add support for GMT G781") +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/lm90.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c +index 74019dff2550e..cc5e48fe304b1 100644 +--- a/drivers/hwmon/lm90.c ++++ b/drivers/hwmon/lm90.c +@@ -373,7 +373,7 @@ static const struct lm90_params lm90_params[] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT + | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, +- .max_convrate = 8, ++ .max_convrate = 7, + }, + [lm86] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT +-- +2.34.1 + diff --git a/queue-5.16/hwmon-nct6775-fix-crash-in-clear_caseopen.patch-28716 b/queue-5.16/hwmon-nct6775-fix-crash-in-clear_caseopen.patch-28716 new file mode 100644 index 00000000000..87ce4ae3726 --- /dev/null +++ b/queue-5.16/hwmon-nct6775-fix-crash-in-clear_caseopen.patch-28716 @@ -0,0 +1,90 @@ +From 395a1bc509c2da6610872dc9dde6c3e98be5c811 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jan 2022 18:23:22 -0800 +Subject: hwmon: (nct6775) Fix crash in clear_caseopen +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Guenter Roeck + +[ Upstream commit 79da533d3cc717ccc05ddbd3190da8a72bc2408b ] + +Paweł Marciniak reports the following crash, observed when clearing +the chassis intrusion alarm. + +BUG: kernel NULL pointer dereference, address: 0000000000000028 +PGD 0 P4D 0 +Oops: 0000 [#1] PREEMPT SMP PTI +CPU: 3 PID: 4815 Comm: bash Tainted: G S 5.16.2-200.fc35.x86_64 #1 +Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./Z97 Extreme4, BIOS P2.60A 05/03/2018 +RIP: 0010:clear_caseopen+0x5a/0x120 [nct6775] +Code: 68 70 e8 e9 32 b1 e3 85 c0 0f 85 d2 00 00 00 48 83 7c 24 ... +RSP: 0018:ffffabcb02803dd8 EFLAGS: 00010246 +RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000 +RDX: ffff8e8808192880 RSI: 0000000000000000 RDI: ffff8e87c7509a68 +RBP: 0000000000000000 R08: 0000000000000001 R09: 000000000000000a +R10: 000000000000000a R11: f000000000000000 R12: 000000000000001f +R13: ffff8e87c7509828 R14: ffff8e87c7509a68 R15: ffff8e88494527a0 +FS: 00007f4db9151740(0000) GS:ffff8e8ebfec0000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000000028 CR3: 0000000166b66001 CR4: 00000000001706e0 +Call Trace: + + kernfs_fop_write_iter+0x11c/0x1b0 + new_sync_write+0x10b/0x180 + vfs_write+0x209/0x2a0 + ksys_write+0x4f/0xc0 + do_syscall_64+0x3b/0x90 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +The problem is that the device passed to clear_caseopen() is the hwmon +device, not the platform device, and the platform data is not set in the +hwmon device. Store the pointer to sio_data in struct nct6775_data and +get if from there if needed. + +Fixes: 2e7b9886968b ("hwmon: (nct6775) Use superio_*() function pointers in sio_data.") +Cc: Denis Pauk +Cc: Bernhard Seibold +Reported-by: Paweł Marciniak +Tested-by: Denis Pauk +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/nct6775.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c +index 57ce8633a7256..3496a823e4d4f 100644 +--- a/drivers/hwmon/nct6775.c ++++ b/drivers/hwmon/nct6775.c +@@ -1175,7 +1175,7 @@ static inline u8 in_to_reg(u32 val, u8 nr) + + struct nct6775_data { + int addr; /* IO base of hw monitor block */ +- int sioreg; /* SIO register address */ ++ struct nct6775_sio_data *sio_data; + enum kinds kind; + const char *name; + +@@ -3561,7 +3561,7 @@ clear_caseopen(struct device *dev, struct device_attribute *attr, + const char *buf, size_t count) + { + struct nct6775_data *data = dev_get_drvdata(dev); +- struct nct6775_sio_data *sio_data = dev_get_platdata(dev); ++ struct nct6775_sio_data *sio_data = data->sio_data; + int nr = to_sensor_dev_attr(attr)->index - INTRUSION_ALARM_BASE; + unsigned long val; + u8 reg; +@@ -3969,7 +3969,7 @@ static int nct6775_probe(struct platform_device *pdev) + return -ENOMEM; + + data->kind = sio_data->kind; +- data->sioreg = sio_data->sioreg; ++ data->sio_data = sio_data; + + if (sio_data->access == access_direct) { + data->addr = res->start; +-- +2.34.1 + diff --git a/queue-5.16/i40e-fix-for-failed-to-init-adminq-while-vf-reset.patch-18848 b/queue-5.16/i40e-fix-for-failed-to-init-adminq-while-vf-reset.patch-18848 new file mode 100644 index 00000000000..5c9988cb7dd --- /dev/null +++ b/queue-5.16/i40e-fix-for-failed-to-init-adminq-while-vf-reset.patch-18848 @@ -0,0 +1,129 @@ +From 8acefd87bafd928280b0decda612141b5f475754 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Dec 2021 12:52:01 +0100 +Subject: i40e: Fix for failed to init adminq while VF reset + +From: Karen Sornek + +[ Upstream commit 0f344c8129a5337dae50e31b817dd50a60ff238c ] + +Fix for failed to init adminq: -53 while VF is resetting via MAC +address changing procedure. +Added sync module to avoid reading deadbeef value in reinit adminq +during software reset. +Without this patch it is possible to trigger VF reset procedure +during reinit adminq. This resulted in an incorrect reading of +value from the AQP registers and generated the -53 error. + +Fixes: 5c3c48ac6bf5 ("i40e: implement virtual device interface") +Signed-off-by: Grzegorz Szczurek +Signed-off-by: Karen Sornek +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + .../net/ethernet/intel/i40e/i40e_register.h | 3 ++ + .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 44 ++++++++++++++++++- + .../ethernet/intel/i40e/i40e_virtchnl_pf.h | 1 + + 3 files changed, 46 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_register.h b/drivers/net/ethernet/intel/i40e/i40e_register.h +index 8d0588a27a053..1908eed4fa5ee 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_register.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_register.h +@@ -413,6 +413,9 @@ + #define I40E_VFINT_DYN_CTLN(_INTVF) (0x00024800 + ((_INTVF) * 4)) /* _i=0...511 */ /* Reset: VFR */ + #define I40E_VFINT_DYN_CTLN_CLEARPBA_SHIFT 1 + #define I40E_VFINT_DYN_CTLN_CLEARPBA_MASK I40E_MASK(0x1, I40E_VFINT_DYN_CTLN_CLEARPBA_SHIFT) ++#define I40E_VFINT_ICR0_ADMINQ_SHIFT 30 ++#define I40E_VFINT_ICR0_ADMINQ_MASK I40E_MASK(0x1, I40E_VFINT_ICR0_ADMINQ_SHIFT) ++#define I40E_VFINT_ICR0_ENA(_VF) (0x0002C000 + ((_VF) * 4)) /* _i=0...127 */ /* Reset: CORER */ + #define I40E_VPINT_AEQCTL(_VF) (0x0002B800 + ((_VF) * 4)) /* _i=0...127 */ /* Reset: CORER */ + #define I40E_VPINT_AEQCTL_MSIX_INDX_SHIFT 0 + #define I40E_VPINT_AEQCTL_ITR_INDX_SHIFT 11 +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 3e88d229b5e0b..c6f643e54c4f7 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -1376,6 +1376,32 @@ static i40e_status i40e_config_vf_promiscuous_mode(struct i40e_vf *vf, + return aq_ret; + } + ++/** ++ * i40e_sync_vfr_reset ++ * @hw: pointer to hw struct ++ * @vf_id: VF identifier ++ * ++ * Before trigger hardware reset, we need to know if no other process has ++ * reserved the hardware for any reset operations. This check is done by ++ * examining the status of the RSTAT1 register used to signal the reset. ++ **/ ++static int i40e_sync_vfr_reset(struct i40e_hw *hw, int vf_id) ++{ ++ u32 reg; ++ int i; ++ ++ for (i = 0; i < I40E_VFR_WAIT_COUNT; i++) { ++ reg = rd32(hw, I40E_VFINT_ICR0_ENA(vf_id)) & ++ I40E_VFINT_ICR0_ADMINQ_MASK; ++ if (reg) ++ return 0; ++ ++ usleep_range(100, 200); ++ } ++ ++ return -EAGAIN; ++} ++ + /** + * i40e_trigger_vf_reset + * @vf: pointer to the VF structure +@@ -1390,9 +1416,11 @@ static void i40e_trigger_vf_reset(struct i40e_vf *vf, bool flr) + struct i40e_pf *pf = vf->pf; + struct i40e_hw *hw = &pf->hw; + u32 reg, reg_idx, bit_idx; ++ bool vf_active; ++ u32 radq; + + /* warn the VF */ +- clear_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states); ++ vf_active = test_and_clear_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states); + + /* Disable VF's configuration API during reset. The flag is re-enabled + * in i40e_alloc_vf_res(), when it's safe again to access VF's VSI. +@@ -1406,7 +1434,19 @@ static void i40e_trigger_vf_reset(struct i40e_vf *vf, bool flr) + * just need to clean up, so don't hit the VFRTRIG register. + */ + if (!flr) { +- /* reset VF using VPGEN_VFRTRIG reg */ ++ /* Sync VFR reset before trigger next one */ ++ radq = rd32(hw, I40E_VFINT_ICR0_ENA(vf->vf_id)) & ++ I40E_VFINT_ICR0_ADMINQ_MASK; ++ if (vf_active && !radq) ++ /* waiting for finish reset by virtual driver */ ++ if (i40e_sync_vfr_reset(hw, vf->vf_id)) ++ dev_info(&pf->pdev->dev, ++ "Reset VF %d never finished\n", ++ vf->vf_id); ++ ++ /* Reset VF using VPGEN_VFRTRIG reg. It is also setting ++ * in progress state in rstat1 register. ++ */ + reg = rd32(hw, I40E_VPGEN_VFRTRIG(vf->vf_id)); + reg |= I40E_VPGEN_VFRTRIG_VFSWR_MASK; + wr32(hw, I40E_VPGEN_VFRTRIG(vf->vf_id), reg); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h +index 49575a640a84c..03c42fd0fea19 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h +@@ -19,6 +19,7 @@ + #define I40E_MAX_VF_PROMISC_FLAGS 3 + + #define I40E_VF_STATE_WAIT_COUNT 20 ++#define I40E_VFR_WAIT_COUNT 100 + + /* Various queue ctrls */ + enum i40e_queue_ctrl { +-- +2.34.1 + diff --git a/queue-5.16/i40e-fix-issue-when-maximum-queues-is-exceeded.patch-11503 b/queue-5.16/i40e-fix-issue-when-maximum-queues-is-exceeded.patch-11503 new file mode 100644 index 00000000000..13dfcea0aa9 --- /dev/null +++ b/queue-5.16/i40e-fix-issue-when-maximum-queues-is-exceeded.patch-11503 @@ -0,0 +1,204 @@ +From 10b046f64ec7aea76c51d6b65c6cb13b922ad72d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Nov 2021 11:17:00 +0000 +Subject: i40e: Fix issue when maximum queues is exceeded + +From: Jedrzej Jagielski + +[ Upstream commit d701658a50a471591094b3eb3961b4926cc8f104 ] + +Before this patch VF interface vanished when +maximum queue number was exceeded. Driver tried +to add next queues even if there was not enough +space. PF sent incorrect number of queues to +the VF when there were not enough of them. + +Add an additional condition introduced to check +available space in 'qp_pile' before proceeding. +This condition makes it impossible to add queues +if they number is greater than the number resulting +from available space. +Also add the search for free space in PF queue +pair piles. + +Without this patch VF interfaces are not seen +when available space for queues has been +exceeded and following logs appears permanently +in dmesg: +"Unable to get VF config (-32)". +"VF 62 failed opcode 3, retval: -5" +"Unable to get VF config due to PF error condition, not retrying" + +Fixes: 7daa6bf3294e ("i40e: driver core headers") +Fixes: 41c445ff0f48 ("i40e: main driver core") +Signed-off-by: Jaroslaw Gawin +Signed-off-by: Slawomir Laba +Signed-off-by: Jedrzej Jagielski +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e.h | 1 - + drivers/net/ethernet/intel/i40e/i40e_main.c | 14 +---- + .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 59 +++++++++++++++++++ + 3 files changed, 61 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h +index 4d939af0a626c..c8cfe62d5e05f 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -174,7 +174,6 @@ enum i40e_interrupt_policy { + + struct i40e_lump_tracking { + u16 num_entries; +- u16 search_hint; + u16 list[0]; + #define I40E_PILE_VALID_BIT 0x8000 + #define I40E_IWARP_IRQ_PILE_ID (I40E_PILE_VALID_BIT - 2) +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 3895a1bf5b46c..4783b8c6755a6 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -196,10 +196,6 @@ int i40e_free_virt_mem_d(struct i40e_hw *hw, struct i40e_virt_mem *mem) + * @id: an owner id to stick on the items assigned + * + * Returns the base item index of the lump, or negative for error +- * +- * The search_hint trick and lack of advanced fit-finding only work +- * because we're highly likely to have all the same size lump requests. +- * Linear search time and any fragmentation should be minimal. + **/ + static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile, + u16 needed, u16 id) +@@ -214,8 +210,7 @@ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile, + return -EINVAL; + } + +- /* start the linear search with an imperfect hint */ +- i = pile->search_hint; ++ i = 0; + while (i < pile->num_entries) { + /* skip already allocated entries */ + if (pile->list[i] & I40E_PILE_VALID_BIT) { +@@ -234,7 +229,6 @@ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile, + for (j = 0; j < needed; j++) + pile->list[i+j] = id | I40E_PILE_VALID_BIT; + ret = i; +- pile->search_hint = i + j; + break; + } + +@@ -257,7 +251,7 @@ static int i40e_put_lump(struct i40e_lump_tracking *pile, u16 index, u16 id) + { + int valid_id = (id | I40E_PILE_VALID_BIT); + int count = 0; +- int i; ++ u16 i; + + if (!pile || index >= pile->num_entries) + return -EINVAL; +@@ -269,8 +263,6 @@ static int i40e_put_lump(struct i40e_lump_tracking *pile, u16 index, u16 id) + count++; + } + +- if (count && index < pile->search_hint) +- pile->search_hint = index; + + return count; + } +@@ -11786,7 +11778,6 @@ static int i40e_init_interrupt_scheme(struct i40e_pf *pf) + return -ENOMEM; + + pf->irq_pile->num_entries = vectors; +- pf->irq_pile->search_hint = 0; + + /* track first vector for misc interrupts, ignore return */ + (void)i40e_get_lump(pf, pf->irq_pile, 1, I40E_PILE_VALID_BIT - 1); +@@ -12589,7 +12580,6 @@ static int i40e_sw_init(struct i40e_pf *pf) + goto sw_init_done; + } + pf->qp_pile->num_entries = pf->hw.func_caps.num_tx_qp; +- pf->qp_pile->search_hint = 0; + + pf->tx_timeout_recovery_level = 1; + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 048f1678ab8ac..3e88d229b5e0b 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -2617,6 +2617,59 @@ error_param: + aq_ret); + } + ++/** ++ * i40e_check_enough_queue - find big enough queue number ++ * @vf: pointer to the VF info ++ * @needed: the number of items needed ++ * ++ * Returns the base item index of the queue, or negative for error ++ **/ ++static int i40e_check_enough_queue(struct i40e_vf *vf, u16 needed) ++{ ++ unsigned int i, cur_queues, more, pool_size; ++ struct i40e_lump_tracking *pile; ++ struct i40e_pf *pf = vf->pf; ++ struct i40e_vsi *vsi; ++ ++ vsi = pf->vsi[vf->lan_vsi_idx]; ++ cur_queues = vsi->alloc_queue_pairs; ++ ++ /* if current allocated queues are enough for need */ ++ if (cur_queues >= needed) ++ return vsi->base_queue; ++ ++ pile = pf->qp_pile; ++ if (cur_queues > 0) { ++ /* if the allocated queues are not zero ++ * just check if there are enough queues for more ++ * behind the allocated queues. ++ */ ++ more = needed - cur_queues; ++ for (i = vsi->base_queue + cur_queues; ++ i < pile->num_entries; i++) { ++ if (pile->list[i] & I40E_PILE_VALID_BIT) ++ break; ++ ++ if (more-- == 1) ++ /* there is enough */ ++ return vsi->base_queue; ++ } ++ } ++ ++ pool_size = 0; ++ for (i = 0; i < pile->num_entries; i++) { ++ if (pile->list[i] & I40E_PILE_VALID_BIT) { ++ pool_size = 0; ++ continue; ++ } ++ if (needed <= ++pool_size) ++ /* there is enough */ ++ return i; ++ } ++ ++ return -ENOMEM; ++} ++ + /** + * i40e_vc_request_queues_msg + * @vf: pointer to the VF info +@@ -2651,6 +2704,12 @@ static int i40e_vc_request_queues_msg(struct i40e_vf *vf, u8 *msg) + req_pairs - cur_pairs, + pf->queues_left); + vfres->num_queue_pairs = pf->queues_left + cur_pairs; ++ } else if (i40e_check_enough_queue(vf, req_pairs) < 0) { ++ dev_warn(&pf->pdev->dev, ++ "VF %d requested %d more queues, but there is not enough for it.\n", ++ vf->vf_id, ++ req_pairs - cur_pairs); ++ vfres->num_queue_pairs = cur_pairs; + } else { + /* successful request */ + vf->num_req_queues = req_pairs; +-- +2.34.1 + diff --git a/queue-5.16/i40e-fix-queues-reservation-for-xdp.patch-4884 b/queue-5.16/i40e-fix-queues-reservation-for-xdp.patch-4884 new file mode 100644 index 00000000000..855b3c6dc53 --- /dev/null +++ b/queue-5.16/i40e-fix-queues-reservation-for-xdp.patch-4884 @@ -0,0 +1,94 @@ +From c9eebeb00661aec257857743e06279e3bee50a01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Nov 2021 11:11:22 +0100 +Subject: i40e: Fix queues reservation for XDP + +From: Sylwester Dziedziuch + +[ Upstream commit 92947844b8beee988c0ce17082b705c2f75f0742 ] + +When XDP was configured on a system with large number of CPUs +and X722 NIC there was a call trace with NULL pointer dereference. + +i40e 0000:87:00.0: failed to get tracking for 256 queues for VSI 0 err -12 +i40e 0000:87:00.0: setup of MAIN VSI failed + +BUG: kernel NULL pointer dereference, address: 0000000000000000 +RIP: 0010:i40e_xdp+0xea/0x1b0 [i40e] +Call Trace: +? i40e_reconfig_rss_queues+0x130/0x130 [i40e] +dev_xdp_install+0x61/0xe0 +dev_xdp_attach+0x18a/0x4c0 +dev_change_xdp_fd+0x1e6/0x220 +do_setlink+0x616/0x1030 +? ahci_port_stop+0x80/0x80 +? ata_qc_issue+0x107/0x1e0 +? lock_timer_base+0x61/0x80 +? __mod_timer+0x202/0x380 +rtnl_setlink+0xe5/0x170 +? bpf_lsm_binder_transaction+0x10/0x10 +? security_capable+0x36/0x50 +rtnetlink_rcv_msg+0x121/0x350 +? rtnl_calcit.isra.0+0x100/0x100 +netlink_rcv_skb+0x50/0xf0 +netlink_unicast+0x1d3/0x2a0 +netlink_sendmsg+0x22a/0x440 +sock_sendmsg+0x5e/0x60 +__sys_sendto+0xf0/0x160 +? __sys_getsockname+0x7e/0xc0 +? _copy_from_user+0x3c/0x80 +? __sys_setsockopt+0xc8/0x1a0 +__x64_sys_sendto+0x20/0x30 +do_syscall_64+0x33/0x40 +entry_SYSCALL_64_after_hwframe+0x44/0xae +RIP: 0033:0x7f83fa7a39e0 + +This was caused by PF queue pile fragmentation due to +flow director VSI queue being placed right after main VSI. +Because of this main VSI was not able to resize its +queue allocation for XDP resulting in no queues allocated +for main VSI when XDP was turned on. + +Fix this by always allocating last queue in PF queue pile +for a flow director VSI. + +Fixes: 41c445ff0f48 ("i40e: main driver core") +Fixes: 74608d17fe29 ("i40e: add support for XDP_TX action") +Signed-off-by: Sylwester Dziedziuch +Signed-off-by: Mateusz Palczewski +Reviewed-by: Maciej Fijalkowski +Tested-by: Kiran Bhandare +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 4783b8c6755a6..7938db57e03bf 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -210,6 +210,20 @@ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile, + return -EINVAL; + } + ++ /* Allocate last queue in the pile for FDIR VSI queue ++ * so it doesn't fragment the qp_pile ++ */ ++ if (pile == pf->qp_pile && pf->vsi[id]->type == I40E_VSI_FDIR) { ++ if (pile->list[pile->num_entries - 1] & I40E_PILE_VALID_BIT) { ++ dev_err(&pf->pdev->dev, ++ "Cannot allocate queue %d for I40E_VSI_FDIR\n", ++ pile->num_entries - 1); ++ return -ENOMEM; ++ } ++ pile->list[pile->num_entries - 1] = id | I40E_PILE_VALID_BIT; ++ return pile->num_entries - 1; ++ } ++ + i = 0; + while (i < pile->num_entries) { + /* skip already allocated entries */ +-- +2.34.1 + diff --git a/queue-5.16/i40e-fix-unsigned-stat-widths.patch-11673 b/queue-5.16/i40e-fix-unsigned-stat-widths.patch-11673 new file mode 100644 index 00000000000..ef7a31aef5e --- /dev/null +++ b/queue-5.16/i40e-fix-unsigned-stat-widths.patch-11673 @@ -0,0 +1,79 @@ +From 30d4cca2618c5ee63214c140bbe704c9190815bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Dec 2021 17:56:33 -0800 +Subject: i40e: fix unsigned stat widths + +From: Joe Damato + +[ Upstream commit 3b8428b84539c78fdc8006c17ebd25afd4722d51 ] + +Change i40e_update_vsi_stats and struct i40e_vsi to use u64 fields to match +the width of the stats counters in struct i40e_rx_queue_stats. + +Update debugfs code to use the correct format specifier for u64. + +Fixes: 41c445ff0f48 ("i40e: main driver core") +Signed-off-by: Joe Damato +Reported-by: kernel test robot +Tested-by: Gurucharan G +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e.h | 8 ++++---- + drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 2 +- + drivers/net/ethernet/intel/i40e/i40e_main.c | 4 ++-- + 3 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h +index c8cfe62d5e05f..2e02cc68cd3f7 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -847,12 +847,12 @@ struct i40e_vsi { + struct rtnl_link_stats64 net_stats_offsets; + struct i40e_eth_stats eth_stats; + struct i40e_eth_stats eth_stats_offsets; +- u32 tx_restart; +- u32 tx_busy; ++ u64 tx_restart; ++ u64 tx_busy; + u64 tx_linearize; + u64 tx_force_wb; +- u32 rx_buf_failed; +- u32 rx_page_failed; ++ u64 rx_buf_failed; ++ u64 rx_page_failed; + + /* These are containers of ring pointers, allocated at run-time */ + struct i40e_ring **rx_rings; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c +index 2c1b1da1220ec..1e57cc8c47d7b 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c +@@ -240,7 +240,7 @@ static void i40e_dbg_dump_vsi_seid(struct i40e_pf *pf, int seid) + (unsigned long int)vsi->net_stats_offsets.rx_compressed, + (unsigned long int)vsi->net_stats_offsets.tx_compressed); + dev_info(&pf->pdev->dev, +- " tx_restart = %d, tx_busy = %d, rx_buf_failed = %d, rx_page_failed = %d\n", ++ " tx_restart = %llu, tx_busy = %llu, rx_buf_failed = %llu, rx_page_failed = %llu\n", + vsi->tx_restart, vsi->tx_busy, + vsi->rx_buf_failed, vsi->rx_page_failed); + rcu_read_lock(); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 7938db57e03bf..f605c0205e4e7 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -778,9 +778,9 @@ static void i40e_update_vsi_stats(struct i40e_vsi *vsi) + struct rtnl_link_stats64 *ns; /* netdev stats */ + struct i40e_eth_stats *oes; + struct i40e_eth_stats *es; /* device's eth stats */ +- u32 tx_restart, tx_busy; ++ u64 tx_restart, tx_busy; + struct i40e_ring *p; +- u32 rx_page, rx_buf; ++ u64 rx_page, rx_buf; + u64 bytes, packets; + unsigned int start; + u64 tx_linearize; +-- +2.34.1 + diff --git a/queue-5.16/i40e-increase-delay-to-1-s-after-global-emp-reset.patch-32655 b/queue-5.16/i40e-increase-delay-to-1-s-after-global-emp-reset.patch-32655 new file mode 100644 index 00000000000..3e62db33047 --- /dev/null +++ b/queue-5.16/i40e-increase-delay-to-1-s-after-global-emp-reset.patch-32655 @@ -0,0 +1,52 @@ +From af6ec1dc3c6474eb2fab9910821e758430d75e73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Oct 2021 13:51:14 +0000 +Subject: i40e: Increase delay to 1 s after global EMP reset + +From: Jedrzej Jagielski + +[ Upstream commit 9b13bd53134c9ddd544a790125199fdbdb505e67 ] + +Recently simplified i40e_rebuild causes that FW sometimes +is not ready after NVM update, the ping does not return. + +Increase the delay in case of EMP reset. +Old delay of 300 ms was introduced for specific cards for 710 series. +Now it works for all the cards and delay was increased. + +Fixes: 1fa51a650e1d ("i40e: Add delay after EMP reset for firmware to recover") +Signed-off-by: Arkadiusz Kubalewski +Signed-off-by: Jedrzej Jagielski +Tested-by: Gurucharan G +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 61afc220fc6cd..3895a1bf5b46c 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -10574,15 +10574,9 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired) + } + i40e_get_oem_version(&pf->hw); + +- if (test_bit(__I40E_EMP_RESET_INTR_RECEIVED, pf->state) && +- ((hw->aq.fw_maj_ver == 4 && hw->aq.fw_min_ver <= 33) || +- hw->aq.fw_maj_ver < 4) && hw->mac.type == I40E_MAC_XL710) { +- /* The following delay is necessary for 4.33 firmware and older +- * to recover after EMP reset. 200 ms should suffice but we +- * put here 300 ms to be sure that FW is ready to operate +- * after reset. +- */ +- mdelay(300); ++ if (test_and_clear_bit(__I40E_EMP_RESET_INTR_RECEIVED, pf->state)) { ++ /* The following delay is necessary for firmware update. */ ++ mdelay(1000); + } + + /* re-verify the eeprom if we just had an EMP reset */ +-- +2.34.1 + diff --git a/queue-5.16/ibmvnic-allow-extra-failures-before-disabling.patch-5412 b/queue-5.16/ibmvnic-allow-extra-failures-before-disabling.patch-5412 new file mode 100644 index 00000000000..49bfb8e9e10 --- /dev/null +++ b/queue-5.16/ibmvnic-allow-extra-failures-before-disabling.patch-5412 @@ -0,0 +1,77 @@ +From b001a412c451f336560bcdc2876d9a43eec156be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 18:59:18 -0800 +Subject: ibmvnic: Allow extra failures before disabling + +From: Sukadev Bhattiprolu + +[ Upstream commit db9f0e8bf79e6da7068b5818fea0ffd9d0d4b4da ] + +If auto-priority-failover (APF) is enabled and there are at least two +backing devices of different priorities, some resets like fail-over, +change-param etc can cause at least two back to back failovers. (Failover +from high priority backing device to lower priority one and then back +to the higher priority one if that is still functional). + +Depending on the timimg of the two failovers it is possible to trigger +a "hard" reset and for the hard reset to fail due to failovers. When this +occurs, the driver assumes that the network is unstable and disables the +VNIC for a 60-second "settling time". This in turn can cause the ethtool +command to fail with "No such device" while the vnic automatically recovers +a little while later. + +Given that it's possible to have two back to back failures, allow for extra +failures before disabling the vnic for the settling time. + +Fixes: f15fde9d47b8 ("ibmvnic: delay next reset if hard reset fails") +Signed-off-by: Sukadev Bhattiprolu +Reviewed-by: Dany Madden +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 0bb3911dd014d..9b2d16ad76f12 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -2598,6 +2598,7 @@ static void __ibmvnic_reset(struct work_struct *work) + struct ibmvnic_rwi *rwi; + unsigned long flags; + u32 reset_state; ++ int num_fails = 0; + int rc = 0; + + adapter = container_of(work, struct ibmvnic_adapter, ibmvnic_reset); +@@ -2651,11 +2652,23 @@ static void __ibmvnic_reset(struct work_struct *work) + rc = do_hard_reset(adapter, rwi, reset_state); + rtnl_unlock(); + } +- if (rc) { +- /* give backing device time to settle down */ ++ if (rc) ++ num_fails++; ++ else ++ num_fails = 0; ++ ++ /* If auto-priority-failover is enabled we can get ++ * back to back failovers during resets, resulting ++ * in at least two failed resets (from high-priority ++ * backing device to low-priority one and then back) ++ * If resets continue to fail beyond that, give the ++ * adapter some time to settle down before retrying. ++ */ ++ if (num_fails >= 3) { + netdev_dbg(adapter->netdev, +- "[S:%s] Hard reset failed, waiting 60 secs\n", +- adapter_state_to_string(adapter->state)); ++ "[S:%s] Hard reset failed %d times, waiting 60 secs\n", ++ adapter_state_to_string(adapter->state), ++ num_fails); + set_current_state(TASK_UNINTERRUPTIBLE); + schedule_timeout(60 * HZ); + } +-- +2.34.1 + diff --git a/queue-5.16/ibmvnic-don-t-spin-in-tasklet.patch-21382 b/queue-5.16/ibmvnic-don-t-spin-in-tasklet.patch-21382 new file mode 100644 index 00000000000..dce524e25d5 --- /dev/null +++ b/queue-5.16/ibmvnic-don-t-spin-in-tasklet.patch-21382 @@ -0,0 +1,47 @@ +From 2123561538a49be252965e3b6fd1d1adb9ff96b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 18:59:20 -0800 +Subject: ibmvnic: don't spin in tasklet + +From: Sukadev Bhattiprolu + +[ Upstream commit 48079e7fdd0269d66b1d7d66ae88bd03162464ad ] + +ibmvnic_tasklet() continuously spins waiting for responses to all +capability requests. It does this to avoid encountering an error +during initialization of the vnic. However if there is a bug in the +VIOS and we do not receive a response to one or more queries the +tasklet ends up spinning continuously leading to hard lock ups. + +If we fail to receive a message from the VIOS it is reasonable to +timeout the login attempt rather than spin indefinitely in the tasklet. + +Fixes: 249168ad07cd ("ibmvnic: Make CRQ interrupt tasklet wait for all capabilities crqs") +Signed-off-by: Sukadev Bhattiprolu +Reviewed-by: Dany Madden +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index acd488310bbce..682a440151a87 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -5491,12 +5491,6 @@ static void ibmvnic_tasklet(struct tasklet_struct *t) + ibmvnic_handle_crq(crq, adapter); + crq->generic.first = 0; + } +- +- /* remain in tasklet until all +- * capabilities responses are received +- */ +- if (!adapter->wait_capability) +- done = true; + } + /* if capabilities CRQ's were sent in this tasklet, the following + * tasklet must wait until all responses are received +-- +2.34.1 + diff --git a/queue-5.16/ibmvnic-init-running_cap_crqs-early.patch-9731 b/queue-5.16/ibmvnic-init-running_cap_crqs-early.patch-9731 new file mode 100644 index 00000000000..5827beae892 --- /dev/null +++ b/queue-5.16/ibmvnic-init-running_cap_crqs-early.patch-9731 @@ -0,0 +1,327 @@ +From 60f29fcae3a8349b9bd694ed0973f8feaf41a887 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 18:59:19 -0800 +Subject: ibmvnic: init ->running_cap_crqs early + +From: Sukadev Bhattiprolu + +[ Upstream commit 151b6a5c06b678687f64f2d9a99fd04d5cd32b72 ] + +We use ->running_cap_crqs to determine when the ibmvnic_tasklet() should +send out the next protocol message type. i.e when we get back responses +to all our QUERY_CAPABILITY CRQs we send out REQUEST_CAPABILITY crqs. +Similiary, when we get responses to all the REQUEST_CAPABILITY crqs, we +send out the QUERY_IP_OFFLOAD CRQ. + +We currently increment ->running_cap_crqs as we send out each CRQ and +have the ibmvnic_tasklet() send out the next message type, when this +running_cap_crqs count drops to 0. + +This assumes that all the CRQs of the current type were sent out before +the count drops to 0. However it is possible that we send out say 6 CRQs, +get preempted and receive all the 6 responses before we send out the +remaining CRQs. This can result in ->running_cap_crqs count dropping to +zero before all messages of the current type were sent and we end up +sending the next protocol message too early. + +Instead initialize the ->running_cap_crqs upfront so the tasklet will +only send the next protocol message after all responses are received. + +Use the cap_reqs local variable to also detect any discrepancy (either +now or in future) in the number of capability requests we actually send. + +Currently only send_query_cap() is affected by this behavior (of sending +next message early) since it is called from the worker thread (during +reset) and from application thread (during ->ndo_open()) and they can be +preempted. send_request_cap() is only called from the tasklet which +processes CRQ responses sequentially, is not be affected. But to +maintain the existing symmtery with send_query_capability() we update +send_request_capability() also. + +Fixes: 249168ad07cd ("ibmvnic: Make CRQ interrupt tasklet wait for all capabilities crqs") +Signed-off-by: Sukadev Bhattiprolu +Reviewed-by: Dany Madden +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 106 +++++++++++++++++++---------- + 1 file changed, 71 insertions(+), 35 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 9b2d16ad76f12..acd488310bbce 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -3849,11 +3849,25 @@ static void send_request_cap(struct ibmvnic_adapter *adapter, int retry) + struct device *dev = &adapter->vdev->dev; + union ibmvnic_crq crq; + int max_entries; ++ int cap_reqs; ++ ++ /* We send out 6 or 7 REQUEST_CAPABILITY CRQs below (depending on ++ * the PROMISC flag). Initialize this count upfront. When the tasklet ++ * receives a response to all of these, it will send the next protocol ++ * message (QUERY_IP_OFFLOAD). ++ */ ++ if (!(adapter->netdev->flags & IFF_PROMISC) || ++ adapter->promisc_supported) ++ cap_reqs = 7; ++ else ++ cap_reqs = 6; + + if (!retry) { + /* Sub-CRQ entries are 32 byte long */ + int entries_page = 4 * PAGE_SIZE / (sizeof(u64) * 4); + ++ atomic_set(&adapter->running_cap_crqs, cap_reqs); ++ + if (adapter->min_tx_entries_per_subcrq > entries_page || + adapter->min_rx_add_entries_per_subcrq > entries_page) { + dev_err(dev, "Fatal, invalid entries per sub-crq\n"); +@@ -3914,44 +3928,45 @@ static void send_request_cap(struct ibmvnic_adapter *adapter, int retry) + adapter->opt_rx_comp_queues; + + adapter->req_rx_add_queues = adapter->max_rx_add_queues; ++ } else { ++ atomic_add(cap_reqs, &adapter->running_cap_crqs); + } +- + memset(&crq, 0, sizeof(crq)); + crq.request_capability.first = IBMVNIC_CRQ_CMD; + crq.request_capability.cmd = REQUEST_CAPABILITY; + + crq.request_capability.capability = cpu_to_be16(REQ_TX_QUEUES); + crq.request_capability.number = cpu_to_be64(adapter->req_tx_queues); +- atomic_inc(&adapter->running_cap_crqs); ++ cap_reqs--; + ibmvnic_send_crq(adapter, &crq); + + crq.request_capability.capability = cpu_to_be16(REQ_RX_QUEUES); + crq.request_capability.number = cpu_to_be64(adapter->req_rx_queues); +- atomic_inc(&adapter->running_cap_crqs); ++ cap_reqs--; + ibmvnic_send_crq(adapter, &crq); + + crq.request_capability.capability = cpu_to_be16(REQ_RX_ADD_QUEUES); + crq.request_capability.number = cpu_to_be64(adapter->req_rx_add_queues); +- atomic_inc(&adapter->running_cap_crqs); ++ cap_reqs--; + ibmvnic_send_crq(adapter, &crq); + + crq.request_capability.capability = + cpu_to_be16(REQ_TX_ENTRIES_PER_SUBCRQ); + crq.request_capability.number = + cpu_to_be64(adapter->req_tx_entries_per_subcrq); +- atomic_inc(&adapter->running_cap_crqs); ++ cap_reqs--; + ibmvnic_send_crq(adapter, &crq); + + crq.request_capability.capability = + cpu_to_be16(REQ_RX_ADD_ENTRIES_PER_SUBCRQ); + crq.request_capability.number = + cpu_to_be64(adapter->req_rx_add_entries_per_subcrq); +- atomic_inc(&adapter->running_cap_crqs); ++ cap_reqs--; + ibmvnic_send_crq(adapter, &crq); + + crq.request_capability.capability = cpu_to_be16(REQ_MTU); + crq.request_capability.number = cpu_to_be64(adapter->req_mtu); +- atomic_inc(&adapter->running_cap_crqs); ++ cap_reqs--; + ibmvnic_send_crq(adapter, &crq); + + if (adapter->netdev->flags & IFF_PROMISC) { +@@ -3959,16 +3974,21 @@ static void send_request_cap(struct ibmvnic_adapter *adapter, int retry) + crq.request_capability.capability = + cpu_to_be16(PROMISC_REQUESTED); + crq.request_capability.number = cpu_to_be64(1); +- atomic_inc(&adapter->running_cap_crqs); ++ cap_reqs--; + ibmvnic_send_crq(adapter, &crq); + } + } else { + crq.request_capability.capability = + cpu_to_be16(PROMISC_REQUESTED); + crq.request_capability.number = cpu_to_be64(0); +- atomic_inc(&adapter->running_cap_crqs); ++ cap_reqs--; + ibmvnic_send_crq(adapter, &crq); + } ++ ++ /* Keep at end to catch any discrepancy between expected and actual ++ * CRQs sent. ++ */ ++ WARN_ON(cap_reqs != 0); + } + + static int pending_scrq(struct ibmvnic_adapter *adapter, +@@ -4362,118 +4382,132 @@ static void send_query_map(struct ibmvnic_adapter *adapter) + static void send_query_cap(struct ibmvnic_adapter *adapter) + { + union ibmvnic_crq crq; ++ int cap_reqs; ++ ++ /* We send out 25 QUERY_CAPABILITY CRQs below. Initialize this count ++ * upfront. When the tasklet receives a response to all of these, it ++ * can send out the next protocol messaage (REQUEST_CAPABILITY). ++ */ ++ cap_reqs = 25; ++ ++ atomic_set(&adapter->running_cap_crqs, cap_reqs); + +- atomic_set(&adapter->running_cap_crqs, 0); + memset(&crq, 0, sizeof(crq)); + crq.query_capability.first = IBMVNIC_CRQ_CMD; + crq.query_capability.cmd = QUERY_CAPABILITY; + + crq.query_capability.capability = cpu_to_be16(MIN_TX_QUEUES); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = cpu_to_be16(MIN_RX_QUEUES); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = cpu_to_be16(MIN_RX_ADD_QUEUES); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = cpu_to_be16(MAX_TX_QUEUES); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = cpu_to_be16(MAX_RX_QUEUES); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = cpu_to_be16(MAX_RX_ADD_QUEUES); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = + cpu_to_be16(MIN_TX_ENTRIES_PER_SUBCRQ); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = + cpu_to_be16(MIN_RX_ADD_ENTRIES_PER_SUBCRQ); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = + cpu_to_be16(MAX_TX_ENTRIES_PER_SUBCRQ); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = + cpu_to_be16(MAX_RX_ADD_ENTRIES_PER_SUBCRQ); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = cpu_to_be16(TCP_IP_OFFLOAD); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = cpu_to_be16(PROMISC_SUPPORTED); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = cpu_to_be16(MIN_MTU); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = cpu_to_be16(MAX_MTU); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = cpu_to_be16(MAX_MULTICAST_FILTERS); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = cpu_to_be16(VLAN_HEADER_INSERTION); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = cpu_to_be16(RX_VLAN_HEADER_INSERTION); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = cpu_to_be16(MAX_TX_SG_ENTRIES); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = cpu_to_be16(RX_SG_SUPPORTED); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = cpu_to_be16(OPT_TX_COMP_SUB_QUEUES); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = cpu_to_be16(OPT_RX_COMP_QUEUES); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = + cpu_to_be16(OPT_RX_BUFADD_Q_PER_RX_COMP_Q); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = + cpu_to_be16(OPT_TX_ENTRIES_PER_SUBCRQ); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = + cpu_to_be16(OPT_RXBA_ENTRIES_PER_SUBCRQ); +- atomic_inc(&adapter->running_cap_crqs); + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; + + crq.query_capability.capability = cpu_to_be16(TX_RX_DESC_REQ); +- atomic_inc(&adapter->running_cap_crqs); ++ + ibmvnic_send_crq(adapter, &crq); ++ cap_reqs--; ++ ++ /* Keep at end to catch any discrepancy between expected and actual ++ * CRQs sent. ++ */ ++ WARN_ON(cap_reqs != 0); + } + + static void send_query_ip_offload(struct ibmvnic_adapter *adapter) +@@ -4777,6 +4811,8 @@ static void handle_request_cap_rsp(union ibmvnic_crq *crq, + char *name; + + atomic_dec(&adapter->running_cap_crqs); ++ netdev_dbg(adapter->netdev, "Outstanding request-caps: %d\n", ++ atomic_read(&adapter->running_cap_crqs)); + switch (be16_to_cpu(crq->request_capability_rsp.capability)) { + case REQ_TX_QUEUES: + req_value = &adapter->req_tx_queues; +-- +2.34.1 + diff --git a/queue-5.16/io_uring-fix-bug-in-slow-unregistering-of-nodes.patch-12857 b/queue-5.16/io_uring-fix-bug-in-slow-unregistering-of-nodes.patch-12857 new file mode 100644 index 00000000000..b126854f550 --- /dev/null +++ b/queue-5.16/io_uring-fix-bug-in-slow-unregistering-of-nodes.patch-12857 @@ -0,0 +1,61 @@ +From c5596e110bbc3fce5b86c2eef05ea150d3adaf8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 04:38:56 -0800 +Subject: io_uring: fix bug in slow unregistering of nodes + +From: Dylan Yudaken + +[ Upstream commit b36a2050040b2d839bdc044007cdd57101d7f881 ] + +In some cases io_rsrc_ref_quiesce will call io_rsrc_node_switch_start, +and then immediately flush the delayed work queue &ctx->rsrc_put_work. + +However the percpu_ref_put does not immediately destroy the node, it +will be called asynchronously via RCU. That ends up with +io_rsrc_node_ref_zero only being called after rsrc_put_work has been +flushed, and so the process ends up sleeping for 1 second unnecessarily. + +This patch executes the put code immediately if we are busy +quiescing. + +Fixes: 4a38aed2a0a7 ("io_uring: batch reap of dead file registrations") +Signed-off-by: Dylan Yudaken +Link: https://lore.kernel.org/r/20220121123856.3557884-1-dylany@fb.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/io_uring.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 15f303180d70c..698db7fb62e06 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -7761,10 +7761,15 @@ static __cold void io_rsrc_node_ref_zero(struct percpu_ref *ref) + struct io_ring_ctx *ctx = node->rsrc_data->ctx; + unsigned long flags; + bool first_add = false; ++ unsigned long delay = HZ; + + spin_lock_irqsave(&ctx->rsrc_ref_lock, flags); + node->done = true; + ++ /* if we are mid-quiesce then do not delay */ ++ if (node->rsrc_data->quiesce) ++ delay = 0; ++ + while (!list_empty(&ctx->rsrc_ref_list)) { + node = list_first_entry(&ctx->rsrc_ref_list, + struct io_rsrc_node, node); +@@ -7777,7 +7782,7 @@ static __cold void io_rsrc_node_ref_zero(struct percpu_ref *ref) + spin_unlock_irqrestore(&ctx->rsrc_ref_lock, flags); + + if (first_add) +- mod_delayed_work(system_wq, &ctx->rsrc_put_work, HZ); ++ mod_delayed_work(system_wq, &ctx->rsrc_put_work, delay); + } + + static struct io_rsrc_node *io_rsrc_node_alloc(struct io_ring_ctx *ctx) +-- +2.34.1 + diff --git a/queue-5.16/ipv4-avoid-using-shared-ip-generator-for-connected-s.patch-8646 b/queue-5.16/ipv4-avoid-using-shared-ip-generator-for-connected-s.patch-8646 new file mode 100644 index 00000000000..81190c953d2 --- /dev/null +++ b/queue-5.16/ipv4-avoid-using-shared-ip-generator-for-connected-s.patch-8646 @@ -0,0 +1,70 @@ +From f4805b91783bb2a1d631e84cd50620be4a5e157e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jan 2022 17:10:22 -0800 +Subject: ipv4: avoid using shared IP generator for connected sockets + +From: Eric Dumazet + +[ Upstream commit 23f57406b82de51809d5812afd96f210f8b627f3 ] + +ip_select_ident_segs() has been very conservative about using +the connected socket private generator only for packets with IP_DF +set, claiming it was needed for some VJ compression implementations. + +As mentioned in this referenced document, this can be abused. +(Ref: Off-Path TCP Exploits of the Mixed IPID Assignment) + +Before switching to pure random IPID generation and possibly hurt +some workloads, lets use the private inet socket generator. + +Not only this will remove one vulnerability, this will also +improve performance of TCP flows using pmtudisc==IP_PMTUDISC_DONT + +Fixes: 73f156a6e8c1 ("inetpeer: get rid of ip_id_count") +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Reported-by: Ray Che +Cc: Willy Tarreau +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/ip.h | 21 ++++++++++----------- + 1 file changed, 10 insertions(+), 11 deletions(-) + +diff --git a/include/net/ip.h b/include/net/ip.h +index b71e88507c4a0..ff68af118020a 100644 +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -525,19 +525,18 @@ static inline void ip_select_ident_segs(struct net *net, struct sk_buff *skb, + { + struct iphdr *iph = ip_hdr(skb); + ++ /* We had many attacks based on IPID, use the private ++ * generator as much as we can. ++ */ ++ if (sk && inet_sk(sk)->inet_daddr) { ++ iph->id = htons(inet_sk(sk)->inet_id); ++ inet_sk(sk)->inet_id += segs; ++ return; ++ } + if ((iph->frag_off & htons(IP_DF)) && !skb->ignore_df) { +- /* This is only to work around buggy Windows95/2000 +- * VJ compression implementations. If the ID field +- * does not change, they drop every other packet in +- * a TCP stream using header compression. +- */ +- if (sk && inet_sk(sk)->inet_daddr) { +- iph->id = htons(inet_sk(sk)->inet_id); +- inet_sk(sk)->inet_id += segs; +- } else { +- iph->id = 0; +- } ++ iph->id = 0; + } else { ++ /* Unfortunately we need the big hammer to get a suitable IPID */ + __ip_select_ident(net, iph, segs); + } + } +-- +2.34.1 + diff --git a/queue-5.16/ipv4-fix-ip-option-filtering-for-locally-generated-f.patch-20660 b/queue-5.16/ipv4-fix-ip-option-filtering-for-locally-generated-f.patch-20660 new file mode 100644 index 00000000000..7a47eda8124 --- /dev/null +++ b/queue-5.16/ipv4-fix-ip-option-filtering-for-locally-generated-f.patch-20660 @@ -0,0 +1,111 @@ +From f266a7e39b71ed30aa7ceb7886b4692f442b7f2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 16:57:31 -0800 +Subject: ipv4: fix ip option filtering for locally generated fragments + +From: Jakub Kicinski + +[ Upstream commit 27a8caa59babb96c5890569e131bc0eb6d45daee ] + +During IP fragmentation we sanitize IP options. This means overwriting +options which should not be copied with NOPs. Only the first fragment +has the original, full options. + +ip_fraglist_prepare() copies the IP header and options from previous +fragment to the next one. Commit 19c3401a917b ("net: ipv4: place control +buffer handling away from fragmentation iterators") moved sanitizing +options before ip_fraglist_prepare() which means options are sanitized +and then overwritten again with the old values. + +Fixing this is not enough, however, nor did the sanitization work +prior to aforementioned commit. + +ip_options_fragment() (which does the sanitization) uses ipcb->opt.optlen +for the length of the options. ipcb->opt of fragments is not populated +(it's 0), only the head skb has the state properly built. So even when +called at the right time ip_options_fragment() does nothing. This seems +to date back all the way to v2.5.44 when the fast path for pre-fragmented +skbs had been introduced. Prior to that ip_options_build() would have been +called for every fragment (in fact ever since v2.5.44 the fragmentation +handing in ip_options_build() has been dead code, I'll clean it up in +-next). + +In the original patch (see Link) caixf mentions fixing the handling +for fragments other than the second one, but I'm not sure how _any_ +fragment could have had their options sanitized with the code +as it stood. + +Tested with python (MTU on lo lowered to 1000 to force fragmentation): + + import socket + s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) + s.setsockopt(socket.IPPROTO_IP, socket.IP_OPTIONS, + bytearray([7,4,5,192, 20|0x80,4,1,0])) + s.sendto(b'1'*2000, ('127.0.0.1', 1234)) + +Before: + +IP (tos 0x0, ttl 64, id 1053, offset 0, flags [+], proto UDP (17), length 996, options (RR [bad length 4] [bad ptr 5] 192.148.4.1,,RA value 256)) + localhost.36500 > localhost.search-agent: UDP, length 2000 +IP (tos 0x0, ttl 64, id 1053, offset 968, flags [+], proto UDP (17), length 996, options (RR [bad length 4] [bad ptr 5] 192.148.4.1,,RA value 256)) + localhost > localhost: udp +IP (tos 0x0, ttl 64, id 1053, offset 1936, flags [none], proto UDP (17), length 100, options (RR [bad length 4] [bad ptr 5] 192.148.4.1,,RA value 256)) + localhost > localhost: udp + +After: + +IP (tos 0x0, ttl 96, id 42549, offset 0, flags [+], proto UDP (17), length 996, options (RR [bad length 4] [bad ptr 5] 192.148.4.1,,RA value 256)) + localhost.51607 > localhost.search-agent: UDP, bad length 2000 > 960 +IP (tos 0x0, ttl 96, id 42549, offset 968, flags [+], proto UDP (17), length 996, options (NOP,NOP,NOP,NOP,RA value 256)) + localhost > localhost: udp +IP (tos 0x0, ttl 96, id 42549, offset 1936, flags [none], proto UDP (17), length 100, options (NOP,NOP,NOP,NOP,RA value 256)) + localhost > localhost: udp + +RA (20 | 0x80) is now copied as expected, RR (7) is "NOPed out". + +Link: https://lore.kernel.org/netdev/20220107080559.122713-1-ooppublic@163.com/ +Fixes: 19c3401a917b ("net: ipv4: place control buffer handling away from fragmentation iterators") +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: caixf +Signed-off-by: Jakub Kicinski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_output.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index 9bca57ef8b838..ff38b46bd4b0f 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -826,15 +826,24 @@ int ip_do_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, + /* Everything is OK. Generate! */ + ip_fraglist_init(skb, iph, hlen, &iter); + +- if (iter.frag) +- ip_options_fragment(iter.frag); +- + for (;;) { + /* Prepare header of the next frame, + * before previous one went down. */ + if (iter.frag) { ++ bool first_frag = (iter.offset == 0); ++ + IPCB(iter.frag)->flags = IPCB(skb)->flags; + ip_fraglist_prepare(skb, &iter); ++ if (first_frag && IPCB(skb)->opt.optlen) { ++ /* ipcb->opt is not populated for frags ++ * coming from __ip_make_skb(), ++ * ip_options_fragment() needs optlen ++ */ ++ IPCB(iter.frag)->opt.optlen = ++ IPCB(skb)->opt.optlen; ++ ip_options_fragment(iter.frag); ++ ip_send_check(iter.iph); ++ } + } + + skb->tstamp = tstamp; +-- +2.34.1 + diff --git a/queue-5.16/ipv4-raw-lock-the-socket-in-raw_bind.patch-29357 b/queue-5.16/ipv4-raw-lock-the-socket-in-raw_bind.patch-29357 new file mode 100644 index 00000000000..771ec803654 --- /dev/null +++ b/queue-5.16/ipv4-raw-lock-the-socket-in-raw_bind.patch-29357 @@ -0,0 +1,78 @@ +From e816cada1e14a4491e426ae888800e86bc1f9d31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jan 2022 16:51:16 -0800 +Subject: ipv4: raw: lock the socket in raw_bind() + +From: Eric Dumazet + +[ Upstream commit 153a0d187e767c68733b8e9f46218eb1f41ab902 ] + +For some reason, raw_bind() forgot to lock the socket. + +BUG: KCSAN: data-race in __ip4_datagram_connect / raw_bind + +write to 0xffff8881170d4308 of 4 bytes by task 5466 on cpu 0: + raw_bind+0x1b0/0x250 net/ipv4/raw.c:739 + inet_bind+0x56/0xa0 net/ipv4/af_inet.c:443 + __sys_bind+0x14b/0x1b0 net/socket.c:1697 + __do_sys_bind net/socket.c:1708 [inline] + __se_sys_bind net/socket.c:1706 [inline] + __x64_sys_bind+0x3d/0x50 net/socket.c:1706 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +read to 0xffff8881170d4308 of 4 bytes by task 5468 on cpu 1: + __ip4_datagram_connect+0xb7/0x7b0 net/ipv4/datagram.c:39 + ip4_datagram_connect+0x2a/0x40 net/ipv4/datagram.c:89 + inet_dgram_connect+0x107/0x190 net/ipv4/af_inet.c:576 + __sys_connect_file net/socket.c:1900 [inline] + __sys_connect+0x197/0x1b0 net/socket.c:1917 + __do_sys_connect net/socket.c:1927 [inline] + __se_sys_connect net/socket.c:1924 [inline] + __x64_sys_connect+0x3d/0x50 net/socket.c:1924 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +value changed: 0x00000000 -> 0x0003007f + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 PID: 5468 Comm: syz-executor.5 Not tainted 5.17.0-rc1-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/raw.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c +index bb446e60cf580..b8689052079cd 100644 +--- a/net/ipv4/raw.c ++++ b/net/ipv4/raw.c +@@ -721,6 +721,7 @@ static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len) + int ret = -EINVAL; + int chk_addr_ret; + ++ lock_sock(sk); + if (sk->sk_state != TCP_CLOSE || addr_len < sizeof(struct sockaddr_in)) + goto out; + +@@ -740,7 +741,9 @@ static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len) + inet->inet_saddr = 0; /* Use device */ + sk_dst_reset(sk); + ret = 0; +-out: return ret; ++out: ++ release_sock(sk); ++ return ret; + } + + /* +-- +2.34.1 + diff --git a/queue-5.16/ipv4-remove-sparse-error-in-ip_neigh_gw4.patch-21843 b/queue-5.16/ipv4-remove-sparse-error-in-ip_neigh_gw4.patch-21843 new file mode 100644 index 00000000000..d8cd967139a --- /dev/null +++ b/queue-5.16/ipv4-remove-sparse-error-in-ip_neigh_gw4.patch-21843 @@ -0,0 +1,39 @@ +From c143a94e0c0b2da928f51c6fec13bded49b3870c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jan 2022 17:34:04 -0800 +Subject: ipv4: remove sparse error in ip_neigh_gw4() + +From: Eric Dumazet + +[ Upstream commit 3c42b2019863b327caa233072c50739d4144dd16 ] + +./include/net/route.h:373:48: warning: incorrect type in argument 2 (different base types) +./include/net/route.h:373:48: expected unsigned int [usertype] key +./include/net/route.h:373:48: got restricted __be32 [usertype] daddr + +Fixes: 5c9f7c1dfc2e ("ipv4: Add helpers for neigh lookup for nexthop") +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/20220127013404.1279313-1-eric.dumazet@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/route.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/net/route.h b/include/net/route.h +index 2e6c0e153e3a5..2551f3f03b37e 100644 +--- a/include/net/route.h ++++ b/include/net/route.h +@@ -369,7 +369,7 @@ static inline struct neighbour *ip_neigh_gw4(struct net_device *dev, + { + struct neighbour *neigh; + +- neigh = __ipv4_neigh_lookup_noref(dev, daddr); ++ neigh = __ipv4_neigh_lookup_noref(dev, (__force u32)daddr); + if (unlikely(!neigh)) + neigh = __neigh_create(&arp_tbl, &daddr, dev, false); + +-- +2.34.1 + diff --git a/queue-5.16/ipv4-tcp-send-zero-ipid-in-synack-messages.patch-9420 b/queue-5.16/ipv4-tcp-send-zero-ipid-in-synack-messages.patch-9420 new file mode 100644 index 00000000000..261324e3e7a --- /dev/null +++ b/queue-5.16/ipv4-tcp-send-zero-ipid-in-synack-messages.patch-9420 @@ -0,0 +1,77 @@ +From 146a14c7caa52078e065eb07c6ee0038aff7e783 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jan 2022 17:10:21 -0800 +Subject: ipv4: tcp: send zero IPID in SYNACK messages + +From: Eric Dumazet + +[ Upstream commit 970a5a3ea86da637471d3cd04d513a0755aba4bf ] + +In commit 431280eebed9 ("ipv4: tcp: send zero IPID for RST and +ACK sent in SYN-RECV and TIME-WAIT state") we took care of some +ctl packets sent by TCP. + +It turns out we need to use a similar strategy for SYNACK packets. + +By default, they carry IP_DF and IPID==0, but there are ways +to ask them to use the hashed IP ident generator and thus +be used to build off-path attacks. +(Ref: Off-Path TCP Exploits of the Mixed IPID Assignment) + +One of this way is to force (before listener is started) +echo 1 >/proc/sys/net/ipv4/ip_no_pmtu_disc + +Another way is using forged ICMP ICMP_FRAG_NEEDED +with a very small MTU (like 68) to force a false return from +ip_dont_fragment() + +In this patch, ip_build_and_send_pkt() uses the following +heuristics. + +1) Most SYNACK packets are smaller than IPV4_MIN_MTU and therefore +can use IP_DF regardless of the listener or route pmtu setting. + +2) In case the SYNACK packet is bigger than IPV4_MIN_MTU, +we use prandom_u32() generator instead of the IPv4 hashed ident one. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Reported-by: Ray Che +Reviewed-by: David Ahern +Cc: Geoff Alexander +Cc: Willy Tarreau +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_output.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index ff38b46bd4b0f..a4d2eb691cbc1 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -162,12 +162,19 @@ int ip_build_and_send_pkt(struct sk_buff *skb, const struct sock *sk, + iph->daddr = (opt && opt->opt.srr ? opt->opt.faddr : daddr); + iph->saddr = saddr; + iph->protocol = sk->sk_protocol; +- if (ip_dont_fragment(sk, &rt->dst)) { ++ /* Do not bother generating IPID for small packets (eg SYNACK) */ ++ if (skb->len <= IPV4_MIN_MTU || ip_dont_fragment(sk, &rt->dst)) { + iph->frag_off = htons(IP_DF); + iph->id = 0; + } else { + iph->frag_off = 0; +- __ip_select_ident(net, iph, 1); ++ /* TCP packets here are SYNACK with fat IPv4/TCP options. ++ * Avoid using the hashed IP ident generator. ++ */ ++ if (sk->sk_protocol == IPPROTO_TCP) ++ iph->id = (__force __be16)prandom_u32(); ++ else ++ __ip_select_ident(net, iph, 1); + } + + if (opt && opt->opt.optlen) { +-- +2.34.1 + diff --git a/queue-5.16/ipv6-annotate-accesses-to-fn-fn_sernum.patch-15640 b/queue-5.16/ipv6-annotate-accesses-to-fn-fn_sernum.patch-15640 new file mode 100644 index 00000000000..eb09a453382 --- /dev/null +++ b/queue-5.16/ipv6-annotate-accesses-to-fn-fn_sernum.patch-15640 @@ -0,0 +1,197 @@ +From 1e0c49424fcb55a91427eeb2ead5286ce0f81cd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jan 2022 09:41:12 -0800 +Subject: ipv6: annotate accesses to fn->fn_sernum + +From: Eric Dumazet + +[ Upstream commit aafc2e3285c2d7a79b7ee15221c19fbeca7b1509 ] + +struct fib6_node's fn_sernum field can be +read while other threads change it. + +Add READ_ONCE()/WRITE_ONCE() annotations. + +Do not change existing smp barriers in fib6_get_cookie_safe() +and __fib6_update_sernum_upto_root() + +syzbot reported: + +BUG: KCSAN: data-race in fib6_clean_node / inet6_csk_route_socket + +write to 0xffff88813df62e2c of 4 bytes by task 1920 on cpu 1: + fib6_clean_node+0xc2/0x260 net/ipv6/ip6_fib.c:2178 + fib6_walk_continue+0x38e/0x430 net/ipv6/ip6_fib.c:2112 + fib6_walk net/ipv6/ip6_fib.c:2160 [inline] + fib6_clean_tree net/ipv6/ip6_fib.c:2240 [inline] + __fib6_clean_all+0x1a9/0x2e0 net/ipv6/ip6_fib.c:2256 + fib6_flush_trees+0x6c/0x80 net/ipv6/ip6_fib.c:2281 + rt_genid_bump_ipv6 include/net/net_namespace.h:488 [inline] + addrconf_dad_completed+0x57f/0x870 net/ipv6/addrconf.c:4230 + addrconf_dad_work+0x908/0x1170 + process_one_work+0x3f6/0x960 kernel/workqueue.c:2307 + worker_thread+0x616/0xa70 kernel/workqueue.c:2454 + kthread+0x1bf/0x1e0 kernel/kthread.c:359 + ret_from_fork+0x1f/0x30 + +read to 0xffff88813df62e2c of 4 bytes by task 15701 on cpu 0: + fib6_get_cookie_safe include/net/ip6_fib.h:285 [inline] + rt6_get_cookie include/net/ip6_fib.h:306 [inline] + ip6_dst_store include/net/ip6_route.h:234 [inline] + inet6_csk_route_socket+0x352/0x3c0 net/ipv6/inet6_connection_sock.c:109 + inet6_csk_xmit+0x91/0x1e0 net/ipv6/inet6_connection_sock.c:121 + __tcp_transmit_skb+0x1323/0x1840 net/ipv4/tcp_output.c:1402 + tcp_transmit_skb net/ipv4/tcp_output.c:1420 [inline] + tcp_write_xmit+0x1450/0x4460 net/ipv4/tcp_output.c:2680 + __tcp_push_pending_frames+0x68/0x1c0 net/ipv4/tcp_output.c:2864 + tcp_push+0x2d9/0x2f0 net/ipv4/tcp.c:725 + mptcp_push_release net/mptcp/protocol.c:1491 [inline] + __mptcp_push_pending+0x46c/0x490 net/mptcp/protocol.c:1578 + mptcp_sendmsg+0x9ec/0xa50 net/mptcp/protocol.c:1764 + inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:643 + sock_sendmsg_nosec net/socket.c:705 [inline] + sock_sendmsg net/socket.c:725 [inline] + kernel_sendmsg+0x97/0xd0 net/socket.c:745 + sock_no_sendpage+0x84/0xb0 net/core/sock.c:3086 + inet_sendpage+0x9d/0xc0 net/ipv4/af_inet.c:834 + kernel_sendpage+0x187/0x200 net/socket.c:3492 + sock_sendpage+0x5a/0x70 net/socket.c:1007 + pipe_to_sendpage+0x128/0x160 fs/splice.c:364 + splice_from_pipe_feed fs/splice.c:418 [inline] + __splice_from_pipe+0x207/0x500 fs/splice.c:562 + splice_from_pipe fs/splice.c:597 [inline] + generic_splice_sendpage+0x94/0xd0 fs/splice.c:746 + do_splice_from fs/splice.c:767 [inline] + direct_splice_actor+0x80/0xa0 fs/splice.c:936 + splice_direct_to_actor+0x345/0x650 fs/splice.c:891 + do_splice_direct+0x106/0x190 fs/splice.c:979 + do_sendfile+0x675/0xc40 fs/read_write.c:1245 + __do_sys_sendfile64 fs/read_write.c:1310 [inline] + __se_sys_sendfile64 fs/read_write.c:1296 [inline] + __x64_sys_sendfile64+0x102/0x140 fs/read_write.c:1296 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +value changed: 0x0000026f -> 0x00000271 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 0 PID: 15701 Comm: syz-executor.2 Not tainted 5.16.0-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 + +The Fixes tag I chose is probably arbitrary, I do not think +we need to backport this patch to older kernels. + +Fixes: c5cff8561d2d ("ipv6: add rcu grace period before freeing fib6_node") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Link: https://lore.kernel.org/r/20220120174112.1126644-1-eric.dumazet@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/ip6_fib.h | 2 +- + net/ipv6/ip6_fib.c | 23 +++++++++++++---------- + net/ipv6/route.c | 2 +- + 3 files changed, 15 insertions(+), 12 deletions(-) + +diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h +index 83b8070d1cc93..c85b040728d7e 100644 +--- a/include/net/ip6_fib.h ++++ b/include/net/ip6_fib.h +@@ -281,7 +281,7 @@ static inline bool fib6_get_cookie_safe(const struct fib6_info *f6i, + fn = rcu_dereference(f6i->fib6_node); + + if (fn) { +- *cookie = fn->fn_sernum; ++ *cookie = READ_ONCE(fn->fn_sernum); + /* pairs with smp_wmb() in __fib6_update_sernum_upto_root() */ + smp_rmb(); + status = true; +diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c +index 0371d2c141455..a506e57c4032a 100644 +--- a/net/ipv6/ip6_fib.c ++++ b/net/ipv6/ip6_fib.c +@@ -111,7 +111,7 @@ void fib6_update_sernum(struct net *net, struct fib6_info *f6i) + fn = rcu_dereference_protected(f6i->fib6_node, + lockdep_is_held(&f6i->fib6_table->tb6_lock)); + if (fn) +- fn->fn_sernum = fib6_new_sernum(net); ++ WRITE_ONCE(fn->fn_sernum, fib6_new_sernum(net)); + } + + /* +@@ -589,12 +589,13 @@ static int fib6_dump_table(struct fib6_table *table, struct sk_buff *skb, + spin_unlock_bh(&table->tb6_lock); + if (res > 0) { + cb->args[4] = 1; +- cb->args[5] = w->root->fn_sernum; ++ cb->args[5] = READ_ONCE(w->root->fn_sernum); + } + } else { +- if (cb->args[5] != w->root->fn_sernum) { ++ int sernum = READ_ONCE(w->root->fn_sernum); ++ if (cb->args[5] != sernum) { + /* Begin at the root if the tree changed */ +- cb->args[5] = w->root->fn_sernum; ++ cb->args[5] = sernum; + w->state = FWS_INIT; + w->node = w->root; + w->skip = w->count; +@@ -1344,7 +1345,7 @@ static void __fib6_update_sernum_upto_root(struct fib6_info *rt, + /* paired with smp_rmb() in fib6_get_cookie_safe() */ + smp_wmb(); + while (fn) { +- fn->fn_sernum = sernum; ++ WRITE_ONCE(fn->fn_sernum, sernum); + fn = rcu_dereference_protected(fn->parent, + lockdep_is_held(&rt->fib6_table->tb6_lock)); + } +@@ -2173,8 +2174,8 @@ static int fib6_clean_node(struct fib6_walker *w) + }; + + if (c->sernum != FIB6_NO_SERNUM_CHANGE && +- w->node->fn_sernum != c->sernum) +- w->node->fn_sernum = c->sernum; ++ READ_ONCE(w->node->fn_sernum) != c->sernum) ++ WRITE_ONCE(w->node->fn_sernum, c->sernum); + + if (!c->func) { + WARN_ON_ONCE(c->sernum == FIB6_NO_SERNUM_CHANGE); +@@ -2542,7 +2543,7 @@ static void ipv6_route_seq_setup_walk(struct ipv6_route_iter *iter, + iter->w.state = FWS_INIT; + iter->w.node = iter->w.root; + iter->w.args = iter; +- iter->sernum = iter->w.root->fn_sernum; ++ iter->sernum = READ_ONCE(iter->w.root->fn_sernum); + INIT_LIST_HEAD(&iter->w.lh); + fib6_walker_link(net, &iter->w); + } +@@ -2570,8 +2571,10 @@ static struct fib6_table *ipv6_route_seq_next_table(struct fib6_table *tbl, + + static void ipv6_route_check_sernum(struct ipv6_route_iter *iter) + { +- if (iter->sernum != iter->w.root->fn_sernum) { +- iter->sernum = iter->w.root->fn_sernum; ++ int sernum = READ_ONCE(iter->w.root->fn_sernum); ++ ++ if (iter->sernum != sernum) { ++ iter->sernum = sernum; + iter->w.state = FWS_INIT; + iter->w.node = iter->w.root; + WARN_ON(iter->w.skip); +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 1deb6297aab66..49fee1f1951c2 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -2802,7 +2802,7 @@ static void ip6_link_failure(struct sk_buff *skb) + if (from) { + fn = rcu_dereference(from->fib6_node); + if (fn && (rt->rt6i_flags & RTF_DEFAULT)) +- fn->fn_sernum = -1; ++ WRITE_ONCE(fn->fn_sernum, -1); + } + } + rcu_read_unlock(); +-- +2.34.1 + diff --git a/queue-5.16/ipv6_tunnel-rate-limit-warning-messages.patch-22703 b/queue-5.16/ipv6_tunnel-rate-limit-warning-messages.patch-22703 new file mode 100644 index 00000000000..c50e2b5d34d --- /dev/null +++ b/queue-5.16/ipv6_tunnel-rate-limit-warning-messages.patch-22703 @@ -0,0 +1,51 @@ +From 103629f47718de7d30fbb9b91fde89af4d0ef950 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jan 2022 10:05:46 +0200 +Subject: ipv6_tunnel: Rate limit warning messages + +From: Ido Schimmel + +[ Upstream commit 6cee105e7f2ced596373951d9ea08dacc3883c68 ] + +The warning messages can be invoked from the data path for every packet +transmitted through an ip6gre netdev, leading to high CPU utilization. + +Fix that by rate limiting the messages. + +Fixes: 09c6bbf090ec ("[IPV6]: Do mandatory IPv6 tunnel endpoint checks in realtime") +Reported-by: Maksym Yaremchuk +Tested-by: Maksym Yaremchuk +Signed-off-by: Ido Schimmel +Reviewed-by: Amit Cohen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/ip6_tunnel.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 484aca492cc06..7c6a0bdb0e1ba 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1036,14 +1036,14 @@ int ip6_tnl_xmit_ctl(struct ip6_tnl *t, + + if (unlikely(!ipv6_chk_addr_and_flags(net, laddr, ldev, false, + 0, IFA_F_TENTATIVE))) +- pr_warn("%s xmit: Local address not yet configured!\n", +- p->name); ++ pr_warn_ratelimited("%s xmit: Local address not yet configured!\n", ++ p->name); + else if (!(p->flags & IP6_TNL_F_ALLOW_LOCAL_REMOTE) && + !ipv6_addr_is_multicast(raddr) && + unlikely(ipv6_chk_addr_and_flags(net, raddr, ldev, + true, 0, IFA_F_TENTATIVE))) +- pr_warn("%s xmit: Routing loop! Remote address found on this node!\n", +- p->name); ++ pr_warn_ratelimited("%s xmit: Routing loop! Remote address found on this node!\n", ++ p->name); + else + ret = 1; + rcu_read_unlock(); +-- +2.34.1 + diff --git a/queue-5.16/kvm-arm64-pkvm-use-the-mm_ops-indirection-for-cache-.patch-28328 b/queue-5.16/kvm-arm64-pkvm-use-the-mm_ops-indirection-for-cache-.patch-28328 new file mode 100644 index 00000000000..fe560847691 --- /dev/null +++ b/queue-5.16/kvm-arm64-pkvm-use-the-mm_ops-indirection-for-cache-.patch-28328 @@ -0,0 +1,67 @@ +From 07001c5a8c3a6b317603ee1a6f24a597fcd1c8aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jan 2022 08:57:58 +0000 +Subject: KVM: arm64: pkvm: Use the mm_ops indirection for cache maintenance + +From: Marc Zyngier + +[ Upstream commit 094d00f8ca58c5d29b25e23b4daaed1ff1f13b41 ] + +CMOs issued from EL2 cannot directly use the kernel helpers, +as EL2 doesn't have a mapping of the guest pages. Oops. + +Instead, use the mm_ops indirection to use helpers that will +perform a mapping at EL2 and allow the CMO to be effective. + +Fixes: 25aa28691bb9 ("KVM: arm64: Move guest CMOs to the fault handlers") +Reviewed-by: Quentin Perret +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20220114125038.1336965-1-maz@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/kvm/hyp/pgtable.c | 18 ++++++------------ + 1 file changed, 6 insertions(+), 12 deletions(-) + +diff --git a/arch/arm64/kvm/hyp/pgtable.c b/arch/arm64/kvm/hyp/pgtable.c +index f8ceebe4982eb..4c77ff556f0ae 100644 +--- a/arch/arm64/kvm/hyp/pgtable.c ++++ b/arch/arm64/kvm/hyp/pgtable.c +@@ -921,13 +921,9 @@ static int stage2_unmap_walker(u64 addr, u64 end, u32 level, kvm_pte_t *ptep, + */ + stage2_put_pte(ptep, mmu, addr, level, mm_ops); + +- if (need_flush) { +- kvm_pte_t *pte_follow = kvm_pte_follow(pte, mm_ops); +- +- dcache_clean_inval_poc((unsigned long)pte_follow, +- (unsigned long)pte_follow + +- kvm_granule_size(level)); +- } ++ if (need_flush && mm_ops->dcache_clean_inval_poc) ++ mm_ops->dcache_clean_inval_poc(kvm_pte_follow(pte, mm_ops), ++ kvm_granule_size(level)); + + if (childp) + mm_ops->put_page(childp); +@@ -1089,15 +1085,13 @@ static int stage2_flush_walker(u64 addr, u64 end, u32 level, kvm_pte_t *ptep, + struct kvm_pgtable *pgt = arg; + struct kvm_pgtable_mm_ops *mm_ops = pgt->mm_ops; + kvm_pte_t pte = *ptep; +- kvm_pte_t *pte_follow; + + if (!kvm_pte_valid(pte) || !stage2_pte_cacheable(pgt, pte)) + return 0; + +- pte_follow = kvm_pte_follow(pte, mm_ops); +- dcache_clean_inval_poc((unsigned long)pte_follow, +- (unsigned long)pte_follow + +- kvm_granule_size(level)); ++ if (mm_ops->dcache_clean_inval_poc) ++ mm_ops->dcache_clean_inval_poc(kvm_pte_follow(pte, mm_ops), ++ kvm_granule_size(level)); + return 0; + } + +-- +2.34.1 + diff --git a/queue-5.16/kvm-selftests-don-t-skip-l2-s-vmcall-in-smm-test-for.patch-6280 b/queue-5.16/kvm-selftests-don-t-skip-l2-s-vmcall-in-smm-test-for.patch-6280 new file mode 100644 index 00000000000..5cf7c89405b --- /dev/null +++ b/queue-5.16/kvm-selftests-don-t-skip-l2-s-vmcall-in-smm-test-for.patch-6280 @@ -0,0 +1,45 @@ +From 8331cd46c7e0e05df5986699bd67c801ebd77a13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jan 2022 22:17:25 +0000 +Subject: KVM: selftests: Don't skip L2's VMCALL in SMM test for SVM guest + +From: Sean Christopherson + +[ Upstream commit 4cf3d3ebe8794c449af3e0e8c1d790c97e461d20 ] + +Don't skip the vmcall() in l2_guest_code() prior to re-entering L2, doing +so will result in L2 running to completion, popping '0' off the stack for +RET, jumping to address '0', and ultimately dying with a triple fault +shutdown. + +It's not at all obvious why the test re-enters L2 and re-executes VMCALL, +but presumably it serves a purpose. The VMX path doesn't skip vmcall(), +and the test can't possibly have passed on SVM, so just do what VMX does. + +Fixes: d951b2210c1a ("KVM: selftests: smm_test: Test SMM enter from L2") +Cc: Maxim Levitsky +Signed-off-by: Sean Christopherson +Message-Id: <20220125221725.2101126-1-seanjc@google.com> +Reviewed-by: Vitaly Kuznetsov +Tested-by: Vitaly Kuznetsov +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kvm/x86_64/smm_test.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/tools/testing/selftests/kvm/x86_64/smm_test.c b/tools/testing/selftests/kvm/x86_64/smm_test.c +index d0fe2fdce58c4..db2a17559c3d5 100644 +--- a/tools/testing/selftests/kvm/x86_64/smm_test.c ++++ b/tools/testing/selftests/kvm/x86_64/smm_test.c +@@ -105,7 +105,6 @@ static void guest_code(void *arg) + + if (cpu_has_svm()) { + run_guest(svm->vmcb, svm->vmcb_gpa); +- svm->vmcb->save.rip += 3; + run_guest(svm->vmcb, svm->vmcb_gpa); + } else { + vmlaunch(); +-- +2.34.1 + diff --git a/queue-5.16/kvm-selftests-re-enable-access_tracking_perf_test.patch-24698 b/queue-5.16/kvm-selftests-re-enable-access_tracking_perf_test.patch-24698 new file mode 100644 index 00000000000..8a3c00ffc56 --- /dev/null +++ b/queue-5.16/kvm-selftests-re-enable-access_tracking_perf_test.patch-24698 @@ -0,0 +1,36 @@ +From 93f8866bbb772055f8f33a4ed5d4809fb27a54e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jan 2022 00:38:26 +0000 +Subject: KVM: selftests: Re-enable access_tracking_perf_test + +From: David Matlack + +[ Upstream commit de1956f48543e90f94b1194395f33140898b39b2 ] + +This selftest was accidentally removed by commit 6a58150859fd +("selftest: KVM: Add intra host migration tests"). Add it back. + +Fixes: 6a58150859fd ("selftest: KVM: Add intra host migration tests") +Signed-off-by: David Matlack +Message-Id: <20220120003826.2805036-1-dmatlack@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kvm/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile +index 290b1b0552d6e..4fdfb42aeddba 100644 +--- a/tools/testing/selftests/kvm/Makefile ++++ b/tools/testing/selftests/kvm/Makefile +@@ -77,6 +77,7 @@ TEST_GEN_PROGS_x86_64 += x86_64/xen_shinfo_test + TEST_GEN_PROGS_x86_64 += x86_64/xen_vmcall_test + TEST_GEN_PROGS_x86_64 += x86_64/vmx_pi_mmio_test + TEST_GEN_PROGS_x86_64 += x86_64/sev_migrate_tests ++TEST_GEN_PROGS_x86_64 += access_tracking_perf_test + TEST_GEN_PROGS_x86_64 += demand_paging_test + TEST_GEN_PROGS_x86_64 += dirty_log_test + TEST_GEN_PROGS_x86_64 += dirty_log_perf_test +-- +2.34.1 + diff --git a/queue-5.16/mptcp-allow-changing-the-backup-bit-by-endpoint-id.patch-27797 b/queue-5.16/mptcp-allow-changing-the-backup-bit-by-endpoint-id.patch-27797 new file mode 100644 index 00000000000..7b6caf0e3c5 --- /dev/null +++ b/queue-5.16/mptcp-allow-changing-the-backup-bit-by-endpoint-id.patch-27797 @@ -0,0 +1,61 @@ +From 75863eb5e59eff10b5bd7bd05b623b183623f0eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Dec 2021 14:35:36 -0800 +Subject: mptcp: allow changing the "backup" bit by endpoint id + +From: Davide Caratti + +[ Upstream commit 602837e8479d20d49559b4b97b79d34c0efe7ecb ] + +a non-zero 'id' is sufficient to identify MPTCP endpoints: allow changing +the value of 'backup' bit by simply specifying the endpoint id. + +Link: https://github.com/multipath-tcp/mptcp_net-next/issues/158 +Signed-off-by: Davide Caratti +Signed-off-by: Mat Martineau +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mptcp/pm_netlink.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c +index 65764c8171b37..d18b13e3e74c6 100644 +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -1711,22 +1711,28 @@ next: + + static int mptcp_nl_cmd_set_flags(struct sk_buff *skb, struct genl_info *info) + { ++ struct mptcp_pm_addr_entry addr = { .addr = { .family = AF_UNSPEC }, }, *entry; + struct nlattr *attr = info->attrs[MPTCP_PM_ATTR_ADDR]; + struct pm_nl_pernet *pernet = genl_info_pm_nl(info); +- struct mptcp_pm_addr_entry addr, *entry; + struct net *net = sock_net(skb->sk); +- u8 bkup = 0; ++ u8 bkup = 0, lookup_by_id = 0; + int ret; + +- ret = mptcp_pm_parse_addr(attr, info, true, &addr); ++ ret = mptcp_pm_parse_addr(attr, info, false, &addr); + if (ret < 0) + return ret; + + if (addr.flags & MPTCP_PM_ADDR_FLAG_BACKUP) + bkup = 1; ++ if (addr.addr.family == AF_UNSPEC) { ++ lookup_by_id = 1; ++ if (!addr.addr.id) ++ return -EOPNOTSUPP; ++ } + + list_for_each_entry(entry, &pernet->local_addr_list, list) { +- if (addresses_equal(&entry->addr, &addr.addr, true)) { ++ if ((!lookup_by_id && addresses_equal(&entry->addr, &addr.addr, true)) || ++ (lookup_by_id && entry->addr.id == addr.addr.id)) { + mptcp_nl_addr_backup(net, &entry->addr, bkup); + + if (bkup) +-- +2.34.1 + diff --git a/queue-5.16/mptcp-clean-up-harmless-false-expressions.patch-23285 b/queue-5.16/mptcp-clean-up-harmless-false-expressions.patch-23285 new file mode 100644 index 00000000000..b3583a9ed4e --- /dev/null +++ b/queue-5.16/mptcp-clean-up-harmless-false-expressions.patch-23285 @@ -0,0 +1,60 @@ +From d3c2d8b084bb2977bc28346b22b0bbda97bef052 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Dec 2021 15:37:02 -0800 +Subject: mptcp: clean up harmless false expressions + +From: Jean Sacren + +[ Upstream commit 59060a47ca50bbdb1d863b73667a1065873ecc06 ] + +entry->addr.id is u8 with a range from 0 to 255 and MAX_ADDR_ID is 255. +We should drop both false expressions of (entry->addr.id > MAX_ADDR_ID). + +We should also remove the obsolete parentheses in the first if branch. + +Use U8_MAX for MAX_ADDR_ID and add a comment to show the link to +mptcp_addr_info.id as suggested by Mr. Matthieu Baerts. + +Reviewed-by: Matthieu Baerts +Signed-off-by: Jean Sacren +Signed-off-by: Mat Martineau +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mptcp/pm_netlink.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c +index d18b13e3e74c6..27427aeeee0e5 100644 +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -38,7 +38,8 @@ struct mptcp_pm_add_entry { + u8 retrans_times; + }; + +-#define MAX_ADDR_ID 255 ++/* max value of mptcp_addr_info.id */ ++#define MAX_ADDR_ID U8_MAX + #define BITMAP_SZ DIV_ROUND_UP(MAX_ADDR_ID + 1, BITS_PER_LONG) + + struct pm_nl_pernet { +@@ -831,14 +832,13 @@ find_next: + entry->addr.id = find_next_zero_bit(pernet->id_bitmap, + MAX_ADDR_ID + 1, + pernet->next_id); +- if ((!entry->addr.id || entry->addr.id > MAX_ADDR_ID) && +- pernet->next_id != 1) { ++ if (!entry->addr.id && pernet->next_id != 1) { + pernet->next_id = 1; + goto find_next; + } + } + +- if (!entry->addr.id || entry->addr.id > MAX_ADDR_ID) ++ if (!entry->addr.id) + goto out; + + __set_bit(entry->addr.id, pernet->id_bitmap); +-- +2.34.1 + diff --git a/queue-5.16/mptcp-fix-msk-traversal-in-mptcp_nl_cmd_set_flags.patch-4074 b/queue-5.16/mptcp-fix-msk-traversal-in-mptcp_nl_cmd_set_flags.patch-4074 new file mode 100644 index 00000000000..06b5157a82d --- /dev/null +++ b/queue-5.16/mptcp-fix-msk-traversal-in-mptcp_nl_cmd_set_flags.patch-4074 @@ -0,0 +1,85 @@ +From 761e92001db7e263b5eabb7a842b3273621f1004 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jan 2022 16:35:27 -0800 +Subject: mptcp: fix msk traversal in mptcp_nl_cmd_set_flags() + +From: Paolo Abeni + +[ Upstream commit 8e9eacad7ec7a9cbf262649ebf1fa6e6f6cc7d82 ] + +The MPTCP endpoint list is under RCU protection, guarded by the +pernet spinlock. mptcp_nl_cmd_set_flags() traverses the list +without acquiring the spin-lock nor under the RCU critical section. + +This change addresses the issue performing the lookup and the endpoint +update under the pernet spinlock. + +Fixes: 0f9f696a502e ("mptcp: add set_flags command in PM netlink") +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mptcp/pm_netlink.c | 37 +++++++++++++++++++++++++++---------- + 1 file changed, 27 insertions(+), 10 deletions(-) + +diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c +index ad3dc9c6c5310..35abcce604b4d 100644 +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -469,6 +469,20 @@ __lookup_addr_by_id(struct pm_nl_pernet *pernet, unsigned int id) + return NULL; + } + ++static struct mptcp_pm_addr_entry * ++__lookup_addr(struct pm_nl_pernet *pernet, const struct mptcp_addr_info *info, ++ bool lookup_by_id) ++{ ++ struct mptcp_pm_addr_entry *entry; ++ ++ list_for_each_entry(entry, &pernet->local_addr_list, list) { ++ if ((!lookup_by_id && addresses_equal(&entry->addr, info, true)) || ++ (lookup_by_id && entry->addr.id == info->id)) ++ return entry; ++ } ++ return NULL; ++} ++ + static int + lookup_id_by_addr(struct pm_nl_pernet *pernet, const struct mptcp_addr_info *addr) + { +@@ -1753,18 +1767,21 @@ static int mptcp_nl_cmd_set_flags(struct sk_buff *skb, struct genl_info *info) + return -EOPNOTSUPP; + } + +- list_for_each_entry(entry, &pernet->local_addr_list, list) { +- if ((!lookup_by_id && addresses_equal(&entry->addr, &addr.addr, true)) || +- (lookup_by_id && entry->addr.id == addr.addr.id)) { +- mptcp_nl_addr_backup(net, &entry->addr, bkup); +- +- if (bkup) +- entry->flags |= MPTCP_PM_ADDR_FLAG_BACKUP; +- else +- entry->flags &= ~MPTCP_PM_ADDR_FLAG_BACKUP; +- } ++ spin_lock_bh(&pernet->lock); ++ entry = __lookup_addr(pernet, &addr.addr, lookup_by_id); ++ if (!entry) { ++ spin_unlock_bh(&pernet->lock); ++ return -EINVAL; + } + ++ if (bkup) ++ entry->flags |= MPTCP_PM_ADDR_FLAG_BACKUP; ++ else ++ entry->flags &= ~MPTCP_PM_ADDR_FLAG_BACKUP; ++ addr = *entry; ++ spin_unlock_bh(&pernet->lock); ++ ++ mptcp_nl_addr_backup(net, &addr.addr, bkup); + return 0; + } + +-- +2.34.1 + diff --git a/queue-5.16/mptcp-fix-removing-ids-bitmap-setting.patch-8263 b/queue-5.16/mptcp-fix-removing-ids-bitmap-setting.patch-8263 new file mode 100644 index 00000000000..50aed43628e --- /dev/null +++ b/queue-5.16/mptcp-fix-removing-ids-bitmap-setting.patch-8263 @@ -0,0 +1,38 @@ +From 71382ec18494a5acdc051a3a986ba53b7d707bee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jan 2022 16:35:28 -0800 +Subject: mptcp: fix removing ids bitmap setting + +From: Geliang Tang + +[ Upstream commit a4c0214fbee97c46e3f41fee37931d66c0fc3cb1 ] + +In mptcp_pm_nl_rm_addr_or_subflow(), the bit of rm_list->ids[i] in the +id_avail_bitmap should be set, not rm_list->ids[1]. This patch fixed it. + +Fixes: 86e39e04482b ("mptcp: keep track of local endpoint still available for each msk") +Acked-by: Paolo Abeni +Signed-off-by: Geliang Tang +Signed-off-by: Mat Martineau +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mptcp/pm_netlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c +index 35abcce604b4d..14e6d6f745186 100644 +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -781,7 +781,7 @@ static void mptcp_pm_nl_rm_addr_or_subflow(struct mptcp_sock *msk, + msk->pm.subflows--; + __MPTCP_INC_STATS(sock_net(sk), rm_type); + } +- __set_bit(rm_list->ids[1], msk->pm.id_avail_bitmap); ++ __set_bit(rm_list->ids[i], msk->pm.id_avail_bitmap); + if (!removed) + continue; + +-- +2.34.1 + diff --git a/queue-5.16/mptcp-keep-track-of-local-endpoint-still-available-f.patch-10692 b/queue-5.16/mptcp-keep-track-of-local-endpoint-still-available-f.patch-10692 new file mode 100644 index 00000000000..2ab3a764652 --- /dev/null +++ b/queue-5.16/mptcp-keep-track-of-local-endpoint-still-available-f.patch-10692 @@ -0,0 +1,404 @@ +From a95883b09b2006a0cea721f0f2376eadfbff6476 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jan 2022 16:20:22 -0800 +Subject: mptcp: keep track of local endpoint still available for each msk + +From: Paolo Abeni + +[ Upstream commit 86e39e04482b0aadf3ee3ed5fcf2d63816559d36 ] + +Include into the path manager status a bitmap tracking the list +of local endpoints still available - not yet used - for the +relevant mptcp socket. + +Keep such map updated at endpoint creation/deletion time, so +that we can easily skip already used endpoint at local address +selection time. + +The endpoint used by the initial subflow is lazyly accounted at +subflow creation time: the usage bitmap is be up2date before +endpoint selection and we avoid such unneeded task in some relevant +scenarios - e.g. busy servers accepting incoming subflows but +not creating any additional ones nor annuncing additional addresses. + +Overall this allows for fair local endpoints usage in case of +subflow failure. + +As a side effect, this patch also enforces that each endpoint +is used at most once for each mptcp connection. + +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/mptcp/pm.c | 1 + + net/mptcp/pm_netlink.c | 125 +++++++++++------- + net/mptcp/protocol.c | 3 +- + net/mptcp/protocol.h | 12 +- + .../testing/selftests/net/mptcp/mptcp_join.sh | 5 +- + 5 files changed, 91 insertions(+), 55 deletions(-) + +diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c +index 6ab386ff32944..332ac6eda3ba4 100644 +--- a/net/mptcp/pm.c ++++ b/net/mptcp/pm.c +@@ -370,6 +370,7 @@ void mptcp_pm_data_init(struct mptcp_sock *msk) + WRITE_ONCE(msk->pm.accept_subflow, false); + WRITE_ONCE(msk->pm.remote_deny_join_id0, false); + msk->pm.status = 0; ++ bitmap_fill(msk->pm.id_avail_bitmap, MPTCP_PM_MAX_ADDR_ID + 1); + + spin_lock_init(&msk->pm.lock); + INIT_LIST_HEAD(&msk->pm.anno_list); +diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c +index 27427aeeee0e5..ad3dc9c6c5310 100644 +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -38,10 +38,6 @@ struct mptcp_pm_add_entry { + u8 retrans_times; + }; + +-/* max value of mptcp_addr_info.id */ +-#define MAX_ADDR_ID U8_MAX +-#define BITMAP_SZ DIV_ROUND_UP(MAX_ADDR_ID + 1, BITS_PER_LONG) +- + struct pm_nl_pernet { + /* protects pernet updates */ + spinlock_t lock; +@@ -53,14 +49,14 @@ struct pm_nl_pernet { + unsigned int local_addr_max; + unsigned int subflows_max; + unsigned int next_id; +- unsigned long id_bitmap[BITMAP_SZ]; ++ DECLARE_BITMAP(id_bitmap, MPTCP_PM_MAX_ADDR_ID + 1); + }; + + #define MPTCP_PM_ADDR_MAX 8 + #define ADD_ADDR_RETRANS_MAX 3 + + static bool addresses_equal(const struct mptcp_addr_info *a, +- struct mptcp_addr_info *b, bool use_port) ++ const struct mptcp_addr_info *b, bool use_port) + { + bool addr_equals = false; + +@@ -174,6 +170,9 @@ select_local_address(const struct pm_nl_pernet *pernet, + if (!(entry->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW)) + continue; + ++ if (!test_bit(entry->addr.id, msk->pm.id_avail_bitmap)) ++ continue; ++ + if (entry->addr.family != sk->sk_family) { + #if IS_ENABLED(CONFIG_MPTCP_IPV6) + if ((entry->addr.family == AF_INET && +@@ -184,23 +183,17 @@ select_local_address(const struct pm_nl_pernet *pernet, + continue; + } + +- /* avoid any address already in use by subflows and +- * pending join +- */ +- if (!lookup_subflow_by_saddr(&msk->conn_list, &entry->addr)) { +- ret = entry; +- break; +- } ++ ret = entry; ++ break; + } + rcu_read_unlock(); + return ret; + } + + static struct mptcp_pm_addr_entry * +-select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos) ++select_signal_address(struct pm_nl_pernet *pernet, struct mptcp_sock *msk) + { + struct mptcp_pm_addr_entry *entry, *ret = NULL; +- int i = 0; + + rcu_read_lock(); + /* do not keep any additional per socket state, just signal +@@ -209,12 +202,14 @@ select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos) + * can lead to additional addresses not being announced. + */ + list_for_each_entry_rcu(entry, &pernet->local_addr_list, list) { ++ if (!test_bit(entry->addr.id, msk->pm.id_avail_bitmap)) ++ continue; ++ + if (!(entry->flags & MPTCP_PM_ADDR_FLAG_SIGNAL)) + continue; +- if (i++ == pos) { +- ret = entry; +- break; +- } ++ ++ ret = entry; ++ break; + } + rcu_read_unlock(); + return ret; +@@ -258,9 +253,11 @@ EXPORT_SYMBOL_GPL(mptcp_pm_get_local_addr_max); + + static void check_work_pending(struct mptcp_sock *msk) + { +- if (msk->pm.add_addr_signaled == mptcp_pm_get_add_addr_signal_max(msk) && +- (msk->pm.local_addr_used == mptcp_pm_get_local_addr_max(msk) || +- msk->pm.subflows == mptcp_pm_get_subflows_max(msk))) ++ struct pm_nl_pernet *pernet = net_generic(sock_net((struct sock *)msk), pm_nl_pernet_id); ++ ++ if (msk->pm.subflows == mptcp_pm_get_subflows_max(msk) || ++ (find_next_and_bit(pernet->id_bitmap, msk->pm.id_avail_bitmap, ++ MPTCP_PM_MAX_ADDR_ID + 1, 0) == MPTCP_PM_MAX_ADDR_ID + 1)) + WRITE_ONCE(msk->pm.work_pending, false); + } + +@@ -460,6 +457,35 @@ static unsigned int fill_remote_addresses_vec(struct mptcp_sock *msk, bool fullm + return i; + } + ++static struct mptcp_pm_addr_entry * ++__lookup_addr_by_id(struct pm_nl_pernet *pernet, unsigned int id) ++{ ++ struct mptcp_pm_addr_entry *entry; ++ ++ list_for_each_entry(entry, &pernet->local_addr_list, list) { ++ if (entry->addr.id == id) ++ return entry; ++ } ++ return NULL; ++} ++ ++static int ++lookup_id_by_addr(struct pm_nl_pernet *pernet, const struct mptcp_addr_info *addr) ++{ ++ struct mptcp_pm_addr_entry *entry; ++ int ret = -1; ++ ++ rcu_read_lock(); ++ list_for_each_entry(entry, &pernet->local_addr_list, list) { ++ if (addresses_equal(&entry->addr, addr, entry->addr.port)) { ++ ret = entry->addr.id; ++ break; ++ } ++ } ++ rcu_read_unlock(); ++ return ret; ++} ++ + static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) + { + struct sock *sk = (struct sock *)msk; +@@ -475,6 +501,19 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) + local_addr_max = mptcp_pm_get_local_addr_max(msk); + subflows_max = mptcp_pm_get_subflows_max(msk); + ++ /* do lazy endpoint usage accounting for the MPC subflows */ ++ if (unlikely(!(msk->pm.status & BIT(MPTCP_PM_MPC_ENDPOINT_ACCOUNTED))) && msk->first) { ++ struct mptcp_addr_info local; ++ int mpc_id; ++ ++ local_address((struct sock_common *)msk->first, &local); ++ mpc_id = lookup_id_by_addr(pernet, &local); ++ if (mpc_id < 0) ++ __clear_bit(mpc_id, msk->pm.id_avail_bitmap); ++ ++ msk->pm.status |= BIT(MPTCP_PM_MPC_ENDPOINT_ACCOUNTED); ++ } ++ + pr_debug("local %d:%d signal %d:%d subflows %d:%d\n", + msk->pm.local_addr_used, local_addr_max, + msk->pm.add_addr_signaled, add_addr_signal_max, +@@ -482,21 +521,16 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) + + /* check first for announce */ + if (msk->pm.add_addr_signaled < add_addr_signal_max) { +- local = select_signal_address(pernet, +- msk->pm.add_addr_signaled); ++ local = select_signal_address(pernet, msk); + + if (local) { + if (mptcp_pm_alloc_anno_list(msk, local)) { ++ __clear_bit(local->addr.id, msk->pm.id_avail_bitmap); + msk->pm.add_addr_signaled++; + mptcp_pm_announce_addr(msk, &local->addr, false); + mptcp_pm_nl_addr_send_ack(msk); + } +- } else { +- /* pick failed, avoid fourther attempts later */ +- msk->pm.local_addr_used = add_addr_signal_max; + } +- +- check_work_pending(msk); + } + + /* check if should create a new subflow */ +@@ -510,19 +544,16 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) + int i, nr; + + msk->pm.local_addr_used++; +- check_work_pending(msk); + nr = fill_remote_addresses_vec(msk, fullmesh, addrs); ++ if (nr) ++ __clear_bit(local->addr.id, msk->pm.id_avail_bitmap); + spin_unlock_bh(&msk->pm.lock); + for (i = 0; i < nr; i++) + __mptcp_subflow_connect(sk, &local->addr, &addrs[i]); + spin_lock_bh(&msk->pm.lock); +- return; + } +- +- /* lookup failed, avoid fourther attempts later */ +- msk->pm.local_addr_used = local_addr_max; +- check_work_pending(msk); + } ++ check_work_pending(msk); + } + + static void mptcp_pm_nl_fully_established(struct mptcp_sock *msk) +@@ -736,6 +767,7 @@ static void mptcp_pm_nl_rm_addr_or_subflow(struct mptcp_sock *msk, + msk->pm.subflows--; + __MPTCP_INC_STATS(sock_net(sk), rm_type); + } ++ __set_bit(rm_list->ids[1], msk->pm.id_avail_bitmap); + if (!removed) + continue; + +@@ -765,6 +797,9 @@ void mptcp_pm_nl_work(struct mptcp_sock *msk) + + msk_owned_by_me(msk); + ++ if (!(pm->status & MPTCP_PM_WORK_MASK)) ++ return; ++ + spin_lock_bh(&msk->pm.lock); + + pr_debug("msk=%p status=%x", msk, pm->status); +@@ -810,7 +845,7 @@ static int mptcp_pm_nl_append_new_local_addr(struct pm_nl_pernet *pernet, + /* to keep the code simple, don't do IDR-like allocation for address ID, + * just bail when we exceed limits + */ +- if (pernet->next_id == MAX_ADDR_ID) ++ if (pernet->next_id == MPTCP_PM_MAX_ADDR_ID) + pernet->next_id = 1; + if (pernet->addrs >= MPTCP_PM_ADDR_MAX) + goto out; +@@ -830,7 +865,7 @@ static int mptcp_pm_nl_append_new_local_addr(struct pm_nl_pernet *pernet, + if (!entry->addr.id) { + find_next: + entry->addr.id = find_next_zero_bit(pernet->id_bitmap, +- MAX_ADDR_ID + 1, ++ MPTCP_PM_MAX_ADDR_ID + 1, + pernet->next_id); + if (!entry->addr.id && pernet->next_id != 1) { + pernet->next_id = 1; +@@ -1197,18 +1232,6 @@ static int mptcp_nl_cmd_add_addr(struct sk_buff *skb, struct genl_info *info) + return 0; + } + +-static struct mptcp_pm_addr_entry * +-__lookup_addr_by_id(struct pm_nl_pernet *pernet, unsigned int id) +-{ +- struct mptcp_pm_addr_entry *entry; +- +- list_for_each_entry(entry, &pernet->local_addr_list, list) { +- if (entry->addr.id == id) +- return entry; +- } +- return NULL; +-} +- + int mptcp_pm_get_flags_and_ifindex_by_id(struct net *net, unsigned int id, + u8 *flags, int *ifindex) + { +@@ -1467,7 +1490,7 @@ static int mptcp_nl_cmd_flush_addrs(struct sk_buff *skb, struct genl_info *info) + list_splice_init(&pernet->local_addr_list, &free_list); + __reset_counters(pernet); + pernet->next_id = 1; +- bitmap_zero(pernet->id_bitmap, MAX_ADDR_ID + 1); ++ bitmap_zero(pernet->id_bitmap, MPTCP_PM_MAX_ADDR_ID + 1); + spin_unlock_bh(&pernet->lock); + mptcp_nl_remove_addrs_list(sock_net(skb->sk), &free_list); + synchronize_rcu(); +@@ -1577,7 +1600,7 @@ static int mptcp_nl_cmd_dump_addrs(struct sk_buff *msg, + pernet = net_generic(net, pm_nl_pernet_id); + + spin_lock_bh(&pernet->lock); +- for (i = id; i < MAX_ADDR_ID + 1; i++) { ++ for (i = id; i < MPTCP_PM_MAX_ADDR_ID + 1; i++) { + if (test_bit(i, pernet->id_bitmap)) { + entry = __lookup_addr_by_id(pernet, i); + if (!entry) +diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c +index 0cd55e4c30fab..70a3cac85f7b8 100644 +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -2416,8 +2416,7 @@ static void mptcp_worker(struct work_struct *work) + + mptcp_check_fastclose(msk); + +- if (msk->pm.status) +- mptcp_pm_nl_work(msk); ++ mptcp_pm_nl_work(msk); + + if (test_and_clear_bit(MPTCP_WORK_EOF, &msk->flags)) + mptcp_check_for_eof(msk); +diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h +index d87cc040352e3..0387ad9fb43f7 100644 +--- a/net/mptcp/protocol.h ++++ b/net/mptcp/protocol.h +@@ -174,16 +174,25 @@ enum mptcp_pm_status { + MPTCP_PM_ADD_ADDR_SEND_ACK, + MPTCP_PM_RM_ADDR_RECEIVED, + MPTCP_PM_ESTABLISHED, +- MPTCP_PM_ALREADY_ESTABLISHED, /* persistent status, set after ESTABLISHED event */ + MPTCP_PM_SUBFLOW_ESTABLISHED, ++ MPTCP_PM_ALREADY_ESTABLISHED, /* persistent status, set after ESTABLISHED event */ ++ MPTCP_PM_MPC_ENDPOINT_ACCOUNTED /* persistent status, set after MPC local address is ++ * accounted int id_avail_bitmap ++ */ + }; + ++/* Status bits below MPTCP_PM_ALREADY_ESTABLISHED need pm worker actions */ ++#define MPTCP_PM_WORK_MASK ((1 << MPTCP_PM_ALREADY_ESTABLISHED) - 1) ++ + enum mptcp_addr_signal_status { + MPTCP_ADD_ADDR_SIGNAL, + MPTCP_ADD_ADDR_ECHO, + MPTCP_RM_ADDR_SIGNAL, + }; + ++/* max value of mptcp_addr_info.id */ ++#define MPTCP_PM_MAX_ADDR_ID U8_MAX ++ + struct mptcp_pm_data { + struct mptcp_addr_info local; + struct mptcp_addr_info remote; +@@ -202,6 +211,7 @@ struct mptcp_pm_data { + u8 local_addr_used; + u8 subflows; + u8 status; ++ DECLARE_BITMAP(id_avail_bitmap, MPTCP_PM_MAX_ADDR_ID + 1); + struct mptcp_rm_list rm_list_tx; + struct mptcp_rm_list rm_list_rx; + }; +diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh +index 7ef639a9d4a6f..bbafa4cf54538 100755 +--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh ++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh +@@ -1071,7 +1071,10 @@ signal_address_tests() + ip netns exec $ns2 ./pm_nl_ctl add 10.0.3.2 flags signal + ip netns exec $ns2 ./pm_nl_ctl add 10.0.4.2 flags signal + run_tests $ns1 $ns2 10.0.1.1 +- chk_add_nr 4 4 ++ ++ # the server will not signal the address terminating ++ # the MPC subflow ++ chk_add_nr 3 3 + } + + link_failure_tests() +-- +2.34.1 + diff --git a/queue-5.16/net-bridge-vlan-fix-memory-leak-in-__allowed_ingress.patch-11369 b/queue-5.16/net-bridge-vlan-fix-memory-leak-in-__allowed_ingress.patch-11369 new file mode 100644 index 00000000000..a82b3c55a06 --- /dev/null +++ b/queue-5.16/net-bridge-vlan-fix-memory-leak-in-__allowed_ingress.patch-11369 @@ -0,0 +1,47 @@ +From 21ad90a1cfd6b2fd4aa691620cfbdaebe6a08132 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jan 2022 15:49:53 +0800 +Subject: net: bridge: vlan: fix memory leak in __allowed_ingress + +From: Tim Yi + +[ Upstream commit fd20d9738395cf8e27d0a17eba34169699fccdff ] + +When using per-vlan state, if vlan snooping and stats are disabled, +untagged or priority-tagged ingress frame will go to check pvid state. +If the port state is forwarding and the pvid state is not +learning/forwarding, untagged or priority-tagged frame will be dropped +but skb memory is not freed. +Should free skb when __allowed_ingress returns false. + +Fixes: a580c76d534c ("net: bridge: vlan: add per-vlan state") +Signed-off-by: Tim Yi +Acked-by: Nikolay Aleksandrov +Link: https://lore.kernel.org/r/20220127074953.12632-1-tim.yi@pica8.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/bridge/br_vlan.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c +index d0ebcc99bfa9d..f02351b4acaca 100644 +--- a/net/bridge/br_vlan.c ++++ b/net/bridge/br_vlan.c +@@ -560,10 +560,10 @@ static bool __allowed_ingress(const struct net_bridge *br, + !br_opt_get(br, BROPT_VLAN_STATS_ENABLED)) { + if (*state == BR_STATE_FORWARDING) { + *state = br_vlan_get_pvid_state(vg); +- return br_vlan_state_allowed(*state, true); +- } else { +- return true; ++ if (!br_vlan_state_allowed(*state, true)) ++ goto drop; + } ++ return true; + } + } + v = br_vlan_find(vg, *vid); +-- +2.34.1 + diff --git a/queue-5.16/net-bridge-vlan-fix-single-net-device-option-dumping.patch-17660 b/queue-5.16/net-bridge-vlan-fix-single-net-device-option-dumping.patch-17660 new file mode 100644 index 00000000000..c5acc2cf825 --- /dev/null +++ b/queue-5.16/net-bridge-vlan-fix-single-net-device-option-dumping.patch-17660 @@ -0,0 +1,42 @@ +From 848cf106338f93ca2dd3a1ea187bb97122bd6118 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jan 2022 15:10:25 +0200 +Subject: net: bridge: vlan: fix single net device option dumping + +From: Nikolay Aleksandrov + +[ Upstream commit dcb2c5c6ca9b9177f04abaf76e5a983d177c9414 ] + +When dumping vlan options for a single net device we send the same +entries infinitely because user-space expects a 0 return at the end but +we keep returning skb->len and restarting the dump on retry. Fix it by +returning the value from br_vlan_dump_dev() if it completed or there was +an error. The only case that must return skb->len is when the dump was +incomplete and needs to continue (-EMSGSIZE). + +Reported-by: Benjamin Poirier +Fixes: 8dcea187088b ("net: bridge: vlan: add rtm definitions and dump support") +Signed-off-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/bridge/br_vlan.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c +index 49e105e0a4479..d0ebcc99bfa9d 100644 +--- a/net/bridge/br_vlan.c ++++ b/net/bridge/br_vlan.c +@@ -2020,7 +2020,8 @@ static int br_vlan_rtm_dump(struct sk_buff *skb, struct netlink_callback *cb) + goto out_err; + } + err = br_vlan_dump_dev(dev, skb, cb, dump_flags); +- if (err && err != -EMSGSIZE) ++ /* if the dump completed without an error we return 0 here */ ++ if (err != -EMSGSIZE) + goto out_err; + } else { + for_each_netdev_rcu(net, dev) { +-- +2.34.1 + diff --git a/queue-5.16/net-cpsw-properly-initialise-struct-page_pool_params.patch-1670 b/queue-5.16/net-cpsw-properly-initialise-struct-page_pool_params.patch-1670 new file mode 100644 index 00000000000..2d9d0aaf96a --- /dev/null +++ b/queue-5.16/net-cpsw-properly-initialise-struct-page_pool_params.patch-1670 @@ -0,0 +1,48 @@ +From 8629e4e6dca7aba5d2cb47e554ebea5c6dd0d1dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jan 2022 15:35:29 +0100 +Subject: net: cpsw: Properly initialise struct page_pool_params +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit c63003e3d99761afb280add3b30de1cf30fa522b ] + +The cpsw driver didn't properly initialise the struct page_pool_params +before calling page_pool_create(), which leads to crashes after the struct +has been expanded with new parameters. + +The second Fixes tag below is where the buggy code was introduced, but +because the code was moved around this patch will only apply on top of the +commit in the first Fixes tag. + +Fixes: c5013ac1dd0e ("net: ethernet: ti: cpsw: move set of common functions in cpsw_priv") +Fixes: 9ed4050c0d75 ("net: ethernet: ti: cpsw: add XDP support") +Reported-by: Colin Foster +Signed-off-by: Toke Høiland-Jørgensen +Tested-by: Colin Foster +Acked-by: Jesper Dangaard Brouer +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/cpsw_priv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ti/cpsw_priv.c b/drivers/net/ethernet/ti/cpsw_priv.c +index 6bb5ac51d23c3..f8e591d69d2cb 100644 +--- a/drivers/net/ethernet/ti/cpsw_priv.c ++++ b/drivers/net/ethernet/ti/cpsw_priv.c +@@ -1144,7 +1144,7 @@ int cpsw_fill_rx_channels(struct cpsw_priv *priv) + static struct page_pool *cpsw_create_page_pool(struct cpsw_common *cpsw, + int size) + { +- struct page_pool_params pp_params; ++ struct page_pool_params pp_params = {}; + struct page_pool *pool; + + pp_params.order = 0; +-- +2.34.1 + diff --git a/queue-5.16/net-fix-information-leakage-in-proc-net-ptype.patch-29118 b/queue-5.16/net-fix-information-leakage-in-proc-net-ptype.patch-29118 new file mode 100644 index 00000000000..7df8632b267 --- /dev/null +++ b/queue-5.16/net-fix-information-leakage-in-proc-net-ptype.patch-29118 @@ -0,0 +1,78 @@ +From f5b386035483bc97628ddc430e17fda12326647c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jan 2022 14:20:13 -0500 +Subject: net: fix information leakage in /proc/net/ptype + +From: Congyu Liu + +[ Upstream commit 47934e06b65637c88a762d9c98329ae6e3238888 ] + +In one net namespace, after creating a packet socket without binding +it to a device, users in other net namespaces can observe the new +`packet_type` added by this packet socket by reading `/proc/net/ptype` +file. This is minor information leakage as packet socket is +namespace aware. + +Add a net pointer in `packet_type` to keep the net namespace of +of corresponding packet socket. In `ptype_seq_show`, this net pointer +must be checked when it is not NULL. + +Fixes: 2feb27dbe00c ("[NETNS]: Minor information leak via /proc/net/ptype file.") +Signed-off-by: Congyu Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/netdevice.h | 1 + + net/core/net-procfs.c | 3 ++- + net/packet/af_packet.c | 2 ++ + 3 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index 6aadcc0ecb5b0..6cbefb660fa3b 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -2636,6 +2636,7 @@ struct packet_type { + struct net_device *); + bool (*id_match)(struct packet_type *ptype, + struct sock *sk); ++ struct net *af_packet_net; + void *af_packet_priv; + struct list_head list; + }; +diff --git a/net/core/net-procfs.c b/net/core/net-procfs.c +index d8b9dbabd4a43..5b8016335acaf 100644 +--- a/net/core/net-procfs.c ++++ b/net/core/net-procfs.c +@@ -260,7 +260,8 @@ static int ptype_seq_show(struct seq_file *seq, void *v) + + if (v == SEQ_START_TOKEN) + seq_puts(seq, "Type Device Function\n"); +- else if (pt->dev == NULL || dev_net(pt->dev) == seq_file_net(seq)) { ++ else if ((!pt->af_packet_net || net_eq(pt->af_packet_net, seq_file_net(seq))) && ++ (!pt->dev || net_eq(dev_net(pt->dev), seq_file_net(seq)))) { + if (pt->type == htons(ETH_P_ALL)) + seq_puts(seq, "ALL "); + else +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 76c2dca7f0a59..43eef5c712c1e 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1773,6 +1773,7 @@ static int fanout_add(struct sock *sk, struct fanout_args *args) + match->prot_hook.dev = po->prot_hook.dev; + match->prot_hook.func = packet_rcv_fanout; + match->prot_hook.af_packet_priv = match; ++ match->prot_hook.af_packet_net = read_pnet(&match->net); + match->prot_hook.id_match = match_fanout_group; + match->max_num_members = args->max_num_members; + list_add(&match->list, &fanout_list); +@@ -3358,6 +3359,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol, + po->prot_hook.func = packet_rcv_spkt; + + po->prot_hook.af_packet_priv = sk; ++ po->prot_hook.af_packet_net = sock_net(sk); + + if (proto) { + po->prot_hook.type = proto; +-- +2.34.1 + diff --git a/queue-5.16/net-hns3-handle-empty-unknown-interrupt-for-vf.patch-12360 b/queue-5.16/net-hns3-handle-empty-unknown-interrupt-for-vf.patch-12360 new file mode 100644 index 00000000000..5442d833d17 --- /dev/null +++ b/queue-5.16/net-hns3-handle-empty-unknown-interrupt-for-vf.patch-12360 @@ -0,0 +1,41 @@ +From 5b85a28cd019740a5e1b90bec6ae47fce140f533 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jan 2022 15:03:12 +0800 +Subject: net: hns3: handle empty unknown interrupt for VF + +From: Yufeng Mo + +[ Upstream commit 2f61353cd2f789a4229b6f5c1c24a40a613357bb ] + +Since some interrupt states may be cleared by hardware, the driver +may receive an empty interrupt. Currently, the VF driver directly +disables the vector0 interrupt in this case. As a result, the VF +is unavailable. Therefore, the vector0 interrupt should be enabled +in this case. + +Fixes: b90fcc5bd904 ("net: hns3: add reset handling for VF when doing Core/Global/IMP reset") +Signed-off-by: Yufeng Mo +Signed-off-by: Guangbin Huang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +index 41afaeea881bc..70491e07b0ff6 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -2496,8 +2496,7 @@ static irqreturn_t hclgevf_misc_irq_handle(int irq, void *data) + break; + } + +- if (event_cause != HCLGEVF_VECTOR0_EVENT_OTHER) +- hclgevf_enable_vector(&hdev->misc_vector, true); ++ hclgevf_enable_vector(&hdev->misc_vector, true); + + return IRQ_HANDLED; + } +-- +2.34.1 + diff --git a/queue-5.16/net-phy-broadcom-hook-up-soft_reset-for-bcm54616s.patch-8413 b/queue-5.16/net-phy-broadcom-hook-up-soft_reset-for-bcm54616s.patch-8413 new file mode 100644 index 00000000000..d30b81f50ad --- /dev/null +++ b/queue-5.16/net-phy-broadcom-hook-up-soft_reset-for-bcm54616s.patch-8413 @@ -0,0 +1,61 @@ +From 00058aad62519b6a0801bf30e8757e55e56f666b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jan 2022 15:52:43 -0600 +Subject: net: phy: broadcom: hook up soft_reset for BCM54616S + +From: Robert Hancock + +[ Upstream commit d15c7e875d44367005370e6a82e8f3a382a04f9b ] + +A problem was encountered with the Bel-Fuse 1GBT-SFP05 SFP module (which +is a 1 Gbps copper module operating in SGMII mode with an internal +BCM54616S PHY device) using the Xilinx AXI Ethernet MAC core, where the +module would work properly on the initial insertion or boot of the +device, but after the device was rebooted, the link would either only +come up at 100 Mbps speeds or go up and down erratically. + +I found no meaningful changes in the PHY configuration registers between +the working and non-working boots, but the status registers seemed to +have a lot of error indications set on the SERDES side of the device on +the non-working boot. I suspect the problem is that whatever happens on +the SGMII link when the device is rebooted and the FPGA logic gets +reloaded ends up putting the module's onboard PHY into a bad state. + +Since commit 6e2d85ec0559 ("net: phy: Stop with excessive soft reset") +the genphy_soft_reset call is not made automatically by the PHY core +unless the callback is explicitly specified in the driver structure. For +most of these Broadcom devices, there is probably a hardware reset that +gets asserted to reset the PHY during boot, however for SFP modules +(where the BCM54616S is commonly found) no such reset line exists, so if +the board keeps the SFP cage powered up across a reboot, it will end up +with no reset occurring during reboots. + +Hook up the genphy_soft_reset callback for BCM54616S to ensure that a +PHY reset is performed before the device is initialized. This appears to +fix the issue with erratic operation after a reboot with this SFP +module. + +Fixes: 6e2d85ec0559 ("net: phy: Stop with excessive soft reset") +Signed-off-by: Robert Hancock +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/broadcom.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c +index bb5104ae46104..3c683e0e40e9e 100644 +--- a/drivers/net/phy/broadcom.c ++++ b/drivers/net/phy/broadcom.c +@@ -854,6 +854,7 @@ static struct phy_driver broadcom_drivers[] = { + .phy_id_mask = 0xfffffff0, + .name = "Broadcom BCM54616S", + /* PHY_GBIT_FEATURES */ ++ .soft_reset = genphy_soft_reset, + .config_init = bcm54xx_config_init, + .config_aneg = bcm54616s_config_aneg, + .config_intr = bcm_phy_config_intr, +-- +2.34.1 + diff --git a/queue-5.16/net-procfs-show-net-devices-bound-packet-types.patch-19867 b/queue-5.16/net-procfs-show-net-devices-bound-packet-types.patch-19867 new file mode 100644 index 00000000000..849d9c6c5dc --- /dev/null +++ b/queue-5.16/net-procfs-show-net-devices-bound-packet-types.patch-19867 @@ -0,0 +1,117 @@ +From 4cd9256ba73d8a7bf640ad1e1ece57b2487052fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 17:15:31 +0800 +Subject: net-procfs: show net devices bound packet types + +From: Jianguo Wu + +[ Upstream commit 1d10f8a1f40b965d449e8f2d5ed7b96a7c138b77 ] + +After commit:7866a621043f ("dev: add per net_device packet type chains"), +we can not get packet types that are bound to a specified net device by +/proc/net/ptype, this patch fix the regression. + +Run "tcpdump -i ens192 udp -nns0" Before and after apply this patch: + +Before: + [root@localhost ~]# cat /proc/net/ptype + Type Device Function + 0800 ip_rcv + 0806 arp_rcv + 86dd ipv6_rcv + +After: + [root@localhost ~]# cat /proc/net/ptype + Type Device Function + ALL ens192 tpacket_rcv + 0800 ip_rcv + 0806 arp_rcv + 86dd ipv6_rcv + +v1 -> v2: + - fix the regression rather than adding new /proc API as + suggested by Stephen Hemminger. + +Fixes: 7866a621043f ("dev: add per net_device packet type chains") +Signed-off-by: Jianguo Wu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/net-procfs.c | 35 ++++++++++++++++++++++++++++++++--- + 1 file changed, 32 insertions(+), 3 deletions(-) + +diff --git a/net/core/net-procfs.c b/net/core/net-procfs.c +index 5b8016335acaf..88cc0ad7d386e 100644 +--- a/net/core/net-procfs.c ++++ b/net/core/net-procfs.c +@@ -190,12 +190,23 @@ static const struct seq_operations softnet_seq_ops = { + .show = softnet_seq_show, + }; + +-static void *ptype_get_idx(loff_t pos) ++static void *ptype_get_idx(struct seq_file *seq, loff_t pos) + { ++ struct list_head *ptype_list = NULL; + struct packet_type *pt = NULL; ++ struct net_device *dev; + loff_t i = 0; + int t; + ++ for_each_netdev_rcu(seq_file_net(seq), dev) { ++ ptype_list = &dev->ptype_all; ++ list_for_each_entry_rcu(pt, ptype_list, list) { ++ if (i == pos) ++ return pt; ++ ++i; ++ } ++ } ++ + list_for_each_entry_rcu(pt, &ptype_all, list) { + if (i == pos) + return pt; +@@ -216,22 +227,40 @@ static void *ptype_seq_start(struct seq_file *seq, loff_t *pos) + __acquires(RCU) + { + rcu_read_lock(); +- return *pos ? ptype_get_idx(*pos - 1) : SEQ_START_TOKEN; ++ return *pos ? ptype_get_idx(seq, *pos - 1) : SEQ_START_TOKEN; + } + + static void *ptype_seq_next(struct seq_file *seq, void *v, loff_t *pos) + { ++ struct net_device *dev; + struct packet_type *pt; + struct list_head *nxt; + int hash; + + ++*pos; + if (v == SEQ_START_TOKEN) +- return ptype_get_idx(0); ++ return ptype_get_idx(seq, 0); + + pt = v; + nxt = pt->list.next; ++ if (pt->dev) { ++ if (nxt != &pt->dev->ptype_all) ++ goto found; ++ ++ dev = pt->dev; ++ for_each_netdev_continue_rcu(seq_file_net(seq), dev) { ++ if (!list_empty(&dev->ptype_all)) { ++ nxt = dev->ptype_all.next; ++ goto found; ++ } ++ } ++ ++ nxt = ptype_all.next; ++ goto ptype_all; ++ } ++ + if (pt->type == htons(ETH_P_ALL)) { ++ptype_all: + if (nxt != &ptype_all) + goto found; + hash = 0; +-- +2.34.1 + diff --git a/queue-5.16/net-smc-transitional-solution-for-clcsock-race-issue.patch-3308 b/queue-5.16/net-smc-transitional-solution-for-clcsock-race-issue.patch-3308 new file mode 100644 index 00000000000..09623dfdd7b --- /dev/null +++ b/queue-5.16/net-smc-transitional-solution-for-clcsock-race-issue.patch-3308 @@ -0,0 +1,201 @@ +From b1879fcc97b37cb568f934cbf4846bfe34bfff64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jan 2022 17:43:09 +0800 +Subject: net/smc: Transitional solution for clcsock race issue + +From: Wen Gu + +[ Upstream commit c0bf3d8a943b6f2e912b7c1de03e2ef28e76f760 ] + +We encountered a crash in smc_setsockopt() and it is caused by +accessing smc->clcsock after clcsock was released. + + BUG: kernel NULL pointer dereference, address: 0000000000000020 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 0 P4D 0 + Oops: 0000 [#1] PREEMPT SMP PTI + CPU: 1 PID: 50309 Comm: nginx Kdump: loaded Tainted: G E 5.16.0-rc4+ #53 + RIP: 0010:smc_setsockopt+0x59/0x280 [smc] + Call Trace: + + __sys_setsockopt+0xfc/0x190 + __x64_sys_setsockopt+0x20/0x30 + do_syscall_64+0x34/0x90 + entry_SYSCALL_64_after_hwframe+0x44/0xae + RIP: 0033:0x7f16ba83918e + + +This patch tries to fix it by holding clcsock_release_lock and +checking whether clcsock has already been released before access. + +In case that a crash of the same reason happens in smc_getsockopt() +or smc_switch_to_fallback(), this patch also checkes smc->clcsock +in them too. And the caller of smc_switch_to_fallback() will identify +whether fallback succeeds according to the return value. + +Fixes: fd57770dd198 ("net/smc: wait for pending work before clcsock release_sock") +Link: https://lore.kernel.org/lkml/5dd7ffd1-28e2-24cc-9442-1defec27375e@linux.ibm.com/T/ +Signed-off-by: Wen Gu +Acked-by: Karsten Graul +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/af_smc.c | 63 +++++++++++++++++++++++++++++++++++++++--------- + 1 file changed, 51 insertions(+), 12 deletions(-) + +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 211cd91b6c408..85e077a69c67d 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -566,12 +566,17 @@ static void smc_stat_fallback(struct smc_sock *smc) + mutex_unlock(&net->smc.mutex_fback_rsn); + } + +-static void smc_switch_to_fallback(struct smc_sock *smc, int reason_code) ++static int smc_switch_to_fallback(struct smc_sock *smc, int reason_code) + { + wait_queue_head_t *smc_wait = sk_sleep(&smc->sk); +- wait_queue_head_t *clc_wait = sk_sleep(smc->clcsock->sk); ++ wait_queue_head_t *clc_wait; + unsigned long flags; + ++ mutex_lock(&smc->clcsock_release_lock); ++ if (!smc->clcsock) { ++ mutex_unlock(&smc->clcsock_release_lock); ++ return -EBADF; ++ } + smc->use_fallback = true; + smc->fallback_rsn = reason_code; + smc_stat_fallback(smc); +@@ -586,18 +591,30 @@ static void smc_switch_to_fallback(struct smc_sock *smc, int reason_code) + * smc socket->wq, which should be removed + * to clcsocket->wq during the fallback. + */ ++ clc_wait = sk_sleep(smc->clcsock->sk); + spin_lock_irqsave(&smc_wait->lock, flags); + spin_lock_nested(&clc_wait->lock, SINGLE_DEPTH_NESTING); + list_splice_init(&smc_wait->head, &clc_wait->head); + spin_unlock(&clc_wait->lock); + spin_unlock_irqrestore(&smc_wait->lock, flags); + } ++ mutex_unlock(&smc->clcsock_release_lock); ++ return 0; + } + + /* fall back during connect */ + static int smc_connect_fallback(struct smc_sock *smc, int reason_code) + { +- smc_switch_to_fallback(smc, reason_code); ++ struct net *net = sock_net(&smc->sk); ++ int rc = 0; ++ ++ rc = smc_switch_to_fallback(smc, reason_code); ++ if (rc) { /* fallback fails */ ++ this_cpu_inc(net->smc.smc_stats->clnt_hshake_err_cnt); ++ if (smc->sk.sk_state == SMC_INIT) ++ sock_put(&smc->sk); /* passive closing */ ++ return rc; ++ } + smc_copy_sock_settings_to_clc(smc); + smc->connect_nonblock = 0; + if (smc->sk.sk_state == SMC_INIT) +@@ -1514,11 +1531,12 @@ static void smc_listen_decline(struct smc_sock *new_smc, int reason_code, + { + /* RDMA setup failed, switch back to TCP */ + smc_conn_abort(new_smc, local_first); +- if (reason_code < 0) { /* error, no fallback possible */ ++ if (reason_code < 0 || ++ smc_switch_to_fallback(new_smc, reason_code)) { ++ /* error, no fallback possible */ + smc_listen_out_err(new_smc); + return; + } +- smc_switch_to_fallback(new_smc, reason_code); + if (reason_code && reason_code != SMC_CLC_DECL_PEERDECL) { + if (smc_clc_send_decline(new_smc, reason_code, version) < 0) { + smc_listen_out_err(new_smc); +@@ -1960,8 +1978,11 @@ static void smc_listen_work(struct work_struct *work) + + /* check if peer is smc capable */ + if (!tcp_sk(newclcsock->sk)->syn_smc) { +- smc_switch_to_fallback(new_smc, SMC_CLC_DECL_PEERNOSMC); +- smc_listen_out_connected(new_smc); ++ rc = smc_switch_to_fallback(new_smc, SMC_CLC_DECL_PEERNOSMC); ++ if (rc) ++ smc_listen_out_err(new_smc); ++ else ++ smc_listen_out_connected(new_smc); + return; + } + +@@ -2250,7 +2271,9 @@ static int smc_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + + if (msg->msg_flags & MSG_FASTOPEN) { + if (sk->sk_state == SMC_INIT && !smc->connect_nonblock) { +- smc_switch_to_fallback(smc, SMC_CLC_DECL_OPTUNSUPP); ++ rc = smc_switch_to_fallback(smc, SMC_CLC_DECL_OPTUNSUPP); ++ if (rc) ++ goto out; + } else { + rc = -EINVAL; + goto out; +@@ -2443,6 +2466,11 @@ static int smc_setsockopt(struct socket *sock, int level, int optname, + /* generic setsockopts reaching us here always apply to the + * CLC socket + */ ++ mutex_lock(&smc->clcsock_release_lock); ++ if (!smc->clcsock) { ++ mutex_unlock(&smc->clcsock_release_lock); ++ return -EBADF; ++ } + if (unlikely(!smc->clcsock->ops->setsockopt)) + rc = -EOPNOTSUPP; + else +@@ -2452,6 +2480,7 @@ static int smc_setsockopt(struct socket *sock, int level, int optname, + sk->sk_err = smc->clcsock->sk->sk_err; + sk_error_report(sk); + } ++ mutex_unlock(&smc->clcsock_release_lock); + + if (optlen < sizeof(int)) + return -EINVAL; +@@ -2468,7 +2497,7 @@ static int smc_setsockopt(struct socket *sock, int level, int optname, + case TCP_FASTOPEN_NO_COOKIE: + /* option not supported by SMC */ + if (sk->sk_state == SMC_INIT && !smc->connect_nonblock) { +- smc_switch_to_fallback(smc, SMC_CLC_DECL_OPTUNSUPP); ++ rc = smc_switch_to_fallback(smc, SMC_CLC_DECL_OPTUNSUPP); + } else { + rc = -EINVAL; + } +@@ -2511,13 +2540,23 @@ static int smc_getsockopt(struct socket *sock, int level, int optname, + char __user *optval, int __user *optlen) + { + struct smc_sock *smc; ++ int rc; + + smc = smc_sk(sock->sk); ++ mutex_lock(&smc->clcsock_release_lock); ++ if (!smc->clcsock) { ++ mutex_unlock(&smc->clcsock_release_lock); ++ return -EBADF; ++ } + /* socket options apply to the CLC socket */ +- if (unlikely(!smc->clcsock->ops->getsockopt)) ++ if (unlikely(!smc->clcsock->ops->getsockopt)) { ++ mutex_unlock(&smc->clcsock_release_lock); + return -EOPNOTSUPP; +- return smc->clcsock->ops->getsockopt(smc->clcsock, level, optname, +- optval, optlen); ++ } ++ rc = smc->clcsock->ops->getsockopt(smc->clcsock, level, optname, ++ optval, optlen); ++ mutex_unlock(&smc->clcsock_release_lock); ++ return rc; + } + + static int smc_ioctl(struct socket *sock, unsigned int cmd, +-- +2.34.1 + diff --git a/queue-5.16/net-stmmac-dwmac-visconti-fix-bit-definitions-for-et.patch-15977 b/queue-5.16/net-stmmac-dwmac-visconti-fix-bit-definitions-for-et.patch-15977 new file mode 100644 index 00000000000..d1486414bff --- /dev/null +++ b/queue-5.16/net-stmmac-dwmac-visconti-fix-bit-definitions-for-et.patch-15977 @@ -0,0 +1,60 @@ +From 02624474bec084abaaa633d05b33279eac8f8e8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jan 2022 13:46:47 +0900 +Subject: net: stmmac: dwmac-visconti: Fix bit definitions for ETHER_CLK_SEL + +From: Yuji Ishikawa + +[ Upstream commit 1ba1a4a90fa416a6f389206416c5f488cf8b1543 ] + +just 0 should be used to represent cleared bits + +* ETHER_CLK_SEL_DIV_SEL_20 +* ETHER_CLK_SEL_TX_CLK_EXT_SEL_IN +* ETHER_CLK_SEL_RX_CLK_EXT_SEL_IN +* ETHER_CLK_SEL_TX_CLK_O_TX_I +* ETHER_CLK_SEL_RMII_CLK_SEL_IN + +Fixes: b38dd98ff8d0 ("net: stmmac: Add Toshiba Visconti SoCs glue driver") +Signed-off-by: Yuji Ishikawa +Reviewed-by: Nobuhiro Iwamatsu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c +index e2e0f977875d7..43a446ceadf7a 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c +@@ -22,21 +22,21 @@ + #define ETHER_CLK_SEL_RMII_CLK_EN BIT(2) + #define ETHER_CLK_SEL_RMII_CLK_RST BIT(3) + #define ETHER_CLK_SEL_DIV_SEL_2 BIT(4) +-#define ETHER_CLK_SEL_DIV_SEL_20 BIT(0) ++#define ETHER_CLK_SEL_DIV_SEL_20 0 + #define ETHER_CLK_SEL_FREQ_SEL_125M (BIT(9) | BIT(8)) + #define ETHER_CLK_SEL_FREQ_SEL_50M BIT(9) + #define ETHER_CLK_SEL_FREQ_SEL_25M BIT(8) + #define ETHER_CLK_SEL_FREQ_SEL_2P5M 0 +-#define ETHER_CLK_SEL_TX_CLK_EXT_SEL_IN BIT(0) ++#define ETHER_CLK_SEL_TX_CLK_EXT_SEL_IN 0 + #define ETHER_CLK_SEL_TX_CLK_EXT_SEL_TXC BIT(10) + #define ETHER_CLK_SEL_TX_CLK_EXT_SEL_DIV BIT(11) +-#define ETHER_CLK_SEL_RX_CLK_EXT_SEL_IN BIT(0) ++#define ETHER_CLK_SEL_RX_CLK_EXT_SEL_IN 0 + #define ETHER_CLK_SEL_RX_CLK_EXT_SEL_RXC BIT(12) + #define ETHER_CLK_SEL_RX_CLK_EXT_SEL_DIV BIT(13) +-#define ETHER_CLK_SEL_TX_CLK_O_TX_I BIT(0) ++#define ETHER_CLK_SEL_TX_CLK_O_TX_I 0 + #define ETHER_CLK_SEL_TX_CLK_O_RMII_I BIT(14) + #define ETHER_CLK_SEL_TX_O_E_N_IN BIT(15) +-#define ETHER_CLK_SEL_RMII_CLK_SEL_IN BIT(0) ++#define ETHER_CLK_SEL_RMII_CLK_SEL_IN 0 + #define ETHER_CLK_SEL_RMII_CLK_SEL_RX_C BIT(16) + + #define ETHER_CLK_SEL_RX_TX_CLK_EN (ETHER_CLK_SEL_RX_CLK_EN | ETHER_CLK_SEL_TX_CLK_EN) +-- +2.34.1 + diff --git a/queue-5.16/net-stmmac-dwmac-visconti-fix-clock-configuration-fo.patch-10364 b/queue-5.16/net-stmmac-dwmac-visconti-fix-clock-configuration-fo.patch-10364 new file mode 100644 index 00000000000..2ae5b57e1a4 --- /dev/null +++ b/queue-5.16/net-stmmac-dwmac-visconti-fix-clock-configuration-fo.patch-10364 @@ -0,0 +1,81 @@ +From a670ffcc3cd7ff84f1bca0d33bc354bdeb222ed2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jan 2022 13:46:48 +0900 +Subject: net: stmmac: dwmac-visconti: Fix clock configuration for RMII mode + +From: Yuji Ishikawa + +[ Upstream commit 0959bc4bd4206433ed101a1332a23e93ad16ec77 ] + +Bit pattern of the ETHER_CLOCK_SEL register for RMII/MII mode should be fixed. +Also, some control bits should be modified with a specific sequence. + +Fixes: b38dd98ff8d0 ("net: stmmac: Add Toshiba Visconti SoCs glue driver") +Signed-off-by: Yuji Ishikawa +Reviewed-by: Nobuhiro Iwamatsu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../ethernet/stmicro/stmmac/dwmac-visconti.c | 32 ++++++++++++------- + 1 file changed, 21 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c +index 43a446ceadf7a..dde5b772a5af7 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c +@@ -96,31 +96,41 @@ static void visconti_eth_fix_mac_speed(void *priv, unsigned int speed) + val |= ETHER_CLK_SEL_TX_O_E_N_IN; + writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL); + ++ /* Set Clock-Mux, Start clock, Set TX_O direction */ + switch (dwmac->phy_intf_sel) { + case ETHER_CONFIG_INTF_RGMII: + val = clk_sel_val | ETHER_CLK_SEL_RX_CLK_EXT_SEL_RXC; ++ writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL); ++ ++ val |= ETHER_CLK_SEL_RX_TX_CLK_EN; ++ writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL); ++ ++ val &= ~ETHER_CLK_SEL_TX_O_E_N_IN; ++ writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL); + break; + case ETHER_CONFIG_INTF_RMII: + val = clk_sel_val | ETHER_CLK_SEL_RX_CLK_EXT_SEL_DIV | +- ETHER_CLK_SEL_TX_CLK_EXT_SEL_TXC | ETHER_CLK_SEL_TX_O_E_N_IN | ++ ETHER_CLK_SEL_TX_CLK_EXT_SEL_DIV | ETHER_CLK_SEL_TX_O_E_N_IN | + ETHER_CLK_SEL_RMII_CLK_SEL_RX_C; ++ writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL); ++ ++ val |= ETHER_CLK_SEL_RMII_CLK_RST; ++ writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL); ++ ++ val |= ETHER_CLK_SEL_RMII_CLK_EN | ETHER_CLK_SEL_RX_TX_CLK_EN; ++ writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL); + break; + case ETHER_CONFIG_INTF_MII: + default: + val = clk_sel_val | ETHER_CLK_SEL_RX_CLK_EXT_SEL_RXC | +- ETHER_CLK_SEL_TX_CLK_EXT_SEL_DIV | ETHER_CLK_SEL_TX_O_E_N_IN | +- ETHER_CLK_SEL_RMII_CLK_EN; ++ ETHER_CLK_SEL_TX_CLK_EXT_SEL_TXC | ETHER_CLK_SEL_TX_O_E_N_IN; ++ writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL); ++ ++ val |= ETHER_CLK_SEL_RX_TX_CLK_EN; ++ writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL); + break; + } + +- /* Start clock */ +- writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL); +- val |= ETHER_CLK_SEL_RX_TX_CLK_EN; +- writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL); +- +- val &= ~ETHER_CLK_SEL_TX_O_E_N_IN; +- writel(val, dwmac->reg + REG_ETHER_CLOCK_SEL); +- + spin_unlock_irqrestore(&dwmac->lock, flags); + } + +-- +2.34.1 + diff --git a/queue-5.16/netfilter-conntrack-don-t-increment-invalid-counter-.patch-26784 b/queue-5.16/netfilter-conntrack-don-t-increment-invalid-counter-.patch-26784 new file mode 100644 index 00000000000..ce97dd4a273 --- /dev/null +++ b/queue-5.16/netfilter-conntrack-don-t-increment-invalid-counter-.patch-26784 @@ -0,0 +1,51 @@ +From ed9206120b4f51d8c8475376255c08437fd57d94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jan 2022 21:37:58 +0100 +Subject: netfilter: conntrack: don't increment invalid counter on NF_REPEAT + +From: Florian Westphal + +[ Upstream commit 830af2eba40327abec64325a5b08b1e85c37a2e0 ] + +The packet isn't invalid, REPEAT means we're trying again after cleaning +out a stale connection, e.g. via tcp tracker. + +This caused increases of invalid stat counter in a test case involving +frequent connection reuse, even though no packet is actually invalid. + +Fixes: 56a62e2218f5 ("netfilter: conntrack: fix NF_REPEAT handling") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_core.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index 4712a90a1820c..7f79974607643 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -1922,15 +1922,17 @@ repeat: + pr_debug("nf_conntrack_in: Can't track with proto module\n"); + nf_conntrack_put(&ct->ct_general); + skb->_nfct = 0; +- NF_CT_STAT_INC_ATOMIC(state->net, invalid); +- if (ret == -NF_DROP) +- NF_CT_STAT_INC_ATOMIC(state->net, drop); + /* Special case: TCP tracker reports an attempt to reopen a + * closed/aborted connection. We have to go back and create a + * fresh conntrack. + */ + if (ret == -NF_REPEAT) + goto repeat; ++ ++ NF_CT_STAT_INC_ATOMIC(state->net, invalid); ++ if (ret == -NF_DROP) ++ NF_CT_STAT_INC_ATOMIC(state->net, drop); ++ + ret = -ret; + goto out; + } +-- +2.34.1 + diff --git a/queue-5.16/nfs-ensure-the-server-has-an-up-to-date-ctime-before.patch-13548 b/queue-5.16/nfs-ensure-the-server-has-an-up-to-date-ctime-before.patch-13548 new file mode 100644 index 00000000000..9b8e5d5e772 --- /dev/null +++ b/queue-5.16/nfs-ensure-the-server-has-an-up-to-date-ctime-before.patch-13548 @@ -0,0 +1,37 @@ +From a5e2d01ea3a7da3f5f73d458a93f604ae43cecba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Dec 2021 16:38:16 -0500 +Subject: NFS: Ensure the server has an up to date ctime before renaming + +From: Trond Myklebust + +[ Upstream commit 6ff9d99bb88faebf134ca668842349d9718e5464 ] + +Renaming a file is required by POSIX to update the file ctime, so +ensure that the file data is synced to disk so that we don't clobber the +updated ctime by writing back after creating the hard link. + +Fixes: f2c2c552f119 ("NFS: Move delegation recall into the NFSv4 callback for rename_setup()") +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/dir.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c +index 4c4fdb208c7ba..27f0ad4817491 100644 +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -2470,6 +2470,8 @@ int nfs_rename(struct user_namespace *mnt_userns, struct inode *old_dir, + } + } + ++ if (S_ISREG(old_inode->i_mode)) ++ nfs_sync_inode(old_inode); + task = nfs_async_rename(old_dir, new_dir, old_dentry, new_dentry, NULL); + if (IS_ERR(task)) { + error = PTR_ERR(task); +-- +2.34.1 + diff --git a/queue-5.16/nfs-ensure-the-server-has-an-up-to-date-ctime-before.patch-14919 b/queue-5.16/nfs-ensure-the-server-has-an-up-to-date-ctime-before.patch-14919 new file mode 100644 index 00000000000..2356519a366 --- /dev/null +++ b/queue-5.16/nfs-ensure-the-server-has-an-up-to-date-ctime-before.patch-14919 @@ -0,0 +1,37 @@ +From b64b17ed39075186ce4d254ef85d2a27da49d4d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Dec 2021 16:38:15 -0500 +Subject: NFS: Ensure the server has an up to date ctime before hardlinking + +From: Trond Myklebust + +[ Upstream commit 204975036b34f55237bc44c8a302a88468ef21b5 ] + +Creating a hard link is required by POSIX to update the file ctime, so +ensure that the file data is synced to disk so that we don't clobber the +updated ctime by writing back after creating the hard link. + +Fixes: 9f7682728728 ("NFS: Move the delegation return down into nfs4_proc_link()") +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/dir.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c +index 731d31015b6aa..4c4fdb208c7ba 100644 +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -2379,6 +2379,8 @@ nfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *dentry) + + trace_nfs_link_enter(inode, dir, dentry); + d_drop(dentry); ++ if (S_ISREG(inode->i_mode)) ++ nfs_sync_inode(inode); + error = NFS_PROTO(dir)->link(inode, dir, &dentry->d_name); + if (error == 0) { + nfs_set_verifier(dentry, nfs_save_change_attribute(dir)); +-- +2.34.1 + diff --git a/queue-5.16/nfsv4-handle-case-where-the-lookup-of-a-directory-fa.patch-32762 b/queue-5.16/nfsv4-handle-case-where-the-lookup-of-a-directory-fa.patch-32762 new file mode 100644 index 00000000000..6a5ad93d9e5 --- /dev/null +++ b/queue-5.16/nfsv4-handle-case-where-the-lookup-of-a-directory-fa.patch-32762 @@ -0,0 +1,52 @@ +From 339c3f5d5e2f4571b95a5e950766d470027ada8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jan 2022 18:24:02 -0500 +Subject: NFSv4: Handle case where the lookup of a directory fails + +From: Trond Myklebust + +[ Upstream commit ac795161c93699d600db16c1a8cc23a65a1eceaf ] + +If the application sets the O_DIRECTORY flag, and tries to open a +regular file, nfs_atomic_open() will punt to doing a regular lookup. +If the server then returns a regular file, we will happily return a +file descriptor with uninitialised open state. + +The fix is to return the expected ENOTDIR error in these cases. + +Reported-by: Lyu Tao +Fixes: 0dd2b474d0b6 ("nfs: implement i_op->atomic_open()") +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/dir.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c +index 27f0ad4817491..2604abbd832eb 100644 +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -1967,6 +1967,19 @@ out: + + no_open: + res = nfs_lookup(dir, dentry, lookup_flags); ++ if (!res) { ++ inode = d_inode(dentry); ++ if ((lookup_flags & LOOKUP_DIRECTORY) && inode && ++ !S_ISDIR(inode->i_mode)) ++ res = ERR_PTR(-ENOTDIR); ++ } else if (!IS_ERR(res)) { ++ inode = d_inode(res); ++ if ((lookup_flags & LOOKUP_DIRECTORY) && inode && ++ !S_ISDIR(inode->i_mode)) { ++ dput(res); ++ res = ERR_PTR(-ENOTDIR); ++ } ++ } + if (switched) { + d_lookup_done(dentry); + if (!res) +-- +2.34.1 + diff --git a/queue-5.16/nfsv4-nfs_atomic_open-can-race-when-looking-up-a-non.patch-311 b/queue-5.16/nfsv4-nfs_atomic_open-can-race-when-looking-up-a-non.patch-311 new file mode 100644 index 00000000000..9c59635363d --- /dev/null +++ b/queue-5.16/nfsv4-nfs_atomic_open-can-race-when-looking-up-a-non.patch-311 @@ -0,0 +1,45 @@ +From 2d8d8041b20ab97e1c19c69b3400d19d88120541 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jan 2022 18:24:03 -0500 +Subject: NFSv4: nfs_atomic_open() can race when looking up a non-regular file + +From: Trond Myklebust + +[ Upstream commit 1751fc1db36f6f411709e143d5393f92d12137a9 ] + +If the file type changes back to being a regular file on the server +between the failed OPEN and our LOOKUP, then we need to re-run the OPEN. + +Fixes: 0dd2b474d0b6 ("nfs: implement i_op->atomic_open()") +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/dir.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c +index 2604abbd832eb..24ce5652d9be8 100644 +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -1972,12 +1972,17 @@ no_open: + if ((lookup_flags & LOOKUP_DIRECTORY) && inode && + !S_ISDIR(inode->i_mode)) + res = ERR_PTR(-ENOTDIR); ++ else if (inode && S_ISREG(inode->i_mode)) ++ res = ERR_PTR(-EOPENSTALE); + } else if (!IS_ERR(res)) { + inode = d_inode(res); + if ((lookup_flags & LOOKUP_DIRECTORY) && inode && + !S_ISDIR(inode->i_mode)) { + dput(res); + res = ERR_PTR(-ENOTDIR); ++ } else if (inode && S_ISREG(inode->i_mode)) { ++ dput(res); ++ res = ERR_PTR(-EOPENSTALE); + } + } + if (switched) { +-- +2.34.1 + diff --git a/queue-5.16/octeontx2-af-add-kpu-changes-to-parse-ngio-as-separa.patch-20656 b/queue-5.16/octeontx2-af-add-kpu-changes-to-parse-ngio-as-separa.patch-20656 new file mode 100644 index 00000000000..f1069527326 --- /dev/null +++ b/queue-5.16/octeontx2-af-add-kpu-changes-to-parse-ngio-as-separa.patch-20656 @@ -0,0 +1,171 @@ +From 7bf3b96bda6b6509398d0e1382f5918a495cdc80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 12:04:47 +0530 +Subject: octeontx2-af: Add KPU changes to parse NGIO as separate layer + +From: Kiran Kumar K + +[ Upstream commit 745166fcf01cecc4f5ff3defc6586868349a43f9 ] + +With current KPU profile NGIO is being parsed along with CTAG as +a single layer. Because of this MCAM/ntuple rules installed with +ethertype as 0x8842 are not being hit. Adding KPU profile changes +to parse NGIO in separate ltype and CTAG in separate ltype. + +Fixes: f9c49be90c05 ("octeontx2-af: Update the default KPU profile and fixes") +Signed-off-by: Kiran Kumar K +Signed-off-by: Subbaraya Sundeep +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../marvell/octeontx2/af/npc_profile.h | 70 +++++++++---------- + 1 file changed, 35 insertions(+), 35 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h b/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h +index 0fe7ad35e36fd..4180376fa6763 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h +@@ -185,7 +185,6 @@ enum npc_kpu_parser_state { + NPC_S_KPU2_QINQ, + NPC_S_KPU2_ETAG, + NPC_S_KPU2_EXDSA, +- NPC_S_KPU2_NGIO, + NPC_S_KPU2_CPT_CTAG, + NPC_S_KPU2_CPT_QINQ, + NPC_S_KPU3_CTAG, +@@ -212,6 +211,7 @@ enum npc_kpu_parser_state { + NPC_S_KPU5_NSH, + NPC_S_KPU5_CPT_IP, + NPC_S_KPU5_CPT_IP6, ++ NPC_S_KPU5_NGIO, + NPC_S_KPU6_IP6_EXT, + NPC_S_KPU6_IP6_HOP_DEST, + NPC_S_KPU6_IP6_ROUT, +@@ -1120,15 +1120,6 @@ static struct npc_kpu_profile_cam kpu1_cam_entries[] = { + 0x0000, + 0x0000, + }, +- { +- NPC_S_KPU1_ETHER, 0xff, +- NPC_ETYPE_CTAG, +- 0xffff, +- NPC_ETYPE_NGIO, +- 0xffff, +- 0x0000, +- 0x0000, +- }, + { + NPC_S_KPU1_ETHER, 0xff, + NPC_ETYPE_CTAG, +@@ -1966,6 +1957,15 @@ static struct npc_kpu_profile_cam kpu2_cam_entries[] = { + 0x0000, + 0x0000, + }, ++ { ++ NPC_S_KPU2_CTAG, 0xff, ++ NPC_ETYPE_NGIO, ++ 0xffff, ++ 0x0000, ++ 0x0000, ++ 0x0000, ++ 0x0000, ++ }, + { + NPC_S_KPU2_CTAG, 0xff, + NPC_ETYPE_PPPOE, +@@ -2749,15 +2749,6 @@ static struct npc_kpu_profile_cam kpu2_cam_entries[] = { + 0x0000, + 0x0000, + }, +- { +- NPC_S_KPU2_NGIO, 0xff, +- 0x0000, +- 0x0000, +- 0x0000, +- 0x0000, +- 0x0000, +- 0x0000, +- }, + { + NPC_S_KPU2_CPT_CTAG, 0xff, + NPC_ETYPE_IP, +@@ -5089,6 +5080,15 @@ static struct npc_kpu_profile_cam kpu5_cam_entries[] = { + 0x0000, + 0x0000, + }, ++ { ++ NPC_S_KPU5_NGIO, 0xff, ++ 0x0000, ++ 0x0000, ++ 0x0000, ++ 0x0000, ++ 0x0000, ++ 0x0000, ++ }, + { + NPC_S_NA, 0X00, + 0x0000, +@@ -8422,14 +8422,6 @@ static struct npc_kpu_profile_action kpu1_action_entries[] = { + 0, + 0, 0, 0, 0, + }, +- { +- NPC_ERRLEV_RE, NPC_EC_NOERR, +- 8, 12, 0, 0, 0, +- NPC_S_KPU2_NGIO, 12, 1, +- NPC_LID_LA, NPC_LT_LA_ETHER, +- 0, +- 0, 0, 0, 0, +- }, + { + NPC_ERRLEV_RE, NPC_EC_NOERR, + 8, 12, 0, 0, 0, +@@ -9194,6 +9186,14 @@ static struct npc_kpu_profile_action kpu2_action_entries[] = { + 0, + 0, 0, 0, 0, + }, ++ { ++ NPC_ERRLEV_RE, NPC_EC_NOERR, ++ 0, 0, 0, 2, 0, ++ NPC_S_KPU5_NGIO, 6, 1, ++ NPC_LID_LB, NPC_LT_LB_CTAG, ++ 0, ++ 0, 0, 0, 0, ++ }, + { + NPC_ERRLEV_RE, NPC_EC_NOERR, + 8, 0, 6, 2, 0, +@@ -9890,14 +9890,6 @@ static struct npc_kpu_profile_action kpu2_action_entries[] = { + NPC_F_LB_U_UNK_ETYPE | NPC_F_LB_L_EXDSA, + 0, 0, 0, 0, + }, +- { +- NPC_ERRLEV_RE, NPC_EC_NOERR, +- 0, 0, 0, 0, 1, +- NPC_S_NA, 0, 1, +- NPC_LID_LC, NPC_LT_LC_NGIO, +- 0, +- 0, 0, 0, 0, +- }, + { + NPC_ERRLEV_RE, NPC_EC_NOERR, + 8, 0, 6, 2, 0, +@@ -11973,6 +11965,14 @@ static struct npc_kpu_profile_action kpu5_action_entries[] = { + 0, + 0, 0, 0, 0, + }, ++ { ++ NPC_ERRLEV_RE, NPC_EC_NOERR, ++ 0, 0, 0, 0, 1, ++ NPC_S_NA, 0, 1, ++ NPC_LID_LC, NPC_LT_LC_NGIO, ++ 0, ++ 0, 0, 0, 0, ++ }, + { + NPC_ERRLEV_LC, NPC_EC_UNK, + 0, 0, 0, 0, 1, +-- +2.34.1 + diff --git a/queue-5.16/octeontx2-af-cn10k-do-not-enable-rpm-loopback-for-lp.patch-3928 b/queue-5.16/octeontx2-af-cn10k-do-not-enable-rpm-loopback-for-lp.patch-3928 new file mode 100644 index 00000000000..609f0b1b888 --- /dev/null +++ b/queue-5.16/octeontx2-af-cn10k-do-not-enable-rpm-loopback-for-lp.patch-3928 @@ -0,0 +1,65 @@ +From b6eba955a5e4e540717e64a81fb66d55e1fd5530 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 12:04:45 +0530 +Subject: octeontx2-af: cn10k: Do not enable RPM loopback for LPC interfaces + +From: Geetha sowjanya + +[ Upstream commit df66b6ebc5dcf7253e35a640b9ec4add54195c25 ] + +Internal looback is not supported to low rate LPCS interface like +SGMII/QSGMII. Hence don't allow to enable for such interfaces. + +Fixes: 3ad3f8f93c81 ("octeontx2-af: cn10k: MAC internal loopback support") +Signed-off-by: Geetha sowjanya +Signed-off-by: Subbaraya Sundeep +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/marvell/octeontx2/af/rpm.c | 27 +++++++++---------- + 1 file changed, 12 insertions(+), 15 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c +index 4cbd91540f999..9ea2f6ac38ec1 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c +@@ -291,23 +291,20 @@ int rpm_lmac_internal_loopback(void *rpmd, int lmac_id, bool enable) + if (!rpm || lmac_id >= rpm->lmac_count) + return -ENODEV; + lmac_type = rpm->mac_ops->get_lmac_type(rpm, lmac_id); +- if (lmac_type == LMAC_MODE_100G_R) { +- cfg = rpm_read(rpm, lmac_id, RPMX_MTI_PCS100X_CONTROL1); +- +- if (enable) +- cfg |= RPMX_MTI_PCS_LBK; +- else +- cfg &= ~RPMX_MTI_PCS_LBK; +- rpm_write(rpm, lmac_id, RPMX_MTI_PCS100X_CONTROL1, cfg); +- } else { +- cfg = rpm_read(rpm, lmac_id, RPMX_MTI_LPCSX_CONTROL1); +- if (enable) +- cfg |= RPMX_MTI_PCS_LBK; +- else +- cfg &= ~RPMX_MTI_PCS_LBK; +- rpm_write(rpm, lmac_id, RPMX_MTI_LPCSX_CONTROL1, cfg); ++ ++ if (lmac_type == LMAC_MODE_QSGMII || lmac_type == LMAC_MODE_SGMII) { ++ dev_err(&rpm->pdev->dev, "loopback not supported for LPC mode\n"); ++ return 0; + } + ++ cfg = rpm_read(rpm, lmac_id, RPMX_MTI_PCS100X_CONTROL1); ++ ++ if (enable) ++ cfg |= RPMX_MTI_PCS_LBK; ++ else ++ cfg &= ~RPMX_MTI_PCS_LBK; ++ rpm_write(rpm, lmac_id, RPMX_MTI_PCS100X_CONTROL1, cfg); ++ + return 0; + } + +-- +2.34.1 + diff --git a/queue-5.16/octeontx2-af-cn10k-use-appropriate-register-for-lmac.patch-4264 b/queue-5.16/octeontx2-af-cn10k-use-appropriate-register-for-lmac.patch-4264 new file mode 100644 index 00000000000..e1da10de07c --- /dev/null +++ b/queue-5.16/octeontx2-af-cn10k-use-appropriate-register-for-lmac.patch-4264 @@ -0,0 +1,224 @@ +From 53d90a111f09da158e8d78452f310b00f86512ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 12:04:42 +0530 +Subject: octeontx2-af: cn10k: Use appropriate register for LMAC enable + +From: Geetha sowjanya + +[ Upstream commit fae80edeafbbba5ef9a0423aa5e5515518626433 ] + +CN10K platforms uses RPM(0..2)_MTI_MAC100(0..3)_COMMAND_CONFIG +register for lmac TX/RX enable whereas CN9xxx platforms use +CGX_CMRX_CONFIG register. This config change was missed when +adding support for CN10K RPM. + +Fixes: 91c6945ea1f9 ("octeontx2-af: cn10k: Add RPM MAC support") +Signed-off-by: Geetha sowjanya +Signed-off-by: Subbaraya Sundeep +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/marvell/octeontx2/af/cgx.c | 2 + + .../marvell/octeontx2/af/lmac_common.h | 3 ++ + .../net/ethernet/marvell/octeontx2/af/rpm.c | 39 +++++++++++++++++++ + .../net/ethernet/marvell/octeontx2/af/rpm.h | 4 ++ + .../net/ethernet/marvell/octeontx2/af/rvu.h | 1 + + .../ethernet/marvell/octeontx2/af/rvu_cgx.c | 14 ++++++- + .../ethernet/marvell/octeontx2/af/rvu_nix.c | 10 ++--- + 7 files changed, 66 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +index 186d00a9ab35c..3631d612aaca1 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +@@ -1570,6 +1570,8 @@ static struct mac_ops cgx_mac_ops = { + .mac_enadis_pause_frm = cgx_lmac_enadis_pause_frm, + .mac_pause_frm_config = cgx_lmac_pause_frm_config, + .mac_enadis_ptp_config = cgx_lmac_ptp_config, ++ .mac_rx_tx_enable = cgx_lmac_rx_tx_enable, ++ .mac_tx_enable = cgx_lmac_tx_enable, + }; + + static int cgx_probe(struct pci_dev *pdev, const struct pci_device_id *id) +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h b/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h +index fc6e7423cbd81..b33e7d1d0851c 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h +@@ -107,6 +107,9 @@ struct mac_ops { + void (*mac_enadis_ptp_config)(void *cgxd, + int lmac_id, + bool enable); ++ ++ int (*mac_rx_tx_enable)(void *cgxd, int lmac_id, bool enable); ++ int (*mac_tx_enable)(void *cgxd, int lmac_id, bool enable); + }; + + struct cgx { +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c +index e695fa0e82a94..4cbd91540f999 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c +@@ -30,6 +30,8 @@ static struct mac_ops rpm_mac_ops = { + .mac_enadis_pause_frm = rpm_lmac_enadis_pause_frm, + .mac_pause_frm_config = rpm_lmac_pause_frm_config, + .mac_enadis_ptp_config = rpm_lmac_ptp_config, ++ .mac_rx_tx_enable = rpm_lmac_rx_tx_enable, ++ .mac_tx_enable = rpm_lmac_tx_enable, + }; + + struct mac_ops *rpm_get_mac_ops(void) +@@ -54,6 +56,43 @@ int rpm_get_nr_lmacs(void *rpmd) + return hweight8(rpm_read(rpm, 0, CGXX_CMRX_RX_LMACS) & 0xFULL); + } + ++int rpm_lmac_tx_enable(void *rpmd, int lmac_id, bool enable) ++{ ++ rpm_t *rpm = rpmd; ++ u64 cfg, last; ++ ++ if (!is_lmac_valid(rpm, lmac_id)) ++ return -ENODEV; ++ ++ cfg = rpm_read(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG); ++ last = cfg; ++ if (enable) ++ cfg |= RPM_TX_EN; ++ else ++ cfg &= ~(RPM_TX_EN); ++ ++ if (cfg != last) ++ rpm_write(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG, cfg); ++ return !!(last & RPM_TX_EN); ++} ++ ++int rpm_lmac_rx_tx_enable(void *rpmd, int lmac_id, bool enable) ++{ ++ rpm_t *rpm = rpmd; ++ u64 cfg; ++ ++ if (!is_lmac_valid(rpm, lmac_id)) ++ return -ENODEV; ++ ++ cfg = rpm_read(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG); ++ if (enable) ++ cfg |= RPM_RX_EN | RPM_TX_EN; ++ else ++ cfg &= ~(RPM_RX_EN | RPM_TX_EN); ++ rpm_write(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG, cfg); ++ return 0; ++} ++ + void rpm_lmac_enadis_rx_pause_fwding(void *rpmd, int lmac_id, bool enable) + { + rpm_t *rpm = rpmd; +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.h b/drivers/net/ethernet/marvell/octeontx2/af/rpm.h +index 57c8a687b488a..ff580311edd03 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.h +@@ -43,6 +43,8 @@ + #define RPMX_MTI_STAT_DATA_HI_CDC 0x10038 + + #define RPM_LMAC_FWI 0xa ++#define RPM_TX_EN BIT_ULL(0) ++#define RPM_RX_EN BIT_ULL(1) + + /* Function Declarations */ + int rpm_get_nr_lmacs(void *rpmd); +@@ -57,4 +59,6 @@ int rpm_lmac_enadis_pause_frm(void *rpmd, int lmac_id, u8 tx_pause, + int rpm_get_tx_stats(void *rpmd, int lmac_id, int idx, u64 *tx_stat); + int rpm_get_rx_stats(void *rpmd, int lmac_id, int idx, u64 *rx_stat); + void rpm_lmac_ptp_config(void *rpmd, int lmac_id, bool enable); ++int rpm_lmac_rx_tx_enable(void *rpmd, int lmac_id, bool enable); ++int rpm_lmac_tx_enable(void *rpmd, int lmac_id, bool enable); + #endif /* RPM_H */ +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +index 66e45d733824e..5ed94cfb47d2d 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +@@ -806,6 +806,7 @@ bool is_mac_feature_supported(struct rvu *rvu, int pf, int feature); + u32 rvu_cgx_get_fifolen(struct rvu *rvu); + void *rvu_first_cgx_pdata(struct rvu *rvu); + int cgxlmac_to_pf(struct rvu *rvu, int cgx_id, int lmac_id); ++int rvu_cgx_config_tx(void *cgxd, int lmac_id, bool enable); + + int npc_get_nixlf_mcam_index(struct npc_mcam *mcam, u16 pcifunc, int nixlf, + int type); +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +index 2ca182a4ce823..8a7ac5a8b821d 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +@@ -441,16 +441,26 @@ void rvu_cgx_enadis_rx_bp(struct rvu *rvu, int pf, bool enable) + int rvu_cgx_config_rxtx(struct rvu *rvu, u16 pcifunc, bool start) + { + int pf = rvu_get_pf(pcifunc); ++ struct mac_ops *mac_ops; + u8 cgx_id, lmac_id; ++ void *cgxd; + + if (!is_cgx_config_permitted(rvu, pcifunc)) + return LMAC_AF_ERR_PERM_DENIED; + + rvu_get_cgx_lmac_id(rvu->pf2cgxlmac_map[pf], &cgx_id, &lmac_id); ++ cgxd = rvu_cgx_pdata(cgx_id, rvu); ++ mac_ops = get_mac_ops(cgxd); ++ ++ return mac_ops->mac_rx_tx_enable(cgxd, lmac_id, start); ++} + +- cgx_lmac_rx_tx_enable(rvu_cgx_pdata(cgx_id, rvu), lmac_id, start); ++int rvu_cgx_config_tx(void *cgxd, int lmac_id, bool enable) ++{ ++ struct mac_ops *mac_ops; + +- return 0; ++ mac_ops = get_mac_ops(cgxd); ++ return mac_ops->mac_tx_enable(cgxd, lmac_id, enable); + } + + void rvu_cgx_disable_dmac_entries(struct rvu *rvu, u16 pcifunc) +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index b74ab0dae10dc..de6e5a1288640 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -2068,8 +2068,8 @@ static int nix_smq_flush(struct rvu *rvu, int blkaddr, + /* enable cgx tx if disabled */ + if (is_pf_cgxmapped(rvu, pf)) { + rvu_get_cgx_lmac_id(rvu->pf2cgxlmac_map[pf], &cgx_id, &lmac_id); +- restore_tx_en = !cgx_lmac_tx_enable(rvu_cgx_pdata(cgx_id, rvu), +- lmac_id, true); ++ restore_tx_en = !rvu_cgx_config_tx(rvu_cgx_pdata(cgx_id, rvu), ++ lmac_id, true); + } + + cfg = rvu_read64(rvu, blkaddr, NIX_AF_SMQX_CFG(smq)); +@@ -2092,7 +2092,7 @@ static int nix_smq_flush(struct rvu *rvu, int blkaddr, + rvu_cgx_enadis_rx_bp(rvu, pf, true); + /* restore cgx tx state */ + if (restore_tx_en) +- cgx_lmac_tx_enable(rvu_cgx_pdata(cgx_id, rvu), lmac_id, false); ++ rvu_cgx_config_tx(rvu_cgx_pdata(cgx_id, rvu), lmac_id, false); + return err; + } + +@@ -3878,7 +3878,7 @@ nix_config_link_credits(struct rvu *rvu, int blkaddr, int link, + /* Enable cgx tx if disabled for credits to be back */ + if (is_pf_cgxmapped(rvu, pf)) { + rvu_get_cgx_lmac_id(rvu->pf2cgxlmac_map[pf], &cgx_id, &lmac_id); +- restore_tx_en = !cgx_lmac_tx_enable(rvu_cgx_pdata(cgx_id, rvu), ++ restore_tx_en = !rvu_cgx_config_tx(rvu_cgx_pdata(cgx_id, rvu), + lmac_id, true); + } + +@@ -3918,7 +3918,7 @@ exit: + + /* Restore state of cgx tx */ + if (restore_tx_en) +- cgx_lmac_tx_enable(rvu_cgx_pdata(cgx_id, rvu), lmac_id, false); ++ rvu_cgx_config_tx(rvu_cgx_pdata(cgx_id, rvu), lmac_id, false); + + mutex_unlock(&rvu->rsrc_lock); + return rc; +-- +2.34.1 + diff --git a/queue-5.16/octeontx2-af-do-not-fixup-all-vf-action-entries.patch-25054 b/queue-5.16/octeontx2-af-do-not-fixup-all-vf-action-entries.patch-25054 new file mode 100644 index 00000000000..adf1c6bfeea --- /dev/null +++ b/queue-5.16/octeontx2-af-do-not-fixup-all-vf-action-entries.patch-25054 @@ -0,0 +1,131 @@ +From 8c51588e848c7b26b50e914a9e74eb732a091591 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 12:04:39 +0530 +Subject: octeontx2-af: Do not fixup all VF action entries + +From: Subbaraya Sundeep + +[ Upstream commit d225c449ab2be25273a3674f476c6c0b57c50254 ] + +AF modifies all the rules destined for VF to use +the action same as default RSS action. This fixup +was needed because AF only installs default rules with +RSS action. But the action in rules installed by a PF +for its VFs should not be changed by this fixup. +This is because action can be drop or direct to +queue as specified by user(ntuple filters). +This patch fixes that problem. + +Fixes: 967db3529eca ("octeontx2-af: add support for multicast/promisc packet") +Signed-off-by: Subbaraya Sundeep +Signed-off-by: Naveen Mamindlapalli +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../ethernet/marvell/octeontx2/af/rvu_npc.c | 22 ++++++++++++++++--- + .../marvell/octeontx2/af/rvu_npc_fs.c | 20 ++++++++++------- + 2 files changed, 31 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +index c0005a1feee69..91f86d77cd41b 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +@@ -402,6 +402,7 @@ static void npc_fixup_vf_rule(struct rvu *rvu, struct npc_mcam *mcam, + int blkaddr, int index, struct mcam_entry *entry, + bool *enable) + { ++ struct rvu_npc_mcam_rule *rule; + u16 owner, target_func; + struct rvu_pfvf *pfvf; + u64 rx_action; +@@ -423,6 +424,12 @@ static void npc_fixup_vf_rule(struct rvu *rvu, struct npc_mcam *mcam, + test_bit(NIXLF_INITIALIZED, &pfvf->flags))) + *enable = false; + ++ /* fix up not needed for the rules added by user(ntuple filters) */ ++ list_for_each_entry(rule, &mcam->mcam_rules, list) { ++ if (rule->entry == index) ++ return; ++ } ++ + /* copy VF default entry action to the VF mcam entry */ + rx_action = npc_get_default_entry_action(rvu, mcam, blkaddr, + target_func); +@@ -489,8 +496,8 @@ static void npc_config_mcam_entry(struct rvu *rvu, struct npc_mcam *mcam, + } + + /* PF installing VF rule */ +- if (intf == NIX_INTF_RX && actindex < mcam->bmap_entries) +- npc_fixup_vf_rule(rvu, mcam, blkaddr, index, entry, &enable); ++ if (is_npc_intf_rx(intf) && actindex < mcam->bmap_entries) ++ npc_fixup_vf_rule(rvu, mcam, blkaddr, actindex, entry, &enable); + + /* Set 'action' */ + rvu_write64(rvu, blkaddr, +@@ -916,7 +923,8 @@ static void npc_update_vf_flow_entry(struct rvu *rvu, struct npc_mcam *mcam, + int blkaddr, u16 pcifunc, u64 rx_action) + { + int actindex, index, bank, entry; +- bool enable; ++ struct rvu_npc_mcam_rule *rule; ++ bool enable, update; + + if (!(pcifunc & RVU_PFVF_FUNC_MASK)) + return; +@@ -924,6 +932,14 @@ static void npc_update_vf_flow_entry(struct rvu *rvu, struct npc_mcam *mcam, + mutex_lock(&mcam->lock); + for (index = 0; index < mcam->bmap_entries; index++) { + if (mcam->entry2target_pffunc[index] == pcifunc) { ++ update = true; ++ /* update not needed for the rules added via ntuple filters */ ++ list_for_each_entry(rule, &mcam->mcam_rules, list) { ++ if (rule->entry == index) ++ update = false; ++ } ++ if (!update) ++ continue; + bank = npc_get_bank(mcam, index); + actindex = index; + entry = index & (mcam->banksize - 1); +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c +index ff2b21999f36f..19c53e591d0da 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c +@@ -1098,14 +1098,6 @@ find_rule: + write_req.cntr = rule->cntr; + } + +- err = rvu_mbox_handler_npc_mcam_write_entry(rvu, &write_req, +- &write_rsp); +- if (err) { +- rvu_mcam_remove_counter_from_rule(rvu, owner, rule); +- if (new) +- kfree(rule); +- return err; +- } + /* update rule */ + memcpy(&rule->packet, &dummy.packet, sizeof(rule->packet)); + memcpy(&rule->mask, &dummy.mask, sizeof(rule->mask)); +@@ -1132,6 +1124,18 @@ find_rule: + if (req->default_rule) + pfvf->def_ucast_rule = rule; + ++ /* write to mcam entry registers */ ++ err = rvu_mbox_handler_npc_mcam_write_entry(rvu, &write_req, ++ &write_rsp); ++ if (err) { ++ rvu_mcam_remove_counter_from_rule(rvu, owner, rule); ++ if (new) { ++ list_del(&rule->list); ++ kfree(rule); ++ } ++ return err; ++ } ++ + /* VF's MAC address is being changed via PF */ + if (pf_set_vfs_mac) { + ether_addr_copy(pfvf->default_mac, req->packet.dmac); +-- +2.34.1 + diff --git a/queue-5.16/octeontx2-af-fix-lbk-backpressure-id-count.patch-21119 b/queue-5.16/octeontx2-af-fix-lbk-backpressure-id-count.patch-21119 new file mode 100644 index 00000000000..76ec7c2b2b6 --- /dev/null +++ b/queue-5.16/octeontx2-af-fix-lbk-backpressure-id-count.patch-21119 @@ -0,0 +1,44 @@ +From 5f1bbdd16d0265d9ee32d0d92971353edb3e3f80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 12:04:40 +0530 +Subject: octeontx2-af: Fix LBK backpressure id count + +From: Sunil Goutham + +[ Upstream commit 00bfe94e388fe12bfd0d4f6361b1b1343374ff5b ] + +In rvu_nix_get_bpid() lbk_bpid_cnt is being read from +wrong register. Due to this backpressure enable is failing +for LBK VF32 onwards. This patch fixes that. + +Fixes: fe1939bb2340 ("octeontx2-af: Add SDP interface support") +Signed-off-by: Sunil Goutham +Signed-off-by: Subbaraya Sundeep +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index d8b1948aaa0ae..b74ab0dae10dc 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -512,11 +512,11 @@ static int rvu_nix_get_bpid(struct rvu *rvu, struct nix_bp_cfg_req *req, + cfg = rvu_read64(rvu, blkaddr, NIX_AF_CONST); + lmac_chan_cnt = cfg & 0xFF; + +- cfg = rvu_read64(rvu, blkaddr, NIX_AF_CONST1); +- sdp_chan_cnt = cfg & 0xFFF; +- + cgx_bpid_cnt = hw->cgx_links * lmac_chan_cnt; + lbk_bpid_cnt = hw->lbk_links * ((cfg >> 16) & 0xFF); ++ ++ cfg = rvu_read64(rvu, blkaddr, NIX_AF_CONST1); ++ sdp_chan_cnt = cfg & 0xFFF; + sdp_bpid_cnt = hw->sdp_links * sdp_chan_cnt; + + pfvf = rvu_get_pfvf(rvu, req->hdr.pcifunc); +-- +2.34.1 + diff --git a/queue-5.16/octeontx2-af-increase-link-credit-restore-polling-ti.patch-12708 b/queue-5.16/octeontx2-af-increase-link-credit-restore-polling-ti.patch-12708 new file mode 100644 index 00000000000..413066ab7dd --- /dev/null +++ b/queue-5.16/octeontx2-af-increase-link-credit-restore-polling-ti.patch-12708 @@ -0,0 +1,55 @@ +From 12d0b60209df36f671ab657280bea5256434de71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 12:04:44 +0530 +Subject: octeontx2-af: Increase link credit restore polling timeout + +From: Geetha sowjanya + +[ Upstream commit 1581d61b42d985cefe7b71eea67ab3bfcbf34d0f ] + +It's been observed that sometimes link credit restore takes +a lot of time than the current timeout. This patch increases +the default timeout value and return the proper error value +on failure. + +Fixes: 1c74b89171c3 ("octeontx2-af: Wait for TX link idle for credits change") +Signed-off-by: Geetha sowjanya +Signed-off-by: Subbaraya Sundeep +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/mbox.h | 1 + + drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 4 ++-- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h +index 4e79e918a1617..58e2aeebc14f8 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h +@@ -732,6 +732,7 @@ enum nix_af_status { + NIX_AF_ERR_BANDPROF_INVAL_REQ = -428, + NIX_AF_ERR_CQ_CTX_WRITE_ERR = -429, + NIX_AF_ERR_AQ_CTX_RETRY_WRITE = -430, ++ NIX_AF_ERR_LINK_CREDITS = -431, + }; + + /* For NIX RX vtag action */ +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index de6e5a1288640..97fb61915379a 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -3891,8 +3891,8 @@ nix_config_link_credits(struct rvu *rvu, int blkaddr, int link, + NIX_AF_TL1X_SW_XOFF(schq), BIT_ULL(0)); + } + +- rc = -EBUSY; +- poll_tmo = jiffies + usecs_to_jiffies(10000); ++ rc = NIX_AF_ERR_LINK_CREDITS; ++ poll_tmo = jiffies + usecs_to_jiffies(200000); + /* Wait for credits to return */ + do { + if (time_after(jiffies, poll_tmo)) +-- +2.34.1 + diff --git a/queue-5.16/octeontx2-af-retry-until-rvu-block-reset-complete.patch-12707 b/queue-5.16/octeontx2-af-retry-until-rvu-block-reset-complete.patch-12707 new file mode 100644 index 00000000000..5889380f2a5 --- /dev/null +++ b/queue-5.16/octeontx2-af-retry-until-rvu-block-reset-complete.patch-12707 @@ -0,0 +1,43 @@ +From cb9bb6abef9573cda4a18d2d05c86dd0426e5080 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 12:04:41 +0530 +Subject: octeontx2-af: Retry until RVU block reset complete + +From: Geetha sowjanya + +[ Upstream commit 03ffbc9914bd1130fba464f0a41c01372e5fc359 ] + +Few RVU blocks like SSO require more time for reset on some +silicons. Hence retrying the block reset until success. + +Fixes: c0fa2cff8822c ("octeontx2-af: Handle return value in block reset") +Signed-off-by: Geetha sowjanya +Signed-off-by: Subbaraya Sundeep +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +index 3ca6b942ebe25..54e1b27a7dfec 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +@@ -520,8 +520,11 @@ static void rvu_block_reset(struct rvu *rvu, int blkaddr, u64 rst_reg) + + rvu_write64(rvu, blkaddr, rst_reg, BIT_ULL(0)); + err = rvu_poll_reg(rvu, blkaddr, rst_reg, BIT_ULL(63), true); +- if (err) +- dev_err(rvu->dev, "HW block:%d reset failed\n", blkaddr); ++ if (err) { ++ dev_err(rvu->dev, "HW block:%d reset timeout retrying again\n", blkaddr); ++ while (rvu_poll_reg(rvu, blkaddr, rst_reg, BIT_ULL(63), true) == -EBUSY) ++ ; ++ } + } + + static void rvu_reset_all_blocks(struct rvu *rvu) +-- +2.34.1 + diff --git a/queue-5.16/octeontx2-pf-cn10k-ensure-valid-pointers-are-freed-t.patch-5484 b/queue-5.16/octeontx2-pf-cn10k-ensure-valid-pointers-are-freed-t.patch-5484 new file mode 100644 index 00000000000..ab23ba32bdf --- /dev/null +++ b/queue-5.16/octeontx2-pf-cn10k-ensure-valid-pointers-are-freed-t.patch-5484 @@ -0,0 +1,54 @@ +From 0127d94e4d54c231d7767e6c83b17db33a971447 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 12:04:43 +0530 +Subject: octeontx2-pf: cn10k: Ensure valid pointers are freed to aura + +From: Geetha sowjanya + +[ Upstream commit c5d731c54a17677939bd59ee8be4ed74d7485ba4 ] + +While freeing SQB pointers to aura, driver first memcpy to +target address and then triggers lmtst operation to free pointer +to the aura. We need to ensure(by adding dmb barrier)that memcpy +is finished before pointers are freed to the aura. This patch also +adds the missing sq context structure entry in debugfs. + +Fixes: ef6c8da71eaf ("octeontx2-pf: cn10K: Reserve LMTST lines per core") +Signed-off-by: Geetha sowjanya +Signed-off-by: Subbaraya Sundeep +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 2 ++ + drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h | 1 + + 2 files changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c +index a09a507369ac3..d1eddb769a419 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c +@@ -1224,6 +1224,8 @@ static void print_nix_cn10k_sq_ctx(struct seq_file *m, + seq_printf(m, "W3: head_offset\t\t\t%d\nW3: smenq_next_sqb_vld\t\t%d\n\n", + sq_ctx->head_offset, sq_ctx->smenq_next_sqb_vld); + ++ seq_printf(m, "W3: smq_next_sq_vld\t\t%d\nW3: smq_pend\t\t\t%d\n", ++ sq_ctx->smq_next_sq_vld, sq_ctx->smq_pend); + seq_printf(m, "W4: next_sqb \t\t\t%llx\n\n", sq_ctx->next_sqb); + seq_printf(m, "W5: tail_sqb \t\t\t%llx\n\n", sq_ctx->tail_sqb); + seq_printf(m, "W6: smenq_sqb \t\t\t%llx\n\n", sq_ctx->smenq_sqb); +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h +index 61e52812983fa..14509fc64cce9 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h +@@ -603,6 +603,7 @@ static inline void __cn10k_aura_freeptr(struct otx2_nic *pfvf, u64 aura, + size++; + tar_addr |= ((size - 1) & 0x7) << 4; + } ++ dma_wmb(); + memcpy((u64 *)lmt_info->lmt_addr, ptrs, sizeof(u64) * num_ptrs); + /* Perform LMTST flush */ + cn10k_lmt_flush(val, tar_addr); +-- +2.34.1 + diff --git a/queue-5.16/octeontx2-pf-forward-error-codes-to-vf.patch-3356 b/queue-5.16/octeontx2-pf-forward-error-codes-to-vf.patch-3356 new file mode 100644 index 00000000000..6f8e9f2bd6f --- /dev/null +++ b/queue-5.16/octeontx2-pf-forward-error-codes-to-vf.patch-3356 @@ -0,0 +1,48 @@ +From 8e5a92564f8d5b65c73ecf0644d2583845131679 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 12:04:46 +0530 +Subject: octeontx2-pf: Forward error codes to VF + +From: Subbaraya Sundeep + +[ Upstream commit a8db854be28622a2477cb21cdf7f829adbb2c42d ] + +PF forwards its VF messages to AF and corresponding +replies from AF to VF. AF sets proper error code in the +replies after processing message requests. Currently PF +checks the error codes in replies and sends invalid +message to VF. This way VF lacks the information of +error code set by AF for its messages. This patch +changes that such that PF simply forwards AF replies +so that VF can handle error codes. + +Fixes: d424b6c02415 ("octeontx2-pf: Enable SRIOV and added VF mbox handling") +Signed-off-by: Subbaraya Sundeep +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +index 1e0d0c9c1dac3..ba7f6b295ca55 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +@@ -394,7 +394,12 @@ static int otx2_forward_vf_mbox_msgs(struct otx2_nic *pf, + dst_mdev->msg_size = mbox_hdr->msg_size; + dst_mdev->num_msgs = num_msgs; + err = otx2_sync_mbox_msg(dst_mbox); +- if (err) { ++ /* Error code -EIO indicate there is a communication failure ++ * to the AF. Rest of the error codes indicate that AF processed ++ * VF messages and set the error codes in response messages ++ * (if any) so simply forward responses to VF. ++ */ ++ if (err == -EIO) { + dev_warn(pf->dev, + "AF not responding to VF%d messages\n", vf); + /* restore PF mbase and exit */ +-- +2.34.1 + diff --git a/queue-5.16/perf-fix-perf_event_read_local-time.patch-6284 b/queue-5.16/perf-fix-perf_event_read_local-time.patch-6284 new file mode 100644 index 00000000000..71e53a25c26 --- /dev/null +++ b/queue-5.16/perf-fix-perf_event_read_local-time.patch-6284 @@ -0,0 +1,575 @@ +From ba446594235229ed18931ced8e2d2db466e49b77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Dec 2021 13:19:52 +0100 +Subject: perf: Fix perf_event_read_local() time + +From: Peter Zijlstra + +[ Upstream commit 09f5e7dc7ad705289e1b1ec065439aa3c42951c4 ] + +Time readers that cannot take locks (due to NMI etc..) currently make +use of perf_event::shadow_ctx_time, which, for that event gives: + + time' = now + (time - timestamp) + +or, alternatively arranged: + + time' = time + (now - timestamp) + +IOW, the progression of time since the last time the shadow_ctx_time +was updated. + +There's problems with this: + + A) the shadow_ctx_time is per-event, even though the ctx_time it + reflects is obviously per context. The direct concequence of this + is that the context needs to iterate all events all the time to + keep the shadow_ctx_time in sync. + + B) even with the prior point, the context itself might not be active + meaning its time should not advance to begin with. + + C) shadow_ctx_time isn't consistently updated when ctx_time is + +There are 3 users of this stuff, that suffer differently from this: + + - calc_timer_values() + - perf_output_read() + - perf_event_update_userpage() /* A */ + + - perf_event_read_local() /* A,B */ + +In particular, perf_output_read() doesn't suffer at all, because it's +sample driven and hence only relevant when the event is actually +running. + +This same was supposed to be true for perf_event_update_userpage(), +after all self-monitoring implies the context is active *HOWEVER*, as +per commit f79256532682 ("perf/core: fix userpage->time_enabled of +inactive events") this goes wrong when combined with counter +overcommit, in that case those events that do not get scheduled when +the context becomes active (task events typically) miss out on the +EVENT_TIME update and ENABLED time is inflated (for a little while) +with the time the context was inactive. Once the event gets rotated +in, this gets corrected, leading to a non-monotonic timeflow. + +perf_event_read_local() made things even worse, it can request time at +any point, suffering all the problems perf_event_update_userpage() +does and more. Because while perf_event_update_userpage() is limited +by the context being active, perf_event_read_local() users have no +such constraint. + +Therefore, completely overhaul things and do away with +perf_event::shadow_ctx_time. Instead have regular context time updates +keep track of this offset directly and provide perf_event_time_now() +to complement perf_event_time(). + +perf_event_time_now() will, in adition to being context wide, also +take into account if the context is active. For inactive context, it +will not advance time. + +This latter property means the cgroup perf_cgroup_info context needs +to grow addition state to track this. + +Additionally, since all this is strictly per-cpu, we can use barrier() +to order context activity vs context time. + +Fixes: 7d9285e82db5 ("perf/bpf: Extend the perf_event_read_local() interface, a.k.a. "bpf: perf event change needed for subsequent bpf helpers"") +Signed-off-by: Peter Zijlstra (Intel) +Tested-by: Song Liu +Tested-by: Namhyung Kim +Link: https://lkml.kernel.org/r/YcB06DasOBtU0b00@hirez.programming.kicks-ass.net +Signed-off-by: Sasha Levin +--- + include/linux/perf_event.h | 15 +-- + kernel/events/core.c | 246 ++++++++++++++++++++++--------------- + 2 files changed, 149 insertions(+), 112 deletions(-) + +diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h +index 318c489b735bc..d7f927f8c335d 100644 +--- a/include/linux/perf_event.h ++++ b/include/linux/perf_event.h +@@ -681,18 +681,6 @@ struct perf_event { + u64 total_time_running; + u64 tstamp; + +- /* +- * timestamp shadows the actual context timing but it can +- * be safely used in NMI interrupt context. It reflects the +- * context time as it was when the event was last scheduled in, +- * or when ctx_sched_in failed to schedule the event because we +- * run out of PMC. +- * +- * ctx_time already accounts for ctx->timestamp. Therefore to +- * compute ctx_time for a sample, simply add perf_clock(). +- */ +- u64 shadow_ctx_time; +- + struct perf_event_attr attr; + u16 header_size; + u16 id_header_size; +@@ -839,6 +827,7 @@ struct perf_event_context { + */ + u64 time; + u64 timestamp; ++ u64 timeoffset; + + /* + * These fields let us detect when two contexts have both +@@ -921,6 +910,8 @@ struct bpf_perf_event_data_kern { + struct perf_cgroup_info { + u64 time; + u64 timestamp; ++ u64 timeoffset; ++ int active; + }; + + struct perf_cgroup { +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 63f0414666438..a0064dd706538 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -674,6 +674,23 @@ perf_event_set_state(struct perf_event *event, enum perf_event_state state) + WRITE_ONCE(event->state, state); + } + ++/* ++ * UP store-release, load-acquire ++ */ ++ ++#define __store_release(ptr, val) \ ++do { \ ++ barrier(); \ ++ WRITE_ONCE(*(ptr), (val)); \ ++} while (0) ++ ++#define __load_acquire(ptr) \ ++({ \ ++ __unqual_scalar_typeof(*(ptr)) ___p = READ_ONCE(*(ptr)); \ ++ barrier(); \ ++ ___p; \ ++}) ++ + #ifdef CONFIG_CGROUP_PERF + + static inline bool +@@ -719,34 +736,51 @@ static inline u64 perf_cgroup_event_time(struct perf_event *event) + return t->time; + } + +-static inline void __update_cgrp_time(struct perf_cgroup *cgrp) ++static inline u64 perf_cgroup_event_time_now(struct perf_event *event, u64 now) + { +- struct perf_cgroup_info *info; +- u64 now; +- +- now = perf_clock(); ++ struct perf_cgroup_info *t; + +- info = this_cpu_ptr(cgrp->info); ++ t = per_cpu_ptr(event->cgrp->info, event->cpu); ++ if (!__load_acquire(&t->active)) ++ return t->time; ++ now += READ_ONCE(t->timeoffset); ++ return now; ++} + +- info->time += now - info->timestamp; ++static inline void __update_cgrp_time(struct perf_cgroup_info *info, u64 now, bool adv) ++{ ++ if (adv) ++ info->time += now - info->timestamp; + info->timestamp = now; ++ /* ++ * see update_context_time() ++ */ ++ WRITE_ONCE(info->timeoffset, info->time - info->timestamp); + } + +-static inline void update_cgrp_time_from_cpuctx(struct perf_cpu_context *cpuctx) ++static inline void update_cgrp_time_from_cpuctx(struct perf_cpu_context *cpuctx, bool final) + { + struct perf_cgroup *cgrp = cpuctx->cgrp; + struct cgroup_subsys_state *css; ++ struct perf_cgroup_info *info; + + if (cgrp) { ++ u64 now = perf_clock(); ++ + for (css = &cgrp->css; css; css = css->parent) { + cgrp = container_of(css, struct perf_cgroup, css); +- __update_cgrp_time(cgrp); ++ info = this_cpu_ptr(cgrp->info); ++ ++ __update_cgrp_time(info, now, true); ++ if (final) ++ __store_release(&info->active, 0); + } + } + } + + static inline void update_cgrp_time_from_event(struct perf_event *event) + { ++ struct perf_cgroup_info *info; + struct perf_cgroup *cgrp; + + /* +@@ -760,8 +794,10 @@ static inline void update_cgrp_time_from_event(struct perf_event *event) + /* + * Do not update time when cgroup is not active + */ +- if (cgroup_is_descendant(cgrp->css.cgroup, event->cgrp->css.cgroup)) +- __update_cgrp_time(event->cgrp); ++ if (cgroup_is_descendant(cgrp->css.cgroup, event->cgrp->css.cgroup)) { ++ info = this_cpu_ptr(event->cgrp->info); ++ __update_cgrp_time(info, perf_clock(), true); ++ } + } + + static inline void +@@ -785,7 +821,8 @@ perf_cgroup_set_timestamp(struct task_struct *task, + for (css = &cgrp->css; css; css = css->parent) { + cgrp = container_of(css, struct perf_cgroup, css); + info = this_cpu_ptr(cgrp->info); +- info->timestamp = ctx->timestamp; ++ __update_cgrp_time(info, ctx->timestamp, false); ++ __store_release(&info->active, 1); + } + } + +@@ -981,14 +1018,6 @@ out: + return ret; + } + +-static inline void +-perf_cgroup_set_shadow_time(struct perf_event *event, u64 now) +-{ +- struct perf_cgroup_info *t; +- t = per_cpu_ptr(event->cgrp->info, event->cpu); +- event->shadow_ctx_time = now - t->timestamp; +-} +- + static inline void + perf_cgroup_event_enable(struct perf_event *event, struct perf_event_context *ctx) + { +@@ -1066,7 +1095,8 @@ static inline void update_cgrp_time_from_event(struct perf_event *event) + { + } + +-static inline void update_cgrp_time_from_cpuctx(struct perf_cpu_context *cpuctx) ++static inline void update_cgrp_time_from_cpuctx(struct perf_cpu_context *cpuctx, ++ bool final) + { + } + +@@ -1098,12 +1128,12 @@ perf_cgroup_switch(struct task_struct *task, struct task_struct *next) + { + } + +-static inline void +-perf_cgroup_set_shadow_time(struct perf_event *event, u64 now) ++static inline u64 perf_cgroup_event_time(struct perf_event *event) + { ++ return 0; + } + +-static inline u64 perf_cgroup_event_time(struct perf_event *event) ++static inline u64 perf_cgroup_event_time_now(struct perf_event *event, u64 now) + { + return 0; + } +@@ -1525,22 +1555,59 @@ static void perf_unpin_context(struct perf_event_context *ctx) + /* + * Update the record of the current time in a context. + */ +-static void update_context_time(struct perf_event_context *ctx) ++static void __update_context_time(struct perf_event_context *ctx, bool adv) + { + u64 now = perf_clock(); + +- ctx->time += now - ctx->timestamp; ++ if (adv) ++ ctx->time += now - ctx->timestamp; + ctx->timestamp = now; ++ ++ /* ++ * The above: time' = time + (now - timestamp), can be re-arranged ++ * into: time` = now + (time - timestamp), which gives a single value ++ * offset to compute future time without locks on. ++ * ++ * See perf_event_time_now(), which can be used from NMI context where ++ * it's (obviously) not possible to acquire ctx->lock in order to read ++ * both the above values in a consistent manner. ++ */ ++ WRITE_ONCE(ctx->timeoffset, ctx->time - ctx->timestamp); ++} ++ ++static void update_context_time(struct perf_event_context *ctx) ++{ ++ __update_context_time(ctx, true); + } + + static u64 perf_event_time(struct perf_event *event) + { + struct perf_event_context *ctx = event->ctx; + ++ if (unlikely(!ctx)) ++ return 0; ++ + if (is_cgroup_event(event)) + return perf_cgroup_event_time(event); + +- return ctx ? ctx->time : 0; ++ return ctx->time; ++} ++ ++static u64 perf_event_time_now(struct perf_event *event, u64 now) ++{ ++ struct perf_event_context *ctx = event->ctx; ++ ++ if (unlikely(!ctx)) ++ return 0; ++ ++ if (is_cgroup_event(event)) ++ return perf_cgroup_event_time_now(event, now); ++ ++ if (!(__load_acquire(&ctx->is_active) & EVENT_TIME)) ++ return ctx->time; ++ ++ now += READ_ONCE(ctx->timeoffset); ++ return now; + } + + static enum event_type_t get_event_type(struct perf_event *event) +@@ -2346,7 +2413,7 @@ __perf_remove_from_context(struct perf_event *event, + + if (ctx->is_active & EVENT_TIME) { + update_context_time(ctx); +- update_cgrp_time_from_cpuctx(cpuctx); ++ update_cgrp_time_from_cpuctx(cpuctx, false); + } + + event_sched_out(event, cpuctx, ctx); +@@ -2357,6 +2424,9 @@ __perf_remove_from_context(struct perf_event *event, + list_del_event(event, ctx); + + if (!ctx->nr_events && ctx->is_active) { ++ if (ctx == &cpuctx->ctx) ++ update_cgrp_time_from_cpuctx(cpuctx, true); ++ + ctx->is_active = 0; + ctx->rotate_necessary = 0; + if (ctx->task) { +@@ -2478,40 +2548,6 @@ void perf_event_disable_inatomic(struct perf_event *event) + irq_work_queue(&event->pending); + } + +-static void perf_set_shadow_time(struct perf_event *event, +- struct perf_event_context *ctx) +-{ +- /* +- * use the correct time source for the time snapshot +- * +- * We could get by without this by leveraging the +- * fact that to get to this function, the caller +- * has most likely already called update_context_time() +- * and update_cgrp_time_xx() and thus both timestamp +- * are identical (or very close). Given that tstamp is, +- * already adjusted for cgroup, we could say that: +- * tstamp - ctx->timestamp +- * is equivalent to +- * tstamp - cgrp->timestamp. +- * +- * Then, in perf_output_read(), the calculation would +- * work with no changes because: +- * - event is guaranteed scheduled in +- * - no scheduled out in between +- * - thus the timestamp would be the same +- * +- * But this is a bit hairy. +- * +- * So instead, we have an explicit cgroup call to remain +- * within the time source all along. We believe it +- * is cleaner and simpler to understand. +- */ +- if (is_cgroup_event(event)) +- perf_cgroup_set_shadow_time(event, event->tstamp); +- else +- event->shadow_ctx_time = event->tstamp - ctx->timestamp; +-} +- + #define MAX_INTERRUPTS (~0ULL) + + static void perf_log_throttle(struct perf_event *event, int enable); +@@ -2552,8 +2588,6 @@ event_sched_in(struct perf_event *event, + + perf_pmu_disable(event->pmu); + +- perf_set_shadow_time(event, ctx); +- + perf_log_itrace_start(event); + + if (event->pmu->add(event, PERF_EF_START)) { +@@ -3247,16 +3281,6 @@ static void ctx_sched_out(struct perf_event_context *ctx, + return; + } + +- ctx->is_active &= ~event_type; +- if (!(ctx->is_active & EVENT_ALL)) +- ctx->is_active = 0; +- +- if (ctx->task) { +- WARN_ON_ONCE(cpuctx->task_ctx != ctx); +- if (!ctx->is_active) +- cpuctx->task_ctx = NULL; +- } +- + /* + * Always update time if it was set; not only when it changes. + * Otherwise we can 'forget' to update time for any but the last +@@ -3270,7 +3294,22 @@ static void ctx_sched_out(struct perf_event_context *ctx, + if (is_active & EVENT_TIME) { + /* update (and stop) ctx time */ + update_context_time(ctx); +- update_cgrp_time_from_cpuctx(cpuctx); ++ update_cgrp_time_from_cpuctx(cpuctx, ctx == &cpuctx->ctx); ++ /* ++ * CPU-release for the below ->is_active store, ++ * see __load_acquire() in perf_event_time_now() ++ */ ++ barrier(); ++ } ++ ++ ctx->is_active &= ~event_type; ++ if (!(ctx->is_active & EVENT_ALL)) ++ ctx->is_active = 0; ++ ++ if (ctx->task) { ++ WARN_ON_ONCE(cpuctx->task_ctx != ctx); ++ if (!ctx->is_active) ++ cpuctx->task_ctx = NULL; + } + + is_active ^= ctx->is_active; /* changed bits */ +@@ -3707,13 +3746,19 @@ static noinline int visit_groups_merge(struct perf_cpu_context *cpuctx, + return 0; + } + ++/* ++ * Because the userpage is strictly per-event (there is no concept of context, ++ * so there cannot be a context indirection), every userpage must be updated ++ * when context time starts :-( ++ * ++ * IOW, we must not miss EVENT_TIME edges. ++ */ + static inline bool event_update_userpage(struct perf_event *event) + { + if (likely(!atomic_read(&event->mmap_count))) + return false; + + perf_event_update_time(event); +- perf_set_shadow_time(event, event->ctx); + perf_event_update_userpage(event); + + return true; +@@ -3797,13 +3842,23 @@ ctx_sched_in(struct perf_event_context *ctx, + struct task_struct *task) + { + int is_active = ctx->is_active; +- u64 now; + + lockdep_assert_held(&ctx->lock); + + if (likely(!ctx->nr_events)) + return; + ++ if (is_active ^ EVENT_TIME) { ++ /* start ctx time */ ++ __update_context_time(ctx, false); ++ perf_cgroup_set_timestamp(task, ctx); ++ /* ++ * CPU-release for the below ->is_active store, ++ * see __load_acquire() in perf_event_time_now() ++ */ ++ barrier(); ++ } ++ + ctx->is_active |= (event_type | EVENT_TIME); + if (ctx->task) { + if (!is_active) +@@ -3814,13 +3869,6 @@ ctx_sched_in(struct perf_event_context *ctx, + + is_active ^= ctx->is_active; /* changed bits */ + +- if (is_active & EVENT_TIME) { +- /* start ctx time */ +- now = perf_clock(); +- ctx->timestamp = now; +- perf_cgroup_set_timestamp(task, ctx); +- } +- + /* + * First go through the list and put on any pinned groups + * in order to give them the best chance of going on. +@@ -4414,6 +4462,18 @@ static inline u64 perf_event_count(struct perf_event *event) + return local64_read(&event->count) + atomic64_read(&event->child_count); + } + ++static void calc_timer_values(struct perf_event *event, ++ u64 *now, ++ u64 *enabled, ++ u64 *running) ++{ ++ u64 ctx_time; ++ ++ *now = perf_clock(); ++ ctx_time = perf_event_time_now(event, *now); ++ __perf_update_times(event, ctx_time, enabled, running); ++} ++ + /* + * NMI-safe method to read a local event, that is an event that + * is: +@@ -4473,10 +4533,9 @@ int perf_event_read_local(struct perf_event *event, u64 *value, + + *value = local64_read(&event->count); + if (enabled || running) { +- u64 now = event->shadow_ctx_time + perf_clock(); +- u64 __enabled, __running; ++ u64 __enabled, __running, __now;; + +- __perf_update_times(event, now, &__enabled, &__running); ++ calc_timer_values(event, &__now, &__enabled, &__running); + if (enabled) + *enabled = __enabled; + if (running) +@@ -5798,18 +5857,6 @@ static int perf_event_index(struct perf_event *event) + return event->pmu->event_idx(event); + } + +-static void calc_timer_values(struct perf_event *event, +- u64 *now, +- u64 *enabled, +- u64 *running) +-{ +- u64 ctx_time; +- +- *now = perf_clock(); +- ctx_time = event->shadow_ctx_time + *now; +- __perf_update_times(event, ctx_time, enabled, running); +-} +- + static void perf_event_init_userpage(struct perf_event *event) + { + struct perf_event_mmap_page *userpg; +@@ -6349,7 +6396,6 @@ accounting: + ring_buffer_attach(event, rb); + + perf_event_update_time(event); +- perf_set_shadow_time(event, event->ctx); + perf_event_init_userpage(event); + perf_event_update_userpage(event); + } else { +-- +2.34.1 + diff --git a/queue-5.16/phylib-fix-potential-use-after-free.patch-4894 b/queue-5.16/phylib-fix-potential-use-after-free.patch-4894 new file mode 100644 index 00000000000..aa1c9299428 --- /dev/null +++ b/queue-5.16/phylib-fix-potential-use-after-free.patch-4894 @@ -0,0 +1,58 @@ +From 2764544d3074d7e07b19608d75284209baaecd8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jan 2022 17:27:48 +0100 +Subject: phylib: fix potential use-after-free +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit cbda1b16687580d5beee38273f6241ae3725960c ] + +Commit bafbdd527d56 ("phylib: Add device reset GPIO support") added call +to phy_device_reset(phydev) after the put_device() call in phy_detach(). + +The comment before the put_device() call says that the phydev might go +away with put_device(). + +Fix potential use-after-free by calling phy_device_reset() before +put_device(). + +Fixes: bafbdd527d56 ("phylib: Add device reset GPIO support") +Signed-off-by: Marek Behún +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20220119162748.32418-1-kabel@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/phy_device.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index 74d8e1dc125f8..ce0bb5951b81e 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -1746,6 +1746,9 @@ void phy_detach(struct phy_device *phydev) + phy_driver_is_genphy_10g(phydev)) + device_release_driver(&phydev->mdio.dev); + ++ /* Assert the reset signal */ ++ phy_device_reset(phydev, 1); ++ + /* + * The phydev might go away on the put_device() below, so avoid + * a use-after-free bug by reading the underlying bus first. +@@ -1757,9 +1760,6 @@ void phy_detach(struct phy_device *phydev) + ndev_owner = dev->dev.parent->driver->owner; + if (ndev_owner != bus->owner) + module_put(bus->owner); +- +- /* Assert the reset signal */ +- phy_device_reset(phydev, 1); + } + EXPORT_SYMBOL(phy_detach); + +-- +2.34.1 + diff --git a/queue-5.16/ping-fix-the-sk_bound_dev_if-match-in-ping_lookup.patch-12227 b/queue-5.16/ping-fix-the-sk_bound_dev_if-match-in-ping_lookup.patch-12227 new file mode 100644 index 00000000000..8a93a2f4560 --- /dev/null +++ b/queue-5.16/ping-fix-the-sk_bound_dev_if-match-in-ping_lookup.patch-12227 @@ -0,0 +1,51 @@ +From 7ea79640ecacbb6e675c163ecebbbca410cf62ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jan 2022 06:40:56 -0500 +Subject: ping: fix the sk_bound_dev_if match in ping_lookup + +From: Xin Long + +[ Upstream commit 2afc3b5a31f9edf3ef0f374f5d70610c79c93a42 ] + +When 'ping' changes to use PING socket instead of RAW socket by: + + # sysctl -w net.ipv4.ping_group_range="0 100" + +the selftests 'router_broadcast.sh' will fail, as such command + + # ip vrf exec vrf-h1 ping -I veth0 198.51.100.255 -b + +can't receive the response skb by the PING socket. It's caused by mismatch +of sk_bound_dev_if and dif in ping_rcv() when looking up the PING socket, +as dif is vrf-h1 if dif's master was set to vrf-h1. + +This patch is to fix this regression by also checking the sk_bound_dev_if +against sdif so that the packets can stil be received even if the socket +is not bound to the vrf device but to the real iif. + +Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind") +Reported-by: Hangbin Liu +Signed-off-by: Xin Long +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/ping.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c +index 1e44a43acfe2d..086822cb1cc96 100644 +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -220,7 +220,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident) + continue; + } + +- if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif) ++ if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif && ++ sk->sk_bound_dev_if != inet_sdif(skb)) + continue; + + sock_hold(sk); +-- +2.34.1 + diff --git a/queue-5.16/powerpc-64s-mask-srr0-before-checking-against-the-ma.patch-26130 b/queue-5.16/powerpc-64s-mask-srr0-before-checking-against-the-ma.patch-26130 new file mode 100644 index 00000000000..9c186e629ca --- /dev/null +++ b/queue-5.16/powerpc-64s-mask-srr0-before-checking-against-the-ma.patch-26130 @@ -0,0 +1,59 @@ +From e69d11801b2ddd019a806a565f5b263a60d66ad8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jan 2022 23:44:03 +1000 +Subject: powerpc/64s: Mask SRR0 before checking against the masked NIP + +From: Nicholas Piggin + +[ Upstream commit aee101d7b95a03078945681dd7f7ea5e4a1e7686 ] + +Commit 314f6c23dd8d ("powerpc/64s: Mask NIP before checking against +SRR0") masked off the low 2 bits of the NIP value in the interrupt +stack frame in case they are non-zero and mis-compare against a SRR0 +register value of a CPU which always reads back 0 from the 2 low bits +which are reserved. + +This now causes the opposite problem that an implementation which does +implement those bits in SRR0 will mis-compare against the masked NIP +value in which they have been cleared. QEMU is one such implementation, +and this is allowed by the architecture. + +This can be triggered by sigfuz by setting low bits of PT_NIP in the +signal context. + +Fix this for now by masking the SRR0 bits as well. Cleaner is probably +to sanitise these values before putting them in registers or stack, but +this is the quick and backportable fix. + +Fixes: 314f6c23dd8d ("powerpc/64s: Mask NIP before checking against SRR0") +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220117134403.2995059-1-npiggin@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/interrupt_64.S | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/powerpc/kernel/interrupt_64.S b/arch/powerpc/kernel/interrupt_64.S +index 4b1ff94e67eb4..4c6d1a8dcefed 100644 +--- a/arch/powerpc/kernel/interrupt_64.S ++++ b/arch/powerpc/kernel/interrupt_64.S +@@ -30,6 +30,7 @@ COMPAT_SYS_CALL_TABLE: + .ifc \srr,srr + mfspr r11,SPRN_SRR0 + ld r12,_NIP(r1) ++ clrrdi r11,r11,2 + clrrdi r12,r12,2 + 100: tdne r11,r12 + EMIT_WARN_ENTRY 100b,__FILE__,__LINE__,(BUGFLAG_WARNING | BUGFLAG_ONCE) +@@ -40,6 +41,7 @@ COMPAT_SYS_CALL_TABLE: + .else + mfspr r11,SPRN_HSRR0 + ld r12,_NIP(r1) ++ clrrdi r11,r11,2 + clrrdi r12,r12,2 + 100: tdne r11,r12 + EMIT_WARN_ENTRY 100b,__FILE__,__LINE__,(BUGFLAG_WARNING | BUGFLAG_ONCE) +-- +2.34.1 + diff --git a/queue-5.16/powerpc-perf-fix-power_pmu_disable-to-call-clear_pmi.patch-12087 b/queue-5.16/powerpc-perf-fix-power_pmu_disable-to-call-clear_pmi.patch-12087 new file mode 100644 index 00000000000..6c628902c9e --- /dev/null +++ b/queue-5.16/powerpc-perf-fix-power_pmu_disable-to-call-clear_pmi.patch-12087 @@ -0,0 +1,95 @@ +From e9bc612012a4f6536eed0f38e0af27f2a0184d72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jan 2022 09:04:29 +0530 +Subject: powerpc/perf: Fix power_pmu_disable to call clear_pmi_irq_pending + only if PMI is pending + +From: Athira Rajeev + +[ Upstream commit fb6433b48a178d4672cb26632454ee0b21056eaa ] + +Running selftest with CONFIG_PPC_IRQ_SOFT_MASK_DEBUG enabled in kernel +triggered below warning: + +[ 172.851380] ------------[ cut here ]------------ +[ 172.851391] WARNING: CPU: 8 PID: 2901 at arch/powerpc/include/asm/hw_irq.h:246 power_pmu_disable+0x270/0x280 +[ 172.851402] Modules linked in: dm_mod bonding nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables rfkill nfnetlink sunrpc xfs libcrc32c pseries_rng xts vmx_crypto uio_pdrv_genirq uio sch_fq_codel ip_tables ext4 mbcache jbd2 sd_mod t10_pi sg ibmvscsi ibmveth scsi_transport_srp fuse +[ 172.851442] CPU: 8 PID: 2901 Comm: lost_exception_ Not tainted 5.16.0-rc5-03218-g798527287598 #2 +[ 172.851451] NIP: c00000000013d600 LR: c00000000013d5a4 CTR: c00000000013b180 +[ 172.851458] REGS: c000000017687860 TRAP: 0700 Not tainted (5.16.0-rc5-03218-g798527287598) +[ 172.851465] MSR: 8000000000029033 CR: 48004884 XER: 20040000 +[ 172.851482] CFAR: c00000000013d5b4 IRQMASK: 1 +[ 172.851482] GPR00: c00000000013d5a4 c000000017687b00 c000000002a10600 0000000000000004 +[ 172.851482] GPR04: 0000000082004000 c0000008ba08f0a8 0000000000000000 00000008b7ed0000 +[ 172.851482] GPR08: 00000000446194f6 0000000000008000 c00000000013b118 c000000000d58e68 +[ 172.851482] GPR12: c00000000013d390 c00000001ec54a80 0000000000000000 0000000000000000 +[ 172.851482] GPR16: 0000000000000000 0000000000000000 c000000015d5c708 c0000000025396d0 +[ 172.851482] GPR20: 0000000000000000 0000000000000000 c00000000a3bbf40 0000000000000003 +[ 172.851482] GPR24: 0000000000000000 c0000008ba097400 c0000000161e0d00 c00000000a3bb600 +[ 172.851482] GPR28: c000000015d5c700 0000000000000001 0000000082384090 c0000008ba0020d8 +[ 172.851549] NIP [c00000000013d600] power_pmu_disable+0x270/0x280 +[ 172.851557] LR [c00000000013d5a4] power_pmu_disable+0x214/0x280 +[ 172.851565] Call Trace: +[ 172.851568] [c000000017687b00] [c00000000013d5a4] power_pmu_disable+0x214/0x280 (unreliable) +[ 172.851579] [c000000017687b40] [c0000000003403ac] perf_pmu_disable+0x4c/0x60 +[ 172.851588] [c000000017687b60] [c0000000003445e4] __perf_event_task_sched_out+0x1d4/0x660 +[ 172.851596] [c000000017687c50] [c000000000d1175c] __schedule+0xbcc/0x12a0 +[ 172.851602] [c000000017687d60] [c000000000d11ea8] schedule+0x78/0x140 +[ 172.851608] [c000000017687d90] [c0000000001a8080] sys_sched_yield+0x20/0x40 +[ 172.851615] [c000000017687db0] [c0000000000334dc] system_call_exception+0x18c/0x380 +[ 172.851622] [c000000017687e10] [c00000000000c74c] system_call_common+0xec/0x268 + +The warning indicates that MSR_EE being set(interrupt enabled) when +there was an overflown PMC detected. This could happen in +power_pmu_disable since it runs under interrupt soft disable +condition ( local_irq_save ) and not with interrupts hard disabled. +commit 2c9ac51b850d ("powerpc/perf: Fix PMU callbacks to clear +pending PMI before resetting an overflown PMC") intended to clear +PMI pending bit in Paca when disabling the PMU. It could happen +that PMC gets overflown while code is in power_pmu_disable +callback function. Hence add a check to see if PMI pending bit +is set in Paca before clearing it via clear_pmi_pending. + +Fixes: 2c9ac51b850d ("powerpc/perf: Fix PMU callbacks to clear pending PMI before resetting an overflown PMC") +Reported-by: Sachin Sant +Signed-off-by: Athira Rajeev +Tested-by: Sachin Sant +Reviewed-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220122033429.25395-1-atrajeev@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/perf/core-book3s.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c +index bef6b1abce702..e78de70509472 100644 +--- a/arch/powerpc/perf/core-book3s.c ++++ b/arch/powerpc/perf/core-book3s.c +@@ -1326,9 +1326,20 @@ static void power_pmu_disable(struct pmu *pmu) + * Otherwise provide a warning if there is PMI pending, but + * no counter is found overflown. + */ +- if (any_pmc_overflown(cpuhw)) +- clear_pmi_irq_pending(); +- else ++ if (any_pmc_overflown(cpuhw)) { ++ /* ++ * Since power_pmu_disable runs under local_irq_save, it ++ * could happen that code hits a PMC overflow without PMI ++ * pending in paca. Hence only clear PMI pending if it was ++ * set. ++ * ++ * If a PMI is pending, then MSR[EE] must be disabled (because ++ * the masked PMI handler disabling EE). So it is safe to ++ * call clear_pmi_irq_pending(). ++ */ ++ if (pmi_irq_pending()) ++ clear_pmi_irq_pending(); ++ } else + WARN_ON(pmi_irq_pending()); + + val = mmcra = cpuhw->mmcr.mmcra; +-- +2.34.1 + diff --git a/queue-5.16/powerpc64-bpf-limit-ldbrx-to-processors-compliant-wi.patch-17391 b/queue-5.16/powerpc64-bpf-limit-ldbrx-to-processors-compliant-wi.patch-17391 new file mode 100644 index 00000000000..469bfdbcd56 --- /dev/null +++ b/queue-5.16/powerpc64-bpf-limit-ldbrx-to-processors-compliant-wi.patch-17391 @@ -0,0 +1,104 @@ +From 867854e0f383bb723d9277090c98ad1bbd44cbe6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jan 2022 17:15:12 +0530 +Subject: powerpc64/bpf: Limit 'ldbrx' to processors compliant with ISA v2.06 + +From: Naveen N. Rao + +[ Upstream commit 3f5f766d5f7f95a69a630da3544a1a0cee1cdddf ] + +Johan reported the below crash with test_bpf on ppc64 e5500: + + test_bpf: #296 ALU_END_FROM_LE 64: 0x0123456789abcdef -> 0x67452301 jited:1 + Oops: Exception in kernel mode, sig: 4 [#1] + BE PAGE_SIZE=4K SMP NR_CPUS=24 QEMU e500 + Modules linked in: test_bpf(+) + CPU: 0 PID: 76 Comm: insmod Not tainted 5.14.0-03771-g98c2059e008a-dirty #1 + NIP: 8000000000061c3c LR: 80000000006dea64 CTR: 8000000000061c18 + REGS: c0000000032d3420 TRAP: 0700 Not tainted (5.14.0-03771-g98c2059e008a-dirty) + MSR: 0000000080089000 CR: 88002822 XER: 20000000 IRQMASK: 0 + <...> + NIP [8000000000061c3c] 0x8000000000061c3c + LR [80000000006dea64] .__run_one+0x104/0x17c [test_bpf] + Call Trace: + .__run_one+0x60/0x17c [test_bpf] (unreliable) + .test_bpf_init+0x6a8/0xdc8 [test_bpf] + .do_one_initcall+0x6c/0x28c + .do_init_module+0x68/0x28c + .load_module+0x2460/0x2abc + .__do_sys_init_module+0x120/0x18c + .system_call_exception+0x110/0x1b8 + system_call_common+0xf0/0x210 + --- interrupt: c00 at 0x101d0acc + <...> + ---[ end trace 47b2bf19090bb3d0 ]--- + + Illegal instruction + +The illegal instruction turned out to be 'ldbrx' emitted for +BPF_FROM_[L|B]E, which was only introduced in ISA v2.06. Guard use of +the same and implement an alternative approach for older processors. + +Fixes: 156d0e290e969c ("powerpc/ebpf/jit: Implement JIT compiler for extended BPF") +Reported-by: Johan Almbladh +Signed-off-by: Naveen N. Rao +Tested-by: Johan Almbladh +Acked-by: Johan Almbladh +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/d1e51c6fdf572062cf3009a751c3406bda01b832.1641468127.git.naveen.n.rao@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/ppc-opcode.h | 1 + + arch/powerpc/net/bpf_jit_comp64.c | 22 +++++++++++++--------- + 2 files changed, 14 insertions(+), 9 deletions(-) + +diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h +index baea657bc8687..bca31a61e57f8 100644 +--- a/arch/powerpc/include/asm/ppc-opcode.h ++++ b/arch/powerpc/include/asm/ppc-opcode.h +@@ -498,6 +498,7 @@ + #define PPC_RAW_LDX(r, base, b) (0x7c00002a | ___PPC_RT(r) | ___PPC_RA(base) | ___PPC_RB(b)) + #define PPC_RAW_LHZ(r, base, i) (0xa0000000 | ___PPC_RT(r) | ___PPC_RA(base) | IMM_L(i)) + #define PPC_RAW_LHBRX(r, base, b) (0x7c00062c | ___PPC_RT(r) | ___PPC_RA(base) | ___PPC_RB(b)) ++#define PPC_RAW_LWBRX(r, base, b) (0x7c00042c | ___PPC_RT(r) | ___PPC_RA(base) | ___PPC_RB(b)) + #define PPC_RAW_LDBRX(r, base, b) (0x7c000428 | ___PPC_RT(r) | ___PPC_RA(base) | ___PPC_RB(b)) + #define PPC_RAW_STWCX(s, a, b) (0x7c00012d | ___PPC_RS(s) | ___PPC_RA(a) | ___PPC_RB(b)) + #define PPC_RAW_CMPWI(a, i) (0x2c000000 | ___PPC_RA(a) | IMM_L(i)) +diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c +index 6057e900a8790..a26a782e8b78e 100644 +--- a/arch/powerpc/net/bpf_jit_comp64.c ++++ b/arch/powerpc/net/bpf_jit_comp64.c +@@ -633,17 +633,21 @@ bpf_alu32_trunc: + EMIT(PPC_RAW_MR(dst_reg, b2p[TMP_REG_1])); + break; + case 64: +- /* +- * Way easier and faster(?) to store the value +- * into stack and then use ldbrx +- * +- * ctx->seen will be reliable in pass2, but +- * the instructions generated will remain the +- * same across all passes +- */ ++ /* Store the value to stack and then use byte-reverse loads */ + PPC_BPF_STL(dst_reg, 1, bpf_jit_stack_local(ctx)); + EMIT(PPC_RAW_ADDI(b2p[TMP_REG_1], 1, bpf_jit_stack_local(ctx))); +- EMIT(PPC_RAW_LDBRX(dst_reg, 0, b2p[TMP_REG_1])); ++ if (cpu_has_feature(CPU_FTR_ARCH_206)) { ++ EMIT(PPC_RAW_LDBRX(dst_reg, 0, b2p[TMP_REG_1])); ++ } else { ++ EMIT(PPC_RAW_LWBRX(dst_reg, 0, b2p[TMP_REG_1])); ++ if (IS_ENABLED(CONFIG_CPU_LITTLE_ENDIAN)) ++ EMIT(PPC_RAW_SLDI(dst_reg, dst_reg, 32)); ++ EMIT(PPC_RAW_LI(b2p[TMP_REG_2], 4)); ++ EMIT(PPC_RAW_LWBRX(b2p[TMP_REG_2], b2p[TMP_REG_2], b2p[TMP_REG_1])); ++ if (IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)) ++ EMIT(PPC_RAW_SLDI(b2p[TMP_REG_2], b2p[TMP_REG_2], 32)); ++ EMIT(PPC_RAW_OR(dst_reg, dst_reg, b2p[TMP_REG_2])); ++ } + break; + } + break; +-- +2.34.1 + diff --git a/queue-5.16/remoteproc-qcom-q6v5-fix-service-routines-build-erro.patch-12912 b/queue-5.16/remoteproc-qcom-q6v5-fix-service-routines-build-erro.patch-12912 new file mode 100644 index 00000000000..216c226f851 --- /dev/null +++ b/queue-5.16/remoteproc-qcom-q6v5-fix-service-routines-build-erro.patch-12912 @@ -0,0 +1,99 @@ +From bf0ea15ff6f8310200eff11d3d8471e5173355bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jan 2022 17:13:38 -0800 +Subject: remoteproc: qcom: q6v5: fix service routines build errors + +From: Randy Dunlap + +[ Upstream commit eee412e968f7b950564880bc6a7a9f00f49034da ] + +When CONFIG_QCOM_AOSS_QMP=m and CONFIG_QCOM_Q6V5_MSS=y, the builtin +driver cannot call into the loadable module's low-level service +functions. Trying to build with that config combo causes linker errors. + +There are two problems here. First, drivers/remoteproc/qcom_q6v5.c +should #include for the definitions of +the service functions, depending on whether CONFIG_QCOM_AOSS_QMP is +set/enabled or not. Second, the qcom remoteproc drivers should depend +on QCOM_AOSS_QMP iff it is enabled (=y or =m) so that the qcom +remoteproc drivers can be built properly. + +This prevents these build errors: + +aarch64-linux-ld: drivers/remoteproc/qcom_q6v5.o: in function `q6v5_load_state_toggle': +qcom_q6v5.c:(.text+0xc4): undefined reference to `qmp_send' +aarch64-linux-ld: drivers/remoteproc/qcom_q6v5.o: in function `qcom_q6v5_deinit': +(.text+0x2e4): undefined reference to `qmp_put' +aarch64-linux-ld: drivers/remoteproc/qcom_q6v5.o: in function `qcom_q6v5_init': +(.text+0x778): undefined reference to `qmp_get' +aarch64-linux-ld: (.text+0x7d8): undefined reference to `qmp_put' + +Fixes: c1fe10d238c0 ("remoteproc: qcom: q6v5: Use qmp_send to update co-processor load state") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Cc: Bjorn Andersson +Cc: Mathieu Poirier +Cc: linux-remoteproc@vger.kernel.org +Cc: Sibi Sankar +Cc: Stephen Boyd +Reviewed-by: Stephen Boyd +Reviewed-by: Bjorn Andersson +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220115011338.2973-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/Kconfig | 4 ++++ + drivers/remoteproc/qcom_q6v5.c | 1 + + 2 files changed, 5 insertions(+) + +diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig +index f2e961f998ca2..341156e2a29b9 100644 +--- a/drivers/remoteproc/Kconfig ++++ b/drivers/remoteproc/Kconfig +@@ -180,6 +180,7 @@ config QCOM_Q6V5_ADSP + depends on RPMSG_QCOM_GLINK_SMEM || RPMSG_QCOM_GLINK_SMEM=n + depends on QCOM_SYSMON || QCOM_SYSMON=n + depends on RPMSG_QCOM_GLINK || RPMSG_QCOM_GLINK=n ++ depends on QCOM_AOSS_QMP || QCOM_AOSS_QMP=n + select MFD_SYSCON + select QCOM_PIL_INFO + select QCOM_MDT_LOADER +@@ -199,6 +200,7 @@ config QCOM_Q6V5_MSS + depends on RPMSG_QCOM_GLINK_SMEM || RPMSG_QCOM_GLINK_SMEM=n + depends on QCOM_SYSMON || QCOM_SYSMON=n + depends on RPMSG_QCOM_GLINK || RPMSG_QCOM_GLINK=n ++ depends on QCOM_AOSS_QMP || QCOM_AOSS_QMP=n + select MFD_SYSCON + select QCOM_MDT_LOADER + select QCOM_PIL_INFO +@@ -218,6 +220,7 @@ config QCOM_Q6V5_PAS + depends on RPMSG_QCOM_GLINK_SMEM || RPMSG_QCOM_GLINK_SMEM=n + depends on QCOM_SYSMON || QCOM_SYSMON=n + depends on RPMSG_QCOM_GLINK || RPMSG_QCOM_GLINK=n ++ depends on QCOM_AOSS_QMP || QCOM_AOSS_QMP=n + select MFD_SYSCON + select QCOM_PIL_INFO + select QCOM_MDT_LOADER +@@ -239,6 +242,7 @@ config QCOM_Q6V5_WCSS + depends on RPMSG_QCOM_GLINK_SMEM || RPMSG_QCOM_GLINK_SMEM=n + depends on QCOM_SYSMON || QCOM_SYSMON=n + depends on RPMSG_QCOM_GLINK || RPMSG_QCOM_GLINK=n ++ depends on QCOM_AOSS_QMP || QCOM_AOSS_QMP=n + select MFD_SYSCON + select QCOM_MDT_LOADER + select QCOM_PIL_INFO +diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c +index eada7e34f3af5..442a388f81028 100644 +--- a/drivers/remoteproc/qcom_q6v5.c ++++ b/drivers/remoteproc/qcom_q6v5.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + #include + #include +-- +2.34.1 + diff --git a/queue-5.16/revert-drm-ast-support-1600x900-with-108mhz-pclk.patch-18660 b/queue-5.16/revert-drm-ast-support-1600x900-with-108mhz-pclk.patch-18660 new file mode 100644 index 00000000000..0c1e2a253aa --- /dev/null +++ b/queue-5.16/revert-drm-ast-support-1600x900-with-108mhz-pclk.patch-18660 @@ -0,0 +1,38 @@ +From 64ae378ce1d37bb483324cd5cf03ce27907d0060 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jan 2022 14:05:27 +1000 +Subject: Revert "drm/ast: Support 1600x900 with 108MHz PCLK" + +From: Dave Airlie + +[ Upstream commit 76cea3d95513fe40000d06a3719c4bb6b53275e2 ] + +This reverts commit 9bb7b689274b67ecb3641e399e76f84adc627df1. + +This caused a regression reported to Red Hat. + +Fixes: 9bb7b689274b ("drm/ast: Support 1600x900 with 108MHz PCLK") +Signed-off-by: Dave Airlie +Signed-off-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20220120040527.552068-1-airlied@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ast/ast_tables.h | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/ast/ast_tables.h b/drivers/gpu/drm/ast/ast_tables.h +index d9eb353a4bf09..dbe1cc620f6e6 100644 +--- a/drivers/gpu/drm/ast/ast_tables.h ++++ b/drivers/gpu/drm/ast/ast_tables.h +@@ -282,8 +282,6 @@ static const struct ast_vbios_enhtable res_1360x768[] = { + }; + + static const struct ast_vbios_enhtable res_1600x900[] = { +- {1800, 1600, 24, 80, 1000, 900, 1, 3, VCLK108, /* 60Hz */ +- (SyncPP | Charx8Dot | LineCompareOff | WideScreenMode | NewModeInfo), 60, 3, 0x3A }, + {1760, 1600, 48, 32, 926, 900, 3, 5, VCLK97_75, /* 60Hz CVT RB */ + (SyncNP | Charx8Dot | LineCompareOff | WideScreenMode | NewModeInfo | + AST2500PreCatchCRT), 60, 1, 0x3A }, +-- +2.34.1 + diff --git a/queue-5.16/revert-ipv6-honor-all-ipv6-pio-valid-lifetime-values.patch-25170 b/queue-5.16/revert-ipv6-honor-all-ipv6-pio-valid-lifetime-values.patch-25170 new file mode 100644 index 00000000000..b52e664cd4e --- /dev/null +++ b/queue-5.16/revert-ipv6-honor-all-ipv6-pio-valid-lifetime-values.patch-25170 @@ -0,0 +1,96 @@ +From 2b53147f00f5487c3fcb9d493f37b53f6bbc2fc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jan 2022 16:38:52 +0100 +Subject: Revert "ipv6: Honor all IPv6 PIO Valid Lifetime values" + +From: Guillaume Nault + +[ Upstream commit 36268983e90316b37000a005642af42234dabb36 ] + +This reverts commit b75326c201242de9495ff98e5d5cff41d7fc0d9d. + +This commit breaks Linux compatibility with USGv6 tests. The RFC this +commit was based on is actually an expired draft: no published RFC +currently allows the new behaviour it introduced. + +Without full IETF endorsement, the flash renumbering scenario this +patch was supposed to enable is never going to work, as other IPv6 +equipements on the same LAN will keep the 2 hours limit. + +Fixes: b75326c20124 ("ipv6: Honor all IPv6 PIO Valid Lifetime values") +Signed-off-by: Guillaume Nault +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/addrconf.h | 2 ++ + net/ipv6/addrconf.c | 27 ++++++++++++++++++++------- + 2 files changed, 22 insertions(+), 7 deletions(-) + +diff --git a/include/net/addrconf.h b/include/net/addrconf.h +index 78ea3e332688f..e7ce719838b5e 100644 +--- a/include/net/addrconf.h ++++ b/include/net/addrconf.h +@@ -6,6 +6,8 @@ + #define RTR_SOLICITATION_INTERVAL (4*HZ) + #define RTR_SOLICITATION_MAX_INTERVAL (3600*HZ) /* 1 hour */ + ++#define MIN_VALID_LIFETIME (2*3600) /* 2 hours */ ++ + #define TEMP_VALID_LIFETIME (7*86400) + #define TEMP_PREFERRED_LIFETIME (86400) + #define REGEN_MAX_RETRY (3) +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 3445f8017430f..87961f1d9959b 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -2589,7 +2589,7 @@ int addrconf_prefix_rcv_add_addr(struct net *net, struct net_device *dev, + __u32 valid_lft, u32 prefered_lft) + { + struct inet6_ifaddr *ifp = ipv6_get_ifaddr(net, addr, dev, 1); +- int create = 0; ++ int create = 0, update_lft = 0; + + if (!ifp && valid_lft) { + int max_addresses = in6_dev->cnf.max_addresses; +@@ -2633,19 +2633,32 @@ int addrconf_prefix_rcv_add_addr(struct net *net, struct net_device *dev, + unsigned long now; + u32 stored_lft; + +- /* Update lifetime (RFC4862 5.5.3 e) +- * We deviate from RFC4862 by honoring all Valid Lifetimes to +- * improve the reaction of SLAAC to renumbering events +- * (draft-gont-6man-slaac-renum-06, Section 4.2) +- */ ++ /* update lifetime (RFC2462 5.5.3 e) */ + spin_lock_bh(&ifp->lock); + now = jiffies; + if (ifp->valid_lft > (now - ifp->tstamp) / HZ) + stored_lft = ifp->valid_lft - (now - ifp->tstamp) / HZ; + else + stored_lft = 0; +- + if (!create && stored_lft) { ++ const u32 minimum_lft = min_t(u32, ++ stored_lft, MIN_VALID_LIFETIME); ++ valid_lft = max(valid_lft, minimum_lft); ++ ++ /* RFC4862 Section 5.5.3e: ++ * "Note that the preferred lifetime of the ++ * corresponding address is always reset to ++ * the Preferred Lifetime in the received ++ * Prefix Information option, regardless of ++ * whether the valid lifetime is also reset or ++ * ignored." ++ * ++ * So we should always update prefered_lft here. ++ */ ++ update_lft = 1; ++ } ++ ++ if (update_lft) { + ifp->valid_lft = valid_lft; + ifp->prefered_lft = prefered_lft; + ifp->tstamp = now; +-- +2.34.1 + diff --git a/queue-5.16/rpmsg-char-fix-race-between-the-release-of-rpmsg_ctr.patch-551 b/queue-5.16/rpmsg-char-fix-race-between-the-release-of-rpmsg_ctr.patch-551 new file mode 100644 index 00000000000..614198c9645 --- /dev/null +++ b/queue-5.16/rpmsg-char-fix-race-between-the-release-of-rpmsg_ctr.patch-551 @@ -0,0 +1,117 @@ +From 525923924867669b49a0af48c9b9a8a6bed1052b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jan 2022 10:47:36 -0800 +Subject: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev + +From: Sujit Kautkar + +[ Upstream commit b7fb2dad571d1e21173c06cef0bced77b323990a ] + +struct rpmsg_ctrldev contains a struct cdev. The current code frees +the rpmsg_ctrldev struct in rpmsg_ctrldev_release_device(), but the +cdev is a managed object, therefore its release is not predictable +and the rpmsg_ctrldev could be freed before the cdev is entirely +released, as in the backtrace below. + +[ 93.625603] ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x7c +[ 93.636115] WARNING: CPU: 0 PID: 12 at lib/debugobjects.c:488 debug_print_object+0x13c/0x1b0 +[ 93.644799] Modules linked in: veth xt_cgroup xt_MASQUERADE rfcomm algif_hash algif_skcipher af_alg uinput ip6table_nat fuse uvcvideo videobuf2_vmalloc venus_enc venus_dec videobuf2_dma_contig hci_uart btandroid btqca snd_soc_rt5682_i2c bluetooth qcom_spmi_temp_alarm snd_soc_rt5682v +[ 93.715175] CPU: 0 PID: 12 Comm: kworker/0:1 Tainted: G B 5.4.163-lockdep #26 +[ 93.723855] Hardware name: Google Lazor (rev3 - 8) with LTE (DT) +[ 93.730055] Workqueue: events kobject_delayed_cleanup +[ 93.735271] pstate: 60c00009 (nZCv daif +PAN +UAO) +[ 93.740216] pc : debug_print_object+0x13c/0x1b0 +[ 93.744890] lr : debug_print_object+0x13c/0x1b0 +[ 93.749555] sp : ffffffacf5bc7940 +[ 93.752978] x29: ffffffacf5bc7940 x28: dfffffd000000000 +[ 93.758448] x27: ffffffacdb11a800 x26: dfffffd000000000 +[ 93.763916] x25: ffffffd0734f856c x24: dfffffd000000000 +[ 93.769389] x23: 0000000000000000 x22: ffffffd0733c35b0 +[ 93.774860] x21: ffffffd0751994a0 x20: ffffffd075ec27c0 +[ 93.780338] x19: ffffffd075199100 x18: 00000000000276e0 +[ 93.785814] x17: 0000000000000000 x16: dfffffd000000000 +[ 93.791291] x15: ffffffffffffffff x14: 6e6968207473696c +[ 93.796768] x13: 0000000000000000 x12: ffffffd075e2b000 +[ 93.802244] x11: 0000000000000001 x10: 0000000000000000 +[ 93.807723] x9 : d13400dff1921900 x8 : d13400dff1921900 +[ 93.813200] x7 : 0000000000000000 x6 : 0000000000000000 +[ 93.818676] x5 : 0000000000000080 x4 : 0000000000000000 +[ 93.824152] x3 : ffffffd0732a0fa4 x2 : 0000000000000001 +[ 93.829628] x1 : ffffffacf5bc7580 x0 : 0000000000000061 +[ 93.835104] Call trace: +[ 93.837644] debug_print_object+0x13c/0x1b0 +[ 93.841963] __debug_check_no_obj_freed+0x25c/0x3c0 +[ 93.846987] debug_check_no_obj_freed+0x18/0x20 +[ 93.851669] slab_free_freelist_hook+0xbc/0x1e4 +[ 93.856346] kfree+0xfc/0x2f4 +[ 93.859416] rpmsg_ctrldev_release_device+0x78/0xb8 +[ 93.864445] device_release+0x84/0x168 +[ 93.868310] kobject_cleanup+0x12c/0x298 +[ 93.872356] kobject_delayed_cleanup+0x10/0x18 +[ 93.876948] process_one_work+0x578/0x92c +[ 93.881086] worker_thread+0x804/0xcf8 +[ 93.884963] kthread+0x2a8/0x314 +[ 93.888303] ret_from_fork+0x10/0x18 + +The cdev_device_add/del() API was created to address this issue (see +commit '233ed09d7fda ("chardev: add helper function to register char +devs with a struct device")'), use it instead of cdev add/del(). + +Fixes: c0cdc19f84a4 ("rpmsg: Driver for user space endpoint interface") +Signed-off-by: Sujit Kautkar +Signed-off-by: Matthias Kaehlcke +Reviewed-by: Mathieu Poirier +Reviewed-by: Bjorn Andersson +Reviewed-by: Stephen Boyd +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220110104706.v6.1.Iaac908f3e3149a89190ce006ba166e2d3fd247a3@changeid +Signed-off-by: Sasha Levin +--- + drivers/rpmsg/rpmsg_char.c | 11 ++--------- + 1 file changed, 2 insertions(+), 9 deletions(-) + +diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c +index b5907b80727cc..b1b75ef045606 100644 +--- a/drivers/rpmsg/rpmsg_char.c ++++ b/drivers/rpmsg/rpmsg_char.c +@@ -459,7 +459,6 @@ static void rpmsg_ctrldev_release_device(struct device *dev) + + ida_simple_remove(&rpmsg_ctrl_ida, dev->id); + ida_simple_remove(&rpmsg_minor_ida, MINOR(dev->devt)); +- cdev_del(&ctrldev->cdev); + kfree(ctrldev); + } + +@@ -494,19 +493,13 @@ static int rpmsg_chrdev_probe(struct rpmsg_device *rpdev) + dev->id = ret; + dev_set_name(&ctrldev->dev, "rpmsg_ctrl%d", ret); + +- ret = cdev_add(&ctrldev->cdev, dev->devt, 1); ++ ret = cdev_device_add(&ctrldev->cdev, &ctrldev->dev); + if (ret) + goto free_ctrl_ida; + + /* We can now rely on the release function for cleanup */ + dev->release = rpmsg_ctrldev_release_device; + +- ret = device_add(dev); +- if (ret) { +- dev_err(&rpdev->dev, "device_add failed: %d\n", ret); +- put_device(dev); +- } +- + dev_set_drvdata(&rpdev->dev, ctrldev); + + return ret; +@@ -532,7 +525,7 @@ static void rpmsg_chrdev_remove(struct rpmsg_device *rpdev) + if (ret) + dev_warn(&rpdev->dev, "failed to nuke endpoints: %d\n", ret); + +- device_del(&ctrldev->dev); ++ cdev_device_del(&ctrldev->cdev, &ctrldev->dev); + put_device(&ctrldev->dev); + } + +-- +2.34.1 + diff --git a/queue-5.16/rpmsg-char-fix-race-between-the-release-of-rpmsg_ept.patch-8103 b/queue-5.16/rpmsg-char-fix-race-between-the-release-of-rpmsg_ept.patch-8103 new file mode 100644 index 00000000000..38a2c3304f7 --- /dev/null +++ b/queue-5.16/rpmsg-char-fix-race-between-the-release-of-rpmsg_ept.patch-8103 @@ -0,0 +1,76 @@ +From 51c6765ad54a43cf7d479fa7de6733dff2031742 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jan 2022 10:47:37 -0800 +Subject: rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev + +From: Matthias Kaehlcke + +[ Upstream commit 7a534ae89e34e9b51acb5a63dd0f88308178b46a ] + +struct rpmsg_eptdev contains a struct cdev. The current code frees +the rpmsg_eptdev struct in rpmsg_eptdev_destroy(), but the cdev is +a managed object, therefore its release is not predictable and the +rpmsg_eptdev could be freed before the cdev is entirely released. + +The cdev_device_add/del() API was created to address this issue +(see commit '233ed09d7fda ("chardev: add helper function to register +char devs with a struct device")'), use it instead of cdev add/del(). + +Fixes: c0cdc19f84a4 ("rpmsg: Driver for user space endpoint interface") +Suggested-by: Bjorn Andersson +Signed-off-by: Matthias Kaehlcke +Reviewed-by: Mathieu Poirier +Reviewed-by: Stephen Boyd +Reviewed-by: Bjorn Andersson +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220110104706.v6.2.Idde68b05b88d4a2e6e54766c653f3a6d9e419ce6@changeid +Signed-off-by: Sasha Levin +--- + drivers/rpmsg/rpmsg_char.c | 11 ++--------- + 1 file changed, 2 insertions(+), 9 deletions(-) + +diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c +index b1b75ef045606..3ec34ad0e893d 100644 +--- a/drivers/rpmsg/rpmsg_char.c ++++ b/drivers/rpmsg/rpmsg_char.c +@@ -90,7 +90,7 @@ static int rpmsg_eptdev_destroy(struct device *dev, void *data) + /* wake up any blocked readers */ + wake_up_interruptible(&eptdev->readq); + +- device_del(&eptdev->dev); ++ cdev_device_del(&eptdev->cdev, &eptdev->dev); + put_device(&eptdev->dev); + + return 0; +@@ -333,7 +333,6 @@ static void rpmsg_eptdev_release_device(struct device *dev) + + ida_simple_remove(&rpmsg_ept_ida, dev->id); + ida_simple_remove(&rpmsg_minor_ida, MINOR(eptdev->dev.devt)); +- cdev_del(&eptdev->cdev); + kfree(eptdev); + } + +@@ -378,19 +377,13 @@ static int rpmsg_eptdev_create(struct rpmsg_ctrldev *ctrldev, + dev->id = ret; + dev_set_name(dev, "rpmsg%d", ret); + +- ret = cdev_add(&eptdev->cdev, dev->devt, 1); ++ ret = cdev_device_add(&eptdev->cdev, &eptdev->dev); + if (ret) + goto free_ept_ida; + + /* We can now rely on the release function for cleanup */ + dev->release = rpmsg_eptdev_release_device; + +- ret = device_add(dev); +- if (ret) { +- dev_err(dev, "device_add failed: %d\n", ret); +- put_device(dev); +- } +- + return ret; + + free_ept_ida: +-- +2.34.1 + diff --git a/queue-5.16/rxrpc-adjust-retransmission-backoff.patch-4735 b/queue-5.16/rxrpc-adjust-retransmission-backoff.patch-4735 new file mode 100644 index 00000000000..5e79371c092 --- /dev/null +++ b/queue-5.16/rxrpc-adjust-retransmission-backoff.patch-4735 @@ -0,0 +1,93 @@ +From ba3246e8813d93898ce5e3913523a428289d5f77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 23:12:58 +0000 +Subject: rxrpc: Adjust retransmission backoff + +From: David Howells + +[ Upstream commit 2c13c05c5ff4b9fc907b07f7311821910ebaaf8a ] + +Improve retransmission backoff by only backing off when we retransmit data +packets rather than when we set the lost ack timer. + +To this end: + + (1) In rxrpc_resend(), use rxrpc_get_rto_backoff() when setting the + retransmission timer and only tell it that we are retransmitting if we + actually have things to retransmit. + + Note that it's possible for the retransmission algorithm to race with + the processing of a received ACK, so we may see no packets needing + retransmission. + + (2) In rxrpc_send_data_packet(), don't bump the backoff when setting the + ack_lost_at timer, as it may then get bumped twice. + +With this, when looking at one particular packet, the retransmission +intervals were seen to be 1.5ms, 2ms, 3ms, 5ms, 9ms, 17ms, 33ms, 71ms, +136ms, 264ms, 544ms, 1.088s, 2.1s, 4.2s and 8.3s. + +Fixes: c410bf01933e ("rxrpc: Fix the excessive initial retransmission timeout") +Suggested-by: Marc Dionne +Signed-off-by: David Howells +Reviewed-by: Marc Dionne +Tested-by: Marc Dionne +cc: linux-afs@lists.infradead.org +Link: https://lore.kernel.org/r/164138117069.2023386.17446904856843997127.stgit@warthog.procyon.org.uk/ +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/rxrpc/call_event.c | 8 +++----- + net/rxrpc/output.c | 2 +- + 2 files changed, 4 insertions(+), 6 deletions(-) + +diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c +index 6be2672a65eab..df864e6922679 100644 +--- a/net/rxrpc/call_event.c ++++ b/net/rxrpc/call_event.c +@@ -157,7 +157,7 @@ static void rxrpc_congestion_timeout(struct rxrpc_call *call) + static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j) + { + struct sk_buff *skb; +- unsigned long resend_at, rto_j; ++ unsigned long resend_at; + rxrpc_seq_t cursor, seq, top; + ktime_t now, max_age, oldest, ack_ts; + int ix; +@@ -165,10 +165,8 @@ static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j) + + _enter("{%d,%d}", call->tx_hard_ack, call->tx_top); + +- rto_j = call->peer->rto_j; +- + now = ktime_get_real(); +- max_age = ktime_sub(now, jiffies_to_usecs(rto_j)); ++ max_age = ktime_sub(now, jiffies_to_usecs(call->peer->rto_j)); + + spin_lock_bh(&call->lock); + +@@ -213,7 +211,7 @@ static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j) + } + + resend_at = nsecs_to_jiffies(ktime_to_ns(ktime_sub(now, oldest))); +- resend_at += jiffies + rto_j; ++ resend_at += jiffies + rxrpc_get_rto_backoff(call->peer, retrans); + WRITE_ONCE(call->resend_at, resend_at); + + if (unacked) +diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c +index 10f2bf2e9068a..a45c83f22236e 100644 +--- a/net/rxrpc/output.c ++++ b/net/rxrpc/output.c +@@ -468,7 +468,7 @@ done: + if (call->peer->rtt_count > 1) { + unsigned long nowj = jiffies, ack_lost_at; + +- ack_lost_at = rxrpc_get_rto_backoff(call->peer, retrans); ++ ack_lost_at = rxrpc_get_rto_backoff(call->peer, false); + ack_lost_at += nowj; + WRITE_ONCE(call->ack_lost_at, ack_lost_at); + rxrpc_reduce_call_timer(call, ack_lost_at, nowj, +-- +2.34.1 + diff --git a/queue-5.16/sch_htb-fail-on-unsupported-parameters-when-offload-.patch-24755 b/queue-5.16/sch_htb-fail-on-unsupported-parameters-when-offload-.patch-24755 new file mode 100644 index 00000000000..c2449adfa54 --- /dev/null +++ b/queue-5.16/sch_htb-fail-on-unsupported-parameters-when-offload-.patch-24755 @@ -0,0 +1,67 @@ +From 3d062b6ad0f7b2b8b87e3d43bb561890ae6006c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jan 2022 12:06:54 +0200 +Subject: sch_htb: Fail on unsupported parameters when offload is requested + +From: Maxim Mikityanskiy + +[ Upstream commit 429c3be8a5e2695b5b92a6a12361eb89eb185495 ] + +The current implementation of HTB offload doesn't support some +parameters. Instead of ignoring them, actively return the EINVAL error +when they are set to non-defaults. + +As this patch goes to stable, the driver API is not changed here. If +future drivers support more offload parameters, the checks can be moved +to the driver side. + +Note that the buffer and cbuffer parameters are also not supported, but +the tc userspace tool assigns some default values derived from rate and +ceil, and identifying these defaults in sch_htb would be unreliable, so +they are still ignored. + +Fixes: d03b195b5aa0 ("sch_htb: Hierarchical QoS hardware offload") +Reported-by: Jakub Kicinski +Signed-off-by: Maxim Mikityanskiy +Reviewed-by: Tariq Toukan +Link: https://lore.kernel.org/r/20220125100654.424570-1-maximmi@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_htb.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c +index 9267922ea9c37..23a9d6242429f 100644 +--- a/net/sched/sch_htb.c ++++ b/net/sched/sch_htb.c +@@ -1810,6 +1810,26 @@ static int htb_change_class(struct Qdisc *sch, u32 classid, + if (!hopt->rate.rate || !hopt->ceil.rate) + goto failure; + ++ if (q->offload) { ++ /* Options not supported by the offload. */ ++ if (hopt->rate.overhead || hopt->ceil.overhead) { ++ NL_SET_ERR_MSG(extack, "HTB offload doesn't support the overhead parameter"); ++ goto failure; ++ } ++ if (hopt->rate.mpu || hopt->ceil.mpu) { ++ NL_SET_ERR_MSG(extack, "HTB offload doesn't support the mpu parameter"); ++ goto failure; ++ } ++ if (hopt->quantum) { ++ NL_SET_ERR_MSG(extack, "HTB offload doesn't support the quantum parameter"); ++ goto failure; ++ } ++ if (hopt->prio) { ++ NL_SET_ERR_MSG(extack, "HTB offload doesn't support the prio parameter"); ++ goto failure; ++ } ++ } ++ + /* Keeping backward compatible with rate_table based iproute2 tc */ + if (hopt->rate.linklayer == TC_LINKLAYER_UNAWARE) + qdisc_put_rtab(qdisc_get_rtab(&hopt->rate, tb[TCA_HTB_RTAB], +-- +2.34.1 + diff --git a/queue-5.16/sched-pelt-relax-the-sync-of-util_sum-with-util_avg.patch-619 b/queue-5.16/sched-pelt-relax-the-sync-of-util_sum-with-util_avg.patch-619 new file mode 100644 index 00000000000..fd303f60abe --- /dev/null +++ b/queue-5.16/sched-pelt-relax-the-sync-of-util_sum-with-util_avg.patch-619 @@ -0,0 +1,105 @@ +From d0c9432ed7f922d97228641d700dc4427f0d4eaa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jan 2022 14:46:56 +0100 +Subject: sched/pelt: Relax the sync of util_sum with util_avg + +From: Vincent Guittot + +[ Upstream commit 98b0d890220d45418cfbc5157b3382e6da5a12ab ] + +Rick reported performance regressions in bugzilla because of cpu frequency +being lower than before: + https://bugzilla.kernel.org/show_bug.cgi?id=215045 + +He bisected the problem to: +commit 1c35b07e6d39 ("sched/fair: Ensure _sum and _avg values stay consistent") + +This commit forces util_sum to be synced with the new util_avg after +removing the contribution of a task and before the next periodic sync. By +doing so util_sum is rounded to its lower bound and might lost up to +LOAD_AVG_MAX-1 of accumulated contribution which has not yet been +reflected in util_avg. + +Instead of always setting util_sum to the low bound of util_avg, which can +significantly lower the utilization of root cfs_rq after propagating the +change down into the hierarchy, we revert the change of util_sum and +propagate the difference. + +In addition, we also check that cfs's util_sum always stays above the +lower bound for a given util_avg as it has been observed that +sched_entity's util_sum is sometimes above cfs one. + +Fixes: 1c35b07e6d39 ("sched/fair: Ensure _sum and _avg values stay consistent") +Reported-by: Rick Yiu +Signed-off-by: Vincent Guittot +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Dietmar Eggemann +Tested-by: Sachin Sant +Link: https://lkml.kernel.org/r/20220111134659.24961-2-vincent.guittot@linaro.org +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 16 +++++++++++++--- + kernel/sched/pelt.h | 4 +++- + 2 files changed, 16 insertions(+), 4 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index f2cf047b25e56..069e01772d922 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -3382,7 +3382,6 @@ void set_task_rq_fair(struct sched_entity *se, + se->avg.last_update_time = n_last_update_time; + } + +- + /* + * When on migration a sched_entity joins/leaves the PELT hierarchy, we need to + * propagate its contribution. The key to this propagation is the invariant +@@ -3450,7 +3449,6 @@ void set_task_rq_fair(struct sched_entity *se, + * XXX: only do this for the part of runnable > running ? + * + */ +- + static inline void + update_tg_cfs_util(struct cfs_rq *cfs_rq, struct sched_entity *se, struct cfs_rq *gcfs_rq) + { +@@ -3682,7 +3680,19 @@ update_cfs_rq_load_avg(u64 now, struct cfs_rq *cfs_rq) + + r = removed_util; + sub_positive(&sa->util_avg, r); +- sa->util_sum = sa->util_avg * divider; ++ sub_positive(&sa->util_sum, r * divider); ++ /* ++ * Because of rounding, se->util_sum might ends up being +1 more than ++ * cfs->util_sum. Although this is not a problem by itself, detaching ++ * a lot of tasks with the rounding problem between 2 updates of ++ * util_avg (~1ms) can make cfs->util_sum becoming null whereas ++ * cfs_util_avg is not. ++ * Check that util_sum is still above its lower bound for the new ++ * util_avg. Given that period_contrib might have moved since the last ++ * sync, we are only sure that util_sum must be above or equal to ++ * util_avg * minimum possible divider ++ */ ++ sa->util_sum = max_t(u32, sa->util_sum, sa->util_avg * PELT_MIN_DIVIDER); + + r = removed_runnable; + sub_positive(&sa->runnable_avg, r); +diff --git a/kernel/sched/pelt.h b/kernel/sched/pelt.h +index e06071bf3472c..c336f5f481bca 100644 +--- a/kernel/sched/pelt.h ++++ b/kernel/sched/pelt.h +@@ -37,9 +37,11 @@ update_irq_load_avg(struct rq *rq, u64 running) + } + #endif + ++#define PELT_MIN_DIVIDER (LOAD_AVG_MAX - 1024) ++ + static inline u32 get_pelt_divider(struct sched_avg *avg) + { +- return LOAD_AVG_MAX - 1024 + avg->period_contrib; ++ return PELT_MIN_DIVIDER + avg->period_contrib; + } + + static inline void cfs_se_util_change(struct sched_avg *avg) +-- +2.34.1 + diff --git a/queue-5.16/scsi-bnx2fc-flush-destroy_work-queue-before-calling-.patch-6652 b/queue-5.16/scsi-bnx2fc-flush-destroy_work-queue-before-calling-.patch-6652 new file mode 100644 index 00000000000..274c3a3d9f4 --- /dev/null +++ b/queue-5.16/scsi-bnx2fc-flush-destroy_work-queue-before-calling-.patch-6652 @@ -0,0 +1,152 @@ +From a7badd64df203395df402250f881799c743ef872 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jan 2022 23:00:44 -0500 +Subject: scsi: bnx2fc: Flush destroy_work queue before calling + bnx2fc_interface_put() + +From: John Meneghini + +[ Upstream commit 847f9ea4c5186fdb7b84297e3eeed9e340e83fce ] + +The bnx2fc_destroy() functions are removing the interface before calling +destroy_work. This results multiple WARNings from sysfs_remove_group() as +the controller rport device attributes are removed too early. + +Replace the fcoe_port's destroy_work queue. It's not needed. + +The problem is easily reproducible with the following steps. + +Example: + + $ dmesg -w & + $ systemctl enable --now fcoe + $ fipvlan -s -c ens2f1 + $ fcoeadm -d ens2f1.802 + [ 583.464488] host2: libfc: Link down on port (7500a1) + [ 583.472651] bnx2fc: 7500a1 - rport not created Yet!! + [ 583.490468] ------------[ cut here ]------------ + [ 583.538725] sysfs group 'power' not found for kobject 'rport-2:0-0' + [ 583.568814] WARNING: CPU: 3 PID: 192 at fs/sysfs/group.c:279 sysfs_remove_group+0x6f/0x80 + [ 583.607130] Modules linked in: dm_service_time 8021q garp mrp stp llc bnx2fc cnic uio rpcsec_gss_krb5 auth_rpcgss nfsv4 ... + [ 583.942994] CPU: 3 PID: 192 Comm: kworker/3:2 Kdump: loaded Not tainted 5.14.0-39.el9.x86_64 #1 + [ 583.984105] Hardware name: HP ProLiant DL120 G7, BIOS J01 07/01/2013 + [ 584.016535] Workqueue: fc_wq_2 fc_rport_final_delete [scsi_transport_fc] + [ 584.050691] RIP: 0010:sysfs_remove_group+0x6f/0x80 + [ 584.074725] Code: ff 5b 48 89 ef 5d 41 5c e9 ee c0 ff ff 48 89 ef e8 f6 b8 ff ff eb d1 49 8b 14 24 48 8b 33 48 c7 c7 ... + [ 584.162586] RSP: 0018:ffffb567c15afdc0 EFLAGS: 00010282 + [ 584.188225] RAX: 0000000000000000 RBX: ffffffff8eec4220 RCX: 0000000000000000 + [ 584.221053] RDX: ffff8c1586ce84c0 RSI: ffff8c1586cd7cc0 RDI: ffff8c1586cd7cc0 + [ 584.255089] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffb567c15afc00 + [ 584.287954] R10: ffffb567c15afbf8 R11: ffffffff8fbe7f28 R12: ffff8c1486326400 + [ 584.322356] R13: ffff8c1486326480 R14: ffff8c1483a4a000 R15: 0000000000000004 + [ 584.355379] FS: 0000000000000000(0000) GS:ffff8c1586cc0000(0000) knlGS:0000000000000000 + [ 584.394419] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + [ 584.421123] CR2: 00007fe95a6f7840 CR3: 0000000107674002 CR4: 00000000000606e0 + [ 584.454888] Call Trace: + [ 584.466108] device_del+0xb2/0x3e0 + [ 584.481701] device_unregister+0x13/0x60 + [ 584.501306] bsg_unregister_queue+0x5b/0x80 + [ 584.522029] bsg_remove_queue+0x1c/0x40 + [ 584.541884] fc_rport_final_delete+0xf3/0x1d0 [scsi_transport_fc] + [ 584.573823] process_one_work+0x1e3/0x3b0 + [ 584.592396] worker_thread+0x50/0x3b0 + [ 584.609256] ? rescuer_thread+0x370/0x370 + [ 584.628877] kthread+0x149/0x170 + [ 584.643673] ? set_kthread_struct+0x40/0x40 + [ 584.662909] ret_from_fork+0x22/0x30 + [ 584.680002] ---[ end trace 53575ecefa942ece ]--- + +Link: https://lore.kernel.org/r/20220115040044.1013475-1-jmeneghi@redhat.com +Fixes: 0cbf32e1681d ("[SCSI] bnx2fc: Avoid calling bnx2fc_if_destroy with unnecessary locks") +Tested-by: Guangwu Zhang +Co-developed-by: Maurizio Lombardi +Signed-off-by: Maurizio Lombardi +Signed-off-by: John Meneghini +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 20 +++++--------------- + 1 file changed, 5 insertions(+), 15 deletions(-) + +diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +index 71fa62bd30830..9be273c320e21 100644 +--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c ++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +@@ -82,7 +82,7 @@ static int bnx2fc_bind_pcidev(struct bnx2fc_hba *hba); + static void bnx2fc_unbind_pcidev(struct bnx2fc_hba *hba); + static struct fc_lport *bnx2fc_if_create(struct bnx2fc_interface *interface, + struct device *parent, int npiv); +-static void bnx2fc_destroy_work(struct work_struct *work); ++static void bnx2fc_port_destroy(struct fcoe_port *port); + + static struct bnx2fc_hba *bnx2fc_hba_lookup(struct net_device *phys_dev); + static struct bnx2fc_interface *bnx2fc_interface_lookup(struct net_device +@@ -907,9 +907,6 @@ static void bnx2fc_indicate_netevent(void *context, unsigned long event, + __bnx2fc_destroy(interface); + } + mutex_unlock(&bnx2fc_dev_lock); +- +- /* Ensure ALL destroy work has been completed before return */ +- flush_workqueue(bnx2fc_wq); + return; + + default: +@@ -1215,8 +1212,8 @@ static int bnx2fc_vport_destroy(struct fc_vport *vport) + mutex_unlock(&n_port->lp_mutex); + bnx2fc_free_vport(interface->hba, port->lport); + bnx2fc_port_shutdown(port->lport); ++ bnx2fc_port_destroy(port); + bnx2fc_interface_put(interface); +- queue_work(bnx2fc_wq, &port->destroy_work); + return 0; + } + +@@ -1525,7 +1522,6 @@ static struct fc_lport *bnx2fc_if_create(struct bnx2fc_interface *interface, + port->lport = lport; + port->priv = interface; + port->get_netdev = bnx2fc_netdev; +- INIT_WORK(&port->destroy_work, bnx2fc_destroy_work); + + /* Configure fcoe_port */ + rc = bnx2fc_lport_config(lport); +@@ -1653,8 +1649,8 @@ static void __bnx2fc_destroy(struct bnx2fc_interface *interface) + bnx2fc_interface_cleanup(interface); + bnx2fc_stop(interface); + list_del(&interface->list); ++ bnx2fc_port_destroy(port); + bnx2fc_interface_put(interface); +- queue_work(bnx2fc_wq, &port->destroy_work); + } + + /** +@@ -1694,15 +1690,12 @@ netdev_err: + return rc; + } + +-static void bnx2fc_destroy_work(struct work_struct *work) ++static void bnx2fc_port_destroy(struct fcoe_port *port) + { +- struct fcoe_port *port; + struct fc_lport *lport; + +- port = container_of(work, struct fcoe_port, destroy_work); + lport = port->lport; +- +- BNX2FC_HBA_DBG(lport, "Entered bnx2fc_destroy_work\n"); ++ BNX2FC_HBA_DBG(lport, "Entered %s, destroying lport %p\n", __func__, lport); + + bnx2fc_if_destroy(lport); + } +@@ -2556,9 +2549,6 @@ static void bnx2fc_ulp_exit(struct cnic_dev *dev) + __bnx2fc_destroy(interface); + mutex_unlock(&bnx2fc_dev_lock); + +- /* Ensure ALL destroy work has been completed before return */ +- flush_workqueue(bnx2fc_wq); +- + bnx2fc_ulp_stop(hba); + /* unregister cnic device */ + if (test_and_clear_bit(BNX2FC_CNIC_REGISTERED, &hba->reg_with_cnic)) +-- +2.34.1 + diff --git a/queue-5.16/scsi-elx-efct-don-t-use-gfp_kernel-under-spin-lock.patch-21203 b/queue-5.16/scsi-elx-efct-don-t-use-gfp_kernel-under-spin-lock.patch-21203 new file mode 100644 index 00000000000..2d179462ac3 --- /dev/null +++ b/queue-5.16/scsi-elx-efct-don-t-use-gfp_kernel-under-spin-lock.patch-21203 @@ -0,0 +1,71 @@ +From c0fca68c54f9d8788e61eed769cf149df3b89128 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jan 2022 09:24:41 +0800 +Subject: scsi: elx: efct: Don't use GFP_KERNEL under spin lock + +From: Yang Yingliang + +[ Upstream commit 61263b3a11a2594b4e898f166c31162236182b5c ] + +GFP_KERNEL/GFP_DMA can't be used under a spin lock. According the comment, +els_ios_lock is used to protect els ios list so we can move down the spin +lock to avoid using this flag under the lock. + +Link: https://lore.kernel.org/r/20220111012441.3232527-1-yangyingliang@huawei.com +Fixes: 8f406ef72859 ("scsi: elx: libefc: Extended link Service I/O handling") +Reported-by: Hulk Robot +Reviewed-by: James Smart +Signed-off-by: Yang Yingliang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/elx/libefc/efc_els.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/elx/libefc/efc_els.c b/drivers/scsi/elx/libefc/efc_els.c +index 24db0accb256e..5f690378fe9a9 100644 +--- a/drivers/scsi/elx/libefc/efc_els.c ++++ b/drivers/scsi/elx/libefc/efc_els.c +@@ -46,18 +46,14 @@ efc_els_io_alloc_size(struct efc_node *node, u32 reqlen, u32 rsplen) + + efc = node->efc; + +- spin_lock_irqsave(&node->els_ios_lock, flags); +- + if (!node->els_io_enabled) { + efc_log_err(efc, "els io alloc disabled\n"); +- spin_unlock_irqrestore(&node->els_ios_lock, flags); + return NULL; + } + + els = mempool_alloc(efc->els_io_pool, GFP_ATOMIC); + if (!els) { + atomic_add_return(1, &efc->els_io_alloc_failed_count); +- spin_unlock_irqrestore(&node->els_ios_lock, flags); + return NULL; + } + +@@ -74,7 +70,6 @@ efc_els_io_alloc_size(struct efc_node *node, u32 reqlen, u32 rsplen) + &els->io.req.phys, GFP_DMA); + if (!els->io.req.virt) { + mempool_free(els, efc->els_io_pool); +- spin_unlock_irqrestore(&node->els_ios_lock, flags); + return NULL; + } + +@@ -94,10 +89,11 @@ efc_els_io_alloc_size(struct efc_node *node, u32 reqlen, u32 rsplen) + + /* add els structure to ELS IO list */ + INIT_LIST_HEAD(&els->list_entry); ++ spin_lock_irqsave(&node->els_ios_lock, flags); + list_add_tail(&els->list_entry, &node->els_ios_list); ++ spin_unlock_irqrestore(&node->els_ios_lock, flags); + } + +- spin_unlock_irqrestore(&node->els_ios_lock, flags); + return els; + } + +-- +2.34.1 + diff --git a/queue-5.16/selftests-mptcp-fix-ipv6-routing-setup.patch-4298 b/queue-5.16/selftests-mptcp-fix-ipv6-routing-setup.patch-4298 new file mode 100644 index 00000000000..32046bf7336 --- /dev/null +++ b/queue-5.16/selftests-mptcp-fix-ipv6-routing-setup.patch-4298 @@ -0,0 +1,60 @@ +From 3de4a260202204c05202f8fe1118cd7ac863e61f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jan 2022 16:35:29 -0800 +Subject: selftests: mptcp: fix ipv6 routing setup + +From: Paolo Abeni + +[ Upstream commit 9846921dba4936d92f7608315b5d1e0a8ec3a538 ] + +MPJ ipv6 selftests currently lack per link route to the server +net. Additionally, ipv6 subflows endpoints are created without any +interface specified. The end-result is that in ipv6 self-tests +subflows are created all on the same link, leading to expected delays +and sporadic self-tests failures. + +Fix the issue by adding the missing setup bits. + +Fixes: 523514ed0a99 ("selftests: mptcp: add ADD_ADDR IPv6 test cases") +Reported-and-tested-by: Geliang Tang +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/mptcp/mptcp_join.sh | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh +index bbafa4cf54538..d188ea0a5fc50 100755 +--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh ++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh +@@ -75,6 +75,7 @@ init() + + # let $ns2 reach any $ns1 address from any interface + ip -net "$ns2" route add default via 10.0.$i.1 dev ns2eth$i metric 10$i ++ ip -net "$ns2" route add default via dead:beef:$i::1 dev ns2eth$i metric 10$i + done + } + +@@ -1389,7 +1390,7 @@ ipv6_tests() + reset + ip netns exec $ns1 ./pm_nl_ctl limits 0 1 + ip netns exec $ns2 ./pm_nl_ctl limits 0 1 +- ip netns exec $ns2 ./pm_nl_ctl add dead:beef:3::2 flags subflow ++ ip netns exec $ns2 ./pm_nl_ctl add dead:beef:3::2 dev ns2eth3 flags subflow + run_tests $ns1 $ns2 dead:beef:1::1 0 0 0 slow + chk_join_nr "single subflow IPv6" 1 1 1 + +@@ -1424,7 +1425,7 @@ ipv6_tests() + ip netns exec $ns1 ./pm_nl_ctl limits 0 2 + ip netns exec $ns1 ./pm_nl_ctl add dead:beef:2::1 flags signal + ip netns exec $ns2 ./pm_nl_ctl limits 1 2 +- ip netns exec $ns2 ./pm_nl_ctl add dead:beef:3::2 flags subflow ++ ip netns exec $ns2 ./pm_nl_ctl add dead:beef:3::2 dev ns2eth3 flags subflow + run_tests $ns1 $ns2 dead:beef:1::1 0 -1 -1 slow + chk_join_nr "remove subflow and signal IPv6" 2 2 2 + chk_add_nr 1 1 +-- +2.34.1 + diff --git a/queue-5.16/series b/queue-5.16/series index 638810c4363..b94d15517b0 100644 --- a/queue-5.16/series +++ b/queue-5.16/series @@ -82,3 +82,189 @@ usb-typec-tcpci-don-t-touch-cc-line-if-it-s-vconn-source.patch usb-typec-tcpm-do-not-disconnect-while-receiving-vbus-off.patch usb-typec-tcpm-do-not-disconnect-when-receiving-vsafe0v.patch ucsi_ccg-check-dev_int-bit-only-when-starting-ccg4.patch +nfs-ensure-the-server-has-an-up-to-date-ctime-before.patch +nfs-ensure-the-server-has-an-up-to-date-ctime-before.patch-28400 +nfsv4-handle-case-where-the-lookup-of-a-directory-fa.patch +nfsv4-nfs_atomic_open-can-race-when-looking-up-a-non.patch +kvm-arm64-pkvm-use-the-mm_ops-indirection-for-cache-.patch +sunrpc-don-t-dereference-xprt-snd_task-if-it-s-a-coo.patch +powerpc64-bpf-limit-ldbrx-to-processors-compliant-wi.patch +netfilter-conntrack-don-t-increment-invalid-counter-.patch +rpmsg-char-fix-race-between-the-release-of-rpmsg_ctr.patch +rpmsg-char-fix-race-between-the-release-of-rpmsg_ept.patch +remoteproc-qcom-q6v5-fix-service-routines-build-erro.patch +powerpc-64s-mask-srr0-before-checking-against-the-ma.patch +perf-fix-perf_event_read_local-time.patch +sched-pelt-relax-the-sync-of-util_sum-with-util_avg.patch +arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabl.patch +net-fix-information-leakage-in-proc-net-ptype.patch +net-phy-broadcom-hook-up-soft_reset-for-bcm54616s.patch +ethtool-fix-link-extended-state-for-big-endian.patch +ipv6_tunnel-rate-limit-warning-messages.patch +net-stmmac-dwmac-visconti-fix-bit-definitions-for-et.patch +net-stmmac-dwmac-visconti-fix-clock-configuration-fo.patch +i40e-increase-delay-to-1-s-after-global-emp-reset.patch +i40e-fix-issue-when-maximum-queues-is-exceeded.patch +i40e-fix-queues-reservation-for-xdp.patch +i40e-fix-for-failed-to-init-adminq-while-vf-reset.patch +i40e-fix-unsigned-stat-widths.patch +phylib-fix-potential-use-after-free.patch +ipv6-annotate-accesses-to-fn-fn_sernum.patch +mptcp-allow-changing-the-backup-bit-by-endpoint-id.patch +mptcp-clean-up-harmless-false-expressions.patch +mptcp-keep-track-of-local-endpoint-still-available-f.patch +mptcp-fix-msk-traversal-in-mptcp_nl_cmd_set_flags.patch +mptcp-fix-removing-ids-bitmap-setting.patch +selftests-mptcp-fix-ipv6-routing-setup.patch +octeontx2-af-do-not-fixup-all-vf-action-entries.patch +octeontx2-af-fix-lbk-backpressure-id-count.patch +octeontx2-af-retry-until-rvu-block-reset-complete.patch +octeontx2-af-cn10k-use-appropriate-register-for-lmac.patch +octeontx2-pf-cn10k-ensure-valid-pointers-are-freed-t.patch +octeontx2-af-increase-link-credit-restore-polling-ti.patch +octeontx2-af-cn10k-do-not-enable-rpm-loopback-for-lp.patch +octeontx2-pf-forward-error-codes-to-vf.patch +octeontx2-af-add-kpu-changes-to-parse-ngio-as-separa.patch +rxrpc-adjust-retransmission-backoff.patch +efi-libstub-arm64-fix-image-check-alignment-at-entry.patch +io_uring-fix-bug-in-slow-unregistering-of-nodes.patch +block-fix-memory-leak-in-disk_register_independent_a.patch +drivers-hv-balloon-account-for-vmbus-packet-header-i.patch +hwmon-lm90-reduce-maximum-conversion-rate-for-g781.patch +hwmon-lm90-re-enable-interrupts-after-alert-clears.patch +hwmon-lm90-mark-alert-as-broken-for-max6654.patch +hwmon-lm90-mark-alert-as-broken-for-max6680.patch +hwmon-lm90-mark-alert-as-broken-for-max6646-6647-664.patch +hwmon-lm90-fix-sysfs-and-udev-notifications.patch +hwmon-adt7470-prevent-divide-by-zero-in-adt7470_fan_.patch +powerpc-perf-fix-power_pmu_disable-to-call-clear_pmi.patch +net-procfs-show-net-devices-bound-packet-types.patch +ipv4-fix-ip-option-filtering-for-locally-generated-f.patch +ibmvnic-allow-extra-failures-before-disabling.patch +ibmvnic-init-running_cap_crqs-early.patch +ibmvnic-don-t-spin-in-tasklet.patch +net-smc-transitional-solution-for-clcsock-race-issue.patch +ping-fix-the-sk_bound_dev_if-match-in-ping_lookup.patch +video-hyperv_fb-fix-validation-of-screen-resolution.patch +can-tcan4x5x-regmap-fix-max-register-value.patch +hwmon-nct6775-fix-crash-in-clear_caseopen.patch +drm-msm-dsi-fix-missing-put_device-call-in-dsi_get_p.patch +drm-msm-hdmi-fix-missing-put_device-call-in-msm_hdmi.patch +drm-msm-dpu-invalid-parameter-check-in-dpu_setup_dsp.patch +drm-msm-fix-wrong-size-calculation.patch +drm-msm-a6xx-add-missing-suspend_count-increment.patch +drm-msm-dsi-invalid-parameter-check-in-msm_dsi_phy_e.patch +scsi-elx-efct-don-t-use-gfp_kernel-under-spin-lock.patch +scsi-bnx2fc-flush-destroy_work-queue-before-calling-.patch +yam-fix-a-memory-leak-in-yam_siocdevprivate.patch +net-cpsw-properly-initialise-struct-page_pool_params.patch +net-hns3-handle-empty-unknown-interrupt-for-vf.patch +kvm-selftests-re-enable-access_tracking_perf_test.patch +usb-roles-fix-include-linux-usb-role.h-compile-issue.patch +drm-amd-display-dc-calcs-dce_calcs-fix-a-memleak-in-.patch +sch_htb-fail-on-unsupported-parameters-when-offload-.patch +revert-drm-ast-support-1600x900-with-108mhz-pclk.patch +kvm-selftests-don-t-skip-l2-s-vmcall-in-smm-test-for.patch +ceph-put-the-requests-sessions-when-it-fails-to-allo.patch +ata-pata_platform-fix-a-null-pointer-dereference-in-.patch +gve-fix-gfp-flags-when-allocing-pages.patch +revert-ipv6-honor-all-ipv6-pio-valid-lifetime-values.patch +net-bridge-vlan-fix-single-net-device-option-dumping.patch +ipv4-raw-lock-the-socket-in-raw_bind.patch +ipv4-tcp-send-zero-ipid-in-synack-messages.patch +ipv4-avoid-using-shared-ip-generator-for-connected-s.patch +ipv4-remove-sparse-error-in-ip_neigh_gw4.patch +net-bridge-vlan-fix-memory-leak-in-__allowed_ingress.patch +nfs-ensure-the-server-has-an-up-to-date-ctime-before.patch-14919 +nfs-ensure-the-server-has-an-up-to-date-ctime-before.patch-13548 +nfsv4-handle-case-where-the-lookup-of-a-directory-fa.patch-32762 +nfsv4-nfs_atomic_open-can-race-when-looking-up-a-non.patch-311 +kvm-arm64-pkvm-use-the-mm_ops-indirection-for-cache-.patch-28328 +sunrpc-don-t-dereference-xprt-snd_task-if-it-s-a-coo.patch-4302 +powerpc64-bpf-limit-ldbrx-to-processors-compliant-wi.patch-17391 +netfilter-conntrack-don-t-increment-invalid-counter-.patch-26784 +rpmsg-char-fix-race-between-the-release-of-rpmsg_ctr.patch-551 +rpmsg-char-fix-race-between-the-release-of-rpmsg_ept.patch-8103 +remoteproc-qcom-q6v5-fix-service-routines-build-erro.patch-12912 +powerpc-64s-mask-srr0-before-checking-against-the-ma.patch-26130 +perf-fix-perf_event_read_local-time.patch-6284 +sched-pelt-relax-the-sync-of-util_sum-with-util_avg.patch-619 +arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabl.patch-490 +net-fix-information-leakage-in-proc-net-ptype.patch-29118 +net-phy-broadcom-hook-up-soft_reset-for-bcm54616s.patch-8413 +ethtool-fix-link-extended-state-for-big-endian.patch-18835 +ipv6_tunnel-rate-limit-warning-messages.patch-22703 +net-stmmac-dwmac-visconti-fix-bit-definitions-for-et.patch-15977 +net-stmmac-dwmac-visconti-fix-clock-configuration-fo.patch-10364 +i40e-increase-delay-to-1-s-after-global-emp-reset.patch-32655 +i40e-fix-issue-when-maximum-queues-is-exceeded.patch-11503 +i40e-fix-queues-reservation-for-xdp.patch-4884 +i40e-fix-for-failed-to-init-adminq-while-vf-reset.patch-18848 +i40e-fix-unsigned-stat-widths.patch-11673 +phylib-fix-potential-use-after-free.patch-4894 +ipv6-annotate-accesses-to-fn-fn_sernum.patch-15640 +mptcp-allow-changing-the-backup-bit-by-endpoint-id.patch-27797 +mptcp-clean-up-harmless-false-expressions.patch-23285 +mptcp-keep-track-of-local-endpoint-still-available-f.patch-10692 +mptcp-fix-msk-traversal-in-mptcp_nl_cmd_set_flags.patch-4074 +mptcp-fix-removing-ids-bitmap-setting.patch-8263 +selftests-mptcp-fix-ipv6-routing-setup.patch-4298 +octeontx2-af-do-not-fixup-all-vf-action-entries.patch-25054 +octeontx2-af-fix-lbk-backpressure-id-count.patch-21119 +octeontx2-af-retry-until-rvu-block-reset-complete.patch-12707 +octeontx2-af-cn10k-use-appropriate-register-for-lmac.patch-4264 +octeontx2-pf-cn10k-ensure-valid-pointers-are-freed-t.patch-5484 +octeontx2-af-increase-link-credit-restore-polling-ti.patch-12708 +octeontx2-af-cn10k-do-not-enable-rpm-loopback-for-lp.patch-3928 +octeontx2-pf-forward-error-codes-to-vf.patch-3356 +octeontx2-af-add-kpu-changes-to-parse-ngio-as-separa.patch-20656 +rxrpc-adjust-retransmission-backoff.patch-4735 +efi-libstub-arm64-fix-image-check-alignment-at-entry.patch-10252 +io_uring-fix-bug-in-slow-unregistering-of-nodes.patch-12857 +block-fix-memory-leak-in-disk_register_independent_a.patch-1118 +drivers-hv-balloon-account-for-vmbus-packet-header-i.patch-13116 +hwmon-lm90-reduce-maximum-conversion-rate-for-g781.patch-12001 +hwmon-lm90-re-enable-interrupts-after-alert-clears.patch-20612 +hwmon-lm90-mark-alert-as-broken-for-max6654.patch-7376 +hwmon-lm90-mark-alert-as-broken-for-max6680.patch-6352 +hwmon-lm90-mark-alert-as-broken-for-max6646-6647-664.patch-25810 +hwmon-lm90-fix-sysfs-and-udev-notifications.patch-1586 +hwmon-adt7470-prevent-divide-by-zero-in-adt7470_fan_.patch-11929 +powerpc-perf-fix-power_pmu_disable-to-call-clear_pmi.patch-12087 +net-procfs-show-net-devices-bound-packet-types.patch-19867 +ipv4-fix-ip-option-filtering-for-locally-generated-f.patch-20660 +ibmvnic-allow-extra-failures-before-disabling.patch-5412 +ibmvnic-init-running_cap_crqs-early.patch-9731 +ibmvnic-don-t-spin-in-tasklet.patch-21382 +net-smc-transitional-solution-for-clcsock-race-issue.patch-3308 +ping-fix-the-sk_bound_dev_if-match-in-ping_lookup.patch-12227 +video-hyperv_fb-fix-validation-of-screen-resolution.patch-6696 +can-tcan4x5x-regmap-fix-max-register-value.patch-2062 +hwmon-nct6775-fix-crash-in-clear_caseopen.patch-28716 +drm-msm-dsi-fix-missing-put_device-call-in-dsi_get_p.patch-32603 +drm-msm-hdmi-fix-missing-put_device-call-in-msm_hdmi.patch-25966 +drm-msm-dpu-invalid-parameter-check-in-dpu_setup_dsp.patch-7879 +drm-msm-fix-wrong-size-calculation.patch-5782 +drm-msm-a6xx-add-missing-suspend_count-increment.patch-12892 +drm-msm-dsi-invalid-parameter-check-in-msm_dsi_phy_e.patch-19238 +scsi-elx-efct-don-t-use-gfp_kernel-under-spin-lock.patch-21203 +scsi-bnx2fc-flush-destroy_work-queue-before-calling-.patch-6652 +yam-fix-a-memory-leak-in-yam_siocdevprivate.patch-12557 +net-cpsw-properly-initialise-struct-page_pool_params.patch-1670 +net-hns3-handle-empty-unknown-interrupt-for-vf.patch-12360 +kvm-selftests-re-enable-access_tracking_perf_test.patch-24698 +usb-roles-fix-include-linux-usb-role.h-compile-issue.patch-783 +drm-amd-display-dc-calcs-dce_calcs-fix-a-memleak-in-.patch-32654 +sch_htb-fail-on-unsupported-parameters-when-offload-.patch-24755 +revert-drm-ast-support-1600x900-with-108mhz-pclk.patch-18660 +kvm-selftests-don-t-skip-l2-s-vmcall-in-smm-test-for.patch-6280 +ceph-put-the-requests-sessions-when-it-fails-to-allo.patch-1486 +ata-pata_platform-fix-a-null-pointer-dereference-in-.patch-13236 +gve-fix-gfp-flags-when-allocing-pages.patch-12328 +revert-ipv6-honor-all-ipv6-pio-valid-lifetime-values.patch-25170 +net-bridge-vlan-fix-single-net-device-option-dumping.patch-17660 +ipv4-raw-lock-the-socket-in-raw_bind.patch-29357 +ipv4-tcp-send-zero-ipid-in-synack-messages.patch-9420 +ipv4-avoid-using-shared-ip-generator-for-connected-s.patch-8646 +ipv4-remove-sparse-error-in-ip_neigh_gw4.patch-21843 +net-bridge-vlan-fix-memory-leak-in-__allowed_ingress.patch-11369 diff --git a/queue-5.16/sunrpc-don-t-dereference-xprt-snd_task-if-it-s-a-coo.patch-4302 b/queue-5.16/sunrpc-don-t-dereference-xprt-snd_task-if-it-s-a-coo.patch-4302 new file mode 100644 index 00000000000..06a7d3ede24 --- /dev/null +++ b/queue-5.16/sunrpc-don-t-dereference-xprt-snd_task-if-it-s-a-coo.patch-4302 @@ -0,0 +1,63 @@ +From e388df98907a64456f538a3c6a0646b31677b77b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jan 2022 12:20:36 -0500 +Subject: SUNRPC: Don't dereference xprt->snd_task if it's a cookie + +From: Chuck Lever + +[ Upstream commit aed28b7a2d620cb5cd0c554cb889075c02e25e8e ] + +Fixes: e26d9972720e ("SUNRPC: Clean up scheduling of autoclose") +Signed-off-by: Chuck Lever +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + include/trace/events/sunrpc.h | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h +index 7b5dcff84cf27..54eb1654d9ecc 100644 +--- a/include/trace/events/sunrpc.h ++++ b/include/trace/events/sunrpc.h +@@ -953,7 +953,8 @@ TRACE_EVENT(rpc_socket_nospace, + { BIT(XPRT_REMOVE), "REMOVE" }, \ + { BIT(XPRT_CONGESTED), "CONGESTED" }, \ + { BIT(XPRT_CWND_WAIT), "CWND_WAIT" }, \ +- { BIT(XPRT_WRITE_SPACE), "WRITE_SPACE" }) ++ { BIT(XPRT_WRITE_SPACE), "WRITE_SPACE" }, \ ++ { BIT(XPRT_SND_IS_COOKIE), "SND_IS_COOKIE" }) + + DECLARE_EVENT_CLASS(rpc_xprt_lifetime_class, + TP_PROTO( +@@ -1150,8 +1151,11 @@ DECLARE_EVENT_CLASS(xprt_writelock_event, + __entry->task_id = -1; + __entry->client_id = -1; + } +- __entry->snd_task_id = xprt->snd_task ? +- xprt->snd_task->tk_pid : -1; ++ if (xprt->snd_task && ++ !test_bit(XPRT_SND_IS_COOKIE, &xprt->state)) ++ __entry->snd_task_id = xprt->snd_task->tk_pid; ++ else ++ __entry->snd_task_id = -1; + ), + + TP_printk(SUNRPC_TRACE_TASK_SPECIFIER +@@ -1196,8 +1200,12 @@ DECLARE_EVENT_CLASS(xprt_cong_event, + __entry->task_id = -1; + __entry->client_id = -1; + } +- __entry->snd_task_id = xprt->snd_task ? +- xprt->snd_task->tk_pid : -1; ++ if (xprt->snd_task && ++ !test_bit(XPRT_SND_IS_COOKIE, &xprt->state)) ++ __entry->snd_task_id = xprt->snd_task->tk_pid; ++ else ++ __entry->snd_task_id = -1; ++ + __entry->cong = xprt->cong; + __entry->cwnd = xprt->cwnd; + __entry->wait = test_bit(XPRT_CWND_WAIT, &xprt->state); +-- +2.34.1 + diff --git a/queue-5.16/usb-roles-fix-include-linux-usb-role.h-compile-issue.patch-783 b/queue-5.16/usb-roles-fix-include-linux-usb-role.h-compile-issue.patch-783 new file mode 100644 index 00000000000..2b6e7c5efe6 --- /dev/null +++ b/queue-5.16/usb-roles-fix-include-linux-usb-role.h-compile-issue.patch-783 @@ -0,0 +1,41 @@ +From 81f55976e9ea9db03d5cd88c7f79841217a3577e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jan 2022 20:43:28 +0800 +Subject: usb: roles: fix include/linux/usb/role.h compile issue + +From: Linyu Yuan + +[ Upstream commit 945c37ed564770c78dfe6b9f08bed57a1b4e60ef ] + +when CONFIG_USB_ROLE_SWITCH is not defined, +add usb_role_switch_find_by_fwnode() definition which return NULL. + +Fixes: c6919d5e0cd1 ("usb: roles: Add usb_role_switch_find_by_fwnode()") +Signed-off-by: Linyu Yuan +Link: https://lore.kernel.org/r/1641818608-25039-1-git-send-email-quic_linyyuan@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + include/linux/usb/role.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/include/linux/usb/role.h b/include/linux/usb/role.h +index 031f148ab3734..b5deafd91f67b 100644 +--- a/include/linux/usb/role.h ++++ b/include/linux/usb/role.h +@@ -91,6 +91,12 @@ fwnode_usb_role_switch_get(struct fwnode_handle *node) + + static inline void usb_role_switch_put(struct usb_role_switch *sw) { } + ++static inline struct usb_role_switch * ++usb_role_switch_find_by_fwnode(const struct fwnode_handle *fwnode) ++{ ++ return NULL; ++} ++ + static inline struct usb_role_switch * + usb_role_switch_register(struct device *parent, + const struct usb_role_switch_desc *desc) +-- +2.34.1 + diff --git a/queue-5.16/video-hyperv_fb-fix-validation-of-screen-resolution.patch-6696 b/queue-5.16/video-hyperv_fb-fix-validation-of-screen-resolution.patch-6696 new file mode 100644 index 00000000000..298e5ccb46d --- /dev/null +++ b/queue-5.16/video-hyperv_fb-fix-validation-of-screen-resolution.patch-6696 @@ -0,0 +1,99 @@ +From fa2f3241ed151ee05e6b8ddb070f18a1b77f46ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Jan 2022 11:18:31 -0800 +Subject: video: hyperv_fb: Fix validation of screen resolution + +From: Michael Kelley + +[ Upstream commit 9ff5549b1d1d3c3a9d71220d44bd246586160f1d ] + +In the WIN10 version of the Synthetic Video protocol with Hyper-V, +Hyper-V reports a list of supported resolutions as part of the protocol +negotiation. The driver calculates the maximum width and height from +the list of resolutions, and uses those maximums to validate any screen +resolution specified in the video= option on the kernel boot line. + +This method of validation is incorrect. For example, the list of +supported resolutions could contain 1600x1200 and 1920x1080, both of +which fit in an 8 Mbyte frame buffer. But calculating the max width +and height yields 1920 and 1200, and 1920x1200 resolution does not fit +in an 8 Mbyte frame buffer. Unfortunately, this resolution is accepted, +causing a kernel fault when the driver accesses memory outside the +frame buffer. + +Instead, validate the specified screen resolution by calculating +its size, and comparing against the frame buffer size. Delete the +code for calculating the max width and height from the list of +resolutions, since these max values have no use. Also add the +frame buffer size to the info message to aid in understanding why +a resolution might be rejected. + +Fixes: 67e7cdb4829d ("video: hyperv: hyperv_fb: Obtain screen resolution from Hyper-V host") +Signed-off-by: Michael Kelley +Reviewed-by: Haiyang Zhang +Acked-by: Helge Deller +Link: https://lore.kernel.org/r/1642360711-2335-1-git-send-email-mikelley@microsoft.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/hyperv_fb.c | 16 +++------------- + 1 file changed, 3 insertions(+), 13 deletions(-) + +diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c +index 23999df527393..c8e0ea27caf1d 100644 +--- a/drivers/video/fbdev/hyperv_fb.c ++++ b/drivers/video/fbdev/hyperv_fb.c +@@ -287,8 +287,6 @@ struct hvfb_par { + + static uint screen_width = HVFB_WIDTH; + static uint screen_height = HVFB_HEIGHT; +-static uint screen_width_max = HVFB_WIDTH; +-static uint screen_height_max = HVFB_HEIGHT; + static uint screen_depth; + static uint screen_fb_size; + static uint dio_fb_size; /* FB size for deferred IO */ +@@ -582,7 +580,6 @@ static int synthvid_get_supported_resolution(struct hv_device *hdev) + int ret = 0; + unsigned long t; + u8 index; +- int i; + + memset(msg, 0, sizeof(struct synthvid_msg)); + msg->vid_hdr.type = SYNTHVID_RESOLUTION_REQUEST; +@@ -613,13 +610,6 @@ static int synthvid_get_supported_resolution(struct hv_device *hdev) + goto out; + } + +- for (i = 0; i < msg->resolution_resp.resolution_count; i++) { +- screen_width_max = max_t(unsigned int, screen_width_max, +- msg->resolution_resp.supported_resolution[i].width); +- screen_height_max = max_t(unsigned int, screen_height_max, +- msg->resolution_resp.supported_resolution[i].height); +- } +- + screen_width = + msg->resolution_resp.supported_resolution[index].width; + screen_height = +@@ -941,7 +931,7 @@ static void hvfb_get_option(struct fb_info *info) + + if (x < HVFB_WIDTH_MIN || y < HVFB_HEIGHT_MIN || + (synthvid_ver_ge(par->synthvid_version, SYNTHVID_VERSION_WIN10) && +- (x > screen_width_max || y > screen_height_max)) || ++ (x * y * screen_depth / 8 > screen_fb_size)) || + (par->synthvid_version == SYNTHVID_VERSION_WIN8 && + x * y * screen_depth / 8 > SYNTHVID_FB_SIZE_WIN8) || + (par->synthvid_version == SYNTHVID_VERSION_WIN7 && +@@ -1194,8 +1184,8 @@ static int hvfb_probe(struct hv_device *hdev, + } + + hvfb_get_option(info); +- pr_info("Screen resolution: %dx%d, Color depth: %d\n", +- screen_width, screen_height, screen_depth); ++ pr_info("Screen resolution: %dx%d, Color depth: %d, Frame buffer size: %d\n", ++ screen_width, screen_height, screen_depth, screen_fb_size); + + ret = hvfb_getmem(hdev, info); + if (ret) { +-- +2.34.1 + diff --git a/queue-5.16/yam-fix-a-memory-leak-in-yam_siocdevprivate.patch-12557 b/queue-5.16/yam-fix-a-memory-leak-in-yam_siocdevprivate.patch-12557 new file mode 100644 index 00000000000..a5f5ee354d4 --- /dev/null +++ b/queue-5.16/yam-fix-a-memory-leak-in-yam_siocdevprivate.patch-12557 @@ -0,0 +1,37 @@ +From ec55532bf3cb0a9896e36faaf336a8311d816816 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jan 2022 11:29:54 +0800 +Subject: yam: fix a memory leak in yam_siocdevprivate() + +From: Hangyu Hua + +[ Upstream commit 29eb31542787e1019208a2e1047bb7c76c069536 ] + +ym needs to be free when ym->cmd != SIOCYAMSMCS. + +Fixes: 0781168e23a2 ("yam: fix a missing-check bug") +Signed-off-by: Hangyu Hua +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/hamradio/yam.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c +index 6376b8485976c..980f2be32f05a 100644 +--- a/drivers/net/hamradio/yam.c ++++ b/drivers/net/hamradio/yam.c +@@ -950,9 +950,7 @@ static int yam_siocdevprivate(struct net_device *dev, struct ifreq *ifr, void __ + ym = memdup_user(data, sizeof(struct yamdrv_ioctl_mcs)); + if (IS_ERR(ym)) + return PTR_ERR(ym); +- if (ym->cmd != SIOCYAMSMCS) +- return -EINVAL; +- if (ym->bitrate > YAM_MAXBITRATE) { ++ if (ym->cmd != SIOCYAMSMCS || ym->bitrate > YAM_MAXBITRATE) { + kfree(ym); + return -EINVAL; + } +-- +2.34.1 + -- 2.47.2