From: Sasha Levin Date: Mon, 19 Aug 2024 14:19:31 +0000 (-0400) Subject: Fixes for 5.15 X-Git-Tag: v6.1.107~115 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1ca23c3ef8945f754dfc191d7b49cd23a68c56d2;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/alsa-hda-realtek-fix-noise-from-speakers-on-lenovo-i.patch b/queue-5.15/alsa-hda-realtek-fix-noise-from-speakers-on-lenovo-i.patch new file mode 100644 index 00000000000..a2246ef1dd5 --- /dev/null +++ b/queue-5.15/alsa-hda-realtek-fix-noise-from-speakers-on-lenovo-i.patch @@ -0,0 +1,39 @@ +From d4f5aebededed38457ef30be8b533e4b7111c961 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Aug 2024 18:39:06 +0330 +Subject: ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7 + +From: Parsa Poorshikhian + +[ Upstream commit ef9718b3d54e822de294351251f3a574f8a082ce ] + +Fix noise from speakers connected to AUX port when no sound is playing. +The problem occurs because the `alc_shutup_pins` function includes +a 0x10ec0257 vendor ID, which causes noise on Lenovo IdeaPad 3 15IAU7 with +Realtek ALC257 codec when no sound is playing. +Removing this vendor ID from the function fixes the bug. + +Fixes: 70794b9563fe ("ALSA: hda/realtek: Add more codec ID to no shutup pins list") +Signed-off-by: Parsa Poorshikhian +Link: https://patch.msgid.link/20240810150939.330693-1-parsa.poorsh@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 8729896c7f9cd..05fb686ae2508 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -577,7 +577,6 @@ static void alc_shutup_pins(struct hda_codec *codec) + switch (codec->core.vendor_id) { + case 0x10ec0236: + case 0x10ec0256: +- case 0x10ec0257: + case 0x19e58326: + case 0x10ec0283: + case 0x10ec0285: +-- +2.43.0 + diff --git a/queue-5.15/atm-idt77252-prevent-use-after-free-in-dequeue_rx.patch b/queue-5.15/atm-idt77252-prevent-use-after-free-in-dequeue_rx.patch new file mode 100644 index 00000000000..749ee3540b5 --- /dev/null +++ b/queue-5.15/atm-idt77252-prevent-use-after-free-in-dequeue_rx.patch @@ -0,0 +1,56 @@ +From b0c6fb4d3c40679e77f8a9b45c37042326a5249e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2024 15:28:19 +0300 +Subject: atm: idt77252: prevent use after free in dequeue_rx() + +From: Dan Carpenter + +[ Upstream commit a9a18e8f770c9b0703dab93580d0b02e199a4c79 ] + +We can't dereference "skb" after calling vcc->push() because the skb +is released. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/atm/idt77252.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c +index 2daf50d4cd47a..7810f974b2ca9 100644 +--- a/drivers/atm/idt77252.c ++++ b/drivers/atm/idt77252.c +@@ -1118,8 +1118,8 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe) + rpp->len += skb->len; + + if (stat & SAR_RSQE_EPDU) { ++ unsigned int len, truesize; + unsigned char *l1l2; +- unsigned int len; + + l1l2 = (unsigned char *) ((unsigned long) skb->data + skb->len - 6); + +@@ -1189,14 +1189,15 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe) + ATM_SKB(skb)->vcc = vcc; + __net_timestamp(skb); + ++ truesize = skb->truesize; + vcc->push(vcc, skb); + atomic_inc(&vcc->stats->rx); + +- if (skb->truesize > SAR_FB_SIZE_3) ++ if (truesize > SAR_FB_SIZE_3) + add_rx_skb(card, 3, SAR_FB_SIZE_3, 1); +- else if (skb->truesize > SAR_FB_SIZE_2) ++ else if (truesize > SAR_FB_SIZE_2) + add_rx_skb(card, 2, SAR_FB_SIZE_2, 1); +- else if (skb->truesize > SAR_FB_SIZE_1) ++ else if (truesize > SAR_FB_SIZE_1) + add_rx_skb(card, 1, SAR_FB_SIZE_1, 1); + else + add_rx_skb(card, 0, SAR_FB_SIZE_0, 1); +-- +2.43.0 + diff --git a/queue-5.15/igc-correct-the-launchtime-offset.patch b/queue-5.15/igc-correct-the-launchtime-offset.patch new file mode 100644 index 00000000000..1eff19e0e4e --- /dev/null +++ b/queue-5.15/igc-correct-the-launchtime-offset.patch @@ -0,0 +1,168 @@ +From 3d7e68bdd37d70e76bc0d9635e4fd4d4a22e3429 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Sep 2022 10:49:40 +0800 +Subject: igc: Correct the launchtime offset + +From: Muhammad Husaini Zulkifli + +[ Upstream commit 790835fcc0cb9992349ae3c9010dbc7321aaa24d ] + +The launchtime offset should be corrected according to sections 7.5.2.6 +Transmit Scheduling Latency of the Intel Ethernet I225/I226 Software +User Manual. + +Software can compensate the latency between the transmission scheduling +and the time that packet is transmitted to the network by setting this +GTxOffset register. Without setting this register, there may be a +significant delay between the packet scheduling and the network point. + +This patch helps to reduce the latency for each of the link speed. + +Before: + +10Mbps : 11000 - 13800 nanosecond +100Mbps : 1300 - 1700 nanosecond +1000Mbps : 190 - 600 nanosecond +2500Mbps : 1400 - 1700 nanosecond + +After: + +10Mbps : less than 750 nanosecond +100Mbps : less than 192 nanosecond +1000Mbps : less than 128 nanosecond +2500Mbps : less than 128 nanosecond + +Test Setup: + +Talker : Use l2_tai.c to generate the launchtime into packet payload. +Listener: Use timedump.c to compute the delta between packet arrival and +LaunchTime packet payload. + +Signed-off-by: Vinicius Costa Gomes +Signed-off-by: Muhammad Husaini Zulkifli +Acked-by: Sasha Neftin +Acked-by: Paul Menzel +Tested-by: Naama Meir +Signed-off-by: Tony Nguyen +Stable-dep-of: e037a26ead18 ("igc: Fix packet still tx after gate close by reducing i226 MAC retry buffer") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_defines.h | 9 ++++++ + drivers/net/ethernet/intel/igc/igc_main.c | 7 +++++ + drivers/net/ethernet/intel/igc/igc_regs.h | 1 + + drivers/net/ethernet/intel/igc/igc_tsn.c | 30 ++++++++++++++++++++ + drivers/net/ethernet/intel/igc/igc_tsn.h | 1 + + 5 files changed, 48 insertions(+) + +diff --git a/drivers/net/ethernet/intel/igc/igc_defines.h b/drivers/net/ethernet/intel/igc/igc_defines.h +index 703b62c5f79b5..95282dde6b8bc 100644 +--- a/drivers/net/ethernet/intel/igc/igc_defines.h ++++ b/drivers/net/ethernet/intel/igc/igc_defines.h +@@ -405,6 +405,15 @@ + #define IGC_DTXMXPKTSZ_TSN 0x19 /* 1600 bytes of max TX DMA packet size */ + #define IGC_DTXMXPKTSZ_DEFAULT 0x98 /* 9728-byte Jumbo frames */ + ++/* Transmit Scheduling Latency */ ++/* Latency between transmission scheduling (LaunchTime) and the time ++ * the packet is transmitted to the network in nanosecond. ++ */ ++#define IGC_TXOFFSET_SPEED_10 0x000034BC ++#define IGC_TXOFFSET_SPEED_100 0x00000578 ++#define IGC_TXOFFSET_SPEED_1000 0x0000012C ++#define IGC_TXOFFSET_SPEED_2500 0x00000578 ++ + /* Time Sync Interrupt Causes */ + #define IGC_TSICR_SYS_WRAP BIT(0) /* SYSTIM Wrap around. */ + #define IGC_TSICR_TXTS BIT(1) /* Transmit Timestamp. */ +diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c +index 6185566fbb98c..eb8c24318fdac 100644 +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -5532,6 +5532,13 @@ static void igc_watchdog_task(struct work_struct *work) + break; + } + ++ /* Once the launch time has been set on the wire, there ++ * is a delay before the link speed can be determined ++ * based on link-up activity. Write into the register ++ * as soon as we know the correct link speed. ++ */ ++ igc_tsn_adjust_txtime_offset(adapter); ++ + if (adapter->link_speed != SPEED_1000) + goto no_wait; + +diff --git a/drivers/net/ethernet/intel/igc/igc_regs.h b/drivers/net/ethernet/intel/igc/igc_regs.h +index 026c3b65fc37a..0e9c1298f36fe 100644 +--- a/drivers/net/ethernet/intel/igc/igc_regs.h ++++ b/drivers/net/ethernet/intel/igc/igc_regs.h +@@ -227,6 +227,7 @@ + /* Transmit Scheduling Registers */ + #define IGC_TQAVCTRL 0x3570 + #define IGC_TXQCTL(_n) (0x3344 + 0x4 * (_n)) ++#define IGC_GTXOFFSET 0x3310 + #define IGC_BASET_L 0x3314 + #define IGC_BASET_H 0x3318 + #define IGC_QBVCYCLET 0x331C +diff --git a/drivers/net/ethernet/intel/igc/igc_tsn.c b/drivers/net/ethernet/intel/igc/igc_tsn.c +index 2330b1ff915e7..93518c785c7d2 100644 +--- a/drivers/net/ethernet/intel/igc/igc_tsn.c ++++ b/drivers/net/ethernet/intel/igc/igc_tsn.c +@@ -48,6 +48,35 @@ static unsigned int igc_tsn_new_flags(struct igc_adapter *adapter) + return new_flags; + } + ++void igc_tsn_adjust_txtime_offset(struct igc_adapter *adapter) ++{ ++ struct igc_hw *hw = &adapter->hw; ++ u16 txoffset; ++ ++ if (!is_any_launchtime(adapter)) ++ return; ++ ++ switch (adapter->link_speed) { ++ case SPEED_10: ++ txoffset = IGC_TXOFFSET_SPEED_10; ++ break; ++ case SPEED_100: ++ txoffset = IGC_TXOFFSET_SPEED_100; ++ break; ++ case SPEED_1000: ++ txoffset = IGC_TXOFFSET_SPEED_1000; ++ break; ++ case SPEED_2500: ++ txoffset = IGC_TXOFFSET_SPEED_2500; ++ break; ++ default: ++ txoffset = 0; ++ break; ++ } ++ ++ wr32(IGC_GTXOFFSET, txoffset); ++} ++ + /* Returns the TSN specific registers to their default values after + * the adapter is reset. + */ +@@ -57,6 +86,7 @@ static int igc_tsn_disable_offload(struct igc_adapter *adapter) + u32 tqavctrl; + int i; + ++ wr32(IGC_GTXOFFSET, 0); + wr32(IGC_TXPBS, I225_TXPBSIZE_DEFAULT); + wr32(IGC_DTXMXPKTSZ, IGC_DTXMXPKTSZ_DEFAULT); + +diff --git a/drivers/net/ethernet/intel/igc/igc_tsn.h b/drivers/net/ethernet/intel/igc/igc_tsn.h +index 1512307f5a528..b53e6af560b73 100644 +--- a/drivers/net/ethernet/intel/igc/igc_tsn.h ++++ b/drivers/net/ethernet/intel/igc/igc_tsn.h +@@ -6,5 +6,6 @@ + + int igc_tsn_offload_apply(struct igc_adapter *adapter); + int igc_tsn_reset(struct igc_adapter *adapter); ++void igc_tsn_adjust_txtime_offset(struct igc_adapter *adapter); + + #endif /* _IGC_BASE_H */ +-- +2.43.0 + diff --git a/queue-5.15/igc-fix-packet-still-tx-after-gate-close-by-reducing.patch b/queue-5.15/igc-fix-packet-still-tx-after-gate-close-by-reducing.patch new file mode 100644 index 00000000000..ae94e9bbab5 --- /dev/null +++ b/queue-5.15/igc-fix-packet-still-tx-after-gate-close-by-reducing.patch @@ -0,0 +1,149 @@ +From ecb03769339f70c9f0992b2b55d70796909eb353 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Jul 2024 11:38:07 -0400 +Subject: igc: Fix packet still tx after gate close by reducing i226 MAC retry + buffer + +From: Faizal Rahim + +[ Upstream commit e037a26ead187901f83cad9c503ccece5ff6817a ] + +Testing uncovered that even when the taprio gate is closed, some packets +still transmit. + +According to i225/6 hardware errata [1], traffic might overflow the +planned QBV window. This happens because MAC maintains an internal buffer, +primarily for supporting half duplex retries. Therefore, even when the +gate closes, residual MAC data in the buffer may still transmit. + +To mitigate this for i226, reduce the MAC's internal buffer from 192 bytes +to the recommended 88 bytes by modifying the RETX_CTL register value. + +This follows guidelines from: +[1] Ethernet Controller I225/I22 Spec Update Rev 2.1 Errata Item 9: + TSN: Packet Transmission Might Cross Qbv Window +[2] I225/6 SW User Manual Rev 1.2.4: Section 8.11.5 Retry Buffer Control + +Note that the RETX_CTL register can't be used in TSN mode because half +duplex feature cannot coexist with TSN. + +Test Steps: +1. Send taprio cmd to board A: + tc qdisc replace dev enp1s0 parent root handle 100 taprio \ + num_tc 4 \ + map 3 2 1 0 3 3 3 3 3 3 3 3 3 3 3 3 \ + queues 1@0 1@1 1@2 1@3 \ + base-time 0 \ + sched-entry S 0x07 500000 \ + sched-entry S 0x0f 500000 \ + flags 0x2 \ + txtime-delay 0 + + Note that for TC3, gate should open for 500us and close for another + 500us. + +3. Take tcpdump log on Board B. + +4. Send udp packets via UDP tai app from Board A to Board B. + +5. Analyze tcpdump log via wireshark log on Board B. Ensure that the + total time from the first to the last packet received during one cycle + for TC3 does not exceed 500us. + +Fixes: 43546211738e ("igc: Add new device ID's") +Signed-off-by: Faizal Rahim +Acked-by: Vinicius Costa Gomes +Tested-by: Mor Bar-Gabay +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_defines.h | 6 ++++ + drivers/net/ethernet/intel/igc/igc_tsn.c | 34 ++++++++++++++++++++ + 2 files changed, 40 insertions(+) + +diff --git a/drivers/net/ethernet/intel/igc/igc_defines.h b/drivers/net/ethernet/intel/igc/igc_defines.h +index 4f2021a940fb3..d5acee27894e5 100644 +--- a/drivers/net/ethernet/intel/igc/igc_defines.h ++++ b/drivers/net/ethernet/intel/igc/igc_defines.h +@@ -405,6 +405,12 @@ + #define IGC_DTXMXPKTSZ_TSN 0x19 /* 1600 bytes of max TX DMA packet size */ + #define IGC_DTXMXPKTSZ_DEFAULT 0x98 /* 9728-byte Jumbo frames */ + ++/* Retry Buffer Control */ ++#define IGC_RETX_CTL 0x041C ++#define IGC_RETX_CTL_WATERMARK_MASK 0xF ++#define IGC_RETX_CTL_QBVFULLTH_SHIFT 8 /* QBV Retry Buffer Full Threshold */ ++#define IGC_RETX_CTL_QBVFULLEN 0x1000 /* Enable QBV Retry Buffer Full Threshold */ ++ + /* Transmit Scheduling Latency */ + /* Latency between transmission scheduling (LaunchTime) and the time + * the packet is transmitted to the network in nanosecond. +diff --git a/drivers/net/ethernet/intel/igc/igc_tsn.c b/drivers/net/ethernet/intel/igc/igc_tsn.c +index 066444675aade..9fbc0b0455803 100644 +--- a/drivers/net/ethernet/intel/igc/igc_tsn.c ++++ b/drivers/net/ethernet/intel/igc/igc_tsn.c +@@ -78,6 +78,15 @@ void igc_tsn_adjust_txtime_offset(struct igc_adapter *adapter) + wr32(IGC_GTXOFFSET, txoffset); + } + ++static void igc_tsn_restore_retx_default(struct igc_adapter *adapter) ++{ ++ struct igc_hw *hw = &adapter->hw; ++ u32 retxctl; ++ ++ retxctl = rd32(IGC_RETX_CTL) & IGC_RETX_CTL_WATERMARK_MASK; ++ wr32(IGC_RETX_CTL, retxctl); ++} ++ + /* Returns the TSN specific registers to their default values after + * the adapter is reset. + */ +@@ -91,6 +100,9 @@ static int igc_tsn_disable_offload(struct igc_adapter *adapter) + wr32(IGC_TXPBS, I225_TXPBSIZE_DEFAULT); + wr32(IGC_DTXMXPKTSZ, IGC_DTXMXPKTSZ_DEFAULT); + ++ if (igc_is_device_id_i226(hw)) ++ igc_tsn_restore_retx_default(adapter); ++ + tqavctrl = rd32(IGC_TQAVCTRL); + tqavctrl &= ~(IGC_TQAVCTRL_TRANSMIT_MODE_TSN | + IGC_TQAVCTRL_ENHANCED_QAV | IGC_TQAVCTRL_FUTSCDDIS); +@@ -111,6 +123,25 @@ static int igc_tsn_disable_offload(struct igc_adapter *adapter) + return 0; + } + ++/* To partially fix i226 HW errata, reduce MAC internal buffering from 192 Bytes ++ * to 88 Bytes by setting RETX_CTL register using the recommendation from: ++ * a) Ethernet Controller I225/I226 Specification Update Rev 2.1 ++ * Item 9: TSN: Packet Transmission Might Cross the Qbv Window ++ * b) I225/6 SW User Manual Rev 1.2.4: Section 8.11.5 Retry Buffer Control ++ */ ++static void igc_tsn_set_retx_qbvfullthreshold(struct igc_adapter *adapter) ++{ ++ struct igc_hw *hw = &adapter->hw; ++ u32 retxctl, watermark; ++ ++ retxctl = rd32(IGC_RETX_CTL); ++ watermark = retxctl & IGC_RETX_CTL_WATERMARK_MASK; ++ /* Set QBVFULLTH value using watermark and set QBVFULLEN */ ++ retxctl |= (watermark << IGC_RETX_CTL_QBVFULLTH_SHIFT) | ++ IGC_RETX_CTL_QBVFULLEN; ++ wr32(IGC_RETX_CTL, retxctl); ++} ++ + static int igc_tsn_enable_offload(struct igc_adapter *adapter) + { + struct igc_hw *hw = &adapter->hw; +@@ -123,6 +154,9 @@ static int igc_tsn_enable_offload(struct igc_adapter *adapter) + wr32(IGC_DTXMXPKTSZ, IGC_DTXMXPKTSZ_TSN); + wr32(IGC_TXPBS, IGC_TXPBSIZE_TSN); + ++ if (igc_is_device_id_i226(hw)) ++ igc_tsn_set_retx_qbvfullthreshold(adapter); ++ + for (i = 0; i < adapter->num_tx_queues; i++) { + struct igc_ring *ring = adapter->tx_ring[i]; + u32 txqctl = 0; +-- +2.43.0 + diff --git a/queue-5.15/igc-remove-i226-qbv-basetime-restriction.patch b/queue-5.15/igc-remove-i226-qbv-basetime-restriction.patch new file mode 100644 index 00000000000..56115752a53 --- /dev/null +++ b/queue-5.15/igc-remove-i226-qbv-basetime-restriction.patch @@ -0,0 +1,221 @@ +From 20a1d947a6ee6b53af6442011082e2a242f3be6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Dec 2022 00:29:07 +0800 +Subject: igc: remove I226 Qbv BaseTime restriction + +From: Muhammad Husaini Zulkifli + +[ Upstream commit b8897dc54e3bc9d25281bbb42a7d730782ff4588 ] + +Remove the Qbv BaseTime restriction for I226 so that the BaseTime can be +scheduled to the future time. A new register bit of Tx Qav Control +(Bit-7: FutScdDis) was introduced to allow I226 scheduling future time as +Qbv BaseTime and not having the Tx hang timeout issue. + +Besides, according to datasheet section 7.5.2.9.3.3, FutScdDis bit has to +be configured first before the cycle time and base time. + +Indeed the FutScdDis bit is only active on re-configuration, thus we have +to set the BASET_L to zero and then only set it to the desired value. + +Please also note that the Qbv configuration flow is moved around based on +the Qbv programming guideline that is documented in the latest datasheet. + +Co-developed-by: Tan Tee Min +Signed-off-by: Tan Tee Min +Signed-off-by: Muhammad Husaini Zulkifli +Tested-by: Naama Meir +Signed-off-by: Tony Nguyen +Stable-dep-of: e037a26ead18 ("igc: Fix packet still tx after gate close by reducing i226 MAC retry buffer") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_base.c | 29 +++++++++++++ + drivers/net/ethernet/intel/igc/igc_base.h | 2 + + drivers/net/ethernet/intel/igc/igc_defines.h | 1 + + drivers/net/ethernet/intel/igc/igc_main.c | 5 ++- + drivers/net/ethernet/intel/igc/igc_tsn.c | 44 +++++++++++++------- + 5 files changed, 65 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc_base.c b/drivers/net/ethernet/intel/igc/igc_base.c +index 84f142f5e472e..be095c6531b68 100644 +--- a/drivers/net/ethernet/intel/igc/igc_base.c ++++ b/drivers/net/ethernet/intel/igc/igc_base.c +@@ -402,6 +402,35 @@ void igc_rx_fifo_flush_base(struct igc_hw *hw) + rd32(IGC_MPC); + } + ++bool igc_is_device_id_i225(struct igc_hw *hw) ++{ ++ switch (hw->device_id) { ++ case IGC_DEV_ID_I225_LM: ++ case IGC_DEV_ID_I225_V: ++ case IGC_DEV_ID_I225_I: ++ case IGC_DEV_ID_I225_K: ++ case IGC_DEV_ID_I225_K2: ++ case IGC_DEV_ID_I225_LMVP: ++ case IGC_DEV_ID_I225_IT: ++ return true; ++ default: ++ return false; ++ } ++} ++ ++bool igc_is_device_id_i226(struct igc_hw *hw) ++{ ++ switch (hw->device_id) { ++ case IGC_DEV_ID_I226_LM: ++ case IGC_DEV_ID_I226_V: ++ case IGC_DEV_ID_I226_K: ++ case IGC_DEV_ID_I226_IT: ++ return true; ++ default: ++ return false; ++ } ++} ++ + static struct igc_mac_operations igc_mac_ops_base = { + .init_hw = igc_init_hw_base, + .check_for_link = igc_check_for_copper_link, +diff --git a/drivers/net/ethernet/intel/igc/igc_base.h b/drivers/net/ethernet/intel/igc/igc_base.h +index 52849f5e8048d..9f3827eda157c 100644 +--- a/drivers/net/ethernet/intel/igc/igc_base.h ++++ b/drivers/net/ethernet/intel/igc/igc_base.h +@@ -7,6 +7,8 @@ + /* forward declaration */ + void igc_rx_fifo_flush_base(struct igc_hw *hw); + void igc_power_down_phy_copper_base(struct igc_hw *hw); ++bool igc_is_device_id_i225(struct igc_hw *hw); ++bool igc_is_device_id_i226(struct igc_hw *hw); + + /* Transmit Descriptor - Advanced */ + union igc_adv_tx_desc { +diff --git a/drivers/net/ethernet/intel/igc/igc_defines.h b/drivers/net/ethernet/intel/igc/igc_defines.h +index 95282dde6b8bc..4f2021a940fb3 100644 +--- a/drivers/net/ethernet/intel/igc/igc_defines.h ++++ b/drivers/net/ethernet/intel/igc/igc_defines.h +@@ -527,6 +527,7 @@ + /* Transmit Scheduling */ + #define IGC_TQAVCTRL_TRANSMIT_MODE_TSN 0x00000001 + #define IGC_TQAVCTRL_ENHANCED_QAV 0x00000008 ++#define IGC_TQAVCTRL_FUTSCDDIS 0x00000080 + + #define IGC_TXQCTL_QUEUE_MODE_LAUNCHT 0x00000001 + #define IGC_TXQCTL_STRICT_CYCLE 0x00000002 +diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c +index eb8c24318fdac..7605115e6a1b2 100644 +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -5991,6 +5991,7 @@ static bool validate_schedule(struct igc_adapter *adapter, + const struct tc_taprio_qopt_offload *qopt) + { + int queue_uses[IGC_MAX_TX_QUEUES] = { }; ++ struct igc_hw *hw = &adapter->hw; + struct timespec64 now; + size_t n; + +@@ -6003,8 +6004,10 @@ static bool validate_schedule(struct igc_adapter *adapter, + * in the future, it will hold all the packets until that + * time, causing a lot of TX Hangs, so to avoid that, we + * reject schedules that would start in the future. ++ * Note: Limitation above is no longer in i226. + */ +- if (!is_base_time_past(qopt->base_time, &now)) ++ if (!is_base_time_past(qopt->base_time, &now) && ++ igc_is_device_id_i225(hw)) + return false; + + for (n = 0; n < qopt->num_entries; n++) { +diff --git a/drivers/net/ethernet/intel/igc/igc_tsn.c b/drivers/net/ethernet/intel/igc/igc_tsn.c +index 93518c785c7d2..066444675aade 100644 +--- a/drivers/net/ethernet/intel/igc/igc_tsn.c ++++ b/drivers/net/ethernet/intel/igc/igc_tsn.c +@@ -2,6 +2,7 @@ + /* Copyright (c) 2019 Intel Corporation */ + + #include "igc.h" ++#include "igc_hw.h" + #include "igc_tsn.h" + + static bool is_any_launchtime(struct igc_adapter *adapter) +@@ -92,7 +93,8 @@ static int igc_tsn_disable_offload(struct igc_adapter *adapter) + + tqavctrl = rd32(IGC_TQAVCTRL); + tqavctrl &= ~(IGC_TQAVCTRL_TRANSMIT_MODE_TSN | +- IGC_TQAVCTRL_ENHANCED_QAV); ++ IGC_TQAVCTRL_ENHANCED_QAV | IGC_TQAVCTRL_FUTSCDDIS); ++ + wr32(IGC_TQAVCTRL, tqavctrl); + + for (i = 0; i < adapter->num_tx_queues; i++) { +@@ -117,20 +119,10 @@ static int igc_tsn_enable_offload(struct igc_adapter *adapter) + ktime_t base_time, systim; + int i; + +- cycle = adapter->cycle_time; +- base_time = adapter->base_time; +- + wr32(IGC_TSAUXC, 0); + wr32(IGC_DTXMXPKTSZ, IGC_DTXMXPKTSZ_TSN); + wr32(IGC_TXPBS, IGC_TXPBSIZE_TSN); + +- tqavctrl = rd32(IGC_TQAVCTRL); +- tqavctrl |= IGC_TQAVCTRL_TRANSMIT_MODE_TSN | IGC_TQAVCTRL_ENHANCED_QAV; +- wr32(IGC_TQAVCTRL, tqavctrl); +- +- wr32(IGC_QBVCYCLET_S, cycle); +- wr32(IGC_QBVCYCLET, cycle); +- + for (i = 0; i < adapter->num_tx_queues; i++) { + struct igc_ring *ring = adapter->tx_ring[i]; + u32 txqctl = 0; +@@ -233,21 +225,43 @@ static int igc_tsn_enable_offload(struct igc_adapter *adapter) + wr32(IGC_TXQCTL(i), txqctl); + } + ++ tqavctrl = rd32(IGC_TQAVCTRL); ++ tqavctrl |= IGC_TQAVCTRL_TRANSMIT_MODE_TSN | IGC_TQAVCTRL_ENHANCED_QAV; ++ ++ cycle = adapter->cycle_time; ++ base_time = adapter->base_time; ++ + nsec = rd32(IGC_SYSTIML); + sec = rd32(IGC_SYSTIMH); + + systim = ktime_set(sec, nsec); +- + if (ktime_compare(systim, base_time) > 0) { +- s64 n; ++ s64 n = div64_s64(ktime_sub_ns(systim, base_time), cycle); + +- n = div64_s64(ktime_sub_ns(systim, base_time), cycle); + base_time = ktime_add_ns(base_time, (n + 1) * cycle); ++ } else { ++ /* According to datasheet section 7.5.2.9.3.3, FutScdDis bit ++ * has to be configured before the cycle time and base time. ++ */ ++ if (igc_is_device_id_i226(hw)) ++ tqavctrl |= IGC_TQAVCTRL_FUTSCDDIS; + } + +- baset_h = div_s64_rem(base_time, NSEC_PER_SEC, &baset_l); ++ wr32(IGC_TQAVCTRL, tqavctrl); ++ ++ wr32(IGC_QBVCYCLET_S, cycle); ++ wr32(IGC_QBVCYCLET, cycle); + ++ baset_h = div_s64_rem(base_time, NSEC_PER_SEC, &baset_l); + wr32(IGC_BASET_H, baset_h); ++ ++ /* In i226, Future base time is only supported when FutScdDis bit ++ * is enabled and only active for re-configuration. ++ * In this case, initialize the base time with zero to create ++ * "re-configuration" scenario then only set the desired base time. ++ */ ++ if (tqavctrl & IGC_TQAVCTRL_FUTSCDDIS) ++ wr32(IGC_BASET_L, 0); + wr32(IGC_BASET_L, baset_l); + + return 0; +-- +2.43.0 + diff --git a/queue-5.15/mlxbf_gige-disable-rx-filters-until-rx-path-initiali.patch b/queue-5.15/mlxbf_gige-disable-rx-filters-until-rx-path-initiali.patch new file mode 100644 index 00000000000..d1d0640ac62 --- /dev/null +++ b/queue-5.15/mlxbf_gige-disable-rx-filters-until-rx-path-initiali.patch @@ -0,0 +1,188 @@ +From b0a3f489f1b6ee18c09012bee62ab80adc180518 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2024 12:36:12 -0400 +Subject: mlxbf_gige: disable RX filters until RX path initialized + +From: David Thompson + +[ Upstream commit df934abb185c71c9f2fa07a5013672d0cbd36560 ] + +A recent change to the driver exposed a bug where the MAC RX +filters (unicast MAC, broadcast MAC, and multicast MAC) are +configured and enabled before the RX path is fully initialized. +The result of this bug is that after the PHY is started packets +that match these MAC RX filters start to flow into the RX FIFO. +And then, after rx_init() is completed, these packets will go +into the driver RX ring as well. If enough packets are received +to fill the RX ring (default size is 128 packets) before the call +to request_irq() completes, the driver RX function becomes stuck. + +This bug is intermittent but is most likely to be seen where the +oob_net0 interface is connected to a busy network with lots of +broadcast and multicast traffic. + +All the MAC RX filters must be disabled until the RX path is ready, +i.e. all initialization is done and all the IRQs are installed. + +Fixes: f7442a634ac0 ("mlxbf_gige: call request_irq() after NAPI initialized") +Reviewed-by: Asmaa Mnebhi +Signed-off-by: David Thompson +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20240809163612.12852-1-davthompson@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlxbf_gige/mlxbf_gige.h | 8 +++ + .../mellanox/mlxbf_gige/mlxbf_gige_main.c | 10 ++++ + .../mellanox/mlxbf_gige/mlxbf_gige_regs.h | 2 + + .../mellanox/mlxbf_gige/mlxbf_gige_rx.c | 50 ++++++++++++++++--- + 4 files changed, 64 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h +index 13ba044e7d9a4..0e4ece5ab7976 100644 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h ++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h +@@ -39,6 +39,7 @@ + */ + #define MLXBF_GIGE_BCAST_MAC_FILTER_IDX 0 + #define MLXBF_GIGE_LOCAL_MAC_FILTER_IDX 1 ++#define MLXBF_GIGE_MAX_FILTER_IDX 3 + + /* Define for broadcast MAC literal */ + #define BCAST_MAC_ADDR 0xFFFFFFFFFFFF +@@ -151,6 +152,13 @@ enum mlxbf_gige_res { + int mlxbf_gige_mdio_probe(struct platform_device *pdev, + struct mlxbf_gige *priv); + void mlxbf_gige_mdio_remove(struct mlxbf_gige *priv); ++ ++void mlxbf_gige_enable_multicast_rx(struct mlxbf_gige *priv); ++void mlxbf_gige_disable_multicast_rx(struct mlxbf_gige *priv); ++void mlxbf_gige_enable_mac_rx_filter(struct mlxbf_gige *priv, ++ unsigned int index); ++void mlxbf_gige_disable_mac_rx_filter(struct mlxbf_gige *priv, ++ unsigned int index); + void mlxbf_gige_set_mac_rx_filter(struct mlxbf_gige *priv, + unsigned int index, u64 dmac); + void mlxbf_gige_get_mac_rx_filter(struct mlxbf_gige *priv, +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +index c644ee78e0b40..60cea337fe8ec 100644 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c ++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +@@ -170,6 +170,10 @@ static int mlxbf_gige_open(struct net_device *netdev) + if (err) + goto napi_deinit; + ++ mlxbf_gige_enable_mac_rx_filter(priv, MLXBF_GIGE_BCAST_MAC_FILTER_IDX); ++ mlxbf_gige_enable_mac_rx_filter(priv, MLXBF_GIGE_LOCAL_MAC_FILTER_IDX); ++ mlxbf_gige_enable_multicast_rx(priv); ++ + /* Set bits in INT_EN that we care about */ + int_en = MLXBF_GIGE_INT_EN_HW_ACCESS_ERROR | + MLXBF_GIGE_INT_EN_TX_CHECKSUM_INPUTS | +@@ -295,6 +299,7 @@ static int mlxbf_gige_probe(struct platform_device *pdev) + void __iomem *plu_base; + void __iomem *base; + int addr, phy_irq; ++ unsigned int i; + int err; + + base = devm_platform_ioremap_resource(pdev, MLXBF_GIGE_RES_MAC); +@@ -337,6 +342,11 @@ static int mlxbf_gige_probe(struct platform_device *pdev) + priv->rx_q_entries = MLXBF_GIGE_DEFAULT_RXQ_SZ; + priv->tx_q_entries = MLXBF_GIGE_DEFAULT_TXQ_SZ; + ++ for (i = 0; i <= MLXBF_GIGE_MAX_FILTER_IDX; i++) ++ mlxbf_gige_disable_mac_rx_filter(priv, i); ++ mlxbf_gige_disable_multicast_rx(priv); ++ mlxbf_gige_disable_promisc(priv); ++ + /* Write initial MAC address to hardware */ + mlxbf_gige_initial_mac(priv); + +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_regs.h b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_regs.h +index 7be3a793984d5..d27535a1fb86f 100644 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_regs.h ++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_regs.h +@@ -59,6 +59,8 @@ + #define MLXBF_GIGE_TX_STATUS_DATA_FIFO_FULL BIT(1) + #define MLXBF_GIGE_RX_MAC_FILTER_DMAC_RANGE_START 0x0520 + #define MLXBF_GIGE_RX_MAC_FILTER_DMAC_RANGE_END 0x0528 ++#define MLXBF_GIGE_RX_MAC_FILTER_GENERAL 0x0530 ++#define MLXBF_GIGE_RX_MAC_FILTER_EN_MULTICAST BIT(1) + #define MLXBF_GIGE_RX_MAC_FILTER_COUNT_DISC 0x0540 + #define MLXBF_GIGE_RX_MAC_FILTER_COUNT_DISC_EN BIT(0) + #define MLXBF_GIGE_RX_MAC_FILTER_COUNT_PASS 0x0548 +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c +index 6999843584934..eb62620b63c7f 100644 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c ++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c +@@ -11,15 +11,31 @@ + #include "mlxbf_gige.h" + #include "mlxbf_gige_regs.h" + +-void mlxbf_gige_set_mac_rx_filter(struct mlxbf_gige *priv, +- unsigned int index, u64 dmac) ++void mlxbf_gige_enable_multicast_rx(struct mlxbf_gige *priv) + { + void __iomem *base = priv->base; +- u64 control; ++ u64 data; + +- /* Write destination MAC to specified MAC RX filter */ +- writeq(dmac, base + MLXBF_GIGE_RX_MAC_FILTER + +- (index * MLXBF_GIGE_RX_MAC_FILTER_STRIDE)); ++ data = readq(base + MLXBF_GIGE_RX_MAC_FILTER_GENERAL); ++ data |= MLXBF_GIGE_RX_MAC_FILTER_EN_MULTICAST; ++ writeq(data, base + MLXBF_GIGE_RX_MAC_FILTER_GENERAL); ++} ++ ++void mlxbf_gige_disable_multicast_rx(struct mlxbf_gige *priv) ++{ ++ void __iomem *base = priv->base; ++ u64 data; ++ ++ data = readq(base + MLXBF_GIGE_RX_MAC_FILTER_GENERAL); ++ data &= ~MLXBF_GIGE_RX_MAC_FILTER_EN_MULTICAST; ++ writeq(data, base + MLXBF_GIGE_RX_MAC_FILTER_GENERAL); ++} ++ ++void mlxbf_gige_enable_mac_rx_filter(struct mlxbf_gige *priv, ++ unsigned int index) ++{ ++ void __iomem *base = priv->base; ++ u64 control; + + /* Enable MAC receive filter mask for specified index */ + control = readq(base + MLXBF_GIGE_CONTROL); +@@ -27,6 +43,28 @@ void mlxbf_gige_set_mac_rx_filter(struct mlxbf_gige *priv, + writeq(control, base + MLXBF_GIGE_CONTROL); + } + ++void mlxbf_gige_disable_mac_rx_filter(struct mlxbf_gige *priv, ++ unsigned int index) ++{ ++ void __iomem *base = priv->base; ++ u64 control; ++ ++ /* Disable MAC receive filter mask for specified index */ ++ control = readq(base + MLXBF_GIGE_CONTROL); ++ control &= ~(MLXBF_GIGE_CONTROL_EN_SPECIFIC_MAC << index); ++ writeq(control, base + MLXBF_GIGE_CONTROL); ++} ++ ++void mlxbf_gige_set_mac_rx_filter(struct mlxbf_gige *priv, ++ unsigned int index, u64 dmac) ++{ ++ void __iomem *base = priv->base; ++ ++ /* Write destination MAC to specified MAC RX filter */ ++ writeq(dmac, base + MLXBF_GIGE_RX_MAC_FILTER + ++ (index * MLXBF_GIGE_RX_MAC_FILTER_STRIDE)); ++} ++ + void mlxbf_gige_get_mac_rx_filter(struct mlxbf_gige *priv, + unsigned int index, u64 *dmac) + { +-- +2.43.0 + diff --git a/queue-5.15/mlxbf_gige-remove-two-unused-function-declarations.patch b/queue-5.15/mlxbf_gige-remove-two-unused-function-declarations.patch new file mode 100644 index 00000000000..bc47255ecfb --- /dev/null +++ b/queue-5.15/mlxbf_gige-remove-two-unused-function-declarations.patch @@ -0,0 +1,40 @@ +From 2bd82340f27bf4ececbc4229743b82d4f638b27e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Aug 2023 22:52:49 +0800 +Subject: mlxbf_gige: Remove two unused function declarations + +From: Yue Haibing + +[ Upstream commit 98261be155f8de38f11b6542d4a8935e5532687b ] + +Commit f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver") +declared but never implemented these. + +Signed-off-by: Yue Haibing +Reviewed-by: Simon Horman +Reviewed-by: Asmaa Mnebhi +Link: https://lore.kernel.org/r/20230808145249.41596-1-yuehaibing@huawei.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: df934abb185c ("mlxbf_gige: disable RX filters until RX path initialized") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h +index 0fdf2c8ca480d..13ba044e7d9a4 100644 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h ++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h +@@ -151,9 +151,6 @@ enum mlxbf_gige_res { + int mlxbf_gige_mdio_probe(struct platform_device *pdev, + struct mlxbf_gige *priv); + void mlxbf_gige_mdio_remove(struct mlxbf_gige *priv); +-irqreturn_t mlxbf_gige_mdio_handle_phy_interrupt(int irq, void *dev_id); +-void mlxbf_gige_mdio_enable_phy_int(struct mlxbf_gige *priv); +- + void mlxbf_gige_set_mac_rx_filter(struct mlxbf_gige *priv, + unsigned int index, u64 dmac); + void mlxbf_gige_get_mac_rx_filter(struct mlxbf_gige *priv, +-- +2.43.0 + diff --git a/queue-5.15/mptcp-correct-mptcp_subflow_attr_ssn_offset-reserved.patch b/queue-5.15/mptcp-correct-mptcp_subflow_attr_ssn_offset-reserved.patch new file mode 100644 index 00000000000..df24285e769 --- /dev/null +++ b/queue-5.15/mptcp-correct-mptcp_subflow_attr_ssn_offset-reserved.patch @@ -0,0 +1,42 @@ +From dea66b84fe829dcbf4dcd3a4ddadb6630bff1d26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Aug 2024 08:51:23 +0200 +Subject: mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size + +From: Eugene Syromiatnikov + +[ Upstream commit 655111b838cdabdb604f3625a9ff08c5eedb11da ] + +ssn_offset field is u32 and is placed into the netlink response with +nla_put_u32(), but only 2 bytes are reserved for the attribute payload +in subflow_get_info_size() (even though it makes no difference +in the end, as it is aligned up to 4 bytes). Supply the correct +argument to the relevant nla_total_size() call to make it less +confusing. + +Fixes: 5147dfb50832 ("mptcp: allow dumping subflow context to userspace") +Signed-off-by: Eugene Syromiatnikov +Reviewed-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20240812065024.GA19719@asgard.redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mptcp/diag.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mptcp/diag.c b/net/mptcp/diag.c +index d7ca71c597545..23bd18084c8a2 100644 +--- a/net/mptcp/diag.c ++++ b/net/mptcp/diag.c +@@ -95,7 +95,7 @@ static size_t subflow_get_info_size(const struct sock *sk) + nla_total_size(4) + /* MPTCP_SUBFLOW_ATTR_RELWRITE_SEQ */ + nla_total_size_64bit(8) + /* MPTCP_SUBFLOW_ATTR_MAP_SEQ */ + nla_total_size(4) + /* MPTCP_SUBFLOW_ATTR_MAP_SFSEQ */ +- nla_total_size(2) + /* MPTCP_SUBFLOW_ATTR_SSN_OFFSET */ ++ nla_total_size(4) + /* MPTCP_SUBFLOW_ATTR_SSN_OFFSET */ + nla_total_size(2) + /* MPTCP_SUBFLOW_ATTR_MAP_DATALEN */ + nla_total_size(4) + /* MPTCP_SUBFLOW_ATTR_FLAGS */ + nla_total_size(1) + /* MPTCP_SUBFLOW_ATTR_ID_REM */ +-- +2.43.0 + diff --git a/queue-5.15/net-axienet-fix-register-defines-comment-description.patch b/queue-5.15/net-axienet-fix-register-defines-comment-description.patch new file mode 100644 index 00000000000..e9b35baadc1 --- /dev/null +++ b/queue-5.15/net-axienet-fix-register-defines-comment-description.patch @@ -0,0 +1,62 @@ +From ee6bf9d3c5786dbe2efa51f06c48aee8295c1af6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2024 11:56:09 +0530 +Subject: net: axienet: Fix register defines comment description + +From: Radhey Shyam Pandey + +[ Upstream commit 9ff2f816e2aa65ca9a1cdf0954842f8173c0f48d ] + +In axiethernet header fix register defines comment description to be +inline with IP documentation. It updates MAC configuration register, +MDIO configuration register and frame filter control description. + +Fixes: 8a3b7a252dca ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver") +Signed-off-by: Radhey Shyam Pandey +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/xilinx/xilinx_axienet.h | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet.h b/drivers/net/ethernet/xilinx/xilinx_axienet.h +index 5b4d153b1492c..cbf637078c38a 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet.h ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet.h +@@ -159,16 +159,16 @@ + #define XAE_RCW1_OFFSET 0x00000404 /* Rx Configuration Word 1 */ + #define XAE_TC_OFFSET 0x00000408 /* Tx Configuration */ + #define XAE_FCC_OFFSET 0x0000040C /* Flow Control Configuration */ +-#define XAE_EMMC_OFFSET 0x00000410 /* EMAC mode configuration */ +-#define XAE_PHYC_OFFSET 0x00000414 /* RGMII/SGMII configuration */ ++#define XAE_EMMC_OFFSET 0x00000410 /* MAC speed configuration */ ++#define XAE_PHYC_OFFSET 0x00000414 /* RX Max Frame Configuration */ + #define XAE_ID_OFFSET 0x000004F8 /* Identification register */ +-#define XAE_MDIO_MC_OFFSET 0x00000500 /* MII Management Config */ +-#define XAE_MDIO_MCR_OFFSET 0x00000504 /* MII Management Control */ +-#define XAE_MDIO_MWD_OFFSET 0x00000508 /* MII Management Write Data */ +-#define XAE_MDIO_MRD_OFFSET 0x0000050C /* MII Management Read Data */ ++#define XAE_MDIO_MC_OFFSET 0x00000500 /* MDIO Setup */ ++#define XAE_MDIO_MCR_OFFSET 0x00000504 /* MDIO Control */ ++#define XAE_MDIO_MWD_OFFSET 0x00000508 /* MDIO Write Data */ ++#define XAE_MDIO_MRD_OFFSET 0x0000050C /* MDIO Read Data */ + #define XAE_UAW0_OFFSET 0x00000700 /* Unicast address word 0 */ + #define XAE_UAW1_OFFSET 0x00000704 /* Unicast address word 1 */ +-#define XAE_FMI_OFFSET 0x00000708 /* Filter Mask Index */ ++#define XAE_FMI_OFFSET 0x00000708 /* Frame Filter Control */ + #define XAE_AF0_OFFSET 0x00000710 /* Address Filter 0 */ + #define XAE_AF1_OFFSET 0x00000714 /* Address Filter 1 */ + +@@ -307,7 +307,7 @@ + */ + #define XAE_UAW1_UNICASTADDR_MASK 0x0000FFFF + +-/* Bit masks for Axi Ethernet FMI register */ ++/* Bit masks for Axi Ethernet FMC register */ + #define XAE_FMI_PM_MASK 0x80000000 /* Promis. mode enable */ + #define XAE_FMI_IND_MASK 0x00000003 /* Index Mask */ + +-- +2.43.0 + diff --git a/queue-5.15/net-dsa-vsc73xx-check-busy-flag-in-mdio-operations.patch b/queue-5.15/net-dsa-vsc73xx-check-busy-flag-in-mdio-operations.patch new file mode 100644 index 00000000000..122582d49bc --- /dev/null +++ b/queue-5.15/net-dsa-vsc73xx-check-busy-flag-in-mdio-operations.patch @@ -0,0 +1,114 @@ +From 0f66d73a630103cae8e0656d0d8411feeb3118e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2024 21:38:04 +0200 +Subject: net: dsa: vsc73xx: check busy flag in MDIO operations + +From: Pawel Dembicki + +[ Upstream commit fa63c6434b6f6aaf9d8d599dc899bc0a074cc0ad ] + +The VSC73xx has a busy flag used during MDIO operations. It is raised +when MDIO read/write operations are in progress. Without it, PHYs are +misconfigured and bus operations do not work as expected. + +Fixes: 05bd97fc559d ("net: dsa: Add Vitesse VSC73xx DSA router driver") +Reviewed-by: Linus Walleij +Reviewed-by: Florian Fainelli +Signed-off-by: Pawel Dembicki +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/vitesse-vsc73xx-core.c | 37 +++++++++++++++++++++++++- + 1 file changed, 36 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/vitesse-vsc73xx-core.c b/drivers/net/dsa/vitesse-vsc73xx-core.c +index ce1c6d6eeb606..592527f069446 100644 +--- a/drivers/net/dsa/vitesse-vsc73xx-core.c ++++ b/drivers/net/dsa/vitesse-vsc73xx-core.c +@@ -39,6 +39,10 @@ + #define VSC73XX_BLOCK_ARBITER 0x5 /* Only subblock 0 */ + #define VSC73XX_BLOCK_SYSTEM 0x7 /* Only subblock 0 */ + ++/* MII Block subblock */ ++#define VSC73XX_BLOCK_MII_INTERNAL 0x0 /* Internal MDIO subblock */ ++#define VSC73XX_BLOCK_MII_EXTERNAL 0x1 /* External MDIO subblock */ ++ + #define CPU_PORT 6 /* CPU port */ + + /* MAC Block registers */ +@@ -197,6 +201,8 @@ + #define VSC73XX_MII_CMD 0x1 + #define VSC73XX_MII_DATA 0x2 + ++#define VSC73XX_MII_STAT_BUSY BIT(3) ++ + /* Arbiter block 5 registers */ + #define VSC73XX_ARBEMPTY 0x0c + #define VSC73XX_ARBDISC 0x0e +@@ -271,6 +277,7 @@ + #define IS_739X(a) (IS_7395(a) || IS_7398(a)) + + #define VSC73XX_POLL_SLEEP_US 1000 ++#define VSC73XX_MDIO_POLL_SLEEP_US 5 + #define VSC73XX_POLL_TIMEOUT_US 10000 + + struct vsc73xx_counter { +@@ -488,6 +495,22 @@ static int vsc73xx_detect(struct vsc73xx *vsc) + return 0; + } + ++static int vsc73xx_mdio_busy_check(struct vsc73xx *vsc) ++{ ++ int ret, err; ++ u32 val; ++ ++ ret = read_poll_timeout(vsc73xx_read, err, ++ err < 0 || !(val & VSC73XX_MII_STAT_BUSY), ++ VSC73XX_MDIO_POLL_SLEEP_US, ++ VSC73XX_POLL_TIMEOUT_US, false, vsc, ++ VSC73XX_BLOCK_MII, VSC73XX_BLOCK_MII_INTERNAL, ++ VSC73XX_MII_STAT, &val); ++ if (ret) ++ return ret; ++ return err; ++} ++ + static int vsc73xx_phy_read(struct dsa_switch *ds, int phy, int regnum) + { + struct vsc73xx *vsc = ds->priv; +@@ -495,12 +518,20 @@ static int vsc73xx_phy_read(struct dsa_switch *ds, int phy, int regnum) + u32 val; + int ret; + ++ ret = vsc73xx_mdio_busy_check(vsc); ++ if (ret) ++ return ret; ++ + /* Setting bit 26 means "read" */ + cmd = BIT(26) | (phy << 21) | (regnum << 16); + ret = vsc73xx_write(vsc, VSC73XX_BLOCK_MII, 0, 1, cmd); + if (ret) + return ret; +- msleep(2); ++ ++ ret = vsc73xx_mdio_busy_check(vsc); ++ if (ret) ++ return ret; ++ + ret = vsc73xx_read(vsc, VSC73XX_BLOCK_MII, 0, 2, &val); + if (ret) + return ret; +@@ -524,6 +555,10 @@ static int vsc73xx_phy_write(struct dsa_switch *ds, int phy, int regnum, + u32 cmd; + int ret; + ++ ret = vsc73xx_mdio_busy_check(vsc); ++ if (ret) ++ return ret; ++ + /* It was found through tedious experiments that this router + * chip really hates to have it's PHYs reset. They + * never recover if that happens: autonegotiation stops +-- +2.43.0 + diff --git a/queue-5.15/net-dsa-vsc73xx-pass-value-in-phy_write-operation.patch b/queue-5.15/net-dsa-vsc73xx-pass-value-in-phy_write-operation.patch new file mode 100644 index 00000000000..83898ce851a --- /dev/null +++ b/queue-5.15/net-dsa-vsc73xx-pass-value-in-phy_write-operation.patch @@ -0,0 +1,40 @@ +From dab57b3dbdae2ba5bec5e2dd24ad1f5a9e169bec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2024 21:38:03 +0200 +Subject: net: dsa: vsc73xx: pass value in phy_write operation + +From: Pawel Dembicki + +[ Upstream commit 5b9eebc2c7a5f0cc7950d918c1e8a4ad4bed5010 ] + +In the 'vsc73xx_phy_write' function, the register value is missing, +and the phy write operation always sends zeros. + +This commit passes the value variable into the proper register. + +Fixes: 05bd97fc559d ("net: dsa: Add Vitesse VSC73xx DSA router driver") +Reviewed-by: Linus Walleij +Reviewed-by: Florian Fainelli +Signed-off-by: Pawel Dembicki +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/vitesse-vsc73xx-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/vitesse-vsc73xx-core.c b/drivers/net/dsa/vitesse-vsc73xx-core.c +index 6b6470ef2ae93..15afb84155472 100644 +--- a/drivers/net/dsa/vitesse-vsc73xx-core.c ++++ b/drivers/net/dsa/vitesse-vsc73xx-core.c +@@ -531,7 +531,7 @@ static int vsc73xx_phy_write(struct dsa_switch *ds, int phy, int regnum, + return 0; + } + +- cmd = (phy << 21) | (regnum << 16); ++ cmd = (phy << 21) | (regnum << 16) | val; + ret = vsc73xx_write(vsc, VSC73XX_BLOCK_MII, 0, 1, cmd); + if (ret) + return ret; +-- +2.43.0 + diff --git a/queue-5.15/net-dsa-vsc73xx-use-read_poll_timeout-instead-delay-.patch b/queue-5.15/net-dsa-vsc73xx-use-read_poll_timeout-instead-delay-.patch new file mode 100644 index 00000000000..1f27ff944fb --- /dev/null +++ b/queue-5.15/net-dsa-vsc73xx-use-read_poll_timeout-instead-delay-.patch @@ -0,0 +1,100 @@ +From ce41bc649bca494b5095f52ec21aa92bfd111f65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Apr 2024 22:50:44 +0200 +Subject: net: dsa: vsc73xx: use read_poll_timeout instead delay loop + +From: Pawel Dembicki + +[ Upstream commit eb7e33d01db3aec128590391b2397384bab406b6 ] + +Switch the delay loop during the Arbiter empty check from +vsc73xx_adjust_link() to use read_poll_timeout(). Functionally, +one msleep() call is eliminated at the end of the loop in the timeout +case. + +As Russell King suggested: + +"This [change] avoids the issue that on the last iteration, the code reads +the register, tests it, finds the condition that's being waiting for is +false, _then_ waits and end up printing the error message - that last +wait is rather useless, and as the arbiter state isn't checked after +waiting, it could be that we had success during the last wait." + +Suggested-by: Russell King +Reviewed-by: Andrew Lunn +Reviewed-by: Linus Walleij +Reviewed-by: Florian Fainelli +Signed-off-by: Pawel Dembicki +Link: https://lore.kernel.org/r/20240417205048.3542839-2-paweldembicki@gmail.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: fa63c6434b6f ("net: dsa: vsc73xx: check busy flag in MDIO operations") +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/vitesse-vsc73xx-core.c | 30 ++++++++++++++------------ + 1 file changed, 16 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/dsa/vitesse-vsc73xx-core.c b/drivers/net/dsa/vitesse-vsc73xx-core.c +index 15afb84155472..ce1c6d6eeb606 100644 +--- a/drivers/net/dsa/vitesse-vsc73xx-core.c ++++ b/drivers/net/dsa/vitesse-vsc73xx-core.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -269,6 +270,9 @@ + #define IS_7398(a) ((a)->chipid == VSC73XX_CHIPID_ID_7398) + #define IS_739X(a) (IS_7395(a) || IS_7398(a)) + ++#define VSC73XX_POLL_SLEEP_US 1000 ++#define VSC73XX_POLL_TIMEOUT_US 10000 ++ + struct vsc73xx_counter { + u8 counter; + const char *name; +@@ -780,7 +784,7 @@ static void vsc73xx_adjust_link(struct dsa_switch *ds, int port, + * after a PHY or the CPU port comes up or down. + */ + if (!phydev->link) { +- int maxloop = 10; ++ int ret, err; + + dev_dbg(vsc->dev, "port %d: went down\n", + port); +@@ -795,19 +799,17 @@ static void vsc73xx_adjust_link(struct dsa_switch *ds, int port, + VSC73XX_ARBDISC, BIT(port), BIT(port)); + + /* Wait until queue is empty */ +- vsc73xx_read(vsc, VSC73XX_BLOCK_ARBITER, 0, +- VSC73XX_ARBEMPTY, &val); +- while (!(val & BIT(port))) { +- msleep(1); +- vsc73xx_read(vsc, VSC73XX_BLOCK_ARBITER, 0, +- VSC73XX_ARBEMPTY, &val); +- if (--maxloop == 0) { +- dev_err(vsc->dev, +- "timeout waiting for block arbiter\n"); +- /* Continue anyway */ +- break; +- } +- } ++ ret = read_poll_timeout(vsc73xx_read, err, ++ err < 0 || (val & BIT(port)), ++ VSC73XX_POLL_SLEEP_US, ++ VSC73XX_POLL_TIMEOUT_US, false, ++ vsc, VSC73XX_BLOCK_ARBITER, 0, ++ VSC73XX_ARBEMPTY, &val); ++ if (ret) ++ dev_err(vsc->dev, ++ "timeout waiting for block arbiter\n"); ++ else if (err < 0) ++ dev_err(vsc->dev, "error reading arbiter\n"); + + /* Put this port into reset */ + vsc73xx_write(vsc, VSC73XX_BLOCK_MAC, port, VSC73XX_MAC_CFG, +-- +2.43.0 + diff --git a/queue-5.15/net-hns3-fix-a-deadlock-problem-when-config-tc-durin.patch b/queue-5.15/net-hns3-fix-a-deadlock-problem-when-config-tc-durin.patch new file mode 100644 index 00000000000..cb1f05ddc8d --- /dev/null +++ b/queue-5.15/net-hns3-fix-a-deadlock-problem-when-config-tc-durin.patch @@ -0,0 +1,76 @@ +From cac13954bccbc9d7050eeeb7d5ce115159d0400f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Aug 2024 22:10:22 +0800 +Subject: net: hns3: fix a deadlock problem when config TC during resetting +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jie Wang + +[ Upstream commit be5e816d00a506719e9dbb1a9c861c5ced30a109 ] + +When config TC during the reset process, may cause a deadlock, the flow is +as below: + pf reset start + │ + ▼ + ...... +setup tc │ + │ ▼ + ▼ DOWN: napi_disable() +napi_disable()(skip) │ + │ │ + ▼ ▼ + ...... ...... + │ │ + ▼ │ +napi_enable() │ + ▼ + UINIT: netif_napi_del() + │ + ▼ + ...... + │ + ▼ + INIT: netif_napi_add() + │ + ▼ + ...... global reset start + │ │ + ▼ ▼ + UP: napi_enable()(skip) ...... + │ │ + ▼ ▼ + ...... napi_disable() + +In reset process, the driver will DOWN the port and then UINIT, in this +case, the setup tc process will UP the port before UINIT, so cause the +problem. Adds a DOWN process in UINIT to fix it. + +Fixes: bb6b94a896d4 ("net: hns3: Add reset interface implementation in client") +Signed-off-by: Jie Wang +Signed-off-by: Jijie Shao +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index e48d33927c176..d6bdcd9f285b0 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -5504,6 +5504,9 @@ static int hns3_reset_notify_uninit_enet(struct hnae3_handle *handle) + struct net_device *netdev = handle->kinfo.netdev; + struct hns3_nic_priv *priv = netdev_priv(netdev); + ++ if (!test_bit(HNS3_NIC_STATE_DOWN, &priv->state)) ++ hns3_nic_net_stop(netdev); ++ + if (!test_and_clear_bit(HNS3_NIC_STATE_INITED, &priv->state)) { + netdev_warn(netdev, "already uninitialized\n"); + return 0; +-- +2.43.0 + diff --git a/queue-5.15/net-hns3-fix-wrong-use-of-semaphore-up.patch b/queue-5.15/net-hns3-fix-wrong-use-of-semaphore-up.patch new file mode 100644 index 00000000000..b8dac4aff62 --- /dev/null +++ b/queue-5.15/net-hns3-fix-wrong-use-of-semaphore-up.patch @@ -0,0 +1,61 @@ +From d1c91007b2b444234ffa63b9b07d64c9a6792bc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Aug 2024 22:10:20 +0800 +Subject: net: hns3: fix wrong use of semaphore up + +From: Jie Wang + +[ Upstream commit 8445d9d3c03101859663d34fda747f6a50947556 ] + +Currently, if hns3 PF or VF FLR reset failed after five times retry, +the reset done process will directly release the semaphore +which has already released in hclge_reset_prepare_general. +This will cause down operation fail. + +So this patch fixes it by adding reset state judgement. The up operation is +only called after successful PF FLR reset. + +Fixes: 8627bdedc435 ("net: hns3: refactor the precedure of PF FLR") +Fixes: f28368bb4542 ("net: hns3: refactor the procedure of VF FLR") +Signed-off-by: Jie Wang +Signed-off-by: Jijie Shao +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 ++-- + drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index c3690e49c3d95..eb902e80a8158 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -11636,8 +11636,8 @@ static void hclge_reset_done(struct hnae3_ae_dev *ae_dev) + dev_err(&hdev->pdev->dev, "fail to rebuild, ret=%d\n", ret); + + hdev->reset_type = HNAE3_NONE_RESET; +- clear_bit(HCLGE_STATE_RST_HANDLING, &hdev->state); +- up(&hdev->reset_sem); ++ if (test_and_clear_bit(HCLGE_STATE_RST_HANDLING, &hdev->state)) ++ up(&hdev->reset_sem); + } + + static void hclge_clear_resetting_state(struct hclge_dev *hdev) +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +index a41e04796b0b6..5b861a2a3e73e 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -2217,8 +2217,8 @@ static void hclgevf_reset_done(struct hnae3_ae_dev *ae_dev) + ret); + + hdev->reset_type = HNAE3_NONE_RESET; +- clear_bit(HCLGEVF_STATE_RST_HANDLING, &hdev->state); +- up(&hdev->reset_sem); ++ if (test_and_clear_bit(HCLGEVF_STATE_RST_HANDLING, &hdev->state)) ++ up(&hdev->reset_sem); + } + + static u32 hclgevf_get_fw_version(struct hnae3_handle *handle) +-- +2.43.0 + diff --git a/queue-5.15/net-mlx5e-correctly-report-errors-for-ethtool-rx-flo.patch b/queue-5.15/net-mlx5e-correctly-report-errors-for-ethtool-rx-flo.patch new file mode 100644 index 00000000000..ef87bb693cb --- /dev/null +++ b/queue-5.15/net-mlx5e-correctly-report-errors-for-ethtool-rx-flo.patch @@ -0,0 +1,46 @@ +From 3cc036a8115c5bdaa3337ae0e6acda0ad464be99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Aug 2024 17:41:05 +0300 +Subject: net/mlx5e: Correctly report errors for ethtool rx flows + +From: Cosmin Ratiu + +[ Upstream commit cbc796be1779c4dbc9a482c7233995e2a8b6bfb3 ] + +Previously, an ethtool rx flow with no attrs would not be added to the +NIC as it has no rules to configure the hw with, but it would be +reported as successful to the caller (return code 0). This is confusing +for the user as ethtool then reports "Added rule $num", but no rule was +actually added. + +This change corrects that by instead reporting these wrong rules as +-EINVAL. + +Fixes: b29c61dac3a2 ("net/mlx5e: Ethtool steering flow validation refactoring") +Signed-off-by: Cosmin Ratiu +Reviewed-by: Saeed Mahameed +Reviewed-by: Dragos Tatulea +Signed-off-by: Tariq Toukan +Link: https://patch.msgid.link/20240808144107.2095424-5-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c +index d32b70c62c949..32212bc41df30 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c +@@ -727,7 +727,7 @@ mlx5e_ethtool_flow_replace(struct mlx5e_priv *priv, + if (num_tuples <= 0) { + netdev_warn(priv->netdev, "%s: flow is not valid %d\n", + __func__, num_tuples); +- return num_tuples; ++ return num_tuples < 0 ? num_tuples : -EINVAL; + } + + eth_ft = get_flow_table(priv, fs, num_tuples); +-- +2.43.0 + diff --git a/queue-5.15/netfilter-allow-ipv6-fragments-to-arrive-on-differen.patch b/queue-5.15/netfilter-allow-ipv6-fragments-to-arrive-on-differen.patch new file mode 100644 index 00000000000..8667249c01c --- /dev/null +++ b/queue-5.15/netfilter-allow-ipv6-fragments-to-arrive-on-differen.patch @@ -0,0 +1,46 @@ +From 87f06490a152f67e8a34cb4c3c7c4c4e339d1823 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Aug 2024 12:40:52 +0100 +Subject: netfilter: allow ipv6 fragments to arrive on different devices + +From: Tom Hughes + +[ Upstream commit 3cd740b985963f874a1a094f1969e998b9d05554 ] + +Commit 264640fc2c5f4 ("ipv6: distinguish frag queues by device +for multicast and link-local packets") modified the ipv6 fragment +reassembly logic to distinguish frag queues by device for multicast +and link-local packets but in fact only the main reassembly code +limits the use of the device to those address types and the netfilter +reassembly code uses the device for all packets. + +This means that if fragments of a packet arrive on different interfaces +then netfilter will fail to reassemble them and the fragments will be +expired without going any further through the filters. + +Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units") +Signed-off-by: Tom Hughes +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/ipv6/netfilter/nf_conntrack_reasm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c +index 5c47be29b9ee9..2e5b090d7c89f 100644 +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c +@@ -155,6 +155,10 @@ static struct frag_queue *fq_find(struct net *net, __be32 id, u32 user, + }; + struct inet_frag_queue *q; + ++ if (!(ipv6_addr_type(&hdr->daddr) & (IPV6_ADDR_MULTICAST | ++ IPV6_ADDR_LINKLOCAL))) ++ key.iif = 0; ++ + q = inet_frag_find(nf_frag->fqdir, &key); + if (!q) + return NULL; +-- +2.43.0 + diff --git a/queue-5.15/netfilter-flowtable-initialise-extack-before-use.patch b/queue-5.15/netfilter-flowtable-initialise-extack-before-use.patch new file mode 100644 index 00000000000..729af245662 --- /dev/null +++ b/queue-5.15/netfilter-flowtable-initialise-extack-before-use.patch @@ -0,0 +1,37 @@ +From 8144c3fa1117410e27ce85bdc910ef4bd9301bac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Aug 2024 17:16:37 +0100 +Subject: netfilter: flowtable: initialise extack before use + +From: Donald Hunter + +[ Upstream commit e9767137308daf906496613fd879808a07f006a2 ] + +Fix missing initialisation of extack in flow offload. + +Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") +Signed-off-by: Donald Hunter +Reviewed-by: Simon Horman +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_flow_table_offload.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c +index 6ac1ebe17456d..d8cb304f809e5 100644 +--- a/net/netfilter/nf_flow_table_offload.c ++++ b/net/netfilter/nf_flow_table_offload.c +@@ -830,8 +830,8 @@ static int nf_flow_offload_tuple(struct nf_flowtable *flowtable, + struct list_head *block_cb_list) + { + struct flow_cls_offload cls_flow = {}; ++ struct netlink_ext_ack extack = {}; + struct flow_block_cb *block_cb; +- struct netlink_ext_ack extack; + __be16 proto = ETH_P_ALL; + int err, i = 0; + +-- +2.43.0 + diff --git a/queue-5.15/netfilter-nf_queue-drop-packets-with-cloned-unconfir.patch b/queue-5.15/netfilter-nf_queue-drop-packets-with-cloned-unconfir.patch new file mode 100644 index 00000000000..cce3ac5ed6d --- /dev/null +++ b/queue-5.15/netfilter-nf_queue-drop-packets-with-cloned-unconfir.patch @@ -0,0 +1,109 @@ +From 9377e00f1913a04654dc9e52fb0004410c6eb8b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Aug 2024 21:28:41 +0200 +Subject: netfilter: nf_queue: drop packets with cloned unconfirmed conntracks + +From: Florian Westphal + +[ Upstream commit 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb ] + +Conntrack assumes an unconfirmed entry (not yet committed to global hash +table) has a refcount of 1 and is not visible to other cores. + +With multicast forwarding this assumption breaks down because such +skbs get cloned after being picked up, i.e. ct->use refcount is > 1. + +Likewise, bridge netfilter will clone broad/mutlicast frames and +all frames in case they need to be flood-forwarded during learning +phase. + +For ip multicast forwarding or plain bridge flood-forward this will +"work" because packets don't leave softirq and are implicitly +serialized. + +With nfqueue this no longer holds true, the packets get queued +and can be reinjected in arbitrary ways. + +Disable this feature, I see no other solution. + +After this patch, nfqueue cannot queue packets except the last +multicast/broadcast packet. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/bridge/br_netfilter_hooks.c | 6 +++++- + net/netfilter/nfnetlink_queue.c | 35 +++++++++++++++++++++++++++++++-- + 2 files changed, 38 insertions(+), 3 deletions(-) + +diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c +index 9981e0dfdd4d3..d0d41dbbfe382 100644 +--- a/net/bridge/br_netfilter_hooks.c ++++ b/net/bridge/br_netfilter_hooks.c +@@ -602,8 +602,12 @@ static unsigned int br_nf_local_in(void *priv, + if (likely(nf_ct_is_confirmed(ct))) + return NF_ACCEPT; + ++ if (WARN_ON_ONCE(refcount_read(&nfct->use) != 1)) { ++ nf_reset_ct(skb); ++ return NF_ACCEPT; ++ } ++ + WARN_ON_ONCE(skb_shared(skb)); +- WARN_ON_ONCE(refcount_read(&nfct->use) != 1); + + /* We can't call nf_confirm here, it would create a dependency + * on nf_conntrack module. +diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c +index 89b16d36da9cf..d5f5b93a99a08 100644 +--- a/net/netfilter/nfnetlink_queue.c ++++ b/net/netfilter/nfnetlink_queue.c +@@ -640,10 +640,41 @@ static bool nf_ct_drop_unconfirmed(const struct nf_queue_entry *entry) + { + #if IS_ENABLED(CONFIG_NF_CONNTRACK) + static const unsigned long flags = IPS_CONFIRMED | IPS_DYING; +- const struct nf_conn *ct = (void *)skb_nfct(entry->skb); ++ struct nf_conn *ct = (void *)skb_nfct(entry->skb); ++ unsigned long status; ++ unsigned int use; + +- if (ct && ((ct->status & flags) == IPS_DYING)) ++ if (!ct) ++ return false; ++ ++ status = READ_ONCE(ct->status); ++ if ((status & flags) == IPS_DYING) + return true; ++ ++ if (status & IPS_CONFIRMED) ++ return false; ++ ++ /* in some cases skb_clone() can occur after initial conntrack ++ * pickup, but conntrack assumes exclusive skb->_nfct ownership for ++ * unconfirmed entries. ++ * ++ * This happens for br_netfilter and with ip multicast routing. ++ * We can't be solved with serialization here because one clone could ++ * have been queued for local delivery. ++ */ ++ use = refcount_read(&ct->ct_general.use); ++ if (likely(use == 1)) ++ return false; ++ ++ /* Can't decrement further? Exclusive ownership. */ ++ if (!refcount_dec_not_one(&ct->ct_general.use)) ++ return false; ++ ++ skb_set_nfct(entry->skb, 0); ++ /* No nf_ct_put(): we already decremented .use and it cannot ++ * drop down to 0. ++ */ ++ return true; + #endif + return false; + } +-- +2.43.0 + diff --git a/queue-5.15/s390-uv-panic-for-set-and-remove-shared-access-uvc-e.patch b/queue-5.15/s390-uv-panic-for-set-and-remove-shared-access-uvc-e.patch new file mode 100644 index 00000000000..f28675bab18 --- /dev/null +++ b/queue-5.15/s390-uv-panic-for-set-and-remove-shared-access-uvc-e.patch @@ -0,0 +1,60 @@ +From 61ad85b3ec45d41a702fcfe29db26079abf20aad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Aug 2024 13:25:48 +0200 +Subject: s390/uv: Panic for set and remove shared access UVC errors + +From: Claudio Imbrenda + +[ Upstream commit cff59d8631e1409ffdd22d9d717e15810181b32c ] + +The return value uv_set_shared() and uv_remove_shared() (which are +wrappers around the share() function) is not always checked. The system +integrity of a protected guest depends on the Share and Unshare UVCs +being successful. This means that any caller that fails to check the +return value will compromise the security of the protected guest. + +No code path that would lead to such violation of the security +guarantees is currently exercised, since all the areas that are shared +never get unshared during the lifetime of the system. This might +change and become an issue in the future. + +The Share and Unshare UVCs can only fail in case of hypervisor +misbehaviour (either a bug or malicious behaviour). In such cases there +is no reasonable way forward, and the system needs to panic. + +This patch replaces the return at the end of the share() function with +a panic, to guarantee system integrity. + +Fixes: 5abb9351dfd9 ("s390/uv: introduce guest side ultravisor code") +Signed-off-by: Claudio Imbrenda +Reviewed-by: Christian Borntraeger +Reviewed-by: Steffen Eiden +Reviewed-by: Janosch Frank +Link: https://lore.kernel.org/r/20240801112548.85303-1-imbrenda@linux.ibm.com +Message-ID: <20240801112548.85303-1-imbrenda@linux.ibm.com> +[frankja@linux.ibm.com: Fixed up patch subject] +Signed-off-by: Janosch Frank +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/uv.h | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/s390/include/asm/uv.h b/arch/s390/include/asm/uv.h +index fe92a4caf5ec8..56df0bc01e3a8 100644 +--- a/arch/s390/include/asm/uv.h ++++ b/arch/s390/include/asm/uv.h +@@ -312,7 +312,10 @@ static inline int share(unsigned long addr, u16 cmd) + + if (!uv_call(0, (u64)&uvcb)) + return 0; +- return -EINVAL; ++ pr_err("%s UVC failed (rc: 0x%x, rrc: 0x%x), possible hypervisor bug.\n", ++ uvcb.header.cmd == UVC_CMD_SET_SHARED_ACCESS ? "Share" : "Unshare", ++ uvcb.header.rc, uvcb.header.rrc); ++ panic("System security cannot be guaranteed unless the system panics now.\n"); + } + + /* +-- +2.43.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 6d57dc1f2c5..7f56490734a 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -21,3 +21,22 @@ btrfs-tree-checker-add-dev-extent-item-checks.patch drm-amdgpu-actually-check-flags-for-all-context-ops.patch memcg_write_event_control-fix-a-user-triggerable-oops.patch drm-amdgpu-jpeg2-properly-set-atomics-vmid-field.patch +s390-uv-panic-for-set-and-remove-shared-access-uvc-e.patch +igc-correct-the-launchtime-offset.patch +igc-remove-i226-qbv-basetime-restriction.patch +igc-fix-packet-still-tx-after-gate-close-by-reducing.patch +net-mlx5e-correctly-report-errors-for-ethtool-rx-flo.patch +atm-idt77252-prevent-use-after-free-in-dequeue_rx.patch +net-axienet-fix-register-defines-comment-description.patch +net-dsa-vsc73xx-pass-value-in-phy_write-operation.patch +net-dsa-vsc73xx-use-read_poll_timeout-instead-delay-.patch +net-dsa-vsc73xx-check-busy-flag-in-mdio-operations.patch +mlxbf_gige-remove-two-unused-function-declarations.patch +mlxbf_gige-disable-rx-filters-until-rx-path-initiali.patch +mptcp-correct-mptcp_subflow_attr_ssn_offset-reserved.patch +netfilter-allow-ipv6-fragments-to-arrive-on-differen.patch +netfilter-flowtable-initialise-extack-before-use.patch +netfilter-nf_queue-drop-packets-with-cloned-unconfir.patch +net-hns3-fix-wrong-use-of-semaphore-up.patch +net-hns3-fix-a-deadlock-problem-when-config-tc-durin.patch +alsa-hda-realtek-fix-noise-from-speakers-on-lenovo-i.patch