From: Sasha Levin Date: Sun, 25 Sep 2022 01:52:29 +0000 (-0400) Subject: Fixes for 5.19 X-Git-Tag: v4.9.330~67 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0a79f79733435b9095798b1783bf0fedc1aef341;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.19 Signed-off-by: Sasha Levin --- diff --git a/queue-5.19/arm-dts-lan966x-fix-the-interrupt-number-for-interna.patch b/queue-5.19/arm-dts-lan966x-fix-the-interrupt-number-for-interna.patch new file mode 100644 index 00000000000..ef014165ce2 --- /dev/null +++ b/queue-5.19/arm-dts-lan966x-fix-the-interrupt-number-for-interna.patch @@ -0,0 +1,44 @@ +From ef64a6aa472902ec0ea94d08ef1a1369ffa8638f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Sep 2022 21:26:29 +0200 +Subject: ARM: dts: lan966x: Fix the interrupt number for internal PHYs + +From: Horatiu Vultur + +[ Upstream commit f5fc22cbbdcd349402faaddf1a07eb8403658ae8 ] + +According to the datasheet the interrupts for internal PHYs are +80 and 81. + +Fixes: 6ad69e07def67c ("ARM: dts: lan966x: add MIIM nodes") +Signed-off-by: Horatiu Vultur +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20220912192629.461452-1-horatiu.vultur@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/lan966x.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/lan966x.dtsi b/arch/arm/boot/dts/lan966x.dtsi +index 38e90a31d2dd..25c19f9d0a12 100644 +--- a/arch/arm/boot/dts/lan966x.dtsi ++++ b/arch/arm/boot/dts/lan966x.dtsi +@@ -515,13 +515,13 @@ mdio1: mdio@e200413c { + + phy0: ethernet-phy@1 { + reg = <1>; +- interrupts = ; ++ interrupts = ; + status = "disabled"; + }; + + phy1: ethernet-phy@2 { + reg = <2>; +- interrupts = ; ++ interrupts = ; + status = "disabled"; + }; + }; +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-imx8mm-reverse-cpld_dn-gpio-label-mapping-.patch b/queue-5.19/arm64-dts-imx8mm-reverse-cpld_dn-gpio-label-mapping-.patch new file mode 100644 index 00000000000..057f4265bdd --- /dev/null +++ b/queue-5.19/arm64-dts-imx8mm-reverse-cpld_dn-gpio-label-mapping-.patch @@ -0,0 +1,45 @@ +From 84252956ef2c24a614fab176409adcd16e2a9902 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 00:13:20 +0200 +Subject: arm64: dts: imx8mm: Reverse CPLD_Dn GPIO label mapping on MX8Menlo + +From: Marek Vasut + +[ Upstream commit 8194a356226ce6f53e1d98b44c0436c583db89d2 ] + +The CPLD_Dn GPIO assignment between SoM and CPLD has now been clarified +in schematic and the assignment is reversed. Update the DT to match the +hardware. + +Fixes: 510c527b4ff57 ("arm64: dts: imx8mm: Add i.MX8M Mini Toradex Verdin based Menlo board") +Signed-off-by: Marek Vasut +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-mx8menlo.dts | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-mx8menlo.dts b/arch/arm64/boot/dts/freescale/imx8mm-mx8menlo.dts +index 92eaf4ef4563..57ecdfa0dfc0 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-mx8menlo.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-mx8menlo.dts +@@ -152,11 +152,11 @@ &gpio4 { + * CPLD_reset is RESET_SOFT in schematic + */ + gpio-line-names = +- "CPLD_D[1]", "CPLD_int", "CPLD_reset", "", +- "", "CPLD_D[0]", "", "", +- "", "", "", "CPLD_D[2]", +- "CPLD_D[3]", "CPLD_D[4]", "CPLD_D[5]", "CPLD_D[6]", +- "CPLD_D[7]", "", "", "", ++ "CPLD_D[6]", "CPLD_int", "CPLD_reset", "", ++ "", "CPLD_D[7]", "", "", ++ "", "", "", "CPLD_D[5]", ++ "CPLD_D[4]", "CPLD_D[3]", "CPLD_D[2]", "CPLD_D[1]", ++ "CPLD_D[0]", "", "", "", + "", "", "", "", + "", "", "", "KBD_intK", + "", "", "", ""; +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-imx8mm-verdin-extend-pmic-voltages.patch b/queue-5.19/arm64-dts-imx8mm-verdin-extend-pmic-voltages.patch new file mode 100644 index 00000000000..cf5be771298 --- /dev/null +++ b/queue-5.19/arm64-dts-imx8mm-verdin-extend-pmic-voltages.patch @@ -0,0 +1,82 @@ +From 99c2700908679af68d0a9482b0347a9ab1d6cdf4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Sep 2022 12:01:51 +0200 +Subject: arm64: dts: imx8mm-verdin: extend pmic voltages + +From: Philippe Schenker + +[ Upstream commit b5a76cb38df779076a3cff624ce6a368d9bcf330 ] + +Currently, we limited the voltages from the PMIC very strictly. This +causes an issue with one Toradex SKU that uses a consumer-grade chip +that is capable of going up to 1.8GHz at 1.00V. + +Extend the ranges to min/max values of the SoC operating ranges (table +10) in the datasheet. Detailed explanation as follows: + +BUCK2: + - As already described above, the SKU with the consumer-grade chip + needs a voltage of at least 1.00V. 1.05V is chosen now as this is + listed as the maximum. Both industrial and consumer-grade chips have + an absolute maximum rating of 1.15V which makes it still safe to put + 1.05V + - Lower the regulator-min value to the smallest value allowed from the + Quad-A53, 1.2GHz version of the SoC + +BUCK3: + - This regulator is used for SoC input voltages VDD_GPU, VDD_VPU and + VDD_DRAM. + - Use the smallest value of these three inputs as the regulator-min + - Use the largest value of these three inputs as the regulator-max + +LDO2: + - This LDO is used for VDD_SNVS_0P8 SoC input voltage. As this has a + single nominal input voltage just put this in the middle of 0.8V. + +Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini") +Signed-off-by: Philippe Schenker +Signed-off-by: Marcel Ziswiler +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +index c2d4da25482f..44b473494d0f 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +@@ -359,8 +359,8 @@ reg_vdd_arm: BUCK2 { + nxp,dvs-standby-voltage = <850000>; + regulator-always-on; + regulator-boot-on; +- regulator-max-microvolt = <950000>; +- regulator-min-microvolt = <850000>; ++ regulator-max-microvolt = <1050000>; ++ regulator-min-microvolt = <805000>; + regulator-name = "On-module +VDD_ARM (BUCK2)"; + regulator-ramp-delay = <3125>; + }; +@@ -368,8 +368,8 @@ reg_vdd_arm: BUCK2 { + reg_vdd_dram: BUCK3 { + regulator-always-on; + regulator-boot-on; +- regulator-max-microvolt = <950000>; +- regulator-min-microvolt = <850000>; ++ regulator-max-microvolt = <1000000>; ++ regulator-min-microvolt = <805000>; + regulator-name = "On-module +VDD_GPU_VPU_DDR (BUCK3)"; + }; + +@@ -408,7 +408,7 @@ reg_nvcc_snvs: LDO1 { + reg_vdd_snvs: LDO2 { + regulator-always-on; + regulator-boot-on; +- regulator-max-microvolt = <900000>; ++ regulator-max-microvolt = <800000>; + regulator-min-microvolt = <800000>; + regulator-name = "On-module +V0.8_SNVS (LDO2)"; + }; +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-imx8mn-remove-gpu-power-domain-reset.patch b/queue-5.19/arm64-dts-imx8mn-remove-gpu-power-domain-reset.patch new file mode 100644 index 00000000000..499f0c12566 --- /dev/null +++ b/queue-5.19/arm64-dts-imx8mn-remove-gpu-power-domain-reset.patch @@ -0,0 +1,40 @@ +From bf833077a87f0a3d91906a5f56542854b67eef7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 21:04:48 +0200 +Subject: arm64: dts: imx8mn: remove GPU power domain reset + +From: Marco Felsch + +[ Upstream commit 347155d1fa85972ac19d1bf58ae3f3ce95e51a5d ] + +The PGC (power gating controller) already handles the reset for the +GPUMIX power domain. By specifying it within the device tree the reset +it issued a 2nd time. This confuses the hardware during power up and +sporadically hangs the SoC. Fix this by removing the reset property and +let the hardware handle the reset. + +Fixes: 9a0f3b157e22e ("arm64: dts: imx8mn: Enable GPU") +Signed-off-by: Marco Felsch +Signed-off-by: Lucas Stach +Tested-by: Adam Ford +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mn.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +index e41e1d56f980..7bd4eecd592e 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +@@ -672,7 +672,6 @@ pgc_gpumix: power-domain@2 { + <&clk IMX8MN_CLK_GPU_SHADER>, + <&clk IMX8MN_CLK_GPU_BUS_ROOT>, + <&clk IMX8MN_CLK_GPU_AHB>; +- resets = <&src IMX8MQ_RESET_GPU_RESET>; + }; + + pgc_dispmix: power-domain@3 { +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-imx8mp-venice-gw74xx-fix-can-stby-polarity.patch b/queue-5.19/arm64-dts-imx8mp-venice-gw74xx-fix-can-stby-polarity.patch new file mode 100644 index 00000000000..0320b2a22e9 --- /dev/null +++ b/queue-5.19/arm64-dts-imx8mp-venice-gw74xx-fix-can-stby-polarity.patch @@ -0,0 +1,37 @@ +From 4338849fdcb14fb7c96df495708a17849aec5249 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Sep 2022 11:08:32 -0700 +Subject: arm64: dts: imx8mp-venice-gw74xx: fix CAN STBY polarity + +From: Tim Harvey + +[ Upstream commit e4ef0885632ed485961ac0962ad01be4ec9ec658 ] + +The CAN STBY poarlity is active-low. Specify it as such by removing the +'enable-active-high' property and updating the gpio property. + +Fixes: 7899eb6cb15d ("arm64: dts: imx: Add i.MX8M Plus Gateworks gw7400 dts support") +Signed-off-by: Tim Harvey +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts +index 6630ec561dc2..4c729ac89625 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts +@@ -123,8 +123,7 @@ reg_can2_stby: regulator-can2-stby { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_reg_can>; + regulator-name = "can2_stby"; +- gpio = <&gpio3 19 GPIO_ACTIVE_HIGH>; +- enable-active-high; ++ gpio = <&gpio3 19 GPIO_ACTIVE_LOW>; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; + }; +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-imx8mp-venice-gw74xx-fix-ksz9477-cpu-port.patch b/queue-5.19/arm64-dts-imx8mp-venice-gw74xx-fix-ksz9477-cpu-port.patch new file mode 100644 index 00000000000..a6141477bb3 --- /dev/null +++ b/queue-5.19/arm64-dts-imx8mp-venice-gw74xx-fix-ksz9477-cpu-port.patch @@ -0,0 +1,37 @@ +From 1e01833ccb0d435852e2095867d9d364918eeac3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Sep 2022 11:08:33 -0700 +Subject: arm64: dts: imx8mp-venice-gw74xx: fix ksz9477 cpu port + +From: Tim Harvey + +[ Upstream commit c3681de3b8f2e8aff0306e2d6c129ca15b70b79d ] + +The CPU uplink port on the KSZ9477 is P5 not P6 - fix this. + +Fixes: 7899eb6cb15d ("arm64: dts: imx: Add i.MX8M Plus Gateworks gw7400 dts support") +Signed-off-by: Tim Harvey +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts +index 4c729ac89625..3df7ee9a2fe1 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts +@@ -510,8 +510,8 @@ lan5: port@4 { + local-mac-address = [00 00 00 00 00 00]; + }; + +- port@6 { +- reg = <6>; ++ port@5 { ++ reg = <5>; + label = "cpu"; + ethernet = <&fec>; + phy-mode = "rgmii-id"; +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-imx8mp-venice-gw74xx-fix-port-phy-validati.patch b/queue-5.19/arm64-dts-imx8mp-venice-gw74xx-fix-port-phy-validati.patch new file mode 100644 index 00000000000..dcdb6ca8b0f --- /dev/null +++ b/queue-5.19/arm64-dts-imx8mp-venice-gw74xx-fix-port-phy-validati.patch @@ -0,0 +1,64 @@ +From 42ce4d047e8ffa55981bfdbf32a296d274790f9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Sep 2022 11:08:34 -0700 +Subject: arm64: dts: imx8mp-venice-gw74xx: fix port/phy validation + +From: Tim Harvey + +[ Upstream commit f7fc391a5e28216150ab5390df35032309ead7e5 ] + +Since commit 65ac79e18120 ("net: dsa: microchip: add the phylink +get_caps") the phy-mode must be set otherwise the switch driver will +assume "NA" mode and invalidate the port. + +Fixes: 7899eb6cb15d ("arm64: dts: imx: Add i.MX8M Plus Gateworks gw7400 dts support") +Signed-off-by: Tim Harvey +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts +index 3df7ee9a2fe1..211e6a1b296e 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts +@@ -483,30 +483,35 @@ ports { + lan1: port@0 { + reg = <0>; + label = "lan1"; ++ phy-mode = "internal"; + local-mac-address = [00 00 00 00 00 00]; + }; + + lan2: port@1 { + reg = <1>; + label = "lan2"; ++ phy-mode = "internal"; + local-mac-address = [00 00 00 00 00 00]; + }; + + lan3: port@2 { + reg = <2>; + label = "lan3"; ++ phy-mode = "internal"; + local-mac-address = [00 00 00 00 00 00]; + }; + + lan4: port@3 { + reg = <3>; + label = "lan4"; ++ phy-mode = "internal"; + local-mac-address = [00 00 00 00 00 00]; + }; + + lan5: port@4 { + reg = <4>; + label = "lan5"; ++ phy-mode = "internal"; + local-mac-address = [00 00 00 00 00 00]; + }; + +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-imx8ulp-add-reset-cells-for-pcc.patch b/queue-5.19/arm64-dts-imx8ulp-add-reset-cells-for-pcc.patch new file mode 100644 index 00000000000..9a430581310 --- /dev/null +++ b/queue-5.19/arm64-dts-imx8ulp-add-reset-cells-for-pcc.patch @@ -0,0 +1,51 @@ +From d477c5bfb4e48ef654edfe02501d04722e9d7175 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Aug 2022 22:25:49 +0800 +Subject: arm64: dts: imx8ulp: add #reset-cells for pcc + +From: Peng Fan + +[ Upstream commit 5fa383a25fd8a16a73485c90da4e3e33a78b45cf ] + +The binding file clock/imx8ulp-pcc-clock.yaml indicates '#reset-cells' +is a required property, add it. + +Fixes: fe6291e96313 ("arm64: dts: imx8ulp: Add the basic dtsi file for imx8ulp") +Signed-off-by: Peng Fan +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8ulp.dtsi | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8ulp.dtsi b/arch/arm64/boot/dts/freescale/imx8ulp.dtsi +index 09f7364dd1d0..1cd389b1b95d 100644 +--- a/arch/arm64/boot/dts/freescale/imx8ulp.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8ulp.dtsi +@@ -172,6 +172,7 @@ pcc3: clock-controller@292d0000 { + compatible = "fsl,imx8ulp-pcc3"; + reg = <0x292d0000 0x10000>; + #clock-cells = <1>; ++ #reset-cells = <1>; + }; + + tpm5: tpm@29340000 { +@@ -270,6 +271,7 @@ pcc4: clock-controller@29800000 { + compatible = "fsl,imx8ulp-pcc4"; + reg = <0x29800000 0x10000>; + #clock-cells = <1>; ++ #reset-cells = <1>; + }; + + lpi2c6: i2c@29840000 { +@@ -414,6 +416,7 @@ pcc5: clock-controller@2da70000 { + compatible = "fsl,imx8ulp-pcc5"; + reg = <0x2da70000 0x10000>; + #clock-cells = <1>; ++ #reset-cells = <1>; + }; + }; + +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-rockchip-fix-property-for-usb2-phy-supply-.patch b/queue-5.19/arm64-dts-rockchip-fix-property-for-usb2-phy-supply-.patch new file mode 100644 index 00000000000..b03ca31964d --- /dev/null +++ b/queue-5.19/arm64-dts-rockchip-fix-property-for-usb2-phy-supply-.patch @@ -0,0 +1,37 @@ +From fec5d98e82745988b6cad39d61954f49677daf62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Sep 2022 08:43:34 +0200 +Subject: arm64: dts: rockchip: fix property for usb2 phy supply on rock-3a + +From: Michael Riesch + +[ Upstream commit 43e1d6d3b45c4e7e25171ec04a10d09969b0f889 ] + +The property "vbus-supply" was copied from the vendor kernel but is not +available in mainstream. Use correct property "phy-supply". + +Fixes: 254a1f6a29e7 ("arm64: dts: rockchip: add usb3 support to the radxa rock3 model a") +Signed-off-by: Michael Riesch +Link: https://lore.kernel.org/r/20220905064335.104650-1-michael.riesch@wolfvision.net +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts b/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts +index 0813c0c5abde..26912f02684c 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts +@@ -543,7 +543,7 @@ &usb2phy0_host { + }; + + &usb2phy0_otg { +- vbus-supply = <&vcc5v0_usb_otg>; ++ phy-supply = <&vcc5v0_usb_otg>; + status = "okay"; + }; + +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-rockchip-fix-property-for-usb2-phy-supply-.patch-26447 b/queue-5.19/arm64-dts-rockchip-fix-property-for-usb2-phy-supply-.patch-26447 new file mode 100644 index 00000000000..b8486956655 --- /dev/null +++ b/queue-5.19/arm64-dts-rockchip-fix-property-for-usb2-phy-supply-.patch-26447 @@ -0,0 +1,38 @@ +From f8fb4c64c776d3fea514fd64f1b1035b3e1062a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Sep 2022 08:43:35 +0200 +Subject: arm64: dts: rockchip: fix property for usb2 phy supply on + rk3568-evb1-v10 + +From: Michael Riesch + +[ Upstream commit 1988e3ef0544bbe54cffa4ec30a5883e5a08c2b6 ] + +The property "vbus-supply" was copied from the vendor kernel but is not +available in mainstream. Use correct property "phy-supply". + +Fixes: d6cfb110b0fd ("arm64: dts: rockchip: add usb3 support to rk3568-evb1-v10") +Signed-off-by: Michael Riesch +Link: https://lore.kernel.org/r/20220905064335.104650-2-michael.riesch@wolfvision.net +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dts b/arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dts +index 622be8be9813..282f5c74d5cd 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dts +@@ -618,7 +618,7 @@ &usb2phy0_host { + }; + + &usb2phy0_otg { +- vbus-supply = <&vcc5v0_usb_otg>; ++ phy-supply = <&vcc5v0_usb_otg>; + status = "okay"; + }; + +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-rockchip-fix-typo-in-lisense-text-for-px30.patch b/queue-5.19/arm64-dts-rockchip-fix-typo-in-lisense-text-for-px30.patch new file mode 100644 index 00000000000..4123d45286c --- /dev/null +++ b/queue-5.19/arm64-dts-rockchip-fix-typo-in-lisense-text-for-px30.patch @@ -0,0 +1,39 @@ +From 4f80ce5629d1de65028e72f74e2c77041f784c04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Aug 2022 16:05:24 +0530 +Subject: arm64: dts: rockchip: Fix typo in lisense text for PX30.Core + +From: Jagan Teki + +[ Upstream commit 4a00c43818dcc19be97250d4c3c4a1e2f1ed4f9d ] + +Fix the Amarula Solutions typo mistake in lisense text added +in Engicam PX30.Core SoM dtsi. + +Fixes: d92a7c331f53c ("arm64: dts: rockchip: Add Engicam PX30.Core SOM") +Signed-off-by: Jagan Teki +Link: https://lore.kernel.org/r/20220822103524.266731-1-jagan@amarulasolutions.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/px30-engicam-px30-core.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/px30-engicam-px30-core.dtsi b/arch/arm64/boot/dts/rockchip/px30-engicam-px30-core.dtsi +index 7249871530ab..5eecbefa8a33 100644 +--- a/arch/arm64/boot/dts/rockchip/px30-engicam-px30-core.dtsi ++++ b/arch/arm64/boot/dts/rockchip/px30-engicam-px30-core.dtsi +@@ -2,8 +2,8 @@ + /* + * Copyright (c) 2020 Fuzhou Rockchip Electronics Co., Ltd + * Copyright (c) 2020 Engicam srl +- * Copyright (c) 2020 Amarula Solutons +- * Copyright (c) 2020 Amarula Solutons(India) ++ * Copyright (c) 2020 Amarula Solutions ++ * Copyright (c) 2020 Amarula Solutions(India) + */ + + #include +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-rockchip-lower-sd-speed-on-quartz64-b.patch b/queue-5.19/arm64-dts-rockchip-lower-sd-speed-on-quartz64-b.patch new file mode 100644 index 00000000000..14c986b93ee --- /dev/null +++ b/queue-5.19/arm64-dts-rockchip-lower-sd-speed-on-quartz64-b.patch @@ -0,0 +1,41 @@ +From 3bb7d42f88c72b0bd3f5338ae784164cade23c5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jul 2022 06:43:06 +0200 +Subject: arm64: dts: rockchip: Lower sd speed on quartz64-b + +From: Nicolas Frattaroli + +[ Upstream commit 1ea90b2d293fd8b1f3377c9ed08364ff6f2a8562 ] + +The previously stated speed of sdr-104 is too high for the hardware +to reliably communicate with some fast SD cards. + +Lower this to sd-uhs-sdr50 to fix this. + +Fixes: dcc8c66bef79 ("arm64: dts: rockchip: add Pine64 Quartz64-B device tree") + +Signed-off-by: Nicolas Frattaroli +Tested-by: Peter Geis +Link: https://lore.kernel.org/r/20220721044307.48641-1-frattaroli.nicolas@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3566-quartz64-b.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-quartz64-b.dts b/arch/arm64/boot/dts/rockchip/rk3566-quartz64-b.dts +index 02d5f5a8ca03..528bb4e8ac77 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-quartz64-b.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3566-quartz64-b.dts +@@ -506,7 +506,7 @@ &sdmmc0 { + disable-wp; + pinctrl-names = "default"; + pinctrl-0 = <&sdmmc0_bus4 &sdmmc0_clk &sdmmc0_cmd &sdmmc0_det>; +- sd-uhs-sdr104; ++ sd-uhs-sdr50; + vmmc-supply = <&vcc3v3_sd>; + vqmmc-supply = <&vccio_sd>; + status = "okay"; +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-rockchip-pull-up-wlan-wake-on-gru-bob.patch b/queue-5.19/arm64-dts-rockchip-pull-up-wlan-wake-on-gru-bob.patch new file mode 100644 index 00000000000..3fe9199be8a --- /dev/null +++ b/queue-5.19/arm64-dts-rockchip-pull-up-wlan-wake-on-gru-bob.patch @@ -0,0 +1,62 @@ +From dc68fab6ff3edc9782ecdbcd59994ffb835edd3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Aug 2022 16:45:04 -0700 +Subject: arm64: dts: rockchip: Pull up wlan wake# on Gru-Bob + +From: Brian Norris + +[ Upstream commit e5467359a725de90b6b8d0dd865500f6373828ca ] + +The Gru-Bob board does not have a pull-up resistor on its +WLAN_HOST_WAKE# pin, but Kevin does. The production/vendor kernel +specified the pin configuration correctly as a pull-up, but this didn't +get ported correctly to upstream. + +This means Bob's WLAN_HOST_WAKE# pin is floating, causing inconsistent +wakeup behavior. + +Note that bt_host_wake_l has a similar dynamic, but apparently the +upstream choice was to redundantly configure both internal and external +pull-up on Kevin (see the "Kevin has an external pull up" comment in +rk3399-gru.dtsi). This doesn't cause any functional problem, although +it's perhaps wasteful. + +Fixes: 8559bbeeb849 ("arm64: dts: rockchip: add Google Bob") +Signed-off-by: Brian Norris +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/20220822164453.1.I75c57b48b0873766ec993bdfb7bc1e63da5a1637@changeid +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts | 5 +++++ + arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi | 1 + + 2 files changed, 6 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts b/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts +index 31ebb4e5fd33..0f9cc042d9bf 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts +@@ -88,3 +88,8 @@ h1_int_od_l: h1-int-od-l { + }; + }; + }; ++ ++&wlan_host_wake_l { ++ /* Kevin has an external pull up, but Bob does not. */ ++ rockchip,pins = <0 RK_PB0 RK_FUNC_GPIO &pcfg_pull_up>; ++}; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi +index 50d459ee4831..eed15fd61d62 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi +@@ -578,6 +578,7 @@ wifi_perst_l: wifi-perst-l { + }; + + wlan_host_wake_l: wlan-host-wake-l { ++ /* Kevin has an external pull up, but Bob does not */ + rockchip,pins = <0 RK_PB0 RK_FUNC_GPIO &pcfg_pull_none>; + }; + }; +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-rockchip-remove-enable-active-low-from-rk3.patch b/queue-5.19/arm64-dts-rockchip-remove-enable-active-low-from-rk3.patch new file mode 100644 index 00000000000..18351e1929f --- /dev/null +++ b/queue-5.19/arm64-dts-rockchip-remove-enable-active-low-from-rk3.patch @@ -0,0 +1,40 @@ +From 74aa6f143fc86bb6cc9724880c88b89465b283ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Aug 2022 14:51:39 -0300 +Subject: arm64: dts: rockchip: Remove 'enable-active-low' from rk3399-puma + +From: Fabio Estevam + +[ Upstream commit a994b34b9abb9c08ee09e835b4027ff2147f9d94 ] + +The 'enable-active-low' property is not a valid one. + +Only 'enable-active-high' is valid, and when this property is absent +the gpio regulator will act as active low by default. + +Remove the invalid 'enable-active-low' property. + +Fixes: 2c66fc34e945 ("arm64: dts: rockchip: add RK3399-Q7 (Puma) SoM") +Signed-off-by: Fabio Estevam +Link: https://lore.kernel.org/r/20220827175140.1696699-1-festevam@denx.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +index b1ac3a89f259..aa3e21bd6c8f 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +@@ -62,7 +62,6 @@ vcc3v3_sys: vcc3v3-sys { + vcc5v0_host: vcc5v0-host-regulator { + compatible = "regulator-fixed"; + gpio = <&gpio4 RK_PA3 GPIO_ACTIVE_LOW>; +- enable-active-low; + pinctrl-names = "default"; + pinctrl-0 = <&vcc5v0_host_en>; + regulator-name = "vcc5v0_host"; +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-rockchip-remove-enable-active-low-from-rk3.patch-1350 b/queue-5.19/arm64-dts-rockchip-remove-enable-active-low-from-rk3.patch-1350 new file mode 100644 index 00000000000..78bd523ddd2 --- /dev/null +++ b/queue-5.19/arm64-dts-rockchip-remove-enable-active-low-from-rk3.patch-1350 @@ -0,0 +1,41 @@ +From a533bb14d2d85dc7dff5f6f87dc43f5c350d855c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Aug 2022 14:51:40 -0300 +Subject: arm64: dts: rockchip: Remove 'enable-active-low' from + rk3566-quartz64-a + +From: Fabio Estevam + +[ Upstream commit ea89926d9690f055fd8da929f6621a760e8e0f14 ] + +The 'enable-active-low' property is not a valid one. + +Only 'enable-active-high' is valid, and when this property is absent +the gpio regulator will act as active low by default. + +Remove the invalid 'enable-active-low' property. + +Fixes: b33a22a1e7c4 ("arm64: dts: rockchip: add basic dts for Pine64 Quartz64-A") +Signed-off-by: Fabio Estevam +Link: https://lore.kernel.org/r/20220827175140.1696699-2-festevam@denx.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3566-quartz64-a.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-quartz64-a.dts b/arch/arm64/boot/dts/rockchip/rk3566-quartz64-a.dts +index fa953b736642..fdbfdf3634e4 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-quartz64-a.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3566-quartz64-a.dts +@@ -163,7 +163,6 @@ vcc5v0_usb20_otg: vcc5v0_usb20_otg { + + vcc3v3_sd: vcc3v3_sd { + compatible = "regulator-fixed"; +- enable-active-low; + gpio = <&gpio0 RK_PA5 GPIO_ACTIVE_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&vcc_sd_h>; +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-rockchip-set-rk3399-gru-pclk_edp-to-24-mhz.patch b/queue-5.19/arm64-dts-rockchip-set-rk3399-gru-pclk_edp-to-24-mhz.patch new file mode 100644 index 00000000000..acd51b719ad --- /dev/null +++ b/queue-5.19/arm64-dts-rockchip-set-rk3399-gru-pclk_edp-to-24-mhz.patch @@ -0,0 +1,51 @@ +From 95a91fecd69d6288880aa936263970afcfb6306e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Aug 2022 13:16:17 -0700 +Subject: arm64: dts: rockchip: Set RK3399-Gru PCLK_EDP to 24 MHz + +From: zain wang + +[ Upstream commit 8123437cf46ea5a0f6ca5cb3c528d8b6db97b9c2 ] + +We've found the AUX channel to be less reliable with PCLK_EDP at a +higher rate (typically 25 MHz). This is especially important on systems +with PSR-enabled panels (like Gru-Kevin), since we make heavy, constant +use of AUX. + +According to Rockchip, using any rate other than 24 MHz can cause +"problems between syncing the PHY an PCLK", which leads to all sorts of +unreliabilities around register operations. + +Fixes: d67a38c5a623 ("arm64: dts: rockchip: move core edp from rk3399-kevin to shared chromebook") +Reviewed-by: Douglas Anderson +Signed-off-by: zain wang +Signed-off-by: Brian Norris +Link: https://lore.kernel.org/r/20220830131212.v2.1.I98d30623f13b785ca77094d0c0fd4339550553b6@changeid +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi +index eed15fd61d62..af5810e5f5b7 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi +@@ -244,6 +244,14 @@ &dmc { + &edp { + status = "okay"; + ++ /* ++ * eDP PHY/clk don't sync reliably at anything other than 24 MHz. Only ++ * set this here, because rk3399-gru.dtsi ensures we can generate this ++ * off GPLL=600MHz, whereas some other RK3399 boards may not. ++ */ ++ assigned-clocks = <&cru PCLK_EDP>; ++ assigned-clock-rates = <24000000>; ++ + ports { + edp_out: port@1 { + reg = <1>; +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-tqma8mqml-include-phy-imx8-pcie.h-header.patch b/queue-5.19/arm64-dts-tqma8mqml-include-phy-imx8-pcie.h-header.patch new file mode 100644 index 00000000000..7653eb8c815 --- /dev/null +++ b/queue-5.19/arm64-dts-tqma8mqml-include-phy-imx8-pcie.h-header.patch @@ -0,0 +1,55 @@ +From a1f0511a9b65b6e1d4f92a9791ca595744195674 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Sep 2022 11:17:02 -0300 +Subject: arm64: dts: tqma8mqml: Include phy-imx8-pcie.h header + +From: Fabio Estevam + +[ Upstream commit 70ae49c5ac876f0f4689889588544104209c09c4 ] + +imx8mm-tqma8mqml.dtsi has PCIe support, so it should include +. + +Otherwise, there are build errors when this SoM dtsi is included +on customers' carrier boards. + +While at it, remove the PCI header from imx8mm-tqma8mqml-mba8mx.dts, +which is now unneeded. + +Fixes: 1d84283101fc ("arm64: dts: tqma8mqml: add PCIe support") +Signed-off-by: Fabio Estevam +Reviewed-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml-mba8mx.dts | 1 - + arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml.dtsi | 1 + + 2 files changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml-mba8mx.dts b/arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml-mba8mx.dts +index 286d2df01cfa..7e0aeb2db305 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml-mba8mx.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml-mba8mx.dts +@@ -5,7 +5,6 @@ + + /dts-v1/; + +-#include + #include "imx8mm-tqma8mqml.dtsi" + #include "mba8mx.dtsi" + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml.dtsi +index 16ee9b5179e6..f649dfacb4b6 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml.dtsi +@@ -3,6 +3,7 @@ + * Copyright 2020-2021 TQ-Systems GmbH + */ + ++#include + #include "imx8mm.dtsi" + + / { +-- +2.35.1 + diff --git a/queue-5.19/batman-adv-fix-hang-up-with-small-mtu-hard-interface.patch b/queue-5.19/batman-adv-fix-hang-up-with-small-mtu-hard-interface.patch new file mode 100644 index 00000000000..f71cf5a9f56 --- /dev/null +++ b/queue-5.19/batman-adv-fix-hang-up-with-small-mtu-hard-interface.patch @@ -0,0 +1,65 @@ +From 4daf4c1ceeb35680c4e67270c0bc741a31de7f75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Aug 2022 12:25:16 +0900 +Subject: batman-adv: Fix hang up with small MTU hard-interface + +From: Shigeru Yoshida + +[ Upstream commit b1cb8a71f1eaec4eb77051590f7f561f25b15e32 ] + +The system hangs up when batman-adv soft-interface is created on +hard-interface with small MTU. For example, the following commands +create batman-adv soft-interface on dummy interface with zero MTU: + + # ip link add name dummy0 type dummy + # ip link set mtu 0 dev dummy0 + # ip link set up dev dummy0 + # ip link add name bat0 type batadv + # ip link set dev dummy0 master bat0 + +These commands cause the system hang up with the following messages: + + [ 90.578925][ T6689] batman_adv: bat0: Adding interface: dummy0 + [ 90.580884][ T6689] batman_adv: bat0: The MTU of interface dummy0 is too small (0) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. + [ 90.586264][ T6689] batman_adv: bat0: Interface activated: dummy0 + [ 90.590061][ T6689] batman_adv: bat0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) + [ 90.595517][ T6689] batman_adv: bat0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) + [ 90.598499][ T6689] batman_adv: bat0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) + +This patch fixes this issue by returning error when enabling +hard-interface with small MTU size. + +Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") +Signed-off-by: Shigeru Yoshida +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/hard-interface.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c +index b8f8da7ee3de..41c1ad33d009 100644 +--- a/net/batman-adv/hard-interface.c ++++ b/net/batman-adv/hard-interface.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -700,6 +701,9 @@ int batadv_hardif_enable_interface(struct batadv_hard_iface *hard_iface, + int max_header_len = batadv_max_header_len(); + int ret; + ++ if (hard_iface->net_dev->mtu < ETH_MIN_MTU + max_header_len) ++ return -EINVAL; ++ + if (hard_iface->if_status != BATADV_IF_NOT_IN_USE) + goto out; + +-- +2.35.1 + diff --git a/queue-5.19/bnxt-prevent-skb-uaf-after-handing-over-to-ptp-worke.patch b/queue-5.19/bnxt-prevent-skb-uaf-after-handing-over-to-ptp-worke.patch new file mode 100644 index 00000000000..308b32360b7 --- /dev/null +++ b/queue-5.19/bnxt-prevent-skb-uaf-after-handing-over-to-ptp-worke.patch @@ -0,0 +1,74 @@ +From d7aa2454c9ae29b306a165226fb01d0d749527d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Sep 2022 13:10:05 -0700 +Subject: bnxt: prevent skb UAF after handing over to PTP worker + +From: Jakub Kicinski + +[ Upstream commit c31f26c8f69f776759cbbdfb38e40ea91aa0dd65 ] + +When reading the timestamp is required bnxt_tx_int() hands +over the ownership of the completed skb to the PTP worker. +The skb should not be used afterwards, as the worker may +run before the rest of our code and free the skb, leading +to a use-after-free. + +Since dev_kfree_skb_any() accepts NULL make the loss of +ownership more obvious and set skb to NULL. + +Fixes: 83bb623c968e ("bnxt_en: Transmit and retrieve packet timestamps") +Reviewed-by: Andy Gospodarek +Reviewed-by: Michael Chan +Link: https://lore.kernel.org/r/20220921201005.335390-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 964354536f9c..111a952f880e 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -662,7 +662,6 @@ static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int nr_pkts) + + for (i = 0; i < nr_pkts; i++) { + struct bnxt_sw_tx_bd *tx_buf; +- bool compl_deferred = false; + struct sk_buff *skb; + int j, last; + +@@ -671,6 +670,8 @@ static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int nr_pkts) + skb = tx_buf->skb; + tx_buf->skb = NULL; + ++ tx_bytes += skb->len; ++ + if (tx_buf->is_push) { + tx_buf->is_push = 0; + goto next_tx_int; +@@ -691,8 +692,9 @@ static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int nr_pkts) + } + if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS)) { + if (bp->flags & BNXT_FLAG_CHIP_P5) { ++ /* PTP worker takes ownership of the skb */ + if (!bnxt_get_tx_ts_p5(bp, skb)) +- compl_deferred = true; ++ skb = NULL; + else + atomic_inc(&bp->ptp_cfg->tx_avail); + } +@@ -701,9 +703,7 @@ static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int nr_pkts) + next_tx_int: + cons = NEXT_TX(cons); + +- tx_bytes += skb->len; +- if (!compl_deferred) +- dev_kfree_skb_any(skb); ++ dev_kfree_skb_any(skb); + } + + netdev_tx_completed_queue(txq, nr_pkts, tx_bytes); +-- +2.35.1 + diff --git a/queue-5.19/bnxt_en-fix-flags-to-check-for-supported-fw-version.patch b/queue-5.19/bnxt_en-fix-flags-to-check-for-supported-fw-version.patch new file mode 100644 index 00000000000..e2c5824ef25 --- /dev/null +++ b/queue-5.19/bnxt_en-fix-flags-to-check-for-supported-fw-version.patch @@ -0,0 +1,44 @@ +From 7210a7ce43b704f642c55a981fc861806de3d5fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Sep 2022 02:49:32 +0300 +Subject: bnxt_en: fix flags to check for supported fw version + +From: Vadim Fedorenko + +[ Upstream commit ae8ffba8baad651af706538e8c47d0a049d406c6 ] + +The warning message of unsupported FW appears every time RX timestamps +are disabled on the interface. The patch fixes the flags to correct set +for the check. + +Fixes: 66ed81dcedc6 ("bnxt_en: Enable packet timestamping for all RX packets") +Cc: Richard Cochran +Signed-off-by: Vadim Fedorenko +Reviewed-by: Andy Gospodarek +Reviewed-by: Michael Chan +Link: https://lore.kernel.org/r/20220915234932.25497-1-vfedorenko@novek.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c +index 7f3c0875b6f5..8e316367f6ce 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c +@@ -317,9 +317,9 @@ void bnxt_ptp_cfg_tstamp_filters(struct bnxt *bp) + + if (!(bp->fw_cap & BNXT_FW_CAP_RX_ALL_PKT_TS) && (ptp->tstamp_filters & + (PORT_MAC_CFG_REQ_FLAGS_ALL_RX_TS_CAPTURE_ENABLE | +- PORT_MAC_CFG_REQ_FLAGS_PTP_RX_TS_CAPTURE_DISABLE))) { ++ PORT_MAC_CFG_REQ_FLAGS_ALL_RX_TS_CAPTURE_DISABLE))) { + ptp->tstamp_filters &= ~(PORT_MAC_CFG_REQ_FLAGS_ALL_RX_TS_CAPTURE_ENABLE | +- PORT_MAC_CFG_REQ_FLAGS_PTP_RX_TS_CAPTURE_DISABLE); ++ PORT_MAC_CFG_REQ_FLAGS_ALL_RX_TS_CAPTURE_DISABLE); + netdev_warn(bp->dev, "Unsupported FW for all RX pkts timestamp filter\n"); + } + +-- +2.35.1 + diff --git a/queue-5.19/bonding-fix-null-deref-in-bond_rr_gen_slave_id.patch b/queue-5.19/bonding-fix-null-deref-in-bond_rr_gen_slave_id.patch new file mode 100644 index 00000000000..ef7bbda8e56 --- /dev/null +++ b/queue-5.19/bonding-fix-null-deref-in-bond_rr_gen_slave_id.patch @@ -0,0 +1,135 @@ +From c07657bb1eeeef4f3e335b6acc1b0a065037be9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Sep 2022 13:45:52 -0400 +Subject: bonding: fix NULL deref in bond_rr_gen_slave_id + +From: Jonathan Toppins + +[ Upstream commit 0e400d602f46360752e4b32ce842dba3808e15e6 ] + +Fix a NULL dereference of the struct bonding.rr_tx_counter member because +if a bond is initially created with an initial mode != zero (Round Robin) +the memory required for the counter is never created and when the mode is +changed there is never any attempt to verify the memory is allocated upon +switching modes. + +This causes the following Oops on an aarch64 machine: + [ 334.686773] Unable to handle kernel paging request at virtual address ffff2c91ac905000 + [ 334.694703] Mem abort info: + [ 334.697486] ESR = 0x0000000096000004 + [ 334.701234] EC = 0x25: DABT (current EL), IL = 32 bits + [ 334.706536] SET = 0, FnV = 0 + [ 334.709579] EA = 0, S1PTW = 0 + [ 334.712719] FSC = 0x04: level 0 translation fault + [ 334.717586] Data abort info: + [ 334.720454] ISV = 0, ISS = 0x00000004 + [ 334.724288] CM = 0, WnR = 0 + [ 334.727244] swapper pgtable: 4k pages, 48-bit VAs, pgdp=000008044d662000 + [ 334.733944] [ffff2c91ac905000] pgd=0000000000000000, p4d=0000000000000000 + [ 334.740734] Internal error: Oops: 96000004 [#1] SMP + [ 334.745602] Modules linked in: bonding tls veth rfkill sunrpc arm_spe_pmu vfat fat acpi_ipmi ipmi_ssif ixgbe igb i40e mdio ipmi_devintf ipmi_msghandler arm_cmn arm_dsu_pmu cppc_cpufreq acpi_tad fuse zram crct10dif_ce ast ghash_ce sbsa_gwdt nvme drm_vram_helper drm_ttm_helper nvme_core ttm xgene_hwmon + [ 334.772217] CPU: 7 PID: 2214 Comm: ping Not tainted 6.0.0-rc4-00133-g64ae13ed4784 #4 + [ 334.779950] Hardware name: GIGABYTE R272-P31-00/MP32-AR1-00, BIOS F18v (SCP: 1.08.20211002) 12/01/2021 + [ 334.789244] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + [ 334.796196] pc : bond_rr_gen_slave_id+0x40/0x124 [bonding] + [ 334.801691] lr : bond_xmit_roundrobin_slave_get+0x38/0xdc [bonding] + [ 334.807962] sp : ffff8000221733e0 + [ 334.811265] x29: ffff8000221733e0 x28: ffffdbac8572d198 x27: ffff80002217357c + [ 334.818392] x26: 000000000000002a x25: ffffdbacb33ee000 x24: ffff07ff980fa000 + [ 334.825519] x23: ffffdbacb2e398ba x22: ffff07ff98102000 x21: ffff07ff981029c0 + [ 334.832646] x20: 0000000000000001 x19: ffff07ff981029c0 x18: 0000000000000014 + [ 334.839773] x17: 0000000000000000 x16: ffffdbacb1004364 x15: 0000aaaabe2f5a62 + [ 334.846899] x14: ffff07ff8e55d968 x13: ffff07ff8e55db30 x12: 0000000000000000 + [ 334.854026] x11: ffffdbacb21532e8 x10: 0000000000000001 x9 : ffffdbac857178ec + [ 334.861153] x8 : ffff07ff9f6e5a28 x7 : 0000000000000000 x6 : 000000007c2b3742 + [ 334.868279] x5 : ffff2c91ac905000 x4 : ffff2c91ac905000 x3 : ffff07ff9f554400 + [ 334.875406] x2 : ffff2c91ac905000 x1 : 0000000000000001 x0 : ffff07ff981029c0 + [ 334.882532] Call trace: + [ 334.884967] bond_rr_gen_slave_id+0x40/0x124 [bonding] + [ 334.890109] bond_xmit_roundrobin_slave_get+0x38/0xdc [bonding] + [ 334.896033] __bond_start_xmit+0x128/0x3a0 [bonding] + [ 334.901001] bond_start_xmit+0x54/0xb0 [bonding] + [ 334.905622] dev_hard_start_xmit+0xb4/0x220 + [ 334.909798] __dev_queue_xmit+0x1a0/0x720 + [ 334.913799] arp_xmit+0x3c/0xbc + [ 334.916932] arp_send_dst+0x98/0xd0 + [ 334.920410] arp_solicit+0xe8/0x230 + [ 334.923888] neigh_probe+0x60/0xb0 + [ 334.927279] __neigh_event_send+0x3b0/0x470 + [ 334.931453] neigh_resolve_output+0x70/0x90 + [ 334.935626] ip_finish_output2+0x158/0x514 + [ 334.939714] __ip_finish_output+0xac/0x1a4 + [ 334.943800] ip_finish_output+0x40/0xfc + [ 334.947626] ip_output+0xf8/0x1a4 + [ 334.950931] ip_send_skb+0x5c/0x100 + [ 334.954410] ip_push_pending_frames+0x3c/0x60 + [ 334.958758] raw_sendmsg+0x458/0x6d0 + [ 334.962325] inet_sendmsg+0x50/0x80 + [ 334.965805] sock_sendmsg+0x60/0x6c + [ 334.969286] __sys_sendto+0xc8/0x134 + [ 334.972853] __arm64_sys_sendto+0x34/0x4c + [ 334.976854] invoke_syscall+0x78/0x100 + [ 334.980594] el0_svc_common.constprop.0+0x4c/0xf4 + [ 334.985287] do_el0_svc+0x38/0x4c + [ 334.988591] el0_svc+0x34/0x10c + [ 334.991724] el0t_64_sync_handler+0x11c/0x150 + [ 334.996072] el0t_64_sync+0x190/0x194 + [ 334.999726] Code: b9001062 f9403c02 d53cd044 8b040042 (b8210040) + [ 335.005810] ---[ end trace 0000000000000000 ]--- + [ 335.010416] Kernel panic - not syncing: Oops: Fatal exception in interrupt + [ 335.017279] SMP: stopping secondary CPUs + [ 335.021374] Kernel Offset: 0x5baca8eb0000 from 0xffff800008000000 + [ 335.027456] PHYS_OFFSET: 0x80000000 + [ 335.030932] CPU features: 0x0000,0085c029,19805c82 + [ 335.035713] Memory Limit: none + [ 335.038756] Rebooting in 180 seconds.. + +The fix is to allocate the memory in bond_open() which is guaranteed +to be called before any packets are processed. + +Fixes: 848ca9182a7d ("net: bonding: Use per-cpu rr_tx_counter") +CC: Jussi Maki +Signed-off-by: Jonathan Toppins +Acked-by: Jay Vosburgh +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 83852e6719e2..ab7cb48f8dfd 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -4155,6 +4155,12 @@ static int bond_open(struct net_device *bond_dev) + struct list_head *iter; + struct slave *slave; + ++ if (BOND_MODE(bond) == BOND_MODE_ROUNDROBIN && !bond->rr_tx_counter) { ++ bond->rr_tx_counter = alloc_percpu(u32); ++ if (!bond->rr_tx_counter) ++ return -ENOMEM; ++ } ++ + /* reset slave->backup and slave->inactive */ + if (bond_has_slaves(bond)) { + bond_for_each_slave(bond, slave, iter) { +@@ -6210,15 +6216,6 @@ static int bond_init(struct net_device *bond_dev) + if (!bond->wq) + return -ENOMEM; + +- if (BOND_MODE(bond) == BOND_MODE_ROUNDROBIN) { +- bond->rr_tx_counter = alloc_percpu(u32); +- if (!bond->rr_tx_counter) { +- destroy_workqueue(bond->wq); +- bond->wq = NULL; +- return -ENOMEM; +- } +- } +- + spin_lock_init(&bond->stats_lock); + netdev_lockdep_set_classes(bond_dev); + +-- +2.35.1 + diff --git a/queue-5.19/can-gs_usb-gs_can_open-fix-race-dev-can.state-condit.patch b/queue-5.19/can-gs_usb-gs_can_open-fix-race-dev-can.state-condit.patch new file mode 100644 index 00000000000..336bde26453 --- /dev/null +++ b/queue-5.19/can-gs_usb-gs_can_open-fix-race-dev-can.state-condit.patch @@ -0,0 +1,55 @@ +From add4d5e16c90659eae1585fc0dc49093547f8a83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Sep 2022 11:40:56 +0200 +Subject: can: gs_usb: gs_can_open(): fix race dev->can.state condition + +From: Marc Kleine-Budde + +[ Upstream commit 5440428b3da65408dba0241985acb7a05258b85e ] + +The dev->can.state is set to CAN_STATE_ERROR_ACTIVE, after the device +has been started. On busy networks the CAN controller might receive +CAN frame between and go into an error state before the dev->can.state +is assigned. + +Assign dev->can.state before starting the controller to close the race +window. + +Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") +Link: https://lore.kernel.org/all/20220920195216.232481-1-mkl@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/gs_usb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c +index d3a658b444b5..092cd51b3926 100644 +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -824,6 +824,7 @@ static int gs_can_open(struct net_device *netdev) + flags |= GS_CAN_MODE_TRIPLE_SAMPLE; + + /* finally start device */ ++ dev->can.state = CAN_STATE_ERROR_ACTIVE; + dm->mode = cpu_to_le32(GS_CAN_MODE_START); + dm->flags = cpu_to_le32(flags); + rc = usb_control_msg(interface_to_usbdev(dev->iface), +@@ -835,13 +836,12 @@ static int gs_can_open(struct net_device *netdev) + if (rc < 0) { + netdev_err(netdev, "Couldn't start device (err=%d)\n", rc); + kfree(dm); ++ dev->can.state = CAN_STATE_STOPPED; + return rc; + } + + kfree(dm); + +- dev->can.state = CAN_STATE_ERROR_ACTIVE; +- + parent->active_channels++; + if (!(dev->can.ctrlmode & CAN_CTRLMODE_LISTENONLY)) + netif_start_queue(netdev); +-- +2.35.1 + diff --git a/queue-5.19/dmaengine-ti-k3-udma-private-fix-refcount-leak-bug-i.patch b/queue-5.19/dmaengine-ti-k3-udma-private-fix-refcount-leak-bug-i.patch new file mode 100644 index 00000000000..315e10b604b --- /dev/null +++ b/queue-5.19/dmaengine-ti-k3-udma-private-fix-refcount-leak-bug-i.patch @@ -0,0 +1,49 @@ +From c19f9d2d87c76c17f899dcafbc446aad1d2a289c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jul 2022 15:32:34 +0800 +Subject: dmaengine: ti: k3-udma-private: Fix refcount leak bug in + of_xudma_dev_get() + +From: Liang He + +[ Upstream commit f9fdb0b86f087c2b7f6c6168dd0985a3c1eda87e ] + +We should call of_node_put() for the reference returned by +of_parse_phandle() in fail path or when it is not used anymore. +Here we only need to move the of_node_put() before the check. + +Fixes: d70241913413 ("dmaengine: ti: k3-udma: Add glue layer for non DMAengine users") +Signed-off-by: Liang He +Acked-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20220720073234.1255474-1-windhl@126.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ti/k3-udma-private.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/dma/ti/k3-udma-private.c b/drivers/dma/ti/k3-udma-private.c +index d4f1e4e9603a..85e00701473c 100644 +--- a/drivers/dma/ti/k3-udma-private.c ++++ b/drivers/dma/ti/k3-udma-private.c +@@ -31,14 +31,14 @@ struct udma_dev *of_xudma_dev_get(struct device_node *np, const char *property) + } + + pdev = of_find_device_by_node(udma_node); ++ if (np != udma_node) ++ of_node_put(udma_node); ++ + if (!pdev) { + pr_debug("UDMA device not found\n"); + return ERR_PTR(-EPROBE_DEFER); + } + +- if (np != udma_node) +- of_node_put(udma_node); +- + ud = platform_get_drvdata(pdev); + if (!ud) { + pr_debug("UDMA has not been probed\n"); +-- +2.35.1 + diff --git a/queue-5.19/drm-hisilicon-add-depends-on-mmu.patch b/queue-5.19/drm-hisilicon-add-depends-on-mmu.patch new file mode 100644 index 00000000000..b201a9200d9 --- /dev/null +++ b/queue-5.19/drm-hisilicon-add-depends-on-mmu.patch @@ -0,0 +1,63 @@ +From 463017bec52b749f60cced8fee3f5a70bcee2298 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 May 2022 19:55:57 -0700 +Subject: drm/hisilicon: Add depends on MMU + +From: Randy Dunlap + +[ Upstream commit d8a79c03054911c375a2252627a429c9bc4615b6 ] + +The Kconfig symbol depended on MMU but was dropped by the commit +acad3fe650a5 ("drm/hisilicon: Removed the dependency on the mmu") +because it already had as a dependency ARM64 that already selects MMU. + +But later, commit a0f25a6bb319 ("drm/hisilicon/hibmc: Allow to be built +if COMPILE_TEST is enabled") allowed the driver to be built for non-ARM64 +when COMPILE_TEST is set but that could lead to unmet direct dependencies +and linking errors. + +Prevent a kconfig warning when MMU is not enabled by making +DRM_HISI_HIBMC depend on MMU. + +WARNING: unmet direct dependencies detected for DRM_TTM + Depends on [n]: HAS_IOMEM [=y] && DRM [=m] && MMU [=n] + Selected by [m]: + - DRM_TTM_HELPER [=m] && HAS_IOMEM [=y] && DRM [=m] + - DRM_HISI_HIBMC [=m] && HAS_IOMEM [=y] && DRM [=m] && PCI [=y] && (ARM64 || COMPILE_TEST [=y]) + +Fixes: acad3fe650a5 ("drm/hisilicon: Removed the dependency on the mmu") +Signed-off-by: Randy Dunlap +Cc: Gerd Hoffmann +Cc: Thomas Zimmermann +Cc: Xinliang Liu +Cc: Tian Tao +Cc: John Stultz +Cc: Xinwei Kong +Cc: Chen Feng +Cc: Christian Koenig +Cc: Huang Rui +Cc: David Airlie +Cc: Daniel Vetter +Reviewed-by: Javier Martinez Canillas +Signed-off-by: Javier Martinez Canillas +Link: https://patchwork.freedesktop.org/patch/msgid/20220531025557.29593-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/hisilicon/hibmc/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/hisilicon/hibmc/Kconfig b/drivers/gpu/drm/hisilicon/hibmc/Kconfig +index 073adfe438dd..4e41c144a290 100644 +--- a/drivers/gpu/drm/hisilicon/hibmc/Kconfig ++++ b/drivers/gpu/drm/hisilicon/hibmc/Kconfig +@@ -2,6 +2,7 @@ + config DRM_HISI_HIBMC + tristate "DRM Support for Hisilicon Hibmc" + depends on DRM && PCI && (ARM64 || COMPILE_TEST) ++ depends on MMU + select DRM_KMS_HELPER + select DRM_VRAM_HELPER + select DRM_TTM +-- +2.35.1 + diff --git a/queue-5.19/drm-mediatek-dsi-add-atomic-destroy-duplicate-_state.patch b/queue-5.19/drm-mediatek-dsi-add-atomic-destroy-duplicate-_state.patch new file mode 100644 index 00000000000..b8f33bc88e2 --- /dev/null +++ b/queue-5.19/drm-mediatek-dsi-add-atomic-destroy-duplicate-_state.patch @@ -0,0 +1,52 @@ +From 154e7095f37867ec9a14b2454be0f9970000aeed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jul 2022 19:27:27 +0200 +Subject: drm/mediatek: dsi: Add atomic {destroy,duplicate}_state, reset + callbacks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: AngeloGioacchino Del Regno + +[ Upstream commit eeda05b5e92f51d9a09646ecb493f0a1e872a6ef ] + +Add callbacks for atomic_destroy_state, atomic_duplicate_state and +atomic_reset to restore functionality of the DSI driver: this solves +vblank timeouts when another bridge is present in the chain. + +Tested bridge chain: DSI <=> ANX7625 => aux-bus panel + +Fixes: 7f6335c6a258 ("drm/mediatek: Modify dsi funcs to atomic operations") +Signed-off-by: AngeloGioacchino Del Regno +Tested-by: Chen-Yu Tsai +Reviewed-by: Nícolas F. R. A. Prado +Tested-by: Nícolas F. R. A. Prado +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20220721172727.14624-1-angelogioacchino.delregno@collabora.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dsi.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c +index af2f123e9a9a..e98b4aca2cb9 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dsi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c +@@ -808,10 +808,13 @@ static void mtk_dsi_bridge_atomic_post_disable(struct drm_bridge *bridge, + + static const struct drm_bridge_funcs mtk_dsi_bridge_funcs = { + .attach = mtk_dsi_bridge_attach, ++ .atomic_destroy_state = drm_atomic_helper_bridge_destroy_state, + .atomic_disable = mtk_dsi_bridge_atomic_disable, ++ .atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state, + .atomic_enable = mtk_dsi_bridge_atomic_enable, + .atomic_pre_enable = mtk_dsi_bridge_atomic_pre_enable, + .atomic_post_disable = mtk_dsi_bridge_atomic_post_disable, ++ .atomic_reset = drm_atomic_helper_bridge_reset, + .mode_set = mtk_dsi_bridge_mode_set, + }; + +-- +2.35.1 + diff --git a/queue-5.19/drm-mediatek-dsi-move-mtk_dsi_stop-call-back-to-mtk_.patch b/queue-5.19/drm-mediatek-dsi-move-mtk_dsi_stop-call-back-to-mtk_.patch new file mode 100644 index 00000000000..10b98d9cb17 --- /dev/null +++ b/queue-5.19/drm-mediatek-dsi-move-mtk_dsi_stop-call-back-to-mtk_.patch @@ -0,0 +1,85 @@ +From 56871f7875a54c03738d69036ef334c8ae21f6e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Aug 2022 15:43:25 -0400 +Subject: drm/mediatek: dsi: Move mtk_dsi_stop() call back to + mtk_dsi_poweroff() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 90144dd8b0d137d9e78ef34b3c418e51a49299ad ] + +As the comment right before the mtk_dsi_stop() call advises, +mtk_dsi_stop() should only be called after +mtk_drm_crtc_atomic_disable(). That's because that function calls +drm_crtc_wait_one_vblank(), which requires the vblank irq to be enabled. + +Previously mtk_dsi_stop(), being in mtk_dsi_poweroff() and guarded by a +refcount, would only be called at the end of +mtk_drm_crtc_atomic_disable(), through the call to mtk_crtc_ddp_hw_fini(). +Commit cde7e2e35c28 ("drm/mediatek: Separate poweron/poweroff from +enable/disable and define new funcs") moved the mtk_dsi_stop() call to +mtk_output_dsi_disable(), causing it to be called before +mtk_drm_crtc_atomic_disable(), and consequently generating vblank +timeout warnings during suspend. + +Move the mtk_dsi_stop() call back to mtk_dsi_poweroff() so that we have +a working vblank irq during mtk_drm_crtc_atomic_disable() and stop +getting vblank timeout warnings. + +Fixes: cde7e2e35c28 ("drm/mediatek: Separate poweron/poweroff from enable/disable and define new funcs") +Signed-off-by: Nícolas F. R. A. Prado +Tested-by: Hsin-Yi Wang +Reviewed-by: AngeloGioacchino Del Regno +Tested-by: Allen-KH Cheng +Link: http://lists.infradead.org/pipermail/linux-mediatek/2022-August/046713.html +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dsi.c | 21 ++++++++++----------- + 1 file changed, 10 insertions(+), 11 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c +index e98b4aca2cb9..9a3b86c29b50 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dsi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c +@@ -685,6 +685,16 @@ static void mtk_dsi_poweroff(struct mtk_dsi *dsi) + if (--dsi->refcount != 0) + return; + ++ /* ++ * mtk_dsi_stop() and mtk_dsi_start() is asymmetric, since ++ * mtk_dsi_stop() should be called after mtk_drm_crtc_atomic_disable(), ++ * which needs irq for vblank, and mtk_dsi_stop() will disable irq. ++ * mtk_dsi_start() needs to be called in mtk_output_dsi_enable(), ++ * after dsi is fully set. ++ */ ++ mtk_dsi_stop(dsi); ++ ++ mtk_dsi_switch_to_cmd_mode(dsi, VM_DONE_INT_FLAG, 500); + mtk_dsi_reset_engine(dsi); + mtk_dsi_lane0_ulp_mode_enter(dsi); + mtk_dsi_clk_ulp_mode_enter(dsi); +@@ -735,17 +745,6 @@ static void mtk_output_dsi_disable(struct mtk_dsi *dsi) + if (!dsi->enabled) + return; + +- /* +- * mtk_dsi_stop() and mtk_dsi_start() is asymmetric, since +- * mtk_dsi_stop() should be called after mtk_drm_crtc_atomic_disable(), +- * which needs irq for vblank, and mtk_dsi_stop() will disable irq. +- * mtk_dsi_start() needs to be called in mtk_output_dsi_enable(), +- * after dsi is fully set. +- */ +- mtk_dsi_stop(dsi); +- +- mtk_dsi_switch_to_cmd_mode(dsi, VM_DONE_INT_FLAG, 500); +- + dsi->enabled = false; + } + +-- +2.35.1 + diff --git a/queue-5.19/drm-mediatek-fix-wrong-dither-settings.patch b/queue-5.19/drm-mediatek-fix-wrong-dither-settings.patch new file mode 100644 index 00000000000..de2a64c5bba --- /dev/null +++ b/queue-5.19/drm-mediatek-fix-wrong-dither-settings.patch @@ -0,0 +1,41 @@ +From db08ed0c905ac5c9aef98ce30dd86ace627b484f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Sep 2022 22:12:05 +0800 +Subject: drm/mediatek: Fix wrong dither settings + +From: Allen-KH Cheng + +[ Upstream commit 87fd9294e63e8fa7532b5e65b534c3001c654ef8 ] + +The width and height arguments in the cmdq packet for mtk_dither_config() +are inverted. We fix the incorrect width and height for dither settings +in mtk_dither_config(). + +Fixes: 73d3724745db ("drm/mediatek: Adjust to the alphabetic order for mediatek-drm") +Co-developed-by: Yongqiang Niu +Signed-off-by: Yongqiang Niu +Signed-off-by: Allen-KH Cheng +Reviewed-by: Matthias Brugger +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20220908141205.18256-1-allen-kh.cheng@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c +index 5d7504a72b11..e244aa408d9d 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c +@@ -151,7 +151,7 @@ static void mtk_dither_config(struct device *dev, unsigned int w, + { + struct mtk_ddp_comp_dev *priv = dev_get_drvdata(dev); + +- mtk_ddp_write(cmdq_pkt, h << 16 | w, &priv->cmdq_reg, priv->regs, DISP_REG_DITHER_SIZE); ++ mtk_ddp_write(cmdq_pkt, w << 16 | h, &priv->cmdq_reg, priv->regs, DISP_REG_DITHER_SIZE); + mtk_ddp_write(cmdq_pkt, DITHER_RELAY_MODE, &priv->cmdq_reg, priv->regs, + DISP_REG_DITHER_CFG); + mtk_dither_set_common(priv->regs, &priv->cmdq_reg, bpc, DISP_REG_DITHER_CFG, +-- +2.35.1 + diff --git a/queue-5.19/drm-panel-simple-fix-innolux_g121i1_l01-bus_format.patch b/queue-5.19/drm-panel-simple-fix-innolux_g121i1_l01-bus_format.patch new file mode 100644 index 00000000000..22e265888b8 --- /dev/null +++ b/queue-5.19/drm-panel-simple-fix-innolux_g121i1_l01-bus_format.patch @@ -0,0 +1,38 @@ +From 04e049b1fe6b29a3426f93bc2b7959a1c405b733 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 13:50:21 -0300 +Subject: drm/panel: simple: Fix innolux_g121i1_l01 bus_format + +From: Heiko Schocher + +[ Upstream commit a7c48a0ab87ae52c087d663e83e56b8225ac4cce ] + +innolux_g121i1_l01 sets bpc to 6, so use the corresponding bus format: +MEDIA_BUS_FMT_RGB666_1X7X3_SPWG. + +Fixes: 4ae13e486866 ("drm/panel: simple: Add more properties to Innolux G121I1-L01") +Signed-off-by: Heiko Schocher +Signed-off-by: Fabio Estevam +Signed-off-by: Marek Vasut +Link: https://patchwork.freedesktop.org/patch/msgid/20220826165021.1592532-1-festevam@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-simple.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index 4a2e580a2f7b..0e001ce8a40f 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -2136,7 +2136,7 @@ static const struct panel_desc innolux_g121i1_l01 = { + .enable = 200, + .disable = 20, + }, +- .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, ++ .bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG, + .connector_type = DRM_MODE_CONNECTOR_LVDS, + }; + +-- +2.35.1 + diff --git a/queue-5.19/firmware-arm_scmi-fix-the-asynchronous-reset-request.patch b/queue-5.19/firmware-arm_scmi-fix-the-asynchronous-reset-request.patch new file mode 100644 index 00000000000..da29b4b8e5b --- /dev/null +++ b/queue-5.19/firmware-arm_scmi-fix-the-asynchronous-reset-request.patch @@ -0,0 +1,56 @@ +From 44ce065874cfab5b026970f752c735b79724542b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Aug 2022 18:27:30 +0100 +Subject: firmware: arm_scmi: Fix the asynchronous reset requests + +From: Cristian Marussi + +[ Upstream commit b75c83d9b961fd3abf7310f8d36d5e6e9f573efb ] + +SCMI Reset protocol specification allows the asynchronous reset request +only when an autonomous reset action is specified. Reset requests based +on explicit assert/deassert of signals should not be served +asynchronously. + +Current implementation will instead issue an asynchronous request in any +case, as long as the reset domain had advertised to support asynchronous +resets. + +Avoid requesting the asynchronous resets when the reset action is not +of the autonomous type, even if the target reset domain does, in general, +support the asynchronous requests. + +Link: https://lore.kernel.org/r/20220817172731.1185305-6-cristian.marussi@arm.com +Fixes: 95a15d80aa0d ("firmware: arm_scmi: Add RESET protocol in SCMI v2.0") +Signed-off-by: Cristian Marussi +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/reset.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/reset.c b/drivers/firmware/arm_scmi/reset.c +index b0494165b1cb..e9afa8cab730 100644 +--- a/drivers/firmware/arm_scmi/reset.c ++++ b/drivers/firmware/arm_scmi/reset.c +@@ -172,7 +172,7 @@ static int scmi_domain_reset(const struct scmi_protocol_handle *ph, u32 domain, + return -EINVAL; + + rdom = pi->dom_info + domain; +- if (rdom->async_reset) ++ if (rdom->async_reset && flags & AUTONOMOUS_RESET) + flags |= ASYNCHRONOUS_RESET; + + ret = ph->xops->xfer_get_init(ph, RESET, sizeof(*dom), 0, &t); +@@ -184,7 +184,7 @@ static int scmi_domain_reset(const struct scmi_protocol_handle *ph, u32 domain, + dom->flags = cpu_to_le32(flags); + dom->reset_state = cpu_to_le32(state); + +- if (rdom->async_reset) ++ if (flags & ASYNCHRONOUS_RESET) + ret = ph->xops->do_xfer_with_response(ph, t); + else + ret = ph->xops->do_xfer(ph, t); +-- +2.35.1 + diff --git a/queue-5.19/firmware-arm_scmi-harden-accesses-to-the-reset-domai.patch b/queue-5.19/firmware-arm_scmi-harden-accesses-to-the-reset-domai.patch new file mode 100644 index 00000000000..73e28be1986 --- /dev/null +++ b/queue-5.19/firmware-arm_scmi-harden-accesses-to-the-reset-domai.patch @@ -0,0 +1,46 @@ +From f529f83b564f8dda8f1d10a73c54c408e9b9fb39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Aug 2022 18:27:29 +0100 +Subject: firmware: arm_scmi: Harden accesses to the reset domains + +From: Cristian Marussi + +[ Upstream commit e9076ffbcaed5da6c182b144ef9f6e24554af268 ] + +Accessing reset domains descriptors by the index upon the SCMI drivers +requests through the SCMI reset operations interface can potentially +lead to out-of-bound violations if the SCMI driver misbehave. + +Add an internal consistency check before any such domains descriptors +accesses. + +Link: https://lore.kernel.org/r/20220817172731.1185305-5-cristian.marussi@arm.com +Signed-off-by: Cristian Marussi +Signed-off-by: Sudeep Holla +Stable-dep-of: b75c83d9b961 ("firmware: arm_scmi: Fix the asynchronous reset requests") +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/reset.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/firmware/arm_scmi/reset.c b/drivers/firmware/arm_scmi/reset.c +index 673f3eb498f4..b0494165b1cb 100644 +--- a/drivers/firmware/arm_scmi/reset.c ++++ b/drivers/firmware/arm_scmi/reset.c +@@ -166,8 +166,12 @@ static int scmi_domain_reset(const struct scmi_protocol_handle *ph, u32 domain, + struct scmi_xfer *t; + struct scmi_msg_reset_domain_reset *dom; + struct scmi_reset_info *pi = ph->get_priv(ph); +- struct reset_dom_info *rdom = pi->dom_info + domain; ++ struct reset_dom_info *rdom; + ++ if (domain >= pi->num_domains) ++ return -EINVAL; ++ ++ rdom = pi->dom_info + domain; + if (rdom->async_reset) + flags |= ASYNCHRONOUS_RESET; + +-- +2.35.1 + diff --git a/queue-5.19/gpio-tqmx86-fix-uninitialized-variable-girq.patch b/queue-5.19/gpio-tqmx86-fix-uninitialized-variable-girq.patch new file mode 100644 index 00000000000..0599ed4486b --- /dev/null +++ b/queue-5.19/gpio-tqmx86-fix-uninitialized-variable-girq.patch @@ -0,0 +1,50 @@ +From 137aba0c032a59c98cbaa11607e50d0de26dc8ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Sep 2022 11:12:49 +0800 +Subject: gpio: tqmx86: fix uninitialized variable girq + +From: Dongliang Mu + +[ Upstream commit 21a9acc162457402c74c5c1e16471fda6eb090c0 ] + +The commit 924610607f19 ("gpio: tpmx86: Move PM device over to +irq domain") adds a dereference of girq that may be uninitialized. + +Fix this by moving irq_domain_set_pm_device into if true branch +as suggested by Marc Zyngier. + +Fixes: 924610607f19 ("gpio: tpmx86: Move PM device over to irq domain") +Suggested-by: Marc Zyngier +Signed-off-by: Dongliang Mu +Acked-by: Marc Zyngier +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-tqmx86.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-tqmx86.c b/drivers/gpio/gpio-tqmx86.c +index fa4bc7481f9a..e739dcea61b2 100644 +--- a/drivers/gpio/gpio-tqmx86.c ++++ b/drivers/gpio/gpio-tqmx86.c +@@ -307,6 +307,8 @@ static int tqmx86_gpio_probe(struct platform_device *pdev) + girq->default_type = IRQ_TYPE_NONE; + girq->handler = handle_simple_irq; + girq->init_valid_mask = tqmx86_init_irq_valid_mask; ++ ++ irq_domain_set_pm_device(girq->domain, dev); + } + + ret = devm_gpiochip_add_data(dev, chip, gpio); +@@ -315,8 +317,6 @@ static int tqmx86_gpio_probe(struct platform_device *pdev) + goto out_pm_dis; + } + +- irq_domain_set_pm_device(girq->domain, dev); +- + dev_info(dev, "GPIO functionality initialized with %d pins\n", + chip->ngpio); + +-- +2.35.1 + diff --git a/queue-5.19/gve-fix-gfp-flags-when-allocing-pages.patch b/queue-5.19/gve-fix-gfp-flags-when-allocing-pages.patch new file mode 100644 index 00000000000..d51dc39a995 --- /dev/null +++ b/queue-5.19/gve-fix-gfp-flags-when-allocing-pages.patch @@ -0,0 +1,42 @@ +From fe1139de94c0597260bcf2642011bd98988abf8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Sep 2022 17:09:01 -0700 +Subject: gve: Fix GFP flags when allocing pages + +From: Shailend Chand + +[ Upstream commit 8ccac4edc8da764389d4fc18b1df740892006557 ] + +Use GFP_ATOMIC when allocating pages out of the hotpath, +continue to use GFP_KERNEL when allocating pages during setup. + +GFP_KERNEL will allow blocking which allows it to succeed +more often in a low memory enviornment but in the hotpath we do +not want to allow the allocation to block. + +Fixes: 9b8dd5e5ea48b ("gve: DQO: Add RX path") +Signed-off-by: Shailend Chand +Signed-off-by: Jeroen de Borst +Link: https://lore.kernel.org/r/20220913000901.959546-1-jeroendb@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/google/gve/gve_rx_dqo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/google/gve/gve_rx_dqo.c b/drivers/net/ethernet/google/gve/gve_rx_dqo.c +index 8c939628e2d8..2e6461b0ea8b 100644 +--- a/drivers/net/ethernet/google/gve/gve_rx_dqo.c ++++ b/drivers/net/ethernet/google/gve/gve_rx_dqo.c +@@ -157,7 +157,7 @@ static int gve_alloc_page_dqo(struct gve_priv *priv, + int err; + + err = gve_alloc_page(priv, &priv->pdev->dev, &buf_state->page_info.page, +- &buf_state->addr, DMA_FROM_DEVICE, GFP_KERNEL); ++ &buf_state->addr, DMA_FROM_DEVICE, GFP_ATOMIC); + if (err) + return err; + +-- +2.35.1 + diff --git a/queue-5.19/i40e-fix-set-max_tx_rate-when-it-is-lower-than-1-mbp.patch b/queue-5.19/i40e-fix-set-max_tx_rate-when-it-is-lower-than-1-mbp.patch new file mode 100644 index 00000000000..b697a9049ce --- /dev/null +++ b/queue-5.19/i40e-fix-set-max_tx_rate-when-it-is-lower-than-1-mbp.patch @@ -0,0 +1,100 @@ +From 95f58e2fa699996ca88951135c9d6671c13e5744 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Sep 2022 09:49:33 +0200 +Subject: i40e: Fix set max_tx_rate when it is lower than 1 Mbps + +From: Michal Jaron + +[ Upstream commit 198eb7e1b81d8ba676d0f4f120c092032ae69a8e ] + +While converting max_tx_rate from bytes to Mbps, this value was set to 0, +if the original value was lower than 125000 bytes (1 Mbps). This would +cause no transmission rate limiting to occur. This happened due to lack of +check of max_tx_rate against the 1 Mbps value for max_tx_rate and the +following division by 125000. Fix this issue by adding a helper +i40e_bw_bytes_to_mbits() which sets max_tx_rate to minimum usable value of +50 Mbps, if its value is less than 1 Mbps, otherwise do the required +conversion by dividing by 125000. + +Fixes: 5ecae4120a6b ("i40e: Refactor VF BW rate limiting") +Signed-off-by: Michal Jaron +Signed-off-by: Andrii Staikov +Tested-by: Bharathi Sreenivas +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 32 +++++++++++++++++---- + 1 file changed, 26 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 1aaf0c5ddf6c..57e27f2024d3 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -5785,6 +5785,26 @@ static int i40e_get_link_speed(struct i40e_vsi *vsi) + } + } + ++/** ++ * i40e_bw_bytes_to_mbits - Convert max_tx_rate from bytes to mbits ++ * @vsi: Pointer to vsi structure ++ * @max_tx_rate: max TX rate in bytes to be converted into Mbits ++ * ++ * Helper function to convert units before send to set BW limit ++ **/ ++static u64 i40e_bw_bytes_to_mbits(struct i40e_vsi *vsi, u64 max_tx_rate) ++{ ++ if (max_tx_rate < I40E_BW_MBPS_DIVISOR) { ++ dev_warn(&vsi->back->pdev->dev, ++ "Setting max tx rate to minimum usable value of 50Mbps.\n"); ++ max_tx_rate = I40E_BW_CREDIT_DIVISOR; ++ } else { ++ do_div(max_tx_rate, I40E_BW_MBPS_DIVISOR); ++ } ++ ++ return max_tx_rate; ++} ++ + /** + * i40e_set_bw_limit - setup BW limit for Tx traffic based on max_tx_rate + * @vsi: VSI to be configured +@@ -5807,10 +5827,10 @@ int i40e_set_bw_limit(struct i40e_vsi *vsi, u16 seid, u64 max_tx_rate) + max_tx_rate, seid); + return -EINVAL; + } +- if (max_tx_rate && max_tx_rate < 50) { ++ if (max_tx_rate && max_tx_rate < I40E_BW_CREDIT_DIVISOR) { + dev_warn(&pf->pdev->dev, + "Setting max tx rate to minimum usable value of 50Mbps.\n"); +- max_tx_rate = 50; ++ max_tx_rate = I40E_BW_CREDIT_DIVISOR; + } + + /* Tx rate credits are in values of 50Mbps, 0 is disabled */ +@@ -8101,9 +8121,9 @@ static int i40e_setup_tc(struct net_device *netdev, void *type_data) + + if (i40e_is_tc_mqprio_enabled(pf)) { + if (vsi->mqprio_qopt.max_rate[0]) { +- u64 max_tx_rate = vsi->mqprio_qopt.max_rate[0]; ++ u64 max_tx_rate = i40e_bw_bytes_to_mbits(vsi, ++ vsi->mqprio_qopt.max_rate[0]); + +- do_div(max_tx_rate, I40E_BW_MBPS_DIVISOR); + ret = i40e_set_bw_limit(vsi, vsi->seid, max_tx_rate); + if (!ret) { + u64 credits = max_tx_rate; +@@ -10848,10 +10868,10 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired) + } + + if (vsi->mqprio_qopt.max_rate[0]) { +- u64 max_tx_rate = vsi->mqprio_qopt.max_rate[0]; ++ u64 max_tx_rate = i40e_bw_bytes_to_mbits(vsi, ++ vsi->mqprio_qopt.max_rate[0]); + u64 credits = 0; + +- do_div(max_tx_rate, I40E_BW_MBPS_DIVISOR); + ret = i40e_set_bw_limit(vsi, vsi->seid, max_tx_rate); + if (ret) + goto end_unlock; +-- +2.35.1 + diff --git a/queue-5.19/i40e-fix-vf-set-max-mtu-size.patch b/queue-5.19/i40e-fix-vf-set-max-mtu-size.patch new file mode 100644 index 00000000000..5b98b291335 --- /dev/null +++ b/queue-5.19/i40e-fix-vf-set-max-mtu-size.patch @@ -0,0 +1,67 @@ +From 6e3963d2868fdc86facfaa5257319845c25cccef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Sep 2022 15:38:36 +0200 +Subject: i40e: Fix VF set max MTU size + +From: Michal Jaron + +[ Upstream commit 372539def2824c43b6afe2403045b140f65c5acc ] + +Max MTU sent to VF is set to 0 during memory allocation. It cause +that max MTU on VF is changed to IAVF_MAX_RXBUFFER and does not +depend on data from HW. + +Set max_mtu field in virtchnl_vf_resource struct to inform +VF in GET_VF_RESOURCES msg what size should be max frame. + +Fixes: dab86afdbbd1 ("i40e/i40evf: Change the way we limit the maximum frame size for Rx") +Signed-off-by: Michal Jaron +Signed-off-by: Mateusz Palczewski +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 20 +++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 86b0f21287dc..67fbaaad3985 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -2038,6 +2038,25 @@ static void i40e_del_qch(struct i40e_vf *vf) + } + } + ++/** ++ * i40e_vc_get_max_frame_size ++ * @vf: pointer to the VF ++ * ++ * Max frame size is determined based on the current port's max frame size and ++ * whether a port VLAN is configured on this VF. The VF is not aware whether ++ * it's in a port VLAN so the PF needs to account for this in max frame size ++ * checks and sending the max frame size to the VF. ++ **/ ++static u16 i40e_vc_get_max_frame_size(struct i40e_vf *vf) ++{ ++ u16 max_frame_size = vf->pf->hw.phy.link_info.max_frame_size; ++ ++ if (vf->port_vlan_id) ++ max_frame_size -= VLAN_HLEN; ++ ++ return max_frame_size; ++} ++ + /** + * i40e_vc_get_vf_resources_msg + * @vf: pointer to the VF info +@@ -2139,6 +2158,7 @@ static int i40e_vc_get_vf_resources_msg(struct i40e_vf *vf, u8 *msg) + vfres->max_vectors = pf->hw.func_caps.num_msix_vectors_vf; + vfres->rss_key_size = I40E_HKEY_ARRAY_SIZE; + vfres->rss_lut_size = I40E_VF_HLUT_ARRAY_SIZE; ++ vfres->max_mtu = i40e_vc_get_max_frame_size(vf); + + if (vf->lan_vsi_idx) { + vfres->vsi_res[0].vsi_id = vf->lan_vsi_id; +-- +2.35.1 + diff --git a/queue-5.19/iavf-fix-bad-page-state.patch b/queue-5.19/iavf-fix-bad-page-state.patch new file mode 100644 index 00000000000..b67cc60e917 --- /dev/null +++ b/queue-5.19/iavf-fix-bad-page-state.patch @@ -0,0 +1,50 @@ +From d753a10d6d195e245a249f2146f1276c6a9d7cd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Sep 2022 15:39:13 +0200 +Subject: iavf: Fix bad page state + +From: Norbert Zulinski + +[ Upstream commit 66039eb9015eee4f7ff0c99b83c65c7ecb3c8190 ] + +Fix bad page state, free inappropriate page in handling dummy +descriptor. iavf_build_skb now has to check not only if rx_buffer is +NULL but also if size is zero, same thing in iavf_clean_rx_irq. +Without this patch driver would free page that will be used +by napi_build_skb. + +Fixes: a9f49e006030 ("iavf: Fix handling of dummy receive descriptors") +Signed-off-by: Norbert Zulinski +Signed-off-by: Mateusz Palczewski +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_txrx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_txrx.c b/drivers/net/ethernet/intel/iavf/iavf_txrx.c +index 4c3f3f419110..18b6a702a1d6 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_txrx.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_txrx.c +@@ -1393,7 +1393,7 @@ static struct sk_buff *iavf_build_skb(struct iavf_ring *rx_ring, + #endif + struct sk_buff *skb; + +- if (!rx_buffer) ++ if (!rx_buffer || !size) + return NULL; + /* prefetch first cache line of first page */ + va = page_address(rx_buffer->page) + rx_buffer->page_offset; +@@ -1551,7 +1551,7 @@ static int iavf_clean_rx_irq(struct iavf_ring *rx_ring, int budget) + /* exit if we failed to retrieve a buffer */ + if (!skb) { + rx_ring->rx_stats.alloc_buff_failed++; +- if (rx_buffer) ++ if (rx_buffer && size) + rx_buffer->pagecnt_bias++; + break; + } +-- +2.35.1 + diff --git a/queue-5.19/iavf-fix-cached-head-and-tail-value-for-iavf_get_tx_.patch b/queue-5.19/iavf-fix-cached-head-and-tail-value-for-iavf_get_tx_.patch new file mode 100644 index 00000000000..75ae6e888f1 --- /dev/null +++ b/queue-5.19/iavf-fix-cached-head-and-tail-value-for-iavf_get_tx_.patch @@ -0,0 +1,45 @@ +From 30036caa470c1e5830fb420ac8b7b1f8b7aaaa64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Sep 2022 16:34:40 +0200 +Subject: iavf: Fix cached head and tail value for iavf_get_tx_pending + +From: Brett Creeley + +[ Upstream commit 809f23c0423a43266e47a7dc67e95b5cb4d1cbfc ] + +The underlying hardware may or may not allow reading of the head or tail +registers and it really makes no difference if we use the software +cached values. So, always used the software cached values. + +Fixes: 9c6c12595b73 ("i40e: Detection and recovery of TX queue hung logic moved to service_task from tx_timeout") +Signed-off-by: Brett Creeley +Co-developed-by: Norbert Zulinski +Signed-off-by: Norbert Zulinski +Signed-off-by: Mateusz Palczewski +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_txrx.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_txrx.c b/drivers/net/ethernet/intel/iavf/iavf_txrx.c +index 06d18797d25a..4c3f3f419110 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_txrx.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_txrx.c +@@ -114,8 +114,11 @@ u32 iavf_get_tx_pending(struct iavf_ring *ring, bool in_sw) + { + u32 head, tail; + ++ /* underlying hardware might not allow access and/or always return ++ * 0 for the head/tail registers so just use the cached values ++ */ + head = ring->next_to_clean; +- tail = readl(ring->tail); ++ tail = ring->next_to_use; + + if (head != tail) + return (head < tail) ? +-- +2.35.1 + diff --git a/queue-5.19/iavf-fix-set-max-mtu-size-with-port-vlan-and-jumbo-f.patch b/queue-5.19/iavf-fix-set-max-mtu-size-with-port-vlan-and-jumbo-f.patch new file mode 100644 index 00000000000..aa4cf0e7c24 --- /dev/null +++ b/queue-5.19/iavf-fix-set-max-mtu-size-with-port-vlan-and-jumbo-f.patch @@ -0,0 +1,59 @@ +From f6fc2cc05207999ea28982b7eeadd699a9f1f47e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Sep 2022 15:38:35 +0200 +Subject: iavf: Fix set max MTU size with port VLAN and jumbo frames + +From: Michal Jaron + +[ Upstream commit 399c98c4dc50b7eb7e9f24da7ffdda6f025676ef ] + +After setting port VLAN and MTU to 9000 on VF with ice driver there +was an iavf error +"PF returned error -5 (IAVF_ERR_PARAM) to our request 6". + +During queue configuration, VF's max packet size was set to +IAVF_MAX_RXBUFFER but on ice max frame size was smaller by VLAN_HLEN +due to making some space for port VLAN as VF is not aware whether it's +in a port VLAN. This mismatch in sizes caused ice to reject queue +configuration with ERR_PARAM error. Proper max_mtu is sent from ice PF +to VF with GET_VF_RESOURCES msg but VF does not look at this. + +In iavf change max_frame from IAVF_MAX_RXBUFFER to max_mtu +received from pf with GET_VF_RESOURCES msg to make vf's +max_frame_size dependent from pf. Add check if received max_mtu is +not in eligible range then set it to IAVF_MAX_RXBUFFER. + +Fixes: dab86afdbbd1 ("i40e/i40evf: Change the way we limit the maximum frame size for Rx") +Signed-off-by: Michal Jaron +Signed-off-by: Mateusz Palczewski +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +index 1603e99bae4a..498797a0a0a9 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +@@ -273,11 +273,14 @@ int iavf_get_vf_vlan_v2_caps(struct iavf_adapter *adapter) + void iavf_configure_queues(struct iavf_adapter *adapter) + { + struct virtchnl_vsi_queue_config_info *vqci; +- struct virtchnl_queue_pair_info *vqpi; ++ int i, max_frame = adapter->vf_res->max_mtu; + int pairs = adapter->num_active_queues; +- int i, max_frame = IAVF_MAX_RXBUFFER; ++ struct virtchnl_queue_pair_info *vqpi; + size_t len; + ++ if (max_frame > IAVF_MAX_RXBUFFER || !max_frame) ++ max_frame = IAVF_MAX_RXBUFFER; ++ + if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) { + /* bail because we already have a command pending */ + dev_err(&adapter->pdev->dev, "Cannot configure queues, command %d pending\n", +-- +2.35.1 + diff --git a/queue-5.19/ice-config-netdev-tc-before-setting-queues-number.patch b/queue-5.19/ice-config-netdev-tc-before-setting-queues-number.patch new file mode 100644 index 00000000000..0aa4560c88e --- /dev/null +++ b/queue-5.19/ice-config-netdev-tc-before-setting-queues-number.patch @@ -0,0 +1,43 @@ +From b3d4cf103b0bb6e3789dbbd20694b2b5fd8a835a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Aug 2022 11:58:54 +0200 +Subject: ice: config netdev tc before setting queues number + +From: Michal Swiatkowski + +[ Upstream commit 122045ca770492660005c22379995506f13efea8 ] + +After lowering number of tx queues the warning appears: +"Number of in use tx queues changed invalidating tc mappings. Priority +traffic classification disabled!" +Example command to reproduce: +ethtool -L enp24s0f0 tx 36 rx 36 + +Fix this by setting correct tc mapping before setting real number of +queues on netdev. + +Fixes: 0754d65bd4be5 ("ice: Add infrastructure for mqprio support via ndo_setup_tc") +Signed-off-by: Michal Swiatkowski +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 0b567e8e3674..f963036571e0 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -6836,6 +6836,8 @@ int ice_vsi_open(struct ice_vsi *vsi) + if (err) + goto err_setup_rx; + ++ ice_vsi_cfg_netdev_tc(vsi, vsi->tc_cfg.ena_tc); ++ + if (vsi->type == ICE_VSI_PF) { + /* Notify the stack of the actual queue counts. */ + err = netif_set_real_num_tx_queues(vsi->netdev, vsi->num_txq); +-- +2.35.1 + diff --git a/queue-5.19/ice-don-t-double-unplug-aux-on-peer-initiated-reset.patch b/queue-5.19/ice-don-t-double-unplug-aux-on-peer-initiated-reset.patch new file mode 100644 index 00000000000..a23857d9e6d --- /dev/null +++ b/queue-5.19/ice-don-t-double-unplug-aux-on-peer-initiated-reset.patch @@ -0,0 +1,147 @@ +From 58c75c1649ab4cac1cfa3f8ae0eb1ba858c90478 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Aug 2022 10:24:23 -0700 +Subject: ice: Don't double unplug aux on peer initiated reset + +From: Dave Ertman + +[ Upstream commit 23c619190318376769ad7b61504c2ea0703fb783 ] + +In the IDC callback that is accessed when the aux drivers request a reset, +the function to unplug the aux devices is called. This function is also +called in the ice_prepare_for_reset function. This double call is causing +a "scheduling while atomic" BUG. + +[ 662.676430] ice 0000:4c:00.0 rocep76s0: cqp opcode = 0x1 maj_err_code = 0xffff min_err_code = 0x8003 + +[ 662.676609] ice 0000:4c:00.0 rocep76s0: [Modify QP Cmd Error][op_code=8] status=-29 waiting=1 completion_err=1 maj=0xffff min=0x8003 + +[ 662.815006] ice 0000:4c:00.0 rocep76s0: ICE OICR event notification: oicr = 0x10000003 + +[ 662.815014] ice 0000:4c:00.0 rocep76s0: critical PE Error, GLPE_CRITERR=0x00011424 + +[ 662.815017] ice 0000:4c:00.0 rocep76s0: Requesting a reset + +[ 662.815475] BUG: scheduling while atomic: swapper/37/0/0x00010002 + +[ 662.815475] BUG: scheduling while atomic: swapper/37/0/0x00010002 +[ 662.815477] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs rfkill 8021q garp mrp stp llc vfat fat rpcrdma intel_rapl_msr intel_rapl_common sunrpc i10nm_edac rdma_ucm nfit ib_srpt libnvdimm ib_isert iscsi_target_mod x86_pkg_temp_thermal intel_powerclamp coretemp target_core_mod snd_hda_intel ib_iser snd_intel_dspcfg libiscsi snd_intel_sdw_acpi scsi_transport_iscsi kvm_intel iTCO_wdt rdma_cm snd_hda_codec kvm iw_cm ipmi_ssif iTCO_vendor_support snd_hda_core irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hwdep snd_seq snd_seq_device rapl snd_pcm snd_timer isst_if_mbox_pci pcspkr isst_if_mmio irdma intel_uncore idxd acpi_ipmi joydev isst_if_common snd mei_me idxd_bus ipmi_si soundcore i2c_i801 mei ipmi_devintf i2c_smbus i2c_ismt ipmi_msghandler acpi_power_meter acpi_pad rv(OE) ib_uverbs ib_cm ib_core xfs libcrc32c ast i2c_algo_bit drm_vram_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm_ttm_helpe + r ttm +[ 662.815546] nvme nvme_core ice drm crc32c_intel i40e t10_pi wmi pinctrl_emmitsburg dm_mirror dm_region_hash dm_log dm_mod fuse +[ 662.815557] Preemption disabled at: +[ 662.815558] [<0000000000000000>] 0x0 +[ 662.815563] CPU: 37 PID: 0 Comm: swapper/37 Kdump: loaded Tainted: G S OE 5.17.1 #2 +[ 662.815566] Hardware name: Intel Corporation D50DNP/D50DNP, BIOS SE5C6301.86B.6624.D18.2111021741 11/02/2021 +[ 662.815568] Call Trace: +[ 662.815572] +[ 662.815574] dump_stack_lvl+0x33/0x42 +[ 662.815581] __schedule_bug.cold.147+0x7d/0x8a +[ 662.815588] __schedule+0x798/0x990 +[ 662.815595] schedule+0x44/0xc0 +[ 662.815597] schedule_preempt_disabled+0x14/0x20 +[ 662.815600] __mutex_lock.isra.11+0x46c/0x490 +[ 662.815603] ? __ibdev_printk+0x76/0xc0 [ib_core] +[ 662.815633] device_del+0x37/0x3d0 +[ 662.815639] ice_unplug_aux_dev+0x1a/0x40 [ice] +[ 662.815674] ice_schedule_reset+0x3c/0xd0 [ice] +[ 662.815693] irdma_iidc_event_handler.cold.7+0xb6/0xd3 [irdma] +[ 662.815712] ? bitmap_find_next_zero_area_off+0x45/0xa0 +[ 662.815719] ice_send_event_to_aux+0x54/0x70 [ice] +[ 662.815741] ice_misc_intr+0x21d/0x2d0 [ice] +[ 662.815756] __handle_irq_event_percpu+0x4c/0x180 +[ 662.815762] handle_irq_event_percpu+0xf/0x40 +[ 662.815764] handle_irq_event+0x34/0x60 +[ 662.815766] handle_edge_irq+0x9a/0x1c0 +[ 662.815770] __common_interrupt+0x62/0x100 +[ 662.815774] common_interrupt+0xb4/0xd0 +[ 662.815779] +[ 662.815780] +[ 662.815780] asm_common_interrupt+0x1e/0x40 +[ 662.815785] RIP: 0010:cpuidle_enter_state+0xd6/0x380 +[ 662.815789] Code: 49 89 c4 0f 1f 44 00 00 31 ff e8 65 d7 95 ff 45 84 ff 74 12 9c 58 f6 c4 02 0f 85 64 02 00 00 31 ff e8 ae c5 9c ff fb 45 85 f6 <0f> 88 12 01 00 00 49 63 d6 4c 2b 24 24 48 8d 04 52 48 8d 04 82 49 +[ 662.815791] RSP: 0018:ff2c2c4f18edbe80 EFLAGS: 00000202 +[ 662.815793] RAX: ff280805df140000 RBX: 0000000000000002 RCX: 000000000000001f +[ 662.815795] RDX: 0000009a52da2d08 RSI: ffffffff93f8240b RDI: ffffffff93f53ee7 +[ 662.815796] RBP: ff5e2bd11ff41928 R08: 0000000000000000 R09: 000000000002f8c0 +[ 662.815797] R10: 0000010c3f18e2cf R11: 000000000000000f R12: 0000009a52da2d08 +[ 662.815798] R13: ffffffff94ad7e20 R14: 0000000000000002 R15: 0000000000000000 +[ 662.815801] cpuidle_enter+0x29/0x40 +[ 662.815803] do_idle+0x261/0x2b0 +[ 662.815807] cpu_startup_entry+0x19/0x20 +[ 662.815809] start_secondary+0x114/0x150 +[ 662.815813] secondary_startup_64_no_verify+0xd5/0xdb +[ 662.815818] +[ 662.815846] bad: scheduling from the idle thread! +[ 662.815849] CPU: 37 PID: 0 Comm: swapper/37 Kdump: loaded Tainted: G S W OE 5.17.1 #2 +[ 662.815852] Hardware name: Intel Corporation D50DNP/D50DNP, BIOS SE5C6301.86B.6624.D18.2111021741 11/02/2021 +[ 662.815853] Call Trace: +[ 662.815855] +[ 662.815856] dump_stack_lvl+0x33/0x42 +[ 662.815860] dequeue_task_idle+0x20/0x30 +[ 662.815863] __schedule+0x1c3/0x990 +[ 662.815868] schedule+0x44/0xc0 +[ 662.815871] schedule_preempt_disabled+0x14/0x20 +[ 662.815873] __mutex_lock.isra.11+0x3a8/0x490 +[ 662.815876] ? __ibdev_printk+0x76/0xc0 [ib_core] +[ 662.815904] device_del+0x37/0x3d0 +[ 662.815909] ice_unplug_aux_dev+0x1a/0x40 [ice] +[ 662.815937] ice_schedule_reset+0x3c/0xd0 [ice] +[ 662.815961] irdma_iidc_event_handler.cold.7+0xb6/0xd3 [irdma] +[ 662.815979] ? bitmap_find_next_zero_area_off+0x45/0xa0 +[ 662.815985] ice_send_event_to_aux+0x54/0x70 [ice] +[ 662.816011] ice_misc_intr+0x21d/0x2d0 [ice] +[ 662.816033] __handle_irq_event_percpu+0x4c/0x180 +[ 662.816037] handle_irq_event_percpu+0xf/0x40 +[ 662.816039] handle_irq_event+0x34/0x60 +[ 662.816042] handle_edge_irq+0x9a/0x1c0 +[ 662.816045] __common_interrupt+0x62/0x100 +[ 662.816048] common_interrupt+0xb4/0xd0 +[ 662.816052] +[ 662.816053] +[ 662.816054] asm_common_interrupt+0x1e/0x40 +[ 662.816057] RIP: 0010:cpuidle_enter_state+0xd6/0x380 +[ 662.816060] Code: 49 89 c4 0f 1f 44 00 00 31 ff e8 65 d7 95 ff 45 84 ff 74 12 9c 58 f6 c4 02 0f 85 64 02 00 00 31 ff e8 ae c5 9c ff fb 45 85 f6 <0f> 88 12 01 00 00 49 63 d6 4c 2b 24 24 48 8d 04 52 48 8d 04 82 49 +[ 662.816063] RSP: 0018:ff2c2c4f18edbe80 EFLAGS: 00000202 +[ 662.816065] RAX: ff280805df140000 RBX: 0000000000000002 RCX: 000000000000001f +[ 662.816067] RDX: 0000009a52da2d08 RSI: ffffffff93f8240b RDI: ffffffff93f53ee7 +[ 662.816068] RBP: ff5e2bd11ff41928 R08: 0000000000000000 R09: 000000000002f8c0 +[ 662.816070] R10: 0000010c3f18e2cf R11: 000000000000000f R12: 0000009a52da2d08 +[ 662.816071] R13: ffffffff94ad7e20 R14: 0000000000000002 R15: 0000000000000000 +[ 662.816075] cpuidle_enter+0x29/0x40 +[ 662.816077] do_idle+0x261/0x2b0 +[ 662.816080] cpu_startup_entry+0x19/0x20 +[ 662.816083] start_secondary+0x114/0x150 +[ 662.816087] secondary_startup_64_no_verify+0xd5/0xdb +[ 662.816091] +[ 662.816169] bad: scheduling from the idle thread! + +The correct place to unplug the aux devices for a reset is in the +prepare_for_reset function, as this is a common place for all reset flows. +It also has built in protection from being called twice in a single reset +instance before the aux devices are replugged. + +Fixes: f9f5301e7e2d4 ("ice: Register auxiliary device to provide RDMA") +Signed-off-by: Dave Ertman +Tested-by: Helena Anna Dubel +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_main.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 4c6bb7482b36..0b567e8e3674 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -2399,8 +2399,6 @@ int ice_schedule_reset(struct ice_pf *pf, enum ice_reset_req reset) + return -EBUSY; + } + +- ice_unplug_aux_dev(pf); +- + switch (reset) { + case ICE_RESET_PFR: + set_bit(ICE_PFR_REQ, pf->state); +-- +2.35.1 + diff --git a/queue-5.19/ice-fix-crash-by-keep-old-cfg-when-update-tcs-more-t.patch b/queue-5.19/ice-fix-crash-by-keep-old-cfg-when-update-tcs-more-t.patch new file mode 100644 index 00000000000..45748214bfa --- /dev/null +++ b/queue-5.19/ice-fix-crash-by-keep-old-cfg-when-update-tcs-more-t.patch @@ -0,0 +1,199 @@ +From 86aa02b41535ac271d6e0b4a87ee3c5b1899cb4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Aug 2022 18:53:18 +0800 +Subject: ice: Fix crash by keep old cfg when update TCs more than queues + +From: Ding Hui + +[ Upstream commit a509702cac95a8b450228a037c8542f57e538e5b ] + +There are problems if allocated queues less than Traffic Classes. + +Commit a632b2a4c920 ("ice: ethtool: Prohibit improper channel config +for DCB") already disallow setting less queues than TCs. + +Another case is if we first set less queues, and later update more TCs +config due to LLDP, ice_vsi_cfg_tc() will failed but left dirty +num_txq/rxq and tc_cfg in vsi, that will cause invalid pointer access. + +[ 95.968089] ice 0000:3b:00.1: More TCs defined than queues/rings allocated. +[ 95.968092] ice 0000:3b:00.1: Trying to use more Rx queues (8), than were allocated (1)! +[ 95.968093] ice 0000:3b:00.1: Failed to config TC for VSI index: 0 +[ 95.969621] general protection fault: 0000 [#1] SMP NOPTI +[ 95.969705] CPU: 1 PID: 58405 Comm: lldpad Kdump: loaded Tainted: G U W O --------- -t - 4.18.0 #1 +[ 95.969867] Hardware name: O.E.M/BC11SPSCB10, BIOS 8.23 12/30/2021 +[ 95.969992] RIP: 0010:devm_kmalloc+0xa/0x60 +[ 95.970052] Code: 5c ff ff ff 31 c0 5b 5d 41 5c c3 b8 f4 ff ff ff eb f4 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 89 d1 <8b> 97 60 02 00 00 48 8d 7e 18 48 39 f7 72 3f 55 89 ce 53 48 8b 4c +[ 95.970344] RSP: 0018:ffffc9003f553888 EFLAGS: 00010206 +[ 95.970425] RAX: dead000000000200 RBX: ffffea003c425b00 RCX: 00000000006080c0 +[ 95.970536] RDX: 00000000006080c0 RSI: 0000000000000200 RDI: dead000000000200 +[ 95.970648] RBP: dead000000000200 R08: 00000000000463c0 R09: ffff888ffa900000 +[ 95.970760] R10: 0000000000000000 R11: 0000000000000002 R12: ffff888ff6b40100 +[ 95.970870] R13: ffff888ff6a55018 R14: 0000000000000000 R15: ffff888ff6a55460 +[ 95.970981] FS: 00007f51b7d24700(0000) GS:ffff88903ee80000(0000) knlGS:0000000000000000 +[ 95.971108] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 95.971197] CR2: 00007fac5410d710 CR3: 0000000f2c1de002 CR4: 00000000007606e0 +[ 95.971309] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 95.971419] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 95.971530] PKRU: 55555554 +[ 95.971573] Call Trace: +[ 95.971622] ice_setup_rx_ring+0x39/0x110 [ice] +[ 95.971695] ice_vsi_setup_rx_rings+0x54/0x90 [ice] +[ 95.971774] ice_vsi_open+0x25/0x120 [ice] +[ 95.971843] ice_open_internal+0xb8/0x1f0 [ice] +[ 95.971919] ice_ena_vsi+0x4f/0xd0 [ice] +[ 95.971987] ice_dcb_ena_dis_vsi.constprop.5+0x29/0x90 [ice] +[ 95.972082] ice_pf_dcb_cfg+0x29a/0x380 [ice] +[ 95.972154] ice_dcbnl_setets+0x174/0x1b0 [ice] +[ 95.972220] dcbnl_ieee_set+0x89/0x230 +[ 95.972279] ? dcbnl_ieee_del+0x150/0x150 +[ 95.972341] dcb_doit+0x124/0x1b0 +[ 95.972392] rtnetlink_rcv_msg+0x243/0x2f0 +[ 95.972457] ? dcb_doit+0x14d/0x1b0 +[ 95.972510] ? __kmalloc_node_track_caller+0x1d3/0x280 +[ 95.972591] ? rtnl_calcit.isra.31+0x100/0x100 +[ 95.972661] netlink_rcv_skb+0xcf/0xf0 +[ 95.972720] netlink_unicast+0x16d/0x220 +[ 95.972781] netlink_sendmsg+0x2ba/0x3a0 +[ 95.975891] sock_sendmsg+0x4c/0x50 +[ 95.979032] ___sys_sendmsg+0x2e4/0x300 +[ 95.982147] ? kmem_cache_alloc+0x13e/0x190 +[ 95.985242] ? __wake_up_common_lock+0x79/0x90 +[ 95.988338] ? __check_object_size+0xac/0x1b0 +[ 95.991440] ? _copy_to_user+0x22/0x30 +[ 95.994539] ? move_addr_to_user+0xbb/0xd0 +[ 95.997619] ? __sys_sendmsg+0x53/0x80 +[ 96.000664] __sys_sendmsg+0x53/0x80 +[ 96.003747] do_syscall_64+0x5b/0x1d0 +[ 96.006862] entry_SYSCALL_64_after_hwframe+0x65/0xca + +Only update num_txq/rxq when passed check, and restore tc_cfg if setup +queue map failed. + +Fixes: a632b2a4c920 ("ice: ethtool: Prohibit improper channel config for DCB") +Signed-off-by: Ding Hui +Reviewed-by: Anatolii Gerasymenko +Tested-by: Arpana Arland (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_lib.c | 42 +++++++++++++++--------- + 1 file changed, 26 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c +index 6c4e1d45235e..1169fd7811b0 100644 +--- a/drivers/net/ethernet/intel/ice/ice_lib.c ++++ b/drivers/net/ethernet/intel/ice/ice_lib.c +@@ -911,7 +911,7 @@ static void ice_set_dflt_vsi_ctx(struct ice_hw *hw, struct ice_vsi_ctx *ctxt) + */ + static int ice_vsi_setup_q_map(struct ice_vsi *vsi, struct ice_vsi_ctx *ctxt) + { +- u16 offset = 0, qmap = 0, tx_count = 0, pow = 0; ++ u16 offset = 0, qmap = 0, tx_count = 0, rx_count = 0, pow = 0; + u16 num_txq_per_tc, num_rxq_per_tc; + u16 qcount_tx = vsi->alloc_txq; + u16 qcount_rx = vsi->alloc_rxq; +@@ -978,23 +978,25 @@ static int ice_vsi_setup_q_map(struct ice_vsi *vsi, struct ice_vsi_ctx *ctxt) + * at least 1) + */ + if (offset) +- vsi->num_rxq = offset; ++ rx_count = offset; + else +- vsi->num_rxq = num_rxq_per_tc; ++ rx_count = num_rxq_per_tc; + +- if (vsi->num_rxq > vsi->alloc_rxq) { ++ if (rx_count > vsi->alloc_rxq) { + dev_err(ice_pf_to_dev(vsi->back), "Trying to use more Rx queues (%u), than were allocated (%u)!\n", +- vsi->num_rxq, vsi->alloc_rxq); ++ rx_count, vsi->alloc_rxq); + return -EINVAL; + } + +- vsi->num_txq = tx_count; +- if (vsi->num_txq > vsi->alloc_txq) { ++ if (tx_count > vsi->alloc_txq) { + dev_err(ice_pf_to_dev(vsi->back), "Trying to use more Tx queues (%u), than were allocated (%u)!\n", +- vsi->num_txq, vsi->alloc_txq); ++ tx_count, vsi->alloc_txq); + return -EINVAL; + } + ++ vsi->num_txq = tx_count; ++ vsi->num_rxq = rx_count; ++ + if (vsi->type == ICE_VSI_VF && vsi->num_txq != vsi->num_rxq) { + dev_dbg(ice_pf_to_dev(vsi->back), "VF VSI should have same number of Tx and Rx queues. Hence making them equal\n"); + /* since there is a chance that num_rxq could have been changed +@@ -3487,6 +3489,7 @@ ice_vsi_setup_q_map_mqprio(struct ice_vsi *vsi, struct ice_vsi_ctx *ctxt, + u16 pow, offset = 0, qcount_tx = 0, qcount_rx = 0, qmap; + u16 tc0_offset = vsi->mqprio_qopt.qopt.offset[0]; + int tc0_qcount = vsi->mqprio_qopt.qopt.count[0]; ++ u16 new_txq, new_rxq; + u8 netdev_tc = 0; + int i; + +@@ -3527,21 +3530,24 @@ ice_vsi_setup_q_map_mqprio(struct ice_vsi *vsi, struct ice_vsi_ctx *ctxt, + } + } + +- /* Set actual Tx/Rx queue pairs */ +- vsi->num_txq = offset + qcount_tx; +- if (vsi->num_txq > vsi->alloc_txq) { ++ new_txq = offset + qcount_tx; ++ if (new_txq > vsi->alloc_txq) { + dev_err(ice_pf_to_dev(vsi->back), "Trying to use more Tx queues (%u), than were allocated (%u)!\n", +- vsi->num_txq, vsi->alloc_txq); ++ new_txq, vsi->alloc_txq); + return -EINVAL; + } + +- vsi->num_rxq = offset + qcount_rx; +- if (vsi->num_rxq > vsi->alloc_rxq) { ++ new_rxq = offset + qcount_rx; ++ if (new_rxq > vsi->alloc_rxq) { + dev_err(ice_pf_to_dev(vsi->back), "Trying to use more Rx queues (%u), than were allocated (%u)!\n", +- vsi->num_rxq, vsi->alloc_rxq); ++ new_rxq, vsi->alloc_rxq); + return -EINVAL; + } + ++ /* Set actual Tx/Rx queue pairs */ ++ vsi->num_txq = new_txq; ++ vsi->num_rxq = new_rxq; ++ + /* Setup queue TC[0].qmap for given VSI context */ + ctxt->info.tc_mapping[0] = cpu_to_le16(qmap); + ctxt->info.q_mapping[0] = cpu_to_le16(vsi->rxq_map[0]); +@@ -3573,6 +3579,7 @@ int ice_vsi_cfg_tc(struct ice_vsi *vsi, u8 ena_tc) + { + u16 max_txqs[ICE_MAX_TRAFFIC_CLASS] = { 0 }; + struct ice_pf *pf = vsi->back; ++ struct ice_tc_cfg old_tc_cfg; + struct ice_vsi_ctx *ctx; + struct device *dev; + int i, ret = 0; +@@ -3597,6 +3604,7 @@ int ice_vsi_cfg_tc(struct ice_vsi *vsi, u8 ena_tc) + max_txqs[i] = vsi->num_txq; + } + ++ memcpy(&old_tc_cfg, &vsi->tc_cfg, sizeof(old_tc_cfg)); + vsi->tc_cfg.ena_tc = ena_tc; + vsi->tc_cfg.numtc = num_tc; + +@@ -3613,8 +3621,10 @@ int ice_vsi_cfg_tc(struct ice_vsi *vsi, u8 ena_tc) + else + ret = ice_vsi_setup_q_map(vsi, ctx); + +- if (ret) ++ if (ret) { ++ memcpy(&vsi->tc_cfg, &old_tc_cfg, sizeof(vsi->tc_cfg)); + goto out; ++ } + + /* must to indicate which section of VSI context are being modified */ + ctx->info.valid_sections = cpu_to_le16(ICE_AQ_VSI_PROP_RXQ_MAP_VALID); +-- +2.35.1 + diff --git a/queue-5.19/ice-fix-ice_xdp_xmit-when-xdp-tx-queue-number-is-not.patch b/queue-5.19/ice-fix-ice_xdp_xmit-when-xdp-tx-queue-number-is-not.patch new file mode 100644 index 00000000000..b054adcc056 --- /dev/null +++ b/queue-5.19/ice-fix-ice_xdp_xmit-when-xdp-tx-queue-number-is-not.patch @@ -0,0 +1,53 @@ +From 9a831b7d156b1e9910a29c53f35d59c02dd7d9f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Sep 2022 15:43:46 +0200 +Subject: ice: Fix ice_xdp_xmit() when XDP TX queue number is not sufficient + +From: Larysa Zaremba + +[ Upstream commit 114f398d48c571bb628187a7b2dd42695156781f ] + +The original patch added the static branch to handle the situation, +when assigning an XDP TX queue to every CPU is not possible, +so they have to be shared. + +However, in the XDP transmit handler ice_xdp_xmit(), an error was +returned in such cases even before static condition was checked, +thus making queue sharing still impossible. + +Fixes: 22bf877e528f ("ice: introduce XDP_TX fallback path") +Signed-off-by: Larysa Zaremba +Reviewed-by: Alexander Lobakin +Link: https://lore.kernel.org/r/20220919134346.25030-1-larysa.zaremba@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_txrx.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c +index 836dce840712..97453d1dfafe 100644 +--- a/drivers/net/ethernet/intel/ice/ice_txrx.c ++++ b/drivers/net/ethernet/intel/ice/ice_txrx.c +@@ -610,7 +610,7 @@ ice_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames, + if (test_bit(ICE_VSI_DOWN, vsi->state)) + return -ENETDOWN; + +- if (!ice_is_xdp_ena_vsi(vsi) || queue_index >= vsi->num_xdp_txq) ++ if (!ice_is_xdp_ena_vsi(vsi)) + return -ENXIO; + + if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) +@@ -621,6 +621,9 @@ ice_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames, + xdp_ring = vsi->xdp_rings[queue_index]; + spin_lock(&xdp_ring->tx_lock); + } else { ++ /* Generally, should not happen */ ++ if (unlikely(queue_index >= vsi->num_xdp_txq)) ++ return -ENXIO; + xdp_ring = vsi->xdp_rings[queue_index]; + } + +-- +2.35.1 + diff --git a/queue-5.19/ice-fix-interface-being-down-after-reset-with-link-d.patch b/queue-5.19/ice-fix-interface-being-down-after-reset-with-link-d.patch new file mode 100644 index 00000000000..efbec0e325a --- /dev/null +++ b/queue-5.19/ice-fix-interface-being-down-after-reset-with-link-d.patch @@ -0,0 +1,80 @@ +From aecb5470363db8576fa462d44834174c37a48387 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 10:31:23 +0200 +Subject: ice: Fix interface being down after reset with link-down-on-close + flag on + +From: Mateusz Palczewski + +[ Upstream commit 8ac7132704f3fbd2095abb9459e5303ce8c9e559 ] + +When performing a reset on ice driver with link-down-on-close flag on +interface would always stay down. Fix this by moving a check of this +flag to ice_stop() that is called only when user wants to bring +interface down. + +Fixes: ab4ab73fc1ec ("ice: Add ethtool private flag to make forcing link down optional") +Signed-off-by: Mateusz Palczewski +Tested-by: Petr Oros +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_main.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index f963036571e0..48befe1e2872 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -6627,7 +6627,7 @@ static void ice_napi_disable_all(struct ice_vsi *vsi) + */ + int ice_down(struct ice_vsi *vsi) + { +- int i, tx_err, rx_err, link_err = 0, vlan_err = 0; ++ int i, tx_err, rx_err, vlan_err = 0; + + WARN_ON(!test_bit(ICE_VSI_DOWN, vsi->state)); + +@@ -6661,20 +6661,13 @@ int ice_down(struct ice_vsi *vsi) + + ice_napi_disable_all(vsi); + +- if (test_bit(ICE_FLAG_LINK_DOWN_ON_CLOSE_ENA, vsi->back->flags)) { +- link_err = ice_force_phys_link_state(vsi, false); +- if (link_err) +- netdev_err(vsi->netdev, "Failed to set physical link down, VSI %d error %d\n", +- vsi->vsi_num, link_err); +- } +- + ice_for_each_txq(vsi, i) + ice_clean_tx_ring(vsi->tx_rings[i]); + + ice_for_each_rxq(vsi, i) + ice_clean_rx_ring(vsi->rx_rings[i]); + +- if (tx_err || rx_err || link_err || vlan_err) { ++ if (tx_err || rx_err || vlan_err) { + netdev_err(vsi->netdev, "Failed to close VSI 0x%04X on switch 0x%04X\n", + vsi->vsi_num, vsi->vsw->sw_id); + return -EIO; +@@ -8876,6 +8869,16 @@ int ice_stop(struct net_device *netdev) + return -EBUSY; + } + ++ if (test_bit(ICE_FLAG_LINK_DOWN_ON_CLOSE_ENA, vsi->back->flags)) { ++ int link_err = ice_force_phys_link_state(vsi, false); ++ ++ if (link_err) { ++ netdev_err(vsi->netdev, "Failed to set physical link down, VSI %d error %d\n", ++ vsi->vsi_num, link_err); ++ return -EIO; ++ } ++ } ++ + ice_vsi_close(vsi); + + return 0; +-- +2.35.1 + diff --git a/queue-5.19/ipv6-fix-crash-when-ipv6-is-administratively-disable.patch b/queue-5.19/ipv6-fix-crash-when-ipv6-is-administratively-disable.patch new file mode 100644 index 00000000000..eeba7f1dce2 --- /dev/null +++ b/queue-5.19/ipv6-fix-crash-when-ipv6-is-administratively-disable.patch @@ -0,0 +1,80 @@ +From b25cd42c27915da40faa9fd8ba8a8315fc8ebd6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Sep 2022 11:48:21 +0300 +Subject: ipv6: Fix crash when IPv6 is administratively disabled + +From: Ido Schimmel + +[ Upstream commit 76dd07281338da6951fdab3432ced843fa87839c ] + +The global 'raw_v6_hashinfo' variable can be accessed even when IPv6 is +administratively disabled via the 'ipv6.disable=1' kernel command line +option, leading to a crash [1]. + +Fix by restoring the original behavior and always initializing the +variable, regardless of IPv6 support being administratively disabled or +not. + +[1] + BUG: unable to handle page fault for address: ffffffffffffffc8 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 173e18067 P4D 173e18067 PUD 173e1a067 PMD 0 + Oops: 0000 [#1] PREEMPT SMP KASAN + CPU: 3 PID: 271 Comm: ss Not tainted 6.0.0-rc4-custom-00136-g0727a9a5fbc1 #1396 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014 + RIP: 0010:raw_diag_dump+0x310/0x7f0 + [...] + Call Trace: + + __inet_diag_dump+0x10f/0x2e0 + netlink_dump+0x575/0xfd0 + __netlink_dump_start+0x67b/0x940 + inet_diag_handler_cmd+0x273/0x2d0 + sock_diag_rcv_msg+0x317/0x440 + netlink_rcv_skb+0x15e/0x430 + sock_diag_rcv+0x2b/0x40 + netlink_unicast+0x53b/0x800 + netlink_sendmsg+0x945/0xe60 + ____sys_sendmsg+0x747/0x960 + ___sys_sendmsg+0x13a/0x1e0 + __sys_sendmsg+0x118/0x1e0 + do_syscall_64+0x34/0x80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Fixes: 0daf07e52709 ("raw: convert raw sockets to RCU") +Reported-by: Roberto Ricci +Tested-by: Roberto Ricci +Signed-off-by: Ido Schimmel +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/20220916084821.229287-1-idosch@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/af_inet6.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c +index 9f6f4a41245d..1012012a061f 100644 +--- a/net/ipv6/af_inet6.c ++++ b/net/ipv6/af_inet6.c +@@ -1069,13 +1069,13 @@ static int __init inet6_init(void) + for (r = &inetsw6[0]; r < &inetsw6[SOCK_MAX]; ++r) + INIT_LIST_HEAD(r); + ++ raw_hashinfo_init(&raw_v6_hashinfo); ++ + if (disable_ipv6_mod) { + pr_info("Loaded, but administratively disabled, reboot required to enable\n"); + goto out; + } + +- raw_hashinfo_init(&raw_v6_hashinfo); +- + err = proto_register(&tcpv6_prot, 1); + if (err) + goto out; +-- +2.35.1 + diff --git a/queue-5.19/ipvlan-fix-out-of-bound-bugs-caused-by-unset-skb-mac.patch b/queue-5.19/ipvlan-fix-out-of-bound-bugs-caused-by-unset-skb-mac.patch new file mode 100644 index 00000000000..9f5965312ca --- /dev/null +++ b/queue-5.19/ipvlan-fix-out-of-bound-bugs-caused-by-unset-skb-mac.patch @@ -0,0 +1,98 @@ +From 2722c61202fd0bce67da4550f7a8ac7578aede81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Sep 2022 18:12:04 +0800 +Subject: ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header + +From: Lu Wei + +[ Upstream commit 81225b2ea161af48e093f58e8dfee6d705b16af4 ] + +If an AF_PACKET socket is used to send packets through ipvlan and the +default xmit function of the AF_PACKET socket is changed from +dev_queue_xmit() to packet_direct_xmit() via setsockopt() with the option +name of PACKET_QDISC_BYPASS, the skb->mac_header may not be reset and +remains as the initial value of 65535, this may trigger slab-out-of-bounds +bugs as following: + +================================================================= +UG: KASAN: slab-out-of-bounds in ipvlan_xmit_mode_l2+0xdb/0x330 [ipvlan] +PU: 2 PID: 1768 Comm: raw_send Kdump: loaded Not tainted 6.0.0-rc4+ #6 +ardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 +all Trace: +print_address_description.constprop.0+0x1d/0x160 +print_report.cold+0x4f/0x112 +kasan_report+0xa3/0x130 +ipvlan_xmit_mode_l2+0xdb/0x330 [ipvlan] +ipvlan_start_xmit+0x29/0xa0 [ipvlan] +__dev_direct_xmit+0x2e2/0x380 +packet_direct_xmit+0x22/0x60 +packet_snd+0x7c9/0xc40 +sock_sendmsg+0x9a/0xa0 +__sys_sendto+0x18a/0x230 +__x64_sys_sendto+0x74/0x90 +do_syscall_64+0x3b/0x90 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +The root cause is: + 1. packet_snd() only reset skb->mac_header when sock->type is SOCK_RAW + and skb->protocol is not specified as in packet_parse_headers() + + 2. packet_direct_xmit() doesn't reset skb->mac_header as dev_queue_xmit() + +In this case, skb->mac_header is 65535 when ipvlan_xmit_mode_l2() is +called. So when ipvlan_xmit_mode_l2() gets mac header with eth_hdr() which +use "skb->head + skb->mac_header", out-of-bound access occurs. + +This patch replaces eth_hdr() with skb_eth_hdr() in ipvlan_xmit_mode_l2() +and reset mac header in multicast to solve this out-of-bound bug. + +Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") +Signed-off-by: Lu Wei +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ipvlan/ipvlan_core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c +index 6ffb27419e64..c58123e13689 100644 +--- a/drivers/net/ipvlan/ipvlan_core.c ++++ b/drivers/net/ipvlan/ipvlan_core.c +@@ -495,7 +495,6 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb) + + static int ipvlan_process_outbound(struct sk_buff *skb) + { +- struct ethhdr *ethh = eth_hdr(skb); + int ret = NET_XMIT_DROP; + + /* The ipvlan is a pseudo-L2 device, so the packets that we receive +@@ -505,6 +504,8 @@ static int ipvlan_process_outbound(struct sk_buff *skb) + if (skb_mac_header_was_set(skb)) { + /* In this mode we dont care about + * multicast and broadcast traffic */ ++ struct ethhdr *ethh = eth_hdr(skb); ++ + if (is_multicast_ether_addr(ethh->h_dest)) { + pr_debug_ratelimited( + "Dropped {multi|broad}cast of type=[%x]\n", +@@ -589,7 +590,7 @@ static int ipvlan_xmit_mode_l3(struct sk_buff *skb, struct net_device *dev) + static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev) + { + const struct ipvl_dev *ipvlan = netdev_priv(dev); +- struct ethhdr *eth = eth_hdr(skb); ++ struct ethhdr *eth = skb_eth_hdr(skb); + struct ipvl_addr *addr; + void *lyr3h; + int addr_type; +@@ -619,6 +620,7 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev) + return dev_forward_skb(ipvlan->phy_dev, skb); + + } else if (is_multicast_ether_addr(eth->h_dest)) { ++ skb_reset_mac_header(skb); + ipvlan_skb_crossing_ns(skb, NULL); + ipvlan_multicast_enqueue(ipvlan->port, skb, true); + return NET_XMIT_SUCCESS; +-- +2.35.1 + diff --git a/queue-5.19/mips-lantiq-export-clk_get_io-for-lantiq_wdt.ko.patch b/queue-5.19/mips-lantiq-export-clk_get_io-for-lantiq_wdt.ko.patch new file mode 100644 index 00000000000..7a546122fb6 --- /dev/null +++ b/queue-5.19/mips-lantiq-export-clk_get_io-for-lantiq_wdt.ko.patch @@ -0,0 +1,41 @@ +From 90644cfc9c0da656817b55a3abc899e58d42ab36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Sep 2022 16:25:40 -0700 +Subject: MIPS: lantiq: export clk_get_io() for lantiq_wdt.ko + +From: Randy Dunlap + +[ Upstream commit 502550123bee6a2ffa438409b5b9aad4d6db3a8c ] + +The lantiq WDT driver uses clk_get_io(), which is not exported, +so export it to fix a build error: + +ERROR: modpost: "clk_get_io" [drivers/watchdog/lantiq_wdt.ko] undefined! + +Fixes: 287e3f3f4e68 ("MIPS: lantiq: implement support for clkdev api") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Cc: Thomas Bogendoerfer +Cc: John Crispin +Cc: linux-mips@vger.kernel.org +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/lantiq/clk.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/mips/lantiq/clk.c b/arch/mips/lantiq/clk.c +index 7a623684d9b5..2d5a0bcb0cec 100644 +--- a/arch/mips/lantiq/clk.c ++++ b/arch/mips/lantiq/clk.c +@@ -50,6 +50,7 @@ struct clk *clk_get_io(void) + { + return &cpu_clk_generic[2]; + } ++EXPORT_SYMBOL_GPL(clk_get_io); + + struct clk *clk_get_ppe(void) + { +-- +2.35.1 + diff --git a/queue-5.19/mips-loongson32-fix-phy-mode-being-left-unspecified.patch b/queue-5.19/mips-loongson32-fix-phy-mode-being-left-unspecified.patch new file mode 100644 index 00000000000..ee108ea2ce3 --- /dev/null +++ b/queue-5.19/mips-loongson32-fix-phy-mode-being-left-unspecified.patch @@ -0,0 +1,99 @@ +From df54cba43e7e199fcd53589117639a9331287e74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Sep 2022 00:10:09 +0800 +Subject: MIPS: Loongson32: Fix PHY-mode being left unspecified + +From: Serge Semin + +[ Upstream commit e9f3f8f488005f6da3cfb66070706770ecaef747 ] + +commit 0060c8783330 ("net: stmmac: implement support for passive mode +converters via dt") has changed the plat->interface field semantics from +containing the PHY-mode to specifying the MAC-PCS interface mode. Due to +that the loongson32 platform code will leave the phylink interface +uninitialized with the PHY-mode intended by the means of the actual +platform setup. The commit-author most likely has just missed the +arch-specific code to fix. Let's mend the Loongson32 platform code then by +assigning the PHY-mode to the phy_interface field of the STMMAC platform +data. + +Fixes: 0060c8783330 ("net: stmmac: implement support for passive mode converters via dt") +Signed-off-by: Serge Semin +Signed-off-by: Keguang Zhang +Tested-by: Keguang Zhang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/loongson32/common/platform.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/mips/loongson32/common/platform.c b/arch/mips/loongson32/common/platform.c +index 794c96c2a4cd..311dc1580bbd 100644 +--- a/arch/mips/loongson32/common/platform.c ++++ b/arch/mips/loongson32/common/platform.c +@@ -98,7 +98,7 @@ int ls1x_eth_mux_init(struct platform_device *pdev, void *priv) + if (plat_dat->bus_id) { + __raw_writel(__raw_readl(LS1X_MUX_CTRL0) | GMAC1_USE_UART1 | + GMAC1_USE_UART0, LS1X_MUX_CTRL0); +- switch (plat_dat->interface) { ++ switch (plat_dat->phy_interface) { + case PHY_INTERFACE_MODE_RGMII: + val &= ~(GMAC1_USE_TXCLK | GMAC1_USE_PWM23); + break; +@@ -107,12 +107,12 @@ int ls1x_eth_mux_init(struct platform_device *pdev, void *priv) + break; + default: + pr_err("unsupported mii mode %d\n", +- plat_dat->interface); ++ plat_dat->phy_interface); + return -ENOTSUPP; + } + val &= ~GMAC1_SHUT; + } else { +- switch (plat_dat->interface) { ++ switch (plat_dat->phy_interface) { + case PHY_INTERFACE_MODE_RGMII: + val &= ~(GMAC0_USE_TXCLK | GMAC0_USE_PWM01); + break; +@@ -121,7 +121,7 @@ int ls1x_eth_mux_init(struct platform_device *pdev, void *priv) + break; + default: + pr_err("unsupported mii mode %d\n", +- plat_dat->interface); ++ plat_dat->phy_interface); + return -ENOTSUPP; + } + val &= ~GMAC0_SHUT; +@@ -131,7 +131,7 @@ int ls1x_eth_mux_init(struct platform_device *pdev, void *priv) + plat_dat = dev_get_platdata(&pdev->dev); + + val &= ~PHY_INTF_SELI; +- if (plat_dat->interface == PHY_INTERFACE_MODE_RMII) ++ if (plat_dat->phy_interface == PHY_INTERFACE_MODE_RMII) + val |= 0x4 << PHY_INTF_SELI_SHIFT; + __raw_writel(val, LS1X_MUX_CTRL1); + +@@ -146,9 +146,9 @@ static struct plat_stmmacenet_data ls1x_eth0_pdata = { + .bus_id = 0, + .phy_addr = -1, + #if defined(CONFIG_LOONGSON1_LS1B) +- .interface = PHY_INTERFACE_MODE_MII, ++ .phy_interface = PHY_INTERFACE_MODE_MII, + #elif defined(CONFIG_LOONGSON1_LS1C) +- .interface = PHY_INTERFACE_MODE_RMII, ++ .phy_interface = PHY_INTERFACE_MODE_RMII, + #endif + .mdio_bus_data = &ls1x_mdio_bus_data, + .dma_cfg = &ls1x_eth_dma_cfg, +@@ -186,7 +186,7 @@ struct platform_device ls1x_eth0_pdev = { + static struct plat_stmmacenet_data ls1x_eth1_pdata = { + .bus_id = 1, + .phy_addr = -1, +- .interface = PHY_INTERFACE_MODE_MII, ++ .phy_interface = PHY_INTERFACE_MODE_MII, + .mdio_bus_data = &ls1x_mdio_bus_data, + .dma_cfg = &ls1x_eth_dma_cfg, + .has_gmac = 1, +-- +2.35.1 + diff --git a/queue-5.19/mlxbf_gige-clear-mdio-gateway-lock-after-read.patch b/queue-5.19/mlxbf_gige-clear-mdio-gateway-lock-after-read.patch new file mode 100644 index 00000000000..43222994e09 --- /dev/null +++ b/queue-5.19/mlxbf_gige-clear-mdio-gateway-lock-after-read.patch @@ -0,0 +1,50 @@ +From 04eef271fedf6f8f8c8b8ee080f06af4275872bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Sep 2022 12:42:47 -0400 +Subject: mlxbf_gige: clear MDIO gateway lock after read + +From: David Thompson + +[ Upstream commit 182447b12144b7be9b63a273d27c5a11bd54960a ] + +The MDIO gateway (GW) lock in BlueField-2 GIGE logic is +set after read. This patch adds logic to make sure the +lock is always cleared at the end of each MDIO transaction. + +Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver") +Reviewed-by: Asmaa Mnebhi +Signed-off-by: David Thompson +Link: https://lore.kernel.org/r/20220902164247.19862-1-davthompson@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_mdio.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_mdio.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_mdio.c +index 85155cd9405c..4aeb927c3715 100644 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_mdio.c ++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_mdio.c +@@ -179,6 +179,9 @@ static int mlxbf_gige_mdio_read(struct mii_bus *bus, int phy_add, int phy_reg) + /* Only return ad bits of the gw register */ + ret &= MLXBF_GIGE_MDIO_GW_AD_MASK; + ++ /* The MDIO lock is set on read. To release it, clear gw register */ ++ writel(0, priv->mdio_io + MLXBF_GIGE_MDIO_GW_OFFSET); ++ + return ret; + } + +@@ -203,6 +206,9 @@ static int mlxbf_gige_mdio_write(struct mii_bus *bus, int phy_add, + temp, !(temp & MLXBF_GIGE_MDIO_GW_BUSY_MASK), + 5, 1000000); + ++ /* The MDIO lock is set on read. To release it, clear gw register */ ++ writel(0, priv->mdio_io + MLXBF_GIGE_MDIO_GW_OFFSET); ++ + return ret; + } + +-- +2.35.1 + diff --git a/queue-5.19/mm-slab_common-fix-possible-double-free-of-kmem_cach.patch b/queue-5.19/mm-slab_common-fix-possible-double-free-of-kmem_cach.patch new file mode 100644 index 00000000000..4ac4668099c --- /dev/null +++ b/queue-5.19/mm-slab_common-fix-possible-double-free-of-kmem_cach.patch @@ -0,0 +1,89 @@ +From 77317abc48e9ae27a0a5dd2039c4fe61ea0c3862 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Sep 2022 11:12:41 +0800 +Subject: mm/slab_common: fix possible double free of kmem_cache + +From: Feng Tang + +[ Upstream commit d71608a877362becdc94191f190902fac1e64d35 ] + +When doing slub_debug test, kfence's 'test_memcache_typesafe_by_rcu' +kunit test case cause a use-after-free error: + + BUG: KASAN: use-after-free in kobject_del+0x14/0x30 + Read of size 8 at addr ffff888007679090 by task kunit_try_catch/261 + + CPU: 1 PID: 261 Comm: kunit_try_catch Tainted: G B N 6.0.0-rc5-next-20220916 #17 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 + Call Trace: + + dump_stack_lvl+0x34/0x48 + print_address_description.constprop.0+0x87/0x2a5 + print_report+0x103/0x1ed + kasan_report+0xb7/0x140 + kobject_del+0x14/0x30 + kmem_cache_destroy+0x130/0x170 + test_exit+0x1a/0x30 + kunit_try_run_case+0xad/0xc0 + kunit_generic_run_threadfn_adapter+0x26/0x50 + kthread+0x17b/0x1b0 + + +The cause is inside kmem_cache_destroy(): + +kmem_cache_destroy + acquire lock/mutex + shutdown_cache + schedule_work(kmem_cache_release) (if RCU flag set) + release lock/mutex + kmem_cache_release (if RCU flag not set) + +In some certain timing, the scheduled work could be run before +the next RCU flag checking, which can then get a wrong value +and lead to double kmem_cache_release(). + +Fix it by caching the RCU flag inside protected area, just like 'refcnt' + +Fixes: 0495e337b703 ("mm/slab_common: Deleting kobject in kmem_cache_destroy() without holding slab_mutex/cpu_hotplug_lock") +Signed-off-by: Feng Tang +Reviewed-by: Hyeonggon Yoo <42.hyeyoo@gmail.com> +Reviewed-by: Waiman Long +Signed-off-by: Vlastimil Babka +Signed-off-by: Sasha Levin +--- + mm/slab_common.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/mm/slab_common.c b/mm/slab_common.c +index dbd4b6f9b0e7..29ae1358d5f0 100644 +--- a/mm/slab_common.c ++++ b/mm/slab_common.c +@@ -503,6 +503,7 @@ void slab_kmem_cache_release(struct kmem_cache *s) + void kmem_cache_destroy(struct kmem_cache *s) + { + int refcnt; ++ bool rcu_set; + + if (unlikely(!s) || !kasan_check_byte(s)) + return; +@@ -510,6 +511,8 @@ void kmem_cache_destroy(struct kmem_cache *s) + cpus_read_lock(); + mutex_lock(&slab_mutex); + ++ rcu_set = s->flags & SLAB_TYPESAFE_BY_RCU; ++ + refcnt = --s->refcount; + if (refcnt) + goto out_unlock; +@@ -520,7 +523,7 @@ void kmem_cache_destroy(struct kmem_cache *s) + out_unlock: + mutex_unlock(&slab_mutex); + cpus_read_unlock(); +- if (!refcnt && !(s->flags & SLAB_TYPESAFE_BY_RCU)) ++ if (!refcnt && !rcu_set) + kmem_cache_release(s); + } + EXPORT_SYMBOL(kmem_cache_destroy); +-- +2.35.1 + diff --git a/queue-5.19/net-bonding-share-lacpdu_mcast_addr-definition.patch b/queue-5.19/net-bonding-share-lacpdu_mcast_addr-definition.patch new file mode 100644 index 00000000000..83b1a1483ec --- /dev/null +++ b/queue-5.19/net-bonding-share-lacpdu_mcast_addr-definition.patch @@ -0,0 +1,105 @@ +From cb5b2a8cc67c8ace34085020ec37703d108f74d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Sep 2022 16:56:39 +0900 +Subject: net: bonding: Share lacpdu_mcast_addr definition + +From: Benjamin Poirier + +[ Upstream commit 1d9a143ee3408349700f44a9197b7ae0e4faae5d ] + +There are already a few definitions of arrays containing +MULTICAST_LACPDU_ADDR and the next patch will add one more use. These all +contain the same constant data so define one common instance for all +bonding code. + +Signed-off-by: Benjamin Poirier +Signed-off-by: David S. Miller +Stable-dep-of: 86247aba599e ("net: bonding: Unsync device addresses on ndo_stop") +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_3ad.c | 5 +++-- + drivers/net/bonding/bond_main.c | 16 ++++------------ + include/net/bond_3ad.h | 2 -- + include/net/bonding.h | 3 +++ + 4 files changed, 10 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c +index 1f0120cbe9e8..8ad095c19f27 100644 +--- a/drivers/net/bonding/bond_3ad.c ++++ b/drivers/net/bonding/bond_3ad.c +@@ -87,8 +87,9 @@ static const u8 null_mac_addr[ETH_ALEN + 2] __long_aligned = { + static u16 ad_ticks_per_sec; + static const int ad_delta_in_ticks = (AD_TIMER_INTERVAL * HZ) / 1000; + +-static const u8 lacpdu_mcast_addr[ETH_ALEN + 2] __long_aligned = +- MULTICAST_LACPDU_ADDR; ++const u8 lacpdu_mcast_addr[ETH_ALEN + 2] __long_aligned = { ++ 0x01, 0x80, 0xC2, 0x00, 0x00, 0x02 ++}; + + /* ================= main 802.3ad protocol functions ================== */ + static int ad_lacpdu_send(struct port *port); +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index bff0bfd10e23..b159b73f2969 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -865,12 +865,8 @@ static void bond_hw_addr_flush(struct net_device *bond_dev, + dev_uc_unsync(slave_dev, bond_dev); + dev_mc_unsync(slave_dev, bond_dev); + +- if (BOND_MODE(bond) == BOND_MODE_8023AD) { +- /* del lacpdu mc addr from mc list */ +- u8 lacpdu_multicast[ETH_ALEN] = MULTICAST_LACPDU_ADDR; +- +- dev_mc_del(slave_dev, lacpdu_multicast); +- } ++ if (BOND_MODE(bond) == BOND_MODE_8023AD) ++ dev_mc_del(slave_dev, lacpdu_mcast_addr); + } + + /*--------------------------- Active slave change ---------------------------*/ +@@ -2144,12 +2140,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev, + dev_uc_sync_multiple(slave_dev, bond_dev); + netif_addr_unlock_bh(bond_dev); + +- if (BOND_MODE(bond) == BOND_MODE_8023AD) { +- /* add lacpdu mc addr to mc list */ +- u8 lacpdu_multicast[ETH_ALEN] = MULTICAST_LACPDU_ADDR; +- +- dev_mc_add(slave_dev, lacpdu_multicast); +- } ++ if (BOND_MODE(bond) == BOND_MODE_8023AD) ++ dev_mc_add(slave_dev, lacpdu_mcast_addr); + } + + bond->slave_cnt++; +diff --git a/include/net/bond_3ad.h b/include/net/bond_3ad.h +index 184105d68294..f2273bd5a4c5 100644 +--- a/include/net/bond_3ad.h ++++ b/include/net/bond_3ad.h +@@ -15,8 +15,6 @@ + #define PKT_TYPE_LACPDU cpu_to_be16(ETH_P_SLOW) + #define AD_TIMER_INTERVAL 100 /*msec*/ + +-#define MULTICAST_LACPDU_ADDR {0x01, 0x80, 0xC2, 0x00, 0x00, 0x02} +- + #define AD_LACP_SLOW 0 + #define AD_LACP_FAST 1 + +diff --git a/include/net/bonding.h b/include/net/bonding.h +index 3b816ae8b1f3..7ac1773b9922 100644 +--- a/include/net/bonding.h ++++ b/include/net/bonding.h +@@ -785,6 +785,9 @@ extern struct rtnl_link_ops bond_link_ops; + /* exported from bond_sysfs_slave.c */ + extern const struct sysfs_ops slave_sysfs_ops; + ++/* exported from bond_3ad.c */ ++extern const u8 lacpdu_mcast_addr[]; ++ + static inline netdev_tx_t bond_tx_drop(struct net_device *dev, struct sk_buff *skb) + { + dev_core_stats_tx_dropped_inc(dev); +-- +2.35.1 + diff --git a/queue-5.19/net-bonding-unsync-device-addresses-on-ndo_stop.patch b/queue-5.19/net-bonding-unsync-device-addresses-on-ndo_stop.patch new file mode 100644 index 00000000000..b61a900ef67 --- /dev/null +++ b/queue-5.19/net-bonding-unsync-device-addresses-on-ndo_stop.patch @@ -0,0 +1,141 @@ +From 579dfc7db0d094a4d87ca90b859cdbbe95ea6327 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Sep 2022 16:56:40 +0900 +Subject: net: bonding: Unsync device addresses on ndo_stop + +From: Benjamin Poirier + +[ Upstream commit 86247aba599e5b07d7e828e6edaaebb0ef2b1158 ] + +Netdev drivers are expected to call dev_{uc,mc}_sync() in their +ndo_set_rx_mode method and dev_{uc,mc}_unsync() in their ndo_stop method. +This is mentioned in the kerneldoc for those dev_* functions. + +The bonding driver calls dev_{uc,mc}_unsync() during ndo_uninit instead of +ndo_stop. This is ineffective because address lists (dev->{uc,mc}) have +already been emptied in unregister_netdevice_many() before ndo_uninit is +called. This mistake can result in addresses being leftover on former bond +slaves after a bond has been deleted; see test_LAG_cleanup() in the last +patch in this series. + +Add unsync calls, via bond_hw_addr_flush(), at their expected location, +bond_close(). +Add dev_mc_add() call to bond_open() to match the above change. + +v3: +* When adding or deleting a slave, only sync/unsync, add/del addresses if + the bond is up. In other cases, it is taken care of at the right time by + ndo_open/ndo_set_rx_mode/ndo_stop. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Benjamin Poirier +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 47 ++++++++++++++++++++++++--------- + 1 file changed, 35 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index b159b73f2969..83852e6719e2 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -886,7 +886,8 @@ static void bond_hw_addr_swap(struct bonding *bond, struct slave *new_active, + if (bond->dev->flags & IFF_ALLMULTI) + dev_set_allmulti(old_active->dev, -1); + +- bond_hw_addr_flush(bond->dev, old_active->dev); ++ if (bond->dev->flags & IFF_UP) ++ bond_hw_addr_flush(bond->dev, old_active->dev); + } + + if (new_active) { +@@ -897,10 +898,12 @@ static void bond_hw_addr_swap(struct bonding *bond, struct slave *new_active, + if (bond->dev->flags & IFF_ALLMULTI) + dev_set_allmulti(new_active->dev, 1); + +- netif_addr_lock_bh(bond->dev); +- dev_uc_sync(new_active->dev, bond->dev); +- dev_mc_sync(new_active->dev, bond->dev); +- netif_addr_unlock_bh(bond->dev); ++ if (bond->dev->flags & IFF_UP) { ++ netif_addr_lock_bh(bond->dev); ++ dev_uc_sync(new_active->dev, bond->dev); ++ dev_mc_sync(new_active->dev, bond->dev); ++ netif_addr_unlock_bh(bond->dev); ++ } + } + } + +@@ -2135,13 +2138,15 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev, + } + } + +- netif_addr_lock_bh(bond_dev); +- dev_mc_sync_multiple(slave_dev, bond_dev); +- dev_uc_sync_multiple(slave_dev, bond_dev); +- netif_addr_unlock_bh(bond_dev); ++ if (bond_dev->flags & IFF_UP) { ++ netif_addr_lock_bh(bond_dev); ++ dev_mc_sync_multiple(slave_dev, bond_dev); ++ dev_uc_sync_multiple(slave_dev, bond_dev); ++ netif_addr_unlock_bh(bond_dev); + +- if (BOND_MODE(bond) == BOND_MODE_8023AD) +- dev_mc_add(slave_dev, lacpdu_mcast_addr); ++ if (BOND_MODE(bond) == BOND_MODE_8023AD) ++ dev_mc_add(slave_dev, lacpdu_mcast_addr); ++ } + } + + bond->slave_cnt++; +@@ -2412,7 +2417,8 @@ static int __bond_release_one(struct net_device *bond_dev, + if (old_flags & IFF_ALLMULTI) + dev_set_allmulti(slave_dev, -1); + +- bond_hw_addr_flush(bond_dev, slave_dev); ++ if (old_flags & IFF_UP) ++ bond_hw_addr_flush(bond_dev, slave_dev); + } + + slave_disable_netpoll(slave); +@@ -4186,6 +4192,9 @@ static int bond_open(struct net_device *bond_dev) + /* register to receive LACPDUs */ + bond->recv_probe = bond_3ad_lacpdu_recv; + bond_3ad_initiate_agg_selection(bond, 1); ++ ++ bond_for_each_slave(bond, slave, iter) ++ dev_mc_add(slave->dev, lacpdu_mcast_addr); + } + + if (bond_mode_can_use_xmit_hash(bond)) +@@ -4197,6 +4206,7 @@ static int bond_open(struct net_device *bond_dev) + static int bond_close(struct net_device *bond_dev) + { + struct bonding *bond = netdev_priv(bond_dev); ++ struct slave *slave; + + bond_work_cancel_all(bond); + bond->send_peer_notif = 0; +@@ -4204,6 +4214,19 @@ static int bond_close(struct net_device *bond_dev) + bond_alb_deinitialize(bond); + bond->recv_probe = NULL; + ++ if (bond_uses_primary(bond)) { ++ rcu_read_lock(); ++ slave = rcu_dereference(bond->curr_active_slave); ++ if (slave) ++ bond_hw_addr_flush(bond_dev, slave->dev); ++ rcu_read_unlock(); ++ } else { ++ struct list_head *iter; ++ ++ bond_for_each_slave(bond, slave, iter) ++ bond_hw_addr_flush(bond_dev, slave->dev); ++ } ++ + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.19/net-core-fix-flow-symmetric-hash.patch b/queue-5.19/net-core-fix-flow-symmetric-hash.patch new file mode 100644 index 00000000000..90eea001892 --- /dev/null +++ b/queue-5.19/net-core-fix-flow-symmetric-hash.patch @@ -0,0 +1,88 @@ +From 20b8f8c59b2610d9fd798b585621f5ada2ffc102 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Sep 2022 12:08:13 +0200 +Subject: net: core: fix flow symmetric hash + +From: Ludovic Cintrat + +[ Upstream commit 64ae13ed478428135cddc2f1113dff162d8112d4 ] + +__flow_hash_consistentify() wrongly swaps ipv4 addresses in few cases. +This function is indirectly used by __skb_get_hash_symmetric(), which is +used to fanout packets in AF_PACKET. +Intrusion detection systems may be impacted by this issue. + +__flow_hash_consistentify() computes the addresses difference then swaps +them if the difference is negative. In few cases src - dst and dst - src +are both negative. + +The following snippet mimics __flow_hash_consistentify(): + +``` + #include + #include + + int main(int argc, char** argv) { + + int diffs_d, diffd_s; + uint32_t dst = 0xb225a8c0; /* 178.37.168.192 --> 192.168.37.178 */ + uint32_t src = 0x3225a8c0; /* 50.37.168.192 --> 192.168.37.50 */ + uint32_t dst2 = 0x3325a8c0; /* 51.37.168.192 --> 192.168.37.51 */ + + diffs_d = src - dst; + diffd_s = dst - src; + + printf("src:%08x dst:%08x, diff(s-d)=%d(0x%x) diff(d-s)=%d(0x%x)\n", + src, dst, diffs_d, diffs_d, diffd_s, diffd_s); + + diffs_d = src - dst2; + diffd_s = dst2 - src; + + printf("src:%08x dst:%08x, diff(s-d)=%d(0x%x) diff(d-s)=%d(0x%x)\n", + src, dst2, diffs_d, diffs_d, diffd_s, diffd_s); + + return 0; + } +``` + +Results: + +src:3225a8c0 dst:b225a8c0, \ + diff(s-d)=-2147483648(0x80000000) \ + diff(d-s)=-2147483648(0x80000000) + +src:3225a8c0 dst:3325a8c0, \ + diff(s-d)=-16777216(0xff000000) \ + diff(d-s)=16777216(0x1000000) + +In the first case the addresses differences are always < 0, therefore +__flow_hash_consistentify() always swaps, thus dst->src and src->dst +packets have differents hashes. + +Fixes: c3f8324188fa8 ("net: Add full IPv6 addresses to flow_keys") +Signed-off-by: Ludovic Cintrat +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/flow_dissector.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c +index 6aee04f75e3e..bcba61ef5b37 100644 +--- a/net/core/flow_dissector.c ++++ b/net/core/flow_dissector.c +@@ -1572,9 +1572,8 @@ static inline void __flow_hash_consistentify(struct flow_keys *keys) + + switch (keys->control.addr_type) { + case FLOW_DISSECTOR_KEY_IPV4_ADDRS: +- addr_diff = (__force u32)keys->addrs.v4addrs.dst - +- (__force u32)keys->addrs.v4addrs.src; +- if (addr_diff < 0) ++ if ((__force u32)keys->addrs.v4addrs.dst < ++ (__force u32)keys->addrs.v4addrs.src) + swap(keys->addrs.v4addrs.src, keys->addrs.v4addrs.dst); + + if ((__force u16)keys->ports.dst < +-- +2.35.1 + diff --git a/queue-5.19/net-enetc-deny-offload-of-tc-based-tsn-features-on-v.patch b/queue-5.19/net-enetc-deny-offload-of-tc-based-tsn-features-on-v.patch new file mode 100644 index 00000000000..6f35fa397c4 --- /dev/null +++ b/queue-5.19/net-enetc-deny-offload-of-tc-based-tsn-features-on-v.patch @@ -0,0 +1,195 @@ +From e91f4439cd76ef59148ca5b3e09510729156333b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Sep 2022 16:32:09 +0300 +Subject: net: enetc: deny offload of tc-based TSN features on VF interfaces + +From: Vladimir Oltean + +[ Upstream commit 5641c751fe2f92d3d9e8a8e03c1263ac8caa0b42 ] + +TSN features on the ENETC (taprio, cbs, gate, police) are configured +through a mix of command BD ring messages and port registers: +enetc_port_rd(), enetc_port_wr(). + +Port registers are a region of the ENETC memory map which are only +accessible from the PCIe Physical Function. They are not accessible from +the Virtual Functions. + +Moreover, attempting to access these registers crashes the kernel: + +$ echo 1 > /sys/bus/pci/devices/0000\:00\:00.0/sriov_numvfs +pci 0000:00:01.0: [1957:ef00] type 00 class 0x020001 +fsl_enetc_vf 0000:00:01.0: Adding to iommu group 15 +fsl_enetc_vf 0000:00:01.0: enabling device (0000 -> 0002) +fsl_enetc_vf 0000:00:01.0 eno0vf0: renamed from eth0 +$ tc qdisc replace dev eno0vf0 root taprio num_tc 8 map 0 1 2 3 4 5 6 7 \ + queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 base-time 0 \ + sched-entry S 0x7f 900000 sched-entry S 0x80 100000 flags 0x2 +Unable to handle kernel paging request at virtual address ffff800009551a08 +Internal error: Oops: 96000007 [#1] PREEMPT SMP +pc : enetc_setup_tc_taprio+0x170/0x47c +lr : enetc_setup_tc_taprio+0x16c/0x47c +Call trace: + enetc_setup_tc_taprio+0x170/0x47c + enetc_setup_tc+0x38/0x2dc + taprio_change+0x43c/0x970 + taprio_init+0x188/0x1e0 + qdisc_create+0x114/0x470 + tc_modify_qdisc+0x1fc/0x6c0 + rtnetlink_rcv_msg+0x12c/0x390 + +Split enetc_setup_tc() into separate functions for the PF and for the +VF drivers. Also remove enetc_qos.o from being included into +enetc-vf.ko, since it serves absolutely no purpose there. + +Fixes: 34c6adf1977b ("enetc: Configure the Time-Aware Scheduler via tc-taprio offload") +Signed-off-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20220916133209.3351399-2-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/Makefile | 1 - + drivers/net/ethernet/freescale/enetc/enetc.c | 21 +------------------ + drivers/net/ethernet/freescale/enetc/enetc.h | 3 +-- + .../net/ethernet/freescale/enetc/enetc_pf.c | 21 ++++++++++++++++++- + .../net/ethernet/freescale/enetc/enetc_vf.c | 13 +++++++++++- + 5 files changed, 34 insertions(+), 25 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/enetc/Makefile b/drivers/net/ethernet/freescale/enetc/Makefile +index a139f2e9d59f..e0e8dfd13793 100644 +--- a/drivers/net/ethernet/freescale/enetc/Makefile ++++ b/drivers/net/ethernet/freescale/enetc/Makefile +@@ -9,7 +9,6 @@ fsl-enetc-$(CONFIG_FSL_ENETC_QOS) += enetc_qos.o + + obj-$(CONFIG_FSL_ENETC_VF) += fsl-enetc-vf.o + fsl-enetc-vf-y := enetc_vf.o $(common-objs) +-fsl-enetc-vf-$(CONFIG_FSL_ENETC_QOS) += enetc_qos.o + + obj-$(CONFIG_FSL_ENETC_IERB) += fsl-enetc-ierb.o + fsl-enetc-ierb-y := enetc_ierb.o +diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c +index 3df099f6cbe0..9f5b921039bd 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc.c +@@ -2432,7 +2432,7 @@ int enetc_close(struct net_device *ndev) + return 0; + } + +-static int enetc_setup_tc_mqprio(struct net_device *ndev, void *type_data) ++int enetc_setup_tc_mqprio(struct net_device *ndev, void *type_data) + { + struct enetc_ndev_priv *priv = netdev_priv(ndev); + struct tc_mqprio_qopt *mqprio = type_data; +@@ -2486,25 +2486,6 @@ static int enetc_setup_tc_mqprio(struct net_device *ndev, void *type_data) + return 0; + } + +-int enetc_setup_tc(struct net_device *ndev, enum tc_setup_type type, +- void *type_data) +-{ +- switch (type) { +- case TC_SETUP_QDISC_MQPRIO: +- return enetc_setup_tc_mqprio(ndev, type_data); +- case TC_SETUP_QDISC_TAPRIO: +- return enetc_setup_tc_taprio(ndev, type_data); +- case TC_SETUP_QDISC_CBS: +- return enetc_setup_tc_cbs(ndev, type_data); +- case TC_SETUP_QDISC_ETF: +- return enetc_setup_tc_txtime(ndev, type_data); +- case TC_SETUP_BLOCK: +- return enetc_setup_tc_psfp(ndev, type_data); +- default: +- return -EOPNOTSUPP; +- } +-} +- + static int enetc_setup_xdp_prog(struct net_device *dev, struct bpf_prog *prog, + struct netlink_ext_ack *extack) + { +diff --git a/drivers/net/ethernet/freescale/enetc/enetc.h b/drivers/net/ethernet/freescale/enetc/enetc.h +index caa12509d06b..2cfe6944ebd3 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc.h ++++ b/drivers/net/ethernet/freescale/enetc/enetc.h +@@ -395,8 +395,7 @@ netdev_tx_t enetc_xmit(struct sk_buff *skb, struct net_device *ndev); + struct net_device_stats *enetc_get_stats(struct net_device *ndev); + void enetc_set_features(struct net_device *ndev, netdev_features_t features); + int enetc_ioctl(struct net_device *ndev, struct ifreq *rq, int cmd); +-int enetc_setup_tc(struct net_device *ndev, enum tc_setup_type type, +- void *type_data); ++int enetc_setup_tc_mqprio(struct net_device *ndev, void *type_data); + int enetc_setup_bpf(struct net_device *dev, struct netdev_bpf *xdp); + int enetc_xdp_xmit(struct net_device *ndev, int num_frames, + struct xdp_frame **frames, u32 flags); +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c +index 201b5f3f634e..bb7750222691 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c +@@ -734,6 +734,25 @@ static int enetc_pf_set_features(struct net_device *ndev, + return 0; + } + ++static int enetc_pf_setup_tc(struct net_device *ndev, enum tc_setup_type type, ++ void *type_data) ++{ ++ switch (type) { ++ case TC_SETUP_QDISC_MQPRIO: ++ return enetc_setup_tc_mqprio(ndev, type_data); ++ case TC_SETUP_QDISC_TAPRIO: ++ return enetc_setup_tc_taprio(ndev, type_data); ++ case TC_SETUP_QDISC_CBS: ++ return enetc_setup_tc_cbs(ndev, type_data); ++ case TC_SETUP_QDISC_ETF: ++ return enetc_setup_tc_txtime(ndev, type_data); ++ case TC_SETUP_BLOCK: ++ return enetc_setup_tc_psfp(ndev, type_data); ++ default: ++ return -EOPNOTSUPP; ++ } ++} ++ + static const struct net_device_ops enetc_ndev_ops = { + .ndo_open = enetc_open, + .ndo_stop = enetc_close, +@@ -748,7 +767,7 @@ static const struct net_device_ops enetc_ndev_ops = { + .ndo_set_vf_spoofchk = enetc_pf_set_vf_spoofchk, + .ndo_set_features = enetc_pf_set_features, + .ndo_eth_ioctl = enetc_ioctl, +- .ndo_setup_tc = enetc_setup_tc, ++ .ndo_setup_tc = enetc_pf_setup_tc, + .ndo_bpf = enetc_setup_bpf, + .ndo_xdp_xmit = enetc_xdp_xmit, + }; +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_vf.c b/drivers/net/ethernet/freescale/enetc/enetc_vf.c +index 4048101c42be..dfcaac302e24 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_vf.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_vf.c +@@ -93,6 +93,17 @@ static int enetc_vf_set_features(struct net_device *ndev, + return 0; + } + ++static int enetc_vf_setup_tc(struct net_device *ndev, enum tc_setup_type type, ++ void *type_data) ++{ ++ switch (type) { ++ case TC_SETUP_QDISC_MQPRIO: ++ return enetc_setup_tc_mqprio(ndev, type_data); ++ default: ++ return -EOPNOTSUPP; ++ } ++} ++ + /* Probing/ Init */ + static const struct net_device_ops enetc_ndev_ops = { + .ndo_open = enetc_open, +@@ -102,7 +113,7 @@ static const struct net_device_ops enetc_ndev_ops = { + .ndo_set_mac_address = enetc_vf_set_mac_addr, + .ndo_set_features = enetc_vf_set_features, + .ndo_eth_ioctl = enetc_ioctl, +- .ndo_setup_tc = enetc_setup_tc, ++ .ndo_setup_tc = enetc_vf_setup_tc, + }; + + static void enetc_vf_netdev_setup(struct enetc_si *si, struct net_device *ndev, +-- +2.35.1 + diff --git a/queue-5.19/net-enetc-move-enetc_set_psfp-out-of-the-common-enet.patch b/queue-5.19/net-enetc-move-enetc_set_psfp-out-of-the-common-enet.patch new file mode 100644 index 00000000000..a15a857ba5e --- /dev/null +++ b/queue-5.19/net-enetc-move-enetc_set_psfp-out-of-the-common-enet.patch @@ -0,0 +1,199 @@ +From dfb3ca3ce48490a840f6174534ff2ae5cf505c7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Sep 2022 16:32:08 +0300 +Subject: net: enetc: move enetc_set_psfp() out of the common + enetc_set_features() + +From: Vladimir Oltean + +[ Upstream commit fed38e64d9b99d65a36c0dbadc3d3f8ddd9ea030 ] + +The VF netdev driver shouldn't respond to changes in the NETIF_F_HW_TC +flag; only PFs should. Moreover, TSN-specific code should go to +enetc_qos.c, which should not be included in the VF driver. + +Fixes: 79e499829f3f ("net: enetc: add hw tc hw offload features for PSPF capability") +Signed-off-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20220916133209.3351399-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/enetc.c | 32 +------------------ + drivers/net/ethernet/freescale/enetc/enetc.h | 9 ++++-- + .../net/ethernet/freescale/enetc/enetc_pf.c | 11 ++++++- + .../net/ethernet/freescale/enetc/enetc_qos.c | 23 +++++++++++++ + .../net/ethernet/freescale/enetc/enetc_vf.c | 4 ++- + 5 files changed, 44 insertions(+), 35 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c +index 4470a4a3e4c3..3df099f6cbe0 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc.c +@@ -2600,29 +2600,6 @@ static int enetc_set_rss(struct net_device *ndev, int en) + return 0; + } + +-static int enetc_set_psfp(struct net_device *ndev, int en) +-{ +- struct enetc_ndev_priv *priv = netdev_priv(ndev); +- int err; +- +- if (en) { +- err = enetc_psfp_enable(priv); +- if (err) +- return err; +- +- priv->active_offloads |= ENETC_F_QCI; +- return 0; +- } +- +- err = enetc_psfp_disable(priv); +- if (err) +- return err; +- +- priv->active_offloads &= ~ENETC_F_QCI; +- +- return 0; +-} +- + static void enetc_enable_rxvlan(struct net_device *ndev, bool en) + { + struct enetc_ndev_priv *priv = netdev_priv(ndev); +@@ -2641,11 +2618,9 @@ static void enetc_enable_txvlan(struct net_device *ndev, bool en) + enetc_bdr_enable_txvlan(&priv->si->hw, i, en); + } + +-int enetc_set_features(struct net_device *ndev, +- netdev_features_t features) ++void enetc_set_features(struct net_device *ndev, netdev_features_t features) + { + netdev_features_t changed = ndev->features ^ features; +- int err = 0; + + if (changed & NETIF_F_RXHASH) + enetc_set_rss(ndev, !!(features & NETIF_F_RXHASH)); +@@ -2657,11 +2632,6 @@ int enetc_set_features(struct net_device *ndev, + if (changed & NETIF_F_HW_VLAN_CTAG_TX) + enetc_enable_txvlan(ndev, + !!(features & NETIF_F_HW_VLAN_CTAG_TX)); +- +- if (changed & NETIF_F_HW_TC) +- err = enetc_set_psfp(ndev, !!(features & NETIF_F_HW_TC)); +- +- return err; + } + + #ifdef CONFIG_FSL_ENETC_PTP_CLOCK +diff --git a/drivers/net/ethernet/freescale/enetc/enetc.h b/drivers/net/ethernet/freescale/enetc/enetc.h +index 29922c20531f..caa12509d06b 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc.h ++++ b/drivers/net/ethernet/freescale/enetc/enetc.h +@@ -393,8 +393,7 @@ void enetc_start(struct net_device *ndev); + void enetc_stop(struct net_device *ndev); + netdev_tx_t enetc_xmit(struct sk_buff *skb, struct net_device *ndev); + struct net_device_stats *enetc_get_stats(struct net_device *ndev); +-int enetc_set_features(struct net_device *ndev, +- netdev_features_t features); ++void enetc_set_features(struct net_device *ndev, netdev_features_t features); + int enetc_ioctl(struct net_device *ndev, struct ifreq *rq, int cmd); + int enetc_setup_tc(struct net_device *ndev, enum tc_setup_type type, + void *type_data); +@@ -465,6 +464,7 @@ int enetc_setup_tc_block_cb(enum tc_setup_type type, void *type_data, + int enetc_setup_tc_psfp(struct net_device *ndev, void *type_data); + int enetc_psfp_init(struct enetc_ndev_priv *priv); + int enetc_psfp_clean(struct enetc_ndev_priv *priv); ++int enetc_set_psfp(struct net_device *ndev, bool en); + + static inline void enetc_get_max_cap(struct enetc_ndev_priv *priv) + { +@@ -540,4 +540,9 @@ static inline int enetc_psfp_disable(struct enetc_ndev_priv *priv) + { + return 0; + } ++ ++static inline int enetc_set_psfp(struct net_device *ndev, bool en) ++{ ++ return 0; ++} + #endif +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c +index c4a0e836d4f0..201b5f3f634e 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c +@@ -709,6 +709,13 @@ static int enetc_pf_set_features(struct net_device *ndev, + { + netdev_features_t changed = ndev->features ^ features; + struct enetc_ndev_priv *priv = netdev_priv(ndev); ++ int err; ++ ++ if (changed & NETIF_F_HW_TC) { ++ err = enetc_set_psfp(ndev, !!(features & NETIF_F_HW_TC)); ++ if (err) ++ return err; ++ } + + if (changed & NETIF_F_HW_VLAN_CTAG_FILTER) { + struct enetc_pf *pf = enetc_si_priv(priv->si); +@@ -722,7 +729,9 @@ static int enetc_pf_set_features(struct net_device *ndev, + if (changed & NETIF_F_LOOPBACK) + enetc_set_loopback(ndev, !!(features & NETIF_F_LOOPBACK)); + +- return enetc_set_features(ndev, features); ++ enetc_set_features(ndev, features); ++ ++ return 0; + } + + static const struct net_device_ops enetc_ndev_ops = { +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_qos.c b/drivers/net/ethernet/freescale/enetc/enetc_qos.c +index 582a663ed0ba..f8a2f02ce22d 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_qos.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_qos.c +@@ -1517,6 +1517,29 @@ int enetc_setup_tc_block_cb(enum tc_setup_type type, void *type_data, + } + } + ++int enetc_set_psfp(struct net_device *ndev, bool en) ++{ ++ struct enetc_ndev_priv *priv = netdev_priv(ndev); ++ int err; ++ ++ if (en) { ++ err = enetc_psfp_enable(priv); ++ if (err) ++ return err; ++ ++ priv->active_offloads |= ENETC_F_QCI; ++ return 0; ++ } ++ ++ err = enetc_psfp_disable(priv); ++ if (err) ++ return err; ++ ++ priv->active_offloads &= ~ENETC_F_QCI; ++ ++ return 0; ++} ++ + int enetc_psfp_init(struct enetc_ndev_priv *priv) + { + if (epsfp.psfp_sfi_bitmap) +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_vf.c b/drivers/net/ethernet/freescale/enetc/enetc_vf.c +index 17924305afa2..4048101c42be 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_vf.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_vf.c +@@ -88,7 +88,9 @@ static int enetc_vf_set_mac_addr(struct net_device *ndev, void *addr) + static int enetc_vf_set_features(struct net_device *ndev, + netdev_features_t features) + { +- return enetc_set_features(ndev, features); ++ enetc_set_features(ndev, features); ++ ++ return 0; + } + + /* Probing/ Init */ +-- +2.35.1 + diff --git a/queue-5.19/net-ipa-properly-limit-modem-routing-table-use.patch b/queue-5.19/net-ipa-properly-limit-modem-routing-table-use.patch new file mode 100644 index 00000000000..50475809a26 --- /dev/null +++ b/queue-5.19/net-ipa-properly-limit-modem-routing-table-use.patch @@ -0,0 +1,234 @@ +From aba4212429126b0eafb3ae278784744780f6174f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Sep 2022 15:46:02 -0500 +Subject: net: ipa: properly limit modem routing table use + +From: Alex Elder + +[ Upstream commit cf412ec333250cb82bafe57169204e14a9f1c2ac ] + +IPA can route packets between IPA-connected entities. The AP and +modem are currently the only such entities supported, and no routing +is required to transfer packets between them. + +The number of entries in each routing table is fixed, and defined at +initialization time. Some of these entries are designated for use +by the modem, and the rest are available for the AP to use. The AP +sends a QMI message to the modem which describes (among other +things) information about routing table memory available for the +modem to use. + +Currently the QMI initialization packet gives wrong information in +its description of routing tables. What *should* be supplied is the +maximum index that the modem can use for the routing table memory +located at a given location. The current code instead supplies the +total *number* of routing table entries. Furthermore, the modem is +granted the entire table, not just the subset it's supposed to use. + +This patch fixes this. First, the ipa_mem_bounds structure is +generalized so its "end" field can be interpreted either as a final +byte offset, or a final array index. Second, the IPv4 and IPv6 +(non-hashed and hashed) table information fields in the QMI +ipa_init_modem_driver_req structure are changed to be ipa_mem_bounds +rather than ipa_mem_array structures. Third, we set the "end" value +for each routing table to be the last index, rather than setting the +"count" to be the number of indices. Finally, instead of allowing +the modem to use all of a routing table's memory, it is limited to +just the portion meant to be used by the modem. In all versions of +IPA currently supported, that is IPA_ROUTE_MODEM_COUNT (8) entries. + +Update a few comments for clarity. + +Fixes: 530f9216a9537 ("soc: qcom: ipa: AP/modem communications") +Signed-off-by: Alex Elder +Link: https://lore.kernel.org/r/20220913204602.1803004-1-elder@linaro.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ipa/ipa_qmi.c | 8 ++++---- + drivers/net/ipa/ipa_qmi_msg.c | 8 ++++---- + drivers/net/ipa/ipa_qmi_msg.h | 37 ++++++++++++++++++++--------------- + drivers/net/ipa/ipa_table.c | 2 -- + drivers/net/ipa/ipa_table.h | 3 +++ + 5 files changed, 32 insertions(+), 26 deletions(-) + +diff --git a/drivers/net/ipa/ipa_qmi.c b/drivers/net/ipa/ipa_qmi.c +index ec010cf2e816..6f874f99b910 100644 +--- a/drivers/net/ipa/ipa_qmi.c ++++ b/drivers/net/ipa/ipa_qmi.c +@@ -308,12 +308,12 @@ init_modem_driver_req(struct ipa_qmi *ipa_qmi) + mem = ipa_mem_find(ipa, IPA_MEM_V4_ROUTE); + req.v4_route_tbl_info_valid = 1; + req.v4_route_tbl_info.start = ipa->mem_offset + mem->offset; +- req.v4_route_tbl_info.count = mem->size / sizeof(__le64); ++ req.v4_route_tbl_info.end = IPA_ROUTE_MODEM_COUNT - 1; + + mem = ipa_mem_find(ipa, IPA_MEM_V6_ROUTE); + req.v6_route_tbl_info_valid = 1; + req.v6_route_tbl_info.start = ipa->mem_offset + mem->offset; +- req.v6_route_tbl_info.count = mem->size / sizeof(__le64); ++ req.v6_route_tbl_info.end = IPA_ROUTE_MODEM_COUNT - 1; + + mem = ipa_mem_find(ipa, IPA_MEM_V4_FILTER); + req.v4_filter_tbl_start_valid = 1; +@@ -352,7 +352,7 @@ init_modem_driver_req(struct ipa_qmi *ipa_qmi) + req.v4_hash_route_tbl_info_valid = 1; + req.v4_hash_route_tbl_info.start = + ipa->mem_offset + mem->offset; +- req.v4_hash_route_tbl_info.count = mem->size / sizeof(__le64); ++ req.v4_hash_route_tbl_info.end = IPA_ROUTE_MODEM_COUNT - 1; + } + + mem = ipa_mem_find(ipa, IPA_MEM_V6_ROUTE_HASHED); +@@ -360,7 +360,7 @@ init_modem_driver_req(struct ipa_qmi *ipa_qmi) + req.v6_hash_route_tbl_info_valid = 1; + req.v6_hash_route_tbl_info.start = + ipa->mem_offset + mem->offset; +- req.v6_hash_route_tbl_info.count = mem->size / sizeof(__le64); ++ req.v6_hash_route_tbl_info.end = IPA_ROUTE_MODEM_COUNT - 1; + } + + mem = ipa_mem_find(ipa, IPA_MEM_V4_FILTER_HASHED); +diff --git a/drivers/net/ipa/ipa_qmi_msg.c b/drivers/net/ipa/ipa_qmi_msg.c +index 6838e8065072..75d3fc0092e9 100644 +--- a/drivers/net/ipa/ipa_qmi_msg.c ++++ b/drivers/net/ipa/ipa_qmi_msg.c +@@ -311,7 +311,7 @@ struct qmi_elem_info ipa_init_modem_driver_req_ei[] = { + .tlv_type = 0x12, + .offset = offsetof(struct ipa_init_modem_driver_req, + v4_route_tbl_info), +- .ei_array = ipa_mem_array_ei, ++ .ei_array = ipa_mem_bounds_ei, + }, + { + .data_type = QMI_OPT_FLAG, +@@ -332,7 +332,7 @@ struct qmi_elem_info ipa_init_modem_driver_req_ei[] = { + .tlv_type = 0x13, + .offset = offsetof(struct ipa_init_modem_driver_req, + v6_route_tbl_info), +- .ei_array = ipa_mem_array_ei, ++ .ei_array = ipa_mem_bounds_ei, + }, + { + .data_type = QMI_OPT_FLAG, +@@ -496,7 +496,7 @@ struct qmi_elem_info ipa_init_modem_driver_req_ei[] = { + .tlv_type = 0x1b, + .offset = offsetof(struct ipa_init_modem_driver_req, + v4_hash_route_tbl_info), +- .ei_array = ipa_mem_array_ei, ++ .ei_array = ipa_mem_bounds_ei, + }, + { + .data_type = QMI_OPT_FLAG, +@@ -517,7 +517,7 @@ struct qmi_elem_info ipa_init_modem_driver_req_ei[] = { + .tlv_type = 0x1c, + .offset = offsetof(struct ipa_init_modem_driver_req, + v6_hash_route_tbl_info), +- .ei_array = ipa_mem_array_ei, ++ .ei_array = ipa_mem_bounds_ei, + }, + { + .data_type = QMI_OPT_FLAG, +diff --git a/drivers/net/ipa/ipa_qmi_msg.h b/drivers/net/ipa/ipa_qmi_msg.h +index 495e85abe50b..9651aa59b596 100644 +--- a/drivers/net/ipa/ipa_qmi_msg.h ++++ b/drivers/net/ipa/ipa_qmi_msg.h +@@ -86,9 +86,11 @@ enum ipa_platform_type { + IPA_QMI_PLATFORM_TYPE_MSM_QNX_V01 = 0x5, /* QNX MSM */ + }; + +-/* This defines the start and end offset of a range of memory. Both +- * fields are offsets relative to the start of IPA shared memory. +- * The end value is the last addressable byte *within* the range. ++/* This defines the start and end offset of a range of memory. The start ++ * value is a byte offset relative to the start of IPA shared memory. The ++ * end value is the last addressable unit *within* the range. Typically ++ * the end value is in units of bytes, however it can also be a maximum ++ * array index value. + */ + struct ipa_mem_bounds { + u32 start; +@@ -129,18 +131,19 @@ struct ipa_init_modem_driver_req { + u8 hdr_tbl_info_valid; + struct ipa_mem_bounds hdr_tbl_info; + +- /* Routing table information. These define the location and size of +- * non-hashable IPv4 and IPv6 filter tables. The start values are +- * offsets relative to the start of IPA shared memory. ++ /* Routing table information. These define the location and maximum ++ * *index* (not byte) for the modem portion of non-hashable IPv4 and ++ * IPv6 routing tables. The start values are byte offsets relative ++ * to the start of IPA shared memory. + */ + u8 v4_route_tbl_info_valid; +- struct ipa_mem_array v4_route_tbl_info; ++ struct ipa_mem_bounds v4_route_tbl_info; + u8 v6_route_tbl_info_valid; +- struct ipa_mem_array v6_route_tbl_info; ++ struct ipa_mem_bounds v6_route_tbl_info; + + /* Filter table information. These define the location of the + * non-hashable IPv4 and IPv6 filter tables. The start values are +- * offsets relative to the start of IPA shared memory. ++ * byte offsets relative to the start of IPA shared memory. + */ + u8 v4_filter_tbl_start_valid; + u32 v4_filter_tbl_start; +@@ -181,18 +184,20 @@ struct ipa_init_modem_driver_req { + u8 zip_tbl_info_valid; + struct ipa_mem_bounds zip_tbl_info; + +- /* Routing table information. These define the location and size +- * of hashable IPv4 and IPv6 filter tables. The start values are +- * offsets relative to the start of IPA shared memory. ++ /* Routing table information. These define the location and maximum ++ * *index* (not byte) for the modem portion of hashable IPv4 and IPv6 ++ * routing tables (if supported by hardware). The start values are ++ * byte offsets relative to the start of IPA shared memory. + */ + u8 v4_hash_route_tbl_info_valid; +- struct ipa_mem_array v4_hash_route_tbl_info; ++ struct ipa_mem_bounds v4_hash_route_tbl_info; + u8 v6_hash_route_tbl_info_valid; +- struct ipa_mem_array v6_hash_route_tbl_info; ++ struct ipa_mem_bounds v6_hash_route_tbl_info; + + /* Filter table information. These define the location and size +- * of hashable IPv4 and IPv6 filter tables. The start values are +- * offsets relative to the start of IPA shared memory. ++ * of hashable IPv4 and IPv6 filter tables (if supported by hardware). ++ * The start values are byte offsets relative to the start of IPA ++ * shared memory. + */ + u8 v4_hash_filter_tbl_start_valid; + u32 v4_hash_filter_tbl_start; +diff --git a/drivers/net/ipa/ipa_table.c b/drivers/net/ipa/ipa_table.c +index 2f5a58bfc529..69efe672ca52 100644 +--- a/drivers/net/ipa/ipa_table.c ++++ b/drivers/net/ipa/ipa_table.c +@@ -108,8 +108,6 @@ + + /* Assignment of route table entries to the modem and AP */ + #define IPA_ROUTE_MODEM_MIN 0 +-#define IPA_ROUTE_MODEM_COUNT 8 +- + #define IPA_ROUTE_AP_MIN IPA_ROUTE_MODEM_COUNT + #define IPA_ROUTE_AP_COUNT \ + (IPA_ROUTE_COUNT_MAX - IPA_ROUTE_MODEM_COUNT) +diff --git a/drivers/net/ipa/ipa_table.h b/drivers/net/ipa/ipa_table.h +index b6a9a0d79d68..1538e2e1732f 100644 +--- a/drivers/net/ipa/ipa_table.h ++++ b/drivers/net/ipa/ipa_table.h +@@ -13,6 +13,9 @@ struct ipa; + /* The maximum number of filter table entries (IPv4, IPv6; hashed or not) */ + #define IPA_FILTER_COUNT_MAX 14 + ++/* The number of route table entries allotted to the modem */ ++#define IPA_ROUTE_MODEM_COUNT 8 ++ + /* The maximum number of route table entries (IPv4, IPv6; hashed or not) */ + #define IPA_ROUTE_COUNT_MAX 15 + +-- +2.35.1 + diff --git a/queue-5.19/net-phy-aquantia-wait-for-the-suspend-resume-operati.patch b/queue-5.19/net-phy-aquantia-wait-for-the-suspend-resume-operati.patch new file mode 100644 index 00000000000..c70787e7b87 --- /dev/null +++ b/queue-5.19/net-phy-aquantia-wait-for-the-suspend-resume-operati.patch @@ -0,0 +1,122 @@ +From 212c2cafead26078ce9121eac99a8e970e39986e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Sep 2022 16:04:51 +0300 +Subject: net: phy: aquantia: wait for the suspend/resume operations to finish + +From: Ioana Ciornei + +[ Upstream commit ca2dccdeeb49a7e408112d681bf447984c845292 ] + +The Aquantia datasheet notes that after issuing a Processor-Intensive +MDIO operation, like changing the low-power state of the device, the +driver should wait for the operation to finish before issuing a new MDIO +command. + +The new aqr107_wait_processor_intensive_op() function is added which can +be used after these kind of MDIO operations. At the moment, we are only +adding it at the end of the suspend/resume calls. + +The issue was identified on a board featuring the AQR113C PHY, on +which commands like 'ip link (..) up / down' issued without any delays +between them would render the link on the PHY to remain down. +The issue was easy to reproduce with a one-liner: + $ ip link set dev ethX down; ip link set dev ethX up; \ + ip link set dev ethX down; ip link set dev ethX up; + +Fixes: ac9e81c230eb ("net: phy: aquantia: add suspend / resume callbacks for AQR107 family") +Signed-off-by: Ioana Ciornei +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20220906130451.1483448-1-ioana.ciornei@nxp.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/phy/aquantia_main.c | 53 ++++++++++++++++++++++++++++++--- + 1 file changed, 49 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/phy/aquantia_main.c b/drivers/net/phy/aquantia_main.c +index c7047f5d7a9b..8bc0957a0f6d 100644 +--- a/drivers/net/phy/aquantia_main.c ++++ b/drivers/net/phy/aquantia_main.c +@@ -90,6 +90,9 @@ + #define VEND1_GLOBAL_FW_ID_MAJOR GENMASK(15, 8) + #define VEND1_GLOBAL_FW_ID_MINOR GENMASK(7, 0) + ++#define VEND1_GLOBAL_GEN_STAT2 0xc831 ++#define VEND1_GLOBAL_GEN_STAT2_OP_IN_PROG BIT(15) ++ + #define VEND1_GLOBAL_RSVD_STAT1 0xc885 + #define VEND1_GLOBAL_RSVD_STAT1_FW_BUILD_ID GENMASK(7, 4) + #define VEND1_GLOBAL_RSVD_STAT1_PROV_ID GENMASK(3, 0) +@@ -124,6 +127,12 @@ + #define VEND1_GLOBAL_INT_VEND_MASK_GLOBAL2 BIT(1) + #define VEND1_GLOBAL_INT_VEND_MASK_GLOBAL3 BIT(0) + ++/* Sleep and timeout for checking if the Processor-Intensive ++ * MDIO operation is finished ++ */ ++#define AQR107_OP_IN_PROG_SLEEP 1000 ++#define AQR107_OP_IN_PROG_TIMEOUT 100000 ++ + struct aqr107_hw_stat { + const char *name; + int reg; +@@ -596,16 +605,52 @@ static void aqr107_link_change_notify(struct phy_device *phydev) + phydev_info(phydev, "Aquantia 1000Base-T2 mode active\n"); + } + ++static int aqr107_wait_processor_intensive_op(struct phy_device *phydev) ++{ ++ int val, err; ++ ++ /* The datasheet notes to wait at least 1ms after issuing a ++ * processor intensive operation before checking. ++ * We cannot use the 'sleep_before_read' parameter of read_poll_timeout ++ * because that just determines the maximum time slept, not the minimum. ++ */ ++ usleep_range(1000, 5000); ++ ++ err = phy_read_mmd_poll_timeout(phydev, MDIO_MMD_VEND1, ++ VEND1_GLOBAL_GEN_STAT2, val, ++ !(val & VEND1_GLOBAL_GEN_STAT2_OP_IN_PROG), ++ AQR107_OP_IN_PROG_SLEEP, ++ AQR107_OP_IN_PROG_TIMEOUT, false); ++ if (err) { ++ phydev_err(phydev, "timeout: processor-intensive MDIO operation\n"); ++ return err; ++ } ++ ++ return 0; ++} ++ + static int aqr107_suspend(struct phy_device *phydev) + { +- return phy_set_bits_mmd(phydev, MDIO_MMD_VEND1, MDIO_CTRL1, +- MDIO_CTRL1_LPOWER); ++ int err; ++ ++ err = phy_set_bits_mmd(phydev, MDIO_MMD_VEND1, MDIO_CTRL1, ++ MDIO_CTRL1_LPOWER); ++ if (err) ++ return err; ++ ++ return aqr107_wait_processor_intensive_op(phydev); + } + + static int aqr107_resume(struct phy_device *phydev) + { +- return phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1, MDIO_CTRL1, +- MDIO_CTRL1_LPOWER); ++ int err; ++ ++ err = phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1, MDIO_CTRL1, ++ MDIO_CTRL1_LPOWER); ++ if (err) ++ return err; ++ ++ return aqr107_wait_processor_intensive_op(phydev); + } + + static int aqr107_probe(struct phy_device *phydev) +-- +2.35.1 + diff --git a/queue-5.19/net-phy-micrel-fix-shared-interrupt-on-lan8814.patch b/queue-5.19/net-phy-micrel-fix-shared-interrupt-on-lan8814.patch new file mode 100644 index 00000000000..ec09b6dec4d --- /dev/null +++ b/queue-5.19/net-phy-micrel-fix-shared-interrupt-on-lan8814.patch @@ -0,0 +1,76 @@ +From dbea680cd50e21889097bb1d63d2a1bd3d2efb42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Sep 2022 16:16:19 +0200 +Subject: net: phy: micrel: fix shared interrupt on LAN8814 + +From: Michael Walle + +[ Upstream commit 2002fbac743b6e2391b4ed50ad9eb626768dd78a ] + +Since commit ece19502834d ("net: phy: micrel: 1588 support for LAN8814 +phy") the handler always returns IRQ_HANDLED, except in an error case. +Before that commit, the interrupt status register was checked and if +it was empty, IRQ_NONE was returned. Restore that behavior to play nice +with the interrupt line being shared with others. + +Fixes: ece19502834d ("net: phy: micrel: 1588 support for LAN8814 phy") +Signed-off-by: Michael Walle +Reviewed-by: Andrew Lunn +Reviewed-by: Horatiu Vultur +Reviewed-by: Divya Koppera +Link: https://lore.kernel.org/r/20220920141619.808117-1-michael@walle.cc +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/micrel.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c +index 34483a4bd688..e8e1101911b2 100644 +--- a/drivers/net/phy/micrel.c ++++ b/drivers/net/phy/micrel.c +@@ -2662,16 +2662,19 @@ static int lan8804_config_init(struct phy_device *phydev) + static irqreturn_t lan8814_handle_interrupt(struct phy_device *phydev) + { + int irq_status, tsu_irq_status; ++ int ret = IRQ_NONE; + + irq_status = phy_read(phydev, LAN8814_INTS); +- if (irq_status > 0 && (irq_status & LAN8814_INT_LINK)) +- phy_trigger_machine(phydev); +- + if (irq_status < 0) { + phy_error(phydev); + return IRQ_NONE; + } + ++ if (irq_status & LAN8814_INT_LINK) { ++ phy_trigger_machine(phydev); ++ ret = IRQ_HANDLED; ++ } ++ + while (1) { + tsu_irq_status = lanphy_read_page_reg(phydev, 4, + LAN8814_INTR_STS_REG); +@@ -2680,12 +2683,15 @@ static irqreturn_t lan8814_handle_interrupt(struct phy_device *phydev) + (tsu_irq_status & (LAN8814_INTR_STS_REG_1588_TSU0_ | + LAN8814_INTR_STS_REG_1588_TSU1_ | + LAN8814_INTR_STS_REG_1588_TSU2_ | +- LAN8814_INTR_STS_REG_1588_TSU3_))) ++ LAN8814_INTR_STS_REG_1588_TSU3_))) { + lan8814_handle_ptp_interrupt(phydev); +- else ++ ret = IRQ_HANDLED; ++ } else { + break; ++ } + } +- return IRQ_HANDLED; ++ ++ return ret; + } + + static int lan8814_ack_interrupt(struct phy_device *phydev) +-- +2.35.1 + diff --git a/queue-5.19/net-ravb-fix-phy-state-warning-splat-during-system-r.patch b/queue-5.19/net-ravb-fix-phy-state-warning-splat-during-system-r.patch new file mode 100644 index 00000000000..ba8d8891199 --- /dev/null +++ b/queue-5.19/net-ravb-fix-phy-state-warning-splat-during-system-r.patch @@ -0,0 +1,46 @@ +From 80bc79f7f7d5ffdbe80c11db05b25dd213a99c70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Sep 2022 16:48:00 +0200 +Subject: net: ravb: Fix PHY state warning splat during system resume + +From: Geert Uytterhoeven + +[ Upstream commit 4924c0cdce75575295f8fa682851fb8e5d619dd2 ] + +Since commit 744d23c71af39c7d ("net: phy: Warn about incorrect +mdio_bus_phy_resume() state"), a warning splat is printed during system +resume with Wake-on-LAN disabled: + + WARNING: CPU: 0 PID: 1197 at drivers/net/phy/phy_device.c:323 mdio_bus_phy_resume+0xbc/0xc8 + +As the Renesas Ethernet AVB driver already calls phy_{stop,start}() in +its suspend/resume callbacks, it is sufficient to just mark the MAC +responsible for managing the power state of the PHY. + +Fixes: fba863b816049b03 ("net: phy: make PHY PM ops a no-op if MAC driver manages PHY PM") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Florian Fainelli +Reviewed-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/8ec796f47620980fdd0403e21bd8b7200b4fa1d4.1663598796.git.geert+renesas@glider.be +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/ravb_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index b357ac4c56c5..7e32b04eb0c7 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -1449,6 +1449,8 @@ static int ravb_phy_init(struct net_device *ndev) + phy_remove_link_mode(phydev, ETHTOOL_LINK_MODE_100baseT_Half_BIT); + } + ++ /* Indicate that the MAC is responsible for managing PHY PM */ ++ phydev->mac_managed_pm = true; + phy_attached_info(phydev); + + return 0; +-- +2.35.1 + diff --git a/queue-5.19/net-sched-fix-possible-refcount-leak-in-tc_new_tfilt.patch b/queue-5.19/net-sched-fix-possible-refcount-leak-in-tc_new_tfilt.patch new file mode 100644 index 00000000000..ecb69ea4d41 --- /dev/null +++ b/queue-5.19/net-sched-fix-possible-refcount-leak-in-tc_new_tfilt.patch @@ -0,0 +1,38 @@ +From 05c32c15a67b97b270acde8672e4f4a80538bc52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Sep 2022 17:27:34 +0800 +Subject: net: sched: fix possible refcount leak in tc_new_tfilter() + +From: Hangyu Hua + +[ Upstream commit c2e1cfefcac35e0eea229e148c8284088ce437b5 ] + +tfilter_put need to be called to put the refount got by tp->ops->get to +avoid possible refcount leak when chain->tmplt_ops != NULL and +chain->tmplt_ops != tp->ops. + +Fixes: 7d5509fa0d3d ("net: sched: extend proto ops with 'put' callback") +Signed-off-by: Hangyu Hua +Reviewed-by: Vlad Buslov +Link: https://lore.kernel.org/r/20220921092734.31700-1-hbh25y@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/cls_api.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c +index ac366c99086f..7d7f7bac0216 100644 +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -2136,6 +2136,7 @@ static int tc_new_tfilter(struct sk_buff *skb, struct nlmsghdr *n, + } + + if (chain->tmplt_ops && chain->tmplt_ops != tp->ops) { ++ tfilter_put(tp, fh); + NL_SET_ERR_MSG(extack, "Chain template is set to a different filter kind"); + err = -EINVAL; + goto errout; +-- +2.35.1 + diff --git a/queue-5.19/net-sched-taprio-avoid-disabling-offload-when-it-was.patch b/queue-5.19/net-sched-taprio-avoid-disabling-offload-when-it-was.patch new file mode 100644 index 00000000000..13b26efa961 --- /dev/null +++ b/queue-5.19/net-sched-taprio-avoid-disabling-offload-when-it-was.patch @@ -0,0 +1,146 @@ +From f3b8e3d4a7d1bb37a44b6d421965d2f609223bb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Sep 2022 13:08:01 +0300 +Subject: net/sched: taprio: avoid disabling offload when it was never enabled + +From: Vladimir Oltean + +[ Upstream commit db46e3a88a09c5cf7e505664d01da7238cd56c92 ] + +In an incredibly strange API design decision, qdisc->destroy() gets +called even if qdisc->init() never succeeded, not exclusively since +commit 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation"), +but apparently also earlier (in the case of qdisc_create_dflt()). + +The taprio qdisc does not fully acknowledge this when it attempts full +offload, because it starts off with q->flags = TAPRIO_FLAGS_INVALID in +taprio_init(), then it replaces q->flags with TCA_TAPRIO_ATTR_FLAGS +parsed from netlink (in taprio_change(), tail called from taprio_init()). + +But in taprio_destroy(), we call taprio_disable_offload(), and this +determines what to do based on FULL_OFFLOAD_IS_ENABLED(q->flags). + +But looking at the implementation of FULL_OFFLOAD_IS_ENABLED() +(a bitwise check of bit 1 in q->flags), it is invalid to call this macro +on q->flags when it contains TAPRIO_FLAGS_INVALID, because that is set +to U32_MAX, and therefore FULL_OFFLOAD_IS_ENABLED() will return true on +an invalid set of flags. + +As a result, it is possible to crash the kernel if user space forces an +error between setting q->flags = TAPRIO_FLAGS_INVALID, and the calling +of taprio_enable_offload(). This is because drivers do not expect the +offload to be disabled when it was never enabled. + +The error that we force here is to attach taprio as a non-root qdisc, +but instead as child of an mqprio root qdisc: + +$ tc qdisc add dev swp0 root handle 1: \ + mqprio num_tc 8 map 0 1 2 3 4 5 6 7 \ + queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 hw 0 +$ tc qdisc replace dev swp0 parent 1:1 \ + taprio num_tc 8 map 0 1 2 3 4 5 6 7 \ + queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 base-time 0 \ + sched-entry S 0x7f 990000 sched-entry S 0x80 100000 \ + flags 0x0 clockid CLOCK_TAI +Unable to handle kernel paging request at virtual address fffffffffffffff8 +[fffffffffffffff8] pgd=0000000000000000, p4d=0000000000000000 +Internal error: Oops: 96000004 [#1] PREEMPT SMP +Call trace: + taprio_dump+0x27c/0x310 + vsc9959_port_setup_tc+0x1f4/0x460 + felix_port_setup_tc+0x24/0x3c + dsa_slave_setup_tc+0x54/0x27c + taprio_disable_offload.isra.0+0x58/0xe0 + taprio_destroy+0x80/0x104 + qdisc_create+0x240/0x470 + tc_modify_qdisc+0x1fc/0x6b0 + rtnetlink_rcv_msg+0x12c/0x390 + netlink_rcv_skb+0x5c/0x130 + rtnetlink_rcv+0x1c/0x2c + +Fix this by keeping track of the operations we made, and undo the +offload only if we actually did it. + +I've added "bool offloaded" inside a 4 byte hole between "int clockid" +and "atomic64_t picos_per_byte". Now the first cache line looks like +below: + +$ pahole -C taprio_sched net/sched/sch_taprio.o +struct taprio_sched { + struct Qdisc * * qdiscs; /* 0 8 */ + struct Qdisc * root; /* 8 8 */ + u32 flags; /* 16 4 */ + enum tk_offsets tk_offset; /* 20 4 */ + int clockid; /* 24 4 */ + bool offloaded; /* 28 1 */ + + /* XXX 3 bytes hole, try to pack */ + + atomic64_t picos_per_byte; /* 32 0 */ + + /* XXX 8 bytes hole, try to pack */ + + spinlock_t current_entry_lock; /* 40 0 */ + + /* XXX 8 bytes hole, try to pack */ + + struct sched_entry * current_entry; /* 48 8 */ + struct sched_gate_list * oper_sched; /* 56 8 */ + /* --- cacheline 1 boundary (64 bytes) --- */ + +Fixes: 9c66d1564676 ("taprio: Add support for hardware offloading") +Signed-off-by: Vladimir Oltean +Reviewed-by: Vinicius Costa Gomes +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_taprio.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c +index 0b941dd63d26..9bec73019f94 100644 +--- a/net/sched/sch_taprio.c ++++ b/net/sched/sch_taprio.c +@@ -67,6 +67,7 @@ struct taprio_sched { + u32 flags; + enum tk_offsets tk_offset; + int clockid; ++ bool offloaded; + atomic64_t picos_per_byte; /* Using picoseconds because for 10Gbps+ + * speeds it's sub-nanoseconds per byte + */ +@@ -1279,6 +1280,8 @@ static int taprio_enable_offload(struct net_device *dev, + goto done; + } + ++ q->offloaded = true; ++ + done: + taprio_offload_free(offload); + +@@ -1293,12 +1296,9 @@ static int taprio_disable_offload(struct net_device *dev, + struct tc_taprio_qopt_offload *offload; + int err; + +- if (!FULL_OFFLOAD_IS_ENABLED(q->flags)) ++ if (!q->offloaded) + return 0; + +- if (!ops->ndo_setup_tc) +- return -EOPNOTSUPP; +- + offload = taprio_offload_alloc(0); + if (!offload) { + NL_SET_ERR_MSG(extack, +@@ -1314,6 +1314,8 @@ static int taprio_disable_offload(struct net_device *dev, + goto out; + } + ++ q->offloaded = false; ++ + out: + taprio_offload_free(offload); + +-- +2.35.1 + diff --git a/queue-5.19/net-sched-taprio-make-qdisc_leaf-see-the-per-netdev-.patch b/queue-5.19/net-sched-taprio-make-qdisc_leaf-see-the-per-netdev-.patch new file mode 100644 index 00000000000..0224692f9bf --- /dev/null +++ b/queue-5.19/net-sched-taprio-make-qdisc_leaf-see-the-per-netdev-.patch @@ -0,0 +1,122 @@ +From 54f8f611ecf508e93961a4b5b9dca0a69063d329 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Sep 2022 13:08:02 +0300 +Subject: net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo + child qdiscs + +From: Vladimir Oltean + +[ Upstream commit 1461d212ab277d8bba1a753d33e9afe03d81f9d4 ] + +taprio can only operate as root qdisc, and to that end, there exists the +following check in taprio_init(), just as in mqprio: + + if (sch->parent != TC_H_ROOT) + return -EOPNOTSUPP; + +And indeed, when we try to attach taprio to an mqprio child, it fails as +expected: + +$ tc qdisc add dev swp0 root handle 1: mqprio num_tc 8 \ + map 0 1 2 3 4 5 6 7 \ + queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 hw 0 +$ tc qdisc replace dev swp0 parent 1:2 taprio num_tc 8 \ + map 0 1 2 3 4 5 6 7 \ + queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 \ + base-time 0 sched-entry S 0x7f 990000 sched-entry S 0x80 100000 \ + flags 0x0 clockid CLOCK_TAI +Error: sch_taprio: Can only be attached as root qdisc. + +(extack message added by me) + +But when we try to attach a taprio child to a taprio root qdisc, +surprisingly it doesn't fail: + +$ tc qdisc replace dev swp0 root handle 1: taprio num_tc 8 \ + map 0 1 2 3 4 5 6 7 queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 \ + base-time 0 sched-entry S 0x7f 990000 sched-entry S 0x80 100000 \ + flags 0x0 clockid CLOCK_TAI +$ tc qdisc replace dev swp0 parent 1:2 taprio num_tc 8 \ + map 0 1 2 3 4 5 6 7 \ + queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 \ + base-time 0 sched-entry S 0x7f 990000 sched-entry S 0x80 100000 \ + flags 0x0 clockid CLOCK_TAI + +This is because tc_modify_qdisc() behaves differently when mqprio is +root, vs when taprio is root. + +In the mqprio case, it finds the parent qdisc through +p = qdisc_lookup(dev, TC_H_MAJ(clid)), and then the child qdisc through +q = qdisc_leaf(p, clid). This leaf qdisc q has handle 0, so it is +ignored according to the comment right below ("It may be default qdisc, +ignore it"). As a result, tc_modify_qdisc() goes through the +qdisc_create() code path, and this gives taprio_init() a chance to check +for sch_parent != TC_H_ROOT and error out. + +Whereas in the taprio case, the returned q = qdisc_leaf(p, clid) is +different. It is not the default qdisc created for each netdev queue +(both taprio and mqprio call qdisc_create_dflt() and keep them in +a private q->qdiscs[], or priv->qdiscs[], respectively). Instead, taprio +makes qdisc_leaf() return the _root_ qdisc, aka itself. + +When taprio does that, tc_modify_qdisc() goes through the qdisc_change() +code path, because the qdisc layer never finds out about the child qdisc +of the root. And through the ->change() ops, taprio has no reason to +check whether its parent is root or not, just through ->init(), which is +not called. + +The problem is the taprio_leaf() implementation. Even though code wise, +it does the exact same thing as mqprio_leaf() which it is copied from, +it works with different input data. This is because mqprio does not +attach itself (the root) to each device TX queue, but one of the default +qdiscs from its private array. + +In fact, since commit 13511704f8d7 ("net: taprio offload: enforce qdisc +to netdev queue mapping"), taprio does this too, but just for the full +offload case. So if we tried to attach a taprio child to a fully +offloaded taprio root qdisc, it would properly fail too; just not to a +software root taprio. + +To fix the problem, stop looking at the Qdisc that's attached to the TX +queue, and instead, always return the default qdiscs that we've +allocated (and to which we privately enqueue and dequeue, in software +scheduling mode). + +Since Qdisc_class_ops :: leaf is only called from tc_modify_qdisc(), +the risk of unforeseen side effects introduced by this change is +minimal. + +Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler") +Signed-off-by: Vladimir Oltean +Reviewed-by: Vinicius Costa Gomes +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_taprio.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c +index 9bec73019f94..86675a79da1e 100644 +--- a/net/sched/sch_taprio.c ++++ b/net/sched/sch_taprio.c +@@ -1951,12 +1951,14 @@ static int taprio_dump(struct Qdisc *sch, struct sk_buff *skb) + + static struct Qdisc *taprio_leaf(struct Qdisc *sch, unsigned long cl) + { +- struct netdev_queue *dev_queue = taprio_queue_get(sch, cl); ++ struct taprio_sched *q = qdisc_priv(sch); ++ struct net_device *dev = qdisc_dev(sch); ++ unsigned int ntx = cl - 1; + +- if (!dev_queue) ++ if (ntx >= dev->num_tx_queues) + return NULL; + +- return dev_queue->qdisc_sleeping; ++ return q->qdiscs[ntx]; + } + + static unsigned long taprio_find(struct Qdisc *sch, u32 classid) +-- +2.35.1 + diff --git a/queue-5.19/net-sh_eth-fix-phy-state-warning-splat-during-system.patch b/queue-5.19/net-sh_eth-fix-phy-state-warning-splat-during-system.patch new file mode 100644 index 00000000000..8fa1ca6bff5 --- /dev/null +++ b/queue-5.19/net-sh_eth-fix-phy-state-warning-splat-during-system.patch @@ -0,0 +1,46 @@ +From 61d23150ce4637430653619484d354c9da3bcc0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Sep 2022 16:48:28 +0200 +Subject: net: sh_eth: Fix PHY state warning splat during system resume + +From: Geert Uytterhoeven + +[ Upstream commit 6a1dbfefdae4f7809b3e277cc76785dac0ac1cd0 ] + +Since commit 744d23c71af39c7d ("net: phy: Warn about incorrect +mdio_bus_phy_resume() state"), a warning splat is printed during system +resume with Wake-on-LAN disabled: + + WARNING: CPU: 0 PID: 626 at drivers/net/phy/phy_device.c:323 mdio_bus_phy_resume+0xbc/0xe4 + +As the Renesas SuperH Ethernet driver already calls phy_{stop,start}() +in its suspend/resume callbacks, it is sufficient to just mark the MAC +responsible for managing the power state of the PHY. + +Fixes: fba863b816049b03 ("net: phy: make PHY PM ops a no-op if MAC driver manages PHY PM") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Florian Fainelli +Reviewed-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/c6e1331b9bef61225fa4c09db3ba3e2e7214ba2d.1663598886.git.geert+renesas@glider.be +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/sh_eth.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c +index 67ade78fb767..7fd8828d3a84 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -2029,6 +2029,8 @@ static int sh_eth_phy_init(struct net_device *ndev) + if (mdp->cd->register_type != SH_ETH_REG_GIGABIT) + phy_set_max_speed(phydev, SPEED_100); + ++ /* Indicate that the MAC is responsible for managing PHY PM */ ++ phydev->mac_managed_pm = true; + phy_attached_info(phydev); + + return 0; +-- +2.35.1 + diff --git a/queue-5.19/net-smc-stop-the-clc-flow-if-no-link-to-map-buffers-.patch b/queue-5.19/net-smc-stop-the-clc-flow-if-no-link-to-map-buffers-.patch new file mode 100644 index 00000000000..8d4b89773c1 --- /dev/null +++ b/queue-5.19/net-smc-stop-the-clc-flow-if-no-link-to-map-buffers-.patch @@ -0,0 +1,69 @@ +From d5fc3788df9538aba929dda5b3ab74f9b6f8ec26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Sep 2022 14:43:09 +0800 +Subject: net/smc: Stop the CLC flow if no link to map buffers on + +From: Wen Gu + +[ Upstream commit e738455b2c6dcdab03e45d97de36476f93f557d2 ] + +There might be a potential race between SMC-R buffer map and +link group termination. + +smc_smcr_terminate_all() | smc_connect_rdma() +-------------------------------------------------------------- + | smc_conn_create() +for links in smcibdev | + schedule links down | + | smc_buf_create() + | \- smcr_buf_map_usable_links() + | \- no usable links found, + | (rmb->mr = NULL) + | + | smc_clc_send_confirm() + | \- access conn->rmb_desc->mr[]->rkey + | (panic) + +During reboot and IB device module remove, all links will be set +down and no usable links remain in link groups. In such situation +smcr_buf_map_usable_links() should return an error and stop the +CLC flow accessing to uninitialized mr. + +Fixes: b9247544c1bc ("net/smc: convert static link ID instances to support multiple links") +Signed-off-by: Wen Gu +Link: https://lore.kernel.org/r/1663656189-32090-1-git-send-email-guwen@linux.alibaba.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/smc/smc_core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index 1f3bb1f6b1f7..8095876b66eb 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -2148,7 +2148,7 @@ static struct smc_buf_desc *smcr_new_buf_create(struct smc_link_group *lgr, + static int smcr_buf_map_usable_links(struct smc_link_group *lgr, + struct smc_buf_desc *buf_desc, bool is_rmb) + { +- int i, rc = 0; ++ int i, rc = 0, cnt = 0; + + /* protect against parallel link reconfiguration */ + mutex_lock(&lgr->llc_conf_mutex); +@@ -2161,9 +2161,12 @@ static int smcr_buf_map_usable_links(struct smc_link_group *lgr, + rc = -ENOMEM; + goto out; + } ++ cnt++; + } + out: + mutex_unlock(&lgr->llc_conf_mutex); ++ if (!rc && !cnt) ++ rc = -EINVAL; + return rc; + } + +-- +2.35.1 + diff --git a/queue-5.19/net-sunhme-fix-packet-reception-for-len-rx_copy_thre.patch b/queue-5.19/net-sunhme-fix-packet-reception-for-len-rx_copy_thre.patch new file mode 100644 index 00000000000..373603cf481 --- /dev/null +++ b/queue-5.19/net-sunhme-fix-packet-reception-for-len-rx_copy_thre.patch @@ -0,0 +1,58 @@ +From 94731a9d7fbf9ee07e545a9d38cfbd15b9cb69e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Sep 2022 19:50:18 -0400 +Subject: net: sunhme: Fix packet reception for len < RX_COPY_THRESHOLD + +From: Sean Anderson + +[ Upstream commit 878e2405710aacfeeb19364c300f38b7a9abfe8f ] + +There is a separate receive path for small packets (under 256 bytes). +Instead of allocating a new dma-capable skb to be used for the next packet, +this path allocates a skb and copies the data into it (reusing the existing +sbk for the next packet). There are two bytes of junk data at the beginning +of every packet. I believe these are inserted in order to allow aligned DMA +and IP headers. We skip over them using skb_reserve. Before copying over +the data, we must use a barrier to ensure we see the whole packet. The +current code only synchronizes len bytes, starting from the beginning of +the packet, including the junk bytes. However, this leaves off the final +two bytes in the packet. Synchronize the whole packet. + +To reproduce this problem, ping a HME with a payload size between 17 and +214 + + $ ping -s 17 + +which will complain rather loudly about the data mismatch. Small packets +(below 60 bytes on the wire) do not have this issue. I suspect this is +related to the padding added to increase the minimum packet size. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Sean Anderson +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20220920235018.1675956-1-seanga2@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sun/sunhme.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c +index 8594ee839628..88aa0d310aee 100644 +--- a/drivers/net/ethernet/sun/sunhme.c ++++ b/drivers/net/ethernet/sun/sunhme.c +@@ -2020,9 +2020,9 @@ static void happy_meal_rx(struct happy_meal *hp, struct net_device *dev) + + skb_reserve(copy_skb, 2); + skb_put(copy_skb, len); +- dma_sync_single_for_cpu(hp->dma_dev, dma_addr, len, DMA_FROM_DEVICE); ++ dma_sync_single_for_cpu(hp->dma_dev, dma_addr, len + 2, DMA_FROM_DEVICE); + skb_copy_from_linear_data(skb, copy_skb->data, len); +- dma_sync_single_for_device(hp->dma_dev, dma_addr, len, DMA_FROM_DEVICE); ++ dma_sync_single_for_device(hp->dma_dev, dma_addr, len + 2, DMA_FROM_DEVICE); + /* Reuse original ring buffer. */ + hme_write_rxd(hp, this, + (RXFLAG_OWN|((RX_BUF_ALLOC_SIZE-RX_OFFSET)<<16)), +-- +2.35.1 + diff --git a/queue-5.19/net-team-unsync-device-addresses-on-ndo_stop.patch b/queue-5.19/net-team-unsync-device-addresses-on-ndo_stop.patch new file mode 100644 index 00000000000..458c3817710 --- /dev/null +++ b/queue-5.19/net-team-unsync-device-addresses-on-ndo_stop.patch @@ -0,0 +1,87 @@ +From 2db06e01b1e4523dcb706e1ed74493da4f98720e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Sep 2022 16:56:41 +0900 +Subject: net: team: Unsync device addresses on ndo_stop + +From: Benjamin Poirier + +[ Upstream commit bd60234222b2fd5573526da7bcd422801f271f5f ] + +Netdev drivers are expected to call dev_{uc,mc}_sync() in their +ndo_set_rx_mode method and dev_{uc,mc}_unsync() in their ndo_stop method. +This is mentioned in the kerneldoc for those dev_* functions. + +The team driver calls dev_{uc,mc}_unsync() during ndo_uninit instead of +ndo_stop. This is ineffective because address lists (dev->{uc,mc}) have +already been emptied in unregister_netdevice_many() before ndo_uninit is +called. This mistake can result in addresses being leftover on former team +ports after a team device has been deleted; see test_LAG_cleanup() in the +last patch in this series. + +Add unsync calls at their expected location, team_close(). + +v3: +* When adding or deleting a port, only sync/unsync addresses if the team + device is up. In other cases, it is taken care of at the right time by + ndo_open/ndo_set_rx_mode/ndo_stop. + +Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device") +Signed-off-by: Benjamin Poirier +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/team/team.c | 24 ++++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index b07dde6f0abf..b9899913d246 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -1275,10 +1275,12 @@ static int team_port_add(struct team *team, struct net_device *port_dev, + } + } + +- netif_addr_lock_bh(dev); +- dev_uc_sync_multiple(port_dev, dev); +- dev_mc_sync_multiple(port_dev, dev); +- netif_addr_unlock_bh(dev); ++ if (dev->flags & IFF_UP) { ++ netif_addr_lock_bh(dev); ++ dev_uc_sync_multiple(port_dev, dev); ++ dev_mc_sync_multiple(port_dev, dev); ++ netif_addr_unlock_bh(dev); ++ } + + port->index = -1; + list_add_tail_rcu(&port->list, &team->port_list); +@@ -1349,8 +1351,10 @@ static int team_port_del(struct team *team, struct net_device *port_dev) + netdev_rx_handler_unregister(port_dev); + team_port_disable_netpoll(port); + vlan_vids_del_by_dev(port_dev, dev); +- dev_uc_unsync(port_dev, dev); +- dev_mc_unsync(port_dev, dev); ++ if (dev->flags & IFF_UP) { ++ dev_uc_unsync(port_dev, dev); ++ dev_mc_unsync(port_dev, dev); ++ } + dev_close(port_dev); + team_port_leave(team, port); + +@@ -1700,6 +1704,14 @@ static int team_open(struct net_device *dev) + + static int team_close(struct net_device *dev) + { ++ struct team *team = netdev_priv(dev); ++ struct team_port *port; ++ ++ list_for_each_entry(port, &team->port_list, list) { ++ dev_uc_unsync(port->dev, dev); ++ dev_mc_unsync(port->dev, dev); ++ } ++ + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.19/netdevsim-fix-hwstats-debugfs-file-permissions.patch b/queue-5.19/netdevsim-fix-hwstats-debugfs-file-permissions.patch new file mode 100644 index 00000000000..91c73244752 --- /dev/null +++ b/queue-5.19/netdevsim-fix-hwstats-debugfs-file-permissions.patch @@ -0,0 +1,59 @@ +From 4d8316124eaac97725e640df24c1360596d2862e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Sep 2022 18:38:30 +0300 +Subject: netdevsim: Fix hwstats debugfs file permissions + +From: Ido Schimmel + +[ Upstream commit 34513ada53eb3e3f711250d8dbc2de4de493d510 ] + +The hwstats debugfs files are only writeable, but they are created with +read and write permissions, causing certain selftests to fail [1]. + +Fix by creating the files with write permission only. + +[1] + # ./test_offload.py + Test destruction of generic XDP... + Traceback (most recent call last): + File "/home/idosch/code/linux/tools/testing/selftests/bpf/./test_offload.py", line 810, in + simdev = NetdevSimDev() + [...] + Exception: Command failed: cat /sys/kernel/debug/netdevsim/netdevsim0//ports/0/dev/hwstats/l3/disable_ifindex + + cat: /sys/kernel/debug/netdevsim/netdevsim0//ports/0/dev/hwstats/l3/disable_ifindex: Invalid argument + +Fixes: 1a6d7ae7d63c ("netdevsim: Introduce support for L3 offload xstats") +Reported-by: Jie2x Zhou +Tested-by: Jie2x Zhou +Signed-off-by: Ido Schimmel +Reviewed-by: Petr Machata +Link: https://lore.kernel.org/r/20220909153830.3732504-1-idosch@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/netdevsim/hwstats.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/netdevsim/hwstats.c b/drivers/net/netdevsim/hwstats.c +index 605a38e16db0..0e58aa7f0374 100644 +--- a/drivers/net/netdevsim/hwstats.c ++++ b/drivers/net/netdevsim/hwstats.c +@@ -433,11 +433,11 @@ int nsim_dev_hwstats_init(struct nsim_dev *nsim_dev) + goto err_remove_hwstats_recursive; + } + +- debugfs_create_file("enable_ifindex", 0600, hwstats->l3_ddir, hwstats, ++ debugfs_create_file("enable_ifindex", 0200, hwstats->l3_ddir, hwstats, + &nsim_dev_hwstats_l3_enable_fops.fops); +- debugfs_create_file("disable_ifindex", 0600, hwstats->l3_ddir, hwstats, ++ debugfs_create_file("disable_ifindex", 0200, hwstats->l3_ddir, hwstats, + &nsim_dev_hwstats_l3_disable_fops.fops); +- debugfs_create_file("fail_next_enable", 0600, hwstats->l3_ddir, hwstats, ++ debugfs_create_file("fail_next_enable", 0200, hwstats->l3_ddir, hwstats, + &nsim_dev_hwstats_l3_fail_fops.fops); + + INIT_DELAYED_WORK(&hwstats->traffic_dw, +-- +2.35.1 + diff --git a/queue-5.19/netfilter-ebtables-fix-memory-leak-when-blob-is-malf.patch b/queue-5.19/netfilter-ebtables-fix-memory-leak-when-blob-is-malf.patch new file mode 100644 index 00000000000..4642ae0f256 --- /dev/null +++ b/queue-5.19/netfilter-ebtables-fix-memory-leak-when-blob-is-malf.patch @@ -0,0 +1,40 @@ +From 6523a5511679e0dd678ebadda3919398cfec564e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Sep 2022 14:20:17 +0200 +Subject: netfilter: ebtables: fix memory leak when blob is malformed + +From: Florian Westphal + +[ Upstream commit 62ce44c4fff947eebdf10bb582267e686e6835c9 ] + +The bug fix was incomplete, it "replaced" crash with a memory leak. +The old code had an assignment to "ret" embedded into the conditional, +restore this. + +Fixes: 7997eff82828 ("netfilter: ebtables: reject blobs that don't provide all entry points") +Reported-and-tested-by: syzbot+a24c5252f3e3ab733464@syzkaller.appspotmail.com +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/bridge/netfilter/ebtables.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index 9a0ae59cdc50..4f385d52a1c4 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -1040,8 +1040,10 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl, + goto free_iterate; + } + +- if (repl->valid_hooks != t->valid_hooks) ++ if (repl->valid_hooks != t->valid_hooks) { ++ ret = -EINVAL; + goto free_unlock; ++ } + + if (repl->num_counters && repl->num_counters != t->private->nentries) { + ret = -EINVAL; +-- +2.35.1 + diff --git a/queue-5.19/netfilter-nf_conntrack_irc-tighten-matching-on-dcc-m.patch b/queue-5.19/netfilter-nf_conntrack_irc-tighten-matching-on-dcc-m.patch new file mode 100644 index 00000000000..5aa9c9fc435 --- /dev/null +++ b/queue-5.19/netfilter-nf_conntrack_irc-tighten-matching-on-dcc-m.patch @@ -0,0 +1,84 @@ +From 5f70393c6dd2ded446baece9cba5cb2527c08cc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 14:56:57 +1000 +Subject: netfilter: nf_conntrack_irc: Tighten matching on DCC message + +From: David Leadbeater + +[ Upstream commit e8d5dfd1d8747b56077d02664a8838c71ced948e ] + +CTCP messages should only be at the start of an IRC message, not +anywhere within it. + +While the helper only decodes packes in the ORIGINAL direction, its +possible to make a client send a CTCP message back by empedding one into +a PING request. As-is, thats enough to make the helper believe that it +saw a CTCP message. + +Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port") +Signed-off-by: David Leadbeater +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_irc.c | 34 ++++++++++++++++++++++++++------ + 1 file changed, 28 insertions(+), 6 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c +index 992decbcaa5c..5703846bea3b 100644 +--- a/net/netfilter/nf_conntrack_irc.c ++++ b/net/netfilter/nf_conntrack_irc.c +@@ -157,15 +157,37 @@ static int help(struct sk_buff *skb, unsigned int protoff, + data = ib_ptr; + data_limit = ib_ptr + datalen; + +- /* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24 +- * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */ +- while (data < data_limit - (19 + MINMATCHLEN)) { +- if (memcmp(data, "\1DCC ", 5)) { ++ /* Skip any whitespace */ ++ while (data < data_limit - 10) { ++ if (*data == ' ' || *data == '\r' || *data == '\n') ++ data++; ++ else ++ break; ++ } ++ ++ /* strlen("PRIVMSG x ")=10 */ ++ if (data < data_limit - 10) { ++ if (strncasecmp("PRIVMSG ", data, 8)) ++ goto out; ++ data += 8; ++ } ++ ++ /* strlen(" :\1DCC SENT t AAAAAAAA P\1\n")=26 ++ * 7+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=26 ++ */ ++ while (data < data_limit - (21 + MINMATCHLEN)) { ++ /* Find first " :", the start of message */ ++ if (memcmp(data, " :", 2)) { + data++; + continue; + } ++ data += 2; ++ ++ /* then check that place only for the DCC command */ ++ if (memcmp(data, "\1DCC ", 5)) ++ goto out; + data += 5; +- /* we have at least (19+MINMATCHLEN)-5 bytes valid data left */ ++ /* we have at least (21+MINMATCHLEN)-(2+5) bytes valid data left */ + + iph = ip_hdr(skb); + pr_debug("DCC found in master %pI4:%u %pI4:%u\n", +@@ -181,7 +203,7 @@ static int help(struct sk_buff *skb, unsigned int protoff, + pr_debug("DCC %s detected\n", dccprotos[i]); + + /* we have at least +- * (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid ++ * (21+MINMATCHLEN)-7-dccprotos[i].matchlen bytes valid + * data left (== 14/13 bytes) */ + if (parse_dcc(data, data_limit, &dcc_ip, + &dcc_port, &addr_beg_p, &addr_end_p)) { +-- +2.35.1 + diff --git a/queue-5.19/netfilter-nf_conntrack_sip-fix-ct_sip_walk_headers.patch b/queue-5.19/netfilter-nf_conntrack_sip-fix-ct_sip_walk_headers.patch new file mode 100644 index 00000000000..898b538e4de --- /dev/null +++ b/queue-5.19/netfilter-nf_conntrack_sip-fix-ct_sip_walk_headers.patch @@ -0,0 +1,60 @@ +From 55d4d6dee55b292454329cb15836fe74788acf2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jun 2019 12:32:40 +0300 +Subject: netfilter: nf_conntrack_sip: fix ct_sip_walk_headers + +From: Igor Ryzhov + +[ Upstream commit 39aebedeaaa95757f5c1f2ddb5f43fdddbf478ca ] + +ct_sip_next_header and ct_sip_get_header return an absolute +value of matchoff, not a shift from current dataoff. +So dataoff should be assigned matchoff, not incremented by it. + +This issue can be seen in the scenario when there are multiple +Contact headers and the first one is using a hostname and other headers +use IP addresses. In this case, ct_sip_walk_headers will work as follows: + +The first ct_sip_get_header call to will find the first Contact header +but will return -1 as the header uses a hostname. But matchoff will +be changed to the offset of this header. After that, dataoff should be +set to matchoff, so that the next ct_sip_get_header call find the next +Contact header. But instead of assigning dataoff to matchoff, it is +incremented by it, which is not correct, as matchoff is an absolute +value of the offset. So on the next call to the ct_sip_get_header, +dataoff will be incorrect, and the next Contact header may not be +found at all. + +Fixes: 05e3ced297fe ("[NETFILTER]: nf_conntrack_sip: introduce SIP-URI parsing helper") +Signed-off-by: Igor Ryzhov +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_sip.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c +index b83dc9bf0a5d..78fd9122b70c 100644 +--- a/net/netfilter/nf_conntrack_sip.c ++++ b/net/netfilter/nf_conntrack_sip.c +@@ -477,7 +477,7 @@ static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr, + return ret; + if (ret == 0) + break; +- dataoff += *matchoff; ++ dataoff = *matchoff; + } + *in_header = 0; + } +@@ -489,7 +489,7 @@ static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr, + break; + if (ret == 0) + return ret; +- dataoff += *matchoff; ++ dataoff = *matchoff; + } + + if (in_header) +-- +2.35.1 + diff --git a/queue-5.19/netfilter-nf_ct_ftp-fix-deadlock-when-nat-rewrite-is.patch b/queue-5.19/netfilter-nf_ct_ftp-fix-deadlock-when-nat-rewrite-is.patch new file mode 100644 index 00000000000..7b408c6a1c7 --- /dev/null +++ b/queue-5.19/netfilter-nf_ct_ftp-fix-deadlock-when-nat-rewrite-is.patch @@ -0,0 +1,57 @@ +From 7d90fcc08d32bb86d334281dc6bff7d49cf8eef4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Sep 2022 18:31:30 +0200 +Subject: netfilter: nf_ct_ftp: fix deadlock when nat rewrite is needed + +From: Florian Westphal + +[ Upstream commit d25088932227680988a6b794221e031a7232f137 ] + +We can't use ct->lock, this is already used by the seqadj internals. +When using ftp helper + nat, seqadj will attempt to acquire ct->lock +again. + +Revert back to a global lock for now. + +Fixes: c783a29c7e59 ("netfilter: nf_ct_ftp: prefer skb_linearize") +Reported-by: Bruno de Paula Larini +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_ftp.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c +index 0d9332e9cf71..617f744a2e3a 100644 +--- a/net/netfilter/nf_conntrack_ftp.c ++++ b/net/netfilter/nf_conntrack_ftp.c +@@ -33,6 +33,7 @@ MODULE_AUTHOR("Rusty Russell "); + MODULE_DESCRIPTION("ftp connection tracking helper"); + MODULE_ALIAS("ip_conntrack_ftp"); + MODULE_ALIAS_NFCT_HELPER(HELPER_NAME); ++static DEFINE_SPINLOCK(nf_ftp_lock); + + #define MAX_PORTS 8 + static u_int16_t ports[MAX_PORTS]; +@@ -409,7 +410,8 @@ static int help(struct sk_buff *skb, + } + datalen = skb->len - dataoff; + +- spin_lock_bh(&ct->lock); ++ /* seqadj (nat) uses ct->lock internally, nf_nat_ftp would cause deadlock */ ++ spin_lock_bh(&nf_ftp_lock); + fb_ptr = skb->data + dataoff; + + ends_in_nl = (fb_ptr[datalen - 1] == '\n'); +@@ -538,7 +540,7 @@ static int help(struct sk_buff *skb, + if (ends_in_nl) + update_nl_seq(ct, seq, ct_ftp_info, dir, skb); + out: +- spin_unlock_bh(&ct->lock); ++ spin_unlock_bh(&nf_ftp_lock); + return ret; + } + +-- +2.35.1 + diff --git a/queue-5.19/netfilter-nf_tables-fix-nft_counters_enabled-underfl.patch b/queue-5.19/netfilter-nf_tables-fix-nft_counters_enabled-underfl.patch new file mode 100644 index 00000000000..cbda76ade6a --- /dev/null +++ b/queue-5.19/netfilter-nf_tables-fix-nft_counters_enabled-underfl.patch @@ -0,0 +1,73 @@ +From 6c5233b604827faf13f49a10e77f2102d68d8088 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Sep 2022 21:41:00 +0900 +Subject: netfilter: nf_tables: fix nft_counters_enabled underflow at + nf_tables_addchain() + +From: Tetsuo Handa + +[ Upstream commit 921ebde3c0d22c8cba74ce8eb3cc4626abff1ccd ] + +syzbot is reporting underflow of nft_counters_enabled counter at +nf_tables_addchain() [1], for commit 43eb8949cfdffa76 ("netfilter: +nf_tables: do not leave chain stats enabled on error") missed that +nf_tables_chain_destroy() after nft_basechain_init() in the error path of +nf_tables_addchain() decrements the counter because nft_basechain_init() +makes nft_is_base_chain() return true by setting NFT_CHAIN_BASE flag. + +Increment the counter immediately after returning from +nft_basechain_init(). + +Link: https://syzkaller.appspot.com/bug?extid=b5d82a651b71cd8a75ab [1] +Reported-by: syzbot +Signed-off-by: Tetsuo Handa +Tested-by: syzbot +Fixes: 43eb8949cfdffa76 ("netfilter: nf_tables: do not leave chain stats enabled on error") +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 848cc81d6992..3aaf36df69d4 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -2197,7 +2197,6 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, + struct netlink_ext_ack *extack) + { + const struct nlattr * const *nla = ctx->nla; +- struct nft_stats __percpu *stats = NULL; + struct nft_table *table = ctx->table; + struct nft_base_chain *basechain; + struct net *net = ctx->net; +@@ -2212,6 +2211,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, + return -EOVERFLOW; + + if (nla[NFTA_CHAIN_HOOK]) { ++ struct nft_stats __percpu *stats = NULL; + struct nft_chain_hook hook; + + if (flags & NFT_CHAIN_BINDING) +@@ -2245,6 +2245,8 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, + kfree(basechain); + return err; + } ++ if (stats) ++ static_branch_inc(&nft_counters_enabled); + } else { + if (flags & NFT_CHAIN_BASE) + return -EINVAL; +@@ -2319,9 +2321,6 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, + goto err_unregister_hook; + } + +- if (stats) +- static_branch_inc(&nft_counters_enabled); +- + table->use++; + + return 0; +-- +2.35.1 + diff --git a/queue-5.19/netfilter-nf_tables-fix-percpu-memory-leak-at-nf_tab.patch b/queue-5.19/netfilter-nf_tables-fix-percpu-memory-leak-at-nf_tab.patch new file mode 100644 index 00000000000..c29a50ae6c6 --- /dev/null +++ b/queue-5.19/netfilter-nf_tables-fix-percpu-memory-leak-at-nf_tab.patch @@ -0,0 +1,36 @@ +From b59538445bd9ddeda26c08c4acd33c8e43bc721c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Sep 2022 22:58:51 +0900 +Subject: netfilter: nf_tables: fix percpu memory leak at nf_tables_addchain() + +From: Tetsuo Handa + +[ Upstream commit 9a4d6dd554b86e65581ef6b6638a39ae079b17ac ] + +It seems to me that percpu memory for chain stats started leaking since +commit 3bc158f8d0330f0a ("netfilter: nf_tables: map basechain priority to +hardware priority") when nft_chain_offload_priority() returned an error. + +Signed-off-by: Tetsuo Handa +Fixes: 3bc158f8d0330f0a ("netfilter: nf_tables: map basechain priority to hardware priority") +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 3aaf36df69d4..2fde193c3d26 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -2243,6 +2243,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, + if (err < 0) { + nft_chain_release_hook(&hook); + kfree(basechain); ++ free_percpu(stats); + return err; + } + if (stats) +-- +2.35.1 + diff --git a/queue-5.19/netfilter-nfnetlink_osf-fix-possible-bogus-match-in-.patch b/queue-5.19/netfilter-nfnetlink_osf-fix-possible-bogus-match-in-.patch new file mode 100644 index 00000000000..585c189eba8 --- /dev/null +++ b/queue-5.19/netfilter-nfnetlink_osf-fix-possible-bogus-match-in-.patch @@ -0,0 +1,49 @@ +From 4b5111d1f9b10a13846ada30ea74bfc7ae45ad15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Sep 2022 10:26:18 +0200 +Subject: netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() + +From: Pablo Neira Ayuso + +[ Upstream commit 559c36c5a8d730c49ef805a72b213d3bba155cc8 ] + +nf_osf_find() incorrectly returns true on mismatch, this leads to +copying uninitialized memory area in nft_osf which can be used to leak +stale kernel stack data to userspace. + +Fixes: 22c7652cdaa8 ("netfilter: nft_osf: Add version option support") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nfnetlink_osf.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c +index 0fa2e2030427..ee6840bd5933 100644 +--- a/net/netfilter/nfnetlink_osf.c ++++ b/net/netfilter/nfnetlink_osf.c +@@ -269,6 +269,7 @@ bool nf_osf_find(const struct sk_buff *skb, + struct nf_osf_hdr_ctx ctx; + const struct tcphdr *tcp; + struct tcphdr _tcph; ++ bool found = false; + + memset(&ctx, 0, sizeof(ctx)); + +@@ -283,10 +284,11 @@ bool nf_osf_find(const struct sk_buff *skb, + + data->genre = f->genre; + data->version = f->version; ++ found = true; + break; + } + +- return true; ++ return found; + } + EXPORT_SYMBOL_GPL(nf_osf_find); + +-- +2.35.1 + diff --git a/queue-5.19/of-mdio-add-of_node_put-when-breaking-out-of-for_eac.patch b/queue-5.19/of-mdio-add-of_node_put-when-breaking-out-of-for_eac.patch new file mode 100644 index 00000000000..eedb73756c8 --- /dev/null +++ b/queue-5.19/of-mdio-add-of_node_put-when-breaking-out-of-for_eac.patch @@ -0,0 +1,38 @@ +From c50431f101740e8a5aaa5e1c6860487e1950bbd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Sep 2022 20:56:59 +0800 +Subject: of: mdio: Add of_node_put() when breaking out of for_each_xx + +From: Liang He + +[ Upstream commit 1c48709e6d9d353acaaac1d8e33474756b121d78 ] + +In of_mdiobus_register(), we should call of_node_put() for 'child' +escaped out of for_each_available_child_of_node(). + +Fixes: 66bdede495c7 ("of_mdio: Fix broken PHY IRQ in case of probe deferral") +Co-developed-by: Miaoqian Lin +Signed-off-by: Miaoqian Lin +Signed-off-by: Liang He +Link: https://lore.kernel.org/r/20220913125659.3331969-1-windhl@126.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/mdio/of_mdio.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/mdio/of_mdio.c b/drivers/net/mdio/of_mdio.c +index 9e3c815a070f..796e9c7857d0 100644 +--- a/drivers/net/mdio/of_mdio.c ++++ b/drivers/net/mdio/of_mdio.c +@@ -231,6 +231,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np) + return 0; + + unregister: ++ of_node_put(child); + mdiobus_unregister(mdio); + return rc; + } +-- +2.35.1 + diff --git a/queue-5.19/perf-jit-include-program-header-in-elf-files.patch b/queue-5.19/perf-jit-include-program-header-in-elf-files.patch new file mode 100644 index 00000000000..1fd6769e39c --- /dev/null +++ b/queue-5.19/perf-jit-include-program-header-in-elf-files.patch @@ -0,0 +1,86 @@ +From 0bbb6bb72cbcaaff2f4fbf831c67714564da6cd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Sep 2022 11:29:10 +0200 +Subject: perf jit: Include program header in ELF files + +From: Lieven Hey + +[ Upstream commit babd04386b1df8c364cdaa39ac0e54349502e1e5 ] + +The missing header makes it hard for programs like elfutils to open +these files. + +Fixes: 2d86612aacb7805f ("perf symbol: Correct address for bss symbols") +Reviewed-by: Leo Yan +Signed-off-by: Lieven Hey +Tested-by: Leo Yan +Cc: Leo Yan +Link: https://lore.kernel.org/r/20220915092910.711036-1-lieven.hey@kdab.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/genelf.c | 14 ++++++++++++++ + tools/perf/util/genelf.h | 4 ++++ + 2 files changed, 18 insertions(+) + +diff --git a/tools/perf/util/genelf.c b/tools/perf/util/genelf.c +index 953338b9e887..02cd9f75e3d2 100644 +--- a/tools/perf/util/genelf.c ++++ b/tools/perf/util/genelf.c +@@ -251,6 +251,7 @@ jit_write_elf(int fd, uint64_t load_addr, const char *sym, + Elf_Data *d; + Elf_Scn *scn; + Elf_Ehdr *ehdr; ++ Elf_Phdr *phdr; + Elf_Shdr *shdr; + uint64_t eh_frame_base_offset; + char *strsym = NULL; +@@ -285,6 +286,19 @@ jit_write_elf(int fd, uint64_t load_addr, const char *sym, + ehdr->e_version = EV_CURRENT; + ehdr->e_shstrndx= unwinding ? 4 : 2; /* shdr index for section name */ + ++ /* ++ * setup program header ++ */ ++ phdr = elf_newphdr(e, 1); ++ phdr[0].p_type = PT_LOAD; ++ phdr[0].p_offset = 0; ++ phdr[0].p_vaddr = 0; ++ phdr[0].p_paddr = 0; ++ phdr[0].p_filesz = csize; ++ phdr[0].p_memsz = csize; ++ phdr[0].p_flags = PF_X | PF_R; ++ phdr[0].p_align = 8; ++ + /* + * setup text section + */ +diff --git a/tools/perf/util/genelf.h b/tools/perf/util/genelf.h +index ae138afe6c56..b5c909546e3f 100644 +--- a/tools/perf/util/genelf.h ++++ b/tools/perf/util/genelf.h +@@ -53,8 +53,10 @@ int jit_add_debug_info(Elf *e, uint64_t code_addr, void *debug, int nr_debug_ent + + #if GEN_ELF_CLASS == ELFCLASS64 + #define elf_newehdr elf64_newehdr ++#define elf_newphdr elf64_newphdr + #define elf_getshdr elf64_getshdr + #define Elf_Ehdr Elf64_Ehdr ++#define Elf_Phdr Elf64_Phdr + #define Elf_Shdr Elf64_Shdr + #define Elf_Sym Elf64_Sym + #define ELF_ST_TYPE(a) ELF64_ST_TYPE(a) +@@ -62,8 +64,10 @@ int jit_add_debug_info(Elf *e, uint64_t code_addr, void *debug, int nr_debug_ent + #define ELF_ST_VIS(a) ELF64_ST_VISIBILITY(a) + #else + #define elf_newehdr elf32_newehdr ++#define elf_newphdr elf32_newphdr + #define elf_getshdr elf32_getshdr + #define Elf_Ehdr Elf32_Ehdr ++#define Elf_Phdr Elf32_Phdr + #define Elf_Shdr Elf32_Shdr + #define Elf_Sym Elf32_Sym + #define ELF_ST_TYPE(a) ELF32_ST_TYPE(a) +-- +2.35.1 + diff --git a/queue-5.19/perf-kcore_copy-do-not-check-proc-modules-is-unchang.patch b/queue-5.19/perf-kcore_copy-do-not-check-proc-modules-is-unchang.patch new file mode 100644 index 00000000000..15d2163a316 --- /dev/null +++ b/queue-5.19/perf-kcore_copy-do-not-check-proc-modules-is-unchang.patch @@ -0,0 +1,62 @@ +From 0a6ac51539e72798e2bc38eae66a3959c7e11e44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Sep 2022 15:24:29 +0300 +Subject: perf kcore_copy: Do not check /proc/modules is unchanged + +From: Adrian Hunter + +[ Upstream commit 5b427df27b94aec1312cace48a746782a0925c53 ] + +/proc/kallsyms and /proc/modules are compared before and after the copy +in order to ensure no changes during the copy. + +However /proc/modules also might change due to reference counts changing +even though that does not make any difference. + +Any modules loaded or unloaded should be visible in changes to kallsyms, +so it is not necessary to check /proc/modules also anyway. + +Remove the comparison checking that /proc/modules is unchanged. + +Fixes: fc1b691d7651d949 ("perf buildid-cache: Add ability to add kcore to the cache") +Reported-by: Daniel Dao +Signed-off-by: Adrian Hunter +Tested-by: Daniel Dao +Acked-by: Namhyung Kim +Cc: Ian Rogers +Cc: Jiri Olsa +Link: https://lore.kernel.org/r/20220914122429.8770-1-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/symbol-elf.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c +index 75bec32d4f57..647b7dff8ef3 100644 +--- a/tools/perf/util/symbol-elf.c ++++ b/tools/perf/util/symbol-elf.c +@@ -2102,8 +2102,8 @@ static int kcore_copy__compare_file(const char *from_dir, const char *to_dir, + * unusual. One significant peculiarity is that the mapping (start -> pgoff) + * is not the same for the kernel map and the modules map. That happens because + * the data is copied adjacently whereas the original kcore has gaps. Finally, +- * kallsyms and modules files are compared with their copies to check that +- * modules have not been loaded or unloaded while the copies were taking place. ++ * kallsyms file is compared with its copy to check that modules have not been ++ * loaded or unloaded while the copies were taking place. + * + * Return: %0 on success, %-1 on failure. + */ +@@ -2166,9 +2166,6 @@ int kcore_copy(const char *from_dir, const char *to_dir) + goto out_extract_close; + } + +- if (kcore_copy__compare_file(from_dir, to_dir, "modules")) +- goto out_extract_close; +- + if (kcore_copy__compare_file(from_dir, to_dir, "kallsyms")) + goto out_extract_close; + +-- +2.35.1 + diff --git a/queue-5.19/perf-stat-fix-bpf-program-section-name.patch b/queue-5.19/perf-stat-fix-bpf-program-section-name.patch new file mode 100644 index 00000000000..50ee5ccd0dc --- /dev/null +++ b/queue-5.19/perf-stat-fix-bpf-program-section-name.patch @@ -0,0 +1,56 @@ +From e9f5d5728d626d9929bd1266be384e2e5897d923 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Sep 2022 11:41:29 -0700 +Subject: perf stat: Fix BPF program section name + +From: Namhyung Kim + +[ Upstream commit 0d77326c3369e255715ed2440a78894ccc98dd69 ] + +It seems the recent libbpf got more strict about the section name. +I'm seeing a failure like this: + + $ sudo ./perf stat -a --bpf-counters --for-each-cgroup ^. sleep 1 + libbpf: prog 'on_cgrp_switch': missing BPF prog type, check ELF section name 'perf_events' + libbpf: prog 'on_cgrp_switch': failed to load: -22 + libbpf: failed to load object 'bperf_cgroup_bpf' + libbpf: failed to load BPF skeleton 'bperf_cgroup_bpf': -22 + Failed to load cgroup skeleton + +The section name should be 'perf_event' (without the trailing 's'). +Although it's related to the libbpf change, it'd be better fix the +section name in the first place. + +Fixes: 944138f048f7d759 ("perf stat: Enable BPF counter with --for-each-cgroup") +Signed-off-by: Namhyung Kim +Cc: Adrian Hunter +Cc: bpf@vger.kernel.org +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Song Liu +Link: https://lore.kernel.org/r/20220916184132.1161506-2-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf_skel/bperf_cgroup.bpf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/bpf_skel/bperf_cgroup.bpf.c b/tools/perf/util/bpf_skel/bperf_cgroup.bpf.c +index 292c430768b5..c72f8ad96f75 100644 +--- a/tools/perf/util/bpf_skel/bperf_cgroup.bpf.c ++++ b/tools/perf/util/bpf_skel/bperf_cgroup.bpf.c +@@ -176,7 +176,7 @@ static int bperf_cgroup_count(void) + } + + // This will be attached to cgroup-switches event for each cpu +-SEC("perf_events") ++SEC("perf_event") + int BPF_PROG(on_cgrp_switch) + { + return bperf_cgroup_count(); +-- +2.35.1 + diff --git a/queue-5.19/perf-stat-fix-cpu-map-index-in-bperf-cgroup-code.patch b/queue-5.19/perf-stat-fix-cpu-map-index-in-bperf-cgroup-code.patch new file mode 100644 index 00000000000..8c55a398447 --- /dev/null +++ b/queue-5.19/perf-stat-fix-cpu-map-index-in-bperf-cgroup-code.patch @@ -0,0 +1,61 @@ +From cb5fa8aa0b659cb58efc7fe287cf4f3b79b2a1c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Sep 2022 11:41:30 -0700 +Subject: perf stat: Fix cpu map index in bperf cgroup code + +From: Namhyung Kim + +[ Upstream commit 3da35231d9e4949c4ae40e3ce653e7c468455d55 ] + +The previous cpu map introduced a bug in the bperf cgroup counter. This +results in a failure when user gives a partial cpu map starting from +non-zero. + + $ sudo ./perf stat -C 1-2 --bpf-counters --for-each-cgroup ^. sleep 1 + libbpf: prog 'on_cgrp_switch': failed to create BPF link for perf_event FD 0: + -9 (Bad file descriptor) + Failed to attach cgroup program + +To get the FD of an evsel, it should use a map index not the CPU number. + +Fixes: 0255571a16059c8e ("perf cpumap: Switch to using perf_cpu_map API") +Signed-off-by: Namhyung Kim +Cc: Adrian Hunter +Cc: bpf@vger.kernel.org +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Peter Zijlstra +Cc: Song Liu +Link: https://lore.kernel.org/r/20220916184132.1161506-3-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf_counter_cgroup.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/bpf_counter_cgroup.c b/tools/perf/util/bpf_counter_cgroup.c +index 63b9db657442..97c69a249c6e 100644 +--- a/tools/perf/util/bpf_counter_cgroup.c ++++ b/tools/perf/util/bpf_counter_cgroup.c +@@ -95,7 +95,7 @@ static int bperf_load_program(struct evlist *evlist) + + perf_cpu_map__for_each_cpu(cpu, i, evlist->core.all_cpus) { + link = bpf_program__attach_perf_event(skel->progs.on_cgrp_switch, +- FD(cgrp_switch, cpu.cpu)); ++ FD(cgrp_switch, i)); + if (IS_ERR(link)) { + pr_err("Failed to attach cgroup program\n"); + err = PTR_ERR(link); +@@ -123,7 +123,7 @@ static int bperf_load_program(struct evlist *evlist) + + map_fd = bpf_map__fd(skel->maps.events); + perf_cpu_map__for_each_cpu(cpu, j, evlist->core.all_cpus) { +- int fd = FD(evsel, cpu.cpu); ++ int fd = FD(evsel, j); + __u32 idx = evsel->core.idx * total_cpus + cpu.cpu; + + err = bpf_map_update_elem(map_fd, &idx, &fd, +-- +2.35.1 + diff --git a/queue-5.19/perf-tools-honor-namespace-when-synthesizing-build-i.patch b/queue-5.19/perf-tools-honor-namespace-when-synthesizing-build-i.patch new file mode 100644 index 00000000000..9bcb1ef4d18 --- /dev/null +++ b/queue-5.19/perf-tools-honor-namespace-when-synthesizing-build-i.patch @@ -0,0 +1,59 @@ +From 116650901432b738ca761a876071ffa0a4b54073 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Sep 2022 15:28:21 -0700 +Subject: perf tools: Honor namespace when synthesizing build-ids + +From: Namhyung Kim + +[ Upstream commit 999e4eaa4b3691acf85d094836260ec4b66c74fd ] + +It needs to enter the namespace before reading a file. + +Fixes: 4183a8d70a288627 ("perf tools: Allow synthesizing the build id for kernel/modules/tasks in PERF_RECORD_MMAP2") +Signed-off-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Peter Zijlstra +Link: http://lore.kernel.org/lkml/20220920222822.2171056-1-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/synthetic-events.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c +index 84d17bd4efae..64e273b2b1b2 100644 +--- a/tools/perf/util/synthetic-events.c ++++ b/tools/perf/util/synthetic-events.c +@@ -367,13 +367,24 @@ static void perf_record_mmap2__read_build_id(struct perf_record_mmap2 *event, + bool is_kernel) + { + struct build_id bid; ++ struct nsinfo *nsi; ++ struct nscookie nc; + int rc; + +- if (is_kernel) ++ if (is_kernel) { + rc = sysfs__read_build_id("/sys/kernel/notes", &bid); +- else +- rc = filename__read_build_id(event->filename, &bid) > 0 ? 0 : -1; ++ goto out; ++ } ++ ++ nsi = nsinfo__new(event->pid); ++ nsinfo__mountns_enter(nsi, &nc); + ++ rc = filename__read_build_id(event->filename, &bid) > 0 ? 0 : -1; ++ ++ nsinfo__mountns_exit(&nc); ++ nsinfo__put(nsi); ++ ++out: + if (rc == 0) { + memcpy(event->build_id, bid.data, sizeof(bid.data)); + event->build_id_size = (u8) bid.size; +-- +2.35.1 + diff --git a/queue-5.19/scsi-mpt3sas-fix-return-value-check-of-dma_get_requi.patch b/queue-5.19/scsi-mpt3sas-fix-return-value-check-of-dma_get_requi.patch new file mode 100644 index 00000000000..e746d637047 --- /dev/null +++ b/queue-5.19/scsi-mpt3sas-fix-return-value-check-of-dma_get_requi.patch @@ -0,0 +1,37 @@ +From f47119c773eb8be204190d3ee35ae1fce4e4d9f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Sep 2022 17:35:38 +0530 +Subject: scsi: mpt3sas: Fix return value check of dma_get_required_mask() + +From: Sreekanth Reddy + +[ Upstream commit e0e0747de0ea3dd87cdbb0393311e17471a9baf1 ] + +Fix the incorrect return value check of dma_get_required_mask(). Due to +this incorrect check, the driver was always setting the DMA mask to 63 bit. + +Link: https://lore.kernel.org/r/20220913120538.18759-2-sreekanth.reddy@broadcom.com +Fixes: ba27c5cf286d ("scsi: mpt3sas: Don't change the DMA coherent mask after allocations") +Signed-off-by: Sreekanth Reddy +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 9a1ae52bb621..a6d3471a6105 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -2993,7 +2993,7 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) + + if (ioc->is_mcpu_endpoint || + sizeof(dma_addr_t) == 4 || ioc->use_32bit_dma || +- dma_get_required_mask(&pdev->dev) <= 32) ++ dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) + ioc->dma_mask = 32; + /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ + else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) +-- +2.35.1 + diff --git a/queue-5.19/scsi-qla2xxx-fix-memory-leak-in-__qlt_24xx_handle_ab.patch b/queue-5.19/scsi-qla2xxx-fix-memory-leak-in-__qlt_24xx_handle_ab.patch new file mode 100644 index 00000000000..4d41b3c97bd --- /dev/null +++ b/queue-5.19/scsi-qla2xxx-fix-memory-leak-in-__qlt_24xx_handle_ab.patch @@ -0,0 +1,43 @@ +From 2c16b6b534c28f39480f73b720c7b1ade1a6adc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Sep 2022 23:49:24 -0300 +Subject: scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts() + +From: Rafael Mendonca + +[ Upstream commit 601be20fc6a1b762044d2398befffd6bf236cebf ] + +Commit 8f394da36a36 ("scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG") +made the __qlt_24xx_handle_abts() function return early if +tcm_qla2xxx_find_cmd_by_tag() didn't find a command, but it missed to clean +up the allocated memory for the management command. + +Link: https://lore.kernel.org/r/20220914024924.695604-1-rafaelmendsr@gmail.com +Fixes: 8f394da36a36 ("scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG") +Reviewed-by: Himanshu Madhani +Signed-off-by: Rafael Mendonca +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_target.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 62666df1a59e..4acff4e84b90 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -2151,8 +2151,10 @@ static int __qlt_24xx_handle_abts(struct scsi_qla_host *vha, + + abort_cmd = ha->tgt.tgt_ops->find_cmd_by_tag(sess, + le32_to_cpu(abts->exchange_addr_to_abort)); +- if (!abort_cmd) ++ if (!abort_cmd) { ++ mempool_free(mcmd, qla_tgt_mgmt_cmd_mempool); + return -EIO; ++ } + mcmd->unpacked_lun = abort_cmd->se_cmd.orig_fe_lun; + + if (abort_cmd->qpair) { +-- +2.35.1 + diff --git a/queue-5.19/selftests-forwarding-add-shebang-for-sch_red.sh.patch b/queue-5.19/selftests-forwarding-add-shebang-for-sch_red.sh.patch new file mode 100644 index 00000000000..c31046bd853 --- /dev/null +++ b/queue-5.19/selftests-forwarding-add-shebang-for-sch_red.sh.patch @@ -0,0 +1,38 @@ +From 887738992729fd905803c7a3352834afe1957c18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Sep 2022 10:44:53 +0800 +Subject: selftests: forwarding: add shebang for sch_red.sh + +From: Hangbin Liu + +[ Upstream commit 83e4b196838d90799a8879e5054a3beecf9ed256 ] + +RHEL/Fedora RPM build checks are stricter, and complain when executable +files don't have a shebang line, e.g. + +*** WARNING: ./kselftests/net/forwarding/sch_red.sh is executable but has no shebang, removing executable bit + +Fix it by adding shebang line. + +Fixes: 6cf0291f9517 ("selftests: forwarding: Add a RED test for SW datapath") +Signed-off-by: Hangbin Liu +Reviewed-by: Petr Machata +Link: https://lore.kernel.org/r/20220922024453.437757-1-liuhangbin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/forwarding/sch_red.sh | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/net/forwarding/sch_red.sh b/tools/testing/selftests/net/forwarding/sch_red.sh +index e714bae473fb..81f31179ac88 100755 +--- a/tools/testing/selftests/net/forwarding/sch_red.sh ++++ b/tools/testing/selftests/net/forwarding/sch_red.sh +@@ -1,3 +1,4 @@ ++#!/bin/bash + # SPDX-License-Identifier: GPL-2.0 + + # This test sends one stream of traffic from H1 through a TBF shaper, to a RED +-- +2.35.1 + diff --git a/queue-5.19/series b/queue-5.19/series index 67d17af924b..e60c202889c 100644 --- a/queue-5.19/series +++ b/queue-5.19/series @@ -67,3 +67,92 @@ kvm-x86-inject-ud-on-emulated-xsetbv-if-xsaves-isn-t-enabled.patch perf-arm-cmn-add-more-bits-to-child-node-address-offset-field.patch arm64-topology-fix-possible-overflow-in-amu_fie_setup.patch vmlinux.lds.h-cfi-reduce-alignment-of-jump-table-to-function-alignment.patch +batman-adv-fix-hang-up-with-small-mtu-hard-interface.patch +firmware-arm_scmi-harden-accesses-to-the-reset-domai.patch +firmware-arm_scmi-fix-the-asynchronous-reset-request.patch +arm64-dts-rockchip-lower-sd-speed-on-quartz64-b.patch +arm64-dts-rockchip-pull-up-wlan-wake-on-gru-bob.patch +arm64-dts-rockchip-fix-typo-in-lisense-text-for-px30.patch +drm-mediatek-dsi-add-atomic-destroy-duplicate-_state.patch +arm64-dts-imx8mm-reverse-cpld_dn-gpio-label-mapping-.patch +arm64-dts-rockchip-set-rk3399-gru-pclk_edp-to-24-mhz.patch +arm64-dts-imx8mn-remove-gpu-power-domain-reset.patch +arm64-dts-imx8ulp-add-reset-cells-for-pcc.patch +dmaengine-ti-k3-udma-private-fix-refcount-leak-bug-i.patch +arm64-dts-rockchip-fix-property-for-usb2-phy-supply-.patch +arm64-dts-rockchip-fix-property-for-usb2-phy-supply-.patch-26447 +arm64-dts-rockchip-remove-enable-active-low-from-rk3.patch +arm64-dts-rockchip-remove-enable-active-low-from-rk3.patch-1350 +arm64-dts-imx8mm-verdin-extend-pmic-voltages.patch +netfilter-nf_conntrack_sip-fix-ct_sip_walk_headers.patch +netfilter-nf_conntrack_irc-tighten-matching-on-dcc-m.patch +netfilter-nfnetlink_osf-fix-possible-bogus-match-in-.patch +ice-don-t-double-unplug-aux-on-peer-initiated-reset.patch +ice-fix-crash-by-keep-old-cfg-when-update-tcs-more-t.patch +iavf-fix-cached-head-and-tail-value-for-iavf_get_tx_.patch +ipvlan-fix-out-of-bound-bugs-caused-by-unset-skb-mac.patch +net-core-fix-flow-symmetric-hash.patch +wifi-iwlwifi-mark-iwlmei-as-broken.patch +arm64-dts-tqma8mqml-include-phy-imx8-pcie.h-header.patch +drm-mediatek-fix-wrong-dither-settings.patch +arm64-dts-imx8mp-venice-gw74xx-fix-can-stby-polarity.patch +arm64-dts-imx8mp-venice-gw74xx-fix-ksz9477-cpu-port.patch +arm-dts-lan966x-fix-the-interrupt-number-for-interna.patch +net-phy-aquantia-wait-for-the-suspend-resume-operati.patch +arm64-dts-imx8mp-venice-gw74xx-fix-port-phy-validati.patch +scsi-qla2xxx-fix-memory-leak-in-__qlt_24xx_handle_ab.patch +scsi-mpt3sas-fix-return-value-check-of-dma_get_requi.patch +net-bonding-share-lacpdu_mcast_addr-definition.patch +net-bonding-unsync-device-addresses-on-ndo_stop.patch +net-team-unsync-device-addresses-on-ndo_stop.patch +drm-panel-simple-fix-innolux_g121i1_l01-bus_format.patch +mm-slab_common-fix-possible-double-free-of-kmem_cach.patch +mips-lantiq-export-clk_get_io-for-lantiq_wdt.ko.patch +mips-loongson32-fix-phy-mode-being-left-unspecified.patch +um-fix-default-console-kernel-parameter.patch +iavf-fix-bad-page-state.patch +mlxbf_gige-clear-mdio-gateway-lock-after-read.patch +iavf-fix-set-max-mtu-size-with-port-vlan-and-jumbo-f.patch +i40e-fix-vf-set-max-mtu-size.patch +i40e-fix-set-max_tx_rate-when-it-is-lower-than-1-mbp.patch +netdevsim-fix-hwstats-debugfs-file-permissions.patch +sfc-fix-tx-channel-offset-when-using-legacy-interrup.patch +sfc-fix-null-pointer-dereference-in-efx_hard_start_x.patch +bnxt_en-fix-flags-to-check-for-supported-fw-version.patch +gve-fix-gfp-flags-when-allocing-pages.patch +drm-hisilicon-add-depends-on-mmu.patch +of-mdio-add-of_node_put-when-breaking-out-of-for_eac.patch +net-ipa-properly-limit-modem-routing-table-use.patch +sfc-siena-fix-tx-channel-offset-when-using-legacy-in.patch +sfc-siena-fix-null-pointer-dereference-in-efx_hard_s.patch +wireguard-ratelimiter-disable-timings-test-by-defaul.patch +wireguard-netlink-avoid-variable-sized-memcpy-on-soc.patch +net-enetc-move-enetc_set_psfp-out-of-the-common-enet.patch +net-enetc-deny-offload-of-tc-based-tsn-features-on-v.patch +ipv6-fix-crash-when-ipv6-is-administratively-disable.patch +net-sched-taprio-avoid-disabling-offload-when-it-was.patch +net-sched-taprio-make-qdisc_leaf-see-the-per-netdev-.patch +ice-config-netdev-tc-before-setting-queues-number.patch +ice-fix-interface-being-down-after-reset-with-link-d.patch +netfilter-nf_tables-fix-nft_counters_enabled-underfl.patch +netfilter-nf_tables-fix-percpu-memory-leak-at-nf_tab.patch +netfilter-ebtables-fix-memory-leak-when-blob-is-malf.patch +netfilter-nf_ct_ftp-fix-deadlock-when-nat-rewrite-is.patch +net-ravb-fix-phy-state-warning-splat-during-system-r.patch +net-sh_eth-fix-phy-state-warning-splat-during-system.patch +gpio-tqmx86-fix-uninitialized-variable-girq.patch +can-gs_usb-gs_can_open-fix-race-dev-can.state-condit.patch +perf-stat-fix-bpf-program-section-name.patch +perf-stat-fix-cpu-map-index-in-bperf-cgroup-code.patch +perf-jit-include-program-header-in-elf-files.patch +perf-kcore_copy-do-not-check-proc-modules-is-unchang.patch +perf-tools-honor-namespace-when-synthesizing-build-i.patch +drm-mediatek-dsi-move-mtk_dsi_stop-call-back-to-mtk_.patch +ice-fix-ice_xdp_xmit-when-xdp-tx-queue-number-is-not.patch +net-smc-stop-the-clc-flow-if-no-link-to-map-buffers-.patch +net-phy-micrel-fix-shared-interrupt-on-lan8814.patch +bonding-fix-null-deref-in-bond_rr_gen_slave_id.patch +net-sunhme-fix-packet-reception-for-len-rx_copy_thre.patch +net-sched-fix-possible-refcount-leak-in-tc_new_tfilt.patch +bnxt-prevent-skb-uaf-after-handing-over-to-ptp-worke.patch +selftests-forwarding-add-shebang-for-sch_red.sh.patch diff --git a/queue-5.19/sfc-fix-null-pointer-dereference-in-efx_hard_start_x.patch b/queue-5.19/sfc-fix-null-pointer-dereference-in-efx_hard_start_x.patch new file mode 100644 index 00000000000..dca889723dd --- /dev/null +++ b/queue-5.19/sfc-fix-null-pointer-dereference-in-efx_hard_start_x.patch @@ -0,0 +1,50 @@ +From e28883db8230ba9fe9b808ecbfa9c609c3bddbc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Sep 2022 13:11:35 +0200 +Subject: sfc: fix null pointer dereference in efx_hard_start_xmit +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Íñigo Huguet + +[ Upstream commit 0a242eb2913a4aa3d6fbdb86559f27628e9466f3 ] + +Trying to get the channel from the tx_queue variable here is wrong +because we can only be here if tx_queue is NULL, so we shouldn't +dereference it. As the above comment in the code says, this is very +unlikely to happen, but it's wrong anyway so let's fix it. + +I hit this issue because of a different bug that caused tx_queue to be +NULL. If that happens, this is the error message that we get here: + BUG: unable to handle kernel NULL pointer dereference at 0000000000000020 + [...] + RIP: 0010:efx_hard_start_xmit+0x153/0x170 [sfc] + +Fixes: 12804793b17c ("sfc: decouple TXQ type from label") +Reported-by: Tianhao Zhao +Signed-off-by: Íñigo Huguet +Acked-by: Edward Cree +Link: https://lore.kernel.org/r/20220914111135.21038-1-ihuguet@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/tx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c +index 138bca611341..80ed7f760bd3 100644 +--- a/drivers/net/ethernet/sfc/tx.c ++++ b/drivers/net/ethernet/sfc/tx.c +@@ -549,7 +549,7 @@ netdev_tx_t efx_hard_start_xmit(struct sk_buff *skb, + * previous packets out. + */ + if (!netdev_xmit_more()) +- efx_tx_send_pending(tx_queue->channel); ++ efx_tx_send_pending(efx_get_tx_channel(efx, index)); + return NETDEV_TX_OK; + } + +-- +2.35.1 + diff --git a/queue-5.19/sfc-fix-tx-channel-offset-when-using-legacy-interrup.patch b/queue-5.19/sfc-fix-tx-channel-offset-when-using-legacy-interrup.patch new file mode 100644 index 00000000000..4ad8f3fac70 --- /dev/null +++ b/queue-5.19/sfc-fix-tx-channel-offset-when-using-legacy-interrup.patch @@ -0,0 +1,67 @@ +From cfd51d0978b717398c65d669951f42b386f70442 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Sep 2022 12:36:48 +0200 +Subject: sfc: fix TX channel offset when using legacy interrupts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Íñigo Huguet + +[ Upstream commit f232af4295653afa4ade3230462b3be15ad16419 ] + +In legacy interrupt mode the tx_channel_offset was hardcoded to 1, but +that's not correct if efx_sepparate_tx_channels is false. In that case, +the offset is 0 because the tx queues are in the single existing channel +at index 0, together with the rx queue. + +Without this fix, as soon as you try to send any traffic, it tries to +get the tx queues from an uninitialized channel getting these errors: + WARNING: CPU: 1 PID: 0 at drivers/net/ethernet/sfc/tx.c:540 efx_hard_start_xmit+0x12e/0x170 [sfc] + [...] + RIP: 0010:efx_hard_start_xmit+0x12e/0x170 [sfc] + [...] + Call Trace: + + dev_hard_start_xmit+0xd7/0x230 + sch_direct_xmit+0x9f/0x360 + __dev_queue_xmit+0x890/0xa40 + [...] + BUG: unable to handle kernel NULL pointer dereference at 0000000000000020 + [...] + RIP: 0010:efx_hard_start_xmit+0x153/0x170 [sfc] + [...] + Call Trace: + + dev_hard_start_xmit+0xd7/0x230 + sch_direct_xmit+0x9f/0x360 + __dev_queue_xmit+0x890/0xa40 + [...] + +Fixes: c308dfd1b43e ("sfc: fix wrong tx channel offset with efx_separate_tx_channels") +Reported-by: Tianhao Zhao +Signed-off-by: Íñigo Huguet +Acked-by: Edward Cree +Link: https://lore.kernel.org/r/20220914103648.16902-1-ihuguet@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/efx_channels.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/sfc/efx_channels.c b/drivers/net/ethernet/sfc/efx_channels.c +index 032b8c0bd788..5b4d661ab986 100644 +--- a/drivers/net/ethernet/sfc/efx_channels.c ++++ b/drivers/net/ethernet/sfc/efx_channels.c +@@ -319,7 +319,7 @@ int efx_probe_interrupts(struct efx_nic *efx) + efx->n_channels = 1 + (efx_separate_tx_channels ? 1 : 0); + efx->n_rx_channels = 1; + efx->n_tx_channels = 1; +- efx->tx_channel_offset = 1; ++ efx->tx_channel_offset = efx_separate_tx_channels ? 1 : 0; + efx->n_xdp_channels = 0; + efx->xdp_channel_offset = efx->n_channels; + efx->legacy_irq = efx->pci_dev->irq; +-- +2.35.1 + diff --git a/queue-5.19/sfc-siena-fix-null-pointer-dereference-in-efx_hard_s.patch b/queue-5.19/sfc-siena-fix-null-pointer-dereference-in-efx_hard_s.patch new file mode 100644 index 00000000000..4383cf5e317 --- /dev/null +++ b/queue-5.19/sfc-siena-fix-null-pointer-dereference-in-efx_hard_s.patch @@ -0,0 +1,41 @@ +From f06106680ff4b92ba223778052cc733c556b3924 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Sep 2022 16:19:58 +0200 +Subject: sfc/siena: fix null pointer dereference in efx_hard_start_xmit +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Íñigo Huguet + +[ Upstream commit 589c6eded10c77a12b7b2cf235b6b19a2bdb91fa ] + +Like in previous patch for sfc, prevent potential (but unlikely) NULL +pointer dereference. + +Fixes: 12804793b17c ("sfc: decouple TXQ type from label") +Reported-by: Tianhao Zhao +Signed-off-by: Íñigo Huguet +Link: https://lore.kernel.org/r/20220915141958.16458-1-ihuguet@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/siena/tx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/sfc/siena/tx.c b/drivers/net/ethernet/sfc/siena/tx.c +index e166dcb9b99c..91e87594ed1e 100644 +--- a/drivers/net/ethernet/sfc/siena/tx.c ++++ b/drivers/net/ethernet/sfc/siena/tx.c +@@ -336,7 +336,7 @@ netdev_tx_t efx_siena_hard_start_xmit(struct sk_buff *skb, + * previous packets out. + */ + if (!netdev_xmit_more()) +- efx_tx_send_pending(tx_queue->channel); ++ efx_tx_send_pending(efx_get_tx_channel(efx, index)); + return NETDEV_TX_OK; + } + +-- +2.35.1 + diff --git a/queue-5.19/sfc-siena-fix-tx-channel-offset-when-using-legacy-in.patch b/queue-5.19/sfc-siena-fix-tx-channel-offset-when-using-legacy-in.patch new file mode 100644 index 00000000000..1c921f21509 --- /dev/null +++ b/queue-5.19/sfc-siena-fix-tx-channel-offset-when-using-legacy-in.patch @@ -0,0 +1,41 @@ +From 71d213a38d2698be65567a72f991eb62e691f53e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Sep 2022 16:16:53 +0200 +Subject: sfc/siena: fix TX channel offset when using legacy interrupts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Íñigo Huguet + +[ Upstream commit 974bb793aded499491246f6f9826e26c2b127320 ] + +As in previous commit for sfc, fix TX channels offset when +efx_siena_separate_tx_channels is false (the default) + +Fixes: 25bde571b4a8 ("sfc/siena: fix wrong tx channel offset with efx_separate_tx_channels") +Reported-by: Tianhao Zhao +Signed-off-by: Íñigo Huguet +Link: https://lore.kernel.org/r/20220915141653.15504-1-ihuguet@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/siena/efx_channels.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/sfc/siena/efx_channels.c b/drivers/net/ethernet/sfc/siena/efx_channels.c +index 017212a40df3..f54ebd007286 100644 +--- a/drivers/net/ethernet/sfc/siena/efx_channels.c ++++ b/drivers/net/ethernet/sfc/siena/efx_channels.c +@@ -320,7 +320,7 @@ int efx_siena_probe_interrupts(struct efx_nic *efx) + efx->n_channels = 1 + (efx_siena_separate_tx_channels ? 1 : 0); + efx->n_rx_channels = 1; + efx->n_tx_channels = 1; +- efx->tx_channel_offset = 1; ++ efx->tx_channel_offset = efx_siena_separate_tx_channels ? 1 : 0; + efx->n_xdp_channels = 0; + efx->xdp_channel_offset = efx->n_channels; + efx->legacy_irq = efx->pci_dev->irq; +-- +2.35.1 + diff --git a/queue-5.19/um-fix-default-console-kernel-parameter.patch b/queue-5.19/um-fix-default-console-kernel-parameter.patch new file mode 100644 index 00000000000..aa6b7d5c892 --- /dev/null +++ b/queue-5.19/um-fix-default-console-kernel-parameter.patch @@ -0,0 +1,60 @@ +From 83dbf96ec694372ea39271b13a9a4586991838e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Aug 2022 21:52:22 +0200 +Subject: um: fix default console kernel parameter + +From: Christian Lamparter + +[ Upstream commit 782b1f70f8a8b28571949d2ba43fe88b96d75ec3 ] + +OpenWrt's UML with 5.15 was producing odd errors/warnings during preinit +part of the early userspace portion: + +|[ 0.000000] Kernel command line: ubd0=root.img root=98:0 console=tty +|[...] +|[ 0.440000] random: jshn: uninitialized urandom read (4 bytes read) +|[ 0.460000] random: jshn: uninitialized urandom read (4 bytes read) +|/etc/preinit: line 47: can't create /dev/tty: No such device or address +|/etc/preinit: line 48: can't create /dev/tty: No such device or address +|/etc/preinit: line 58: can't open /dev/tty: No such device or address +|[...] repeated many times + +That "/dev/tty" came from the command line (which is automatically +added if no console= parameter was specified for the uml binary). + +The TLDP project tells the following about the /dev/tty: + +| /dev/tty stands for the controlling terminal (if any) for the current +| process.[...] +| /dev/tty is something like a link to the actually terminal device[..] + +The "(if any)" is important here, since it's possible for processes to +not have a controlling terminal. + +I think this was a simple typo and the author wanted tty0 there. + +CC: Thomas Meyer +Fixes: d7ffac33631b ("um: stdio_console: Make preferred console") +Signed-off-by: Christian Lamparter +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/kernel/um_arch.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/um/kernel/um_arch.c b/arch/um/kernel/um_arch.c +index e0de60e503b9..d9e023c78f56 100644 +--- a/arch/um/kernel/um_arch.c ++++ b/arch/um/kernel/um_arch.c +@@ -33,7 +33,7 @@ + #include "um_arch.h" + + #define DEFAULT_COMMAND_LINE_ROOT "root=98:0" +-#define DEFAULT_COMMAND_LINE_CONSOLE "console=tty" ++#define DEFAULT_COMMAND_LINE_CONSOLE "console=tty0" + + /* Changed in add_arg and setup_arch, which run before SMP is started */ + static char __initdata command_line[COMMAND_LINE_SIZE] = { 0 }; +-- +2.35.1 + diff --git a/queue-5.19/wifi-iwlwifi-mark-iwlmei-as-broken.patch b/queue-5.19/wifi-iwlwifi-mark-iwlmei-as-broken.patch new file mode 100644 index 00000000000..8dc0c5bb200 --- /dev/null +++ b/queue-5.19/wifi-iwlwifi-mark-iwlmei-as-broken.patch @@ -0,0 +1,48 @@ +From 6a37a99764b130864ca31cadac1ecd56e3daa310 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Sep 2022 15:44:50 +0200 +Subject: wifi: iwlwifi: Mark IWLMEI as broken +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit 8997f5c8a62760db69fd5c56116705796322c8ed ] + +The iwlmei driver breaks iwlwifi when returning from suspend. The interface +ends up in the 'down' state after coming back from suspend. And iwd doesn't +touch the interface state, but wpa_supplicant does, so the bug only happens on +iwd. + +The bug report[0] has been open for four months now, and no fix seems to be +forthcoming. Since just disabling the iwlmei driver works as a workaround, +let's mark the config option as broken until it can be fixed properly. + +[0] https://bugzilla.kernel.org/show_bug.cgi?id=215937 + +Fixes: 2da4366f9e2c ("iwlwifi: mei: add the driver to allow cooperation with CSME") +Signed-off-by: Toke Høiland-Jørgensen +Acked-by: Emmanuel Grumbach +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220907134450.1183045-1-toke@toke.dk +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/Kconfig b/drivers/net/wireless/intel/iwlwifi/Kconfig +index a647a406b87b..b20409f8c13a 100644 +--- a/drivers/net/wireless/intel/iwlwifi/Kconfig ++++ b/drivers/net/wireless/intel/iwlwifi/Kconfig +@@ -140,6 +140,7 @@ config IWLMEI + depends on INTEL_MEI + depends on PM + depends on CFG80211 ++ depends on BROKEN + help + Enables the iwlmei kernel module. + +-- +2.35.1 + diff --git a/queue-5.19/wireguard-netlink-avoid-variable-sized-memcpy-on-soc.patch b/queue-5.19/wireguard-netlink-avoid-variable-sized-memcpy-on-soc.patch new file mode 100644 index 00000000000..9ab6ba4c585 --- /dev/null +++ b/queue-5.19/wireguard-netlink-avoid-variable-sized-memcpy-on-soc.patch @@ -0,0 +1,60 @@ +From dc1a8d2a2439b7ad8b1e920cc7c043aec9b8182c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Sep 2022 15:37:40 +0100 +Subject: wireguard: netlink: avoid variable-sized memcpy on sockaddr + +From: Jason A. Donenfeld + +[ Upstream commit 26c013108c12b94bc023bf19198a4300596c98b1 ] + +Doing a variable-sized memcpy is slower, and the compiler isn't smart +enough to turn this into a constant-size assignment. + +Further, Kees' latest fortified memcpy will actually bark, because the +destination pointer is type sockaddr, not explicitly sockaddr_in or +sockaddr_in6, so it thinks there's an overflow: + + memcpy: detected field-spanning write (size 28) of single field + "&endpoint.addr" at drivers/net/wireguard/netlink.c:446 (size 16) + +Fix this by just assigning by using explicit casts for each checked +case. + +Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") +Signed-off-by: Jason A. Donenfeld +Reviewed-by: Kees Cook +Reported-by: syzbot+a448cda4dba2dac50de5@syzkaller.appspotmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/wireguard/netlink.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/wireguard/netlink.c b/drivers/net/wireguard/netlink.c +index d0f3b6d7f408..5c804bcabfe6 100644 +--- a/drivers/net/wireguard/netlink.c ++++ b/drivers/net/wireguard/netlink.c +@@ -436,14 +436,13 @@ static int set_peer(struct wg_device *wg, struct nlattr **attrs) + if (attrs[WGPEER_A_ENDPOINT]) { + struct sockaddr *addr = nla_data(attrs[WGPEER_A_ENDPOINT]); + size_t len = nla_len(attrs[WGPEER_A_ENDPOINT]); ++ struct endpoint endpoint = { { { 0 } } }; + +- if ((len == sizeof(struct sockaddr_in) && +- addr->sa_family == AF_INET) || +- (len == sizeof(struct sockaddr_in6) && +- addr->sa_family == AF_INET6)) { +- struct endpoint endpoint = { { { 0 } } }; +- +- memcpy(&endpoint.addr, addr, len); ++ if (len == sizeof(struct sockaddr_in) && addr->sa_family == AF_INET) { ++ endpoint.addr4 = *(struct sockaddr_in *)addr; ++ wg_socket_set_peer_endpoint(peer, &endpoint); ++ } else if (len == sizeof(struct sockaddr_in6) && addr->sa_family == AF_INET6) { ++ endpoint.addr6 = *(struct sockaddr_in6 *)addr; + wg_socket_set_peer_endpoint(peer, &endpoint); + } + } +-- +2.35.1 + diff --git a/queue-5.19/wireguard-ratelimiter-disable-timings-test-by-defaul.patch b/queue-5.19/wireguard-ratelimiter-disable-timings-test-by-defaul.patch new file mode 100644 index 00000000000..3f4b4530b0d --- /dev/null +++ b/queue-5.19/wireguard-ratelimiter-disable-timings-test-by-defaul.patch @@ -0,0 +1,104 @@ +From 1d39dadea5e0d8e7a273d459dddcad8a267bfbf2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Sep 2022 15:37:38 +0100 +Subject: wireguard: ratelimiter: disable timings test by default + +From: Jason A. Donenfeld + +[ Upstream commit 684dec3cf45da2b0848298efae4adf3b2aeafeda ] + +A previous commit tried to make the ratelimiter timings test more +reliable but in the process made it less reliable on other +configurations. This is an impossible problem to solve without +increasingly ridiculous heuristics. And it's not even a problem that +actually needs to be solved in any comprehensive way, since this is only +ever used during development. So just cordon this off with a DEBUG_ +ifdef, just like we do for the trie's randomized tests, so it can be +enabled while hacking on the code, and otherwise disabled in CI. In the +process we also revert 151c8e499f47. + +Fixes: 151c8e499f47 ("wireguard: ratelimiter: use hrtimer in selftest") +Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/wireguard/selftest/ratelimiter.c | 25 ++++++++------------ + 1 file changed, 10 insertions(+), 15 deletions(-) + +diff --git a/drivers/net/wireguard/selftest/ratelimiter.c b/drivers/net/wireguard/selftest/ratelimiter.c +index ba87d294604f..d4bb40a695ab 100644 +--- a/drivers/net/wireguard/selftest/ratelimiter.c ++++ b/drivers/net/wireguard/selftest/ratelimiter.c +@@ -6,29 +6,28 @@ + #ifdef DEBUG + + #include +-#include + + static const struct { + bool result; +- u64 nsec_to_sleep_before; ++ unsigned int msec_to_sleep_before; + } expected_results[] __initconst = { + [0 ... PACKETS_BURSTABLE - 1] = { true, 0 }, + [PACKETS_BURSTABLE] = { false, 0 }, +- [PACKETS_BURSTABLE + 1] = { true, NSEC_PER_SEC / PACKETS_PER_SECOND }, ++ [PACKETS_BURSTABLE + 1] = { true, MSEC_PER_SEC / PACKETS_PER_SECOND }, + [PACKETS_BURSTABLE + 2] = { false, 0 }, +- [PACKETS_BURSTABLE + 3] = { true, (NSEC_PER_SEC / PACKETS_PER_SECOND) * 2 }, ++ [PACKETS_BURSTABLE + 3] = { true, (MSEC_PER_SEC / PACKETS_PER_SECOND) * 2 }, + [PACKETS_BURSTABLE + 4] = { true, 0 }, + [PACKETS_BURSTABLE + 5] = { false, 0 } + }; + + static __init unsigned int maximum_jiffies_at_index(int index) + { +- u64 total_nsecs = 2 * NSEC_PER_SEC / PACKETS_PER_SECOND / 3; ++ unsigned int total_msecs = 2 * MSEC_PER_SEC / PACKETS_PER_SECOND / 3; + int i; + + for (i = 0; i <= index; ++i) +- total_nsecs += expected_results[i].nsec_to_sleep_before; +- return nsecs_to_jiffies(total_nsecs); ++ total_msecs += expected_results[i].msec_to_sleep_before; ++ return msecs_to_jiffies(total_msecs); + } + + static __init int timings_test(struct sk_buff *skb4, struct iphdr *hdr4, +@@ -43,12 +42,8 @@ static __init int timings_test(struct sk_buff *skb4, struct iphdr *hdr4, + loop_start_time = jiffies; + + for (i = 0; i < ARRAY_SIZE(expected_results); ++i) { +- if (expected_results[i].nsec_to_sleep_before) { +- ktime_t timeout = ktime_add(ktime_add_ns(ktime_get_coarse_boottime(), TICK_NSEC * 4 / 3), +- ns_to_ktime(expected_results[i].nsec_to_sleep_before)); +- set_current_state(TASK_UNINTERRUPTIBLE); +- schedule_hrtimeout_range_clock(&timeout, 0, HRTIMER_MODE_ABS, CLOCK_BOOTTIME); +- } ++ if (expected_results[i].msec_to_sleep_before) ++ msleep(expected_results[i].msec_to_sleep_before); + + if (time_is_before_jiffies(loop_start_time + + maximum_jiffies_at_index(i))) +@@ -132,7 +127,7 @@ bool __init wg_ratelimiter_selftest(void) + if (IS_ENABLED(CONFIG_KASAN) || IS_ENABLED(CONFIG_UBSAN)) + return true; + +- BUILD_BUG_ON(NSEC_PER_SEC % PACKETS_PER_SECOND != 0); ++ BUILD_BUG_ON(MSEC_PER_SEC % PACKETS_PER_SECOND != 0); + + if (wg_ratelimiter_init()) + goto out; +@@ -172,7 +167,7 @@ bool __init wg_ratelimiter_selftest(void) + ++test; + #endif + +- for (trials = TRIALS_BEFORE_GIVING_UP;;) { ++ for (trials = TRIALS_BEFORE_GIVING_UP; IS_ENABLED(DEBUG_RATELIMITER_TIMINGS);) { + int test_count = 0, ret; + + ret = timings_test(skb4, hdr4, skb6, hdr6, &test_count); +-- +2.35.1 +