From: Sasha Levin Date: Mon, 7 Sep 2020 02:55:56 +0000 (-0400) Subject: Fixes for 5.8 X-Git-Tag: v4.14.197~40 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0037ff001ae7927f69f0fb999e9765041bcb0257;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.8 Signed-off-by: Sasha Levin --- diff --git a/queue-5.8/batman-adv-avoid-uninitialized-chaddr-when-handling-.patch b/queue-5.8/batman-adv-avoid-uninitialized-chaddr-when-handling-.patch new file mode 100644 index 00000000000..e7ad5873386 --- /dev/null +++ b/queue-5.8/batman-adv-avoid-uninitialized-chaddr-when-handling-.patch @@ -0,0 +1,52 @@ +From 8807f9eaf132eeaad4ce2b7f23d8361f5df7b24e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jul 2020 20:36:43 +0200 +Subject: batman-adv: Avoid uninitialized chaddr when handling DHCP + +From: Sven Eckelmann + +[ Upstream commit 303216e76dcab6049c9d42390b1032f0649a8206 ] + +The gateway client code can try to optimize the delivery of DHCP packets to +avoid broadcasting them through the whole mesh. But also transmissions to +the client can be optimized by looking up the destination via the chaddr of +the DHCP packet. + +But the chaddr is currently only done when chaddr is fully inside the +non-paged area of the skbuff. Otherwise it will not be initialized and the +unoptimized path should have been taken. + +But the implementation didn't handle this correctly. It didn't retrieve the +correct chaddr but still tried to perform the TT lookup with this +uninitialized memory. + +Reported-by: syzbot+ab16e463b903f5a37036@syzkaller.appspotmail.com +Fixes: 6c413b1c22a2 ("batman-adv: send every DHCP packet as bat-unicast") +Signed-off-by: Sven Eckelmann +Acked-by: Antonio Quartulli +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/gateway_client.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c +index a18dcc686dc31..ef3f85b576c4c 100644 +--- a/net/batman-adv/gateway_client.c ++++ b/net/batman-adv/gateway_client.c +@@ -703,8 +703,10 @@ batadv_gw_dhcp_recipient_get(struct sk_buff *skb, unsigned int *header_len, + + chaddr_offset = *header_len + BATADV_DHCP_CHADDR_OFFSET; + /* store the client address if the message is going to a client */ +- if (ret == BATADV_DHCP_TO_CLIENT && +- pskb_may_pull(skb, chaddr_offset + ETH_ALEN)) { ++ if (ret == BATADV_DHCP_TO_CLIENT) { ++ if (!pskb_may_pull(skb, chaddr_offset + ETH_ALEN)) ++ return BATADV_DHCP_NO; ++ + /* check if the DHCP packet carries an Ethernet DHCP */ + p = skb->data + *header_len + BATADV_DHCP_HTYPE_OFFSET; + if (*p != BATADV_DHCP_HTYPE_ETHERNET) +-- +2.25.1 + diff --git a/queue-5.8/batman-adv-bla-use-netif_rx_ni-when-not-in-interrupt.patch b/queue-5.8/batman-adv-bla-use-netif_rx_ni-when-not-in-interrupt.patch new file mode 100644 index 00000000000..4bb7dc39e10 --- /dev/null +++ b/queue-5.8/batman-adv-bla-use-netif_rx_ni-when-not-in-interrupt.patch @@ -0,0 +1,42 @@ +From e97276895405431339d7c07d1303aeabc23f43e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 17:46:10 +0300 +Subject: batman-adv: bla: use netif_rx_ni when not in interrupt context + +From: Jussi Kivilinna + +[ Upstream commit 279e89b2281af3b1a9f04906e157992c19c9f163 ] + +batadv_bla_send_claim() gets called from worker thread context through +batadv_bla_periodic_work(), thus netif_rx_ni needs to be used in that +case. This fixes "NOHZ: local_softirq_pending 08" log messages seen +when batman-adv is enabled. + +Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code") +Signed-off-by: Jussi Kivilinna +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/bridge_loop_avoidance.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c +index 41cc87f06b142..cfb9e16afe38a 100644 +--- a/net/batman-adv/bridge_loop_avoidance.c ++++ b/net/batman-adv/bridge_loop_avoidance.c +@@ -437,7 +437,10 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, u8 *mac, + batadv_add_counter(bat_priv, BATADV_CNT_RX_BYTES, + skb->len + ETH_HLEN); + +- netif_rx(skb); ++ if (in_interrupt()) ++ netif_rx(skb); ++ else ++ netif_rx_ni(skb); + out: + if (primary_if) + batadv_hardif_put(primary_if); +-- +2.25.1 + diff --git a/queue-5.8/batman-adv-fix-own-ogm-check-in-aggregated-ogms.patch b/queue-5.8/batman-adv-fix-own-ogm-check-in-aggregated-ogms.patch new file mode 100644 index 00000000000..a7584490087 --- /dev/null +++ b/queue-5.8/batman-adv-fix-own-ogm-check-in-aggregated-ogms.patch @@ -0,0 +1,65 @@ +From daa9864fe0c14e08fbb0611fbf305861e4746263 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jul 2020 14:28:08 +0200 +Subject: batman-adv: Fix own OGM check in aggregated OGMs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Lüssing + +[ Upstream commit d8bf0c01642275c7dca1e5d02c34e4199c200b1f ] + +The own OGM check is currently misplaced and can lead to the following +issues: + +For one thing we might receive an aggregated OGM from a neighbor node +which has our own OGM in the first place. We would then not only skip +our own OGM but erroneously also any other, following OGM in the +aggregate. + +For another, we might receive an OGM aggregate which has our own OGM in +a place other then the first one. Then we would wrongly not skip this +OGM, leading to populating the orginator and gateway table with ourself. + +Fixes: 9323158ef9f4 ("batman-adv: OGMv2 - implement originators logic") +Signed-off-by: Linus Lüssing +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/bat_v_ogm.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c +index 18028b9f95f01..65b1280cf2fc1 100644 +--- a/net/batman-adv/bat_v_ogm.c ++++ b/net/batman-adv/bat_v_ogm.c +@@ -874,6 +874,12 @@ static void batadv_v_ogm_process(const struct sk_buff *skb, int ogm_offset, + ntohl(ogm_packet->seqno), ogm_throughput, ogm_packet->ttl, + ogm_packet->version, ntohs(ogm_packet->tvlv_len)); + ++ if (batadv_is_my_mac(bat_priv, ogm_packet->orig)) { ++ batadv_dbg(BATADV_DBG_BATMAN, bat_priv, ++ "Drop packet: originator packet from ourself\n"); ++ return; ++ } ++ + /* If the throughput metric is 0, immediately drop the packet. No need + * to create orig_node / neigh_node for an unusable route. + */ +@@ -1001,11 +1007,6 @@ int batadv_v_ogm_packet_recv(struct sk_buff *skb, + if (batadv_is_my_mac(bat_priv, ethhdr->h_source)) + goto free_skb; + +- ogm_packet = (struct batadv_ogm2_packet *)skb->data; +- +- if (batadv_is_my_mac(bat_priv, ogm_packet->orig)) +- goto free_skb; +- + batadv_inc_counter(bat_priv, BATADV_CNT_MGMT_RX); + batadv_add_counter(bat_priv, BATADV_CNT_MGMT_RX_BYTES, + skb->len + ETH_HLEN); +-- +2.25.1 + diff --git a/queue-5.8/block-fix-locking-in-bdev_del_partition.patch b/queue-5.8/block-fix-locking-in-bdev_del_partition.patch new file mode 100644 index 00000000000..fc52fbb59a0 --- /dev/null +++ b/queue-5.8/block-fix-locking-in-bdev_del_partition.patch @@ -0,0 +1,79 @@ +From fb9abd61238029ae1c5660302c8bcb264236b831 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Sep 2020 11:59:41 +0200 +Subject: block: fix locking in bdev_del_partition + +From: Christoph Hellwig + +[ Upstream commit 08fc1ab6d748ab1a690fd483f41e2938984ce353 ] + +We need to hold the whole device bd_mutex to protect against +other thread concurrently deleting out partition before we get +to it, and thus causing a use after free. + +Fixes: cddae808aeb7 ("block: pass a hd_struct to delete_partition") +Reported-by: syzbot+6448f3c229bc52b82f69@syzkaller.appspotmail.com +Signed-off-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/partitions/core.c | 27 +++++++++++++-------------- + 1 file changed, 13 insertions(+), 14 deletions(-) + +diff --git a/block/partitions/core.c b/block/partitions/core.c +index 78951e33b2d7c..534e11285a8d4 100644 +--- a/block/partitions/core.c ++++ b/block/partitions/core.c +@@ -524,19 +524,20 @@ int bdev_add_partition(struct block_device *bdev, int partno, + int bdev_del_partition(struct block_device *bdev, int partno) + { + struct block_device *bdevp; +- struct hd_struct *part; +- int ret = 0; +- +- part = disk_get_part(bdev->bd_disk, partno); +- if (!part) +- return -ENXIO; ++ struct hd_struct *part = NULL; ++ int ret; + +- ret = -ENOMEM; +- bdevp = bdget(part_devt(part)); ++ bdevp = bdget_disk(bdev->bd_disk, partno); + if (!bdevp) +- goto out_put_part; ++ return -ENOMEM; + + mutex_lock(&bdevp->bd_mutex); ++ mutex_lock_nested(&bdev->bd_mutex, 1); ++ ++ ret = -ENXIO; ++ part = disk_get_part(bdev->bd_disk, partno); ++ if (!part) ++ goto out_unlock; + + ret = -EBUSY; + if (bdevp->bd_openers) +@@ -545,16 +546,14 @@ int bdev_del_partition(struct block_device *bdev, int partno) + sync_blockdev(bdevp); + invalidate_bdev(bdevp); + +- mutex_lock_nested(&bdev->bd_mutex, 1); + delete_partition(bdev->bd_disk, part); +- mutex_unlock(&bdev->bd_mutex); +- + ret = 0; + out_unlock: ++ mutex_unlock(&bdev->bd_mutex); + mutex_unlock(&bdevp->bd_mutex); + bdput(bdevp); +-out_put_part: +- disk_put_part(part); ++ if (part) ++ disk_put_part(part); + return ret; + } + +-- +2.25.1 + diff --git a/queue-5.8/bnxt-don-t-enable-napi-until-rings-are-ready.patch b/queue-5.8/bnxt-don-t-enable-napi-until-rings-are-ready.patch new file mode 100644 index 00000000000..3f4fd60d2b8 --- /dev/null +++ b/queue-5.8/bnxt-don-t-enable-napi-until-rings-are-ready.patch @@ -0,0 +1,86 @@ +From edca13bbb41a9cb68f8e441406226b401f965bf6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 12:40:07 -0700 +Subject: bnxt: don't enable NAPI until rings are ready + +From: Jakub Kicinski + +[ Upstream commit 96ecdcc992eb7f468b2cf829b0f5408a1fad4668 ] + +Netpoll can try to poll napi as soon as napi_enable() is called. +It crashes trying to access a doorbell which is still NULL: + + BUG: kernel NULL pointer dereference, address: 0000000000000000 + CPU: 59 PID: 6039 Comm: ethtool Kdump: loaded Tainted: G S 5.9.0-rc1-00469-g5fd99b5d9950-dirty #26 + RIP: 0010:bnxt_poll+0x121/0x1c0 + Code: c4 20 44 89 e0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 41 8b 86 a0 01 00 00 41 23 85 18 01 00 00 49 8b 96 a8 01 00 00 0d 00 00 00 24 <89> 02 +41 f6 45 77 02 74 cb 49 8b ae d8 01 00 00 31 c0 c7 44 24 1a + netpoll_poll_dev+0xbd/0x1a0 + __netpoll_send_skb+0x1b2/0x210 + netpoll_send_udp+0x2c9/0x406 + write_ext_msg+0x1d7/0x1f0 + console_unlock+0x23c/0x520 + vprintk_emit+0xe0/0x1d0 + printk+0x58/0x6f + x86_vector_activate.cold+0xf/0x46 + __irq_domain_activate_irq+0x50/0x80 + __irq_domain_activate_irq+0x32/0x80 + __irq_domain_activate_irq+0x32/0x80 + irq_domain_activate_irq+0x25/0x40 + __setup_irq+0x2d2/0x700 + request_threaded_irq+0xfb/0x160 + __bnxt_open_nic+0x3b1/0x750 + bnxt_open_nic+0x19/0x30 + ethtool_set_channels+0x1ac/0x220 + dev_ethtool+0x11ba/0x2240 + dev_ioctl+0x1cf/0x390 + sock_do_ioctl+0x95/0x130 + +Reported-by: Rob Sherwood +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Signed-off-by: Jakub Kicinski +Reviewed-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 93a1f36cdb5cf..cd5c7a1412c6d 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -9186,15 +9186,15 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) + } + } + +- bnxt_enable_napi(bp); +- bnxt_debug_dev_init(bp); +- + rc = bnxt_init_nic(bp, irq_re_init); + if (rc) { + netdev_err(bp->dev, "bnxt_init_nic err: %x\n", rc); +- goto open_err; ++ goto open_err_irq; + } + ++ bnxt_enable_napi(bp); ++ bnxt_debug_dev_init(bp); ++ + if (link_re_init) { + mutex_lock(&bp->link_lock); + rc = bnxt_update_phy_setting(bp); +@@ -9225,10 +9225,6 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) + bnxt_vf_reps_open(bp); + return 0; + +-open_err: +- bnxt_debug_dev_exit(bp); +- bnxt_disable_napi(bp); +- + open_err_irq: + bnxt_del_napi(bp); + +-- +2.25.1 + diff --git a/queue-5.8/bnxt_en-check-for-zero-dir-entries-in-nvram.patch b/queue-5.8/bnxt_en-check-for-zero-dir-entries-in-nvram.patch new file mode 100644 index 00000000000..8b167c67433 --- /dev/null +++ b/queue-5.8/bnxt_en-check-for-zero-dir-entries-in-nvram.patch @@ -0,0 +1,39 @@ +From 675775716de9e869d75bd980f60311392ab05628 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 01:08:33 -0400 +Subject: bnxt_en: Check for zero dir entries in NVRAM. + +From: Vasundhara Volam + +[ Upstream commit dbbfa96ad920c50d58bcaefa57f5f33ceef9d00e ] + +If firmware goes into unstable state, HWRM_NVM_GET_DIR_INFO firmware +command may return zero dir entries. Return error in such case to +avoid zero length dma buffer request. + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Signed-off-by: Vasundhara Volam +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index dcb3f61af7ab0..309b73a665ba2 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -2270,6 +2270,9 @@ static int bnxt_get_nvram_directory(struct net_device *dev, u32 len, u8 *data) + if (rc != 0) + return rc; + ++ if (!dir_entries || !entry_length) ++ return -EIO; ++ + /* Insert 2 bytes of directory info (count and size of entries) */ + if (len < 2) + return -EINVAL; +-- +2.25.1 + diff --git a/queue-5.8/bnxt_en-don-t-query-fw-when-netif_running-is-false.patch b/queue-5.8/bnxt_en-don-t-query-fw-when-netif_running-is-false.patch new file mode 100644 index 00000000000..5d3b4d56976 --- /dev/null +++ b/queue-5.8/bnxt_en-don-t-query-fw-when-netif_running-is-false.patch @@ -0,0 +1,40 @@ +From fa3b7dbdd7b1b75952f45afb2f3d3daed682346a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 01:08:32 -0400 +Subject: bnxt_en: Don't query FW when netif_running() is false. + +From: Pavan Chebbi + +[ Upstream commit c1c2d77408022a398a1a7c51cf20488c922629de ] + +In rare conditions like two stage OS installation, the +ethtool's get_channels function may be called when the +device is in D3 state, leading to uncorrectable PCI error. +Check netif_running() first before making any query to FW +which involves writing to BAR. + +Fixes: db4723b3cd2d ("bnxt_en: Check max_tx_scheduler_inputs value from firmware.") +Signed-off-by: Pavan Chebbi +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index b4aa56dc4f9fb..dcb3f61af7ab0 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -847,7 +847,7 @@ static void bnxt_get_channels(struct net_device *dev, + int max_tx_sch_inputs; + + /* Get the most up-to-date max_tx_sch_inputs. */ +- if (BNXT_NEW_RM(bp)) ++ if (netif_running(dev) && BNXT_NEW_RM(bp)) + bnxt_hwrm_func_resc_qcaps(bp, false); + max_tx_sch_inputs = hw_resc->max_tx_sch_inputs; + +-- +2.25.1 + diff --git a/queue-5.8/bnxt_en-fix-ethtool-s-statitics-with-xdp-or-tcs-enab.patch b/queue-5.8/bnxt_en-fix-ethtool-s-statitics-with-xdp-or-tcs-enab.patch new file mode 100644 index 00000000000..b3f5583afe9 --- /dev/null +++ b/queue-5.8/bnxt_en-fix-ethtool-s-statitics-with-xdp-or-tcs-enab.patch @@ -0,0 +1,59 @@ +From b742f5f6dae1eb672a9511d2c10c591fe45989bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 01:08:34 -0400 +Subject: bnxt_en: Fix ethtool -S statitics with XDP or TCs enabled. + +From: Michael Chan + +[ Upstream commit 7de651490c27ebc5edb5c7224c368bd0cd5b3862 ] + +We are returning the wrong count for ETH_SS_STATS in get_sset_count() +when XDP or TCs are enabled. In a recent commit, we got rid of +irrelevant counters when the ring is RX only or TX only, but we +did not make the proper adjustments for the count. As a result, +when we have XDP or TCs enabled, we are returning an excess count +because some of the rings are TX only. This causes ethtool -S to +display extra counters with no counter names. + +Fix bnxt_get_num_ring_stats() by not assuming that all rings will +always have RX and TX counters in combined mode. + +Fixes: 125592fbf467 ("bnxt_en: show only relevant ethtool stats for a TX or RX ring") +Reviewed-by: Vasundhara Volam +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 11 ++--------- + 1 file changed, 2 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 309b73a665ba2..bc2c76fa54cad 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -494,20 +494,13 @@ static int bnxt_get_num_tpa_ring_stats(struct bnxt *bp) + static int bnxt_get_num_ring_stats(struct bnxt *bp) + { + int rx, tx, cmn; +- bool sh = false; +- +- if (bp->flags & BNXT_FLAG_SHARED_RINGS) +- sh = true; + + rx = NUM_RING_RX_HW_STATS + NUM_RING_RX_SW_STATS + + bnxt_get_num_tpa_ring_stats(bp); + tx = NUM_RING_TX_HW_STATS; + cmn = NUM_RING_CMN_SW_STATS; +- if (sh) +- return (rx + tx + cmn) * bp->cp_nr_rings; +- else +- return rx * bp->rx_nr_rings + tx * bp->tx_nr_rings + +- cmn * bp->cp_nr_rings; ++ return rx * bp->rx_nr_rings + tx * bp->tx_nr_rings + ++ cmn * bp->cp_nr_rings; + } + + static int bnxt_get_num_stats(struct bnxt *bp) +-- +2.25.1 + diff --git a/queue-5.8/bnxt_en-fix-hwrm-error-when-querying-vf-temperature.patch b/queue-5.8/bnxt_en-fix-hwrm-error-when-querying-vf-temperature.patch new file mode 100644 index 00000000000..cce533a407b --- /dev/null +++ b/queue-5.8/bnxt_en-fix-hwrm-error-when-querying-vf-temperature.patch @@ -0,0 +1,60 @@ +From e9ef13aec7e3e7189e970d962888643b955c8c22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 01:08:37 -0400 +Subject: bnxt_en: fix HWRM error when querying VF temperature + +From: Edwin Peer + +[ Upstream commit 12cce90b934bf2b0ed9c339b4d5503e69954351a ] + +Firmware returns RESOURCE_ACCESS_DENIED for HWRM_TEMP_MONITORY_QUERY for +VFs. This produces unpleasing error messages in the log when temp1_input +is queried via the hwmon sysfs interface from a VF. + +The error is harmless and expected, so silence it and return unknown as +the value. Since the device temperature is not particularly sensitive +information, provide flexibility to change this policy in future by +silencing the error rather than avoiding the HWRM call entirely for VFs. + +Fixes: cde49a42a9bb ("bnxt_en: Add hwmon sysfs support to read temperature") +Cc: Marc Smith +Reported-by: Marc Smith +Signed-off-by: Edwin Peer +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 5a6ddc2dba4ee..93a1f36cdb5cf 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -8992,16 +8992,19 @@ static ssize_t bnxt_show_temp(struct device *dev, + struct hwrm_temp_monitor_query_input req = {0}; + struct hwrm_temp_monitor_query_output *resp; + struct bnxt *bp = dev_get_drvdata(dev); +- u32 temp = 0; ++ u32 len = 0; + + resp = bp->hwrm_cmd_resp_addr; + bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_TEMP_MONITOR_QUERY, -1, -1); + mutex_lock(&bp->hwrm_cmd_lock); +- if (!_hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT)) +- temp = resp->temp * 1000; /* display millidegree */ ++ if (!_hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT)) ++ len = sprintf(buf, "%u\n", resp->temp * 1000); /* display millidegree */ + mutex_unlock(&bp->hwrm_cmd_lock); + +- return sprintf(buf, "%u\n", temp); ++ if (len) ++ return len; ++ ++ return sprintf(buf, "unknown\n"); + } + static SENSOR_DEVICE_ATTR(temp1_input, 0444, bnxt_show_temp, NULL, 0); + +-- +2.25.1 + diff --git a/queue-5.8/bnxt_en-fix-pci-aer-error-recovery-flow.patch b/queue-5.8/bnxt_en-fix-pci-aer-error-recovery-flow.patch new file mode 100644 index 00000000000..fb222e6543a --- /dev/null +++ b/queue-5.8/bnxt_en-fix-pci-aer-error-recovery-flow.patch @@ -0,0 +1,46 @@ +From f9361af082566c4ecf284ec188a0cbd01d553701 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 01:08:35 -0400 +Subject: bnxt_en: Fix PCI AER error recovery flow + +From: Vasundhara Volam + +[ Upstream commit df3875ec550396974b1d8a518bd120d034738236 ] + +When a PCI error is detected the PCI state could be corrupt, save +the PCI state after initialization and restore it after the slot +reset. + +Fixes: 6316ea6db93d ("bnxt_en: Enable AER support.") +Signed-off-by: Vasundhara Volam +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 7463a1847cebd..e71a99555b4bc 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -12065,6 +12065,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + (long)pci_resource_start(pdev, 0), dev->dev_addr); + pcie_print_link_status(pdev); + ++ pci_save_state(pdev); + return 0; + + init_err_cleanup: +@@ -12260,6 +12261,8 @@ static pci_ers_result_t bnxt_io_slot_reset(struct pci_dev *pdev) + "Cannot re-enable PCI device after reset.\n"); + } else { + pci_set_master(pdev); ++ pci_restore_state(pdev); ++ pci_save_state(pdev); + + err = bnxt_hwrm_func_reset(bp); + if (!err) { +-- +2.25.1 + diff --git a/queue-5.8/bnxt_en-fix-possible-crash-in-bnxt_fw_reset_task.patch b/queue-5.8/bnxt_en-fix-possible-crash-in-bnxt_fw_reset_task.patch new file mode 100644 index 00000000000..ec71963c07f --- /dev/null +++ b/queue-5.8/bnxt_en-fix-possible-crash-in-bnxt_fw_reset_task.patch @@ -0,0 +1,68 @@ +From 3f7dbce1d42a68e91db39088c47ff65c48944f7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 01:08:36 -0400 +Subject: bnxt_en: Fix possible crash in bnxt_fw_reset_task(). + +From: Michael Chan + +[ Upstream commit b148bb238c02f0c7797efed026e9bba5892d2172 ] + +bnxt_fw_reset_task() is run from a delayed workqueue. The current +code is not cancelling the workqueue in the driver's .remove() +method and it can potentially crash if the device is removed with +the workqueue still pending. + +The fix is to clear the BNXT_STATE_IN_FW_RESET flag and then cancel +the delayed workqueue in bnxt_remove_one(). bnxt_queue_fw_reset_work() +also needs to check that this flag is set before scheduling. This +will guarantee that no rescheduling will be done after it is cancelled. + +Fixes: 230d1f0de754 ("bnxt_en: Handle firmware reset.") +Reviewed-by: Vasundhara Volam +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index e71a99555b4bc..5a6ddc2dba4ee 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -1141,6 +1141,9 @@ static int bnxt_discard_rx(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + + static void bnxt_queue_fw_reset_work(struct bnxt *bp, unsigned long delay) + { ++ if (!(test_bit(BNXT_STATE_IN_FW_RESET, &bp->state))) ++ return; ++ + if (BNXT_PF(bp)) + queue_delayed_work(bnxt_pf_wq, &bp->fw_reset_task, delay); + else +@@ -1157,10 +1160,12 @@ static void bnxt_queue_sp_work(struct bnxt *bp) + + static void bnxt_cancel_sp_work(struct bnxt *bp) + { +- if (BNXT_PF(bp)) ++ if (BNXT_PF(bp)) { + flush_workqueue(bnxt_pf_wq); +- else ++ } else { + cancel_work_sync(&bp->sp_task); ++ cancel_delayed_work_sync(&bp->fw_reset_task); ++ } + } + + static void bnxt_sched_reset(struct bnxt *bp, struct bnxt_rx_ring_info *rxr) +@@ -11501,6 +11506,7 @@ static void bnxt_remove_one(struct pci_dev *pdev) + unregister_netdev(dev); + bnxt_dl_unregister(bp); + bnxt_shutdown_tc(bp); ++ clear_bit(BNXT_STATE_IN_FW_RESET, &bp->state); + bnxt_cancel_sp_work(bp); + bp->sp_event = 0; + +-- +2.25.1 + diff --git a/queue-5.8/bpf-fix-a-buffer-out-of-bound-access-when-filling-ra.patch b/queue-5.8/bpf-fix-a-buffer-out-of-bound-access-when-filling-ra.patch new file mode 100644 index 00000000000..0a9a65ae7fd --- /dev/null +++ b/queue-5.8/bpf-fix-a-buffer-out-of-bound-access-when-filling-ra.patch @@ -0,0 +1,44 @@ +From 48fbc9d120ef44db4e87cee6fad5f884ec3b83b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 12:10:54 -0700 +Subject: bpf: Fix a buffer out-of-bound access when filling raw_tp link_info + +From: Yonghong Song + +[ Upstream commit b474959d5afda6e341a02c85f9595d85d39189ae ] + +Commit f2e10bff16a0 ("bpf: Add support for BPF_OBJ_GET_INFO_BY_FD for bpf_link") +added link query for raw_tp. One of fields in link_info is to +fill a user buffer with tp_name. The Scurrent checking only +declares "ulen && !ubuf" as invalid. So "!ulen && ubuf" will be +valid. Later on, we do "copy_to_user(ubuf, tp_name, ulen - 1)" which +may overwrite user memory incorrectly. + +This patch fixed the problem by disallowing "!ulen && ubuf" case as well. + +Fixes: f2e10bff16a0 ("bpf: Add support for BPF_OBJ_GET_INFO_BY_FD for bpf_link") +Signed-off-by: Yonghong Song +Signed-off-by: Alexei Starovoitov +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20200821191054.714731-1-yhs@fb.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/syscall.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index 0fd80ac81f705..72e943b3bd656 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -2629,7 +2629,7 @@ static int bpf_raw_tp_link_fill_link_info(const struct bpf_link *link, + u32 ulen = info->raw_tracepoint.tp_name_len; + size_t tp_len = strlen(tp_name); + +- if (ulen && !ubuf) ++ if (!ulen ^ !ubuf) + return -EINVAL; + + info->raw_tracepoint.tp_name_len = tp_len + 1; +-- +2.25.1 + diff --git a/queue-5.8/cxgb4-fix-thermal-zone-device-registration.patch b/queue-5.8/cxgb4-fix-thermal-zone-device-registration.patch new file mode 100644 index 00000000000..044579108ff --- /dev/null +++ b/queue-5.8/cxgb4-fix-thermal-zone-device-registration.patch @@ -0,0 +1,111 @@ +From 2abf6da3830e3f25b02b30b4e5acdf2e06952520 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Aug 2020 21:14:40 +0530 +Subject: cxgb4: fix thermal zone device registration + +From: Potnuri Bharat Teja + +[ Upstream commit 6b6382a857d824c0866056d5736bbcb597a922ed ] + +When multiple adapters are present in the system, pci hot-removing second +adapter leads to the following warning as both the adapters registered +thermal zone device with same thermal zone name/type. +Therefore, use unique thermal zone name during thermal zone device +initialization. Also mark thermal zone dev NULL once unregistered. + +[ 414.370143] ------------[ cut here ]------------ +[ 414.370944] sysfs group 'power' not found for kobject 'hwmon0' +[ 414.371747] WARNING: CPU: 9 PID: 2661 at fs/sysfs/group.c:281 + sysfs_remove_group+0x76/0x80 +[ 414.382550] CPU: 9 PID: 2661 Comm: bash Not tainted 5.8.0-rc6+ #33 +[ 414.383593] Hardware name: Supermicro X10SRA-F/X10SRA-F, BIOS 2.0a 06/23/2016 +[ 414.384669] RIP: 0010:sysfs_remove_group+0x76/0x80 +[ 414.385738] Code: 48 89 df 5b 5d 41 5c e9 d8 b5 ff ff 48 89 df e8 60 b0 ff ff + eb cb 49 8b 14 24 48 8b 75 00 48 c7 c7 90 ae 13 bb e8 6a 27 d0 ff <0f> 0b 5b 5d + 41 5c c3 0f 1f 00 0f 1f 44 00 00 48 85 f6 74 31 41 54 +[ 414.388404] RSP: 0018:ffffa22bc080fcb0 EFLAGS: 00010286 +[ 414.389638] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 +[ 414.390829] RDX: 0000000000000001 RSI: ffff8ee2de3e9510 RDI: ffff8ee2de3e9510 +[ 414.392064] RBP: ffffffffbaef2ee0 R08: 0000000000000000 R09: 0000000000000000 +[ 414.393224] R10: 0000000000000000 R11: 000000002b30006c R12: ffff8ee260720008 +[ 414.394388] R13: ffff8ee25e0a40e8 R14: ffffa22bc080ff08 R15: ffff8ee2c3be5020 +[ 414.395661] FS: 00007fd2a7171740(0000) GS:ffff8ee2de200000(0000) + knlGS:0000000000000000 +[ 414.396825] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 414.398011] CR2: 00007f178ffe5020 CR3: 000000084c5cc003 CR4: 00000000003606e0 +[ 414.399172] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 414.400352] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 414.401473] Call Trace: +[ 414.402685] device_del+0x89/0x400 +[ 414.403819] device_unregister+0x16/0x60 +[ 414.405024] hwmon_device_unregister+0x44/0xa0 +[ 414.406112] thermal_remove_hwmon_sysfs+0x196/0x200 +[ 414.407256] thermal_zone_device_unregister+0x1b5/0x1f0 +[ 414.408415] cxgb4_thermal_remove+0x3c/0x4f [cxgb4] +[ 414.409668] remove_one+0x212/0x290 [cxgb4] +[ 414.410875] pci_device_remove+0x36/0xb0 +[ 414.412004] device_release_driver_internal+0xe2/0x1c0 +[ 414.413276] pci_stop_bus_device+0x64/0x90 +[ 414.414433] pci_stop_and_remove_bus_device_locked+0x16/0x30 +[ 414.415609] remove_store+0x75/0x90 +[ 414.416790] kernfs_fop_write+0x114/0x1b0 +[ 414.417930] vfs_write+0xcf/0x210 +[ 414.419059] ksys_write+0xa7/0xe0 +[ 414.420120] do_syscall_64+0x4c/0xa0 +[ 414.421278] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +[ 414.422335] RIP: 0033:0x7fd2a686afd0 +[ 414.423396] Code: Bad RIP value. +[ 414.424549] RSP: 002b:00007fffc1446148 EFLAGS: 00000246 ORIG_RAX: + 0000000000000001 +[ 414.425638] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fd2a686afd0 +[ 414.426830] RDX: 0000000000000002 RSI: 00007fd2a7196000 RDI: 0000000000000001 +[ 414.427927] RBP: 00007fd2a7196000 R08: 000000000000000a R09: 00007fd2a7171740 +[ 414.428923] R10: 00007fd2a7171740 R11: 0000000000000246 R12: 00007fd2a6b43400 +[ 414.430082] R13: 0000000000000002 R14: 0000000000000001 R15: 0000000000000000 +[ 414.431027] irq event stamp: 76300 +[ 414.435678] ---[ end trace 13865acb4d5ab00f ]--- + +Fixes: b18719157762 ("cxgb4: Add thermal zone support") +Signed-off-by: Potnuri Bharat Teja +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.c +index 3de8a5e83b6c7..d7fefdbf3e575 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.c +@@ -62,6 +62,7 @@ static struct thermal_zone_device_ops cxgb4_thermal_ops = { + int cxgb4_thermal_init(struct adapter *adap) + { + struct ch_thermal *ch_thermal = &adap->ch_thermal; ++ char ch_tz_name[THERMAL_NAME_LENGTH]; + int num_trip = CXGB4_NUM_TRIPS; + u32 param, val; + int ret; +@@ -82,7 +83,8 @@ int cxgb4_thermal_init(struct adapter *adap) + ch_thermal->trip_type = THERMAL_TRIP_CRITICAL; + } + +- ch_thermal->tzdev = thermal_zone_device_register("cxgb4", num_trip, ++ snprintf(ch_tz_name, sizeof(ch_tz_name), "cxgb4_%s", adap->name); ++ ch_thermal->tzdev = thermal_zone_device_register(ch_tz_name, num_trip, + 0, adap, + &cxgb4_thermal_ops, + NULL, 0, 0); +@@ -97,7 +99,9 @@ int cxgb4_thermal_init(struct adapter *adap) + + int cxgb4_thermal_remove(struct adapter *adap) + { +- if (adap->ch_thermal.tzdev) ++ if (adap->ch_thermal.tzdev) { + thermal_zone_device_unregister(adap->ch_thermal.tzdev); ++ adap->ch_thermal.tzdev = NULL; ++ } + return 0; + } +-- +2.25.1 + diff --git a/queue-5.8/dmaengine-at_hdmac-add-missing-kfree-call-in-at_dma_.patch b/queue-5.8/dmaengine-at_hdmac-add-missing-kfree-call-in-at_dma_.patch new file mode 100644 index 00000000000..e87082287f1 --- /dev/null +++ b/queue-5.8/dmaengine-at_hdmac-add-missing-kfree-call-in-at_dma_.patch @@ -0,0 +1,37 @@ +From 30b1d30f844c63f354098387895affdc67f38c3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Aug 2020 19:57:28 +0800 +Subject: dmaengine: at_hdmac: add missing kfree() call in at_dma_xlate() + +From: Yu Kuai + +[ Upstream commit e097eb7473d9e70da9e03276f61cd392ccb9d79f ] + +If memory allocation for 'atslave' succeed, at_dma_xlate() doesn't have a +corresponding kfree() in exception handling. Thus add kfree() for this +function implementation. + +Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding") +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20200817115728.1706719-4-yukuai3@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/at_hdmac.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c +index c91642b5f1037..626819b33a325 100644 +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -1691,6 +1691,7 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec, + chan = dma_request_channel(mask, at_dma_filter, atslave); + if (!chan) { + put_device(&dmac_pdev->dev); ++ kfree(atslave); + return NULL; + } + +-- +2.25.1 + diff --git a/queue-5.8/dmaengine-at_hdmac-add-missing-put_device-call-in-at.patch b/queue-5.8/dmaengine-at_hdmac-add-missing-put_device-call-in-at.patch new file mode 100644 index 00000000000..531406be0e6 --- /dev/null +++ b/queue-5.8/dmaengine-at_hdmac-add-missing-put_device-call-in-at.patch @@ -0,0 +1,53 @@ +From 55fc955506b88da0399691c5ae3752024093e6e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Aug 2020 19:57:27 +0800 +Subject: dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate() + +From: Yu Kuai + +[ Upstream commit 3832b78b3ec2cf51e07102f9b4480e343459b20f ] + +If of_find_device_by_node() succeed, at_dma_xlate() doesn't have a +corresponding put_device(). Thus add put_device() to fix the exception +handling for this function implementation. + +Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding") +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20200817115728.1706719-3-yukuai3@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/at_hdmac.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c +index 22c1c507055a3..c91642b5f1037 100644 +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -1657,8 +1657,10 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec, + dma_cap_set(DMA_SLAVE, mask); + + atslave = kmalloc(sizeof(*atslave), GFP_KERNEL); +- if (!atslave) ++ if (!atslave) { ++ put_device(&dmac_pdev->dev); + return NULL; ++ } + + atslave->cfg = ATC_DST_H2SEL_HW | ATC_SRC_H2SEL_HW; + /* +@@ -1687,8 +1689,10 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec, + atslave->dma_dev = &dmac_pdev->dev; + + chan = dma_request_channel(mask, at_dma_filter, atslave); +- if (!chan) ++ if (!chan) { ++ put_device(&dmac_pdev->dev); + return NULL; ++ } + + atchan = to_at_dma_chan(chan); + atchan->per_if = dma_spec->args[0] & 0xff; +-- +2.25.1 + diff --git a/queue-5.8/dmaengine-at_hdmac-check-return-value-of-of_find_dev.patch b/queue-5.8/dmaengine-at_hdmac-check-return-value-of-of_find_dev.patch new file mode 100644 index 00000000000..2f034c18a1e --- /dev/null +++ b/queue-5.8/dmaengine-at_hdmac-check-return-value-of-of_find_dev.patch @@ -0,0 +1,39 @@ +From 05a98bad9f17c0c27bb1d188821d706ace841425 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Aug 2020 19:57:26 +0800 +Subject: dmaengine: at_hdmac: check return value of of_find_device_by_node() + in at_dma_xlate() + +From: Yu Kuai + +[ Upstream commit 0cef8e2c5a07d482ec907249dbd6687e8697677f ] + +The reurn value of of_find_device_by_node() is not checked, thus null +pointer dereference will be triggered if of_find_device_by_node() +failed. + +Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding") +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20200817115728.1706719-2-yukuai3@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/at_hdmac.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c +index 73a20780744bf..22c1c507055a3 100644 +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -1650,6 +1650,8 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec, + return NULL; + + dmac_pdev = of_find_device_by_node(dma_spec->np); ++ if (!dmac_pdev) ++ return NULL; + + dma_cap_zero(mask); + dma_cap_set(DMA_SLAVE, mask); +-- +2.25.1 + diff --git a/queue-5.8/dmaengine-of-dma-fix-of_dma_router_xlate-s-of_dma_xl.patch b/queue-5.8/dmaengine-of-dma-fix-of_dma_router_xlate-s-of_dma_xl.patch new file mode 100644 index 00000000000..db312b2255e --- /dev/null +++ b/queue-5.8/dmaengine-of-dma-fix-of_dma_router_xlate-s-of_dma_xl.patch @@ -0,0 +1,47 @@ +From 859f393a4f301cecfcd4c76da22089bc9cba9ed7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 13:49:28 +0300 +Subject: dmaengine: of-dma: Fix of_dma_router_xlate's of_dma_xlate handling + +From: Peter Ujfalusi + +[ Upstream commit 5b2aa9f918f6837ae943557f8cec02c34fcf80e7 ] + +of_dma_xlate callback can return ERR_PTR as well NULL in case of failure. + +If error code is returned (not NULL) then the route should be released and +the router should not be registered for the channel. + +Fixes: 56f13c0d9524c ("dmaengine: of_dma: Support for DMA routers") +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20200806104928.25975-1-peter.ujfalusi@ti.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/of-dma.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/dma/of-dma.c b/drivers/dma/of-dma.c +index b2c2b5e8093cf..0db816eb8080d 100644 +--- a/drivers/dma/of-dma.c ++++ b/drivers/dma/of-dma.c +@@ -71,12 +71,12 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec, + return NULL; + + chan = ofdma_target->of_dma_xlate(&dma_spec_target, ofdma_target); +- if (chan) { +- chan->router = ofdma->dma_router; +- chan->route_data = route_data; +- } else { ++ if (IS_ERR_OR_NULL(chan)) { + ofdma->dma_router->route_free(ofdma->dma_router->dev, + route_data); ++ } else { ++ chan->router = ofdma->dma_router; ++ chan->route_data = route_data; + } + + /* +-- +2.25.1 + diff --git a/queue-5.8/dmaengine-pl330-fix-burst-length-if-burst-size-is-sm.patch b/queue-5.8/dmaengine-pl330-fix-burst-length-if-burst-size-is-sm.patch new file mode 100644 index 00000000000..e208e5cfa8c --- /dev/null +++ b/queue-5.8/dmaengine-pl330-fix-burst-length-if-burst-size-is-sm.patch @@ -0,0 +1,48 @@ +From 72a096722abec619d209285a16f842bd04a8550f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 08:46:17 +0200 +Subject: dmaengine: pl330: Fix burst length if burst size is smaller than bus + width + +From: Marek Szyprowski + +[ Upstream commit 0661cef675d37e2c4b66a996389ebeae8568e49e ] + +Move the burst len fixup after setting the generic value for it. This +finally enables the fixup introduced by commit 137bd11090d8 ("dmaengine: +pl330: Align DMA memcpy operations to MFIFO width"), which otherwise was +overwritten by the generic value. + +Reported-by: kernel test robot +Fixes: 137bd11090d8 ("dmaengine: pl330: Align DMA memcpy operations to MFIFO width") +Signed-off-by: Marek Szyprowski +Link: https://lore.kernel.org/r/20200825064617.16193-1-m.szyprowski@samsung.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/pl330.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c +index 88b884cbb7c1b..9d8a235a5b884 100644 +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -2788,6 +2788,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst, + while (burst != (1 << desc->rqcfg.brst_size)) + desc->rqcfg.brst_size++; + ++ desc->rqcfg.brst_len = get_burst_len(desc, len); + /* + * If burst size is smaller than bus width then make sure we only + * transfer one at a time to avoid a burst stradling an MFIFO entry. +@@ -2795,7 +2796,6 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst, + if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width) + desc->rqcfg.brst_len = 1; + +- desc->rqcfg.brst_len = get_burst_len(desc, len); + desc->bytes_requested = len; + + desc->txd.flags = flags; +-- +2.25.1 + diff --git a/queue-5.8/dmaengine-ti-k3-udma-fix-the-tr-initialization-for-p.patch b/queue-5.8/dmaengine-ti-k3-udma-fix-the-tr-initialization-for-p.patch new file mode 100644 index 00000000000..efa2236555a --- /dev/null +++ b/queue-5.8/dmaengine-ti-k3-udma-fix-the-tr-initialization-for-p.patch @@ -0,0 +1,44 @@ +From fc1fb52a691ed5da0ff775e41d2cee156a12c3a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Aug 2020 15:01:08 +0300 +Subject: dmaengine: ti: k3-udma: Fix the TR initialization for prep_slave_sg + +From: Peter Ujfalusi + +[ Upstream commit 33ebffa105990c43bf336cabe26c77384f59fe70 ] + +The TR which needs to be initialized for the next sg entry is indexed by +tr_idx and not by the running i counter. + +In case any sub element in the SG needs more than one TR, the code would +corrupt an already configured TR. + +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20200824120108.9178-1-peter.ujfalusi@ti.com +Fixes: 6cf668a4ef829 ("dmaengine: ti: k3-udma: Use the TR counter helper for slave_sg and cyclic") +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ti/k3-udma.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c +index 6c879a7343604..3e488d963f246 100644 +--- a/drivers/dma/ti/k3-udma.c ++++ b/drivers/dma/ti/k3-udma.c +@@ -2109,9 +2109,9 @@ udma_prep_slave_sg_tr(struct udma_chan *uc, struct scatterlist *sgl, + return NULL; + } + +- cppi5_tr_init(&tr_req[i].flags, CPPI5_TR_TYPE1, false, false, +- CPPI5_TR_EVENT_SIZE_COMPLETION, 0); +- cppi5_tr_csf_set(&tr_req[i].flags, CPPI5_TR_CSF_SUPR_EVT); ++ cppi5_tr_init(&tr_req[tr_idx].flags, CPPI5_TR_TYPE1, false, ++ false, CPPI5_TR_EVENT_SIZE_COMPLETION, 0); ++ cppi5_tr_csf_set(&tr_req[tr_idx].flags, CPPI5_TR_CSF_SUPR_EVT); + + tr_req[tr_idx].addr = sg_addr; + tr_req[tr_idx].icnt0 = tr0_cnt0; +-- +2.25.1 + diff --git a/queue-5.8/drm-radeon-prefer-lower-feedback-dividers.patch b/queue-5.8/drm-radeon-prefer-lower-feedback-dividers.patch new file mode 100644 index 00000000000..b2e91cff0b1 --- /dev/null +++ b/queue-5.8/drm-radeon-prefer-lower-feedback-dividers.patch @@ -0,0 +1,48 @@ +From 0e7759caa543b3f22e494f5991ad005f516d8a0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 01:33:48 +0800 +Subject: drm/radeon: Prefer lower feedback dividers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kai-Heng Feng + +[ Upstream commit fc8c70526bd30733ea8667adb8b8ffebea30a8ed ] + +Commit 2e26ccb119bd ("drm/radeon: prefer lower reference dividers") +fixed screen flicker for HP Compaq nx9420 but breaks other laptops like +Asus X50SL. + +Turns out we also need to favor lower feedback dividers. + +Users confirmed this change fixes the regression and doesn't regress the +original fix. + +Fixes: 2e26ccb119bd ("drm/radeon: prefer lower reference dividers") +BugLink: https://bugs.launchpad.net/bugs/1791312 +BugLink: https://bugs.launchpad.net/bugs/1861554 +Reviewed-by: Christian König +Signed-off-by: Kai-Heng Feng +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/radeon_display.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c +index df1a7eb736517..840c4bf6307fd 100644 +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -933,7 +933,7 @@ static void avivo_get_fb_ref_div(unsigned nom, unsigned den, unsigned post_div, + + /* get matching reference and feedback divider */ + *ref_div = min(max(den/post_div, 1u), ref_div_max); +- *fb_div = DIV_ROUND_CLOSEST(nom * *ref_div * post_div, den); ++ *fb_div = max(nom * *ref_div * post_div / den, 1u); + + /* limit fb divider to its maximum */ + if (*fb_div > fb_div_max) { +-- +2.25.1 + diff --git a/queue-5.8/fix-regression-in-epoll-keep-a-reference-on-files-ad.patch b/queue-5.8/fix-regression-in-epoll-keep-a-reference-on-files-ad.patch new file mode 100644 index 00000000000..c458f9b1bd0 --- /dev/null +++ b/queue-5.8/fix-regression-in-epoll-keep-a-reference-on-files-ad.patch @@ -0,0 +1,42 @@ +From 2eacd7f08c0878efc6cdb6159d3bde6ff024c87b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 11:30:48 -0400 +Subject: fix regression in "epoll: Keep a reference on files added to the + check list" + +From: Al Viro + +[ Upstream commit 77f4689de17c0887775bb77896f4cc11a39bf848 ] + +epoll_loop_check_proc() can run into a file already committed to destruction; +we can't grab a reference on those and don't need to add them to the set for +reverse path check anyway. + +Tested-by: Marc Zyngier +Fixes: a9ed4a6560b8 ("epoll: Keep a reference on files added to the check list") +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/eventpoll.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/eventpoll.c b/fs/eventpoll.c +index e0decff22ae27..8107e06d7f6f5 100644 +--- a/fs/eventpoll.c ++++ b/fs/eventpoll.c +@@ -1995,9 +1995,9 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests) + * during ep_insert(). + */ + if (list_empty(&epi->ffd.file->f_tfile_llink)) { +- get_file(epi->ffd.file); +- list_add(&epi->ffd.file->f_tfile_llink, +- &tfile_check_list); ++ if (get_file_rcu(epi->ffd.file)) ++ list_add(&epi->ffd.file->f_tfile_llink, ++ &tfile_check_list); + } + } + } +-- +2.25.1 + diff --git a/queue-5.8/gtp-add-gtpa_link-info-to-msg-sent-to-userspace.patch b/queue-5.8/gtp-add-gtpa_link-info-to-msg-sent-to-userspace.patch new file mode 100644 index 00000000000..f856f3fe8d3 --- /dev/null +++ b/queue-5.8/gtp-add-gtpa_link-info-to-msg-sent-to-userspace.patch @@ -0,0 +1,36 @@ +From 673b5f8ce96e09fc429d6e8e434e16e9c0abed12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 14:59:40 +0200 +Subject: gtp: add GTPA_LINK info to msg sent to userspace + +From: Nicolas Dichtel + +[ Upstream commit b274e47d9e3f4dcd4ad4028a316ec22dc4533ac7 ] + +During a dump, this attribute is essential, it enables the userspace to +know on which interface the context is linked to. + +Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") +Signed-off-by: Nicolas Dichtel +Tested-by: Gabriel Ganne +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/gtp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c +index 21640a035d7df..8e47d0112e5dc 100644 +--- a/drivers/net/gtp.c ++++ b/drivers/net/gtp.c +@@ -1179,6 +1179,7 @@ static int gtp_genl_fill_info(struct sk_buff *skb, u32 snd_portid, u32 snd_seq, + goto nlmsg_failure; + + if (nla_put_u32(skb, GTPA_VERSION, pctx->gtp_version) || ++ nla_put_u32(skb, GTPA_LINK, pctx->dev->ifindex) || + nla_put_be32(skb, GTPA_PEER_ADDRESS, pctx->peer_addr_ip4.s_addr) || + nla_put_be32(skb, GTPA_MS_ADDRESS, pctx->ms_addr_ip4.s_addr)) + goto nla_put_failure; +-- +2.25.1 + diff --git a/queue-5.8/include-linux-log2.h-add-missing-around-n-in-roundup.patch b/queue-5.8/include-linux-log2.h-add-missing-around-n-in-roundup.patch new file mode 100644 index 00000000000..1298ea0aaf5 --- /dev/null +++ b/queue-5.8/include-linux-log2.h-add-missing-around-n-in-roundup.patch @@ -0,0 +1,37 @@ +From 8bfa29bb460303b3a17722c488c364c5d5f56e5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Sep 2020 16:36:19 -0700 +Subject: include/linux/log2.h: add missing () around n in roundup_pow_of_two() + +From: Jason Gunthorpe + +[ Upstream commit 428fc0aff4e59399ec719ffcc1f7a5d29a4ee476 ] + +Otherwise gcc generates warnings if the expression is complicated. + +Fixes: 312a0c170945 ("[PATCH] LOG2: Alter roundup_pow_of_two() so that it can use a ilog2() on a constant") +Signed-off-by: Jason Gunthorpe +Signed-off-by: Andrew Morton +Link: https://lkml.kernel.org/r/0-v1-8a2697e3c003+41165-log_brackets_jgg@nvidia.com +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/linux/log2.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/log2.h b/include/linux/log2.h +index 83a4a3ca3e8a7..c619ec6eff4ae 100644 +--- a/include/linux/log2.h ++++ b/include/linux/log2.h +@@ -173,7 +173,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n) + #define roundup_pow_of_two(n) \ + ( \ + __builtin_constant_p(n) ? ( \ +- (n == 1) ? 1 : \ ++ ((n) == 1) ? 1 : \ + (1UL << (ilog2((n) - 1) + 1)) \ + ) : \ + __roundup_pow_of_two(n) \ +-- +2.25.1 + diff --git a/queue-5.8/iommu-amd-restore-irte.remapen-bit-after-programming.patch b/queue-5.8/iommu-amd-restore-irte.remapen-bit-after-programming.patch new file mode 100644 index 00000000000..225430cd09f --- /dev/null +++ b/queue-5.8/iommu-amd-restore-irte.remapen-bit-after-programming.patch @@ -0,0 +1,46 @@ +From c3951941e1e210489b837237dfbd3a0411a62510 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Sep 2020 09:38:21 +0000 +Subject: iommu/amd: Restore IRTE.RemapEn bit after programming IRTE + +From: Suravee Suthikulpanit + +[ Upstream commit 26e495f341075c09023ba16dee9a7f37a021e745 ] + +Currently, the RemapEn (valid) bit is accidentally cleared when +programming IRTE w/ guestMode=0. It should be restored to +the prior state. + +Fixes: b9fc6b56f478 ("iommu/amd: Implements irq_set_vcpu_affinity() hook to setup vapic mode for pass-through devices") +Signed-off-by: Suravee Suthikulpanit +Reviewed-by: Joao Martins +Link: https://lore.kernel.org/r/20200903093822.52012-2-suravee.suthikulpanit@amd.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/iommu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index 2f22326ee4dfe..d7b037891fb7e 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -3841,6 +3841,7 @@ int amd_iommu_deactivate_guest_mode(void *data) + struct amd_ir_data *ir_data = (struct amd_ir_data *)data; + struct irte_ga *entry = (struct irte_ga *) ir_data->entry; + struct irq_cfg *cfg = ir_data->cfg; ++ u64 valid = entry->lo.fields_remap.valid; + + if (!AMD_IOMMU_GUEST_IR_VAPIC(amd_iommu_guest_ir) || + !entry || !entry->lo.fields_vapic.guest_mode) +@@ -3849,6 +3850,7 @@ int amd_iommu_deactivate_guest_mode(void *data) + entry->lo.val = 0; + entry->hi.val = 0; + ++ entry->lo.fields_remap.valid = valid; + entry->lo.fields_remap.dm = apic->irq_dest_mode; + entry->lo.fields_remap.int_type = apic->irq_delivery_mode; + entry->hi.fields.vector = cfg->vector; +-- +2.25.1 + diff --git a/queue-5.8/iommu-amd-use-cmpxchg_double-when-updating-128-bit-i.patch b/queue-5.8/iommu-amd-use-cmpxchg_double-when-updating-128-bit-i.patch new file mode 100644 index 00000000000..274f2278109 --- /dev/null +++ b/queue-5.8/iommu-amd-use-cmpxchg_double-when-updating-128-bit-i.patch @@ -0,0 +1,138 @@ +From 31640157d429339f8fffc14a645cb2c9739e0f17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Sep 2020 09:38:22 +0000 +Subject: iommu/amd: Use cmpxchg_double() when updating 128-bit IRTE + +From: Suravee Suthikulpanit + +[ Upstream commit e52d58d54a321d4fe9d0ecdabe4f8774449f0d6e ] + +When using 128-bit interrupt-remapping table entry (IRTE) (a.k.a GA mode), +current driver disables interrupt remapping when it updates the IRTE +so that the upper and lower 64-bit values can be updated safely. + +However, this creates a small window, where the interrupt could +arrive and result in IO_PAGE_FAULT (for interrupt) as shown below. + + IOMMU Driver Device IRQ + ============ =========== + irte.RemapEn=0 + ... + change IRTE IRQ from device ==> IO_PAGE_FAULT !! + ... + irte.RemapEn=1 + +This scenario has been observed when changing irq affinity on a system +running I/O-intensive workload, in which the destination APIC ID +in the IRTE is updated. + +Instead, use cmpxchg_double() to update the 128-bit IRTE at once without +disabling the interrupt remapping. However, this means several features, +which require GA (128-bit IRTE) support will also be affected if cmpxchg16b +is not supported (which is unprecedented for AMD processors w/ IOMMU). + +Fixes: 880ac60e2538 ("iommu/amd: Introduce interrupt remapping ops structure") +Reported-by: Sean Osborne +Signed-off-by: Suravee Suthikulpanit +Tested-by: Erik Rockstrom +Reviewed-by: Joao Martins +Link: https://lore.kernel.org/r/20200903093822.52012-3-suravee.suthikulpanit@amd.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/Kconfig | 2 +- + drivers/iommu/amd/init.c | 21 +++++++++++++++++++-- + drivers/iommu/amd/iommu.c | 17 +++++++++++++---- + 3 files changed, 33 insertions(+), 7 deletions(-) + +diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig +index b0f308cb7f7c2..201b2718f0755 100644 +--- a/drivers/iommu/Kconfig ++++ b/drivers/iommu/Kconfig +@@ -143,7 +143,7 @@ config AMD_IOMMU + select IOMMU_API + select IOMMU_IOVA + select IOMMU_DMA +- depends on X86_64 && PCI && ACPI ++ depends on X86_64 && PCI && ACPI && HAVE_CMPXCHG_DOUBLE + help + With this option you can enable support for AMD IOMMU hardware in + your system. An IOMMU is a hardware component which provides +diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c +index 6ebd4825e3206..bf45f8e2c7edd 100644 +--- a/drivers/iommu/amd/init.c ++++ b/drivers/iommu/amd/init.c +@@ -1518,7 +1518,14 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h) + iommu->mmio_phys_end = MMIO_REG_END_OFFSET; + else + iommu->mmio_phys_end = MMIO_CNTR_CONF_OFFSET; +- if (((h->efr_attr & (0x1 << IOMMU_FEAT_GASUP_SHIFT)) == 0)) ++ ++ /* ++ * Note: GA (128-bit IRTE) mode requires cmpxchg16b supports. ++ * GAM also requires GA mode. Therefore, we need to ++ * check cmpxchg16b support before enabling it. ++ */ ++ if (!boot_cpu_has(X86_FEATURE_CX16) || ++ ((h->efr_attr & (0x1 << IOMMU_FEAT_GASUP_SHIFT)) == 0)) + amd_iommu_guest_ir = AMD_IOMMU_GUEST_IR_LEGACY; + break; + case 0x11: +@@ -1527,8 +1534,18 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h) + iommu->mmio_phys_end = MMIO_REG_END_OFFSET; + else + iommu->mmio_phys_end = MMIO_CNTR_CONF_OFFSET; +- if (((h->efr_reg & (0x1 << IOMMU_EFR_GASUP_SHIFT)) == 0)) ++ ++ /* ++ * Note: GA (128-bit IRTE) mode requires cmpxchg16b supports. ++ * XT, GAM also requires GA mode. Therefore, we need to ++ * check cmpxchg16b support before enabling them. ++ */ ++ if (!boot_cpu_has(X86_FEATURE_CX16) || ++ ((h->efr_reg & (0x1 << IOMMU_EFR_GASUP_SHIFT)) == 0)) { + amd_iommu_guest_ir = AMD_IOMMU_GUEST_IR_LEGACY; ++ break; ++ } ++ + /* + * Note: Since iommu_update_intcapxt() leverages + * the IOMMU MMIO access to MSI capability block registers +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index d7b037891fb7e..200ee948f6ec1 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -3283,6 +3283,7 @@ out: + static int modify_irte_ga(u16 devid, int index, struct irte_ga *irte, + struct amd_ir_data *data) + { ++ bool ret; + struct irq_remap_table *table; + struct amd_iommu *iommu; + unsigned long flags; +@@ -3300,10 +3301,18 @@ static int modify_irte_ga(u16 devid, int index, struct irte_ga *irte, + + entry = (struct irte_ga *)table->table; + entry = &entry[index]; +- entry->lo.fields_remap.valid = 0; +- entry->hi.val = irte->hi.val; +- entry->lo.val = irte->lo.val; +- entry->lo.fields_remap.valid = 1; ++ ++ ret = cmpxchg_double(&entry->lo.val, &entry->hi.val, ++ entry->lo.val, entry->hi.val, ++ irte->lo.val, irte->hi.val); ++ /* ++ * We use cmpxchg16 to atomically update the 128-bit IRTE, ++ * and it cannot be updated by the hardware or other processors ++ * behind us, so the return value of cmpxchg16 should be the ++ * same as the old value. ++ */ ++ WARN_ON(!ret); ++ + if (data) + data->ref = entry; + +-- +2.25.1 + diff --git a/queue-5.8/iommu-vt-d-serialize-iommu-gcmd-register-modificatio.patch b/queue-5.8/iommu-vt-d-serialize-iommu-gcmd-register-modificatio.patch new file mode 100644 index 00000000000..6ba11f955ad --- /dev/null +++ b/queue-5.8/iommu-vt-d-serialize-iommu-gcmd-register-modificatio.patch @@ -0,0 +1,62 @@ +From f05e1d1118b0332c1c789547b748319e694a4bd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Aug 2020 08:06:15 +0800 +Subject: iommu/vt-d: Serialize IOMMU GCMD register modifications + +From: Lu Baolu + +[ Upstream commit 6e4e9ec65078093165463c13d4eb92b3e8d7b2e8 ] + +The VT-d spec requires (10.4.4 Global Command Register, GCMD_REG General +Description) that: + +If multiple control fields in this register need to be modified, software +must serialize the modifications through multiple writes to this register. + +However, in irq_remapping.c, modifications of IRE and CFI are done in one +write. We need to do two separate writes with STS checking after each. It +also checks the status register before writing command register to avoid +unnecessary register write. + +Fixes: af8d102f999a4 ("x86/intel/irq_remapping: Clean up x2apic opt-out security warning mess") +Signed-off-by: Lu Baolu +Reviewed-by: Kevin Tian +Cc: Andy Lutomirski +Cc: Jacob Pan +Cc: Kevin Tian +Cc: Ashok Raj +Link: https://lore.kernel.org/r/20200828000615.8281-1-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/irq_remapping.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/intel/irq_remapping.c b/drivers/iommu/intel/irq_remapping.c +index aa096b333a991..4828f4fe09ab5 100644 +--- a/drivers/iommu/intel/irq_remapping.c ++++ b/drivers/iommu/intel/irq_remapping.c +@@ -507,12 +507,18 @@ static void iommu_enable_irq_remapping(struct intel_iommu *iommu) + + /* Enable interrupt-remapping */ + iommu->gcmd |= DMA_GCMD_IRE; +- iommu->gcmd &= ~DMA_GCMD_CFI; /* Block compatibility-format MSIs */ + writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG); +- + IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG, + readl, (sts & DMA_GSTS_IRES), sts); + ++ /* Block compatibility-format MSIs */ ++ if (sts & DMA_GSTS_CFIS) { ++ iommu->gcmd &= ~DMA_GCMD_CFI; ++ writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG); ++ IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG, ++ readl, !(sts & DMA_GSTS_CFIS), sts); ++ } ++ + /* + * With CFI clear in the Global Command register, we should be + * protected from dangerous (i.e. compatibility) interrupts +-- +2.25.1 + diff --git a/queue-5.8/media-cedrus-add-missing-v4l2_ctrl_request_hdl_put.patch b/queue-5.8/media-cedrus-add-missing-v4l2_ctrl_request_hdl_put.patch new file mode 100644 index 00000000000..12644e345c3 --- /dev/null +++ b/queue-5.8/media-cedrus-add-missing-v4l2_ctrl_request_hdl_put.patch @@ -0,0 +1,54 @@ +From 8aa245b699242731baa06216661b45c6f46ee20a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Aug 2020 21:18:33 +0200 +Subject: media: cedrus: Add missing v4l2_ctrl_request_hdl_put() + +From: Ezequiel Garcia + +[ Upstream commit b30063976f29fc221a99d18d37d22ca035068aa9 ] + +The check for a required control in the request was missing a call to +v4l2_ctrl_request_hdl_put() in the error path. Fix it. + +Fixes: 50e761516f2b8c ("media: platform: Add Cedrus VPU decoder driver") +Signed-off-by: Ezequiel Garcia +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/sunxi/cedrus/cedrus.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.c b/drivers/staging/media/sunxi/cedrus/cedrus.c +index bc27f9430eeb1..7c6b91f0e780a 100644 +--- a/drivers/staging/media/sunxi/cedrus/cedrus.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus.c +@@ -199,6 +199,7 @@ static int cedrus_request_validate(struct media_request *req) + struct v4l2_ctrl *ctrl_test; + unsigned int count; + unsigned int i; ++ int ret = 0; + + list_for_each_entry(obj, &req->objects, list) { + struct vb2_buffer *vb; +@@ -243,12 +244,16 @@ static int cedrus_request_validate(struct media_request *req) + if (!ctrl_test) { + v4l2_info(&ctx->dev->v4l2_dev, + "Missing required codec control\n"); +- return -ENOENT; ++ ret = -ENOENT; ++ break; + } + } + + v4l2_ctrl_request_hdl_put(hdl); + ++ if (ret) ++ return ret; ++ + return vb2_request_validate(req); + } + +-- +2.25.1 + diff --git a/queue-5.8/media-i2c-imx214-select-v4l2_fwnode.patch b/queue-5.8/media-i2c-imx214-select-v4l2_fwnode.patch new file mode 100644 index 00000000000..59f71641589 --- /dev/null +++ b/queue-5.8/media-i2c-imx214-select-v4l2_fwnode.patch @@ -0,0 +1,57 @@ +From aba29d9058bad6040d6bc30b3ec97ec7626f7eb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jun 2020 18:43:52 +0200 +Subject: media: i2c: imx214: select V4L2_FWNODE + +From: Jacopo Mondi + +[ Upstream commit bca82e3557ee1fbfbdacb09033a2d81ac76c86eb ] + +After the recent conversion of the media build infrastructure to select +V4L2 components instead of depending on their presence, which took place +in: +32a363d0b0b14 ("media: Kconfig files: use select for V4L2 subdevs and MC") + +imx214 stands out as being the (only?) media I2C driver that still depends +on a V4L2 core symbol instead of selecting it. + +This confuses the build system which claims it has detected a circular +dependency when other drivers select the same symbol as the imx214 +driver does. + +drivers/media/i2c/Kconfig:728:error: recursive dependency detected! +drivers/media/i2c/Kconfig:728: symbol VIDEO_IMX214 depends on V4L2_FWNODE +drivers/media/v4l2-core/Kconfig:71: symbol V4L2_FWNODE is selected by VIDEO_BCM2835_UNICAM +drivers/media/platform/bcm2835/Kconfig:3: symbol VIDEO_BCM2835_UNICAM depends on VIDEO_V4L2_SUBDEV_API +drivers/media/v4l2-core/Kconfig:19: symbol VIDEO_V4L2_SUBDEV_API depends on MEDIA_CONTROLLER +drivers/media/Kconfig:168: symbol MEDIA_CONTROLLER is selected by VIDEO_IMX214 + +Fix this by making the imx214 driver select V4L2_FWNODE instead of +depending on it and align it with all the other drivers. + +Fixes: 32a363d0b0b14 ("media: Kconfig files: use select for V4L2 subdevs and MC") +Reviewed-by: Laurent Pinchart +Signed-off-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig +index da11036ad804d..6b1a6851ccb0b 100644 +--- a/drivers/media/i2c/Kconfig ++++ b/drivers/media/i2c/Kconfig +@@ -728,7 +728,7 @@ config VIDEO_HI556 + config VIDEO_IMX214 + tristate "Sony IMX214 sensor support" + depends on GPIOLIB && I2C && VIDEO_V4L2 +- depends on V4L2_FWNODE ++ select V4L2_FWNODE + select MEDIA_CONTROLLER + select VIDEO_V4L2_SUBDEV_API + select REGMAP_I2C +-- +2.25.1 + diff --git a/queue-5.8/media-vicodec-add-missing-v4l2_ctrl_request_hdl_put.patch b/queue-5.8/media-vicodec-add-missing-v4l2_ctrl_request_hdl_put.patch new file mode 100644 index 00000000000..c6e103f7f38 --- /dev/null +++ b/queue-5.8/media-vicodec-add-missing-v4l2_ctrl_request_hdl_put.patch @@ -0,0 +1,37 @@ +From cb03ccb4665f3b76fc5f4d4f4d37e9c079365f57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Aug 2020 12:30:33 +0200 +Subject: media: vicodec: add missing v4l2_ctrl_request_hdl_put() + +From: Hans Verkuil + +[ Upstream commit 2e7c8fb8942773f412fe12f3b63e8bb92c18ab3f ] + +The check for a required control in the request was missing a call to +v4l2_ctrl_request_hdl_put(), so the control request object was never +released. + +Signed-off-by: Hans Verkuil +Fixes: 997deb811bf5 ("media: vicodec: Add support for stateless decoder.") +Reviewed-by: Ezequiel Garcia +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/test-drivers/vicodec/vicodec-core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/test-drivers/vicodec/vicodec-core.c b/drivers/media/test-drivers/vicodec/vicodec-core.c +index e879290727ef4..25c4ca6884dda 100644 +--- a/drivers/media/test-drivers/vicodec/vicodec-core.c ++++ b/drivers/media/test-drivers/vicodec/vicodec-core.c +@@ -1994,6 +1994,7 @@ static int vicodec_request_validate(struct media_request *req) + } + ctrl = v4l2_ctrl_request_hdl_ctrl_find(hdl, + vicodec_ctrl_stateless_state.id); ++ v4l2_ctrl_request_hdl_put(hdl); + if (!ctrl) { + v4l2_info(&ctx->dev->v4l2_dev, + "Missing required codec control\n"); +-- +2.25.1 + diff --git a/queue-5.8/mips-add-missing-msacsr-and-upper-msa-initialization.patch b/queue-5.8/mips-add-missing-msacsr-and-upper-msa-initialization.patch new file mode 100644 index 00000000000..691927c32c9 --- /dev/null +++ b/queue-5.8/mips-add-missing-msacsr-and-upper-msa-initialization.patch @@ -0,0 +1,50 @@ +From a29691825fe7fc6727e3dd1fcdbffb98da73a5ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Sep 2020 14:53:09 +0800 +Subject: MIPS: add missing MSACSR and upper MSA initialization + +From: Huang Pei + +[ Upstream commit bb06748207cfb1502d11b90325eba7f8c44c9f02 ] + +In cc97ab235f3f ("MIPS: Simplify FP context initialization), init_fp_ctx +just initialize the fp/msa context, and own_fp_inatomic just restore +FCSR and 64bit FP regs from it, but miss MSACSR and upper MSA regs for +MSA, so MSACSR and MSA upper regs's value from previous task on current +cpu can leak into current task and cause unpredictable behavior when MSA +context not initialized. + +Fixes: cc97ab235f3f ("MIPS: Simplify FP context initialization") +Signed-off-by: Huang Pei +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/traps.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c +index e664d8b43e72b..2e9d0637591c9 100644 +--- a/arch/mips/kernel/traps.c ++++ b/arch/mips/kernel/traps.c +@@ -1286,6 +1286,18 @@ static int enable_restore_fp_context(int msa) + err = own_fpu_inatomic(1); + if (msa && !err) { + enable_msa(); ++ /* ++ * with MSA enabled, userspace can see MSACSR ++ * and MSA regs, but the values in them are from ++ * other task before current task, restore them ++ * from saved fp/msa context ++ */ ++ write_msa_csr(current->thread.fpu.msacsr); ++ /* ++ * own_fpu_inatomic(1) just restore low 64bit, ++ * fix the high 64bit ++ */ ++ init_msa_upper(); + set_thread_flag(TIF_USEDMSA); + set_thread_flag(TIF_MSA_CTX_LIVE); + } +-- +2.25.1 + diff --git a/queue-5.8/mips-bmips-also-call-bmips_cpu_setup-for-secondary-c.patch b/queue-5.8/mips-bmips-also-call-bmips_cpu_setup-for-secondary-c.patch new file mode 100644 index 00000000000..89a5c830cf1 --- /dev/null +++ b/queue-5.8/mips-bmips-also-call-bmips_cpu_setup-for-secondary-c.patch @@ -0,0 +1,37 @@ +From df2f8c28e3153f0ad54fb1001281ec4c77dea202 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Aug 2020 11:26:45 -0700 +Subject: MIPS: BMIPS: Also call bmips_cpu_setup() for secondary cores + +From: Florian Fainelli + +[ Upstream commit e14f633b66902615cf7faa5d032b45ab8b6fb158 ] + +The initialization done by bmips_cpu_setup() typically affects both +threads of a given core, on 7435 which supports 2 cores and 2 threads, +logical CPU number 2 and 3 would not run this initialization. + +Fixes: 738a3f79027b ("MIPS: BMIPS: Add early CPU initialization code") +Signed-off-by: Florian Fainelli +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/smp-bmips.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c +index 2f513506a3d52..1dbfb5aadffd6 100644 +--- a/arch/mips/kernel/smp-bmips.c ++++ b/arch/mips/kernel/smp-bmips.c +@@ -239,6 +239,8 @@ static int bmips_boot_secondary(int cpu, struct task_struct *idle) + */ + static void bmips_init_secondary(void) + { ++ bmips_cpu_setup(); ++ + switch (current_cpu_type()) { + case CPU_BMIPS4350: + case CPU_BMIPS4380: +-- +2.25.1 + diff --git a/queue-5.8/mips-mm-bmips5000-has-inclusive-physical-caches.patch b/queue-5.8/mips-mm-bmips5000-has-inclusive-physical-caches.patch new file mode 100644 index 00000000000..c41a6f1fd38 --- /dev/null +++ b/queue-5.8/mips-mm-bmips5000-has-inclusive-physical-caches.patch @@ -0,0 +1,41 @@ +From aae490bcb17fdc493630dd4d4609e49341049f01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Aug 2020 11:26:44 -0700 +Subject: MIPS: mm: BMIPS5000 has inclusive physical caches + +From: Florian Fainelli + +[ Upstream commit dbfc95f98f0158958d1f1e6bf06d74be38dbd821 ] + +When the BMIPS generic cpu-feature-overrides.h file was introduced, +cpu_has_inclusive_caches/MIPS_CPU_INCLUSIVE_CACHES was not set for +BMIPS5000 CPUs. Correct this when we have initialized the MIPS secondary +cache successfully. + +Fixes: f337967d6d87 ("MIPS: BMIPS: Add cpu-feature-overrides.h") +Signed-off-by: Florian Fainelli +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/mm/c-r4k.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c +index 49569e5666d7a..cb32a00d286e1 100644 +--- a/arch/mips/mm/c-r4k.c ++++ b/arch/mips/mm/c-r4k.c +@@ -1712,7 +1712,11 @@ static void setup_scache(void) + printk("MIPS secondary cache %ldkB, %s, linesize %d bytes.\n", + scache_size >> 10, + way_string[c->scache.ways], c->scache.linesz); ++ ++ if (current_cpu_type() == CPU_BMIPS5000) ++ c->options |= MIPS_CPU_INCLUSIVE_CACHES; + } ++ + #else + if (!(c->scache.flags & MIPS_CACHE_NOT_PRESENT)) + panic("Dunno how to handle MIPS32 / MIPS64 second level cache"); +-- +2.25.1 + diff --git a/queue-5.8/mips-perf-fix-wrong-check-condition-of-loongson-even.patch b/queue-5.8/mips-perf-fix-wrong-check-condition-of-loongson-even.patch new file mode 100644 index 00000000000..b9c615f1b38 --- /dev/null +++ b/queue-5.8/mips-perf-fix-wrong-check-condition-of-loongson-even.patch @@ -0,0 +1,44 @@ +From 4de7c835a6bd26276db559f5118bff17f49cb678 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Aug 2020 16:03:08 +0800 +Subject: MIPS: perf: Fix wrong check condition of Loongson event IDs + +From: Tiezhu Yang + +[ Upstream commit a231995700c392c0807da95deea231b23fc51a3c ] + +According to the user's manual chapter 8.2.1 of Loongson 3A2000 CPU [1] +and 3A3000 CPU [2], we should take some event IDs such as 274, 358, 359 +and 360 as valid in the check condition, otherwise they are recognized +as "not supported", fix it. + +[1] http://www.loongson.cn/uploadfile/cpu/3A2000/Loongson3A2000_user2.pdf +[2] http://www.loongson.cn/uploadfile/cpu/3A3000/Loongson3A3000_3B3000user2.pdf + +Fixes: e9dfbaaeef1c ("MIPS: perf: Add hardware perf events support for new Loongson-3") +Signed-off-by: Tiezhu Yang +Acked-by: Huang Pei +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/perf_event_mipsxx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/kernel/perf_event_mipsxx.c b/arch/mips/kernel/perf_event_mipsxx.c +index efce5defcc5cf..011eb6bbf81a5 100644 +--- a/arch/mips/kernel/perf_event_mipsxx.c ++++ b/arch/mips/kernel/perf_event_mipsxx.c +@@ -1898,8 +1898,8 @@ static const struct mips_perf_event *mipsxx_pmu_map_raw_event(u64 config) + (base_id >= 64 && base_id < 90) || + (base_id >= 128 && base_id < 164) || + (base_id >= 192 && base_id < 200) || +- (base_id >= 256 && base_id < 274) || +- (base_id >= 320 && base_id < 358) || ++ (base_id >= 256 && base_id < 275) || ++ (base_id >= 320 && base_id < 361) || + (base_id >= 384 && base_id < 574)) + break; + +-- +2.25.1 + diff --git a/queue-5.8/mips-sni-fix-scsi-interrupt.patch b/queue-5.8/mips-sni-fix-scsi-interrupt.patch new file mode 100644 index 00000000000..d4b1997a214 --- /dev/null +++ b/queue-5.8/mips-sni-fix-scsi-interrupt.patch @@ -0,0 +1,40 @@ +From 3c96dea5170b18e041ada2bb8628bfe2bc074aa4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 23:32:14 +0200 +Subject: MIPS: SNI: Fix SCSI interrupt + +From: Thomas Bogendoerfer + +[ Upstream commit baf5cb30fbd1c22f6aa03c081794c2ee0f5be4da ] + +On RM400(a20r) machines ISA and SCSI interrupts share the same interrupt +line. Commit 49e6e07e3c80 ("MIPS: pass non-NULL dev_id on shared +request_irq()") accidently dropped the IRQF_SHARED bit, which breaks +registering SCSI interrupt. Put back IRQF_SHARED and add dev_id for +ISA interrupt. + +Fixes: 49e6e07e3c80 ("MIPS: pass non-NULL dev_id on shared request_irq()") +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/sni/a20r.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/sni/a20r.c b/arch/mips/sni/a20r.c +index 0ecffb65fd6d1..b09dc844985a8 100644 +--- a/arch/mips/sni/a20r.c ++++ b/arch/mips/sni/a20r.c +@@ -222,8 +222,8 @@ void __init sni_a20r_irq_init(void) + irq_set_chip_and_handler(i, &a20r_irq_type, handle_level_irq); + sni_hwint = a20r_hwint; + change_c0_status(ST0_IM, IE_IRQ0); +- if (request_irq(SNI_A20R_IRQ_BASE + 3, sni_isa_irq_handler, 0, "ISA", +- NULL)) ++ if (request_irq(SNI_A20R_IRQ_BASE + 3, sni_isa_irq_handler, ++ IRQF_SHARED, "ISA", sni_isa_irq_handler)) + pr_err("Failed to register ISA interrupt\n"); + } + +-- +2.25.1 + diff --git a/queue-5.8/mmc-sdhci-acpi-fix-hs400-tuning-for-amdi0040.patch b/queue-5.8/mmc-sdhci-acpi-fix-hs400-tuning-for-amdi0040.patch new file mode 100644 index 00000000000..9b6d73a0093 --- /dev/null +++ b/queue-5.8/mmc-sdhci-acpi-fix-hs400-tuning-for-amdi0040.patch @@ -0,0 +1,139 @@ +From 115177d5e1f2ed35fe3b97aadcf6e5ca2347322c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Aug 2020 13:00:19 -0600 +Subject: mmc: sdhci-acpi: Fix HS400 tuning for AMDI0040 + +From: Raul E Rangel + +[ Upstream commit 61d7437ed13906984c44697970ee792ac6271a31 ] + +The AMD eMMC Controller can only use the tuned clock while in HS200 and +HS400 mode. If we switch to a different mode, we need to disable the +tuned clock. If we have previously performed tuning and switch back to +HS200 or HS400, we can re-enable the tuned clock. + +Previously the tuned clock was not getting disabled when switching to +DDR52 which is part of the HS400 tuning sequence. + +Fixes: 34597a3f60b1 ("mmc: sdhci-acpi: Add support for ACPI HID of AMD Controller with HS400") +Signed-off-by: Raul E Rangel +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20200819125832.v2.1.Ie8f0689ec9f449203328b37409d1cf06b565f331@changeid +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-acpi.c | 67 +++++++++++++++++++++++++++++------ + 1 file changed, 57 insertions(+), 10 deletions(-) + +diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c +index d8b76cb8698aa..2d9f79b50a7fa 100644 +--- a/drivers/mmc/host/sdhci-acpi.c ++++ b/drivers/mmc/host/sdhci-acpi.c +@@ -535,6 +535,11 @@ static const struct sdhci_acpi_slot sdhci_acpi_slot_qcom_sd = { + .caps = MMC_CAP_NONREMOVABLE, + }; + ++struct amd_sdhci_host { ++ bool tuned_clock; ++ bool dll_enabled; ++}; ++ + /* AMD sdhci reset dll register. */ + #define SDHCI_AMD_RESET_DLL_REGISTER 0x908 + +@@ -554,26 +559,66 @@ static void sdhci_acpi_amd_hs400_dll(struct sdhci_host *host) + } + + /* +- * For AMD Platform it is required to disable the tuning +- * bit first controller to bring to HS Mode from HS200 +- * mode, later enable to tune to HS400 mode. ++ * The initialization sequence for HS400 is: ++ * HS->HS200->Perform Tuning->HS->HS400 ++ * ++ * The re-tuning sequence is: ++ * HS400->DDR52->HS->HS200->Perform Tuning->HS->HS400 ++ * ++ * The AMD eMMC Controller can only use the tuned clock while in HS200 and HS400 ++ * mode. If we switch to a different mode, we need to disable the tuned clock. ++ * If we have previously performed tuning and switch back to HS200 or ++ * HS400, we can re-enable the tuned clock. ++ * + */ + static void amd_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) + { + struct sdhci_host *host = mmc_priv(mmc); ++ struct sdhci_acpi_host *acpi_host = sdhci_priv(host); ++ struct amd_sdhci_host *amd_host = sdhci_acpi_priv(acpi_host); + unsigned int old_timing = host->timing; ++ u16 val; + + sdhci_set_ios(mmc, ios); +- if (old_timing == MMC_TIMING_MMC_HS200 && +- ios->timing == MMC_TIMING_MMC_HS) +- sdhci_writew(host, 0x9, SDHCI_HOST_CONTROL2); +- if (old_timing != MMC_TIMING_MMC_HS400 && +- ios->timing == MMC_TIMING_MMC_HS400) { +- sdhci_writew(host, 0x80, SDHCI_HOST_CONTROL2); +- sdhci_acpi_amd_hs400_dll(host); ++ ++ if (old_timing != host->timing && amd_host->tuned_clock) { ++ if (host->timing == MMC_TIMING_MMC_HS400 || ++ host->timing == MMC_TIMING_MMC_HS200) { ++ val = sdhci_readw(host, SDHCI_HOST_CONTROL2); ++ val |= SDHCI_CTRL_TUNED_CLK; ++ sdhci_writew(host, val, SDHCI_HOST_CONTROL2); ++ } else { ++ val = sdhci_readw(host, SDHCI_HOST_CONTROL2); ++ val &= ~SDHCI_CTRL_TUNED_CLK; ++ sdhci_writew(host, val, SDHCI_HOST_CONTROL2); ++ } ++ ++ /* DLL is only required for HS400 */ ++ if (host->timing == MMC_TIMING_MMC_HS400 && ++ !amd_host->dll_enabled) { ++ sdhci_acpi_amd_hs400_dll(host); ++ amd_host->dll_enabled = true; ++ } + } + } + ++static int amd_sdhci_execute_tuning(struct mmc_host *mmc, u32 opcode) ++{ ++ int err; ++ struct sdhci_host *host = mmc_priv(mmc); ++ struct sdhci_acpi_host *acpi_host = sdhci_priv(host); ++ struct amd_sdhci_host *amd_host = sdhci_acpi_priv(acpi_host); ++ ++ amd_host->tuned_clock = false; ++ ++ err = sdhci_execute_tuning(mmc, opcode); ++ ++ if (!err && !host->tuning_err) ++ amd_host->tuned_clock = true; ++ ++ return err; ++} ++ + static const struct sdhci_ops sdhci_acpi_ops_amd = { + .set_clock = sdhci_set_clock, + .set_bus_width = sdhci_set_bus_width, +@@ -601,6 +646,7 @@ static int sdhci_acpi_emmc_amd_probe_slot(struct platform_device *pdev, + + host->mmc_host_ops.select_drive_strength = amd_select_drive_strength; + host->mmc_host_ops.set_ios = amd_set_ios; ++ host->mmc_host_ops.execute_tuning = amd_sdhci_execute_tuning; + return 0; + } + +@@ -612,6 +658,7 @@ static const struct sdhci_acpi_slot sdhci_acpi_slot_amd_emmc = { + SDHCI_QUIRK_32BIT_ADMA_SIZE, + .quirks2 = SDHCI_QUIRK2_BROKEN_64_BIT_DMA, + .probe_slot = sdhci_acpi_emmc_amd_probe_slot, ++ .priv_size = sizeof(struct amd_sdhci_host), + }; + + struct sdhci_acpi_uid_slot { +-- +2.25.1 + diff --git a/queue-5.8/net-arc_emac-fix-memleak-in-arc_mdio_probe.patch b/queue-5.8/net-arc_emac-fix-memleak-in-arc_mdio_probe.patch new file mode 100644 index 00000000000..bde146d5be9 --- /dev/null +++ b/queue-5.8/net-arc_emac-fix-memleak-in-arc_mdio_probe.patch @@ -0,0 +1,36 @@ +From 5593c7d0e148ec8c68802dea1e5fead68910e693 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Aug 2020 16:56:47 +0800 +Subject: net: arc_emac: Fix memleak in arc_mdio_probe + +From: Dinghao Liu + +[ Upstream commit e2d79cd8875fa8c3cc7defa98a8cc99a1ed0c62f ] + +When devm_gpiod_get_optional() fails, bus should be +freed just like when of_mdiobus_register() fails. + +Fixes: 1bddd96cba03d ("net: arc_emac: support the phy reset for emac driver") +Signed-off-by: Dinghao Liu +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/arc/emac_mdio.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/arc/emac_mdio.c b/drivers/net/ethernet/arc/emac_mdio.c +index 0187dbf3b87df..54cdafdd067db 100644 +--- a/drivers/net/ethernet/arc/emac_mdio.c ++++ b/drivers/net/ethernet/arc/emac_mdio.c +@@ -153,6 +153,7 @@ int arc_mdio_probe(struct arc_emac_priv *priv) + if (IS_ERR(data->reset_gpio)) { + error = PTR_ERR(data->reset_gpio); + dev_err(priv->dev, "Failed to request gpio: %d\n", error); ++ mdiobus_free(bus); + return error; + } + +-- +2.25.1 + diff --git a/queue-5.8/net-bcmgenet-fix-mask-check-in-bcmgenet_validate_flo.patch b/queue-5.8/net-bcmgenet-fix-mask-check-in-bcmgenet_validate_flo.patch new file mode 100644 index 00000000000..856cafe5930 --- /dev/null +++ b/queue-5.8/net-bcmgenet-fix-mask-check-in-bcmgenet_validate_flo.patch @@ -0,0 +1,39 @@ +From e6db3f97e403a5dbb393550481a2f8abe87fdff8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 14:18:45 +0300 +Subject: net: bcmgenet: fix mask check in bcmgenet_validate_flow() + +From: Denis Efremov + +[ Upstream commit 1996cf46e4673a25ef2478eb266714f409a98221 ] + +VALIDATE_MASK(eth_mask->h_source) is checked twice in a row in +bcmgenet_validate_flow(). Add VALIDATE_MASK(eth_mask->h_dest) +instead. + +Fixes: 3e370952287c ("net: bcmgenet: add support for ethtool rxnfc flows") +Signed-off-by: Denis Efremov +Acked-by: Doug Berger +Acked-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index e471b14fc6e98..f0074c873da3b 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -1364,7 +1364,7 @@ static int bcmgenet_validate_flow(struct net_device *dev, + case ETHER_FLOW: + eth_mask = &cmd->fs.m_u.ether_spec; + /* don't allow mask which isn't valid */ +- if (VALIDATE_MASK(eth_mask->h_source) || ++ if (VALIDATE_MASK(eth_mask->h_dest) || + VALIDATE_MASK(eth_mask->h_source) || + VALIDATE_MASK(eth_mask->h_proto)) { + netdev_err(dev, "rxnfc: Unsupported mask\n"); +-- +2.25.1 + diff --git a/queue-5.8/net-dp83867-fix-wol-secureon-password.patch b/queue-5.8/net-dp83867-fix-wol-secureon-password.patch new file mode 100644 index 00000000000..3f77db4d636 --- /dev/null +++ b/queue-5.8/net-dp83867-fix-wol-secureon-password.patch @@ -0,0 +1,41 @@ +From 275e86b0cff71ce2c41aecb2c5c395fc335607de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 14:27:04 -0500 +Subject: net: dp83867: Fix WoL SecureOn password + +From: Dan Murphy + +[ Upstream commit 8b4a11c67da538504d60ae917ffe5254f59b1248 ] + +Fix the registers being written to as the values were being over written +when writing the same registers. + +Fixes: caabee5b53f5 ("net: phy: dp83867: support Wake on LAN") +Signed-off-by: Dan Murphy +Reviewed-by: Andrew Lunn +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/dp83867.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c +index f3c04981b8da6..cd7032628a28c 100644 +--- a/drivers/net/phy/dp83867.c ++++ b/drivers/net/phy/dp83867.c +@@ -215,9 +215,9 @@ static int dp83867_set_wol(struct phy_device *phydev, + if (wol->wolopts & WAKE_MAGICSECURE) { + phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_RXFSOP1, + (wol->sopass[1] << 8) | wol->sopass[0]); +- phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_RXFSOP1, ++ phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_RXFSOP2, + (wol->sopass[3] << 8) | wol->sopass[2]); +- phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_RXFSOP1, ++ phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_RXFSOP3, + (wol->sopass[5] << 8) | wol->sopass[4]); + + val_rxcfg |= DP83867_WOL_SEC_EN; +-- +2.25.1 + diff --git a/queue-5.8/net-dsa-mt7530-fix-advertising-unsupported-1000baset.patch b/queue-5.8/net-dsa-mt7530-fix-advertising-unsupported-1000baset.patch new file mode 100644 index 00000000000..e527bcf6a47 --- /dev/null +++ b/queue-5.8/net-dsa-mt7530-fix-advertising-unsupported-1000baset.patch @@ -0,0 +1,38 @@ +From d3050fe91bc3736ad0035164be45e7a490a3f457 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Aug 2020 17:15:47 +0800 +Subject: net: dsa: mt7530: fix advertising unsupported 1000baseT_Half + +From: Landen Chao + +[ Upstream commit f272285f6abb9178d029375599626baf3d5f4e8a ] + +Remove 1000baseT_Half to advertise correct hardware capability in +phylink_validate() callback function. + +Fixes: 38f790a80560 ("net: dsa: mt7530: Add support for port 5") +Signed-off-by: Landen Chao +Reviewed-by: Andrew Lunn +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mt7530.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index 8dcb8a49ab67f..238417db26f9b 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -1501,7 +1501,7 @@ unsupported: + phylink_set(mask, 100baseT_Full); + + if (state->interface != PHY_INTERFACE_MODE_MII) { +- phylink_set(mask, 1000baseT_Half); ++ /* This switch only supports 1G full-duplex. */ + phylink_set(mask, 1000baseT_Full); + if (port == 5) + phylink_set(mask, 1000baseX_Full); +-- +2.25.1 + diff --git a/queue-5.8/net-ethernet-mlx4-fix-memory-allocation-in-mlx4_budd.patch b/queue-5.8/net-ethernet-mlx4-fix-memory-allocation-in-mlx4_budd.patch new file mode 100644 index 00000000000..bd5b7af87ee --- /dev/null +++ b/queue-5.8/net-ethernet-mlx4-fix-memory-allocation-in-mlx4_budd.patch @@ -0,0 +1,44 @@ +From 093c9d7ba4c0e1ff6678a727b310d84ce11a1e5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Aug 2020 22:37:09 +0800 +Subject: net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init() + +From: Shung-Hsi Yu + +[ Upstream commit cbedcb044e9cc4e14bbe6658111224bb923094f4 ] + +On machines with much memory (> 2 TByte) and log_mtts_per_seg == 0, a +max_order of 31 will be passed to mlx_buddy_init(), which results in +s = BITS_TO_LONGS(1 << 31) becoming a negative value, leading to +kvmalloc_array() failure when it is converted to size_t. + + mlx4_core 0000:b1:00.0: Failed to initialize memory region table, aborting + mlx4_core: probe of 0000:b1:00.0 failed with error -12 + +Fix this issue by changing the left shifting operand from a signed literal to +an unsigned one. + +Fixes: 225c7b1feef1 ("IB/mlx4: Add a driver Mellanox ConnectX InfiniBand adapters") +Signed-off-by: Shung-Hsi Yu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/mr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c +index d2986f1f2db02..d7444782bfdd0 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mr.c ++++ b/drivers/net/ethernet/mellanox/mlx4/mr.c +@@ -114,7 +114,7 @@ static int mlx4_buddy_init(struct mlx4_buddy *buddy, int max_order) + goto err_out; + + for (i = 0; i <= buddy->max_order; ++i) { +- s = BITS_TO_LONGS(1 << (buddy->max_order - i)); ++ s = BITS_TO_LONGS(1UL << (buddy->max_order - i)); + buddy->bits[i] = kvmalloc_array(s, sizeof(long), GFP_KERNEL | __GFP_ZERO); + if (!buddy->bits[i]) + goto err_out_free; +-- +2.25.1 + diff --git a/queue-5.8/net-ethernet-ti-am65-cpsw-fix-rmii-100mbit-link-mode.patch b/queue-5.8/net-ethernet-ti-am65-cpsw-fix-rmii-100mbit-link-mode.patch new file mode 100644 index 00000000000..aca58aa8748 --- /dev/null +++ b/queue-5.8/net-ethernet-ti-am65-cpsw-fix-rmii-100mbit-link-mode.patch @@ -0,0 +1,36 @@ +From 2e72e775ee23776e9e3b7f6fbcbb6a1ed8700b69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Aug 2020 20:34:32 +0300 +Subject: net: ethernet: ti: am65-cpsw: fix rmii 100Mbit link mode + +From: Grygorii Strashko + +[ Upstream commit c2f89219f559502c9292d79f695bab9dcec532d1 ] + +In RMII link mode it's required to set bit 15 IFCTL_A in MAC_SL MAC_CONTROL +register to enable support for 100Mbit link speed. + +Fixes: 93a76530316a ("net: ethernet: ti: introduce am65x/j721e gigabit eth subsystem driver") +Signed-off-by: Grygorii Strashko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +index 88832277edd5a..c7c9980e02604 100644 +--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c ++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +@@ -172,6 +172,8 @@ void am65_cpsw_nuss_adjust_link(struct net_device *ndev) + if (phy->speed == 10 && phy_interface_is_rgmii(phy)) + /* Can be used with in band mode only */ + mac_control |= CPSW_SL_CTL_EXT_EN; ++ if (phy->speed == 100 && phy->interface == PHY_INTERFACE_MODE_RMII) ++ mac_control |= CPSW_SL_CTL_IFCTL_A; + if (phy->duplex) + mac_control |= CPSW_SL_CTL_FULLDUPLEX; + +-- +2.25.1 + diff --git a/queue-5.8/net-ethernet-ti-cpsw-fix-clean-up-of-vlan-mc-entries.patch b/queue-5.8/net-ethernet-ti-cpsw-fix-clean-up-of-vlan-mc-entries.patch new file mode 100644 index 00000000000..530cd1472cf --- /dev/null +++ b/queue-5.8/net-ethernet-ti-cpsw-fix-clean-up-of-vlan-mc-entries.patch @@ -0,0 +1,41 @@ +From db894f399dfea5a9ff896ee3b83f04472c2c3c54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Aug 2020 11:10:52 -0400 +Subject: net: ethernet: ti: cpsw: fix clean up of vlan mc entries for host + port + +From: Murali Karicheri + +[ Upstream commit 99d469fc64d06f0c81c0fe2a1c01645a67e0cbf0 ] + +To flush the vid + mc entries from ALE, which is required when a VLAN +interface is removed, driver needs to call cpsw_ale_flush_multicast() +with ALE_PORT_HOST for port mask as these entries are added only for +host port. Without this, these entries remain in the ALE table even +after removing the VLAN interface. cpsw_ale_flush_multicast() calls +cpsw_ale_flush_mcast which expects a port mask to do the job. + +Fixes: 15180eca569b ("net: ethernet: ti: cpsw: fix vlan mcast") +Signed-off-by: Murali Karicheri +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/cpsw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index 9b17bbbe102fe..4a65edc5a3759 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -1116,7 +1116,7 @@ static int cpsw_ndo_vlan_rx_kill_vid(struct net_device *ndev, + HOST_PORT_NUM, ALE_VLAN, vid); + ret |= cpsw_ale_del_mcast(cpsw->ale, priv->ndev->broadcast, + 0, ALE_VLAN, vid); +- ret |= cpsw_ale_flush_multicast(cpsw->ale, 0, vid); ++ ret |= cpsw_ale_flush_multicast(cpsw->ale, ALE_PORT_HOST, vid); + err: + pm_runtime_put(cpsw->dev); + return ret; +-- +2.25.1 + diff --git a/queue-5.8/net-ethernet-ti-cpsw_new-fix-clean-up-of-vlan-mc-ent.patch b/queue-5.8/net-ethernet-ti-cpsw_new-fix-clean-up-of-vlan-mc-ent.patch new file mode 100644 index 00000000000..f7b3445b37a --- /dev/null +++ b/queue-5.8/net-ethernet-ti-cpsw_new-fix-clean-up-of-vlan-mc-ent.patch @@ -0,0 +1,41 @@ +From 461c6a44caef294c5e9d5efc1e0e720007c0cb38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Aug 2020 11:10:53 -0400 +Subject: net: ethernet: ti: cpsw_new: fix clean up of vlan mc entries for host + port + +From: Murali Karicheri + +[ Upstream commit 2c6500e82e5190b038f0b79f85a20da55bdd4b86 ] + +To flush the vid + mc entries from ALE, which is required when a VLAN +interface is removed, driver needs to call cpsw_ale_flush_multicast() +with ALE_PORT_HOST for port mask as these entries are added only for +host port. Without this, these entries remain in the ALE table even +after removing the VLAN interface. cpsw_ale_flush_multicast() calls +cpsw_ale_flush_mcast which expects a port mask to do the job. + +Fixes: ed3525eda4c4 ("net: ethernet: ti: introduce cpsw switchdev based driver part 1 - dual-emac") +Signed-off-by: Murali Karicheri +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/cpsw_new.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ti/cpsw_new.c b/drivers/net/ethernet/ti/cpsw_new.c +index 1247d35d42ef3..8d0a2bc7128d4 100644 +--- a/drivers/net/ethernet/ti/cpsw_new.c ++++ b/drivers/net/ethernet/ti/cpsw_new.c +@@ -1044,7 +1044,7 @@ static int cpsw_ndo_vlan_rx_kill_vid(struct net_device *ndev, + HOST_PORT_NUM, ALE_VLAN, vid); + cpsw_ale_del_mcast(cpsw->ale, priv->ndev->broadcast, + 0, ALE_VLAN, vid); +- cpsw_ale_flush_multicast(cpsw->ale, 0, vid); ++ cpsw_ale_flush_multicast(cpsw->ale, ALE_PORT_HOST, vid); + err: + pm_runtime_put(cpsw->dev); + return ret; +-- +2.25.1 + diff --git a/queue-5.8/net-ethernet-ti-cpsw_new-fix-error-handling-in-cpsw_.patch b/queue-5.8/net-ethernet-ti-cpsw_new-fix-error-handling-in-cpsw_.patch new file mode 100644 index 00000000000..d050d1b1714 --- /dev/null +++ b/queue-5.8/net-ethernet-ti-cpsw_new-fix-error-handling-in-cpsw_.patch @@ -0,0 +1,81 @@ +From cd2c319fee07f2c0bd5dcf60e0dfc2547dafebed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Aug 2020 10:38:39 -0400 +Subject: net: ethernet: ti: cpsw_new: fix error handling in + cpsw_ndo_vlan_rx_kill_vid() + +From: Murali Karicheri + +[ Upstream commit af8ea111134624855710a0ef5543b871d49b0162 ] + +This patch fixes a bunch of issues in cpsw_ndo_vlan_rx_kill_vid() + + - pm_runtime_get_sync() returns non zero value. This results in + non zero value return to caller which will be interpreted as error. + So overwrite ret with zero. + - If VID matches with port VLAN VID, then set error code. + - Currently when VLAN interface is deleted, all of the VLAN mc addresses + are removed from ALE table, however the return values from ale function + calls are not checked. These functions can return error code -ENOENT. + But that shouldn't happen in a normal case. So add error print to + catch the situations so that these can be investigated and addressed. + return zero in these cases as these are not real error case, but only + serve to catch ALE table update related issues and help address the + same in the driver. + +Fixes: ed3525eda4c4 ("net: ethernet: ti: introduce cpsw switchdev based driver part 1 - dual-emac") +Signed-off-by: Murali Karicheri +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/cpsw_new.c | 27 +++++++++++++++++++++------ + 1 file changed, 21 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/ti/cpsw_new.c b/drivers/net/ethernet/ti/cpsw_new.c +index 8d0a2bc7128d4..8ed78577cdedf 100644 +--- a/drivers/net/ethernet/ti/cpsw_new.c ++++ b/drivers/net/ethernet/ti/cpsw_new.c +@@ -1032,19 +1032,34 @@ static int cpsw_ndo_vlan_rx_kill_vid(struct net_device *ndev, + return ret; + } + ++ /* reset the return code as pm_runtime_get_sync() can return ++ * non zero values as well. ++ */ ++ ret = 0; + for (i = 0; i < cpsw->data.slaves; i++) { + if (cpsw->slaves[i].ndev && +- vid == cpsw->slaves[i].port_vlan) ++ vid == cpsw->slaves[i].port_vlan) { ++ ret = -EINVAL; + goto err; ++ } + } + + dev_dbg(priv->dev, "removing vlanid %d from vlan filter\n", vid); +- cpsw_ale_del_vlan(cpsw->ale, vid, 0); +- cpsw_ale_del_ucast(cpsw->ale, priv->mac_addr, +- HOST_PORT_NUM, ALE_VLAN, vid); +- cpsw_ale_del_mcast(cpsw->ale, priv->ndev->broadcast, +- 0, ALE_VLAN, vid); ++ ret = cpsw_ale_del_vlan(cpsw->ale, vid, 0); ++ if (ret) ++ dev_err(priv->dev, "cpsw_ale_del_vlan() failed: ret %d\n", ret); ++ ret = cpsw_ale_del_ucast(cpsw->ale, priv->mac_addr, ++ HOST_PORT_NUM, ALE_VLAN, vid); ++ if (ret) ++ dev_err(priv->dev, "cpsw_ale_del_ucast() failed: ret %d\n", ++ ret); ++ ret = cpsw_ale_del_mcast(cpsw->ale, priv->ndev->broadcast, ++ 0, ALE_VLAN, vid); ++ if (ret) ++ dev_err(priv->dev, "cpsw_ale_del_mcast failed. ret %d\n", ++ ret); + cpsw_ale_flush_multicast(cpsw->ale, ALE_PORT_HOST, vid); ++ ret = 0; + err: + pm_runtime_put(cpsw->dev); + return ret; +-- +2.25.1 + diff --git a/queue-5.8/net-gemini-fix-another-missing-clk_disable_unprepare.patch b/queue-5.8/net-gemini-fix-another-missing-clk_disable_unprepare.patch new file mode 100644 index 00000000000..b3c438c1980 --- /dev/null +++ b/queue-5.8/net-gemini-fix-another-missing-clk_disable_unprepare.patch @@ -0,0 +1,84 @@ +From acf2d5e5f09b0a3a676eb45044f9d792cccc75c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 14:56:31 +0300 +Subject: net: gemini: Fix another missing clk_disable_unprepare() in probe + +From: Dan Carpenter + +[ Upstream commit eb0f3bc463d59d86402f19c59aa44e82dc3fab6d ] + +We recently added some calls to clk_disable_unprepare() but we missed +the last error path if register_netdev() fails. + +I made a couple cleanups so we avoid mistakes like this in the future. +First I reversed the "if (!ret)" condition and pulled the code in one +indent level. Also, the "port->netdev = NULL;" is not required because +"port" isn't used again outside this function so I deleted that line. + +Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cortina/gemini.c | 34 +++++++++++++-------------- + 1 file changed, 17 insertions(+), 17 deletions(-) + +diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c +index 62e271aea4a50..ffec0f3dd9578 100644 +--- a/drivers/net/ethernet/cortina/gemini.c ++++ b/drivers/net/ethernet/cortina/gemini.c +@@ -2446,8 +2446,8 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev) + port->reset = devm_reset_control_get_exclusive(dev, NULL); + if (IS_ERR(port->reset)) { + dev_err(dev, "no reset\n"); +- clk_disable_unprepare(port->pclk); +- return PTR_ERR(port->reset); ++ ret = PTR_ERR(port->reset); ++ goto unprepare; + } + reset_control_reset(port->reset); + usleep_range(100, 500); +@@ -2502,25 +2502,25 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev) + IRQF_SHARED, + port_names[port->id], + port); +- if (ret) { +- clk_disable_unprepare(port->pclk); +- return ret; +- } ++ if (ret) ++ goto unprepare; + + ret = register_netdev(netdev); +- if (!ret) { ++ if (ret) ++ goto unprepare; ++ ++ netdev_info(netdev, ++ "irq %d, DMA @ 0x%pap, GMAC @ 0x%pap\n", ++ port->irq, &dmares->start, ++ &gmacres->start); ++ ret = gmac_setup_phy(netdev); ++ if (ret) + netdev_info(netdev, +- "irq %d, DMA @ 0x%pap, GMAC @ 0x%pap\n", +- port->irq, &dmares->start, +- &gmacres->start); +- ret = gmac_setup_phy(netdev); +- if (ret) +- netdev_info(netdev, +- "PHY init failed, deferring to ifup time\n"); +- return 0; +- } ++ "PHY init failed, deferring to ifup time\n"); ++ return 0; + +- port->netdev = NULL; ++unprepare: ++ clk_disable_unprepare(port->pclk); + return ret; + } + +-- +2.25.1 + diff --git a/queue-5.8/net-hns-fix-memleak-in-hns_nic_dev_probe.patch b/queue-5.8/net-hns-fix-memleak-in-hns_nic_dev_probe.patch new file mode 100644 index 00000000000..97fa9c4fa60 --- /dev/null +++ b/queue-5.8/net-hns-fix-memleak-in-hns_nic_dev_probe.patch @@ -0,0 +1,50 @@ +From 3036fcdc8d39bab299b77f2cfc8987e8780a8662 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Aug 2020 13:44:42 +0800 +Subject: net: hns: Fix memleak in hns_nic_dev_probe + +From: Dinghao Liu + +[ Upstream commit 100e3345c6e719d2291e1efd5de311cc24bb9c0b ] + +hns_nic_dev_probe allocates ndev, but not free it on +two error handling paths, which may lead to memleak. + +Fixes: 63434888aaf1b ("net: hns: net: hns: enet adds support of acpi") +Signed-off-by: Dinghao Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns/hns_enet.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +index 23f278e46975b..22522f8a52999 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +@@ -2282,8 +2282,10 @@ static int hns_nic_dev_probe(struct platform_device *pdev) + priv->enet_ver = AE_VERSION_1; + else if (acpi_dev_found(hns_enet_acpi_match[1].id)) + priv->enet_ver = AE_VERSION_2; +- else +- return -ENXIO; ++ else { ++ ret = -ENXIO; ++ goto out_read_prop_fail; ++ } + + /* try to find port-idx-in-ae first */ + ret = acpi_node_get_property_reference(dev->fwnode, +@@ -2299,7 +2301,8 @@ static int hns_nic_dev_probe(struct platform_device *pdev) + priv->fwnode = args.fwnode; + } else { + dev_err(dev, "cannot read cfg data from OF or acpi\n"); +- return -ENXIO; ++ ret = -ENXIO; ++ goto out_read_prop_fail; + } + + ret = device_property_read_u32(dev, "port-idx-in-ae", &port_id); +-- +2.25.1 + diff --git a/queue-5.8/net-packet-fix-overflow-in-tpacket_rcv.patch b/queue-5.8/net-packet-fix-overflow-in-tpacket_rcv.patch new file mode 100644 index 00000000000..6c6868f5c67 --- /dev/null +++ b/queue-5.8/net-packet-fix-overflow-in-tpacket_rcv.patch @@ -0,0 +1,59 @@ +From 00c393ea14d12a4ef490a6aedf0fa6bfc2bfe8c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Sep 2020 21:05:28 -0700 +Subject: net/packet: fix overflow in tpacket_rcv + +From: Or Cohen + +[ Upstream commit acf69c946233259ab4d64f8869d4037a198c7f06 ] + +Using tp_reserve to calculate netoff can overflow as +tp_reserve is unsigned int and netoff is unsigned short. + +This may lead to macoff receving a smaller value then +sizeof(struct virtio_net_hdr), and if po->has_vnet_hdr +is set, an out-of-bounds write will occur when +calling virtio_net_hdr_from_skb. + +The bug is fixed by converting netoff to unsigned int +and checking if it exceeds USHRT_MAX. + +This addresses CVE-2020-14386 + +Fixes: 8913336a7e8d ("packet: add PACKET_RESERVE sockopt") +Signed-off-by: Or Cohen +Signed-off-by: Eric Dumazet +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 301f41d4929bd..82f7802983797 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2170,7 +2170,8 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + int skb_len = skb->len; + unsigned int snaplen, res; + unsigned long status = TP_STATUS_USER; +- unsigned short macoff, netoff, hdrlen; ++ unsigned short macoff, hdrlen; ++ unsigned int netoff; + struct sk_buff *copy_skb = NULL; + struct timespec64 ts; + __u32 ts_status; +@@ -2239,6 +2240,10 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + } + macoff = netoff - maclen; + } ++ if (netoff > USHRT_MAX) { ++ atomic_inc(&po->tp_drops); ++ goto drop_n_restore; ++ } + if (po->tp_version <= TPACKET_V2) { + if (macoff + snaplen > po->rx_ring.frame_size) { + if (po->copy_thresh && +-- +2.25.1 + diff --git a/queue-5.8/net-systemport-fix-memleak-in-bcm_sysport_probe.patch b/queue-5.8/net-systemport-fix-memleak-in-bcm_sysport_probe.patch new file mode 100644 index 00000000000..9ad46b1370c --- /dev/null +++ b/queue-5.8/net-systemport-fix-memleak-in-bcm_sysport_probe.patch @@ -0,0 +1,40 @@ +From f535fec9745c98bd9534f96d60f4743459ec6230 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Aug 2020 13:58:31 +0800 +Subject: net: systemport: Fix memleak in bcm_sysport_probe + +From: Dinghao Liu + +[ Upstream commit 7ef1fc57301f3cef7201497aa27e89ccb91737fe ] + +When devm_kcalloc() fails, dev should be freed just +like what we've done in the subsequent error paths. + +Fixes: 7b78be48a8eb6 ("net: systemport: Dynamically allocate number of TX rings") +Signed-off-by: Dinghao Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bcmsysport.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c +index b25356e21a1ea..e6ccc2122573d 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -2462,8 +2462,10 @@ static int bcm_sysport_probe(struct platform_device *pdev) + priv->tx_rings = devm_kcalloc(&pdev->dev, txq, + sizeof(struct bcm_sysport_tx_ring), + GFP_KERNEL); +- if (!priv->tx_rings) +- return -ENOMEM; ++ if (!priv->tx_rings) { ++ ret = -ENOMEM; ++ goto err_free_netdev; ++ } + + priv->is_lite = params->is_lite; + priv->num_rx_desc_words = params->num_rx_desc_words; +-- +2.25.1 + diff --git a/queue-5.8/netfilter-conntrack-do-not-auto-delete-clash-entries.patch b/queue-5.8/netfilter-conntrack-do-not-auto-delete-clash-entries.patch new file mode 100644 index 00000000000..da6abc2dfe0 --- /dev/null +++ b/queue-5.8/netfilter-conntrack-do-not-auto-delete-clash-entries.patch @@ -0,0 +1,117 @@ +From f00cf534e565f42f0d29aea2a9a0e977557b46cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 00:07:18 +0200 +Subject: netfilter: conntrack: do not auto-delete clash entries on reply + +From: Florian Westphal + +[ Upstream commit c46172147ebbeb70094db48d76ab7945d96c638b ] + +Its possible that we have more than one packet with the same ct tuple +simultaneously, e.g. when an application emits n packets on same UDP +socket from multiple threads. + +NAT rules might be applied to those packets. With the right set of rules, +n packets will be mapped to m destinations, where at least two packets end +up with the same destination. + +When this happens, the existing clash resolution may merge the skb that +is processed after the first has been received with the identical tuple +already in hash table. + +However, its possible that this identical tuple is a NAT_CLASH tuple. +In that case the second skb will be sent, but no reply can be received +since the reply that is processed first removes the NAT_CLASH tuple. + +Do not auto-delete, this gives a 1 second window for replies to be passed +back to originator. + +Packets that are coming later (udp stream case) will not be affected: +they match the original ct entry, not a NAT_CLASH one. + +Also prevent NAT_CLASH entries from getting offloaded. + +Fixes: 6a757c07e51f ("netfilter: conntrack: allow insertion of clashing entries") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_proto_udp.c | 26 ++++++++++---------------- + net/netfilter/nft_flow_offload.c | 2 +- + 2 files changed, 11 insertions(+), 17 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c +index 760ca24228165..af402f458ee02 100644 +--- a/net/netfilter/nf_conntrack_proto_udp.c ++++ b/net/netfilter/nf_conntrack_proto_udp.c +@@ -81,18 +81,6 @@ static bool udp_error(struct sk_buff *skb, + return false; + } + +-static void nf_conntrack_udp_refresh_unreplied(struct nf_conn *ct, +- struct sk_buff *skb, +- enum ip_conntrack_info ctinfo, +- u32 extra_jiffies) +-{ +- if (unlikely(ctinfo == IP_CT_ESTABLISHED_REPLY && +- ct->status & IPS_NAT_CLASH)) +- nf_ct_kill(ct); +- else +- nf_ct_refresh_acct(ct, ctinfo, skb, extra_jiffies); +-} +- + /* Returns verdict for packet, and may modify conntracktype */ + int nf_conntrack_udp_packet(struct nf_conn *ct, + struct sk_buff *skb, +@@ -124,12 +112,15 @@ int nf_conntrack_udp_packet(struct nf_conn *ct, + + nf_ct_refresh_acct(ct, ctinfo, skb, extra); + ++ /* never set ASSURED for IPS_NAT_CLASH, they time out soon */ ++ if (unlikely((ct->status & IPS_NAT_CLASH))) ++ return NF_ACCEPT; ++ + /* Also, more likely to be important, and not a probe */ + if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status)) + nf_conntrack_event_cache(IPCT_ASSURED, ct); + } else { +- nf_conntrack_udp_refresh_unreplied(ct, skb, ctinfo, +- timeouts[UDP_CT_UNREPLIED]); ++ nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[UDP_CT_UNREPLIED]); + } + return NF_ACCEPT; + } +@@ -206,12 +197,15 @@ int nf_conntrack_udplite_packet(struct nf_conn *ct, + if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) { + nf_ct_refresh_acct(ct, ctinfo, skb, + timeouts[UDP_CT_REPLIED]); ++ ++ if (unlikely((ct->status & IPS_NAT_CLASH))) ++ return NF_ACCEPT; ++ + /* Also, more likely to be important, and not a probe */ + if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status)) + nf_conntrack_event_cache(IPCT_ASSURED, ct); + } else { +- nf_conntrack_udp_refresh_unreplied(ct, skb, ctinfo, +- timeouts[UDP_CT_UNREPLIED]); ++ nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[UDP_CT_UNREPLIED]); + } + return NF_ACCEPT; + } +diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c +index 3b9b97aa4b32e..3a6c84fb2c90d 100644 +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -102,7 +102,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, + } + + if (nf_ct_ext_exist(ct, NF_CT_EXT_HELPER) || +- ct->status & IPS_SEQ_ADJUST) ++ ct->status & (IPS_SEQ_ADJUST | IPS_NAT_CLASH)) + goto out; + + if (!nf_ct_is_confirmed(ct)) +-- +2.25.1 + diff --git a/queue-5.8/netfilter-nf_tables-add-nfta_set_userdata-if-not-nul.patch b/queue-5.8/netfilter-nf_tables-add-nfta_set_userdata-if-not-nul.patch new file mode 100644 index 00000000000..03dc933f39f --- /dev/null +++ b/queue-5.8/netfilter-nf_tables-add-nfta_set_userdata-if-not-nul.patch @@ -0,0 +1,36 @@ +From 9eae998a9c909f721588ecbee8bcdd600981aafa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 14:12:54 +0200 +Subject: netfilter: nf_tables: add NFTA_SET_USERDATA if not null + +From: Pablo Neira Ayuso + +[ Upstream commit 6f03bf43ee05b31d3822def2a80f11b3591c55b3 ] + +Kernel sends an empty NFTA_SET_USERDATA attribute with no value if +userspace adds a set with no NFTA_SET_USERDATA attribute. + +Fixes: e6d8ecac9e68 ("netfilter: nf_tables: Add new attributes into nft_set to store user data.") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index d31832d32e028..39be0a3015c63 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -3643,7 +3643,8 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, + goto nla_put_failure; + } + +- if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata)) ++ if (set->udata && ++ nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata)) + goto nla_put_failure; + + nest = nla_nest_start_noflag(skb, NFTA_SET_DESC); +-- +2.25.1 + diff --git a/queue-5.8/netfilter-nf_tables-fix-destination-register-zeroing.patch b/queue-5.8/netfilter-nf_tables-fix-destination-register-zeroing.patch new file mode 100644 index 00000000000..13e8b9a0314 --- /dev/null +++ b/queue-5.8/netfilter-nf_tables-fix-destination-register-zeroing.patch @@ -0,0 +1,82 @@ +From a79db758d1394d32bb3694c516d6158a2c579a55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 21:05:50 +0200 +Subject: netfilter: nf_tables: fix destination register zeroing + +From: Florian Westphal + +[ Upstream commit 1e105e6afa6c3d32bfb52c00ffa393894a525c27 ] + +Following bug was reported via irc: +nft list ruleset + set knock_candidates_ipv4 { + type ipv4_addr . inet_service + size 65535 + elements = { 127.0.0.1 . 123, + 127.0.0.1 . 123 } + } + .. + udp dport 123 add @knock_candidates_ipv4 { ip saddr . 123 } + udp dport 123 add @knock_candidates_ipv4 { ip saddr . udp dport } + +It should not have been possible to add a duplicate set entry. + +After some debugging it turned out that the problem is the immediate +value (123) in the second-to-last rule. + +Concatenations use 32bit registers, i.e. the elements are 8 bytes each, +not 6 and it turns out the kernel inserted + +inet firewall @knock_candidates_ipv4 + element 0100007f ffff7b00 : 0 [end] + element 0100007f 00007b00 : 0 [end] + +Note the non-zero upper bits of the first element. It turns out that +nft_immediate doesn't zero the destination register, but this is needed +when the length isn't a multiple of 4. + +Furthermore, the zeroing in nft_payload is broken. We can't use +[len / 4] = 0 -- if len is a multiple of 4, index is off by one. + +Skip zeroing in this case and use a conditional instead of (len -1) / 4. + +Fixes: 49499c3e6e18 ("netfilter: nf_tables: switch registers to 32 bit addressing") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_tables.h | 2 ++ + net/netfilter/nft_payload.c | 4 +++- + 2 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index 6f0f6fca9ac3e..ec2cbfab71f35 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -143,6 +143,8 @@ static inline u64 nft_reg_load64(const u32 *sreg) + static inline void nft_data_copy(u32 *dst, const struct nft_data *src, + unsigned int len) + { ++ if (len % NFT_REG32_SIZE) ++ dst[len / NFT_REG32_SIZE] = 0; + memcpy(dst, src, len); + } + +diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c +index a7de3a58f553d..67ce866a446d9 100644 +--- a/net/netfilter/nft_payload.c ++++ b/net/netfilter/nft_payload.c +@@ -87,7 +87,9 @@ void nft_payload_eval(const struct nft_expr *expr, + u32 *dest = ®s->data[priv->dreg]; + int offset; + +- dest[priv->len / NFT_REG32_SIZE] = 0; ++ if (priv->len % NFT_REG32_SIZE) ++ dest[priv->len / NFT_REG32_SIZE] = 0; ++ + switch (priv->base) { + case NFT_PAYLOAD_LL_HEADER: + if (!skb_mac_header_was_set(skb)) +-- +2.25.1 + diff --git a/queue-5.8/netfilter-nf_tables-incorrect-enum-nft_list_attribut.patch b/queue-5.8/netfilter-nf_tables-incorrect-enum-nft_list_attribut.patch new file mode 100644 index 00000000000..be06e7c0e65 --- /dev/null +++ b/queue-5.8/netfilter-nf_tables-incorrect-enum-nft_list_attribut.patch @@ -0,0 +1,35 @@ +From 241fe63ded1c8f236c71ffd11bd02f5a7ff49493 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 14:12:55 +0200 +Subject: netfilter: nf_tables: incorrect enum nft_list_attributes definition + +From: Pablo Neira Ayuso + +[ Upstream commit da9125df854ea48a6240c66e8a67be06e2c12c03 ] + +This should be NFTA_LIST_UNSPEC instead of NFTA_LIST_UNPEC, all other +similar attribute definitions are postfixed with _UNSPEC. + +Fixes: 96518518cc41 ("netfilter: add nftables") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/uapi/linux/netfilter/nf_tables.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h +index 4565456c0ef44..0b27da1d771ba 100644 +--- a/include/uapi/linux/netfilter/nf_tables.h ++++ b/include/uapi/linux/netfilter/nf_tables.h +@@ -133,7 +133,7 @@ enum nf_tables_msg_types { + * @NFTA_LIST_ELEM: list element (NLA_NESTED) + */ + enum nft_list_attributes { +- NFTA_LIST_UNPEC, ++ NFTA_LIST_UNSPEC, + NFTA_LIST_ELEM, + __NFTA_LIST_MAX + }; +-- +2.25.1 + diff --git a/queue-5.8/netfilter-nfnetlink-nfnetlink_unicast-reports-eagain.patch b/queue-5.8/netfilter-nfnetlink-nfnetlink_unicast-reports-eagain.patch new file mode 100644 index 00000000000..783f82f531f --- /dev/null +++ b/queue-5.8/netfilter-nfnetlink-nfnetlink_unicast-reports-eagain.patch @@ -0,0 +1,238 @@ +From f6b1c1b107841883ebe00f711535660c785b6858 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Aug 2020 13:55:36 +0200 +Subject: netfilter: nfnetlink: nfnetlink_unicast() reports EAGAIN instead of + ENOBUFS + +From: Pablo Neira Ayuso + +[ Upstream commit ee921183557af39c1a0475f982d43b0fcac25e2e ] + +Frontend callback reports EAGAIN to nfnetlink to retry a command, this +is used to signal that module autoloading is required. Unfortunately, +nlmsg_unicast() reports EAGAIN in case the receiver socket buffer gets +full, so it enters a busy-loop. + +This patch updates nfnetlink_unicast() to turn EAGAIN into ENOBUFS and +to use nlmsg_unicast(). Remove the flags field in nfnetlink_unicast() +since this is always MSG_DONTWAIT in the existing code which is exactly +what nlmsg_unicast() passes to netlink_unicast() as parameter. + +Fixes: 96518518cc41 ("netfilter: add nftables") +Reported-by: Phil Sutter +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/linux/netfilter/nfnetlink.h | 3 +- + net/netfilter/nf_tables_api.c | 61 ++++++++++++++--------------- + net/netfilter/nfnetlink.c | 11 ++++-- + net/netfilter/nfnetlink_log.c | 3 +- + net/netfilter/nfnetlink_queue.c | 2 +- + 5 files changed, 40 insertions(+), 40 deletions(-) + +diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h +index 851425c3178f1..89016d08f6a27 100644 +--- a/include/linux/netfilter/nfnetlink.h ++++ b/include/linux/netfilter/nfnetlink.h +@@ -43,8 +43,7 @@ int nfnetlink_has_listeners(struct net *net, unsigned int group); + int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 portid, + unsigned int group, int echo, gfp_t flags); + int nfnetlink_set_err(struct net *net, u32 portid, u32 group, int error); +-int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid, +- int flags); ++int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid); + + static inline u16 nfnl_msg_type(u8 subsys, u8 msg_type) + { +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 39be0a3015c63..05059f620d41e 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -797,11 +797,11 @@ static int nf_tables_gettable(struct net *net, struct sock *nlsk, + nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0, + family, table); + if (err < 0) +- goto err; ++ goto err_fill_table_info; + +- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); ++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); + +-err: ++err_fill_table_info: + kfree_skb(skb2); + return err; + } +@@ -1527,11 +1527,11 @@ static int nf_tables_getchain(struct net *net, struct sock *nlsk, + nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0, + family, table, chain); + if (err < 0) +- goto err; ++ goto err_fill_chain_info; + +- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); ++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); + +-err: ++err_fill_chain_info: + kfree_skb(skb2); + return err; + } +@@ -2898,11 +2898,11 @@ static int nf_tables_getrule(struct net *net, struct sock *nlsk, + nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0, + family, table, chain, rule, NULL); + if (err < 0) +- goto err; ++ goto err_fill_rule_info; + +- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); ++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); + +-err: ++err_fill_rule_info: + kfree_skb(skb2); + return err; + } +@@ -3829,11 +3829,11 @@ static int nf_tables_getset(struct net *net, struct sock *nlsk, + + err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0); + if (err < 0) +- goto err; ++ goto err_fill_set_info; + +- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); ++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); + +-err: ++err_fill_set_info: + kfree_skb(skb2); + return err; + } +@@ -4721,24 +4721,18 @@ static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set, + err = -ENOMEM; + skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC); + if (skb == NULL) +- goto err1; ++ return err; + + err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid, + NFT_MSG_NEWSETELEM, 0, set, &elem); + if (err < 0) +- goto err2; ++ goto err_fill_setelem; + +- err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT); +- /* This avoids a loop in nfnetlink. */ +- if (err < 0) +- goto err1; ++ return nfnetlink_unicast(skb, ctx->net, ctx->portid); + +- return 0; +-err2: ++err_fill_setelem: + kfree_skb(skb); +-err1: +- /* this avoids a loop in nfnetlink. */ +- return err == -EAGAIN ? -ENOBUFS : err; ++ return err; + } + + /* called with rcu_read_lock held */ +@@ -5992,10 +5986,11 @@ static int nf_tables_getobj(struct net *net, struct sock *nlsk, + nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0, + family, table, obj, reset); + if (err < 0) +- goto err; ++ goto err_fill_obj_info; + +- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); +-err: ++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); ++ ++err_fill_obj_info: + kfree_skb(skb2); + return err; + } +@@ -6844,10 +6839,11 @@ static int nf_tables_getflowtable(struct net *net, struct sock *nlsk, + NFT_MSG_NEWFLOWTABLE, 0, family, + flowtable, &flowtable->hook_list); + if (err < 0) +- goto err; ++ goto err_fill_flowtable_info; + +- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); +-err: ++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); ++ ++err_fill_flowtable_info: + kfree_skb(skb2); + return err; + } +@@ -7018,10 +7014,11 @@ static int nf_tables_getgen(struct net *net, struct sock *nlsk, + err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid, + nlh->nlmsg_seq); + if (err < 0) +- goto err; ++ goto err_fill_gen_info; + +- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); +-err: ++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); ++ ++err_fill_gen_info: + kfree_skb(skb2); + return err; + } +diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c +index 5f24edf958309..3a2e64e13b227 100644 +--- a/net/netfilter/nfnetlink.c ++++ b/net/netfilter/nfnetlink.c +@@ -149,10 +149,15 @@ int nfnetlink_set_err(struct net *net, u32 portid, u32 group, int error) + } + EXPORT_SYMBOL_GPL(nfnetlink_set_err); + +-int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid, +- int flags) ++int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid) + { +- return netlink_unicast(net->nfnl, skb, portid, flags); ++ int err; ++ ++ err = nlmsg_unicast(net->nfnl, skb, portid); ++ if (err == -EAGAIN) ++ err = -ENOBUFS; ++ ++ return err; + } + EXPORT_SYMBOL_GPL(nfnetlink_unicast); + +diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c +index 0ba020ca38e68..7ca2ca4bba055 100644 +--- a/net/netfilter/nfnetlink_log.c ++++ b/net/netfilter/nfnetlink_log.c +@@ -356,8 +356,7 @@ __nfulnl_send(struct nfulnl_instance *inst) + goto out; + } + } +- nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid, +- MSG_DONTWAIT); ++ nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid); + out: + inst->qlen = 0; + inst->skb = NULL; +diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c +index 3243a31f6e829..70d086944bcc7 100644 +--- a/net/netfilter/nfnetlink_queue.c ++++ b/net/netfilter/nfnetlink_queue.c +@@ -681,7 +681,7 @@ __nfqnl_enqueue_packet(struct net *net, struct nfqnl_instance *queue, + *packet_id_ptr = htonl(entry->id); + + /* nfnetlink_unicast will either free the nskb or add it to a socket */ +- err = nfnetlink_unicast(nskb, net, queue->peer_portid, MSG_DONTWAIT); ++ err = nfnetlink_unicast(nskb, net, queue->peer_portid); + if (err < 0) { + if (queue->flags & NFQA_CFG_F_FAIL_OPEN) { + failopen = 1; +-- +2.25.1 + diff --git a/queue-5.8/nfp-flower-fix-abi-mismatch-between-driver-and-firmw.patch b/queue-5.8/nfp-flower-fix-abi-mismatch-between-driver-and-firmw.patch new file mode 100644 index 00000000000..d8f5d7ce836 --- /dev/null +++ b/queue-5.8/nfp-flower-fix-abi-mismatch-between-driver-and-firmw.patch @@ -0,0 +1,47 @@ +From 23b63d82044104f8522e45e40bcb81c07eb8888c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 17:04:58 +0200 +Subject: nfp: flower: fix ABI mismatch between driver and firmware + +From: Louis Peens + +[ Upstream commit f614e536704d37326b0975da9cc33dd61d28c378 ] + +Fix an issue where the driver wrongly detected ipv6 neighbour updates +from the NFP as corrupt. Add a reserved field on the kernel side so +it is similar to the ipv4 version of the struct and has space for the +extra bytes from the card. + +Fixes: 9ea9bfa12240 ("nfp: flower: support ipv6 tunnel keep-alive messages from fw") +Signed-off-by: Louis Peens +Signed-off-by: Simon Horman +Acked-by: Jakub Kicinski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c +index 2df3deedf9fd8..7248d248f6041 100644 +--- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c ++++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c +@@ -61,6 +61,7 @@ struct nfp_tun_active_tuns { + * @flags: options part of the request + * @tun_info.ipv6: dest IPv6 address of active route + * @tun_info.egress_port: port the encapsulated packet egressed ++ * @tun_info.extra: reserved for future use + * @tun_info: tunnels that have sent traffic in reported period + */ + struct nfp_tun_active_tuns_v6 { +@@ -70,6 +71,7 @@ struct nfp_tun_active_tuns_v6 { + struct route_ip_info_v6 { + struct in6_addr ipv6; + __be32 egress_port; ++ __be32 extra[2]; + } tun_info[]; + }; + +-- +2.25.1 + diff --git a/queue-5.8/nvme-fix-controller-instance-leak.patch b/queue-5.8/nvme-fix-controller-instance-leak.patch new file mode 100644 index 00000000000..64c0454033c --- /dev/null +++ b/queue-5.8/nvme-fix-controller-instance-leak.patch @@ -0,0 +1,40 @@ +From 3924866fcf4987e5e9a0b3df4a76bdede070e353 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 10:53:04 -0700 +Subject: nvme: fix controller instance leak + +From: Keith Busch + +[ Upstream commit 192f6c29bb28bfd0a17e6ad331d09f1ec84143d0 ] + +If the driver has to unbind from the controller for an early failure +before the subsystem has been set up, there won't be a subsystem holding +the controller's instance, so the controller needs to free its own +instance in this case. + +Fixes: 733e4b69d508d ("nvme: Assign subsys instance from first ctrl") +Signed-off-by: Keith Busch +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Christoph Hellwig +Signed-off-by: Sagi Grimberg +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index f38548e6d55ec..fa0039dcacc66 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -4148,7 +4148,7 @@ static void nvme_free_ctrl(struct device *dev) + container_of(dev, struct nvme_ctrl, ctrl_device); + struct nvme_subsystem *subsys = ctrl->subsys; + +- if (subsys && ctrl->instance != subsys->instance) ++ if (!subsys || ctrl->instance != subsys->instance) + ida_simple_remove(&nvme_instance_ida, ctrl->instance); + + kfree(ctrl->effects); +-- +2.25.1 + diff --git a/queue-5.8/nvmet-fc-fix-a-missed-_irqsave-version-of-spin_lock-.patch b/queue-5.8/nvmet-fc-fix-a-missed-_irqsave-version-of-spin_lock-.patch new file mode 100644 index 00000000000..12dc321cacb --- /dev/null +++ b/queue-5.8/nvmet-fc-fix-a-missed-_irqsave-version-of-spin_lock-.patch @@ -0,0 +1,44 @@ +From 2f821bb73f61db424d740141d7471d067fdc58ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 09:58:19 +0200 +Subject: nvmet-fc: Fix a missed _irqsave version of spin_lock in + 'nvmet_fc_fod_op_done()' + +From: Christophe JAILLET + +[ Upstream commit 70e37988db94aba607d5491a94f80ba08e399b6b ] + +The way 'spin_lock()' and 'spin_lock_irqsave()' are used is not consistent +in this function. + +Use 'spin_lock_irqsave()' also here, as there is no guarantee that +interruptions are disabled at that point, according to surrounding code. + +Fixes: a97ec51b37ef ("nvmet_fc: Rework target side abort handling") +Signed-off-by: Christophe JAILLET +Reviewed-by: Christoph Hellwig +Signed-off-by: Sagi Grimberg +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index 27fd3b5aa621c..f98a1ba4dc47c 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -2362,9 +2362,9 @@ nvmet_fc_fod_op_done(struct nvmet_fc_fcp_iod *fod) + return; + if (fcpreq->fcp_error || + fcpreq->transferred_length != fcpreq->transfer_length) { +- spin_lock(&fod->flock); ++ spin_lock_irqsave(&fod->flock, flags); + fod->abort = true; +- spin_unlock(&fod->flock); ++ spin_unlock_irqrestore(&fod->flock, flags); + + nvmet_req_complete(&fod->req, NVME_SC_INTERNAL); + return; +-- +2.25.1 + diff --git a/queue-5.8/opp-don-t-drop-reference-for-an-opp-table-that-was-n.patch b/queue-5.8/opp-don-t-drop-reference-for-an-opp-table-that-was-n.patch new file mode 100644 index 00000000000..03d2e64430c --- /dev/null +++ b/queue-5.8/opp-don-t-drop-reference-for-an-opp-table-that-was-n.patch @@ -0,0 +1,98 @@ +From 83d1c621e7843f92db8f5b179e79f35b29af5f70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Aug 2020 13:03:06 +0530 +Subject: opp: Don't drop reference for an OPP table that was never parsed + +From: Viresh Kumar + +[ Upstream commit 922ff0759a16299e24cacfc981ac07914d8f1826 ] + +dev_pm_opp_remove_table() should drop a reference to the OPP table only +if the DT OPP table was parsed earlier with a call to +dev_pm_opp_of_add_table() earlier. Else it may end up dropping the +reference to the OPP table, which was added as a result of other calls +like dev_pm_opp_set_clkname(). And would hence result in undesirable +behavior later on when caller would try to free the resource again. + +Fixes: 03758d60265c ("opp: Replace list_kref with a local counter") +Reported-by: Naresh Kamboju +Reported-by: Anders Roxell +Tested-by: Naresh Kamboju +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/opp/core.c | 22 ++++++++++++++++------ + drivers/opp/opp.h | 2 +- + 2 files changed, 17 insertions(+), 7 deletions(-) + +diff --git a/drivers/opp/core.c b/drivers/opp/core.c +index 8c90f78717723..91dcad982d362 100644 +--- a/drivers/opp/core.c ++++ b/drivers/opp/core.c +@@ -1265,13 +1265,19 @@ void dev_pm_opp_remove(struct device *dev, unsigned long freq) + } + EXPORT_SYMBOL_GPL(dev_pm_opp_remove); + +-void _opp_remove_all_static(struct opp_table *opp_table) ++bool _opp_remove_all_static(struct opp_table *opp_table) + { + struct dev_pm_opp *opp, *tmp; ++ bool ret = true; + + mutex_lock(&opp_table->lock); + +- if (!opp_table->parsed_static_opps || --opp_table->parsed_static_opps) ++ if (!opp_table->parsed_static_opps) { ++ ret = false; ++ goto unlock; ++ } ++ ++ if (--opp_table->parsed_static_opps) + goto unlock; + + list_for_each_entry_safe(opp, tmp, &opp_table->opp_list, node) { +@@ -1281,6 +1287,8 @@ void _opp_remove_all_static(struct opp_table *opp_table) + + unlock: + mutex_unlock(&opp_table->lock); ++ ++ return ret; + } + + /** +@@ -2382,13 +2390,15 @@ void _dev_pm_opp_find_and_remove_table(struct device *dev) + return; + } + +- _opp_remove_all_static(opp_table); ++ /* ++ * Drop the extra reference only if the OPP table was successfully added ++ * with dev_pm_opp_of_add_table() earlier. ++ **/ ++ if (_opp_remove_all_static(opp_table)) ++ dev_pm_opp_put_opp_table(opp_table); + + /* Drop reference taken by _find_opp_table() */ + dev_pm_opp_put_opp_table(opp_table); +- +- /* Drop reference taken while the OPP table was added */ +- dev_pm_opp_put_opp_table(opp_table); + } + + /** +diff --git a/drivers/opp/opp.h b/drivers/opp/opp.h +index e51646ff279eb..c3fcd571e446d 100644 +--- a/drivers/opp/opp.h ++++ b/drivers/opp/opp.h +@@ -212,7 +212,7 @@ struct opp_table { + + /* Routines internal to opp core */ + void dev_pm_opp_get(struct dev_pm_opp *opp); +-void _opp_remove_all_static(struct opp_table *opp_table); ++bool _opp_remove_all_static(struct opp_table *opp_table); + void _get_opp_table_kref(struct opp_table *opp_table); + int _get_opp_count(struct opp_table *opp_table); + struct opp_table *_find_opp_table(struct device *dev); +-- +2.25.1 + diff --git a/queue-5.8/perf-bench-the-do_run_multi_threaded-function-must-u.patch b/queue-5.8/perf-bench-the-do_run_multi_threaded-function-must-u.patch new file mode 100644 index 00000000000..0f5e4b224aa --- /dev/null +++ b/queue-5.8/perf-bench-the-do_run_multi_threaded-function-must-u.patch @@ -0,0 +1,52 @@ +From fbde4a849762bd7846c69b18f307a04d57ae6503 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 22:05:26 +0800 +Subject: perf bench: The do_run_multi_threaded() function must use + IS_ERR(perf_session__new()) + +From: YueHaibing + +[ Upstream commit e4d71f79cf5c10fa8bc6f5d3bebea570c9c438f1 ] + +In case of error, the function perf_session__new() returns ERR_PTR() and +never returns NULL. The NULL test in the return value check should be +replaced with IS_ERR() + +Committer notes: + +This wasn't compiling due to an extraneous '{' not matched by a '}', fix +it. + +Fixes: 13edc237200c ("perf bench: Add a multi-threaded synthesize benchmark") +Signed-off-by: YueHaibing +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lore.kernel.org/lkml/20200902140526.26916-1-yuehaibing@huawei.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/bench/synthesize.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/bench/synthesize.c b/tools/perf/bench/synthesize.c +index 8d624aea1c5e5..b2924e3181dc3 100644 +--- a/tools/perf/bench/synthesize.c ++++ b/tools/perf/bench/synthesize.c +@@ -162,8 +162,8 @@ static int do_run_multi_threaded(struct target *target, + init_stats(&event_stats); + for (i = 0; i < multi_iterations; i++) { + session = perf_session__new(NULL, false, NULL); +- if (!session) +- return -ENOMEM; ++ if (IS_ERR(session)) ++ return PTR_ERR(session); + + atomic_set(&event_count, 0); + gettimeofday(&start, NULL); +-- +2.25.1 + diff --git a/queue-5.8/perf-cs-etm-fix-corrupt-data-after-perf-inject-from.patch b/queue-5.8/perf-cs-etm-fix-corrupt-data-after-perf-inject-from.patch new file mode 100644 index 00000000000..b4592b4099a --- /dev/null +++ b/queue-5.8/perf-cs-etm-fix-corrupt-data-after-perf-inject-from.patch @@ -0,0 +1,65 @@ +From aa363e1fc121920c7e21a47fa0ee0413bf62d3e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Aug 2020 16:47:50 +0800 +Subject: perf cs-etm: Fix corrupt data after perf inject from + +From: Al Grant + +[ Upstream commit f5f8e7e55fbdb4fdddec73518e23c48083108fbb ] + +Commit 42bbabed09ce6208 ("perf tools: Add hw_idx in struct branch_stack") +changed the format of branch stacks in perf samples. When samples use +this new format, a flag must be set in the corresponding event. + +Synthesized branch stacks generated from CoreSight ETM trace were using +the new format, but not setting the event attribute, leading to +consumers seeing corrupt data. This patch fixes the issue by setting the +event attribute to indicate use of the new format. + +Fixes: 42bbabed09ce6208 ("perf tools: Add hw_idx in struct branch_stack") +Signed-off-by: Al Grant +Reviewed-by: Andrea Brunato +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Mathieu Poirier +Cc: Mike Leach +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Suzuki Poulouse +Cc: linux-arm-kernel@lists.infradead.org +Signed-off-by: Leo Yan +Link: http://lore.kernel.org/lkml/20200819084751.17686-1-leo.yan@linaro.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/cs-etm.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c +index c283223fb31f2..a2a369e2fbb67 100644 +--- a/tools/perf/util/cs-etm.c ++++ b/tools/perf/util/cs-etm.c +@@ -1344,8 +1344,15 @@ static int cs_etm__synth_events(struct cs_etm_auxtrace *etm, + attr.sample_type &= ~(u64)PERF_SAMPLE_ADDR; + } + +- if (etm->synth_opts.last_branch) ++ if (etm->synth_opts.last_branch) { + attr.sample_type |= PERF_SAMPLE_BRANCH_STACK; ++ /* ++ * We don't use the hardware index, but the sample generation ++ * code uses the new format branch_stack with this field, ++ * so the event attributes must indicate that it's present. ++ */ ++ attr.branch_sample_type |= PERF_SAMPLE_BRANCH_HW_INDEX; ++ } + + if (etm->synth_opts.instructions) { + attr.config = PERF_COUNT_HW_INSTRUCTIONS; +-- +2.25.1 + diff --git a/queue-5.8/perf-intel-pt-fix-corrupt-data-after-perf-inject-fro.patch b/queue-5.8/perf-intel-pt-fix-corrupt-data-after-perf-inject-fro.patch new file mode 100644 index 00000000000..ce66ab21d9c --- /dev/null +++ b/queue-5.8/perf-intel-pt-fix-corrupt-data-after-perf-inject-fro.patch @@ -0,0 +1,65 @@ +From f8157dab92eca0d1cfeed08065ed2afa8890ac4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Aug 2020 16:47:51 +0800 +Subject: perf intel-pt: Fix corrupt data after perf inject from + +From: Al Grant + +[ Upstream commit a347306fbec5dcaf7c276777b11d530eab6a4526 ] + +Commit 42bbabed09ce6208 ("perf tools: Add hw_idx in struct branch_stack") +changed the format of branch stacks in perf samples. When samples use +this new format, a flag must be set in the corresponding event. + +Synthesized branch stacks generated from Intel PT were using the new +format, but not setting the event attribute, leading to consumers +seeing corrupt data. This patch fixes the issue by setting the event +attribute to indicate use of the new format. + +Fixes: 42bbabed09ce6208 ("perf tools: Add hw_idx in struct branch_stack") +Signed-off-by: Al Grant +Acked-by: Adrian Hunter +Reviewed-by: Mathieu Poirier +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Leo Yan +Cc: Mark Rutland +Cc: Mike Leach +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Suzuki Poulouse +Cc: linux-arm-kernel@lists.infradead.org +Link: http://lore.kernel.org/lkml/20200819084751.17686-2-leo.yan@linaro.org +Signed-off-by: Leo Yan +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/intel-pt.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c +index cb3c1e569a2db..9357b5f62c273 100644 +--- a/tools/perf/util/intel-pt.c ++++ b/tools/perf/util/intel-pt.c +@@ -2913,8 +2913,15 @@ static int intel_pt_synth_events(struct intel_pt *pt, + + if (pt->synth_opts.callchain) + attr.sample_type |= PERF_SAMPLE_CALLCHAIN; +- if (pt->synth_opts.last_branch) ++ if (pt->synth_opts.last_branch) { + attr.sample_type |= PERF_SAMPLE_BRANCH_STACK; ++ /* ++ * We don't use the hardware index, but the sample generation ++ * code uses the new format branch_stack with this field, ++ * so the event attributes must indicate that it's present. ++ */ ++ attr.branch_sample_type |= PERF_SAMPLE_BRANCH_HW_INDEX; ++ } + + if (pt->synth_opts.instructions) { + attr.config = PERF_COUNT_HW_INSTRUCTIONS; +-- +2.25.1 + diff --git a/queue-5.8/perf-jevents-fix-suspicious-code-in-fixregex.patch b/queue-5.8/perf-jevents-fix-suspicious-code-in-fixregex.patch new file mode 100644 index 00000000000..87a8d9bd5e5 --- /dev/null +++ b/queue-5.8/perf-jevents-fix-suspicious-code-in-fixregex.patch @@ -0,0 +1,47 @@ +From 59ba879e92b0e196060617bb0a754e813a61df3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Sep 2020 00:25:10 +0900 +Subject: perf jevents: Fix suspicious code in fixregex() + +From: Namhyung Kim + +[ Upstream commit e62458e3940eb3dfb009481850e140fbee183b04 ] + +The new string should have enough space for the original string and the +back slashes IMHO. + +Fixes: fbc2844e84038ce3 ("perf vendor events: Use more flexible pattern matching for CPU identification for mapfile.csv") +Signed-off-by: Namhyung Kim +Reviewed-by: Ian Rogers +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Jiri Olsa +Cc: John Garry +Cc: Kajol Jain +Cc: Mark Rutland +Cc: Peter Zijlstra +Cc: Stephane Eranian +Cc: William Cohen +Link: http://lore.kernel.org/lkml/20200903152510.489233-1-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/pmu-events/jevents.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c +index fa86c5f997cc5..fc9c158bfa134 100644 +--- a/tools/perf/pmu-events/jevents.c ++++ b/tools/perf/pmu-events/jevents.c +@@ -137,7 +137,7 @@ static char *fixregex(char *s) + return s; + + /* allocate space for a new string */ +- fixed = (char *) malloc(len + 1); ++ fixed = (char *) malloc(len + esc_count + 1); + if (!fixed) + return NULL; + +-- +2.25.1 + diff --git a/queue-5.8/perf-sched-timehist-fix-use-of-cpu-list-with-summary.patch b/queue-5.8/perf-sched-timehist-fix-use-of-cpu-list-with-summary.patch new file mode 100644 index 00000000000..6737a314d84 --- /dev/null +++ b/queue-5.8/perf-sched-timehist-fix-use-of-cpu-list-with-summary.patch @@ -0,0 +1,50 @@ +From aa9eb8f321deea39734b45ca1bc6b788dfa33b13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Aug 2020 11:09:42 -0600 +Subject: perf sched timehist: Fix use of CPU list with summary option + +From: David Ahern + +[ Upstream commit a74eaf1605d42391c2357a70e94e5a2c7780fea9 ] + +Do not update thread stats or show idle summary unless CPU is in the +list of interest. + +Fixes: c30d630d1bcfad8d ("perf sched timehist: Add support for filtering on CPU") +Signed-off-by: David Ahern +Acked-by: Namhyung Kim +Cc: Jiri Olsa +Link: http://lore.kernel.org/lkml/20200817170943.1486-1-dsahern@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-sched.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c +index 459e4229945e4..7b9511e59b434 100644 +--- a/tools/perf/builtin-sched.c ++++ b/tools/perf/builtin-sched.c +@@ -2575,7 +2575,8 @@ static int timehist_sched_change_event(struct perf_tool *tool, + } + + if (!sched->idle_hist || thread->tid == 0) { +- timehist_update_runtime_stats(tr, t, tprev); ++ if (!cpu_list || test_bit(sample->cpu, cpu_bitmap)) ++ timehist_update_runtime_stats(tr, t, tprev); + + if (sched->idle_hist) { + struct idle_thread_runtime *itr = (void *)tr; +@@ -2848,6 +2849,9 @@ static void timehist_print_summary(struct perf_sched *sched, + + printf("\nIdle stats:\n"); + for (i = 0; i < idle_max_cpu; ++i) { ++ if (cpu_list && !test_bit(i, cpu_bitmap)) ++ continue; ++ + t = idle_threads[i]; + if (!t) + continue; +-- +2.25.1 + diff --git a/queue-5.8/perf-stat-turn-off-summary-for-interval-mode-by-defa.patch b/queue-5.8/perf-stat-turn-off-summary-for-interval-mode-by-defa.patch new file mode 100644 index 00000000000..6746431bbf5 --- /dev/null +++ b/queue-5.8/perf-stat-turn-off-summary-for-interval-mode-by-defa.patch @@ -0,0 +1,183 @@ +From 1b279087eec764a1a37aeb08e6bda85640572639 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Sep 2020 09:01:13 +0800 +Subject: perf stat: Turn off summary for interval mode by default + +From: Jin Yao + +[ Upstream commit ee6a961432e75393bd69bf70ba70bad90396fa82 ] + +There's a risk that outputting interval mode summaries by default breaks +CSV consumers. It already broke pmu-tools/toplev. + +So now we turn off the summary by default but we create a new option +'--summary' to enable the summary. This is active even when not using +CSV mode. + +Before: + + root@kbl-ppc:~# perf stat -I1000 --interval-count 2 + # time counts unit events + 1.000265904 8,005.73 msec cpu-clock # 8.006 CPUs utilized + 1.000265904 601 context-switches # 0.075 K/sec + 1.000265904 10 cpu-migrations # 0.001 K/sec + 1.000265904 0 page-faults # 0.000 K/sec + 1.000265904 66,746,521 cycles # 0.008 GHz + 1.000265904 71,874,398 instructions # 1.08 insn per cycle + 1.000265904 13,356,781 branches # 1.668 M/sec + 1.000265904 298,756 branch-misses # 2.24% of all branches + 2.001857667 8,012.52 msec cpu-clock # 8.013 CPUs utilized + 2.001857667 164 context-switches # 0.020 K/sec + 2.001857667 10 cpu-migrations # 0.001 K/sec + 2.001857667 2 page-faults # 0.000 K/sec + 2.001857667 5,822,188 cycles # 0.001 GHz + 2.001857667 2,186,170 instructions # 0.38 insn per cycle + 2.001857667 442,378 branches # 0.055 M/sec + 2.001857667 44,750 branch-misses # 10.12% of all branches + + Performance counter stats for 'system wide': + + 16,018.25 msec cpu-clock # 7.993 CPUs utilized + 765 context-switches # 0.048 K/sec + 20 cpu-migrations # 0.001 K/sec + 2 page-faults # 0.000 K/sec + 72,568,709 cycles # 0.005 GHz + 74,060,568 instructions # 1.02 insn per cycle + 13,799,159 branches # 0.861 M/sec + 343,506 branch-misses # 2.49% of all branches + + 2.004118489 seconds time elapsed + +After: + + root@kbl-ppc:~# perf stat -I1000 --interval-count 2 + # time counts unit events + 1.001336393 8,013.28 msec cpu-clock # 8.013 CPUs utilized + 1.001336393 82 context-switches # 0.010 K/sec + 1.001336393 8 cpu-migrations # 0.001 K/sec + 1.001336393 0 page-faults # 0.000 K/sec + 1.001336393 4,199,121 cycles # 0.001 GHz + 1.001336393 1,373,991 instructions # 0.33 insn per cycle + 1.001336393 270,681 branches # 0.034 M/sec + 1.001336393 31,659 branch-misses # 11.70% of all branches + 2.003905006 8,020.52 msec cpu-clock # 8.021 CPUs utilized + 2.003905006 184 context-switches # 0.023 K/sec + 2.003905006 8 cpu-migrations # 0.001 K/sec + 2.003905006 2 page-faults # 0.000 K/sec + 2.003905006 5,446,190 cycles # 0.001 GHz + 2.003905006 2,312,547 instructions # 0.42 insn per cycle + 2.003905006 451,691 branches # 0.056 M/sec + 2.003905006 37,925 branch-misses # 8.40% of all branches + + root@kbl-ppc:~# perf stat -I1000 --interval-count 2 --summary + # time counts unit events + 1.001313128 8,013.20 msec cpu-clock # 8.013 CPUs utilized + 1.001313128 83 context-switches # 0.010 K/sec + 1.001313128 8 cpu-migrations # 0.001 K/sec + 1.001313128 0 page-faults # 0.000 K/sec + 1.001313128 4,470,950 cycles # 0.001 GHz + 1.001313128 1,440,045 instructions # 0.32 insn per cycle + 1.001313128 283,222 branches # 0.035 M/sec + 1.001313128 33,576 branch-misses # 11.86% of all branches + 2.003857385 8,020.34 msec cpu-clock # 8.020 CPUs utilized + 2.003857385 154 context-switches # 0.019 K/sec + 2.003857385 8 cpu-migrations # 0.001 K/sec + 2.003857385 2 page-faults # 0.000 K/sec + 2.003857385 4,515,676 cycles # 0.001 GHz + 2.003857385 2,180,449 instructions # 0.48 insn per cycle + 2.003857385 435,254 branches # 0.054 M/sec + 2.003857385 31,179 branch-misses # 7.16% of all branches + + Performance counter stats for 'system wide': + + 16,033.53 msec cpu-clock # 7.992 CPUs utilized + 237 context-switches # 0.015 K/sec + 16 cpu-migrations # 0.001 K/sec + 2 page-faults # 0.000 K/sec + 8,986,626 cycles # 0.001 GHz + 3,620,494 instructions # 0.40 insn per cycle + 718,476 branches # 0.045 M/sec + 64,755 branch-misses # 9.01% of all branches + + 2.006124542 seconds time elapsed + +Fixes: c7e5b328a8d4 ("perf stat: Report summary for interval mode") +Signed-off-by: Jin Yao +Tested-by: Arnaldo Carvalho de Melo +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Peter Zijlstra +Link: http://lore.kernel.org/lkml/20200903010113.32232-1-yao.jin@linux.intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/Documentation/perf-stat.txt | 3 +++ + tools/perf/builtin-stat.c | 8 +++++--- + tools/perf/util/stat.h | 1 + + 3 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt +index c8209467076b1..d8299b77f5c89 100644 +--- a/tools/perf/Documentation/perf-stat.txt ++++ b/tools/perf/Documentation/perf-stat.txt +@@ -380,6 +380,9 @@ counts for all hardware threads in a core but show the sum counts per + hardware thread. This is essentially a replacement for the any bit and + convenient for post processing. + ++--summary:: ++Print summary for interval mode (-I). ++ + EXAMPLES + -------- + +diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c +index 9be020e0098ad..6e2502de755a8 100644 +--- a/tools/perf/builtin-stat.c ++++ b/tools/perf/builtin-stat.c +@@ -402,7 +402,7 @@ static void read_counters(struct timespec *rs) + { + struct evsel *counter; + +- if (!stat_config.summary && (read_affinity_counters(rs) < 0)) ++ if (!stat_config.stop_read_counter && (read_affinity_counters(rs) < 0)) + return; + + evlist__for_each_entry(evsel_list, counter) { +@@ -826,9 +826,9 @@ try_again_reset: + if (stat_config.walltime_run_table) + stat_config.walltime_run[run_idx] = t1 - t0; + +- if (interval) { ++ if (interval && stat_config.summary) { + stat_config.interval = 0; +- stat_config.summary = true; ++ stat_config.stop_read_counter = true; + init_stats(&walltime_nsecs_stats); + update_stats(&walltime_nsecs_stats, t1 - t0); + +@@ -1066,6 +1066,8 @@ static struct option stat_options[] = { + "Use with 'percore' event qualifier to show the event " + "counts of one hardware thread by sum up total hardware " + "threads of same physical core"), ++ OPT_BOOLEAN(0, "summary", &stat_config.summary, ++ "print summary for interval mode"), + #ifdef HAVE_LIBPFM + OPT_CALLBACK(0, "pfm-events", &evsel_list, "event", + "libpfm4 event selector. use 'perf list' to list available events", +diff --git a/tools/perf/util/stat.h b/tools/perf/util/stat.h +index f75ae679eb281..d8a9dd786bf43 100644 +--- a/tools/perf/util/stat.h ++++ b/tools/perf/util/stat.h +@@ -113,6 +113,7 @@ struct perf_stat_config { + bool summary; + bool metric_no_group; + bool metric_no_merge; ++ bool stop_read_counter; + FILE *output; + unsigned int interval; + unsigned int timeout; +-- +2.25.1 + diff --git a/queue-5.8/perf-tools-correct-snoopx-field-offset.patch b/queue-5.8/perf-tools-correct-snoopx-field-offset.patch new file mode 100644 index 00000000000..1e9e9259123 --- /dev/null +++ b/queue-5.8/perf-tools-correct-snoopx-field-offset.patch @@ -0,0 +1,51 @@ +From 8dade0ca8ff2eedcbb4b03db29532de12ee2bf96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Sep 2020 12:10:14 -0300 +Subject: perf tools: Correct SNOOPX field offset + +From: Al Grant + +[ Upstream commit 39c0a53b114d0317e5c4e76b631f41d133af5cb0 ] + +perf_event.h has macros that define the field offsets in the data_src +bitmask in perf records. The SNOOPX and REMOTE offsets were both 37. + +These are distinct fields, and the bitfield layout in perf_mem_data_src +confirms that SNOOPX should be at offset 38. + +Committer notes: + +This was extracted from a larger patch that also contained kernel +changes. + +Fixes: 52839e653b5629bd ("perf tools: Add support for printing new mem_info encodings") +Signed-off-by: Al Grant +Reviewed-by: Andi Kleen +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lore.kernel.org/lkml/9974f2d0-bf7f-518e-d9f7-4520e5ff1bb0@foss.arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/include/uapi/linux/perf_event.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/include/uapi/linux/perf_event.h b/tools/include/uapi/linux/perf_event.h +index 7b2d6fc9e6ed7..bc8c4816ba386 100644 +--- a/tools/include/uapi/linux/perf_event.h ++++ b/tools/include/uapi/linux/perf_event.h +@@ -1155,7 +1155,7 @@ union perf_mem_data_src { + + #define PERF_MEM_SNOOPX_FWD 0x01 /* forward */ + /* 1 free */ +-#define PERF_MEM_SNOOPX_SHIFT 37 ++#define PERF_MEM_SNOOPX_SHIFT 38 + + /* locked instruction */ + #define PERF_MEM_LOCK_NA 0x01 /* not available */ +-- +2.25.1 + diff --git a/queue-5.8/perf-top-report-fix-infinite-loop-in-the-tui-for-gro.patch b/queue-5.8/perf-top-report-fix-infinite-loop-in-the-tui-for-gro.patch new file mode 100644 index 00000000000..fe80614a174 --- /dev/null +++ b/queue-5.8/perf-top-report-fix-infinite-loop-in-the-tui-for-gro.patch @@ -0,0 +1,69 @@ +From fc036b2e11d558a0931c67d84d0597cd41202657 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Aug 2020 16:17:00 -0300 +Subject: perf top/report: Fix infinite loop in the TUI for grouped events + +From: Arnaldo Carvalho de Melo + +[ Upstream commit d4ccbacb9c217fefb4332a9af81b785690cf1053 ] + +For a while we need to have a dummy event for doing things like +receiving PERF_RECORD_COMM, PERF_RECORD_EXEC, etc for threads being +created and dying while we synthesize the pre-existing ones at tool +start. + +This 'dummy' event is needed for keeping track of thread lifetime events +early in the session but are uninteresting otherwise, i.e. no need to +have it in a initial events menu for the non-grouped case, i.e. for: + + # perf top -e cycles,instructions + +or even for plain: + + # perf top + +When 'cycles' and that 'dummy' event are in place. + +The code to remove that 'dummy' event ended up creating an endless loop +for the grouped case, i.e.: + + # perf top -e '{cycles,instructions}' + +Fix it. + +Fixes: bee9ca1c8a237ca1 ("perf report TUI: Remove needless 'dummy' event from menu") +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Namhyung Kim +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/ui/browsers/hists.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c +index be9c4c0549bc8..a07626f072087 100644 +--- a/tools/perf/ui/browsers/hists.c ++++ b/tools/perf/ui/browsers/hists.c +@@ -3629,8 +3629,8 @@ int perf_evlist__tui_browse_hists(struct evlist *evlist, const char *help, + { + int nr_entries = evlist->core.nr_entries; + +-single_entry: + if (perf_evlist__single_entry(evlist)) { ++single_entry: { + struct evsel *first = evlist__first(evlist); + + return perf_evsel__hists_browse(first, nr_entries, help, +@@ -3638,6 +3638,7 @@ single_entry: + env, warn_lost_event, + annotation_opts); + } ++ } + + if (symbol_conf.event_group) { + struct evsel *pos; +-- +2.25.1 + diff --git a/queue-5.8/perf-top-skip-side-band-event-setup-if-have_libbpf_s.patch b/queue-5.8/perf-top-skip-side-band-event-setup-if-have_libbpf_s.patch new file mode 100644 index 00000000000..850b53c657c --- /dev/null +++ b/queue-5.8/perf-top-skip-side-band-event-setup-if-have_libbpf_s.patch @@ -0,0 +1,100 @@ +From 74d5f3f2fe755f81acbc733701a5512009451960 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 20:30:37 +0800 +Subject: perf top: Skip side-band event setup if HAVE_LIBBPF_SUPPORT is not + set + +From: Tiezhu Yang + +[ Upstream commit 0c5f1acc2a14416bf30023f373558d369afdbfc8 ] + +When I execute 'perf top' without HAVE_LIBBPF_SUPPORT, there exists the +following segmentation fault, skip the side-band event setup to fix it, +this is similar with commit 1101c872c8c7 ("perf record: Skip side-band +event setup if HAVE_LIBBPF_SUPPORT is not set"). + + [yangtiezhu@linux perf]$ ./perf top + + perf: Segmentation fault + Obtained 6 stack frames. + ./perf(sighandler_dump_stack+0x5c) [0x12011b604] + [0xffffffc010] + ./perf(perf_mmap__read_init+0x3e) [0x1201feeae] + ./perf() [0x1200d715c] + /lib64/libpthread.so.0(+0xab9c) [0xffee10ab9c] + /lib64/libc.so.6(+0x128f4c) [0xffedc08f4c] + Segmentation fault + [yangtiezhu@linux perf]$ + +I use git bisect to find commit b38d85ef49cf ("perf bpf: Decouple +creating the evlist from adding the SB event") is the first bad commit, +so also add the Fixes tag. + +Committer testing: + +First build perf explicitely disabling libbpf: + + $ make NO_LIBBPF=1 O=/tmp/build/perf -C tools/perf install-bin && perf test python + +Now make sure it isn't linked: + + $ perf -vv | grep -w bpf + bpf: [ OFF ] # HAVE_LIBBPF_SUPPORT + $ + $ nm ~/bin/perf | grep libbpf + $ + +And now try to run 'perf top': + + # perf top + perf: Segmentation fault + -------- backtrace -------- + perf[0x5bcd6d] + /lib64/libc.so.6(+0x3ca6f)[0x7fd0f5a66a6f] + perf(perf_mmap__read_init+0x1e)[0x5e1afe] + perf[0x4cc468] + /lib64/libpthread.so.0(+0x9431)[0x7fd0f645a431] + /lib64/libc.so.6(clone+0x42)[0x7fd0f5b2b912] + # + +Applying this patch fixes the issue. + +Fixes: b38d85ef49cf ("perf bpf: Decouple creating the evlist from adding the SB event") +Signed-off-by: Tiezhu Yang +Tested-by: Arnaldo Carvalho de Melo +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Xuefeng Li +Link: http://lore.kernel.org/lkml/1597753837-16222-1-git-send-email-yangtiezhu@loongson.cn +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-top.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c +index 13889d73f8dd5..c665d69c0651d 100644 +--- a/tools/perf/builtin-top.c ++++ b/tools/perf/builtin-top.c +@@ -1746,6 +1746,7 @@ int cmd_top(int argc, const char **argv) + goto out_delete_evlist; + } + ++#ifdef HAVE_LIBBPF_SUPPORT + if (!top.record_opts.no_bpf_event) { + top.sb_evlist = evlist__new(); + +@@ -1759,6 +1760,7 @@ int cmd_top(int argc, const char **argv) + goto out_delete_evlist; + } + } ++#endif + + if (perf_evlist__start_sb_thread(top.sb_evlist, target)) { + pr_debug("Couldn't start the BPF side band thread:\nBPF programs starting from now on won't be annotatable\n"); +-- +2.25.1 + diff --git a/queue-5.8/ravb-fixed-to-be-able-to-unload-modules.patch b/queue-5.8/ravb-fixed-to-be-able-to-unload-modules.patch new file mode 100644 index 00000000000..82f3261113c --- /dev/null +++ b/queue-5.8/ravb-fixed-to-be-able-to-unload-modules.patch @@ -0,0 +1,208 @@ +From daf2d66b9179db48970113d7d4e1dfd1a2cc664d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 18:43:07 +0900 +Subject: ravb: Fixed to be able to unload modules + +From: Yuusuke Ashizuka + +[ Upstream commit 1838d6c62f57836639bd3d83e7855e0ee4f6defc ] + +When this driver is built as a module, I cannot rmmod it after insmoding +it. +This is because that this driver calls ravb_mdio_init() at the time of +probe, and module->refcnt is incremented by alloc_mdio_bitbang() called +after that. +Therefore, even if ifup is not performed, the driver is in use and rmmod +cannot be performed. + +$ lsmod +Module Size Used by +ravb 40960 1 +$ rmmod ravb +rmmod: ERROR: Module ravb is in use + +Call ravb_mdio_init() at open and free_mdio_bitbang() at close, thereby +rmmod is possible in the ifdown state. + +Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") +Signed-off-by: Yuusuke Ashizuka +Reviewed-by: Sergei Shtylyov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/ravb_main.c | 110 +++++++++++------------ + 1 file changed, 55 insertions(+), 55 deletions(-) + +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index 99f7aae102ce1..df89d09b253e2 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -1342,6 +1342,51 @@ static inline int ravb_hook_irq(unsigned int irq, irq_handler_t handler, + return error; + } + ++/* MDIO bus init function */ ++static int ravb_mdio_init(struct ravb_private *priv) ++{ ++ struct platform_device *pdev = priv->pdev; ++ struct device *dev = &pdev->dev; ++ int error; ++ ++ /* Bitbang init */ ++ priv->mdiobb.ops = &bb_ops; ++ ++ /* MII controller setting */ ++ priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb); ++ if (!priv->mii_bus) ++ return -ENOMEM; ++ ++ /* Hook up MII support for ethtool */ ++ priv->mii_bus->name = "ravb_mii"; ++ priv->mii_bus->parent = dev; ++ snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x", ++ pdev->name, pdev->id); ++ ++ /* Register MDIO bus */ ++ error = of_mdiobus_register(priv->mii_bus, dev->of_node); ++ if (error) ++ goto out_free_bus; ++ ++ return 0; ++ ++out_free_bus: ++ free_mdio_bitbang(priv->mii_bus); ++ return error; ++} ++ ++/* MDIO bus release function */ ++static int ravb_mdio_release(struct ravb_private *priv) ++{ ++ /* Unregister mdio bus */ ++ mdiobus_unregister(priv->mii_bus); ++ ++ /* Free bitbang info */ ++ free_mdio_bitbang(priv->mii_bus); ++ ++ return 0; ++} ++ + /* Network device open function for Ethernet AVB */ + static int ravb_open(struct net_device *ndev) + { +@@ -1350,6 +1395,13 @@ static int ravb_open(struct net_device *ndev) + struct device *dev = &pdev->dev; + int error; + ++ /* MDIO bus init */ ++ error = ravb_mdio_init(priv); ++ if (error) { ++ netdev_err(ndev, "failed to initialize MDIO\n"); ++ return error; ++ } ++ + napi_enable(&priv->napi[RAVB_BE]); + napi_enable(&priv->napi[RAVB_NC]); + +@@ -1427,6 +1479,7 @@ out_free_irq: + out_napi_off: + napi_disable(&priv->napi[RAVB_NC]); + napi_disable(&priv->napi[RAVB_BE]); ++ ravb_mdio_release(priv); + return error; + } + +@@ -1736,6 +1789,8 @@ static int ravb_close(struct net_device *ndev) + ravb_ring_free(ndev, RAVB_BE); + ravb_ring_free(ndev, RAVB_NC); + ++ ravb_mdio_release(priv); ++ + return 0; + } + +@@ -1887,51 +1942,6 @@ static const struct net_device_ops ravb_netdev_ops = { + .ndo_set_features = ravb_set_features, + }; + +-/* MDIO bus init function */ +-static int ravb_mdio_init(struct ravb_private *priv) +-{ +- struct platform_device *pdev = priv->pdev; +- struct device *dev = &pdev->dev; +- int error; +- +- /* Bitbang init */ +- priv->mdiobb.ops = &bb_ops; +- +- /* MII controller setting */ +- priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb); +- if (!priv->mii_bus) +- return -ENOMEM; +- +- /* Hook up MII support for ethtool */ +- priv->mii_bus->name = "ravb_mii"; +- priv->mii_bus->parent = dev; +- snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x", +- pdev->name, pdev->id); +- +- /* Register MDIO bus */ +- error = of_mdiobus_register(priv->mii_bus, dev->of_node); +- if (error) +- goto out_free_bus; +- +- return 0; +- +-out_free_bus: +- free_mdio_bitbang(priv->mii_bus); +- return error; +-} +- +-/* MDIO bus release function */ +-static int ravb_mdio_release(struct ravb_private *priv) +-{ +- /* Unregister mdio bus */ +- mdiobus_unregister(priv->mii_bus); +- +- /* Free bitbang info */ +- free_mdio_bitbang(priv->mii_bus); +- +- return 0; +-} +- + static const struct of_device_id ravb_match_table[] = { + { .compatible = "renesas,etheravb-r8a7790", .data = (void *)RCAR_GEN2 }, + { .compatible = "renesas,etheravb-r8a7794", .data = (void *)RCAR_GEN2 }, +@@ -2174,13 +2184,6 @@ static int ravb_probe(struct platform_device *pdev) + eth_hw_addr_random(ndev); + } + +- /* MDIO bus init */ +- error = ravb_mdio_init(priv); +- if (error) { +- dev_err(&pdev->dev, "failed to initialize MDIO\n"); +- goto out_dma_free; +- } +- + netif_napi_add(ndev, &priv->napi[RAVB_BE], ravb_poll, 64); + netif_napi_add(ndev, &priv->napi[RAVB_NC], ravb_poll, 64); + +@@ -2202,8 +2205,6 @@ static int ravb_probe(struct platform_device *pdev) + out_napi_del: + netif_napi_del(&priv->napi[RAVB_NC]); + netif_napi_del(&priv->napi[RAVB_BE]); +- ravb_mdio_release(priv); +-out_dma_free: + dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat, + priv->desc_bat_dma); + +@@ -2235,7 +2236,6 @@ static int ravb_remove(struct platform_device *pdev) + unregister_netdev(ndev); + netif_napi_del(&priv->napi[RAVB_NC]); + netif_napi_del(&priv->napi[RAVB_BE]); +- ravb_mdio_release(priv); + pm_runtime_disable(&pdev->dev); + free_netdev(ndev); + platform_set_drvdata(pdev, NULL); +-- +2.25.1 + diff --git a/queue-5.8/rxrpc-fix-loss-of-rtt-samples-due-to-interposed-ack.patch b/queue-5.8/rxrpc-fix-loss-of-rtt-samples-due-to-interposed-ack.patch new file mode 100644 index 00000000000..14ee9642b2f --- /dev/null +++ b/queue-5.8/rxrpc-fix-loss-of-rtt-samples-due-to-interposed-ack.patch @@ -0,0 +1,546 @@ +From 059a3b7e77a12538ad100952eb2dedcbb7385e7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Aug 2020 23:29:16 +0100 +Subject: rxrpc: Fix loss of RTT samples due to interposed ACK + +From: David Howells + +[ Upstream commit 4700c4d80b7bb171f6996016ef121e1508860b42 ] + +The Rx protocol has a mechanism to help generate RTT samples that works by +a client transmitting a REQUESTED-type ACK when it receives a DATA packet +that has the REQUEST_ACK flag set. + +The peer, however, may interpose other ACKs before transmitting the +REQUESTED-ACK, as can be seen in the following trace excerpt: + + rxrpc_tx_data: c=00000044 DATA d0b5ece8:00000001 00000001 q=00000001 fl=07 + rxrpc_rx_ack: c=00000044 00000001 PNG r=00000000 f=00000002 p=00000000 n=0 + rxrpc_rx_ack: c=00000044 00000002 REQ r=00000001 f=00000002 p=00000001 n=0 + ... + +DATA packet 1 (q=xx) has REQUEST_ACK set (bit 1 of fl=xx). The incoming +ping (labelled PNG) hard-acks the request DATA packet (f=xx exceeds the +sequence number of the DATA packet), causing it to be discarded from the Tx +ring. The ACK that was requested (labelled REQ, r=xx references the serial +of the DATA packet) comes after the ping, but the sk_buff holding the +timestamp has gone and the RTT sample is lost. + +This is particularly noticeable on RPC calls used to probe the service +offered by the peer. A lot of peers end up with an unknown RTT because we +only ever sent a single RPC. This confuses the server rotation algorithm. + +Fix this by caching the information about the outgoing packet in RTT +calculations in the rxrpc_call struct rather than looking in the Tx ring. + +A four-deep buffer is maintained and both REQUEST_ACK-flagged DATA and +PING-ACK transmissions are recorded in there. When the appropriate +response ACK is received, the buffer is checked for a match and, if found, +an RTT sample is recorded. + +If a received ACK refers to a packet with a later serial number than an +entry in the cache, that entry is presumed lost and the entry is made +available to record a new transmission. + +ACKs types other than REQUESTED-type and PING-type cause any matching +sample to be cancelled as they don't necessarily represent a useful +measurement. + +If there's no space in the buffer on ping/data transmission, the sample +base is discarded. + +Fixes: 50235c4b5a2f ("rxrpc: Obtain RTT data by requesting ACKs on DATA packets") +Signed-off-by: David Howells +Signed-off-by: Sasha Levin +--- + include/trace/events/rxrpc.h | 27 +++++++-- + net/rxrpc/ar-internal.h | 13 +++-- + net/rxrpc/call_object.c | 1 + + net/rxrpc/input.c | 104 ++++++++++++++++++++--------------- + net/rxrpc/output.c | 82 ++++++++++++++++++++------- + net/rxrpc/rtt.c | 3 +- + 6 files changed, 154 insertions(+), 76 deletions(-) + +diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h +index 059b6e45a0283..c33079b986e86 100644 +--- a/include/trace/events/rxrpc.h ++++ b/include/trace/events/rxrpc.h +@@ -138,11 +138,16 @@ enum rxrpc_recvmsg_trace { + }; + + enum rxrpc_rtt_tx_trace { ++ rxrpc_rtt_tx_cancel, + rxrpc_rtt_tx_data, ++ rxrpc_rtt_tx_no_slot, + rxrpc_rtt_tx_ping, + }; + + enum rxrpc_rtt_rx_trace { ++ rxrpc_rtt_rx_cancel, ++ rxrpc_rtt_rx_lost, ++ rxrpc_rtt_rx_obsolete, + rxrpc_rtt_rx_ping_response, + rxrpc_rtt_rx_requested_ack, + }; +@@ -339,10 +344,15 @@ enum rxrpc_tx_point { + E_(rxrpc_recvmsg_wait, "WAIT") + + #define rxrpc_rtt_tx_traces \ ++ EM(rxrpc_rtt_tx_cancel, "CNCE") \ + EM(rxrpc_rtt_tx_data, "DATA") \ ++ EM(rxrpc_rtt_tx_no_slot, "FULL") \ + E_(rxrpc_rtt_tx_ping, "PING") + + #define rxrpc_rtt_rx_traces \ ++ EM(rxrpc_rtt_rx_cancel, "CNCL") \ ++ EM(rxrpc_rtt_rx_obsolete, "OBSL") \ ++ EM(rxrpc_rtt_rx_lost, "LOST") \ + EM(rxrpc_rtt_rx_ping_response, "PONG") \ + E_(rxrpc_rtt_rx_requested_ack, "RACK") + +@@ -1087,38 +1097,43 @@ TRACE_EVENT(rxrpc_recvmsg, + + TRACE_EVENT(rxrpc_rtt_tx, + TP_PROTO(struct rxrpc_call *call, enum rxrpc_rtt_tx_trace why, +- rxrpc_serial_t send_serial), ++ int slot, rxrpc_serial_t send_serial), + +- TP_ARGS(call, why, send_serial), ++ TP_ARGS(call, why, slot, send_serial), + + TP_STRUCT__entry( + __field(unsigned int, call ) + __field(enum rxrpc_rtt_tx_trace, why ) ++ __field(int, slot ) + __field(rxrpc_serial_t, send_serial ) + ), + + TP_fast_assign( + __entry->call = call->debug_id; + __entry->why = why; ++ __entry->slot = slot; + __entry->send_serial = send_serial; + ), + +- TP_printk("c=%08x %s sr=%08x", ++ TP_printk("c=%08x [%d] %s sr=%08x", + __entry->call, ++ __entry->slot, + __print_symbolic(__entry->why, rxrpc_rtt_tx_traces), + __entry->send_serial) + ); + + TRACE_EVENT(rxrpc_rtt_rx, + TP_PROTO(struct rxrpc_call *call, enum rxrpc_rtt_rx_trace why, ++ int slot, + rxrpc_serial_t send_serial, rxrpc_serial_t resp_serial, + u32 rtt, u32 rto), + +- TP_ARGS(call, why, send_serial, resp_serial, rtt, rto), ++ TP_ARGS(call, why, slot, send_serial, resp_serial, rtt, rto), + + TP_STRUCT__entry( + __field(unsigned int, call ) + __field(enum rxrpc_rtt_rx_trace, why ) ++ __field(int, slot ) + __field(rxrpc_serial_t, send_serial ) + __field(rxrpc_serial_t, resp_serial ) + __field(u32, rtt ) +@@ -1128,14 +1143,16 @@ TRACE_EVENT(rxrpc_rtt_rx, + TP_fast_assign( + __entry->call = call->debug_id; + __entry->why = why; ++ __entry->slot = slot; + __entry->send_serial = send_serial; + __entry->resp_serial = resp_serial; + __entry->rtt = rtt; + __entry->rto = rto; + ), + +- TP_printk("c=%08x %s sr=%08x rr=%08x rtt=%u rto=%u", ++ TP_printk("c=%08x [%d] %s sr=%08x rr=%08x rtt=%u rto=%u", + __entry->call, ++ __entry->slot, + __print_symbolic(__entry->why, rxrpc_rtt_rx_traces), + __entry->send_serial, + __entry->resp_serial, +diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h +index 9a2139ebd67d7..ca1fea72c8d29 100644 +--- a/net/rxrpc/ar-internal.h ++++ b/net/rxrpc/ar-internal.h +@@ -488,7 +488,6 @@ enum rxrpc_call_flag { + RXRPC_CALL_RX_LAST, /* Received the last packet (at rxtx_top) */ + RXRPC_CALL_TX_LAST, /* Last packet in Tx buffer (at rxtx_top) */ + RXRPC_CALL_SEND_PING, /* A ping will need to be sent */ +- RXRPC_CALL_PINGING, /* Ping in process */ + RXRPC_CALL_RETRANS_TIMEOUT, /* Retransmission due to timeout occurred */ + RXRPC_CALL_BEGAN_RX_TIMER, /* We began the expect_rx_by timer */ + RXRPC_CALL_RX_HEARD, /* The peer responded at least once to this call */ +@@ -673,9 +672,13 @@ struct rxrpc_call { + rxrpc_seq_t ackr_consumed; /* Highest packet shown consumed */ + rxrpc_seq_t ackr_seen; /* Highest packet shown seen */ + +- /* ping management */ +- rxrpc_serial_t ping_serial; /* Last ping sent */ +- ktime_t ping_time; /* Time last ping sent */ ++ /* RTT management */ ++ rxrpc_serial_t rtt_serial[4]; /* Serial number of DATA or PING sent */ ++ ktime_t rtt_sent_at[4]; /* Time packet sent */ ++ unsigned long rtt_avail; /* Mask of available slots in bits 0-3, ++ * Mask of pending samples in 8-11 */ ++#define RXRPC_CALL_RTT_AVAIL_MASK 0xf ++#define RXRPC_CALL_RTT_PEND_SHIFT 8 + + /* transmission-phase ACK management */ + ktime_t acks_latest_ts; /* Timestamp of latest ACK received */ +@@ -1037,7 +1040,7 @@ static inline bool __rxrpc_abort_eproto(struct rxrpc_call *call, + /* + * rtt.c + */ +-void rxrpc_peer_add_rtt(struct rxrpc_call *, enum rxrpc_rtt_rx_trace, ++void rxrpc_peer_add_rtt(struct rxrpc_call *, enum rxrpc_rtt_rx_trace, int, + rxrpc_serial_t, rxrpc_serial_t, ktime_t, ktime_t); + unsigned long rxrpc_get_rto_backoff(struct rxrpc_peer *, bool); + void rxrpc_peer_init_rtt(struct rxrpc_peer *); +diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c +index 38a46167523fa..a40fae0139423 100644 +--- a/net/rxrpc/call_object.c ++++ b/net/rxrpc/call_object.c +@@ -153,6 +153,7 @@ struct rxrpc_call *rxrpc_alloc_call(struct rxrpc_sock *rx, gfp_t gfp, + call->cong_ssthresh = RXRPC_RXTX_BUFF_SIZE - 1; + + call->rxnet = rxnet; ++ call->rtt_avail = RXRPC_CALL_RTT_AVAIL_MASK; + atomic_inc(&rxnet->nr_calls); + return call; + +diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c +index a7699e56eac88..19ddfc9807e89 100644 +--- a/net/rxrpc/input.c ++++ b/net/rxrpc/input.c +@@ -608,36 +608,57 @@ unlock: + } + + /* +- * Process a requested ACK. ++ * See if there's a cached RTT probe to complete. + */ +-static void rxrpc_input_requested_ack(struct rxrpc_call *call, +- ktime_t resp_time, +- rxrpc_serial_t orig_serial, +- rxrpc_serial_t ack_serial) ++static void rxrpc_complete_rtt_probe(struct rxrpc_call *call, ++ ktime_t resp_time, ++ rxrpc_serial_t acked_serial, ++ rxrpc_serial_t ack_serial, ++ enum rxrpc_rtt_rx_trace type) + { +- struct rxrpc_skb_priv *sp; +- struct sk_buff *skb; ++ rxrpc_serial_t orig_serial; ++ unsigned long avail; + ktime_t sent_at; +- int ix; ++ bool matched = false; ++ int i; + +- for (ix = 0; ix < RXRPC_RXTX_BUFF_SIZE; ix++) { +- skb = call->rxtx_buffer[ix]; +- if (!skb) +- continue; ++ avail = READ_ONCE(call->rtt_avail); ++ smp_rmb(); /* Read avail bits before accessing data. */ + +- sent_at = skb->tstamp; +- smp_rmb(); /* Read timestamp before serial. */ +- sp = rxrpc_skb(skb); +- if (sp->hdr.serial != orig_serial) ++ for (i = 0; i < ARRAY_SIZE(call->rtt_serial); i++) { ++ if (!test_bit(i + RXRPC_CALL_RTT_PEND_SHIFT, &avail)) + continue; +- goto found; +- } + +- return; ++ sent_at = call->rtt_sent_at[i]; ++ orig_serial = call->rtt_serial[i]; ++ ++ if (orig_serial == acked_serial) { ++ clear_bit(i + RXRPC_CALL_RTT_PEND_SHIFT, &call->rtt_avail); ++ smp_mb(); /* Read data before setting avail bit */ ++ set_bit(i, &call->rtt_avail); ++ if (type != rxrpc_rtt_rx_cancel) ++ rxrpc_peer_add_rtt(call, type, i, acked_serial, ack_serial, ++ sent_at, resp_time); ++ else ++ trace_rxrpc_rtt_rx(call, rxrpc_rtt_rx_cancel, i, ++ orig_serial, acked_serial, 0, 0); ++ matched = true; ++ } ++ ++ /* If a later serial is being acked, then mark this slot as ++ * being available. ++ */ ++ if (after(acked_serial, orig_serial)) { ++ trace_rxrpc_rtt_rx(call, rxrpc_rtt_rx_obsolete, i, ++ orig_serial, acked_serial, 0, 0); ++ clear_bit(i + RXRPC_CALL_RTT_PEND_SHIFT, &call->rtt_avail); ++ smp_wmb(); ++ set_bit(i, &call->rtt_avail); ++ } ++ } + +-found: +- rxrpc_peer_add_rtt(call, rxrpc_rtt_rx_requested_ack, +- orig_serial, ack_serial, sent_at, resp_time); ++ if (!matched) ++ trace_rxrpc_rtt_rx(call, rxrpc_rtt_rx_lost, 9, 0, acked_serial, 0, 0); + } + + /* +@@ -682,27 +703,11 @@ static void rxrpc_input_check_for_lost_ack(struct rxrpc_call *call) + */ + static void rxrpc_input_ping_response(struct rxrpc_call *call, + ktime_t resp_time, +- rxrpc_serial_t orig_serial, ++ rxrpc_serial_t acked_serial, + rxrpc_serial_t ack_serial) + { +- rxrpc_serial_t ping_serial; +- ktime_t ping_time; +- +- ping_time = call->ping_time; +- smp_rmb(); +- ping_serial = READ_ONCE(call->ping_serial); +- +- if (orig_serial == call->acks_lost_ping) ++ if (acked_serial == call->acks_lost_ping) + rxrpc_input_check_for_lost_ack(call); +- +- if (before(orig_serial, ping_serial) || +- !test_and_clear_bit(RXRPC_CALL_PINGING, &call->flags)) +- return; +- if (after(orig_serial, ping_serial)) +- return; +- +- rxrpc_peer_add_rtt(call, rxrpc_rtt_rx_ping_response, +- orig_serial, ack_serial, ping_time, resp_time); + } + + /* +@@ -869,12 +874,23 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) + first_soft_ack, prev_pkt, + summary.ack_reason, nr_acks); + +- if (buf.ack.reason == RXRPC_ACK_PING_RESPONSE) ++ switch (buf.ack.reason) { ++ case RXRPC_ACK_PING_RESPONSE: + rxrpc_input_ping_response(call, skb->tstamp, acked_serial, + ack_serial); +- if (buf.ack.reason == RXRPC_ACK_REQUESTED) +- rxrpc_input_requested_ack(call, skb->tstamp, acked_serial, +- ack_serial); ++ rxrpc_complete_rtt_probe(call, skb->tstamp, acked_serial, ack_serial, ++ rxrpc_rtt_rx_ping_response); ++ break; ++ case RXRPC_ACK_REQUESTED: ++ rxrpc_complete_rtt_probe(call, skb->tstamp, acked_serial, ack_serial, ++ rxrpc_rtt_rx_requested_ack); ++ break; ++ default: ++ if (acked_serial != 0) ++ rxrpc_complete_rtt_probe(call, skb->tstamp, acked_serial, ack_serial, ++ rxrpc_rtt_rx_cancel); ++ break; ++ } + + if (buf.ack.reason == RXRPC_ACK_PING) { + _proto("Rx ACK %%%u PING Request", ack_serial); +diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c +index 1ba43c3df4adb..3cfff7922ba82 100644 +--- a/net/rxrpc/output.c ++++ b/net/rxrpc/output.c +@@ -123,6 +123,49 @@ static size_t rxrpc_fill_out_ack(struct rxrpc_connection *conn, + return top - hard_ack + 3; + } + ++/* ++ * Record the beginning of an RTT probe. ++ */ ++static int rxrpc_begin_rtt_probe(struct rxrpc_call *call, rxrpc_serial_t serial, ++ enum rxrpc_rtt_tx_trace why) ++{ ++ unsigned long avail = call->rtt_avail; ++ int rtt_slot = 9; ++ ++ if (!(avail & RXRPC_CALL_RTT_AVAIL_MASK)) ++ goto no_slot; ++ ++ rtt_slot = __ffs(avail & RXRPC_CALL_RTT_AVAIL_MASK); ++ if (!test_and_clear_bit(rtt_slot, &call->rtt_avail)) ++ goto no_slot; ++ ++ call->rtt_serial[rtt_slot] = serial; ++ call->rtt_sent_at[rtt_slot] = ktime_get_real(); ++ smp_wmb(); /* Write data before avail bit */ ++ set_bit(rtt_slot + RXRPC_CALL_RTT_PEND_SHIFT, &call->rtt_avail); ++ ++ trace_rxrpc_rtt_tx(call, why, rtt_slot, serial); ++ return rtt_slot; ++ ++no_slot: ++ trace_rxrpc_rtt_tx(call, rxrpc_rtt_tx_no_slot, rtt_slot, serial); ++ return -1; ++} ++ ++/* ++ * Cancel an RTT probe. ++ */ ++static void rxrpc_cancel_rtt_probe(struct rxrpc_call *call, ++ rxrpc_serial_t serial, int rtt_slot) ++{ ++ if (rtt_slot != -1) { ++ clear_bit(rtt_slot + RXRPC_CALL_RTT_PEND_SHIFT, &call->rtt_avail); ++ smp_wmb(); /* Clear pending bit before setting slot */ ++ set_bit(rtt_slot, &call->rtt_avail); ++ trace_rxrpc_rtt_tx(call, rxrpc_rtt_tx_cancel, rtt_slot, serial); ++ } ++} ++ + /* + * Send an ACK call packet. + */ +@@ -136,7 +179,7 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping, + rxrpc_serial_t serial; + rxrpc_seq_t hard_ack, top; + size_t len, n; +- int ret; ++ int ret, rtt_slot = -1; + u8 reason; + + if (test_bit(RXRPC_CALL_DISCONNECTED, &call->flags)) +@@ -196,18 +239,8 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping, + if (_serial) + *_serial = serial; + +- if (ping) { +- call->ping_serial = serial; +- smp_wmb(); +- /* We need to stick a time in before we send the packet in case +- * the reply gets back before kernel_sendmsg() completes - but +- * asking UDP to send the packet can take a relatively long +- * time. +- */ +- call->ping_time = ktime_get_real(); +- set_bit(RXRPC_CALL_PINGING, &call->flags); +- trace_rxrpc_rtt_tx(call, rxrpc_rtt_tx_ping, serial); +- } ++ if (ping) ++ rtt_slot = rxrpc_begin_rtt_probe(call, serial, rxrpc_rtt_tx_ping); + + ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 2, len); + conn->params.peer->last_tx_at = ktime_get_seconds(); +@@ -221,8 +254,7 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping, + + if (call->state < RXRPC_CALL_COMPLETE) { + if (ret < 0) { +- if (ping) +- clear_bit(RXRPC_CALL_PINGING, &call->flags); ++ rxrpc_cancel_rtt_probe(call, serial, rtt_slot); + rxrpc_propose_ACK(call, pkt->ack.reason, + ntohl(pkt->ack.serial), + false, true, +@@ -321,7 +353,7 @@ int rxrpc_send_data_packet(struct rxrpc_call *call, struct sk_buff *skb, + struct kvec iov[2]; + rxrpc_serial_t serial; + size_t len; +- int ret; ++ int ret, rtt_slot = -1; + + _enter(",{%d}", skb->len); + +@@ -397,6 +429,8 @@ int rxrpc_send_data_packet(struct rxrpc_call *call, struct sk_buff *skb, + sp->hdr.serial = serial; + smp_wmb(); /* Set serial before timestamp */ + skb->tstamp = ktime_get_real(); ++ if (whdr.flags & RXRPC_REQUEST_ACK) ++ rtt_slot = rxrpc_begin_rtt_probe(call, serial, rxrpc_rtt_tx_data); + + /* send the packet by UDP + * - returns -EMSGSIZE if UDP would have to fragment the packet +@@ -408,12 +442,15 @@ int rxrpc_send_data_packet(struct rxrpc_call *call, struct sk_buff *skb, + conn->params.peer->last_tx_at = ktime_get_seconds(); + + up_read(&conn->params.local->defrag_sem); +- if (ret < 0) ++ if (ret < 0) { ++ rxrpc_cancel_rtt_probe(call, serial, rtt_slot); + trace_rxrpc_tx_fail(call->debug_id, serial, ret, + rxrpc_tx_point_call_data_nofrag); +- else ++ } else { + trace_rxrpc_tx_packet(call->debug_id, &whdr, + rxrpc_tx_point_call_data_nofrag); ++ } ++ + rxrpc_tx_backoff(call, ret); + if (ret == -EMSGSIZE) + goto send_fragmentable; +@@ -422,7 +459,6 @@ done: + if (ret >= 0) { + if (whdr.flags & RXRPC_REQUEST_ACK) { + call->peer->rtt_last_req = skb->tstamp; +- trace_rxrpc_rtt_tx(call, rxrpc_rtt_tx_data, serial); + if (call->peer->rtt_count > 1) { + unsigned long nowj = jiffies, ack_lost_at; + +@@ -469,6 +505,8 @@ send_fragmentable: + sp->hdr.serial = serial; + smp_wmb(); /* Set serial before timestamp */ + skb->tstamp = ktime_get_real(); ++ if (whdr.flags & RXRPC_REQUEST_ACK) ++ rtt_slot = rxrpc_begin_rtt_probe(call, serial, rxrpc_rtt_tx_data); + + switch (conn->params.local->srx.transport.family) { + case AF_INET6: +@@ -487,12 +525,14 @@ send_fragmentable: + BUG(); + } + +- if (ret < 0) ++ if (ret < 0) { ++ rxrpc_cancel_rtt_probe(call, serial, rtt_slot); + trace_rxrpc_tx_fail(call->debug_id, serial, ret, + rxrpc_tx_point_call_data_frag); +- else ++ } else { + trace_rxrpc_tx_packet(call->debug_id, &whdr, + rxrpc_tx_point_call_data_frag); ++ } + rxrpc_tx_backoff(call, ret); + + up_write(&conn->params.local->defrag_sem); +diff --git a/net/rxrpc/rtt.c b/net/rxrpc/rtt.c +index 928d8b34a3eee..1221b0637a7ec 100644 +--- a/net/rxrpc/rtt.c ++++ b/net/rxrpc/rtt.c +@@ -146,6 +146,7 @@ static void rxrpc_ack_update_rtt(struct rxrpc_peer *peer, long rtt_us) + * exclusive access to the peer RTT data. + */ + void rxrpc_peer_add_rtt(struct rxrpc_call *call, enum rxrpc_rtt_rx_trace why, ++ int rtt_slot, + rxrpc_serial_t send_serial, rxrpc_serial_t resp_serial, + ktime_t send_time, ktime_t resp_time) + { +@@ -162,7 +163,7 @@ void rxrpc_peer_add_rtt(struct rxrpc_call *call, enum rxrpc_rtt_rx_trace why, + peer->rtt_count++; + spin_unlock(&peer->rtt_input_lock); + +- trace_rxrpc_rtt_rx(call, why, send_serial, resp_serial, ++ trace_rxrpc_rtt_rx(call, why, rtt_slot, send_serial, resp_serial, + peer->srtt_us >> 3, peer->rto_j); + } + +-- +2.25.1 + diff --git a/queue-5.8/rxrpc-keep-the-ack-serial-in-a-var-in-rxrpc_input_ac.patch b/queue-5.8/rxrpc-keep-the-ack-serial-in-a-var-in-rxrpc_input_ac.patch new file mode 100644 index 00000000000..f2cad7047ba --- /dev/null +++ b/queue-5.8/rxrpc-keep-the-ack-serial-in-a-var-in-rxrpc_input_ac.patch @@ -0,0 +1,99 @@ +From d2ad64307fef8031a55eee0ff73693fb65390067 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 14:12:33 +0100 +Subject: rxrpc: Keep the ACK serial in a var in rxrpc_input_ack() + +From: David Howells + +[ Upstream commit 68528d937dcd675e79973061c1a314db598162d1 ] + +Keep the ACK serial number in a variable in rxrpc_input_ack() as it's used +frequently. + +Signed-off-by: David Howells +Signed-off-by: Sasha Levin +--- + net/rxrpc/input.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c +index 767579328a069..a7699e56eac88 100644 +--- a/net/rxrpc/input.c ++++ b/net/rxrpc/input.c +@@ -843,7 +843,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) + struct rxrpc_ackinfo info; + u8 acks[RXRPC_MAXACKS]; + } buf; +- rxrpc_serial_t acked_serial; ++ rxrpc_serial_t ack_serial, acked_serial; + rxrpc_seq_t first_soft_ack, hard_ack, prev_pkt; + int nr_acks, offset, ioffset; + +@@ -856,6 +856,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) + } + offset += sizeof(buf.ack); + ++ ack_serial = sp->hdr.serial; + acked_serial = ntohl(buf.ack.serial); + first_soft_ack = ntohl(buf.ack.firstPacket); + prev_pkt = ntohl(buf.ack.previousPacket); +@@ -864,31 +865,31 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) + summary.ack_reason = (buf.ack.reason < RXRPC_ACK__INVALID ? + buf.ack.reason : RXRPC_ACK__INVALID); + +- trace_rxrpc_rx_ack(call, sp->hdr.serial, acked_serial, ++ trace_rxrpc_rx_ack(call, ack_serial, acked_serial, + first_soft_ack, prev_pkt, + summary.ack_reason, nr_acks); + + if (buf.ack.reason == RXRPC_ACK_PING_RESPONSE) + rxrpc_input_ping_response(call, skb->tstamp, acked_serial, +- sp->hdr.serial); ++ ack_serial); + if (buf.ack.reason == RXRPC_ACK_REQUESTED) + rxrpc_input_requested_ack(call, skb->tstamp, acked_serial, +- sp->hdr.serial); ++ ack_serial); + + if (buf.ack.reason == RXRPC_ACK_PING) { +- _proto("Rx ACK %%%u PING Request", sp->hdr.serial); ++ _proto("Rx ACK %%%u PING Request", ack_serial); + rxrpc_propose_ACK(call, RXRPC_ACK_PING_RESPONSE, +- sp->hdr.serial, true, true, ++ ack_serial, true, true, + rxrpc_propose_ack_respond_to_ping); + } else if (sp->hdr.flags & RXRPC_REQUEST_ACK) { + rxrpc_propose_ACK(call, RXRPC_ACK_REQUESTED, +- sp->hdr.serial, true, true, ++ ack_serial, true, true, + rxrpc_propose_ack_respond_to_ack); + } + + /* Discard any out-of-order or duplicate ACKs (outside lock). */ + if (!rxrpc_is_ack_valid(call, first_soft_ack, prev_pkt)) { +- trace_rxrpc_rx_discard_ack(call->debug_id, sp->hdr.serial, ++ trace_rxrpc_rx_discard_ack(call->debug_id, ack_serial, + first_soft_ack, call->ackr_first_seq, + prev_pkt, call->ackr_prev_seq); + return; +@@ -904,7 +905,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) + + /* Discard any out-of-order or duplicate ACKs (inside lock). */ + if (!rxrpc_is_ack_valid(call, first_soft_ack, prev_pkt)) { +- trace_rxrpc_rx_discard_ack(call->debug_id, sp->hdr.serial, ++ trace_rxrpc_rx_discard_ack(call->debug_id, ack_serial, + first_soft_ack, call->ackr_first_seq, + prev_pkt, call->ackr_prev_seq); + goto out; +@@ -964,7 +965,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) + RXRPC_TX_ANNO_LAST && + summary.nr_acks == call->tx_top - hard_ack && + rxrpc_is_client_call(call)) +- rxrpc_propose_ACK(call, RXRPC_ACK_PING, sp->hdr.serial, ++ rxrpc_propose_ACK(call, RXRPC_ACK_PING, ack_serial, + false, true, + rxrpc_propose_ack_ping_for_lost_reply); + +-- +2.25.1 + diff --git a/queue-5.8/rxrpc-make-rxrpc_kernel_get_srtt-indicate-validity.patch b/queue-5.8/rxrpc-make-rxrpc_kernel_get_srtt-indicate-validity.patch new file mode 100644 index 00000000000..e9dc59c8435 --- /dev/null +++ b/queue-5.8/rxrpc-make-rxrpc_kernel_get_srtt-indicate-validity.patch @@ -0,0 +1,98 @@ +From 236b40375fc72f690ae45803c1678c084e48e988 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 15:13:00 +0100 +Subject: rxrpc: Make rxrpc_kernel_get_srtt() indicate validity + +From: David Howells + +[ Upstream commit 1d4adfaf65746203861c72d9d78de349eb97d528 ] + +Fix rxrpc_kernel_get_srtt() to indicate the validity of the returned +smoothed RTT. If we haven't had any valid samples yet, the SRTT isn't +useful. + +Fixes: c410bf01933e ("rxrpc: Fix the excessive initial retransmission timeout") +Signed-off-by: David Howells +Signed-off-by: Sasha Levin +--- + fs/afs/fs_probe.c | 4 ++-- + fs/afs/vl_probe.c | 4 ++-- + include/net/af_rxrpc.h | 2 +- + net/rxrpc/peer_object.c | 16 +++++++++++++--- + 4 files changed, 18 insertions(+), 8 deletions(-) + +diff --git a/fs/afs/fs_probe.c b/fs/afs/fs_probe.c +index 5d9ef517cf816..e7e98ad63a91a 100644 +--- a/fs/afs/fs_probe.c ++++ b/fs/afs/fs_probe.c +@@ -161,8 +161,8 @@ responded: + } + } + +- rtt_us = rxrpc_kernel_get_srtt(call->net->socket, call->rxcall); +- if (rtt_us < server->probe.rtt) { ++ if (rxrpc_kernel_get_srtt(call->net->socket, call->rxcall, &rtt_us) && ++ rtt_us < server->probe.rtt) { + server->probe.rtt = rtt_us; + server->rtt = rtt_us; + alist->preferred = index; +diff --git a/fs/afs/vl_probe.c b/fs/afs/vl_probe.c +index e3aa013c21779..081b7e5b13f58 100644 +--- a/fs/afs/vl_probe.c ++++ b/fs/afs/vl_probe.c +@@ -92,8 +92,8 @@ responded: + } + } + +- rtt_us = rxrpc_kernel_get_srtt(call->net->socket, call->rxcall); +- if (rtt_us < server->probe.rtt) { ++ if (rxrpc_kernel_get_srtt(call->net->socket, call->rxcall, &rtt_us) && ++ rtt_us < server->probe.rtt) { + server->probe.rtt = rtt_us; + alist->preferred = index; + have_result = true; +diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h +index 91eacbdcf33d2..f6abcc0bbd6e7 100644 +--- a/include/net/af_rxrpc.h ++++ b/include/net/af_rxrpc.h +@@ -59,7 +59,7 @@ bool rxrpc_kernel_abort_call(struct socket *, struct rxrpc_call *, + void rxrpc_kernel_end_call(struct socket *, struct rxrpc_call *); + void rxrpc_kernel_get_peer(struct socket *, struct rxrpc_call *, + struct sockaddr_rxrpc *); +-u32 rxrpc_kernel_get_srtt(struct socket *, struct rxrpc_call *); ++bool rxrpc_kernel_get_srtt(struct socket *, struct rxrpc_call *, u32 *); + int rxrpc_kernel_charge_accept(struct socket *, rxrpc_notify_rx_t, + rxrpc_user_attach_call_t, unsigned long, gfp_t, + unsigned int); +diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c +index ca29976bb193e..68396d0520525 100644 +--- a/net/rxrpc/peer_object.c ++++ b/net/rxrpc/peer_object.c +@@ -502,11 +502,21 @@ EXPORT_SYMBOL(rxrpc_kernel_get_peer); + * rxrpc_kernel_get_srtt - Get a call's peer smoothed RTT + * @sock: The socket on which the call is in progress. + * @call: The call to query ++ * @_srtt: Where to store the SRTT value. + * +- * Get the call's peer smoothed RTT. ++ * Get the call's peer smoothed RTT in uS. + */ +-u32 rxrpc_kernel_get_srtt(struct socket *sock, struct rxrpc_call *call) ++bool rxrpc_kernel_get_srtt(struct socket *sock, struct rxrpc_call *call, ++ u32 *_srtt) + { +- return call->peer->srtt_us >> 3; ++ struct rxrpc_peer *peer = call->peer; ++ ++ if (peer->rtt_count == 0) { ++ *_srtt = 1000000; /* 1S */ ++ return false; ++ } ++ ++ *_srtt = call->peer->srtt_us >> 3; ++ return true; + } + EXPORT_SYMBOL(rxrpc_kernel_get_srtt); +-- +2.25.1 + diff --git a/queue-5.8/selftests-bpf-fix-massive-output-from-test_maps.patch b/queue-5.8/selftests-bpf-fix-massive-output-from-test_maps.patch new file mode 100644 index 00000000000..ce3d3027f23 --- /dev/null +++ b/queue-5.8/selftests-bpf-fix-massive-output-from-test_maps.patch @@ -0,0 +1,42 @@ +From c512a5c68967a6c289d01ba6694bf106c69147f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 10:17:36 +0200 +Subject: selftests/bpf: Fix massive output from test_maps + +From: Jesper Dangaard Brouer + +[ Upstream commit fa4505675e093e895b7ec49a76d44f6b5ad9602e ] + +When stdout output from the selftests tool 'test_maps' gets redirected +into e.g file or pipe, then the output lines increase a lot (from 21 +to 33949 lines). This is caused by the printf that happens before the +fork() call, and there are user-space buffered printf data that seems +to be duplicated into the forked process. + +To fix this fflush() stdout before the fork loop in __run_parallel(). + +Fixes: 1a97cf1fe503 ("selftests/bpf: speedup test_maps") +Signed-off-by: Jesper Dangaard Brouer +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/159842985651.1050885.2154399297503372406.stgit@firesoul +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_maps.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c +index 754cf611723ee..0d92ebcb335d1 100644 +--- a/tools/testing/selftests/bpf/test_maps.c ++++ b/tools/testing/selftests/bpf/test_maps.c +@@ -1274,6 +1274,8 @@ static void __run_parallel(unsigned int tasks, + pid_t pid[tasks]; + int i; + ++ fflush(stdout); ++ + for (i = 0; i < tasks; i++) { + pid[i] = fork(); + if (pid[i] == 0) { +-- +2.25.1 + diff --git a/queue-5.8/series b/queue-5.8/series index fd3817e98f6..649c97db770 100644 --- a/queue-5.8/series +++ b/queue-5.8/series @@ -36,3 +36,82 @@ drm-amd-display-retry-aux-write-when-fail-occurs.patch drm-amd-display-fix-memleak-in-amdgpu_dm_mode_config.patch xen-xenbus-fix-granting-of-vmalloc-d-memory.patch fsldma-fix-very-broken-32-bit-ppc-ioread64-functiona.patch +dmaengine-of-dma-fix-of_dma_router_xlate-s-of_dma_xl.patch +batman-adv-avoid-uninitialized-chaddr-when-handling-.patch +batman-adv-fix-own-ogm-check-in-aggregated-ogms.patch +batman-adv-bla-use-netif_rx_ni-when-not-in-interrupt.patch +dmaengine-at_hdmac-check-return-value-of-of_find_dev.patch +dmaengine-at_hdmac-add-missing-put_device-call-in-at.patch +dmaengine-at_hdmac-add-missing-kfree-call-in-at_dma_.patch +rxrpc-keep-the-ack-serial-in-a-var-in-rxrpc_input_ac.patch +rxrpc-fix-loss-of-rtt-samples-due-to-interposed-ack.patch +rxrpc-make-rxrpc_kernel_get_srtt-indicate-validity.patch +mips-mm-bmips5000-has-inclusive-physical-caches.patch +mips-bmips-also-call-bmips_cpu_setup-for-secondary-c.patch +mmc-sdhci-acpi-fix-hs400-tuning-for-amdi0040.patch +perf-sched-timehist-fix-use-of-cpu-list-with-summary.patch +perf-top-skip-side-band-event-setup-if-have_libbpf_s.patch +netfilter-nf_tables-add-nfta_set_userdata-if-not-nul.patch +netfilter-nf_tables-incorrect-enum-nft_list_attribut.patch +netfilter-nf_tables-fix-destination-register-zeroing.patch +net-hns-fix-memleak-in-hns_nic_dev_probe.patch +net-systemport-fix-memleak-in-bcm_sysport_probe.patch +ravb-fixed-to-be-able-to-unload-modules.patch +net-arc_emac-fix-memleak-in-arc_mdio_probe.patch +bpf-fix-a-buffer-out-of-bound-access-when-filling-ra.patch +dmaengine-pl330-fix-burst-length-if-burst-size-is-sm.patch +dmaengine-ti-k3-udma-fix-the-tr-initialization-for-p.patch +gtp-add-gtpa_link-info-to-msg-sent-to-userspace.patch +net-ethernet-ti-cpsw-fix-clean-up-of-vlan-mc-entries.patch +net-ethernet-ti-cpsw_new-fix-clean-up-of-vlan-mc-ent.patch +bnxt_en-don-t-query-fw-when-netif_running-is-false.patch +bnxt_en-check-for-zero-dir-entries-in-nvram.patch +bnxt_en-fix-ethtool-s-statitics-with-xdp-or-tcs-enab.patch +bnxt_en-fix-pci-aer-error-recovery-flow.patch +bnxt_en-fix-possible-crash-in-bnxt_fw_reset_task.patch +bnxt_en-fix-hwrm-error-when-querying-vf-temperature.patch +xfs-finish-dfops-on-every-insert-range-shift-iterati.patch +xfs-fix-boundary-test-in-xfs_attr_shortform_verify.patch +bnxt-don-t-enable-napi-until-rings-are-ready.patch +media-vicodec-add-missing-v4l2_ctrl_request_hdl_put.patch +media-cedrus-add-missing-v4l2_ctrl_request_hdl_put.patch +net-ethernet-ti-cpsw_new-fix-error-handling-in-cpsw_.patch +media-i2c-imx214-select-v4l2_fwnode.patch +selftests-bpf-fix-massive-output-from-test_maps.patch +net-dsa-mt7530-fix-advertising-unsupported-1000baset.patch +netfilter-nfnetlink-nfnetlink_unicast-reports-eagain.patch +nvmet-fc-fix-a-missed-_irqsave-version-of-spin_lock-.patch +nvme-fix-controller-instance-leak.patch +netfilter-conntrack-do-not-auto-delete-clash-entries.patch +opp-don-t-drop-reference-for-an-opp-table-that-was-n.patch +cxgb4-fix-thermal-zone-device-registration.patch +net-ethernet-ti-am65-cpsw-fix-rmii-100mbit-link-mode.patch +mips-perf-fix-wrong-check-condition-of-loongson-even.patch +block-fix-locking-in-bdev_del_partition.patch +perf-top-report-fix-infinite-loop-in-the-tui-for-gro.patch +perf-cs-etm-fix-corrupt-data-after-perf-inject-from.patch +perf-intel-pt-fix-corrupt-data-after-perf-inject-fro.patch +perf-tools-correct-snoopx-field-offset.patch +net-ethernet-mlx4-fix-memory-allocation-in-mlx4_budd.patch +fix-regression-in-epoll-keep-a-reference-on-files-ad.patch +net-bcmgenet-fix-mask-check-in-bcmgenet_validate_flo.patch +net-gemini-fix-another-missing-clk_disable_unprepare.patch +nfp-flower-fix-abi-mismatch-between-driver-and-firmw.patch +net-dp83867-fix-wol-secureon-password.patch +drm-radeon-prefer-lower-feedback-dividers.patch +x86-mm-32-bring-back-vmalloc-faulting-on-x86_32.patch +mips-add-missing-msacsr-and-upper-msa-initialization.patch +mips-sni-fix-scsi-interrupt.patch +xfs-fix-xfs_bmap_validate_extent_raw-when-checking-a.patch +perf-jevents-fix-suspicious-code-in-fixregex.patch +perf-stat-turn-off-summary-for-interval-mode-by-defa.patch +perf-bench-the-do_run_multi_threaded-function-must-u.patch +tg3-fix-soft-lockup-when-tg3_reset_task-fails.patch +x86-fakenuma-fix-invalid-starting-node-id.patch +iommu-vt-d-serialize-iommu-gcmd-register-modificatio.patch +thermal-ti-soc-thermal-fix-bogus-thermal-shutdowns-f.patch +thermal-qcom-spmi-temp-alarm-don-t-suppress-negative.patch +iommu-amd-restore-irte.remapen-bit-after-programming.patch +iommu-amd-use-cmpxchg_double-when-updating-128-bit-i.patch +net-packet-fix-overflow-in-tpacket_rcv.patch +include-linux-log2.h-add-missing-around-n-in-roundup.patch diff --git a/queue-5.8/tg3-fix-soft-lockup-when-tg3_reset_task-fails.patch b/queue-5.8/tg3-fix-soft-lockup-when-tg3_reset_task-fails.patch new file mode 100644 index 00000000000..5cbf55fd85a --- /dev/null +++ b/queue-5.8/tg3-fix-soft-lockup-when-tg3_reset_task-fails.patch @@ -0,0 +1,80 @@ +From 4e9ca6ec3feecb03961e443744418841a7f54232 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Sep 2020 14:28:54 -0400 +Subject: tg3: Fix soft lockup when tg3_reset_task() fails. + +From: Michael Chan + +[ Upstream commit 556699341efa98243e08e34401b3f601da91f5a3 ] + +If tg3_reset_task() fails, the device state is left in an inconsistent +state with IFF_RUNNING still set but NAPI state not enabled. A +subsequent operation, such as ifdown or AER error can cause it to +soft lock up when it tries to disable NAPI state. + +Fix it by bringing down the device to !IFF_RUNNING state when +tg3_reset_task() fails. tg3_reset_task() running from workqueue +will now call tg3_close() when the reset fails. We need to +modify tg3_reset_task_cancel() slightly to avoid tg3_close() +calling cancel_work_sync() to cancel tg3_reset_task(). Otherwise +cancel_work_sync() will wait forever for tg3_reset_task() to +finish. + +Reported-by: David Christensen +Reported-by: Baptiste Covolato +Fixes: db2199737990 ("tg3: Schedule at most one tg3_reset_task run") +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/tg3.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index ebff1fc0d8cef..4515804d1ce4c 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -7221,8 +7221,8 @@ static inline void tg3_reset_task_schedule(struct tg3 *tp) + + static inline void tg3_reset_task_cancel(struct tg3 *tp) + { +- cancel_work_sync(&tp->reset_task); +- tg3_flag_clear(tp, RESET_TASK_PENDING); ++ if (test_and_clear_bit(TG3_FLAG_RESET_TASK_PENDING, tp->tg3_flags)) ++ cancel_work_sync(&tp->reset_task); + tg3_flag_clear(tp, TX_RECOVERY_PENDING); + } + +@@ -11209,18 +11209,27 @@ static void tg3_reset_task(struct work_struct *work) + + tg3_halt(tp, RESET_KIND_SHUTDOWN, 0); + err = tg3_init_hw(tp, true); +- if (err) ++ if (err) { ++ tg3_full_unlock(tp); ++ tp->irq_sync = 0; ++ tg3_napi_enable(tp); ++ /* Clear this flag so that tg3_reset_task_cancel() will not ++ * call cancel_work_sync() and wait forever. ++ */ ++ tg3_flag_clear(tp, RESET_TASK_PENDING); ++ dev_close(tp->dev); + goto out; ++ } + + tg3_netif_start(tp); + +-out: + tg3_full_unlock(tp); + + if (!err) + tg3_phy_start(tp); + + tg3_flag_clear(tp, RESET_TASK_PENDING); ++out: + rtnl_unlock(); + } + +-- +2.25.1 + diff --git a/queue-5.8/thermal-qcom-spmi-temp-alarm-don-t-suppress-negative.patch b/queue-5.8/thermal-qcom-spmi-temp-alarm-don-t-suppress-negative.patch new file mode 100644 index 00000000000..cd06785a60e --- /dev/null +++ b/queue-5.8/thermal-qcom-spmi-temp-alarm-don-t-suppress-negative.patch @@ -0,0 +1,49 @@ +From dbf586d0431830d62e6cad1ccd03cd16e4b65514 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jul 2020 09:52:51 -0700 +Subject: thermal: qcom-spmi-temp-alarm: Don't suppress negative temp + +From: Veera Vegivada + +[ Upstream commit 0ffdab6f2dea9e23ec33230de24e492ff0b186d9 ] + +Currently driver is suppressing the negative temperature +readings from the vadc. Consumers of the thermal zones need +to read the negative temperature too. Don't suppress the +readings. + +Fixes: c610afaa21d3c6e ("thermal: Add QPNP PMIC temperature alarm driver") +Signed-off-by: Veera Vegivada +Signed-off-by: Guru Das Srinagesh +Reviewed-by: Stephen Boyd +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/944856eb819081268fab783236a916257de120e4.1596040416.git.gurus@codeaurora.org +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/qcom-spmi-temp-alarm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/thermal/qcom/qcom-spmi-temp-alarm.c b/drivers/thermal/qcom/qcom-spmi-temp-alarm.c +index bf7bae42c141c..6dc879fea9c8a 100644 +--- a/drivers/thermal/qcom/qcom-spmi-temp-alarm.c ++++ b/drivers/thermal/qcom/qcom-spmi-temp-alarm.c +@@ -1,6 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0-only + /* +- * Copyright (c) 2011-2015, 2017, The Linux Foundation. All rights reserved. ++ * Copyright (c) 2011-2015, 2017, 2020, The Linux Foundation. All rights reserved. + */ + + #include +@@ -191,7 +191,7 @@ static int qpnp_tm_get_temp(void *data, int *temp) + chip->temp = mili_celsius; + } + +- *temp = chip->temp < 0 ? 0 : chip->temp; ++ *temp = chip->temp; + + return 0; + } +-- +2.25.1 + diff --git a/queue-5.8/thermal-ti-soc-thermal-fix-bogus-thermal-shutdowns-f.patch b/queue-5.8/thermal-ti-soc-thermal-fix-bogus-thermal-shutdowns-f.patch new file mode 100644 index 00000000000..41b5924309e --- /dev/null +++ b/queue-5.8/thermal-ti-soc-thermal-fix-bogus-thermal-shutdowns-f.patch @@ -0,0 +1,110 @@ +From 221b99aecad46e2c12854284c63b3f34b67b9a1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jul 2020 11:33:38 -0700 +Subject: thermal: ti-soc-thermal: Fix bogus thermal shutdowns for omap4430 + +From: Tony Lindgren + +[ Upstream commit 30d24faba0532d6972df79a1bf060601994b5873 ] + +We can sometimes get bogus thermal shutdowns on omap4430 at least with +droid4 running idle with a battery charger connected: + +thermal thermal_zone0: critical temperature reached (143 C), shutting down + +Dumping out the register values shows we can occasionally get a 0x7f value +that is outside the TRM listed values in the ADC conversion table. And then +we get a normal value when reading again after that. Reading the register +multiple times does not seem help avoiding the bogus values as they stay +until the next sample is ready. + +Looking at the TRM chapter "18.4.10.2.3 ADC Codes Versus Temperature", we +should have values from 13 to 107 listed with a total of 95 values. But +looking at the omap4430_adc_to_temp array, the values are off, and the +end values are missing. And it seems that the 4430 ADC table is similar +to omap3630 rather than omap4460. + +Let's fix the issue by using values based on the omap3630 table and just +ignoring invalid values. Compared to the 4430 TRM, the omap3630 table has +the missing values added while the TRM table only shows every second +value. + +Note that sometimes the ADC register values within the valid table can +also be way off for about 1 out of 10 values. But it seems that those +just show about 25 C too low values rather than too high values. So those +do not cause a bogus thermal shutdown. + +Fixes: 1a31270e54d7 ("staging: omap-thermal: add OMAP4 data structures") +Cc: Merlijn Wajer +Cc: Pavel Machek +Cc: Sebastian Reichel +Signed-off-by: Tony Lindgren +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20200706183338.25622-1-tony@atomide.com +Signed-off-by: Sasha Levin +--- + .../ti-soc-thermal/omap4-thermal-data.c | 23 ++++++++++--------- + .../thermal/ti-soc-thermal/omap4xxx-bandgap.h | 10 +++++--- + 2 files changed, 19 insertions(+), 14 deletions(-) + +diff --git a/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c b/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c +index 63b02bfb2adf6..fdb8a495ab69a 100644 +--- a/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c ++++ b/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c +@@ -37,20 +37,21 @@ static struct temp_sensor_data omap4430_mpu_temp_sensor_data = { + + /* + * Temperature values in milli degree celsius +- * ADC code values from 530 to 923 ++ * ADC code values from 13 to 107, see TRM ++ * "18.4.10.2.3 ADC Codes Versus Temperature". + */ + static const int + omap4430_adc_to_temp[OMAP4430_ADC_END_VALUE - OMAP4430_ADC_START_VALUE + 1] = { +- -38000, -35000, -34000, -32000, -30000, -28000, -26000, -24000, -22000, +- -20000, -18000, -17000, -15000, -13000, -12000, -10000, -8000, -6000, +- -5000, -3000, -1000, 0, 2000, 3000, 5000, 6000, 8000, 10000, 12000, +- 13000, 15000, 17000, 19000, 21000, 23000, 25000, 27000, 28000, 30000, +- 32000, 33000, 35000, 37000, 38000, 40000, 42000, 43000, 45000, 47000, +- 48000, 50000, 52000, 53000, 55000, 57000, 58000, 60000, 62000, 64000, +- 66000, 68000, 70000, 71000, 73000, 75000, 77000, 78000, 80000, 82000, +- 83000, 85000, 87000, 88000, 90000, 92000, 93000, 95000, 97000, 98000, +- 100000, 102000, 103000, 105000, 107000, 109000, 111000, 113000, 115000, +- 117000, 118000, 120000, 122000, 123000, ++ -40000, -38000, -35000, -34000, -32000, -30000, -28000, -26000, -24000, ++ -22000, -20000, -18500, -17000, -15000, -13500, -12000, -10000, -8000, ++ -6500, -5000, -3500, -1500, 0, 2000, 3500, 5000, 6500, 8500, 10000, ++ 12000, 13500, 15000, 17000, 19000, 21000, 23000, 25000, 27000, 28500, ++ 30000, 32000, 33500, 35000, 37000, 38500, 40000, 42000, 43500, 45000, ++ 47000, 48500, 50000, 52000, 53500, 55000, 57000, 58500, 60000, 62000, ++ 64000, 66000, 68000, 70000, 71500, 73500, 75000, 77000, 78500, 80000, ++ 82000, 83500, 85000, 87000, 88500, 90000, 92000, 93500, 95000, 97000, ++ 98500, 100000, 102000, 103500, 105000, 107000, 109000, 111000, 113000, ++ 115000, 117000, 118500, 120000, 122000, 123500, 125000, + }; + + /* OMAP4430 data */ +diff --git a/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h b/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h +index a453ff8eb313e..9a3955c3853ba 100644 +--- a/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h ++++ b/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h +@@ -53,9 +53,13 @@ + * and thresholds for OMAP4430. + */ + +-/* ADC conversion table limits */ +-#define OMAP4430_ADC_START_VALUE 0 +-#define OMAP4430_ADC_END_VALUE 127 ++/* ++ * ADC conversion table limits. Ignore values outside the TRM listed ++ * range to avoid bogus thermal shutdowns. See omap4430 TRM chapter ++ * "18.4.10.2.3 ADC Codes Versus Temperature". ++ */ ++#define OMAP4430_ADC_START_VALUE 13 ++#define OMAP4430_ADC_END_VALUE 107 + /* bandgap clock limits (no control on 4430) */ + #define OMAP4430_MAX_FREQ 32768 + #define OMAP4430_MIN_FREQ 32768 +-- +2.25.1 + diff --git a/queue-5.8/x86-fakenuma-fix-invalid-starting-node-id.patch b/queue-5.8/x86-fakenuma-fix-invalid-starting-node-id.patch new file mode 100644 index 00000000000..e1e2813169b --- /dev/null +++ b/queue-5.8/x86-fakenuma-fix-invalid-starting-node-id.patch @@ -0,0 +1,74 @@ +From 83957ef8ea7d0707a0950ff99645a70f76904ef3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Sep 2020 14:10:47 +0800 +Subject: x86, fakenuma: Fix invalid starting node ID + +From: Huang Ying + +[ Upstream commit ccae0f36d500aef727f98acd8d0601e6b262a513 ] + +Commit: + + cc9aec03e58f ("x86/numa_emulation: Introduce uniform split capability") + +uses "-1" as the starting node ID, which causes the strange kernel log as +follows, when "numa=fake=32G" is added to the kernel command line: + + Faking node -1 at [mem 0x0000000000000000-0x0000000893ffffff] (35136MB) + Faking node 0 at [mem 0x0000001840000000-0x000000203fffffff] (32768MB) + Faking node 1 at [mem 0x0000000894000000-0x000000183fffffff] (64192MB) + Faking node 2 at [mem 0x0000002040000000-0x000000283fffffff] (32768MB) + Faking node 3 at [mem 0x0000002840000000-0x000000303fffffff] (32768MB) + +And finally the kernel crashes: + + BUG: Bad page state in process swapper pfn:00011 + page:(____ptrval____) refcount:0 mapcount:1 mapping:(____ptrval____) index:0x55cd7e44b270 pfn:0x11 + failed to read mapping contents, not a valid kernel address? + flags: 0x5(locked|uptodate) + raw: 0000000000000005 000055cd7e44af30 000055cd7e44af50 0000000100000006 + raw: 000055cd7e44b270 000055cd7e44b290 0000000000000000 000055cd7e44b510 + page dumped because: page still charged to cgroup + page->mem_cgroup:000055cd7e44b510 + Modules linked in: + CPU: 0 PID: 0 Comm: swapper Not tainted 5.9.0-rc2 #1 + Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 + Call Trace: + dump_stack+0x57/0x80 + bad_page.cold+0x63/0x94 + __free_pages_ok+0x33f/0x360 + memblock_free_all+0x127/0x195 + mem_init+0x23/0x1f5 + start_kernel+0x219/0x4f5 + secondary_startup_64+0xb6/0xc0 + +Fix this bug via using 0 as the starting node ID. This restores the +original behavior before cc9aec03e58f. + +[ mingo: Massaged the changelog. ] + +Fixes: cc9aec03e58f ("x86/numa_emulation: Introduce uniform split capability") +Signed-off-by: "Huang, Ying" +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20200904061047.612950-1-ying.huang@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/mm/numa_emulation.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/mm/numa_emulation.c b/arch/x86/mm/numa_emulation.c +index c5174b4e318b4..683cd12f47938 100644 +--- a/arch/x86/mm/numa_emulation.c ++++ b/arch/x86/mm/numa_emulation.c +@@ -321,7 +321,7 @@ static int __init split_nodes_size_interleave(struct numa_meminfo *ei, + u64 addr, u64 max_addr, u64 size) + { + return split_nodes_size_interleave_uniform(ei, pi, addr, max_addr, size, +- 0, NULL, NUMA_NO_NODE); ++ 0, NULL, 0); + } + + static int __init setup_emu2phys_nid(int *dfl_phys_nid) +-- +2.25.1 + diff --git a/queue-5.8/x86-mm-32-bring-back-vmalloc-faulting-on-x86_32.patch b/queue-5.8/x86-mm-32-bring-back-vmalloc-faulting-on-x86_32.patch new file mode 100644 index 00000000000..00944cb8b2d --- /dev/null +++ b/queue-5.8/x86-mm-32-bring-back-vmalloc-faulting-on-x86_32.patch @@ -0,0 +1,171 @@ +From 57ea7c6c5051ca62883a775bd4c44264987ee3a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 17:59:04 +0200 +Subject: x86/mm/32: Bring back vmalloc faulting on x86_32 + +From: Joerg Roedel + +[ Upstream commit 4819e15f740ec884a50bdc431d7f1e7638b6f7d9 ] + +One can not simply remove vmalloc faulting on x86-32. Upstream + + commit: 7f0a002b5a21 ("x86/mm: remove vmalloc faulting") + +removed it on x86 alltogether because previously the +arch_sync_kernel_mappings() interface was introduced. This interface +added synchronization of vmalloc/ioremap page-table updates to all +page-tables in the system at creation time and was thought to make +vmalloc faulting obsolete. + +But that assumption was incredibly naive. + +It turned out that there is a race window between the time the vmalloc +or ioremap code establishes a mapping and the time it synchronizes +this change to other page-tables in the system. + +During this race window another CPU or thread can establish a vmalloc +mapping which uses the same intermediate page-table entries (e.g. PMD +or PUD) and does no synchronization in the end, because it found all +necessary mappings already present in the kernel reference page-table. + +But when these intermediate page-table entries are not yet +synchronized, the other CPU or thread will continue with a vmalloc +address that is not yet mapped in the page-table it currently uses, +causing an unhandled page fault and oops like below: + + BUG: unable to handle page fault for address: fe80c000 + #PF: supervisor write access in kernel mode + #PF: error_code(0x0002) - not-present page + *pde = 33183067 *pte = a8648163 + Oops: 0002 [#1] SMP + CPU: 1 PID: 13514 Comm: cve-2017-17053 Tainted: G + ... + Call Trace: + ldt_dup_context+0x66/0x80 + dup_mm+0x2b3/0x480 + copy_process+0x133b/0x15c0 + _do_fork+0x94/0x3e0 + __ia32_sys_clone+0x67/0x80 + __do_fast_syscall_32+0x3f/0x70 + do_fast_syscall_32+0x29/0x60 + do_SYSENTER_32+0x15/0x20 + entry_SYSENTER_32+0x9f/0xf2 + EIP: 0xb7eef549 + +So the arch_sync_kernel_mappings() interface is racy, but removing it +would mean to re-introduce the vmalloc_sync_all() interface, which is +even more awful. Keep arch_sync_kernel_mappings() in place and catch +the race condition in the page-fault handler instead. + +Do a partial revert of above commit to get vmalloc faulting on x86-32 +back in place. + +Fixes: 7f0a002b5a21 ("x86/mm: remove vmalloc faulting") +Reported-by: Naresh Kamboju +Signed-off-by: Joerg Roedel +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20200902155904.17544-1-joro@8bytes.org +Signed-off-by: Sasha Levin +--- + arch/x86/mm/fault.c | 78 +++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 78 insertions(+) + +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index 1ead568c01012..7cf290701a7c6 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -191,6 +191,53 @@ static inline pmd_t *vmalloc_sync_one(pgd_t *pgd, unsigned long address) + return pmd_k; + } + ++/* ++ * Handle a fault on the vmalloc or module mapping area ++ * ++ * This is needed because there is a race condition between the time ++ * when the vmalloc mapping code updates the PMD to the point in time ++ * where it synchronizes this update with the other page-tables in the ++ * system. ++ * ++ * In this race window another thread/CPU can map an area on the same ++ * PMD, finds it already present and does not synchronize it with the ++ * rest of the system yet. As a result v[mz]alloc might return areas ++ * which are not mapped in every page-table in the system, causing an ++ * unhandled page-fault when they are accessed. ++ */ ++static noinline int vmalloc_fault(unsigned long address) ++{ ++ unsigned long pgd_paddr; ++ pmd_t *pmd_k; ++ pte_t *pte_k; ++ ++ /* Make sure we are in vmalloc area: */ ++ if (!(address >= VMALLOC_START && address < VMALLOC_END)) ++ return -1; ++ ++ /* ++ * Synchronize this task's top level page-table ++ * with the 'reference' page table. ++ * ++ * Do _not_ use "current" here. We might be inside ++ * an interrupt in the middle of a task switch.. ++ */ ++ pgd_paddr = read_cr3_pa(); ++ pmd_k = vmalloc_sync_one(__va(pgd_paddr), address); ++ if (!pmd_k) ++ return -1; ++ ++ if (pmd_large(*pmd_k)) ++ return 0; ++ ++ pte_k = pte_offset_kernel(pmd_k, address); ++ if (!pte_present(*pte_k)) ++ return -1; ++ ++ return 0; ++} ++NOKPROBE_SYMBOL(vmalloc_fault); ++ + void arch_sync_kernel_mappings(unsigned long start, unsigned long end) + { + unsigned long addr; +@@ -1111,6 +1158,37 @@ do_kern_addr_fault(struct pt_regs *regs, unsigned long hw_error_code, + */ + WARN_ON_ONCE(hw_error_code & X86_PF_PK); + ++#ifdef CONFIG_X86_32 ++ /* ++ * We can fault-in kernel-space virtual memory on-demand. The ++ * 'reference' page table is init_mm.pgd. ++ * ++ * NOTE! We MUST NOT take any locks for this case. We may ++ * be in an interrupt or a critical region, and should ++ * only copy the information from the master page table, ++ * nothing more. ++ * ++ * Before doing this on-demand faulting, ensure that the ++ * fault is not any of the following: ++ * 1. A fault on a PTE with a reserved bit set. ++ * 2. A fault caused by a user-mode access. (Do not demand- ++ * fault kernel memory due to user-mode accesses). ++ * 3. A fault caused by a page-level protection violation. ++ * (A demand fault would be on a non-present page which ++ * would have X86_PF_PROT==0). ++ * ++ * This is only needed to close a race condition on x86-32 in ++ * the vmalloc mapping/unmapping code. See the comment above ++ * vmalloc_fault() for details. On x86-64 the race does not ++ * exist as the vmalloc mappings don't need to be synchronized ++ * there. ++ */ ++ if (!(hw_error_code & (X86_PF_RSVD | X86_PF_USER | X86_PF_PROT))) { ++ if (vmalloc_fault(address) >= 0) ++ return; ++ } ++#endif ++ + /* Was the fault spurious, caused by lazy TLB invalidation? */ + if (spurious_kernel_fault(hw_error_code, address)) + return; +-- +2.25.1 + diff --git a/queue-5.8/xfs-finish-dfops-on-every-insert-range-shift-iterati.patch b/queue-5.8/xfs-finish-dfops-on-every-insert-range-shift-iterati.patch new file mode 100644 index 00000000000..073248031a3 --- /dev/null +++ b/queue-5.8/xfs-finish-dfops-on-every-insert-range-shift-iterati.patch @@ -0,0 +1,46 @@ +From 8746bd2ff086432e026b92647ee1e3eaf9d69a79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 08:05:58 -0700 +Subject: xfs: finish dfops on every insert range shift iteration + +From: Brian Foster + +[ Upstream commit 9c516e0e4554e8f26ab73d46cbc789d7d8db664d ] + +The recent change to make insert range an atomic operation used the +incorrect transaction rolling mechanism. The explicit transaction +roll does not finish deferred operations. This means that intents +for rmapbt updates caused by extent shifts are not logged until the +final transaction commits. Thus if a crash occurs during an insert +range, log recovery might leave the rmapbt in an inconsistent state. +This was discovered by repeated runs of generic/455. + +Update insert range to finish dfops on every shift iteration. This +is similar to collapse range and ensures that intents are logged +with the transactions that make associated changes. + +Fixes: dd87f87d87fa ("xfs: rework insert range into an atomic operation") +Signed-off-by: Brian Foster +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Sasha Levin +--- + fs/xfs/xfs_bmap_util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c +index afdc7f8e0e701..feb277874a1fb 100644 +--- a/fs/xfs/xfs_bmap_util.c ++++ b/fs/xfs/xfs_bmap_util.c +@@ -1165,7 +1165,7 @@ xfs_insert_file_space( + goto out_trans_cancel; + + do { +- error = xfs_trans_roll_inode(&tp, ip); ++ error = xfs_defer_finish(&tp); + if (error) + goto out_trans_cancel; + +-- +2.25.1 + diff --git a/queue-5.8/xfs-fix-boundary-test-in-xfs_attr_shortform_verify.patch b/queue-5.8/xfs-fix-boundary-test-in-xfs_attr_shortform_verify.patch new file mode 100644 index 00000000000..b1723e99693 --- /dev/null +++ b/queue-5.8/xfs-fix-boundary-test-in-xfs_attr_shortform_verify.patch @@ -0,0 +1,54 @@ +From a56c1515a12ba99a057d720a7feec23d2d2f00f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 14:11:58 -0700 +Subject: xfs: fix boundary test in xfs_attr_shortform_verify + +From: Eric Sandeen + +[ Upstream commit f4020438fab05364018c91f7e02ebdd192085933 ] + +The boundary test for the fixed-offset parts of xfs_attr_sf_entry in +xfs_attr_shortform_verify is off by one, because the variable array +at the end is defined as nameval[1] not nameval[]. +Hence we need to subtract 1 from the calculation. + +This can be shown by: + +# touch file +# setfattr -n root.a file + +and verifications will fail when it's written to disk. + +This only matters for a last attribute which has a single-byte name +and no value, otherwise the combination of namelen & valuelen will +push endp further out and this test won't fail. + +Fixes: 1e1bbd8e7ee06 ("xfs: create structure verifier function for shortform xattrs") +Signed-off-by: Eric Sandeen +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Reviewed-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/xfs/libxfs/xfs_attr_leaf.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c +index 2f7e89e4be3e3..4eb2ecd31b0d2 100644 +--- a/fs/xfs/libxfs/xfs_attr_leaf.c ++++ b/fs/xfs/libxfs/xfs_attr_leaf.c +@@ -996,8 +996,10 @@ xfs_attr_shortform_verify( + * struct xfs_attr_sf_entry has a variable length. + * Check the fixed-offset parts of the structure are + * within the data buffer. ++ * xfs_attr_sf_entry is defined with a 1-byte variable ++ * array at the end, so we must subtract that off. + */ +- if (((char *)sfep + sizeof(*sfep)) >= endp) ++ if (((char *)sfep + sizeof(*sfep) - 1) >= endp) + return __this_address; + + /* Don't allow names with known bad length. */ +-- +2.25.1 + diff --git a/queue-5.8/xfs-fix-xfs_bmap_validate_extent_raw-when-checking-a.patch b/queue-5.8/xfs-fix-xfs_bmap_validate_extent_raw-when-checking-a.patch new file mode 100644 index 00000000000..7d762950e16 --- /dev/null +++ b/queue-5.8/xfs-fix-xfs_bmap_validate_extent_raw-when-checking-a.patch @@ -0,0 +1,37 @@ +From c3ba2f112573f9de234ff1738905ba6428c9e62a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 10:47:02 -0700 +Subject: xfs: fix xfs_bmap_validate_extent_raw when checking attr fork of rt + files + +From: Darrick J. Wong + +[ Upstream commit d0c20d38af135b2b4b90aa59df7878ef0c8fbef4 ] + +The realtime flag only applies to the data fork, so don't use the +realtime block number checks on the attr fork of a realtime file. + +Fixes: 30b0984d9117 ("xfs: refactor bmap record validation") +Signed-off-by: Darrick J. Wong +Reviewed-by: Eric Sandeen +Signed-off-by: Sasha Levin +--- + fs/xfs/libxfs/xfs_bmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c +index 667cdd0dfdf4a..aa784404964a0 100644 +--- a/fs/xfs/libxfs/xfs_bmap.c ++++ b/fs/xfs/libxfs/xfs_bmap.c +@@ -6222,7 +6222,7 @@ xfs_bmap_validate_extent( + + isrt = XFS_IS_REALTIME_INODE(ip); + endfsb = irec->br_startblock + irec->br_blockcount - 1; +- if (isrt) { ++ if (isrt && whichfork == XFS_DATA_FORK) { + if (!xfs_verify_rtbno(mp, irec->br_startblock)) + return __this_address; + if (!xfs_verify_rtbno(mp, endfsb)) +-- +2.25.1 +