From 9d3139e581c8dd303b12453f3a841aa9e0389ab3 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 17 Jul 2022 10:52:36 -0400 Subject: [PATCH] Fixes for 5.18 Signed-off-by: Sasha Levin --- ...cpi_video_handles_brightness_key_pre.patch | 99 ++++++ ...re-bhb-avoid-pr_info-every-time-a-cp.patch | 58 +++ ...-the-fdt_fixed-sections-as-shareable.patch | 153 ++++++++ ...s-at91-sama5d2-fix-typo-in-i2s1-node.patch | 40 +++ ...6qdl-ts7970-fix-ngpio-typo-and-count.patch | 39 +++ ...x-spi-nor-campatible-on-orange-pi-ze.patch | 40 +++ ...om-bcm4908-fix-cpu-node-for-smp-boot.patch | 38 ++ ...om-bcm4908-fix-timer-node-for-bcm490.patch | 43 +++ ...28a-update-sfp-node-to-include-clock.patch | 41 +++ ...ke-correct-the-handling-of-fmt_confi.patch | 133 +++++++ ...ke-correct-the-ssp-rate-discovery-in.patch | 48 +++ ...gtl5000-fix-noise-on-shutdown-remove.patch | 79 +++++ .../asoc-tas2764-add-post-reset-delays.patch | 69 ++++ ...as2764-correct-playback-volume-range.patch | 43 +++ ...fix-amp-gain-register-offset-default.patch | 52 +++ ...x-and-extend-fsync-polarity-handling.patch | 135 +++++++ queue-5.18/bnxt_en-fix-bnxt_refclk_read.patch | 60 ++++ ...ix-bnxt_reinit_after_abort-code-path.patch | 52 +++ queue-5.18/bnxt_en-fix-livepatch-query.patch | 45 +++ ...-max-resources-if-sriov-enable-fails.patch | 83 +++++ .../cipso-fix-data-races-around-sysctl.patch | 95 +++++ ...ensure-valid-event-timestamp-for-cur.patch | 116 ++++++ ...ignore-first-mst-sideband-message-re.patch | 155 +++++++++ ...only-use-depth-36-bpp-linebuffers-on.patch | 68 ++++ .../drm-amd-pm-prevent-divide-by-zero.patch | 46 +++ ...ay-disable-prefer_shadow-for-generic.patch | 113 ++++++ ...-fbdev-buffers-pinned-during-suspend.patch | 65 ++++ ...ct-the-mec-atomic-support-firmware-c.patch | 38 ++ ...ossible-refcount-leak-in-intel_dp_ad.patch | 44 +++ ...alize-grdom-access-between-multiple-.patch | 124 +++++++ ...alize-tlb-invalidates-with-gt-resets.patch | 76 ++++ ...-n-should-use-the-same-guc-fw-as-adl.patch | 53 +++ ...err-vs-null-bug-in-intel_gvt_update_.patch | 44 +++ ...ts-fix-a-couple-is_err-vs-null-tests.patch | 53 +++ ...lftests-fix-subtraction-overflow-bug.patch | 43 +++ ...m-i915-ttm-fix-sg_table-construction.patch | 308 ++++++++++++++++ ...e-devlink-code-to-read-nvm-in-blocks.patch | 122 +++++++ ...822-generic-device-id-in-pldm-header.patch | 175 ++++++++++ ...race-around-sysctl_icmp_echo_ignore_.patch | 50 +++ ...around-sysctl_icmp_echo_ignore_.patch-4417 | 50 +++ ...race-around-sysctl_icmp_errors_use_i.patch | 50 +++ ...race-around-sysctl_icmp_ignore_bogus.patch | 51 +++ ...ta-race-around-sysctl_icmp_ratelimit.patch | 37 ++ ...ata-race-around-sysctl_icmp_ratemask.patch | 36 ++ .../icmp-fix-data-races-around-sysctl.patch | 42 +++ ...ces-around-sysctl_icmp_echo_enable_p.patch | 51 +++ ...ial-integer-overflow-in-ima_appraise.patch | 37 ++ ...ntial-memory-leak-in-ima_init_crypto.patch | 36 ++ ...ure-verification-when-config_kexec_s.patch | 87 +++++ ...netpeer-fix-data-races-around-sysctl.patch | 52 +++ ...data-race-around-sysctl_fib_sync_mem.patch | 36 ++ ...-data-races-around-sysctl_ip_dynaddr.patch | 59 ++++ ...itialize-struct-kvm_lapic_irq-in-kvm.patch | 60 ++++ queue-5.18/lockd-fix-nlm_close_files.patch | 44 +++ ...kd-set-fl_owner-when-unlocking-files.patch | 54 +++ ...ssing-numa_stat-when-config_hugetlb_.patch | 66 ++++ ...subflow-traversal-at-disconnect-time.patch | 51 +++ ...tic-remove-aq_nic_deinit-when-resume.patch | 61 ++++ ...ove-deep-parameter-on-suspend-resume.patch | 101 ++++++ ...am65-cpsw-fix-devlink-port-register-.patch | 95 +++++ ...net-fix-data-races-around-sysctl_mem.patch | 36 ++ ...ld-reference-returned-by-of_get_chil.patch | 57 +++ ...-prestera-fix-missed-deinit-sequence.patch | 35 ++ ...-own-workqueue-instead-of-mlx5e-priv.patch | 105 ++++++ ...pability-check-for-updating-vnic-env.patch | 42 +++ ...abling-sriov-while-tc-nic-rules-are-.patch | 60 ++++ ...s-fix-build-time-constant-test-in-rx.patch | 38 ++ ...s-fix-build-time-constant-test-in-tx.patch | 38 ++ ...e-ring-the-tx-doorbell-on-dma-errors.patch | 123 +++++++ ...et-ocelot-fix-wrong-time_after-usage.patch | 69 ++++ ...os-disable-split-header-for-tegra194.patch | 47 +++ .../net-stmmac-fix-leaks-in-probe.patch | 46 +++ ...-check-for-errors-in-tls_device_init.patch | 83 +++++ ...ack-fix-crash-due-to-confirmed-bit-l.patch | 190 ++++++++++ ...ack-include-ecache-dying-list-in-dum.patch | 121 +++++++ ...nntrack-remove-the-percpu-dying-list.patch | 264 ++++++++++++++ ...ack-split-inner-loop-of-list-dumping.patch | 121 +++++++ ...er-ecache-move-to-separate-structure.patch | 108 ++++++ ...-use-dedicated-list-for-event-redeli.patch | 329 ++++++++++++++++++ ...g-incorrect-offset-to-network-header.patch | 70 ++++ ...les-replace-bug_on-by-element-length.patch | 220 ++++++++++++ ...o-not-unlock-and-put-the-folio-twice.patch | 180 ++++++++++ ...ata-races-around-nexthop_compat_mode.patch | 74 ++++ ...-skb-segments-exceeds-descriptor-lim.patch | 123 +++++++ ...sd-decode-nfsv4-birth-time-attribute.patch | 83 +++++ .../objtool-update-retpoline-validation.patch | 120 +++++++ ...race-around-sysctl_raw_l3mdev_accept.patch | 36 ++ ...ulk-optional-exclusive-control-gette.patch | 47 +++ ...rcu-deadlock-caused-by-kvm_riscv_che.patch | 51 +++ ...s-microchip-hook-up-the-mpfs-l2cache.patch | 63 ++++ ...-skb-checksum-in-bpf_push_seg6_encap.patch | 44 +++ ...cksum-evaluation-in-srh-encapsulatio.patch | 73 ++++ ...cksum-in-srv6-end.b6-and-end.b6.enca.patch | 51 +++ queue-5.18/series | 117 +++++++ ...fc-fix-kernel-panic-when-creating-vf.patch | 71 ++++ ...-use-after-free-when-disabling-sriov.patch | 113 ++++++ ...nd-negprot-bug-in-some-samba-servers.patch | 63 ++++ ...-limit-max-transfer-and-message-size.patch | 70 ++++ ...sctl-fix-data-races-in-proc_dointvec.patch | 51 +++ ...-data-races-in-proc_dointvec_jiffies.patch | 48 +++ ...x-data-races-in-proc_dointvec_minmax.patch | 42 +++ ...ta-races-in-proc_dointvec_ms_jiffies.patch | 56 +++ ...ix-data-races-in-proc_dou8vec_minmax.patch | 49 +++ ...ctl-fix-data-races-in-proc_douintvec.patch | 45 +++ ...-data-races-in-proc_douintvec_minmax.patch | 42 +++ ...data-races-in-proc_doulongvec_minmax.patch | 45 +++ ...ta-race-around-sysctl_max_tw_buckets.patch | 37 ++ ...-race-around-sysctl_tcp_ecn_fallback.patch | 50 +++ ...a-race-around-sysctl_tcp_max_orphans.patch | 37 ++ ...fix-data-races-around-sysctl_tcp_ecn.patch | 92 +++++ ...-sleeping-while-atomic-in-kdb-ftdump.patch | 71 ++++ ...vlan-fix-memory-leak-in-vlan_newlink.patch | 92 +++++ ...gs-report-amd-retbleed-vulnerability.patch | 181 ++++++++++ .../x86-cpu-amd-add-spectral-chicken.patch | 117 +++++++ ...ix-setcc-emulation-for-return-thunks.patch | 97 ++++++ ...6-sev-avoid-using-__x86_return_thunk.patch | 51 +++ .../x86-xen-rename-sys-entry-points.patch | 142 ++++++++ ...e-failure-to-unmap-invalid_grant_han.patch | 58 +++ 118 files changed, 9278 insertions(+) create mode 100644 queue-5.18/acpi-video-fix-acpi_video_handles_brightness_key_pre.patch create mode 100644 queue-5.18/arm-9209-1-spectre-bhb-avoid-pr_info-every-time-a-cp.patch create mode 100644 queue-5.18/arm-9210-1-mark-the-fdt_fixed-sections-as-shareable.patch create mode 100644 queue-5.18/arm-dts-at91-sama5d2-fix-typo-in-i2s1-node.patch create mode 100644 queue-5.18/arm-dts-imx6qdl-ts7970-fix-ngpio-typo-and-count.patch create mode 100644 queue-5.18/arm-dts-sunxi-fix-spi-nor-campatible-on-orange-pi-ze.patch create mode 100644 queue-5.18/arm64-dts-broadcom-bcm4908-fix-cpu-node-for-smp-boot.patch create mode 100644 queue-5.18/arm64-dts-broadcom-bcm4908-fix-timer-node-for-bcm490.patch create mode 100644 queue-5.18/arm64-dts-ls1028a-update-sfp-node-to-include-clock.patch create mode 100644 queue-5.18/asoc-intel-skylake-correct-the-handling-of-fmt_confi.patch create mode 100644 queue-5.18/asoc-intel-skylake-correct-the-ssp-rate-discovery-in.patch create mode 100644 queue-5.18/asoc-sgtl5000-fix-noise-on-shutdown-remove.patch create mode 100644 queue-5.18/asoc-tas2764-add-post-reset-delays.patch create mode 100644 queue-5.18/asoc-tas2764-correct-playback-volume-range.patch create mode 100644 queue-5.18/asoc-tas2764-fix-amp-gain-register-offset-default.patch create mode 100644 queue-5.18/asoc-tas2764-fix-and-extend-fsync-polarity-handling.patch create mode 100644 queue-5.18/bnxt_en-fix-bnxt_refclk_read.patch create mode 100644 queue-5.18/bnxt_en-fix-bnxt_reinit_after_abort-code-path.patch create mode 100644 queue-5.18/bnxt_en-fix-livepatch-query.patch create mode 100644 queue-5.18/bnxt_en-reclaim-max-resources-if-sriov-enable-fails.patch create mode 100644 queue-5.18/cipso-fix-data-races-around-sysctl.patch create mode 100644 queue-5.18/drm-amd-display-ensure-valid-event-timestamp-for-cur.patch create mode 100644 queue-5.18/drm-amd-display-ignore-first-mst-sideband-message-re.patch create mode 100644 queue-5.18/drm-amd-display-only-use-depth-36-bpp-linebuffers-on.patch create mode 100644 queue-5.18/drm-amd-pm-prevent-divide-by-zero.patch create mode 100644 queue-5.18/drm-amdgpu-display-disable-prefer_shadow-for-generic.patch create mode 100644 queue-5.18/drm-amdgpu-keep-fbdev-buffers-pinned-during-suspend.patch create mode 100644 queue-5.18/drm-amdkfd-correct-the-mec-atomic-support-firmware-c.patch create mode 100644 queue-5.18/drm-i915-fix-a-possible-refcount-leak-in-intel_dp_ad.patch create mode 100644 queue-5.18/drm-i915-gt-serialize-grdom-access-between-multiple-.patch create mode 100644 queue-5.18/drm-i915-gt-serialize-tlb-invalidates-with-gt-resets.patch create mode 100644 queue-5.18/drm-i915-guc-adl-n-should-use-the-same-guc-fw-as-adl.patch create mode 100644 queue-5.18/drm-i915-gvt-is_err-vs-null-bug-in-intel_gvt_update_.patch create mode 100644 queue-5.18/drm-i915-selftests-fix-a-couple-is_err-vs-null-tests.patch create mode 100644 queue-5.18/drm-i915-selftests-fix-subtraction-overflow-bug.patch create mode 100644 queue-5.18/drm-i915-ttm-fix-sg_table-construction.patch create mode 100644 queue-5.18/ice-change-devlink-code-to-read-nvm-in-blocks.patch create mode 100644 queue-5.18/ice-handle-e822-generic-device-id-in-pldm-header.patch create mode 100644 queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_echo_ignore_.patch create mode 100644 queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_echo_ignore_.patch-4417 create mode 100644 queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_errors_use_i.patch create mode 100644 queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_ignore_bogus.patch create mode 100644 queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_ratelimit.patch create mode 100644 queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_ratemask.patch create mode 100644 queue-5.18/icmp-fix-data-races-around-sysctl.patch create mode 100644 queue-5.18/icmp-fix-data-races-around-sysctl_icmp_echo_enable_p.patch create mode 100644 queue-5.18/ima-fix-a-potential-integer-overflow-in-ima_appraise.patch create mode 100644 queue-5.18/ima-fix-potential-memory-leak-in-ima_init_crypto.patch create mode 100644 queue-5.18/ima-force-signature-verification-when-config_kexec_s.patch create mode 100644 queue-5.18/inetpeer-fix-data-races-around-sysctl.patch create mode 100644 queue-5.18/ipv4-fix-a-data-race-around-sysctl_fib_sync_mem.patch create mode 100644 queue-5.18/ipv4-fix-data-races-around-sysctl_ip_dynaddr.patch create mode 100644 queue-5.18/kvm-x86-fully-initialize-struct-kvm_lapic_irq-in-kvm.patch create mode 100644 queue-5.18/lockd-fix-nlm_close_files.patch create mode 100644 queue-5.18/lockd-set-fl_owner-when-unlocking-files.patch create mode 100644 queue-5.18/mm-sysctl-fix-missing-numa_stat-when-config_hugetlb_.patch create mode 100644 queue-5.18/mptcp-fix-subflow-traversal-at-disconnect-time.patch create mode 100644 queue-5.18/net-atlantic-remove-aq_nic_deinit-when-resume.patch create mode 100644 queue-5.18/net-atlantic-remove-deep-parameter-on-suspend-resume.patch create mode 100644 queue-5.18/net-ethernet-ti-am65-cpsw-fix-devlink-port-register-.patch create mode 100644 queue-5.18/net-fix-data-races-around-sysctl_mem.patch create mode 100644 queue-5.18/net-ftgmac100-hold-reference-returned-by-of_get_chil.patch create mode 100644 queue-5.18/net-marvell-prestera-fix-missed-deinit-sequence.patch create mode 100644 queue-5.18/net-mlx5e-ct-use-own-workqueue-instead-of-mlx5e-priv.patch create mode 100644 queue-5.18/net-mlx5e-fix-capability-check-for-updating-vnic-env.patch create mode 100644 queue-5.18/net-mlx5e-fix-enabling-sriov-while-tc-nic-rules-are-.patch create mode 100644 queue-5.18/net-mlx5e-ktls-fix-build-time-constant-test-in-rx.patch create mode 100644 queue-5.18/net-mlx5e-ktls-fix-build-time-constant-test-in-tx.patch create mode 100644 queue-5.18/net-mlx5e-ring-the-tx-doorbell-on-dma-errors.patch create mode 100644 queue-5.18/net-ocelot-fix-wrong-time_after-usage.patch create mode 100644 queue-5.18/net-stmmac-dwc-qos-disable-split-header-for-tegra194.patch create mode 100644 queue-5.18/net-stmmac-fix-leaks-in-probe.patch create mode 100644 queue-5.18/net-tls-check-for-errors-in-tls_device_init.patch create mode 100644 queue-5.18/netfilter-conntrack-fix-crash-due-to-confirmed-bit-l.patch create mode 100644 queue-5.18/netfilter-conntrack-include-ecache-dying-list-in-dum.patch create mode 100644 queue-5.18/netfilter-conntrack-remove-the-percpu-dying-list.patch create mode 100644 queue-5.18/netfilter-conntrack-split-inner-loop-of-list-dumping.patch create mode 100644 queue-5.18/netfilter-ecache-move-to-separate-structure.patch create mode 100644 queue-5.18/netfilter-ecache-use-dedicated-list-for-event-redeli.patch create mode 100644 queue-5.18/netfilter-nf_log-incorrect-offset-to-network-header.patch create mode 100644 queue-5.18/netfilter-nf_tables-replace-bug_on-by-element-length.patch create mode 100644 queue-5.18/netfs-do-not-unlock-and-put-the-folio-twice.patch create mode 100644 queue-5.18/nexthop-fix-data-races-around-nexthop_compat_mode.patch create mode 100644 queue-5.18/nfp-fix-issue-of-skb-segments-exceeds-descriptor-lim.patch create mode 100644 queue-5.18/nfsd-decode-nfsv4-birth-time-attribute.patch create mode 100644 queue-5.18/objtool-update-retpoline-validation.patch create mode 100644 queue-5.18/raw-fix-a-data-race-around-sysctl_raw_l3mdev_accept.patch create mode 100644 queue-5.18/reset-fix-devm-bulk-optional-exclusive-control-gette.patch create mode 100644 queue-5.18/risc-v-kvm-fix-srcu-deadlock-caused-by-kvm_riscv_che.patch create mode 100644 queue-5.18/riscv-dts-microchip-hook-up-the-mpfs-l2cache.patch create mode 100644 queue-5.18/seg6-bpf-fix-skb-checksum-in-bpf_push_seg6_encap.patch create mode 100644 queue-5.18/seg6-fix-skb-checksum-evaluation-in-srh-encapsulatio.patch create mode 100644 queue-5.18/seg6-fix-skb-checksum-in-srv6-end.b6-and-end.b6.enca.patch create mode 100644 queue-5.18/sfc-fix-kernel-panic-when-creating-vf.patch create mode 100644 queue-5.18/sfc-fix-use-after-free-when-disabling-sriov.patch create mode 100644 queue-5.18/smb3-workaround-negprot-bug-in-some-samba-servers.patch create mode 100644 queue-5.18/spi-amd-limit-max-transfer-and-message-size.patch create mode 100644 queue-5.18/sysctl-fix-data-races-in-proc_dointvec.patch create mode 100644 queue-5.18/sysctl-fix-data-races-in-proc_dointvec_jiffies.patch create mode 100644 queue-5.18/sysctl-fix-data-races-in-proc_dointvec_minmax.patch create mode 100644 queue-5.18/sysctl-fix-data-races-in-proc_dointvec_ms_jiffies.patch create mode 100644 queue-5.18/sysctl-fix-data-races-in-proc_dou8vec_minmax.patch create mode 100644 queue-5.18/sysctl-fix-data-races-in-proc_douintvec.patch create mode 100644 queue-5.18/sysctl-fix-data-races-in-proc_douintvec_minmax.patch create mode 100644 queue-5.18/sysctl-fix-data-races-in-proc_doulongvec_minmax.patch create mode 100644 queue-5.18/tcp-fix-a-data-race-around-sysctl_max_tw_buckets.patch create mode 100644 queue-5.18/tcp-fix-a-data-race-around-sysctl_tcp_ecn_fallback.patch create mode 100644 queue-5.18/tcp-fix-a-data-race-around-sysctl_tcp_max_orphans.patch create mode 100644 queue-5.18/tcp-fix-data-races-around-sysctl_tcp_ecn.patch create mode 100644 queue-5.18/tracing-fix-sleeping-while-atomic-in-kdb-ftdump.patch create mode 100644 queue-5.18/vlan-fix-memory-leak-in-vlan_newlink.patch create mode 100644 queue-5.18/x86-bugs-report-amd-retbleed-vulnerability.patch create mode 100644 queue-5.18/x86-cpu-amd-add-spectral-chicken.patch create mode 100644 queue-5.18/x86-kvm-fix-setcc-emulation-for-return-thunks.patch create mode 100644 queue-5.18/x86-sev-avoid-using-__x86_return_thunk.patch create mode 100644 queue-5.18/x86-xen-rename-sys-entry-points.patch create mode 100644 queue-5.18/xen-gntdev-ignore-failure-to-unmap-invalid_grant_han.patch diff --git a/queue-5.18/acpi-video-fix-acpi_video_handles_brightness_key_pre.patch b/queue-5.18/acpi-video-fix-acpi_video_handles_brightness_key_pre.patch new file mode 100644 index 00000000000..af10cd08891 --- /dev/null +++ b/queue-5.18/acpi-video-fix-acpi_video_handles_brightness_key_pre.patch @@ -0,0 +1,99 @@ +From d986c87f7e648b55df6ab3ba9bbbb8eb64acda3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 23:11:01 +0200 +Subject: ACPI: video: Fix acpi_video_handles_brightness_key_presses() + +From: Hans de Goede + +[ Upstream commit 5ad26161a371e4aa2d2553286f0cac580987a493 ] + +Commit 3a0cf7ab8df3 ("ACPI: video: Change how we determine if brightness +key-presses are handled") made acpi_video_handles_brightness_key_presses() +report false when none of the ACPI Video Devices support backlight control. + +But it turns out that at least on a Dell Inspiron N4010 there is no ACPI +backlight control, yet brightness hotkeys are still reported through +the ACPI Video Bus; and since acpi_video_handles_brightness_key_presses() +now returns false, brightness keypresses are now reported twice. + +To fix this rename the has_backlight flag to may_report_brightness_keys and +also set it the first time a brightness key press event is received. + +Depending on the delivery of the other ACPI (WMI) event vs the ACPI Video +Bus event this means that the first brightness key press might still get +reported twice, but all further keypresses will be filtered as before. + +Note that this relies on other drivers reporting brightness key events +calling acpi_video_handles_brightness_key_presses() when delivering +the events (rather then once during driver probe). This is already +required and documented in include/acpi/video.h: + +/* + * Note: The value returned by acpi_video_handles_brightness_key_presses() + * may change over time and should not be cached. + */ + +Fixes: 3a0cf7ab8df3 ("ACPI: video: Change how we determine if brightness key-presses are handled") +Link: https://lore.kernel.org/regressions/CALF=6jEe5G8+r1Wo0vvz4GjNQQhdkLT5p8uCHn6ZXhg4nsOWow@mail.gmail.com/ +Reported-and-tested-by: Ben Greening +Signed-off-by: Hans de Goede +Acked-by: Rafael J. Wysocki +Link: https://lore.kernel.org/r/20220713211101.85547-2-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_video.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c +index e4ea42b83b51..3bd0de69aa11 100644 +--- a/drivers/acpi/acpi_video.c ++++ b/drivers/acpi/acpi_video.c +@@ -73,7 +73,7 @@ module_param(device_id_scheme, bool, 0444); + static int only_lcd = -1; + module_param(only_lcd, int, 0444); + +-static bool has_backlight; ++static bool may_report_brightness_keys; + static int register_count; + static DEFINE_MUTEX(register_count_mutex); + static DEFINE_MUTEX(video_list_lock); +@@ -1224,7 +1224,7 @@ acpi_video_bus_get_one_device(struct acpi_device *device, + acpi_video_device_find_cap(data); + + if (data->cap._BCM && data->cap._BCL) +- has_backlight = true; ++ may_report_brightness_keys = true; + + mutex_lock(&video->device_list_lock); + list_add_tail(&data->entry, &video->video_device_list); +@@ -1693,6 +1693,9 @@ static void acpi_video_device_notify(acpi_handle handle, u32 event, void *data) + break; + } + ++ if (keycode) ++ may_report_brightness_keys = true; ++ + acpi_notifier_call_chain(device, event, 0); + + if (keycode && (report_key_events & REPORT_BRIGHTNESS_KEY_EVENTS)) { +@@ -2254,7 +2257,7 @@ void acpi_video_unregister(void) + if (register_count) { + acpi_bus_unregister_driver(&acpi_video_bus); + register_count = 0; +- has_backlight = false; ++ may_report_brightness_keys = false; + } + mutex_unlock(®ister_count_mutex); + } +@@ -2276,7 +2279,7 @@ void acpi_video_unregister_backlight(void) + + bool acpi_video_handles_brightness_key_presses(void) + { +- return has_backlight && ++ return may_report_brightness_keys && + (report_key_events & REPORT_BRIGHTNESS_KEY_EVENTS); + } + EXPORT_SYMBOL(acpi_video_handles_brightness_key_presses); +-- +2.35.1 + diff --git a/queue-5.18/arm-9209-1-spectre-bhb-avoid-pr_info-every-time-a-cp.patch b/queue-5.18/arm-9209-1-spectre-bhb-avoid-pr_info-every-time-a-cp.patch new file mode 100644 index 00000000000..45034f0edbb --- /dev/null +++ b/queue-5.18/arm-9209-1-spectre-bhb-avoid-pr_info-every-time-a-cp.patch @@ -0,0 +1,58 @@ +From 2c6afffb43b463a1b06b0ed222f5c69913f2fc26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 May 2022 09:53:42 +0100 +Subject: ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out + of idle + +From: Ard Biesheuvel + +[ Upstream commit 0609e200246bfd3b7516091c491bec4308349055 ] + +Jon reports that the Spectre-BHB init code is filling up the kernel log +with spurious notifications about which mitigation has been enabled, +every time any CPU comes out of a low power state. + +Given that Spectre-BHB mitigations are system wide, only a single +mitigation can be enabled, and we already print an error if two types of +CPUs coexist in a single system that require different Spectre-BHB +mitigations. + +This means that the pr_info() that describes the selected mitigation +does not need to be emitted for each CPU anyway, and so we can simply +emit it only once. + +In order to clarify the above in the log message, update it to describe +that the selected mitigation will be enabled on all CPUs, including ones +that are unaffected. If another CPU comes up later that is affected and +requires a different mitigation, we report an error as before. + +Fixes: b9baf5c8c5c3 ("ARM: Spectre-BHB workaround") +Tested-by: Jon Hunter +Signed-off-by: Ard Biesheuvel +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/mm/proc-v7-bugs.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c +index f9730eba0632..8bc7a2d6d6c7 100644 +--- a/arch/arm/mm/proc-v7-bugs.c ++++ b/arch/arm/mm/proc-v7-bugs.c +@@ -208,10 +208,10 @@ static int spectre_bhb_install_workaround(int method) + return SPECTRE_VULNERABLE; + + spectre_bhb_method = method; +- } + +- pr_info("CPU%u: Spectre BHB: using %s workaround\n", +- smp_processor_id(), spectre_bhb_method_name(method)); ++ pr_info("CPU%u: Spectre BHB: enabling %s workaround for all CPUs\n", ++ smp_processor_id(), spectre_bhb_method_name(method)); ++ } + + return SPECTRE_MITIGATED; + } +-- +2.35.1 + diff --git a/queue-5.18/arm-9210-1-mark-the-fdt_fixed-sections-as-shareable.patch b/queue-5.18/arm-9210-1-mark-the-fdt_fixed-sections-as-shareable.patch new file mode 100644 index 00000000000..197ac97ac87 --- /dev/null +++ b/queue-5.18/arm-9210-1-mark-the-fdt_fixed-sections-as-shareable.patch @@ -0,0 +1,153 @@ +From 8ba0bf4de1412b40355b9d64601346ddd96a60ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 15:05:41 +0100 +Subject: ARM: 9210/1: Mark the FDT_FIXED sections as shareable + +From: Zhen Lei + +[ Upstream commit 598f0a99fa8a35be44b27106b43ddc66417af3b1 ] + +commit 7a1be318f579 ("ARM: 9012/1: move device tree mapping out of linear +region") use FDT_FIXED_BASE to map the whole FDT_FIXED_SIZE memory area +which contains fdt. But it only reserves the exact physical memory that +fdt occupied. Unfortunately, this mapping is non-shareable. An illegal or +speculative read access can bring the RAM content from non-fdt zone into +cache, PIPT makes it to be hit by subsequently read access through +shareable mapping(such as linear mapping), and the cache consistency +between cores is lost due to non-shareable property. + +|<---------FDT_FIXED_SIZE------>| +| | + ------------------------------- +| | | | + ------------------------------- + +1. CoreA read through MT_ROM mapping, the old data is loaded + into the cache. +2. CoreB write to update data through linear mapping. CoreA + received the notification to invalid the corresponding cachelines, but + the property non-shareable makes it to be ignored. +3. CoreA read through linear mapping, cache hit, the old data + is read. + +To eliminate this risk, add a new memory type MT_MEMORY_RO. Compared to +MT_ROM, it is shareable and non-executable. + +Here's an example: + list_del corruption. prev->next should be c0ecbf74, but was c08410dc + kernel BUG at lib/list_debug.c:53! + ... ... + PC is at __list_del_entry_valid+0x58/0x98 + LR is at __list_del_entry_valid+0x58/0x98 + psr: 60000093 + sp : c0ecbf30 ip : 00000000 fp : 00000001 + r10: c08410d0 r9 : 00000001 r8 : c0825e0c + r7 : 20000013 r6 : c08410d0 r5 : c0ecbf74 r4 : c0ecbf74 + r3 : c0825d08 r2 : 00000000 r1 : df7ce6f4 r0 : 00000044 + ... ... + Stack: (0xc0ecbf30 to 0xc0ecc000) + bf20: c0ecbf74 c0164fd0 c0ecbf70 c0165170 + bf40: c0eca000 c0840c00 c0840c00 c0824500 c0825e0c c0189bbc c088f404 60000013 + bf60: 60000013 c0e85100 000004ec 00000000 c0ebcdc0 c0ecbf74 c0ecbf74 c0825d08 + ... ... < next prev > + (__list_del_entry_valid) from (__list_del_entry+0xc/0x20) + (__list_del_entry) from (finish_swait+0x60/0x7c) + (finish_swait) from (rcu_gp_kthread+0x560/0xa20) + (rcu_gp_kthread) from (kthread+0x14c/0x15c) + (kthread) from (ret_from_fork+0x14/0x24) + +The faulty list node to be deleted is a local variable, its address is +c0ecbf74. The dumped stack shows that 'prev' = c0ecbf74, but its value +before lib/list_debug.c:53 is c08410dc. A large amount of printing results +in swapping out the cacheline containing the old data(MT_ROM mapping is +read only, so the cacheline cannot be dirty), and the subsequent dump +operation obtains new data from the DDR. + +Fixes: 7a1be318f579 ("ARM: 9012/1: move device tree mapping out of linear region") +Suggested-by: Ard Biesheuvel +Signed-off-by: Zhen Lei +Reviewed-by: Ard Biesheuvel +Reviewed-by: Kefeng Wang +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/mach/map.h | 1 + + arch/arm/mm/mmu.c | 15 ++++++++++++++- + 2 files changed, 15 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/include/asm/mach/map.h b/arch/arm/include/asm/mach/map.h +index 92282558caf7..2b8970d8e5a2 100644 +--- a/arch/arm/include/asm/mach/map.h ++++ b/arch/arm/include/asm/mach/map.h +@@ -27,6 +27,7 @@ enum { + MT_HIGH_VECTORS, + MT_MEMORY_RWX, + MT_MEMORY_RW, ++ MT_MEMORY_RO, + MT_ROM, + MT_MEMORY_RWX_NONCACHED, + MT_MEMORY_RW_DTCM, +diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c +index 5e2be37a198e..cd17e324aa51 100644 +--- a/arch/arm/mm/mmu.c ++++ b/arch/arm/mm/mmu.c +@@ -296,6 +296,13 @@ static struct mem_type mem_types[] __ro_after_init = { + .prot_sect = PMD_TYPE_SECT | PMD_SECT_AP_WRITE, + .domain = DOMAIN_KERNEL, + }, ++ [MT_MEMORY_RO] = { ++ .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY | ++ L_PTE_XN | L_PTE_RDONLY, ++ .prot_l1 = PMD_TYPE_TABLE, ++ .prot_sect = PMD_TYPE_SECT, ++ .domain = DOMAIN_KERNEL, ++ }, + [MT_ROM] = { + .prot_sect = PMD_TYPE_SECT, + .domain = DOMAIN_KERNEL, +@@ -489,6 +496,7 @@ static void __init build_mem_type_table(void) + + /* Also setup NX memory mapping */ + mem_types[MT_MEMORY_RW].prot_sect |= PMD_SECT_XN; ++ mem_types[MT_MEMORY_RO].prot_sect |= PMD_SECT_XN; + } + if (cpu_arch >= CPU_ARCH_ARMv7 && (cr & CR_TRE)) { + /* +@@ -568,6 +576,7 @@ static void __init build_mem_type_table(void) + mem_types[MT_ROM].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE; + mem_types[MT_MINICLEAN].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE; + mem_types[MT_CACHECLEAN].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE; ++ mem_types[MT_MEMORY_RO].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE; + #endif + + /* +@@ -587,6 +596,8 @@ static void __init build_mem_type_table(void) + mem_types[MT_MEMORY_RWX].prot_pte |= L_PTE_SHARED; + mem_types[MT_MEMORY_RW].prot_sect |= PMD_SECT_S; + mem_types[MT_MEMORY_RW].prot_pte |= L_PTE_SHARED; ++ mem_types[MT_MEMORY_RO].prot_sect |= PMD_SECT_S; ++ mem_types[MT_MEMORY_RO].prot_pte |= L_PTE_SHARED; + mem_types[MT_MEMORY_DMA_READY].prot_pte |= L_PTE_SHARED; + mem_types[MT_MEMORY_RWX_NONCACHED].prot_sect |= PMD_SECT_S; + mem_types[MT_MEMORY_RWX_NONCACHED].prot_pte |= L_PTE_SHARED; +@@ -647,6 +658,8 @@ static void __init build_mem_type_table(void) + mem_types[MT_MEMORY_RWX].prot_pte |= kern_pgprot; + mem_types[MT_MEMORY_RW].prot_sect |= ecc_mask | cp->pmd; + mem_types[MT_MEMORY_RW].prot_pte |= kern_pgprot; ++ mem_types[MT_MEMORY_RO].prot_sect |= ecc_mask | cp->pmd; ++ mem_types[MT_MEMORY_RO].prot_pte |= kern_pgprot; + mem_types[MT_MEMORY_DMA_READY].prot_pte |= kern_pgprot; + mem_types[MT_MEMORY_RWX_NONCACHED].prot_sect |= ecc_mask; + mem_types[MT_ROM].prot_sect |= cp->pmd; +@@ -1360,7 +1373,7 @@ static void __init devicemaps_init(const struct machine_desc *mdesc) + map.pfn = __phys_to_pfn(__atags_pointer & SECTION_MASK); + map.virtual = FDT_FIXED_BASE; + map.length = FDT_FIXED_SIZE; +- map.type = MT_ROM; ++ map.type = MT_MEMORY_RO; + create_mapping(&map); + } + +-- +2.35.1 + diff --git a/queue-5.18/arm-dts-at91-sama5d2-fix-typo-in-i2s1-node.patch b/queue-5.18/arm-dts-at91-sama5d2-fix-typo-in-i2s1-node.patch new file mode 100644 index 00000000000..cc328bce324 --- /dev/null +++ b/queue-5.18/arm-dts-at91-sama5d2-fix-typo-in-i2s1-node.patch @@ -0,0 +1,40 @@ +From 33fd71095f70f3f92b7f99e0b2141d7075fda7c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jul 2022 14:58:12 -0700 +Subject: ARM: dts: at91: sama5d2: Fix typo in i2s1 node + +From: Ryan Wanner + +[ Upstream commit 2fdf15b50a46e366740df4cccbe2343269b4ff55 ] + +Fix typo in i2s1 causing errors in dt binding validation. +Change assigned-parrents to assigned-clock-parents +to match i2s0 node formatting. + +Fixes: 1ca81883c557 ("ARM: dts: at91: sama5d2: add nodes for I2S controllers") +Signed-off-by: Ryan Wanner +[claudiu.beznea: use imperative addressing in commit description, remove + blank line after fixes tag, fix typo in commit message] +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20220707215812.193008-1-Ryan.Wanner@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sama5d2.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi +index 89c71d419f82..659a17fc755c 100644 +--- a/arch/arm/boot/dts/sama5d2.dtsi ++++ b/arch/arm/boot/dts/sama5d2.dtsi +@@ -1124,7 +1124,7 @@ AT91_XDMAC_DT_PERID(33))>, + clocks = <&pmc PMC_TYPE_PERIPHERAL 55>, <&pmc PMC_TYPE_GCK 55>; + clock-names = "pclk", "gclk"; + assigned-clocks = <&pmc PMC_TYPE_CORE PMC_I2S1_MUX>; +- assigned-parrents = <&pmc PMC_TYPE_GCK 55>; ++ assigned-clock-parents = <&pmc PMC_TYPE_GCK 55>; + status = "disabled"; + }; + +-- +2.35.1 + diff --git a/queue-5.18/arm-dts-imx6qdl-ts7970-fix-ngpio-typo-and-count.patch b/queue-5.18/arm-dts-imx6qdl-ts7970-fix-ngpio-typo-and-count.patch new file mode 100644 index 00000000000..f9630c25e84 --- /dev/null +++ b/queue-5.18/arm-dts-imx6qdl-ts7970-fix-ngpio-typo-and-count.patch @@ -0,0 +1,39 @@ +From 043b2649d5bee83aa882ceb150ab3bc65f4cc21c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 14:03:27 -0700 +Subject: ARM: dts: imx6qdl-ts7970: Fix ngpio typo and count + +From: Kris Bahnsen + +[ Upstream commit e95ea0f687e679fcb0a3a67d0755b81ee7d60db0 ] + +Device-tree incorrectly used "ngpio" which caused the driver to +fallback to 32 ngpios. + +This platform has 62 GPIO registers. + +Fixes: 9ff8e9fccef9 ("ARM: dts: TS-7970: add basic device tree") +Signed-off-by: Kris Bahnsen +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-ts7970.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-ts7970.dtsi b/arch/arm/boot/dts/imx6qdl-ts7970.dtsi +index fded07f370b3..d6ba4b2a60f6 100644 +--- a/arch/arm/boot/dts/imx6qdl-ts7970.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-ts7970.dtsi +@@ -226,7 +226,7 @@ gpio8: gpio@28 { + reg = <0x28>; + #gpio-cells = <2>; + gpio-controller; +- ngpio = <32>; ++ ngpios = <62>; + }; + + sgtl5000: codec@a { +-- +2.35.1 + diff --git a/queue-5.18/arm-dts-sunxi-fix-spi-nor-campatible-on-orange-pi-ze.patch b/queue-5.18/arm-dts-sunxi-fix-spi-nor-campatible-on-orange-pi-ze.patch new file mode 100644 index 00000000000..c38c1991962 --- /dev/null +++ b/queue-5.18/arm-dts-sunxi-fix-spi-nor-campatible-on-orange-pi-ze.patch @@ -0,0 +1,40 @@ +From 77f7948e3b082112a971c73898943fff2e2ab686 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 19:45:29 +0200 +Subject: ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero + +From: Michal Suchanek + +[ Upstream commit 884b66976a7279ee889ba885fe364244d50b79e7 ] + +The device tree should include generic "jedec,spi-nor" compatible, and a +manufacturer-specific one. +The macronix part is what is shipped on the boards that come with a +flash chip. + +Fixes: 45857ae95478 ("ARM: dts: orange-pi-zero: add node for SPI NOR") +Signed-off-by: Michal Suchanek +Acked-by: Jernej Skrabec +Signed-off-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20220708174529.3360-1-msuchanek@suse.de +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts b/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts +index f19ed981da9d..3706216ffb40 100644 +--- a/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts ++++ b/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts +@@ -169,7 +169,7 @@ &spi0 { + flash@0 { + #address-cells = <1>; + #size-cells = <1>; +- compatible = "mxicy,mx25l1606e", "winbond,w25q128"; ++ compatible = "mxicy,mx25l1606e", "jedec,spi-nor"; + reg = <0>; + spi-max-frequency = <40000000>; + }; +-- +2.35.1 + diff --git a/queue-5.18/arm64-dts-broadcom-bcm4908-fix-cpu-node-for-smp-boot.patch b/queue-5.18/arm64-dts-broadcom-bcm4908-fix-cpu-node-for-smp-boot.patch new file mode 100644 index 00000000000..3f98bd80b0f --- /dev/null +++ b/queue-5.18/arm64-dts-broadcom-bcm4908-fix-cpu-node-for-smp-boot.patch @@ -0,0 +1,38 @@ +From 4bdfd8addaf0d76ec15b5a3fc356ab9262d2aaa3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 11:25:07 -0700 +Subject: arm64: dts: broadcom: bcm4908: Fix cpu node for smp boot + +From: William Zhang + +[ Upstream commit 8bd582ae9a71d7f14c4e0c735b2eacaf7516d626 ] + +Add spin-table enable-method and cpu-release-addr properties for +cpu0 node. This is required by all ARMv8 SoC. Otherwise some +bootloader like u-boot can not update cpu-release-addr and linux +fails to start up secondary cpus. + +Fixes: 2961f69f151c ("arm64: dts: broadcom: add BCM4908 and Asus GT-AC5300 early DTS files") +Signed-off-by: William Zhang +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi b/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi +index a4be040a00c0..967d2cd3c3ce 100644 +--- a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi ++++ b/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi +@@ -29,6 +29,8 @@ cpu0: cpu@0 { + device_type = "cpu"; + compatible = "brcm,brahma-b53"; + reg = <0x0>; ++ enable-method = "spin-table"; ++ cpu-release-addr = <0x0 0xfff8>; + next-level-cache = <&l2>; + }; + +-- +2.35.1 + diff --git a/queue-5.18/arm64-dts-broadcom-bcm4908-fix-timer-node-for-bcm490.patch b/queue-5.18/arm64-dts-broadcom-bcm4908-fix-timer-node-for-bcm490.patch new file mode 100644 index 00000000000..a80953efdb7 --- /dev/null +++ b/queue-5.18/arm64-dts-broadcom-bcm4908-fix-timer-node-for-bcm490.patch @@ -0,0 +1,43 @@ +From 4f5b5081d3cd73ad96822ff71b2df73fa67f6158 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 11:25:06 -0700 +Subject: arm64: dts: broadcom: bcm4908: Fix timer node for BCM4906 SoC + +From: William Zhang + +[ Upstream commit b4a544e415e9be33b37d9bfa9d9f9f4d13f553d6 ] + +The cpu mask value in interrupt property inherits from bcm4908.dtsi +which sets to four cpus. Correct the value to two cpus for dual core +BCM4906 SoC. + +Fixes: c8b404fb05dc ("arm64: dts: broadcom: bcm4908: add BCM4906 Netgear R8000P DTS files") +Signed-off-by: William Zhang +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/broadcom/bcm4908/bcm4906.dtsi | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4906.dtsi b/arch/arm64/boot/dts/broadcom/bcm4908/bcm4906.dtsi +index 66023d553524..d084c33d5ca8 100644 +--- a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4906.dtsi ++++ b/arch/arm64/boot/dts/broadcom/bcm4908/bcm4906.dtsi +@@ -9,6 +9,14 @@ cpus { + /delete-node/ cpu@3; + }; + ++ timer { ++ compatible = "arm,armv8-timer"; ++ interrupts = , ++ , ++ , ++ ; ++ }; ++ + pmu { + compatible = "arm,cortex-a53-pmu"; + interrupts = , +-- +2.35.1 + diff --git a/queue-5.18/arm64-dts-ls1028a-update-sfp-node-to-include-clock.patch b/queue-5.18/arm64-dts-ls1028a-update-sfp-node-to-include-clock.patch new file mode 100644 index 00000000000..0a6a1f26939 --- /dev/null +++ b/queue-5.18/arm64-dts-ls1028a-update-sfp-node-to-include-clock.patch @@ -0,0 +1,41 @@ +From c36cbfda80752f5ad2fc564563788c9616d010ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 14:16:59 -0400 +Subject: arm64: dts: ls1028a: Update SFP node to include clock + +From: Sean Anderson + +[ Upstream commit 3c12e9da3098a30fc82dea01768d355c28e3692d ] + +The clocks property is now mandatory. Add it to avoid warning message. + +Signed-off-by: Sean Anderson +Reviewed-by: Michael Walle +Fixes: eba5bea8f37f ("arm64: dts: ls1028a: add efuse node") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +index 088271d49139..59b289b52a28 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +@@ -224,9 +224,12 @@ rst: syscon@1e60000 { + little-endian; + }; + +- efuse@1e80000 { ++ sfp: efuse@1e80000 { + compatible = "fsl,ls1028a-sfp"; + reg = <0x0 0x1e80000 0x0 0x10000>; ++ clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL ++ QORIQ_CLK_PLL_DIV(4)>; ++ clock-names = "sfp"; + #address-cells = <1>; + #size-cells = <1>; + +-- +2.35.1 + diff --git a/queue-5.18/asoc-intel-skylake-correct-the-handling-of-fmt_confi.patch b/queue-5.18/asoc-intel-skylake-correct-the-handling-of-fmt_confi.patch new file mode 100644 index 00000000000..1fec1d97672 --- /dev/null +++ b/queue-5.18/asoc-intel-skylake-correct-the-handling-of-fmt_confi.patch @@ -0,0 +1,133 @@ +From e5499c9a702b12ca756e7d673727585bf4647896 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 09:56:38 +0300 +Subject: ASoC: Intel: Skylake: Correct the handling of fmt_config flexible + array + +From: Peter Ujfalusi + +[ Upstream commit fc976f5629afb4160ee77798b14a693eac903ffd ] + +The struct nhlt_format's fmt_config is a flexible array, it must not be +used as normal array. +When moving to the next nhlt_fmt_cfg we need to take into account the data +behind the ->config.caps (indicated by ->config.size). + +The logic of the code also changed: it is no longer saves the _last_ +fmt_cfg for all found rates. + +Fixes: bc2bd45b1f7f3 ("ASoC: Intel: Skylake: Parse nhlt and register clock device") +Signed-off-by: Peter Ujfalusi +Reviewed-by: Cezary Rojewski +Link: https://lore.kernel.org/r/20220630065638.11183-3-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/skylake/skl-nhlt.c | 37 ++++++++++++++++++++---------- + 1 file changed, 25 insertions(+), 12 deletions(-) + +diff --git a/sound/soc/intel/skylake/skl-nhlt.c b/sound/soc/intel/skylake/skl-nhlt.c +index 366f7bd9bc02..deb7b820325e 100644 +--- a/sound/soc/intel/skylake/skl-nhlt.c ++++ b/sound/soc/intel/skylake/skl-nhlt.c +@@ -111,11 +111,12 @@ static void skl_get_ssp_clks(struct skl_dev *skl, struct skl_ssp_clk *ssp_clks, + if (fmt->fmt_count == 0) + return; + ++ fmt_cfg = (struct nhlt_fmt_cfg *)fmt->fmt_config; + for (i = 0; i < fmt->fmt_count; i++) { ++ struct nhlt_fmt_cfg *saved_fmt_cfg = fmt_cfg; + bool present = false; + +- fmt_cfg = &fmt->fmt_config[i]; +- wav_fmt = &fmt_cfg->fmt_ext; ++ wav_fmt = &saved_fmt_cfg->fmt_ext; + + channels = wav_fmt->fmt.channels; + bps = wav_fmt->fmt.bits_per_sample; +@@ -133,12 +134,18 @@ static void skl_get_ssp_clks(struct skl_dev *skl, struct skl_ssp_clk *ssp_clks, + * derive the rate. + */ + for (j = i; j < fmt->fmt_count; j++) { +- fmt_cfg = &fmt->fmt_config[j]; +- wav_fmt = &fmt_cfg->fmt_ext; ++ struct nhlt_fmt_cfg *tmp_fmt_cfg = fmt_cfg; ++ ++ wav_fmt = &tmp_fmt_cfg->fmt_ext; + if ((fs == wav_fmt->fmt.samples_per_sec) && +- (bps == wav_fmt->fmt.bits_per_sample)) ++ (bps == wav_fmt->fmt.bits_per_sample)) { + channels = max_t(u16, channels, + wav_fmt->fmt.channels); ++ saved_fmt_cfg = tmp_fmt_cfg; ++ } ++ /* Move to the next nhlt_fmt_cfg */ ++ tmp_fmt_cfg = (struct nhlt_fmt_cfg *)(tmp_fmt_cfg->config.caps + ++ tmp_fmt_cfg->config.size); + } + + rate = channels * bps * fs; +@@ -154,8 +161,11 @@ static void skl_get_ssp_clks(struct skl_dev *skl, struct skl_ssp_clk *ssp_clks, + + /* Fill rate and parent for sclk/sclkfs */ + if (!present) { ++ struct nhlt_fmt_cfg *first_fmt_cfg; ++ ++ first_fmt_cfg = (struct nhlt_fmt_cfg *)fmt->fmt_config; + i2s_config_ext = (struct skl_i2s_config_blob_ext *) +- fmt->fmt_config[0].config.caps; ++ first_fmt_cfg->config.caps; + + /* MCLK Divider Source Select */ + if (is_legacy_blob(i2s_config_ext->hdr.sig)) { +@@ -169,6 +179,9 @@ static void skl_get_ssp_clks(struct skl_dev *skl, struct skl_ssp_clk *ssp_clks, + + parent = skl_get_parent_clk(clk_src); + ++ /* Move to the next nhlt_fmt_cfg */ ++ fmt_cfg = (struct nhlt_fmt_cfg *)(fmt_cfg->config.caps + ++ fmt_cfg->config.size); + /* + * Do not copy the config data if there is no parent + * clock available for this clock source select +@@ -177,9 +190,9 @@ static void skl_get_ssp_clks(struct skl_dev *skl, struct skl_ssp_clk *ssp_clks, + continue; + + sclk[id].rate_cfg[rate_index].rate = rate; +- sclk[id].rate_cfg[rate_index].config = fmt_cfg; ++ sclk[id].rate_cfg[rate_index].config = saved_fmt_cfg; + sclkfs[id].rate_cfg[rate_index].rate = rate; +- sclkfs[id].rate_cfg[rate_index].config = fmt_cfg; ++ sclkfs[id].rate_cfg[rate_index].config = saved_fmt_cfg; + sclk[id].parent_name = parent->name; + sclkfs[id].parent_name = parent->name; + +@@ -193,13 +206,13 @@ static void skl_get_mclk(struct skl_dev *skl, struct skl_ssp_clk *mclk, + { + struct skl_i2s_config_blob_ext *i2s_config_ext; + struct skl_i2s_config_blob_legacy *i2s_config; +- struct nhlt_specific_cfg *fmt_cfg; ++ struct nhlt_fmt_cfg *fmt_cfg; + struct skl_clk_parent_src *parent; + u32 clkdiv, div_ratio; + u8 clk_src; + +- fmt_cfg = &fmt->fmt_config[0].config; +- i2s_config_ext = (struct skl_i2s_config_blob_ext *)fmt_cfg->caps; ++ fmt_cfg = (struct nhlt_fmt_cfg *)fmt->fmt_config; ++ i2s_config_ext = (struct skl_i2s_config_blob_ext *)fmt_cfg->config.caps; + + /* MCLK Divider Source Select and divider */ + if (is_legacy_blob(i2s_config_ext->hdr.sig)) { +@@ -228,7 +241,7 @@ static void skl_get_mclk(struct skl_dev *skl, struct skl_ssp_clk *mclk, + return; + + mclk[id].rate_cfg[0].rate = parent->rate/div_ratio; +- mclk[id].rate_cfg[0].config = &fmt->fmt_config[0]; ++ mclk[id].rate_cfg[0].config = fmt_cfg; + mclk[id].parent_name = parent->name; + } + +-- +2.35.1 + diff --git a/queue-5.18/asoc-intel-skylake-correct-the-ssp-rate-discovery-in.patch b/queue-5.18/asoc-intel-skylake-correct-the-ssp-rate-discovery-in.patch new file mode 100644 index 00000000000..cca39d4c851 --- /dev/null +++ b/queue-5.18/asoc-intel-skylake-correct-the-ssp-rate-discovery-in.patch @@ -0,0 +1,48 @@ +From 60a05bdf68d941bc73bbb20c5b5b7aa9a9b8c7c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 09:56:37 +0300 +Subject: ASoC: Intel: Skylake: Correct the ssp rate discovery in + skl_get_ssp_clks() + +From: Peter Ujfalusi + +[ Upstream commit 219af251bd1694bce1f627d238347d2eaf13de61 ] + +The present flag is only set once when one rate has been found to be saved. +This will effectively going to ignore any rate discovered at later time and +based on the code, this is not the intention. + +Fixes: bc2bd45b1f7f3 ("ASoC: Intel: Skylake: Parse nhlt and register clock device") +Signed-off-by: Peter Ujfalusi +Reviewed-by: Cezary Rojewski +Link: https://lore.kernel.org/r/20220630065638.11183-2-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/skylake/skl-nhlt.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/intel/skylake/skl-nhlt.c b/sound/soc/intel/skylake/skl-nhlt.c +index 2439a574ac2f..366f7bd9bc02 100644 +--- a/sound/soc/intel/skylake/skl-nhlt.c ++++ b/sound/soc/intel/skylake/skl-nhlt.c +@@ -99,7 +99,6 @@ static void skl_get_ssp_clks(struct skl_dev *skl, struct skl_ssp_clk *ssp_clks, + struct nhlt_fmt_cfg *fmt_cfg; + struct wav_fmt_ext *wav_fmt; + unsigned long rate; +- bool present = false; + int rate_index = 0; + u16 channels, bps; + u8 clk_src; +@@ -113,6 +112,8 @@ static void skl_get_ssp_clks(struct skl_dev *skl, struct skl_ssp_clk *ssp_clks, + return; + + for (i = 0; i < fmt->fmt_count; i++) { ++ bool present = false; ++ + fmt_cfg = &fmt->fmt_config[i]; + wav_fmt = &fmt_cfg->fmt_ext; + +-- +2.35.1 + diff --git a/queue-5.18/asoc-sgtl5000-fix-noise-on-shutdown-remove.patch b/queue-5.18/asoc-sgtl5000-fix-noise-on-shutdown-remove.patch new file mode 100644 index 00000000000..62f02f7e751 --- /dev/null +++ b/queue-5.18/asoc-sgtl5000-fix-noise-on-shutdown-remove.patch @@ -0,0 +1,79 @@ +From 3d1900195fdf321cf465db214ff69ae9b6fbcfbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jun 2022 12:13:01 +0200 +Subject: ASoC: sgtl5000: Fix noise on shutdown/remove + +From: Francesco Dolcini + +[ Upstream commit 040e3360af3736348112d29425bf5d0be5b93115 ] + +Put the SGTL5000 in a silent/safe state on shutdown/remove, this is +required since the SGTL5000 produces a constant noise on its output +after it is configured and its clock is removed. Without this change +this is happening every time the module is unbound/removed or from +reboot till the clock is enabled again. + +The issue was experienced on both a Toradex Colibri/Apalis iMX6, but can +be easily reproduced everywhere just playing something on the codec and +after that removing/unbinding the driver. + +Fixes: 9b34e6cc3bc2 ("ASoC: Add Freescale SGTL5000 codec support") +Signed-off-by: Francesco Dolcini +Reviewed-by: Fabio Estevam +Link: https://lore.kernel.org/r/20220624101301.441314-1-francesco.dolcini@toradex.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/sgtl5000.c | 9 +++++++++ + sound/soc/codecs/sgtl5000.h | 1 + + 2 files changed, 10 insertions(+) + +diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c +index 8eebf27d0ea2..281785a9301b 100644 +--- a/sound/soc/codecs/sgtl5000.c ++++ b/sound/soc/codecs/sgtl5000.c +@@ -1796,6 +1796,9 @@ static int sgtl5000_i2c_remove(struct i2c_client *client) + { + struct sgtl5000_priv *sgtl5000 = i2c_get_clientdata(client); + ++ regmap_write(sgtl5000->regmap, SGTL5000_CHIP_DIG_POWER, SGTL5000_DIG_POWER_DEFAULT); ++ regmap_write(sgtl5000->regmap, SGTL5000_CHIP_ANA_POWER, SGTL5000_ANA_POWER_DEFAULT); ++ + clk_disable_unprepare(sgtl5000->mclk); + regulator_bulk_disable(sgtl5000->num_supplies, sgtl5000->supplies); + regulator_bulk_free(sgtl5000->num_supplies, sgtl5000->supplies); +@@ -1803,6 +1806,11 @@ static int sgtl5000_i2c_remove(struct i2c_client *client) + return 0; + } + ++static void sgtl5000_i2c_shutdown(struct i2c_client *client) ++{ ++ sgtl5000_i2c_remove(client); ++} ++ + static const struct i2c_device_id sgtl5000_id[] = { + {"sgtl5000", 0}, + {}, +@@ -1823,6 +1831,7 @@ static struct i2c_driver sgtl5000_i2c_driver = { + }, + .probe = sgtl5000_i2c_probe, + .remove = sgtl5000_i2c_remove, ++ .shutdown = sgtl5000_i2c_shutdown, + .id_table = sgtl5000_id, + }; + +diff --git a/sound/soc/codecs/sgtl5000.h b/sound/soc/codecs/sgtl5000.h +index 56ec5863f250..3a808c762299 100644 +--- a/sound/soc/codecs/sgtl5000.h ++++ b/sound/soc/codecs/sgtl5000.h +@@ -80,6 +80,7 @@ + /* + * SGTL5000_CHIP_DIG_POWER + */ ++#define SGTL5000_DIG_POWER_DEFAULT 0x0000 + #define SGTL5000_ADC_EN 0x0040 + #define SGTL5000_DAC_EN 0x0020 + #define SGTL5000_DAP_POWERUP 0x0010 +-- +2.35.1 + diff --git a/queue-5.18/asoc-tas2764-add-post-reset-delays.patch b/queue-5.18/asoc-tas2764-add-post-reset-delays.patch new file mode 100644 index 00000000000..f264d2f695f --- /dev/null +++ b/queue-5.18/asoc-tas2764-add-post-reset-delays.patch @@ -0,0 +1,69 @@ +From 31d74d8d7471ddacd43ff9603f69c77195c2f1d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 09:51:32 +0200 +Subject: ASoC: tas2764: Add post reset delays +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Martin PoviÅ¡er + +[ Upstream commit cd10bb89b0d57bca98eb75e0444854a1c129a14e ] + +Make sure there is at least 1 ms delay from reset to first command as +is specified in the datasheet. This is a fix similar to commit +307f31452078 ("ASoC: tas2770: Insert post reset delay"). + +Fixes: 827ed8a0fa50 ("ASoC: tas2764: Add the driver for the TAS2764") +Signed-off-by: Martin PoviÅ¡er +Link: https://lore.kernel.org/r/20220630075135.2221-1-povik+lin@cutebit.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2764.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/tas2764.c b/sound/soc/codecs/tas2764.c +index 9265af41c235..edc66ff6dc49 100644 +--- a/sound/soc/codecs/tas2764.c ++++ b/sound/soc/codecs/tas2764.c +@@ -42,10 +42,12 @@ static void tas2764_reset(struct tas2764_priv *tas2764) + gpiod_set_value_cansleep(tas2764->reset_gpio, 0); + msleep(20); + gpiod_set_value_cansleep(tas2764->reset_gpio, 1); ++ usleep_range(1000, 2000); + } + + snd_soc_component_write(tas2764->component, TAS2764_SW_RST, + TAS2764_RST); ++ usleep_range(1000, 2000); + } + + static int tas2764_set_bias_level(struct snd_soc_component *component, +@@ -107,8 +109,10 @@ static int tas2764_codec_resume(struct snd_soc_component *component) + struct tas2764_priv *tas2764 = snd_soc_component_get_drvdata(component); + int ret; + +- if (tas2764->sdz_gpio) ++ if (tas2764->sdz_gpio) { + gpiod_set_value_cansleep(tas2764->sdz_gpio, 1); ++ usleep_range(1000, 2000); ++ } + + ret = snd_soc_component_update_bits(component, TAS2764_PWR_CTRL, + TAS2764_PWR_CTRL_MASK, +@@ -501,8 +505,10 @@ static int tas2764_codec_probe(struct snd_soc_component *component) + + tas2764->component = component; + +- if (tas2764->sdz_gpio) ++ if (tas2764->sdz_gpio) { + gpiod_set_value_cansleep(tas2764->sdz_gpio, 1); ++ usleep_range(1000, 2000); ++ } + + tas2764_reset(tas2764); + +-- +2.35.1 + diff --git a/queue-5.18/asoc-tas2764-correct-playback-volume-range.patch b/queue-5.18/asoc-tas2764-correct-playback-volume-range.patch new file mode 100644 index 00000000000..d1e6684627a --- /dev/null +++ b/queue-5.18/asoc-tas2764-correct-playback-volume-range.patch @@ -0,0 +1,43 @@ +From ac148d50598745f1787eecc0311628e8026e65b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 09:51:34 +0200 +Subject: ASoC: tas2764: Correct playback volume range +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hector Martin + +[ Upstream commit 3e99e5697e1f7120b5abc755e8a560b22612d6ed ] + +DVC value 0xc8 is -100dB and 0xc9 is mute; this needs to map to +-100.5dB as far as the dB scale is concerned. Fix that and enable +the mute flag, so alsamixer correctly shows the control as +<0 dB .. -100 dB, mute>. + +Signed-off-by: Hector Martin +Fixes: 827ed8a0fa50 ("ASoC: tas2764: Add the driver for the TAS2764") +Signed-off-by: Martin PoviÅ¡er +Link: https://lore.kernel.org/r/20220630075135.2221-3-povik+lin@cutebit.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2764.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/tas2764.c b/sound/soc/codecs/tas2764.c +index 46c815650b2c..bd79bc7ecf6b 100644 +--- a/sound/soc/codecs/tas2764.c ++++ b/sound/soc/codecs/tas2764.c +@@ -536,7 +536,7 @@ static int tas2764_codec_probe(struct snd_soc_component *component) + } + + static DECLARE_TLV_DB_SCALE(tas2764_digital_tlv, 1100, 50, 0); +-static DECLARE_TLV_DB_SCALE(tas2764_playback_volume, -10000, 50, 0); ++static DECLARE_TLV_DB_SCALE(tas2764_playback_volume, -10050, 50, 1); + + static const struct snd_kcontrol_new tas2764_snd_controls[] = { + SOC_SINGLE_TLV("Speaker Volume", TAS2764_DVC, 0, +-- +2.35.1 + diff --git a/queue-5.18/asoc-tas2764-fix-amp-gain-register-offset-default.patch b/queue-5.18/asoc-tas2764-fix-amp-gain-register-offset-default.patch new file mode 100644 index 00000000000..3e8d31a9ec5 --- /dev/null +++ b/queue-5.18/asoc-tas2764-fix-amp-gain-register-offset-default.patch @@ -0,0 +1,52 @@ +From f81ab5a2ba6266b96df5f175d5613be008edef28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 09:51:35 +0200 +Subject: ASoC: tas2764: Fix amp gain register offset & default +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hector Martin + +[ Upstream commit 1c4f29ec878bbf1cc0a1eb54ae7da5ff98e19641 ] + +The register default is 0x28 per the datasheet, and the amp gain field +is supposed to be shifted left by one. With the wrong default, the ALSA +controls lie about the power-up state. With the wrong shift, we get only +half the gain we expect. + +Signed-off-by: Hector Martin +Fixes: 827ed8a0fa50 ("ASoC: tas2764: Add the driver for the TAS2764") +Signed-off-by: Martin PoviÅ¡er +Link: https://lore.kernel.org/r/20220630075135.2221-4-povik+lin@cutebit.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2764.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/tas2764.c b/sound/soc/codecs/tas2764.c +index bd79bc7ecf6b..ec13ba01e522 100644 +--- a/sound/soc/codecs/tas2764.c ++++ b/sound/soc/codecs/tas2764.c +@@ -541,7 +541,7 @@ static DECLARE_TLV_DB_SCALE(tas2764_playback_volume, -10050, 50, 1); + static const struct snd_kcontrol_new tas2764_snd_controls[] = { + SOC_SINGLE_TLV("Speaker Volume", TAS2764_DVC, 0, + TAS2764_DVC_MAX, 1, tas2764_playback_volume), +- SOC_SINGLE_TLV("Amp Gain Volume", TAS2764_CHNL_0, 0, 0x14, 0, ++ SOC_SINGLE_TLV("Amp Gain Volume", TAS2764_CHNL_0, 1, 0x14, 0, + tas2764_digital_tlv), + }; + +@@ -566,7 +566,7 @@ static const struct reg_default tas2764_reg_defaults[] = { + { TAS2764_SW_RST, 0x00 }, + { TAS2764_PWR_CTRL, 0x1a }, + { TAS2764_DVC, 0x00 }, +- { TAS2764_CHNL_0, 0x00 }, ++ { TAS2764_CHNL_0, 0x28 }, + { TAS2764_TDM_CFG0, 0x09 }, + { TAS2764_TDM_CFG1, 0x02 }, + { TAS2764_TDM_CFG2, 0x0a }, +-- +2.35.1 + diff --git a/queue-5.18/asoc-tas2764-fix-and-extend-fsync-polarity-handling.patch b/queue-5.18/asoc-tas2764-fix-and-extend-fsync-polarity-handling.patch new file mode 100644 index 00000000000..e87e080e02e --- /dev/null +++ b/queue-5.18/asoc-tas2764-fix-and-extend-fsync-polarity-handling.patch @@ -0,0 +1,135 @@ +From cad7d03bd997ed70365765cfeed3e90eb49ebf9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 09:51:33 +0200 +Subject: ASoC: tas2764: Fix and extend FSYNC polarity handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Martin PoviÅ¡er + +[ Upstream commit d1a10f1b48202e2d183cce144c218a211e98d906 ] + +Fix setting of FSYNC polarity in case of LEFT_J and DSP_A/B formats. +Do NOT set the SCFG field as was previously done, because that is not +correct and is also in conflict with the "ASI1 Source" control which +sets the same SCFG field! + +Also add support for explicit polarity inversion. + +Fixes: 827ed8a0fa50 ("ASoC: tas2764: Add the driver for the TAS2764") +Signed-off-by: Martin PoviÅ¡er +Link: https://lore.kernel.org/r/20220630075135.2221-2-povik+lin@cutebit.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2764.c | 30 +++++++++++++++++------------- + sound/soc/codecs/tas2764.h | 6 ++---- + 2 files changed, 19 insertions(+), 17 deletions(-) + +diff --git a/sound/soc/codecs/tas2764.c b/sound/soc/codecs/tas2764.c +index edc66ff6dc49..46c815650b2c 100644 +--- a/sound/soc/codecs/tas2764.c ++++ b/sound/soc/codecs/tas2764.c +@@ -135,7 +135,8 @@ static const char * const tas2764_ASI1_src[] = { + }; + + static SOC_ENUM_SINGLE_DECL( +- tas2764_ASI1_src_enum, TAS2764_TDM_CFG2, 4, tas2764_ASI1_src); ++ tas2764_ASI1_src_enum, TAS2764_TDM_CFG2, TAS2764_TDM_CFG2_SCFG_SHIFT, ++ tas2764_ASI1_src); + + static const struct snd_kcontrol_new tas2764_asi1_mux = + SOC_DAPM_ENUM("ASI1 Source", tas2764_ASI1_src_enum); +@@ -333,20 +334,22 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) + { + struct snd_soc_component *component = dai->component; + struct tas2764_priv *tas2764 = snd_soc_component_get_drvdata(component); +- u8 tdm_rx_start_slot = 0, asi_cfg_1 = 0; +- int iface; ++ u8 tdm_rx_start_slot = 0, asi_cfg_0 = 0, asi_cfg_1 = 0; + int ret; + + switch (fmt & SND_SOC_DAIFMT_INV_MASK) { ++ case SND_SOC_DAIFMT_NB_IF: ++ asi_cfg_0 ^= TAS2764_TDM_CFG0_FRAME_START; ++ fallthrough; + case SND_SOC_DAIFMT_NB_NF: + asi_cfg_1 = TAS2764_TDM_CFG1_RX_RISING; + break; ++ case SND_SOC_DAIFMT_IB_IF: ++ asi_cfg_0 ^= TAS2764_TDM_CFG0_FRAME_START; ++ fallthrough; + case SND_SOC_DAIFMT_IB_NF: + asi_cfg_1 = TAS2764_TDM_CFG1_RX_FALLING; + break; +- default: +- dev_err(tas2764->dev, "ASI format Inverse is not found\n"); +- return -EINVAL; + } + + ret = snd_soc_component_update_bits(component, TAS2764_TDM_CFG1, +@@ -357,13 +360,13 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) + + switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) { + case SND_SOC_DAIFMT_I2S: ++ asi_cfg_0 ^= TAS2764_TDM_CFG0_FRAME_START; ++ fallthrough; + case SND_SOC_DAIFMT_DSP_A: +- iface = TAS2764_TDM_CFG2_SCFG_I2S; + tdm_rx_start_slot = 1; + break; + case SND_SOC_DAIFMT_DSP_B: + case SND_SOC_DAIFMT_LEFT_J: +- iface = TAS2764_TDM_CFG2_SCFG_LEFT_J; + tdm_rx_start_slot = 0; + break; + default: +@@ -372,14 +375,15 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) + return -EINVAL; + } + +- ret = snd_soc_component_update_bits(component, TAS2764_TDM_CFG1, +- TAS2764_TDM_CFG1_MASK, +- (tdm_rx_start_slot << TAS2764_TDM_CFG1_51_SHIFT)); ++ ret = snd_soc_component_update_bits(component, TAS2764_TDM_CFG0, ++ TAS2764_TDM_CFG0_FRAME_START, ++ asi_cfg_0); + if (ret < 0) + return ret; + +- ret = snd_soc_component_update_bits(component, TAS2764_TDM_CFG2, +- TAS2764_TDM_CFG2_SCFG_MASK, iface); ++ ret = snd_soc_component_update_bits(component, TAS2764_TDM_CFG1, ++ TAS2764_TDM_CFG1_MASK, ++ (tdm_rx_start_slot << TAS2764_TDM_CFG1_51_SHIFT)); + if (ret < 0) + return ret; + +diff --git a/sound/soc/codecs/tas2764.h b/sound/soc/codecs/tas2764.h +index 67d6fd903c42..f015f22a083b 100644 +--- a/sound/soc/codecs/tas2764.h ++++ b/sound/soc/codecs/tas2764.h +@@ -47,6 +47,7 @@ + #define TAS2764_TDM_CFG0_MASK GENMASK(3, 1) + #define TAS2764_TDM_CFG0_44_1_48KHZ BIT(3) + #define TAS2764_TDM_CFG0_88_2_96KHZ (BIT(3) | BIT(1)) ++#define TAS2764_TDM_CFG0_FRAME_START BIT(0) + + /* TDM Configuration Reg1 */ + #define TAS2764_TDM_CFG1 TAS2764_REG(0X0, 0x09) +@@ -66,10 +67,7 @@ + #define TAS2764_TDM_CFG2_RXS_16BITS 0x0 + #define TAS2764_TDM_CFG2_RXS_24BITS BIT(0) + #define TAS2764_TDM_CFG2_RXS_32BITS BIT(1) +-#define TAS2764_TDM_CFG2_SCFG_MASK GENMASK(5, 4) +-#define TAS2764_TDM_CFG2_SCFG_I2S 0x0 +-#define TAS2764_TDM_CFG2_SCFG_LEFT_J BIT(4) +-#define TAS2764_TDM_CFG2_SCFG_RIGHT_J BIT(5) ++#define TAS2764_TDM_CFG2_SCFG_SHIFT 4 + + /* TDM Configuration Reg3 */ + #define TAS2764_TDM_CFG3 TAS2764_REG(0X0, 0x0c) +-- +2.35.1 + diff --git a/queue-5.18/bnxt_en-fix-bnxt_refclk_read.patch b/queue-5.18/bnxt_en-fix-bnxt_refclk_read.patch new file mode 100644 index 00000000000..64968bb608c --- /dev/null +++ b/queue-5.18/bnxt_en-fix-bnxt_refclk_read.patch @@ -0,0 +1,60 @@ +From cf6794f66a76e793b7b8b43252ee7388ea117d1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 22:26:18 -0400 +Subject: bnxt_en: Fix bnxt_refclk_read() + +From: Pavan Chebbi + +[ Upstream commit ddde5412fdaa5048bbca31529d46cb8da882870c ] + +The upper 32-bit PHC register is not latched when reading the lower +32-bit PHC register. Current code leaves a small window where we may +not read correct higher order bits if the lower order bits are just about +to wrap around. + +This patch fixes this by reading higher order bits twice and makes +sure that final value is correctly paired with its lower 32 bits. + +Fixes: 30e96f487f64 ("bnxt_en: Do not read the PTP PHC during chip reset") +Cc: Richard Cochran +Signed-off-by: Pavan Chebbi +Signed-off-by: Michael Chan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c +index f9c94e5fe718..3221911e25fe 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c +@@ -76,14 +76,23 @@ static int bnxt_refclk_read(struct bnxt *bp, struct ptp_system_timestamp *sts, + u64 *ns) + { + struct bnxt_ptp_cfg *ptp = bp->ptp_cfg; ++ u32 high_before, high_now, low; + + if (test_bit(BNXT_STATE_IN_FW_RESET, &bp->state)) + return -EIO; + ++ high_before = readl(bp->bar0 + ptp->refclk_mapped_regs[1]); + ptp_read_system_prets(sts); +- *ns = readl(bp->bar0 + ptp->refclk_mapped_regs[0]); ++ low = readl(bp->bar0 + ptp->refclk_mapped_regs[0]); + ptp_read_system_postts(sts); +- *ns |= (u64)readl(bp->bar0 + ptp->refclk_mapped_regs[1]) << 32; ++ high_now = readl(bp->bar0 + ptp->refclk_mapped_regs[1]); ++ if (high_now != high_before) { ++ ptp_read_system_prets(sts); ++ low = readl(bp->bar0 + ptp->refclk_mapped_regs[0]); ++ ptp_read_system_postts(sts); ++ } ++ *ns = ((u64)high_now << 32) | low; ++ + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.18/bnxt_en-fix-bnxt_reinit_after_abort-code-path.patch b/queue-5.18/bnxt_en-fix-bnxt_reinit_after_abort-code-path.patch new file mode 100644 index 00000000000..0c40a768e2c --- /dev/null +++ b/queue-5.18/bnxt_en-fix-bnxt_reinit_after_abort-code-path.patch @@ -0,0 +1,52 @@ +From fbbd665644f5b3c77919ee1b714763df79b8a10d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 22:26:15 -0400 +Subject: bnxt_en: Fix bnxt_reinit_after_abort() code path + +From: Michael Chan + +[ Upstream commit 4279414bff8af9898e8c53ae6c5bc17f68ad67b7 ] + +bnxt_reinit_after_abort() is called during ifup when a previous +FW reset sequence has aborted or a previous ifup has failed after +detecting FW reset. In all cases, it is safe to assume that a +previous FW reset has completed and the driver may not have fully +reinitialized. + +Prior to this patch, it is assumed that the +FUNC_DRV_IF_CHANGE_RESP_FLAGS_HOT_FW_RESET_DONE flag will always be +set by the firmware in bnxt_hwrm_if_change(). This may not be true if +the driver has already attempted to register with the firmware. The +firmware may not set the RESET_DONE flag again after the driver has +registered, assuming that the driver has seen the flag already. + +Fix it to always go through the FW reset initialization path if +the BNXT_STATE_FW_RESET_DET flag is set. This flag is always set +by the driver after successfully going through bnxt_reinit_after_abort(). + +Fixes: 6882c36cf82e ("bnxt_en: attempt to reinitialize after aborted reset") +Reviewed-by: Pavan Chebbi +Signed-off-by: Michael Chan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index ee6686a111bd..1ceccaed2da0 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -9916,7 +9916,8 @@ static int bnxt_hwrm_if_change(struct bnxt *bp, bool up) + + if (flags & FUNC_DRV_IF_CHANGE_RESP_FLAGS_RESC_CHANGE) + resc_reinit = true; +- if (flags & FUNC_DRV_IF_CHANGE_RESP_FLAGS_HOT_FW_RESET_DONE) ++ if (flags & FUNC_DRV_IF_CHANGE_RESP_FLAGS_HOT_FW_RESET_DONE || ++ test_bit(BNXT_STATE_FW_RESET_DET, &bp->state)) + fw_reset = true; + else + bnxt_remap_fw_health_regs(bp); +-- +2.35.1 + diff --git a/queue-5.18/bnxt_en-fix-livepatch-query.patch b/queue-5.18/bnxt_en-fix-livepatch-query.patch new file mode 100644 index 00000000000..42749d5a72a --- /dev/null +++ b/queue-5.18/bnxt_en-fix-livepatch-query.patch @@ -0,0 +1,45 @@ +From f611beb2421c51433bca1b638dbf3939cc15d91e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 22:26:16 -0400 +Subject: bnxt_en: fix livepatch query + +From: Vikas Gupta + +[ Upstream commit 619b9b1622c283cc5ca86f4c487db266a8f55dab ] + +In the livepatch query fw_target BNXT_FW_SRT_PATCH is +applicable for P5 chips only. + +Fixes: 3c4153394e2c ("bnxt_en: implement firmware live patching") +Reviewed-by: Saravanan Vajravel +Reviewed-by: Somnath Kotur +Signed-off-by: Vikas Gupta +Signed-off-by: Michael Chan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c +index 0c17f90d44a2..3a9441fe4fd1 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c +@@ -979,9 +979,11 @@ static int bnxt_dl_info_get(struct devlink *dl, struct devlink_info_req *req, + if (rc) + return rc; + +- rc = bnxt_dl_livepatch_info_put(bp, req, BNXT_FW_SRT_PATCH); +- if (rc) +- return rc; ++ if (BNXT_CHIP_P5(bp)) { ++ rc = bnxt_dl_livepatch_info_put(bp, req, BNXT_FW_SRT_PATCH); ++ if (rc) ++ return rc; ++ } + return bnxt_dl_livepatch_info_put(bp, req, BNXT_FW_CRT_PATCH); + + } +-- +2.35.1 + diff --git a/queue-5.18/bnxt_en-reclaim-max-resources-if-sriov-enable-fails.patch b/queue-5.18/bnxt_en-reclaim-max-resources-if-sriov-enable-fails.patch new file mode 100644 index 00000000000..05a5de336b5 --- /dev/null +++ b/queue-5.18/bnxt_en-reclaim-max-resources-if-sriov-enable-fails.patch @@ -0,0 +1,83 @@ +From 8a05d2c6f3e24fe239d6a30f599f66cb2d2bd762 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 22:26:14 -0400 +Subject: bnxt_en: reclaim max resources if sriov enable fails + +From: Kashyap Desai + +[ Upstream commit c5b744d38c36a407a41e918602eec4d89730787b ] + +If bnxt_sriov_enable() fails after some resources have been reserved +for the VFs, the current code is not unwinding properly and the +reserved resources become unavailable afterwards. Fix it by +properly unwinding with a call to bnxt_hwrm_func_qcaps() to +reset all maximum resources. + +Also, add the missing bnxt_ulp_sriov_cfg() call to let the RDMA +driver know to abort. + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Signed-off-by: Kashyap Desai +Signed-off-by: Michael Chan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- + drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + + drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 7 ++++++- + 3 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index d5149478a351..ee6686a111bd 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -7641,7 +7641,7 @@ static void bnxt_hwrm_dbg_qcaps(struct bnxt *bp) + + static int bnxt_hwrm_queue_qportcfg(struct bnxt *bp); + +-static int bnxt_hwrm_func_qcaps(struct bnxt *bp) ++int bnxt_hwrm_func_qcaps(struct bnxt *bp) + { + int rc; + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index 98453a78cbd0..4c6ce2b2b3b7 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -2310,6 +2310,7 @@ int bnxt_cancel_reservations(struct bnxt *bp, bool fw_reset); + int bnxt_hwrm_alloc_wol_fltr(struct bnxt *bp); + int bnxt_hwrm_free_wol_fltr(struct bnxt *bp); + int bnxt_hwrm_func_resc_qcaps(struct bnxt *bp, bool all); ++int bnxt_hwrm_func_qcaps(struct bnxt *bp); + int bnxt_hwrm_fw_set_time(struct bnxt *); + int bnxt_open_nic(struct bnxt *, bool, bool); + int bnxt_half_open_nic(struct bnxt *bp); +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +index ddf2f3963abe..a1a2c7a64fd5 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +@@ -823,8 +823,10 @@ static int bnxt_sriov_enable(struct bnxt *bp, int *num_vfs) + goto err_out2; + + rc = pci_enable_sriov(bp->pdev, *num_vfs); +- if (rc) ++ if (rc) { ++ bnxt_ulp_sriov_cfg(bp, 0); + goto err_out2; ++ } + + return 0; + +@@ -832,6 +834,9 @@ static int bnxt_sriov_enable(struct bnxt *bp, int *num_vfs) + /* Free the resources reserved for various VF's */ + bnxt_hwrm_func_vf_resource_free(bp, *num_vfs); + ++ /* Restore the max resources */ ++ bnxt_hwrm_func_qcaps(bp); ++ + err_out1: + bnxt_free_vf_resources(bp); + +-- +2.35.1 + diff --git a/queue-5.18/cipso-fix-data-races-around-sysctl.patch b/queue-5.18/cipso-fix-data-races-around-sysctl.patch new file mode 100644 index 00000000000..58bf5f1a506 --- /dev/null +++ b/queue-5.18/cipso-fix-data-races-around-sysctl.patch @@ -0,0 +1,95 @@ +From caf831bfa3839e6622012f701a0ff253ec730904 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:40:01 -0700 +Subject: cipso: Fix data-races around sysctl. + +From: Kuniyuki Iwashima + +[ Upstream commit dd44f04b9214adb68ef5684ae87a81ba03632250 ] + +While reading cipso sysctl variables, they can be changed concurrently. +So, we need to add READ_ONCE() to avoid data-races. + +Fixes: 446fda4f2682 ("[NetLabel]: CIPSOv4 engine") +Signed-off-by: Kuniyuki Iwashima +Acked-by: Paul Moore +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + Documentation/networking/ip-sysctl.rst | 2 +- + net/ipv4/cipso_ipv4.c | 12 +++++++----- + 2 files changed, 8 insertions(+), 6 deletions(-) + +diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst +index 66828293d9cb..8ffed7135fc1 100644 +--- a/Documentation/networking/ip-sysctl.rst ++++ b/Documentation/networking/ip-sysctl.rst +@@ -1085,7 +1085,7 @@ cipso_cache_enable - BOOLEAN + cipso_cache_bucket_size - INTEGER + The CIPSO label cache consists of a fixed size hash table with each + hash bucket containing a number of cache entries. This variable limits +- the number of entries in each hash bucket; the larger the value the ++ the number of entries in each hash bucket; the larger the value is, the + more CIPSO label mappings that can be cached. When the number of + entries in a given hash bucket reaches this limit adding new entries + causes the oldest entry in the bucket to be removed to make room. +diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c +index 62d5f99760aa..6cd3b6c559f0 100644 +--- a/net/ipv4/cipso_ipv4.c ++++ b/net/ipv4/cipso_ipv4.c +@@ -239,7 +239,7 @@ static int cipso_v4_cache_check(const unsigned char *key, + struct cipso_v4_map_cache_entry *prev_entry = NULL; + u32 hash; + +- if (!cipso_v4_cache_enabled) ++ if (!READ_ONCE(cipso_v4_cache_enabled)) + return -ENOENT; + + hash = cipso_v4_map_cache_hash(key, key_len); +@@ -296,13 +296,14 @@ static int cipso_v4_cache_check(const unsigned char *key, + int cipso_v4_cache_add(const unsigned char *cipso_ptr, + const struct netlbl_lsm_secattr *secattr) + { ++ int bkt_size = READ_ONCE(cipso_v4_cache_bucketsize); + int ret_val = -EPERM; + u32 bkt; + struct cipso_v4_map_cache_entry *entry = NULL; + struct cipso_v4_map_cache_entry *old_entry = NULL; + u32 cipso_ptr_len; + +- if (!cipso_v4_cache_enabled || cipso_v4_cache_bucketsize <= 0) ++ if (!READ_ONCE(cipso_v4_cache_enabled) || bkt_size <= 0) + return 0; + + cipso_ptr_len = cipso_ptr[1]; +@@ -322,7 +323,7 @@ int cipso_v4_cache_add(const unsigned char *cipso_ptr, + + bkt = entry->hash & (CIPSO_V4_CACHE_BUCKETS - 1); + spin_lock_bh(&cipso_v4_cache[bkt].lock); +- if (cipso_v4_cache[bkt].size < cipso_v4_cache_bucketsize) { ++ if (cipso_v4_cache[bkt].size < bkt_size) { + list_add(&entry->list, &cipso_v4_cache[bkt].list); + cipso_v4_cache[bkt].size += 1; + } else { +@@ -1199,7 +1200,8 @@ static int cipso_v4_gentag_rbm(const struct cipso_v4_doi *doi_def, + /* This will send packets using the "optimized" format when + * possible as specified in section 3.4.2.6 of the + * CIPSO draft. */ +- if (cipso_v4_rbm_optfmt && ret_val > 0 && ret_val <= 10) ++ if (READ_ONCE(cipso_v4_rbm_optfmt) && ret_val > 0 && ++ ret_val <= 10) + tag_len = 14; + else + tag_len = 4 + ret_val; +@@ -1603,7 +1605,7 @@ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option) + * all the CIPSO validations here but it doesn't + * really specify _exactly_ what we need to validate + * ... so, just make it a sysctl tunable. */ +- if (cipso_v4_rbm_strictvalid) { ++ if (READ_ONCE(cipso_v4_rbm_strictvalid)) { + if (cipso_v4_map_lvl_valid(doi_def, + tag[3]) < 0) { + err_offset = opt_iter + 3; +-- +2.35.1 + diff --git a/queue-5.18/drm-amd-display-ensure-valid-event-timestamp-for-cur.patch b/queue-5.18/drm-amd-display-ensure-valid-event-timestamp-for-cur.patch new file mode 100644 index 00000000000..3c934a8bf6c --- /dev/null +++ b/queue-5.18/drm-amd-display-ensure-valid-event-timestamp-for-cur.patch @@ -0,0 +1,116 @@ +From 8b4c0a9c735c4f4364e2dfe8fbd33aede3c2fecc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 16:51:31 +0200 +Subject: drm/amd/display: Ensure valid event timestamp for cursor-only commits +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michel Dänzer + +[ Upstream commit 3283c83eb6fcfbda8ea03d7149d8e42e71c5d45e ] + +Requires enabling the vblank machinery for them. + +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2030 +Signed-off-by: Michel Dänzer +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 43 +++++++++++++++++-- + 1 file changed, 40 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index bfbd701a4c9a..810965bd0692 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -464,6 +464,26 @@ static void dm_pflip_high_irq(void *interrupt_params) + vrr_active, (int) !e); + } + ++static void dm_crtc_handle_vblank(struct amdgpu_crtc *acrtc) ++{ ++ struct drm_crtc *crtc = &acrtc->base; ++ struct drm_device *dev = crtc->dev; ++ unsigned long flags; ++ ++ drm_crtc_handle_vblank(crtc); ++ ++ spin_lock_irqsave(&dev->event_lock, flags); ++ ++ /* Send completion event for cursor-only commits */ ++ if (acrtc->event && acrtc->pflip_status != AMDGPU_FLIP_SUBMITTED) { ++ drm_crtc_send_vblank_event(crtc, acrtc->event); ++ drm_crtc_vblank_put(crtc); ++ acrtc->event = NULL; ++ } ++ ++ spin_unlock_irqrestore(&dev->event_lock, flags); ++} ++ + static void dm_vupdate_high_irq(void *interrupt_params) + { + struct common_irq_params *irq_params = interrupt_params; +@@ -502,7 +522,7 @@ static void dm_vupdate_high_irq(void *interrupt_params) + * if a pageflip happened inside front-porch. + */ + if (vrr_active) { +- drm_crtc_handle_vblank(&acrtc->base); ++ dm_crtc_handle_vblank(acrtc); + + /* BTR processing for pre-DCE12 ASICs */ + if (acrtc->dm_irq_params.stream && +@@ -554,7 +574,7 @@ static void dm_crtc_high_irq(void *interrupt_params) + * to dm_vupdate_high_irq after end of front-porch. + */ + if (!vrr_active) +- drm_crtc_handle_vblank(&acrtc->base); ++ dm_crtc_handle_vblank(acrtc); + + /** + * Following stuff must happen at start of vblank, for crc +@@ -9199,6 +9219,7 @@ static void amdgpu_dm_commit_planes(struct drm_atomic_state *state, + struct amdgpu_bo *abo; + uint32_t target_vblank, last_flip_vblank; + bool vrr_active = amdgpu_dm_vrr_active(acrtc_state); ++ bool cursor_update = false; + bool pflip_present = false; + struct { + struct dc_surface_update surface_updates[MAX_SURFACES]; +@@ -9234,8 +9255,13 @@ static void amdgpu_dm_commit_planes(struct drm_atomic_state *state, + struct dm_plane_state *dm_new_plane_state = to_dm_plane_state(new_plane_state); + + /* Cursor plane is handled after stream updates */ +- if (plane->type == DRM_PLANE_TYPE_CURSOR) ++ if (plane->type == DRM_PLANE_TYPE_CURSOR) { ++ if ((fb && crtc == pcrtc) || ++ (old_plane_state->fb && old_plane_state->crtc == pcrtc)) ++ cursor_update = true; ++ + continue; ++ } + + if (!fb || !crtc || pcrtc != crtc) + continue; +@@ -9397,6 +9423,17 @@ static void amdgpu_dm_commit_planes(struct drm_atomic_state *state, + bundle->stream_update.vrr_infopacket = + &acrtc_state->stream->vrr_infopacket; + } ++ } else if (cursor_update && acrtc_state->active_planes > 0 && ++ !acrtc_state->force_dpms_off && ++ acrtc_attach->base.state->event) { ++ drm_crtc_vblank_get(pcrtc); ++ ++ spin_lock_irqsave(&pcrtc->dev->event_lock, flags); ++ ++ acrtc_attach->event = acrtc_attach->base.state->event; ++ acrtc_attach->base.state->event = NULL; ++ ++ spin_unlock_irqrestore(&pcrtc->dev->event_lock, flags); + } + + /* Update the planes if changed or disable if we don't have any. */ +-- +2.35.1 + diff --git a/queue-5.18/drm-amd-display-ignore-first-mst-sideband-message-re.patch b/queue-5.18/drm-amd-display-ignore-first-mst-sideband-message-re.patch new file mode 100644 index 00000000000..ba9c01ce96b --- /dev/null +++ b/queue-5.18/drm-amd-display-ignore-first-mst-sideband-message-re.patch @@ -0,0 +1,155 @@ +From fbc814ab014f827e776915bb4fc58c66596c06ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 15:52:46 -0400 +Subject: drm/amd/display: Ignore First MST Sideband Message Return Error + +From: Fangzhi Zuo + +[ Upstream commit acea108fa067d140bd155161a79b1fcd967f4137 ] + +[why] +First MST sideband message returns AUX_RET_ERROR_HPD_DISCON +on certain intel platform. Aux transaction considered failure +if HPD unexpected pulled low. The actual aux transaction success +in such case, hence do not return error. + +[how] +Not returning error when AUX_RET_ERROR_HPD_DISCON detected +on the first sideband message. + +v2: squash in additional DMI entries +v3: squash in static fix + +Signed-off-by: Fangzhi Zuo +Acked-by: Solomon Chiu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 39 +++++++++++++++++++ + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 8 ++++ + .../display/amdgpu_dm/amdgpu_dm_mst_types.c | 17 ++++++++ + 3 files changed, 64 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index b55a433e829e..bfbd701a4c9a 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -72,6 +72,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -1391,6 +1392,41 @@ static bool dm_should_disable_stutter(struct pci_dev *pdev) + return false; + } + ++static const struct dmi_system_id hpd_disconnect_quirk_table[] = { ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Precision 3660"), ++ }, ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Precision 3260"), ++ }, ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Precision 3460"), ++ }, ++ }, ++ {} ++}; ++ ++static void retrieve_dmi_info(struct amdgpu_display_manager *dm) ++{ ++ const struct dmi_system_id *dmi_id; ++ ++ dm->aux_hpd_discon_quirk = false; ++ ++ dmi_id = dmi_first_match(hpd_disconnect_quirk_table); ++ if (dmi_id) { ++ dm->aux_hpd_discon_quirk = true; ++ DRM_INFO("aux_hpd_discon_quirk attached\n"); ++ } ++} ++ + static int amdgpu_dm_init(struct amdgpu_device *adev) + { + struct dc_init_data init_data; +@@ -1521,6 +1557,9 @@ static int amdgpu_dm_init(struct amdgpu_device *adev) + } + + INIT_LIST_HEAD(&adev->dm.da_list); ++ ++ retrieve_dmi_info(&adev->dm); ++ + /* Display Core create. */ + adev->dm.dc = dc_create(&init_data); + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +index 7e44b0429448..4844601a5f47 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +@@ -546,6 +546,14 @@ struct amdgpu_display_manager { + * last successfully applied backlight values. + */ + u32 actual_brightness[AMDGPU_DM_MAX_NUM_EDP]; ++ ++ /** ++ * @aux_hpd_discon_quirk: ++ * ++ * quirk for hpd discon while aux is on-going. ++ * occurred on certain intel platform ++ */ ++ bool aux_hpd_discon_quirk; + }; + + enum dsc_clock_force_state { +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +index 31ac1fce36f8..d864cae1af67 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +@@ -58,6 +58,8 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux, + ssize_t result = 0; + struct aux_payload payload; + enum aux_return_code_type operation_result; ++ struct amdgpu_device *adev; ++ struct ddc_service *ddc; + + if (WARN_ON(msg->size > 16)) + return -E2BIG; +@@ -76,6 +78,21 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux, + result = dc_link_aux_transfer_raw(TO_DM_AUX(aux)->ddc_service, &payload, + &operation_result); + ++ /* ++ * w/a on certain intel platform where hpd is unexpected to pull low during ++ * 1st sideband message transaction by return AUX_RET_ERROR_HPD_DISCON ++ * aux transaction is succuess in such case, therefore bypass the error ++ */ ++ ddc = TO_DM_AUX(aux)->ddc_service; ++ adev = ddc->ctx->driver_context; ++ if (adev->dm.aux_hpd_discon_quirk) { ++ if (msg->address == DP_SIDEBAND_MSG_DOWN_REQ_BASE && ++ operation_result == AUX_RET_ERROR_HPD_DISCON) { ++ result = 0; ++ operation_result = AUX_RET_SUCCESS; ++ } ++ } ++ + if (payload.write && result >= 0) + result = msg->size; + +-- +2.35.1 + diff --git a/queue-5.18/drm-amd-display-only-use-depth-36-bpp-linebuffers-on.patch b/queue-5.18/drm-amd-display-only-use-depth-36-bpp-linebuffers-on.patch new file mode 100644 index 00000000000..47d349bf3c2 --- /dev/null +++ b/queue-5.18/drm-amd-display-only-use-depth-36-bpp-linebuffers-on.patch @@ -0,0 +1,68 @@ +From 2bddd9ef74721a573b52c1b58237d933069017e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 19:39:28 +0200 +Subject: drm/amd/display: Only use depth 36 bpp linebuffers on DCN display + engines. + +From: Mario Kleiner + +[ Upstream commit add61d3c31de6a4b5e11a2ab96aaf4c873481568 ] + +Various DCE versions had trouble with 36 bpp lb depth, requiring fixes, +last time in commit 353ca0fa5630 ("drm/amd/display: Fix 10bit 4K display +on CIK GPUs") for DCE-8. So far >= DCE-11.2 was considered ok, but now I +found out that on DCE-11.2 it causes dithering when there shouldn't be +any, so identity pixel passthrough with identity gamma LUTs doesn't work +when it should. This breaks various important neuroscience applications, +as reported to me by scientific users of Polaris cards under Ubuntu 22.04 +with Linux 5.15, and confirmed by testing it myself on DCE-11.2. + +Lets only use depth 36 for DCN engines, where my testing showed that it +is both necessary for high color precision output, e.g., RGBA16 fb's, +and not harmful, as far as more than one year in real-world use showed. + +DCE engines seem to work fine for high precision output at 30 bpp, so +this ("famous last words") depth 30 should hopefully fix all known problems +without introducing new ones. + +Successfully retested on DCE-11.2 Polaris and DCN-1.0 Raven Ridge on +top of Linux 5.19.0-rc2 + drm-next. + +Fixes: 353ca0fa5630 ("drm/amd/display: Fix 10bit 4K display on CIK GPUs") +Signed-off-by: Mario Kleiner +Tested-by: Mario Kleiner +Cc: stable@vger.kernel.org # 5.14.0 +Cc: Alex Deucher +Cc: Harry Wentland +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +index d251c3f3a714..5cdbd2b8aa4d 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +@@ -1113,12 +1113,13 @@ bool resource_build_scaling_params(struct pipe_ctx *pipe_ctx) + * on certain displays, such as the Sharp 4k. 36bpp is needed + * to support SURFACE_PIXEL_FORMAT_GRPH_ARGB16161616 and + * SURFACE_PIXEL_FORMAT_GRPH_ABGR16161616 with actual > 10 bpc +- * precision on at least DCN display engines. However, at least +- * Carrizo with DCE_VERSION_11_0 does not like 36 bpp lb depth, +- * so use only 30 bpp on DCE_VERSION_11_0. Testing with DCE 11.2 and 8.3 +- * did not show such problems, so this seems to be the exception. ++ * precision on DCN display engines, but apparently not for DCE, as ++ * far as testing on DCE-11.2 and DCE-8 showed. Various DCE parts have ++ * problems: Carrizo with DCE_VERSION_11_0 does not like 36 bpp lb depth, ++ * neither do DCE-8 at 4k resolution, or DCE-11.2 (broken identify pixel ++ * passthrough). Therefore only use 36 bpp on DCN where it is actually needed. + */ +- if (plane_state->ctx->dce_version > DCE_VERSION_11_0) ++ if (plane_state->ctx->dce_version > DCE_VERSION_MAX) + pipe_ctx->plane_res.scl_data.lb_params.depth = LB_PIXEL_DEPTH_36BPP; + else + pipe_ctx->plane_res.scl_data.lb_params.depth = LB_PIXEL_DEPTH_30BPP; +-- +2.35.1 + diff --git a/queue-5.18/drm-amd-pm-prevent-divide-by-zero.patch b/queue-5.18/drm-amd-pm-prevent-divide-by-zero.patch new file mode 100644 index 00000000000..56717bb4b0e --- /dev/null +++ b/queue-5.18/drm-amd-pm-prevent-divide-by-zero.patch @@ -0,0 +1,46 @@ +From 399b94d540bb070813df006d1eed57c0567988de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 14:35:11 -0800 +Subject: drm/amd/pm: Prevent divide by zero +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yefim Barashkin + +[ Upstream commit 0638c98c17aa12fe914459c82cd178247e21fb2b ] + +divide error: 0000 [#1] SMP PTI +CPU: 3 PID: 78925 Comm: tee Not tainted 5.15.50-1-lts #1 +Hardware name: MSI MS-7A59/Z270 SLI PLUS (MS-7A59), BIOS 1.90 01/30/2018 +RIP: 0010:smu_v11_0_set_fan_speed_rpm+0x11/0x110 [amdgpu] + +Speed is user-configurable through a file. +I accidentally set it to zero, and the driver crashed. + +Reviewed-by: Evan Quan +Reviewed-by: André Almeida +Signed-off-by: Yefim Barashkin +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c +index 5f8809f6990d..2fbd2926a531 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c +@@ -1228,6 +1228,8 @@ int smu_v11_0_set_fan_speed_rpm(struct smu_context *smu, + uint32_t crystal_clock_freq = 2500; + uint32_t tach_period; + ++ if (speed == 0) ++ return -EINVAL; + /* + * To prevent from possible overheat, some ASICs may have requirement + * for minimum fan speed: +-- +2.35.1 + diff --git a/queue-5.18/drm-amdgpu-display-disable-prefer_shadow-for-generic.patch b/queue-5.18/drm-amdgpu-display-disable-prefer_shadow-for-generic.patch new file mode 100644 index 00000000000..f72c5215ac4 --- /dev/null +++ b/queue-5.18/drm-amdgpu-display-disable-prefer_shadow-for-generic.patch @@ -0,0 +1,113 @@ +From f0b2c203027d4f304b1acff981fc341b0ad9d404 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jun 2022 10:10:37 -0400 +Subject: drm/amdgpu/display: disable prefer_shadow for generic fb helpers + +From: Alex Deucher + +[ Upstream commit 3a4b1cc28fbdc2325b3e3ed7d8024995a75f9216 ] + +Seems to break hibernation. Disable for now until we can root +cause it. + +Fixes: 087451f372bf ("drm/amdgpu: use generic fb helpers instead of setting up AMD own's.") +Bug: https://bugzilla.kernel.org/show_bug.cgi?id=216119 +Acked-by: Evan Quan +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c | 3 ++- + drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 3 ++- + drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 3 ++- + drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 3 ++- + drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 3 ++- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++- + 6 files changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c +index 5224d9a39737..842670d4a12e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c +@@ -494,7 +494,8 @@ static int amdgpu_vkms_sw_init(void *handle) + adev_to_drm(adev)->mode_config.max_height = YRES_MAX; + + adev_to_drm(adev)->mode_config.preferred_depth = 24; +- adev_to_drm(adev)->mode_config.prefer_shadow = 1; ++ /* disable prefer shadow for now due to hibernation issues */ ++ adev_to_drm(adev)->mode_config.prefer_shadow = 0; + + adev_to_drm(adev)->mode_config.fb_base = adev->gmc.aper_base; + +diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c +index 288fce7dc0ed..9c964cd3b5d4 100644 +--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c +@@ -2796,7 +2796,8 @@ static int dce_v10_0_sw_init(void *handle) + adev_to_drm(adev)->mode_config.max_height = 16384; + + adev_to_drm(adev)->mode_config.preferred_depth = 24; +- adev_to_drm(adev)->mode_config.prefer_shadow = 1; ++ /* disable prefer shadow for now due to hibernation issues */ ++ adev_to_drm(adev)->mode_config.prefer_shadow = 0; + + adev_to_drm(adev)->mode_config.fb_modifiers_not_supported = true; + +diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c +index cbe5250b31cb..e0ad9f27dc3f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c +@@ -2914,7 +2914,8 @@ static int dce_v11_0_sw_init(void *handle) + adev_to_drm(adev)->mode_config.max_height = 16384; + + adev_to_drm(adev)->mode_config.preferred_depth = 24; +- adev_to_drm(adev)->mode_config.prefer_shadow = 1; ++ /* disable prefer shadow for now due to hibernation issues */ ++ adev_to_drm(adev)->mode_config.prefer_shadow = 0; + + adev_to_drm(adev)->mode_config.fb_modifiers_not_supported = true; + +diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c +index 982855e6cf52..3caf6f386042 100644 +--- a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c +@@ -2673,7 +2673,8 @@ static int dce_v6_0_sw_init(void *handle) + adev_to_drm(adev)->mode_config.max_width = 16384; + adev_to_drm(adev)->mode_config.max_height = 16384; + adev_to_drm(adev)->mode_config.preferred_depth = 24; +- adev_to_drm(adev)->mode_config.prefer_shadow = 1; ++ /* disable prefer shadow for now due to hibernation issues */ ++ adev_to_drm(adev)->mode_config.prefer_shadow = 0; + adev_to_drm(adev)->mode_config.fb_modifiers_not_supported = true; + adev_to_drm(adev)->mode_config.fb_base = adev->gmc.aper_base; + +diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c +index 84440741c60b..7c75df5bffed 100644 +--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c +@@ -2693,7 +2693,8 @@ static int dce_v8_0_sw_init(void *handle) + adev_to_drm(adev)->mode_config.max_height = 16384; + + adev_to_drm(adev)->mode_config.preferred_depth = 24; +- adev_to_drm(adev)->mode_config.prefer_shadow = 1; ++ /* disable prefer shadow for now due to hibernation issues */ ++ adev_to_drm(adev)->mode_config.prefer_shadow = 0; + + adev_to_drm(adev)->mode_config.fb_modifiers_not_supported = true; + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 6dc9808760fc..b55a433e829e 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -3847,7 +3847,8 @@ static int amdgpu_dm_mode_config_init(struct amdgpu_device *adev) + adev_to_drm(adev)->mode_config.max_height = 16384; + + adev_to_drm(adev)->mode_config.preferred_depth = 24; +- adev_to_drm(adev)->mode_config.prefer_shadow = 1; ++ /* disable prefer shadow for now due to hibernation issues */ ++ adev_to_drm(adev)->mode_config.prefer_shadow = 0; + /* indicates support for immediate flip */ + adev_to_drm(adev)->mode_config.async_page_flip = true; + +-- +2.35.1 + diff --git a/queue-5.18/drm-amdgpu-keep-fbdev-buffers-pinned-during-suspend.patch b/queue-5.18/drm-amdgpu-keep-fbdev-buffers-pinned-during-suspend.patch new file mode 100644 index 00000000000..80291e9d165 --- /dev/null +++ b/queue-5.18/drm-amdgpu-keep-fbdev-buffers-pinned-during-suspend.patch @@ -0,0 +1,65 @@ +From 256a93ae755f16a9c537b7606e6fd8b57cb3653a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jun 2022 10:04:55 -0400 +Subject: drm/amdgpu: keep fbdev buffers pinned during suspend + +From: Alex Deucher + +[ Upstream commit f9a89117fbdc63c0d4ab63a8f3596a72c245bcfe ] + +Was dropped when we converted to the generic helpers. + +Fixes: 087451f372bf ("drm/amdgpu: use generic fb helpers instead of setting up AMD own's.") +Acked-by: Evan Quan +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 25 +++++++++++++++++---- + 1 file changed, 21 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +index fae5c1debfad..ffb3702745a5 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +@@ -1547,6 +1547,21 @@ bool amdgpu_crtc_get_scanout_position(struct drm_crtc *crtc, + stime, etime, mode); + } + ++static bool ++amdgpu_display_robj_is_fb(struct amdgpu_device *adev, struct amdgpu_bo *robj) ++{ ++ struct drm_device *dev = adev_to_drm(adev); ++ struct drm_fb_helper *fb_helper = dev->fb_helper; ++ ++ if (!fb_helper || !fb_helper->buffer) ++ return false; ++ ++ if (gem_to_amdgpu_bo(fb_helper->buffer->gem) != robj) ++ return false; ++ ++ return true; ++} ++ + int amdgpu_display_suspend_helper(struct amdgpu_device *adev) + { + struct drm_device *dev = adev_to_drm(adev); +@@ -1582,10 +1597,12 @@ int amdgpu_display_suspend_helper(struct amdgpu_device *adev) + continue; + } + robj = gem_to_amdgpu_bo(fb->obj[0]); +- r = amdgpu_bo_reserve(robj, true); +- if (r == 0) { +- amdgpu_bo_unpin(robj); +- amdgpu_bo_unreserve(robj); ++ if (!amdgpu_display_robj_is_fb(adev, robj)) { ++ r = amdgpu_bo_reserve(robj, true); ++ if (r == 0) { ++ amdgpu_bo_unpin(robj); ++ amdgpu_bo_unreserve(robj); ++ } + } + } + return 0; +-- +2.35.1 + diff --git a/queue-5.18/drm-amdkfd-correct-the-mec-atomic-support-firmware-c.patch b/queue-5.18/drm-amdkfd-correct-the-mec-atomic-support-firmware-c.patch new file mode 100644 index 00000000000..fc604fad18d --- /dev/null +++ b/queue-5.18/drm-amdkfd-correct-the-mec-atomic-support-firmware-c.patch @@ -0,0 +1,38 @@ +From 9492718ad7af3dce35a3df30ad7370b81cbec3f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 16:03:08 +0800 +Subject: drm/amdkfd: correct the MEC atomic support firmware checking for GC + 10.3.7 + +From: Prike Liang + +[ Upstream commit c0044865480a162146b9dfe7783e73a08e97b2b9 ] + +On the GC 10.3.7 platform the initial MEC release version #3 can support +atomic operation,so need correct and set its MEC atomic support version to #3. + +Signed-off-by: Prike Liang +Reviewed-by: Aaron Liu +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 5.18.x +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_device.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c +index 651498bfecc8..2059c3138410 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c +@@ -158,6 +158,8 @@ static void kfd_device_info_init(struct kfd_dev *kfd, + /* Navi2x+, Navi1x+ */ + if (gc_version == IP_VERSION(10, 3, 6)) + kfd->device_info.no_atomic_fw_version = 14; ++ else if (gc_version == IP_VERSION(10, 3, 7)) ++ kfd->device_info.no_atomic_fw_version = 3; + else if (gc_version >= IP_VERSION(10, 3, 0)) + kfd->device_info.no_atomic_fw_version = 92; + else if (gc_version >= IP_VERSION(10, 1, 1)) +-- +2.35.1 + diff --git a/queue-5.18/drm-i915-fix-a-possible-refcount-leak-in-intel_dp_ad.patch b/queue-5.18/drm-i915-fix-a-possible-refcount-leak-in-intel_dp_ad.patch new file mode 100644 index 00000000000..56dd601c46f --- /dev/null +++ b/queue-5.18/drm-i915-fix-a-possible-refcount-leak-in-intel_dp_ad.patch @@ -0,0 +1,44 @@ +From 8ed52dc7f7a264ab4960e2d173a5b4fee8d896fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jun 2022 06:04:06 -0700 +Subject: drm/i915: fix a possible refcount leak in + intel_dp_add_mst_connector() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hangyu Hua + +[ Upstream commit 85144df9ff4652816448369de76897c57cbb1b93 ] + +If drm_connector_init fails, intel_connector_free will be called to take +care of proper free. So it is necessary to drop the refcount of port +before intel_connector_free. + +Fixes: 091a4f91942a ("drm/i915: Handle drm-layer errors in intel_dp_add_mst_connector") +Signed-off-by: Hangyu Hua +Reviewed-by: José Roberto de Souza +Link: https://patchwork.freedesktop.org/patch/msgid/20220624130406.17996-1-jose.souza@intel.com +Signed-off-by: José Roberto de Souza +(cherry picked from commit cea9ed611e85d36a05db52b6457bf584b7d969e2) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_dp_mst.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/i915/display/intel_dp_mst.c b/drivers/gpu/drm/i915/display/intel_dp_mst.c +index e30e698aa684..f7d46ea3afb9 100644 +--- a/drivers/gpu/drm/i915/display/intel_dp_mst.c ++++ b/drivers/gpu/drm/i915/display/intel_dp_mst.c +@@ -841,6 +841,7 @@ static struct drm_connector *intel_dp_add_mst_connector(struct drm_dp_mst_topolo + ret = drm_connector_init(dev, connector, &intel_dp_mst_connector_funcs, + DRM_MODE_CONNECTOR_DisplayPort); + if (ret) { ++ drm_dp_mst_put_port_malloc(port); + intel_connector_free(intel_connector); + return NULL; + } +-- +2.35.1 + diff --git a/queue-5.18/drm-i915-gt-serialize-grdom-access-between-multiple-.patch b/queue-5.18/drm-i915-gt-serialize-grdom-access-between-multiple-.patch new file mode 100644 index 00000000000..8e0b89f9727 --- /dev/null +++ b/queue-5.18/drm-i915-gt-serialize-grdom-access-between-multiple-.patch @@ -0,0 +1,124 @@ +From b55ce6436524f1413f1f3268b9f947b0012fc86e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 16:21:32 +0100 +Subject: drm/i915/gt: Serialize GRDOM access between multiple engine resets +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chris Wilson + +[ Upstream commit b24dcf1dc507f69ed3b5c66c2b6a0209ae80d4d4 ] + +Don't allow two engines to be reset in parallel, as they would both +try to select a reset bit (and send requests to common registers) +and wait on that register, at the same time. Serialize control of +the reset requests/acks using the uncore->lock, which will also ensure +that no other GT state changes at the same time as the actual reset. + +Cc: stable@vger.kernel.org # v4.4 and upper +Reported-by: Mika Kuoppala +Signed-off-by: Chris Wilson +Acked-by: Mika Kuoppala +Reviewed-by: Andi Shyti +Reviewed-by: Andrzej Hajda +Acked-by: Thomas Hellström +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Rodrigo Vivi +Link: https://patchwork.freedesktop.org/patch/msgid/e0a2d894e77aed7c2e36b0d1abdc7dbac3011729.1657639152.git.mchehab@kernel.org +(cherry picked from commit 336561a914fc0c6f1218228718f633b31b7af1c3) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_reset.c | 37 ++++++++++++++++++++------- + 1 file changed, 28 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_reset.c b/drivers/gpu/drm/i915/gt/intel_reset.c +index b7c6d4462ec5..d57db66ac7ea 100644 +--- a/drivers/gpu/drm/i915/gt/intel_reset.c ++++ b/drivers/gpu/drm/i915/gt/intel_reset.c +@@ -299,9 +299,9 @@ static int gen6_hw_domain_reset(struct intel_gt *gt, u32 hw_domain_mask) + return err; + } + +-static int gen6_reset_engines(struct intel_gt *gt, +- intel_engine_mask_t engine_mask, +- unsigned int retry) ++static int __gen6_reset_engines(struct intel_gt *gt, ++ intel_engine_mask_t engine_mask, ++ unsigned int retry) + { + struct intel_engine_cs *engine; + u32 hw_mask; +@@ -320,6 +320,20 @@ static int gen6_reset_engines(struct intel_gt *gt, + return gen6_hw_domain_reset(gt, hw_mask); + } + ++static int gen6_reset_engines(struct intel_gt *gt, ++ intel_engine_mask_t engine_mask, ++ unsigned int retry) ++{ ++ unsigned long flags; ++ int ret; ++ ++ spin_lock_irqsave(>->uncore->lock, flags); ++ ret = __gen6_reset_engines(gt, engine_mask, retry); ++ spin_unlock_irqrestore(>->uncore->lock, flags); ++ ++ return ret; ++} ++ + static struct intel_engine_cs *find_sfc_paired_vecs_engine(struct intel_engine_cs *engine) + { + int vecs_id; +@@ -486,9 +500,9 @@ static void gen11_unlock_sfc(struct intel_engine_cs *engine) + rmw_clear_fw(uncore, sfc_lock.lock_reg, sfc_lock.lock_bit); + } + +-static int gen11_reset_engines(struct intel_gt *gt, +- intel_engine_mask_t engine_mask, +- unsigned int retry) ++static int __gen11_reset_engines(struct intel_gt *gt, ++ intel_engine_mask_t engine_mask, ++ unsigned int retry) + { + struct intel_engine_cs *engine; + intel_engine_mask_t tmp; +@@ -582,8 +596,11 @@ static int gen8_reset_engines(struct intel_gt *gt, + struct intel_engine_cs *engine; + const bool reset_non_ready = retry >= 1; + intel_engine_mask_t tmp; ++ unsigned long flags; + int ret; + ++ spin_lock_irqsave(>->uncore->lock, flags); ++ + for_each_engine_masked(engine, gt, engine_mask, tmp) { + ret = gen8_engine_reset_prepare(engine); + if (ret && !reset_non_ready) +@@ -611,17 +628,19 @@ static int gen8_reset_engines(struct intel_gt *gt, + * This is best effort, so ignore any error from the initial reset. + */ + if (IS_DG2(gt->i915) && engine_mask == ALL_ENGINES) +- gen11_reset_engines(gt, gt->info.engine_mask, 0); ++ __gen11_reset_engines(gt, gt->info.engine_mask, 0); + + if (GRAPHICS_VER(gt->i915) >= 11) +- ret = gen11_reset_engines(gt, engine_mask, retry); ++ ret = __gen11_reset_engines(gt, engine_mask, retry); + else +- ret = gen6_reset_engines(gt, engine_mask, retry); ++ ret = __gen6_reset_engines(gt, engine_mask, retry); + + skip_reset: + for_each_engine_masked(engine, gt, engine_mask, tmp) + gen8_engine_reset_cancel(engine); + ++ spin_unlock_irqrestore(>->uncore->lock, flags); ++ + return ret; + } + +-- +2.35.1 + diff --git a/queue-5.18/drm-i915-gt-serialize-tlb-invalidates-with-gt-resets.patch b/queue-5.18/drm-i915-gt-serialize-tlb-invalidates-with-gt-resets.patch new file mode 100644 index 00000000000..3908c6f62a4 --- /dev/null +++ b/queue-5.18/drm-i915-gt-serialize-tlb-invalidates-with-gt-resets.patch @@ -0,0 +1,76 @@ +From cd3fd76729a8c7c7c8c75d0b6e877775a129fdf5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 16:21:33 +0100 +Subject: drm/i915/gt: Serialize TLB invalidates with GT resets +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chris Wilson + +[ Upstream commit a1c5a7bf79c1faa5633b918b5c0666545e84c4d1 ] + +Avoid trying to invalidate the TLB in the middle of performing an +engine reset, as this may result in the reset timing out. Currently, +the TLB invalidate is only serialised by its own mutex, forgoing the +uncore lock, but we can take the uncore->lock as well to serialise +the mmio access, thereby serialising with the GDRST. + +Tested on a NUC5i7RYB, BIOS RYBDWi35.86A.0380.2019.0517.1530 with +i915 selftest/hangcheck. + +Cc: stable@vger.kernel.org # v4.4 and upper +Fixes: 7938d61591d3 ("drm/i915: Flush TLBs before releasing backing store") +Reported-by: Mauro Carvalho Chehab +Tested-by: Mauro Carvalho Chehab +Reviewed-by: Mauro Carvalho Chehab +Signed-off-by: Chris Wilson +Cc: Tvrtko Ursulin +Reviewed-by: Andi Shyti +Acked-by: Thomas Hellström +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Rodrigo Vivi +Link: https://patchwork.freedesktop.org/patch/msgid/1e59a7c45dd919a530256b9ac721ac6ea86c0677.1657639152.git.mchehab@kernel.org +(cherry picked from commit 33da97894758737895e90c909f16786052680ef4) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_gt.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_gt.c b/drivers/gpu/drm/i915/gt/intel_gt.c +index 8a2483ccbfb9..f4375479e6f0 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gt.c ++++ b/drivers/gpu/drm/i915/gt/intel_gt.c +@@ -1012,6 +1012,20 @@ void intel_gt_invalidate_tlbs(struct intel_gt *gt) + mutex_lock(>->tlb_invalidate_lock); + intel_uncore_forcewake_get(uncore, FORCEWAKE_ALL); + ++ spin_lock_irq(&uncore->lock); /* serialise invalidate with GT reset */ ++ ++ for_each_engine(engine, gt, id) { ++ struct reg_and_bit rb; ++ ++ rb = get_reg_and_bit(engine, regs == gen8_regs, regs, num); ++ if (!i915_mmio_reg_offset(rb.reg)) ++ continue; ++ ++ intel_uncore_write_fw(uncore, rb.reg, rb.bit); ++ } ++ ++ spin_unlock_irq(&uncore->lock); ++ + for_each_engine(engine, gt, id) { + /* + * HW architecture suggest typical invalidation time at 40us, +@@ -1026,7 +1040,6 @@ void intel_gt_invalidate_tlbs(struct intel_gt *gt) + if (!i915_mmio_reg_offset(rb.reg)) + continue; + +- intel_uncore_write_fw(uncore, rb.reg, rb.bit); + if (__intel_wait_for_register_fw(uncore, + rb.reg, rb.bit, 0, + timeout_us, timeout_ms, +-- +2.35.1 + diff --git a/queue-5.18/drm-i915-guc-adl-n-should-use-the-same-guc-fw-as-adl.patch b/queue-5.18/drm-i915-guc-adl-n-should-use-the-same-guc-fw-as-adl.patch new file mode 100644 index 00000000000..fdc6e9bfdce --- /dev/null +++ b/queue-5.18/drm-i915-guc-adl-n-should-use-the-same-guc-fw-as-adl.patch @@ -0,0 +1,53 @@ +From aa72f1c2fc8cd6f2671dcb4dd7e9f0be1a92dae2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jun 2022 16:30:05 -0700 +Subject: drm/i915/guc: ADL-N should use the same GuC FW as ADL-S + +From: Daniele Ceraolo Spurio + +[ Upstream commit 25c95bf494067f7bd1dfa8064ef964abe88cafc2 ] + +The only difference between the ADL S and P GuC FWs is the HWConfig +support. ADL-N does not support HWConfig, so we should use the same +binary as ADL-S, otherwise the GuC might attempt to fetch a config +table that does not exist. ADL-N is internally identified as an ADL-P, +so we need to special-case it in the FW selection code. + +Fixes: 7e28d0b26759 ("drm/i915/adl-n: Enable ADL-N platform") +Cc: John Harrison +Cc: Tejas Upadhyay +Cc: Anusha Srivatsa +Cc: Jani Nikula +Signed-off-by: Daniele Ceraolo Spurio +Reviewed-by: Matt Roper +Link: https://patchwork.freedesktop.org/patch/msgid/20220621233005.3952293-1-daniele.ceraolospurio@intel.com +(cherry picked from commit 971e4a9781742aaad1587e25fd5582b2dd595ef8) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c b/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c +index 9b6fbad47646..097b0c8b8531 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c +@@ -160,6 +160,15 @@ __uc_fw_auto_select(struct drm_i915_private *i915, struct intel_uc_fw *uc_fw) + u8 rev = INTEL_REVID(i915); + int i; + ++ /* ++ * The only difference between the ADL GuC FWs is the HWConfig support. ++ * ADL-N does not support HWConfig, so we should use the same binary as ++ * ADL-S, otherwise the GuC might attempt to fetch a config table that ++ * does not exist. ++ */ ++ if (IS_ADLP_N(i915)) ++ p = INTEL_ALDERLAKE_S; ++ + GEM_BUG_ON(uc_fw->type >= ARRAY_SIZE(blobs_all)); + fw_blobs = blobs_all[uc_fw->type].blobs; + fw_count = blobs_all[uc_fw->type].count; +-- +2.35.1 + diff --git a/queue-5.18/drm-i915-gvt-is_err-vs-null-bug-in-intel_gvt_update_.patch b/queue-5.18/drm-i915-gvt-is_err-vs-null-bug-in-intel_gvt_update_.patch new file mode 100644 index 00000000000..e8f7b91bd56 --- /dev/null +++ b/queue-5.18/drm-i915-gvt-is_err-vs-null-bug-in-intel_gvt_update_.patch @@ -0,0 +1,44 @@ +From 2dff322e11a20947cddb1222a5b410fc63335e90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 11:41:06 +0300 +Subject: drm/i915/gvt: IS_ERR() vs NULL bug in + intel_gvt_update_reg_whitelist() + +From: Dan Carpenter + +[ Upstream commit e87197fbd137c888fd6c871c72fe7e89445dd015 ] + +The shmem_pin_map() function returns NULL, it doesn't return error +pointers. + +Fixes: 97ea656521c8 ("drm/i915/gvt: Parse default state to update reg whitelist") +Reviewed-by: Andrzej Hajda +Signed-off-by: Dan Carpenter +Signed-off-by: Zhenyu Wang +Link: http://patchwork.freedesktop.org/patch/msgid/Ysftoia2BPUyqVcD@kili +Acked-by: Zhenyu Wang +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gvt/cmd_parser.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c +index 2459213b6c87..f49c1e8b8df7 100644 +--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c ++++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c +@@ -3117,9 +3117,9 @@ void intel_gvt_update_reg_whitelist(struct intel_vgpu *vgpu) + continue; + + vaddr = shmem_pin_map(engine->default_state); +- if (IS_ERR(vaddr)) { +- gvt_err("failed to map %s->default state, err:%zd\n", +- engine->name, PTR_ERR(vaddr)); ++ if (!vaddr) { ++ gvt_err("failed to map %s->default state\n", ++ engine->name); + return; + } + +-- +2.35.1 + diff --git a/queue-5.18/drm-i915-selftests-fix-a-couple-is_err-vs-null-tests.patch b/queue-5.18/drm-i915-selftests-fix-a-couple-is_err-vs-null-tests.patch new file mode 100644 index 00000000000..ac2ea6e7b26 --- /dev/null +++ b/queue-5.18/drm-i915-selftests-fix-a-couple-is_err-vs-null-tests.patch @@ -0,0 +1,53 @@ +From 9fd04955b70bd03490a897241003e966e9d1bb96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 12:41:04 +0300 +Subject: drm/i915/selftests: fix a couple IS_ERR() vs NULL tests + +From: Dan Carpenter + +[ Upstream commit 896dcabd1f8f613c533d948df17408c41f8929f5 ] + +The shmem_pin_map() function doesn't return error pointers, it returns +NULL. + +Fixes: be1cb55a07bf ("drm/i915/gt: Keep a no-frills swappable copy of the default context state") +Signed-off-by: Dan Carpenter +Reviewed-by: Matthew Auld +Signed-off-by: Matthew Auld +Link: https://patchwork.freedesktop.org/patch/msgid/20220708094104.GL2316@kadam +(cherry picked from commit d50f5a109cf4ed50c5b575c1bb5fc3bd17b23308) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/selftest_lrc.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/selftest_lrc.c b/drivers/gpu/drm/i915/gt/selftest_lrc.c +index 21c29d315cc0..9d42a7c67a8c 100644 +--- a/drivers/gpu/drm/i915/gt/selftest_lrc.c ++++ b/drivers/gpu/drm/i915/gt/selftest_lrc.c +@@ -155,8 +155,8 @@ static int live_lrc_layout(void *arg) + continue; + + hw = shmem_pin_map(engine->default_state); +- if (IS_ERR(hw)) { +- err = PTR_ERR(hw); ++ if (!hw) { ++ err = -ENOMEM; + break; + } + hw += LRC_STATE_OFFSET / sizeof(*hw); +@@ -331,8 +331,8 @@ static int live_lrc_fixed(void *arg) + continue; + + hw = shmem_pin_map(engine->default_state); +- if (IS_ERR(hw)) { +- err = PTR_ERR(hw); ++ if (!hw) { ++ err = -ENOMEM; + break; + } + hw += LRC_STATE_OFFSET / sizeof(*hw); +-- +2.35.1 + diff --git a/queue-5.18/drm-i915-selftests-fix-subtraction-overflow-bug.patch b/queue-5.18/drm-i915-selftests-fix-subtraction-overflow-bug.patch new file mode 100644 index 00000000000..7f727f45275 --- /dev/null +++ b/queue-5.18/drm-i915-selftests-fix-subtraction-overflow-bug.patch @@ -0,0 +1,43 @@ +From 879831dc95c2fc056a1a27a29150d30fa4f343c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jun 2022 13:35:28 +0200 +Subject: drm/i915/selftests: fix subtraction overflow bug + +From: Andrzej Hajda + +[ Upstream commit 333991c4e66b3d4b5613315f18016da80344f659 ] + +On some machines hole_end can be small enough to cause subtraction +overflow. On the other side (addr + 2 * min_alignment) can overflow +in case of mock tests. This patch should handle both cases. + +Fixes: e1c5f754067b59 ("drm/i915: Avoid overflow in computing pot_hole loop termination") +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/3674 +Signed-off-by: Andrzej Hajda +Reviewed-by: Andi Shyti +Signed-off-by: Andi Shyti +Link: https://patchwork.freedesktop.org/patch/msgid/20220624113528.2159210-1-andrzej.hajda@intel.com +Signed-off-by: Rodrigo Vivi +(cherry picked from commit ab3edc679c552a466e4bf0b11af3666008bd65a2) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/selftests/i915_gem_gtt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c +index ab751192eb3b..34d1ef015233 100644 +--- a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c ++++ b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c +@@ -742,7 +742,7 @@ static int pot_hole(struct i915_address_space *vm, + u64 addr; + + for (addr = round_up(hole_start + min_alignment, step) - min_alignment; +- addr <= round_down(hole_end - (2 * min_alignment), step) - min_alignment; ++ hole_end > addr && hole_end - addr >= 2 * min_alignment; + addr += step) { + err = i915_vma_pin(vma, 0, 0, addr | flags); + if (err) { +-- +2.35.1 + diff --git a/queue-5.18/drm-i915-ttm-fix-sg_table-construction.patch b/queue-5.18/drm-i915-ttm-fix-sg_table-construction.patch new file mode 100644 index 00000000000..fc1a2197860 --- /dev/null +++ b/queue-5.18/drm-i915-ttm-fix-sg_table-construction.patch @@ -0,0 +1,308 @@ +From 7fe195536c27e17b32543a0dc8a4887747510135 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 09:58:59 +0100 +Subject: drm/i915/ttm: fix sg_table construction +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matthew Auld + +[ Upstream commit aff1e0b09b54b64944b7fe32997229552737b9e9 ] + +If we encounter some monster sized local-memory page that exceeds the +maximum sg length (UINT32_MAX), ensure that don't end up with some +misaligned address in the entry that follows, leading to fireworks +later. Also ensure we have some coverage of this in the selftests. + +v2(Chris): + - Use round_down consistently to avoid udiv errors +v3(Nirmoy): + - Also update the max_segment in the selftest + +Fixes: f701b16d4cc5 ("drm/i915/ttm: add i915_sg_from_buddy_resource") +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6379 +Signed-off-by: Matthew Auld +Cc: Thomas Hellström +Cc: Nirmoy Das +Reviewed-by: Nirmoy Das +Link: https://patchwork.freedesktop.org/patch/msgid/20220711085859.24198-1-matthew.auld@intel.com +(cherry picked from commit bc99f1209f19fefa3ee11e77464ccfae541f4291) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 11 ++++++++-- + drivers/gpu/drm/i915/i915_scatterlist.c | 19 +++++++++++++---- + drivers/gpu/drm/i915/i915_scatterlist.h | 6 ++++-- + drivers/gpu/drm/i915/intel_region_ttm.c | 10 ++++++--- + drivers/gpu/drm/i915/intel_region_ttm.h | 3 ++- + .../drm/i915/selftests/intel_memory_region.c | 21 +++++++++++++++++-- + drivers/gpu/drm/i915/selftests/mock_region.c | 3 ++- + 7 files changed, 58 insertions(+), 15 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c +index 45cc5837ce00..342ca303eae4 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c +@@ -583,10 +583,15 @@ i915_ttm_resource_get_st(struct drm_i915_gem_object *obj, + struct ttm_resource *res) + { + struct ttm_buffer_object *bo = i915_gem_to_ttm(obj); ++ u64 page_alignment; + + if (!i915_ttm_gtt_binds_lmem(res)) + return i915_ttm_tt_get_st(bo->ttm); + ++ page_alignment = bo->page_alignment << PAGE_SHIFT; ++ if (!page_alignment) ++ page_alignment = obj->mm.region->min_page_size; ++ + /* + * If CPU mapping differs, we need to add the ttm_tt pages to + * the resulting st. Might make sense for GGTT. +@@ -597,7 +602,8 @@ i915_ttm_resource_get_st(struct drm_i915_gem_object *obj, + struct i915_refct_sgt *rsgt; + + rsgt = intel_region_ttm_resource_to_rsgt(obj->mm.region, +- res); ++ res, ++ page_alignment); + if (IS_ERR(rsgt)) + return rsgt; + +@@ -606,7 +612,8 @@ i915_ttm_resource_get_st(struct drm_i915_gem_object *obj, + return i915_refct_sgt_get(obj->ttm.cached_io_rsgt); + } + +- return intel_region_ttm_resource_to_rsgt(obj->mm.region, res); ++ return intel_region_ttm_resource_to_rsgt(obj->mm.region, res, ++ page_alignment); + } + + static int i915_ttm_truncate(struct drm_i915_gem_object *obj) +diff --git a/drivers/gpu/drm/i915/i915_scatterlist.c b/drivers/gpu/drm/i915/i915_scatterlist.c +index 159571b9bd24..f63b50b71e10 100644 +--- a/drivers/gpu/drm/i915/i915_scatterlist.c ++++ b/drivers/gpu/drm/i915/i915_scatterlist.c +@@ -68,6 +68,7 @@ void i915_refct_sgt_init(struct i915_refct_sgt *rsgt, size_t size) + * drm_mm_node + * @node: The drm_mm_node. + * @region_start: An offset to add to the dma addresses of the sg list. ++ * @page_alignment: Required page alignment for each sg entry. Power of two. + * + * Create a struct sg_table, initializing it from a struct drm_mm_node, + * taking a maximum segment length into account, splitting into segments +@@ -77,15 +78,18 @@ void i915_refct_sgt_init(struct i915_refct_sgt *rsgt, size_t size) + * error code cast to an error pointer on failure. + */ + struct i915_refct_sgt *i915_rsgt_from_mm_node(const struct drm_mm_node *node, +- u64 region_start) ++ u64 region_start, ++ u64 page_alignment) + { +- const u64 max_segment = SZ_1G; /* Do we have a limit on this? */ ++ const u64 max_segment = round_down(UINT_MAX, page_alignment); + u64 segment_pages = max_segment >> PAGE_SHIFT; + u64 block_size, offset, prev_end; + struct i915_refct_sgt *rsgt; + struct sg_table *st; + struct scatterlist *sg; + ++ GEM_BUG_ON(!max_segment); ++ + rsgt = kmalloc(sizeof(*rsgt), GFP_KERNEL); + if (!rsgt) + return ERR_PTR(-ENOMEM); +@@ -112,6 +116,8 @@ struct i915_refct_sgt *i915_rsgt_from_mm_node(const struct drm_mm_node *node, + sg = __sg_next(sg); + + sg_dma_address(sg) = region_start + offset; ++ GEM_BUG_ON(!IS_ALIGNED(sg_dma_address(sg), ++ page_alignment)); + sg_dma_len(sg) = 0; + sg->length = 0; + st->nents++; +@@ -138,6 +144,7 @@ struct i915_refct_sgt *i915_rsgt_from_mm_node(const struct drm_mm_node *node, + * i915_buddy_block list + * @res: The struct i915_ttm_buddy_resource. + * @region_start: An offset to add to the dma addresses of the sg list. ++ * @page_alignment: Required page alignment for each sg entry. Power of two. + * + * Create a struct sg_table, initializing it from struct i915_buddy_block list, + * taking a maximum segment length into account, splitting into segments +@@ -147,11 +154,12 @@ struct i915_refct_sgt *i915_rsgt_from_mm_node(const struct drm_mm_node *node, + * error code cast to an error pointer on failure. + */ + struct i915_refct_sgt *i915_rsgt_from_buddy_resource(struct ttm_resource *res, +- u64 region_start) ++ u64 region_start, ++ u64 page_alignment) + { + struct i915_ttm_buddy_resource *bman_res = to_ttm_buddy_resource(res); + const u64 size = res->num_pages << PAGE_SHIFT; +- const u64 max_segment = rounddown(UINT_MAX, PAGE_SIZE); ++ const u64 max_segment = round_down(UINT_MAX, page_alignment); + struct drm_buddy *mm = bman_res->mm; + struct list_head *blocks = &bman_res->blocks; + struct drm_buddy_block *block; +@@ -161,6 +169,7 @@ struct i915_refct_sgt *i915_rsgt_from_buddy_resource(struct ttm_resource *res, + resource_size_t prev_end; + + GEM_BUG_ON(list_empty(blocks)); ++ GEM_BUG_ON(!max_segment); + + rsgt = kmalloc(sizeof(*rsgt), GFP_KERNEL); + if (!rsgt) +@@ -191,6 +200,8 @@ struct i915_refct_sgt *i915_rsgt_from_buddy_resource(struct ttm_resource *res, + sg = __sg_next(sg); + + sg_dma_address(sg) = region_start + offset; ++ GEM_BUG_ON(!IS_ALIGNED(sg_dma_address(sg), ++ page_alignment)); + sg_dma_len(sg) = 0; + sg->length = 0; + st->nents++; +diff --git a/drivers/gpu/drm/i915/i915_scatterlist.h b/drivers/gpu/drm/i915/i915_scatterlist.h +index 12c6a1684081..b13e4cdea923 100644 +--- a/drivers/gpu/drm/i915/i915_scatterlist.h ++++ b/drivers/gpu/drm/i915/i915_scatterlist.h +@@ -213,9 +213,11 @@ static inline void __i915_refct_sgt_init(struct i915_refct_sgt *rsgt, + void i915_refct_sgt_init(struct i915_refct_sgt *rsgt, size_t size); + + struct i915_refct_sgt *i915_rsgt_from_mm_node(const struct drm_mm_node *node, +- u64 region_start); ++ u64 region_start, ++ u64 page_alignment); + + struct i915_refct_sgt *i915_rsgt_from_buddy_resource(struct ttm_resource *res, +- u64 region_start); ++ u64 region_start, ++ u64 page_alignment); + + #endif +diff --git a/drivers/gpu/drm/i915/intel_region_ttm.c b/drivers/gpu/drm/i915/intel_region_ttm.c +index 737ef3f4ab54..d896558cf458 100644 +--- a/drivers/gpu/drm/i915/intel_region_ttm.c ++++ b/drivers/gpu/drm/i915/intel_region_ttm.c +@@ -151,6 +151,7 @@ int intel_region_ttm_fini(struct intel_memory_region *mem) + * Convert an opaque TTM resource manager resource to a refcounted sg_table. + * @mem: The memory region. + * @res: The resource manager resource obtained from the TTM resource manager. ++ * @page_alignment: Required page alignment for each sg entry. Power of two. + * + * The gem backends typically use sg-tables for operations on the underlying + * io_memory. So provide a way for the backends to translate the +@@ -160,16 +161,19 @@ int intel_region_ttm_fini(struct intel_memory_region *mem) + */ + struct i915_refct_sgt * + intel_region_ttm_resource_to_rsgt(struct intel_memory_region *mem, +- struct ttm_resource *res) ++ struct ttm_resource *res, ++ u64 page_alignment) + { + if (mem->is_range_manager) { + struct ttm_range_mgr_node *range_node = + to_ttm_range_mgr_node(res); + + return i915_rsgt_from_mm_node(&range_node->mm_nodes[0], +- mem->region.start); ++ mem->region.start, ++ page_alignment); + } else { +- return i915_rsgt_from_buddy_resource(res, mem->region.start); ++ return i915_rsgt_from_buddy_resource(res, mem->region.start, ++ page_alignment); + } + } + +diff --git a/drivers/gpu/drm/i915/intel_region_ttm.h b/drivers/gpu/drm/i915/intel_region_ttm.h +index fdee5e7bd46c..b17e494ef79c 100644 +--- a/drivers/gpu/drm/i915/intel_region_ttm.h ++++ b/drivers/gpu/drm/i915/intel_region_ttm.h +@@ -24,7 +24,8 @@ int intel_region_ttm_fini(struct intel_memory_region *mem); + + struct i915_refct_sgt * + intel_region_ttm_resource_to_rsgt(struct intel_memory_region *mem, +- struct ttm_resource *res); ++ struct ttm_resource *res, ++ u64 page_alignment); + + void intel_region_ttm_resource_free(struct intel_memory_region *mem, + struct ttm_resource *res); +diff --git a/drivers/gpu/drm/i915/selftests/intel_memory_region.c b/drivers/gpu/drm/i915/selftests/intel_memory_region.c +index ba32893e0873..0250a114fe0a 100644 +--- a/drivers/gpu/drm/i915/selftests/intel_memory_region.c ++++ b/drivers/gpu/drm/i915/selftests/intel_memory_region.c +@@ -451,7 +451,6 @@ static int igt_mock_splintered_region(void *arg) + + static int igt_mock_max_segment(void *arg) + { +- const unsigned int max_segment = rounddown(UINT_MAX, PAGE_SIZE); + struct intel_memory_region *mem = arg; + struct drm_i915_private *i915 = mem->i915; + struct i915_ttm_buddy_resource *res; +@@ -460,7 +459,10 @@ static int igt_mock_max_segment(void *arg) + struct drm_buddy *mm; + struct list_head *blocks; + struct scatterlist *sg; ++ I915_RND_STATE(prng); + LIST_HEAD(objects); ++ unsigned int max_segment; ++ unsigned int ps; + u64 size; + int err = 0; + +@@ -472,7 +474,13 @@ static int igt_mock_max_segment(void *arg) + */ + + size = SZ_8G; +- mem = mock_region_create(i915, 0, size, PAGE_SIZE, 0, 0); ++ ps = PAGE_SIZE; ++ if (i915_prandom_u64_state(&prng) & 1) ++ ps = SZ_64K; /* For something like DG2 */ ++ ++ max_segment = round_down(UINT_MAX, ps); ++ ++ mem = mock_region_create(i915, 0, size, ps, 0, 0); + if (IS_ERR(mem)) + return PTR_ERR(mem); + +@@ -498,12 +506,21 @@ static int igt_mock_max_segment(void *arg) + } + + for (sg = obj->mm.pages->sgl; sg; sg = sg_next(sg)) { ++ dma_addr_t daddr = sg_dma_address(sg); ++ + if (sg->length > max_segment) { + pr_err("%s: Created an oversized scatterlist entry, %u > %u\n", + __func__, sg->length, max_segment); + err = -EINVAL; + goto out_close; + } ++ ++ if (!IS_ALIGNED(daddr, ps)) { ++ pr_err("%s: Created an unaligned scatterlist entry, addr=%pa, ps=%u\n", ++ __func__, &daddr, ps); ++ err = -EINVAL; ++ goto out_close; ++ } + } + + out_close: +diff --git a/drivers/gpu/drm/i915/selftests/mock_region.c b/drivers/gpu/drm/i915/selftests/mock_region.c +index f64325491f35..6f7c9820d3e9 100644 +--- a/drivers/gpu/drm/i915/selftests/mock_region.c ++++ b/drivers/gpu/drm/i915/selftests/mock_region.c +@@ -32,7 +32,8 @@ static int mock_region_get_pages(struct drm_i915_gem_object *obj) + return PTR_ERR(obj->mm.res); + + obj->mm.rsgt = intel_region_ttm_resource_to_rsgt(obj->mm.region, +- obj->mm.res); ++ obj->mm.res, ++ obj->mm.region->min_page_size); + if (IS_ERR(obj->mm.rsgt)) { + err = PTR_ERR(obj->mm.rsgt); + goto err_free_resource; +-- +2.35.1 + diff --git a/queue-5.18/ice-change-devlink-code-to-read-nvm-in-blocks.patch b/queue-5.18/ice-change-devlink-code-to-read-nvm-in-blocks.patch new file mode 100644 index 00000000000..2db4f911bf4 --- /dev/null +++ b/queue-5.18/ice-change-devlink-code-to-read-nvm-in-blocks.patch @@ -0,0 +1,122 @@ +From aec5e92dbb1738fea189d59c79c1a62b2db0f9c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 14:48:32 -0700 +Subject: ice: change devlink code to read NVM in blocks + +From: Paul M Stillwell Jr + +[ Upstream commit 7b6f9462a3234c35cf808453d39a074a04e71de1 ] + +When creating a snapshot of the NVM the driver needs to read the entire +contents from the NVM and store it. The NVM reads are protected by a lock +that is shared between the driver and the firmware. + +If the driver takes too long to read the entire NVM (which can happen on +some systems) then the firmware could reclaim the lock and cause subsequent +reads from the driver to fail. + +We could fix this by increasing the timeout that we pass to the firmware, +but we could end up in the same situation again if the system is slow. +Instead have the driver break the reading of the NVM into blocks that are +small enough that we have confidence that the read will complete within the +timeout time, but large enough not to cause significant AQ overhead. + +Fixes: dce730f17825 ("ice: add a devlink region for dumping NVM contents") +Signed-off-by: Paul M Stillwell Jr +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_devlink.c | 59 +++++++++++++------- + 1 file changed, 40 insertions(+), 19 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_devlink.c b/drivers/net/ethernet/intel/ice/ice_devlink.c +index 4a9de59121d8..31836bbdf813 100644 +--- a/drivers/net/ethernet/intel/ice/ice_devlink.c ++++ b/drivers/net/ethernet/intel/ice/ice_devlink.c +@@ -792,6 +792,8 @@ void ice_devlink_destroy_vf_port(struct ice_vf *vf) + devlink_port_unregister(devlink_port); + } + ++#define ICE_DEVLINK_READ_BLK_SIZE (1024 * 1024) ++ + /** + * ice_devlink_nvm_snapshot - Capture a snapshot of the NVM flash contents + * @devlink: the devlink instance +@@ -818,8 +820,9 @@ static int ice_devlink_nvm_snapshot(struct devlink *devlink, + struct ice_pf *pf = devlink_priv(devlink); + struct device *dev = ice_pf_to_dev(pf); + struct ice_hw *hw = &pf->hw; +- void *nvm_data; +- u32 nvm_size; ++ u8 *nvm_data, *tmp, i; ++ u32 nvm_size, left; ++ s8 num_blks; + int status; + + nvm_size = hw->flash.flash_size; +@@ -827,26 +830,44 @@ static int ice_devlink_nvm_snapshot(struct devlink *devlink, + if (!nvm_data) + return -ENOMEM; + +- status = ice_acquire_nvm(hw, ICE_RES_READ); +- if (status) { +- dev_dbg(dev, "ice_acquire_nvm failed, err %d aq_err %d\n", +- status, hw->adminq.sq_last_status); +- NL_SET_ERR_MSG_MOD(extack, "Failed to acquire NVM semaphore"); +- vfree(nvm_data); +- return status; +- } + +- status = ice_read_flat_nvm(hw, 0, &nvm_size, nvm_data, false); +- if (status) { +- dev_dbg(dev, "ice_read_flat_nvm failed after reading %u bytes, err %d aq_err %d\n", +- nvm_size, status, hw->adminq.sq_last_status); +- NL_SET_ERR_MSG_MOD(extack, "Failed to read NVM contents"); ++ num_blks = DIV_ROUND_UP(nvm_size, ICE_DEVLINK_READ_BLK_SIZE); ++ tmp = nvm_data; ++ left = nvm_size; ++ ++ /* Some systems take longer to read the NVM than others which causes the ++ * FW to reclaim the NVM lock before the entire NVM has been read. Fix ++ * this by breaking the reads of the NVM into smaller chunks that will ++ * probably not take as long. This has some overhead since we are ++ * increasing the number of AQ commands, but it should always work ++ */ ++ for (i = 0; i < num_blks; i++) { ++ u32 read_sz = min_t(u32, ICE_DEVLINK_READ_BLK_SIZE, left); ++ ++ status = ice_acquire_nvm(hw, ICE_RES_READ); ++ if (status) { ++ dev_dbg(dev, "ice_acquire_nvm failed, err %d aq_err %d\n", ++ status, hw->adminq.sq_last_status); ++ NL_SET_ERR_MSG_MOD(extack, "Failed to acquire NVM semaphore"); ++ vfree(nvm_data); ++ return -EIO; ++ } ++ ++ status = ice_read_flat_nvm(hw, i * ICE_DEVLINK_READ_BLK_SIZE, ++ &read_sz, tmp, false); ++ if (status) { ++ dev_dbg(dev, "ice_read_flat_nvm failed after reading %u bytes, err %d aq_err %d\n", ++ read_sz, status, hw->adminq.sq_last_status); ++ NL_SET_ERR_MSG_MOD(extack, "Failed to read NVM contents"); ++ ice_release_nvm(hw); ++ vfree(nvm_data); ++ return -EIO; ++ } + ice_release_nvm(hw); +- vfree(nvm_data); +- return status; +- } + +- ice_release_nvm(hw); ++ tmp += read_sz; ++ left -= read_sz; ++ } + + *data = nvm_data; + +-- +2.35.1 + diff --git a/queue-5.18/ice-handle-e822-generic-device-id-in-pldm-header.patch b/queue-5.18/ice-handle-e822-generic-device-id-in-pldm-header.patch new file mode 100644 index 00000000000..d5ee27bba34 --- /dev/null +++ b/queue-5.18/ice-handle-e822-generic-device-id-in-pldm-header.patch @@ -0,0 +1,175 @@ +From bcd44c0d0a562d18c80194ad04bb439ba00950c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 14:09:52 -0700 +Subject: ice: handle E822 generic device ID in PLDM header + +From: Paul M Stillwell Jr + +[ Upstream commit f52d166819a4d8e0d5cca07d8a8dd6397c96dcf1 ] + +The driver currently presumes that the record data in the PLDM header +of the firmware image will match the device ID of the running device. +This is true for E810 devices. It appears that for E822 devices that +this is not guaranteed to be true. + +Fix this by adding a check for the generic E822 device. + +Fixes: d69ea414c9b4 ("ice: implement device flash update via devlink") +Signed-off-by: Paul M Stillwell Jr +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_devids.h | 1 + + .../net/ethernet/intel/ice/ice_fw_update.c | 96 ++++++++++++++++++- + drivers/net/ethernet/intel/ice/ice_main.c | 1 + + 3 files changed, 96 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_devids.h b/drivers/net/ethernet/intel/ice/ice_devids.h +index 61dd2f18dee8..b41bc3dc1745 100644 +--- a/drivers/net/ethernet/intel/ice/ice_devids.h ++++ b/drivers/net/ethernet/intel/ice/ice_devids.h +@@ -5,6 +5,7 @@ + #define _ICE_DEVIDS_H_ + + /* Device IDs */ ++#define ICE_DEV_ID_E822_SI_DFLT 0x1888 + /* Intel(R) Ethernet Connection E823-L for backplane */ + #define ICE_DEV_ID_E823L_BACKPLANE 0x124C + /* Intel(R) Ethernet Connection E823-L for SFP */ +diff --git a/drivers/net/ethernet/intel/ice/ice_fw_update.c b/drivers/net/ethernet/intel/ice/ice_fw_update.c +index 665a344fb9c0..3dc5662d62a6 100644 +--- a/drivers/net/ethernet/intel/ice/ice_fw_update.c ++++ b/drivers/net/ethernet/intel/ice/ice_fw_update.c +@@ -736,7 +736,87 @@ static int ice_finalize_update(struct pldmfw *context) + return 0; + } + +-static const struct pldmfw_ops ice_fwu_ops = { ++struct ice_pldm_pci_record_id { ++ u32 vendor; ++ u32 device; ++ u32 subsystem_vendor; ++ u32 subsystem_device; ++}; ++ ++/** ++ * ice_op_pci_match_record - Check if a PCI device matches the record ++ * @context: PLDM fw update structure ++ * @record: list of records extracted from the PLDM image ++ * ++ * Determine if the PCI device associated with this device matches the record ++ * data provided. ++ * ++ * Searches the descriptor TLVs and extracts the relevant descriptor data into ++ * a pldm_pci_record_id. This is then compared against the PCI device ID ++ * information. ++ * ++ * Returns: true if the device matches the record, false otherwise. ++ */ ++static bool ++ice_op_pci_match_record(struct pldmfw *context, struct pldmfw_record *record) ++{ ++ struct pci_dev *pdev = to_pci_dev(context->dev); ++ struct ice_pldm_pci_record_id id = { ++ .vendor = PCI_ANY_ID, ++ .device = PCI_ANY_ID, ++ .subsystem_vendor = PCI_ANY_ID, ++ .subsystem_device = PCI_ANY_ID, ++ }; ++ struct pldmfw_desc_tlv *desc; ++ ++ list_for_each_entry(desc, &record->descs, entry) { ++ u16 value; ++ int *ptr; ++ ++ switch (desc->type) { ++ case PLDM_DESC_ID_PCI_VENDOR_ID: ++ ptr = &id.vendor; ++ break; ++ case PLDM_DESC_ID_PCI_DEVICE_ID: ++ ptr = &id.device; ++ break; ++ case PLDM_DESC_ID_PCI_SUBVENDOR_ID: ++ ptr = &id.subsystem_vendor; ++ break; ++ case PLDM_DESC_ID_PCI_SUBDEV_ID: ++ ptr = &id.subsystem_device; ++ break; ++ default: ++ /* Skip unrelated TLVs */ ++ continue; ++ } ++ ++ value = get_unaligned_le16(desc->data); ++ /* A value of zero for one of the descriptors is sometimes ++ * used when the record should ignore this field when matching ++ * device. For example if the record applies to any subsystem ++ * device or vendor. ++ */ ++ if (value) ++ *ptr = value; ++ else ++ *ptr = PCI_ANY_ID; ++ } ++ ++ /* the E822 device can have a generic device ID so check for that */ ++ if ((id.vendor == PCI_ANY_ID || id.vendor == pdev->vendor) && ++ (id.device == PCI_ANY_ID || id.device == pdev->device || ++ id.device == ICE_DEV_ID_E822_SI_DFLT) && ++ (id.subsystem_vendor == PCI_ANY_ID || ++ id.subsystem_vendor == pdev->subsystem_vendor) && ++ (id.subsystem_device == PCI_ANY_ID || ++ id.subsystem_device == pdev->subsystem_device)) ++ return true; ++ ++ return false; ++} ++ ++static const struct pldmfw_ops ice_fwu_ops_e810 = { + .match_record = &pldmfw_op_pci_match_record, + .send_package_data = &ice_send_package_data, + .send_component_table = &ice_send_component_table, +@@ -744,6 +824,14 @@ static const struct pldmfw_ops ice_fwu_ops = { + .finalize_update = &ice_finalize_update, + }; + ++static const struct pldmfw_ops ice_fwu_ops_e822 = { ++ .match_record = &ice_op_pci_match_record, ++ .send_package_data = &ice_send_package_data, ++ .send_component_table = &ice_send_component_table, ++ .flash_component = &ice_flash_component, ++ .finalize_update = &ice_finalize_update, ++}; ++ + /** + * ice_get_pending_updates - Check if the component has a pending update + * @pf: the PF driver structure +@@ -921,7 +1009,11 @@ int ice_devlink_flash_update(struct devlink *devlink, + + memset(&priv, 0, sizeof(priv)); + +- priv.context.ops = &ice_fwu_ops; ++ /* the E822 device needs a slightly different ops */ ++ if (hw->mac_type == ICE_MAC_GENERIC) ++ priv.context.ops = &ice_fwu_ops_e822; ++ else ++ priv.context.ops = &ice_fwu_ops_e810; + priv.context.dev = dev; + priv.extack = extack; + priv.pf = pf; +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index d069b19f9bf7..efb076f71e38 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -5397,6 +5397,7 @@ static const struct pci_device_id ice_pci_tbl[] = { + { PCI_VDEVICE(INTEL, ICE_DEV_ID_E823L_10G_BASE_T), 0 }, + { PCI_VDEVICE(INTEL, ICE_DEV_ID_E823L_1GBE), 0 }, + { PCI_VDEVICE(INTEL, ICE_DEV_ID_E823L_QSFP), 0 }, ++ { PCI_VDEVICE(INTEL, ICE_DEV_ID_E822_SI_DFLT), 0 }, + /* required last entry */ + { 0, } + }; +-- +2.35.1 + diff --git a/queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_echo_ignore_.patch b/queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_echo_ignore_.patch new file mode 100644 index 00000000000..9ae3a3f63d2 --- /dev/null +++ b/queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_echo_ignore_.patch @@ -0,0 +1,50 @@ +From 8a1c23709734bb1f7b40704a799b474159556809 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:22 -0700 +Subject: icmp: Fix a data-race around sysctl_icmp_echo_ignore_all. + +From: Kuniyuki Iwashima + +[ Upstream commit bb7bb35a63b4812da8e3aff587773678e31d23e3 ] + +While reading sysctl_icmp_echo_ignore_all, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/icmp.c | 2 +- + net/ipv4/sysctl_net_ipv4.c | 2 ++ + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index 97350a38a75d..92eaa96a9ff1 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -990,7 +990,7 @@ static bool icmp_echo(struct sk_buff *skb) + + net = dev_net(skb_dst(skb)->dev); + /* should there be an ICMP stat for ignored echos? */ +- if (net->ipv4.sysctl_icmp_echo_ignore_all) ++ if (READ_ONCE(net->ipv4.sysctl_icmp_echo_ignore_all)) + return true; + + icmp_param.data.icmph = *icmp_hdr(skb); +diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c +index ad80d180b60b..8987864c4479 100644 +--- a/net/ipv4/sysctl_net_ipv4.c ++++ b/net/ipv4/sysctl_net_ipv4.c +@@ -603,6 +603,8 @@ static struct ctl_table ipv4_net_table[] = { + .maxlen = sizeof(u8), + .mode = 0644, + .proc_handler = proc_dou8vec_minmax, ++ .extra1 = SYSCTL_ZERO, ++ .extra2 = SYSCTL_ONE + }, + { + .procname = "icmp_echo_enable_probe", +-- +2.35.1 + diff --git a/queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_echo_ignore_.patch-4417 b/queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_echo_ignore_.patch-4417 new file mode 100644 index 00000000000..f5d8f04eaee --- /dev/null +++ b/queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_echo_ignore_.patch-4417 @@ -0,0 +1,50 @@ +From 35c5e9e17652e4d1bbc4b9d0a3ae8a02b1614717 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:24 -0700 +Subject: icmp: Fix a data-race around sysctl_icmp_echo_ignore_broadcasts. + +From: Kuniyuki Iwashima + +[ Upstream commit 66484bb98ed2dfa1dda37a32411483d8311ac269 ] + +While reading sysctl_icmp_echo_ignore_broadcasts, it can be changed +concurrently. Thus, we need to add READ_ONCE() to its reader. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/icmp.c | 2 +- + net/ipv4/sysctl_net_ipv4.c | 2 ++ + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index 7edc8a3b1646..2c402b4671a1 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -1239,7 +1239,7 @@ int icmp_rcv(struct sk_buff *skb) + */ + if ((icmph->type == ICMP_ECHO || + icmph->type == ICMP_TIMESTAMP) && +- net->ipv4.sysctl_icmp_echo_ignore_broadcasts) { ++ READ_ONCE(net->ipv4.sysctl_icmp_echo_ignore_broadcasts)) { + goto error; + } + if (icmph->type != ICMP_ECHO && +diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c +index 8987864c4479..6613351094ce 100644 +--- a/net/ipv4/sysctl_net_ipv4.c ++++ b/net/ipv4/sysctl_net_ipv4.c +@@ -621,6 +621,8 @@ static struct ctl_table ipv4_net_table[] = { + .maxlen = sizeof(u8), + .mode = 0644, + .proc_handler = proc_dou8vec_minmax, ++ .extra1 = SYSCTL_ZERO, ++ .extra2 = SYSCTL_ONE + }, + { + .procname = "icmp_ignore_bogus_error_responses", +-- +2.35.1 + diff --git a/queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_errors_use_i.patch b/queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_errors_use_i.patch new file mode 100644 index 00000000000..503c486b746 --- /dev/null +++ b/queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_errors_use_i.patch @@ -0,0 +1,50 @@ +From 110949f8e518eb3f08167dbf345a6bfbd79514d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:26 -0700 +Subject: icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr. + +From: Kuniyuki Iwashima + +[ Upstream commit d2efabce81db7eed1c98fa1a3f203f0edd738ac3 ] + +While reading sysctl_icmp_errors_use_inbound_ifaddr, it can be changed +concurrently. Thus, we need to add READ_ONCE() to its reader. + +Fixes: 1c2fb7f93cb2 ("[IPV4]: Sysctl configurable icmp error source address.") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/icmp.c | 2 +- + net/ipv4/sysctl_net_ipv4.c | 2 ++ + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index 1a061d10949f..37ba5f042908 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -693,7 +693,7 @@ void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info, + + rcu_read_lock(); + if (rt_is_input_route(rt) && +- net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr) ++ READ_ONCE(net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr)) + dev = dev_get_by_index_rcu(net, inet_iif(skb_in)); + + if (dev) +diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c +index 4cf2a6f560d4..33e65e79e46e 100644 +--- a/net/ipv4/sysctl_net_ipv4.c ++++ b/net/ipv4/sysctl_net_ipv4.c +@@ -639,6 +639,8 @@ static struct ctl_table ipv4_net_table[] = { + .maxlen = sizeof(u8), + .mode = 0644, + .proc_handler = proc_dou8vec_minmax, ++ .extra1 = SYSCTL_ZERO, ++ .extra2 = SYSCTL_ONE + }, + { + .procname = "icmp_ratelimit", +-- +2.35.1 + diff --git a/queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_ignore_bogus.patch b/queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_ignore_bogus.patch new file mode 100644 index 00000000000..44c4706c469 --- /dev/null +++ b/queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_ignore_bogus.patch @@ -0,0 +1,51 @@ +From 66187f9864d2b129eed8c687815c2945abb285e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:25 -0700 +Subject: icmp: Fix a data-race around + sysctl_icmp_ignore_bogus_error_responses. + +From: Kuniyuki Iwashima + +[ Upstream commit b04f9b7e85c7d7aecbada620e8759a662af068d3 ] + +While reading sysctl_icmp_ignore_bogus_error_responses, it can be changed +concurrently. Thus, we need to add READ_ONCE() to its reader. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/icmp.c | 2 +- + net/ipv4/sysctl_net_ipv4.c | 2 ++ + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index 2c402b4671a1..1a061d10949f 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -930,7 +930,7 @@ static bool icmp_unreach(struct sk_buff *skb) + * get the other vendor to fix their kit. + */ + +- if (!net->ipv4.sysctl_icmp_ignore_bogus_error_responses && ++ if (!READ_ONCE(net->ipv4.sysctl_icmp_ignore_bogus_error_responses) && + inet_addr_type_dev_table(net, skb->dev, iph->daddr) == RTN_BROADCAST) { + net_warn_ratelimited("%pI4 sent an invalid ICMP type %u, code %u error to a broadcast: %pI4 on %s\n", + &ip_hdr(skb)->saddr, +diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c +index 6613351094ce..4cf2a6f560d4 100644 +--- a/net/ipv4/sysctl_net_ipv4.c ++++ b/net/ipv4/sysctl_net_ipv4.c +@@ -630,6 +630,8 @@ static struct ctl_table ipv4_net_table[] = { + .maxlen = sizeof(u8), + .mode = 0644, + .proc_handler = proc_dou8vec_minmax, ++ .extra1 = SYSCTL_ZERO, ++ .extra2 = SYSCTL_ONE + }, + { + .procname = "icmp_errors_use_inbound_ifaddr", +-- +2.35.1 + diff --git a/queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_ratelimit.patch b/queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_ratelimit.patch new file mode 100644 index 00000000000..7ef44f3a727 --- /dev/null +++ b/queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_ratelimit.patch @@ -0,0 +1,37 @@ +From c05c6be5745391e32a8da9939d1739c3818b14bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:27 -0700 +Subject: icmp: Fix a data-race around sysctl_icmp_ratelimit. + +From: Kuniyuki Iwashima + +[ Upstream commit 2a4eb714841f288cf51c7d942d98af6a8c6e4b01 ] + +While reading sysctl_icmp_ratelimit, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/icmp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index 37ba5f042908..41efb7381859 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -320,7 +320,8 @@ static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt, + + vif = l3mdev_master_ifindex(dst->dev); + peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, vif, 1); +- rc = inet_peer_xrlim_allow(peer, net->ipv4.sysctl_icmp_ratelimit); ++ rc = inet_peer_xrlim_allow(peer, ++ READ_ONCE(net->ipv4.sysctl_icmp_ratelimit)); + if (peer) + inet_putpeer(peer); + out: +-- +2.35.1 + diff --git a/queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_ratemask.patch b/queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_ratemask.patch new file mode 100644 index 00000000000..611ed30e4ef --- /dev/null +++ b/queue-5.18/icmp-fix-a-data-race-around-sysctl_icmp_ratemask.patch @@ -0,0 +1,36 @@ +From df23022e288306e3aa1786b3f159c9842c604170 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:28 -0700 +Subject: icmp: Fix a data-race around sysctl_icmp_ratemask. + +From: Kuniyuki Iwashima + +[ Upstream commit 1ebcb25ad6fc3d50fca87350acf451b9a66dd31e ] + +While reading sysctl_icmp_ratemask, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/icmp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index 41efb7381859..c13ceda9ce5d 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -282,7 +282,7 @@ static bool icmpv4_mask_allow(struct net *net, int type, int code) + return true; + + /* Limit if icmp type is enabled in ratemask. */ +- if (!((1 << type) & net->ipv4.sysctl_icmp_ratemask)) ++ if (!((1 << type) & READ_ONCE(net->ipv4.sysctl_icmp_ratemask))) + return true; + + return false; +-- +2.35.1 + diff --git a/queue-5.18/icmp-fix-data-races-around-sysctl.patch b/queue-5.18/icmp-fix-data-races-around-sysctl.patch new file mode 100644 index 00000000000..96f8e6efa1f --- /dev/null +++ b/queue-5.18/icmp-fix-data-races-around-sysctl.patch @@ -0,0 +1,42 @@ +From feb9fa400d52c9649704e6721c20e1b5797720d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:40:02 -0700 +Subject: icmp: Fix data-races around sysctl. + +From: Kuniyuki Iwashima + +[ Upstream commit 48d7ee321ea5182c6a70782aa186422a70e67e22 ] + +While reading icmp sysctl variables, they can be changed concurrently. +So, we need to add READ_ONCE() to avoid data-races. + +Fixes: 4cdf507d5452 ("icmp: add a global rate limitation") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/icmp.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index 72a375c7f417..97350a38a75d 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -253,11 +253,12 @@ bool icmp_global_allow(void) + spin_lock(&icmp_global.lock); + delta = min_t(u32, now - icmp_global.stamp, HZ); + if (delta >= HZ / 50) { +- incr = sysctl_icmp_msgs_per_sec * delta / HZ ; ++ incr = READ_ONCE(sysctl_icmp_msgs_per_sec) * delta / HZ; + if (incr) + WRITE_ONCE(icmp_global.stamp, now); + } +- credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst); ++ credit = min_t(u32, icmp_global.credit + incr, ++ READ_ONCE(sysctl_icmp_msgs_burst)); + if (credit) { + /* We want to use a credit of one in average, but need to randomize + * it for security reasons. +-- +2.35.1 + diff --git a/queue-5.18/icmp-fix-data-races-around-sysctl_icmp_echo_enable_p.patch b/queue-5.18/icmp-fix-data-races-around-sysctl_icmp_echo_enable_p.patch new file mode 100644 index 00000000000..621e8149d73 --- /dev/null +++ b/queue-5.18/icmp-fix-data-races-around-sysctl_icmp_echo_enable_p.patch @@ -0,0 +1,51 @@ +From 7d378b6fa14a99bf46d70460df66619e101b5e6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:23 -0700 +Subject: icmp: Fix data-races around sysctl_icmp_echo_enable_probe. + +From: Kuniyuki Iwashima + +[ Upstream commit 4a2f7083cc6cb72dade9a63699ca352fad26d1cd ] + +While reading sysctl_icmp_echo_enable_probe, it can be changed +concurrently. Thus, we need to add READ_ONCE() to its readers. + +Fixes: d329ea5bd884 ("icmp: add response to RFC 8335 PROBE messages") +Fixes: 1fd07f33c3ea ("ipv6: ICMPV6: add response to ICMPV6 RFC 8335 PROBE messages") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/icmp.c | 2 +- + net/ipv6/icmp.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index 92eaa96a9ff1..7edc8a3b1646 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -1025,7 +1025,7 @@ bool icmp_build_probe(struct sk_buff *skb, struct icmphdr *icmphdr) + u16 ident_len; + u8 status; + +- if (!net->ipv4.sysctl_icmp_echo_enable_probe) ++ if (!READ_ONCE(net->ipv4.sysctl_icmp_echo_enable_probe)) + return false; + + /* We currently only support probing interfaces on the proxy node +diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c +index e6b978ea0e87..26554aa6fc1b 100644 +--- a/net/ipv6/icmp.c ++++ b/net/ipv6/icmp.c +@@ -919,7 +919,7 @@ static int icmpv6_rcv(struct sk_buff *skb) + break; + case ICMPV6_EXT_ECHO_REQUEST: + if (!net->ipv6.sysctl.icmpv6_echo_ignore_all && +- net->ipv4.sysctl_icmp_echo_enable_probe) ++ READ_ONCE(net->ipv4.sysctl_icmp_echo_enable_probe)) + icmpv6_echo_reply(skb); + break; + +-- +2.35.1 + diff --git a/queue-5.18/ima-fix-a-potential-integer-overflow-in-ima_appraise.patch b/queue-5.18/ima-fix-a-potential-integer-overflow-in-ima_appraise.patch new file mode 100644 index 00000000000..cb4751f21f3 --- /dev/null +++ b/queue-5.18/ima-fix-a-potential-integer-overflow-in-ima_appraise.patch @@ -0,0 +1,37 @@ +From 25f9f846bed7549bfc20cf61fbf77d74d90c1623 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jul 2022 13:14:17 +0800 +Subject: ima: Fix a potential integer overflow in ima_appraise_measurement + +From: Huaxin Lu + +[ Upstream commit d2ee2cfc4aa85ff6a2a3b198a3a524ec54e3d999 ] + +When the ima-modsig is enabled, the rc passed to evm_verifyxattr() may be +negative, which may cause the integer overflow problem. + +Fixes: 39b07096364a ("ima: Implement support for module-style appended signatures") +Signed-off-by: Huaxin Lu +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/ima/ima_appraise.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c +index 17232bbfb9f9..ee6a0f8879e4 100644 +--- a/security/integrity/ima/ima_appraise.c ++++ b/security/integrity/ima/ima_appraise.c +@@ -408,7 +408,8 @@ int ima_appraise_measurement(enum ima_hooks func, + goto out; + } + +- status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value, rc, iint); ++ status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value, ++ rc < 0 ? 0 : rc, iint); + switch (status) { + case INTEGRITY_PASS: + case INTEGRITY_PASS_IMMUTABLE: +-- +2.35.1 + diff --git a/queue-5.18/ima-fix-potential-memory-leak-in-ima_init_crypto.patch b/queue-5.18/ima-fix-potential-memory-leak-in-ima_init_crypto.patch new file mode 100644 index 00000000000..6af82c99724 --- /dev/null +++ b/queue-5.18/ima-fix-potential-memory-leak-in-ima_init_crypto.patch @@ -0,0 +1,36 @@ +From a14b83618a587bf150e0fe17202559c7d59eaea3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 09:10:37 +0800 +Subject: ima: Fix potential memory leak in ima_init_crypto() + +From: Jianglei Nie + +[ Upstream commit 067d2521874135267e681c19d42761c601d503d6 ] + +On failure to allocate the SHA1 tfm, IMA fails to initialize and exits +without freeing the ima_algo_array. Add the missing kfree() for +ima_algo_array to avoid the potential memory leak. + +Signed-off-by: Jianglei Nie +Fixes: 6d94809af6b0 ("ima: Allocate and initialize tfm for each PCR bank") +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/ima/ima_crypto.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c +index a7206cc1d7d1..64499056648a 100644 +--- a/security/integrity/ima/ima_crypto.c ++++ b/security/integrity/ima/ima_crypto.c +@@ -205,6 +205,7 @@ int __init ima_init_crypto(void) + + crypto_free_shash(ima_algo_array[i].tfm); + } ++ kfree(ima_algo_array); + out: + crypto_free_shash(ima_shash_tfm); + return rc; +-- +2.35.1 + diff --git a/queue-5.18/ima-force-signature-verification-when-config_kexec_s.patch b/queue-5.18/ima-force-signature-verification-when-config_kexec_s.patch new file mode 100644 index 00000000000..69e4ce385ce --- /dev/null +++ b/queue-5.18/ima-force-signature-verification-when-config_kexec_s.patch @@ -0,0 +1,87 @@ +From 88c69fd7a6542d6df8d34b7252ff15ac3721f869 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 15:21:11 +0800 +Subject: ima: force signature verification when CONFIG_KEXEC_SIG is configured + +From: Coiby Xu + +[ Upstream commit af16df54b89dee72df253abc5e7b5e8a6d16c11c ] + +Currently, an unsigned kernel could be kexec'ed when IMA arch specific +policy is configured unless lockdown is enabled. Enforce kernel +signature verification check in the kexec_file_load syscall when IMA +arch specific policy is configured. + +Fixes: 99d5cadfde2b ("kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE") +Reported-and-suggested-by: Mimi Zohar +Signed-off-by: Coiby Xu +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + include/linux/kexec.h | 6 ++++++ + kernel/kexec_file.c | 11 ++++++++++- + security/integrity/ima/ima_efi.c | 2 ++ + 3 files changed, 18 insertions(+), 1 deletion(-) + +diff --git a/include/linux/kexec.h b/include/linux/kexec.h +index fcd5035209f1..8d573baaab29 100644 +--- a/include/linux/kexec.h ++++ b/include/linux/kexec.h +@@ -452,6 +452,12 @@ static inline int kexec_crash_loaded(void) { return 0; } + #define kexec_in_progress false + #endif /* CONFIG_KEXEC_CORE */ + ++#ifdef CONFIG_KEXEC_SIG ++void set_kexec_sig_enforced(void); ++#else ++static inline void set_kexec_sig_enforced(void) {} ++#endif ++ + #endif /* !defined(__ASSEBMLY__) */ + + #endif /* LINUX_KEXEC_H */ +diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c +index c108a2a88754..bb0fb63f563c 100644 +--- a/kernel/kexec_file.c ++++ b/kernel/kexec_file.c +@@ -29,6 +29,15 @@ + #include + #include "kexec_internal.h" + ++#ifdef CONFIG_KEXEC_SIG ++static bool sig_enforce = IS_ENABLED(CONFIG_KEXEC_SIG_FORCE); ++ ++void set_kexec_sig_enforced(void) ++{ ++ sig_enforce = true; ++} ++#endif ++ + static int kexec_calculate_store_digests(struct kimage *image); + + /* +@@ -159,7 +168,7 @@ kimage_validate_signature(struct kimage *image) + image->kernel_buf_len); + if (ret) { + +- if (IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) { ++ if (sig_enforce) { + pr_notice("Enforced kernel signature verification failed (%d).\n", ret); + return ret; + } +diff --git a/security/integrity/ima/ima_efi.c b/security/integrity/ima/ima_efi.c +index 71786d01946f..9db66fe310d4 100644 +--- a/security/integrity/ima/ima_efi.c ++++ b/security/integrity/ima/ima_efi.c +@@ -67,6 +67,8 @@ const char * const *arch_get_ima_policy(void) + if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) { + if (IS_ENABLED(CONFIG_MODULE_SIG)) + set_module_sig_enforced(); ++ if (IS_ENABLED(CONFIG_KEXEC_SIG)) ++ set_kexec_sig_enforced(); + return sb_arch_rules; + } + return NULL; +-- +2.35.1 + diff --git a/queue-5.18/inetpeer-fix-data-races-around-sysctl.patch b/queue-5.18/inetpeer-fix-data-races-around-sysctl.patch new file mode 100644 index 00000000000..363d3c46252 --- /dev/null +++ b/queue-5.18/inetpeer-fix-data-races-around-sysctl.patch @@ -0,0 +1,52 @@ +From de6d026dc57e583bb3ead4e908e4737702715ee8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:39:59 -0700 +Subject: inetpeer: Fix data-races around sysctl. + +From: Kuniyuki Iwashima + +[ Upstream commit 3d32edf1f3c38d3301f6434e56316f293466d7fb ] + +While reading inetpeer sysctl variables, they can be changed +concurrently. So, we need to add READ_ONCE() to avoid data-races. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/inetpeer.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c +index da21dfce24d7..e9fed83e9b3c 100644 +--- a/net/ipv4/inetpeer.c ++++ b/net/ipv4/inetpeer.c +@@ -141,16 +141,20 @@ static void inet_peer_gc(struct inet_peer_base *base, + struct inet_peer *gc_stack[], + unsigned int gc_cnt) + { ++ int peer_threshold, peer_maxttl, peer_minttl; + struct inet_peer *p; + __u32 delta, ttl; + int i; + +- if (base->total >= inet_peer_threshold) ++ peer_threshold = READ_ONCE(inet_peer_threshold); ++ peer_maxttl = READ_ONCE(inet_peer_maxttl); ++ peer_minttl = READ_ONCE(inet_peer_minttl); ++ ++ if (base->total >= peer_threshold) + ttl = 0; /* be aggressive */ + else +- ttl = inet_peer_maxttl +- - (inet_peer_maxttl - inet_peer_minttl) / HZ * +- base->total / inet_peer_threshold * HZ; ++ ttl = peer_maxttl - (peer_maxttl - peer_minttl) / HZ * ++ base->total / peer_threshold * HZ; + for (i = 0; i < gc_cnt; i++) { + p = gc_stack[i]; + +-- +2.35.1 + diff --git a/queue-5.18/ipv4-fix-a-data-race-around-sysctl_fib_sync_mem.patch b/queue-5.18/ipv4-fix-a-data-race-around-sysctl_fib_sync_mem.patch new file mode 100644 index 00000000000..e074769748f --- /dev/null +++ b/queue-5.18/ipv4-fix-a-data-race-around-sysctl_fib_sync_mem.patch @@ -0,0 +1,36 @@ +From 858c0a3b1b6486a5dd1aaea23ad50bb06556b84a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:40:03 -0700 +Subject: ipv4: Fix a data-race around sysctl_fib_sync_mem. + +From: Kuniyuki Iwashima + +[ Upstream commit 73318c4b7dbd0e781aaababff17376b2894745c0 ] + +While reading sysctl_fib_sync_mem, it can be changed concurrently. +So, we need to add READ_ONCE() to avoid a data-race. + +Fixes: 9ab948a91b2c ("ipv4: Allow amount of dirty memory from fib resizing to be controllable") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/fib_trie.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c +index fb0e49c36c2e..43a496272227 100644 +--- a/net/ipv4/fib_trie.c ++++ b/net/ipv4/fib_trie.c +@@ -498,7 +498,7 @@ static void tnode_free(struct key_vector *tn) + tn = container_of(head, struct tnode, rcu)->kv; + } + +- if (tnode_free_size >= sysctl_fib_sync_mem) { ++ if (tnode_free_size >= READ_ONCE(sysctl_fib_sync_mem)) { + tnode_free_size = 0; + synchronize_rcu(); + } +-- +2.35.1 + diff --git a/queue-5.18/ipv4-fix-data-races-around-sysctl_ip_dynaddr.patch b/queue-5.18/ipv4-fix-data-races-around-sysctl_ip_dynaddr.patch new file mode 100644 index 00000000000..03d0d93670a --- /dev/null +++ b/queue-5.18/ipv4-fix-data-races-around-sysctl_ip_dynaddr.patch @@ -0,0 +1,59 @@ +From eb117af5477ce74151c3ccf438bd81aafee1fd09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:32 -0700 +Subject: ipv4: Fix data-races around sysctl_ip_dynaddr. + +From: Kuniyuki Iwashima + +[ Upstream commit e49e4aff7ec19b2d0d0957ee30e93dade57dab9e ] + +While reading sysctl_ip_dynaddr, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + Documentation/networking/ip-sysctl.rst | 2 +- + net/ipv4/af_inet.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst +index 8ffed7135fc1..8899b474edbf 100644 +--- a/Documentation/networking/ip-sysctl.rst ++++ b/Documentation/networking/ip-sysctl.rst +@@ -1179,7 +1179,7 @@ ip_autobind_reuse - BOOLEAN + option should only be set by experts. + Default: 0 + +-ip_dynaddr - BOOLEAN ++ip_dynaddr - INTEGER + If set non-zero, enables support for dynamic addresses. + If set to a non-zero value larger than 1, a kernel log + message will be printed when dynamic address rewriting +diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c +index 72fde2888ad2..98bc180563d1 100644 +--- a/net/ipv4/af_inet.c ++++ b/net/ipv4/af_inet.c +@@ -1247,7 +1247,7 @@ static int inet_sk_reselect_saddr(struct sock *sk) + if (new_saddr == old_saddr) + return 0; + +- if (sock_net(sk)->ipv4.sysctl_ip_dynaddr > 1) { ++ if (READ_ONCE(sock_net(sk)->ipv4.sysctl_ip_dynaddr) > 1) { + pr_info("%s(): shifting inet->saddr from %pI4 to %pI4\n", + __func__, &old_saddr, &new_saddr); + } +@@ -1302,7 +1302,7 @@ int inet_sk_rebuild_header(struct sock *sk) + * Other protocols have to map its equivalent state to TCP_SYN_SENT. + * DCCP maps its DCCP_REQUESTING state to TCP_SYN_SENT. -acme + */ +- if (!sock_net(sk)->ipv4.sysctl_ip_dynaddr || ++ if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_ip_dynaddr) || + sk->sk_state != TCP_SYN_SENT || + (sk->sk_userlocks & SOCK_BINDADDR_LOCK) || + (err = inet_sk_reselect_saddr(sk)) != 0) +-- +2.35.1 + diff --git a/queue-5.18/kvm-x86-fully-initialize-struct-kvm_lapic_irq-in-kvm.patch b/queue-5.18/kvm-x86-fully-initialize-struct-kvm_lapic_irq-in-kvm.patch new file mode 100644 index 00000000000..b11f1298c6e --- /dev/null +++ b/queue-5.18/kvm-x86-fully-initialize-struct-kvm_lapic_irq-in-kvm.patch @@ -0,0 +1,60 @@ +From 95d40d08bed452f698250fbc9b5199cbb83664b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 14:51:47 +0200 +Subject: KVM: x86: Fully initialize 'struct kvm_lapic_irq' in + kvm_pv_kick_cpu_op() + +From: Vitaly Kuznetsov + +[ Upstream commit 8a414f943f8b5f94bbaafdec863d6f3dbef33f8a ] + +'vector' and 'trig_mode' fields of 'struct kvm_lapic_irq' are left +uninitialized in kvm_pv_kick_cpu_op(). While these fields are normally +not needed for APIC_DM_REMRD, they're still referenced by +__apic_accept_irq() for trace_kvm_apic_accept_irq(). Fully initialize +the structure to avoid consuming random stack memory. + +Fixes: a183b638b61c ("KVM: x86: make apic_accept_irq tracepoint more generic") +Reported-by: syzbot+d6caa905917d353f0d07@syzkaller.appspotmail.com +Signed-off-by: Vitaly Kuznetsov +Reviewed-by: Sean Christopherson +Message-Id: <20220708125147.593975-1-vkuznets@redhat.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/x86.c | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 558d1f2ab5b4..828f5cf1af45 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -9074,15 +9074,17 @@ static int kvm_pv_clock_pairing(struct kvm_vcpu *vcpu, gpa_t paddr, + */ + static void kvm_pv_kick_cpu_op(struct kvm *kvm, int apicid) + { +- struct kvm_lapic_irq lapic_irq; +- +- lapic_irq.shorthand = APIC_DEST_NOSHORT; +- lapic_irq.dest_mode = APIC_DEST_PHYSICAL; +- lapic_irq.level = 0; +- lapic_irq.dest_id = apicid; +- lapic_irq.msi_redir_hint = false; ++ /* ++ * All other fields are unused for APIC_DM_REMRD, but may be consumed by ++ * common code, e.g. for tracing. Defer initialization to the compiler. ++ */ ++ struct kvm_lapic_irq lapic_irq = { ++ .delivery_mode = APIC_DM_REMRD, ++ .dest_mode = APIC_DEST_PHYSICAL, ++ .shorthand = APIC_DEST_NOSHORT, ++ .dest_id = apicid, ++ }; + +- lapic_irq.delivery_mode = APIC_DM_REMRD; + kvm_irq_delivery_to_apic(kvm, NULL, &lapic_irq, NULL); + } + +-- +2.35.1 + diff --git a/queue-5.18/lockd-fix-nlm_close_files.patch b/queue-5.18/lockd-fix-nlm_close_files.patch new file mode 100644 index 00000000000..48f738a6c55 --- /dev/null +++ b/queue-5.18/lockd-fix-nlm_close_files.patch @@ -0,0 +1,44 @@ +From 2ebe0903fa69d29cf06d12548448dd7faca22f2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 14:30:14 -0400 +Subject: lockd: fix nlm_close_files + +From: Jeff Layton + +[ Upstream commit 1197eb5906a5464dbaea24cac296dfc38499cc00 ] + +This loop condition tries a bit too hard to be clever. Just test for +the two indices we care about explicitly. + +Cc: J. Bruce Fields +Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file") +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/lockd/svcsubs.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/fs/lockd/svcsubs.c b/fs/lockd/svcsubs.c +index b2f277727469..e1c4617de771 100644 +--- a/fs/lockd/svcsubs.c ++++ b/fs/lockd/svcsubs.c +@@ -283,11 +283,10 @@ nlm_file_inuse(struct nlm_file *file) + + static void nlm_close_files(struct nlm_file *file) + { +- struct file *f; +- +- for (f = file->f_file[0]; f <= file->f_file[1]; f++) +- if (f) +- nlmsvc_ops->fclose(f); ++ if (file->f_file[O_RDONLY]) ++ nlmsvc_ops->fclose(file->f_file[O_RDONLY]); ++ if (file->f_file[O_WRONLY]) ++ nlmsvc_ops->fclose(file->f_file[O_WRONLY]); + } + + /* +-- +2.35.1 + diff --git a/queue-5.18/lockd-set-fl_owner-when-unlocking-files.patch b/queue-5.18/lockd-set-fl_owner-when-unlocking-files.patch new file mode 100644 index 00000000000..8a6499074d4 --- /dev/null +++ b/queue-5.18/lockd-set-fl_owner-when-unlocking-files.patch @@ -0,0 +1,54 @@ +From 116b9bf7892ed63833f73ed6784b0d6867c2ff59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 14:30:13 -0400 +Subject: lockd: set fl_owner when unlocking files + +From: Jeff Layton + +[ Upstream commit aec158242b87a43d83322e99bc71ab4428e5ab79 ] + +Unlocking a POSIX lock on an inode with vfs_lock_file only works if +the owner matches. Ensure we set it in the request. + +Cc: J. Bruce Fields +Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file") +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/lockd/svcsubs.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/lockd/svcsubs.c b/fs/lockd/svcsubs.c +index 0a22a2faf552..b2f277727469 100644 +--- a/fs/lockd/svcsubs.c ++++ b/fs/lockd/svcsubs.c +@@ -176,7 +176,7 @@ nlm_delete_file(struct nlm_file *file) + } + } + +-static int nlm_unlock_files(struct nlm_file *file) ++static int nlm_unlock_files(struct nlm_file *file, fl_owner_t owner) + { + struct file_lock lock; + +@@ -184,6 +184,7 @@ static int nlm_unlock_files(struct nlm_file *file) + lock.fl_type = F_UNLCK; + lock.fl_start = 0; + lock.fl_end = OFFSET_MAX; ++ lock.fl_owner = owner; + if (file->f_file[O_RDONLY] && + vfs_lock_file(file->f_file[O_RDONLY], F_SETLK, &lock, NULL)) + goto out_err; +@@ -225,7 +226,7 @@ nlm_traverse_locks(struct nlm_host *host, struct nlm_file *file, + if (match(lockhost, host)) { + + spin_unlock(&flctx->flc_lock); +- if (nlm_unlock_files(file)) ++ if (nlm_unlock_files(file, fl->fl_owner)) + return 1; + goto again; + } +-- +2.35.1 + diff --git a/queue-5.18/mm-sysctl-fix-missing-numa_stat-when-config_hugetlb_.patch b/queue-5.18/mm-sysctl-fix-missing-numa_stat-when-config_hugetlb_.patch new file mode 100644 index 00000000000..f21fc37c0ea --- /dev/null +++ b/queue-5.18/mm-sysctl-fix-missing-numa_stat-when-config_hugetlb_.patch @@ -0,0 +1,66 @@ +From 286cc37d1937a13a1c8c80e69bda987a8538d37a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 18:40:32 +0800 +Subject: mm: sysctl: fix missing numa_stat when !CONFIG_HUGETLB_PAGE + +From: Muchun Song + +[ Upstream commit 43b5240ca6b33108998810593248186b1e3ae34a ] + +"numa_stat" should not be included in the scope of CONFIG_HUGETLB_PAGE, if +CONFIG_HUGETLB_PAGE is not configured even if CONFIG_NUMA is configured, +"numa_stat" is missed form /proc. Move it out of CONFIG_HUGETLB_PAGE to +fix it. + +Fixes: 4518085e127d ("mm, sysctl: make NUMA stats configurable") +Signed-off-by: Muchun Song +Cc: +Acked-by: Michal Hocko +Acked-by: Mel Gorman +Signed-off-by: Luis Chamberlain +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index f165ea67dd33..c42ba2d669dc 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -2466,6 +2466,17 @@ static struct ctl_table vm_table[] = { + .extra1 = SYSCTL_ZERO, + .extra2 = SYSCTL_TWO_HUNDRED, + }, ++#ifdef CONFIG_NUMA ++ { ++ .procname = "numa_stat", ++ .data = &sysctl_vm_numa_stat, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = sysctl_vm_numa_stat_handler, ++ .extra1 = SYSCTL_ZERO, ++ .extra2 = SYSCTL_ONE, ++ }, ++#endif + #ifdef CONFIG_HUGETLB_PAGE + { + .procname = "nr_hugepages", +@@ -2482,15 +2493,6 @@ static struct ctl_table vm_table[] = { + .mode = 0644, + .proc_handler = &hugetlb_mempolicy_sysctl_handler, + }, +- { +- .procname = "numa_stat", +- .data = &sysctl_vm_numa_stat, +- .maxlen = sizeof(int), +- .mode = 0644, +- .proc_handler = sysctl_vm_numa_stat_handler, +- .extra1 = SYSCTL_ZERO, +- .extra2 = SYSCTL_ONE, +- }, + #endif + { + .procname = "hugetlb_shm_group", +-- +2.35.1 + diff --git a/queue-5.18/mptcp-fix-subflow-traversal-at-disconnect-time.patch b/queue-5.18/mptcp-fix-subflow-traversal-at-disconnect-time.patch new file mode 100644 index 00000000000..c721efc4c22 --- /dev/null +++ b/queue-5.18/mptcp-fix-subflow-traversal-at-disconnect-time.patch @@ -0,0 +1,51 @@ +From b48de5528273beca2c08e41aff8880c6dc16b034 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 16:36:09 -0700 +Subject: mptcp: fix subflow traversal at disconnect time + +From: Paolo Abeni + +[ Upstream commit 5c835bb142d4013c2ab24bff5ae9f6709a39cbcf ] + +At disconnect time the MPTCP protocol traverse the subflows +list closing each of them. In some circumstances - MPJ subflow, +passive MPTCP socket, the latter operation can remove the +subflow from the list, invalidating the current iterator. + +Address the issue using the safe list traversing helper +variant. + +Reported-by: van fantasy +Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation") +Tested-by: Matthieu Baerts +Reviewed-by: Mat Martineau +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/mptcp/protocol.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c +index b0fb1fc0bd4a..b52fd250cb3a 100644 +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -2840,12 +2840,12 @@ static void mptcp_copy_inaddrs(struct sock *msk, const struct sock *ssk) + + static int mptcp_disconnect(struct sock *sk, int flags) + { +- struct mptcp_subflow_context *subflow; ++ struct mptcp_subflow_context *subflow, *tmp; + struct mptcp_sock *msk = mptcp_sk(sk); + + inet_sk_state_store(sk, TCP_CLOSE); + +- mptcp_for_each_subflow(msk, subflow) { ++ list_for_each_entry_safe(subflow, tmp, &msk->conn_list, node) { + struct sock *ssk = mptcp_subflow_tcp_sock(subflow); + + __mptcp_close_ssk(sk, ssk, subflow, MPTCP_CF_FASTCLOSE); +-- +2.35.1 + diff --git a/queue-5.18/net-atlantic-remove-aq_nic_deinit-when-resume.patch b/queue-5.18/net-atlantic-remove-aq_nic_deinit-when-resume.patch new file mode 100644 index 00000000000..e26b007a3c1 --- /dev/null +++ b/queue-5.18/net-atlantic-remove-aq_nic_deinit-when-resume.patch @@ -0,0 +1,61 @@ +From cc9ddc791472c18e5a75ba8df61787e90de80880 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 19:12:24 +0800 +Subject: net: atlantic: remove aq_nic_deinit() when resume + +From: Chia-Lin Kao (AceLan) + +[ Upstream commit 2e15c51fefaffaf9f72255eaef4fada05055e4c5 ] + +aq_nic_deinit() has been called while suspending, so we don't have to call +it again on resume. +Actually, call it again leads to another hang issue when resuming from +S3. + +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992345] Call Trace: +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992346] +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992348] aq_nic_deinit+0xb4/0xd0 [atlantic] +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992356] aq_pm_thaw+0x7f/0x100 [atlantic] +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992362] pci_pm_resume+0x5c/0x90 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992366] ? pci_pm_thaw+0x80/0x80 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992368] dpm_run_callback+0x4e/0x120 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992371] device_resume+0xad/0x200 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992373] async_resume+0x1e/0x40 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992374] async_run_entry_fn+0x33/0x120 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992377] process_one_work+0x220/0x3c0 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992380] worker_thread+0x4d/0x3f0 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992382] ? process_one_work+0x3c0/0x3c0 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992384] kthread+0x12a/0x150 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992386] ? set_kthread_struct+0x40/0x40 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992387] ret_from_fork+0x22/0x30 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992391] +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992392] ---[ end trace 1ec8c79604ed5e0d ]--- +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992394] PM: dpm_run_callback(): pci_pm_resume+0x0/0x90 returns -110 +Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992397] atlantic 0000:02:00.0: PM: failed to resume async: error -110 + +Fixes: 1809c30b6e5a ("net: atlantic: always deep reset on pm op, fixing up my null deref regression") +Signed-off-by: Chia-Lin Kao (AceLan) +Link: https://lore.kernel.org/r/20220713111224.1535938-2-acelan.kao@canonical.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +index dbd5263130f9..8647125d60ae 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +@@ -413,9 +413,6 @@ static int atl_resume_common(struct device *dev) + pci_set_power_state(pdev, PCI_D0); + pci_restore_state(pdev); + +- /* Reinitialize Nic/Vecs objects */ +- aq_nic_deinit(nic, !nic->aq_hw->aq_nic_cfg->wol); +- + if (netif_running(nic->ndev)) { + ret = aq_nic_init(nic); + if (ret) +-- +2.35.1 + diff --git a/queue-5.18/net-atlantic-remove-deep-parameter-on-suspend-resume.patch b/queue-5.18/net-atlantic-remove-deep-parameter-on-suspend-resume.patch new file mode 100644 index 00000000000..4900b2ddcef --- /dev/null +++ b/queue-5.18/net-atlantic-remove-deep-parameter-on-suspend-resume.patch @@ -0,0 +1,101 @@ +From 613fb5611925a6189252282bbfdae56af1cc62f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 19:12:23 +0800 +Subject: net: atlantic: remove deep parameter on suspend/resume functions + +From: Chia-Lin Kao (AceLan) + +[ Upstream commit 0f33250760384e05c36466b0a2f92f3c6007ba92 ] + +Below commit claims that atlantic NIC requires to reset the device on pm +op, and had set the deep to true for all suspend/resume functions. +commit 1809c30b6e5a ("net: atlantic: always deep reset on pm op, fixing up my null deref regression") +So, we could remove deep parameter on suspend/resume functions without +any functional change. + +Fixes: 1809c30b6e5a ("net: atlantic: always deep reset on pm op, fixing up my null deref regression") +Signed-off-by: Chia-Lin Kao (AceLan) +Link: https://lore.kernel.org/r/20220713111224.1535938-1-acelan.kao@canonical.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../ethernet/aquantia/atlantic/aq_pci_func.c | 24 ++++++++----------- + 1 file changed, 10 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +index 831833911a52..dbd5263130f9 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +@@ -379,7 +379,7 @@ static void aq_pci_shutdown(struct pci_dev *pdev) + } + } + +-static int aq_suspend_common(struct device *dev, bool deep) ++static int aq_suspend_common(struct device *dev) + { + struct aq_nic_s *nic = pci_get_drvdata(to_pci_dev(dev)); + +@@ -392,17 +392,15 @@ static int aq_suspend_common(struct device *dev, bool deep) + if (netif_running(nic->ndev)) + aq_nic_stop(nic); + +- if (deep) { +- aq_nic_deinit(nic, !nic->aq_hw->aq_nic_cfg->wol); +- aq_nic_set_power(nic); +- } ++ aq_nic_deinit(nic, !nic->aq_hw->aq_nic_cfg->wol); ++ aq_nic_set_power(nic); + + rtnl_unlock(); + + return 0; + } + +-static int atl_resume_common(struct device *dev, bool deep) ++static int atl_resume_common(struct device *dev) + { + struct pci_dev *pdev = to_pci_dev(dev); + struct aq_nic_s *nic; +@@ -415,10 +413,8 @@ static int atl_resume_common(struct device *dev, bool deep) + pci_set_power_state(pdev, PCI_D0); + pci_restore_state(pdev); + +- if (deep) { +- /* Reinitialize Nic/Vecs objects */ +- aq_nic_deinit(nic, !nic->aq_hw->aq_nic_cfg->wol); +- } ++ /* Reinitialize Nic/Vecs objects */ ++ aq_nic_deinit(nic, !nic->aq_hw->aq_nic_cfg->wol); + + if (netif_running(nic->ndev)) { + ret = aq_nic_init(nic); +@@ -444,22 +440,22 @@ static int atl_resume_common(struct device *dev, bool deep) + + static int aq_pm_freeze(struct device *dev) + { +- return aq_suspend_common(dev, true); ++ return aq_suspend_common(dev); + } + + static int aq_pm_suspend_poweroff(struct device *dev) + { +- return aq_suspend_common(dev, true); ++ return aq_suspend_common(dev); + } + + static int aq_pm_thaw(struct device *dev) + { +- return atl_resume_common(dev, true); ++ return atl_resume_common(dev); + } + + static int aq_pm_resume_restore(struct device *dev) + { +- return atl_resume_common(dev, true); ++ return atl_resume_common(dev); + } + + static const struct dev_pm_ops aq_pm_ops = { +-- +2.35.1 + diff --git a/queue-5.18/net-ethernet-ti-am65-cpsw-fix-devlink-port-register-.patch b/queue-5.18/net-ethernet-ti-am65-cpsw-fix-devlink-port-register-.patch new file mode 100644 index 00000000000..882252a2a86 --- /dev/null +++ b/queue-5.18/net-ethernet-ti-am65-cpsw-fix-devlink-port-register-.patch @@ -0,0 +1,95 @@ +From c06712ac137a11e8859e341701dc7f85a19b0643 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 12:32:08 +0530 +Subject: net: ethernet: ti: am65-cpsw: Fix devlink port register sequence + +From: Siddharth Vadapalli + +[ Upstream commit 0680e20af5fbf41df8a11b11bd9a7c25b2ca0746 ] + +Renaming interfaces using udevd depends on the interface being registered +before its netdev is registered. Otherwise, udevd reads an empty +phys_port_name value, resulting in the interface not being renamed. + +Fix this by registering the interface before registering its netdev +by invoking am65_cpsw_nuss_register_devlink() before invoking +register_netdev() for the interface. + +Move the function call to devlink_port_type_eth_set(), invoking it after +register_netdev() is invoked, to ensure that netlink notification for the +port state change is generated after the netdev is completely initialized. + +Fixes: 58356eb31d60 ("net: ti: am65-cpsw-nuss: Add devlink support") +Signed-off-by: Siddharth Vadapalli +Link: https://lore.kernel.org/r/20220706070208.12207-1-s-vadapalli@ti.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +index 6d978dbf708f..298953053407 100644 +--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c ++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +@@ -2475,7 +2475,6 @@ static int am65_cpsw_nuss_register_devlink(struct am65_cpsw_common *common) + port->port_id, ret); + goto dl_port_unreg; + } +- devlink_port_type_eth_set(dl_port, port->ndev); + } + devlink_register(common->devlink); + return ret; +@@ -2519,6 +2518,7 @@ static void am65_cpsw_unregister_devlink(struct am65_cpsw_common *common) + static int am65_cpsw_nuss_register_ndevs(struct am65_cpsw_common *common) + { + struct device *dev = common->dev; ++ struct devlink_port *dl_port; + struct am65_cpsw_port *port; + int ret = 0, i; + +@@ -2535,6 +2535,10 @@ static int am65_cpsw_nuss_register_ndevs(struct am65_cpsw_common *common) + return ret; + } + ++ ret = am65_cpsw_nuss_register_devlink(common); ++ if (ret) ++ return ret; ++ + for (i = 0; i < common->port_num; i++) { + port = &common->ports[i]; + +@@ -2547,25 +2551,24 @@ static int am65_cpsw_nuss_register_ndevs(struct am65_cpsw_common *common) + i, ret); + goto err_cleanup_ndev; + } ++ ++ dl_port = &port->devlink_port; ++ devlink_port_type_eth_set(dl_port, port->ndev); + } + + ret = am65_cpsw_register_notifiers(common); + if (ret) + goto err_cleanup_ndev; + +- ret = am65_cpsw_nuss_register_devlink(common); +- if (ret) +- goto clean_unregister_notifiers; +- + /* can't auto unregister ndev using devm_add_action() due to + * devres release sequence in DD core for DMA + */ + + return 0; +-clean_unregister_notifiers: +- am65_cpsw_unregister_notifiers(common); ++ + err_cleanup_ndev: + am65_cpsw_nuss_cleanup_ndev(common); ++ am65_cpsw_unregister_devlink(common); + + return ret; + } +-- +2.35.1 + diff --git a/queue-5.18/net-fix-data-races-around-sysctl_mem.patch b/queue-5.18/net-fix-data-races-around-sysctl_mem.patch new file mode 100644 index 00000000000..4ea8084d71c --- /dev/null +++ b/queue-5.18/net-fix-data-races-around-sysctl_mem.patch @@ -0,0 +1,36 @@ +From c8f2e02504f1dae63337469796f48c9673db0621 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:40:00 -0700 +Subject: net: Fix data-races around sysctl_mem. + +From: Kuniyuki Iwashima + +[ Upstream commit 310731e2f1611d1d13aae237abcf8e66d33345d5 ] + +While reading .sysctl_mem, it can be changed concurrently. +So, we need to add READ_ONCE() to avoid data-races. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/sock.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/net/sock.h b/include/net/sock.h +index 3c4fb8f03fd9..6bef0ffb1e7b 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1534,7 +1534,7 @@ void __sk_mem_reclaim(struct sock *sk, int amount); + /* sysctl_mem values are in pages, we convert them in SK_MEM_QUANTUM units */ + static inline long sk_prot_mem_limits(const struct sock *sk, int index) + { +- long val = sk->sk_prot->sysctl_mem[index]; ++ long val = READ_ONCE(sk->sk_prot->sysctl_mem[index]); + + #if PAGE_SIZE > SK_MEM_QUANTUM + val <<= PAGE_SHIFT - SK_MEM_QUANTUM_SHIFT; +-- +2.35.1 + diff --git a/queue-5.18/net-ftgmac100-hold-reference-returned-by-of_get_chil.patch b/queue-5.18/net-ftgmac100-hold-reference-returned-by-of_get_chil.patch new file mode 100644 index 00000000000..adca9d127e0 --- /dev/null +++ b/queue-5.18/net-ftgmac100-hold-reference-returned-by-of_get_chil.patch @@ -0,0 +1,57 @@ +From 2c5811d6af91174e2cc6107735d1352481dba150 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 14:14:17 +0800 +Subject: net: ftgmac100: Hold reference returned by of_get_child_by_name() + +From: Liang He + +[ Upstream commit 49b9f431ff0d845a36be0b3ede35ec324f2e5fee ] + +In ftgmac100_probe(), we should hold the refernece returned by +of_get_child_by_name() and use it to call of_node_put() for +reference balance. + +Fixes: 39bfab8844a0 ("net: ftgmac100: Add support for DT phy-handle property") +Signed-off-by: Liang He +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/faraday/ftgmac100.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c +index 5231818943c6..c03663785a8d 100644 +--- a/drivers/net/ethernet/faraday/ftgmac100.c ++++ b/drivers/net/ethernet/faraday/ftgmac100.c +@@ -1764,6 +1764,19 @@ static int ftgmac100_setup_clk(struct ftgmac100 *priv) + return rc; + } + ++static bool ftgmac100_has_child_node(struct device_node *np, const char *name) ++{ ++ struct device_node *child_np = of_get_child_by_name(np, name); ++ bool ret = false; ++ ++ if (child_np) { ++ ret = true; ++ of_node_put(child_np); ++ } ++ ++ return ret; ++} ++ + static int ftgmac100_probe(struct platform_device *pdev) + { + struct resource *res; +@@ -1883,7 +1896,7 @@ static int ftgmac100_probe(struct platform_device *pdev) + + /* Display what we found */ + phy_attached_info(phy); +- } else if (np && !of_get_child_by_name(np, "mdio")) { ++ } else if (np && !ftgmac100_has_child_node(np, "mdio")) { + /* Support legacy ASPEED devicetree descriptions that decribe a + * MAC with an embedded MDIO controller but have no "mdio" + * child node. Automatically scan the MDIO bus for available +-- +2.35.1 + diff --git a/queue-5.18/net-marvell-prestera-fix-missed-deinit-sequence.patch b/queue-5.18/net-marvell-prestera-fix-missed-deinit-sequence.patch new file mode 100644 index 00000000000..39a1553e563 --- /dev/null +++ b/queue-5.18/net-marvell-prestera-fix-missed-deinit-sequence.patch @@ -0,0 +1,35 @@ +From cd0d144d94c740cffcabd4293f1825aa22b8ff4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Jul 2022 15:20:21 +0300 +Subject: net: marvell: prestera: fix missed deinit sequence + +From: Yevhen Orlov + +[ Upstream commit f946964a9f79f8dcb5a6329265281eebfc23aee5 ] + +Add unregister_fib_notifier as rollback of register_fib_notifier. + +Fixes: 4394fbcb78cf ("net: marvell: prestera: handle fib notifications") +Signed-off-by: Yevhen Orlov +Link: https://lore.kernel.org/r/20220710122021.7642-1-yevhen.orlov@plvision.eu +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/prestera/prestera_router.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/marvell/prestera/prestera_router.c b/drivers/net/ethernet/marvell/prestera/prestera_router.c +index 6c5618cf4f08..97d9012db189 100644 +--- a/drivers/net/ethernet/marvell/prestera/prestera_router.c ++++ b/drivers/net/ethernet/marvell/prestera/prestera_router.c +@@ -587,6 +587,7 @@ int prestera_router_init(struct prestera_switch *sw) + + void prestera_router_fini(struct prestera_switch *sw) + { ++ unregister_fib_notifier(&init_net, &sw->router->fib_nb); + unregister_inetaddr_notifier(&sw->router->inetaddr_nb); + unregister_inetaddr_validator_notifier(&sw->router->inetaddr_valid_nb); + rhashtable_destroy(&sw->router->kern_fib_cache_ht); +-- +2.35.1 + diff --git a/queue-5.18/net-mlx5e-ct-use-own-workqueue-instead-of-mlx5e-priv.patch b/queue-5.18/net-mlx5e-ct-use-own-workqueue-instead-of-mlx5e-priv.patch new file mode 100644 index 00000000000..50943346659 --- /dev/null +++ b/queue-5.18/net-mlx5e-ct-use-own-workqueue-instead-of-mlx5e-priv.patch @@ -0,0 +1,105 @@ +From da6eb243b37c7531d91de7a8b42f12dfae299c1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jun 2022 10:43:55 +0300 +Subject: net/mlx5e: CT: Use own workqueue instead of mlx5e priv + +From: Roi Dayan + +[ Upstream commit 6c4e8fa03fde7e5b304594294e397a9ba92feaf6 ] + +Allocate a ct priv workqueue instead of using mlx5e priv one +so flushing will only be of related CT entries. +Also move flushing of the workqueue before rhashtable destroy +otherwise entries won't be valid. + +Fixes: b069e14fff46 ("net/mlx5e: CT: Fix queued up restore put() executing after relevant ft release") +Signed-off-by: Roi Dayan +Reviewed-by: Oz Shlomo +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlx5/core/en/tc_ct.c | 20 +++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c +index 1ff7a07bcd06..fbcce63e5b80 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c +@@ -66,6 +66,7 @@ struct mlx5_tc_ct_priv { + struct mlx5_ct_fs *fs; + struct mlx5_ct_fs_ops *fs_ops; + spinlock_t ht_lock; /* protects ft entries */ ++ struct workqueue_struct *wq; + }; + + struct mlx5_ct_flow { +@@ -927,14 +928,11 @@ static void mlx5_tc_ct_entry_del_work(struct work_struct *work) + static void + __mlx5_tc_ct_entry_put(struct mlx5_ct_entry *entry) + { +- struct mlx5e_priv *priv; +- + if (!refcount_dec_and_test(&entry->refcnt)) + return; + +- priv = netdev_priv(entry->ct_priv->netdev); + INIT_WORK(&entry->work, mlx5_tc_ct_entry_del_work); +- queue_work(priv->wq, &entry->work); ++ queue_work(entry->ct_priv->wq, &entry->work); + } + + static struct mlx5_ct_counter * +@@ -1744,19 +1742,16 @@ mlx5_tc_ct_flush_ft_entry(void *ptr, void *arg) + static void + mlx5_tc_ct_del_ft_cb(struct mlx5_tc_ct_priv *ct_priv, struct mlx5_ct_ft *ft) + { +- struct mlx5e_priv *priv; +- + if (!refcount_dec_and_test(&ft->refcount)) + return; + ++ flush_workqueue(ct_priv->wq); + nf_flow_table_offload_del_cb(ft->nf_ft, + mlx5_tc_ct_block_flow_offload, ft); + rhashtable_remove_fast(&ct_priv->zone_ht, &ft->node, zone_params); + rhashtable_free_and_destroy(&ft->ct_entries_ht, + mlx5_tc_ct_flush_ft_entry, + ct_priv); +- priv = netdev_priv(ct_priv->netdev); +- flush_workqueue(priv->wq); + mlx5_tc_ct_free_pre_ct_tables(ft); + mapping_remove(ct_priv->zone_mapping, ft->zone_restore_id); + kfree(ft); +@@ -2139,6 +2134,12 @@ mlx5_tc_ct_init(struct mlx5e_priv *priv, struct mlx5_fs_chains *chains, + if (rhashtable_init(&ct_priv->ct_tuples_nat_ht, &tuples_nat_ht_params)) + goto err_ct_tuples_nat_ht; + ++ ct_priv->wq = alloc_ordered_workqueue("mlx5e_ct_priv_wq", 0); ++ if (!ct_priv->wq) { ++ err = -ENOMEM; ++ goto err_wq; ++ } ++ + err = mlx5_tc_ct_fs_init(ct_priv); + if (err) + goto err_init_fs; +@@ -2146,6 +2147,8 @@ mlx5_tc_ct_init(struct mlx5e_priv *priv, struct mlx5_fs_chains *chains, + return ct_priv; + + err_init_fs: ++ destroy_workqueue(ct_priv->wq); ++err_wq: + rhashtable_destroy(&ct_priv->ct_tuples_nat_ht); + err_ct_tuples_nat_ht: + rhashtable_destroy(&ct_priv->ct_tuples_ht); +@@ -2175,6 +2178,7 @@ mlx5_tc_ct_clean(struct mlx5_tc_ct_priv *ct_priv) + if (!ct_priv) + return; + ++ destroy_workqueue(ct_priv->wq); + chains = ct_priv->chains; + + ct_priv->fs_ops->destroy(ct_priv->fs); +-- +2.35.1 + diff --git a/queue-5.18/net-mlx5e-fix-capability-check-for-updating-vnic-env.patch b/queue-5.18/net-mlx5e-fix-capability-check-for-updating-vnic-env.patch new file mode 100644 index 00000000000..d1be646c531 --- /dev/null +++ b/queue-5.18/net-mlx5e-fix-capability-check-for-updating-vnic-env.patch @@ -0,0 +1,42 @@ +From 485ecd0ac33787e62539eeb25bd3d5fa0c691045 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Jun 2022 15:05:53 +0300 +Subject: net/mlx5e: Fix capability check for updating vnic env counters + +From: Gal Pressman + +[ Upstream commit 452133dd580811f184e76b1402983182ee425298 ] + +The existing capability check for vnic env counters only checks for +receive steering discards, although we need the counters update for the +exposed internal queue oob counter as well. This could result in the +latter counter not being updated correctly when the receive steering +discards counter is not supported. +Fix that by checking whether any counter is supported instead of only +the steering counter capability. + +Fixes: 0cfafd4b4ddf ("net/mlx5e: Add device out of buffer counter") +Signed-off-by: Gal Pressman +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c +index bdc870f9c2f3..4429c848d4c4 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c +@@ -688,7 +688,7 @@ static MLX5E_DECLARE_STATS_GRP_OP_UPDATE_STATS(vnic_env) + u32 in[MLX5_ST_SZ_DW(query_vnic_env_in)] = {}; + struct mlx5_core_dev *mdev = priv->mdev; + +- if (!MLX5_CAP_GEN(priv->mdev, nic_receive_steering_discard)) ++ if (!mlx5e_stats_grp_vnic_env_num_stats(priv)) + return; + + MLX5_SET(query_vnic_env_in, in, opcode, MLX5_CMD_OP_QUERY_VNIC_ENV); +-- +2.35.1 + diff --git a/queue-5.18/net-mlx5e-fix-enabling-sriov-while-tc-nic-rules-are-.patch b/queue-5.18/net-mlx5e-fix-enabling-sriov-while-tc-nic-rules-are-.patch new file mode 100644 index 00000000000..c04882c5c01 --- /dev/null +++ b/queue-5.18/net-mlx5e-fix-enabling-sriov-while-tc-nic-rules-are-.patch @@ -0,0 +1,60 @@ +From 7ac5f4f0cd44fc510ec0517d0845b5b22f215f87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jun 2022 13:11:18 +0300 +Subject: net/mlx5e: Fix enabling sriov while tc nic rules are offloaded + +From: Paul Blakey + +[ Upstream commit 0c9d876545a56aebed30fa306d0460a4d28d271a ] + +There is a total of four 4M entries flow tables. In sriov disabled +mode, ct, ct_nat and post_act take three of them. When adding the +first tc nic rule in this mode, it will take another 4M table +for the tc table. If user then enables sriov, the legacy +flow table tries to take another 4M and fails, and so enablement fails. + +To fix that, have legacy fdb take the next available maximum +size from the fs ft pool. + +Fixes: 4a98544d1827 ("net/mlx5: Move chains ft pool to be used by all firmware steering") +Signed-off-by: Paul Blakey +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c +index 9d17206d1625..fabe49a35a5c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c +@@ -11,6 +11,7 @@ + #include "mlx5_core.h" + #include "eswitch.h" + #include "fs_core.h" ++#include "fs_ft_pool.h" + #include "esw/qos.h" + + enum { +@@ -95,8 +96,7 @@ static int esw_create_legacy_fdb_table(struct mlx5_eswitch *esw) + if (!flow_group_in) + return -ENOMEM; + +- table_size = BIT(MLX5_CAP_ESW_FLOWTABLE_FDB(dev, log_max_ft_size)); +- ft_attr.max_fte = table_size; ++ ft_attr.max_fte = POOL_NEXT_SIZE; + ft_attr.prio = LEGACY_FDB_PRIO; + fdb = mlx5_create_flow_table(root_ns, &ft_attr); + if (IS_ERR(fdb)) { +@@ -105,6 +105,7 @@ static int esw_create_legacy_fdb_table(struct mlx5_eswitch *esw) + goto out; + } + esw->fdb_table.legacy.fdb = fdb; ++ table_size = fdb->max_fte; + + /* Addresses group : Full match unicast/multicast addresses */ + MLX5_SET(create_flow_group_in, flow_group_in, match_criteria_enable, +-- +2.35.1 + diff --git a/queue-5.18/net-mlx5e-ktls-fix-build-time-constant-test-in-rx.patch b/queue-5.18/net-mlx5e-ktls-fix-build-time-constant-test-in-rx.patch new file mode 100644 index 00000000000..58635ce6b62 --- /dev/null +++ b/queue-5.18/net-mlx5e-ktls-fix-build-time-constant-test-in-rx.patch @@ -0,0 +1,38 @@ +From 37033f1c8424033dbf02a73e74928a6dc8854f97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jun 2022 21:21:10 +0300 +Subject: net/mlx5e: kTLS, Fix build time constant test in RX + +From: Tariq Toukan + +[ Upstream commit 2ec6cf9b742a5c18982861322fa5de6510f8f57e ] + +Use the correct constant (TLS_DRIVER_STATE_SIZE_RX) in the comparison +against the size of the private RX TLS driver context. + +Fixes: 1182f3659357 ("net/mlx5e: kTLS, Add kTLS RX HW offload support") +Signed-off-by: Tariq Toukan +Reviewed-by: Maxim Mikityanskiy +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c +index 96064a2033f7..f3f2aeb1bc21 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c +@@ -231,8 +231,7 @@ mlx5e_set_ktls_rx_priv_ctx(struct tls_context *tls_ctx, + struct mlx5e_ktls_offload_context_rx **ctx = + __tls_driver_ctx(tls_ctx, TLS_OFFLOAD_CTX_DIR_RX); + +- BUILD_BUG_ON(sizeof(struct mlx5e_ktls_offload_context_rx *) > +- TLS_OFFLOAD_CONTEXT_SIZE_RX); ++ BUILD_BUG_ON(sizeof(priv_rx) > TLS_DRIVER_STATE_SIZE_RX); + + *ctx = priv_rx; + } +-- +2.35.1 + diff --git a/queue-5.18/net-mlx5e-ktls-fix-build-time-constant-test-in-tx.patch b/queue-5.18/net-mlx5e-ktls-fix-build-time-constant-test-in-tx.patch new file mode 100644 index 00000000000..40a0e0d853c --- /dev/null +++ b/queue-5.18/net-mlx5e-ktls-fix-build-time-constant-test-in-tx.patch @@ -0,0 +1,38 @@ +From 5a70a52ef9d731fb0efeaf04f1656fdcc59d1d8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jun 2022 21:20:29 +0300 +Subject: net/mlx5e: kTLS, Fix build time constant test in TX + +From: Tariq Toukan + +[ Upstream commit 6cc2714e85754a621219693ea8aa3077d6fca0cb ] + +Use the correct constant (TLS_DRIVER_STATE_SIZE_TX) in the comparison +against the size of the private TX TLS driver context. + +Fixes: df8d866770f9 ("net/mlx5e: kTLS, Use kernel API to extract private offload context") +Signed-off-by: Tariq Toukan +Reviewed-by: Maxim Mikityanskiy +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c +index aaf11c66bf4c..6f12764d8880 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c +@@ -68,8 +68,7 @@ mlx5e_set_ktls_tx_priv_ctx(struct tls_context *tls_ctx, + struct mlx5e_ktls_offload_context_tx **ctx = + __tls_driver_ctx(tls_ctx, TLS_OFFLOAD_CTX_DIR_TX); + +- BUILD_BUG_ON(sizeof(struct mlx5e_ktls_offload_context_tx *) > +- TLS_OFFLOAD_CONTEXT_SIZE_TX); ++ BUILD_BUG_ON(sizeof(priv_tx) > TLS_DRIVER_STATE_SIZE_TX); + + *ctx = priv_tx; + } +-- +2.35.1 + diff --git a/queue-5.18/net-mlx5e-ring-the-tx-doorbell-on-dma-errors.patch b/queue-5.18/net-mlx5e-ring-the-tx-doorbell-on-dma-errors.patch new file mode 100644 index 00000000000..4f134c7db77 --- /dev/null +++ b/queue-5.18/net-mlx5e-ring-the-tx-doorbell-on-dma-errors.patch @@ -0,0 +1,123 @@ +From b4a2ee217b6c725522ff6be59809a943941014f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 May 2022 14:01:37 +0300 +Subject: net/mlx5e: Ring the TX doorbell on DMA errors + +From: Maxim Mikityanskiy + +[ Upstream commit 5b759bf2f9d73db05369aef2344502095c4e5e73 ] + +TX doorbells may be postponed, because sometimes the driver knows that +another packet follows (for example, when xmit_more is true, or when a +MPWQE session is closed before transmitting a packet). + +However, the DMA mapping may fail for the next packet, in which case a +new WQE is not posted, the doorbell isn't updated either, and the +transmission of the previous packet will be delayed indefinitely. + +This commit fixes the described rare error flow by posting a NOP and +ringing the doorbell on errors to flush all the previous packets. The +MPWQE session is closed before that. DMA mapping in the MPWQE flow is +moved to the beginning of mlx5e_sq_xmit_mpwqe, because empty sessions +are not allowed. Stop room always has enough space for a NOP, because +the actual TX WQE is not posted. + +Fixes: e586b3b0baee ("net/mlx5: Ethernet Datapath files") +Signed-off-by: Maxim Mikityanskiy +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/en_tx.c | 39 ++++++++++++++----- + 1 file changed, 30 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +index 2dc48406cd08..54a3f866a345 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +@@ -318,6 +318,26 @@ static void mlx5e_tx_check_stop(struct mlx5e_txqsq *sq) + } + } + ++static void mlx5e_tx_flush(struct mlx5e_txqsq *sq) ++{ ++ struct mlx5e_tx_wqe_info *wi; ++ struct mlx5e_tx_wqe *wqe; ++ u16 pi; ++ ++ /* Must not be called when a MPWQE session is active but empty. */ ++ mlx5e_tx_mpwqe_ensure_complete(sq); ++ ++ pi = mlx5_wq_cyc_ctr2ix(&sq->wq, sq->pc); ++ wi = &sq->db.wqe_info[pi]; ++ ++ *wi = (struct mlx5e_tx_wqe_info) { ++ .num_wqebbs = 1, ++ }; ++ ++ wqe = mlx5e_post_nop(&sq->wq, sq->sqn, &sq->pc); ++ mlx5e_notify_hw(&sq->wq, sq->pc, sq->uar_map, &wqe->ctrl); ++} ++ + static inline void + mlx5e_txwqe_complete(struct mlx5e_txqsq *sq, struct sk_buff *skb, + const struct mlx5e_tx_attr *attr, +@@ -410,6 +430,7 @@ mlx5e_sq_xmit_wqe(struct mlx5e_txqsq *sq, struct sk_buff *skb, + err_drop: + stats->dropped++; + dev_kfree_skb_any(skb); ++ mlx5e_tx_flush(sq); + } + + static bool mlx5e_tx_skb_supports_mpwqe(struct sk_buff *skb, struct mlx5e_tx_attr *attr) +@@ -511,6 +532,13 @@ mlx5e_sq_xmit_mpwqe(struct mlx5e_txqsq *sq, struct sk_buff *skb, + struct mlx5_wqe_ctrl_seg *cseg; + struct mlx5e_xmit_data txd; + ++ txd.data = skb->data; ++ txd.len = skb->len; ++ ++ txd.dma_addr = dma_map_single(sq->pdev, txd.data, txd.len, DMA_TO_DEVICE); ++ if (unlikely(dma_mapping_error(sq->pdev, txd.dma_addr))) ++ goto err_unmap; ++ + if (!mlx5e_tx_mpwqe_session_is_active(sq)) { + mlx5e_tx_mpwqe_session_start(sq, eseg); + } else if (!mlx5e_tx_mpwqe_same_eseg(sq, eseg)) { +@@ -520,18 +548,9 @@ mlx5e_sq_xmit_mpwqe(struct mlx5e_txqsq *sq, struct sk_buff *skb, + + sq->stats->xmit_more += xmit_more; + +- txd.data = skb->data; +- txd.len = skb->len; +- +- txd.dma_addr = dma_map_single(sq->pdev, txd.data, txd.len, DMA_TO_DEVICE); +- if (unlikely(dma_mapping_error(sq->pdev, txd.dma_addr))) +- goto err_unmap; + mlx5e_dma_push(sq, txd.dma_addr, txd.len, MLX5E_DMA_MAP_SINGLE); +- + mlx5e_skb_fifo_push(&sq->db.skb_fifo, skb); +- + mlx5e_tx_mpwqe_add_dseg(sq, &txd); +- + mlx5e_tx_skb_update_hwts_flags(skb); + + if (unlikely(mlx5e_tx_mpwqe_is_full(&sq->mpwqe, sq->max_sq_mpw_wqebbs))) { +@@ -553,6 +572,7 @@ mlx5e_sq_xmit_mpwqe(struct mlx5e_txqsq *sq, struct sk_buff *skb, + mlx5e_dma_unmap_wqe_err(sq, 1); + sq->stats->dropped++; + dev_kfree_skb_any(skb); ++ mlx5e_tx_flush(sq); + } + + void mlx5e_tx_mpwqe_ensure_complete(struct mlx5e_txqsq *sq) +@@ -935,5 +955,6 @@ void mlx5i_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb, + err_drop: + stats->dropped++; + dev_kfree_skb_any(skb); ++ mlx5e_tx_flush(sq); + } + #endif +-- +2.35.1 + diff --git a/queue-5.18/net-ocelot-fix-wrong-time_after-usage.patch b/queue-5.18/net-ocelot-fix-wrong-time_after-usage.patch new file mode 100644 index 00000000000..07421852f70 --- /dev/null +++ b/queue-5.18/net-ocelot-fix-wrong-time_after-usage.patch @@ -0,0 +1,69 @@ +From e2088345538f91f3113c6428cef37022942633b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:28:45 +0300 +Subject: net: ocelot: fix wrong time_after usage + +From: Pavel Skripkin + +[ Upstream commit f46fd3d7c3bd5d7bd5bb664135cf32ca9e97190b ] + +Accidentally noticed, that this driver is the only user of +while (time_after(jiffies...)). + +It looks like typo, because likely this while loop will finish after 1st +iteration, because time_after() returns true when 1st argument _is after_ +2nd one. + +There is one possible problem with this poll loop: the scheduler could put +the thread to sleep, and it does not get woken up for +OCELOT_FDMA_CH_SAFE_TIMEOUT_US. During that time, the hardware has done +its thing, but you exit the while loop and return -ETIMEDOUT. + +Fix it by using sane poll API that avoids all problems described above + +Fixes: 753a026cfec1 ("net: ocelot: add FDMA support") +Suggested-by: Andrew Lunn +Signed-off-by: Pavel Skripkin +Reviewed-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20220706132845.27968-1-paskripkin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mscc/ocelot_fdma.c | 17 ++++++++--------- + 1 file changed, 8 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/mscc/ocelot_fdma.c b/drivers/net/ethernet/mscc/ocelot_fdma.c +index dffa597bffe6..6a8f84f325a3 100644 +--- a/drivers/net/ethernet/mscc/ocelot_fdma.c ++++ b/drivers/net/ethernet/mscc/ocelot_fdma.c +@@ -94,19 +94,18 @@ static void ocelot_fdma_activate_chan(struct ocelot *ocelot, dma_addr_t dma, + ocelot_fdma_writel(ocelot, MSCC_FDMA_CH_ACTIVATE, BIT(chan)); + } + ++static u32 ocelot_fdma_read_ch_safe(struct ocelot *ocelot) ++{ ++ return ocelot_fdma_readl(ocelot, MSCC_FDMA_CH_SAFE); ++} ++ + static int ocelot_fdma_wait_chan_safe(struct ocelot *ocelot, int chan) + { +- unsigned long timeout; + u32 safe; + +- timeout = jiffies + usecs_to_jiffies(OCELOT_FDMA_CH_SAFE_TIMEOUT_US); +- do { +- safe = ocelot_fdma_readl(ocelot, MSCC_FDMA_CH_SAFE); +- if (safe & BIT(chan)) +- return 0; +- } while (time_after(jiffies, timeout)); +- +- return -ETIMEDOUT; ++ return readx_poll_timeout_atomic(ocelot_fdma_read_ch_safe, ocelot, safe, ++ safe & BIT(chan), 0, ++ OCELOT_FDMA_CH_SAFE_TIMEOUT_US); + } + + static void ocelot_fdma_dcb_set_data(struct ocelot_fdma_dcb *dcb, +-- +2.35.1 + diff --git a/queue-5.18/net-stmmac-dwc-qos-disable-split-header-for-tegra194.patch b/queue-5.18/net-stmmac-dwc-qos-disable-split-header-for-tegra194.patch new file mode 100644 index 00000000000..fe05cf7c46f --- /dev/null +++ b/queue-5.18/net-stmmac-dwc-qos-disable-split-header-for-tegra194.patch @@ -0,0 +1,47 @@ +From 2005c90207772e86467df2683b35ebafa2e23250 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 09:39:13 +0100 +Subject: net: stmmac: dwc-qos: Disable split header for Tegra194 + +From: Jon Hunter + +[ Upstream commit 029c1c2059e9c4b38f97a06204cdecd10cfbeb8a ] + +There is a long-standing issue with the Synopsys DWC Ethernet driver +for Tegra194 where random system crashes have been observed [0]. The +problem occurs when the split header feature is enabled in the stmmac +driver. In the bad case, a larger than expected buffer length is +received and causes the calculation of the total buffer length to +overflow. This results in a very large buffer length that causes the +kernel to crash. Why this larger buffer length is received is not clear, +however, the feedback from the NVIDIA design team is that the split +header feature is not supported for Tegra194. Therefore, disable split +header support for Tegra194 to prevent these random crashes from +occurring. + +[0] https://lore.kernel.org/linux-tegra/b0b17697-f23e-8fa5-3757-604a86f3a095@nvidia.com/ + +Fixes: 67afd6d1cfdf ("net: stmmac: Add Split Header support and enable it in XGMAC cores") +Signed-off-by: Jon Hunter +Link: https://lore.kernel.org/r/20220706083913.13750-1-jonathanh@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c +index bc91fd867dcd..358fc26f8d1f 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c +@@ -361,6 +361,7 @@ static int tegra_eqos_probe(struct platform_device *pdev, + data->fix_mac_speed = tegra_eqos_fix_speed; + data->init = tegra_eqos_init; + data->bsp_priv = eqos; ++ data->sph_disable = 1; + + err = tegra_eqos_init(pdev, eqos); + if (err < 0) +-- +2.35.1 + diff --git a/queue-5.18/net-stmmac-fix-leaks-in-probe.patch b/queue-5.18/net-stmmac-fix-leaks-in-probe.patch new file mode 100644 index 00000000000..877e5c8040d --- /dev/null +++ b/queue-5.18/net-stmmac-fix-leaks-in-probe.patch @@ -0,0 +1,46 @@ +From 844ae193905d277e77cb6a454f3e60248b5b423d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 17:42:25 +0300 +Subject: net: stmmac: fix leaks in probe + +From: Dan Carpenter + +[ Upstream commit 23aa6d5088e3bd65de77c5c307237b9937f8b48a ] + +These two error paths should clean up before returning. + +Fixes: 2bb4b98b60d7 ("net: stmmac: Add Ingenic SoCs MAC support.") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c +index 9a6d819b84ae..378b4dd826bb 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c +@@ -273,7 +273,8 @@ static int ingenic_mac_probe(struct platform_device *pdev) + mac->tx_delay = tx_delay_ps * 1000; + } else { + dev_err(&pdev->dev, "Invalid TX clock delay: %dps\n", tx_delay_ps); +- return -EINVAL; ++ ret = -EINVAL; ++ goto err_remove_config_dt; + } + } + +@@ -283,7 +284,8 @@ static int ingenic_mac_probe(struct platform_device *pdev) + mac->rx_delay = rx_delay_ps * 1000; + } else { + dev_err(&pdev->dev, "Invalid RX clock delay: %dps\n", rx_delay_ps); +- return -EINVAL; ++ ret = -EINVAL; ++ goto err_remove_config_dt; + } + } + +-- +2.35.1 + diff --git a/queue-5.18/net-tls-check-for-errors-in-tls_device_init.patch b/queue-5.18/net-tls-check-for-errors-in-tls_device_init.patch new file mode 100644 index 00000000000..3aae90bf42d --- /dev/null +++ b/queue-5.18/net-tls-check-for-errors-in-tls_device_init.patch @@ -0,0 +1,83 @@ +From 105fed9e239f505ce9ab9fd3c3b52987b491ed82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 10:07:54 +0300 +Subject: net/tls: Check for errors in tls_device_init + +From: Tariq Toukan + +[ Upstream commit 3d8c51b25a235e283e37750943bbf356ef187230 ] + +Add missing error checks in tls_device_init. + +Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure") +Reported-by: Jakub Kicinski +Reviewed-by: Maxim Mikityanskiy +Signed-off-by: Tariq Toukan +Link: https://lore.kernel.org/r/20220714070754.1428-1-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/tls.h | 4 ++-- + net/tls/tls_device.c | 4 ++-- + net/tls/tls_main.c | 7 ++++++- + 3 files changed, 10 insertions(+), 5 deletions(-) + +diff --git a/include/net/tls.h b/include/net/tls.h +index b6968a5b5538..e8764d3da41a 100644 +--- a/include/net/tls.h ++++ b/include/net/tls.h +@@ -708,7 +708,7 @@ int tls_sw_fallback_init(struct sock *sk, + struct tls_crypto_info *crypto_info); + + #ifdef CONFIG_TLS_DEVICE +-void tls_device_init(void); ++int tls_device_init(void); + void tls_device_cleanup(void); + void tls_device_sk_destruct(struct sock *sk); + int tls_set_device_offload(struct sock *sk, struct tls_context *ctx); +@@ -728,7 +728,7 @@ static inline bool tls_is_sk_rx_device_offloaded(struct sock *sk) + return tls_get_ctx(sk)->rx_conf == TLS_HW; + } + #else +-static inline void tls_device_init(void) {} ++static inline int tls_device_init(void) { return 0; } + static inline void tls_device_cleanup(void) {} + + static inline int +diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c +index 3919fe2c58c5..3a61bb594544 100644 +--- a/net/tls/tls_device.c ++++ b/net/tls/tls_device.c +@@ -1394,9 +1394,9 @@ static struct notifier_block tls_dev_notifier = { + .notifier_call = tls_dev_event, + }; + +-void __init tls_device_init(void) ++int __init tls_device_init(void) + { +- register_netdevice_notifier(&tls_dev_notifier); ++ return register_netdevice_notifier(&tls_dev_notifier); + } + + void __exit tls_device_cleanup(void) +diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c +index 5c9697840ef7..13058b0ee4cd 100644 +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -993,7 +993,12 @@ static int __init tls_register(void) + if (err) + return err; + +- tls_device_init(); ++ err = tls_device_init(); ++ if (err) { ++ unregister_pernet_subsys(&tls_proc_ops); ++ return err; ++ } ++ + tcp_register_ulp(&tcp_tls_ulp_ops); + + return 0; +-- +2.35.1 + diff --git a/queue-5.18/netfilter-conntrack-fix-crash-due-to-confirmed-bit-l.patch b/queue-5.18/netfilter-conntrack-fix-crash-due-to-confirmed-bit-l.patch new file mode 100644 index 00000000000..0247e20acd1 --- /dev/null +++ b/queue-5.18/netfilter-conntrack-fix-crash-due-to-confirmed-bit-l.patch @@ -0,0 +1,190 @@ +From 5a24db7224caa08286e5971ebb35ec019e00c06a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:50:04 +0200 +Subject: netfilter: conntrack: fix crash due to confirmed bit load reordering + +From: Florian Westphal + +[ Upstream commit 0ed8f619b412b52360ccdfaf997223ccd9319569 ] + +Kajetan Puchalski reports crash on ARM, with backtrace of: + +__nf_ct_delete_from_lists +nf_ct_delete +early_drop +__nf_conntrack_alloc + +Unlike atomic_inc_not_zero, refcount_inc_not_zero is not a full barrier. +conntrack uses SLAB_TYPESAFE_BY_RCU, i.e. it is possible that a 'newly' +allocated object is still in use on another CPU: + +CPU1 CPU2 + encounter 'ct' during hlist walk + delete_from_lists + refcount drops to 0 + kmem_cache_free(ct); + __nf_conntrack_alloc() // returns same object + refcount_inc_not_zero(ct); /* might fail */ + + /* If set, ct is public/in the hash table */ + test_bit(IPS_CONFIRMED_BIT, &ct->status); + +In case CPU1 already set refcount back to 1, refcount_inc_not_zero() +will succeed. + +The expected possibilities for a CPU that obtained the object 'ct' +(but no reference so far) are: + +1. refcount_inc_not_zero() fails. CPU2 ignores the object and moves to + the next entry in the list. This happens for objects that are about + to be free'd, that have been free'd, or that have been reallocated + by __nf_conntrack_alloc(), but where the refcount has not been + increased back to 1 yet. + +2. refcount_inc_not_zero() succeeds. CPU2 checks the CONFIRMED bit + in ct->status. If set, the object is public/in the table. + + If not, the object must be skipped; CPU2 calls nf_ct_put() to + un-do the refcount increment and moves to the next object. + +Parallel deletion from the hlists is prevented by a +'test_and_set_bit(IPS_DYING_BIT, &ct->status);' check, i.e. only one +cpu will do the unlink, the other one will only drop its reference count. + +Because refcount_inc_not_zero is not a full barrier, CPU2 may try to +delete an object that is not on any list: + +1. refcount_inc_not_zero() successful (refcount inited to 1 on other CPU) +2. CONFIRMED test also successful (load was reordered or zeroing + of ct->status not yet visible) +3. delete_from_lists unlinks entry not on the hlist, because + IPS_DYING_BIT is 0 (already cleared). + +2) is already wrong: CPU2 will handle a partially initited object +that is supposed to be private to CPU1. + +Add needed barriers when refcount_inc_not_zero() is successful. + +It also inserts a smp_wmb() before the refcount is set to 1 during +allocation. + +Because other CPU might still see the object, refcount_set(1) +"resurrects" it, so we need to make sure that other CPUs will also observe +the right content. In particular, the CONFIRMED bit test must only pass +once the object is fully initialised and either in the hash or about to be +inserted (with locks held to delay possible unlink from early_drop or +gc worker). + +I did not change flow_offload_alloc(), as far as I can see it should call +refcount_inc(), not refcount_inc_not_zero(): the ct object is attached to +the skb so its refcount should be >= 1 in all cases. + +v2: prefer smp_acquire__after_ctrl_dep to smp_rmb (Will Deacon). +v3: keep smp_acquire__after_ctrl_dep close to refcount_inc_not_zero call + add comment in nf_conntrack_netlink, no control dependency there + due to locks. + +Cc: Peter Zijlstra +Link: https://lore.kernel.org/all/Yr7WTfd6AVTQkLjI@e126311.manchester.arm.com/ +Reported-by: Kajetan Puchalski +Diagnosed-by: Will Deacon +Fixes: 719774377622 ("netfilter: conntrack: convert to refcount_t api") +Signed-off-by: Florian Westphal +Acked-by: Will Deacon +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_core.c | 22 ++++++++++++++++++++++ + net/netfilter/nf_conntrack_netlink.c | 1 + + net/netfilter/nf_conntrack_standalone.c | 3 +++ + 3 files changed, 26 insertions(+) + +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index 9010b6e5a072..5a85735512ce 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -764,6 +764,9 @@ static void nf_ct_gc_expired(struct nf_conn *ct) + if (!refcount_inc_not_zero(&ct->ct_general.use)) + return; + ++ /* load ->status after refcount increase */ ++ smp_acquire__after_ctrl_dep(); ++ + if (nf_ct_should_gc(ct)) + nf_ct_kill(ct); + +@@ -830,6 +833,9 @@ __nf_conntrack_find_get(struct net *net, const struct nf_conntrack_zone *zone, + */ + ct = nf_ct_tuplehash_to_ctrack(h); + if (likely(refcount_inc_not_zero(&ct->ct_general.use))) { ++ /* re-check key after refcount */ ++ smp_acquire__after_ctrl_dep(); ++ + if (likely(nf_ct_key_equal(h, tuple, zone, net))) + goto found; + +@@ -1369,6 +1375,9 @@ static unsigned int early_drop_list(struct net *net, + if (!refcount_inc_not_zero(&tmp->ct_general.use)) + continue; + ++ /* load ->ct_net and ->status after refcount increase */ ++ smp_acquire__after_ctrl_dep(); ++ + /* kill only if still in same netns -- might have moved due to + * SLAB_TYPESAFE_BY_RCU rules. + * +@@ -1518,6 +1527,9 @@ static void gc_worker(struct work_struct *work) + if (!refcount_inc_not_zero(&tmp->ct_general.use)) + continue; + ++ /* load ->status after refcount increase */ ++ smp_acquire__after_ctrl_dep(); ++ + if (gc_worker_skip_ct(tmp)) { + nf_ct_put(tmp); + continue; +@@ -1749,6 +1761,16 @@ init_conntrack(struct net *net, struct nf_conn *tmpl, + if (!exp) + __nf_ct_try_assign_helper(ct, tmpl, GFP_ATOMIC); + ++ /* Other CPU might have obtained a pointer to this object before it was ++ * released. Because refcount is 0, refcount_inc_not_zero() will fail. ++ * ++ * After refcount_set(1) it will succeed; ensure that zeroing of ++ * ct->status and the correct ct->net pointer are visible; else other ++ * core might observe CONFIRMED bit which means the entry is valid and ++ * in the hash table, but its not (anymore). ++ */ ++ smp_wmb(); ++ + /* Now it is inserted into the unconfirmed list, set refcount to 1. */ + refcount_set(&ct->ct_general.use, 1); + nf_ct_add_to_unconfirmed_list(ct); +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 2e9c8183e4a2..431e005ff14d 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -1203,6 +1203,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) + hnnode) { + ct = nf_ct_tuplehash_to_ctrack(h); + if (nf_ct_is_expired(ct)) { ++ /* need to defer nf_ct_kill() until lock is released */ + if (i < ARRAY_SIZE(nf_ct_evict) && + refcount_inc_not_zero(&ct->ct_general.use)) + nf_ct_evict[i++] = ct; +diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c +index 55aa55b252b2..48812dda273b 100644 +--- a/net/netfilter/nf_conntrack_standalone.c ++++ b/net/netfilter/nf_conntrack_standalone.c +@@ -306,6 +306,9 @@ static int ct_seq_show(struct seq_file *s, void *v) + if (unlikely(!refcount_inc_not_zero(&ct->ct_general.use))) + return 0; + ++ /* load ->status after refcount increase */ ++ smp_acquire__after_ctrl_dep(); ++ + if (nf_ct_should_gc(ct)) { + nf_ct_kill(ct); + goto release; +-- +2.35.1 + diff --git a/queue-5.18/netfilter-conntrack-include-ecache-dying-list-in-dum.patch b/queue-5.18/netfilter-conntrack-include-ecache-dying-list-in-dum.patch new file mode 100644 index 00000000000..1b185f5e651 --- /dev/null +++ b/queue-5.18/netfilter-conntrack-include-ecache-dying-list-in-dum.patch @@ -0,0 +1,121 @@ +From 575491b2317d85f312001168a7a2633f343bd50a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 13:01:17 +0200 +Subject: netfilter: conntrack: include ecache dying list in dumps + +From: Florian Westphal + +[ Upstream commit 0d3cc504ba9cdcff76346306c37eb1ea01e60a86 ] + +The new pernet dying list includes conntrack entries that await +delivery of the 'destroy' event via ctnetlink. + +The old percpu dying list will be removed soon. + +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_conntrack_ecache.h | 2 + + net/netfilter/nf_conntrack_ecache.c | 10 +++++ + net/netfilter/nf_conntrack_netlink.c | 43 +++++++++++++++++++++ + 3 files changed, 55 insertions(+) + +diff --git a/include/net/netfilter/nf_conntrack_ecache.h b/include/net/netfilter/nf_conntrack_ecache.h +index a6135b5030dd..b57d73785e4d 100644 +--- a/include/net/netfilter/nf_conntrack_ecache.h ++++ b/include/net/netfilter/nf_conntrack_ecache.h +@@ -164,6 +164,8 @@ void nf_conntrack_ecache_work(struct net *net, enum nf_ct_ecache_state state); + void nf_conntrack_ecache_pernet_init(struct net *net); + void nf_conntrack_ecache_pernet_fini(struct net *net); + ++struct nf_conntrack_net_ecache *nf_conn_pernet_ecache(const struct net *net); ++ + static inline bool nf_conntrack_ecache_dwork_pending(const struct net *net) + { + return net->ct.ecache_dwork_pending; +diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c +index 2752859479b2..334b2b4e5e8b 100644 +--- a/net/netfilter/nf_conntrack_ecache.c ++++ b/net/netfilter/nf_conntrack_ecache.c +@@ -38,6 +38,16 @@ enum retry_state { + STATE_DONE, + }; + ++struct nf_conntrack_net_ecache *nf_conn_pernet_ecache(const struct net *net) ++{ ++ struct nf_conntrack_net *cnet = nf_ct_pernet(net); ++ ++ return &cnet->ecache; ++} ++#if IS_MODULE(CONFIG_NF_CT_NETLINK) ++EXPORT_SYMBOL_GPL(nf_conn_pernet_ecache); ++#endif ++ + static enum retry_state ecache_work_evict_list(struct nf_conntrack_net *cnet) + { + unsigned long stop = jiffies + ECACHE_MAX_JIFFIES; +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 924d766e6c53..a4ec2aad2187 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -62,6 +62,7 @@ struct ctnetlink_list_dump_ctx { + struct nf_conn *last; + unsigned int cpu; + bool done; ++ bool retrans_done; + }; + + static int ctnetlink_dump_tuples_proto(struct sk_buff *skb, +@@ -1802,6 +1803,48 @@ ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying + static int + ctnetlink_dump_dying(struct sk_buff *skb, struct netlink_callback *cb) + { ++ struct ctnetlink_list_dump_ctx *ctx = (void *)cb->ctx; ++ struct nf_conn *last = ctx->last; ++#ifdef CONFIG_NF_CONNTRACK_EVENTS ++ const struct net *net = sock_net(skb->sk); ++ struct nf_conntrack_net_ecache *ecache_net; ++ struct nf_conntrack_tuple_hash *h; ++ struct hlist_nulls_node *n; ++#endif ++ ++ if (ctx->retrans_done) ++ return ctnetlink_dump_list(skb, cb, true); ++ ++ ctx->last = NULL; ++ ++#ifdef CONFIG_NF_CONNTRACK_EVENTS ++ ecache_net = nf_conn_pernet_ecache(net); ++ spin_lock_bh(&ecache_net->dying_lock); ++ ++ hlist_nulls_for_each_entry(h, n, &ecache_net->dying_list, hnnode) { ++ struct nf_conn *ct; ++ int res; ++ ++ ct = nf_ct_tuplehash_to_ctrack(h); ++ if (last && last != ct) ++ continue; ++ ++ res = ctnetlink_dump_one_entry(skb, cb, ct, true); ++ if (res < 0) { ++ spin_unlock_bh(&ecache_net->dying_lock); ++ nf_ct_put(last); ++ return skb->len; ++ } ++ ++ nf_ct_put(last); ++ last = NULL; ++ } ++ ++ spin_unlock_bh(&ecache_net->dying_lock); ++#endif ++ nf_ct_put(last); ++ ctx->retrans_done = true; ++ + return ctnetlink_dump_list(skb, cb, true); + } + +-- +2.35.1 + diff --git a/queue-5.18/netfilter-conntrack-remove-the-percpu-dying-list.patch b/queue-5.18/netfilter-conntrack-remove-the-percpu-dying-list.patch new file mode 100644 index 00000000000..21866292d49 --- /dev/null +++ b/queue-5.18/netfilter-conntrack-remove-the-percpu-dying-list.patch @@ -0,0 +1,264 @@ +From 728932e646dd25f0a57dcbf6610bd9bdcea2f525 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 13:01:18 +0200 +Subject: netfilter: conntrack: remove the percpu dying list + +From: Florian Westphal + +[ Upstream commit 1397af5bfd7d32b0cf2adb70a78c9a9e8f11d912 ] + +Its no longer needed. Entries that need event redelivery are placed +on the new pernet dying list. + +The advantage is that there is no need to take additional spinlock on +conntrack removal unless event redelivery failed or the conntrack entry +was never added to the table in the first place (confirmed bit not set). + +The IPS_CONFIRMED bit now needs to be set as soon as the entry has been +unlinked from the unconfirmed list, else the destroy function may +attempt to unlink it a second time. + +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netns/conntrack.h | 1 - + net/netfilter/nf_conntrack_core.c | 35 +++++----------------------- + net/netfilter/nf_conntrack_ecache.c | 1 - + net/netfilter/nf_conntrack_netlink.c | 23 ++++++------------ + 4 files changed, 13 insertions(+), 47 deletions(-) + +diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h +index 0294f3d473af..e985a3010b89 100644 +--- a/include/net/netns/conntrack.h ++++ b/include/net/netns/conntrack.h +@@ -96,7 +96,6 @@ struct nf_ip_net { + struct ct_pcpu { + spinlock_t lock; + struct hlist_nulls_head unconfirmed; +- struct hlist_nulls_head dying; + }; + + struct netns_ct { +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index ca1d1d105163..9010b6e5a072 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -525,21 +525,6 @@ clean_from_lists(struct nf_conn *ct) + nf_ct_remove_expectations(ct); + } + +-/* must be called with local_bh_disable */ +-static void nf_ct_add_to_dying_list(struct nf_conn *ct) +-{ +- struct ct_pcpu *pcpu; +- +- /* add this conntrack to the (per cpu) dying list */ +- ct->cpu = smp_processor_id(); +- pcpu = per_cpu_ptr(nf_ct_net(ct)->ct.pcpu_lists, ct->cpu); +- +- spin_lock(&pcpu->lock); +- hlist_nulls_add_head(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode, +- &pcpu->dying); +- spin_unlock(&pcpu->lock); +-} +- + /* must be called with local_bh_disable */ + static void nf_ct_add_to_unconfirmed_list(struct nf_conn *ct) + { +@@ -556,11 +541,11 @@ static void nf_ct_add_to_unconfirmed_list(struct nf_conn *ct) + } + + /* must be called with local_bh_disable */ +-static void nf_ct_del_from_dying_or_unconfirmed_list(struct nf_conn *ct) ++static void nf_ct_del_from_unconfirmed_list(struct nf_conn *ct) + { + struct ct_pcpu *pcpu; + +- /* We overload first tuple to link into unconfirmed or dying list.*/ ++ /* We overload first tuple to link into unconfirmed list.*/ + pcpu = per_cpu_ptr(nf_ct_net(ct)->ct.pcpu_lists, ct->cpu); + + spin_lock(&pcpu->lock); +@@ -648,7 +633,8 @@ void nf_ct_destroy(struct nf_conntrack *nfct) + */ + nf_ct_remove_expectations(ct); + +- nf_ct_del_from_dying_or_unconfirmed_list(ct); ++ if (unlikely(!nf_ct_is_confirmed(ct))) ++ nf_ct_del_from_unconfirmed_list(ct); + + local_bh_enable(); + +@@ -686,7 +672,6 @@ static void nf_ct_delete_from_lists(struct nf_conn *ct) + local_bh_disable(); + + __nf_ct_delete_from_lists(ct); +- nf_ct_add_to_dying_list(ct); + + local_bh_enable(); + } +@@ -700,8 +685,6 @@ static void nf_ct_add_to_ecache_list(struct nf_conn *ct) + hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode, + &cnet->ecache.dying_list); + spin_unlock(&cnet->ecache.dying_lock); +-#else +- nf_ct_add_to_dying_list(ct); + #endif + } + +@@ -995,7 +978,6 @@ static void __nf_conntrack_insert_prepare(struct nf_conn *ct) + struct nf_conn_tstamp *tstamp; + + refcount_inc(&ct->ct_general.use); +- ct->status |= IPS_CONFIRMED; + + /* set conntrack timestamp, if enabled. */ + tstamp = nf_conn_tstamp_find(ct); +@@ -1024,7 +1006,6 @@ static int __nf_ct_resolve_clash(struct sk_buff *skb, + nf_conntrack_get(&ct->ct_general); + + nf_ct_acct_merge(ct, ctinfo, loser_ct); +- nf_ct_add_to_dying_list(loser_ct); + nf_ct_put(loser_ct); + nf_ct_set(skb, ct, ctinfo); + +@@ -1157,7 +1138,6 @@ nf_ct_resolve_clash(struct sk_buff *skb, struct nf_conntrack_tuple_hash *h, + return ret; + + drop: +- nf_ct_add_to_dying_list(loser_ct); + NF_CT_STAT_INC(net, drop); + NF_CT_STAT_INC(net, insert_failed); + return NF_DROP; +@@ -1224,10 +1204,10 @@ __nf_conntrack_confirm(struct sk_buff *skb) + * user context, else we insert an already 'dead' hash, blocking + * further use of that particular connection -JM. + */ +- nf_ct_del_from_dying_or_unconfirmed_list(ct); ++ nf_ct_del_from_unconfirmed_list(ct); ++ ct->status |= IPS_CONFIRMED; + + if (unlikely(nf_ct_is_dying(ct))) { +- nf_ct_add_to_dying_list(ct); + NF_CT_STAT_INC(net, insert_failed); + goto dying; + } +@@ -1251,7 +1231,6 @@ __nf_conntrack_confirm(struct sk_buff *skb) + goto out; + if (chainlen++ > max_chainlen) { + chaintoolong: +- nf_ct_add_to_dying_list(ct); + NF_CT_STAT_INC(net, chaintoolong); + NF_CT_STAT_INC(net, insert_failed); + ret = NF_DROP; +@@ -2800,7 +2779,6 @@ void nf_conntrack_init_end(void) + * We need to use special "null" values, not used in hash table + */ + #define UNCONFIRMED_NULLS_VAL ((1<<30)+0) +-#define DYING_NULLS_VAL ((1<<30)+1) + + int nf_conntrack_init_net(struct net *net) + { +@@ -2821,7 +2799,6 @@ int nf_conntrack_init_net(struct net *net) + + spin_lock_init(&pcpu->lock); + INIT_HLIST_NULLS_HEAD(&pcpu->unconfirmed, UNCONFIRMED_NULLS_VAL); +- INIT_HLIST_NULLS_HEAD(&pcpu->dying, DYING_NULLS_VAL); + } + + net->ct.stat = alloc_percpu(struct ip_conntrack_stat); +diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c +index 334b2b4e5e8b..7472c544642f 100644 +--- a/net/netfilter/nf_conntrack_ecache.c ++++ b/net/netfilter/nf_conntrack_ecache.c +@@ -94,7 +94,6 @@ static enum retry_state ecache_work_evict_list(struct nf_conntrack_net *cnet) + hlist_nulls_for_each_entry_safe(h, n, &evicted_list, hnnode) { + struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); + +- hlist_nulls_add_fake(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode); + hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_REPLY].hnnode); + nf_ct_put(ct); + +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index a4ec2aad2187..2e9c8183e4a2 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -62,7 +62,6 @@ struct ctnetlink_list_dump_ctx { + struct nf_conn *last; + unsigned int cpu; + bool done; +- bool retrans_done; + }; + + static int ctnetlink_dump_tuples_proto(struct sk_buff *skb, +@@ -1751,13 +1750,12 @@ static int ctnetlink_dump_one_entry(struct sk_buff *skb, + } + + static int +-ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying) ++ctnetlink_dump_unconfirmed(struct sk_buff *skb, struct netlink_callback *cb) + { + struct ctnetlink_list_dump_ctx *ctx = (void *)cb->ctx; + struct nf_conn *ct, *last; + struct nf_conntrack_tuple_hash *h; + struct hlist_nulls_node *n; +- struct hlist_nulls_head *list; + struct net *net = sock_net(skb->sk); + int res, cpu; + +@@ -1774,12 +1772,11 @@ ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying + + pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu); + spin_lock_bh(&pcpu->lock); +- list = dying ? &pcpu->dying : &pcpu->unconfirmed; + restart: +- hlist_nulls_for_each_entry(h, n, list, hnnode) { ++ hlist_nulls_for_each_entry(h, n, &pcpu->unconfirmed, hnnode) { + ct = nf_ct_tuplehash_to_ctrack(h); + +- res = ctnetlink_dump_one_entry(skb, cb, ct, dying); ++ res = ctnetlink_dump_one_entry(skb, cb, ct, false); + if (res < 0) { + ctx->cpu = cpu; + spin_unlock_bh(&pcpu->lock); +@@ -1812,8 +1809,8 @@ ctnetlink_dump_dying(struct sk_buff *skb, struct netlink_callback *cb) + struct hlist_nulls_node *n; + #endif + +- if (ctx->retrans_done) +- return ctnetlink_dump_list(skb, cb, true); ++ if (ctx->done) ++ return 0; + + ctx->last = NULL; + +@@ -1842,10 +1839,10 @@ ctnetlink_dump_dying(struct sk_buff *skb, struct netlink_callback *cb) + + spin_unlock_bh(&ecache_net->dying_lock); + #endif ++ ctx->done = true; + nf_ct_put(last); +- ctx->retrans_done = true; + +- return ctnetlink_dump_list(skb, cb, true); ++ return skb->len; + } + + static int ctnetlink_get_ct_dying(struct sk_buff *skb, +@@ -1863,12 +1860,6 @@ static int ctnetlink_get_ct_dying(struct sk_buff *skb, + return -EOPNOTSUPP; + } + +-static int +-ctnetlink_dump_unconfirmed(struct sk_buff *skb, struct netlink_callback *cb) +-{ +- return ctnetlink_dump_list(skb, cb, false); +-} +- + static int ctnetlink_get_ct_unconfirmed(struct sk_buff *skb, + const struct nfnl_info *info, + const struct nlattr * const cda[]) +-- +2.35.1 + diff --git a/queue-5.18/netfilter-conntrack-split-inner-loop-of-list-dumping.patch b/queue-5.18/netfilter-conntrack-split-inner-loop-of-list-dumping.patch new file mode 100644 index 00000000000..db7e639dc14 --- /dev/null +++ b/queue-5.18/netfilter-conntrack-split-inner-loop-of-list-dumping.patch @@ -0,0 +1,121 @@ +From 41362ae2d8edcd5fcde31650129e1e25affa2d9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Mar 2022 14:22:03 +0100 +Subject: netfilter: conntrack: split inner loop of list dumping to own + function + +From: Florian Westphal + +[ Upstream commit 49001a2e83a80f6d9c4287c46ffa41a03667bbd1 ] + +This allows code re-use in the followup patch. +No functional changes intended. + +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_netlink.c | 68 ++++++++++++++++++---------- + 1 file changed, 43 insertions(+), 25 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 1ea2ad732d57..924d766e6c53 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -1708,6 +1708,47 @@ static int ctnetlink_done_list(struct netlink_callback *cb) + return 0; + } + ++static int ctnetlink_dump_one_entry(struct sk_buff *skb, ++ struct netlink_callback *cb, ++ struct nf_conn *ct, ++ bool dying) ++{ ++ struct ctnetlink_list_dump_ctx *ctx = (void *)cb->ctx; ++ struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); ++ u8 l3proto = nfmsg->nfgen_family; ++ int res; ++ ++ if (l3proto && nf_ct_l3num(ct) != l3proto) ++ return 0; ++ ++ if (ctx->last) { ++ if (ct != ctx->last) ++ return 0; ++ ++ ctx->last = NULL; ++ } ++ ++ /* We can't dump extension info for the unconfirmed ++ * list because unconfirmed conntracks can have ++ * ct->ext reallocated (and thus freed). ++ * ++ * In the dying list case ct->ext can't be free'd ++ * until after we drop pcpu->lock. ++ */ ++ res = ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).portid, ++ cb->nlh->nlmsg_seq, ++ NFNL_MSG_TYPE(cb->nlh->nlmsg_type), ++ ct, dying, 0); ++ if (res < 0) { ++ if (!refcount_inc_not_zero(&ct->ct_general.use)) ++ return 0; ++ ++ ctx->last = ct; ++ } ++ ++ return res; ++} ++ + static int + ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying) + { +@@ -1715,12 +1756,9 @@ ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying + struct nf_conn *ct, *last; + struct nf_conntrack_tuple_hash *h; + struct hlist_nulls_node *n; +- struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); +- u_int8_t l3proto = nfmsg->nfgen_family; +- int res; +- int cpu; + struct hlist_nulls_head *list; + struct net *net = sock_net(skb->sk); ++ int res, cpu; + + if (ctx->done) + return 0; +@@ -1739,30 +1777,10 @@ ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying + restart: + hlist_nulls_for_each_entry(h, n, list, hnnode) { + ct = nf_ct_tuplehash_to_ctrack(h); +- if (l3proto && nf_ct_l3num(ct) != l3proto) +- continue; +- if (ctx->last) { +- if (ct != last) +- continue; +- ctx->last = NULL; +- } + +- /* We can't dump extension info for the unconfirmed +- * list because unconfirmed conntracks can have +- * ct->ext reallocated (and thus freed). +- * +- * In the dying list case ct->ext can't be free'd +- * until after we drop pcpu->lock. +- */ +- res = ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).portid, +- cb->nlh->nlmsg_seq, +- NFNL_MSG_TYPE(cb->nlh->nlmsg_type), +- ct, dying, 0); ++ res = ctnetlink_dump_one_entry(skb, cb, ct, dying); + if (res < 0) { +- if (!refcount_inc_not_zero(&ct->ct_general.use)) +- continue; + ctx->cpu = cpu; +- ctx->last = ct; + spin_unlock_bh(&pcpu->lock); + goto out; + } +-- +2.35.1 + diff --git a/queue-5.18/netfilter-ecache-move-to-separate-structure.patch b/queue-5.18/netfilter-ecache-move-to-separate-structure.patch new file mode 100644 index 00000000000..efda7c766ae --- /dev/null +++ b/queue-5.18/netfilter-ecache-move-to-separate-structure.patch @@ -0,0 +1,108 @@ +From ed12dc360a007c7776b732f17611fc4de3bd6637 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Mar 2022 14:22:01 +0100 +Subject: netfilter: ecache: move to separate structure + +From: Florian Westphal + +[ Upstream commit 9027ce0b071a1bbd046682907fc2e23ca3592883 ] + +This makes it easier for a followup patch to only expose ecache +related parts of nf_conntrack_net structure. + +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_conntrack.h | 8 ++++++-- + net/netfilter/nf_conntrack_ecache.c | 19 ++++++++++--------- + 2 files changed, 16 insertions(+), 11 deletions(-) + +diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h +index b08b70989d2c..69e6c6a218be 100644 +--- a/include/net/netfilter/nf_conntrack.h ++++ b/include/net/netfilter/nf_conntrack.h +@@ -43,6 +43,11 @@ union nf_conntrack_expect_proto { + /* insert expect proto private data here */ + }; + ++struct nf_conntrack_net_ecache { ++ struct delayed_work dwork; ++ struct netns_ct *ct_net; ++}; ++ + struct nf_conntrack_net { + /* only used when new connection is allocated: */ + atomic_t count; +@@ -58,8 +63,7 @@ struct nf_conntrack_net { + struct ctl_table_header *sysctl_header; + #endif + #ifdef CONFIG_NF_CONNTRACK_EVENTS +- struct delayed_work ecache_dwork; +- struct netns_ct *ct_net; ++ struct nf_conntrack_net_ecache ecache; + #endif + }; + +diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c +index 07e65b4e92f8..0cb2da0a759a 100644 +--- a/net/netfilter/nf_conntrack_ecache.c ++++ b/net/netfilter/nf_conntrack_ecache.c +@@ -96,8 +96,8 @@ static enum retry_state ecache_work_evict_list(struct ct_pcpu *pcpu) + + static void ecache_work(struct work_struct *work) + { +- struct nf_conntrack_net *cnet = container_of(work, struct nf_conntrack_net, ecache_dwork.work); +- struct netns_ct *ctnet = cnet->ct_net; ++ struct nf_conntrack_net *cnet = container_of(work, struct nf_conntrack_net, ecache.dwork.work); ++ struct netns_ct *ctnet = cnet->ecache.ct_net; + int cpu, delay = -1; + struct ct_pcpu *pcpu; + +@@ -127,7 +127,7 @@ static void ecache_work(struct work_struct *work) + + ctnet->ecache_dwork_pending = delay > 0; + if (delay >= 0) +- schedule_delayed_work(&cnet->ecache_dwork, delay); ++ schedule_delayed_work(&cnet->ecache.dwork, delay); + } + + static int __nf_conntrack_eventmask_report(struct nf_conntrack_ecache *e, +@@ -293,12 +293,12 @@ void nf_conntrack_ecache_work(struct net *net, enum nf_ct_ecache_state state) + struct nf_conntrack_net *cnet = nf_ct_pernet(net); + + if (state == NFCT_ECACHE_DESTROY_FAIL && +- !delayed_work_pending(&cnet->ecache_dwork)) { +- schedule_delayed_work(&cnet->ecache_dwork, HZ); ++ !delayed_work_pending(&cnet->ecache.dwork)) { ++ schedule_delayed_work(&cnet->ecache.dwork, HZ); + net->ct.ecache_dwork_pending = true; + } else if (state == NFCT_ECACHE_DESTROY_SENT) { + net->ct.ecache_dwork_pending = false; +- mod_delayed_work(system_wq, &cnet->ecache_dwork, 0); ++ mod_delayed_work(system_wq, &cnet->ecache.dwork, 0); + } + } + +@@ -310,8 +310,9 @@ void nf_conntrack_ecache_pernet_init(struct net *net) + struct nf_conntrack_net *cnet = nf_ct_pernet(net); + + net->ct.sysctl_events = nf_ct_events; +- cnet->ct_net = &net->ct; +- INIT_DELAYED_WORK(&cnet->ecache_dwork, ecache_work); ++ ++ cnet->ecache.ct_net = &net->ct; ++ INIT_DELAYED_WORK(&cnet->ecache.dwork, ecache_work); + + BUILD_BUG_ON(__IPCT_MAX >= 16); /* e->ctmask is u16 */ + } +@@ -320,5 +321,5 @@ void nf_conntrack_ecache_pernet_fini(struct net *net) + { + struct nf_conntrack_net *cnet = nf_ct_pernet(net); + +- cancel_delayed_work_sync(&cnet->ecache_dwork); ++ cancel_delayed_work_sync(&cnet->ecache.dwork); + } +-- +2.35.1 + diff --git a/queue-5.18/netfilter-ecache-use-dedicated-list-for-event-redeli.patch b/queue-5.18/netfilter-ecache-use-dedicated-list-for-event-redeli.patch new file mode 100644 index 00000000000..a0bf17820bb --- /dev/null +++ b/queue-5.18/netfilter-ecache-use-dedicated-list-for-event-redeli.patch @@ -0,0 +1,329 @@ +From 2b5972be781cabc57e180359bd9b44fe69fa9bee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 13:01:16 +0200 +Subject: netfilter: ecache: use dedicated list for event redelivery + +From: Florian Westphal + +[ Upstream commit 2ed3bf188b33630cf9d93b996ebf001847a00b5a ] + +This disentangles event redelivery and the percpu dying list. + +Because entries are now stored on a dedicated list, all +entries are in NFCT_ECACHE_DESTROY_FAIL state and all entries +still have confirmed bit set -- the reference count is at least 1. + +The 'struct net' back-pointer can be removed as well. + +The pcpu dying list will be removed eventually, it has no functionality. + +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_conntrack.h | 3 +- + include/net/netfilter/nf_conntrack_ecache.h | 2 - + net/netfilter/nf_conntrack_core.c | 33 +++++- + net/netfilter/nf_conntrack_ecache.c | 117 +++++++++----------- + 4 files changed, 82 insertions(+), 73 deletions(-) + +diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h +index 69e6c6a218be..28672a944499 100644 +--- a/include/net/netfilter/nf_conntrack.h ++++ b/include/net/netfilter/nf_conntrack.h +@@ -45,7 +45,8 @@ union nf_conntrack_expect_proto { + + struct nf_conntrack_net_ecache { + struct delayed_work dwork; +- struct netns_ct *ct_net; ++ spinlock_t dying_lock; ++ struct hlist_nulls_head dying_list; + }; + + struct nf_conntrack_net { +diff --git a/include/net/netfilter/nf_conntrack_ecache.h b/include/net/netfilter/nf_conntrack_ecache.h +index 6c4c490a3e34..a6135b5030dd 100644 +--- a/include/net/netfilter/nf_conntrack_ecache.h ++++ b/include/net/netfilter/nf_conntrack_ecache.h +@@ -14,7 +14,6 @@ + #include + + enum nf_ct_ecache_state { +- NFCT_ECACHE_UNKNOWN, /* destroy event not sent */ + NFCT_ECACHE_DESTROY_FAIL, /* tried but failed to send destroy event */ + NFCT_ECACHE_DESTROY_SENT, /* sent destroy event after failure */ + }; +@@ -23,7 +22,6 @@ struct nf_conntrack_ecache { + unsigned long cache; /* bitops want long */ + u16 ctmask; /* bitmask of ct events to be delivered */ + u16 expmask; /* bitmask of expect events to be delivered */ +- enum nf_ct_ecache_state state:8;/* ecache state */ + u32 missed; /* missed events */ + u32 portid; /* netlink portid of destroyer */ + }; +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index 0164e5f522e8..ca1d1d105163 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -660,15 +660,12 @@ void nf_ct_destroy(struct nf_conntrack *nfct) + } + EXPORT_SYMBOL(nf_ct_destroy); + +-static void nf_ct_delete_from_lists(struct nf_conn *ct) ++static void __nf_ct_delete_from_lists(struct nf_conn *ct) + { + struct net *net = nf_ct_net(ct); + unsigned int hash, reply_hash; + unsigned int sequence; + +- nf_ct_helper_destroy(ct); +- +- local_bh_disable(); + do { + sequence = read_seqcount_begin(&nf_conntrack_generation); + hash = hash_conntrack(net, +@@ -681,12 +678,33 @@ static void nf_ct_delete_from_lists(struct nf_conn *ct) + + clean_from_lists(ct); + nf_conntrack_double_unlock(hash, reply_hash); ++} + ++static void nf_ct_delete_from_lists(struct nf_conn *ct) ++{ ++ nf_ct_helper_destroy(ct); ++ local_bh_disable(); ++ ++ __nf_ct_delete_from_lists(ct); + nf_ct_add_to_dying_list(ct); + + local_bh_enable(); + } + ++static void nf_ct_add_to_ecache_list(struct nf_conn *ct) ++{ ++#ifdef CONFIG_NF_CONNTRACK_EVENTS ++ struct nf_conntrack_net *cnet = nf_ct_pernet(nf_ct_net(ct)); ++ ++ spin_lock(&cnet->ecache.dying_lock); ++ hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode, ++ &cnet->ecache.dying_list); ++ spin_unlock(&cnet->ecache.dying_lock); ++#else ++ nf_ct_add_to_dying_list(ct); ++#endif ++} ++ + bool nf_ct_delete(struct nf_conn *ct, u32 portid, int report) + { + struct nf_conn_tstamp *tstamp; +@@ -709,7 +727,12 @@ bool nf_ct_delete(struct nf_conn *ct, u32 portid, int report) + /* destroy event was not delivered. nf_ct_put will + * be done by event cache worker on redelivery. + */ +- nf_ct_delete_from_lists(ct); ++ nf_ct_helper_destroy(ct); ++ local_bh_disable(); ++ __nf_ct_delete_from_lists(ct); ++ nf_ct_add_to_ecache_list(ct); ++ local_bh_enable(); ++ + nf_conntrack_ecache_work(nf_ct_net(ct), NFCT_ECACHE_DESTROY_FAIL); + return false; + } +diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c +index 0cb2da0a759a..2752859479b2 100644 +--- a/net/netfilter/nf_conntrack_ecache.c ++++ b/net/netfilter/nf_conntrack_ecache.c +@@ -16,7 +16,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -29,8 +28,9 @@ + + static DEFINE_MUTEX(nf_ct_ecache_mutex); + +-#define ECACHE_RETRY_WAIT (HZ/10) +-#define ECACHE_STACK_ALLOC (256 / sizeof(void *)) ++#define DYING_NULLS_VAL ((1 << 30) + 1) ++#define ECACHE_MAX_JIFFIES msecs_to_jiffies(10) ++#define ECACHE_RETRY_JIFFIES msecs_to_jiffies(10) + + enum retry_state { + STATE_CONGESTED, +@@ -38,58 +38,58 @@ enum retry_state { + STATE_DONE, + }; + +-static enum retry_state ecache_work_evict_list(struct ct_pcpu *pcpu) ++static enum retry_state ecache_work_evict_list(struct nf_conntrack_net *cnet) + { +- struct nf_conn *refs[ECACHE_STACK_ALLOC]; ++ unsigned long stop = jiffies + ECACHE_MAX_JIFFIES; ++ struct hlist_nulls_head evicted_list; + enum retry_state ret = STATE_DONE; + struct nf_conntrack_tuple_hash *h; + struct hlist_nulls_node *n; +- unsigned int evicted = 0; ++ unsigned int sent; + +- spin_lock(&pcpu->lock); ++ INIT_HLIST_NULLS_HEAD(&evicted_list, DYING_NULLS_VAL); + +- hlist_nulls_for_each_entry(h, n, &pcpu->dying, hnnode) { ++next: ++ sent = 0; ++ spin_lock_bh(&cnet->ecache.dying_lock); ++ ++ hlist_nulls_for_each_entry_safe(h, n, &cnet->ecache.dying_list, hnnode) { + struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); +- struct nf_conntrack_ecache *e; +- +- if (!nf_ct_is_confirmed(ct)) +- continue; +- +- /* This ecache access is safe because the ct is on the +- * pcpu dying list and we hold the spinlock -- the entry +- * cannot be free'd until after the lock is released. +- * +- * This is true even if ct has a refcount of 0: the +- * cpu that is about to free the entry must remove it +- * from the dying list and needs the lock to do so. +- */ +- e = nf_ct_ecache_find(ct); +- if (!e || e->state != NFCT_ECACHE_DESTROY_FAIL) +- continue; + +- /* ct is in NFCT_ECACHE_DESTROY_FAIL state, this means +- * the worker owns this entry: the ct will remain valid +- * until the worker puts its ct reference. ++ /* The worker owns all entries, ct remains valid until nf_ct_put ++ * in the loop below. + */ + if (nf_conntrack_event(IPCT_DESTROY, ct)) { + ret = STATE_CONGESTED; + break; + } + +- e->state = NFCT_ECACHE_DESTROY_SENT; +- refs[evicted] = ct; ++ hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode); ++ hlist_nulls_add_head(&ct->tuplehash[IP_CT_DIR_REPLY].hnnode, &evicted_list); + +- if (++evicted >= ARRAY_SIZE(refs)) { ++ if (time_after(stop, jiffies)) { + ret = STATE_RESTART; + break; + } ++ ++ if (sent++ > 16) { ++ spin_unlock_bh(&cnet->ecache.dying_lock); ++ cond_resched(); ++ goto next; ++ } + } + +- spin_unlock(&pcpu->lock); ++ spin_unlock_bh(&cnet->ecache.dying_lock); + +- /* can't _put while holding lock */ +- while (evicted) +- nf_ct_put(refs[--evicted]); ++ hlist_nulls_for_each_entry_safe(h, n, &evicted_list, hnnode) { ++ struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); ++ ++ hlist_nulls_add_fake(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode); ++ hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_REPLY].hnnode); ++ nf_ct_put(ct); ++ ++ cond_resched(); ++ } + + return ret; + } +@@ -97,35 +97,20 @@ static enum retry_state ecache_work_evict_list(struct ct_pcpu *pcpu) + static void ecache_work(struct work_struct *work) + { + struct nf_conntrack_net *cnet = container_of(work, struct nf_conntrack_net, ecache.dwork.work); +- struct netns_ct *ctnet = cnet->ecache.ct_net; +- int cpu, delay = -1; +- struct ct_pcpu *pcpu; +- +- local_bh_disable(); +- +- for_each_possible_cpu(cpu) { +- enum retry_state ret; +- +- pcpu = per_cpu_ptr(ctnet->pcpu_lists, cpu); +- +- ret = ecache_work_evict_list(pcpu); +- +- switch (ret) { +- case STATE_CONGESTED: +- delay = ECACHE_RETRY_WAIT; +- goto out; +- case STATE_RESTART: +- delay = 0; +- break; +- case STATE_DONE: +- break; +- } ++ int ret, delay = -1; ++ ++ ret = ecache_work_evict_list(cnet); ++ switch (ret) { ++ case STATE_CONGESTED: ++ delay = ECACHE_RETRY_JIFFIES; ++ break; ++ case STATE_RESTART: ++ delay = 0; ++ break; ++ case STATE_DONE: ++ break; + } + +- out: +- local_bh_enable(); +- +- ctnet->ecache_dwork_pending = delay > 0; + if (delay >= 0) + schedule_delayed_work(&cnet->ecache.dwork, delay); + } +@@ -199,7 +184,6 @@ int nf_conntrack_eventmask_report(unsigned int events, struct nf_conn *ct, + */ + if (e->portid == 0 && portid != 0) + e->portid = portid; +- e->state = NFCT_ECACHE_DESTROY_FAIL; + } + + return ret; +@@ -297,8 +281,10 @@ void nf_conntrack_ecache_work(struct net *net, enum nf_ct_ecache_state state) + schedule_delayed_work(&cnet->ecache.dwork, HZ); + net->ct.ecache_dwork_pending = true; + } else if (state == NFCT_ECACHE_DESTROY_SENT) { +- net->ct.ecache_dwork_pending = false; +- mod_delayed_work(system_wq, &cnet->ecache.dwork, 0); ++ if (!hlist_nulls_empty(&cnet->ecache.dying_list)) ++ mod_delayed_work(system_wq, &cnet->ecache.dwork, 0); ++ else ++ net->ct.ecache_dwork_pending = false; + } + } + +@@ -311,8 +297,9 @@ void nf_conntrack_ecache_pernet_init(struct net *net) + + net->ct.sysctl_events = nf_ct_events; + +- cnet->ecache.ct_net = &net->ct; + INIT_DELAYED_WORK(&cnet->ecache.dwork, ecache_work); ++ INIT_HLIST_NULLS_HEAD(&cnet->ecache.dying_list, DYING_NULLS_VAL); ++ spin_lock_init(&cnet->ecache.dying_lock); + + BUILD_BUG_ON(__IPCT_MAX >= 16); /* e->ctmask is u16 */ + } +-- +2.35.1 + diff --git a/queue-5.18/netfilter-nf_log-incorrect-offset-to-network-header.patch b/queue-5.18/netfilter-nf_log-incorrect-offset-to-network-header.patch new file mode 100644 index 00000000000..605c0c3a978 --- /dev/null +++ b/queue-5.18/netfilter-nf_log-incorrect-offset-to-network-header.patch @@ -0,0 +1,70 @@ +From b4d91e5fad9754320a7b012b5b30b94c85cb6f38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jul 2022 10:26:15 +0200 +Subject: netfilter: nf_log: incorrect offset to network header + +From: Pablo Neira Ayuso + +[ Upstream commit 7a847c00eeba9744353ecdfad253143b9115678a ] + +NFPROTO_ARP is expecting to find the ARP header at the network offset. + +In the particular case of ARP, HTYPE= field shows the initial bytes of +the ethernet header destination MAC address. + + netdev out: IN= OUT=bridge0 MACSRC=c2:76:e5:71:e1:de MACDST=36:b0:4a:e2:72:ea MACPROTO=0806 ARP HTYPE=14000 PTYPE=0x4ae2 OPCODE=49782 + +NFPROTO_NETDEV egress hook is also expecting to find the IP headers at +the network offset. + +Fixes: 35b9395104d5 ("netfilter: add generic ARP packet logger") +Reported-by: Tom Yan +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_log_syslog.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/nf_log_syslog.c b/net/netfilter/nf_log_syslog.c +index 13234641cdb3..7000e069bc07 100644 +--- a/net/netfilter/nf_log_syslog.c ++++ b/net/netfilter/nf_log_syslog.c +@@ -61,7 +61,7 @@ dump_arp_packet(struct nf_log_buf *m, + unsigned int logflags; + struct arphdr _arph; + +- ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph); ++ ah = skb_header_pointer(skb, nhoff, sizeof(_arph), &_arph); + if (!ah) { + nf_log_buf_add(m, "TRUNCATED"); + return; +@@ -90,7 +90,7 @@ dump_arp_packet(struct nf_log_buf *m, + ah->ar_pln != sizeof(__be32)) + return; + +- ap = skb_header_pointer(skb, sizeof(_arph), sizeof(_arpp), &_arpp); ++ ap = skb_header_pointer(skb, nhoff + sizeof(_arph), sizeof(_arpp), &_arpp); + if (!ap) { + nf_log_buf_add(m, " INCOMPLETE [%zu bytes]", + skb->len - sizeof(_arph)); +@@ -144,7 +144,7 @@ static void nf_log_arp_packet(struct net *net, u_int8_t pf, + + nf_log_dump_packet_common(m, pf, hooknum, skb, in, out, loginfo, + prefix); +- dump_arp_packet(m, loginfo, skb, 0); ++ dump_arp_packet(m, loginfo, skb, skb_network_offset(skb)); + + nf_log_buf_close(m); + } +@@ -829,7 +829,7 @@ static void nf_log_ip_packet(struct net *net, u_int8_t pf, + if (in) + dump_ipv4_mac_header(m, loginfo, skb); + +- dump_ipv4_packet(net, m, loginfo, skb, 0); ++ dump_ipv4_packet(net, m, loginfo, skb, skb_network_offset(skb)); + + nf_log_buf_close(m); + } +-- +2.35.1 + diff --git a/queue-5.18/netfilter-nf_tables-replace-bug_on-by-element-length.patch b/queue-5.18/netfilter-nf_tables-replace-bug_on-by-element-length.patch new file mode 100644 index 00000000000..c8a59ea65cc --- /dev/null +++ b/queue-5.18/netfilter-nf_tables-replace-bug_on-by-element-length.patch @@ -0,0 +1,220 @@ +From f385fecc7463c195a1d3f545c211340bb7ed9f76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jul 2022 11:41:59 +0200 +Subject: netfilter: nf_tables: replace BUG_ON by element length check + +From: Pablo Neira Ayuso + +[ Upstream commit c39ba4de6b0a843bec5d46c2b6f2064428dada5e ] + +BUG_ON can be triggered from userspace with an element with a large +userdata area. Replace it by length check and return EINVAL instead. +Over time extensions have been growing in size. + +Pick a sufficiently old Fixes: tag to propagate this fix. + +Fixes: 7d7402642eaf ("netfilter: nf_tables: variable sized set element keys / data") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_tables.h | 14 +++--- + net/netfilter/nf_tables_api.c | 72 ++++++++++++++++++++++--------- + 2 files changed, 60 insertions(+), 26 deletions(-) + +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index 279ae0fff7ad..f0c3a1ee197c 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -657,18 +657,22 @@ static inline void nft_set_ext_prepare(struct nft_set_ext_tmpl *tmpl) + tmpl->len = sizeof(struct nft_set_ext); + } + +-static inline void nft_set_ext_add_length(struct nft_set_ext_tmpl *tmpl, u8 id, +- unsigned int len) ++static inline int nft_set_ext_add_length(struct nft_set_ext_tmpl *tmpl, u8 id, ++ unsigned int len) + { + tmpl->len = ALIGN(tmpl->len, nft_set_ext_types[id].align); +- BUG_ON(tmpl->len > U8_MAX); ++ if (tmpl->len > U8_MAX) ++ return -EINVAL; ++ + tmpl->offset[id] = tmpl->len; + tmpl->len += nft_set_ext_types[id].len + len; ++ ++ return 0; + } + +-static inline void nft_set_ext_add(struct nft_set_ext_tmpl *tmpl, u8 id) ++static inline int nft_set_ext_add(struct nft_set_ext_tmpl *tmpl, u8 id) + { +- nft_set_ext_add_length(tmpl, id, 0); ++ return nft_set_ext_add_length(tmpl, id, 0); + } + + static inline void nft_set_ext_init(struct nft_set_ext *ext, +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index a136148627e7..de3dc35ce609 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -5831,8 +5831,11 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL)) + return -EINVAL; + +- if (flags != 0) +- nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); ++ if (flags != 0) { ++ err = nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); ++ if (err < 0) ++ return err; ++ } + + if (set->flags & NFT_SET_MAP) { + if (nla[NFTA_SET_ELEM_DATA] == NULL && +@@ -5941,7 +5944,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + if (err < 0) + goto err_set_elem_expr; + +- nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); ++ err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); ++ if (err < 0) ++ goto err_parse_key; + } + + if (nla[NFTA_SET_ELEM_KEY_END]) { +@@ -5950,22 +5955,31 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + if (err < 0) + goto err_parse_key; + +- nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen); ++ err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen); ++ if (err < 0) ++ goto err_parse_key_end; + } + + if (timeout > 0) { +- nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION); +- if (timeout != set->timeout) +- nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT); ++ err = nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION); ++ if (err < 0) ++ goto err_parse_key_end; ++ ++ if (timeout != set->timeout) { ++ err = nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT); ++ if (err < 0) ++ goto err_parse_key_end; ++ } + } + + if (num_exprs) { + for (i = 0; i < num_exprs; i++) + size += expr_array[i]->ops->size; + +- nft_set_ext_add_length(&tmpl, NFT_SET_EXT_EXPRESSIONS, +- sizeof(struct nft_set_elem_expr) + +- size); ++ err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_EXPRESSIONS, ++ sizeof(struct nft_set_elem_expr) + size); ++ if (err < 0) ++ goto err_parse_key_end; + } + + if (nla[NFTA_SET_ELEM_OBJREF] != NULL) { +@@ -5980,7 +5994,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + err = PTR_ERR(obj); + goto err_parse_key_end; + } +- nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF); ++ err = nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF); ++ if (err < 0) ++ goto err_parse_key_end; + } + + if (nla[NFTA_SET_ELEM_DATA] != NULL) { +@@ -6014,7 +6030,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + NFT_VALIDATE_NEED); + } + +- nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, desc.len); ++ err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, desc.len); ++ if (err < 0) ++ goto err_parse_data; + } + + /* The full maximum length of userdata can exceed the maximum +@@ -6024,9 +6042,12 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + ulen = 0; + if (nla[NFTA_SET_ELEM_USERDATA] != NULL) { + ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]); +- if (ulen > 0) +- nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA, +- ulen); ++ if (ulen > 0) { ++ err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA, ++ ulen); ++ if (err < 0) ++ goto err_parse_data; ++ } + } + + err = -ENOMEM; +@@ -6252,8 +6273,11 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set, + + nft_set_ext_prepare(&tmpl); + +- if (flags != 0) +- nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); ++ if (flags != 0) { ++ err = nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); ++ if (err < 0) ++ return err; ++ } + + if (nla[NFTA_SET_ELEM_KEY]) { + err = nft_setelem_parse_key(ctx, set, &elem.key.val, +@@ -6261,16 +6285,20 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set, + if (err < 0) + return err; + +- nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); ++ err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); ++ if (err < 0) ++ goto fail_elem; + } + + if (nla[NFTA_SET_ELEM_KEY_END]) { + err = nft_setelem_parse_key(ctx, set, &elem.key_end.val, + nla[NFTA_SET_ELEM_KEY_END]); + if (err < 0) +- return err; ++ goto fail_elem; + +- nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen); ++ err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen); ++ if (err < 0) ++ goto fail_elem_key_end; + } + + err = -ENOMEM; +@@ -6278,7 +6306,7 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set, + elem.key_end.val.data, NULL, 0, 0, + GFP_KERNEL_ACCOUNT); + if (elem.priv == NULL) +- goto fail_elem; ++ goto fail_elem_key_end; + + ext = nft_set_elem_ext(set, elem.priv); + if (flags) +@@ -6302,6 +6330,8 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set, + kfree(trans); + fail_trans: + kfree(elem.priv); ++fail_elem_key_end: ++ nft_data_release(&elem.key_end.val, NFT_DATA_VALUE); + fail_elem: + nft_data_release(&elem.key.val, NFT_DATA_VALUE); + return err; +-- +2.35.1 + diff --git a/queue-5.18/netfs-do-not-unlock-and-put-the-folio-twice.patch b/queue-5.18/netfs-do-not-unlock-and-put-the-folio-twice.patch new file mode 100644 index 00000000000..b26105d0197 --- /dev/null +++ b/queue-5.18/netfs-do-not-unlock-and-put-the-folio-twice.patch @@ -0,0 +1,180 @@ +From a6b99f2f1b61c35fcb21b8e3fd0a47ee1006eb51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 12:11:21 +0800 +Subject: netfs: do not unlock and put the folio twice + +From: Xiubo Li + +[ Upstream commit fac47b43c760ea90e64b895dba60df0327be7775 ] + +check_write_begin() will unlock and put the folio when return +non-zero. So we should avoid unlocking and putting it twice in +netfs layer. + +Change the way ->check_write_begin() works in the following two ways: + + (1) Pass it a pointer to the folio pointer, allowing it to unlock and put + the folio prior to doing the stuff it wants to do, provided it clears + the folio pointer. + + (2) Change the return values such that 0 with folio pointer set means + continue, 0 with folio pointer cleared means re-get and all error + codes indicating an error (no special treatment for -EAGAIN). + +[ bagasdotme: use Sphinx code text syntax for *foliop pointer ] + +Cc: stable@vger.kernel.org +Link: https://tracker.ceph.com/issues/56423 +Link: https://lore.kernel.org/r/cf169f43-8ee7-8697-25da-0204d1b4343e@redhat.com +Co-developed-by: David Howells +Signed-off-by: Xiubo Li +Signed-off-by: David Howells +Signed-off-by: Bagas Sanjaya +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + Documentation/filesystems/netfs_library.rst | 8 +++++--- + fs/afs/file.c | 2 +- + fs/ceph/addr.c | 11 ++++++----- + fs/netfs/buffered_read.c | 17 ++++++++++------- + include/linux/netfs.h | 2 +- + 5 files changed, 23 insertions(+), 17 deletions(-) + +diff --git a/Documentation/filesystems/netfs_library.rst b/Documentation/filesystems/netfs_library.rst +index 0483abcafcb0..0542358724f1 100644 +--- a/Documentation/filesystems/netfs_library.rst ++++ b/Documentation/filesystems/netfs_library.rst +@@ -300,7 +300,7 @@ through which it can issue requests and negotiate:: + void (*issue_read)(struct netfs_io_subrequest *subreq); + bool (*is_still_valid)(struct netfs_io_request *rreq); + int (*check_write_begin)(struct file *file, loff_t pos, unsigned len, +- struct folio *folio, void **_fsdata); ++ struct folio **foliop, void **_fsdata); + void (*done)(struct netfs_io_request *rreq); + void (*cleanup)(struct address_space *mapping, void *netfs_priv); + }; +@@ -376,8 +376,10 @@ The operations are as follows: + allocated/grabbed the folio to be modified to allow the filesystem to flush + conflicting state before allowing it to be modified. + +- It should return 0 if everything is now fine, -EAGAIN if the folio should be +- regrabbed and any other error code to abort the operation. ++ It may unlock and discard the folio it was given and set the caller's folio ++ pointer to NULL. It should return 0 if everything is now fine (``*foliop`` ++ left set) or the op should be retried (``*foliop`` cleared) and any other ++ error code to abort the operation. + + * ``done`` + +diff --git a/fs/afs/file.c b/fs/afs/file.c +index fab8324833ba..a8a5a91dc375 100644 +--- a/fs/afs/file.c ++++ b/fs/afs/file.c +@@ -376,7 +376,7 @@ static int afs_begin_cache_operation(struct netfs_io_request *rreq) + } + + static int afs_check_write_begin(struct file *file, loff_t pos, unsigned len, +- struct folio *folio, void **_fsdata) ++ struct folio **foliop, void **_fsdata) + { + struct afs_vnode *vnode = AFS_FS_I(file_inode(file)); + +diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c +index 11dbb1133a21..ae567fb7f65a 100644 +--- a/fs/ceph/addr.c ++++ b/fs/ceph/addr.c +@@ -63,7 +63,7 @@ + (CONGESTION_ON_THRESH(congestion_kb) >> 2)) + + static int ceph_netfs_check_write_begin(struct file *file, loff_t pos, unsigned int len, +- struct folio *folio, void **_fsdata); ++ struct folio **foliop, void **_fsdata); + + static inline struct ceph_snap_context *page_snap_context(struct page *page) + { +@@ -1285,18 +1285,19 @@ ceph_find_incompatible(struct page *page) + } + + static int ceph_netfs_check_write_begin(struct file *file, loff_t pos, unsigned int len, +- struct folio *folio, void **_fsdata) ++ struct folio **foliop, void **_fsdata) + { + struct inode *inode = file_inode(file); + struct ceph_inode_info *ci = ceph_inode(inode); + struct ceph_snap_context *snapc; + +- snapc = ceph_find_incompatible(folio_page(folio, 0)); ++ snapc = ceph_find_incompatible(folio_page(*foliop, 0)); + if (snapc) { + int r; + +- folio_unlock(folio); +- folio_put(folio); ++ folio_unlock(*foliop); ++ folio_put(*foliop); ++ *foliop = NULL; + if (IS_ERR(snapc)) + return PTR_ERR(snapc); + +diff --git a/fs/netfs/buffered_read.c b/fs/netfs/buffered_read.c +index e8e3359a4c54..8d03826c2b15 100644 +--- a/fs/netfs/buffered_read.c ++++ b/fs/netfs/buffered_read.c +@@ -320,8 +320,9 @@ static bool netfs_skip_folio_read(struct folio *folio, loff_t pos, size_t len, + * conflicting writes once the folio is grabbed and locked. It is passed a + * pointer to the fsdata cookie that gets returned to the VM to be passed to + * write_end. It is permitted to sleep. It should return 0 if the request +- * should go ahead; unlock the folio and return -EAGAIN to cause the folio to +- * be regot; or return an error. ++ * should go ahead or it may return an error. It may also unlock and put the ++ * folio, provided it sets ``*foliop`` to NULL, in which case a return of 0 ++ * will cause the folio to be re-got and the process to be retried. + * + * The calling netfs must initialise a netfs context contiguous to the vfs + * inode before calling this. +@@ -352,13 +353,13 @@ int netfs_write_begin(struct file *file, struct address_space *mapping, + + if (ctx->ops->check_write_begin) { + /* Allow the netfs (eg. ceph) to flush conflicts. */ +- ret = ctx->ops->check_write_begin(file, pos, len, folio, _fsdata); ++ ret = ctx->ops->check_write_begin(file, pos, len, &folio, _fsdata); + if (ret < 0) { + trace_netfs_failure(NULL, NULL, ret, netfs_fail_check_write_begin); +- if (ret == -EAGAIN) +- goto retry; + goto error; + } ++ if (!folio) ++ goto retry; + } + + if (folio_test_uptodate(folio)) +@@ -420,8 +421,10 @@ int netfs_write_begin(struct file *file, struct address_space *mapping, + error_put: + netfs_put_request(rreq, false, netfs_rreq_trace_put_failed); + error: +- folio_unlock(folio); +- folio_put(folio); ++ if (folio) { ++ folio_unlock(folio); ++ folio_put(folio); ++ } + _leave(" = %d", ret); + return ret; + } +diff --git a/include/linux/netfs.h b/include/linux/netfs.h +index a9c6f73877ec..95dadf0cd4b8 100644 +--- a/include/linux/netfs.h ++++ b/include/linux/netfs.h +@@ -211,7 +211,7 @@ struct netfs_request_ops { + void (*issue_read)(struct netfs_io_subrequest *subreq); + bool (*is_still_valid)(struct netfs_io_request *rreq); + int (*check_write_begin)(struct file *file, loff_t pos, unsigned len, +- struct folio *folio, void **_fsdata); ++ struct folio **foliop, void **_fsdata); + void (*done)(struct netfs_io_request *rreq); + void (*cleanup)(struct address_space *mapping, void *netfs_priv); + }; +-- +2.35.1 + diff --git a/queue-5.18/nexthop-fix-data-races-around-nexthop_compat_mode.patch b/queue-5.18/nexthop-fix-data-races-around-nexthop_compat_mode.patch new file mode 100644 index 00000000000..8fa0b637770 --- /dev/null +++ b/queue-5.18/nexthop-fix-data-races-around-nexthop_compat_mode.patch @@ -0,0 +1,74 @@ +From f2f730324c360139e317c1bb2aeb90cb3d7e5c3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:33 -0700 +Subject: nexthop: Fix data-races around nexthop_compat_mode. + +From: Kuniyuki Iwashima + +[ Upstream commit bdf00bf24bef9be1ca641a6390fd5487873e0d2e ] + +While reading nexthop_compat_mode, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +Fixes: 4f80116d3df3 ("net: ipv4: add sysctl for nexthop api compatibility mode") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/fib_semantics.c | 2 +- + net/ipv4/nexthop.c | 5 +++-- + net/ipv6/route.c | 2 +- + 3 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c +index 1c4fef385ef6..720f65f7bd0b 100644 +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -1811,7 +1811,7 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event, + goto nla_put_failure; + if (nexthop_is_blackhole(fi->nh)) + rtm->rtm_type = RTN_BLACKHOLE; +- if (!fi->fib_net->ipv4.sysctl_nexthop_compat_mode) ++ if (!READ_ONCE(fi->fib_net->ipv4.sysctl_nexthop_compat_mode)) + goto offload; + } + +diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c +index e459a391e607..853a75a8fbaf 100644 +--- a/net/ipv4/nexthop.c ++++ b/net/ipv4/nexthop.c +@@ -1858,7 +1858,7 @@ static void __remove_nexthop_fib(struct net *net, struct nexthop *nh) + /* __ip6_del_rt does a release, so do a hold here */ + fib6_info_hold(f6i); + ipv6_stub->ip6_del_rt(net, f6i, +- !net->ipv4.sysctl_nexthop_compat_mode); ++ !READ_ONCE(net->ipv4.sysctl_nexthop_compat_mode)); + } + } + +@@ -2361,7 +2361,8 @@ static int insert_nexthop(struct net *net, struct nexthop *new_nh, + if (!rc) { + nh_base_seq_inc(net); + nexthop_notify(RTM_NEWNEXTHOP, new_nh, &cfg->nlinfo); +- if (replace_notify && net->ipv4.sysctl_nexthop_compat_mode) ++ if (replace_notify && ++ READ_ONCE(net->ipv4.sysctl_nexthop_compat_mode)) + nexthop_replace_notify(net, new_nh, &cfg->nlinfo); + } + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 83786de847ab..a87b96a256af 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -5737,7 +5737,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb, + if (nexthop_is_blackhole(rt->nh)) + rtm->rtm_type = RTN_BLACKHOLE; + +- if (net->ipv4.sysctl_nexthop_compat_mode && ++ if (READ_ONCE(net->ipv4.sysctl_nexthop_compat_mode) && + rt6_fill_node_nexthop(skb, rt->nh, &nh_flags) < 0) + goto nla_put_failure; + +-- +2.35.1 + diff --git a/queue-5.18/nfp-fix-issue-of-skb-segments-exceeds-descriptor-lim.patch b/queue-5.18/nfp-fix-issue-of-skb-segments-exceeds-descriptor-lim.patch new file mode 100644 index 00000000000..2c2a7ce9446 --- /dev/null +++ b/queue-5.18/nfp-fix-issue-of-skb-segments-exceeds-descriptor-lim.patch @@ -0,0 +1,123 @@ +From d8bdee341eea1fb43c9369652f31351b506c32ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 11:07:18 +0100 +Subject: nfp: fix issue of skb segments exceeds descriptor limitation + +From: Baowen Zheng + +[ Upstream commit 9c840d5f9aaef87e65db900bae21c70b059aba5f ] + +TCP packets will be dropped if the segments number in the tx skb +exceeds limitation when sending iperf3 traffic with --zerocopy option. + +we make the following changes: + +Get nr_frags in nfp_nfdk_tx_maybe_close_block instead of passing from +outside because it will be changed after skb_linearize operation. + +Fill maximum dma_len in first tx descriptor to make sure the whole +head is included in the first descriptor. + +Fixes: c10d12e3dce8 ("nfp: add support for NFDK data path") +Signed-off-by: Baowen Zheng +Reviewed-by: Louis Peens +Signed-off-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/netronome/nfp/nfdk/dp.c | 33 +++++++++++++++----- + 1 file changed, 25 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/netronome/nfp/nfdk/dp.c b/drivers/net/ethernet/netronome/nfp/nfdk/dp.c +index e509d6dcba5c..805071d64a20 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfdk/dp.c ++++ b/drivers/net/ethernet/netronome/nfp/nfdk/dp.c +@@ -125,17 +125,18 @@ nfp_nfdk_tx_csum(struct nfp_net_dp *dp, struct nfp_net_r_vector *r_vec, + + static int + nfp_nfdk_tx_maybe_close_block(struct nfp_net_tx_ring *tx_ring, +- unsigned int nr_frags, struct sk_buff *skb) ++ struct sk_buff *skb) + { + unsigned int n_descs, wr_p, nop_slots; + const skb_frag_t *frag, *fend; + struct nfp_nfdk_tx_desc *txd; ++ unsigned int nr_frags; + unsigned int wr_idx; + int err; + + recount_descs: + n_descs = nfp_nfdk_headlen_to_segs(skb_headlen(skb)); +- ++ nr_frags = skb_shinfo(skb)->nr_frags; + frag = skb_shinfo(skb)->frags; + fend = frag + nr_frags; + for (; frag < fend; frag++) +@@ -281,10 +282,13 @@ netdev_tx_t nfp_nfdk_tx(struct sk_buff *skb, struct net_device *netdev) + if (unlikely((int)metadata < 0)) + goto err_flush; + +- nr_frags = skb_shinfo(skb)->nr_frags; +- if (nfp_nfdk_tx_maybe_close_block(tx_ring, nr_frags, skb)) ++ if (nfp_nfdk_tx_maybe_close_block(tx_ring, skb)) + goto err_flush; + ++ /* nr_frags will change after skb_linearize so we get nr_frags after ++ * nfp_nfdk_tx_maybe_close_block function ++ */ ++ nr_frags = skb_shinfo(skb)->nr_frags; + /* DMA map all */ + wr_idx = D_IDX(tx_ring, tx_ring->wr_p); + txd = &tx_ring->ktxds[wr_idx]; +@@ -310,7 +314,16 @@ netdev_tx_t nfp_nfdk_tx(struct sk_buff *skb, struct net_device *netdev) + + /* FIELD_PREP() implicitly truncates to chunk */ + dma_len -= 1; +- dlen_type = FIELD_PREP(NFDK_DESC_TX_DMA_LEN_HEAD, dma_len) | ++ ++ /* We will do our best to pass as much data as we can in descriptor ++ * and we need to make sure the first descriptor includes whole head ++ * since there is limitation in firmware side. Sometimes the value of ++ * dma_len bitwise and NFDK_DESC_TX_DMA_LEN_HEAD will less than ++ * headlen. ++ */ ++ dlen_type = FIELD_PREP(NFDK_DESC_TX_DMA_LEN_HEAD, ++ dma_len > NFDK_DESC_TX_DMA_LEN_HEAD ? ++ NFDK_DESC_TX_DMA_LEN_HEAD : dma_len) | + FIELD_PREP(NFDK_DESC_TX_TYPE_HEAD, type); + + txd->dma_len_type = cpu_to_le16(dlen_type); +@@ -925,7 +938,9 @@ nfp_nfdk_tx_xdp_buf(struct nfp_net_dp *dp, struct nfp_net_rx_ring *rx_ring, + + /* FIELD_PREP() implicitly truncates to chunk */ + dma_len -= 1; +- dlen_type = FIELD_PREP(NFDK_DESC_TX_DMA_LEN_HEAD, dma_len) | ++ dlen_type = FIELD_PREP(NFDK_DESC_TX_DMA_LEN_HEAD, ++ dma_len > NFDK_DESC_TX_DMA_LEN_HEAD ? ++ NFDK_DESC_TX_DMA_LEN_HEAD : dma_len) | + FIELD_PREP(NFDK_DESC_TX_TYPE_HEAD, type); + + txd->dma_len_type = cpu_to_le16(dlen_type); +@@ -1303,7 +1318,7 @@ nfp_nfdk_ctrl_tx_one(struct nfp_net *nn, struct nfp_net_r_vector *r_vec, + skb_push(skb, 4)); + } + +- if (nfp_nfdk_tx_maybe_close_block(tx_ring, 0, skb)) ++ if (nfp_nfdk_tx_maybe_close_block(tx_ring, skb)) + goto err_free; + + /* DMA map all */ +@@ -1328,7 +1343,9 @@ nfp_nfdk_ctrl_tx_one(struct nfp_net *nn, struct nfp_net_r_vector *r_vec, + txbuf++; + + dma_len -= 1; +- dlen_type = FIELD_PREP(NFDK_DESC_TX_DMA_LEN_HEAD, dma_len) | ++ dlen_type = FIELD_PREP(NFDK_DESC_TX_DMA_LEN_HEAD, ++ dma_len > NFDK_DESC_TX_DMA_LEN_HEAD ? ++ NFDK_DESC_TX_DMA_LEN_HEAD : dma_len) | + FIELD_PREP(NFDK_DESC_TX_TYPE_HEAD, type); + + txd->dma_len_type = cpu_to_le16(dlen_type); +-- +2.35.1 + diff --git a/queue-5.18/nfsd-decode-nfsv4-birth-time-attribute.patch b/queue-5.18/nfsd-decode-nfsv4-birth-time-attribute.patch new file mode 100644 index 00000000000..9637e0503c1 --- /dev/null +++ b/queue-5.18/nfsd-decode-nfsv4-birth-time-attribute.patch @@ -0,0 +1,83 @@ +From dc58ec63462a978f655a77c65e6004443cf38a8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Jul 2022 14:46:04 -0400 +Subject: NFSD: Decode NFSv4 birth time attribute + +From: Chuck Lever + +[ Upstream commit 5b2f3e0777da2a5dd62824bbe2fdab1d12caaf8f ] + +NFSD has advertised support for the NFSv4 time_create attribute +since commit e377a3e698fb ("nfsd: Add support for the birth time +attribute"). + +Igor Mammedov reports that Mac OS clients attempt to set the NFSv4 +birth time attribute via OPEN(CREATE) and SETATTR if the server +indicates that it supports it, but since the above commit was +merged, those attempts now fail. + +Table 5 in RFC 8881 lists the time_create attribute as one that can +be both set and retrieved, but the above commit did not add server +support for clients to provide a time_create attribute. IMO that's +a bug in our implementation of the NFSv4 protocol, which this commit +addresses. + +Whether NFSD silently ignores the new birth time or actually sets it +is another matter. I haven't found another filesystem service in the +Linux kernel that enables users or clients to modify a file's birth +time attribute. + +This commit reflects my (perhaps incorrect) understanding of whether +Linux users can set a file's birth time. NFSD will now recognize a +time_create attribute but it ignores its value. It clears the +time_create bit in the returned attribute bitmask to indicate that +the value was not used. + +Reported-by: Igor Mammedov +Fixes: e377a3e698fb ("nfsd: Add support for the birth time attribute") +Tested-by: Igor Mammedov +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4xdr.c | 9 +++++++++ + fs/nfsd/nfsd.h | 3 ++- + 2 files changed, 11 insertions(+), 1 deletion(-) + +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index da92e7d2ab6a..264c3a4629c9 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -470,6 +470,15 @@ nfsd4_decode_fattr4(struct nfsd4_compoundargs *argp, u32 *bmval, u32 bmlen, + return nfserr_bad_xdr; + } + } ++ if (bmval[1] & FATTR4_WORD1_TIME_CREATE) { ++ struct timespec64 ts; ++ ++ /* No Linux filesystem supports setting this attribute. */ ++ bmval[1] &= ~FATTR4_WORD1_TIME_CREATE; ++ status = nfsd4_decode_nfstime4(argp, &ts); ++ if (status) ++ return status; ++ } + if (bmval[1] & FATTR4_WORD1_TIME_MODIFY_SET) { + u32 set_it; + +diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h +index 4fc1fd639527..727754d56243 100644 +--- a/fs/nfsd/nfsd.h ++++ b/fs/nfsd/nfsd.h +@@ -460,7 +460,8 @@ static inline bool nfsd_attrs_supported(u32 minorversion, const u32 *bmval) + (FATTR4_WORD0_SIZE | FATTR4_WORD0_ACL) + #define NFSD_WRITEABLE_ATTRS_WORD1 \ + (FATTR4_WORD1_MODE | FATTR4_WORD1_OWNER | FATTR4_WORD1_OWNER_GROUP \ +- | FATTR4_WORD1_TIME_ACCESS_SET | FATTR4_WORD1_TIME_MODIFY_SET) ++ | FATTR4_WORD1_TIME_ACCESS_SET | FATTR4_WORD1_TIME_CREATE \ ++ | FATTR4_WORD1_TIME_MODIFY_SET) + #ifdef CONFIG_NFSD_V4_SECURITY_LABEL + #define MAYBE_FATTR4_WORD2_SECURITY_LABEL \ + FATTR4_WORD2_SECURITY_LABEL +-- +2.35.1 + diff --git a/queue-5.18/objtool-update-retpoline-validation.patch b/queue-5.18/objtool-update-retpoline-validation.patch new file mode 100644 index 00000000000..2af5359a55f --- /dev/null +++ b/queue-5.18/objtool-update-retpoline-validation.patch @@ -0,0 +1,120 @@ +From 13d4841cf81b8750beb3ead5c8bf1051fad2adda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jun 2022 23:15:59 +0200 +Subject: objtool: Update Retpoline validation + +From: Peter Zijlstra + +[ Upstream commit 9bb2ec608a209018080ca262f771e6a9ff203b6f ] + +Update retpoline validation with the new CONFIG_RETPOLINE requirement of +not having bare naked RET instructions. + +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Borislav Petkov +Reviewed-by: Josh Poimboeuf +Signed-off-by: Borislav Petkov +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/nospec-branch.h | 6 ++++++ + arch/x86/mm/mem_encrypt_boot.S | 2 ++ + arch/x86/xen/xen-head.S | 1 + + tools/objtool/check.c | 19 +++++++++++++------ + 4 files changed, 22 insertions(+), 6 deletions(-) + +diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h +index da251a5645b0..f1a7ecd0a7c7 100644 +--- a/arch/x86/include/asm/nospec-branch.h ++++ b/arch/x86/include/asm/nospec-branch.h +@@ -75,6 +75,12 @@ + .popsection + .endm + ++/* ++ * (ab)use RETPOLINE_SAFE on RET to annotate away 'bare' RET instructions ++ * vs RETBleed validation. ++ */ ++#define ANNOTATE_UNRET_SAFE ANNOTATE_RETPOLINE_SAFE ++ + /* + * JMP_NOSPEC and CALL_NOSPEC macros can be used instead of a simple + * indirect jmp/call which may be susceptible to the Spectre variant 2 +diff --git a/arch/x86/mm/mem_encrypt_boot.S b/arch/x86/mm/mem_encrypt_boot.S +index d94dea450fa6..9de3d900bc92 100644 +--- a/arch/x86/mm/mem_encrypt_boot.S ++++ b/arch/x86/mm/mem_encrypt_boot.S +@@ -66,6 +66,7 @@ SYM_FUNC_START(sme_encrypt_execute) + pop %rbp + + /* Offset to __x86_return_thunk would be wrong here */ ++ ANNOTATE_UNRET_SAFE + ret + int3 + SYM_FUNC_END(sme_encrypt_execute) +@@ -154,6 +155,7 @@ SYM_FUNC_START(__enc_copy) + pop %r15 + + /* Offset to __x86_return_thunk would be wrong here */ ++ ANNOTATE_UNRET_SAFE + ret + int3 + .L__enc_copy_end: +diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S +index 13af6fe453e3..ffaa62167f6e 100644 +--- a/arch/x86/xen/xen-head.S ++++ b/arch/x86/xen/xen-head.S +@@ -26,6 +26,7 @@ SYM_CODE_START(hypercall_page) + .rept (PAGE_SIZE / 32) + UNWIND_HINT_FUNC + ANNOTATE_NOENDBR ++ ANNOTATE_UNRET_SAFE + ret + /* + * Xen will write the hypercall page, and sort out ENDBR. +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index f66e4ac0af94..fbe41203fc9b 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -2030,8 +2030,9 @@ static int read_retpoline_hints(struct objtool_file *file) + } + + if (insn->type != INSN_JUMP_DYNAMIC && +- insn->type != INSN_CALL_DYNAMIC) { +- WARN_FUNC("retpoline_safe hint not an indirect jump/call", ++ insn->type != INSN_CALL_DYNAMIC && ++ insn->type != INSN_RETURN) { ++ WARN_FUNC("retpoline_safe hint not an indirect jump/call/ret", + insn->sec, insn->offset); + return -1; + } +@@ -3561,7 +3562,8 @@ static int validate_retpoline(struct objtool_file *file) + + for_each_insn(file, insn) { + if (insn->type != INSN_JUMP_DYNAMIC && +- insn->type != INSN_CALL_DYNAMIC) ++ insn->type != INSN_CALL_DYNAMIC && ++ insn->type != INSN_RETURN) + continue; + + if (insn->retpoline_safe) +@@ -3576,9 +3578,14 @@ static int validate_retpoline(struct objtool_file *file) + if (!strcmp(insn->sec->name, ".init.text") && !module) + continue; + +- WARN_FUNC("indirect %s found in RETPOLINE build", +- insn->sec, insn->offset, +- insn->type == INSN_JUMP_DYNAMIC ? "jump" : "call"); ++ if (insn->type == INSN_RETURN) { ++ WARN_FUNC("'naked' return found in RETPOLINE build", ++ insn->sec, insn->offset); ++ } else { ++ WARN_FUNC("indirect %s found in RETPOLINE build", ++ insn->sec, insn->offset, ++ insn->type == INSN_JUMP_DYNAMIC ? "jump" : "call"); ++ } + + warnings++; + } +-- +2.35.1 + diff --git a/queue-5.18/raw-fix-a-data-race-around-sysctl_raw_l3mdev_accept.patch b/queue-5.18/raw-fix-a-data-race-around-sysctl_raw_l3mdev_accept.patch new file mode 100644 index 00000000000..847ffe31ada --- /dev/null +++ b/queue-5.18/raw-fix-a-data-race-around-sysctl_raw_l3mdev_accept.patch @@ -0,0 +1,36 @@ +From 39f8011b8122475aa572ada04371684eda70ea39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:29 -0700 +Subject: raw: Fix a data-race around sysctl_raw_l3mdev_accept. + +From: Kuniyuki Iwashima + +[ Upstream commit 1dace014928e6e385363032d359a04dee9158af0 ] + +While reading sysctl_raw_l3mdev_accept, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: 6897445fb194 ("net: provide a sysctl raw_l3mdev_accept for raw socket lookup with VRFs") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/raw.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/net/raw.h b/include/net/raw.h +index 8ad8df594853..c51a635671a7 100644 +--- a/include/net/raw.h ++++ b/include/net/raw.h +@@ -75,7 +75,7 @@ static inline bool raw_sk_bound_dev_eq(struct net *net, int bound_dev_if, + int dif, int sdif) + { + #if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV) +- return inet_bound_dev_eq(!!net->ipv4.sysctl_raw_l3mdev_accept, ++ return inet_bound_dev_eq(READ_ONCE(net->ipv4.sysctl_raw_l3mdev_accept), + bound_dev_if, dif, sdif); + #else + return inet_bound_dev_eq(true, bound_dev_if, dif, sdif); +-- +2.35.1 + diff --git a/queue-5.18/reset-fix-devm-bulk-optional-exclusive-control-gette.patch b/queue-5.18/reset-fix-devm-bulk-optional-exclusive-control-gette.patch new file mode 100644 index 00000000000..2c18b6a2ae2 --- /dev/null +++ b/queue-5.18/reset-fix-devm-bulk-optional-exclusive-control-gette.patch @@ -0,0 +1,47 @@ +From ce21c4e433469d37295348700d878213099cb47b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jun 2022 17:18:45 +0300 +Subject: reset: Fix devm bulk optional exclusive control getter + +From: Serge Semin + +[ Upstream commit a57f68ddc8865d59a19783080cc52fb4a11dc209 ] + +Most likely due to copy-paste mistake the device managed version of the +denoted reset control getter has been implemented with invalid semantic, +which can be immediately spotted by having "WARN_ON(shared && acquired)" +warning in the system log as soon as the method is called. Anyway let's +fix it by altering the boolean arguments passed to the +__devm_reset_control_bulk_get() method from +- shared = true, optional = false, acquired = true +to ++ shared = false, optional = true, acquired = true +That's what they were supposed to be in the first place (see the non-devm +version of the same method: reset_control_bulk_get_optional_exclusive()). + +Fixes: 48d71395896d ("reset: Add reset_control_bulk API") +Signed-off-by: Serge Semin +Reviewed-by: Dmitry Osipenko +Signed-off-by: Philipp Zabel +Link: https://lore.kernel.org/r/20220624141853.7417-2-Sergey.Semin@baikalelectronics.ru +Signed-off-by: Sasha Levin +--- + include/linux/reset.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/reset.h b/include/linux/reset.h +index 8a21b5756c3e..514ddf003efc 100644 +--- a/include/linux/reset.h ++++ b/include/linux/reset.h +@@ -731,7 +731,7 @@ static inline int __must_check + devm_reset_control_bulk_get_optional_exclusive(struct device *dev, int num_rstcs, + struct reset_control_bulk_data *rstcs) + { +- return __devm_reset_control_bulk_get(dev, num_rstcs, rstcs, true, false, true); ++ return __devm_reset_control_bulk_get(dev, num_rstcs, rstcs, false, true, true); + } + + /** +-- +2.35.1 + diff --git a/queue-5.18/risc-v-kvm-fix-srcu-deadlock-caused-by-kvm_riscv_che.patch b/queue-5.18/risc-v-kvm-fix-srcu-deadlock-caused-by-kvm_riscv_che.patch new file mode 100644 index 00000000000..abdbd6a8a01 --- /dev/null +++ b/queue-5.18/risc-v-kvm-fix-srcu-deadlock-caused-by-kvm_riscv_che.patch @@ -0,0 +1,51 @@ +From 79ed92567dfe00c3d8e228968dc43656176c5131 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 09:36:32 +0530 +Subject: RISC-V: KVM: Fix SRCU deadlock caused by + kvm_riscv_check_vcpu_requests() + +From: Anup Patel + +[ Upstream commit be82abe6a76ba8e76f25312566182b0f13c4fbf9 ] + +The kvm_riscv_check_vcpu_requests() is called with SRCU read lock held +and for KVM_REQ_SLEEP request it will block the VCPU without releasing +SRCU read lock. This causes KVM ioctls (such as KVM_IOEVENTFD) from +other VCPUs of the same Guest/VM to hang/deadlock if there is any +synchronize_srcu() or synchronize_srcu_expedited() in the path. + +To fix the above in kvm_riscv_check_vcpu_requests(), we should do SRCU +read unlock before blocking the VCPU and do SRCU read lock after VCPU +wakeup. + +Fixes: cce69aff689e ("RISC-V: KVM: Implement VCPU interrupts and requests handling") +Reported-by: Bin Meng +Signed-off-by: Anup Patel +Reviewed-by: Atish Patra +Tested-by: Heinrich Schuchardt +Tested-by: Bin Meng +Signed-off-by: Anup Patel +Signed-off-by: Sasha Levin +--- + arch/riscv/kvm/vcpu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/riscv/kvm/vcpu.c b/arch/riscv/kvm/vcpu.c +index 7461f964d20a..3894777bfa87 100644 +--- a/arch/riscv/kvm/vcpu.c ++++ b/arch/riscv/kvm/vcpu.c +@@ -673,9 +673,11 @@ static void kvm_riscv_check_vcpu_requests(struct kvm_vcpu *vcpu) + + if (kvm_request_pending(vcpu)) { + if (kvm_check_request(KVM_REQ_SLEEP, vcpu)) { ++ kvm_vcpu_srcu_read_unlock(vcpu); + rcuwait_wait_event(wait, + (!vcpu->arch.power_off) && (!vcpu->arch.pause), + TASK_INTERRUPTIBLE); ++ kvm_vcpu_srcu_read_lock(vcpu); + + if (vcpu->arch.power_off || vcpu->arch.pause) { + /* +-- +2.35.1 + diff --git a/queue-5.18/riscv-dts-microchip-hook-up-the-mpfs-l2cache.patch b/queue-5.18/riscv-dts-microchip-hook-up-the-mpfs-l2cache.patch new file mode 100644 index 00000000000..78dcd3e0baa --- /dev/null +++ b/queue-5.18/riscv-dts-microchip-hook-up-the-mpfs-l2cache.patch @@ -0,0 +1,63 @@ +From a6108a437e9702e37e6e3b5ec11ac2c4e9710684 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jun 2022 21:07:33 +0100 +Subject: riscv: dts: microchip: hook up the mpfs' l2cache + +From: Conor Dooley + +[ Upstream commit efa310ba00716d7a872bdc5fa1f5545edc9efd69 ] + +The initial PolarFire SoC devicetree must have been forked off from +the fu540 one prior to the addition of l2cache controller support being +added there. When the controller node was added to mpfs.dtsi, it was +not hooked up to the CPUs & thus sysfs reports an incorrect cache +configuration. Hook it up. + +Fixes: 0fa6107eca41 ("RISC-V: Initial DTS for Microchip ICICLE board") +Reviewed-by: Sudeep Holla +Reviewed-by: Daire McNamara +Signed-off-by: Conor Dooley +Signed-off-by: Sasha Levin +--- + arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi b/arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi +index f44fce1fe080..2f75e39d2fdd 100644 +--- a/arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi ++++ b/arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi +@@ -51,6 +51,7 @@ cpu1: cpu@1 { + riscv,isa = "rv64imafdc"; + clocks = <&clkcfg CLK_CPU>; + tlb-split; ++ next-level-cache = <&cctrllr>; + status = "okay"; + + cpu1_intc: interrupt-controller { +@@ -78,6 +79,7 @@ cpu2: cpu@2 { + riscv,isa = "rv64imafdc"; + clocks = <&clkcfg CLK_CPU>; + tlb-split; ++ next-level-cache = <&cctrllr>; + status = "okay"; + + cpu2_intc: interrupt-controller { +@@ -105,6 +107,7 @@ cpu3: cpu@3 { + riscv,isa = "rv64imafdc"; + clocks = <&clkcfg CLK_CPU>; + tlb-split; ++ next-level-cache = <&cctrllr>; + status = "okay"; + + cpu3_intc: interrupt-controller { +@@ -132,6 +135,7 @@ cpu4: cpu@4 { + riscv,isa = "rv64imafdc"; + clocks = <&clkcfg CLK_CPU>; + tlb-split; ++ next-level-cache = <&cctrllr>; + status = "okay"; + cpu4_intc: interrupt-controller { + #interrupt-cells = <1>; +-- +2.35.1 + diff --git a/queue-5.18/seg6-bpf-fix-skb-checksum-in-bpf_push_seg6_encap.patch b/queue-5.18/seg6-bpf-fix-skb-checksum-in-bpf_push_seg6_encap.patch new file mode 100644 index 00000000000..9bce42a5d1e --- /dev/null +++ b/queue-5.18/seg6-bpf-fix-skb-checksum-in-bpf_push_seg6_encap.patch @@ -0,0 +1,44 @@ +From 7f545698aeecec562926632fc19d7ff9cc27c5bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 19:58:37 +0200 +Subject: seg6: bpf: fix skb checksum in bpf_push_seg6_encap() + +From: Andrea Mayer + +[ Upstream commit 4889fbd98deaf243c3baadc54e296d71c6af1eb0 ] + +Both helper functions bpf_lwt_seg6_action() and bpf_lwt_push_encap() use +the bpf_push_seg6_encap() to encapsulate the packet in an IPv6 with Segment +Routing Header (SRH) or insert an SRH between the IPv6 header and the +payload. +To achieve this result, such helper functions rely on bpf_push_seg6_encap() +which, in turn, leverages seg6_do_srh_{encap,inline}() to perform the +required operation (i.e. encap/inline). + +This patch removes the initialization of the IPv6 header payload length +from bpf_push_seg6_encap(), as it is now handled properly by +seg6_do_srh_{encap,inline}() to prevent corruption of the skb checksum. + +Fixes: fe94cc290f53 ("bpf: Add IPv6 Segment Routing helpers") +Signed-off-by: Andrea Mayer +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index af1e77f2f24a..6391c1885bca 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -6148,7 +6148,6 @@ static int bpf_push_seg6_encap(struct sk_buff *skb, u32 type, void *hdr, u32 len + if (err) + return err; + +- ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); + skb_set_transport_header(skb, sizeof(struct ipv6hdr)); + + return seg6_lookup_nexthop(skb, NULL, 0); +-- +2.35.1 + diff --git a/queue-5.18/seg6-fix-skb-checksum-evaluation-in-srh-encapsulatio.patch b/queue-5.18/seg6-fix-skb-checksum-evaluation-in-srh-encapsulatio.patch new file mode 100644 index 00000000000..fc3a083cc4b --- /dev/null +++ b/queue-5.18/seg6-fix-skb-checksum-evaluation-in-srh-encapsulatio.patch @@ -0,0 +1,73 @@ +From 0eaf70a1d10a5291c4eb0c09f8bf1c4a4ecce16e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 19:58:35 +0200 +Subject: seg6: fix skb checksum evaluation in SRH encapsulation/insertion + +From: Andrea Mayer + +[ Upstream commit df8386d13ea280d55beee1b95f61a59234a3798b ] + +Support for SRH encapsulation and insertion was introduced with +commit 6c8702c60b88 ("ipv6: sr: add support for SRH encapsulation and +injection with lwtunnels"), through the seg6_do_srh_encap() and +seg6_do_srh_inline() functions, respectively. +The former encapsulates the packet in an outer IPv6 header along with +the SRH, while the latter inserts the SRH between the IPv6 header and +the payload. Then, the headers are initialized/updated according to the +operating mode (i.e., encap/inline). +Finally, the skb checksum is calculated to reflect the changes applied +to the headers. + +The IPv6 payload length ('payload_len') is not initialized +within seg6_do_srh_{inline,encap}() but is deferred in seg6_do_srh(), i.e. +the caller of seg6_do_srh_{inline,encap}(). +However, this operation invalidates the skb checksum, since the +'payload_len' is updated only after the checksum is evaluated. + +To solve this issue, the initialization of the IPv6 payload length is +moved from seg6_do_srh() directly into the seg6_do_srh_{inline,encap}() +functions and before the skb checksum update takes place. + +Fixes: 6c8702c60b88 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels") +Reported-by: Paolo Abeni +Link: https://lore.kernel.org/all/20220705190727.69d532417be7438b15404ee1@uniroma2.it +Signed-off-by: Andrea Mayer +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv6/seg6_iptunnel.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c +index d64855010948..e756ba705fd9 100644 +--- a/net/ipv6/seg6_iptunnel.c ++++ b/net/ipv6/seg6_iptunnel.c +@@ -189,6 +189,8 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto) + } + #endif + ++ hdr->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); ++ + skb_postpush_rcsum(skb, hdr, tot_len); + + return 0; +@@ -241,6 +243,8 @@ int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh) + } + #endif + ++ hdr->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); ++ + skb_postpush_rcsum(skb, hdr, sizeof(struct ipv6hdr) + hdrlen); + + return 0; +@@ -302,7 +306,6 @@ static int seg6_do_srh(struct sk_buff *skb) + break; + } + +- ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); + skb_set_transport_header(skb, sizeof(struct ipv6hdr)); + nf_reset_ct(skb); + +-- +2.35.1 + diff --git a/queue-5.18/seg6-fix-skb-checksum-in-srv6-end.b6-and-end.b6.enca.patch b/queue-5.18/seg6-fix-skb-checksum-in-srv6-end.b6-and-end.b6.enca.patch new file mode 100644 index 00000000000..fff048753ec --- /dev/null +++ b/queue-5.18/seg6-fix-skb-checksum-in-srv6-end.b6-and-end.b6.enca.patch @@ -0,0 +1,51 @@ +From 1eb32b1035bd017ebd0d7b6f4fd91efbe2ba1feb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 19:58:36 +0200 +Subject: seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors + +From: Andrea Mayer + +[ Upstream commit f048880fc77058d864aff5c674af7918b30f312a ] + +The SRv6 End.B6 and End.B6.Encaps behaviors rely on functions +seg6_do_srh_{encap,inline}() to, respectively: i) encapsulate the +packet within an outer IPv6 header with the specified Segment Routing +Header (SRH); ii) insert the specified SRH directly after the IPv6 +header of the packet. + +This patch removes the initialization of the IPv6 header payload length +from the input_action_end_b6{_encap}() functions, as it is now handled +properly by seg6_do_srh_{encap,inline}() to avoid corruption of the skb +checksum. + +Fixes: 140f04c33bbc ("ipv6: sr: implement several seg6local actions") +Signed-off-by: Andrea Mayer +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv6/seg6_local.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c +index 98a34287439c..2cd4a8d3b30a 100644 +--- a/net/ipv6/seg6_local.c ++++ b/net/ipv6/seg6_local.c +@@ -826,7 +826,6 @@ static int input_action_end_b6(struct sk_buff *skb, struct seg6_local_lwt *slwt) + if (err) + goto drop; + +- ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); + skb_set_transport_header(skb, sizeof(struct ipv6hdr)); + + seg6_lookup_nexthop(skb, NULL, 0); +@@ -858,7 +857,6 @@ static int input_action_end_b6_encap(struct sk_buff *skb, + if (err) + goto drop; + +- ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); + skb_set_transport_header(skb, sizeof(struct ipv6hdr)); + + seg6_lookup_nexthop(skb, NULL, 0); +-- +2.35.1 + diff --git a/queue-5.18/series b/queue-5.18/series index 4a297d3360a..57057ba2559 100644 --- a/queue-5.18/series +++ b/queue-5.18/series @@ -27,3 +27,120 @@ fs-remap-constrain-dedupe-of-eof-blocks.patch nilfs2-fix-incorrect-masking-of-permission-flags-for-symlinks.patch sh-convert-nommu-io-re-un-map-to-static-inline-functions.patch revert-evm-fix-memleak-in-init_desc.patch +reset-fix-devm-bulk-optional-exclusive-control-gette.patch +arm64-dts-ls1028a-update-sfp-node-to-include-clock.patch +arm-dts-imx6qdl-ts7970-fix-ngpio-typo-and-count.patch +riscv-dts-microchip-hook-up-the-mpfs-l2cache.patch +spi-amd-limit-max-transfer-and-message-size.patch +arm-9209-1-spectre-bhb-avoid-pr_info-every-time-a-cp.patch +arm-9210-1-mark-the-fdt_fixed-sections-as-shareable.patch +net-mlx5e-ktls-fix-build-time-constant-test-in-tx.patch +net-mlx5e-ktls-fix-build-time-constant-test-in-rx.patch +net-mlx5e-fix-enabling-sriov-while-tc-nic-rules-are-.patch +net-mlx5e-ct-use-own-workqueue-instead-of-mlx5e-priv.patch +net-mlx5e-fix-capability-check-for-updating-vnic-env.patch +net-mlx5e-ring-the-tx-doorbell-on-dma-errors.patch +drm-amdgpu-keep-fbdev-buffers-pinned-during-suspend.patch +drm-amdgpu-display-disable-prefer_shadow-for-generic.patch +drm-i915-fix-a-possible-refcount-leak-in-intel_dp_ad.patch +drm-i915-guc-adl-n-should-use-the-same-guc-fw-as-adl.patch +ima-fix-a-potential-integer-overflow-in-ima_appraise.patch +asoc-sgtl5000-fix-noise-on-shutdown-remove.patch +asoc-tas2764-add-post-reset-delays.patch +asoc-tas2764-fix-and-extend-fsync-polarity-handling.patch +asoc-tas2764-correct-playback-volume-range.patch +asoc-tas2764-fix-amp-gain-register-offset-default.patch +asoc-intel-skylake-correct-the-ssp-rate-discovery-in.patch +asoc-intel-skylake-correct-the-handling-of-fmt_confi.patch +netfilter-ecache-move-to-separate-structure.patch +netfilter-conntrack-split-inner-loop-of-list-dumping.patch +netfilter-ecache-use-dedicated-list-for-event-redeli.patch +netfilter-conntrack-include-ecache-dying-list-in-dum.patch +netfilter-conntrack-remove-the-percpu-dying-list.patch +netfilter-conntrack-fix-crash-due-to-confirmed-bit-l.patch +net-stmmac-dwc-qos-disable-split-header-for-tegra194.patch +net-ethernet-ti-am65-cpsw-fix-devlink-port-register-.patch +net-ocelot-fix-wrong-time_after-usage.patch +sysctl-fix-data-races-in-proc_dointvec.patch +sysctl-fix-data-races-in-proc_douintvec.patch +sysctl-fix-data-races-in-proc_dointvec_minmax.patch +sysctl-fix-data-races-in-proc_douintvec_minmax.patch +sysctl-fix-data-races-in-proc_doulongvec_minmax.patch +sysctl-fix-data-races-in-proc_dointvec_jiffies.patch +tcp-fix-a-data-race-around-sysctl_tcp_max_orphans.patch +inetpeer-fix-data-races-around-sysctl.patch +net-fix-data-races-around-sysctl_mem.patch +cipso-fix-data-races-around-sysctl.patch +icmp-fix-data-races-around-sysctl.patch +ipv4-fix-a-data-race-around-sysctl_fib_sync_mem.patch +arm-dts-at91-sama5d2-fix-typo-in-i2s1-node.patch +arm-dts-sunxi-fix-spi-nor-campatible-on-orange-pi-ze.patch +arm64-dts-broadcom-bcm4908-fix-timer-node-for-bcm490.patch +arm64-dts-broadcom-bcm4908-fix-cpu-node-for-smp-boot.patch +netfilter-nf_log-incorrect-offset-to-network-header.patch +nfp-fix-issue-of-skb-segments-exceeds-descriptor-lim.patch +vlan-fix-memory-leak-in-vlan_newlink.patch +netfilter-nf_tables-replace-bug_on-by-element-length.patch +risc-v-kvm-fix-srcu-deadlock-caused-by-kvm_riscv_che.patch +drm-i915-gvt-is_err-vs-null-bug-in-intel_gvt_update_.patch +xen-gntdev-ignore-failure-to-unmap-invalid_grant_han.patch +mptcp-fix-subflow-traversal-at-disconnect-time.patch +nfsd-decode-nfsv4-birth-time-attribute.patch +lockd-set-fl_owner-when-unlocking-files.patch +lockd-fix-nlm_close_files.patch +net-marvell-prestera-fix-missed-deinit-sequence.patch +ice-handle-e822-generic-device-id-in-pldm-header.patch +ice-change-devlink-code-to-read-nvm-in-blocks.patch +tracing-fix-sleeping-while-atomic-in-kdb-ftdump.patch +drm-i915-selftests-fix-a-couple-is_err-vs-null-tests.patch +drm-i915-ttm-fix-sg_table-construction.patch +drm-i915-gt-serialize-grdom-access-between-multiple-.patch +drm-i915-gt-serialize-tlb-invalidates-with-gt-resets.patch +drm-i915-selftests-fix-subtraction-overflow-bug.patch +bnxt_en-reclaim-max-resources-if-sriov-enable-fails.patch +bnxt_en-fix-bnxt_reinit_after_abort-code-path.patch +bnxt_en-fix-livepatch-query.patch +bnxt_en-fix-bnxt_refclk_read.patch +sysctl-fix-data-races-in-proc_dou8vec_minmax.patch +sysctl-fix-data-races-in-proc_dointvec_ms_jiffies.patch +tcp-fix-a-data-race-around-sysctl_max_tw_buckets.patch +icmp-fix-a-data-race-around-sysctl_icmp_echo_ignore_.patch +icmp-fix-data-races-around-sysctl_icmp_echo_enable_p.patch +icmp-fix-a-data-race-around-sysctl_icmp_echo_ignore_.patch-4417 +icmp-fix-a-data-race-around-sysctl_icmp_ignore_bogus.patch +icmp-fix-a-data-race-around-sysctl_icmp_errors_use_i.patch +icmp-fix-a-data-race-around-sysctl_icmp_ratelimit.patch +icmp-fix-a-data-race-around-sysctl_icmp_ratemask.patch +raw-fix-a-data-race-around-sysctl_raw_l3mdev_accept.patch +tcp-fix-data-races-around-sysctl_tcp_ecn.patch +tcp-fix-a-data-race-around-sysctl_tcp_ecn_fallback.patch +ipv4-fix-data-races-around-sysctl_ip_dynaddr.patch +nexthop-fix-data-races-around-nexthop_compat_mode.patch +net-ftgmac100-hold-reference-returned-by-of_get_chil.patch +net-stmmac-fix-leaks-in-probe.patch +ima-force-signature-verification-when-config_kexec_s.patch +ima-fix-potential-memory-leak-in-ima_init_crypto.patch +drm-amd-display-ignore-first-mst-sideband-message-re.patch +drm-amdkfd-correct-the-mec-atomic-support-firmware-c.patch +drm-amd-display-only-use-depth-36-bpp-linebuffers-on.patch +drm-amd-pm-prevent-divide-by-zero.patch +drm-amd-display-ensure-valid-event-timestamp-for-cur.patch +smb3-workaround-negprot-bug-in-some-samba-servers.patch +sfc-fix-use-after-free-when-disabling-sriov.patch +netfs-do-not-unlock-and-put-the-folio-twice.patch +seg6-fix-skb-checksum-evaluation-in-srh-encapsulatio.patch +seg6-fix-skb-checksum-in-srv6-end.b6-and-end.b6.enca.patch +seg6-bpf-fix-skb-checksum-in-bpf_push_seg6_encap.patch +sfc-fix-kernel-panic-when-creating-vf.patch +net-atlantic-remove-deep-parameter-on-suspend-resume.patch +net-atlantic-remove-aq_nic_deinit-when-resume.patch +kvm-x86-fully-initialize-struct-kvm_lapic_irq-in-kvm.patch +net-tls-check-for-errors-in-tls_device_init.patch +acpi-video-fix-acpi_video_handles_brightness_key_pre.patch +mm-sysctl-fix-missing-numa_stat-when-config_hugetlb_.patch +x86-kvm-fix-setcc-emulation-for-return-thunks.patch +x86-sev-avoid-using-__x86_return_thunk.patch +x86-bugs-report-amd-retbleed-vulnerability.patch +objtool-update-retpoline-validation.patch +x86-xen-rename-sys-entry-points.patch +x86-cpu-amd-add-spectral-chicken.patch diff --git a/queue-5.18/sfc-fix-kernel-panic-when-creating-vf.patch b/queue-5.18/sfc-fix-kernel-panic-when-creating-vf.patch new file mode 100644 index 00000000000..fa86c6ad638 --- /dev/null +++ b/queue-5.18/sfc-fix-kernel-panic-when-creating-vf.patch @@ -0,0 +1,71 @@ +From bd5eab81befc582433c7d1ce82a09c7c059eb4ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 11:21:16 +0200 +Subject: sfc: fix kernel panic when creating VF +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Íñigo Huguet + +[ Upstream commit ada74c5539eba06cf8b47d068f92e0b3963a9a6e ] + +When creating VFs a kernel panic can happen when calling to +efx_ef10_try_update_nic_stats_vf. + +When releasing a DMA coherent buffer, sometimes, I don't know in what +specific circumstances, it has to unmap memory with vunmap. It is +disallowed to do that in IRQ context or with BH disabled. Otherwise, we +hit this line in vunmap, causing the crash: + BUG_ON(in_interrupt()); + +This patch reenables BH to release the buffer. + +Log messages when the bug is hit: + kernel BUG at mm/vmalloc.c:2727! + invalid opcode: 0000 [#1] PREEMPT SMP NOPTI + CPU: 6 PID: 1462 Comm: NetworkManager Kdump: loaded Tainted: G I --------- --- 5.14.0-119.el9.x86_64 #1 + Hardware name: Dell Inc. PowerEdge R740/06WXJT, BIOS 2.8.2 08/27/2020 + RIP: 0010:vunmap+0x2e/0x30 + ...skip... + Call Trace: + __iommu_dma_free+0x96/0x100 + efx_nic_free_buffer+0x2b/0x40 [sfc] + efx_ef10_try_update_nic_stats_vf+0x14a/0x1c0 [sfc] + efx_ef10_update_stats_vf+0x18/0x40 [sfc] + efx_start_all+0x15e/0x1d0 [sfc] + efx_net_open+0x5a/0xe0 [sfc] + __dev_open+0xe7/0x1a0 + __dev_change_flags+0x1d7/0x240 + dev_change_flags+0x21/0x60 + ...skip... + +Fixes: d778819609a2 ("sfc: DMA the VF stats only when requested") +Reported-by: Ma Yuying +Signed-off-by: Íñigo Huguet +Acked-by: Edward Cree +Link: https://lore.kernel.org/r/20220713092116.21238-1-ihuguet@redhat.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/ef10.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c +index 186cb28c03bd..8b62ce21aff3 100644 +--- a/drivers/net/ethernet/sfc/ef10.c ++++ b/drivers/net/ethernet/sfc/ef10.c +@@ -1932,7 +1932,10 @@ static int efx_ef10_try_update_nic_stats_vf(struct efx_nic *efx) + + efx_update_sw_stats(efx, stats); + out: ++ /* releasing a DMA coherent buffer with BH disabled can panic */ ++ spin_unlock_bh(&efx->stats_lock); + efx_nic_free_buffer(efx, &stats_buf); ++ spin_lock_bh(&efx->stats_lock); + return rc; + } + +-- +2.35.1 + diff --git a/queue-5.18/sfc-fix-use-after-free-when-disabling-sriov.patch b/queue-5.18/sfc-fix-use-after-free-when-disabling-sriov.patch new file mode 100644 index 00000000000..0673d707c59 --- /dev/null +++ b/queue-5.18/sfc-fix-use-after-free-when-disabling-sriov.patch @@ -0,0 +1,113 @@ +From e24a78c1dd957cdc5422a4814b7e195ba8e2a5f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 08:26:42 +0200 +Subject: sfc: fix use after free when disabling sriov +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Íñigo Huguet + +[ Upstream commit ebe41da5d47ac0fff877e57bd14c54dccf168827 ] + +Use after free is detected by kfence when disabling sriov. What was read +after being freed was vf->pci_dev: it was freed from pci_disable_sriov +and later read in efx_ef10_sriov_free_vf_vports, called from +efx_ef10_sriov_free_vf_vswitching. + +Set the pointer to NULL at release time to not trying to read it later. + +Reproducer and dmesg log (note that kfence doesn't detect it every time): +$ echo 1 > /sys/class/net/enp65s0f0np0/device/sriov_numvfs +$ echo 0 > /sys/class/net/enp65s0f0np0/device/sriov_numvfs + + BUG: KFENCE: use-after-free read in efx_ef10_sriov_free_vf_vswitching+0x82/0x170 [sfc] + + Use-after-free read at 0x00000000ff3c1ba5 (in kfence-#224): + efx_ef10_sriov_free_vf_vswitching+0x82/0x170 [sfc] + efx_ef10_pci_sriov_disable+0x38/0x70 [sfc] + efx_pci_sriov_configure+0x24/0x40 [sfc] + sriov_numvfs_store+0xfe/0x140 + kernfs_fop_write_iter+0x11c/0x1b0 + new_sync_write+0x11f/0x1b0 + vfs_write+0x1eb/0x280 + ksys_write+0x5f/0xe0 + do_syscall_64+0x5c/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + + kfence-#224: 0x00000000edb8ef95-0x00000000671f5ce1, size=2792, cache=kmalloc-4k + + allocated by task 6771 on cpu 10 at 3137.860196s: + pci_alloc_dev+0x21/0x60 + pci_iov_add_virtfn+0x2a2/0x320 + sriov_enable+0x212/0x3e0 + efx_ef10_sriov_configure+0x67/0x80 [sfc] + efx_pci_sriov_configure+0x24/0x40 [sfc] + sriov_numvfs_store+0xba/0x140 + kernfs_fop_write_iter+0x11c/0x1b0 + new_sync_write+0x11f/0x1b0 + vfs_write+0x1eb/0x280 + ksys_write+0x5f/0xe0 + do_syscall_64+0x5c/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + + freed by task 6771 on cpu 12 at 3170.991309s: + device_release+0x34/0x90 + kobject_cleanup+0x3a/0x130 + pci_iov_remove_virtfn+0xd9/0x120 + sriov_disable+0x30/0xe0 + efx_ef10_pci_sriov_disable+0x57/0x70 [sfc] + efx_pci_sriov_configure+0x24/0x40 [sfc] + sriov_numvfs_store+0xfe/0x140 + kernfs_fop_write_iter+0x11c/0x1b0 + new_sync_write+0x11f/0x1b0 + vfs_write+0x1eb/0x280 + ksys_write+0x5f/0xe0 + do_syscall_64+0x5c/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Fixes: 3c5eb87605e85 ("sfc: create vports for VFs and assign random MAC addresses") +Reported-by: Yanghang Liu +Signed-off-by: Íñigo Huguet +Acked-by: Martin Habets +Link: https://lore.kernel.org/r/20220712062642.6915-1-ihuguet@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/ef10_sriov.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/sfc/ef10_sriov.c b/drivers/net/ethernet/sfc/ef10_sriov.c +index 7f5aa4a8c451..92550c7e85ce 100644 +--- a/drivers/net/ethernet/sfc/ef10_sriov.c ++++ b/drivers/net/ethernet/sfc/ef10_sriov.c +@@ -408,8 +408,9 @@ static int efx_ef10_pci_sriov_enable(struct efx_nic *efx, int num_vfs) + static int efx_ef10_pci_sriov_disable(struct efx_nic *efx, bool force) + { + struct pci_dev *dev = efx->pci_dev; ++ struct efx_ef10_nic_data *nic_data = efx->nic_data; + unsigned int vfs_assigned = pci_vfs_assigned(dev); +- int rc = 0; ++ int i, rc = 0; + + if (vfs_assigned && !force) { + netif_info(efx, drv, efx->net_dev, "VFs are assigned to guests; " +@@ -417,10 +418,13 @@ static int efx_ef10_pci_sriov_disable(struct efx_nic *efx, bool force) + return -EBUSY; + } + +- if (!vfs_assigned) ++ if (!vfs_assigned) { ++ for (i = 0; i < efx->vf_count; i++) ++ nic_data->vf[i].pci_dev = NULL; + pci_disable_sriov(dev); +- else ++ } else { + rc = -EBUSY; ++ } + + efx_ef10_sriov_free_vf_vswitching(efx); + efx->vf_count = 0; +-- +2.35.1 + diff --git a/queue-5.18/smb3-workaround-negprot-bug-in-some-samba-servers.patch b/queue-5.18/smb3-workaround-negprot-bug-in-some-samba-servers.patch new file mode 100644 index 00000000000..319ba729809 --- /dev/null +++ b/queue-5.18/smb3-workaround-negprot-bug-in-some-samba-servers.patch @@ -0,0 +1,63 @@ +From e489d0d508b1be5dcaf7cdcfe787d0a434c4e4ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 00:11:42 -0500 +Subject: smb3: workaround negprot bug in some Samba servers + +From: Steve French + +[ Upstream commit 32f319183c439b239294cb2d70ada3564c4c7c39 ] + +Mount can now fail to older Samba servers due to a server +bug handling padding at the end of the last negotiate +context (negotiate contexts typically are rounded up to 8 +bytes by adding padding if needed). This server bug can +be avoided by switching the order of negotiate contexts, +placing a negotiate context at the end that does not +require padding (prior to the recent netname context fix +this was the case on the client). + +Fixes: 73130a7b1ac9 ("smb3: fix empty netname context on secondary channels") +Reported-by: Julian Sikorski +Tested-by: Julian Sikorski +Reviewed-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2pdu.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 6a8a00f28b19..2e6c0f4d8449 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -571,10 +571,6 @@ assemble_neg_contexts(struct smb2_negotiate_req *req, + *total_len += ctxt_len; + pneg_ctxt += ctxt_len; + +- build_posix_ctxt((struct smb2_posix_neg_context *)pneg_ctxt); +- *total_len += sizeof(struct smb2_posix_neg_context); +- pneg_ctxt += sizeof(struct smb2_posix_neg_context); +- + /* + * secondary channels don't have the hostname field populated + * use the hostname field in the primary channel instead +@@ -586,9 +582,14 @@ assemble_neg_contexts(struct smb2_negotiate_req *req, + hostname); + *total_len += ctxt_len; + pneg_ctxt += ctxt_len; +- neg_context_count = 4; +- } else /* second channels do not have a hostname */ + neg_context_count = 3; ++ } else ++ neg_context_count = 2; ++ ++ build_posix_ctxt((struct smb2_posix_neg_context *)pneg_ctxt); ++ *total_len += sizeof(struct smb2_posix_neg_context); ++ pneg_ctxt += sizeof(struct smb2_posix_neg_context); ++ neg_context_count++; + + if (server->compress_algorithm) { + build_compression_ctxt((struct smb2_compression_capabilities_context *) +-- +2.35.1 + diff --git a/queue-5.18/spi-amd-limit-max-transfer-and-message-size.patch b/queue-5.18/spi-amd-limit-max-transfer-and-message-size.patch new file mode 100644 index 00000000000..65e5f0fef94 --- /dev/null +++ b/queue-5.18/spi-amd-limit-max-transfer-and-message-size.patch @@ -0,0 +1,70 @@ +From 186902be4bbe431a355fb3149156b67771c0e3ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 13:06:22 +0300 +Subject: spi: amd: Limit max transfer and message size + +From: Cristian Ciocaltea + +[ Upstream commit 6ece49c56965544262523dae4a071ace3db63507 ] + +Enabling the SPI CS35L41 audio codec driver for Steam Deck [1] +revealed a problem with the current AMD SPI controller driver +implementation, consisting of an unrecoverable system hang. + +The issue can be prevented if we ensure the max transfer size +and the max message size do not exceed the FIFO buffer size. + +According to the implementation of the downstream driver, the +AMD SPI controller is not able to handle more than 70 bytes per +transfer, which corresponds to the size of the FIFO buffer. + +Hence, let's fix this by setting the SPI limits mentioned above. + +[1] https://lore.kernel.org/r/20220621213819.262537-1-cristian.ciocaltea@collabora.com + +Reported-by: Anastasios Vacharakis +Fixes: bbb336f39efc ("spi: spi-amd: Add AMD SPI controller driver support") +Signed-off-by: Cristian Ciocaltea +Link: https://lore.kernel.org/r/20220706100626.1234731-2-cristian.ciocaltea@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-amd.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/spi/spi-amd.c b/drivers/spi/spi-amd.c +index cba6a4486c24..efdcbe6c4c26 100644 +--- a/drivers/spi/spi-amd.c ++++ b/drivers/spi/spi-amd.c +@@ -33,6 +33,7 @@ + #define AMD_SPI_RX_COUNT_REG 0x4B + #define AMD_SPI_STATUS_REG 0x4C + ++#define AMD_SPI_FIFO_SIZE 70 + #define AMD_SPI_MEM_SIZE 200 + + /* M_CMD OP codes for SPI */ +@@ -270,6 +271,11 @@ static int amd_spi_master_transfer(struct spi_master *master, + return 0; + } + ++static size_t amd_spi_max_transfer_size(struct spi_device *spi) ++{ ++ return AMD_SPI_FIFO_SIZE; ++} ++ + static int amd_spi_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; +@@ -302,6 +308,8 @@ static int amd_spi_probe(struct platform_device *pdev) + master->flags = SPI_MASTER_HALF_DUPLEX; + master->setup = amd_spi_master_setup; + master->transfer_one_message = amd_spi_master_transfer; ++ master->max_transfer_size = amd_spi_max_transfer_size; ++ master->max_message_size = amd_spi_max_transfer_size; + + /* Register the controller with SPI framework */ + err = devm_spi_register_master(dev, master); +-- +2.35.1 + diff --git a/queue-5.18/sysctl-fix-data-races-in-proc_dointvec.patch b/queue-5.18/sysctl-fix-data-races-in-proc_dointvec.patch new file mode 100644 index 00000000000..b0a13b527e6 --- /dev/null +++ b/queue-5.18/sysctl-fix-data-races-in-proc_dointvec.patch @@ -0,0 +1,51 @@ +From 8dacdd65cebdd87ea541e368ee00f504dcb6a6f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:39:52 -0700 +Subject: sysctl: Fix data races in proc_dointvec(). + +From: Kuniyuki Iwashima + +[ Upstream commit 1f1be04b4d48a2475ea1aab46a99221bfc5c0968 ] + +A sysctl variable is accessed concurrently, and there is always a chance +of data-race. So, all readers and writers need some basic protection to +avoid load/store-tearing. + +This patch changes proc_dointvec() to use READ_ONCE() and WRITE_ONCE() +internally to fix data-races on the sysctl side. For now, proc_dointvec() +itself is tolerant to a data-race, but we still need to add annotations on +the other subsystem's side. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 830aaf8ca08e..27b3a55dc4bd 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -518,14 +518,14 @@ static int do_proc_dointvec_conv(bool *negp, unsigned long *lvalp, + if (*negp) { + if (*lvalp > (unsigned long) INT_MAX + 1) + return -EINVAL; +- *valp = -*lvalp; ++ WRITE_ONCE(*valp, -*lvalp); + } else { + if (*lvalp > (unsigned long) INT_MAX) + return -EINVAL; +- *valp = *lvalp; ++ WRITE_ONCE(*valp, *lvalp); + } + } else { +- int val = *valp; ++ int val = READ_ONCE(*valp); + if (val < 0) { + *negp = true; + *lvalp = -(unsigned long)val; +-- +2.35.1 + diff --git a/queue-5.18/sysctl-fix-data-races-in-proc_dointvec_jiffies.patch b/queue-5.18/sysctl-fix-data-races-in-proc_dointvec_jiffies.patch new file mode 100644 index 00000000000..1e6ab5cbb5c --- /dev/null +++ b/queue-5.18/sysctl-fix-data-races-in-proc_dointvec_jiffies.patch @@ -0,0 +1,48 @@ +From 1ec5abdf8a4c9701c02364ea350a566dd4181b3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:39:57 -0700 +Subject: sysctl: Fix data races in proc_dointvec_jiffies(). + +From: Kuniyuki Iwashima + +[ Upstream commit e877820877663fbae8cb9582ea597a7230b94df3 ] + +A sysctl variable is accessed concurrently, and there is always a chance +of data-race. So, all readers and writers need some basic protection to +avoid load/store-tearing. + +This patch changes proc_dointvec_jiffies() to use READ_ONCE() and +WRITE_ONCE() internally to fix data-races on the sysctl side. For now, +proc_dointvec_jiffies() itself is tolerant to a data-race, but we still +need to add annotations on the other subsystem's side. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 7a8899f237a2..878b1122cb89 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -1245,9 +1245,12 @@ static int do_proc_dointvec_jiffies_conv(bool *negp, unsigned long *lvalp, + if (write) { + if (*lvalp > INT_MAX / HZ) + return 1; +- *valp = *negp ? -(*lvalp*HZ) : (*lvalp*HZ); ++ if (*negp) ++ WRITE_ONCE(*valp, -*lvalp * HZ); ++ else ++ WRITE_ONCE(*valp, *lvalp * HZ); + } else { +- int val = *valp; ++ int val = READ_ONCE(*valp); + unsigned long lval; + if (val < 0) { + *negp = true; +-- +2.35.1 + diff --git a/queue-5.18/sysctl-fix-data-races-in-proc_dointvec_minmax.patch b/queue-5.18/sysctl-fix-data-races-in-proc_dointvec_minmax.patch new file mode 100644 index 00000000000..3184514901d --- /dev/null +++ b/queue-5.18/sysctl-fix-data-races-in-proc_dointvec_minmax.patch @@ -0,0 +1,42 @@ +From 269aced08b4fb3a49c4ada45ebe1a5c80ca28bdb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:39:54 -0700 +Subject: sysctl: Fix data races in proc_dointvec_minmax(). + +From: Kuniyuki Iwashima + +[ Upstream commit f613d86d014b6375a4085901de39406598121e35 ] + +A sysctl variable is accessed concurrently, and there is always a chance +of data-race. So, all readers and writers need some basic protection to +avoid load/store-tearing. + +This patch changes proc_dointvec_minmax() to use READ_ONCE() and +WRITE_ONCE() internally to fix data-races on the sysctl side. For now, +proc_dointvec_minmax() itself is tolerant to a data-race, but we still +need to add annotations on the other subsystem's side. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 6c61e2992fed..22ebf3f5eefe 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -929,7 +929,7 @@ static int do_proc_dointvec_minmax_conv(bool *negp, unsigned long *lvalp, + if ((param->min && *param->min > tmp) || + (param->max && *param->max < tmp)) + return -EINVAL; +- *valp = tmp; ++ WRITE_ONCE(*valp, tmp); + } + + return 0; +-- +2.35.1 + diff --git a/queue-5.18/sysctl-fix-data-races-in-proc_dointvec_ms_jiffies.patch b/queue-5.18/sysctl-fix-data-races-in-proc_dointvec_ms_jiffies.patch new file mode 100644 index 00000000000..396bb59f222 --- /dev/null +++ b/queue-5.18/sysctl-fix-data-races-in-proc_dointvec_ms_jiffies.patch @@ -0,0 +1,56 @@ +From 7ab4dde94c41fb9ae6a74956dae8b2534b7b927e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:20 -0700 +Subject: sysctl: Fix data-races in proc_dointvec_ms_jiffies(). + +From: Kuniyuki Iwashima + +[ Upstream commit 7d1025e559782b58824b36cb8ad547a69f2e4b31 ] + +A sysctl variable is accessed concurrently, and there is always a chance +of data-race. So, all readers and writers need some basic protection to +avoid load/store-tearing. + +This patch changes proc_dointvec_ms_jiffies() to use READ_ONCE() and +WRITE_ONCE() internally to fix data-races on the sysctl side. For now, +proc_dointvec_ms_jiffies() itself is tolerant to a data-race, but we still +need to add annotations on the other subsystem's side. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 54ec36e69907..f165ea67dd33 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -1296,9 +1296,9 @@ static int do_proc_dointvec_ms_jiffies_conv(bool *negp, unsigned long *lvalp, + + if (jif > INT_MAX) + return 1; +- *valp = (int)jif; ++ WRITE_ONCE(*valp, (int)jif); + } else { +- int val = *valp; ++ int val = READ_ONCE(*valp); + unsigned long lval; + if (val < 0) { + *negp = true; +@@ -1366,8 +1366,8 @@ int proc_dointvec_userhz_jiffies(struct ctl_table *table, int write, + * @ppos: the current position in the file + * + * Reads/writes up to table->maxlen/sizeof(unsigned int) integer +- * values from/to the user buffer, treated as an ASCII string. +- * The values read are assumed to be in 1/1000 seconds, and ++ * values from/to the user buffer, treated as an ASCII string. ++ * The values read are assumed to be in 1/1000 seconds, and + * are converted into jiffies. + * + * Returns 0 on success. +-- +2.35.1 + diff --git a/queue-5.18/sysctl-fix-data-races-in-proc_dou8vec_minmax.patch b/queue-5.18/sysctl-fix-data-races-in-proc_dou8vec_minmax.patch new file mode 100644 index 00000000000..e0a77acb670 --- /dev/null +++ b/queue-5.18/sysctl-fix-data-races-in-proc_dou8vec_minmax.patch @@ -0,0 +1,49 @@ +From 9972fe50cd98fd1d3ba3f13274413043a869cea5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:19 -0700 +Subject: sysctl: Fix data-races in proc_dou8vec_minmax(). + +From: Kuniyuki Iwashima + +[ Upstream commit 7dee5d7747a69aa2be41f04c6a7ecfe3ac8cdf18 ] + +A sysctl variable is accessed concurrently, and there is always a chance +of data-race. So, all readers and writers need some basic protection to +avoid load/store-tearing. + +This patch changes proc_dou8vec_minmax() to use READ_ONCE() and +WRITE_ONCE() internally to fix data-races on the sysctl side. For now, +proc_dou8vec_minmax() itself is tolerant to a data-race, but we still +need to add annotations on the other subsystem's side. + +Fixes: cb9444130662 ("sysctl: add proc_dou8vec_minmax()") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 878b1122cb89..54ec36e69907 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -1079,13 +1079,13 @@ int proc_dou8vec_minmax(struct ctl_table *table, int write, + + tmp.maxlen = sizeof(val); + tmp.data = &val; +- val = *data; ++ val = READ_ONCE(*data); + res = do_proc_douintvec(&tmp, write, buffer, lenp, ppos, + do_proc_douintvec_minmax_conv, ¶m); + if (res) + return res; + if (write) +- *data = val; ++ WRITE_ONCE(*data, val); + return 0; + } + EXPORT_SYMBOL_GPL(proc_dou8vec_minmax); +-- +2.35.1 + diff --git a/queue-5.18/sysctl-fix-data-races-in-proc_douintvec.patch b/queue-5.18/sysctl-fix-data-races-in-proc_douintvec.patch new file mode 100644 index 00000000000..d9df10ae830 --- /dev/null +++ b/queue-5.18/sysctl-fix-data-races-in-proc_douintvec.patch @@ -0,0 +1,45 @@ +From ad1caaff9f0668d52985908887491e119c0ecf02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:39:53 -0700 +Subject: sysctl: Fix data races in proc_douintvec(). + +From: Kuniyuki Iwashima + +[ Upstream commit 4762b532ec9539755aab61445d5da6e1926ccb99 ] + +A sysctl variable is accessed concurrently, and there is always a chance +of data-race. So, all readers and writers need some basic protection to +avoid load/store-tearing. + +This patch changes proc_douintvec() to use READ_ONCE() and WRITE_ONCE() +internally to fix data-races on the sysctl side. For now, proc_douintvec() +itself is tolerant to a data-race, but we still need to add annotations on +the other subsystem's side. + +Fixes: e7d316a02f68 ("sysctl: handle error writing UINT_MAX to u32 fields") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 27b3a55dc4bd..6c61e2992fed 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -544,9 +544,9 @@ static int do_proc_douintvec_conv(unsigned long *lvalp, + if (write) { + if (*lvalp > UINT_MAX) + return -EINVAL; +- *valp = *lvalp; ++ WRITE_ONCE(*valp, *lvalp); + } else { +- unsigned int val = *valp; ++ unsigned int val = READ_ONCE(*valp); + *lvalp = (unsigned long)val; + } + return 0; +-- +2.35.1 + diff --git a/queue-5.18/sysctl-fix-data-races-in-proc_douintvec_minmax.patch b/queue-5.18/sysctl-fix-data-races-in-proc_douintvec_minmax.patch new file mode 100644 index 00000000000..09bab0a14d1 --- /dev/null +++ b/queue-5.18/sysctl-fix-data-races-in-proc_douintvec_minmax.patch @@ -0,0 +1,42 @@ +From 27411b266b4c0688c1a26d7940d268271872b886 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:39:55 -0700 +Subject: sysctl: Fix data races in proc_douintvec_minmax(). + +From: Kuniyuki Iwashima + +[ Upstream commit 2d3b559df3ed39258737789aae2ae7973d205bc1 ] + +A sysctl variable is accessed concurrently, and there is always a chance +of data-race. So, all readers and writers need some basic protection to +avoid load/store-tearing. + +This patch changes proc_douintvec_minmax() to use READ_ONCE() and +WRITE_ONCE() internally to fix data-races on the sysctl side. For now, +proc_douintvec_minmax() itself is tolerant to a data-race, but we still +need to add annotations on the other subsystem's side. + +Fixes: 61d9b56a8920 ("sysctl: add unsigned int range support") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 22ebf3f5eefe..a769f64a78ed 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -995,7 +995,7 @@ static int do_proc_douintvec_minmax_conv(unsigned long *lvalp, + (param->max && *param->max < tmp)) + return -ERANGE; + +- *valp = tmp; ++ WRITE_ONCE(*valp, tmp); + } + + return 0; +-- +2.35.1 + diff --git a/queue-5.18/sysctl-fix-data-races-in-proc_doulongvec_minmax.patch b/queue-5.18/sysctl-fix-data-races-in-proc_doulongvec_minmax.patch new file mode 100644 index 00000000000..c185f00e492 --- /dev/null +++ b/queue-5.18/sysctl-fix-data-races-in-proc_doulongvec_minmax.patch @@ -0,0 +1,45 @@ +From 38f488e5935fb476f1bc42f0e379a2ff33cbfab6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:39:56 -0700 +Subject: sysctl: Fix data races in proc_doulongvec_minmax(). + +From: Kuniyuki Iwashima + +[ Upstream commit c31bcc8fb89fc2812663900589c6325ba35d9a65 ] + +A sysctl variable is accessed concurrently, and there is always a chance +of data-race. So, all readers and writers need some basic protection to +avoid load/store-tearing. + +This patch changes proc_doulongvec_minmax() to use READ_ONCE() and +WRITE_ONCE() internally to fix data-races on the sysctl side. For now, +proc_doulongvec_minmax() itself is tolerant to a data-race, but we still +need to add annotations on the other subsystem's side. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index a769f64a78ed..7a8899f237a2 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -1162,9 +1162,9 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, + err = -EINVAL; + break; + } +- *i = val; ++ WRITE_ONCE(*i, val); + } else { +- val = convdiv * (*i) / convmul; ++ val = convdiv * READ_ONCE(*i) / convmul; + if (!first) + proc_put_char(&buffer, &left, '\t'); + proc_put_long(&buffer, &left, val, false); +-- +2.35.1 + diff --git a/queue-5.18/tcp-fix-a-data-race-around-sysctl_max_tw_buckets.patch b/queue-5.18/tcp-fix-a-data-race-around-sysctl_max_tw_buckets.patch new file mode 100644 index 00000000000..425fe740632 --- /dev/null +++ b/queue-5.18/tcp-fix-a-data-race-around-sysctl_max_tw_buckets.patch @@ -0,0 +1,37 @@ +From 4f408fc55de0f7482c7a89d9417f35648bc07ef9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:21 -0700 +Subject: tcp: Fix a data-race around sysctl_max_tw_buckets. + +From: Kuniyuki Iwashima + +[ Upstream commit 6f605b57f3782114e330e108ce1903ede22ec675 ] + +While reading sysctl_max_tw_buckets, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/inet_timewait_sock.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c +index 0ec501845cb3..47ccc343c9fb 100644 +--- a/net/ipv4/inet_timewait_sock.c ++++ b/net/ipv4/inet_timewait_sock.c +@@ -156,7 +156,8 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, + { + struct inet_timewait_sock *tw; + +- if (refcount_read(&dr->tw_refcount) - 1 >= dr->sysctl_max_tw_buckets) ++ if (refcount_read(&dr->tw_refcount) - 1 >= ++ READ_ONCE(dr->sysctl_max_tw_buckets)) + return NULL; + + tw = kmem_cache_alloc(sk->sk_prot_creator->twsk_prot->twsk_slab, +-- +2.35.1 + diff --git a/queue-5.18/tcp-fix-a-data-race-around-sysctl_tcp_ecn_fallback.patch b/queue-5.18/tcp-fix-a-data-race-around-sysctl_tcp_ecn_fallback.patch new file mode 100644 index 00000000000..813ad0046b9 --- /dev/null +++ b/queue-5.18/tcp-fix-a-data-race-around-sysctl_tcp_ecn_fallback.patch @@ -0,0 +1,50 @@ +From 1c28c67b1b9a6964e6f27e8193a8cc61081ae2c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:31 -0700 +Subject: tcp: Fix a data-race around sysctl_tcp_ecn_fallback. + +From: Kuniyuki Iwashima + +[ Upstream commit 12b8d9ca7e678abc48195294494f1815b555d658 ] + +While reading sysctl_tcp_ecn_fallback, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: 492135557dc0 ("tcp: add rfc3168, section 6.1.1.1. fallback") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/sysctl_net_ipv4.c | 2 ++ + net/ipv4/tcp_output.c | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c +index 11add5214713..ffe0264a51b8 100644 +--- a/net/ipv4/sysctl_net_ipv4.c ++++ b/net/ipv4/sysctl_net_ipv4.c +@@ -689,6 +689,8 @@ static struct ctl_table ipv4_net_table[] = { + .maxlen = sizeof(u8), + .mode = 0644, + .proc_handler = proc_dou8vec_minmax, ++ .extra1 = SYSCTL_ZERO, ++ .extra2 = SYSCTL_ONE, + }, + { + .procname = "ip_dynaddr", +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 9eefe7f6370f..34249469e361 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -346,7 +346,7 @@ static void tcp_ecn_send_syn(struct sock *sk, struct sk_buff *skb) + + static void tcp_ecn_clear_syn(struct sock *sk, struct sk_buff *skb) + { +- if (sock_net(sk)->ipv4.sysctl_tcp_ecn_fallback) ++ if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_ecn_fallback)) + /* tp->ecn_flags are cleared at a later point in time when + * SYN ACK is ultimatively being received. + */ +-- +2.35.1 + diff --git a/queue-5.18/tcp-fix-a-data-race-around-sysctl_tcp_max_orphans.patch b/queue-5.18/tcp-fix-a-data-race-around-sysctl_tcp_max_orphans.patch new file mode 100644 index 00000000000..56f268de21f --- /dev/null +++ b/queue-5.18/tcp-fix-a-data-race-around-sysctl_tcp_max_orphans.patch @@ -0,0 +1,37 @@ +From a18e58594b70f96a4354decdec374e052926f387 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 16:39:58 -0700 +Subject: tcp: Fix a data-race around sysctl_tcp_max_orphans. + +From: Kuniyuki Iwashima + +[ Upstream commit 47e6ab24e8c6e3ca10ceb5835413f401f90de4bf ] + +While reading sysctl_tcp_max_orphans, it can be changed concurrently. +So, we need to add READ_ONCE() to avoid a data-race. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index e31cf137c614..f2fd1779d925 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2735,7 +2735,8 @@ static void tcp_orphan_update(struct timer_list *unused) + + static bool tcp_too_many_orphans(int shift) + { +- return READ_ONCE(tcp_orphan_cache) << shift > sysctl_tcp_max_orphans; ++ return READ_ONCE(tcp_orphan_cache) << shift > ++ READ_ONCE(sysctl_tcp_max_orphans); + } + + bool tcp_check_oom(struct sock *sk, int shift) +-- +2.35.1 + diff --git a/queue-5.18/tcp-fix-data-races-around-sysctl_tcp_ecn.patch b/queue-5.18/tcp-fix-data-races-around-sysctl_tcp_ecn.patch new file mode 100644 index 00000000000..3486d536d15 --- /dev/null +++ b/queue-5.18/tcp-fix-data-races-around-sysctl_tcp_ecn.patch @@ -0,0 +1,92 @@ +From d445a5240ca0df30b24b5beec905a8b5ae6c46d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:30 -0700 +Subject: tcp: Fix data-races around sysctl_tcp_ecn. + +From: Kuniyuki Iwashima + +[ Upstream commit 4785a66702f086cf2ea84bdbe6ec921f274bd9f2 ] + +While reading sysctl_tcp_ecn, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c | 2 +- + net/ipv4/syncookies.c | 2 +- + net/ipv4/sysctl_net_ipv4.c | 2 ++ + net/ipv4/tcp_input.c | 2 +- + net/ipv4/tcp_output.c | 2 +- + 5 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c +index 4af5561cbfc5..7c760aa65540 100644 +--- a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c ++++ b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c +@@ -1392,7 +1392,7 @@ static void chtls_pass_accept_request(struct sock *sk, + th_ecn = tcph->ece && tcph->cwr; + if (th_ecn) { + ect = !INET_ECN_is_not_ect(ip_dsfield); +- ecn_ok = sock_net(sk)->ipv4.sysctl_tcp_ecn; ++ ecn_ok = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_ecn); + if ((!ect && ecn_ok) || tcp_ca_needs_ecn(sk)) + inet_rsk(oreq)->ecn_ok = 1; + } +diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c +index f33c31dd7366..b387c4835155 100644 +--- a/net/ipv4/syncookies.c ++++ b/net/ipv4/syncookies.c +@@ -273,7 +273,7 @@ bool cookie_ecn_ok(const struct tcp_options_received *tcp_opt, + if (!ecn_ok) + return false; + +- if (net->ipv4.sysctl_tcp_ecn) ++ if (READ_ONCE(net->ipv4.sysctl_tcp_ecn)) + return true; + + return dst_feature(dst, RTAX_FEATURE_ECN); +diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c +index 33e65e79e46e..11add5214713 100644 +--- a/net/ipv4/sysctl_net_ipv4.c ++++ b/net/ipv4/sysctl_net_ipv4.c +@@ -680,6 +680,8 @@ static struct ctl_table ipv4_net_table[] = { + .maxlen = sizeof(u8), + .mode = 0644, + .proc_handler = proc_dou8vec_minmax, ++ .extra1 = SYSCTL_ZERO, ++ .extra2 = SYSCTL_TWO, + }, + { + .procname = "tcp_ecn_fallback", +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 6b8fcf79688b..2d71bcfcc759 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -6712,7 +6712,7 @@ static void tcp_ecn_create_request(struct request_sock *req, + + ect = !INET_ECN_is_not_ect(TCP_SKB_CB(skb)->ip_dsfield); + ecn_ok_dst = dst_feature(dst, DST_FEATURE_ECN_MASK); +- ecn_ok = net->ipv4.sysctl_tcp_ecn || ecn_ok_dst; ++ ecn_ok = READ_ONCE(net->ipv4.sysctl_tcp_ecn) || ecn_ok_dst; + + if (((!ect || th->res1) && ecn_ok) || tcp_ca_needs_ecn(listen_sk) || + (ecn_ok_dst & DST_FEATURE_ECN_CA) || +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 6b00c17c72aa..9eefe7f6370f 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -324,7 +324,7 @@ static void tcp_ecn_send_syn(struct sock *sk, struct sk_buff *skb) + { + struct tcp_sock *tp = tcp_sk(sk); + bool bpf_needs_ecn = tcp_bpf_ca_needs_ecn(sk); +- bool use_ecn = sock_net(sk)->ipv4.sysctl_tcp_ecn == 1 || ++ bool use_ecn = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_ecn) == 1 || + tcp_ca_needs_ecn(sk) || bpf_needs_ecn; + + if (!use_ecn) { +-- +2.35.1 + diff --git a/queue-5.18/tracing-fix-sleeping-while-atomic-in-kdb-ftdump.patch b/queue-5.18/tracing-fix-sleeping-while-atomic-in-kdb-ftdump.patch new file mode 100644 index 00000000000..fea66e952dd --- /dev/null +++ b/queue-5.18/tracing-fix-sleeping-while-atomic-in-kdb-ftdump.patch @@ -0,0 +1,71 @@ +From 8038429cae97fdfae64a7a784449952e3455081d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 17:09:52 -0700 +Subject: tracing: Fix sleeping while atomic in kdb ftdump + +From: Douglas Anderson + +[ Upstream commit 495fcec8648cdfb483b5b9ab310f3839f07cb3b8 ] + +If you drop into kdb and type "ftdump" you'll get a sleeping while +atomic warning from memory allocation in trace_find_next_entry(). + +This appears to have been caused by commit ff895103a84a ("tracing: +Save off entry when peeking at next entry"), which added the +allocation in that path. The problematic commit was already fixed by +commit 8e99cf91b99b ("tracing: Do not allocate buffer in +trace_find_next_entry() in atomic") but that fix missed the kdb case. + +The fix here is easy: just move the assignment of the static buffer to +the place where it should have been to begin with: +trace_init_global_iter(). That function is called in two places, once +is right before the assignment of the static buffer added by the +previous fix and once is in kdb. + +Note that it appears that there's a second static buffer that we need +to assign that was added in commit efbbdaa22bb7 ("tracing: Show real +address for trace event arguments"), so we'll move that too. + +Link: https://lkml.kernel.org/r/20220708170919.1.I75844e5038d9425add2ad853a608cb44bb39df40@changeid + +Fixes: ff895103a84a ("tracing: Save off entry when peeking at next entry") +Fixes: efbbdaa22bb7 ("tracing: Show real address for trace event arguments") +Signed-off-by: Douglas Anderson +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 114c31bdf8f9..c0c98b0c86e7 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -9863,6 +9863,12 @@ void trace_init_global_iter(struct trace_iterator *iter) + /* Output in nanoseconds only if we are using a clock in nanoseconds. */ + if (trace_clocks[iter->tr->clock_id].in_ns) + iter->iter_flags |= TRACE_FILE_TIME_IN_NS; ++ ++ /* Can not use kmalloc for iter.temp and iter.fmt */ ++ iter->temp = static_temp_buf; ++ iter->temp_size = STATIC_TEMP_BUF_SIZE; ++ iter->fmt = static_fmt_buf; ++ iter->fmt_size = STATIC_FMT_BUF_SIZE; + } + + void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) +@@ -9895,11 +9901,6 @@ void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) + + /* Simulate the iterator */ + trace_init_global_iter(&iter); +- /* Can not use kmalloc for iter.temp and iter.fmt */ +- iter.temp = static_temp_buf; +- iter.temp_size = STATIC_TEMP_BUF_SIZE; +- iter.fmt = static_fmt_buf; +- iter.fmt_size = STATIC_FMT_BUF_SIZE; + + for_each_tracing_cpu(cpu) { + atomic_inc(&per_cpu_ptr(iter.array_buffer->data, cpu)->disabled); +-- +2.35.1 + diff --git a/queue-5.18/vlan-fix-memory-leak-in-vlan_newlink.patch b/queue-5.18/vlan-fix-memory-leak-in-vlan_newlink.patch new file mode 100644 index 00000000000..5881956fe43 --- /dev/null +++ b/queue-5.18/vlan-fix-memory-leak-in-vlan_newlink.patch @@ -0,0 +1,92 @@ +From 933058b4627a72dda5ff8f5fb30416ecb0e1d39a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 15:11:53 +0000 +Subject: vlan: fix memory leak in vlan_newlink() + +From: Eric Dumazet + +[ Upstream commit 72a0b329114b1caa8e69dfa7cdad1dd3c69b8602 ] + +Blamed commit added back a bug I fixed in commit 9bbd917e0bec +("vlan: fix memory leak in vlan_dev_set_egress_priority") + +If a memory allocation fails in vlan_changelink() after other allocations +succeeded, we need to call vlan_dev_free_egress_priority() +to free all allocated memory because after a failed ->newlink() +we do not call any methods like ndo_uninit() or dev->priv_destructor(). + +In following example, if the allocation for last element 2000:2001 fails, +we need to free eight prior allocations: + +ip link add link dummy0 dummy0.100 type vlan id 100 \ + egress-qos-map 1:2 2:3 3:4 4:5 5:6 6:7 7:8 8:9 2000:2001 + +syzbot report was: + +BUG: memory leak +unreferenced object 0xffff888117bd1060 (size 32): +comm "syz-executor408", pid 3759, jiffies 4294956555 (age 34.090s) +hex dump (first 32 bytes): +09 00 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 ................ +00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ +backtrace: +[] kmalloc include/linux/slab.h:600 [inline] +[] vlan_dev_set_egress_priority+0xed/0x170 net/8021q/vlan_dev.c:193 +[] vlan_changelink+0x178/0x1d0 net/8021q/vlan_netlink.c:128 +[] vlan_newlink+0x148/0x260 net/8021q/vlan_netlink.c:185 +[] rtnl_newlink_create net/core/rtnetlink.c:3363 [inline] +[] __rtnl_newlink+0xa58/0xdc0 net/core/rtnetlink.c:3580 +[] rtnl_newlink+0x49/0x70 net/core/rtnetlink.c:3593 +[] rtnetlink_rcv_msg+0x21c/0x5c0 net/core/rtnetlink.c:6089 +[] netlink_rcv_skb+0x87/0x1d0 net/netlink/af_netlink.c:2501 +[] netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] +[] netlink_unicast+0x397/0x4c0 net/netlink/af_netlink.c:1345 +[] netlink_sendmsg+0x396/0x710 net/netlink/af_netlink.c:1921 +[] sock_sendmsg_nosec net/socket.c:714 [inline] +[] sock_sendmsg+0x56/0x80 net/socket.c:734 +[] ____sys_sendmsg+0x36c/0x390 net/socket.c:2488 +[] ___sys_sendmsg+0x8b/0xd0 net/socket.c:2542 +[] __sys_sendmsg net/socket.c:2571 [inline] +[] __do_sys_sendmsg net/socket.c:2580 [inline] +[] __se_sys_sendmsg net/socket.c:2578 [inline] +[] __x64_sys_sendmsg+0x78/0xf0 net/socket.c:2578 +[] do_syscall_x64 arch/x86/entry/common.c:50 [inline] +[] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 +[] entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Fixes: 37aa50c539bc ("vlan: introduce vlan_dev_free_egress_priority") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: Xin Long +Reviewed-by: Xin Long +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/8021q/vlan_netlink.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c +index 53b1955b027f..214532173536 100644 +--- a/net/8021q/vlan_netlink.c ++++ b/net/8021q/vlan_netlink.c +@@ -182,10 +182,14 @@ static int vlan_newlink(struct net *src_net, struct net_device *dev, + else if (dev->mtu > max_mtu) + return -EINVAL; + ++ /* Note: If this initial vlan_changelink() fails, we need ++ * to call vlan_dev_free_egress_priority() to free memory. ++ */ + err = vlan_changelink(dev, tb, data, extack); +- if (err) +- return err; +- err = register_vlan_dev(dev, extack); ++ ++ if (!err) ++ err = register_vlan_dev(dev, extack); ++ + if (err) + vlan_dev_free_egress_priority(dev); + return err; +-- +2.35.1 + diff --git a/queue-5.18/x86-bugs-report-amd-retbleed-vulnerability.patch b/queue-5.18/x86-bugs-report-amd-retbleed-vulnerability.patch new file mode 100644 index 00000000000..6e6fa1be689 --- /dev/null +++ b/queue-5.18/x86-bugs-report-amd-retbleed-vulnerability.patch @@ -0,0 +1,181 @@ +From 11ec092a5ddd50700e667a569d3337bdc54f5afb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jun 2022 23:15:49 +0200 +Subject: x86/bugs: Report AMD retbleed vulnerability + +From: Alexandre Chartre + +[ Upstream commit 6b80b59b3555706508008f1f127b5412c89c7fd8 ] + +Report that AMD x86 CPUs are vulnerable to the RETBleed (Arbitrary +Speculative Code Execution with Return Instructions) attack. + + [peterz: add hygon] + [kim: invert parity; fam15h] + +Co-developed-by: Kim Phillips +Signed-off-by: Kim Phillips +Signed-off-by: Alexandre Chartre +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Borislav Petkov +Reviewed-by: Josh Poimboeuf +Signed-off-by: Borislav Petkov +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/cpufeatures.h | 1 + + arch/x86/kernel/cpu/bugs.c | 13 +++++++++++++ + arch/x86/kernel/cpu/common.c | 19 +++++++++++++++++++ + drivers/base/cpu.c | 8 ++++++++ + include/linux/cpu.h | 2 ++ + 5 files changed, 43 insertions(+) + +diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h +index e17de69faa54..cf5553744e83 100644 +--- a/arch/x86/include/asm/cpufeatures.h ++++ b/arch/x86/include/asm/cpufeatures.h +@@ -444,5 +444,6 @@ + #define X86_BUG_ITLB_MULTIHIT X86_BUG(23) /* CPU may incur MCE during certain page attribute changes */ + #define X86_BUG_SRBDS X86_BUG(24) /* CPU may leak RNG bits if not mitigated */ + #define X86_BUG_MMIO_STALE_DATA X86_BUG(25) /* CPU is affected by Processor MMIO Stale Data vulnerabilities */ ++#define X86_BUG_RETBLEED X86_BUG(26) /* CPU is affected by RETBleed */ + + #endif /* _ASM_X86_CPUFEATURES_H */ +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index a8a9f6406331..425ff2f32669 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -1987,6 +1987,11 @@ static ssize_t srbds_show_state(char *buf) + return sprintf(buf, "%s\n", srbds_strings[srbds_mitigation]); + } + ++static ssize_t retbleed_show_state(char *buf) ++{ ++ return sprintf(buf, "Vulnerable\n"); ++} ++ + static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr, + char *buf, unsigned int bug) + { +@@ -2032,6 +2037,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr + case X86_BUG_MMIO_STALE_DATA: + return mmio_stale_data_show_state(buf); + ++ case X86_BUG_RETBLEED: ++ return retbleed_show_state(buf); ++ + default: + break; + } +@@ -2088,4 +2096,9 @@ ssize_t cpu_show_mmio_stale_data(struct device *dev, struct device_attribute *at + { + return cpu_show_common(dev, attr, buf, X86_BUG_MMIO_STALE_DATA); + } ++ ++ssize_t cpu_show_retbleed(struct device *dev, struct device_attribute *attr, char *buf) ++{ ++ return cpu_show_common(dev, attr, buf, X86_BUG_RETBLEED); ++} + #endif +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index af5d0c188f7b..796cc55313f4 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -1231,16 +1231,27 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = { + {} + }; + ++#define VULNBL(vendor, family, model, blacklist) \ ++ X86_MATCH_VENDOR_FAM_MODEL(vendor, family, model, blacklist) ++ + #define VULNBL_INTEL_STEPPINGS(model, steppings, issues) \ + X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(INTEL, 6, \ + INTEL_FAM6_##model, steppings, \ + X86_FEATURE_ANY, issues) + ++#define VULNBL_AMD(family, blacklist) \ ++ VULNBL(AMD, family, X86_MODEL_ANY, blacklist) ++ ++#define VULNBL_HYGON(family, blacklist) \ ++ VULNBL(HYGON, family, X86_MODEL_ANY, blacklist) ++ + #define SRBDS BIT(0) + /* CPU is affected by X86_BUG_MMIO_STALE_DATA */ + #define MMIO BIT(1) + /* CPU is affected by Shared Buffers Data Sampling (SBDS), a variant of X86_BUG_MMIO_STALE_DATA */ + #define MMIO_SBDS BIT(2) ++/* CPU is affected by RETbleed, speculating where you would not expect it */ ++#define RETBLEED BIT(3) + + static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { + VULNBL_INTEL_STEPPINGS(IVYBRIDGE, X86_STEPPING_ANY, SRBDS), +@@ -1273,6 +1284,11 @@ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { + VULNBL_INTEL_STEPPINGS(ATOM_TREMONT, X86_STEPPINGS(0x1, 0x1), MMIO | MMIO_SBDS), + VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_D, X86_STEPPING_ANY, MMIO), + VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L, X86_STEPPINGS(0x0, 0x0), MMIO | MMIO_SBDS), ++ ++ VULNBL_AMD(0x15, RETBLEED), ++ VULNBL_AMD(0x16, RETBLEED), ++ VULNBL_AMD(0x17, RETBLEED), ++ VULNBL_HYGON(0x18, RETBLEED), + {} + }; + +@@ -1374,6 +1390,9 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) + !arch_cap_mmio_immune(ia32_cap)) + setup_force_cpu_bug(X86_BUG_MMIO_STALE_DATA); + ++ if (cpu_matches(cpu_vuln_blacklist, RETBLEED)) ++ setup_force_cpu_bug(X86_BUG_RETBLEED); ++ + if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN)) + return; + +diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c +index a97776ea9d99..4c98849577d4 100644 +--- a/drivers/base/cpu.c ++++ b/drivers/base/cpu.c +@@ -570,6 +570,12 @@ ssize_t __weak cpu_show_mmio_stale_data(struct device *dev, + return sysfs_emit(buf, "Not affected\n"); + } + ++ssize_t __weak cpu_show_retbleed(struct device *dev, ++ struct device_attribute *attr, char *buf) ++{ ++ return sysfs_emit(buf, "Not affected\n"); ++} ++ + static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); + static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL); + static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL); +@@ -580,6 +586,7 @@ static DEVICE_ATTR(tsx_async_abort, 0444, cpu_show_tsx_async_abort, NULL); + static DEVICE_ATTR(itlb_multihit, 0444, cpu_show_itlb_multihit, NULL); + static DEVICE_ATTR(srbds, 0444, cpu_show_srbds, NULL); + static DEVICE_ATTR(mmio_stale_data, 0444, cpu_show_mmio_stale_data, NULL); ++static DEVICE_ATTR(retbleed, 0444, cpu_show_retbleed, NULL); + + static struct attribute *cpu_root_vulnerabilities_attrs[] = { + &dev_attr_meltdown.attr, +@@ -592,6 +599,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = { + &dev_attr_itlb_multihit.attr, + &dev_attr_srbds.attr, + &dev_attr_mmio_stale_data.attr, ++ &dev_attr_retbleed.attr, + NULL + }; + +diff --git a/include/linux/cpu.h b/include/linux/cpu.h +index 2c7477354744..314802f98b9d 100644 +--- a/include/linux/cpu.h ++++ b/include/linux/cpu.h +@@ -68,6 +68,8 @@ extern ssize_t cpu_show_srbds(struct device *dev, struct device_attribute *attr, + extern ssize_t cpu_show_mmio_stale_data(struct device *dev, + struct device_attribute *attr, + char *buf); ++extern ssize_t cpu_show_retbleed(struct device *dev, ++ struct device_attribute *attr, char *buf); + + extern __printf(4, 5) + struct device *cpu_device_create(struct device *parent, void *drvdata, +-- +2.35.1 + diff --git a/queue-5.18/x86-cpu-amd-add-spectral-chicken.patch b/queue-5.18/x86-cpu-amd-add-spectral-chicken.patch new file mode 100644 index 00000000000..47f514762ef --- /dev/null +++ b/queue-5.18/x86-cpu-amd-add-spectral-chicken.patch @@ -0,0 +1,117 @@ +From bbbf9cd770a7ba5109e077ca099dc062d1ad9518 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jun 2022 23:16:04 +0200 +Subject: x86/cpu/amd: Add Spectral Chicken + +From: Peter Zijlstra + +[ Upstream commit d7caac991feeef1b871ee6988fd2c9725df09039 ] + +Zen2 uarchs have an undocumented, unnamed, MSR that contains a chicken +bit for some speculation behaviour. It needs setting. + +Note: very belatedly AMD released naming; it's now officially called + MSR_AMD64_DE_CFG2 and MSR_AMD64_DE_CFG2_SUPPRESS_NOBR_PRED_BIT + but shall remain the SPECTRAL CHICKEN. + +Suggested-by: Andrew Cooper +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Borislav Petkov +Reviewed-by: Josh Poimboeuf +Signed-off-by: Borislav Petkov +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/msr-index.h | 3 +++ + arch/x86/kernel/cpu/amd.c | 23 ++++++++++++++++++++++- + arch/x86/kernel/cpu/cpu.h | 2 ++ + arch/x86/kernel/cpu/hygon.c | 6 ++++++ + 4 files changed, 33 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h +index 4425d6773183..d15d0ef6b357 100644 +--- a/arch/x86/include/asm/msr-index.h ++++ b/arch/x86/include/asm/msr-index.h +@@ -552,6 +552,9 @@ + /* Fam 17h MSRs */ + #define MSR_F17H_IRPERF 0xc00000e9 + ++#define MSR_ZEN2_SPECTRAL_CHICKEN 0xc00110e3 ++#define MSR_ZEN2_SPECTRAL_CHICKEN_BIT BIT_ULL(1) ++ + /* Fam 16h MSRs */ + #define MSR_F16H_L2I_PERF_CTL 0xc0010230 + #define MSR_F16H_L2I_PERF_CTR 0xc0010231 +diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c +index 0c0b09796ced..8cf0659c0521 100644 +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -862,6 +862,26 @@ static void init_amd_bd(struct cpuinfo_x86 *c) + clear_rdrand_cpuid_bit(c); + } + ++void init_spectral_chicken(struct cpuinfo_x86 *c) ++{ ++ u64 value; ++ ++ /* ++ * On Zen2 we offer this chicken (bit) on the altar of Speculation. ++ * ++ * This suppresses speculation from the middle of a basic block, i.e. it ++ * suppresses non-branch predictions. ++ * ++ * We use STIBP as a heuristic to filter out Zen2 from the rest of F17H ++ */ ++ if (!cpu_has(c, X86_FEATURE_HYPERVISOR) && cpu_has(c, X86_FEATURE_AMD_STIBP)) { ++ if (!rdmsrl_safe(MSR_ZEN2_SPECTRAL_CHICKEN, &value)) { ++ value |= MSR_ZEN2_SPECTRAL_CHICKEN_BIT; ++ wrmsrl_safe(MSR_ZEN2_SPECTRAL_CHICKEN, value); ++ } ++ } ++} ++ + static void init_amd_zn(struct cpuinfo_x86 *c) + { + set_cpu_cap(c, X86_FEATURE_ZEN); +@@ -907,7 +927,8 @@ static void init_amd(struct cpuinfo_x86 *c) + case 0x12: init_amd_ln(c); break; + case 0x15: init_amd_bd(c); break; + case 0x16: init_amd_jg(c); break; +- case 0x17: fallthrough; ++ case 0x17: init_spectral_chicken(c); ++ fallthrough; + case 0x19: init_amd_zn(c); break; + } + +diff --git a/arch/x86/kernel/cpu/cpu.h b/arch/x86/kernel/cpu/cpu.h +index 2a8e584fc991..7c9b5893c30a 100644 +--- a/arch/x86/kernel/cpu/cpu.h ++++ b/arch/x86/kernel/cpu/cpu.h +@@ -61,6 +61,8 @@ static inline void tsx_init(void) { } + static inline void tsx_ap_init(void) { } + #endif /* CONFIG_CPU_SUP_INTEL */ + ++extern void init_spectral_chicken(struct cpuinfo_x86 *c); ++ + extern void get_cpu_cap(struct cpuinfo_x86 *c); + extern void get_cpu_address_sizes(struct cpuinfo_x86 *c); + extern void cpu_detect_cache_sizes(struct cpuinfo_x86 *c); +diff --git a/arch/x86/kernel/cpu/hygon.c b/arch/x86/kernel/cpu/hygon.c +index 3fcdda4c1e11..21fd425088fe 100644 +--- a/arch/x86/kernel/cpu/hygon.c ++++ b/arch/x86/kernel/cpu/hygon.c +@@ -302,6 +302,12 @@ static void init_hygon(struct cpuinfo_x86 *c) + /* get apicid instead of initial apic id from cpuid */ + c->apicid = hard_smp_processor_id(); + ++ /* ++ * XXX someone from Hygon needs to confirm this DTRT ++ * ++ init_spectral_chicken(c); ++ */ ++ + set_cpu_cap(c, X86_FEATURE_ZEN); + set_cpu_cap(c, X86_FEATURE_CPB); + +-- +2.35.1 + diff --git a/queue-5.18/x86-kvm-fix-setcc-emulation-for-return-thunks.patch b/queue-5.18/x86-kvm-fix-setcc-emulation-for-return-thunks.patch new file mode 100644 index 00000000000..09399de11c4 --- /dev/null +++ b/queue-5.18/x86-kvm-fix-setcc-emulation-for-return-thunks.patch @@ -0,0 +1,97 @@ +From 96ec7e0685f92832aa26ab0db0fec15711ea73e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jun 2022 23:15:42 +0200 +Subject: x86/kvm: Fix SETcc emulation for return thunks + +From: Peter Zijlstra + +[ Upstream commit af2e140f34208a5dfb6b7a8ad2d56bda88f0524d ] + +Prepare the SETcc fastop stuff for when RET can be larger still. + +The tricky bit here is that the expressions should not only be +constant C expressions, but also absolute GAS expressions. This means +no ?: and 'true' is ~0. + +Also ensure em_setcc() has the same alignment as the actual FOP_SETCC() +ops, this ensures there cannot be an alignment hole between em_setcc() +and the first op. + +Additionally, add a .skip directive to the FOP_SETCC() macro to fill +any remaining space with INT3 traps; however the primary purpose of +this directive is to generate AS warnings when the remaining space +goes negative. Which is a very good indication the alignment magic +went side-ways. + +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Borislav Petkov +Reviewed-by: Josh Poimboeuf +Signed-off-by: Borislav Petkov +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/emulate.c | 28 +++++++++++++++------------- + 1 file changed, 15 insertions(+), 13 deletions(-) + +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index 89b11e7dca8a..b01437015f99 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -325,13 +325,15 @@ static int fastop(struct x86_emulate_ctxt *ctxt, fastop_t fop); + #define FOP_RET(name) \ + __FOP_RET(#name) + +-#define FOP_START(op) \ ++#define __FOP_START(op, align) \ + extern void em_##op(struct fastop *fake); \ + asm(".pushsection .text, \"ax\" \n\t" \ + ".global em_" #op " \n\t" \ +- ".align " __stringify(FASTOP_SIZE) " \n\t" \ ++ ".align " __stringify(align) " \n\t" \ + "em_" #op ":\n\t" + ++#define FOP_START(op) __FOP_START(op, FASTOP_SIZE) ++ + #define FOP_END \ + ".popsection") + +@@ -435,16 +437,15 @@ static int fastop(struct x86_emulate_ctxt *ctxt, fastop_t fop); + /* + * Depending on .config the SETcc functions look like: + * +- * ENDBR [4 bytes; CONFIG_X86_KERNEL_IBT] +- * SETcc %al [3 bytes] +- * RET [1 byte] +- * INT3 [1 byte; CONFIG_SLS] +- * +- * Which gives possible sizes 4, 5, 8 or 9. When rounded up to the +- * next power-of-two alignment they become 4, 8 or 16 resp. ++ * ENDBR [4 bytes; CONFIG_X86_KERNEL_IBT] ++ * SETcc %al [3 bytes] ++ * RET | JMP __x86_return_thunk [1,5 bytes; CONFIG_RETPOLINE] ++ * INT3 [1 byte; CONFIG_SLS] + */ +-#define SETCC_LENGTH (ENDBR_INSN_SIZE + 4 + IS_ENABLED(CONFIG_SLS)) +-#define SETCC_ALIGN (4 << IS_ENABLED(CONFIG_SLS) << HAS_KERNEL_IBT) ++#define RET_LENGTH (1 + (4 * IS_ENABLED(CONFIG_RETPOLINE)) + \ ++ IS_ENABLED(CONFIG_SLS)) ++#define SETCC_LENGTH (ENDBR_INSN_SIZE + 3 + RET_LENGTH) ++#define SETCC_ALIGN (4 << ((SETCC_LENGTH > 4) & 1) << ((SETCC_LENGTH > 8) & 1)) + static_assert(SETCC_LENGTH <= SETCC_ALIGN); + + #define FOP_SETCC(op) \ +@@ -453,9 +454,10 @@ static_assert(SETCC_LENGTH <= SETCC_ALIGN); + #op ": \n\t" \ + ASM_ENDBR \ + #op " %al \n\t" \ +- __FOP_RET(#op) ++ __FOP_RET(#op) \ ++ ".skip " __stringify(SETCC_ALIGN) " - (.-" #op "), 0xcc \n\t" + +-FOP_START(setcc) ++__FOP_START(setcc, SETCC_ALIGN) + FOP_SETCC(seto) + FOP_SETCC(setno) + FOP_SETCC(setc) +-- +2.35.1 + diff --git a/queue-5.18/x86-sev-avoid-using-__x86_return_thunk.patch b/queue-5.18/x86-sev-avoid-using-__x86_return_thunk.patch new file mode 100644 index 00000000000..4275d798831 --- /dev/null +++ b/queue-5.18/x86-sev-avoid-using-__x86_return_thunk.patch @@ -0,0 +1,51 @@ +From 6557a4fb5d40b4c562801bb163745fe56bdde1bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jun 2022 23:15:44 +0200 +Subject: x86/sev: Avoid using __x86_return_thunk + +From: Kim Phillips + +[ Upstream commit 0ee9073000e8791f8b134a8ded31bcc767f7f232 ] + +Specifically, it's because __enc_copy() encrypts the kernel after +being relocated outside the kernel in sme_encrypt_execute(), and the +RET macro's jmp offset isn't amended prior to execution. + +Signed-off-by: Kim Phillips +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Borislav Petkov +Reviewed-by: Josh Poimboeuf +Signed-off-by: Borislav Petkov +Signed-off-by: Sasha Levin +--- + arch/x86/mm/mem_encrypt_boot.S | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/mm/mem_encrypt_boot.S b/arch/x86/mm/mem_encrypt_boot.S +index 3d1dba05fce4..d94dea450fa6 100644 +--- a/arch/x86/mm/mem_encrypt_boot.S ++++ b/arch/x86/mm/mem_encrypt_boot.S +@@ -65,7 +65,9 @@ SYM_FUNC_START(sme_encrypt_execute) + movq %rbp, %rsp /* Restore original stack pointer */ + pop %rbp + +- RET ++ /* Offset to __x86_return_thunk would be wrong here */ ++ ret ++ int3 + SYM_FUNC_END(sme_encrypt_execute) + + SYM_FUNC_START(__enc_copy) +@@ -151,6 +153,8 @@ SYM_FUNC_START(__enc_copy) + pop %r12 + pop %r15 + +- RET ++ /* Offset to __x86_return_thunk would be wrong here */ ++ ret ++ int3 + .L__enc_copy_end: + SYM_FUNC_END(__enc_copy) +-- +2.35.1 + diff --git a/queue-5.18/x86-xen-rename-sys-entry-points.patch b/queue-5.18/x86-xen-rename-sys-entry-points.patch new file mode 100644 index 00000000000..26bface5b70 --- /dev/null +++ b/queue-5.18/x86-xen-rename-sys-entry-points.patch @@ -0,0 +1,142 @@ +From 8656f768ea3921fb8f9789696dd2b95e46b94c02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jun 2022 23:16:00 +0200 +Subject: x86/xen: Rename SYS* entry points + +From: Peter Zijlstra + +[ Upstream commit b75b7f8ef1148be1b9321ffc2f6c19238904b438 ] + +Native SYS{CALL,ENTER} entry points are called +entry_SYS{CALL,ENTER}_{64,compat}, make sure the Xen versions are +named consistently. + +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Borislav Petkov +Reviewed-by: Josh Poimboeuf +Signed-off-by: Borislav Petkov +Signed-off-by: Sasha Levin +--- + arch/x86/xen/setup.c | 6 +++--- + arch/x86/xen/xen-asm.S | 20 ++++++++++---------- + arch/x86/xen/xen-ops.h | 6 +++--- + 3 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c +index 81aa46f770c5..cfa99e8f054b 100644 +--- a/arch/x86/xen/setup.c ++++ b/arch/x86/xen/setup.c +@@ -918,7 +918,7 @@ void xen_enable_sysenter(void) + if (!boot_cpu_has(sysenter_feature)) + return; + +- ret = register_callback(CALLBACKTYPE_sysenter, xen_sysenter_target); ++ ret = register_callback(CALLBACKTYPE_sysenter, xen_entry_SYSENTER_compat); + if(ret != 0) + setup_clear_cpu_cap(sysenter_feature); + } +@@ -927,7 +927,7 @@ void xen_enable_syscall(void) + { + int ret; + +- ret = register_callback(CALLBACKTYPE_syscall, xen_syscall_target); ++ ret = register_callback(CALLBACKTYPE_syscall, xen_entry_SYSCALL_64); + if (ret != 0) { + printk(KERN_ERR "Failed to set syscall callback: %d\n", ret); + /* Pretty fatal; 64-bit userspace has no other +@@ -936,7 +936,7 @@ void xen_enable_syscall(void) + + if (boot_cpu_has(X86_FEATURE_SYSCALL32)) { + ret = register_callback(CALLBACKTYPE_syscall32, +- xen_syscall32_target); ++ xen_entry_SYSCALL_compat); + if (ret != 0) + setup_clear_cpu_cap(X86_FEATURE_SYSCALL32); + } +diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm.S +index caa9bc2fa100..6bf9d45b9178 100644 +--- a/arch/x86/xen/xen-asm.S ++++ b/arch/x86/xen/xen-asm.S +@@ -234,7 +234,7 @@ SYM_CODE_END(xenpv_restore_regs_and_return_to_usermode) + */ + + /* Normal 64-bit system call target */ +-SYM_CODE_START(xen_syscall_target) ++SYM_CODE_START(xen_entry_SYSCALL_64) + UNWIND_HINT_EMPTY + ENDBR + popq %rcx +@@ -249,12 +249,12 @@ SYM_CODE_START(xen_syscall_target) + movq $__USER_CS, 1*8(%rsp) + + jmp entry_SYSCALL_64_after_hwframe +-SYM_CODE_END(xen_syscall_target) ++SYM_CODE_END(xen_entry_SYSCALL_64) + + #ifdef CONFIG_IA32_EMULATION + + /* 32-bit compat syscall target */ +-SYM_CODE_START(xen_syscall32_target) ++SYM_CODE_START(xen_entry_SYSCALL_compat) + UNWIND_HINT_EMPTY + ENDBR + popq %rcx +@@ -269,10 +269,10 @@ SYM_CODE_START(xen_syscall32_target) + movq $__USER32_CS, 1*8(%rsp) + + jmp entry_SYSCALL_compat_after_hwframe +-SYM_CODE_END(xen_syscall32_target) ++SYM_CODE_END(xen_entry_SYSCALL_compat) + + /* 32-bit compat sysenter target */ +-SYM_CODE_START(xen_sysenter_target) ++SYM_CODE_START(xen_entry_SYSENTER_compat) + UNWIND_HINT_EMPTY + ENDBR + /* +@@ -291,19 +291,19 @@ SYM_CODE_START(xen_sysenter_target) + movq $__USER32_CS, 1*8(%rsp) + + jmp entry_SYSENTER_compat_after_hwframe +-SYM_CODE_END(xen_sysenter_target) ++SYM_CODE_END(xen_entry_SYSENTER_compat) + + #else /* !CONFIG_IA32_EMULATION */ + +-SYM_CODE_START(xen_syscall32_target) +-SYM_CODE_START(xen_sysenter_target) ++SYM_CODE_START(xen_entry_SYSCALL_compat) ++SYM_CODE_START(xen_entry_SYSENTER_compat) + UNWIND_HINT_EMPTY + ENDBR + lea 16(%rsp), %rsp /* strip %rcx, %r11 */ + mov $-ENOSYS, %rax + pushq $0 + jmp hypercall_iret +-SYM_CODE_END(xen_sysenter_target) +-SYM_CODE_END(xen_syscall32_target) ++SYM_CODE_END(xen_entry_SYSENTER_compat) ++SYM_CODE_END(xen_entry_SYSCALL_compat) + + #endif /* CONFIG_IA32_EMULATION */ +diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h +index fd0fec6e92f4..9a8bb972193d 100644 +--- a/arch/x86/xen/xen-ops.h ++++ b/arch/x86/xen/xen-ops.h +@@ -10,10 +10,10 @@ + /* These are code, but not functions. Defined in entry.S */ + extern const char xen_failsafe_callback[]; + +-void xen_sysenter_target(void); ++void xen_entry_SYSENTER_compat(void); + #ifdef CONFIG_X86_64 +-void xen_syscall_target(void); +-void xen_syscall32_target(void); ++void xen_entry_SYSCALL_64(void); ++void xen_entry_SYSCALL_compat(void); + #endif + + extern void *xen_initial_gdt; +-- +2.35.1 + diff --git a/queue-5.18/xen-gntdev-ignore-failure-to-unmap-invalid_grant_han.patch b/queue-5.18/xen-gntdev-ignore-failure-to-unmap-invalid_grant_han.patch new file mode 100644 index 00000000000..cf7ef6fe348 --- /dev/null +++ b/queue-5.18/xen-gntdev-ignore-failure-to-unmap-invalid_grant_han.patch @@ -0,0 +1,58 @@ +From 731723087ad30c6d0e95429eff51c8d6e9a8f0d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Jul 2022 19:05:22 -0400 +Subject: xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE + +From: Demi Marie Obenour + +[ Upstream commit 166d3863231667c4f64dee72b77d1102cdfad11f ] + +The error paths of gntdev_mmap() can call unmap_grant_pages() even +though not all of the pages have been successfully mapped. This will +trigger the WARN_ON()s in __unmap_grant_pages_done(). The number of +warnings can be very large; I have observed thousands of lines of +warnings in the systemd journal. + +Avoid this problem by only warning on unmapping failure if the handle +being unmapped is not INVALID_GRANT_HANDLE. The handle field of any +page that was not successfully mapped will be INVALID_GRANT_HANDLE, so +this catches all cases where unmapping can legitimately fail. + +Fixes: dbe97cff7dd9 ("xen/gntdev: Avoid blocking in unmap_grant_pages()") +Cc: stable@vger.kernel.org +Suggested-by: Juergen Gross +Signed-off-by: Demi Marie Obenour +Reviewed-by: Oleksandr Tyshchenko +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20220710230522.1563-1-demi@invisiblethingslab.com +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + drivers/xen/gntdev.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c +index 4b56c39f766d..84b143eef395 100644 +--- a/drivers/xen/gntdev.c ++++ b/drivers/xen/gntdev.c +@@ -396,13 +396,15 @@ static void __unmap_grant_pages_done(int result, + unsigned int offset = data->unmap_ops - map->unmap_ops; + + for (i = 0; i < data->count; i++) { +- WARN_ON(map->unmap_ops[offset+i].status); ++ WARN_ON(map->unmap_ops[offset + i].status != GNTST_okay && ++ map->unmap_ops[offset + i].handle != INVALID_GRANT_HANDLE); + pr_debug("unmap handle=%d st=%d\n", + map->unmap_ops[offset+i].handle, + map->unmap_ops[offset+i].status); + map->unmap_ops[offset+i].handle = INVALID_GRANT_HANDLE; + if (use_ptemod) { +- WARN_ON(map->kunmap_ops[offset+i].status); ++ WARN_ON(map->kunmap_ops[offset + i].status != GNTST_okay && ++ map->kunmap_ops[offset + i].handle != INVALID_GRANT_HANDLE); + pr_debug("kunmap handle=%u st=%d\n", + map->kunmap_ops[offset+i].handle, + map->kunmap_ops[offset+i].status); +-- +2.35.1 + -- 2.47.3