From abfb7a12a51a67ea221e341fd1fabb8f93a184b9 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sat, 23 Jul 2022 23:29:58 -0400 Subject: [PATCH] Fixes for 5.15 Signed-off-by: Sasha Levin --- ...fer-overflow-in-be_get_module_eeprom.patch | 144 +++ ...add-option-to-defer-works-of-hpd_rx_.patch | 208 ++++ ...fork-thread-to-offload-work-of-hpd_r.patch | 485 +++++++++ ...ignore-first-mst-sideband-message-re.patch | 155 +++ ...support-for-dmub-hpd-interrupt-handl.patch | 342 +++++++ ...ay-add-quirk-handling-for-stutter-mo.patch | 76 ++ ...add-missing-of_node_put-in-fail-path.patch | 47 + ...t-clock-before-sending-message-to-cs.patch | 44 + ...pio-gpio-xilinx-fix-integer-overflow.patch | 37 + ...y-use-single-read-write-for-no-ai-mo.patch | 48 + ...-the-correct-range-when-do-regmap-sy.patch | 85 ++ ...-the-correct-register-address-when-r.patch | 53 + ...ge-large-transfer-count-reset-logic-.patch | 111 ++ ...register-setting-for-400khz-frequenc.patch | 35 + ...us-adapter-reinitialization-during-r.patch | 83 ++ ...andling-of-dummy-receive-descriptors.patch | 48 + ...c_removed-logic-and-implement-it-pro.patch | 119 +++ ...race-around-sysctl_igmp_max_membersh.patch | 36 + ...races-around-sysctl_igmp_llm_reports.patch | 110 ++ ...ata-races-around-sysctl_igmp_max_msf.patch | 68 ++ ...ta-race-around-sysctl_fwmark_reflect.patch | 36 + ...race-around-sysctl_ip_autobind_reuse.patch | 36 + ...s-around-sysctl_ip_fwd_update_priori.patch | 57 ++ ...-races-around-sysctl_ip_fwd_use_pmtu.patch | 50 + ...-races-around-sysctl_ip_no_pmtu_disc.patch | 78 ++ ...races-around-sysctl_ip_nonlocal_bind.patch | 50 + ...ata-races-around-sysctl_ip_prot_sock.patch | 69 ++ ...race-around-sysctl_fib_multipath_use.patch | 36 + ...ces-around-sysctl_fib_multipath_hash.patch | 50 + ...ound-sysctl_fib_multipath_hash.patch-25508 | 69 ++ ...tcp-do-not-use-per-netns-ctl-sockets.patch | 177 ++++ ...g-to-prevent-panic-when-setting-srio.patch | 138 +++ ...ctl-change-watermark_scale_factor-ma.patch | 80 ++ ...-set-wait_for_ready-timeout-based-on.patch | 77 ++ ...-gpmi-validate-controller-clock-rate.patch | 121 +++ ...hip-ksz_common-fix-refcount-leak-bug.patch | 53 + ...ja1105-silent-spi_device_id-warnings.patch | 68 ++ ...vsc73xx-silent-spi_device_id-warning.patch | 49 + ...-use-kfree_skb_reason-in-ip_rcv_core.patch | 117 +++ ...ree_skb_reason-in-ip_rcv_finish_core.patch | 105 ++ ...er-use-kfree_drop_reason-for-nf_drop.patch | 65 ++ .../net-skb-introduce-kfree_skb_reason.patch | 224 ++++ ...e-kfree_skb_reason-in-__udp4_lib_rcv.patch | 101 ++ ...b-use-kfree_skb_reason-in-tcp_v4_rcv.patch | 131 +++ ...reason-add-document-for-drop-reasons.patch | 52 + ...rename-skb_drop_reason_socket_filter.patch | 67 ++ ...-dma-queue-left-shift-overflow-issue.patch | 82 ++ ...m-runtime-issue-in-stmmac_dvr_remove.patch | 59 ++ ...nbalanced-ptp-clock-issue-in-suspend.patch | 92 ++ ...ove-redunctant-disable-xpcs-eee-call.patch | 45 + ...tls-fix-race-in-tls-device-down-flow.patch | 72 ++ ...n_ebpf_filter-and-pskb_trim-into-dif.patch | 44 + ...ck-for-duplicate-identifiers-earlier.patch | 55 + ...me-fix-block-device-naming-collision.patch | 64 ++ ...ta-race-between-perf_event_set_outpu.patch | 167 +++ ...onvert-perf-time-to-tsc-test-for-hyb.patch | 80 ++ ...da-37xx-convert-to-use-dev_err_probe.patch | 65 ++ ...7xx-make-use-of-the-devm_platform_io.patch | 50 + ...7xx-use-raw-spinlocks-for-regmap-to-.patch | 92 ++ ...7xx-use-temporary-variable-for-struc.patch | 230 +++++ ...heck-for-null-return-of-devm_kcalloc.patch | 43 + ...rename-mt7628-an-functions-to-mt76x8.patch | 402 ++++++++ ...ename-pinctrl-rt2880-to-pinctrl-rali.patch | 964 ++++++++++++++++++ ...versatile-fix-refcount-leak-in-versa.patch | 38 + ...not-advertise-1gb-page-size-for-x722.patch | 87 ++ ...a-fix-sleep-from-invalid-context-bug.patch | 113 ++ ...x-possible-hw-unit-hang-after-an-s0i.patch | 124 +++ ...aid-clear-read-queue-map-s-nr_queues.patch | 48 + ...-drop-loglevel-of-writeboost-message.patch | 43 + queue-5.15/series | 103 ++ ...-boundary-constants-from-sysctl.c-to.patch | 301 ++++++ ...ata-race-around-sysctl_tcp_fwmark_ac.patch | 37 + ...ace-around-sysctl_tcp_abort_on_overf.patch | 36 + ...race-around-sysctl_tcp_early_retrans.patch | 36 + ...ace-around-sysctl_tcp_mtu_probe_floo.patch | 36 + ...race-around-sysctl_tcp_notsent_lowat.patch | 36 + ...ace-around-sysctl_tcp_probe_interval.patch | 36 + ...ace-around-sysctl_tcp_probe_threshol.patch | 36 + ...ace-around-sysctl_tcp_retrans_collap.patch | 36 + ...-data-race-around-sysctl_tcp_rfc1337.patch | 36 + ...a-data-race-around-sysctl_tcp_stdurg.patch | 36 + ...ace-around-sysctl_tcp_thin_linear_ti.patch | 36 + ...data-race-around-sysctl_tcp_tw_reuse.patch | 39 + ...-races-around-keepalive-sysctl-knobs.patch | 69 ++ ...ces-around-some-timeout-sysctl-knobs.patch | 119 +++ ...es-around-sysctl-knobs-related-to-sy.patch | 180 ++++ ...-races-around-sysctl_max_syn_backlog.patch | 42 + ...ata-races-around-sysctl_tcp_base_mss.patch | 50 + ...fix-data-races-around-sysctl_tcp_ecn.patch | 92 ++ ...ata-races-around-sysctl_tcp_fastopen.patch | 85 ++ ...es-around-sysctl_tcp_fastopen_blackh.patch | 46 + ...aces-around-sysctl_tcp_l3mdev_accept.patch | 59 ++ ...ces-around-sysctl_tcp_max_reordering.patch | 45 + ...-races-around-sysctl_tcp_migrate_req.patch | 45 + ...-races-around-sysctl_tcp_min_snd_mss.patch | 51 + ...-races-around-sysctl_tcp_mtu_probing.patch | 50 + ...ata-races-around-sysctl_tcp_recovery.patch | 62 ++ ...a-races-around-sysctl_tcp_reordering.patch | 89 ++ ...es-around-sysctl_tcp_slow_start_afte.patch | 52 + ...es-around-sysctl_tcp_syn-ack-_retrie.patch | 85 ++ ...a-races-around-sysctl_tcp_syncookies.patch | 143 +++ ...dev_if-once-in-inet_request_bound_de.patch | 46 + ...race-around-sysctl_udp_l3mdev_accept.patch | 36 + ...-fix-a-possible-double-xfrm_pols_put.patch | 58 ++ 104 files changed, 9893 insertions(+) create mode 100644 queue-5.15/be2net-fix-buffer-overflow-in-be_get_module_eeprom.patch create mode 100644 queue-5.15/drm-amd-display-add-option-to-defer-works-of-hpd_rx_.patch create mode 100644 queue-5.15/drm-amd-display-fork-thread-to-offload-work-of-hpd_r.patch create mode 100644 queue-5.15/drm-amd-display-ignore-first-mst-sideband-message-re.patch create mode 100644 queue-5.15/drm-amd-display-support-for-dmub-hpd-interrupt-handl.patch create mode 100644 queue-5.15/drm-amdgpu-display-add-quirk-handling-for-stutter-mo.patch create mode 100644 queue-5.15/drm-imx-dcss-add-missing-of_node_put-in-fail-path.patch create mode 100644 queue-5.15/e1000e-enable-gpt-clock-before-sending-message-to-cs.patch create mode 100644 queue-5.15/gpio-gpio-xilinx-fix-integer-overflow.patch create mode 100644 queue-5.15/gpio-pca953x-only-use-single-read-write-for-no-ai-mo.patch create mode 100644 queue-5.15/gpio-pca953x-use-the-correct-range-when-do-regmap-sy.patch create mode 100644 queue-5.15/gpio-pca953x-use-the-correct-register-address-when-r.patch create mode 100644 queue-5.15/i2c-cadence-change-large-transfer-count-reset-logic-.patch create mode 100644 queue-5.15/i2c-mlxcpld-fix-register-setting-for-400khz-frequenc.patch create mode 100644 queue-5.15/i40e-fix-erroneous-adapter-reinitialization-during-r.patch create mode 100644 queue-5.15/iavf-fix-handling-of-dummy-receive-descriptors.patch create mode 100644 queue-5.15/igc-reinstate-igc_removed-logic-and-implement-it-pro.patch create mode 100644 queue-5.15/igmp-fix-a-data-race-around-sysctl_igmp_max_membersh.patch create mode 100644 queue-5.15/igmp-fix-data-races-around-sysctl_igmp_llm_reports.patch create mode 100644 queue-5.15/igmp-fix-data-races-around-sysctl_igmp_max_msf.patch create mode 100644 queue-5.15/ip-fix-a-data-race-around-sysctl_fwmark_reflect.patch create mode 100644 queue-5.15/ip-fix-a-data-race-around-sysctl_ip_autobind_reuse.patch create mode 100644 queue-5.15/ip-fix-data-races-around-sysctl_ip_fwd_update_priori.patch create mode 100644 queue-5.15/ip-fix-data-races-around-sysctl_ip_fwd_use_pmtu.patch create mode 100644 queue-5.15/ip-fix-data-races-around-sysctl_ip_no_pmtu_disc.patch create mode 100644 queue-5.15/ip-fix-data-races-around-sysctl_ip_nonlocal_bind.patch create mode 100644 queue-5.15/ip-fix-data-races-around-sysctl_ip_prot_sock.patch create mode 100644 queue-5.15/ipv4-fix-a-data-race-around-sysctl_fib_multipath_use.patch create mode 100644 queue-5.15/ipv4-fix-data-races-around-sysctl_fib_multipath_hash.patch create mode 100644 queue-5.15/ipv4-fix-data-races-around-sysctl_fib_multipath_hash.patch-25508 create mode 100644 queue-5.15/ipv4-tcp-do-not-use-per-netns-ctl-sockets.patch create mode 100644 queue-5.15/ixgbe-add-locking-to-prevent-panic-when-setting-srio.patch create mode 100644 queue-5.15/mm-pagealloc-sysctl-change-watermark_scale_factor-ma.patch create mode 100644 queue-5.15/mtd-rawnand-gpmi-set-wait_for_ready-timeout-based-on.patch create mode 100644 queue-5.15/mtd-rawnand-gpmi-validate-controller-clock-rate.patch create mode 100644 queue-5.15/net-dsa-microchip-ksz_common-fix-refcount-leak-bug.patch create mode 100644 queue-5.15/net-dsa-sja1105-silent-spi_device_id-warnings.patch create mode 100644 queue-5.15/net-dsa-vitesse-vsc73xx-silent-spi_device_id-warning.patch create mode 100644 queue-5.15/net-ipv4-use-kfree_skb_reason-in-ip_rcv_core.patch create mode 100644 queue-5.15/net-ipv4-use-kfree_skb_reason-in-ip_rcv_finish_core.patch create mode 100644 queue-5.15/net-netfilter-use-kfree_drop_reason-for-nf_drop.patch create mode 100644 queue-5.15/net-skb-introduce-kfree_skb_reason.patch create mode 100644 queue-5.15/net-skb-use-kfree_skb_reason-in-__udp4_lib_rcv.patch create mode 100644 queue-5.15/net-skb-use-kfree_skb_reason-in-tcp_v4_rcv.patch create mode 100644 queue-5.15/net-skb_drop_reason-add-document-for-drop-reasons.patch create mode 100644 queue-5.15/net-socket-rename-skb_drop_reason_socket_filter.patch create mode 100644 queue-5.15/net-stmmac-fix-dma-queue-left-shift-overflow-issue.patch create mode 100644 queue-5.15/net-stmmac-fix-pm-runtime-issue-in-stmmac_dvr_remove.patch create mode 100644 queue-5.15/net-stmmac-fix-unbalanced-ptp-clock-issue-in-suspend.patch create mode 100644 queue-5.15/net-stmmac-remove-redunctant-disable-xpcs-eee-call.patch create mode 100644 queue-5.15/net-tls-fix-race-in-tls-device-down-flow.patch create mode 100644 queue-5.15/net-tun-split-run_ebpf_filter-and-pskb_trim-into-dif.patch create mode 100644 queue-5.15/nvme-check-for-duplicate-identifiers-earlier.patch create mode 100644 queue-5.15/nvme-fix-block-device-naming-collision.patch create mode 100644 queue-5.15/perf-core-fix-data-race-between-perf_event_set_outpu.patch create mode 100644 queue-5.15/perf-tests-fix-convert-perf-time-to-tsc-test-for-hyb.patch create mode 100644 queue-5.15/pinctrl-armada-37xx-convert-to-use-dev_err_probe.patch create mode 100644 queue-5.15/pinctrl-armada-37xx-make-use-of-the-devm_platform_io.patch create mode 100644 queue-5.15/pinctrl-armada-37xx-use-raw-spinlocks-for-regmap-to-.patch create mode 100644 queue-5.15/pinctrl-armada-37xx-use-temporary-variable-for-struc.patch create mode 100644 queue-5.15/pinctrl-ralink-check-for-null-return-of-devm_kcalloc.patch create mode 100644 queue-5.15/pinctrl-ralink-rename-mt7628-an-functions-to-mt76x8.patch create mode 100644 queue-5.15/pinctrl-ralink-rename-pinctrl-rt2880-to-pinctrl-rali.patch create mode 100644 queue-5.15/power-reset-arm-versatile-fix-refcount-leak-in-versa.patch create mode 100644 queue-5.15/rdma-irdma-do-not-advertise-1gb-page-size-for-x722.patch create mode 100644 queue-5.15/rdma-irdma-fix-sleep-from-invalid-context-bug.patch create mode 100644 queue-5.15/revert-e1000e-fix-possible-hw-unit-hang-after-an-s0i.patch create mode 100644 queue-5.15/scsi-megaraid-clear-read-queue-map-s-nr_queues.patch create mode 100644 queue-5.15/scsi-ufs-core-drop-loglevel-of-writeboost-message.patch create mode 100644 queue-5.15/sysctl-move-some-boundary-constants-from-sysctl.c-to.patch create mode 100644 queue-5.15/tcp-dccp-fix-a-data-race-around-sysctl_tcp_fwmark_ac.patch create mode 100644 queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_abort_on_overf.patch create mode 100644 queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_early_retrans.patch create mode 100644 queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_mtu_probe_floo.patch create mode 100644 queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_notsent_lowat.patch create mode 100644 queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_probe_interval.patch create mode 100644 queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_probe_threshol.patch create mode 100644 queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_retrans_collap.patch create mode 100644 queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_rfc1337.patch create mode 100644 queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_stdurg.patch create mode 100644 queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_thin_linear_ti.patch create mode 100644 queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_tw_reuse.patch create mode 100644 queue-5.15/tcp-fix-data-races-around-keepalive-sysctl-knobs.patch create mode 100644 queue-5.15/tcp-fix-data-races-around-some-timeout-sysctl-knobs.patch create mode 100644 queue-5.15/tcp-fix-data-races-around-sysctl-knobs-related-to-sy.patch create mode 100644 queue-5.15/tcp-fix-data-races-around-sysctl_max_syn_backlog.patch create mode 100644 queue-5.15/tcp-fix-data-races-around-sysctl_tcp_base_mss.patch create mode 100644 queue-5.15/tcp-fix-data-races-around-sysctl_tcp_ecn.patch create mode 100644 queue-5.15/tcp-fix-data-races-around-sysctl_tcp_fastopen.patch create mode 100644 queue-5.15/tcp-fix-data-races-around-sysctl_tcp_fastopen_blackh.patch create mode 100644 queue-5.15/tcp-fix-data-races-around-sysctl_tcp_l3mdev_accept.patch create mode 100644 queue-5.15/tcp-fix-data-races-around-sysctl_tcp_max_reordering.patch create mode 100644 queue-5.15/tcp-fix-data-races-around-sysctl_tcp_migrate_req.patch create mode 100644 queue-5.15/tcp-fix-data-races-around-sysctl_tcp_min_snd_mss.patch create mode 100644 queue-5.15/tcp-fix-data-races-around-sysctl_tcp_mtu_probing.patch create mode 100644 queue-5.15/tcp-fix-data-races-around-sysctl_tcp_recovery.patch create mode 100644 queue-5.15/tcp-fix-data-races-around-sysctl_tcp_reordering.patch create mode 100644 queue-5.15/tcp-fix-data-races-around-sysctl_tcp_slow_start_afte.patch create mode 100644 queue-5.15/tcp-fix-data-races-around-sysctl_tcp_syn-ack-_retrie.patch create mode 100644 queue-5.15/tcp-fix-data-races-around-sysctl_tcp_syncookies.patch create mode 100644 queue-5.15/tcp-sk-sk_bound_dev_if-once-in-inet_request_bound_de.patch create mode 100644 queue-5.15/udp-fix-a-data-race-around-sysctl_udp_l3mdev_accept.patch create mode 100644 queue-5.15/xfrm-xfrm_policy-fix-a-possible-double-xfrm_pols_put.patch diff --git a/queue-5.15/be2net-fix-buffer-overflow-in-be_get_module_eeprom.patch b/queue-5.15/be2net-fix-buffer-overflow-in-be_get_module_eeprom.patch new file mode 100644 index 00000000000..c0e11210c1b --- /dev/null +++ b/queue-5.15/be2net-fix-buffer-overflow-in-be_get_module_eeprom.patch @@ -0,0 +1,144 @@ +From daf512cd0d8c14cbd5562639f214d7bb8ed384d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Jul 2022 11:51:34 +0300 +Subject: be2net: Fix buffer overflow in be_get_module_eeprom + +From: Hristo Venev + +[ Upstream commit d7241f679a59cfe27f92cb5c6272cb429fb1f7ec ] + +be_cmd_read_port_transceiver_data assumes that it is given a buffer that +is at least PAGE_DATA_LEN long, or twice that if the module supports SFF +8472. However, this is not always the case. + +Fix this by passing the desired offset and length to +be_cmd_read_port_transceiver_data so that we only copy the bytes once. + +Fixes: e36edd9d26cf ("be2net: add ethtool "-m" option support") +Signed-off-by: Hristo Venev +Link: https://lore.kernel.org/r/20220716085134.6095-1-hristo@venev.name +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/emulex/benet/be_cmds.c | 10 +++--- + drivers/net/ethernet/emulex/benet/be_cmds.h | 2 +- + .../net/ethernet/emulex/benet/be_ethtool.c | 31 ++++++++++++------- + 3 files changed, 25 insertions(+), 18 deletions(-) + +diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c +index 649c5c429bd7..1288b5e3d220 100644 +--- a/drivers/net/ethernet/emulex/benet/be_cmds.c ++++ b/drivers/net/ethernet/emulex/benet/be_cmds.c +@@ -2287,7 +2287,7 @@ int be_cmd_get_beacon_state(struct be_adapter *adapter, u8 port_num, u32 *state) + + /* Uses sync mcc */ + int be_cmd_read_port_transceiver_data(struct be_adapter *adapter, +- u8 page_num, u8 *data) ++ u8 page_num, u32 off, u32 len, u8 *data) + { + struct be_dma_mem cmd; + struct be_mcc_wrb *wrb; +@@ -2321,10 +2321,10 @@ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter, + req->port = cpu_to_le32(adapter->hba_port_num); + req->page_num = cpu_to_le32(page_num); + status = be_mcc_notify_wait(adapter); +- if (!status) { ++ if (!status && len > 0) { + struct be_cmd_resp_port_type *resp = cmd.va; + +- memcpy(data, resp->page_data, PAGE_DATA_LEN); ++ memcpy(data, resp->page_data + off, len); + } + err: + mutex_unlock(&adapter->mcc_lock); +@@ -2415,7 +2415,7 @@ int be_cmd_query_cable_type(struct be_adapter *adapter) + int status; + + status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, +- page_data); ++ 0, PAGE_DATA_LEN, page_data); + if (!status) { + switch (adapter->phy.interface_type) { + case PHY_TYPE_QSFP: +@@ -2440,7 +2440,7 @@ int be_cmd_query_sfp_info(struct be_adapter *adapter) + int status; + + status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, +- page_data); ++ 0, PAGE_DATA_LEN, page_data); + if (!status) { + strlcpy(adapter->phy.vendor_name, page_data + + SFP_VENDOR_NAME_OFFSET, SFP_VENDOR_NAME_LEN - 1); +diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h +index c30d6d6f0f3a..9e17d6a7ab8c 100644 +--- a/drivers/net/ethernet/emulex/benet/be_cmds.h ++++ b/drivers/net/ethernet/emulex/benet/be_cmds.h +@@ -2427,7 +2427,7 @@ int be_cmd_set_beacon_state(struct be_adapter *adapter, u8 port_num, u8 beacon, + int be_cmd_get_beacon_state(struct be_adapter *adapter, u8 port_num, + u32 *state); + int be_cmd_read_port_transceiver_data(struct be_adapter *adapter, +- u8 page_num, u8 *data); ++ u8 page_num, u32 off, u32 len, u8 *data); + int be_cmd_query_cable_type(struct be_adapter *adapter); + int be_cmd_query_sfp_info(struct be_adapter *adapter); + int lancer_cmd_read_object(struct be_adapter *adapter, struct be_dma_mem *cmd, +diff --git a/drivers/net/ethernet/emulex/benet/be_ethtool.c b/drivers/net/ethernet/emulex/benet/be_ethtool.c +index f9955308b93d..010a0024f3ce 100644 +--- a/drivers/net/ethernet/emulex/benet/be_ethtool.c ++++ b/drivers/net/ethernet/emulex/benet/be_ethtool.c +@@ -1342,7 +1342,7 @@ static int be_get_module_info(struct net_device *netdev, + return -EOPNOTSUPP; + + status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, +- page_data); ++ 0, PAGE_DATA_LEN, page_data); + if (!status) { + if (!page_data[SFP_PLUS_SFF_8472_COMP]) { + modinfo->type = ETH_MODULE_SFF_8079; +@@ -1360,25 +1360,32 @@ static int be_get_module_eeprom(struct net_device *netdev, + { + struct be_adapter *adapter = netdev_priv(netdev); + int status; ++ u32 begin, end; + + if (!check_privilege(adapter, MAX_PRIVILEGES)) + return -EOPNOTSUPP; + +- status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, +- data); +- if (status) +- goto err; ++ begin = eeprom->offset; ++ end = eeprom->offset + eeprom->len; ++ ++ if (begin < PAGE_DATA_LEN) { ++ status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, begin, ++ min_t(u32, end, PAGE_DATA_LEN) - begin, ++ data); ++ if (status) ++ goto err; ++ ++ data += PAGE_DATA_LEN - begin; ++ begin = PAGE_DATA_LEN; ++ } + +- if (eeprom->offset + eeprom->len > PAGE_DATA_LEN) { +- status = be_cmd_read_port_transceiver_data(adapter, +- TR_PAGE_A2, +- data + +- PAGE_DATA_LEN); ++ if (end > PAGE_DATA_LEN) { ++ status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A2, ++ begin - PAGE_DATA_LEN, ++ end - begin, data); + if (status) + goto err; + } +- if (eeprom->offset) +- memcpy(data, data + eeprom->offset, eeprom->len); + err: + return be_cmd_status(status); + } +-- +2.35.1 + diff --git a/queue-5.15/drm-amd-display-add-option-to-defer-works-of-hpd_rx_.patch b/queue-5.15/drm-amd-display-add-option-to-defer-works-of-hpd_rx_.patch new file mode 100644 index 00000000000..c3b80467f2b --- /dev/null +++ b/queue-5.15/drm-amd-display-add-option-to-defer-works-of-hpd_rx_.patch @@ -0,0 +1,208 @@ +From d1631fec38df5c5e7dd169c86b62dc40975f5052 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 15:54:47 +0800 +Subject: drm/amd/display: Add option to defer works of hpd_rx_irq + +From: Wayne Lin + +[ Upstream commit 410ad92d7fecd30de7456c19e326e272c2153ff2 ] + +[Why & How] +Due to some code flow constraints, we need to defer dc_lock needed works +from dc_link_handle_hpd_rx_irq(). Thus, do following changes: + +* Change allow_hpd_rx_irq() from static to public +* Change handle_automated_test() from static to public +* Extract link lost handling flow out from dc_link_handle_hpd_rx_irq() + and put those into a new function dc_link_dp_handle_link_loss() +* Add one option parameter to decide whether defer works within + dc_link_handle_hpd_rx_irq() + +Acked-by: Mikita Lipski +Signed-off-by: Wayne Lin +Reviewed-by: Nicholas Kazlauskas +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/core/dc_link_dp.c | 92 ++++++++++++------- + drivers/gpu/drm/amd/display/dc/dc_link.h | 3 + + 2 files changed, 63 insertions(+), 32 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +index 05f81d44aa6c..9b6111eb9ca4 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +@@ -2743,7 +2743,7 @@ void decide_link_settings(struct dc_stream_state *stream, + } + + /*************************Short Pulse IRQ***************************/ +-static bool allow_hpd_rx_irq(const struct dc_link *link) ++bool dc_link_dp_allow_hpd_rx_irq(const struct dc_link *link) + { + /* + * Don't handle RX IRQ unless one of following is met: +@@ -3177,7 +3177,7 @@ static void dp_test_get_audio_test_data(struct dc_link *link, bool disable_video + } + } + +-static void handle_automated_test(struct dc_link *link) ++void dc_link_dp_handle_automated_test(struct dc_link *link) + { + union test_request test_request; + union test_response test_response; +@@ -3226,17 +3226,50 @@ static void handle_automated_test(struct dc_link *link) + sizeof(test_response)); + } + +-bool dc_link_handle_hpd_rx_irq(struct dc_link *link, union hpd_irq_data *out_hpd_irq_dpcd_data, bool *out_link_loss) ++void dc_link_dp_handle_link_loss(struct dc_link *link) ++{ ++ int i; ++ struct pipe_ctx *pipe_ctx; ++ ++ for (i = 0; i < MAX_PIPES; i++) { ++ pipe_ctx = &link->dc->current_state->res_ctx.pipe_ctx[i]; ++ if (pipe_ctx && pipe_ctx->stream && pipe_ctx->stream->link == link) ++ break; ++ } ++ ++ if (pipe_ctx == NULL || pipe_ctx->stream == NULL) ++ return; ++ ++ for (i = 0; i < MAX_PIPES; i++) { ++ pipe_ctx = &link->dc->current_state->res_ctx.pipe_ctx[i]; ++ if (pipe_ctx && pipe_ctx->stream && !pipe_ctx->stream->dpms_off && ++ pipe_ctx->stream->link == link && !pipe_ctx->prev_odm_pipe) { ++ core_link_disable_stream(pipe_ctx); ++ } ++ } ++ ++ for (i = 0; i < MAX_PIPES; i++) { ++ pipe_ctx = &link->dc->current_state->res_ctx.pipe_ctx[i]; ++ if (pipe_ctx && pipe_ctx->stream && !pipe_ctx->stream->dpms_off && ++ pipe_ctx->stream->link == link && !pipe_ctx->prev_odm_pipe) { ++ core_link_enable_stream(link->dc->current_state, pipe_ctx); ++ } ++ } ++} ++ ++static bool handle_hpd_rx_irq(struct dc_link *link, union hpd_irq_data *out_hpd_irq_dpcd_data, bool *out_link_loss, ++ bool defer_handling, bool *has_left_work) + { + union hpd_irq_data hpd_irq_dpcd_data = { { { {0} } } }; + union device_service_irq device_service_clear = { { 0 } }; + enum dc_status result; + bool status = false; +- struct pipe_ctx *pipe_ctx; +- int i; + + if (out_link_loss) + *out_link_loss = false; ++ ++ if (has_left_work) ++ *has_left_work = false; + /* For use cases related to down stream connection status change, + * PSR and device auto test, refer to function handle_sst_hpd_irq + * in DAL2.1*/ +@@ -3268,11 +3301,14 @@ bool dc_link_handle_hpd_rx_irq(struct dc_link *link, union hpd_irq_data *out_hpd + &device_service_clear.raw, + sizeof(device_service_clear.raw)); + device_service_clear.raw = 0; +- handle_automated_test(link); ++ if (defer_handling && has_left_work) ++ *has_left_work = true; ++ else ++ dc_link_dp_handle_automated_test(link); + return false; + } + +- if (!allow_hpd_rx_irq(link)) { ++ if (!dc_link_dp_allow_hpd_rx_irq(link)) { + DC_LOG_HW_HPD_IRQ("%s: skipping HPD handling on %d\n", + __func__, link->link_index); + return false; +@@ -3286,12 +3322,18 @@ bool dc_link_handle_hpd_rx_irq(struct dc_link *link, union hpd_irq_data *out_hpd + * so do not handle as a normal sink status change interrupt. + */ + +- if (hpd_irq_dpcd_data.bytes.device_service_irq.bits.UP_REQ_MSG_RDY) ++ if (hpd_irq_dpcd_data.bytes.device_service_irq.bits.UP_REQ_MSG_RDY) { ++ if (defer_handling && has_left_work) ++ *has_left_work = true; + return true; ++ } + + /* check if we have MST msg and return since we poll for it */ +- if (hpd_irq_dpcd_data.bytes.device_service_irq.bits.DOWN_REP_MSG_RDY) ++ if (hpd_irq_dpcd_data.bytes.device_service_irq.bits.DOWN_REP_MSG_RDY) { ++ if (defer_handling && has_left_work) ++ *has_left_work = true; + return false; ++ } + + /* For now we only handle 'Downstream port status' case. + * If we got sink count changed it means +@@ -3308,29 +3350,10 @@ bool dc_link_handle_hpd_rx_irq(struct dc_link *link, union hpd_irq_data *out_hpd + sizeof(hpd_irq_dpcd_data), + "Status: "); + +- for (i = 0; i < MAX_PIPES; i++) { +- pipe_ctx = &link->dc->current_state->res_ctx.pipe_ctx[i]; +- if (pipe_ctx && pipe_ctx->stream && pipe_ctx->stream->link == link) +- break; +- } +- +- if (pipe_ctx == NULL || pipe_ctx->stream == NULL) +- return false; +- +- +- for (i = 0; i < MAX_PIPES; i++) { +- pipe_ctx = &link->dc->current_state->res_ctx.pipe_ctx[i]; +- if (pipe_ctx && pipe_ctx->stream && !pipe_ctx->stream->dpms_off && +- pipe_ctx->stream->link == link && !pipe_ctx->prev_odm_pipe) +- core_link_disable_stream(pipe_ctx); +- } +- +- for (i = 0; i < MAX_PIPES; i++) { +- pipe_ctx = &link->dc->current_state->res_ctx.pipe_ctx[i]; +- if (pipe_ctx && pipe_ctx->stream && !pipe_ctx->stream->dpms_off && +- pipe_ctx->stream->link == link && !pipe_ctx->prev_odm_pipe) +- core_link_enable_stream(link->dc->current_state, pipe_ctx); +- } ++ if (defer_handling && has_left_work) ++ *has_left_work = true; ++ else ++ dc_link_dp_handle_link_loss(link); + + status = false; + if (out_link_loss) +@@ -3356,6 +3379,11 @@ bool dc_link_handle_hpd_rx_irq(struct dc_link *link, union hpd_irq_data *out_hpd + return status; + } + ++bool dc_link_handle_hpd_rx_irq(struct dc_link *link, union hpd_irq_data *out_hpd_irq_dpcd_data, bool *out_link_loss) ++{ ++ return handle_hpd_rx_irq(link, out_hpd_irq_dpcd_data, out_link_loss, false, NULL); ++} ++ + /*query dpcd for version and mst cap addresses*/ + bool is_mst_supported(struct dc_link *link) + { +diff --git a/drivers/gpu/drm/amd/display/dc/dc_link.h b/drivers/gpu/drm/amd/display/dc/dc_link.h +index 83845d006c54..0efa2bc8639b 100644 +--- a/drivers/gpu/drm/amd/display/dc/dc_link.h ++++ b/drivers/gpu/drm/amd/display/dc/dc_link.h +@@ -308,6 +308,9 @@ bool dc_link_wait_for_t12(struct dc_link *link); + enum dc_status read_hpd_rx_irq_data( + struct dc_link *link, + union hpd_irq_data *irq_data); ++void dc_link_dp_handle_automated_test(struct dc_link *link); ++void dc_link_dp_handle_link_loss(struct dc_link *link); ++bool dc_link_dp_allow_hpd_rx_irq(const struct dc_link *link); + + struct dc_sink_init_data; + +-- +2.35.1 + diff --git a/queue-5.15/drm-amd-display-fork-thread-to-offload-work-of-hpd_r.patch b/queue-5.15/drm-amd-display-fork-thread-to-offload-work-of-hpd_r.patch new file mode 100644 index 00000000000..a1c0c8adc9f --- /dev/null +++ b/queue-5.15/drm-amd-display-fork-thread-to-offload-work-of-hpd_r.patch @@ -0,0 +1,485 @@ +From 269686946d7ef829cfb7f0d5701472985d01ee79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jul 2021 11:50:28 +0800 +Subject: drm/amd/display: Fork thread to offload work of hpd_rx_irq + +From: Wayne Lin + +[ Upstream commit 8e794421bc981586d0af4e959ec76d668c793a55 ] + +[Why] +Currently, we will try to get dm.dc_lock in handle_hpd_rx_irq() when +link lost happened, which is risky and could cause deadlock. +e.g. If we are under procedure to enable MST streams and then monitor +happens to toggle short hpd to notify link lost, then +handle_hpd_rx_irq() will get blocked due to stream enabling flow has +dc_lock. However, under MST, enabling streams involves communication +with remote sinks which need to use handle_hpd_rx_irq() to handle +sideband messages. Thus, we have deadlock here. + +[How] +Target is to have handle_hpd_rx_irq() finished as soon as possilble. +Hence we can react to interrupt quickly. Besides, we should avoid to +grabe dm.dc_lock within handle_hpd_rx_irq() to avoid deadlock situation. + +Firstly, revert patches which introduced to use dm.dc_lock in +handle_hpd_rx_irq(): + +* commit ("drm/amd/display: NULL pointer error during ") + +* commit ("drm/amd/display: Only one display lights up while using MST") + +* commit ("drm/amd/display: take dc_lock in short pulse handler only") + +Instead, create work to handle irq events which needs dm.dc_lock. +Besides: + +* Create struct hpd_rx_irq_offload_work_queue for each link to handle + its short hpd events + +* Avoid to handle link lost/ automated test if the link is disconnected + +* Defer dc_lock needed works in dc_link_handle_hpd_rx_irq(). This + function should just handle simple stuff for us (e.g. DPCD R/W). + However, deferred works should still be handled by the order that + dc_link_handle_hpd_rx_irq() used to be. + +* Change function name dm_handle_hpd_rx_irq() to + dm_handle_mst_sideband_msg() to be more specific + +Reviewed-by: Nicholas Kazlauskas +Acked-by: Mikita Lipski +Signed-off-by: Wayne Lin +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 203 ++++++++++++++---- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 49 ++++- + .../gpu/drm/amd/display/dc/core/dc_link_dp.c | 9 +- + drivers/gpu/drm/amd/display/dc/dc_link.h | 6 +- + 4 files changed, 219 insertions(+), 48 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 19048f0d83a4..ce647302a1ec 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -1236,6 +1236,83 @@ static void vblank_control_worker(struct work_struct *work) + } + + #endif ++ ++static void dm_handle_hpd_rx_offload_work(struct work_struct *work) ++{ ++ struct hpd_rx_irq_offload_work *offload_work; ++ struct amdgpu_dm_connector *aconnector; ++ struct dc_link *dc_link; ++ struct amdgpu_device *adev; ++ enum dc_connection_type new_connection_type = dc_connection_none; ++ unsigned long flags; ++ ++ offload_work = container_of(work, struct hpd_rx_irq_offload_work, work); ++ aconnector = offload_work->offload_wq->aconnector; ++ ++ if (!aconnector) { ++ DRM_ERROR("Can't retrieve aconnector in hpd_rx_irq_offload_work"); ++ goto skip; ++ } ++ ++ adev = drm_to_adev(aconnector->base.dev); ++ dc_link = aconnector->dc_link; ++ ++ mutex_lock(&aconnector->hpd_lock); ++ if (!dc_link_detect_sink(dc_link, &new_connection_type)) ++ DRM_ERROR("KMS: Failed to detect connector\n"); ++ mutex_unlock(&aconnector->hpd_lock); ++ ++ if (new_connection_type == dc_connection_none) ++ goto skip; ++ ++ if (amdgpu_in_reset(adev)) ++ goto skip; ++ ++ mutex_lock(&adev->dm.dc_lock); ++ if (offload_work->data.bytes.device_service_irq.bits.AUTOMATED_TEST) ++ dc_link_dp_handle_automated_test(dc_link); ++ else if ((dc_link->connector_signal != SIGNAL_TYPE_EDP) && ++ hpd_rx_irq_check_link_loss_status(dc_link, &offload_work->data) && ++ dc_link_dp_allow_hpd_rx_irq(dc_link)) { ++ dc_link_dp_handle_link_loss(dc_link); ++ spin_lock_irqsave(&offload_work->offload_wq->offload_lock, flags); ++ offload_work->offload_wq->is_handling_link_loss = false; ++ spin_unlock_irqrestore(&offload_work->offload_wq->offload_lock, flags); ++ } ++ mutex_unlock(&adev->dm.dc_lock); ++ ++skip: ++ kfree(offload_work); ++ ++} ++ ++static struct hpd_rx_irq_offload_work_queue *hpd_rx_irq_create_workqueue(struct dc *dc) ++{ ++ int max_caps = dc->caps.max_links; ++ int i = 0; ++ struct hpd_rx_irq_offload_work_queue *hpd_rx_offload_wq = NULL; ++ ++ hpd_rx_offload_wq = kcalloc(max_caps, sizeof(*hpd_rx_offload_wq), GFP_KERNEL); ++ ++ if (!hpd_rx_offload_wq) ++ return NULL; ++ ++ ++ for (i = 0; i < max_caps; i++) { ++ hpd_rx_offload_wq[i].wq = ++ create_singlethread_workqueue("amdgpu_dm_hpd_rx_offload_wq"); ++ ++ if (hpd_rx_offload_wq[i].wq == NULL) { ++ DRM_ERROR("create amdgpu_dm_hpd_rx_offload_wq fail!"); ++ return NULL; ++ } ++ ++ spin_lock_init(&hpd_rx_offload_wq[i].offload_lock); ++ } ++ ++ return hpd_rx_offload_wq; ++} ++ + static int amdgpu_dm_init(struct amdgpu_device *adev) + { + struct dc_init_data init_data; +@@ -1362,6 +1439,12 @@ static int amdgpu_dm_init(struct amdgpu_device *adev) + + dc_hardware_init(adev->dm.dc); + ++ adev->dm.hpd_rx_offload_wq = hpd_rx_irq_create_workqueue(adev->dm.dc); ++ if (!adev->dm.hpd_rx_offload_wq) { ++ DRM_ERROR("amdgpu: failed to create hpd rx offload workqueue.\n"); ++ goto error; ++ } ++ + #if defined(CONFIG_DRM_AMD_DC_DCN) + if ((adev->flags & AMD_IS_APU) && (adev->asic_type >= CHIP_CARRIZO)) { + struct dc_phy_addr_space_config pa_config; +@@ -1541,6 +1624,18 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev) + adev->dm.freesync_module = NULL; + } + ++ if (adev->dm.hpd_rx_offload_wq) { ++ for (i = 0; i < adev->dm.dc->caps.max_links; i++) { ++ if (adev->dm.hpd_rx_offload_wq[i].wq) { ++ destroy_workqueue(adev->dm.hpd_rx_offload_wq[i].wq); ++ adev->dm.hpd_rx_offload_wq[i].wq = NULL; ++ } ++ } ++ ++ kfree(adev->dm.hpd_rx_offload_wq); ++ adev->dm.hpd_rx_offload_wq = NULL; ++ } ++ + mutex_destroy(&adev->dm.audio_lock); + mutex_destroy(&adev->dm.dc_lock); + +@@ -2160,6 +2255,16 @@ static enum dc_status amdgpu_dm_commit_zero_streams(struct dc *dc) + return res; + } + ++static void hpd_rx_irq_work_suspend(struct amdgpu_display_manager *dm) ++{ ++ int i; ++ ++ if (dm->hpd_rx_offload_wq) { ++ for (i = 0; i < dm->dc->caps.max_links; i++) ++ flush_workqueue(dm->hpd_rx_offload_wq[i].wq); ++ } ++} ++ + static int dm_suspend(void *handle) + { + struct amdgpu_device *adev = handle; +@@ -2181,6 +2286,8 @@ static int dm_suspend(void *handle) + + amdgpu_dm_irq_suspend(adev); + ++ hpd_rx_irq_work_suspend(dm); ++ + return ret; + } + +@@ -2191,6 +2298,8 @@ static int dm_suspend(void *handle) + + amdgpu_dm_irq_suspend(adev); + ++ hpd_rx_irq_work_suspend(dm); ++ + dc_set_power_state(dm->dc, DC_ACPI_CM_POWER_STATE_D3); + + return 0; +@@ -2869,8 +2978,7 @@ static void handle_hpd_irq(void *param) + + } + +- +-static void dm_handle_hpd_rx_irq(struct amdgpu_dm_connector *aconnector) ++static void dm_handle_mst_sideband_msg(struct amdgpu_dm_connector *aconnector) + { + uint8_t esi[DP_PSR_ERROR_STATUS - DP_SINK_COUNT_ESI] = { 0 }; + uint8_t dret; +@@ -2948,6 +3056,25 @@ static void dm_handle_hpd_rx_irq(struct amdgpu_dm_connector *aconnector) + DRM_DEBUG_DRIVER("Loop exceeded max iterations\n"); + } + ++static void schedule_hpd_rx_offload_work(struct hpd_rx_irq_offload_work_queue *offload_wq, ++ union hpd_irq_data hpd_irq_data) ++{ ++ struct hpd_rx_irq_offload_work *offload_work = ++ kzalloc(sizeof(*offload_work), GFP_KERNEL); ++ ++ if (!offload_work) { ++ DRM_ERROR("Failed to allocate hpd_rx_irq_offload_work.\n"); ++ return; ++ } ++ ++ INIT_WORK(&offload_work->work, dm_handle_hpd_rx_offload_work); ++ offload_work->data = hpd_irq_data; ++ offload_work->offload_wq = offload_wq; ++ ++ queue_work(offload_wq->wq, &offload_work->work); ++ DRM_DEBUG_KMS("queue work to handle hpd_rx offload work"); ++} ++ + static void handle_hpd_rx_irq(void *param) + { + struct amdgpu_dm_connector *aconnector = (struct amdgpu_dm_connector *)param; +@@ -2959,14 +3086,16 @@ static void handle_hpd_rx_irq(void *param) + enum dc_connection_type new_connection_type = dc_connection_none; + struct amdgpu_device *adev = drm_to_adev(dev); + union hpd_irq_data hpd_irq_data; +- bool lock_flag = 0; ++ bool link_loss = false; ++ bool has_left_work = false; ++ int idx = aconnector->base.index; ++ struct hpd_rx_irq_offload_work_queue *offload_wq = &adev->dm.hpd_rx_offload_wq[idx]; + + memset(&hpd_irq_data, 0, sizeof(hpd_irq_data)); + + if (adev->dm.disable_hpd_irq) + return; + +- + /* + * TODO:Temporary add mutex to protect hpd interrupt not have a gpio + * conflict, after implement i2c helper, this mutex should be +@@ -2974,43 +3103,41 @@ static void handle_hpd_rx_irq(void *param) + */ + mutex_lock(&aconnector->hpd_lock); + +- read_hpd_rx_irq_data(dc_link, &hpd_irq_data); ++ result = dc_link_handle_hpd_rx_irq(dc_link, &hpd_irq_data, ++ &link_loss, true, &has_left_work); + +- if ((dc_link->cur_link_settings.lane_count != LANE_COUNT_UNKNOWN) || +- (dc_link->type == dc_connection_mst_branch)) { +- if (hpd_irq_data.bytes.device_service_irq.bits.UP_REQ_MSG_RDY) { +- result = true; +- dm_handle_hpd_rx_irq(aconnector); +- goto out; +- } else if (hpd_irq_data.bytes.device_service_irq.bits.DOWN_REP_MSG_RDY) { +- result = false; +- dm_handle_hpd_rx_irq(aconnector); ++ if (!has_left_work) ++ goto out; ++ ++ if (hpd_irq_data.bytes.device_service_irq.bits.AUTOMATED_TEST) { ++ schedule_hpd_rx_offload_work(offload_wq, hpd_irq_data); ++ goto out; ++ } ++ ++ if (dc_link_dp_allow_hpd_rx_irq(dc_link)) { ++ if (hpd_irq_data.bytes.device_service_irq.bits.UP_REQ_MSG_RDY || ++ hpd_irq_data.bytes.device_service_irq.bits.DOWN_REP_MSG_RDY) { ++ dm_handle_mst_sideband_msg(aconnector); + goto out; + } +- } + +- /* +- * TODO: We need the lock to avoid touching DC state while it's being +- * modified during automated compliance testing, or when link loss +- * happens. While this should be split into subhandlers and proper +- * interfaces to avoid having to conditionally lock like this in the +- * outer layer, we need this workaround temporarily to allow MST +- * lightup in some scenarios to avoid timeout. +- */ +- if (!amdgpu_in_reset(adev) && +- (hpd_rx_irq_check_link_loss_status(dc_link, &hpd_irq_data) || +- hpd_irq_data.bytes.device_service_irq.bits.AUTOMATED_TEST)) { +- mutex_lock(&adev->dm.dc_lock); +- lock_flag = 1; +- } ++ if (link_loss) { ++ bool skip = false; + +-#ifdef CONFIG_DRM_AMD_DC_HDCP +- result = dc_link_handle_hpd_rx_irq(dc_link, &hpd_irq_data, NULL); +-#else +- result = dc_link_handle_hpd_rx_irq(dc_link, NULL, NULL); +-#endif +- if (!amdgpu_in_reset(adev) && lock_flag) +- mutex_unlock(&adev->dm.dc_lock); ++ spin_lock(&offload_wq->offload_lock); ++ skip = offload_wq->is_handling_link_loss; ++ ++ if (!skip) ++ offload_wq->is_handling_link_loss = true; ++ ++ spin_unlock(&offload_wq->offload_lock); ++ ++ if (!skip) ++ schedule_hpd_rx_offload_work(offload_wq, hpd_irq_data); ++ ++ goto out; ++ } ++ } + + out: + if (result && !is_mst_root_connector) { +@@ -3095,6 +3222,10 @@ static void register_hpd_handlers(struct amdgpu_device *adev) + amdgpu_dm_irq_register_interrupt(adev, &int_params, + handle_hpd_rx_irq, + (void *) aconnector); ++ ++ if (adev->dm.hpd_rx_offload_wq) ++ adev->dm.hpd_rx_offload_wq[connector->index].aconnector = ++ aconnector; + } + } + } +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +index da87ca77023d..cd059af033b4 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +@@ -171,6 +171,48 @@ struct dal_allocation { + u64 gpu_addr; + }; + ++/** ++ * struct hpd_rx_irq_offload_work_queue - Work queue to handle hpd_rx_irq ++ * offload work ++ */ ++struct hpd_rx_irq_offload_work_queue { ++ /** ++ * @wq: workqueue structure to queue offload work. ++ */ ++ struct workqueue_struct *wq; ++ /** ++ * @offload_lock: To protect fields of offload work queue. ++ */ ++ spinlock_t offload_lock; ++ /** ++ * @is_handling_link_loss: Used to prevent inserting link loss event when ++ * we're handling link loss ++ */ ++ bool is_handling_link_loss; ++ /** ++ * @aconnector: The aconnector that this work queue is attached to ++ */ ++ struct amdgpu_dm_connector *aconnector; ++}; ++ ++/** ++ * struct hpd_rx_irq_offload_work - hpd_rx_irq offload work structure ++ */ ++struct hpd_rx_irq_offload_work { ++ /** ++ * @work: offload work ++ */ ++ struct work_struct work; ++ /** ++ * @data: reference irq data which is used while handling offload work ++ */ ++ union hpd_irq_data data; ++ /** ++ * @offload_wq: offload work queue that this work is queued to ++ */ ++ struct hpd_rx_irq_offload_work_queue *offload_wq; ++}; ++ + /** + * struct amdgpu_display_manager - Central amdgpu display manager device + * +@@ -461,7 +503,12 @@ struct amdgpu_display_manager { + */ + struct crc_rd_work *crc_rd_wrk; + #endif +- ++ /** ++ * @hpd_rx_offload_wq: ++ * ++ * Work queue to offload works of hpd_rx_irq ++ */ ++ struct hpd_rx_irq_offload_work_queue *hpd_rx_offload_wq; + /** + * @mst_encoders: + * +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +index 9b6111eb9ca4..6d5dc5ab3d8c 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +@@ -2075,7 +2075,7 @@ static struct dc_link_settings get_max_link_cap(struct dc_link *link) + return max_link_cap; + } + +-enum dc_status read_hpd_rx_irq_data( ++static enum dc_status read_hpd_rx_irq_data( + struct dc_link *link, + union hpd_irq_data *irq_data) + { +@@ -3257,7 +3257,7 @@ void dc_link_dp_handle_link_loss(struct dc_link *link) + } + } + +-static bool handle_hpd_rx_irq(struct dc_link *link, union hpd_irq_data *out_hpd_irq_dpcd_data, bool *out_link_loss, ++bool dc_link_handle_hpd_rx_irq(struct dc_link *link, union hpd_irq_data *out_hpd_irq_dpcd_data, bool *out_link_loss, + bool defer_handling, bool *has_left_work) + { + union hpd_irq_data hpd_irq_dpcd_data = { { { {0} } } }; +@@ -3379,11 +3379,6 @@ static bool handle_hpd_rx_irq(struct dc_link *link, union hpd_irq_data *out_hpd_ + return status; + } + +-bool dc_link_handle_hpd_rx_irq(struct dc_link *link, union hpd_irq_data *out_hpd_irq_dpcd_data, bool *out_link_loss) +-{ +- return handle_hpd_rx_irq(link, out_hpd_irq_dpcd_data, out_link_loss, false, NULL); +-} +- + /*query dpcd for version and mst cap addresses*/ + bool is_mst_supported(struct dc_link *link) + { +diff --git a/drivers/gpu/drm/amd/display/dc/dc_link.h b/drivers/gpu/drm/amd/display/dc/dc_link.h +index 0efa2bc8639b..9b7c32f7fd86 100644 +--- a/drivers/gpu/drm/amd/display/dc/dc_link.h ++++ b/drivers/gpu/drm/amd/display/dc/dc_link.h +@@ -296,7 +296,8 @@ enum dc_status dc_link_allocate_mst_payload(struct pipe_ctx *pipe_ctx); + * false - no change in Downstream port status. No further action required + * from DM. */ + bool dc_link_handle_hpd_rx_irq(struct dc_link *dc_link, +- union hpd_irq_data *hpd_irq_dpcd_data, bool *out_link_loss); ++ union hpd_irq_data *hpd_irq_dpcd_data, bool *out_link_loss, ++ bool defer_handling, bool *has_left_work); + + /* + * On eDP links this function call will stall until T12 has elapsed. +@@ -305,9 +306,6 @@ bool dc_link_handle_hpd_rx_irq(struct dc_link *dc_link, + */ + bool dc_link_wait_for_t12(struct dc_link *link); + +-enum dc_status read_hpd_rx_irq_data( +- struct dc_link *link, +- union hpd_irq_data *irq_data); + void dc_link_dp_handle_automated_test(struct dc_link *link); + void dc_link_dp_handle_link_loss(struct dc_link *link); + bool dc_link_dp_allow_hpd_rx_irq(const struct dc_link *link); +-- +2.35.1 + diff --git a/queue-5.15/drm-amd-display-ignore-first-mst-sideband-message-re.patch b/queue-5.15/drm-amd-display-ignore-first-mst-sideband-message-re.patch new file mode 100644 index 00000000000..b2eb3038c8b --- /dev/null +++ b/queue-5.15/drm-amd-display-ignore-first-mst-sideband-message-re.patch @@ -0,0 +1,155 @@ +From 7e53e73fde9c46c2f489ea9750db9c4041f9db85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 15:52:46 -0400 +Subject: drm/amd/display: Ignore First MST Sideband Message Return Error + +From: Fangzhi Zuo + +[ Upstream commit acea108fa067d140bd155161a79b1fcd967f4137 ] + +[why] +First MST sideband message returns AUX_RET_ERROR_HPD_DISCON +on certain intel platform. Aux transaction considered failure +if HPD unexpected pulled low. The actual aux transaction success +in such case, hence do not return error. + +[how] +Not returning error when AUX_RET_ERROR_HPD_DISCON detected +on the first sideband message. + +v2: squash in additional DMI entries +v3: squash in static fix + +Signed-off-by: Fangzhi Zuo +Acked-by: Solomon Chiu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 39 +++++++++++++++++++ + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 8 ++++ + .../display/amdgpu_dm/amdgpu_dm_mst_types.c | 17 ++++++++ + 3 files changed, 64 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 873cb0051952..7150afacbc4f 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -70,6 +70,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -1344,6 +1345,41 @@ static bool dm_should_disable_stutter(struct pci_dev *pdev) + return false; + } + ++static const struct dmi_system_id hpd_disconnect_quirk_table[] = { ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Precision 3660"), ++ }, ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Precision 3260"), ++ }, ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Precision 3460"), ++ }, ++ }, ++ {} ++}; ++ ++static void retrieve_dmi_info(struct amdgpu_display_manager *dm) ++{ ++ const struct dmi_system_id *dmi_id; ++ ++ dm->aux_hpd_discon_quirk = false; ++ ++ dmi_id = dmi_first_match(hpd_disconnect_quirk_table); ++ if (dmi_id) { ++ dm->aux_hpd_discon_quirk = true; ++ DRM_INFO("aux_hpd_discon_quirk attached\n"); ++ } ++} ++ + static int amdgpu_dm_init(struct amdgpu_device *adev) + { + struct dc_init_data init_data; +@@ -1435,6 +1471,9 @@ static int amdgpu_dm_init(struct amdgpu_device *adev) + init_data.flags.power_down_display_on_boot = true; + + INIT_LIST_HEAD(&adev->dm.da_list); ++ ++ retrieve_dmi_info(&adev->dm); ++ + /* Display Core create. */ + adev->dm.dc = dc_create(&init_data); + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +index cd059af033b4..f9c3e5a41713 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +@@ -539,6 +539,14 @@ struct amdgpu_display_manager { + * last successfully applied backlight values. + */ + u32 actual_brightness[AMDGPU_DM_MAX_NUM_EDP]; ++ ++ /** ++ * @aux_hpd_discon_quirk: ++ * ++ * quirk for hpd discon while aux is on-going. ++ * occurred on certain intel platform ++ */ ++ bool aux_hpd_discon_quirk; + }; + + enum dsc_clock_force_state { +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +index 74885ff77f96..652cf108b3c2 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +@@ -55,6 +55,8 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux, + ssize_t result = 0; + struct aux_payload payload; + enum aux_return_code_type operation_result; ++ struct amdgpu_device *adev; ++ struct ddc_service *ddc; + + if (WARN_ON(msg->size > 16)) + return -E2BIG; +@@ -71,6 +73,21 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux, + result = dc_link_aux_transfer_raw(TO_DM_AUX(aux)->ddc_service, &payload, + &operation_result); + ++ /* ++ * w/a on certain intel platform where hpd is unexpected to pull low during ++ * 1st sideband message transaction by return AUX_RET_ERROR_HPD_DISCON ++ * aux transaction is succuess in such case, therefore bypass the error ++ */ ++ ddc = TO_DM_AUX(aux)->ddc_service; ++ adev = ddc->ctx->driver_context; ++ if (adev->dm.aux_hpd_discon_quirk) { ++ if (msg->address == DP_SIDEBAND_MSG_DOWN_REQ_BASE && ++ operation_result == AUX_RET_ERROR_HPD_DISCON) { ++ result = 0; ++ operation_result = AUX_RET_SUCCESS; ++ } ++ } ++ + if (payload.write && result >= 0) + result = msg->size; + +-- +2.35.1 + diff --git a/queue-5.15/drm-amd-display-support-for-dmub-hpd-interrupt-handl.patch b/queue-5.15/drm-amd-display-support-for-dmub-hpd-interrupt-handl.patch new file mode 100644 index 00000000000..e89bb67ece9 --- /dev/null +++ b/queue-5.15/drm-amd-display-support-for-dmub-hpd-interrupt-handl.patch @@ -0,0 +1,342 @@ +From 89de16457026db8cb7e619aa7b1b63cd47daaa8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jul 2021 13:55:02 +0800 +Subject: drm/amd/display: Support for DMUB HPD interrupt handling + +From: Jude Shih + +[ Upstream commit e27c41d5b0681c597ac1894f4e02cf626e062250 ] + +[WHY] +To add support for HPD interrupt handling from DMUB. +HPD interrupt could be triggered from outbox1 from DMUB + +[HOW] +1) Use queue_work to handle hpd task from outbox1 + +2) Add handle_hpd_irq_helper to share interrupt handling code +between legacy and DMUB HPD from outbox1 + +3) Added DMUB HPD handling in dmub_srv_stat_get_notification(). +HPD handling callback function and wake up the DMUB thread. + +Reviewed-by: Nicholas Kazlauskas +Acked-by: Qingqing Zhuo +Signed-off-by: Jude Shih +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 171 +++++++++++++++++- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 40 ++++ + 2 files changed, 203 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index d35a6f6d158e..19048f0d83a4 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -215,6 +215,8 @@ static void handle_cursor_update(struct drm_plane *plane, + static const struct drm_format_info * + amd_get_format_info(const struct drm_mode_fb_cmd2 *cmd); + ++static void handle_hpd_irq_helper(struct amdgpu_dm_connector *aconnector); ++ + static bool + is_timing_unchanged_for_freesync(struct drm_crtc_state *old_crtc_state, + struct drm_crtc_state *new_crtc_state); +@@ -618,6 +620,116 @@ static void dm_dcn_vertical_interrupt0_high_irq(void *interrupt_params) + } + #endif + ++/** ++ * dmub_aux_setconfig_reply_callback - Callback for AUX or SET_CONFIG command. ++ * @adev: amdgpu_device pointer ++ * @notify: dmub notification structure ++ * ++ * Dmub AUX or SET_CONFIG command completion processing callback ++ * Copies dmub notification to DM which is to be read by AUX command. ++ * issuing thread and also signals the event to wake up the thread. ++ */ ++void dmub_aux_setconfig_callback(struct amdgpu_device *adev, struct dmub_notification *notify) ++{ ++ if (adev->dm.dmub_notify) ++ memcpy(adev->dm.dmub_notify, notify, sizeof(struct dmub_notification)); ++ if (notify->type == DMUB_NOTIFICATION_AUX_REPLY) ++ complete(&adev->dm.dmub_aux_transfer_done); ++} ++ ++/** ++ * dmub_hpd_callback - DMUB HPD interrupt processing callback. ++ * @adev: amdgpu_device pointer ++ * @notify: dmub notification structure ++ * ++ * Dmub Hpd interrupt processing callback. Gets displayindex through the ++ * ink index and calls helper to do the processing. ++ */ ++void dmub_hpd_callback(struct amdgpu_device *adev, struct dmub_notification *notify) ++{ ++ struct amdgpu_dm_connector *aconnector; ++ struct drm_connector *connector; ++ struct drm_connector_list_iter iter; ++ struct dc_link *link; ++ uint8_t link_index = 0; ++ struct drm_device *dev = adev->dm.ddev; ++ ++ if (adev == NULL) ++ return; ++ ++ if (notify == NULL) { ++ DRM_ERROR("DMUB HPD callback notification was NULL"); ++ return; ++ } ++ ++ if (notify->link_index > adev->dm.dc->link_count) { ++ DRM_ERROR("DMUB HPD index (%u)is abnormal", notify->link_index); ++ return; ++ } ++ ++ drm_modeset_lock(&dev->mode_config.connection_mutex, NULL); ++ ++ link_index = notify->link_index; ++ ++ link = adev->dm.dc->links[link_index]; ++ ++ drm_connector_list_iter_begin(dev, &iter); ++ drm_for_each_connector_iter(connector, &iter) { ++ aconnector = to_amdgpu_dm_connector(connector); ++ if (link && aconnector->dc_link == link) { ++ DRM_INFO("DMUB HPD callback: link_index=%u\n", link_index); ++ handle_hpd_irq_helper(aconnector); ++ break; ++ } ++ } ++ drm_connector_list_iter_end(&iter); ++ drm_modeset_unlock(&dev->mode_config.connection_mutex); ++ ++} ++ ++/** ++ * register_dmub_notify_callback - Sets callback for DMUB notify ++ * @adev: amdgpu_device pointer ++ * @type: Type of dmub notification ++ * @callback: Dmub interrupt callback function ++ * @dmub_int_thread_offload: offload indicator ++ * ++ * API to register a dmub callback handler for a dmub notification ++ * Also sets indicator whether callback processing to be offloaded. ++ * to dmub interrupt handling thread ++ * Return: true if successfully registered, false if there is existing registration ++ */ ++bool register_dmub_notify_callback(struct amdgpu_device *adev, enum dmub_notification_type type, ++dmub_notify_interrupt_callback_t callback, bool dmub_int_thread_offload) ++{ ++ if (callback != NULL && type < ARRAY_SIZE(adev->dm.dmub_thread_offload)) { ++ adev->dm.dmub_callback[type] = callback; ++ adev->dm.dmub_thread_offload[type] = dmub_int_thread_offload; ++ } else ++ return false; ++ ++ return true; ++} ++ ++static void dm_handle_hpd_work(struct work_struct *work) ++{ ++ struct dmub_hpd_work *dmub_hpd_wrk; ++ ++ dmub_hpd_wrk = container_of(work, struct dmub_hpd_work, handle_hpd_work); ++ ++ if (!dmub_hpd_wrk->dmub_notify) { ++ DRM_ERROR("dmub_hpd_wrk dmub_notify is NULL"); ++ return; ++ } ++ ++ if (dmub_hpd_wrk->dmub_notify->type < ARRAY_SIZE(dmub_hpd_wrk->adev->dm.dmub_callback)) { ++ dmub_hpd_wrk->adev->dm.dmub_callback[dmub_hpd_wrk->dmub_notify->type](dmub_hpd_wrk->adev, ++ dmub_hpd_wrk->dmub_notify); ++ } ++ kfree(dmub_hpd_wrk); ++ ++} ++ + #define DMUB_TRACE_MAX_READ 64 + /** + * dm_dmub_outbox1_low_irq() - Handles Outbox interrupt +@@ -634,18 +746,33 @@ static void dm_dmub_outbox1_low_irq(void *interrupt_params) + struct amdgpu_display_manager *dm = &adev->dm; + struct dmcub_trace_buf_entry entry = { 0 }; + uint32_t count = 0; ++ struct dmub_hpd_work *dmub_hpd_wrk; + + if (dc_enable_dmub_notifications(adev->dm.dc)) { ++ dmub_hpd_wrk = kzalloc(sizeof(*dmub_hpd_wrk), GFP_ATOMIC); ++ if (!dmub_hpd_wrk) { ++ DRM_ERROR("Failed to allocate dmub_hpd_wrk"); ++ return; ++ } ++ INIT_WORK(&dmub_hpd_wrk->handle_hpd_work, dm_handle_hpd_work); ++ + if (irq_params->irq_src == DC_IRQ_SOURCE_DMCUB_OUTBOX) { + do { + dc_stat_get_dmub_notification(adev->dm.dc, ¬ify); +- } while (notify.pending_notification); ++ if (notify.type > ARRAY_SIZE(dm->dmub_thread_offload)) { ++ DRM_ERROR("DM: notify type %d larger than the array size %ld !", notify.type, ++ ARRAY_SIZE(dm->dmub_thread_offload)); ++ continue; ++ } ++ if (dm->dmub_thread_offload[notify.type] == true) { ++ dmub_hpd_wrk->dmub_notify = ¬ify; ++ dmub_hpd_wrk->adev = adev; ++ queue_work(adev->dm.delayed_hpd_wq, &dmub_hpd_wrk->handle_hpd_work); ++ } else { ++ dm->dmub_callback[notify.type](adev, ¬ify); ++ } + +- if (adev->dm.dmub_notify) +- memcpy(adev->dm.dmub_notify, ¬ify, sizeof(struct dmub_notification)); +- if (notify.type == DMUB_NOTIFICATION_AUX_REPLY) +- complete(&adev->dm.dmub_aux_transfer_done); +- // TODO : HPD Implementation ++ } while (notify.pending_notification); + + } else { + DRM_ERROR("DM: Failed to receive correct outbox IRQ !"); +@@ -1287,7 +1414,25 @@ static int amdgpu_dm_init(struct amdgpu_device *adev) + DRM_INFO("amdgpu: fail to allocate adev->dm.dmub_notify"); + goto error; + } ++ ++ adev->dm.delayed_hpd_wq = create_singlethread_workqueue("amdgpu_dm_hpd_wq"); ++ if (!adev->dm.delayed_hpd_wq) { ++ DRM_ERROR("amdgpu: failed to create hpd offload workqueue.\n"); ++ goto error; ++ } ++ + amdgpu_dm_outbox_init(adev); ++#if defined(CONFIG_DRM_AMD_DC_DCN) ++ if (!register_dmub_notify_callback(adev, DMUB_NOTIFICATION_AUX_REPLY, ++ dmub_aux_setconfig_callback, false)) { ++ DRM_ERROR("amdgpu: fail to register dmub aux callback"); ++ goto error; ++ } ++ if (!register_dmub_notify_callback(adev, DMUB_NOTIFICATION_HPD, dmub_hpd_callback, true)) { ++ DRM_ERROR("amdgpu: fail to register dmub hpd callback"); ++ goto error; ++ } ++#endif + } + + if (amdgpu_dm_initialize_drm_device(adev)) { +@@ -1369,6 +1514,8 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev) + if (dc_enable_dmub_notifications(adev->dm.dc)) { + kfree(adev->dm.dmub_notify); + adev->dm.dmub_notify = NULL; ++ destroy_workqueue(adev->dm.delayed_hpd_wq); ++ adev->dm.delayed_hpd_wq = NULL; + } + + if (adev->dm.dmub_bo) +@@ -2654,9 +2801,8 @@ void amdgpu_dm_update_connector_after_detect( + dc_sink_release(sink); + } + +-static void handle_hpd_irq(void *param) ++static void handle_hpd_irq_helper(struct amdgpu_dm_connector *aconnector) + { +- struct amdgpu_dm_connector *aconnector = (struct amdgpu_dm_connector *)param; + struct drm_connector *connector = &aconnector->base; + struct drm_device *dev = connector->dev; + enum dc_connection_type new_connection_type = dc_connection_none; +@@ -2715,6 +2861,15 @@ static void handle_hpd_irq(void *param) + + } + ++static void handle_hpd_irq(void *param) ++{ ++ struct amdgpu_dm_connector *aconnector = (struct amdgpu_dm_connector *)param; ++ ++ handle_hpd_irq_helper(aconnector); ++ ++} ++ ++ + static void dm_handle_hpd_rx_irq(struct amdgpu_dm_connector *aconnector) + { + uint8_t esi[DP_PSR_ERROR_STATUS - DP_SINK_COUNT_ESI] = { 0 }; +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +index 46d6e65f6bd4..da87ca77023d 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +@@ -47,6 +47,8 @@ + #define AMDGPU_DM_MAX_CRTC 6 + + #define AMDGPU_DM_MAX_NUM_EDP 2 ++ ++#define AMDGPU_DMUB_NOTIFICATION_MAX 5 + /* + #include "include/amdgpu_dal_power_if.h" + #include "amdgpu_dm_irq.h" +@@ -86,6 +88,21 @@ struct dm_compressor_info { + uint64_t gpu_addr; + }; + ++typedef void (*dmub_notify_interrupt_callback_t)(struct amdgpu_device *adev, struct dmub_notification *notify); ++ ++/** ++ * struct dmub_hpd_work - Handle time consuming work in low priority outbox IRQ ++ * ++ * @handle_hpd_work: Work to be executed in a separate thread to handle hpd_low_irq ++ * @dmub_notify: notification for callback function ++ * @adev: amdgpu_device pointer ++ */ ++struct dmub_hpd_work { ++ struct work_struct handle_hpd_work; ++ struct dmub_notification *dmub_notify; ++ struct amdgpu_device *adev; ++}; ++ + /** + * struct vblank_control_work - Work data for vblank control + * @work: Kernel work data for the work event +@@ -190,8 +207,30 @@ struct amdgpu_display_manager { + */ + struct dmub_srv *dmub_srv; + ++ /** ++ * @dmub_notify: ++ * ++ * Notification from DMUB. ++ */ ++ + struct dmub_notification *dmub_notify; + ++ /** ++ * @dmub_callback: ++ * ++ * Callback functions to handle notification from DMUB. ++ */ ++ ++ dmub_notify_interrupt_callback_t dmub_callback[AMDGPU_DMUB_NOTIFICATION_MAX]; ++ ++ /** ++ * @dmub_thread_offload: ++ * ++ * Flag to indicate if callback is offload. ++ */ ++ ++ bool dmub_thread_offload[AMDGPU_DMUB_NOTIFICATION_MAX]; ++ + /** + * @dmub_fb_info: + * +@@ -439,6 +478,7 @@ struct amdgpu_display_manager { + */ + struct list_head da_list; + struct completion dmub_aux_transfer_done; ++ struct workqueue_struct *delayed_hpd_wq; + + /** + * @brightness: +-- +2.35.1 + diff --git a/queue-5.15/drm-amdgpu-display-add-quirk-handling-for-stutter-mo.patch b/queue-5.15/drm-amdgpu-display-add-quirk-handling-for-stutter-mo.patch new file mode 100644 index 00000000000..0191c9c4145 --- /dev/null +++ b/queue-5.15/drm-amdgpu-display-add-quirk-handling-for-stutter-mo.patch @@ -0,0 +1,76 @@ +From 2c4ae5a412d5e4e41d87b315b58aab54ea2b0635 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Oct 2021 16:45:00 -0400 +Subject: drm/amdgpu/display: add quirk handling for stutter mode + +From: Alex Deucher + +[ Upstream commit 3ce51649cdf23ab463494df2bd6d1e9529ebdc6a ] + +Stutter mode is a power saving feature on GPUs, however at +least one early raven system exhibits stability issues with +it. Add a quirk to disable it for that system. + +Bug: https://bugzilla.kernel.org/show_bug.cgi?id=214417 +Fixes: 005440066f929b ("drm/amdgpu: enable gfxoff again on raven series (v2)") +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 33 +++++++++++++++++++ + 1 file changed, 33 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index ce647302a1ec..873cb0051952 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -1313,6 +1313,37 @@ static struct hpd_rx_irq_offload_work_queue *hpd_rx_irq_create_workqueue(struct + return hpd_rx_offload_wq; + } + ++struct amdgpu_stutter_quirk { ++ u16 chip_vendor; ++ u16 chip_device; ++ u16 subsys_vendor; ++ u16 subsys_device; ++ u8 revision; ++}; ++ ++static const struct amdgpu_stutter_quirk amdgpu_stutter_quirk_list[] = { ++ /* https://bugzilla.kernel.org/show_bug.cgi?id=214417 */ ++ { 0x1002, 0x15dd, 0x1002, 0x15dd, 0xc8 }, ++ { 0, 0, 0, 0, 0 }, ++}; ++ ++static bool dm_should_disable_stutter(struct pci_dev *pdev) ++{ ++ const struct amdgpu_stutter_quirk *p = amdgpu_stutter_quirk_list; ++ ++ while (p && p->chip_device != 0) { ++ if (pdev->vendor == p->chip_vendor && ++ pdev->device == p->chip_device && ++ pdev->subsystem_vendor == p->subsys_vendor && ++ pdev->subsystem_device == p->subsys_device && ++ pdev->revision == p->revision) { ++ return true; ++ } ++ ++p; ++ } ++ return false; ++} ++ + static int amdgpu_dm_init(struct amdgpu_device *adev) + { + struct dc_init_data init_data; +@@ -1421,6 +1452,8 @@ static int amdgpu_dm_init(struct amdgpu_device *adev) + + if (adev->asic_type != CHIP_CARRIZO && adev->asic_type != CHIP_STONEY) + adev->dm.dc->debug.disable_stutter = amdgpu_pp_feature_mask & PP_STUTTER_MODE ? false : true; ++ if (dm_should_disable_stutter(adev->pdev)) ++ adev->dm.dc->debug.disable_stutter = true; + + if (amdgpu_dc_debug_mask & DC_DISABLE_STUTTER) + adev->dm.dc->debug.disable_stutter = true; +-- +2.35.1 + diff --git a/queue-5.15/drm-imx-dcss-add-missing-of_node_put-in-fail-path.patch b/queue-5.15/drm-imx-dcss-add-missing-of_node_put-in-fail-path.patch new file mode 100644 index 00000000000..15618e302e4 --- /dev/null +++ b/queue-5.15/drm-imx-dcss-add-missing-of_node_put-in-fail-path.patch @@ -0,0 +1,47 @@ +From 2c851f804fd84d4fb4a77fa47c34caa8df37aa3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 16:13:37 +0800 +Subject: drm/imx/dcss: Add missing of_node_put() in fail path + +From: Liang He + +[ Upstream commit 02c87df2480ac855d88ee308ce3fa857d9bd55a8 ] + +In dcss_dev_create() and dcss_dev_destroy(), we should call of_node_put() +in fail path or before the dcss's destroy as of_graph_get_port_by_id() has +increased the refcount. + +Fixes: 9021c317b770 ("drm/imx: Add initial support for DCSS on iMX8MQ") +Signed-off-by: Liang He +Reviewed-by: Laurentiu Palcu +Signed-off-by: Laurentiu Palcu +Link: https://patchwork.freedesktop.org/patch/msgid/20220714081337.374761-1-windhl@126.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/imx/dcss/dcss-dev.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/imx/dcss/dcss-dev.c b/drivers/gpu/drm/imx/dcss/dcss-dev.c +index c849533ca83e..3f5750cc2673 100644 +--- a/drivers/gpu/drm/imx/dcss/dcss-dev.c ++++ b/drivers/gpu/drm/imx/dcss/dcss-dev.c +@@ -207,6 +207,7 @@ struct dcss_dev *dcss_dev_create(struct device *dev, bool hdmi_output) + + ret = dcss_submodules_init(dcss); + if (ret) { ++ of_node_put(dcss->of_port); + dev_err(dev, "submodules initialization failed\n"); + goto clks_err; + } +@@ -237,6 +238,8 @@ void dcss_dev_destroy(struct dcss_dev *dcss) + dcss_clocks_disable(dcss); + } + ++ of_node_put(dcss->of_port); ++ + pm_runtime_disable(dcss->dev); + + dcss_submodules_stop(dcss); +-- +2.35.1 + diff --git a/queue-5.15/e1000e-enable-gpt-clock-before-sending-message-to-cs.patch b/queue-5.15/e1000e-enable-gpt-clock-before-sending-message-to-cs.patch new file mode 100644 index 00000000000..e74811b154c --- /dev/null +++ b/queue-5.15/e1000e-enable-gpt-clock-before-sending-message-to-cs.patch @@ -0,0 +1,44 @@ +From 46953750b7ec1694ba9cdc388e56c24b921fc876 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 May 2022 10:09:05 +0300 +Subject: e1000e: Enable GPT clock before sending message to CSME + +From: Sasha Neftin + +[ Upstream commit b49feacbeffc7635cc6692cbcc6a1eae2c17da6f ] + +On corporate (CSME) ADL systems, the Ethernet Controller may stop working +("HW unit hang") after exiting from the s0ix state. The reason is that +CSME misses the message sent by the host. Enabling the dynamic GPT clock +solves this problem. This clock is cleared upon HW initialization. + +Fixes: 3e55d231716e ("e1000e: Add handshake with the CSME to support S0ix") +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=214821 +Reviewed-by: Dima Ruinskiy +Signed-off-by: Sasha Neftin +Tested-by: Chia-Lin Kao (AceLan) +Tested-by: Naama Meir +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e1000e/netdev.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index ce48e630fe55..0fba6ccecf12 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -6499,6 +6499,10 @@ static void e1000e_s0ix_exit_flow(struct e1000_adapter *adapter) + + if (er32(FWSM) & E1000_ICH_FWSM_FW_VALID && + hw->mac.type >= e1000_pch_adp) { ++ /* Keep the GPT clock enabled for CSME */ ++ mac_data = er32(FEXTNVM); ++ mac_data |= BIT(3); ++ ew32(FEXTNVM, mac_data); + /* Request ME unconfigure the device from S0ix */ + mac_data = er32(H2ME); + mac_data &= ~E1000_H2ME_START_DPG; +-- +2.35.1 + diff --git a/queue-5.15/gpio-gpio-xilinx-fix-integer-overflow.patch b/queue-5.15/gpio-gpio-xilinx-fix-integer-overflow.patch new file mode 100644 index 00000000000..aea05517e6a --- /dev/null +++ b/queue-5.15/gpio-gpio-xilinx-fix-integer-overflow.patch @@ -0,0 +1,37 @@ +From f34ac256a9a1a28f11b345f04f2d6b344a40c1df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jul 2022 13:09:09 +0530 +Subject: gpio: gpio-xilinx: Fix integer overflow + +From: Srinivas Neeli + +[ Upstream commit 32c094a09d5829ad9b02cdf667569aefa8de0ea6 ] + +Current implementation is not able to configure more than 32 pins +due to incorrect data type. So type casting with unsigned long +to avoid it. + +Fixes: 02b3f84d9080 ("xilinx: Switch to use bitmap APIs") +Signed-off-by: Srinivas Neeli +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-xilinx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-xilinx.c b/drivers/gpio/gpio-xilinx.c +index a1b66338d077..db616ae560a3 100644 +--- a/drivers/gpio/gpio-xilinx.c ++++ b/drivers/gpio/gpio-xilinx.c +@@ -99,7 +99,7 @@ static inline void xgpio_set_value32(unsigned long *map, int bit, u32 v) + const unsigned long offset = (bit % BITS_PER_LONG) & BIT(5); + + map[index] &= ~(0xFFFFFFFFul << offset); +- map[index] |= v << offset; ++ map[index] |= (unsigned long)v << offset; + } + + static inline int xgpio_regoffset(struct xgpio_instance *chip, int ch) +-- +2.35.1 + diff --git a/queue-5.15/gpio-pca953x-only-use-single-read-write-for-no-ai-mo.patch b/queue-5.15/gpio-pca953x-only-use-single-read-write-for-no-ai-mo.patch new file mode 100644 index 00000000000..444d3f00f9c --- /dev/null +++ b/queue-5.15/gpio-pca953x-only-use-single-read-write-for-no-ai-mo.patch @@ -0,0 +1,48 @@ +From 8df9ec5f7a74d3a95fa83c7b06c66a2950609f95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 16:31:41 +0800 +Subject: gpio: pca953x: only use single read/write for No AI mode + +From: Haibo Chen + +[ Upstream commit db8edaa09d7461ec08672a92a2eef63d5882bb79 ] + +For the device use NO AI mode(not support auto address increment), +only use the single read/write when config the regmap. + +We meet issue on PCA9557PW on i.MX8QXP/DXL evk board, this device +do not support AI mode, but when do the regmap sync, regmap will +sync 3 byte data to register 1, logically this means write first +data to register 1, write second data to register 2, write third data +to register 3. But this device do not support AI mode, finally, these +three data write only into register 1 one by one. the reault is the +value of register 1 alway equal to the latest data, here is the third +data, no operation happened on register 2 and register 3. This is +not what we expect. + +Fixes: 49427232764d ("gpio: pca953x: Perform basic regmap conversion") +Signed-off-by: Haibo Chen +Reviewed-by: Andy Shevchenko +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-pca953x.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c +index 33683295a0bf..f334c8556a22 100644 +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -351,6 +351,9 @@ static const struct regmap_config pca953x_i2c_regmap = { + .reg_bits = 8, + .val_bits = 8, + ++ .use_single_read = true, ++ .use_single_write = true, ++ + .readable_reg = pca953x_readable_register, + .writeable_reg = pca953x_writeable_register, + .volatile_reg = pca953x_volatile_register, +-- +2.35.1 + diff --git a/queue-5.15/gpio-pca953x-use-the-correct-range-when-do-regmap-sy.patch b/queue-5.15/gpio-pca953x-use-the-correct-range-when-do-regmap-sy.patch new file mode 100644 index 00000000000..5175fe7f819 --- /dev/null +++ b/queue-5.15/gpio-pca953x-use-the-correct-range-when-do-regmap-sy.patch @@ -0,0 +1,85 @@ +From f64db8728971ee048a91ffcec701e71eab85f560 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 16:31:42 +0800 +Subject: gpio: pca953x: use the correct range when do regmap sync + +From: Haibo Chen + +[ Upstream commit 2abc17a93867dc816f0ed9d32021dda8078e7330 ] + +regmap will sync a range of registers, here use the correct range +to make sure the sync do not touch other unexpected registers. + +Find on pca9557pw on imx8qxp/dxl evk board, this device support +8 pin, so only need one register(8 bits) to cover all the 8 pins's +property setting. But when sync the output, we find it actually +update two registers, output register and the following register. + +Fixes: b76574300504 ("gpio: pca953x: Restore registers after suspend/resume cycle") +Fixes: ec82d1eba346 ("gpio: pca953x: Zap ad-hoc reg_output cache") +Fixes: 0f25fda840a9 ("gpio: pca953x: Zap ad-hoc reg_direction cache") +Signed-off-by: Haibo Chen +Reviewed-by: Andy Shevchenko +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-pca953x.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c +index f334c8556a22..60b7616dd4aa 100644 +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -900,12 +900,12 @@ static int device_pca95xx_init(struct pca953x_chip *chip, u32 invert) + int ret; + + ret = regcache_sync_region(chip->regmap, chip->regs->output, +- chip->regs->output + NBANK(chip)); ++ chip->regs->output + NBANK(chip) - 1); + if (ret) + goto out; + + ret = regcache_sync_region(chip->regmap, chip->regs->direction, +- chip->regs->direction + NBANK(chip)); ++ chip->regs->direction + NBANK(chip) - 1); + if (ret) + goto out; + +@@ -1118,14 +1118,14 @@ static int pca953x_regcache_sync(struct device *dev) + * sync these registers first and only then sync the rest. + */ + regaddr = pca953x_recalc_addr(chip, chip->regs->direction, 0); +- ret = regcache_sync_region(chip->regmap, regaddr, regaddr + NBANK(chip)); ++ ret = regcache_sync_region(chip->regmap, regaddr, regaddr + NBANK(chip) - 1); + if (ret) { + dev_err(dev, "Failed to sync GPIO dir registers: %d\n", ret); + return ret; + } + + regaddr = pca953x_recalc_addr(chip, chip->regs->output, 0); +- ret = regcache_sync_region(chip->regmap, regaddr, regaddr + NBANK(chip)); ++ ret = regcache_sync_region(chip->regmap, regaddr, regaddr + NBANK(chip) - 1); + if (ret) { + dev_err(dev, "Failed to sync GPIO out registers: %d\n", ret); + return ret; +@@ -1135,7 +1135,7 @@ static int pca953x_regcache_sync(struct device *dev) + if (chip->driver_data & PCA_PCAL) { + regaddr = pca953x_recalc_addr(chip, PCAL953X_IN_LATCH, 0); + ret = regcache_sync_region(chip->regmap, regaddr, +- regaddr + NBANK(chip)); ++ regaddr + NBANK(chip) - 1); + if (ret) { + dev_err(dev, "Failed to sync INT latch registers: %d\n", + ret); +@@ -1144,7 +1144,7 @@ static int pca953x_regcache_sync(struct device *dev) + + regaddr = pca953x_recalc_addr(chip, PCAL953X_INT_MASK, 0); + ret = regcache_sync_region(chip->regmap, regaddr, +- regaddr + NBANK(chip)); ++ regaddr + NBANK(chip) - 1); + if (ret) { + dev_err(dev, "Failed to sync INT mask registers: %d\n", + ret); +-- +2.35.1 + diff --git a/queue-5.15/gpio-pca953x-use-the-correct-register-address-when-r.patch b/queue-5.15/gpio-pca953x-use-the-correct-register-address-when-r.patch new file mode 100644 index 00000000000..bec946fa808 --- /dev/null +++ b/queue-5.15/gpio-pca953x-use-the-correct-register-address-when-r.patch @@ -0,0 +1,53 @@ +From c12dac4d28c60721ab8de7d3b03d1e028251ad33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 16:31:43 +0800 +Subject: gpio: pca953x: use the correct register address when regcache sync + during init + +From: Haibo Chen + +[ Upstream commit b8c768ccdd8338504fb78370747728d5002b1b5a ] + +For regcache_sync_region, we need to use pca953x_recalc_addr() to get +the real register address. + +Fixes: ec82d1eba346 ("gpio: pca953x: Zap ad-hoc reg_output cache") +Fixes: 0f25fda840a9 ("gpio: pca953x: Zap ad-hoc reg_direction cache") +Signed-off-by: Haibo Chen +Reviewed-by: Andy Shevchenko +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-pca953x.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c +index 60b7616dd4aa..64befd6f702b 100644 +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -897,15 +897,18 @@ static int pca953x_irq_setup(struct pca953x_chip *chip, + static int device_pca95xx_init(struct pca953x_chip *chip, u32 invert) + { + DECLARE_BITMAP(val, MAX_LINE); ++ u8 regaddr; + int ret; + +- ret = regcache_sync_region(chip->regmap, chip->regs->output, +- chip->regs->output + NBANK(chip) - 1); ++ regaddr = pca953x_recalc_addr(chip, chip->regs->output, 0); ++ ret = regcache_sync_region(chip->regmap, regaddr, ++ regaddr + NBANK(chip) - 1); + if (ret) + goto out; + +- ret = regcache_sync_region(chip->regmap, chip->regs->direction, +- chip->regs->direction + NBANK(chip) - 1); ++ regaddr = pca953x_recalc_addr(chip, chip->regs->direction, 0); ++ ret = regcache_sync_region(chip->regmap, regaddr, ++ regaddr + NBANK(chip) - 1); + if (ret) + goto out; + +-- +2.35.1 + diff --git a/queue-5.15/i2c-cadence-change-large-transfer-count-reset-logic-.patch b/queue-5.15/i2c-cadence-change-large-transfer-count-reset-logic-.patch new file mode 100644 index 00000000000..a1e91efbc4e --- /dev/null +++ b/queue-5.15/i2c-cadence-change-large-transfer-count-reset-logic-.patch @@ -0,0 +1,111 @@ +From c3f859e75713975740c8649ab190552b0dd6a1c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jun 2022 17:29:19 -0600 +Subject: i2c: cadence: Change large transfer count reset logic to be + unconditional + +From: Robert Hancock + +[ Upstream commit 4ca8ca873d454635c20d508261bfc0081af75cf8 ] + +Problems were observed on the Xilinx ZynqMP platform with large I2C reads. +When a read of 277 bytes was performed, the controller NAKed the transfer +after only 252 bytes were transferred and returned an ENXIO error on the +transfer. + +There is some code in cdns_i2c_master_isr to handle this case by resetting +the transfer count in the controller before it reaches 0, to allow larger +transfers to work, but it was conditional on the CDNS_I2C_BROKEN_HOLD_BIT +quirk being set on the controller, and ZynqMP uses the r1p14 version of +the core where this quirk is not being set. The requirement to do this to +support larger reads seems like an inherently required workaround due to +the core only having an 8-bit transfer size register, so it does not +appear that this should be conditional on the broken HOLD bit quirk which +is used elsewhere in the driver. + +Remove the dependency on the CDNS_I2C_BROKEN_HOLD_BIT for this transfer +size reset logic to fix this problem. + +Fixes: 63cab195bf49 ("i2c: removed work arounds in i2c driver for Zynq Ultrascale+ MPSoC") +Signed-off-by: Robert Hancock +Reviewed-by: Shubhrajyoti Datta +Acked-by: Michal Simek +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-cadence.c | 30 +++++------------------------- + 1 file changed, 5 insertions(+), 25 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c +index 3d6f8ee355bf..630cfa4ddd46 100644 +--- a/drivers/i2c/busses/i2c-cadence.c ++++ b/drivers/i2c/busses/i2c-cadence.c +@@ -388,9 +388,9 @@ static irqreturn_t cdns_i2c_slave_isr(void *ptr) + */ + static irqreturn_t cdns_i2c_master_isr(void *ptr) + { +- unsigned int isr_status, avail_bytes, updatetx; ++ unsigned int isr_status, avail_bytes; + unsigned int bytes_to_send; +- bool hold_quirk; ++ bool updatetx; + struct cdns_i2c *id = ptr; + /* Signal completion only after everything is updated */ + int done_flag = 0; +@@ -410,11 +410,7 @@ static irqreturn_t cdns_i2c_master_isr(void *ptr) + * Check if transfer size register needs to be updated again for a + * large data receive operation. + */ +- updatetx = 0; +- if (id->recv_count > id->curr_recv_count) +- updatetx = 1; +- +- hold_quirk = (id->quirks & CDNS_I2C_BROKEN_HOLD_BIT) && updatetx; ++ updatetx = id->recv_count > id->curr_recv_count; + + /* When receiving, handle data interrupt and completion interrupt */ + if (id->p_recv_buf && +@@ -445,7 +441,7 @@ static irqreturn_t cdns_i2c_master_isr(void *ptr) + break; + } + +- if (cdns_is_holdquirk(id, hold_quirk)) ++ if (cdns_is_holdquirk(id, updatetx)) + break; + } + +@@ -456,7 +452,7 @@ static irqreturn_t cdns_i2c_master_isr(void *ptr) + * maintain transfer size non-zero while performing a large + * receive operation. + */ +- if (cdns_is_holdquirk(id, hold_quirk)) { ++ if (cdns_is_holdquirk(id, updatetx)) { + /* wait while fifo is full */ + while (cdns_i2c_readreg(CDNS_I2C_XFER_SIZE_OFFSET) != + (id->curr_recv_count - CDNS_I2C_FIFO_DEPTH)) +@@ -478,22 +474,6 @@ static irqreturn_t cdns_i2c_master_isr(void *ptr) + CDNS_I2C_XFER_SIZE_OFFSET); + id->curr_recv_count = id->recv_count; + } +- } else if (id->recv_count && !hold_quirk && +- !id->curr_recv_count) { +- +- /* Set the slave address in address register*/ +- cdns_i2c_writereg(id->p_msg->addr & CDNS_I2C_ADDR_MASK, +- CDNS_I2C_ADDR_OFFSET); +- +- if (id->recv_count > CDNS_I2C_TRANSFER_SIZE) { +- cdns_i2c_writereg(CDNS_I2C_TRANSFER_SIZE, +- CDNS_I2C_XFER_SIZE_OFFSET); +- id->curr_recv_count = CDNS_I2C_TRANSFER_SIZE; +- } else { +- cdns_i2c_writereg(id->recv_count, +- CDNS_I2C_XFER_SIZE_OFFSET); +- id->curr_recv_count = id->recv_count; +- } + } + + /* Clear hold (if not repeated start) and signal completion */ +-- +2.35.1 + diff --git a/queue-5.15/i2c-mlxcpld-fix-register-setting-for-400khz-frequenc.patch b/queue-5.15/i2c-mlxcpld-fix-register-setting-for-400khz-frequenc.patch new file mode 100644 index 00000000000..b4e93573eec --- /dev/null +++ b/queue-5.15/i2c-mlxcpld-fix-register-setting-for-400khz-frequenc.patch @@ -0,0 +1,35 @@ +From 89e6e3beb7772fea27a7ccf136aa35782b61b5da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 12:14:05 +0300 +Subject: i2c: mlxcpld: Fix register setting for 400KHz frequency + +From: Vadim Pasternak + +[ Upstream commit e1f77ecc75aaee6bed04e8fd7830e00032af012e ] + +Fix setting of 'Half Cycle' register for 400KHz frequency. + +Fixes: fa1049135c15 ("i2c: mlxcpld: Modify register setting for 400KHz frequency") +Signed-off-by: Vadim Pasternak +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mlxcpld.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-mlxcpld.c b/drivers/i2c/busses/i2c-mlxcpld.c +index 015e11c4663f..077d716c73ca 100644 +--- a/drivers/i2c/busses/i2c-mlxcpld.c ++++ b/drivers/i2c/busses/i2c-mlxcpld.c +@@ -49,7 +49,7 @@ + #define MLXCPLD_LPCI2C_NACK_IND 2 + + #define MLXCPLD_I2C_FREQ_1000KHZ_SET 0x04 +-#define MLXCPLD_I2C_FREQ_400KHZ_SET 0x0c ++#define MLXCPLD_I2C_FREQ_400KHZ_SET 0x0e + #define MLXCPLD_I2C_FREQ_100KHZ_SET 0x42 + + enum mlxcpld_i2c_frequency { +-- +2.35.1 + diff --git a/queue-5.15/i40e-fix-erroneous-adapter-reinitialization-during-r.patch b/queue-5.15/i40e-fix-erroneous-adapter-reinitialization-during-r.patch new file mode 100644 index 00000000000..f4b7a4bc647 --- /dev/null +++ b/queue-5.15/i40e-fix-erroneous-adapter-reinitialization-during-r.patch @@ -0,0 +1,83 @@ +From 9f97b5062a427b26986ada6ea1dfd736ac53cc48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 14:45:41 -0700 +Subject: i40e: Fix erroneous adapter reinitialization during recovery process + +From: Dawid Lukwinski + +[ Upstream commit f838a63369818faadec4ad1736cfbd20ab5da00e ] + +Fix an issue when driver incorrectly detects state +of recovery process and erroneously reinitializes interrupts, +which results in a kernel error and call trace message. + +The issue was caused by a combination of two factors: +1. Assuming the EMP reset issued after completing +firmware recovery means the whole recovery process is complete. +2. Erroneous reinitialization of interrupt vector after detecting +the above mentioned EMP reset. + +Fixes (1) by changing how recovery state change is detected +and (2) by adjusting the conditional expression to ensure using proper +interrupt reinitialization method, depending on the situation. + +Fixes: 4ff0ee1af016 ("i40e: Introduce recovery mode support") +Signed-off-by: Dawid Lukwinski +Signed-off-by: Jan Sokolowski +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20220715214542.2968762-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 02594e4d6258..c801b128e5b2 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -10631,7 +10631,7 @@ static int i40e_reset(struct i40e_pf *pf) + **/ + static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired) + { +- int old_recovery_mode_bit = test_bit(__I40E_RECOVERY_MODE, pf->state); ++ const bool is_recovery_mode_reported = i40e_check_recovery_mode(pf); + struct i40e_vsi *vsi = pf->vsi[pf->lan_vsi]; + struct i40e_hw *hw = &pf->hw; + i40e_status ret; +@@ -10639,13 +10639,11 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired) + int v; + + if (test_bit(__I40E_EMP_RESET_INTR_RECEIVED, pf->state) && +- i40e_check_recovery_mode(pf)) { ++ is_recovery_mode_reported) + i40e_set_ethtool_ops(pf->vsi[pf->lan_vsi]->netdev); +- } + + if (test_bit(__I40E_DOWN, pf->state) && +- !test_bit(__I40E_RECOVERY_MODE, pf->state) && +- !old_recovery_mode_bit) ++ !test_bit(__I40E_RECOVERY_MODE, pf->state)) + goto clear_recovery; + dev_dbg(&pf->pdev->dev, "Rebuilding internal switch\n"); + +@@ -10672,13 +10670,12 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired) + * accordingly with regard to resources initialization + * and deinitialization + */ +- if (test_bit(__I40E_RECOVERY_MODE, pf->state) || +- old_recovery_mode_bit) { ++ if (test_bit(__I40E_RECOVERY_MODE, pf->state)) { + if (i40e_get_capabilities(pf, + i40e_aqc_opc_list_func_capabilities)) + goto end_unlock; + +- if (test_bit(__I40E_RECOVERY_MODE, pf->state)) { ++ if (is_recovery_mode_reported) { + /* we're staying in recovery mode so we'll reinitialize + * misc vector here + */ +-- +2.35.1 + diff --git a/queue-5.15/iavf-fix-handling-of-dummy-receive-descriptors.patch b/queue-5.15/iavf-fix-handling-of-dummy-receive-descriptors.patch new file mode 100644 index 00000000000..99d98ab70be --- /dev/null +++ b/queue-5.15/iavf-fix-handling-of-dummy-receive-descriptors.patch @@ -0,0 +1,48 @@ +From e121f5d259c2dbf1f9c67bbc66661c0a2206e454 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jun 2022 17:33:01 -0700 +Subject: iavf: Fix handling of dummy receive descriptors + +From: Przemyslaw Patynowski + +[ Upstream commit a9f49e0060301a9bfebeca76739158d0cf91cdf6 ] + +Fix memory leak caused by not handling dummy receive descriptor properly. +iavf_get_rx_buffer now sets the rx_buffer return value for dummy receive +descriptors. Without this patch, when the hardware writes a dummy +descriptor, iavf would not free the page allocated for the previous receive +buffer. This is an unlikely event but can still happen. + +[Jesse: massaged commit message] + +Fixes: efa14c398582 ("iavf: allow null RX descriptors") +Signed-off-by: Przemyslaw Patynowski +Signed-off-by: Jesse Brandeburg +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_txrx.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_txrx.c b/drivers/net/ethernet/intel/iavf/iavf_txrx.c +index 3525eab8e9f9..5448ed0e0357 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_txrx.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_txrx.c +@@ -1250,11 +1250,10 @@ static struct iavf_rx_buffer *iavf_get_rx_buffer(struct iavf_ring *rx_ring, + { + struct iavf_rx_buffer *rx_buffer; + +- if (!size) +- return NULL; +- + rx_buffer = &rx_ring->rx_bi[rx_ring->next_to_clean]; + prefetchw(rx_buffer->page); ++ if (!size) ++ return rx_buffer; + + /* we are reusing so sync this buffer for CPU use */ + dma_sync_single_range_for_cpu(rx_ring->dev, +-- +2.35.1 + diff --git a/queue-5.15/igc-reinstate-igc_removed-logic-and-implement-it-pro.patch b/queue-5.15/igc-reinstate-igc_removed-logic-and-implement-it-pro.patch new file mode 100644 index 00000000000..b7e4328461f --- /dev/null +++ b/queue-5.15/igc-reinstate-igc_removed-logic-and-implement-it-pro.patch @@ -0,0 +1,119 @@ +From 6a0ca97c0eb48024b0623220f9b21d33723adf4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 18:58:11 +0300 +Subject: igc: Reinstate IGC_REMOVED logic and implement it properly + +From: Lennert Buytenhek + +[ Upstream commit 7c1ddcee5311f3315096217881d2dbe47cc683f9 ] + +The initially merged version of the igc driver code (via commit +146740f9abc4, "igc: Add support for PF") contained the following +IGC_REMOVED checks in the igc_rd32/wr32() MMIO accessors: + + u32 igc_rd32(struct igc_hw *hw, u32 reg) + { + u8 __iomem *hw_addr = READ_ONCE(hw->hw_addr); + u32 value = 0; + + if (IGC_REMOVED(hw_addr)) + return ~value; + + value = readl(&hw_addr[reg]); + + /* reads should not return all F's */ + if (!(~value) && (!reg || !(~readl(hw_addr)))) + hw->hw_addr = NULL; + + return value; + } + +And: + + #define wr32(reg, val) \ + do { \ + u8 __iomem *hw_addr = READ_ONCE((hw)->hw_addr); \ + if (!IGC_REMOVED(hw_addr)) \ + writel((val), &hw_addr[(reg)]); \ + } while (0) + +E.g. igb has similar checks in its MMIO accessors, and has a similar +macro E1000_REMOVED, which is implemented as follows: + + #define E1000_REMOVED(h) unlikely(!(h)) + +These checks serve to detect and take note of an 0xffffffff MMIO read +return from the device, which can be caused by a PCIe link flap or some +other kind of PCI bus error, and to avoid performing MMIO reads and +writes from that point onwards. + +However, the IGC_REMOVED macro was not originally implemented: + + #ifndef IGC_REMOVED + #define IGC_REMOVED(a) (0) + #endif /* IGC_REMOVED */ + +This led to the IGC_REMOVED logic to be removed entirely in a +subsequent commit (commit 3c215fb18e70, "igc: remove IGC_REMOVED +function"), with the rationale that such checks matter only for +virtualization and that igc does not support virtualization -- but a +PCIe device can become detached even without virtualization being in +use, and without proper checks, a PCIe bus error affecting an igc +adapter will lead to various NULL pointer dereferences, as the first +access after the error will set hw->hw_addr to NULL, and subsequent +accesses will blindly dereference this now-NULL pointer. + +This patch reinstates the IGC_REMOVED checks in igc_rd32/wr32(), and +implements IGC_REMOVED the way it is done for igb, by checking for the +unlikely() case of hw_addr being NULL. This change prevents the oopses +seen when a PCIe link flap occurs on an igc adapter. + +Fixes: 146740f9abc4 ("igc: Add support for PF") +Signed-off-by: Lennert Buytenhek +Tested-by: Naama Meir +Acked-by: Sasha Neftin +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_main.c | 3 +++ + drivers/net/ethernet/intel/igc/igc_regs.h | 5 ++++- + 2 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c +index f99819fc559d..2a84f57ea68b 100644 +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -6159,6 +6159,9 @@ u32 igc_rd32(struct igc_hw *hw, u32 reg) + u8 __iomem *hw_addr = READ_ONCE(hw->hw_addr); + u32 value = 0; + ++ if (IGC_REMOVED(hw_addr)) ++ return ~value; ++ + value = readl(&hw_addr[reg]); + + /* reads should not return all F's */ +diff --git a/drivers/net/ethernet/intel/igc/igc_regs.h b/drivers/net/ethernet/intel/igc/igc_regs.h +index e197a33d93a0..026c3b65fc37 100644 +--- a/drivers/net/ethernet/intel/igc/igc_regs.h ++++ b/drivers/net/ethernet/intel/igc/igc_regs.h +@@ -306,7 +306,8 @@ u32 igc_rd32(struct igc_hw *hw, u32 reg); + #define wr32(reg, val) \ + do { \ + u8 __iomem *hw_addr = READ_ONCE((hw)->hw_addr); \ +- writel((val), &hw_addr[(reg)]); \ ++ if (!IGC_REMOVED(hw_addr)) \ ++ writel((val), &hw_addr[(reg)]); \ + } while (0) + + #define rd32(reg) (igc_rd32(hw, reg)) +@@ -318,4 +319,6 @@ do { \ + + #define array_rd32(reg, offset) (igc_rd32(hw, (reg) + ((offset) << 2))) + ++#define IGC_REMOVED(h) unlikely(!(h)) ++ + #endif +-- +2.35.1 + diff --git a/queue-5.15/igmp-fix-a-data-race-around-sysctl_igmp_max_membersh.patch b/queue-5.15/igmp-fix-a-data-race-around-sysctl_igmp_max_membersh.patch new file mode 100644 index 00000000000..df43b5e0cbd --- /dev/null +++ b/queue-5.15/igmp-fix-a-data-race-around-sysctl_igmp_max_membersh.patch @@ -0,0 +1,36 @@ +From c439f61c56a2bf9f1bb642c0f1fb383db4795576 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 10:17:42 -0700 +Subject: igmp: Fix a data-race around sysctl_igmp_max_memberships. + +From: Kuniyuki Iwashima + +[ Upstream commit 6305d821e3b9b5379d348528e5b5faf316383bc2 ] + +While reading sysctl_igmp_max_memberships, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/igmp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c +index ccfbc0a8f11c..8920ae3751d1 100644 +--- a/net/ipv4/igmp.c ++++ b/net/ipv4/igmp.c +@@ -2197,7 +2197,7 @@ static int __ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr, + count++; + } + err = -ENOBUFS; +- if (count >= net->ipv4.sysctl_igmp_max_memberships) ++ if (count >= READ_ONCE(net->ipv4.sysctl_igmp_max_memberships)) + goto done; + iml = sock_kmalloc(sk, sizeof(*iml), GFP_KERNEL); + if (!iml) +-- +2.35.1 + diff --git a/queue-5.15/igmp-fix-data-races-around-sysctl_igmp_llm_reports.patch b/queue-5.15/igmp-fix-data-races-around-sysctl_igmp_llm_reports.patch new file mode 100644 index 00000000000..4cc214277e7 --- /dev/null +++ b/queue-5.15/igmp-fix-data-races-around-sysctl_igmp_llm_reports.patch @@ -0,0 +1,110 @@ +From 436346228848db6a92fbf81012f2ac71d436c0c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 10:17:41 -0700 +Subject: igmp: Fix data-races around sysctl_igmp_llm_reports. + +From: Kuniyuki Iwashima + +[ Upstream commit f6da2267e71106474fbc0943dc24928b9cb79119 ] + +While reading sysctl_igmp_llm_reports, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +This test can be packed into a helper, so such changes will be in the +follow-up series after net is merged into net-next. + + if (ipv4_is_local_multicast(pmc->multiaddr) && + !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) + +Fixes: df2cf4a78e48 ("IGMP: Inhibit reports for local multicast groups") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/igmp.c | 21 +++++++++++++-------- + 1 file changed, 13 insertions(+), 8 deletions(-) + +diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c +index 930f6c41f519..ccfbc0a8f11c 100644 +--- a/net/ipv4/igmp.c ++++ b/net/ipv4/igmp.c +@@ -467,7 +467,8 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc, + + if (pmc->multiaddr == IGMP_ALL_HOSTS) + return skb; +- if (ipv4_is_local_multicast(pmc->multiaddr) && !net->ipv4.sysctl_igmp_llm_reports) ++ if (ipv4_is_local_multicast(pmc->multiaddr) && ++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) + return skb; + + mtu = READ_ONCE(dev->mtu); +@@ -593,7 +594,7 @@ static int igmpv3_send_report(struct in_device *in_dev, struct ip_mc_list *pmc) + if (pmc->multiaddr == IGMP_ALL_HOSTS) + continue; + if (ipv4_is_local_multicast(pmc->multiaddr) && +- !net->ipv4.sysctl_igmp_llm_reports) ++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) + continue; + spin_lock_bh(&pmc->lock); + if (pmc->sfcount[MCAST_EXCLUDE]) +@@ -736,7 +737,8 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc, + if (type == IGMPV3_HOST_MEMBERSHIP_REPORT) + return igmpv3_send_report(in_dev, pmc); + +- if (ipv4_is_local_multicast(group) && !net->ipv4.sysctl_igmp_llm_reports) ++ if (ipv4_is_local_multicast(group) && ++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) + return 0; + + if (type == IGMP_HOST_LEAVE_MESSAGE) +@@ -920,7 +922,8 @@ static bool igmp_heard_report(struct in_device *in_dev, __be32 group) + + if (group == IGMP_ALL_HOSTS) + return false; +- if (ipv4_is_local_multicast(group) && !net->ipv4.sysctl_igmp_llm_reports) ++ if (ipv4_is_local_multicast(group) && ++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) + return false; + + rcu_read_lock(); +@@ -1045,7 +1048,7 @@ static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb, + if (im->multiaddr == IGMP_ALL_HOSTS) + continue; + if (ipv4_is_local_multicast(im->multiaddr) && +- !net->ipv4.sysctl_igmp_llm_reports) ++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) + continue; + spin_lock_bh(&im->lock); + if (im->tm_running) +@@ -1296,7 +1299,8 @@ static void __igmp_group_dropped(struct ip_mc_list *im, gfp_t gfp) + #ifdef CONFIG_IP_MULTICAST + if (im->multiaddr == IGMP_ALL_HOSTS) + return; +- if (ipv4_is_local_multicast(im->multiaddr) && !net->ipv4.sysctl_igmp_llm_reports) ++ if (ipv4_is_local_multicast(im->multiaddr) && ++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) + return; + + reporter = im->reporter; +@@ -1338,7 +1342,8 @@ static void igmp_group_added(struct ip_mc_list *im) + #ifdef CONFIG_IP_MULTICAST + if (im->multiaddr == IGMP_ALL_HOSTS) + return; +- if (ipv4_is_local_multicast(im->multiaddr) && !net->ipv4.sysctl_igmp_llm_reports) ++ if (ipv4_is_local_multicast(im->multiaddr) && ++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) + return; + + if (in_dev->dead) +@@ -1642,7 +1647,7 @@ static void ip_mc_rejoin_groups(struct in_device *in_dev) + if (im->multiaddr == IGMP_ALL_HOSTS) + continue; + if (ipv4_is_local_multicast(im->multiaddr) && +- !net->ipv4.sysctl_igmp_llm_reports) ++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) + continue; + + /* a failover is happening and switches +-- +2.35.1 + diff --git a/queue-5.15/igmp-fix-data-races-around-sysctl_igmp_max_msf.patch b/queue-5.15/igmp-fix-data-races-around-sysctl_igmp_max_msf.patch new file mode 100644 index 00000000000..cf265457cae --- /dev/null +++ b/queue-5.15/igmp-fix-data-races-around-sysctl_igmp_max_msf.patch @@ -0,0 +1,68 @@ +From 6a3f18fcf5d4aa447f933aa91a1e6887938ef3e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 10:17:43 -0700 +Subject: igmp: Fix data-races around sysctl_igmp_max_msf. + +From: Kuniyuki Iwashima + +[ Upstream commit 6ae0f2e553737b8cce49a1372573c81130ffa80e ] + +While reading sysctl_igmp_max_msf, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/igmp.c | 2 +- + net/ipv4/ip_sockglue.c | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c +index 8920ae3751d1..9f4674244aff 100644 +--- a/net/ipv4/igmp.c ++++ b/net/ipv4/igmp.c +@@ -2384,7 +2384,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct + } + /* else, add a new source to the filter */ + +- if (psl && psl->sl_count >= net->ipv4.sysctl_igmp_max_msf) { ++ if (psl && psl->sl_count >= READ_ONCE(net->ipv4.sysctl_igmp_max_msf)) { + err = -ENOBUFS; + goto done; + } +diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c +index 8268e427f889..38f296afb663 100644 +--- a/net/ipv4/ip_sockglue.c ++++ b/net/ipv4/ip_sockglue.c +@@ -782,7 +782,7 @@ static int ip_set_mcast_msfilter(struct sock *sk, sockptr_t optval, int optlen) + /* numsrc >= (4G-140)/128 overflow in 32 bits */ + err = -ENOBUFS; + if (gsf->gf_numsrc >= 0x1ffffff || +- gsf->gf_numsrc > sock_net(sk)->ipv4.sysctl_igmp_max_msf) ++ gsf->gf_numsrc > READ_ONCE(sock_net(sk)->ipv4.sysctl_igmp_max_msf)) + goto out_free_gsf; + + err = -EINVAL; +@@ -832,7 +832,7 @@ static int compat_ip_set_mcast_msfilter(struct sock *sk, sockptr_t optval, + + /* numsrc >= (4G-140)/128 overflow in 32 bits */ + err = -ENOBUFS; +- if (n > sock_net(sk)->ipv4.sysctl_igmp_max_msf) ++ if (n > READ_ONCE(sock_net(sk)->ipv4.sysctl_igmp_max_msf)) + goto out_free_gsf; + err = set_mcast_msfilter(sk, gf32->gf_interface, n, gf32->gf_fmode, + &gf32->gf_group, gf32->gf_slist_flex); +@@ -1242,7 +1242,7 @@ static int do_ip_setsockopt(struct sock *sk, int level, int optname, + } + /* numsrc >= (1G-4) overflow in 32 bits */ + if (msf->imsf_numsrc >= 0x3ffffffcU || +- msf->imsf_numsrc > net->ipv4.sysctl_igmp_max_msf) { ++ msf->imsf_numsrc > READ_ONCE(net->ipv4.sysctl_igmp_max_msf)) { + kfree(msf); + err = -ENOBUFS; + break; +-- +2.35.1 + diff --git a/queue-5.15/ip-fix-a-data-race-around-sysctl_fwmark_reflect.patch b/queue-5.15/ip-fix-a-data-race-around-sysctl_fwmark_reflect.patch new file mode 100644 index 00000000000..d0446683b95 --- /dev/null +++ b/queue-5.15/ip-fix-a-data-race-around-sysctl_fwmark_reflect.patch @@ -0,0 +1,36 @@ +From 3531356d47f2a0ac9e50d602b088bd909f1e267a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 13:51:57 -0700 +Subject: ip: Fix a data-race around sysctl_fwmark_reflect. + +From: Kuniyuki Iwashima + +[ Upstream commit 85d0b4dbd74b95cc492b1f4e34497d3f894f5d9a ] + +While reading sysctl_fwmark_reflect, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: e110861f8609 ("net: add a sysctl to reflect the fwmark on replies") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/ip.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/net/ip.h b/include/net/ip.h +index c69dd114f367..a0ac57af82dc 100644 +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -379,7 +379,7 @@ void ipfrag_init(void); + void ip_static_sysctl_init(void); + + #define IP4_REPLY_MARK(net, mark) \ +- ((net)->ipv4.sysctl_fwmark_reflect ? (mark) : 0) ++ (READ_ONCE((net)->ipv4.sysctl_fwmark_reflect) ? (mark) : 0) + + static inline bool ip_is_fragment(const struct iphdr *iph) + { +-- +2.35.1 + diff --git a/queue-5.15/ip-fix-a-data-race-around-sysctl_ip_autobind_reuse.patch b/queue-5.15/ip-fix-a-data-race-around-sysctl_ip_autobind_reuse.patch new file mode 100644 index 00000000000..4dc7f087f4c --- /dev/null +++ b/queue-5.15/ip-fix-a-data-race-around-sysctl_ip_autobind_reuse.patch @@ -0,0 +1,36 @@ +From 0b5ba420721969121ff582da77a73bf19678b8d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 13:51:56 -0700 +Subject: ip: Fix a data-race around sysctl_ip_autobind_reuse. + +From: Kuniyuki Iwashima + +[ Upstream commit 0db232765887d9807df8bcb7b6f29b2871539eab ] + +While reading sysctl_ip_autobind_reuse, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: 4b01a9674231 ("tcp: bind(0) remove the SO_REUSEADDR restriction when ephemeral ports are exhausted.") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/inet_connection_sock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c +index 62a67fdc344c..d3bbb344bbe1 100644 +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -259,7 +259,7 @@ inet_csk_find_open_port(struct sock *sk, struct inet_bind_bucket **tb_ret, int * + goto other_half_scan; + } + +- if (net->ipv4.sysctl_ip_autobind_reuse && !relax) { ++ if (READ_ONCE(net->ipv4.sysctl_ip_autobind_reuse) && !relax) { + /* We still have a chance to connect to different destinations */ + relax = true; + goto ports_exhausted; +-- +2.35.1 + diff --git a/queue-5.15/ip-fix-data-races-around-sysctl_ip_fwd_update_priori.patch b/queue-5.15/ip-fix-data-races-around-sysctl_ip_fwd_update_priori.patch new file mode 100644 index 00000000000..3b8c4d898d3 --- /dev/null +++ b/queue-5.15/ip-fix-data-races-around-sysctl_ip_fwd_update_priori.patch @@ -0,0 +1,57 @@ +From 85d1b6564d49197cbf92170e9f6c459e3e9d4995 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 13:51:54 -0700 +Subject: ip: Fix data-races around sysctl_ip_fwd_update_priority. + +From: Kuniyuki Iwashima + +[ Upstream commit 7bf9e18d9a5e99e3c83482973557e9f047b051e7 ] + +While reading sysctl_ip_fwd_update_priority, it can be changed +concurrently. Thus, we need to add READ_ONCE() to its readers. + +Fixes: 432e05d32892 ("net: ipv4: Control SKB reprioritization after forwarding") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 3 ++- + net/ipv4/ip_forward.c | 2 +- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +index 6ef4ca8599ac..d17156c11ef8 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +@@ -9787,13 +9787,14 @@ static int mlxsw_sp_dscp_init(struct mlxsw_sp *mlxsw_sp) + static int __mlxsw_sp_router_init(struct mlxsw_sp *mlxsw_sp) + { + struct net *net = mlxsw_sp_net(mlxsw_sp); +- bool usp = net->ipv4.sysctl_ip_fwd_update_priority; + char rgcr_pl[MLXSW_REG_RGCR_LEN]; + u64 max_rifs; ++ bool usp; + + if (!MLXSW_CORE_RES_VALID(mlxsw_sp->core, MAX_RIFS)) + return -EIO; + max_rifs = MLXSW_CORE_RES_GET(mlxsw_sp->core, MAX_RIFS); ++ usp = READ_ONCE(net->ipv4.sysctl_ip_fwd_update_priority); + + mlxsw_reg_rgcr_pack(rgcr_pl, true, true); + mlxsw_reg_rgcr_max_router_interfaces_set(rgcr_pl, max_rifs); +diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c +index 00ec819f949b..29730edda220 100644 +--- a/net/ipv4/ip_forward.c ++++ b/net/ipv4/ip_forward.c +@@ -151,7 +151,7 @@ int ip_forward(struct sk_buff *skb) + !skb_sec_path(skb)) + ip_rt_send_redirect(skb); + +- if (net->ipv4.sysctl_ip_fwd_update_priority) ++ if (READ_ONCE(net->ipv4.sysctl_ip_fwd_update_priority)) + skb->priority = rt_tos2priority(iph->tos); + + return NF_HOOK(NFPROTO_IPV4, NF_INET_FORWARD, +-- +2.35.1 + diff --git a/queue-5.15/ip-fix-data-races-around-sysctl_ip_fwd_use_pmtu.patch b/queue-5.15/ip-fix-data-races-around-sysctl_ip_fwd_use_pmtu.patch new file mode 100644 index 00000000000..5ffce83f76e --- /dev/null +++ b/queue-5.15/ip-fix-data-races-around-sysctl_ip_fwd_use_pmtu.patch @@ -0,0 +1,50 @@ +From 30f362f4b2b27c8377cf8c8ca59f716c1d108e5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 13:51:53 -0700 +Subject: ip: Fix data-races around sysctl_ip_fwd_use_pmtu. + +From: Kuniyuki Iwashima + +[ Upstream commit 60c158dc7b1f0558f6cadd5b50d0386da0000d50 ] + +While reading sysctl_ip_fwd_use_pmtu, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +Fixes: f87c10a8aa1e ("ipv4: introduce ip_dst_mtu_maybe_forward and protect forwarding path against pmtu spoofing") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/ip.h | 2 +- + net/ipv4/route.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/net/ip.h b/include/net/ip.h +index a77a9e1c6c04..c69dd114f367 100644 +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -441,7 +441,7 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst, + struct net *net = dev_net(dst->dev); + unsigned int mtu; + +- if (net->ipv4.sysctl_ip_fwd_use_pmtu || ++ if (READ_ONCE(net->ipv4.sysctl_ip_fwd_use_pmtu) || + ip_mtu_locked(dst) || + !forwarding) { + mtu = rt->rt_pmtu; +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 1db2fda22830..7f08a30256c5 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -1404,7 +1404,7 @@ u32 ip_mtu_from_fib_result(struct fib_result *res, __be32 daddr) + struct fib_info *fi = res->fi; + u32 mtu = 0; + +- if (dev_net(dev)->ipv4.sysctl_ip_fwd_use_pmtu || ++ if (READ_ONCE(dev_net(dev)->ipv4.sysctl_ip_fwd_use_pmtu) || + fi->fib_metrics->metrics[RTAX_LOCK - 1] & (1 << RTAX_MTU)) + mtu = fi->fib_mtu; + +-- +2.35.1 + diff --git a/queue-5.15/ip-fix-data-races-around-sysctl_ip_no_pmtu_disc.patch b/queue-5.15/ip-fix-data-races-around-sysctl_ip_no_pmtu_disc.patch new file mode 100644 index 00000000000..6076a1eb68d --- /dev/null +++ b/queue-5.15/ip-fix-data-races-around-sysctl_ip_no_pmtu_disc.patch @@ -0,0 +1,78 @@ +From 772ed322280c3f6c8b2a00bf4661b99f7c1ee5de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 13:51:52 -0700 +Subject: ip: Fix data-races around sysctl_ip_no_pmtu_disc. + +From: Kuniyuki Iwashima + +[ Upstream commit 0968d2a441bf6afb551fd99e60fa65ed67068963 ] + +While reading sysctl_ip_no_pmtu_disc, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/af_inet.c | 2 +- + net/ipv4/icmp.c | 2 +- + net/ipv6/af_inet6.c | 2 +- + net/xfrm/xfrm_state.c | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c +index 44f21278003d..781c595f6880 100644 +--- a/net/ipv4/af_inet.c ++++ b/net/ipv4/af_inet.c +@@ -338,7 +338,7 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, + inet->hdrincl = 1; + } + +- if (net->ipv4.sysctl_ip_no_pmtu_disc) ++ if (READ_ONCE(net->ipv4.sysctl_ip_no_pmtu_disc)) + inet->pmtudisc = IP_PMTUDISC_DONT; + else + inet->pmtudisc = IP_PMTUDISC_WANT; +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index a5cc89506c1e..609c4ff7edc6 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -887,7 +887,7 @@ static bool icmp_unreach(struct sk_buff *skb) + * values please see + * Documentation/networking/ip-sysctl.rst + */ +- switch (net->ipv4.sysctl_ip_no_pmtu_disc) { ++ switch (READ_ONCE(net->ipv4.sysctl_ip_no_pmtu_disc)) { + default: + net_dbg_ratelimited("%pI4: fragmentation needed and DF set\n", + &iph->daddr); +diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c +index dab4a047590b..3a91d0d40aec 100644 +--- a/net/ipv6/af_inet6.c ++++ b/net/ipv6/af_inet6.c +@@ -226,7 +226,7 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, + RCU_INIT_POINTER(inet->mc_list, NULL); + inet->rcv_tos = 0; + +- if (net->ipv4.sysctl_ip_no_pmtu_disc) ++ if (READ_ONCE(net->ipv4.sysctl_ip_no_pmtu_disc)) + inet->pmtudisc = IP_PMTUDISC_DONT; + else + inet->pmtudisc = IP_PMTUDISC_WANT; +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index f7bfa1916968..b1a04a22166f 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -2619,7 +2619,7 @@ int __xfrm_init_state(struct xfrm_state *x, bool init_replay, bool offload) + int err; + + if (family == AF_INET && +- xs_net(x)->ipv4.sysctl_ip_no_pmtu_disc) ++ READ_ONCE(xs_net(x)->ipv4.sysctl_ip_no_pmtu_disc)) + x->props.flags |= XFRM_STATE_NOPMTUDISC; + + err = -EPROTONOSUPPORT; +-- +2.35.1 + diff --git a/queue-5.15/ip-fix-data-races-around-sysctl_ip_nonlocal_bind.patch b/queue-5.15/ip-fix-data-races-around-sysctl_ip_nonlocal_bind.patch new file mode 100644 index 00000000000..49ebb79a151 --- /dev/null +++ b/queue-5.15/ip-fix-data-races-around-sysctl_ip_nonlocal_bind.patch @@ -0,0 +1,50 @@ +From 98b4aa936a0a662d6ccec68693484dff0b00a07c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 13:51:55 -0700 +Subject: ip: Fix data-races around sysctl_ip_nonlocal_bind. + +From: Kuniyuki Iwashima + +[ Upstream commit 289d3b21fb0bfc94c4e98f10635bba1824e5f83c ] + +While reading sysctl_ip_nonlocal_bind, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/inet_sock.h | 2 +- + net/sctp/protocol.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h +index d81b7f85819e..defd77baf74a 100644 +--- a/include/net/inet_sock.h ++++ b/include/net/inet_sock.h +@@ -373,7 +373,7 @@ static inline bool inet_get_convert_csum(struct sock *sk) + static inline bool inet_can_nonlocal_bind(struct net *net, + struct inet_sock *inet) + { +- return net->ipv4.sysctl_ip_nonlocal_bind || ++ return READ_ONCE(net->ipv4.sysctl_ip_nonlocal_bind) || + inet->freebind || inet->transparent; + } + +diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c +index ec0f52567c16..9987decdead2 100644 +--- a/net/sctp/protocol.c ++++ b/net/sctp/protocol.c +@@ -359,7 +359,7 @@ static int sctp_v4_available(union sctp_addr *addr, struct sctp_sock *sp) + if (addr->v4.sin_addr.s_addr != htonl(INADDR_ANY) && + ret != RTN_LOCAL && + !sp->inet.freebind && +- !net->ipv4.sysctl_ip_nonlocal_bind) ++ !READ_ONCE(net->ipv4.sysctl_ip_nonlocal_bind)) + return 0; + + if (ipv6_only_sock(sctp_opt2sk(sp))) +-- +2.35.1 + diff --git a/queue-5.15/ip-fix-data-races-around-sysctl_ip_prot_sock.patch b/queue-5.15/ip-fix-data-races-around-sysctl_ip_prot_sock.patch new file mode 100644 index 00000000000..0cb427f0d40 --- /dev/null +++ b/queue-5.15/ip-fix-data-races-around-sysctl_ip_prot_sock.patch @@ -0,0 +1,69 @@ +From 2f8b051e12ecace9390a5b675e80affdf359f6ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 10:26:42 -0700 +Subject: ip: Fix data-races around sysctl_ip_prot_sock. + +From: Kuniyuki Iwashima + +[ Upstream commit 9b55c20f83369dd54541d9ddbe3a018a8377f451 ] + +sysctl_ip_prot_sock is accessed concurrently, and there is always a chance +of data-race. So, all readers and writers need some basic protection to +avoid load/store-tearing. + +Fixes: 4548b683b781 ("Introduce a sysctl that modifies the value of PROT_SOCK.") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/ip.h | 2 +- + net/ipv4/sysctl_net_ipv4.c | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/include/net/ip.h b/include/net/ip.h +index a0ac57af82dc..8462ced0c21e 100644 +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -352,7 +352,7 @@ static inline bool sysctl_dev_name_is_allowed(const char *name) + + static inline bool inet_port_requires_bind_service(struct net *net, unsigned short port) + { +- return port < net->ipv4.sysctl_ip_prot_sock; ++ return port < READ_ONCE(net->ipv4.sysctl_ip_prot_sock); + } + + #else +diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c +index ead5db7e24ea..a36728277e32 100644 +--- a/net/ipv4/sysctl_net_ipv4.c ++++ b/net/ipv4/sysctl_net_ipv4.c +@@ -97,7 +97,7 @@ static int ipv4_local_port_range(struct ctl_table *table, int write, + * port limit. + */ + if ((range[1] < range[0]) || +- (range[0] < net->ipv4.sysctl_ip_prot_sock)) ++ (range[0] < READ_ONCE(net->ipv4.sysctl_ip_prot_sock))) + ret = -EINVAL; + else + set_local_port_range(net, range); +@@ -123,7 +123,7 @@ static int ipv4_privileged_ports(struct ctl_table *table, int write, + .extra2 = &ip_privileged_port_max, + }; + +- pports = net->ipv4.sysctl_ip_prot_sock; ++ pports = READ_ONCE(net->ipv4.sysctl_ip_prot_sock); + + ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); + +@@ -135,7 +135,7 @@ static int ipv4_privileged_ports(struct ctl_table *table, int write, + if (range[0] < pports) + ret = -EINVAL; + else +- net->ipv4.sysctl_ip_prot_sock = pports; ++ WRITE_ONCE(net->ipv4.sysctl_ip_prot_sock, pports); + } + + return ret; +-- +2.35.1 + diff --git a/queue-5.15/ipv4-fix-a-data-race-around-sysctl_fib_multipath_use.patch b/queue-5.15/ipv4-fix-a-data-race-around-sysctl_fib_multipath_use.patch new file mode 100644 index 00000000000..b97a0253684 --- /dev/null +++ b/queue-5.15/ipv4-fix-a-data-race-around-sysctl_fib_multipath_use.patch @@ -0,0 +1,36 @@ +From 8dfbd9a96c9a2c051d5874c16065e6a4a7d8a374 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 10:26:39 -0700 +Subject: ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh. + +From: Kuniyuki Iwashima + +[ Upstream commit 87507bcb4f5de16bb419e9509d874f4db6c0ad0f ] + +While reading sysctl_fib_multipath_use_neigh, it can be changed +concurrently. Thus, we need to add READ_ONCE() to its reader. + +Fixes: a6db4494d218 ("net: ipv4: Consider failed nexthops in multipath routes") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/fib_semantics.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c +index 674694d8ac61..55de6fa83dea 100644 +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -2233,7 +2233,7 @@ void fib_select_multipath(struct fib_result *res, int hash) + } + + change_nexthops(fi) { +- if (net->ipv4.sysctl_fib_multipath_use_neigh) { ++ if (READ_ONCE(net->ipv4.sysctl_fib_multipath_use_neigh)) { + if (!fib_good_nh(nexthop_nh)) + continue; + if (!first) { +-- +2.35.1 + diff --git a/queue-5.15/ipv4-fix-data-races-around-sysctl_fib_multipath_hash.patch b/queue-5.15/ipv4-fix-data-races-around-sysctl_fib_multipath_hash.patch new file mode 100644 index 00000000000..370c33101bd --- /dev/null +++ b/queue-5.15/ipv4-fix-data-races-around-sysctl_fib_multipath_hash.patch @@ -0,0 +1,50 @@ +From 91f0001b803d75531cc4ad0137c041d087186130 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 10:26:40 -0700 +Subject: ipv4: Fix data-races around sysctl_fib_multipath_hash_policy. + +From: Kuniyuki Iwashima + +[ Upstream commit 7998c12a08c97cc26660532c9f90a34bd7d8da5a ] + +While reading sysctl_fib_multipath_hash_policy, it can be changed +concurrently. Thus, we need to add READ_ONCE() to its readers. + +Fixes: bf4e0a3db97e ("net: ipv4: add support for ECMP hash policy choice") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 2 +- + net/ipv4/route.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +index d17156c11ef8..6cdf0e232b1c 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +@@ -9588,7 +9588,7 @@ static void mlxsw_sp_mp4_hash_init(struct mlxsw_sp *mlxsw_sp, + unsigned long *fields = config->fields; + u32 hash_fields; + +- switch (net->ipv4.sysctl_fib_multipath_hash_policy) { ++ switch (READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_policy)) { + case 0: + mlxsw_sp_mp4_hash_outer_addr(config); + break; +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 7f08a30256c5..ade6cb309c40 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -2048,7 +2048,7 @@ int fib_multipath_hash(const struct net *net, const struct flowi4 *fl4, + struct flow_keys hash_keys; + u32 mhash = 0; + +- switch (net->ipv4.sysctl_fib_multipath_hash_policy) { ++ switch (READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_policy)) { + case 0: + memset(&hash_keys, 0, sizeof(hash_keys)); + hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS; +-- +2.35.1 + diff --git a/queue-5.15/ipv4-fix-data-races-around-sysctl_fib_multipath_hash.patch-25508 b/queue-5.15/ipv4-fix-data-races-around-sysctl_fib_multipath_hash.patch-25508 new file mode 100644 index 00000000000..01e50cd43c2 --- /dev/null +++ b/queue-5.15/ipv4-fix-data-races-around-sysctl_fib_multipath_hash.patch-25508 @@ -0,0 +1,69 @@ +From 6b7e1774cc86adb4ef0b2e71f535b08449ce1921 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 10:26:41 -0700 +Subject: ipv4: Fix data-races around sysctl_fib_multipath_hash_fields. + +From: Kuniyuki Iwashima + +[ Upstream commit 8895a9c2ac76fb9d3922fed4fe092c8ec5e5cccc ] + +While reading sysctl_fib_multipath_hash_fields, it can be changed +concurrently. Thus, we need to add READ_ONCE() to its readers. + +Fixes: ce5c9c20d364 ("ipv4: Add a sysctl to control multipath hash fields") +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 2 +- + net/ipv4/route.c | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +index 6cdf0e232b1c..55de90d5ae59 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +@@ -9606,7 +9606,7 @@ static void mlxsw_sp_mp4_hash_init(struct mlxsw_sp *mlxsw_sp, + mlxsw_sp_mp_hash_inner_l3(config); + break; + case 3: +- hash_fields = net->ipv4.sysctl_fib_multipath_hash_fields; ++ hash_fields = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_fields); + /* Outer */ + MLXSW_SP_MP_HASH_HEADER_SET(headers, IPV4_EN_NOT_TCP_NOT_UDP); + MLXSW_SP_MP_HASH_HEADER_SET(headers, IPV4_EN_TCP_UDP); +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index ade6cb309c40..ca59b61fd3a3 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -1929,7 +1929,7 @@ static u32 fib_multipath_custom_hash_outer(const struct net *net, + const struct sk_buff *skb, + bool *p_has_inner) + { +- u32 hash_fields = net->ipv4.sysctl_fib_multipath_hash_fields; ++ u32 hash_fields = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_fields); + struct flow_keys keys, hash_keys; + + if (!(hash_fields & FIB_MULTIPATH_HASH_FIELD_OUTER_MASK)) +@@ -1958,7 +1958,7 @@ static u32 fib_multipath_custom_hash_inner(const struct net *net, + const struct sk_buff *skb, + bool has_inner) + { +- u32 hash_fields = net->ipv4.sysctl_fib_multipath_hash_fields; ++ u32 hash_fields = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_fields); + struct flow_keys keys, hash_keys; + + /* We assume the packet carries an encapsulation, but if none was +@@ -2018,7 +2018,7 @@ static u32 fib_multipath_custom_hash_skb(const struct net *net, + static u32 fib_multipath_custom_hash_fl4(const struct net *net, + const struct flowi4 *fl4) + { +- u32 hash_fields = net->ipv4.sysctl_fib_multipath_hash_fields; ++ u32 hash_fields = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_fields); + struct flow_keys hash_keys; + + if (!(hash_fields & FIB_MULTIPATH_HASH_FIELD_OUTER_MASK)) +-- +2.35.1 + diff --git a/queue-5.15/ipv4-tcp-do-not-use-per-netns-ctl-sockets.patch b/queue-5.15/ipv4-tcp-do-not-use-per-netns-ctl-sockets.patch new file mode 100644 index 00000000000..18a4edd2081 --- /dev/null +++ b/queue-5.15/ipv4-tcp-do-not-use-per-netns-ctl-sockets.patch @@ -0,0 +1,177 @@ +From 290fbb5ffc27e2266d72a862b7acfdd370d7817f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jan 2022 12:24:57 -0800 +Subject: ipv4/tcp: do not use per netns ctl sockets + +From: Eric Dumazet + +[ Upstream commit 37ba017dcc3b1123206808979834655ddcf93251 ] + +TCP ipv4 uses per-cpu/per-netns ctl sockets in order to send +RST and some ACK packets (on behalf of TIMEWAIT sockets). + +This adds memory and cpu costs, which do not seem needed. +Now typical servers have 256 or more cores, this adds considerable +tax to netns users. + +tcp sockets are used from BH context, are not receiving packets, +and do not store any persistent state but the 'struct net' pointer +in order to be able to use IPv4 output functions. + +Note that I attempted a related change in the past, that had +to be hot-fixed in commit bdbbb8527b6f ("ipv4: tcp: get rid of ugly unicast_sock") + +This patch could very well surface old bugs, on layers not +taking care of sk->sk_kern_sock properly. + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/netns/ipv4.h | 1 - + net/ipv4/tcp_ipv4.c | 61 ++++++++++++++++++---------------------- + 2 files changed, 27 insertions(+), 35 deletions(-) + +diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h +index 6c5b2efc4f17..d60a10cfc382 100644 +--- a/include/net/netns/ipv4.h ++++ b/include/net/netns/ipv4.h +@@ -74,7 +74,6 @@ struct netns_ipv4 { + struct sock *mc_autojoin_sk; + + struct inet_peer_base *peers; +- struct sock * __percpu *tcp_sk; + struct fqdir *fqdir; + + u8 sysctl_icmp_echo_ignore_all; +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 5d94822fd506..b9a9f288bfa6 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -91,6 +91,8 @@ static int tcp_v4_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key, + struct inet_hashinfo tcp_hashinfo; + EXPORT_SYMBOL(tcp_hashinfo); + ++static DEFINE_PER_CPU(struct sock *, ipv4_tcp_sk); ++ + static u32 tcp_v4_init_seq(const struct sk_buff *skb) + { + return secure_tcp_seq(ip_hdr(skb)->daddr, +@@ -807,7 +809,8 @@ static void tcp_v4_send_reset(const struct sock *sk, struct sk_buff *skb) + arg.tos = ip_hdr(skb)->tos; + arg.uid = sock_net_uid(net, sk && sk_fullsock(sk) ? sk : NULL); + local_bh_disable(); +- ctl_sk = this_cpu_read(*net->ipv4.tcp_sk); ++ ctl_sk = this_cpu_read(ipv4_tcp_sk); ++ sock_net_set(ctl_sk, net); + if (sk) { + ctl_sk->sk_mark = (sk->sk_state == TCP_TIME_WAIT) ? + inet_twsk(sk)->tw_mark : sk->sk_mark; +@@ -822,6 +825,7 @@ static void tcp_v4_send_reset(const struct sock *sk, struct sk_buff *skb) + transmit_time); + + ctl_sk->sk_mark = 0; ++ sock_net_set(ctl_sk, &init_net); + __TCP_INC_STATS(net, TCP_MIB_OUTSEGS); + __TCP_INC_STATS(net, TCP_MIB_OUTRSTS); + local_bh_enable(); +@@ -905,7 +909,8 @@ static void tcp_v4_send_ack(const struct sock *sk, + arg.tos = tos; + arg.uid = sock_net_uid(net, sk_fullsock(sk) ? sk : NULL); + local_bh_disable(); +- ctl_sk = this_cpu_read(*net->ipv4.tcp_sk); ++ ctl_sk = this_cpu_read(ipv4_tcp_sk); ++ sock_net_set(ctl_sk, net); + ctl_sk->sk_mark = (sk->sk_state == TCP_TIME_WAIT) ? + inet_twsk(sk)->tw_mark : sk->sk_mark; + ctl_sk->sk_priority = (sk->sk_state == TCP_TIME_WAIT) ? +@@ -918,6 +923,7 @@ static void tcp_v4_send_ack(const struct sock *sk, + transmit_time); + + ctl_sk->sk_mark = 0; ++ sock_net_set(ctl_sk, &init_net); + __TCP_INC_STATS(net, TCP_MIB_OUTSEGS); + local_bh_enable(); + } +@@ -3103,41 +3109,14 @@ EXPORT_SYMBOL(tcp_prot); + + static void __net_exit tcp_sk_exit(struct net *net) + { +- int cpu; +- + if (net->ipv4.tcp_congestion_control) + bpf_module_put(net->ipv4.tcp_congestion_control, + net->ipv4.tcp_congestion_control->owner); +- +- for_each_possible_cpu(cpu) +- inet_ctl_sock_destroy(*per_cpu_ptr(net->ipv4.tcp_sk, cpu)); +- free_percpu(net->ipv4.tcp_sk); + } + + static int __net_init tcp_sk_init(struct net *net) + { +- int res, cpu, cnt; +- +- net->ipv4.tcp_sk = alloc_percpu(struct sock *); +- if (!net->ipv4.tcp_sk) +- return -ENOMEM; +- +- for_each_possible_cpu(cpu) { +- struct sock *sk; +- +- res = inet_ctl_sock_create(&sk, PF_INET, SOCK_RAW, +- IPPROTO_TCP, net); +- if (res) +- goto fail; +- sock_set_flag(sk, SOCK_USE_WRITE_QUEUE); +- +- /* Please enforce IP_DF and IPID==0 for RST and +- * ACK sent in SYN-RECV and TIME-WAIT state. +- */ +- inet_sk(sk)->pmtudisc = IP_PMTUDISC_DO; +- +- *per_cpu_ptr(net->ipv4.tcp_sk, cpu) = sk; +- } ++ int cnt; + + net->ipv4.sysctl_tcp_ecn = 2; + net->ipv4.sysctl_tcp_ecn_fallback = 1; +@@ -3221,10 +3200,6 @@ static int __net_init tcp_sk_init(struct net *net) + net->ipv4.tcp_congestion_control = &tcp_reno; + + return 0; +-fail: +- tcp_sk_exit(net); +- +- return res; + } + + static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list) +@@ -3318,6 +3293,24 @@ static void __init bpf_iter_register(void) + + void __init tcp_v4_init(void) + { ++ int cpu, res; ++ ++ for_each_possible_cpu(cpu) { ++ struct sock *sk; ++ ++ res = inet_ctl_sock_create(&sk, PF_INET, SOCK_RAW, ++ IPPROTO_TCP, &init_net); ++ if (res) ++ panic("Failed to create the TCP control socket.\n"); ++ sock_set_flag(sk, SOCK_USE_WRITE_QUEUE); ++ ++ /* Please enforce IP_DF and IPID==0 for RST and ++ * ACK sent in SYN-RECV and TIME-WAIT state. ++ */ ++ inet_sk(sk)->pmtudisc = IP_PMTUDISC_DO; ++ ++ per_cpu(ipv4_tcp_sk, cpu) = sk; ++ } + if (register_pernet_subsys(&tcp_sk_ops)) + panic("Failed to create the TCP control socket.\n"); + +-- +2.35.1 + diff --git a/queue-5.15/ixgbe-add-locking-to-prevent-panic-when-setting-srio.patch b/queue-5.15/ixgbe-add-locking-to-prevent-panic-when-setting-srio.patch new file mode 100644 index 00000000000..89540b8468c --- /dev/null +++ b/queue-5.15/ixgbe-add-locking-to-prevent-panic-when-setting-srio.patch @@ -0,0 +1,138 @@ +From e876b74e075aed7e225e93e93b77d52a4e3e3e56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 14:44:56 -0700 +Subject: ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero + +From: Piotr Skajewski + +[ Upstream commit 1e53834ce541d4fe271cdcca7703e50be0a44f8a ] + +It is possible to disable VFs while the PF driver is processing requests +from the VF driver. This can result in a panic. + +BUG: unable to handle kernel paging request at 000000000000106c +PGD 0 P4D 0 +Oops: 0000 [#1] SMP NOPTI +CPU: 8 PID: 0 Comm: swapper/8 Kdump: loaded Tainted: G I --------- - +Hardware name: Dell Inc. PowerEdge R740/06WXJT, BIOS 2.8.2 08/27/2020 +RIP: 0010:ixgbe_msg_task+0x4c8/0x1690 [ixgbe] +Code: 00 00 48 8d 04 40 48 c1 e0 05 89 7c 24 24 89 fd 48 89 44 24 10 83 ff +01 0f 84 b8 04 00 00 4c 8b 64 24 10 4d 03 a5 48 22 00 00 <41> 80 7c 24 4c +00 0f 84 8a 03 00 00 0f b7 c7 83 f8 08 0f 84 8f 0a +RSP: 0018:ffffb337869f8df8 EFLAGS: 00010002 +RAX: 0000000000001020 RBX: 0000000000000000 RCX: 000000000000002b +RDX: 0000000000000002 RSI: 0000000000000008 RDI: 0000000000000006 +RBP: 0000000000000006 R08: 0000000000000002 R09: 0000000000029780 +R10: 00006957d8f42832 R11: 0000000000000000 R12: 0000000000001020 +R13: ffff8a00e8978ac0 R14: 000000000000002b R15: ffff8a00e8979c80 +FS: 0000000000000000(0000) GS:ffff8a07dfd00000(0000) knlGS:00000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 000000000000106c CR3: 0000000063e10004 CR4: 00000000007726e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +PKRU: 55555554 +Call Trace: + + ? ttwu_do_wakeup+0x19/0x140 + ? try_to_wake_up+0x1cd/0x550 + ? ixgbevf_update_xcast_mode+0x71/0xc0 [ixgbevf] + ixgbe_msix_other+0x17e/0x310 [ixgbe] + __handle_irq_event_percpu+0x40/0x180 + handle_irq_event_percpu+0x30/0x80 + handle_irq_event+0x36/0x53 + handle_edge_irq+0x82/0x190 + handle_irq+0x1c/0x30 + do_IRQ+0x49/0xd0 + common_interrupt+0xf/0xf + +This can be eventually be reproduced with the following script: + +while : +do + echo 63 > /sys/class/net//device/sriov_numvfs + sleep 1 + echo 0 > /sys/class/net//device/sriov_numvfs + sleep 1 +done + +Add lock when disabling SR-IOV to prevent process VF mailbox communication. + +Fixes: d773d1310625 ("ixgbe: Fix memory leak when SR-IOV VFs are direct assigned") +Signed-off-by: Piotr Skajewski +Tested-by: Marek Szlosek +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20220715214456.2968711-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe.h | 1 + + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 +++ + drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 6 ++++++ + 3 files changed, 10 insertions(+) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe.h b/drivers/net/ethernet/intel/ixgbe/ixgbe.h +index a604552fa634..c375a5d54b40 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe.h ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe.h +@@ -770,6 +770,7 @@ struct ixgbe_adapter { + #ifdef CONFIG_IXGBE_IPSEC + struct ixgbe_ipsec *ipsec; + #endif /* CONFIG_IXGBE_IPSEC */ ++ spinlock_t vfs_lock; + }; + + static inline u8 ixgbe_max_rss_indices(struct ixgbe_adapter *adapter) +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 750b02bb2fdc..8cb20af51ecd 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -6397,6 +6397,9 @@ static int ixgbe_sw_init(struct ixgbe_adapter *adapter, + /* n-tuple support exists, always init our spinlock */ + spin_lock_init(&adapter->fdir_perfect_lock); + ++ /* init spinlock to avoid concurrency of VF resources */ ++ spin_lock_init(&adapter->vfs_lock); ++ + #ifdef CONFIG_IXGBE_DCB + ixgbe_init_dcb(adapter); + #endif +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c +index aaebdae8b5ff..0078ae592616 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c +@@ -204,10 +204,13 @@ void ixgbe_enable_sriov(struct ixgbe_adapter *adapter, unsigned int max_vfs) + int ixgbe_disable_sriov(struct ixgbe_adapter *adapter) + { + unsigned int num_vfs = adapter->num_vfs, vf; ++ unsigned long flags; + int rss; + ++ spin_lock_irqsave(&adapter->vfs_lock, flags); + /* set num VFs to 0 to prevent access to vfinfo */ + adapter->num_vfs = 0; ++ spin_unlock_irqrestore(&adapter->vfs_lock, flags); + + /* put the reference to all of the vf devices */ + for (vf = 0; vf < num_vfs; ++vf) { +@@ -1305,8 +1308,10 @@ static void ixgbe_rcv_ack_from_vf(struct ixgbe_adapter *adapter, u32 vf) + void ixgbe_msg_task(struct ixgbe_adapter *adapter) + { + struct ixgbe_hw *hw = &adapter->hw; ++ unsigned long flags; + u32 vf; + ++ spin_lock_irqsave(&adapter->vfs_lock, flags); + for (vf = 0; vf < adapter->num_vfs; vf++) { + /* process any reset requests */ + if (!ixgbe_check_for_rst(hw, vf)) +@@ -1320,6 +1325,7 @@ void ixgbe_msg_task(struct ixgbe_adapter *adapter) + if (!ixgbe_check_for_ack(hw, vf)) + ixgbe_rcv_ack_from_vf(adapter, vf); + } ++ spin_unlock_irqrestore(&adapter->vfs_lock, flags); + } + + void ixgbe_disable_tx_rx(struct ixgbe_adapter *adapter) +-- +2.35.1 + diff --git a/queue-5.15/mm-pagealloc-sysctl-change-watermark_scale_factor-ma.patch b/queue-5.15/mm-pagealloc-sysctl-change-watermark_scale_factor-ma.patch new file mode 100644 index 00000000000..67437f0695a --- /dev/null +++ b/queue-5.15/mm-pagealloc-sysctl-change-watermark_scale_factor-ma.patch @@ -0,0 +1,80 @@ +From 2aa34d732ae91e75d325761de3b9d3b7ffd28c15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jan 2022 14:07:17 -0800 +Subject: mm/pagealloc: sysctl: change watermark_scale_factor max limit to 30% + +From: Suren Baghdasaryan + +[ Upstream commit 39c65a94cd9661532be150e88f8b02f4a6844a35 ] + +For embedded systems with low total memory, having to run applications +with relatively large memory requirements, 10% max limitation for +watermark_scale_factor poses an issue of triggering direct reclaim every +time such application is started. This results in slow application +startup times and bad end-user experience. + +By increasing watermark_scale_factor max limit we allow vendors more +flexibility to choose the right level of kswapd aggressiveness for their +device and workload requirements. + +Link: https://lkml.kernel.org/r/20211124193604.2758863-1-surenb@google.com +Signed-off-by: Suren Baghdasaryan +Acked-by: Johannes Weiner +Cc: Michal Hocko +Cc: Lukas Middendorf +Cc: Antti Palosaari +Cc: Luis Chamberlain +Cc: Kees Cook +Cc: Iurii Zaikin +Cc: Dave Hansen +Cc: Vlastimil Babka +Cc: Mel Gorman +Cc: Jonathan Corbet +Cc: Zhang Yi +Cc: Fengfei Xi +Cc: Mike Rapoport +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + Documentation/admin-guide/sysctl/vm.rst | 2 +- + kernel/sysctl.c | 3 ++- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/Documentation/admin-guide/sysctl/vm.rst b/Documentation/admin-guide/sysctl/vm.rst +index 5e795202111f..f4804ce37c58 100644 +--- a/Documentation/admin-guide/sysctl/vm.rst ++++ b/Documentation/admin-guide/sysctl/vm.rst +@@ -948,7 +948,7 @@ how much memory needs to be free before kswapd goes back to sleep. + + The unit is in fractions of 10,000. The default value of 10 means the + distances between watermarks are 0.1% of the available memory in the +-node/system. The maximum value is 1000, or 10% of memory. ++node/system. The maximum value is 3000, or 30% of memory. + + A high rate of threads entering direct reclaim (allocstall) or kswapd + going to sleep prematurely (kswapd_low_wmark_hit_quickly) can indicate +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 25c18b2df684..347a90a878b3 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -122,6 +122,7 @@ static unsigned long long_max = LONG_MAX; + static int one_hundred = 100; + static int two_hundred = 200; + static int one_thousand = 1000; ++static int three_thousand = 3000; + #ifdef CONFIG_PRINTK + static int ten_thousand = 10000; + #endif +@@ -2971,7 +2972,7 @@ static struct ctl_table vm_table[] = { + .mode = 0644, + .proc_handler = watermark_scale_factor_sysctl_handler, + .extra1 = SYSCTL_ONE, +- .extra2 = &one_thousand, ++ .extra2 = &three_thousand, + }, + { + .procname = "percpu_pagelist_high_fraction", +-- +2.35.1 + diff --git a/queue-5.15/mtd-rawnand-gpmi-set-wait_for_ready-timeout-based-on.patch b/queue-5.15/mtd-rawnand-gpmi-set-wait_for_ready-timeout-based-on.patch new file mode 100644 index 00000000000..481450a802f --- /dev/null +++ b/queue-5.15/mtd-rawnand-gpmi-set-wait_for_ready-timeout-based-on.patch @@ -0,0 +1,77 @@ +From 173c071fc673b6fc6a92e4e489a6e77b452a0c3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 13:03:41 +0200 +Subject: mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase + times +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sascha Hauer + +[ Upstream commit 0fddf9ad06fd9f439f137139861556671673e31c ] + +06781a5026350 Fixes the calculation of the DEVICE_BUSY_TIMEOUT register +value from busy_timeout_cycles. busy_timeout_cycles is calculated wrong +though: It is calculated based on the maximum page read time, but the +timeout is also used for page write and block erase operations which +require orders of magnitude bigger timeouts. + +Fix this by calculating busy_timeout_cycles from the maximum of +tBERS_max and tPROG_max. + +This is for now the easiest and most obvious way to fix the driver. +There's room for improvements though: The NAND_OP_WAITRDY_INSTR tells us +the desired timeout for the current operation, so we could program the +timeout dynamically for each operation instead of setting a fixed +timeout. Also we could wire up the interrupt handler to actually detect +and forward timeouts occurred when waiting for the chip being ready. + +As a sidenote I verified that the change in 06781a5026350 is really +correct. I wired up the interrupt handler in my tree and measured the +time between starting the operation and the timeout interrupt handler +coming in. The time increases 41us with each step in the timeout +register which corresponds to 4096 clock cycles with the 99MHz clock +that I have. + +Fixes: 06781a5026350 ("mtd: rawnand: gpmi: Fix setting busy timeout setting") +Fixes: b1206122069aa ("mtd: rawniand: gpmi: use core timings instead of an empirical derivation") +Cc: stable@vger.kernel.org +Signed-off-by: Sascha Hauer +Acked-by: Han Xu +Tested-by: Tomasz Moń +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +index 62f4988c2a5f..aef722dfdef5 100644 +--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c ++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +@@ -655,9 +655,10 @@ static int gpmi_nfc_compute_timings(struct gpmi_nand_data *this, + unsigned int tRP_ps; + bool use_half_period; + int sample_delay_ps, sample_delay_factor; +- u16 busy_timeout_cycles; ++ unsigned int busy_timeout_cycles; + u8 wrn_dly_sel; + unsigned long clk_rate, min_rate; ++ u64 busy_timeout_ps; + + if (sdr->tRC_min >= 30000) { + /* ONFI non-EDO modes [0-3] */ +@@ -690,7 +691,8 @@ static int gpmi_nfc_compute_timings(struct gpmi_nand_data *this, + addr_setup_cycles = TO_CYCLES(sdr->tALS_min, period_ps); + data_setup_cycles = TO_CYCLES(sdr->tDS_min, period_ps); + data_hold_cycles = TO_CYCLES(sdr->tDH_min, period_ps); +- busy_timeout_cycles = TO_CYCLES(sdr->tWB_max + sdr->tR_max, period_ps); ++ busy_timeout_ps = max(sdr->tBERS_max, sdr->tPROG_max); ++ busy_timeout_cycles = TO_CYCLES(busy_timeout_ps, period_ps); + + hw->timing0 = BF_GPMI_TIMING0_ADDRESS_SETUP(addr_setup_cycles) | + BF_GPMI_TIMING0_DATA_HOLD(data_hold_cycles) | +-- +2.35.1 + diff --git a/queue-5.15/mtd-rawnand-gpmi-validate-controller-clock-rate.patch b/queue-5.15/mtd-rawnand-gpmi-validate-controller-clock-rate.patch new file mode 100644 index 00000000000..f0aa29397e6 --- /dev/null +++ b/queue-5.15/mtd-rawnand-gpmi-validate-controller-clock-rate.patch @@ -0,0 +1,121 @@ +From 9754b65d6b5953b674d4c1cbde9a247ddff4a3e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jan 2022 10:54:33 +0100 +Subject: mtd: rawnand: gpmi: validate controller clock rate + +From: Dario Binacchi + +[ Upstream commit 15e27d197a7ea69b4643791ca2f8467fdd998359 ] + +What to do when the real rate of the gpmi clock is not equal to the +required one? The solutions proposed in [1] did not lead to a conclusion +on how to validate the clock rate, so, inspired by the document [2], I +consider the rate correct only if not lower or equal to the rate of the +previous edo mode. In fact, in chapter 4.16.2 (NV-DDR) of the document [2], +it is written that "If the host selects timing mode n, then its clock +period shall be faster than the clock period of timing mode n-1 and +slower than or equal to the clock period of timing mode n.". I thought +that it could therefore also be used in this case, without therefore +having to define the valid rate ranges empirically. + +For example, suppose that gpmi_nfc_compute_timings() is called to set +edo mode 5 (100MHz) but the rate returned by clk_round_rate() is 80MHz +(edo mode 4). In this case gpmi_nfc_compute_timings() will return error, +and will be called again to set edo mode 4, which this time will be +successful. + +[1] https://lore.kernel.org/r/20210702065350.209646-5-ebiggers@kernel.org +[2] http://www.onfi.org/-/media/client/onfi/specs/onfi_3_0_gold.pdf?la=en + +Co-developed-by: Michael Trimarchi +Signed-off-by: Michael Trimarchi +Signed-off-by: Dario Binacchi +Tested-by: Sascha Hauer +Reviewed-by: Sascha Hauer +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220118095434.35081-4-dario.binacchi@amarulasolutions.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +index b72b387c08ef..62f4988c2a5f 100644 +--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c ++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +@@ -644,8 +644,8 @@ static int bch_set_geometry(struct gpmi_nand_data *this) + * RDN_DELAY = ----------------------- {3} + * RP + */ +-static void gpmi_nfc_compute_timings(struct gpmi_nand_data *this, +- const struct nand_sdr_timings *sdr) ++static int gpmi_nfc_compute_timings(struct gpmi_nand_data *this, ++ const struct nand_sdr_timings *sdr) + { + struct gpmi_nfc_hardware_timing *hw = &this->hw; + struct resources *r = &this->resources; +@@ -657,23 +657,33 @@ static void gpmi_nfc_compute_timings(struct gpmi_nand_data *this, + int sample_delay_ps, sample_delay_factor; + u16 busy_timeout_cycles; + u8 wrn_dly_sel; ++ unsigned long clk_rate, min_rate; + + if (sdr->tRC_min >= 30000) { + /* ONFI non-EDO modes [0-3] */ + hw->clk_rate = 22000000; ++ min_rate = 0; + wrn_dly_sel = BV_GPMI_CTRL1_WRN_DLY_SEL_4_TO_8NS; + } else if (sdr->tRC_min >= 25000) { + /* ONFI EDO mode 4 */ + hw->clk_rate = 80000000; ++ min_rate = 22000000; + wrn_dly_sel = BV_GPMI_CTRL1_WRN_DLY_SEL_NO_DELAY; + } else { + /* ONFI EDO mode 5 */ + hw->clk_rate = 100000000; ++ min_rate = 80000000; + wrn_dly_sel = BV_GPMI_CTRL1_WRN_DLY_SEL_NO_DELAY; + } + +- hw->clk_rate = clk_round_rate(r->clock[0], hw->clk_rate); ++ clk_rate = clk_round_rate(r->clock[0], hw->clk_rate); ++ if (clk_rate <= min_rate) { ++ dev_err(this->dev, "clock setting: expected %ld, got %ld\n", ++ hw->clk_rate, clk_rate); ++ return -ENOTSUPP; ++ } + ++ hw->clk_rate = clk_rate; + /* SDR core timings are given in picoseconds */ + period_ps = div_u64((u64)NSEC_PER_SEC * 1000, hw->clk_rate); + +@@ -714,6 +724,7 @@ static void gpmi_nfc_compute_timings(struct gpmi_nand_data *this, + hw->ctrl1n |= BF_GPMI_CTRL1_RDN_DELAY(sample_delay_factor) | + BM_GPMI_CTRL1_DLL_ENABLE | + (use_half_period ? BM_GPMI_CTRL1_HALF_PERIOD : 0); ++ return 0; + } + + static int gpmi_nfc_apply_timings(struct gpmi_nand_data *this) +@@ -769,6 +780,7 @@ static int gpmi_setup_interface(struct nand_chip *chip, int chipnr, + { + struct gpmi_nand_data *this = nand_get_controller_data(chip); + const struct nand_sdr_timings *sdr; ++ int ret; + + /* Retrieve required NAND timings */ + sdr = nand_get_sdr_timings(conf); +@@ -784,7 +796,9 @@ static int gpmi_setup_interface(struct nand_chip *chip, int chipnr, + return 0; + + /* Do the actual derivation of the controller timings */ +- gpmi_nfc_compute_timings(this, sdr); ++ ret = gpmi_nfc_compute_timings(this, sdr); ++ if (ret) ++ return ret; + + this->hw.must_apply_timings = true; + +-- +2.35.1 + diff --git a/queue-5.15/net-dsa-microchip-ksz_common-fix-refcount-leak-bug.patch b/queue-5.15/net-dsa-microchip-ksz_common-fix-refcount-leak-bug.patch new file mode 100644 index 00000000000..1e396994fb1 --- /dev/null +++ b/queue-5.15/net-dsa-microchip-ksz_common-fix-refcount-leak-bug.patch @@ -0,0 +1,53 @@ +From 717845087f6785bd7afe337db11a8767cef31007 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 23:31:38 +0800 +Subject: net: dsa: microchip: ksz_common: Fix refcount leak bug + +From: Liang He + +[ Upstream commit a14bd7475452c51835dd5a0cee4c8fa48dd0b539 ] + +In ksz_switch_register(), we should call of_node_put() for the +reference returned by of_get_child_by_name() which has increased +the refcount. + +Fixes: 912aae27c6af ("net: dsa: microchip: really look for phy-mode in port nodes") +Signed-off-by: Liang He +Reviewed-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20220714153138.375919-1-windhl@126.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz_common.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c +index 7c2968a639eb..4c4e6990c0ae 100644 +--- a/drivers/net/dsa/microchip/ksz_common.c ++++ b/drivers/net/dsa/microchip/ksz_common.c +@@ -414,18 +414,21 @@ int ksz_switch_register(struct ksz_device *dev, + ports = of_get_child_by_name(dev->dev->of_node, "ethernet-ports"); + if (!ports) + ports = of_get_child_by_name(dev->dev->of_node, "ports"); +- if (ports) ++ if (ports) { + for_each_available_child_of_node(ports, port) { + if (of_property_read_u32(port, "reg", + &port_num)) + continue; + if (!(dev->port_mask & BIT(port_num))) { + of_node_put(port); ++ of_node_put(ports); + return -EINVAL; + } + of_get_phy_mode(port, + &dev->ports[port_num].interface); + } ++ of_node_put(ports); ++ } + dev->synclko_125 = of_property_read_bool(dev->dev->of_node, + "microchip,synclko-125"); + } +-- +2.35.1 + diff --git a/queue-5.15/net-dsa-sja1105-silent-spi_device_id-warnings.patch b/queue-5.15/net-dsa-sja1105-silent-spi_device_id-warnings.patch new file mode 100644 index 00000000000..f5e01a1fa81 --- /dev/null +++ b/queue-5.15/net-dsa-sja1105-silent-spi_device_id-warnings.patch @@ -0,0 +1,68 @@ +From e8a25b71a17cc56348431a92f9ef20fe3e7f21e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Jul 2022 15:58:30 +0200 +Subject: net: dsa: sja1105: silent spi_device_id warnings + +From: Oleksij Rempel + +[ Upstream commit 855fe49984a8a3899f07ae1d149d46cd8d4acb52 ] + +Add spi_device_id entries to silent following warnings: + SPI driver sja1105 has no spi_device_id for nxp,sja1105e + SPI driver sja1105 has no spi_device_id for nxp,sja1105t + SPI driver sja1105 has no spi_device_id for nxp,sja1105p + SPI driver sja1105 has no spi_device_id for nxp,sja1105q + SPI driver sja1105 has no spi_device_id for nxp,sja1105r + SPI driver sja1105 has no spi_device_id for nxp,sja1105s + SPI driver sja1105 has no spi_device_id for nxp,sja1110a + SPI driver sja1105 has no spi_device_id for nxp,sja1110b + SPI driver sja1105 has no spi_device_id for nxp,sja1110c + SPI driver sja1105 has no spi_device_id for nxp,sja1110d + +Fixes: 5fa6863ba692 ("spi: Check we have a spi_device_id for each DT compatible") +Signed-off-by: Oleksij Rempel +Reviewed-by: Vladimir Oltean +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20220717135831.2492844-1-o.rempel@pengutronix.de +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/sja1105/sja1105_main.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c +index 924c3f129992..1a2a7536ff8a 100644 +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -3372,12 +3372,28 @@ static const struct of_device_id sja1105_dt_ids[] = { + }; + MODULE_DEVICE_TABLE(of, sja1105_dt_ids); + ++static const struct spi_device_id sja1105_spi_ids[] = { ++ { "sja1105e" }, ++ { "sja1105t" }, ++ { "sja1105p" }, ++ { "sja1105q" }, ++ { "sja1105r" }, ++ { "sja1105s" }, ++ { "sja1110a" }, ++ { "sja1110b" }, ++ { "sja1110c" }, ++ { "sja1110d" }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(spi, sja1105_spi_ids); ++ + static struct spi_driver sja1105_driver = { + .driver = { + .name = "sja1105", + .owner = THIS_MODULE, + .of_match_table = of_match_ptr(sja1105_dt_ids), + }, ++ .id_table = sja1105_spi_ids, + .probe = sja1105_probe, + .remove = sja1105_remove, + .shutdown = sja1105_shutdown, +-- +2.35.1 + diff --git a/queue-5.15/net-dsa-vitesse-vsc73xx-silent-spi_device_id-warning.patch b/queue-5.15/net-dsa-vitesse-vsc73xx-silent-spi_device_id-warning.patch new file mode 100644 index 00000000000..772b098f739 --- /dev/null +++ b/queue-5.15/net-dsa-vitesse-vsc73xx-silent-spi_device_id-warning.patch @@ -0,0 +1,49 @@ +From d8a7a88fbb3e0fdd7de8ecd8e8162744c4c4852b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Jul 2022 15:58:31 +0200 +Subject: net: dsa: vitesse-vsc73xx: silent spi_device_id warnings + +From: Oleksij Rempel + +[ Upstream commit 1774559f07993e1cac33c2406e99049d4bdea6c8 ] + +Add spi_device_id entries to silent SPI warnings. + +Fixes: 5fa6863ba692 ("spi: Check we have a spi_device_id for each DT compatible") +Signed-off-by: Oleksij Rempel +Reviewed-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20220717135831.2492844-2-o.rempel@pengutronix.de +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/vitesse-vsc73xx-spi.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/dsa/vitesse-vsc73xx-spi.c b/drivers/net/dsa/vitesse-vsc73xx-spi.c +index 645398901e05..922ae22fad66 100644 +--- a/drivers/net/dsa/vitesse-vsc73xx-spi.c ++++ b/drivers/net/dsa/vitesse-vsc73xx-spi.c +@@ -207,10 +207,20 @@ static const struct of_device_id vsc73xx_of_match[] = { + }; + MODULE_DEVICE_TABLE(of, vsc73xx_of_match); + ++static const struct spi_device_id vsc73xx_spi_ids[] = { ++ { "vsc7385" }, ++ { "vsc7388" }, ++ { "vsc7395" }, ++ { "vsc7398" }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(spi, vsc73xx_spi_ids); ++ + static struct spi_driver vsc73xx_spi_driver = { + .probe = vsc73xx_spi_probe, + .remove = vsc73xx_spi_remove, + .shutdown = vsc73xx_spi_shutdown, ++ .id_table = vsc73xx_spi_ids, + .driver = { + .name = "vsc73xx-spi", + .of_match_table = vsc73xx_of_match, +-- +2.35.1 + diff --git a/queue-5.15/net-ipv4-use-kfree_skb_reason-in-ip_rcv_core.patch b/queue-5.15/net-ipv4-use-kfree_skb_reason-in-ip_rcv_core.patch new file mode 100644 index 00000000000..7f6db45b9f5 --- /dev/null +++ b/queue-5.15/net-ipv4-use-kfree_skb_reason-in-ip_rcv_core.patch @@ -0,0 +1,117 @@ +From 34e864211062414193de01c1bcf4d0c280aefac5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Feb 2022 15:47:35 +0800 +Subject: net: ipv4: use kfree_skb_reason() in ip_rcv_core() + +From: Menglong Dong + +[ Upstream commit 33cba42985c8144eef78d618fc1e51aaa074b169 ] + +Replace kfree_skb() with kfree_skb_reason() in ip_rcv_core(). Three new +drop reasons are introduced: + +SKB_DROP_REASON_OTHERHOST +SKB_DROP_REASON_IP_CSUM +SKB_DROP_REASON_IP_INHDR + +Signed-off-by: Menglong Dong +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/skbuff.h | 9 +++++++++ + include/trace/events/skb.h | 3 +++ + net/ipv4/ip_input.c | 12 ++++++++++-- + 3 files changed, 22 insertions(+), 2 deletions(-) + +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index b63da0d1a4b2..514fb8074f78 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -318,6 +318,15 @@ enum skb_drop_reason { + SKB_DROP_REASON_SOCKET_FILTER, /* dropped by socket filter */ + SKB_DROP_REASON_UDP_CSUM, /* UDP checksum error */ + SKB_DROP_REASON_NETFILTER_DROP, /* dropped by netfilter */ ++ SKB_DROP_REASON_OTHERHOST, /* packet don't belong to current ++ * host (interface is in promisc ++ * mode) ++ */ ++ SKB_DROP_REASON_IP_CSUM, /* IP checksum error */ ++ SKB_DROP_REASON_IP_INHDR, /* there is something wrong with ++ * IP header (see ++ * IPSTATS_MIB_INHDRERRORS) ++ */ + SKB_DROP_REASON_MAX, + }; + +diff --git a/include/trace/events/skb.h b/include/trace/events/skb.h +index 3d89f7b09a43..f2b1778485f0 100644 +--- a/include/trace/events/skb.h ++++ b/include/trace/events/skb.h +@@ -17,6 +17,9 @@ + EM(SKB_DROP_REASON_SOCKET_FILTER, SOCKET_FILTER) \ + EM(SKB_DROP_REASON_UDP_CSUM, UDP_CSUM) \ + EM(SKB_DROP_REASON_NETFILTER_DROP, NETFILTER_DROP) \ ++ EM(SKB_DROP_REASON_OTHERHOST, OTHERHOST) \ ++ EM(SKB_DROP_REASON_IP_CSUM, IP_CSUM) \ ++ EM(SKB_DROP_REASON_IP_INHDR, IP_INHDR) \ + EMe(SKB_DROP_REASON_MAX, MAX) + + #undef EM +diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c +index 3a025c011971..7be18de32e16 100644 +--- a/net/ipv4/ip_input.c ++++ b/net/ipv4/ip_input.c +@@ -436,13 +436,16 @@ static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb) + static struct sk_buff *ip_rcv_core(struct sk_buff *skb, struct net *net) + { + const struct iphdr *iph; ++ int drop_reason; + u32 len; + + /* When the interface is in promisc. mode, drop all the crap + * that it receives, do not try to analyse it. + */ +- if (skb->pkt_type == PACKET_OTHERHOST) ++ if (skb->pkt_type == PACKET_OTHERHOST) { ++ drop_reason = SKB_DROP_REASON_OTHERHOST; + goto drop; ++ } + + __IP_UPD_PO_STATS(net, IPSTATS_MIB_IN, skb->len); + +@@ -452,6 +455,7 @@ static struct sk_buff *ip_rcv_core(struct sk_buff *skb, struct net *net) + goto out; + } + ++ drop_reason = SKB_DROP_REASON_NOT_SPECIFIED; + if (!pskb_may_pull(skb, sizeof(struct iphdr))) + goto inhdr_error; + +@@ -488,6 +492,7 @@ static struct sk_buff *ip_rcv_core(struct sk_buff *skb, struct net *net) + + len = ntohs(iph->tot_len); + if (skb->len < len) { ++ drop_reason = SKB_DROP_REASON_PKT_TOO_SMALL; + __IP_INC_STATS(net, IPSTATS_MIB_INTRUNCATEDPKTS); + goto drop; + } else if (len < (iph->ihl*4)) +@@ -516,11 +521,14 @@ static struct sk_buff *ip_rcv_core(struct sk_buff *skb, struct net *net) + return skb; + + csum_error: ++ drop_reason = SKB_DROP_REASON_IP_CSUM; + __IP_INC_STATS(net, IPSTATS_MIB_CSUMERRORS); + inhdr_error: ++ if (drop_reason == SKB_DROP_REASON_NOT_SPECIFIED) ++ drop_reason = SKB_DROP_REASON_IP_INHDR; + __IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS); + drop: +- kfree_skb(skb); ++ kfree_skb_reason(skb, drop_reason); + out: + return NULL; + } +-- +2.35.1 + diff --git a/queue-5.15/net-ipv4-use-kfree_skb_reason-in-ip_rcv_finish_core.patch b/queue-5.15/net-ipv4-use-kfree_skb_reason-in-ip_rcv_finish_core.patch new file mode 100644 index 00000000000..101dc7f31ad --- /dev/null +++ b/queue-5.15/net-ipv4-use-kfree_skb_reason-in-ip_rcv_finish_core.patch @@ -0,0 +1,105 @@ +From c58320020f295fbebcd51c9f84064e082e4ca451 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Feb 2022 15:47:36 +0800 +Subject: net: ipv4: use kfree_skb_reason() in ip_rcv_finish_core() + +From: Menglong Dong + +[ Upstream commit c1f166d1f7eef212096a98b22f5acf92f9af353d ] + +Replace kfree_skb() with kfree_skb_reason() in ip_rcv_finish_core(), +following drop reasons are introduced: + +SKB_DROP_REASON_IP_RPFILTER +SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST + +Signed-off-by: Menglong Dong +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/skbuff.h | 9 +++++++++ + include/trace/events/skb.h | 3 +++ + net/ipv4/ip_input.c | 14 ++++++++++---- + 3 files changed, 22 insertions(+), 4 deletions(-) + +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index 514fb8074f78..cbd719e5329a 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -327,6 +327,15 @@ enum skb_drop_reason { + * IP header (see + * IPSTATS_MIB_INHDRERRORS) + */ ++ SKB_DROP_REASON_IP_RPFILTER, /* IP rpfilter validate failed. ++ * see the document for rp_filter ++ * in ip-sysctl.rst for more ++ * information ++ */ ++ SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST, /* destination address of L2 ++ * is multicast, but L3 is ++ * unicast. ++ */ + SKB_DROP_REASON_MAX, + }; + +diff --git a/include/trace/events/skb.h b/include/trace/events/skb.h +index f2b1778485f0..485a1d3034a4 100644 +--- a/include/trace/events/skb.h ++++ b/include/trace/events/skb.h +@@ -20,6 +20,9 @@ + EM(SKB_DROP_REASON_OTHERHOST, OTHERHOST) \ + EM(SKB_DROP_REASON_IP_CSUM, IP_CSUM) \ + EM(SKB_DROP_REASON_IP_INHDR, IP_INHDR) \ ++ EM(SKB_DROP_REASON_IP_RPFILTER, IP_RPFILTER) \ ++ EM(SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST, \ ++ UNICAST_IN_L2_MULTICAST) \ + EMe(SKB_DROP_REASON_MAX, MAX) + + #undef EM +diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c +index 7be18de32e16..d5222c0fa87c 100644 +--- a/net/ipv4/ip_input.c ++++ b/net/ipv4/ip_input.c +@@ -318,8 +318,10 @@ static int ip_rcv_finish_core(struct net *net, struct sock *sk, + { + const struct iphdr *iph = ip_hdr(skb); + int (*edemux)(struct sk_buff *skb); ++ int err, drop_reason; + struct rtable *rt; +- int err; ++ ++ drop_reason = SKB_DROP_REASON_NOT_SPECIFIED; + + if (ip_can_use_hint(skb, iph, hint)) { + err = ip_route_use_hint(skb, iph->daddr, iph->saddr, iph->tos, +@@ -396,19 +398,23 @@ static int ip_rcv_finish_core(struct net *net, struct sock *sk, + * so-called "hole-196" attack) so do it for both. + */ + if (in_dev && +- IN_DEV_ORCONF(in_dev, DROP_UNICAST_IN_L2_MULTICAST)) ++ IN_DEV_ORCONF(in_dev, DROP_UNICAST_IN_L2_MULTICAST)) { ++ drop_reason = SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST; + goto drop; ++ } + } + + return NET_RX_SUCCESS; + + drop: +- kfree_skb(skb); ++ kfree_skb_reason(skb, drop_reason); + return NET_RX_DROP; + + drop_error: +- if (err == -EXDEV) ++ if (err == -EXDEV) { ++ drop_reason = SKB_DROP_REASON_IP_RPFILTER; + __NET_INC_STATS(net, LINUX_MIB_IPRPFILTER); ++ } + goto drop; + } + +-- +2.35.1 + diff --git a/queue-5.15/net-netfilter-use-kfree_drop_reason-for-nf_drop.patch b/queue-5.15/net-netfilter-use-kfree_drop_reason-for-nf_drop.patch new file mode 100644 index 00000000000..4a5c88d9408 --- /dev/null +++ b/queue-5.15/net-netfilter-use-kfree_drop_reason-for-nf_drop.patch @@ -0,0 +1,65 @@ +From a280c37007956f0c2332d8360815d1fc8838e785 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Feb 2022 15:47:34 +0800 +Subject: net: netfilter: use kfree_drop_reason() for NF_DROP + +From: Menglong Dong + +[ Upstream commit 2df3041ba3be950376e8c25a8f6da22f7fcc765c ] + +Replace kfree_skb() with kfree_skb_reason() in nf_hook_slow() when +skb is dropped by reason of NF_DROP. Following new drop reasons +are introduced: + +SKB_DROP_REASON_NETFILTER_DROP + +Signed-off-by: Menglong Dong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/skbuff.h | 1 + + include/trace/events/skb.h | 1 + + net/netfilter/core.c | 3 ++- + 3 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index f329c617eb96..b63da0d1a4b2 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -317,6 +317,7 @@ enum skb_drop_reason { + SKB_DROP_REASON_TCP_CSUM, /* TCP checksum error */ + SKB_DROP_REASON_SOCKET_FILTER, /* dropped by socket filter */ + SKB_DROP_REASON_UDP_CSUM, /* UDP checksum error */ ++ SKB_DROP_REASON_NETFILTER_DROP, /* dropped by netfilter */ + SKB_DROP_REASON_MAX, + }; + +diff --git a/include/trace/events/skb.h b/include/trace/events/skb.h +index a8a64b97504d..3d89f7b09a43 100644 +--- a/include/trace/events/skb.h ++++ b/include/trace/events/skb.h +@@ -16,6 +16,7 @@ + EM(SKB_DROP_REASON_TCP_CSUM, TCP_CSUM) \ + EM(SKB_DROP_REASON_SOCKET_FILTER, SOCKET_FILTER) \ + EM(SKB_DROP_REASON_UDP_CSUM, UDP_CSUM) \ ++ EM(SKB_DROP_REASON_NETFILTER_DROP, NETFILTER_DROP) \ + EMe(SKB_DROP_REASON_MAX, MAX) + + #undef EM +diff --git a/net/netfilter/core.c b/net/netfilter/core.c +index 60332fdb6dd4..cca0762a9010 100644 +--- a/net/netfilter/core.c ++++ b/net/netfilter/core.c +@@ -592,7 +592,8 @@ int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state, + case NF_ACCEPT: + break; + case NF_DROP: +- kfree_skb(skb); ++ kfree_skb_reason(skb, ++ SKB_DROP_REASON_NETFILTER_DROP); + ret = NF_DROP_GETERR(verdict); + if (ret == 0) + ret = -EPERM; +-- +2.35.1 + diff --git a/queue-5.15/net-skb-introduce-kfree_skb_reason.patch b/queue-5.15/net-skb-introduce-kfree_skb_reason.patch new file mode 100644 index 00000000000..7480c7f8350 --- /dev/null +++ b/queue-5.15/net-skb-introduce-kfree_skb_reason.patch @@ -0,0 +1,224 @@ +From caa5c5d4efddc7762825b8c7b023c70453f9c11b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Jan 2022 14:36:26 +0800 +Subject: net: skb: introduce kfree_skb_reason() + +From: Menglong Dong + +[ Upstream commit c504e5c2f9648a1e5c2be01e8c3f59d394192bd3 ] + +Introduce the interface kfree_skb_reason(), which is able to pass +the reason why the skb is dropped to 'kfree_skb' tracepoint. + +Add the 'reason' field to 'trace_kfree_skb', therefor user can get +more detail information about abnormal skb with 'drop_monitor' or +eBPF. + +All drop reasons are defined in the enum 'skb_drop_reason', and +they will be print as string in 'kfree_skb' tracepoint in format +of 'reason: XXX'. + +( Maybe the reasons should be defined in a uapi header file, so that +user space can use them? ) + +Signed-off-by: Menglong Dong +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/linux/skbuff.h | 23 ++++++++++++++++++++++- + include/trace/events/skb.h | 36 +++++++++++++++++++++++++++++------- + net/core/dev.c | 3 ++- + net/core/drop_monitor.c | 10 +++++++--- + net/core/skbuff.c | 12 +++++++----- + 5 files changed, 67 insertions(+), 17 deletions(-) + +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index e213acaa91ec..029bc228bcf9 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -304,6 +304,17 @@ struct sk_buff_head { + + struct sk_buff; + ++/* The reason of skb drop, which is used in kfree_skb_reason(). ++ * en...maybe they should be splited by group? ++ * ++ * Each item here should also be in 'TRACE_SKB_DROP_REASON', which is ++ * used to translate the reason to string. ++ */ ++enum skb_drop_reason { ++ SKB_DROP_REASON_NOT_SPECIFIED, ++ SKB_DROP_REASON_MAX, ++}; ++ + /* To allow 64K frame to be packed as single skb without frag_list we + * require 64K/PAGE_SIZE pages plus 1 additional page to allow for + * buffers which do not start on a page boundary. +@@ -1074,8 +1085,18 @@ static inline bool skb_unref(struct sk_buff *skb) + return true; + } + ++void kfree_skb_reason(struct sk_buff *skb, enum skb_drop_reason reason); ++ ++/** ++ * kfree_skb - free an sk_buff with 'NOT_SPECIFIED' reason ++ * @skb: buffer to free ++ */ ++static inline void kfree_skb(struct sk_buff *skb) ++{ ++ kfree_skb_reason(skb, SKB_DROP_REASON_NOT_SPECIFIED); ++} ++ + void skb_release_head_state(struct sk_buff *skb); +-void kfree_skb(struct sk_buff *skb); + void kfree_skb_list(struct sk_buff *segs); + void skb_dump(const char *level, const struct sk_buff *skb, bool full_pkt); + void skb_tx_error(struct sk_buff *skb); +diff --git a/include/trace/events/skb.h b/include/trace/events/skb.h +index 9e92f22eb086..294c61bbe44b 100644 +--- a/include/trace/events/skb.h ++++ b/include/trace/events/skb.h +@@ -9,29 +9,51 @@ + #include + #include + ++#define TRACE_SKB_DROP_REASON \ ++ EM(SKB_DROP_REASON_NOT_SPECIFIED, NOT_SPECIFIED) \ ++ EMe(SKB_DROP_REASON_MAX, MAX) ++ ++#undef EM ++#undef EMe ++ ++#define EM(a, b) TRACE_DEFINE_ENUM(a); ++#define EMe(a, b) TRACE_DEFINE_ENUM(a); ++ ++TRACE_SKB_DROP_REASON ++ ++#undef EM ++#undef EMe ++#define EM(a, b) { a, #b }, ++#define EMe(a, b) { a, #b } ++ + /* + * Tracepoint for free an sk_buff: + */ + TRACE_EVENT(kfree_skb, + +- TP_PROTO(struct sk_buff *skb, void *location), ++ TP_PROTO(struct sk_buff *skb, void *location, ++ enum skb_drop_reason reason), + +- TP_ARGS(skb, location), ++ TP_ARGS(skb, location, reason), + + TP_STRUCT__entry( +- __field( void *, skbaddr ) +- __field( void *, location ) +- __field( unsigned short, protocol ) ++ __field(void *, skbaddr) ++ __field(void *, location) ++ __field(unsigned short, protocol) ++ __field(enum skb_drop_reason, reason) + ), + + TP_fast_assign( + __entry->skbaddr = skb; + __entry->location = location; + __entry->protocol = ntohs(skb->protocol); ++ __entry->reason = reason; + ), + +- TP_printk("skbaddr=%p protocol=%u location=%p", +- __entry->skbaddr, __entry->protocol, __entry->location) ++ TP_printk("skbaddr=%p protocol=%u location=%p reason: %s", ++ __entry->skbaddr, __entry->protocol, __entry->location, ++ __print_symbolic(__entry->reason, ++ TRACE_SKB_DROP_REASON)) + ); + + TRACE_EVENT(consume_skb, +diff --git a/net/core/dev.c b/net/core/dev.c +index 6111506a4105..12b1811cb488 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -5005,7 +5005,8 @@ static __latent_entropy void net_tx_action(struct softirq_action *h) + if (likely(get_kfree_skb_cb(skb)->reason == SKB_REASON_CONSUMED)) + trace_consume_skb(skb); + else +- trace_kfree_skb(skb, net_tx_action); ++ trace_kfree_skb(skb, net_tx_action, ++ SKB_DROP_REASON_NOT_SPECIFIED); + + if (skb->fclone != SKB_FCLONE_UNAVAILABLE) + __kfree_skb(skb); +diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c +index 1d99b731e5b2..78202141930f 100644 +--- a/net/core/drop_monitor.c ++++ b/net/core/drop_monitor.c +@@ -110,7 +110,8 @@ static u32 net_dm_queue_len = 1000; + + struct net_dm_alert_ops { + void (*kfree_skb_probe)(void *ignore, struct sk_buff *skb, +- void *location); ++ void *location, ++ enum skb_drop_reason reason); + void (*napi_poll_probe)(void *ignore, struct napi_struct *napi, + int work, int budget); + void (*work_item_func)(struct work_struct *work); +@@ -262,7 +263,9 @@ static void trace_drop_common(struct sk_buff *skb, void *location) + spin_unlock_irqrestore(&data->lock, flags); + } + +-static void trace_kfree_skb_hit(void *ignore, struct sk_buff *skb, void *location) ++static void trace_kfree_skb_hit(void *ignore, struct sk_buff *skb, ++ void *location, ++ enum skb_drop_reason reason) + { + trace_drop_common(skb, location); + } +@@ -494,7 +497,8 @@ static const struct net_dm_alert_ops net_dm_alert_summary_ops = { + + static void net_dm_packet_trace_kfree_skb_hit(void *ignore, + struct sk_buff *skb, +- void *location) ++ void *location, ++ enum skb_drop_reason reason) + { + ktime_t tstamp = ktime_get_real(); + struct per_cpu_dm_data *data; +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 7ef0f5a8ab03..5ebef94e14dc 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -759,21 +759,23 @@ void __kfree_skb(struct sk_buff *skb) + EXPORT_SYMBOL(__kfree_skb); + + /** +- * kfree_skb - free an sk_buff ++ * kfree_skb_reason - free an sk_buff with special reason + * @skb: buffer to free ++ * @reason: reason why this skb is dropped + * + * Drop a reference to the buffer and free it if the usage count has +- * hit zero. ++ * hit zero. Meanwhile, pass the drop reason to 'kfree_skb' ++ * tracepoint. + */ +-void kfree_skb(struct sk_buff *skb) ++void kfree_skb_reason(struct sk_buff *skb, enum skb_drop_reason reason) + { + if (!skb_unref(skb)) + return; + +- trace_kfree_skb(skb, __builtin_return_address(0)); ++ trace_kfree_skb(skb, __builtin_return_address(0), reason); + __kfree_skb(skb); + } +-EXPORT_SYMBOL(kfree_skb); ++EXPORT_SYMBOL(kfree_skb_reason); + + void kfree_skb_list(struct sk_buff *segs) + { +-- +2.35.1 + diff --git a/queue-5.15/net-skb-use-kfree_skb_reason-in-__udp4_lib_rcv.patch b/queue-5.15/net-skb-use-kfree_skb_reason-in-__udp4_lib_rcv.patch new file mode 100644 index 00000000000..f83a4202748 --- /dev/null +++ b/queue-5.15/net-skb-use-kfree_skb_reason-in-__udp4_lib_rcv.patch @@ -0,0 +1,101 @@ +From 16374b153884a0ec03bc0b2f4615c2b7d52067e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Jan 2022 14:36:28 +0800 +Subject: net: skb: use kfree_skb_reason() in __udp4_lib_rcv() + +From: Menglong Dong + +[ Upstream commit 1c7fab70df085d866a3765955f397ca2b4025b15 ] + +Replace kfree_skb() with kfree_skb_reason() in __udp4_lib_rcv. +New drop reason 'SKB_DROP_REASON_UDP_CSUM' is added for udp csum +error. + +Signed-off-by: Menglong Dong +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/linux/skbuff.h | 1 + + include/trace/events/skb.h | 1 + + net/ipv4/udp.c | 10 ++++++++-- + 3 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index 5305af6cc86f..66aac2006868 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -316,6 +316,7 @@ enum skb_drop_reason { + SKB_DROP_REASON_PKT_TOO_SMALL, + SKB_DROP_REASON_TCP_CSUM, + SKB_DROP_REASON_TCP_FILTER, ++ SKB_DROP_REASON_UDP_CSUM, + SKB_DROP_REASON_MAX, + }; + +diff --git a/include/trace/events/skb.h b/include/trace/events/skb.h +index faa7d068a7bc..3e042ca2cedb 100644 +--- a/include/trace/events/skb.h ++++ b/include/trace/events/skb.h +@@ -15,6 +15,7 @@ + EM(SKB_DROP_REASON_PKT_TOO_SMALL, PKT_TOO_SMALL) \ + EM(SKB_DROP_REASON_TCP_CSUM, TCP_CSUM) \ + EM(SKB_DROP_REASON_TCP_FILTER, TCP_FILTER) \ ++ EM(SKB_DROP_REASON_UDP_CSUM, UDP_CSUM) \ + EMe(SKB_DROP_REASON_MAX, MAX) + + #undef EM +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 835b9d6e4e68..4ad4daa16cce 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -2411,6 +2411,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + __be32 saddr, daddr; + struct net *net = dev_net(skb->dev); + bool refcounted; ++ int drop_reason; ++ ++ drop_reason = SKB_DROP_REASON_NOT_SPECIFIED; + + /* + * Validate the packet. +@@ -2466,6 +2469,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + if (udp_lib_checksum_complete(skb)) + goto csum_error; + ++ drop_reason = SKB_DROP_REASON_NO_SOCKET; + __UDP_INC_STATS(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE); + icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0); + +@@ -2473,10 +2477,11 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + * Hmm. We got an UDP packet to a port to which we + * don't wanna listen. Ignore it. + */ +- kfree_skb(skb); ++ kfree_skb_reason(skb, drop_reason); + return 0; + + short_packet: ++ drop_reason = SKB_DROP_REASON_PKT_TOO_SMALL; + net_dbg_ratelimited("UDP%s: short packet: From %pI4:%u %d/%d to %pI4:%u\n", + proto == IPPROTO_UDPLITE ? "Lite" : "", + &saddr, ntohs(uh->source), +@@ -2489,6 +2494,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + * RFC1122: OK. Discards the bad packet silently (as far as + * the network is concerned, anyway) as per 4.1.3.4 (MUST). + */ ++ drop_reason = SKB_DROP_REASON_UDP_CSUM; + net_dbg_ratelimited("UDP%s: bad checksum. From %pI4:%u to %pI4:%u ulen %d\n", + proto == IPPROTO_UDPLITE ? "Lite" : "", + &saddr, ntohs(uh->source), &daddr, ntohs(uh->dest), +@@ -2496,7 +2502,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + __UDP_INC_STATS(net, UDP_MIB_CSUMERRORS, proto == IPPROTO_UDPLITE); + drop: + __UDP_INC_STATS(net, UDP_MIB_INERRORS, proto == IPPROTO_UDPLITE); +- kfree_skb(skb); ++ kfree_skb_reason(skb, drop_reason); + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.15/net-skb-use-kfree_skb_reason-in-tcp_v4_rcv.patch b/queue-5.15/net-skb-use-kfree_skb_reason-in-tcp_v4_rcv.patch new file mode 100644 index 00000000000..893517657eb --- /dev/null +++ b/queue-5.15/net-skb-use-kfree_skb_reason-in-tcp_v4_rcv.patch @@ -0,0 +1,131 @@ +From 22ab3ff8f5f8fca4e57d4700d0097a31121fd917 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Jan 2022 14:36:27 +0800 +Subject: net: skb: use kfree_skb_reason() in tcp_v4_rcv() + +From: Menglong Dong + +[ Upstream commit 85125597419aec3aa7b8f3b8713e415f997796f2 ] + +Replace kfree_skb() with kfree_skb_reason() in tcp_v4_rcv(). Following +drop reasons are added: + +SKB_DROP_REASON_NO_SOCKET +SKB_DROP_REASON_PKT_TOO_SMALL +SKB_DROP_REASON_TCP_CSUM +SKB_DROP_REASON_TCP_FILTER + +After this patch, 'kfree_skb' event will print message like this: + +$ TASK-PID CPU# ||||| TIMESTAMP FUNCTION +$ | | | ||||| | | + -0 [000] ..s1. 36.113438: kfree_skb: skbaddr=(____ptrval____) protocol=2048 location=(____ptrval____) reason: NO_SOCKET + +The reason of skb drop is printed too. + +Signed-off-by: Menglong Dong +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/linux/skbuff.h | 4 ++++ + include/trace/events/skb.h | 4 ++++ + net/ipv4/tcp_ipv4.c | 14 +++++++++++--- + 3 files changed, 19 insertions(+), 3 deletions(-) + +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index 029bc228bcf9..5305af6cc86f 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -312,6 +312,10 @@ struct sk_buff; + */ + enum skb_drop_reason { + SKB_DROP_REASON_NOT_SPECIFIED, ++ SKB_DROP_REASON_NO_SOCKET, ++ SKB_DROP_REASON_PKT_TOO_SMALL, ++ SKB_DROP_REASON_TCP_CSUM, ++ SKB_DROP_REASON_TCP_FILTER, + SKB_DROP_REASON_MAX, + }; + +diff --git a/include/trace/events/skb.h b/include/trace/events/skb.h +index 294c61bbe44b..faa7d068a7bc 100644 +--- a/include/trace/events/skb.h ++++ b/include/trace/events/skb.h +@@ -11,6 +11,10 @@ + + #define TRACE_SKB_DROP_REASON \ + EM(SKB_DROP_REASON_NOT_SPECIFIED, NOT_SPECIFIED) \ ++ EM(SKB_DROP_REASON_NO_SOCKET, NO_SOCKET) \ ++ EM(SKB_DROP_REASON_PKT_TOO_SMALL, PKT_TOO_SMALL) \ ++ EM(SKB_DROP_REASON_TCP_CSUM, TCP_CSUM) \ ++ EM(SKB_DROP_REASON_TCP_FILTER, TCP_FILTER) \ + EMe(SKB_DROP_REASON_MAX, MAX) + + #undef EM +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index b9a9f288bfa6..d901858aa440 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -1976,8 +1976,10 @@ int tcp_v4_rcv(struct sk_buff *skb) + const struct tcphdr *th; + bool refcounted; + struct sock *sk; ++ int drop_reason; + int ret; + ++ drop_reason = SKB_DROP_REASON_NOT_SPECIFIED; + if (skb->pkt_type != PACKET_HOST) + goto discard_it; + +@@ -1989,8 +1991,10 @@ int tcp_v4_rcv(struct sk_buff *skb) + + th = (const struct tcphdr *)skb->data; + +- if (unlikely(th->doff < sizeof(struct tcphdr) / 4)) ++ if (unlikely(th->doff < sizeof(struct tcphdr) / 4)) { ++ drop_reason = SKB_DROP_REASON_PKT_TOO_SMALL; + goto bad_packet; ++ } + if (!pskb_may_pull(skb, th->doff * 4)) + goto discard_it; + +@@ -2093,8 +2097,10 @@ int tcp_v4_rcv(struct sk_buff *skb) + + nf_reset_ct(skb); + +- if (tcp_filter(sk, skb)) ++ if (tcp_filter(sk, skb)) { ++ drop_reason = SKB_DROP_REASON_TCP_FILTER; + goto discard_and_relse; ++ } + th = (const struct tcphdr *)skb->data; + iph = ip_hdr(skb); + tcp_v4_fill_cb(skb, iph, th); +@@ -2131,6 +2137,7 @@ int tcp_v4_rcv(struct sk_buff *skb) + return ret; + + no_tcp_socket: ++ drop_reason = SKB_DROP_REASON_NO_SOCKET; + if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) + goto discard_it; + +@@ -2138,6 +2145,7 @@ int tcp_v4_rcv(struct sk_buff *skb) + + if (tcp_checksum_complete(skb)) { + csum_error: ++ drop_reason = SKB_DROP_REASON_TCP_CSUM; + trace_tcp_bad_csum(skb); + __TCP_INC_STATS(net, TCP_MIB_CSUMERRORS); + bad_packet: +@@ -2148,7 +2156,7 @@ int tcp_v4_rcv(struct sk_buff *skb) + + discard_it: + /* Discard frame. */ +- kfree_skb(skb); ++ kfree_skb_reason(skb, drop_reason); + return 0; + + discard_and_relse: +-- +2.35.1 + diff --git a/queue-5.15/net-skb_drop_reason-add-document-for-drop-reasons.patch b/queue-5.15/net-skb_drop_reason-add-document-for-drop-reasons.patch new file mode 100644 index 00000000000..72f836d69c0 --- /dev/null +++ b/queue-5.15/net-skb_drop_reason-add-document-for-drop-reasons.patch @@ -0,0 +1,52 @@ +From c9c2ed6f7aaf4232084d6d367b075bde0d63e1e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Feb 2022 15:47:33 +0800 +Subject: net: skb_drop_reason: add document for drop reasons + +From: Menglong Dong + +[ Upstream commit 88590b369354092183bcba04e2368010c462557f ] + +Add document for following existing drop reasons: + +SKB_DROP_REASON_NOT_SPECIFIED +SKB_DROP_REASON_NO_SOCKET +SKB_DROP_REASON_PKT_TOO_SMALL +SKB_DROP_REASON_TCP_CSUM +SKB_DROP_REASON_SOCKET_FILTER +SKB_DROP_REASON_UDP_CSUM + +Signed-off-by: Menglong Dong +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/skbuff.h | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index f92f05c9d72d..f329c617eb96 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -311,12 +311,12 @@ struct sk_buff; + * used to translate the reason to string. + */ + enum skb_drop_reason { +- SKB_DROP_REASON_NOT_SPECIFIED, +- SKB_DROP_REASON_NO_SOCKET, +- SKB_DROP_REASON_PKT_TOO_SMALL, +- SKB_DROP_REASON_TCP_CSUM, +- SKB_DROP_REASON_SOCKET_FILTER, +- SKB_DROP_REASON_UDP_CSUM, ++ SKB_DROP_REASON_NOT_SPECIFIED, /* drop reason is not specified */ ++ SKB_DROP_REASON_NO_SOCKET, /* socket not found */ ++ SKB_DROP_REASON_PKT_TOO_SMALL, /* packet size is too small */ ++ SKB_DROP_REASON_TCP_CSUM, /* TCP checksum error */ ++ SKB_DROP_REASON_SOCKET_FILTER, /* dropped by socket filter */ ++ SKB_DROP_REASON_UDP_CSUM, /* UDP checksum error */ + SKB_DROP_REASON_MAX, + }; + +-- +2.35.1 + diff --git a/queue-5.15/net-socket-rename-skb_drop_reason_socket_filter.patch b/queue-5.15/net-socket-rename-skb_drop_reason_socket_filter.patch new file mode 100644 index 00000000000..330f3aa881b --- /dev/null +++ b/queue-5.15/net-socket-rename-skb_drop_reason_socket_filter.patch @@ -0,0 +1,67 @@ +From 5d2664b04a0b4454d4a1e7b9ffb413cf48774fbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jan 2022 17:13:01 +0800 +Subject: net: socket: rename SKB_DROP_REASON_SOCKET_FILTER + +From: Menglong Dong + +[ Upstream commit 364df53c081d93fcfd6b91085ff2650c7f17b3c7 ] + +Rename SKB_DROP_REASON_SOCKET_FILTER, which is used +as the reason of skb drop out of socket filter before +it's part of a released kernel. It will be used for +more protocols than just TCP in future series. + +Signed-off-by: Menglong Dong +Reviewed-by: David Ahern +Link: https://lore.kernel.org/all/20220127091308.91401-2-imagedong@tencent.com/ +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/linux/skbuff.h | 2 +- + include/trace/events/skb.h | 2 +- + net/ipv4/tcp_ipv4.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index 66aac2006868..f92f05c9d72d 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -315,7 +315,7 @@ enum skb_drop_reason { + SKB_DROP_REASON_NO_SOCKET, + SKB_DROP_REASON_PKT_TOO_SMALL, + SKB_DROP_REASON_TCP_CSUM, +- SKB_DROP_REASON_TCP_FILTER, ++ SKB_DROP_REASON_SOCKET_FILTER, + SKB_DROP_REASON_UDP_CSUM, + SKB_DROP_REASON_MAX, + }; +diff --git a/include/trace/events/skb.h b/include/trace/events/skb.h +index 3e042ca2cedb..a8a64b97504d 100644 +--- a/include/trace/events/skb.h ++++ b/include/trace/events/skb.h +@@ -14,7 +14,7 @@ + EM(SKB_DROP_REASON_NO_SOCKET, NO_SOCKET) \ + EM(SKB_DROP_REASON_PKT_TOO_SMALL, PKT_TOO_SMALL) \ + EM(SKB_DROP_REASON_TCP_CSUM, TCP_CSUM) \ +- EM(SKB_DROP_REASON_TCP_FILTER, TCP_FILTER) \ ++ EM(SKB_DROP_REASON_SOCKET_FILTER, SOCKET_FILTER) \ + EM(SKB_DROP_REASON_UDP_CSUM, UDP_CSUM) \ + EMe(SKB_DROP_REASON_MAX, MAX) + +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index d901858aa440..235ae91bfd5a 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -2098,7 +2098,7 @@ int tcp_v4_rcv(struct sk_buff *skb) + nf_reset_ct(skb); + + if (tcp_filter(sk, skb)) { +- drop_reason = SKB_DROP_REASON_TCP_FILTER; ++ drop_reason = SKB_DROP_REASON_SOCKET_FILTER; + goto discard_and_relse; + } + th = (const struct tcphdr *)skb->data; +-- +2.35.1 + diff --git a/queue-5.15/net-stmmac-fix-dma-queue-left-shift-overflow-issue.patch b/queue-5.15/net-stmmac-fix-dma-queue-left-shift-overflow-issue.patch new file mode 100644 index 00000000000..2f3cb6a9d90 --- /dev/null +++ b/queue-5.15/net-stmmac-fix-dma-queue-left-shift-overflow-issue.patch @@ -0,0 +1,82 @@ +From 8a077e9e225ffb33dd80cf6a2308d8e2ddf94a09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 15:47:01 +0800 +Subject: net: stmmac: fix dma queue left shift overflow issue + +From: Junxiao Chang + +[ Upstream commit 613b065ca32e90209024ec4a6bb5ca887ee70980 ] + +When queue number is > 4, left shift overflows due to 32 bits +integer variable. Mask calculation is wrong for MTL_RXQ_DMA_MAP1. + +If CONFIG_UBSAN is enabled, kernel dumps below warning: +[ 10.363842] ================================================================== +[ 10.363882] UBSAN: shift-out-of-bounds in /build/linux-intel-iotg-5.15-8e6Tf4/ +linux-intel-iotg-5.15-5.15.0/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c:224:12 +[ 10.363929] shift exponent 40 is too large for 32-bit type 'unsigned int' +[ 10.363953] CPU: 1 PID: 599 Comm: NetworkManager Not tainted 5.15.0-1003-intel-iotg +[ 10.363956] Hardware name: ADLINK Technology Inc. LEC-EL/LEC-EL, BIOS 0.15.11 12/22/2021 +[ 10.363958] Call Trace: +[ 10.363960] +[ 10.363963] dump_stack_lvl+0x4a/0x5f +[ 10.363971] dump_stack+0x10/0x12 +[ 10.363974] ubsan_epilogue+0x9/0x45 +[ 10.363976] __ubsan_handle_shift_out_of_bounds.cold+0x61/0x10e +[ 10.363979] ? wake_up_klogd+0x4a/0x50 +[ 10.363983] ? vprintk_emit+0x8f/0x240 +[ 10.363986] dwmac4_map_mtl_dma.cold+0x42/0x91 [stmmac] +[ 10.364001] stmmac_mtl_configuration+0x1ce/0x7a0 [stmmac] +[ 10.364009] ? dwmac410_dma_init_channel+0x70/0x70 [stmmac] +[ 10.364020] stmmac_hw_setup.cold+0xf/0xb14 [stmmac] +[ 10.364030] ? page_pool_alloc_pages+0x4d/0x70 +[ 10.364034] ? stmmac_clear_tx_descriptors+0x6e/0xe0 [stmmac] +[ 10.364042] stmmac_open+0x39e/0x920 [stmmac] +[ 10.364050] __dev_open+0xf0/0x1a0 +[ 10.364054] __dev_change_flags+0x188/0x1f0 +[ 10.364057] dev_change_flags+0x26/0x60 +[ 10.364059] do_setlink+0x908/0xc40 +[ 10.364062] ? do_setlink+0xb10/0xc40 +[ 10.364064] ? __nla_validate_parse+0x4c/0x1a0 +[ 10.364068] __rtnl_newlink+0x597/0xa10 +[ 10.364072] ? __nla_reserve+0x41/0x50 +[ 10.364074] ? __kmalloc_node_track_caller+0x1d0/0x4d0 +[ 10.364079] ? pskb_expand_head+0x75/0x310 +[ 10.364082] ? nla_reserve_64bit+0x21/0x40 +[ 10.364086] ? skb_free_head+0x65/0x80 +[ 10.364089] ? security_sock_rcv_skb+0x2c/0x50 +[ 10.364094] ? __cond_resched+0x19/0x30 +[ 10.364097] ? kmem_cache_alloc_trace+0x15a/0x420 +[ 10.364100] rtnl_newlink+0x49/0x70 + +This change fixes MTL_RXQ_DMA_MAP1 mask issue and channel/queue +mapping warning. + +Fixes: d43042f4da3e ("net: stmmac: mapping mtl rx to dma channel") +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=216195 +Reported-by: Cedric Wassenaar +Signed-off-by: Junxiao Chang +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +index b21745368983..412abfabd28b 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +@@ -219,6 +219,9 @@ static void dwmac4_map_mtl_dma(struct mac_device_info *hw, u32 queue, u32 chan) + if (queue == 0 || queue == 4) { + value &= ~MTL_RXQ_DMA_Q04MDMACH_MASK; + value |= MTL_RXQ_DMA_Q04MDMACH(chan); ++ } else if (queue > 4) { ++ value &= ~MTL_RXQ_DMA_QXMDMACH_MASK(queue - 4); ++ value |= MTL_RXQ_DMA_QXMDMACH(chan, queue - 4); + } else { + value &= ~MTL_RXQ_DMA_QXMDMACH_MASK(queue); + value |= MTL_RXQ_DMA_QXMDMACH(chan, queue); +-- +2.35.1 + diff --git a/queue-5.15/net-stmmac-fix-pm-runtime-issue-in-stmmac_dvr_remove.patch b/queue-5.15/net-stmmac-fix-pm-runtime-issue-in-stmmac_dvr_remove.patch new file mode 100644 index 00000000000..feb504884c4 --- /dev/null +++ b/queue-5.15/net-stmmac-fix-pm-runtime-issue-in-stmmac_dvr_remove.patch @@ -0,0 +1,59 @@ +From c1fa8393c7304d5684f516d6ce05a47de35dd774 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 14:00:13 +0800 +Subject: net: stmmac: fix pm runtime issue in stmmac_dvr_remove() + +From: Biao Huang + +[ Upstream commit 0d9a15913b871e03fdd3b3d90a2e665fb22f9bcf ] + +If netif is running when stmmac_dvr_remove is invoked, +the unregister_netdev will call ndo_stop(stmmac_release) and +vlan_kill_rx_filter(stmmac_vlan_rx_kill_vid). + +Currently, stmmac_dvr_remove() will disable pm runtime before +unregister_netdev. When stmmac_vlan_rx_kill_vid is invoked, +pm_runtime_resume_and_get in it returns EACCESS error number, +and reports: + + dwmac-mediatek 11021000.ethernet eth0: stmmac_dvr_remove: removing driver + dwmac-mediatek 11021000.ethernet eth0: FPE workqueue stop + dwmac-mediatek 11021000.ethernet eth0: failed to kill vid 0081/0 + +Move the pm_runtime_disable to the end of stmmac_dvr_remove +to fix this issue. + +Fixes: 6449520391dfc ("net: stmmac: properly handle with runtime pm in stmmac_dvr_remove()") +Signed-off-by: Biao Huang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 9c1e19ea6fcd..95e1307cfda2 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -7279,8 +7279,6 @@ int stmmac_dvr_remove(struct device *dev) + netdev_info(priv->dev, "%s: removing driver", __func__); + + pm_runtime_get_sync(dev); +- pm_runtime_disable(dev); +- pm_runtime_put_noidle(dev); + + stmmac_stop_all_dma(priv); + stmmac_mac_set(priv, priv->ioaddr, false); +@@ -7307,6 +7305,9 @@ int stmmac_dvr_remove(struct device *dev) + mutex_destroy(&priv->lock); + bitmap_free(priv->af_xdp_zc_qps); + ++ pm_runtime_disable(dev); ++ pm_runtime_put_noidle(dev); ++ + return 0; + } + EXPORT_SYMBOL_GPL(stmmac_dvr_remove); +-- +2.35.1 + diff --git a/queue-5.15/net-stmmac-fix-unbalanced-ptp-clock-issue-in-suspend.patch b/queue-5.15/net-stmmac-fix-unbalanced-ptp-clock-issue-in-suspend.patch new file mode 100644 index 00000000000..b93a0c63502 --- /dev/null +++ b/queue-5.15/net-stmmac-fix-unbalanced-ptp-clock-issue-in-suspend.patch @@ -0,0 +1,92 @@ +From bf3f4f9f0664ab1e56a508594fd090b08a7ddd98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 14:00:14 +0800 +Subject: net: stmmac: fix unbalanced ptp clock issue in suspend/resume flow + +From: Biao Huang + +[ Upstream commit f4c7d8948e866918d61493264dbbd67e45ef2bda ] + +Current stmmac driver will prepare/enable ptp_ref clock in +stmmac_init_tstamp_counter(). + +The stmmac_pltfr_noirq_suspend will disable it once in suspend flow. + +But in resume flow, + stmmac_pltfr_noirq_resume --> stmmac_init_tstamp_counter + stmmac_resume --> stmmac_hw_setup --> stmmac_init_ptp --> stmmac_init_tstamp_counter +ptp_ref clock reference counter increases twice, which leads to unbalance +ptp clock when resume back. + +Move ptp_ref clock prepare/enable out of stmmac_init_tstamp_counter to fix it. + +Fixes: 0735e639f129d ("net: stmmac: skip only stmmac_ptp_register when resume from suspend") +Signed-off-by: Biao Huang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 17 ++++++++--------- + .../ethernet/stmicro/stmmac/stmmac_platform.c | 8 +++++++- + 2 files changed, 15 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 95e1307cfda2..b4f83c865568 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -844,19 +844,10 @@ int stmmac_init_tstamp_counter(struct stmmac_priv *priv, u32 systime_flags) + struct timespec64 now; + u32 sec_inc = 0; + u64 temp = 0; +- int ret; + + if (!(priv->dma_cap.time_stamp || priv->dma_cap.atime_stamp)) + return -EOPNOTSUPP; + +- ret = clk_prepare_enable(priv->plat->clk_ptp_ref); +- if (ret < 0) { +- netdev_warn(priv->dev, +- "failed to enable PTP reference clock: %pe\n", +- ERR_PTR(ret)); +- return ret; +- } +- + stmmac_config_hw_tstamping(priv, priv->ptpaddr, systime_flags); + priv->systime_flags = systime_flags; + +@@ -3325,6 +3316,14 @@ static int stmmac_hw_setup(struct net_device *dev, bool ptp_register) + + stmmac_mmc_setup(priv); + ++ if (ptp_register) { ++ ret = clk_prepare_enable(priv->plat->clk_ptp_ref); ++ if (ret < 0) ++ netdev_warn(priv->dev, ++ "failed to enable PTP reference clock: %pe\n", ++ ERR_PTR(ret)); ++ } ++ + ret = stmmac_init_ptp(priv); + if (ret == -EOPNOTSUPP) + netdev_warn(priv->dev, "PTP not supported by HW\n"); +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +index 11e1055e8260..9f5cac4000da 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +@@ -815,7 +815,13 @@ static int __maybe_unused stmmac_pltfr_noirq_resume(struct device *dev) + if (ret) + return ret; + +- stmmac_init_tstamp_counter(priv, priv->systime_flags); ++ ret = clk_prepare_enable(priv->plat->clk_ptp_ref); ++ if (ret < 0) { ++ netdev_warn(priv->dev, ++ "failed to enable PTP reference clock: %pe\n", ++ ERR_PTR(ret)); ++ return ret; ++ } + } + + return 0; +-- +2.35.1 + diff --git a/queue-5.15/net-stmmac-remove-redunctant-disable-xpcs-eee-call.patch b/queue-5.15/net-stmmac-remove-redunctant-disable-xpcs-eee-call.patch new file mode 100644 index 00000000000..84602abf17d --- /dev/null +++ b/queue-5.15/net-stmmac-remove-redunctant-disable-xpcs-eee-call.patch @@ -0,0 +1,45 @@ +From e924b850eecdc3ff4dae01e90fd09aff3d4542c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 20:24:02 +0800 +Subject: net: stmmac: remove redunctant disable xPCS EEE call + +From: Wong Vee Khee + +[ Upstream commit da791bac104a3169b05b54270afe75daacba4641 ] + +Disable is done in stmmac_init_eee() on the event of MAC link down. +Since setting enable/disable EEE via ethtool will eventually trigger +a MAC down, removing this redunctant call in stmmac_ethtool.c to avoid +calling xpcs_config_eee() twice. + +Fixes: d4aeaed80b0e ("net: stmmac: trigger PCS EEE to turn off on link down") +Signed-off-by: Wong Vee Khee +Link: https://lore.kernel.org/r/20220715122402.1017470-1-vee.khee.wong@linux.intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +index 8f563b446d5c..dc31501fec8f 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +@@ -800,14 +800,6 @@ static int stmmac_ethtool_op_set_eee(struct net_device *dev, + netdev_warn(priv->dev, + "Setting EEE tx-lpi is not supported\n"); + +- if (priv->hw->xpcs) { +- ret = xpcs_config_eee(priv->hw->xpcs, +- priv->plat->mult_fact_100ns, +- edata->eee_enabled); +- if (ret) +- return ret; +- } +- + if (!edata->eee_enabled) + stmmac_disable_eee_mode(priv); + +-- +2.35.1 + diff --git a/queue-5.15/net-tls-fix-race-in-tls-device-down-flow.patch b/queue-5.15/net-tls-fix-race-in-tls-device-down-flow.patch new file mode 100644 index 00000000000..76e340fdff5 --- /dev/null +++ b/queue-5.15/net-tls-fix-race-in-tls-device-down-flow.patch @@ -0,0 +1,72 @@ +From 7cb7ab94f8746f54e96edf4388469b921aa8f1c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 11:42:16 +0300 +Subject: net/tls: Fix race in TLS device down flow + +From: Tariq Toukan + +[ Upstream commit f08d8c1bb97c48f24a82afaa2fd8c140f8d3da8b ] + +Socket destruction flow and tls_device_down function sync against each +other using tls_device_lock and the context refcount, to guarantee the +device resources are freed via tls_dev_del() by the end of +tls_device_down. + +In the following unfortunate flow, this won't happen: +- refcount is decreased to zero in tls_device_sk_destruct. +- tls_device_down starts, skips the context as refcount is zero, going + all the way until it flushes the gc work, and returns without freeing + the device resources. +- only then, tls_device_queue_ctx_destruction is called, queues the gc + work and frees the context's device resources. + +Solve it by decreasing the refcount in the socket's destruction flow +under the tls_device_lock, for perfect synchronization. This does not +slow down the common likely destructor flow, in which both the refcount +is decreased and the spinlock is acquired, anyway. + +Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure") +Reviewed-by: Maxim Mikityanskiy +Signed-off-by: Tariq Toukan +Reviewed-by: Jakub Kicinski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tls/tls_device.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c +index 4775431cbd38..4e33150cfb9e 100644 +--- a/net/tls/tls_device.c ++++ b/net/tls/tls_device.c +@@ -97,13 +97,16 @@ static void tls_device_queue_ctx_destruction(struct tls_context *ctx) + unsigned long flags; + + spin_lock_irqsave(&tls_device_lock, flags); ++ if (unlikely(!refcount_dec_and_test(&ctx->refcount))) ++ goto unlock; ++ + list_move_tail(&ctx->list, &tls_device_gc_list); + + /* schedule_work inside the spinlock + * to make sure tls_device_down waits for that work. + */ + schedule_work(&tls_device_gc_work); +- ++unlock: + spin_unlock_irqrestore(&tls_device_lock, flags); + } + +@@ -194,8 +197,7 @@ void tls_device_sk_destruct(struct sock *sk) + clean_acked_data_disable(inet_csk(sk)); + } + +- if (refcount_dec_and_test(&tls_ctx->refcount)) +- tls_device_queue_ctx_destruction(tls_ctx); ++ tls_device_queue_ctx_destruction(tls_ctx); + } + EXPORT_SYMBOL_GPL(tls_device_sk_destruct); + +-- +2.35.1 + diff --git a/queue-5.15/net-tun-split-run_ebpf_filter-and-pskb_trim-into-dif.patch b/queue-5.15/net-tun-split-run_ebpf_filter-and-pskb_trim-into-dif.patch new file mode 100644 index 00000000000..b2b7768f3a1 --- /dev/null +++ b/queue-5.15/net-tun-split-run_ebpf_filter-and-pskb_trim-into-dif.patch @@ -0,0 +1,44 @@ +From d8ca90b50cc8f133f94e3d6f31fd91c8da724dde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Mar 2022 06:55:06 -0800 +Subject: net: tun: split run_ebpf_filter() and pskb_trim() into different "if + statement" + +From: Dongli Zhang + +[ Upstream commit 45a15d89fbcd280571eba8e5ca309e14ba6afa8f ] + +No functional change. + +Just to split the if statement into different conditions to use +kfree_skb_reason() to trace the reason later. + +Cc: Joao Martins +Cc: Joe Jin +Signed-off-by: Dongli Zhang +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/tun.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index ea60453fe69a..f92d6a12831f 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -1097,7 +1097,10 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev) + goto drop; + + len = run_ebpf_filter(tun, skb, len); +- if (len == 0 || pskb_trim(skb, len)) ++ if (len == 0) ++ goto drop; ++ ++ if (pskb_trim(skb, len)) + goto drop; + + if (unlikely(skb_orphan_frags_rx(skb, GFP_ATOMIC))) +-- +2.35.1 + diff --git a/queue-5.15/nvme-check-for-duplicate-identifiers-earlier.patch b/queue-5.15/nvme-check-for-duplicate-identifiers-earlier.patch new file mode 100644 index 00000000000..f787b0d972f --- /dev/null +++ b/queue-5.15/nvme-check-for-duplicate-identifiers-earlier.patch @@ -0,0 +1,55 @@ +From ccef8f4daa6ff354b23cb2ce5dcb2b73deabdd29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Feb 2022 17:46:50 +0100 +Subject: nvme: check for duplicate identifiers earlier + +From: Christoph Hellwig + +[ Upstream commit e2d77d2e11c4f1e70a1a24cc8fe63ff3dc9b53ef ] + +Lift the check for duplicate identifiers into nvme_init_ns_head, which +avoids pointless error unwinding in case they don't match, and also +matches where we check identifier validity for the multipath case. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Keith Busch +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 29b56ea01132..8fca84d44446 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3686,13 +3686,6 @@ static struct nvme_ns_head *nvme_alloc_ns_head(struct nvme_ctrl *ctrl, + head->ids = *ids; + kref_init(&head->ref); + +- ret = nvme_subsys_check_duplicate_ids(ctrl->subsys, &head->ids); +- if (ret) { +- dev_err(ctrl->device, +- "duplicate IDs for nsid %d\n", nsid); +- goto out_cleanup_srcu; +- } +- + if (head->ids.csi) { + ret = nvme_get_effects_log(ctrl, head->ids.csi, &head->effects); + if (ret) +@@ -3731,6 +3724,12 @@ static int nvme_init_ns_head(struct nvme_ns *ns, unsigned nsid, + mutex_lock(&ctrl->subsys->lock); + head = nvme_find_ns_head(ctrl, nsid); + if (!head) { ++ ret = nvme_subsys_check_duplicate_ids(ctrl->subsys, ids); ++ if (ret) { ++ dev_err(ctrl->device, ++ "duplicate IDs for nsid %d\n", nsid); ++ goto out_unlock; ++ } + head = nvme_alloc_ns_head(ctrl, nsid, ids); + if (IS_ERR(head)) { + ret = PTR_ERR(head); +-- +2.35.1 + diff --git a/queue-5.15/nvme-fix-block-device-naming-collision.patch b/queue-5.15/nvme-fix-block-device-naming-collision.patch new file mode 100644 index 00000000000..e918c4338a5 --- /dev/null +++ b/queue-5.15/nvme-fix-block-device-naming-collision.patch @@ -0,0 +1,64 @@ +From e7f90ffdac7187a323c8ef6ff838353f0791178d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 12:42:10 +0000 +Subject: nvme: fix block device naming collision + +From: Israel Rukshin + +[ Upstream commit 6961b5e02876b3b47f030a1f1ee8fd3e631ac270 ] + +The issue exists when multipath is enabled and the namespace is +shared, but all the other controller checks at nvme_is_unique_nsid() +are false. The reason for this issue is that nvme_is_unique_nsid() +returns false when is called from nvme_mpath_alloc_disk() due to an +uninitialized value of head->shared. The patch fixes it by setting +head->shared before nvme_mpath_alloc_disk() is called. + +Fixes: 5974ea7ce0f9 ("nvme: allow duplicate NSIDs for private namespaces") +Signed-off-by: Israel Rukshin +Reviewed-by: Keith Busch +Reviewed-by: Max Gurtovoy +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 8fca84d44446..0c9cdbaf5cd6 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3660,7 +3660,7 @@ static int nvme_add_ns_cdev(struct nvme_ns *ns) + } + + static struct nvme_ns_head *nvme_alloc_ns_head(struct nvme_ctrl *ctrl, +- unsigned nsid, struct nvme_ns_ids *ids) ++ unsigned nsid, struct nvme_ns_ids *ids, bool is_shared) + { + struct nvme_ns_head *head; + size_t size = sizeof(*head); +@@ -3684,6 +3684,7 @@ static struct nvme_ns_head *nvme_alloc_ns_head(struct nvme_ctrl *ctrl, + head->subsys = ctrl->subsys; + head->ns_id = nsid; + head->ids = *ids; ++ head->shared = is_shared; + kref_init(&head->ref); + + if (head->ids.csi) { +@@ -3730,12 +3731,11 @@ static int nvme_init_ns_head(struct nvme_ns *ns, unsigned nsid, + "duplicate IDs for nsid %d\n", nsid); + goto out_unlock; + } +- head = nvme_alloc_ns_head(ctrl, nsid, ids); ++ head = nvme_alloc_ns_head(ctrl, nsid, ids, is_shared); + if (IS_ERR(head)) { + ret = PTR_ERR(head); + goto out_unlock; + } +- head->shared = is_shared; + } else { + ret = -EINVAL; + if (!is_shared || !head->shared) { +-- +2.35.1 + diff --git a/queue-5.15/perf-core-fix-data-race-between-perf_event_set_outpu.patch b/queue-5.15/perf-core-fix-data-race-between-perf_event_set_outpu.patch new file mode 100644 index 00000000000..c480202a2e5 --- /dev/null +++ b/queue-5.15/perf-core-fix-data-race-between-perf_event_set_outpu.patch @@ -0,0 +1,167 @@ +From 01919a88b779fb5c33b7c742e416d3e92efe0a93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jul 2022 15:07:26 +0200 +Subject: perf/core: Fix data race between perf_event_set_output() and + perf_mmap_close() + +From: Peter Zijlstra + +[ Upstream commit 68e3c69803dada336893640110cb87221bb01dcf ] + +Yang Jihing reported a race between perf_event_set_output() and +perf_mmap_close(): + + CPU1 CPU2 + + perf_mmap_close(e2) + if (atomic_dec_and_test(&e2->rb->mmap_count)) // 1 - > 0 + detach_rest = true + + ioctl(e1, IOC_SET_OUTPUT, e2) + perf_event_set_output(e1, e2) + + ... + list_for_each_entry_rcu(e, &e2->rb->event_list, rb_entry) + ring_buffer_attach(e, NULL); + // e1 isn't yet added and + // therefore not detached + + ring_buffer_attach(e1, e2->rb) + list_add_rcu(&e1->rb_entry, + &e2->rb->event_list) + +After this; e1 is attached to an unmapped rb and a subsequent +perf_mmap() will loop forever more: + + again: + mutex_lock(&e->mmap_mutex); + if (event->rb) { + ... + if (!atomic_inc_not_zero(&e->rb->mmap_count)) { + ... + mutex_unlock(&e->mmap_mutex); + goto again; + } + } + +The loop in perf_mmap_close() holds e2->mmap_mutex, while the attach +in perf_event_set_output() holds e1->mmap_mutex. As such there is no +serialization to avoid this race. + +Change perf_event_set_output() to take both e1->mmap_mutex and +e2->mmap_mutex to alleviate that problem. Additionally, have the loop +in perf_mmap() detach the rb directly, this avoids having to wait for +the concurrent perf_mmap_close() to get around to doing it to make +progress. + +Fixes: 9bb5d40cd93c ("perf: Fix mmap() accounting hole") +Reported-by: Yang Jihong +Signed-off-by: Peter Zijlstra (Intel) +Tested-by: Yang Jihong +Link: https://lkml.kernel.org/r/YsQ3jm2GR38SW7uD@worktop.programming.kicks-ass.net +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 45 ++++++++++++++++++++++++++++++-------------- + 1 file changed, 31 insertions(+), 14 deletions(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index d7e05d937560..c6c7a4d80573 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -6355,10 +6355,10 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) + + if (!atomic_inc_not_zero(&event->rb->mmap_count)) { + /* +- * Raced against perf_mmap_close() through +- * perf_event_set_output(). Try again, hope for better +- * luck. ++ * Raced against perf_mmap_close(); remove the ++ * event and try again. + */ ++ ring_buffer_attach(event, NULL); + mutex_unlock(&event->mmap_mutex); + goto again; + } +@@ -11892,14 +11892,25 @@ static int perf_copy_attr(struct perf_event_attr __user *uattr, + goto out; + } + ++static void mutex_lock_double(struct mutex *a, struct mutex *b) ++{ ++ if (b < a) ++ swap(a, b); ++ ++ mutex_lock(a); ++ mutex_lock_nested(b, SINGLE_DEPTH_NESTING); ++} ++ + static int + perf_event_set_output(struct perf_event *event, struct perf_event *output_event) + { + struct perf_buffer *rb = NULL; + int ret = -EINVAL; + +- if (!output_event) ++ if (!output_event) { ++ mutex_lock(&event->mmap_mutex); + goto set; ++ } + + /* don't allow circular references */ + if (event == output_event) +@@ -11937,8 +11948,15 @@ perf_event_set_output(struct perf_event *event, struct perf_event *output_event) + event->pmu != output_event->pmu) + goto out; + ++ /* ++ * Hold both mmap_mutex to serialize against perf_mmap_close(). Since ++ * output_event is already on rb->event_list, and the list iteration ++ * restarts after every removal, it is guaranteed this new event is ++ * observed *OR* if output_event is already removed, it's guaranteed we ++ * observe !rb->mmap_count. ++ */ ++ mutex_lock_double(&event->mmap_mutex, &output_event->mmap_mutex); + set: +- mutex_lock(&event->mmap_mutex); + /* Can't redirect output if we've got an active mmap() */ + if (atomic_read(&event->mmap_count)) + goto unlock; +@@ -11948,6 +11966,12 @@ perf_event_set_output(struct perf_event *event, struct perf_event *output_event) + rb = ring_buffer_get(output_event); + if (!rb) + goto unlock; ++ ++ /* did we race against perf_mmap_close() */ ++ if (!atomic_read(&rb->mmap_count)) { ++ ring_buffer_put(rb); ++ goto unlock; ++ } + } + + ring_buffer_attach(event, rb); +@@ -11955,20 +11979,13 @@ perf_event_set_output(struct perf_event *event, struct perf_event *output_event) + ret = 0; + unlock: + mutex_unlock(&event->mmap_mutex); ++ if (output_event) ++ mutex_unlock(&output_event->mmap_mutex); + + out: + return ret; + } + +-static void mutex_lock_double(struct mutex *a, struct mutex *b) +-{ +- if (b < a) +- swap(a, b); +- +- mutex_lock(a); +- mutex_lock_nested(b, SINGLE_DEPTH_NESTING); +-} +- + static int perf_event_set_clock(struct perf_event *event, clockid_t clk_id) + { + bool nmi_safe = false; +-- +2.35.1 + diff --git a/queue-5.15/perf-tests-fix-convert-perf-time-to-tsc-test-for-hyb.patch b/queue-5.15/perf-tests-fix-convert-perf-time-to-tsc-test-for-hyb.patch new file mode 100644 index 00000000000..179b7fb3e3e --- /dev/null +++ b/queue-5.15/perf-tests-fix-convert-perf-time-to-tsc-test-for-hyb.patch @@ -0,0 +1,80 @@ +From e2f62f71d4efd658bcee19c0e0e68c75a770dd1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 15:34:59 +0300 +Subject: perf tests: Fix Convert perf time to TSC test for hybrid + +From: Adrian Hunter + +[ Upstream commit deb44a6249f696106645c63c0603eab08a6122af ] + +The test does not always correctly determine the number of events for +hybrids, nor allow for more than 1 evsel when parsing. + +Fix by iterating the events actually created and getting the correct +evsel for the events processed. + +Fixes: d9da6f70eb235110 ("perf tests: Support 'Convert perf time to TSC' test for hybrid") +Reviewed-by: Kan Liang +Signed-off-by: Adrian Hunter +Cc: Ian Rogers +Cc: Jin Yao +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Thomas Richter +Link: https://lore.kernel.org/r/20220713123459.24145-3-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/perf-time-to-tsc.c | 18 ++++-------------- + 1 file changed, 4 insertions(+), 14 deletions(-) + +diff --git a/tools/perf/tests/perf-time-to-tsc.c b/tools/perf/tests/perf-time-to-tsc.c +index 7c56bc1f4cff..89d25befb171 100644 +--- a/tools/perf/tests/perf-time-to-tsc.c ++++ b/tools/perf/tests/perf-time-to-tsc.c +@@ -20,8 +20,6 @@ + #include "tsc.h" + #include "mmap.h" + #include "tests.h" +-#include "pmu.h" +-#include "pmu-hybrid.h" + + #define CHECK__(x) { \ + while ((x) < 0) { \ +@@ -84,18 +82,8 @@ int test__perf_time_to_tsc(struct test *test __maybe_unused, int subtest __maybe + + evlist__config(evlist, &opts, NULL); + +- evsel = evlist__first(evlist); +- +- evsel->core.attr.comm = 1; +- evsel->core.attr.disabled = 1; +- evsel->core.attr.enable_on_exec = 0; +- +- /* +- * For hybrid "cycles:u", it creates two events. +- * Init the second evsel here. +- */ +- if (perf_pmu__has_hybrid() && perf_pmu__hybrid_mounted("cpu_atom")) { +- evsel = evsel__next(evsel); ++ /* For hybrid "cycles:u", it creates two events */ ++ evlist__for_each_entry(evlist, evsel) { + evsel->core.attr.comm = 1; + evsel->core.attr.disabled = 1; + evsel->core.attr.enable_on_exec = 0; +@@ -141,10 +129,12 @@ int test__perf_time_to_tsc(struct test *test __maybe_unused, int subtest __maybe + goto next_event; + + if (strcmp(event->comm.comm, comm1) == 0) { ++ CHECK_NOT_NULL__(evsel = evlist__event2evsel(evlist, event)); + CHECK__(evsel__parse_sample(evsel, event, &sample)); + comm1_time = sample.time; + } + if (strcmp(event->comm.comm, comm2) == 0) { ++ CHECK_NOT_NULL__(evsel = evlist__event2evsel(evlist, event)); + CHECK__(evsel__parse_sample(evsel, event, &sample)); + comm2_time = sample.time; + } +-- +2.35.1 + diff --git a/queue-5.15/pinctrl-armada-37xx-convert-to-use-dev_err_probe.patch b/queue-5.15/pinctrl-armada-37xx-convert-to-use-dev_err_probe.patch new file mode 100644 index 00000000000..3986b1d0daf --- /dev/null +++ b/queue-5.15/pinctrl-armada-37xx-convert-to-use-dev_err_probe.patch @@ -0,0 +1,65 @@ +From 71ddd73045bf45339442a73f4191caba229e4744 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Nov 2021 14:42:34 +0200 +Subject: pinctrl: armada-37xx: Convert to use dev_err_probe() + +From: Andy Shevchenko + +[ Upstream commit 06cb10ea0cd5c5f4db9627a33ab47fec32cb5960 ] + +It's fine to call dev_err_probe() in ->probe() when error code is known. +Convert the driver to use dev_err_probe(). + +Signed-off-by: Andy Shevchenko +Reviewed-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 18 ++++++------------ + 1 file changed, 6 insertions(+), 12 deletions(-) + +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +index 40bcf05123eb..7d0d2771a9ac 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +@@ -736,10 +736,8 @@ static int armada_37xx_irqchip_register(struct platform_device *pdev, + break; + } + } +- if (ret) { +- dev_err(dev, "no gpio-controller child node\n"); +- return ret; +- } ++ if (ret) ++ return dev_err_probe(dev, ret, "no gpio-controller child node\n"); + + nr_irq_parent = of_irq_count(np); + spin_lock_init(&info->irq_lock); +@@ -996,10 +994,8 @@ static int armada_37xx_pinctrl_register(struct platform_device *pdev, + return ret; + + info->pctl_dev = devm_pinctrl_register(dev, ctrldesc, info); +- if (IS_ERR(info->pctl_dev)) { +- dev_err(dev, "could not register pinctrl driver\n"); +- return PTR_ERR(info->pctl_dev); +- } ++ if (IS_ERR(info->pctl_dev)) ++ return dev_err_probe(dev, PTR_ERR(info->pctl_dev), "could not register pinctrl driver\n"); + + return 0; + } +@@ -1135,10 +1131,8 @@ static int __init armada_37xx_pinctrl_probe(struct platform_device *pdev) + info->dev = dev; + + regmap = syscon_node_to_regmap(np); +- if (IS_ERR(regmap)) { +- dev_err(dev, "cannot get regmap\n"); +- return PTR_ERR(regmap); +- } ++ if (IS_ERR(regmap)) ++ return dev_err_probe(dev, PTR_ERR(regmap), "cannot get regmap\n"); + info->regmap = regmap; + + info->data = of_device_get_match_data(dev); +-- +2.35.1 + diff --git a/queue-5.15/pinctrl-armada-37xx-make-use-of-the-devm_platform_io.patch b/queue-5.15/pinctrl-armada-37xx-make-use-of-the-devm_platform_io.patch new file mode 100644 index 00000000000..24506893527 --- /dev/null +++ b/queue-5.15/pinctrl-armada-37xx-make-use-of-the-devm_platform_io.patch @@ -0,0 +1,50 @@ +From da41feab233ab6e9c1f9f2c9f7750c5ae30fc72d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Nov 2021 14:42:33 +0200 +Subject: pinctrl: armada-37xx: Make use of the + devm_platform_ioremap_resource() + +From: Andy Shevchenko + +[ Upstream commit 49bdef501728acbfadc7eeafafb4f6c3fea415eb ] + +Use the devm_platform_ioremap_resource() helper instead of +calling of_address_to_resource() and devm_ioremap_resource() +separately. + +Signed-off-by: Andy Shevchenko +Reviewed-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +index e1f76b4ddf23..40bcf05123eb 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +@@ -727,7 +727,6 @@ static int armada_37xx_irqchip_register(struct platform_device *pdev, + struct gpio_irq_chip *girq = &gc->irq; + struct device *dev = &pdev->dev; + struct device_node *np; +- struct resource res; + int ret = -ENODEV, i, nr_irq_parent; + + /* Check if we have at least one gpio-controller child node */ +@@ -750,12 +749,7 @@ static int armada_37xx_irqchip_register(struct platform_device *pdev, + return 0; + } + +- if (of_address_to_resource(dev->of_node, 1, &res)) { +- dev_err(dev, "cannot find IO resource\n"); +- return -ENOENT; +- } +- +- info->base = devm_ioremap_resource(dev, &res); ++ info->base = devm_platform_ioremap_resource(pdev, 1); + if (IS_ERR(info->base)) + return PTR_ERR(info->base); + +-- +2.35.1 + diff --git a/queue-5.15/pinctrl-armada-37xx-use-raw-spinlocks-for-regmap-to-.patch b/queue-5.15/pinctrl-armada-37xx-use-raw-spinlocks-for-regmap-to-.patch new file mode 100644 index 00000000000..eea59e2cc45 --- /dev/null +++ b/queue-5.15/pinctrl-armada-37xx-use-raw-spinlocks-for-regmap-to-.patch @@ -0,0 +1,92 @@ +From 14a6ec91d01b4a6e6a137b16cfe19ee55a788695 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Jul 2022 02:37:45 +0300 +Subject: pinctrl: armada-37xx: use raw spinlocks for regmap to avoid invalid + wait context + +From: Vladimir Oltean + +[ Upstream commit 4546760619cfa9b718fe2059ceb07101cf9ff61e ] + +The irqchip->irq_set_type method is called by __irq_set_trigger() under +the desc->lock raw spinlock. + +The armada-37xx implementation, armada_37xx_irq_set_type(), uses an MMIO +regmap created by of_syscon_register(), which uses plain spinlocks +(the kind that are sleepable on RT). + +Therefore, this is an invalid locking scheme for which we get a kernel +splat stating just that ("[ BUG: Invalid wait context ]"), because the +context in which the plain spinlock may sleep is atomic due to the raw +spinlock. We need to go raw spinlocks all the way. + +Make this driver create its own MMIO regmap, with use_raw_spinlock=true, +and stop relying on syscon to provide it. + +This patch depends on commit 67021f25d952 ("regmap: teach regmap to use +raw spinlocks if requested in the config"). + +Cc: # 5.15+ +Fixes: 2f227605394b ("pinctrl: armada-37xx: Add irqchip support") +Signed-off-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20220716233745.1704677-3-vladimir.oltean@nxp.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 27 ++++++++++++++++----- + 1 file changed, 21 insertions(+), 6 deletions(-) + +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +index 7d0d2771a9ac..7338bc353347 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +@@ -1116,25 +1116,40 @@ static const struct of_device_id armada_37xx_pinctrl_of_match[] = { + { }, + }; + ++static const struct regmap_config armada_37xx_pinctrl_regmap_config = { ++ .reg_bits = 32, ++ .val_bits = 32, ++ .reg_stride = 4, ++ .use_raw_spinlock = true, ++}; ++ + static int __init armada_37xx_pinctrl_probe(struct platform_device *pdev) + { + struct armada_37xx_pinctrl *info; + struct device *dev = &pdev->dev; +- struct device_node *np = dev->of_node; + struct regmap *regmap; ++ void __iomem *base; + int ret; + ++ base = devm_platform_get_and_ioremap_resource(pdev, 0, NULL); ++ if (IS_ERR(base)) { ++ dev_err(dev, "failed to ioremap base address: %pe\n", base); ++ return PTR_ERR(base); ++ } ++ ++ regmap = devm_regmap_init_mmio(dev, base, ++ &armada_37xx_pinctrl_regmap_config); ++ if (IS_ERR(regmap)) { ++ dev_err(dev, "failed to create regmap: %pe\n", regmap); ++ return PTR_ERR(regmap); ++ } ++ + info = devm_kzalloc(dev, sizeof(*info), GFP_KERNEL); + if (!info) + return -ENOMEM; + + info->dev = dev; +- +- regmap = syscon_node_to_regmap(np); +- if (IS_ERR(regmap)) +- return dev_err_probe(dev, PTR_ERR(regmap), "cannot get regmap\n"); + info->regmap = regmap; +- + info->data = of_device_get_match_data(dev); + + ret = armada_37xx_pinctrl_register(pdev, info); +-- +2.35.1 + diff --git a/queue-5.15/pinctrl-armada-37xx-use-temporary-variable-for-struc.patch b/queue-5.15/pinctrl-armada-37xx-use-temporary-variable-for-struc.patch new file mode 100644 index 00000000000..34aee2a8a58 --- /dev/null +++ b/queue-5.15/pinctrl-armada-37xx-use-temporary-variable-for-struc.patch @@ -0,0 +1,230 @@ +From 932040b8943ca372a8997ee853bbe4c8c2b69cab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Nov 2021 14:42:32 +0200 +Subject: pinctrl: armada-37xx: Use temporary variable for struct device + +From: Andy Shevchenko + +[ Upstream commit 50cf2ed284e49028a885aa56c3ea50714c635879 ] + +Use temporary variable for struct device to make code neater. + +Signed-off-by: Andy Shevchenko +Reviewed-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 56 +++++++++------------ + 1 file changed, 23 insertions(+), 33 deletions(-) + +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +index 85a0052bb0e6..e1f76b4ddf23 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +@@ -341,12 +341,12 @@ static int armada_37xx_pmx_set_by_name(struct pinctrl_dev *pctldev, + struct armada_37xx_pin_group *grp) + { + struct armada_37xx_pinctrl *info = pinctrl_dev_get_drvdata(pctldev); ++ struct device *dev = info->dev; + unsigned int reg = SELECTION; + unsigned int mask = grp->reg_mask; + int func, val; + +- dev_dbg(info->dev, "enable function %s group %s\n", +- name, grp->name); ++ dev_dbg(dev, "enable function %s group %s\n", name, grp->name); + + func = match_string(grp->funcs, NB_FUNCS, name); + if (func < 0) +@@ -722,16 +722,16 @@ static unsigned int armada_37xx_irq_startup(struct irq_data *d) + static int armada_37xx_irqchip_register(struct platform_device *pdev, + struct armada_37xx_pinctrl *info) + { +- struct device_node *np = info->dev->of_node; + struct gpio_chip *gc = &info->gpio_chip; + struct irq_chip *irqchip = &info->irq_chip; + struct gpio_irq_chip *girq = &gc->irq; + struct device *dev = &pdev->dev; ++ struct device_node *np; + struct resource res; + int ret = -ENODEV, i, nr_irq_parent; + + /* Check if we have at least one gpio-controller child node */ +- for_each_child_of_node(info->dev->of_node, np) { ++ for_each_child_of_node(dev->of_node, np) { + if (of_property_read_bool(np, "gpio-controller")) { + ret = 0; + break; +@@ -750,12 +750,12 @@ static int armada_37xx_irqchip_register(struct platform_device *pdev, + return 0; + } + +- if (of_address_to_resource(info->dev->of_node, 1, &res)) { ++ if (of_address_to_resource(dev->of_node, 1, &res)) { + dev_err(dev, "cannot find IO resource\n"); + return -ENOENT; + } + +- info->base = devm_ioremap_resource(info->dev, &res); ++ info->base = devm_ioremap_resource(dev, &res); + if (IS_ERR(info->base)) + return PTR_ERR(info->base); + +@@ -774,8 +774,7 @@ static int armada_37xx_irqchip_register(struct platform_device *pdev, + * the chained irq with all of them. + */ + girq->num_parents = nr_irq_parent; +- girq->parents = devm_kcalloc(&pdev->dev, nr_irq_parent, +- sizeof(*girq->parents), GFP_KERNEL); ++ girq->parents = devm_kcalloc(dev, nr_irq_parent, sizeof(*girq->parents), GFP_KERNEL); + if (!girq->parents) + return -ENOMEM; + for (i = 0; i < nr_irq_parent; i++) { +@@ -794,11 +793,12 @@ static int armada_37xx_irqchip_register(struct platform_device *pdev, + static int armada_37xx_gpiochip_register(struct platform_device *pdev, + struct armada_37xx_pinctrl *info) + { ++ struct device *dev = &pdev->dev; + struct device_node *np; + struct gpio_chip *gc; + int ret = -ENODEV; + +- for_each_child_of_node(info->dev->of_node, np) { ++ for_each_child_of_node(dev->of_node, np) { + if (of_find_property(np, "gpio-controller", NULL)) { + ret = 0; + break; +@@ -811,19 +811,16 @@ static int armada_37xx_gpiochip_register(struct platform_device *pdev, + + gc = &info->gpio_chip; + gc->ngpio = info->data->nr_pins; +- gc->parent = &pdev->dev; ++ gc->parent = dev; + gc->base = -1; + gc->of_node = np; + gc->label = info->data->name; + + ret = armada_37xx_irqchip_register(pdev, info); +- if (ret) +- return ret; +- ret = devm_gpiochip_add_data(&pdev->dev, gc, info); + if (ret) + return ret; + +- return 0; ++ return devm_gpiochip_add_data(dev, gc, info); + } + + /** +@@ -874,13 +871,13 @@ static int armada_37xx_add_function(struct armada_37xx_pmx_func *funcs, + static int armada_37xx_fill_group(struct armada_37xx_pinctrl *info) + { + int n, num = 0, funcsize = info->data->nr_pins; ++ struct device *dev = info->dev; + + for (n = 0; n < info->ngroups; n++) { + struct armada_37xx_pin_group *grp = &info->groups[n]; + int i, j, f; + +- grp->pins = devm_kcalloc(info->dev, +- grp->npins + grp->extra_npins, ++ grp->pins = devm_kcalloc(dev, grp->npins + grp->extra_npins, + sizeof(*grp->pins), + GFP_KERNEL); + if (!grp->pins) +@@ -898,8 +895,7 @@ static int armada_37xx_fill_group(struct armada_37xx_pinctrl *info) + ret = armada_37xx_add_function(info->funcs, &funcsize, + grp->funcs[f]); + if (ret == -EOVERFLOW) +- dev_err(info->dev, +- "More functions than pins(%d)\n", ++ dev_err(dev, "More functions than pins(%d)\n", + info->data->nr_pins); + if (ret < 0) + continue; +@@ -925,6 +921,7 @@ static int armada_37xx_fill_group(struct armada_37xx_pinctrl *info) + static int armada_37xx_fill_func(struct armada_37xx_pinctrl *info) + { + struct armada_37xx_pmx_func *funcs = info->funcs; ++ struct device *dev = info->dev; + int n; + + for (n = 0; n < info->nfuncs; n++) { +@@ -932,8 +929,7 @@ static int armada_37xx_fill_func(struct armada_37xx_pinctrl *info) + const char **groups; + int g; + +- funcs[n].groups = devm_kcalloc(info->dev, +- funcs[n].ngroups, ++ funcs[n].groups = devm_kcalloc(dev, funcs[n].ngroups, + sizeof(*(funcs[n].groups)), + GFP_KERNEL); + if (!funcs[n].groups) +@@ -962,6 +958,7 @@ static int armada_37xx_pinctrl_register(struct platform_device *pdev, + const struct armada_37xx_pin_data *pin_data = info->data; + struct pinctrl_desc *ctrldesc = &info->pctl; + struct pinctrl_pin_desc *pindesc, *pdesc; ++ struct device *dev = &pdev->dev; + int pin, ret; + + info->groups = pin_data->groups; +@@ -973,9 +970,7 @@ static int armada_37xx_pinctrl_register(struct platform_device *pdev, + ctrldesc->pmxops = &armada_37xx_pmx_ops; + ctrldesc->confops = &armada_37xx_pinconf_ops; + +- pindesc = devm_kcalloc(&pdev->dev, +- pin_data->nr_pins, sizeof(*pindesc), +- GFP_KERNEL); ++ pindesc = devm_kcalloc(dev, pin_data->nr_pins, sizeof(*pindesc), GFP_KERNEL); + if (!pindesc) + return -ENOMEM; + +@@ -994,14 +989,10 @@ static int armada_37xx_pinctrl_register(struct platform_device *pdev, + * we allocate functions for number of pins and hope there are + * fewer unique functions than pins available + */ +- info->funcs = devm_kcalloc(&pdev->dev, +- pin_data->nr_pins, +- sizeof(struct armada_37xx_pmx_func), +- GFP_KERNEL); ++ info->funcs = devm_kcalloc(dev, pin_data->nr_pins, sizeof(*info->funcs), GFP_KERNEL); + if (!info->funcs) + return -ENOMEM; + +- + ret = armada_37xx_fill_group(info); + if (ret) + return ret; +@@ -1010,9 +1001,9 @@ static int armada_37xx_pinctrl_register(struct platform_device *pdev, + if (ret) + return ret; + +- info->pctl_dev = devm_pinctrl_register(&pdev->dev, ctrldesc, info); ++ info->pctl_dev = devm_pinctrl_register(dev, ctrldesc, info); + if (IS_ERR(info->pctl_dev)) { +- dev_err(&pdev->dev, "could not register pinctrl driver\n"); ++ dev_err(dev, "could not register pinctrl driver\n"); + return PTR_ERR(info->pctl_dev); + } + +@@ -1143,8 +1134,7 @@ static int __init armada_37xx_pinctrl_probe(struct platform_device *pdev) + struct regmap *regmap; + int ret; + +- info = devm_kzalloc(dev, sizeof(struct armada_37xx_pinctrl), +- GFP_KERNEL); ++ info = devm_kzalloc(dev, sizeof(*info), GFP_KERNEL); + if (!info) + return -ENOMEM; + +@@ -1152,7 +1142,7 @@ static int __init armada_37xx_pinctrl_probe(struct platform_device *pdev) + + regmap = syscon_node_to_regmap(np); + if (IS_ERR(regmap)) { +- dev_err(&pdev->dev, "cannot get regmap\n"); ++ dev_err(dev, "cannot get regmap\n"); + return PTR_ERR(regmap); + } + info->regmap = regmap; +-- +2.35.1 + diff --git a/queue-5.15/pinctrl-ralink-check-for-null-return-of-devm_kcalloc.patch b/queue-5.15/pinctrl-ralink-check-for-null-return-of-devm_kcalloc.patch new file mode 100644 index 00000000000..ebc3adc4712 --- /dev/null +++ b/queue-5.15/pinctrl-ralink-check-for-null-return-of-devm_kcalloc.patch @@ -0,0 +1,43 @@ +From f9564331f4f811b13c65fa3f3aa500b3512ab30c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Jul 2022 23:49:22 +0800 +Subject: pinctrl: ralink: Check for null return of devm_kcalloc + +From: William Dean + +[ Upstream commit c3b821e8e406d5650e587b7ac624ac24e9b780a8 ] + +Because of the possible failure of the allocation, data->domains might +be NULL pointer and will cause the dereference of the NULL pointer +later. +Therefore, it might be better to check it and directly return -ENOMEM +without releasing data manually if fails, because the comment of the +devm_kmalloc() says "Memory allocated with this function is +automatically freed on driver detach.". + +Fixes: a86854d0c599b ("treewide: devm_kzalloc() -> devm_kcalloc()") +Reported-by: Hacash Robot +Signed-off-by: William Dean +Link: https://lore.kernel.org/r/20220710154922.2610876-1-williamsukatube@163.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/ralink/pinctrl-ralink.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pinctrl/ralink/pinctrl-ralink.c b/drivers/pinctrl/ralink/pinctrl-ralink.c +index 841f23f55c95..3a8268a43d74 100644 +--- a/drivers/pinctrl/ralink/pinctrl-ralink.c ++++ b/drivers/pinctrl/ralink/pinctrl-ralink.c +@@ -266,6 +266,8 @@ static int ralink_pinmux_pins(struct ralink_priv *p) + p->func[i]->pin_count, + sizeof(int), + GFP_KERNEL); ++ if (!p->func[i]->pins) ++ return -ENOMEM; + for (j = 0; j < p->func[i]->pin_count; j++) + p->func[i]->pins[j] = p->func[i]->pin_first + j; + +-- +2.35.1 + diff --git a/queue-5.15/pinctrl-ralink-rename-mt7628-an-functions-to-mt76x8.patch b/queue-5.15/pinctrl-ralink-rename-mt7628-an-functions-to-mt76x8.patch new file mode 100644 index 00000000000..f7ff1722f54 --- /dev/null +++ b/queue-5.15/pinctrl-ralink-rename-mt7628-an-functions-to-mt76x8.patch @@ -0,0 +1,402 @@ +From 3d3cb4204d6ba8399c5d54200fc19e42c023afae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Apr 2022 20:39:03 +0300 +Subject: pinctrl: ralink: rename MT7628(an) functions to MT76X8 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arınç ÜNAL + +[ Upstream commit 150438c86f55989632005b92c94f4aa2ec562ed6 ] + +The functions that include "MT7628(an)" are for MT7628 and MT7688 SoCs. +Rename them to MT76X8 to refer to both of the SoCs. + +Signed-off-by: Arınç ÜNAL +Reviewed-by: Sergio Paracuellos +Acked-by: Sergio Paracuellos +Link: https://lore.kernel.org/r/20220414173916.5552-2-arinc.unal@arinc9.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/ralink/pinctrl-mt7620.c | 218 ++++++++++++------------ + 1 file changed, 109 insertions(+), 109 deletions(-) + +diff --git a/drivers/pinctrl/ralink/pinctrl-mt7620.c b/drivers/pinctrl/ralink/pinctrl-mt7620.c +index 6853b5b8b0fe..d3f9feec1f74 100644 +--- a/drivers/pinctrl/ralink/pinctrl-mt7620.c ++++ b/drivers/pinctrl/ralink/pinctrl-mt7620.c +@@ -112,260 +112,260 @@ static struct rt2880_pmx_group mt7620a_pinmux_data[] = { + { 0 } + }; + +-static struct rt2880_pmx_func pwm1_grp_mt7628[] = { ++static struct rt2880_pmx_func pwm1_grp_mt76x8[] = { + FUNC("sdxc d6", 3, 19, 1), + FUNC("utif", 2, 19, 1), + FUNC("gpio", 1, 19, 1), + FUNC("pwm1", 0, 19, 1), + }; + +-static struct rt2880_pmx_func pwm0_grp_mt7628[] = { ++static struct rt2880_pmx_func pwm0_grp_mt76x8[] = { + FUNC("sdxc d7", 3, 18, 1), + FUNC("utif", 2, 18, 1), + FUNC("gpio", 1, 18, 1), + FUNC("pwm0", 0, 18, 1), + }; + +-static struct rt2880_pmx_func uart2_grp_mt7628[] = { ++static struct rt2880_pmx_func uart2_grp_mt76x8[] = { + FUNC("sdxc d5 d4", 3, 20, 2), + FUNC("pwm", 2, 20, 2), + FUNC("gpio", 1, 20, 2), + FUNC("uart2", 0, 20, 2), + }; + +-static struct rt2880_pmx_func uart1_grp_mt7628[] = { ++static struct rt2880_pmx_func uart1_grp_mt76x8[] = { + FUNC("sw_r", 3, 45, 2), + FUNC("pwm", 2, 45, 2), + FUNC("gpio", 1, 45, 2), + FUNC("uart1", 0, 45, 2), + }; + +-static struct rt2880_pmx_func i2c_grp_mt7628[] = { ++static struct rt2880_pmx_func i2c_grp_mt76x8[] = { + FUNC("-", 3, 4, 2), + FUNC("debug", 2, 4, 2), + FUNC("gpio", 1, 4, 2), + FUNC("i2c", 0, 4, 2), + }; + +-static struct rt2880_pmx_func refclk_grp_mt7628[] = { FUNC("refclk", 0, 37, 1) }; +-static struct rt2880_pmx_func perst_grp_mt7628[] = { FUNC("perst", 0, 36, 1) }; +-static struct rt2880_pmx_func wdt_grp_mt7628[] = { FUNC("wdt", 0, 38, 1) }; +-static struct rt2880_pmx_func spi_grp_mt7628[] = { FUNC("spi", 0, 7, 4) }; ++static struct rt2880_pmx_func refclk_grp_mt76x8[] = { FUNC("refclk", 0, 37, 1) }; ++static struct rt2880_pmx_func perst_grp_mt76x8[] = { FUNC("perst", 0, 36, 1) }; ++static struct rt2880_pmx_func wdt_grp_mt76x8[] = { FUNC("wdt", 0, 38, 1) }; ++static struct rt2880_pmx_func spi_grp_mt76x8[] = { FUNC("spi", 0, 7, 4) }; + +-static struct rt2880_pmx_func sd_mode_grp_mt7628[] = { ++static struct rt2880_pmx_func sd_mode_grp_mt76x8[] = { + FUNC("jtag", 3, 22, 8), + FUNC("utif", 2, 22, 8), + FUNC("gpio", 1, 22, 8), + FUNC("sdxc", 0, 22, 8), + }; + +-static struct rt2880_pmx_func uart0_grp_mt7628[] = { ++static struct rt2880_pmx_func uart0_grp_mt76x8[] = { + FUNC("-", 3, 12, 2), + FUNC("-", 2, 12, 2), + FUNC("gpio", 1, 12, 2), + FUNC("uart0", 0, 12, 2), + }; + +-static struct rt2880_pmx_func i2s_grp_mt7628[] = { ++static struct rt2880_pmx_func i2s_grp_mt76x8[] = { + FUNC("antenna", 3, 0, 4), + FUNC("pcm", 2, 0, 4), + FUNC("gpio", 1, 0, 4), + FUNC("i2s", 0, 0, 4), + }; + +-static struct rt2880_pmx_func spi_cs1_grp_mt7628[] = { ++static struct rt2880_pmx_func spi_cs1_grp_mt76x8[] = { + FUNC("-", 3, 6, 1), + FUNC("refclk", 2, 6, 1), + FUNC("gpio", 1, 6, 1), + FUNC("spi cs1", 0, 6, 1), + }; + +-static struct rt2880_pmx_func spis_grp_mt7628[] = { ++static struct rt2880_pmx_func spis_grp_mt76x8[] = { + FUNC("pwm_uart2", 3, 14, 4), + FUNC("utif", 2, 14, 4), + FUNC("gpio", 1, 14, 4), + FUNC("spis", 0, 14, 4), + }; + +-static struct rt2880_pmx_func gpio_grp_mt7628[] = { ++static struct rt2880_pmx_func gpio_grp_mt76x8[] = { + FUNC("pcie", 3, 11, 1), + FUNC("refclk", 2, 11, 1), + FUNC("gpio", 1, 11, 1), + FUNC("gpio", 0, 11, 1), + }; + +-static struct rt2880_pmx_func p4led_kn_grp_mt7628[] = { ++static struct rt2880_pmx_func p4led_kn_grp_mt76x8[] = { + FUNC("jtag", 3, 30, 1), + FUNC("utif", 2, 30, 1), + FUNC("gpio", 1, 30, 1), + FUNC("p4led_kn", 0, 30, 1), + }; + +-static struct rt2880_pmx_func p3led_kn_grp_mt7628[] = { ++static struct rt2880_pmx_func p3led_kn_grp_mt76x8[] = { + FUNC("jtag", 3, 31, 1), + FUNC("utif", 2, 31, 1), + FUNC("gpio", 1, 31, 1), + FUNC("p3led_kn", 0, 31, 1), + }; + +-static struct rt2880_pmx_func p2led_kn_grp_mt7628[] = { ++static struct rt2880_pmx_func p2led_kn_grp_mt76x8[] = { + FUNC("jtag", 3, 32, 1), + FUNC("utif", 2, 32, 1), + FUNC("gpio", 1, 32, 1), + FUNC("p2led_kn", 0, 32, 1), + }; + +-static struct rt2880_pmx_func p1led_kn_grp_mt7628[] = { ++static struct rt2880_pmx_func p1led_kn_grp_mt76x8[] = { + FUNC("jtag", 3, 33, 1), + FUNC("utif", 2, 33, 1), + FUNC("gpio", 1, 33, 1), + FUNC("p1led_kn", 0, 33, 1), + }; + +-static struct rt2880_pmx_func p0led_kn_grp_mt7628[] = { ++static struct rt2880_pmx_func p0led_kn_grp_mt76x8[] = { + FUNC("jtag", 3, 34, 1), + FUNC("rsvd", 2, 34, 1), + FUNC("gpio", 1, 34, 1), + FUNC("p0led_kn", 0, 34, 1), + }; + +-static struct rt2880_pmx_func wled_kn_grp_mt7628[] = { ++static struct rt2880_pmx_func wled_kn_grp_mt76x8[] = { + FUNC("rsvd", 3, 35, 1), + FUNC("rsvd", 2, 35, 1), + FUNC("gpio", 1, 35, 1), + FUNC("wled_kn", 0, 35, 1), + }; + +-static struct rt2880_pmx_func p4led_an_grp_mt7628[] = { ++static struct rt2880_pmx_func p4led_an_grp_mt76x8[] = { + FUNC("jtag", 3, 39, 1), + FUNC("utif", 2, 39, 1), + FUNC("gpio", 1, 39, 1), + FUNC("p4led_an", 0, 39, 1), + }; + +-static struct rt2880_pmx_func p3led_an_grp_mt7628[] = { ++static struct rt2880_pmx_func p3led_an_grp_mt76x8[] = { + FUNC("jtag", 3, 40, 1), + FUNC("utif", 2, 40, 1), + FUNC("gpio", 1, 40, 1), + FUNC("p3led_an", 0, 40, 1), + }; + +-static struct rt2880_pmx_func p2led_an_grp_mt7628[] = { ++static struct rt2880_pmx_func p2led_an_grp_mt76x8[] = { + FUNC("jtag", 3, 41, 1), + FUNC("utif", 2, 41, 1), + FUNC("gpio", 1, 41, 1), + FUNC("p2led_an", 0, 41, 1), + }; + +-static struct rt2880_pmx_func p1led_an_grp_mt7628[] = { ++static struct rt2880_pmx_func p1led_an_grp_mt76x8[] = { + FUNC("jtag", 3, 42, 1), + FUNC("utif", 2, 42, 1), + FUNC("gpio", 1, 42, 1), + FUNC("p1led_an", 0, 42, 1), + }; + +-static struct rt2880_pmx_func p0led_an_grp_mt7628[] = { ++static struct rt2880_pmx_func p0led_an_grp_mt76x8[] = { + FUNC("jtag", 3, 43, 1), + FUNC("rsvd", 2, 43, 1), + FUNC("gpio", 1, 43, 1), + FUNC("p0led_an", 0, 43, 1), + }; + +-static struct rt2880_pmx_func wled_an_grp_mt7628[] = { ++static struct rt2880_pmx_func wled_an_grp_mt76x8[] = { + FUNC("rsvd", 3, 44, 1), + FUNC("rsvd", 2, 44, 1), + FUNC("gpio", 1, 44, 1), + FUNC("wled_an", 0, 44, 1), + }; + +-#define MT7628_GPIO_MODE_MASK 0x3 +- +-#define MT7628_GPIO_MODE_P4LED_KN 58 +-#define MT7628_GPIO_MODE_P3LED_KN 56 +-#define MT7628_GPIO_MODE_P2LED_KN 54 +-#define MT7628_GPIO_MODE_P1LED_KN 52 +-#define MT7628_GPIO_MODE_P0LED_KN 50 +-#define MT7628_GPIO_MODE_WLED_KN 48 +-#define MT7628_GPIO_MODE_P4LED_AN 42 +-#define MT7628_GPIO_MODE_P3LED_AN 40 +-#define MT7628_GPIO_MODE_P2LED_AN 38 +-#define MT7628_GPIO_MODE_P1LED_AN 36 +-#define MT7628_GPIO_MODE_P0LED_AN 34 +-#define MT7628_GPIO_MODE_WLED_AN 32 +-#define MT7628_GPIO_MODE_PWM1 30 +-#define MT7628_GPIO_MODE_PWM0 28 +-#define MT7628_GPIO_MODE_UART2 26 +-#define MT7628_GPIO_MODE_UART1 24 +-#define MT7628_GPIO_MODE_I2C 20 +-#define MT7628_GPIO_MODE_REFCLK 18 +-#define MT7628_GPIO_MODE_PERST 16 +-#define MT7628_GPIO_MODE_WDT 14 +-#define MT7628_GPIO_MODE_SPI 12 +-#define MT7628_GPIO_MODE_SDMODE 10 +-#define MT7628_GPIO_MODE_UART0 8 +-#define MT7628_GPIO_MODE_I2S 6 +-#define MT7628_GPIO_MODE_CS1 4 +-#define MT7628_GPIO_MODE_SPIS 2 +-#define MT7628_GPIO_MODE_GPIO 0 +- +-static struct rt2880_pmx_group mt7628an_pinmux_data[] = { +- GRP_G("pwm1", pwm1_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_PWM1), +- GRP_G("pwm0", pwm0_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_PWM0), +- GRP_G("uart2", uart2_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_UART2), +- GRP_G("uart1", uart1_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_UART1), +- GRP_G("i2c", i2c_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_I2C), +- GRP("refclk", refclk_grp_mt7628, 1, MT7628_GPIO_MODE_REFCLK), +- GRP("perst", perst_grp_mt7628, 1, MT7628_GPIO_MODE_PERST), +- GRP("wdt", wdt_grp_mt7628, 1, MT7628_GPIO_MODE_WDT), +- GRP("spi", spi_grp_mt7628, 1, MT7628_GPIO_MODE_SPI), +- GRP_G("sdmode", sd_mode_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_SDMODE), +- GRP_G("uart0", uart0_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_UART0), +- GRP_G("i2s", i2s_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_I2S), +- GRP_G("spi cs1", spi_cs1_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_CS1), +- GRP_G("spis", spis_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_SPIS), +- GRP_G("gpio", gpio_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_GPIO), +- GRP_G("wled_an", wled_an_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_WLED_AN), +- GRP_G("p0led_an", p0led_an_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_P0LED_AN), +- GRP_G("p1led_an", p1led_an_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_P1LED_AN), +- GRP_G("p2led_an", p2led_an_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_P2LED_AN), +- GRP_G("p3led_an", p3led_an_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_P3LED_AN), +- GRP_G("p4led_an", p4led_an_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_P4LED_AN), +- GRP_G("wled_kn", wled_kn_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_WLED_KN), +- GRP_G("p0led_kn", p0led_kn_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_P0LED_KN), +- GRP_G("p1led_kn", p1led_kn_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_P1LED_KN), +- GRP_G("p2led_kn", p2led_kn_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_P2LED_KN), +- GRP_G("p3led_kn", p3led_kn_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_P3LED_KN), +- GRP_G("p4led_kn", p4led_kn_grp_mt7628, MT7628_GPIO_MODE_MASK, +- 1, MT7628_GPIO_MODE_P4LED_KN), ++#define MT76X8_GPIO_MODE_MASK 0x3 ++ ++#define MT76X8_GPIO_MODE_P4LED_KN 58 ++#define MT76X8_GPIO_MODE_P3LED_KN 56 ++#define MT76X8_GPIO_MODE_P2LED_KN 54 ++#define MT76X8_GPIO_MODE_P1LED_KN 52 ++#define MT76X8_GPIO_MODE_P0LED_KN 50 ++#define MT76X8_GPIO_MODE_WLED_KN 48 ++#define MT76X8_GPIO_MODE_P4LED_AN 42 ++#define MT76X8_GPIO_MODE_P3LED_AN 40 ++#define MT76X8_GPIO_MODE_P2LED_AN 38 ++#define MT76X8_GPIO_MODE_P1LED_AN 36 ++#define MT76X8_GPIO_MODE_P0LED_AN 34 ++#define MT76X8_GPIO_MODE_WLED_AN 32 ++#define MT76X8_GPIO_MODE_PWM1 30 ++#define MT76X8_GPIO_MODE_PWM0 28 ++#define MT76X8_GPIO_MODE_UART2 26 ++#define MT76X8_GPIO_MODE_UART1 24 ++#define MT76X8_GPIO_MODE_I2C 20 ++#define MT76X8_GPIO_MODE_REFCLK 18 ++#define MT76X8_GPIO_MODE_PERST 16 ++#define MT76X8_GPIO_MODE_WDT 14 ++#define MT76X8_GPIO_MODE_SPI 12 ++#define MT76X8_GPIO_MODE_SDMODE 10 ++#define MT76X8_GPIO_MODE_UART0 8 ++#define MT76X8_GPIO_MODE_I2S 6 ++#define MT76X8_GPIO_MODE_CS1 4 ++#define MT76X8_GPIO_MODE_SPIS 2 ++#define MT76X8_GPIO_MODE_GPIO 0 ++ ++static struct rt2880_pmx_group mt76x8_pinmux_data[] = { ++ GRP_G("pwm1", pwm1_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_PWM1), ++ GRP_G("pwm0", pwm0_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_PWM0), ++ GRP_G("uart2", uart2_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_UART2), ++ GRP_G("uart1", uart1_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_UART1), ++ GRP_G("i2c", i2c_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_I2C), ++ GRP("refclk", refclk_grp_mt76x8, 1, MT76X8_GPIO_MODE_REFCLK), ++ GRP("perst", perst_grp_mt76x8, 1, MT76X8_GPIO_MODE_PERST), ++ GRP("wdt", wdt_grp_mt76x8, 1, MT76X8_GPIO_MODE_WDT), ++ GRP("spi", spi_grp_mt76x8, 1, MT76X8_GPIO_MODE_SPI), ++ GRP_G("sdmode", sd_mode_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_SDMODE), ++ GRP_G("uart0", uart0_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_UART0), ++ GRP_G("i2s", i2s_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_I2S), ++ GRP_G("spi cs1", spi_cs1_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_CS1), ++ GRP_G("spis", spis_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_SPIS), ++ GRP_G("gpio", gpio_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_GPIO), ++ GRP_G("wled_an", wled_an_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_WLED_AN), ++ GRP_G("p0led_an", p0led_an_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_P0LED_AN), ++ GRP_G("p1led_an", p1led_an_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_P1LED_AN), ++ GRP_G("p2led_an", p2led_an_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_P2LED_AN), ++ GRP_G("p3led_an", p3led_an_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_P3LED_AN), ++ GRP_G("p4led_an", p4led_an_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_P4LED_AN), ++ GRP_G("wled_kn", wled_kn_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_WLED_KN), ++ GRP_G("p0led_kn", p0led_kn_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_P0LED_KN), ++ GRP_G("p1led_kn", p1led_kn_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_P1LED_KN), ++ GRP_G("p2led_kn", p2led_kn_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_P2LED_KN), ++ GRP_G("p3led_kn", p3led_kn_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_P3LED_KN), ++ GRP_G("p4led_kn", p4led_kn_grp_mt76x8, MT76X8_GPIO_MODE_MASK, ++ 1, MT76X8_GPIO_MODE_P4LED_KN), + { 0 } + }; + + static int mt7620_pinmux_probe(struct platform_device *pdev) + { + if (is_mt76x8()) +- return rt2880_pinmux_init(pdev, mt7628an_pinmux_data); ++ return rt2880_pinmux_init(pdev, mt76x8_pinmux_data); + else + return rt2880_pinmux_init(pdev, mt7620a_pinmux_data); + } +-- +2.35.1 + diff --git a/queue-5.15/pinctrl-ralink-rename-pinctrl-rt2880-to-pinctrl-rali.patch b/queue-5.15/pinctrl-ralink-rename-pinctrl-rt2880-to-pinctrl-rali.patch new file mode 100644 index 00000000000..3e531cb8ec8 --- /dev/null +++ b/queue-5.15/pinctrl-ralink-rename-pinctrl-rt2880-to-pinctrl-rali.patch @@ -0,0 +1,964 @@ +From 655660fb7efbf8a8d3e6e3e03e16ace79e2e8159 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Apr 2022 20:39:04 +0300 +Subject: pinctrl: ralink: rename pinctrl-rt2880 to pinctrl-ralink +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arınç ÜNAL + +[ Upstream commit 6b3dd85b0bdec1a8308fa5dcbafcd5d55b5f3608 ] + +pinctrl-rt2880.c and pinmux.h make up the Ralink pinctrl driver. Rename +pinctrl-rt2880.c to pinctrl-ralink.c. Rename pinmux.h to pinctrl-ralink.h. +Fix references to it. Rename functions that include "rt2880" to "ralink". + +Remove PINCTRL_RT2880 symbol and make the existing PINCTRL_RALINK symbol +compile pinctrl-ralink.c. Change the bool to "Ralink pinctrl driver". + +Signed-off-by: Arınç ÜNAL +Reviewed-by: Sergio Paracuellos +Acked-by: Sergio Paracuellos +Link: https://lore.kernel.org/r/20220414173916.5552-3-arinc.unal@arinc9.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/ralink/Kconfig | 16 ++-- + drivers/pinctrl/ralink/Makefile | 2 +- + drivers/pinctrl/ralink/pinctrl-mt7620.c | 92 +++++++++---------- + drivers/pinctrl/ralink/pinctrl-mt7621.c | 30 +++--- + .../{pinctrl-rt2880.c => pinctrl-ralink.c} | 90 +++++++++--------- + .../ralink/{pinmux.h => pinctrl-ralink.h} | 16 ++-- + drivers/pinctrl/ralink/pinctrl-rt288x.c | 20 ++-- + drivers/pinctrl/ralink/pinctrl-rt305x.c | 44 ++++----- + drivers/pinctrl/ralink/pinctrl-rt3883.c | 28 +++--- + 9 files changed, 167 insertions(+), 171 deletions(-) + rename drivers/pinctrl/ralink/{pinctrl-rt2880.c => pinctrl-ralink.c} (73%) + rename drivers/pinctrl/ralink/{pinmux.h => pinctrl-ralink.h} (75%) + +diff --git a/drivers/pinctrl/ralink/Kconfig b/drivers/pinctrl/ralink/Kconfig +index a76ee3deb8c3..d0f0a8f2b9b7 100644 +--- a/drivers/pinctrl/ralink/Kconfig ++++ b/drivers/pinctrl/ralink/Kconfig +@@ -3,37 +3,33 @@ menu "Ralink pinctrl drivers" + depends on RALINK + + config PINCTRL_RALINK +- bool "Ralink pin control support" +- default y if RALINK +- +-config PINCTRL_RT2880 +- bool "RT2880 pinctrl driver for RALINK/Mediatek SOCs" ++ bool "Ralink pinctrl driver" + select PINMUX + select GENERIC_PINCONF + + config PINCTRL_MT7620 + bool "mt7620 pinctrl driver for RALINK/Mediatek SOCs" + depends on RALINK && SOC_MT7620 +- select PINCTRL_RT2880 ++ select PINCTRL_RALINK + + config PINCTRL_MT7621 + bool "mt7621 pinctrl driver for RALINK/Mediatek SOCs" + depends on RALINK && SOC_MT7621 +- select PINCTRL_RT2880 ++ select PINCTRL_RALINK + + config PINCTRL_RT288X + bool "RT288X pinctrl driver for RALINK/Mediatek SOCs" + depends on RALINK && SOC_RT288X +- select PINCTRL_RT2880 ++ select PINCTRL_RALINK + + config PINCTRL_RT305X + bool "RT305X pinctrl driver for RALINK/Mediatek SOCs" + depends on RALINK && SOC_RT305X +- select PINCTRL_RT2880 ++ select PINCTRL_RALINK + + config PINCTRL_RT3883 + bool "RT3883 pinctrl driver for RALINK/Mediatek SOCs" + depends on RALINK && SOC_RT3883 +- select PINCTRL_RT2880 ++ select PINCTRL_RALINK + + endmenu +diff --git a/drivers/pinctrl/ralink/Makefile b/drivers/pinctrl/ralink/Makefile +index a15610206ced..2c1323b74e96 100644 +--- a/drivers/pinctrl/ralink/Makefile ++++ b/drivers/pinctrl/ralink/Makefile +@@ -1,5 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0 +-obj-$(CONFIG_PINCTRL_RT2880) += pinctrl-rt2880.o ++obj-$(CONFIG_PINCTRL_RALINK) += pinctrl-ralink.o + + obj-$(CONFIG_PINCTRL_MT7620) += pinctrl-mt7620.o + obj-$(CONFIG_PINCTRL_MT7621) += pinctrl-mt7621.o +diff --git a/drivers/pinctrl/ralink/pinctrl-mt7620.c b/drivers/pinctrl/ralink/pinctrl-mt7620.c +index d3f9feec1f74..51b863d85c51 100644 +--- a/drivers/pinctrl/ralink/pinctrl-mt7620.c ++++ b/drivers/pinctrl/ralink/pinctrl-mt7620.c +@@ -5,7 +5,7 @@ + #include + #include + #include +-#include "pinmux.h" ++#include "pinctrl-ralink.h" + + #define MT7620_GPIO_MODE_UART0_SHIFT 2 + #define MT7620_GPIO_MODE_UART0_MASK 0x7 +@@ -54,20 +54,20 @@ + #define MT7620_GPIO_MODE_EPHY 15 + #define MT7620_GPIO_MODE_PA 20 + +-static struct rt2880_pmx_func i2c_grp[] = { FUNC("i2c", 0, 1, 2) }; +-static struct rt2880_pmx_func spi_grp[] = { FUNC("spi", 0, 3, 4) }; +-static struct rt2880_pmx_func uartlite_grp[] = { FUNC("uartlite", 0, 15, 2) }; +-static struct rt2880_pmx_func mdio_grp[] = { ++static struct ralink_pmx_func i2c_grp[] = { FUNC("i2c", 0, 1, 2) }; ++static struct ralink_pmx_func spi_grp[] = { FUNC("spi", 0, 3, 4) }; ++static struct ralink_pmx_func uartlite_grp[] = { FUNC("uartlite", 0, 15, 2) }; ++static struct ralink_pmx_func mdio_grp[] = { + FUNC("mdio", MT7620_GPIO_MODE_MDIO, 22, 2), + FUNC("refclk", MT7620_GPIO_MODE_MDIO_REFCLK, 22, 2), + }; +-static struct rt2880_pmx_func rgmii1_grp[] = { FUNC("rgmii1", 0, 24, 12) }; +-static struct rt2880_pmx_func refclk_grp[] = { FUNC("spi refclk", 0, 37, 3) }; +-static struct rt2880_pmx_func ephy_grp[] = { FUNC("ephy", 0, 40, 5) }; +-static struct rt2880_pmx_func rgmii2_grp[] = { FUNC("rgmii2", 0, 60, 12) }; +-static struct rt2880_pmx_func wled_grp[] = { FUNC("wled", 0, 72, 1) }; +-static struct rt2880_pmx_func pa_grp[] = { FUNC("pa", 0, 18, 4) }; +-static struct rt2880_pmx_func uartf_grp[] = { ++static struct ralink_pmx_func rgmii1_grp[] = { FUNC("rgmii1", 0, 24, 12) }; ++static struct ralink_pmx_func refclk_grp[] = { FUNC("spi refclk", 0, 37, 3) }; ++static struct ralink_pmx_func ephy_grp[] = { FUNC("ephy", 0, 40, 5) }; ++static struct ralink_pmx_func rgmii2_grp[] = { FUNC("rgmii2", 0, 60, 12) }; ++static struct ralink_pmx_func wled_grp[] = { FUNC("wled", 0, 72, 1) }; ++static struct ralink_pmx_func pa_grp[] = { FUNC("pa", 0, 18, 4) }; ++static struct ralink_pmx_func uartf_grp[] = { + FUNC("uartf", MT7620_GPIO_MODE_UARTF, 7, 8), + FUNC("pcm uartf", MT7620_GPIO_MODE_PCM_UARTF, 7, 8), + FUNC("pcm i2s", MT7620_GPIO_MODE_PCM_I2S, 7, 8), +@@ -76,20 +76,20 @@ static struct rt2880_pmx_func uartf_grp[] = { + FUNC("gpio uartf", MT7620_GPIO_MODE_GPIO_UARTF, 7, 4), + FUNC("gpio i2s", MT7620_GPIO_MODE_GPIO_I2S, 7, 4), + }; +-static struct rt2880_pmx_func wdt_grp[] = { ++static struct ralink_pmx_func wdt_grp[] = { + FUNC("wdt rst", 0, 17, 1), + FUNC("wdt refclk", 0, 17, 1), + }; +-static struct rt2880_pmx_func pcie_rst_grp[] = { ++static struct ralink_pmx_func pcie_rst_grp[] = { + FUNC("pcie rst", MT7620_GPIO_MODE_PCIE_RST, 36, 1), + FUNC("pcie refclk", MT7620_GPIO_MODE_PCIE_REF, 36, 1) + }; +-static struct rt2880_pmx_func nd_sd_grp[] = { ++static struct ralink_pmx_func nd_sd_grp[] = { + FUNC("nand", MT7620_GPIO_MODE_NAND, 45, 15), + FUNC("sd", MT7620_GPIO_MODE_SD, 47, 13) + }; + +-static struct rt2880_pmx_group mt7620a_pinmux_data[] = { ++static struct ralink_pmx_group mt7620a_pinmux_data[] = { + GRP("i2c", i2c_grp, 1, MT7620_GPIO_MODE_I2C), + GRP("uartf", uartf_grp, MT7620_GPIO_MODE_UART0_MASK, + MT7620_GPIO_MODE_UART0_SHIFT), +@@ -112,166 +112,166 @@ static struct rt2880_pmx_group mt7620a_pinmux_data[] = { + { 0 } + }; + +-static struct rt2880_pmx_func pwm1_grp_mt76x8[] = { ++static struct ralink_pmx_func pwm1_grp_mt76x8[] = { + FUNC("sdxc d6", 3, 19, 1), + FUNC("utif", 2, 19, 1), + FUNC("gpio", 1, 19, 1), + FUNC("pwm1", 0, 19, 1), + }; + +-static struct rt2880_pmx_func pwm0_grp_mt76x8[] = { ++static struct ralink_pmx_func pwm0_grp_mt76x8[] = { + FUNC("sdxc d7", 3, 18, 1), + FUNC("utif", 2, 18, 1), + FUNC("gpio", 1, 18, 1), + FUNC("pwm0", 0, 18, 1), + }; + +-static struct rt2880_pmx_func uart2_grp_mt76x8[] = { ++static struct ralink_pmx_func uart2_grp_mt76x8[] = { + FUNC("sdxc d5 d4", 3, 20, 2), + FUNC("pwm", 2, 20, 2), + FUNC("gpio", 1, 20, 2), + FUNC("uart2", 0, 20, 2), + }; + +-static struct rt2880_pmx_func uart1_grp_mt76x8[] = { ++static struct ralink_pmx_func uart1_grp_mt76x8[] = { + FUNC("sw_r", 3, 45, 2), + FUNC("pwm", 2, 45, 2), + FUNC("gpio", 1, 45, 2), + FUNC("uart1", 0, 45, 2), + }; + +-static struct rt2880_pmx_func i2c_grp_mt76x8[] = { ++static struct ralink_pmx_func i2c_grp_mt76x8[] = { + FUNC("-", 3, 4, 2), + FUNC("debug", 2, 4, 2), + FUNC("gpio", 1, 4, 2), + FUNC("i2c", 0, 4, 2), + }; + +-static struct rt2880_pmx_func refclk_grp_mt76x8[] = { FUNC("refclk", 0, 37, 1) }; +-static struct rt2880_pmx_func perst_grp_mt76x8[] = { FUNC("perst", 0, 36, 1) }; +-static struct rt2880_pmx_func wdt_grp_mt76x8[] = { FUNC("wdt", 0, 38, 1) }; +-static struct rt2880_pmx_func spi_grp_mt76x8[] = { FUNC("spi", 0, 7, 4) }; ++static struct ralink_pmx_func refclk_grp_mt76x8[] = { FUNC("refclk", 0, 37, 1) }; ++static struct ralink_pmx_func perst_grp_mt76x8[] = { FUNC("perst", 0, 36, 1) }; ++static struct ralink_pmx_func wdt_grp_mt76x8[] = { FUNC("wdt", 0, 38, 1) }; ++static struct ralink_pmx_func spi_grp_mt76x8[] = { FUNC("spi", 0, 7, 4) }; + +-static struct rt2880_pmx_func sd_mode_grp_mt76x8[] = { ++static struct ralink_pmx_func sd_mode_grp_mt76x8[] = { + FUNC("jtag", 3, 22, 8), + FUNC("utif", 2, 22, 8), + FUNC("gpio", 1, 22, 8), + FUNC("sdxc", 0, 22, 8), + }; + +-static struct rt2880_pmx_func uart0_grp_mt76x8[] = { ++static struct ralink_pmx_func uart0_grp_mt76x8[] = { + FUNC("-", 3, 12, 2), + FUNC("-", 2, 12, 2), + FUNC("gpio", 1, 12, 2), + FUNC("uart0", 0, 12, 2), + }; + +-static struct rt2880_pmx_func i2s_grp_mt76x8[] = { ++static struct ralink_pmx_func i2s_grp_mt76x8[] = { + FUNC("antenna", 3, 0, 4), + FUNC("pcm", 2, 0, 4), + FUNC("gpio", 1, 0, 4), + FUNC("i2s", 0, 0, 4), + }; + +-static struct rt2880_pmx_func spi_cs1_grp_mt76x8[] = { ++static struct ralink_pmx_func spi_cs1_grp_mt76x8[] = { + FUNC("-", 3, 6, 1), + FUNC("refclk", 2, 6, 1), + FUNC("gpio", 1, 6, 1), + FUNC("spi cs1", 0, 6, 1), + }; + +-static struct rt2880_pmx_func spis_grp_mt76x8[] = { ++static struct ralink_pmx_func spis_grp_mt76x8[] = { + FUNC("pwm_uart2", 3, 14, 4), + FUNC("utif", 2, 14, 4), + FUNC("gpio", 1, 14, 4), + FUNC("spis", 0, 14, 4), + }; + +-static struct rt2880_pmx_func gpio_grp_mt76x8[] = { ++static struct ralink_pmx_func gpio_grp_mt76x8[] = { + FUNC("pcie", 3, 11, 1), + FUNC("refclk", 2, 11, 1), + FUNC("gpio", 1, 11, 1), + FUNC("gpio", 0, 11, 1), + }; + +-static struct rt2880_pmx_func p4led_kn_grp_mt76x8[] = { ++static struct ralink_pmx_func p4led_kn_grp_mt76x8[] = { + FUNC("jtag", 3, 30, 1), + FUNC("utif", 2, 30, 1), + FUNC("gpio", 1, 30, 1), + FUNC("p4led_kn", 0, 30, 1), + }; + +-static struct rt2880_pmx_func p3led_kn_grp_mt76x8[] = { ++static struct ralink_pmx_func p3led_kn_grp_mt76x8[] = { + FUNC("jtag", 3, 31, 1), + FUNC("utif", 2, 31, 1), + FUNC("gpio", 1, 31, 1), + FUNC("p3led_kn", 0, 31, 1), + }; + +-static struct rt2880_pmx_func p2led_kn_grp_mt76x8[] = { ++static struct ralink_pmx_func p2led_kn_grp_mt76x8[] = { + FUNC("jtag", 3, 32, 1), + FUNC("utif", 2, 32, 1), + FUNC("gpio", 1, 32, 1), + FUNC("p2led_kn", 0, 32, 1), + }; + +-static struct rt2880_pmx_func p1led_kn_grp_mt76x8[] = { ++static struct ralink_pmx_func p1led_kn_grp_mt76x8[] = { + FUNC("jtag", 3, 33, 1), + FUNC("utif", 2, 33, 1), + FUNC("gpio", 1, 33, 1), + FUNC("p1led_kn", 0, 33, 1), + }; + +-static struct rt2880_pmx_func p0led_kn_grp_mt76x8[] = { ++static struct ralink_pmx_func p0led_kn_grp_mt76x8[] = { + FUNC("jtag", 3, 34, 1), + FUNC("rsvd", 2, 34, 1), + FUNC("gpio", 1, 34, 1), + FUNC("p0led_kn", 0, 34, 1), + }; + +-static struct rt2880_pmx_func wled_kn_grp_mt76x8[] = { ++static struct ralink_pmx_func wled_kn_grp_mt76x8[] = { + FUNC("rsvd", 3, 35, 1), + FUNC("rsvd", 2, 35, 1), + FUNC("gpio", 1, 35, 1), + FUNC("wled_kn", 0, 35, 1), + }; + +-static struct rt2880_pmx_func p4led_an_grp_mt76x8[] = { ++static struct ralink_pmx_func p4led_an_grp_mt76x8[] = { + FUNC("jtag", 3, 39, 1), + FUNC("utif", 2, 39, 1), + FUNC("gpio", 1, 39, 1), + FUNC("p4led_an", 0, 39, 1), + }; + +-static struct rt2880_pmx_func p3led_an_grp_mt76x8[] = { ++static struct ralink_pmx_func p3led_an_grp_mt76x8[] = { + FUNC("jtag", 3, 40, 1), + FUNC("utif", 2, 40, 1), + FUNC("gpio", 1, 40, 1), + FUNC("p3led_an", 0, 40, 1), + }; + +-static struct rt2880_pmx_func p2led_an_grp_mt76x8[] = { ++static struct ralink_pmx_func p2led_an_grp_mt76x8[] = { + FUNC("jtag", 3, 41, 1), + FUNC("utif", 2, 41, 1), + FUNC("gpio", 1, 41, 1), + FUNC("p2led_an", 0, 41, 1), + }; + +-static struct rt2880_pmx_func p1led_an_grp_mt76x8[] = { ++static struct ralink_pmx_func p1led_an_grp_mt76x8[] = { + FUNC("jtag", 3, 42, 1), + FUNC("utif", 2, 42, 1), + FUNC("gpio", 1, 42, 1), + FUNC("p1led_an", 0, 42, 1), + }; + +-static struct rt2880_pmx_func p0led_an_grp_mt76x8[] = { ++static struct ralink_pmx_func p0led_an_grp_mt76x8[] = { + FUNC("jtag", 3, 43, 1), + FUNC("rsvd", 2, 43, 1), + FUNC("gpio", 1, 43, 1), + FUNC("p0led_an", 0, 43, 1), + }; + +-static struct rt2880_pmx_func wled_an_grp_mt76x8[] = { ++static struct ralink_pmx_func wled_an_grp_mt76x8[] = { + FUNC("rsvd", 3, 44, 1), + FUNC("rsvd", 2, 44, 1), + FUNC("gpio", 1, 44, 1), +@@ -308,7 +308,7 @@ static struct rt2880_pmx_func wled_an_grp_mt76x8[] = { + #define MT76X8_GPIO_MODE_SPIS 2 + #define MT76X8_GPIO_MODE_GPIO 0 + +-static struct rt2880_pmx_group mt76x8_pinmux_data[] = { ++static struct ralink_pmx_group mt76x8_pinmux_data[] = { + GRP_G("pwm1", pwm1_grp_mt76x8, MT76X8_GPIO_MODE_MASK, + 1, MT76X8_GPIO_MODE_PWM1), + GRP_G("pwm0", pwm0_grp_mt76x8, MT76X8_GPIO_MODE_MASK, +@@ -365,9 +365,9 @@ static struct rt2880_pmx_group mt76x8_pinmux_data[] = { + static int mt7620_pinmux_probe(struct platform_device *pdev) + { + if (is_mt76x8()) +- return rt2880_pinmux_init(pdev, mt76x8_pinmux_data); ++ return ralink_pinmux_init(pdev, mt76x8_pinmux_data); + else +- return rt2880_pinmux_init(pdev, mt7620a_pinmux_data); ++ return ralink_pinmux_init(pdev, mt7620a_pinmux_data); + } + + static const struct of_device_id mt7620_pinmux_match[] = { +diff --git a/drivers/pinctrl/ralink/pinctrl-mt7621.c b/drivers/pinctrl/ralink/pinctrl-mt7621.c +index 7d96144c474e..14b89cb43d4c 100644 +--- a/drivers/pinctrl/ralink/pinctrl-mt7621.c ++++ b/drivers/pinctrl/ralink/pinctrl-mt7621.c +@@ -3,7 +3,7 @@ + #include + #include + #include +-#include "pinmux.h" ++#include "pinctrl-ralink.h" + + #define MT7621_GPIO_MODE_UART1 1 + #define MT7621_GPIO_MODE_I2C 2 +@@ -34,40 +34,40 @@ + #define MT7621_GPIO_MODE_SDHCI_SHIFT 18 + #define MT7621_GPIO_MODE_SDHCI_GPIO 1 + +-static struct rt2880_pmx_func uart1_grp[] = { FUNC("uart1", 0, 1, 2) }; +-static struct rt2880_pmx_func i2c_grp[] = { FUNC("i2c", 0, 3, 2) }; +-static struct rt2880_pmx_func uart3_grp[] = { ++static struct ralink_pmx_func uart1_grp[] = { FUNC("uart1", 0, 1, 2) }; ++static struct ralink_pmx_func i2c_grp[] = { FUNC("i2c", 0, 3, 2) }; ++static struct ralink_pmx_func uart3_grp[] = { + FUNC("uart3", 0, 5, 4), + FUNC("i2s", 2, 5, 4), + FUNC("spdif3", 3, 5, 4), + }; +-static struct rt2880_pmx_func uart2_grp[] = { ++static struct ralink_pmx_func uart2_grp[] = { + FUNC("uart2", 0, 9, 4), + FUNC("pcm", 2, 9, 4), + FUNC("spdif2", 3, 9, 4), + }; +-static struct rt2880_pmx_func jtag_grp[] = { FUNC("jtag", 0, 13, 5) }; +-static struct rt2880_pmx_func wdt_grp[] = { ++static struct ralink_pmx_func jtag_grp[] = { FUNC("jtag", 0, 13, 5) }; ++static struct ralink_pmx_func wdt_grp[] = { + FUNC("wdt rst", 0, 18, 1), + FUNC("wdt refclk", 2, 18, 1), + }; +-static struct rt2880_pmx_func pcie_rst_grp[] = { ++static struct ralink_pmx_func pcie_rst_grp[] = { + FUNC("pcie rst", MT7621_GPIO_MODE_PCIE_RST, 19, 1), + FUNC("pcie refclk", MT7621_GPIO_MODE_PCIE_REF, 19, 1) + }; +-static struct rt2880_pmx_func mdio_grp[] = { FUNC("mdio", 0, 20, 2) }; +-static struct rt2880_pmx_func rgmii2_grp[] = { FUNC("rgmii2", 0, 22, 12) }; +-static struct rt2880_pmx_func spi_grp[] = { ++static struct ralink_pmx_func mdio_grp[] = { FUNC("mdio", 0, 20, 2) }; ++static struct ralink_pmx_func rgmii2_grp[] = { FUNC("rgmii2", 0, 22, 12) }; ++static struct ralink_pmx_func spi_grp[] = { + FUNC("spi", 0, 34, 7), + FUNC("nand1", 2, 34, 7), + }; +-static struct rt2880_pmx_func sdhci_grp[] = { ++static struct ralink_pmx_func sdhci_grp[] = { + FUNC("sdhci", 0, 41, 8), + FUNC("nand2", 2, 41, 8), + }; +-static struct rt2880_pmx_func rgmii1_grp[] = { FUNC("rgmii1", 0, 49, 12) }; ++static struct ralink_pmx_func rgmii1_grp[] = { FUNC("rgmii1", 0, 49, 12) }; + +-static struct rt2880_pmx_group mt7621_pinmux_data[] = { ++static struct ralink_pmx_group mt7621_pinmux_data[] = { + GRP("uart1", uart1_grp, 1, MT7621_GPIO_MODE_UART1), + GRP("i2c", i2c_grp, 1, MT7621_GPIO_MODE_I2C), + GRP_G("uart3", uart3_grp, MT7621_GPIO_MODE_UART3_MASK, +@@ -92,7 +92,7 @@ static struct rt2880_pmx_group mt7621_pinmux_data[] = { + + static int mt7621_pinmux_probe(struct platform_device *pdev) + { +- return rt2880_pinmux_init(pdev, mt7621_pinmux_data); ++ return ralink_pinmux_init(pdev, mt7621_pinmux_data); + } + + static const struct of_device_id mt7621_pinmux_match[] = { +diff --git a/drivers/pinctrl/ralink/pinctrl-rt2880.c b/drivers/pinctrl/ralink/pinctrl-ralink.c +similarity index 73% +rename from drivers/pinctrl/ralink/pinctrl-rt2880.c +rename to drivers/pinctrl/ralink/pinctrl-ralink.c +index 96fc06d1b8b9..841f23f55c95 100644 +--- a/drivers/pinctrl/ralink/pinctrl-rt2880.c ++++ b/drivers/pinctrl/ralink/pinctrl-ralink.c +@@ -19,23 +19,23 @@ + #include + #include + +-#include "pinmux.h" ++#include "pinctrl-ralink.h" + #include "../core.h" + #include "../pinctrl-utils.h" + + #define SYSC_REG_GPIO_MODE 0x60 + #define SYSC_REG_GPIO_MODE2 0x64 + +-struct rt2880_priv { ++struct ralink_priv { + struct device *dev; + + struct pinctrl_pin_desc *pads; + struct pinctrl_desc *desc; + +- struct rt2880_pmx_func **func; ++ struct ralink_pmx_func **func; + int func_count; + +- struct rt2880_pmx_group *groups; ++ struct ralink_pmx_group *groups; + const char **group_names; + int group_count; + +@@ -43,27 +43,27 @@ struct rt2880_priv { + int max_pins; + }; + +-static int rt2880_get_group_count(struct pinctrl_dev *pctrldev) ++static int ralink_get_group_count(struct pinctrl_dev *pctrldev) + { +- struct rt2880_priv *p = pinctrl_dev_get_drvdata(pctrldev); ++ struct ralink_priv *p = pinctrl_dev_get_drvdata(pctrldev); + + return p->group_count; + } + +-static const char *rt2880_get_group_name(struct pinctrl_dev *pctrldev, ++static const char *ralink_get_group_name(struct pinctrl_dev *pctrldev, + unsigned int group) + { +- struct rt2880_priv *p = pinctrl_dev_get_drvdata(pctrldev); ++ struct ralink_priv *p = pinctrl_dev_get_drvdata(pctrldev); + + return (group >= p->group_count) ? NULL : p->group_names[group]; + } + +-static int rt2880_get_group_pins(struct pinctrl_dev *pctrldev, ++static int ralink_get_group_pins(struct pinctrl_dev *pctrldev, + unsigned int group, + const unsigned int **pins, + unsigned int *num_pins) + { +- struct rt2880_priv *p = pinctrl_dev_get_drvdata(pctrldev); ++ struct ralink_priv *p = pinctrl_dev_get_drvdata(pctrldev); + + if (group >= p->group_count) + return -EINVAL; +@@ -74,35 +74,35 @@ static int rt2880_get_group_pins(struct pinctrl_dev *pctrldev, + return 0; + } + +-static const struct pinctrl_ops rt2880_pctrl_ops = { +- .get_groups_count = rt2880_get_group_count, +- .get_group_name = rt2880_get_group_name, +- .get_group_pins = rt2880_get_group_pins, ++static const struct pinctrl_ops ralink_pctrl_ops = { ++ .get_groups_count = ralink_get_group_count, ++ .get_group_name = ralink_get_group_name, ++ .get_group_pins = ralink_get_group_pins, + .dt_node_to_map = pinconf_generic_dt_node_to_map_all, + .dt_free_map = pinconf_generic_dt_free_map, + }; + +-static int rt2880_pmx_func_count(struct pinctrl_dev *pctrldev) ++static int ralink_pmx_func_count(struct pinctrl_dev *pctrldev) + { +- struct rt2880_priv *p = pinctrl_dev_get_drvdata(pctrldev); ++ struct ralink_priv *p = pinctrl_dev_get_drvdata(pctrldev); + + return p->func_count; + } + +-static const char *rt2880_pmx_func_name(struct pinctrl_dev *pctrldev, ++static const char *ralink_pmx_func_name(struct pinctrl_dev *pctrldev, + unsigned int func) + { +- struct rt2880_priv *p = pinctrl_dev_get_drvdata(pctrldev); ++ struct ralink_priv *p = pinctrl_dev_get_drvdata(pctrldev); + + return p->func[func]->name; + } + +-static int rt2880_pmx_group_get_groups(struct pinctrl_dev *pctrldev, ++static int ralink_pmx_group_get_groups(struct pinctrl_dev *pctrldev, + unsigned int func, + const char * const **groups, + unsigned int * const num_groups) + { +- struct rt2880_priv *p = pinctrl_dev_get_drvdata(pctrldev); ++ struct ralink_priv *p = pinctrl_dev_get_drvdata(pctrldev); + + if (p->func[func]->group_count == 1) + *groups = &p->group_names[p->func[func]->groups[0]]; +@@ -114,10 +114,10 @@ static int rt2880_pmx_group_get_groups(struct pinctrl_dev *pctrldev, + return 0; + } + +-static int rt2880_pmx_group_enable(struct pinctrl_dev *pctrldev, ++static int ralink_pmx_group_enable(struct pinctrl_dev *pctrldev, + unsigned int func, unsigned int group) + { +- struct rt2880_priv *p = pinctrl_dev_get_drvdata(pctrldev); ++ struct ralink_priv *p = pinctrl_dev_get_drvdata(pctrldev); + u32 mode = 0; + u32 reg = SYSC_REG_GPIO_MODE; + int i; +@@ -158,11 +158,11 @@ static int rt2880_pmx_group_enable(struct pinctrl_dev *pctrldev, + return 0; + } + +-static int rt2880_pmx_group_gpio_request_enable(struct pinctrl_dev *pctrldev, ++static int ralink_pmx_group_gpio_request_enable(struct pinctrl_dev *pctrldev, + struct pinctrl_gpio_range *range, + unsigned int pin) + { +- struct rt2880_priv *p = pinctrl_dev_get_drvdata(pctrldev); ++ struct ralink_priv *p = pinctrl_dev_get_drvdata(pctrldev); + + if (!p->gpio[pin]) { + dev_err(p->dev, "pin %d is not set to gpio mux\n", pin); +@@ -172,28 +172,28 @@ static int rt2880_pmx_group_gpio_request_enable(struct pinctrl_dev *pctrldev, + return 0; + } + +-static const struct pinmux_ops rt2880_pmx_group_ops = { +- .get_functions_count = rt2880_pmx_func_count, +- .get_function_name = rt2880_pmx_func_name, +- .get_function_groups = rt2880_pmx_group_get_groups, +- .set_mux = rt2880_pmx_group_enable, +- .gpio_request_enable = rt2880_pmx_group_gpio_request_enable, ++static const struct pinmux_ops ralink_pmx_group_ops = { ++ .get_functions_count = ralink_pmx_func_count, ++ .get_function_name = ralink_pmx_func_name, ++ .get_function_groups = ralink_pmx_group_get_groups, ++ .set_mux = ralink_pmx_group_enable, ++ .gpio_request_enable = ralink_pmx_group_gpio_request_enable, + }; + +-static struct pinctrl_desc rt2880_pctrl_desc = { ++static struct pinctrl_desc ralink_pctrl_desc = { + .owner = THIS_MODULE, +- .name = "rt2880-pinmux", +- .pctlops = &rt2880_pctrl_ops, +- .pmxops = &rt2880_pmx_group_ops, ++ .name = "ralink-pinmux", ++ .pctlops = &ralink_pctrl_ops, ++ .pmxops = &ralink_pmx_group_ops, + }; + +-static struct rt2880_pmx_func gpio_func = { ++static struct ralink_pmx_func gpio_func = { + .name = "gpio", + }; + +-static int rt2880_pinmux_index(struct rt2880_priv *p) ++static int ralink_pinmux_index(struct ralink_priv *p) + { +- struct rt2880_pmx_group *mux = p->groups; ++ struct ralink_pmx_group *mux = p->groups; + int i, j, c = 0; + + /* count the mux functions */ +@@ -248,7 +248,7 @@ static int rt2880_pinmux_index(struct rt2880_priv *p) + return 0; + } + +-static int rt2880_pinmux_pins(struct rt2880_priv *p) ++static int ralink_pinmux_pins(struct ralink_priv *p) + { + int i, j; + +@@ -311,10 +311,10 @@ static int rt2880_pinmux_pins(struct rt2880_priv *p) + return 0; + } + +-int rt2880_pinmux_init(struct platform_device *pdev, +- struct rt2880_pmx_group *data) ++int ralink_pinmux_init(struct platform_device *pdev, ++ struct ralink_pmx_group *data) + { +- struct rt2880_priv *p; ++ struct ralink_priv *p; + struct pinctrl_dev *dev; + int err; + +@@ -322,23 +322,23 @@ int rt2880_pinmux_init(struct platform_device *pdev, + return -ENOTSUPP; + + /* setup the private data */ +- p = devm_kzalloc(&pdev->dev, sizeof(struct rt2880_priv), GFP_KERNEL); ++ p = devm_kzalloc(&pdev->dev, sizeof(struct ralink_priv), GFP_KERNEL); + if (!p) + return -ENOMEM; + + p->dev = &pdev->dev; +- p->desc = &rt2880_pctrl_desc; ++ p->desc = &ralink_pctrl_desc; + p->groups = data; + platform_set_drvdata(pdev, p); + + /* init the device */ +- err = rt2880_pinmux_index(p); ++ err = ralink_pinmux_index(p); + if (err) { + dev_err(&pdev->dev, "failed to load index\n"); + return err; + } + +- err = rt2880_pinmux_pins(p); ++ err = ralink_pinmux_pins(p); + if (err) { + dev_err(&pdev->dev, "failed to load pins\n"); + return err; +diff --git a/drivers/pinctrl/ralink/pinmux.h b/drivers/pinctrl/ralink/pinctrl-ralink.h +similarity index 75% +rename from drivers/pinctrl/ralink/pinmux.h +rename to drivers/pinctrl/ralink/pinctrl-ralink.h +index 0046abe3bcc7..134969409585 100644 +--- a/drivers/pinctrl/ralink/pinmux.h ++++ b/drivers/pinctrl/ralink/pinctrl-ralink.h +@@ -3,8 +3,8 @@ + * Copyright (C) 2012 John Crispin + */ + +-#ifndef _RT288X_PINMUX_H__ +-#define _RT288X_PINMUX_H__ ++#ifndef _PINCTRL_RALINK_H__ ++#define _PINCTRL_RALINK_H__ + + #define FUNC(name, value, pin_first, pin_count) \ + { name, value, pin_first, pin_count } +@@ -19,9 +19,9 @@ + .func = _func, .gpio = _gpio, \ + .func_count = ARRAY_SIZE(_func) } + +-struct rt2880_pmx_group; ++struct ralink_pmx_group; + +-struct rt2880_pmx_func { ++struct ralink_pmx_func { + const char *name; + const char value; + +@@ -35,7 +35,7 @@ struct rt2880_pmx_func { + int enabled; + }; + +-struct rt2880_pmx_group { ++struct ralink_pmx_group { + const char *name; + int enabled; + +@@ -43,11 +43,11 @@ struct rt2880_pmx_group { + const char mask; + const char gpio; + +- struct rt2880_pmx_func *func; ++ struct ralink_pmx_func *func; + int func_count; + }; + +-int rt2880_pinmux_init(struct platform_device *pdev, +- struct rt2880_pmx_group *data); ++int ralink_pinmux_init(struct platform_device *pdev, ++ struct ralink_pmx_group *data); + + #endif +diff --git a/drivers/pinctrl/ralink/pinctrl-rt288x.c b/drivers/pinctrl/ralink/pinctrl-rt288x.c +index 0744aebbace5..40c45140ff8a 100644 +--- a/drivers/pinctrl/ralink/pinctrl-rt288x.c ++++ b/drivers/pinctrl/ralink/pinctrl-rt288x.c +@@ -4,7 +4,7 @@ + #include + #include + #include +-#include "pinmux.h" ++#include "pinctrl-ralink.h" + + #define RT2880_GPIO_MODE_I2C BIT(0) + #define RT2880_GPIO_MODE_UART0 BIT(1) +@@ -15,15 +15,15 @@ + #define RT2880_GPIO_MODE_SDRAM BIT(6) + #define RT2880_GPIO_MODE_PCI BIT(7) + +-static struct rt2880_pmx_func i2c_func[] = { FUNC("i2c", 0, 1, 2) }; +-static struct rt2880_pmx_func spi_func[] = { FUNC("spi", 0, 3, 4) }; +-static struct rt2880_pmx_func uartlite_func[] = { FUNC("uartlite", 0, 7, 8) }; +-static struct rt2880_pmx_func jtag_func[] = { FUNC("jtag", 0, 17, 5) }; +-static struct rt2880_pmx_func mdio_func[] = { FUNC("mdio", 0, 22, 2) }; +-static struct rt2880_pmx_func sdram_func[] = { FUNC("sdram", 0, 24, 16) }; +-static struct rt2880_pmx_func pci_func[] = { FUNC("pci", 0, 40, 32) }; ++static struct ralink_pmx_func i2c_func[] = { FUNC("i2c", 0, 1, 2) }; ++static struct ralink_pmx_func spi_func[] = { FUNC("spi", 0, 3, 4) }; ++static struct ralink_pmx_func uartlite_func[] = { FUNC("uartlite", 0, 7, 8) }; ++static struct ralink_pmx_func jtag_func[] = { FUNC("jtag", 0, 17, 5) }; ++static struct ralink_pmx_func mdio_func[] = { FUNC("mdio", 0, 22, 2) }; ++static struct ralink_pmx_func sdram_func[] = { FUNC("sdram", 0, 24, 16) }; ++static struct ralink_pmx_func pci_func[] = { FUNC("pci", 0, 40, 32) }; + +-static struct rt2880_pmx_group rt2880_pinmux_data_act[] = { ++static struct ralink_pmx_group rt2880_pinmux_data_act[] = { + GRP("i2c", i2c_func, 1, RT2880_GPIO_MODE_I2C), + GRP("spi", spi_func, 1, RT2880_GPIO_MODE_SPI), + GRP("uartlite", uartlite_func, 1, RT2880_GPIO_MODE_UART0), +@@ -36,7 +36,7 @@ static struct rt2880_pmx_group rt2880_pinmux_data_act[] = { + + static int rt288x_pinmux_probe(struct platform_device *pdev) + { +- return rt2880_pinmux_init(pdev, rt2880_pinmux_data_act); ++ return ralink_pinmux_init(pdev, rt2880_pinmux_data_act); + } + + static const struct of_device_id rt288x_pinmux_match[] = { +diff --git a/drivers/pinctrl/ralink/pinctrl-rt305x.c b/drivers/pinctrl/ralink/pinctrl-rt305x.c +index 5d8fa156c003..25527ca1ccaa 100644 +--- a/drivers/pinctrl/ralink/pinctrl-rt305x.c ++++ b/drivers/pinctrl/ralink/pinctrl-rt305x.c +@@ -5,7 +5,7 @@ + #include + #include + #include +-#include "pinmux.h" ++#include "pinctrl-ralink.h" + + #define RT305X_GPIO_MODE_UART0_SHIFT 2 + #define RT305X_GPIO_MODE_UART0_MASK 0x7 +@@ -31,9 +31,9 @@ + #define RT3352_GPIO_MODE_LNA 18 + #define RT3352_GPIO_MODE_PA 20 + +-static struct rt2880_pmx_func i2c_func[] = { FUNC("i2c", 0, 1, 2) }; +-static struct rt2880_pmx_func spi_func[] = { FUNC("spi", 0, 3, 4) }; +-static struct rt2880_pmx_func uartf_func[] = { ++static struct ralink_pmx_func i2c_func[] = { FUNC("i2c", 0, 1, 2) }; ++static struct ralink_pmx_func spi_func[] = { FUNC("spi", 0, 3, 4) }; ++static struct ralink_pmx_func uartf_func[] = { + FUNC("uartf", RT305X_GPIO_MODE_UARTF, 7, 8), + FUNC("pcm uartf", RT305X_GPIO_MODE_PCM_UARTF, 7, 8), + FUNC("pcm i2s", RT305X_GPIO_MODE_PCM_I2S, 7, 8), +@@ -42,28 +42,28 @@ static struct rt2880_pmx_func uartf_func[] = { + FUNC("gpio uartf", RT305X_GPIO_MODE_GPIO_UARTF, 7, 4), + FUNC("gpio i2s", RT305X_GPIO_MODE_GPIO_I2S, 7, 4), + }; +-static struct rt2880_pmx_func uartlite_func[] = { FUNC("uartlite", 0, 15, 2) }; +-static struct rt2880_pmx_func jtag_func[] = { FUNC("jtag", 0, 17, 5) }; +-static struct rt2880_pmx_func mdio_func[] = { FUNC("mdio", 0, 22, 2) }; +-static struct rt2880_pmx_func rt5350_led_func[] = { FUNC("led", 0, 22, 5) }; +-static struct rt2880_pmx_func rt5350_cs1_func[] = { ++static struct ralink_pmx_func uartlite_func[] = { FUNC("uartlite", 0, 15, 2) }; ++static struct ralink_pmx_func jtag_func[] = { FUNC("jtag", 0, 17, 5) }; ++static struct ralink_pmx_func mdio_func[] = { FUNC("mdio", 0, 22, 2) }; ++static struct ralink_pmx_func rt5350_led_func[] = { FUNC("led", 0, 22, 5) }; ++static struct ralink_pmx_func rt5350_cs1_func[] = { + FUNC("spi_cs1", 0, 27, 1), + FUNC("wdg_cs1", 1, 27, 1), + }; +-static struct rt2880_pmx_func sdram_func[] = { FUNC("sdram", 0, 24, 16) }; +-static struct rt2880_pmx_func rt3352_rgmii_func[] = { ++static struct ralink_pmx_func sdram_func[] = { FUNC("sdram", 0, 24, 16) }; ++static struct ralink_pmx_func rt3352_rgmii_func[] = { + FUNC("rgmii", 0, 24, 12) + }; +-static struct rt2880_pmx_func rgmii_func[] = { FUNC("rgmii", 0, 40, 12) }; +-static struct rt2880_pmx_func rt3352_lna_func[] = { FUNC("lna", 0, 36, 2) }; +-static struct rt2880_pmx_func rt3352_pa_func[] = { FUNC("pa", 0, 38, 2) }; +-static struct rt2880_pmx_func rt3352_led_func[] = { FUNC("led", 0, 40, 5) }; +-static struct rt2880_pmx_func rt3352_cs1_func[] = { ++static struct ralink_pmx_func rgmii_func[] = { FUNC("rgmii", 0, 40, 12) }; ++static struct ralink_pmx_func rt3352_lna_func[] = { FUNC("lna", 0, 36, 2) }; ++static struct ralink_pmx_func rt3352_pa_func[] = { FUNC("pa", 0, 38, 2) }; ++static struct ralink_pmx_func rt3352_led_func[] = { FUNC("led", 0, 40, 5) }; ++static struct ralink_pmx_func rt3352_cs1_func[] = { + FUNC("spi_cs1", 0, 45, 1), + FUNC("wdg_cs1", 1, 45, 1), + }; + +-static struct rt2880_pmx_group rt3050_pinmux_data[] = { ++static struct ralink_pmx_group rt3050_pinmux_data[] = { + GRP("i2c", i2c_func, 1, RT305X_GPIO_MODE_I2C), + GRP("spi", spi_func, 1, RT305X_GPIO_MODE_SPI), + GRP("uartf", uartf_func, RT305X_GPIO_MODE_UART0_MASK, +@@ -76,7 +76,7 @@ static struct rt2880_pmx_group rt3050_pinmux_data[] = { + { 0 } + }; + +-static struct rt2880_pmx_group rt3352_pinmux_data[] = { ++static struct ralink_pmx_group rt3352_pinmux_data[] = { + GRP("i2c", i2c_func, 1, RT305X_GPIO_MODE_I2C), + GRP("spi", spi_func, 1, RT305X_GPIO_MODE_SPI), + GRP("uartf", uartf_func, RT305X_GPIO_MODE_UART0_MASK, +@@ -92,7 +92,7 @@ static struct rt2880_pmx_group rt3352_pinmux_data[] = { + { 0 } + }; + +-static struct rt2880_pmx_group rt5350_pinmux_data[] = { ++static struct ralink_pmx_group rt5350_pinmux_data[] = { + GRP("i2c", i2c_func, 1, RT305X_GPIO_MODE_I2C), + GRP("spi", spi_func, 1, RT305X_GPIO_MODE_SPI), + GRP("uartf", uartf_func, RT305X_GPIO_MODE_UART0_MASK, +@@ -107,11 +107,11 @@ static struct rt2880_pmx_group rt5350_pinmux_data[] = { + static int rt305x_pinmux_probe(struct platform_device *pdev) + { + if (soc_is_rt5350()) +- return rt2880_pinmux_init(pdev, rt5350_pinmux_data); ++ return ralink_pinmux_init(pdev, rt5350_pinmux_data); + else if (soc_is_rt305x() || soc_is_rt3350()) +- return rt2880_pinmux_init(pdev, rt3050_pinmux_data); ++ return ralink_pinmux_init(pdev, rt3050_pinmux_data); + else if (soc_is_rt3352()) +- return rt2880_pinmux_init(pdev, rt3352_pinmux_data); ++ return ralink_pinmux_init(pdev, rt3352_pinmux_data); + else + return -EINVAL; + } +diff --git a/drivers/pinctrl/ralink/pinctrl-rt3883.c b/drivers/pinctrl/ralink/pinctrl-rt3883.c +index 3e0e1b4caa64..0b8674dbe188 100644 +--- a/drivers/pinctrl/ralink/pinctrl-rt3883.c ++++ b/drivers/pinctrl/ralink/pinctrl-rt3883.c +@@ -3,7 +3,7 @@ + #include + #include + #include +-#include "pinmux.h" ++#include "pinctrl-ralink.h" + + #define RT3883_GPIO_MODE_UART0_SHIFT 2 + #define RT3883_GPIO_MODE_UART0_MASK 0x7 +@@ -39,9 +39,9 @@ + #define RT3883_GPIO_MODE_LNA_G_GPIO 0x3 + #define RT3883_GPIO_MODE_LNA_G _RT3883_GPIO_MODE_LNA_G(RT3883_GPIO_MODE_LNA_G_MASK) + +-static struct rt2880_pmx_func i2c_func[] = { FUNC("i2c", 0, 1, 2) }; +-static struct rt2880_pmx_func spi_func[] = { FUNC("spi", 0, 3, 4) }; +-static struct rt2880_pmx_func uartf_func[] = { ++static struct ralink_pmx_func i2c_func[] = { FUNC("i2c", 0, 1, 2) }; ++static struct ralink_pmx_func spi_func[] = { FUNC("spi", 0, 3, 4) }; ++static struct ralink_pmx_func uartf_func[] = { + FUNC("uartf", RT3883_GPIO_MODE_UARTF, 7, 8), + FUNC("pcm uartf", RT3883_GPIO_MODE_PCM_UARTF, 7, 8), + FUNC("pcm i2s", RT3883_GPIO_MODE_PCM_I2S, 7, 8), +@@ -50,21 +50,21 @@ static struct rt2880_pmx_func uartf_func[] = { + FUNC("gpio uartf", RT3883_GPIO_MODE_GPIO_UARTF, 7, 4), + FUNC("gpio i2s", RT3883_GPIO_MODE_GPIO_I2S, 7, 4), + }; +-static struct rt2880_pmx_func uartlite_func[] = { FUNC("uartlite", 0, 15, 2) }; +-static struct rt2880_pmx_func jtag_func[] = { FUNC("jtag", 0, 17, 5) }; +-static struct rt2880_pmx_func mdio_func[] = { FUNC("mdio", 0, 22, 2) }; +-static struct rt2880_pmx_func lna_a_func[] = { FUNC("lna a", 0, 32, 3) }; +-static struct rt2880_pmx_func lna_g_func[] = { FUNC("lna g", 0, 35, 3) }; +-static struct rt2880_pmx_func pci_func[] = { ++static struct ralink_pmx_func uartlite_func[] = { FUNC("uartlite", 0, 15, 2) }; ++static struct ralink_pmx_func jtag_func[] = { FUNC("jtag", 0, 17, 5) }; ++static struct ralink_pmx_func mdio_func[] = { FUNC("mdio", 0, 22, 2) }; ++static struct ralink_pmx_func lna_a_func[] = { FUNC("lna a", 0, 32, 3) }; ++static struct ralink_pmx_func lna_g_func[] = { FUNC("lna g", 0, 35, 3) }; ++static struct ralink_pmx_func pci_func[] = { + FUNC("pci-dev", 0, 40, 32), + FUNC("pci-host2", 1, 40, 32), + FUNC("pci-host1", 2, 40, 32), + FUNC("pci-fnc", 3, 40, 32) + }; +-static struct rt2880_pmx_func ge1_func[] = { FUNC("ge1", 0, 72, 12) }; +-static struct rt2880_pmx_func ge2_func[] = { FUNC("ge2", 0, 84, 12) }; ++static struct ralink_pmx_func ge1_func[] = { FUNC("ge1", 0, 72, 12) }; ++static struct ralink_pmx_func ge2_func[] = { FUNC("ge2", 0, 84, 12) }; + +-static struct rt2880_pmx_group rt3883_pinmux_data[] = { ++static struct ralink_pmx_group rt3883_pinmux_data[] = { + GRP("i2c", i2c_func, 1, RT3883_GPIO_MODE_I2C), + GRP("spi", spi_func, 1, RT3883_GPIO_MODE_SPI), + GRP("uartf", uartf_func, RT3883_GPIO_MODE_UART0_MASK, +@@ -83,7 +83,7 @@ static struct rt2880_pmx_group rt3883_pinmux_data[] = { + + static int rt3883_pinmux_probe(struct platform_device *pdev) + { +- return rt2880_pinmux_init(pdev, rt3883_pinmux_data); ++ return ralink_pinmux_init(pdev, rt3883_pinmux_data); + } + + static const struct of_device_id rt3883_pinmux_match[] = { +-- +2.35.1 + diff --git a/queue-5.15/power-reset-arm-versatile-fix-refcount-leak-in-versa.patch b/queue-5.15/power-reset-arm-versatile-fix-refcount-leak-in-versa.patch new file mode 100644 index 00000000000..754d03e7bb9 --- /dev/null +++ b/queue-5.15/power-reset-arm-versatile-fix-refcount-leak-in-versa.patch @@ -0,0 +1,38 @@ +From 056efd3368d7e69ae4e6df2e81fd5d14a55dd2bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 May 2022 18:10:09 +0400 +Subject: power/reset: arm-versatile: Fix refcount leak in + versatile_reboot_probe + +From: Miaoqian Lin + +[ Upstream commit 80192eff64eee9b3bc0594a47381937b94b9d65a ] + +of_find_matching_node_and_match() returns a node pointer with refcount +incremented, we should use of_node_put() on it when not need anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: 0e545f57b708 ("power: reset: driver for the Versatile syscon reboot") +Signed-off-by: Miaoqian Lin +Reviewed-by: Linus Walleij +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/reset/arm-versatile-reboot.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/power/reset/arm-versatile-reboot.c b/drivers/power/reset/arm-versatile-reboot.c +index 08d0a07b58ef..c7624d7611a7 100644 +--- a/drivers/power/reset/arm-versatile-reboot.c ++++ b/drivers/power/reset/arm-versatile-reboot.c +@@ -146,6 +146,7 @@ static int __init versatile_reboot_probe(void) + versatile_reboot_type = (enum versatile_reboot)reboot_id->data; + + syscon_regmap = syscon_node_to_regmap(np); ++ of_node_put(np); + if (IS_ERR(syscon_regmap)) + return PTR_ERR(syscon_regmap); + +-- +2.35.1 + diff --git a/queue-5.15/rdma-irdma-do-not-advertise-1gb-page-size-for-x722.patch b/queue-5.15/rdma-irdma-do-not-advertise-1gb-page-size-for-x722.patch new file mode 100644 index 00000000000..e0cd21d7f62 --- /dev/null +++ b/queue-5.15/rdma-irdma-do-not-advertise-1gb-page-size-for-x722.patch @@ -0,0 +1,87 @@ +From 419968870c9b7642ea43a7902ba0b517a303145a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jul 2022 18:08:36 -0500 +Subject: RDMA/irdma: Do not advertise 1GB page size for x722 + +From: Mustafa Ismail + +[ Upstream commit 5e8afb8792f3b6ae7ccf700f8c19225382636401 ] + +x722 does not support 1GB page size but the irdma driver incorrectly +advertises 1GB page size support for x722 device to ib_core to compute the +best page size to use on this MR. This could lead to incorrect start +offsets computed by hardware on the MR. + +Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") +Signed-off-by: Mustafa Ismail +Signed-off-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/i40iw_hw.c | 1 + + drivers/infiniband/hw/irdma/icrdma_hw.c | 1 + + drivers/infiniband/hw/irdma/irdma.h | 1 + + drivers/infiniband/hw/irdma/verbs.c | 4 ++-- + 4 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/irdma/i40iw_hw.c b/drivers/infiniband/hw/irdma/i40iw_hw.c +index 64148ad8a604..040d4e2b9767 100644 +--- a/drivers/infiniband/hw/irdma/i40iw_hw.c ++++ b/drivers/infiniband/hw/irdma/i40iw_hw.c +@@ -202,6 +202,7 @@ void i40iw_init_hw(struct irdma_sc_dev *dev) + dev->hw_attrs.uk_attrs.max_hw_read_sges = I40IW_MAX_SGE_RD; + dev->hw_attrs.max_hw_device_pages = I40IW_MAX_PUSH_PAGE_COUNT; + dev->hw_attrs.uk_attrs.max_hw_inline = I40IW_MAX_INLINE_DATA_SIZE; ++ dev->hw_attrs.page_size_cap = SZ_4K | SZ_2M; + dev->hw_attrs.max_hw_ird = I40IW_MAX_IRD_SIZE; + dev->hw_attrs.max_hw_ord = I40IW_MAX_ORD_SIZE; + dev->hw_attrs.max_hw_wqes = I40IW_MAX_WQ_ENTRIES; +diff --git a/drivers/infiniband/hw/irdma/icrdma_hw.c b/drivers/infiniband/hw/irdma/icrdma_hw.c +index cf53b17510cd..5986fd906308 100644 +--- a/drivers/infiniband/hw/irdma/icrdma_hw.c ++++ b/drivers/infiniband/hw/irdma/icrdma_hw.c +@@ -139,6 +139,7 @@ void icrdma_init_hw(struct irdma_sc_dev *dev) + dev->cqp_db = dev->hw_regs[IRDMA_CQPDB]; + dev->cq_ack_db = dev->hw_regs[IRDMA_CQACK]; + dev->irq_ops = &icrdma_irq_ops; ++ dev->hw_attrs.page_size_cap = SZ_4K | SZ_2M | SZ_1G; + dev->hw_attrs.max_hw_ird = ICRDMA_MAX_IRD_SIZE; + dev->hw_attrs.max_hw_ord = ICRDMA_MAX_ORD_SIZE; + dev->hw_attrs.max_stat_inst = ICRDMA_MAX_STATS_COUNT; +diff --git a/drivers/infiniband/hw/irdma/irdma.h b/drivers/infiniband/hw/irdma/irdma.h +index 46c12334c735..4789e85d717b 100644 +--- a/drivers/infiniband/hw/irdma/irdma.h ++++ b/drivers/infiniband/hw/irdma/irdma.h +@@ -127,6 +127,7 @@ struct irdma_hw_attrs { + u64 max_hw_outbound_msg_size; + u64 max_hw_inbound_msg_size; + u64 max_mr_size; ++ u64 page_size_cap; + u32 min_hw_qp_id; + u32 min_hw_aeq_size; + u32 max_hw_aeq_size; +diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c +index 8a3ac4257e86..0eef46428691 100644 +--- a/drivers/infiniband/hw/irdma/verbs.c ++++ b/drivers/infiniband/hw/irdma/verbs.c +@@ -29,7 +29,7 @@ static int irdma_query_device(struct ib_device *ibdev, + props->vendor_part_id = pcidev->device; + + props->hw_ver = rf->pcidev->revision; +- props->page_size_cap = SZ_4K | SZ_2M | SZ_1G; ++ props->page_size_cap = hw_attrs->page_size_cap; + props->max_mr_size = hw_attrs->max_mr_size; + props->max_qp = rf->max_qp - rf->used_qps; + props->max_qp_wr = hw_attrs->max_qp_wr; +@@ -2776,7 +2776,7 @@ static struct ib_mr *irdma_reg_user_mr(struct ib_pd *pd, u64 start, u64 len, + + if (req.reg_type == IRDMA_MEMREG_TYPE_MEM) { + iwmr->page_size = ib_umem_find_best_pgsz(region, +- SZ_4K | SZ_2M | SZ_1G, ++ iwdev->rf->sc_dev.hw_attrs.page_size_cap, + virt); + if (unlikely(!iwmr->page_size)) { + kfree(iwmr); +-- +2.35.1 + diff --git a/queue-5.15/rdma-irdma-fix-sleep-from-invalid-context-bug.patch b/queue-5.15/rdma-irdma-fix-sleep-from-invalid-context-bug.patch new file mode 100644 index 00000000000..d4bbc9e589d --- /dev/null +++ b/queue-5.15/rdma-irdma-fix-sleep-from-invalid-context-bug.patch @@ -0,0 +1,113 @@ +From 472730ca9645077a6cc4abf18e8ccc1006145c6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jul 2022 18:08:37 -0500 +Subject: RDMA/irdma: Fix sleep from invalid context BUG + +From: Mustafa Ismail + +[ Upstream commit cc0315564d6eec91c716d314b743321be24c70b3 ] + +Taking the qos_mutex to process RoCEv2 QP's on netdev events causes a +kernel splat. + +Fix this by removing the handling for RoCEv2 in +irdma_cm_teardown_connections that uses the mutex. This handling is only +needed for iWARP to avoid having connections established while the link is +down or having connections remain functional after the IP address is +removed. + + BUG: sleeping function called from invalid context at kernel/locking/mutex. + Call Trace: + kernel: dump_stack+0x66/0x90 + kernel: ___might_sleep.cold.92+0x8d/0x9a + kernel: mutex_lock+0x1c/0x40 + kernel: irdma_cm_teardown_connections+0x28e/0x4d0 [irdma] + kernel: ? check_preempt_curr+0x7a/0x90 + kernel: ? select_idle_sibling+0x22/0x3c0 + kernel: ? select_task_rq_fair+0x94c/0xc90 + kernel: ? irdma_exec_cqp_cmd+0xc27/0x17c0 [irdma] + kernel: ? __wake_up_common+0x7a/0x190 + kernel: irdma_if_notify+0x3cc/0x450 [irdma] + kernel: ? sched_clock_cpu+0xc/0xb0 + kernel: irdma_inet6addr_event+0xc6/0x150 [irdma] + +Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager") +Signed-off-by: Mustafa Ismail +Signed-off-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/cm.c | 50 -------------------------------- + 1 file changed, 50 deletions(-) + +diff --git a/drivers/infiniband/hw/irdma/cm.c b/drivers/infiniband/hw/irdma/cm.c +index 632f65e53b63..60d4e9c151ff 100644 +--- a/drivers/infiniband/hw/irdma/cm.c ++++ b/drivers/infiniband/hw/irdma/cm.c +@@ -4221,10 +4221,6 @@ void irdma_cm_teardown_connections(struct irdma_device *iwdev, u32 *ipaddr, + struct irdma_cm_node *cm_node; + struct list_head teardown_list; + struct ib_qp_attr attr; +- struct irdma_sc_vsi *vsi = &iwdev->vsi; +- struct irdma_sc_qp *sc_qp; +- struct irdma_qp *qp; +- int i; + + INIT_LIST_HEAD(&teardown_list); + +@@ -4241,52 +4237,6 @@ void irdma_cm_teardown_connections(struct irdma_device *iwdev, u32 *ipaddr, + irdma_cm_disconn(cm_node->iwqp); + irdma_rem_ref_cm_node(cm_node); + } +- if (!iwdev->roce_mode) +- return; +- +- INIT_LIST_HEAD(&teardown_list); +- for (i = 0; i < IRDMA_MAX_USER_PRIORITY; i++) { +- mutex_lock(&vsi->qos[i].qos_mutex); +- list_for_each_safe (list_node, list_core_temp, +- &vsi->qos[i].qplist) { +- u32 qp_ip[4]; +- +- sc_qp = container_of(list_node, struct irdma_sc_qp, +- list); +- if (sc_qp->qp_uk.qp_type != IRDMA_QP_TYPE_ROCE_RC) +- continue; +- +- qp = sc_qp->qp_uk.back_qp; +- if (!disconnect_all) { +- if (nfo->ipv4) +- qp_ip[0] = qp->udp_info.local_ipaddr[3]; +- else +- memcpy(qp_ip, +- &qp->udp_info.local_ipaddr[0], +- sizeof(qp_ip)); +- } +- +- if (disconnect_all || +- (nfo->vlan_id == (qp->udp_info.vlan_tag & VLAN_VID_MASK) && +- !memcmp(qp_ip, ipaddr, nfo->ipv4 ? 4 : 16))) { +- spin_lock(&iwdev->rf->qptable_lock); +- if (iwdev->rf->qp_table[sc_qp->qp_uk.qp_id]) { +- irdma_qp_add_ref(&qp->ibqp); +- list_add(&qp->teardown_entry, +- &teardown_list); +- } +- spin_unlock(&iwdev->rf->qptable_lock); +- } +- } +- mutex_unlock(&vsi->qos[i].qos_mutex); +- } +- +- list_for_each_safe (list_node, list_core_temp, &teardown_list) { +- qp = container_of(list_node, struct irdma_qp, teardown_entry); +- attr.qp_state = IB_QPS_ERR; +- irdma_modify_qp_roce(&qp->ibqp, &attr, IB_QP_STATE, NULL); +- irdma_qp_rem_ref(&qp->ibqp); +- } + } + + /** +-- +2.35.1 + diff --git a/queue-5.15/revert-e1000e-fix-possible-hw-unit-hang-after-an-s0i.patch b/queue-5.15/revert-e1000e-fix-possible-hw-unit-hang-after-an-s0i.patch new file mode 100644 index 00000000000..b992f327c0b --- /dev/null +++ b/queue-5.15/revert-e1000e-fix-possible-hw-unit-hang-after-an-s0i.patch @@ -0,0 +1,124 @@ +From bb27624d0b432fced487f0b9f358277ab9e87f50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 May 2022 11:52:54 +0300 +Subject: Revert "e1000e: Fix possible HW unit hang after an s0ix exit" + +From: Sasha Neftin + +[ Upstream commit 6cfa45361d3eac31ba67d7d0bbef547151450106 ] + +This reverts commit 1866aa0d0d6492bc2f8d22d0df49abaccf50cddd. + +Commit 1866aa0d0d64 ("e1000e: Fix possible HW unit hang after an s0ix +exit") was a workaround for CSME problem to handle messages comes via H2ME +mailbox. This problem has been fixed by patch "e1000e: Enable the GPT +clock before sending message to the CSME". + +Fixes: 3e55d231716e ("e1000e: Add handshake with the CSME to support S0ix") +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=214821 +Signed-off-by: Sasha Neftin +Tested-by: Naama Meir +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e1000e/hw.h | 1 - + drivers/net/ethernet/intel/e1000e/ich8lan.c | 4 ---- + drivers/net/ethernet/intel/e1000e/ich8lan.h | 1 - + drivers/net/ethernet/intel/e1000e/netdev.c | 26 --------------------- + 4 files changed, 32 deletions(-) + +diff --git a/drivers/net/ethernet/intel/e1000e/hw.h b/drivers/net/ethernet/intel/e1000e/hw.h +index 13382df2f2ef..bcf680e83811 100644 +--- a/drivers/net/ethernet/intel/e1000e/hw.h ++++ b/drivers/net/ethernet/intel/e1000e/hw.h +@@ -630,7 +630,6 @@ struct e1000_phy_info { + bool disable_polarity_correction; + bool is_mdix; + bool polarity_correction; +- bool reset_disable; + bool speed_downgraded; + bool autoneg_wait_to_complete; + }; +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c +index e6c8e6d5234f..9466f65a6da7 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c +@@ -2050,10 +2050,6 @@ static s32 e1000_check_reset_block_ich8lan(struct e1000_hw *hw) + bool blocked = false; + int i = 0; + +- /* Check the PHY (LCD) reset flag */ +- if (hw->phy.reset_disable) +- return true; +- + while ((blocked = !(er32(FWSM) & E1000_ICH_FWSM_RSPCIPHY)) && + (i++ < 30)) + usleep_range(10000, 11000); +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h +index 638a3ddd7ada..2504b11c3169 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h +@@ -271,7 +271,6 @@ + #define I217_CGFREG_ENABLE_MTA_RESET 0x0002 + #define I217_MEMPWR PHY_REG(772, 26) + #define I217_MEMPWR_DISABLE_SMB_RELEASE 0x0010 +-#define I217_MEMPWR_MOEM 0x1000 + + /* Receive Address Initial CRC Calculation */ + #define E1000_PCH_RAICC(_n) (0x05F50 + ((_n) * 4)) +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index 0fba6ccecf12..407bbb4cc236 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -6996,21 +6996,8 @@ static __maybe_unused int e1000e_pm_suspend(struct device *dev) + struct net_device *netdev = pci_get_drvdata(to_pci_dev(dev)); + struct e1000_adapter *adapter = netdev_priv(netdev); + struct pci_dev *pdev = to_pci_dev(dev); +- struct e1000_hw *hw = &adapter->hw; +- u16 phy_data; + int rc; + +- if (er32(FWSM) & E1000_ICH_FWSM_FW_VALID && +- hw->mac.type >= e1000_pch_adp) { +- /* Mask OEM Bits / Gig Disable / Restart AN (772_26[12] = 1) */ +- e1e_rphy(hw, I217_MEMPWR, &phy_data); +- phy_data |= I217_MEMPWR_MOEM; +- e1e_wphy(hw, I217_MEMPWR, phy_data); +- +- /* Disable LCD reset */ +- hw->phy.reset_disable = true; +- } +- + e1000e_flush_lpic(pdev); + + e1000e_pm_freeze(dev); +@@ -7032,8 +7019,6 @@ static __maybe_unused int e1000e_pm_resume(struct device *dev) + struct net_device *netdev = pci_get_drvdata(to_pci_dev(dev)); + struct e1000_adapter *adapter = netdev_priv(netdev); + struct pci_dev *pdev = to_pci_dev(dev); +- struct e1000_hw *hw = &adapter->hw; +- u16 phy_data; + int rc; + + /* Introduce S0ix implementation */ +@@ -7044,17 +7029,6 @@ static __maybe_unused int e1000e_pm_resume(struct device *dev) + if (rc) + return rc; + +- if (er32(FWSM) & E1000_ICH_FWSM_FW_VALID && +- hw->mac.type >= e1000_pch_adp) { +- /* Unmask OEM Bits / Gig Disable / Restart AN 772_26[12] = 0 */ +- e1e_rphy(hw, I217_MEMPWR, &phy_data); +- phy_data &= ~I217_MEMPWR_MOEM; +- e1e_wphy(hw, I217_MEMPWR, phy_data); +- +- /* Enable LCD reset */ +- hw->phy.reset_disable = false; +- } +- + return e1000e_pm_thaw(dev); + } + +-- +2.35.1 + diff --git a/queue-5.15/scsi-megaraid-clear-read-queue-map-s-nr_queues.patch b/queue-5.15/scsi-megaraid-clear-read-queue-map-s-nr_queues.patch new file mode 100644 index 00000000000..46ad10e6ceb --- /dev/null +++ b/queue-5.15/scsi-megaraid-clear-read-queue-map-s-nr_queues.patch @@ -0,0 +1,48 @@ +From 618b878056a205666a33950a4aa5ea237d96afbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 20:59:42 +0800 +Subject: scsi: megaraid: Clear READ queue map's nr_queues + +From: Ming Lei + +[ Upstream commit 8312cd3a7b835ae3033a679e5f0014a40e7891c5 ] + +The megaraid SCSI driver sets set->nr_maps as 3 if poll_queues is > 0, and +blk-mq actually initializes each map's nr_queues as nr_hw_queues. +Consequently the driver has to clear READ queue map's nr_queues, otherwise +the queue map becomes broken if poll_queues is set as non-zero. + +Link: https://lore.kernel.org/r/20220706125942.528533-1-ming.lei@redhat.com +Fixes: 9e4bec5b2a23 ("scsi: megaraid_sas: mq_poll support") +Cc: Kashyap Desai +Cc: sumit.saxena@broadcom.com +Cc: chandrakanth.patil@broadcom.com +Cc: linux-block@vger.kernel.org +Cc: Hannes Reinecke +Reported-by: Guangwu Zhang +Tested-by: Guangwu Zhang +Reviewed-by: Bart Van Assche +Signed-off-by: Ming Lei +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid/megaraid_sas_base.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index bb3f78013a13..88e164e3d2ea 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -3196,6 +3196,9 @@ static int megasas_map_queues(struct Scsi_Host *shost) + qoff += map->nr_queues; + offset += map->nr_queues; + ++ /* we never use READ queue, so can't cheat blk-mq */ ++ shost->tag_set.map[HCTX_TYPE_READ].nr_queues = 0; ++ + /* Setup Poll hctx */ + map = &shost->tag_set.map[HCTX_TYPE_POLL]; + map->nr_queues = instance->iopoll_q_count; +-- +2.35.1 + diff --git a/queue-5.15/scsi-ufs-core-drop-loglevel-of-writeboost-message.patch b/queue-5.15/scsi-ufs-core-drop-loglevel-of-writeboost-message.patch new file mode 100644 index 00000000000..bcfcc89a6c8 --- /dev/null +++ b/queue-5.15/scsi-ufs-core-drop-loglevel-of-writeboost-message.patch @@ -0,0 +1,43 @@ +From 4490c6c001f815723229f19bb65842e659d43310 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 17:00:27 -0700 +Subject: scsi: ufs: core: Drop loglevel of WriteBoost message + +From: Bjorn Andersson + +[ Upstream commit 2ae57c995003a7840cb6b5ec5f0c06193695321b ] + +Commit '3b5f3c0d0548 ("scsi: ufs: core: Tidy up WB configuration code")' +changed the log level of the write boost enable/disable notification from +debug to info. This results in a lot of noise in the kernel log during +normal operation. + +Drop it back to debug level to avoid this. + +Link: https://lore.kernel.org/r/20220709000027.3929970-1-bjorn.andersson@linaro.org +Fixes: 3b5f3c0d0548 ("scsi: ufs: core: Tidy up WB configuration code") +Reviewed-by: Alim Akhtar +Acked-by: Bean Huo +Signed-off-by: Bjorn Andersson +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 5c9a31f18b7f..4a7248421bcd 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -5638,7 +5638,7 @@ int ufshcd_wb_toggle(struct ufs_hba *hba, bool enable) + } + + hba->dev_info.wb_enabled = enable; +- dev_info(hba->dev, "%s Write Booster %s\n", ++ dev_dbg(hba->dev, "%s Write Booster %s\n", + __func__, enable ? "enabled" : "disabled"); + + return ret; +-- +2.35.1 + diff --git a/queue-5.15/series b/queue-5.15/series index 281aac16829..9f4f77f0d80 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -26,3 +26,106 @@ xfs-fix-perag-reference-leak-on-iteration-race-with-growfs.patch xfs-prevent-a-warn_once-in-xfs_ioc_attr_list.patch r8152-fix-a-wol-issue.patch ip-fix-data-races-around-sysctl_ip_default_ttl.patch +xfrm-xfrm_policy-fix-a-possible-double-xfrm_pols_put.patch +power-reset-arm-versatile-fix-refcount-leak-in-versa.patch +rdma-irdma-do-not-advertise-1gb-page-size-for-x722.patch +rdma-irdma-fix-sleep-from-invalid-context-bug.patch +pinctrl-ralink-rename-mt7628-an-functions-to-mt76x8.patch +pinctrl-ralink-rename-pinctrl-rt2880-to-pinctrl-rali.patch +pinctrl-ralink-check-for-null-return-of-devm_kcalloc.patch +perf-core-fix-data-race-between-perf_event_set_outpu.patch +ipv4-tcp-do-not-use-per-netns-ctl-sockets.patch +net-tun-split-run_ebpf_filter-and-pskb_trim-into-dif.patch +mm-pagealloc-sysctl-change-watermark_scale_factor-ma.patch +sysctl-move-some-boundary-constants-from-sysctl.c-to.patch +tcp-fix-data-races-around-sysctl_tcp_ecn.patch +drm-amd-display-support-for-dmub-hpd-interrupt-handl.patch +drm-amd-display-add-option-to-defer-works-of-hpd_rx_.patch +drm-amd-display-fork-thread-to-offload-work-of-hpd_r.patch +drm-amdgpu-display-add-quirk-handling-for-stutter-mo.patch +drm-amd-display-ignore-first-mst-sideband-message-re.patch +scsi-megaraid-clear-read-queue-map-s-nr_queues.patch +scsi-ufs-core-drop-loglevel-of-writeboost-message.patch +nvme-check-for-duplicate-identifiers-earlier.patch +nvme-fix-block-device-naming-collision.patch +e1000e-enable-gpt-clock-before-sending-message-to-cs.patch +revert-e1000e-fix-possible-hw-unit-hang-after-an-s0i.patch +igc-reinstate-igc_removed-logic-and-implement-it-pro.patch +ip-fix-data-races-around-sysctl_ip_no_pmtu_disc.patch +ip-fix-data-races-around-sysctl_ip_fwd_use_pmtu.patch +ip-fix-data-races-around-sysctl_ip_fwd_update_priori.patch +ip-fix-data-races-around-sysctl_ip_nonlocal_bind.patch +ip-fix-a-data-race-around-sysctl_ip_autobind_reuse.patch +ip-fix-a-data-race-around-sysctl_fwmark_reflect.patch +tcp-dccp-fix-a-data-race-around-sysctl_tcp_fwmark_ac.patch +tcp-sk-sk_bound_dev_if-once-in-inet_request_bound_de.patch +tcp-fix-data-races-around-sysctl_tcp_l3mdev_accept.patch +tcp-fix-data-races-around-sysctl_tcp_mtu_probing.patch +tcp-fix-data-races-around-sysctl_tcp_base_mss.patch +tcp-fix-data-races-around-sysctl_tcp_min_snd_mss.patch +tcp-fix-a-data-race-around-sysctl_tcp_mtu_probe_floo.patch +tcp-fix-a-data-race-around-sysctl_tcp_probe_threshol.patch +tcp-fix-a-data-race-around-sysctl_tcp_probe_interval.patch +net-stmmac-fix-pm-runtime-issue-in-stmmac_dvr_remove.patch +net-stmmac-fix-unbalanced-ptp-clock-issue-in-suspend.patch +mtd-rawnand-gpmi-validate-controller-clock-rate.patch +mtd-rawnand-gpmi-set-wait_for_ready-timeout-based-on.patch +net-dsa-microchip-ksz_common-fix-refcount-leak-bug.patch +net-skb-introduce-kfree_skb_reason.patch +net-skb-use-kfree_skb_reason-in-tcp_v4_rcv.patch +net-skb-use-kfree_skb_reason-in-__udp4_lib_rcv.patch +net-socket-rename-skb_drop_reason_socket_filter.patch +net-skb_drop_reason-add-document-for-drop-reasons.patch +net-netfilter-use-kfree_drop_reason-for-nf_drop.patch +net-ipv4-use-kfree_skb_reason-in-ip_rcv_core.patch +net-ipv4-use-kfree_skb_reason-in-ip_rcv_finish_core.patch +i2c-mlxcpld-fix-register-setting-for-400khz-frequenc.patch +i2c-cadence-change-large-transfer-count-reset-logic-.patch +perf-tests-fix-convert-perf-time-to-tsc-test-for-hyb.patch +net-stmmac-fix-dma-queue-left-shift-overflow-issue.patch +net-tls-fix-race-in-tls-device-down-flow.patch +igmp-fix-data-races-around-sysctl_igmp_llm_reports.patch +igmp-fix-a-data-race-around-sysctl_igmp_max_membersh.patch +igmp-fix-data-races-around-sysctl_igmp_max_msf.patch +tcp-fix-data-races-around-keepalive-sysctl-knobs.patch +tcp-fix-data-races-around-sysctl_tcp_syn-ack-_retrie.patch +tcp-fix-data-races-around-sysctl_tcp_syncookies.patch +tcp-fix-data-races-around-sysctl_tcp_migrate_req.patch +tcp-fix-data-races-around-sysctl_tcp_reordering.patch +tcp-fix-data-races-around-some-timeout-sysctl-knobs.patch +tcp-fix-a-data-race-around-sysctl_tcp_notsent_lowat.patch +tcp-fix-a-data-race-around-sysctl_tcp_tw_reuse.patch +tcp-fix-data-races-around-sysctl_max_syn_backlog.patch +tcp-fix-data-races-around-sysctl_tcp_fastopen.patch +tcp-fix-data-races-around-sysctl_tcp_fastopen_blackh.patch +iavf-fix-handling-of-dummy-receive-descriptors.patch +pinctrl-armada-37xx-use-temporary-variable-for-struc.patch +pinctrl-armada-37xx-make-use-of-the-devm_platform_io.patch +pinctrl-armada-37xx-convert-to-use-dev_err_probe.patch +pinctrl-armada-37xx-use-raw-spinlocks-for-regmap-to-.patch +i40e-fix-erroneous-adapter-reinitialization-during-r.patch +ixgbe-add-locking-to-prevent-panic-when-setting-srio.patch +net-stmmac-remove-redunctant-disable-xpcs-eee-call.patch +gpio-pca953x-only-use-single-read-write-for-no-ai-mo.patch +gpio-pca953x-use-the-correct-range-when-do-regmap-sy.patch +gpio-pca953x-use-the-correct-register-address-when-r.patch +be2net-fix-buffer-overflow-in-be_get_module_eeprom.patch +net-dsa-sja1105-silent-spi_device_id-warnings.patch +net-dsa-vitesse-vsc73xx-silent-spi_device_id-warning.patch +drm-imx-dcss-add-missing-of_node_put-in-fail-path.patch +ipv4-fix-a-data-race-around-sysctl_fib_multipath_use.patch +ipv4-fix-data-races-around-sysctl_fib_multipath_hash.patch +ipv4-fix-data-races-around-sysctl_fib_multipath_hash.patch-25508 +ip-fix-data-races-around-sysctl_ip_prot_sock.patch +udp-fix-a-data-race-around-sysctl_udp_l3mdev_accept.patch +tcp-fix-data-races-around-sysctl-knobs-related-to-sy.patch +tcp-fix-a-data-race-around-sysctl_tcp_early_retrans.patch +tcp-fix-data-races-around-sysctl_tcp_recovery.patch +tcp-fix-a-data-race-around-sysctl_tcp_thin_linear_ti.patch +tcp-fix-data-races-around-sysctl_tcp_slow_start_afte.patch +tcp-fix-a-data-race-around-sysctl_tcp_retrans_collap.patch +tcp-fix-a-data-race-around-sysctl_tcp_stdurg.patch +tcp-fix-a-data-race-around-sysctl_tcp_rfc1337.patch +tcp-fix-a-data-race-around-sysctl_tcp_abort_on_overf.patch +tcp-fix-data-races-around-sysctl_tcp_max_reordering.patch +gpio-gpio-xilinx-fix-integer-overflow.patch diff --git a/queue-5.15/sysctl-move-some-boundary-constants-from-sysctl.c-to.patch b/queue-5.15/sysctl-move-some-boundary-constants-from-sysctl.c-to.patch new file mode 100644 index 00000000000..51ca1573899 --- /dev/null +++ b/queue-5.15/sysctl-move-some-boundary-constants-from-sysctl.c-to.patch @@ -0,0 +1,301 @@ +From 476ffd8b82dd52e679c7a65234d7f1b3f82c7d77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 22:10:55 -0800 +Subject: sysctl: move some boundary constants from sysctl.c to sysctl_vals + +From: Xiaoming Ni + +[ Upstream commit 78e36f3b0dae586f623c4a37ec5eb5496f5abbe1 ] + +sysctl has helpers which let us specify boundary values for a min or max +int value. Since these are used for a boundary check only they don't +change, so move these variables to sysctl_vals to avoid adding duplicate +variables. This will help with our cleanup of kernel/sysctl.c. + +[akpm@linux-foundation.org: update it for "mm/pagealloc: sysctl: change watermark_scale_factor max limit to 30%"] +[mcgrof@kernel.org: major rebase] + +Link: https://lkml.kernel.org/r/20211123202347.818157-3-mcgrof@kernel.org +Signed-off-by: Xiaoming Ni +Signed-off-by: Luis Chamberlain +Reviewed-by: Kees Cook +Cc: Al Viro +Cc: Amir Goldstein +Cc: Andy Shevchenko +Cc: Benjamin LaHaise +Cc: "Eric W. Biederman" +Cc: Greg Kroah-Hartman +Cc: Iurii Zaikin +Cc: Jan Kara +Cc: Paul Turner +Cc: Peter Zijlstra +Cc: Petr Mladek +Cc: Qing Wang +Cc: Sebastian Reichel +Cc: Sergey Senozhatsky +Cc: Stephen Kitt +Cc: Tetsuo Handa +Cc: Antti Palosaari +Cc: Arnd Bergmann +Cc: Benjamin Herrenschmidt +Cc: Clemens Ladisch +Cc: David Airlie +Cc: Jani Nikula +Cc: Joel Becker +Cc: Joonas Lahtinen +Cc: Joseph Qi +Cc: Julia Lawall +Cc: Lukas Middendorf +Cc: Mark Fasheh +Cc: Phillip Potter +Cc: Rodrigo Vivi +Cc: Douglas Gilbert +Cc: James E.J. Bottomley +Cc: Jani Nikula +Cc: John Ogness +Cc: Martin K. Petersen +Cc: "Rafael J. Wysocki" +Cc: Steven Rostedt (VMware) +Cc: Suren Baghdasaryan +Cc: "Theodore Ts'o" +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/proc/proc_sysctl.c | 2 +- + include/linux/sysctl.h | 13 +++++++++--- + kernel/sysctl.c | 45 ++++++++++++++++++------------------------ + 3 files changed, 30 insertions(+), 30 deletions(-) + +diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c +index 5d66faecd4ef..013fc5931bc3 100644 +--- a/fs/proc/proc_sysctl.c ++++ b/fs/proc/proc_sysctl.c +@@ -25,7 +25,7 @@ static const struct file_operations proc_sys_dir_file_operations; + static const struct inode_operations proc_sys_dir_operations; + + /* shared constants to be used in various sysctls */ +-const int sysctl_vals[] = { 0, 1, INT_MAX }; ++const int sysctl_vals[] = { -1, 0, 1, 2, 4, 100, 200, 1000, 3000, INT_MAX }; + EXPORT_SYMBOL(sysctl_vals); + + /* Support for permanently empty directories */ +diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h +index 1fa2b69c6fc3..fa372b4c2313 100644 +--- a/include/linux/sysctl.h ++++ b/include/linux/sysctl.h +@@ -38,9 +38,16 @@ struct ctl_table_header; + struct ctl_dir; + + /* Keep the same order as in fs/proc/proc_sysctl.c */ +-#define SYSCTL_ZERO ((void *)&sysctl_vals[0]) +-#define SYSCTL_ONE ((void *)&sysctl_vals[1]) +-#define SYSCTL_INT_MAX ((void *)&sysctl_vals[2]) ++#define SYSCTL_NEG_ONE ((void *)&sysctl_vals[0]) ++#define SYSCTL_ZERO ((void *)&sysctl_vals[1]) ++#define SYSCTL_ONE ((void *)&sysctl_vals[2]) ++#define SYSCTL_TWO ((void *)&sysctl_vals[3]) ++#define SYSCTL_FOUR ((void *)&sysctl_vals[4]) ++#define SYSCTL_ONE_HUNDRED ((void *)&sysctl_vals[5]) ++#define SYSCTL_TWO_HUNDRED ((void *)&sysctl_vals[6]) ++#define SYSCTL_ONE_THOUSAND ((void *)&sysctl_vals[7]) ++#define SYSCTL_THREE_THOUSAND ((void *)&sysctl_vals[8]) ++#define SYSCTL_INT_MAX ((void *)&sysctl_vals[9]) + + extern const int sysctl_vals[]; + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 347a90a878b3..23c08bf3db58 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -113,16 +113,9 @@ + static int sixty = 60; + #endif + +-static int __maybe_unused neg_one = -1; +-static int __maybe_unused two = 2; +-static int __maybe_unused four = 4; + static unsigned long zero_ul; + static unsigned long one_ul = 1; + static unsigned long long_max = LONG_MAX; +-static int one_hundred = 100; +-static int two_hundred = 200; +-static int one_thousand = 1000; +-static int three_thousand = 3000; + #ifdef CONFIG_PRINTK + static int ten_thousand = 10000; + #endif +@@ -1973,7 +1966,7 @@ static struct ctl_table kern_table[] = { + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, +- .extra1 = &neg_one, ++ .extra1 = SYSCTL_NEG_ONE, + .extra2 = SYSCTL_ONE, + }, + #endif +@@ -2315,7 +2308,7 @@ static struct ctl_table kern_table[] = { + .mode = 0644, + .proc_handler = proc_dointvec_minmax_sysadmin, + .extra1 = SYSCTL_ZERO, +- .extra2 = &two, ++ .extra2 = SYSCTL_TWO, + }, + #endif + { +@@ -2575,7 +2568,7 @@ static struct ctl_table kern_table[] = { + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, +- .extra1 = &neg_one, ++ .extra1 = SYSCTL_NEG_ONE, + }, + #endif + #ifdef CONFIG_RT_MUTEXES +@@ -2637,7 +2630,7 @@ static struct ctl_table kern_table[] = { + .mode = 0644, + .proc_handler = perf_cpu_time_max_percent_handler, + .extra1 = SYSCTL_ZERO, +- .extra2 = &one_hundred, ++ .extra2 = SYSCTL_ONE_HUNDRED, + }, + { + .procname = "perf_event_max_stack", +@@ -2655,7 +2648,7 @@ static struct ctl_table kern_table[] = { + .mode = 0644, + .proc_handler = perf_event_max_stack_handler, + .extra1 = SYSCTL_ZERO, +- .extra2 = &one_thousand, ++ .extra2 = SYSCTL_ONE_THOUSAND, + }, + #endif + { +@@ -2686,7 +2679,7 @@ static struct ctl_table kern_table[] = { + .mode = 0644, + .proc_handler = bpf_unpriv_handler, + .extra1 = SYSCTL_ZERO, +- .extra2 = &two, ++ .extra2 = SYSCTL_TWO, + }, + { + .procname = "bpf_stats_enabled", +@@ -2740,7 +2733,7 @@ static struct ctl_table vm_table[] = { + .mode = 0644, + .proc_handler = overcommit_policy_handler, + .extra1 = SYSCTL_ZERO, +- .extra2 = &two, ++ .extra2 = SYSCTL_TWO, + }, + { + .procname = "panic_on_oom", +@@ -2749,7 +2742,7 @@ static struct ctl_table vm_table[] = { + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, +- .extra2 = &two, ++ .extra2 = SYSCTL_TWO, + }, + { + .procname = "oom_kill_allocating_task", +@@ -2794,7 +2787,7 @@ static struct ctl_table vm_table[] = { + .mode = 0644, + .proc_handler = dirty_background_ratio_handler, + .extra1 = SYSCTL_ZERO, +- .extra2 = &one_hundred, ++ .extra2 = SYSCTL_ONE_HUNDRED, + }, + { + .procname = "dirty_background_bytes", +@@ -2811,7 +2804,7 @@ static struct ctl_table vm_table[] = { + .mode = 0644, + .proc_handler = dirty_ratio_handler, + .extra1 = SYSCTL_ZERO, +- .extra2 = &one_hundred, ++ .extra2 = SYSCTL_ONE_HUNDRED, + }, + { + .procname = "dirty_bytes", +@@ -2851,7 +2844,7 @@ static struct ctl_table vm_table[] = { + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, +- .extra2 = &two_hundred, ++ .extra2 = SYSCTL_TWO_HUNDRED, + }, + #ifdef CONFIG_NUMA + { +@@ -2910,7 +2903,7 @@ static struct ctl_table vm_table[] = { + .mode = 0200, + .proc_handler = drop_caches_sysctl_handler, + .extra1 = SYSCTL_ONE, +- .extra2 = &four, ++ .extra2 = SYSCTL_FOUR, + }, + #ifdef CONFIG_COMPACTION + { +@@ -2927,7 +2920,7 @@ static struct ctl_table vm_table[] = { + .mode = 0644, + .proc_handler = compaction_proactiveness_sysctl_handler, + .extra1 = SYSCTL_ZERO, +- .extra2 = &one_hundred, ++ .extra2 = SYSCTL_ONE_HUNDRED, + }, + { + .procname = "extfrag_threshold", +@@ -2972,7 +2965,7 @@ static struct ctl_table vm_table[] = { + .mode = 0644, + .proc_handler = watermark_scale_factor_sysctl_handler, + .extra1 = SYSCTL_ONE, +- .extra2 = &three_thousand, ++ .extra2 = SYSCTL_THREE_THOUSAND, + }, + { + .procname = "percpu_pagelist_high_fraction", +@@ -3051,7 +3044,7 @@ static struct ctl_table vm_table[] = { + .mode = 0644, + .proc_handler = sysctl_min_unmapped_ratio_sysctl_handler, + .extra1 = SYSCTL_ZERO, +- .extra2 = &one_hundred, ++ .extra2 = SYSCTL_ONE_HUNDRED, + }, + { + .procname = "min_slab_ratio", +@@ -3060,7 +3053,7 @@ static struct ctl_table vm_table[] = { + .mode = 0644, + .proc_handler = sysctl_min_slab_ratio_sysctl_handler, + .extra1 = SYSCTL_ZERO, +- .extra2 = &one_hundred, ++ .extra2 = SYSCTL_ONE_HUNDRED, + }, + #endif + #ifdef CONFIG_SMP +@@ -3350,7 +3343,7 @@ static struct ctl_table fs_table[] = { + .mode = 0600, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, +- .extra2 = &two, ++ .extra2 = SYSCTL_TWO, + }, + { + .procname = "protected_regular", +@@ -3359,7 +3352,7 @@ static struct ctl_table fs_table[] = { + .mode = 0600, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, +- .extra2 = &two, ++ .extra2 = SYSCTL_TWO, + }, + { + .procname = "suid_dumpable", +@@ -3368,7 +3361,7 @@ static struct ctl_table fs_table[] = { + .mode = 0644, + .proc_handler = proc_dointvec_minmax_coredump, + .extra1 = SYSCTL_ZERO, +- .extra2 = &two, ++ .extra2 = SYSCTL_TWO, + }, + #if defined(CONFIG_BINFMT_MISC) || defined(CONFIG_BINFMT_MISC_MODULE) + { +-- +2.35.1 + diff --git a/queue-5.15/tcp-dccp-fix-a-data-race-around-sysctl_tcp_fwmark_ac.patch b/queue-5.15/tcp-dccp-fix-a-data-race-around-sysctl_tcp_fwmark_ac.patch new file mode 100644 index 00000000000..9964c93bbd1 --- /dev/null +++ b/queue-5.15/tcp-dccp-fix-a-data-race-around-sysctl_tcp_fwmark_ac.patch @@ -0,0 +1,37 @@ +From e34723444b584e59af2a564787903e235920ea1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 13:51:58 -0700 +Subject: tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. + +From: Kuniyuki Iwashima + +[ Upstream commit 1a0008f9df59451d0a17806c1ee1a19857032fa8 ] + +While reading sysctl_tcp_fwmark_accept, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: 84f39b08d786 ("net: support marking accepting TCP sockets") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/inet_sock.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h +index defd77baf74a..33344d54ad65 100644 +--- a/include/net/inet_sock.h ++++ b/include/net/inet_sock.h +@@ -107,7 +107,8 @@ static inline struct inet_request_sock *inet_rsk(const struct request_sock *sk) + + static inline u32 inet_request_mark(const struct sock *sk, struct sk_buff *skb) + { +- if (!sk->sk_mark && sock_net(sk)->ipv4.sysctl_tcp_fwmark_accept) ++ if (!sk->sk_mark && ++ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fwmark_accept)) + return skb->mark; + + return sk->sk_mark; +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_abort_on_overf.patch b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_abort_on_overf.patch new file mode 100644 index 00000000000..5ba65193728 --- /dev/null +++ b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_abort_on_overf.patch @@ -0,0 +1,36 @@ +From e206aa9ef1d9e5236e96b7a7f18cb66a0c0aac66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 10:26:52 -0700 +Subject: tcp: Fix a data-race around sysctl_tcp_abort_on_overflow. + +From: Kuniyuki Iwashima + +[ Upstream commit 2d17d9c7382327d00aeaea35af44e9b26d53206e ] + +While reading sysctl_tcp_abort_on_overflow, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_minisocks.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c +index 39d8101e8f99..41368e77fbb8 100644 +--- a/net/ipv4/tcp_minisocks.c ++++ b/net/ipv4/tcp_minisocks.c +@@ -789,7 +789,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb, + if (sk != req->rsk_listener) + __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMIGRATEREQFAILURE); + +- if (!sock_net(sk)->ipv4.sysctl_tcp_abort_on_overflow) { ++ if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_abort_on_overflow)) { + inet_rsk(req)->acked = 1; + return NULL; + } +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_early_retrans.patch b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_early_retrans.patch new file mode 100644 index 00000000000..9e4446687dc --- /dev/null +++ b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_early_retrans.patch @@ -0,0 +1,36 @@ +From b4657c8d52a8a43c1df0d8e7626b99748ffd7c92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 10:26:45 -0700 +Subject: tcp: Fix a data-race around sysctl_tcp_early_retrans. + +From: Kuniyuki Iwashima + +[ Upstream commit 52e65865deb6a36718a463030500f16530eaab74 ] + +While reading sysctl_tcp_early_retrans, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: eed530b6c676 ("tcp: early retransmit") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index a08fcf15372a..3b71d8735995 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2739,7 +2739,7 @@ bool tcp_schedule_loss_probe(struct sock *sk, bool advancing_rto) + if (rcu_access_pointer(tp->fastopen_rsk)) + return false; + +- early_retrans = sock_net(sk)->ipv4.sysctl_tcp_early_retrans; ++ early_retrans = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_early_retrans); + /* Schedule a loss probe in 2*RTT for SACK capable connections + * not in loss recovery, that are either limited by cwnd or application. + */ +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_mtu_probe_floo.patch b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_mtu_probe_floo.patch new file mode 100644 index 00000000000..7f0dc388e4f --- /dev/null +++ b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_mtu_probe_floo.patch @@ -0,0 +1,36 @@ +From 819d71b7545b24c65b65bd6fa5fc641ebec0620b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 13:52:03 -0700 +Subject: tcp: Fix a data-race around sysctl_tcp_mtu_probe_floor. + +From: Kuniyuki Iwashima + +[ Upstream commit 8e92d4423615a5257d0d871fc067aa561f597deb ] + +While reading sysctl_tcp_mtu_probe_floor, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: c04b79b6cfd7 ("tcp: add new tcp_mtu_probe_floor sysctl") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_timer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index 39107bb730b0..4f3b9ab222b6 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -172,7 +172,7 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk) + } else { + mss = tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_low) >> 1; + mss = min(READ_ONCE(net->ipv4.sysctl_tcp_base_mss), mss); +- mss = max(mss, net->ipv4.sysctl_tcp_mtu_probe_floor); ++ mss = max(mss, READ_ONCE(net->ipv4.sysctl_tcp_mtu_probe_floor)); + mss = max(mss, READ_ONCE(net->ipv4.sysctl_tcp_min_snd_mss)); + icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, mss); + } +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_notsent_lowat.patch b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_notsent_lowat.patch new file mode 100644 index 00000000000..9acfa6ab2b1 --- /dev/null +++ b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_notsent_lowat.patch @@ -0,0 +1,36 @@ +From 34040be709c6d692914d91806346817b7b13c996 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 10:17:51 -0700 +Subject: tcp: Fix a data-race around sysctl_tcp_notsent_lowat. + +From: Kuniyuki Iwashima + +[ Upstream commit 55be873695ed8912eb77ff46d1d1cadf028bd0f3 ] + +While reading sysctl_tcp_notsent_lowat, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: c9bee3b7fdec ("tcp: TCP_NOTSENT_LOWAT socket option") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index caecc020e521..0c609d10c320 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1994,7 +1994,7 @@ void __tcp_v4_send_check(struct sk_buff *skb, __be32 saddr, __be32 daddr); + static inline u32 tcp_notsent_lowat(const struct tcp_sock *tp) + { + struct net *net = sock_net((struct sock *)tp); +- return tp->notsent_lowat ?: net->ipv4.sysctl_tcp_notsent_lowat; ++ return tp->notsent_lowat ?: READ_ONCE(net->ipv4.sysctl_tcp_notsent_lowat); + } + + bool tcp_stream_memory_free(const struct sock *sk, int wake); +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_probe_interval.patch b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_probe_interval.patch new file mode 100644 index 00000000000..ec44aec9c6a --- /dev/null +++ b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_probe_interval.patch @@ -0,0 +1,36 @@ +From 60b8208e22d03217288240cf0a2dcb4d32a6f3ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 13:52:05 -0700 +Subject: tcp: Fix a data-race around sysctl_tcp_probe_interval. + +From: Kuniyuki Iwashima + +[ Upstream commit 2a85388f1d94a9f8b5a529118a2c5eaa0520d85c ] + +While reading sysctl_tcp_probe_interval, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: 05cbc0db03e8 ("ipv4: Create probe timer for tcp PMTU as per RFC4821") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 0ba48c43c06f..3fa2bfbc250d 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2281,7 +2281,7 @@ static inline void tcp_mtu_check_reprobe(struct sock *sk) + u32 interval; + s32 delta; + +- interval = net->ipv4.sysctl_tcp_probe_interval; ++ interval = READ_ONCE(net->ipv4.sysctl_tcp_probe_interval); + delta = tcp_jiffies32 - icsk->icsk_mtup.probe_timestamp; + if (unlikely(delta >= interval * HZ)) { + int mss = tcp_current_mss(sk); +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_probe_threshol.patch b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_probe_threshol.patch new file mode 100644 index 00000000000..0057f8ff4fb --- /dev/null +++ b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_probe_threshol.patch @@ -0,0 +1,36 @@ +From d4b0eec88a92641f3033771f3bc22d560696a285 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 13:52:04 -0700 +Subject: tcp: Fix a data-race around sysctl_tcp_probe_threshold. + +From: Kuniyuki Iwashima + +[ Upstream commit 92c0aa4175474483d6cf373314343d4e624e882a ] + +While reading sysctl_tcp_probe_threshold, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: 6b58e0a5f32d ("ipv4: Use binary search to choose tcp PMTU probe_size") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index b4a8a5b9350f..0ba48c43c06f 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2363,7 +2363,7 @@ static int tcp_mtu_probe(struct sock *sk) + * probing process by not resetting search range to its orignal. + */ + if (probe_size > tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_high) || +- interval < net->ipv4.sysctl_tcp_probe_threshold) { ++ interval < READ_ONCE(net->ipv4.sysctl_tcp_probe_threshold)) { + /* Check whether enough time has elaplased for + * another round of probing. + */ +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_retrans_collap.patch b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_retrans_collap.patch new file mode 100644 index 00000000000..f26d1e63eab --- /dev/null +++ b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_retrans_collap.patch @@ -0,0 +1,36 @@ +From bce9329613fef581327333976a9936e6b0206106 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 10:26:49 -0700 +Subject: tcp: Fix a data-race around sysctl_tcp_retrans_collapse. + +From: Kuniyuki Iwashima + +[ Upstream commit 1a63cb91f0c2fcdeced6d6edee8d1d886583d139 ] + +While reading sysctl_tcp_retrans_collapse, it can be changed +concurrently. Thus, we need to add READ_ONCE() to its reader. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 94f7841f7bfb..caf9283f9b0f 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -3108,7 +3108,7 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to, + struct sk_buff *skb = to, *tmp; + bool first = true; + +- if (!sock_net(sk)->ipv4.sysctl_tcp_retrans_collapse) ++ if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_retrans_collapse)) + return; + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN) + return; +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_rfc1337.patch b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_rfc1337.patch new file mode 100644 index 00000000000..0a12a141471 --- /dev/null +++ b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_rfc1337.patch @@ -0,0 +1,36 @@ +From 0eca6ecf156cffebdffae761d4fff72d29743a9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 10:26:51 -0700 +Subject: tcp: Fix a data-race around sysctl_tcp_rfc1337. + +From: Kuniyuki Iwashima + +[ Upstream commit 0b484c91911e758e53656d570de58c2ed81ec6f2 ] + +While reading sysctl_tcp_rfc1337, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_minisocks.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c +index 13783fc58e03..39d8101e8f99 100644 +--- a/net/ipv4/tcp_minisocks.c ++++ b/net/ipv4/tcp_minisocks.c +@@ -180,7 +180,7 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb, + * Oh well... nobody has a sufficient solution to this + * protocol bug yet. + */ +- if (twsk_net(tw)->ipv4.sysctl_tcp_rfc1337 == 0) { ++ if (!READ_ONCE(twsk_net(tw)->ipv4.sysctl_tcp_rfc1337)) { + kill: + inet_twsk_deschedule_put(tw); + return TCP_TW_SUCCESS; +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_stdurg.patch b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_stdurg.patch new file mode 100644 index 00000000000..463d442ed47 --- /dev/null +++ b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_stdurg.patch @@ -0,0 +1,36 @@ +From 168fbcf77a63ffa360a41d0e80bd722fc5845690 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 10:26:50 -0700 +Subject: tcp: Fix a data-race around sysctl_tcp_stdurg. + +From: Kuniyuki Iwashima + +[ Upstream commit 4e08ed41cb1194009fc1a916a59ce3ed4afd77cd ] + +While reading sysctl_tcp_stdurg, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 1cc0aca39c04..6309a4eb3acd 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -5542,7 +5542,7 @@ static void tcp_check_urg(struct sock *sk, const struct tcphdr *th) + struct tcp_sock *tp = tcp_sk(sk); + u32 ptr = ntohs(th->urg_ptr); + +- if (ptr && !sock_net(sk)->ipv4.sysctl_tcp_stdurg) ++ if (ptr && !READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_stdurg)) + ptr--; + ptr += ntohl(th->seq); + +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_thin_linear_ti.patch b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_thin_linear_ti.patch new file mode 100644 index 00000000000..df73e6e239b --- /dev/null +++ b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_thin_linear_ti.patch @@ -0,0 +1,36 @@ +From 2822a362735fa87be304ac9fda4fefc05e5d393a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 10:26:47 -0700 +Subject: tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts. + +From: Kuniyuki Iwashima + +[ Upstream commit 7c6f2a86ca590d5187a073d987e9599985fb1c7c ] + +While reading sysctl_tcp_thin_linear_timeouts, it can be changed +concurrently. Thus, we need to add READ_ONCE() to its reader. + +Fixes: 36e31b0af587 ("net: TCP thin linear timeouts") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_timer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index ec5277becc6a..50bba370486e 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -578,7 +578,7 @@ void tcp_retransmit_timer(struct sock *sk) + * linear-timeout retransmissions into a black hole + */ + if (sk->sk_state == TCP_ESTABLISHED && +- (tp->thin_lto || net->ipv4.sysctl_tcp_thin_linear_timeouts) && ++ (tp->thin_lto || READ_ONCE(net->ipv4.sysctl_tcp_thin_linear_timeouts)) && + tcp_stream_is_thin(tp) && + icsk->icsk_retransmits <= TCP_THIN_LINEAR_RETRIES) { + icsk->icsk_backoff = 0; +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_tw_reuse.patch b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_tw_reuse.patch new file mode 100644 index 00000000000..229d824fe73 --- /dev/null +++ b/queue-5.15/tcp-fix-a-data-race-around-sysctl_tcp_tw_reuse.patch @@ -0,0 +1,39 @@ +From 9d706e9ce94351cda5ce9c6d82f68d92ea43b9a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 10:17:52 -0700 +Subject: tcp: Fix a data-race around sysctl_tcp_tw_reuse. + +From: Kuniyuki Iwashima + +[ Upstream commit cbfc6495586a3f09f6f07d9fb3c7cafe807e3c55 ] + +While reading sysctl_tcp_tw_reuse, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_ipv4.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 235ae91bfd5a..fba02cf6b468 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -108,10 +108,10 @@ static u32 tcp_v4_init_ts_off(const struct net *net, const struct sk_buff *skb) + + int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp) + { ++ int reuse = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_tw_reuse); + const struct inet_timewait_sock *tw = inet_twsk(sktw); + const struct tcp_timewait_sock *tcptw = tcp_twsk(sktw); + struct tcp_sock *tp = tcp_sk(sk); +- int reuse = sock_net(sk)->ipv4.sysctl_tcp_tw_reuse; + + if (reuse == 2) { + /* Still does not detect *everything* that goes through +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-data-races-around-keepalive-sysctl-knobs.patch b/queue-5.15/tcp-fix-data-races-around-keepalive-sysctl-knobs.patch new file mode 100644 index 00000000000..af300b94b98 --- /dev/null +++ b/queue-5.15/tcp-fix-data-races-around-keepalive-sysctl-knobs.patch @@ -0,0 +1,69 @@ +From 85e473aaa7b7b24f95c98c23b20499a35cf7176c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 10:17:45 -0700 +Subject: tcp: Fix data-races around keepalive sysctl knobs. + +From: Kuniyuki Iwashima + +[ Upstream commit f2f316e287e6c2e3a1c5bab8d9b77ee03daa0463 ] + +While reading sysctl_tcp_keepalive_(time|probes|intvl), they can be changed +concurrently. Thus, we need to add READ_ONCE() to their readers. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 9 ++++++--- + net/smc/smc_llc.c | 2 +- + 2 files changed, 7 insertions(+), 4 deletions(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 3b97db2d438f..cae0c9102eda 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1469,21 +1469,24 @@ static inline int keepalive_intvl_when(const struct tcp_sock *tp) + { + struct net *net = sock_net((struct sock *)tp); + +- return tp->keepalive_intvl ? : net->ipv4.sysctl_tcp_keepalive_intvl; ++ return tp->keepalive_intvl ? : ++ READ_ONCE(net->ipv4.sysctl_tcp_keepalive_intvl); + } + + static inline int keepalive_time_when(const struct tcp_sock *tp) + { + struct net *net = sock_net((struct sock *)tp); + +- return tp->keepalive_time ? : net->ipv4.sysctl_tcp_keepalive_time; ++ return tp->keepalive_time ? : ++ READ_ONCE(net->ipv4.sysctl_tcp_keepalive_time); + } + + static inline int keepalive_probes(const struct tcp_sock *tp) + { + struct net *net = sock_net((struct sock *)tp); + +- return tp->keepalive_probes ? : net->ipv4.sysctl_tcp_keepalive_probes; ++ return tp->keepalive_probes ? : ++ READ_ONCE(net->ipv4.sysctl_tcp_keepalive_probes); + } + + static inline u32 keepalive_time_elapsed(const struct tcp_sock *tp) +diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c +index ee1f0fdba085..0ef15f8fba90 100644 +--- a/net/smc/smc_llc.c ++++ b/net/smc/smc_llc.c +@@ -1787,7 +1787,7 @@ void smc_llc_lgr_init(struct smc_link_group *lgr, struct smc_sock *smc) + init_waitqueue_head(&lgr->llc_flow_waiter); + init_waitqueue_head(&lgr->llc_msg_waiter); + mutex_init(&lgr->llc_conf_mutex); +- lgr->llc_testlink_time = net->ipv4.sysctl_tcp_keepalive_time; ++ lgr->llc_testlink_time = READ_ONCE(net->ipv4.sysctl_tcp_keepalive_time); + } + + /* called after lgr was removed from lgr_list */ +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-data-races-around-some-timeout-sysctl-knobs.patch b/queue-5.15/tcp-fix-data-races-around-some-timeout-sysctl-knobs.patch new file mode 100644 index 00000000000..1c4223c8690 --- /dev/null +++ b/queue-5.15/tcp-fix-data-races-around-some-timeout-sysctl-knobs.patch @@ -0,0 +1,119 @@ +From 969105aa4025b0ba2b5faf54e86ecee50d4ad898 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 10:17:50 -0700 +Subject: tcp: Fix data-races around some timeout sysctl knobs. + +From: Kuniyuki Iwashima + +[ Upstream commit 39e24435a776e9de5c6dd188836cf2523547804b ] + +While reading these sysctl knobs, they can be changed concurrently. +Thus, we need to add READ_ONCE() to their readers. + + - tcp_retries1 + - tcp_retries2 + - tcp_orphan_retries + - tcp_fin_timeout + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 3 ++- + net/ipv4/tcp.c | 2 +- + net/ipv4/tcp_output.c | 2 +- + net/ipv4/tcp_timer.c | 10 +++++----- + 4 files changed, 9 insertions(+), 8 deletions(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index cae0c9102eda..caecc020e521 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1499,7 +1499,8 @@ static inline u32 keepalive_time_elapsed(const struct tcp_sock *tp) + + static inline int tcp_fin_time(const struct sock *sk) + { +- int fin_timeout = tcp_sk(sk)->linger2 ? : sock_net(sk)->ipv4.sysctl_tcp_fin_timeout; ++ int fin_timeout = tcp_sk(sk)->linger2 ? : ++ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fin_timeout); + const int rto = inet_csk(sk)->icsk_rto; + + if (fin_timeout < (rto << 2) - (rto >> 1)) +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 480fac19a074..f853f34dfb79 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3980,7 +3980,7 @@ static int do_tcp_getsockopt(struct sock *sk, int level, + case TCP_LINGER2: + val = tp->linger2; + if (val >= 0) +- val = (val ? : net->ipv4.sysctl_tcp_fin_timeout) / HZ; ++ val = (val ? : READ_ONCE(net->ipv4.sysctl_tcp_fin_timeout)) / HZ; + break; + case TCP_DEFER_ACCEPT: + val = retrans_to_secs(icsk->icsk_accept_queue.rskq_defer_accept, +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 3fa2bfbc250d..fcccf56ae9f7 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -4093,7 +4093,7 @@ void tcp_send_probe0(struct sock *sk) + + icsk->icsk_probes_out++; + if (err <= 0) { +- if (icsk->icsk_backoff < net->ipv4.sysctl_tcp_retries2) ++ if (icsk->icsk_backoff < READ_ONCE(net->ipv4.sysctl_tcp_retries2)) + icsk->icsk_backoff++; + timeout = tcp_probe0_when(sk, TCP_RTO_MAX); + } else { +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index a234704e8163..ec5277becc6a 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -143,7 +143,7 @@ static int tcp_out_of_resources(struct sock *sk, bool do_reset) + */ + static int tcp_orphan_retries(struct sock *sk, bool alive) + { +- int retries = sock_net(sk)->ipv4.sysctl_tcp_orphan_retries; /* May be zero. */ ++ int retries = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_orphan_retries); /* May be zero. */ + + /* We know from an ICMP that something is wrong. */ + if (sk->sk_err_soft && !alive) +@@ -243,14 +243,14 @@ static int tcp_write_timeout(struct sock *sk) + READ_ONCE(net->ipv4.sysctl_tcp_syn_retries); + expired = icsk->icsk_retransmits >= retry_until; + } else { +- if (retransmits_timed_out(sk, net->ipv4.sysctl_tcp_retries1, 0)) { ++ if (retransmits_timed_out(sk, READ_ONCE(net->ipv4.sysctl_tcp_retries1), 0)) { + /* Black hole detection */ + tcp_mtu_probing(icsk, sk); + + __dst_negative_advice(sk); + } + +- retry_until = net->ipv4.sysctl_tcp_retries2; ++ retry_until = READ_ONCE(net->ipv4.sysctl_tcp_retries2); + if (sock_flag(sk, SOCK_DEAD)) { + const bool alive = icsk->icsk_rto < TCP_RTO_MAX; + +@@ -381,7 +381,7 @@ static void tcp_probe_timer(struct sock *sk) + msecs_to_jiffies(icsk->icsk_user_timeout)) + goto abort; + +- max_probes = sock_net(sk)->ipv4.sysctl_tcp_retries2; ++ max_probes = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_retries2); + if (sock_flag(sk, SOCK_DEAD)) { + const bool alive = inet_csk_rto_backoff(icsk, TCP_RTO_MAX) < TCP_RTO_MAX; + +@@ -589,7 +589,7 @@ void tcp_retransmit_timer(struct sock *sk) + } + inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, + tcp_clamp_rto_to_user_timeout(sk), TCP_RTO_MAX); +- if (retransmits_timed_out(sk, net->ipv4.sysctl_tcp_retries1 + 1, 0)) ++ if (retransmits_timed_out(sk, READ_ONCE(net->ipv4.sysctl_tcp_retries1) + 1, 0)) + __sk_dst_reset(sk); + + out:; +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-data-races-around-sysctl-knobs-related-to-sy.patch b/queue-5.15/tcp-fix-data-races-around-sysctl-knobs-related-to-sy.patch new file mode 100644 index 00000000000..0ae17408cd2 --- /dev/null +++ b/queue-5.15/tcp-fix-data-races-around-sysctl-knobs-related-to-sy.patch @@ -0,0 +1,180 @@ +From bc3c27aac1f9296b91256f9d66139263f333682b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 10:26:44 -0700 +Subject: tcp: Fix data-races around sysctl knobs related to SYN option. + +From: Kuniyuki Iwashima + +[ Upstream commit 3666f666e99600518ab20982af04a078bbdad277 ] + +While reading these knobs, they can be changed concurrently. +Thus, we need to add READ_ONCE() to their readers. + + - tcp_sack + - tcp_window_scaling + - tcp_timestamps + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../ethernet/chelsio/inline_crypto/chtls/chtls_cm.c | 6 +++--- + net/core/secure_seq.c | 4 ++-- + net/ipv4/syncookies.c | 6 +++--- + net/ipv4/tcp_input.c | 6 +++--- + net/ipv4/tcp_output.c | 10 +++++----- + 5 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c +index 7c760aa65540..ddfe9208529a 100644 +--- a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c ++++ b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c +@@ -1236,8 +1236,8 @@ static struct sock *chtls_recv_sock(struct sock *lsk, + csk->sndbuf = newsk->sk_sndbuf; + csk->smac_idx = ((struct port_info *)netdev_priv(ndev))->smt_idx; + RCV_WSCALE(tp) = select_rcv_wscale(tcp_full_space(newsk), +- sock_net(newsk)-> +- ipv4.sysctl_tcp_window_scaling, ++ READ_ONCE(sock_net(newsk)-> ++ ipv4.sysctl_tcp_window_scaling), + tp->window_clamp); + neigh_release(n); + inet_inherit_port(&tcp_hashinfo, lsk, newsk); +@@ -1384,7 +1384,7 @@ static void chtls_pass_accept_request(struct sock *sk, + #endif + } + if (req->tcpopt.wsf <= 14 && +- sock_net(sk)->ipv4.sysctl_tcp_window_scaling) { ++ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_window_scaling)) { + inet_rsk(oreq)->wscale_ok = 1; + inet_rsk(oreq)->snd_wscale = req->tcpopt.wsf; + } +diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c +index 7131cd1fb2ad..189eea1372d5 100644 +--- a/net/core/secure_seq.c ++++ b/net/core/secure_seq.c +@@ -64,7 +64,7 @@ u32 secure_tcpv6_ts_off(const struct net *net, + .daddr = *(struct in6_addr *)daddr, + }; + +- if (net->ipv4.sysctl_tcp_timestamps != 1) ++ if (READ_ONCE(net->ipv4.sysctl_tcp_timestamps) != 1) + return 0; + + ts_secret_init(); +@@ -120,7 +120,7 @@ EXPORT_SYMBOL(secure_ipv6_port_ephemeral); + #ifdef CONFIG_INET + u32 secure_tcp_ts_off(const struct net *net, __be32 saddr, __be32 daddr) + { +- if (net->ipv4.sysctl_tcp_timestamps != 1) ++ if (READ_ONCE(net->ipv4.sysctl_tcp_timestamps) != 1) + return 0; + + ts_secret_init(); +diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c +index 8eee771d2aca..940839264025 100644 +--- a/net/ipv4/syncookies.c ++++ b/net/ipv4/syncookies.c +@@ -249,12 +249,12 @@ bool cookie_timestamp_decode(const struct net *net, + return true; + } + +- if (!net->ipv4.sysctl_tcp_timestamps) ++ if (!READ_ONCE(net->ipv4.sysctl_tcp_timestamps)) + return false; + + tcp_opt->sack_ok = (options & TS_OPT_SACK) ? TCP_SACK_SEEN : 0; + +- if (tcp_opt->sack_ok && !net->ipv4.sysctl_tcp_sack) ++ if (tcp_opt->sack_ok && !READ_ONCE(net->ipv4.sysctl_tcp_sack)) + return false; + + if ((options & TS_OPT_WSCALE_MASK) == TS_OPT_WSCALE_MASK) +@@ -263,7 +263,7 @@ bool cookie_timestamp_decode(const struct net *net, + tcp_opt->wscale_ok = 1; + tcp_opt->snd_wscale = options & TS_OPT_WSCALE_MASK; + +- return net->ipv4.sysctl_tcp_window_scaling != 0; ++ return READ_ONCE(net->ipv4.sysctl_tcp_window_scaling) != 0; + } + EXPORT_SYMBOL(cookie_timestamp_decode); + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index d9e534c6fd0c..dd10a317709f 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -4053,7 +4053,7 @@ void tcp_parse_options(const struct net *net, + break; + case TCPOPT_WINDOW: + if (opsize == TCPOLEN_WINDOW && th->syn && +- !estab && net->ipv4.sysctl_tcp_window_scaling) { ++ !estab && READ_ONCE(net->ipv4.sysctl_tcp_window_scaling)) { + __u8 snd_wscale = *(__u8 *)ptr; + opt_rx->wscale_ok = 1; + if (snd_wscale > TCP_MAX_WSCALE) { +@@ -4069,7 +4069,7 @@ void tcp_parse_options(const struct net *net, + case TCPOPT_TIMESTAMP: + if ((opsize == TCPOLEN_TIMESTAMP) && + ((estab && opt_rx->tstamp_ok) || +- (!estab && net->ipv4.sysctl_tcp_timestamps))) { ++ (!estab && READ_ONCE(net->ipv4.sysctl_tcp_timestamps)))) { + opt_rx->saw_tstamp = 1; + opt_rx->rcv_tsval = get_unaligned_be32(ptr); + opt_rx->rcv_tsecr = get_unaligned_be32(ptr + 4); +@@ -4077,7 +4077,7 @@ void tcp_parse_options(const struct net *net, + break; + case TCPOPT_SACK_PERM: + if (opsize == TCPOLEN_SACK_PERM && th->syn && +- !estab && net->ipv4.sysctl_tcp_sack) { ++ !estab && READ_ONCE(net->ipv4.sysctl_tcp_sack)) { + opt_rx->sack_ok = TCP_SACK_SEEN; + tcp_sack_reset(opt_rx); + } +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index fcccf56ae9f7..a08fcf15372a 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -790,18 +790,18 @@ static unsigned int tcp_syn_options(struct sock *sk, struct sk_buff *skb, + opts->mss = tcp_advertise_mss(sk); + remaining -= TCPOLEN_MSS_ALIGNED; + +- if (likely(sock_net(sk)->ipv4.sysctl_tcp_timestamps && !*md5)) { ++ if (likely(READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_timestamps) && !*md5)) { + opts->options |= OPTION_TS; + opts->tsval = tcp_skb_timestamp(skb) + tp->tsoffset; + opts->tsecr = tp->rx_opt.ts_recent; + remaining -= TCPOLEN_TSTAMP_ALIGNED; + } +- if (likely(sock_net(sk)->ipv4.sysctl_tcp_window_scaling)) { ++ if (likely(READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_window_scaling))) { + opts->ws = tp->rx_opt.rcv_wscale; + opts->options |= OPTION_WSCALE; + remaining -= TCPOLEN_WSCALE_ALIGNED; + } +- if (likely(sock_net(sk)->ipv4.sysctl_tcp_sack)) { ++ if (likely(READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_sack))) { + opts->options |= OPTION_SACK_ADVERTISE; + if (unlikely(!(OPTION_TS & opts->options))) + remaining -= TCPOLEN_SACKPERM_ALIGNED; +@@ -3649,7 +3649,7 @@ static void tcp_connect_init(struct sock *sk) + * See tcp_input.c:tcp_rcv_state_process case TCP_SYN_SENT. + */ + tp->tcp_header_len = sizeof(struct tcphdr); +- if (sock_net(sk)->ipv4.sysctl_tcp_timestamps) ++ if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_timestamps)) + tp->tcp_header_len += TCPOLEN_TSTAMP_ALIGNED; + + #ifdef CONFIG_TCP_MD5SIG +@@ -3685,7 +3685,7 @@ static void tcp_connect_init(struct sock *sk) + tp->advmss - (tp->rx_opt.ts_recent_stamp ? tp->tcp_header_len - sizeof(struct tcphdr) : 0), + &tp->rcv_wnd, + &tp->window_clamp, +- sock_net(sk)->ipv4.sysctl_tcp_window_scaling, ++ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_window_scaling), + &rcv_wscale, + rcv_wnd); + +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-data-races-around-sysctl_max_syn_backlog.patch b/queue-5.15/tcp-fix-data-races-around-sysctl_max_syn_backlog.patch new file mode 100644 index 00000000000..37aa43965e7 --- /dev/null +++ b/queue-5.15/tcp-fix-data-races-around-sysctl_max_syn_backlog.patch @@ -0,0 +1,42 @@ +From c525de546972443e85cd51c2b1926cc6984bca29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 10:17:53 -0700 +Subject: tcp: Fix data-races around sysctl_max_syn_backlog. + +From: Kuniyuki Iwashima + +[ Upstream commit 79539f34743d3e14cc1fa6577d326a82cc64d62f ] + +While reading sysctl_max_syn_backlog, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 06802295e170..d9e534c6fd0c 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -6894,10 +6894,12 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, + tcp_rsk(req)->ts_off = af_ops->init_ts_off(net, skb); + + if (!want_cookie && !isn) { ++ int max_syn_backlog = READ_ONCE(net->ipv4.sysctl_max_syn_backlog); ++ + /* Kill the following clause, if you dislike this way. */ + if (!syncookies && +- (net->ipv4.sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) < +- (net->ipv4.sysctl_max_syn_backlog >> 2)) && ++ (max_syn_backlog - inet_csk_reqsk_queue_len(sk) < ++ (max_syn_backlog >> 2)) && + !tcp_peer_is_proven(req, dst)) { + /* Without syncookies last quarter of + * backlog is filled with destinations, +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_base_mss.patch b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_base_mss.patch new file mode 100644 index 00000000000..fb2f0402e09 --- /dev/null +++ b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_base_mss.patch @@ -0,0 +1,50 @@ +From 874d00838f919fa8fa375daff3ab8c02289bc7d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 13:52:01 -0700 +Subject: tcp: Fix data-races around sysctl_tcp_base_mss. + +From: Kuniyuki Iwashima + +[ Upstream commit 88d78bc097cd8ebc6541e93316c9d9bf651b13e8 ] + +While reading sysctl_tcp_base_mss, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +Fixes: 5d424d5a674f ("[TCP]: MTU probing") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 2 +- + net/ipv4/tcp_timer.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 1acfd4298a01..53277a9a2300 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -1768,7 +1768,7 @@ void tcp_mtup_init(struct sock *sk) + icsk->icsk_mtup.enabled = READ_ONCE(net->ipv4.sysctl_tcp_mtu_probing) > 1; + icsk->icsk_mtup.search_high = tp->rx_opt.mss_clamp + sizeof(struct tcphdr) + + icsk->icsk_af_ops->net_header_len; +- icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, net->ipv4.sysctl_tcp_base_mss); ++ icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, READ_ONCE(net->ipv4.sysctl_tcp_base_mss)); + icsk->icsk_mtup.probe_size = 0; + if (icsk->icsk_mtup.enabled) + icsk->icsk_mtup.probe_timestamp = tcp_jiffies32; +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index 98bb00e29e1e..04063c7e33ba 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -171,7 +171,7 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk) + icsk->icsk_mtup.probe_timestamp = tcp_jiffies32; + } else { + mss = tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_low) >> 1; +- mss = min(net->ipv4.sysctl_tcp_base_mss, mss); ++ mss = min(READ_ONCE(net->ipv4.sysctl_tcp_base_mss), mss); + mss = max(mss, net->ipv4.sysctl_tcp_mtu_probe_floor); + mss = max(mss, net->ipv4.sysctl_tcp_min_snd_mss); + icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, mss); +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_ecn.patch b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_ecn.patch new file mode 100644 index 00000000000..f1c598b8f9d --- /dev/null +++ b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_ecn.patch @@ -0,0 +1,92 @@ +From c2c8649807f70a1bd274c16a31530f22241fcd89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:15:30 -0700 +Subject: tcp: Fix data-races around sysctl_tcp_ecn. + +From: Kuniyuki Iwashima + +[ Upstream commit 4785a66702f086cf2ea84bdbe6ec921f274bd9f2 ] + +While reading sysctl_tcp_ecn, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c | 2 +- + net/ipv4/syncookies.c | 2 +- + net/ipv4/sysctl_net_ipv4.c | 2 ++ + net/ipv4/tcp_input.c | 2 +- + net/ipv4/tcp_output.c | 2 +- + 5 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c +index 4af5561cbfc5..7c760aa65540 100644 +--- a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c ++++ b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c +@@ -1392,7 +1392,7 @@ static void chtls_pass_accept_request(struct sock *sk, + th_ecn = tcph->ece && tcph->cwr; + if (th_ecn) { + ect = !INET_ECN_is_not_ect(ip_dsfield); +- ecn_ok = sock_net(sk)->ipv4.sysctl_tcp_ecn; ++ ecn_ok = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_ecn); + if ((!ect && ecn_ok) || tcp_ca_needs_ecn(sk)) + inet_rsk(oreq)->ecn_ok = 1; + } +diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c +index 10b469aee492..fd1dc86ba512 100644 +--- a/net/ipv4/syncookies.c ++++ b/net/ipv4/syncookies.c +@@ -275,7 +275,7 @@ bool cookie_ecn_ok(const struct tcp_options_received *tcp_opt, + if (!ecn_ok) + return false; + +- if (net->ipv4.sysctl_tcp_ecn) ++ if (READ_ONCE(net->ipv4.sysctl_tcp_ecn)) + return true; + + return dst_feature(dst, RTAX_FEATURE_ECN); +diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c +index 616658e7c796..ead5db7e24ea 100644 +--- a/net/ipv4/sysctl_net_ipv4.c ++++ b/net/ipv4/sysctl_net_ipv4.c +@@ -689,6 +689,8 @@ static struct ctl_table ipv4_net_table[] = { + .maxlen = sizeof(u8), + .mode = 0644, + .proc_handler = proc_dou8vec_minmax, ++ .extra1 = SYSCTL_ZERO, ++ .extra2 = SYSCTL_TWO, + }, + { + .procname = "tcp_ecn_fallback", +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 0ff2f620f8e4..ae06923fe8d0 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -6669,7 +6669,7 @@ static void tcp_ecn_create_request(struct request_sock *req, + + ect = !INET_ECN_is_not_ect(TCP_SKB_CB(skb)->ip_dsfield); + ecn_ok_dst = dst_feature(dst, DST_FEATURE_ECN_MASK); +- ecn_ok = net->ipv4.sysctl_tcp_ecn || ecn_ok_dst; ++ ecn_ok = READ_ONCE(net->ipv4.sysctl_tcp_ecn) || ecn_ok_dst; + + if (((!ect || th->res1) && ecn_ok) || tcp_ca_needs_ecn(listen_sk) || + (ecn_ok_dst & DST_FEATURE_ECN_CA) || +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 509aab1b7ac9..0bd5c334ccce 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -324,7 +324,7 @@ static void tcp_ecn_send_syn(struct sock *sk, struct sk_buff *skb) + { + struct tcp_sock *tp = tcp_sk(sk); + bool bpf_needs_ecn = tcp_bpf_ca_needs_ecn(sk); +- bool use_ecn = sock_net(sk)->ipv4.sysctl_tcp_ecn == 1 || ++ bool use_ecn = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_ecn) == 1 || + tcp_ca_needs_ecn(sk) || bpf_needs_ecn; + + if (!use_ecn) { +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_fastopen.patch b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_fastopen.patch new file mode 100644 index 00000000000..64d8c62c8c6 --- /dev/null +++ b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_fastopen.patch @@ -0,0 +1,85 @@ +From 3e4ae3bc6b044c3bf4b2acc1dbb3268b47824552 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 10:17:54 -0700 +Subject: tcp: Fix data-races around sysctl_tcp_fastopen. + +From: Kuniyuki Iwashima + +[ Upstream commit 5a54213318c43f4009ae158347aa6016e3b9b55a ] + +While reading sysctl_tcp_fastopen, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +Fixes: 2100c8d2d9db ("net-tcp: Fast Open base") +Signed-off-by: Kuniyuki Iwashima +Acked-by: Yuchung Cheng +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/af_inet.c | 2 +- + net/ipv4/tcp.c | 6 ++++-- + net/ipv4/tcp_fastopen.c | 4 ++-- + 3 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c +index 781c595f6880..e4b2ced66261 100644 +--- a/net/ipv4/af_inet.c ++++ b/net/ipv4/af_inet.c +@@ -220,7 +220,7 @@ int inet_listen(struct socket *sock, int backlog) + * because the socket was in TCP_LISTEN state previously but + * was shutdown() rather than close(). + */ +- tcp_fastopen = sock_net(sk)->ipv4.sysctl_tcp_fastopen; ++ tcp_fastopen = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fastopen); + if ((tcp_fastopen & TFO_SERVER_WO_SOCKOPT1) && + (tcp_fastopen & TFO_SERVER_ENABLE) && + !inet_csk(sk)->icsk_accept_queue.fastopenq.max_qlen) { +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index f853f34dfb79..1abdb8712655 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1159,7 +1159,8 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg, + struct sockaddr *uaddr = msg->msg_name; + int err, flags; + +- if (!(sock_net(sk)->ipv4.sysctl_tcp_fastopen & TFO_CLIENT_ENABLE) || ++ if (!(READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fastopen) & ++ TFO_CLIENT_ENABLE) || + (uaddr && msg->msg_namelen >= sizeof(uaddr->sa_family) && + uaddr->sa_family == AF_UNSPEC)) + return -EOPNOTSUPP; +@@ -3626,7 +3627,8 @@ static int do_tcp_setsockopt(struct sock *sk, int level, int optname, + case TCP_FASTOPEN_CONNECT: + if (val > 1 || val < 0) { + err = -EINVAL; +- } else if (net->ipv4.sysctl_tcp_fastopen & TFO_CLIENT_ENABLE) { ++ } else if (READ_ONCE(net->ipv4.sysctl_tcp_fastopen) & ++ TFO_CLIENT_ENABLE) { + if (sk->sk_state == TCP_CLOSE) + tp->fastopen_connect = val; + else +diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c +index 59412d6354a0..936544a4753e 100644 +--- a/net/ipv4/tcp_fastopen.c ++++ b/net/ipv4/tcp_fastopen.c +@@ -338,7 +338,7 @@ static bool tcp_fastopen_no_cookie(const struct sock *sk, + const struct dst_entry *dst, + int flag) + { +- return (sock_net(sk)->ipv4.sysctl_tcp_fastopen & flag) || ++ return (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fastopen) & flag) || + tcp_sk(sk)->fastopen_no_cookie || + (dst && dst_metric(dst, RTAX_FASTOPEN_NO_COOKIE)); + } +@@ -353,7 +353,7 @@ struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb, + const struct dst_entry *dst) + { + bool syn_data = TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq + 1; +- int tcp_fastopen = sock_net(sk)->ipv4.sysctl_tcp_fastopen; ++ int tcp_fastopen = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fastopen); + struct tcp_fastopen_cookie valid_foc = { .len = -1 }; + struct sock *child; + int ret = 0; +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_fastopen_blackh.patch b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_fastopen_blackh.patch new file mode 100644 index 00000000000..8f9e04587f4 --- /dev/null +++ b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_fastopen_blackh.patch @@ -0,0 +1,46 @@ +From d552c1ce6dd580393e9c99c108689dd366f86153 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 10:17:55 -0700 +Subject: tcp: Fix data-races around sysctl_tcp_fastopen_blackhole_timeout. + +From: Kuniyuki Iwashima + +[ Upstream commit 021266ec640c7a4527e6cd4b7349a512b351de1d ] + +While reading sysctl_tcp_fastopen_blackhole_timeout, it can be changed +concurrently. Thus, we need to add READ_ONCE() to its readers. + +Fixes: cf1ef3f0719b ("net/tcp_fastopen: Disable active side TFO in certain scenarios") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_fastopen.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c +index 936544a4753e..6e0a8ef5e816 100644 +--- a/net/ipv4/tcp_fastopen.c ++++ b/net/ipv4/tcp_fastopen.c +@@ -495,7 +495,7 @@ void tcp_fastopen_active_disable(struct sock *sk) + { + struct net *net = sock_net(sk); + +- if (!sock_net(sk)->ipv4.sysctl_tcp_fastopen_blackhole_timeout) ++ if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fastopen_blackhole_timeout)) + return; + + /* Paired with READ_ONCE() in tcp_fastopen_active_should_disable() */ +@@ -516,7 +516,8 @@ void tcp_fastopen_active_disable(struct sock *sk) + */ + bool tcp_fastopen_active_should_disable(struct sock *sk) + { +- unsigned int tfo_bh_timeout = sock_net(sk)->ipv4.sysctl_tcp_fastopen_blackhole_timeout; ++ unsigned int tfo_bh_timeout = ++ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fastopen_blackhole_timeout); + unsigned long timeout; + int tfo_da_times; + int multiplier; +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_l3mdev_accept.patch b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_l3mdev_accept.patch new file mode 100644 index 00000000000..b810a04a809 --- /dev/null +++ b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_l3mdev_accept.patch @@ -0,0 +1,59 @@ +From f4de735e6433e3747951116caa4ff635cff02ff7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 13:51:59 -0700 +Subject: tcp: Fix data-races around sysctl_tcp_l3mdev_accept. + +From: Kuniyuki Iwashima + +[ Upstream commit 08a75f10679470552a3a443f9aefd1399604d31d ] + +While reading sysctl_tcp_l3mdev_accept, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +Fixes: 6dd9a14e92e5 ("net: Allow accepted sockets to be bound to l3mdev domain") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/inet_hashtables.h | 2 +- + include/net/inet_sock.h | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h +index 98e1ec1a14f0..749bb1e46087 100644 +--- a/include/net/inet_hashtables.h ++++ b/include/net/inet_hashtables.h +@@ -207,7 +207,7 @@ static inline bool inet_sk_bound_dev_eq(struct net *net, int bound_dev_if, + int dif, int sdif) + { + #if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV) +- return inet_bound_dev_eq(!!net->ipv4.sysctl_tcp_l3mdev_accept, ++ return inet_bound_dev_eq(!!READ_ONCE(net->ipv4.sysctl_tcp_l3mdev_accept), + bound_dev_if, dif, sdif); + #else + return inet_bound_dev_eq(true, bound_dev_if, dif, sdif); +diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h +index e71827aa2dfb..c307a547d2cb 100644 +--- a/include/net/inet_sock.h ++++ b/include/net/inet_sock.h +@@ -121,7 +121,7 @@ static inline int inet_request_bound_dev_if(const struct sock *sk, + #ifdef CONFIG_NET_L3_MASTER_DEV + struct net *net = sock_net(sk); + +- if (!bound_dev_if && net->ipv4.sysctl_tcp_l3mdev_accept) ++ if (!bound_dev_if && READ_ONCE(net->ipv4.sysctl_tcp_l3mdev_accept)) + return l3mdev_master_ifindex_by_index(net, skb->skb_iif); + #endif + +@@ -133,7 +133,7 @@ static inline int inet_sk_bound_l3mdev(const struct sock *sk) + #ifdef CONFIG_NET_L3_MASTER_DEV + struct net *net = sock_net(sk); + +- if (!net->ipv4.sysctl_tcp_l3mdev_accept) ++ if (!READ_ONCE(net->ipv4.sysctl_tcp_l3mdev_accept)) + return l3mdev_master_ifindex_by_index(net, + sk->sk_bound_dev_if); + #endif +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_max_reordering.patch b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_max_reordering.patch new file mode 100644 index 00000000000..cb68811fde4 --- /dev/null +++ b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_max_reordering.patch @@ -0,0 +1,45 @@ +From c74ebfc3849bf6e7048d3304671675df34f49c67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 10:26:53 -0700 +Subject: tcp: Fix data-races around sysctl_tcp_max_reordering. + +From: Kuniyuki Iwashima + +[ Upstream commit a11e5b3e7a59fde1a90b0eaeaa82320495cf8cae ] + +While reading sysctl_tcp_max_reordering, it can be changed +concurrently. Thus, we need to add READ_ONCE() to its readers. + +Fixes: dca145ffaa8d ("tcp: allow for bigger reordering level") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 6309a4eb3acd..2d21d8bf3b8c 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -1043,7 +1043,7 @@ static void tcp_check_sack_reordering(struct sock *sk, const u32 low_seq, + tp->undo_marker ? tp->undo_retrans : 0); + #endif + tp->reordering = min_t(u32, (metric + mss - 1) / mss, +- sock_net(sk)->ipv4.sysctl_tcp_max_reordering); ++ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_max_reordering)); + } + + /* This exciting event is worth to be remembered. 8) */ +@@ -2022,7 +2022,7 @@ static void tcp_check_reno_reordering(struct sock *sk, const int addend) + return; + + tp->reordering = min_t(u32, tp->packets_out + addend, +- sock_net(sk)->ipv4.sysctl_tcp_max_reordering); ++ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_max_reordering)); + tp->reord_seen++; + NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPRENOREORDER); + } +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_migrate_req.patch b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_migrate_req.patch new file mode 100644 index 00000000000..4e249330b58 --- /dev/null +++ b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_migrate_req.patch @@ -0,0 +1,45 @@ +From 0e47663bf2a4428f1e5f5a4832c4e8ec8351baf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 10:17:48 -0700 +Subject: tcp: Fix data-races around sysctl_tcp_migrate_req. + +From: Kuniyuki Iwashima + +[ Upstream commit 4177f545895b1da08447a80692f30617154efa6e ] + +While reading sysctl_tcp_migrate_req, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +Fixes: f9ac779f881c ("net: Introduce net.ipv4.tcp_migrate_req.") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/sock_reuseport.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c +index 3f00a28fe762..5daa1fa54249 100644 +--- a/net/core/sock_reuseport.c ++++ b/net/core/sock_reuseport.c +@@ -387,7 +387,7 @@ void reuseport_stop_listen_sock(struct sock *sk) + prog = rcu_dereference_protected(reuse->prog, + lockdep_is_held(&reuseport_lock)); + +- if (sock_net(sk)->ipv4.sysctl_tcp_migrate_req || ++ if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_migrate_req) || + (prog && prog->expected_attach_type == BPF_SK_REUSEPORT_SELECT_OR_MIGRATE)) { + /* Migration capable, move sk from the listening section + * to the closed section. +@@ -545,7 +545,7 @@ struct sock *reuseport_migrate_sock(struct sock *sk, + hash = migrating_sk->sk_hash; + prog = rcu_dereference(reuse->prog); + if (!prog || prog->expected_attach_type != BPF_SK_REUSEPORT_SELECT_OR_MIGRATE) { +- if (sock_net(sk)->ipv4.sysctl_tcp_migrate_req) ++ if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_migrate_req)) + goto select_by_hash; + goto failure; + } +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_min_snd_mss.patch b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_min_snd_mss.patch new file mode 100644 index 00000000000..dfa7be2e429 --- /dev/null +++ b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_min_snd_mss.patch @@ -0,0 +1,51 @@ +From 1bed1963fee353ec8c53ccf124a04f691f31b6e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 13:52:02 -0700 +Subject: tcp: Fix data-races around sysctl_tcp_min_snd_mss. + +From: Kuniyuki Iwashima + +[ Upstream commit 78eb166cdefcc3221c8c7c1e2d514e91a2eb5014 ] + +While reading sysctl_tcp_min_snd_mss, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +Fixes: 5f3e2bf008c2 ("tcp: add tcp_min_snd_mss sysctl") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 3 ++- + net/ipv4/tcp_timer.c | 2 +- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 53277a9a2300..b4a8a5b9350f 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -1722,7 +1722,8 @@ static inline int __tcp_mtu_to_mss(struct sock *sk, int pmtu) + mss_now -= icsk->icsk_ext_hdr_len; + + /* Then reserve room for full set of TCP options and 8 bytes of data */ +- mss_now = max(mss_now, sock_net(sk)->ipv4.sysctl_tcp_min_snd_mss); ++ mss_now = max(mss_now, ++ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_min_snd_mss)); + return mss_now; + } + +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index 04063c7e33ba..39107bb730b0 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -173,7 +173,7 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk) + mss = tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_low) >> 1; + mss = min(READ_ONCE(net->ipv4.sysctl_tcp_base_mss), mss); + mss = max(mss, net->ipv4.sysctl_tcp_mtu_probe_floor); +- mss = max(mss, net->ipv4.sysctl_tcp_min_snd_mss); ++ mss = max(mss, READ_ONCE(net->ipv4.sysctl_tcp_min_snd_mss)); + icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, mss); + } + tcp_sync_mss(sk, icsk->icsk_pmtu_cookie); +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_mtu_probing.patch b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_mtu_probing.patch new file mode 100644 index 00000000000..9244176a5ea --- /dev/null +++ b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_mtu_probing.patch @@ -0,0 +1,50 @@ +From 236677cb5015e2a27624a49eab7733932fc08559 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 13:52:00 -0700 +Subject: tcp: Fix data-races around sysctl_tcp_mtu_probing. + +From: Kuniyuki Iwashima + +[ Upstream commit f47d00e077e7d61baf69e46dde3210c886360207 ] + +While reading sysctl_tcp_mtu_probing, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +Fixes: 5d424d5a674f ("[TCP]: MTU probing") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 2 +- + net/ipv4/tcp_timer.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 0bd5c334ccce..1acfd4298a01 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -1765,7 +1765,7 @@ void tcp_mtup_init(struct sock *sk) + struct inet_connection_sock *icsk = inet_csk(sk); + struct net *net = sock_net(sk); + +- icsk->icsk_mtup.enabled = net->ipv4.sysctl_tcp_mtu_probing > 1; ++ icsk->icsk_mtup.enabled = READ_ONCE(net->ipv4.sysctl_tcp_mtu_probing) > 1; + icsk->icsk_mtup.search_high = tp->rx_opt.mss_clamp + sizeof(struct tcphdr) + + icsk->icsk_af_ops->net_header_len; + icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, net->ipv4.sysctl_tcp_base_mss); +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index 20cf4a98c69d..98bb00e29e1e 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -163,7 +163,7 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk) + int mss; + + /* Black hole detection */ +- if (!net->ipv4.sysctl_tcp_mtu_probing) ++ if (!READ_ONCE(net->ipv4.sysctl_tcp_mtu_probing)) + return; + + if (!icsk->icsk_mtup.enabled) { +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_recovery.patch b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_recovery.patch new file mode 100644 index 00000000000..6714d86e16f --- /dev/null +++ b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_recovery.patch @@ -0,0 +1,62 @@ +From 2118a9bec8118d23adc6bf391b9daea108e09628 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 10:26:46 -0700 +Subject: tcp: Fix data-races around sysctl_tcp_recovery. + +From: Kuniyuki Iwashima + +[ Upstream commit e7d2ef837e14a971a05f60ea08c47f3fed1a36e4 ] + +While reading sysctl_tcp_recovery, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +Fixes: 4f41b1c58a32 ("tcp: use RACK to detect losses") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 3 ++- + net/ipv4/tcp_recovery.c | 6 ++++-- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index dd10a317709f..1cc0aca39c04 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -2087,7 +2087,8 @@ static inline void tcp_init_undo(struct tcp_sock *tp) + + static bool tcp_is_rack(const struct sock *sk) + { +- return sock_net(sk)->ipv4.sysctl_tcp_recovery & TCP_RACK_LOSS_DETECTION; ++ return READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_recovery) & ++ TCP_RACK_LOSS_DETECTION; + } + + /* If we detect SACK reneging, forget all SACK information +diff --git a/net/ipv4/tcp_recovery.c b/net/ipv4/tcp_recovery.c +index fd113f6226ef..ac14216f6204 100644 +--- a/net/ipv4/tcp_recovery.c ++++ b/net/ipv4/tcp_recovery.c +@@ -19,7 +19,8 @@ static u32 tcp_rack_reo_wnd(const struct sock *sk) + return 0; + + if (tp->sacked_out >= tp->reordering && +- !(sock_net(sk)->ipv4.sysctl_tcp_recovery & TCP_RACK_NO_DUPTHRESH)) ++ !(READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_recovery) & ++ TCP_RACK_NO_DUPTHRESH)) + return 0; + } + +@@ -192,7 +193,8 @@ void tcp_rack_update_reo_wnd(struct sock *sk, struct rate_sample *rs) + { + struct tcp_sock *tp = tcp_sk(sk); + +- if (sock_net(sk)->ipv4.sysctl_tcp_recovery & TCP_RACK_STATIC_REO_WND || ++ if ((READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_recovery) & ++ TCP_RACK_STATIC_REO_WND) || + !rs->prior_delivered) + return; + +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_reordering.patch b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_reordering.patch new file mode 100644 index 00000000000..84ef203ddb9 --- /dev/null +++ b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_reordering.patch @@ -0,0 +1,89 @@ +From 4b4a9d6043855b61a50a6c6cba716b5e863c030d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 10:17:49 -0700 +Subject: tcp: Fix data-races around sysctl_tcp_reordering. + +From: Kuniyuki Iwashima + +[ Upstream commit 46778cd16e6a5ad1b2e3a91f6c057c907379418e ] + +While reading sysctl_tcp_reordering, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 2 +- + net/ipv4/tcp_input.c | 10 +++++++--- + net/ipv4/tcp_metrics.c | 3 ++- + 3 files changed, 10 insertions(+), 5 deletions(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index e22a61b2ba82..480fac19a074 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -447,7 +447,7 @@ void tcp_init_sock(struct sock *sk) + tp->snd_cwnd_clamp = ~0; + tp->mss_cache = TCP_MSS_DEFAULT; + +- tp->reordering = sock_net(sk)->ipv4.sysctl_tcp_reordering; ++ tp->reordering = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_reordering); + tcp_assign_congestion_control(sk); + + tp->tsoffset = 0; +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 134e36f46e91..06802295e170 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -2131,6 +2131,7 @@ void tcp_enter_loss(struct sock *sk) + struct tcp_sock *tp = tcp_sk(sk); + struct net *net = sock_net(sk); + bool new_recovery = icsk->icsk_ca_state < TCP_CA_Recovery; ++ u8 reordering; + + tcp_timeout_mark_lost(sk); + +@@ -2151,10 +2152,12 @@ void tcp_enter_loss(struct sock *sk) + /* Timeout in disordered state after receiving substantial DUPACKs + * suggests that the degree of reordering is over-estimated. + */ ++ reordering = READ_ONCE(net->ipv4.sysctl_tcp_reordering); + if (icsk->icsk_ca_state <= TCP_CA_Disorder && +- tp->sacked_out >= net->ipv4.sysctl_tcp_reordering) ++ tp->sacked_out >= reordering) + tp->reordering = min_t(unsigned int, tp->reordering, +- net->ipv4.sysctl_tcp_reordering); ++ reordering); ++ + tcp_set_ca_state(sk, TCP_CA_Loss); + tp->high_seq = tp->snd_nxt; + tcp_ecn_queue_cwr(tp); +@@ -3457,7 +3460,8 @@ static inline bool tcp_may_raise_cwnd(const struct sock *sk, const int flag) + * new SACK or ECE mark may first advance cwnd here and later reduce + * cwnd in tcp_fastretrans_alert() based on more states. + */ +- if (tcp_sk(sk)->reordering > sock_net(sk)->ipv4.sysctl_tcp_reordering) ++ if (tcp_sk(sk)->reordering > ++ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_reordering)) + return flag & FLAG_FORWARD_PROGRESS; + + return flag & FLAG_DATA_ACKED; +diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c +index 7029b0e98edb..a501150deaa3 100644 +--- a/net/ipv4/tcp_metrics.c ++++ b/net/ipv4/tcp_metrics.c +@@ -428,7 +428,8 @@ void tcp_update_metrics(struct sock *sk) + if (!tcp_metric_locked(tm, TCP_METRIC_REORDERING)) { + val = tcp_metric_get(tm, TCP_METRIC_REORDERING); + if (val < tp->reordering && +- tp->reordering != net->ipv4.sysctl_tcp_reordering) ++ tp->reordering != ++ READ_ONCE(net->ipv4.sysctl_tcp_reordering)) + tcp_metric_set(tm, TCP_METRIC_REORDERING, + tp->reordering); + } +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_slow_start_afte.patch b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_slow_start_afte.patch new file mode 100644 index 00000000000..744f7f9c1d0 --- /dev/null +++ b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_slow_start_afte.patch @@ -0,0 +1,52 @@ +From ce2d2acdb8b708858a4189d600a41cf5287832a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 10:26:48 -0700 +Subject: tcp: Fix data-races around sysctl_tcp_slow_start_after_idle. + +From: Kuniyuki Iwashima + +[ Upstream commit 4845b5713ab18a1bb6e31d1fbb4d600240b8b691 ] + +While reading sysctl_tcp_slow_start_after_idle, it can be changed +concurrently. Thus, we need to add READ_ONCE() to its readers. + +Fixes: 35089bb203f4 ("[TCP]: Add tcp_slow_start_after_idle sysctl.") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 4 ++-- + net/ipv4/tcp_output.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 0c609d10c320..8ce8aafeef0f 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1390,8 +1390,8 @@ static inline void tcp_slow_start_after_idle_check(struct sock *sk) + struct tcp_sock *tp = tcp_sk(sk); + s32 delta; + +- if (!sock_net(sk)->ipv4.sysctl_tcp_slow_start_after_idle || tp->packets_out || +- ca_ops->cong_control) ++ if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_slow_start_after_idle) || ++ tp->packets_out || ca_ops->cong_control) + return; + delta = tcp_jiffies32 - tp->lsndtime; + if (delta > inet_csk(sk)->icsk_rto) +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 3b71d8735995..94f7841f7bfb 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -1901,7 +1901,7 @@ static void tcp_cwnd_validate(struct sock *sk, bool is_cwnd_limited) + if (tp->packets_out > tp->snd_cwnd_used) + tp->snd_cwnd_used = tp->packets_out; + +- if (sock_net(sk)->ipv4.sysctl_tcp_slow_start_after_idle && ++ if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_slow_start_after_idle) && + (s32)(tcp_jiffies32 - tp->snd_cwnd_stamp) >= inet_csk(sk)->icsk_rto && + !ca_ops->cong_control) + tcp_cwnd_application_limited(sk); +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_syn-ack-_retrie.patch b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_syn-ack-_retrie.patch new file mode 100644 index 00000000000..2ad5d47ef12 --- /dev/null +++ b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_syn-ack-_retrie.patch @@ -0,0 +1,85 @@ +From fe29c1b76a50752636c8fd43a04f1d30239c7bda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 10:17:46 -0700 +Subject: tcp: Fix data-races around sysctl_tcp_syn(ack)?_retries. + +From: Kuniyuki Iwashima + +[ Upstream commit 20a3b1c0f603e8c55c3396abd12dfcfb523e4d3c ] + +While reading sysctl_tcp_syn(ack)?_retries, they can be changed +concurrently. Thus, we need to add READ_ONCE() to their readers. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/inet_connection_sock.c | 3 ++- + net/ipv4/tcp.c | 3 ++- + net/ipv4/tcp_timer.c | 10 +++++++--- + 3 files changed, 11 insertions(+), 5 deletions(-) + +diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c +index d3bbb344bbe1..a53f9bf7886f 100644 +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -829,7 +829,8 @@ static void reqsk_timer_handler(struct timer_list *t) + + icsk = inet_csk(sk_listener); + net = sock_net(sk_listener); +- max_syn_ack_retries = icsk->icsk_syn_retries ? : net->ipv4.sysctl_tcp_synack_retries; ++ max_syn_ack_retries = icsk->icsk_syn_retries ? : ++ READ_ONCE(net->ipv4.sysctl_tcp_synack_retries); + /* Normally all the openreqs are young and become mature + * (i.e. converted to established socket) for first timeout. + * If synack was not acknowledged for 1 second, it means +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 4ac53c8f0583..e22a61b2ba82 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3974,7 +3974,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level, + val = keepalive_probes(tp); + break; + case TCP_SYNCNT: +- val = icsk->icsk_syn_retries ? : net->ipv4.sysctl_tcp_syn_retries; ++ val = icsk->icsk_syn_retries ? : ++ READ_ONCE(net->ipv4.sysctl_tcp_syn_retries); + break; + case TCP_LINGER2: + val = tp->linger2; +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index 4f3b9ab222b6..a234704e8163 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -239,7 +239,8 @@ static int tcp_write_timeout(struct sock *sk) + if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) { + if (icsk->icsk_retransmits) + __dst_negative_advice(sk); +- retry_until = icsk->icsk_syn_retries ? : net->ipv4.sysctl_tcp_syn_retries; ++ retry_until = icsk->icsk_syn_retries ? : ++ READ_ONCE(net->ipv4.sysctl_tcp_syn_retries); + expired = icsk->icsk_retransmits >= retry_until; + } else { + if (retransmits_timed_out(sk, net->ipv4.sysctl_tcp_retries1, 0)) { +@@ -406,12 +407,15 @@ abort: tcp_write_err(sk); + static void tcp_fastopen_synack_timer(struct sock *sk, struct request_sock *req) + { + struct inet_connection_sock *icsk = inet_csk(sk); +- int max_retries = icsk->icsk_syn_retries ? : +- sock_net(sk)->ipv4.sysctl_tcp_synack_retries + 1; /* add one more retry for fastopen */ + struct tcp_sock *tp = tcp_sk(sk); ++ int max_retries; + + req->rsk_ops->syn_ack_timeout(req); + ++ /* add one more retry for fastopen */ ++ max_retries = icsk->icsk_syn_retries ? : ++ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_synack_retries) + 1; ++ + if (req->num_timeout >= max_retries) { + tcp_write_err(sk); + return; +-- +2.35.1 + diff --git a/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_syncookies.patch b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_syncookies.patch new file mode 100644 index 00000000000..675f88a36c7 --- /dev/null +++ b/queue-5.15/tcp-fix-data-races-around-sysctl_tcp_syncookies.patch @@ -0,0 +1,143 @@ +From eaff1fb294e6e51878714c79f1950416c7d9390b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 10:17:47 -0700 +Subject: tcp: Fix data-races around sysctl_tcp_syncookies. + +From: Kuniyuki Iwashima + +[ Upstream commit f2e383b5bb6bbc60a0b94b87b3e49a2b1aefd11e ] + +While reading sysctl_tcp_syncookies, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its readers. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 4 ++-- + net/ipv4/syncookies.c | 3 ++- + net/ipv4/tcp_input.c | 20 ++++++++++++-------- + net/ipv6/syncookies.c | 3 ++- + 4 files changed, 18 insertions(+), 12 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 8b2bc855714b..ac64395611ae 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -6734,7 +6734,7 @@ BPF_CALL_5(bpf_tcp_check_syncookie, struct sock *, sk, void *, iph, u32, iph_len + if (sk->sk_protocol != IPPROTO_TCP || sk->sk_state != TCP_LISTEN) + return -EINVAL; + +- if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies) ++ if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies)) + return -EINVAL; + + if (!th->ack || th->rst || th->syn) +@@ -6809,7 +6809,7 @@ BPF_CALL_5(bpf_tcp_gen_syncookie, struct sock *, sk, void *, iph, u32, iph_len, + if (sk->sk_protocol != IPPROTO_TCP || sk->sk_state != TCP_LISTEN) + return -EINVAL; + +- if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies) ++ if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies)) + return -ENOENT; + + if (!th->syn || th->ack || th->fin || th->rst) +diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c +index fd1dc86ba512..8eee771d2aca 100644 +--- a/net/ipv4/syncookies.c ++++ b/net/ipv4/syncookies.c +@@ -342,7 +342,8 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb) + struct flowi4 fl4; + u32 tsoff = 0; + +- if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies || !th->ack || th->rst) ++ if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies) || ++ !th->ack || th->rst) + goto out; + + if (tcp_synq_no_recent_overflow(sk)) +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index ae06923fe8d0..134e36f46e91 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -6735,11 +6735,14 @@ static bool tcp_syn_flood_action(const struct sock *sk, const char *proto) + { + struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue; + const char *msg = "Dropping request"; +- bool want_cookie = false; + struct net *net = sock_net(sk); ++ bool want_cookie = false; ++ u8 syncookies; ++ ++ syncookies = READ_ONCE(net->ipv4.sysctl_tcp_syncookies); + + #ifdef CONFIG_SYN_COOKIES +- if (net->ipv4.sysctl_tcp_syncookies) { ++ if (syncookies) { + msg = "Sending cookies"; + want_cookie = true; + __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPREQQFULLDOCOOKIES); +@@ -6747,8 +6750,7 @@ static bool tcp_syn_flood_action(const struct sock *sk, const char *proto) + #endif + __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPREQQFULLDROP); + +- if (!queue->synflood_warned && +- net->ipv4.sysctl_tcp_syncookies != 2 && ++ if (!queue->synflood_warned && syncookies != 2 && + xchg(&queue->synflood_warned, 1) == 0) + net_info_ratelimited("%s: Possible SYN flooding on port %d. %s. Check SNMP counters.\n", + proto, sk->sk_num, msg); +@@ -6797,7 +6799,7 @@ u16 tcp_get_syncookie_mss(struct request_sock_ops *rsk_ops, + struct tcp_sock *tp = tcp_sk(sk); + u16 mss; + +- if (sock_net(sk)->ipv4.sysctl_tcp_syncookies != 2 && ++ if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies) != 2 && + !inet_csk_reqsk_queue_is_full(sk)) + return 0; + +@@ -6831,13 +6833,15 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, + bool want_cookie = false; + struct dst_entry *dst; + struct flowi fl; ++ u8 syncookies; ++ ++ syncookies = READ_ONCE(net->ipv4.sysctl_tcp_syncookies); + + /* TW buckets are converted to open requests without + * limitations, they conserve resources and peer is + * evidently real one. + */ +- if ((net->ipv4.sysctl_tcp_syncookies == 2 || +- inet_csk_reqsk_queue_is_full(sk)) && !isn) { ++ if ((syncookies == 2 || inet_csk_reqsk_queue_is_full(sk)) && !isn) { + want_cookie = tcp_syn_flood_action(sk, rsk_ops->slab_name); + if (!want_cookie) + goto drop; +@@ -6887,7 +6891,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, + + if (!want_cookie && !isn) { + /* Kill the following clause, if you dislike this way. */ +- if (!net->ipv4.sysctl_tcp_syncookies && ++ if (!syncookies && + (net->ipv4.sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) < + (net->ipv4.sysctl_max_syn_backlog >> 2)) && + !tcp_peer_is_proven(req, dst)) { +diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c +index ca92dd6981de..12ae817aaf2e 100644 +--- a/net/ipv6/syncookies.c ++++ b/net/ipv6/syncookies.c +@@ -141,7 +141,8 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb) + __u8 rcv_wscale; + u32 tsoff = 0; + +- if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies || !th->ack || th->rst) ++ if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies) || ++ !th->ack || th->rst) + goto out; + + if (tcp_synq_no_recent_overflow(sk)) +-- +2.35.1 + diff --git a/queue-5.15/tcp-sk-sk_bound_dev_if-once-in-inet_request_bound_de.patch b/queue-5.15/tcp-sk-sk_bound_dev_if-once-in-inet_request_bound_de.patch new file mode 100644 index 00000000000..446d154bd54 --- /dev/null +++ b/queue-5.15/tcp-sk-sk_bound_dev_if-once-in-inet_request_bound_de.patch @@ -0,0 +1,46 @@ +From ec14fd5a27d4da72bbdc6ec890d75c299a1c363f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 May 2022 11:55:43 -0700 +Subject: tcp: sk->sk_bound_dev_if once in inet_request_bound_dev_if() + +From: Eric Dumazet + +[ Upstream commit fdb5fd7f736ec7ae9fb36d2842ea6d9ebc4e7269 ] + +inet_request_bound_dev_if() reads sk->sk_bound_dev_if twice +while listener socket is not locked. + +Another cpu could change this field under us. + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/inet_sock.h | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h +index 33344d54ad65..e71827aa2dfb 100644 +--- a/include/net/inet_sock.h ++++ b/include/net/inet_sock.h +@@ -117,14 +117,15 @@ static inline u32 inet_request_mark(const struct sock *sk, struct sk_buff *skb) + static inline int inet_request_bound_dev_if(const struct sock *sk, + struct sk_buff *skb) + { ++ int bound_dev_if = READ_ONCE(sk->sk_bound_dev_if); + #ifdef CONFIG_NET_L3_MASTER_DEV + struct net *net = sock_net(sk); + +- if (!sk->sk_bound_dev_if && net->ipv4.sysctl_tcp_l3mdev_accept) ++ if (!bound_dev_if && net->ipv4.sysctl_tcp_l3mdev_accept) + return l3mdev_master_ifindex_by_index(net, skb->skb_iif); + #endif + +- return sk->sk_bound_dev_if; ++ return bound_dev_if; + } + + static inline int inet_sk_bound_l3mdev(const struct sock *sk) +-- +2.35.1 + diff --git a/queue-5.15/udp-fix-a-data-race-around-sysctl_udp_l3mdev_accept.patch b/queue-5.15/udp-fix-a-data-race-around-sysctl_udp_l3mdev_accept.patch new file mode 100644 index 00000000000..00894b3a439 --- /dev/null +++ b/queue-5.15/udp-fix-a-data-race-around-sysctl_udp_l3mdev_accept.patch @@ -0,0 +1,36 @@ +From c19f172020f6f6c2d678b62537d79290f33bf305 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 10:26:43 -0700 +Subject: udp: Fix a data-race around sysctl_udp_l3mdev_accept. + +From: Kuniyuki Iwashima + +[ Upstream commit 3d72bb4188c708bb16758c60822fc4dda7a95174 ] + +While reading sysctl_udp_l3mdev_accept, it can be changed concurrently. +Thus, we need to add READ_ONCE() to its reader. + +Fixes: 63a6fff353d0 ("net: Avoid receiving packets with an l3mdev on unbound UDP sockets") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/udp.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/net/udp.h b/include/net/udp.h +index 909ecf447e0f..438b1b01a56c 100644 +--- a/include/net/udp.h ++++ b/include/net/udp.h +@@ -262,7 +262,7 @@ static inline bool udp_sk_bound_dev_eq(struct net *net, int bound_dev_if, + int dif, int sdif) + { + #if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV) +- return inet_bound_dev_eq(!!net->ipv4.sysctl_udp_l3mdev_accept, ++ return inet_bound_dev_eq(!!READ_ONCE(net->ipv4.sysctl_udp_l3mdev_accept), + bound_dev_if, dif, sdif); + #else + return inet_bound_dev_eq(true, bound_dev_if, dif, sdif); +-- +2.35.1 + diff --git a/queue-5.15/xfrm-xfrm_policy-fix-a-possible-double-xfrm_pols_put.patch b/queue-5.15/xfrm-xfrm_policy-fix-a-possible-double-xfrm_pols_put.patch new file mode 100644 index 00000000000..d470edc856b --- /dev/null +++ b/queue-5.15/xfrm-xfrm_policy-fix-a-possible-double-xfrm_pols_put.patch @@ -0,0 +1,58 @@ +From a7154fd08b1e49dba2cc3289e51ed3405bfec6f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jun 2022 14:46:25 +0800 +Subject: xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in + xfrm_bundle_lookup() + +From: Hangyu Hua + +[ Upstream commit f85daf0e725358be78dfd208dea5fd665d8cb901 ] + +xfrm_policy_lookup() will call xfrm_pol_hold_rcu() to get a refcount of +pols[0]. This refcount can be dropped in xfrm_expand_policies() when +xfrm_expand_policies() return error. pols[0]'s refcount is balanced in +here. But xfrm_bundle_lookup() will also call xfrm_pols_put() with +num_pols == 1 to drop this refcount when xfrm_expand_policies() return +error. + +This patch also fix an illegal address access. pols[0] will save a error +point when xfrm_policy_lookup fails. This lead to xfrm_pols_put to resolve +an illegal address in xfrm_bundle_lookup's error path. + +Fix these by setting num_pols = 0 in xfrm_expand_policies()'s error path. + +Fixes: 80c802f3073e ("xfrm: cache bundles instead of policies for outgoing flows") +Signed-off-by: Hangyu Hua +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_policy.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index a6271b955e11..fb198f9490a0 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -2678,8 +2678,10 @@ static int xfrm_expand_policies(const struct flowi *fl, u16 family, + *num_xfrms = 0; + return 0; + } +- if (IS_ERR(pols[0])) ++ if (IS_ERR(pols[0])) { ++ *num_pols = 0; + return PTR_ERR(pols[0]); ++ } + + *num_xfrms = pols[0]->xfrm_nr; + +@@ -2694,6 +2696,7 @@ static int xfrm_expand_policies(const struct flowi *fl, u16 family, + if (pols[1]) { + if (IS_ERR(pols[1])) { + xfrm_pols_put(pols, *num_pols); ++ *num_pols = 0; + return PTR_ERR(pols[1]); + } + (*num_pols)++; +-- +2.35.1 + -- 2.47.3