From 0db151cf4383e4ca5693557aeeef694ded72c755 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sat, 6 Jan 2024 20:58:51 -0500 Subject: [PATCH] Fixes for 5.15 Signed-off-by: Sasha Levin --- ...x-array-index-out-of-bounds-read-in-.patch | 64 +++++ ...x-add-check-for-usbnet_get_endpoints.patch | 38 +++ ...ix-error-handler-with-pm_runtime_ena.patch | 65 +++++ ...n-g12a-toacodec-fix-event-generation.patch | 39 +++ ...toacodec-validate-written-enum-value.patch | 40 +++ ...tohdmitx-fix-event-generation-for-s-.patch | 39 +++ ...tohdmitx-validate-written-enum-value.patch | 50 ++++ ...is-applied-code-from-bnxt_cfg_ntp_fi.patch | 47 +++ .../can-raw-add-support-for-so_mark.patch | 36 +++ ...add-support-for-so_txtime-scm_txtime.patch | 63 ++++ ...65dsi86-never-store-more-than-msg-si.patch | 55 ++++ ...passing-the-correct-dpcd_rev-for-drm.patch | 42 +++ ...input-checks-to-prevent-config-with-.patch | 53 ++++ ...e-after-free-in-i40e_aqc_add_filters.patch | 120 ++++++++ ...tore-vf-msi-x-state-during-pci-reset.patch | 104 +++++++ .../igc-check-vlan-ethertype-mask.patch | 72 +++++ queue-5.15/igc-check-vlan-tci-mask.patch | 141 +++++++++ queue-5.15/igc-fix-hicredit-calculation.patch | 45 +++ ...vlan-ethertype-matching-back-to-user.patch | 75 +++++ ...ge-fix-receive-packet-race-condition.patch | 63 ++++ ...e-check-the-mapcount-of-the-precise-.patch | 54 ++++ ...-fcs-generation-for-fragmented-skbuf.patch | 46 +++ ...ssing-getsockopt-so_timestamping_new.patch | 60 ++++ ...ssing-so_timestamping_new-cmsg-suppo.patch | 40 +++ ...potential-memleak-in-ql_alloc_buffer.patch | 44 +++ ...-restore-msg_namelen-in-sock_sendmsg.patch | 55 ++++ ...t-fix-possible-memory-leak-in-em_tex.patch | 40 +++ ...tend-sof_timestamping_opt_id-to-hw-t.patch | 52 ++++ ...mediate-drop-chain-reference-counter.patch | 36 +++ ...ld-a-ref-to-llcp_local-dev-when-hold.patch | 128 +++++++++ ...ays-configure-nix-tx-link-credits-ba.patch | 184 ++++++++++++ ...don-t-enable-pause-frames-by-default.patch | 270 ++++++++++++++++++ ...-marking-couple-of-structure-as-__pa.patch | 46 +++ ...enable-mac-tx-in-otx2_stop-processin.patch | 93 ++++++ ...t-nix-link-credits-based-on-max-lmac.patch | 252 ++++++++++++++++ ...r8169-fix-pci-error-on-system-resume.patch | 49 ++++ ...mem-floor-the-memory-size-to-the-mul.patch | 56 ++++ queue-5.15/series | 39 +++ ...double-free-bug-in-efx_probe_filters.patch | 51 ++++ ...pcie-don-t-synchronize-irqs-from-irq.patch | 170 +++++++++++ 40 files changed, 3016 insertions(+) create mode 100644 queue-5.15/arm-sun9i-smp-fix-array-index-out-of-bounds-read-in-.patch create mode 100644 queue-5.15/asix-add-check-for-usbnet_get_endpoints.patch create mode 100644 queue-5.15/asoc-fsl_rpmsg-fix-error-handler-with-pm_runtime_ena.patch create mode 100644 queue-5.15/asoc-meson-g12a-toacodec-fix-event-generation.patch create mode 100644 queue-5.15/asoc-meson-g12a-toacodec-validate-written-enum-value.patch create mode 100644 queue-5.15/asoc-meson-g12a-tohdmitx-fix-event-generation-for-s-.patch create mode 100644 queue-5.15/asoc-meson-g12a-tohdmitx-validate-written-enum-value.patch create mode 100644 queue-5.15/bnxt_en-remove-mis-applied-code-from-bnxt_cfg_ntp_fi.patch create mode 100644 queue-5.15/can-raw-add-support-for-so_mark.patch create mode 100644 queue-5.15/can-raw-add-support-for-so_txtime-scm_txtime.patch create mode 100644 queue-5.15/drm-bridge-ti-sn65dsi86-never-store-more-than-msg-si.patch create mode 100644 queue-5.15/drm-i915-dp-fix-passing-the-correct-dpcd_rev-for-drm.patch create mode 100644 queue-5.15/i40e-fix-filter-input-checks-to-prevent-config-with-.patch create mode 100644 queue-5.15/i40e-fix-use-after-free-in-i40e_aqc_add_filters.patch create mode 100644 queue-5.15/i40e-restore-vf-msi-x-state-during-pci-reset.patch create mode 100644 queue-5.15/igc-check-vlan-ethertype-mask.patch create mode 100644 queue-5.15/igc-check-vlan-tci-mask.patch create mode 100644 queue-5.15/igc-fix-hicredit-calculation.patch create mode 100644 queue-5.15/igc-report-vlan-ethertype-matching-back-to-user.patch create mode 100644 queue-5.15/mlxbf_gige-fix-receive-packet-race-condition.patch create mode 100644 queue-5.15/mm-memory-failure-check-the-mapcount-of-the-precise-.patch create mode 100644 queue-5.15/net-bcmgenet-fix-fcs-generation-for-fragmented-skbuf.patch create mode 100644 queue-5.15/net-implement-missing-getsockopt-so_timestamping_new.patch create mode 100644 queue-5.15/net-implement-missing-so_timestamping_new-cmsg-suppo.patch create mode 100644 queue-5.15/net-qla3xxx-fix-potential-memleak-in-ql_alloc_buffer.patch create mode 100644 queue-5.15/net-save-and-restore-msg_namelen-in-sock_sendmsg.patch create mode 100644 queue-5.15/net-sched-em_text-fix-possible-memory-leak-in-em_tex.patch create mode 100644 queue-5.15/net-timestamp-extend-sof_timestamping_opt_id-to-hw-t.patch create mode 100644 queue-5.15/netfilter-nft_immediate-drop-chain-reference-counter.patch create mode 100644 queue-5.15/nfc-llcp_core-hold-a-ref-to-llcp_local-dev-when-hold.patch create mode 100644 queue-5.15/octeontx2-af-always-configure-nix-tx-link-credits-ba.patch create mode 100644 queue-5.15/octeontx2-af-don-t-enable-pause-frames-by-default.patch create mode 100644 queue-5.15/octeontx2-af-fix-marking-couple-of-structure-as-__pa.patch create mode 100644 queue-5.15/octeontx2-af-re-enable-mac-tx-in-otx2_stop-processin.patch create mode 100644 queue-5.15/octeontx2-af-set-nix-link-credits-based-on-max-lmac.patch create mode 100644 queue-5.15/r8169-fix-pci-error-on-system-resume.patch create mode 100644 queue-5.15/selftests-secretmem-floor-the-memory-size-to-the-mul.patch create mode 100644 queue-5.15/sfc-fix-a-double-free-bug-in-efx_probe_filters.patch create mode 100644 queue-5.15/wifi-iwlwifi-pcie-don-t-synchronize-irqs-from-irq.patch diff --git a/queue-5.15/arm-sun9i-smp-fix-array-index-out-of-bounds-read-in-.patch b/queue-5.15/arm-sun9i-smp-fix-array-index-out-of-bounds-read-in-.patch new file mode 100644 index 00000000000..a4e33fba6e5 --- /dev/null +++ b/queue-5.15/arm-sun9i-smp-fix-array-index-out-of-bounds-read-in-.patch @@ -0,0 +1,64 @@ +From a1d4c1ec2a7bd2d54dfa6da22f3ed46fb4dc2021 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Dec 2023 20:39:02 +0100 +Subject: ARM: sun9i: smp: Fix array-index-out-of-bounds read in + sunxi_mc_smp_init + +From: Stefan Wahren + +[ Upstream commit 72ad3b772b6d393701df58ba1359b0bb346a19ed ] + +Running a multi-arch kernel (multi_v7_defconfig) on a Raspberry Pi 3B+ +with enabled CONFIG_UBSAN triggers the following warning: + + UBSAN: array-index-out-of-bounds in arch/arm/mach-sunxi/mc_smp.c:810:29 + index 2 is out of range for type 'sunxi_mc_smp_data [2]' + CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc6-00248-g5254c0cbc92d + Hardware name: BCM2835 + unwind_backtrace from show_stack+0x10/0x14 + show_stack from dump_stack_lvl+0x40/0x4c + dump_stack_lvl from ubsan_epilogue+0x8/0x34 + ubsan_epilogue from __ubsan_handle_out_of_bounds+0x78/0x80 + __ubsan_handle_out_of_bounds from sunxi_mc_smp_init+0xe4/0x4cc + sunxi_mc_smp_init from do_one_initcall+0xa0/0x2fc + do_one_initcall from kernel_init_freeable+0xf4/0x2f4 + kernel_init_freeable from kernel_init+0x18/0x158 + kernel_init from ret_from_fork+0x14/0x28 + +Since the enabled method couldn't match with any entry from +sunxi_mc_smp_data, the value of the index shouldn't be used right after +the loop. So move it after the check of ret in order to have a valid +index. + +Fixes: 1631090e34f5 ("ARM: sun9i: smp: Add is_a83t field") +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20231228193903.9078-1-wahrenst@gmx.net +Reviewed-by: Chen-Yu Tsai +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-sunxi/mc_smp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mach-sunxi/mc_smp.c b/arch/arm/mach-sunxi/mc_smp.c +index 26cbce1353387..b2f5f4f28705f 100644 +--- a/arch/arm/mach-sunxi/mc_smp.c ++++ b/arch/arm/mach-sunxi/mc_smp.c +@@ -808,12 +808,12 @@ static int __init sunxi_mc_smp_init(void) + break; + } + +- is_a83t = sunxi_mc_smp_data[i].is_a83t; +- + of_node_put(node); + if (ret) + return -ENODEV; + ++ is_a83t = sunxi_mc_smp_data[i].is_a83t; ++ + if (!sunxi_mc_smp_cpu_table_init()) + return -EINVAL; + +-- +2.43.0 + diff --git a/queue-5.15/asix-add-check-for-usbnet_get_endpoints.patch b/queue-5.15/asix-add-check-for-usbnet_get_endpoints.patch new file mode 100644 index 00000000000..49dfd5dc64d --- /dev/null +++ b/queue-5.15/asix-add-check-for-usbnet_get_endpoints.patch @@ -0,0 +1,38 @@ +From de304613832ddd6bacde385c1221840e77afb5b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 03:35:34 +0000 +Subject: asix: Add check for usbnet_get_endpoints + +From: Chen Ni + +[ Upstream commit eaac6a2d26b65511e164772bec6918fcbc61938e ] + +Add check for usbnet_get_endpoints() and return the error if it fails +in order to transfer the error. + +Fixes: 16626b0cc3d5 ("asix: Add a new driver for the AX88172A") +Signed-off-by: Chen Ni +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/ax88172a.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c +index d9777d9a7c5df..bc6c8c253911b 100644 +--- a/drivers/net/usb/ax88172a.c ++++ b/drivers/net/usb/ax88172a.c +@@ -161,7 +161,9 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf) + u8 buf[ETH_ALEN]; + struct ax88172a_private *priv; + +- usbnet_get_endpoints(dev, intf); ++ ret = usbnet_get_endpoints(dev, intf); ++ if (ret) ++ return ret; + + priv = kzalloc(sizeof(*priv), GFP_KERNEL); + if (!priv) +-- +2.43.0 + diff --git a/queue-5.15/asoc-fsl_rpmsg-fix-error-handler-with-pm_runtime_ena.patch b/queue-5.15/asoc-fsl_rpmsg-fix-error-handler-with-pm_runtime_ena.patch new file mode 100644 index 00000000000..82d3130aa55 --- /dev/null +++ b/queue-5.15/asoc-fsl_rpmsg-fix-error-handler-with-pm_runtime_ena.patch @@ -0,0 +1,65 @@ +From f9f5487e0e6b3cf6fa1cb15cce391f0132172baf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Dec 2023 17:06:08 +0900 +Subject: ASoC: fsl_rpmsg: Fix error handler with pm_runtime_enable + +From: Chancel Liu + +[ Upstream commit f9d378fc68c43fd41b35133edec9cd902ec334ec ] + +There is error message when defer probe happens: + +fsl_rpmsg rpmsg_audio: Unbalanced pm_runtime_enable! + +Fix the error handler with pm_runtime_enable. + +Fixes: b73d9e6225e8 ("ASoC: fsl_rpmsg: Add CPU DAI driver for audio base on rpmsg") +Signed-off-by: Chancel Liu +Acked-by: Shengjiu Wang +Link: https://lore.kernel.org/r/20231225080608.967953-1-chancel.liu@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_rpmsg.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/fsl/fsl_rpmsg.c b/sound/soc/fsl/fsl_rpmsg.c +index d60f4dac6c1b3..e82c0e6a60b5a 100644 +--- a/sound/soc/fsl/fsl_rpmsg.c ++++ b/sound/soc/fsl/fsl_rpmsg.c +@@ -191,7 +191,7 @@ static int fsl_rpmsg_probe(struct platform_device *pdev) + ret = devm_snd_soc_register_component(&pdev->dev, &fsl_component, + &fsl_rpmsg_dai, 1); + if (ret) +- return ret; ++ goto err_pm_disable; + + rpmsg->card_pdev = platform_device_register_data(&pdev->dev, + "imx-audio-rpmsg", +@@ -201,16 +201,22 @@ static int fsl_rpmsg_probe(struct platform_device *pdev) + if (IS_ERR(rpmsg->card_pdev)) { + dev_err(&pdev->dev, "failed to register rpmsg card\n"); + ret = PTR_ERR(rpmsg->card_pdev); +- return ret; ++ goto err_pm_disable; + } + + return 0; ++ ++err_pm_disable: ++ pm_runtime_disable(&pdev->dev); ++ return ret; + } + + static int fsl_rpmsg_remove(struct platform_device *pdev) + { + struct fsl_rpmsg *rpmsg = platform_get_drvdata(pdev); + ++ pm_runtime_disable(&pdev->dev); ++ + if (rpmsg->card_pdev) + platform_device_unregister(rpmsg->card_pdev); + +-- +2.43.0 + diff --git a/queue-5.15/asoc-meson-g12a-toacodec-fix-event-generation.patch b/queue-5.15/asoc-meson-g12a-toacodec-fix-event-generation.patch new file mode 100644 index 00000000000..222035adb94 --- /dev/null +++ b/queue-5.15/asoc-meson-g12a-toacodec-fix-event-generation.patch @@ -0,0 +1,39 @@ +From 75e73e9ca248f2a7ce29475f7f2c0b0deaddae40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 18:34:03 +0000 +Subject: ASoC: meson: g12a-toacodec: Fix event generation + +From: Mark Brown + +[ Upstream commit 172c88244b5f2d3375403ebb504d407be0fded59 ] + +When a control changes value the return value from _put() should be 1 so +we get events generated to userspace notifying applications of the change. +We are checking if there has been a change and exiting early if not but we +are not providing the correct return value in the latter case, fix this. + +Fixes: af2618a2eee8 ("ASoC: meson: g12a: add internal DAC glue driver") +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20240103-meson-enum-val-v1-3-424af7a8fb91@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/meson/g12a-toacodec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/meson/g12a-toacodec.c b/sound/soc/meson/g12a-toacodec.c +index 10a2ff1ecf33e..1cd62ba56e06b 100644 +--- a/sound/soc/meson/g12a-toacodec.c ++++ b/sound/soc/meson/g12a-toacodec.c +@@ -104,7 +104,7 @@ static int g12a_toacodec_mux_put_enum(struct snd_kcontrol *kcontrol, + + snd_soc_dapm_mux_update_power(dapm, kcontrol, mux, e, NULL); + +- return 0; ++ return 1; + } + + static SOC_ENUM_SINGLE_DECL(g12a_toacodec_mux_enum, TOACODEC_CTRL0, +-- +2.43.0 + diff --git a/queue-5.15/asoc-meson-g12a-toacodec-validate-written-enum-value.patch b/queue-5.15/asoc-meson-g12a-toacodec-validate-written-enum-value.patch new file mode 100644 index 00000000000..b94c88d21f4 --- /dev/null +++ b/queue-5.15/asoc-meson-g12a-toacodec-validate-written-enum-value.patch @@ -0,0 +1,40 @@ +From 8b47be61c64a2be85a0c605c40d80801656f3ac1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 18:34:01 +0000 +Subject: ASoC: meson: g12a-toacodec: Validate written enum values + +From: Mark Brown + +[ Upstream commit 3150b70e944ead909260285dfb5707d0bedcf87b ] + +When writing to an enum we need to verify that the value written is valid +for the enumeration, the helper function snd_soc_item_enum_to_val() doesn't +do it since it needs to return an unsigned (and in any case we'd need to +check the return value). + +Fixes: af2618a2eee8 ("ASoC: meson: g12a: add internal DAC glue driver") +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20240103-meson-enum-val-v1-1-424af7a8fb91@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/meson/g12a-toacodec.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/meson/g12a-toacodec.c b/sound/soc/meson/g12a-toacodec.c +index 1dfee1396843c..10a2ff1ecf33e 100644 +--- a/sound/soc/meson/g12a-toacodec.c ++++ b/sound/soc/meson/g12a-toacodec.c +@@ -71,6 +71,9 @@ static int g12a_toacodec_mux_put_enum(struct snd_kcontrol *kcontrol, + struct soc_enum *e = (struct soc_enum *)kcontrol->private_value; + unsigned int mux, reg; + ++ if (ucontrol->value.enumerated.item[0] >= e->items) ++ return -EINVAL; ++ + mux = snd_soc_enum_item_to_val(e, ucontrol->value.enumerated.item[0]); + regmap_field_read(priv->field_dat_sel, ®); + +-- +2.43.0 + diff --git a/queue-5.15/asoc-meson-g12a-tohdmitx-fix-event-generation-for-s-.patch b/queue-5.15/asoc-meson-g12a-tohdmitx-fix-event-generation-for-s-.patch new file mode 100644 index 00000000000..600ce4af6e8 --- /dev/null +++ b/queue-5.15/asoc-meson-g12a-tohdmitx-fix-event-generation-for-s-.patch @@ -0,0 +1,39 @@ +From 3f35bec44301b677575b4493556fc3769793d8e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 18:34:04 +0000 +Subject: ASoC: meson: g12a-tohdmitx: Fix event generation for S/PDIF mux + +From: Mark Brown + +[ Upstream commit b036d8ef3120b996751495ce25994eea58032a98 ] + +When a control changes value the return value from _put() should be 1 so +we get events generated to userspace notifying applications of the change. +While the I2S mux gets this right the S/PDIF mux does not, fix the return +value. + +Fixes: c8609f3870f7 ("ASoC: meson: add g12a tohdmitx control") +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20240103-meson-enum-val-v1-4-424af7a8fb91@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/meson/g12a-tohdmitx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/meson/g12a-tohdmitx.c b/sound/soc/meson/g12a-tohdmitx.c +index 6b16159733f72..4a9b67421c705 100644 +--- a/sound/soc/meson/g12a-tohdmitx.c ++++ b/sound/soc/meson/g12a-tohdmitx.c +@@ -118,7 +118,7 @@ static int g12a_tohdmitx_spdif_mux_put_enum(struct snd_kcontrol *kcontrol, + + snd_soc_dapm_mux_update_power(dapm, kcontrol, mux, e, NULL); + +- return 0; ++ return 1; + } + + static SOC_ENUM_SINGLE_DECL(g12a_tohdmitx_spdif_mux_enum, TOHDMITX_CTRL0, +-- +2.43.0 + diff --git a/queue-5.15/asoc-meson-g12a-tohdmitx-validate-written-enum-value.patch b/queue-5.15/asoc-meson-g12a-tohdmitx-validate-written-enum-value.patch new file mode 100644 index 00000000000..af3e97169dc --- /dev/null +++ b/queue-5.15/asoc-meson-g12a-tohdmitx-validate-written-enum-value.patch @@ -0,0 +1,50 @@ +From c45ba94e0e9dcbf4c73fda8df9471906d6f3e55a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 18:34:02 +0000 +Subject: ASoC: meson: g12a-tohdmitx: Validate written enum values + +From: Mark Brown + +[ Upstream commit 1e001206804be3f3d21f4a1cf16e5d059d75643f ] + +When writing to an enum we need to verify that the value written is valid +for the enumeration, the helper function snd_soc_item_enum_to_val() doesn't +do it since it needs to return an unsigned (and in any case we'd need to +check the return value). + +Fixes: c8609f3870f7 ("ASoC: meson: add g12a tohdmitx control") +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20240103-meson-enum-val-v1-2-424af7a8fb91@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/meson/g12a-tohdmitx.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/sound/soc/meson/g12a-tohdmitx.c b/sound/soc/meson/g12a-tohdmitx.c +index 6c99052feafd8..6b16159733f72 100644 +--- a/sound/soc/meson/g12a-tohdmitx.c ++++ b/sound/soc/meson/g12a-tohdmitx.c +@@ -45,6 +45,9 @@ static int g12a_tohdmitx_i2s_mux_put_enum(struct snd_kcontrol *kcontrol, + struct soc_enum *e = (struct soc_enum *)kcontrol->private_value; + unsigned int mux, changed; + ++ if (ucontrol->value.enumerated.item[0] >= e->items) ++ return -EINVAL; ++ + mux = snd_soc_enum_item_to_val(e, ucontrol->value.enumerated.item[0]); + changed = snd_soc_component_test_bits(component, e->reg, + CTRL0_I2S_DAT_SEL, +@@ -93,6 +96,9 @@ static int g12a_tohdmitx_spdif_mux_put_enum(struct snd_kcontrol *kcontrol, + struct soc_enum *e = (struct soc_enum *)kcontrol->private_value; + unsigned int mux, changed; + ++ if (ucontrol->value.enumerated.item[0] >= e->items) ++ return -EINVAL; ++ + mux = snd_soc_enum_item_to_val(e, ucontrol->value.enumerated.item[0]); + changed = snd_soc_component_test_bits(component, TOHDMITX_CTRL0, + CTRL0_SPDIF_SEL, +-- +2.43.0 + diff --git a/queue-5.15/bnxt_en-remove-mis-applied-code-from-bnxt_cfg_ntp_fi.patch b/queue-5.15/bnxt_en-remove-mis-applied-code-from-bnxt_cfg_ntp_fi.patch new file mode 100644 index 00000000000..c36c36b3d9a --- /dev/null +++ b/queue-5.15/bnxt_en-remove-mis-applied-code-from-bnxt_cfg_ntp_fi.patch @@ -0,0 +1,47 @@ +From c22a1663af57c7cc88237eb8946df6fb8648aa49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 16:59:24 -0800 +Subject: bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters() + +From: Michael Chan + +[ Upstream commit e009b2efb7a8850498796b360043ac25c8d3d28f ] + +The 2 lines to check for the BNXT_HWRM_PF_UNLOAD_SP_EVENT bit was +mis-applied to bnxt_cfg_ntp_filters() and should have been applied to +bnxt_sp_task(). + +Fixes: 19241368443f ("bnxt_en: Send PF driver unload notification to all VFs.") +Reviewed-by: Andy Gospodarek +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 42fa218295295..631639a19bad8 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -11749,6 +11749,8 @@ static void bnxt_sp_task(struct work_struct *work) + bnxt_cfg_ntp_filters(bp); + if (test_and_clear_bit(BNXT_HWRM_EXEC_FWD_REQ_SP_EVENT, &bp->sp_event)) + bnxt_hwrm_exec_fwd_req(bp); ++ if (test_and_clear_bit(BNXT_HWRM_PF_UNLOAD_SP_EVENT, &bp->sp_event)) ++ netdev_info(bp->dev, "Receive PF driver unload event!\n"); + if (test_and_clear_bit(BNXT_PERIODIC_STATS_SP_EVENT, &bp->sp_event)) { + bnxt_hwrm_port_qstats(bp, 0); + bnxt_hwrm_port_qstats_ext(bp, 0); +@@ -12694,8 +12696,6 @@ static void bnxt_cfg_ntp_filters(struct bnxt *bp) + } + } + } +- if (test_and_clear_bit(BNXT_HWRM_PF_UNLOAD_SP_EVENT, &bp->sp_event)) +- netdev_info(bp->dev, "Receive PF driver unload event!\n"); + } + + #else +-- +2.43.0 + diff --git a/queue-5.15/can-raw-add-support-for-so_mark.patch b/queue-5.15/can-raw-add-support-for-so_mark.patch new file mode 100644 index 00000000000..1542b3cabbf --- /dev/null +++ b/queue-5.15/can-raw-add-support-for-so_mark.patch @@ -0,0 +1,36 @@ +From 437660e1a2ae9c208a4a5446c1b19b6f62466543 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Dec 2022 10:10:08 +0100 +Subject: can: raw: add support for SO_MARK + +From: Marc Kleine-Budde + +[ Upstream commit 0826e82b8a32e646b7b32ba8b68ba30812028e47 ] + +Add support for SO_MARK to the CAN_RAW protocol. This makes it +possible to add traffic control filters based on the fwmark. + +Link: https://lore.kernel.org/all/20221210113653.170346-1-mkl@pengutronix.de +Acked-by: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Stable-dep-of: 7f6ca95d16b9 ("net: Implement missing getsockopt(SO_TIMESTAMPING_NEW)") +Signed-off-by: Sasha Levin +--- + net/can/raw.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/can/raw.c b/net/can/raw.c +index ed8834b853bee..e32ffcd200f38 100644 +--- a/net/can/raw.c ++++ b/net/can/raw.c +@@ -836,6 +836,7 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) + skb->dev = dev; + skb->sk = sk; + skb->priority = sk->sk_priority; ++ skb->mark = sk->sk_mark; + skb->tstamp = sockc.transmit_time; + + skb_setup_tx_timestamp(skb, sockc.tsflags); +-- +2.43.0 + diff --git a/queue-5.15/can-raw-add-support-for-so_txtime-scm_txtime.patch b/queue-5.15/can-raw-add-support-for-so_txtime-scm_txtime.patch new file mode 100644 index 00000000000..5bc1ce1c061 --- /dev/null +++ b/queue-5.15/can-raw-add-support-for-so_txtime-scm_txtime.patch @@ -0,0 +1,63 @@ +From ec1fd3ab717c4642238ed51768b748dffc83b3fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 12:31:52 +0200 +Subject: can: raw: add support for SO_TXTIME/SCM_TXTIME + +From: Marc Kleine-Budde + +[ Upstream commit 51a0d5e51178fcd147c1b8fdab2ed16b561326db ] + +This patch calls into sock_cmsg_send() to parse the user supplied +control information into a struct sockcm_cookie. Then assign the +requested transmit time to the skb. + +This makes it possible to use the Earliest TXTIME First (ETF) packet +scheduler with the CAN_RAW protocol. The user can send a CAN_RAW frame +with a TXTIME and the kernel (with the ETF scheduler) will take care +of sending it to the network interface. + +Link: https://lore.kernel.org/all/20220502091946.1916211-3-mkl@pengutronix.de +Acked-by: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Stable-dep-of: 7f6ca95d16b9 ("net: Implement missing getsockopt(SO_TIMESTAMPING_NEW)") +Signed-off-by: Sasha Levin +--- + net/can/raw.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/net/can/raw.c b/net/can/raw.c +index 8877d22da67ee..ed8834b853bee 100644 +--- a/net/can/raw.c ++++ b/net/can/raw.c +@@ -780,6 +780,7 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) + { + struct sock *sk = sock->sk; + struct raw_sock *ro = raw_sk(sk); ++ struct sockcm_cookie sockc; + struct sk_buff *skb; + struct net_device *dev; + int ifindex; +@@ -825,11 +826,19 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) + if (err < 0) + goto free_skb; + +- skb_setup_tx_timestamp(skb, sk->sk_tsflags); ++ sockcm_init(&sockc, sk); ++ if (msg->msg_controllen) { ++ err = sock_cmsg_send(sk, msg, &sockc); ++ if (unlikely(err)) ++ goto free_skb; ++ } + + skb->dev = dev; + skb->sk = sk; + skb->priority = sk->sk_priority; ++ skb->tstamp = sockc.transmit_time; ++ ++ skb_setup_tx_timestamp(skb, sockc.tsflags); + + err = can_send(skb, ro->loopback); + +-- +2.43.0 + diff --git a/queue-5.15/drm-bridge-ti-sn65dsi86-never-store-more-than-msg-si.patch b/queue-5.15/drm-bridge-ti-sn65dsi86-never-store-more-than-msg-si.patch new file mode 100644 index 00000000000..1b0b40b765a --- /dev/null +++ b/queue-5.15/drm-bridge-ti-sn65dsi86-never-store-more-than-msg-si.patch @@ -0,0 +1,55 @@ +From 28a937921b0f457490aa342b707b775c086f1aa6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Dec 2023 12:37:52 -0800 +Subject: drm/bridge: ti-sn65dsi86: Never store more than msg->size bytes in + AUX xfer + +From: Douglas Anderson + +[ Upstream commit aca58eac52b88138ab98c814afb389a381725cd7 ] + +For aux reads, the value `msg->size` indicates the size of the buffer +provided by `msg->buffer`. We should never in any circumstances write +more bytes to the buffer since it may overflow the buffer. + +In the ti-sn65dsi86 driver there is one code path that reads the +transfer length from hardware. Even though it's never been seen to be +a problem, we should make extra sure that the hardware isn't +increasing the length since doing so would cause us to overrun the +buffer. + +Fixes: 982f589bde7a ("drm/bridge: ti-sn65dsi86: Update reply on aux failures") +Reviewed-by: Stephen Boyd +Reviewed-by: Guenter Roeck +Signed-off-by: Douglas Anderson +Link: https://patchwork.freedesktop.org/patch/msgid/20231214123752.v3.2.I7b83c0f31aeedc6b1dc98c7c741d3e1f94f040f8@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-sn65dsi86.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +index 22c2ff5272c60..b488c6cb8f106 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +@@ -471,6 +471,7 @@ static ssize_t ti_sn_aux_transfer(struct drm_dp_aux *aux, + u32 request_val = AUX_CMD_REQ(msg->request); + u8 *buf = msg->buffer; + unsigned int len = msg->size; ++ unsigned int short_len; + unsigned int val; + int ret; + u8 addr_len[SN_AUX_LENGTH_REG + 1 - SN_AUX_ADDR_19_16_REG]; +@@ -544,7 +545,8 @@ static ssize_t ti_sn_aux_transfer(struct drm_dp_aux *aux, + } + + if (val & AUX_IRQ_STATUS_AUX_SHORT) { +- ret = regmap_read(pdata->regmap, SN_AUX_LENGTH_REG, &len); ++ ret = regmap_read(pdata->regmap, SN_AUX_LENGTH_REG, &short_len); ++ len = min(len, short_len); + if (ret) + goto exit; + } else if (val & AUX_IRQ_STATUS_NAT_I2C_FAIL) { +-- +2.43.0 + diff --git a/queue-5.15/drm-i915-dp-fix-passing-the-correct-dpcd_rev-for-drm.patch b/queue-5.15/drm-i915-dp-fix-passing-the-correct-dpcd_rev-for-drm.patch new file mode 100644 index 00000000000..e835124be63 --- /dev/null +++ b/queue-5.15/drm-i915-dp-fix-passing-the-correct-dpcd_rev-for-drm.patch @@ -0,0 +1,42 @@ +From b89c01f2096bc7f48612a3d5e821722f02467ce2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Dec 2023 13:15:42 -0800 +Subject: drm/i915/dp: Fix passing the correct DPCD_REV for + drm_dp_set_phy_test_pattern + +From: Khaled Almahallawy + +[ Upstream commit 2bd7a06a1208aaacb4e7a2a5436c23bce8d70801 ] + +Using link_status to get DPCD_REV fails when disabling/defaulting +phy pattern. Use intel_dp->dpcd to access DPCD_REV correctly. + +Fixes: 8cdf72711928 ("drm/i915/dp: Program vswing, pre-emphasis, test-pattern") +Cc: Jani Nikula +Cc: Imre Deak +Cc: Lee Shawn C +Signed-off-by: Khaled Almahallawy +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20231213211542.3585105-3-khaled.almahallawy@intel.com +(cherry picked from commit 3ee302ec22d6e1d7d1e6d381b0d507ee80f2135c) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_dp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c +index 6cc1258578088..a0c04b9d9c739 100644 +--- a/drivers/gpu/drm/i915/display/intel_dp.c ++++ b/drivers/gpu/drm/i915/display/intel_dp.c +@@ -3275,7 +3275,7 @@ static void intel_dp_process_phy_request(struct intel_dp *intel_dp, + intel_dp->train_set, crtc_state->lane_count); + + drm_dp_set_phy_test_pattern(&intel_dp->aux, data, +- link_status[DP_DPCD_REV]); ++ intel_dp->dpcd[DP_DPCD_REV]); + } + + static u8 intel_dp_autotest_phy_pattern(struct intel_dp *intel_dp) +-- +2.43.0 + diff --git a/queue-5.15/i40e-fix-filter-input-checks-to-prevent-config-with-.patch b/queue-5.15/i40e-fix-filter-input-checks-to-prevent-config-with-.patch new file mode 100644 index 00000000000..f340f99f625 --- /dev/null +++ b/queue-5.15/i40e-fix-filter-input-checks-to-prevent-config-with-.patch @@ -0,0 +1,53 @@ +From 64220390083c2c193a7c632b08cda3d6cbac2943 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 11:23:11 +0100 +Subject: i40e: Fix filter input checks to prevent config with invalid values + +From: Sudheer Mogilappagari + +[ Upstream commit 3e48041d9820c17e0a51599d12e66c6e12a8d08d ] + +Prevent VF from configuring filters with unsupported actions or use +REDIRECT action with invalid tc number. Current checks could cause +out of bounds access on PF side. + +Fixes: e284fc280473 ("i40e: Add and delete cloud filter") +Reviewed-by: Andrii Staikov +Signed-off-by: Sudheer Mogilappagari +Signed-off-by: Aleksandr Loktionov +Reviewed-by: Simon Horman +Tested-by: Bharathi Sreenivas +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 7950b18cb7a41..0946565b157cd 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -3427,16 +3427,16 @@ static int i40e_validate_cloud_filter(struct i40e_vf *vf, + bool found = false; + int bkt; + +- if (!tc_filter->action) { ++ if (tc_filter->action != VIRTCHNL_ACTION_TC_REDIRECT) { + dev_info(&pf->pdev->dev, +- "VF %d: Currently ADq doesn't support Drop Action\n", +- vf->vf_id); ++ "VF %d: ADQ doesn't support this action (%d)\n", ++ vf->vf_id, tc_filter->action); + goto err; + } + + /* action_meta is TC number here to which the filter is applied */ + if (!tc_filter->action_meta || +- tc_filter->action_meta > I40E_MAX_VF_VSI) { ++ tc_filter->action_meta > vf->num_tc) { + dev_info(&pf->pdev->dev, "VF %d: Invalid TC number %u\n", + vf->vf_id, tc_filter->action_meta); + goto err; +-- +2.43.0 + diff --git a/queue-5.15/i40e-fix-use-after-free-in-i40e_aqc_add_filters.patch b/queue-5.15/i40e-fix-use-after-free-in-i40e_aqc_add_filters.patch new file mode 100644 index 00000000000..8f04bb57200 --- /dev/null +++ b/queue-5.15/i40e-fix-use-after-free-in-i40e_aqc_add_filters.patch @@ -0,0 +1,120 @@ +From 57dd50188a43331a1d3a9b971a4bc383e14a03fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Dec 2023 15:08:50 +0800 +Subject: i40e: fix use-after-free in i40e_aqc_add_filters() + +From: Ke Xiao + +[ Upstream commit 6a15584e99db8918b60e507539c7446375dcf366 ] + +Commit 3116f59c12bd ("i40e: fix use-after-free in +i40e_sync_filters_subtask()") avoided use-after-free issues, +by increasing refcount during update the VSI filter list to +the HW. However, it missed the unicast situation. + +When deleting an unicast FDB entry, the i40e driver will release +the mac_filter, and i40e_service_task will concurrently request +firmware to add the mac_filter, which will lead to the following +use-after-free issue. + +Fix again for both netdev->uc and netdev->mc. + +BUG: KASAN: use-after-free in i40e_aqc_add_filters+0x55c/0x5b0 [i40e] +Read of size 2 at addr ffff888eb3452d60 by task kworker/8:7/6379 + +CPU: 8 PID: 6379 Comm: kworker/8:7 Kdump: loaded Tainted: G +Workqueue: i40e i40e_service_task [i40e] +Call Trace: + dump_stack+0x71/0xab + print_address_description+0x6b/0x290 + kasan_report+0x14a/0x2b0 + i40e_aqc_add_filters+0x55c/0x5b0 [i40e] + i40e_sync_vsi_filters+0x1676/0x39c0 [i40e] + i40e_service_task+0x1397/0x2bb0 [i40e] + process_one_work+0x56a/0x11f0 + worker_thread+0x8f/0xf40 + kthread+0x2a0/0x390 + ret_from_fork+0x1f/0x40 + +Allocated by task 21948: + kasan_kmalloc+0xa6/0xd0 + kmem_cache_alloc_trace+0xdb/0x1c0 + i40e_add_filter+0x11e/0x520 [i40e] + i40e_addr_sync+0x37/0x60 [i40e] + __hw_addr_sync_dev+0x1f5/0x2f0 + i40e_set_rx_mode+0x61/0x1e0 [i40e] + dev_uc_add_excl+0x137/0x190 + i40e_ndo_fdb_add+0x161/0x260 [i40e] + rtnl_fdb_add+0x567/0x950 + rtnetlink_rcv_msg+0x5db/0x880 + netlink_rcv_skb+0x254/0x380 + netlink_unicast+0x454/0x610 + netlink_sendmsg+0x747/0xb00 + sock_sendmsg+0xe2/0x120 + __sys_sendto+0x1ae/0x290 + __x64_sys_sendto+0xdd/0x1b0 + do_syscall_64+0xa0/0x370 + entry_SYSCALL_64_after_hwframe+0x65/0xca + +Freed by task 21948: + __kasan_slab_free+0x137/0x190 + kfree+0x8b/0x1b0 + __i40e_del_filter+0x116/0x1e0 [i40e] + i40e_del_mac_filter+0x16c/0x300 [i40e] + i40e_addr_unsync+0x134/0x1b0 [i40e] + __hw_addr_sync_dev+0xff/0x2f0 + i40e_set_rx_mode+0x61/0x1e0 [i40e] + dev_uc_del+0x77/0x90 + rtnl_fdb_del+0x6a5/0x860 + rtnetlink_rcv_msg+0x5db/0x880 + netlink_rcv_skb+0x254/0x380 + netlink_unicast+0x454/0x610 + netlink_sendmsg+0x747/0xb00 + sock_sendmsg+0xe2/0x120 + __sys_sendto+0x1ae/0x290 + __x64_sys_sendto+0xdd/0x1b0 + do_syscall_64+0xa0/0x370 + entry_SYSCALL_64_after_hwframe+0x65/0xca + +Fixes: 3116f59c12bd ("i40e: fix use-after-free in i40e_sync_filters_subtask()") +Fixes: 41c445ff0f48 ("i40e: main driver core") +Signed-off-by: Ke Xiao +Signed-off-by: Ding Hui +Cc: Di Zhu +Reviewed-by: Jan Sokolowski +Reviewed-by: Simon Horman +Reviewed-by: Jacob Keller +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index cf085bd8d790f..04b8a006b21f1 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -102,12 +102,18 @@ static struct workqueue_struct *i40e_wq; + static void netdev_hw_addr_refcnt(struct i40e_mac_filter *f, + struct net_device *netdev, int delta) + { ++ struct netdev_hw_addr_list *ha_list; + struct netdev_hw_addr *ha; + + if (!f || !netdev) + return; + +- netdev_for_each_mc_addr(ha, netdev) { ++ if (is_unicast_ether_addr(f->macaddr) || is_link_local_ether_addr(f->macaddr)) ++ ha_list = &netdev->uc; ++ else ++ ha_list = &netdev->mc; ++ ++ netdev_hw_addr_list_for_each(ha, ha_list) { + if (ether_addr_equal(ha->addr, f->macaddr)) { + ha->refcount += delta; + if (ha->refcount <= 0) +-- +2.43.0 + diff --git a/queue-5.15/i40e-restore-vf-msi-x-state-during-pci-reset.patch b/queue-5.15/i40e-restore-vf-msi-x-state-during-pci-reset.patch new file mode 100644 index 00000000000..3c3691d25c3 --- /dev/null +++ b/queue-5.15/i40e-restore-vf-msi-x-state-during-pci-reset.patch @@ -0,0 +1,104 @@ +From 8135ca893eb1806d77d2593b7a8b8e6d7168dee7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Dec 2023 14:27:35 +0100 +Subject: i40e: Restore VF MSI-X state during PCI reset + +From: Andrii Staikov + +[ Upstream commit 371e576ff3e8580d91d49026e5d5faebf5565558 ] + +During a PCI FLR the MSI-X Enable flag in the VF PCI MSI-X capability +register will be cleared. This can lead to issues when a VF is +assigned to a VM because in these cases the VF driver receives no +indication of the PF PCI error/reset and additionally it is incapable +of restoring the cleared flag in the hypervisor configuration space +without fully reinitializing the driver interrupt functionality. + +Since the VF driver is unable to easily resolve this condition on its own, +restore the VF MSI-X flag during the PF PCI reset handling. + +Fixes: 19b7960b2da1 ("i40e: implement split PCI error reset handler") +Co-developed-by: Karen Ostrowska +Signed-off-by: Karen Ostrowska +Co-developed-by: Mateusz Palczewski +Signed-off-by: Mateusz Palczewski +Reviewed-by: Wojciech Drewek +Reviewed-by: Przemek Kitszel +Signed-off-by: Andrii Staikov +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 3 +++ + .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 26 +++++++++++++++++++ + .../ethernet/intel/i40e/i40e_virtchnl_pf.h | 3 +++ + 3 files changed, 32 insertions(+) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 04b8a006b21f1..10737418565ff 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -16424,6 +16424,9 @@ static void i40e_pci_error_reset_done(struct pci_dev *pdev) + return; + + i40e_reset_and_rebuild(pf, false, false); ++#ifdef CONFIG_PCI_IOV ++ i40e_restore_all_vfs_msi_state(pdev); ++#endif /* CONFIG_PCI_IOV */ + } + + /** +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 0946565b157cd..4d23ff936ce42 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -152,6 +152,32 @@ void i40e_vc_notify_reset(struct i40e_pf *pf) + (u8 *)&pfe, sizeof(struct virtchnl_pf_event)); + } + ++#ifdef CONFIG_PCI_IOV ++void i40e_restore_all_vfs_msi_state(struct pci_dev *pdev) ++{ ++ u16 vf_id; ++ u16 pos; ++ ++ /* Continue only if this is a PF */ ++ if (!pdev->is_physfn) ++ return; ++ ++ if (!pci_num_vf(pdev)) ++ return; ++ ++ pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_SRIOV); ++ if (pos) { ++ struct pci_dev *vf_dev = NULL; ++ ++ pci_read_config_word(pdev, pos + PCI_SRIOV_VF_DID, &vf_id); ++ while ((vf_dev = pci_get_device(pdev->vendor, vf_id, vf_dev))) { ++ if (vf_dev->is_virtfn && vf_dev->physfn == pdev) ++ pci_restore_msi_state(vf_dev); ++ } ++ } ++} ++#endif /* CONFIG_PCI_IOV */ ++ + /** + * i40e_vc_notify_vf_reset + * @vf: pointer to the VF structure +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h +index 358bbdb587951..bd497cc5303a1 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h +@@ -135,6 +135,9 @@ int i40e_ndo_set_vf_spoofchk(struct net_device *netdev, int vf_id, bool enable); + + void i40e_vc_notify_link_state(struct i40e_pf *pf); + void i40e_vc_notify_reset(struct i40e_pf *pf); ++#ifdef CONFIG_PCI_IOV ++void i40e_restore_all_vfs_msi_state(struct pci_dev *pdev); ++#endif /* CONFIG_PCI_IOV */ + int i40e_get_vf_stats(struct net_device *netdev, int vf_id, + struct ifla_vf_stats *vf_stats); + +-- +2.43.0 + diff --git a/queue-5.15/igc-check-vlan-ethertype-mask.patch b/queue-5.15/igc-check-vlan-ethertype-mask.patch new file mode 100644 index 00000000000..dc2eefde9d0 --- /dev/null +++ b/queue-5.15/igc-check-vlan-ethertype-mask.patch @@ -0,0 +1,72 @@ +From dbb05d2b21bca15a121969cbc72b195b1c8f7406 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 15:07:18 +0100 +Subject: igc: Check VLAN EtherType mask + +From: Kurt Kanzenbach + +[ Upstream commit 7afd49a38e73afd57ff62c8d1cf5af760c4d49c0 ] + +Currently the driver accepts VLAN EtherType steering rules regardless of +the configured mask. And things might fail silently or with confusing error +messages to the user. The VLAN EtherType can only be matched by full +mask. Therefore, add a check for that. + +For instance the following rule is invalid, but the driver accepts it and +ignores the user specified mask: +|root@host:~# ethtool -N enp3s0 flow-type ether vlan-etype 0x8100 \ +| m 0x00ff action 0 +|Added rule with ID 63 +|root@host:~# ethtool --show-ntuple enp3s0 +|4 RX rings available +|Total 1 rules +| +|Filter: 63 +| Flow Type: Raw Ethernet +| Src MAC addr: 00:00:00:00:00:00 mask: FF:FF:FF:FF:FF:FF +| Dest MAC addr: 00:00:00:00:00:00 mask: FF:FF:FF:FF:FF:FF +| Ethertype: 0x0 mask: 0xFFFF +| VLAN EtherType: 0x8100 mask: 0x0 +| VLAN: 0x0 mask: 0xffff +| User-defined: 0x0 mask: 0xffffffffffffffff +| Action: Direct to queue 0 + +After: +|root@host:~# ethtool -N enp3s0 flow-type ether vlan-etype 0x8100 \ +| m 0x00ff action 0 +|rmgr: Cannot insert RX class rule: Operation not supported + +Fixes: 2b477d057e33 ("igc: Integrate flex filter into ethtool ops") +Suggested-by: Suman Ghosh +Signed-off-by: Kurt Kanzenbach +Acked-by: Vinicius Costa Gomes +Reviewed-by: Simon Horman +Tested-by: Naama Meir +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_ethtool.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c +index 2365692cd328f..9dfa618a3651e 100644 +--- a/drivers/net/ethernet/intel/igc/igc_ethtool.c ++++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c +@@ -1349,6 +1349,14 @@ static int igc_ethtool_add_nfc_rule(struct igc_adapter *adapter, + return -EOPNOTSUPP; + } + ++ /* VLAN EtherType can only be matched by full mask. */ ++ if ((fsp->flow_type & FLOW_EXT) && ++ fsp->m_ext.vlan_etype && ++ fsp->m_ext.vlan_etype != ETHER_TYPE_FULL_MASK) { ++ netdev_dbg(netdev, "VLAN EtherType mask not supported\n"); ++ return -EOPNOTSUPP; ++ } ++ + if (fsp->location >= IGC_MAX_RXNFC_RULES) { + netdev_dbg(netdev, "Invalid location\n"); + return -EINVAL; +-- +2.43.0 + diff --git a/queue-5.15/igc-check-vlan-tci-mask.patch b/queue-5.15/igc-check-vlan-tci-mask.patch new file mode 100644 index 00000000000..8511cb907fb --- /dev/null +++ b/queue-5.15/igc-check-vlan-tci-mask.patch @@ -0,0 +1,141 @@ +From d8e66e1b8dd46696cc6355cb3871d75dd4ef031c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 08:50:43 +0100 +Subject: igc: Check VLAN TCI mask + +From: Kurt Kanzenbach + +[ Upstream commit b5063cbe148b829e8eb97672c2cbccc058835476 ] + +Currently the driver accepts VLAN TCI steering rules regardless of the +configured mask. And things might fail silently or with confusing error +messages to the user. + +There are two ways to handle the VLAN TCI mask: + + 1. Match on the PCP field using a VLAN prio filter + 2. Match on complete TCI field using a flex filter + +Therefore, add checks and code for that. + +For instance the following rule is invalid and will be converted into a +VLAN prio rule which is not correct: +|root@host:~# ethtool -N enp3s0 flow-type ether vlan 0x0001 m 0xf000 \ +| action 1 +|Added rule with ID 61 +|root@host:~# ethtool --show-ntuple enp3s0 +|4 RX rings available +|Total 1 rules +| +|Filter: 61 +| Flow Type: Raw Ethernet +| Src MAC addr: 00:00:00:00:00:00 mask: FF:FF:FF:FF:FF:FF +| Dest MAC addr: 00:00:00:00:00:00 mask: FF:FF:FF:FF:FF:FF +| Ethertype: 0x0 mask: 0xFFFF +| VLAN EtherType: 0x0 mask: 0xffff +| VLAN: 0x1 mask: 0x1fff +| User-defined: 0x0 mask: 0xffffffffffffffff +| Action: Direct to queue 1 + +After: +|root@host:~# ethtool -N enp3s0 flow-type ether vlan 0x0001 m 0xf000 \ +| action 1 +|rmgr: Cannot insert RX class rule: Operation not supported + +Fixes: 7991487ecb2d ("igc: Allow for Flex Filters to be installed") +Signed-off-by: Kurt Kanzenbach +Acked-by: Vinicius Costa Gomes +Reviewed-by: Simon Horman +Tested-by: Naama Meir +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc.h | 1 + + drivers/net/ethernet/intel/igc/igc_ethtool.c | 28 +++++++++++++++++--- + 2 files changed, 26 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h +index e09ca21b8e3fe..009416705dde1 100644 +--- a/drivers/net/ethernet/intel/igc/igc.h ++++ b/drivers/net/ethernet/intel/igc/igc.h +@@ -537,6 +537,7 @@ struct igc_nfc_filter { + u16 etype; + __be16 vlan_etype; + u16 vlan_tci; ++ u16 vlan_tci_mask; + u8 src_addr[ETH_ALEN]; + u8 dst_addr[ETH_ALEN]; + u8 user_data[8]; +diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c +index ea4545e431dc5..2365692cd328f 100644 +--- a/drivers/net/ethernet/intel/igc/igc_ethtool.c ++++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c +@@ -950,6 +950,7 @@ static int igc_ethtool_set_coalesce(struct net_device *netdev, + } + + #define ETHER_TYPE_FULL_MASK ((__force __be16)~0) ++#define VLAN_TCI_FULL_MASK ((__force __be16)~0) + static int igc_ethtool_get_nfc_rule(struct igc_adapter *adapter, + struct ethtool_rxnfc *cmd) + { +@@ -981,7 +982,7 @@ static int igc_ethtool_get_nfc_rule(struct igc_adapter *adapter, + if (rule->filter.match_flags & IGC_FILTER_FLAG_VLAN_TCI) { + fsp->flow_type |= FLOW_EXT; + fsp->h_ext.vlan_tci = htons(rule->filter.vlan_tci); +- fsp->m_ext.vlan_tci = htons(VLAN_PRIO_MASK); ++ fsp->m_ext.vlan_tci = htons(rule->filter.vlan_tci_mask); + } + + if (rule->filter.match_flags & IGC_FILTER_FLAG_DST_MAC_ADDR) { +@@ -1216,6 +1217,7 @@ static void igc_ethtool_init_nfc_rule(struct igc_nfc_rule *rule, + + if ((fsp->flow_type & FLOW_EXT) && fsp->m_ext.vlan_tci) { + rule->filter.vlan_tci = ntohs(fsp->h_ext.vlan_tci); ++ rule->filter.vlan_tci_mask = ntohs(fsp->m_ext.vlan_tci); + rule->filter.match_flags |= IGC_FILTER_FLAG_VLAN_TCI; + } + +@@ -1253,11 +1255,19 @@ static void igc_ethtool_init_nfc_rule(struct igc_nfc_rule *rule, + memcpy(rule->filter.user_mask, fsp->m_ext.data, sizeof(fsp->m_ext.data)); + } + +- /* When multiple filter options or user data or vlan etype is set, use a +- * flex filter. ++ /* The i225/i226 has various different filters. Flex filters provide a ++ * way to match up to the first 128 bytes of a packet. Use them for: ++ * a) For specific user data ++ * b) For VLAN EtherType ++ * c) For full TCI match ++ * d) Or in case multiple filter criteria are set ++ * ++ * Otherwise, use the simple MAC, VLAN PRIO or EtherType filters. + */ + if ((rule->filter.match_flags & IGC_FILTER_FLAG_USER_DATA) || + (rule->filter.match_flags & IGC_FILTER_FLAG_VLAN_ETYPE) || ++ ((rule->filter.match_flags & IGC_FILTER_FLAG_VLAN_TCI) && ++ rule->filter.vlan_tci_mask == ntohs(VLAN_TCI_FULL_MASK)) || + (rule->filter.match_flags & (rule->filter.match_flags - 1))) + rule->flex = true; + else +@@ -1327,6 +1337,18 @@ static int igc_ethtool_add_nfc_rule(struct igc_adapter *adapter, + return -EINVAL; + } + ++ /* There are two ways to match the VLAN TCI: ++ * 1. Match on PCP field and use vlan prio filter for it ++ * 2. Match on complete TCI field and use flex filter for it ++ */ ++ if ((fsp->flow_type & FLOW_EXT) && ++ fsp->m_ext.vlan_tci && ++ fsp->m_ext.vlan_tci != htons(VLAN_PRIO_MASK) && ++ fsp->m_ext.vlan_tci != VLAN_TCI_FULL_MASK) { ++ netdev_dbg(netdev, "VLAN mask not supported\n"); ++ return -EOPNOTSUPP; ++ } ++ + if (fsp->location >= IGC_MAX_RXNFC_RULES) { + netdev_dbg(netdev, "Invalid location\n"); + return -EINVAL; +-- +2.43.0 + diff --git a/queue-5.15/igc-fix-hicredit-calculation.patch b/queue-5.15/igc-fix-hicredit-calculation.patch new file mode 100644 index 00000000000..795e68fcc2e --- /dev/null +++ b/queue-5.15/igc-fix-hicredit-calculation.patch @@ -0,0 +1,45 @@ +From 65033440295546ae6068ce92f9d6361743df29c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 15:58:16 +0100 +Subject: igc: Fix hicredit calculation + +From: Rodrigo Cataldo + +[ Upstream commit 947dfc8138dfaeb6e966e2d661de89eb203e3064 ] + +According to the Intel Software Manual for I225, Section 7.5.2.7, +hicredit should be multiplied by the constant link-rate value, 0x7736. + +Currently, the old constant link-rate value, 0x7735, from the boards +supported on igb are being used, most likely due to a copy'n'paste, as +the rest of the logic is the same for both drivers. + +Update hicredit accordingly. + +Fixes: 1ab011b0bf07 ("igc: Add support for CBS offloading") +Reviewed-by: Kurt Kanzenbach +Signed-off-by: Rodrigo Cataldo +Acked-by: Vinicius Costa Gomes +Tested-by: Naama Meir +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_tsn.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc_tsn.c b/drivers/net/ethernet/intel/igc/igc_tsn.c +index 356c7455c5cee..2330b1ff915e7 100644 +--- a/drivers/net/ethernet/intel/igc/igc_tsn.c ++++ b/drivers/net/ethernet/intel/igc/igc_tsn.c +@@ -185,7 +185,7 @@ static int igc_tsn_enable_offload(struct igc_adapter *adapter) + wr32(IGC_TQAVCC(i), tqavcc); + + wr32(IGC_TQAVHC(i), +- 0x80000000 + ring->hicredit * 0x7735); ++ 0x80000000 + ring->hicredit * 0x7736); + } else { + /* Disable any CBS for the queue */ + txqctl &= ~(IGC_TXQCTL_QAV_SEL_MASK); +-- +2.43.0 + diff --git a/queue-5.15/igc-report-vlan-ethertype-matching-back-to-user.patch b/queue-5.15/igc-report-vlan-ethertype-matching-back-to-user.patch new file mode 100644 index 00000000000..a6d59b3fb4f --- /dev/null +++ b/queue-5.15/igc-report-vlan-ethertype-matching-back-to-user.patch @@ -0,0 +1,75 @@ +From cf2cbfaa44479077820bf0b6f2deb6193592f6df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 08:50:42 +0100 +Subject: igc: Report VLAN EtherType matching back to user + +From: Kurt Kanzenbach + +[ Upstream commit 088464abd48cf3735aee91f9e211b32da9d81117 ] + +Currently the driver allows to configure matching by VLAN EtherType. +However, the retrieval function does not report it back to the user. Add +it. + +Before: +|root@host:~# ethtool -N enp3s0 flow-type ether vlan-etype 0x8100 action 0 +|Added rule with ID 63 +|root@host:~# ethtool --show-ntuple enp3s0 +|4 RX rings available +|Total 1 rules +| +|Filter: 63 +| Flow Type: Raw Ethernet +| Src MAC addr: 00:00:00:00:00:00 mask: FF:FF:FF:FF:FF:FF +| Dest MAC addr: 00:00:00:00:00:00 mask: FF:FF:FF:FF:FF:FF +| Ethertype: 0x0 mask: 0xFFFF +| Action: Direct to queue 0 + +After: +|root@host:~# ethtool -N enp3s0 flow-type ether vlan-etype 0x8100 action 0 +|Added rule with ID 63 +|root@host:~# ethtool --show-ntuple enp3s0 +|4 RX rings available +|Total 1 rules +| +|Filter: 63 +| Flow Type: Raw Ethernet +| Src MAC addr: 00:00:00:00:00:00 mask: FF:FF:FF:FF:FF:FF +| Dest MAC addr: 00:00:00:00:00:00 mask: FF:FF:FF:FF:FF:FF +| Ethertype: 0x0 mask: 0xFFFF +| VLAN EtherType: 0x8100 mask: 0x0 +| VLAN: 0x0 mask: 0xffff +| User-defined: 0x0 mask: 0xffffffffffffffff +| Action: Direct to queue 0 + +Fixes: 2b477d057e33 ("igc: Integrate flex filter into ethtool ops") +Signed-off-by: Kurt Kanzenbach +Acked-by: Vinicius Costa Gomes +Reviewed-by: Simon Horman +Tested-by: Naama Meir +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_ethtool.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c +index 3bffd2729a439..ea4545e431dc5 100644 +--- a/drivers/net/ethernet/intel/igc/igc_ethtool.c ++++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c +@@ -972,6 +972,12 @@ static int igc_ethtool_get_nfc_rule(struct igc_adapter *adapter, + fsp->m_u.ether_spec.h_proto = ETHER_TYPE_FULL_MASK; + } + ++ if (rule->filter.match_flags & IGC_FILTER_FLAG_VLAN_ETYPE) { ++ fsp->flow_type |= FLOW_EXT; ++ fsp->h_ext.vlan_etype = rule->filter.vlan_etype; ++ fsp->m_ext.vlan_etype = ETHER_TYPE_FULL_MASK; ++ } ++ + if (rule->filter.match_flags & IGC_FILTER_FLAG_VLAN_TCI) { + fsp->flow_type |= FLOW_EXT; + fsp->h_ext.vlan_tci = htons(rule->filter.vlan_tci); +-- +2.43.0 + diff --git a/queue-5.15/mlxbf_gige-fix-receive-packet-race-condition.patch b/queue-5.15/mlxbf_gige-fix-receive-packet-race-condition.patch new file mode 100644 index 00000000000..bf6e75dfadc --- /dev/null +++ b/queue-5.15/mlxbf_gige-fix-receive-packet-race-condition.patch @@ -0,0 +1,63 @@ +From c348186c58de152348f772c8ee6ab35a02f89853 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Dec 2023 18:47:39 -0500 +Subject: mlxbf_gige: fix receive packet race condition + +From: David Thompson + +[ Upstream commit dcea1bd45e6d111cc8fc1aaefa7e31694089bda3 ] + +Under heavy traffic, the BlueField Gigabit interface can +become unresponsive. This is due to a possible race condition +in the mlxbf_gige_rx_packet function, where the function exits +with producer and consumer indices equal but there are remaining +packet(s) to be processed. In order to prevent this situation, +read receive consumer index *before* the HW replenish so that +the mlxbf_gige_rx_packet function returns an accurate return +value even if a packet is received into just-replenished buffer +prior to exiting this routine. If the just-replenished buffer +is received and occupies the last RX ring entry, the interface +would not recover and instead would encounter RX packet drops +related to internal buffer shortages since the driver RX logic +is not being triggered to drain the RX ring. This patch will +address and prevent this "ring full" condition. + +Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver") +Reviewed-by: Asmaa Mnebhi +Signed-off-by: David Thompson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c +index 0d5a41a2ae010..227d01cace3f0 100644 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c ++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c +@@ -267,6 +267,13 @@ static bool mlxbf_gige_rx_packet(struct mlxbf_gige *priv, int *rx_pkts) + priv->stats.rx_truncate_errors++; + } + ++ /* Read receive consumer index before replenish so that this routine ++ * returns accurate return value even if packet is received into ++ * just-replenished buffer prior to exiting this routine. ++ */ ++ rx_ci = readq(priv->base + MLXBF_GIGE_RX_CQE_PACKET_CI); ++ rx_ci_rem = rx_ci % priv->rx_q_entries; ++ + /* Let hardware know we've replenished one buffer */ + rx_pi++; + +@@ -279,8 +286,6 @@ static bool mlxbf_gige_rx_packet(struct mlxbf_gige *priv, int *rx_pkts) + rx_pi_rem = rx_pi % priv->rx_q_entries; + if (rx_pi_rem == 0) + priv->valid_polarity ^= 1; +- rx_ci = readq(priv->base + MLXBF_GIGE_RX_CQE_PACKET_CI); +- rx_ci_rem = rx_ci % priv->rx_q_entries; + + if (skb) + netif_receive_skb(skb); +-- +2.43.0 + diff --git a/queue-5.15/mm-memory-failure-check-the-mapcount-of-the-precise-.patch b/queue-5.15/mm-memory-failure-check-the-mapcount-of-the-precise-.patch new file mode 100644 index 00000000000..8854d4561ff --- /dev/null +++ b/queue-5.15/mm-memory-failure-check-the-mapcount-of-the-precise-.patch @@ -0,0 +1,54 @@ +From a243f483ade93987e78de4a6f9f5b13686ad2ffa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Dec 2023 13:58:36 +0000 +Subject: mm/memory-failure: check the mapcount of the precise page + +From: Matthew Wilcox (Oracle) + +[ Upstream commit c79c5a0a00a9457718056b588f312baadf44e471 ] + +A process may map only some of the pages in a folio, and might be missed +if it maps the poisoned page but not the head page. Or it might be +unnecessarily hit if it maps the head page, but not the poisoned page. + +Link: https://lkml.kernel.org/r/20231218135837.3310403-3-willy@infradead.org +Fixes: 7af446a841a2 ("HWPOISON, hugetlb: enable error handling path for hugepage") +Signed-off-by: Matthew Wilcox (Oracle) +Cc: Dan Williams +Cc: Naoya Horiguchi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + mm/memory-failure.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index bcd71d8736be5..1f23baa98ee9b 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1331,7 +1331,7 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn, + * This check implies we don't kill processes if their pages + * are in the swap cache early. Those are always late kills. + */ +- if (!page_mapped(hpage)) ++ if (!page_mapped(p)) + return true; + + if (PageKsm(p)) { +@@ -1397,10 +1397,10 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn, + } + } + +- unmap_success = !page_mapped(hpage); ++ unmap_success = !page_mapped(p); + if (!unmap_success) + pr_err("Memory failure: %#lx: failed to unmap page (mapcount=%d)\n", +- pfn, page_mapcount(hpage)); ++ pfn, page_mapcount(p)); + + /* + * try_to_unmap() might put mlocked page in lru cache, so call +-- +2.43.0 + diff --git a/queue-5.15/net-bcmgenet-fix-fcs-generation-for-fragmented-skbuf.patch b/queue-5.15/net-bcmgenet-fix-fcs-generation-for-fragmented-skbuf.patch new file mode 100644 index 00000000000..1cecd50fc50 --- /dev/null +++ b/queue-5.15/net-bcmgenet-fix-fcs-generation-for-fragmented-skbuf.patch @@ -0,0 +1,46 @@ +From 2d3fe7f7618e73eed5bc0847424589289e5cc4c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Dec 2023 14:56:38 +0100 +Subject: net: bcmgenet: Fix FCS generation for fragmented skbuffs + +From: Adrian Cinal + +[ Upstream commit e584f2ff1e6cc9b1d99e8a6b0f3415940d1b3eb3 ] + +The flag DMA_TX_APPEND_CRC was only written to the first DMA descriptor +in the TX path, where each descriptor corresponds to a single skbuff +fragment (or the skbuff head). This led to packets with no FCS appearing +on the wire if the kernel allocated the packet in fragments, which would +always happen when using PACKET_MMAP/TPACKET (cf. tpacket_fill_skb() in +net/af_packet.c). + +Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file") +Signed-off-by: Adrian Cinal +Acked-by: Doug Berger +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20231228135638.1339245-1-adriancinal1@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index f6a553e5df25f..1c3f7efce8a7f 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -2090,8 +2090,10 @@ static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *dev) + /* Note: if we ever change from DMA_TX_APPEND_CRC below we + * will need to restore software padding of "runt" packets + */ ++ len_stat |= DMA_TX_APPEND_CRC; ++ + if (!i) { +- len_stat |= DMA_TX_APPEND_CRC | DMA_SOP; ++ len_stat |= DMA_SOP; + if (skb->ip_summed == CHECKSUM_PARTIAL) + len_stat |= DMA_TX_DO_CSUM; + } +-- +2.43.0 + diff --git a/queue-5.15/net-implement-missing-getsockopt-so_timestamping_new.patch b/queue-5.15/net-implement-missing-getsockopt-so_timestamping_new.patch new file mode 100644 index 00000000000..abeff26ee66 --- /dev/null +++ b/queue-5.15/net-implement-missing-getsockopt-so_timestamping_new.patch @@ -0,0 +1,60 @@ +From 460f3f916b9de582f5412f752b56c13e3a35e145 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Dec 2023 00:19:01 +0100 +Subject: net: Implement missing getsockopt(SO_TIMESTAMPING_NEW) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jörn-Thorben Hinz + +[ Upstream commit 7f6ca95d16b96567ce4cf458a2790ff17fa620c3 ] + +Commit 9718475e6908 ("socket: Add SO_TIMESTAMPING_NEW") added the new +socket option SO_TIMESTAMPING_NEW. Setting the option is handled in +sk_setsockopt(), querying it was not handled in sk_getsockopt(), though. + +Following remarks on an earlier submission of this patch, keep the old +behavior of getsockopt(SO_TIMESTAMPING_OLD) which returns the active +flags even if they actually have been set through SO_TIMESTAMPING_NEW. + +The new getsockopt(SO_TIMESTAMPING_NEW) is stricter, returning flags +only if they have been set through the same option. + +Fixes: 9718475e6908 ("socket: Add SO_TIMESTAMPING_NEW") +Link: https://lore.kernel.org/lkml/20230703175048.151683-1-jthinz@mailbox.tu-berlin.de/ +Link: https://lore.kernel.org/netdev/0d7cddc9-03fa-43db-a579-14f3e822615b@app.fastmail.com/ +Signed-off-by: Jörn-Thorben Hinz +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/sock.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/net/core/sock.c b/net/core/sock.c +index 662cd6d54ac70..ef29106af6046 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -1534,9 +1534,16 @@ int sock_getsockopt(struct socket *sock, int level, int optname, + break; + + case SO_TIMESTAMPING_OLD: ++ case SO_TIMESTAMPING_NEW: + lv = sizeof(v.timestamping); +- v.timestamping.flags = sk->sk_tsflags; +- v.timestamping.bind_phc = sk->sk_bind_phc; ++ /* For the later-added case SO_TIMESTAMPING_NEW: Be strict about only ++ * returning the flags when they were set through the same option. ++ * Don't change the beviour for the old case SO_TIMESTAMPING_OLD. ++ */ ++ if (optname == SO_TIMESTAMPING_OLD || sock_flag(sk, SOCK_TSTAMP_NEW)) { ++ v.timestamping.flags = sk->sk_tsflags; ++ v.timestamping.bind_phc = sk->sk_bind_phc; ++ } + break; + + case SO_RCVTIMEO_OLD: +-- +2.43.0 + diff --git a/queue-5.15/net-implement-missing-so_timestamping_new-cmsg-suppo.patch b/queue-5.15/net-implement-missing-so_timestamping_new-cmsg-suppo.patch new file mode 100644 index 00000000000..cf3b15c7dd7 --- /dev/null +++ b/queue-5.15/net-implement-missing-so_timestamping_new-cmsg-suppo.patch @@ -0,0 +1,40 @@ +From 8e4360ee99a5c6322ac5ca3a3613b14efd767aa7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jan 2024 09:57:44 +0100 +Subject: net: Implement missing SO_TIMESTAMPING_NEW cmsg support + +From: Thomas Lange + +[ Upstream commit 382a32018b74f407008615e0e831d05ed28e81cd ] + +Commit 9718475e6908 ("socket: Add SO_TIMESTAMPING_NEW") added the new +socket option SO_TIMESTAMPING_NEW. However, it was never implemented in +__sock_cmsg_send thus breaking SO_TIMESTAMPING cmsg for platforms using +SO_TIMESTAMPING_NEW. + +Fixes: 9718475e6908 ("socket: Add SO_TIMESTAMPING_NEW") +Link: https://lore.kernel.org/netdev/6a7281bf-bc4a-4f75-bb88-7011908ae471@app.fastmail.com/ +Signed-off-by: Thomas Lange +Reviewed-by: Willem de Bruijn +Link: https://lore.kernel.org/r/20240104085744.49164-1-thomas@corelatus.se +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/sock.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/core/sock.c b/net/core/sock.c +index ef29106af6046..e254790d562ef 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -2551,6 +2551,7 @@ int __sock_cmsg_send(struct sock *sk, struct msghdr *msg, struct cmsghdr *cmsg, + sockc->mark = *(u32 *)CMSG_DATA(cmsg); + break; + case SO_TIMESTAMPING_OLD: ++ case SO_TIMESTAMPING_NEW: + if (cmsg->cmsg_len != CMSG_LEN(sizeof(u32))) + return -EINVAL; + +-- +2.43.0 + diff --git a/queue-5.15/net-qla3xxx-fix-potential-memleak-in-ql_alloc_buffer.patch b/queue-5.15/net-qla3xxx-fix-potential-memleak-in-ql_alloc_buffer.patch new file mode 100644 index 00000000000..8348ca2de8d --- /dev/null +++ b/queue-5.15/net-qla3xxx-fix-potential-memleak-in-ql_alloc_buffer.patch @@ -0,0 +1,44 @@ +From 9039b5144248d5fb8de0387ae16ffed1a1f8ad2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Dec 2023 15:02:27 +0800 +Subject: net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues + +From: Dinghao Liu + +[ Upstream commit 89f45c30172c80e55c887f32f1af8e184124577b ] + +When dma_alloc_coherent() fails, we should free qdev->lrg_buf +to prevent potential memleak. + +Fixes: 1357bfcf7106 ("qla3xxx: Dynamically size the rx buffer queue based on the MTU.") +Signed-off-by: Dinghao Liu +Link: https://lore.kernel.org/r/20231227070227.10527-1-dinghao.liu@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qla3xxx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c +index 29837e533cee8..127daad4410b9 100644 +--- a/drivers/net/ethernet/qlogic/qla3xxx.c ++++ b/drivers/net/ethernet/qlogic/qla3xxx.c +@@ -2589,6 +2589,7 @@ static int ql_alloc_buffer_queues(struct ql3_adapter *qdev) + + if (qdev->lrg_buf_q_alloc_virt_addr == NULL) { + netdev_err(qdev->ndev, "lBufQ failed\n"); ++ kfree(qdev->lrg_buf); + return -ENOMEM; + } + qdev->lrg_buf_q_virt_addr = qdev->lrg_buf_q_alloc_virt_addr; +@@ -2613,6 +2614,7 @@ static int ql_alloc_buffer_queues(struct ql3_adapter *qdev) + qdev->lrg_buf_q_alloc_size, + qdev->lrg_buf_q_alloc_virt_addr, + qdev->lrg_buf_q_alloc_phy_addr); ++ kfree(qdev->lrg_buf); + return -ENOMEM; + } + +-- +2.43.0 + diff --git a/queue-5.15/net-save-and-restore-msg_namelen-in-sock_sendmsg.patch b/queue-5.15/net-save-and-restore-msg_namelen-in-sock_sendmsg.patch new file mode 100644 index 00000000000..69722627b22 --- /dev/null +++ b/queue-5.15/net-save-and-restore-msg_namelen-in-sock_sendmsg.patch @@ -0,0 +1,55 @@ +From 81e027a22ca659d990a4cafc888d9d316001f5e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Dec 2023 09:12:30 -0400 +Subject: net: Save and restore msg_namelen in sock_sendmsg + +From: Marc Dionne + +[ Upstream commit 01b2885d9415152bcb12ff1f7788f500a74ea0ed ] + +Commit 86a7e0b69bd5 ("net: prevent rewrite of msg_name in +sock_sendmsg()") made sock_sendmsg save the incoming msg_name pointer +and restore it before returning, to insulate the caller against +msg_name being changed by the called code. If the address length +was also changed however, we may return with an inconsistent structure +where the length doesn't match the address, and attempts to reuse it may +lead to lost packets. + +For example, a kernel that doesn't have commit 1c5950fc6fe9 ("udp6: fix +potential access to stale information") will replace a v4 mapped address +with its ipv4 equivalent, and shorten namelen accordingly from 28 to 16. +If the caller attempts to reuse the resulting msg structure, it will have +the original ipv6 (v4 mapped) address but an incorrect v4 length. + +Fixes: 86a7e0b69bd5 ("net: prevent rewrite of msg_name in sock_sendmsg()") +Signed-off-by: Marc Dionne +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/socket.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/socket.c b/net/socket.c +index 57c2b78b446b5..f7cfc703bd213 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -728,6 +728,7 @@ int sock_sendmsg(struct socket *sock, struct msghdr *msg) + { + struct sockaddr_storage *save_addr = (struct sockaddr_storage *)msg->msg_name; + struct sockaddr_storage address; ++ int save_len = msg->msg_namelen; + int ret; + + if (msg->msg_name) { +@@ -737,6 +738,7 @@ int sock_sendmsg(struct socket *sock, struct msghdr *msg) + + ret = __sock_sendmsg(sock, msg); + msg->msg_name = save_addr; ++ msg->msg_namelen = save_len; + + return ret; + } +-- +2.43.0 + diff --git a/queue-5.15/net-sched-em_text-fix-possible-memory-leak-in-em_tex.patch b/queue-5.15/net-sched-em_text-fix-possible-memory-leak-in-em_tex.patch new file mode 100644 index 00000000000..0aed3ccd089 --- /dev/null +++ b/queue-5.15/net-sched-em_text-fix-possible-memory-leak-in-em_tex.patch @@ -0,0 +1,40 @@ +From f00d47d7f3ea41a20252375a8e53ee090edc8fd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Dec 2023 10:25:31 +0800 +Subject: net: sched: em_text: fix possible memory leak in em_text_destroy() + +From: Hangyu Hua + +[ Upstream commit 8fcb0382af6f1ef50936f1be05b8149eb2f88496 ] + +m->data needs to be freed when em_text_destroy is called. + +Fixes: d675c989ed2d ("[PKT_SCHED]: Packet classification based on textsearch (ematch)") +Acked-by: Jamal Hadi Salim +Signed-off-by: Hangyu Hua +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/em_text.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/sched/em_text.c b/net/sched/em_text.c +index 6f3c1fb2fb44c..f176afb70559e 100644 +--- a/net/sched/em_text.c ++++ b/net/sched/em_text.c +@@ -97,8 +97,10 @@ static int em_text_change(struct net *net, void *data, int len, + + static void em_text_destroy(struct tcf_ematch *m) + { +- if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) ++ if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) { + textsearch_destroy(EM_TEXT_PRIV(m)->config); ++ kfree(EM_TEXT_PRIV(m)); ++ } + } + + static int em_text_dump(struct sk_buff *skb, struct tcf_ematch *m) +-- +2.43.0 + diff --git a/queue-5.15/net-timestamp-extend-sof_timestamping_opt_id-to-hw-t.patch b/queue-5.15/net-timestamp-extend-sof_timestamping_opt_id-to-hw-t.patch new file mode 100644 index 00000000000..2bff917c947 --- /dev/null +++ b/queue-5.15/net-timestamp-extend-sof_timestamping_opt_id-to-hw-t.patch @@ -0,0 +1,52 @@ +From 67b51411f5edf25ebd6046ed583ef67065a468b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 08:07:38 -0800 +Subject: net-timestamp: extend SOF_TIMESTAMPING_OPT_ID to HW timestamps + +From: Vadim Fedorenko + +[ Upstream commit 8ca5a5790b9a1ce147484d2a2c4e66d2553f3d6c ] + +When the feature was added it was enabled for SW timestamps only but +with current hardware the same out-of-order timestamps can be seen. +Let's expand the area for the feature to all types of timestamps. + +Signed-off-by: Vadim Fedorenko +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Stable-dep-of: 7f6ca95d16b9 ("net: Implement missing getsockopt(SO_TIMESTAMPING_NEW)") +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_output.c | 2 +- + net/ipv6/ip6_output.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index a5f09d64c6ed1..a445e4e05e0d1 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -990,7 +990,7 @@ static int __ip_append_data(struct sock *sk, + mtu = cork->gso_size ? IP_MAX_MTU : cork->fragsize; + paged = !!cork->gso_size; + +- if (cork->tx_flags & SKBTX_ANY_SW_TSTAMP && ++ if (cork->tx_flags & SKBTX_ANY_TSTAMP && + sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID) + tskey = atomic_inc_return(&sk->sk_tskey) - 1; + +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 5045b479c2a95..7205473ba28d3 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -1484,7 +1484,7 @@ static int __ip6_append_data(struct sock *sk, + mtu = cork->gso_size ? IP6_MAX_MTU : cork->fragsize; + orig_mtu = mtu; + +- if (cork->tx_flags & SKBTX_ANY_SW_TSTAMP && ++ if (cork->tx_flags & SKBTX_ANY_TSTAMP && + sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID) + tskey = atomic_inc_return(&sk->sk_tskey) - 1; + +-- +2.43.0 + diff --git a/queue-5.15/netfilter-nft_immediate-drop-chain-reference-counter.patch b/queue-5.15/netfilter-nft_immediate-drop-chain-reference-counter.patch new file mode 100644 index 00000000000..8d59a9f428f --- /dev/null +++ b/queue-5.15/netfilter-nft_immediate-drop-chain-reference-counter.patch @@ -0,0 +1,36 @@ +From 387850842ac6770401e2146098b5ba0a6804be82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jan 2024 20:15:33 +0100 +Subject: netfilter: nft_immediate: drop chain reference counter on error + +From: Pablo Neira Ayuso + +[ Upstream commit b29be0ca8e816119ccdf95cc7d7c7be9bde005f1 ] + +In the init path, nft_data_init() bumps the chain reference counter, +decrement it on error by following the error path which calls +nft_data_release() to restore it. + +Fixes: 4bedf9eee016 ("netfilter: nf_tables: fix chain binding transaction logic") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_immediate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c +index 7d5b63c5a30af..d154fe67ca8a6 100644 +--- a/net/netfilter/nft_immediate.c ++++ b/net/netfilter/nft_immediate.c +@@ -78,7 +78,7 @@ static int nft_immediate_init(const struct nft_ctx *ctx, + case NFT_GOTO: + err = nf_tables_bind_chain(ctx, chain); + if (err < 0) +- return err; ++ goto err1; + break; + default: + break; +-- +2.43.0 + diff --git a/queue-5.15/nfc-llcp_core-hold-a-ref-to-llcp_local-dev-when-hold.patch b/queue-5.15/nfc-llcp_core-hold-a-ref-to-llcp_local-dev-when-hold.patch new file mode 100644 index 00000000000..21aea096b51 --- /dev/null +++ b/queue-5.15/nfc-llcp_core-hold-a-ref-to-llcp_local-dev-when-hold.patch @@ -0,0 +1,128 @@ +From aa2d6782fad631f46b11fe2aded96a95f73cdfa8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 23:19:43 +0530 +Subject: nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to + llcp_local + +From: Siddh Raman Pant + +[ Upstream commit c95f919567d6f1914f13350af61a1b044ac85014 ] + +llcp_sock_sendmsg() calls nfc_llcp_send_ui_frame() which in turn calls +nfc_alloc_send_skb(), which accesses the nfc_dev from the llcp_sock for +getting the headroom and tailroom needed for skb allocation. + +Parallelly the nfc_dev can be freed, as the refcount is decreased via +nfc_free_device(), leading to a UAF reported by Syzkaller, which can +be summarized as follows: + +(1) llcp_sock_sendmsg() -> nfc_llcp_send_ui_frame() + -> nfc_alloc_send_skb() -> Dereference *nfc_dev +(2) virtual_ncidev_close() -> nci_free_device() -> nfc_free_device() + -> put_device() -> nfc_release() -> Free *nfc_dev + +When a reference to llcp_local is acquired, we do not acquire the same +for the nfc_dev. This leads to freeing even when the llcp_local is in +use, and this is the case with the UAF described above too. + +Thus, when we acquire a reference to llcp_local, we should acquire a +reference to nfc_dev, and release the references appropriately later. + +References for llcp_local is initialized in nfc_llcp_register_device() +(which is called by nfc_register_device()). Thus, we should acquire a +reference to nfc_dev there. + +nfc_unregister_device() calls nfc_llcp_unregister_device() which in +turn calls nfc_llcp_local_put(). Thus, the reference to nfc_dev is +appropriately released later. + +Reported-and-tested-by: syzbot+bbe84a4010eeea00982d@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=bbe84a4010eeea00982d +Fixes: c7aa12252f51 ("NFC: Take a reference on the LLCP local pointer when creating a socket") +Reviewed-by: Suman Ghosh +Signed-off-by: Siddh Raman Pant +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/nfc/llcp_core.c | 39 ++++++++++++++++++++++++++++++++++++--- + 1 file changed, 36 insertions(+), 3 deletions(-) + +diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c +index 92f70686bee0a..da3cb0d29b972 100644 +--- a/net/nfc/llcp_core.c ++++ b/net/nfc/llcp_core.c +@@ -147,6 +147,13 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool device, + + static struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local) + { ++ /* Since using nfc_llcp_local may result in usage of nfc_dev, whenever ++ * we hold a reference to local, we also need to hold a reference to ++ * the device to avoid UAF. ++ */ ++ if (!nfc_get_device(local->dev->idx)) ++ return NULL; ++ + kref_get(&local->ref); + + return local; +@@ -179,10 +186,18 @@ static void local_release(struct kref *ref) + + int nfc_llcp_local_put(struct nfc_llcp_local *local) + { ++ struct nfc_dev *dev; ++ int ret; ++ + if (local == NULL) + return 0; + +- return kref_put(&local->ref, local_release); ++ dev = local->dev; ++ ++ ret = kref_put(&local->ref, local_release); ++ nfc_put_device(dev); ++ ++ return ret; + } + + static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local, +@@ -968,8 +983,17 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_local *local, + } + + new_sock = nfc_llcp_sock(new_sk); +- new_sock->dev = local->dev; ++ + new_sock->local = nfc_llcp_local_get(local); ++ if (!new_sock->local) { ++ reason = LLCP_DM_REJ; ++ sock_put(&new_sock->sk); ++ release_sock(&sock->sk); ++ sock_put(&sock->sk); ++ goto fail; ++ } ++ ++ new_sock->dev = local->dev; + new_sock->rw = sock->rw; + new_sock->miux = sock->miux; + new_sock->nfc_protocol = sock->nfc_protocol; +@@ -1607,7 +1631,16 @@ int nfc_llcp_register_device(struct nfc_dev *ndev) + if (local == NULL) + return -ENOMEM; + +- local->dev = ndev; ++ /* As we are going to initialize local's refcount, we need to get the ++ * nfc_dev to avoid UAF, otherwise there is no point in continuing. ++ * See nfc_llcp_local_get(). ++ */ ++ local->dev = nfc_get_device(ndev->idx); ++ if (!local->dev) { ++ kfree(local); ++ return -ENODEV; ++ } ++ + INIT_LIST_HEAD(&local->list); + kref_init(&local->ref); + mutex_init(&local->sdp_lock); +-- +2.43.0 + diff --git a/queue-5.15/octeontx2-af-always-configure-nix-tx-link-credits-ba.patch b/queue-5.15/octeontx2-af-always-configure-nix-tx-link-credits-ba.patch new file mode 100644 index 00000000000..19fc3604713 --- /dev/null +++ b/queue-5.15/octeontx2-af-always-configure-nix-tx-link-credits-ba.patch @@ -0,0 +1,184 @@ +From 7cf6c3093cc8b8b944d429d23b180865b5eda01d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jan 2024 15:26:43 +0530 +Subject: octeontx2-af: Always configure NIX TX link credits based on max frame + size + +From: Naveen Mamindlapalli + +[ Upstream commit a0d9528f6daf7fe8de217fa80a94d2989d2a57a7 ] + +Currently the NIX TX link credits are initialized based on the max frame +size that can be transmitted on a link but when the MTU is changed, the +NIX TX link credits are reprogrammed by the SW based on the new MTU value. +Since SMQ max packet length is programmed to max frame size by default, +there is a chance that NIX TX may stall while sending a max frame sized +packet on the link with insufficient credits to send the packet all at +once. This patch avoids stall issue by not changing the link credits +dynamically when the MTU is changed. + +Fixes: 1c74b89171c3 ("octeontx2-af: Wait for TX link idle for credits change") +Signed-off-by: Naveen Mamindlapalli +Signed-off-by: Sunil Kovvuri Goutham +Signed-off-by: Nithin Kumar Dabilpuram +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../ethernet/marvell/octeontx2/af/rvu_nix.c | 110 +----------------- + 1 file changed, 3 insertions(+), 107 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index 874248499ef9a..cb082f5e6cda9 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -3877,90 +3877,18 @@ static void nix_find_link_frs(struct rvu *rvu, + req->minlen = minlen; + } + +-static int +-nix_config_link_credits(struct rvu *rvu, int blkaddr, int link, +- u16 pcifunc, u64 tx_credits) +-{ +- struct rvu_hwinfo *hw = rvu->hw; +- int pf = rvu_get_pf(pcifunc); +- u8 cgx_id = 0, lmac_id = 0; +- unsigned long poll_tmo; +- bool restore_tx_en = 0; +- struct nix_hw *nix_hw; +- u64 cfg, sw_xoff = 0; +- u32 schq = 0; +- u32 credits; +- int rc; +- +- nix_hw = get_nix_hw(rvu->hw, blkaddr); +- if (!nix_hw) +- return NIX_AF_ERR_INVALID_NIXBLK; +- +- if (tx_credits == nix_hw->tx_credits[link]) +- return 0; +- +- /* Enable cgx tx if disabled for credits to be back */ +- if (is_pf_cgxmapped(rvu, pf)) { +- rvu_get_cgx_lmac_id(rvu->pf2cgxlmac_map[pf], &cgx_id, &lmac_id); +- restore_tx_en = !rvu_cgx_config_tx(rvu_cgx_pdata(cgx_id, rvu), +- lmac_id, true); +- } +- +- mutex_lock(&rvu->rsrc_lock); +- /* Disable new traffic to link */ +- if (hw->cap.nix_shaping) { +- schq = nix_get_tx_link(rvu, pcifunc); +- sw_xoff = rvu_read64(rvu, blkaddr, NIX_AF_TL1X_SW_XOFF(schq)); +- rvu_write64(rvu, blkaddr, +- NIX_AF_TL1X_SW_XOFF(schq), BIT_ULL(0)); +- } +- +- rc = NIX_AF_ERR_LINK_CREDITS; +- poll_tmo = jiffies + usecs_to_jiffies(200000); +- /* Wait for credits to return */ +- do { +- if (time_after(jiffies, poll_tmo)) +- goto exit; +- usleep_range(100, 200); +- +- cfg = rvu_read64(rvu, blkaddr, +- NIX_AF_TX_LINKX_NORM_CREDIT(link)); +- credits = (cfg >> 12) & 0xFFFFFULL; +- } while (credits != nix_hw->tx_credits[link]); +- +- cfg &= ~(0xFFFFFULL << 12); +- cfg |= (tx_credits << 12); +- rvu_write64(rvu, blkaddr, NIX_AF_TX_LINKX_NORM_CREDIT(link), cfg); +- rc = 0; +- +- nix_hw->tx_credits[link] = tx_credits; +- +-exit: +- /* Enable traffic back */ +- if (hw->cap.nix_shaping && !sw_xoff) +- rvu_write64(rvu, blkaddr, NIX_AF_TL1X_SW_XOFF(schq), 0); +- +- /* Restore state of cgx tx */ +- if (restore_tx_en) +- rvu_cgx_config_tx(rvu_cgx_pdata(cgx_id, rvu), lmac_id, false); +- +- mutex_unlock(&rvu->rsrc_lock); +- return rc; +-} +- + int rvu_mbox_handler_nix_set_hw_frs(struct rvu *rvu, struct nix_frs_cfg *req, + struct msg_rsp *rsp) + { + struct rvu_hwinfo *hw = rvu->hw; + u16 pcifunc = req->hdr.pcifunc; + int pf = rvu_get_pf(pcifunc); +- int blkaddr, schq, link = -1; +- struct nix_txsch *txsch; +- u64 cfg, lmac_fifo_len; ++ int blkaddr, link = -1; + struct nix_hw *nix_hw; + struct rvu_pfvf *pfvf; + u8 cgx = 0, lmac = 0; + u16 max_mtu; ++ u64 cfg; + + blkaddr = rvu_get_blkaddr(rvu, BLKTYPE_NIX, pcifunc); + if (blkaddr < 0) +@@ -3981,25 +3909,6 @@ int rvu_mbox_handler_nix_set_hw_frs(struct rvu *rvu, struct nix_frs_cfg *req, + if (req->update_minlen && req->minlen < NIC_HW_MIN_FRS) + return NIX_AF_ERR_FRS_INVALID; + +- /* Check if requester wants to update SMQ's */ +- if (!req->update_smq) +- goto rx_frscfg; +- +- /* Update min/maxlen in each of the SMQ attached to this PF/VF */ +- txsch = &nix_hw->txsch[NIX_TXSCH_LVL_SMQ]; +- mutex_lock(&rvu->rsrc_lock); +- for (schq = 0; schq < txsch->schq.max; schq++) { +- if (TXSCH_MAP_FUNC(txsch->pfvf_map[schq]) != pcifunc) +- continue; +- cfg = rvu_read64(rvu, blkaddr, NIX_AF_SMQX_CFG(schq)); +- cfg = (cfg & ~(0xFFFFULL << 8)) | ((u64)req->maxlen << 8); +- if (req->update_minlen) +- cfg = (cfg & ~0x7FULL) | ((u64)req->minlen & 0x7F); +- rvu_write64(rvu, blkaddr, NIX_AF_SMQX_CFG(schq), cfg); +- } +- mutex_unlock(&rvu->rsrc_lock); +- +-rx_frscfg: + /* Check if config is for SDP link */ + if (req->sdp_link) { + if (!hw->sdp_links) +@@ -4022,7 +3931,6 @@ int rvu_mbox_handler_nix_set_hw_frs(struct rvu *rvu, struct nix_frs_cfg *req, + if (link < 0) + return NIX_AF_ERR_RX_LINK_INVALID; + +- + linkcfg: + nix_find_link_frs(rvu, req, pcifunc); + +@@ -4032,19 +3940,7 @@ int rvu_mbox_handler_nix_set_hw_frs(struct rvu *rvu, struct nix_frs_cfg *req, + cfg = (cfg & ~0xFFFFULL) | req->minlen; + rvu_write64(rvu, blkaddr, NIX_AF_RX_LINKX_CFG(link), cfg); + +- if (req->sdp_link || pf == 0) +- return 0; +- +- /* Update transmit credits for CGX links */ +- lmac_fifo_len = rvu_cgx_get_lmac_fifolen(rvu, cgx, lmac); +- if (!lmac_fifo_len) { +- dev_err(rvu->dev, +- "%s: Failed to get CGX/RPM%d:LMAC%d FIFO size\n", +- __func__, cgx, lmac); +- return 0; +- } +- return nix_config_link_credits(rvu, blkaddr, link, pcifunc, +- (lmac_fifo_len - req->maxlen) / 16); ++ return 0; + } + + int rvu_mbox_handler_nix_set_rx_cfg(struct rvu *rvu, struct nix_rx_cfg *req, +-- +2.43.0 + diff --git a/queue-5.15/octeontx2-af-don-t-enable-pause-frames-by-default.patch b/queue-5.15/octeontx2-af-don-t-enable-pause-frames-by-default.patch new file mode 100644 index 00000000000..aaf8831f726 --- /dev/null +++ b/queue-5.15/octeontx2-af-don-t-enable-pause-frames-by-default.patch @@ -0,0 +1,270 @@ +From b5a1058b19d4466ba6e9b3c0a4751d67de3de2c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Feb 2022 12:45:16 +0530 +Subject: octeontx2-af: Don't enable Pause frames by default + +From: Hariprasad Kelam + +[ Upstream commit d957b51f7ed66dbe6102f1bba0587fdfc0119a94 ] + +Current implementation is such that 802.3x pause frames are +enabled by default. As CGX and RPM blocks support PFC +(priority flow control) also, instead of driver enabling one +between them enable them upon request from PF or its VFs. +Also add support to disable pause frames in driver unbind. + +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Kovvuri Goutham +Signed-off-by: David S. Miller +Stable-dep-of: a0d9528f6daf ("octeontx2-af: Always configure NIX TX link credits based on max frame size") +Signed-off-by: Sasha Levin +--- + .../net/ethernet/marvell/octeontx2/af/cgx.c | 41 ++++++---------- + .../net/ethernet/marvell/octeontx2/af/rpm.c | 47 +++++-------------- + .../ethernet/marvell/octeontx2/af/rvu_nix.c | 8 ---- + .../marvell/octeontx2/nic/otx2_common.c | 1 + + .../ethernet/marvell/octeontx2/nic/otx2_pf.c | 15 +++--- + .../ethernet/marvell/octeontx2/nic/otx2_vf.c | 12 +++-- + 6 files changed, 44 insertions(+), 80 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +index 8ac95cb7bbb74..098504aa0fd2b 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +@@ -789,21 +789,8 @@ static void cgx_lmac_pause_frm_config(void *cgxd, int lmac_id, bool enable) + + if (!is_lmac_valid(cgx, lmac_id)) + return; +- if (enable) { +- /* Enable receive pause frames */ +- cfg = cgx_read(cgx, lmac_id, CGXX_SMUX_RX_FRM_CTL); +- cfg |= CGX_SMUX_RX_FRM_CTL_CTL_BCK; +- cgx_write(cgx, lmac_id, CGXX_SMUX_RX_FRM_CTL, cfg); +- +- cfg = cgx_read(cgx, lmac_id, CGXX_GMP_GMI_RXX_FRM_CTL); +- cfg |= CGX_GMP_GMI_RXX_FRM_CTL_CTL_BCK; +- cgx_write(cgx, lmac_id, CGXX_GMP_GMI_RXX_FRM_CTL, cfg); +- +- /* Enable pause frames transmission */ +- cfg = cgx_read(cgx, lmac_id, CGXX_SMUX_TX_CTL); +- cfg |= CGX_SMUX_TX_CTL_L2P_BP_CONV; +- cgx_write(cgx, lmac_id, CGXX_SMUX_TX_CTL, cfg); + ++ if (enable) { + /* Set pause time and interval */ + cgx_write(cgx, lmac_id, CGXX_SMUX_TX_PAUSE_PKT_TIME, + DEFAULT_PAUSE_TIME); +@@ -820,21 +807,21 @@ static void cgx_lmac_pause_frm_config(void *cgxd, int lmac_id, bool enable) + cfg &= ~0xFFFFULL; + cgx_write(cgx, lmac_id, CGXX_GMP_GMI_TX_PAUSE_PKT_INTERVAL, + cfg | (DEFAULT_PAUSE_TIME / 2)); +- } else { +- /* ALL pause frames received are completely ignored */ +- cfg = cgx_read(cgx, lmac_id, CGXX_SMUX_RX_FRM_CTL); +- cfg &= ~CGX_SMUX_RX_FRM_CTL_CTL_BCK; +- cgx_write(cgx, lmac_id, CGXX_SMUX_RX_FRM_CTL, cfg); ++ } + +- cfg = cgx_read(cgx, lmac_id, CGXX_GMP_GMI_RXX_FRM_CTL); +- cfg &= ~CGX_GMP_GMI_RXX_FRM_CTL_CTL_BCK; +- cgx_write(cgx, lmac_id, CGXX_GMP_GMI_RXX_FRM_CTL, cfg); ++ /* ALL pause frames received are completely ignored */ ++ cfg = cgx_read(cgx, lmac_id, CGXX_SMUX_RX_FRM_CTL); ++ cfg &= ~CGX_SMUX_RX_FRM_CTL_CTL_BCK; ++ cgx_write(cgx, lmac_id, CGXX_SMUX_RX_FRM_CTL, cfg); + +- /* Disable pause frames transmission */ +- cfg = cgx_read(cgx, lmac_id, CGXX_SMUX_TX_CTL); +- cfg &= ~CGX_SMUX_TX_CTL_L2P_BP_CONV; +- cgx_write(cgx, lmac_id, CGXX_SMUX_TX_CTL, cfg); +- } ++ cfg = cgx_read(cgx, lmac_id, CGXX_GMP_GMI_RXX_FRM_CTL); ++ cfg &= ~CGX_GMP_GMI_RXX_FRM_CTL_CTL_BCK; ++ cgx_write(cgx, lmac_id, CGXX_GMP_GMI_RXX_FRM_CTL, cfg); ++ ++ /* Disable pause frames transmission */ ++ cfg = cgx_read(cgx, lmac_id, CGXX_SMUX_TX_CTL); ++ cfg &= ~CGX_SMUX_TX_CTL_L2P_BP_CONV; ++ cgx_write(cgx, lmac_id, CGXX_SMUX_TX_CTL, cfg); + } + + void cgx_lmac_ptp_config(void *cgxd, int lmac_id, bool enable) +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c +index 9ea2f6ac38ec1..8c0b35a868cfe 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c +@@ -167,26 +167,6 @@ void rpm_lmac_pause_frm_config(void *rpmd, int lmac_id, bool enable) + u64 cfg; + + if (enable) { +- /* Enable 802.3 pause frame mode */ +- cfg = rpm_read(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG); +- cfg &= ~RPMX_MTI_MAC100X_COMMAND_CONFIG_PFC_MODE; +- rpm_write(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG, cfg); +- +- /* Enable receive pause frames */ +- cfg = rpm_read(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG); +- cfg &= ~RPMX_MTI_MAC100X_COMMAND_CONFIG_RX_P_DISABLE; +- rpm_write(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG, cfg); +- +- /* Enable forward pause to TX block */ +- cfg = rpm_read(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG); +- cfg &= ~RPMX_MTI_MAC100X_COMMAND_CONFIG_PAUSE_IGNORE; +- rpm_write(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG, cfg); +- +- /* Enable pause frames transmission */ +- cfg = rpm_read(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG); +- cfg &= ~RPMX_MTI_MAC100X_COMMAND_CONFIG_TX_P_DISABLE; +- rpm_write(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG, cfg); +- + /* Set pause time and interval */ + cfg = rpm_read(rpm, lmac_id, + RPMX_MTI_MAC100X_CL01_PAUSE_QUANTA); +@@ -199,23 +179,22 @@ void rpm_lmac_pause_frm_config(void *rpmd, int lmac_id, bool enable) + cfg &= ~0xFFFFULL; + rpm_write(rpm, lmac_id, RPMX_MTI_MAC100X_CL01_QUANTA_THRESH, + cfg | (RPM_DEFAULT_PAUSE_TIME / 2)); ++ } + +- } else { +- /* ALL pause frames received are completely ignored */ +- cfg = rpm_read(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG); +- cfg |= RPMX_MTI_MAC100X_COMMAND_CONFIG_RX_P_DISABLE; +- rpm_write(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG, cfg); ++ /* ALL pause frames received are completely ignored */ ++ cfg = rpm_read(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG); ++ cfg |= RPMX_MTI_MAC100X_COMMAND_CONFIG_RX_P_DISABLE; ++ rpm_write(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG, cfg); + +- /* Disable forward pause to TX block */ +- cfg = rpm_read(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG); +- cfg |= RPMX_MTI_MAC100X_COMMAND_CONFIG_PAUSE_IGNORE; +- rpm_write(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG, cfg); ++ /* Disable forward pause to TX block */ ++ cfg = rpm_read(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG); ++ cfg |= RPMX_MTI_MAC100X_COMMAND_CONFIG_PAUSE_IGNORE; ++ rpm_write(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG, cfg); + +- /* Disable pause frames transmission */ +- cfg = rpm_read(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG); +- cfg |= RPMX_MTI_MAC100X_COMMAND_CONFIG_TX_P_DISABLE; +- rpm_write(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG, cfg); +- } ++ /* Disable pause frames transmission */ ++ cfg = rpm_read(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG); ++ cfg |= RPMX_MTI_MAC100X_COMMAND_CONFIG_TX_P_DISABLE; ++ rpm_write(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG, cfg); + } + + int rpm_get_rx_stats(void *rpmd, int lmac_id, int idx, u64 *rx_stat) +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index 5f9f6da5c45bb..1ab9dc544eeea 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -296,7 +296,6 @@ static int nix_interface_init(struct rvu *rvu, u16 pcifunc, int type, int nixlf, + struct rvu_hwinfo *hw = rvu->hw; + struct sdp_node_info *sdp_info; + int pkind, pf, vf, lbkid, vfid; +- struct mac_ops *mac_ops; + u8 cgx_id, lmac_id; + bool from_vf; + int err; +@@ -326,13 +325,6 @@ static int nix_interface_init(struct rvu *rvu, u16 pcifunc, int type, int nixlf, + cgx_set_pkind(rvu_cgx_pdata(cgx_id, rvu), lmac_id, pkind); + rvu_npc_set_pkind(rvu, pkind, pfvf); + +- mac_ops = get_mac_ops(rvu_cgx_pdata(cgx_id, rvu)); +- +- /* By default we enable pause frames */ +- if ((pcifunc & RVU_PFVF_FUNC_MASK) == 0) +- mac_ops->mac_enadis_pause_frm(rvu_cgx_pdata(cgx_id, +- rvu), +- lmac_id, true, true); + break; + case NIX_INTF_TYPE_LBK: + vf = (pcifunc & RVU_PFVF_FUNC_MASK) - 1; +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +index b743646993ca2..572c981171bac 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +@@ -262,6 +262,7 @@ int otx2_config_pause_frm(struct otx2_nic *pfvf) + mutex_unlock(&pfvf->mbox.lock); + return err; + } ++EXPORT_SYMBOL(otx2_config_pause_frm); + + int otx2_set_flowkey_cfg(struct otx2_nic *pfvf) + { +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +index f9bb0e9e73592..167b926196c83 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +@@ -1785,9 +1785,6 @@ int otx2_open(struct net_device *netdev) + if (pf->linfo.link_up && !(pf->pcifunc & RVU_PFVF_FUNC_MASK)) + otx2_handle_link_event(pf); + +- /* Restore pause frame settings */ +- otx2_config_pause_frm(pf); +- + /* Install DMAC Filters */ + if (pf->flags & OTX2_FLAG_DMACFLTR_SUPPORT) + otx2_dmacflt_reinstall_flows(pf); +@@ -2777,10 +2774,6 @@ static int otx2_probe(struct pci_dev *pdev, const struct pci_device_id *id) + /* Enable link notifications */ + otx2_cgx_config_linkevents(pf, true); + +- /* Enable pause frames by default */ +- pf->flags |= OTX2_FLAG_RX_PAUSE_ENABLED; +- pf->flags |= OTX2_FLAG_TX_PAUSE_ENABLED; +- + return 0; + + err_pf_sriov_init: +@@ -2924,6 +2917,14 @@ static void otx2_remove(struct pci_dev *pdev) + if (pf->flags & OTX2_FLAG_RX_TSTAMP_ENABLED) + otx2_config_hw_rx_tstamp(pf, false); + ++ /* Disable 802.3x pause frames */ ++ if (pf->flags & OTX2_FLAG_RX_PAUSE_ENABLED || ++ (pf->flags & OTX2_FLAG_TX_PAUSE_ENABLED)) { ++ pf->flags &= ~OTX2_FLAG_RX_PAUSE_ENABLED; ++ pf->flags &= ~OTX2_FLAG_TX_PAUSE_ENABLED; ++ otx2_config_pause_frm(pf); ++ } ++ + cancel_work_sync(&pf->reset_task); + /* Disable link notifications */ + otx2_cgx_config_linkevents(pf, false); +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +index e69b0e2729cb2..689e0853ab9cd 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +@@ -695,10 +695,6 @@ static int otx2vf_probe(struct pci_dev *pdev, const struct pci_device_id *id) + if (err) + goto err_unreg_netdev; + +- /* Enable pause frames by default */ +- vf->flags |= OTX2_FLAG_RX_PAUSE_ENABLED; +- vf->flags |= OTX2_FLAG_TX_PAUSE_ENABLED; +- + return 0; + + err_unreg_netdev: +@@ -732,6 +728,14 @@ static void otx2vf_remove(struct pci_dev *pdev) + + vf = netdev_priv(netdev); + ++ /* Disable 802.3x pause frames */ ++ if (vf->flags & OTX2_FLAG_RX_PAUSE_ENABLED || ++ (vf->flags & OTX2_FLAG_TX_PAUSE_ENABLED)) { ++ vf->flags &= ~OTX2_FLAG_RX_PAUSE_ENABLED; ++ vf->flags &= ~OTX2_FLAG_TX_PAUSE_ENABLED; ++ otx2_config_pause_frm(vf); ++ } ++ + cancel_work_sync(&vf->reset_task); + otx2_unregister_dl(vf); + unregister_netdev(netdev); +-- +2.43.0 + diff --git a/queue-5.15/octeontx2-af-fix-marking-couple-of-structure-as-__pa.patch b/queue-5.15/octeontx2-af-fix-marking-couple-of-structure-as-__pa.patch new file mode 100644 index 00000000000..be18c2f3696 --- /dev/null +++ b/queue-5.15/octeontx2-af-fix-marking-couple-of-structure-as-__pa.patch @@ -0,0 +1,46 @@ +From c9264c16328e07538e006567966dde293c98ae2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 19:56:33 +0530 +Subject: octeontx2-af: Fix marking couple of structure as __packed + +From: Suman Ghosh + +[ Upstream commit 0ee2384a5a0f3b4eeac8d10bb01a0609d245a4d1 ] + +Couple of structures was not marked as __packed. This patch +fixes the same and mark them as __packed. + +Fixes: 42006910b5ea ("octeontx2-af: cleanup KPU config data") +Signed-off-by: Suman Ghosh +Reviewed-by: Jacob Keller +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/npc.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/npc.h b/drivers/net/ethernet/marvell/octeontx2/af/npc.h +index 6e1192f526089..0f88efe39e41a 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/npc.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/npc.h +@@ -490,7 +490,7 @@ struct npc_lt_def { + u8 ltype_mask; + u8 ltype_match; + u8 lid; +-}; ++} __packed; + + struct npc_lt_def_ipsec { + u8 ltype_mask; +@@ -498,7 +498,7 @@ struct npc_lt_def_ipsec { + u8 lid; + u8 spi_offset; + u8 spi_nz; +-}; ++} __packed; + + struct npc_lt_def_apad { + u8 ltype_mask; +-- +2.43.0 + diff --git a/queue-5.15/octeontx2-af-re-enable-mac-tx-in-otx2_stop-processin.patch b/queue-5.15/octeontx2-af-re-enable-mac-tx-in-otx2_stop-processin.patch new file mode 100644 index 00000000000..8b7b93ba6a2 --- /dev/null +++ b/queue-5.15/octeontx2-af-re-enable-mac-tx-in-otx2_stop-processin.patch @@ -0,0 +1,93 @@ +From 30c1e229cb9ce6616beb1965b0cae7bb44faf22a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jan 2024 19:44:00 +0530 +Subject: octeontx2-af: Re-enable MAC TX in otx2_stop processing + +From: Naveen Mamindlapalli + +[ Upstream commit 818ed8933bd17bc91a9fa8b94a898189c546fc1a ] + +During QoS scheduling testing with multiple strict priority flows, the +netdev tx watchdog timeout routine is invoked when a low priority QoS +queue doesn't get a chance to transmit the packets because other high +priority flows are completely subscribing the transmit link. The netdev +tx watchdog timeout routine will stop MAC RX and TX functionality in +otx2_stop() routine before cleanup of HW TX queues which results in SMQ +flush errors because the packets belonging to low priority queues will +never gets flushed since MAC TX is disabled. This patch fixes the issue +by re-enabling MAC TX to ensure the packets in HW pipeline gets flushed +properly. + +Fixes: a7faa68b4e7f ("octeontx2-af: Start/Stop traffic in CGX along with NPC") +Signed-off-by: Naveen Mamindlapalli +Signed-off-by: Sunil Kovvuri Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + + .../net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 17 +++++++++++++++++ + .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 8 +++++++- + 3 files changed, 25 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +index 8d1df8a70ae0d..b4be1b597f331 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +@@ -813,6 +813,7 @@ u32 rvu_cgx_get_fifolen(struct rvu *rvu); + void *rvu_first_cgx_pdata(struct rvu *rvu); + int cgxlmac_to_pf(struct rvu *rvu, int cgx_id, int lmac_id); + int rvu_cgx_config_tx(void *cgxd, int lmac_id, bool enable); ++int rvu_cgx_tx_enable(struct rvu *rvu, u16 pcifunc, bool enable); + u32 rvu_cgx_get_lmac_fifolen(struct rvu *rvu, int cgx, int lmac); + int npc_get_nixlf_mcam_index(struct npc_mcam *mcam, u16 pcifunc, int nixlf, + int type); +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +index 4bd511b007cbc..dd231d9f89db1 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +@@ -456,6 +456,23 @@ int rvu_cgx_config_rxtx(struct rvu *rvu, u16 pcifunc, bool start) + return mac_ops->mac_rx_tx_enable(cgxd, lmac_id, start); + } + ++int rvu_cgx_tx_enable(struct rvu *rvu, u16 pcifunc, bool enable) ++{ ++ int pf = rvu_get_pf(pcifunc); ++ struct mac_ops *mac_ops; ++ u8 cgx_id, lmac_id; ++ void *cgxd; ++ ++ if (!is_cgx_config_permitted(rvu, pcifunc)) ++ return LMAC_AF_ERR_PERM_DENIED; ++ ++ rvu_get_cgx_lmac_id(rvu->pf2cgxlmac_map[pf], &cgx_id, &lmac_id); ++ cgxd = rvu_cgx_pdata(cgx_id, rvu); ++ mac_ops = get_mac_ops(cgxd); ++ ++ return mac_ops->mac_tx_enable(cgxd, lmac_id, enable); ++} ++ + int rvu_cgx_config_tx(void *cgxd, int lmac_id, bool enable) + { + struct mac_ops *mac_ops; +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index cb082f5e6cda9..bda93e550b08a 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -4447,7 +4447,13 @@ int rvu_mbox_handler_nix_lf_stop_rx(struct rvu *rvu, struct msg_req *req, + pfvf = rvu_get_pfvf(rvu, pcifunc); + clear_bit(NIXLF_INITIALIZED, &pfvf->flags); + +- return rvu_cgx_start_stop_io(rvu, pcifunc, false); ++ err = rvu_cgx_start_stop_io(rvu, pcifunc, false); ++ if (err) ++ return err; ++ ++ rvu_cgx_tx_enable(rvu, pcifunc, true); ++ ++ return 0; + } + + void rvu_nix_lf_teardown(struct rvu *rvu, u16 pcifunc, int blkaddr, int nixlf) +-- +2.43.0 + diff --git a/queue-5.15/octeontx2-af-set-nix-link-credits-based-on-max-lmac.patch b/queue-5.15/octeontx2-af-set-nix-link-credits-based-on-max-lmac.patch new file mode 100644 index 00000000000..f9105428582 --- /dev/null +++ b/queue-5.15/octeontx2-af-set-nix-link-credits-based-on-max-lmac.patch @@ -0,0 +1,252 @@ +From c309cfbbcffbf00c635431e27abdb5661c2e6e68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 11:05:55 +0530 +Subject: octeontx2-af: Set NIX link credits based on max LMAC + +From: Sunil Goutham + +[ Upstream commit 459f326e995ce6f02f3dc79ca5bc4e2abe33d156 ] + +When number of LMACs active on a CGX/RPM are 3, then +current NIX link credit config based on per lmac fifo +length which inturn is calculated as +'lmac_fifo_len = total_fifo_len / 3', is incorrect. In HW +one of the LMAC gets half of the FIFO and rest gets 1/4th. + +Signed-off-by: Nithin Dabilpuram +Signed-off-by: Sunil Goutham +Signed-off-by: Geetha Sowjanya +Signed-off-by: David S. Miller +Stable-dep-of: a0d9528f6daf ("octeontx2-af: Always configure NIX TX link credits based on max frame size") +Signed-off-by: Sasha Levin +--- + .../net/ethernet/marvell/octeontx2/af/cgx.c | 27 +++++++++++++++ + .../marvell/octeontx2/af/lmac_common.h | 1 + + .../net/ethernet/marvell/octeontx2/af/rpm.c | 30 ++++++++++++++++ + .../net/ethernet/marvell/octeontx2/af/rpm.h | 1 + + .../net/ethernet/marvell/octeontx2/af/rvu.h | 2 +- + .../ethernet/marvell/octeontx2/af/rvu_cgx.c | 16 +++++++++ + .../ethernet/marvell/octeontx2/af/rvu_nix.c | 34 ++++++++++++++----- + 7 files changed, 102 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +index 098504aa0fd2b..1a269a2e61fdb 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +@@ -505,6 +505,32 @@ static u8 cgx_get_lmac_type(void *cgxd, int lmac_id) + return (cfg >> CGX_LMAC_TYPE_SHIFT) & CGX_LMAC_TYPE_MASK; + } + ++static u32 cgx_get_lmac_fifo_len(void *cgxd, int lmac_id) ++{ ++ struct cgx *cgx = cgxd; ++ u8 num_lmacs; ++ u32 fifo_len; ++ ++ fifo_len = cgx->mac_ops->fifo_len; ++ num_lmacs = cgx->mac_ops->get_nr_lmacs(cgx); ++ ++ switch (num_lmacs) { ++ case 1: ++ return fifo_len; ++ case 2: ++ return fifo_len / 2; ++ case 3: ++ /* LMAC0 gets half of the FIFO, reset 1/4th */ ++ if (lmac_id == 0) ++ return fifo_len / 2; ++ return fifo_len / 4; ++ case 4: ++ default: ++ return fifo_len / 4; ++ } ++ return 0; ++} ++ + /* Configure CGX LMAC in internal loopback mode */ + int cgx_lmac_internal_loopback(void *cgxd, int lmac_id, bool enable) + { +@@ -1557,6 +1583,7 @@ static struct mac_ops cgx_mac_ops = { + .tx_stats_cnt = 18, + .get_nr_lmacs = cgx_get_nr_lmacs, + .get_lmac_type = cgx_get_lmac_type, ++ .lmac_fifo_len = cgx_get_lmac_fifo_len, + .mac_lmac_intl_lbk = cgx_lmac_internal_loopback, + .mac_get_rx_stats = cgx_get_rx_stats, + .mac_get_tx_stats = cgx_get_tx_stats, +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h b/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h +index b33e7d1d0851c..f6eb9fec1e8d6 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h +@@ -76,6 +76,7 @@ struct mac_ops { + */ + int (*get_nr_lmacs)(void *cgx); + u8 (*get_lmac_type)(void *cgx, int lmac_id); ++ u32 (*lmac_fifo_len)(void *cgx, int lmac_id); + int (*mac_lmac_intl_lbk)(void *cgx, int lmac_id, + bool enable); + /* Register Stats related functions */ +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c +index 8c0b35a868cfe..3ac26ba31e2f3 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c +@@ -22,6 +22,7 @@ static struct mac_ops rpm_mac_ops = { + .tx_stats_cnt = 34, + .get_nr_lmacs = rpm_get_nr_lmacs, + .get_lmac_type = rpm_get_lmac_type, ++ .lmac_fifo_len = rpm_get_lmac_fifo_len, + .mac_lmac_intl_lbk = rpm_lmac_internal_loopback, + .mac_get_rx_stats = rpm_get_rx_stats, + .mac_get_tx_stats = rpm_get_tx_stats, +@@ -261,6 +262,35 @@ u8 rpm_get_lmac_type(void *rpmd, int lmac_id) + return err; + } + ++u32 rpm_get_lmac_fifo_len(void *rpmd, int lmac_id) ++{ ++ rpm_t *rpm = rpmd; ++ u64 hi_perf_lmac; ++ u8 num_lmacs; ++ u32 fifo_len; ++ ++ fifo_len = rpm->mac_ops->fifo_len; ++ num_lmacs = rpm->mac_ops->get_nr_lmacs(rpm); ++ ++ switch (num_lmacs) { ++ case 1: ++ return fifo_len; ++ case 2: ++ return fifo_len / 2; ++ case 3: ++ /* LMAC marked as hi_perf gets half of the FIFO and rest 1/4th */ ++ hi_perf_lmac = rpm_read(rpm, 0, CGXX_CMRX_RX_LMACS); ++ hi_perf_lmac = (hi_perf_lmac >> 4) & 0x3ULL; ++ if (lmac_id == hi_perf_lmac) ++ return fifo_len / 2; ++ return fifo_len / 4; ++ case 4: ++ default: ++ return fifo_len / 4; ++ } ++ return 0; ++} ++ + int rpm_lmac_internal_loopback(void *rpmd, int lmac_id, bool enable) + { + rpm_t *rpm = rpmd; +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.h b/drivers/net/ethernet/marvell/octeontx2/af/rpm.h +index ff580311edd03..39e9a1d068353 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.h +@@ -49,6 +49,7 @@ + /* Function Declarations */ + int rpm_get_nr_lmacs(void *rpmd); + u8 rpm_get_lmac_type(void *rpmd, int lmac_id); ++u32 rpm_get_lmac_fifo_len(void *rpmd, int lmac_id); + int rpm_lmac_internal_loopback(void *rpmd, int lmac_id, bool enable); + void rpm_lmac_enadis_rx_pause_fwding(void *rpmd, int lmac_id, bool enable); + int rpm_lmac_get_pause_frm_status(void *cgxd, int lmac_id, u8 *tx_pause, +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +index 9d517e6dac2f0..8d1df8a70ae0d 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +@@ -813,7 +813,7 @@ u32 rvu_cgx_get_fifolen(struct rvu *rvu); + void *rvu_first_cgx_pdata(struct rvu *rvu); + int cgxlmac_to_pf(struct rvu *rvu, int cgx_id, int lmac_id); + int rvu_cgx_config_tx(void *cgxd, int lmac_id, bool enable); +- ++u32 rvu_cgx_get_lmac_fifolen(struct rvu *rvu, int cgx, int lmac); + int npc_get_nixlf_mcam_index(struct npc_mcam *mcam, u16 pcifunc, int nixlf, + int type); + bool is_mcam_entry_enabled(struct rvu *rvu, struct npc_mcam *mcam, int blkaddr, +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +index f4c7bb6bf053a..4bd511b007cbc 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +@@ -831,6 +831,22 @@ u32 rvu_cgx_get_fifolen(struct rvu *rvu) + return fifo_len; + } + ++u32 rvu_cgx_get_lmac_fifolen(struct rvu *rvu, int cgx, int lmac) ++{ ++ struct mac_ops *mac_ops; ++ void *cgxd; ++ ++ cgxd = rvu_cgx_pdata(cgx, rvu); ++ if (!cgxd) ++ return 0; ++ ++ mac_ops = get_mac_ops(cgxd); ++ if (!mac_ops->lmac_fifo_len) ++ return 0; ++ ++ return mac_ops->lmac_fifo_len(cgxd, lmac); ++} ++ + static int rvu_cgx_config_intlbk(struct rvu *rvu, u16 pcifunc, bool en) + { + int pf = rvu_get_pf(pcifunc); +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index 1ab9dc544eeea..874248499ef9a 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -4036,9 +4036,13 @@ int rvu_mbox_handler_nix_set_hw_frs(struct rvu *rvu, struct nix_frs_cfg *req, + return 0; + + /* Update transmit credits for CGX links */ +- lmac_fifo_len = +- rvu_cgx_get_fifolen(rvu) / +- cgx_get_lmac_cnt(rvu_cgx_pdata(cgx, rvu)); ++ lmac_fifo_len = rvu_cgx_get_lmac_fifolen(rvu, cgx, lmac); ++ if (!lmac_fifo_len) { ++ dev_err(rvu->dev, ++ "%s: Failed to get CGX/RPM%d:LMAC%d FIFO size\n", ++ __func__, cgx, lmac); ++ return 0; ++ } + return nix_config_link_credits(rvu, blkaddr, link, pcifunc, + (lmac_fifo_len - req->maxlen) / 16); + } +@@ -4086,7 +4090,10 @@ static void nix_link_config(struct rvu *rvu, int blkaddr, + struct rvu_hwinfo *hw = rvu->hw; + int cgx, lmac_cnt, slink, link; + u16 lbk_max_frs, lmac_max_frs; ++ unsigned long lmac_bmap; + u64 tx_credits, cfg; ++ u64 lmac_fifo_len; ++ int iter; + + rvu_get_lbk_link_max_frs(rvu, &lbk_max_frs); + rvu_get_lmac_link_max_frs(rvu, &lmac_max_frs); +@@ -4120,12 +4127,23 @@ static void nix_link_config(struct rvu *rvu, int blkaddr, + /* Skip when cgx is not available or lmac cnt is zero */ + if (lmac_cnt <= 0) + continue; +- tx_credits = ((rvu_cgx_get_fifolen(rvu) / lmac_cnt) - +- lmac_max_frs) / 16; +- /* Enable credits and set credit pkt count to max allowed */ +- cfg = (tx_credits << 12) | (0x1FF << 2) | BIT_ULL(1); + slink = cgx * hw->lmac_per_cgx; +- for (link = slink; link < (slink + lmac_cnt); link++) { ++ ++ /* Get LMAC id's from bitmap */ ++ lmac_bmap = cgx_get_lmac_bmap(rvu_cgx_pdata(cgx, rvu)); ++ for_each_set_bit(iter, &lmac_bmap, MAX_LMAC_PER_CGX) { ++ lmac_fifo_len = rvu_cgx_get_lmac_fifolen(rvu, cgx, iter); ++ if (!lmac_fifo_len) { ++ dev_err(rvu->dev, ++ "%s: Failed to get CGX/RPM%d:LMAC%d FIFO size\n", ++ __func__, cgx, iter); ++ continue; ++ } ++ tx_credits = (lmac_fifo_len - lmac_max_frs) / 16; ++ /* Enable credits and set credit pkt count to max allowed */ ++ cfg = (tx_credits << 12) | (0x1FF << 2) | BIT_ULL(1); ++ ++ link = iter + slink; + nix_hw->tx_credits[link] = tx_credits; + rvu_write64(rvu, blkaddr, + NIX_AF_TX_LINKX_NORM_CREDIT(link), cfg); +-- +2.43.0 + diff --git a/queue-5.15/r8169-fix-pci-error-on-system-resume.patch b/queue-5.15/r8169-fix-pci-error-on-system-resume.patch new file mode 100644 index 00000000000..4673efd6c91 --- /dev/null +++ b/queue-5.15/r8169-fix-pci-error-on-system-resume.patch @@ -0,0 +1,49 @@ +From 482a2ba9cc0c97951ee5879aaf1d986bff54c831 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Dec 2023 12:34:09 +0800 +Subject: r8169: Fix PCI error on system resume + +From: Kai-Heng Feng + +[ Upstream commit 9c476269bff2908a20930c58085bf0b05ebd569a ] + +Some r8168 NICs stop working upon system resume: + +[ 688.051096] r8169 0000:02:00.1 enp2s0f1: rtl_ep_ocp_read_cond == 0 (loop: 10, delay: 10000). +[ 688.175131] r8169 0000:02:00.1 enp2s0f1: Link is Down +... +[ 691.534611] r8169 0000:02:00.1 enp2s0f1: PCI error (cmd = 0x0407, status_errs = 0x0000) + +Not sure if it's related, but those NICs have a BMC device at function +0: +02:00.0 Unassigned class [ff00]: Realtek Semiconductor Co., Ltd. Realtek RealManage BMC [10ec:816e] (rev 1a) + +Trial and error shows that increase the loop wait on +rtl_ep_ocp_read_cond to 30 can eliminate the issue, so let +rtl8168ep_driver_start() to wait a bit longer. + +Fixes: e6d6ca6e1204 ("r8169: Add support for another RTL8168FP") +Signed-off-by: Kai-Heng Feng +Reviewed-by: Heiner Kallweit +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index c0a339ff43a6b..16888e3f09290 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -1191,7 +1191,7 @@ static void rtl8168ep_driver_start(struct rtl8169_private *tp) + { + r8168ep_ocp_write(tp, 0x01, 0x180, OOB_CMD_DRIVER_START); + r8168ep_ocp_write(tp, 0x01, 0x30, r8168ep_ocp_read(tp, 0x30) | 0x01); +- rtl_loop_wait_high(tp, &rtl_ep_ocp_read_cond, 10000, 10); ++ rtl_loop_wait_high(tp, &rtl_ep_ocp_read_cond, 10000, 30); + } + + static void rtl8168_driver_start(struct rtl8169_private *tp) +-- +2.43.0 + diff --git a/queue-5.15/selftests-secretmem-floor-the-memory-size-to-the-mul.patch b/queue-5.15/selftests-secretmem-floor-the-memory-size-to-the-mul.patch new file mode 100644 index 00000000000..d9a6d9608e1 --- /dev/null +++ b/queue-5.15/selftests-secretmem-floor-the-memory-size-to-the-mul.patch @@ -0,0 +1,56 @@ +From d7ad4df13708de4f4efc488d7afaf6d358a548c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Dec 2023 15:19:30 +0500 +Subject: selftests: secretmem: floor the memory size to the multiple of + page_size + +From: Muhammad Usama Anjum + +[ Upstream commit 0aac13add26d546ac74c89d2883b3a5f0fbea039 ] + +The "locked-in-memory size" limit per process can be non-multiple of +page_size. The mmap() fails if we try to allocate locked-in-memory with +same size as the allowed limit if it isn't multiple of the page_size +because mmap() rounds off the memory size to be allocated to next multiple +of page_size. + +Fix this by flooring the length to be allocated with mmap() to the +previous multiple of the page_size. + +This was getting triggered on KernelCI regularly because of different +ulimit settings which wasn't multiple of the page_size. Find logs +here: https://linux.kernelci.org/test/plan/id/657654bd8e81e654fae13532/ +The bug in was present from the time test was first added. + +Link: https://lkml.kernel.org/r/20231214101931.1155586-1-usama.anjum@collabora.com +Fixes: 76fe17ef588a ("secretmem: test: add basic selftest for memfd_secret(2)") +Signed-off-by: Muhammad Usama Anjum +Reported-by: "kernelci.org bot" +Closes: https://linux.kernelci.org/test/plan/id/657654bd8e81e654fae13532/ +Cc: "James E.J. Bottomley" +Cc: Mike Rapoport (IBM) +Cc: Shuah Khan +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vm/memfd_secret.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/testing/selftests/vm/memfd_secret.c b/tools/testing/selftests/vm/memfd_secret.c +index 93e7e7ffed337..9177490981489 100644 +--- a/tools/testing/selftests/vm/memfd_secret.c ++++ b/tools/testing/selftests/vm/memfd_secret.c +@@ -62,6 +62,9 @@ static void test_mlock_limit(int fd) + char *mem; + + len = mlock_limit_cur; ++ if (len % page_size != 0) ++ len = (len/page_size) * page_size; ++ + mem = mmap(NULL, len, prot, mode, fd, 0); + if (mem == MAP_FAILED) { + fail("unable to mmap secret memory\n"); +-- +2.43.0 + diff --git a/queue-5.15/series b/queue-5.15/series index c071d30dc1d..e2f81dbac8a 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -1,2 +1,41 @@ keys-dns-fix-missing-size-check-of-v1-server-list-header.patch block-don-t-invalidate-pagecache-for-invalid-falloc-modes.patch +wifi-iwlwifi-pcie-don-t-synchronize-irqs-from-irq.patch +drm-bridge-ti-sn65dsi86-never-store-more-than-msg-si.patch +nfc-llcp_core-hold-a-ref-to-llcp_local-dev-when-hold.patch +octeontx2-af-fix-marking-couple-of-structure-as-__pa.patch +drm-i915-dp-fix-passing-the-correct-dpcd_rev-for-drm.patch +i40e-fix-filter-input-checks-to-prevent-config-with-.patch +igc-report-vlan-ethertype-matching-back-to-user.patch +igc-check-vlan-tci-mask.patch +igc-check-vlan-ethertype-mask.patch +asoc-fsl_rpmsg-fix-error-handler-with-pm_runtime_ena.patch +mlxbf_gige-fix-receive-packet-race-condition.patch +net-sched-em_text-fix-possible-memory-leak-in-em_tex.patch +r8169-fix-pci-error-on-system-resume.patch +net-implement-missing-getsockopt-so_timestamping_new.patch +can-raw-add-support-for-so_txtime-scm_txtime.patch +can-raw-add-support-for-so_mark.patch +net-timestamp-extend-sof_timestamping_opt_id-to-hw-t.patch +arm-sun9i-smp-fix-array-index-out-of-bounds-read-in-.patch +sfc-fix-a-double-free-bug-in-efx_probe_filters.patch +net-bcmgenet-fix-fcs-generation-for-fragmented-skbuf.patch +netfilter-nft_immediate-drop-chain-reference-counter.patch +net-save-and-restore-msg_namelen-in-sock_sendmsg.patch +i40e-fix-use-after-free-in-i40e_aqc_add_filters.patch +asoc-meson-g12a-toacodec-validate-written-enum-value.patch +asoc-meson-g12a-tohdmitx-validate-written-enum-value.patch +asoc-meson-g12a-toacodec-fix-event-generation.patch +asoc-meson-g12a-tohdmitx-fix-event-generation-for-s-.patch +i40e-restore-vf-msi-x-state-during-pci-reset.patch +igc-fix-hicredit-calculation.patch +net-qla3xxx-fix-potential-memleak-in-ql_alloc_buffer.patch +octeontx2-af-don-t-enable-pause-frames-by-default.patch +octeontx2-af-set-nix-link-credits-based-on-max-lmac.patch +octeontx2-af-always-configure-nix-tx-link-credits-ba.patch +octeontx2-af-re-enable-mac-tx-in-otx2_stop-processin.patch +asix-add-check-for-usbnet_get_endpoints.patch +bnxt_en-remove-mis-applied-code-from-bnxt_cfg_ntp_fi.patch +net-implement-missing-so_timestamping_new-cmsg-suppo.patch +selftests-secretmem-floor-the-memory-size-to-the-mul.patch +mm-memory-failure-check-the-mapcount-of-the-precise-.patch diff --git a/queue-5.15/sfc-fix-a-double-free-bug-in-efx_probe_filters.patch b/queue-5.15/sfc-fix-a-double-free-bug-in-efx_probe_filters.patch new file mode 100644 index 00000000000..20f6b9104f5 --- /dev/null +++ b/queue-5.15/sfc-fix-a-double-free-bug-in-efx_probe_filters.patch @@ -0,0 +1,51 @@ +From dfe8fce1a1f84525c44f537b63329b96cb883862 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Dec 2023 19:29:14 +0800 +Subject: sfc: fix a double-free bug in efx_probe_filters + +From: Zhipeng Lu + +[ Upstream commit d5a306aedba34e640b11d7026dbbafb78ee3a5f6 ] + +In efx_probe_filters, the channel->rps_flow_id is freed in a +efx_for_each_channel marco when success equals to 0. +However, after the following call chain: + +ef100_net_open + |-> efx_probe_filters + |-> ef100_net_stop + |-> efx_remove_filters + +The channel->rps_flow_id is freed again in the efx_for_each_channel of +efx_remove_filters, triggering a double-free bug. + +Fixes: a9dc3d5612ce ("sfc_ef100: RX filter table management and related gubbins") +Reviewed-by: Simon Horman +Reviewed-by: Edward Cree +Signed-off-by: Zhipeng Lu +Link: https://lore.kernel.org/r/20231225112915.3544581-1-alexious@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/rx_common.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/sfc/rx_common.c b/drivers/net/ethernet/sfc/rx_common.c +index a804c754cd7d0..0f2d6efdbba1c 100644 +--- a/drivers/net/ethernet/sfc/rx_common.c ++++ b/drivers/net/ethernet/sfc/rx_common.c +@@ -837,8 +837,10 @@ int efx_probe_filters(struct efx_nic *efx) + } + + if (!success) { +- efx_for_each_channel(channel, efx) ++ efx_for_each_channel(channel, efx) { + kfree(channel->rps_flow_id); ++ channel->rps_flow_id = NULL; ++ } + efx->type->filter_table_remove(efx); + rc = -ENOMEM; + goto out_unlock; +-- +2.43.0 + diff --git a/queue-5.15/wifi-iwlwifi-pcie-don-t-synchronize-irqs-from-irq.patch b/queue-5.15/wifi-iwlwifi-pcie-don-t-synchronize-irqs-from-irq.patch new file mode 100644 index 00000000000..23017da68eb --- /dev/null +++ b/queue-5.15/wifi-iwlwifi-pcie-don-t-synchronize-irqs-from-irq.patch @@ -0,0 +1,170 @@ +From 24f99b916c39e9ad28eb78b083d3151b2135d9e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Dec 2023 11:13:34 +0100 +Subject: wifi: iwlwifi: pcie: don't synchronize IRQs from IRQ + +From: Johannes Berg + +[ Upstream commit 400f6ebbc175286576c7f7fddf3c347d09d12310 ] + +On older devices (before unified image!) we can end up calling +stop_device from an rfkill interrupt. However, in stop_device +we attempt to synchronize IRQs, which then of course deadlocks. + +Avoid this by checking the context, if running from the IRQ +thread then don't synchronize. This wouldn't be correct on a +new device since RSS is supported, but older devices only have +a single interrupt/queue. + +Fixes: 37fb29bd1f90 ("wifi: iwlwifi: pcie: synchronize IRQs before NAPI") +Reviewed-by: Miri Korenblit +Reviewed-by: Emmanuel Grumbach +Signed-off-by: Johannes Berg +Signed-off-by: Kalle Valo +Link: https://msgid.link/20231215111335.59aab00baed7.Iadfe154d6248e7f9dfd69522e5429dbbd72925d7@changeid +Signed-off-by: Sasha Levin +--- + .../net/wireless/intel/iwlwifi/pcie/internal.h | 4 ++-- + drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 8 ++++---- + drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 17 +++++++++-------- + 3 files changed, 15 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h +index 74959de9d7002..04c801748b338 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h +@@ -728,7 +728,7 @@ static inline void iwl_enable_rfkill_int(struct iwl_trans *trans) + } + } + +-void iwl_pcie_handle_rfkill_irq(struct iwl_trans *trans); ++void iwl_pcie_handle_rfkill_irq(struct iwl_trans *trans, bool from_irq); + + static inline bool iwl_is_rfkill_set(struct iwl_trans *trans) + { +@@ -775,7 +775,7 @@ static inline bool iwl_pcie_dbg_on(struct iwl_trans *trans) + return (trans->dbg.dest_tlv || iwl_trans_dbg_ini_valid(trans)); + } + +-void iwl_trans_pcie_rf_kill(struct iwl_trans *trans, bool state); ++void iwl_trans_pcie_rf_kill(struct iwl_trans *trans, bool state, bool from_irq); + void iwl_trans_pcie_dump_regs(struct iwl_trans *trans); + + #ifdef CONFIG_IWLWIFI_DEBUGFS +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +index df201d40f6c95..29be7ed768947 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +@@ -1780,7 +1780,7 @@ static u32 iwl_pcie_int_cause_ict(struct iwl_trans *trans) + return inta; + } + +-void iwl_pcie_handle_rfkill_irq(struct iwl_trans *trans) ++void iwl_pcie_handle_rfkill_irq(struct iwl_trans *trans, bool from_irq) + { + struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); + struct isr_statistics *isr_stats = &trans_pcie->isr_stats; +@@ -1804,7 +1804,7 @@ void iwl_pcie_handle_rfkill_irq(struct iwl_trans *trans) + isr_stats->rfkill++; + + if (prev != report) +- iwl_trans_pcie_rf_kill(trans, report); ++ iwl_trans_pcie_rf_kill(trans, report, from_irq); + mutex_unlock(&trans_pcie->mutex); + + if (hw_rfkill) { +@@ -1944,7 +1944,7 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id) + + /* HW RF KILL switch toggled */ + if (inta & CSR_INT_BIT_RF_KILL) { +- iwl_pcie_handle_rfkill_irq(trans); ++ iwl_pcie_handle_rfkill_irq(trans, true); + handled |= CSR_INT_BIT_RF_KILL; + } + +@@ -2332,7 +2332,7 @@ irqreturn_t iwl_pcie_irq_msix_handler(int irq, void *dev_id) + + /* HW RF KILL switch toggled */ + if (inta_hw & MSIX_HW_INT_CAUSES_REG_RF_KILL) +- iwl_pcie_handle_rfkill_irq(trans); ++ iwl_pcie_handle_rfkill_irq(trans, true); + + if (inta_hw & MSIX_HW_INT_CAUSES_REG_HW_ERR) { + IWL_ERR(trans, +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +index 8a19463bc81c1..8170d06974837 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +@@ -1046,7 +1046,7 @@ bool iwl_pcie_check_hw_rf_kill(struct iwl_trans *trans) + report = test_bit(STATUS_RFKILL_OPMODE, &trans->status); + + if (prev != report) +- iwl_trans_pcie_rf_kill(trans, report); ++ iwl_trans_pcie_rf_kill(trans, report, false); + + return hw_rfkill; + } +@@ -1170,7 +1170,7 @@ static void iwl_pcie_init_msix(struct iwl_trans_pcie *trans_pcie) + trans_pcie->hw_mask = trans_pcie->hw_init_mask; + } + +-static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans) ++static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans, bool from_irq) + { + struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); + +@@ -1197,7 +1197,8 @@ static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans) + if (test_and_clear_bit(STATUS_DEVICE_ENABLED, &trans->status)) { + IWL_DEBUG_INFO(trans, + "DEVICE_ENABLED bit was set and is now cleared\n"); +- iwl_pcie_synchronize_irqs(trans); ++ if (!from_irq) ++ iwl_pcie_synchronize_irqs(trans); + iwl_pcie_rx_napi_sync(trans); + iwl_pcie_tx_stop(trans); + iwl_pcie_rx_stop(trans); +@@ -1385,7 +1386,7 @@ void iwl_trans_pcie_handle_stop_rfkill(struct iwl_trans *trans, + clear_bit(STATUS_RFKILL_OPMODE, &trans->status); + } + if (hw_rfkill != was_in_rfkill) +- iwl_trans_pcie_rf_kill(trans, hw_rfkill); ++ iwl_trans_pcie_rf_kill(trans, hw_rfkill, false); + } + + static void iwl_trans_pcie_stop_device(struct iwl_trans *trans) +@@ -1400,12 +1401,12 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans) + mutex_lock(&trans_pcie->mutex); + trans_pcie->opmode_down = true; + was_in_rfkill = test_bit(STATUS_RFKILL_OPMODE, &trans->status); +- _iwl_trans_pcie_stop_device(trans); ++ _iwl_trans_pcie_stop_device(trans, false); + iwl_trans_pcie_handle_stop_rfkill(trans, was_in_rfkill); + mutex_unlock(&trans_pcie->mutex); + } + +-void iwl_trans_pcie_rf_kill(struct iwl_trans *trans, bool state) ++void iwl_trans_pcie_rf_kill(struct iwl_trans *trans, bool state, bool from_irq) + { + struct iwl_trans_pcie __maybe_unused *trans_pcie = + IWL_TRANS_GET_PCIE_TRANS(trans); +@@ -1418,7 +1419,7 @@ void iwl_trans_pcie_rf_kill(struct iwl_trans *trans, bool state) + if (trans->trans_cfg->gen2) + _iwl_trans_pcie_gen2_stop_device(trans); + else +- _iwl_trans_pcie_stop_device(trans); ++ _iwl_trans_pcie_stop_device(trans, from_irq); + } + } + +@@ -2741,7 +2742,7 @@ static ssize_t iwl_dbgfs_rfkill_write(struct file *file, + IWL_WARN(trans, "changing debug rfkill %d->%d\n", + trans_pcie->debug_rfkill, new_value); + trans_pcie->debug_rfkill = new_value; +- iwl_pcie_handle_rfkill_irq(trans); ++ iwl_pcie_handle_rfkill_irq(trans, false); + + return count; + } +-- +2.43.0 + -- 2.47.3