diff --git a/blacklist.conf b/blacklist.conf index 9af67cd..b897242 100644 --- a/blacklist.conf +++ b/blacklist.conf @@ -1767,3 +1767,7 @@ bc93b9ae0151ae5ad5b8504cdc598428ea99570b # Breaks kABI f51778db088b2407ec177f2f4da0f6290602aa3f # Compile fix only 0107973a80adad5b73232d3fbcd26f710ab1f851 # breaks kABI, needed for SEV which is not supported in 15SP1 a268e0f2455c32653140775662b40c2b1f1b2efa # fixes only CONFIG_PROC_FS=n +c8d647a326f06a39a8e5f0f1af946eacfa1835f8 # driver is not in 4.12 +412055398b9e67e07347a936fc4a6adddabe9cf4 # minor bug, major kabi breakage +d5aa6b22e2258f05317313ecc02efbb988ed6d38 # minor bug, major kabi breakage +078000d02d57f02dde61de4901f289672e98c8bc # multiple complex dependencies, minor bug diff --git a/patches.kabi/kABI-Fix-kABI-for-extended-APIC-ID-support.patch b/patches.kabi/kABI-Fix-kABI-for-extended-APIC-ID-support.patch new file mode 100644 index 0000000..9549be4 --- /dev/null +++ b/patches.kabi/kABI-Fix-kABI-for-extended-APIC-ID-support.patch @@ -0,0 +1,32 @@ +From: Joerg Roedel +Date: Fri, 22 Jan 2021 16:56:17 +0100 +Subject: [PATCH] kABI: Fix kABI for extended APIC-ID support +Patch-mainline: Never, kABI fix +References: bsc#1181001, jsc#ECO-3191 + +Signed-off-by: Joerg Roedel +--- + arch/x86/include/asm/io_apic.h | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/include/asm/io_apic.h b/arch/x86/include/asm/io_apic.h +index 31bd718748c3..4f642bc3cc00 100644 +--- a/arch/x86/include/asm/io_apic.h ++++ b/arch/x86/include/asm/io_apic.h +@@ -76,9 +76,12 @@ struct IO_APIC_route_entry { + trigger : 1, /* 0: edge, 1: level */ + mask : 1, /* 0: enabled, 1: disabled */ + __reserved_2 : 15; +- ++#ifndef __GENKSYMS__ + __u32 __reserved_3 : 17, + ext_dest : 7, ++#else ++ __u32 __reserved_3 : 24, ++#endif + dest : 8; + } __attribute__ ((packed)); + +-- +2.25.0 + diff --git a/patches.rt/0194-rtmutex-Handle-the-various-new-futex-race-conditions.patch b/patches.rt/0194-rtmutex-Handle-the-various-new-futex-race-conditions.patch index c677f33..c28764d 100644 --- a/patches.rt/0194-rtmutex-Handle-the-various-new-futex-race-conditions.patch +++ b/patches.rt/0194-rtmutex-Handle-the-various-new-futex-race-conditions.patch @@ -20,7 +20,7 @@ Signed-off-by: Mike Galbraith --- a/kernel/futex.c +++ b/kernel/futex.c -@@ -2137,6 +2137,16 @@ retry_private: +@@ -2147,6 +2147,16 @@ retry_private: */ requeue_pi_wake_futex(this, &key2, hb2); continue; @@ -37,16 +37,16 @@ Signed-off-by: Mike Galbraith } else if (ret) { /* * rt_mutex_start_proxy_lock() detected a -@@ -3170,7 +3180,7 @@ static int futex_wait_requeue_pi(u32 __u +@@ -3202,7 +3212,7 @@ static int futex_wait_requeue_pi(u32 __u + { struct hrtimer_sleeper timeout, *to = NULL; - struct futex_pi_state *pi_state = NULL; struct rt_mutex_waiter rt_waiter; - struct futex_hash_bucket *hb; + struct futex_hash_bucket *hb, *hb2; union futex_key key2 = FUTEX_KEY_INIT; struct futex_q q = futex_q_init; int res, ret; -@@ -3226,20 +3236,55 @@ static int futex_wait_requeue_pi(u32 __u +@@ -3258,20 +3268,55 @@ static int futex_wait_requeue_pi(u32 __u /* Queue the futex_q, drop the hb lock, wait for wakeup. */ futex_wait_queue_me(hb, &q, to); @@ -113,7 +113,7 @@ Signed-off-by: Mike Galbraith /* Check if the requeue code acquired the second futex for us. */ if (!q.rt_waiter) { -@@ -3248,7 +3293,8 @@ static int futex_wait_requeue_pi(u32 __u +@@ -3280,14 +3325,15 @@ static int futex_wait_requeue_pi(u32 __u * did a lock-steal - fix up the PI-state in that case. */ if (q.pi_state && (q.pi_state->owner != current)) { @@ -121,18 +121,17 @@ Signed-off-by: Mike Galbraith + spin_lock(&hb2->lock); + BUG_ON(&hb2->lock != q.lock_ptr); ret = fixup_pi_state_owner(uaddr2, &q, current); - if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current) { - pi_state = q.pi_state; -@@ -3259,7 +3305,7 @@ static int futex_wait_requeue_pi(u32 __u + /* + * Drop the reference to the pi state which * the requeue_pi() code acquired for us. */ put_pi_state(q.pi_state); - spin_unlock(q.lock_ptr); + spin_unlock(&hb2->lock); - } - } else { - struct rt_mutex *pi_mutex; -@@ -3273,7 +3319,8 @@ static int futex_wait_requeue_pi(u32 __u + /* + * Adjust the return value. It's either -EFAULT or + * success (1) but the caller expects 0 for success. +@@ -3306,7 +3352,8 @@ static int futex_wait_requeue_pi(u32 __u pi_mutex = &q.pi_state->pi_mutex; ret = rt_mutex_wait_proxy_lock(pi_mutex, to, &rt_waiter); diff --git a/patches.rt/0206-rt-Add-the-preempt-rt-lock-replacement-APIs.patch b/patches.rt/0206-rt-Add-the-preempt-rt-lock-replacement-APIs.patch index e7461a4..9ae225d 100644 --- a/patches.rt/0206-rt-Add-the-preempt-rt-lock-replacement-APIs.patch +++ b/patches.rt/0206-rt-Add-the-preempt-rt-lock-replacement-APIs.patch @@ -1001,7 +1001,7 @@ Signed-off-by: Mike Galbraith +#endif --- a/kernel/futex.c +++ b/kernel/futex.c -@@ -1430,6 +1430,7 @@ static int wake_futex_pi(u32 __user *uad +@@ -1494,6 +1494,7 @@ static int wake_futex_pi(u32 __user *uad struct task_struct *new_owner; bool postunlock = false; DEFINE_WAKE_Q(wake_q); @@ -1009,14 +1009,15 @@ Signed-off-by: Mike Galbraith int ret = 0; new_owner = rt_mutex_next_owner(&pi_state->pi_mutex); -@@ -1491,13 +1492,13 @@ static int wake_futex_pi(u32 __user *uad - pi_state->owner = new_owner; - raw_spin_unlock(&new_owner->pi_lock); +@@ -1543,14 +1544,15 @@ static int wake_futex_pi(u32 __user *uad + * not fail. + */ + pi_state_update_owner(pi_state, new_owner); +- postunlock = __rt_mutex_futex_unlock(&pi_state->pi_mutex, &wake_q); ++ postunlock = __rt_mutex_futex_unlock(&pi_state->pi_mutex, &wake_q, ++ &wake_sleeper_q); + } -- postunlock = __rt_mutex_futex_unlock(&pi_state->pi_mutex, &wake_q); -- -+ postunlock = __rt_mutex_futex_unlock(&pi_state->pi_mutex, &wake_q, -+ &wake_sleeper_q); out_unlock: raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock); @@ -1026,7 +1027,7 @@ Signed-off-by: Mike Galbraith return ret; } -@@ -2799,7 +2800,7 @@ retry_private: +@@ -2866,7 +2868,7 @@ retry_private: goto no_block; } @@ -1035,7 +1036,7 @@ Signed-off-by: Mike Galbraith /* * On PREEMPT_RT_FULL, when hb->lock becomes an rt_mutex, we must not -@@ -3166,7 +3167,7 @@ static int futex_wait_requeue_pi(u32 __u +@@ -3239,7 +3241,7 @@ static int futex_wait_requeue_pi(u32 __u * The waiter is allocated on our stack, manipulated by the requeue * code while we sleep on uaddr. */ @@ -2371,7 +2372,7 @@ Signed-off-by: Mike Galbraith debug_rt_mutex_proxy_lock(lock, proxy_owner); rt_mutex_set_owner(lock, proxy_owner); } -@@ -1952,3 +2376,25 @@ bool rt_mutex_cleanup_proxy_lock(struct +@@ -1978,3 +2402,25 @@ bool rt_mutex_cleanup_proxy_lock(struct return cleanup; } @@ -2415,16 +2416,16 @@ Signed-off-by: Mike Galbraith #ifdef CONFIG_DEBUG_RT_MUTEXES unsigned long ip; struct pid *deadlock_task_pid; -@@ -107,7 +109,7 @@ extern void rt_mutex_init_proxy_locked(s +@@ -106,7 +108,7 @@ extern struct task_struct *rt_mutex_next + extern void rt_mutex_init_proxy_locked(struct rt_mutex *lock, struct task_struct *proxy_owner); - extern void rt_mutex_proxy_unlock(struct rt_mutex *lock, - struct task_struct *proxy_owner); + extern void rt_mutex_proxy_unlock(struct rt_mutex *lock); -extern void rt_mutex_init_waiter(struct rt_mutex_waiter *waiter); +extern void rt_mutex_init_waiter(struct rt_mutex_waiter *waiter, bool savetate); extern int __rt_mutex_start_proxy_lock(struct rt_mutex *lock, struct rt_mutex_waiter *waiter, struct task_struct *task); -@@ -125,9 +127,11 @@ extern int __rt_mutex_futex_trylock(stru +@@ -124,9 +126,11 @@ extern int __rt_mutex_futex_trylock(stru extern void rt_mutex_futex_unlock(struct rt_mutex *lock); extern bool __rt_mutex_futex_unlock(struct rt_mutex *lock, diff --git a/patches.suse/0001-locking-futex-Allow-low-level-atomic-operations-to-r.patch b/patches.suse/0001-locking-futex-Allow-low-level-atomic-operations-to-r.patch new file mode 100644 index 0000000..bf84aa5 --- /dev/null +++ b/patches.suse/0001-locking-futex-Allow-low-level-atomic-operations-to-r.patch @@ -0,0 +1,345 @@ +From 6b4f4bc9cb22875f97023984a625386f0c7cc1c0 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Thu, 28 Feb 2019 11:58:08 +0000 +Subject: [PATCH] locking/futex: Allow low-level atomic operations to return -EAGAIN +Git-commit: 6b4f4bc9cb22875f97023984a625386f0c7cc1c0 +Patch-mainline: v5.2-rc1 +References: bsc#1149032 + +Some futex() operations, including FUTEX_WAKE_OP, require the kernel to +perform an atomic read-modify-write of the futex word via the userspace +mapping. These operations are implemented by each architecture in +arch_futex_atomic_op_inuser() and futex_atomic_cmpxchg_inatomic(), which +are called in atomic context with the relevant hash bucket locks held. + +Although these routines may return -EFAULT in response to a page fault +generated when accessing userspace, they are expected to succeed (i.e. +return 0) in all other cases. This poses a problem for architectures +that do not provide bounded forward progress guarantees or fairness of +contended atomic operations and can lead to starvation in some cases. + +In these problematic scenarios, we must return back to the core futex +code so that we can drop the hash bucket locks and reschedule if +necessary, much like we do in the case of a page fault. + +Allow architectures to return -EAGAIN from their implementations of +arch_futex_atomic_op_inuser() and futex_atomic_cmpxchg_inatomic(), which +will cause the core futex code to reschedule if necessary and return +back to the architecture code later on. + +Cc: +Acked-by: Peter Zijlstra (Intel) +Signed-off-by: Will Deacon +Signed-off-by: Davidlohr Bueso + +--- + kernel/futex.c | 188 ++++++++++++++++++++++++++++++------------------- + 1 file changed, 117 insertions(+), 71 deletions(-) + +diff --git a/kernel/futex.c b/kernel/futex.c +index a8bf2077854d..88e21334e209 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -1306,13 +1306,15 @@ static int lookup_pi_state(u32 __user *uaddr, u32 uval, + + static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval) + { ++ int err; + u32 uninitialized_var(curval); + + if (unlikely(should_fail_futex(true))) + return -EFAULT; + +- if (unlikely(cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))) +- return -EFAULT; ++ err = cmpxchg_futex_value_locked(&curval, uaddr, uval, newval); ++ if (unlikely(err)) ++ return err; + + /* If user space value changed, let the caller retry */ + return curval != uval ? -EAGAIN : 0; +@@ -1497,10 +1499,8 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_pi_state *pi_ + if (unlikely(should_fail_futex(true))) + ret = -EFAULT; + +- if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)) { +- ret = -EFAULT; +- +- } else if (curval != uval) { ++ ret = cmpxchg_futex_value_locked(&curval, uaddr, uval, newval); ++ if (!ret && (curval != uval)) { + /* + * If a unconditional UNLOCK_PI operation (user space did not + * try the TID->0 transition) raced with a waiter setting the +@@ -1695,32 +1695,32 @@ futex_wake_op(u32 __user *uaddr1, unsigned int flags, u32 __user *uaddr2, + double_lock_hb(hb1, hb2); + op_ret = futex_atomic_op_inuser(op, uaddr2); + if (unlikely(op_ret < 0)) { +- + double_unlock_hb(hb1, hb2); + +-#ifndef CONFIG_MMU +- /* +- * we don't get EFAULT from MMU faults if we don't have an MMU, +- * but we might get them from range checking +- */ +- ret = op_ret; +- goto out_put_keys; +-#endif +- +- if (unlikely(op_ret != -EFAULT)) { ++ if (!IS_ENABLED(CONFIG_MMU) || ++ unlikely(op_ret != -EFAULT && op_ret != -EAGAIN)) { ++ /* ++ * we don't get EFAULT from MMU faults if we don't have ++ * an MMU, but we might get them from range checking ++ */ + ret = op_ret; + goto out_put_keys; + } + +- ret = fault_in_user_writeable(uaddr2); +- if (ret) +- goto out_put_keys; ++ if (op_ret == -EFAULT) { ++ ret = fault_in_user_writeable(uaddr2); ++ if (ret) ++ goto out_put_keys; ++ } + +- if (!(flags & FLAGS_SHARED)) ++ if (!(flags & FLAGS_SHARED)) { ++ cond_resched(); + goto retry_private; ++ } + + put_futex_key(&key2); + put_futex_key(&key1); ++ cond_resched(); + goto retry; + } + +@@ -2326,7 +2326,7 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, + u32 uval, uninitialized_var(curval), newval; + struct task_struct *oldowner, *newowner; + u32 newtid; +- int ret; ++ int ret, err = 0; + + lockdep_assert_held(q->lock_ptr); + +@@ -2397,14 +2397,17 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, + if (!pi_state->owner) + newtid |= FUTEX_OWNER_DIED; + +- if (get_futex_value_locked(&uval, uaddr)) +- goto handle_fault; ++ err = get_futex_value_locked(&uval, uaddr); ++ if (err) ++ goto handle_err; + + for (;;) { + newval = (uval & FUTEX_OWNER_DIED) | newtid; + +- if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)) +- goto handle_fault; ++ err = cmpxchg_futex_value_locked(&curval, uaddr, uval, newval); ++ if (err) ++ goto handle_err; ++ + if (curval == uval) + break; + uval = curval; +@@ -2432,23 +2435,37 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, + return 0; + + /* +- * To handle the page fault we need to drop the locks here. That gives +- * the other task (either the highest priority waiter itself or the +- * task which stole the rtmutex) the chance to try the fixup of the +- * pi_state. So once we are back from handling the fault we need to +- * check the pi_state after reacquiring the locks and before trying to +- * do another fixup. When the fixup has been done already we simply +- * return. ++ * In order to reschedule or handle a page fault, we need to drop the ++ * locks here. In the case of a fault, this gives the other task ++ * (either the highest priority waiter itself or the task which stole ++ * the rtmutex) the chance to try the fixup of the pi_state. So once we ++ * are back from handling the fault we need to check the pi_state after ++ * reacquiring the locks and before trying to do another fixup. When ++ * the fixup has been done already we simply return. + * + * Note: we hold both hb->lock and pi_mutex->wait_lock. We can safely + * drop hb->lock since the caller owns the hb -> futex_q relation. + * Dropping the pi_mutex->wait_lock requires the state revalidate. + */ +-handle_fault: ++handle_err: + raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock); + spin_unlock(q->lock_ptr); + +- ret = fault_in_user_writeable(uaddr); ++ switch (err) { ++ case -EFAULT: ++ ret = fault_in_user_writeable(uaddr); ++ break; ++ ++ case -EAGAIN: ++ cond_resched(); ++ ret = 0; ++ break; ++ ++ default: ++ WARN_ON_ONCE(1); ++ ret = err; ++ break; ++ } + + spin_lock(q->lock_ptr); + raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock); +@@ -3011,10 +3028,8 @@ static int futex_unlock_pi(u32 __user *uaddr, unsigned int flags) + * A unconditional UNLOCK_PI op raced against a waiter + * setting the FUTEX_WAITERS bit. Try again. + */ +- if (ret == -EAGAIN) { +- put_futex_key(&key); +- goto retry; +- } ++ if (ret == -EAGAIN) ++ goto pi_retry; + /* + * wake_futex_pi has detected invalid state. Tell user + * space. +@@ -3029,9 +3044,19 @@ static int futex_unlock_pi(u32 __user *uaddr, unsigned int flags) + * preserve the WAITERS bit not the OWNER_DIED one. We are the + * owner. + */ +- if (cmpxchg_futex_value_locked(&curval, uaddr, uval, 0)) { ++ if ((ret = cmpxchg_futex_value_locked(&curval, uaddr, uval, 0))) { + spin_unlock(&hb->lock); +- goto pi_faulted; ++ switch (ret) { ++ case -EFAULT: ++ goto pi_faulted; ++ ++ case -EAGAIN: ++ goto pi_retry; ++ ++ default: ++ WARN_ON_ONCE(1); ++ goto out_putkey; ++ } + } + + /* +@@ -3045,6 +3070,11 @@ static int futex_unlock_pi(u32 __user *uaddr, unsigned int flags) + put_futex_key(&key); + return ret; + ++pi_retry: ++ put_futex_key(&key); ++ cond_resched(); ++ goto retry; ++ + pi_faulted: + put_futex_key(&key); + +@@ -3402,6 +3432,7 @@ SYSCALL_DEFINE3(get_robust_list, int, pid, + int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi) + { + u32 uval, uninitialized_var(nval), mval; ++ int err; + + /* Futex address must be 32bit aligned */ + if ((((unsigned long)uaddr) % sizeof(*uaddr)) != 0) +@@ -3411,42 +3442,57 @@ int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi) + if (get_user(uval, uaddr)) + return -1; + +- if ((uval & FUTEX_TID_MASK) == task_pid_vnr(curr)) { +- /* +- * Ok, this dying thread is truly holding a futex +- * of interest. Set the OWNER_DIED bit atomically +- * via cmpxchg, and if the value had FUTEX_WAITERS +- * set, wake up a waiter (if any). (We have to do a +- * futex_wake() even if OWNER_DIED is already set - +- * to handle the rare but possible case of recursive +- * thread-death.) The rest of the cleanup is done in +- * userspace. +- */ +- mval = (uval & FUTEX_WAITERS) | FUTEX_OWNER_DIED; +- /* +- * We are not holding a lock here, but we want to have +- * the pagefault_disable/enable() protection because +- * we want to handle the fault gracefully. If the +- * access fails we try to fault in the futex with R/W +- * verification via get_user_pages. get_user() above +- * does not guarantee R/W access. If that fails we +- * give up and leave the futex locked. +- */ +- if (cmpxchg_futex_value_locked(&nval, uaddr, uval, mval)) { ++ if ((uval & FUTEX_TID_MASK) != task_pid_vnr(curr)) ++ return 0; ++ ++ /* ++ * Ok, this dying thread is truly holding a futex ++ * of interest. Set the OWNER_DIED bit atomically ++ * via cmpxchg, and if the value had FUTEX_WAITERS ++ * set, wake up a waiter (if any). (We have to do a ++ * futex_wake() even if OWNER_DIED is already set - ++ * to handle the rare but possible case of recursive ++ * thread-death.) The rest of the cleanup is done in ++ * userspace. ++ */ ++ mval = (uval & FUTEX_WAITERS) | FUTEX_OWNER_DIED; ++ ++ /* ++ * We are not holding a lock here, but we want to have ++ * the pagefault_disable/enable() protection because ++ * we want to handle the fault gracefully. If the ++ * access fails we try to fault in the futex with R/W ++ * verification via get_user_pages. get_user() above ++ * does not guarantee R/W access. If that fails we ++ * give up and leave the futex locked. ++ */ ++ if ((err = cmpxchg_futex_value_locked(&nval, uaddr, uval, mval))) { ++ switch (err) { ++ case -EFAULT: + if (fault_in_user_writeable(uaddr)) + return -1; + goto retry; +- } +- if (nval != uval) ++ ++ case -EAGAIN: ++ cond_resched(); + goto retry; + +- /* +- * Wake robust non-PI futexes here. The wakeup of +- * PI futexes happens in exit_pi_state(): +- */ +- if (!pi && (uval & FUTEX_WAITERS)) +- futex_wake(uaddr, 1, 1, FUTEX_BITSET_MATCH_ANY); ++ default: ++ WARN_ON_ONCE(1); ++ return err; ++ } + } ++ ++ if (nval != uval) ++ goto retry; ++ ++ /* ++ * Wake robust non-PI futexes here. The wakeup of ++ * PI futexes happens in exit_pi_state(): ++ */ ++ if (!pi && (uval & FUTEX_WAITERS)) ++ futex_wake(uaddr, 1, 1, FUTEX_BITSET_MATCH_ANY); ++ + return 0; + } + +-- +2.26.2 + diff --git a/patches.suse/0001-net-freescale-fec-Fix-ethtool-d-runtime-PM.patch b/patches.suse/0001-net-freescale-fec-Fix-ethtool-d-runtime-PM.patch new file mode 100644 index 0000000..9864a32 --- /dev/null +++ b/patches.suse/0001-net-freescale-fec-Fix-ethtool-d-runtime-PM.patch @@ -0,0 +1,53 @@ +From d486c0413dc675952297a358696322265dd92bf6 Mon Sep 17 00:00:00 2001 +From: Andrew Lunn +Date: Thu, 2 Jan 2020 15:33:34 +0100 +Subject: [PATCH 01/16] net: freescale: fec: Fix ethtool -d runtime PM +Git-commit: c72a0bc0aa19f49160330a65ab77184b5b7d131b +Patch-mainline: v5.5-rc6 +References: git-fixes + +In order to dump the FECs registers the clocks have to be ticking, +otherwise a data abort occurs. Add calls to runtime PM so they are +enabled and later disabled. + +Fixes: e8fcfcd5684a ("net: fec: optimize the clock management to save power") +Reported-by: Chris Healy +Signed-off-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/freescale/fec_main.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index cdadf7fc5834..fa1223a0265e 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -2182,8 +2182,14 @@ static void fec_enet_get_regs(struct net_device *ndev, + { + struct fec_enet_private *fep = netdev_priv(ndev); + u32 __iomem *theregs = (u32 __iomem *)fep->hwp; ++ struct device *dev = &fep->pdev->dev; + u32 *buf = (u32 *)regbuf; + u32 i, off; ++ int ret; ++ ++ ret = pm_runtime_get_sync(dev); ++ if (ret < 0) ++ return; + + memset(buf, 0, regs->len); + +@@ -2197,6 +2203,9 @@ static void fec_enet_get_regs(struct net_device *ndev, + off >>= 2; + buf[off] = readl(&theregs[off]); + } ++ ++ pm_runtime_mark_last_busy(dev); ++ pm_runtime_put_autosuspend(dev); + } + + static int fec_enet_get_ts_info(struct net_device *ndev, +-- +2.16.4 + diff --git a/patches.suse/0001-x86-apic-Fix-x2apic-enablement-without-interrupt-rem.patch b/patches.suse/0001-x86-apic-Fix-x2apic-enablement-without-interrupt-rem.patch new file mode 100644 index 0000000..b7e0f7d --- /dev/null +++ b/patches.suse/0001-x86-apic-Fix-x2apic-enablement-without-interrupt-rem.patch @@ -0,0 +1,99 @@ +From: David Woodhouse +Date: Wed, 7 Oct 2020 13:20:42 +0100 +Subject: [PATCH 1/5] x86/apic: Fix x2apic enablement without interrupt + remapping +Patch-mainline: Never, upstream uses different implementation +References: bsc#1181001, jsc#ECO-3191 + +Currently, Linux as a hypervisor guest will enable x2apic only if there +are no CPUs present at boot time with an APIC ID above 255. + +Hotplugging a CPU later with a higher APIC ID would result in a CPU +which cannot be targeted by external interrupts. + +Add a filter in x2apic_apic_id_valid() which can be used to prevent +such CPUs from coming online, and allow x2apic to be enabled even if +they are present at boot time. + +Fixes: ce69a784504 ("x86/apic: Enable x2APIC without interrupt remapping under KVM") +Signed-off-by: David Woodhouse +Acked-by: Joerg Roedel +--- + arch/x86/include/asm/apic.h | 1 + + arch/x86/include/asm/x2apic.h | 5 +++++ + arch/x86/kernel/apic/apic.c | 14 ++++++++------ + arch/x86/kernel/apic/x2apic_phys.c | 6 ++++++ + 4 files changed, 20 insertions(+), 6 deletions(-) + +--- a/arch/x86/include/asm/apic.h ++++ b/arch/x86/include/asm/apic.h +@@ -235,6 +235,7 @@ static inline u64 native_x2apic_icr_read + + extern int x2apic_mode; + extern int x2apic_phys; ++extern void __init x2apic_set_max_apicid(u32 apicid); + extern void __init check_x2apic(void); + extern void x2apic_setup(void); + static inline int x2apic_enabled(void) +--- a/arch/x86/include/asm/x2apic.h ++++ b/arch/x86/include/asm/x2apic.h +@@ -9,8 +9,13 @@ + #include + #include + ++extern u32 x2apic_max_apicid; ++ + static int x2apic_apic_id_valid(int apicid) + { ++ if (x2apic_max_apicid && apicid > x2apic_max_apicid) ++ return 0; ++ + return 1; + } + +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -1580,20 +1580,22 @@ static __init void try_to_enable_x2apic( + return; + + if (remap_mode != IRQ_REMAP_X2APIC_MODE) { +- /* IR is required if there is APIC ID > 255 even when running +- * under KVM ++ /* ++ * Using X2APIC without IR is not architecturally supported ++ * on bare metal but may be supported in guests. + */ +- if (max_physical_apicid > 255 || +- !x86_init.hyper.x2apic_available()) { ++ if (!x86_init.hyper.x2apic_available()) { + pr_info("x2apic: IRQ remapping doesn't support X2APIC mode\n"); + x2apic_disable(); + return; + } + + /* +- * without IR all CPUs can be addressed by IOAPIC/MSI +- * only in physical mode ++ * Without IR, all CPUs can be addressed by IOAPIC/MSI only ++ * in physical mode, and CPUs with an APIC ID that cannnot ++ * be addressed must not be brought online. + */ ++ x2apic_set_max_apicid(255); + x2apic_phys = 1; + } + x2apic_enable(); +--- a/arch/x86/kernel/apic/x2apic_phys.c ++++ b/arch/x86/kernel/apic/x2apic_phys.c +@@ -11,6 +11,12 @@ + int x2apic_phys; + + static struct apic apic_x2apic_phys; ++u32 x2apic_max_apicid; ++ ++void __init x2apic_set_max_apicid(u32 apicid) ++{ ++ x2apic_max_apicid = apicid; ++} + + static int set_x2apic_phys_mode(char *arg) + { diff --git a/patches.suse/0002-mlxsw-spectrum-Do-not-modify-cloned-SKBs-during-xmit.patch b/patches.suse/0002-mlxsw-spectrum-Do-not-modify-cloned-SKBs-during-xmit.patch new file mode 100644 index 0000000..c46b4f6 --- /dev/null +++ b/patches.suse/0002-mlxsw-spectrum-Do-not-modify-cloned-SKBs-during-xmit.patch @@ -0,0 +1,85 @@ +From 760f4b07705da24d295bd5226091cbf82b16e5e4 Mon Sep 17 00:00:00 2001 +From: Ido Schimmel +Date: Wed, 15 Jan 2020 13:53:45 +0200 +Subject: [PATCH 02/16] mlxsw: spectrum: Do not modify cloned SKBs during xmit +Git-commit: 2da51ce75d86ab1f7770ac1391a9a1697ddaa60c +Patch-mainline: v5.5-rc7 +References: git-fixes + +The driver needs to prepend a Tx header to each packet it is +transmitting. The header includes information such as the egress port +and traffic class. + +The addition of the header requires the driver to modify the SKB's +header and therefore it must not be shared. Otherwise, we risk hitting +various race conditions. + +For example, when a packet is flooded (cloned) by the bridge driver to +two switch ports swp1 and swp2: + +t0 - mlxsw_sp_port_xmit() is called for swp1. Tx header is prepended with + swp1's port number +t1 - mlxsw_sp_port_xmit() is called for swp2. Tx header is prepended with + swp2's port number, overwriting swp1's port number +t2 - The device processes data buffer from t0. Packet is transmitted via + swp2 +t3 - The device processes data buffer from t1. Packet is transmitted via + swp2 + +Usually, the device is fast enough and transmits the packet before its +Tx header is overwritten, but this is not the case in emulated +environments. + +Fix this by making sure the SKB's header is writable by calling +skb_cow_head(). Since the function ensures we have headroom to push the +Tx header, the check further in the function can be removed. + +v2: +* Use skb_cow_head() instead of skb_unshare() as suggested by Jakub +* Remove unnecessary check regarding headroom + +Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC") +Signed-off-by: Ido Schimmel +Reported-by: Shalom Toledo +Acked-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 18 ++++++------------ + 1 file changed, 6 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +index 7a67c1f3c579..2406a1e5580a 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +@@ -721,21 +721,15 @@ static netdev_tx_t mlxsw_sp_port_xmit(struct sk_buff *skb, + u64 len; + int err; + ++ if (skb_cow_head(skb, MLXSW_TXHDR_LEN)) { ++ this_cpu_inc(mlxsw_sp_port->pcpu_stats->tx_dropped); ++ dev_kfree_skb_any(skb); ++ return NETDEV_TX_OK; ++ } ++ + if (mlxsw_core_skb_transmit_busy(mlxsw_sp->core, &tx_info)) + return NETDEV_TX_BUSY; + +- if (unlikely(skb_headroom(skb) < MLXSW_TXHDR_LEN)) { +- struct sk_buff *skb_orig = skb; +- +- skb = skb_realloc_headroom(skb, MLXSW_TXHDR_LEN); +- if (!skb) { +- this_cpu_inc(mlxsw_sp_port->pcpu_stats->tx_dropped); +- dev_kfree_skb_any(skb_orig); +- return NETDEV_TX_OK; +- } +- dev_consume_skb_any(skb_orig); +- } +- + if (eth_skb_pad(skb)) { + this_cpu_inc(mlxsw_sp_port->pcpu_stats->tx_dropped); + return NETDEV_TX_OK; +-- +2.16.4 + diff --git a/patches.suse/0002-x86-msi-Only-use-high-bits-of-MSI-address-for-DMAR-u.patch b/patches.suse/0002-x86-msi-Only-use-high-bits-of-MSI-address-for-DMAR-u.patch new file mode 100644 index 0000000..18cf172 --- /dev/null +++ b/patches.suse/0002-x86-msi-Only-use-high-bits-of-MSI-address-for-DMAR-u.patch @@ -0,0 +1,97 @@ +From: David Woodhouse +Date: Wed, 7 Oct 2020 13:20:43 +0100 +Subject: [PATCH 2/5] x86/msi: Only use high bits of MSI address for DMAR unit +Patch-mainline: Never, upstream uses different implementation +References: bsc#1181001, jsc#ECO-3191 + +The Intel IOMMU has an MSI-like configuration for its interrupt, but +it isn't really MSI. So it gets to abuse the high 32 bits of the address, +and puts the high 24 bits of the extended APIC ID there. + +This isn't something that can be used in the general case for real MSIs, +since external devices using the high bits of the address would be +performing writes to actual memory space above 4GiB, not targeted at the +APIC. + +Factor the hack out and allow it only to be used when appropriate, +adding a WARN_ON_ONCE() if other MSIs are targeted at an unreachable +APIC ID. In *theory* that should never happen since the compatibility +MSI messages are not supposed to be used with Interrupt Remapping +enabled. In practice, if IR is enabled but some devices aren't within +scope of any given remapping unit, it might happen. But that's a longer +story and this warning is the right thing to do in that case for the +short term. + +The x2apic_enabled() check isn't needed because Linux won't bring up +CPUs with higher APIC IDs unless x2apic is enabled anyway. + +Signed-off-by: David Woodhouse +Acked-by: Joerg Roedel +--- + arch/x86/kernel/apic/msi.c | 36 +++++++++++++++++++++++++++++++----- + 1 file changed, 31 insertions(+), 5 deletions(-) + +--- a/arch/x86/kernel/apic/msi.c ++++ b/arch/x86/kernel/apic/msi.c +@@ -25,15 +25,13 @@ + + static struct irq_domain *msi_default_domain; + +-static void irq_msi_compose_msg(struct irq_data *data, struct msi_msg *msg) ++static void __irq_msi_compose_msg(struct irq_data *data, struct msi_msg *msg, ++ bool dmar) + { + struct irq_cfg *cfg = irqd_cfg(data); + + msg->address_hi = MSI_ADDR_BASE_HI; + +- if (x2apic_enabled()) +- msg->address_hi |= MSI_ADDR_EXT_DEST_ID(cfg->dest_apicid); +- + msg->address_lo = + MSI_ADDR_BASE_LO | + ((apic->irq_dest_mode == 0) ? +@@ -51,6 +49,34 @@ static void irq_msi_compose_msg(struct i + MSI_DATA_DELIVERY_FIXED : + MSI_DATA_DELIVERY_LOWPRI) | + MSI_DATA_VECTOR(cfg->vector); ++ ++ /* ++ * Only the IOMMU itself can use the trick of putting destination ++ * APIC ID into the high bits of the address. Anything else would ++ * just be writing to memory if it tried that, and needs IR to ++ * address higher APIC IDs. ++ */ ++ if (dmar) ++ msg->address_hi |= MSI_ADDR_EXT_DEST_ID(cfg->dest_apicid); ++ else ++ WARN_ON_ONCE(MSI_ADDR_EXT_DEST_ID(cfg->dest_apicid)); ++} ++ ++static void irq_msi_compose_msg(struct irq_data *data, struct msi_msg *msg) ++{ ++ __irq_msi_compose_msg(data, msg, false); ++} ++ ++ ++/* ++ * The Intel IOMMU (ab)uses the high bits of the MSI address to contain the ++ * high bits of the destination APIC ID. This can't be done in the general ++ * case for MSIs as it would be targeting real memory above 4GiB not the ++ * APIC. ++ */ ++static void dmar_msi_compose_msg(struct irq_data *data, struct msi_msg *msg) ++{ ++ __irq_msi_compose_msg(data, msg, true); + } + + /* +@@ -186,7 +212,7 @@ static struct irq_chip dmar_msi_controll + .irq_ack = irq_chip_ack_parent, + .irq_set_affinity = msi_domain_set_affinity, + .irq_retrigger = irq_chip_retrigger_hierarchy, +- .irq_compose_msi_msg = irq_msi_compose_msg, ++ .irq_compose_msi_msg = dmar_msi_compose_msg, + .irq_write_msi_msg = dmar_msi_write_msg, + .flags = IRQCHIP_SKIP_SET_WAKE, + }; diff --git a/patches.suse/0003-mlxsw-switchx2-Do-not-modify-cloned-SKBs-during-xmit.patch b/patches.suse/0003-mlxsw-switchx2-Do-not-modify-cloned-SKBs-during-xmit.patch new file mode 100644 index 0000000..0be16dc --- /dev/null +++ b/patches.suse/0003-mlxsw-switchx2-Do-not-modify-cloned-SKBs-during-xmit.patch @@ -0,0 +1,84 @@ +From f0c57bff3f7c7071c44670e3cf5832197f18d471 Mon Sep 17 00:00:00 2001 +From: Ido Schimmel +Date: Wed, 15 Jan 2020 13:53:46 +0200 +Subject: [PATCH 03/16] mlxsw: switchx2: Do not modify cloned SKBs during xmit +Git-commit: 63963d0f9d17be83d0e419e03282847ecc2c3715 +Patch-mainline: v5.5-rc7 +References: git-fixes + +The driver needs to prepend a Tx header to each packet it is +transmitting. The header includes information such as the egress port +and traffic class. + +The addition of the header requires the driver to modify the SKB's +header and therefore it must not be shared. Otherwise, we risk hitting +various race conditions. + +For example, when a packet is flooded (cloned) by the bridge driver to +two switch ports swp1 and swp2: + +t0 - mlxsw_sp_port_xmit() is called for swp1. Tx header is prepended with + swp1's port number +t1 - mlxsw_sp_port_xmit() is called for swp2. Tx header is prepended with + swp2's port number, overwriting swp1's port number +t2 - The device processes data buffer from t0. Packet is transmitted via + swp2 +t3 - The device processes data buffer from t1. Packet is transmitted via + swp2 + +Usually, the device is fast enough and transmits the packet before its +Tx header is overwritten, but this is not the case in emulated +environments. + +Fix this by making sure the SKB's header is writable by calling +skb_cow_head(). Since the function ensures we have headroom to push the +Tx header, the check further in the function can be removed. + +v2: +* Use skb_cow_head() instead of skb_unshare() as suggested by Jakub +* Remove unnecessary check regarding headroom + +Fixes: 31557f0f9755 ("mlxsw: Introduce Mellanox SwitchX-2 ASIC support") +Signed-off-by: Ido Schimmel +Reported-by: Shalom Toledo +Acked-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/mellanox/mlxsw/switchx2.c | 17 ++++++----------- + 1 file changed, 6 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c +index 2d4f213e154d..e0b767f4112f 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c +@@ -300,20 +300,15 @@ static netdev_tx_t mlxsw_sx_port_xmit(struct sk_buff *skb, + u64 len; + int err; + ++ if (skb_cow_head(skb, MLXSW_TXHDR_LEN)) { ++ this_cpu_inc(mlxsw_sx_port->pcpu_stats->tx_dropped); ++ dev_kfree_skb_any(skb); ++ return NETDEV_TX_OK; ++ } ++ + if (mlxsw_core_skb_transmit_busy(mlxsw_sx->core, &tx_info)) + return NETDEV_TX_BUSY; + +- if (unlikely(skb_headroom(skb) < MLXSW_TXHDR_LEN)) { +- struct sk_buff *skb_orig = skb; +- +- skb = skb_realloc_headroom(skb, MLXSW_TXHDR_LEN); +- if (!skb) { +- this_cpu_inc(mlxsw_sx_port->pcpu_stats->tx_dropped); +- dev_kfree_skb_any(skb_orig); +- return NETDEV_TX_OK; +- } +- dev_consume_skb_any(skb_orig); +- } + mlxsw_sx_txhdr_construct(skb, &tx_info); + /* TX header is consumed by HW on the way so we shouldn't count its + * bytes as being sent. +-- +2.16.4 + diff --git a/patches.suse/0003-x86-ioapic-Handle-Extended-Destination-ID-field-in-R.patch b/patches.suse/0003-x86-ioapic-Handle-Extended-Destination-ID-field-in-R.patch new file mode 100644 index 0000000..bc4e5d9 --- /dev/null +++ b/patches.suse/0003-x86-ioapic-Handle-Extended-Destination-ID-field-in-R.patch @@ -0,0 +1,115 @@ +From: David Woodhouse +Date: Wed, 7 Oct 2020 13:20:44 +0100 +Subject: [PATCH 3/5] x86/ioapic: Handle Extended Destination ID field in RTE +Patch-mainline: Never, upstream uses different implementation +References: bsc#1181001, jsc#ECO-3191 + +The IOAPIC Redirection Table Entries contain an 8-bit Extended +Destination ID field which maps to bits 11-4 of the MSI address. + +The lowest bit is used to indicate remappable format, when interrupt +remapping is in use. A hypervisor can use the other 7 bits to permit +guests to address up to 15 bits of APIC IDs, thus allowing 32768 vCPUs +before having to expose a vIOMMU and interrupt remapping to the guest. + +No behavioural change in this patch, since nothing yet permits APIC IDs +above 255 to be used with the non-IR IOAPIC domain. Except for the case +where IR is enabled but there are IOAPICs which aren't in the scope of +any IOMMU, which is totally hosed anyway and needs fixing independently +of this change. + +Signed-off-by: David Woodhouse +Acked-by: Joerg Roedel +--- + arch/x86/include/asm/io_apic.h | 3 ++- + arch/x86/kernel/apic/io_apic.c | 19 +++++++++++++------ + 2 files changed, 15 insertions(+), 7 deletions(-) + +--- a/arch/x86/include/asm/io_apic.h ++++ b/arch/x86/include/asm/io_apic.h +@@ -77,7 +77,8 @@ struct IO_APIC_route_entry { + mask : 1, /* 0: enabled, 1: disabled */ + __reserved_2 : 15; + +- __u32 __reserved_3 : 24, ++ __u32 __reserved_3 : 17, ++ ext_dest : 7, + dest : 8; + } __attribute__ ((packed)); + +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -1268,10 +1268,10 @@ static void io_apic_print_entries(unsign + buf, (ir_entry->index << 15) | ir_entry->index, + ir_entry->zero); + else +- printk(KERN_DEBUG "%s, %s, D(%02X), M(%1d)\n", ++ printk(KERN_DEBUG "%s, %s, D(%02X%02X), M(%1d)\n", + buf, + entry.dest_mode == IOAPIC_DEST_MODE_LOGICAL ? +- "logical " : "physical", ++ "logical " : "physical", entry.ext_dest, + entry.dest, entry.delivery_mode); + } + } +@@ -1439,6 +1439,7 @@ void native_disable_io_apic(void) + */ + if (ioapic_i8259.pin != -1) { + struct IO_APIC_route_entry entry; ++ u32 apic_id = read_apic_id(); + + memset(&entry, 0, sizeof(entry)); + entry.mask = IOAPIC_UNMASKED; +@@ -1446,7 +1447,8 @@ void native_disable_io_apic(void) + entry.polarity = IOAPIC_POL_HIGH; + entry.dest_mode = IOAPIC_DEST_MODE_PHYSICAL; + entry.delivery_mode = dest_ExtINT; +- entry.dest = read_apic_id(); ++ entry.dest = apic_id & 0xff; ++ entry.ext_dest = apic_id >> 8; + + /* + * Add it to the IO-APIC irq-routing table: +@@ -1861,7 +1863,8 @@ static int ioapic_set_affinity(struct ir + raw_spin_lock_irqsave(&ioapic_lock, flags); + if (ret >= 0 && ret != IRQ_SET_MASK_OK_DONE) { + cfg = irqd_cfg(irq_data); +- data->entry.dest = cfg->dest_apicid; ++ data->entry.dest = cfg->dest_apicid & 0xff; ++ data->entry.ext_dest = cfg->dest_apicid >> 8; + data->entry.vector = cfg->vector; + for_each_irq_pin(entry, data->irq_2_pin) + __ioapic_write_entry(entry->apic, entry->pin, +@@ -1969,6 +1972,7 @@ static inline void __init unlock_ExtINT_ + int apic, pin, i; + struct IO_APIC_route_entry entry0, entry1; + unsigned char save_control, save_freq_select; ++ u32 apic_id; + + pin = find_isa_irq_pin(8, mp_INT); + if (pin == -1) { +@@ -1984,11 +1988,13 @@ static inline void __init unlock_ExtINT_ + entry0 = ioapic_read_entry(apic, pin); + clear_IO_APIC_pin(apic, pin); + ++ apic_id = hard_smp_processor_id(); + memset(&entry1, 0, sizeof(entry1)); + + entry1.dest_mode = IOAPIC_DEST_MODE_PHYSICAL; + entry1.mask = IOAPIC_UNMASKED; +- entry1.dest = hard_smp_processor_id(); ++ entry1.dest = apic_id & 0xff; ++ entry1.ext_dest = apic_id >> 8; + entry1.delivery_mode = dest_ExtINT; + entry1.polarity = entry0.polarity; + entry1.trigger = IOAPIC_EDGE; +@@ -2896,7 +2902,8 @@ static void mp_setup_entry(struct irq_cf + memset(entry, 0, sizeof(*entry)); + entry->delivery_mode = apic->irq_delivery_mode; + entry->dest_mode = apic->irq_dest_mode; +- entry->dest = cfg->dest_apicid; ++ entry->dest = cfg->dest_apicid & 0xff; ++ entry->ext_dest = cfg->dest_apicid >> 8; + entry->vector = cfg->vector; + entry->trigger = data->trigger; + entry->polarity = data->polarity; diff --git a/patches.suse/0004-net-sonic-Add-mutual-exclusion-for-accessing-shared-.patch b/patches.suse/0004-net-sonic-Add-mutual-exclusion-for-accessing-shared-.patch new file mode 100644 index 0000000..f73caba --- /dev/null +++ b/patches.suse/0004-net-sonic-Add-mutual-exclusion-for-accessing-shared-.patch @@ -0,0 +1,158 @@ +From 27afc00f871e789fdd32460592e7d0a7bcc33673 Mon Sep 17 00:00:00 2001 +From: Finn Thain +Date: Thu, 23 Jan 2020 09:07:26 +1100 +Subject: [PATCH 04/16] net/sonic: Add mutual exclusion for accessing shared + state +Git-commit: 865ad2f2201dc18685ba2686f13217f8b3a9c52c +Patch-mainline: v5.5 +References: git-fixes + +The netif_stop_queue() call in sonic_send_packet() races with the +netif_wake_queue() call in sonic_interrupt(). This causes issues +like "NETDEV WATCHDOG: eth0 (macsonic): transmit queue 0 timed out". +Fix this by disabling interrupts when accessing tx_skb[] and next_tx. +Update a comment to clarify the synchronization properties. + +Fixes: efcce839360f ("[PATCH] macsonic/jazzsonic network drivers update") +Tested-by: Stan Johnson +Signed-off-by: Finn Thain +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/natsemi/sonic.c | 49 +++++++++++++++++++++++++----------- + drivers/net/ethernet/natsemi/sonic.h | 1 + + 2 files changed, 36 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c +index c4fe611b2e43..071cbd3a44cb 100644 +--- a/drivers/net/ethernet/natsemi/sonic.c ++++ b/drivers/net/ethernet/natsemi/sonic.c +@@ -50,6 +50,8 @@ static int sonic_open(struct net_device *dev) + if (sonic_debug > 2) + printk("sonic_open: initializing sonic driver.\n"); + ++ spin_lock_init(&lp->lock); ++ + for (i = 0; i < SONIC_NUM_RRS; i++) { + struct sk_buff *skb = netdev_alloc_skb(dev, SONIC_RBSIZE + 2); + if (skb == NULL) { +@@ -194,8 +196,6 @@ static void sonic_tx_timeout(struct net_device *dev) + * wake the tx queue + * Concurrently with all of this, the SONIC is potentially writing to + * the status flags of the TDs. +- * Until some mutual exclusion is added, this code will not work with SMP. However, +- * MIPS Jazz machines and m68k Macs were all uni-processor machines. + */ + + static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev) +@@ -203,7 +203,8 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev) + struct sonic_local *lp = netdev_priv(dev); + dma_addr_t laddr; + int length; +- int entry = lp->next_tx; ++ int entry; ++ unsigned long flags; + + if (sonic_debug > 2) + printk("sonic_send_packet: skb=%p, dev=%p\n", skb, dev); +@@ -226,6 +227,10 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev) + return NETDEV_TX_OK; + } + ++ spin_lock_irqsave(&lp->lock, flags); ++ ++ entry = lp->next_tx; ++ + sonic_tda_put(dev, entry, SONIC_TD_STATUS, 0); /* clear status */ + sonic_tda_put(dev, entry, SONIC_TD_FRAG_COUNT, 1); /* single fragment */ + sonic_tda_put(dev, entry, SONIC_TD_PKTSIZE, length); /* length of packet */ +@@ -235,10 +240,6 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev) + sonic_tda_put(dev, entry, SONIC_TD_LINK, + sonic_tda_get(dev, entry, SONIC_TD_LINK) | SONIC_EOL); + +- /* +- * Must set tx_skb[entry] only after clearing status, and +- * before clearing EOL and before stopping queue +- */ + wmb(); + lp->tx_len[entry] = length; + lp->tx_laddr[entry] = laddr; +@@ -263,6 +264,8 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev) + + SONIC_WRITE(SONIC_CMD, SONIC_CR_TXP); + ++ spin_unlock_irqrestore(&lp->lock, flags); ++ + return NETDEV_TX_OK; + } + +@@ -275,9 +278,21 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id) + struct net_device *dev = dev_id; + struct sonic_local *lp = netdev_priv(dev); + int status; ++ unsigned long flags; ++ ++ /* The lock has two purposes. Firstly, it synchronizes sonic_interrupt() ++ * with sonic_send_packet() so that the two functions can share state. ++ * Secondly, it makes sonic_interrupt() re-entrant, as that is required ++ * by macsonic which must use two IRQs with different priority levels. ++ */ ++ spin_lock_irqsave(&lp->lock, flags); ++ ++ status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT; ++ if (!status) { ++ spin_unlock_irqrestore(&lp->lock, flags); + +- if (!(status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT)) + return IRQ_NONE; ++ } + + do { + if (status & SONIC_INT_PKTRX) { +@@ -292,11 +307,12 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id) + int td_status; + int freed_some = 0; + +- /* At this point, cur_tx is the index of a TD that is one of: +- * unallocated/freed (status set & tx_skb[entry] clear) +- * allocated and sent (status set & tx_skb[entry] set ) +- * allocated and not yet sent (status clear & tx_skb[entry] set ) +- * still being allocated by sonic_send_packet (status clear & tx_skb[entry] clear) ++ /* The state of a Transmit Descriptor may be inferred ++ * from { tx_skb[entry], td_status } as follows. ++ * { clear, clear } => the TD has never been used ++ * { set, clear } => the TD was handed to SONIC ++ * { set, set } => the TD was handed back ++ * { clear, set } => the TD is available for re-use + */ + + if (sonic_debug > 2) +@@ -398,7 +414,12 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id) + /* load CAM done */ + if (status & SONIC_INT_LCD) + SONIC_WRITE(SONIC_ISR, SONIC_INT_LCD); /* clear the interrupt */ +- } while((status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT)); ++ ++ status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT; ++ } while (status); ++ ++ spin_unlock_irqrestore(&lp->lock, flags); ++ + return IRQ_HANDLED; + } + +diff --git a/drivers/net/ethernet/natsemi/sonic.h b/drivers/net/ethernet/natsemi/sonic.h +index 7b0a8db57af9..414e5391ca8b 100644 +--- a/drivers/net/ethernet/natsemi/sonic.h ++++ b/drivers/net/ethernet/natsemi/sonic.h +@@ -320,6 +320,7 @@ struct sonic_local { + unsigned int next_tx; /* next free TD */ + struct device *device; /* generic device */ + struct net_device_stats stats; ++ spinlock_t lock; + }; + + #define TX_TIMEOUT (3 * HZ) +-- +2.16.4 + diff --git a/patches.suse/0004-x86-apic-Support-15-bits-of-APIC-ID-in-IOAPIC-MSI-wh.patch b/patches.suse/0004-x86-apic-Support-15-bits-of-APIC-ID-in-IOAPIC-MSI-wh.patch new file mode 100644 index 0000000..559b0ae --- /dev/null +++ b/patches.suse/0004-x86-apic-Support-15-bits-of-APIC-ID-in-IOAPIC-MSI-wh.patch @@ -0,0 +1,120 @@ +From: David Woodhouse +Date: Wed, 7 Oct 2020 13:20:45 +0100 +Subject: [PATCH 4/5] x86/apic: Support 15 bits of APIC ID in IOAPIC/MSI where + available +Patch-mainline: Never, upstream uses different implementation +References: bsc#1181001, jsc#ECO-3191 + +Some hypervisors can allow the guest to use the Extended Destination ID +field in the IOAPIC RTE and MSI address to address up to 32768 CPUs. + +Signed-off-by: David Woodhouse +Acked-by: Joerg Roedel +--- + arch/x86/include/asm/mpspec.h | 1 + + arch/x86/include/asm/x86_init.h | 2 ++ + arch/x86/kernel/apic/apic.c | 15 ++++++++++++++- + arch/x86/kernel/apic/msi.c | 9 ++++++++- + arch/x86/kernel/x86_init.c | 1 + + 5 files changed, 26 insertions(+), 2 deletions(-) + +--- a/arch/x86/include/asm/mpspec.h ++++ b/arch/x86/include/asm/mpspec.h +@@ -41,6 +41,7 @@ extern DECLARE_BITMAP(mp_bus_not_pci, MA + extern unsigned int boot_cpu_physical_apicid; + extern u8 boot_cpu_apic_version; + extern unsigned long mp_lapic_addr; ++extern int msi_ext_dest_id; + + #ifdef CONFIG_X86_LOCAL_APIC + extern int smp_found_config; +--- a/arch/x86/include/asm/x86_init.h ++++ b/arch/x86/include/asm/x86_init.h +@@ -117,11 +117,13 @@ struct x86_init_pci { + * struct x86_hyper_init - x86 hypervisor init functions + * @init_platform: platform setup + * @x2apic_available: X2APIC detection ++ * @msi_ext_dest_id: MSI and IOAPIC support 15-bit APIC IDs + * @init_mem_mapping: setup early mappings during init_mem_mapping() + */ + struct x86_hyper_init { + void (*init_platform)(void); + bool (*x2apic_available)(void); ++ bool (*msi_ext_dest_id)(void); + void (*init_mem_mapping)(void); + }; + +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -1576,9 +1576,21 @@ static __init void x2apic_enable(void) + + static __init void try_to_enable_x2apic(int remap_mode) + { ++ u32 apic_limit = 255; ++ + if (x2apic_state == X2APIC_DISABLED) + return; + ++ /* ++ * If the hypervisor supports extended destination ID in IOAPIC ++ * and MSI, that increases the maximum APIC ID that can be used ++ * for non-remapped IRQ domains. ++ */ ++ if (x86_init.hyper.msi_ext_dest_id()) { ++ msi_ext_dest_id = 1; ++ apic_limit = 32767; ++ } ++ + if (remap_mode != IRQ_REMAP_X2APIC_MODE) { + /* + * Using X2APIC without IR is not architecturally supported +@@ -1595,9 +1607,10 @@ static __init void try_to_enable_x2apic( + * in physical mode, and CPUs with an APIC ID that cannnot + * be addressed must not be brought online. + */ +- x2apic_set_max_apicid(255); ++ x2apic_set_max_apicid(apic_limit); + x2apic_phys = 1; + } ++ + x2apic_enable(); + } + +--- a/arch/x86/kernel/apic/msi.c ++++ b/arch/x86/kernel/apic/msi.c +@@ -25,6 +25,8 @@ + + static struct irq_domain *msi_default_domain; + ++int msi_ext_dest_id; ++ + static void __irq_msi_compose_msg(struct irq_data *data, struct msi_msg *msg, + bool dmar) + { +@@ -54,10 +56,15 @@ static void __irq_msi_compose_msg(struct + * Only the IOMMU itself can use the trick of putting destination + * APIC ID into the high bits of the address. Anything else would + * just be writing to memory if it tried that, and needs IR to +- * address higher APIC IDs. ++ * address APICs which can't be addressed in the normal 32-bit ++ * address range at 0xFFExxxxx. That is typically just 8 bits, but ++ * some hypervisors allow the extended destination ID field in bits ++ * 11-5 to be used, giving support for 15 bits of APIC IDs in total. + */ + if (dmar) + msg->address_hi |= MSI_ADDR_EXT_DEST_ID(cfg->dest_apicid); ++ else if (msi_ext_dest_id && cfg->dest_apicid < 0x8000) ++ msg->address_lo |= MSI_ADDR_EXT_DEST_ID(cfg->dest_apicid) >> 3; + else + WARN_ON_ONCE(MSI_ADDR_EXT_DEST_ID(cfg->dest_apicid)); + } +--- a/arch/x86/kernel/x86_init.c ++++ b/arch/x86/kernel/x86_init.c +@@ -87,6 +87,7 @@ struct x86_init_ops x86_init __initdata + .hyper = { + .init_platform = x86_init_noop, + .x2apic_available = bool_x86_init_noop, ++ .msi_ext_dest_id = bool_x86_init_noop, + .init_mem_mapping = x86_init_noop, + }, + }; diff --git a/patches.suse/0005-net-tulip-Adjust-indentation-in-dmfe-uli526x-_init_m.patch b/patches.suse/0005-net-tulip-Adjust-indentation-in-dmfe-uli526x-_init_m.patch new file mode 100644 index 0000000..35aea61 --- /dev/null +++ b/patches.suse/0005-net-tulip-Adjust-indentation-in-dmfe-uli526x-_init_m.patch @@ -0,0 +1,93 @@ +From 7f15444fad9149d61a0277d0fae486678d4a583a Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Mon, 9 Dec 2019 14:16:23 -0700 +Subject: [PATCH 05/16] net: tulip: Adjust indentation in {dmfe, + uli526x}_init_module +Git-commit: fe06bf3d83ef0d92f35a24e03297172e92ce9ce3 +Patch-mainline: v5.6-rc1 +References: git-fixes + +Clang warns: + +../drivers/net/ethernet/dec/tulip/uli526x.c:1812:3: warning: misleading +indentation; statement is not part of the previous 'if' +[-Wmisleading-indentation] + switch (mode) { + ^ +../drivers/net/ethernet/dec/tulip/uli526x.c:1809:2: note: previous +statement is here + if (cr6set) + ^ +1 warning generated. + +../drivers/net/ethernet/dec/tulip/dmfe.c:2217:3: warning: misleading +indentation; statement is not part of the previous 'if' +[-Wmisleading-indentation] + switch(mode) { + ^ +../drivers/net/ethernet/dec/tulip/dmfe.c:2214:2: note: previous +statement is here + if (cr6set) + ^ +1 warning generated. + +This warning occurs because there is a space before the tab on these +lines. Remove them so that the indentation is consistent with the Linux +kernel coding style and clang no longer warns. + +While we are here, adjust the default block in dmfe_init_module to have +a proper break between the label and assignment and add a space between +the switch and opening parentheses to avoid a checkpatch warning. + +Fixes: e1c3e5014040 ("[PATCH] initialisation cleanup for ULI526x-net-driver") +Link: https://github.com/ClangBuiltLinux/linux/issues/795 +Signed-off-by: Nathan Chancellor +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/dec/tulip/dmfe.c | 7 ++++--- + drivers/net/ethernet/dec/tulip/uli526x.c | 4 ++-- + 2 files changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/dec/tulip/dmfe.c b/drivers/net/ethernet/dec/tulip/dmfe.c +index 07e10a45beaa..cd5309668186 100644 +--- a/drivers/net/ethernet/dec/tulip/dmfe.c ++++ b/drivers/net/ethernet/dec/tulip/dmfe.c +@@ -2224,15 +2224,16 @@ static int __init dmfe_init_module(void) + if (cr6set) + dmfe_cr6_user_set = cr6set; + +- switch(mode) { +- case DMFE_10MHF: ++ switch (mode) { ++ case DMFE_10MHF: + case DMFE_100MHF: + case DMFE_10MFD: + case DMFE_100MFD: + case DMFE_1M_HPNA: + dmfe_media_mode = mode; + break; +- default:dmfe_media_mode = DMFE_AUTO; ++ default: ++ dmfe_media_mode = DMFE_AUTO; + break; + } + +diff --git a/drivers/net/ethernet/dec/tulip/uli526x.c b/drivers/net/ethernet/dec/tulip/uli526x.c +index 7fc248efc4ba..9779555eea25 100644 +--- a/drivers/net/ethernet/dec/tulip/uli526x.c ++++ b/drivers/net/ethernet/dec/tulip/uli526x.c +@@ -1819,8 +1819,8 @@ static int __init uli526x_init_module(void) + if (cr6set) + uli526x_cr6_user_set = cr6set; + +- switch (mode) { +- case ULI526X_10MHF: ++ switch (mode) { ++ case ULI526X_10MHF: + case ULI526X_100MHF: + case ULI526X_10MFD: + case ULI526X_100MFD: +-- +2.16.4 + diff --git a/patches.suse/0005-x86-kvm-Add-KVM_FEATURE_MSI_EXT_DEST_ID.patch b/patches.suse/0005-x86-kvm-Add-KVM_FEATURE_MSI_EXT_DEST_ID.patch new file mode 100644 index 0000000..18c9740 --- /dev/null +++ b/patches.suse/0005-x86-kvm-Add-KVM_FEATURE_MSI_EXT_DEST_ID.patch @@ -0,0 +1,39 @@ +From: David Woodhouse +Date: Wed, 7 Oct 2020 13:20:46 +0100 +Subject: [PATCH 5/5] x86/kvm: Add KVM_FEATURE_MSI_EXT_DEST_ID +Patch-mainline: Never, upstream uses different implementation +References: bsc#1181001, jsc#ECO-3191 + +This allows the host to indicate that IOAPIC and MSI emulation supports +15-bit destination IDs, allowing up to 32768 CPUs without interrupt +remapping. + +cf. https://patchwork.kernel.org/patch/11816693/ for qemu + +Signed-off-by: David Woodhouse +Acked-by: Paolo Bonzini +Acked-by: Joerg Roedel +--- + arch/x86/kernel/kvm.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/arch/x86/kernel/kvm.c ++++ b/arch/x86/kernel/kvm.c +@@ -578,11 +578,17 @@ static uint32_t __init kvm_detect(void) + return kvm_cpuid_base(); + } + ++static bool __init kvm_msi_ext_dest_id(void) ++{ ++ return kvm_para_has_feature(KVM_FEATURE_MSI_EXT_DEST_ID); ++} ++ + const __initconst struct hypervisor_x86 x86_hyper_kvm = { + .name = "KVM", + .detect = kvm_detect, + .type = X86_HYPER_KVM, + .init.x2apic_available = kvm_para_available, ++ .init.msi_ext_dest_id = kvm_msi_ext_dest_id, + }; + + static __init int activate_jump_labels(void) diff --git a/patches.suse/0006-net-smc911x-Adjust-indentation-in-smc911x_phy_config.patch b/patches.suse/0006-net-smc911x-Adjust-indentation-in-smc911x_phy_config.patch new file mode 100644 index 0000000..ce04bba --- /dev/null +++ b/patches.suse/0006-net-smc911x-Adjust-indentation-in-smc911x_phy_config.patch @@ -0,0 +1,51 @@ +From 236b3bff99e77d6f468ccd1579e832fd8812ba80 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Mon, 9 Dec 2019 14:50:27 -0700 +Subject: [PATCH 06/16] net: smc911x: Adjust indentation in + smc911x_phy_configure +Git-commit: 5c61e223004b3b5c3f1dd25718e979bc17a3b12d +Patch-mainline: v5.6-rc1 +References: git-fixes + +Clang warns: + +../drivers/net/ethernet/smsc/smc911x.c:939:3: warning: misleading +indentation; statement is not part of the previous 'if' +[-Wmisleading-indentation] + if (!lp->ctl_rfduplx) + ^ +../drivers/net/ethernet/smsc/smc911x.c:936:2: note: previous statement +is here + if (lp->ctl_rspeed != 100) + ^ +1 warning generated. + +This warning occurs because there is a space after the tab on this line. +Remove it so that the indentation is consistent with the Linux kernel +coding style and clang no longer warns. + +Fixes: 0a0c72c9118c ("[PATCH] RE: [PATCH 1/1] net driver: Add support for SMSC LAN911x line of ethernet chips") +Link: https://github.com/ClangBuiltLinux/linux/issues/796 +Signed-off-by: Nathan Chancellor +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/smsc/smc911x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c +index 05157442a980..843cf53db5fa 100644 +--- a/drivers/net/ethernet/smsc/smc911x.c ++++ b/drivers/net/ethernet/smsc/smc911x.c +@@ -947,7 +947,7 @@ static void smc911x_phy_configure(struct work_struct *work) + if (lp->ctl_rspeed != 100) + my_ad_caps &= ~(ADVERTISE_100BASE4|ADVERTISE_100FULL|ADVERTISE_100HALF); + +- if (!lp->ctl_rfduplx) ++ if (!lp->ctl_rfduplx) + my_ad_caps &= ~(ADVERTISE_100FULL|ADVERTISE_10FULL); + + /* Update our Auto-Neg Advertisement Register */ +-- +2.16.4 + diff --git a/patches.suse/0008-net-atlantic-fix-use-after-free-kasan-warn.patch b/patches.suse/0008-net-atlantic-fix-use-after-free-kasan-warn.patch new file mode 100644 index 0000000..ea0fcb1 --- /dev/null +++ b/patches.suse/0008-net-atlantic-fix-use-after-free-kasan-warn.patch @@ -0,0 +1,65 @@ +From 9e5821bd5eb82d0e11b207495d111a1e994ba741 Mon Sep 17 00:00:00 2001 +From: Pavel Belous +Date: Fri, 14 Feb 2020 18:44:55 +0300 +Subject: [PATCH 08/16] net: atlantic: fix use after free kasan warn +Git-commit: a4980919ad6a7be548d499bc5338015e1a9191c6 +Patch-mainline: v5.6-rc3 +References: git-fixes + +skb->len is used to calculate statistics after xmit invocation. + +Under a stress load it may happen that skb will be xmited, +rx interrupt will come and skb will be freed, all before xmit function +is even returned. + +Eventually, skb->len will access unallocated area. + +Moving stats calculation into tx_clean routine. + +Fixes: 018423e90bee ("net: ethernet: aquantia: Add ring support code") +Reported-by: Christophe Vu-Brugier +Signed-off-by: Igor Russkikh +Signed-off-by: Pavel Belous +Signed-off-by: Dmitry Bogdanov +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 3 --- + drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 6 +++++- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +index 723b1106c801..d46f7ba3ec8c 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +@@ -636,9 +636,6 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb) + if (err >= 0) { + if (aq_ring_avail_dx(ring) < AQ_CFG_SKB_FRAGS_MAX + 1) + aq_nic_ndev_queue_stop(self, ring->idx); +- +- ++ring->stats.tx.packets; +- ring->stats.tx.bytes += skb->len; + } + } else { + err = NETDEV_TX_BUSY; +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +index 81e715ffd734..393fc575ca60 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +@@ -121,8 +121,12 @@ void aq_ring_tx_clean(struct aq_ring_s *self) + DMA_TO_DEVICE); + } + +- if (unlikely(buff->is_eop)) ++ if (unlikely(buff->is_eop)) { ++ ++self->stats.rx.packets; ++ self->stats.tx.bytes += buff->skb->len; ++ + dev_kfree_skb_any(buff->skb); ++ } + } + } + +-- +2.16.4 + diff --git a/patches.suse/0009-net-atlantic-fix-potential-error-handling.patch b/patches.suse/0009-net-atlantic-fix-potential-error-handling.patch new file mode 100644 index 0000000..97c5871 --- /dev/null +++ b/patches.suse/0009-net-atlantic-fix-potential-error-handling.patch @@ -0,0 +1,43 @@ +From 8b867ae028b40325bdb866a40b149ad28da43852 Mon Sep 17 00:00:00 2001 +From: Pavel Belous +Date: Fri, 14 Feb 2020 18:44:56 +0300 +Subject: [PATCH 09/16] net: atlantic: fix potential error handling +Git-commit: 380ec5b9af7f0d57dbf6ac067fd9f33cff2fef71 +Patch-mainline: v5.6-rc3 +References: git-fixes + +Code inspection found that in case of mapping error we do return current +'ret' value. But beside error, it is used to count number of descriptors +allocated for the packet. In that case map_skb function could return '1'. + +Changing it to return zero (number of mapped descriptors for skb) + +Fixes: 018423e90bee ("net: ethernet: aquantia: Add ring support code") +Signed-off-by: Pavel Belous +Signed-off-by: Igor Russkikh +Signed-off-by: Dmitry Bogdanov +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +index d46f7ba3ec8c..b3f742723de3 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +@@ -504,8 +504,10 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self, + dx_buff->len, + DMA_TO_DEVICE); + +- if (unlikely(dma_mapping_error(aq_nic_get_dev(self), dx_buff->pa))) ++ if (unlikely(dma_mapping_error(aq_nic_get_dev(self), dx_buff->pa))) { ++ ret = 0; + goto exit; ++ } + + dx_buff->len_pkt = skb->len; + dx_buff->is_sop = 1U; +-- +2.16.4 + diff --git a/patches.suse/0010-net-bcmgenet-keep-MAC-in-reset-until-PHY-is-up.patch b/patches.suse/0010-net-bcmgenet-keep-MAC-in-reset-until-PHY-is-up.patch new file mode 100644 index 0000000..1a94304 --- /dev/null +++ b/patches.suse/0010-net-bcmgenet-keep-MAC-in-reset-until-PHY-is-up.patch @@ -0,0 +1,108 @@ +From 10cac62ce39073d71e9197b654368e9a03937026 Mon Sep 17 00:00:00 2001 +From: Doug Berger +Date: Mon, 16 Mar 2020 14:44:56 -0700 +Subject: [PATCH 10/16] net: bcmgenet: keep MAC in reset until PHY is up +Git-commit: 88f6c8bf1aaed5039923fb4c701cab4d42176275 +Patch-mainline: v5.6 +References: git-fixes + +As noted in commit 28c2d1a7a0bf ("net: bcmgenet: enable loopback +during UniMAC sw_reset") the UniMAC must be clocked at least 5 +cycles while the sw_reset is asserted to ensure a clean reset. + +That commit enabled local loopback to provide an Rx clock from the +GENET sourced Tx clk. However, when connected in MII mode the Tx +clk is sourced by the PHY so if an EPHY is not supplying clocks +(e.g. when the link is down) the UniMAC does not receive the +necessary clocks. + +This commit extends the sw_reset window until the PHY reports that +the link is up thereby ensuring that the clocks are being provided +to the MAC to produce a clean reset. + +One consequence is that if the system attempts to enter a Wake on +LAN suspend state when the PHY link has not been active the MAC +may not have had a chance to initialize cleanly. In this case, we +remove the sw_reset and enable the WoL reception path as normal +with the hope that the PHY will provide the necessary clocks to +drive the WoL blocks if the link becomes active after the system +has entered suspend. + +Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file") +Signed-off-by: Doug Berger +Acked-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 10 ++++------ + drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 6 +++++- + drivers/net/ethernet/broadcom/genet/bcmmii.c | 6 ++++++ + 3 files changed, 15 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index c1eaa99c6fdb..0daa59a02611 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -1886,6 +1886,8 @@ static void umac_enable_set(struct bcmgenet_priv *priv, u32 mask, bool enable) + u32 reg; + + reg = bcmgenet_umac_readl(priv, UMAC_CMD); ++ if (reg & CMD_SW_RESET) ++ return; + if (enable) + reg |= mask; + else +@@ -1905,13 +1907,9 @@ static void reset_umac(struct bcmgenet_priv *priv) + bcmgenet_rbuf_ctrl_set(priv, 0); + udelay(10); + +- /* disable MAC while updating its registers */ +- bcmgenet_umac_writel(priv, 0, UMAC_CMD); +- +- /* issue soft reset with (rg)mii loopback to ensure a stable rxclk */ +- bcmgenet_umac_writel(priv, CMD_SW_RESET | CMD_LCL_LOOP_EN, UMAC_CMD); ++ /* issue soft reset and disable MAC while updating its registers */ ++ bcmgenet_umac_writel(priv, CMD_SW_RESET, UMAC_CMD); + udelay(2); +- bcmgenet_umac_writel(priv, 0, UMAC_CMD); + } + + static void bcmgenet_intr_disable(struct bcmgenet_priv *priv) +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c +index 57582efa362d..b19eef1cc5da 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c +@@ -135,8 +135,12 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv, + return -EINVAL; + } + +- /* disable RX */ ++ /* Can't suspend with WoL if MAC is still in reset */ + reg = bcmgenet_umac_readl(priv, UMAC_CMD); ++ if (reg & CMD_SW_RESET) ++ reg &= ~CMD_SW_RESET; ++ ++ /* disable RX */ + reg &= ~CMD_RX_EN; + bcmgenet_umac_writel(priv, reg, UMAC_CMD); + mdelay(10); +diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c +index c13045f6fb1f..222a446c0265 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c +@@ -150,6 +150,12 @@ void bcmgenet_mii_setup(struct net_device *dev) + CMD_HD_EN | + CMD_RX_PAUSE_IGNORE | CMD_TX_PAUSE_IGNORE); + reg |= cmd_bits; ++ if (reg & CMD_SW_RESET) { ++ reg &= ~CMD_SW_RESET; ++ bcmgenet_umac_writel(priv, reg, UMAC_CMD); ++ udelay(2); ++ reg |= CMD_TX_EN | CMD_RX_EN; ++ } + bcmgenet_umac_writel(priv, reg, UMAC_CMD); + } else { + /* done if nothing has changed */ +-- +2.16.4 + diff --git a/patches.suse/0013-net-liquidio-Delete-non-working-LIQUIDIO_PACKAGE-che.patch b/patches.suse/0013-net-liquidio-Delete-non-working-LIQUIDIO_PACKAGE-che.patch new file mode 100644 index 0000000..15f27da --- /dev/null +++ b/patches.suse/0013-net-liquidio-Delete-non-working-LIQUIDIO_PACKAGE-che.patch @@ -0,0 +1,61 @@ +From 6c2a2452d7c01bf16092f7049152989426ed84e1 Mon Sep 17 00:00:00 2001 +From: Leon Romanovsky +Date: Sun, 1 Mar 2020 16:44:38 +0200 +Subject: [PATCH 13/16] net/liquidio: Delete non-working LIQUIDIO_PACKAGE check +Git-commit: d4bb38156fe60288064d8a3a16d67ad18a9e62f8 +Patch-mainline: v5.7-rc1 +References: git-fixes + +Size of LIQUIDIO_PACKAGE is 0 and it means that checks of package +version never worked, delete dead code. + +Fixes: 3258124534f6 ("liquidio: Consolidate common functionality") +Signed-off-by: Leon Romanovsky +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/cavium/liquidio/liquidio_common.h | 4 +--- + drivers/net/ethernet/cavium/liquidio/octeon_console.c | 10 ++-------- + 2 files changed, 3 insertions(+), 11 deletions(-) + +--- a/drivers/net/ethernet/cavium/liquidio/liquidio_common.h ++++ b/drivers/net/ethernet/cavium/liquidio/liquidio_common.h +@@ -25,15 +25,13 @@ + + #include "octeon_config.h" + +-#define LIQUIDIO_PACKAGE "" + #define LIQUIDIO_BASE_MAJOR_VERSION 1 + #define LIQUIDIO_BASE_MINOR_VERSION 7 + #define LIQUIDIO_BASE_MICRO_VERSION 2 + #define LIQUIDIO_BASE_VERSION __stringify(LIQUIDIO_BASE_MAJOR_VERSION) "." \ + __stringify(LIQUIDIO_BASE_MINOR_VERSION) + #define LIQUIDIO_MICRO_VERSION "." __stringify(LIQUIDIO_BASE_MICRO_VERSION) +-#define LIQUIDIO_VERSION LIQUIDIO_PACKAGE \ +- __stringify(LIQUIDIO_BASE_MAJOR_VERSION) "." \ ++#define LIQUIDIO_VERSION __stringify(LIQUIDIO_BASE_MAJOR_VERSION) "." \ + __stringify(LIQUIDIO_BASE_MINOR_VERSION) \ + "." __stringify(LIQUIDIO_BASE_MICRO_VERSION) + +--- a/drivers/net/ethernet/cavium/liquidio/octeon_console.c ++++ b/drivers/net/ethernet/cavium/liquidio/octeon_console.c +@@ -840,17 +840,11 @@ int octeon_download_firmware(struct octe + return -EINVAL; + } + +- if (strncmp(LIQUIDIO_PACKAGE, h->version, strlen(LIQUIDIO_PACKAGE))) { +- dev_err(&oct->pci_dev->dev, "Unmatched firmware package type. Expected %s, got %s.\n", +- LIQUIDIO_PACKAGE, h->version); +- return -EINVAL; +- } +- +- if (memcmp(LIQUIDIO_BASE_VERSION, h->version + strlen(LIQUIDIO_PACKAGE), ++ if (memcmp(LIQUIDIO_BASE_VERSION, h->version, + strlen(LIQUIDIO_BASE_VERSION))) { + dev_err(&oct->pci_dev->dev, "Unmatched firmware version. Expected %s.x, got %s.\n", + LIQUIDIO_BASE_VERSION, +- h->version + strlen(LIQUIDIO_PACKAGE)); ++ h->version); + return -EINVAL; + } + diff --git a/patches.suse/0015-net-dsa-b53-Lookup-VID-in-ARL-searches-when-VLAN-is-.patch b/patches.suse/0015-net-dsa-b53-Lookup-VID-in-ARL-searches-when-VLAN-is-.patch new file mode 100644 index 0000000..744c9cb --- /dev/null +++ b/patches.suse/0015-net-dsa-b53-Lookup-VID-in-ARL-searches-when-VLAN-is-.patch @@ -0,0 +1,39 @@ +From 35e056596e75b26e7af935c26aacc1de2aa33487 Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Mon, 20 Apr 2020 20:26:51 -0700 +Subject: [PATCH 15/16] net: dsa: b53: Lookup VID in ARL searches when VLAN is + enabled +Git-commit: 2e97b0cd1651a270f3a3fcf42115c51f3284c049 +Patch-mainline: v5.7-rc3 +References: git-fixes + +When VLAN is enabled, and an ARL search is issued, we also need to +compare the full {MAC,VID} tuple before returning a successful search +result. + +Fixes: 1da6df85c6fb ("net: dsa: b53: Implement ARL add/del/dump operations") +Reviewed-by: Andrew Lunn +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/dsa/b53/b53_common.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c +index dbd45608a8a8..ed4c9b742925 100644 +--- a/drivers/net/dsa/b53/b53_common.c ++++ b/drivers/net/dsa/b53/b53_common.c +@@ -1219,6 +1219,9 @@ static int b53_arl_read(struct b53_devic + continue; + if ((mac_vid & ARLTBL_MAC_MASK) != mac) + continue; ++ if (dev->vlan_enabled && ++ ((mac_vid >> ARLTBL_VID_S) & ARLTBL_VID_MASK) != vid) ++ continue; + *idx = i; + } + +-- +2.16.4 + diff --git a/patches.suse/0016-net-dsa-b53-b53_arl_rw_op-needs-to-select-IVL-or-SVL.patch b/patches.suse/0016-net-dsa-b53-b53_arl_rw_op-needs-to-select-IVL-or-SVL.patch new file mode 100644 index 0000000..fe9fb20 --- /dev/null +++ b/patches.suse/0016-net-dsa-b53-b53_arl_rw_op-needs-to-select-IVL-or-SVL.patch @@ -0,0 +1,52 @@ +From ff72d95e8f67d048556e9b1253f98686fb083e3b Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Mon, 20 Apr 2020 20:26:55 -0700 +Subject: [PATCH 16/16] net: dsa: b53: b53_arl_rw_op() needs to select IVL or + SVL +Git-commit: 64fec9493f7dc9bdd7233bcfe98985c45bd0e3c1 +Patch-mainline: v5.7-rc3 +References: git-fixes + +Flip the IVL_SVL_SELECT bit correctly based on the VLAN enable status, +the default is to perform Shared VLAN learning instead of Individual +learning. + +Fixes: 1da6df85c6fb ("net: dsa: b53: Implement ARL add/del/dump operations") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/dsa/b53/b53_common.c | 4 ++++ + drivers/net/dsa/b53/b53_regs.h | 1 + + 2 files changed, 5 insertions(+) + +diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c +index ed4c9b742925..8d00d27c53bb 100644 +--- a/drivers/net/dsa/b53/b53_common.c ++++ b/drivers/net/dsa/b53/b53_common.c +@@ -1189,6 +1189,10 @@ static int b53_arl_rw_op(struct b53_device *dev, unsigned int op) + reg |= ARLTBL_RW; + else + reg &= ~ARLTBL_RW; ++ if (dev->vlan_enabled) ++ reg &= ~ARLTBL_IVL_SVL_SELECT; ++ else ++ reg |= ARLTBL_IVL_SVL_SELECT; + b53_write8(dev, B53_ARLIO_PAGE, B53_ARLTBL_RW_CTRL, reg); + + return b53_arl_op_wait(dev); +diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h +index 247aef92b759..303700680421 100644 +--- a/drivers/net/dsa/b53/b53_regs.h ++++ b/drivers/net/dsa/b53/b53_regs.h +@@ -282,6 +282,7 @@ + /* ARL Table Read/Write Register (8 bit) */ + #define B53_ARLTBL_RW_CTRL 0x00 + #define ARLTBL_RW BIT(0) ++#define ARLTBL_IVL_SVL_SELECT BIT(6) + #define ARLTBL_START_DONE BIT(7) + + /* MAC Address Index Register (48 bit) */ +-- +2.16.4 + diff --git a/patches.suse/4.4.136-002-powerpc-64s-Clear-PCR-on-boot.patch b/patches.suse/4.4.136-002-powerpc-64s-Clear-PCR-on-boot.patch index 53e3e18..7547156 100644 --- a/patches.suse/4.4.136-002-powerpc-64s-Clear-PCR-on-boot.patch +++ b/patches.suse/4.4.136-002-powerpc-64s-Clear-PCR-on-boot.patch @@ -1,3 +1,4 @@ +From faf37c44a105f3608115785f17cbbf3500f8bc71 Mon Sep 17 00:00:00 2001 From: Michael Neuling Date: Fri, 18 May 2018 11:37:42 +1000 Subject: [PATCH] powerpc/64s: Clear PCR on boot @@ -5,8 +6,6 @@ References: bnc#1012382 Patch-mainline: v4.17-rc7 Git-commit: faf37c44a105f3608115785f17cbbf3500f8bc71 -commit faf37c44a105f3608115785f17cbbf3500f8bc71 upstream. - Clear the PCR (Processor Compatibility Register) on boot to ensure we are not running in a compatibility mode. @@ -19,12 +18,14 @@ sigills on newer instructions (seen in libc). Signed-off-by: Michael Neuling Cc: stable@vger.kernel.org Signed-off-by: Michael Ellerman -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: Jiri Slaby +Acked-by: Michal Suchanek --- - arch/powerpc/kernel/cpu_setup_power.S | 4 ++++ - 1 file changed, 4 insertions(+) + arch/powerpc/kernel/cpu_setup_power.S | 6 ++++++ + arch/powerpc/kernel/dt_cpu_ftrs.c | 1 + + 2 files changed, 7 insertions(+) +diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S +index 3f30c994e931..458b928dbd84 100644 --- a/arch/powerpc/kernel/cpu_setup_power.S +++ b/arch/powerpc/kernel/cpu_setup_power.S @@ -28,6 +28,7 @@ _GLOBAL(__setup_cpu_power7) @@ -59,3 +60,34 @@ Signed-off-by: Jiri Slaby mfspr r3,SPRN_LPCR ori r3, r3, LPCR_PECEDH li r4,0 /* LPES = 0 */ +@@ -99,6 +103,7 @@ _GLOBAL(__setup_cpu_power9) + mtspr SPRN_PSSCR,r0 + mtspr SPRN_LPID,r0 + mtspr SPRN_PID,r0 ++ mtspr SPRN_PCR,r0 + mfspr r3,SPRN_LPCR + LOAD_REG_IMMEDIATE(r4, LPCR_PECEDH | LPCR_PECE_HVEE | LPCR_HVICE | LPCR_HEIC) + or r3, r3, r4 +@@ -123,6 +128,7 @@ _GLOBAL(__restore_cpu_power9) + mtspr SPRN_PSSCR,r0 + mtspr SPRN_LPID,r0 + mtspr SPRN_PID,r0 ++ mtspr SPRN_PCR,r0 + mfspr r3,SPRN_LPCR + LOAD_REG_IMMEDIATE(r4, LPCR_PECEDH | LPCR_PECE_HVEE | LPCR_HVICE | LPCR_HEIC) + or r3, r3, r4 +diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c +index 8ab51f6ca03a..c904477abaf3 100644 +--- a/arch/powerpc/kernel/dt_cpu_ftrs.c ++++ b/arch/powerpc/kernel/dt_cpu_ftrs.c +@@ -101,6 +101,7 @@ static void __restore_cpu_cpufeatures(void) + if (hv_mode) { + mtspr(SPRN_LPID, 0); + mtspr(SPRN_HFSCR, system_registers.hfscr); ++ mtspr(SPRN_PCR, 0); + } + mtspr(SPRN_FSCR, system_registers.fscr); + +-- +2.26.2 + diff --git a/patches.suse/ALSA-doc-Fix-reference-to-mixart.rst.patch b/patches.suse/ALSA-doc-Fix-reference-to-mixart.rst.patch new file mode 100644 index 0000000..51e45c0 --- /dev/null +++ b/patches.suse/ALSA-doc-Fix-reference-to-mixart.rst.patch @@ -0,0 +1,40 @@ +From 3e096a2112b7b407549020cf095e2a425f00fabb Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jonathan=20Neusch=C3=A4fer?= +Date: Fri, 1 Jan 2021 23:19:42 +0100 +Subject: [PATCH] ALSA: doc: Fix reference to mixart.rst +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 3e096a2112b7b407549020cf095e2a425f00fabb +Patch-mainline: v5.11-rc4 +References: git-fixes + +MIXART.txt has been converted to ReST and renamed. Fix the reference +in alsa-configuration.rst. + +Fixes: 3d8e81862ce4 ("ALSA: doc: ReSTize MIXART.txt") +Signed-off-by: Jonathan Neuschäfer +Cc: +Link: https://lore.kernel.org/r/20210101221942.1068388-1-j.neuschaefer@gmx.net +Signed-off-by: Takashi Iwai + +--- + Documentation/sound/alsa-configuration.rst | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/sound/alsa-configuration.rst b/Documentation/sound/alsa-configuration.rst +index fe52c314b763..b36af65a08ed 100644 +--- a/Documentation/sound/alsa-configuration.rst ++++ b/Documentation/sound/alsa-configuration.rst +@@ -1501,7 +1501,7 @@ Module for Digigram miXart8 sound cards. + + This module supports multiple cards. + Note: One miXart8 board will be represented as 4 alsa cards. +-See MIXART.txt for details. ++See Documentation/sound/cards/mixart.rst for details. + + When the driver is compiled as a module and the hotplug firmware + is supported, the firmware data is loaded via hotplug automatically. +-- +2.26.2 + diff --git a/patches.suse/ALSA-hda-via-Add-minimum-mute-flag.patch b/patches.suse/ALSA-hda-via-Add-minimum-mute-flag.patch new file mode 100644 index 0000000..9d59749 --- /dev/null +++ b/patches.suse/ALSA-hda-via-Add-minimum-mute-flag.patch @@ -0,0 +1,36 @@ +From 67ea698c3950d10925be33c21ca49ffb64e21842 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 14 Jan 2021 08:24:53 +0100 +Subject: [PATCH] ALSA: hda/via: Add minimum mute flag +Git-commit: 67ea698c3950d10925be33c21ca49ffb64e21842 +Patch-mainline: v5.11-rc5 +References: git-fixes + +It turned out that VIA codecs also mute the sound in the lowest mixer +level. Turn on the dac_min_mute flag to indicate the mute-as-minimum +in TLV like already done in Conexant and IDT codecs. + +Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=210559 +Cc: +Link: https://lore.kernel.org/r/20210114072453.11379-1-tiwai@suse.de +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_via.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c +index 0ab40a8a68fb..834367dd54e1 100644 +--- a/sound/pci/hda/patch_via.c ++++ b/sound/pci/hda/patch_via.c +@@ -113,6 +113,7 @@ static struct via_spec *via_new_spec(struct hda_codec *codec) + spec->codec_type = VT1708S; + spec->gen.indep_hp = 1; + spec->gen.keep_eapd_on = 1; ++ spec->gen.dac_min_mute = 1; + spec->gen.pcm_playback_hook = via_playback_pcm_hook; + spec->gen.add_stereo_mix_input = HDA_HINT_STEREO_MIX_AUTO; + codec->power_save_node = 1; +-- +2.26.2 + diff --git a/patches.suse/ALSA-rawmidi-Fix-racy-buffer-resize-under-concurrent.patch b/patches.suse/ALSA-rawmidi-Fix-racy-buffer-resize-under-concurrent.patch index 3c1e5dc..80e735f 100644 --- a/patches.suse/ALSA-rawmidi-Fix-racy-buffer-resize-under-concurrent.patch +++ b/patches.suse/ALSA-rawmidi-Fix-racy-buffer-resize-under-concurrent.patch @@ -6,8 +6,6 @@ Git-commit: c1f6e3c818dd734c30f6a7eeebf232ba2cf3181d Patch-mainline: v5.7-rc6 References: CVE-2020-27786 bsc#1179601 -[ backport note: kvfree() is replaced with kfree() -- tiwai ] - The rawmidi core allows user to resize the runtime buffer via ioctl, and this may lead to UAF when performed during concurrent reads or Writes: the read/write functions unlock the runtime lock temporarily @@ -48,7 +46,7 @@ Signed-off-by: Takashi Iwai wait_queue_head_t sleep; --- a/sound/core/rawmidi.c +++ b/sound/core/rawmidi.c -@@ -108,6 +108,17 @@ static void snd_rawmidi_input_event_work +@@ -112,6 +112,17 @@ static void snd_rawmidi_input_event_work runtime->event(runtime->substream); } @@ -66,19 +64,19 @@ Signed-off-by: Takashi Iwai static int snd_rawmidi_runtime_create(struct snd_rawmidi_substream *substream) { struct snd_rawmidi_runtime *runtime; -@@ -654,6 +665,11 @@ int snd_rawmidi_output_params(struct snd +@@ -661,6 +672,11 @@ static int resize_runtime_buffer(struct if (!newbuf) return -ENOMEM; spin_lock_irq(&runtime->lock); + if (runtime->buffer_ref) { + spin_unlock_irq(&runtime->lock); -+ kfree(newbuf); ++ kvfree(newbuf); + return -EBUSY; + } oldbuf = runtime->buffer; runtime->buffer = newbuf; runtime->buffer_size = params->buffer_size; -@@ -962,8 +978,10 @@ static long snd_rawmidi_kernel_read1(str +@@ -960,8 +976,10 @@ static long snd_rawmidi_kernel_read1(str long result = 0, count1; struct snd_rawmidi_runtime *runtime = substream->runtime; unsigned long appl_ptr; @@ -89,7 +87,7 @@ Signed-off-by: Takashi Iwai while (count > 0 && runtime->avail) { count1 = runtime->buffer_size - runtime->appl_ptr; if (count1 > count) -@@ -982,16 +1000,19 @@ static long snd_rawmidi_kernel_read1(str +@@ -980,16 +998,19 @@ static long snd_rawmidi_kernel_read1(str if (userbuf) { spin_unlock_irqrestore(&runtime->lock, flags); if (copy_to_user(userbuf + result, @@ -113,7 +111,7 @@ Signed-off-by: Takashi Iwai } long snd_rawmidi_kernel_read(struct snd_rawmidi_substream *substream, -@@ -1262,6 +1283,7 @@ static long snd_rawmidi_kernel_write1(st +@@ -1283,6 +1304,7 @@ static long snd_rawmidi_kernel_write1(st return -EAGAIN; } } @@ -121,7 +119,7 @@ Signed-off-by: Takashi Iwai while (count > 0 && runtime->avail > 0) { count1 = runtime->buffer_size - runtime->appl_ptr; if (count1 > count) -@@ -1293,6 +1315,7 @@ static long snd_rawmidi_kernel_write1(st +@@ -1314,6 +1336,7 @@ static long snd_rawmidi_kernel_write1(st } __end: count1 = runtime->avail < runtime->buffer_size; diff --git a/patches.suse/ALSA-seq-oss-Fix-missing-error-check-in-snd_seq_oss_.patch b/patches.suse/ALSA-seq-oss-Fix-missing-error-check-in-snd_seq_oss_.patch new file mode 100644 index 0000000..632bca5 --- /dev/null +++ b/patches.suse/ALSA-seq-oss-Fix-missing-error-check-in-snd_seq_oss_.patch @@ -0,0 +1,41 @@ +From 217bfbb8b0bfa24619b11ab75c135fec99b99b20 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 15 Jan 2021 10:34:28 +0100 +Subject: [PATCH] ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() +Git-commit: 217bfbb8b0bfa24619b11ab75c135fec99b99b20 +Patch-mainline: v5.11-rc5 +References: git-fixes + +snd_seq_oss_synth_make_info() didn't check the error code from +snd_seq_oss_midi_make_info(), and this leads to the call of strlcpy() +with the uninitialized string as the source, which may lead to the +access over the limit. + +Add the proper error check for avoiding the failure. + +Reported-by: syzbot+e42504ff21cff05a595f@syzkaller.appspotmail.com +Cc: +Link: https://lore.kernel.org/r/20210115093428.15882-1-tiwai@suse.de +Signed-off-by: Takashi Iwai + +--- + sound/core/seq/oss/seq_oss_synth.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c +index 11554d0412f0..1b8409ec2c97 100644 +--- a/sound/core/seq/oss/seq_oss_synth.c ++++ b/sound/core/seq/oss/seq_oss_synth.c +@@ -611,7 +611,8 @@ snd_seq_oss_synth_make_info(struct seq_oss_devinfo *dp, int dev, struct synth_in + + if (info->is_midi) { + struct midi_info minf; +- snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf); ++ if (snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf)) ++ return -ENXIO; + inf->synth_type = SYNTH_TYPE_MIDI; + inf->synth_subtype = 0; + inf->nr_voices = 16; +-- +2.26.2 + diff --git a/patches.suse/ASoC-Intel-haswell-Add-missing-pm_ops.patch b/patches.suse/ASoC-Intel-haswell-Add-missing-pm_ops.patch new file mode 100644 index 0000000..6d40b70 --- /dev/null +++ b/patches.suse/ASoC-Intel-haswell-Add-missing-pm_ops.patch @@ -0,0 +1,36 @@ +From bb224c3e3e41d940612d4cc9573289cdbd5cb8f5 Mon Sep 17 00:00:00 2001 +From: Cezary Rojewski +Date: Thu, 17 Dec 2020 11:54:01 +0100 +Subject: [PATCH] ASoC: Intel: haswell: Add missing pm_ops +Git-commit: bb224c3e3e41d940612d4cc9573289cdbd5cb8f5 +Patch-mainline: v5.11-rc4 +References: git-fixes + +haswell machine board is missing pm_ops what prevents it from undergoing +suspend-resume procedure successfully. Assign default snd_soc_pm_ops so +this is no longer the case. + +Signed-off-by: Cezary Rojewski +Link: https://lore.kernel.org/r/20201217105401.27865-1-cezary.rojewski@intel.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/intel/boards/haswell.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/intel/boards/haswell.c b/sound/soc/intel/boards/haswell.c +index c55d1239e705..c763bfeb1f38 100644 +--- a/sound/soc/intel/boards/haswell.c ++++ b/sound/soc/intel/boards/haswell.c +@@ -189,6 +189,7 @@ static struct platform_driver haswell_audio = { + .probe = haswell_audio_probe, + .driver = { + .name = "haswell-audio", ++ .pm = &snd_soc_pm_ops, + }, + }; + +-- +2.26.2 + diff --git a/patches.suse/IB-mlx5-Fix-DEVX-support-for-MLX5_CMD_OP_INIT2INIT_Q.patch b/patches.suse/IB-mlx5-Fix-DEVX-support-for-MLX5_CMD_OP_INIT2INIT_Q.patch new file mode 100644 index 0000000..b2c4205 --- /dev/null +++ b/patches.suse/IB-mlx5-Fix-DEVX-support-for-MLX5_CMD_OP_INIT2INIT_Q.patch @@ -0,0 +1,36 @@ +From: Mark Zhang +Date: Wed, 27 May 2020 16:57:03 +0300 +Subject: IB/mlx5: Fix DEVX support for MLX5_CMD_OP_INIT2INIT_QP command +Patch-mainline: v5.8-rc1 +Git-commit: d246a3061528be6d852156d25c02ea69d6db7e65 +References: bsc#1103991 FATE#326007 + +The commit citied in the Fixes line wasn't complete and solved +only part of the problems. Update the mlx5_ib to properly support +MLX5_CMD_OP_INIT2INIT_QP command in the DEVX, that is required when +modify the QP tx_port_affinity. + +Fixes: 819f7427bafd ("RDMA/mlx5: Add init2init as a modify command") +Link: https://lore.kernel.org/r/20200527135703.482501-1-leon@kernel.org +Signed-off-by: Mark Zhang +Reviewed-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/mlx5/devx.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/infiniband/hw/mlx5/devx.c ++++ b/drivers/infiniband/hw/mlx5/devx.c +@@ -264,6 +264,10 @@ static int devx_is_valid_obj_id(struct d + obj_id = get_enc_obj_id(MLX5_CMD_OP_CREATE_QP, + MLX5_GET(rst2init_qp_in, in, qpn)); + break; ++ case MLX5_CMD_OP_INIT2INIT_QP: ++ obj_id = get_enc_obj_id(MLX5_CMD_OP_CREATE_QP, ++ MLX5_GET(init2init_qp_in, in, qpn)); ++ break; + case MLX5_CMD_OP_INIT2RTR_QP: + obj_id = get_enc_obj_id(MLX5_CMD_OP_CREATE_QP, + MLX5_GET(init2rtr_qp_in, in, qpn)); diff --git a/patches.suse/RDMA-addr-Fix-race-with-netevent_callback-rdma_addr_.patch b/patches.suse/RDMA-addr-Fix-race-with-netevent_callback-rdma_addr_.patch new file mode 100644 index 0000000..3a62dde --- /dev/null +++ b/patches.suse/RDMA-addr-Fix-race-with-netevent_callback-rdma_addr_.patch @@ -0,0 +1,68 @@ +From: Jason Gunthorpe +Date: Wed, 30 Sep 2020 10:20:07 +0300 +Subject: RDMA/addr: Fix race with netevent_callback()/rdma_addr_cancel() +Patch-mainline: v5.10-rc1 +Git-commit: 2ee9bf346fbfd1dad0933b9eb3a4c2c0979b633e +References: bsc#1103992 FATE#326009 + +This three thread race can result in the work being run once the callback +becomes NULL: + + CPU1 CPU2 CPU3 + netevent_callback() + process_one_req() rdma_addr_cancel() + [..] + spin_lock_bh() + set_timeout() + spin_unlock_bh() + + spin_lock_bh() + list_del_init(&req->list); + spin_unlock_bh() + + req->callback = NULL + spin_lock_bh() + if (!list_empty(&req->list)) + // Skipped! + // cancel_delayed_work(&req->work); + spin_unlock_bh() + + process_one_req() // again + req->callback() // BOOM + cancel_delayed_work_sync() + +The solution is to always cancel the work once it is completed so any +in between set_timeout() does not result in it running again. + +Cc: stable@vger.kernel.org +Fixes: 44e75052bc2a ("RDMA/rdma_cm: Make rdma_addr_cancel into a fence") +Link: https://lore.kernel.org/r/20200930072007.1009692-1-leon@kernel.org +Reported-by: Dan Aloni +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/core/addr.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/infiniband/core/addr.c ++++ b/drivers/infiniband/core/addr.c +@@ -644,13 +644,12 @@ static void process_one_req(struct work_ + req->callback = NULL; + + spin_lock_bh(&lock); ++ /* ++ * Although the work will normally have been canceled by the workqueue, ++ * it can still be requeued as long as it is on the req_list. ++ */ ++ cancel_delayed_work(&req->work); + if (!list_empty(&req->list)) { +- /* +- * Although the work will normally have been canceled by the +- * workqueue, it can still be requeued as long as it is on the +- * req_list. +- */ +- cancel_delayed_work(&req->work); + list_del_init(&req->list); + kfree(req); + } diff --git a/patches.suse/RDMA-bnxt_re-Do-not-add-user-qps-to-flushlist.patch b/patches.suse/RDMA-bnxt_re-Do-not-add-user-qps-to-flushlist.patch new file mode 100644 index 0000000..0e0ab85 --- /dev/null +++ b/patches.suse/RDMA-bnxt_re-Do-not-add-user-qps-to-flushlist.patch @@ -0,0 +1,35 @@ +From: Selvin Xavier +Date: Wed, 5 Aug 2020 21:45:48 -0700 +Subject: RDMA/bnxt_re: Do not add user qps to flushlist +Patch-mainline: v5.9-rc2 +Git-commit: a812f2d60a9fb7818f9c81f967180317b52545c0 +References: bsc#1050244 FATE#322915 + +Driver shall add only the kernel qps to the flush list for clean up. +During async error events from the HW, driver is adding qps to this list +without checking if the qp is kernel qp or not. + +Add a check to avoid user qp addition to the flush list. + +Fixes: 942c9b6ca8de ("RDMA/bnxt_re: Avoid Hard lockup during error CQE processing") +Fixes: c50866e2853a ("bnxt_re: fix the regression due to changes in alloc_pbl") +Link: https://lore.kernel.org/r/1596689148-4023-1-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/bnxt_re/main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/bnxt_re/main.c ++++ b/drivers/infiniband/hw/bnxt_re/main.c +@@ -800,7 +800,8 @@ static int bnxt_re_handle_qp_async_event + struct ib_event event; + unsigned int flags; + +- if (qp->qplib_qp.state == CMDQ_MODIFY_QP_NEW_STATE_ERR) { ++ if (qp->qplib_qp.state == CMDQ_MODIFY_QP_NEW_STATE_ERR && ++ rdma_is_kernel_res(&qp->ib_qp.res)) { + flags = bnxt_re_lock_cqs(qp); + bnxt_qplib_add_flush_qp(&qp->qplib_qp); + bnxt_re_unlock_cqs(qp, flags); diff --git a/patches.suse/RDMA-bnxt_re-Do-not-report-transparent-vlan-from-QP1.patch b/patches.suse/RDMA-bnxt_re-Do-not-report-transparent-vlan-from-QP1.patch new file mode 100644 index 0000000..1cdfded --- /dev/null +++ b/patches.suse/RDMA-bnxt_re-Do-not-report-transparent-vlan-from-QP1.patch @@ -0,0 +1,57 @@ +From: Selvin Xavier +Date: Mon, 24 Aug 2020 11:14:32 -0700 +Subject: RDMA/bnxt_re: Do not report transparent vlan from QP1 +Patch-mainline: v5.9-rc5 +Git-commit: 2d0e60ee322d512fa6bc62d23a6760b39a380847 +References: bsc#1104742 FATE#325917 + +QP1 Rx CQE reports transparent VLAN ID in the completion and this is used +while reporting the completion for received MAD packet. Check if the vlan +id is configured before reporting it in the work completion. + +Fixes: 84511455ac5b ("RDMA/bnxt_re: report vlan_id and sl in qp1 recv completion") +Link: https://lore.kernel.org/r/1598292876-26529-3-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -3049,6 +3049,19 @@ static void bnxt_re_process_res_rawqp1_w + wc->wc_flags |= IB_WC_GRH; + } + ++static bool bnxt_re_check_if_vlan_valid(struct bnxt_re_dev *rdev, ++ u16 vlan_id) ++{ ++ /* ++ * Check if the vlan is configured in the host. If not configured, it ++ * can be a transparent VLAN. So dont report the vlan id. ++ */ ++ if (!__vlan_find_dev_deep_rcu(rdev->netdev, ++ htons(ETH_P_8021Q), vlan_id)) ++ return false; ++ return true; ++} ++ + static bool bnxt_re_is_vlan_pkt(struct bnxt_qplib_cqe *orig_cqe, + u16 *vid, u8 *sl) + { +@@ -3117,9 +3130,11 @@ static void bnxt_re_process_res_shadow_q + wc->src_qp = orig_cqe->src_qp; + memcpy(wc->smac, orig_cqe->smac, ETH_ALEN); + if (bnxt_re_is_vlan_pkt(orig_cqe, &vlan_id, &sl)) { +- wc->vlan_id = vlan_id; +- wc->sl = sl; +- wc->wc_flags |= IB_WC_WITH_VLAN; ++ if (bnxt_re_check_if_vlan_valid(rdev, vlan_id)) { ++ wc->vlan_id = vlan_id; ++ wc->sl = sl; ++ wc->wc_flags |= IB_WC_WITH_VLAN; ++ } + } + wc->port_num = 1; + wc->vendor_err = orig_cqe->status; diff --git a/patches.suse/RDMA-cma-Don-t-overwrite-sgid_attr-after-device-is-r.patch b/patches.suse/RDMA-cma-Don-t-overwrite-sgid_attr-after-device-is-r.patch new file mode 100644 index 0000000..aa1360f --- /dev/null +++ b/patches.suse/RDMA-cma-Don-t-overwrite-sgid_attr-after-device-is-r.patch @@ -0,0 +1,71 @@ +From: Leon Romanovsky +Date: Sun, 13 Dec 2020 15:29:39 +0200 +Subject: RDMA/cma: Don't overwrite sgid_attr after device is released +Patch-mainline: v5.11-rc1 +Git-commit: e246b7c035d74abfb3507fa10082d0c42cc016c3 +References: bsc#1103992 FATE#326009 + +As part of the cma_dev release, that pointer will be set to NULL. In case +it happens in rdma_bind_addr() (part of an error flow), the next call to +addr_handler() will have a call to cma_acquire_dev_by_src_ip() which will +overwrite sgid_attr without releasing it. + + WARNING: CPU: 2 PID: 108 at drivers/infiniband/core/cma.c:606 cma_bind_sgid_attr drivers/infiniband/core/cma.c:606 [inline] + WARNING: CPU: 2 PID: 108 at drivers/infiniband/core/cma.c:606 cma_acquire_dev_by_src_ip+0x470/0x4b0 drivers/infiniband/core/cma.c:649 + CPU: 2 PID: 108 Comm: kworker/u8:1 Not tainted 5.10.0-rc6+ #257 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 + Workqueue: ib_addr process_one_req + RIP: 0010:cma_bind_sgid_attr drivers/infiniband/core/cma.c:606 [inline] + RIP: 0010:cma_acquire_dev_by_src_ip+0x470/0x4b0 drivers/infiniband/core/cma.c:649 + Code: 66 d9 4a ff 4d 8b 6e 10 49 8d bd 1c 08 00 00 e8 b6 d6 4a ff 45 0f b6 bd 1c 08 00 00 41 83 e7 01 e9 49 fd ff ff e8 90 c5 29 ff <0f> 0b e9 80 fe ff ff e8 84 c5 29 ff 4c 89 f7 e8 2c d9 4a ff 4d 8b + RSP: 0018:ffff8881047c7b40 EFLAGS: 00010293 + RAX: ffff888104789c80 RBX: 0000000000000001 RCX: ffffffff820b8ef8 + RDX: 0000000000000000 RSI: ffffffff820b9080 RDI: ffff88810cd4c998 + RBP: ffff8881047c7c08 R08: ffff888104789c80 R09: ffffed10209f4036 + R10: ffff888104fa01ab R11: ffffed10209f4035 R12: ffff88810cd4c800 + R13: ffff888105750e28 R14: ffff888108f0a100 R15: ffff88810cd4c998 + FS: 0000000000000000(0000) GS:ffff888119c00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000000 CR3: 0000000104e60005 CR4: 0000000000370ea0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + addr_handler+0x266/0x350 drivers/infiniband/core/cma.c:3190 + process_one_req+0xa3/0x300 drivers/infiniband/core/addr.c:645 + process_one_work+0x54c/0x930 kernel/workqueue.c:2272 + worker_thread+0x82/0x830 kernel/workqueue.c:2418 + kthread+0x1ca/0x220 kernel/kthread.c:292 + ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296 + +Fixes: ff11c6cd521f ("RDMA/cma: Introduce and use cma_acquire_dev_by_src_ip()") +Link: https://lore.kernel.org/r/20201213132940.345554-5-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/core/cma.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -526,6 +526,10 @@ static void cma_release_dev(struct rdma_ + list_del(&id_priv->list); + cma_deref_dev(id_priv->cma_dev); + id_priv->cma_dev = NULL; ++ if (id_priv->id.route.addr.dev_addr.sgid_attr) { ++ rdma_put_gid_attr(id_priv->id.route.addr.dev_addr.sgid_attr); ++ id_priv->id.route.addr.dev_addr.sgid_attr = NULL; ++ } + mutex_unlock(&lock); + } + +@@ -1843,9 +1847,6 @@ void rdma_destroy_id(struct rdma_cm_id * + + kfree(id_priv->id.route.path_rec); + +- if (id_priv->id.route.addr.dev_addr.sgid_attr) +- rdma_put_gid_attr(id_priv->id.route.addr.dev_addr.sgid_attr); +- + put_net(id_priv->id.route.addr.dev_addr.net); + kfree(id_priv); + } diff --git a/patches.suse/RDMA-core-Ensure-security-pkey-modify-is-not-lost.patch b/patches.suse/RDMA-core-Ensure-security-pkey-modify-is-not-lost.patch new file mode 100644 index 0000000..b09634b --- /dev/null +++ b/patches.suse/RDMA-core-Ensure-security-pkey-modify-is-not-lost.patch @@ -0,0 +1,72 @@ +From: Mike Marciniszyn +Date: Fri, 13 Mar 2020 08:47:05 -0400 +Subject: RDMA/core: Ensure security pkey modify is not lost +Patch-mainline: v5.6 +Git-commit: 2d47fbacf2725a67869f4d3634c2415e7dfab2f4 +References: bsc#1046306 FATE#322942 + +The following modify sequence (loosely based on ipoib) will lose a pkey +modifcation: + +- Modify (pkey index, port) +- Modify (new pkey index, NO port) + +After the first modify, the qp_pps list will have saved the pkey and the +unit on the main list. + +During the second modify, get_new_pps() will fetch the port from qp_pps +and read the new pkey index from qp_attr->pkey_index. The state will +still be zero, or IB_PORT_PKEY_NOT_VALID. Because of the invalid state, +the new values will never replace the one in the qp pps list, losing the +new pkey. + +This happens because the following if statements will never correct the +state because the first term will be false. If the code had been executed, +it would incorrectly overwrite valid values. + + if ((qp_attr_mask & IB_QP_PKEY_INDEX) && (qp_attr_mask & IB_QP_PORT)) + new_pps->main.state = IB_PORT_PKEY_VALID; + + if (!(qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) && qp_pps) { + new_pps->main.port_num = qp_pps->main.port_num; + new_pps->main.pkey_index = qp_pps->main.pkey_index; + if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID) + new_pps->main.state = IB_PORT_PKEY_VALID; + } + +Fix by joining the two if statements with an or test to see if qp_pps is +non-NULL and in the correct state. + +Fixes: 1dd017882e01 ("RDMA/core: Fix protection fault in get_pkey_idx_qp_list") +Link: https://lore.kernel.org/r/20200313124704.14982.55907.stgit@awfm-01.aw.intel.com +Reviewed-by: Kaike Wan +Signed-off-by: Mike Marciniszyn +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/core/security.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +--- a/drivers/infiniband/core/security.c ++++ b/drivers/infiniband/core/security.c +@@ -346,16 +346,11 @@ static struct ib_ports_pkeys *get_new_pp + else if (qp_pps) + new_pps->main.pkey_index = qp_pps->main.pkey_index; + +- if ((qp_attr_mask & IB_QP_PKEY_INDEX) && (qp_attr_mask & IB_QP_PORT)) ++ if (((qp_attr_mask & IB_QP_PKEY_INDEX) && ++ (qp_attr_mask & IB_QP_PORT)) || ++ (qp_pps && qp_pps->main.state != IB_PORT_PKEY_NOT_VALID)) + new_pps->main.state = IB_PORT_PKEY_VALID; + +- if (!(qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) && qp_pps) { +- new_pps->main.port_num = qp_pps->main.port_num; +- new_pps->main.pkey_index = qp_pps->main.pkey_index; +- if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID) +- new_pps->main.state = IB_PORT_PKEY_VALID; +- } +- + if (qp_attr_mask & IB_QP_ALT_PATH) { + new_pps->alt.port_num = qp_attr->alt_port_num; + new_pps->alt.pkey_index = qp_attr->alt_pkey_index; diff --git a/patches.suse/RDMA-core-Fix-pkey-and-port-assignment-in-get_new_pp.patch b/patches.suse/RDMA-core-Fix-pkey-and-port-assignment-in-get_new_pp.patch new file mode 100644 index 0000000..62764ed --- /dev/null +++ b/patches.suse/RDMA-core-Fix-pkey-and-port-assignment-in-get_new_pp.patch @@ -0,0 +1,100 @@ +From: Maor Gottlieb +Date: Thu, 27 Feb 2020 14:57:28 +0200 +Subject: RDMA/core: Fix pkey and port assignment in get_new_pps +Patch-mainline: v5.6-rc5 +Git-commit: 801b67f3eaafd3f2ec8b65d93142d4ffedba85df +References: bsc#1046306 FATE#322942 + +When port is part of the modify mask, then we should take it from the +qp_attr and not from the old pps. Same for PKEY. Otherwise there are +panics in some configurations: + + RIP: 0010:get_pkey_idx_qp_list+0x50/0x80 [ib_core] + Code: c7 18 e8 13 04 30 ef 0f b6 43 06 48 69 c0 b8 00 00 00 48 03 85 a0 04 00 00 48 8b 50 20 48 8d 48 20 48 39 ca 74 1a 0f b7 73 04 <66> 39 72 10 75 08 eb 10 66 39 72 10 74 0a 48 8b 12 48 39 ca 75 f2 + RSP: 0018:ffffafb3480932f0 EFLAGS: 00010203 + RAX: ffff98059ababa10 RBX: ffff980d926e8cc0 RCX: ffff98059ababa30 + RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff98059ababa28 + RBP: ffff98059b940000 R08: 00000000000310c0 R09: ffff97fe47c07480 + R10: 0000000000000036 R11: 0000000000000200 R12: 0000000000000071 + R13: ffff98059b940000 R14: ffff980d87f948a0 R15: 0000000000000000 + FS: 00007f88deb31740(0000) GS:ffff98059f600000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000010 CR3: 0000000853e26001 CR4: 00000000001606e0 + Call Trace: + port_pkey_list_insert+0x3d/0x1b0 [ib_core] + ? kmem_cache_alloc_trace+0x215/0x220 + ib_security_modify_qp+0x226/0x3a0 [ib_core] + _ib_modify_qp+0xcf/0x390 [ib_core] + ipoib_init_qp+0x7f/0x200 [ib_ipoib] + ? rvt_modify_port+0xd0/0xd0 [rdmavt] + ? ib_find_pkey+0x99/0xf0 [ib_core] + ipoib_ib_dev_open_default+0x1a/0x200 [ib_ipoib] + ipoib_ib_dev_open+0x96/0x130 [ib_ipoib] + ipoib_open+0x44/0x130 [ib_ipoib] + __dev_open+0xd1/0x160 + __dev_change_flags+0x1ab/0x1f0 + dev_change_flags+0x23/0x60 + do_setlink+0x328/0xe30 + ? __nla_validate_parse+0x54/0x900 + __rtnl_newlink+0x54e/0x810 + ? __alloc_pages_nodemask+0x17d/0x320 + ? page_fault+0x30/0x50 + ? _cond_resched+0x15/0x30 + ? kmem_cache_alloc_trace+0x1c8/0x220 + rtnl_newlink+0x43/0x60 + rtnetlink_rcv_msg+0x28f/0x350 + ? kmem_cache_alloc+0x1fb/0x200 + ? _cond_resched+0x15/0x30 + ? __kmalloc_node_track_caller+0x24d/0x2d0 + ? rtnl_calcit.isra.31+0x120/0x120 + netlink_rcv_skb+0xcb/0x100 + netlink_unicast+0x1e0/0x340 + netlink_sendmsg+0x317/0x480 + ? __check_object_size+0x48/0x1d0 + sock_sendmsg+0x65/0x80 + ____sys_sendmsg+0x223/0x260 + ? copy_msghdr_from_user+0xdc/0x140 + ___sys_sendmsg+0x7c/0xc0 + ? skb_dequeue+0x57/0x70 + ? __inode_wait_for_writeback+0x75/0xe0 + ? fsnotify_grab_connector+0x45/0x80 + ? __dentry_kill+0x12c/0x180 + __sys_sendmsg+0x58/0xa0 + do_syscall_64+0x5b/0x200 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + RIP: 0033:0x7f88de467f10 + +Link: https://lore.kernel.org/r/20200227125728.100551-1-leon@kernel.org +Cc: +Fixes: 1dd017882e01 ("RDMA/core: Fix protection fault in get_pkey_idx_qp_list") +Signed-off-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Tested-by: Mike Marciniszyn +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/core/security.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/infiniband/core/security.c ++++ b/drivers/infiniband/core/security.c +@@ -337,11 +337,15 @@ static struct ib_ports_pkeys *get_new_pp + return NULL; + + if (qp_attr_mask & IB_QP_PORT) +- new_pps->main.port_num = +- (qp_pps) ? qp_pps->main.port_num : qp_attr->port_num; ++ new_pps->main.port_num = qp_attr->port_num; ++ else if (qp_pps) ++ new_pps->main.port_num = qp_pps->main.port_num; ++ + if (qp_attr_mask & IB_QP_PKEY_INDEX) +- new_pps->main.pkey_index = (qp_pps) ? qp_pps->main.pkey_index : +- qp_attr->pkey_index; ++ new_pps->main.pkey_index = qp_attr->pkey_index; ++ else if (qp_pps) ++ new_pps->main.pkey_index = qp_pps->main.pkey_index; ++ + if ((qp_attr_mask & IB_QP_PKEY_INDEX) && (qp_attr_mask & IB_QP_PORT)) + new_pps->main.state = IB_PORT_PKEY_VALID; + diff --git a/patches.suse/RDMA-core-Fix-protection-fault-in-get_pkey_idx_qp_li.patch b/patches.suse/RDMA-core-Fix-protection-fault-in-get_pkey_idx_qp_li.patch new file mode 100644 index 0000000..5e917fe --- /dev/null +++ b/patches.suse/RDMA-core-Fix-protection-fault-in-get_pkey_idx_qp_li.patch @@ -0,0 +1,91 @@ +From: Leon Romanovsky +Date: Wed, 12 Feb 2020 10:06:51 +0200 +Subject: RDMA/core: Fix protection fault in get_pkey_idx_qp_list +Patch-mainline: v5.6-rc2 +Git-commit: 1dd017882e01d2fcd9c5dbbf1eb376211111c393 +References: bsc#1046306 FATE#322942 + +We don't need to set pkey as valid in case that user set only one of pkey +index or port number, otherwise it will be resulted in NULL pointer +dereference while accessing to uninitialized pkey list. The following +crash from Syzkaller revealed it. + + kasan: CONFIG_KASAN_INLINE enabled + kasan: GPF could be caused by NULL-ptr deref or user memory access + general protection fault: 0000 [#1] SMP KASAN PTI + CPU: 1 PID: 14753 Comm: syz-executor.2 Not tainted 5.5.0-rc5 #2 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS + rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 + RIP: 0010:get_pkey_idx_qp_list+0x161/0x2d0 + Code: 01 00 00 49 8b 5e 20 4c 39 e3 0f 84 b9 00 00 00 e8 e4 42 6e fe 48 + 8d 7b 10 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 + 02 84 c0 74 08 3c 01 0f 8e d0 00 00 00 48 8d 7d 04 48 b8 + RSP: 0018:ffffc9000bc6f950 EFLAGS: 00010202 + RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff82c8bdec + RDX: 0000000000000002 RSI: ffffc900030a8000 RDI: 0000000000000010 + RBP: ffff888112c8ce80 R08: 0000000000000004 R09: fffff5200178df1f + R10: 0000000000000001 R11: fffff5200178df1f R12: ffff888115dc4430 + R13: ffff888115da8498 R14: ffff888115dc4410 R15: ffff888115da8000 + FS: 00007f20777de700(0000) GS:ffff88811b100000(0000) + knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000001b2f721000 CR3: 00000001173ca002 CR4: 0000000000360ee0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + port_pkey_list_insert+0xd7/0x7c0 + ib_security_modify_qp+0x6fa/0xfc0 + _ib_modify_qp+0x8c4/0xbf0 + modify_qp+0x10da/0x16d0 + ib_uverbs_modify_qp+0x9a/0x100 + ib_uverbs_write+0xaa5/0xdf0 + __vfs_write+0x7c/0x100 + vfs_write+0x168/0x4a0 + ksys_write+0xc8/0x200 + do_syscall_64+0x9c/0x390 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Fixes: d291f1a65232 ("IB/core: Enforce PKey security on QPs") +Link: https://lore.kernel.org/r/20200212080651.GB679970@unreal +Signed-off-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Message-Id: <20200212080651.GB679970@unreal> +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/core/security.c | 24 +++++++++--------------- + 1 file changed, 9 insertions(+), 15 deletions(-) + +--- a/drivers/infiniband/core/security.c ++++ b/drivers/infiniband/core/security.c +@@ -336,22 +336,16 @@ static struct ib_ports_pkeys *get_new_pp + if (!new_pps) + return NULL; + +- if (qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) { +- if (!qp_pps) { +- new_pps->main.port_num = qp_attr->port_num; +- new_pps->main.pkey_index = qp_attr->pkey_index; +- } else { +- new_pps->main.port_num = (qp_attr_mask & IB_QP_PORT) ? +- qp_attr->port_num : +- qp_pps->main.port_num; +- +- new_pps->main.pkey_index = +- (qp_attr_mask & IB_QP_PKEY_INDEX) ? +- qp_attr->pkey_index : +- qp_pps->main.pkey_index; +- } ++ if (qp_attr_mask & IB_QP_PORT) ++ new_pps->main.port_num = ++ (qp_pps) ? qp_pps->main.port_num : qp_attr->port_num; ++ if (qp_attr_mask & IB_QP_PKEY_INDEX) ++ new_pps->main.pkey_index = (qp_pps) ? qp_pps->main.pkey_index : ++ qp_attr->pkey_index; ++ if ((qp_attr_mask & IB_QP_PKEY_INDEX) && (qp_attr_mask & IB_QP_PORT)) + new_pps->main.state = IB_PORT_PKEY_VALID; +- } else if (qp_pps) { ++ ++ if (!(qp_attr_mask & (IB_QP_PKEY_INDEX || IB_QP_PORT)) && qp_pps) { + new_pps->main.port_num = qp_pps->main.port_num; + new_pps->main.pkey_index = qp_pps->main.pkey_index; + if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID) diff --git a/patches.suse/RDMA-core-Fix-reported-speed-and-width.patch b/patches.suse/RDMA-core-Fix-reported-speed-and-width.patch new file mode 100644 index 0000000..369ecc5 --- /dev/null +++ b/patches.suse/RDMA-core-Fix-reported-speed-and-width.patch @@ -0,0 +1,33 @@ +From: Kamal Heib +Date: Wed, 2 Sep 2020 15:43:04 +0300 +Subject: RDMA/core: Fix reported speed and width +Patch-mainline: v5.9-rc5 +Git-commit: 28b0865714b315e318ac45c4fc9156f3d4649646 +References: bsc#1046306 FATE#322942 + +When the returned speed from __ethtool_get_link_ksettings() is +SPEED_UNKNOWN this will lead to reporting a wrong speed and width for +providers that uses ib_get_eth_speed(), fix that by defaulting the +netdev_speed to SPEED_1000 in case the returned value from +__ethtool_get_link_ksettings() is SPEED_UNKNOWN. + +Fixes: d41861942fc5 ("IB/core: Add generic function to extract IB speed from netdev") +Link: https://lore.kernel.org/r/20200902124304.170912-1-kamalheib1@gmail.com +Signed-off-by: Kamal Heib +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/core/verbs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/core/verbs.c ++++ b/drivers/infiniband/core/verbs.c +@@ -1702,7 +1702,7 @@ int ib_get_eth_speed(struct ib_device *d + + dev_put(netdev); + +- if (!rc) { ++ if (!rc && lksettings.base.speed != (u32)SPEED_UNKNOWN) { + netdev_speed = lksettings.base.speed; + } else { + netdev_speed = SPEED_1000; diff --git a/patches.suse/RDMA-core-Fix-return-error-value-in-_ib_modify_qp-to.patch b/patches.suse/RDMA-core-Fix-return-error-value-in-_ib_modify_qp-to.patch new file mode 100644 index 0000000..f3750b9 --- /dev/null +++ b/patches.suse/RDMA-core-Fix-return-error-value-in-_ib_modify_qp-to.patch @@ -0,0 +1,31 @@ +From: Li Heng +Date: Sat, 25 Jul 2020 10:56:27 +0800 +Subject: RDMA/core: Fix return error value in _ib_modify_qp() to negative +Patch-mainline: v5.9-rc1 +Git-commit: 47fda651d5af2506deac57d54887cf55ce26e244 +References: bsc#1103992 FATE#326009 + +The error codes in _ib_modify_qp() are supposed to be negative errno. + +Fixes: 7a5c938b9ed0 ("IB/core: Check for rdma_protocol_ib only after validating port_num") +Link: https://lore.kernel.org/r/1595645787-20375-1-git-send-email-liheng40@huawei.com +Reported-by: Hulk Robot +Signed-off-by: Li Heng +Reviewed-by: Parav Pandit +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/core/verbs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/core/verbs.c ++++ b/drivers/infiniband/core/verbs.c +@@ -1606,7 +1606,7 @@ static int _ib_modify_qp(struct ib_qp *q + if (!(rdma_protocol_ib(qp->device, + attr->alt_ah_attr.port_num) && + rdma_protocol_ib(qp->device, port))) { +- ret = EINVAL; ++ ret = -EINVAL; + goto out; + } + } diff --git a/patches.suse/RDMA-core-Fix-use-of-logical-OR-in-get_new_pps.patch b/patches.suse/RDMA-core-Fix-use-of-logical-OR-in-get_new_pps.patch new file mode 100644 index 0000000..900cdf5 --- /dev/null +++ b/patches.suse/RDMA-core-Fix-use-of-logical-OR-in-get_new_pps.patch @@ -0,0 +1,40 @@ +From: Nathan Chancellor +Date: Mon, 17 Feb 2020 13:43:18 -0700 +Subject: RDMA/core: Fix use of logical OR in get_new_pps +Patch-mainline: v5.6-rc5 +Git-commit: 4ca501d6aaf21de31541deac35128bbea8427aa6 +References: bsc#1046306 FATE#322942 + +Clang warns: + +../drivers/infiniband/core/security.c:351:41: warning: converting the +enum constant to a boolean [-Wint-in-bool-context] + if (!(qp_attr_mask & (IB_QP_PKEY_INDEX || IB_QP_PORT)) && qp_pps) { + ^ +1 warning generated. + +A bitwise OR should have been used instead. + +Fixes: 1dd017882e01 ("RDMA/core: Fix protection fault in get_pkey_idx_qp_list") +Link: https://lore.kernel.org/r/20200217204318.13609-1-natechancellor@gmail.com +Link: https://github.com/ClangBuiltLinux/linux/issues/889 +Reported-by: Dan Carpenter +Signed-off-by: Nathan Chancellor +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/core/security.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/core/security.c ++++ b/drivers/infiniband/core/security.c +@@ -345,7 +345,7 @@ static struct ib_ports_pkeys *get_new_pp + if ((qp_attr_mask & IB_QP_PKEY_INDEX) && (qp_attr_mask & IB_QP_PORT)) + new_pps->main.state = IB_PORT_PKEY_VALID; + +- if (!(qp_attr_mask & (IB_QP_PKEY_INDEX || IB_QP_PORT)) && qp_pps) { ++ if (!(qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) && qp_pps) { + new_pps->main.port_num = qp_pps->main.port_num; + new_pps->main.pkey_index = qp_pps->main.pkey_index; + if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID) diff --git a/patches.suse/RDMA-hns-Bugfix-for-memory-window-mtpt-configuration.patch b/patches.suse/RDMA-hns-Bugfix-for-memory-window-mtpt-configuration.patch new file mode 100644 index 0000000..9a00a2b --- /dev/null +++ b/patches.suse/RDMA-hns-Bugfix-for-memory-window-mtpt-configuration.patch @@ -0,0 +1,30 @@ +From: Yixian Liu +Date: Thu, 26 Nov 2020 18:26:12 +0800 +Subject: RDMA/hns: Bugfix for memory window mtpt configuration +Patch-mainline: v5.10-rc6 +Git-commit: 17475e104dcb74217c282781817f8f52b46130d3 +References: bsc#1104427 FATE#326416 + +When a memory window is bound to a memory region, the local write access +should be set for its mtpt table. + +Fixes: c7c28191408b ("RDMA/hns: Add MW support for hip08") +Link: https://lore.kernel.org/r/1606386372-21094-1-git-send-email-liweihang@huawei.com +Signed-off-by: Yixian Liu +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -2427,6 +2427,7 @@ static int hns_roce_v2_mw_write_mtpt(voi + + roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_R_INV_EN_S, 1); + roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_L_INV_EN_S, 1); ++ roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_LW_EN_S, 1); + + roce_set_bit(mpt_entry->byte_12_mw_pa, V2_MPT_BYTE_12_PA_S, 0); + roce_set_bit(mpt_entry->byte_12_mw_pa, V2_MPT_BYTE_12_MR_MW_S, 1); diff --git a/patches.suse/RDMA-hns-Bugfix-for-slab-out-of-bounds-when-unloadin.patch b/patches.suse/RDMA-hns-Bugfix-for-slab-out-of-bounds-when-unloadin.patch new file mode 100644 index 0000000..4c6a34b --- /dev/null +++ b/patches.suse/RDMA-hns-Bugfix-for-slab-out-of-bounds-when-unloadin.patch @@ -0,0 +1,152 @@ +From: Xi Wang +Date: Fri, 9 Aug 2019 17:41:02 +0800 +Subject: RDMA/hns: Bugfix for slab-out-of-bounds when unloading hip08 driver +Patch-mainline: v5.4-rc1 +Git-commit: 9bba3f0cbfc8abf2e1549ea03c0128186081d7a8 +References: bsc#1104427 FATE#326416 + +kasan will report a BUG when run command 'rmmod hns_roce_hw_v2', the calltrace +is as follows: + +================================================================== +BUG: KASAN: slab-out-of-bounds in hns_roce_table_mhop_put+0x584/0x828 +[hns_roce] +Read of size 8 at addr ffff802185e08300 by task rmmod/270 + +Call trace: +dump_backtrace+0x0/0x1e8 +show_stack+0x14/0x20 +dump_stack+0xc4/0xfc +print_address_description+0x60/0x270 +__kasan_report+0x164/0x1b8 +kasan_report+0xc/0x18 +__asan_load8+0x84/0xa8 +hns_roce_table_mhop_put+0x584/0x828 [hns_roce] +hns_roce_table_put+0x174/0x1a0 [hns_roce] +hns_roce_mr_free+0x124/0x210 [hns_roce] +hns_roce_dereg_mr+0x90/0xb8 [hns_roce] +ib_dealloc_pd_user+0x60/0xf0 +ib_mad_port_close+0x128/0x1d8 +ib_mad_remove_device+0x94/0x118 +remove_client_context+0xa0/0xe0 +disable_device+0xfc/0x1c0 +__ib_unregister_device+0x60/0xe0 +ib_unregister_device+0x24/0x38 +hns_roce_exit+0x3c/0x138 [hns_roce] +__hns_roce_hw_v2_uninit_instance.isra.30+0x28/0x50 [hns_roce_hw_v2] +hns_roce_hw_v2_uninit_instance+0x44/0x60 [hns_roce_hw_v2] +hclge_uninit_client_instance+0x15c/0x238 [hclge] +hnae3_uninit_client_instance+0x84/0xa8 [hnae3] +hnae3_unregister_client+0x84/0x158 [hnae3] +hns_roce_hw_v2_exit+0x14/0x20 [hns_roce_hw_v2] +__arm64_sys_delete_module+0x20c/0x308 +el0_svc_handler+0xbc/0x210 +el0_svc+0x8/0xc + +Allocated by task 255: +__kasan_kmalloc.isra.0+0xd0/0x180 +kasan_kmalloc+0xc/0x18 +__kmalloc+0x16c/0x328 +hns_roce_init_hem_table+0x20c/0x428 [hns_roce] +hns_roce_init+0x214/0xfe0 [hns_roce] +__hns_roce_hw_v2_init_instance+0x284/0x330 [hns_roce_hw_v2] +hns_roce_hw_v2_init_instance+0xd0/0x1b8 [hns_roce_hw_v2] +hclge_init_roce_client_instance+0x180/0x310 [hclge] +hclge_init_client_instance+0xcc/0x508 [hclge] +hnae3_init_client_instance.part.3+0x3c/0x80 [hnae3] +hnae3_register_client+0x134/0x1a8 [hnae3] +0xffff200009c00014 +do_one_initcall+0x9c/0x3e0 +do_init_module+0xd4/0x2d8 +load_module+0x3284/0x3690 +__se_sys_init_module+0x274/0x308 +__arm64_sys_init_module+0x40/0x50 +el0_svc_handler+0xbc/0x210 +el0_svc+0x8/0xc + +Freed by task 0: +(stack is not available) + +The buggy address belongs to the object at ffff802185e06300 +which belongs to the cache kmalloc-8k of size 8192 +The buggy address is located 0 bytes to the right of +8192-byte region [ffff802185e06300, ffff802185e08300) +The buggy address belongs to the page: +page:ffff7fe008617800 refcount:1 mapcount:0 mapping:ffff802340020e00 index:0x0 +compound_mapcount: 0 +flags: 0x5fffe00000010200(slab|head) +raw: 5fffe00000010200 dead000000000100 dead000000000200 ffff802340020e00 +raw: 0000000000000000 00000000803e003e 00000001ffffffff 0000000000000000 +page dumped because: kasan: bad access detected + +Memory state around the buggy address: +ffff802185e08200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +ffff802185e08280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +>ffff802185e08300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +^ +ffff802185e08380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +ffff802185e08400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +================================================================== +Disabling lock debugging due to kernel taint + +Fixes: a25d13cbe816 ("RDMA/hns: Add the interfaces to support multi hop addressing for the contexts in hip08") + +Signed-off-by: Xi Wang +Link: https://lore.kernel.org/r/1565343666-73193-6-git-send-email-oulijun@huawei.com +Signed-off-by: Doug Ledford +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/hns/hns_roce_hem.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +--- a/drivers/infiniband/hw/hns/hns_roce_hem.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c +@@ -59,12 +59,13 @@ bool hns_roce_check_whether_mhop(struct + EXPORT_SYMBOL_GPL(hns_roce_check_whether_mhop); + + static bool hns_roce_check_hem_null(struct hns_roce_hem **hem, u64 start_idx, +- u32 bt_chunk_num) ++ u32 bt_chunk_num, u64 hem_max_num) + { +- int i; ++ u64 check_max_num = start_idx + bt_chunk_num; ++ u64 i; + +- for (i = 0; i < bt_chunk_num; i++) +- if (hem[start_idx + i]) ++ for (i = start_idx; (i < check_max_num) && (i < hem_max_num); i++) ++ if (hem[i]) + return false; + + return true; +@@ -459,6 +460,12 @@ static int hns_roce_table_mhop_get(struc + return -EINVAL; + } + ++ if (unlikely(hem_idx >= table->num_hem)) { ++ dev_err(dev, "Table %d exceed hem limt idx = %llu,max = %lu!\n", ++ table->type, hem_idx, table->num_hem); ++ return -EINVAL; ++ } ++ + mutex_lock(&table->mutex); + + if (table->hem[hem_idx]) { +@@ -696,7 +703,7 @@ static void hns_roce_table_mhop_put(stru + if (check_whether_bt_num_2(table->type, hop_num)) { + start_idx = mhop.l0_idx * chunk_ba_num; + if (hns_roce_check_hem_null(table->hem, start_idx, +- chunk_ba_num)) { ++ chunk_ba_num, table->num_hem)) { + if (table->type < HEM_TYPE_MTT && + hr_dev->hw->clear_hem(hr_dev, table, obj, 0)) + dev_warn(dev, "Clear HEM base address failed.\n"); +@@ -710,7 +717,7 @@ static void hns_roce_table_mhop_put(stru + start_idx = mhop.l0_idx * chunk_ba_num * chunk_ba_num + + mhop.l1_idx * chunk_ba_num; + if (hns_roce_check_hem_null(table->hem, start_idx, +- chunk_ba_num)) { ++ chunk_ba_num, table->num_hem)) { + if (hr_dev->hw->clear_hem(hr_dev, table, obj, 1)) + dev_warn(dev, "Clear HEM base address failed.\n"); + diff --git a/patches.suse/RDMA-hns-Fix-cmdq-parameter-of-querying-pf-timer-res.patch b/patches.suse/RDMA-hns-Fix-cmdq-parameter-of-querying-pf-timer-res.patch new file mode 100644 index 0000000..9bdce13 --- /dev/null +++ b/patches.suse/RDMA-hns-Fix-cmdq-parameter-of-querying-pf-timer-res.patch @@ -0,0 +1,70 @@ +From: Lang Cheng +Date: Fri, 8 May 2020 17:45:52 +0800 +Subject: RDMA/hns: Fix cmdq parameter of querying pf timer resource +Patch-mainline: v5.8-rc1 +Git-commit: 441c88d5b3ff80108ff536c6cf80591187015403 +References: bsc#1104427 FATE#326416 bsc#1126206 + +The firmware has reduced the number of descriptions of command +HNS_ROCE_OPC_QUERY_PF_TIMER_RES to 1. The driver needs to adapt, otherwise +the hardware will report error 4(CMD_NEXT_ERR). + +Fixes: 0e40dc2f70cd ("RDMA/hns: Add timer allocation support for hip08") +Link: https://lore.kernel.org/r/1588931159-56875-3-git-send-email-liweihang@huawei.com +Signed-off-by: Lang Cheng +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 32 ++++++++++------------------- + 1 file changed, 12 insertions(+), 20 deletions(-) + +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -1349,34 +1349,26 @@ static int hns_roce_query_pf_resource(st + static int hns_roce_query_pf_timer_resource(struct hns_roce_dev *hr_dev) + { + struct hns_roce_pf_timer_res_a *req_a; +- struct hns_roce_cmq_desc desc[2]; +- int ret, i; ++ struct hns_roce_cmq_desc desc; ++ int ret; + +- for (i = 0; i < 2; i++) { +- hns_roce_cmq_setup_basic_desc(&desc[i], +- HNS_ROCE_OPC_QUERY_PF_TIMER_RES, +- true); ++ hns_roce_cmq_setup_basic_desc(&desc, HNS_ROCE_OPC_QUERY_PF_TIMER_RES, ++ true); + +- if (i == 0) +- desc[i].flag |= cpu_to_le16(HNS_ROCE_CMD_FLAG_NEXT); +- else +- desc[i].flag &= ~cpu_to_le16(HNS_ROCE_CMD_FLAG_NEXT); +- } +- +- ret = hns_roce_cmq_send(hr_dev, desc, 2); ++ ret = hns_roce_cmq_send(hr_dev, &desc, 1); + if (ret) + return ret; + +- req_a = (struct hns_roce_pf_timer_res_a *)desc[0].data; ++ req_a = (struct hns_roce_pf_timer_res_a *)desc.data; + + hr_dev->caps.qpc_timer_bt_num = +- roce_get_field(req_a->qpc_timer_bt_idx_num, +- PF_RES_DATA_1_PF_QPC_TIMER_BT_NUM_M, +- PF_RES_DATA_1_PF_QPC_TIMER_BT_NUM_S); ++ roce_get_field(req_a->qpc_timer_bt_idx_num, ++ PF_RES_DATA_1_PF_QPC_TIMER_BT_NUM_M, ++ PF_RES_DATA_1_PF_QPC_TIMER_BT_NUM_S); + hr_dev->caps.cqc_timer_bt_num = +- roce_get_field(req_a->cqc_timer_bt_idx_num, +- PF_RES_DATA_2_PF_CQC_TIMER_BT_NUM_M, +- PF_RES_DATA_2_PF_CQC_TIMER_BT_NUM_S); ++ roce_get_field(req_a->cqc_timer_bt_idx_num, ++ PF_RES_DATA_2_PF_CQC_TIMER_BT_NUM_M, ++ PF_RES_DATA_2_PF_CQC_TIMER_BT_NUM_S); + + return 0; + } diff --git a/patches.suse/RDMA-hns-Fix-missing-sq_sig_type-when-querying-QP.patch b/patches.suse/RDMA-hns-Fix-missing-sq_sig_type-when-querying-QP.patch new file mode 100644 index 0000000..d1d794a --- /dev/null +++ b/patches.suse/RDMA-hns-Fix-missing-sq_sig_type-when-querying-QP.patch @@ -0,0 +1,29 @@ +From: Weihang Li +Date: Sat, 19 Sep 2020 18:03:22 +0800 +Subject: RDMA/hns: Fix missing sq_sig_type when querying QP +Patch-mainline: v5.10-rc1 +Git-commit: 05df49279f8926178ecb3ce88e61b63104cd6293 +References: bsc#1104427 FATE#326416 + +The sq_sig_type field should be filled when querying QP, or the users may +get a wrong value. + +Fixes: 926a01dc000d ("RDMA/hns: Add QP operations support for hip08 SoC") +Link: https://lore.kernel.org/r/1600509802-44382-9-git-send-email-liweihang@huawei.com +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -4567,6 +4567,7 @@ done: + } + + qp_init_attr->cap = qp_attr->cap; ++ qp_init_attr->sq_sig_type = hr_qp->sq_signal_bits; + + out: + mutex_unlock(&hr_qp->mutex); diff --git a/patches.suse/RDMA-hns-bugfix-for-slab-out-of-bounds-when-loading-.patch b/patches.suse/RDMA-hns-bugfix-for-slab-out-of-bounds-when-loading-.patch new file mode 100644 index 0000000..5187d19 --- /dev/null +++ b/patches.suse/RDMA-hns-bugfix-for-slab-out-of-bounds-when-loading-.patch @@ -0,0 +1,119 @@ +From: Xi Wang +Date: Fri, 9 Aug 2019 17:41:03 +0800 +Subject: RDMA/hns: bugfix for slab-out-of-bounds when loading hip08 driver +Patch-mainline: v5.4-rc1 +Git-commit: bf8c02f961c89e5ccae5987b7ab28f5592a35101 +References: bsc#1104427 FATE#326416 + +kasan will report a BUG when run command 'insmod hns_roce_hw_v2.ko', the +calltrace is as follows: + +================================================================== +BUG: KASAN: slab-out-of-bounds in hns_roce_v2_init_eq_table+0x1324/0x1948 +[hns_roce_hw_v2] +Read of size 8 at addr ffff8020e7a10608 by task insmod/256 + +CPU: 0 PID: 256 Comm: insmod Tainted: G O 5.2.0-rc4 #1 +Hardware name: Huawei D06 /D06, BIOS Hisilicon D06 UEFI RC0 +Call trace: +dump_backtrace+0x0/0x1e8 +show_stack+0x14/0x20 +dump_stack+0xc4/0xfc +print_address_description+0x60/0x270 +__kasan_report+0x164/0x1b8 +kasan_report+0xc/0x18 +__asan_load8+0x84/0xa8 +hns_roce_v2_init_eq_table+0x1324/0x1948 [hns_roce_hw_v2] +hns_roce_init+0xf8/0xfe0 [hns_roce] +__hns_roce_hw_v2_init_instance+0x284/0x330 [hns_roce_hw_v2] +hns_roce_hw_v2_init_instance+0xd0/0x1b8 [hns_roce_hw_v2] +hclge_init_roce_client_instance+0x180/0x310 [hclge] +hclge_init_client_instance+0xcc/0x508 [hclge] +hnae3_init_client_instance.part.3+0x3c/0x80 [hnae3] +hnae3_register_client+0x134/0x1a8 [hnae3] +hns_roce_hw_v2_init+0x14/0x10000 [hns_roce_hw_v2] +do_one_initcall+0x9c/0x3e0 +do_init_module+0xd4/0x2d8 +load_module+0x3284/0x3690 +__se_sys_init_module+0x274/0x308 +__arm64_sys_init_module+0x40/0x50 +el0_svc_handler+0xbc/0x210 +el0_svc+0x8/0xc + +Allocated by task 256: +__kasan_kmalloc.isra.0+0xd0/0x180 +kasan_kmalloc+0xc/0x18 +__kmalloc+0x16c/0x328 +hns_roce_v2_init_eq_table+0x764/0x1948 [hns_roce_hw_v2] +hns_roce_init+0xf8/0xfe0 [hns_roce] +__hns_roce_hw_v2_init_instance+0x284/0x330 [hns_roce_hw_v2] +hns_roce_hw_v2_init_instance+0xd0/0x1b8 [hns_roce_hw_v2] +hclge_init_roce_client_instance+0x180/0x310 [hclge] +hclge_init_client_instance+0xcc/0x508 [hclge] +hnae3_init_client_instance.part.3+0x3c/0x80 [hnae3] +hnae3_register_client+0x134/0x1a8 [hnae3] +hns_roce_hw_v2_init+0x14/0x10000 [hns_roce_hw_v2] +do_one_initcall+0x9c/0x3e0 +do_init_module+0xd4/0x2d8 +load_module+0x3284/0x3690 +__se_sys_init_module+0x274/0x308 +__arm64_sys_init_module+0x40/0x50 +el0_svc_handler+0xbc/0x210 +el0_svc+0x8/0xc + +Freed by task 0: +(stack is not available) + +The buggy address belongs to the object at ffff8020e7a10600 +which belongs to the cache kmalloc-128 of size 128 +The buggy address is located 8 bytes inside of +128-byte region [ffff8020e7a10600, ffff8020e7a10680) +The buggy address belongs to the page: +page:ffff7fe00839e840 refcount:1 mapcount:0 mapping:ffff802340020200 index:0x0 +flags: 0x5fffe00000000200(slab) +raw: 5fffe00000000200 dead000000000100 dead000000000200 ffff802340020200 +raw: 0000000000000000 0000000081000100 00000001ffffffff 0000000000000000 +page dumped because: kasan: bad access detected + +Memory state around the buggy address: +ffff8020e7a10500: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc +ffff8020e7a10580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +>ffff8020e7a10600: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +^ +ffff8020e7a10680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +ffff8020e7a10700: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +================================================================== +Disabling lock debugging due to kernel taint + +Fixes: a5073d6054f7 ("RDMA/hns: Add eq support of hip08") + +Signed-off-by: Xi Wang +Link: https://lore.kernel.org/r/1565343666-73193-7-git-send-email-oulijun@huawei.com +Signed-off-by: Doug Ledford +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -5481,7 +5481,8 @@ static int hns_roce_mhop_alloc_eq(struct + break; + } + eq->cur_eqe_ba = eq->buf_dma[0]; +- eq->nxt_eqe_ba = eq->buf_dma[1]; ++ if (ba_num > 1) ++ eq->nxt_eqe_ba = eq->buf_dma[1]; + + } else if (mhop_num == 2) { + /* alloc L1 BT and buf */ +@@ -5522,7 +5523,8 @@ static int hns_roce_mhop_alloc_eq(struct + break; + } + eq->cur_eqe_ba = eq->buf_dma[0]; +- eq->nxt_eqe_ba = eq->buf_dma[1]; ++ if (ba_num > 1) ++ eq->nxt_eqe_ba = eq->buf_dma[1]; + } + + eq->l0_last_num = i + 1; diff --git a/patches.suse/RDMA-iw_cxgb4-Fix-incorrect-function-parameters.patch b/patches.suse/RDMA-iw_cxgb4-Fix-incorrect-function-parameters.patch new file mode 100644 index 0000000..1792339 --- /dev/null +++ b/patches.suse/RDMA-iw_cxgb4-Fix-incorrect-function-parameters.patch @@ -0,0 +1,44 @@ +From: Potnuri Bharat Teja +Date: Tue, 12 May 2020 00:26:08 +0530 +Subject: RDMA/iw_cxgb4: Fix incorrect function parameters +Patch-mainline: v5.7-rc6 +Git-commit: c8b1f340e54158662acfa41d6dee274846370282 +References: bsc#1136348 jsc#SLE-4684 + +While reading the TCB field in t4_tcb_get_field32() the wrong mask is +passed as a parameter which leads the driver eventually to a kernel +panic/app segfault from access to an illegal SRQ index while flushing the +SRQ completions during connection teardown. + +Fixes: 11a27e2121a5 ("iw_cxgb4: complete the cached SRQ buffers") +Link: https://lore.kernel.org/r/20200511185608.5202-1-bharat@chelsio.com +Signed-off-by: Potnuri Bharat Teja +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/cxgb4/cm.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -2889,8 +2889,7 @@ static int peer_abort(struct c4iw_dev *d + srqidx = ABORT_RSS_SRQIDX_G( + be32_to_cpu(req->srqidx_status)); + if (srqidx) { +- complete_cached_srq_buffers(ep, +- req->srqidx_status); ++ complete_cached_srq_buffers(ep, srqidx); + } else { + /* Hold ep ref until finish_peer_abort() */ + c4iw_get_ep(&ep->com); +@@ -3865,8 +3864,8 @@ static int read_tcb_rpl(struct c4iw_dev + return 0; + } + +- ep->srqe_idx = t4_tcb_get_field32(tcb, TCB_RQ_START_W, TCB_RQ_START_W, +- TCB_RQ_START_S); ++ ep->srqe_idx = t4_tcb_get_field32(tcb, TCB_RQ_START_W, TCB_RQ_START_M, ++ TCB_RQ_START_S); + cleanup: + pr_debug("ep %p tid %u %016x\n", ep, ep->hwtid, ep->srqe_idx); + diff --git a/patches.suse/RDMA-iw_cxgb4-initiate-CLOSE-when-entering-TERM.patch b/patches.suse/RDMA-iw_cxgb4-initiate-CLOSE-when-entering-TERM.patch new file mode 100644 index 0000000..61a3b0d --- /dev/null +++ b/patches.suse/RDMA-iw_cxgb4-initiate-CLOSE-when-entering-TERM.patch @@ -0,0 +1,67 @@ +From: Krishnamraju Eraparaju +Date: Tue, 4 Feb 2020 14:42:30 +0530 +Subject: RDMA/iw_cxgb4: initiate CLOSE when entering TERM +Patch-mainline: v5.6-rc2 +Git-commit: d219face9059f38ad187bde133451a2a308fdb7c +References: bsc#1136348 jsc#SLE-4684 + +As per draft-hilland-iwarp-verbs-v1.0, sec 6.2.3, always initiate a CLOSE +when entering into TERM state. + +In c4iw_modify_qp(), disconnect operation should only be performed when +the modify_qp call is invoked from ib_core. And all other internal +modify_qp calls(invoked within iw_cxgb4) that needs 'disconnect' should +call c4iw_ep_disconnect() explicitly after modify_qp. Otherwise, deadlocks +like below can occur: + + Call Trace: + schedule+0x2f/0xa0 + schedule_preempt_disabled+0xa/0x10 + __mutex_lock.isra.5+0x2d0/0x4a0 + c4iw_ep_disconnect+0x39/0x430 => tries to reacquire ep lock again + c4iw_modify_qp+0x468/0x10d0 + rx_data+0x218/0x570 => acquires ep lock + process_work+0x5f/0x70 + process_one_work+0x1a7/0x3b0 + worker_thread+0x30/0x390 + kthread+0x112/0x130 + ret_from_fork+0x35/0x40 + +Fixes: d2c33370ae73 ("RDMA/iw_cxgb4: Always disconnect when QP is transitioning to TERMINATE state") +Link: https://lore.kernel.org/r/20200204091230.7210-1-krishna2@chelsio.com +Signed-off-by: Krishnamraju Eraparaju +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/cxgb4/cm.c | 4 ++++ + drivers/infiniband/hw/cxgb4/qp.c | 4 ++-- + 2 files changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -3034,6 +3034,10 @@ static int terminate(struct c4iw_dev *de + C4IW_QP_ATTR_NEXT_STATE, &attrs, 1); + } + ++ /* As per draft-hilland-iwarp-verbs-v1.0, sec 6.2.3, ++ * when entering the TERM state the RNIC MUST initiate a CLOSE. ++ */ ++ c4iw_ep_disconnect(ep, 1, GFP_KERNEL); + c4iw_put_ep(&ep->com); + } else + pr_warn("TERM received tid %u no ep/qp\n", tid); +--- a/drivers/infiniband/hw/cxgb4/qp.c ++++ b/drivers/infiniband/hw/cxgb4/qp.c +@@ -1948,10 +1948,10 @@ int c4iw_modify_qp(struct c4iw_dev *rhp, + qhp->attr.layer_etype = attrs->layer_etype; + qhp->attr.ecode = attrs->ecode; + ep = qhp->ep; +- c4iw_get_ep(&ep->com); +- disconnect = 1; + if (!internal) { ++ c4iw_get_ep(&ep->com); + terminate = 1; ++ disconnect = 1; + } else { + terminate = qhp->attr.send_term; + ret = rdma_fini(rhp, qhp, ep); diff --git a/patches.suse/RDMA-mlx5-Add-init2init-as-a-modify-command.patch b/patches.suse/RDMA-mlx5-Add-init2init-as-a-modify-command.patch new file mode 100644 index 0000000..af24f26 --- /dev/null +++ b/patches.suse/RDMA-mlx5-Add-init2init-as-a-modify-command.patch @@ -0,0 +1,32 @@ +From: Aharon Landau +Date: Wed, 13 May 2020 12:55:50 +0300 +Subject: RDMA/mlx5: Add init2init as a modify command +Patch-mainline: v5.8-rc1 +Git-commit: 819f7427bafd494ef7ca4942ec6322db20722d7b +References: bsc#1103991 FATE#326007 + +Missing INIT2INIT entry in the list of modify commands caused DEVX +applications to be unable to modify_qp for this transition state. Add the +MLX5_CMD_OP_INIT2INIT_QP opcode to the list of allowed DEVX opcodes. + +Fixes: e662e14d801b ("IB/mlx5: Add DEVX support for modify and query commands") +Link: https://lore.kernel.org/r/20200513095550.211345-1-leon@kernel.org +Signed-off-by: Aharon Landau +Reviewed-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/mlx5/devx.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/infiniband/hw/mlx5/devx.c ++++ b/drivers/infiniband/hw/mlx5/devx.c +@@ -496,6 +496,7 @@ static bool devx_is_obj_modify_cmd(const + case MLX5_CMD_OP_SET_L2_TABLE_ENTRY: + case MLX5_CMD_OP_RST2INIT_QP: + case MLX5_CMD_OP_INIT2RTR_QP: ++ case MLX5_CMD_OP_INIT2INIT_QP: + case MLX5_CMD_OP_RTR2RTS_QP: + case MLX5_CMD_OP_RTS2RTS_QP: + case MLX5_CMD_OP_SQERR2RTS_QP: diff --git a/patches.suse/RDMA-mlx5-Fix-typo-in-enum-name.patch b/patches.suse/RDMA-mlx5-Fix-typo-in-enum-name.patch new file mode 100644 index 0000000..240485b --- /dev/null +++ b/patches.suse/RDMA-mlx5-Fix-typo-in-enum-name.patch @@ -0,0 +1,29 @@ +From: Pavel Machek +Date: Fri, 24 Jul 2020 10:41:12 +0200 +Subject: RDMA/mlx5: Fix typo in enum name +Patch-mainline: v5.9-rc1 +Git-commit: 8b603d0715a372f5827d3a6b19d9568bf854b687 +References: bsc#1103991 FATE#326007 + +Nnothing uses the enum name, so this is harmless. + +Fixes: 322694412400 ("IB/mlx5: Introduce driver create and destroy flow methods") +Link: https://lore.kernel.org/r/20200724084112.GC31930@amd +Signed-off-by: Pavel Machek (CIP) +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + include/uapi/rdma/mlx5_user_ioctl_cmds.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/uapi/rdma/mlx5_user_ioctl_cmds.h ++++ b/include/uapi/rdma/mlx5_user_ioctl_cmds.h +@@ -160,7 +160,7 @@ enum mlx5_ib_create_flow_attrs { + MLX5_IB_ATTR_CREATE_FLOW_TAG, + }; + +-enum mlx5_ib_destoy_flow_attrs { ++enum mlx5_ib_destroy_flow_attrs { + MLX5_IB_ATTR_DESTROY_FLOW_HANDLE = (1U << UVERBS_ID_NS_SHIFT), + }; + diff --git a/patches.suse/RDMA-mlx5-Fix-wrong-free-of-blue-flame-register-on-e.patch b/patches.suse/RDMA-mlx5-Fix-wrong-free-of-blue-flame-register-on-e.patch new file mode 100644 index 0000000..57e109a --- /dev/null +++ b/patches.suse/RDMA-mlx5-Fix-wrong-free-of-blue-flame-register-on-e.patch @@ -0,0 +1,33 @@ +From: Mark Bloch +Date: Wed, 13 Jan 2021 14:17:03 +0200 +Subject: RDMA/mlx5: Fix wrong free of blue flame register on error +Patch-mainline: v5.11-rc4 +Git-commit: 1c3aa6bd0b823105c2030af85d92d158e815d669 +References: bsc#1103991 FATE#326007 + +If the allocation of the fast path blue flame register fails, the driver +should free the regular blue flame register allocated a statement above, +not the one that it just failed to allocate. + +Fixes: 16c1975f1032 ("IB/mlx5: Create profile infrastructure to add and remove stages") +Link: https://lore.kernel.org/r/20210113121703.559778-6-leon@kernel.org +Reported-by: Hans Petter Selasky +Signed-off-by: Mark Bloch +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/mlx5/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -6080,7 +6080,7 @@ int mlx5_ib_stage_bfrag_init(struct mlx5 + + err = mlx5_alloc_bfreg(dev->mdev, &dev->fp_bfreg, false, true); + if (err) +- mlx5_free_bfreg(dev->mdev, &dev->fp_bfreg); ++ mlx5_free_bfreg(dev->mdev, &dev->bfreg); + + return err; + } diff --git a/patches.suse/RDMA-qedr-Fix-inline-size-returned-for-iWARP.patch b/patches.suse/RDMA-qedr-Fix-inline-size-returned-for-iWARP.patch new file mode 100644 index 0000000..e9b6195 --- /dev/null +++ b/patches.suse/RDMA-qedr-Fix-inline-size-returned-for-iWARP.patch @@ -0,0 +1,33 @@ +From: Michal Kalderon +Date: Wed, 2 Sep 2020 19:57:40 +0300 +Subject: RDMA/qedr: Fix inline size returned for iWARP +Patch-mainline: v5.10-rc1 +Git-commit: fbf58026b2256e9cd5f241a4801d79d3b2b7b89d +References: bsc#1050545 FATE#322893 + +commit 59e8970b3798 ("RDMA/qedr: Return max inline data in QP query +result") changed query_qp max_inline size to return the max roce inline +size. When iwarp was introduced, this should have been modified to return +the max inline size based on protocol. This size is cached in the device +attributes + +Fixes: 69ad0e7fe845 ("RDMA/qedr: Add support for iWARP in user space") +Link: https://lore.kernel.org/r/20200902165741.8355-8-michal.kalderon@marvell.com +Signed-off-by: Michal Kalderon +Signed-off-by: Jason Gunthorpe +Acked-by: Thomas Bogendoerfer +--- + drivers/infiniband/hw/qedr/verbs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -2505,7 +2505,7 @@ int qedr_query_qp(struct ib_qp *ibqp, + qp_attr->cap.max_recv_wr = qp->rq.max_wr; + qp_attr->cap.max_send_sge = qp->sq.max_sges; + qp_attr->cap.max_recv_sge = qp->rq.max_sges; +- qp_attr->cap.max_inline_data = ROCE_REQ_MAX_INLINE_DATA_SIZE; ++ qp_attr->cap.max_inline_data = dev->attr.max_inline; + qp_init_attr->cap = qp_attr->cap; + + qp_attr->ah_attr.type = RDMA_AH_ATTR_TYPE_ROCE; diff --git a/patches.suse/Revert-crypto-chelsio-Inline-single-pdu-only.patch b/patches.suse/Revert-crypto-chelsio-Inline-single-pdu-only.patch new file mode 100644 index 0000000..aa8f6ed --- /dev/null +++ b/patches.suse/Revert-crypto-chelsio-Inline-single-pdu-only.patch @@ -0,0 +1,49 @@ +From: Ayush Sawal +Date: Wed, 6 May 2020 20:17:19 +0530 +Subject: Revert "crypto: chelsio - Inline single pdu only" +Patch-mainline: v5.8-rc1 +Git-commit: 857b412511c87ed7137e63b90b2de020c24660e9 +References: git-fixes + +This reverts commit 27c6feb0fb33a665a746346e76714826a5be5d10. + +For ipsec offload the chelsio's ethernet driver expects a single mtu +sized packet. + +But when ipsec traffic is running using iperf, most of the packets in +that traffic are gso packets(large sized skbs) because GSO is enabled by +default in TCP, due to this commit 0a6b2a1dc2a2 ("tcp: switch to GSO +being always on"), so chcr_ipsec_offload_ok() receives a gso +skb(with gso_size non zero). + +Due to the check in chcr_ipsec_offload_ok(), this function returns false +for most of the packet, then ipsec offload is skipped and the skb goes +out taking the coprocessor path which reduces the bandwidth for inline +ipsec. + +If this check is removed then for most of the packets(large sized skbs) +the chcr_ipsec_offload_ok() returns true and then as GSO is on, the +segmentation of the packet happens in the kernel and then finally the +driver_xmit is called, which receives a segmented mtu sized packet which +is what the driver expects for ipsec offload. So this case becomes +unnecessary here, therefore removing it. + +Signed-off-by: Ayush Sawal +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/crypto/chelsio/chcr_ipsec.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/crypto/chelsio/chcr_ipsec.c ++++ b/drivers/crypto/chelsio/chcr_ipsec.c +@@ -301,9 +301,6 @@ static bool chcr_ipsec_offload_ok(struct + if (ipv6_ext_hdr(ipv6_hdr(skb)->nexthdr)) + return false; + } +- /* Inline single pdu */ +- if (skb_shinfo(skb)->gso_size) +- return false; + return true; + } + diff --git a/patches.suse/USB-ehci-fix-an-interrupt-calltrace-error.patch b/patches.suse/USB-ehci-fix-an-interrupt-calltrace-error.patch new file mode 100644 index 0000000..85e6cfd --- /dev/null +++ b/patches.suse/USB-ehci-fix-an-interrupt-calltrace-error.patch @@ -0,0 +1,53 @@ +From 643a4df7fe3f6831d14536fd692be85f92670a52 Mon Sep 17 00:00:00 2001 +From: Longfang Liu +Date: Tue, 12 Jan 2021 09:57:27 +0800 +Subject: [PATCH] USB: ehci: fix an interrupt calltrace error +Git-commit: 643a4df7fe3f6831d14536fd692be85f92670a52 +Patch-mainline: v5.11-rc5 +References: git-fixes + +The system that use Synopsys USB host controllers goes to suspend +when using USB audio player. This causes the USB host controller +continuous send interrupt signal to system, When the number of +interrupts exceeds 100000, the system will forcibly close the +interrupts and output a calltrace error. + +When the system goes to suspend, the last interrupt is reported to +the driver. At this time, the system has set the state to suspend. +This causes the last interrupt to not be processed by the system and +not clear the interrupt flag. This uncleared interrupt flag constantly +triggers new interrupt event. This causing the driver to receive more +than 100,000 interrupts, which causes the system to forcibly close the +interrupt report and report the calltrace error. + +so, when the driver goes to sleep and changes the system state to +suspend, the interrupt flag needs to be cleared. + +Signed-off-by: Longfang Liu +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/1610416647-45774-1-git-send-email-liulongfang@huawei.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/host/ehci-hub.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c +index 087402aec5cb..9f9ab5ccea88 100644 +--- a/drivers/usb/host/ehci-hub.c ++++ b/drivers/usb/host/ehci-hub.c +@@ -345,6 +345,9 @@ static int ehci_bus_suspend (struct usb_hcd *hcd) + + unlink_empty_async_suspended(ehci); + ++ /* Some Synopsys controllers mistakenly leave IAA turned on */ ++ ehci_writel(ehci, STS_IAA, &ehci->regs->status); ++ + /* Any IAA cycle that started before the suspend is now invalid */ + end_iaa_cycle(ehci); + ehci_handle_start_intr_unlinks(ehci); +-- +2.26.2 + diff --git a/patches.suse/__netif_receive_skb_core-pass-skb-by-reference.patch b/patches.suse/__netif_receive_skb_core-pass-skb-by-reference.patch new file mode 100644 index 0000000..6c728f1 --- /dev/null +++ b/patches.suse/__netif_receive_skb_core-pass-skb-by-reference.patch @@ -0,0 +1,89 @@ +From: Boris Sukholitko +Date: Tue, 19 May 2020 10:32:37 +0300 +Subject: __netif_receive_skb_core: pass skb by reference +Patch-mainline: v5.7-rc7 +Git-commit: c0bbbdc32febd4f034ecbf3ea17865785b2c0652 +References: bsc#1109837 + +__netif_receive_skb_core may change the skb pointer passed into it (e.g. +in rx_handler). The original skb may be freed as a result of this +operation. + +The callers of __netif_receive_skb_core may further process original skb +by using pt_prev pointer returned by __netif_receive_skb_core thus +leading to unpleasant effects. + +The solution is to pass skb by reference into __netif_receive_skb_core. + +v2: Added Fixes tag and comment regarding ppt_prev and skb invariant. + +Fixes: 88eb1944e18c ("net: core: propagate SKB lists through packet_type lookup") +Signed-off-by: Boris Sukholitko +Acked-by: Edward Cree +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + net/core/dev.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -4732,11 +4732,12 @@ static inline int nf_ingress(struct sk_b + return 0; + } + +-static int __netif_receive_skb_core(struct sk_buff *skb, bool pfmemalloc, ++static int __netif_receive_skb_core(struct sk_buff **pskb, bool pfmemalloc, + struct packet_type **ppt_prev) + { + struct packet_type *ptype, *pt_prev; + rx_handler_func_t *rx_handler; ++ struct sk_buff *skb = *pskb; + struct net_device *orig_dev; + bool deliver_exact = false; + int ret = NET_RX_DROP; +@@ -4767,8 +4768,10 @@ another_round: + ret2 = do_xdp_generic(rcu_dereference(skb->dev->xdp_prog), skb); + preempt_enable(); + +- if (ret2 != XDP_PASS) +- return NET_RX_DROP; ++ if (ret2 != XDP_PASS) { ++ ret = NET_RX_DROP; ++ goto out; ++ } + skb_reset_mac_len(skb); + } + +@@ -4890,6 +4893,13 @@ drop: + } + + out: ++ /* The invariant here is that if *ppt_prev is not NULL ++ * then skb should also be non-NULL. ++ * ++ * Apparently *ppt_prev assignment above holds this invariant due to ++ * skb dereferencing near it. ++ */ ++ *pskb = skb; + return ret; + } + +@@ -4899,7 +4909,7 @@ static int __netif_receive_skb_one_core( + struct packet_type *pt_prev = NULL; + int ret; + +- ret = __netif_receive_skb_core(skb, pfmemalloc, &pt_prev); ++ ret = __netif_receive_skb_core(&skb, pfmemalloc, &pt_prev); + if (pt_prev) + ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev); + return ret; +@@ -4975,7 +4985,7 @@ static void __netif_receive_skb_list_cor + struct packet_type *pt_prev = NULL; + + skb_list_del_init(skb); +- __netif_receive_skb_core(skb, pfmemalloc, &pt_prev); ++ __netif_receive_skb_core(&skb, pfmemalloc, &pt_prev); + if (!pt_prev) + continue; + if (pt_curr != pt_prev || od_curr != orig_dev) { diff --git a/patches.suse/bnxt_en-Don-t-query-FW-when-netif_running-is-false.patch b/patches.suse/bnxt_en-Don-t-query-FW-when-netif_running-is-false.patch new file mode 100644 index 0000000..6828d41 --- /dev/null +++ b/patches.suse/bnxt_en-Don-t-query-FW-when-netif_running-is-false.patch @@ -0,0 +1,33 @@ +From: Pavan Chebbi +Date: Wed, 26 Aug 2020 01:08:32 -0400 +Subject: bnxt_en: Don't query FW when netif_running() is false. +Patch-mainline: v5.9-rc4 +Git-commit: c1c2d77408022a398a1a7c51cf20488c922629de +References: bsc#1086282 FATE#324873 + +In rare conditions like two stage OS installation, the +ethtool's get_channels function may be called when the +device is in D3 state, leading to uncorrectable PCI error. +Check netif_running() first before making any query to FW +which involves writing to BAR. + +Fixes: db4723b3cd2d ("bnxt_en: Check max_tx_scheduler_inputs value from firmware.") +Signed-off-by: Pavan Chebbi +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -687,7 +687,7 @@ static void bnxt_get_channels(struct net + int max_tx_sch_inputs; + + /* Get the most up-to-date max_tx_sch_inputs. */ +- if (BNXT_NEW_RM(bp)) ++ if (netif_running(dev) && BNXT_NEW_RM(bp)) + bnxt_hwrm_func_resc_qcaps(bp, false); + max_tx_sch_inputs = hw_resc->max_tx_sch_inputs; + diff --git a/patches.suse/bnxt_en-Fix-accumulation-of-bp-net_stats_prev.patch b/patches.suse/bnxt_en-Fix-accumulation-of-bp-net_stats_prev.patch new file mode 100644 index 0000000..f5b0eaa --- /dev/null +++ b/patches.suse/bnxt_en-Fix-accumulation-of-bp-net_stats_prev.patch @@ -0,0 +1,38 @@ +From: Michael Chan +Date: Mon, 25 May 2020 17:41:17 -0400 +Subject: bnxt_en: Fix accumulation of bp->net_stats_prev. +Patch-mainline: v5.7 +Git-commit: b8056e8434b037fdab08158fea99ed7bc8ef3a74 +References: bsc#1104745 FATE#325918 + +We have logic to maintain network counters across resets by storing +the counters in bp->net_stats_prev before reset. But not all resets +will clear the counters. Certain resets that don't need to change +the number of rings do not clear the counters. The current logic +accumulates the counters before all resets, causing big jumps in +the counters after some resets, such as ethtool -G. + +Fix it by only accumulating the counters during reset if the irq_re_init +parameter is set. The parameter signifies that all rings and interrupts +will be reset and that means that the counters will also be reset. + +Reported-by: Vijayendra Suman +Fixes: b8875ca356f1 ("bnxt_en: Save ring statistics before reset.") +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -8639,7 +8639,7 @@ static void __bnxt_close_nic(struct bnxt + bnxt_free_skbs(bp); + + /* Save ring stats before shutdown */ +- if (bp->bnapi) ++ if (bp->bnapi && irq_re_init) + bnxt_get_ring_stats(bp, &bp->net_stats_prev); + if (irq_re_init) { + bnxt_free_irq(bp); diff --git a/patches.suse/bnxt_en-Improve-stats-context-resource-accounting-wi.patch b/patches.suse/bnxt_en-Improve-stats-context-resource-accounting-wi.patch new file mode 100644 index 0000000..fe7b85f --- /dev/null +++ b/patches.suse/bnxt_en-Improve-stats-context-resource-accounting-wi.patch @@ -0,0 +1,50 @@ +From: Michael Chan +Date: Mon, 11 Jan 2021 04:26:39 -0500 +Subject: bnxt_en: Improve stats context resource accounting with RDMA driver + loaded. +Patch-mainline: v5.11-rc4 +Git-commit: 869c4d5eb1e6fbda66aa790c48bdb946d71494a0 +References: bsc#1104745 FATE#325918 + +The function bnxt_get_ulp_stat_ctxs() does not count the stats contexts +used by the RDMA driver correctly when the RDMA driver is freeing the +MSIX vectors. It assumes that if the RDMA driver is registered, the +additional stats contexts will be needed. This is not true when the +RDMA driver is about to unregister and frees the MSIX vectors. + +This slight error leads to over accouting of the stats contexts needed +after the RDMA driver has unloaded. This will cause some firmware +warning and error messages in dmesg during subsequent config. changes +or ifdown/ifup. + +Fix it by properly accouting for extra stats contexts only if the +RDMA driver is registered and MSIX vectors have been successfully +requested. + +Fixes: c027c6b4e91f ("bnxt_en: get rid of num_stat_ctxs variable") +Reviewed-by: Yongping Zhang +Reviewed-by: Pavan Chebbi +Signed-off-by: Michael Chan +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c +@@ -216,8 +216,12 @@ int bnxt_get_ulp_msix_base(struct bnxt * + + int bnxt_get_ulp_stat_ctxs(struct bnxt *bp) + { +- if (bnxt_ulp_registered(bp->edev, BNXT_ROCE_ULP)) +- return BNXT_MIN_ROCE_STAT_CTXS; ++ if (bnxt_ulp_registered(bp->edev, BNXT_ROCE_ULP)) { ++ struct bnxt_en_dev *edev = bp->edev; ++ ++ if (edev->ulp_tbl[BNXT_ROCE_ULP].msix_requested) ++ return BNXT_MIN_ROCE_STAT_CTXS; ++ } + + return 0; + } diff --git a/patches.suse/bnxt_en-Release-PCI-regions-when-DMA-mask-setup-fail.patch b/patches.suse/bnxt_en-Release-PCI-regions-when-DMA-mask-setup-fail.patch new file mode 100644 index 0000000..dc41177 --- /dev/null +++ b/patches.suse/bnxt_en-Release-PCI-regions-when-DMA-mask-setup-fail.patch @@ -0,0 +1,31 @@ +From: Michael Chan +Date: Fri, 20 Nov 2020 02:44:31 -0500 +Subject: bnxt_en: Release PCI regions when DMA mask setup fails during probe. +Patch-mainline: v5.10-rc6 +Git-commit: c54bc3ced5106663c2f2b44071800621f505b00e +References: git-fixes + +Jump to init_err_release to cleanup. bnxt_unmap_bars() will also be +called but it will do nothing if the BARs are not mapped yet. + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Reported-by: Jakub Kicinski +Signed-off-by: Michael Chan +Link: https://lore.kernel.org/r/1605858271-8209-1-git-send-email-michael.chan@broadcom.com +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -9551,7 +9551,7 @@ static int bnxt_init_board(struct pci_de + dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)) != 0) { + dev_err(&pdev->dev, "System does not support DMA, aborting\n"); + rc = -EIO; +- goto init_err_disable; ++ goto init_err_release; + } + + pci_set_master(pdev); diff --git a/patches.suse/bnxt_en-Reset-rings-if-ring-reservation-fails-during.patch b/patches.suse/bnxt_en-Reset-rings-if-ring-reservation-fails-during.patch new file mode 100644 index 0000000..9731b0c --- /dev/null +++ b/patches.suse/bnxt_en-Reset-rings-if-ring-reservation-fails-during.patch @@ -0,0 +1,35 @@ +From: Vasundhara Volam +Date: Sun, 22 Mar 2020 16:40:05 -0400 +Subject: bnxt_en: Reset rings if ring reservation fails during open() +Patch-mainline: v5.6 +Git-commit: 5d765a5e4bd7c368e564e11402bba74cf7f03ac1 +References: bsc#1086282 FATE#324873 + +If ring counts are not reset when ring reservation fails, +bnxt_init_dflt_ring_mode() will not be called again to reinitialise +IRQs when open() is called and results in system crash as napi will +also be not initialised. This patch fixes it by resetting the ring +counts. + +Fixes: 47558acd56a7 ("bnxt_en: Reserve rings at driver open if none was reserved at probe time.") +Signed-off-by: Vasundhara Volam +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -10370,6 +10370,10 @@ static int bnxt_set_dflt_rings(struct bn + bp->rx_nr_rings++; + bp->cp_nr_rings++; + } ++ if (rc) { ++ bp->tx_nr_rings = 0; ++ bp->rx_nr_rings = 0; ++ } + return rc; + } + diff --git a/patches.suse/bnxt_en-fix-HWRM-error-when-querying-VF-temperature.patch b/patches.suse/bnxt_en-fix-HWRM-error-when-querying-VF-temperature.patch new file mode 100644 index 0000000..0f58009 --- /dev/null +++ b/patches.suse/bnxt_en-fix-HWRM-error-when-querying-VF-temperature.patch @@ -0,0 +1,53 @@ +From: Edwin Peer +Date: Wed, 26 Aug 2020 01:08:37 -0400 +Subject: bnxt_en: fix HWRM error when querying VF temperature +Patch-mainline: v5.9-rc4 +Git-commit: 12cce90b934bf2b0ed9c339b4d5503e69954351a +References: bsc#1104745 FATE#325918 + +Firmware returns RESOURCE_ACCESS_DENIED for HWRM_TEMP_MONITORY_QUERY for +VFs. This produces unpleasing error messages in the log when temp1_input +is queried via the hwmon sysfs interface from a VF. + +The error is harmless and expected, so silence it and return unknown as +the value. Since the device temperature is not particularly sensitive +information, provide flexibility to change this policy in future by +silencing the error rather than avoiding the HWRM call entirely for VFs. + +Fixes: cde49a42a9bb ("bnxt_en: Add hwmon sysfs support to read temperature") +Cc: Marc Smith +Reported-by: Marc Smith +Signed-off-by: Edwin Peer +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -8306,16 +8306,19 @@ static ssize_t bnxt_show_temp(struct dev + struct hwrm_temp_monitor_query_input req = {0}; + struct hwrm_temp_monitor_query_output *resp; + struct bnxt *bp = dev_get_drvdata(dev); +- u32 temp = 0; ++ u32 len = 0; + + resp = bp->hwrm_cmd_resp_addr; + bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_TEMP_MONITOR_QUERY, -1, -1); + mutex_lock(&bp->hwrm_cmd_lock); +- if (!_hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT)) +- temp = resp->temp * 1000; /* display millidegree */ ++ if (!_hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT)) ++ len = sprintf(buf, "%u\n", resp->temp * 1000); /* display millidegree */ + mutex_unlock(&bp->hwrm_cmd_lock); + +- return sprintf(buf, "%u\n", temp); ++ if (len) ++ return len; ++ ++ return sprintf(buf, "unknown\n"); + } + static SENSOR_DEVICE_ATTR(temp1_input, 0444, bnxt_show_temp, NULL, 0); + diff --git a/patches.suse/bnxt_en-fix-error-return-code-in-bnxt_init_board.patch b/patches.suse/bnxt_en-fix-error-return-code-in-bnxt_init_board.patch new file mode 100644 index 0000000..cfe3157 --- /dev/null +++ b/patches.suse/bnxt_en-fix-error-return-code-in-bnxt_init_board.patch @@ -0,0 +1,31 @@ +From: Zhang Changzhong +Date: Thu, 19 Nov 2020 21:30:21 +0800 +Subject: bnxt_en: fix error return code in bnxt_init_board() +Patch-mainline: v5.10-rc6 +Git-commit: 3383176efc0fb0c0900a191026468a58668b4214 +References: git-fixes + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Reported-by: Hulk Robot +Signed-off-by: Zhang Changzhong +Reviewed-by: Edwin Peer +Link: https://lore.kernel.org/r/1605792621-6268-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -9550,6 +9550,7 @@ static int bnxt_init_board(struct pci_de + if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)) != 0 && + dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)) != 0) { + dev_err(&pdev->dev, "System does not support DMA, aborting\n"); ++ rc = -EIO; + goto init_err_disable; + } + diff --git a/patches.suse/bnxt_en-fix-error-return-code-in-bnxt_init_one.patch b/patches.suse/bnxt_en-fix-error-return-code-in-bnxt_init_one.patch new file mode 100644 index 0000000..957de56 --- /dev/null +++ b/patches.suse/bnxt_en-fix-error-return-code-in-bnxt_init_one.patch @@ -0,0 +1,31 @@ +From: Zhang Changzhong +Date: Wed, 18 Nov 2020 20:17:31 +0800 +Subject: bnxt_en: fix error return code in bnxt_init_one() +Patch-mainline: v5.10-rc6 +Git-commit: b5f796b62c98cd8c219c4b788ecb6e1218e648cb +References: bsc#1050242 FATE#322914 + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: c213eae8d3cd ("bnxt_en: Improve VF/PF link change logic.") +Reported-by: Hulk Robot +Signed-off-by: Zhang Changzhong +Reviewed-by: Edwin Peer +Link: https://lore.kernel.org/r/1605701851-20270-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -10694,6 +10694,7 @@ static int bnxt_init_one(struct pci_dev + create_singlethread_workqueue("bnxt_pf_wq"); + if (!bnxt_pf_wq) { + dev_err(&pdev->dev, "Unable to create workqueue.\n"); ++ rc = -ENOMEM; + goto init_err_pci_clean; + } + } diff --git a/patches.suse/bnxt_en-read-EEPROM-A2h-address-using-page-0.patch b/patches.suse/bnxt_en-read-EEPROM-A2h-address-using-page-0.patch new file mode 100644 index 0000000..6580fc8 --- /dev/null +++ b/patches.suse/bnxt_en-read-EEPROM-A2h-address-using-page-0.patch @@ -0,0 +1,34 @@ +From: Edwin Peer +Date: Sun, 15 Nov 2020 19:27:49 -0500 +Subject: bnxt_en: read EEPROM A2h address using page 0 +Patch-mainline: v5.10-rc5 +Git-commit: 4260330b32b14330cfe427d568ac5f5b29b5be3d +References: git-fixes + +The module eeprom address range returned by bnxt_get_module_eeprom() +should be 256 bytes of A0h address space, the lower half of the A2h +address space, and page 0 for the upper half of the A2h address space. + +Fix the firmware call by passing page_number 0 for the A2h slave address +space. + +Fixes: 42ee18fe4ca2 ("bnxt_en: Add Support for ETHTOOL_GMODULEINFO and ETHTOOL_GMODULEEEPRO") +Signed-off-by: Edwin Peer +Signed-off-by: Michael Chan +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -2514,7 +2514,7 @@ static int bnxt_get_module_eeprom(struct + /* Read A2 portion of the EEPROM */ + if (length) { + start -= ETH_MODULE_SFF_8436_LEN; +- rc = bnxt_read_sfp_module_eeprom_info(bp, I2C_DEV_ADDR_A2, 1, ++ rc = bnxt_read_sfp_module_eeprom_info(bp, I2C_DEV_ADDR_A2, 0, + start, length, data); + } + return rc; diff --git a/patches.suse/bnxt_en-return-proper-error-codes-in-bnxt_show_temp.patch b/patches.suse/bnxt_en-return-proper-error-codes-in-bnxt_show_temp.patch new file mode 100644 index 0000000..95a9b1a --- /dev/null +++ b/patches.suse/bnxt_en-return-proper-error-codes-in-bnxt_show_temp.patch @@ -0,0 +1,70 @@ +From: Edwin Peer +Date: Sun, 20 Sep 2020 21:08:55 -0400 +Subject: bnxt_en: return proper error codes in bnxt_show_temp +Patch-mainline: v5.9-rc7 +Git-commit: d69753fa1ecb3218b56b022722f7a5822735b876 +References: bsc#1104745 FATE#325918 + +Returning "unknown" as a temperature value violates the hwmon interface +rules. Appropriate error codes should be returned via device_attribute +show instead. These will ultimately be propagated to the user via the +file system interface. + +In addition to the corrected error handling, it is an even better idea to +not present the sensor in sysfs at all if it is known that the read will +definitely fail. Given that temp1_input is currently the only sensor +reported, ensure no hwmon registration if TEMP_MONITOR_QUERY is not +supported or if it will fail due to access permissions. Something smarter +may be needed if and when other sensors are added. + +Fixes: 12cce90b934b ("bnxt_en: fix HWRM error when querying VF temperature") +Signed-off-by: Edwin Peer +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -8307,18 +8307,16 @@ static ssize_t bnxt_show_temp(struct dev + struct hwrm_temp_monitor_query_output *resp; + struct bnxt *bp = dev_get_drvdata(dev); + u32 len = 0; ++ int rc; + + resp = bp->hwrm_cmd_resp_addr; + bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_TEMP_MONITOR_QUERY, -1, -1); + mutex_lock(&bp->hwrm_cmd_lock); +- if (!_hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT)) ++ rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT); ++ if (!rc) + len = sprintf(buf, "%u\n", resp->temp * 1000); /* display millidegree */ + mutex_unlock(&bp->hwrm_cmd_lock); +- +- if (len) +- return len; +- +- return sprintf(buf, "unknown\n"); ++ return rc ?: len; + } + static SENSOR_DEVICE_ATTR(temp1_input, 0444, bnxt_show_temp, NULL, 0); + +@@ -8338,7 +8336,16 @@ static void bnxt_hwmon_close(struct bnxt + + static void bnxt_hwmon_open(struct bnxt *bp) + { ++ struct hwrm_temp_monitor_query_input req = {0}; + struct pci_dev *pdev = bp->pdev; ++ int rc; ++ ++ bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_TEMP_MONITOR_QUERY, -1, -1); ++ rc = hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT); ++ if (rc == -EACCES || rc == -EOPNOTSUPP) { ++ bnxt_hwmon_close(bp); ++ return; ++ } + + bp->hwmon_dev = hwmon_device_register_with_groups(&pdev->dev, + DRV_MODULE_NAME, bp, diff --git a/patches.suse/bonding-set-dev-needed_headroom-in-bond_setup_by_sla.patch b/patches.suse/bonding-set-dev-needed_headroom-in-bond_setup_by_sla.patch new file mode 100644 index 0000000..9ce0bb3 --- /dev/null +++ b/patches.suse/bonding-set-dev-needed_headroom-in-bond_setup_by_sla.patch @@ -0,0 +1,64 @@ +From: Eric Dumazet +Date: Fri, 25 Sep 2020 06:38:07 -0700 +Subject: bonding: set dev->needed_headroom in bond_setup_by_slave() +Patch-mainline: v5.9 +Git-commit: f32f19339596b214c208c0dba716f4b6cc4f6958 +References: git-fixes + +syzbot managed to crash a host by creating a bond +with a GRE device. + +For non Ethernet device, bonding calls bond_setup_by_slave() +instead of ether_setup(), and unfortunately dev->needed_headroom +was not copied from the new added member. + +[ 171.243095] skbuff: skb_under_panic: text:ffffffffa184b9ea len:116 put:20 head:ffff883f84012dc0 data:ffff883f84012dbc tail:0x70 end:0xd00 dev:bond0 +[ 171.243111] ------------[ cut here ]------------ +[ 171.243112] kernel BUG at net/core/skbuff.c:112! +[ 171.243117] invalid opcode: 0000 [#1] SMP KASAN PTI +[ 171.243469] gsmi: Log Shutdown Reason 0x03 +[ 171.243505] Call Trace: +[ 171.243506] +[ 171.243512] [] skb_push+0x49/0x50 +[ 171.243516] [] ipgre_header+0x2a/0xf0 +[ 171.243520] [] neigh_connected_output+0xb7/0x100 +[ 171.243524] [] ip6_finish_output2+0x383/0x490 +[ 171.243528] [] __ip6_finish_output+0xa2/0x110 +[ 171.243531] [] ip6_finish_output+0x2c/0xa0 +[ 171.243534] [] ip6_output+0x69/0x110 +[ 171.243537] [] ? ip6_output+0x110/0x110 +[ 171.243541] [] mld_sendpack+0x1b2/0x2d0 +[ 171.243544] [] ? mld_send_report+0xf0/0xf0 +[ 171.243548] [] mld_ifc_timer_expire+0x2d7/0x3b0 +[ 171.243551] [] ? mld_gq_timer_expire+0x50/0x50 +[ 171.243556] [] call_timer_fn+0x30/0x130 +[ 171.243559] [] expire_timers+0x4c/0x110 +[ 171.243563] [] __run_timers+0x213/0x260 +[ 171.243566] [] ? ktime_get+0x3d/0xa0 +[ 171.243570] [] ? clockevents_program_event+0x7e/0xe0 +[ 171.243574] [] ? sched_clock_cpu+0x15/0x190 +[ 171.243577] [] run_timer_softirq+0x1d/0x40 +[ 171.243581] [] __do_softirq+0x152/0x2f0 +[ 171.243585] [] irq_exit+0x9f/0xb0 +[ 171.243588] [] smp_apic_timer_interrupt+0xfd/0x1a0 +[ 171.243591] [] apic_timer_interrupt+0x86/0x90 + +Fixes: f5184d267c1a ("net: Allow netdevices to specify needed head/tailroom") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/bonding/bond_main.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1130,6 +1130,7 @@ static void bond_setup_by_slave(struct n + + bond_dev->type = slave_dev->type; + bond_dev->hard_header_len = slave_dev->hard_header_len; ++ bond_dev->needed_headroom = slave_dev->needed_headroom; + bond_dev->addr_len = slave_dev->addr_len; + + memcpy(bond_dev->broadcast, slave_dev->broadcast, diff --git a/patches.suse/can-c_can-c_can_power_up-fix-error-handling.patch b/patches.suse/can-c_can-c_can_power_up-fix-error-handling.patch new file mode 100644 index 0000000..68a5c9e --- /dev/null +++ b/patches.suse/can-c_can-c_can_power_up-fix-error-handling.patch @@ -0,0 +1,66 @@ +From 44cef0c0ffbd8d61143712ce874be68a273b7884 Mon Sep 17 00:00:00 2001 +From: Zhang Qilong +Date: Sat, 28 Nov 2020 21:39:21 +0800 +Subject: [PATCH] can: c_can: c_can_power_up(): fix error handling +Git-commit: 44cef0c0ffbd8d61143712ce874be68a273b7884 +Patch-mainline: v5.10-rc7 +References: git-fixes + +In the error handling in c_can_power_up(), there are two bugs: + +1) c_can_pm_runtime_get_sync() will increase usage counter if device is not + empty. Forgetting to call c_can_pm_runtime_put_sync() will result in a + reference leak here. + +2) c_can_reset_ram() operation will set start bit when enable is true. We + should clear it in the error handling. + +We fix it by adding c_can_pm_runtime_put_sync() for 1), and +c_can_reset_ram(enable is false) for 2) in the error handling. + +Fixes: 8212003260c60 ("can: c_can: Add d_can suspend resume support") +Fixes: 52cde85acc23f ("can: c_can: Add d_can raminit support") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201128133922.3276973-2-zhangqilong3@huawei.com +[mkl: return "0" instead of "ret"] +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + drivers/net/can/c_can/c_can.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c +index 1ccdbe89585b..1a9e9b9a4bf6 100644 +--- a/drivers/net/can/c_can/c_can.c ++++ b/drivers/net/can/c_can/c_can.c +@@ -1295,12 +1295,22 @@ int c_can_power_up(struct net_device *dev) + time_after(time_out, jiffies)) + cpu_relax(); + +- if (time_after(jiffies, time_out)) +- return -ETIMEDOUT; ++ if (time_after(jiffies, time_out)) { ++ ret = -ETIMEDOUT; ++ goto err_out; ++ } + + ret = c_can_start(dev); +- if (!ret) +- c_can_irq_control(priv, true); ++ if (ret) ++ goto err_out; ++ ++ c_can_irq_control(priv, true); ++ ++ return 0; ++ ++err_out: ++ c_can_reset_ram(priv, false); ++ c_can_pm_runtime_put_sync(priv); + + return ret; + } +-- +2.26.2 + diff --git a/patches.suse/can-dev-prevent-potential-information-leak-in-can_fi.patch b/patches.suse/can-dev-prevent-potential-information-leak-in-can_fi.patch new file mode 100644 index 0000000..0f0742a --- /dev/null +++ b/patches.suse/can-dev-prevent-potential-information-leak-in-can_fi.patch @@ -0,0 +1,38 @@ +From b552766c872f5b0d90323b24e4c9e8fa67486dd5 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 21 Jan 2021 09:08:05 +0300 +Subject: [PATCH] can: dev: prevent potential information leak in can_fill_info() +Git-commit: b552766c872f5b0d90323b24e4c9e8fa67486dd5 +Patch-mainline: v5.11-rc6 +References: git-fixes + +The "bec" struct isn't necessarily always initialized. For example, the +mcp251xfd_get_berr_counter() function doesn't initialize anything if the +interface is down. + +Fixes: 52c793f24054 ("can: netlink support for bus-error reporting and counters") +Link: https://lore.kernel.org/r/YAkaRdRJncsJO8Ve@mwanda +Signed-off-by: Dan Carpenter +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + drivers/net/can/dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index 8b1ae023cb21..c73e2a65c904 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -1163,7 +1163,7 @@ static int can_fill_info(struct sk_buff *skb, const struct net_device *dev) + { + struct can_priv *priv = netdev_priv(dev); + struct can_ctrlmode cm = {.flags = priv->ctrlmode}; +- struct can_berr_counter bec; ++ struct can_berr_counter bec = { }; + enum can_state state = priv->state; + + if (priv->do_get_state) +-- +2.26.2 + diff --git a/patches.suse/can-vxcan-vxcan_xmit-fix-use-after-free-bug.patch b/patches.suse/can-vxcan-vxcan_xmit-fix-use-after-free-bug.patch new file mode 100644 index 0000000..67b16f6 --- /dev/null +++ b/patches.suse/can-vxcan-vxcan_xmit-fix-use-after-free-bug.patch @@ -0,0 +1,53 @@ +From 75854cad5d80976f6ea0f0431f8cedd3bcc475cb Mon Sep 17 00:00:00 2001 +From: Vincent Mailhol +Date: Wed, 20 Jan 2021 20:41:36 +0900 +Subject: [PATCH] can: vxcan: vxcan_xmit: fix use after free bug +Git-commit: 75854cad5d80976f6ea0f0431f8cedd3bcc475cb +Patch-mainline: v5.11-rc5 +References: git-fixes + +After calling netif_rx_ni(skb), dereferencing skb is unsafe. +Especially, the canfd_frame cfd which aliases skb memory is accessed +after the netif_rx_ni(). + +Fixes: a8f820a380a2 ("can: add Virtual CAN Tunnel driver (vxcan)") +Link: https://lore.kernel.org/r/20210120114137.200019-3-mailhol.vincent@wanadoo.fr +Signed-off-by: Vincent Mailhol +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + drivers/net/can/vxcan.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/vxcan.c b/drivers/net/can/vxcan.c +index fa47bab510bb..f9a524c5f6d6 100644 +--- a/drivers/net/can/vxcan.c ++++ b/drivers/net/can/vxcan.c +@@ -39,6 +39,7 @@ static netdev_tx_t vxcan_xmit(struct sk_buff *skb, struct net_device *dev) + struct net_device *peer; + struct canfd_frame *cfd = (struct canfd_frame *)skb->data; + struct net_device_stats *peerstats, *srcstats = &dev->stats; ++ u8 len; + + if (can_dropped_invalid_skb(dev, skb)) + return NETDEV_TX_OK; +@@ -61,12 +62,13 @@ static netdev_tx_t vxcan_xmit(struct sk_buff *skb, struct net_device *dev) + skb->dev = peer; + skb->ip_summed = CHECKSUM_UNNECESSARY; + ++ len = cfd->len; + if (netif_rx_ni(skb) == NET_RX_SUCCESS) { + srcstats->tx_packets++; +- srcstats->tx_bytes += cfd->len; ++ srcstats->tx_bytes += len; + peerstats = &peer->stats; + peerstats->rx_packets++; +- peerstats->rx_bytes += cfd->len; ++ peerstats->rx_bytes += len; + } + + out_unlock: +-- +2.26.2 + diff --git a/patches.suse/chelsio-chtls-correct-function-return-and-return-typ.patch b/patches.suse/chelsio-chtls-correct-function-return-and-return-typ.patch new file mode 100644 index 0000000..7e43907 --- /dev/null +++ b/patches.suse/chelsio-chtls-correct-function-return-and-return-typ.patch @@ -0,0 +1,32 @@ +From: Vinay Kumar Yadav +Date: Mon, 19 Oct 2020 17:20:24 +0530 +Subject: chelsio/chtls: correct function return and return type +Patch-mainline: v5.10-rc1 +Git-commit: 8580a61aede28d441e1c80588803411ee86aa299 +References: bsc#1104270 FATE#325931 + +csk_mem_free() should return true if send buffer is available, +false otherwise. + +Fixes: 3b8305f5c844 ("crypto: chtls - wait for memory sendmsg, sendpage") +Signed-off-by: Vinay Kumar Yadav +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/crypto/chelsio/chtls/chtls_io.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/crypto/chelsio/chtls/chtls_io.c ++++ b/drivers/crypto/chelsio/chtls/chtls_io.c +@@ -913,9 +913,9 @@ static int tls_header_read(struct tls_hd + return (__force int)cpu_to_be16(thdr->length); + } + +-static int csk_mem_free(struct chtls_dev *cdev, struct sock *sk) ++static bool csk_mem_free(struct chtls_dev *cdev, struct sock *sk) + { +- return (cdev->max_host_sndbuf - sk->sk_wmem_queued); ++ return (cdev->max_host_sndbuf - sk->sk_wmem_queued > 0); + } + + static int csk_wait_memory(struct chtls_dev *cdev, diff --git a/patches.suse/chelsio-chtls-correct-netdevice-for-vlan-interface.patch b/patches.suse/chelsio-chtls-correct-netdevice-for-vlan-interface.patch new file mode 100644 index 0000000..675aa49 --- /dev/null +++ b/patches.suse/chelsio-chtls-correct-netdevice-for-vlan-interface.patch @@ -0,0 +1,30 @@ +From: Vinay Kumar Yadav +Date: Mon, 19 Oct 2020 17:20:21 +0530 +Subject: chelsio/chtls: correct netdevice for vlan interface +Patch-mainline: v5.10-rc1 +Git-commit: 81519d1f7df7ed1bd5b1397540c8884438f57ae2 +References: bsc#1104270 FATE#325931 + +Check if netdevice is a vlan interface and find real vlan netdevice. + +Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition") +Signed-off-by: Venkatesh Ellapu +Signed-off-by: Vinay Kumar Yadav +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/crypto/chelsio/chtls/chtls_cm.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/crypto/chelsio/chtls/chtls_cm.c ++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c +@@ -1041,6 +1041,9 @@ static struct sock *chtls_recv_sock(stru + ndev = n->dev; + if (!ndev) + goto free_dst; ++ if (is_vlan_dev(ndev)) ++ ndev = vlan_dev_real_dev(ndev); ++ + port_id = cxgb4_port_idx(ndev); + + csk = chtls_sock_create(cdev); diff --git a/patches.suse/chelsio-chtls-fix-a-double-free-in-chtls_setkey.patch b/patches.suse/chelsio-chtls-fix-a-double-free-in-chtls_setkey.patch new file mode 100644 index 0000000..51553b5 --- /dev/null +++ b/patches.suse/chelsio-chtls-fix-a-double-free-in-chtls_setkey.patch @@ -0,0 +1,33 @@ +From: Dan Carpenter +Date: Thu, 3 Dec 2020 11:44:31 +0300 +Subject: chelsio/chtls: fix a double free in chtls_setkey() +Patch-mainline: v5.10-rc7 +Git-commit: 391119fb5c5c4bdb4d57c7ffeb5e8d18560783d1 +References: bsc#1104270 FATE#325931 + +The "skb" is freed by the transmit code in cxgb4_ofld_send() and we +shouldn't use it again. But in the current code, if we hit an error +later on in the function then the clean up code will call kfree_skb(skb) +and so it causes a double free. + +Set the "skb" to NULL and that makes the kfree_skb() a no-op. + +Fixes: d25f2f71f653 ("crypto: chtls - Program the TLS session Key") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/X8ilb6PtBRLWiSHp@mwanda +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/crypto/chelsio/chtls/chtls_hw.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/crypto/chelsio/chtls/chtls_hw.c ++++ b/drivers/crypto/chelsio/chtls/chtls_hw.c +@@ -375,6 +375,7 @@ int chtls_setkey(struct chtls_sock *csk, + csk->wr_unacked += DIV_ROUND_UP(len, 16); + enqueue_wr(csk, skb); + cxgb4_ofld_send(csk->egress_dev, skb); ++ skb = NULL; + + chtls_set_scmd(csk); + /* Clear quiesce for Rx key */ diff --git a/patches.suse/chelsio-chtls-fix-always-leaking-ctrl_skb.patch b/patches.suse/chelsio-chtls-fix-always-leaking-ctrl_skb.patch new file mode 100644 index 0000000..6b5c84c --- /dev/null +++ b/patches.suse/chelsio-chtls-fix-always-leaking-ctrl_skb.patch @@ -0,0 +1,32 @@ +From: Vinay Kumar Yadav +Date: Mon, 2 Nov 2020 23:09:10 +0530 +Subject: chelsio/chtls: fix always leaking ctrl_skb +Patch-mainline: v5.10-rc3 +Git-commit: dbfe394dad33f99cf8458be50483ec40a5d29c34 +References: bsc#1104270 FATE#325931 + +Correct skb refcount in alloc_ctrl_skb(), causing skb memleak +when chtls_send_abort() called with NULL skb. +it was always leaking the skb, correct it by incrementing skb +refs by one. + +Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition") +Signed-off-by: Vinay Kumar Yadav +Link: https://lore.kernel.org/r/20201102173909.24826-1-vinay.yadav@chelsio.com +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/crypto/chelsio/chtls/chtls_cm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/crypto/chelsio/chtls/chtls_cm.c ++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c +@@ -176,7 +176,7 @@ static struct sk_buff *alloc_ctrl_skb(st + { + if (likely(skb && !skb_shared(skb) && !skb_cloned(skb))) { + __skb_trim(skb, 0); +- refcount_add(2, &skb->users); ++ refcount_inc(&skb->users); + } else { + skb = alloc_skb(len, GFP_KERNEL | __GFP_NOFAIL); + } diff --git a/patches.suse/chelsio-chtls-fix-deadlock-issue.patch b/patches.suse/chelsio-chtls-fix-deadlock-issue.patch new file mode 100644 index 0000000..f171c4c --- /dev/null +++ b/patches.suse/chelsio-chtls-fix-deadlock-issue.patch @@ -0,0 +1,38 @@ +From: Vinay Kumar Yadav +Date: Mon, 26 Oct 2020 01:05:39 +0530 +Subject: chelsio/chtls: fix deadlock issue +Patch-mainline: v5.10-rc2 +Git-commit: 28e9dcd9172028263c8225c15c4e329e08475e89 +References: bsc#1104270 FATE#325931 + +In chtls_pass_establish() we hold child socket lock using bh_lock_sock +and we are again trying bh_lock_sock in add_to_reap_list, causing deadlock. +Remove bh_lock_sock in add_to_reap_list() as lock is already held. + +Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition") +Signed-off-by: Vinay Kumar Yadav +Link: https://lore.kernel.org/r/20201025193538.31112-1-vinay.yadav@chelsio.com +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/crypto/chelsio/chtls/chtls_cm.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/crypto/chelsio/chtls/chtls_cm.c ++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c +@@ -1333,7 +1333,6 @@ static void add_to_reap_list(struct sock + struct chtls_sock *csk = sk->sk_user_data; + + local_bh_disable(); +- bh_lock_sock(sk); + release_tcp_port(sk); /* release the port immediately */ + + spin_lock(&reap_list_lock); +@@ -1342,7 +1341,6 @@ static void add_to_reap_list(struct sock + if (!csk->passive_reap_next) + schedule_work(&reap_task); + spin_unlock(&reap_list_lock); +- bh_unlock_sock(sk); + local_bh_enable(); + } + diff --git a/patches.suse/chelsio-chtls-fix-memory-leaks-caused-by-a-race.patch b/patches.suse/chelsio-chtls-fix-memory-leaks-caused-by-a-race.patch new file mode 100644 index 0000000..e52164c --- /dev/null +++ b/patches.suse/chelsio-chtls-fix-memory-leaks-caused-by-a-race.patch @@ -0,0 +1,46 @@ +From: Vinay Kumar Yadav +Date: Mon, 2 Nov 2020 23:06:51 +0530 +Subject: chelsio/chtls: fix memory leaks caused by a race +Patch-mainline: v5.10-rc3 +Git-commit: 8080b462b6aa856ae05ea010441a702599e579f2 +References: bsc#1104270 FATE#325931 + +race between user context and softirq causing memleak, +consider the call sequence scenario + +chtls_setkey() //user context +chtls_peer_close() +chtls_abort_req_rss() +chtls_setkey() //user context + +work request skb queued in chtls_setkey() won't be freed +because resources are already cleaned for this connection, +fix it by not queuing work request while socket is closing. + +v1->v2: +- fix W=1 warning. + +v2->v3: +- separate it out from another memleak fix. + +Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition") +Signed-off-by: Vinay Kumar Yadav +Link: https://lore.kernel.org/r/20201102173650.24754-1-vinay.yadav@chelsio.com +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/crypto/chelsio/chtls/chtls_hw.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/crypto/chelsio/chtls/chtls_hw.c ++++ b/drivers/crypto/chelsio/chtls/chtls_hw.c +@@ -367,6 +367,9 @@ int chtls_setkey(struct chtls_sock *csk, + if (ret) + goto out_notcb; + ++ if (unlikely(csk_flag(sk, CSK_ABORT_SHUTDOWN))) ++ goto out_notcb; ++ + set_wr_txq(skb, CPL_PRIORITY_DATA, csk->tlshws.txqid); + csk->wr_credits -= DIV_ROUND_UP(len, 16); + csk->wr_unacked += DIV_ROUND_UP(len, 16); diff --git a/patches.suse/chelsio-chtls-fix-memory-leaks-in-CPL-handlers.patch b/patches.suse/chelsio-chtls-fix-memory-leaks-in-CPL-handlers.patch new file mode 100644 index 0000000..1aac571 --- /dev/null +++ b/patches.suse/chelsio-chtls-fix-memory-leaks-in-CPL-handlers.patch @@ -0,0 +1,65 @@ +From: Vinay Kumar Yadav +Date: Mon, 26 Oct 2020 01:12:29 +0530 +Subject: chelsio/chtls: fix memory leaks in CPL handlers +Patch-mainline: v5.10-rc2 +Git-commit: 6daa1da4e262b0cd52ef0acc1989ff22b5540264 +References: bsc#1104270 FATE#325931 + +CPL handler functions chtls_pass_open_rpl() and +chtls_close_listsrv_rpl() should return CPL_RET_BUF_DONE +so that caller function will do skb free to avoid leak. + +Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition") +Signed-off-by: Vinay Kumar Yadav +Link: https://lore.kernel.org/r/20201025194228.31271-1-vinay.yadav@chelsio.com +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/crypto/chelsio/chtls/chtls_cm.c | 27 ++++++++++++--------------- + 1 file changed, 12 insertions(+), 15 deletions(-) + +--- a/drivers/crypto/chelsio/chtls/chtls_cm.c ++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c +@@ -694,14 +694,13 @@ static int chtls_pass_open_rpl(struct ch + if (rpl->status != CPL_ERR_NONE) { + pr_info("Unexpected PASS_OPEN_RPL status %u for STID %u\n", + rpl->status, stid); +- return CPL_RET_BUF_DONE; ++ } else { ++ cxgb4_free_stid(cdev->tids, stid, listen_ctx->lsk->sk_family); ++ sock_put(listen_ctx->lsk); ++ kfree(listen_ctx); ++ module_put(THIS_MODULE); + } +- cxgb4_free_stid(cdev->tids, stid, listen_ctx->lsk->sk_family); +- sock_put(listen_ctx->lsk); +- kfree(listen_ctx); +- module_put(THIS_MODULE); +- +- return 0; ++ return CPL_RET_BUF_DONE; + } + + static int chtls_close_listsrv_rpl(struct chtls_dev *cdev, struct sk_buff *skb) +@@ -718,15 +717,13 @@ static int chtls_close_listsrv_rpl(struc + if (rpl->status != CPL_ERR_NONE) { + pr_info("Unexpected CLOSE_LISTSRV_RPL status %u for STID %u\n", + rpl->status, stid); +- return CPL_RET_BUF_DONE; ++ } else { ++ cxgb4_free_stid(cdev->tids, stid, listen_ctx->lsk->sk_family); ++ sock_put(listen_ctx->lsk); ++ kfree(listen_ctx); ++ module_put(THIS_MODULE); + } +- +- cxgb4_free_stid(cdev->tids, stid, listen_ctx->lsk->sk_family); +- sock_put(listen_ctx->lsk); +- kfree(listen_ctx); +- module_put(THIS_MODULE); +- +- return 0; ++ return CPL_RET_BUF_DONE; + } + + static void chtls_release_resources(struct sock *sk) diff --git a/patches.suse/chelsio-chtls-fix-panic-during-unload-reload-chtls.patch b/patches.suse/chelsio-chtls-fix-panic-during-unload-reload-chtls.patch new file mode 100644 index 0000000..8bf1936 --- /dev/null +++ b/patches.suse/chelsio-chtls-fix-panic-during-unload-reload-chtls.patch @@ -0,0 +1,31 @@ +From: Vinay Kumar Yadav +Date: Thu, 26 Nov 2020 03:19:14 +0530 +Subject: chelsio/chtls: fix panic during unload reload chtls +Patch-mainline: v5.10-rc7 +Git-commit: e3d5e971d2f83d8ddd4b91a50cea4517fb488383 +References: bsc#1104270 FATE#325931 + +there is kernel panic in inet_twsk_free() while chtls +module unload when socket is in TIME_WAIT state because +sk_prot_creator was not preserved on connection socket. + +Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition") +Signed-off-by: Udai Sharma +Signed-off-by: Vinay Kumar Yadav +Link: https://lore.kernel.org/r/20201125214913.16938-1-vinay.yadav@chelsio.com +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/crypto/chelsio/chtls/chtls_cm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/crypto/chelsio/chtls/chtls_cm.c ++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c +@@ -1065,6 +1065,7 @@ static struct sock *chtls_recv_sock(stru + sk_setup_caps(newsk, dst); + ctx = tls_get_ctx(lsk); + newsk->sk_destruct = ctx->sk_destruct; ++ newsk->sk_prot_creator = lsk->sk_prot_creator; + csk->sk = newsk; + csk->passive_reap_next = oreq; + csk->tx_chan = cxgb4_port_chan(ndev); diff --git a/patches.suse/chelsio-chtls-fix-socket-lock.patch b/patches.suse/chelsio-chtls-fix-socket-lock.patch new file mode 100644 index 0000000..3b6d872 --- /dev/null +++ b/patches.suse/chelsio-chtls-fix-socket-lock.patch @@ -0,0 +1,28 @@ +From: Vinay Kumar Yadav +Date: Mon, 19 Oct 2020 17:20:20 +0530 +Subject: chelsio/chtls: fix socket lock +Patch-mainline: v5.10-rc1 +Git-commit: 0fb5f0160a36d7acaa8e84ce873af99f94b60484 +References: bsc#1104270 FATE#325931 + +In chtls_sendpage() socket lock is released but not acquired, +fix it by taking lock. + +Fixes: 36bedb3f2e5b ("crypto: chtls - Inline TLS record Tx") +Signed-off-by: Vinay Kumar Yadav +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/crypto/chelsio/chtls/chtls_io.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/crypto/chelsio/chtls/chtls_io.c ++++ b/drivers/crypto/chelsio/chtls/chtls_io.c +@@ -1212,6 +1212,7 @@ int chtls_sendpage(struct sock *sk, stru + copied = 0; + csk = rcu_dereference_sk_user_data(sk); + cdev = csk->cdev; ++ lock_sock(sk); + timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT); + + err = sk_stream_wait_connect(sk, &timeo); diff --git a/patches.suse/chelsio-chtls-fix-tls-record-info-to-user.patch b/patches.suse/chelsio-chtls-fix-tls-record-info-to-user.patch new file mode 100644 index 0000000..94473ca --- /dev/null +++ b/patches.suse/chelsio-chtls-fix-tls-record-info-to-user.patch @@ -0,0 +1,49 @@ +From: Vinay Kumar Yadav +Date: Fri, 23 Oct 2020 00:35:57 +0530 +Subject: chelsio/chtls: fix tls record info to user +Patch-mainline: v5.10-rc2 +Git-commit: 4f3391ce8f5a69e7e6d66d0a3fc654eb6dbdc919 +References: bsc#1104270 FATE#325931 + +chtls_pt_recvmsg() receives a skb with tls header and subsequent +skb with data, need to finalize the data copy whenever next skb +with tls header is available. but here current tls header is +overwritten by next available tls header, ends up corrupting +user buffer data. fixing it by finalizing current record whenever +next skb contains tls header. + +v1->v2: +- Improved commit message. + +Fixes: 17a7d24aa89d ("crypto: chtls - generic handling of data and hdr") +Signed-off-by: Vinay Kumar Yadav +Link: https://lore.kernel.org/r/20201022190556.21308-1-vinay.yadav@chelsio.com +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/crypto/chelsio/chtls/chtls_io.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/crypto/chelsio/chtls/chtls_io.c ++++ b/drivers/crypto/chelsio/chtls/chtls_io.c +@@ -1539,6 +1539,7 @@ skip_copy: + tp->urg_data = 0; + + if ((avail + offset) >= skb->len) { ++ struct sk_buff *next_skb; + if (ULP_SKB_CB(skb)->flags & ULPCB_FLAG_TLS_HDR) { + tp->copied_seq += skb->len; + hws->rcvpld = skb->hdr_len; +@@ -1548,8 +1549,10 @@ skip_copy: + chtls_free_skb(sk, skb); + buffers_freed++; + hws->copied_seq = 0; +- if (copied >= target && +- !skb_peek(&sk->sk_receive_queue)) ++ next_skb = skb_peek(&sk->sk_receive_queue); ++ if (copied >= target && !next_skb) ++ break; ++ if (ULP_SKB_CB(next_skb)->flags & ULPCB_FLAG_TLS_HDR) + break; + } + } while (len > 0); diff --git a/patches.suse/chtls-Added-a-check-to-avoid-NULL-pointer-dereferenc.patch b/patches.suse/chtls-Added-a-check-to-avoid-NULL-pointer-dereferenc.patch new file mode 100644 index 0000000..0ae08ae --- /dev/null +++ b/patches.suse/chtls-Added-a-check-to-avoid-NULL-pointer-dereferenc.patch @@ -0,0 +1,33 @@ +From: Ayush Sawal +Date: Wed, 6 Jan 2021 09:59:11 +0530 +Subject: chtls: Added a check to avoid NULL pointer dereference +Patch-mainline: v5.11-rc3 +Git-commit: eade1e0a4fb31d48eeb1589d9bb859ae4dd6181d +References: bsc#1104270 FATE#325931 + +In case of server removal lookup_stid() may return NULL pointer, which +is used as listen_ctx. So added a check before accessing this pointer. + +Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition") +Signed-off-by: Vinay Kumar Yadav +Signed-off-by: Ayush Sawal +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/crypto/chelsio/chtls/chtls_cm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/crypto/chelsio/chtls/chtls_cm.c ++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c +@@ -1407,6 +1407,11 @@ static int chtls_pass_establish(struct c + sk_wake_async(sk, 0, POLL_OUT); + + data = lookup_stid(cdev->tids, stid); ++ if (!data) { ++ /* listening server close */ ++ kfree_skb(skb); ++ goto unlock; ++ } + lsk = ((struct listen_ctx *)data)->lsk; + + bh_lock_sock(lsk); diff --git a/patches.suse/chtls-Fix-chtls-resources-release-sequence.patch b/patches.suse/chtls-Fix-chtls-resources-release-sequence.patch new file mode 100644 index 0000000..4b9b65b --- /dev/null +++ b/patches.suse/chtls-Fix-chtls-resources-release-sequence.patch @@ -0,0 +1,58 @@ +From: Ayush Sawal +Date: Wed, 6 Jan 2021 09:59:12 +0530 +Subject: chtls: Fix chtls resources release sequence +Patch-mainline: v5.11-rc3 +Git-commit: 15ef6b0e30b354253e2c10b3836bc59767eb162b +References: bsc#1104270 FATE#325931 + +CPL_ABORT_RPL is sent after releasing the resources by calling +chtls_release_resources(sk); and chtls_conn_done(sk); +eventually causing kernel panic. Fixing it by calling release +in appropriate order. + +Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition") +Signed-off-by: Vinay Kumar Yadav +Signed-off-by: Ayush Sawal +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/crypto/chelsio/chtls/chtls_cm.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/crypto/chelsio/chtls/chtls_cm.c ++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c +@@ -1858,9 +1858,9 @@ static void bl_abort_syn_rcv(struct sock + queue = csk->txq_idx; + + skb->sk = NULL; +- do_abort_syn_rcv(child, lsk); + chtls_send_abort_rpl(child, skb, BLOG_SKB_CB(skb)->cdev, + CPL_ABORT_NO_RST, queue); ++ do_abort_syn_rcv(child, lsk); + } + + static int abort_syn_rcv(struct sock *sk, struct sk_buff *skb) +@@ -1890,8 +1890,8 @@ static int abort_syn_rcv(struct sock *sk + if (!sock_owned_by_user(psk)) { + int queue = csk->txq_idx; + +- do_abort_syn_rcv(sk, psk); + chtls_send_abort_rpl(sk, skb, cdev, CPL_ABORT_NO_RST, queue); ++ do_abort_syn_rcv(sk, psk); + } else { + skb->sk = sk; + BLOG_SKB_CB(skb)->backlog_rcv = bl_abort_syn_rcv; +@@ -1935,11 +1935,11 @@ static void chtls_abort_req_rss(struct s + if (sk->sk_state == TCP_SYN_RECV && !abort_syn_rcv(sk, skb)) + return; + +- chtls_release_resources(sk); +- chtls_conn_done(sk); + } + + chtls_send_abort_rpl(sk, skb, csk->cdev, rst_status, queue); ++ chtls_release_resources(sk); ++ chtls_conn_done(sk); + } + + static void chtls_abort_rpl_rss(struct sock *sk, struct sk_buff *skb) diff --git a/patches.suse/chtls-Fix-hardware-tid-leak.patch b/patches.suse/chtls-Fix-hardware-tid-leak.patch new file mode 100644 index 0000000..57cbc5a --- /dev/null +++ b/patches.suse/chtls-Fix-hardware-tid-leak.patch @@ -0,0 +1,83 @@ +From: Ayush Sawal +Date: Wed, 6 Jan 2021 09:59:06 +0530 +Subject: chtls: Fix hardware tid leak +Patch-mainline: v5.11-rc3 +Git-commit: 717df0f4cdc9044c415431a3522b3e9ccca5b4a3 +References: bsc#1104270 FATE#325931 + +send_abort_rpl() is not calculating cpl_abort_req_rss offset and +ends up sending wrong TID with abort_rpl WR causng tid leaks. +Replaced send_abort_rpl() with chtls_send_abort_rpl() as it is +redundant. + +Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition") +Signed-off-by: Rohit Maheshwari +Signed-off-by: Ayush Sawal +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/crypto/chelsio/chtls/chtls_cm.c | 39 ++------------------------------ + 1 file changed, 3 insertions(+), 36 deletions(-) + +--- a/drivers/crypto/chelsio/chtls/chtls_cm.c ++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c +@@ -1791,39 +1791,6 @@ static void send_defer_abort_rpl(struct + kfree_skb(skb); + } + +-static void send_abort_rpl(struct sock *sk, struct sk_buff *skb, +- struct chtls_dev *cdev, int status, int queue) +-{ +- struct cpl_abort_req_rss *req = cplhdr(skb); +- struct sk_buff *reply_skb; +- struct chtls_sock *csk; +- +- csk = rcu_dereference_sk_user_data(sk); +- +- reply_skb = alloc_skb(sizeof(struct cpl_abort_rpl), +- GFP_KERNEL); +- +- if (!reply_skb) { +- req->status = (queue << 1); +- send_defer_abort_rpl(cdev, skb); +- return; +- } +- +- set_abort_rpl_wr(reply_skb, GET_TID(req), status); +- kfree_skb(skb); +- +- set_wr_txq(reply_skb, CPL_PRIORITY_DATA, queue); +- if (csk_conn_inline(csk)) { +- struct l2t_entry *e = csk->l2t_entry; +- +- if (e && sk->sk_state != TCP_SYN_RECV) { +- cxgb4_l2t_send(csk->egress_dev, reply_skb, e); +- return; +- } +- } +- cxgb4_ofld_send(cdev->lldi->ports[0], reply_skb); +-} +- + /* + * Add an skb to the deferred skb queue for processing from process context. + */ +@@ -1887,8 +1854,8 @@ static void bl_abort_syn_rcv(struct sock + + skb->sk = NULL; + do_abort_syn_rcv(child, lsk); +- send_abort_rpl(child, skb, BLOG_SKB_CB(skb)->cdev, +- CPL_ABORT_NO_RST, queue); ++ chtls_send_abort_rpl(child, skb, BLOG_SKB_CB(skb)->cdev, ++ CPL_ABORT_NO_RST, queue); + } + + static int abort_syn_rcv(struct sock *sk, struct sk_buff *skb) +@@ -1919,7 +1886,7 @@ static int abort_syn_rcv(struct sock *sk + int queue = csk->txq_idx; + + do_abort_syn_rcv(sk, psk); +- send_abort_rpl(sk, skb, cdev, CPL_ABORT_NO_RST, queue); ++ chtls_send_abort_rpl(sk, skb, cdev, CPL_ABORT_NO_RST, queue); + } else { + skb->sk = sk; + BLOG_SKB_CB(skb)->backlog_rcv = bl_abort_syn_rcv; diff --git a/patches.suse/chtls-Remove-invalid-set_tcb-call.patch b/patches.suse/chtls-Remove-invalid-set_tcb-call.patch new file mode 100644 index 0000000..9ad434d --- /dev/null +++ b/patches.suse/chtls-Remove-invalid-set_tcb-call.patch @@ -0,0 +1,33 @@ +From: Ayush Sawal +Date: Wed, 6 Jan 2021 09:59:07 +0530 +Subject: chtls: Remove invalid set_tcb call +Patch-mainline: v5.11-rc3 +Git-commit: 827d329105bfde6701f0077e34a09c4a86e27145 +References: bsc#1104270 FATE#325931 + +At the time of SYN_RECV, connection information is not +initialized at FW, updating tcb flag over uninitialized +connection causes adapter crash. We don't need to +update the flag during SYN_RECV state, so avoid this. + +Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition") +Signed-off-by: Rohit Maheshwari +Signed-off-by: Ayush Sawal +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/crypto/chelsio/chtls/chtls_cm.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/crypto/chelsio/chtls/chtls_cm.c ++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c +@@ -1904,9 +1904,6 @@ static void chtls_abort_req_rss(struct s + int queue = csk->txq_idx; + + if (is_neg_adv(req->status)) { +- if (sk->sk_state == TCP_SYN_RECV) +- chtls_set_tcb_tflag(sk, 0, 0); +- + kfree_skb(skb); + return; + } diff --git a/patches.suse/chtls-Replace-skb_dequeue-with-skb_peek.patch b/patches.suse/chtls-Replace-skb_dequeue-with-skb_peek.patch new file mode 100644 index 0000000..cc240cd --- /dev/null +++ b/patches.suse/chtls-Replace-skb_dequeue-with-skb_peek.patch @@ -0,0 +1,32 @@ +From: Ayush Sawal +Date: Wed, 6 Jan 2021 09:59:10 +0530 +Subject: chtls: Replace skb_dequeue with skb_peek +Patch-mainline: v5.11-rc3 +Git-commit: a84b2c0d5fa23da6d6c8c0d5f5c93184a2744d3e +References: bsc#1104270 FATE#325931 + +The skb is unlinked twice, one in __skb_dequeue in function +chtls_reset_synq() and another in cleanup_syn_rcv_conn(). +So in this patch using skb_peek() instead of __skb_dequeue(), +so that unlink will be handled only in cleanup_syn_rcv_conn(). + +Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition") +Signed-off-by: Vinay Kumar Yadav +Signed-off-by: Ayush Sawal +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/crypto/chelsio/chtls/chtls_cm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/crypto/chelsio/chtls/chtls_cm.c ++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c +@@ -579,7 +579,7 @@ static void chtls_reset_synq(struct list + + while (!skb_queue_empty(&listen_ctx->synq)) { + struct chtls_sock *csk = +- container_of((struct synq *)__skb_dequeue ++ container_of((struct synq *)skb_peek + (&listen_ctx->synq), struct chtls_sock, synq); + struct sock *child = csk->sk; + diff --git a/patches.suse/cpumap-Avoid-warning-when-CONFIG_DEBUG_PER_CPU_MAPS-.patch b/patches.suse/cpumap-Avoid-warning-when-CONFIG_DEBUG_PER_CPU_MAPS-.patch new file mode 100644 index 0000000..87a65d0 --- /dev/null +++ b/patches.suse/cpumap-Avoid-warning-when-CONFIG_DEBUG_PER_CPU_MAPS-.patch @@ -0,0 +1,43 @@ +From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= +Date: Thu, 16 Apr 2020 10:31:20 +0200 +Subject: cpumap: Avoid warning when CONFIG_DEBUG_PER_CPU_MAPS is enabled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Patch-mainline: v5.7-rc3 +Git-commit: bc23d0e3f717ced21fbfacab3ab887d55e5ba367 +References: bsc#1109837 + +When the kernel is built with CONFIG_DEBUG_PER_CPU_MAPS, the cpumap code +can trigger a spurious warning if CONFIG_CPUMASK_OFFSTACK is also set. This +happens because in this configuration, NR_CPUS can be larger than +nr_cpumask_bits, so the initial check in cpu_map_alloc() is not sufficient +to guard against hitting the warning in cpumask_check(). + +Fix this by explicitly checking the supplied key against the +nr_cpumask_bits variable before calling cpu_possible(). + +Fixes: 6710e1126934 ("bpf: introduce new bpf cpu map type BPF_MAP_TYPE_CPUMAP") +Reported-by: Xiumei Mu +Signed-off-by: Toke Høiland-Jørgensen +Signed-off-by: Alexei Starovoitov +Tested-by: Xiumei Mu +Acked-by: Jesper Dangaard Brouer +Acked-by: Song Liu +Link: https://lore.kernel.org/bpf/20200416083120.453718-1-toke@redhat.com +Acked-by: Thomas Bogendoerfer +--- + kernel/bpf/cpumap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/bpf/cpumap.c ++++ b/kernel/bpf/cpumap.c +@@ -455,7 +455,7 @@ static int cpu_map_update_elem(struct bp + return -EOVERFLOW; + + /* Make sure CPU is a valid possible cpu */ +- if (!cpu_possible(key_cpu)) ++ if (key_cpu >= nr_cpumask_bits || !cpu_possible(key_cpu)) + return -ENODEV; + + if (qsize == 0) { diff --git a/patches.suse/cxgb3-fix-error-return-code-in-t3_sge_alloc_qset.patch b/patches.suse/cxgb3-fix-error-return-code-in-t3_sge_alloc_qset.patch new file mode 100644 index 0000000..d1aa76d --- /dev/null +++ b/patches.suse/cxgb3-fix-error-return-code-in-t3_sge_alloc_qset.patch @@ -0,0 +1,31 @@ +From: Zhang Changzhong +Date: Wed, 2 Dec 2020 17:56:05 +0800 +Subject: cxgb3: fix error return code in t3_sge_alloc_qset() +Patch-mainline: v5.10-rc7 +Git-commit: ff9924897f8bfed82e61894b373ab9d2dfea5b10 +References: git-fixes + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: b1fb1f280d09 ("cxgb3 - Fix dma mapping error path") +Reported-by: Hulk Robot +Signed-off-by: Zhang Changzhong +Acked-by: Raju Rangoju +Link: https://lore.kernel.org/r/1606902965-1646-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/chelsio/cxgb3/sge.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/chelsio/cxgb3/sge.c ++++ b/drivers/net/ethernet/chelsio/cxgb3/sge.c +@@ -3176,6 +3176,7 @@ int t3_sge_alloc_qset(struct adapter *ad + GFP_KERNEL | __GFP_COMP); + if (!avail) { + CH_ALERT(adapter, "free list queue 0 initialization failed\n"); ++ ret = -ENOMEM; + goto err; + } + if (avail < q->fl[0].size) diff --git a/patches.suse/cxgb4-cxgb4vf-fix-flow-control-display-for-auto-nego.patch b/patches.suse/cxgb4-cxgb4vf-fix-flow-control-display-for-auto-nego.patch new file mode 100644 index 0000000..8e66008 --- /dev/null +++ b/patches.suse/cxgb4-cxgb4vf-fix-flow-control-display-for-auto-nego.patch @@ -0,0 +1,192 @@ +From: Rahul Lakkireddy +Date: Mon, 30 Dec 2019 18:14:08 +0530 +Subject: cxgb4/cxgb4vf: fix flow control display for auto negotiation +Patch-mainline: v5.5-rc5 +Git-commit: 0caeaf6ad532f9be5a768a158627cb31921cc8b7 +References: bsc#1046540 FATE#322930 bsc#1046542 FATE#322928 + +As per 802.3-2005, Section Two, Annex 28B, Table 28B-2 [1], when +_only_ Rx pause is enabled, both symmetric and asymmetric pause +towards local device must be enabled. Also, firmware returns the local +device's flow control pause params as part of advertised capabilities +and negotiated params as part of current link attributes. So, fix up +ethtool's flow control pause params fetch logic to read from acaps, +instead of linkattr. + +[1] https://standards.ieee.org/standard/802_3-2005.html + +Fixes: c3168cabe1af ("cxgb4/cxgbvf: Handle 32-bit fw port capabilities") +Signed-off-by: Surendra Mobiya +Signed-off-by: Rahul Lakkireddy +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/chelsio/cxgb4/cxgb4.h | 1 + drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c | 4 +-- + drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 21 ++++++++++++-------- + drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c | 4 +-- + drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h | 1 + drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c | 18 ++++++++++------- + 6 files changed, 30 insertions(+), 19 deletions(-) + +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h +@@ -503,6 +503,7 @@ struct link_config { + + enum cc_pause requested_fc; /* flow control user has requested */ + enum cc_pause fc; /* actual link flow control */ ++ enum cc_pause advertised_fc; /* actual advertised flow control */ + + enum cc_fec requested_fec; /* Forward Error Correction: */ + enum cc_fec fec; /* requested and actual in use */ +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c +@@ -805,8 +805,8 @@ static void get_pauseparam(struct net_de + struct port_info *p = netdev_priv(dev); + + epause->autoneg = (p->link_cfg.requested_fc & PAUSE_AUTONEG) != 0; +- epause->rx_pause = (p->link_cfg.fc & PAUSE_RX) != 0; +- epause->tx_pause = (p->link_cfg.fc & PAUSE_TX) != 0; ++ epause->rx_pause = (p->link_cfg.advertised_fc & PAUSE_RX) != 0; ++ epause->tx_pause = (p->link_cfg.advertised_fc & PAUSE_TX) != 0; + } + + static int set_pauseparam(struct net_device *dev, +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +@@ -4089,7 +4089,8 @@ static inline fw_port_cap32_t cc_to_fwca + if (cc_pause & PAUSE_TX) + fw_pause |= FW_PORT_CAP32_802_3_PAUSE; + else +- fw_pause |= FW_PORT_CAP32_802_3_ASM_DIR; ++ fw_pause |= FW_PORT_CAP32_802_3_ASM_DIR | ++ FW_PORT_CAP32_802_3_PAUSE; + } else if (cc_pause & PAUSE_TX) { + fw_pause |= FW_PORT_CAP32_802_3_ASM_DIR; + } +@@ -8566,17 +8567,17 @@ static fw_port_cap32_t lstatus_to_fwcap( + void t4_handle_get_port_info(struct port_info *pi, const __be64 *rpl) + { + const struct fw_port_cmd *cmd = (const void *)rpl; +- int action = FW_PORT_CMD_ACTION_G(be32_to_cpu(cmd->action_to_len16)); +- struct adapter *adapter = pi->adapter; ++ fw_port_cap32_t pcaps, acaps, lpacaps, linkattr; + struct link_config *lc = &pi->link_cfg; +- int link_ok, linkdnrc; +- enum fw_port_type port_type; ++ struct adapter *adapter = pi->adapter; ++ unsigned int speed, fc, fec, adv_fc; + enum fw_port_module_type mod_type; +- unsigned int speed, fc, fec; +- fw_port_cap32_t pcaps, acaps, lpacaps, linkattr; ++ int action, link_ok, linkdnrc; ++ enum fw_port_type port_type; + + /* Extract the various fields from the Port Information message. + */ ++ action = FW_PORT_CMD_ACTION_G(be32_to_cpu(cmd->action_to_len16)); + switch (action) { + case FW_PORT_ACTION_GET_PORT_INFO: { + u32 lstatus = be32_to_cpu(cmd->u.info.lstatus_to_modtype); +@@ -8614,6 +8615,7 @@ void t4_handle_get_port_info(struct port + } + + fec = fwcap_to_cc_fec(acaps); ++ adv_fc = fwcap_to_cc_pause(acaps); + fc = fwcap_to_cc_pause(linkattr); + speed = fwcap_to_speed(linkattr); + +@@ -8670,7 +8672,9 @@ void t4_handle_get_port_info(struct port + } + + if (link_ok != lc->link_ok || speed != lc->speed || +- fc != lc->fc || fec != lc->fec) { /* something changed */ ++ fc != lc->fc || adv_fc != lc->advertised_fc || ++ fec != lc->fec) { ++ /* something changed */ + if (!link_ok && lc->link_ok) { + lc->link_down_rc = linkdnrc; + dev_warn_ratelimited(adapter->pdev_dev, +@@ -8680,6 +8684,7 @@ void t4_handle_get_port_info(struct port + } + lc->link_ok = link_ok; + lc->speed = speed; ++ lc->advertised_fc = adv_fc; + lc->fc = fc; + lc->fec = fec; + +--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c ++++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c +@@ -1690,8 +1690,8 @@ static void cxgb4vf_get_pauseparam(struc + struct port_info *pi = netdev_priv(dev); + + pauseparam->autoneg = (pi->link_cfg.requested_fc & PAUSE_AUTONEG) != 0; +- pauseparam->rx_pause = (pi->link_cfg.fc & PAUSE_RX) != 0; +- pauseparam->tx_pause = (pi->link_cfg.fc & PAUSE_TX) != 0; ++ pauseparam->rx_pause = (pi->link_cfg.advertised_fc & PAUSE_RX) != 0; ++ pauseparam->tx_pause = (pi->link_cfg.advertised_fc & PAUSE_TX) != 0; + } + + /* +--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h ++++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h +@@ -135,6 +135,7 @@ struct link_config { + + enum cc_pause requested_fc; /* flow control user has requested */ + enum cc_pause fc; /* actual link flow control */ ++ enum cc_pause advertised_fc; /* actual advertised flow control */ + + enum cc_fec auto_fec; /* Forward Error Correction: */ + enum cc_fec requested_fec; /* "automatic" (IEEE 802.3), */ +--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c +@@ -1913,16 +1913,16 @@ static const char *t4vf_link_down_rc_str + static void t4vf_handle_get_port_info(struct port_info *pi, + const struct fw_port_cmd *cmd) + { +- int action = FW_PORT_CMD_ACTION_G(be32_to_cpu(cmd->action_to_len16)); +- struct adapter *adapter = pi->adapter; ++ fw_port_cap32_t pcaps, acaps, lpacaps, linkattr; + struct link_config *lc = &pi->link_cfg; +- int link_ok, linkdnrc; +- enum fw_port_type port_type; ++ struct adapter *adapter = pi->adapter; ++ unsigned int speed, fc, fec, adv_fc; + enum fw_port_module_type mod_type; +- unsigned int speed, fc, fec; +- fw_port_cap32_t pcaps, acaps, lpacaps, linkattr; ++ int action, link_ok, linkdnrc; ++ enum fw_port_type port_type; + + /* Extract the various fields from the Port Information message. */ ++ action = FW_PORT_CMD_ACTION_G(be32_to_cpu(cmd->action_to_len16)); + switch (action) { + case FW_PORT_ACTION_GET_PORT_INFO: { + u32 lstatus = be32_to_cpu(cmd->u.info.lstatus_to_modtype); +@@ -1982,6 +1982,7 @@ static void t4vf_handle_get_port_info(st + } + + fec = fwcap_to_cc_fec(acaps); ++ adv_fc = fwcap_to_cc_pause(acaps); + fc = fwcap_to_cc_pause(linkattr); + speed = fwcap_to_speed(linkattr); + +@@ -2012,7 +2013,9 @@ static void t4vf_handle_get_port_info(st + } + + if (link_ok != lc->link_ok || speed != lc->speed || +- fc != lc->fc || fec != lc->fec) { /* something changed */ ++ fc != lc->fc || adv_fc != lc->advertised_fc || ++ fec != lc->fec) { ++ /* something changed */ + if (!link_ok && lc->link_ok) { + lc->link_down_rc = linkdnrc; + dev_warn_ratelimited(adapter->pdev_dev, +@@ -2022,6 +2025,7 @@ static void t4vf_handle_get_port_info(st + } + lc->link_ok = link_ok; + lc->speed = speed; ++ lc->advertised_fc = adv_fc; + lc->fc = fc; + lc->fec = fec; + diff --git a/patches.suse/cxgb4-fix-SGE-queue-dump-destination-buffer-context.patch b/patches.suse/cxgb4-fix-SGE-queue-dump-destination-buffer-context.patch new file mode 100644 index 0000000..19deb28 --- /dev/null +++ b/patches.suse/cxgb4-fix-SGE-queue-dump-destination-buffer-context.patch @@ -0,0 +1,47 @@ +From: Rahul Lakkireddy +Date: Wed, 24 Jun 2020 01:51:37 +0530 +Subject: cxgb4: fix SGE queue dump destination buffer context +Patch-mainline: v5.8-rc3 +Git-commit: 1992ded5d111997877a9a25205976d8d03c46814 +References: bsc#1073513 + +The data in destination buffer is expected to be be parsed in big +endian. So, use the right context. + +Fixes following sparse warning: +cudbg_lib.c:2041:44: warning: incorrect type in assignment (different +base types) +cudbg_lib.c:2041:44: expected unsigned long long [usertype] +cudbg_lib.c:2041:44: got restricted __be64 [usertype] + +Fixes: 736c3b94474e ("cxgb4: collect egress and ingress SGE queue contexts") +Signed-off-by: Rahul Lakkireddy +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c +@@ -1992,7 +1992,6 @@ int cudbg_collect_dump_context(struct cu + u8 mem_type[CTXT_INGRESS + 1] = { 0 }; + struct cudbg_buffer temp_buff = { 0 }; + struct cudbg_ch_cntxt *buff; +- u64 *dst_off, *src_off; + u8 *ctx_buf; + u8 i, k; + int rc; +@@ -2061,8 +2060,11 @@ int cudbg_collect_dump_context(struct cu + } + + for (j = 0; j < max_ctx_qid; j++) { ++ __be64 *dst_off; ++ u64 *src_off; ++ + src_off = (u64 *)(ctx_buf + j * SGE_CTXT_SIZE); +- dst_off = (u64 *)buff->data; ++ dst_off = (__be64 *)buff->data; + + /* The data is stored in 64-bit cpu order. Convert it + * to big endian before parsing. diff --git a/patches.suse/cxgb4-fix-adapter-crash-due-to-wrong-MC-size.patch b/patches.suse/cxgb4-fix-adapter-crash-due-to-wrong-MC-size.patch new file mode 100644 index 0000000..970add9 --- /dev/null +++ b/patches.suse/cxgb4-fix-adapter-crash-due-to-wrong-MC-size.patch @@ -0,0 +1,77 @@ +From: Vishal Kulkarni +Date: Wed, 22 Apr 2020 21:20:07 +0530 +Subject: cxgb4: fix adapter crash due to wrong MC size +Patch-mainline: v5.7-rc3 +Git-commit: ce222748078592afb51b810dc154531aeba4f512 +References: bsc#1073513 + +In the absence of MC1, the size calculation function +cudbg_mem_region_size() was returing wrong MC size and +resulted in adapter crash. This patch adds new argument +to cudbg_mem_region_size() which will have actual size +and returns error to caller in the absence of MC1. + +Fixes: a1c69520f785 ("cxgb4: collect MC memory dump") +Signed-off-by: Vishal Kulkarni " +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c | 27 ++++++++++++++++++------- + 1 file changed, 20 insertions(+), 7 deletions(-) + +--- a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c +@@ -1066,9 +1066,9 @@ static void cudbg_t4_fwcache(struct cudb + } + } + +-static unsigned long cudbg_mem_region_size(struct cudbg_init *pdbg_init, +- struct cudbg_error *cudbg_err, +- u8 mem_type) ++static int cudbg_mem_region_size(struct cudbg_init *pdbg_init, ++ struct cudbg_error *cudbg_err, ++ u8 mem_type, unsigned long *region_size) + { + struct adapter *padap = pdbg_init->adap; + struct cudbg_meminfo mem_info; +@@ -1077,15 +1077,23 @@ static unsigned long cudbg_mem_region_si + + memset(&mem_info, 0, sizeof(struct cudbg_meminfo)); + rc = cudbg_fill_meminfo(padap, &mem_info); +- if (rc) ++ if (rc) { ++ cudbg_err->sys_err = rc; + return rc; ++ } + + cudbg_t4_fwcache(pdbg_init, cudbg_err); + rc = cudbg_meminfo_get_mem_index(padap, &mem_info, mem_type, &mc_idx); +- if (rc) ++ if (rc) { ++ cudbg_err->sys_err = rc; + return rc; ++ } ++ ++ if (region_size) ++ *region_size = mem_info.avail[mc_idx].limit - ++ mem_info.avail[mc_idx].base; + +- return mem_info.avail[mc_idx].limit - mem_info.avail[mc_idx].base; ++ return 0; + } + + static int cudbg_collect_mem_region(struct cudbg_init *pdbg_init, +@@ -1093,7 +1101,12 @@ static int cudbg_collect_mem_region(stru + struct cudbg_error *cudbg_err, + u8 mem_type) + { +- unsigned long size = cudbg_mem_region_size(pdbg_init, cudbg_err, mem_type); ++ unsigned long size = 0; ++ int rc; ++ ++ rc = cudbg_mem_region_size(pdbg_init, cudbg_err, mem_type, &size); ++ if (rc) ++ return rc; + + return cudbg_read_fw_mem(pdbg_init, dbg_buff, mem_type, size, + cudbg_err); diff --git a/patches.suse/cxgb4-fix-all-mask-IP-address-comparison.patch b/patches.suse/cxgb4-fix-all-mask-IP-address-comparison.patch new file mode 100644 index 0000000..61be591 --- /dev/null +++ b/patches.suse/cxgb4-fix-all-mask-IP-address-comparison.patch @@ -0,0 +1,41 @@ +From: Rahul Lakkireddy +Date: Thu, 9 Jul 2020 03:14:27 +0530 +Subject: cxgb4: fix all-mask IP address comparison +Patch-mainline: v5.8-rc5 +Git-commit: 76c4d85c9260c3d741cbd194c30c61983d0a4303 +References: bsc#1064802 bsc#1066129 + +Convert all-mask IP address to Big Endian, instead, for comparison. + +Fixes: f286dd8eaad5 ("cxgb4: use correct type for all-mask IP address comparison") +Signed-off-by: Rahul Lakkireddy +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c +@@ -834,16 +834,16 @@ static bool is_addr_all_mask(u8 *ipmask, + struct in_addr *addr; + + addr = (struct in_addr *)ipmask; +- if (ntohl(addr->s_addr) == 0xffffffff) ++ if (addr->s_addr == htonl(0xffffffff)) + return true; + } else if (family == AF_INET6) { + struct in6_addr *addr6; + + addr6 = (struct in6_addr *)ipmask; +- if (ntohl(addr6->s6_addr32[0]) == 0xffffffff && +- ntohl(addr6->s6_addr32[1]) == 0xffffffff && +- ntohl(addr6->s6_addr32[2]) == 0xffffffff && +- ntohl(addr6->s6_addr32[3]) == 0xffffffff) ++ if (addr6->s6_addr32[0] == htonl(0xffffffff) && ++ addr6->s6_addr32[1] == htonl(0xffffffff) && ++ addr6->s6_addr32[2] == htonl(0xffffffff) && ++ addr6->s6_addr32[3] == htonl(0xffffffff)) + return true; + } + return false; diff --git a/patches.suse/cxgb4-fix-large-delays-in-PTP-synchronization.patch b/patches.suse/cxgb4-fix-large-delays-in-PTP-synchronization.patch new file mode 100644 index 0000000..d01ed6d --- /dev/null +++ b/patches.suse/cxgb4-fix-large-delays-in-PTP-synchronization.patch @@ -0,0 +1,74 @@ +From: Rahul Lakkireddy +Date: Mon, 20 Apr 2020 15:26:54 +0530 +Subject: cxgb4: fix large delays in PTP synchronization +Patch-mainline: v5.7-rc3 +Git-commit: bd019427bf3623ee3c7d2845cf921bbf4c14846c +References: bsc#1046540 bsc#1046648 + +Fetching PTP sync information from mailbox is slow and can take +up to 10 milliseconds. Reduce this unnecessary delay by directly +reading the information from the corresponding registers. + +Fixes: 9c33e4208bce ("cxgb4: Add PTP Hardware Clock (PHC) support") +Signed-off-by: Manoj Malviya +Signed-off-by: Rahul Lakkireddy +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c | 27 +++++-------------------- + drivers/net/ethernet/chelsio/cxgb4/t4_regs.h | 3 ++ + 2 files changed, 9 insertions(+), 21 deletions(-) + +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c +@@ -308,32 +308,17 @@ static int cxgb4_ptp_adjtime(struct ptp_ + */ + static int cxgb4_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts) + { +- struct adapter *adapter = (struct adapter *)container_of(ptp, +- struct adapter, ptp_clock_info); +- struct fw_ptp_cmd c; ++ struct adapter *adapter = container_of(ptp, struct adapter, ++ ptp_clock_info); + u64 ns; +- int err; + +- memset(&c, 0, sizeof(c)); +- c.op_to_portid = cpu_to_be32(FW_CMD_OP_V(FW_PTP_CMD) | +- FW_CMD_REQUEST_F | +- FW_CMD_READ_F | +- FW_PTP_CMD_PORTID_V(0)); +- c.retval_len16 = cpu_to_be32(FW_CMD_LEN16_V(sizeof(c) / 16)); +- c.u.ts.sc = FW_PTP_SC_GET_TIME; +- +- err = t4_wr_mbox(adapter, adapter->mbox, &c, sizeof(c), &c); +- if (err < 0) { +- dev_err(adapter->pdev_dev, +- "PTP: %s error %d\n", __func__, -err); +- return err; +- } ++ ns = t4_read_reg(adapter, T5_PORT_REG(0, MAC_PORT_PTP_SUM_LO_A)); ++ ns |= (u64)t4_read_reg(adapter, ++ T5_PORT_REG(0, MAC_PORT_PTP_SUM_HI_A)) << 32; + + /* convert to timespec*/ +- ns = be64_to_cpu(c.u.ts.tm); + *ts = ns_to_timespec64(ns); +- +- return err; ++ return 0; + } + + /** +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h +@@ -1900,6 +1900,9 @@ + + #define MAC_PORT_CFG2_A 0x818 + ++#define MAC_PORT_PTP_SUM_LO_A 0x990 ++#define MAC_PORT_PTP_SUM_HI_A 0x994 ++ + #define MPS_CMN_CTL_A 0x9000 + + #define COUNTPAUSEMCRX_S 5 diff --git a/patches.suse/cxgb4-fix-the-panic-caused-by-non-smac-rewrite.patch b/patches.suse/cxgb4-fix-the-panic-caused-by-non-smac-rewrite.patch new file mode 100644 index 0000000..8993b28 --- /dev/null +++ b/patches.suse/cxgb4-fix-the-panic-caused-by-non-smac-rewrite.patch @@ -0,0 +1,34 @@ +From: Raju Rangoju +Date: Wed, 18 Nov 2020 20:02:13 +0530 +Subject: cxgb4: fix the panic caused by non smac rewrite +Patch-mainline: v5.10-rc6 +Git-commit: bff453921ae105a8dbbad0ed7dd5f5ce424536e7 +References: bsc#1064802 bsc#1066129 + +SMT entry is allocated only when loopback Source MAC +rewriting is requested. Accessing SMT entry for non +smac rewrite cases results in kernel panic. + +Fix the panic caused by non smac rewrite + +Fixes: 937d84205884 ("cxgb4: set up filter action after rewrites") +Signed-off-by: Raju Rangoju +Link: https://lore.kernel.org/r/20201118143213.13319-1-rajur@chelsio.com +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c +@@ -626,7 +626,8 @@ int set_filter_wr(struct adapter *adapte + FW_FILTER_WR_OVLAN_VLD_V(f->fs.val.ovlan_vld) | + FW_FILTER_WR_IVLAN_VLDM_V(f->fs.mask.ivlan_vld) | + FW_FILTER_WR_OVLAN_VLDM_V(f->fs.mask.ovlan_vld)); +- fwr->smac_sel = f->smt->idx; ++ if (f->fs.newsmac) ++ fwr->smac_sel = f->smt->idx; + fwr->rx_chan_rx_rpl_iq = + htons(FW_FILTER_WR_RX_CHAN_V(0) | + FW_FILTER_WR_RX_RPL_IQ_V(adapter->sge.fw_evtq.abs_id)); diff --git a/patches.suse/cxgb4-fix-thermal-zone-device-registration.patch b/patches.suse/cxgb4-fix-thermal-zone-device-registration.patch new file mode 100644 index 0000000..bde85b3 --- /dev/null +++ b/patches.suse/cxgb4-fix-thermal-zone-device-registration.patch @@ -0,0 +1,104 @@ +From: Potnuri Bharat Teja +Date: Fri, 28 Aug 2020 21:14:40 +0530 +Subject: cxgb4: fix thermal zone device registration +Patch-mainline: v5.9-rc4 +Git-commit: 6b6382a857d824c0866056d5736bbcb597a922ed +References: bsc#1104279 FATE#325938 bsc#1104277 FATE#325936 + +When multiple adapters are present in the system, pci hot-removing second +adapter leads to the following warning as both the adapters registered +thermal zone device with same thermal zone name/type. +Therefore, use unique thermal zone name during thermal zone device +initialization. Also mark thermal zone dev NULL once unregistered. + +[ 414.370143] ------------[ cut here ]------------ +[ 414.370944] sysfs group 'power' not found for kobject 'hwmon0' +[ 414.371747] WARNING: CPU: 9 PID: 2661 at fs/sysfs/group.c:281 + sysfs_remove_group+0x76/0x80 +[ 414.382550] CPU: 9 PID: 2661 Comm: bash Not tainted 5.8.0-rc6+ #33 +[ 414.383593] Hardware name: Supermicro X10SRA-F/X10SRA-F, BIOS 2.0a 06/23/2016 +[ 414.384669] RIP: 0010:sysfs_remove_group+0x76/0x80 +[ 414.385738] Code: 48 89 df 5b 5d 41 5c e9 d8 b5 ff ff 48 89 df e8 60 b0 ff ff + eb cb 49 8b 14 24 48 8b 75 00 48 c7 c7 90 ae 13 bb e8 6a 27 d0 ff <0f> 0b 5b 5d + 41 5c c3 0f 1f 00 0f 1f 44 00 00 48 85 f6 74 31 41 54 +[ 414.388404] RSP: 0018:ffffa22bc080fcb0 EFLAGS: 00010286 +[ 414.389638] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 +[ 414.390829] RDX: 0000000000000001 RSI: ffff8ee2de3e9510 RDI: ffff8ee2de3e9510 +[ 414.392064] RBP: ffffffffbaef2ee0 R08: 0000000000000000 R09: 0000000000000000 +[ 414.393224] R10: 0000000000000000 R11: 000000002b30006c R12: ffff8ee260720008 +[ 414.394388] R13: ffff8ee25e0a40e8 R14: ffffa22bc080ff08 R15: ffff8ee2c3be5020 +[ 414.395661] FS: 00007fd2a7171740(0000) GS:ffff8ee2de200000(0000) + knlGS:0000000000000000 +[ 414.396825] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 414.398011] CR2: 00007f178ffe5020 CR3: 000000084c5cc003 CR4: 00000000003606e0 +[ 414.399172] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 414.400352] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 414.401473] Call Trace: +[ 414.402685] device_del+0x89/0x400 +[ 414.403819] device_unregister+0x16/0x60 +[ 414.405024] hwmon_device_unregister+0x44/0xa0 +[ 414.406112] thermal_remove_hwmon_sysfs+0x196/0x200 +[ 414.407256] thermal_zone_device_unregister+0x1b5/0x1f0 +[ 414.408415] cxgb4_thermal_remove+0x3c/0x4f [cxgb4] +[ 414.409668] remove_one+0x212/0x290 [cxgb4] +[ 414.410875] pci_device_remove+0x36/0xb0 +[ 414.412004] device_release_driver_internal+0xe2/0x1c0 +[ 414.413276] pci_stop_bus_device+0x64/0x90 +[ 414.414433] pci_stop_and_remove_bus_device_locked+0x16/0x30 +[ 414.415609] remove_store+0x75/0x90 +[ 414.416790] kernfs_fop_write+0x114/0x1b0 +[ 414.417930] vfs_write+0xcf/0x210 +[ 414.419059] ksys_write+0xa7/0xe0 +[ 414.420120] do_syscall_64+0x4c/0xa0 +[ 414.421278] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +[ 414.422335] RIP: 0033:0x7fd2a686afd0 +[ 414.423396] Code: Bad RIP value. +[ 414.424549] RSP: 002b:00007fffc1446148 EFLAGS: 00000246 ORIG_RAX: + 0000000000000001 +[ 414.425638] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fd2a686afd0 +[ 414.426830] RDX: 0000000000000002 RSI: 00007fd2a7196000 RDI: 0000000000000001 +[ 414.427927] RBP: 00007fd2a7196000 R08: 000000000000000a R09: 00007fd2a7171740 +[ 414.428923] R10: 00007fd2a7171740 R11: 0000000000000246 R12: 00007fd2a6b43400 +[ 414.430082] R13: 0000000000000002 R14: 0000000000000001 R15: 0000000000000000 +[ 414.431027] irq event stamp: 76300 +[ 414.435678] ---[ end trace 13865acb4d5ab00f ]--- + +Fixes: b18719157762 ("cxgb4: Add thermal zone support") +Signed-off-by: Potnuri Bharat Teja +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.c +@@ -73,6 +73,7 @@ static struct thermal_zone_device_ops cx + int cxgb4_thermal_init(struct adapter *adap) + { + struct ch_thermal *ch_thermal = &adap->ch_thermal; ++ char ch_tz_name[THERMAL_NAME_LENGTH]; + int num_trip = CXGB4_NUM_TRIPS; + u32 param, val; + int ret; +@@ -93,7 +94,8 @@ int cxgb4_thermal_init(struct adapter *a + ch_thermal->trip_type = THERMAL_TRIP_CRITICAL; + } + +- ch_thermal->tzdev = thermal_zone_device_register("cxgb4", num_trip, ++ snprintf(ch_tz_name, sizeof(ch_tz_name), "cxgb4_%s", adap->name); ++ ch_thermal->tzdev = thermal_zone_device_register(ch_tz_name, num_trip, + 0, adap, + &cxgb4_thermal_ops, + NULL, 0, 0); +@@ -108,7 +110,9 @@ int cxgb4_thermal_init(struct adapter *a + + int cxgb4_thermal_remove(struct adapter *adap) + { +- if (adap->ch_thermal.tzdev) ++ if (adap->ch_thermal.tzdev) { + thermal_zone_device_unregister(adap->ch_thermal.tzdev); ++ adap->ch_thermal.tzdev = NULL; ++ } + return 0; + } diff --git a/patches.suse/cxgb4-fix-throughput-drop-during-Tx-backpressure.patch b/patches.suse/cxgb4-fix-throughput-drop-during-Tx-backpressure.patch new file mode 100644 index 0000000..4414c4a --- /dev/null +++ b/patches.suse/cxgb4-fix-throughput-drop-during-Tx-backpressure.patch @@ -0,0 +1,98 @@ +From: Rahul Lakkireddy +Date: Thu, 19 Mar 2020 23:08:09 +0530 +Subject: cxgb4: fix throughput drop during Tx backpressure +Patch-mainline: v5.6 +Git-commit: 7affd80802afb6ca92dba47d768632fbde365241 +References: bsc#1127354 bsc#1127371 + +commit 7c3bebc3d868 ("cxgb4: request the TX CIDX updates to status page") +reverted back to getting Tx CIDX updates via DMA, instead of interrupts, +introduced by commit d429005fdf2c ("cxgb4/cxgb4vf: Add support for SGE +doorbell queue timer") + +However, it missed reverting back several code changes where Tx CIDX +updates are not explicitly requested during backpressure when using +interrupt mode. These missed changes cause slow recovery during +backpressure because the corresponding interrupt no longer comes and +hence results in Tx throughput drop. + +So, revert back these missed code changes, as well, which will allow +explicitly requesting Tx CIDX updates when backpressure happens. +This enables the corresponding interrupt with Tx CIDX update message +to get generated and hence speed up recovery and restore back +throughput. + +Fixes: 7c3bebc3d868 ("cxgb4: request the TX CIDX updates to status page") +Fixes: d429005fdf2c ("cxgb4/cxgb4vf: Add support for SGE doorbell queue timer") +Signed-off-by: Rahul Lakkireddy +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/chelsio/cxgb4/sge.c | 42 +------------------------------ + 1 file changed, 2 insertions(+), 40 deletions(-) + +--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c +@@ -1469,16 +1469,7 @@ out_free: dev_kfree_skb_any(skb); + * has opened up. + */ + eth_txq_stop(q); +- +- /* If we're using the SGE Doorbell Queue Timer facility, we +- * don't need to ask the Firmware to send us Egress Queue CIDX +- * Updates: the Hardware will do this automatically. And +- * since we send the Ingress Queue CIDX Updates to the +- * corresponding Ethernet Response Queue, we'll get them very +- * quickly. +- */ +- if (!q->dbqt) +- wr_mid |= FW_WR_EQUEQ_F | FW_WR_EQUIQ_F; ++ wr_mid |= FW_WR_EQUEQ_F | FW_WR_EQUIQ_F; + } + + wr = (void *)&q->q.desc[q->q.pidx]; +@@ -1793,16 +1784,7 @@ static netdev_tx_t cxgb4_vf_eth_xmit(str + * has opened up. + */ + eth_txq_stop(txq); +- +- /* If we're using the SGE Doorbell Queue Timer facility, we +- * don't need to ask the Firmware to send us Egress Queue CIDX +- * Updates: the Hardware will do this automatically. And +- * since we send the Ingress Queue CIDX Updates to the +- * corresponding Ethernet Response Queue, we'll get them very +- * quickly. +- */ +- if (!txq->dbqt) +- wr_mid |= FW_WR_EQUEQ_F | FW_WR_EQUIQ_F; ++ wr_mid |= FW_WR_EQUEQ_F | FW_WR_EQUIQ_F; + } + + /* Start filling in our Work Request. Note that we do _not_ handle +@@ -2925,26 +2907,6 @@ static void t4_tx_completion_handler(str + } + + txq = &s->ethtxq[pi->first_qset + rspq->idx]; +- +- /* We've got the Hardware Consumer Index Update in the Egress Update +- * message. If we're using the SGE Doorbell Queue Timer mechanism, +- * these Egress Update messages will be our sole CIDX Updates we get +- * since we don't want to chew up PCIe bandwidth for both Ingress +- * Messages and Status Page writes. However, The code which manages +- * reclaiming successfully DMA'ed TX Work Requests uses the CIDX value +- * stored in the Status Page at the end of the TX Queue. It's easiest +- * to simply copy the CIDX Update value from the Egress Update message +- * to the Status Page. Also note that no Endian issues need to be +- * considered here since both are Big Endian and we're just copying +- * bytes consistently ... +- */ +- if (txq->dbqt) { +- struct cpl_sge_egr_update *egr; +- +- egr = (struct cpl_sge_egr_update *)rsp; +- WRITE_ONCE(txq->q.stat->cidx, egr->cidx); +- } +- + t4_sge_eth_txq_egress_update(adapter, txq, -1); + } + diff --git a/patches.suse/cxgb4-move-DCB-version-extern-to-header-file.patch b/patches.suse/cxgb4-move-DCB-version-extern-to-header-file.patch new file mode 100644 index 0000000..cd0b65b --- /dev/null +++ b/patches.suse/cxgb4-move-DCB-version-extern-to-header-file.patch @@ -0,0 +1,44 @@ +From: Rahul Lakkireddy +Date: Wed, 24 Jun 2020 01:51:39 +0530 +Subject: cxgb4: move DCB version extern to header file +Patch-mainline: v5.8-rc3 +Git-commit: bab3bcf3e9873e1e6e9cb39c1f55a05fb10415a4 +References: bsc#1104279 FATE#325938 + +Move the DCB version string array extern to header file. + +Fixes following sparse warning: +cxgb4_dcb.c:13:12: warning: symbol 'dcb_ver_array' was not declared. +Should it be static? + +Fixes: ebddd97afb89 ("cxgb4: add support to display DCB info") +Signed-off-by: Rahul Lakkireddy +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h | 3 +++ + drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 1 - + 2 files changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h +@@ -148,6 +148,9 @@ static inline __u8 bitswap_1(unsigned ch + ((val & 0x02) << 5) | + ((val & 0x01) << 7); + } ++ ++extern const char * const dcb_ver_array[]; ++ + #define CXGB4_DCB_ENABLED true + + #else /* !CONFIG_CHELSIO_T4_DCB */ +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c +@@ -2387,7 +2387,6 @@ static const struct file_operations rss_ + }; + + #ifdef CONFIG_CHELSIO_T4_DCB +-extern char *dcb_ver_array[]; + + /* Data Center Briging information for each port. + */ diff --git a/patches.suse/cxgb4-remove-cast-when-saving-IPv4-partial-checksum.patch b/patches.suse/cxgb4-remove-cast-when-saving-IPv4-partial-checksum.patch new file mode 100644 index 0000000..f9e8250 --- /dev/null +++ b/patches.suse/cxgb4-remove-cast-when-saving-IPv4-partial-checksum.patch @@ -0,0 +1,36 @@ +From: Rahul Lakkireddy +Date: Wed, 24 Jun 2020 01:51:38 +0530 +Subject: cxgb4: remove cast when saving IPv4 partial checksum +Patch-mainline: v5.8-rc3 +Git-commit: 2f6670165d22406467c667e9454e558bc75b933e +References: bsc#1074220 + +The checksum field in IPv4 header is in __sum16 and ip_fast_csum() +also returns __sum16. So, no need to cast it to u16. + +Fixes following sparse warning: +sge.c:1539:47: warning: cast from restricted __sum16 +sge.c:1539:44: warning: incorrect type in assignment (different base types) +sge.c:1539:44: expected restricted __sum16 [usertype] check +sge.c:1539:44: got unsigned short [usertype] + +Fixes: d0a1299c6bf7 ("cxgb4: add support for vxlan segmentation offload") +Signed-off-by: Rahul Lakkireddy +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/chelsio/cxgb4/sge.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c +@@ -1510,8 +1510,7 @@ out_free: dev_kfree_skb_any(skb); + if (iph->version == 4) { + iph->check = 0; + iph->tot_len = 0; +- iph->check = (u16)(~ip_fast_csum((u8 *)iph, +- iph->ihl)); ++ iph->check = ~ip_fast_csum((u8 *)iph, iph->ihl); + } + if (skb->ip_summed == CHECKSUM_PARTIAL) + cntrl = hwcsum(adap->params.chip, skb); diff --git a/patches.suse/cxgb4-set-up-filter-action-after-rewrites.patch b/patches.suse/cxgb4-set-up-filter-action-after-rewrites.patch new file mode 100644 index 0000000..b82089f --- /dev/null +++ b/patches.suse/cxgb4-set-up-filter-action-after-rewrites.patch @@ -0,0 +1,151 @@ +From: Raju Rangoju +Date: Fri, 23 Oct 2020 17:28:52 +0530 +Subject: cxgb4: set up filter action after rewrites +Patch-mainline: v5.10-rc2 +Git-commit: 937d8420588421eaa5c7aa5c79b26b42abb288ef +References: bsc#1064802 bsc#1066129 + +The current code sets up the filter action field before +rewrites are set up. When the action 'switch' is used +with rewrites, this may result in initial few packets +that get switched out don't have rewrites applied +on them. + +So, make sure filter action is set up along with rewrites +or only after everything else is set up for rewrites. + +Fixes: 12b276fbf6e0 ("cxgb4: add support to create hash filters") +Signed-off-by: Raju Rangoju +Link: https://lore.kernel.org/r/20201023115852.18262-1-rajur@chelsio.com +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 56 ++++++++++------------ + drivers/net/ethernet/chelsio/cxgb4/t4_tcb.h | 4 + + 2 files changed, 31 insertions(+), 29 deletions(-) + +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c +@@ -145,13 +145,13 @@ static int configure_filter_smac(struct + int err; + + /* do a set-tcb for smac-sel and CWR bit.. */ +- err = set_tcb_tflag(adap, f, f->tid, TF_CCTRL_CWR_S, 1, 1); +- if (err) +- goto smac_err; +- + err = set_tcb_field(adap, f, f->tid, TCB_SMAC_SEL_W, + TCB_SMAC_SEL_V(TCB_SMAC_SEL_M), + TCB_SMAC_SEL_V(f->smt->idx), 1); ++ if (err) ++ goto smac_err; ++ ++ err = set_tcb_tflag(adap, f, f->tid, TF_CCTRL_CWR_S, 1, 1); + if (!err) + return 0; + +@@ -608,6 +608,7 @@ int set_filter_wr(struct adapter *adapte + FW_FILTER_WR_DIRSTEERHASH_V(f->fs.dirsteerhash) | + FW_FILTER_WR_LPBK_V(f->fs.action == FILTER_SWITCH) | + FW_FILTER_WR_DMAC_V(f->fs.newdmac) | ++ FW_FILTER_WR_SMAC_V(f->fs.newsmac) | + FW_FILTER_WR_INSVLAN_V(f->fs.newvlan == VLAN_INSERT || + f->fs.newvlan == VLAN_REWRITE) | + FW_FILTER_WR_RMVLAN_V(f->fs.newvlan == VLAN_REMOVE || +@@ -625,7 +626,7 @@ int set_filter_wr(struct adapter *adapte + FW_FILTER_WR_OVLAN_VLD_V(f->fs.val.ovlan_vld) | + FW_FILTER_WR_IVLAN_VLDM_V(f->fs.mask.ivlan_vld) | + FW_FILTER_WR_OVLAN_VLDM_V(f->fs.mask.ovlan_vld)); +- fwr->smac_sel = 0; ++ fwr->smac_sel = f->smt->idx; + fwr->rx_chan_rx_rpl_iq = + htons(FW_FILTER_WR_RX_CHAN_V(0) | + FW_FILTER_WR_RX_RPL_IQ_V(adapter->sge.fw_evtq.abs_id)); +@@ -1043,11 +1044,8 @@ static void mk_act_open_req6(struct filt + TX_QUEUE_V(f->fs.nat_mode) | + T5_OPT_2_VALID_F | + RX_CHANNEL_V(cxgb4_port_e2cchan(f->dev)) | +- CONG_CNTRL_V((f->fs.action == FILTER_DROP) | +- (f->fs.dirsteer << 1)) | + PACE_V((f->fs.maskhash) | +- ((f->fs.dirsteerhash) << 1)) | +- CCTRL_ECN_V(f->fs.action == FILTER_SWITCH)); ++ ((f->fs.dirsteerhash) << 1))); + } + + static void mk_act_open_req(struct filter_entry *f, struct sk_buff *skb, +@@ -1083,11 +1081,8 @@ static void mk_act_open_req(struct filte + TX_QUEUE_V(f->fs.nat_mode) | + T5_OPT_2_VALID_F | + RX_CHANNEL_V(cxgb4_port_e2cchan(f->dev)) | +- CONG_CNTRL_V((f->fs.action == FILTER_DROP) | +- (f->fs.dirsteer << 1)) | + PACE_V((f->fs.maskhash) | +- ((f->fs.dirsteerhash) << 1)) | +- CCTRL_ECN_V(f->fs.action == FILTER_SWITCH)); ++ ((f->fs.dirsteerhash) << 1))); + } + + static int cxgb4_set_hash_filter(struct net_device *dev, +@@ -1745,6 +1740,20 @@ void hash_filter_rpl(struct adapter *ada + } + return; + } ++ switch (f->fs.action) { ++ case FILTER_PASS: ++ if (f->fs.dirsteer) ++ set_tcb_tflag(adap, f, tid, ++ TF_DIRECT_STEER_S, 1, 1); ++ break; ++ case FILTER_DROP: ++ set_tcb_tflag(adap, f, tid, TF_DROP_S, 1, 1); ++ break; ++ case FILTER_SWITCH: ++ set_tcb_tflag(adap, f, tid, TF_LPBK_S, 1, 1); ++ break; ++ } ++ + break; + + default: +@@ -1805,22 +1814,11 @@ void filter_rpl(struct adapter *adap, co + if (ctx) + ctx->result = 0; + } else if (ret == FW_FILTER_WR_FLT_ADDED) { +- int err = 0; +- +- if (f->fs.newsmac) +- err = configure_filter_smac(adap, f); +- +- if (!err) { +- f->pending = 0; /* async setup completed */ +- f->valid = 1; +- if (ctx) { +- ctx->result = 0; +- ctx->tid = idx; +- } +- } else { +- clear_filter(adap, f); +- if (ctx) +- ctx->result = err; ++ f->pending = 0; /* async setup completed */ ++ f->valid = 1; ++ if (ctx) { ++ ctx->result = 0; ++ ctx->tid = idx; + } + } else { + /* Something went wrong. Issue a warning about the +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_tcb.h ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_tcb.h +@@ -50,6 +50,10 @@ + #define TCB_RQ_START_M 0x3ffffffULL + #define TCB_RQ_START_V(x) ((x) << TCB_RQ_START_S) + ++#define TF_DROP_S 22 ++#define TF_DIRECT_STEER_S 23 ++#define TF_LPBK_S 59 ++ + #define TF_CCTRL_ECE_S 60 + #define TF_CCTRL_CWR_S 61 + #define TF_CCTRL_RFR_S 62 diff --git a/patches.suse/cxgb4-use-correct-type-for-all-mask-IP-address-compa.patch b/patches.suse/cxgb4-use-correct-type-for-all-mask-IP-address-compa.patch new file mode 100644 index 0000000..303e36f --- /dev/null +++ b/patches.suse/cxgb4-use-correct-type-for-all-mask-IP-address-compa.patch @@ -0,0 +1,49 @@ +From: Rahul Lakkireddy +Date: Wed, 24 Jun 2020 01:51:36 +0530 +Subject: cxgb4: use correct type for all-mask IP address comparison +Patch-mainline: v5.8-rc3 +Git-commit: f286dd8eaad5a2758750f407ab079298e0bcc8a5 +References: bsc#1064802 bsc#1066129 + +Use correct type to check for all-mask exact match IP addresses. + +Fixes following sparse warnings due to big endian value checks +against 0xffffffff in is_addr_all_mask(): +cxgb4_filter.c:977:25: warning: restricted __be32 degrades to integer +cxgb4_filter.c:983:37: warning: restricted __be32 degrades to integer +cxgb4_filter.c:984:37: warning: restricted __be32 degrades to integer +cxgb4_filter.c:985:37: warning: restricted __be32 degrades to integer +cxgb4_filter.c:986:37: warning: restricted __be32 degrades to integer + +Fixes: 3eb8b62d5a26 ("cxgb4: add support to create hash-filters via tc-flower offload") +Signed-off-by: Rahul Lakkireddy +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c +@@ -834,16 +834,16 @@ static bool is_addr_all_mask(u8 *ipmask, + struct in_addr *addr; + + addr = (struct in_addr *)ipmask; +- if (addr->s_addr == 0xffffffff) ++ if (ntohl(addr->s_addr) == 0xffffffff) + return true; + } else if (family == AF_INET6) { + struct in6_addr *addr6; + + addr6 = (struct in6_addr *)ipmask; +- if (addr6->s6_addr32[0] == 0xffffffff && +- addr6->s6_addr32[1] == 0xffffffff && +- addr6->s6_addr32[2] == 0xffffffff && +- addr6->s6_addr32[3] == 0xffffffff) ++ if (ntohl(addr6->s6_addr32[0]) == 0xffffffff && ++ ntohl(addr6->s6_addr32[1]) == 0xffffffff && ++ ntohl(addr6->s6_addr32[2]) == 0xffffffff && ++ ntohl(addr6->s6_addr32[3]) == 0xffffffff) + return true; + } + return false; diff --git a/patches.suse/cxgb4-use-unaligned-conversion-for-fetching-timestam.patch b/patches.suse/cxgb4-use-unaligned-conversion-for-fetching-timestam.patch new file mode 100644 index 0000000..50a8835 --- /dev/null +++ b/patches.suse/cxgb4-use-unaligned-conversion-for-fetching-timestam.patch @@ -0,0 +1,32 @@ +From: Rahul Lakkireddy +Date: Wed, 24 Jun 2020 01:51:33 +0530 +Subject: cxgb4: use unaligned conversion for fetching timestamp +Patch-mainline: v5.8-rc3 +Git-commit: 589b1c9c166dce120e27b32a83a78f55464a7ef9 +References: bsc#1046540 bsc#1046648 + +Use get_unaligned_be64() to fetch the timestamp needed for ns_to_ktime() +conversion. + +Fixes following sparse warning: +sge.c:3282:43: warning: cast to restricted __be64 + +Fixes: a456950445a0 ("cxgb4: time stamping interface for PTP") +Signed-off-by: Rahul Lakkireddy +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/chelsio/cxgb4/sge.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c +@@ -2817,7 +2817,7 @@ static noinline int t4_systim_to_hwstamp + + hwtstamps = skb_hwtstamps(skb); + memset(hwtstamps, 0, sizeof(*hwtstamps)); +- hwtstamps->hwtstamp = ns_to_ktime(be64_to_cpu(*((u64 *)data))); ++ hwtstamps->hwtstamp = ns_to_ktime(get_unaligned_be64(data)); + + return RX_PTP_PKT_SUC; + } diff --git a/patches.suse/drivers-net-xgene-Fix-the-order-of-the-arguments-of-.patch b/patches.suse/drivers-net-xgene-Fix-the-order-of-the-arguments-of-.patch new file mode 100644 index 0000000..f179fe8 --- /dev/null +++ b/patches.suse/drivers-net-xgene-Fix-the-order-of-the-arguments-of-.patch @@ -0,0 +1,35 @@ +From: Christophe JAILLET +Date: Sun, 26 Jan 2020 11:44:29 +0100 +Subject: drivers: net: xgene: Fix the order of the arguments of + 'alloc_etherdev_mqs()' +Patch-mainline: v5.6-rc1 +Git-commit: 5a44c71ccda60a50073c5d7fe3f694cdfa3ab0c2 +References: git-fixes + +'alloc_etherdev_mqs()' expects first 'tx', then 'rx'. The semantic here +looks reversed. + +Reorder the arguments passed to 'alloc_etherdev_mqs()' in order to keep +the correct semantic. + +In fact, this is a no-op because both XGENE_NUM_[RT]X_RING are 8. + +Fixes: 107dec2749fe ("drivers: net: xgene: Add support for multiple queues") +Signed-off-by: Christophe JAILLET +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c ++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c +@@ -2037,7 +2037,7 @@ static int xgene_enet_probe(struct platf + int ret; + + ndev = alloc_etherdev_mqs(sizeof(struct xgene_enet_pdata), +- XGENE_NUM_RX_RING, XGENE_NUM_TX_RING); ++ XGENE_NUM_TX_RING, XGENE_NUM_RX_RING); + if (!ndev) + return -ENOMEM; + diff --git a/patches.suse/drm-i915-Check-for-all-subplatform-bits.patch b/patches.suse/drm-i915-Check-for-all-subplatform-bits.patch new file mode 100644 index 0000000..2b4b5be --- /dev/null +++ b/patches.suse/drm-i915-Check-for-all-subplatform-bits.patch @@ -0,0 +1,43 @@ +From 8f6d08c9af284d74276da6681348e4673f13caea Mon Sep 17 00:00:00 2001 +From: Umesh Nerlige Ramappa +Date: Thu, 21 Jan 2021 16:19:35 +0000 +Subject: [PATCH] drm/i915: Check for all subplatform bits +Git-commit: 8f6d08c9af284d74276da6681348e4673f13caea +Patch-mainline: v5.11-rc6 +No-fix: 27b695ee1af9bb36605e67055874ec081306ac28 +References: git-fixes + +Current code is checking only 2 bits in the subplatform, but actually 3 +bits are allocated for the field. Check all 3 bits. + +Fixes: 805446c8347c ("drm/i915: Introduce concept of a sub-platform") +Cc: Tvrtko Ursulin +Signed-off-by: Umesh Nerlige Ramappa +Reviewed-by: Tvrtko Ursulin +Signed-off-by: Chris Wilson +Link: https://patchwork.freedesktop.org/patch/msgid/20210121161936.746591-1-tvrtko.ursulin@linux.intel.com +(cherry picked from commit 27b695ee1af9bb36605e67055874ec081306ac28) + +Signed-off-by: Jani Nikula +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/i915/i915_drv.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h +index 632c713227dc..c6964f82a1bb 100644 +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -1346,7 +1346,7 @@ intel_subplatform(const struct intel_runtime_info *info, enum intel_platform p) + { + const unsigned int pi = __platform_mask_index(info, p); + +- return info->platform_mask[pi] & INTEL_SUBPLATFORM_BITS; ++ return info->platform_mask[pi] & ((1 << INTEL_SUBPLATFORM_BITS) - 1); + } + + static __always_inline bool +-- +2.26.2 + diff --git a/patches.suse/drm-nouveau-bios-fix-issue-shadowing-expansion-ROMs.patch b/patches.suse/drm-nouveau-bios-fix-issue-shadowing-expansion-ROMs.patch new file mode 100644 index 0000000..6b66f68 --- /dev/null +++ b/patches.suse/drm-nouveau-bios-fix-issue-shadowing-expansion-ROMs.patch @@ -0,0 +1,50 @@ +From 402a89660e9dc880710b12773076a336c9dab3d7 Mon Sep 17 00:00:00 2001 +From: Ben Skeggs +Date: Wed, 13 Jan 2021 17:12:52 +1000 +Subject: [PATCH] drm/nouveau/bios: fix issue shadowing expansion ROMs +Git-commit: 402a89660e9dc880710b12773076a336c9dab3d7 +Patch-mainline: v5.11-rc4 +References: git-fixes + +This issue has generally been covered up by the presence of additional +expansion ROMs after the ones we're interested in, with header fetches +of subsequent images loading enough of the ROM to hide the issue. + +Noticed on GA102, which lacks a type 0x70 image compared to TU102,. + +[ 906.364197] nouveau 0000:09:00.0: bios: 00000000: type 00, 65024 bytes +[ 906.381205] nouveau 0000:09:00.0: bios: 0000fe00: type 03, 91648 bytes +[ 906.405213] nouveau 0000:09:00.0: bios: 00026400: type e0, 22016 bytes +[ 906.410984] nouveau 0000:09:00.0: bios: 0002ba00: type e0, 366080 bytes + +vs + +[ 22.961901] nouveau 0000:09:00.0: bios: 00000000: type 00, 60416 bytes +[ 22.984174] nouveau 0000:09:00.0: bios: 0000ec00: type 03, 71168 bytes +[ 23.010446] nouveau 0000:09:00.0: bios: 00020200: type e0, 48128 bytes +[ 23.028220] nouveau 0000:09:00.0: bios: 0002be00: type e0, 140800 bytes +[ 23.080196] nouveau 0000:09:00.0: bios: 0004e400: type 70, 7168 bytes + +Signed-off-by: Ben Skeggs +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c +index 7deb81b6dbac..4b571cc6bc70 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c +@@ -75,7 +75,7 @@ shadow_image(struct nvkm_bios *bios, int idx, u32 offset, struct shadow *mthd) + nvkm_debug(subdev, "%08x: type %02x, %d bytes\n", + image.base, image.type, image.size); + +- if (!shadow_fetch(bios, mthd, image.size)) { ++ if (!shadow_fetch(bios, mthd, image.base + image.size)) { + nvkm_debug(subdev, "%08x: fetch failed\n", image.base); + return 0; + } +-- +2.26.2 + diff --git a/patches.suse/drm-nouveau-i2c-gm200-increase-width-of-aux-semaphor.patch b/patches.suse/drm-nouveau-i2c-gm200-increase-width-of-aux-semaphor.patch new file mode 100644 index 0000000..ec4f288 --- /dev/null +++ b/patches.suse/drm-nouveau-i2c-gm200-increase-width-of-aux-semaphor.patch @@ -0,0 +1,55 @@ +From ba6e9ab0fcf3d76e3952deb12b5f993991621d9c Mon Sep 17 00:00:00 2001 +From: Ben Skeggs +Date: Wed, 13 Jan 2021 17:12:52 +1000 +Subject: [PATCH] drm/nouveau/i2c/gm200: increase width of aux semaphore owner fields +Git-commit: ba6e9ab0fcf3d76e3952deb12b5f993991621d9c +Patch-mainline: v5.11-rc4 +References: git-fixes + +Noticed while debugging GA102. + +Signed-off-by: Ben Skeggs +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c +index ab67b67fd2a5..8bd1d442e465 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c +@@ -33,7 +33,7 @@ static void + gm200_i2c_aux_fini(struct gm200_i2c_aux *aux) + { + struct nvkm_device *device = aux->base.pad->i2c->subdev.device; +- nvkm_mask(device, 0x00d954 + (aux->ch * 0x50), 0x00310000, 0x00000000); ++ nvkm_mask(device, 0x00d954 + (aux->ch * 0x50), 0x00710000, 0x00000000); + } + + static int +@@ -54,10 +54,10 @@ gm200_i2c_aux_init(struct gm200_i2c_aux *aux) + AUX_ERR(&aux->base, "begin idle timeout %08x", ctrl); + return -EBUSY; + } +- } while (ctrl & 0x03010000); ++ } while (ctrl & 0x07010000); + + /* set some magic, and wait up to 1ms for it to appear */ +- nvkm_mask(device, 0x00d954 + (aux->ch * 0x50), 0x00300000, ureq); ++ nvkm_mask(device, 0x00d954 + (aux->ch * 0x50), 0x00700000, ureq); + timeout = 1000; + do { + ctrl = nvkm_rd32(device, 0x00d954 + (aux->ch * 0x50)); +@@ -67,7 +67,7 @@ gm200_i2c_aux_init(struct gm200_i2c_aux *aux) + gm200_i2c_aux_fini(aux); + return -EBUSY; + } +- } while ((ctrl & 0x03000000) != urep); ++ } while ((ctrl & 0x07000000) != urep); + + return 0; + } +-- +2.26.2 + diff --git a/patches.suse/drm-nouveau-privring-ack-interrupts-the-same-way-as-.patch b/patches.suse/drm-nouveau-privring-ack-interrupts-the-same-way-as-.patch new file mode 100644 index 0000000..2a1f864 --- /dev/null +++ b/patches.suse/drm-nouveau-privring-ack-interrupts-the-same-way-as-.patch @@ -0,0 +1,119 @@ +From e05e06cd34f5311f677294a08b609acfbc315236 Mon Sep 17 00:00:00 2001 +From: Ben Skeggs +Date: Wed, 13 Jan 2021 17:12:52 +1000 +Subject: [PATCH] drm/nouveau/privring: ack interrupts the same way as RM +Git-commit: e05e06cd34f5311f677294a08b609acfbc315236 +Patch-mainline: v5.11-rc4 +References: git-fixes + +Whatever it is that we were doing before doesn't work on Ampere. + +Signed-off-by: Ben Skeggs +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gf100.c | 10 +++++++--- + drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gk104.c | 10 +++++++--- + 2 files changed, 14 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gf100.c b/drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gf100.c +index 2340040942c9..1115376bc85f 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gf100.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gf100.c +@@ -22,6 +22,7 @@ + * Authors: Ben Skeggs + */ + #include "priv.h" ++#include + + static void + gf100_ibus_intr_hub(struct nvkm_subdev *ibus, int i) +@@ -31,7 +32,6 @@ gf100_ibus_intr_hub(struct nvkm_subdev *ibus, int i) + u32 data = nvkm_rd32(device, 0x122124 + (i * 0x0400)); + u32 stat = nvkm_rd32(device, 0x122128 + (i * 0x0400)); + nvkm_debug(ibus, "HUB%d: %06x %08x (%08x)\n", i, addr, data, stat); +- nvkm_mask(device, 0x122128 + (i * 0x0400), 0x00000200, 0x00000000); + } + + static void +@@ -42,7 +42,6 @@ gf100_ibus_intr_rop(struct nvkm_subdev *ibus, int i) + u32 data = nvkm_rd32(device, 0x124124 + (i * 0x0400)); + u32 stat = nvkm_rd32(device, 0x124128 + (i * 0x0400)); + nvkm_debug(ibus, "ROP%d: %06x %08x (%08x)\n", i, addr, data, stat); +- nvkm_mask(device, 0x124128 + (i * 0x0400), 0x00000200, 0x00000000); + } + + static void +@@ -53,7 +52,6 @@ gf100_ibus_intr_gpc(struct nvkm_subdev *ibus, int i) + u32 data = nvkm_rd32(device, 0x128124 + (i * 0x0400)); + u32 stat = nvkm_rd32(device, 0x128128 + (i * 0x0400)); + nvkm_debug(ibus, "GPC%d: %06x %08x (%08x)\n", i, addr, data, stat); +- nvkm_mask(device, 0x128128 + (i * 0x0400), 0x00000200, 0x00000000); + } + + void +@@ -90,6 +88,12 @@ gf100_ibus_intr(struct nvkm_subdev *ibus) + intr1 &= ~stat; + } + } ++ ++ nvkm_mask(device, 0x121c4c, 0x0000003f, 0x00000002); ++ nvkm_msec(device, 2000, ++ if (!(nvkm_rd32(device, 0x121c4c) & 0x0000003f)) ++ break; ++ ); + } + + static int +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gk104.c b/drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gk104.c +index f3915f85838e..22e487b493ad 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gk104.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gk104.c +@@ -22,6 +22,7 @@ + * Authors: Ben Skeggs + */ + #include "priv.h" ++#include + + static void + gk104_ibus_intr_hub(struct nvkm_subdev *ibus, int i) +@@ -31,7 +32,6 @@ gk104_ibus_intr_hub(struct nvkm_subdev *ibus, int i) + u32 data = nvkm_rd32(device, 0x122124 + (i * 0x0800)); + u32 stat = nvkm_rd32(device, 0x122128 + (i * 0x0800)); + nvkm_debug(ibus, "HUB%d: %06x %08x (%08x)\n", i, addr, data, stat); +- nvkm_mask(device, 0x122128 + (i * 0x0800), 0x00000200, 0x00000000); + } + + static void +@@ -42,7 +42,6 @@ gk104_ibus_intr_rop(struct nvkm_subdev *ibus, int i) + u32 data = nvkm_rd32(device, 0x124124 + (i * 0x0800)); + u32 stat = nvkm_rd32(device, 0x124128 + (i * 0x0800)); + nvkm_debug(ibus, "ROP%d: %06x %08x (%08x)\n", i, addr, data, stat); +- nvkm_mask(device, 0x124128 + (i * 0x0800), 0x00000200, 0x00000000); + } + + static void +@@ -53,7 +52,6 @@ gk104_ibus_intr_gpc(struct nvkm_subdev *ibus, int i) + u32 data = nvkm_rd32(device, 0x128124 + (i * 0x0800)); + u32 stat = nvkm_rd32(device, 0x128128 + (i * 0x0800)); + nvkm_debug(ibus, "GPC%d: %06x %08x (%08x)\n", i, addr, data, stat); +- nvkm_mask(device, 0x128128 + (i * 0x0800), 0x00000200, 0x00000000); + } + + void +@@ -90,6 +88,12 @@ gk104_ibus_intr(struct nvkm_subdev *ibus) + intr1 &= ~stat; + } + } ++ ++ nvkm_mask(device, 0x12004c, 0x0000003f, 0x00000002); ++ nvkm_msec(device, 2000, ++ if (!(nvkm_rd32(device, 0x12004c) & 0x0000003f)) ++ break; ++ ); + } + + static int +-- +2.26.2 + diff --git a/patches.suse/ehci-fix-EHCI-host-controller-initialization-sequenc.patch b/patches.suse/ehci-fix-EHCI-host-controller-initialization-sequenc.patch new file mode 100644 index 0000000..4c3d085 --- /dev/null +++ b/patches.suse/ehci-fix-EHCI-host-controller-initialization-sequenc.patch @@ -0,0 +1,65 @@ +From 280a9045bb18833db921b316a5527d2b565e9f2e Mon Sep 17 00:00:00 2001 +From: Eugene Korenevsky +Date: Sun, 10 Jan 2021 20:36:09 +0300 +Subject: [PATCH] ehci: fix EHCI host controller initialization sequence +Git-commit: 280a9045bb18833db921b316a5527d2b565e9f2e +Patch-mainline: v5.11-rc5 +References: git-fixes + +According to EHCI spec, EHCI HC clears USBSTS.HCHalted whenever +USBCMD.RS=1. + +However, it is a good practice to wait some time after setting USBCMD.RS +(approximately 100ms) until USBSTS.HCHalted become zero. + +Without this waiting, VirtualBox's EHCI virtual HC accidentally hangs +(see BugLink). + +Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=211095 +Acked-by: Alan Stern +Signed-off-by: Eugene Korenevsky +Cc: stable +Link: https://lore.kernel.org/r/20210110173609.GA17313@himera.home +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/host/ehci-hcd.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c +index e358ae17d51e..1926b328b6aa 100644 +--- a/drivers/usb/host/ehci-hcd.c ++++ b/drivers/usb/host/ehci-hcd.c +@@ -574,6 +574,7 @@ static int ehci_run (struct usb_hcd *hcd) + struct ehci_hcd *ehci = hcd_to_ehci (hcd); + u32 temp; + u32 hcc_params; ++ int rc; + + hcd->uses_new_polling = 1; + +@@ -629,9 +630,20 @@ static int ehci_run (struct usb_hcd *hcd) + down_write(&ehci_cf_port_reset_rwsem); + ehci->rh_state = EHCI_RH_RUNNING; + ehci_writel(ehci, FLAG_CF, &ehci->regs->configured_flag); ++ ++ /* Wait until HC become operational */ + ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */ + msleep(5); ++ rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT, 0, 100 * 1000); ++ + up_write(&ehci_cf_port_reset_rwsem); ++ ++ if (rc) { ++ ehci_err(ehci, "USB %x.%x, controller refused to start: %d\n", ++ ((ehci->sbrn & 0xf0)>>4), (ehci->sbrn & 0x0f), rc); ++ return rc; ++ } ++ + ehci->last_periodic_enable = ktime_get_real(); + + temp = HC_VERSION(ehci, ehci_readl(ehci, &ehci->caps->hc_capbase)); +-- +2.26.2 + diff --git a/patches.suse/floppy-reintroduce-O_NDELAY-fix.patch b/patches.suse/floppy-reintroduce-O_NDELAY-fix.patch new file mode 100644 index 0000000..fc6018f --- /dev/null +++ b/patches.suse/floppy-reintroduce-O_NDELAY-fix.patch @@ -0,0 +1,79 @@ +From e32f6163c47efbdbad06258560aa00d1c7e5b699 Mon Sep 17 00:00:00 2001 +From: Jiri Kosina +Date: Fri, 22 Jan 2021 12:13:20 +0100 +Subject: [PATCH] floppy: reintroduce O_NDELAY fix + +References: boo#1181018 +Patch-mainline: submitted Git-repo: https://github.com/evdenis/linux-floppy Git-commit: e32f6163c47efbdbad06258560aa00d1c7e5b699 + +This issue was originally fixed in 09954bad4 ("floppy: refactor open() +flags handling"). + +The fix as a side-effect, however, introduce issue for open(O_ACCMODE) +that is being used for ioctl-only open. I wrote a fix for that, but +instead of it being merged, full revert of 09954bad4 was performed, +re-introducing the O_NDELAY / O_NONBLOCK issue, and it strikes again. + +This is a forward-port of the original fix to current codebase; the +original submission had the changelog below: + +==== +Commit 09954bad4 ("floppy: refactor open() flags handling"), as a +side-effect, causes open(/dev/fdX, O_ACCMODE) to fail. It turns out that +this is being used setfdprm userspace for ioctl-only open(). + +Reintroduce back the original behavior wrt !(FMODE_READ|FMODE_WRITE) +modes, while still keeping the original O_NDELAY bug fixed. + +Link: https://lore.kernel.org/r/nycvar.YFH.7.76.2101221209060.5622@cbobk.fhfr.pm +Cc: stable@vger.kernel.org +Reported-by: Wim Osterholt +Tested-by: Wim Osterholt +Reported-and-tested-by: Kurt Garloff +Fixes: 09954bad4 ("floppy: refactor open() flags handling") +Fixes: f2791e7ead ("Revert "floppy: refactor open() flags handling"") +Signed-off-by: Jiri Kosina +Signed-off-by: Denis Efremov +Acked-by: Michal Suchanek +--- + drivers/block/floppy.c | 29 ++++++++++++++--------------- + 1 file changed, 14 insertions(+), 15 deletions(-) + +--- a/drivers/block/floppy.c ++++ b/drivers/block/floppy.c +@@ -4063,21 +4063,22 @@ static int floppy_open(struct block_devi + if (UFDCS->rawcmd == 1) + UFDCS->rawcmd = 2; + +- if (!(mode & FMODE_NDELAY)) { +- if (mode & (FMODE_READ|FMODE_WRITE)) { +- UDRS->last_checked = 0; +- clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags); +- check_disk_change(bdev); +- if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags)) +- goto out; +- if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags)) +- goto out; +- } +- res = -EROFS; +- if ((mode & FMODE_WRITE) && +- !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags)) ++ if (mode & (FMODE_READ|FMODE_WRITE)) { ++ UDRS->last_checked = 0; ++ clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags); ++ check_disk_change(bdev); ++ if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags)) ++ goto out; ++ if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags)) + goto out; + } ++ ++ res = -EROFS; ++ ++ if ((mode & FMODE_WRITE) && ++ !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags)) ++ goto out; ++ + mutex_unlock(&open_lock); + mutex_unlock(&floppy_mutex); + return 0; diff --git a/patches.suse/futex-Fix-incorrect-should_fail_futex-handling.patch b/patches.suse/futex-Fix-incorrect-should_fail_futex-handling.patch new file mode 100644 index 0000000..069cf90 --- /dev/null +++ b/patches.suse/futex-Fix-incorrect-should_fail_futex-handling.patch @@ -0,0 +1,49 @@ +From 921c7ebd1337d1a46783d7e15a850e12aed2eaa0 Mon Sep 17 00:00:00 2001 +From: Mateusz Nosek +Date: Sun, 27 Sep 2020 02:08:58 +0200 +Subject: [PATCH] futex: Fix incorrect should_fail_futex() handling +Git-commit: 921c7ebd1337d1a46783d7e15a850e12aed2eaa0 +Patch-mainline: v5.10-rc2 +References: bsc#1181349 CVE-2021-3347 + +If should_futex_fail() returns true in futex_wake_pi(), then the 'ret' +variable is set to -EFAULT and then immediately overwritten. So the failure +injection is non-functional. + +Fix it by actually leaving the function and returning -EFAULT. + +The Fixes tag is kinda blury because the initial commit which introduced +failure injection was already sloppy, but the below mentioned commit broke +it completely. + +[ tglx: Massaged changelog ] + +Fixes: 6b4f4bc9cb22 ("locking/futex: Allow low-level atomic operations to return -EAGAIN") +Signed-off-by: Mateusz Nosek +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20200927000858.24219-1-mateusznosek0@gmail.com +Signed-off-by: Davidlohr Bueso + +--- + kernel/futex.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/kernel/futex.c b/kernel/futex.c +index a5876694a60e..39681bf8b06c 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -1502,8 +1502,10 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_pi_state *pi_ + */ + newval = FUTEX_WAITERS | task_pid_vnr(new_owner); + +- if (unlikely(should_fail_futex(true))) ++ if (unlikely(should_fail_futex(true))) { + ret = -EFAULT; ++ goto out_unlock; ++ } + + ret = cmpxchg_futex_value_locked(&curval, uaddr, uval, newval); + if (!ret && (curval != uval)) { +-- +2.26.2 + diff --git a/patches.suse/futex-Handle-faults-correctly-for-PI-futexes.patch b/patches.suse/futex-Handle-faults-correctly-for-PI-futexes.patch new file mode 100644 index 0000000..14053ed --- /dev/null +++ b/patches.suse/futex-Handle-faults-correctly-for-PI-futexes.patch @@ -0,0 +1,165 @@ +Subject: futex: Handle faults correctly for PI futexes +From: Thomas Gleixner +Date: Mon Jan 18 19:01:21 2021 +0100 +Git-commit: 34b1a1ce1458f50ef27c54e28eb9b1947012907a +Patch-mainline: v5.11-rc6 +References: bsc#1181349 bsc#1149032 CVE-2021-3347 + +fixup_pi_state_owner() tries to ensure that the state of the rtmutex, +pi_state and the user space value related to the PI futex are consistent +before returning to user space. In case that the user space value update +faults and the fault cannot be resolved by faulting the page in via +fault_in_user_writeable() the function returns with -EFAULT and leaves +the rtmutex and pi_state owner state inconsistent. + +A subsequent futex_unlock_pi() operates on the inconsistent pi_state and +releases the rtmutex despite not owning it which can corrupt the RB tree of +the rtmutex and cause a subsequent kernel stack use after free. + +It was suggested to loop forever in fixup_pi_state_owner() if the fault +cannot be resolved, but that results in runaway tasks which is especially +undesired when the problem happens due to a programming error and not due +to malice. + +As the user space value cannot be fixed up, the proper solution is to make +the rtmutex and the pi_state consistent so both have the same owner. This +leaves the user space value out of sync. Any subsequent operation on the +futex will fail because the 10th rule of PI futexes (pi_state owner and +user space value are consistent) has been violated. + +As a consequence this removes the inept attempts of 'fixing' the situation +in case that the current task owns the rtmutex when returning with an +unresolvable fault by unlocking the rtmutex which left pi_state::owner and +rtmutex::owner out of sync in a different and only slightly less dangerous +way. + +Fixes: 1b7558e457ed ("futexes: fix fault handling in futex_lock_pi") +Reported-by: gzobqq@gmail.com +Signed-off-by: Thomas Gleixner +Acked-by: Peter Zijlstra (Intel) +Cc: stable@vger.kernel.org +Signed-off-by: Davidlohr Bueso + +--- + kernel/futex.c | 56 ++++++++++++++++++-------------------------------- + 1 file changed, 20 insertions(+), 36 deletions(-) + +diff --git a/kernel/futex.c b/kernel/futex.c +index 9530dd6c7459..a66b5bbe73dc 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -1007,7 +1007,8 @@ void exit_pi_state_list(struct task_struct *curr) + * FUTEX_OWNER_DIED bit. See [4] + * + * [10] There is no transient state which leaves owner and user space +- * TID out of sync. ++ * TID out of sync. Except one error case where the kernel is denied ++ * write access to the user address, see fixup_pi_state_owner(). + * + * + * Serialization and lifetime rules: +@@ -2465,6 +2466,24 @@ static int __fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, + if (!err) + goto retry; + ++ /* ++ * fault_in_user_writeable() failed so user state is immutable. At ++ * best we can make the kernel state consistent but user state will ++ * be most likely hosed and any subsequent unlock operation will be ++ * rejected due to PI futex rule [10]. ++ * ++ * Ensure that the rtmutex owner is also the pi_state owner despite ++ * the user space value claiming something different. There is no ++ * point in unlocking the rtmutex if current is the owner as it ++ * would need to wait until the next waiter has taken the rtmutex ++ * to guarantee consistent state. Keep it simple. Userspace asked ++ * for this wreckaged state. ++ * ++ * The rtmutex has an owner - either current or some other ++ * task. See the EAGAIN loop above. ++ */ ++ pi_state_update_owner(pi_state, rt_mutex_owner(&pi_state->pi_mutex)); ++ + return err; + } + +@@ -2754,7 +2773,6 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags, + ktime_t *time, int trylock) + { + struct hrtimer_sleeper timeout, *to = NULL; +- struct futex_pi_state *pi_state = NULL; + struct rt_mutex_waiter rt_waiter; + struct futex_hash_bucket *hb; + struct futex_q q = futex_q_init; +@@ -2885,23 +2903,9 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags, + if (res) + ret = (res < 0) ? res : 0; + +- /* +- * If fixup_owner() faulted and was unable to handle the fault, unlock +- * it and return the fault to userspace. +- */ +- if (ret && (rt_mutex_owner(&q.pi_state->pi_mutex) == current)) { +- pi_state = q.pi_state; +- get_pi_state(pi_state); +- } +- + /* Unqueue and drop the lock */ + unqueue_me_pi(&q); + +- if (pi_state) { +- rt_mutex_futex_unlock(&pi_state->pi_mutex); +- put_pi_state(pi_state); +- } +- + goto out_put_key; + + out_unlock_put_key: +@@ -3164,7 +3168,6 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, + u32 __user *uaddr2) + { + struct hrtimer_sleeper timeout, *to = NULL; +- struct futex_pi_state *pi_state = NULL; + struct rt_mutex_waiter rt_waiter; + struct futex_hash_bucket *hb; + union futex_key key2 = FUTEX_KEY_INIT; +@@ -3246,10 +3249,6 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, + if (q.pi_state && (q.pi_state->owner != current)) { + spin_lock(q.lock_ptr); + ret = fixup_pi_state_owner(uaddr2, &q, current); +- if (ret < 0 && rt_mutex_owner(&q.pi_state->pi_mutex) == current) { +- pi_state = q.pi_state; +- get_pi_state(pi_state); +- } + /* + * Drop the reference to the pi state which + * the requeue_pi() code acquired for us. +@@ -3291,25 +3290,10 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, + if (res) + ret = (res < 0) ? res : 0; + +- /* +- * If fixup_pi_state_owner() faulted and was unable to handle +- * the fault, unlock the rt_mutex and return the fault to +- * userspace. +- */ +- if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current) { +- pi_state = q.pi_state; +- get_pi_state(pi_state); +- } +- + /* Unqueue and drop the lock. */ + unqueue_me_pi(&q); + } + +- if (pi_state) { +- rt_mutex_futex_unlock(&pi_state->pi_mutex); +- put_pi_state(pi_state); +- } +- + if (ret == -EINTR) { + /* + * We've already been requeued, but cannot restart by calling +-- +2.26.2 + diff --git a/patches.suse/futex-Handle-transient-ownerless-rtmutex-state-corre.patch b/patches.suse/futex-Handle-transient-ownerless-rtmutex-state-corre.patch index 24e8cb0..e905b7d 100644 --- a/patches.suse/futex-Handle-transient-ownerless-rtmutex-state-corre.patch +++ b/patches.suse/futex-Handle-transient-ownerless-rtmutex-state-corre.patch @@ -47,14 +47,14 @@ Link: https://lore.kernel.org/r/87sg9pkvf7.fsf@nanos.tec.linutronix.de Signed-off-by: Davidlohr Bueso --- - kernel/futex.c | 14 ++++++++++++-- - 1 file changed, 12 insertions(+), 2 deletions(-) + kernel/futex.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/kernel/futex.c b/kernel/futex.c -index a8bf2077854d..263c689ca9c8 100644 +index f8614ef4ff31..ac328874f6e5 100644 --- a/kernel/futex.c +++ b/kernel/futex.c -@@ -2375,10 +2375,20 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, +@@ -2380,10 +2380,22 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, } /* @@ -72,11 +72,10 @@ index a8bf2077854d..263c689ca9c8 100644 + * situation and not any different from the other retry + * conditions. + */ -+ if (unlikely(!newowner)) -+ goto handle_fault; ++ if (unlikely(!newowner)) { ++ err = -EAGAIN; ++ goto handle_err; ++ } } else { WARN_ON_ONCE(argowner != current); if (oldowner == current) { --- -2.26.2 - diff --git a/patches.suse/futex_Ensure_the_correct_return_value_from_futex_lock_pi_.patch b/patches.suse/futex_Ensure_the_correct_return_value_from_futex_lock_pi_.patch new file mode 100644 index 0000000..caaf935 --- /dev/null +++ b/patches.suse/futex_Ensure_the_correct_return_value_from_futex_lock_pi_.patch @@ -0,0 +1,136 @@ +Subject: futex: Ensure the correct return value from futex_lock_pi() +From: Thomas Gleixner +Date: Wed Jan 20 16:00:24 2021 +0100 +Git-commit: 12bb3f7f1b03d5913b3f9d4236a488aa7774dfe9 +Patch-mainline: v5.11-rc6 +References: bsc#1181349 bsc#1149032 CVE-2021-3347 + +commit 12bb3f7f1b03d5913b3f9d4236a488aa7774dfe9 upstream + +In case that futex_lock_pi() was aborted by a signal or a timeout and the +task returned without acquiring the rtmutex, but is the designated owner of +the futex due to a concurrent futex_unlock_pi() fixup_owner() is invoked to +establish consistent state. In that case it invokes fixup_pi_state_owner() +which in turn tries to acquire the rtmutex again. If that succeeds then it +does not propagate this success to fixup_owner() and futex_lock_pi() +returns -EINTR or -ETIMEOUT despite having the futex locked. + +Return success from fixup_pi_state_owner() in all cases where the current +task owns the rtmutex and therefore the futex and propagate it correctly +through fixup_owner(). Fixup the other callsite which does not expect a +positive return value. + +Fixes: c1e2f0eaf015 ("futex: Avoid violating the 10th rule of futex") +Signed-off-by: Thomas Gleixner +Acked-by: Peter Zijlstra (Intel) +Cc: stable@vger.kernel.org +Signed-off-by: Davidlohr Bueso + +--- + kernel/futex.c | 32 ++++++++++++++++---------------- + 1 file changed, 16 insertions(+), 16 deletions(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -2507,8 +2507,8 @@ static int fixup_pi_state_owner(u32 __us + } + + if (__rt_mutex_futex_trylock(&pi_state->pi_mutex)) { +- /* We got the lock after all, nothing to fix. */ +- ret = 0; ++ /* We got the lock. pi_state is correct. Tell caller. */ ++ ret = 1; + goto out_unlock; + } + +@@ -2536,7 +2536,7 @@ static int fixup_pi_state_owner(u32 __us + * We raced against a concurrent self; things are + * already fixed up. Nothing to do. + */ +- ret = 0; ++ ret = 1; + goto out_unlock; + } + newowner = argowner; +@@ -2582,7 +2582,7 @@ static int fixup_pi_state_owner(u32 __us + raw_spin_unlock(&newowner->pi_lock); + raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock); + +- return 0; ++ return argowner == current; + + /* + * In order to reschedule or handle a page fault, we need to drop the +@@ -2624,7 +2624,7 @@ static int fixup_pi_state_owner(u32 __us + * Check if someone else fixed it for us: + */ + if (pi_state->owner != oldowner) { +- ret = 0; ++ ret = argowner == current; + goto out_unlock; + } + +@@ -2657,8 +2657,6 @@ static long futex_wait_restart(struct re + */ + static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked) + { +- int ret = 0; +- + if (locked) { + /* + * Got the lock. We might not be the anticipated owner if we +@@ -2669,8 +2667,8 @@ static int fixup_owner(u32 __user *uaddr + * stable state, anything else needs more attention. + */ + if (q->pi_state->owner != current) +- ret = fixup_pi_state_owner(uaddr, q, current); +- goto out; ++ return fixup_pi_state_owner(uaddr, q, current); ++ return 1; + } + + /* +@@ -2681,10 +2679,8 @@ static int fixup_owner(u32 __user *uaddr + * Another speculative read; pi_state->owner == current is unstable + * but needs our attention. + */ +- if (q->pi_state->owner == current) { +- ret = fixup_pi_state_owner(uaddr, q, NULL); +- goto out; +- } ++ if (q->pi_state->owner == current) ++ return fixup_pi_state_owner(uaddr, q, NULL); + + /* + * Paranoia check. If we did not take the lock, then we should not be +@@ -2697,8 +2693,7 @@ static int fixup_owner(u32 __user *uaddr + q->pi_state->owner); + } + +-out: +- return ret ? ret : locked; ++ return 0; + } + + /** +@@ -3429,7 +3424,7 @@ static int futex_wait_requeue_pi(u32 __u + if (q.pi_state && (q.pi_state->owner != current)) { + spin_lock(q.lock_ptr); + ret = fixup_pi_state_owner(uaddr2, &q, current); +- if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current) { ++ if (ret < 0 && rt_mutex_owner(&q.pi_state->pi_mutex) == current) { + pi_state = q.pi_state; + get_pi_state(pi_state); + } +@@ -3439,6 +3434,11 @@ static int futex_wait_requeue_pi(u32 __u + */ + put_pi_state(q.pi_state); + spin_unlock(q.lock_ptr); ++ /* ++ * Adjust the return value. It's either -EFAULT or ++ * success (1) but the caller expects 0 for success. ++ */ ++ ret = ret < 0 ? ret : 0; + } + } else { + struct rt_mutex *pi_mutex; diff --git a/patches.suse/futex_Provide_and_use_pi_state_update_owner_.patch b/patches.suse/futex_Provide_and_use_pi_state_update_owner_.patch new file mode 100644 index 0000000..4716493 --- /dev/null +++ b/patches.suse/futex_Provide_and_use_pi_state_update_owner_.patch @@ -0,0 +1,113 @@ +Subject: futex: Provide and use pi_state_update_owner() +From: Thomas Gleixner +Date: Tue Jan 19 15:21:35 2021 +0100 +Git-commit: c5cade200ab9a2a3be9e7f32a752c8d86b502ec7 +Patch-mainline: v5.11-rc6 +References: bsc#1181349 bsc#1149032 CVE-2021-3347 + +Updating pi_state::owner is done at several places with the same +code. Provide a function for it and use that at the obvious places. + +This is also a preparation for a bug fix to avoid yet another copy of the +same code or alternatively introducing a completely unpenetratable mess of +gotos. + +Originally-by: Peter Zijlstra +Signed-off-by: Thomas Gleixner +Acked-by: Peter Zijlstra (Intel) +Cc: stable@vger.kernel.org +Signed-off-by: Davidlohr Bueso + +--- + kernel/futex.c | 66 ++++++++++++++++++++++++++++----------------------------- + 1 file changed, 33 insertions(+), 33 deletions(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -839,6 +839,29 @@ static struct futex_pi_state *alloc_pi_s + return pi_state; + } + ++static void pi_state_update_owner(struct futex_pi_state *pi_state, ++ struct task_struct *new_owner) ++{ ++ struct task_struct *old_owner = pi_state->owner; ++ ++ lockdep_assert_held(&pi_state->pi_mutex.wait_lock); ++ ++ if (old_owner) { ++ raw_spin_lock(&old_owner->pi_lock); ++ WARN_ON(list_empty(&pi_state->list)); ++ list_del_init(&pi_state->list); ++ raw_spin_unlock(&old_owner->pi_lock); ++ } ++ ++ if (new_owner) { ++ raw_spin_lock(&new_owner->pi_lock); ++ WARN_ON(!list_empty(&pi_state->list)); ++ list_add(&pi_state->list, &new_owner->pi_state_list); ++ pi_state->owner = new_owner; ++ raw_spin_unlock(&new_owner->pi_lock); ++ } ++} ++ + static void get_pi_state(struct futex_pi_state *pi_state) + { + WARN_ON_ONCE(!atomic_inc_not_zero(&pi_state->refcount)); +@@ -1615,26 +1638,15 @@ static int wake_futex_pi(u32 __user *uad + ret = -EINVAL; + } + +- if (ret) +- goto out_unlock; +- +- /* +- * This is a point of no return; once we modify the uval there is no +- * going back and subsequent operations must not fail. +- */ +- +- raw_spin_lock(&pi_state->owner->pi_lock); +- WARN_ON(list_empty(&pi_state->list)); +- list_del_init(&pi_state->list); +- raw_spin_unlock(&pi_state->owner->pi_lock); +- +- raw_spin_lock(&new_owner->pi_lock); +- WARN_ON(!list_empty(&pi_state->list)); +- list_add(&pi_state->list, &new_owner->pi_state_list); +- pi_state->owner = new_owner; +- raw_spin_unlock(&new_owner->pi_lock); +- +- postunlock = __rt_mutex_futex_unlock(&pi_state->pi_mutex, &wake_q); ++ if (!ret) { ++ /* ++ * This is a point of no return; once we modified the uval ++ * there is no going back and subsequent operations must ++ * not fail. ++ */ ++ pi_state_update_owner(pi_state, new_owner); ++ postunlock = __rt_mutex_futex_unlock(&pi_state->pi_mutex, &wake_q); ++ } + + out_unlock: + raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock); +@@ -2567,19 +2579,7 @@ static int fixup_pi_state_owner(u32 __us + * We fixed up user space. Now we need to fix the pi_state + * itself. + */ +- if (pi_state->owner != NULL) { +- raw_spin_lock(&pi_state->owner->pi_lock); +- WARN_ON(list_empty(&pi_state->list)); +- list_del_init(&pi_state->list); +- raw_spin_unlock(&pi_state->owner->pi_lock); +- } +- +- pi_state->owner = newowner; +- +- raw_spin_lock(&newowner->pi_lock); +- WARN_ON(!list_empty(&pi_state->list)); +- list_add(&pi_state->list, &newowner->pi_state_list); +- raw_spin_unlock(&newowner->pi_lock); ++ pi_state_update_owner(pi_state, newowner); + raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock); + + return argowner == current; diff --git a/patches.suse/futex_Replace_pointless_printk_in_fixup_owner_.patch b/patches.suse/futex_Replace_pointless_printk_in_fixup_owner_.patch new file mode 100644 index 0000000..26f0df4 --- /dev/null +++ b/patches.suse/futex_Replace_pointless_printk_in_fixup_owner_.patch @@ -0,0 +1,40 @@ +Subject: futex: Replace pointless printk in fixup_owner() +From: Thomas Gleixner +Date: Tue Jan 19 16:06:10 2021 +0100 +Git-commit: 04b79c55201f02ffd675e1231d731365e335c307 +Patch-mainline: v5.11-rc6 +References: bsc#1181349 bsc#1149032 CVE-2021-3347 + +If that unexpected case of inconsistent arguments ever happens then the +futex state is left completely inconsistent and the printk is not really +helpful. Replace it with a warning and make the state consistent. + +Signed-off-by: Thomas Gleixner +Acked-by: Peter Zijlstra (Intel) +Cc: stable@vger.kernel.org +Signed-off-by: Davidlohr Bueso + +--- + kernel/futex.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -2684,14 +2684,10 @@ static int fixup_owner(u32 __user *uaddr + + /* + * Paranoia check. If we did not take the lock, then we should not be +- * the owner of the rt_mutex. ++ * the owner of the rt_mutex. Warn and establish consistent state. + */ +- if (rt_mutex_owner(&q->pi_state->pi_mutex) == current) { +- printk(KERN_ERR "fixup_owner: ret = %d pi-mutex: %p " +- "pi-state %p\n", ret, +- q->pi_state->pi_mutex.owner, +- q->pi_state->owner); +- } ++ if (WARN_ON_ONCE(rt_mutex_owner(&q->pi_state->pi_mutex) == current)) ++ return fixup_pi_state_owner(uaddr, q, current); + + return 0; + } diff --git a/patches.suse/futex_Simplify_fixup_pi_state_owner_.patch b/patches.suse/futex_Simplify_fixup_pi_state_owner_.patch new file mode 100644 index 0000000..182c694 --- /dev/null +++ b/patches.suse/futex_Simplify_fixup_pi_state_owner_.patch @@ -0,0 +1,134 @@ +Subject: futex: Simplify fixup_pi_state_owner() +From: Thomas Gleixner +Date: Tue Jan 19 16:26:38 2021 +0100 +Git-commit: f2dac39d93987f7de1e20b3988c8685523247ae2 +Patch-mainline: v5.11-rc6 +References: bsc#1181349 bsc#1149032 CVE-2021-3347 + +Too many gotos already and an upcoming fix would make it even more +unreadable. + +Signed-off-by: Thomas Gleixner +Acked-by: Peter Zijlstra (Intel) +Cc: stable@vger.kernel.org +Signed-off-by: Davidlohr Bueso + +--- + kernel/futex.c | 53 ++++++++++++++++++++++++++--------------------------- + 1 file changed, 26 insertions(+), 27 deletions(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -2463,18 +2463,13 @@ static void unqueue_me_pi(struct futex_q + spin_unlock(q->lock_ptr); + } + +-static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, +- struct task_struct *argowner) ++static int __fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, ++ struct task_struct *argowner) + { ++ u32 uval, uninitialized_var(curval), newval, newtid; + struct futex_pi_state *pi_state = q->pi_state; +- u32 uval, uninitialized_var(curval), newval; + struct task_struct *oldowner, *newowner; +- u32 newtid; +- int ret, err = 0; +- +- lockdep_assert_held(q->lock_ptr); +- +- raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock); ++ int err = 0; + + oldowner = pi_state->owner; + +@@ -2508,14 +2503,12 @@ static int fixup_pi_state_owner(u32 __us + * We raced against a concurrent self; things are + * already fixed up. Nothing to do. + */ +- ret = 0; +- goto out_unlock; ++ return 0; + } + + if (__rt_mutex_futex_trylock(&pi_state->pi_mutex)) { + /* We got the lock. pi_state is correct. Tell caller. */ +- ret = 1; +- goto out_unlock; ++ return 1; + } + + /* +@@ -2542,8 +2535,7 @@ static int fixup_pi_state_owner(u32 __us + * We raced against a concurrent self; things are + * already fixed up. Nothing to do. + */ +- ret = 1; +- goto out_unlock; ++ return 1; + } + newowner = argowner; + } +@@ -2574,7 +2566,6 @@ static int fixup_pi_state_owner(u32 __us + * itself. + */ + pi_state_update_owner(pi_state, newowner); +- raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock); + + return argowner == current; + +@@ -2597,17 +2588,16 @@ static int fixup_pi_state_owner(u32 __us + + switch (err) { + case -EFAULT: +- ret = fault_in_user_writeable(uaddr); ++ err = fault_in_user_writeable(uaddr); + break; + + case -EAGAIN: + cond_resched(); +- ret = 0; ++ err = 0; + break; + + default: + WARN_ON_ONCE(1); +- ret = err; + break; + } + +@@ -2617,17 +2607,26 @@ static int fixup_pi_state_owner(u32 __us + /* + * Check if someone else fixed it for us: + */ +- if (pi_state->owner != oldowner) { +- ret = argowner == current; +- goto out_unlock; +- } ++ if (pi_state->owner != oldowner) ++ return argowner == current; + +- if (ret) +- goto out_unlock; ++ /* Retry if err was -EAGAIN or the fault in succeeded */ ++ if (!err) ++ goto retry; + +- goto retry; ++ return err; ++} + +-out_unlock: ++static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, ++ struct task_struct *argowner) ++{ ++ struct futex_pi_state *pi_state = q->pi_state; ++ int ret; ++ ++ lockdep_assert_held(q->lock_ptr); ++ ++ raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock); ++ ret = __fixup_pi_state_owner(uaddr, q, argowner); + raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock); + return ret; + } diff --git a/patches.suse/futex_Use_pi_state_update_owner__in_put_pi_state_.patch b/patches.suse/futex_Use_pi_state_update_owner__in_put_pi_state_.patch new file mode 100644 index 0000000..8dd14aa --- /dev/null +++ b/patches.suse/futex_Use_pi_state_update_owner__in_put_pi_state_.patch @@ -0,0 +1,38 @@ +Subject: futex: Use pi_state_update_owner() in put_pi_state() +From: Thomas Gleixner +Date: Wed Jan 20 11:35:19 2021 +0100 +Git-commit: 6ccc84f917d33312eb2846bd7b567639f585ad6d +Patch-mainline: v5.11-rc6 +References: bsc#1181349 bsc#1149032 CVE-2021-3347 + +No point in open coding it. This way it gains the extra sanity checks. + +Signed-off-by: Thomas Gleixner +Acked-by: Peter Zijlstra (Intel) +Cc: stable@vger.kernel.org +Signed-off-by: Davidlohr Bueso + +--- + kernel/futex.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -884,16 +884,10 @@ static void put_pi_state(struct futex_pi + * and has cleaned up the pi_state already + */ + if (pi_state->owner) { +- struct task_struct *owner; + unsigned long flags; + + raw_spin_lock_irqsave(&pi_state->pi_mutex.wait_lock, flags); +- owner = pi_state->owner; +- if (owner) { +- raw_spin_lock(&owner->pi_lock); +- list_del_init(&pi_state->list); +- raw_spin_unlock(&owner->pi_lock); +- } ++ pi_state_update_owner(pi_state, NULL); + rt_mutex_proxy_unlock(&pi_state->pi_mutex); + raw_spin_unlock_irqrestore(&pi_state->pi_mutex.wait_lock, flags); + } diff --git a/patches.suse/i40e-Fix-removing-driver-while-bare-metal-VFs-pass-t.patch b/patches.suse/i40e-Fix-removing-driver-while-bare-metal-VFs-pass-t.patch new file mode 100644 index 0000000..3ec9616 --- /dev/null +++ b/patches.suse/i40e-Fix-removing-driver-while-bare-metal-VFs-pass-t.patch @@ -0,0 +1,151 @@ +From: Sylwester Dziedziuch +Date: Fri, 20 Nov 2020 10:06:40 -0800 +Subject: i40e: Fix removing driver while bare-metal VFs pass traffic +Patch-mainline: v5.10-rc6 +Git-commit: 2980cbd4dce7b1e9bf57df3ced43a7b184986f50 +References: git-fixes + +Prevent VFs from resetting when PF driver is being unloaded: +- introduce new pf state: __I40E_VF_RESETS_DISABLED; +- check if pf state has __I40E_VF_RESETS_DISABLED state set, + if so, disable any further VFLR event notifications; +- when i40e_remove (rmmod i40e) is called, disable any resets on + the VFs; + +Previously if there were bare-metal VFs passing traffic and PF +driver was removed, there was a possibility of VFs triggering a Tx +timeout right before iavf_remove. This was causing iavf_close to +not be called because there is a check in the beginning of iavf_remove +that bails out early if adapter->state < IAVF_DOWN_PENDING. This +makes it so some resources do not get cleaned up. + +Fixes: 6a9ddb36eeb8 ("i40e: disable IOV before freeing resources") +Signed-off-by: Slawomir Laba +Signed-off-by: Brett Creeley +Signed-off-by: Sylwester Dziedziuch +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20201120180640.3654474-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 22 ++++++++++++----- + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 26 ++++++++++++--------- + 3 files changed, 31 insertions(+), 18 deletions(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -173,6 +173,7 @@ enum i40e_state_t { + __I40E_CLIENT_RESET, + __I40E_VIRTCHNL_OP_PENDING, + __I40E_RECOVERY_MODE, ++ __I40E_VF_RESETS_DISABLED, /* disable resets during i40e_remove */ + /* This must be last as it determines the size of the BITMAP */ + __I40E_STATE_SIZE__, + }; +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -3992,8 +3992,16 @@ static irqreturn_t i40e_intr(int irq, vo + } + + if (icr0 & I40E_PFINT_ICR0_VFLR_MASK) { +- ena_mask &= ~I40E_PFINT_ICR0_ENA_VFLR_MASK; +- set_bit(__I40E_VFLR_EVENT_PENDING, pf->state); ++ /* disable any further VFLR event notifications */ ++ if (test_bit(__I40E_VF_RESETS_DISABLED, pf->state)) { ++ u32 reg = rd32(hw, I40E_PFINT_ICR0_ENA); ++ ++ reg &= ~I40E_PFINT_ICR0_VFLR_MASK; ++ wr32(hw, I40E_PFINT_ICR0_ENA, reg); ++ } else { ++ ena_mask &= ~I40E_PFINT_ICR0_ENA_VFLR_MASK; ++ set_bit(__I40E_VFLR_EVENT_PENDING, pf->state); ++ } + } + + if (icr0 & I40E_PFINT_ICR0_GRST_MASK) { +@@ -14794,6 +14802,11 @@ static void i40e_remove(struct pci_dev * + while (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state)) + usleep_range(1000, 2000); + ++ if (pf->flags & I40E_FLAG_SRIOV_ENABLED) { ++ set_bit(__I40E_VF_RESETS_DISABLED, pf->state); ++ i40e_free_vfs(pf); ++ pf->flags &= ~I40E_FLAG_SRIOV_ENABLED; ++ } + /* no more scheduling of any task */ + set_bit(__I40E_SUSPENDED, pf->state); + set_bit(__I40E_DOWN, pf->state); +@@ -14820,11 +14833,6 @@ static void i40e_remove(struct pci_dev * + */ + i40e_notify_client_of_netdev_close(pf->vsi[pf->lan_vsi], false); + +- if (pf->flags & I40E_FLAG_SRIOV_ENABLED) { +- i40e_free_vfs(pf); +- pf->flags &= ~I40E_FLAG_SRIOV_ENABLED; +- } +- + i40e_fdir_teardown(pf); + + /* If there is a switch structure or any orphans, remove them. +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -1352,7 +1352,8 @@ static void i40e_cleanup_reset_vf(struct + * @vf: pointer to the VF structure + * @flr: VFLR was issued or not + * +- * Returns true if the VF is reset, false otherwise. ++ * Returns true if the VF is in reset, resets successfully, or resets ++ * are disabled and false otherwise. + **/ + bool i40e_reset_vf(struct i40e_vf *vf, bool flr) + { +@@ -1362,11 +1363,14 @@ bool i40e_reset_vf(struct i40e_vf *vf, b + u32 reg; + int i; + ++ if (test_bit(__I40E_VF_RESETS_DISABLED, pf->state)) ++ return true; ++ + /* If the VFs have been disabled, this means something else is + * resetting the VF, so we shouldn't continue. + */ + if (test_and_set_bit(__I40E_VF_DISABLE, pf->state)) +- return false; ++ return true; + + i40e_trigger_vf_reset(vf, flr); + +@@ -1530,6 +1534,15 @@ void i40e_free_vfs(struct i40e_pf *pf) + + i40e_notify_client_of_vf_enable(pf, 0); + ++ /* Disable IOV before freeing resources. This lets any VF drivers ++ * running in the host get themselves cleaned up before we yank ++ * the carpet out from underneath their feet. ++ */ ++ if (!pci_vfs_assigned(pf->pdev)) ++ pci_disable_sriov(pf->pdev); ++ else ++ dev_warn(&pf->pdev->dev, "VFs are assigned - not disabling SR-IOV\n"); ++ + /* Amortize wait time by stopping all VFs at the same time */ + for (i = 0; i < pf->num_alloc_vfs; i++) { + if (test_bit(I40E_VF_STATE_INIT, &pf->vf[i].vf_states)) +@@ -1545,15 +1558,6 @@ void i40e_free_vfs(struct i40e_pf *pf) + i40e_vsi_wait_queues_disabled(pf->vsi[pf->vf[i].lan_vsi_idx]); + } + +- /* Disable IOV before freeing resources. This lets any VF drivers +- * running in the host get themselves cleaned up before we yank +- * the carpet out from underneath their feet. +- */ +- if (!pci_vfs_assigned(pf->pdev)) +- pci_disable_sriov(pf->pdev); +- else +- dev_warn(&pf->pdev->dev, "VFs are assigned - not disabling SR-IOV\n"); +- + /* free up VF resources */ + tmp = pf->num_alloc_vfs; + pf->num_alloc_vfs = 0; diff --git a/patches.suse/i40e-avoid-premature-Rx-buffer-reuse.patch b/patches.suse/i40e-avoid-premature-Rx-buffer-reuse.patch new file mode 100644 index 0000000..8f96222 --- /dev/null +++ b/patches.suse/i40e-avoid-premature-Rx-buffer-reuse.patch @@ -0,0 +1,181 @@ +From: =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= +Date: Tue, 25 Aug 2020 19:27:34 +0200 +Subject: i40e: avoid premature Rx buffer reuse +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Patch-mainline: v5.10 +Git-commit: 75aab4e10ae6a4593a60f66d13de755d4e91f400 +References: bsc#1111981 FATE#326312 FATE#326313 + +The page recycle code, incorrectly, relied on that a page fragment +could not be freed inside xdp_do_redirect(). This assumption leads to +that page fragments that are used by the stack/XDP redirect can be +reused and overwritten. + +To avoid this, store the page count prior invoking xdp_do_redirect(). + +Longer explanation: + +Intel NICs have a recycle mechanism. The main idea is that a page is +split into two parts. One part is owned by the driver, one part might +be owned by someone else, such as the stack. + +t0: Page is allocated, and put on the Rx ring + +--------------- +used by NIC ->| upper buffer +(rx_buffer) +--------------- + | lower buffer + +--------------- + page count == USHRT_MAX + rx_buffer->pagecnt_bias == USHRT_MAX + +t1: Buffer is received, and passed to the stack (e.g.) + +--------------- + | upper buff (skb) + +--------------- +used by NIC ->| lower buffer +(rx_buffer) +--------------- + page count == USHRT_MAX + rx_buffer->pagecnt_bias == USHRT_MAX - 1 + +t2: Buffer is received, and redirected + +--------------- + | upper buff (skb) + +--------------- +used by NIC ->| lower buffer +(rx_buffer) +--------------- + +Now, prior calling xdp_do_redirect(): + page count == USHRT_MAX + rx_buffer->pagecnt_bias == USHRT_MAX - 2 + +This means that buffer *cannot* be flipped/reused, because the skb is +still using it. + +The problem arises when xdp_do_redirect() actually frees the +segment. Then we get: + page count == USHRT_MAX - 1 + rx_buffer->pagecnt_bias == USHRT_MAX - 2 + +From a recycle perspective, the buffer can be flipped and reused, +which means that the skb data area is passed to the Rx HW ring! + +To work around this, the page count is stored prior calling +xdp_do_redirect(). + +Note that this is not optimal, since the NIC could actually reuse the +"lower buffer" again. However, then we need to track whether +XDP_REDIRECT consumed the buffer or not. + +Fixes: d9314c474d4f ("i40e: add support for XDP_REDIRECT") +Reported-and-analyzed-by: Li RongQing +Signed-off-by: Björn Töpel +Tested-by: George Kuruvinakunnel +Signed-off-by: Tony Nguyen +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 27 ++++++++++++++++++++------- + 1 file changed, 20 insertions(+), 7 deletions(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -1887,6 +1887,7 @@ static inline bool i40e_page_is_reusable + * the adapter for another receive + * + * @rx_buffer: buffer containing the page ++ * @rx_buffer_pgcnt: buffer page refcount pre xdp_do_redirect() call + * + * If page is reusable, rx_buffer->page_offset is adjusted to point to + * an unused region in the page. +@@ -1909,7 +1910,8 @@ static inline bool i40e_page_is_reusable + * + * In either case, if the page is reusable its refcount is increased. + **/ +-static bool i40e_can_reuse_rx_page(struct i40e_rx_buffer *rx_buffer) ++static bool i40e_can_reuse_rx_page(struct i40e_rx_buffer *rx_buffer, ++ int rx_buffer_pgcnt) + { + unsigned int pagecnt_bias = rx_buffer->pagecnt_bias; + struct page *page = rx_buffer->page; +@@ -1920,7 +1922,7 @@ static bool i40e_can_reuse_rx_page(struc + + #if (PAGE_SIZE < 8192) + /* if we are only owner of page we can reuse it */ +- if (unlikely((page_count(page) - pagecnt_bias) > 1)) ++ if (unlikely((rx_buffer_pgcnt - pagecnt_bias) > 1)) + return false; + #else + #define I40E_LAST_OFFSET \ +@@ -1979,17 +1981,25 @@ static void i40e_add_rx_frag(struct i40e + * i40e_get_rx_buffer - Fetch Rx buffer and synchronize data for use + * @rx_ring: rx descriptor ring to transact packets on + * @size: size of buffer to add to skb ++ * @rx_buffer_pgcnt: buffer page refcount + * + * This function will pull an Rx buffer from the ring and synchronize it + * for use by the CPU. + */ + static struct i40e_rx_buffer *i40e_get_rx_buffer(struct i40e_ring *rx_ring, +- const unsigned int size) ++ const unsigned int size, ++ int *rx_buffer_pgcnt) + { + struct i40e_rx_buffer *rx_buffer; + + rx_buffer = &rx_ring->rx_bi[rx_ring->next_to_clean]; + prefetchw(rx_buffer->page); ++ *rx_buffer_pgcnt = ++#if (PAGE_SIZE < 8192) ++ page_count(rx_buffer->page); ++#else ++ 0; ++#endif + + /* we are reusing so sync this buffer for CPU use */ + dma_sync_single_range_for_cpu(rx_ring->dev, +@@ -2142,14 +2152,16 @@ static struct sk_buff *i40e_build_skb(st + * i40e_put_rx_buffer - Clean up used buffer and either recycle or free + * @rx_ring: rx descriptor ring to transact packets on + * @rx_buffer: rx buffer to pull data from ++ * @rx_buffer_pgcnt: rx buffer page refcount pre xdp_do_redirect() call + * + * This function will clean up the contents of the rx_buffer. It will + * either recycle the buffer or unmap it and free the associated resources. + */ + static void i40e_put_rx_buffer(struct i40e_ring *rx_ring, +- struct i40e_rx_buffer *rx_buffer) ++ struct i40e_rx_buffer *rx_buffer, ++ int rx_buffer_pgcnt) + { +- if (i40e_can_reuse_rx_page(rx_buffer)) { ++ if (i40e_can_reuse_rx_page(rx_buffer, rx_buffer_pgcnt)) { + /* hand second half of page back to the ring */ + i40e_reuse_rx_page(rx_ring, rx_buffer); + } else { +@@ -2362,6 +2374,7 @@ static int i40e_clean_rx_irq(struct i40e + while (likely(total_rx_packets < (unsigned int)budget)) { + struct i40e_rx_buffer *rx_buffer; + union i40e_rx_desc *rx_desc; ++ int rx_buffer_pgcnt; + unsigned int size; + u64 qword; + +@@ -2401,7 +2414,7 @@ static int i40e_clean_rx_irq(struct i40e + break; + + i40e_trace(clean_rx_irq, rx_ring, rx_desc, skb); +- rx_buffer = i40e_get_rx_buffer(rx_ring, size); ++ rx_buffer = i40e_get_rx_buffer(rx_ring, size, &rx_buffer_pgcnt); + + /* retrieve a buffer from the ring */ + if (!skb) { +@@ -2441,7 +2454,7 @@ static int i40e_clean_rx_irq(struct i40e + break; + } + +- i40e_put_rx_buffer(rx_ring, rx_buffer); ++ i40e_put_rx_buffer(rx_ring, rx_buffer, rx_buffer_pgcnt); + cleaned_count++; + + if (i40e_is_non_eop(rx_ring, rx_desc, skb)) diff --git a/patches.suse/igb-Report-speed-and-duplex-as-unknown-when-device-i.patch b/patches.suse/igb-Report-speed-and-duplex-as-unknown-when-device-i.patch new file mode 100644 index 0000000..8a84778 --- /dev/null +++ b/patches.suse/igb-Report-speed-and-duplex-as-unknown-when-device-i.patch @@ -0,0 +1,50 @@ +From: Kai-Heng Feng +Date: Tue, 5 May 2020 12:01:54 +0800 +Subject: igb: Report speed and duplex as unknown when device is runtime + suspended +Patch-mainline: v5.8-rc1 +Git-commit: 165ae7a8feb53dc47fb041357e4b253bfc927cf9 +References: git-fixes + +igb device gets runtime suspended when there's no link partner. We can't +get correct speed under that state: +$ cat /sys/class/net/enp3s0/speed +1000 + +In addition to that, an error can also be spotted in dmesg: +[ 385.991957] igb 0000:03:00.0 enp3s0: PCIe link lost + +Since device can only be runtime suspended when there's no link partner, +we can skip reading register and let the following logic set speed and +duplex with correct status. + +The more generic approach will be wrap get_link_ksettings() with begin() +and complete() callbacks. However, for this particular issue, begin() +calls igb_runtime_resume() , which tries to rtnl_lock() while the lock +is already hold by upper ethtool layer. + +So let's take this approach until the igb_runtime_resume() no longer +needs to hold rtnl_lock. + +CC: stable +Suggested-by: Alexander Duyck +Signed-off-by: Kai-Heng Feng +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/intel/igb/igb_ethtool.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c ++++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c +@@ -163,7 +163,8 @@ static int igb_get_link_ksettings(struct + u32 speed; + u32 supported, advertising; + +- status = rd32(E1000_STATUS); ++ status = pm_runtime_suspended(&adapter->pdev->dev) ? ++ 0 : rd32(E1000_STATUS); + if (hw->phy.media_type == e1000_media_type_copper) { + + supported = (SUPPORTED_10baseT_Half | diff --git a/patches.suse/igc-fix-link-speed-advertising.patch b/patches.suse/igc-fix-link-speed-advertising.patch new file mode 100644 index 0000000..5c36ea1 --- /dev/null +++ b/patches.suse/igc-fix-link-speed-advertising.patch @@ -0,0 +1,74 @@ +From: Corinna Vinschen +Date: Tue, 17 Nov 2020 20:50:40 +0100 +Subject: igc: fix link speed advertising +Git-commit: 329a3678ec69962aa67c91397efbd46d36635f91 +Patch-mainline: v5.11-rc6 +References: jsc#SLE-4799 + +Link speed advertising in igc has two problems: + +- When setting the advertisement via ethtool, the link speed is converted + to the legacy 32 bit representation for the intel PHY code. + This inadvertently drops ETHTOOL_LINK_MODE_2500baseT_Full_BIT (being + beyond bit 31). As a result, any call to `ethtool -s ...' drops the + 2500Mbit/s link speed from the PHY settings. Only reloading the driver + alleviates that problem. + + Fix this by converting the ETHTOOL_LINK_MODE_2500baseT_Full_BIT to the + Intel PHY ADVERTISE_2500_FULL bit explicitly. + +- Rather than checking the actual PHY setting, the .get_link_ksettings + function always fills link_modes.advertising with all link speeds + the device is capable of. + + Fix this by checking the PHY autoneg_advertised settings and report + only the actually advertised speeds up to ethtool. + +Fixes: 8c5ad0dae93c ("igc: Add ethtool support") +Signed-off-by: Corinna Vinschen +Signed-off-by: Tony Nguyen +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/intel/igc/igc_ethtool.c | 24 ++++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/intel/igc/igc_ethtool.c ++++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c +@@ -1670,12 +1670,18 @@ static int igc_get_link_ksettings(struct + cmd->base.phy_address = hw->phy.addr; + + /* advertising link modes */ +- ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Half); +- ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Full); +- ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Half); +- ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Full); +- ethtool_link_ksettings_add_link_mode(cmd, advertising, 1000baseT_Full); +- ethtool_link_ksettings_add_link_mode(cmd, advertising, 2500baseT_Full); ++ if (hw->phy.autoneg_advertised & ADVERTISE_10_HALF) ++ ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Half); ++ if (hw->phy.autoneg_advertised & ADVERTISE_10_FULL) ++ ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Full); ++ if (hw->phy.autoneg_advertised & ADVERTISE_100_HALF) ++ ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Half); ++ if (hw->phy.autoneg_advertised & ADVERTISE_100_FULL) ++ ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Full); ++ if (hw->phy.autoneg_advertised & ADVERTISE_1000_FULL) ++ ethtool_link_ksettings_add_link_mode(cmd, advertising, 1000baseT_Full); ++ if (hw->phy.autoneg_advertised & ADVERTISE_2500_FULL) ++ ethtool_link_ksettings_add_link_mode(cmd, advertising, 2500baseT_Full); + + /* set autoneg settings */ + if (hw->mac.autoneg == 1) { +@@ -1786,6 +1792,12 @@ static int igc_set_link_ksettings(struct + + ethtool_convert_link_mode_to_legacy_u32(&advertising, + cmd->link_modes.advertising); ++ /* Converting to legacy u32 drops ETHTOOL_LINK_MODE_2500baseT_Full_BIT. ++ * We have to check this and convert it to ADVERTISE_2500_FULL ++ * (aka ETHTOOL_LINK_MODE_2500baseX_Full_BIT) explicitly. ++ */ ++ if (ethtool_link_ksettings_test_link_mode(cmd, advertising, 2500baseT_Full)) ++ advertising |= ADVERTISE_2500_FULL; + + if (cmd->base.autoneg == AUTONEG_ENABLE) { + hw->mac.autoneg = 1; diff --git a/patches.suse/iommu-vt-d-don-t-dereference-iommu_device-if-iommu_api-is-not-built b/patches.suse/iommu-vt-d-don-t-dereference-iommu_device-if-iommu_api-is-not-built new file mode 100644 index 0000000..07093ba --- /dev/null +++ b/patches.suse/iommu-vt-d-don-t-dereference-iommu_device-if-iommu_api-is-not-built @@ -0,0 +1,64 @@ +From: Bartosz Golaszewski +Date: Tue, 13 Oct 2020 09:30:55 +0200 +Subject: iommu/vt-d: Don't dereference iommu_device if IOMMU_API is not built +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Git-commit: 9def3b1a07c41e21c68a0eb353e3e569fdd1d2b1 +Patch-mainline: v5.10-rc1 +References: bsc#1181001, jsc#ECO-3191 + +Since commit c40aaaac1018 ("iommu/vt-d: Gracefully handle DMAR units +with no supported address widths") dmar.c needs struct iommu_device to +be selected. We can drop this dependency by not dereferencing struct +iommu_device if IOMMU_API is not selected and by reusing the information +stored in iommu->drhd->ignored instead. + +This fixes the following build error when IOMMU_API is not selected: + +drivers/iommu/dmar.c: In function ‘free_iommu’: +drivers/iommu/dmar.c:1139:41: error: ‘struct iommu_device’ has no member named ‘ops’ + 1139 | if (intel_iommu_enabled && iommu->iommu.ops) { + ^ + +Fixes: c40aaaac1018 ("iommu/vt-d: Gracefully handle DMAR units with no supported address widths") +Signed-off-by: Bartosz Golaszewski +Acked-by: Lu Baolu +Acked-by: David Woodhouse +Link: https://lore.kernel.org/r/20201013073055.11262-1-brgl@bgdev.pl +Signed-off-by: Joerg Roedel +--- + drivers/iommu/dmar.c | 3 ++- + include/linux/intel-iommu.h | 2 ++ + 2 files changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/iommu/dmar.c ++++ b/drivers/iommu/dmar.c +@@ -1125,6 +1125,7 @@ static int alloc_iommu(struct dmar_drhd_ + } + + drhd->iommu = iommu; ++ iommu->drhd = drhd; + + return 0; + +@@ -1139,7 +1140,7 @@ error: + + static void free_iommu(struct intel_iommu *iommu) + { +- if (intel_iommu_enabled && iommu->iommu.ops) { ++ if (intel_iommu_enabled && !iommu->drhd->ignored) { + iommu_device_unregister(&iommu->iommu); + iommu_device_sysfs_remove(&iommu->iommu); + } +--- a/include/linux/intel-iommu.h ++++ b/include/linux/intel-iommu.h +@@ -435,6 +435,8 @@ struct intel_iommu { + struct iommu_device iommu; /* IOMMU core code handle */ + int node; + u32 flags; /* Software defined flags */ ++ ++ struct dmar_drhd_unit *drhd; + }; + + static inline void __iommu_flush_cache( diff --git a/patches.suse/iommu-vt-d-gracefully-handle-dmar-units-with-no-supported-address-widths b/patches.suse/iommu-vt-d-gracefully-handle-dmar-units-with-no-supported-address-widths new file mode 100644 index 0000000..bd671fa --- /dev/null +++ b/patches.suse/iommu-vt-d-gracefully-handle-dmar-units-with-no-supported-address-widths @@ -0,0 +1,95 @@ +From: David Woodhouse +Date: Thu, 24 Sep 2020 15:08:42 +0100 +Subject: iommu/vt-d: Gracefully handle DMAR units with no supported address + widths +Git-commit: c40aaaac1018ff1382f2d35df5129a6bcea3df6b +Patch-mainline: v5.10-rc1 +References: bsc#1181001, jsc#ECO-3191 + +Instead of bailing out completely, such a unit can still be used for +interrupt remapping. + +Signed-off-by: David Woodhouse +Reviewed-by: Lu Baolu +Link: https://lore.kernel.org/linux-iommu/549928db2de6532117f36c9c810373c14cf76f51.camel@infradead.org/ +Signed-off-by: Joerg Roedel +--- + drivers/iommu/dmar.c | 46 +++++++++++++++++++++++++++++++--------------- + 1 file changed, 31 insertions(+), 15 deletions(-) + +--- a/drivers/iommu/dmar.c ++++ b/drivers/iommu/dmar.c +@@ -1031,8 +1031,8 @@ static int alloc_iommu(struct dmar_drhd_ + { + struct intel_iommu *iommu; + u32 ver, sts; +- int agaw = 0; +- int msagaw = 0; ++ int agaw = -1; ++ int msagaw = -1; + int err; + + if (!drhd->reg_base_addr) { +@@ -1057,17 +1057,28 @@ static int alloc_iommu(struct dmar_drhd_ + } + + err = -EINVAL; +- agaw = iommu_calculate_agaw(iommu); +- if (agaw < 0) { +- pr_err("Cannot get a valid agaw for iommu (seq_id = %d)\n", +- iommu->seq_id); +- goto err_unmap; +- } +- msagaw = iommu_calculate_max_sagaw(iommu); +- if (msagaw < 0) { +- pr_err("Cannot get a valid max agaw for iommu (seq_id = %d)\n", +- iommu->seq_id); +- goto err_unmap; ++ if (cap_sagaw(iommu->cap) == 0) { ++ pr_info("%s: No supported address widths. Not attempting DMA translation.\n", ++ iommu->name); ++ drhd->ignored = 1; ++ } ++ ++ if (!drhd->ignored) { ++ agaw = iommu_calculate_agaw(iommu); ++ if (agaw < 0) { ++ pr_err("Cannot get a valid agaw for iommu (seq_id = %d)\n", ++ iommu->seq_id); ++ drhd->ignored = 1; ++ } ++ } ++ if (!drhd->ignored) { ++ msagaw = iommu_calculate_max_sagaw(iommu); ++ if (msagaw < 0) { ++ pr_err("Cannot get a valid max agaw for iommu (seq_id = %d)\n", ++ iommu->seq_id); ++ drhd->ignored = 1; ++ agaw = -1; ++ } + } + iommu->agaw = agaw; + iommu->msagaw = msagaw; +@@ -1094,7 +1105,12 @@ static int alloc_iommu(struct dmar_drhd_ + + raw_spin_lock_init(&iommu->register_lock); + +- if (intel_iommu_enabled) { ++ /* ++ * This is only for hotplug; at boot time intel_iommu_enabled won't ++ * be set yet. When intel_iommu_init() runs, it registers the units ++ * present at boot time, then sets intel_iommu_enabled. ++ */ ++ if (intel_iommu_enabled && !drhd->ignored) { + err = iommu_device_sysfs_add(&iommu->iommu, NULL, + intel_iommu_groups, + "%s", iommu->name); +@@ -1123,7 +1139,7 @@ error: + + static void free_iommu(struct intel_iommu *iommu) + { +- if (intel_iommu_enabled) { ++ if (intel_iommu_enabled && iommu->iommu.ops) { + iommu_device_unregister(&iommu->iommu); + iommu_device_sysfs_remove(&iommu->iommu); + } diff --git a/patches.suse/ixgbe-Fix-XDP-redirect-on-archs-with-PAGE_SIZE-above.patch b/patches.suse/ixgbe-Fix-XDP-redirect-on-archs-with-PAGE_SIZE-above.patch new file mode 100644 index 0000000..de17bfc --- /dev/null +++ b/patches.suse/ixgbe-Fix-XDP-redirect-on-archs-with-PAGE_SIZE-above.patch @@ -0,0 +1,41 @@ +From: Jesper Dangaard Brouer +Date: Thu, 14 May 2020 12:50:49 +0200 +Subject: ixgbe: Fix XDP redirect on archs with PAGE_SIZE above 4K +Patch-mainline: v5.8-rc1 +Git-commit: 88eb0ee17b2ece64fcf6689a4557a5c2e7a89c4b +References: bsc#1109837 FATE#326322 + +The ixgbe driver have another memory model when compiled on archs with +PAGE_SIZE above 4096 bytes. In this mode it doesn't split the page in +two halves, but instead increment rx_buffer->page_offset by truesize of +packet (which include headroom and tailroom for skb_shared_info). + +This is done correctly in ixgbe_build_skb(), but in ixgbe_rx_buffer_flip +which is currently only called on XDP_TX and XDP_REDIRECT, it forgets +to add the tailroom for skb_shared_info. This breaks XDP_REDIRECT, for +veth and cpumap. Fix by adding size of skb_shared_info tailroom. + +Maintainers notice: This fix have been queued to Jeff. + +Fixes: 6453073987ba ("ixgbe: add initial support for xdp redirect") +Signed-off-by: Jesper Dangaard Brouer +Signed-off-by: Alexei Starovoitov +Cc: Jeff Kirsher +Link: https://lore.kernel.org/bpf/158945344946.97035.17031588499266605743.stgit@firesoul +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -2279,7 +2279,8 @@ static void ixgbe_rx_buffer_flip(struct + rx_buffer->page_offset ^= truesize; + #else + unsigned int truesize = ring_uses_build_skb(rx_ring) ? +- SKB_DATA_ALIGN(IXGBE_SKB_PAD + size) : ++ SKB_DATA_ALIGN(IXGBE_SKB_PAD + size) + ++ SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) : + SKB_DATA_ALIGN(size); + + rx_buffer->page_offset += truesize; diff --git a/patches.suse/ixgbe-avoid-premature-Rx-buffer-reuse.patch b/patches.suse/ixgbe-avoid-premature-Rx-buffer-reuse.patch new file mode 100644 index 0000000..b54f639 --- /dev/null +++ b/patches.suse/ixgbe-avoid-premature-Rx-buffer-reuse.patch @@ -0,0 +1,107 @@ +From: =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= +Date: Tue, 25 Aug 2020 19:27:35 +0200 +Subject: ixgbe: avoid premature Rx buffer reuse +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Patch-mainline: v5.10 +Git-commit: a06316dc87bdc000f7f39a315476957af2ba0f05 +References: bsc#1109837 FATE#326322 + +The page recycle code, incorrectly, relied on that a page fragment +could not be freed inside xdp_do_redirect(). This assumption leads to +that page fragments that are used by the stack/XDP redirect can be +reused and overwritten. + +To avoid this, store the page count prior invoking xdp_do_redirect(). + +Fixes: 6453073987ba ("ixgbe: add initial support for xdp redirect") +Reported-and-analyzed-by: Li RongQing +Signed-off-by: Björn Töpel +Tested-by: Sandeep Penigalapati +Signed-off-by: Tony Nguyen +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 24 +++++++++++++++++------- + 1 file changed, 17 insertions(+), 7 deletions(-) + +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -1972,7 +1972,8 @@ static inline bool ixgbe_page_is_reserve + return (page_to_nid(page) != numa_mem_id()) || page_is_pfmemalloc(page); + } + +-static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer) ++static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer, ++ int rx_buffer_pgcnt) + { + unsigned int pagecnt_bias = rx_buffer->pagecnt_bias; + struct page *page = rx_buffer->page; +@@ -1983,7 +1984,7 @@ static bool ixgbe_can_reuse_rx_page(stru + + #if (PAGE_SIZE < 8192) + /* if we are only owner of page we can reuse it */ +- if (unlikely((page_ref_count(page) - pagecnt_bias) > 1)) ++ if (unlikely((rx_buffer_pgcnt - pagecnt_bias) > 1)) + return false; + #else + /* The last offset is a bit aggressive in that we assume the +@@ -2048,11 +2049,18 @@ static void ixgbe_add_rx_frag(struct ixg + static struct ixgbe_rx_buffer *ixgbe_get_rx_buffer(struct ixgbe_ring *rx_ring, + union ixgbe_adv_rx_desc *rx_desc, + struct sk_buff **skb, +- const unsigned int size) ++ const unsigned int size, ++ int *rx_buffer_pgcnt) + { + struct ixgbe_rx_buffer *rx_buffer; + + rx_buffer = &rx_ring->rx_buffer_info[rx_ring->next_to_clean]; ++ *rx_buffer_pgcnt = ++#if (PAGE_SIZE < 8192) ++ page_count(rx_buffer->page); ++#else ++ 0; ++#endif + prefetchw(rx_buffer->page); + *skb = rx_buffer->skb; + +@@ -2082,9 +2090,10 @@ skip_sync: + + static void ixgbe_put_rx_buffer(struct ixgbe_ring *rx_ring, + struct ixgbe_rx_buffer *rx_buffer, +- struct sk_buff *skb) ++ struct sk_buff *skb, ++ int rx_buffer_pgcnt) + { +- if (ixgbe_can_reuse_rx_page(rx_buffer)) { ++ if (ixgbe_can_reuse_rx_page(rx_buffer, rx_buffer_pgcnt)) { + /* hand second half of page back to the ring */ + ixgbe_reuse_rx_page(rx_ring, rx_buffer); + } else { +@@ -2320,6 +2329,7 @@ static int ixgbe_clean_rx_irq(struct ixg + union ixgbe_adv_rx_desc *rx_desc; + struct ixgbe_rx_buffer *rx_buffer; + struct sk_buff *skb; ++ int rx_buffer_pgcnt; + unsigned int size; + + /* return some buffers to hardware, one at a time is too slow */ +@@ -2339,7 +2349,7 @@ static int ixgbe_clean_rx_irq(struct ixg + */ + dma_rmb(); + +- rx_buffer = ixgbe_get_rx_buffer(rx_ring, rx_desc, &skb, size); ++ rx_buffer = ixgbe_get_rx_buffer(rx_ring, rx_desc, &skb, size, &rx_buffer_pgcnt); + + /* retrieve a buffer from the ring */ + if (!skb) { +@@ -2381,7 +2391,7 @@ static int ixgbe_clean_rx_irq(struct ixg + break; + } + +- ixgbe_put_rx_buffer(rx_ring, rx_buffer, skb); ++ ixgbe_put_rx_buffer(rx_ring, rx_buffer, skb, rx_buffer_pgcnt); + cleaned_count++; + + /* place incomplete frames back on ring for completion */ diff --git a/patches.suse/mlxsw-core-Fix-use-after-free-in-mlxsw_emad_trans_fi.patch b/patches.suse/mlxsw-core-Fix-use-after-free-in-mlxsw_emad_trans_fi.patch new file mode 100644 index 0000000..d131784 --- /dev/null +++ b/patches.suse/mlxsw-core-Fix-use-after-free-in-mlxsw_emad_trans_fi.patch @@ -0,0 +1,159 @@ +From: Amit Cohen +Date: Sat, 24 Oct 2020 16:37:33 +0300 +Subject: mlxsw: core: Fix use-after-free in mlxsw_emad_trans_finish() +Patch-mainline: v5.10-rc2 +Git-commit: 0daf2bf5a2dcf33d446b76360908f109816e2e21 +References: git-fixes + +Each EMAD transaction stores the skb used to issue the EMAD request +('trans->tx_skb') so that the request could be retried in case of a +timeout. The skb can be freed when a corresponding response is received +or as part of the retry logic (e.g., failed retransmit, exceeded maximum +number of retries). + +The two tasks (i.e., response processing and retransmits) are +synchronized by the atomic 'trans->active' field which ensures that +responses to inactive transactions are ignored. + +In case of a failed retransmit the transaction is finished and all of +its resources are freed. However, the current code does not mark it as +inactive. Syzkaller was able to hit a race condition in which a +concurrent response is processed while the transaction's resources are +being freed, resulting in a use-after-free [1]. + +Fix the issue by making sure to mark the transaction as inactive after a +failed retransmit and free its resources only if a concurrent task did +not already do that. + +[1] +BUG: KASAN: use-after-free in consume_skb+0x30/0x370 +net/core/skbuff.c:833 +Read of size 4 at addr ffff88804f570494 by task syz-executor.0/1004 + +CPU: 0 PID: 1004 Comm: syz-executor.0 Not tainted 5.8.0-rc7+ #68 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS +rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 +Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0xf6/0x16e lib/dump_stack.c:118 + print_address_description.constprop.0+0x1c/0x250 +mm/kasan/report.c:383 + __kasan_report mm/kasan/report.c:513 [inline] + kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530 + check_memory_region_inline mm/kasan/generic.c:186 [inline] + check_memory_region+0x14e/0x1b0 mm/kasan/generic.c:192 + instrument_atomic_read include/linux/instrumented.h:56 [inline] + atomic_read include/asm-generic/atomic-instrumented.h:27 [inline] + refcount_read include/linux/refcount.h:147 [inline] + skb_unref include/linux/skbuff.h:1044 [inline] + consume_skb+0x30/0x370 net/core/skbuff.c:833 + mlxsw_emad_trans_finish+0x64/0x1c0 drivers/net/ethernet/mellanox/mlxsw/core.c:592 + mlxsw_emad_process_response drivers/net/ethernet/mellanox/mlxsw/core.c:651 [inline] + mlxsw_emad_rx_listener_func+0x5c9/0xac0 drivers/net/ethernet/mellanox/mlxsw/core.c:672 + mlxsw_core_skb_receive+0x4df/0x770 drivers/net/ethernet/mellanox/mlxsw/core.c:2063 + mlxsw_pci_cqe_rdq_handle drivers/net/ethernet/mellanox/mlxsw/pci.c:595 [inline] + mlxsw_pci_cq_tasklet+0x12a6/0x2520 drivers/net/ethernet/mellanox/mlxsw/pci.c:651 + tasklet_action_common.isra.0+0x13f/0x3e0 kernel/softirq.c:550 + __do_softirq+0x223/0x964 kernel/softirq.c:292 + asm_call_on_stack+0x12/0x20 arch/x86/entry/entry_64.S:711 + +Allocated by task 1006: + save_stack+0x1b/0x40 mm/kasan/common.c:48 + set_track mm/kasan/common.c:56 [inline] + __kasan_kmalloc mm/kasan/common.c:494 [inline] + __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:467 + slab_post_alloc_hook mm/slab.h:586 [inline] + slab_alloc_node mm/slub.c:2824 [inline] + slab_alloc mm/slub.c:2832 [inline] + kmem_cache_alloc+0xcd/0x2e0 mm/slub.c:2837 + __build_skb+0x21/0x60 net/core/skbuff.c:311 + __netdev_alloc_skb+0x1e2/0x360 net/core/skbuff.c:464 + netdev_alloc_skb include/linux/skbuff.h:2810 [inline] + mlxsw_emad_alloc drivers/net/ethernet/mellanox/mlxsw/core.c:756 [inline] + mlxsw_emad_reg_access drivers/net/ethernet/mellanox/mlxsw/core.c:787 [inline] + mlxsw_core_reg_access_emad+0x1ab/0x1420 drivers/net/ethernet/mellanox/mlxsw/core.c:1817 + mlxsw_reg_trans_query+0x39/0x50 drivers/net/ethernet/mellanox/mlxsw/core.c:1831 + mlxsw_sp_sb_pm_occ_clear drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c:260 [inline] + mlxsw_sp_sb_occ_max_clear+0xbff/0x10a0 drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c:1365 + mlxsw_devlink_sb_occ_max_clear+0x76/0xb0 drivers/net/ethernet/mellanox/mlxsw/core.c:1037 + devlink_nl_cmd_sb_occ_max_clear_doit+0x1ec/0x280 net/core/devlink.c:1765 + genl_family_rcv_msg_doit net/netlink/genetlink.c:669 [inline] + genl_family_rcv_msg net/netlink/genetlink.c:714 [inline] + genl_rcv_msg+0x617/0x980 net/netlink/genetlink.c:731 + netlink_rcv_skb+0x152/0x440 net/netlink/af_netlink.c:2470 + genl_rcv+0x24/0x40 net/netlink/genetlink.c:742 + netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline] + netlink_unicast+0x53a/0x750 net/netlink/af_netlink.c:1330 + netlink_sendmsg+0x850/0xd90 net/netlink/af_netlink.c:1919 + sock_sendmsg_nosec net/socket.c:651 [inline] + sock_sendmsg+0x150/0x190 net/socket.c:671 + ____sys_sendmsg+0x6d8/0x840 net/socket.c:2359 + ___sys_sendmsg+0xff/0x170 net/socket.c:2413 + __sys_sendmsg+0xe5/0x1b0 net/socket.c:2446 + do_syscall_64+0x56/0xa0 arch/x86/entry/common.c:384 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Freed by task 73: + save_stack+0x1b/0x40 mm/kasan/common.c:48 + set_track mm/kasan/common.c:56 [inline] + kasan_set_free_info mm/kasan/common.c:316 [inline] + __kasan_slab_free+0x12c/0x170 mm/kasan/common.c:455 + slab_free_hook mm/slub.c:1474 [inline] + slab_free_freelist_hook mm/slub.c:1507 [inline] + slab_free mm/slub.c:3072 [inline] + kmem_cache_free+0xbe/0x380 mm/slub.c:3088 + kfree_skbmem net/core/skbuff.c:622 [inline] + kfree_skbmem+0xef/0x1b0 net/core/skbuff.c:616 + __kfree_skb net/core/skbuff.c:679 [inline] + consume_skb net/core/skbuff.c:837 [inline] + consume_skb+0xe1/0x370 net/core/skbuff.c:831 + mlxsw_emad_trans_finish+0x64/0x1c0 drivers/net/ethernet/mellanox/mlxsw/core.c:592 + mlxsw_emad_transmit_retry.isra.0+0x9d/0xc0 drivers/net/ethernet/mellanox/mlxsw/core.c:613 + mlxsw_emad_trans_timeout_work+0x43/0x50 drivers/net/ethernet/mellanox/mlxsw/core.c:625 + process_one_work+0xa3e/0x17a0 kernel/workqueue.c:2269 + worker_thread+0x9e/0x1050 kernel/workqueue.c:2415 + kthread+0x355/0x470 kernel/kthread.c:291 + ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:293 + +The buggy address belongs to the object at ffff88804f5703c0 + which belongs to the cache skbuff_head_cache of size 224 +The buggy address is located 212 bytes inside of + 224-byte region [ffff88804f5703c0, ffff88804f5704a0) +The buggy address belongs to the page: +page:ffffea00013d5c00 refcount:1 mapcount:0 mapping:0000000000000000 +index:0x0 +flags: 0x100000000000200(slab) +raw: 0100000000000200 dead000000000100 dead000000000122 ffff88806c625400 +raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 +page dumped because: kasan: bad access detected + +Memory state around the buggy address: + ffff88804f570380: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb + ffff88804f570400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +>ffff88804f570480: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc + ^ + ffff88804f570500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + ffff88804f570580: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc + +Fixes: caf7297e7ab5f ("mlxsw: core: Introduce support for asynchronous EMAD register access") +Signed-off-by: Amit Cohen +Reviewed-by: Jiri Pirko +Signed-off-by: Ido Schimmel +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/mellanox/mlxsw/core.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/mellanox/mlxsw/core.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c +@@ -488,6 +488,9 @@ static void mlxsw_emad_transmit_retry(st + err = mlxsw_emad_transmit(trans->core, trans); + if (err == 0) + return; ++ ++ if (!atomic_dec_and_test(&trans->active)) ++ return; + } else { + err = -EIO; + } diff --git a/patches.suse/mlxsw-destroy-workqueue-when-trap_register-in-mlxsw_.patch b/patches.suse/mlxsw-destroy-workqueue-when-trap_register-in-mlxsw_.patch new file mode 100644 index 0000000..66c64a6 --- /dev/null +++ b/patches.suse/mlxsw-destroy-workqueue-when-trap_register-in-mlxsw_.patch @@ -0,0 +1,38 @@ +From: Liu Jian +Date: Mon, 20 Jul 2020 22:31:49 +0800 +Subject: mlxsw: destroy workqueue when trap_register in mlxsw_emad_init +Patch-mainline: v5.8-rc7 +Git-commit: 5dbaeb87f2b309936be0aeae00cbc9e7f20ab296 +References: bsc#1112374 + +When mlxsw_core_trap_register fails in mlxsw_emad_init, +destroy_workqueue() shouled be called to destroy mlxsw_core->emad_wq. + +Fixes: d965465b60ba ("mlxsw: core: Fix possible deadlock") +Signed-off-by: Liu Jian +Reviewed-by: Ido Schimmel +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/mellanox/mlxsw/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlxsw/core.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c +@@ -587,7 +587,7 @@ static int mlxsw_emad_init(struct mlxsw_ + err = mlxsw_core_trap_register(mlxsw_core, &mlxsw_emad_rx_listener, + mlxsw_core); + if (err) +- return err; ++ goto err_trap_register; + + err = mlxsw_core->driver->basic_trap_groups_set(mlxsw_core); + if (err) +@@ -599,6 +599,7 @@ static int mlxsw_emad_init(struct mlxsw_ + err_emad_trap_set: + mlxsw_core_trap_unregister(mlxsw_core, &mlxsw_emad_rx_listener, + mlxsw_core); ++err_trap_register: + destroy_workqueue(mlxsw_core->emad_wq); + return err; + } diff --git a/patches.suse/mlxsw-spectrum-Fix-use-after-free-of-split-unsplit-t.patch b/patches.suse/mlxsw-spectrum-Fix-use-after-free-of-split-unsplit-t.patch new file mode 100644 index 0000000..e5f3228 --- /dev/null +++ b/patches.suse/mlxsw-spectrum-Fix-use-after-free-of-split-unsplit-t.patch @@ -0,0 +1,106 @@ +From: Jiri Pirko +Date: Thu, 21 May 2020 15:11:44 +0300 +Subject: mlxsw: spectrum: Fix use-after-free of split/unsplit/type_set in case + reload fails +Patch-mainline: v5.7-rc7 +Git-commit: 4340f42f207eacb81e7a6b6bb1e3b6afad9a2e26 +References: bsc#1112374 + +In case of reload fail, the mlxsw_sp->ports contains a pointer to a +freed memory (either by reload_down() or reload_up() error path). +Fix this by initializing the pointer to NULL and checking it before +dereferencing in split/unsplit/type_set callpaths. + +Fixes: 24cc68ad6c46 ("mlxsw: core: Add support for reload") +Reported-by: Danielle Ratson +Signed-off-by: Jiri Pirko +Signed-off-by: Ido Schimmel +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 14 ++++++++++++-- + drivers/net/ethernet/mellanox/mlxsw/switchx2.c | 8 ++++++++ + 2 files changed, 20 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +@@ -3022,6 +3022,7 @@ static void mlxsw_sp_ports_remove(struct + mlxsw_sp_port_remove(mlxsw_sp, i); + kfree(mlxsw_sp->port_to_module); + kfree(mlxsw_sp->ports); ++ mlxsw_sp->ports = NULL; + } + + static int mlxsw_sp_ports_create(struct mlxsw_sp *mlxsw_sp) +@@ -3070,6 +3071,7 @@ err_port_module_info_get: + kfree(mlxsw_sp->port_to_module); + err_port_to_module_alloc: + kfree(mlxsw_sp->ports); ++ mlxsw_sp->ports = NULL; + return err; + } + +@@ -3124,6 +3126,14 @@ static void mlxsw_sp_port_unsplit_create + } + } + ++static struct mlxsw_sp_port * ++mlxsw_sp_port_get_by_local_port(struct mlxsw_sp *mlxsw_sp, u8 local_port) ++{ ++ if (mlxsw_sp->ports && mlxsw_sp->ports[local_port]) ++ return mlxsw_sp->ports[local_port]; ++ return NULL; ++} ++ + static int mlxsw_sp_port_split(struct mlxsw_core *mlxsw_core, u8 local_port, + unsigned int count, + struct netlink_ext_ack *extack) +@@ -3134,7 +3144,7 @@ static int mlxsw_sp_port_split(struct ml + int i; + int err; + +- mlxsw_sp_port = mlxsw_sp->ports[local_port]; ++ mlxsw_sp_port = mlxsw_sp_port_get_by_local_port(mlxsw_sp, local_port); + if (!mlxsw_sp_port) { + dev_err(mlxsw_sp->bus_info->dev, "Port number \"%d\" does not exist\n", + local_port); +@@ -3201,7 +3211,7 @@ static int mlxsw_sp_port_unsplit(struct + unsigned int count; + int i; + +- mlxsw_sp_port = mlxsw_sp->ports[local_port]; ++ mlxsw_sp_port = mlxsw_sp_port_get_by_local_port(mlxsw_sp, local_port); + if (!mlxsw_sp_port) { + dev_err(mlxsw_sp->bus_info->dev, "Port number \"%d\" does not exist\n", + local_port); +--- a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c +@@ -1289,6 +1289,7 @@ static void mlxsw_sx_ports_remove(struct + if (mlxsw_sx_port_created(mlxsw_sx, i)) + mlxsw_sx_port_remove(mlxsw_sx, i); + kfree(mlxsw_sx->ports); ++ mlxsw_sx->ports = NULL; + } + + static int mlxsw_sx_ports_create(struct mlxsw_sx *mlxsw_sx) +@@ -1323,6 +1324,7 @@ err_port_module_info_get: + if (mlxsw_sx_port_created(mlxsw_sx, i)) + mlxsw_sx_port_remove(mlxsw_sx, i); + kfree(mlxsw_sx->ports); ++ mlxsw_sx->ports = NULL; + return err; + } + +@@ -1406,6 +1408,12 @@ static int mlxsw_sx_port_type_set(struct + u8 module, width; + int err; + ++ if (!mlxsw_sx->ports || !mlxsw_sx->ports[local_port]) { ++ dev_err(mlxsw_sx->bus_info->dev, "Port number \"%d\" does not exist\n", ++ local_port); ++ return -EINVAL; ++ } ++ + if (new_type == DEVLINK_PORT_TYPE_AUTO) + return -EOPNOTSUPP; + diff --git a/patches.suse/module-delay-kobject-uevent-until-after-module-init-.patch b/patches.suse/module-delay-kobject-uevent-until-after-module-init-.patch new file mode 100644 index 0000000..df154ea --- /dev/null +++ b/patches.suse/module-delay-kobject-uevent-until-after-module-init-.patch @@ -0,0 +1,66 @@ +From 38dc717e97153e46375ee21797aa54777e5498f3 Mon Sep 17 00:00:00 2001 +From: Jessica Yu +Date: Fri, 27 Nov 2020 10:09:39 +0100 +Subject: [PATCH] module: delay kobject uevent until after module init call +Patch-mainline: v5.11-rc1 +Git-commit: 38dc717e97153e46375ee21797aa54777e5498f3 +References: bsc#1178631 + +Apparently there has been a longstanding race between udev/systemd and +the module loader. Currently, the module loader sends a uevent right +after sysfs initialization, but before the module calls its init +function. However, some udev rules expect that the module has +initialized already upon receiving the uevent. + +This race has been triggered recently (see link in references) in some +systemd mount unit files. For instance, the configfs module creates the +/sys/kernel/config mount point in its init function, however the module +loader issues the uevent before this happens. sys-kernel-config.mount +expects to be able to mount /sys/kernel/config upon receipt of the +module loading uevent, but if the configfs module has not called its +init function yet, then this directory will not exist and the mount unit +fails. A similar situation exists for sys-fs-fuse-connections.mount, as +the fuse sysfs mount point is created during the fuse module's init +function. If udev is faster than module initialization then the mount +unit would fail in a similar fashion. + +To fix this race, delay the module KOBJ_ADD uevent until after the +module has finished calling its init routine. + +References: https://github.com/systemd/systemd/issues/17586 +Reviewed-by: Greg Kroah-Hartman +Tested-By: Nicolas Morey-Chaisemartin +Signed-off-by: Jessica Yu +Acked-by: Jessica Yu +--- + kernel/module.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -1757,7 +1757,6 @@ static int mod_sysfs_init(struct module + if (err) + mod_kobject_put(mod); + +- /* delay uevent until full sysfs population */ + out: + return err; + } +@@ -1791,7 +1790,6 @@ static int mod_sysfs_setup(struct module + add_sect_attrs(mod, info); + add_notes_attrs(mod, info); + +- kobject_uevent(&mod->mkobj.kobj, KOBJ_ADD); + return 0; + + out_unreg_param: +@@ -3421,6 +3419,9 @@ static noinline int do_init_module(struc + blocking_notifier_call_chain(&module_notify_list, + MODULE_STATE_LIVE, mod); + ++ /* Delay uevent until module has finished its init routine */ ++ kobject_uevent(&mod->mkobj.kobj, KOBJ_ADD); ++ + /* + * We need to finish all async code before the module init sequence + * is done. This has potential to deadlock. For example, a newly diff --git a/patches.suse/msft-hv-2201-x86-hyperv-Fix-kexec-panic-hang-issues.patch b/patches.suse/msft-hv-2201-x86-hyperv-Fix-kexec-panic-hang-issues.patch new file mode 100644 index 0000000..0ba9222 --- /dev/null +++ b/patches.suse/msft-hv-2201-x86-hyperv-Fix-kexec-panic-hang-issues.patch @@ -0,0 +1,139 @@ +From: Dexuan Cui +Date: Mon, 21 Dec 2020 22:55:41 -0800 +Patch-mainline: v5.11-rc4 +Subject: x86/hyperv: Fix kexec panic/hang issues +Git-commit: dfe94d4086e40e92b1926bddcefa629b791e9b28 +References: bsc#1176831 + +Currently the kexec kernel can panic or hang due to 2 causes: + +1) hv_cpu_die() is not called upon kexec, so the hypervisor corrupts the +old VP Assist Pages when the kexec kernel runs. The same issue is fixed +for hibernation in commit 421f090c819d ("x86/hyperv: Suspend/resume the +VP assist page for hibernation"). Now fix it for kexec. + +2) hyperv_cleanup() is called too early. In the kexec path, the other CPUs +are stopped in hv_machine_shutdown() -> native_machine_shutdown(), so +between hv_kexec_handler() and native_machine_shutdown(), the other CPUs +can still try to access the hypercall page and cause panic. The workaround +"hv_hypercall_pg = NULL;" in hyperv_cleanup() is unreliabe. Move +hyperv_cleanup() to a better place. + +Signed-off-by: Dexuan Cui +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/20201222065541.24312-1-decui@microsoft.com +Signed-off-by: Wei Liu +Acked-by: Olaf Hering +--- + arch/x86/hyperv/hv_init.c | 4 ++++ + arch/x86/include/asm/mshyperv.h | 2 ++ + arch/x86/kernel/cpu/mshyperv.c | 18 ++++++++++++++++++ + drivers/hv/vmbus_drv.c | 2 -- + 4 files changed, 24 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c +--- a/arch/x86/hyperv/hv_init.c ++++ b/arch/x86/hyperv/hv_init.c +@@ -16,6 +16,9 @@ + #include + #include + #include ++#ifndef __GENKSYMS__ /* kABI workaround for SLE kernel */ ++#include ++#endif + #include + #include + #include +@@ -33,6 +33,8 @@ + #include + #include + ++int hyperv_init_cpuhp; ++ + void *hv_hypercall_pg; + EXPORT_SYMBOL_GPL(hv_hypercall_pg); + +@@ -314,6 +316,8 @@ void __init hyperv_init(void) + + /* Register Hyper-V specific clocksource */ + hv_init_clocksource(); ++ ++ hyperv_init_cpuhp = cpuhp; + return; + + remove_cpuhp_state: +diff --git a/arch/x86/include/asm/mshyperv.h b/arch/x86/include/asm/mshyperv.h +--- a/arch/x86/include/asm/mshyperv.h ++++ b/arch/x86/include/asm/mshyperv.h +@@ -72,6 +72,8 @@ static inline void hv_disable_stimer0_pe + + + #if IS_ENABLED(CONFIG_HYPERV) ++extern int hyperv_init_cpuhp; ++ + extern void *hv_hypercall_pg; + extern void __percpu **hyperv_pcpu_input_arg; + +diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c +--- a/arch/x86/kernel/cpu/mshyperv.c ++++ b/arch/x86/kernel/cpu/mshyperv.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -135,14 +135,32 @@ static void hv_machine_shutdown(void) + { + if (kexec_in_progress && hv_kexec_handler) + hv_kexec_handler(); ++ ++ /* ++ * Call hv_cpu_die() on all the CPUs, otherwise later the hypervisor ++ * corrupts the old VP Assist Pages and can crash the kexec kernel. ++ */ ++ if (kexec_in_progress && hyperv_init_cpuhp > 0) ++ cpuhp_remove_state(hyperv_init_cpuhp); ++ ++ /* The function calls stop_other_cpus(). */ + native_machine_shutdown(); ++ ++ /* Disable the hypercall page when there is only 1 active CPU. */ ++ if (kexec_in_progress) ++ hyperv_cleanup(); + } + + static void hv_machine_crash_shutdown(struct pt_regs *regs) + { + if (hv_crash_handler) + hv_crash_handler(regs); ++ ++ /* The function calls crash_smp_send_stop(). */ + native_machine_crash_shutdown(regs); ++ ++ /* Disable the hypercall page when there is only 1 active CPU. */ ++ hyperv_cleanup(); + } + #endif /* CONFIG_KEXEC_CORE */ + #endif /* CONFIG_HYPERV */ +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -2550,7 +2550,6 @@ static void hv_kexec_handler(void) + /* Make sure conn_state is set as hv_synic_cleanup checks for it */ + mb(); + cpuhp_remove_state(hyperv_cpuhp_online); +- hyperv_cleanup(); + }; + + static void hv_crash_handler(struct pt_regs *regs) +@@ -2144,7 +2144,6 @@ static void hv_crash_handler(struct pt_r + cpu = smp_processor_id(); + hv_stimer_cleanup(cpu); + hv_synic_cleanup(cpu); +- hyperv_cleanup(); + }; + + static int __init hv_acpi_init(void) diff --git a/patches.suse/nbd-Fix-memory-leak-in-nbd_add_socket.patch b/patches.suse/nbd-Fix-memory-leak-in-nbd_add_socket.patch new file mode 100644 index 0000000..54f1847 --- /dev/null +++ b/patches.suse/nbd-Fix-memory-leak-in-nbd_add_socket.patch @@ -0,0 +1,73 @@ +From: Zheng Bin +Date: Mon, 29 Jun 2020 09:23:49 +0800 +Subject: nbd: Fix memory leak in nbd_add_socket +Patch-mainline: v5.8-rc5 +Git-commit: 579dd91ab3a5446b148e7f179b6596b270dace46 +References: bsc#1181504 + +When adding first socket to nbd, if nsock's allocation failed, the data +structure member "config->socks" was reallocated, but the data structure +member "config->num_connections" was not updated. A memory leak will occur +then because the function "nbd_config_put" will free "config->socks" only +when "config->num_connections" is not zero. + +Fixes: 03bf73c315ed ("nbd: prevent memory leak") +Reported-by: syzbot+934037347002901b8d2a@syzkaller.appspotmail.com +Signed-off-by: Zheng Bin +Reviewed-by: Eric Biggers +Signed-off-by: Jens Axboe +Acked-by: Daniel Wagner +--- + drivers/block/nbd.c | 25 +++++++++++++++---------- + 1 file changed, 15 insertions(+), 10 deletions(-) + +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -880,25 +880,26 @@ static int nbd_add_socket(struct nbd_dev + test_bit(NBD_BOUND, &config->runtime_flags))) { + dev_err(disk_to_dev(nbd->disk), + "Device being setup by another task"); +- sockfd_put(sock); +- return -EBUSY; ++ err = -EBUSY; ++ goto put_socket; ++ } ++ ++ nsock = kzalloc(sizeof(*nsock), GFP_KERNEL); ++ if (!nsock) { ++ err = -ENOMEM; ++ goto put_socket; + } + + socks = krealloc(config->socks, (config->num_connections + 1) * + sizeof(struct nbd_sock *), GFP_KERNEL); + if (!socks) { +- sockfd_put(sock); +- return -ENOMEM; ++ kfree(nsock); ++ err = -ENOMEM; ++ goto put_socket; + } + + config->socks = socks; + +- nsock = kzalloc(sizeof(struct nbd_sock), GFP_KERNEL); +- if (!nsock) { +- sockfd_put(sock); +- return -ENOMEM; +- } +- + nsock->fallback_index = -1; + nsock->dead = false; + mutex_init(&nsock->tx_lock); +@@ -910,6 +911,10 @@ static int nbd_add_socket(struct nbd_dev + atomic_inc(&config->live_connections); + + return 0; ++ ++put_socket: ++ sockfd_put(sock); ++ return err; + } + + static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg) diff --git a/patches.suse/nbd-freeze-the-queue-while-we-re-adding-connections.patch b/patches.suse/nbd-freeze-the-queue-while-we-re-adding-connections.patch new file mode 100644 index 0000000..ef23e35 --- /dev/null +++ b/patches.suse/nbd-freeze-the-queue-while-we-re-adding-connections.patch @@ -0,0 +1,57 @@ +From: Josef Bacik +Date: Mon, 25 Jan 2021 12:21:02 -0500 +Subject: nbd: freeze the queue while we're adding connections +Patch-mainline: v5.11-rc6 +Git-commit: b98e762e3d71e893b221f871825dc64694cfb258 +References: bsc#1181504 CVE-2021-3348 + +When setting up a device, we can krealloc the config->socks array to add +new sockets to the configuration. However if we happen to get a IO +request in at this point even though we aren't setup we could hit a UAF, +as we deref config->socks without any locking, assuming that the +configuration was setup already and that ->socks is safe to access it as +we have a reference on the configuration. + +But there's nothing really preventing IO from occurring at this point of +the device setup, we don't want to incur the overhead of a lock to +access ->socks when it will never change while the device is running. +To fix this UAF scenario simply freeze the queue if we are adding +sockets. This will protect us from this particular case without adding +any additional overhead for the normal running case. + +Cc: stable@vger.kernel.org +Signed-off-by: Josef Bacik +Signed-off-by: Jens Axboe +Acked-by: Daniel Wagner +--- + drivers/block/nbd.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -871,6 +871,12 @@ static int nbd_add_socket(struct nbd_dev + if (!sock) + return err; + ++ /* ++ * We need to make sure we don't get any errant requests while we're ++ * reallocating the ->socks array. ++ */ ++ blk_mq_freeze_queue(nbd->disk->queue); ++ + if (!netlink && !nbd->task_setup && + !test_bit(NBD_BOUND, &config->runtime_flags)) + nbd->task_setup = current; +@@ -909,10 +915,12 @@ static int nbd_add_socket(struct nbd_dev + nsock->cookie = 0; + socks[config->num_connections++] = nsock; + atomic_inc(&config->live_connections); ++ blk_mq_unfreeze_queue(nbd->disk->queue); + + return 0; + + put_socket: ++ blk_mq_unfreeze_queue(nbd->disk->queue); + sockfd_put(sock); + return err; + } diff --git a/patches.suse/net-cbs-Fix-software-cbs-to-consider-packet-sending-.patch b/patches.suse/net-cbs-Fix-software-cbs-to-consider-packet-sending-.patch new file mode 100644 index 0000000..8a98f21 --- /dev/null +++ b/patches.suse/net-cbs-Fix-software-cbs-to-consider-packet-sending-.patch @@ -0,0 +1,63 @@ +From: Zh-yuan Ye +Date: Tue, 24 Mar 2020 17:28:25 +0900 +Subject: net: cbs: Fix software cbs to consider packet sending time +Patch-mainline: v5.6 +Git-commit: 961d0e5b32946703125964f9f5b6321d60f4d706 +References: bsc#1109837 + +Currently the software CBS does not consider the packet sending time +when depleting the credits. It caused the throughput to be +Idleslope[kbps] * (Port transmit rate[kbps] / |Sendslope[kbps]|) where +Idleslope * (Port transmit rate / (Idleslope + |Sendslope|)) = Idleslope +is expected. In order to fix the issue above, this patch takes the time +when the packet sending completes into account by moving the anchor time +variable "last" ahead to the send completion time upon transmission and +adding wait when the next dequeue request comes before the send +completion time of the previous packet. + +changelog: +V2->V3: + - remove unnecessary whitespace cleanup + - add the checks if port_rate is 0 before division + +V1->V2: + - combine variable "send_completed" into "last" + - add the comment for estimate of the packet sending + +Fixes: 585d763af09c ("net/sched: Introduce Credit Based Shaper (CBS) qdisc") +Signed-off-by: Zh-yuan Ye +Reviewed-by: Vinicius Costa Gomes +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + net/sched/sch_cbs.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/net/sched/sch_cbs.c ++++ b/net/sched/sch_cbs.c +@@ -186,6 +186,11 @@ static struct sk_buff *cbs_dequeue_soft( + s64 credits; + int len; + ++ /* The previous packet is still being sent */ ++ if (now < q->last) { ++ qdisc_watchdog_schedule_ns(&q->watchdog, q->last); ++ return NULL; ++ } + if (q->credits < 0) { + credits = timediff_to_credits(now - q->last, q->idleslope); + +@@ -217,7 +222,12 @@ static struct sk_buff *cbs_dequeue_soft( + credits += q->credits; + + q->credits = max_t(s64, credits, q->locredit); +- q->last = now; ++ /* Estimate of the transmission of the last byte of the packet in ns */ ++ if (unlikely(atomic64_read(&q->port_rate) == 0)) ++ q->last = now; ++ else ++ q->last = now + div64_s64(len * NSEC_PER_SEC, ++ atomic64_read(&q->port_rate)); + + return skb; + } diff --git a/patches.suse/net-dsa-b53-Rework-ARL-bin-logic.patch b/patches.suse/net-dsa-b53-Rework-ARL-bin-logic.patch index 1d0502b..c41ad5c 100644 --- a/patches.suse/net-dsa-b53-Rework-ARL-bin-logic.patch +++ b/patches.suse/net-dsa-b53-Rework-ARL-bin-logic.patch @@ -48,7 +48,7 @@ Signed-off-by: Jiri Slaby /* Read the bins */ for (i = 0; i < dev->num_arl_entries; i++) { u64 mac_vid; -@@ -1156,13 +1159,21 @@ static int b53_arl_read(struct b53_devic +@@ -1215,16 +1215,24 @@ static int b53_arl_read(struct b53_devic B53_ARLTBL_DATA_ENTRY(i), &fwd_entry); b53_arl_to_entry(ent, mac_vid, fwd_entry); @@ -59,6 +59,9 @@ Signed-off-by: Jiri Slaby + } if ((mac_vid & ARLTBL_MAC_MASK) != mac) continue; + if (dev->vlan_enabled && + ((mac_vid >> ARLTBL_VID_S) & ARLTBL_VID_MASK) != vid) + continue; *idx = i; + return 0; } diff --git a/patches.suse/net-ena-set-initial-DMA-width-to-avoid-intel-iommu-i.patch b/patches.suse/net-ena-set-initial-DMA-width-to-avoid-intel-iommu-i.patch new file mode 100644 index 0000000..82982d3 --- /dev/null +++ b/patches.suse/net-ena-set-initial-DMA-width-to-avoid-intel-iommu-i.patch @@ -0,0 +1,71 @@ +From: Shay Agroskin +Date: Mon, 23 Nov 2020 21:08:58 +0200 +Subject: net: ena: set initial DMA width to avoid intel iommu issue +Patch-mainline: v5.10-rc6 +Git-commit: 09323b3bca95181c0da79daebc8b0603e500f573 +References: git-fixes + +The ENA driver uses the readless mechanism, which uses DMA, to find +out what the DMA mask is supposed to be. + +If DMA is used without setting the dma_mask first, it causes the +Intel IOMMU driver to think that ENA is a 32-bit device and therefore +disables IOMMU passthrough permanently. + +This patch sets the dma_mask to be ENA_MAX_PHYS_ADDR_SIZE_BITS=48 +before readless initialization in +ena_device_init()->ena_com_mmio_reg_read_request_init(), +which is large enough to workaround the intel_iommu issue. + +DMA mask is set again to the correct value after it's received from the +device after readless is initialized. + +The patch also changes the driver to use dma_set_mask_and_coherent() +function instead of the two pci_set_dma_mask() and +pci_set_consistent_dma_mask() ones. Both methods achieve the same +effect. + +Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") +Signed-off-by: Mike Cui +Signed-off-by: Arthur Kiyanovski +Signed-off-by: Shay Agroskin +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/amazon/ena/ena_netdev.c | 17 ++++++++--------- + 1 file changed, 8 insertions(+), 9 deletions(-) + +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -3377,16 +3377,9 @@ static int ena_device_init(struct ena_co + goto err_mmio_read_less; + } + +- rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(dma_width)); ++ rc = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(dma_width)); + if (rc) { +- dev_err(dev, "pci_set_dma_mask failed 0x%x\n", rc); +- goto err_mmio_read_less; +- } +- +- rc = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(dma_width)); +- if (rc) { +- dev_err(dev, "err_pci_set_consistent_dma_mask failed 0x%x\n", +- rc); ++ dev_err(dev, "dma_set_mask_and_coherent failed %d\n", rc); + goto err_mmio_read_less; + } + +@@ -4161,6 +4154,12 @@ static int ena_probe(struct pci_dev *pde + return rc; + } + ++ rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(ENA_MAX_PHYS_ADDR_SIZE_BITS)); ++ if (rc) { ++ dev_err(&pdev->dev, "dma_set_mask_and_coherent failed %d\n", rc); ++ goto err_disable_device; ++ } ++ + pci_set_master(pdev); + + ena_dev = vzalloc(sizeof(*ena_dev)); diff --git a/patches.suse/net-ethernet-mlx4-Avoid-assigning-a-value-to-ring_co.patch b/patches.suse/net-ethernet-mlx4-Avoid-assigning-a-value-to-ring_co.patch new file mode 100644 index 0000000..58fd650 --- /dev/null +++ b/patches.suse/net-ethernet-mlx4-Avoid-assigning-a-value-to-ring_co.patch @@ -0,0 +1,33 @@ +From: Luo Jiaxing +Date: Sat, 12 Sep 2020 16:08:15 +0800 +Subject: net: ethernet: mlx4: Avoid assigning a value to ring_cons but not + used it anymore in mlx4_en_xmit() +Patch-mainline: v5.10-rc1 +Git-commit: e5e252ba21d243689a8e8bf2af5bf5579dabfea7 +References: git-fixes + +We found a set but not used variable 'ring_cons' in mlx4_en_xmit(), it will +cause a warning when build the kernel. And after checking the commit record +of this function, we found that it was introduced by a previous patch. + +So, We delete this redundant assignment code. + +Fixes: 488a9b48e398 ("net/mlx4_en: Wake TX queues only when there's enough room") + +Signed-off-by: Luo Jiaxing +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/mellanox/mlx4/en_tx.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c +@@ -1081,7 +1081,6 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff + */ + smp_rmb(); + +- ring_cons = READ_ONCE(ring->cons); + if (unlikely(!mlx4_en_is_tx_ring_full(ring))) { + netif_tx_wake_queue(ring->tx_queue); + ring->wake_queue++; diff --git a/patches.suse/net-filter-Permit-reading-NET-in-load_bytes_relative.patch b/patches.suse/net-filter-Permit-reading-NET-in-load_bytes_relative.patch new file mode 100644 index 0000000..ddbf7e5 --- /dev/null +++ b/patches.suse/net-filter-Permit-reading-NET-in-load_bytes_relative.patch @@ -0,0 +1,67 @@ +From: YiFei Zhu +Date: Wed, 10 Jun 2020 13:41:39 -0500 +Subject: net/filter: Permit reading NET in load_bytes_relative when MAC not + set +Patch-mainline: v5.8-rc1 +Git-commit: 0f5d82f187e1beda3fe7295dfc500af266a5bd80 +References: bsc#1109837 + +Added a check in the switch case on start_header that checks for +the existence of the header, and in the case that MAC is not set +and the caller requests for MAC, -EFAULT. If the caller requests +for NET then MAC's existence is completely ignored. + +There is no function to check NET header's existence and as far +as cgroup_skb/egress is concerned it should always be set. + +Removed for ptr >= the start of header, considering offset is +bounded unsigned and should always be true. len <= end - mac is +redundant to ptr + len <= end. + +Fixes: 3eee1f75f2b9 ("bpf: fix bpf_skb_load_bytes_relative pkt length check") +Signed-off-by: YiFei Zhu +Signed-off-by: Daniel Borkmann +Reviewed-by: Stanislav Fomichev +Link: https://lore.kernel.org/bpf/76bb820ddb6a95f59a772ecbd8c8a336f646b362.1591812755.git.zhuyifei@google.com +Acked-by: Thomas Bogendoerfer +--- + net/core/filter.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -1708,25 +1708,27 @@ BPF_CALL_5(bpf_skb_load_bytes_relative, + u32, offset, void *, to, u32, len, u32, start_header) + { + u8 *end = skb_tail_pointer(skb); +- u8 *net = skb_network_header(skb); +- u8 *mac = skb_mac_header(skb); +- u8 *ptr; ++ u8 *start, *ptr; + +- if (unlikely(offset > 0xffff || len > (end - mac))) ++ if (unlikely(offset > 0xffff)) + goto err_clear; + + switch (start_header) { + case BPF_HDR_START_MAC: +- ptr = mac + offset; ++ if (unlikely(!skb_mac_header_was_set(skb))) ++ goto err_clear; ++ start = skb_mac_header(skb); + break; + case BPF_HDR_START_NET: +- ptr = net + offset; ++ start = skb_network_header(skb); + break; + default: + goto err_clear; + } + +- if (likely(ptr >= mac && ptr + len <= end)) { ++ ptr = start + offset; ++ ++ if (likely(ptr + len <= end)) { + memcpy(to, ptr, len); + return 0; + } diff --git a/patches.suse/net-hns3-add-a-missing-uninit-debugfs-when-unload-dr.patch b/patches.suse/net-hns3-add-a-missing-uninit-debugfs-when-unload-dr.patch new file mode 100644 index 0000000..68e743f --- /dev/null +++ b/patches.suse/net-hns3-add-a-missing-uninit-debugfs-when-unload-dr.patch @@ -0,0 +1,31 @@ +From: Huazhong Tan +Date: Mon, 6 Jul 2020 19:26:01 +0800 +Subject: net: hns3: add a missing uninit debugfs when unload driver +Patch-mainline: v5.8-rc5 +Git-commit: e22b5e728bbb179b912d3a3cd5c25894a89a26a2 +References: bsc#1104353 FATE#326415 + +When unloading driver, if flag HNS3_NIC_STATE_INITED has been +already cleared, the debugfs will not be uninitialized, so fix it. + +Fixes: b2292360bb2a ("net: hns3: Add debugfs framework registration") +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -3940,9 +3940,8 @@ static void hns3_client_uninit(struct hn + + hns3_put_ring_config(priv); + +- hns3_dbg_uninit(handle); +- + out_netdev_free: ++ hns3_dbg_uninit(handle); + free_netdev(netdev); + } + diff --git a/patches.suse/net-hns3-add-compatible-handling-for-command-HCLGE_O.patch b/patches.suse/net-hns3-add-compatible-handling-for-command-HCLGE_O.patch new file mode 100644 index 0000000..3ab82fa --- /dev/null +++ b/patches.suse/net-hns3-add-compatible-handling-for-command-HCLGE_O.patch @@ -0,0 +1,52 @@ +From: Huazhong Tan +Date: Thu, 7 Nov 2019 09:30:19 +0800 +Subject: net: hns3: add compatible handling for command HCLGE_OPC_PF_RST_DONE +Patch-mainline: v5.4-rc7 +Git-commit: 648db0514a3808eead513d7abfaf650d02a64d5c +References: git-fixes + +Since old firmware does not support HCLGE_OPC_PF_RST_DONE, it will +return -EOPNOTSUPP to the driver when received this command. So +for this case, it should just print a warning and return success +to the caller. + +Fixes: 72e2fb07997c ("net: hns3: clear reset interrupt status in hclge_irq_handle()") +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 18 +++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -3392,12 +3392,28 @@ static int hclge_set_rst_done(struct hcl + { + struct hclge_pf_rst_done_cmd *req; + struct hclge_desc desc; ++ int ret; + + req = (struct hclge_pf_rst_done_cmd *)desc.data; + hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_PF_RST_DONE, false); + req->pf_rst_done |= HCLGE_PF_RESET_DONE_BIT; + +- return hclge_cmd_send(&hdev->hw, &desc, 1); ++ ret = hclge_cmd_send(&hdev->hw, &desc, 1); ++ /* To be compatible with the old firmware, which does not support ++ * command HCLGE_OPC_PF_RST_DONE, just print a warning and ++ * return success ++ */ ++ if (ret == -EOPNOTSUPP) { ++ dev_warn(&hdev->pdev->dev, ++ "current firmware does not support command(0x%x)!\n", ++ HCLGE_OPC_PF_RST_DONE); ++ return 0; ++ } else if (ret) { ++ dev_err(&hdev->pdev->dev, "assert PF reset done fail %d!\n", ++ ret); ++ } ++ ++ return ret; + } + + static int hclge_reset_prepare_up(struct hclge_dev *hdev) diff --git a/patches.suse/net-hns3-add-management-table-after-IMP-reset.patch b/patches.suse/net-hns3-add-management-table-after-IMP-reset.patch new file mode 100644 index 0000000..6cb0e8c --- /dev/null +++ b/patches.suse/net-hns3-add-management-table-after-IMP-reset.patch @@ -0,0 +1,35 @@ +From: Yufeng Mo +Date: Fri, 14 Feb 2020 09:53:41 +0800 +Subject: net: hns3: add management table after IMP reset +Patch-mainline: v5.6-rc2 +Git-commit: d0db7ed397517c8b2be24a0d1abfa15df776908e +References: bsc#1104353 FATE#326415 + +In the current process, the management table is missing after the +IMP reset. This patch adds the management table to the reset process. + +Fixes: f5aac71c0327 ("net: hns3: add manager table initialization for hardware") +Signed-off-by: Yufeng Mo +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -9027,6 +9027,13 @@ static int hclge_reset_ae_dev(struct hna + return ret; + } + ++ ret = init_mgr_tbl(hdev); ++ if (ret) { ++ dev_err(&pdev->dev, ++ "failed to reinit manager table, ret = %d\n", ret); ++ return ret; ++ } ++ + ret = hclge_init_fd_config(hdev); + if (ret) { + dev_err(&pdev->dev, "fd table init fail, ret=%d\n", ret); diff --git a/patches.suse/net-hns3-check-reset-interrupt-status-when-reset-fai.patch b/patches.suse/net-hns3-check-reset-interrupt-status-when-reset-fai.patch new file mode 100644 index 0000000..67f9c35 --- /dev/null +++ b/patches.suse/net-hns3-check-reset-interrupt-status-when-reset-fai.patch @@ -0,0 +1,48 @@ +From: Huazhong Tan +Date: Wed, 28 Aug 2019 22:23:15 +0800 +Subject: net: hns3: check reset interrupt status when reset fails +Patch-mainline: v5.4-rc1 +Git-commit: 2336f19d789223b9f42f111aab8de6ad66d12c28 +References: git-fixes + +Currently, the reset interrupt will be cleared firstly, so when +reset fails, if interrupt status register has reset interrupt, +it means there is a new coming reset. + +Fixes: 72e2fb07997c ("net: hns3: clear reset interrupt status in hclge_irq_handle()") +Signed-off-by: Huazhong Tan +Reviewed-by: Peng Li +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 7 +++---- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 1 + + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -3337,11 +3337,10 @@ static bool hclge_reset_err_handle(struc + dev_info(&hdev->pdev->dev, "Reset pending %lu\n", + hdev->reset_pending); + return true; +- } else if ((hdev->reset_type != HNAE3_IMP_RESET) && +- (hclge_read_dev(&hdev->hw, HCLGE_GLOBAL_RESET_REG) & +- BIT(HCLGE_IMP_RESET_BIT))) { ++ } else if (hclge_read_dev(&hdev->hw, HCLGE_MISC_VECTOR_INT_STS) & ++ HCLGE_RESET_INT_M) { + dev_info(&hdev->pdev->dev, +- "reset failed because IMP Reset is pending\n"); ++ "reset failed because new reset interrupt\n"); + hclge_clear_reset_cause(hdev); + return false; + } else if (hdev->reset_fail_cnt < MAX_RESET_FAIL_CNT) { +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h +@@ -164,6 +164,7 @@ enum HLCGE_PORT_TYPE { + #define HCLGE_GLOBAL_RESET_BIT 0 + #define HCLGE_CORE_RESET_BIT 1 + #define HCLGE_IMP_RESET_BIT 2 ++#define HCLGE_RESET_INT_M GENMASK(2, 0) + #define HCLGE_FUN_RST_ING 0x20C00 + #define HCLGE_FUN_RST_ING_B 0 + diff --git a/patches.suse/net-hns3-clear-reset-interrupt-status-in-hclge_irq_h.patch b/patches.suse/net-hns3-clear-reset-interrupt-status-in-hclge_irq_h.patch new file mode 100644 index 0000000..ba428ed --- /dev/null +++ b/patches.suse/net-hns3-clear-reset-interrupt-status-in-hclge_irq_h.patch @@ -0,0 +1,196 @@ +From: Huazhong Tan +Date: Thu, 1 Aug 2019 11:55:44 +0800 +Subject: net: hns3: clear reset interrupt status in hclge_irq_handle() +Patch-mainline: v5.4-rc1 +Git-commit: 72e2fb07997c5ca2c73114624fd64c41be013bdc +References: git-fixes + +Currently, the reset interrupt is cleared in the reset task, which +is too late. Since, when the hardware finish the previous reset, +it can begin to do a new global/IMP reset, if this new coming reset +type is same as the previous one, the driver will clear them together, +then driver can not get that there is another reset, but the hardware +still wait for the driver to deal with the second one. + +So this patch clears PF's reset interrupt status in the +hclge_irq_handle(), the hardware waits for handshaking from +driver before doing reset, so the driver and hardware deal with reset +one by one. + +BTW, when VF doing global/IMP reset, it reads PF's reset interrupt +register to get that whether PF driver's re-initialization is done, +since VF's re-initialization should be done after PF's. So we add +a new command and a register bit to do that. When VF receive reset +interrupt, it sets up this bit, and PF finishes re-initialization +send command to clear this bit, then VF do re-initialization. + +Fixes: 4ed340ab8f49 ("net: hns3: Add reset process in hclge_main") +Signed-off-by: Huazhong Tan +Reviewed-by: Yunsheng Lin +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 8 +++ + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 34 ++++++++++++-- + drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 29 +++++++---- + drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 3 + + 4 files changed, 61 insertions(+), 13 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +@@ -86,6 +86,7 @@ enum hclge_opcode_type { + HCLGE_OPC_QUERY_PF_RSRC = 0x0023, + HCLGE_OPC_QUERY_VF_RSRC = 0x0024, + HCLGE_OPC_GET_CFG_PARAM = 0x0025, ++ HCLGE_OPC_PF_RST_DONE = 0x0026, + + HCLGE_OPC_STATS_64_BIT = 0x0030, + HCLGE_OPC_STATS_32_BIT = 0x0031, +@@ -878,6 +879,13 @@ struct hclge_reset_cmd { + u8 rsv[22]; + }; + ++#define HCLGE_PF_RESET_DONE_BIT BIT(0) ++ ++struct hclge_pf_rst_done_cmd { ++ u8 pf_rst_done; ++ u8 rsv[23]; ++}; ++ + #define HCLGE_CMD_SERDES_SERIAL_INNER_LOOP_B BIT(0) + #define HCLGE_CMD_SERDES_PARALLEL_INNER_LOOP_B BIT(2) + #define HCLGE_CMD_SERDES_DONE_B BIT(0) +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -2879,10 +2879,15 @@ static irqreturn_t hclge_misc_irq_handle + break; + } + +- /* clear the source of interrupt if it is not cause by reset */ ++ hclge_clear_event_cause(hdev, event_cause, clearval); ++ ++ /* Enable interrupt if it is not cause by reset. And when ++ * clearval equal to 0, it means interrupt status may be ++ * cleared by hardware before driver reads status register. ++ * For this case, vector0 interrupt also should be enabled. ++ */ + if (!clearval || + event_cause == HCLGE_VECTOR0_EVENT_MBX) { +- hclge_clear_event_cause(hdev, event_cause, clearval); + hclge_enable_vector(&hdev->misc_vector, true); + } + +@@ -3226,7 +3231,13 @@ static void hclge_clear_reset_cause(stru + if (!clearval) + return; + +- hclge_write_dev(&hdev->hw, HCLGE_MISC_RESET_STS_REG, clearval); ++ /* For revision 0x20, the reset interrupt source ++ * can only be cleared after hardware reset done ++ */ ++ if (hdev->pdev->revision == 0x20) ++ hclge_write_dev(&hdev->hw, HCLGE_MISC_RESET_STS_REG, ++ clearval); ++ + hclge_enable_vector(&hdev->misc_vector, true); + } + +@@ -3356,6 +3367,18 @@ static bool hclge_reset_err_handle(struc + return false; + } + ++static int hclge_set_rst_done(struct hclge_dev *hdev) ++{ ++ struct hclge_pf_rst_done_cmd *req; ++ struct hclge_desc desc; ++ ++ req = (struct hclge_pf_rst_done_cmd *)desc.data; ++ hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_PF_RST_DONE, false); ++ req->pf_rst_done |= HCLGE_PF_RESET_DONE_BIT; ++ ++ return hclge_cmd_send(&hdev->hw, &desc, 1); ++} ++ + static int hclge_reset_prepare_up(struct hclge_dev *hdev) + { + int ret = 0; +@@ -3366,6 +3389,11 @@ static int hclge_reset_prepare_up(struct + case HNAE3_FLR_RESET: + ret = hclge_set_all_vf_rst(hdev, false); + break; ++ case HNAE3_GLOBAL_RESET: ++ /* fall through */ ++ case HNAE3_IMP_RESET: ++ ret = hclge_set_rst_done(hdev); ++ break; + default: + break; + } +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -1396,19 +1396,22 @@ static int hclgevf_reset_wait(struct hcl + u32 val; + int ret; + +- /* wait to check the hardware reset completion status */ +- val = hclgevf_read_dev(&hdev->hw, HCLGEVF_RST_ING); +- dev_info(&hdev->pdev->dev, "checking vf resetting status: %x\n", val); +- + if (hdev->reset_type == HNAE3_FLR_RESET) + return hclgevf_flr_poll_timeout(hdev, + HCLGEVF_RESET_WAIT_US, + HCLGEVF_RESET_WAIT_CNT); +- +- ret = readl_poll_timeout(hdev->hw.io_base + HCLGEVF_RST_ING, val, +- !(val & HCLGEVF_RST_ING_BITS), +- HCLGEVF_RESET_WAIT_US, +- HCLGEVF_RESET_WAIT_TIMEOUT_US); ++ else if (hdev->reset_type == HNAE3_VF_RESET) ++ ret = readl_poll_timeout(hdev->hw.io_base + ++ HCLGEVF_VF_RST_ING, val, ++ !(val & HCLGEVF_VF_RST_ING_BIT), ++ HCLGEVF_RESET_WAIT_US, ++ HCLGEVF_RESET_WAIT_TIMEOUT_US); ++ else ++ ret = readl_poll_timeout(hdev->hw.io_base + ++ HCLGEVF_RST_ING, val, ++ !(val & HCLGEVF_RST_ING_BITS), ++ HCLGEVF_RESET_WAIT_US, ++ HCLGEVF_RESET_WAIT_TIMEOUT_US); + + /* hardware completion status should be available by this time */ + if (ret) { +@@ -1886,7 +1889,7 @@ static void hclgevf_clear_event_cause(st + static enum hclgevf_evt_cause hclgevf_check_evt_cause(struct hclgevf_dev *hdev, + u32 *clearval) + { +- u32 cmdq_src_reg, rst_ing_reg; ++ u32 val, cmdq_src_reg, rst_ing_reg; + + /* fetch the events from their corresponding regs */ + cmdq_src_reg = hclgevf_read_dev(&hdev->hw, +@@ -1902,6 +1905,12 @@ static enum hclgevf_evt_cause hclgevf_ch + cmdq_src_reg &= ~BIT(HCLGEVF_VECTOR0_RST_INT_B); + *clearval = cmdq_src_reg; + hdev->rst_stats.vf_rst_cnt++; ++ /* set up VF hardware reset status, its PF will clear ++ * this status when PF has initialized done. ++ */ ++ val = hclgevf_read_dev(&hdev->hw, HCLGEVF_VF_RST_ING); ++ hclgevf_write_dev(&hdev->hw, HCLGEVF_VF_RST_ING, ++ val | HCLGEVF_VF_RST_ING_BIT); + return HCLGEVF_VECTOR0_EVENT_RST; + } + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h +@@ -103,6 +103,9 @@ + (HCLGEVF_FUN_RST_ING_BIT | HCLGEVF_GLOBAL_RST_ING_BIT | \ + HCLGEVF_CORE_RST_ING_BIT | HCLGEVF_IMP_RST_ING_BIT) + ++#define HCLGEVF_VF_RST_ING 0x07008 ++#define HCLGEVF_VF_RST_ING_BIT BIT(16) ++ + #define HCLGEVF_RSS_IND_TBL_SIZE 512 + #define HCLGEVF_RSS_SET_BITMAP_MSK 0xffff + #define HCLGEVF_RSS_KEY_SIZE 40 diff --git a/patches.suse/net-hns3-fix-a-TX-timeout-issue.patch b/patches.suse/net-hns3-fix-a-TX-timeout-issue.patch new file mode 100644 index 0000000..a84856a --- /dev/null +++ b/patches.suse/net-hns3-fix-a-TX-timeout-issue.patch @@ -0,0 +1,38 @@ +From: Yonglong Liu +Date: Tue, 28 Jul 2020 10:16:49 +0800 +Subject: net: hns3: fix a TX timeout issue +Patch-mainline: v5.8 +Git-commit: a7e90ee5965fafc53d36e8b3205f08c88d7bc11f +References: bsc#1104353 FATE#326415 + +When the queue depth and queue parameters are modified, there is +a low probability that TX timeout occurs. The two operations cause +the link to be down or up when the watchdog is still working. All +queues are stopped when the link is down. After the carrier is on, +all queues are woken up. If the watchdog detects the link between +the carrier on and wakeup queues, a false TX timeout occurs. + +So fix this issue by modifying the sequence of carrier on and queue +wakeup, which is symmetrical to the link down action. + +Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") +Signed-off-by: Yonglong Liu +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -3961,8 +3961,8 @@ static void hns3_link_status_change(stru + return; + + if (linkup) { +- netif_carrier_on(netdev); + netif_tx_wake_all_queues(netdev); ++ netif_carrier_on(netdev); + if (netif_msg_link(handle)) + netdev_info(netdev, "link up\n"); + } else { diff --git a/patches.suse/net-hns3-fix-a-wrong-reset-interrupt-status-mask.patch b/patches.suse/net-hns3-fix-a-wrong-reset-interrupt-status-mask.patch new file mode 100644 index 0000000..20f37ea --- /dev/null +++ b/patches.suse/net-hns3-fix-a-wrong-reset-interrupt-status-mask.patch @@ -0,0 +1,34 @@ +From: Huazhong Tan +Date: Wed, 20 Nov 2019 10:07:15 +0800 +Subject: net: hns3: fix a wrong reset interrupt status mask +Patch-mainline: v5.4 +Git-commit: 74e78d6bae1904e87469da5ed87e9f6bd1131f46 +References: git-fixes + +According to hardware user manual, bits5~7 in register +HCLGE_MISC_VECTOR_INT_STS means reset interrupts status, +but HCLGE_RESET_INT_M is defined as bits0~2 now. So it +will make hclge_reset_err_handle() read the wrong reset +interrupt status. + +This patch fixes this wrong bit mask. + +Fixes: 2336f19d7892 ("net: hns3: check reset interrupt status when reset fails") +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h +@@ -164,7 +164,7 @@ enum HLCGE_PORT_TYPE { + #define HCLGE_GLOBAL_RESET_BIT 0 + #define HCLGE_CORE_RESET_BIT 1 + #define HCLGE_IMP_RESET_BIT 2 +-#define HCLGE_RESET_INT_M GENMASK(2, 0) ++#define HCLGE_RESET_INT_M GENMASK(7, 5) + #define HCLGE_FUN_RST_ING 0x20C00 + #define HCLGE_FUN_RST_ING_B 0 + diff --git a/patches.suse/net-hns3-fix-error-VF-index-when-setting-VLAN-offloa.patch b/patches.suse/net-hns3-fix-error-VF-index-when-setting-VLAN-offloa.patch new file mode 100644 index 0000000..6c2452e --- /dev/null +++ b/patches.suse/net-hns3-fix-error-VF-index-when-setting-VLAN-offloa.patch @@ -0,0 +1,69 @@ +From: Jian Shen +Date: Thu, 5 Sep 2019 21:31:36 +0800 +Subject: net: hns3: fix error VF index when setting VLAN offload +Patch-mainline: v5.4-rc1 +Git-commit: d9c0f2756a33833b2653f7a3612814fa5f52a568 +References: bsc#1104353 FATE#326415 + +In original codes, the VF index used incorrectly in function +hclge_set_vlan_rx_offload_cfg() and hclge_set_vlan_rx_offload_cfg(). +When VF id is greater than 8, for example 9, it will set the +same bit with VF id 1. + +This patch fixes it by using vport->vport_id % HCLGE_VF_NUM_PER_CMD / +HCLGE_VF_NUM_PER_BYTE as the array index, instead of vport->vport_id / +HCLGE_VF_NUM_PER_CMD. + +Fixes: 052ece6dc19c ("net: hns3: add ethtool related offload command") +Signed-off-by: Jian Shen +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -7339,6 +7339,7 @@ static int hclge_set_vlan_tx_offload_cfg + struct hclge_vport_vtag_tx_cfg_cmd *req; + struct hclge_dev *hdev = vport->back; + struct hclge_desc desc; ++ u16 bmap_index; + int status; + + hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_VLAN_PORT_TX_CFG, false); +@@ -7361,8 +7362,10 @@ static int hclge_set_vlan_tx_offload_cfg + hnae3_set_bit(req->vport_vlan_cfg, HCLGE_CFG_NIC_ROCE_SEL_B, 0); + + req->vf_offset = vport->vport_id / HCLGE_VF_NUM_PER_CMD; +- req->vf_bitmap[req->vf_offset] = +- 1 << (vport->vport_id % HCLGE_VF_NUM_PER_BYTE); ++ bmap_index = vport->vport_id % HCLGE_VF_NUM_PER_CMD / ++ HCLGE_VF_NUM_PER_BYTE; ++ req->vf_bitmap[bmap_index] = ++ 1U << (vport->vport_id % HCLGE_VF_NUM_PER_BYTE); + + status = hclge_cmd_send(&hdev->hw, &desc, 1); + if (status) +@@ -7379,6 +7382,7 @@ static int hclge_set_vlan_rx_offload_cfg + struct hclge_vport_vtag_rx_cfg_cmd *req; + struct hclge_dev *hdev = vport->back; + struct hclge_desc desc; ++ u16 bmap_index; + int status; + + hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_VLAN_PORT_RX_CFG, false); +@@ -7394,8 +7398,10 @@ static int hclge_set_vlan_rx_offload_cfg + vcfg->vlan2_vlan_prionly ? 1 : 0); + + req->vf_offset = vport->vport_id / HCLGE_VF_NUM_PER_CMD; +- req->vf_bitmap[req->vf_offset] = +- 1 << (vport->vport_id % HCLGE_VF_NUM_PER_BYTE); ++ bmap_index = vport->vport_id % HCLGE_VF_NUM_PER_CMD / ++ HCLGE_VF_NUM_PER_BYTE; ++ req->vf_bitmap[bmap_index] = ++ 1U << (vport->vport_id % HCLGE_VF_NUM_PER_BYTE); + + status = hclge_cmd_send(&hdev->hw, &desc, 1); + if (status) diff --git a/patches.suse/net-hns3-fix-error-handling-for-desc-filling-8ceca59f.patch b/patches.suse/net-hns3-fix-error-handling-for-desc-filling-8ceca59f.patch new file mode 100644 index 0000000..daa1826 --- /dev/null +++ b/patches.suse/net-hns3-fix-error-handling-for-desc-filling-8ceca59f.patch @@ -0,0 +1,70 @@ +From: Yunsheng Lin +Date: Tue, 21 Jul 2020 19:03:53 +0800 +Subject: net: hns3: fix error handling for desc filling +Patch-mainline: v5.8-rc7 +Git-commit: 8ceca59fb3ed48a693171bd571c4fcbd555b7f1f +References: bsc#1104353 FATE#326415 + +The content of the TX desc is automatically cleared by the HW +when the HW has sent out the packet to the wire. When desc filling +fails in hns3_nic_net_xmit(), it will call hns3_clear_desc() to do +the error handling, which miss zeroing of the TX desc and the +checking if a unmapping is needed. + +So add the zeroing and checking in hns3_clear_desc() to avoid the +above problem. Also add DESC_TYPE_UNKNOWN to indicate the info in +desc_cb is not valid, because hns3_nic_reclaim_desc() may treat +the desc_cb->type of zero as packet and add to the sent pkt +statistics accordingly. + +Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") +Signed-off-by: Yunsheng Lin +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hnae3.h | 1 + + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 8 ++++++++ + 2 files changed, 9 insertions(+) + +--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h +@@ -77,6 +77,7 @@ + ((ring)->p = ((ring)->p - 1 + (ring)->desc_num) % (ring)->desc_num) + + enum hns_desc_type { ++ DESC_TYPE_UNKNOWN, + DESC_TYPE_SKB, + DESC_TYPE_PAGE, + }; +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -1259,6 +1259,10 @@ static void hns3_clear_desc(struct hns3_ + unsigned int i; + + for (i = 0; i < ring->desc_num; i++) { ++ struct hns3_desc *desc = &ring->desc[ring->next_to_use]; ++ ++ memset(desc, 0, sizeof(*desc)); ++ + /* check if this is where we started */ + if (ring->next_to_use == next_to_use_orig) + break; +@@ -1266,6 +1270,9 @@ static void hns3_clear_desc(struct hns3_ + /* rollback one */ + ring_ptr_move_bw(ring, next_to_use); + ++ if (!ring->desc_cb[ring->next_to_use].dma) ++ continue; ++ + /* unmap the descriptor dma address */ + if (ring->desc_cb[ring->next_to_use].type == DESC_TYPE_SKB) + dma_unmap_single(dev, +@@ -1280,6 +1287,7 @@ static void hns3_clear_desc(struct hns3_ + + ring->desc_cb[ring->next_to_use].length = 0; + ring->desc_cb[ring->next_to_use].dma = 0; ++ ring->desc_cb[ring->next_to_use].type = DESC_TYPE_UNKNOWN; + } + } + diff --git a/patches.suse/net-hns3-fix-for-not-calculating-TX-BD-send-size-cor.patch b/patches.suse/net-hns3-fix-for-not-calculating-TX-BD-send-size-cor.patch new file mode 100644 index 0000000..2aba9ea --- /dev/null +++ b/patches.suse/net-hns3-fix-for-not-calculating-TX-BD-send-size-cor.patch @@ -0,0 +1,52 @@ +From: Yunsheng Lin +Date: Tue, 21 Jul 2020 19:03:52 +0800 +Subject: net: hns3: fix for not calculating TX BD send size correctly +Patch-mainline: v5.8-rc7 +Git-commit: 48ae74c9d89f827b39b5c07a1f02fc13637a3cd6 +References: bsc#1126390 + +With GRO and fraglist support, the SKB can be aggregated to +a total size of 65535, and when that SKB is forwarded through +a bridge, the size of the SKB may be pushed to exceed the size +of 65535 when br_dev_queue_push_xmit() is called. + +The max send size of BD supported by the HW is 65535, when a SKB +with a headlen of over 65535 is sent to the driver, the driver +needs to use multi BD to send the linear data, and the send size +of the last BD is calculated incorrectly by the driver who is +using '&' operation, which causes a TX error. + +Use '%' operation to fix this problem. + +Fixes: 3fe13ed95dd3 ("net: hns3: avoid mult + div op in critical data path") +Signed-off-by: Yunsheng Lin +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 2 -- + 2 files changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -1114,7 +1114,7 @@ static int hns3_fill_desc(struct hns3_en + } + + frag_buf_num = hns3_tx_bd_count(size); +- sizeoflast = size & HNS3_TX_LAST_SIZE_M; ++ sizeoflast = size % HNS3_MAX_BD_SIZE; + sizeoflast = sizeoflast ? sizeoflast : HNS3_MAX_BD_SIZE; + + /* When frag size is bigger than hardware limit, split this frag */ +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h +@@ -186,8 +186,6 @@ enum hns3_nic_state { + #define HNS3_TXD_MSS_S 0 + #define HNS3_TXD_MSS_M (0x3fff << HNS3_TXD_MSS_S) + +-#define HNS3_TX_LAST_SIZE_M 0xffff +- + #define HNS3_VECTOR_TX_IRQ BIT_ULL(0) + #define HNS3_VECTOR_RX_IRQ BIT_ULL(1) + diff --git a/patches.suse/net-hns3-fix-interrupt-clearing-error-for-VF.patch b/patches.suse/net-hns3-fix-interrupt-clearing-error-for-VF.patch new file mode 100644 index 0000000..e029033 --- /dev/null +++ b/patches.suse/net-hns3-fix-interrupt-clearing-error-for-VF.patch @@ -0,0 +1,95 @@ +From: Huazhong Tan +Date: Fri, 9 Aug 2019 10:31:08 +0800 +Subject: net: hns3: fix interrupt clearing error for VF +Patch-mainline: v5.4-rc1 +Git-commit: 130509213baeb3cada40c19dd87341a6787f8b23 +References: bsc#1104353 FATE#326415 + +Currently, VF driver has two kinds of interrupts, reset & CMDQ RX. +For revision 0x21, according to the UM, each interrupt should be +cleared by write 0 to the corresponding bit, but the implementation +writes 0 to the whole register in fact, it will clear other +interrupt at the same time, then the VF will loss the interrupt. +But for revision 0x20, this interrupt clear register is a read & +write register, for compatible, we just keep the old implementation +for 0x20. + +This patch fixes it, also, adds a new register for reading the interrupt +status according to hardware user manual. + +Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support") +Fixes: b90fcc5bd904 ("net: hns3: add reset handling for VF when doing Core/Global/IMP reset") + +Signed-off-by: Huazhong Tan +Reviewed-by: Yunsheng Lin +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 28 +++++++++----- + drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 2 + + 2 files changed, 21 insertions(+), 9 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -1889,21 +1889,20 @@ static void hclgevf_clear_event_cause(st + static enum hclgevf_evt_cause hclgevf_check_evt_cause(struct hclgevf_dev *hdev, + u32 *clearval) + { +- u32 val, cmdq_src_reg, rst_ing_reg; ++ u32 val, cmdq_stat_reg, rst_ing_reg; + + /* fetch the events from their corresponding regs */ +- cmdq_src_reg = hclgevf_read_dev(&hdev->hw, +- HCLGEVF_VECTOR0_CMDQ_SRC_REG); ++ cmdq_stat_reg = hclgevf_read_dev(&hdev->hw, ++ HCLGEVF_VECTOR0_CMDQ_STAT_REG); + +- if (BIT(HCLGEVF_VECTOR0_RST_INT_B) & cmdq_src_reg) { ++ if (BIT(HCLGEVF_VECTOR0_RST_INT_B) & cmdq_stat_reg) { + rst_ing_reg = hclgevf_read_dev(&hdev->hw, HCLGEVF_RST_ING); + dev_info(&hdev->pdev->dev, + "receive reset interrupt 0x%x!\n", rst_ing_reg); + set_bit(HNAE3_VF_RESET, &hdev->reset_pending); + set_bit(HCLGEVF_RESET_PENDING, &hdev->reset_state); + set_bit(HCLGEVF_STATE_CMD_DISABLE, &hdev->state); +- cmdq_src_reg &= ~BIT(HCLGEVF_VECTOR0_RST_INT_B); +- *clearval = cmdq_src_reg; ++ *clearval = ~(1U << HCLGEVF_VECTOR0_RST_INT_B); + hdev->rst_stats.vf_rst_cnt++; + /* set up VF hardware reset status, its PF will clear + * this status when PF has initialized done. +@@ -1915,9 +1914,20 @@ static enum hclgevf_evt_cause hclgevf_ch + } + + /* check for vector0 mailbox(=CMDQ RX) event source */ +- if (BIT(HCLGEVF_VECTOR0_RX_CMDQ_INT_B) & cmdq_src_reg) { +- cmdq_src_reg &= ~BIT(HCLGEVF_VECTOR0_RX_CMDQ_INT_B); +- *clearval = cmdq_src_reg; ++ if (BIT(HCLGEVF_VECTOR0_RX_CMDQ_INT_B) & cmdq_stat_reg) { ++ /* for revision 0x21, clearing interrupt is writing bit 0 ++ * to the clear register, writing bit 1 means to keep the ++ * old value. ++ * for revision 0x20, the clear register is a read & write ++ * register, so we should just write 0 to the bit we are ++ * handling, and keep other bits as cmdq_stat_reg. ++ */ ++ if (hdev->pdev->revision >= 0x21) ++ *clearval = ~(1U << HCLGEVF_VECTOR0_RX_CMDQ_INT_B); ++ else ++ *clearval = cmdq_stat_reg & ++ ~BIT(HCLGEVF_VECTOR0_RX_CMDQ_INT_B); ++ + return HCLGEVF_VECTOR0_EVENT_MBX; + } + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h +@@ -87,6 +87,8 @@ + + /* Vector0 interrupt CMDQ event source register(RW) */ + #define HCLGEVF_VECTOR0_CMDQ_SRC_REG 0x27100 ++/* Vector0 interrupt CMDQ event status register(RO) */ ++#define HCLGEVF_VECTOR0_CMDQ_STAT_REG 0x27104 + /* CMDQ register bits for RX event(=MBX event) */ + #define HCLGEVF_VECTOR0_RX_CMDQ_INT_B 1 + /* RST register bits for RESET event */ diff --git a/patches.suse/net-hns3-fix-mis-counting-IRQ-vector-numbers-issue.patch b/patches.suse/net-hns3-fix-mis-counting-IRQ-vector-numbers-issue.patch new file mode 100644 index 0000000..49162d1 --- /dev/null +++ b/patches.suse/net-hns3-fix-mis-counting-IRQ-vector-numbers-issue.patch @@ -0,0 +1,233 @@ +From: Yonglong Liu +Date: Fri, 18 Oct 2019 11:42:59 +0800 +Subject: net: hns3: fix mis-counting IRQ vector numbers issue +Patch-mainline: v5.4-rc4 +Git-commit: 580a05f9d4ada3bfb689140d0efec1efdb8a48da +References: bsc#1104353 FATE#326415 + +Currently, the num_msi_left means the vector numbers of NIC, +but if the PF supported RoCE, it contains the vector numbers +of NIC and RoCE(Not expected). + +This may cause interrupts lost in some case, because of the +NIC module used the vector resources which belongs to RoCE. + +This patch adds a new variable num_nic_msi to store the vector +numbers of NIC, and adjust the default TQP numbers and rss_size +according to the value of num_nic_msi. + +Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support") +Signed-off-by: Yonglong Liu +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hnae3.h | 2 + + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 21 ++++++++++ + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 1 + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 11 ++++- + drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 28 ++++++++++++-- + drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 1 + 6 files changed, 58 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h +@@ -32,6 +32,8 @@ + + #define HNAE3_MOD_VERSION "1.0" + ++#define HNAE3_MIN_VECTOR_NUM 2 /* first one for misc, another for IO */ ++ + /* Device IDs */ + #define HNAE3_DEV_ID_GE 0xA220 + #define HNAE3_DEV_ID_25GE 0xA221 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -804,6 +804,9 @@ static int hclge_query_pf_resource(struc + hnae3_get_field(__le16_to_cpu(req->pf_intr_vector_number), + HCLGE_PF_VEC_NUM_M, HCLGE_PF_VEC_NUM_S); + ++ /* nic's msix numbers is always equals to the roce's. */ ++ hdev->num_nic_msi = hdev->num_roce_msi; ++ + /* PF should have NIC vectors and Roce vectors, + * NIC vectors are queued before Roce vectors. + */ +@@ -813,6 +816,15 @@ static int hclge_query_pf_resource(struc + hdev->num_msi = + hnae3_get_field(__le16_to_cpu(req->pf_intr_vector_number), + HCLGE_PF_VEC_NUM_M, HCLGE_PF_VEC_NUM_S); ++ ++ hdev->num_nic_msi = hdev->num_msi; ++ } ++ ++ if (hdev->num_nic_msi < HNAE3_MIN_VECTOR_NUM) { ++ dev_err(&hdev->pdev->dev, ++ "Just %u msi resources, not enough for pf(min:2).\n", ++ hdev->num_nic_msi); ++ return -EINVAL; + } + + return 0; +@@ -1395,6 +1407,10 @@ static int hclge_assign_tqp(struct hclg + kinfo->rss_size = min_t(u16, hdev->rss_size_max, + vport->alloc_tqps / hdev->tm_info.num_tc); + ++ /* ensure one to one mapping between irq and queue at default */ ++ kinfo->rss_size = min_t(u16, kinfo->rss_size, ++ (hdev->num_nic_msi - 1) / hdev->tm_info.num_tc); ++ + return 0; + } + +@@ -2173,7 +2189,8 @@ static int hclge_init_msi(struct hclge_d + int vectors; + int i; + +- vectors = pci_alloc_irq_vectors(pdev, 1, hdev->num_msi, ++ vectors = pci_alloc_irq_vectors(pdev, HNAE3_MIN_VECTOR_NUM, ++ hdev->num_msi, + PCI_IRQ_MSI | PCI_IRQ_MSIX); + if (vectors < 0) { + dev_err(&pdev->dev, +@@ -2188,6 +2205,7 @@ static int hclge_init_msi(struct hclge_d + + hdev->num_msi = vectors; + hdev->num_msi_left = vectors; ++ + hdev->base_msi_vector = pdev->irq; + hdev->roce_base_vector = hdev->base_msi_vector + + hdev->roce_base_msix_offset; +@@ -3692,6 +3710,7 @@ static int hclge_get_vector(struct hnae3 + int alloc = 0; + int i, j; + ++ vector_num = min_t(u16, hdev->num_nic_msi - 1, vector_num); + vector_num = min(hdev->num_msi_left, vector_num); + + for (j = 0; j < vector_num; j++) { +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h +@@ -795,6 +795,7 @@ struct hclge_dev { + u32 base_msi_vector; + u16 *vector_status; + int *vector_irq; ++ u16 num_nic_msi; /* Num of nic vectors for this PF */ + u16 num_roce_msi; /* Num of roce vectors for this PF */ + int roce_base_vector; + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +@@ -537,9 +537,16 @@ static void hclge_tm_vport_tc_info_updat + kinfo->rss_size = kinfo->req_rss_size; + } else if (kinfo->rss_size > max_rss_size || + (!kinfo->req_rss_size && kinfo->rss_size < max_rss_size)) { ++ /* if user not set rss, the rss_size should compare with the ++ * valid msi numbers to ensure one to one map between tqp and ++ * irq as default. ++ */ ++ if (!kinfo->req_rss_size) ++ max_rss_size = min_t(u16, max_rss_size, ++ (hdev->num_nic_msi - 1) / ++ kinfo->num_tc); ++ + /* Set to the maximum specification value (max_rss_size). */ +- dev_info(&hdev->pdev->dev, "rss changes from %d to %d\n", +- kinfo->rss_size, max_rss_size); + kinfo->rss_size = max_rss_size; + } + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -411,6 +411,13 @@ static int hclgevf_knic_setup(struct hcl + kinfo->tqp[i] = &hdev->htqp[i].q; + } + ++ /* after init the max rss_size and tqps, adjust the default tqp numbers ++ * and rss size with the actual vector numbers ++ */ ++ kinfo->num_tqps = min_t(u16, hdev->num_nic_msix - 1, kinfo->num_tqps); ++ kinfo->rss_size = min_t(u16, kinfo->num_tqps / kinfo->num_tc, ++ kinfo->rss_size); ++ + return 0; + } + +@@ -502,6 +509,7 @@ static int hclgevf_get_vector(struct hna + int alloc = 0; + int i, j; + ++ vector_num = min_t(u16, hdev->num_nic_msix - 1, vector_num); + vector_num = min(hdev->num_msi_left, vector_num); + + for (j = 0; j < vector_num; j++) { +@@ -2247,13 +2255,14 @@ static int hclgevf_init_msi(struct hclge + int vectors; + int i; + +- if (hnae3_get_bit(hdev->ae_dev->flag, HNAE3_DEV_SUPPORT_ROCE_B)) ++ if (hnae3_dev_roce_supported(hdev)) + vectors = pci_alloc_irq_vectors(pdev, + hdev->roce_base_msix_offset + 1, + hdev->num_msi, + PCI_IRQ_MSIX); + else +- vectors = pci_alloc_irq_vectors(pdev, 1, hdev->num_msi, ++ vectors = pci_alloc_irq_vectors(pdev, HNAE3_MIN_VECTOR_NUM, ++ hdev->num_msi, + PCI_IRQ_MSI | PCI_IRQ_MSIX); + + if (vectors < 0) { +@@ -2269,6 +2278,7 @@ static int hclgevf_init_msi(struct hclge + + hdev->num_msi = vectors; + hdev->num_msi_left = vectors; ++ + hdev->base_msi_vector = pdev->irq; + hdev->roce_base_vector = pdev->irq + hdev->roce_base_msix_offset; + +@@ -2534,7 +2544,7 @@ static int hclgevf_query_vf_resource(str + + req = (struct hclgevf_query_res_cmd *)desc.data; + +- if (hnae3_get_bit(hdev->ae_dev->flag, HNAE3_DEV_SUPPORT_ROCE_B)) { ++ if (hnae3_dev_roce_supported(hdev)) { + hdev->roce_base_msix_offset = + hnae3_get_field(__le16_to_cpu(req->msixcap_localid_ba_rocee), + HCLGEVF_MSIX_OFT_ROCEE_M, +@@ -2543,6 +2553,9 @@ static int hclgevf_query_vf_resource(str + hnae3_get_field(__le16_to_cpu(req->vf_intr_vector_number), + HCLGEVF_VEC_NUM_M, HCLGEVF_VEC_NUM_S); + ++ /* nic's msix numbers is always equals to the roce's. */ ++ hdev->num_nic_msix = hdev->num_roce_msix; ++ + /* VF should have NIC vectors and Roce vectors, NIC vectors + * are queued before Roce vectors. The offset is fixed to 64. + */ +@@ -2552,6 +2565,15 @@ static int hclgevf_query_vf_resource(str + hdev->num_msi = + hnae3_get_field(__le16_to_cpu(req->vf_intr_vector_number), + HCLGEVF_VEC_NUM_M, HCLGEVF_VEC_NUM_S); ++ ++ hdev->num_nic_msix = hdev->num_msi; ++ } ++ ++ if (hdev->num_nic_msix < HNAE3_MIN_VECTOR_NUM) { ++ dev_err(&hdev->pdev->dev, ++ "Just %u msi resources, not enough for vf(min:2).\n", ++ hdev->num_nic_msix); ++ return -EINVAL; + } + + return 0; +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h +@@ -270,6 +270,7 @@ struct hclgevf_dev { + u16 num_msi; + u16 num_msi_left; + u16 num_msi_used; ++ u16 num_nic_msix; /* Num of nic vectors for this VF */ + u16 num_roce_msix; /* Num of roce vectors for this VF */ + u16 roce_base_msix_offset; + int roce_base_vector; diff --git a/patches.suse/net-hns3-fix-shaper-parameter-algorithm.patch b/patches.suse/net-hns3-fix-shaper-parameter-algorithm.patch new file mode 100644 index 0000000..bf37a00 --- /dev/null +++ b/patches.suse/net-hns3-fix-shaper-parameter-algorithm.patch @@ -0,0 +1,58 @@ +From: Yonglong Liu +Date: Wed, 11 Sep 2019 10:40:35 +0800 +Subject: net: hns3: fix shaper parameter algorithm +Patch-mainline: v5.4-rc1 +Git-commit: 1a92497dc3f90280aebfea8044741d75438110e0 +References: bsc#1104353 FATE#326415 + +Currently when hns3 driver configures the tm shaper to limit +bandwidth below 20Mbit using the parameters calculated by +hclge_shaper_para_calc(), the actual bandwidth limited by tm +hardware module is not accurate enough, for example, 1.28 Mbit +when the user is configuring 1 Mbit. + +This patch adjusts the ir_calc to be closer to ir, and +always calculate the ir_b parameter when user is configuring +a small bandwidth. Also, removes an unnecessary parenthesis +when calculating denominator. + +Fixes: 848440544b41 ("net: hns3: Add support of TX Scheduler & Shaper to HNS3 driver") +Signed-off-by: Yonglong Liu +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +@@ -81,16 +81,13 @@ static int hclge_shaper_para_calc(u32 ir + return 0; + } else if (ir_calc > ir) { + /* Increasing the denominator to select ir_s value */ +- while (ir_calc > ir) { ++ while (ir_calc >= ir && ir) { + ir_s_calc++; + ir_calc = DIVISOR_IR_B_126 / (tick * (1 << ir_s_calc)); + } + +- if (ir_calc == ir) +- *ir_b = 126; +- else +- *ir_b = (ir * tick * (1 << ir_s_calc) + +- (DIVISOR_CLK >> 1)) / DIVISOR_CLK; ++ *ir_b = (ir * tick * (1 << ir_s_calc) + (DIVISOR_CLK >> 1)) / ++ DIVISOR_CLK; + } else { + /* Increasing the numerator to select ir_u value */ + u32 numerator; +@@ -104,7 +101,7 @@ static int hclge_shaper_para_calc(u32 ir + if (ir_calc == ir) { + *ir_b = 126; + } else { +- u32 denominator = (DIVISOR_CLK * (1 << --ir_u_calc)); ++ u32 denominator = DIVISOR_CLK * (1 << --ir_u_calc); + *ir_b = (ir * tick + (denominator >> 1)) / denominator; + } + } diff --git a/patches.suse/net-hns3-fix-the-number-of-queues-actually-used-by-A.patch b/patches.suse/net-hns3-fix-the-number-of-queues-actually-used-by-A.patch new file mode 100644 index 0000000..19214d1 --- /dev/null +++ b/patches.suse/net-hns3-fix-the-number-of-queues-actually-used-by-A.patch @@ -0,0 +1,32 @@ +From: Yufeng Mo +Date: Tue, 5 Jan 2021 11:37:27 +0800 +Subject: net: hns3: fix the number of queues actually used by ARQ +Patch-mainline: v5.11-rc3 +Git-commit: 65e61e3c2a619c4d4b873885b2d5394025ed117b +References: bsc#1104353 FATE#326415 + +HCLGE_MBX_MAX_ARQ_MSG_NUM is used to apply memory for the number +of queues used by ARQ(Asynchronous Receive Queue), so the head +and tail pointers should also use this macro. + +Fixes: 07a0556a3a73 ("net: hns3: Changes to support ARQ(Asynchronous Receive Queue)") +Signed-off-by: Yufeng Mo +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h +@@ -121,7 +121,7 @@ struct hclgevf_mbx_arq_ring { + #define hclge_mbx_ring_ptr_move_crq(crq) \ + (crq->next_to_use = (crq->next_to_use + 1) % crq->desc_num) + #define hclge_mbx_tail_ptr_move_arq(arq) \ +- (arq.tail = (arq.tail + 1) % HCLGE_MBX_MAX_ARQ_MSG_SIZE) ++ (arq.tail = (arq.tail + 1) % HCLGE_MBX_MAX_ARQ_MSG_NUM) + #define hclge_mbx_head_ptr_move_arq(arq) \ +- (arq.head = (arq.head + 1) % HCLGE_MBX_MAX_ARQ_MSG_SIZE) ++ (arq.head = (arq.head + 1) % HCLGE_MBX_MAX_ARQ_MSG_NUM) + #endif diff --git a/patches.suse/net-hns3-fix-use-after-free-when-doing-self-test.patch b/patches.suse/net-hns3-fix-use-after-free-when-doing-self-test.patch new file mode 100644 index 0000000..4ae1517 --- /dev/null +++ b/patches.suse/net-hns3-fix-use-after-free-when-doing-self-test.patch @@ -0,0 +1,78 @@ +From: Yonglong Liu +Date: Mon, 6 Jul 2020 19:26:02 +0800 +Subject: net: hns3: fix use-after-free when doing self test +Patch-mainline: v5.8-rc5 +Git-commit: a06656211304fec653c1931c2ca6d644013b5bbb +References: bsc#1104353 FATE#326415 + +Enable promisc mode of PF, set VF link state to enable, and +run iperf of the VF, then do self test of the PF. The self test +will fail with a low frequency, and may cause a use-after-free +problem. + +[ 87.142126] selftest:000004a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ +[ 87.159722] ================================================================== +[ 87.174187] BUG: KASAN: use-after-free in hex_dump_to_buffer+0x140/0x608 +[ 87.187600] Read of size 1 at addr ffff003b22828000 by task ethtool/1186 +[ 87.201012] +[ 87.203978] CPU: 7 PID: 1186 Comm: ethtool Not tainted 5.5.0-rc4-gfd51c473-dirty #4 +[ 87.219306] Hardware name: Huawei TaiShan 2280 V2/BC82AMDA, BIOS TA BIOS 2280-A CS V2.B160.01 01/15/2020 +[ 87.238292] Call trace: +[ 87.243173] dump_backtrace+0x0/0x280 +[ 87.250491] show_stack+0x24/0x30 +[ 87.257114] dump_stack+0xe8/0x140 +[ 87.263911] print_address_description.isra.8+0x70/0x380 +[ 87.274538] __kasan_report+0x12c/0x230 +[ 87.282203] kasan_report+0xc/0x18 +[ 87.288999] __asan_load1+0x60/0x68 +[ 87.295969] hex_dump_to_buffer+0x140/0x608 +[ 87.304332] print_hex_dump+0x140/0x1e0 +[ 87.312000] hns3_lb_check_skb_data+0x168/0x170 +[ 87.321060] hns3_clean_rx_ring+0xa94/0xfe0 +[ 87.329422] hns3_self_test+0x708/0x8c0 + +The length of packet sent by the selftest process is only +128 + 14 bytes, and the min buffer size of a BD is 256 bytes, +and the receive process will make sure the packet sent by +the selftest process is in the linear part, so only check +the linear part in hns3_lb_check_skb_data(). + +So fix this use-after-free by using skb_headlen() to dump +skb->data instead of skb->len. + +Fixes: c39c4d98dc65 ("net: hns3: Add mac loopback selftest support in hns3 driver") +Signed-off-by: Yonglong Liu +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c +@@ -169,18 +169,21 @@ static void hns3_lb_check_skb_data(struc + { + struct hns3_enet_tqp_vector *tqp_vector = ring->tqp_vector; + unsigned char *packet = skb->data; ++ u32 len = skb_headlen(skb); + u32 i; + +- for (i = 0; i < skb->len; i++) ++ len = min_t(u32, len, HNS3_NIC_LB_TEST_PACKET_SIZE); ++ ++ for (i = 0; i < len; i++) + if (packet[i] != (unsigned char)(i & 0xff)) + break; + + /* The packet is correctly received */ +- if (i == skb->len) ++ if (i == HNS3_NIC_LB_TEST_PACKET_SIZE) + tqp_vector->rx_group.total_packets++; + else + print_hex_dump(KERN_ERR, "selftest:", DUMP_PREFIX_OFFSET, 16, 1, +- skb->data, skb->len, true); ++ skb->data, len, true); + + dev_kfree_skb_any(skb); + } diff --git a/patches.suse/net-hns3-reallocate-SSU-buffer-size-when-pfc_en-chan.patch b/patches.suse/net-hns3-reallocate-SSU-buffer-size-when-pfc_en-chan.patch new file mode 100644 index 0000000..f3a4c62 --- /dev/null +++ b/patches.suse/net-hns3-reallocate-SSU-buffer-size-when-pfc_en-chan.patch @@ -0,0 +1,56 @@ +From: Yunsheng Lin +Date: Thu, 14 Nov 2019 10:32:40 +0800 +Subject: net: hns3: reallocate SSU' buffer size when pfc_en changes +Patch-mainline: v5.4-rc8 +Git-commit: aea8cfb35a82d6c2f3517c86694933ba766635e5 +References: bsc#1104353 FATE#326415 + +When a TC's PFC is disabled or enabled, the RX private buffer for +this TC need to be changed too, otherwise this may cause packet +dropped problem. + +This patch fixes it by calling hclge_buffer_alloc to reallocate +buffer when pfc_en changes. + +Fixes: cacde272dd00 ("net: hns3: Add hclge_dcb module for the support of DCB feature") +Signed-off-by: Yunsheng Lin +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +@@ -302,6 +302,7 @@ static int hclge_ieee_setpfc(struct hnae + struct hclge_vport *vport = hclge_get_vport(h); + struct hclge_dev *hdev = vport->back; + u8 i, j, pfc_map, *prio_tc; ++ int ret; + + if (!(hdev->dcbx_cap & DCB_CAP_DCBX_VER_IEEE) || + hdev->flag & HCLGE_FLAG_MQPRIO_ENABLE) +@@ -327,7 +328,21 @@ static int hclge_ieee_setpfc(struct hnae + + hclge_tm_pfc_info_update(hdev); + +- return hclge_pause_setup_hw(hdev, false); ++ ret = hclge_pause_setup_hw(hdev, false); ++ if (ret) ++ return ret; ++ ++ ret = hclge_notify_client(hdev, HNAE3_DOWN_CLIENT); ++ if (ret) ++ return ret; ++ ++ ret = hclge_buffer_alloc(hdev); ++ if (ret) { ++ hclge_notify_client(hdev, HNAE3_UP_CLIENT); ++ return ret; ++ } ++ ++ return hclge_notify_client(hdev, HNAE3_UP_CLIENT); + } + + /* DCBX configuration */ diff --git a/patches.suse/net-mlx4_en-Avoid-scheduling-restart-task-if-it-is-a.patch b/patches.suse/net-mlx4_en-Avoid-scheduling-restart-task-if-it-is-a.patch new file mode 100644 index 0000000..65a2024 --- /dev/null +++ b/patches.suse/net-mlx4_en-Avoid-scheduling-restart-task-if-it-is-a.patch @@ -0,0 +1,122 @@ +From: Moshe Shemesh +Date: Wed, 9 Dec 2020 15:03:38 +0200 +Subject: net/mlx4_en: Avoid scheduling restart task if it is already running +Patch-mainline: v5.10 +Git-commit: fed91613c9dd455dd154b22fa8e11b8526466082 +References: git-fixes + +Add restarting state flag to avoid scheduling another restart task while +such task is already running. Change task name from watchdog_task to +restart_task to better fit the task role. + +Fixes: 1e338db56e5a ("mlx4_en: Fix a race at restart task") +Signed-off-by: Moshe Shemesh +Signed-off-by: Tariq Toukan +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 20 +++++++++++++------- + drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 7 ++++++- + 2 files changed, 19 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -1383,8 +1383,10 @@ static void mlx4_en_tx_timeout(struct ne + } + + priv->port_stats.tx_timeout++; +- en_dbg(DRV, priv, "Scheduling watchdog\n"); +- queue_work(mdev->workqueue, &priv->watchdog_task); ++ if (!test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state)) { ++ en_dbg(DRV, priv, "Scheduling port restart\n"); ++ queue_work(mdev->workqueue, &priv->restart_task); ++ } + } + + +@@ -1834,6 +1836,7 @@ int mlx4_en_start_port(struct net_device + local_bh_enable(); + } + ++ clear_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state); + netif_tx_start_all_queues(dev); + netif_device_attach(dev); + +@@ -2004,7 +2007,7 @@ void mlx4_en_stop_port(struct net_device + static void mlx4_en_restart(struct work_struct *work) + { + struct mlx4_en_priv *priv = container_of(work, struct mlx4_en_priv, +- watchdog_task); ++ restart_task); + struct mlx4_en_dev *mdev = priv->mdev; + struct net_device *dev = priv->dev; + +@@ -2384,7 +2387,7 @@ static int mlx4_en_change_mtu(struct net + if (netif_running(dev)) { + mutex_lock(&mdev->state_lock); + if (!mdev->device_up) { +- /* NIC is probably restarting - let watchdog task reset ++ /* NIC is probably restarting - let restart task reset + * the port */ + en_dbg(DRV, priv, "Change MTU called with card down!?\n"); + } else { +@@ -2393,7 +2396,9 @@ static int mlx4_en_change_mtu(struct net + if (err) { + en_err(priv, "Failed restarting port:%d\n", + priv->port); +- queue_work(mdev->workqueue, &priv->watchdog_task); ++ if (!test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING, ++ &priv->state)) ++ queue_work(mdev->workqueue, &priv->restart_task); + } + } + mutex_unlock(&mdev->state_lock); +@@ -2879,7 +2884,8 @@ static int mlx4_xdp_set(struct net_devic + if (err) { + en_err(priv, "Failed starting port %d for XDP change\n", + priv->port); +- queue_work(mdev->workqueue, &priv->watchdog_task); ++ if (!test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state)) ++ queue_work(mdev->workqueue, &priv->restart_task); + } + } + +@@ -3277,7 +3283,7 @@ int mlx4_en_init_netdev(struct mlx4_en_d + priv->counter_index = MLX4_SINK_COUNTER_INDEX(mdev->dev); + spin_lock_init(&priv->stats_lock); + INIT_WORK(&priv->rx_mode_task, mlx4_en_do_set_rx_mode); +- INIT_WORK(&priv->watchdog_task, mlx4_en_restart); ++ INIT_WORK(&priv->restart_task, mlx4_en_restart); + INIT_WORK(&priv->linkstate_task, mlx4_en_linkstate); + INIT_DELAYED_WORK(&priv->stats_task, mlx4_en_do_get_stats); + INIT_DELAYED_WORK(&priv->service_task, mlx4_en_service_task); +--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h ++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h +@@ -530,6 +530,10 @@ struct mlx4_en_stats_bitmap { + struct mutex mutex; /* for mutual access to stats bitmap */ + }; + ++enum { ++ MLX4_EN_STATE_FLAG_RESTARTING, ++}; ++ + struct mlx4_en_priv { + struct mlx4_en_dev *mdev; + struct mlx4_en_port_profile *prof; +@@ -595,7 +599,7 @@ struct mlx4_en_priv { + struct mlx4_en_cq *rx_cq[MAX_RX_RINGS]; + struct mlx4_qp drop_qp; + struct work_struct rx_mode_task; +- struct work_struct watchdog_task; ++ struct work_struct restart_task; + struct work_struct linkstate_task; + struct delayed_work stats_task; + struct delayed_work service_task; +@@ -643,6 +647,7 @@ struct mlx4_en_priv { + u32 pflags; + u8 rss_key[MLX4_EN_RSS_KEY_SIZE]; + u8 rss_hash_fn; ++ unsigned long state; + }; + + enum mlx4_en_wol { diff --git a/patches.suse/net-mlx5-Add-handling-of-port-type-in-rule-deletion.patch b/patches.suse/net-mlx5-Add-handling-of-port-type-in-rule-deletion.patch new file mode 100644 index 0000000..8b8b77a --- /dev/null +++ b/patches.suse/net-mlx5-Add-handling-of-port-type-in-rule-deletion.patch @@ -0,0 +1,110 @@ +From: Michael Guralnik +Date: Mon, 2 Nov 2020 17:34:44 +0200 +Subject: net/mlx5: Add handling of port type in rule deletion +Patch-mainline: v5.10-rc5 +Git-commit: 8cbcc5ef2a281f6bb10099f4572a08cb765ffbf4 +References: bsc#1103991 FATE#326007 + +Handle destruction of rules with port destination type to enable +full destruction of flow. + +Without this handling of TX rules the deletion of these rules fails. +Dmesg of flow destruction failure: + +[ 203.714146] mlx5_core 0000:00:0b.0: mlx5_cmd_check:753:(pid 342): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad parameter(0x3), syndrome (0x144b7a) +[ 210.547387] ------------[ cut here ]------------ +[ 210.548663] refcount_t: decrement hit 0; leaking memory. +[ 210.550651] WARNING: CPU: 4 PID: 342 at lib/refcount.c:31 refcount_warn_saturate+0x5c/0x110 +[ 210.550654] Modules linked in: mlx5_ib mlx5_core ib_ipoib rdma_ucm rdma_cm iw_cm ib_cm ib_umad ib_uverbs ib_core +[ 210.550675] CPU: 4 PID: 342 Comm: test Not tainted 5.8.0-rc2+ #116 +[ 210.550678] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 +[ 210.550680] RIP: 0010:refcount_warn_saturate+0x5c/0x110 +[ 210.550685] Code: c6 d1 1b 01 00 0f 84 ad 00 00 00 5b 5d c3 80 3d b5 d1 1b 01 00 75 f4 48 c7 c7 20 d1 15 82 c6 05 a5 d1 1b 01 01 e8 a7 eb af ff <0f> 0b eb dd 80 3d 99 d1 1b 01 00 75 d4 48 c7 c7 c0 cf 15 82 c6 05 +[ 210.550687] RSP: 0018:ffff8881642e77e8 EFLAGS: 00010282 +[ 210.550691] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000000000 +[ 210.550694] RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffffed102c85ceef +[ 210.550696] RBP: ffff888161720428 R08: ffffffff8124c10e R09: ffffed103243beae +[ 210.550698] R10: ffff8881921df56b R11: ffffed103243bead R12: ffff8881841b4180 +[ 210.550701] R13: ffff888161720428 R14: ffff8881616d0000 R15: ffff888161720380 +[ 210.550704] FS: 00007fc27f025740(0000) GS:ffff888192000000(0000) knlGS:0000000000000000 +[ 210.550706] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 210.550708] CR2: 0000557e4b41a6a0 CR3: 0000000002415004 CR4: 0000000000360ea0 +[ 210.550711] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 210.550713] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 210.550715] Call Trace: +[ 210.550717] mlx5_del_flow_rules+0x484/0x490 [mlx5_core] +[ 210.550720] ? mlx5_cmd_set_fte+0xa80/0xa80 [mlx5_core] +[ 210.550722] mlx5_ib_destroy_flow+0x17f/0x280 [mlx5_ib] +[ 210.550724] uverbs_free_flow+0x4c/0x90 [ib_uverbs] +[ 210.550726] destroy_hw_idr_uobject+0x41/0xb0 [ib_uverbs] +[ 210.550728] uverbs_destroy_uobject+0xaa/0x390 [ib_uverbs] +[ 210.550731] __uverbs_cleanup_ufile+0x129/0x1b0 [ib_uverbs] +[ 210.550733] ? uverbs_destroy_uobject+0x390/0x390 [ib_uverbs] +[ 210.550735] uverbs_destroy_ufile_hw+0x78/0x190 [ib_uverbs] +[ 210.550737] ib_uverbs_close+0x36/0x140 [ib_uverbs] +[ 210.550739] __fput+0x181/0x380 +[ 210.550741] task_work_run+0x88/0xd0 +[ 210.550743] do_exit+0x5f6/0x13b0 +[ 210.550745] ? sched_clock_cpu+0x30/0x140 +[ 210.550747] ? is_current_pgrp_orphaned+0x70/0x70 +[ 210.550750] ? lock_downgrade+0x360/0x360 +[ 210.550752] ? mark_held_locks+0x1d/0x90 +[ 210.550754] do_group_exit+0x8a/0x140 +[ 210.550756] get_signal+0x20a/0xf50 +[ 210.550758] do_signal+0x8c/0xbe0 +[ 210.550760] ? hrtimer_nanosleep+0x1d8/0x200 +[ 210.550762] ? nanosleep_copyout+0x50/0x50 +[ 210.550764] ? restore_sigcontext+0x320/0x320 +[ 210.550766] ? __hrtimer_init+0xf0/0xf0 +[ 210.550768] ? timespec64_add_safe+0x150/0x150 +[ 210.550770] ? mark_held_locks+0x1d/0x90 +[ 210.550772] ? lockdep_hardirqs_on_prepare+0x14c/0x240 +[ 210.550774] __prepare_exit_to_usermode+0x119/0x170 +[ 210.550776] do_syscall_64+0x65/0x300 +[ 210.550778] ? trace_hardirqs_off+0x10/0x120 +[ 210.550781] ? mark_held_locks+0x1d/0x90 +[ 210.550783] ? asm_sysvec_apic_timer_interrupt+0xa/0x20 +[ 210.550785] ? lockdep_hardirqs_on+0x112/0x190 +[ 210.550787] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +[ 210.550789] RIP: 0033:0x7fc27f1cd157 +[ 210.550791] Code: Bad RIP value. +[ 210.550793] RSP: 002b:00007ffd4db27ea8 EFLAGS: 00000246 ORIG_RAX: 0000000000000023 +[ 210.550798] RAX: fffffffffffffdfc RBX: ffffffffffffff80 RCX: 00007fc27f1cd157 +[ 210.550800] RDX: 00007fc27f025740 RSI: 00007ffd4db27eb0 RDI: 00007ffd4db27eb0 +[ 210.550803] RBP: 0000000000000016 R08: 0000000000000000 R09: 000000000000000e +[ 210.550805] R10: 00007ffd4db27dc7 R11: 0000000000000246 R12: 0000000000400c00 +[ 210.550808] R13: 00007ffd4db285f0 R14: 0000000000000000 R15: 0000000000000000 +[ 210.550809] irq event stamp: 49399 +[ 210.550812] hardirqs last enabled at (49399): [] console_unlock+0x556/0x6f0 +[ 210.550815] hardirqs last disabled at (49398): [] console_unlock+0xb7/0x6f0 +[ 210.550818] softirqs last enabled at (48706): [] __do_softirq+0x37b/0x60c +[ 210.550820] softirqs last disabled at (48697): [] asm_call_on_stack+0xf/0x20 +[ 210.550822] ---[ end trace ad18c0e6fa846454 ]--- +[ 210.581862] mlx5_core 0000:00:0c.0: mlx5_destroy_flow_table:2132:(pid 342): Flow table 262150 wasn't destroyed, refcount > 1 + +Fixes: a7ee18bdee83 ("RDMA/mlx5: Allow creating a matcher for a NIC TX flow table") +Signed-off-by: Michael Guralnik +Reviewed-by: Mark Bloch +Reviewed-by: Maor Gottlieb +Signed-off-by: Saeed Mahameed +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +@@ -450,6 +450,13 @@ static void del_sw_hw_rule(struct fs_nod + goto out; + } + ++ if (rule->dest_attr.type == MLX5_FLOW_DESTINATION_TYPE_PORT && ++ --fte->dests_size) { ++ modify_mask |= BIT(MLX5_SET_FTE_MODIFY_ENABLE_MASK_ACTION); ++ fte->action.action &= ~MLX5_FLOW_CONTEXT_ACTION_ALLOW; ++ goto out; ++ } ++ + if ((fte->action.action & MLX5_FLOW_CONTEXT_ACTION_FWD_DEST) && + --fte->dests_size) { + modify_mask = BIT(MLX5_SET_FTE_MODIFY_ENABLE_MASK_DESTINATION_LIST); diff --git a/patches.suse/net-mlx5-Fix-memory-leak-on-flow-table-creation-erro.patch b/patches.suse/net-mlx5-Fix-memory-leak-on-flow-table-creation-erro.patch new file mode 100644 index 0000000..bfbf2dc --- /dev/null +++ b/patches.suse/net-mlx5-Fix-memory-leak-on-flow-table-creation-erro.patch @@ -0,0 +1,29 @@ +From: Roi Dayan +Date: Tue, 12 Jan 2021 14:04:29 +0200 +Subject: net/mlx5: Fix memory leak on flow table creation error flow +Git-commit: 487c6ef81eb98d0a43cb08be91b1fcc9b4250626 +Patch-mainline: v5.11-rc6 +References: bsc#1046305 FATE#322943 + +When we create the ft object we also init rhltable in ft->fgs_hash. +So in error flow before kfree of ft we need to destroy that rhltable. + +Fixes: 693c6883bbc4 ("net/mlx5: Add hash table for flow groups in flow table") +Signed-off-by: Roi Dayan +Reviewed-by: Maor Dickman +Signed-off-by: Saeed Mahameed +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +@@ -1030,6 +1030,7 @@ static struct mlx5_flow_table *__mlx5_cr + destroy_ft: + root->cmds->destroy_flow_table(root->dev, ft); + free_ft: ++ rhltable_destroy(&ft->fgs_hash); + kfree(ft); + unlock_root: + mutex_unlock(&root->chain_lock); diff --git a/patches.suse/net-mlx5e-Fix-VLAN-cleanup-flow.patch b/patches.suse/net-mlx5e-Fix-VLAN-cleanup-flow.patch new file mode 100644 index 0000000..602a394 --- /dev/null +++ b/patches.suse/net-mlx5e-Fix-VLAN-cleanup-flow.patch @@ -0,0 +1,75 @@ +From: Aya Levin +Date: Sun, 13 Sep 2020 17:57:23 +0300 +Subject: net/mlx5e: Fix VLAN cleanup flow +Patch-mainline: v5.9 +Git-commit: 8c7353b6f716436ad0bfda2b5c5524ab2dde5894 +References: git-fixes + +Prior to this patch unloading an interface in promiscuous mode with RX +VLAN filtering feature turned off - resulted in a warning. This is due +to a wrong condition in the VLAN rules cleanup flow, which left the +any-vid rules in the VLAN steering table. These rules prevented +destroying the flow group and the flow table. + +The any-vid rules are removed in 2 flows, but none of them remove it in +case both promiscuous is set and VLAN filtering is off. Fix the issue by +changing the condition of the VLAN table cleanup flow to clean also in +case of promiscuous mode. + +mlx5_core 0000:00:08.0: mlx5_destroy_flow_group:2123:(pid 28729): Flow group 20 wasn't destroyed, refcount > 1 +mlx5_core 0000:00:08.0: mlx5_destroy_flow_group:2123:(pid 28729): Flow group 19 wasn't destroyed, refcount > 1 +mlx5_core 0000:00:08.0: mlx5_destroy_flow_table:2112:(pid 28729): Flow table 262149 wasn't destroyed, refcount > 1 +... +... +------------[ cut here ]------------ +FW pages counter is 11560 after reclaiming all pages +WARNING: CPU: 1 PID: 28729 at +drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c:660 +mlx5_reclaim_startup_pages+0x178/0x230 [mlx5_core] +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS +rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 +Call Trace: + mlx5_function_teardown+0x2f/0x90 [mlx5_core] + mlx5_unload_one+0x71/0x110 [mlx5_core] + remove_one+0x44/0x80 [mlx5_core] + pci_device_remove+0x3e/0xc0 + device_release_driver_internal+0xfb/0x1c0 + device_release_driver+0x12/0x20 + pci_stop_bus_device+0x68/0x90 + pci_stop_and_remove_bus_device+0x12/0x20 + hv_eject_device_work+0x6f/0x170 [pci_hyperv] + ? __schedule+0x349/0x790 + process_one_work+0x206/0x400 + worker_thread+0x34/0x3f0 + ? process_one_work+0x400/0x400 + kthread+0x126/0x140 + ? kthread_park+0x90/0x90 + ret_from_fork+0x22/0x30 + ---[ end trace 6283bde8d26170dc ]--- + +Fixes: 9df30601c843 ("net/mlx5e: Restore vlan filter after seamless reset") +Signed-off-by: Aya Levin +Reviewed-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c +@@ -415,8 +415,12 @@ static void mlx5e_del_vlan_rules(struct + for_each_set_bit(i, priv->fs.vlan.active_svlans, VLAN_N_VID) + mlx5e_del_vlan_rule(priv, MLX5E_VLAN_RULE_TYPE_MATCH_STAG_VID, i); + +- if (priv->fs.vlan.cvlan_filter_disabled && +- !(priv->netdev->flags & IFF_PROMISC)) ++ WARN_ON_ONCE(!(test_bit(MLX5E_STATE_DESTROYING, &priv->state))); ++ ++ /* must be called after DESTROY bit is set and ++ * set_rx_mode is called and flushed ++ */ ++ if (priv->fs.vlan.cvlan_filter_disabled) + mlx5e_del_any_vid_rules(priv); + } + diff --git a/patches.suse/net-mlx5e-Fix-VLAN-create-flow.patch b/patches.suse/net-mlx5e-Fix-VLAN-create-flow.patch new file mode 100644 index 0000000..bfff0c0 --- /dev/null +++ b/patches.suse/net-mlx5e-Fix-VLAN-create-flow.patch @@ -0,0 +1,48 @@ +From: Aya Levin +Date: Sun, 13 Sep 2020 18:05:40 +0300 +Subject: net/mlx5e: Fix VLAN create flow +Patch-mainline: v5.9 +Git-commit: d4a16052bccdd695982f89d815ca075825115821 +References: git-fixes + +When interface is attached while in promiscuous mode and with VLAN +filtering turned off, both configurations are not respected and VLAN +filtering is performed. +There are 2 flows which add the any-vid rules during interface attach: +VLAN creation table and set rx mode. Each is relaying on the other to +add any-vid rules, eventually non of them does. + +Fix this by adding any-vid rules on VLAN creation regardless of +promiscuous mode. + +Fixes: 9df30601c843 ("net/mlx5e: Restore vlan filter after seamless reset") +Signed-off-by: Aya Levin +Reviewed-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c +@@ -217,6 +217,9 @@ static int __mlx5e_add_vlan_rule(struct + break; + } + ++ if (WARN_ONCE(*rule_p, "VLAN rule already exists type %d", rule_type)) ++ return 0; ++ + *rule_p = mlx5_add_flow_rules(ft, spec, &flow_act, &dest, 1); + + if (IS_ERR(*rule_p)) { +@@ -397,8 +400,7 @@ static void mlx5e_add_vlan_rules(struct + for_each_set_bit(i, priv->fs.vlan.active_svlans, VLAN_N_VID) + mlx5e_add_vlan_rule(priv, MLX5E_VLAN_RULE_TYPE_MATCH_STAG_VID, i); + +- if (priv->fs.vlan.cvlan_filter_disabled && +- !(priv->netdev->flags & IFF_PROMISC)) ++ if (priv->fs.vlan.cvlan_filter_disabled) + mlx5e_add_any_vid_rules(priv); + } + diff --git a/patches.suse/net-mlx5e-Fix-memleak-in-mlx5e_create_l2_table_group.patch b/patches.suse/net-mlx5e-Fix-memleak-in-mlx5e_create_l2_table_group.patch new file mode 100644 index 0000000..7096ec5 --- /dev/null +++ b/patches.suse/net-mlx5e-Fix-memleak-in-mlx5e_create_l2_table_group.patch @@ -0,0 +1,31 @@ +From: Dinghao Liu +Date: Mon, 21 Dec 2020 19:27:31 +0800 +Subject: net/mlx5e: Fix memleak in mlx5e_create_l2_table_groups +Patch-mainline: v5.11-rc3 +Git-commit: 5b0bb12c58ac7d22e05b5bfdaa30a116c8c32e32 +References: git-fixes + +When mlx5_create_flow_group() fails, ft->g should be +freed just like when kvzalloc() fails. The caller of +mlx5e_create_l2_table_groups() does not catch this +issue on failure, which leads to memleak. + +Fixes: 33cfaaa8f36f ("net/mlx5e: Split the main flow steering table") +Signed-off-by: Dinghao Liu +Reviewed-by: Leon Romanovsky +Signed-off-by: Saeed Mahameed +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c +@@ -1312,6 +1312,7 @@ err_destroy_groups: + ft->g[ft->num_groups] = NULL; + mlx5e_destroy_groups(ft); + kvfree(in); ++ kfree(ft->g); + + return err; + } diff --git a/patches.suse/net-mlx5e-Fix-two-double-free-cases.patch b/patches.suse/net-mlx5e-Fix-two-double-free-cases.patch new file mode 100644 index 0000000..3b4b662 --- /dev/null +++ b/patches.suse/net-mlx5e-Fix-two-double-free-cases.patch @@ -0,0 +1,42 @@ +From: Dinghao Liu +Date: Mon, 28 Dec 2020 16:48:40 +0800 +Subject: net/mlx5e: Fix two double free cases +Patch-mainline: v5.11-rc3 +Git-commit: 7a6eb072a9548492ead086f3e820e9aac71c7138 +References: bsc#1046305 FATE#322943 + +mlx5e_create_ttc_table_groups() frees ft->g on failure of +kvzalloc(), but such failure will be caught by its caller +in mlx5e_create_ttc_table() and ft->g will be freed again +in mlx5e_destroy_flow_table(). The same issue also occurs +in mlx5e_create_ttc_table_groups(). Set ft->g to NULL after +kfree() to avoid double free. + +Fixes: 7b3722fa9ef6 ("net/mlx5e: Support RSS for GRE tunneled packets") +Fixes: 33cfaaa8f36f ("net/mlx5e: Split the main flow steering table") +Signed-off-by: Dinghao Liu +Reviewed-by: Leon Romanovsky +Signed-off-by: Saeed Mahameed +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c +@@ -893,6 +893,7 @@ static int mlx5e_create_ttc_table_groups + in = kvzalloc(inlen, GFP_KERNEL); + if (!in) { + kfree(ft->g); ++ ft->g = NULL; + return -ENOMEM; + } + +@@ -1033,6 +1034,7 @@ static int mlx5e_create_inner_ttc_table_ + in = kvzalloc(inlen, GFP_KERNEL); + if (!in) { + kfree(ft->g); ++ ft->g = NULL; + return -ENOMEM; + } + diff --git a/patches.suse/net-mlx5e-IPoIB-Drop-multicast-packets-that-this-int.patch b/patches.suse/net-mlx5e-IPoIB-Drop-multicast-packets-that-this-int.patch new file mode 100644 index 0000000..d57e141 --- /dev/null +++ b/patches.suse/net-mlx5e-IPoIB-Drop-multicast-packets-that-this-int.patch @@ -0,0 +1,66 @@ +From: Erez Shitrit +Date: Mon, 4 May 2020 11:46:25 +0300 +Subject: net/mlx5e: IPoIB, Drop multicast packets that this interface sent +Patch-mainline: v5.8-rc1 +Git-commit: 8b46d424a743ddfef8056d5167f13ee7ebd1dcad +References: bsc#1075020 + +After enabled loopback packets for IPoIB, we need to drop these packets +that this HCA has replicated and came back to the same interface that +sent them. + +Fixes: 4c6c615e3f30 ("net/mlx5e: IPoIB, Add PKEY child interface nic profile") +Signed-off-by: Erez Shitrit +Reviewed-by: Alex Vesker +Signed-off-by: Saeed Mahameed +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +@@ -1318,6 +1318,7 @@ out: + + #ifdef CONFIG_MLX5_CORE_IPOIB + ++#define MLX5_IB_GRH_SGID_OFFSET 8 + #define MLX5_IB_GRH_DGID_OFFSET 24 + #define MLX5_GID_SIZE 16 + +@@ -1331,6 +1332,7 @@ static inline void mlx5i_complete_rx_cqe + struct net_device *netdev; + struct mlx5e_priv *priv; + char *pseudo_header; ++ u32 flags_rqpn; + u32 qpn; + u8 *dgid; + u8 g; +@@ -1352,7 +1354,8 @@ static inline void mlx5i_complete_rx_cqe + tstamp = &priv->tstamp; + stats = &priv->channel_stats[rq->ix].rq; + +- g = (be32_to_cpu(cqe->flags_rqpn) >> 28) & 3; ++ flags_rqpn = be32_to_cpu(cqe->flags_rqpn); ++ g = (flags_rqpn >> 28) & 3; + dgid = skb->data + MLX5_IB_GRH_DGID_OFFSET; + if ((!g) || dgid[0] != 0xff) + skb->pkt_type = PACKET_HOST; +@@ -1361,9 +1364,15 @@ static inline void mlx5i_complete_rx_cqe + else + skb->pkt_type = PACKET_MULTICAST; + +- /* TODO: IB/ipoib: Allow mcast packets from other VFs +- * 68996a6e760e5c74654723eeb57bf65628ae87f4 ++ /* Drop packets that this interface sent, ie multicast packets ++ * that the HCA has replicated. + */ ++ if (g && (qpn == (flags_rqpn & 0xffffff)) && ++ (memcmp(netdev->dev_addr + 4, skb->data + MLX5_IB_GRH_SGID_OFFSET, ++ MLX5_GID_SIZE) == 0)) { ++ skb->dev = NULL; ++ return; ++ } + + skb_pull(skb, MLX5_IB_GRH_BYTES); + diff --git a/patches.suse/net-mlx5e-TX-Fix-consumer-index-of-error-cqe-dump.patch b/patches.suse/net-mlx5e-TX-Fix-consumer-index-of-error-cqe-dump.patch new file mode 100644 index 0000000..65512de --- /dev/null +++ b/patches.suse/net-mlx5e-TX-Fix-consumer-index-of-error-cqe-dump.patch @@ -0,0 +1,34 @@ +From: Tariq Toukan +Date: Tue, 24 Sep 2019 11:29:09 +0300 +Subject: net/mlx5e: TX, Fix consumer index of error cqe dump +Patch-mainline: v5.4-rc6 +Git-commit: 61ea02d2c13106116c6e4916ac5d9dd41151c959 +References: bsc#1103990 FATE#326006 + +The completion queue consumer index increments upon a call to +mlx5_cqwq_pop(). +When dumping an error CQE, the index is already incremented. +Decrease one for the print command. + +Fixes: 16cc14d81733 ("net/mlx5e: Dump xmit error completions") +Signed-off-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +@@ -462,7 +462,10 @@ netdev_tx_t mlx5e_xmit(struct sk_buff *s + static void mlx5e_dump_error_cqe(struct mlx5e_txqsq *sq, + struct mlx5_err_cqe *err_cqe) + { +- u32 ci = mlx5_cqwq_get_ci(&sq->cq.wq); ++ struct mlx5_cqwq *wq = &sq->cq.wq; ++ u32 ci; ++ ++ ci = mlx5_cqwq_ctr2ix(wq, wq->cc - 1); + + netdev_err(sq->channel->netdev, + "Error cqe on cqn 0x%x, ci 0x%x, sqn 0x%x, syndrome 0x%x, vendor syndrome 0x%x\n", diff --git a/patches.suse/net-mlx5e-fix-bpf_prog-reference-count-leaks-in-mlx5.patch b/patches.suse/net-mlx5e-fix-bpf_prog-reference-count-leaks-in-mlx5.patch new file mode 100644 index 0000000..11cc336 --- /dev/null +++ b/patches.suse/net-mlx5e-fix-bpf_prog-reference-count-leaks-in-mlx5.patch @@ -0,0 +1,48 @@ +From: Xin Xiong +Date: Thu, 30 Jul 2020 18:29:41 +0800 +Subject: net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq +Patch-mainline: v5.8 +Git-commit: e692139e6af339a1495ef401b2d95f7f9d1c7a44 +References: bsc#1103990 FATE#326006 + +The function invokes bpf_prog_inc(), which increases the reference +count of a bpf_prog object "rq->xdp_prog" if the object isn't NULL. + +The refcount leak issues take place in two error handling paths. When +either mlx5_wq_ll_create() or mlx5_wq_cyc_create() fails, the function +simply returns the error code and forgets to drop the reference count +increased earlier, causing a reference count leak of "rq->xdp_prog". + +Fix this issue by jumping to the error handling path err_rq_wq_destroy +while either function fails. + +Fixes: 422d4c401edd ("net/mlx5e: RX, Split WQ objects for different RQ types") +Signed-off-by: Xin Xiong +Signed-off-by: Xiyu Yang +Signed-off-by: Xin Tan +Signed-off-by: Saeed Mahameed +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -529,7 +529,7 @@ static int mlx5e_alloc_rq(struct mlx5e_c + err = mlx5_wq_ll_create(mdev, &rqp->wq, rqc_wq, &rq->mpwqe.wq, + &rq->wq_ctrl); + if (err) +- return err; ++ goto err_rq_wq_destroy; + + rq->mpwqe.wq.db = &rq->mpwqe.wq.db[MLX5_RCV_DBR]; + +@@ -574,7 +574,7 @@ static int mlx5e_alloc_rq(struct mlx5e_c + err = mlx5_wq_cyc_create(mdev, &rqp->wq, rqc_wq, &rq->wqe.wq, + &rq->wq_ctrl); + if (err) +- return err; ++ goto err_rq_wq_destroy; + + rq->wqe.wq.db = &rq->wqe.wq.db[MLX5_RCV_DBR]; + diff --git a/patches.suse/net-mvpp2-Fix-GoP-port-3-Networking-Complex-Control-.patch b/patches.suse/net-mvpp2-Fix-GoP-port-3-Networking-Complex-Control-.patch new file mode 100644 index 0000000..86146f1 --- /dev/null +++ b/patches.suse/net-mvpp2-Fix-GoP-port-3-Networking-Complex-Control-.patch @@ -0,0 +1,32 @@ +From: Stefan Chulski +Date: Sun, 20 Dec 2020 13:02:29 +0200 +Subject: net: mvpp2: Fix GoP port 3 Networking Complex Control configurations +Patch-mainline: v5.11-rc3 +Git-commit: 2575bc1aa9d52a62342b57a0b7d0a12146cf6aed +References: bsc#1098633 + +During GoP port 2 Networking Complex Control mode of operation configurations, +also GoP port 3 mode of operation was wrongly set. +Patch removes these configurations. + +Fixes: f84bf386f395 ("net: mvpp2: initialize the GoP") +Acked-by: Marcin Wojtas +Signed-off-by: Stefan Chulski +Link: https://lore.kernel.org/r/1608462149-1702-1-git-send-email-stefanc@marvell.com +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -978,7 +978,7 @@ static void mvpp22_gop_init_rgmii(struct + + regmap_read(priv->sysctrl_base, GENCONF_CTRL0, &val); + if (port->gop_id == 2) +- val |= GENCONF_CTRL0_PORT0_RGMII | GENCONF_CTRL0_PORT1_RGMII; ++ val |= GENCONF_CTRL0_PORT0_RGMII; + else if (port->gop_id == 3) + val |= GENCONF_CTRL0_PORT1_RGMII_MII; + regmap_write(priv->sysctrl_base, GENCONF_CTRL0, val); diff --git a/patches.suse/net-mvpp2-Fix-error-return-code-in-mvpp2_open.patch b/patches.suse/net-mvpp2-Fix-error-return-code-in-mvpp2_open.patch new file mode 100644 index 0000000..dee3fc7 --- /dev/null +++ b/patches.suse/net-mvpp2-Fix-error-return-code-in-mvpp2_open.patch @@ -0,0 +1,31 @@ +From: Wang Hai +Date: Thu, 3 Dec 2020 22:18:06 +0800 +Subject: net: mvpp2: Fix error return code in mvpp2_open() +Patch-mainline: v5.10-rc7 +Git-commit: 82a10dc7f0960735f40e8d7d3bee56934291600f +References: bsc#1119113 FATE#326472 + +Fix to return negative error code -ENOENT from invalid configuration +error handling case instead of 0, as done elsewhere in this function. + +Fixes: 4bb043262878 ("net: mvpp2: phylink support") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20201203141806.37966-1-wanghai38@huawei.com +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -3441,6 +3441,7 @@ static int mvpp2_open(struct net_device + if (!valid) { + netdev_err(port->dev, + "invalid configuration: no dt or link IRQ"); ++ err = -ENOENT; + goto err_free_irq; + } + diff --git a/patches.suse/net-mvpp2-fix-pkt-coalescing-int-threshold-configura.patch b/patches.suse/net-mvpp2-fix-pkt-coalescing-int-threshold-configura.patch new file mode 100644 index 0000000..03b51b8 --- /dev/null +++ b/patches.suse/net-mvpp2-fix-pkt-coalescing-int-threshold-configura.patch @@ -0,0 +1,46 @@ +From: Stefan Chulski +Date: Wed, 23 Dec 2020 20:35:21 +0200 +Subject: net: mvpp2: fix pkt coalescing int-threshold configuration +Patch-mainline: v5.11-rc3 +Git-commit: 4f374d2c43a9e5e773f1dee56db63bd6b8a36276 +References: bsc#1098633 + +The packet coalescing interrupt threshold has separated registers +for different aggregated/cpu (sw-thread). The required value should +be loaded for every thread but not only for 1 current cpu. + +Fixes: 213f428f5056 ("net: mvpp2: add support for TX interrupts and RX queue distribution modes") +Signed-off-by: Stefan Chulski +Link: https://lore.kernel.org/r/1608748521-11033-1-git-send-email-stefanc@marvell.com +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -1900,17 +1900,18 @@ static void mvpp2_rx_pkts_coal_set(struc + static void mvpp2_tx_pkts_coal_set(struct mvpp2_port *port, + struct mvpp2_tx_queue *txq) + { +- unsigned int thread = mvpp2_cpu_to_thread(port->priv, get_cpu()); ++ unsigned int thread; + u32 val; + + if (txq->done_pkts_coal > MVPP2_TXQ_THRESH_MASK) + txq->done_pkts_coal = MVPP2_TXQ_THRESH_MASK; + + val = (txq->done_pkts_coal << MVPP2_TXQ_THRESH_OFFSET); +- mvpp2_thread_write(port->priv, thread, MVPP2_TXQ_NUM_REG, txq->id); +- mvpp2_thread_write(port->priv, thread, MVPP2_TXQ_THRESH_REG, val); +- +- put_cpu(); ++ /* PKT-coalescing registers are per-queue + per-thread */ ++ for (thread = 0; thread < MVPP2_MAX_THREADS; thread++) { ++ mvpp2_thread_write(port->priv, thread, MVPP2_TXQ_NUM_REG, txq->id); ++ mvpp2_thread_write(port->priv, thread, MVPP2_TXQ_THRESH_REG, val); ++ } + } + + static u32 mvpp2_usec_to_cycles(u32 usec, unsigned long clk_hz) diff --git a/patches.suse/net-sched-act_tunnel_key-fix-OOB-write-in-case-of-IP.patch b/patches.suse/net-sched-act_tunnel_key-fix-OOB-write-in-case-of-IP.patch new file mode 100644 index 0000000..927d7dd --- /dev/null +++ b/patches.suse/net-sched-act_tunnel_key-fix-OOB-write-in-case-of-IP.patch @@ -0,0 +1,120 @@ +From: Davide Caratti +Date: Wed, 21 Oct 2020 00:02:40 +0200 +Subject: net/sched: act_tunnel_key: fix OOB write in case of IPv6 ERSPAN + tunnels +Patch-mainline: v5.10-rc1 +Git-commit: a7a12b5a0f950bc6b9f7153390634ea798738db9 +References: bsc#1109837 + +the following command + + # tc action add action tunnel_key \ + > set src_ip 2001:db8::1 dst_ip 2001:db8::2 id 10 erspan_opts 1:6789:0:0 + +generates the following splat: + + BUG: KASAN: slab-out-of-bounds in tunnel_key_copy_opts+0xcc9/0x1010 [act_tunnel_key] + Write of size 4 at addr ffff88813f5f1cc8 by task tc/873 + + CPU: 2 PID: 873 Comm: tc Not tainted 5.9.0+ #282 + Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014 + Call Trace: + dump_stack+0x99/0xcb + print_address_description.constprop.7+0x1e/0x230 + kasan_report.cold.13+0x37/0x7c + tunnel_key_copy_opts+0xcc9/0x1010 [act_tunnel_key] + tunnel_key_init+0x160c/0x1f40 [act_tunnel_key] + tcf_action_init_1+0x5b5/0x850 + tcf_action_init+0x15d/0x370 + tcf_action_add+0xd9/0x2f0 + tc_ctl_action+0x29b/0x3a0 + rtnetlink_rcv_msg+0x341/0x8d0 + netlink_rcv_skb+0x120/0x380 + netlink_unicast+0x439/0x630 + netlink_sendmsg+0x719/0xbf0 + sock_sendmsg+0xe2/0x110 + ____sys_sendmsg+0x5ba/0x890 + ___sys_sendmsg+0xe9/0x160 + __sys_sendmsg+0xd3/0x170 + do_syscall_64+0x33/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + RIP: 0033:0x7f872a96b338 + Code: 89 02 48 c7 c0 ff ff ff ff eb b5 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 25 43 2c 00 8b 00 85 c0 75 17 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 41 54 41 89 d4 55 + RSP: 002b:00007ffffe367518 EFLAGS: 00000246 ORIG_RAX: 000000000000002e + RAX: ffffffffffffffda RBX: 000000005f8f5aed RCX: 00007f872a96b338 + RDX: 0000000000000000 RSI: 00007ffffe367580 RDI: 0000000000000003 + RBP: 0000000000000000 R08: 0000000000000001 R09: 000000000000001c + R10: 000000000000000b R11: 0000000000000246 R12: 0000000000000001 + R13: 0000000000686760 R14: 0000000000000601 R15: 0000000000000000 + + Allocated by task 873: + kasan_save_stack+0x19/0x40 + __kasan_kmalloc.constprop.7+0xc1/0xd0 + __kmalloc+0x151/0x310 + metadata_dst_alloc+0x20/0x40 + tunnel_key_init+0xfff/0x1f40 [act_tunnel_key] + tcf_action_init_1+0x5b5/0x850 + tcf_action_init+0x15d/0x370 + tcf_action_add+0xd9/0x2f0 + tc_ctl_action+0x29b/0x3a0 + rtnetlink_rcv_msg+0x341/0x8d0 + netlink_rcv_skb+0x120/0x380 + netlink_unicast+0x439/0x630 + netlink_sendmsg+0x719/0xbf0 + sock_sendmsg+0xe2/0x110 + ____sys_sendmsg+0x5ba/0x890 + ___sys_sendmsg+0xe9/0x160 + __sys_sendmsg+0xd3/0x170 + do_syscall_64+0x33/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + + The buggy address belongs to the object at ffff88813f5f1c00 + which belongs to the cache kmalloc-256 of size 256 + The buggy address is located 200 bytes inside of + 256-byte region [ffff88813f5f1c00, ffff88813f5f1d00) + The buggy address belongs to the page: + page:0000000011b48a19 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13f5f0 + head:0000000011b48a19 order:1 compound_mapcount:0 + flags: 0x17ffffc0010200(slab|head) + raw: 0017ffffc0010200 0000000000000000 0000000d00000001 ffff888107c43400 + raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 + page dumped because: kasan: bad access detected + + Memory state around the buggy address: + ffff88813f5f1b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ffff88813f5f1c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + >ffff88813f5f1c80: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc + ^ + ffff88813f5f1d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ffff88813f5f1d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + +using IPv6 tunnels, act_tunnel_key allocates a fixed amount of memory for +the tunnel metadata, but then it expects additional bytes to store tunnel +specific metadata with tunnel_key_copy_opts(). + +Fix the arguments of __ipv6_tun_set_dst(), so that 'md_size' contains the +size previously computed by tunnel_key_get_opts_len(), like it's done for +IPv4 tunnels. + +Fixes: 0ed5269f9e41 ("net/sched: add tunnel option support to act_tunnel_key") +Reported-by: Shuang Li +Signed-off-by: Davide Caratti +Acked-by: Cong Wang +Link: https://lore.kernel.org/r/36ebe969f6d13ff59912d6464a4356fe6f103766.1603231100.git.dcaratti@redhat.com +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + net/sched/act_tunnel_key.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/sched/act_tunnel_key.c ++++ b/net/sched/act_tunnel_key.c +@@ -312,7 +312,7 @@ static int tunnel_key_init(struct net *n + + metadata = __ipv6_tun_set_dst(&saddr, &daddr, tos, ttl, dst_port, + 0, flags, +- key_id, 0); ++ key_id, opts_len); + } else { + NL_SET_ERR_MSG(extack, "Missing either ipv4 or ipv6 src and dst"); + ret = -EINVAL; diff --git a/patches.suse/net-smc-cancel-event-worker-during-device-removal b/patches.suse/net-smc-cancel-event-worker-during-device-removal new file mode 100644 index 0000000..56e6d68 --- /dev/null +++ b/patches.suse/net-smc-cancel-event-worker-during-device-removal @@ -0,0 +1,31 @@ +From: Karsten Graul +Date: Tue, 10 Mar 2020 09:33:30 +0100 +Subject: net/smc: cancel event worker during device removal +Git-commit: ece0d7bd74615773268475b6b64d6f1ebbd4b4c6 +Patch-mainline: v5.6-rc6 +References: git-fixes + +During IB device removal, cancel the event worker before the device +structure is freed. + +Fixes: a4cf0443c414 ("smc: introduce SMC as an IB-client") +Reported-by: syzbot+b297c6825752e7a07272@syzkaller.appspotmail.com +Signed-off-by: Karsten Graul +Reviewed-by: Ursula Braun +Reviewed-by: Leon Romanovsky +Signed-off-by: David S. Miller +Acked-by: Petr Tesarik +--- + net/smc/smc_ib.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/smc/smc_ib.c ++++ b/net/smc/smc_ib.c +@@ -568,6 +568,7 @@ static void smc_ib_remove_dev(struct ib_ + spin_unlock(&smc_ib_devices.lock); + smc_ib_cleanup_per_ibdev(smcibdev); + ib_unregister_event_handler(&smcibdev->event_handler); ++ cancel_work_sync(&smcibdev->port_event_work); + kfree(smcibdev); + } + diff --git a/patches.suse/net-smc-check-for-valid-ib_client_data b/patches.suse/net-smc-check-for-valid-ib_client_data new file mode 100644 index 0000000..d1805fb --- /dev/null +++ b/patches.suse/net-smc-check-for-valid-ib_client_data @@ -0,0 +1,30 @@ +From: Karsten Graul +Date: Wed, 26 Feb 2020 17:52:46 +0100 +Subject: net/smc: check for valid ib_client_data +Git-commit: a2f2ef4a54c0d97aa6a8386f4ff23f36ebb488cf +Patch-mainline: v5.6-rc4 +References: git-fixes + +In smc_ib_remove_dev() check if the provided ib device was actually +initialized for SMC before. + +Reported-by: syzbot+84484ccebdd4e5451d91@syzkaller.appspotmail.com +Fixes: a4cf0443c414 ("smc: introduce SMC as an IB-client") +Signed-off-by: Karsten Graul +Signed-off-by: David S. Miller +Acked-by: Petr Tesarik +--- + net/smc/smc_ib.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/smc/smc_ib.c ++++ b/net/smc/smc_ib.c +@@ -560,6 +560,8 @@ static void smc_ib_remove_dev(struct ib_ + struct smc_ib_device *smcibdev; + + smcibdev = ib_get_client_data(ibdev, &smc_ib_client); ++ if (!smcibdev || smcibdev->ibdev != ibdev) ++ return; + ib_set_client_data(ibdev, &smc_ib_client, NULL); + spin_lock(&smc_ib_devices.lock); + list_del_init(&smcibdev->list); /* remove from smc_ib_devices */ diff --git a/patches.suse/net-smc-fix-sleep-bug-in-smc_pnet_find_roce_resource b/patches.suse/net-smc-fix-sleep-bug-in-smc_pnet_find_roce_resource new file mode 100644 index 0000000..31ca55b --- /dev/null +++ b/patches.suse/net-smc-fix-sleep-bug-in-smc_pnet_find_roce_resource @@ -0,0 +1,231 @@ +From: Ursula Braun +Date: Wed, 8 Jul 2020 17:05:13 +0200 +Subject: net/smc: fix sleep bug in smc_pnet_find_roce_resource() +Git-commit: 92f3cb0e11dda530d1daa42d7a11af5a92ed89e4 +Patch-mainline: v5.8-rc5 +References: git-fixes + +Tests showed this BUG: +[572555.252867] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:935 +[572555.252876] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 131031, name: smcapp +[572555.252879] INFO: lockdep is turned off. +[572555.252883] CPU: 1 PID: 131031 Comm: smcapp Tainted: G O 5.7.0-rc3uschi+ #356 +[572555.252885] Hardware name: IBM 3906 M03 703 (LPAR) +[572555.252887] Call Trace: +[572555.252896] [<00000000ac364554>] show_stack+0x94/0xe8 +[572555.252901] [<00000000aca1f400>] dump_stack+0xa0/0xe0 +[572555.252906] [<00000000ac3c8c10>] ___might_sleep+0x260/0x280 +[572555.252910] [<00000000acdc0c98>] __mutex_lock+0x48/0x940 +[572555.252912] [<00000000acdc15c2>] mutex_lock_nested+0x32/0x40 +[572555.252975] [<000003ff801762d0>] mlx5_lag_get_roce_netdev+0x30/0xc0 [mlx5_core] +[572555.252996] [<000003ff801fb3aa>] mlx5_ib_get_netdev+0x3a/0xe0 [mlx5_ib] +[572555.253007] [<000003ff80063848>] smc_pnet_find_roce_resource+0x1d8/0x310 [smc] +[572555.253011] [<000003ff800602f0>] __smc_connect+0x1f0/0x3e0 [smc] +[572555.253015] [<000003ff80060634>] smc_connect+0x154/0x190 [smc] +[572555.253022] [<00000000acbed8d4>] __sys_connect+0x94/0xd0 +[572555.253025] [<00000000acbef620>] __s390x_sys_socketcall+0x170/0x360 +[572555.253028] [<00000000acdc6800>] system_call+0x298/0x2b8 +[572555.253030] INFO: lockdep is turned off. + +Function smc_pnet_find_rdma_dev() might be called from +smc_pnet_find_roce_resource(). It holds the smc_ib_devices list +spinlock while calling infiniband op get_netdev(). At least for mlx5 +the get_netdev operation wants mutex serialization, which conflicts +with the smc_ib_devices spinlock. +This patch switches the smc_ib_devices spinlock into a mutex to +allow sleeping when calling get_netdev(). + +Fixes: a4cf0443c414 ("smc: introduce SMC as an IB-client") +Signed-off-by: Ursula Braun +Signed-off-by: Karsten Graul +Signed-off-by: David S. Miller +[ ptesarik: smc_core_going_away() hunks removed because of missing + commit c3d9494e68c4a5d23227ede822fda9bd68bef8e3. + Additional changes in _smc_pnet_dump are needed because of missing + commit fdff704dc60418e9a1bac78ae09c857d05c65aa3. ] +Signed-off-by: Petr Tesarik +--- + net/smc/smc_ib.c | 11 ++++++----- + net/smc/smc_ib.h | 3 ++- + net/smc/smc_pnet.c | 25 +++++++++++++------------ + 3 files changed, 21 insertions(+), 18 deletions(-) + +--- a/net/smc/smc_ib.c ++++ b/net/smc/smc_ib.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -32,7 +33,7 @@ + #define SMC_QP_RNR_RETRY 7 /* 7: infinite */ + + struct smc_ib_devices smc_ib_devices = { /* smc-registered ib devices */ +- .lock = __SPIN_LOCK_UNLOCKED(smc_ib_devices.lock), ++ .mutex = __MUTEX_INITIALIZER(smc_ib_devices.mutex), + .list = LIST_HEAD_INIT(smc_ib_devices.list), + }; + +@@ -533,9 +534,9 @@ static void smc_ib_add_dev(struct ib_dev + smcibdev->ibdev = ibdev; + INIT_WORK(&smcibdev->port_event_work, smc_ib_port_event_work); + +- spin_lock(&smc_ib_devices.lock); ++ mutex_lock(&smc_ib_devices.mutex); + list_add_tail(&smcibdev->list, &smc_ib_devices.list); +- spin_unlock(&smc_ib_devices.lock); ++ mutex_unlock(&smc_ib_devices.mutex); + ib_set_client_data(ibdev, &smc_ib_client, smcibdev); + INIT_IB_EVENT_HANDLER(&smcibdev->event_handler, smcibdev->ibdev, + smc_ib_global_event_handler); +@@ -563,9 +564,9 @@ static void smc_ib_remove_dev(struct ib_ + if (!smcibdev || smcibdev->ibdev != ibdev) + return; + ib_set_client_data(ibdev, &smc_ib_client, NULL); +- spin_lock(&smc_ib_devices.lock); ++ mutex_lock(&smc_ib_devices.mutex); + list_del_init(&smcibdev->list); /* remove from smc_ib_devices */ +- spin_unlock(&smc_ib_devices.lock); ++ mutex_unlock(&smc_ib_devices.mutex); + smc_ib_cleanup_per_ibdev(smcibdev); + ib_unregister_event_handler(&smcibdev->event_handler); + cancel_work_sync(&smcibdev->port_event_work); +--- a/net/smc/smc_ib.h ++++ b/net/smc/smc_ib.h +@@ -13,6 +13,7 @@ + + #include + #include ++#include + #include + #include + +@@ -23,7 +24,7 @@ + + struct smc_ib_devices { /* list of smc ib devices definition */ + struct list_head list; +- spinlock_t lock; /* protects list of smc ib devices */ ++ struct mutex mutex; /* protects list of smc ib devices */ + }; + + extern struct smc_ib_devices smc_ib_devices; /* list of smc ib devices */ +--- a/net/smc/smc_pnet.c ++++ b/net/smc/smc_pnet.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -124,7 +125,7 @@ static int smc_pnet_remove_by_pnetid(str + return rc; + + /* remove ib devices */ +- spin_lock(&smc_ib_devices.lock); ++ mutex_lock(&smc_ib_devices.mutex); + list_for_each_entry(ibdev, &smc_ib_devices.list, list) { + for (ibport = 0; ibport < SMC_MAX_PORTS; ibport++) { + if (ibdev->pnetid_by_user[ibport] && +@@ -138,7 +139,7 @@ static int smc_pnet_remove_by_pnetid(str + } + } + } +- spin_unlock(&smc_ib_devices.lock); ++ mutex_unlock(&smc_ib_devices.mutex); + /* remove smcd devices */ + spin_lock(&smcd_dev_list.lock); + list_for_each_entry(smcd_dev, &smcd_dev_list.list, list) { +@@ -200,14 +201,14 @@ static int smc_pnet_enter(struct smc_pne + struct smc_ib_device *ib_dev = new_pnetelem->smcibdev; + int ib_port = new_pnetelem->ib_port; + +- spin_lock(&smc_ib_devices.lock); ++ mutex_lock(&smc_ib_devices.mutex); + if (smc_pnet_match(ib_dev->pnetid[ib_port - 1], pnet_null)) { + memcpy(ib_dev->pnetid[ib_port - 1], + new_pnetelem->pnet_name, SMC_MAX_PNETID_LEN); + ib_dev->pnetid_by_user[ib_port - 1] = true; + new_ibdev = true; + } +- spin_unlock(&smc_ib_devices.lock); ++ mutex_unlock(&smc_ib_devices.mutex); + } + if (new_pnetelem->smcd_dev) { + struct smcd_dev *smcd_dev = new_pnetelem->smcd_dev; +@@ -290,7 +291,7 @@ static struct smc_ib_device *smc_pnet_fi + { + struct smc_ib_device *ibdev; + +- spin_lock(&smc_ib_devices.lock); ++ mutex_lock(&smc_ib_devices.mutex); + list_for_each_entry(ibdev, &smc_ib_devices.list, list) { + if (!strncmp(ibdev->ibdev->name, ib_name, + sizeof(ibdev->ibdev->name)) || +@@ -301,7 +302,7 @@ static struct smc_ib_device *smc_pnet_fi + } + ibdev = NULL; + out: +- spin_unlock(&smc_ib_devices.lock); ++ mutex_unlock(&smc_ib_devices.mutex); + return ibdev; + } + +@@ -505,7 +506,7 @@ static int _smc_pnet_dump(struct net *ne + return idx; + + /* dump ib devices */ +- spin_lock(&smc_ib_devices.lock); ++ mutex_lock(&smc_ib_devices.mutex); + list_for_each_entry(ibdev, &smc_ib_devices.list, list) { + for (ibport = 0; ibport < SMC_MAX_PORTS; ibport++) { + if (ibdev->pnetid_by_user[ibport]) { +@@ -530,7 +531,7 @@ static int _smc_pnet_dump(struct net *ne + } + } + } +- spin_unlock(&smc_ib_devices.lock); ++ mutex_unlock(&smc_ib_devices.mutex); + + /* dump smcd devices */ + spin_lock(&smcd_dev_list.lock); +@@ -761,7 +762,7 @@ static void smc_pnet_find_rdma_dev(struc + { + struct smc_ib_device *ibdev; + +- spin_lock(&smc_ib_devices.lock); ++ mutex_lock(&smc_ib_devices.mutex); + list_for_each_entry(ibdev, &smc_ib_devices.list, list) { + struct net_device *ndev; + int i; +@@ -785,7 +786,7 @@ static void smc_pnet_find_rdma_dev(struc + } + } + } +- spin_unlock(&smc_ib_devices.lock); ++ mutex_unlock(&smc_ib_devices.mutex); + } + + /* Determine the corresponding IB device port based on the hardware PNETID. +@@ -809,7 +810,7 @@ static void smc_pnet_find_roce_by_pnetid + return; /* pnetid could not be determined */ + } + +- spin_lock(&smc_ib_devices.lock); ++ mutex_lock(&smc_ib_devices.mutex); + list_for_each_entry(ibdev, &smc_ib_devices.list, list) { + for (i = 1; i <= SMC_MAX_PORTS; i++) { + if (!rdma_is_port_valid(ibdev->ibdev, i)) +@@ -825,7 +826,7 @@ static void smc_pnet_find_roce_by_pnetid + } + } + out: +- spin_unlock(&smc_ib_devices.lock); ++ mutex_unlock(&smc_ib_devices.mutex); + } + + static void smc_pnet_find_ism_by_pnetid(struct net_device *ndev, diff --git a/patches.suse/net-smc-receive-pending-data-after-rcv_shutdown b/patches.suse/net-smc-receive-pending-data-after-rcv_shutdown new file mode 100644 index 0000000..87288c6 --- /dev/null +++ b/patches.suse/net-smc-receive-pending-data-after-rcv_shutdown @@ -0,0 +1,70 @@ +From: Karsten Graul +Date: Thu, 10 Oct 2019 10:16:11 +0200 +Subject: net/smc: receive pending data after RCV_SHUTDOWN +Git-commit: 107529e31a87acd475ff6a0f82745821b8f70fec +Patch-mainline: v5.4-rc4 +References: git-fixes + +smc_rx_recvmsg() first checks if data is available, and then if +RCV_SHUTDOWN is set. There is a race when smc_cdc_msg_recv_action() runs +in between these 2 checks, receives data and sets RCV_SHUTDOWN. +In that case smc_rx_recvmsg() would return from receive without to +process the available data. +Fix that with a final check for data available if RCV_SHUTDOWN is set. +Move the check for data into a function and call it twice. +And use the existing helper smc_rx_data_available(). + +Fixes: 952310ccf2d8 ("smc: receive data from RMBE") +Reviewed-by: Ursula Braun +Signed-off-by: Karsten Graul +Signed-off-by: Jakub Kicinski +Acked-by: Petr Tesarik +--- + net/smc/smc_rx.c | 25 ++++++++++++++++++++----- + 1 file changed, 20 insertions(+), 5 deletions(-) + +--- a/net/smc/smc_rx.c ++++ b/net/smc/smc_rx.c +@@ -261,6 +261,18 @@ static int smc_rx_recv_urg(struct smc_so + return -EAGAIN; + } + ++static bool smc_rx_recvmsg_data_available(struct smc_sock *smc) ++{ ++ struct smc_connection *conn = &smc->conn; ++ ++ if (smc_rx_data_available(conn)) ++ return true; ++ else if (conn->urg_state == SMC_URG_VALID) ++ /* we received a single urgent Byte - skip */ ++ smc_rx_update_cons(smc, 0); ++ return false; ++} ++ + /* smc_rx_recvmsg - receive data from RMBE + * @msg: copy data to receive buffer + * @pipe: copy data to pipe if set - indicates splice() call +@@ -302,15 +314,18 @@ int smc_rx_recvmsg(struct smc_sock *smc, + if (read_done >= target || (pipe && read_done)) + break; + +- if (atomic_read(&conn->bytes_to_rcv)) ++ if (smc_rx_recvmsg_data_available(smc)) + goto copy; +- else if (conn->urg_state == SMC_URG_VALID) +- /* we received a single urgent Byte - skip */ +- smc_rx_update_cons(smc, 0); + + if (sk->sk_shutdown & RCV_SHUTDOWN || +- conn->local_tx_ctrl.conn_state_flags.peer_conn_abort) ++ conn->local_tx_ctrl.conn_state_flags.peer_conn_abort) { ++ /* smc_cdc_msg_recv_action() could have run after ++ * above smc_rx_recvmsg_data_available() ++ */ ++ if (smc_rx_recvmsg_data_available(smc)) ++ goto copy; + break; ++ } + + if (read_done) { + if (sk->sk_err || diff --git a/patches.suse/net-smc-receive-returns-without-data b/patches.suse/net-smc-receive-returns-without-data new file mode 100644 index 0000000..62bd653 --- /dev/null +++ b/patches.suse/net-smc-receive-returns-without-data @@ -0,0 +1,45 @@ +From: Karsten Graul +Date: Thu, 10 Oct 2019 10:16:10 +0200 +Subject: net/smc: receive returns without data +Git-commit: 882dcfe5a1785c20f45820cbe6fec4b8b647c946 +Patch-mainline: v5.4-rc4 +References: git-fixes + +smc_cdc_rxed_any_close_or_senddone() is used as an end condition for the +receive loop. This conflicts with smc_cdc_msg_recv_action() which could +run in parallel and set the bits checked by +smc_cdc_rxed_any_close_or_senddone() before the receive is processed. +In that case we could return from receive with no data, although data is +available. The same applies to smc_rx_wait(). +Fix this by checking for RCV_SHUTDOWN only, which is set in +smc_cdc_msg_recv_action() after the receive was actually processed. + +Fixes: 952310ccf2d8 ("smc: receive data from RMBE") +Reviewed-by: Ursula Braun +Signed-off-by: Karsten Graul +Signed-off-by: Jakub Kicinski +Acked-by: Petr Tesarik +--- + net/smc/smc_rx.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/net/smc/smc_rx.c ++++ b/net/smc/smc_rx.c +@@ -211,8 +211,7 @@ int smc_rx_wait(struct smc_sock *smc, lo + rc = sk_wait_event(sk, timeo, + sk->sk_err || + sk->sk_shutdown & RCV_SHUTDOWN || +- fcrit(conn) || +- smc_cdc_rxed_any_close_or_senddone(conn), ++ fcrit(conn), + &wait); + remove_wait_queue(sk_sleep(sk), &wait); + sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk); +@@ -310,7 +309,6 @@ int smc_rx_recvmsg(struct smc_sock *smc, + smc_rx_update_cons(smc, 0); + + if (sk->sk_shutdown & RCV_SHUTDOWN || +- smc_cdc_rxed_any_close_or_senddone(conn) || + conn->local_tx_ctrl.conn_state_flags.peer_conn_abort) + break; + diff --git a/patches.suse/net-smc-switch-smcd_dev_list-spinlock-to-mutex b/patches.suse/net-smc-switch-smcd_dev_list-spinlock-to-mutex index 6513a9b..ab3fa11 100644 --- a/patches.suse/net-smc-switch-smcd_dev_list-spinlock-to-mutex +++ b/patches.suse/net-smc-switch-smcd_dev_list-spinlock-to-mutex @@ -92,7 +92,7 @@ Signed-off-by: Petr Tesarik +++ b/net/smc/smc_pnet.c @@ -140,7 +140,7 @@ static int smc_pnet_remove_by_pnetid(str } - spin_unlock(&smc_ib_devices.lock); + mutex_unlock(&smc_ib_devices.mutex); /* remove smcd devices */ - spin_lock(&smcd_dev_list.lock); + mutex_lock(&smcd_dev_list.mutex); @@ -144,7 +144,7 @@ Signed-off-by: Petr Tesarik } @@ -533,7 +533,7 @@ static int _smc_pnet_dump(struct net *ne - spin_unlock(&smc_ib_devices.lock); + mutex_unlock(&smc_ib_devices.mutex); /* dump smcd devices */ - spin_lock(&smcd_dev_list.lock); diff --git a/patches.suse/net-team-fix-memory-leak-in-__team_options_register.patch b/patches.suse/net-team-fix-memory-leak-in-__team_options_register.patch new file mode 100644 index 0000000..a1addfa --- /dev/null +++ b/patches.suse/net-team-fix-memory-leak-in-__team_options_register.patch @@ -0,0 +1,45 @@ +From: Anant Thazhemadam +Date: Mon, 5 Oct 2020 02:25:36 +0530 +Subject: net: team: fix memory leak in __team_options_register +Patch-mainline: v5.9 +Git-commit: 9a9e77495958c7382b2438bc19746dd3aaaabb8e +References: git-fixes + +The variable "i" isn't initialized back correctly after the first loop +under the label inst_rollback gets executed. + +The value of "i" is assigned to be option_count - 1, and the ensuing +loop (under alloc_rollback) begins by initializing i--. +Thus, the value of i when the loop begins execution will now become +i = option_count - 2. + +Thus, when kfree(dst_opts[i]) is called in the second loop in this +order, (i.e., inst_rollback followed by alloc_rollback), +dst_optsp[option_count - 2] is the first element freed, and +dst_opts[option_count - 1] does not get freed, and thus, a memory +leak is caused. + +This memory leak can be fixed, by assigning i = option_count (instead of +option_count - 1). + +Fixes: 80f7c6683fe0 ("team: add support for per-port options") +Reported-by: syzbot+69b804437cfec30deac3@syzkaller.appspotmail.com +Tested-by: syzbot+69b804437cfec30deac3@syzkaller.appspotmail.com +Signed-off-by: Anant Thazhemadam +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/team/team.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -299,7 +299,7 @@ inst_rollback: + for (i--; i >= 0; i--) + __team_option_inst_del_option(team, dst_opts[i]); + +- i = option_count - 1; ++ i = option_count; + alloc_rollback: + for (i--; i >= 0; i--) + kfree(dst_opts[i]); diff --git a/patches.suse/net_failover-fixed-rollback-in-net_failover_open.patch b/patches.suse/net_failover-fixed-rollback-in-net_failover_open.patch new file mode 100644 index 0000000..6a934d0 --- /dev/null +++ b/patches.suse/net_failover-fixed-rollback-in-net_failover_open.patch @@ -0,0 +1,31 @@ +From: Vasily Averin +Date: Tue, 2 Jun 2020 15:55:26 +0300 +Subject: net_failover: fixed rollback in net_failover_open() +Patch-mainline: v5.8-rc1 +Git-commit: e8224bfe77293494626f6eec1884fee7b87d0ced +References: bsc#1109837 + +found by smatch: +drivers/net/net_failover.c:65 net_failover_open() error: + we previously assumed 'primary_dev' could be null (see line 43) + +Fixes: cfc80d9a1163 ("net: Introduce net_failover driver") +Signed-off-by: Vasily Averin +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/net_failover.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/net_failover.c ++++ b/drivers/net/net_failover.c +@@ -62,7 +62,8 @@ static int net_failover_open(struct net_ + return 0; + + err_standby_open: +- dev_close(primary_dev); ++ if (primary_dev) ++ dev_close(primary_dev); + err_primary_open: + netif_tx_disable(dev); + return err; diff --git a/patches.suse/net_sched-let-qdisc_put-accept-NULL-pointer.patch b/patches.suse/net_sched-let-qdisc_put-accept-NULL-pointer.patch new file mode 100644 index 0000000..98310f4 --- /dev/null +++ b/patches.suse/net_sched-let-qdisc_put-accept-NULL-pointer.patch @@ -0,0 +1,42 @@ +From: Cong Wang +Date: Thu, 12 Sep 2019 10:22:30 -0700 +Subject: net_sched: let qdisc_put() accept NULL pointer +Patch-mainline: v5.4-rc1 +Git-commit: 6efb971ba8edfbd80b666f29de12882852f095ae +References: bsc#1056657 FATE#322189 bsc#1056653 FATE#322190 bsc#1056787 + +When tcf_block_get() fails in sfb_init(), q->qdisc is still a NULL +pointer which leads to a crash in sfb_destroy(). Similar for +sch_dsmark. + +Instead of fixing each separately, Linus suggested to just accept +NULL pointer in qdisc_put(), which would make callers easier. + +(For sch_dsmark, the bug probably exists long before commit +6529eaba33f0.) + +Fixes: 6529eaba33f0 ("net: sched: introduce tcf block infractructure") +Reported-by: syzbot+d5870a903591faaca4ae@syzkaller.appspotmail.com +Suggested-by: Linus Torvalds +Cc: Jamal Hadi Salim +Cc: Jiri Pirko +Signed-off-by: Cong Wang +Acked-by: Jiri Pirko +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + net/sched/sch_generic.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -1008,6 +1008,9 @@ static void qdisc_destroy(struct Qdisc * + + void qdisc_put(struct Qdisc *qdisc) + { ++ if (!qdisc) ++ return; ++ + if (qdisc->flags & TCQ_F_BUILTIN || + !refcount_dec_and_test(&qdisc->refcnt)) + return; diff --git a/patches.suse/nfp-validate-the-return-code-from-dev_queue_xmit.patch b/patches.suse/nfp-validate-the-return-code-from-dev_queue_xmit.patch new file mode 100644 index 0000000..0a5d9ed --- /dev/null +++ b/patches.suse/nfp-validate-the-return-code-from-dev_queue_xmit.patch @@ -0,0 +1,32 @@ +From: Jakub Kicinski +Date: Wed, 27 Mar 2019 11:38:38 -0700 +Subject: nfp: validate the return code from dev_queue_xmit() +Patch-mainline: v5.1-rc4 +Git-commit: c8ba5b91a04e3e2643e48501c114108802f21cda +References: git-fixes + +dev_queue_xmit() may return error codes as well as netdev_tx_t, +and it always consumes the skb. Make sure we always return a +correct netdev_tx_t value. + +Fixes: eadfa4c3be99 ("nfp: add stats and xmit helpers for representors") +Signed-off-by: Jakub Kicinski +Reviewed-by: John Hurley +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/netronome/nfp/nfp_net_repr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c +@@ -195,7 +195,7 @@ static netdev_tx_t nfp_repr_xmit(struct + ret = dev_queue_xmit(skb); + nfp_repr_inc_tx_stats(netdev, len, ret); + +- return ret; ++ return NETDEV_TX_OK; + } + + static int nfp_repr_stop(struct net_device *netdev) diff --git a/patches.suse/nfsd4-readdirplus-shouldn-t-return-parent-of-export.patch b/patches.suse/nfsd4-readdirplus-shouldn-t-return-parent-of-export.patch new file mode 100644 index 0000000..e23c027 --- /dev/null +++ b/patches.suse/nfsd4-readdirplus-shouldn-t-return-parent-of-export.patch @@ -0,0 +1,50 @@ +From: "J. Bruce Fields" +Date: Mon, 11 Jan 2021 16:01:29 -0500 +Subject: [PATCH] nfsd4: readdirplus shouldn't return parent of export +Git-commit: 51b2ee7d006a736a9126e8111d1f24e4fd0afaa6 +Patch-mainline: v5.11 +References: git-fixes + +If you export a subdirectory of a filesystem, a READDIRPLUS on the root +of that export will return the filehandle of the parent with the ".." +entry. + +The filehandle is optional, so let's just not return the filehandle for +".." if we're at the root of an export. + +Note that once the client learns one filehandle outside of the export, +they can trivially access the rest of the export using further lookups. + +However, it is also not very difficult to guess filehandles outside of +the export. So exporting a subdirectory of a filesystem should +considered equivalent to providing access to the entire filesystem. To +avoid confusion, we recommend only exporting entire filesystems. + +Reported-by: Youjipeng +Signed-off-by: J. Bruce Fields +Cc: stable@vger.kernel.org +Signed-off-by: Chuck Lever +Acked-by: NeilBrown + +--- + fs/nfsd/nfs3xdr.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/fs/nfsd/nfs3xdr.c ++++ b/fs/nfsd/nfs3xdr.c +@@ -788,9 +788,14 @@ compose_entry_fh(struct nfsd3_readdirres + if (isdotent(name, namlen)) { + if (namlen == 2) { + dchild = dget_parent(dparent); +- /* filesystem root - cannot return filehandle for ".." */ ++ /* ++ * Don't return filehandle for ".." if we're at ++ * the filesystem or export root: ++ */ + if (dchild == dparent) + goto out; ++ if (dparent == exp->ex_path.dentry) ++ goto out; + } else + dchild = dget(dparent); + } else diff --git a/patches.suse/qed-Fix-race-condition-between-scheduling-and-destro.patch b/patches.suse/qed-Fix-race-condition-between-scheduling-and-destro.patch new file mode 100644 index 0000000..fc68f58 --- /dev/null +++ b/patches.suse/qed-Fix-race-condition-between-scheduling-and-destro.patch @@ -0,0 +1,61 @@ +From: Yuval Basson +Date: Wed, 25 Mar 2020 22:50:43 +0200 +Subject: qed: Fix race condition between scheduling and destroying the + slowpath workqueue +Patch-mainline: v5.7-rc1 +Git-commit: 3b85720d3fd72e6ef4de252cd2f67548eb645eb4 +References: bsc#1086314 FATE#324886 bsc#1086313 FATE#324885 bsc#1086301 FATE#3248881 + +Calling queue_delayed_work concurrently with +destroy_workqueue might race to an unexpected outcome - +scheduled task after wq is destroyed or other resources +(like ptt_pool) are freed (yields NULL pointer dereference). +cancel_delayed_work prevents the race by cancelling +the timer triggered for scheduling a new task. + +Fixes: 59ccf86fe ("qed: Add driver infrastucture for handling mfw requests") +Signed-off-by: Denis Bolotin +Signed-off-by: Michal Kalderon +Signed-off-by: Yuval Basson +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/qlogic/qed/qed_main.c | 13 ++----------- + 1 file changed, 2 insertions(+), 11 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qed/qed_main.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c +@@ -1083,9 +1083,6 @@ static void qed_update_pf_params(struct + #define QED_PERIODIC_DB_REC_INTERVAL_MS 100 + #define QED_PERIODIC_DB_REC_INTERVAL \ + msecs_to_jiffies(QED_PERIODIC_DB_REC_INTERVAL_MS) +-#define QED_PERIODIC_DB_REC_WAIT_COUNT 10 +-#define QED_PERIODIC_DB_REC_WAIT_INTERVAL \ +- (QED_PERIODIC_DB_REC_INTERVAL_MS / QED_PERIODIC_DB_REC_WAIT_COUNT) + + static int qed_slowpath_delayed_work(struct qed_hwfn *hwfn, + enum qed_slowpath_wq_flag wq_flag, +@@ -1119,7 +1116,7 @@ void qed_periodic_db_rec_start(struct qe + + static void qed_slowpath_wq_stop(struct qed_dev *cdev) + { +- int i, sleep_count = QED_PERIODIC_DB_REC_WAIT_COUNT; ++ int i; + + if (IS_VF(cdev)) + return; +@@ -1131,13 +1128,7 @@ static void qed_slowpath_wq_stop(struct + /* Stop queuing new delayed works */ + cdev->hwfns[i].slowpath_wq_active = false; + +- /* Wait until the last periodic doorbell recovery is executed */ +- while (test_bit(QED_SLOWPATH_PERIODIC_DB_REC, +- &cdev->hwfns[i].slowpath_task_flags) && +- sleep_count--) +- msleep(QED_PERIODIC_DB_REC_WAIT_INTERVAL); +- +- flush_workqueue(cdev->hwfns[i].slowpath_wq); ++ cancel_delayed_work(&cdev->hwfns[i].slowpath_task); + destroy_workqueue(cdev->hwfns[i].slowpath_wq); + } + } diff --git a/patches.suse/qed-Fix-use-after-free-in-qed_chain_free.patch b/patches.suse/qed-Fix-use-after-free-in-qed_chain_free.patch new file mode 100644 index 0000000..f7577b3 --- /dev/null +++ b/patches.suse/qed-Fix-use-after-free-in-qed_chain_free.patch @@ -0,0 +1,203 @@ +From: Yuval Basson +Date: Sun, 29 Mar 2020 20:32:49 +0300 +Subject: qed: Fix use after free in qed_chain_free +Patch-mainline: v5.7-rc1 +Git-commit: 8063f761cd7c17fc1d0018728936e0c33a25388a +References: bsc#1050536 FATE#322898 bsc#1050538 FATE#322897 + +The qed_chain data structure was modified in +commit 1a4a69751f4d ("qed: Chain support for external PBL") to support +receiving an external pbl (due to iWARP FW requirements). +The pages pointed to by the pbl are allocated in qed_chain_alloc +and their virtual address are stored in an virtual addresses array to +enable accessing and freeing the data. The physical addresses however +weren't stored and were accessed directly from the external-pbl +during free. + +Destroy-qp flow, leads to freeing the external pbl before the chain is +freed, when the chain is freed it tries accessing the already freed +external pbl, leading to a use-after-free. Therefore we need to store +the physical addresses in additional to the virtual addresses in a +new data structure. + +Fixes: 1a4a69751f4d ("qed: Chain support for external PBL") +Signed-off-by: Michal Kalderon +Signed-off-by: Yuval Bason +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/qlogic/qed/qed_dev.c | 38 ++++++++++++------------------ + include/linux/qed/qed_chain.h | 24 +++++++++++------- + 2 files changed, 31 insertions(+), 31 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c +@@ -4648,26 +4648,20 @@ static void qed_chain_free_single(struct + + static void qed_chain_free_pbl(struct qed_dev *cdev, struct qed_chain *p_chain) + { +- void **pp_virt_addr_tbl = p_chain->pbl.pp_virt_addr_tbl; ++ struct addr_tbl_entry *pp_addr_tbl = p_chain->pbl.pp_addr_tbl; + u32 page_cnt = p_chain->page_cnt, i, pbl_size; +- u8 *p_pbl_virt = p_chain->pbl_sp.p_virt_table; + +- if (!pp_virt_addr_tbl) ++ if (!pp_addr_tbl) + return; + +- if (!p_pbl_virt) +- goto out; +- + for (i = 0; i < page_cnt; i++) { +- if (!pp_virt_addr_tbl[i]) ++ if (!pp_addr_tbl[i].virt_addr || !pp_addr_tbl[i].dma_map) + break; + + dma_free_coherent(&cdev->pdev->dev, + QED_CHAIN_PAGE_SIZE, +- pp_virt_addr_tbl[i], +- *(dma_addr_t *)p_pbl_virt); +- +- p_pbl_virt += QED_CHAIN_PBL_ENTRY_SIZE; ++ pp_addr_tbl[i].virt_addr, ++ pp_addr_tbl[i].dma_map); + } + + pbl_size = page_cnt * QED_CHAIN_PBL_ENTRY_SIZE; +@@ -4677,9 +4671,9 @@ static void qed_chain_free_pbl(struct qe + pbl_size, + p_chain->pbl_sp.p_virt_table, + p_chain->pbl_sp.p_phys_table); +-out: +- vfree(p_chain->pbl.pp_virt_addr_tbl); +- p_chain->pbl.pp_virt_addr_tbl = NULL; ++ ++ vfree(p_chain->pbl.pp_addr_tbl); ++ p_chain->pbl.pp_addr_tbl = NULL; + } + + void qed_chain_free(struct qed_dev *cdev, struct qed_chain *p_chain) +@@ -4780,19 +4774,19 @@ qed_chain_alloc_pbl(struct qed_dev *cdev + { + u32 page_cnt = p_chain->page_cnt, size, i; + dma_addr_t p_phys = 0, p_pbl_phys = 0; +- void **pp_virt_addr_tbl = NULL; ++ struct addr_tbl_entry *pp_addr_tbl; + u8 *p_pbl_virt = NULL; + void *p_virt = NULL; + +- size = page_cnt * sizeof(*pp_virt_addr_tbl); +- pp_virt_addr_tbl = vzalloc(size); +- if (!pp_virt_addr_tbl) ++ size = page_cnt * sizeof(*pp_addr_tbl); ++ pp_addr_tbl = vzalloc(size); ++ if (!pp_addr_tbl) + return -ENOMEM; + + /* The allocation of the PBL table is done with its full size, since it + * is expected to be successive. + * qed_chain_init_pbl_mem() is called even in a case of an allocation +- * failure, since pp_virt_addr_tbl was previously allocated, and it ++ * failure, since tbl was previously allocated, and it + * should be saved to allow its freeing during the error flow. + */ + size = page_cnt * QED_CHAIN_PBL_ENTRY_SIZE; +@@ -4806,8 +4800,7 @@ qed_chain_alloc_pbl(struct qed_dev *cdev + p_chain->b_external_pbl = true; + } + +- qed_chain_init_pbl_mem(p_chain, p_pbl_virt, p_pbl_phys, +- pp_virt_addr_tbl); ++ qed_chain_init_pbl_mem(p_chain, p_pbl_virt, p_pbl_phys, pp_addr_tbl); + if (!p_pbl_virt) + return -ENOMEM; + +@@ -4826,7 +4819,8 @@ qed_chain_alloc_pbl(struct qed_dev *cdev + /* Fill the PBL table with the physical address of the page */ + *(dma_addr_t *)p_pbl_virt = p_phys; + /* Keep the virtual address of the page */ +- p_chain->pbl.pp_virt_addr_tbl[i] = p_virt; ++ p_chain->pbl.pp_addr_tbl[i].virt_addr = p_virt; ++ p_chain->pbl.pp_addr_tbl[i].dma_map = p_phys; + + p_pbl_virt += QED_CHAIN_PBL_ENTRY_SIZE; + } +--- a/include/linux/qed/qed_chain.h ++++ b/include/linux/qed/qed_chain.h +@@ -97,6 +97,11 @@ struct qed_chain_u32 { + u32 cons_idx; + }; + ++struct addr_tbl_entry { ++ void *virt_addr; ++ dma_addr_t dma_map; ++}; ++ + struct qed_chain { + /* fastpath portion of the chain - required for commands such + * as produce / consume. +@@ -107,10 +112,11 @@ struct qed_chain { + + /* Fastpath portions of the PBL [if exists] */ + struct { +- /* Table for keeping the virtual addresses of the chain pages, +- * respectively to the physical addresses in the pbl table. ++ /* Table for keeping the virtual and physical addresses of the ++ * chain pages, respectively to the physical addresses ++ * in the pbl table. + */ +- void **pp_virt_addr_tbl; ++ struct addr_tbl_entry *pp_addr_tbl; + + union { + struct qed_chain_pbl_u16 u16; +@@ -287,7 +293,7 @@ qed_chain_advance_page(struct qed_chain + *(u32 *)page_to_inc = 0; + page_index = *(u32 *)page_to_inc; + } +- *p_next_elem = p_chain->pbl.pp_virt_addr_tbl[page_index]; ++ *p_next_elem = p_chain->pbl.pp_addr_tbl[page_index].virt_addr; + } + } + +@@ -537,7 +543,7 @@ static inline void qed_chain_init_params + + p_chain->pbl_sp.p_phys_table = 0; + p_chain->pbl_sp.p_virt_table = NULL; +- p_chain->pbl.pp_virt_addr_tbl = NULL; ++ p_chain->pbl.pp_addr_tbl = NULL; + } + + /** +@@ -575,11 +581,11 @@ static inline void qed_chain_init_mem(st + static inline void qed_chain_init_pbl_mem(struct qed_chain *p_chain, + void *p_virt_pbl, + dma_addr_t p_phys_pbl, +- void **pp_virt_addr_tbl) ++ struct addr_tbl_entry *pp_addr_tbl) + { + p_chain->pbl_sp.p_phys_table = p_phys_pbl; + p_chain->pbl_sp.p_virt_table = p_virt_pbl; +- p_chain->pbl.pp_virt_addr_tbl = pp_virt_addr_tbl; ++ p_chain->pbl.pp_addr_tbl = pp_addr_tbl; + } + + /** +@@ -644,7 +650,7 @@ static inline void *qed_chain_get_last_e + break; + case QED_CHAIN_MODE_PBL: + last_page_idx = p_chain->page_cnt - 1; +- p_virt_addr = p_chain->pbl.pp_virt_addr_tbl[last_page_idx]; ++ p_virt_addr = p_chain->pbl.pp_addr_tbl[last_page_idx].virt_addr; + break; + } + /* p_virt_addr points at this stage to the last page of the chain */ +@@ -716,7 +722,7 @@ static inline void qed_chain_pbl_zero_me + page_cnt = qed_chain_get_page_cnt(p_chain); + + for (i = 0; i < page_cnt; i++) +- memset(p_chain->pbl.pp_virt_addr_tbl[i], 0, ++ memset(p_chain->pbl.pp_addr_tbl[i].virt_addr, 0, + QED_CHAIN_PAGE_SIZE); + } + diff --git a/patches.suse/rtmutex_Remove_unused_argument_from_rt_mutex_proxy_unlock_.patch b/patches.suse/rtmutex_Remove_unused_argument_from_rt_mutex_proxy_unlock_.patch new file mode 100644 index 0000000..f060b04 --- /dev/null +++ b/patches.suse/rtmutex_Remove_unused_argument_from_rt_mutex_proxy_unlock_.patch @@ -0,0 +1,56 @@ +Subject: rtmutex: Remove unused argument from rt_mutex_proxy_unlock() +From: Thomas Gleixner +Date: Wed Jan 20 11:32:07 2021 +0100 +Git-commit: 2156ac1934166d6deb6cd0f6ffc4c1076ec63697 +Patch-mainline: v5.11-rc6 +References: bsc#1181349 bsc#1149032 CVE-2021-3347 + +Nothing uses the argument. Remove it as preparation to use +pi_state_update_owner(). + +Signed-off-by: Thomas Gleixner +Acked-by: Peter Zijlstra (Intel) +Cc: stable@vger.kernel.org +Signed-off-by: Davidlohr Bueso + +--- + kernel/futex.c | 2 +- + kernel/locking/rtmutex.c | 3 +-- + kernel/locking/rtmutex_common.h | 3 +-- + 3 files changed, 3 insertions(+), 5 deletions(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -894,7 +894,7 @@ static void put_pi_state(struct futex_pi + list_del_init(&pi_state->list); + raw_spin_unlock(&owner->pi_lock); + } +- rt_mutex_proxy_unlock(&pi_state->pi_mutex, owner); ++ rt_mutex_proxy_unlock(&pi_state->pi_mutex); + raw_spin_unlock_irqrestore(&pi_state->pi_mutex.wait_lock, flags); + } + +--- a/kernel/locking/rtmutex.c ++++ b/kernel/locking/rtmutex.c +@@ -1719,8 +1719,7 @@ void rt_mutex_init_proxy_locked(struct r + * possible because it belongs to the pi_state which is about to be freed + * and it is not longer visible to other tasks. + */ +-void rt_mutex_proxy_unlock(struct rt_mutex *lock, +- struct task_struct *proxy_owner) ++void rt_mutex_proxy_unlock(struct rt_mutex *lock) + { + debug_rt_mutex_proxy_unlock(lock); + rt_mutex_set_owner(lock, NULL); +--- a/kernel/locking/rtmutex_common.h ++++ b/kernel/locking/rtmutex_common.h +@@ -132,8 +132,7 @@ enum rtmutex_chainwalk { + extern struct task_struct *rt_mutex_next_owner(struct rt_mutex *lock); + extern void rt_mutex_init_proxy_locked(struct rt_mutex *lock, + struct task_struct *proxy_owner); +-extern void rt_mutex_proxy_unlock(struct rt_mutex *lock, +- struct task_struct *proxy_owner); ++extern void rt_mutex_proxy_unlock(struct rt_mutex *lock); + extern void rt_mutex_init_waiter(struct rt_mutex_waiter *waiter); + extern int __rt_mutex_start_proxy_lock(struct rt_mutex *lock, + struct rt_mutex_waiter *waiter, diff --git a/patches.suse/s390-cio-fix-use-after-free-in-ccw_device_destroy_console b/patches.suse/s390-cio-fix-use-after-free-in-ccw_device_destroy_console new file mode 100644 index 0000000..2f11e6f --- /dev/null +++ b/patches.suse/s390-cio-fix-use-after-free-in-ccw_device_destroy_console @@ -0,0 +1,41 @@ +From: Qinglang Miao +Date: Tue, 1 Dec 2020 14:31:50 +0800 +Subject: s390/cio: fix use-after-free in ccw_device_destroy_console +Git-commit: 14d4c4fa46eeaa3922e8e1c4aa727eb0a1412804 +Patch-mainline: v5.11-rc1 +References: git-fixes + +Use of sch->dev reference after the put_device() call could trigger +the use-after-free bugs. + +Fix this by simply adjusting the position of put_device. + +Fixes: 37db8985b211 ("s390/cio: add basic protected virtualization support") +Reported-by: Hulk Robot +Suggested-by: Cornelia Huck +Signed-off-by: Qinglang Miao +Reviewed-by: Cornelia Huck +Reviewed-by: Vineeth Vijayan +[vneethv@linux.ibm.com: Slight modification in the commit-message] +Signed-off-by: Vineeth Vijayan +Signed-off-by: Heiko Carstens +Acked-by: Petr Tesarik +--- + drivers/s390/cio/device.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/s390/cio/device.c ++++ b/drivers/s390/cio/device.c +@@ -1704,10 +1704,10 @@ void __init ccw_device_destroy_console(s + struct io_subchannel_private *io_priv = to_io_private(sch); + + set_io_private(sch, NULL); +- put_device(&sch->dev); +- put_device(&cdev->dev); + dma_free_coherent(&sch->dev, sizeof(*io_priv->dma_area), + io_priv->dma_area, io_priv->dma_area_dma); ++ put_device(&sch->dev); ++ put_device(&cdev->dev); + kfree(io_priv); + } + diff --git a/patches.suse/s390-qeth-delay-draining-the-tx-buffers b/patches.suse/s390-qeth-delay-draining-the-tx-buffers new file mode 100644 index 0000000..8a02265 --- /dev/null +++ b/patches.suse/s390-qeth-delay-draining-the-tx-buffers @@ -0,0 +1,56 @@ +From: Julian Wiedmann +Date: Thu, 10 Sep 2020 11:05:18 +0200 +Subject: s390/qeth: delay draining the TX buffers +Git-commit: 5bf490e6807bf56f49b5991b4be817407dd32656 +Patch-mainline: v5.9-rc7 +References: git-fixes + +Wait until the QDIO data connection is severed. Otherwise the device +might still be processing the buffers, and end up accessing skb data +that we already freed. + +Fixes: 8b5026bc1693 ("s390/qeth: fix qdio teardown after early init error") +Signed-off-by: Julian Wiedmann +Signed-off-by: David S. Miller +Acked-by: Petr Tesarik +--- + drivers/s390/net/qeth_l2_main.c | 2 +- + drivers/s390/net/qeth_l3_main.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -382,7 +382,6 @@ static void qeth_l2_stop_card(struct qet + card->state = CARD_STATE_HARDSETUP; + } + if (card->state == CARD_STATE_HARDSETUP) { +- qeth_clear_qdio_buffers(card); + qeth_clear_working_pool_list(card); + card->state = CARD_STATE_DOWN; + } +@@ -392,6 +391,7 @@ static void qeth_l2_stop_card(struct qet + } + + qeth_qdio_clear_card(card, 0); ++ qeth_clear_qdio_buffers(card); + flush_workqueue(card->event_wq); + card->info.promisc_mode = 0; + } +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -1426,7 +1426,6 @@ static void qeth_l3_stop_card(struct qet + card->state = CARD_STATE_HARDSETUP; + } + if (card->state == CARD_STATE_HARDSETUP) { +- qeth_clear_qdio_buffers(card); + qeth_clear_working_pool_list(card); + card->state = CARD_STATE_DOWN; + } +@@ -1436,6 +1435,7 @@ static void qeth_l3_stop_card(struct qet + } + + qeth_qdio_clear_card(card, 0); ++ qeth_clear_qdio_buffers(card); + flush_workqueue(card->event_wq); + card->info.promisc_mode = 0; + } diff --git a/patches.suse/s390-qeth-fix-deadlock-during-recovery b/patches.suse/s390-qeth-fix-deadlock-during-recovery new file mode 100644 index 0000000..5dc7783 --- /dev/null +++ b/patches.suse/s390-qeth-fix-deadlock-during-recovery @@ -0,0 +1,266 @@ +From: Julian Wiedmann +Date: Thu, 7 Jan 2021 18:24:40 +0100 +Subject: s390/qeth: fix deadlock during recovery +Git-commit: 0b9902c1fcc59ba75268386c0420a554f8844168 +Patch-mainline: v5.11-rc3 +References: git-fixes + +When qeth_dev_layer2_store() - holding the discipline_mutex - waits +inside qeth_l*_remove_device() for a qeth_do_reset() thread to complete, +we can hit a deadlock if qeth_do_reset() concurrently calls +qeth_set_online() and thus tries to aquire the discipline_mutex. + +Move the discipline_mutex locking outside of qeth_set_online() and +qeth_set_offline(), and turn the discipline into a parameter so that +callers understand the dependency. + +To fix the deadlock, we can now relax the locking: +As already established, qeth_l*_remove_device() waits for +qeth_do_reset() to complete. So qeth_do_reset() itself is under no risk +of having card->discipline ripped out while it's running, and thus +doesn't need to take the discipline_mutex. + +Fixes: 9dc48ccc68b9 ("qeth: serialize sysfs-triggered device configurations") +Signed-off-by: Julian Wiedmann +Reviewed-by: Alexandra Winter +Signed-off-by: Jakub Kicinski +[ ptesarik: Since SLE15-SP1 does not contain upstream commit + 91003f354e6bbe8d225b4d54127d80c694d201d9, there is no qeth_do_reset(). + Recovery is done by qeth_l2_recover() or qeth_l3_recover() instead, + and the deadlock needs fixing in both implementations. ] +Signed-off-by: Petr Tesarik +--- + drivers/s390/net/qeth_core_main.c | 12 +++++++++++- + drivers/s390/net/qeth_l2_main.c | 25 +++++++++++++++++-------- + drivers/s390/net/qeth_l3_main.c | 25 +++++++++++++++++-------- + 3 files changed, 45 insertions(+), 17 deletions(-) + +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -5937,7 +5937,11 @@ static int qeth_core_set_online(struct c + goto err; + } + } ++ ++ mutex_lock(&card->discipline_mutex); + rc = card->discipline->set_online(gdev); ++ mutex_unlock(&card->discipline_mutex); ++ + err: + return rc; + } +@@ -5945,7 +5949,13 @@ err: + static int qeth_core_set_offline(struct ccwgroup_device *gdev) + { + struct qeth_card *card = dev_get_drvdata(&gdev->dev); +- return card->discipline->set_offline(gdev); ++ int rc; ++ ++ mutex_lock(&card->discipline_mutex); ++ rc = card->discipline->set_offline(gdev); ++ mutex_unlock(&card->discipline_mutex); ++ ++ return rc; + } + + static void qeth_core_shutdown(struct ccwgroup_device *gdev) +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -825,8 +825,11 @@ static void qeth_l2_remove_device(struct + qeth_set_allowed_threads(card, 0, 1); + wait_event(card->wait_q, qeth_threads_running(card, 0xffffffff) == 0); + +- if (cgdev->state == CCWGROUP_ONLINE) ++ if (cgdev->state == CCWGROUP_ONLINE) { ++ mutex_lock(&card->discipline_mutex); + qeth_l2_set_offline(cgdev); ++ mutex_unlock(&card->discipline_mutex); ++ } + + cancel_work_sync(&card->close_dev_work); + if (qeth_netdev_is_registered(card->dev)) +@@ -959,7 +962,6 @@ static int __qeth_l2_set_online(struct c + enum qeth_card_states recover_flag; + bool carrier_ok; + +- mutex_lock(&card->discipline_mutex); + mutex_lock(&card->conf_mutex); + QETH_DBF_TEXT(SETUP, 2, "setonlin"); + QETH_DBF_HEX(SETUP, 2, &card, sizeof(void *)); +@@ -1045,7 +1047,6 @@ static int __qeth_l2_set_online(struct c + /* let user_space know that device is online */ + kobject_uevent(&gdev->dev.kobj, KOBJ_CHANGE); + mutex_unlock(&card->conf_mutex); +- mutex_unlock(&card->discipline_mutex); + return 0; + + out_remove: +@@ -1059,7 +1060,6 @@ out_remove: + else + card->state = CARD_STATE_DOWN; + mutex_unlock(&card->conf_mutex); +- mutex_unlock(&card->discipline_mutex); + return rc; + } + +@@ -1075,7 +1075,6 @@ static int __qeth_l2_set_offline(struct + int rc = 0, rc2 = 0, rc3 = 0; + enum qeth_card_states recover_flag; + +- mutex_lock(&card->discipline_mutex); + mutex_lock(&card->conf_mutex); + QETH_DBF_TEXT(SETUP, 3, "setoffl"); + QETH_DBF_HEX(SETUP, 3, &card, sizeof(void *)); +@@ -1100,7 +1099,6 @@ static int __qeth_l2_set_offline(struct + /* let user_space know that device is offline */ + kobject_uevent(&cgdev->dev.kobj, KOBJ_CHANGE); + mutex_unlock(&card->conf_mutex); +- mutex_unlock(&card->discipline_mutex); + return 0; + } + +@@ -1122,6 +1120,7 @@ static int qeth_l2_recover(void *ptr) + dev_warn(&card->gdev->dev, + "A recovery process has been started for the device\n"); + qeth_set_recovery_task(card); ++ /* Lock-free, other users will block until we are done. */ + __qeth_l2_set_offline(card->gdev, 1); + rc = __qeth_l2_set_online(card->gdev, 1); + if (!rc) +@@ -1161,9 +1160,14 @@ static int qeth_l2_pm_suspend(struct ccw + if (card->state == CARD_STATE_UP) { + if (card->info.hwtrap) + qeth_hw_trap(card, QETH_DIAGS_TRAP_DISARM); ++ mutex_lock(&card->discipline_mutex); + __qeth_l2_set_offline(card->gdev, 1); +- } else ++ mutex_unlock(&card->discipline_mutex); ++ } else { ++ mutex_lock(&card->discipline_mutex); + __qeth_l2_set_offline(card->gdev, 0); ++ mutex_unlock(&card->discipline_mutex); ++ } + return 0; + } + +@@ -1173,14 +1177,19 @@ static int qeth_l2_pm_resume(struct ccwg + int rc = 0; + + if (card->state == CARD_STATE_RECOVER) { ++ mutex_lock(&card->discipline_mutex); + rc = __qeth_l2_set_online(card->gdev, 1); ++ mutex_unlock(&card->discipline_mutex); + if (rc) { + rtnl_lock(); + dev_close(card->dev); + rtnl_unlock(); + } +- } else ++ } else { ++ mutex_lock(&card->discipline_mutex); + rc = __qeth_l2_set_online(card->gdev, 0); ++ mutex_unlock(&card->discipline_mutex); ++ } + + qeth_set_allowed_threads(card, 0xffffffff, 0); + netif_device_attach(card->dev); +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -2475,8 +2475,11 @@ static void qeth_l3_remove_device(struct + qeth_set_allowed_threads(card, 0, 1); + wait_event(card->wait_q, qeth_threads_running(card, 0xffffffff) == 0); + +- if (cgdev->state == CCWGROUP_ONLINE) ++ if (cgdev->state == CCWGROUP_ONLINE) { ++ mutex_lock(&card->discipline_mutex); + qeth_l3_set_offline(cgdev); ++ mutex_unlock(&card->discipline_mutex); ++ } + + cancel_work_sync(&card->close_dev_work); + if (qeth_netdev_is_registered(card->dev)) +@@ -2492,7 +2495,6 @@ static int __qeth_l3_set_online(struct c + enum qeth_card_states recover_flag; + bool carrier_ok; + +- mutex_lock(&card->discipline_mutex); + mutex_lock(&card->conf_mutex); + QETH_DBF_TEXT(SETUP, 2, "setonlin"); + QETH_DBF_HEX(SETUP, 2, &card, sizeof(void *)); +@@ -2566,7 +2568,6 @@ static int __qeth_l3_set_online(struct c + /* let user_space know that device is online */ + kobject_uevent(&gdev->dev.kobj, KOBJ_CHANGE); + mutex_unlock(&card->conf_mutex); +- mutex_unlock(&card->discipline_mutex); + return 0; + out_remove: + qeth_l3_stop_card(card, 0); +@@ -2579,7 +2580,6 @@ out_remove: + else + card->state = CARD_STATE_DOWN; + mutex_unlock(&card->conf_mutex); +- mutex_unlock(&card->discipline_mutex); + return rc; + } + +@@ -2595,7 +2595,6 @@ static int __qeth_l3_set_offline(struct + int rc = 0, rc2 = 0, rc3 = 0; + enum qeth_card_states recover_flag; + +- mutex_lock(&card->discipline_mutex); + mutex_lock(&card->conf_mutex); + QETH_DBF_TEXT(SETUP, 3, "setoffl"); + QETH_DBF_HEX(SETUP, 3, &card, sizeof(void *)); +@@ -2625,7 +2624,6 @@ static int __qeth_l3_set_offline(struct + /* let user_space know that device is offline */ + kobject_uevent(&cgdev->dev.kobj, KOBJ_CHANGE); + mutex_unlock(&card->conf_mutex); +- mutex_unlock(&card->discipline_mutex); + return 0; + } + +@@ -2648,6 +2646,7 @@ static int qeth_l3_recover(void *ptr) + dev_warn(&card->gdev->dev, + "A recovery process has been started for the device\n"); + qeth_set_recovery_task(card); ++ /* Lock-free, other users will block until we are done. */ + __qeth_l3_set_offline(card->gdev, 1); + rc = __qeth_l3_set_online(card->gdev, 1); + if (!rc) +@@ -2676,9 +2675,14 @@ static int qeth_l3_pm_suspend(struct ccw + if (card->state == CARD_STATE_UP) { + if (card->info.hwtrap) + qeth_hw_trap(card, QETH_DIAGS_TRAP_DISARM); ++ mutex_lock(&card->discipline_mutex); + __qeth_l3_set_offline(card->gdev, 1); +- } else ++ mutex_unlock(&card->discipline_mutex); ++ } else { ++ mutex_lock(&card->discipline_mutex); + __qeth_l3_set_offline(card->gdev, 0); ++ mutex_unlock(&card->discipline_mutex); ++ } + return 0; + } + +@@ -2688,14 +2692,19 @@ static int qeth_l3_pm_resume(struct ccwg + int rc = 0; + + if (card->state == CARD_STATE_RECOVER) { ++ mutex_lock(&card->discipline_mutex); + rc = __qeth_l3_set_online(card->gdev, 1); ++ mutex_unlock(&card->discipline_mutex); + if (rc) { + rtnl_lock(); + dev_close(card->dev); + rtnl_unlock(); + } +- } else ++ } else { ++ mutex_lock(&card->discipline_mutex); + rc = __qeth_l3_set_online(card->gdev, 0); ++ mutex_unlock(&card->discipline_mutex); ++ } + + qeth_set_allowed_threads(card, 0xffffffff, 0); + netif_device_attach(card->dev); diff --git a/patches.suse/s390-qeth-fix-l2-header-access-in-qeth_l3_osa_features_check b/patches.suse/s390-qeth-fix-l2-header-access-in-qeth_l3_osa_features_check new file mode 100644 index 0000000..2878818 --- /dev/null +++ b/patches.suse/s390-qeth-fix-l2-header-access-in-qeth_l3_osa_features_check @@ -0,0 +1,33 @@ +From: Julian Wiedmann +Date: Thu, 7 Jan 2021 18:24:42 +0100 +Subject: s390/qeth: fix L2 header access in qeth_l3_osa_features_check() +Git-commit: f9c4845385c8f6631ebd5dddfb019ea7a285fba4 +Patch-mainline: v5.11-rc3 +References: git-fixes + +ip_finish_output_gso() may call .ndo_features_check() even before the +skb has a L2 header. This conflicts with qeth_get_ip_version()'s attempt +to inspect the L2 header via vlan_eth_hdr(). + +Switch to vlan_get_protocol(), as already used further down in the +common qeth_features_check() path. + +Fixes: f13ade199391 ("s390/qeth: run non-offload L3 traffic over common xmit path") +Signed-off-by: Julian Wiedmann +Signed-off-by: Jakub Kicinski +Acked-by: Petr Tesarik +--- + drivers/s390/net/qeth_l3_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -2322,7 +2322,7 @@ static netdev_features_t qeth_l3_osa_fea + struct net_device *dev, + netdev_features_t features) + { +- if (qeth_get_ip_version(skb) != 4) ++ if (vlan_get_protocol(skb) != htons(ETH_P_IP)) + features &= ~NETIF_F_HW_VLAN_CTAG_TX; + return qeth_features_check(skb, dev, features); + } diff --git a/patches.suse/s390-qeth-fix-locking-for-discipline-setup-removal b/patches.suse/s390-qeth-fix-locking-for-discipline-setup-removal new file mode 100644 index 0000000..9a377aa --- /dev/null +++ b/patches.suse/s390-qeth-fix-locking-for-discipline-setup-removal @@ -0,0 +1,149 @@ +From: Julian Wiedmann +Date: Thu, 7 Jan 2021 18:24:41 +0100 +Subject: s390/qeth: fix locking for discipline setup / removal +Git-commit: b41b554c1ee75070a14c02a88496b1f231c7eacc +Patch-mainline: v5.11-rc3 +References: git-fixes + +Due to insufficient locking, qeth_core_set_online() and +qeth_dev_layer2_store() can run in parallel, both attempting to load & +setup the discipline (and stepping on each other toes along the way). +A similar race can also occur between qeth_core_remove_device() and +qeth_dev_layer2_store(). + +Access to .discipline is meant to be protected by the discipline_mutex, +so add/expand the locking in qeth_core_remove_device() and +qeth_core_set_online(). +Adjust the locking in qeth_l*_remove_device() accordingly, as it's now +handled by the callers in a consistent manner. + +Based on an initial patch by Ursula Braun. + +Fixes: 9dc48ccc68b9 ("qeth: serialize sysfs-triggered device configurations") +Signed-off-by: Julian Wiedmann +Reviewed-by: Alexandra Winter +Signed-off-by: Jakub Kicinski +[ ptesarik: Since SLE15-SP1 still contains pm callbacks, appropriate + locking must be added there. ] +Signed-off-by: Petr Tesarik +--- + drivers/s390/net/qeth_core_main.c | 28 ++++++++++++++++++++-------- + drivers/s390/net/qeth_l2_main.c | 5 +---- + drivers/s390/net/qeth_l3_main.c | 5 +---- + 3 files changed, 22 insertions(+), 16 deletions(-) + +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -5869,6 +5869,7 @@ static int qeth_core_probe_device(struct + break; + default: + card->info.layer_enforced = true; ++ /* It's so early that we don't need the discipline_mutex yet. */ + rc = qeth_core_load_discipline(card, enforced_disc); + if (rc) + goto err_load; +@@ -5904,10 +5905,12 @@ static void qeth_core_remove_device(stru + + QETH_DBF_TEXT(SETUP, 2, "removedv"); + ++ mutex_lock(&card->discipline_mutex); + if (card->discipline) { + card->discipline->remove(gdev); + qeth_core_free_discipline(card); + } ++ mutex_unlock(&card->discipline_mutex); + + write_lock_irq(&qeth_core_card_list.rwlock); + list_del(&card->list); +@@ -5923,6 +5926,7 @@ static int qeth_core_set_online(struct c + int rc = 0; + enum qeth_discipline_id def_discipline; + ++ mutex_lock(&card->discipline_mutex); + if (!card->discipline) { + if (card->info.type == QETH_CARD_TYPE_IQD) + def_discipline = QETH_DISCIPLINE_LAYER3; +@@ -5938,11 +5942,10 @@ static int qeth_core_set_online(struct c + } + } + +- mutex_lock(&card->discipline_mutex); + rc = card->discipline->set_online(gdev); +- mutex_unlock(&card->discipline_mutex); + + err: ++ mutex_unlock(&card->discipline_mutex); + return rc; + } + +@@ -5972,25 +5975,34 @@ static void qeth_core_shutdown(struct cc + static int qeth_core_freeze(struct ccwgroup_device *gdev) + { + struct qeth_card *card = dev_get_drvdata(&gdev->dev); ++ int rc = 0; ++ mutex_lock(&card->discipline_mutex); + if (card->discipline && card->discipline->freeze) +- return card->discipline->freeze(gdev); +- return 0; ++ rc = card->discipline->freeze(gdev); ++ mutex_unlock(&card->discipline_mutex); ++ return rc; + } + + static int qeth_core_thaw(struct ccwgroup_device *gdev) + { + struct qeth_card *card = dev_get_drvdata(&gdev->dev); ++ int rc = 0; ++ mutex_lock(&card->discipline_mutex); + if (card->discipline && card->discipline->thaw) +- return card->discipline->thaw(gdev); +- return 0; ++ rc = card->discipline->thaw(gdev); ++ mutex_unlock(&card->discipline_mutex); ++ return rc; + } + + static int qeth_core_restore(struct ccwgroup_device *gdev) + { + struct qeth_card *card = dev_get_drvdata(&gdev->dev); ++ int rc = 0; ++ mutex_lock(&card->discipline_mutex); + if (card->discipline && card->discipline->restore) +- return card->discipline->restore(gdev); +- return 0; ++ rc = card->discipline->restore(gdev); ++ mutex_unlock(&card->discipline_mutex); ++ return rc; + } + + static ssize_t group_store(struct device_driver *ddrv, const char *buf, +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -825,11 +825,8 @@ static void qeth_l2_remove_device(struct + qeth_set_allowed_threads(card, 0, 1); + wait_event(card->wait_q, qeth_threads_running(card, 0xffffffff) == 0); + +- if (cgdev->state == CCWGROUP_ONLINE) { +- mutex_lock(&card->discipline_mutex); ++ if (cgdev->state == CCWGROUP_ONLINE) + qeth_l2_set_offline(cgdev); +- mutex_unlock(&card->discipline_mutex); +- } + + cancel_work_sync(&card->close_dev_work); + if (qeth_netdev_is_registered(card->dev)) +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -2475,11 +2475,8 @@ static void qeth_l3_remove_device(struct + qeth_set_allowed_threads(card, 0, 1); + wait_event(card->wait_q, qeth_threads_running(card, 0xffffffff) == 0); + +- if (cgdev->state == CCWGROUP_ONLINE) { +- mutex_lock(&card->discipline_mutex); ++ if (cgdev->state == CCWGROUP_ONLINE) + qeth_l3_set_offline(cgdev); +- mutex_unlock(&card->discipline_mutex); +- } + + cancel_work_sync(&card->close_dev_work); + if (qeth_netdev_is_registered(card->dev)) diff --git a/patches.suse/sched-fair-fix-enqueue_task_fair-warning-some-more.patch b/patches.suse/sched-fair-fix-enqueue_task_fair-warning-some-more.patch new file mode 100644 index 0000000..154ad05 --- /dev/null +++ b/patches.suse/sched-fair-fix-enqueue_task_fair-warning-some-more.patch @@ -0,0 +1,54 @@ +From: Phil Auld +Date: Tue, 12 May 2020 09:52:22 -0400 +Subject: sched/fair: Fix enqueue_task_fair() warning some more +Patch-mainline: v5.7-rc7 +Git-commit: b34cb07dde7c2346dec73d053ce926aeaa087303 +References: bsc#1179093 + +sched/fair: Fix enqueue_task_fair warning some more + +The recent patch, fe61468b2cb (sched/fair: Fix enqueue_task_fair warning) +did not fully resolve the issues with the rq->tmp_alone_branch != +&rq->leaf_cfs_rq_list warning in enqueue_task_fair. There is a case where +the first for_each_sched_entity loop exits due to on_rq, having incompletely +updated the list. In this case the second for_each_sched_entity loop can +further modify se. The later code to fix up the list management fails to do +what is needed because se does not point to the sched_entity which broke out +of the first loop. The list is not fixed up because the throttled parent was +already added back to the list by a task enqueue in a parallel child hierarchy. + +Address this by calling list_add_leaf_cfs_rq if there are throttled parents +while doing the second for_each_sched_entity loop. + +Fixes: fe61468b2cb ("sched/fair: Fix enqueue_task_fair warning") +Suggested-by: Vincent Guittot +Signed-off-by: Phil Auld +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Dietmar Eggemann +Reviewed-by: Vincent Guittot +Link: https://lkml.kernel.org/r/20200512135222.GC2201@lorien.usersys.redhat.com + +Acked-by: Michal Koutný +--- + kernel/sched/fair.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 02f323b85b6d3..c6d57c334d511 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -5479,6 +5479,13 @@ enqueue_task_fair(struct rq *rq, struct task_struct *p, int flags) + /* end evaluation on encountering a throttled cfs_rq */ + if (cfs_rq_throttled(cfs_rq)) + goto enqueue_throttle; ++ ++ /* ++ * One parent has been throttled and cfs_rq removed from the ++ * list. Add it back to not break the leaf list. ++ */ ++ if (throttled_hierarchy(cfs_rq)) ++ list_add_leaf_cfs_rq(cfs_rq); + } + + enqueue_throttle: + diff --git a/patches.suse/sched-fair-fix-enqueue_task_fair-warning.patch b/patches.suse/sched-fair-fix-enqueue_task_fair-warning.patch new file mode 100644 index 0000000..f22953a --- /dev/null +++ b/patches.suse/sched-fair-fix-enqueue_task_fair-warning.patch @@ -0,0 +1,89 @@ +From: Vincent Guittot +Date: Fri, 6 Mar 2020 14:52:57 +0100 +Subject: sched/fair: Fix enqueue_task_fair warning +Patch-mainline: v5.7-rc1 +Git-commit: fe61468b2cbc2b7ce5f8d3bf32ae5001d4c434e9 +References: bsc#1179093 + +When a cfs rq is throttled, the latter and its child are removed from the +leaf list but their nr_running is not changed which includes staying higher +than 1. When a task is enqueued in this throttled branch, the cfs rqs must +be added back in order to ensure correct ordering in the list but this can +only happens if nr_running == 1. +When cfs bandwidth is used, we call unconditionnaly list_add_leaf_cfs_rq() +when enqueuing an entity to make sure that the complete branch will be +added. + +Similarly unthrottle_cfs_rq() can stop adding cfs in the list when a parent +is throttled. Iterate the remaining entity to ensure that the complete +branch will be added in the list. + +Reported-by: Christian Borntraeger +Signed-off-by: Vincent Guittot +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Dietmar Eggemann +Tested-by: Christian Borntraeger +Tested-by: Dietmar Eggemann +Cc: stable@vger.kernel.org +Cc: stable@vger.kernel.org #v5.1+ +Link: https://lkml.kernel.org/r/20200306135257.25044-1-vincent.guittot@linaro.org + +Acked-by: Michal Koutný +--- + kernel/sched/fair.c | 26 ++++++++++++++++++++++---- + 1 file changed, 22 insertions(+), 4 deletions(-) + +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -4085,6 +4085,7 @@ static inline void check_schedstat_requi + #endif + } + ++static inline bool cfs_bandwidth_used(void); + + /* + * MIGRATION +@@ -4163,10 +4164,16 @@ enqueue_entity(struct cfs_rq *cfs_rq, st + __enqueue_entity(cfs_rq, se); + se->on_rq = 1; + +- if (cfs_rq->nr_running == 1) { ++ /* ++ * When bandwidth control is enabled, cfs might have been removed ++ * because of a parent been throttled but cfs->nr_running > 1. Try to ++ * add it unconditionnally. ++ */ ++ if (cfs_rq->nr_running == 1 || cfs_bandwidth_used()) + list_add_leaf_cfs_rq(cfs_rq); ++ ++ if (cfs_rq->nr_running == 1) + check_enqueue_throttle(cfs_rq); +- } + } + + static void __clear_buddies_last(struct sched_entity *se) +@@ -4799,11 +4806,22 @@ void unthrottle_cfs_rq(struct cfs_rq *cf + break; + } + +- assert_list_leaf_cfs_rq(rq); +- + if (!se) + add_nr_running(rq, task_delta); + ++ /* ++ * The cfs_rq_throttled() breaks in the above iteration can result in ++ * incomplete leaf list maintenance, resulting in triggering the ++ * assertion below. ++ */ ++ for_each_sched_entity(se) { ++ cfs_rq = cfs_rq_of(se); ++ ++ list_add_leaf_cfs_rq(cfs_rq); ++ } ++ ++ assert_list_leaf_cfs_rq(rq); ++ + /* determine whether we need to wake up potentially idle cpu */ + if (rq->curr == rq->idle && rq->cfs.nr_running) + resched_curr(rq); diff --git a/patches.suse/sched-fair-fix-reordering-of-enqueue-dequeue_task_fair.patch b/patches.suse/sched-fair-fix-reordering-of-enqueue-dequeue_task_fair.patch new file mode 100644 index 0000000..f6064f7 --- /dev/null +++ b/patches.suse/sched-fair-fix-reordering-of-enqueue-dequeue_task_fair.patch @@ -0,0 +1,74 @@ +From: Vincent Guittot +Date: Fri, 6 Mar 2020 09:42:08 +0100 +Subject: sched/fair: Fix reordering of enqueue/dequeue_task_fair() +Git-commit: 5ab297bab984310267734dfbcc8104566658ebef +References: bsc#1179093 +Patch-mainline: v5.7-rc1 + +Even when a cgroup is throttled, the group se of a child cgroup can still +be enqueued and its gse->on_rq stays true. When a task is enqueued on such +child, we still have to update the load_avg and increase +h_nr_running of the throttled cfs. Nevertheless, the 1st +for_each_sched_entity() loop is skipped because of gse->on_rq == true and the +2nd loop because the cfs is throttled whereas we have to update both +load_avg with the old h_nr_running and increase h_nr_running in such case. + +The same sequence can happen during dequeue when se moves to parent before +breaking in the 1st loop. + +Note that the update of load_avg will effectively happen only once in order +to sync up to the throttled time. Next call for updating load_avg will stop +early because the clock stays unchanged. + +Signed-off-by: Vincent Guittot +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Ingo Molnar +Fixes: 6d4d22468dae ("sched/fair: Reorder enqueue/dequeue_task_fair path") +Link: https://lkml.kernel.org/r/20200306084208.12583-1-vincent.guittot@linaro.org + +[mkoutny: Adjust for missing h_idle_nr_running] +Acked-by: Michal Koutný +--- + kernel/sched/fair.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -5364,14 +5364,14 @@ enqueue_task_fair(struct rq *rq, struct + for_each_sched_entity(se) { + cfs_rq = cfs_rq_of(se); + +- /* end evaluation on encountering a throttled cfs_rq */ +- if (cfs_rq_throttled(cfs_rq)) +- goto enqueue_throttle; +- + update_load_avg(cfs_rq, se, UPDATE_TG); + update_cfs_group(se); + + cfs_rq->h_nr_running++; ++ ++ /* end evaluation on encountering a throttled cfs_rq */ ++ if (cfs_rq_throttled(cfs_rq)) ++ goto enqueue_throttle; + } + + enqueue_throttle: +@@ -5439,14 +5439,14 @@ static void dequeue_task_fair(struct rq + for_each_sched_entity(se) { + cfs_rq = cfs_rq_of(se); + +- /* end evaluation on encountering a throttled cfs_rq */ +- if (cfs_rq_throttled(cfs_rq)) +- goto dequeue_throttle; +- + update_load_avg(cfs_rq, se, UPDATE_TG); + update_cfs_group(se); + + cfs_rq->h_nr_running--; ++ ++ /* end evaluation on encountering a throttled cfs_rq */ ++ if (cfs_rq_throttled(cfs_rq)) ++ goto dequeue_throttle; + } + + dequeue_throttle: diff --git a/patches.suse/sched-fair-fix-unthrottle_cfs_rq-for-leaf_cfs_rq-list.patch b/patches.suse/sched-fair-fix-unthrottle_cfs_rq-for-leaf_cfs_rq-list.patch new file mode 100644 index 0000000..d228ed3 --- /dev/null +++ b/patches.suse/sched-fair-fix-unthrottle_cfs_rq-for-leaf_cfs_rq-list.patch @@ -0,0 +1,94 @@ +From: Vincent Guittot +Date: Wed, 13 May 2020 15:55:28 +0200 +Subject: sched/fair: Fix unthrottle_cfs_rq() for leaf_cfs_rq list +Patch-mainline: v5.7-rc7 +Git-commit: 39f23ce07b9355d05a64ae303ce20d1c4b92b957 +References: bsc#1179093 + +Although not exactly identical, unthrottle_cfs_rq() and enqueue_task_fair() +are quite close and follow the same sequence for enqueuing an entity in the +cfs hierarchy. Modify unthrottle_cfs_rq() to use the same pattern as +enqueue_task_fair(). This fixes a problem already faced with the latter and +add an optimization in the last for_each_sched_entity loop. + +Fixes: fe61468b2cb (sched/fair: Fix enqueue_task_fair warning) +Reported-by Tao Zhou +Signed-off-by: Vincent Guittot +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Phil Auld +Reviewed-by: Ben Segall +Link: https://lkml.kernel.org/r/20200513135528.4742-1-vincent.guittot@linaro.org + +[mkoutny: Adjust for missing idle_h_nr_running and no update_load_avg in +unthrottle_cfs_rq (fixed only in 6212437f0f604 ("sched/fair: Fix runnable_avg +for throttled cfs") v5.7-rc1~179^2~20 ] +Acked-by: Michal Koutný +--- + kernel/sched/fair.c | 34 ++++++++++++++++++++++++++-------- + 1 file changed, 26 insertions(+), 8 deletions(-) + +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -4772,7 +4772,6 @@ void unthrottle_cfs_rq(struct cfs_rq *cf + struct rq *rq = rq_of(cfs_rq); + struct cfs_bandwidth *cfs_b = tg_cfs_bandwidth(cfs_rq->tg); + struct sched_entity *se; +- int enqueue = 1; + long task_delta; + + se = cfs_rq->tg->se[cpu_of(rq)]; +@@ -4795,20 +4794,38 @@ void unthrottle_cfs_rq(struct cfs_rq *cf + task_delta = cfs_rq->h_nr_running; + for_each_sched_entity(se) { + if (se->on_rq) +- enqueue = 0; ++ break; ++ cfs_rq = cfs_rq_of(se); ++ enqueue_entity(cfs_rq, se, ENQUEUE_WAKEUP); ++ ++ cfs_rq->h_nr_running += task_delta; ++ ++ /* end evaluation on encountering a throttled cfs_rq */ ++ if (cfs_rq_throttled(cfs_rq)) ++ goto unthrottle_throttle; ++ } + ++ for_each_sched_entity(se) { + cfs_rq = cfs_rq_of(se); +- if (enqueue) +- enqueue_entity(cfs_rq, se, ENQUEUE_WAKEUP); ++ + cfs_rq->h_nr_running += task_delta; + ++ /* end evaluation on encountering a throttled cfs_rq */ + if (cfs_rq_throttled(cfs_rq)) +- break; ++ goto unthrottle_throttle; ++ ++ /* ++ * One parent has been throttled and cfs_rq removed from the ++ * list. Add it back to not break the leaf list. ++ */ ++ if (throttled_hierarchy(cfs_rq)) ++ list_add_leaf_cfs_rq(cfs_rq); + } + +- if (!se) +- add_nr_running(rq, task_delta); ++ /* At this point se is NULL and we are at root level*/ ++ add_nr_running(rq, task_delta); + ++unthrottle_throttle: + /* + * The cfs_rq_throttled() breaks in the above iteration can result in + * incomplete leaf list maintenance, resulting in triggering the +@@ -4817,7 +4834,8 @@ void unthrottle_cfs_rq(struct cfs_rq *cf + for_each_sched_entity(se) { + cfs_rq = cfs_rq_of(se); + +- list_add_leaf_cfs_rq(cfs_rq); ++ if (list_add_leaf_cfs_rq(cfs_rq)) ++ break; + } + + assert_list_leaf_cfs_rq(rq); diff --git a/patches.suse/sched-fair-reorder-enqueue-dequeue_task_fair-path.patch b/patches.suse/sched-fair-reorder-enqueue-dequeue_task_fair-path.patch new file mode 100644 index 0000000..321c198 --- /dev/null +++ b/patches.suse/sched-fair-reorder-enqueue-dequeue_task_fair-path.patch @@ -0,0 +1,126 @@ +From: Vincent Guittot +Date: Mon, 24 Feb 2020 09:52:14 +0000 +Subject: sched/fair: Reorder enqueue/dequeue_task_fair path +Patch-mainline: v5.7-rc1 +Git-commit: 6d4d22468dae3d8757af9f8b81b848a76ef4409d +References: bsc#1179093 + +The walk through the cgroup hierarchy during the enqueue/dequeue of a task +is split in 2 distinct parts for throttled cfs_rq without any added value +but making code less readable. + +Change the code ordering such that everything related to a cfs_rq +(throttled or not) will be done in the same loop. + +In addition, the same steps ordering is used when updating a cfs_rq: + + - update_load_avg + - update_cfs_group + - update *h_nr_running + +This reordering enables the use of h_nr_running in PELT algorithm. + +No functional and performance changes are expected and have been noticed +during tests. + +Signed-off-by: Vincent Guittot +Signed-off-by: Mel Gorman +Signed-off-by: Ingo Molnar +Reviewed-by: "Dietmar Eggemann " +Acked-by: Peter Zijlstra +Cc: Juri Lelli +Cc: Valentin Schneider +Cc: Phil Auld +Cc: Hillf Danton +Link: https://lore.kernel.org/r/20200224095223.13361-5-mgorman@techsingularity.net + +[mkoutny: Adjusted for missing idle_h_nr_running member] +Acked-by: Michal Koutný +--- + kernel/sched/fair.c | 38 ++++++++++++++++++-------------------- + 1 file changed, 18 insertions(+), 20 deletions(-) + +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -5352,30 +5352,29 @@ enqueue_task_fair(struct rq *rq, struct + cfs_rq = cfs_rq_of(se); + enqueue_entity(cfs_rq, se, flags); + +- /* +- * end evaluation on encountering a throttled cfs_rq +- * +- * note: in the case of encountering a throttled cfs_rq we will +- * post the final h_nr_running increment below. +- */ +- if (cfs_rq_throttled(cfs_rq)) +- break; + cfs_rq->h_nr_running++; + ++ /* end evaluation on encountering a throttled cfs_rq */ ++ if (cfs_rq_throttled(cfs_rq)) ++ goto enqueue_throttle; ++ + flags = ENQUEUE_WAKEUP; + } + + for_each_sched_entity(se) { + cfs_rq = cfs_rq_of(se); +- cfs_rq->h_nr_running++; + ++ /* end evaluation on encountering a throttled cfs_rq */ + if (cfs_rq_throttled(cfs_rq)) +- break; ++ goto enqueue_throttle; + + update_load_avg(cfs_rq, se, UPDATE_TG); + update_cfs_group(se); ++ ++ cfs_rq->h_nr_running++; + } + ++enqueue_throttle: + if (!se) + add_nr_running(rq, 1); + +@@ -5416,16 +5415,12 @@ static void dequeue_task_fair(struct rq + cfs_rq = cfs_rq_of(se); + dequeue_entity(cfs_rq, se, flags); + +- /* +- * end evaluation on encountering a throttled cfs_rq +- * +- * note: in the case of encountering a throttled cfs_rq we will +- * post the final h_nr_running decrement below. +- */ +- if (cfs_rq_throttled(cfs_rq)) +- break; + cfs_rq->h_nr_running--; + ++ /* end evaluation on encountering a throttled cfs_rq */ ++ if (cfs_rq_throttled(cfs_rq)) ++ goto dequeue_throttle; ++ + /* Don't dequeue parent if it has other entities besides us */ + if (cfs_rq->load.weight) { + /* Avoid re-evaluating load for this entity: */ +@@ -5443,15 +5438,18 @@ static void dequeue_task_fair(struct rq + + for_each_sched_entity(se) { + cfs_rq = cfs_rq_of(se); +- cfs_rq->h_nr_running--; + ++ /* end evaluation on encountering a throttled cfs_rq */ + if (cfs_rq_throttled(cfs_rq)) +- break; ++ goto dequeue_throttle; + + update_load_avg(cfs_rq, se, UPDATE_TG); + update_cfs_group(se); ++ ++ cfs_rq->h_nr_running--; + } + ++dequeue_throttle: + if (!se) + sub_nr_running(rq, 1); + diff --git a/patches.suse/scsi-ibmvfc-Set-default-timeout-to-avoid-crash-durin.patch b/patches.suse/scsi-ibmvfc-Set-default-timeout-to-avoid-crash-durin.patch new file mode 100644 index 0000000..e6ba8fc --- /dev/null +++ b/patches.suse/scsi-ibmvfc-Set-default-timeout-to-avoid-crash-durin.patch @@ -0,0 +1,86 @@ +From 764907293edc1af7ac857389af9dc858944f53dc Mon Sep 17 00:00:00 2001 +From: Brian King +Date: Tue, 12 Jan 2021 09:06:38 -0600 +Subject: [PATCH] scsi: ibmvfc: Set default timeout to avoid crash during + migration + +References: bsc#1181425 ltc#188252 +Patch-mainline: v5.11-rc5 +Git-commit: 764907293edc1af7ac857389af9dc858944f53dc + +While testing live partition mobility, we have observed occasional crashes +of the Linux partition. What we've seen is that during the live migration, +for specific configurations with large amounts of memory, slow network +links, and workloads that are changing memory a lot, the partition can end +up being suspended for 30 seconds or longer. This resulted in the following +scenario: + +CPU 0 CPU 1 +------------------------------- ---------------------------------- +scsi_queue_rq migration_store + -> blk_mq_start_request -> rtas_ibm_suspend_me + -> blk_add_timer -> on_each_cpu(rtas_percpu_suspend_me + _______________________________________V + | + V + -> IPI from CPU 1 + -> rtas_percpu_suspend_me + -> __rtas_suspend_last_cpu + +-- Linux partition suspended for > 30 seconds -- + -> for_each_online_cpu(cpu) + plpar_hcall_norets(H_PROD + -> scsi_dispatch_cmd + -> scsi_times_out + -> scsi_abort_command + -> queue_delayed_work + -> ibmvfc_queuecommand_lck + -> ibmvfc_send_event + -> ibmvfc_send_crq + - returns H_CLOSED + <- returns SCSI_MLQUEUE_HOST_BUSY +-> __blk_mq_requeue_request + + -> scmd_eh_abort_handler + -> scsi_try_to_abort_cmd + - returns SUCCESS + -> scsi_queue_insert + +Normally, the SCMD_STATE_COMPLETE bit would protect against the command +completion and the timeout, but that doesn't work here, since we don't +check that at all in the SCSI_MLQUEUE_HOST_BUSY path. + +In this case we end up calling scsi_queue_insert on a request that has +already been queued, or possibly even freed, and we crash. + +The patch below simply increases the default I/O timeout to avoid this race +condition. This is also the timeout value that nearly all IBM SAN storage +recommends setting as the default value. + +Link: https://lore.kernel.org/r/1610463998-19791-1-git-send-email-brking@linux.vnet.ibm.com +Signed-off-by: Brian King +Signed-off-by: Martin K. Petersen +Acked-by: Michal Suchanek +--- + drivers/scsi/ibmvscsi/ibmvfc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c +index 7312f31df878..65f168c41d23 100644 +--- a/drivers/scsi/ibmvscsi/ibmvfc.c ++++ b/drivers/scsi/ibmvscsi/ibmvfc.c +@@ -3007,8 +3007,10 @@ static int ibmvfc_slave_configure(struct scsi_device *sdev) + unsigned long flags = 0; + + spin_lock_irqsave(shost->host_lock, flags); +- if (sdev->type == TYPE_DISK) ++ if (sdev->type == TYPE_DISK) { + sdev->allow_restart = 1; ++ blk_queue_rq_timeout(sdev->request_queue, 120 * HZ); ++ } + spin_unlock_irqrestore(shost->host_lock, flags); + return 0; + } +-- +2.26.2 + diff --git a/patches.suse/scsi-lpfc-Enhancements-to-LOG_TRACE_EVENT-for-better.patch b/patches.suse/scsi-lpfc-Enhancements-to-LOG_TRACE_EVENT-for-better.patch new file mode 100644 index 0000000..33b6349 --- /dev/null +++ b/patches.suse/scsi-lpfc-Enhancements-to-LOG_TRACE_EVENT-for-better.patch @@ -0,0 +1,108 @@ +From: James Smart +Date: Mon, 4 Jan 2021 10:02:39 -0800 +Subject: scsi: lpfc: Enhancements to LOG_TRACE_EVENT for better readability +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git +Git-commit: 0b3ad32e26460affc9d4b2f9c32d7c228e8b0cfb +References: bsc#1180891 + +While testing recent discovery node rework, several items were seen that +could be done better with respect to the new trace event logic. + +1) in the following msg: + kernel: lpfc 0000:44:00.0: start 35 end 35 cnt 0 + If cnt is zero in the 1st message, there is no reason to display the + 1st message, which is just giving start/end positioning. + + Fix by not displaying message if cnt is 0. + +2) If the driver is loaded with module log verbosity off, and later a + single NPIV host instance verbosity is enabled via sysfs, it enables + messages on all instances. This is due to the trace log verbosity checks + (lpfc_dmp_dbg) looking at the phba only. It should look at the phba and + the vport. + + Fix by enabling a check on both phba and vport. + +3) in the following messages: + 2904 Firmware Dump Image Present on Adapter + 2887 Reset Needed: Attempting Port Recovery... + These messages are not necessary for the trace event log, which is + primarily for discovery. + + Fix by changing log level on these 2 messages to LOG_SLI. + +Link: https://lore.kernel.org/r/20210104180240.46824-15-jsmart2021@gmail.com +Co-developed-by: Dick Kennedy +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_init.c | 20 +++++++++++++++++++- + drivers/scsi/lpfc/lpfc_sli.c | 2 +- + 2 files changed, 20 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -1868,7 +1868,7 @@ lpfc_sli4_port_sta_fn_reset(struct lpfc_ + + /* need reset: attempt for port recovery */ + if (en_rn_msg) +- lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, ++ lpfc_printf_log(phba, KERN_ERR, LOG_SLI, + "2887 Reset Needed: Attempting Port " + "Recovery...\n"); + +@@ -14188,15 +14188,32 @@ void lpfc_dmp_dbg(struct lpfc_hba *phba) + int i; + int j = 0; + unsigned long rem_nsec; ++ struct lpfc_vport **vports; + ++ /* Don't dump messages if we explicitly set log_verbose for the ++ * physical port or any vport. ++ */ + if (phba->cfg_log_verbose) + return; + ++ vports = lpfc_create_vport_work_array(phba); ++ if (vports != NULL) { ++ for (i = 0; i <= phba->max_vpi && vports[i] != NULL; i++) { ++ if (vports[i]->cfg_log_verbose) { ++ lpfc_destroy_vport_work_array(phba, vports); ++ return; ++ } ++ } ++ } ++ lpfc_destroy_vport_work_array(phba, vports); ++ + if (atomic_cmpxchg(&phba->dbg_log_dmping, 0, 1) != 0) + return; + + start_idx = (unsigned int)atomic_read(&phba->dbg_log_idx) % DBG_LOG_SZ; + dbg_cnt = (unsigned int)atomic_read(&phba->dbg_log_cnt); ++ if (!dbg_cnt) ++ goto out; + temp_idx = start_idx; + if (dbg_cnt >= DBG_LOG_SZ) { + dbg_cnt = DBG_LOG_SZ; +@@ -14226,6 +14243,7 @@ void lpfc_dmp_dbg(struct lpfc_hba *phba) + rem_nsec / 1000, + phba->dbg_log[temp_idx].log); + } ++out: + atomic_set(&phba->dbg_log_cnt, 0); + atomic_set(&phba->dbg_log_dmping, 0); + } +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -7363,7 +7363,7 @@ static void lpfc_sli4_dip(struct lpfc_hb + return; + + if (bf_get(lpfc_sliport_status_dip, ®_data)) +- lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, ++ lpfc_printf_log(phba, KERN_ERR, LOG_SLI, + "2904 Firmware Dump Image Present" + " on Adapter"); + } diff --git a/patches.suse/scsi-lpfc-Fix-FW-reset-action-if-I-Os-are-outstandin.patch b/patches.suse/scsi-lpfc-Fix-FW-reset-action-if-I-Os-are-outstandin.patch new file mode 100644 index 0000000..eb72f6a --- /dev/null +++ b/patches.suse/scsi-lpfc-Fix-FW-reset-action-if-I-Os-are-outstandin.patch @@ -0,0 +1,44 @@ +From: James Smart +Date: Mon, 4 Jan 2021 10:02:31 -0800 +Subject: scsi: lpfc: Fix FW reset action if I/Os are outstanding +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git +Git-commit: 3ba6216aaded84207362c806fcb4eb6197926db4 +References: bsc#1180891 + +If the port is configured for NVME and has any outstanding IOs when a FW +reset is requesteed, outstanding I/Os are not properly cleaned up. This +causes the fw download request to fail. + +Fix by clearing the LPFC_SLI_ACTIVE flag to signify the I/O must be +manually flushed by the driver on port reset. + +Link: https://lore.kernel.org/r/20210104180240.46824-7-jsmart2021@gmail.com +Co-developed-by: Dick Kennedy +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_init.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -1836,6 +1836,16 @@ lpfc_sli4_port_sta_fn_reset(struct lpfc_ + lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, + "2887 Reset Needed: Attempting Port " + "Recovery...\n"); ++ ++ /* If we are no wait, the HBA has been reset and is not ++ * functional, thus we should clear LPFC_SLI_ACTIVE flag. ++ */ ++ if (mbx_action == LPFC_MBX_NO_WAIT) { ++ spin_lock_irq(&phba->hbalock); ++ phba->sli.sli_flag &= ~LPFC_SLI_ACTIVE; ++ spin_unlock_irq(&phba->hbalock); ++ } ++ + lpfc_offline_prep(phba, mbx_action); + lpfc_sli_flush_io_rings(phba); + lpfc_offline(phba); diff --git a/patches.suse/scsi-lpfc-Fix-NVMe-recovery-after-mailbox-timeout.patch b/patches.suse/scsi-lpfc-Fix-NVMe-recovery-after-mailbox-timeout.patch new file mode 100644 index 0000000..3b0186b --- /dev/null +++ b/patches.suse/scsi-lpfc-Fix-NVMe-recovery-after-mailbox-timeout.patch @@ -0,0 +1,211 @@ +From: James Smart +Date: Mon, 4 Jan 2021 10:02:35 -0800 +Subject: scsi: lpfc: Fix NVMe recovery after mailbox timeout +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git +Git-commit: 9ec58ec7d41a08d79d996407b03b23da69990814 +References: bsc#1180891 + +If a mailbox command times out, the SLI port is deemed in error and the +port is reset. The HBA cleanup is not returning I/Os to the NVMe layer +before the port is unregistered. This is due to the HBA being marked +offline (!SLI_ACTIVE) and cleanup being done by the mailbox timeout handler +rather than an general adapter reset routine. The mailbox timeout handler +mailbox handler only cleaned up SCSI I/Os. + +Fix by reworking the mailbox handler to: + + - After handling the mailbox error, detect the board is already in + failure (may be due to another error), and leave cleanup to the + other handler. + + - If the mailbox command timeout is initial detector of the port error, + continue with the board cleanup and marking the adapter offline + (!SLI_ACTIVE). Remove the SCSI-only I/O cleanup routine. The generic + reset adapter routine that is subsequently invoked, will clean up the + I/Os. + + - Have the reset adapter routine flush all NVMe and SCSI I/Os if the + adapter has been marked failed (!SLI_ACTIVE). + + - Rework the NVMe I/O terminate routine to take a status code to fail the + I/O with and update so that cleaned up I/O calls the wqe completion + routine. Currently it is bypassing the wqe cleanup and calling the NVMe + I/O completion directly. The wqe completion routine will take care of + data structure and node cleanup then call the NVMe I/O completion + handler. + +Link: https://lore.kernel.org/r/20210104180240.46824-11-jsmart2021@gmail.com +Co-developed-by: Dick Kennedy +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_crtn.h | 4 ++-- + drivers/scsi/lpfc/lpfc_init.c | 8 ++++++-- + drivers/scsi/lpfc/lpfc_nvme.c | 33 +++++++++++++++++---------------- + drivers/scsi/lpfc/lpfc_sli.c | 20 ++++++++++++-------- + 4 files changed, 37 insertions(+), 28 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc_crtn.h ++++ b/drivers/scsi/lpfc/lpfc_crtn.h +@@ -256,7 +256,6 @@ void lpfc_nvmet_ctxbuf_post(struct lpfc_ + int lpfc_nvmet_rcv_unsol_abort(struct lpfc_vport *vport, + struct fc_frame_header *fc_hdr); + void lpfc_nvmet_wqfull_process(struct lpfc_hba *phba, struct lpfc_queue *wq); +-void lpfc_sli_flush_nvme_rings(struct lpfc_hba *phba); + void lpfc_nvme_wait_for_io_drain(struct lpfc_hba *phba); + void lpfc_sli4_build_dflt_fcf_record(struct lpfc_hba *, struct fcf_record *, + uint16_t); +@@ -595,7 +594,8 @@ void lpfc_release_io_buf(struct lpfc_hba + void lpfc_io_ktime(struct lpfc_hba *phba, struct lpfc_io_buf *ncmd); + void lpfc_wqe_cmd_template(void); + void lpfc_nvmet_cmd_template(void); +-void lpfc_nvme_cancel_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *pwqeIn); ++void lpfc_nvme_cancel_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *pwqeIn, ++ uint32_t stat, uint32_t param); + extern int lpfc_enable_nvmet_cnt; + extern unsigned long long lpfc_enable_nvmet[]; + extern int lpfc_no_hba_reset_cnt; +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -6195,10 +6195,14 @@ lpfc_reset_hba(struct lpfc_hba *phba) + phba->link_state = LPFC_HBA_ERROR; + return; + } +- if (phba->sli.sli_flag & LPFC_SLI_ACTIVE) ++ ++ /* If not LPFC_SLI_ACTIVE, force all IO to be flushed */ ++ if (phba->sli.sli_flag & LPFC_SLI_ACTIVE) { + lpfc_offline_prep(phba, LPFC_MBX_WAIT); +- else ++ } else { + lpfc_offline_prep(phba, LPFC_MBX_NO_WAIT); ++ lpfc_sli_flush_io_rings(phba); ++ } + lpfc_offline(phba); + lpfc_sli_brdrestart(phba); + lpfc_online(phba); +--- a/drivers/scsi/lpfc/lpfc_nvme.c ++++ b/drivers/scsi/lpfc/lpfc_nvme.c +@@ -2447,14 +2447,17 @@ lpfc_nvme_wait_for_io_drain(struct lpfc_ + } + + void +-lpfc_nvme_cancel_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *pwqeIn) ++lpfc_nvme_cancel_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *pwqeIn, ++ uint32_t stat, uint32_t param) + { + #if (IS_ENABLED(CONFIG_NVME_FC)) + struct lpfc_io_buf *lpfc_ncmd; + struct nvmefc_fcp_req *nCmd; +- struct lpfc_nvme_fcpreq_priv *freqpriv; ++ struct lpfc_wcqe_complete wcqe; ++ struct lpfc_wcqe_complete *wcqep = &wcqe; + +- if (!pwqeIn->context1) { ++ lpfc_ncmd = (struct lpfc_io_buf *)pwqeIn->context1; ++ if (!lpfc_ncmd) { + lpfc_sli_release_iocbq(phba, pwqeIn); + return; + } +@@ -2464,31 +2467,29 @@ lpfc_nvme_cancel_iocb(struct lpfc_hba *p + lpfc_sli_release_iocbq(phba, pwqeIn); + return; + } +- lpfc_ncmd = (struct lpfc_io_buf *)pwqeIn->context1; + + spin_lock(&lpfc_ncmd->buf_lock); +- if (!lpfc_ncmd->nvmeCmd) { ++ nCmd = lpfc_ncmd->nvmeCmd; ++ if (!nCmd) { + spin_unlock(&lpfc_ncmd->buf_lock); + lpfc_release_nvme_buf(phba, lpfc_ncmd); + return; + } ++ spin_unlock(&lpfc_ncmd->buf_lock); + +- nCmd = lpfc_ncmd->nvmeCmd; + lpfc_printf_log(phba, KERN_INFO, LOG_NVME_IOERR, + "6194 NVME Cancel xri %x\n", + lpfc_ncmd->cur_iocbq.sli4_xritag); + +- nCmd->transferred_length = 0; +- nCmd->rcv_rsplen = 0; +- nCmd->status = NVME_SC_INTERNAL; +- freqpriv = nCmd->private; +- freqpriv->nvme_buf = NULL; +- lpfc_ncmd->nvmeCmd = NULL; +- +- spin_unlock(&lpfc_ncmd->buf_lock); +- nCmd->done(nCmd); ++ wcqep->word0 = 0; ++ bf_set(lpfc_wcqe_c_status, wcqep, stat); ++ wcqep->parameter = param; ++ wcqep->word3 = 0; /* xb is 0 */ + + /* Call release with XB=1 to queue the IO into the abort list. */ +- lpfc_release_nvme_buf(phba, lpfc_ncmd); ++ if (phba->sli.sli_flag & LPFC_SLI_ACTIVE) ++ bf_set(lpfc_wcqe_c_xb, wcqep, 1); ++ ++ (pwqeIn->wqe_cmpl)(phba, pwqeIn, wcqep); + #endif + } +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -1535,15 +1535,19 @@ lpfc_sli_cancel_iocbs(struct lpfc_hba *p + + while (!list_empty(iocblist)) { + list_remove_head(iocblist, piocb, struct lpfc_iocbq, list); +- if (!piocb->iocb_cmpl) { ++ if (piocb->wqe_cmpl) { + if (piocb->iocb_flag & LPFC_IO_NVME) +- lpfc_nvme_cancel_iocb(phba, piocb); ++ lpfc_nvme_cancel_iocb(phba, piocb, ++ ulpstatus, ulpWord4); + else + lpfc_sli_release_iocbq(phba, piocb); +- } else { ++ ++ } else if (piocb->iocb_cmpl) { + piocb->iocb.ulpStatus = ulpstatus; + piocb->iocb.un.ulpWord[4] = ulpWord4; + (piocb->iocb_cmpl) (phba, piocb, piocb); ++ } else { ++ lpfc_sli_release_iocbq(phba, piocb); + } + } + return; +@@ -8162,8 +8166,10 @@ lpfc_mbox_timeout_handler(struct lpfc_hb + + struct lpfc_sli *psli = &phba->sli; + +- /* If the mailbox completed, process the completion and return */ +- if (lpfc_sli4_process_missed_mbox_completions(phba)) ++ /* If the mailbox completed, process the completion */ ++ lpfc_sli4_process_missed_mbox_completions(phba); ++ ++ if (!(psli->sli_flag & LPFC_SLI_ACTIVE)) + return; + + if (pmbox != NULL) +@@ -8204,8 +8210,6 @@ lpfc_mbox_timeout_handler(struct lpfc_hb + psli->sli_flag &= ~LPFC_SLI_ACTIVE; + spin_unlock_irq(&phba->hbalock); + +- lpfc_sli_abort_fcp_rings(phba); +- + lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, + "0345 Resetting board due to mailbox timeout\n"); + +@@ -11676,7 +11680,7 @@ lpfc_sli_validate_fcp_iocb(struct lpfc_i + struct lpfc_io_buf *lpfc_cmd; + int rc = 1; + +- if (iocbq->vport != vport) ++ if (!iocbq || iocbq->vport != vport) + return rc; + + if (!(iocbq->iocb_flag & LPFC_IO_FCP) || diff --git a/patches.suse/scsi-lpfc-Fix-PLOGI-S_ID-of-0-on-pt2pt-config.patch b/patches.suse/scsi-lpfc-Fix-PLOGI-S_ID-of-0-on-pt2pt-config.patch new file mode 100644 index 0000000..66fda71 --- /dev/null +++ b/patches.suse/scsi-lpfc-Fix-PLOGI-S_ID-of-0-on-pt2pt-config.patch @@ -0,0 +1,81 @@ +From: James Smart +Date: Mon, 4 Jan 2021 10:02:26 -0800 +Subject: scsi: lpfc: Fix PLOGI S_ID of 0 on pt2pt config +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git +Git-commit: 8e062ce305ad00cccb5631c5dad37b6dc4fa0c67 +References: bsc#1180891 + +Under some pt2pt situations, the other end of the link may issue a LOGO +after successfully completing PLOGI and assigning addresses to the port. +Thus the driver may attempt a new PLOGI to re-create the login, but the +LOGO handling cleared the address back to 0. Once this happens, the other +end, which may be address 0, gets all confused and this cannot be resolved +without an administrative action to bounce the link. + +Fix by assuming that address assignment only occurs on the 1st PLOGI after +link up, and regardless of login state, the address assignment sticks. The +FC standards aren't particularly clear in this situation (it only describes +initial PLOGI), but there is nothing that contradicts this and behaviors on +the devices tested appears to conform to the understanding. + +Thus, don't reset the port address to 0 as part of LOGO handling. Port +addresses will only reset on link down. + +Link: https://lore.kernel.org/r/20210104180240.46824-2-jsmart2021@gmail.com +Co-developed-by: Dick Kennedy +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_els.c | 31 +++++-------------------------- + 1 file changed, 5 insertions(+), 26 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -2815,7 +2815,6 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba + struct lpfc_nodelist *ndlp = (struct lpfc_nodelist *) cmdiocb->context1; + struct lpfc_vport *vport = ndlp->vport; + IOCB_t *irsp; +- struct lpfcMboxq *mbox; + unsigned long flags; + uint32_t skip_recovery = 0; + +@@ -2884,31 +2883,11 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba + lpfc_els_free_iocb(phba, cmdiocb); + lpfc_nlp_put(ndlp); + +- /* If we are in pt2pt mode, we could rcv new S_ID on PLOGI */ +- if ((vport->fc_flag & FC_PT2PT) && +- !(vport->fc_flag & FC_PT2PT_PLOGI)) { +- phba->pport->fc_myDID = 0; +- +- if ((vport->cfg_enable_fc4_type == LPFC_ENABLE_BOTH) || +- (vport->cfg_enable_fc4_type == LPFC_ENABLE_NVME)) { +- if (phba->nvmet_support) +- lpfc_nvmet_update_targetport(phba); +- else +- lpfc_nvme_update_localport(phba->pport); +- } +- +- mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL); +- if (mbox) { +- lpfc_config_link(phba, mbox); +- mbox->mbox_cmpl = lpfc_sli_def_mbox_cmpl; +- mbox->vport = vport; +- if (lpfc_sli_issue_mbox(phba, mbox, MBX_NOWAIT) == +- MBX_NOT_FINISHED) { +- mempool_free(mbox, phba->mbox_mem_pool); +- skip_recovery = 1; +- } +- } +- } ++ /* At this point, the LOGO processing is complete. NOTE: For a ++ * pt2pt topology, we are assuming the NPortID will only change ++ * on link up processing. For a LOGO / PLOGI initiated by the ++ * Initiator, we are assuming the NPortID is not going to change. ++ */ + + /* + * If the node is a target, the handling attempts to recover the port. diff --git a/patches.suse/scsi-lpfc-Fix-auto-sli_mode-and-its-effect-on-CONFIG.patch b/patches.suse/scsi-lpfc-Fix-auto-sli_mode-and-its-effect-on-CONFIG.patch new file mode 100644 index 0000000..2c29a64 --- /dev/null +++ b/patches.suse/scsi-lpfc-Fix-auto-sli_mode-and-its-effect-on-CONFIG.patch @@ -0,0 +1,176 @@ +From: James Smart +Date: Mon, 4 Jan 2021 10:02:27 -0800 +Subject: scsi: lpfc: Fix auto sli_mode and its effect on CONFIG_PORT for SLI3 +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git +Git-commit: d2f2547efd39e9482e25a07c5bddf928dcb12ce7 +References: bsc#1180891 + +A very long time ago, there was a feature: auto sli mode. It gave the user +the ability to auto select the SLI mode (SLI2 or SLI3) to run the port in, +or even force SLI2 mode if configured. Because of the convoluted logic, +the CONFIG_PORT mbox command ends up being called 2 or 3 times. It should +have been called only once. Additionally, the driver no longer supports +SLI-2, so only SLI-3 mode should be allowed. + +The following changes were made: + + - Force module parameter to SLI3 only. + + - Rip out redundant CONFIG_PORT mbox commands. + + - Force CONFIG_PORT mbox command to be in beginning of enable ISR routine. + + - Added changes for offline to online behavior + +Link: https://lore.kernel.org/r/20210104180240.46824-3-jsmart2021@gmail.com +Co-developed-by: Dick Kennedy +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc.h | 1 + drivers/scsi/lpfc/lpfc_attr.c | 7 +----- + drivers/scsi/lpfc/lpfc_init.c | 20 ++++++++++-------- + drivers/scsi/lpfc/lpfc_sli.c | 46 ++++++++++-------------------------------- + 4 files changed, 26 insertions(+), 48 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc.h ++++ b/drivers/scsi/lpfc/lpfc.h +@@ -779,6 +779,7 @@ struct lpfc_hba { + */ + #define HBA_FLOGI_ISSUED 0x100000 /* FLOGI was issued */ + #define HBA_DEFER_FLOGI 0x800000 /* Defer FLOGI till read_sparm cmpl */ ++#define HBA_NEEDS_CFG_PORT 0x2000000 /* SLI3 - needs a CONFIG_PORT mbox */ + + uint32_t fcp_ring_in_use; /* When polling test if intr-hndlr active*/ + struct lpfc_dmabuf slim2p; +--- a/drivers/scsi/lpfc/lpfc_attr.c ++++ b/drivers/scsi/lpfc/lpfc_attr.c +@@ -3448,11 +3448,8 @@ unsigned long lpfc_no_hba_reset[MAX_HBAS + module_param_array(lpfc_no_hba_reset, ulong, &lpfc_no_hba_reset_cnt, 0444); + MODULE_PARM_DESC(lpfc_no_hba_reset, "WWPN of HBAs that should not be reset"); + +-LPFC_ATTR(sli_mode, 0, 0, 3, +- "SLI mode selector:" +- " 0 - auto (SLI-3 if supported)," +- " 2 - select SLI-2 even on SLI-3 capable HBAs," +- " 3 - select SLI-3"); ++LPFC_ATTR(sli_mode, 3, 3, 3, ++ "SLI mode selector: 3 - select SLI-3"); + + LPFC_ATTR_R(enable_npiv, 1, 0, 1, + "Enable NPIV functionality"); +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -10731,17 +10731,19 @@ lpfc_sli_enable_intr(struct lpfc_hba *ph + uint32_t intr_mode = LPFC_INTR_ERROR; + int retval; + ++ /* Need to issue conf_port mbox cmd before conf_msi mbox cmd */ ++ retval = lpfc_sli_config_port(phba, LPFC_SLI_REV3); ++ if (retval) ++ return intr_mode; ++ phba->hba_flag &= ~HBA_NEEDS_CFG_PORT; ++ + if (cfg_mode == 2) { +- /* Need to issue conf_port mbox cmd before conf_msi mbox cmd */ +- retval = lpfc_sli_config_port(phba, LPFC_SLI_REV3); ++ /* Now, try to enable MSI-X interrupt mode */ ++ retval = lpfc_sli_enable_msix(phba); + if (!retval) { +- /* Now, try to enable MSI-X interrupt mode */ +- retval = lpfc_sli_enable_msix(phba); +- if (!retval) { +- /* Indicate initialization to MSI-X mode */ +- phba->intr_type = MSIX; +- intr_mode = 2; +- } ++ /* Indicate initialization to MSI-X mode */ ++ phba->intr_type = MSIX; ++ intr_mode = 2; + } + } + +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -4245,6 +4245,8 @@ lpfc_sli_brdready_s3(struct lpfc_hba *ph + if (lpfc_readl(phba->HSregaddr, &status)) + return 1; + ++ phba->hba_flag |= HBA_NEEDS_CFG_PORT; ++ + /* + * Check status register every 100ms for 5 retries, then every + * 500ms for 5, then every 2.5 sec for 5, then reset board and +@@ -4573,6 +4575,7 @@ lpfc_sli_brdreset(struct lpfc_hba *phba) + /* perform board reset */ + phba->fc_eventTag = 0; + phba->link_events = 0; ++ phba->hba_flag |= HBA_NEEDS_CFG_PORT; + if (phba->pport) { + phba->pport->fc_myDID = 0; + phba->pport->fc_prevDID = 0; +@@ -4906,6 +4909,8 @@ lpfc_sli_chipset_init(struct lpfc_hba *p + return -EIO; + } + ++ phba->hba_flag |= HBA_NEEDS_CFG_PORT; ++ + /* Clear all interrupt enable conditions */ + writel(0, phba->HCregaddr); + readl(phba->HCregaddr); /* flush */ +@@ -5202,45 +5207,18 @@ int + lpfc_sli_hba_setup(struct lpfc_hba *phba) + { + uint32_t rc; +- int mode = 3, i; ++ int i; + int longs; + +- switch (phba->cfg_sli_mode) { +- case 2: +- if (phba->cfg_enable_npiv) { +- lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, +- "1824 NPIV enabled: Override sli_mode " +- "parameter (%d) to auto (0).\n", +- phba->cfg_sli_mode); +- break; +- } +- mode = 2; +- break; +- case 0: +- case 3: +- break; +- default: +- lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, +- "1819 Unrecognized sli_mode parameter: %d.\n", +- phba->cfg_sli_mode); +- +- break; ++ /* Enable ISR already does config_port because of config_msi mbx */ ++ if (phba->hba_flag & HBA_NEEDS_CFG_PORT) { ++ rc = lpfc_sli_config_port(phba, LPFC_SLI_REV3); ++ if (rc) ++ return -EIO; ++ phba->hba_flag &= ~HBA_NEEDS_CFG_PORT; + } + phba->fcp_embed_io = 0; /* SLI4 FC support only */ + +- rc = lpfc_sli_config_port(phba, mode); +- +- if (rc && phba->cfg_sli_mode == 3) +- lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, +- "1820 Unable to select SLI-3. " +- "Not supported by adapter.\n"); +- if (rc && mode != 2) +- rc = lpfc_sli_config_port(phba, 2); +- else if (rc && mode == 2) +- rc = lpfc_sli_config_port(phba, 3); +- if (rc) +- goto lpfc_sli_hba_setup_error; +- + /* Enable PCIe device Advanced Error Reporting (AER) if configured */ + if (phba->cfg_aer_support == 1 && !(phba->hba_flag & HBA_AER_ENABLED)) { + rc = pci_enable_pcie_error_reporting(phba->pcidev); diff --git a/patches.suse/scsi-lpfc-Fix-crash-when-a-fabric-node-is-released-p.patch b/patches.suse/scsi-lpfc-Fix-crash-when-a-fabric-node-is-released-p.patch new file mode 100644 index 0000000..0f53e2e --- /dev/null +++ b/patches.suse/scsi-lpfc-Fix-crash-when-a-fabric-node-is-released-p.patch @@ -0,0 +1,100 @@ +From: James Smart +Date: Mon, 4 Jan 2021 10:02:29 -0800 +Subject: scsi: lpfc: Fix crash when a fabric node is released prematurely +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git +Git-commit: 07aaefdf75c50b55e1f1e1c904fa6d00466e0a75 +References: bsc#1180891 + +The driver's management of the fabric controller (aka pseudo-scsi +initiator) node in SLI3 mode is causing this crash. The crash occurs +because of a node reference imbalance that frees the fabric controller node +while devloss is outstanding from the SCSI transport. This is triggered by +an odd behavior where the switch reacts to a rejected RDP request with a +PLOGI and nothing else, not even a LOGO. The driver ACKS the PLOGI and +after successfully registering the RPI, incorrectly registers the fabric +controller node because it has the NLP_FC4_FCP flag still set from the +fabric controller PRLI. If a LIP is issued, the driver attempts to cleanup +on Link Up and ends up executing too many puts. + +Fix by detecting the fabric node type and clearing out the nodes internal +flags that triggered a SCSI transport registration and subsequence dev_loss +event. The driver cannot count on any persistence from fabric controller +nodes. + +Link: https://lore.kernel.org/r/20210104180240.46824-5-jsmart2021@gmail.com +Co-developed-by: Dick Kennedy +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_hbadisc.c | 18 +++++++++++++----- + drivers/scsi/lpfc/lpfc_nportdisc.c | 8 +++++++- + 2 files changed, 20 insertions(+), 6 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc_hbadisc.c ++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c +@@ -75,6 +75,16 @@ static void lpfc_unregister_fcfi_cmpl(st + static int lpfc_fcf_inuse(struct lpfc_hba *); + static void lpfc_mbx_cmpl_read_sparam(struct lpfc_hba *, LPFC_MBOXQ_t *); + ++static int ++lpfc_valid_xpt_node(struct lpfc_nodelist *ndlp) ++{ ++ if (ndlp->nlp_fc4_type || ++ ndlp->nlp_DID == Fabric_DID || ++ ndlp->nlp_DID == NameServer_DID || ++ ndlp->nlp_DID == FDMI_DID) ++ return 1; ++ return 0; ++} + /* The source of a terminate rport I/O is either a dev_loss_tmo + * event or a call to fc_remove_host. While the rport should be + * valid during these downcalls, the transport can call twice +@@ -4314,7 +4324,8 @@ lpfc_nlp_state_cleanup(struct lpfc_vport + /* FCP and NVME Transport interface */ + if ((old_state == NLP_STE_MAPPED_NODE || + old_state == NLP_STE_UNMAPPED_NODE)) { +- if (ndlp->rport) { ++ if (ndlp->rport && ++ lpfc_valid_xpt_node(ndlp)) { + vport->phba->nport_event_cnt++; + lpfc_unregister_remote_port(ndlp); + } +@@ -4336,10 +4347,7 @@ lpfc_nlp_state_cleanup(struct lpfc_vport + + if (new_state == NLP_STE_MAPPED_NODE || + new_state == NLP_STE_UNMAPPED_NODE) { +- if (ndlp->nlp_fc4_type || +- ndlp->nlp_DID == Fabric_DID || +- ndlp->nlp_DID == NameServer_DID || +- ndlp->nlp_DID == FDMI_DID) { ++ if (lpfc_valid_xpt_node(ndlp)) { + vport->phba->nport_event_cnt++; + /* + * Tell the fc transport about the port, if we haven't +--- a/drivers/scsi/lpfc/lpfc_nportdisc.c ++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c +@@ -1012,7 +1012,12 @@ lpfc_rcv_prli(struct lpfc_vport *vport, + ndlp->nlp_fc4_type |= NLP_FC4_NVME; + lpfc_nlp_set_state(vport, ndlp, NLP_STE_UNMAPPED_NODE); + } +- if (npr->prliType == PRLI_FCP_TYPE) ++ ++ /* Fabric Controllers send FCP PRLI as an initiator but should ++ * not get recognized as FCP type and registered with transport. ++ */ ++ if (npr->prliType == PRLI_FCP_TYPE && ++ !(ndlp->nlp_type & NLP_FABRIC)) + ndlp->nlp_fc4_type |= NLP_FC4_FCP; + } + if (rport) { +@@ -2035,6 +2040,7 @@ lpfc_cmpl_reglogin_reglogin_issue(struct + * must complete PRLI. + */ + if (ndlp->nlp_type & NLP_FABRIC) { ++ ndlp->nlp_fc4_type &= ~NLP_FC4_FCP; + ndlp->nlp_prev_state = NLP_STE_REG_LOGIN_ISSUE; + lpfc_nlp_set_state(vport, ndlp, NLP_STE_UNMAPPED_NODE); + } diff --git a/patches.suse/scsi-lpfc-Fix-error-log-messages-being-logged-follow.patch b/patches.suse/scsi-lpfc-Fix-error-log-messages-being-logged-follow.patch new file mode 100644 index 0000000..6af38e6 --- /dev/null +++ b/patches.suse/scsi-lpfc-Fix-error-log-messages-being-logged-follow.patch @@ -0,0 +1,97 @@ +From: James Smart +Date: Mon, 4 Jan 2021 10:02:33 -0800 +Subject: scsi: lpfc: Fix error log messages being logged following SCSI task + mgnt +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git +Git-commit: da09ae4864e10b1436d129e1d2fc1029172c74fa +References: bsc#1180891 + +A successful task mgmt command is logging errors, making it look like +problems were encountered. This is due to log messages for the +device/target and bus reset handlers having the LOG_TRACE_EVENT flag set. + +Fix by adjusting the event flag such that the call to the logging routine +only receives a LOG_TRACE_EVENT if a prior call actually failed. + +Link: https://lore.kernel.org/r/20210104180240.46824-9-jsmart2021@gmail.com +Co-developed-by: Dick Kennedy +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_scsi.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc_scsi.c ++++ b/drivers/scsi/lpfc/lpfc_scsi.c +@@ -5849,6 +5849,7 @@ lpfc_device_reset_handler(struct scsi_cm + uint64_t lun_id = cmnd->device->lun; + struct lpfc_scsi_event_header scsi_event; + int status; ++ u32 logit = LOG_FCP; + + rdata = lpfc_rport_data_from_scsi_device(cmnd->device); + if (!rdata || !rdata->pnode) { +@@ -5880,8 +5881,10 @@ lpfc_device_reset_handler(struct scsi_cm + + status = lpfc_send_taskmgmt(vport, cmnd, tgt_id, lun_id, + FCP_LUN_RESET); ++ if (status != SUCCESS) ++ logit = LOG_TRACE_EVENT; + +- lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, ++ lpfc_printf_vlog(vport, KERN_ERR, logit, + "0713 SCSI layer issued Device Reset (%d, %llu) " + "return x%x\n", tgt_id, lun_id, status); + +@@ -5920,6 +5923,7 @@ lpfc_target_reset_handler(struct scsi_cm + uint64_t lun_id = cmnd->device->lun; + struct lpfc_scsi_event_header scsi_event; + int status; ++ u32 logit = LOG_FCP; + + rdata = lpfc_rport_data_from_scsi_device(cmnd->device); + if (!rdata || !rdata->pnode) { +@@ -5959,8 +5963,10 @@ lpfc_target_reset_handler(struct scsi_cm + + status = lpfc_send_taskmgmt(vport, cmnd, tgt_id, lun_id, + FCP_TARGET_RESET); ++ if (status != SUCCESS) ++ logit = LOG_TRACE_EVENT; + +- lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, ++ lpfc_printf_vlog(vport, KERN_ERR, logit, + "0723 SCSI layer issued Target Reset (%d, %llu) " + "return x%x\n", tgt_id, lun_id, status); + +@@ -5996,6 +6002,7 @@ lpfc_bus_reset_handler(struct scsi_cmnd + struct lpfc_scsi_event_header scsi_event; + int match; + int ret = SUCCESS, status, i; ++ u32 logit = LOG_FCP; + + scsi_event.event_type = FC_REG_SCSI_EVENT; + scsi_event.subcategory = LPFC_EVENT_BUSRESET; +@@ -6056,8 +6063,10 @@ lpfc_bus_reset_handler(struct scsi_cmnd + status = lpfc_reset_flush_io_context(vport, 0, 0, LPFC_CTX_HOST); + if (status != SUCCESS) + ret = FAILED; ++ if (ret == FAILED) ++ logit = LOG_TRACE_EVENT; + +- lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, ++ lpfc_printf_vlog(vport, KERN_ERR, logit, + "0714 SCSI layer issued Bus Reset Data: x%x\n", ret); + return ret; + } +@@ -6086,7 +6095,7 @@ lpfc_host_reset_handler(struct scsi_cmnd + struct lpfc_hba *phba = vport->phba; + int rc, ret = SUCCESS; + +- lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, ++ lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP, + "3172 SCSI layer issued Host Reset Data:\n"); + + lpfc_offline_prep(phba, LPFC_MBX_WAIT); diff --git a/patches.suse/scsi-lpfc-Fix-target-reset-failing.patch b/patches.suse/scsi-lpfc-Fix-target-reset-failing.patch new file mode 100644 index 0000000..97c73ad --- /dev/null +++ b/patches.suse/scsi-lpfc-Fix-target-reset-failing.patch @@ -0,0 +1,144 @@ +From: James Smart +Date: Mon, 4 Jan 2021 10:02:34 -0800 +Subject: scsi: lpfc: Fix target reset failing +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git +Git-commit: 31051249f12e225c446bc8208a4734279d2c743d +References: bsc#1180891 + +Target reset is failed by the target as an invalid command. + +The Target Reset TMF has been obsoleted in T10 for a while, but continues +to be used. On (newer) devices, the TMF is rejected causing the reset +handler to escalate to adapter resets. + +Fix by having Target Reset TMF rejections be translated into a LOGO and +re-PLOGI with the target device. This provides the same semantic action +(although, if the device also supports nvme traffic, it will terminate nvme +traffic as well - but it's still recoverable). + +Link: https://lore.kernel.org/r/20210104180240.46824-10-jsmart2021@gmail.com +Co-developed-by: Dick Kennedy +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_disc.h | 3 +++ + drivers/scsi/lpfc/lpfc_els.c | 7 +++++++ + drivers/scsi/lpfc/lpfc_scsi.c | 38 ++++++++++++++++++++++++++++++++++++-- + 3 files changed, 46 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc_disc.h ++++ b/drivers/scsi/lpfc/lpfc_disc.h +@@ -135,14 +135,17 @@ struct lpfc_nodelist { + struct lpfc_scsicmd_bkt *lat_data; /* Latency data */ + uint32_t fc4_prli_sent; + uint32_t fc4_xpt_flags; ++ uint32_t upcall_flags; + #define NLP_WAIT_FOR_UNREG 0x1 + #define SCSI_XPT_REGD 0x2 + #define NVME_XPT_REGD 0x4 ++#define NLP_WAIT_FOR_LOGO 0x2 + + + uint32_t nvme_fb_size; /* NVME target's supported byte cnt */ + #define NVME_FB_BIT_SHIFT 9 /* PRLI Rsp first burst in 512B units. */ + uint32_t nlp_defer_did; ++ wait_queue_head_t *logo_waitq; + }; + + struct lpfc_node_rrq { +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -2817,6 +2817,7 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba + IOCB_t *irsp; + unsigned long flags; + uint32_t skip_recovery = 0; ++ int wake_up_waiter = 0; + + /* we pass cmdiocb to state machine which needs rspiocb as well */ + cmdiocb->context_un.rsp_iocb = rspiocb; +@@ -2824,6 +2825,10 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba + irsp = &(rspiocb->iocb); + spin_lock_irq(&ndlp->lock); + ndlp->nlp_flag &= ~NLP_LOGO_SND; ++ if (ndlp->upcall_flags & NLP_WAIT_FOR_LOGO) { ++ wake_up_waiter = 1; ++ ndlp->upcall_flags &= ~NLP_WAIT_FOR_LOGO; ++ } + spin_unlock_irq(&ndlp->lock); + + lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, +@@ -2889,6 +2894,8 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba + * Initiator, we are assuming the NPortID is not going to change. + */ + ++ if (wake_up_waiter && ndlp->logo_waitq) ++ wake_up(ndlp->logo_waitq); + /* + * If the node is a target, the handling attempts to recover the port. + * For any other port type, the rpi is unregistered as an implicit +--- a/drivers/scsi/lpfc/lpfc_scsi.c ++++ b/drivers/scsi/lpfc/lpfc_scsi.c +@@ -5924,6 +5924,8 @@ lpfc_target_reset_handler(struct scsi_cm + struct lpfc_scsi_event_header scsi_event; + int status; + u32 logit = LOG_FCP; ++ unsigned long flags; ++ DECLARE_WAIT_QUEUE_HEAD_ONSTACK(waitq); + + rdata = lpfc_rport_data_from_scsi_device(cmnd->device); + if (!rdata || !rdata->pnode) { +@@ -5942,10 +5944,10 @@ lpfc_target_reset_handler(struct scsi_cm + lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, + "0722 Target Reset rport failure: rdata x%px\n", rdata); + if (pnode) { +- spin_lock_irq(&pnode->lock); ++ spin_lock_irqsave(&pnode->lock, flags); + pnode->nlp_flag &= ~NLP_NPR_ADISC; + pnode->nlp_fcp_info &= ~NLP_FCP_2_DEVICE; +- spin_unlock_irq(&pnode->lock); ++ spin_unlock_irqrestore(&pnode->lock, flags); + } + lpfc_reset_flush_io_context(vport, tgt_id, lun_id, + LPFC_CTX_TGT); +@@ -5965,6 +5967,38 @@ lpfc_target_reset_handler(struct scsi_cm + FCP_TARGET_RESET); + if (status != SUCCESS) + logit = LOG_TRACE_EVENT; ++ spin_lock_irqsave(&pnode->lock, flags); ++ if (status != SUCCESS && ++ (!(pnode->upcall_flags & NLP_WAIT_FOR_LOGO)) && ++ !pnode->logo_waitq) { ++ pnode->logo_waitq = &waitq; ++ pnode->nlp_fcp_info &= ~NLP_FCP_2_DEVICE; ++ pnode->nlp_flag |= NLP_ISSUE_LOGO; ++ pnode->upcall_flags |= NLP_WAIT_FOR_LOGO; ++ spin_unlock_irqrestore(&pnode->lock, flags); ++ lpfc_unreg_rpi(vport, pnode); ++ wait_event_timeout(waitq, ++ (!(pnode->upcall_flags & NLP_WAIT_FOR_LOGO)), ++ msecs_to_jiffies(vport->cfg_devloss_tmo * ++ 1000)); ++ ++ if (pnode->upcall_flags & NLP_WAIT_FOR_LOGO) { ++ lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, ++ "0725 SCSI layer TGTRST failed & LOGO TMO " ++ " (%d, %llu) return x%x\n", tgt_id, ++ lun_id, status); ++ spin_lock_irqsave(&pnode->lock, flags); ++ pnode->upcall_flags &= ~NLP_WAIT_FOR_LOGO; ++ } else { ++ spin_lock_irqsave(&pnode->lock, flags); ++ } ++ pnode->logo_waitq = NULL; ++ spin_unlock_irqrestore(&pnode->lock, flags); ++ status = SUCCESS; ++ } else { ++ status = FAILED; ++ spin_unlock_irqrestore(&pnode->lock, flags); ++ } + + lpfc_printf_vlog(vport, KERN_ERR, logit, + "0723 SCSI layer issued Target Reset (%d, %llu) " diff --git a/patches.suse/scsi-lpfc-Fix-vport-create-logging.patch b/patches.suse/scsi-lpfc-Fix-vport-create-logging.patch new file mode 100644 index 0000000..7f0b482 --- /dev/null +++ b/patches.suse/scsi-lpfc-Fix-vport-create-logging.patch @@ -0,0 +1,37 @@ +From: James Smart +Date: Mon, 4 Jan 2021 10:02:36 -0800 +Subject: scsi: lpfc: Fix vport create logging +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git +Git-commit: ff8a44bff5ef8e22cabead4ef3ab523a0e45291b +References: bsc#1180891 + +When with testing with large numbers of npiv vports and link bounces, the +driver is flooding the messages file, even with log_verbose = 0. + +The new LOG_TRACE_EVENT messages are still generating events to the +messages files. + +Fix by converting the vport create msg from LOG_TRACE_EVENT to LOG_VPORT. + +Link: https://lore.kernel.org/r/20210104180240.46824-12-jsmart2021@gmail.com +Co-developed-by: Dick Kennedy +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_vport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/lpfc/lpfc_vport.c ++++ b/drivers/scsi/lpfc/lpfc_vport.c +@@ -478,7 +478,7 @@ lpfc_vport_create(struct fc_vport *fc_vp + rc = VPORT_OK; + + out: +- lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, ++ lpfc_printf_vlog(vport, KERN_ERR, LOG_VPORT, + "1825 Vport Created.\n"); + lpfc_host_attrib_init(lpfc_shost_from_vport(vport)); + error_out: diff --git a/patches.suse/scsi-lpfc-Implement-health-checking-when-aborting-I-.patch b/patches.suse/scsi-lpfc-Implement-health-checking-when-aborting-I-.patch new file mode 100644 index 0000000..af009ef --- /dev/null +++ b/patches.suse/scsi-lpfc-Implement-health-checking-when-aborting-I-.patch @@ -0,0 +1,505 @@ +From: James Smart +Date: Mon, 4 Jan 2021 10:02:38 -0800 +Subject: scsi: lpfc: Implement health checking when aborting I/O +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git +Git-commit: a22d73b655a8ec6d41f08790e28ee19dc55d0d33 +References: bsc#1180891 + +Several errors have occurred where the adapter stops or fails but does not +raise the register values for the driver to detect failure. Thus driver is +unaware of the failure. The failure typically results in I/O timeouts, the +I/O timeout handler failing (after several seconds), and the error handler +escalating recovery policy and resulting in more errors. Eventually, the +driver is in a position where things have spiraled and it can't do recovery +because other recovery ops are still outstanding and it becomes unusable. + +Resolve the situation by having the I/O timeout handler (actually a els, +SCSI I/O, NVMe ls, or NVMe I/O timeout), in addition to aborting the I/O, +perform a mailbox command and look for a response from the hardware. If +the mailbox command fails, it will mark the adapter offline and then invoke +the adapter reset handler to clean up. + +The new I/O timeout test will be limited to a test every 5s. If there are +multiple I/O timeouts concurrently, only the 1st I/O timeout will generate +the mailbox command. Further testing will only occur once a timeout occurs +after a 5s delay from the last mailbox command has expired. + +Link: https://lore.kernel.org/r/20210104180240.46824-14-jsmart2021@gmail.com +Co-developed-by: Dick Kennedy +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc.h | 3 + drivers/scsi/lpfc/lpfc_attr.c | 2 + drivers/scsi/lpfc/lpfc_crtn.h | 2 + drivers/scsi/lpfc/lpfc_els.c | 9 + + drivers/scsi/lpfc/lpfc_hbadisc.c | 3 + drivers/scsi/lpfc/lpfc_init.c | 177 ++++++++++++++++++++++--------------- + drivers/scsi/lpfc/lpfc_nportdisc.c | 2 + drivers/scsi/lpfc/lpfc_nvme.c | 8 + + drivers/scsi/lpfc/lpfc_scsi.c | 3 + drivers/scsi/lpfc/lpfc_sli.c | 44 ++++++++- + 10 files changed, 178 insertions(+), 75 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc.h ++++ b/drivers/scsi/lpfc/lpfc.h +@@ -780,6 +780,8 @@ struct lpfc_hba { + #define HBA_FLOGI_ISSUED 0x100000 /* FLOGI was issued */ + #define HBA_DEFER_FLOGI 0x800000 /* Defer FLOGI till read_sparm cmpl */ + #define HBA_NEEDS_CFG_PORT 0x2000000 /* SLI3 - needs a CONFIG_PORT mbox */ ++#define HBA_HBEAT_INP 0x4000000 /* mbox HBEAT is in progress */ ++#define HBA_HBEAT_TMO 0x8000000 /* HBEAT initiated after timeout */ + + uint32_t fcp_ring_in_use; /* When polling test if intr-hndlr active*/ + struct lpfc_dmabuf slim2p; +@@ -1135,7 +1137,6 @@ struct lpfc_hba { + unsigned long last_completion_time; + unsigned long skipped_hb; + struct timer_list hb_tmofunc; +- uint8_t hb_outstanding; + struct timer_list rrq_tmr; + enum hba_temp_state over_temp_state; + /* +--- a/drivers/scsi/lpfc/lpfc_attr.c ++++ b/drivers/scsi/lpfc/lpfc_attr.c +@@ -1791,6 +1791,8 @@ lpfc_board_mode_store(struct device *dev + else if (strncmp(buf, "pci_bus_reset", sizeof("pci_bus_reset") - 1) + == 0) + status = lpfc_reset_pci_bus(phba); ++ else if (strncmp(buf, "heartbeat", sizeof("heartbeat") - 1) == 0) ++ lpfc_issue_hb_tmo(phba); + else if (strncmp(buf, "trunk", sizeof("trunk") - 1) == 0) + status = lpfc_set_trunking(phba, (char *)buf + sizeof("trunk")); + else +--- a/drivers/scsi/lpfc/lpfc_crtn.h ++++ b/drivers/scsi/lpfc/lpfc_crtn.h +@@ -360,6 +360,8 @@ lpfc_sli_abort_taskmgmt(struct lpfc_vpor + + void lpfc_mbox_timeout(struct timer_list *t); + void lpfc_mbox_timeout_handler(struct lpfc_hba *); ++int lpfc_issue_hb_mbox(struct lpfc_hba *phba); ++void lpfc_issue_hb_tmo(struct lpfc_hba *phba); + + struct lpfc_nodelist *lpfc_findnode_did(struct lpfc_vport *, uint32_t); + struct lpfc_nodelist *lpfc_findnode_wwpn(struct lpfc_vport *, +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -1428,6 +1428,9 @@ lpfc_els_abort_flogi(struct lpfc_hba *ph + NULL); + } + } ++ /* Make sure HBA is alive */ ++ lpfc_issue_hb_tmo(phba); ++ + spin_unlock_irq(&phba->hbalock); + + return 0; +@@ -8127,6 +8130,9 @@ lpfc_els_timeout_handler(struct lpfc_vpo + spin_unlock_irq(&phba->hbalock); + } + ++ /* Make sure HBA is alive */ ++ lpfc_issue_hb_tmo(phba); ++ + if (!list_empty(&pring->txcmplq)) + if (!(phba->pport->load_flag & FC_UNLOADING)) + mod_timer(&vport->els_tmofunc, +@@ -8226,6 +8232,9 @@ lpfc_els_flush_cmd(struct lpfc_vport *vp + lpfc_sli_issue_abort_iotag(phba, pring, piocb, NULL); + spin_unlock_irqrestore(&phba->hbalock, iflags); + } ++ /* Make sure HBA is alive */ ++ lpfc_issue_hb_tmo(phba); ++ + if (!list_empty(&abort_list)) + lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, + "3387 abort list for txq not empty\n"); +--- a/drivers/scsi/lpfc/lpfc_hbadisc.c ++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c +@@ -5616,6 +5616,9 @@ lpfc_free_tx(struct lpfc_hba *phba, stru + } + spin_unlock_irq(&phba->hbalock); + ++ /* Make sure HBA is alive */ ++ lpfc_issue_hb_tmo(phba); ++ + /* Cancel all the IOCBs from the completions list */ + lpfc_sli_cancel_iocbs(phba, &completions, IOSTAT_LOCAL_REJECT, + IOERR_SLI_ABORTED); +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -594,7 +594,7 @@ lpfc_config_port_post(struct lpfc_hba *p + /* Set up heart beat (HB) timer */ + mod_timer(&phba->hb_tmofunc, + jiffies + msecs_to_jiffies(1000 * LPFC_HB_MBOX_INTERVAL)); +- phba->hb_outstanding = 0; ++ phba->hba_flag &= ~(HBA_HBEAT_INP | HBA_HBEAT_TMO); + phba->last_completion_time = jiffies; + /* Set up error attention (ERATT) polling timer */ + mod_timer(&phba->eratt_poll, +@@ -1207,10 +1207,10 @@ lpfc_hb_mbox_cmpl(struct lpfc_hba * phba + unsigned long drvr_flag; + + spin_lock_irqsave(&phba->hbalock, drvr_flag); +- phba->hb_outstanding = 0; ++ phba->hba_flag &= ~(HBA_HBEAT_INP | HBA_HBEAT_TMO); + spin_unlock_irqrestore(&phba->hbalock, drvr_flag); + +- /* Check and reset heart-beat timer is necessary */ ++ /* Check and reset heart-beat timer if necessary */ + mempool_free(pmboxq, phba->mbox_mem_pool); + if (!(phba->pport->fc_flag & FC_OFFLINE_MODE) && + !(phba->link_state == LPFC_HBA_ERROR) && +@@ -1384,6 +1384,60 @@ static void lpfc_hb_mxp_handler(struct l + } + + /** ++ * lpfc_issue_hb_mbox - Issues heart-beat mailbox command ++ * @phba: pointer to lpfc hba data structure. ++ * ++ * If a HB mbox is not already in progrees, this routine will allocate ++ * a LPFC_MBOXQ_t, populate it with a MBX_HEARTBEAT (0x31) command, ++ * and issue it. The HBA_HBEAT_INP flag means the command is in progress. ++ **/ ++int ++lpfc_issue_hb_mbox(struct lpfc_hba *phba) ++{ ++ LPFC_MBOXQ_t *pmboxq; ++ int retval; ++ ++ /* Is a Heartbeat mbox already in progress */ ++ if (phba->hba_flag & HBA_HBEAT_INP) ++ return 0; ++ ++ pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL); ++ if (!pmboxq) ++ return -ENOMEM; ++ ++ lpfc_heart_beat(phba, pmboxq); ++ pmboxq->mbox_cmpl = lpfc_hb_mbox_cmpl; ++ pmboxq->vport = phba->pport; ++ retval = lpfc_sli_issue_mbox(phba, pmboxq, MBX_NOWAIT); ++ ++ if (retval != MBX_BUSY && retval != MBX_SUCCESS) { ++ mempool_free(pmboxq, phba->mbox_mem_pool); ++ return -ENXIO; ++ } ++ phba->hba_flag |= HBA_HBEAT_INP; ++ ++ return 0; ++} ++ ++/** ++ * lpfc_issue_hb_tmo - Signals heartbeat timer to issue mbox command ++ * @phba: pointer to lpfc hba data structure. ++ * ++ * The heartbeat timer (every 5 sec) will fire. If the HBA_HBEAT_TMO ++ * flag is set, it will force a MBX_HEARTBEAT mbox command, regardless ++ * of the value of lpfc_enable_hba_heartbeat. ++ * If lpfc_enable_hba_heartbeat is set, the timeout routine will always ++ * try to issue a MBX_HEARTBEAT mbox command. ++ **/ ++void ++lpfc_issue_hb_tmo(struct lpfc_hba *phba) ++{ ++ if (phba->cfg_enable_hba_heartbeat) ++ return; ++ phba->hba_flag |= HBA_HBEAT_TMO; ++} ++ ++/** + * lpfc_hb_timeout_handler - The HBA-timer timeout handler + * @phba: pointer to lpfc hba data structure. + * +@@ -1403,9 +1457,9 @@ void + lpfc_hb_timeout_handler(struct lpfc_hba *phba) + { + struct lpfc_vport **vports; +- LPFC_MBOXQ_t *pmboxq; + struct lpfc_dmabuf *buf_ptr; +- int retval, i; ++ int retval = 0; ++ int i, tmo; + struct lpfc_sli *psli = &phba->sli; + LIST_HEAD(completions); + +@@ -1427,24 +1481,6 @@ lpfc_hb_timeout_handler(struct lpfc_hba + (phba->pport->fc_flag & FC_OFFLINE_MODE)) + return; + +- spin_lock_irq(&phba->pport->work_port_lock); +- +- if (time_after(phba->last_completion_time + +- msecs_to_jiffies(1000 * LPFC_HB_MBOX_INTERVAL), +- jiffies)) { +- spin_unlock_irq(&phba->pport->work_port_lock); +- if (!phba->hb_outstanding) +- mod_timer(&phba->hb_tmofunc, +- jiffies + +- msecs_to_jiffies(1000 * LPFC_HB_MBOX_INTERVAL)); +- else +- mod_timer(&phba->hb_tmofunc, +- jiffies + +- msecs_to_jiffies(1000 * LPFC_HB_MBOX_TIMEOUT)); +- return; +- } +- spin_unlock_irq(&phba->pport->work_port_lock); +- + if (phba->elsbuf_cnt && + (phba->elsbuf_cnt == phba->elsbuf_prev_cnt)) { + spin_lock_irq(&phba->hbalock); +@@ -1464,37 +1500,43 @@ lpfc_hb_timeout_handler(struct lpfc_hba + + /* If there is no heart beat outstanding, issue a heartbeat command */ + if (phba->cfg_enable_hba_heartbeat) { +- if (!phba->hb_outstanding) { ++ /* If IOs are completing, no need to issue a MBX_HEARTBEAT */ ++ spin_lock_irq(&phba->pport->work_port_lock); ++ if (time_after(phba->last_completion_time + ++ msecs_to_jiffies(1000 * LPFC_HB_MBOX_INTERVAL), ++ jiffies)) { ++ spin_unlock_irq(&phba->pport->work_port_lock); ++ if (phba->hba_flag & HBA_HBEAT_INP) ++ tmo = (1000 * LPFC_HB_MBOX_TIMEOUT); ++ else ++ tmo = (1000 * LPFC_HB_MBOX_INTERVAL); ++ goto out; ++ } ++ spin_unlock_irq(&phba->pport->work_port_lock); ++ ++ /* Check if a MBX_HEARTBEAT is already in progress */ ++ if (phba->hba_flag & HBA_HBEAT_INP) { ++ /* ++ * If heart beat timeout called with HBA_HBEAT_INP set ++ * we need to give the hb mailbox cmd a chance to ++ * complete or TMO. ++ */ ++ lpfc_printf_log(phba, KERN_WARNING, LOG_INIT, ++ "0459 Adapter heartbeat still outstanding: " ++ "last compl time was %d ms.\n", ++ jiffies_to_msecs(jiffies ++ - phba->last_completion_time)); ++ tmo = (1000 * LPFC_HB_MBOX_TIMEOUT); ++ } else { + if ((!(psli->sli_flag & LPFC_SLI_MBOX_ACTIVE)) && + (list_empty(&psli->mboxq))) { +- pmboxq = mempool_alloc(phba->mbox_mem_pool, +- GFP_KERNEL); +- if (!pmboxq) { +- mod_timer(&phba->hb_tmofunc, +- jiffies + +- msecs_to_jiffies(1000 * +- LPFC_HB_MBOX_INTERVAL)); +- return; +- } + +- lpfc_heart_beat(phba, pmboxq); +- pmboxq->mbox_cmpl = lpfc_hb_mbox_cmpl; +- pmboxq->vport = phba->pport; +- retval = lpfc_sli_issue_mbox(phba, pmboxq, +- MBX_NOWAIT); +- +- if (retval != MBX_BUSY && +- retval != MBX_SUCCESS) { +- mempool_free(pmboxq, +- phba->mbox_mem_pool); +- mod_timer(&phba->hb_tmofunc, +- jiffies + +- msecs_to_jiffies(1000 * +- LPFC_HB_MBOX_INTERVAL)); +- return; ++ retval = lpfc_issue_hb_mbox(phba); ++ if (retval) { ++ tmo = (1000 * LPFC_HB_MBOX_INTERVAL); ++ goto out; + } + phba->skipped_hb = 0; +- phba->hb_outstanding = 1; + } else if (time_before_eq(phba->last_completion_time, + phba->skipped_hb)) { + lpfc_printf_log(phba, KERN_INFO, LOG_INIT, +@@ -1505,30 +1547,23 @@ lpfc_hb_timeout_handler(struct lpfc_hba + } else + phba->skipped_hb = jiffies; + +- mod_timer(&phba->hb_tmofunc, +- jiffies + +- msecs_to_jiffies(1000 * LPFC_HB_MBOX_TIMEOUT)); +- return; +- } else { +- /* +- * If heart beat timeout called with hb_outstanding set +- * we need to give the hb mailbox cmd a chance to +- * complete or TMO. +- */ +- lpfc_printf_log(phba, KERN_WARNING, LOG_INIT, +- "0459 Adapter heartbeat still out" +- "standing:last compl time was %d ms.\n", +- jiffies_to_msecs(jiffies +- - phba->last_completion_time)); +- mod_timer(&phba->hb_tmofunc, +- jiffies + +- msecs_to_jiffies(1000 * LPFC_HB_MBOX_TIMEOUT)); ++ tmo = (1000 * LPFC_HB_MBOX_TIMEOUT); ++ goto out; + } + } else { +- mod_timer(&phba->hb_tmofunc, +- jiffies + +- msecs_to_jiffies(1000 * LPFC_HB_MBOX_INTERVAL)); ++ /* Check to see if we want to force a MBX_HEARTBEAT */ ++ if (phba->hba_flag & HBA_HBEAT_TMO) { ++ retval = lpfc_issue_hb_mbox(phba); ++ if (retval) ++ tmo = (1000 * LPFC_HB_MBOX_INTERVAL); ++ else ++ tmo = (1000 * LPFC_HB_MBOX_TIMEOUT); ++ goto out; ++ } ++ tmo = (1000 * LPFC_HB_MBOX_INTERVAL); + } ++out: ++ mod_timer(&phba->hb_tmofunc, jiffies + msecs_to_jiffies(tmo)); + } + + /** +@@ -2992,7 +3027,7 @@ lpfc_stop_hba_timers(struct lpfc_hba *ph + del_timer_sync(&phba->rrq_tmr); + phba->hba_flag &= ~HBA_RRQ_ACTIVE; + } +- phba->hb_outstanding = 0; ++ phba->hba_flag &= ~(HBA_HBEAT_INP | HBA_HBEAT_TMO); + + switch (phba->pci_dev_grp) { + case LPFC_PCI_DEV_LP: +--- a/drivers/scsi/lpfc/lpfc_nportdisc.c ++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c +@@ -252,6 +252,8 @@ lpfc_els_abort(struct lpfc_hba *phba, st + lpfc_sli_issue_abort_iotag(phba, pring, iocb, NULL); + spin_unlock_irq(&phba->hbalock); + } ++ /* Make sure HBA is alive */ ++ lpfc_issue_hb_tmo(phba); + + INIT_LIST_HEAD(&abort_list); + +--- a/drivers/scsi/lpfc/lpfc_nvme.c ++++ b/drivers/scsi/lpfc/lpfc_nvme.c +@@ -1699,6 +1699,10 @@ lpfc_nvme_fcp_abort(struct nvme_fc_local + + spin_unlock(&lpfc_nbuf->buf_lock); + spin_unlock_irqrestore(&phba->hbalock, flags); ++ ++ /* Make sure HBA is alive */ ++ lpfc_issue_hb_tmo(phba); ++ + if (ret_val != WQE_SUCCESS) { + lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, + "6137 Failed abts issue_wqe with status x%x " +@@ -2444,6 +2448,10 @@ lpfc_nvme_wait_for_io_drain(struct lpfc_ + } + } + } ++ ++ /* Make sure HBA is alive */ ++ lpfc_issue_hb_tmo(phba); ++ + } + + void +--- a/drivers/scsi/lpfc/lpfc_scsi.c ++++ b/drivers/scsi/lpfc/lpfc_scsi.c +@@ -5479,6 +5479,9 @@ lpfc_abort_handler(struct scsi_cmnd *cmn + lpfc_sli_abort_fcp_cmpl); + } + ++ /* Make sure HBA is alive */ ++ lpfc_issue_hb_tmo(phba); ++ + if (ret_val != IOCB_SUCCESS) { + /* Indicate the IO is not being aborted by the driver. */ + lpfc_cmd->waitq = NULL; +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -4111,6 +4111,8 @@ lpfc_sli_abort_iocb_ring(struct lpfc_hba + lpfc_sli_issue_abort_iotag(phba, pring, iocb, NULL); + spin_unlock_irq(&phba->hbalock); + } ++ /* Make sure HBA is alive */ ++ lpfc_issue_hb_tmo(phba); + + /* Cancel all the IOCBs from the completions list */ + lpfc_sli_cancel_iocbs(phba, &completions, IOSTAT_LOCAL_REJECT, +@@ -7916,7 +7918,7 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phb + /* Start heart beat timer */ + mod_timer(&phba->hb_tmofunc, + jiffies + msecs_to_jiffies(1000 * LPFC_HB_MBOX_INTERVAL)); +- phba->hb_outstanding = 0; ++ phba->hba_flag &= ~(HBA_HBEAT_INP | HBA_HBEAT_TMO); + phba->last_completion_time = jiffies; + + /* start eq_delay heartbeat */ +@@ -11090,6 +11092,9 @@ lpfc_sli_host_down(struct lpfc_vport *vp + } + spin_unlock_irqrestore(&phba->hbalock, flags); + ++ /* Make sure HBA is alive */ ++ lpfc_issue_hb_tmo(phba); ++ + /* Cancel all the IOCBs from the completions list */ + lpfc_sli_cancel_iocbs(phba, &completions, IOSTAT_LOCAL_REJECT, + IOERR_SLI_DOWN); +@@ -12901,7 +12906,21 @@ lpfc_sli_sp_intr_handler(int irq, void * + spin_unlock_irqrestore( + &phba->pport->work_port_lock, + iflag); +- lpfc_mbox_cmpl_put(phba, pmb); ++ ++ /* Do NOT queue MBX_HEARTBEAT to the worker ++ * thread for processing. ++ */ ++ if (pmbox->mbxCommand == MBX_HEARTBEAT) { ++ /* Process mbox now */ ++ phba->sli.mbox_active = NULL; ++ phba->sli.sli_flag &= ++ ~LPFC_SLI_MBOX_ACTIVE; ++ if (pmb->mbox_cmpl) ++ pmb->mbox_cmpl(phba, pmb); ++ } else { ++ /* Queue to worker thread to process */ ++ lpfc_mbox_cmpl_put(phba, pmb); ++ } + } + } else + spin_unlock_irqrestore(&phba->hbalock, iflag); +@@ -13497,7 +13516,26 @@ lpfc_sli4_sp_handle_mbox_event(struct lp + phba->pport->work_port_events &= ~WORKER_MBOX_TMO; + spin_unlock_irqrestore(&phba->pport->work_port_lock, iflags); + +- /* There is mailbox completion work to do */ ++ /* Do NOT queue MBX_HEARTBEAT to the worker thread for processing. */ ++ if (pmbox->mbxCommand == MBX_HEARTBEAT) { ++ spin_lock_irqsave(&phba->hbalock, iflags); ++ /* Release the mailbox command posting token */ ++ phba->sli.sli_flag &= ~LPFC_SLI_MBOX_ACTIVE; ++ phba->sli.mbox_active = NULL; ++ if (bf_get(lpfc_trailer_consumed, mcqe)) ++ lpfc_sli4_mq_release(phba->sli4_hba.mbx_wq); ++ spin_unlock_irqrestore(&phba->hbalock, iflags); ++ ++ /* Post the next mbox command, if there is one */ ++ lpfc_sli4_post_async_mbox(phba); ++ ++ /* Process cmpl now */ ++ if (pmb->mbox_cmpl) ++ pmb->mbox_cmpl(phba, pmb); ++ return false; ++ } ++ ++ /* There is mailbox completion work to queue to the worker thread */ + spin_lock_irqsave(&phba->hbalock, iflags); + __lpfc_mbox_cmpl_put(phba, pmb); + phba->work_ha |= HA_MBATT; diff --git a/patches.suse/scsi-lpfc-Prevent-duplicate-requests-to-unregister-w.patch b/patches.suse/scsi-lpfc-Prevent-duplicate-requests-to-unregister-w.patch new file mode 100644 index 0000000..82104c8 --- /dev/null +++ b/patches.suse/scsi-lpfc-Prevent-duplicate-requests-to-unregister-w.patch @@ -0,0 +1,44 @@ +From: James Smart +Date: Mon, 4 Jan 2021 10:02:32 -0800 +Subject: scsi: lpfc: Prevent duplicate requests to unregister with cpuhp + framework +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git +Git-commit: f0871ab68a8b9db3bc89859169204f774fe707fd +References: bsc#1180891 + +In the lpfc offline routine, called for various reasons such as sysfs +attribute, driver unload, or port error, the driver is calling +__lpfc_cpuhp_remove() to destroy the hot plug data. If the offline routine +is called while the driver is in the process of being unloaded, a request +using lpfc_cpuhp_remove() is also made from lpfc_sli4_hba_unset(). The +cpuhp elements are no longer valid when the second removal request is made. + +Fix by only calling the cpuhp removal once when the adapter is in the +process of unloading. + +Link: https://lore.kernel.org/r/20210104180240.46824-8-jsmart2021@gmail.com +Co-developed-by: Dick Kennedy +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_init.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -3605,7 +3605,11 @@ lpfc_offline(struct lpfc_hba *phba) + spin_unlock_irq(shost->host_lock); + } + lpfc_destroy_vport_work_array(phba, vports); +- __lpfc_cpuhp_remove(phba); ++ /* If OFFLINE flag is clear (i.e. unloading), cpuhp removal is handled ++ * in hba_unset ++ */ ++ if (phba->pport->fc_flag & FC_OFFLINE_MODE) ++ __lpfc_cpuhp_remove(phba); + + if (phba->cfg_xri_rebalancing) + lpfc_destroy_multixri_pools(phba); diff --git a/patches.suse/scsi-lpfc-Refresh-ndlp-when-a-new-PRLI-is-received-i.patch b/patches.suse/scsi-lpfc-Refresh-ndlp-when-a-new-PRLI-is-received-i.patch new file mode 100644 index 0000000..f664c49 --- /dev/null +++ b/patches.suse/scsi-lpfc-Refresh-ndlp-when-a-new-PRLI-is-received-i.patch @@ -0,0 +1,64 @@ +From: James Smart +Date: Mon, 4 Jan 2021 10:02:28 -0800 +Subject: scsi: lpfc: Refresh ndlp when a new PRLI is received in the PRLI + issue state +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git +Git-commit: ecf041fe9895c3f5c0119fb427fa634a275c9382 +References: bsc#1180891 + +Testing with target ports coming and going, the driver eventually reached a +state where it no longer discovered the target. When the driver has issued +a PRLI and receives a PRLI from the target, it is not properly updating the +node's initiator/target role flags. Thus, when a subsequent RSCN is +received for a target loss, the driver mis-identifies the target as an +initiator and does not initiate LUN scanning. + +Fix by always refreshing the ndlp with the latest PRLI state information +whenever a PRLI is processed. Also clear the ndlp flags when processing a +PLOGI so that there is no carry over through a re-login. + +Link: https://lore.kernel.org/r/20210104180240.46824-4-jsmart2021@gmail.com +Co-developed-by: Dick Kennedy +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_nportdisc.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/scsi/lpfc/lpfc_nportdisc.c ++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c +@@ -473,6 +473,15 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, + */ + if (!(ndlp->nlp_type & NLP_FABRIC) && + !(phba->nvmet_support)) { ++ /* Clear ndlp info, since follow up PRLI may have ++ * updated ndlp information ++ */ ++ ndlp->nlp_type &= ~(NLP_FCP_TARGET | NLP_FCP_INITIATOR); ++ ndlp->nlp_type &= ~(NLP_NVME_TARGET | NLP_NVME_INITIATOR); ++ ndlp->nlp_fcp_info &= ~NLP_FCP_2_DEVICE; ++ ndlp->nlp_nvme_info &= ~NLP_NVME_NSLER; ++ ndlp->nlp_flag &= ~NLP_FIRSTBURST; ++ + lpfc_els_rsp_acc(vport, ELS_CMD_PLOGI, cmdiocb, + ndlp, NULL); + return 1; +@@ -496,6 +505,7 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, + ndlp->nlp_type &= ~(NLP_FCP_TARGET | NLP_FCP_INITIATOR); + ndlp->nlp_type &= ~(NLP_NVME_TARGET | NLP_NVME_INITIATOR); + ndlp->nlp_fcp_info &= ~NLP_FCP_2_DEVICE; ++ ndlp->nlp_nvme_info &= ~NLP_NVME_NSLER; + ndlp->nlp_flag &= ~NLP_FIRSTBURST; + + login_mbox = NULL; +@@ -2098,6 +2108,7 @@ lpfc_rcv_prli_prli_issue(struct lpfc_vpo + + if (!lpfc_rcv_prli_support_check(vport, ndlp, cmdiocb)) + return ndlp->nlp_state; ++ lpfc_rcv_prli(vport, ndlp, cmdiocb); + lpfc_els_rsp_prli_acc(vport, cmdiocb, ndlp); + return ndlp->nlp_state; + } diff --git a/patches.suse/scsi-lpfc-Simplify-bool-comparison.patch b/patches.suse/scsi-lpfc-Simplify-bool-comparison.patch new file mode 100644 index 0000000..1b9c503 --- /dev/null +++ b/patches.suse/scsi-lpfc-Simplify-bool-comparison.patch @@ -0,0 +1,36 @@ +From: YANG LI +Date: Tue, 12 Jan 2021 16:24:53 +0800 +Subject: scsi: lpfc: Simplify bool comparison +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git +Git-commit: af0c94afc0c495da3d48448892b7509ac84528dc +References: bsc#1180891 + +Fix the following coccicheck warning: + +./drivers/scsi/lpfc/lpfc_bsg.c:5392:5-29: WARNING: Comparison to bool + +Link: https://lore.kernel.org/r/1610439893-64872-1-git-send-email-abaci-bugfix@linux.alibaba.com +Reported-by: Abaci Robot +Reviewed-by: James Smart +Signed-off-by: YANG LI +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_bsg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc_bsg.c ++++ b/drivers/scsi/lpfc/lpfc_bsg.c +@@ -5379,9 +5379,9 @@ lpfc_check_fwlog_support(struct lpfc_hba + + ras_fwlog = &phba->ras_fwlog; + +- if (ras_fwlog->ras_hwsupport == false) ++ if (!ras_fwlog->ras_hwsupport) + return -EACCES; +- else if (ras_fwlog->ras_enabled == false) ++ else if (!ras_fwlog->ras_enabled) + return -EPERM; + else + return 0; diff --git a/patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.7.patch b/patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.7.patch new file mode 100644 index 0000000..ac34e62 --- /dev/null +++ b/patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.7.patch @@ -0,0 +1,31 @@ +From: James Smart +Date: Mon, 4 Jan 2021 10:02:40 -0800 +Subject: scsi: lpfc: Update lpfc version to 12.8.0.7 +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git +Git-commit: 181dd9a4c2c63b23b19035c95f46008f2693499f +References: bsc#1180891 + +Update lpfc version to 12.8.0.7 + +Link: https://lore.kernel.org/r/20210104180240.46824-16-jsmart2021@gmail.com +Co-developed-by: Dick Kennedy +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_version.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/lpfc/lpfc_version.h ++++ b/drivers/scsi/lpfc/lpfc_version.h +@@ -20,7 +20,7 @@ + * included with this package. * + *******************************************************************/ + +-#define LPFC_DRIVER_VERSION "12.8.0.6" ++#define LPFC_DRIVER_VERSION "12.8.0.7" + #define LPFC_DRIVER_NAME "lpfc" + + /* Used for SLI 2/3 */ diff --git a/patches.suse/scsi-lpfc-Use-the-nvme-fc-transport-supplied-timeout.patch b/patches.suse/scsi-lpfc-Use-the-nvme-fc-transport-supplied-timeout.patch new file mode 100644 index 0000000..a7ba550 --- /dev/null +++ b/patches.suse/scsi-lpfc-Use-the-nvme-fc-transport-supplied-timeout.patch @@ -0,0 +1,55 @@ +From: James Smart +Date: Mon, 4 Jan 2021 10:02:30 -0800 +Subject: scsi: lpfc: Use the nvme-fc transport supplied timeout for LS + requests +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git +Git-commit: c33b1609344f8ac9ac57339f487ca41d659e0143 +References: bsc#1180891 + +When lpfc generates a GEN_REQUEST wqe for the nvme LS (such as Create +Association), the timeout is set to R_A_TOV without regard to the timeout +value supplied by the nvme-fc transport. The driver should be setting the +timeout to the value passed into the routine. Additionally the caller +should be setting the timeout value to the value in the ls request set by +the nvme transport. Instead, it unconditionally is setting it to a driver +defined value. So the driver actually overrode the value twice. + +Fix by using the timeout provided to the routine, and for the caller, set +the timeout to the ls request timeout value. + +Link: https://lore.kernel.org/r/20210104180240.46824-6-jsmart2021@gmail.com +Co-developed-by: Dick Kennedy +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_nvme.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc_nvme.c ++++ b/drivers/scsi/lpfc/lpfc_nvme.c +@@ -378,7 +378,7 @@ lpfc_nvme_gen_req(struct lpfc_vport *vpo + bf_set(wqe_xri_tag, &wqe->gen_req.wqe_com, genwqe->sli4_xritag); + + /* Word 7 */ +- bf_set(wqe_tmo, &wqe->gen_req.wqe_com, (vport->phba->fc_ratov-1)); ++ bf_set(wqe_tmo, &wqe->gen_req.wqe_com, tmo); + bf_set(wqe_class, &wqe->gen_req.wqe_com, CLASS3); + bf_set(wqe_cmnd, &wqe->gen_req.wqe_com, CMD_GEN_REQUEST64_WQE); + bf_set(wqe_ct, &wqe->gen_req.wqe_com, SLI4_CT_RPI); +@@ -546,12 +546,9 @@ lpfc_nvme_ls_req(struct nvme_fc_local_po + + atomic_inc(&lport->fc4NvmeLsRequests); + +- /* Hardcode the wait to 30 seconds. Connections are failing otherwise. +- * This code allows it all to work. +- */ + ret = lpfc_nvme_gen_req(vport, bmp, pnvme_lsreq->rqstaddr, + pnvme_lsreq, lpfc_nvme_cmpl_gen_req, +- ndlp, 2, 30, 0); ++ ndlp, 2, pnvme_lsreq->timeout, 0); + if (ret != WQE_SUCCESS) { + atomic_inc(&lport->xmt_ls_err); + lpfc_printf_vlog(vport, KERN_ERR, LOG_NVME_DISC, diff --git a/patches.suse/supported-flag b/patches.suse/supported-flag index a15c251..9f3d3bb 100644 --- a/patches.suse/supported-flag +++ b/patches.suse/supported-flag @@ -29,7 +29,7 @@ Signed-off-by: Andreas Gruenbacher --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -4213,6 +4213,14 @@ +@@ -4651,6 +4651,14 @@ unknown_nmi_panic [X86] Cause panic on unknown NMI. @@ -46,7 +46,7 @@ Signed-off-by: Andreas Gruenbacher (default -1 = authorized except for wireless USB, --- a/Documentation/sysctl/kernel.txt +++ b/Documentation/sysctl/kernel.txt -@@ -963,6 +963,18 @@ can be ORed together: +@@ -974,6 +974,18 @@ can be ORed together: signature. 16384 - A soft lockup has previously occurred on the system. 32768 - The kernel has been live patched. @@ -81,7 +81,7 @@ Signed-off-by: Andreas Gruenbacher KERNELVERSION = $(VERSION)$(if $(PATCHLEVEL),.$(PATCHLEVEL)$(if $(SUBLEVEL),.$(SUBLEVEL)))$(EXTRAVERSION) --- a/include/linux/kernel.h +++ b/include/linux/kernel.h -@@ -457,6 +457,9 @@ extern int panic_on_unrecovered_nmi; +@@ -461,6 +461,9 @@ extern int panic_on_unrecovered_nmi; extern int panic_on_io_nmi; extern int panic_on_warn; extern int sysctl_panic_on_rcu_stall; @@ -91,7 +91,7 @@ Signed-off-by: Andreas Gruenbacher extern int sysctl_panic_on_stackoverflow; extern bool crash_kexec_post_notifiers; -@@ -515,7 +518,19 @@ extern enum system_states { +@@ -519,7 +522,19 @@ extern enum system_states { #define TAINT_UNSIGNED_MODULE 13 #define TAINT_SOFTLOCKUP 14 #define TAINT_LIVEPATCH 15 @@ -214,7 +214,7 @@ Signed-off-by: Andreas Gruenbacher /* * Mutex protects: * 1) List of modules (also safely readable with preempt_disable), -@@ -1171,6 +1187,12 @@ static size_t module_flags_taint(struct +@@ -1156,6 +1172,12 @@ static size_t module_flags_taint(struct buf[l++] = taint_flags[i].c_true; } @@ -227,7 +227,7 @@ Signed-off-by: Andreas Gruenbacher return l; } -@@ -1243,6 +1265,33 @@ static ssize_t show_taint(struct module_ +@@ -1228,6 +1250,33 @@ static ssize_t show_taint(struct module_ static struct module_attribute modinfo_taint = __ATTR(taint, 0444, show_taint, NULL); @@ -261,7 +261,7 @@ Signed-off-by: Andreas Gruenbacher static struct module_attribute *modinfo_attrs[] = { &module_uevent, &modinfo_version, -@@ -1251,6 +1300,9 @@ static struct module_attribute *modinfo_ +@@ -1236,6 +1285,9 @@ static struct module_attribute *modinfo_ &modinfo_coresize, &modinfo_initsize, &modinfo_taint, @@ -271,7 +271,7 @@ Signed-off-by: Andreas Gruenbacher #ifdef CONFIG_MODULE_UNLOAD &modinfo_refcnt, #endif -@@ -1806,9 +1858,37 @@ static int mod_sysfs_setup(struct module +@@ -1790,8 +1842,36 @@ static int mod_sysfs_setup(struct module add_sect_attrs(mod, info); add_notes_attrs(mod, info); @@ -296,7 +296,6 @@ Signed-off-by: Andreas Gruenbacher + } +#endif + - kobject_uevent(&mod->mkobj.kobj, KOBJ_ADD); return 0; +#ifdef CONFIG_SUSE_KERNEL_SUPPORTED @@ -309,7 +308,7 @@ Signed-off-by: Andreas Gruenbacher out_unreg_param: module_param_sysfs_remove(mod); out_unreg_holders: -@@ -4325,6 +4405,9 @@ void print_modules(void) +@@ -4344,6 +4424,9 @@ void print_modules(void) if (last_unloaded_module[0]) pr_cont(" [last unloaded: %s]", last_unloaded_module); pr_cont("\n"); @@ -321,7 +320,7 @@ Signed-off-by: Andreas Gruenbacher #ifdef CONFIG_MODVERSIONS --- a/kernel/panic.c +++ b/kernel/panic.c -@@ -321,6 +321,10 @@ const struct taint_flag taint_flags[TAIN +@@ -325,6 +325,10 @@ const struct taint_flag taint_flags[TAIN { 'E', ' ', true }, /* TAINT_UNSIGNED_MODULE */ { 'L', ' ', false }, /* TAINT_SOFTLOCKUP */ { 'K', ' ', true }, /* TAINT_LIVEPATCH */ @@ -332,7 +331,7 @@ Signed-off-by: Andreas Gruenbacher }; /** -@@ -342,6 +346,8 @@ const struct taint_flag taint_flags[TAIN +@@ -346,6 +350,8 @@ const struct taint_flag taint_flags[TAIN * 'E' - Unsigned module has been loaded. * 'L' - A soft lockup has previously occurred. * 'K' - Kernel has been live patched. @@ -343,7 +342,7 @@ Signed-off-by: Andreas Gruenbacher */ --- a/kernel/sysctl.c +++ b/kernel/sysctl.c -@@ -790,6 +790,15 @@ static struct ctl_table kern_table[] = { +@@ -795,6 +795,15 @@ static struct ctl_table kern_table[] = { .extra1 = &pid_max_min, .extra2 = &pid_max_max, }, diff --git a/patches.suse/team-set-dev-needed_headroom-in-team_setup_by_port.patch b/patches.suse/team-set-dev-needed_headroom-in-team_setup_by_port.patch new file mode 100644 index 0000000..840c092 --- /dev/null +++ b/patches.suse/team-set-dev-needed_headroom-in-team_setup_by_port.patch @@ -0,0 +1,29 @@ +From: Eric Dumazet +Date: Fri, 25 Sep 2020 06:38:08 -0700 +Subject: team: set dev->needed_headroom in team_setup_by_port() +Patch-mainline: v5.9 +Git-commit: 89d01748b2354e210b5d4ea47bc25a42a1b42c82 +References: git-fixes + +Some devices set needed_headroom. If we ignore it, we might +end up crashing in various skb_push() for example in ipgre_header() +since some layers assume enough headroom has been reserved. + +Fixes: 1d76efe1577b ("team: add support for non-ethernet devices") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/team/team.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -2088,6 +2088,7 @@ static void team_setup_by_port(struct ne + dev->header_ops = port_dev->header_ops; + dev->type = port_dev->type; + dev->hard_header_len = port_dev->hard_header_len; ++ dev->needed_headroom = port_dev->needed_headroom; + dev->addr_len = port_dev->addr_len; + dev->mtu = port_dev->mtu; + memcpy(dev->broadcast, port_dev->broadcast, port_dev->addr_len); diff --git a/patches.suse/tun-fix-return-value-when-the-number-of-iovs-exceeds.patch b/patches.suse/tun-fix-return-value-when-the-number-of-iovs-exceeds.patch new file mode 100644 index 0000000..48d13c2 --- /dev/null +++ b/patches.suse/tun-fix-return-value-when-the-number-of-iovs-exceeds.patch @@ -0,0 +1,40 @@ +From: Yunjian Wang +Date: Fri, 25 Dec 2020 10:52:16 +0800 +Subject: tun: fix return value when the number of iovs exceeds MAX_SKB_FRAGS +Patch-mainline: v5.11-rc3 +Git-commit: 950271d7cc0b4546af3549d8143c4132d6e1f138 +References: bsc#1109837 + +Currently the tun_napi_alloc_frags() function returns -ENOMEM when the +number of iovs exceeds MAX_SKB_FRAGS + 1. However this is inappropriate, +we should use -EMSGSIZE instead of -ENOMEM. + +The following distinctions are matters: +1. the caller need to drop the bad packet when -EMSGSIZE is returned, + which means meeting a persistent failure. +2. the caller can try again when -ENOMEM is returned, which means + meeting a transient failure. + +Fixes: 90e33d459407 ("tun: enable napi_gro_frags() for TUN/TAP driver") +Signed-off-by: Yunjian Wang +Acked-by: Willem de Bruijn +Acked-by: Jason Wang +Acked-by: Michael S. Tsirkin +Link: https://lore.kernel.org/r/1608864736-24332-1-git-send-email-wangyunjian@huawei.com +Signed-off-by: Jakub Kicinski +Acked-by: Thomas Bogendoerfer +--- + drivers/net/tun.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -1451,7 +1451,7 @@ static struct sk_buff *tun_napi_alloc_fr + int i; + + if (it->nr_segs > MAX_SKB_FRAGS + 1) +- return ERR_PTR(-ENOMEM); ++ return ERR_PTR(-EMSGSIZE); + + local_bh_disable(); + skb = napi_get_frags(&tfile->napi); diff --git a/patches.suse/veth-Adjust-hard_start-offset-on-redirect-XDP-frames.patch b/patches.suse/veth-Adjust-hard_start-offset-on-redirect-XDP-frames.patch new file mode 100644 index 0000000..5648d26 --- /dev/null +++ b/patches.suse/veth-Adjust-hard_start-offset-on-redirect-XDP-frames.patch @@ -0,0 +1,82 @@ +From: Jesper Dangaard Brouer +Date: Thu, 14 May 2020 12:49:43 +0200 +Subject: veth: Adjust hard_start offset on redirect XDP frames +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Patch-mainline: v5.8-rc1 +Git-commit: 5c8572251fabc5bb49fd623c064e95a9daf6a3e3 +References: bsc#1109837 + +When native XDP redirect into a veth device, the frame arrives in the +xdp_frame structure. It is then processed in veth_xdp_rcv_one(), +which can run a new XDP bpf_prog on the packet. Doing so requires +converting xdp_frame to xdp_buff, but the tricky part is that +xdp_frame memory area is located in the top (data_hard_start) memory +area that xdp_buff will point into. + +The current code tried to protect the xdp_frame area, by assigning +xdp_buff.data_hard_start past this memory. This results in 32 bytes +less headroom to expand into via BPF-helper bpf_xdp_adjust_head(). + +This protect step is actually not needed, because BPF-helper +bpf_xdp_adjust_head() already reserve this area, and don't allow +BPF-prog to expand into it. Thus, it is safe to point data_hard_start +directly at xdp_frame memory area. + +Fixes: 9fc8d518d9d5 ("veth: Handle xdp_frames in xdp napi ring") +Reported-by: Mao Wenan +Signed-off-by: Jesper Dangaard Brouer +Signed-off-by: Alexei Starovoitov +Acked-by: Toshiaki Makita +Acked-by: Toke Høiland-Jørgensen +Link: https://lore.kernel.org/bpf/158945338331.97035.5923525383710752178.stgit@firesoul +Acked-by: Thomas Bogendoerfer +--- + drivers/net/veth.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -386,13 +386,15 @@ static struct sk_buff *veth_xdp_rcv_one( + unsigned int *xdp_xmit) + { + void *hard_start = frame->data - frame->headroom; +- void *head = hard_start - sizeof(struct xdp_frame); + int len = frame->len, delta = 0; + struct xdp_frame orig_frame; + struct bpf_prog *xdp_prog; + unsigned int headroom; + struct sk_buff *skb; + ++ /* bpf_xdp_adjust_head() assures BPF cannot access xdp_frame area */ ++ hard_start -= sizeof(struct xdp_frame); ++ + rcu_read_lock(); + xdp_prog = rcu_dereference(rq->xdp_prog); + if (likely(xdp_prog)) { +@@ -414,7 +416,6 @@ static struct sk_buff *veth_xdp_rcv_one( + break; + case XDP_TX: + orig_frame = *frame; +- xdp.data_hard_start = head; + xdp.rxq->mem = frame->mem; + if (unlikely(veth_xdp_tx(rq->dev, &xdp) < 0)) { + trace_xdp_exception(rq->dev, xdp_prog, act); +@@ -426,7 +427,6 @@ static struct sk_buff *veth_xdp_rcv_one( + goto xdp_xmit; + case XDP_REDIRECT: + orig_frame = *frame; +- xdp.data_hard_start = head; + xdp.rxq->mem = frame->mem; + if (xdp_do_redirect(rq->dev, &xdp, xdp_prog)) { + frame = &orig_frame; +@@ -446,7 +446,7 @@ static struct sk_buff *veth_xdp_rcv_one( + rcu_read_unlock(); + + headroom = sizeof(struct xdp_frame) + frame->headroom - delta; +- skb = veth_build_skb(head, headroom, len, 0); ++ skb = veth_build_skb(hard_start, headroom, len, 0); + if (!skb) { + xdp_return_frame(frame); + goto err; diff --git a/patches.suse/vhost-vsock-fix-vhost-vsock-cid-hashing-inconsistent.patch b/patches.suse/vhost-vsock-fix-vhost-vsock-cid-hashing-inconsistent.patch new file mode 100644 index 0000000..a45b486 --- /dev/null +++ b/patches.suse/vhost-vsock-fix-vhost-vsock-cid-hashing-inconsistent.patch @@ -0,0 +1,54 @@ +From: Zha Bin +Date: Tue, 8 Jan 2019 16:07:03 +0800 +Subject: vhost/vsock: fix vhost vsock cid hashing inconsistent +Patch-mainline: v5.0-rc3 +Git-commit: 7fbe078c37aba3088359c9256c1a1d0c3e39ee81 +References: git-fixes + +The vsock core only supports 32bit CID, but the Virtio-vsock spec define +CID (dst_cid and src_cid) as u64 and the upper 32bits is reserved as +zero. This inconsistency causes one bug in vhost vsock driver. The +scenarios is: + + 0. A hash table (vhost_vsock_hash) is used to map an CID to a vsock + object. And hash_min() is used to compute the hash key. hash_min() is + defined as: + (sizeof(val) <= 4 ? hash_32(val, bits) : hash_long(val, bits)). + That means the hash algorithm has dependency on the size of macro + argument 'val'. + 0. In function vhost_vsock_set_cid(), a 64bit CID is passed to + hash_min() to compute the hash key when inserting a vsock object into + the hash table. + 0. In function vhost_vsock_get(), a 32bit CID is passed to hash_min() + to compute the hash key when looking up a vsock for an CID. + +Because the different size of the CID, hash_min() returns different hash +key, thus fails to look up the vsock object for an CID. + +To fix this bug, we keep CID as u64 in the IOCTLs and virtio message +headers, but explicitly convert u64 to u32 when deal with the hash table +and vsock core. + +Fixes: 834e772c8db0 ("vhost/vsock: fix use-after-free in network stack callers") +Link: https://github.com/stefanha/virtio/blob/vsock/trunk/content.tex +Signed-off-by: Zha Bin +Reviewed-by: Liu Jiang +Reviewed-by: Stefan Hajnoczi +Acked-by: Jason Wang +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/vhost/vsock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/vhost/vsock.c ++++ b/drivers/vhost/vsock.c +@@ -642,7 +642,7 @@ static int vhost_vsock_set_cid(struct vh + hash_del_rcu(&vsock->hash); + + vsock->guest_cid = guest_cid; +- hash_add_rcu(vhost_vsock_hash, &vsock->hash, guest_cid); ++ hash_add_rcu(vhost_vsock_hash, &vsock->hash, vsock->guest_cid); + spin_unlock_bh(&vhost_vsock_lock); + + return 0; diff --git a/patches.suse/virtio_net-Keep-vnet-header-zeroed-if-XDP-is-loaded-.patch b/patches.suse/virtio_net-Keep-vnet-header-zeroed-if-XDP-is-loaded-.patch new file mode 100644 index 0000000..f6c275b --- /dev/null +++ b/patches.suse/virtio_net-Keep-vnet-header-zeroed-if-XDP-is-loaded-.patch @@ -0,0 +1,37 @@ +From: Yuya Kusakabe +Date: Tue, 25 Feb 2020 12:32:11 +0900 +Subject: virtio_net: Keep vnet header zeroed if XDP is loaded for small buffer +Patch-mainline: v5.7-rc1 +Git-commit: f1d4884d6871ded0592604b0e72e4a7bd292eab9 +References: git-fixes + +We do not want to care about the vnet header in receive_small() if XDP +is loaded, since we can not know whether or not the packet is modified +by XDP. + +Fixes: f6b10209b90d ("virtio-net: switch to use build_skb() for small buffer") +Signed-off-by: Yuya Kusakabe +Signed-off-by: Daniel Borkmann +Acked-by: Jason Wang +Acked-by: Michael S. Tsirkin +Link: https://lore.kernel.org/bpf/20200225033212.437563-1-yuya.kusakabe@gmail.com +Acked-by: Thomas Bogendoerfer +--- + drivers/net/virtio_net.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -747,10 +747,10 @@ static struct sk_buff *receive_small(str + } + skb_reserve(skb, headroom - delta); + skb_put(skb, len); +- if (!delta) { ++ if (!xdp_prog) { + buf += header_offset; + memcpy(skb_vnet_hdr(skb), buf, vi->hdr_len); +- } /* keep zeroed vnet hdr since packet was changed by bpf */ ++ } /* keep zeroed vnet hdr since XDP is loaded */ + + err: + return skb; diff --git a/patches.suse/x86-kvm-reserve-kvm_feature_msi_ext_dest_id b/patches.suse/x86-kvm-reserve-kvm_feature_msi_ext_dest_id new file mode 100644 index 0000000..59dbc9e --- /dev/null +++ b/patches.suse/x86-kvm-reserve-kvm_feature_msi_ext_dest_id @@ -0,0 +1,48 @@ +From: David Woodhouse +Date: Mon, 19 Oct 2020 15:55:56 +0100 +Subject: x86/kvm: Reserve KVM_FEATURE_MSI_EXT_DEST_ID +Git-commit: 5a169bf04cd2bfdbac967d12eb5b70915b29d7ee +Patch-mainline: v5.10-rc2 +References: bsc#1181001, jsc#ECO-3191 + +No functional change; just reserve the feature bit for now so that VMMs +can start to implement it. + +This will allow the host to indicate that MSI emulation supports 15-bit +destination IDs, allowing up to 32768 CPUs without interrupt remapping. + +cf. https://patchwork.kernel.org/patch/11816693/ for qemu + +Signed-off-by: David Woodhouse +Acked-by: Paolo Bonzini +Message-Id: <4cd59bed05f4b7410d3d1ffd1e997ab53683874d.camel@infradead.org> +Signed-off-by: Paolo Bonzini +Acked-by: Joerg Roedel +--- + Documentation/virtual/kvm/cpuid.txt | 4 ++++ + arch/x86/include/uapi/asm/kvm_para.h | 1 + + 2 files changed, 5 insertions(+) + +--- a/Documentation/virtual/kvm/cpuid.txt ++++ b/Documentation/virtual/kvm/cpuid.txt +@@ -58,6 +58,10 @@ KVM_FEATURE_ASYNC_PF_VMEXIT || + || || can be enabled by setting bit 2 + || || when writing to msr 0x4b564d02 + ------------------------------------------------------------------------------ ++KVM_FEATURE_MSI_EXT_DEST_ID || 15 || guest checks this feature bit ++ || || before using extended destination ++ || || ID bits in MSI address bits 11-5. ++------------------------------------------------------------------------------ + KVM_FEATURE_CLOCKSOURCE_STABLE_BIT || 24 || host will warn if no guest-side + || || per-cpu warps are expected in + || || kvmclock. +--- a/arch/x86/include/uapi/asm/kvm_para.h ++++ b/arch/x86/include/uapi/asm/kvm_para.h +@@ -24,6 +24,7 @@ + #define KVM_FEATURE_PV_EOI 6 + #define KVM_FEATURE_PV_UNHALT 7 + #define KVM_FEATURE_ASYNC_PF_VMEXIT 10 ++#define KVM_FEATURE_MSI_EXT_DEST_ID 15 + + /* The last 8 bits are used to indicate how to interpret the flags field + * in pvclock structure. If no bits are set, all flags are ignored. diff --git a/patches.suse/xdp-Fix-xsk_generic_xmit-errno.patch b/patches.suse/xdp-Fix-xsk_generic_xmit-errno.patch new file mode 100644 index 0000000..3aa7905 --- /dev/null +++ b/patches.suse/xdp-Fix-xsk_generic_xmit-errno.patch @@ -0,0 +1,38 @@ +From: Li RongQing +Date: Thu, 11 Jun 2020 13:11:06 +0800 +Subject: xdp: Fix xsk_generic_xmit errno +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Patch-mainline: v5.8-rc1 +Git-commit: aa2cad0600ed2ca6a0ab39948d4db1666b6c962b +References: bsc#1109837 + +Propagate sock_alloc_send_skb error code, not set it to +EAGAIN unconditionally, when fail to allocate skb, which +might cause that user space unnecessary loops. + +Fixes: 35fcde7f8deb ("xsk: support for Tx") +Signed-off-by: Li RongQing +Signed-off-by: Daniel Borkmann +Acked-by: Björn Töpel +Link: https://lore.kernel.org/bpf/1591852266-24017-1-git-send-email-lirongqing@baidu.com +Acked-by: Thomas Bogendoerfer +--- + net/xdp/xsk.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/net/xdp/xsk.c ++++ b/net/xdp/xsk.c +@@ -257,10 +257,8 @@ static int xsk_generic_xmit(struct sock + + len = desc.len; + skb = sock_alloc_send_skb(sk, len, 1, &err); +- if (unlikely(!skb)) { +- err = -EAGAIN; ++ if (unlikely(!skb)) + goto out; +- } + + skb_put(skb, len); + addr = desc.addr; diff --git a/patches.suse/xhci-make-sure-TRB-is-fully-written-before-giving-it.patch b/patches.suse/xhci-make-sure-TRB-is-fully-written-before-giving-it.patch new file mode 100644 index 0000000..250915e --- /dev/null +++ b/patches.suse/xhci-make-sure-TRB-is-fully-written-before-giving-it.patch @@ -0,0 +1,58 @@ +From 576667bad341516edc4e18eb85acb0a2b4c9c9d9 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Fri, 15 Jan 2021 18:19:06 +0200 +Subject: [PATCH] xhci: make sure TRB is fully written before giving it to the controller +Git-commit: 576667bad341516edc4e18eb85acb0a2b4c9c9d9 +Patch-mainline: v5.11-rc5 +References: git-fixes + +Once the command ring doorbell is rung the xHC controller will parse all +command TRBs on the command ring that have the cycle bit set properly. + +If the driver just started writing the next command TRB to the ring when +hardware finished the previous TRB, then HW might fetch an incomplete TRB +as long as its cycle bit set correctly. + +A command TRB is 16 bytes (128 bits) long. +Driver writes the command TRB in four 32 bit chunks, with the chunk +containing the cycle bit last. This does however not guarantee that +chunks actually get written in that order. + +This was detected in stress testing when canceling URBs with several +connected USB devices. +Two consecutive "Set TR Dequeue pointer" commands got queued right +after each other, and the second one was only partially written when +the controller parsed it, causing the dequeue pointer to be set +to bogus values. This was seen as error messages: + +"Mismatch between completed Set TR Deq Ptr command & xHCI internal state" + +Solution is to add a write memory barrier before writing the cycle bit. + +Cc: +Tested-by: Ross Zwisler +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20210115161907.2875631-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/host/xhci-ring.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 5677b81c0915..cf0c93a90200 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -2931,6 +2931,8 @@ static void queue_trb(struct xhci_hcd *xhci, struct xhci_ring *ring, + trb->field[0] = cpu_to_le32(field1); + trb->field[1] = cpu_to_le32(field2); + trb->field[2] = cpu_to_le32(field3); ++ /* make sure TRB is fully written before giving it to the controller */ ++ wmb(); + trb->field[3] = cpu_to_le32(field4); + + trace_xhci_queue_trb(ring, trb); +-- +2.26.2 + diff --git a/patches.suse/xhci-tegra-Delay-for-disabling-LFPS-detector.patch b/patches.suse/xhci-tegra-Delay-for-disabling-LFPS-detector.patch new file mode 100644 index 0000000..f903026 --- /dev/null +++ b/patches.suse/xhci-tegra-Delay-for-disabling-LFPS-detector.patch @@ -0,0 +1,52 @@ +From da7e0c3c2909a3d9bf8acfe1db3cb213bd7febfb Mon Sep 17 00:00:00 2001 +From: JC Kuo +Date: Fri, 15 Jan 2021 18:19:07 +0200 +Subject: [PATCH] xhci: tegra: Delay for disabling LFPS detector +Git-commit: da7e0c3c2909a3d9bf8acfe1db3cb213bd7febfb +Patch-mainline: v5.11-rc5 +References: git-fixes + +Occasionally, we are seeing some SuperSpeed devices resumes right after +being directed to U3. This commits add 500us delay to ensure LFPS +detector is disabled before sending ACK to firmware. + +[ 16.099363] tegra-xusb 70090000.usb: entering ELPG +[ 16.104343] tegra-xusb 70090000.usb: 2-1 isn't suspended: 0x0c001203 +[ 16.114576] tegra-xusb 70090000.usb: not all ports suspended: -16 +[ 16.120789] tegra-xusb 70090000.usb: entering ELPG failed + +The register write passes through a few flop stages of 32KHz clock domain. +NVIDIA ASIC designer reviewed RTL and suggests 500us delay. + +Cc: stable@vger.kernel.org +Signed-off-by: JC Kuo +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20210115161907.2875631-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/host/xhci-tegra.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c +index 934be1686352..50bb91b6a4b8 100644 +--- a/drivers/usb/host/xhci-tegra.c ++++ b/drivers/usb/host/xhci-tegra.c +@@ -623,6 +623,13 @@ static void tegra_xusb_mbox_handle(struct tegra_xusb *tegra, + enable); + if (err < 0) + break; ++ ++ /* ++ * wait 500us for LFPS detector to be disabled before ++ * sending ACK ++ */ ++ if (!enable) ++ usleep_range(500, 1000); + } + + if (err < 0) { +-- +2.26.2 + diff --git a/series.conf b/series.conf index 4476d7f..3096b98 100644 --- a/series.conf +++ b/series.conf @@ -46136,6 +46136,7 @@ patches.suse/bpf-fix-panic-in-stack_map_get_build_id-on-i386-and-.patch patches.suse/bpf-fix-bpffs-bitfield-pretty-print.patch patches.suse/net-stmmac-Fix-PCI-module-removal-leak.patch + patches.suse/vhost-vsock-fix-vhost-vsock-cid-hashing-inconsistent.patch patches.suse/isdn-i4l-isdn_tty-Fix-some-concurrency-double-free-b.patch patches.suse/bnxt_en-Fix-ring-checking-logic-on-57500-chips.patch patches.suse/bnxt_en-Fix-context-memory-allocation.patch @@ -48192,6 +48193,7 @@ patches.suse/fm10k-Fix-a-potential-NULL-pointer-dereference.patch patches.suse/qmi_wwan-add-Olicard-600.patch patches.suse/netns-provide-pure-entropy-for-net_hash_mix.patch + patches.suse/nfp-validate-the-return-code-from-dev_queue_xmit.patch patches.suse/nfp-disable-netpoll-on-representors.patch patches.suse/openvswitch-fix-flow-actions-reallocation.patch patches.suse/net-rds-force-to-destroy-connection-if-t_sock-is-NUL.patch @@ -48589,6 +48591,7 @@ patches.suse/s390-enable-processes-for-mio-instructions patches.suse/s390-unwind-introduce-stack-unwind-api.patch patches.suse/s390-ftrace-use-have_function_graph_ret_addr_ptr.patch + patches.suse/0001-locking-futex-Allow-low-level-atomic-operations-to-r.patch patches.suse/arm64-Provide-a-command-line-to-disable-spectre_v2-m.patch patches.suse/arm64-Add-sysfs-vulnerability-show-for-spectre-v1.patch patches.suse/arm64-add-sysfs-vulnerability-show-for-meltdown.patch @@ -51849,8 +51852,10 @@ patches.suse/net-mlx5e-Print-a-warning-when-LRO-feature-is-droppe.patch patches.suse/net-hns3-do-not-query-unsupported-commands-in-debugf.patch patches.suse/net-hns3-fix-some-reset-handshake-issue.patch + patches.suse/net-hns3-clear-reset-interrupt-status-in-hclge_irq_h.patch patches.suse/cxgb4-smt-Add-lock-for-atomic_dec_and_test.patch patches.suse/net-hns3-fix-GFP-flag-error-in-hclge_mac_update_stat.patch + patches.suse/net-hns3-fix-interrupt-clearing-error-for-VF.patch patches.suse/0052-xgbe-no-need-to-check-return-value-of-debugfs_create.patch patches.suse/0005-caif-no-need-to-check-return-value-of-debugfs_create.patch patches.suse/netfilter-connlabels-prefer-static-lock-initialiser.patch @@ -51865,8 +51870,10 @@ patches.suse/0003-cirrus-cs89x0-use-devm_platform_ioremap_resource-to-.patch patches.suse/i40e-reduce-stack-usage-in-i40e_set_fc.patch patches.suse/0004-cirrus-cs89x0-remove-set-but-not-used-variable-lp.patch + patches.suse/net-hns3-check-reset-interrupt-status-when-reset-fai.patch patches.suse/IB-mlx5-Support-MLX5_CMD_OP_QUERY_LAG-as-a-DEVX-gene.patch patches.suse/net-mlx5e-ethtool-Fix-a-typo-in-WOL-function-names.patch + patches.suse/net-hns3-fix-error-VF-index-when-setting-VLAN-offloa.patch patches.suse/tools-bpftool-fix-arguments-for-p_err-in-do_event_pi.patch patches.suse/xsk-avoid-store-tearing-when-assigning-queues.patch patches.suse/xsk-avoid-store-tearing-when-assigning-umem.patch @@ -51878,6 +51885,7 @@ patches.suse/msft-hv-1945-hv_netvsc-Allow-scatter-gather-feature-to-be-tunable.patch patches.suse/ixgbe-sync-the-first-fragment-unconditionally.patch patches.suse/i40e-Add-support-for-X710-device.patch + patches.suse/net-hns3-fix-shaper-parameter-algorithm.patch patches.suse/net-hns3-fix-port-setting-handle-for-fibre-port.patch patches.suse/net-mlx5-FWTrace-Reduce-stack-usage.patch patches.suse/nl80211-Fix-possible-Spectre-v1-for-CQM-RSSI-4b2c5a14.patch @@ -51900,6 +51908,7 @@ patches.suse/net-ena-fix-update-of-interrupt-moderation-register.patch patches.suse/net-ena-fix-retrieval-of-nonadaptive-interrupt-moder.patch patches.suse/net-ena-fix-incorrect-update-of-intr_delay_resolutio.patch + patches.suse/net_sched-let-qdisc_put-accept-NULL-pointer.patch patches.suse/net-ena-don-t-wake-up-tx-queue-when-down.patch patches.suse/0001-xen-netfront-do-not-assume-sk_buff_head-list-is-empt.patch patches.suse/btrfs-volumes-Remove-ENOSPC-prone-btrfs_can_relocate.patch @@ -52053,6 +52062,8 @@ patches.suse/0001-drm-amdkfd-fix-a-use-after-free-race-with-mmu_notife.patch patches.suse/IB-hfi1-Remove-unused-define.patch patches.suse/RDMA-hns-Fix-comparison-of-unsigned-long-variable-en.patch + patches.suse/RDMA-hns-Bugfix-for-slab-out-of-bounds-when-unloadin.patch + patches.suse/RDMA-hns-bugfix-for-slab-out-of-bounds-when-loading-.patch patches.suse/RDMA-hns-Remove-the-some-magic-number.patch patches.suse/RDMA-hns-Add-reset-process-for-function-clear.patch patches.suse/RDMA-hns-Fix-wrong-assignment-of-qp_access_flags.patch @@ -52539,6 +52550,8 @@ patches.suse/net-usb-qmi_wwan-add-Telit-0x1050-composition.patch patches.suse/net-update-net_dim-documentation-after-rename.patch patches.suse/net-smc-fix-smcd-link-group-creation-with-vlan-id.patch + patches.suse/net-smc-receive-returns-without-data + patches.suse/net-smc-receive-pending-data-after-rcv_shutdown patches.suse/iwlwifi-pcie-fix-rb_allocator-workqueue-allocation.patch patches.suse/iwlwifi-dbg_ini-fix-memory-leak-in-alloc_sgtable.patch patches.suse/iwlwifi-pcie-fix-memory-leaks-in-iwl_pcie_ctxt_info_.patch @@ -52553,6 +52566,7 @@ patches.suse/ipv4-Return-ENETUNREACH-if-we-can-t-create-route-but.patch patches.suse/net-phy-bcm7xxx-define-soft_reset-for-40nm-EPHY.patch patches.suse/net-bcmgenet-reset-40nm-EPHY-on-energy-detect.patch + patches.suse/net-hns3-fix-mis-counting-IRQ-vector-numbers-issue.patch patches.suse/0001-xen-netback-fix-error-path-of-xenvif_connect_data.patch patches.suse/net-dsa-fix-switch-tree-list.patch patches.suse/x86-boot-64-Make-level2_kernel_pgt-pages-invalid-out.patch @@ -52629,6 +52643,7 @@ patches.suse/SUNRPC-The-RDMA-back-channel-mustn-t-disappear-while.patch patches.suse/NFSv4-Don-t-allow-a-cached-open-with-a-revoked-deleg.patch patches.suse/NFS-Fix-an-RCU-lock-leak-in-nfs4_refresh_delegation_.patch + patches.suse/net-mlx5e-TX-Fix-consumer-index-of-error-cqe-dump.patch patches.suse/net-mlx5-prevent-memory-leak-in-mlx5_fpga_conn_creat.patch patches.suse/r8152-add-device-id-for-Lenovo-ThinkPad-USB-C-Dock-G.patch patches.suse/net-openvswitch-free-vport-unless-register_netdevice.patch @@ -52735,6 +52750,7 @@ patches.suse/0008-net-bcmgenet-reapply-manual-settings-to-the-PHY.patch patches.suse/net-smc-fix-ethernet-interface-refcounting patches.suse/net-mlx5e-Fix-eswitch-debug-print-of-max-fdb-flow.patch + patches.suse/net-hns3-add-compatible-handling-for-command-HCLGE_O.patch patches.suse/NFC-st21nfca-fix-double-free.patch patches.suse/nfc-netlink-fix-double-device-reference-drop.patch patches.suse/CDC-NCM-handle-incomplete-transfer-of-MTU.patch @@ -52827,6 +52843,7 @@ patches.suse/slip-Fix-memory-leak-in-slip_open-error-path.patch patches.suse/net-cdc_ncm-Signedness-bug-in-cdc_ncm_set_dgram_size.patch patches.suse/slcan-Fix-memory-leak-in-error-path.patch + patches.suse/net-hns3-reallocate-SSU-buffer-size-when-pfc_en-chan.patch patches.suse/net-hns3-fix-ETS-bandwidth-validation-bug.patch patches.suse/ax88172a-fix-information-leak-on-short-answers.patch patches.suse/net-smc-fix-fastopen-for-non-blocking-connect @@ -52844,6 +52861,7 @@ patches.suse/net-sched-ensure-opts_len-IP_TUNNEL_OPTS_MAX-in-act_.patch patches.suse/net-mlx4_en-Fix-wrong-limitation-for-number-of-TX-ri.patch patches.suse/net-sched-act_pedit-fix-WARN-in-the-traffic-path.patch + patches.suse/net-hns3-fix-a-wrong-reset-interrupt-status-mask.patch patches.suse/s390-qeth-fix-potential-deadlock-on-workqueue-flush patches.suse/s390-qeth-return-proper-errno-on-io-error patches.suse/net-ibmvnic-Ignore-H_FUNCTION-return-from-H_EOI-to-t.patch @@ -53713,6 +53731,7 @@ patches.suse/net-mlxfw-Fix-out-of-memory-error-in-mfa2-flash-burn.patch patches.suse/dpaa_eth-fix-DMA-mapping-leak.patch patches.suse/net-stmmac-dwmac-meson8b-Fix-the-RGMII-TX-delay-on-M.patch + patches.suse/cxgb4-cxgb4vf-fix-flow-control-display-for-auto-nego.patch patches.suse/ptp-fix-the-race-between-the-release-of-ptp_clock-an.patch patches.suse/pstore-ram-Write-new-dumps-to-start-of-recycled-zone.patch patches.suse/0001-drm-sun4i-hdmi-Remove-duplicate-cleanup-calls.patch @@ -53738,6 +53757,7 @@ patches.suse/ftrace-avoid-potential-division-by-zero-in-function-profiler.patch patches.suse/kernel-trace-fix-do-not-unregister-tracepoints-when-register-sched_migrate_task-fail.patch patches.suse/tcp-fix-old-stuff-D-SACK-causing-SACK-to-be-treated-.patch + patches.suse/0001-net-freescale-fec-Fix-ethtool-d-runtime-PM.patch patches.suse/can-can_dropped_invalid_skb-ensure-an-initialized-he.patch patches.suse/can-gs_usb-gs_usb_probe-use-descriptors-of-current-a.patch patches.suse/can-mscan-mscan_rx_poll-fix-rx-path-lockup-when-retu.patch @@ -53844,6 +53864,8 @@ patches.suse/cfg80211-fix-memory-leak-in-cfg80211_cqm_rssi_update.patch patches.suse/cfg80211-check-for-set_wiphy_params.patch patches.suse/cfg80211-fix-page-refcount-issue-in-A-MSDU-decap.patch + patches.suse/0002-mlxsw-spectrum-Do-not-modify-cloned-SKBs-during-xmit.patch + patches.suse/0003-mlxsw-switchx2-Do-not-modify-cloned-SKBs-during-xmit.patch patches.suse/mlxsw-spectrum-Wipe-xstats.backlog-of-down-ports.patch patches.suse/mlxsw-spectrum_qdisc-Include-MC-TCs-in-Qdisc-counter.patch patches.suse/tcp-fix-marked-lost-packets-not-being-retransmitted.patch @@ -53892,6 +53914,7 @@ patches.suse/tun-add-mutex_unlock-call-and-napi.skb-clearing-in-t.patch patches.suse/libertas-Fix-two-buffer-overflows-at-parsing-bss-des.patch patches.suse/iwlwifi-mvm-fix-NVM-check-for-3168-devices.patch + patches.suse/0004-net-sonic-Add-mutual-exclusion-for-accessing-shared-.patch patches.suse/net_sched-fix-datalen-for-ematch.patch patches.suse/net-cxgb3_main-Add-CAP_NET_ADMIN-check-to-CHELSIO_GE.patch patches.suse/net-mlx5-Fix-lowest-FDB-pool-size.patch @@ -53983,6 +54006,8 @@ patches.suse/crypto-atmel-sha-fix-error-handling-when-setting-hma.patch patches.suse/crypto-caam-qi2-fix-typo-in-algorithm-s-driver-name.patch patches.suse/NFC-port100-Convert-cpu_to_le16-le16_to_cpu-E1-E2-to.patch + patches.suse/0005-net-tulip-Adjust-indentation-in-dmfe-uli526x-_init_m.patch + patches.suse/0006-net-smc911x-Adjust-indentation-in-smc911x_phy_config.patch patches.suse/ppp-Adjust-indentation-into-ppp_async_input.patch patches.suse/net-ena-implement-XDP-drop-support.patch patches.suse/net-ena-Implement-XDP_TX-action.patch @@ -54010,6 +54035,7 @@ patches.suse/0055-amd-xgbe-remove-unnecessary-conversion-to-bool.patch patches.suse/msft-hv-2010-hv_netvsc-Add-XDP-support.patch patches.suse/net_sched-ematch-reject-invalid-TCF_EM_SIMPLE.patch + patches.suse/drivers-net-xgene-Fix-the-order-of-the-arguments-of-.patch patches.suse/Bluetooth-Fix-race-condition-in-hci_release_sock.patch patches.suse/mwifiex-drop-most-magic-numbers-from-mwifiex_process.patch patches.suse/brcmfmac-sdio-Fix-OOB-interrupt-initialization-on-br.patch @@ -54363,6 +54389,7 @@ patches.suse/0001-enic-prevent-waking-up-stopped-tx-queues-over-watchd.patch patches.suse/net-sched-matchall-add-missing-validation-of-TCA_MAT.patch patches.suse/net-sched-flower-add-missing-validation-of-TCA_FLOWE.patch + patches.suse/net-hns3-add-management-table-after-IMP-reset.patch patches.suse/net-hns3-fix-a-copying-IPv6-address-error-in-hclge_f.patch patches.suse/net-smc-transfer-fasync_list-in-case-of-fallback patches.suse/net-smc-no-peer-id-in-clc-decline-for-smcd @@ -54379,8 +54406,10 @@ patches.suse/IB-hfi1-Close-window-for-pq-and-request-coliding.patch patches.suse/IB-rdmavt-Reset-all-QPs-when-the-device-is-shut-down.patch patches.suse/RDMA-core-Fix-invalid-memory-access-in-spec_filter_s.patch + patches.suse/RDMA-iw_cxgb4-initiate-CLOSE-when-entering-TERM.patch patches.suse/IB-umad-Fix-kernel-crash-while-unloading-ib_umad.patch patches.suse/RDMA-rxe-Fix-soft-lockup-problem-due-to-using-taskle.patch + patches.suse/RDMA-core-Fix-protection-fault-in-get_pkey_idx_qp_li.patch patches.suse/Input-synaptics-switch-T470s-to-RMI4-by-default.patch patches.suse/Input-synaptics-enable-SMBus-on-ThinkPad-L470.patch patches.suse/Input-synaptics-remove-the-LEN0049-dmi-id-from-topbu.patch @@ -54413,6 +54442,8 @@ patches.suse/ipv6-Fix-route-replacement-with-dev-only-route.patch patches.suse/ipv6-Fix-nlmsg_flags-when-splitting-a-multipath-rout.patch patches.suse/net-fib_rules-Correctly-set-table-field-when-table-n.patch + patches.suse/0008-net-atlantic-fix-use-after-free-kasan-warn.patch + patches.suse/0009-net-atlantic-fix-potential-error-handling.patch patches.suse/net-phy-restore-mdio-regs-in-the-iproc-mdio-driver.patch patches.suse/0001-net-dsa-b53-Ensure-the-default-VID-is-untagged.patch patches.suse/NFC-pn544-Fix-a-typo-in-a-debug-message.patch @@ -54489,6 +54520,7 @@ patches.suse/net-Fix-Tx-hash-bound-checking.patch patches.suse/net-smc-fix-cleanup-for-linkgroup-setup-failures patches.suse/ipv6-restrict-IPV6_ADDRFORM-operation.patch + patches.suse/net-smc-check-for-valid-ib_client_data patches.suse/0001-amdgpu-gmc_v9-save-restore-sdpif-regs-during-S3.patch patches.suse/0001-drm-i915-gvt-Separate-display-reset-from-ALL_ENGINES.patch patches.suse/drm-i915-gvt-fix-orphan-vgpu-dmabuf_objs-lifetime @@ -54542,7 +54574,9 @@ patches.suse/0001-Revert-bcache-ignore-pending-signals-when-creating-g.patch patches.suse/blktrace-fix-dereference-after-null-check.patch patches.suse/Revert-RDMA-cma-Simplify-rdma_resolve_addr-error-flo.patch + patches.suse/RDMA-core-Fix-use-of-logical-OR-in-get_new_pps.patch patches.suse/RMDA-cm-Fix-missing-ib_cm_destroy_id-in-ib_cm_insert.patch + patches.suse/RDMA-core-Fix-pkey-and-port-assignment-in-get_new_pp.patch patches.suse/IB-hfi1-qib-Ensure-RCU-is-locked-when-accessing-list.patch patches.suse/RDMA-core-Fix-protection-fault-in-ib_mr_pool_destroy.patch patches.suse/RDMA-iwcm-Fix-iwcm-work-deallocation.patch @@ -54598,6 +54632,7 @@ patches.suse/cgroup-memcg-net-do-not-associate-sock-with-unrelated-cgroup.patch patches.suse/net-memcg-late-association-of-sock-to-memcg.patch patches.suse/ipv6-addrconf-call-ipv6_mc_up-for-non-Ethernet-inter.patch + patches.suse/net-smc-cancel-event-worker-during-device-removal patches.suse/ibmvnic-Do-not-process-device-remove-during-device-r.patch patches.suse/net-macsec-update-SCI-upon-MAC-address-change.patch patches.suse/s390-qeth-handle-error-when-backing-rx-buffer @@ -54666,11 +54701,13 @@ patches.suse/hsr-set-.netnsok-flag.patch patches.suse/net_sched-cls_route-remove-the-right-filter-from-has.patch patches.suse/net-mvneta-Fix-the-case-where-the-last-poll-did-not-.patch + patches.suse/0010-net-bcmgenet-keep-MAC-in-reset-until-PHY-is-up.patch patches.suse/net-ena-fix-incorrect-setting-of-the-number-of-msix-.patch patches.suse/net-ena-fix-request-of-incorrect-number-of-IRQ-vecto.patch patches.suse/net-ena-avoid-memory-access-violation-by-validating-.patch patches.suse/net-ena-fix-continuous-keep-alive-resets.patch patches.suse/vxlan-check-return-value-of-gro_cells_init.patch + patches.suse/cxgb4-fix-throughput-drop-during-Tx-backpressure.patch patches.suse/cxgb4-fix-Txq-restart-check-during-backpressure.patch patches.suse/hsr-fix-general-protection-fault-in-hsr_addr_is_self.patch patches.suse/slcan-not-call-free_netdev-before-rtnl_unlock-in-slc.patch @@ -54680,8 +54717,11 @@ patches.suse/macsec-restrict-to-ethernet-devices.patch patches.suse/bnxt_en-fix-memory-leaks-in-bnxt_dcbnl_ieee_getets.patch patches.suse/bnxt_en-Return-error-if-bnxt_alloc_ctx_mem-fails.patch + patches.suse/bnxt_en-Reset-rings-if-ring-reservation-fails-during.patch patches.suse/net-dsa-Fix-duplicate-frames-flooded-by-learning.patch + patches.suse/net-cbs-Fix-software-cbs-to-consider-packet-sending-.patch patches.suse/net-ena-add-pci-shutdown-handler-to-allow-safe-kexec.patch + patches.suse/RDMA-core-Ensure-security-pkey-modify-is-not-lost.patch patches.suse/RDMA-mlx5-Fix-access-to-wrong-pointer-while-performi.patch patches.suse/0001-ceph-check-pool_flag_full-nearfull-in-addition-to-osdmap_full-nearfull.patch patches.suse/0002-libceph-fix-alloc_msg_with_page_vector-memory-leaks.patch @@ -54764,6 +54804,9 @@ patches.suse/hwrng-via_rng-convert-to-new-x86-cpu-match-macros.patch patches.suse/x86-cpu-cleanup-the-now-unused-cpu-match-macros.patch patches.suse/cpufreq-intel_pstate-fix-wrong-macro-conversion.patch + patches.suse/sched-fair-reorder-enqueue-dequeue_task_fair-path.patch + patches.suse/sched-fair-fix-reordering-of-enqueue-dequeue_task_fair.patch + patches.suse/sched-fair-fix-enqueue_task_fair-warning.patch patches.suse/irqchip-bcm2835-Quiesce-IRQs-left-enabled-by-bootloa.patch patches.suse/fbdev-g364fb-Fix-build-failure.patch patches.suse/firmware-arm_sdei-fix-double-lock-on-hibernate-with-.patch @@ -54823,9 +54866,11 @@ patches.suse/net-ena-remove-set-but-not-used-variable-hash_key.patch patches.suse/net-ena-ethtool-remove-redundant-non-zero-check-on-r.patch patches.suse/0056-net-amd-Remove-useless-driver-version.patch + patches.suse/virtio_net-Keep-vnet-header-zeroed-if-XDP-is-loaded-.patch patches.suse/hsr-use-netdev_err-instead-of-WARN_ONCE.patch patches.suse/ethtool-Factored-out-similar-ethtool-link-settings-f.patch patches.suse/net-ethtool-Introduce-link_ksettings-API-for-virtual.patch + patches.suse/0013-net-liquidio-Delete-non-working-LIQUIDIO_PACKAGE-che.patch patches.suse/brcmfmac-abort-and-release-host-after-error.patch patches.suse/net-mlx5-Expose-link-speed-directly.patch patches.suse/net-mlx5-Expose-port-speed-when-possible.patch @@ -54838,10 +54883,12 @@ patches.suse/mwifiex-set-needed_headroom-not-hard_header_len.patch patches.suse/ath10k-use-kzalloc-to-read-for-ath10k_sdio_hif_diag_.patch patches.suse/ath9k-Handle-txpower-changes-even-when-TPC-is-disabl.patch + patches.suse/qed-Fix-race-condition-between-scheduling-and-destro.patch patches.suse/s390-qeth-support-net-namespaces-for-l3-devices patches.suse/Crypto-chelsio-Fixes-a-hang-issue-during-driver-regi.patch patches.suse/Crypto-chelsio-Fixes-a-deadlock-between-rtnl_lock-an.patch patches.suse/net-ena-Make-some-functions-static.patch + patches.suse/qed-Fix-use-after-free-in-qed_chain_free.patch patches.suse/net-dsa-bcm_sf2-Fix-overflow-checks.patch patches.suse/mac80211-fix-authentication-with-iwlwifi-mvm.patch patches.suse/ipv4-fix-a-RCU-list-lock-in-fib_triestat_seq_show.patch @@ -55218,18 +55265,23 @@ patches.suse/tcp-cache-line-align-MAX_TCP_HEADER.patch patches.suse/ipv6-fix-restrict-IPV6_ADDRFORM-operation.patch patches.suse/net-stmmac-dwmac-meson8b-Add-missing-boundary-to-RGM.patch + patches.suse/cxgb4-fix-large-delays-in-PTP-synchronization.patch patches.suse/team-fix-hang-in-team_mode_get.patch patches.suse/net-mlx5-Fix-failing-fw-tracer-allocation-on-s390.patch patches.suse/macvlan-fix-null-dereference-in-macvlan_device_event.patch patches.suse/xfrm-Always-set-XFRM_TRANSFORMED-in-xfrm-4-6-_output.patch patches.suse/vrf-Check-skb-for-XFRM_TRANSFORMED-flag.patch + patches.suse/0015-net-dsa-b53-Lookup-VID-in-ARL-searches-when-VLAN-is-.patch patches.suse/net-dsa-b53-Fix-ARL-register-definitions.patch patches.suse/net-dsa-b53-Rework-ARL-bin-logic.patch + patches.suse/0016-net-dsa-b53-b53_arl_rw_op-needs-to-select-IVL-or-SVL.patch patches.suse/mlxsw-Fix-some-IS_ERR-vs-NULL-bugs.patch + patches.suse/cxgb4-fix-adapter-crash-due-to-wrong-MC-size.patch patches.suse/net-x25-Fix-x25_neigh-refcnt-leak-when-receiving-fra.patch patches.suse/net-bcmgenet-correct-per-TX-RX-ring-statistics.patch patches.suse/iwlwifi-pcie-actually-release-queue-memory-in-TVQM.patch patches.suse/macsec-avoid-to-set-wrong-mtu.patch + patches.suse/cpumap-Avoid-warning-when-CONFIG_DEBUG_PER_CPU_MAPS-.patch patches.suse/bpf-Forbid-XADD-on-spilled-pointers-for-unprivileged.patch patches.suse/powerpc-setup_64-Set-cache-line-size-based-on-cache-.patch patches.suse/s390-ftrace-fix-potential-crashes-when-switching-tracers @@ -55383,6 +55435,7 @@ patches.suse/ALSA-hda-realtek-Limit-int-mic-boost-for-Thinkpad-T5.patch patches.suse/i40iw-Fix-error-handling-in-i40iw_manage_arp_cache.patch patches.suse/IB-mlx4-Test-return-value-of-calls-to-ib_get_cached_.patch + patches.suse/RDMA-iw_cxgb4-Fix-incorrect-function-parameters.patch patches.suse/Revert-ipv6-add-mtu-lock-check-in-__ip6_rt_update_pm.patch patches.suse/net-fix-a-potential-recursive-NETDEV_FEAT_CHANGE.patch patches.suse/dpaa2-eth-prevent-array-underflow-in-update_cls_rule.patch @@ -55432,14 +55485,18 @@ patches.suse/net-sched-fix-reporting-the-first-time-use-timestamp.patch patches.suse/r8152-support-additional-Microsoft-Surface-Ethernet-.patch patches.suse/net-inet_csk-Fix-so_reuseport-bind-address-cache-in-.patch + patches.suse/__netif_receive_skb_core-pass-skb-by-reference.patch patches.suse/sctp-Don-t-add-the-shutdown-timer-if-its-already-bee.patch patches.suse/ax25-fix-setsockopt-SO_BINDTODEVICE.patch patches.suse/net-qrtr-Fix-passing-invalid-reference-to-qrtr_local.patch patches.suse/net-ipip-fix-wrong-address-family-in-init-error-path.patch patches.suse/sctp-Start-shutdown-on-association-restart-if-in-SHU.patch + patches.suse/mlxsw-spectrum-Fix-use-after-free-of-split-unsplit-t.patch patches.suse/net-mlx4_core-fix-a-memory-leak-bug.patch patches.suse/net-mlx5-Add-command-entry-handling-completion.patch patches.suse/net-mlx5e-Update-netdev-txq-on-completions-during-cl.patch + patches.suse/sched-fair-fix-enqueue_task_fair-warning-some-more.patch + patches.suse/sched-fair-fix-unthrottle_cfs_rq-for-leaf_cfs_rq-list.patch patches.suse/x86-unwind-orc-fix-unwind_get_return_address_ptr-for-inactive-tasks.patch patches.suse/Input-usbtouchscreen-add-support-for-BonXeon-TP.patch patches.suse/Input-evdev-call-input_flush_device-on-release-not-f.patch @@ -55467,6 +55524,7 @@ patches.suse/mac80211-mesh-fix-discovery-timer-re-arming-issue-cr.patch patches.suse/net-check-untrusted-gso_size-at-kernel-entry.patch patches.suse/net-usb-qmi_wwan-add-Telit-LE910C1-EUX-composition.patch + patches.suse/bnxt_en-Fix-accumulation-of-bp-net_stats_prev.patch patches.suse/crypto-chelsio-chtls-properly-set-tp-lsndtime.patch patches.suse/vsock-fix-timeout-in-vsock_accept.patch patches.suse/net-be-more-gentle-about-silly-gso-requests-coming-f.patch @@ -55556,6 +55614,7 @@ patches.suse/net-ena-use-SHUTDOWN-as-reset-reason-when-closing-in.patch patches.suse/net-ena-cosmetic-remove-unnecessary-spaces-and-tabs-.patch patches.suse/net-ena-cosmetic-extract-code-to-ena_indirection_tab.patch + patches.suse/Revert-crypto-chelsio-Inline-single-pdu-only.patch patches.suse/Crypto-chcr-fix-for-ccm-aes-failed-test.patch patches.suse/ath9k-Fix-use-after-free-Read-in-ath9k_wmi_ctrl_rx.patch patches.suse/ath9k-Fix-use-after-free-Write-in-ath9k_htc_rx_msg.patch @@ -55567,6 +55626,9 @@ patches.suse/carl9170-remove-P2P_GO-support.patch patches.suse/ath9k_htc-Silence-undersized-packet-warnings.patch patches.suse/Bluetooth-Handle-Inquiry-Cancel-error-after-Inquiry-.patch + patches.suse/veth-Adjust-hard_start-offset-on-redirect-XDP-frames.patch + patches.suse/ixgbe-Fix-XDP-redirect-on-archs-with-PAGE_SIZE-above.patch + patches.suse/net-mlx5e-IPoIB-Drop-multicast-packets-that-this-int.patch patches.suse/e1000-Do-not-perform-reset-in-reset_task-if-we-are-a.patch patches.suse/net-ena-add-support-for-the-rx-offset-feature.patch patches.suse/net-ena-rename-ena_com_free_desc-to-make-API-more-un.patch @@ -55582,6 +55644,7 @@ patches.suse/net-ena-cosmetic-fix-spacing-issues.patch patches.suse/net-ena-cosmetic-minor-code-changes.patch patches.suse/net-ena-reduce-driver-load-time.patch + patches.suse/igb-Report-speed-and-duplex-as-unknown-when-device-i.patch patches.suse/e1000e-Disable-TSO-for-buffer-overrun-workaround.patch patches.suse/rtlwifi-Fix-a-double-free-in-_rtl_usb_tx_urb_setup.patch patches.suse/mwifiex-Fix-memory-corruption-in-dump_station.patch @@ -55605,6 +55668,7 @@ patches.suse/ipv6-fix-IPV6_ADDRFORM-operation-logic.patch patches.suse/s390-bpf-maintain-8-byte-stack-alignment patches.suse/vmxnet3-allow-rx-flow-hash-ops-only-when-rss-is-enab.patch + patches.suse/net_failover-fixed-rollback-in-net_failover_open.patch patches.suse/media-dvb-return-EREMOTEIO-on-i2c-transfer-failure.patch patches.suse/media-platform-fcp-Set-appropriate-DMA-parameters.patch patches.suse/media-si2157-Better-check-for-running-tuner-in-init.patch @@ -55668,8 +55732,11 @@ patches.suse/RDMA-rxe-Set-default-vendor-ID.patch patches.suse/RDMA-uverbs-Make-the-event_queue-fds-return-POLLERR-.patch patches.suse/RDMA-mlx5-Verify-that-QP-is-created-with-RQ-or-SQ.patch + patches.suse/RDMA-hns-Fix-cmdq-parameter-of-querying-pf-timer-res.patch + patches.suse/RDMA-mlx5-Add-init2init-as-a-modify-command.patch patches.suse/RDMA-efa-Fix-setting-of-wrong-bit-in-get-set_feature.patch patches.suse/IB-cma-Fix-ports-memory-leak-in-cma_configfs.patch + patches.suse/IB-mlx5-Fix-DEVX-support-for-MLX5_CMD_OP_INIT2INIT_Q.patch patches.suse/scsi-qla2xxx-Split-qla2x00_configure_local_loop.patch patches.suse/scsi-qla2xxx-Use-ARRAY_SIZE-instead-of-open-coding-i.patch patches.suse/scsi-lpfc-remove-duplicate-unloading-checks.patch @@ -55820,6 +55887,8 @@ patches.suse/i2c-pxa-clear-all-master-action-bits-in-i2c_pxa_stop.patch patches.suse/scsi-ibmvscsi-Don-t-send-host-info-in-adapter-info-M.patch patches.suse/ibmvnic-Flush-existing-work-items-before-device-remo.patch + patches.suse/net-filter-Permit-reading-NET-in-load_bytes_relative.patch + patches.suse/xdp-Fix-xsk_generic_xmit-errno.patch patches.suse/ext4-fix-partial-cluster-initialization-when-splitti.patch patches.suse/ext4-jbd2-ensure-panic-by-fix-a-race-between-jbd2-ab.patch patches.suse/ibmvnic-Harden-device-login-requests.patch @@ -55883,6 +55952,11 @@ patches.suse/net-qede-fix-PTP-initialization-on-recovery.patch patches.suse/net-qede-fix-use-after-free-on-recovery-and-AER-hand.patch patches.suse/net-qed-fix-maybe-uninitialized-warning.patch + patches.suse/cxgb4-use-unaligned-conversion-for-fetching-timestam.patch + patches.suse/cxgb4-use-correct-type-for-all-mask-IP-address-compa.patch + patches.suse/cxgb4-fix-SGE-queue-dump-destination-buffer-context.patch + patches.suse/cxgb4-remove-cast-when-saving-IPv4-partial-checksum.patch + patches.suse/cxgb4-move-DCB-version-extern-to-header-file.patch patches.suse/net-Do-not-clear-the-sock-TX-queue-in-sk_set_socket.patch patches.suse/net-bridge-enfore-alignment-for-ethernet-address.patch patches.suse/tcp_cubic-fix-spurious-HYSTART_DELAY-exit-upon-drop-.patch @@ -55967,6 +56041,7 @@ patches.suse/s390-mm-fix-huge-pte-soft-dirty-copying patches.suse/gpio-arizona-handle-pm_runtime_get_sync-failure-case.patch patches.suse/pinctrl-amd-fix-npins-for-uart0-in-kerncz_groups.patch + patches.suse/nbd-Fix-memory-leak-in-nbd_add_socket.patch patches.suse/IB-hfi1-Do-not-destroy-hfi1_wq-when-the-device-is-sh.patch patches.suse/IB-hfi1-Do-not-destroy-link_wq-when-the-device-is-sh.patch patches.suse/llc-make-sure-applications-use-ARPHRD_ETHER.patch @@ -55976,14 +56051,18 @@ patches.suse/tcp-md5-refine-tcp_md5_do_add-tcp_md5_hash_key-barri.patch patches.suse/tcp-md5-do-not-send-silly-options-in-SYNCOOKIES.patch patches.suse/sched-consistently-handle-layer3-header-accesses-in-.patch + patches.suse/net-hns3-add-a-missing-uninit-debugfs-when-unload-dr.patch + patches.suse/net-hns3-fix-use-after-free-when-doing-self-test.patch patches.suse/net-usb-qmi_wwan-add-support-for-Quectel-EG95-LTE-mo.patch patches.suse/cgroup-fix-cgroup_sk_alloc-for-sk_clone_lock.patch patches.suse/ipv4-fill-fl4_icmp_-type-code-in-ping_v4_sendmsg.patch patches.suse/0012-net-Added-pointer-check-for-dst-ops-neigh_lookup-in-.patch patches.suse/vlan-consolidate-VLAN-parsing-code-and-limit-max-par.patch + patches.suse/net-smc-fix-sleep-bug-in-smc_pnet_find_roce_resource patches.suse/net-smc-switch-smcd_dev_list-spinlock-to-mutex patches.suse/net-smc-tolerate-future-smcd-versions patches.suse/l2tp-remove-skb_dst_set-from-l2tp_xmit_skb.patch + patches.suse/cxgb4-fix-all-mask-IP-address-comparison.patch patches.suse/net_sched-fix-a-memory-leak-in-atm_tc_init.patch patches.suse/tcp-make-sure-listeners-don-t-initialize-congestion-.patch patches.suse/cgroup-fix-sock_cgroup_data-on-big-endian.patch @@ -56066,9 +56145,12 @@ patches.suse/rxrpc-Fix-sendmsg-returning-EPIPE-due-to-recvmsg-ret.patch patches.suse/net-smc-fix-dmb-buffer-shortage patches.suse/dpaa_eth-Fix-one-possible-memleak-in-dpaa_eth_probe.patch + patches.suse/mlxsw-destroy-workqueue-when-trap_register-in-mlxsw_.patch patches.suse/nfc-s3fwrn5-add-missing-release-on-skb-in-s3fwrn5_re.patch patches.suse/net-sysfs-add-a-newline-when-printing-tx_timeout-by-.patch patches.suse/0011-net-udp-Fix-wrong-clean-up-for-IS_UDPLITE-macro.patch + patches.suse/net-hns3-fix-for-not-calculating-TX-BD-send-size-cor.patch + patches.suse/net-hns3-fix-error-handling-for-desc-filling-8ceca59f.patch patches.suse/qed-suppress-don-t-support-RoCE-iWARP-flooding-on-HW.patch patches.suse/qed-suppress-false-positives-interrupt-error-message.patch patches.suse/drivers-net-wan-x25_asy-Fix-to-make-it-work.patch @@ -56105,6 +56187,7 @@ patches.suse/ALSA-hda-Workaround-for-spurious-wakeups-on-some-Int.patch patches.suse/ALSA-hda-fix-NULL-pointer-dereference-during-suspend.patch patches.suse/ALSA-hda-realtek-Fixed-HP-right-speaker-no-sound.patch + patches.suse/net-hns3-fix-a-TX-timeout-issue.patch patches.suse/usb-hso-check-for-return-value-in-hso_serial_common_.patch patches.suse/net-lan78xx-add-missing-endpoint-sanity-check.patch patches.suse/net-lan78xx-fix-transfer-buffer-memory-leak.patch @@ -56122,6 +56205,7 @@ patches.suse/mac80211-mesh-Free-pending-skb-when-destroying-a-mpa.patch patches.suse/cfg80211-check-vendor-command-doit-pointer-before-us.patch patches.suse/0007-rds-Prevent-kernel-infoleak-in-rds_notify_queue_get.patch + patches.suse/net-mlx5e-fix-bpf_prog-reference-count-leaks-in-mlx5.patch patches.suse/0006-af_key-pfkey_dump-needs-parameter-validation.patch patches.suse/bpf-Fix-map-leak-in-HASH_OF_MAPS-map.patch patches.suse/kvm-svm-fix-disable-pause-loop-exit-pause-filtering-capability-on-svm @@ -56334,6 +56418,8 @@ patches.suse/RDMA-rxe-Return-void-from-rxe_mem_init_dma.patch patches.suse/RDMA-qedr-SRQ-s-bug-fixes.patch patches.suse/RDMA-rxe-Prevent-access-to-wr-next-ptr-afrer-wr-is-p.patch + patches.suse/RDMA-mlx5-Fix-typo-in-enum-name.patch + patches.suse/RDMA-core-Fix-return-error-value-in-_ib_modify_qp-to.patch patches.suse/scsi-Fix-trivial-spelling.patch patches.suse/scsi-qla2xxx-Check-the-size-of-struct-fcp_hdr-at-com.patch patches.suse/scsi-qla2xxx-Remove-the-__packed-annotation-from-str.patch @@ -56544,6 +56630,7 @@ patches.suse/ALSA-usb-audio-ignore-broken-processing-extension-un.patch patches.suse/ASoC-intel-Fix-memleak-in-sst_media_open.patch patches.suse/ALSA-hda-realtek-Add-quirk-for-Samsung-Galaxy-Book-I.patch + patches.suse/RDMA-bnxt_re-Do-not-add-user-qps-to-flushlist.patch patches.suse/ext4-fix-potential-negative-array-index-in-do_split.patch patches.suse/jbd2-add-the-missing-unlock_buffer-in-the-error-path.patch patches.suse/ext4-handle-error-of-ext4_setup_system_zone-on-remou.patch @@ -56641,10 +56728,13 @@ patches.suse/batman-adv-bla-use-netif_rx_ni-when-not-in-interrupt.patch patches.suse/gtp-add-GTPA_LINK-info-to-msg-sent-to-userspace.patch patches.suse/ibmvnic-fix-NULL-tx_pools-and-rx_tools-issue-at-do_r.patch + patches.suse/bnxt_en-Don-t-query-FW-when-netif_running-is-false.patch patches.suse/bnxt_en-Check-for-zero-dir-entries-in-NVRAM.patch + patches.suse/bnxt_en-fix-HWRM-error-when-querying-VF-temperature.patch patches.suse/net-disable-netpoll-on-fresh-napis.patch patches.suse/bnxt-don-t-enable-NAPI-until-rings-are-ready.patch patches.suse/cfg80211-regulatory-reject-invalid-hints.patch + patches.suse/cxgb4-fix-thermal-zone-device-registration.patch patches.suse/net-ethernet-mlx4-Fix-memory-allocation-in-mlx4_budd.patch patches.suse/net-usb-dm9601-Add-USB-ID-of-Keenetic-Plus-DSL.patch patches.suse/tipc-fix-shutdown-of-connectionless-socket.patch @@ -56690,6 +56780,8 @@ patches.suse/RDMA-rxe-Fix-the-parent-sysfs-read-when-the-interfac.patch patches.suse/RDMA-rxe-Fix-memleak-in-rxe_mem_init_user.patch patches.suse/RDMA-mlx4-Read-pkey-table-length-instead-of-hardcode.patch + patches.suse/RDMA-bnxt_re-Do-not-report-transparent-vlan-from-QP1.patch + patches.suse/RDMA-core-Fix-reported-speed-and-width.patch patches.suse/drm-sun4i-Fix-dsi-dcs-long-write-function.patch patches.suse/drm-tve200-Stabilize-enable-disable.patch patches.suse/mmc-sdhci-msm-Add-retries-when-all-tuning-phases-are.patch @@ -56750,6 +56842,7 @@ patches.suse/ip-fix-tos-reflection-in-ack-and-reset-packets.patch patches.suse/tipc-fix-shutdown-of-connection-oriented-socket.patch patches.suse/hdlc_ppp-add-range-checks-in-ppp_cp_parse_cr.patch + patches.suse/s390-qeth-delay-draining-the-tx-buffers patches.suse/net-DCB-Validate-DCB_ATTR_DCB_BUFFER-argument.patch patches.suse/tipc-use-skb_unshare-instead-in-tipc_buf_append.patch patches.suse/ipv4-Update-exception-handling-for-multipath-routes-.patch @@ -56761,6 +56854,7 @@ patches.suse/batman-adv-Add-missing-include-for-in_interrupt.patch patches.suse/batman-adv-mcast-fix-duplicate-mcast-packets-in-BLA-.patch patches.suse/net-ipv6-fix-kconfig-dependency-warning-for-IPV6_SEG.patch + patches.suse/bnxt_en-return-proper-error-codes-in-bnxt_show_temp.patch patches.suse/bnxt_en-Protect-bnxt_set_eee-and-bnxt_set_pauseparam.patch patches.suse/mac80211-do-not-allow-bigger-VHT-MPDUs-than-the-hard.patch patches.suse/ALSA-asihpi-fix-iounmap-in-error-handler.patch @@ -56792,12 +56886,17 @@ patches.suse/i2c-cpm-Fix-i2c_ram-structure.patch patches.suse/xen-events-don-t-use-chip_data-for-legacy-IRQs.patch patches.suse/vmxnet3-fix-cksum-offload-issues-for-non-udp-tunnels.patch + patches.suse/bonding-set-dev-needed_headroom-in-bond_setup_by_sla.patch + patches.suse/team-set-dev-needed_headroom-in-team_setup_by_port.patch patches.suse/0002-net-introduce-helper-sendpage_ok-in-include-linux-ne.patch patches.suse/0003-net-add-WARN_ONCE-in-kernel_sendpage-for-improper-ze.patch patches.suse/0004-nvme-tcp-check-page-by-sendpage_ok-before-calling-ke.patch patches.suse/0006-drbd-code-cleanup-by-using-sendpage_ok-to-check-page.patch patches.suse/0007-scsi-libiscsi-use-sendpage_ok-in-iscsi_tcp_segment_m.patch patches.suse/0008-libceph-use-sendpage_ok-in-ceph_tcp_sendpage.patch + patches.suse/net-mlx5e-Fix-VLAN-cleanup-flow.patch + patches.suse/net-mlx5e-Fix-VLAN-create-flow.patch + patches.suse/net-team-fix-memory-leak-in-__team_options_register.patch patches.suse/platform-x86-thinkpad_acpi-initialize-tp_nvram_state.patch patches.suse/platform-x86-fix-kconfig-dependency-warning-for-FUJI.patch patches.suse/platform-x86-thinkpad_acpi-re-initialize-ACPI-buffer.patch @@ -56868,6 +56967,7 @@ patches.suse/PM-hibernate-remove-the-bogus-call-to-get_gendisk-in.patch patches.suse/ACPI-video-use-ACPI-backlight-for-HP-635-Notebook.patch patches.suse/ACPI-extlog-Check-for-RDMSR-failure.patch + patches.suse/iommu-vt-d-gracefully-handle-dmar-units-with-no-supported-address-widths patches.suse/scsi-smartpqi-identify-physical-devices-without-issuing-inquiry.patch patches.suse/scsi-smartpqi-add-id-support-for-smartraid-3152-8i.patch patches.suse/scsi-smartpqi-update-logical-volume-size-after-expansion.patch @@ -57033,6 +57133,7 @@ patches.suse/rtl8xxxu-prevent-potential-memory-leak.patch patches.suse/mwifiex-remove-function-pointer-check.patch patches.suse/brcmsmac-fix-memory-leak-in-wlc_phy_attach_lcnphy.patch + patches.suse/net-ethernet-mlx4-Avoid-assigning-a-value-to-ring_co.patch patches.suse/net-ena-Change-license-into-format-to-SPDX-in-all-fi.patch patches.suse/net-ena-Change-log-message-to-netif-dev-function.patch patches.suse/net-ena-Capitalize-all-log-strings-and-improve-code-.patch @@ -57081,8 +57182,11 @@ patches.suse/RDMA-ucma-Add-missing-locking-around-rdma_leave_mult.patch patches.suse/RDMA-qedr-Fix-doorbell-setting.patch patches.suse/RDMA-qedr-Fix-use-of-uninitialized-field.patch + patches.suse/RDMA-qedr-Fix-inline-size-returned-for-iWARP.patch patches.suse/RDMA-hns-Set-the-unsupported-wr-opcode.patch patches.suse/RDMA-hns-Correct-typo-of-hns_roce_create_cq.patch + patches.suse/RDMA-hns-Fix-missing-sq_sig_type-when-querying-QP.patch + patches.suse/RDMA-addr-Fix-race-with-netevent_callback-rdma_addr_.patch patches.suse/RDMA-qedr-Endianness-warnings-cleanup.patch patches.suse/RDMA-ipoib-Set-rtnl_link_ops-for-ipoib-interfaces.patch patches.suse/RDMA-bnxt_re-Fix-sizeof-mismatch-for-allocation-of-p.patch @@ -57102,6 +57206,7 @@ patches.suse/0010-xen-events-use-a-common-cpu-hotplug-hook-for-event-c.patch patches.suse/0011-xen-events-defer-eoi-in-case-of-excessive-number-of-.patch patches.suse/0012-xen-events-block-rogue-events-for-some-time.patch + patches.suse/iommu-vt-d-don-t-dereference-iommu_device-if-iommu_api-is-not-built patches.suse/power-supply-test_power-add-missing-newlines-when-pr.patch patches.suse/NFS-fix-nfs_path-in-case-of-a-rename-retry.patch patches.suse/NFSv4.2-support-EXCHGID4_FLAG_SUPP_FENCE_OPS-4.2-EXC.patch @@ -57131,6 +57236,10 @@ patches.suse/cifs-remove-bogus-debug-code.patch patches.suse/icmp-randomize-the-global-rate-limiter.patch patches.suse/nfc-Ensure-presence-of-NFC_ATTR_FIRMWARE_NAME-attrib.patch + patches.suse/chelsio-chtls-fix-socket-lock.patch + patches.suse/chelsio-chtls-correct-netdevice-for-vlan-interface.patch + patches.suse/chelsio-chtls-correct-function-return-and-return-typ.patch + patches.suse/net-sched-act_tunnel_key-fix-OOB-write-in-case-of-IP.patch patches.suse/ibmvnic-save-changed-mac-address-to-adapter-mac_addr.patch patches.suse/drm-ttm-fix-eviction-valuable-range-check.patch patches.suse/drm-i915-Force-VT-d-workarounds-when-running-as-a-gu.patch @@ -57161,7 +57270,12 @@ patches.suse/msft-hv-2164-hyperv_fb-Update-screen_info-after-removing-old-fram.patch patches.suse/x86-unwind-orc-fix-inactive-tasks-with-stack-pointer-in-sp-on-gcc-10-compiled-kernels.patch patches.suse/RDMA-qedr-Fix-memory-leak-in-iWARP-CM.patch + patches.suse/chelsio-chtls-fix-tls-record-info-to-user.patch + patches.suse/cxgb4-set-up-filter-action-after-rewrites.patch patches.suse/mlxsw-core-Fix-memory-leak-on-module-removal.patch + patches.suse/mlxsw-core-Fix-use-after-free-in-mlxsw_emad_trans_fi.patch + patches.suse/chelsio-chtls-fix-deadlock-issue.patch + patches.suse/chelsio-chtls-fix-memory-leaks-in-CPL-handlers.patch patches.suse/ibmveth-Fix-use-of-ibmveth-in-a-bridge.patch patches.suse/tipc-fix-memory-leak-caused-by-tipc_buf_append.patch patches.suse/ibmvnic-fix-ibmvnic_set_mac.patch @@ -57176,6 +57290,7 @@ patches.suse/btrfs-fix-use-after-free-on-readahead-extent-after-f.patch patches.suse/scsi-qla2xxx-Return-EBUSY-on-fcport-deletion.patch patches.suse/scsi-ibmvscsi-Fix-potential-race-after-loss-of-trans.patch + patches.suse/x86-kvm-reserve-kvm_feature_msi_ext_dest_id patches.suse/usb-host-fsl-mph-dr-of-check-return-of-dma_set_mask.patch patches.suse/usb-cdc-acm-fix-cooldown-mechanism.patch patches.suse/usb-typec-tcpm-reset-hard_reset_count-for-any-discon.patch @@ -57188,6 +57303,7 @@ patches.suse/staging-comedi-cb_pcidas-Allow-2-channel-commands-fo.patch patches.suse/docs-ABI-stable-remove-a-duplicated-documentation.patch patches.suse/docs-ABI-sysfs-c2port-remove-a-duplicated-entry.patch + patches.suse/futex-Fix-incorrect-should_fail_futex-handling.patch patches.suse/time-Prevent-undefined-behaviour-in-timespec64_to_ns.patch patches.suse/kthread_worker-prevent-queuing-delayed-work-from-tim.patch patches.suse/mm-always-have-io_remap_pfn_range-set-pgprot_decrypted.patch @@ -57208,6 +57324,8 @@ patches.suse/dpaa_eth-fix-the-RX-headroom-size-alignment.patch patches.suse/powerpc-vnic-Extend-failover-pending-window.patch patches.suse/net-usb-qmi_wwan-add-Telit-LE910Cx-0x1230-compositio.patch + patches.suse/chelsio-chtls-fix-memory-leaks-caused-by-a-race.patch + patches.suse/chelsio-chtls-fix-always-leaking-ctrl_skb.patch patches.suse/can-rx-offload-don-t-call-kfree_skb-from-IRQ-context.patch patches.suse/can-dev-can_get_echo_skb-prevent-call-to-kfree_skb-i.patch patches.suse/can-dev-__can_get_echo_skb-fix-real-payload-length-r.patch @@ -57277,9 +57395,11 @@ patches.suse/can-peak_usb-fix-potential-integer-overflow-on-shift.patch patches.suse/can-m_can-m_can_handle_state_change-fix-state-change.patch patches.suse/can-m_can-m_can_stop-set-device-to-software-init-mod.patch + patches.suse/bnxt_en-read-EEPROM-A2h-address-using-page-0.patch patches.suse/qed-fix-error-return-code-in-qed_iwarp_ll2_start.patch patches.suse/inet_diag-Fix-error-path-to-cancel-the-meseage-in-in.patch patches.suse/page_frag-Recover-from-memory-pressure.patch + patches.suse/net-mlx5-Add-handling-of-port-type-in-rule-deletion.patch patches.suse/net-mlx4_core-Fix-init_hca-fields-offset.patch patches.suse/drm-sun4i-dw-hdmi-fix-error-return-code-in-sun8i_dw_.patch patches.suse/drm-i915-gvt-Set-ENHANCED_FRAME_CAP-bit.patch @@ -57309,8 +57429,13 @@ patches.suse/platform-x86-toshiba_acpi-Fix-the-wrong-variable-ass.patch patches.suse/IB-mthca-fix-return-value-of-error-branch-in-mthca_i.patch patches.suse/IB-hfi1-Ensure-correct-mm-is-used-at-all-times.patch + patches.suse/RDMA-hns-Bugfix-for-memory-window-mtpt-configuration.patch patches.suse/btrfs-qgroup-don-t-commit-transaction-when-we-alread.patch + patches.suse/bnxt_en-fix-error-return-code-in-bnxt_init_one.patch + patches.suse/bnxt_en-fix-error-return-code-in-bnxt_init_board.patch + patches.suse/bnxt_en-Release-PCI-regions-when-DMA-mask-setup-fail.patch patches.suse/net-tls-missing-received-data-after-fast-remote-clos.patch + patches.suse/cxgb4-fix-the-panic-caused-by-non-smac-rewrite.patch patches.suse/tcp-Set-INET_ECN_xmit-configuration-in-tcp_reinit_co.patch patches.suse/s390-qeth-make-af_iucv-tx-notification-call-more-robust patches.suse/s390-qeth-fix-af_iucv-notification-race @@ -57321,8 +57446,10 @@ patches.suse/ibmvnic-notify-peers-when-failover-and-migration-hap.patch patches.suse/iwlwifi-pcie-limit-memory-read-spin-time.patch patches.suse/iwlwifi-mvm-fix-kernel-panic-in-case-of-assert-durin.patch + patches.suse/i40e-Fix-removing-driver-while-bare-metal-VFs-pass-t.patch patches.suse/nfc-s3fwrn5-use-signed-integer-for-parsing-GPIO-numb.patch patches.suse/net-ena-handle-bad-request-id-in-ena_netdev.patch + patches.suse/net-ena-set-initial-DMA-width-to-avoid-intel-iommu-i.patch patches.suse/net-ena-fix-packet-s-addresses-for-rx_offset-feature.patch patches.suse/ibmvnic-fix-NULL-pointer-dereference-in-reset_sub_cr.patch patches.suse/ibmvnic-enhance-resetting-status-check-during-module.patch @@ -57347,8 +57474,13 @@ patches.suse/ibmvnic-avoid-memset-null-scrq-msgs.patch patches.suse/ibmvnic-restore-adapter-state-on-failed-reset.patch patches.suse/ibmvnic-delay-next-reset-if-hard-reset-fails.patch + patches.suse/chelsio-chtls-fix-panic-during-unload-reload-chtls.patch + patches.suse/can-c_can-c_can_power_up-fix-error-handling.patch patches.suse/inet_ecn-Fix-endianness-of-checksum-update-when-sett.patch patches.suse/net-x25-prevent-a-couple-of-overflows.patch + patches.suse/cxgb3-fix-error-return-code-in-t3_sge_alloc_qset.patch + patches.suse/chelsio-chtls-fix-a-double-free-in-chtls_setkey.patch + patches.suse/net-mvpp2-Fix-error-return-code-in-mvpp2_open.patch patches.suse/drm-rockchip-Avoid-uninitialized-use-of-endpoint-id-.patch patches.suse/msft-hv-2173-scsi-storvsc-Fix-error-return-in-storvsc_probe.patch patches.suse/powerpc-64s-Fix-hash-ISA-v3.0-TLBIEL-instruction-gen.patch @@ -57377,6 +57509,9 @@ patches.suse/cfg80211-initialize-rekey_data.patch patches.suse/mac80211-mesh-fix-mesh_pathtbl_init-error-path.patch patches.suse/can-softing-softing_netdev_open-fix-error-handling.patch + patches.suse/net-mlx4_en-Avoid-scheduling-restart-task-if-it-is-a.patch + patches.suse/i40e-avoid-premature-Rx-buffer-reuse.patch + patches.suse/ixgbe-avoid-premature-Rx-buffer-reuse.patch patches.suse/gpio-mvebu-fix-potential-user-after-free-on-probe.patch patches.suse/pinctrl-merrifield-Set-default-bias-in-case-no-parti.patch patches.suse/pinctrl-baytrail-Avoid-clearing-debounce-value-when-.patch @@ -57416,6 +57551,7 @@ patches.suse/edac-i10nm-use-readl-to-access-mmio-registers.patch patches.suse/edac-amd64-fix-pci-component-registration.patch patches.suse/x86-mm-ident_map-check-for-errors-from-ident_pud_init.patch + patches.suse/s390-cio-fix-use-after-free-in-ccw_device_destroy_console patches.suse/s390-smp-perform-initial-cpu-reset-also-for-smt-siblings patches.suse/mm-memory_failure-always-pin-the-page-in-madvise_inj.patch patches.suse/mm-don-t-wake-kswapd-prematurely-when-watermark-boosting-is-disabled.patch @@ -57583,6 +57719,7 @@ patches.suse/scsi-qla2xxx-If-fcport-is-undergoing-deletion-comple.patch patches.suse/scsi-qla2xxx-Fix-device-loss-on-4G-and-older-HBAs.patch patches.suse/scsi-qla2xxx-Update-version-to-10.02.00.104-k.patch + patches.suse/RDMA-cma-Don-t-overwrite-sgid_attr-after-device-is-r.patch patches.suse/mfd-rt5033-Fix-errorneous-defines.patch patches.suse/pinctrl-falcon-add-missing-put_device-call-in-pinctr.patch patches.suse/vfio-pci-use-io_remap_pfn_range-for-pci-io-memory @@ -57596,6 +57733,7 @@ patches.suse/NFSv4.2-condition-READDIR-s-mask-for-security-label-.patch patches.suse/lockd-don-t-use-interval-based-rebinding-over-TCP.patch patches.suse/NFS-switch-nfsiod-to-be-an-UNBOUND-workqueue.patch + patches.suse/module-delay-kobject-uevent-until-after-module-init-.patch patches.suse/powerpc-64-Set-up-a-kernel-stack-for-secondaries-bef.patch patches.suse/Revert-powerpc-pseries-hotplug-cpu-Remove-double-fre.patch patches.suse/powerpc-perf-Fix-crash-with-is_sier_available-when-p.patch @@ -57627,7 +57765,10 @@ patches.suse/s390-dasd-fix-list-corruption-of-lcu-list patches.suse/powerpc-smp-Add-__init-to-init_big_cores.patch patches.suse/ethernet-ucc_geth-fix-use-after-free-in-ucc_geth_rem.patch + patches.suse/net-mvpp2-Fix-GoP-port-3-Networking-Complex-Control-.patch patches.suse/ibmvnic-continue-fatal-error-reset-after-passive-ini.patch + patches.suse/tun-fix-return-value-when-the-number-of-iovs-exceeds.patch + patches.suse/net-mvpp2-fix-pkt-coalescing-int-threshold-configura.patch patches.suse/ibmvnic-fix-NULL-pointer-dereference.patch patches.suse/ALSA-hda-via-Fix-runtime-PM-for-Clevo-W35xSS.patch patches.suse/btrfs-qgroup-don-t-try-to-wait-flushing-if-we-re-alr.patch @@ -57635,6 +57776,17 @@ patches.suse/misdn-dsp-select-CONFIG_BITREVERSE.patch patches.suse/wan-ds26522-select-CONFIG_BITREVERSE.patch patches.suse/net-vlan-avoid-leaks-on-register_vlan_dev-failures.patch + patches.suse/net-hns3-fix-the-number-of-queues-actually-used-by-A.patch + patches.suse/chtls-Fix-hardware-tid-leak.patch + patches.suse/chtls-Remove-invalid-set_tcb-call.patch + patches.suse/chtls-Replace-skb_dequeue-with-skb_peek.patch + patches.suse/chtls-Added-a-check-to-avoid-NULL-pointer-dereferenc.patch + patches.suse/chtls-Fix-chtls-resources-release-sequence.patch + patches.suse/s390-qeth-fix-deadlock-during-recovery + patches.suse/s390-qeth-fix-locking-for-discipline-setup-removal + patches.suse/s390-qeth-fix-l2-header-access-in-qeth_l3_osa_features_check + patches.suse/net-mlx5e-Fix-two-double-free-cases.patch + patches.suse/net-mlx5e-Fix-memleak-in-mlx5e_create_l2_table_group.patch patches.suse/0002-drm-msm-Fix-WARN_ON-splat-in-_free_object.patch patches.suse/ACPI-scan-add-stub-acpi_create_platform_device-for-C.patch patches.suse/Revert-device-property-Keep-secondary-firmware-node-.patch @@ -57654,23 +57806,69 @@ patches.suse/usb-gadget-select-CONFIG_CRC32.patch patches.suse/usb-gadget-configfs-Preserve-function-ordering-after.patch patches.suse/USB-serial-iuu_phoenix-fix-DMA-from-stack.patch + patches.suse/msft-hv-2201-x86-hyperv-Fix-kexec-panic-hang-issues.patch patches.suse/NFS4-Fix-use-after-free-in-trace_event_raw_event_nfs.patch patches.suse/net-sunrpc-interpret-the-return-value-of-kstrtou32-c.patch patches.suse/pNFS-Mark-layout-for-return-if-return-on-close-was-n.patch patches.suse/NFS-nfs_igrab_and_active-must-first-reference-the-su.patch patches.suse/ASoC-dapm-remove-widget-from-dirty-list-on-free.patch + patches.suse/ASoC-Intel-haswell-Add-missing-pm_ops.patch + patches.suse/ALSA-doc-Fix-reference-to-mixart.rst.patch patches.suse/ALSA-fireface-Fix-integer-overflow-in-transmit_midi_.patch patches.suse/ALSA-firewire-tascam-Fix-integer-overflow-in-midi_po.patch patches.suse/r8152-Add-Lenovo-Powered-USB-C-Travel-Hub.patch + patches.suse/bnxt_en-Improve-stats-context-resource-accounting-wi.patch + patches.suse/drm-nouveau-bios-fix-issue-shadowing-expansion-ROMs.patch + patches.suse/drm-nouveau-privring-ack-interrupts-the-same-way-as-.patch + patches.suse/drm-nouveau-i2c-gm200-increase-width-of-aux-semaphor.patch patches.suse/ACPI-scan-Harden-acpi_device_add-against-device-ID-o.patch + patches.suse/RDMA-mlx5-Fix-wrong-free-of-blue-flame-register-on-e.patch patches.suse/spi-cadence-cache-reference-clock-rate-during-probe.patch + patches.suse/nfsd4-readdirplus-shouldn-t-return-parent-of-export.patch + patches.suse/can-vxcan-vxcan_xmit-fix-use-after-free-bug.patch + patches.suse/ALSA-hda-via-Add-minimum-mute-flag.patch + patches.suse/ALSA-seq-oss-Fix-missing-error-check-in-snd_seq_oss_.patch patches.suse/ACPI-scan-Make-acpi_bus_get_device-clear-return-poin.patch patches.suse/drm-atomic-put-state-on-error-path.patch patches.suse/mmc-sdhci-xenon-fix-1.8v-regulator-stabilization.patch + patches.suse/scsi-ibmvfc-Set-default-timeout-to-avoid-crash-durin.patch patches.suse/i2c-octeon-check-correct-size-of-maximum-RECV_LEN-pa.patch + patches.suse/ehci-fix-EHCI-host-controller-initialization-sequenc.patch + patches.suse/USB-ehci-fix-an-interrupt-calltrace-error.patch patches.suse/usb-udc-core-Use-lock-when-write-to-soft_connect.patch + patches.suse/xhci-make-sure-TRB-is-fully-written-before-giving-it.patch + patches.suse/xhci-tegra-Delay-for-disabling-LFPS-detector.patch patches.suse/serial-mvebu-uart-fix-tx-lost-characters-at-power-of.patch patches.suse/iio-ad5504-Fix-setting-power-down-state.patch + patches.suse/futex_Ensure_the_correct_return_value_from_futex_lock_pi_.patch + patches.suse/futex_Replace_pointless_printk_in_fixup_owner_.patch + patches.suse/futex_Provide_and_use_pi_state_update_owner_.patch + patches.suse/rtmutex_Remove_unused_argument_from_rt_mutex_proxy_unlock_.patch + patches.suse/futex_Use_pi_state_update_owner__in_put_pi_state_.patch + patches.suse/futex_Simplify_fixup_pi_state_owner_.patch + patches.suse/futex-Handle-faults-correctly-for-PI-futexes.patch + patches.suse/igc-fix-link-speed-advertising.patch + patches.suse/can-dev-prevent-potential-information-leak-in-can_fi.patch + patches.suse/net-mlx5-Fix-memory-leak-on-flow-table-creation-erro.patch + patches.suse/drm-i915-Check-for-all-subplatform-bits.patch + patches.suse/nbd-freeze-the-queue-while-we-re-adding-connections.patch + + # jejb/scsi for-next + patches.suse/scsi-lpfc-Fix-PLOGI-S_ID-of-0-on-pt2pt-config.patch + patches.suse/scsi-lpfc-Fix-auto-sli_mode-and-its-effect-on-CONFIG.patch + patches.suse/scsi-lpfc-Refresh-ndlp-when-a-new-PRLI-is-received-i.patch + patches.suse/scsi-lpfc-Fix-crash-when-a-fabric-node-is-released-p.patch + patches.suse/scsi-lpfc-Use-the-nvme-fc-transport-supplied-timeout.patch + patches.suse/scsi-lpfc-Fix-FW-reset-action-if-I-Os-are-outstandin.patch + patches.suse/scsi-lpfc-Prevent-duplicate-requests-to-unregister-w.patch + patches.suse/scsi-lpfc-Fix-error-log-messages-being-logged-follow.patch + patches.suse/scsi-lpfc-Fix-target-reset-failing.patch + patches.suse/scsi-lpfc-Fix-NVMe-recovery-after-mailbox-timeout.patch + patches.suse/scsi-lpfc-Fix-vport-create-logging.patch + patches.suse/scsi-lpfc-Implement-health-checking-when-aborting-I-.patch + patches.suse/scsi-lpfc-Enhancements-to-LOG_TRACE_EVENT-for-better.patch + patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.7.patch + patches.suse/scsi-lpfc-Simplify-bool-comparison.patch # dhowells/linux-fs keys-uefi patches.suse/0001-KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch @@ -57699,6 +57897,7 @@ patches.suse/0004-ocfs2-give-applications-more-IO-opportunities-during.patch patches.suse/cifs-set_root_ses-ipc.patch patches.suse/target-fix-XCOPY-NAA-identifier-lookup.patch + patches.suse/floppy-reintroduce-O_NDELAY-fix.patch ######################################################## # end of sorted patches @@ -58430,6 +58629,16 @@ patches.suse/0005-xen-revert-Allow-watches-discard-events-before-queue.patch patches.suse/0006-xen-support-having-only-one-event-pending-per-watch.patch + + ################################################################# + # Extended APIC-ID patches to support large AWS instance types + ################################################################# + patches.suse/0001-x86-apic-Fix-x2apic-enablement-without-interrupt-rem.patch + patches.suse/0002-x86-msi-Only-use-high-bits-of-MSI-address-for-DMAR-u.patch + patches.suse/0003-x86-ioapic-Handle-Extended-Destination-ID-field-in-R.patch + patches.suse/0004-x86-apic-Support-15-bits-of-APIC-ID-in-IOAPIC-MSI-wh.patch + patches.suse/0005-x86-kvm-Add-KVM_FEATURE_MSI_EXT_DEST_ID.patch + ######################################################## # kABI consistency patches ######################################################## @@ -58550,6 +58759,7 @@ patches.kabi/b53_kabi.patch patches.kabi/kABI-ath10k-move-a-new-structure-member-to-the-end.patch patches.kabi/snd-hda-codec-generic-kabi-workaround.patch + patches.kabi/kABI-Fix-kABI-for-extended-APIC-ID-support.patch ######################################################## # You'd better have a good reason for adding a patch