From: Sasha Levin Date: Sat, 10 Sep 2022 23:50:44 +0000 (-0400) Subject: Fixes for 5.19 X-Git-Tag: v5.19.9~45 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=bbcd93d7753ce4a5ced1fffe1936d961526c2052;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.19 Signed-off-by: Sasha Levin --- diff --git a/queue-5.19/afs-use-the-operation-issue-time-instead-of-the-repl.patch b/queue-5.19/afs-use-the-operation-issue-time-instead-of-the-repl.patch new file mode 100644 index 00000000000..c1882ae9d60 --- /dev/null +++ b/queue-5.19/afs-use-the-operation-issue-time-instead-of-the-repl.patch @@ -0,0 +1,125 @@ +From a730ff826e863b8c76bff7a340ae88abede9deaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Aug 2022 13:16:42 +0100 +Subject: afs: Use the operation issue time instead of the reply time for + callbacks + +From: David Howells + +[ Upstream commit 7903192c4b4a82d792cb0dc5e2779a2efe60d45b ] + +rxrpc and kafs between them try to use the receive timestamp on the first +data packet (ie. the one with sequence number 1) as a base from which to +calculate the time at which callback promise and lock expiration occurs. + +However, we don't know how long it took for the server to send us the reply +from it having completed the basic part of the operation - it might then, +for instance, have to send a bunch of a callback breaks, depending on the +particular operation. + +Fix this by using the time at which the operation is issued on the client +as a base instead. That should never be longer than the server's idea of +the expiry time. + +Fixes: 781070551c26 ("afs: Fix calculation of callback expiry time") +Fixes: 2070a3e44962 ("rxrpc: Allow the reply time to be obtained on a client call") +Suggested-by: Jeffrey E Altman +Signed-off-by: David Howells +Signed-off-by: Sasha Levin +--- + fs/afs/flock.c | 2 +- + fs/afs/fsclient.c | 2 +- + fs/afs/internal.h | 3 +-- + fs/afs/rxrpc.c | 7 +------ + fs/afs/yfsclient.c | 3 +-- + 5 files changed, 5 insertions(+), 12 deletions(-) + +diff --git a/fs/afs/flock.c b/fs/afs/flock.c +index c4210a3964d8b..bbcc5afd15760 100644 +--- a/fs/afs/flock.c ++++ b/fs/afs/flock.c +@@ -76,7 +76,7 @@ void afs_lock_op_done(struct afs_call *call) + if (call->error == 0) { + spin_lock(&vnode->lock); + trace_afs_flock_ev(vnode, NULL, afs_flock_timestamp, 0); +- vnode->locked_at = call->reply_time; ++ vnode->locked_at = call->issue_time; + afs_schedule_lock_extension(vnode); + spin_unlock(&vnode->lock); + } +diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c +index 4943413d9c5f7..7d37f63ef0f09 100644 +--- a/fs/afs/fsclient.c ++++ b/fs/afs/fsclient.c +@@ -131,7 +131,7 @@ static void xdr_decode_AFSFetchStatus(const __be32 **_bp, + + static time64_t xdr_decode_expiry(struct afs_call *call, u32 expiry) + { +- return ktime_divns(call->reply_time, NSEC_PER_SEC) + expiry; ++ return ktime_divns(call->issue_time, NSEC_PER_SEC) + expiry; + } + + static void xdr_decode_AFSCallBack(const __be32 **_bp, +diff --git a/fs/afs/internal.h b/fs/afs/internal.h +index a6f25d9e75b52..28bdd0387e5ea 100644 +--- a/fs/afs/internal.h ++++ b/fs/afs/internal.h +@@ -137,7 +137,6 @@ struct afs_call { + bool need_attention; /* T if RxRPC poked us */ + bool async; /* T if asynchronous */ + bool upgrade; /* T to request service upgrade */ +- bool have_reply_time; /* T if have got reply_time */ + bool intr; /* T if interruptible */ + bool unmarshalling_error; /* T if an unmarshalling error occurred */ + u16 service_id; /* Actual service ID (after upgrade) */ +@@ -151,7 +150,7 @@ struct afs_call { + } __attribute__((packed)); + __be64 tmp64; + }; +- ktime_t reply_time; /* Time of first reply packet */ ++ ktime_t issue_time; /* Time of issue of operation */ + }; + + struct afs_call_type { +diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c +index a5434f3e57c68..e3de7fea36435 100644 +--- a/fs/afs/rxrpc.c ++++ b/fs/afs/rxrpc.c +@@ -347,6 +347,7 @@ void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp) + if (call->max_lifespan) + rxrpc_kernel_set_max_life(call->net->socket, rxcall, + call->max_lifespan); ++ call->issue_time = ktime_get_real(); + + /* send the request */ + iov[0].iov_base = call->request; +@@ -497,12 +498,6 @@ static void afs_deliver_to_call(struct afs_call *call) + return; + } + +- if (!call->have_reply_time && +- rxrpc_kernel_get_reply_time(call->net->socket, +- call->rxcall, +- &call->reply_time)) +- call->have_reply_time = true; +- + ret = call->type->deliver(call); + state = READ_ONCE(call->state); + if (ret == 0 && call->unmarshalling_error) +diff --git a/fs/afs/yfsclient.c b/fs/afs/yfsclient.c +index fdc7d675b4b0c..11571cca86c19 100644 +--- a/fs/afs/yfsclient.c ++++ b/fs/afs/yfsclient.c +@@ -232,8 +232,7 @@ static void xdr_decode_YFSCallBack(const __be32 **_bp, + struct afs_callback *cb = &scb->callback; + ktime_t cb_expiry; + +- cb_expiry = call->reply_time; +- cb_expiry = ktime_add(cb_expiry, xdr_to_u64(x->expiration_time) * 100); ++ cb_expiry = ktime_add(call->issue_time, xdr_to_u64(x->expiration_time) * 100); + cb->expires_at = ktime_divns(cb_expiry, NSEC_PER_SEC); + scb->have_cb = true; + *_bp += xdr_size(x); +-- +2.35.1 + diff --git a/queue-5.19/alsa-usb-audio-inform-the-delayed-registration-more-.patch b/queue-5.19/alsa-usb-audio-inform-the-delayed-registration-more-.patch new file mode 100644 index 00000000000..98853b100bc --- /dev/null +++ b/queue-5.19/alsa-usb-audio-inform-the-delayed-registration-more-.patch @@ -0,0 +1,58 @@ +From 0a0ca7a180672fc949517d45916b9e450d33361c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Aug 2022 14:59:00 +0200 +Subject: ALSA: usb-audio: Inform the delayed registration more properly + +From: Takashi Iwai + +[ Upstream commit 7e1afce5866e02b45bf88c27dd7de1b9dfade1cc ] + +The info message that was added in the commit a4aad5636c72 ("ALSA: +usb-audio: Inform devices that need delayed registration") is actually +useful to know the need for the delayed registration. However, it +turned out that this doesn't catch the all cases; namely, this warned +only when a PCM stream is attached onto the existing PCM instance, but +it doesn't count for a newly created PCM instance. This made +confusion as if there were no further delayed registration. + +This patch moves the check to the code path for either adding a stream +or creating a PCM instance. Also, make it simpler by checking the +card->registered flag instead of querying each snd_device state. + +Fixes: a4aad5636c72 ("ALSA: usb-audio: Inform devices that need delayed registration") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216082 +Link: https://lore.kernel.org/r/20220831125901.4660-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/stream.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/sound/usb/stream.c b/sound/usb/stream.c +index 40ce8a1cb318a..f10f4e6d3fb85 100644 +--- a/sound/usb/stream.c ++++ b/sound/usb/stream.c +@@ -495,6 +495,10 @@ static int __snd_usb_add_audio_stream(struct snd_usb_audio *chip, + return 0; + } + } ++ ++ if (chip->card->registered) ++ chip->need_delayed_register = true; ++ + /* look for an empty stream */ + list_for_each_entry(as, &chip->pcm_list, list) { + if (as->fmt_type != fp->fmt_type) +@@ -502,9 +506,6 @@ static int __snd_usb_add_audio_stream(struct snd_usb_audio *chip, + subs = &as->substream[stream]; + if (subs->ep_num) + continue; +- if (snd_device_get_state(chip->card, as->pcm) != +- SNDRV_DEV_BUILD) +- chip->need_delayed_register = true; + err = snd_pcm_new_stream(as->pcm, stream, 1); + if (err < 0) + return err; +-- +2.35.1 + diff --git a/queue-5.19/alsa-usb-audio-register-card-again-for-iface-over-de.patch b/queue-5.19/alsa-usb-audio-register-card-again-for-iface-over-de.patch new file mode 100644 index 00000000000..462279ace96 --- /dev/null +++ b/queue-5.19/alsa-usb-audio-register-card-again-for-iface-over-de.patch @@ -0,0 +1,60 @@ +From 3917daf7ff8c4755c17eee5144bd9e13aec67f9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Aug 2022 14:59:01 +0200 +Subject: ALSA: usb-audio: Register card again for iface over delayed_register + option + +From: Takashi Iwai + +[ Upstream commit 2027f114686e0f3f1f39971964dfc618637c88c2 ] + +When the delayed registration is specified via either delayed_register +option or the quirk, we delay the invocation of snd_card_register() +until the given interface. But if a wrong value has been set there +and there are more interfaces over the given interface number, +snd_card_register() call would be missing for those interfaces. + +This patch catches up those missing calls by fixing the comparison of +the interface number. Now the call is skipped only if the processed +interface is less than the given interface, instead of the exact +match. + +Fixes: b70038ef4fea ("ALSA: usb-audio: Add delayed_register option") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216082 +Link: https://lore.kernel.org/r/20220831125901.4660-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/card.c | 2 +- + sound/usb/quirks.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/usb/card.c b/sound/usb/card.c +index d356743de2ff9..706d249a9ad6b 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -699,7 +699,7 @@ static bool check_delayed_register_option(struct snd_usb_audio *chip, int iface) + if (delayed_register[i] && + sscanf(delayed_register[i], "%x:%x", &id, &inum) == 2 && + id == chip->usb_id) +- return inum != iface; ++ return iface < inum; + } + + return false; +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 9bfead5efc4c1..5b4d8f5eade20 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1764,7 +1764,7 @@ bool snd_usb_registration_quirk(struct snd_usb_audio *chip, int iface) + + for (q = registration_quirks; q->usb_id; q++) + if (chip->usb_id == q->usb_id) +- return iface != q->interface; ++ return iface < q->interface; + + /* Register as normal */ + return false; +-- +2.35.1 + diff --git a/queue-5.19/arm-at91-pm-fix-ddr-recalibration-when-resuming-from.patch b/queue-5.19/arm-at91-pm-fix-ddr-recalibration-when-resuming-from.patch new file mode 100644 index 00000000000..0b4ca4e209b --- /dev/null +++ b/queue-5.19/arm-at91-pm-fix-ddr-recalibration-when-resuming-from.patch @@ -0,0 +1,104 @@ +From 02a9044e7c94efee47f6064f49db193f2a125ca8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 11:39:21 +0300 +Subject: ARM: at91: pm: fix DDR recalibration when resuming from backup and + self-refresh + +From: Claudiu Beznea + +[ Upstream commit 7a94b83a7dc551607b6c4400df29151e6a951f07 ] + +On SAMA7G5, when resuming from backup and self-refresh, the bootloader +performs DDR PHY recalibration by restoring the value of ZQ0SR0 (stored +in RAM by Linux before going to backup and self-refresh). It has been +discovered that the current procedure doesn't work for all possible values +that might go to ZQ0SR0 due to hardware bug. The workaround to this is to +avoid storing some values in ZQ0SR0. Thus Linux will read the ZQ0SR0 +register and cache its value in RAM after processing it (using +modified_gray_code array). The bootloader will restore the processed value. + +Fixes: d2d4716d8384 ("ARM: at91: pm: save ddr phy calibration data to securam") +Suggested-by: Frederic Schumacher +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20220826083927.3107272-4-claudiu.beznea@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm.c | 36 ++++++++++++++++++++++++++++++++---- + include/soc/at91/sama7-ddr.h | 4 ++++ + 2 files changed, 36 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c +index df6d673e83d56..f4501dea98b04 100644 +--- a/arch/arm/mach-at91/pm.c ++++ b/arch/arm/mach-at91/pm.c +@@ -541,9 +541,41 @@ extern u32 at91_pm_suspend_in_sram_sz; + + static int at91_suspend_finish(unsigned long val) + { ++ unsigned char modified_gray_code[] = { ++ 0x00, 0x01, 0x02, 0x03, 0x06, 0x07, 0x04, 0x05, 0x0c, 0x0d, ++ 0x0e, 0x0f, 0x0a, 0x0b, 0x08, 0x09, 0x18, 0x19, 0x1a, 0x1b, ++ 0x1e, 0x1f, 0x1c, 0x1d, 0x14, 0x15, 0x16, 0x17, 0x12, 0x13, ++ 0x10, 0x11, ++ }; ++ unsigned int tmp, index; + int i; + + if (soc_pm.data.mode == AT91_PM_BACKUP && soc_pm.data.ramc_phy) { ++ /* ++ * Bootloader will perform DDR recalibration and will try to ++ * restore the ZQ0SR0 with the value saved here. But the ++ * calibration is buggy and restoring some values from ZQ0SR0 ++ * is forbidden and risky thus we need to provide processed ++ * values for these (modified gray code values). ++ */ ++ tmp = readl(soc_pm.data.ramc_phy + DDR3PHY_ZQ0SR0); ++ ++ /* Store pull-down output impedance select. */ ++ index = (tmp >> DDR3PHY_ZQ0SR0_PDO_OFF) & 0x1f; ++ soc_pm.bu->ddr_phy_calibration[0] = modified_gray_code[index]; ++ ++ /* Store pull-up output impedance select. */ ++ index = (tmp >> DDR3PHY_ZQ0SR0_PUO_OFF) & 0x1f; ++ soc_pm.bu->ddr_phy_calibration[0] |= modified_gray_code[index]; ++ ++ /* Store pull-down on-die termination impedance select. */ ++ index = (tmp >> DDR3PHY_ZQ0SR0_PDODT_OFF) & 0x1f; ++ soc_pm.bu->ddr_phy_calibration[0] |= modified_gray_code[index]; ++ ++ /* Store pull-up on-die termination impedance select. */ ++ index = (tmp >> DDR3PHY_ZQ0SRO_PUODT_OFF) & 0x1f; ++ soc_pm.bu->ddr_phy_calibration[0] |= modified_gray_code[index]; ++ + /* + * The 1st 8 words of memory might get corrupted in the process + * of DDR PHY recalibration; it is saved here in securam and it +@@ -1066,10 +1098,6 @@ static int __init at91_pm_backup_init(void) + of_scan_flat_dt(at91_pm_backup_scan_memcs, &located); + if (!located) + goto securam_fail; +- +- /* DDR3PHY_ZQ0SR0 */ +- soc_pm.bu->ddr_phy_calibration[0] = readl(soc_pm.data.ramc_phy + +- 0x188); + } + + return 0; +diff --git a/include/soc/at91/sama7-ddr.h b/include/soc/at91/sama7-ddr.h +index 2706bc48c0764..6ce3bd22f6c69 100644 +--- a/include/soc/at91/sama7-ddr.h ++++ b/include/soc/at91/sama7-ddr.h +@@ -38,6 +38,10 @@ + #define DDR3PHY_DSGCR_ODTPDD_ODT0 (1 << 20) /* ODT[0] Power Down Driver */ + + #define DDR3PHY_ZQ0SR0 (0x188) /* ZQ status register 0 */ ++#define DDR3PHY_ZQ0SR0_PDO_OFF (0) /* Pull-down output impedance select offset */ ++#define DDR3PHY_ZQ0SR0_PUO_OFF (5) /* Pull-up output impedance select offset */ ++#define DDR3PHY_ZQ0SR0_PDODT_OFF (10) /* Pull-down on-die termination impedance select offset */ ++#define DDR3PHY_ZQ0SRO_PUODT_OFF (15) /* Pull-up on-die termination impedance select offset */ + + #define DDR3PHY_DX0DLLCR (0x1CC) /* DDR3PHY DATX8 DLL Control Register */ + #define DDR3PHY_DX1DLLCR (0x20C) /* DDR3PHY DATX8 DLL Control Register */ +-- +2.35.1 + diff --git a/queue-5.19/arm-at91-pm-fix-self-refresh-for-sama7g5.patch b/queue-5.19/arm-at91-pm-fix-self-refresh-for-sama7g5.patch new file mode 100644 index 00000000000..1db045589d2 --- /dev/null +++ b/queue-5.19/arm-at91-pm-fix-self-refresh-for-sama7g5.patch @@ -0,0 +1,89 @@ +From bf26f600ed4a98b973204587415e5d45accbbc7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 11:39:20 +0300 +Subject: ARM: at91: pm: fix self-refresh for sama7g5 + +From: Claudiu Beznea + +[ Upstream commit a02875c4cbd6f3d2f33d70cc158a19ef02d4b84f ] + +It has been discovered that on some parts, from time to time, self-refresh +procedure doesn't work as expected. Debugging and investigating it proved +that disabling AC DLL introduce glitches in RAM controllers which +leads to unexpected behavior. This is confirmed as a hardware bug. DLL +bypass disables 3 DLLs: 2 DX DLLs and AC DLL. Thus, keep only DX DLLs +disabled. This introduce 6mA extra current consumption on VDDCORE when +switching to any ULP mode or standby mode but the self-refresh procedure +still works. + +Fixes: f0bbf17958e8 ("ARM: at91: pm: add self-refresh support for sama7g5") +Suggested-by: Frederic Schumacher +Signed-off-by: Claudiu Beznea +Tested-by: Cristian Birsan +Link: https://lore.kernel.org/r/20220826083927.3107272-3-claudiu.beznea@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm_suspend.S | 24 +++++++++++++++++------- + include/soc/at91/sama7-ddr.h | 4 ++++ + 2 files changed, 21 insertions(+), 7 deletions(-) + +diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S +index abe4ced33edaf..ffed4d9490428 100644 +--- a/arch/arm/mach-at91/pm_suspend.S ++++ b/arch/arm/mach-at91/pm_suspend.S +@@ -172,9 +172,15 @@ sr_ena_2: + /* Put DDR PHY's DLL in bypass mode for non-backup modes. */ + cmp r7, #AT91_PM_BACKUP + beq sr_ena_3 +- ldr tmp1, [r3, #DDR3PHY_PIR] +- orr tmp1, tmp1, #DDR3PHY_PIR_DLLBYP +- str tmp1, [r3, #DDR3PHY_PIR] ++ ++ /* Disable DX DLLs. */ ++ ldr tmp1, [r3, #DDR3PHY_DX0DLLCR] ++ orr tmp1, tmp1, #DDR3PHY_DXDLLCR_DLLDIS ++ str tmp1, [r3, #DDR3PHY_DX0DLLCR] ++ ++ ldr tmp1, [r3, #DDR3PHY_DX1DLLCR] ++ orr tmp1, tmp1, #DDR3PHY_DXDLLCR_DLLDIS ++ str tmp1, [r3, #DDR3PHY_DX1DLLCR] + + sr_ena_3: + /* Power down DDR PHY data receivers. */ +@@ -221,10 +227,14 @@ sr_ena_3: + bic tmp1, tmp1, #DDR3PHY_DSGCR_ODTPDD_ODT0 + str tmp1, [r3, #DDR3PHY_DSGCR] + +- /* Take DDR PHY's DLL out of bypass mode. */ +- ldr tmp1, [r3, #DDR3PHY_PIR] +- bic tmp1, tmp1, #DDR3PHY_PIR_DLLBYP +- str tmp1, [r3, #DDR3PHY_PIR] ++ /* Enable DX DLLs. */ ++ ldr tmp1, [r3, #DDR3PHY_DX0DLLCR] ++ bic tmp1, tmp1, #DDR3PHY_DXDLLCR_DLLDIS ++ str tmp1, [r3, #DDR3PHY_DX0DLLCR] ++ ++ ldr tmp1, [r3, #DDR3PHY_DX1DLLCR] ++ bic tmp1, tmp1, #DDR3PHY_DXDLLCR_DLLDIS ++ str tmp1, [r3, #DDR3PHY_DX1DLLCR] + + /* Enable quasi-dynamic programming. */ + mov tmp1, #0 +diff --git a/include/soc/at91/sama7-ddr.h b/include/soc/at91/sama7-ddr.h +index 9e17247474fa9..2706bc48c0764 100644 +--- a/include/soc/at91/sama7-ddr.h ++++ b/include/soc/at91/sama7-ddr.h +@@ -39,6 +39,10 @@ + + #define DDR3PHY_ZQ0SR0 (0x188) /* ZQ status register 0 */ + ++#define DDR3PHY_DX0DLLCR (0x1CC) /* DDR3PHY DATX8 DLL Control Register */ ++#define DDR3PHY_DX1DLLCR (0x20C) /* DDR3PHY DATX8 DLL Control Register */ ++#define DDR3PHY_DXDLLCR_DLLDIS (1 << 31) /* DLL Disable */ ++ + /* UDDRC */ + #define UDDRC_STAT (0x04) /* UDDRC Operating Mode Status Register */ + #define UDDRC_STAT_SELFREF_TYPE_DIS (0x0 << 4) /* SDRAM is not in Self-refresh */ +-- +2.35.1 + diff --git a/queue-5.19/arm-dts-at91-sama5d27_wlsom1-don-t-keep-ldo2-enabled.patch b/queue-5.19/arm-dts-at91-sama5d27_wlsom1-don-t-keep-ldo2-enabled.patch new file mode 100644 index 00000000000..ef74f02fd45 --- /dev/null +++ b/queue-5.19/arm-dts-at91-sama5d27_wlsom1-don-t-keep-ldo2-enabled.patch @@ -0,0 +1,35 @@ +From 1c6c1fa84e878ca0c647bf5bc7f8836f1a432a87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 11:39:25 +0300 +Subject: ARM: dts: at91: sama5d27_wlsom1: don't keep ldo2 enabled all the time + +From: Claudiu Beznea + +[ Upstream commit 617a0d9fe6867bf5b3b7272629cd780c27c877d9 ] + +ldo2 is not used by any consumer on sama5d27_wlsom1 board, thus +don't keep it enabled all the time. + +Fixes: 5d4c3cfb63fe ("ARM: dts: at91: sama5d27_wlsom1: add SAMA5D27 wlsom1 and wlsom1-ek") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20220826083927.3107272-8-claudiu.beznea@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91-sama5d27_wlsom1.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm/boot/dts/at91-sama5d27_wlsom1.dtsi b/arch/arm/boot/dts/at91-sama5d27_wlsom1.dtsi +index de0bef06af2c4..d6f364c6be94b 100644 +--- a/arch/arm/boot/dts/at91-sama5d27_wlsom1.dtsi ++++ b/arch/arm/boot/dts/at91-sama5d27_wlsom1.dtsi +@@ -177,7 +177,6 @@ + regulator-name = "LDO2"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; +- regulator-always-on; + + regulator-state-standby { + regulator-on-in-suspend; +-- +2.35.1 + diff --git a/queue-5.19/arm-dts-at91-sama5d27_wlsom1-specify-proper-regulato.patch b/queue-5.19/arm-dts-at91-sama5d27_wlsom1-specify-proper-regulato.patch new file mode 100644 index 00000000000..42a8f6b69b0 --- /dev/null +++ b/queue-5.19/arm-dts-at91-sama5d27_wlsom1-specify-proper-regulato.patch @@ -0,0 +1,84 @@ +From 665f245cf888a532c13418b2843188aafb1db52c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 11:39:22 +0300 +Subject: ARM: dts: at91: sama5d27_wlsom1: specify proper regulator output + ranges + +From: Claudiu Beznea + +[ Upstream commit addf7efec23af2b67547800aa232d551945e7de2 ] + +Min and max output ranges of regulators need to satisfy board +requirements not PMIC requirements. Thus adjust device tree to +cope with this. + +Fixes: 5d4c3cfb63fe ("ARM: dts: at91: sama5d27_wlsom1: add SAMA5D27 wlsom1 and wlsom1-ek") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20220826083927.3107272-5-claudiu.beznea@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91-sama5d27_wlsom1.dtsi | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/arch/arm/boot/dts/at91-sama5d27_wlsom1.dtsi b/arch/arm/boot/dts/at91-sama5d27_wlsom1.dtsi +index ba621783acdbc..de0bef06af2c4 100644 +--- a/arch/arm/boot/dts/at91-sama5d27_wlsom1.dtsi ++++ b/arch/arm/boot/dts/at91-sama5d27_wlsom1.dtsi +@@ -76,8 +76,8 @@ + regulators { + vdd_3v3: VDD_IO { + regulator-name = "VDD_IO"; +- regulator-min-microvolt = <1200000>; +- regulator-max-microvolt = <3700000>; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; + regulator-initial-mode = <2>; + regulator-allowed-modes = <2>, <4>; + regulator-always-on; +@@ -95,8 +95,8 @@ + + vddio_ddr: VDD_DDR { + regulator-name = "VDD_DDR"; +- regulator-min-microvolt = <600000>; +- regulator-max-microvolt = <1850000>; ++ regulator-min-microvolt = <1200000>; ++ regulator-max-microvolt = <1200000>; + regulator-initial-mode = <2>; + regulator-allowed-modes = <2>, <4>; + regulator-always-on; +@@ -118,8 +118,8 @@ + + vdd_core: VDD_CORE { + regulator-name = "VDD_CORE"; +- regulator-min-microvolt = <600000>; +- regulator-max-microvolt = <1850000>; ++ regulator-min-microvolt = <1250000>; ++ regulator-max-microvolt = <1250000>; + regulator-initial-mode = <2>; + regulator-allowed-modes = <2>, <4>; + regulator-always-on; +@@ -160,8 +160,8 @@ + + LDO1 { + regulator-name = "LDO1"; +- regulator-min-microvolt = <1200000>; +- regulator-max-microvolt = <3700000>; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; + regulator-always-on; + + regulator-state-standby { +@@ -175,8 +175,8 @@ + + LDO2 { + regulator-name = "LDO2"; +- regulator-min-microvolt = <1200000>; +- regulator-max-microvolt = <3700000>; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <3300000>; + regulator-always-on; + + regulator-state-standby { +-- +2.35.1 + diff --git a/queue-5.19/arm-dts-at91-sama5d2_icp-don-t-keep-vdd_other-enable.patch b/queue-5.19/arm-dts-at91-sama5d2_icp-don-t-keep-vdd_other-enable.patch new file mode 100644 index 00000000000..f3e090c0900 --- /dev/null +++ b/queue-5.19/arm-dts-at91-sama5d2_icp-don-t-keep-vdd_other-enable.patch @@ -0,0 +1,36 @@ +From 00b018439ec2962c3c81235261df3cac17fcb35c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 11:39:26 +0300 +Subject: ARM: dts: at91: sama5d2_icp: don't keep vdd_other enabled all the + time + +From: Claudiu Beznea + +[ Upstream commit 3d074b750d2b4c91962f10ea1df1c289ce0d3ce8 ] + +VDD_OTHER is not connected to any on board consumer thus it is not +needed to keep it enabled all the time. + +Fixes: 68a95ef72cef ("ARM: dts: at91: sama5d2-icp: add SAMA5D2-ICP") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20220826083927.3107272-9-claudiu.beznea@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91-sama5d2_icp.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm/boot/dts/at91-sama5d2_icp.dts b/arch/arm/boot/dts/at91-sama5d2_icp.dts +index 64d5ae179bec9..492456e195a37 100644 +--- a/arch/arm/boot/dts/at91-sama5d2_icp.dts ++++ b/arch/arm/boot/dts/at91-sama5d2_icp.dts +@@ -258,7 +258,6 @@ + regulator-max-microvolt = <1850000>; + regulator-initial-mode = <2>; + regulator-allowed-modes = <2>, <4>; +- regulator-always-on; + + regulator-state-standby { + regulator-on-in-suspend; +-- +2.35.1 + diff --git a/queue-5.19/arm-dts-at91-sama5d2_icp-specify-proper-regulator-ou.patch b/queue-5.19/arm-dts-at91-sama5d2_icp-specify-proper-regulator-ou.patch new file mode 100644 index 00000000000..1a79e342c34 --- /dev/null +++ b/queue-5.19/arm-dts-at91-sama5d2_icp-specify-proper-regulator-ou.patch @@ -0,0 +1,83 @@ +From bc107aeea322950992b29ac72ff21d07276fb002 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 11:39:23 +0300 +Subject: ARM: dts: at91: sama5d2_icp: specify proper regulator output ranges + +From: Claudiu Beznea + +[ Upstream commit 7737d93666eea282febf95e5fa3b3fde1f2549f3 ] + +Min and max output ranges of regulators need to satisfy board +requirements not PMIC requirements. Thus adjust device tree to +cope with this. + +Fixes: 68a95ef72cef ("ARM: dts: at91: sama5d2-icp: add SAMA5D2-ICP") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20220826083927.3107272-6-claudiu.beznea@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91-sama5d2_icp.dts | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/arch/arm/boot/dts/at91-sama5d2_icp.dts b/arch/arm/boot/dts/at91-sama5d2_icp.dts +index 164201a8fbf2d..64d5ae179bec9 100644 +--- a/arch/arm/boot/dts/at91-sama5d2_icp.dts ++++ b/arch/arm/boot/dts/at91-sama5d2_icp.dts +@@ -197,8 +197,8 @@ + regulators { + vdd_io_reg: VDD_IO { + regulator-name = "VDD_IO"; +- regulator-min-microvolt = <1200000>; +- regulator-max-microvolt = <3700000>; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; + regulator-initial-mode = <2>; + regulator-allowed-modes = <2>, <4>; + regulator-always-on; +@@ -216,8 +216,8 @@ + + VDD_DDR { + regulator-name = "VDD_DDR"; +- regulator-min-microvolt = <600000>; +- regulator-max-microvolt = <1850000>; ++ regulator-min-microvolt = <1350000>; ++ regulator-max-microvolt = <1350000>; + regulator-initial-mode = <2>; + regulator-allowed-modes = <2>, <4>; + regulator-always-on; +@@ -235,8 +235,8 @@ + + VDD_CORE { + regulator-name = "VDD_CORE"; +- regulator-min-microvolt = <600000>; +- regulator-max-microvolt = <1850000>; ++ regulator-min-microvolt = <1250000>; ++ regulator-max-microvolt = <1250000>; + regulator-initial-mode = <2>; + regulator-allowed-modes = <2>, <4>; + regulator-always-on; +@@ -273,8 +273,8 @@ + + LDO1 { + regulator-name = "LDO1"; +- regulator-min-microvolt = <1200000>; +- regulator-max-microvolt = <3700000>; ++ regulator-min-microvolt = <2500000>; ++ regulator-max-microvolt = <2500000>; + regulator-always-on; + + regulator-state-standby { +@@ -288,8 +288,8 @@ + + LDO2 { + regulator-name = "LDO2"; +- regulator-min-microvolt = <1200000>; +- regulator-max-microvolt = <3700000>; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; + regulator-always-on; + + regulator-state-standby { +-- +2.35.1 + diff --git a/queue-5.19/arm-dts-at91-sama7g5ek-specify-proper-regulator-outp.patch b/queue-5.19/arm-dts-at91-sama7g5ek-specify-proper-regulator-outp.patch new file mode 100644 index 00000000000..5388d8eedfb --- /dev/null +++ b/queue-5.19/arm-dts-at91-sama7g5ek-specify-proper-regulator-outp.patch @@ -0,0 +1,81 @@ +From 47b1380c973c6c4ae9e1089708ed06882d60909f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 11:39:24 +0300 +Subject: ARM: dts: at91: sama7g5ek: specify proper regulator output ranges + +From: Claudiu Beznea + +[ Upstream commit 7f41d52ced9e1b7ed4ff8e1ae9cacbf46b64e6db ] + +Min and max output ranges of regulators need to satisfy board +requirements not PMIC requirements. Thus adjust device tree to +cope with this. + +Fixes: 7540629e2fc7 ("ARM: dts: at91: add sama7g5 SoC DT and sama7g5-ek") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20220826083927.3107272-7-claudiu.beznea@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91-sama7g5ek.dts | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/arch/arm/boot/dts/at91-sama7g5ek.dts b/arch/arm/boot/dts/at91-sama7g5ek.dts +index 103544620fd7c..b261b4da08502 100644 +--- a/arch/arm/boot/dts/at91-sama7g5ek.dts ++++ b/arch/arm/boot/dts/at91-sama7g5ek.dts +@@ -244,8 +244,8 @@ + regulators { + vdd_3v3: VDD_IO { + regulator-name = "VDD_IO"; +- regulator-min-microvolt = <1200000>; +- regulator-max-microvolt = <3700000>; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; + regulator-initial-mode = <2>; + regulator-allowed-modes = <2>, <4>; + regulator-always-on; +@@ -264,8 +264,8 @@ + + vddioddr: VDD_DDR { + regulator-name = "VDD_DDR"; +- regulator-min-microvolt = <1300000>; +- regulator-max-microvolt = <1450000>; ++ regulator-min-microvolt = <1350000>; ++ regulator-max-microvolt = <1350000>; + regulator-initial-mode = <2>; + regulator-allowed-modes = <2>, <4>; + regulator-always-on; +@@ -285,8 +285,8 @@ + + vddcore: VDD_CORE { + regulator-name = "VDD_CORE"; +- regulator-min-microvolt = <1100000>; +- regulator-max-microvolt = <1850000>; ++ regulator-min-microvolt = <1150000>; ++ regulator-max-microvolt = <1150000>; + regulator-initial-mode = <2>; + regulator-allowed-modes = <2>, <4>; + regulator-always-on; +@@ -306,7 +306,7 @@ + vddcpu: VDD_OTHER { + regulator-name = "VDD_OTHER"; + regulator-min-microvolt = <1050000>; +- regulator-max-microvolt = <1850000>; ++ regulator-max-microvolt = <1250000>; + regulator-initial-mode = <2>; + regulator-allowed-modes = <2>, <4>; + regulator-ramp-delay = <3125>; +@@ -326,8 +326,8 @@ + + vldo1: LDO1 { + regulator-name = "LDO1"; +- regulator-min-microvolt = <1200000>; +- regulator-max-microvolt = <3700000>; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; + regulator-always-on; + + regulator-state-standby { +-- +2.35.1 + diff --git a/queue-5.19/arm-dts-imx6qdl-kontron-samx6i-fix-spi-flash-compati.patch b/queue-5.19/arm-dts-imx6qdl-kontron-samx6i-fix-spi-flash-compati.patch new file mode 100644 index 00000000000..2c84f9ab31e --- /dev/null +++ b/queue-5.19/arm-dts-imx6qdl-kontron-samx6i-fix-spi-flash-compati.patch @@ -0,0 +1,37 @@ +From 08968cf88d6556e94a13c4590f697ccaadc6301d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jul 2022 15:05:22 +0200 +Subject: ARM: dts: imx6qdl-kontron-samx6i: fix spi-flash compatible + +From: Marco Felsch + +[ Upstream commit af7d78c957017f8b3a0986769f6f18e57f9362ea ] + +Drop the "winbond,w25q16dw" compatible since it causes to set the +MODALIAS to w25q16dw which is not specified within spi-nor id table. +Fix this by use the common "jedec,spi-nor" compatible. + +Fixes: 2125212785c9 ("ARM: dts: imx6qdl-kontron-samx6i: add Kontron SMARC SoM Support") +Signed-off-by: Marco Felsch +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +index f159c58b9edba..6b791d515e294 100644 +--- a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +@@ -249,7 +249,7 @@ + + /* default boot source: workaround #1 for errata ERR006282 */ + smarc_flash: flash@0 { +- compatible = "winbond,w25q16dw", "jedec,spi-nor"; ++ compatible = "jedec,spi-nor"; + reg = <0>; + spi-max-frequency = <20000000>; + }; +-- +2.35.1 + diff --git a/queue-5.19/arm-dts-imx6qdl-kontron-samx6i-remove-duplicated-nod.patch b/queue-5.19/arm-dts-imx6qdl-kontron-samx6i-remove-duplicated-nod.patch new file mode 100644 index 00000000000..a587a7fc39c --- /dev/null +++ b/queue-5.19/arm-dts-imx6qdl-kontron-samx6i-remove-duplicated-nod.patch @@ -0,0 +1,44 @@ +From 304ce4458fa28459d1d0340c3f2d01e7b9953cbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jul 2022 15:05:21 +0200 +Subject: ARM: dts: imx6qdl-kontron-samx6i: remove duplicated node + +From: Marco Felsch + +[ Upstream commit 204f67d86f55dd4fa757ed04757d7273f71a169c ] + +The regulator node 'regulator-3p3v-s0' was dupplicated. Remove it to +clean the DTS. + +Fixes: 2a51f9dae13d ("ARM: dts: imx6qdl-kontron-samx6i: Add iMX6-based Kontron SMARC-sAMX6i module") +Signed-off-by: Marco Felsch +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +index 095c9143d99a3..f159c58b9edba 100644 +--- a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +@@ -51,16 +51,6 @@ + vin-supply = <®_3p3v_s5>; + }; + +- reg_3p3v_s0: regulator-3p3v-s0 { +- compatible = "regulator-fixed"; +- regulator-name = "V_3V3_S0"; +- regulator-min-microvolt = <3300000>; +- regulator-max-microvolt = <3300000>; +- regulator-always-on; +- regulator-boot-on; +- vin-supply = <®_3p3v_s5>; +- }; +- + reg_3p3v_s5: regulator-3p3v-s5 { + compatible = "regulator-fixed"; + regulator-name = "V_3V3_S5"; +-- +2.35.1 + diff --git a/queue-5.19/arm-dts-imx6qdl-vicut1.dtsi-fix-node-name-backlight_.patch b/queue-5.19/arm-dts-imx6qdl-vicut1.dtsi-fix-node-name-backlight_.patch new file mode 100644 index 00000000000..b81495de0d1 --- /dev/null +++ b/queue-5.19/arm-dts-imx6qdl-vicut1.dtsi-fix-node-name-backlight_.patch @@ -0,0 +1,36 @@ +From 63dc52826e6ab3fd9742ee5afb8f29f885aef8a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jul 2022 14:32:22 +0200 +Subject: ARM: dts: imx6qdl-vicut1.dtsi: Fix node name backlight_led + +From: David Jander + +[ Upstream commit 83c75e1bc2b83b3f0c718833bde677ebfa736283 ] + +This naming error slipped through, so now that a new backlight node has +been added with correct spelling, fix this one also. + +Fixes: 98efa526a0c4 ("ARM: dts: imx6qdl-vicut1/vicutgo: Add backlight_led node") +Signed-off-by: David Jander +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-vicut1.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-vicut1.dtsi b/arch/arm/boot/dts/imx6qdl-vicut1.dtsi +index a1676b5d2980f..c5a98b0110dd3 100644 +--- a/arch/arm/boot/dts/imx6qdl-vicut1.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-vicut1.dtsi +@@ -28,7 +28,7 @@ + enable-gpios = <&gpio4 28 GPIO_ACTIVE_HIGH>; + }; + +- backlight_led: backlight_led { ++ backlight_led: backlight-led { + compatible = "pwm-backlight"; + pwms = <&pwm3 0 5000000 0>; + brightness-levels = <0 16 64 255>; +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-freescale-verdin-imx8mm-fix-atmel_mxt_ts-r.patch b/queue-5.19/arm64-dts-freescale-verdin-imx8mm-fix-atmel_mxt_ts-r.patch new file mode 100644 index 00000000000..aa9c8a7f432 --- /dev/null +++ b/queue-5.19/arm64-dts-freescale-verdin-imx8mm-fix-atmel_mxt_ts-r.patch @@ -0,0 +1,36 @@ +From 22371a204b8a8dc3f5d29c7b33035e9764b298db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Aug 2022 23:39:04 +0200 +Subject: arm64: dts: freescale: verdin-imx8mm: fix atmel_mxt_ts reset polarity + +From: Marcel Ziswiler + +[ Upstream commit 90974f655922219c0a0cdce7ae8de7f30c549cb5 ] + +Fix reset GPIO polarity in-line with the following commit feedaacdadfc +("Input: atmel_mxt_ts - fix up inverted RESET handler"). + +Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini") +Signed-off-by: Marcel Ziswiler +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +index d6d31094be0af..c2d4da25482ff 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +@@ -595,7 +595,7 @@ + pinctrl-0 = <&pinctrl_gpio_9_dsi>, <&pinctrl_i2s_2_bclk_touch_reset>; + reg = <0x4a>; + /* Verdin I2S_2_BCLK (TOUCH_RESET#, SODIMM 42) */ +- reset-gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>; ++ reset-gpios = <&gpio3 23 GPIO_ACTIVE_LOW>; + status = "disabled"; + }; + +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-freescale-verdin-imx8mp-fix-atmel_mxt_ts-r.patch b/queue-5.19/arm64-dts-freescale-verdin-imx8mp-fix-atmel_mxt_ts-r.patch new file mode 100644 index 00000000000..2bd50d7a43e --- /dev/null +++ b/queue-5.19/arm64-dts-freescale-verdin-imx8mp-fix-atmel_mxt_ts-r.patch @@ -0,0 +1,45 @@ +From b2c82a4ae4ad1753ba272971e6951886c6895329 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Aug 2022 23:39:05 +0200 +Subject: arm64: dts: freescale: verdin-imx8mp: fix atmel_mxt_ts reset polarity + +From: Marcel Ziswiler + +[ Upstream commit 8f143b9f3849828870bb2a7f28288095ad9a329d ] + +Fix reset GPIO polarity in-line with the following commit feedaacdadfc +("Input: atmel_mxt_ts - fix up inverted RESET handler"). + +Fixes: a39ed23bdf6e ("arm64: dts: freescale: add initial support for verdin imx8m plus") +Signed-off-by: Marcel Ziswiler +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi +index fb17e329cd370..f5323291a9b24 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi +@@ -620,7 +620,7 @@ + interrupts = <5 IRQ_TYPE_EDGE_FALLING>; + reg = <0x4a>; + /* Verdin GPIO_2 (SODIMM 208) */ +- reset-gpios = <&gpio1 1 GPIO_ACTIVE_HIGH>; ++ reset-gpios = <&gpio1 1 GPIO_ACTIVE_LOW>; + status = "disabled"; + }; + }; +@@ -697,7 +697,7 @@ + pinctrl-0 = <&pinctrl_gpio_9_dsi>, <&pinctrl_i2s_2_bclk_touch_reset>; + reg = <0x4a>; + /* Verdin I2S_2_BCLK (TOUCH_RESET#, SODIMM 42) */ +- reset-gpios = <&gpio5 0 GPIO_ACTIVE_HIGH>; ++ reset-gpios = <&gpio5 0 GPIO_ACTIVE_LOW>; + status = "disabled"; + }; + +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-imx8mm-venice-gw7901-fix-port-phy-validati.patch b/queue-5.19/arm64-dts-imx8mm-venice-gw7901-fix-port-phy-validati.patch new file mode 100644 index 00000000000..f124a32f5f3 --- /dev/null +++ b/queue-5.19/arm64-dts-imx8mm-venice-gw7901-fix-port-phy-validati.patch @@ -0,0 +1,57 @@ +From 3db9973087c7b0462db59b9746697a3dca43eba4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Aug 2022 10:20:54 -0700 +Subject: arm64: dts: imx8mm-venice-gw7901: fix port/phy validation + +From: Tim Harvey + +[ Upstream commit 7f4dbc3f26e5cb1f056faaaf14277f48c4682fff ] + +Since commit 65ac79e18120 ("net: dsa: microchip: add the phylink +get_caps") the phy-mode must be set otherwise the switch driver will +assume "NA" mode and invalidate the port. + +Fixes: 65ac79e18120 ("net: dsa: microchip: add the phylink get_caps") +Signed-off-by: Tim Harvey +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts +index 24737e89038a4..96cac0f969a77 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts +@@ -626,24 +626,28 @@ + lan1: port@0 { + reg = <0>; + label = "lan1"; ++ phy-mode = "internal"; + local-mac-address = [00 00 00 00 00 00]; + }; + + lan2: port@1 { + reg = <1>; + label = "lan2"; ++ phy-mode = "internal"; + local-mac-address = [00 00 00 00 00 00]; + }; + + lan3: port@2 { + reg = <2>; + label = "lan3"; ++ phy-mode = "internal"; + local-mac-address = [00 00 00 00 00 00]; + }; + + lan4: port@3 { + reg = <3>; + label = "lan4"; ++ phy-mode = "internal"; + local-mac-address = [00 00 00 00 00 00]; + }; + +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-imx8mm-verdin-update-can-clock-to-40mhz.patch b/queue-5.19/arm64-dts-imx8mm-verdin-update-can-clock-to-40mhz.patch new file mode 100644 index 00000000000..ea78d10278f --- /dev/null +++ b/queue-5.19/arm64-dts-imx8mm-verdin-update-can-clock-to-40mhz.patch @@ -0,0 +1,49 @@ +From 7521e48bfc3c47764d2b2a72f512f46dbb8134d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 14:42:04 +0200 +Subject: arm64: dts: imx8mm-verdin: update CAN clock to 40MHz + +From: Andrejs Cainikovs + +[ Upstream commit be1e3dfecf7d2fbcb4a45b113da637983878246c ] + +Update SPI CAN controller clock to match current hardware design. + +Signed-off-by: Andrejs Cainikovs +Acked-by: Marcel Ziswiler +Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +index eafa88d980b32..2841c6bfe3a92 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +@@ -32,10 +32,10 @@ + }; + + /* Fixed clock dedicated to SPI CAN controller */ +- clk20m: oscillator { ++ clk40m: oscillator { + compatible = "fixed-clock"; + #clock-cells = <0>; +- clock-frequency = <20000000>; ++ clock-frequency = <40000000>; + }; + + gpio-keys { +@@ -194,7 +194,7 @@ + + can1: can@0 { + compatible = "microchip,mcp251xfd"; +- clocks = <&clk20m>; ++ clocks = <&clk40m>; + interrupts-extended = <&gpio1 6 IRQ_TYPE_EDGE_FALLING>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_can1_int>; +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-imx8mm-verdin-use-level-interrupt-for-mcp2.patch b/queue-5.19/arm64-dts-imx8mm-verdin-use-level-interrupt-for-mcp2.patch new file mode 100644 index 00000000000..5246c5f4c83 --- /dev/null +++ b/queue-5.19/arm64-dts-imx8mm-verdin-use-level-interrupt-for-mcp2.patch @@ -0,0 +1,38 @@ +From 275c8148bdc95bddae23c0be8ace5afb299df1af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 14:42:05 +0200 +Subject: arm64: dts: imx8mm-verdin: use level interrupt for mcp251xfd + +From: Andrejs Cainikovs + +[ Upstream commit e9f130e0775b5a2dad0a33440347d373ff69e631 ] + +Switch to level interrupt for mcp251xfd. This will make sure no +interrupts are lost. + +Signed-off-by: Andrejs Cainikovs +Reported-by: Marc Kleine-Budde +Acked-by: Marc Kleine-Budde +Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +index 2841c6bfe3a92..6491e745b3fa8 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +@@ -195,7 +195,7 @@ + can1: can@0 { + compatible = "microchip,mcp251xfd"; + clocks = <&clk40m>; +- interrupts-extended = <&gpio1 6 IRQ_TYPE_EDGE_FALLING>; ++ interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_can1_int>; + reg = <0>; +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-imx8mp-venice-gw74xx-fix-sai2-pin-settings.patch b/queue-5.19/arm64-dts-imx8mp-venice-gw74xx-fix-sai2-pin-settings.patch new file mode 100644 index 00000000000..973a3c68bc2 --- /dev/null +++ b/queue-5.19/arm64-dts-imx8mp-venice-gw74xx-fix-sai2-pin-settings.patch @@ -0,0 +1,41 @@ +From 3341eed95a1e552f21cf21266de5646516829df2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Jul 2022 18:50:05 +0800 +Subject: arm64: dts: imx8mp-venice-gw74xx: fix sai2 pin settings + +From: Peng Fan + +[ Upstream commit 706dd9d30d3bda4e31d423af004c22d48e89fbc9 ] + +The pad settings are missed, add them + +Fixes: 7899eb6cb15d ("arm64: dts: imx: Add i.MX8M Plus Gateworks gw7400 dts support") +Signed-off-by: Peng Fan +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts +index 521215520a0f4..6630ec561dc25 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts +@@ -770,10 +770,10 @@ + + pinctrl_sai2: sai2grp { + fsl,pins = < +- MX8MP_IOMUXC_SAI2_TXFS__AUDIOMIX_SAI2_TX_SYNC +- MX8MP_IOMUXC_SAI2_TXD0__AUDIOMIX_SAI2_TX_DATA00 +- MX8MP_IOMUXC_SAI2_TXC__AUDIOMIX_SAI2_TX_BCLK +- MX8MP_IOMUXC_SAI2_MCLK__AUDIOMIX_SAI2_MCLK ++ MX8MP_IOMUXC_SAI2_TXFS__AUDIOMIX_SAI2_TX_SYNC 0xd6 ++ MX8MP_IOMUXC_SAI2_TXD0__AUDIOMIX_SAI2_TX_DATA00 0xd6 ++ MX8MP_IOMUXC_SAI2_TXC__AUDIOMIX_SAI2_TX_BCLK 0xd6 ++ MX8MP_IOMUXC_SAI2_MCLK__AUDIOMIX_SAI2_MCLK 0xd6 + >; + }; + +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-imx8mq-tqma8mq-remove-superfluous-interrup.patch b/queue-5.19/arm64-dts-imx8mq-tqma8mq-remove-superfluous-interrup.patch new file mode 100644 index 00000000000..ceb7111239b --- /dev/null +++ b/queue-5.19/arm64-dts-imx8mq-tqma8mq-remove-superfluous-interrup.patch @@ -0,0 +1,35 @@ +From 0186970f8da373453fa3f09bed462189cefc1f3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Jul 2022 16:17:39 +0200 +Subject: arm64: dts: imx8mq-tqma8mq: Remove superfluous interrupt-names + +From: Alexander Stein + +[ Upstream commit 8eaac789128a84e79c193e662959469e824423ee ] + +This property was never needed, remove it. This also silences +dtbs_check warnings. + +Fixes: b186b8b6e770 ("arm64: dts: freescale: add initial device tree for TQMa8Mx with i.MX8M") +Signed-off-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mq-tqma8mq.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mq-tqma8mq.dtsi b/arch/arm64/boot/dts/freescale/imx8mq-tqma8mq.dtsi +index 899e8e7dbc24f..802ad6e5cef61 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mq-tqma8mq.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mq-tqma8mq.dtsi +@@ -204,7 +204,6 @@ + reg = <0x51>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_rtc>; +- interrupt-names = "irq"; + interrupt-parent = <&gpio1>; + interrupts = <1 IRQ_TYPE_EDGE_FALLING>; + quartz-load-femtofarads = <7000>; +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-ls1028a-qds-65bb-don-t-use-in-band-autoneg.patch b/queue-5.19/arm64-dts-ls1028a-qds-65bb-don-t-use-in-band-autoneg.patch new file mode 100644 index 00000000000..1a6fd80dbc7 --- /dev/null +++ b/queue-5.19/arm64-dts-ls1028a-qds-65bb-don-t-use-in-band-autoneg.patch @@ -0,0 +1,38 @@ +From e6949242e2cb9efabe6b4986a85bf85d6431564a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Aug 2022 16:50:06 +0300 +Subject: arm64: dts: ls1028a-qds-65bb: don't use in-band autoneg for + 2500base-x + +From: Vladimir Oltean + +[ Upstream commit e7406f864e765c564c5cf384464faff66114f97d ] + +The Lynx PCS integrated with ENETC port 0 does not support in-band +autoneg for the 2500base-x SERDES protocol, and prints errors from its +phylink methods. Furthermore, the AQR112 card used for these boards does +not expect in-band autoneg either. So delete the extraneous property. + +Fixes: e426d63e752b ("arm64: dts: ls1028a-qds: add overlays for various serdes protocols") +Signed-off-by: Vladimir Oltean +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-ls1028a-qds-65bb.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds-65bb.dts b/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds-65bb.dts +index 40d34c8384a5e..b949cac037427 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds-65bb.dts ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds-65bb.dts +@@ -25,7 +25,6 @@ + &enetc_port0 { + phy-handle = <&slot1_sgmii>; + phy-mode = "2500base-x"; +- managed = "in-band-status"; + status = "okay"; + }; + +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-renesas-r8a779g0-fix-hscif0-interrupt-numb.patch b/queue-5.19/arm64-dts-renesas-r8a779g0-fix-hscif0-interrupt-numb.patch new file mode 100644 index 00000000000..0b2756824d6 --- /dev/null +++ b/queue-5.19/arm64-dts-renesas-r8a779g0-fix-hscif0-interrupt-numb.patch @@ -0,0 +1,39 @@ +From 415c1c8b105aa02e9e8da257163d7f3b6eb74f1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Aug 2022 11:24:47 +0200 +Subject: arm64: dts: renesas: r8a779g0: Fix HSCIF0 interrupt number + +From: Geert Uytterhoeven + +[ Upstream commit ab2866f12ca18747413ba41409231d44e0c6149b ] + +The interrupt number for the HSCIF0 serial port, which serves as the +serial console on the White Hawk board, is incorrect, causing userspace +to hang immediately as soon as it tries to print something. +Kernel output is unaffected, as it is printed using polling. + +Fixes: 987da486d84a5643 ("arm64: dts: renesas: Add Renesas R8A779G0 SoC support") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Yoshihiro Shimoda +Link: https://lore.kernel.org/r/751dcef40d4534e856ed49b1d5b3a3e8d365ec42.1661419377.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a779g0.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi +index 7cbb0de060ddc..1c15726cff8bf 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi +@@ -85,7 +85,7 @@ + "renesas,rcar-gen4-hscif", + "renesas,hscif"; + reg = <0 0xe6540000 0 96>; +- interrupts = ; ++ interrupts = ; + clocks = <&cpg CPG_MOD 514>, + <&cpg CPG_CORE R8A779G0_CLK_S0D3_PER>, + <&scif_clk>; +-- +2.35.1 + diff --git a/queue-5.19/arm64-dts-verdin-imx8mm-add-otg2-pd-to-usbphy.patch b/queue-5.19/arm64-dts-verdin-imx8mm-add-otg2-pd-to-usbphy.patch new file mode 100644 index 00000000000..5bf3e1bf018 --- /dev/null +++ b/queue-5.19/arm64-dts-verdin-imx8mm-add-otg2-pd-to-usbphy.patch @@ -0,0 +1,43 @@ +From e47b480ccc5e75a102bd95d46a2b6f60af086ca6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Aug 2022 16:07:38 +0200 +Subject: arm64: dts: verdin-imx8mm: add otg2 pd to usbphy + +From: Philippe Schenker + +[ Upstream commit 2fa24aa721ebb3a83dd2093814ba9a5dcdaa3183 ] + +The Verdin iMX8M Mini System on Module does not have USB-ID signal +connected on Verdin USB_2 (usbotg2). On Verdin Development board this is +no problem, as we have connected a USB-Hub that is always connected. + +However, if Verdin USB_2 is desired to be used as a single USB-Host port +the chipidea driver does not detect if a USB device is plugged into this +port, due to runtime pm shutting down the PHY. + +Add the power-domain &pgc_otg2 to &usbphynop2 in order to detect +plugging events and enumerate the usb device. + +Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini") +Signed-off-by: Philippe Schenker +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +index 6491e745b3fa8..d6d31094be0af 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +@@ -737,6 +737,7 @@ + }; + + &usbphynop2 { ++ power-domains = <&pgc_otg2>; + vcc-supply = <®_vdd_3v3>; + }; + +-- +2.35.1 + diff --git a/queue-5.19/asoc-cs42l42-only-report-button-state-if-there-was-a.patch b/queue-5.19/asoc-cs42l42-only-report-button-state-if-there-was-a.patch new file mode 100644 index 00000000000..65761cca51b --- /dev/null +++ b/queue-5.19/asoc-cs42l42-only-report-button-state-if-there-was-a.patch @@ -0,0 +1,64 @@ +From 0dd7102d07ce34ea24f6af78b81fe42585123d85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Aug 2022 13:31:38 +0100 +Subject: ASoC: cs42l42: Only report button state if there was a button + interrupt + +From: Richard Fitzgerald + +[ Upstream commit ea75deef1a738d25502cfbb2caa564270b271525 ] + +Only report a button state change if the interrupt status shows that +there was a button event. + +Previously the code would always drop into the button reporting at the +end of interrupt handling if the jack was present. If neither of the +button report interrupts were pending it would report all buttons +released. This could then lead to a button being reported as released +while it is still pressed. + +Fixes: c5b8ee0879bc ("ASoC: cs42l42: Report jack and button detection") +Signed-off-by: Richard Fitzgerald +Link: https://lore.kernel.org/r/20220815123138.3810249-1-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs42l42.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c +index 4fade23887972..8cba3015398b7 100644 +--- a/sound/soc/codecs/cs42l42.c ++++ b/sound/soc/codecs/cs42l42.c +@@ -1618,7 +1618,6 @@ static irqreturn_t cs42l42_irq_thread(int irq, void *data) + unsigned int current_plug_status; + unsigned int current_button_status; + unsigned int i; +- int report = 0; + + mutex_lock(&cs42l42->irq_lock); + if (cs42l42->suspended) { +@@ -1713,13 +1712,15 @@ static irqreturn_t cs42l42_irq_thread(int irq, void *data) + + if (current_button_status & CS42L42_M_DETECT_TF_MASK) { + dev_dbg(cs42l42->dev, "Button released\n"); +- report = 0; ++ snd_soc_jack_report(cs42l42->jack, 0, ++ SND_JACK_BTN_0 | SND_JACK_BTN_1 | ++ SND_JACK_BTN_2 | SND_JACK_BTN_3); + } else if (current_button_status & CS42L42_M_DETECT_FT_MASK) { +- report = cs42l42_handle_button_press(cs42l42); +- ++ snd_soc_jack_report(cs42l42->jack, ++ cs42l42_handle_button_press(cs42l42), ++ SND_JACK_BTN_0 | SND_JACK_BTN_1 | ++ SND_JACK_BTN_2 | SND_JACK_BTN_3); + } +- snd_soc_jack_report(cs42l42->jack, report, SND_JACK_BTN_0 | SND_JACK_BTN_1 | +- SND_JACK_BTN_2 | SND_JACK_BTN_3); + } + } + +-- +2.35.1 + diff --git a/queue-5.19/asoc-qcom-sm8250-add-missing-module-owner.patch b/queue-5.19/asoc-qcom-sm8250-add-missing-module-owner.patch new file mode 100644 index 00000000000..4f1b9264bbe --- /dev/null +++ b/queue-5.19/asoc-qcom-sm8250-add-missing-module-owner.patch @@ -0,0 +1,35 @@ +From 4466f5945b99f6c16afea5f2baecdd8e15b09e12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Aug 2022 17:52:29 +0100 +Subject: ASoC: qcom: sm8250: add missing module owner + +From: Srinivas Kandagatla + +[ Upstream commit c6e14bb9f50df7126ca64405ae807d8bc7b39f9a ] + +Add missing module owner to able to build and load this driver as module. + +Fixes: aa2e2785545a ("ASoC: qcom: sm8250: add sound card qrb5165-rb5 support") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20220816165229.7971-1-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/qcom/sm8250.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/qcom/sm8250.c b/sound/soc/qcom/sm8250.c +index 6e1184c8b672a..c48ac107810d4 100644 +--- a/sound/soc/qcom/sm8250.c ++++ b/sound/soc/qcom/sm8250.c +@@ -270,6 +270,7 @@ static int sm8250_platform_probe(struct platform_device *pdev) + if (!card) + return -ENOMEM; + ++ card->owner = THIS_MODULE; + /* Allocate the private data */ + data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL); + if (!data) +-- +2.35.1 + diff --git a/queue-5.19/asoc-sof-kconfig-make-ipc_flood_test-depend-on-snd_s.patch b/queue-5.19/asoc-sof-kconfig-make-ipc_flood_test-depend-on-snd_s.patch new file mode 100644 index 00000000000..37659ba136a --- /dev/null +++ b/queue-5.19/asoc-sof-kconfig-make-ipc_flood_test-depend-on-snd_s.patch @@ -0,0 +1,38 @@ +From 9248076f197d37c2043cefe3f0d64c574475fd8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Aug 2022 15:15:53 +0300 +Subject: ASoC: SOF: Kconfig: Make IPC_FLOOD_TEST depend on SND_SOC_SOF + +From: Peter Ujfalusi + +[ Upstream commit 3942499fba11de048c3ac1390b808e9e6ae88de5 ] + +Make sure that the IPC_FLOOD client can not be built in when SND_SOC_SOF is +built as module. + +Fixes: 6e9548cdb30e5 ("ASoC: SOF: Convert the generic IPC flood test into SOF client") +Reported-by: kernel test robot +Signed-off-by: Peter Ujfalusi +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20220823121554.4255-2-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/sof/Kconfig b/sound/soc/sof/Kconfig +index 4542868cd730f..96c40542446db 100644 +--- a/sound/soc/sof/Kconfig ++++ b/sound/soc/sof/Kconfig +@@ -196,6 +196,7 @@ config SND_SOC_SOF_DEBUG_ENABLE_FIRMWARE_TRACE + + config SND_SOC_SOF_DEBUG_IPC_FLOOD_TEST + tristate "SOF enable IPC flood test" ++ depends on SND_SOC_SOF + select SND_SOC_SOF_CLIENT + help + This option enables a separate client device for IPC flood test +-- +2.35.1 + diff --git a/queue-5.19/asoc-sof-kconfig-make-ipc_message_injector-depend-on.patch b/queue-5.19/asoc-sof-kconfig-make-ipc_message_injector-depend-on.patch new file mode 100644 index 00000000000..42cd0a17a3f --- /dev/null +++ b/queue-5.19/asoc-sof-kconfig-make-ipc_message_injector-depend-on.patch @@ -0,0 +1,38 @@ +From f72e168159cb4f19b8a5ad24e8104f7cd5d7856a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Aug 2022 15:15:54 +0300 +Subject: ASoC: SOF: Kconfig: Make IPC_MESSAGE_INJECTOR depend on SND_SOC_SOF + +From: Peter Ujfalusi + +[ Upstream commit 2cf520ffbcbd55c0f2b4276065444d7526d9d197 ] + +Make sure that the IPC_MESSAGE_INJECTOR client can not be built in when +SND_SOC_SOF is built as module. + +Fixes: cac0b0887e530 ("ASoC: SOF: Convert the generic IPC message injector into SOF client") +Reported-by: kernel test robot +Signed-off-by: Peter Ujfalusi +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20220823121554.4255-3-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/sof/Kconfig b/sound/soc/sof/Kconfig +index 96c40542446db..39216c09f1597 100644 +--- a/sound/soc/sof/Kconfig ++++ b/sound/soc/sof/Kconfig +@@ -215,6 +215,7 @@ config SND_SOC_SOF_DEBUG_IPC_FLOOD_TEST_NUM + + config SND_SOC_SOF_DEBUG_IPC_MSG_INJECTOR + tristate "SOF enable IPC message injector" ++ depends on SND_SOC_SOF + select SND_SOC_SOF_CLIENT + help + This option enables the IPC message injector which can be used to send +-- +2.35.1 + diff --git a/queue-5.19/block-don-t-add-partitions-if-gd_suppress_part_scan-.patch b/queue-5.19/block-don-t-add-partitions-if-gd_suppress_part_scan-.patch new file mode 100644 index 00000000000..bbecac71dd6 --- /dev/null +++ b/queue-5.19/block-don-t-add-partitions-if-gd_suppress_part_scan-.patch @@ -0,0 +1,46 @@ +From 4c96b1dd9280abc294a64dd777f2cbf7d9c80704 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Aug 2022 18:38:19 +0800 +Subject: block: don't add partitions if GD_SUPPRESS_PART_SCAN is set + +From: Ming Lei + +[ Upstream commit 748008e1da926a814cc0a054c81ca614408b1b0c ] + +Commit b9684a71fca7 ("block, loop: support partitions without scanning") +adds GD_SUPPRESS_PART_SCAN for replacing part function of +GENHD_FL_NO_PART. But looks blk_add_partitions() is missed, since +loop doesn't want to add partitions if GENHD_FL_NO_PART was set. +And it causes regression on libblockdev (as called from udisks) which +operates with the LO_FLAGS_PARTSCAN. + +Fixes the issue by not adding partitions if GD_SUPPRESS_PART_SCAN is +set. + +Fixes: b9684a71fca7 ("block, loop: support partitions without scanning") +Signed-off-by: Ming Lei +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20220823103819.395776-1-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/partitions/core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/block/partitions/core.c b/block/partitions/core.c +index 8a0ec929023bc..76617b1d2d47f 100644 +--- a/block/partitions/core.c ++++ b/block/partitions/core.c +@@ -597,6 +597,9 @@ static int blk_add_partitions(struct gendisk *disk) + if (disk->flags & GENHD_FL_NO_PART) + return 0; + ++ if (test_bit(GD_SUPPRESS_PART_SCAN, &disk->state)) ++ return 0; ++ + state = check_partition(disk); + if (!state) + return 0; +-- +2.35.1 + diff --git a/queue-5.19/bonding-add-all-node-mcast-address-when-slave-up.patch b/queue-5.19/bonding-add-all-node-mcast-address-when-slave-up.patch new file mode 100644 index 00000000000..e1359f13b75 --- /dev/null +++ b/queue-5.19/bonding-add-all-node-mcast-address-when-slave-up.patch @@ -0,0 +1,60 @@ +From 4275289b6d1a72030c8f8c96824d7d3c902b7677 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Aug 2022 17:37:21 +0800 +Subject: bonding: add all node mcast address when slave up + +From: Hangbin Liu + +[ Upstream commit fd16eb948ea8b28afb03e11a5b11841e6ac2aa2b ] + +When a link is enslave to bond, it need to set the interface down first. +This makes the slave remove mac multicast address 33:33:00:00:00:01(The +IPv6 multicast address ff02::1 is kept even when the interface down). When +bond set the slave up, ipv6_mc_up() was not called due to commit c2edacf80e15 +("bonding / ipv6: no addrconf for slaves separately from master"). + +This is not an issue before we adding the lladdr target feature for bonding, +as the mac multicast address will be added back when bond interface up and +join group ff02::1. + +But after adding lladdr target feature for bonding. When user set a lladdr +target, the unsolicited NA message with all-nodes multicast dest will be +dropped as the slave interface never add 33:33:00:00:00:01 back. + +Fix this by calling ipv6_mc_up() to add 33:33:00:00:00:01 back when +the slave interface up. + +Reported-by: LiLiang +Fixes: 5e1eeef69c0f ("bonding: NS target should accept link local address") +Signed-off-by: Hangbin Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/addrconf.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index b738eb7e1cae8..04cf06866e765 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -3557,11 +3557,15 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event, + fallthrough; + case NETDEV_UP: + case NETDEV_CHANGE: +- if (dev->flags & IFF_SLAVE) ++ if (idev && idev->cnf.disable_ipv6) + break; + +- if (idev && idev->cnf.disable_ipv6) ++ if (dev->flags & IFF_SLAVE) { ++ if (event == NETDEV_UP && !IS_ERR_OR_NULL(idev) && ++ dev->flags & IFF_UP && dev->flags & IFF_MULTICAST) ++ ipv6_mc_up(idev); + break; ++ } + + if (event == NETDEV_UP) { + /* restore routes for permanent addresses */ +-- +2.35.1 + diff --git a/queue-5.19/bonding-use-unspecified-address-if-no-available-link.patch b/queue-5.19/bonding-use-unspecified-address-if-no-available-link.patch new file mode 100644 index 00000000000..4c19349158a --- /dev/null +++ b/queue-5.19/bonding-use-unspecified-address-if-no-available-link.patch @@ -0,0 +1,52 @@ +From 656abad3956bf84a4a951aada2f61d9fa0c1c87f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Aug 2022 17:37:20 +0800 +Subject: bonding: use unspecified address if no available link local address + +From: Hangbin Liu + +[ Upstream commit b7f14132bf58256e841774ae07d3ffb7a841c2bc ] + +When ns_ip6_target was set, the ipv6_dev_get_saddr() will be called to get +available source address and send IPv6 neighbor solicit message. + +If the target is global address, ipv6_dev_get_saddr() will get any +available src address. But if the target is link local address, +ipv6_dev_get_saddr() will only get available address from our interface, +i.e. the corresponding bond interface. + +But before bond interface up, all the address is tentative, while +ipv6_dev_get_saddr() will ignore tentative address. This makes we can't +find available link local src address, then bond_ns_send() will not be +called and no NS message was sent. Finally bond interface will keep in +down state. + +Fix this by sending NS with unspecified address if there is no available +source address. + +Reported-by: LiLiang +Fixes: 5e1eeef69c0f ("bonding: NS target should accept link local address") +Signed-off-by: Hangbin Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 6ba4c83fe5fc0..0cf8c3a125d2e 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3134,6 +3134,9 @@ static void bond_ns_send_all(struct bonding *bond, struct slave *slave) + found: + if (!ipv6_dev_get_saddr(dev_net(dst->dev), dst->dev, &targets[i], 0, &saddr)) + bond_ns_send(slave, &targets[i], &saddr, tags); ++ else ++ bond_ns_send(slave, &targets[i], &in6addr_any, tags); ++ + dst_release(dst); + kfree(tags); + } +-- +2.35.1 + diff --git a/queue-5.19/btrfs-fix-the-max-chunk-size-and-stripe-length-calcu.patch b/queue-5.19/btrfs-fix-the-max-chunk-size-and-stripe-length-calcu.patch new file mode 100644 index 00000000000..6f2e234072f --- /dev/null +++ b/queue-5.19/btrfs-fix-the-max-chunk-size-and-stripe-length-calcu.patch @@ -0,0 +1,106 @@ +From 6885562d84f486725b9e4f52cca3ea53e59030a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Aug 2022 15:06:44 +0800 +Subject: btrfs: fix the max chunk size and stripe length calculation + +From: Qu Wenruo + +[ Upstream commit 5da431b71d4b9be3c8cf6786eff9e2d41a5f9f65 ] + +[BEHAVIOR CHANGE] +Since commit f6fca3917b4d ("btrfs: store chunk size in space-info +struct"), btrfs no longer can create larger data chunks than 1G: + + mkfs.btrfs -f -m raid1 -d raid0 $dev1 $dev2 $dev3 $dev4 + mount $dev1 $mnt + + btrfs balance start --full $mnt + btrfs balance start --full $mnt + umount $mnt + + btrfs ins dump-tree -t chunk $dev1 | grep "DATA|RAID0" -C 2 + +Before that offending commit, what we got is a 4G data chunk: + + item 6 key (FIRST_CHUNK_TREE CHUNK_ITEM 9492758528) itemoff 15491 itemsize 176 + length 4294967296 owner 2 stripe_len 65536 type DATA|RAID0 + io_align 65536 io_width 65536 sector_size 4096 + num_stripes 4 sub_stripes 1 + +Now what we got is only 1G data chunk: + + item 6 key (FIRST_CHUNK_TREE CHUNK_ITEM 6271533056) itemoff 15491 itemsize 176 + length 1073741824 owner 2 stripe_len 65536 type DATA|RAID0 + io_align 65536 io_width 65536 sector_size 4096 + num_stripes 4 sub_stripes 1 + +This will increase the number of data chunks by the number of devices, +not only increase system chunk usage, but also greatly increase mount +time. + +Without a proper reason, we should not change the max chunk size. + +[CAUSE] +Previously, we set max data chunk size to 10G, while max data stripe +length to 1G. + +Commit f6fca3917b4d ("btrfs: store chunk size in space-info struct") +completely ignored the 10G limit, but use 1G max stripe limit instead, +causing above shrink in max data chunk size. + +[FIX] +Fix the max data chunk size to 10G, and in decide_stripe_size_regular() +we limit stripe_size to 1G manually. + +This should only affect data chunks, as for metadata chunks we always +set the max stripe size the same as max chunk size (256M or 1G +depending on fs size). + +Now the same script result the same old result: + + item 6 key (FIRST_CHUNK_TREE CHUNK_ITEM 9492758528) itemoff 15491 itemsize 176 + length 4294967296 owner 2 stripe_len 65536 type DATA|RAID0 + io_align 65536 io_width 65536 sector_size 4096 + num_stripes 4 sub_stripes 1 + +Reported-by: Wang Yugui +Fixes: f6fca3917b4d ("btrfs: store chunk size in space-info struct") +Signed-off-by: Qu Wenruo +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/space-info.c | 2 +- + fs/btrfs/volumes.c | 3 +++ + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c +index b0c5b4738b1f7..17623e6410c5d 100644 +--- a/fs/btrfs/space-info.c ++++ b/fs/btrfs/space-info.c +@@ -199,7 +199,7 @@ static u64 calc_chunk_size(const struct btrfs_fs_info *fs_info, u64 flags) + ASSERT(flags & BTRFS_BLOCK_GROUP_TYPE_MASK); + + if (flags & BTRFS_BLOCK_GROUP_DATA) +- return SZ_1G; ++ return BTRFS_MAX_DATA_CHUNK_SIZE; + else if (flags & BTRFS_BLOCK_GROUP_SYSTEM) + return SZ_32M; + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 3460fd6743807..16e01fbdcec83 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -5266,6 +5266,9 @@ static int decide_stripe_size_regular(struct alloc_chunk_ctl *ctl, + ctl->stripe_size); + } + ++ /* Stripe size should not go beyond 1G. */ ++ ctl->stripe_size = min_t(u64, ctl->stripe_size, SZ_1G); ++ + /* Align to BTRFS_STRIPE_LEN */ + ctl->stripe_size = round_down(ctl->stripe_size, BTRFS_STRIPE_LEN); + ctl->chunk_size = ctl->stripe_size * data_stripes; +-- +2.35.1 + diff --git a/queue-5.19/btrfs-zoned-fix-mounting-with-conventional-zones.patch b/queue-5.19/btrfs-zoned-fix-mounting-with-conventional-zones.patch new file mode 100644 index 00000000000..fe7ed72a5db --- /dev/null +++ b/queue-5.19/btrfs-zoned-fix-mounting-with-conventional-zones.patch @@ -0,0 +1,169 @@ +From 322f4a99735621a77c42d21a7c8eee68cfdda60e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Sep 2022 05:38:24 -0700 +Subject: btrfs: zoned: fix mounting with conventional zones + +From: Johannes Thumshirn + +[ Upstream commit 6ca64ac2763149fb66c0b4bf12f5e0977a88e51d ] + +Since commit 6a921de58992 ("btrfs: zoned: introduce +space_info->active_total_bytes"), we're only counting the bytes of a +block group on an active zone as usable for metadata writes. But on a +SMR drive, we don't have active zones and short circuit some of the +logic. + +This leads to an error on mount, because we cannot reserve space for +metadata writes. + +Fix this by also setting the BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE bit in the +block-group's runtime flag if the zone is a conventional zone. + +Fixes: 6a921de58992 ("btrfs: zoned: introduce space_info->active_total_bytes") +Signed-off-by: Johannes Thumshirn +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/zoned.c | 81 ++++++++++++++++++++++++------------------------ + 1 file changed, 40 insertions(+), 41 deletions(-) + +diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c +index 4949e0d82923d..1386362fad3b8 100644 +--- a/fs/btrfs/zoned.c ++++ b/fs/btrfs/zoned.c +@@ -1187,7 +1187,7 @@ int btrfs_ensure_empty_zones(struct btrfs_device *device, u64 start, u64 size) + * offset. + */ + static int calculate_alloc_pointer(struct btrfs_block_group *cache, +- u64 *offset_ret) ++ u64 *offset_ret, bool new) + { + struct btrfs_fs_info *fs_info = cache->fs_info; + struct btrfs_root *root; +@@ -1197,6 +1197,21 @@ static int calculate_alloc_pointer(struct btrfs_block_group *cache, + int ret; + u64 length; + ++ /* ++ * Avoid tree lookups for a new block group, there's no use for it. ++ * It must always be 0. ++ * ++ * Also, we have a lock chain of extent buffer lock -> chunk mutex. ++ * For new a block group, this function is called from ++ * btrfs_make_block_group() which is already taking the chunk mutex. ++ * Thus, we cannot call calculate_alloc_pointer() which takes extent ++ * buffer locks to avoid deadlock. ++ */ ++ if (new) { ++ *offset_ret = 0; ++ return 0; ++ } ++ + path = btrfs_alloc_path(); + if (!path) + return -ENOMEM; +@@ -1332,6 +1347,13 @@ int btrfs_load_block_group_zone_info(struct btrfs_block_group *cache, bool new) + else + num_conventional++; + ++ /* ++ * Consider a zone as active if we can allow any number of ++ * active zones. ++ */ ++ if (!device->zone_info->max_active_zones) ++ __set_bit(i, active); ++ + if (!is_sequential) { + alloc_offsets[i] = WP_CONVENTIONAL; + continue; +@@ -1398,45 +1420,23 @@ int btrfs_load_block_group_zone_info(struct btrfs_block_group *cache, bool new) + __set_bit(i, active); + break; + } +- +- /* +- * Consider a zone as active if we can allow any number of +- * active zones. +- */ +- if (!device->zone_info->max_active_zones) +- __set_bit(i, active); + } + + if (num_sequential > 0) + cache->seq_zone = true; + + if (num_conventional > 0) { +- /* +- * Avoid calling calculate_alloc_pointer() for new BG. It +- * is no use for new BG. It must be always 0. +- * +- * Also, we have a lock chain of extent buffer lock -> +- * chunk mutex. For new BG, this function is called from +- * btrfs_make_block_group() which is already taking the +- * chunk mutex. Thus, we cannot call +- * calculate_alloc_pointer() which takes extent buffer +- * locks to avoid deadlock. +- */ +- + /* Zone capacity is always zone size in emulation */ + cache->zone_capacity = cache->length; +- if (new) { +- cache->alloc_offset = 0; +- goto out; +- } +- ret = calculate_alloc_pointer(cache, &last_alloc); +- if (ret || map->num_stripes == num_conventional) { +- if (!ret) +- cache->alloc_offset = last_alloc; +- else +- btrfs_err(fs_info, ++ ret = calculate_alloc_pointer(cache, &last_alloc, new); ++ if (ret) { ++ btrfs_err(fs_info, + "zoned: failed to determine allocation offset of bg %llu", +- cache->start); ++ cache->start); ++ goto out; ++ } else if (map->num_stripes == num_conventional) { ++ cache->alloc_offset = last_alloc; ++ cache->zone_is_active = 1; + goto out; + } + } +@@ -1504,13 +1504,6 @@ int btrfs_load_block_group_zone_info(struct btrfs_block_group *cache, bool new) + goto out; + } + +- if (cache->zone_is_active) { +- btrfs_get_block_group(cache); +- spin_lock(&fs_info->zone_active_bgs_lock); +- list_add_tail(&cache->active_bg_list, &fs_info->zone_active_bgs); +- spin_unlock(&fs_info->zone_active_bgs_lock); +- } +- + out: + if (cache->alloc_offset > fs_info->zone_size) { + btrfs_err(fs_info, +@@ -1535,10 +1528,16 @@ int btrfs_load_block_group_zone_info(struct btrfs_block_group *cache, bool new) + ret = -EIO; + } + +- if (!ret) ++ if (!ret) { + cache->meta_write_pointer = cache->alloc_offset + cache->start; +- +- if (ret) { ++ if (cache->zone_is_active) { ++ btrfs_get_block_group(cache); ++ spin_lock(&fs_info->zone_active_bgs_lock); ++ list_add_tail(&cache->active_bg_list, ++ &fs_info->zone_active_bgs); ++ spin_unlock(&fs_info->zone_active_bgs_lock); ++ } ++ } else { + kfree(cache->physical_map); + cache->physical_map = NULL; + } +-- +2.35.1 + diff --git a/queue-5.19/erofs-fix-error-return-code-in-erofs_fscache_-meta_-.patch b/queue-5.19/erofs-fix-error-return-code-in-erofs_fscache_-meta_-.patch new file mode 100644 index 00000000000..d6cc7ab6ef4 --- /dev/null +++ b/queue-5.19/erofs-fix-error-return-code-in-erofs_fscache_-meta_-.patch @@ -0,0 +1,55 @@ +From 100c37aaa6739f0c75b1df6b96006ff4e900eb6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Aug 2022 11:48:29 +0800 +Subject: erofs: fix error return code in erofs_fscache_{meta_,}read_folio + +From: Sun Ke + +[ Upstream commit 5bd9628b784cc5e38e1c7ebb680bbd6ee741230e ] + +If erofs_fscache_alloc_request fail and then goto out, it will return 0. +it should return a negative error code instead of 0. + +Fixes: d435d53228dd ("erofs: change to use asynchronous io for fscache readpage/readahead") +Signed-off-by: Sun Ke +Reviewed-by: Jingbo Xu +Reviewed-by: Gao Xiang +Reviewed-by: Chao Yu +Link: https://lore.kernel.org/r/20220815034829.3940803-1-sunke32@huawei.com +Signed-off-by: Gao Xiang +Signed-off-by: Sasha Levin +--- + fs/erofs/fscache.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c +index 8e01d89c3319e..b5fd9d71e67f1 100644 +--- a/fs/erofs/fscache.c ++++ b/fs/erofs/fscache.c +@@ -222,8 +222,10 @@ static int erofs_fscache_meta_read_folio(struct file *data, struct folio *folio) + + rreq = erofs_fscache_alloc_request(folio_mapping(folio), + folio_pos(folio), folio_size(folio)); +- if (IS_ERR(rreq)) ++ if (IS_ERR(rreq)) { ++ ret = PTR_ERR(rreq); + goto out; ++ } + + return erofs_fscache_read_folios_async(mdev.m_fscache->cookie, + rreq, mdev.m_pa); +@@ -301,8 +303,10 @@ static int erofs_fscache_read_folio(struct file *file, struct folio *folio) + + rreq = erofs_fscache_alloc_request(folio_mapping(folio), + folio_pos(folio), folio_size(folio)); +- if (IS_ERR(rreq)) ++ if (IS_ERR(rreq)) { ++ ret = PTR_ERR(rreq); + goto out_unlock; ++ } + + pstart = mdev.m_pa + (pos - map.m_la); + return erofs_fscache_read_folios_async(mdev.m_fscache->cookie, +-- +2.35.1 + diff --git a/queue-5.19/erofs-fix-pcluster-use-after-free-on-up-platforms.patch b/queue-5.19/erofs-fix-pcluster-use-after-free-on-up-platforms.patch new file mode 100644 index 00000000000..41302a74073 --- /dev/null +++ b/queue-5.19/erofs-fix-pcluster-use-after-free-on-up-platforms.patch @@ -0,0 +1,116 @@ +From e578556eeaaa059bb9df329060b909c45062f758 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Sep 2022 12:57:10 +0800 +Subject: erofs: fix pcluster use-after-free on UP platforms + +From: Gao Xiang + +[ Upstream commit 2f44013e39984c127c6efedf70e6b5f4e9dcf315 ] + +During stress testing with CONFIG_SMP disabled, KASAN reports as below: + +================================================================== +BUG: KASAN: use-after-free in __mutex_lock+0xe5/0xc30 +Read of size 8 at addr ffff8881094223f8 by task stress/7789 + +CPU: 0 PID: 7789 Comm: stress Not tainted 6.0.0-rc1-00002-g0d53d2e882f9 #3 +Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 +Call Trace: + +.. + __mutex_lock+0xe5/0xc30 +.. + z_erofs_do_read_page+0x8ce/0x1560 +.. + z_erofs_readahead+0x31c/0x580 +.. +Freed by task 7787 + kasan_save_stack+0x1e/0x40 + kasan_set_track+0x20/0x30 + kasan_set_free_info+0x20/0x40 + __kasan_slab_free+0x10c/0x190 + kmem_cache_free+0xed/0x380 + rcu_core+0x3d5/0xc90 + __do_softirq+0x12d/0x389 + +Last potentially related work creation: + kasan_save_stack+0x1e/0x40 + __kasan_record_aux_stack+0x97/0xb0 + call_rcu+0x3d/0x3f0 + erofs_shrink_workstation+0x11f/0x210 + erofs_shrink_scan+0xdc/0x170 + shrink_slab.constprop.0+0x296/0x530 + drop_slab+0x1c/0x70 + drop_caches_sysctl_handler+0x70/0x80 + proc_sys_call_handler+0x20a/0x2f0 + vfs_write+0x555/0x6c0 + ksys_write+0xbe/0x160 + do_syscall_64+0x3b/0x90 + +The root cause is that erofs_workgroup_unfreeze() doesn't reset to +orig_val thus it causes a race that the pcluster reuses unexpectedly +before freeing. + +Since UP platforms are quite rare now, such path becomes unnecessary. +Let's drop such specific-designed path directly instead. + +Fixes: 73f5c66df3e2 ("staging: erofs: fix `erofs_workgroup_{try_to_freeze, unfreeze}'") +Reviewed-by: Yue Hu +Reviewed-by: Chao Yu +Link: https://lore.kernel.org/r/20220902045710.109530-1-hsiangkao@linux.alibaba.com +Signed-off-by: Gao Xiang +Signed-off-by: Sasha Levin +--- + fs/erofs/internal.h | 29 ----------------------------- + 1 file changed, 29 deletions(-) + +diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h +index cfee49d33b95a..a01cc82795a25 100644 +--- a/fs/erofs/internal.h ++++ b/fs/erofs/internal.h +@@ -195,7 +195,6 @@ struct erofs_workgroup { + atomic_t refcount; + }; + +-#if defined(CONFIG_SMP) + static inline bool erofs_workgroup_try_to_freeze(struct erofs_workgroup *grp, + int val) + { +@@ -224,34 +223,6 @@ static inline int erofs_wait_on_workgroup_freezed(struct erofs_workgroup *grp) + return atomic_cond_read_relaxed(&grp->refcount, + VAL != EROFS_LOCKED_MAGIC); + } +-#else +-static inline bool erofs_workgroup_try_to_freeze(struct erofs_workgroup *grp, +- int val) +-{ +- preempt_disable(); +- /* no need to spin on UP platforms, let's just disable preemption. */ +- if (val != atomic_read(&grp->refcount)) { +- preempt_enable(); +- return false; +- } +- return true; +-} +- +-static inline void erofs_workgroup_unfreeze(struct erofs_workgroup *grp, +- int orig_val) +-{ +- preempt_enable(); +-} +- +-static inline int erofs_wait_on_workgroup_freezed(struct erofs_workgroup *grp) +-{ +- int v = atomic_read(&grp->refcount); +- +- /* workgroup is never freezed on uniprocessor systems */ +- DBG_BUGON(v == EROFS_LOCKED_MAGIC); +- return v; +-} +-#endif /* !CONFIG_SMP */ + #endif /* !CONFIG_EROFS_FS_ZIP */ + + /* we strictly follow PAGE_SIZE and no buffer head yet */ +-- +2.35.1 + diff --git a/queue-5.19/i40e-fix-kernel-crash-during-module-removal.patch b/queue-5.19/i40e-fix-kernel-crash-during-module-removal.patch new file mode 100644 index 00000000000..f5fe58a5edc --- /dev/null +++ b/queue-5.19/i40e-fix-kernel-crash-during-module-removal.patch @@ -0,0 +1,106 @@ +From caaae9659aefb34fde8010b487a271f6e50c1fd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Aug 2022 18:22:30 +0200 +Subject: i40e: Fix kernel crash during module removal + +From: Ivan Vecera + +[ Upstream commit fb8396aeda5872369a8ed6d2301e2c86e303c520 ] + +The driver incorrectly frees client instance and subsequent +i40e module removal leads to kernel crash. + +Reproducer: +1. Do ethtool offline test followed immediately by another one +host# ethtool -t eth0 offline; ethtool -t eth0 offline +2. Remove recursively irdma module that also removes i40e module +host# modprobe -r irdma + +Result: +[ 8675.035651] i40e 0000:3d:00.0 eno1: offline testing starting +[ 8675.193774] i40e 0000:3d:00.0 eno1: testing finished +[ 8675.201316] i40e 0000:3d:00.0 eno1: offline testing starting +[ 8675.358921] i40e 0000:3d:00.0 eno1: testing finished +[ 8675.496921] i40e 0000:3d:00.0: IRDMA hardware initialization FAILED init_state=2 status=-110 +[ 8686.188955] i40e 0000:3d:00.1: i40e_ptp_stop: removed PHC on eno2 +[ 8686.943890] i40e 0000:3d:00.1: Deleted LAN device PF1 bus=0x3d dev=0x00 func=0x01 +[ 8686.952669] i40e 0000:3d:00.0: i40e_ptp_stop: removed PHC on eno1 +[ 8687.761787] BUG: kernel NULL pointer dereference, address: 0000000000000030 +[ 8687.768755] #PF: supervisor read access in kernel mode +[ 8687.773895] #PF: error_code(0x0000) - not-present page +[ 8687.779034] PGD 0 P4D 0 +[ 8687.781575] Oops: 0000 [#1] PREEMPT SMP NOPTI +[ 8687.785935] CPU: 51 PID: 172891 Comm: rmmod Kdump: loaded Tainted: G W I 5.19.0+ #2 +[ 8687.794800] Hardware name: Intel Corporation S2600WFD/S2600WFD, BIOS SE5C620.86B.0X.02.0001.051420190324 05/14/2019 +[ 8687.805222] RIP: 0010:i40e_lan_del_device+0x13/0xb0 [i40e] +[ 8687.810719] Code: d4 84 c0 0f 84 b8 25 01 00 e9 9c 25 01 00 41 bc f4 ff ff ff eb 91 90 0f 1f 44 00 00 41 54 55 53 48 8b 87 58 08 00 00 48 89 fb <48> 8b 68 30 48 89 ef e8 21 8a 0f d5 48 89 ef e8 a9 78 0f d5 48 8b +[ 8687.829462] RSP: 0018:ffffa604072efce0 EFLAGS: 00010202 +[ 8687.834689] RAX: 0000000000000000 RBX: ffff8f43833b2000 RCX: 0000000000000000 +[ 8687.841821] RDX: 0000000000000000 RSI: ffff8f4b0545b298 RDI: ffff8f43833b2000 +[ 8687.848955] RBP: ffff8f43833b2000 R08: 0000000000000001 R09: 0000000000000000 +[ 8687.856086] R10: 0000000000000000 R11: 000ffffffffff000 R12: ffff8f43833b2ef0 +[ 8687.863218] R13: ffff8f43833b2ef0 R14: ffff915103966000 R15: ffff8f43833b2008 +[ 8687.870342] FS: 00007f79501c3740(0000) GS:ffff8f4adffc0000(0000) knlGS:0000000000000000 +[ 8687.878427] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 8687.884174] CR2: 0000000000000030 CR3: 000000014276e004 CR4: 00000000007706e0 +[ 8687.891306] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 8687.898441] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 8687.905572] PKRU: 55555554 +[ 8687.908286] Call Trace: +[ 8687.910737] +[ 8687.912843] i40e_remove+0x2c0/0x330 [i40e] +[ 8687.917040] pci_device_remove+0x33/0xa0 +[ 8687.920962] device_release_driver_internal+0x1aa/0x230 +[ 8687.926188] driver_detach+0x44/0x90 +[ 8687.929770] bus_remove_driver+0x55/0xe0 +[ 8687.933693] pci_unregister_driver+0x2a/0xb0 +[ 8687.937967] i40e_exit_module+0xc/0xf48 [i40e] + +Two offline tests cause IRDMA driver failure (ETIMEDOUT) and this +failure is indicated back to i40e_client_subtask() that calls +i40e_client_del_instance() to free client instance referenced +by pf->cinst and sets this pointer to NULL. During the module +removal i40e_remove() calls i40e_lan_del_device() that dereferences +pf->cinst that is NULL -> crash. +Do not remove client instance when client open callbacks fails and +just clear __I40E_CLIENT_INSTANCE_OPENED bit. The driver also needs +to take care about this situation (when netdev is up and client +is NOT opened) in i40e_notify_client_of_netdev_close() and +calls client close callback only when __I40E_CLIENT_INSTANCE_OPENED +is set. + +Fixes: 0ef2d5afb12d ("i40e: KISS the client interface") +Signed-off-by: Ivan Vecera +Tested-by: Helena Anna Dubel +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_client.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/ethernet/intel/i40e/i40e_client.c +index ea2bb0140a6eb..10d7a982a5b9b 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_client.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_client.c +@@ -177,6 +177,10 @@ void i40e_notify_client_of_netdev_close(struct i40e_vsi *vsi, bool reset) + "Cannot locate client instance close routine\n"); + return; + } ++ if (!test_bit(__I40E_CLIENT_INSTANCE_OPENED, &cdev->state)) { ++ dev_dbg(&pf->pdev->dev, "Client is not open, abort close\n"); ++ return; ++ } + cdev->client->ops->close(&cdev->lan_info, cdev->client, reset); + clear_bit(__I40E_CLIENT_INSTANCE_OPENED, &cdev->state); + i40e_client_release_qvlist(&cdev->lan_info); +@@ -429,7 +433,6 @@ void i40e_client_subtask(struct i40e_pf *pf) + /* Remove failed client instance */ + clear_bit(__I40E_CLIENT_INSTANCE_OPENED, + &cdev->state); +- i40e_client_del_instance(pf); + return; + } + } +-- +2.35.1 + diff --git a/queue-5.19/iavf-detach-device-during-reset-task.patch b/queue-5.19/iavf-detach-device-during-reset-task.patch new file mode 100644 index 00000000000..5b1c134c8ec --- /dev/null +++ b/queue-5.19/iavf-detach-device-during-reset-task.patch @@ -0,0 +1,90 @@ +From fe6486a0ea5b211dd9b13564819f53e2e155020e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Aug 2022 10:16:27 +0200 +Subject: iavf: Detach device during reset task + +From: Ivan Vecera + +[ Upstream commit aa626da947e9cd30c4cf727493903e1adbb2c0a0 ] + +iavf_reset_task() takes crit_lock at the beginning and holds +it during whole call. The function subsequently calls +iavf_init_interrupt_scheme() that grabs RTNL. Problem occurs +when userspace initiates during the reset task any ndo callback +that runs under RTNL like iavf_open() because some of that +functions tries to take crit_lock. This leads to classic A-B B-A +deadlock scenario. + +To resolve this situation the device should be detached in +iavf_reset_task() prior taking crit_lock to avoid subsequent +ndos running under RTNL and reattach the device at the end. + +Fixes: 62fe2a865e6d ("i40evf: add missing rtnl_lock() around i40evf_set_interrupt_capability") +Cc: Jacob Keller +Cc: Patryk Piotrowski +Cc: SlawomirX Laba +Tested-by: Vitaly Grinberg +Signed-off-by: Ivan Vecera +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 6d159334da9ec..981c43b204ff4 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -2789,6 +2789,11 @@ static void iavf_reset_task(struct work_struct *work) + int i = 0, err; + bool running; + ++ /* Detach interface to avoid subsequent NDO callbacks */ ++ rtnl_lock(); ++ netif_device_detach(netdev); ++ rtnl_unlock(); ++ + /* When device is being removed it doesn't make sense to run the reset + * task, just return in such a case. + */ +@@ -2796,7 +2801,7 @@ static void iavf_reset_task(struct work_struct *work) + if (adapter->state != __IAVF_REMOVE) + queue_work(iavf_wq, &adapter->reset_task); + +- return; ++ goto reset_finish; + } + + while (!mutex_trylock(&adapter->client_lock)) +@@ -2866,7 +2871,6 @@ static void iavf_reset_task(struct work_struct *work) + + if (running) { + netif_carrier_off(netdev); +- netif_tx_stop_all_queues(netdev); + adapter->link_up = false; + iavf_napi_disable_all(adapter); + } +@@ -2996,7 +3000,7 @@ static void iavf_reset_task(struct work_struct *work) + mutex_unlock(&adapter->client_lock); + mutex_unlock(&adapter->crit_lock); + +- return; ++ goto reset_finish; + reset_err: + if (running) { + set_bit(__IAVF_VSI_DOWN, adapter->vsi.state); +@@ -3007,6 +3011,10 @@ static void iavf_reset_task(struct work_struct *work) + mutex_unlock(&adapter->client_lock); + mutex_unlock(&adapter->crit_lock); + dev_err(&adapter->pdev->dev, "failed to allocate resources during reinit\n"); ++reset_finish: ++ rtnl_lock(); ++ netif_device_attach(netdev); ++ rtnl_unlock(); + } + + /** +-- +2.35.1 + diff --git a/queue-5.19/ib-core-fix-a-nested-dead-lock-as-part-of-odp-flow.patch b/queue-5.19/ib-core-fix-a-nested-dead-lock-as-part-of-odp-flow.patch new file mode 100644 index 00000000000..d48d572f618 --- /dev/null +++ b/queue-5.19/ib-core-fix-a-nested-dead-lock-as-part-of-odp-flow.patch @@ -0,0 +1,94 @@ +From 573054dd38362cd4d7f10be519a6eaa75011073b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 09:10:36 +0300 +Subject: IB/core: Fix a nested dead lock as part of ODP flow + +From: Yishai Hadas + +[ Upstream commit 85eaeb5058f0f04dffb124c97c86b4f18db0b833 ] + +Fix a nested dead lock as part of ODP flow by using mmput_async(). + +From the below call trace [1] can see that calling mmput() once we have +the umem_odp->umem_mutex locked as required by +ib_umem_odp_map_dma_and_lock() might trigger in the same task the +exit_mmap()->__mmu_notifier_release()->mlx5_ib_invalidate_range() which +may dead lock when trying to lock the same mutex. + +Moving to use mmput_async() will solve the problem as the above +exit_mmap() flow will be called in other task and will be executed once +the lock will be available. + +[1] +[64843.077665] task:kworker/u133:2 state:D stack: 0 pid:80906 ppid: +2 flags:0x00004000 +[64843.077672] Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib] +[64843.077719] Call Trace: +[64843.077722] +[64843.077724] __schedule+0x23d/0x590 +[64843.077729] schedule+0x4e/0xb0 +[64843.077735] schedule_preempt_disabled+0xe/0x10 +[64843.077740] __mutex_lock.constprop.0+0x263/0x490 +[64843.077747] __mutex_lock_slowpath+0x13/0x20 +[64843.077752] mutex_lock+0x34/0x40 +[64843.077758] mlx5_ib_invalidate_range+0x48/0x270 [mlx5_ib] +[64843.077808] __mmu_notifier_release+0x1a4/0x200 +[64843.077816] exit_mmap+0x1bc/0x200 +[64843.077822] ? walk_page_range+0x9c/0x120 +[64843.077828] ? __cond_resched+0x1a/0x50 +[64843.077833] ? mutex_lock+0x13/0x40 +[64843.077839] ? uprobe_clear_state+0xac/0x120 +[64843.077860] mmput+0x5f/0x140 +[64843.077867] ib_umem_odp_map_dma_and_lock+0x21b/0x580 [ib_core] +[64843.077931] pagefault_real_mr+0x9a/0x140 [mlx5_ib] +[64843.077962] pagefault_mr+0xb4/0x550 [mlx5_ib] +[64843.077992] pagefault_single_data_segment.constprop.0+0x2ac/0x560 +[mlx5_ib] +[64843.078022] mlx5_ib_eqe_pf_action+0x528/0x780 [mlx5_ib] +[64843.078051] process_one_work+0x22b/0x3d0 +[64843.078059] worker_thread+0x53/0x410 +[64843.078065] ? process_one_work+0x3d0/0x3d0 +[64843.078073] kthread+0x12a/0x150 +[64843.078079] ? set_kthread_struct+0x50/0x50 +[64843.078085] ret_from_fork+0x22/0x30 +[64843.078093] + +Fixes: 36f30e486dce ("IB/core: Improve ODP to use hmm_range_fault()") +Reviewed-by: Maor Gottlieb +Signed-off-by: Yishai Hadas +Link: https://lore.kernel.org/r/74d93541ea533ef7daec6f126deb1072500aeb16.1661251841.git.leonro@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/umem_odp.c | 2 +- + kernel/fork.c | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c +index 186ed8859920c..d39e16c211e8a 100644 +--- a/drivers/infiniband/core/umem_odp.c ++++ b/drivers/infiniband/core/umem_odp.c +@@ -462,7 +462,7 @@ int ib_umem_odp_map_dma_and_lock(struct ib_umem_odp *umem_odp, u64 user_virt, + mutex_unlock(&umem_odp->umem_mutex); + + out_put_mm: +- mmput(owning_mm); ++ mmput_async(owning_mm); + out_put_task: + if (owning_process) + put_task_struct(owning_process); +diff --git a/kernel/fork.c b/kernel/fork.c +index 9d44f2d46c696..d587c85f35b1e 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1225,6 +1225,7 @@ void mmput_async(struct mm_struct *mm) + schedule_work(&mm->async_put_work); + } + } ++EXPORT_SYMBOL_GPL(mmput_async); + #endif + + /** +-- +2.35.1 + diff --git a/queue-5.19/ice-fix-dma-mappings-leak.patch b/queue-5.19/ice-fix-dma-mappings-leak.patch new file mode 100644 index 00000000000..987cf560362 --- /dev/null +++ b/queue-5.19/ice-fix-dma-mappings-leak.patch @@ -0,0 +1,232 @@ +From 240cf3c94e6d0a04a588d3612247b203ed382926 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Aug 2022 12:09:22 +0200 +Subject: ice: Fix DMA mappings leak + +From: Przemyslaw Patynowski + +[ Upstream commit 7e753eb675f0523207b184558638ee2eed6c9ac2 ] + +Fix leak, when user changes ring parameters. +During reallocation of RX buffers, new DMA mappings are created for +those buffers. New buffers with different RX ring count should +substitute older ones, but those buffers were freed in ice_vsi_cfg_rxq +and reallocated again with ice_alloc_rx_buf. kfree on rx_buf caused +leak of already mapped DMA. +Reallocate ZC with xdp_buf struct, when BPF program loads. Reallocate +back to rx_buf, when BPF program unloads. +If BPF program is loaded/unloaded and XSK pools are created, reallocate +RX queues accordingly in XDP_SETUP_XSK_POOL handler. + +Steps for reproduction: +while : +do + for ((i=0; i<=8160; i=i+32)) + do + ethtool -G enp130s0f0 rx $i tx $i + sleep 0.5 + ethtool -g enp130s0f0 + done +done + +Fixes: 617f3e1b588c ("ice: xsk: allocate separate memory for XDP SW ring") +Signed-off-by: Przemyslaw Patynowski +Signed-off-by: Mateusz Palczewski +Tested-by: Chandan (A Contingent Worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_base.c | 17 ------ + drivers/net/ethernet/intel/ice/ice_main.c | 8 +++ + drivers/net/ethernet/intel/ice/ice_xsk.c | 63 +++++++++++++++++++++++ + drivers/net/ethernet/intel/ice/ice_xsk.h | 8 +++ + 4 files changed, 79 insertions(+), 17 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_base.c b/drivers/net/ethernet/intel/ice/ice_base.c +index 136d7911adb48..1e32438081780 100644 +--- a/drivers/net/ethernet/intel/ice/ice_base.c ++++ b/drivers/net/ethernet/intel/ice/ice_base.c +@@ -7,18 +7,6 @@ + #include "ice_dcb_lib.h" + #include "ice_sriov.h" + +-static bool ice_alloc_rx_buf_zc(struct ice_rx_ring *rx_ring) +-{ +- rx_ring->xdp_buf = kcalloc(rx_ring->count, sizeof(*rx_ring->xdp_buf), GFP_KERNEL); +- return !!rx_ring->xdp_buf; +-} +- +-static bool ice_alloc_rx_buf(struct ice_rx_ring *rx_ring) +-{ +- rx_ring->rx_buf = kcalloc(rx_ring->count, sizeof(*rx_ring->rx_buf), GFP_KERNEL); +- return !!rx_ring->rx_buf; +-} +- + /** + * __ice_vsi_get_qs_contig - Assign a contiguous chunk of queues to VSI + * @qs_cfg: gathered variables needed for PF->VSI queues assignment +@@ -519,11 +507,8 @@ int ice_vsi_cfg_rxq(struct ice_rx_ring *ring) + xdp_rxq_info_reg(&ring->xdp_rxq, ring->netdev, + ring->q_index, ring->q_vector->napi.napi_id); + +- kfree(ring->rx_buf); + ring->xsk_pool = ice_xsk_pool(ring); + if (ring->xsk_pool) { +- if (!ice_alloc_rx_buf_zc(ring)) +- return -ENOMEM; + xdp_rxq_info_unreg_mem_model(&ring->xdp_rxq); + + ring->rx_buf_len = +@@ -538,8 +523,6 @@ int ice_vsi_cfg_rxq(struct ice_rx_ring *ring) + dev_info(dev, "Registered XDP mem model MEM_TYPE_XSK_BUFF_POOL on Rx ring %d\n", + ring->q_index); + } else { +- if (!ice_alloc_rx_buf(ring)) +- return -ENOMEM; + if (!xdp_rxq_info_is_reg(&ring->xdp_rxq)) + /* coverity[check_return] */ + xdp_rxq_info_reg(&ring->xdp_rxq, +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 3d45e075204e3..abc5d2b91f32b 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -2898,10 +2898,18 @@ ice_xdp_setup_prog(struct ice_vsi *vsi, struct bpf_prog *prog, + if (xdp_ring_err) + NL_SET_ERR_MSG_MOD(extack, "Setting up XDP Tx resources failed"); + } ++ /* reallocate Rx queues that are used for zero-copy */ ++ xdp_ring_err = ice_realloc_zc_buf(vsi, true); ++ if (xdp_ring_err) ++ NL_SET_ERR_MSG_MOD(extack, "Setting up XDP Rx resources failed"); + } else if (ice_is_xdp_ena_vsi(vsi) && !prog) { + xdp_ring_err = ice_destroy_xdp_rings(vsi); + if (xdp_ring_err) + NL_SET_ERR_MSG_MOD(extack, "Freeing XDP Tx resources failed"); ++ /* reallocate Rx queues that were used for zero-copy */ ++ xdp_ring_err = ice_realloc_zc_buf(vsi, false); ++ if (xdp_ring_err) ++ NL_SET_ERR_MSG_MOD(extack, "Freeing XDP Rx resources failed"); + } else { + /* safe to call even when prog == vsi->xdp_prog as + * dev_xdp_install in net/core/dev.c incremented prog's +diff --git a/drivers/net/ethernet/intel/ice/ice_xsk.c b/drivers/net/ethernet/intel/ice/ice_xsk.c +index e48e29258450f..03ce85f6e6df8 100644 +--- a/drivers/net/ethernet/intel/ice/ice_xsk.c ++++ b/drivers/net/ethernet/intel/ice/ice_xsk.c +@@ -192,6 +192,7 @@ static int ice_qp_dis(struct ice_vsi *vsi, u16 q_idx) + err = ice_vsi_ctrl_one_rx_ring(vsi, false, q_idx, true); + if (err) + return err; ++ ice_clean_rx_ring(rx_ring); + + ice_qvec_toggle_napi(vsi, q_vector, false); + ice_qp_clean_rings(vsi, q_idx); +@@ -316,6 +317,62 @@ ice_xsk_pool_enable(struct ice_vsi *vsi, struct xsk_buff_pool *pool, u16 qid) + return 0; + } + ++/** ++ * ice_realloc_rx_xdp_bufs - reallocate for either XSK or normal buffer ++ * @rx_ring: Rx ring ++ * @pool_present: is pool for XSK present ++ * ++ * Try allocating memory and return ENOMEM, if failed to allocate. ++ * If allocation was successful, substitute buffer with allocated one. ++ * Returns 0 on success, negative on failure ++ */ ++static int ++ice_realloc_rx_xdp_bufs(struct ice_rx_ring *rx_ring, bool pool_present) ++{ ++ size_t elem_size = pool_present ? sizeof(*rx_ring->xdp_buf) : ++ sizeof(*rx_ring->rx_buf); ++ void *sw_ring = kcalloc(rx_ring->count, elem_size, GFP_KERNEL); ++ ++ if (!sw_ring) ++ return -ENOMEM; ++ ++ if (pool_present) { ++ kfree(rx_ring->rx_buf); ++ rx_ring->rx_buf = NULL; ++ rx_ring->xdp_buf = sw_ring; ++ } else { ++ kfree(rx_ring->xdp_buf); ++ rx_ring->xdp_buf = NULL; ++ rx_ring->rx_buf = sw_ring; ++ } ++ ++ return 0; ++} ++ ++/** ++ * ice_realloc_zc_buf - reallocate XDP ZC queue pairs ++ * @vsi: Current VSI ++ * @zc: is zero copy set ++ * ++ * Reallocate buffer for rx_rings that might be used by XSK. ++ * XDP requires more memory, than rx_buf provides. ++ * Returns 0 on success, negative on failure ++ */ ++int ice_realloc_zc_buf(struct ice_vsi *vsi, bool zc) ++{ ++ struct ice_rx_ring *rx_ring; ++ unsigned long q; ++ ++ for_each_set_bit(q, vsi->af_xdp_zc_qps, ++ max_t(int, vsi->alloc_txq, vsi->alloc_rxq)) { ++ rx_ring = vsi->rx_rings[q]; ++ if (ice_realloc_rx_xdp_bufs(rx_ring, zc)) ++ return -ENOMEM; ++ } ++ ++ return 0; ++} ++ + /** + * ice_xsk_pool_setup - enable/disable a buffer pool region depending on its state + * @vsi: Current VSI +@@ -345,11 +402,17 @@ int ice_xsk_pool_setup(struct ice_vsi *vsi, struct xsk_buff_pool *pool, u16 qid) + if_running = netif_running(vsi->netdev) && ice_is_xdp_ena_vsi(vsi); + + if (if_running) { ++ struct ice_rx_ring *rx_ring = vsi->rx_rings[qid]; ++ + ret = ice_qp_dis(vsi, qid); + if (ret) { + netdev_err(vsi->netdev, "ice_qp_dis error = %d\n", ret); + goto xsk_pool_if_up; + } ++ ++ ret = ice_realloc_rx_xdp_bufs(rx_ring, pool_present); ++ if (ret) ++ goto xsk_pool_if_up; + } + + pool_failure = pool_present ? ice_xsk_pool_enable(vsi, pool, qid) : +diff --git a/drivers/net/ethernet/intel/ice/ice_xsk.h b/drivers/net/ethernet/intel/ice/ice_xsk.h +index 21faec8e97db1..4edbe81eb6460 100644 +--- a/drivers/net/ethernet/intel/ice/ice_xsk.h ++++ b/drivers/net/ethernet/intel/ice/ice_xsk.h +@@ -27,6 +27,7 @@ bool ice_xsk_any_rx_ring_ena(struct ice_vsi *vsi); + void ice_xsk_clean_rx_ring(struct ice_rx_ring *rx_ring); + void ice_xsk_clean_xdp_ring(struct ice_tx_ring *xdp_ring); + bool ice_xmit_zc(struct ice_tx_ring *xdp_ring, u32 budget, int napi_budget); ++int ice_realloc_zc_buf(struct ice_vsi *vsi, bool zc); + #else + static inline bool + ice_xmit_zc(struct ice_tx_ring __always_unused *xdp_ring, +@@ -72,5 +73,12 @@ ice_xsk_wakeup(struct net_device __always_unused *netdev, + + static inline void ice_xsk_clean_rx_ring(struct ice_rx_ring *rx_ring) { } + static inline void ice_xsk_clean_xdp_ring(struct ice_tx_ring *xdp_ring) { } ++ ++static inline int ++ice_realloc_zc_buf(struct ice_vsi __always_unused *vsi, ++ bool __always_unused zc) ++{ ++ return 0; ++} + #endif /* CONFIG_XDP_SOCKETS */ + #endif /* !_ICE_XSK_H_ */ +-- +2.35.1 + diff --git a/queue-5.19/ice-use-bitmap_free-instead-of-devm_kfree.patch b/queue-5.19/ice-use-bitmap_free-instead-of-devm_kfree.patch new file mode 100644 index 00000000000..18fd3456c1e --- /dev/null +++ b/queue-5.19/ice-use-bitmap_free-instead-of-devm_kfree.patch @@ -0,0 +1,37 @@ +From a9341b05dcb8f323c99b3324b59f6541057ec6ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Aug 2022 10:53:20 +0200 +Subject: ice: use bitmap_free instead of devm_kfree + +From: Michal Swiatkowski + +[ Upstream commit 59ac325557b6c14f1f793b90d3946bc145ffa085 ] + +pf->avail_txqs was allocated using bitmap_zalloc, bitmap_free should be +used to free this memory. + +Fixes: 78b5713ac1241 ("ice: Alloc queue management bitmaps and arrays dynamically") +Signed-off-by: Michal Swiatkowski +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index abc5d2b91f32b..4c6bb7482b362 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -3912,7 +3912,7 @@ static int ice_init_pf(struct ice_pf *pf) + + pf->avail_rxqs = bitmap_zalloc(pf->max_pf_rxqs, GFP_KERNEL); + if (!pf->avail_rxqs) { +- devm_kfree(ice_pf_to_dev(pf), pf->avail_txqs); ++ bitmap_free(pf->avail_txqs); + pf->avail_txqs = NULL; + return -ENOMEM; + } +-- +2.35.1 + diff --git a/queue-5.19/io_uring-recycle-kbuf-recycle-on-tw-requeue.patch b/queue-5.19/io_uring-recycle-kbuf-recycle-on-tw-requeue.patch new file mode 100644 index 00000000000..1308afd870b --- /dev/null +++ b/queue-5.19/io_uring-recycle-kbuf-recycle-on-tw-requeue.patch @@ -0,0 +1,38 @@ +From b2d70c4d229c52ff81c1a1c5cf024e335d76e48a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Sep 2022 17:11:17 +0100 +Subject: io_uring: recycle kbuf recycle on tw requeue + +From: Pavel Begunkov + +[ Upstream commit 336d28a8f38013a069f2d46e73aaa1880ef17a47 ] + +When we queue a request via tw for execution it's not going to be +executed immediately, so when io_queue_async() hits IO_APOLL_READY +and queues a tw but doesn't try to recycle/consume the buffer some other +request may try to use the the buffer. + +Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers") +Signed-off-by: Pavel Begunkov +Link: https://lore.kernel.org/r/a19bc9e211e3184215a58e129b62f440180e9212.1662480490.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/io_uring.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index cd155b7e1346d..effe3570a051f 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -8260,6 +8260,7 @@ static void io_queue_async(struct io_kiocb *req, int ret) + + switch (io_arm_poll_handler(req, 0)) { + case IO_APOLL_READY: ++ io_kbuf_recycle(req, 0); + io_req_task_queue(req); + break; + case IO_APOLL_ABORTED: +-- +2.35.1 + diff --git a/queue-5.19/ipv6-sr-fix-out-of-bounds-read-when-setting-hmac-dat.patch b/queue-5.19/ipv6-sr-fix-out-of-bounds-read-when-setting-hmac-dat.patch new file mode 100644 index 00000000000..6c614acce3a --- /dev/null +++ b/queue-5.19/ipv6-sr-fix-out-of-bounds-read-when-setting-hmac-dat.patch @@ -0,0 +1,78 @@ +From cf39fd8c244d38e449abe08ecdc1739cbb75073d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Sep 2022 10:45:06 +0100 +Subject: ipv6: sr: fix out-of-bounds read when setting HMAC data. + +From: David Lebrun + +[ Upstream commit 84a53580c5d2138c7361c7c3eea5b31827e63b35 ] + +The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 +Segment Routing Headers. This configuration is realised via netlink through +four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and +SEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actual +length of the SECRET attribute, it is possible to provide invalid combinations +(e.g., secret = "", secretlen = 64). This case is not checked in the code and +with an appropriately crafted netlink message, an out-of-bounds read of up +to 64 bytes (max secret length) can occur past the skb end pointer and into +skb_shared_info: + +Breakpoint 1, seg6_genl_sethmac (skb=, info=) at net/ipv6/seg6.c:208 +208 memcpy(hinfo->secret, secret, slen); +(gdb) bt + #0 seg6_genl_sethmac (skb=, info=) at net/ipv6/seg6.c:208 + #1 0xffffffff81e012e9 in genl_family_rcv_msg_doit (skb=skb@entry=0xffff88800b1f9f00, nlh=nlh@entry=0xffff88800b1b7600, + extack=extack@entry=0xffffc90000ba7af0, ops=ops@entry=0xffffc90000ba7a80, hdrlen=4, net=0xffffffff84237580 , family=, + family=) at net/netlink/genetlink.c:731 + #2 0xffffffff81e01435 in genl_family_rcv_msg (extack=0xffffc90000ba7af0, nlh=0xffff88800b1b7600, skb=0xffff88800b1f9f00, + family=0xffffffff82fef6c0 ) at net/netlink/genetlink.c:775 + #3 genl_rcv_msg (skb=0xffff88800b1f9f00, nlh=0xffff88800b1b7600, extack=0xffffc90000ba7af0) at net/netlink/genetlink.c:792 + #4 0xffffffff81dfffc3 in netlink_rcv_skb (skb=skb@entry=0xffff88800b1f9f00, cb=cb@entry=0xffffffff81e01350 ) + at net/netlink/af_netlink.c:2501 + #5 0xffffffff81e00919 in genl_rcv (skb=0xffff88800b1f9f00) at net/netlink/genetlink.c:803 + #6 0xffffffff81dff6ae in netlink_unicast_kernel (ssk=0xffff888010eec800, skb=0xffff88800b1f9f00, sk=0xffff888004aed000) + at net/netlink/af_netlink.c:1319 + #7 netlink_unicast (ssk=ssk@entry=0xffff888010eec800, skb=skb@entry=0xffff88800b1f9f00, portid=portid@entry=0, nonblock=) + at net/netlink/af_netlink.c:1345 + #8 0xffffffff81dff9a4 in netlink_sendmsg (sock=, msg=0xffffc90000ba7e48, len=) at net/netlink/af_netlink.c:1921 +... +(gdb) p/x ((struct sk_buff *)0xffff88800b1f9f00)->head + ((struct sk_buff *)0xffff88800b1f9f00)->end +$1 = 0xffff88800b1b76c0 +(gdb) p/x secret +$2 = 0xffff88800b1b76c0 +(gdb) p slen +$3 = 64 '@' + +The OOB data can then be read back from userspace by dumping HMAC state. This +commit fixes this by ensuring SECRETLEN cannot exceed the actual length of +SECRET. + +Reported-by: Lucas Leong +Tested: verified that EINVAL is correctly returned when secretlen > len(secret) +Fixes: 4f4853dc1c9c1 ("ipv6: sr: implement API to control SR HMAC structure") +Signed-off-by: David Lebrun +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/seg6.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c +index 73aaabf0e9665..0b0e34ddc64e0 100644 +--- a/net/ipv6/seg6.c ++++ b/net/ipv6/seg6.c +@@ -191,6 +191,11 @@ static int seg6_genl_sethmac(struct sk_buff *skb, struct genl_info *info) + goto out_unlock; + } + ++ if (slen > nla_len(info->attrs[SEG6_ATTR_SECRET])) { ++ err = -EINVAL; ++ goto out_unlock; ++ } ++ + if (hinfo) { + err = seg6_hmac_info_del(net, hmackeyid); + if (err) +-- +2.35.1 + diff --git a/queue-5.19/kunit-fix-assert_type-for-comparison-macros.patch b/queue-5.19/kunit-fix-assert_type-for-comparison-macros.patch new file mode 100644 index 00000000000..f40904319fe --- /dev/null +++ b/queue-5.19/kunit-fix-assert_type-for-comparison-macros.patch @@ -0,0 +1,70 @@ +From d1a50de1381f7731337dc4aaa6162bc85b5192d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Aug 2022 17:01:47 +0200 +Subject: kunit: fix assert_type for comparison macros + +From: Sander Vanheule + +[ Upstream commit aded3cad909581c60335037112c4f86bbfe90f17 ] + +When replacing KUNIT_BINARY_*_MSG_ASSERTION() macros with +KUNIT_BINARY_INT_ASSERTION(), the assert_type parameter was not always +correctly transferred. Specifically, the following errors were +introduced: + - KUNIT_EXPECT_LE_MSG() uses KUNIT_ASSERTION + - KUNIT_ASSERT_LT_MSG() uses KUNIT_EXPECTATION + - KUNIT_ASSERT_GT_MSG() uses KUNIT_EXPECTATION + +A failing KUNIT_EXPECT_LE_MSG() test thus prevents further tests from +running, while failing KUNIT_ASSERT_{LT,GT}_MSG() tests do not prevent +further tests from running. This is contrary to the documentation, +which states that failing KUNIT_EXPECT_* macros allow further tests to +run, while failing KUNIT_ASSERT_* macros should prevent this. + +Revert the KUNIT_{ASSERTION,EXPECTATION} switches to fix the behaviour +for the affected macros. + +Fixes: 40f39777ce4f ("kunit: decrease macro layering for integer asserts") +Signed-off-by: Sander Vanheule +Reviewed-by: Daniel Latypov +Reviewed-by: Brendan Higgins +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + include/kunit/test.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/include/kunit/test.h b/include/kunit/test.h +index 8ffcd7de96070..648dbb00a3008 100644 +--- a/include/kunit/test.h ++++ b/include/kunit/test.h +@@ -863,7 +863,7 @@ do { \ + + #define KUNIT_EXPECT_LE_MSG(test, left, right, fmt, ...) \ + KUNIT_BINARY_INT_ASSERTION(test, \ +- KUNIT_ASSERTION, \ ++ KUNIT_EXPECTATION, \ + left, <=, right, \ + fmt, \ + ##__VA_ARGS__) +@@ -1153,7 +1153,7 @@ do { \ + + #define KUNIT_ASSERT_LT_MSG(test, left, right, fmt, ...) \ + KUNIT_BINARY_INT_ASSERTION(test, \ +- KUNIT_EXPECTATION, \ ++ KUNIT_ASSERTION, \ + left, <, right, \ + fmt, \ + ##__VA_ARGS__) +@@ -1194,7 +1194,7 @@ do { \ + + #define KUNIT_ASSERT_GT_MSG(test, left, right, fmt, ...) \ + KUNIT_BINARY_INT_ASSERTION(test, \ +- KUNIT_EXPECTATION, \ ++ KUNIT_ASSERTION, \ + left, >, right, \ + fmt, \ + ##__VA_ARGS__) +-- +2.35.1 + diff --git a/queue-5.19/libperf-evlist-fix-per-thread-mmaps-for-multi-thread.patch b/queue-5.19/libperf-evlist-fix-per-thread-mmaps-for-multi-thread.patch new file mode 100644 index 00000000000..1608f0f2435 --- /dev/null +++ b/queue-5.19/libperf-evlist-fix-per-thread-mmaps-for-multi-thread.patch @@ -0,0 +1,220 @@ +From 1e580f29974812262ec366f58fd44794282091ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Sep 2022 14:42:09 +0300 +Subject: libperf evlist: Fix per-thread mmaps for multi-threaded targets +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Adrian Hunter + +[ Upstream commit 7864d8f7c088aad988c44c631f1ceed9179cf2cf ] + +The offending commit removed mmap_per_thread(), which did not consider +the different set-output rules for per-thread mmaps i.e. in the per-thread +case set-output is used for file descriptors of the same thread not the +same cpu. + +This was not immediately noticed because it only happens with +multi-threaded targets and we do not have a test for that yet. + +Reinstate mmap_per_thread() expanding it to cover also system-wide per-cpu +events i.e. to continue to allow the mixing of per-thread and per-cpu +mmaps. + +Debug messages (with -vv) show the file descriptors that are opened with +sys_perf_event_open. New debug messages are added (needs -vvv) that show +also which file descriptors are mmapped and which are redirected with +set-output. + +In the per-cpu case (cpu != -1) file descriptors for the same CPU are +set-output to the first file descriptor for that CPU. + +In the per-thread case (cpu == -1) file descriptors for the same thread are +set-output to the first file descriptor for that thread. + +Example (process 17489 has 2 threads): + + Before (but with new debug prints): + + $ perf record --no-bpf-event -vvv --per-thread -p 17489 + + sys_perf_event_open: pid 17489 cpu -1 group_fd -1 flags 0x8 = 5 + sys_perf_event_open: pid 17490 cpu -1 group_fd -1 flags 0x8 = 6 + + libperf: idx 0: mmapping fd 5 + libperf: idx 0: set output fd 6 -> 5 + failed to mmap with 22 (Invalid argument) + + After: + + $ perf record --no-bpf-event -vvv --per-thread -p 17489 + + sys_perf_event_open: pid 17489 cpu -1 group_fd -1 flags 0x8 = 5 + sys_perf_event_open: pid 17490 cpu -1 group_fd -1 flags 0x8 = 6 + + libperf: mmap_per_thread: nr cpu values (may include -1) 1 nr threads 2 + libperf: idx 0: mmapping fd 5 + libperf: idx 1: mmapping fd 6 + + [ perf record: Woken up 2 times to write data ] + [ perf record: Captured and wrote 0.018 MB perf.data (15 samples) ] + +Per-cpu example (process 20341 has 2 threads, same as above): + + $ perf record --no-bpf-event -vvv -p 20341 + + sys_perf_event_open: pid 20341 cpu 0 group_fd -1 flags 0x8 = 5 + sys_perf_event_open: pid 20342 cpu 0 group_fd -1 flags 0x8 = 6 + sys_perf_event_open: pid 20341 cpu 1 group_fd -1 flags 0x8 = 7 + sys_perf_event_open: pid 20342 cpu 1 group_fd -1 flags 0x8 = 8 + sys_perf_event_open: pid 20341 cpu 2 group_fd -1 flags 0x8 = 9 + sys_perf_event_open: pid 20342 cpu 2 group_fd -1 flags 0x8 = 10 + sys_perf_event_open: pid 20341 cpu 3 group_fd -1 flags 0x8 = 11 + sys_perf_event_open: pid 20342 cpu 3 group_fd -1 flags 0x8 = 12 + sys_perf_event_open: pid 20341 cpu 4 group_fd -1 flags 0x8 = 13 + sys_perf_event_open: pid 20342 cpu 4 group_fd -1 flags 0x8 = 14 + sys_perf_event_open: pid 20341 cpu 5 group_fd -1 flags 0x8 = 15 + sys_perf_event_open: pid 20342 cpu 5 group_fd -1 flags 0x8 = 16 + sys_perf_event_open: pid 20341 cpu 6 group_fd -1 flags 0x8 = 17 + sys_perf_event_open: pid 20342 cpu 6 group_fd -1 flags 0x8 = 18 + sys_perf_event_open: pid 20341 cpu 7 group_fd -1 flags 0x8 = 19 + sys_perf_event_open: pid 20342 cpu 7 group_fd -1 flags 0x8 = 20 + + libperf: mmap_per_cpu: nr cpu values 8 nr threads 2 + libperf: idx 0: mmapping fd 5 + libperf: idx 0: set output fd 6 -> 5 + libperf: idx 1: mmapping fd 7 + libperf: idx 1: set output fd 8 -> 7 + libperf: idx 2: mmapping fd 9 + libperf: idx 2: set output fd 10 -> 9 + libperf: idx 3: mmapping fd 11 + libperf: idx 3: set output fd 12 -> 11 + libperf: idx 4: mmapping fd 13 + libperf: idx 4: set output fd 14 -> 13 + libperf: idx 5: mmapping fd 15 + libperf: idx 5: set output fd 16 -> 15 + libperf: idx 6: mmapping fd 17 + libperf: idx 6: set output fd 18 -> 17 + libperf: idx 7: mmapping fd 19 + libperf: idx 7: set output fd 20 -> 19 + + [ perf record: Woken up 7 times to write data ] + [ perf record: Captured and wrote 0.020 MB perf.data (17 samples) ] + +Fixes: ae4f8ae16a078964 ("libperf evlist: Allow mixing per-thread and per-cpu mmaps") +Reported-by: Tomáš Trnka +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216441 +Signed-off-by: Adrian Hunter +Acked-by: Jiri Olsa +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20220905114209.8389-1-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/perf/evlist.c | 50 +++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 50 insertions(+) + +diff --git a/tools/lib/perf/evlist.c b/tools/lib/perf/evlist.c +index e6c98a6e3908e..6b1bafe267a42 100644 +--- a/tools/lib/perf/evlist.c ++++ b/tools/lib/perf/evlist.c +@@ -486,6 +486,7 @@ mmap_per_evsel(struct perf_evlist *evlist, struct perf_evlist_mmap_ops *ops, + if (ops->idx) + ops->idx(evlist, evsel, mp, idx); + ++ pr_debug("idx %d: mmapping fd %d\n", idx, *output); + if (ops->mmap(map, mp, *output, evlist_cpu) < 0) + return -1; + +@@ -494,6 +495,7 @@ mmap_per_evsel(struct perf_evlist *evlist, struct perf_evlist_mmap_ops *ops, + if (!idx) + perf_evlist__set_mmap_first(evlist, map, overwrite); + } else { ++ pr_debug("idx %d: set output fd %d -> %d\n", idx, fd, *output); + if (ioctl(fd, PERF_EVENT_IOC_SET_OUTPUT, *output) != 0) + return -1; + +@@ -519,6 +521,48 @@ mmap_per_evsel(struct perf_evlist *evlist, struct perf_evlist_mmap_ops *ops, + return 0; + } + ++static int ++mmap_per_thread(struct perf_evlist *evlist, struct perf_evlist_mmap_ops *ops, ++ struct perf_mmap_param *mp) ++{ ++ int nr_threads = perf_thread_map__nr(evlist->threads); ++ int nr_cpus = perf_cpu_map__nr(evlist->all_cpus); ++ int cpu, thread, idx = 0; ++ int nr_mmaps = 0; ++ ++ pr_debug("%s: nr cpu values (may include -1) %d nr threads %d\n", ++ __func__, nr_cpus, nr_threads); ++ ++ /* per-thread mmaps */ ++ for (thread = 0; thread < nr_threads; thread++, idx++) { ++ int output = -1; ++ int output_overwrite = -1; ++ ++ if (mmap_per_evsel(evlist, ops, idx, mp, 0, thread, &output, ++ &output_overwrite, &nr_mmaps)) ++ goto out_unmap; ++ } ++ ++ /* system-wide mmaps i.e. per-cpu */ ++ for (cpu = 1; cpu < nr_cpus; cpu++, idx++) { ++ int output = -1; ++ int output_overwrite = -1; ++ ++ if (mmap_per_evsel(evlist, ops, idx, mp, cpu, 0, &output, ++ &output_overwrite, &nr_mmaps)) ++ goto out_unmap; ++ } ++ ++ if (nr_mmaps != evlist->nr_mmaps) ++ pr_err("Miscounted nr_mmaps %d vs %d\n", nr_mmaps, evlist->nr_mmaps); ++ ++ return 0; ++ ++out_unmap: ++ perf_evlist__munmap(evlist); ++ return -1; ++} ++ + static int + mmap_per_cpu(struct perf_evlist *evlist, struct perf_evlist_mmap_ops *ops, + struct perf_mmap_param *mp) +@@ -528,6 +572,8 @@ mmap_per_cpu(struct perf_evlist *evlist, struct perf_evlist_mmap_ops *ops, + int nr_mmaps = 0; + int cpu, thread; + ++ pr_debug("%s: nr cpu values %d nr threads %d\n", __func__, nr_cpus, nr_threads); ++ + for (cpu = 0; cpu < nr_cpus; cpu++) { + int output = -1; + int output_overwrite = -1; +@@ -569,6 +615,7 @@ int perf_evlist__mmap_ops(struct perf_evlist *evlist, + struct perf_evlist_mmap_ops *ops, + struct perf_mmap_param *mp) + { ++ const struct perf_cpu_map *cpus = evlist->all_cpus; + struct perf_evsel *evsel; + + if (!ops || !ops->get || !ops->mmap) +@@ -588,6 +635,9 @@ int perf_evlist__mmap_ops(struct perf_evlist *evlist, + if (evlist->pollfd.entries == NULL && perf_evlist__alloc_pollfd(evlist) < 0) + return -ENOMEM; + ++ if (perf_cpu_map__empty(cpus)) ++ return mmap_per_thread(evlist, ops, mp); ++ + return mmap_per_cpu(evlist, ops, mp); + } + +-- +2.35.1 + diff --git a/queue-5.19/net-dsa-felix-access-qsys_tag_config-under-tas_lock-.patch b/queue-5.19/net-dsa-felix-access-qsys_tag_config-under-tas_lock-.patch new file mode 100644 index 00000000000..a96e5b16db6 --- /dev/null +++ b/queue-5.19/net-dsa-felix-access-qsys_tag_config-under-tas_lock-.patch @@ -0,0 +1,48 @@ +From ddd733eac4f1f0feee2d5e37a9ee3923f339e4c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Sep 2022 20:01:25 +0300 +Subject: net: dsa: felix: access QSYS_TAG_CONFIG under tas_lock in + vsc9959_sched_speed_set + +From: Vladimir Oltean + +[ Upstream commit a4bb481aeb9d84cb53112a478e6db4705b794c34 ] + +The read-modify-write of QSYS_TAG_CONFIG from vsc9959_sched_speed_set() +runs unlocked with respect to the other functions that access it, which +are vsc9959_tas_guard_bands_update(), vsc9959_qos_port_tas_set() and +vsc9959_tas_clock_adjust(). All the others are under ocelot->tas_lock, +so move the vsc9959_sched_speed_set() access under that lock as well, to +resolve the concurrency. + +Fixes: 55a515b1f5a9 ("net: dsa: felix: drop oversized frames with tc-taprio instead of hanging the port") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/ocelot/felix_vsc9959.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/ocelot/felix_vsc9959.c b/drivers/net/dsa/ocelot/felix_vsc9959.c +index 2a5822c619ef3..f1767a6b9271c 100644 +--- a/drivers/net/dsa/ocelot/felix_vsc9959.c ++++ b/drivers/net/dsa/ocelot/felix_vsc9959.c +@@ -1664,13 +1664,13 @@ static void vsc9959_sched_speed_set(struct ocelot *ocelot, int port, + break; + } + ++ mutex_lock(&ocelot->tas_lock); ++ + ocelot_rmw_rix(ocelot, + QSYS_TAG_CONFIG_LINK_SPEED(tas_speed), + QSYS_TAG_CONFIG_LINK_SPEED_M, + QSYS_TAG_CONFIG, port); + +- mutex_lock(&ocelot->tas_lock); +- + if (ocelot_port->taprio) + vsc9959_tas_guard_bands_update(ocelot, port); + +-- +2.35.1 + diff --git a/queue-5.19/net-dsa-felix-disable-cut-through-forwarding-for-fra.patch b/queue-5.19/net-dsa-felix-disable-cut-through-forwarding-for-fra.patch new file mode 100644 index 00000000000..d5b3c59d24c --- /dev/null +++ b/queue-5.19/net-dsa-felix-disable-cut-through-forwarding-for-fra.patch @@ -0,0 +1,221 @@ +From 8def554a1e9e0b4a3adaf8a479a554c310113263 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Sep 2022 20:01:24 +0300 +Subject: net: dsa: felix: disable cut-through forwarding for frames oversized + for tc-taprio + +From: Vladimir Oltean + +[ Upstream commit 843794bbdef83955ae5b43dfafc355c3786e2145 ] + +Experimentally, it looks like when QSYS_QMAXSDU_CFG_7 is set to 605, +frames even way larger than 601 octets are transmitted even though these +should be considered as oversized, according to the documentation, and +dropped. + +Since oversized frame dropping depends on frame size, which is only +known at the EOF stage, and therefore not at SOF when cut-through +forwarding begins, it means that the switch cannot take QSYS_QMAXSDU_CFG_* +into consideration for traffic classes that are cut-through. + +Since cut-through forwarding has no UAPI to control it, and the driver +enables it based on the mantra "if we can, then why not", the strategy +is to alter vsc9959_cut_through_fwd() to take into consideration which +tc's have oversize frame dropping enabled, and disable cut-through for +them. Then, from vsc9959_tas_guard_bands_update(), we re-trigger the +cut-through determination process. + +There are 2 strategies for vsc9959_cut_through_fwd() to determine +whether a tc has oversized dropping enabled or not. One is to keep a bit +mask of traffic classes per port, and the other is to read back from the +hardware registers (a non-zero value of QSYS_QMAXSDU_CFG_* means the +feature is enabled). We choose reading back from registers, because +struct ocelot_port is shared with drivers (ocelot, seville) that don't +support either cut-through nor tc-taprio, and we don't have a felix +specific extension of struct ocelot_port. Furthermore, reading registers +from the Felix hardware is quite cheap, since they are memory-mapped. + +Fixes: 55a515b1f5a9 ("net: dsa: felix: drop oversized frames with tc-taprio instead of hanging the port") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/ocelot/felix_vsc9959.c | 122 ++++++++++++++++--------- + 1 file changed, 79 insertions(+), 43 deletions(-) + +diff --git a/drivers/net/dsa/ocelot/felix_vsc9959.c b/drivers/net/dsa/ocelot/felix_vsc9959.c +index 6439b56f381f9..2a5822c619ef3 100644 +--- a/drivers/net/dsa/ocelot/felix_vsc9959.c ++++ b/drivers/net/dsa/ocelot/felix_vsc9959.c +@@ -1471,6 +1471,65 @@ static void vsc9959_tas_min_gate_lengths(struct tc_taprio_qopt_offload *taprio, + min_gate_len[tc] = 0; + } + ++/* ocelot_write_rix is a macro that concatenates QSYS_MAXSDU_CFG_* with _RSZ, ++ * so we need to spell out the register access to each traffic class in helper ++ * functions, to simplify callers ++ */ ++static void vsc9959_port_qmaxsdu_set(struct ocelot *ocelot, int port, int tc, ++ u32 max_sdu) ++{ ++ switch (tc) { ++ case 0: ++ ocelot_write_rix(ocelot, max_sdu, QSYS_QMAXSDU_CFG_0, ++ port); ++ break; ++ case 1: ++ ocelot_write_rix(ocelot, max_sdu, QSYS_QMAXSDU_CFG_1, ++ port); ++ break; ++ case 2: ++ ocelot_write_rix(ocelot, max_sdu, QSYS_QMAXSDU_CFG_2, ++ port); ++ break; ++ case 3: ++ ocelot_write_rix(ocelot, max_sdu, QSYS_QMAXSDU_CFG_3, ++ port); ++ break; ++ case 4: ++ ocelot_write_rix(ocelot, max_sdu, QSYS_QMAXSDU_CFG_4, ++ port); ++ break; ++ case 5: ++ ocelot_write_rix(ocelot, max_sdu, QSYS_QMAXSDU_CFG_5, ++ port); ++ break; ++ case 6: ++ ocelot_write_rix(ocelot, max_sdu, QSYS_QMAXSDU_CFG_6, ++ port); ++ break; ++ case 7: ++ ocelot_write_rix(ocelot, max_sdu, QSYS_QMAXSDU_CFG_7, ++ port); ++ break; ++ } ++} ++ ++static u32 vsc9959_port_qmaxsdu_get(struct ocelot *ocelot, int port, int tc) ++{ ++ switch (tc) { ++ case 0: return ocelot_read_rix(ocelot, QSYS_QMAXSDU_CFG_0, port); ++ case 1: return ocelot_read_rix(ocelot, QSYS_QMAXSDU_CFG_1, port); ++ case 2: return ocelot_read_rix(ocelot, QSYS_QMAXSDU_CFG_2, port); ++ case 3: return ocelot_read_rix(ocelot, QSYS_QMAXSDU_CFG_3, port); ++ case 4: return ocelot_read_rix(ocelot, QSYS_QMAXSDU_CFG_4, port); ++ case 5: return ocelot_read_rix(ocelot, QSYS_QMAXSDU_CFG_5, port); ++ case 6: return ocelot_read_rix(ocelot, QSYS_QMAXSDU_CFG_6, port); ++ case 7: return ocelot_read_rix(ocelot, QSYS_QMAXSDU_CFG_7, port); ++ default: ++ return 0; ++ } ++} ++ + /* Update QSYS_PORT_MAX_SDU to make sure the static guard bands added by the + * switch (see the ALWAYS_GUARD_BAND_SCH_Q comment) are correct at all MTU + * values (the default value is 1518). Also, for traffic class windows smaller +@@ -1527,6 +1586,8 @@ static void vsc9959_tas_guard_bands_update(struct ocelot *ocelot, int port) + + vsc9959_tas_min_gate_lengths(ocelot_port->taprio, min_gate_len); + ++ mutex_lock(&ocelot->fwd_domain_lock); ++ + for (tc = 0; tc < OCELOT_NUM_TC; tc++) { + u32 max_sdu; + +@@ -1569,47 +1630,14 @@ static void vsc9959_tas_guard_bands_update(struct ocelot *ocelot, int port) + max_sdu); + } + +- /* ocelot_write_rix is a macro that concatenates +- * QSYS_MAXSDU_CFG_* with _RSZ, so we need to spell out +- * the writes to each traffic class +- */ +- switch (tc) { +- case 0: +- ocelot_write_rix(ocelot, max_sdu, QSYS_QMAXSDU_CFG_0, +- port); +- break; +- case 1: +- ocelot_write_rix(ocelot, max_sdu, QSYS_QMAXSDU_CFG_1, +- port); +- break; +- case 2: +- ocelot_write_rix(ocelot, max_sdu, QSYS_QMAXSDU_CFG_2, +- port); +- break; +- case 3: +- ocelot_write_rix(ocelot, max_sdu, QSYS_QMAXSDU_CFG_3, +- port); +- break; +- case 4: +- ocelot_write_rix(ocelot, max_sdu, QSYS_QMAXSDU_CFG_4, +- port); +- break; +- case 5: +- ocelot_write_rix(ocelot, max_sdu, QSYS_QMAXSDU_CFG_5, +- port); +- break; +- case 6: +- ocelot_write_rix(ocelot, max_sdu, QSYS_QMAXSDU_CFG_6, +- port); +- break; +- case 7: +- ocelot_write_rix(ocelot, max_sdu, QSYS_QMAXSDU_CFG_7, +- port); +- break; +- } ++ vsc9959_port_qmaxsdu_set(ocelot, port, tc, max_sdu); + } + + ocelot_write_rix(ocelot, maxlen, QSYS_PORT_MAX_SDU, port); ++ ++ ocelot->ops->cut_through_fwd(ocelot); ++ ++ mutex_unlock(&ocelot->fwd_domain_lock); + } + + static void vsc9959_sched_speed_set(struct ocelot *ocelot, int port, +@@ -2709,7 +2737,7 @@ static void vsc9959_cut_through_fwd(struct ocelot *ocelot) + { + struct felix *felix = ocelot_to_felix(ocelot); + struct dsa_switch *ds = felix->ds; +- int port, other_port; ++ int tc, port, other_port; + + lockdep_assert_held(&ocelot->fwd_domain_lock); + +@@ -2753,19 +2781,27 @@ static void vsc9959_cut_through_fwd(struct ocelot *ocelot) + min_speed = other_ocelot_port->speed; + } + +- /* Enable cut-through forwarding for all traffic classes. */ +- if (ocelot_port->speed == min_speed) ++ /* Enable cut-through forwarding for all traffic classes that ++ * don't have oversized dropping enabled, since this check is ++ * bypassed in cut-through mode. ++ */ ++ if (ocelot_port->speed == min_speed) { + val = GENMASK(7, 0); + ++ for (tc = 0; tc < OCELOT_NUM_TC; tc++) ++ if (vsc9959_port_qmaxsdu_get(ocelot, port, tc)) ++ val &= ~BIT(tc); ++ } ++ + set: + tmp = ocelot_read_rix(ocelot, ANA_CUT_THRU_CFG, port); + if (tmp == val) + continue; + + dev_dbg(ocelot->dev, +- "port %d fwd mask 0x%lx speed %d min_speed %d, %s cut-through forwarding\n", ++ "port %d fwd mask 0x%lx speed %d min_speed %d, %s cut-through forwarding on TC mask 0x%x\n", + port, mask, ocelot_port->speed, min_speed, +- val ? "enabling" : "disabling"); ++ val ? "enabling" : "disabling", val); + + ocelot_write_rix(ocelot, val, ANA_CUT_THRU_CFG, port); + } +-- +2.35.1 + diff --git a/queue-5.19/net-ethernet-mtk_eth_soc-check-max-allowed-hash-in-m.patch b/queue-5.19/net-ethernet-mtk_eth_soc-check-max-allowed-hash-in-m.patch new file mode 100644 index 00000000000..15e97a5c145 --- /dev/null +++ b/queue-5.19/net-ethernet-mtk_eth_soc-check-max-allowed-hash-in-m.patch @@ -0,0 +1,39 @@ +From 98e593355502d11d6a8860ce3615fdee2592f1bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Sep 2022 14:41:28 +0200 +Subject: net: ethernet: mtk_eth_soc: check max allowed hash in + mtk_ppe_check_skb + +From: Lorenzo Bianconi + +[ Upstream commit f27b405ef43319a3ceefc2123245201a63ed4e00 ] + +Even if max hash configured in hw in mtk_ppe_hash_entry is +MTK_PPE_ENTRIES - 1, check theoretical OOB accesses in +mtk_ppe_check_skb routine + +Fixes: c4f033d9e03e9 ("net: ethernet: mtk_eth_soc: rework hardware flow table management") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_ppe.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/mediatek/mtk_ppe.h b/drivers/net/ethernet/mediatek/mtk_ppe.h +index 1f5cf1c9a9475..69ffce04d6306 100644 +--- a/drivers/net/ethernet/mediatek/mtk_ppe.h ++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h +@@ -293,6 +293,9 @@ mtk_ppe_check_skb(struct mtk_ppe *ppe, struct sk_buff *skb, u16 hash) + if (!ppe) + return; + ++ if (hash > MTK_PPE_HASH_MASK) ++ return; ++ + now = (u16)jiffies; + diff = now - ppe->foe_check_time[hash]; + if (diff < HZ / 10) +-- +2.35.1 + diff --git a/queue-5.19/net-ethernet-mtk_eth_soc-fix-typo-in-__mtk_foe_entry.patch b/queue-5.19/net-ethernet-mtk_eth_soc-fix-typo-in-__mtk_foe_entry.patch new file mode 100644 index 00000000000..ae2a9a8ba7f --- /dev/null +++ b/queue-5.19/net-ethernet-mtk_eth_soc-fix-typo-in-__mtk_foe_entry.patch @@ -0,0 +1,35 @@ +From 5a12eba0c62de2a95e3e773cc7a69f73f9df018c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Sep 2022 16:36:32 +0200 +Subject: net: ethernet: mtk_eth_soc: fix typo in __mtk_foe_entry_clear + +From: Lorenzo Bianconi + +[ Upstream commit 0e80707d94e4c88f9879bdafcbaceb13432ec1f4 ] + +Set ib1 state to MTK_FOE_STATE_UNBIND in __mtk_foe_entry_clear routine. + +Fixes: 33fc42de33278 ("net: ethernet: mtk_eth_soc: support creating mac address based offload entries") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_ppe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_ppe.c b/drivers/net/ethernet/mediatek/mtk_ppe.c +index dab8f3f771f84..cfe804bc8d205 100644 +--- a/drivers/net/ethernet/mediatek/mtk_ppe.c ++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c +@@ -412,7 +412,7 @@ __mtk_foe_entry_clear(struct mtk_ppe *ppe, struct mtk_flow_entry *entry) + if (entry->hash != 0xffff) { + ppe->foe_table[entry->hash].ib1 &= ~MTK_FOE_IB1_STATE; + ppe->foe_table[entry->hash].ib1 |= FIELD_PREP(MTK_FOE_IB1_STATE, +- MTK_FOE_STATE_BIND); ++ MTK_FOE_STATE_UNBIND); + dma_wmb(); + } + entry->hash = 0xffff; +-- +2.35.1 + diff --git a/queue-5.19/net-fec-use-a-spinlock-to-guard-fep-ptp_clk_on.patch b/queue-5.19/net-fec-use-a-spinlock-to-guard-fep-ptp_clk_on.patch new file mode 100644 index 00000000000..bd8db145132 --- /dev/null +++ b/queue-5.19/net-fec-use-a-spinlock-to-guard-fep-ptp_clk_on.patch @@ -0,0 +1,194 @@ +From 230da0d4c35127b68ae16945271ac4270ce5d096 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Sep 2022 16:04:03 +0200 +Subject: net: fec: Use a spinlock to guard `fep->ptp_clk_on` +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Csókás Bence + +[ Upstream commit b353b241f1eb9b6265358ffbe2632fdcb563354f ] + +Mutexes cannot be taken in a non-preemptible context, +causing a panic in `fec_ptp_save_state()`. Replacing +`ptp_clk_mutex` by `tmreg_lock` fixes this. + +Fixes: 6a4d7234ae9a ("net: fec: ptp: avoid register access when ipg clock is disabled") +Fixes: f79959220fa5 ("fec: Restart PPS after link state change") +Reported-by: Marc Kleine-Budde +Link: https://lore.kernel.org/all/20220827160922.642zlcd5foopozru@pengutronix.de/ +Signed-off-by: Csókás Bence +Tested-by: Francesco Dolcini # Toradex Apalis iMX6 +Link: https://lore.kernel.org/r/20220901140402.64804-1-csokas.bence@prolan.hu +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec.h | 1 - + drivers/net/ethernet/freescale/fec_main.c | 17 +++++++------- + drivers/net/ethernet/freescale/fec_ptp.c | 28 ++++++++--------------- + 3 files changed, 19 insertions(+), 27 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h +index ed7301b691694..939720a75f87c 100644 +--- a/drivers/net/ethernet/freescale/fec.h ++++ b/drivers/net/ethernet/freescale/fec.h +@@ -557,7 +557,6 @@ struct fec_enet_private { + struct clk *clk_2x_txclk; + + bool ptp_clk_on; +- struct mutex ptp_clk_mutex; + unsigned int num_tx_queues; + unsigned int num_rx_queues; + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index a90275143d873..8538ea31ca803 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -1994,6 +1994,7 @@ static void fec_enet_phy_reset_after_clk_enable(struct net_device *ndev) + static int fec_enet_clk_enable(struct net_device *ndev, bool enable) + { + struct fec_enet_private *fep = netdev_priv(ndev); ++ unsigned long flags; + int ret; + + if (enable) { +@@ -2002,15 +2003,15 @@ static int fec_enet_clk_enable(struct net_device *ndev, bool enable) + return ret; + + if (fep->clk_ptp) { +- mutex_lock(&fep->ptp_clk_mutex); ++ spin_lock_irqsave(&fep->tmreg_lock, flags); + ret = clk_prepare_enable(fep->clk_ptp); + if (ret) { +- mutex_unlock(&fep->ptp_clk_mutex); ++ spin_unlock_irqrestore(&fep->tmreg_lock, flags); + goto failed_clk_ptp; + } else { + fep->ptp_clk_on = true; + } +- mutex_unlock(&fep->ptp_clk_mutex); ++ spin_unlock_irqrestore(&fep->tmreg_lock, flags); + } + + ret = clk_prepare_enable(fep->clk_ref); +@@ -2025,10 +2026,10 @@ static int fec_enet_clk_enable(struct net_device *ndev, bool enable) + } else { + clk_disable_unprepare(fep->clk_enet_out); + if (fep->clk_ptp) { +- mutex_lock(&fep->ptp_clk_mutex); ++ spin_lock_irqsave(&fep->tmreg_lock, flags); + clk_disable_unprepare(fep->clk_ptp); + fep->ptp_clk_on = false; +- mutex_unlock(&fep->ptp_clk_mutex); ++ spin_unlock_irqrestore(&fep->tmreg_lock, flags); + } + clk_disable_unprepare(fep->clk_ref); + clk_disable_unprepare(fep->clk_2x_txclk); +@@ -2041,10 +2042,10 @@ static int fec_enet_clk_enable(struct net_device *ndev, bool enable) + clk_disable_unprepare(fep->clk_ref); + failed_clk_ref: + if (fep->clk_ptp) { +- mutex_lock(&fep->ptp_clk_mutex); ++ spin_lock_irqsave(&fep->tmreg_lock, flags); + clk_disable_unprepare(fep->clk_ptp); + fep->ptp_clk_on = false; +- mutex_unlock(&fep->ptp_clk_mutex); ++ spin_unlock_irqrestore(&fep->tmreg_lock, flags); + } + failed_clk_ptp: + clk_disable_unprepare(fep->clk_enet_out); +@@ -3873,7 +3874,7 @@ fec_probe(struct platform_device *pdev) + } + + fep->ptp_clk_on = false; +- mutex_init(&fep->ptp_clk_mutex); ++ spin_lock_init(&fep->tmreg_lock); + + /* clk_ref is optional, depends on board */ + fep->clk_ref = devm_clk_get_optional(&pdev->dev, "enet_clk_ref"); +diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c +index 3dc3c0b626c21..af20aa2379640 100644 +--- a/drivers/net/ethernet/freescale/fec_ptp.c ++++ b/drivers/net/ethernet/freescale/fec_ptp.c +@@ -365,21 +365,19 @@ static int fec_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta) + */ + static int fec_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts) + { +- struct fec_enet_private *adapter = ++ struct fec_enet_private *fep = + container_of(ptp, struct fec_enet_private, ptp_caps); + u64 ns; + unsigned long flags; + +- mutex_lock(&adapter->ptp_clk_mutex); ++ spin_lock_irqsave(&fep->tmreg_lock, flags); + /* Check the ptp clock */ +- if (!adapter->ptp_clk_on) { +- mutex_unlock(&adapter->ptp_clk_mutex); ++ if (!fep->ptp_clk_on) { ++ spin_unlock_irqrestore(&fep->tmreg_lock, flags); + return -EINVAL; + } +- spin_lock_irqsave(&adapter->tmreg_lock, flags); +- ns = timecounter_read(&adapter->tc); +- spin_unlock_irqrestore(&adapter->tmreg_lock, flags); +- mutex_unlock(&adapter->ptp_clk_mutex); ++ ns = timecounter_read(&fep->tc); ++ spin_unlock_irqrestore(&fep->tmreg_lock, flags); + + *ts = ns_to_timespec64(ns); + +@@ -404,10 +402,10 @@ static int fec_ptp_settime(struct ptp_clock_info *ptp, + unsigned long flags; + u32 counter; + +- mutex_lock(&fep->ptp_clk_mutex); ++ spin_lock_irqsave(&fep->tmreg_lock, flags); + /* Check the ptp clock */ + if (!fep->ptp_clk_on) { +- mutex_unlock(&fep->ptp_clk_mutex); ++ spin_unlock_irqrestore(&fep->tmreg_lock, flags); + return -EINVAL; + } + +@@ -417,11 +415,9 @@ static int fec_ptp_settime(struct ptp_clock_info *ptp, + */ + counter = ns & fep->cc.mask; + +- spin_lock_irqsave(&fep->tmreg_lock, flags); + writel(counter, fep->hwp + FEC_ATIME); + timecounter_init(&fep->tc, &fep->cc, ns); + spin_unlock_irqrestore(&fep->tmreg_lock, flags); +- mutex_unlock(&fep->ptp_clk_mutex); + return 0; + } + +@@ -518,13 +514,11 @@ static void fec_time_keep(struct work_struct *work) + struct fec_enet_private *fep = container_of(dwork, struct fec_enet_private, time_keep); + unsigned long flags; + +- mutex_lock(&fep->ptp_clk_mutex); ++ spin_lock_irqsave(&fep->tmreg_lock, flags); + if (fep->ptp_clk_on) { +- spin_lock_irqsave(&fep->tmreg_lock, flags); + timecounter_read(&fep->tc); +- spin_unlock_irqrestore(&fep->tmreg_lock, flags); + } +- mutex_unlock(&fep->ptp_clk_mutex); ++ spin_unlock_irqrestore(&fep->tmreg_lock, flags); + + schedule_delayed_work(&fep->time_keep, HZ); + } +@@ -599,8 +593,6 @@ void fec_ptp_init(struct platform_device *pdev, int irq_idx) + } + fep->ptp_inc = NSEC_PER_SEC / fep->cycle_speed; + +- spin_lock_init(&fep->tmreg_lock); +- + fec_ptp_start_cyclecounter(ndev); + + INIT_DELAYED_WORK(&fep->time_keep, fec_time_keep); +-- +2.35.1 + diff --git a/queue-5.19/net-introduce-__skb_fill_page_desc_noacc.patch b/queue-5.19/net-introduce-__skb_fill_page_desc_noacc.patch new file mode 100644 index 00000000000..e2414c6f58e --- /dev/null +++ b/queue-5.19/net-introduce-__skb_fill_page_desc_noacc.patch @@ -0,0 +1,70 @@ +From fbfe05591a7aa941b4ec5fc3bcb6d56898f5d1d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 21:52:32 +0100 +Subject: net: introduce __skb_fill_page_desc_noacc + +From: Pavel Begunkov + +[ Upstream commit 84ce071e38a6e25ea3ea91188e5482ac1f17b3af ] + +Managed pages contain pinned userspace pages and controlled by upper +layers, there is no need in tracking skb->pfmemalloc for them. Introduce +a helper for filling frags but ignoring page tracking, it'll be needed +later. + +Signed-off-by: Pavel Begunkov +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/linux/skbuff.h | 28 +++++++++++++++++----------- + 1 file changed, 17 insertions(+), 11 deletions(-) + +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index 2f41364a6791e..b0a1374043f30 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -2528,6 +2528,22 @@ static inline unsigned int skb_pagelen(const struct sk_buff *skb) + return skb_headlen(skb) + __skb_pagelen(skb); + } + ++static inline void __skb_fill_page_desc_noacc(struct skb_shared_info *shinfo, ++ int i, struct page *page, ++ int off, int size) ++{ ++ skb_frag_t *frag = &shinfo->frags[i]; ++ ++ /* ++ * Propagate page pfmemalloc to the skb if we can. The problem is ++ * that not all callers have unique ownership of the page but rely ++ * on page_is_pfmemalloc doing the right thing(tm). ++ */ ++ frag->bv_page = page; ++ frag->bv_offset = off; ++ skb_frag_size_set(frag, size); ++} ++ + /** + * __skb_fill_page_desc - initialise a paged fragment in an skb + * @skb: buffer containing fragment to be initialised +@@ -2544,17 +2560,7 @@ static inline unsigned int skb_pagelen(const struct sk_buff *skb) + static inline void __skb_fill_page_desc(struct sk_buff *skb, int i, + struct page *page, int off, int size) + { +- skb_frag_t *frag = &skb_shinfo(skb)->frags[i]; +- +- /* +- * Propagate page pfmemalloc to the skb if we can. The problem is +- * that not all callers have unique ownership of the page but rely +- * on page_is_pfmemalloc doing the right thing(tm). +- */ +- frag->bv_page = page; +- frag->bv_offset = off; +- skb_frag_size_set(frag, size); +- ++ __skb_fill_page_desc_noacc(skb_shinfo(skb), i, page, off, size); + page = compound_head(page); + if (page_is_pfmemalloc(page)) + skb->pfmemalloc = true; +-- +2.35.1 + diff --git a/queue-5.19/net-phy-lan87xx-change-interrupt-src-of-link_up-to-c.patch b/queue-5.19/net-phy-lan87xx-change-interrupt-src-of-link_up-to-c.patch new file mode 100644 index 00000000000..b2f8b0dfd24 --- /dev/null +++ b/queue-5.19/net-phy-lan87xx-change-interrupt-src-of-link_up-to-c.patch @@ -0,0 +1,138 @@ +From bd0cff5e7c4ab460ec621ee511df9c5f29947e49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Sep 2022 20:57:50 +0530 +Subject: net: phy: lan87xx: change interrupt src of link_up to comm_ready + +From: Arun Ramadoss + +[ Upstream commit 5382033a35227c57a349d74752ad2527780159a9 ] + +Currently phy link up/down interrupt is enabled using the +LAN87xx_INTERRUPT_MASK register. In the lan87xx_read_status function, +phy link is determined using the T1_MODE_STAT_REG register comm_ready bit. +comm_ready bit is set using the loc_rcvr_status & rem_rcvr_status. +Whenever the phy link is up, LAN87xx_INTERRUPT_SOURCE link_up bit is set +first but comm_ready bit takes some time to set based on local and +remote receiver status. +As per the current implementation, interrupt is triggered using link_up +but the comm_ready bit is still cleared in the read_status function. So, +link is always down. Initially tested with the shared interrupt +mechanism with switch and internal phy which is working, but after +implementing interrupt controller it is not working. +It can fixed either by updating the read_status function to read from +LAN87XX_INTERRUPT_SOURCE register or enable the interrupt mask for +comm_ready bit. But the validation team recommends the use of comm_ready +for link detection. +This patch fixes by enabling the comm_ready bit for link_up in the +LAN87XX_INTERRUPT_MASK_2 register (MISC Bank) and link_down in +LAN87xx_INTERRUPT_MASK register. + +Fixes: 8a1b415d70b7 ("net: phy: added ethtool master-slave configuration support") +Signed-off-by: Arun Ramadoss +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20220905152750.5079-1-arun.ramadoss@microchip.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/phy/microchip_t1.c | 58 +++++++++++++++++++++++++++++++--- + 1 file changed, 54 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/phy/microchip_t1.c b/drivers/net/phy/microchip_t1.c +index d4c93d59bc539..8569a545e0a3f 100644 +--- a/drivers/net/phy/microchip_t1.c ++++ b/drivers/net/phy/microchip_t1.c +@@ -28,12 +28,16 @@ + + /* Interrupt Source Register */ + #define LAN87XX_INTERRUPT_SOURCE (0x18) ++#define LAN87XX_INTERRUPT_SOURCE_2 (0x08) + + /* Interrupt Mask Register */ + #define LAN87XX_INTERRUPT_MASK (0x19) + #define LAN87XX_MASK_LINK_UP (0x0004) + #define LAN87XX_MASK_LINK_DOWN (0x0002) + ++#define LAN87XX_INTERRUPT_MASK_2 (0x09) ++#define LAN87XX_MASK_COMM_RDY BIT(10) ++ + /* MISC Control 1 Register */ + #define LAN87XX_CTRL_1 (0x11) + #define LAN87XX_MASK_RGMII_TXC_DLY_EN (0x4000) +@@ -424,17 +428,55 @@ static int lan87xx_phy_config_intr(struct phy_device *phydev) + int rc, val = 0; + + if (phydev->interrupts == PHY_INTERRUPT_ENABLED) { +- /* unmask all source and clear them before enable */ +- rc = phy_write(phydev, LAN87XX_INTERRUPT_MASK, 0x7FFF); ++ /* clear all interrupt */ ++ rc = phy_write(phydev, LAN87XX_INTERRUPT_MASK, val); ++ if (rc < 0) ++ return rc; ++ + rc = phy_read(phydev, LAN87XX_INTERRUPT_SOURCE); +- val = LAN87XX_MASK_LINK_UP | LAN87XX_MASK_LINK_DOWN; ++ if (rc < 0) ++ return rc; ++ ++ rc = access_ereg(phydev, PHYACC_ATTR_MODE_WRITE, ++ PHYACC_ATTR_BANK_MISC, ++ LAN87XX_INTERRUPT_MASK_2, val); ++ if (rc < 0) ++ return rc; ++ ++ rc = access_ereg(phydev, PHYACC_ATTR_MODE_READ, ++ PHYACC_ATTR_BANK_MISC, ++ LAN87XX_INTERRUPT_SOURCE_2, 0); ++ if (rc < 0) ++ return rc; ++ ++ /* enable link down and comm ready interrupt */ ++ val = LAN87XX_MASK_LINK_DOWN; + rc = phy_write(phydev, LAN87XX_INTERRUPT_MASK, val); ++ if (rc < 0) ++ return rc; ++ ++ val = LAN87XX_MASK_COMM_RDY; ++ rc = access_ereg(phydev, PHYACC_ATTR_MODE_WRITE, ++ PHYACC_ATTR_BANK_MISC, ++ LAN87XX_INTERRUPT_MASK_2, val); + } else { + rc = phy_write(phydev, LAN87XX_INTERRUPT_MASK, val); +- if (rc) ++ if (rc < 0) + return rc; + + rc = phy_read(phydev, LAN87XX_INTERRUPT_SOURCE); ++ if (rc < 0) ++ return rc; ++ ++ rc = access_ereg(phydev, PHYACC_ATTR_MODE_WRITE, ++ PHYACC_ATTR_BANK_MISC, ++ LAN87XX_INTERRUPT_MASK_2, val); ++ if (rc < 0) ++ return rc; ++ ++ rc = access_ereg(phydev, PHYACC_ATTR_MODE_READ, ++ PHYACC_ATTR_BANK_MISC, ++ LAN87XX_INTERRUPT_SOURCE_2, 0); + } + + return rc < 0 ? rc : 0; +@@ -444,6 +486,14 @@ static irqreturn_t lan87xx_handle_interrupt(struct phy_device *phydev) + { + int irq_status; + ++ irq_status = access_ereg(phydev, PHYACC_ATTR_MODE_READ, ++ PHYACC_ATTR_BANK_MISC, ++ LAN87XX_INTERRUPT_SOURCE_2, 0); ++ if (irq_status < 0) { ++ phy_error(phydev); ++ return IRQ_NONE; ++ } ++ + irq_status = phy_read(phydev, LAN87XX_INTERRUPT_SOURCE); + if (irq_status < 0) { + phy_error(phydev); +-- +2.35.1 + diff --git a/queue-5.19/net-smc-fix-possible-access-to-freed-memory-in-link-.patch b/queue-5.19/net-smc-fix-possible-access-to-freed-memory-in-link-.patch new file mode 100644 index 00000000000..e2cdfa5dfda --- /dev/null +++ b/queue-5.19/net-smc-fix-possible-access-to-freed-memory-in-link-.patch @@ -0,0 +1,145 @@ +From 64784ce25a3d43a6830219a70db534a1e5080299 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Sep 2022 21:01:39 +0800 +Subject: net/smc: Fix possible access to freed memory in link clear + +From: Yacan Liu + +[ Upstream commit e9b1a4f867ae9c1dbd1d71cd09cbdb3239fb4968 ] + +After modifying the QP to the Error state, all RX WR would be completed +with WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not +wait for it is done, but destroy the QP and free the link group directly. +So there is a risk that accessing the freed memory in tasklet context. + +Here is a crash example: + + BUG: unable to handle page fault for address: ffffffff8f220860 + #PF: supervisor write access in kernel mode + #PF: error_code(0x0002) - not-present page + PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060 + Oops: 0002 [#1] SMP PTI + CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G S OE 5.10.0-0607+ #23 + Hardware name: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07/09/2018 + RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0 + Code: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 05 00 c8 02 00 48 03 04 f5 00 09 98 8e <48> 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32 + RSP: 0018:ffffb3b6c001ebd8 EFLAGS: 00010086 + RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000 + RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00 + RBP: ffff91db62bacc00 R08: 0000000000000000 R09: c00000010000028b + R10: 0000000000055198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010 + R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040 + FS: 0000000000000000(0000) GS:ffff91db1f840000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + + _raw_spin_lock_irqsave+0x30/0x40 + mlx5_ib_poll_cq+0x4c/0xc50 [mlx5_ib] + smc_wr_rx_tasklet_fn+0x56/0xa0 [smc] + tasklet_action_common.isra.21+0x66/0x100 + __do_softirq+0xd5/0x29c + asm_call_irq_on_stack+0x12/0x20 + + do_softirq_own_stack+0x37/0x40 + irq_exit_rcu+0x9d/0xa0 + sysvec_call_function_single+0x34/0x80 + asm_sysvec_call_function_single+0x12/0x20 + +Fixes: bd4ad57718cc ("smc: initialize IB transport incl. PD, MR, QP, CQ, event, WR") +Signed-off-by: Yacan Liu +Reviewed-by: Tony Lu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/smc_core.c | 1 + + net/smc/smc_core.h | 2 ++ + net/smc/smc_wr.c | 5 +++++ + net/smc/smc_wr.h | 5 +++++ + 4 files changed, 13 insertions(+) + +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index f40f6ed0fbdb4..1f3bb1f6b1f7b 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -755,6 +755,7 @@ int smcr_link_init(struct smc_link_group *lgr, struct smc_link *lnk, + lnk->lgr = lgr; + smc_lgr_hold(lgr); /* lgr_put in smcr_link_clear() */ + lnk->link_idx = link_idx; ++ lnk->wr_rx_id_compl = 0; + smc_ibdev_cnt_inc(lnk); + smcr_copy_dev_info_to_link(lnk); + atomic_set(&lnk->conn_cnt, 0); +diff --git a/net/smc/smc_core.h b/net/smc/smc_core.h +index 4cb03e9423648..7b43a78c7f73a 100644 +--- a/net/smc/smc_core.h ++++ b/net/smc/smc_core.h +@@ -115,8 +115,10 @@ struct smc_link { + dma_addr_t wr_rx_dma_addr; /* DMA address of wr_rx_bufs */ + dma_addr_t wr_rx_v2_dma_addr; /* DMA address of v2 rx buf*/ + u64 wr_rx_id; /* seq # of last recv WR */ ++ u64 wr_rx_id_compl; /* seq # of last completed WR */ + u32 wr_rx_cnt; /* number of WR recv buffers */ + unsigned long wr_rx_tstamp; /* jiffies when last buf rx */ ++ wait_queue_head_t wr_rx_empty_wait; /* wait for RQ empty */ + + struct ib_reg_wr wr_reg; /* WR register memory region */ + wait_queue_head_t wr_reg_wait; /* wait for wr_reg result */ +diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c +index 26f8f240d9e84..b0678a417e09d 100644 +--- a/net/smc/smc_wr.c ++++ b/net/smc/smc_wr.c +@@ -454,6 +454,7 @@ static inline void smc_wr_rx_process_cqes(struct ib_wc wc[], int num) + + for (i = 0; i < num; i++) { + link = wc[i].qp->qp_context; ++ link->wr_rx_id_compl = wc[i].wr_id; + if (wc[i].status == IB_WC_SUCCESS) { + link->wr_rx_tstamp = jiffies; + smc_wr_rx_demultiplex(&wc[i]); +@@ -465,6 +466,8 @@ static inline void smc_wr_rx_process_cqes(struct ib_wc wc[], int num) + case IB_WC_RNR_RETRY_EXC_ERR: + case IB_WC_WR_FLUSH_ERR: + smcr_link_down_cond_sched(link); ++ if (link->wr_rx_id_compl == link->wr_rx_id) ++ wake_up(&link->wr_rx_empty_wait); + break; + default: + smc_wr_rx_post(link); /* refill WR RX */ +@@ -639,6 +642,7 @@ void smc_wr_free_link(struct smc_link *lnk) + return; + ibdev = lnk->smcibdev->ibdev; + ++ smc_wr_drain_cq(lnk); + smc_wr_wakeup_reg_wait(lnk); + smc_wr_wakeup_tx_wait(lnk); + +@@ -889,6 +893,7 @@ int smc_wr_create_link(struct smc_link *lnk) + atomic_set(&lnk->wr_tx_refcnt, 0); + init_waitqueue_head(&lnk->wr_reg_wait); + atomic_set(&lnk->wr_reg_refcnt, 0); ++ init_waitqueue_head(&lnk->wr_rx_empty_wait); + return rc; + + dma_unmap: +diff --git a/net/smc/smc_wr.h b/net/smc/smc_wr.h +index a54e90a1110fd..45e9b894d3f8a 100644 +--- a/net/smc/smc_wr.h ++++ b/net/smc/smc_wr.h +@@ -73,6 +73,11 @@ static inline void smc_wr_tx_link_put(struct smc_link *link) + wake_up_all(&link->wr_tx_wait); + } + ++static inline void smc_wr_drain_cq(struct smc_link *lnk) ++{ ++ wait_event(lnk->wr_rx_empty_wait, lnk->wr_rx_id_compl == lnk->wr_rx_id); ++} ++ + static inline void smc_wr_wakeup_tx_wait(struct smc_link *lnk) + { + wake_up_all(&lnk->wr_tx_wait); +-- +2.35.1 + diff --git a/queue-5.19/netfilter-br_netfilter-drop-dst-references-before-se.patch b/queue-5.19/netfilter-br_netfilter-drop-dst-references-before-se.patch new file mode 100644 index 00000000000..16a8f238e64 --- /dev/null +++ b/queue-5.19/netfilter-br_netfilter-drop-dst-references-before-se.patch @@ -0,0 +1,96 @@ +From fdebc4fbf190048a1910c28b121e1d2fb37e95ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Aug 2022 22:36:03 -0700 +Subject: netfilter: br_netfilter: Drop dst references before setting. + +From: Harsh Modi + +[ Upstream commit d047283a7034140ea5da759a494fd2274affdd46 ] + +The IPv6 path already drops dst in the daddr changed case, but the IPv4 +path does not. This change makes the two code paths consistent. + +Further, it is possible that there is already a metadata_dst allocated from +ingress that might already be attached to skbuff->dst while following +the bridge path. If it is not released before setting a new +metadata_dst, it will be leaked. This is similar to what is done in +bpf_set_tunnel_key() or ip6_route_input(). + +It is important to note that the memory being leaked is not the dst +being set in the bridge code, but rather memory allocated from some +other code path that is not being freed correctly before the skb dst is +overwritten. + +An example of the leakage fixed by this commit found using kmemleak: + +unreferenced object 0xffff888010112b00 (size 256): + comm "softirq", pid 0, jiffies 4294762496 (age 32.012s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 80 16 f1 83 ff ff ff ff ................ + e1 4e f6 82 ff ff ff ff 00 00 00 00 00 00 00 00 .N.............. + backtrace: + [<00000000d79567ea>] metadata_dst_alloc+0x1b/0xe0 + [<00000000be113e13>] udp_tun_rx_dst+0x174/0x1f0 + [<00000000a36848f4>] geneve_udp_encap_recv+0x350/0x7b0 + [<00000000d4afb476>] udp_queue_rcv_one_skb+0x380/0x560 + [<00000000ac064aea>] udp_unicast_rcv_skb+0x75/0x90 + [<000000009a8ee8c5>] ip_protocol_deliver_rcu+0xd8/0x230 + [<00000000ef4980bb>] ip_local_deliver_finish+0x7a/0xa0 + [<00000000d7533c8c>] __netif_receive_skb_one_core+0x89/0xa0 + [<00000000a879497d>] process_backlog+0x93/0x190 + [<00000000e41ade9f>] __napi_poll+0x28/0x170 + [<00000000b4c0906b>] net_rx_action+0x14f/0x2a0 + [<00000000b20dd5d4>] __do_softirq+0xf4/0x305 + [<000000003a7d7e15>] __irq_exit_rcu+0xc3/0x140 + [<00000000968d39a2>] sysvec_apic_timer_interrupt+0x9e/0xc0 + [<000000009e920794>] asm_sysvec_apic_timer_interrupt+0x16/0x20 + [<000000008942add0>] native_safe_halt+0x13/0x20 + +Florian Westphal says: "Original code was likely fine because nothing +ever did set a skb->dst entry earlier than bridge in those days." + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Harsh Modi +Acked-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/bridge/br_netfilter_hooks.c | 2 ++ + net/bridge/br_netfilter_ipv6.c | 1 + + 2 files changed, 3 insertions(+) + +diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c +index ff47790366497..f20f4373ff408 100644 +--- a/net/bridge/br_netfilter_hooks.c ++++ b/net/bridge/br_netfilter_hooks.c +@@ -384,6 +384,7 @@ static int br_nf_pre_routing_finish(struct net *net, struct sock *sk, struct sk_ + /* - Bridged-and-DNAT'ed traffic doesn't + * require ip_forwarding. */ + if (rt->dst.dev == dev) { ++ skb_dst_drop(skb); + skb_dst_set(skb, &rt->dst); + goto bridged_dnat; + } +@@ -413,6 +414,7 @@ static int br_nf_pre_routing_finish(struct net *net, struct sock *sk, struct sk_ + kfree_skb(skb); + return 0; + } ++ skb_dst_drop(skb); + skb_dst_set_noref(skb, &rt->dst); + } + +diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c +index e4e0c836c3f51..6b07f30675bb0 100644 +--- a/net/bridge/br_netfilter_ipv6.c ++++ b/net/bridge/br_netfilter_ipv6.c +@@ -197,6 +197,7 @@ static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struc + kfree_skb(skb); + return 0; + } ++ skb_dst_drop(skb); + skb_dst_set_noref(skb, &rt->dst); + } + +-- +2.35.1 + diff --git a/queue-5.19/netfilter-nf_conntrack_irc-fix-forged-ip-logic.patch b/queue-5.19/netfilter-nf_conntrack_irc-fix-forged-ip-logic.patch new file mode 100644 index 00000000000..31131a8269c --- /dev/null +++ b/queue-5.19/netfilter-nf_conntrack_irc-fix-forged-ip-logic.patch @@ -0,0 +1,43 @@ +From cd420eb298c0c55748928971fd8472244fc0d7ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 14:56:58 +1000 +Subject: netfilter: nf_conntrack_irc: Fix forged IP logic + +From: David Leadbeater + +[ Upstream commit 0efe125cfb99e6773a7434f3463f7c2fa28f3a43 ] + +Ensure the match happens in the right direction, previously the +destination used was the server, not the NAT host, as the comment +shows the code intended. + +Additionally nf_nat_irc uses port 0 as a signal and there's no valid way +it can appear in a DCC message, so consider port 0 also forged. + +Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port") +Signed-off-by: David Leadbeater +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_irc.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c +index 1796c456ac98b..992decbcaa5c1 100644 +--- a/net/netfilter/nf_conntrack_irc.c ++++ b/net/netfilter/nf_conntrack_irc.c +@@ -194,8 +194,9 @@ static int help(struct sk_buff *skb, unsigned int protoff, + + /* dcc_ip can be the internal OR external (NAT'ed) IP */ + tuple = &ct->tuplehash[dir].tuple; +- if (tuple->src.u3.ip != dcc_ip && +- tuple->dst.u3.ip != dcc_ip) { ++ if ((tuple->src.u3.ip != dcc_ip && ++ ct->tuplehash[!dir].tuple.dst.u3.ip != dcc_ip) || ++ dcc_port == 0) { + net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n", + &tuple->src.u3.ip, + &dcc_ip, dcc_port); +-- +2.35.1 + diff --git a/queue-5.19/netfilter-nf_tables-clean-up-hook-list-when-offload-.patch b/queue-5.19/netfilter-nf_tables-clean-up-hook-list-when-offload-.patch new file mode 100644 index 00000000000..17dad7cfb8b --- /dev/null +++ b/queue-5.19/netfilter-nf_tables-clean-up-hook-list-when-offload-.patch @@ -0,0 +1,68 @@ +From 9e850d16df61a17b56d6a211e8a520a1cd1c31f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Aug 2022 13:11:47 +0200 +Subject: netfilter: nf_tables: clean up hook list when offload flags check + fails + +From: Pablo Neira Ayuso + +[ Upstream commit 77972a36ecc4db7fc7c68f0e80714263c5f03f65 ] + +splice back the hook list so nft_chain_release_hook() has a chance to +release the hooks. + +BUG: memory leak +unreferenced object 0xffff88810180b100 (size 96): + comm "syz-executor133", pid 3619, jiffies 4294945714 (age 12.690s) + hex dump (first 32 bytes): + 28 64 23 02 81 88 ff ff 28 64 23 02 81 88 ff ff (d#.....(d#..... + 90 a8 aa 83 ff ff ff ff 00 00 b5 0f 81 88 ff ff ................ + backtrace: + [] kmalloc include/linux/slab.h:600 [inline] + [] nft_netdev_hook_alloc+0x3b/0xc0 net/netfilter/nf_tables_api.c:1901 + [] nft_chain_parse_netdev net/netfilter/nf_tables_api.c:1998 [inline] + [] nft_chain_parse_hook+0x33a/0x530 net/netfilter/nf_tables_api.c:2073 + [] nf_tables_addchain.constprop.0+0x10b/0x950 net/netfilter/nf_tables_api.c:2218 + [] nf_tables_newchain+0xa8b/0xc60 net/netfilter/nf_tables_api.c:2593 + [] nfnetlink_rcv_batch+0xa46/0xd20 net/netfilter/nfnetlink.c:517 + [] nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:638 [inline] + [] nfnetlink_rcv+0x1f9/0x220 net/netfilter/nfnetlink.c:656 + [] netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] + [] netlink_unicast+0x397/0x4c0 net/netlink/af_netlink.c:1345 + [] netlink_sendmsg+0x396/0x710 net/netlink/af_netlink.c:1921 + [] sock_sendmsg_nosec net/socket.c:714 [inline] + [] sock_sendmsg+0x56/0x80 net/socket.c:734 + [] ____sys_sendmsg+0x36c/0x390 net/socket.c:2482 + [] ___sys_sendmsg+0xa8/0x110 net/socket.c:2536 + [] __sys_sendmsg+0x88/0x100 net/socket.c:2565 + [] do_syscall_x64 arch/x86/entry/common.c:50 [inline] + [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 + [] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: d54725cd11a5 ("netfilter: nf_tables: support for multiple devices per netdev hook") +Reported-by: syzbot+5fcdbfab6d6744c57418@syzkaller.appspotmail.com +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index bc690238a3c56..848cc81d69926 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -2166,8 +2166,10 @@ static int nft_basechain_init(struct nft_base_chain *basechain, u8 family, + chain->flags |= NFT_CHAIN_BASE | flags; + basechain->policy = NF_ACCEPT; + if (chain->flags & NFT_CHAIN_HW_OFFLOAD && +- !nft_chain_offload_support(basechain)) ++ !nft_chain_offload_support(basechain)) { ++ list_splice_init(&basechain->hook_list, &hook->list); + return -EOPNOTSUPP; ++ } + + flow_block_init(&basechain->flow_block); + +-- +2.35.1 + diff --git a/queue-5.19/nvme-tcp-fix-regression-that-causes-sporadic-request.patch b/queue-5.19/nvme-tcp-fix-regression-that-causes-sporadic-request.patch new file mode 100644 index 00000000000..ec7eea67e2f --- /dev/null +++ b/queue-5.19/nvme-tcp-fix-regression-that-causes-sporadic-request.patch @@ -0,0 +1,79 @@ +From 2c423fdd83043058dbe692831eb7af69e607b4b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Sep 2022 18:07:06 +0300 +Subject: nvme-tcp: fix regression that causes sporadic requests to time out + +From: Sagi Grimberg + +[ Upstream commit 3770a42bb8ceb856877699257a43c0585a5d2996 ] + +When we queue requests, we strive to batch as much as possible and also +signal the network stack that more data is about to be sent over a socket +with MSG_SENDPAGE_NOTLAST. This flag looks at the pending requests queued +as well as queue->more_requests that is derived from the block layer +last-in-batch indication. + +We set more_request=true when we flush the request directly from +.queue_rq submission context (in nvme_tcp_send_all), however this is +wrongly assuming that no other requests may be queued during the +execution of nvme_tcp_send_all. + +Due to this, a race condition may happen where: + + 1. request X is queued as !last-in-batch + 2. request X submission context calls nvme_tcp_send_all directly + 3. nvme_tcp_send_all is preempted and schedules to a different cpu + 4. request Y is queued as last-in-batch + 5. nvme_tcp_send_all context sends request X+Y, however signals for + both MSG_SENDPAGE_NOTLAST because queue->more_requests=true. + +==> none of the requests is pushed down to the wire as the network +stack is waiting for more data, both requests timeout. + +To fix this, we eliminate queue->more_requests and only rely on +the queue req_list and send_list to be not-empty. + +Fixes: 122e5b9f3d37 ("nvme-tcp: optimize network stack with setting msg flags according to batch size") +Reported-by: Jonathan Nicklin +Signed-off-by: Sagi Grimberg +Tested-by: Jonathan Nicklin +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/tcp.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 40bd68ba1040a..daa0e160e1212 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -121,7 +121,6 @@ struct nvme_tcp_queue { + struct mutex send_mutex; + struct llist_head req_list; + struct list_head send_list; +- bool more_requests; + + /* recv state */ + void *pdu; +@@ -318,7 +317,7 @@ static inline void nvme_tcp_send_all(struct nvme_tcp_queue *queue) + static inline bool nvme_tcp_queue_more(struct nvme_tcp_queue *queue) + { + return !list_empty(&queue->send_list) || +- !llist_empty(&queue->req_list) || queue->more_requests; ++ !llist_empty(&queue->req_list); + } + + static inline void nvme_tcp_queue_request(struct nvme_tcp_request *req, +@@ -337,9 +336,7 @@ static inline void nvme_tcp_queue_request(struct nvme_tcp_request *req, + */ + if (queue->io_cpu == raw_smp_processor_id() && + sync && empty && mutex_trylock(&queue->send_mutex)) { +- queue->more_requests = !last; + nvme_tcp_send_all(queue); +- queue->more_requests = false; + mutex_unlock(&queue->send_mutex); + } + +-- +2.35.1 + diff --git a/queue-5.19/nvme-tcp-fix-uaf-when-detecting-digest-errors.patch b/queue-5.19/nvme-tcp-fix-uaf-when-detecting-digest-errors.patch new file mode 100644 index 00000000000..419cb857513 --- /dev/null +++ b/queue-5.19/nvme-tcp-fix-uaf-when-detecting-digest-errors.patch @@ -0,0 +1,39 @@ +From bb2a0180bfebeb438e5a8689ddd5867bed3c32aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Sep 2022 13:54:17 +0300 +Subject: nvme-tcp: fix UAF when detecting digest errors + +From: Sagi Grimberg + +[ Upstream commit 160f3549a907a50e51a8518678ba2dcf2541abea ] + +We should also bail from the io_work loop when we set rd_enabled to true, +so we don't attempt to read data from the socket when the TCP stream is +already out-of-sync or corrupted. + +Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver") +Reported-by: Daniel Wagner +Signed-off-by: Sagi Grimberg +Reviewed-by: Daniel Wagner +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/tcp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 7a9e6ffa23429..40bd68ba1040a 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -1227,7 +1227,7 @@ static void nvme_tcp_io_work(struct work_struct *w) + else if (unlikely(result < 0)) + return; + +- if (!pending) ++ if (!pending || !queue->rd_enabled) + return; + + } while (!time_after(jiffies, deadline)); /* quota is exhausted */ +-- +2.35.1 + diff --git a/queue-5.19/nvmet-fix-mar-and-mor-off-by-one-errors.patch b/queue-5.19/nvmet-fix-mar-and-mor-off-by-one-errors.patch new file mode 100644 index 00000000000..bab31ca1a60 --- /dev/null +++ b/queue-5.19/nvmet-fix-mar-and-mor-off-by-one-errors.patch @@ -0,0 +1,65 @@ +From a82fa6a5c3fb9b57cbef9a10a7c8a5674b618739 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Sep 2022 09:39:28 +0200 +Subject: nvmet: fix mar and mor off-by-one errors + +From: Dennis Maisenbacher + +[ Upstream commit b7e97872a65e1d57b4451769610554c131f37a0a ] + +Maximum Active Resources (MAR) and Maximum Open Resources (MOR) are 0's +based vales where a value of 0xffffffff indicates that there is no limit. + +Decrement the values that are returned by bdev_max_open_zones and +bdev_max_active_zones as the block layer helpers are not 0's based. +A 0 returned by the block layer helpers indicates no limit, thus convert +it to 0xffffffff (U32_MAX). + +Fixes: aaf2e048af27 ("nvmet: add ZBD over ZNS backend support") +Suggested-by: Niklas Cassel +Signed-off-by: Dennis Maisenbacher +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/zns.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/target/zns.c b/drivers/nvme/target/zns.c +index 82b61acf7a72b..1956be87ac5ff 100644 +--- a/drivers/nvme/target/zns.c ++++ b/drivers/nvme/target/zns.c +@@ -100,6 +100,7 @@ void nvmet_execute_identify_cns_cs_ns(struct nvmet_req *req) + struct nvme_id_ns_zns *id_zns; + u64 zsze; + u16 status; ++ u32 mar, mor; + + if (le32_to_cpu(req->cmd->identify.nsid) == NVME_NSID_ALL) { + req->error_loc = offsetof(struct nvme_identify, nsid); +@@ -130,8 +131,20 @@ void nvmet_execute_identify_cns_cs_ns(struct nvmet_req *req) + zsze = (bdev_zone_sectors(req->ns->bdev) << 9) >> + req->ns->blksize_shift; + id_zns->lbafe[0].zsze = cpu_to_le64(zsze); +- id_zns->mor = cpu_to_le32(bdev_max_open_zones(req->ns->bdev)); +- id_zns->mar = cpu_to_le32(bdev_max_active_zones(req->ns->bdev)); ++ ++ mor = bdev_max_open_zones(req->ns->bdev); ++ if (!mor) ++ mor = U32_MAX; ++ else ++ mor--; ++ id_zns->mor = cpu_to_le32(mor); ++ ++ mar = bdev_max_active_zones(req->ns->bdev); ++ if (!mar) ++ mar = U32_MAX; ++ else ++ mar--; ++ id_zns->mar = cpu_to_le32(mar); + + done: + status = nvmet_copy_to_sgl(req, 0, id_zns, sizeof(*id_zns)); +-- +2.35.1 + diff --git a/queue-5.19/perf-dlfilter-dlfilter-show-cycles-fix-types-for-pri.patch b/queue-5.19/perf-dlfilter-dlfilter-show-cycles-fix-types-for-pri.patch new file mode 100644 index 00000000000..b16c4ba9842 --- /dev/null +++ b/queue-5.19/perf-dlfilter-dlfilter-show-cycles-fix-types-for-pri.patch @@ -0,0 +1,45 @@ +From de086ad0ca7292f686d317e76195b8057d742a48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Sep 2022 10:47:35 +0300 +Subject: perf dlfilter dlfilter-show-cycles: Fix types for print format + +From: Adrian Hunter + +[ Upstream commit 1706623e940347ad23fdf77910eca4905dc37f91 ] + +Avoid compiler warning about format %llu that expects long long unsigned +int but argument has type __u64. + +Reported-by: Arnaldo Carvalho de Melo +Fixes: c3afd6e50fce824f ("perf dlfilter: Add dlfilter-show-cycles") +Signed-off-by: Adrian Hunter +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: https://lore.kernel.org/r/20220905074735.4513-1-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/dlfilters/dlfilter-show-cycles.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/dlfilters/dlfilter-show-cycles.c b/tools/perf/dlfilters/dlfilter-show-cycles.c +index 9eccc97bff82f..6d47298ebe9f6 100644 +--- a/tools/perf/dlfilters/dlfilter-show-cycles.c ++++ b/tools/perf/dlfilters/dlfilter-show-cycles.c +@@ -98,9 +98,9 @@ int filter_event_early(void *data, const struct perf_dlfilter_sample *sample, vo + static void print_vals(__u64 cycles, __u64 delta) + { + if (delta) +- printf("%10llu %10llu ", cycles, delta); ++ printf("%10llu %10llu ", (unsigned long long)cycles, (unsigned long long)delta); + else +- printf("%10llu %10s ", cycles, ""); ++ printf("%10llu %10s ", (unsigned long long)cycles, ""); + } + + int filter_event(void *data, const struct perf_dlfilter_sample *sample, void *ctx) +-- +2.35.1 + diff --git a/queue-5.19/perf-record-fix-synthesis-failure-warnings.patch b/queue-5.19/perf-record-fix-synthesis-failure-warnings.patch new file mode 100644 index 00000000000..ed1f8d082ca --- /dev/null +++ b/queue-5.19/perf-record-fix-synthesis-failure-warnings.patch @@ -0,0 +1,79 @@ +From 111266fac7d6a790d0fa3f5a2222ed77d1bebeea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Sep 2022 19:24:58 +0300 +Subject: perf record: Fix synthesis failure warnings + +From: Adrian Hunter + +[ Upstream commit faf59ec8c3c3708c64ff76b50e6f757c6b4a1054 ] + +Some calls to synthesis functions set err < 0 but only warn about the +failure and continue. However they do not set err back to zero, relying +on subsequent code to do that. + +That changed with the introduction of option --synth. When --synth=no +subsequent functions that set err back to zero are not called. + +Fix by setting err = 0 in those cases. + +Example: + + Before: + + $ perf record --no-bpf-event --synth=all -o /tmp/huh uname + Couldn't synthesize bpf events. + Linux + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.014 MB /tmp/huh (7 samples) ] + $ perf record --no-bpf-event --synth=no -o /tmp/huh uname + Couldn't synthesize bpf events. + + After: + + $ perf record --no-bpf-event --synth=no -o /tmp/huh uname + Couldn't synthesize bpf events. + Linux + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.014 MB /tmp/huh (7 samples) ] + +Fixes: 41b740b6e8a994e5 ("perf record: Add --synth option") +Signed-off-by: Adrian Hunter +Acked-by: Namhyung Kim +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: https://lore.kernel.org/r/20220907162458.72817-1-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-record.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c +index 9a71f0330137e..68c878b4e5e4c 100644 +--- a/tools/perf/builtin-record.c ++++ b/tools/perf/builtin-record.c +@@ -1892,14 +1892,18 @@ static int record__synthesize(struct record *rec, bool tail) + + err = perf_event__synthesize_bpf_events(session, process_synthesized_event, + machine, opts); +- if (err < 0) ++ if (err < 0) { + pr_warning("Couldn't synthesize bpf events.\n"); ++ err = 0; ++ } + + if (rec->opts.synth & PERF_SYNTH_CGROUP) { + err = perf_event__synthesize_cgroups(tool, process_synthesized_event, + machine); +- if (err < 0) ++ if (err < 0) { + pr_warning("Couldn't synthesize cgroup events.\n"); ++ err = 0; ++ } + } + + if (rec->opts.nr_threads_synthesize > 1) { +-- +2.35.1 + diff --git a/queue-5.19/perf-script-fix-cannot-print-iregs-field-for-hybrid-.patch b/queue-5.19/perf-script-fix-cannot-print-iregs-field-for-hybrid-.patch new file mode 100644 index 00000000000..eb8eb9b3f98 --- /dev/null +++ b/queue-5.19/perf-script-fix-cannot-print-iregs-field-for-hybrid-.patch @@ -0,0 +1,78 @@ +From 16a8201cf1f65968b60c48a8ed95d83d72423bb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Sep 2022 15:00:30 +0800 +Subject: perf script: Fix Cannot print 'iregs' field for hybrid systems + +From: Zhengjun Xing + +[ Upstream commit 82b2425fad2dd47204b3da589b679220f8aacc0e ] + +Commit b91e5492f9d7ca89 ("perf record: Add a dummy event on hybrid +systems to collect metadata records") adds a dummy event on hybrid +systems to fix the symbol "unknown" issue when the workload is created +in a P-core but runs on an E-core. The added dummy event will cause +"perf script -F iregs" to fail. Dummy events do not have "iregs" +attribute set, so when we do evsel__check_attr, the "iregs" attribute +check will fail, so the issue happened. + +The following commit [1] has fixed a similar issue by skipping the attr +check for the dummy event because it does not have any samples anyway. It +works okay for the normal mode, but the issue still happened when running +the test in the pipe mode. In the pipe mode, it calls process_attr() which +still checks the attr for the dummy event. This commit fixed the issue by +skipping the attr check for the dummy event in the API evsel__check_attr, +Otherwise, we have to patch everywhere when evsel__check_attr() is called. + +Before: + + #./perf record -o - --intr-regs=di,r8,dx,cx -e br_inst_retired.near_call:p -c 1000 --per-thread true 2>/dev/null|./perf script -F iregs |head -5 + Samples for 'dummy:HG' event do not have IREGS attribute set. Cannot print 'iregs' field. + 0x120 [0x90]: failed to process type: 64 + # + +After: + + # ./perf record -o - --intr-regs=di,r8,dx,cx -e br_inst_retired.near_call:p -c 1000 --per-thread true 2>/dev/null|./perf script -F iregs |head -5 + ABI:2 CX:0x55b8efa87000 DX:0x55b8efa7e000 DI:0xffffba5e625efbb0 R8:0xffff90e51f8ae100 + ABI:2 CX:0x7f1dae1e4000 DX:0xd0 DI:0xffff90e18c675ac0 R8:0x71 + ABI:2 CX:0xcc0 DX:0x1 DI:0xffff90e199880240 R8:0x0 + ABI:2 CX:0xffff90e180dd7500 DX:0xffff90e180dd7500 DI:0xffff90e180043500 R8:0x1 + ABI:2 CX:0x50 DX:0xffff90e18c583bd0 DI:0xffff90e1998803c0 R8:0x58 + # + +[1]https://lore.kernel.org/lkml/20220831124041.219925-1-jolsa@kernel.org/ + +Fixes: b91e5492f9d7ca89 ("perf record: Add a dummy event on hybrid systems to collect metadata records") +Suggested-by: Namhyung Kim +Signed-off-by: Xing Zhengjun +Acked-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Kan Liang +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20220908070030.3455164-1-zhengjun.xing@linux.intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-script.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c +index c689054002cca..26a572c160d6f 100644 +--- a/tools/perf/builtin-script.c ++++ b/tools/perf/builtin-script.c +@@ -441,6 +441,9 @@ static int evsel__check_attr(struct evsel *evsel, struct perf_session *session) + struct perf_event_attr *attr = &evsel->core.attr; + bool allow_user_set; + ++ if (evsel__is_dummy_event(evsel)) ++ return 0; ++ + if (perf_header__has_feat(&session->header, HEADER_STAT)) + return 0; + +-- +2.35.1 + diff --git a/queue-5.19/rdma-cma-fix-arguments-order-in-net-device-validatio.patch b/queue-5.19/rdma-cma-fix-arguments-order-in-net-device-validatio.patch new file mode 100644 index 00000000000..5baa4566b2b --- /dev/null +++ b/queue-5.19/rdma-cma-fix-arguments-order-in-net-device-validatio.patch @@ -0,0 +1,48 @@ +From 8be125b256b966c830d2eba17b507e1ce0756b3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Aug 2022 13:51:50 +0300 +Subject: RDMA/cma: Fix arguments order in net device validation + +From: Michael Guralnik + +[ Upstream commit 27cfde795a96aef1e859a5480489944b95421e46 ] + +Fix the order of source and destination addresses when resolving the +route between server and client to validate use of correct net device. + +The reverse order we had so far didn't actually validate the net device +as the server would try to resolve the route to itself, thus always +getting the server's net device. + +The issue was discovered when running cm applications on a single host +between 2 interfaces with same subnet and source based routing rules. +When resolving the reverse route the source based route rules were +ignored. + +Fixes: f887f2ac87c2 ("IB/cma: Validate routing of incoming requests") +Link: https://lore.kernel.org/r/1c1ec2277a131d277ebcceec987fd338d35b775f.1661251872.git.leonro@nvidia.com +Signed-off-by: Michael Guralnik +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cma.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index fabca5e51e3d4..4dd133eccfdfb 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -1719,8 +1719,8 @@ cma_ib_id_from_event(struct ib_cm_id *cm_id, + } + + if (!validate_net_dev(*net_dev, +- (struct sockaddr *)&req->listen_addr_storage, +- (struct sockaddr *)&req->src_addr_storage)) { ++ (struct sockaddr *)&req->src_addr_storage, ++ (struct sockaddr *)&req->listen_addr_storage)) { + id_priv = ERR_PTR(-EHOSTUNREACH); + goto err; + } +-- +2.35.1 + diff --git a/queue-5.19/rdma-hns-fix-supported-page-size.patch b/queue-5.19/rdma-hns-fix-supported-page-size.patch new file mode 100644 index 00000000000..c8e7e83506a --- /dev/null +++ b/queue-5.19/rdma-hns-fix-supported-page-size.patch @@ -0,0 +1,37 @@ +From 8949096cf84db1e1f5a59c7245d40d491d639f42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Aug 2022 18:50:18 +0800 +Subject: RDMA/hns: Fix supported page size + +From: Chengchang Tang + +[ Upstream commit 55af9d498556f0860eb89ffa7677e8d73f6f643f ] + +The supported page size for hns is (4K, 128M), not (4K, 2G). + +Fixes: cfc85f3e4b7f ("RDMA/hns: Add profile support for hip08 driver") +Link: https://lore.kernel.org/r/20220829105021.1427804-2-liangwenpeng@huawei.com +Signed-off-by: Chengchang Tang +Signed-off-by: Wenpeng Liang +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +index 7ffb7824d2689..2d7e91004e3c7 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +@@ -83,7 +83,7 @@ + + #define HNS_ROCE_V2_QPC_TIMER_ENTRY_SZ PAGE_SIZE + #define HNS_ROCE_V2_CQC_TIMER_ENTRY_SZ PAGE_SIZE +-#define HNS_ROCE_V2_PAGE_SIZE_SUPPORTED 0xFFFFF000 ++#define HNS_ROCE_V2_PAGE_SIZE_SUPPORTED 0xFFFF000 + #define HNS_ROCE_V2_MAX_INNER_MTPT_NUM 2 + #define HNS_ROCE_INVALID_LKEY 0x0 + #define HNS_ROCE_INVALID_SGE_LENGTH 0x80000000 +-- +2.35.1 + diff --git a/queue-5.19/rdma-hns-fix-wrong-fixed-value-of-qp-rq.wqe_shift.patch b/queue-5.19/rdma-hns-fix-wrong-fixed-value-of-qp-rq.wqe_shift.patch new file mode 100644 index 00000000000..dfa942ad0f6 --- /dev/null +++ b/queue-5.19/rdma-hns-fix-wrong-fixed-value-of-qp-rq.wqe_shift.patch @@ -0,0 +1,43 @@ +From 62bbf73f16b784c33bb956d32a88fe2bbeb00ddd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Aug 2022 18:50:19 +0800 +Subject: RDMA/hns: Fix wrong fixed value of qp->rq.wqe_shift + +From: Wenpeng Liang + +[ Upstream commit 0c8b5d6268d92d141bfd64d21c870d295a84dee1 ] + +The value of qp->rq.wqe_shift of HIP08 is always determined by the number +of sge. So delete the wrong branch. + +Fixes: cfc85f3e4b7f ("RDMA/hns: Add profile support for hip08 driver") +Fixes: 926a01dc000d ("RDMA/hns: Add QP operations support for hip08 SoC") +Link: https://lore.kernel.org/r/20220829105021.1427804-3-liangwenpeng@huawei.com +Signed-off-by: Wenpeng Liang +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_qp.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c +index 48d3616a6d71d..7bee7f6c5e702 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_qp.c ++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c +@@ -462,11 +462,8 @@ static int set_rq_size(struct hns_roce_dev *hr_dev, struct ib_qp_cap *cap, + hr_qp->rq.max_gs = roundup_pow_of_two(max(1U, cap->max_recv_sge) + + hr_qp->rq.rsv_sge); + +- if (hr_dev->caps.max_rq_sg <= HNS_ROCE_SGE_IN_WQE) +- hr_qp->rq.wqe_shift = ilog2(hr_dev->caps.max_rq_desc_sz); +- else +- hr_qp->rq.wqe_shift = ilog2(hr_dev->caps.max_rq_desc_sz * +- hr_qp->rq.max_gs); ++ hr_qp->rq.wqe_shift = ilog2(hr_dev->caps.max_rq_desc_sz * ++ hr_qp->rq.max_gs); + + hr_qp->rq.wqe_cnt = cnt; + if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_RQ_INLINE && +-- +2.35.1 + diff --git a/queue-5.19/rdma-hns-remove-the-num_qpc_timer-variable.patch b/queue-5.19/rdma-hns-remove-the-num_qpc_timer-variable.patch new file mode 100644 index 00000000000..8cdc51911bc --- /dev/null +++ b/queue-5.19/rdma-hns-remove-the-num_qpc_timer-variable.patch @@ -0,0 +1,93 @@ +From 5a421b71e0f3bbf43f31a975d669a3d02553f88e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Aug 2022 18:50:20 +0800 +Subject: RDMA/hns: Remove the num_qpc_timer variable + +From: Yixing Liu + +[ Upstream commit 45baad7dd98f4d83f67c86c28769d3184390e324 ] + +The bt number of qpc_timer of HIP09 increases compared with that of HIP08. +Therefore, qpc_timer_bt_num and num_qpc_timer do not match. As a result, +the driver may fail to allocate qpc_timer. So the driver needs to uniquely +uses qpc_timer_bt_num to represent the bt number of qpc_timer. + +Fixes: 0e40dc2f70cd ("RDMA/hns: Add timer allocation support for hip08") +Link: https://lore.kernel.org/r/20220829105021.1427804-4-liangwenpeng@huawei.com +Signed-off-by: Yixing Liu +Signed-off-by: Wenpeng Liang +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_device.h | 1 - + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 3 +-- + drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 2 +- + drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- + 4 files changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h +index 2855e9ad4b328..1df076e70e293 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_device.h ++++ b/drivers/infiniband/hw/hns/hns_roce_device.h +@@ -730,7 +730,6 @@ struct hns_roce_caps { + u32 num_qps; + u32 num_pi_qps; + u32 reserved_qps; +- int num_qpc_timer; + u32 num_srqs; + u32 max_wqes; + u32 max_srq_wrs; +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index b354caeaa9b29..49edff989f1f1 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -1941,7 +1941,7 @@ static void set_default_caps(struct hns_roce_dev *hr_dev) + + caps->num_mtpts = HNS_ROCE_V2_MAX_MTPT_NUM; + caps->num_pds = HNS_ROCE_V2_MAX_PD_NUM; +- caps->num_qpc_timer = HNS_ROCE_V2_MAX_QPC_TIMER_NUM; ++ caps->qpc_timer_bt_num = HNS_ROCE_V2_MAX_QPC_TIMER_BT_NUM; + caps->cqc_timer_bt_num = HNS_ROCE_V2_MAX_CQC_TIMER_BT_NUM; + + caps->max_qp_init_rdma = HNS_ROCE_V2_MAX_QP_INIT_RDMA; +@@ -2237,7 +2237,6 @@ static int hns_roce_query_pf_caps(struct hns_roce_dev *hr_dev) + caps->max_rq_sg = le16_to_cpu(resp_a->max_rq_sg); + caps->max_rq_sg = roundup_pow_of_two(caps->max_rq_sg); + caps->max_extend_sg = le32_to_cpu(resp_a->max_extend_sg); +- caps->num_qpc_timer = le16_to_cpu(resp_a->num_qpc_timer); + caps->max_srq_sges = le16_to_cpu(resp_a->max_srq_sges); + caps->max_srq_sges = roundup_pow_of_two(caps->max_srq_sges); + caps->num_aeq_vectors = resp_a->num_aeq_vectors; +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +index 2d7e91004e3c7..e4b640caee1b7 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +@@ -36,11 +36,11 @@ + #include + + #define HNS_ROCE_V2_MAX_QP_NUM 0x1000 +-#define HNS_ROCE_V2_MAX_QPC_TIMER_NUM 0x200 + #define HNS_ROCE_V2_MAX_WQE_NUM 0x8000 + #define HNS_ROCE_V2_MAX_SRQ_WR 0x8000 + #define HNS_ROCE_V2_MAX_SRQ_SGE 64 + #define HNS_ROCE_V2_MAX_CQ_NUM 0x100000 ++#define HNS_ROCE_V2_MAX_QPC_TIMER_BT_NUM 0x100 + #define HNS_ROCE_V2_MAX_CQC_TIMER_BT_NUM 0x100 + #define HNS_ROCE_V2_MAX_SRQ_NUM 0x100000 + #define HNS_ROCE_V2_MAX_CQE_NUM 0x400000 +diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c +index c8af4ebd7cbd3..4ccb217b2841d 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_main.c ++++ b/drivers/infiniband/hw/hns/hns_roce_main.c +@@ -725,7 +725,7 @@ static int hns_roce_init_hem(struct hns_roce_dev *hr_dev) + ret = hns_roce_init_hem_table(hr_dev, &hr_dev->qpc_timer_table, + HEM_TYPE_QPC_TIMER, + hr_dev->caps.qpc_timer_entry_sz, +- hr_dev->caps.num_qpc_timer, 1); ++ hr_dev->caps.qpc_timer_bt_num, 1); + if (ret) { + dev_err(dev, + "Failed to init QPC timer memory, aborting.\n"); +-- +2.35.1 + diff --git a/queue-5.19/rdma-irdma-fix-drain-sq-hang-with-no-completion.patch b/queue-5.19/rdma-irdma-fix-drain-sq-hang-with-no-completion.patch new file mode 100644 index 00000000000..2836bb2050e --- /dev/null +++ b/queue-5.19/rdma-irdma-fix-drain-sq-hang-with-no-completion.patch @@ -0,0 +1,66 @@ +From d988dd31961b2c9f90570a598f4a6a1f69ccf246 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 10:43:59 -0500 +Subject: RDMA/irdma: Fix drain SQ hang with no completion + +From: Shiraz Saleem + +[ Upstream commit ead54ced6321099978d30d62dc49c282a6e70574 ] + +SW generated completions for outstanding WRs posted on SQ +after QP is in error target the wrong CQ. This causes the +ib_drain_sq to hang with no completion. + +Fix this to generate completions on the right CQ. + +[ 863.969340] INFO: task kworker/u52:2:671 blocked for more than 122 seconds. +[ 863.979224] Not tainted 5.14.0-130.el9.x86_64 #1 +[ 863.986588] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 863.996997] task:kworker/u52:2 state:D stack: 0 pid: 671 ppid: 2 flags:0x00004000 +[ 864.007272] Workqueue: xprtiod xprt_autoclose [sunrpc] +[ 864.014056] Call Trace: +[ 864.017575] __schedule+0x206/0x580 +[ 864.022296] schedule+0x43/0xa0 +[ 864.026736] schedule_timeout+0x115/0x150 +[ 864.032185] __wait_for_common+0x93/0x1d0 +[ 864.037717] ? usleep_range_state+0x90/0x90 +[ 864.043368] __ib_drain_sq+0xf6/0x170 [ib_core] +[ 864.049371] ? __rdma_block_iter_next+0x80/0x80 [ib_core] +[ 864.056240] ib_drain_sq+0x66/0x70 [ib_core] +[ 864.062003] rpcrdma_xprt_disconnect+0x82/0x3b0 [rpcrdma] +[ 864.069365] ? xprt_prepare_transmit+0x5d/0xc0 [sunrpc] +[ 864.076386] xprt_rdma_close+0xe/0x30 [rpcrdma] +[ 864.082593] xprt_autoclose+0x52/0x100 [sunrpc] +[ 864.088718] process_one_work+0x1e8/0x3c0 +[ 864.094170] worker_thread+0x50/0x3b0 +[ 864.099109] ? rescuer_thread+0x370/0x370 +[ 864.104473] kthread+0x149/0x170 +[ 864.109022] ? set_kthread_struct+0x40/0x40 +[ 864.114713] ret_from_fork+0x22/0x30 + +Fixes: 81091d7696ae ("RDMA/irdma: Add SW mechanism to generate completions on error") +Link: https://lore.kernel.org/r/20220824154358.117-1-shiraz.saleem@intel.com +Reported-by: Kamal Heib +Signed-off-by: Shiraz Saleem +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/utils.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/irdma/utils.c b/drivers/infiniband/hw/irdma/utils.c +index ab3c5208a1231..7b15faadfef5c 100644 +--- a/drivers/infiniband/hw/irdma/utils.c ++++ b/drivers/infiniband/hw/irdma/utils.c +@@ -2597,7 +2597,7 @@ void irdma_generate_flush_completions(struct irdma_qp *iwqp) + spin_unlock_irqrestore(&iwqp->lock, flags2); + spin_unlock_irqrestore(&iwqp->iwscq->lock, flags1); + if (compl_generated) +- irdma_comp_handler(iwqp->iwrcq); ++ irdma_comp_handler(iwqp->iwscq); + } else { + spin_unlock_irqrestore(&iwqp->iwscq->lock, flags1); + mod_delayed_work(iwqp->iwdev->cleanup_wq, &iwqp->dwork_flush, +-- +2.35.1 + diff --git a/queue-5.19/rdma-irdma-report-rnr-nak-generation-in-device-caps.patch b/queue-5.19/rdma-irdma-report-rnr-nak-generation-in-device-caps.patch new file mode 100644 index 00000000000..5aa0b7b5544 --- /dev/null +++ b/queue-5.19/rdma-irdma-report-rnr-nak-generation-in-device-caps.patch @@ -0,0 +1,41 @@ +From 2eedd9015b2fd8cab7106ab541b201e1e1523ce0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Sep 2022 17:32:44 -0500 +Subject: RDMA/irdma: Report RNR NAK generation in device caps + +From: Sindhu-Devale + +[ Upstream commit a261786fdc0a5bed2e5f994dcc0ffeeeb0d662c7 ] + +Report RNR NAK generation when device capabilities are queried + +Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") +Signed-off-by: Sindhu-Devale +Signed-off-by: Shiraz Saleem +Link: https://lore.kernel.org/r/20220906223244.1119-6-shiraz.saleem@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/verbs.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c +index e7120d7a5b4c6..ab73d1715f991 100644 +--- a/drivers/infiniband/hw/irdma/verbs.c ++++ b/drivers/infiniband/hw/irdma/verbs.c +@@ -46,8 +46,11 @@ static int irdma_query_device(struct ib_device *ibdev, + props->max_sge_rd = hw_attrs->uk_attrs.max_hw_read_sges; + props->max_qp_rd_atom = hw_attrs->max_hw_ird; + props->max_qp_init_rd_atom = hw_attrs->max_hw_ord; +- if (rdma_protocol_roce(ibdev, 1)) ++ if (rdma_protocol_roce(ibdev, 1)) { ++ props->device_cap_flags |= IB_DEVICE_RC_RNR_NAK_GEN; + props->max_pkeys = IRDMA_PKEY_TBL_SZ; ++ } ++ + props->max_ah = rf->max_ah; + props->max_mcast_grp = rf->max_mcg; + props->max_mcast_qp_attach = IRDMA_MAX_MGS_PER_CTX; +-- +2.35.1 + diff --git a/queue-5.19/rdma-irdma-report-the-correct-max-cqes-from-query-de.patch b/queue-5.19/rdma-irdma-report-the-correct-max-cqes-from-query-de.patch new file mode 100644 index 00000000000..c529a5a1dbc --- /dev/null +++ b/queue-5.19/rdma-irdma-report-the-correct-max-cqes-from-query-de.patch @@ -0,0 +1,38 @@ +From b2fcf1a79c175d22b5f9ddcce21ac0b58e5ee0b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Sep 2022 17:32:40 -0500 +Subject: RDMA/irdma: Report the correct max cqes from query device + +From: Sindhu-Devale + +[ Upstream commit 12faad5e5cf2372af2d51f348b697b5edf838daf ] + +Report the correct max cqes available to an application taking +into account a reserved entry to detect overflow. + +Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") +Signed-off-by: Sindhu-Devale +Signed-off-by: Shiraz Saleem +Link: https://lore.kernel.org/r/20220906223244.1119-2-shiraz.saleem@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/verbs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c +index 227a799385d1d..4835702871677 100644 +--- a/drivers/infiniband/hw/irdma/verbs.c ++++ b/drivers/infiniband/hw/irdma/verbs.c +@@ -39,7 +39,7 @@ static int irdma_query_device(struct ib_device *ibdev, + props->max_send_sge = hw_attrs->uk_attrs.max_hw_wq_frags; + props->max_recv_sge = hw_attrs->uk_attrs.max_hw_wq_frags; + props->max_cq = rf->max_cq - rf->used_cqs; +- props->max_cqe = rf->max_cqe; ++ props->max_cqe = rf->max_cqe - 1; + props->max_mr = rf->max_mr - rf->used_mrs; + props->max_mw = props->max_mr; + props->max_pd = rf->max_pd - rf->used_pds; +-- +2.35.1 + diff --git a/queue-5.19/rdma-irdma-return-correct-wc-error-for-bind-operatio.patch b/queue-5.19/rdma-irdma-return-correct-wc-error-for-bind-operatio.patch new file mode 100644 index 00000000000..f6d87dadda2 --- /dev/null +++ b/queue-5.19/rdma-irdma-return-correct-wc-error-for-bind-operatio.patch @@ -0,0 +1,57 @@ +From 38ff530bf99f8c99879c06a47a90ab526fa27769 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Sep 2022 17:32:42 -0500 +Subject: RDMA/irdma: Return correct WC error for bind operation failure + +From: Sindhu-Devale + +[ Upstream commit dcb23bbb1de7e009875fdfac2b8a9808a9319cc6 ] + +When a QP and a MR on a local host are in different PDs, the HW generates +an asynchronous event (AE). The same AE is generated when a QP and a MW +are in different PDs during a bind operation. Return the more appropriate +IBV_WC_MW_BIND_ERR for the latter case by checking the OP type from the +CQE in error. + +Fixes: 551c46edc769 ("RDMA/irdma: Add user/kernel shared libraries") +Signed-off-by: Sindhu-Devale +Signed-off-by: Shiraz Saleem +Link: https://lore.kernel.org/r/20220906223244.1119-4-shiraz.saleem@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/uk.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/irdma/uk.c b/drivers/infiniband/hw/irdma/uk.c +index daeab5daed5bc..d003ad864ee44 100644 +--- a/drivers/infiniband/hw/irdma/uk.c ++++ b/drivers/infiniband/hw/irdma/uk.c +@@ -1005,6 +1005,7 @@ int irdma_uk_cq_poll_cmpl(struct irdma_cq_uk *cq, + int ret_code; + bool move_cq_head = true; + u8 polarity; ++ u8 op_type; + bool ext_valid; + __le64 *ext_cqe; + +@@ -1187,7 +1188,6 @@ int irdma_uk_cq_poll_cmpl(struct irdma_cq_uk *cq, + do { + __le64 *sw_wqe; + u64 wqe_qword; +- u8 op_type; + u32 tail; + + tail = qp->sq_ring.tail; +@@ -1204,6 +1204,8 @@ int irdma_uk_cq_poll_cmpl(struct irdma_cq_uk *cq, + break; + } + } while (1); ++ if (op_type == IRDMA_OP_TYPE_BIND_MW && info->minor_err == FLUSH_PROT_ERR) ++ info->minor_err = FLUSH_MW_BIND_ERR; + qp->sq_flush_seen = true; + if (!IRDMA_RING_MORE_WORK(qp->sq_ring)) + qp->sq_flush_complete = true; +-- +2.35.1 + diff --git a/queue-5.19/rdma-irdma-return-error-on-mr-deregister-cqp-failure.patch b/queue-5.19/rdma-irdma-return-error-on-mr-deregister-cqp-failure.patch new file mode 100644 index 00000000000..8cd4f3b0d91 --- /dev/null +++ b/queue-5.19/rdma-irdma-return-error-on-mr-deregister-cqp-failure.patch @@ -0,0 +1,75 @@ +From 3a383da3ed491ff00bc4fc2f6f13145ec4a1ef81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Sep 2022 17:32:41 -0500 +Subject: RDMA/irdma: Return error on MR deregister CQP failure + +From: Sindhu-Devale + +[ Upstream commit 6b227bd32db778eddc6f3b22cc72a28dda0f2272 ] + +The MR deregister CQP can fail if an MW is bound to it. +Return an appropriate error for this case. + +Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") +Signed-off-by: Sindhu-Devale +Signed-off-by: Shiraz Saleem +Link: https://lore.kernel.org/r/20220906223244.1119-3-shiraz.saleem@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/utils.c | 13 ++++++++----- + drivers/infiniband/hw/irdma/verbs.c | 6 +++++- + 2 files changed, 13 insertions(+), 6 deletions(-) + +diff --git a/drivers/infiniband/hw/irdma/utils.c b/drivers/infiniband/hw/irdma/utils.c +index 7b15faadfef5c..f4d774451160d 100644 +--- a/drivers/infiniband/hw/irdma/utils.c ++++ b/drivers/infiniband/hw/irdma/utils.c +@@ -590,11 +590,14 @@ static int irdma_wait_event(struct irdma_pci_f *rf, + cqp_error = cqp_request->compl_info.error; + if (cqp_error) { + err_code = -EIO; +- if (cqp_request->compl_info.maj_err_code == 0xFFFF && +- cqp_request->compl_info.min_err_code == 0x8029) { +- if (!rf->reset) { +- rf->reset = true; +- rf->gen_ops.request_reset(rf); ++ if (cqp_request->compl_info.maj_err_code == 0xFFFF) { ++ if (cqp_request->compl_info.min_err_code == 0x8002) ++ err_code = -EBUSY; ++ else if (cqp_request->compl_info.min_err_code == 0x8029) { ++ if (!rf->reset) { ++ rf->reset = true; ++ rf->gen_ops.request_reset(rf); ++ } + } + } + } +diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c +index 4835702871677..e7120d7a5b4c6 100644 +--- a/drivers/infiniband/hw/irdma/verbs.c ++++ b/drivers/infiniband/hw/irdma/verbs.c +@@ -3001,6 +3001,7 @@ static int irdma_dereg_mr(struct ib_mr *ib_mr, struct ib_udata *udata) + struct irdma_pble_alloc *palloc = &iwpbl->pble_alloc; + struct irdma_cqp_request *cqp_request; + struct cqp_cmds_info *cqp_info; ++ int status; + + if (iwmr->type != IRDMA_MEMREG_TYPE_MEM) { + if (iwmr->region) { +@@ -3031,8 +3032,11 @@ static int irdma_dereg_mr(struct ib_mr *ib_mr, struct ib_udata *udata) + cqp_info->post_sq = 1; + cqp_info->in.u.dealloc_stag.dev = &iwdev->rf->sc_dev; + cqp_info->in.u.dealloc_stag.scratch = (uintptr_t)cqp_request; +- irdma_handle_cqp_op(iwdev->rf, cqp_request); ++ status = irdma_handle_cqp_op(iwdev->rf, cqp_request); + irdma_put_cqp_request(&iwdev->rf->cqp, cqp_request); ++ if (status) ++ return status; ++ + irdma_free_stag(iwdev, iwmr->stag); + done: + if (iwpbl->pbl_allocated) +-- +2.35.1 + diff --git a/queue-5.19/rdma-mlx5-set-local-port-to-one-when-accessing-count.patch b/queue-5.19/rdma-mlx5-set-local-port-to-one-when-accessing-count.patch new file mode 100644 index 00000000000..e6771b08320 --- /dev/null +++ b/queue-5.19/rdma-mlx5-set-local-port-to-one-when-accessing-count.patch @@ -0,0 +1,53 @@ +From 252a652e07b0b70648e21e40eba5241c85e0ed07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Aug 2022 12:02:28 +0300 +Subject: RDMA/mlx5: Set local port to one when accessing counters + +From: Chris Mi + +[ Upstream commit 74b30b3ad5cec95d2647e796d10137438a098bc1 ] + +When accessing Ports Performance Counters Register (PPCNT), +local port must be one if it is Function-Per-Port HCA that +HCA_CAP.num_ports is 1. + +The offending patch can change the local port to other values +when accessing PPCNT after enabling switchdev mode. The following +syndrome will be printed: + + # cat /sys/class/infiniband/rdmap4s0f0/ports/2/counters/* + # dmesg + mlx5_core 0000:04:00.0: mlx5_cmd_check:756:(pid 12450): ACCESS_REG(0x805) op_mod(0x1) failed, status bad parameter(0x3), syndrome (0x1e5585) + +Fix it by setting local port to one for Function-Per-Port HCA. + +Fixes: 210b1f78076f ("IB/mlx5: When not in dual port RoCE mode, use provided port as native") +Reviewed-by: Mark Bloch +Signed-off-by: Chris Mi +Link: https://lore.kernel.org/r/6c5086c295c76211169e58dbd610fb0402360bab.1661763459.git.leonro@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/mad.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/infiniband/hw/mlx5/mad.c b/drivers/infiniband/hw/mlx5/mad.c +index 293ed709e5ed5..b4dc52392275b 100644 +--- a/drivers/infiniband/hw/mlx5/mad.c ++++ b/drivers/infiniband/hw/mlx5/mad.c +@@ -166,6 +166,12 @@ static int process_pma_cmd(struct mlx5_ib_dev *dev, u32 port_num, + mdev = dev->mdev; + mdev_port_num = 1; + } ++ if (MLX5_CAP_GEN(dev->mdev, num_ports) == 1) { ++ /* set local port to one for Function-Per-Port HCA. */ ++ mdev = dev->mdev; ++ mdev_port_num = 1; ++ } ++ + /* Declaring support of extended counters */ + if (in_mad->mad_hdr.attr_id == IB_PMA_CLASS_PORT_INFO) { + struct ib_class_port_info cpi = {}; +-- +2.35.1 + diff --git a/queue-5.19/rdma-rtrs-clt-use-the-right-sg_cnt-after-ib_dma_map_.patch b/queue-5.19/rdma-rtrs-clt-use-the-right-sg_cnt-after-ib_dma_map_.patch new file mode 100644 index 00000000000..146675a3635 --- /dev/null +++ b/queue-5.19/rdma-rtrs-clt-use-the-right-sg_cnt-after-ib_dma_map_.patch @@ -0,0 +1,73 @@ +From e352184022b2c0535877e50db9ac931c4205923b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Aug 2022 12:53:54 +0200 +Subject: RDMA/rtrs-clt: Use the right sg_cnt after ib_dma_map_sg + +From: Jack Wang + +[ Upstream commit b66905e04dc714825aa6cffb950e281b46bbeafe ] + +When iommu is enabled, we hit warnings like this: +WARNING: at rtrs/rtrs.c:178 rtrs_iu_post_rdma_write_imm+0x9b/0x110 + +rtrs warn on one sge entry length is 0, which is unexpected. + +The problem is ib_dma_map_sg augments the SGL into a 'dma mapped SGL'. +This process may change the number of entries and the lengths of each +entry. + +Code that touches dma_address is iterating over the 'dma mapped SGL' +and must use dma_nents which returned from ib_dma_map_sg(). +So pass the count return from ib_dma_map_sg. + +Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality") +Link: https://lore.kernel.org/r/20220818105355.110344-3-haris.iqbal@ionos.com +Signed-off-by: Jack Wang +Reviewed-by: Aleksei Marov +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +index 525f083fcaeb4..bf464400a4409 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +@@ -1004,7 +1004,8 @@ rtrs_clt_get_copy_req(struct rtrs_clt_path *alive_path, + static int rtrs_post_rdma_write_sg(struct rtrs_clt_con *con, + struct rtrs_clt_io_req *req, + struct rtrs_rbuf *rbuf, bool fr_en, +- u32 size, u32 imm, struct ib_send_wr *wr, ++ u32 count, u32 size, u32 imm, ++ struct ib_send_wr *wr, + struct ib_send_wr *tail) + { + struct rtrs_clt_path *clt_path = to_clt_path(con->c.path); +@@ -1024,12 +1025,12 @@ static int rtrs_post_rdma_write_sg(struct rtrs_clt_con *con, + num_sge = 2; + ptail = tail; + } else { +- for_each_sg(req->sglist, sg, req->sg_cnt, i) { ++ for_each_sg(req->sglist, sg, count, i) { + sge[i].addr = sg_dma_address(sg); + sge[i].length = sg_dma_len(sg); + sge[i].lkey = clt_path->s.dev->ib_pd->local_dma_lkey; + } +- num_sge = 1 + req->sg_cnt; ++ num_sge = 1 + count; + } + sge[i].addr = req->iu->dma_addr; + sge[i].length = size; +@@ -1142,7 +1143,7 @@ static int rtrs_clt_write_req(struct rtrs_clt_io_req *req) + */ + rtrs_clt_update_all_stats(req, WRITE); + +- ret = rtrs_post_rdma_write_sg(req->con, req, rbuf, fr_en, ++ ret = rtrs_post_rdma_write_sg(req->con, req, rbuf, fr_en, count, + req->usr_len + sizeof(*msg), + imm, wr, &inv_wr); + if (ret) { +-- +2.35.1 + diff --git a/queue-5.19/rdma-rtrs-srv-pass-the-correct-number-of-entries-for.patch b/queue-5.19/rdma-rtrs-srv-pass-the-correct-number-of-entries-for.patch new file mode 100644 index 00000000000..2477c40aa9a --- /dev/null +++ b/queue-5.19/rdma-rtrs-srv-pass-the-correct-number-of-entries-for.patch @@ -0,0 +1,77 @@ +From c3d0a5866ac210fd91d3a80bcd00250fbdf279fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Aug 2022 12:53:55 +0200 +Subject: RDMA/rtrs-srv: Pass the correct number of entries for dma mapped SGL + +From: Jack Wang + +[ Upstream commit 56c310de0b4b3aca1c4fdd9c1093fc48372a7335 ] + +ib_dma_map_sg() augments the SGL into a 'dma mapped SGL'. This process +may change the number of entries and the lengths of each entry. + +Code that touches dma_address is iterating over the 'dma mapped SGL' +and must use dma_nents which returned from ib_dma_map_sg(). + +We should use the return count from ib_dma_map_sg for futher usage. + +Fixes: 9cb837480424e ("RDMA/rtrs: server: main functionality") +Link: https://lore.kernel.org/r/20220818105355.110344-4-haris.iqbal@ionos.com +Signed-off-by: Jack Wang +Reviewed-by: Aleksei Marov +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-srv.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c +index 24024bce25664..ee4876bdce4ac 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c +@@ -600,7 +600,7 @@ static int map_cont_bufs(struct rtrs_srv_path *srv_path) + struct sg_table *sgt = &srv_mr->sgt; + struct scatterlist *s; + struct ib_mr *mr; +- int nr, chunks; ++ int nr, nr_sgt, chunks; + + chunks = chunks_per_mr * mri; + if (!always_invalidate) +@@ -615,19 +615,19 @@ static int map_cont_bufs(struct rtrs_srv_path *srv_path) + sg_set_page(s, srv->chunks[chunks + i], + max_chunk_size, 0); + +- nr = ib_dma_map_sg(srv_path->s.dev->ib_dev, sgt->sgl, ++ nr_sgt = ib_dma_map_sg(srv_path->s.dev->ib_dev, sgt->sgl, + sgt->nents, DMA_BIDIRECTIONAL); +- if (nr < sgt->nents) { +- err = nr < 0 ? nr : -EINVAL; ++ if (!nr_sgt) { ++ err = -EINVAL; + goto free_sg; + } + mr = ib_alloc_mr(srv_path->s.dev->ib_pd, IB_MR_TYPE_MEM_REG, +- sgt->nents); ++ nr_sgt); + if (IS_ERR(mr)) { + err = PTR_ERR(mr); + goto unmap_sg; + } +- nr = ib_map_mr_sg(mr, sgt->sgl, sgt->nents, ++ nr = ib_map_mr_sg(mr, sgt->sgl, nr_sgt, + NULL, max_chunk_size); + if (nr < 0 || nr < sgt->nents) { + err = nr < 0 ? nr : -EINVAL; +@@ -646,7 +646,7 @@ static int map_cont_bufs(struct rtrs_srv_path *srv_path) + } + } + /* Eventually dma addr for each chunk can be cached */ +- for_each_sg(sgt->sgl, s, sgt->orig_nents, i) ++ for_each_sg(sgt->sgl, s, nr_sgt, i) + srv_path->dma_addr[chunks + i] = sg_dma_address(s); + + ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey)); +-- +2.35.1 + diff --git a/queue-5.19/rdma-siw-pass-a-pointer-to-virt_to_page.patch b/queue-5.19/rdma-siw-pass-a-pointer-to-virt_to_page.patch new file mode 100644 index 00000000000..90a2bb33740 --- /dev/null +++ b/queue-5.19/rdma-siw-pass-a-pointer-to-virt_to_page.patch @@ -0,0 +1,88 @@ +From fcd777991b2cc2298ab79d00f3ed2a7bf7a1161b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Sep 2022 23:59:18 +0200 +Subject: RDMA/siw: Pass a pointer to virt_to_page() + +From: Linus Walleij + +[ Upstream commit 0d1b756acf60da5004c1e20ca4462f0c257bf6e1 ] + +Functions that work on a pointer to virtual memory such as +virt_to_pfn() and users of that function such as +virt_to_page() are supposed to pass a pointer to virtual +memory, ideally a (void *) or other pointer. However since +many architectures implement virt_to_pfn() as a macro, +this function becomes polymorphic and accepts both a +(unsigned long) and a (void *). + +If we instead implement a proper virt_to_pfn(void *addr) +function the following happens (occurred on arch/arm): + +drivers/infiniband/sw/siw/siw_qp_tx.c:32:23: warning: incompatible + integer to pointer conversion passing 'dma_addr_t' (aka 'unsigned int') + to parameter of type 'const void *' [-Wint-conversion] +drivers/infiniband/sw/siw/siw_qp_tx.c:32:37: warning: passing argument + 1 of 'virt_to_pfn' makes pointer from integer without a cast + [-Wint-conversion] +drivers/infiniband/sw/siw/siw_qp_tx.c:538:36: warning: incompatible + integer to pointer conversion passing 'unsigned long long' + to parameter of type 'const void *' [-Wint-conversion] + +Fix this with an explicit cast. In one case where the SIW +SGE uses an unaligned u64 we need a double cast modifying the +virtual address (va) to a platform-specific uintptr_t before +casting to a (void *). + +Fixes: b9be6f18cf9e ("rdma/siw: transmit path") +Cc: linux-rdma@vger.kernel.org +Signed-off-by: Linus Walleij +Link: https://lore.kernel.org/r/20220902215918.603761-1-linus.walleij@linaro.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_qp_tx.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/sw/siw/siw_qp_tx.c b/drivers/infiniband/sw/siw/siw_qp_tx.c +index 1f4e60257700e..7d47b521070b1 100644 +--- a/drivers/infiniband/sw/siw/siw_qp_tx.c ++++ b/drivers/infiniband/sw/siw/siw_qp_tx.c +@@ -29,7 +29,7 @@ static struct page *siw_get_pblpage(struct siw_mem *mem, u64 addr, int *idx) + dma_addr_t paddr = siw_pbl_get_buffer(pbl, offset, NULL, idx); + + if (paddr) +- return virt_to_page(paddr); ++ return virt_to_page((void *)paddr); + + return NULL; + } +@@ -533,13 +533,23 @@ static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, struct socket *s) + kunmap_local(kaddr); + } + } else { +- u64 va = sge->laddr + sge_off; ++ /* ++ * Cast to an uintptr_t to preserve all 64 bits ++ * in sge->laddr. ++ */ ++ uintptr_t va = (uintptr_t)(sge->laddr + sge_off); + +- page_array[seg] = virt_to_page(va & PAGE_MASK); ++ /* ++ * virt_to_page() takes a (void *) pointer ++ * so cast to a (void *) meaning it will be 64 ++ * bits on a 64 bit platform and 32 bits on a ++ * 32 bit platform. ++ */ ++ page_array[seg] = virt_to_page((void *)(va & PAGE_MASK)); + if (do_crc) + crypto_shash_update( + c_tx->mpa_crc_hd, +- (void *)(uintptr_t)va, ++ (void *)va, + plen); + } + +-- +2.35.1 + diff --git a/queue-5.19/rdma-srp-set-scmnd-result-only-when-scmnd-is-not-nul.patch b/queue-5.19/rdma-srp-set-scmnd-result-only-when-scmnd-is-not-nul.patch new file mode 100644 index 00000000000..82f3f03e379 --- /dev/null +++ b/queue-5.19/rdma-srp-set-scmnd-result-only-when-scmnd-is-not-nul.patch @@ -0,0 +1,66 @@ +From 5c30179b0434340d80df2d10a8f2a8e497d6bd23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Aug 2022 08:16:29 +0000 +Subject: RDMA/srp: Set scmnd->result only when scmnd is not NULL + +From: yangx.jy@fujitsu.com + +[ Upstream commit 12f35199a2c0551187edbf8eb01379f0598659fa ] + +This change fixes the following kernel NULL pointer dereference +which is reproduced by blktests srp/007 occasionally. + +BUG: kernel NULL pointer dereference, address: 0000000000000170 +PGD 0 P4D 0 +Oops: 0002 [#1] PREEMPT SMP NOPTI +CPU: 0 PID: 9 Comm: kworker/0:1H Kdump: loaded Not tainted 6.0.0-rc1+ #37 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-29-g6a62e0cb0dfe-prebuilt.qemu.org 04/01/2014 +Workqueue: 0x0 (kblockd) +RIP: 0010:srp_recv_done+0x176/0x500 [ib_srp] +Code: 00 4d 85 ff 0f 84 52 02 00 00 48 c7 82 80 02 00 00 00 00 00 00 4c 89 df 4c 89 14 24 e8 53 d3 4a f6 4c 8b 14 24 41 0f b6 42 13 <41> 89 87 70 01 00 00 41 0f b6 52 12 f6 c2 02 74 44 41 8b 42 1c b9 +RSP: 0018:ffffaef7c0003e28 EFLAGS: 00000282 +RAX: 0000000000000000 RBX: ffff9bc9486dea60 RCX: 0000000000000000 +RDX: 0000000000000102 RSI: ffffffffb76bbd0e RDI: 00000000ffffffff +RBP: ffff9bc980099a00 R08: 0000000000000001 R09: 0000000000000001 +R10: ffff9bca53ef0000 R11: ffff9bc980099a10 R12: ffff9bc956e14000 +R13: ffff9bc9836b9cb0 R14: ffff9bc9557b4480 R15: 0000000000000000 +FS: 0000000000000000(0000) GS:ffff9bc97ec00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000000170 CR3: 0000000007e04000 CR4: 00000000000006f0 +Call Trace: + + __ib_process_cq+0xb7/0x280 [ib_core] + ib_poll_handler+0x2b/0x130 [ib_core] + irq_poll_softirq+0x93/0x150 + __do_softirq+0xee/0x4b8 + irq_exit_rcu+0xf7/0x130 + sysvec_apic_timer_interrupt+0x8e/0xc0 + + +Fixes: ad215aaea4f9 ("RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent") +Link: https://lore.kernel.org/r/20220831081626.18712-1-yangx.jy@fujitsu.com +Signed-off-by: Xiao Yang +Acked-by: Bart Van Assche +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/srp/ib_srp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c +index 6058abf42ba74..3d9c108d73ad8 100644 +--- a/drivers/infiniband/ulp/srp/ib_srp.c ++++ b/drivers/infiniband/ulp/srp/ib_srp.c +@@ -1962,7 +1962,8 @@ static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp) + if (scmnd) { + req = scsi_cmd_priv(scmnd); + scmnd = srp_claim_req(ch, req, NULL, scmnd); +- } else { ++ } ++ if (!scmnd) { + shost_printk(KERN_ERR, target->scsi_host, + "Null scmnd for RSP w/tag %#016llx received on ch %td / QP %#x\n", + rsp->tag, ch - target->ch, ch->qp->qp_num); +-- +2.35.1 + diff --git a/queue-5.19/regmap-spi-reserve-space-for-register-address-paddin.patch b/queue-5.19/regmap-spi-reserve-space-for-register-address-paddin.patch new file mode 100644 index 00000000000..c6ffb4380f7 --- /dev/null +++ b/queue-5.19/regmap-spi-reserve-space-for-register-address-paddin.patch @@ -0,0 +1,62 @@ +From c29275cde0e0de4bd6107b48916b6a34b4a13da0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Aug 2022 13:48:51 +0300 +Subject: regmap: spi: Reserve space for register address/padding + +From: Cristian Ciocaltea + +[ Upstream commit f5723cfc01932c7a8d5c78dbf7e067e537c91439 ] + +Currently the max_raw_read and max_raw_write limits in regmap_spi struct +do not take into account the additional size of the transmitted register +address and padding. This may result in exceeding the maximum permitted +SPI message size, which could cause undefined behaviour, e.g. data +corruption. + +Fix regmap_get_spi_bus() to properly adjust the above mentioned limits +by reserving space for the register address/padding as set in the regmap +configuration. + +Fixes: f231ff38b7b2 ("regmap: spi: Set regmap max raw r/w from max_transfer_size") + +Signed-off-by: Cristian Ciocaltea +Reviewed-by: Lucas Tanure +Link: https://lore.kernel.org/r/20220818104851.429479-1-cristian.ciocaltea@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap-spi.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/base/regmap/regmap-spi.c b/drivers/base/regmap/regmap-spi.c +index 719323bc6c7f1..37ab23a9d0345 100644 +--- a/drivers/base/regmap/regmap-spi.c ++++ b/drivers/base/regmap/regmap-spi.c +@@ -113,6 +113,7 @@ static const struct regmap_bus *regmap_get_spi_bus(struct spi_device *spi, + const struct regmap_config *config) + { + size_t max_size = spi_max_transfer_size(spi); ++ size_t max_msg_size, reg_reserve_size; + struct regmap_bus *bus; + + if (max_size != SIZE_MAX) { +@@ -120,9 +121,16 @@ static const struct regmap_bus *regmap_get_spi_bus(struct spi_device *spi, + if (!bus) + return ERR_PTR(-ENOMEM); + ++ max_msg_size = spi_max_message_size(spi); ++ reg_reserve_size = config->reg_bits / BITS_PER_BYTE ++ + config->pad_bits / BITS_PER_BYTE; ++ if (max_size + reg_reserve_size > max_msg_size) ++ max_size -= reg_reserve_size; ++ + bus->free_on_exit = true; + bus->max_raw_read = max_size; + bus->max_raw_write = max_size; ++ + return bus; + } + +-- +2.35.1 + diff --git a/queue-5.19/regulator-core-clean-up-on-enable-failure.patch b/queue-5.19/regulator-core-clean-up-on-enable-failure.patch new file mode 100644 index 00000000000..54f0f0afe84 --- /dev/null +++ b/queue-5.19/regulator-core-clean-up-on-enable-failure.patch @@ -0,0 +1,72 @@ +From 59497b64ad7f1ef0cc9932dff99fc18dc8636874 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Aug 2022 14:43:36 -0500 +Subject: regulator: core: Clean up on enable failure + +From: Andrew Halaney + +[ Upstream commit c32f1ebfd26bece77141257864ed7b4720da1557 ] + +If regulator_enable() fails, enable_count is incremented still. +A consumer, assuming no matching regulator_disable() is necessary on +failure, will then get this error message upon regulator_put() +since enable_count is non-zero: + + [ 1.277418] WARNING: CPU: 3 PID: 1 at drivers/regulator/core.c:2304 _regulator_put.part.0+0x168/0x170 + +The consumer could try to fix this in their driver by cleaning up on +error from regulator_enable() (i.e. call regulator_disable()), but that +results in the following since regulator_enable() failed and didn't +increment user_count: + + [ 1.258112] unbalanced disables for vreg_l17c + [ 1.262606] WARNING: CPU: 4 PID: 1 at drivers/regulator/core.c:2899 _regulator_disable+0xd4/0x190 + +Fix this by decrementing enable_count upon failure to enable. + +With this in place, just the reason for failure to enable is printed +as expected and developers can focus on the root cause of their issue +instead of thinking their usage of the regulator consumer api is +incorrect. For example, in my case: + + [ 1.240426] vreg_l17c: invalid input voltage found + +Fixes: 5451781dadf8 ("regulator: core: Only count load for enabled consumers") +Signed-off-by: Andrew Halaney +Reviewed-by: Douglas Anderson +Reviewed-by: Brian Masney +Link: https://lore.kernel.org/r/20220819194336.382740-1-ahalaney@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 1e54a833f2cf0..a9daaf4d5aaab 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -2732,13 +2732,18 @@ static int _regulator_do_enable(struct regulator_dev *rdev) + */ + static int _regulator_handle_consumer_enable(struct regulator *regulator) + { ++ int ret; + struct regulator_dev *rdev = regulator->rdev; + + lockdep_assert_held_once(&rdev->mutex.base); + + regulator->enable_count++; +- if (regulator->uA_load && regulator->enable_count == 1) +- return drms_uA_update(rdev); ++ if (regulator->uA_load && regulator->enable_count == 1) { ++ ret = drms_uA_update(rdev); ++ if (ret) ++ regulator->enable_count--; ++ return ret; ++ } + + return 0; + } +-- +2.35.1 + diff --git a/queue-5.19/revert-net-phy-meson-gxl-improve-link-up-behavior.patch b/queue-5.19/revert-net-phy-meson-gxl-improve-link-up-behavior.patch new file mode 100644 index 00000000000..5c21d044f26 --- /dev/null +++ b/queue-5.19/revert-net-phy-meson-gxl-improve-link-up-behavior.patch @@ -0,0 +1,47 @@ +From 0071998c0678efb302f95c4c5503b33f8f7cb00f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Aug 2022 21:20:49 +0200 +Subject: Revert "net: phy: meson-gxl: improve link-up behavior" + +From: Heiner Kallweit + +[ Upstream commit 7fdc77665f3d45c9da7c6edd4beadee9790f43aa ] + +This reverts commit 2c87c6f9fbddc5b84d67b2fa3f432fcac6d99d93. +Meanwhile it turned out that the following commit is the proper +workaround for the issue that 2c87c6f9fbdd tries to address. +a3a57bf07de2 ("net: stmmac: work around sporadic tx issue on link-up") +It's nor clear why the to be reverted commit helped for one user, +for others it didn't make a difference. + +Fixes: 2c87c6f9fbdd ("net: phy: meson-gxl: improve link-up behavior") +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/8deeeddc-6b71-129b-1918-495a12dc11e3@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/meson-gxl.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/drivers/net/phy/meson-gxl.c b/drivers/net/phy/meson-gxl.c +index 73f7962a37d33..c49062ad72c6c 100644 +--- a/drivers/net/phy/meson-gxl.c ++++ b/drivers/net/phy/meson-gxl.c +@@ -243,13 +243,7 @@ static irqreturn_t meson_gxl_handle_interrupt(struct phy_device *phydev) + irq_status == INTSRC_ENERGY_DETECT) + return IRQ_HANDLED; + +- /* Give PHY some time before MAC starts sending data. This works +- * around an issue where network doesn't come up properly. +- */ +- if (!(irq_status & INTSRC_LINK_DOWN)) +- phy_queue_state_machine(phydev, msecs_to_jiffies(100)); +- else +- phy_trigger_machine(phydev); ++ phy_trigger_machine(phydev); + + return IRQ_HANDLED; + } +-- +2.35.1 + diff --git a/queue-5.19/revert-soc-imx-imx8m-blk-ctrl-set-power-device-name.patch b/queue-5.19/revert-soc-imx-imx8m-blk-ctrl-set-power-device-name.patch new file mode 100644 index 00000000000..42730bc45d4 --- /dev/null +++ b/queue-5.19/revert-soc-imx-imx8m-blk-ctrl-set-power-device-name.patch @@ -0,0 +1,38 @@ +From 3a9a252e6aabc362579d3d1441738206bfaa50b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 11:08:53 +0200 +Subject: Revert "soc: imx: imx8m-blk-ctrl: set power device name" + +From: Marco Felsch + +[ Upstream commit b64b46fbaa1da626324f304bcb5fe0662f28b6ce ] + +This reverts commit 8239d67f59cf522dd4f7135392a2f9a3a25f9cff. + +This change confuses the sysfs cleanup path since the rename is done +after the device registration. + +Fixes: 8239d67f59cf ("soc: imx: imx8m-blk-ctrl: set power device name") +Signed-off-by: Marco Felsch +Reviewed-by: Lucas Stach +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/soc/imx/imx8m-blk-ctrl.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/soc/imx/imx8m-blk-ctrl.c b/drivers/soc/imx/imx8m-blk-ctrl.c +index 7ebc28709e945..2782a7e0a8719 100644 +--- a/drivers/soc/imx/imx8m-blk-ctrl.c ++++ b/drivers/soc/imx/imx8m-blk-ctrl.c +@@ -242,7 +242,6 @@ static int imx8m_blk_ctrl_probe(struct platform_device *pdev) + ret = PTR_ERR(domain->power_dev); + goto cleanup_pds; + } +- dev_set_name(domain->power_dev, "%s", data->name); + + domain->genpd.name = data->name; + domain->genpd.power_on = imx8m_blk_ctrl_power_on; +-- +2.35.1 + diff --git a/queue-5.19/riscv-dts-microchip-use-an-mpfs-specific-l2-compatib.patch b/queue-5.19/riscv-dts-microchip-use-an-mpfs-specific-l2-compatib.patch new file mode 100644 index 00000000000..32acfbc4970 --- /dev/null +++ b/queue-5.19/riscv-dts-microchip-use-an-mpfs-specific-l2-compatib.patch @@ -0,0 +1,41 @@ +From f4b5f7177f5082e13be714ed6804595284a3623b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Aug 2022 19:04:18 +0100 +Subject: riscv: dts: microchip: use an mpfs specific l2 compatible + +From: Conor Dooley + +[ Upstream commit 0dec364ffeb6149aae572ded1e34d4b444c23be6 ] + +PolarFire SoC does not have the same l2 cache controller as the fu540, +featuring an extra interrupt. Appease the devicetree checker overlords +by adding a PolarFire SoC specific compatible to fix the below sort of +warnings: + +mpfs-polarberry.dtb: cache-controller@2010000: interrupts: [[1], [3], [4], [2]] is too long + +Fixes: 0fa6107eca41 ("RISC-V: Initial DTS for Microchip ICICLE board") +Fixes: 34fc9cc3aebe ("riscv: dts: microchip: correct L2 cache interrupts") +Reviewed-by: Heinrich Schuchardt +Signed-off-by: Conor Dooley +Signed-off-by: Sasha Levin +--- + arch/riscv/boot/dts/microchip/mpfs.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/riscv/boot/dts/microchip/mpfs.dtsi b/arch/riscv/boot/dts/microchip/mpfs.dtsi +index 9f5bce1488d93..9bf37ef379509 100644 +--- a/arch/riscv/boot/dts/microchip/mpfs.dtsi ++++ b/arch/riscv/boot/dts/microchip/mpfs.dtsi +@@ -161,7 +161,7 @@ + ranges; + + cctrllr: cache-controller@2010000 { +- compatible = "sifive,fu540-c000-ccache", "cache"; ++ compatible = "microchip,mpfs-ccache", "sifive,fu540-c000-ccache", "cache"; + reg = <0x0 0x2010000 0x0 0x1000>; + cache-block-size = <64>; + cache-level = <2>; +-- +2.35.1 + diff --git a/queue-5.19/rxrpc-fix-an-insufficiently-large-sglist-in-rxkad_ve.patch b/queue-5.19/rxrpc-fix-an-insufficiently-large-sglist-in-rxkad_ve.patch new file mode 100644 index 00000000000..b80bf551720 --- /dev/null +++ b/queue-5.19/rxrpc-fix-an-insufficiently-large-sglist-in-rxkad_ve.patch @@ -0,0 +1,58 @@ +From 85b524ccf0f4ce311abe37fbc63439ae581f1d9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 22:39:28 +0100 +Subject: rxrpc: Fix an insufficiently large sglist in rxkad_verify_packet_2() + +From: David Howells + +[ Upstream commit 0d40f728e28393a8817d1fcae923dfa3409e488c ] + +rxkad_verify_packet_2() has a small stack-allocated sglist of 4 elements, +but if that isn't sufficient for the number of fragments in the socket +buffer, we try to allocate an sglist large enough to hold all the +fragments. + +However, for large packets with a lot of fragments, this isn't sufficient +and we need at least one additional fragment. + +The problem manifests as skb_to_sgvec() returning -EMSGSIZE and this then +getting returned by userspace. Most of the time, this isn't a problem as +rxrpc sets a limit of 5692, big enough for 4 jumbo subpackets to be glued +together; occasionally, however, the server will ignore the reported limit +and give a packet that's a lot bigger - say 19852 bytes with ->nr_frags +being 7. skb_to_sgvec() then tries to return a "zeroth" fragment that +seems to occur before the fragments counted by ->nr_frags and we hit the +end of the sglist too early. + +Note that __skb_to_sgvec() also has an skb_walk_frags() loop that is +recursive up to 24 deep. I'm not sure if I need to take account of that +too - or if there's an easy way of counting those frags too. + +Fix this by counting an extra frag and allocating a larger sglist based on +that. + +Fixes: d0d5c0cd1e71 ("rxrpc: Use skb_unshare() rather than skb_cow_data()") +Reported-by: Marc Dionne +Signed-off-by: David Howells +cc: linux-afs@lists.infradead.org +Signed-off-by: Sasha Levin +--- + net/rxrpc/rxkad.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c +index 08aab5c01437d..db47844f4ac99 100644 +--- a/net/rxrpc/rxkad.c ++++ b/net/rxrpc/rxkad.c +@@ -540,7 +540,7 @@ static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb, + * directly into the target buffer. + */ + sg = _sg; +- nsg = skb_shinfo(skb)->nr_frags; ++ nsg = skb_shinfo(skb)->nr_frags + 1; + if (nsg <= 4) { + nsg = 4; + } else { +-- +2.35.1 + diff --git a/queue-5.19/rxrpc-fix-icmp-icmp6-error-handling.patch b/queue-5.19/rxrpc-fix-icmp-icmp6-error-handling.patch new file mode 100644 index 00000000000..111c265afbd --- /dev/null +++ b/queue-5.19/rxrpc-fix-icmp-icmp6-error-handling.patch @@ -0,0 +1,502 @@ +From 205ea9158daeb55f243c94670b2023b9a8ddabbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 15:39:28 +0100 +Subject: rxrpc: Fix ICMP/ICMP6 error handling + +From: David Howells + +[ Upstream commit ac56a0b48da86fd1b4389632fb7c4c8a5d86eefa ] + +Because rxrpc pretends to be a tunnel on top of a UDP/UDP6 socket, allowing +it to siphon off UDP packets early in the handling of received UDP packets +thereby avoiding the packet going through the UDP receive queue, it doesn't +get ICMP packets through the UDP ->sk_error_report() callback. In fact, it +doesn't appear that there's any usable option for getting hold of ICMP +packets. + +Fix this by adding a new UDP encap hook to distribute error messages for +UDP tunnels. If the hook is set, then the tunnel driver will be able to +see ICMP packets. The hook provides the offset into the packet of the UDP +header of the original packet that caused the notification. + +An alternative would be to call the ->error_handler() hook - but that +requires that the skbuff be cloned (as ip_icmp_error() or ipv6_cmp_error() +do, though isn't really necessary or desirable in rxrpc's case is we want +to parse them there and then, not queue them). + +Changes +======= +ver #3) + - Fixed an uninitialised variable. + +ver #2) + - Fixed some missing CONFIG_AF_RXRPC_IPV6 conditionals. + +Fixes: 5271953cad31 ("rxrpc: Use the UDP encap_rcv hook") +Signed-off-by: David Howells +Signed-off-by: Sasha Levin +--- + include/linux/udp.h | 1 + + include/net/udp_tunnel.h | 4 + + net/ipv4/udp.c | 2 + + net/ipv4/udp_tunnel_core.c | 1 + + net/ipv6/udp.c | 5 +- + net/rxrpc/ar-internal.h | 1 + + net/rxrpc/local_object.c | 1 + + net/rxrpc/peer_event.c | 293 ++++++++++++++++++++++++++++++++----- + 8 files changed, 270 insertions(+), 38 deletions(-) + +diff --git a/include/linux/udp.h b/include/linux/udp.h +index 254a2654400f8..e96da4157d04d 100644 +--- a/include/linux/udp.h ++++ b/include/linux/udp.h +@@ -70,6 +70,7 @@ struct udp_sock { + * For encapsulation sockets. + */ + int (*encap_rcv)(struct sock *sk, struct sk_buff *skb); ++ void (*encap_err_rcv)(struct sock *sk, struct sk_buff *skb, unsigned int udp_offset); + int (*encap_err_lookup)(struct sock *sk, struct sk_buff *skb); + void (*encap_destroy)(struct sock *sk); + +diff --git a/include/net/udp_tunnel.h b/include/net/udp_tunnel.h +index afc7ce713657b..72394f441dad8 100644 +--- a/include/net/udp_tunnel.h ++++ b/include/net/udp_tunnel.h +@@ -67,6 +67,9 @@ static inline int udp_sock_create(struct net *net, + typedef int (*udp_tunnel_encap_rcv_t)(struct sock *sk, struct sk_buff *skb); + typedef int (*udp_tunnel_encap_err_lookup_t)(struct sock *sk, + struct sk_buff *skb); ++typedef void (*udp_tunnel_encap_err_rcv_t)(struct sock *sk, ++ struct sk_buff *skb, ++ unsigned int udp_offset); + typedef void (*udp_tunnel_encap_destroy_t)(struct sock *sk); + typedef struct sk_buff *(*udp_tunnel_gro_receive_t)(struct sock *sk, + struct list_head *head, +@@ -80,6 +83,7 @@ struct udp_tunnel_sock_cfg { + __u8 encap_type; + udp_tunnel_encap_rcv_t encap_rcv; + udp_tunnel_encap_err_lookup_t encap_err_lookup; ++ udp_tunnel_encap_err_rcv_t encap_err_rcv; + udp_tunnel_encap_destroy_t encap_destroy; + udp_tunnel_gro_receive_t gro_receive; + udp_tunnel_gro_complete_t gro_complete; +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index aa9f2ec3dc468..01e1d36bdf135 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -781,6 +781,8 @@ int __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable) + */ + if (tunnel) { + /* ...not for tunnels though: we don't have a sending socket */ ++ if (udp_sk(sk)->encap_err_rcv) ++ udp_sk(sk)->encap_err_rcv(sk, skb, iph->ihl << 2); + goto out; + } + if (!inet->recverr) { +diff --git a/net/ipv4/udp_tunnel_core.c b/net/ipv4/udp_tunnel_core.c +index 8efaf8c3fe2a9..8242c8947340e 100644 +--- a/net/ipv4/udp_tunnel_core.c ++++ b/net/ipv4/udp_tunnel_core.c +@@ -72,6 +72,7 @@ void setup_udp_tunnel_sock(struct net *net, struct socket *sock, + + udp_sk(sk)->encap_type = cfg->encap_type; + udp_sk(sk)->encap_rcv = cfg->encap_rcv; ++ udp_sk(sk)->encap_err_rcv = cfg->encap_err_rcv; + udp_sk(sk)->encap_err_lookup = cfg->encap_err_lookup; + udp_sk(sk)->encap_destroy = cfg->encap_destroy; + udp_sk(sk)->gro_receive = cfg->gro_receive; +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index e2f2e087a7531..40074bc7274ea 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -616,8 +616,11 @@ int __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt, + } + + /* Tunnels don't have an application socket: don't pass errors back */ +- if (tunnel) ++ if (tunnel) { ++ if (udp_sk(sk)->encap_err_rcv) ++ udp_sk(sk)->encap_err_rcv(sk, skb, offset); + goto out; ++ } + + if (!np->recverr) { + if (!harderr || sk->sk_state != TCP_ESTABLISHED) +diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h +index 571436064cd6f..62c70709d7980 100644 +--- a/net/rxrpc/ar-internal.h ++++ b/net/rxrpc/ar-internal.h +@@ -982,6 +982,7 @@ void rxrpc_send_keepalive(struct rxrpc_peer *); + /* + * peer_event.c + */ ++void rxrpc_encap_err_rcv(struct sock *sk, struct sk_buff *skb, unsigned int udp_offset); + void rxrpc_error_report(struct sock *); + void rxrpc_peer_keepalive_worker(struct work_struct *); + +diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c +index 96ecb7356c0fe..79bb02eb67b2b 100644 +--- a/net/rxrpc/local_object.c ++++ b/net/rxrpc/local_object.c +@@ -137,6 +137,7 @@ static int rxrpc_open_socket(struct rxrpc_local *local, struct net *net) + + tuncfg.encap_type = UDP_ENCAP_RXRPC; + tuncfg.encap_rcv = rxrpc_input_packet; ++ tuncfg.encap_err_rcv = rxrpc_encap_err_rcv; + tuncfg.sk_user_data = local; + setup_udp_tunnel_sock(net, local->socket, &tuncfg); + +diff --git a/net/rxrpc/peer_event.c b/net/rxrpc/peer_event.c +index be032850ae8ca..32561e9567fe3 100644 +--- a/net/rxrpc/peer_event.c ++++ b/net/rxrpc/peer_event.c +@@ -16,22 +16,105 @@ + #include + #include + #include ++#include + #include "ar-internal.h" + ++static void rxrpc_adjust_mtu(struct rxrpc_peer *, unsigned int); + static void rxrpc_store_error(struct rxrpc_peer *, struct sock_exterr_skb *); + static void rxrpc_distribute_error(struct rxrpc_peer *, int, + enum rxrpc_call_completion); + + /* +- * Find the peer associated with an ICMP packet. ++ * Find the peer associated with an ICMPv4 packet. + */ + static struct rxrpc_peer *rxrpc_lookup_peer_icmp_rcu(struct rxrpc_local *local, +- const struct sk_buff *skb, ++ struct sk_buff *skb, ++ unsigned int udp_offset, ++ unsigned int *info, + struct sockaddr_rxrpc *srx) + { +- struct sock_exterr_skb *serr = SKB_EXT_ERR(skb); ++ struct iphdr *ip, *ip0 = ip_hdr(skb); ++ struct icmphdr *icmp = icmp_hdr(skb); ++ struct udphdr *udp = (struct udphdr *)(skb->data + udp_offset); + +- _enter(""); ++ _enter("%u,%u,%u", ip0->protocol, icmp->type, icmp->code); ++ ++ switch (icmp->type) { ++ case ICMP_DEST_UNREACH: ++ *info = ntohs(icmp->un.frag.mtu); ++ fallthrough; ++ case ICMP_TIME_EXCEEDED: ++ case ICMP_PARAMETERPROB: ++ ip = (struct iphdr *)((void *)icmp + 8); ++ break; ++ default: ++ return NULL; ++ } ++ ++ memset(srx, 0, sizeof(*srx)); ++ srx->transport_type = local->srx.transport_type; ++ srx->transport_len = local->srx.transport_len; ++ srx->transport.family = local->srx.transport.family; ++ ++ /* Can we see an ICMP4 packet on an ICMP6 listening socket? and vice ++ * versa? ++ */ ++ switch (srx->transport.family) { ++ case AF_INET: ++ srx->transport_len = sizeof(srx->transport.sin); ++ srx->transport.family = AF_INET; ++ srx->transport.sin.sin_port = udp->dest; ++ memcpy(&srx->transport.sin.sin_addr, &ip->daddr, ++ sizeof(struct in_addr)); ++ break; ++ ++#ifdef CONFIG_AF_RXRPC_IPV6 ++ case AF_INET6: ++ srx->transport_len = sizeof(srx->transport.sin); ++ srx->transport.family = AF_INET; ++ srx->transport.sin.sin_port = udp->dest; ++ memcpy(&srx->transport.sin.sin_addr, &ip->daddr, ++ sizeof(struct in_addr)); ++ break; ++#endif ++ ++ default: ++ WARN_ON_ONCE(1); ++ return NULL; ++ } ++ ++ _net("ICMP {%pISp}", &srx->transport); ++ return rxrpc_lookup_peer_rcu(local, srx); ++} ++ ++#ifdef CONFIG_AF_RXRPC_IPV6 ++/* ++ * Find the peer associated with an ICMPv6 packet. ++ */ ++static struct rxrpc_peer *rxrpc_lookup_peer_icmp6_rcu(struct rxrpc_local *local, ++ struct sk_buff *skb, ++ unsigned int udp_offset, ++ unsigned int *info, ++ struct sockaddr_rxrpc *srx) ++{ ++ struct icmp6hdr *icmp = icmp6_hdr(skb); ++ struct ipv6hdr *ip, *ip0 = ipv6_hdr(skb); ++ struct udphdr *udp = (struct udphdr *)(skb->data + udp_offset); ++ ++ _enter("%u,%u,%u", ip0->nexthdr, icmp->icmp6_type, icmp->icmp6_code); ++ ++ switch (icmp->icmp6_type) { ++ case ICMPV6_DEST_UNREACH: ++ *info = ntohl(icmp->icmp6_mtu); ++ fallthrough; ++ case ICMPV6_PKT_TOOBIG: ++ case ICMPV6_TIME_EXCEED: ++ case ICMPV6_PARAMPROB: ++ ip = (struct ipv6hdr *)((void *)icmp + 8); ++ break; ++ default: ++ return NULL; ++ } + + memset(srx, 0, sizeof(*srx)); + srx->transport_type = local->srx.transport_type; +@@ -41,6 +124,165 @@ static struct rxrpc_peer *rxrpc_lookup_peer_icmp_rcu(struct rxrpc_local *local, + /* Can we see an ICMP4 packet on an ICMP6 listening socket? and vice + * versa? + */ ++ switch (srx->transport.family) { ++ case AF_INET: ++ _net("Rx ICMP6 on v4 sock"); ++ srx->transport_len = sizeof(srx->transport.sin); ++ srx->transport.family = AF_INET; ++ srx->transport.sin.sin_port = udp->dest; ++ memcpy(&srx->transport.sin.sin_addr, ++ &ip->daddr.s6_addr32[3], sizeof(struct in_addr)); ++ break; ++ case AF_INET6: ++ _net("Rx ICMP6"); ++ srx->transport.sin.sin_port = udp->dest; ++ memcpy(&srx->transport.sin6.sin6_addr, &ip->daddr, ++ sizeof(struct in6_addr)); ++ break; ++ default: ++ WARN_ON_ONCE(1); ++ return NULL; ++ } ++ ++ _net("ICMP {%pISp}", &srx->transport); ++ return rxrpc_lookup_peer_rcu(local, srx); ++} ++#endif /* CONFIG_AF_RXRPC_IPV6 */ ++ ++/* ++ * Handle an error received on the local endpoint as a tunnel. ++ */ ++void rxrpc_encap_err_rcv(struct sock *sk, struct sk_buff *skb, ++ unsigned int udp_offset) ++{ ++ struct sock_extended_err ee; ++ struct sockaddr_rxrpc srx; ++ struct rxrpc_local *local; ++ struct rxrpc_peer *peer; ++ unsigned int info = 0; ++ int err; ++ u8 version = ip_hdr(skb)->version; ++ u8 type = icmp_hdr(skb)->type; ++ u8 code = icmp_hdr(skb)->code; ++ ++ rcu_read_lock(); ++ local = rcu_dereference_sk_user_data(sk); ++ if (unlikely(!local)) { ++ rcu_read_unlock(); ++ return; ++ } ++ ++ rxrpc_new_skb(skb, rxrpc_skb_received); ++ ++ switch (ip_hdr(skb)->version) { ++ case IPVERSION: ++ peer = rxrpc_lookup_peer_icmp_rcu(local, skb, udp_offset, ++ &info, &srx); ++ break; ++#ifdef CONFIG_AF_RXRPC_IPV6 ++ case 6: ++ peer = rxrpc_lookup_peer_icmp6_rcu(local, skb, udp_offset, ++ &info, &srx); ++ break; ++#endif ++ default: ++ rcu_read_unlock(); ++ return; ++ } ++ ++ if (peer && !rxrpc_get_peer_maybe(peer)) ++ peer = NULL; ++ if (!peer) { ++ rcu_read_unlock(); ++ return; ++ } ++ ++ memset(&ee, 0, sizeof(ee)); ++ ++ switch (version) { ++ case IPVERSION: ++ switch (type) { ++ case ICMP_DEST_UNREACH: ++ switch (code) { ++ case ICMP_FRAG_NEEDED: ++ rxrpc_adjust_mtu(peer, info); ++ rcu_read_unlock(); ++ rxrpc_put_peer(peer); ++ return; ++ default: ++ break; ++ } ++ ++ err = EHOSTUNREACH; ++ if (code <= NR_ICMP_UNREACH) { ++ /* Might want to do something different with ++ * non-fatal errors ++ */ ++ //harderr = icmp_err_convert[code].fatal; ++ err = icmp_err_convert[code].errno; ++ } ++ break; ++ ++ case ICMP_TIME_EXCEEDED: ++ err = EHOSTUNREACH; ++ break; ++ default: ++ err = EPROTO; ++ break; ++ } ++ ++ ee.ee_origin = SO_EE_ORIGIN_ICMP; ++ ee.ee_type = type; ++ ee.ee_code = code; ++ ee.ee_errno = err; ++ break; ++ ++#ifdef CONFIG_AF_RXRPC_IPV6 ++ case 6: ++ switch (type) { ++ case ICMPV6_PKT_TOOBIG: ++ rxrpc_adjust_mtu(peer, info); ++ rcu_read_unlock(); ++ rxrpc_put_peer(peer); ++ return; ++ } ++ ++ icmpv6_err_convert(type, code, &err); ++ ++ if (err == EACCES) ++ err = EHOSTUNREACH; ++ ++ ee.ee_origin = SO_EE_ORIGIN_ICMP6; ++ ee.ee_type = type; ++ ee.ee_code = code; ++ ee.ee_errno = err; ++ break; ++#endif ++ } ++ ++ trace_rxrpc_rx_icmp(peer, &ee, &srx); ++ ++ rxrpc_distribute_error(peer, err, RXRPC_CALL_NETWORK_ERROR); ++ rcu_read_unlock(); ++ rxrpc_put_peer(peer); ++} ++ ++/* ++ * Find the peer associated with a local error. ++ */ ++static struct rxrpc_peer *rxrpc_lookup_peer_local_rcu(struct rxrpc_local *local, ++ const struct sk_buff *skb, ++ struct sockaddr_rxrpc *srx) ++{ ++ struct sock_exterr_skb *serr = SKB_EXT_ERR(skb); ++ ++ _enter(""); ++ ++ memset(srx, 0, sizeof(*srx)); ++ srx->transport_type = local->srx.transport_type; ++ srx->transport_len = local->srx.transport_len; ++ srx->transport.family = local->srx.transport.family; ++ + switch (srx->transport.family) { + case AF_INET: + srx->transport_len = sizeof(srx->transport.sin); +@@ -104,10 +346,8 @@ static struct rxrpc_peer *rxrpc_lookup_peer_icmp_rcu(struct rxrpc_local *local, + /* + * Handle an MTU/fragmentation problem. + */ +-static void rxrpc_adjust_mtu(struct rxrpc_peer *peer, struct sock_exterr_skb *serr) ++static void rxrpc_adjust_mtu(struct rxrpc_peer *peer, unsigned int mtu) + { +- u32 mtu = serr->ee.ee_info; +- + _net("Rx ICMP Fragmentation Needed (%d)", mtu); + + /* wind down the local interface MTU */ +@@ -148,7 +388,7 @@ void rxrpc_error_report(struct sock *sk) + struct sock_exterr_skb *serr; + struct sockaddr_rxrpc srx; + struct rxrpc_local *local; +- struct rxrpc_peer *peer; ++ struct rxrpc_peer *peer = NULL; + struct sk_buff *skb; + + rcu_read_lock(); +@@ -172,41 +412,20 @@ void rxrpc_error_report(struct sock *sk) + } + rxrpc_new_skb(skb, rxrpc_skb_received); + serr = SKB_EXT_ERR(skb); +- if (!skb->len && serr->ee.ee_origin == SO_EE_ORIGIN_TIMESTAMPING) { +- _leave("UDP empty message"); +- rcu_read_unlock(); +- rxrpc_free_skb(skb, rxrpc_skb_freed); +- return; +- } + +- peer = rxrpc_lookup_peer_icmp_rcu(local, skb, &srx); +- if (peer && !rxrpc_get_peer_maybe(peer)) +- peer = NULL; +- if (!peer) { +- rcu_read_unlock(); +- rxrpc_free_skb(skb, rxrpc_skb_freed); +- _leave(" [no peer]"); +- return; +- } +- +- trace_rxrpc_rx_icmp(peer, &serr->ee, &srx); +- +- if ((serr->ee.ee_origin == SO_EE_ORIGIN_ICMP && +- serr->ee.ee_type == ICMP_DEST_UNREACH && +- serr->ee.ee_code == ICMP_FRAG_NEEDED)) { +- rxrpc_adjust_mtu(peer, serr); +- rcu_read_unlock(); +- rxrpc_free_skb(skb, rxrpc_skb_freed); +- rxrpc_put_peer(peer); +- _leave(" [MTU update]"); +- return; ++ if (serr->ee.ee_origin == SO_EE_ORIGIN_LOCAL) { ++ peer = rxrpc_lookup_peer_local_rcu(local, skb, &srx); ++ if (peer && !rxrpc_get_peer_maybe(peer)) ++ peer = NULL; ++ if (peer) { ++ trace_rxrpc_rx_icmp(peer, &serr->ee, &srx); ++ rxrpc_store_error(peer, serr); ++ } + } + +- rxrpc_store_error(peer, serr); + rcu_read_unlock(); + rxrpc_free_skb(skb, rxrpc_skb_freed); + rxrpc_put_peer(peer); +- + _leave(""); + } + +-- +2.35.1 + diff --git a/queue-5.19/sch_sfb-also-store-skb-len-before-calling-child-enqu.patch b/queue-5.19/sch_sfb-also-store-skb-len-before-calling-child-enqu.patch new file mode 100644 index 00000000000..90f961e7654 --- /dev/null +++ b/queue-5.19/sch_sfb-also-store-skb-len-before-calling-child-enqu.patch @@ -0,0 +1,52 @@ +From 0f8f8c4fe670499ca3d33fd55757d0eea49be1e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Sep 2022 21:21:36 +0200 +Subject: sch_sfb: Also store skb len before calling child enqueue +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit 2f09707d0c972120bf794cfe0f0c67e2c2ddb252 ] + +Cong Wang noticed that the previous fix for sch_sfb accessing the queued +skb after enqueueing it to a child qdisc was incomplete: the SFB enqueue +function was also calling qdisc_qstats_backlog_inc() after enqueue, which +reads the pkt len from the skb cb field. Fix this by also storing the skb +len, and using the stored value to increment the backlog after enqueueing. + +Fixes: 9efd23297cca ("sch_sfb: Don't assume the skb is still around after enqueueing to child") +Signed-off-by: Toke Høiland-Jørgensen +Acked-by: Cong Wang +Link: https://lore.kernel.org/r/20220905192137.965549-1-toke@toke.dk +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/sched/sch_sfb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c +index 0d761f454ae8b..2829455211f8c 100644 +--- a/net/sched/sch_sfb.c ++++ b/net/sched/sch_sfb.c +@@ -281,6 +281,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch, + { + + struct sfb_sched_data *q = qdisc_priv(sch); ++ unsigned int len = qdisc_pkt_len(skb); + struct Qdisc *child = q->qdisc; + struct tcf_proto *fl; + struct sfb_skb_cb cb; +@@ -403,7 +404,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch, + memcpy(&cb, sfb_skb_cb(skb), sizeof(cb)); + ret = qdisc_enqueue(skb, child, to_free); + if (likely(ret == NET_XMIT_SUCCESS)) { +- qdisc_qstats_backlog_inc(sch, skb); ++ sch->qstats.backlog += len; + sch->q.qlen++; + increment_qlen(&cb, q); + } else if (net_xmit_drop_count(ret)) { +-- +2.35.1 + diff --git a/queue-5.19/sch_sfb-don-t-assume-the-skb-is-still-around-after-e.patch b/queue-5.19/sch_sfb-don-t-assume-the-skb-is-still-around-after-e.patch new file mode 100644 index 00000000000..5f32d51e687 --- /dev/null +++ b/queue-5.19/sch_sfb-don-t-assume-the-skb-is-still-around-after-e.patch @@ -0,0 +1,82 @@ +From d21cfbc62e07cec1d9c5dcf1a2a868fb331c49e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Aug 2022 23:52:18 +0200 +Subject: sch_sfb: Don't assume the skb is still around after enqueueing to + child +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit 9efd23297cca530bb35e1848665805d3fcdd7889 ] + +The sch_sfb enqueue() routine assumes the skb is still alive after it has +been enqueued into a child qdisc, using the data in the skb cb field in the +increment_qlen() routine after enqueue. However, the skb may in fact have +been freed, causing a use-after-free in this case. In particular, this +happens if sch_cake is used as a child of sfb, and the GSO splitting mode +of CAKE is enabled (in which case the skb will be split into segments and +the original skb freed). + +Fix this by copying the sfb cb data to the stack before enqueueing the skb, +and using this stack copy in increment_qlen() instead of the skb pointer +itself. + +Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-18231 +Fixes: e13e02a3c68d ("net_sched: SFB flow scheduler") +Signed-off-by: Toke Høiland-Jørgensen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/sch_sfb.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c +index 3d061a13d7ed2..0d761f454ae8b 100644 +--- a/net/sched/sch_sfb.c ++++ b/net/sched/sch_sfb.c +@@ -135,15 +135,15 @@ static void increment_one_qlen(u32 sfbhash, u32 slot, struct sfb_sched_data *q) + } + } + +-static void increment_qlen(const struct sk_buff *skb, struct sfb_sched_data *q) ++static void increment_qlen(const struct sfb_skb_cb *cb, struct sfb_sched_data *q) + { + u32 sfbhash; + +- sfbhash = sfb_hash(skb, 0); ++ sfbhash = cb->hashes[0]; + if (sfbhash) + increment_one_qlen(sfbhash, 0, q); + +- sfbhash = sfb_hash(skb, 1); ++ sfbhash = cb->hashes[1]; + if (sfbhash) + increment_one_qlen(sfbhash, 1, q); + } +@@ -283,6 +283,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch, + struct sfb_sched_data *q = qdisc_priv(sch); + struct Qdisc *child = q->qdisc; + struct tcf_proto *fl; ++ struct sfb_skb_cb cb; + int i; + u32 p_min = ~0; + u32 minqlen = ~0; +@@ -399,11 +400,12 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch, + } + + enqueue: ++ memcpy(&cb, sfb_skb_cb(skb), sizeof(cb)); + ret = qdisc_enqueue(skb, child, to_free); + if (likely(ret == NET_XMIT_SUCCESS)) { + qdisc_qstats_backlog_inc(sch, skb); + sch->q.qlen++; +- increment_qlen(skb, q); ++ increment_qlen(&cb, q); + } else if (net_xmit_drop_count(ret)) { + q->stats.childdrop++; + qdisc_qstats_drop(sch); +-- +2.35.1 + diff --git a/queue-5.19/series b/queue-5.19/series index 56d87347be6..5764164a62f 100644 --- a/queue-5.19/series +++ b/queue-5.19/series @@ -61,3 +61,95 @@ cgroup-elide-write-locking-threadgroup_rwsem-when-up.patch cgroup-fix-threadgroup_rwsem-cpus_read_lock-deadlock.patch cifs-remove-useless-parameter-is_fsctl-from-smb2_ioc.patch smb3-missing-inode-locks-in-zero-range.patch +spi-bitbang-fix-lsb-first-rx.patch +asoc-cs42l42-only-report-button-state-if-there-was-a.patch +revert-soc-imx-imx8m-blk-ctrl-set-power-device-name.patch +arm64-dts-imx8mm-verdin-update-can-clock-to-40mhz.patch +arm64-dts-imx8mm-verdin-use-level-interrupt-for-mcp2.patch +asoc-qcom-sm8250-add-missing-module-owner.patch +regmap-spi-reserve-space-for-register-address-paddin.patch +arm64-dts-imx8mp-venice-gw74xx-fix-sai2-pin-settings.patch +arm64-dts-imx8mq-tqma8mq-remove-superfluous-interrup.patch +rdma-rtrs-clt-use-the-right-sg_cnt-after-ib_dma_map_.patch +rdma-rtrs-srv-pass-the-correct-number-of-entries-for.patch +arm-dts-imx6qdl-vicut1.dtsi-fix-node-name-backlight_.patch +arm-dts-imx6qdl-kontron-samx6i-remove-duplicated-nod.patch +arm-dts-imx6qdl-kontron-samx6i-fix-spi-flash-compati.patch +arm64-dts-ls1028a-qds-65bb-don-t-use-in-band-autoneg.patch +soc-imx-gpcv2-assert-reset-before-ungating-clock.patch +arm64-dts-verdin-imx8mm-add-otg2-pd-to-usbphy.patch +arm64-dts-imx8mm-venice-gw7901-fix-port-phy-validati.patch +arm64-dts-freescale-verdin-imx8mm-fix-atmel_mxt_ts-r.patch +arm64-dts-freescale-verdin-imx8mp-fix-atmel_mxt_ts-r.patch +regulator-core-clean-up-on-enable-failure.patch +asoc-sof-kconfig-make-ipc_flood_test-depend-on-snd_s.patch +asoc-sof-kconfig-make-ipc_message_injector-depend-on.patch +tee-fix-compiler-warning-in-tee_shm_register.patch +rdma-irdma-fix-drain-sq-hang-with-no-completion.patch +arm64-dts-renesas-r8a779g0-fix-hscif0-interrupt-numb.patch +rdma-cma-fix-arguments-order-in-net-device-validatio.patch +soc-brcmstb-pm-arm-fix-refcount-leak-and-__iomem-lea.patch +rdma-hns-fix-supported-page-size.patch +rdma-hns-fix-wrong-fixed-value-of-qp-rq.wqe_shift.patch +rdma-hns-remove-the-num_qpc_timer-variable.patch +wifi-wilc1000-fix-dma-on-stack-objects.patch +arm-at91-pm-fix-self-refresh-for-sama7g5.patch +arm-at91-pm-fix-ddr-recalibration-when-resuming-from.patch +arm-dts-at91-sama5d27_wlsom1-specify-proper-regulato.patch +arm-dts-at91-sama5d2_icp-specify-proper-regulator-ou.patch +arm-dts-at91-sama7g5ek-specify-proper-regulator-outp.patch +arm-dts-at91-sama5d27_wlsom1-don-t-keep-ldo2-enabled.patch +arm-dts-at91-sama5d2_icp-don-t-keep-vdd_other-enable.patch +netfilter-br_netfilter-drop-dst-references-before-se.patch +netfilter-nf_tables-clean-up-hook-list-when-offload-.patch +riscv-dts-microchip-use-an-mpfs-specific-l2-compatib.patch +netfilter-nf_conntrack_irc-fix-forged-ip-logic.patch +rdma-srp-set-scmnd-result-only-when-scmnd-is-not-nul.patch +alsa-usb-audio-inform-the-delayed-registration-more-.patch +alsa-usb-audio-register-card-again-for-iface-over-de.patch +rxrpc-fix-icmp-icmp6-error-handling.patch +rxrpc-fix-an-insufficiently-large-sglist-in-rxkad_ve.patch +afs-use-the-operation-issue-time-instead-of-the-repl.patch +kunit-fix-assert_type-for-comparison-macros.patch +revert-net-phy-meson-gxl-improve-link-up-behavior.patch +sch_sfb-don-t-assume-the-skb-is-still-around-after-e.patch +tipc-fix-shift-wrapping-bug-in-map_get.patch +net-introduce-__skb_fill_page_desc_noacc.patch +tcp-tx-zerocopy-should-not-sense-pfmemalloc-status.patch +ice-fix-dma-mappings-leak.patch +ice-use-bitmap_free-instead-of-devm_kfree.patch +i40e-fix-kernel-crash-during-module-removal.patch +iavf-detach-device-during-reset-task.patch +net-fec-use-a-spinlock-to-guard-fep-ptp_clk_on.patch +xen-netback-only-remove-hotplug-status-when-the-vif-.patch +block-don-t-add-partitions-if-gd_suppress_part_scan-.patch +rdma-siw-pass-a-pointer-to-virt_to_page.patch +bonding-use-unspecified-address-if-no-available-link.patch +bonding-add-all-node-mcast-address-when-slave-up.patch +ipv6-sr-fix-out-of-bounds-read-when-setting-hmac-dat.patch +ib-core-fix-a-nested-dead-lock-as-part-of-odp-flow.patch +rdma-mlx5-set-local-port-to-one-when-accessing-count.patch +btrfs-zoned-fix-mounting-with-conventional-zones.patch +erofs-fix-error-return-code-in-erofs_fscache_-meta_-.patch +erofs-fix-pcluster-use-after-free-on-up-platforms.patch +nvme-tcp-fix-uaf-when-detecting-digest-errors.patch +nvme-tcp-fix-regression-that-causes-sporadic-request.patch +tcp-fix-early-etimedout-after-spurious-non-sack-rto.patch +btrfs-fix-the-max-chunk-size-and-stripe-length-calcu.patch +nvmet-fix-mar-and-mor-off-by-one-errors.patch +rdma-irdma-report-the-correct-max-cqes-from-query-de.patch +rdma-irdma-return-error-on-mr-deregister-cqp-failure.patch +rdma-irdma-return-correct-wc-error-for-bind-operatio.patch +rdma-irdma-report-rnr-nak-generation-in-device-caps.patch +net-dsa-felix-disable-cut-through-forwarding-for-fra.patch +net-dsa-felix-access-qsys_tag_config-under-tas_lock-.patch +net-ethernet-mtk_eth_soc-fix-typo-in-__mtk_foe_entry.patch +net-ethernet-mtk_eth_soc-check-max-allowed-hash-in-m.patch +net-smc-fix-possible-access-to-freed-memory-in-link-.patch +io_uring-recycle-kbuf-recycle-on-tw-requeue.patch +net-phy-lan87xx-change-interrupt-src-of-link_up-to-c.patch +sch_sfb-also-store-skb-len-before-calling-child-enqu.patch +libperf-evlist-fix-per-thread-mmaps-for-multi-thread.patch +perf-dlfilter-dlfilter-show-cycles-fix-types-for-pri.patch +perf-script-fix-cannot-print-iregs-field-for-hybrid-.patch +perf-record-fix-synthesis-failure-warnings.patch diff --git a/queue-5.19/soc-brcmstb-pm-arm-fix-refcount-leak-and-__iomem-lea.patch b/queue-5.19/soc-brcmstb-pm-arm-fix-refcount-leak-and-__iomem-lea.patch new file mode 100644 index 00000000000..21dfdf0175e --- /dev/null +++ b/queue-5.19/soc-brcmstb-pm-arm-fix-refcount-leak-and-__iomem-lea.patch @@ -0,0 +1,163 @@ +From f79af9fad59906f3cbbd848058908903e9f1bd34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jul 2022 09:56:20 +0800 +Subject: soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs + +From: Liang He + +[ Upstream commit 1085f5080647f0c9f357c270a537869191f7f2a1 ] + +In brcmstb_pm_probe(), there are two kinds of leak bugs: + +(1) we need to add of_node_put() when for_each__matching_node() breaks +(2) we need to add iounmap() for each iomap in fail path + +Fixes: 0b741b8234c8 ("soc: bcm: brcmstb: Add support for S2/S3/S5 suspend states (ARM)") +Signed-off-by: Liang He +Link: https://lore.kernel.org/r/20220707015620.306468-1-windhl@126.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + drivers/soc/bcm/brcmstb/pm/pm-arm.c | 50 ++++++++++++++++++++++------- + 1 file changed, 39 insertions(+), 11 deletions(-) + +diff --git a/drivers/soc/bcm/brcmstb/pm/pm-arm.c b/drivers/soc/bcm/brcmstb/pm/pm-arm.c +index 70ad0f3dce283..286f5d57c0cab 100644 +--- a/drivers/soc/bcm/brcmstb/pm/pm-arm.c ++++ b/drivers/soc/bcm/brcmstb/pm/pm-arm.c +@@ -684,13 +684,14 @@ static int brcmstb_pm_probe(struct platform_device *pdev) + const struct of_device_id *of_id = NULL; + struct device_node *dn; + void __iomem *base; +- int ret, i; ++ int ret, i, s; + + /* AON ctrl registers */ + base = brcmstb_ioremap_match(aon_ctrl_dt_ids, 0, NULL); + if (IS_ERR(base)) { + pr_err("error mapping AON_CTRL\n"); +- return PTR_ERR(base); ++ ret = PTR_ERR(base); ++ goto aon_err; + } + ctrl.aon_ctrl_base = base; + +@@ -700,8 +701,10 @@ static int brcmstb_pm_probe(struct platform_device *pdev) + /* Assume standard offset */ + ctrl.aon_sram = ctrl.aon_ctrl_base + + AON_CTRL_SYSTEM_DATA_RAM_OFS; ++ s = 0; + } else { + ctrl.aon_sram = base; ++ s = 1; + } + + writel_relaxed(0, ctrl.aon_sram + AON_REG_PANIC); +@@ -711,7 +714,8 @@ static int brcmstb_pm_probe(struct platform_device *pdev) + (const void **)&ddr_phy_data); + if (IS_ERR(base)) { + pr_err("error mapping DDR PHY\n"); +- return PTR_ERR(base); ++ ret = PTR_ERR(base); ++ goto ddr_phy_err; + } + ctrl.support_warm_boot = ddr_phy_data->supports_warm_boot; + ctrl.pll_status_offset = ddr_phy_data->pll_status_offset; +@@ -731,17 +735,20 @@ static int brcmstb_pm_probe(struct platform_device *pdev) + for_each_matching_node(dn, ddr_shimphy_dt_ids) { + i = ctrl.num_memc; + if (i >= MAX_NUM_MEMC) { ++ of_node_put(dn); + pr_warn("too many MEMCs (max %d)\n", MAX_NUM_MEMC); + break; + } + + base = of_io_request_and_map(dn, 0, dn->full_name); + if (IS_ERR(base)) { ++ of_node_put(dn); + if (!ctrl.support_warm_boot) + break; + + pr_err("error mapping DDR SHIMPHY %d\n", i); +- return PTR_ERR(base); ++ ret = PTR_ERR(base); ++ goto ddr_shimphy_err; + } + ctrl.memcs[i].ddr_shimphy_base = base; + ctrl.num_memc++; +@@ -752,14 +759,18 @@ static int brcmstb_pm_probe(struct platform_device *pdev) + for_each_matching_node(dn, brcmstb_memc_of_match) { + base = of_iomap(dn, 0); + if (!base) { ++ of_node_put(dn); + pr_err("error mapping DDR Sequencer %d\n", i); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto brcmstb_memc_err; + } + + of_id = of_match_node(brcmstb_memc_of_match, dn); + if (!of_id) { + iounmap(base); +- return -EINVAL; ++ of_node_put(dn); ++ ret = -EINVAL; ++ goto brcmstb_memc_err; + } + + ddr_seq_data = of_id->data; +@@ -779,21 +790,24 @@ static int brcmstb_pm_probe(struct platform_device *pdev) + dn = of_find_matching_node(NULL, sram_dt_ids); + if (!dn) { + pr_err("SRAM not found\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto brcmstb_memc_err; + } + + ret = brcmstb_init_sram(dn); + of_node_put(dn); + if (ret) { + pr_err("error setting up SRAM for PM\n"); +- return ret; ++ goto brcmstb_memc_err; + } + + ctrl.pdev = pdev; + + ctrl.s3_params = kmalloc(sizeof(*ctrl.s3_params), GFP_KERNEL); +- if (!ctrl.s3_params) +- return -ENOMEM; ++ if (!ctrl.s3_params) { ++ ret = -ENOMEM; ++ goto s3_params_err; ++ } + ctrl.s3_params_pa = dma_map_single(&pdev->dev, ctrl.s3_params, + sizeof(*ctrl.s3_params), + DMA_TO_DEVICE); +@@ -813,7 +827,21 @@ static int brcmstb_pm_probe(struct platform_device *pdev) + + out: + kfree(ctrl.s3_params); +- ++s3_params_err: ++ iounmap(ctrl.boot_sram); ++brcmstb_memc_err: ++ for (i--; i >= 0; i--) ++ iounmap(ctrl.memcs[i].ddr_ctrl); ++ddr_shimphy_err: ++ for (i = 0; i < ctrl.num_memc; i++) ++ iounmap(ctrl.memcs[i].ddr_shimphy_base); ++ ++ iounmap(ctrl.memcs[0].ddr_phy_base); ++ddr_phy_err: ++ iounmap(ctrl.aon_ctrl_base); ++ if (s) ++ iounmap(ctrl.aon_sram); ++aon_err: + pr_warn("PM: initialization failed with code %d\n", ret); + + return ret; +-- +2.35.1 + diff --git a/queue-5.19/soc-imx-gpcv2-assert-reset-before-ungating-clock.patch b/queue-5.19/soc-imx-gpcv2-assert-reset-before-ungating-clock.patch new file mode 100644 index 00000000000..326d9c338b4 --- /dev/null +++ b/queue-5.19/soc-imx-gpcv2-assert-reset-before-ungating-clock.patch @@ -0,0 +1,51 @@ +From 80fe5594047a3c72e9cb831abd8dab1f3feaeeb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Aug 2022 19:08:02 +0200 +Subject: soc: imx: gpcv2: Assert reset before ungating clock + +From: Marek Vasut + +[ Upstream commit df88005bd81b80c944d185554e264a4b0f993c37 ] + +In case the power domain clock are ungated before the reset is asserted, +the system might freeze completely. This is likely due to a device is an +undefined state being attached to bus, which sporadically leads to a bus +hang. Assert the reset before the clock are enabled to assure the device +is in defined state before being attached to bus. + +Fixes: fe58c887fb8ca ("soc: imx: gpcv2: add support for optional resets") +Signed-off-by: Marek Vasut +Reviewed-by: Fabio Estevam +Reviewed-by: Lucas Stach +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/soc/imx/gpcv2.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/imx/gpcv2.c b/drivers/soc/imx/gpcv2.c +index 85aa86e1338af..5a3809f6a698f 100644 +--- a/drivers/soc/imx/gpcv2.c ++++ b/drivers/soc/imx/gpcv2.c +@@ -333,6 +333,8 @@ static int imx_pgc_power_up(struct generic_pm_domain *genpd) + } + } + ++ reset_control_assert(domain->reset); ++ + /* Enable reset clocks for all devices in the domain */ + ret = clk_bulk_prepare_enable(domain->num_clks, domain->clks); + if (ret) { +@@ -340,7 +342,8 @@ static int imx_pgc_power_up(struct generic_pm_domain *genpd) + goto out_regulator_disable; + } + +- reset_control_assert(domain->reset); ++ /* delays for reset to propagate */ ++ udelay(5); + + if (domain->bits.pxx) { + /* request the domain to power up */ +-- +2.35.1 + diff --git a/queue-5.19/spi-bitbang-fix-lsb-first-rx.patch b/queue-5.19/spi-bitbang-fix-lsb-first-rx.patch new file mode 100644 index 00000000000..c29ca8b1aea --- /dev/null +++ b/queue-5.19/spi-bitbang-fix-lsb-first-rx.patch @@ -0,0 +1,66 @@ +From b0f8eb5e3460b8ffe9086522ba04a9360a54c94c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Aug 2022 15:58:57 +0100 +Subject: spi: bitbang: Fix lsb-first Rx + +From: Robin Murphy + +[ Upstream commit 46f7ac3d7892e808c9ba01c39da6bb85cda26ecd ] + +Shifting the recieved bit by "bits" inserts it at the top of the +*currently remaining* Tx data, so we end up accumulating the whole +transfer into bit 0 of the output word. Oops. + +For the algorithm to work as intended, we need to remember where the +top of the *original* word was, and shift Rx to there. + +Fixes: 1847e3046c52 ("spi: gpio: Implement LSB First bitbang support") +Signed-off-by: Robin Murphy +Link: https://lore.kernel.org/r/28324d8622da80461cce35a82859b003d6f6c4b0.1659538737.git.robin.murphy@arm.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bitbang-txrx.h | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-bitbang-txrx.h b/drivers/spi/spi-bitbang-txrx.h +index 267342dfa7388..2dcbe166df63e 100644 +--- a/drivers/spi/spi-bitbang-txrx.h ++++ b/drivers/spi/spi-bitbang-txrx.h +@@ -116,6 +116,7 @@ bitbang_txrx_le_cpha0(struct spi_device *spi, + { + /* if (cpol == 0) this is SPI_MODE_0; else this is SPI_MODE_2 */ + ++ u8 rxbit = bits - 1; + u32 oldbit = !(word & 1); + /* clock starts at inactive polarity */ + for (; likely(bits); bits--) { +@@ -135,7 +136,7 @@ bitbang_txrx_le_cpha0(struct spi_device *spi, + /* sample LSB (from slave) on leading edge */ + word >>= 1; + if ((flags & SPI_MASTER_NO_RX) == 0) +- word |= getmiso(spi) << (bits - 1); ++ word |= getmiso(spi) << rxbit; + setsck(spi, cpol); + } + return word; +@@ -148,6 +149,7 @@ bitbang_txrx_le_cpha1(struct spi_device *spi, + { + /* if (cpol == 0) this is SPI_MODE_1; else this is SPI_MODE_3 */ + ++ u8 rxbit = bits - 1; + u32 oldbit = !(word & 1); + /* clock starts at inactive polarity */ + for (; likely(bits); bits--) { +@@ -168,7 +170,7 @@ bitbang_txrx_le_cpha1(struct spi_device *spi, + /* sample LSB (from slave) on trailing edge */ + word >>= 1; + if ((flags & SPI_MASTER_NO_RX) == 0) +- word |= getmiso(spi) << (bits - 1); ++ word |= getmiso(spi) << rxbit; + } + return word; + } +-- +2.35.1 + diff --git a/queue-5.19/tcp-fix-early-etimedout-after-spurious-non-sack-rto.patch b/queue-5.19/tcp-fix-early-etimedout-after-spurious-non-sack-rto.patch new file mode 100644 index 00000000000..6c657475ab0 --- /dev/null +++ b/queue-5.19/tcp-fix-early-etimedout-after-spurious-non-sack-rto.patch @@ -0,0 +1,129 @@ +From c65830f869acf1b5add4b090eedfc07191f05b34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Sep 2022 08:10:23 -0400 +Subject: tcp: fix early ETIMEDOUT after spurious non-SACK RTO + +From: Neal Cardwell + +[ Upstream commit 686dc2db2a0fdc1d34b424ec2c0a735becd8d62b ] + +Fix a bug reported and analyzed by Nagaraj Arankal, where the handling +of a spurious non-SACK RTO could cause a connection to fail to clear +retrans_stamp, causing a later RTO to very prematurely time out the +connection with ETIMEDOUT. + +Here is the buggy scenario, expanding upon Nagaraj Arankal's excellent +report: + +(*1) Send one data packet on a non-SACK connection + +(*2) Because no ACK packet is received, the packet is retransmitted + and we enter CA_Loss; but this retransmission is spurious. + +(*3) The ACK for the original data is received. The transmitted packet + is acknowledged. The TCP timestamp is before the retrans_stamp, + so tcp_may_undo() returns true, and tcp_try_undo_loss() returns + true without changing state to Open (because tcp_is_sack() is + false), and tcp_process_loss() returns without calling + tcp_try_undo_recovery(). Normally after undoing a CA_Loss + episode, tcp_fastretrans_alert() would see that the connection + has returned to CA_Open and fall through and call + tcp_try_to_open(), which would set retrans_stamp to 0. However, + for non-SACK connections we hold the connection in CA_Loss, so do + not fall through to call tcp_try_to_open() and do not set + retrans_stamp to 0. So retrans_stamp is (erroneously) still + non-zero. + + At this point the first "retransmission event" has passed and + been recovered from. Any future retransmission is a completely + new "event". However, retrans_stamp is erroneously still + set. (And we are still in CA_Loss, which is correct.) + +(*4) After 16 minutes (to correspond with tcp_retries2=15), a new data + packet is sent. Note: No data is transmitted between (*3) and + (*4) and we disabled keep alives. + + The socket's timeout SHOULD be calculated from this point in + time, but instead it's calculated from the prior "event" 16 + minutes ago (step (*2)). + +(*5) Because no ACK packet is received, the packet is retransmitted. + +(*6) At the time of the 2nd retransmission, the socket returns + ETIMEDOUT, prematurely, because retrans_stamp is (erroneously) + too far in the past (set at the time of (*2)). + +This commit fixes this bug by ensuring that we reuse in +tcp_try_undo_loss() the same careful logic for non-SACK connections +that we have in tcp_try_undo_recovery(). To avoid duplicating logic, +we factor out that logic into a new +tcp_is_non_sack_preventing_reopen() helper and call that helper from +both undo functions. + +Fixes: da34ac7626b5 ("tcp: only undo on partial ACKs in CA_Loss") +Reported-by: Nagaraj Arankal +Link: https://lore.kernel.org/all/SJ0PR84MB1847BE6C24D274C46A1B9B0EB27A9@SJ0PR84MB1847.NAMPRD84.PROD.OUTLOOK.COM/ +Signed-off-by: Neal Cardwell +Signed-off-by: Yuchung Cheng +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/20220903121023.866900-1-ncardwell.kernel@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 25 ++++++++++++++++++------- + 1 file changed, 18 insertions(+), 7 deletions(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index e5435156e545d..c30696eafc361 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -2514,6 +2514,21 @@ static inline bool tcp_may_undo(const struct tcp_sock *tp) + return tp->undo_marker && (!tp->undo_retrans || tcp_packet_delayed(tp)); + } + ++static bool tcp_is_non_sack_preventing_reopen(struct sock *sk) ++{ ++ struct tcp_sock *tp = tcp_sk(sk); ++ ++ if (tp->snd_una == tp->high_seq && tcp_is_reno(tp)) { ++ /* Hold old state until something *above* high_seq ++ * is ACKed. For Reno it is MUST to prevent false ++ * fast retransmits (RFC2582). SACK TCP is safe. */ ++ if (!tcp_any_retrans_done(sk)) ++ tp->retrans_stamp = 0; ++ return true; ++ } ++ return false; ++} ++ + /* People celebrate: "We love our President!" */ + static bool tcp_try_undo_recovery(struct sock *sk) + { +@@ -2536,14 +2551,8 @@ static bool tcp_try_undo_recovery(struct sock *sk) + } else if (tp->rack.reo_wnd_persist) { + tp->rack.reo_wnd_persist--; + } +- if (tp->snd_una == tp->high_seq && tcp_is_reno(tp)) { +- /* Hold old state until something *above* high_seq +- * is ACKed. For Reno it is MUST to prevent false +- * fast retransmits (RFC2582). SACK TCP is safe. */ +- if (!tcp_any_retrans_done(sk)) +- tp->retrans_stamp = 0; ++ if (tcp_is_non_sack_preventing_reopen(sk)) + return true; +- } + tcp_set_ca_state(sk, TCP_CA_Open); + tp->is_sack_reneg = 0; + return false; +@@ -2579,6 +2588,8 @@ static bool tcp_try_undo_loss(struct sock *sk, bool frto_undo) + NET_INC_STATS(sock_net(sk), + LINUX_MIB_TCPSPURIOUSRTOS); + inet_csk(sk)->icsk_retransmits = 0; ++ if (tcp_is_non_sack_preventing_reopen(sk)) ++ return true; + if (frto_undo || tcp_is_sack(tp)) { + tcp_set_ca_state(sk, TCP_CA_Open); + tp->is_sack_reneg = 0; +-- +2.35.1 + diff --git a/queue-5.19/tcp-tx-zerocopy-should-not-sense-pfmemalloc-status.patch b/queue-5.19/tcp-tx-zerocopy-should-not-sense-pfmemalloc-status.patch new file mode 100644 index 00000000000..a07ce9025e2 --- /dev/null +++ b/queue-5.19/tcp-tx-zerocopy-should-not-sense-pfmemalloc-status.patch @@ -0,0 +1,173 @@ +From b23a1211d9b1fc4546bce8440e00a86ac51e363b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Aug 2022 23:38:09 +0000 +Subject: tcp: TX zerocopy should not sense pfmemalloc status + +From: Eric Dumazet + +[ Upstream commit 3261400639463a853ba2b3be8bd009c2a8089775 ] + +We got a recent syzbot report [1] showing a possible misuse +of pfmemalloc page status in TCP zerocopy paths. + +Indeed, for pages coming from user space or other layers, +using page_is_pfmemalloc() is moot, and possibly could give +false positives. + +There has been attempts to make page_is_pfmemalloc() more robust, +but not using it in the first place in this context is probably better, +removing cpu cycles. + +Note to stable teams : + +You need to backport 84ce071e38a6 ("net: introduce +__skb_fill_page_desc_noacc") as a prereq. + +Race is more probable after commit c07aea3ef4d4 +("mm: add a signature in struct page") because page_is_pfmemalloc() +is now using low order bit from page->lru.next, which can change +more often than page->index. + +Low order bit should never be set for lru.next (when used as an anchor +in LRU list), so KCSAN report is mostly a false positive. + +Backporting to older kernel versions seems not necessary. + +[1] +BUG: KCSAN: data-race in lru_add_fn / tcp_build_frag + +write to 0xffffea0004a1d2c8 of 8 bytes by task 18600 on cpu 0: +__list_add include/linux/list.h:73 [inline] +list_add include/linux/list.h:88 [inline] +lruvec_add_folio include/linux/mm_inline.h:105 [inline] +lru_add_fn+0x440/0x520 mm/swap.c:228 +folio_batch_move_lru+0x1e1/0x2a0 mm/swap.c:246 +folio_batch_add_and_move mm/swap.c:263 [inline] +folio_add_lru+0xf1/0x140 mm/swap.c:490 +filemap_add_folio+0xf8/0x150 mm/filemap.c:948 +__filemap_get_folio+0x510/0x6d0 mm/filemap.c:1981 +pagecache_get_page+0x26/0x190 mm/folio-compat.c:104 +grab_cache_page_write_begin+0x2a/0x30 mm/folio-compat.c:116 +ext4_da_write_begin+0x2dd/0x5f0 fs/ext4/inode.c:2988 +generic_perform_write+0x1d4/0x3f0 mm/filemap.c:3738 +ext4_buffered_write_iter+0x235/0x3e0 fs/ext4/file.c:270 +ext4_file_write_iter+0x2e3/0x1210 +call_write_iter include/linux/fs.h:2187 [inline] +new_sync_write fs/read_write.c:491 [inline] +vfs_write+0x468/0x760 fs/read_write.c:578 +ksys_write+0xe8/0x1a0 fs/read_write.c:631 +__do_sys_write fs/read_write.c:643 [inline] +__se_sys_write fs/read_write.c:640 [inline] +__x64_sys_write+0x3e/0x50 fs/read_write.c:640 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +read to 0xffffea0004a1d2c8 of 8 bytes by task 18611 on cpu 1: +page_is_pfmemalloc include/linux/mm.h:1740 [inline] +__skb_fill_page_desc include/linux/skbuff.h:2422 [inline] +skb_fill_page_desc include/linux/skbuff.h:2443 [inline] +tcp_build_frag+0x613/0xb20 net/ipv4/tcp.c:1018 +do_tcp_sendpages+0x3e8/0xaf0 net/ipv4/tcp.c:1075 +tcp_sendpage_locked net/ipv4/tcp.c:1140 [inline] +tcp_sendpage+0x89/0xb0 net/ipv4/tcp.c:1150 +inet_sendpage+0x7f/0xc0 net/ipv4/af_inet.c:833 +kernel_sendpage+0x184/0x300 net/socket.c:3561 +sock_sendpage+0x5a/0x70 net/socket.c:1054 +pipe_to_sendpage+0x128/0x160 fs/splice.c:361 +splice_from_pipe_feed fs/splice.c:415 [inline] +__splice_from_pipe+0x222/0x4d0 fs/splice.c:559 +splice_from_pipe fs/splice.c:594 [inline] +generic_splice_sendpage+0x89/0xc0 fs/splice.c:743 +do_splice_from fs/splice.c:764 [inline] +direct_splice_actor+0x80/0xa0 fs/splice.c:931 +splice_direct_to_actor+0x305/0x620 fs/splice.c:886 +do_splice_direct+0xfb/0x180 fs/splice.c:974 +do_sendfile+0x3bf/0x910 fs/read_write.c:1249 +__do_sys_sendfile64 fs/read_write.c:1317 [inline] +__se_sys_sendfile64 fs/read_write.c:1303 [inline] +__x64_sys_sendfile64+0x10c/0x150 fs/read_write.c:1303 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +value changed: 0x0000000000000000 -> 0xffffea0004a1d288 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 PID: 18611 Comm: syz-executor.4 Not tainted 6.0.0-rc2-syzkaller-00248-ge022620b5d05-dirty #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 + +Fixes: c07aea3ef4d4 ("mm: add a signature in struct page") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: Shakeel Butt +Reviewed-by: Shakeel Butt +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/skbuff.h | 21 +++++++++++++++++++++ + net/core/datagram.c | 2 +- + net/ipv4/tcp.c | 2 +- + 3 files changed, 23 insertions(+), 2 deletions(-) + +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index b0a1374043f30..63d0a21b63162 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -2587,6 +2587,27 @@ static inline void skb_fill_page_desc(struct sk_buff *skb, int i, + skb_shinfo(skb)->nr_frags = i + 1; + } + ++/** ++ * skb_fill_page_desc_noacc - initialise a paged fragment in an skb ++ * @skb: buffer containing fragment to be initialised ++ * @i: paged fragment index to initialise ++ * @page: the page to use for this fragment ++ * @off: the offset to the data with @page ++ * @size: the length of the data ++ * ++ * Variant of skb_fill_page_desc() which does not deal with ++ * pfmemalloc, if page is not owned by us. ++ */ ++static inline void skb_fill_page_desc_noacc(struct sk_buff *skb, int i, ++ struct page *page, int off, ++ int size) ++{ ++ struct skb_shared_info *shinfo = skb_shinfo(skb); ++ ++ __skb_fill_page_desc_noacc(shinfo, i, page, off, size); ++ shinfo->nr_frags = i + 1; ++} ++ + void skb_add_rx_frag(struct sk_buff *skb, int i, struct page *page, int off, + int size, unsigned int truesize); + +diff --git a/net/core/datagram.c b/net/core/datagram.c +index 50f4faeea76cc..48e82438acb02 100644 +--- a/net/core/datagram.c ++++ b/net/core/datagram.c +@@ -675,7 +675,7 @@ int __zerocopy_sg_from_iter(struct sock *sk, struct sk_buff *skb, + page_ref_sub(last_head, refs); + refs = 0; + } +- skb_fill_page_desc(skb, frag++, head, start, size); ++ skb_fill_page_desc_noacc(skb, frag++, head, start, size); + } + if (refs) + page_ref_sub(last_head, refs); +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 3d446773ff2a5..ab03977b65781 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1015,7 +1015,7 @@ static struct sk_buff *tcp_build_frag(struct sock *sk, int size_goal, int flags, + skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy); + } else { + get_page(page); +- skb_fill_page_desc(skb, i, page, offset, copy); ++ skb_fill_page_desc_noacc(skb, i, page, offset, copy); + } + + if (!(flags & MSG_NO_SHARED_FRAGS)) +-- +2.35.1 + diff --git a/queue-5.19/tee-fix-compiler-warning-in-tee_shm_register.patch b/queue-5.19/tee-fix-compiler-warning-in-tee_shm_register.patch new file mode 100644 index 00000000000..a88e98376a7 --- /dev/null +++ b/queue-5.19/tee-fix-compiler-warning-in-tee_shm_register.patch @@ -0,0 +1,40 @@ +From 271f00c990c8f0980bceea59da0feb29c4fdf412 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Aug 2022 07:43:35 +0200 +Subject: tee: fix compiler warning in tee_shm_register() + +From: Jens Wiklander + +[ Upstream commit eccd7439709810127563e7e3e49b8b44c7b2791d ] + +Include to avoid the warning: + drivers/tee/tee_shm.c: In function 'tee_shm_register': +>> drivers/tee/tee_shm.c:242:14: error: implicit declaration of function 'access_ok' [-Werror=implicit-function-declaration] + 242 | if (!access_ok((void __user *)addr, length)) + | ^~~~~~~~~ + cc1: some warnings being treated as errors + +Fixes: 573ae4f13f63 ("tee: add overflow check in register_shm_helper()") +Reviewed-by: Sumit Garg +Reported-by: kernel test robot +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/tee_shm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c +index 1175f3a46859f..27295bda3e0bd 100644 +--- a/drivers/tee/tee_shm.c ++++ b/drivers/tee/tee_shm.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + #include + #include "tee_private.h" + +-- +2.35.1 + diff --git a/queue-5.19/tipc-fix-shift-wrapping-bug-in-map_get.patch b/queue-5.19/tipc-fix-shift-wrapping-bug-in-map_get.patch new file mode 100644 index 00000000000..f3620410ff1 --- /dev/null +++ b/queue-5.19/tipc-fix-shift-wrapping-bug-in-map_get.patch @@ -0,0 +1,36 @@ +From 332b944e8b54d12e84be83077bbed8192277c01c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Aug 2022 17:47:56 +0300 +Subject: tipc: fix shift wrapping bug in map_get() + +From: Dan Carpenter + +[ Upstream commit e2b224abd9bf45dcb55750479fc35970725a430b ] + +There is a shift wrapping bug in this code so anything thing above +31 will return false. + +Fixes: 35c55c9877f8 ("tipc: add neighbor monitoring framework") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/monitor.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c +index 2f4d23238a7e3..9618e4429f0fe 100644 +--- a/net/tipc/monitor.c ++++ b/net/tipc/monitor.c +@@ -160,7 +160,7 @@ static void map_set(u64 *up_map, int i, unsigned int v) + + static int map_get(u64 up_map, int i) + { +- return (up_map & (1 << i)) >> i; ++ return (up_map & (1ULL << i)) >> i; + } + + static struct tipc_peer *peer_prev(struct tipc_peer *peer) +-- +2.35.1 + diff --git a/queue-5.19/wifi-wilc1000-fix-dma-on-stack-objects.patch b/queue-5.19/wifi-wilc1000-fix-dma-on-stack-objects.patch new file mode 100644 index 00000000000..81c1cecf910 --- /dev/null +++ b/queue-5.19/wifi-wilc1000-fix-dma-on-stack-objects.patch @@ -0,0 +1,214 @@ +From cc3c35a33bf7b4d55938f0fcae178ebd43d7118b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Aug 2022 07:57:56 +0000 +Subject: wifi: wilc1000: fix DMA on stack objects + +From: Ajay.Kathat@microchip.com + +[ Upstream commit 40b717bfcefab28a0656b8caa5e43d5449e5a671 ] + +Sometimes 'wilc_sdio_cmd53' is called with addresses pointing to an +object on the stack. Use dynamically allocated memory for cmd53 instead +of stack address which is not DMA'able. + +Fixes: 5625f965d764 ("wilc1000: move wilc driver out of staging") +Reported-by: Michael Walle +Suggested-by: Michael Walle +Signed-off-by: Ajay Singh +Reviewed-by: Michael Walle +Tested-by: Michael Walle +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220809075749.62752-1-ajay.kathat@microchip.com +Signed-off-by: Sasha Levin +--- + .../net/wireless/microchip/wilc1000/netdev.h | 1 + + .../net/wireless/microchip/wilc1000/sdio.c | 39 ++++++++++++++++--- + .../net/wireless/microchip/wilc1000/wlan.c | 15 ++++++- + 3 files changed, 47 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/microchip/wilc1000/netdev.h b/drivers/net/wireless/microchip/wilc1000/netdev.h +index a067274c20144..bf001e9def6aa 100644 +--- a/drivers/net/wireless/microchip/wilc1000/netdev.h ++++ b/drivers/net/wireless/microchip/wilc1000/netdev.h +@@ -254,6 +254,7 @@ struct wilc { + u8 *rx_buffer; + u32 rx_buffer_offset; + u8 *tx_buffer; ++ u32 *vmm_table; + + struct txq_handle txq[NQUEUES]; + int txq_entries; +diff --git a/drivers/net/wireless/microchip/wilc1000/sdio.c b/drivers/net/wireless/microchip/wilc1000/sdio.c +index 7962c11cfe848..56f924a31bc66 100644 +--- a/drivers/net/wireless/microchip/wilc1000/sdio.c ++++ b/drivers/net/wireless/microchip/wilc1000/sdio.c +@@ -27,6 +27,7 @@ struct wilc_sdio { + bool irq_gpio; + u32 block_size; + int has_thrpt_enh3; ++ u8 *cmd53_buf; + }; + + struct sdio_cmd52 { +@@ -46,6 +47,7 @@ struct sdio_cmd53 { + u32 count: 9; + u8 *buffer; + u32 block_size; ++ bool use_global_buf; + }; + + static const struct wilc_hif_func wilc_hif_sdio; +@@ -90,6 +92,8 @@ static int wilc_sdio_cmd53(struct wilc *wilc, struct sdio_cmd53 *cmd) + { + struct sdio_func *func = container_of(wilc->dev, struct sdio_func, dev); + int size, ret; ++ struct wilc_sdio *sdio_priv = wilc->bus_data; ++ u8 *buf = cmd->buffer; + + sdio_claim_host(func); + +@@ -100,12 +104,23 @@ static int wilc_sdio_cmd53(struct wilc *wilc, struct sdio_cmd53 *cmd) + else + size = cmd->count; + ++ if (cmd->use_global_buf) { ++ if (size > sizeof(u32)) ++ return -EINVAL; ++ ++ buf = sdio_priv->cmd53_buf; ++ } ++ + if (cmd->read_write) { /* write */ +- ret = sdio_memcpy_toio(func, cmd->address, +- (void *)cmd->buffer, size); ++ if (cmd->use_global_buf) ++ memcpy(buf, cmd->buffer, size); ++ ++ ret = sdio_memcpy_toio(func, cmd->address, buf, size); + } else { /* read */ +- ret = sdio_memcpy_fromio(func, (void *)cmd->buffer, +- cmd->address, size); ++ ret = sdio_memcpy_fromio(func, buf, cmd->address, size); ++ ++ if (cmd->use_global_buf) ++ memcpy(cmd->buffer, buf, size); + } + + sdio_release_host(func); +@@ -127,6 +142,12 @@ static int wilc_sdio_probe(struct sdio_func *func, + if (!sdio_priv) + return -ENOMEM; + ++ sdio_priv->cmd53_buf = kzalloc(sizeof(u32), GFP_KERNEL); ++ if (!sdio_priv->cmd53_buf) { ++ ret = -ENOMEM; ++ goto free; ++ } ++ + ret = wilc_cfg80211_init(&wilc, &func->dev, WILC_HIF_SDIO, + &wilc_hif_sdio); + if (ret) +@@ -160,6 +181,7 @@ static int wilc_sdio_probe(struct sdio_func *func, + irq_dispose_mapping(wilc->dev_irq_num); + wilc_netdev_cleanup(wilc); + free: ++ kfree(sdio_priv->cmd53_buf); + kfree(sdio_priv); + return ret; + } +@@ -171,6 +193,7 @@ static void wilc_sdio_remove(struct sdio_func *func) + + clk_disable_unprepare(wilc->rtc_clk); + wilc_netdev_cleanup(wilc); ++ kfree(sdio_priv->cmd53_buf); + kfree(sdio_priv); + } + +@@ -367,8 +390,9 @@ static int wilc_sdio_write_reg(struct wilc *wilc, u32 addr, u32 data) + cmd.address = WILC_SDIO_FBR_DATA_REG; + cmd.block_mode = 0; + cmd.increment = 1; +- cmd.count = 4; ++ cmd.count = sizeof(u32); + cmd.buffer = (u8 *)&data; ++ cmd.use_global_buf = true; + cmd.block_size = sdio_priv->block_size; + ret = wilc_sdio_cmd53(wilc, &cmd); + if (ret) +@@ -406,6 +430,7 @@ static int wilc_sdio_write(struct wilc *wilc, u32 addr, u8 *buf, u32 size) + nblk = size / block_size; + nleft = size % block_size; + ++ cmd.use_global_buf = false; + if (nblk > 0) { + cmd.block_mode = 1; + cmd.increment = 1; +@@ -484,8 +509,9 @@ static int wilc_sdio_read_reg(struct wilc *wilc, u32 addr, u32 *data) + cmd.address = WILC_SDIO_FBR_DATA_REG; + cmd.block_mode = 0; + cmd.increment = 1; +- cmd.count = 4; ++ cmd.count = sizeof(u32); + cmd.buffer = (u8 *)data; ++ cmd.use_global_buf = true; + + cmd.block_size = sdio_priv->block_size; + ret = wilc_sdio_cmd53(wilc, &cmd); +@@ -527,6 +553,7 @@ static int wilc_sdio_read(struct wilc *wilc, u32 addr, u8 *buf, u32 size) + nblk = size / block_size; + nleft = size % block_size; + ++ cmd.use_global_buf = false; + if (nblk > 0) { + cmd.block_mode = 1; + cmd.increment = 1; +diff --git a/drivers/net/wireless/microchip/wilc1000/wlan.c b/drivers/net/wireless/microchip/wilc1000/wlan.c +index 48441f0389ca1..0c8a571486d25 100644 +--- a/drivers/net/wireless/microchip/wilc1000/wlan.c ++++ b/drivers/net/wireless/microchip/wilc1000/wlan.c +@@ -714,7 +714,7 @@ int wilc_wlan_handle_txq(struct wilc *wilc, u32 *txq_count) + int ret = 0; + int counter; + int timeout; +- u32 vmm_table[WILC_VMM_TBL_SIZE]; ++ u32 *vmm_table = wilc->vmm_table; + u8 ac_pkt_num_to_chip[NQUEUES] = {0, 0, 0, 0}; + const struct wilc_hif_func *func; + int srcu_idx; +@@ -1251,6 +1251,8 @@ void wilc_wlan_cleanup(struct net_device *dev) + while ((rqe = wilc_wlan_rxq_remove(wilc))) + kfree(rqe); + ++ kfree(wilc->vmm_table); ++ wilc->vmm_table = NULL; + kfree(wilc->rx_buffer); + wilc->rx_buffer = NULL; + kfree(wilc->tx_buffer); +@@ -1485,6 +1487,14 @@ int wilc_wlan_init(struct net_device *dev) + goto fail; + } + ++ if (!wilc->vmm_table) ++ wilc->vmm_table = kzalloc(WILC_VMM_TBL_SIZE, GFP_KERNEL); ++ ++ if (!wilc->vmm_table) { ++ ret = -ENOBUFS; ++ goto fail; ++ } ++ + if (!wilc->tx_buffer) + wilc->tx_buffer = kmalloc(WILC_TX_BUFF_SIZE, GFP_KERNEL); + +@@ -1509,7 +1519,8 @@ int wilc_wlan_init(struct net_device *dev) + return 0; + + fail: +- ++ kfree(wilc->vmm_table); ++ wilc->vmm_table = NULL; + kfree(wilc->rx_buffer); + wilc->rx_buffer = NULL; + kfree(wilc->tx_buffer); +-- +2.35.1 + diff --git a/queue-5.19/xen-netback-only-remove-hotplug-status-when-the-vif-.patch b/queue-5.19/xen-netback-only-remove-hotplug-status-when-the-vif-.patch new file mode 100644 index 00000000000..cc5ca8975ef --- /dev/null +++ b/queue-5.19/xen-netback-only-remove-hotplug-status-when-the-vif-.patch @@ -0,0 +1,50 @@ +From e166ebad58fd37fd213d2788c24ea8a25fe8139d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Sep 2022 12:55:54 +0100 +Subject: xen-netback: only remove 'hotplug-status' when the vif is actually + destroyed + +From: Paul Durrant + +[ Upstream commit c55f34b6aec2a8cb47eadaffea773e83bf85de91 ] + +Removing 'hotplug-status' in backend_disconnected() means that it will be +removed even in the case that the frontend unilaterally disconnects (which +it is free to do at any time). The consequence of this is that, when the +frontend attempts to re-connect, the backend gets stuck in 'InitWait' +rather than moving straight to 'Connected' (which it can do because the +hotplug script has already run). +Instead, the 'hotplug-status' mode should be removed in netback_remove() +i.e. when the vif really is going away. + +Fixes: 0f4558ae9187 ("Revert "xen-netback: remove 'hotplug-status' once it has served its purpose"") +Signed-off-by: Paul Durrant +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/xen-netback/xenbus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c +index 990360d75cb64..e85b3c5d4acce 100644 +--- a/drivers/net/xen-netback/xenbus.c ++++ b/drivers/net/xen-netback/xenbus.c +@@ -256,7 +256,6 @@ static void backend_disconnect(struct backend_info *be) + unsigned int queue_index; + + xen_unregister_watchers(vif); +- xenbus_rm(XBT_NIL, be->dev->nodename, "hotplug-status"); + #ifdef CONFIG_DEBUG_FS + xenvif_debugfs_delif(vif); + #endif /* CONFIG_DEBUG_FS */ +@@ -984,6 +983,7 @@ static int netback_remove(struct xenbus_device *dev) + struct backend_info *be = dev_get_drvdata(&dev->dev); + + unregister_hotplug_status_watch(be); ++ xenbus_rm(XBT_NIL, dev->nodename, "hotplug-status"); + if (be->vif) { + kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE); + backend_disconnect(be); +-- +2.35.1 +