From: Sasha Levin Date: Mon, 30 May 2022 04:25:50 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v4.9.317~44^2~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5139306d0c24b30fb06d63b571ca5f4a46836fb2;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/drivers-i2c-thunderx-allow-driver-to-work-with-acpi-.patch b/queue-5.10/drivers-i2c-thunderx-allow-driver-to-work-with-acpi-.patch new file mode 100644 index 00000000000..4ea9b62f286 --- /dev/null +++ b/queue-5.10/drivers-i2c-thunderx-allow-driver-to-work-with-acpi-.patch @@ -0,0 +1,36 @@ +From 46e3e2ac284c745a7996803579b4bdbf4b424e83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 06:36:59 -0700 +Subject: drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI + controllers + +From: Piyush Malgujar + +[ Upstream commit 03a35bc856ddc09f2cc1f4701adecfbf3b464cb3 ] + +Due to i2c->adap.dev.fwnode not being set, ACPI_COMPANION() wasn't properly +found for TWSI controllers. + +Signed-off-by: Szymon Balcerak +Signed-off-by: Piyush Malgujar +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-thunderx-pcidrv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-thunderx-pcidrv.c b/drivers/i2c/busses/i2c-thunderx-pcidrv.c +index 12c90aa0900e..a77cd86fe75e 100644 +--- a/drivers/i2c/busses/i2c-thunderx-pcidrv.c ++++ b/drivers/i2c/busses/i2c-thunderx-pcidrv.c +@@ -213,6 +213,7 @@ static int thunder_i2c_probe_pci(struct pci_dev *pdev, + i2c->adap.bus_recovery_info = &octeon_i2c_recovery_info; + i2c->adap.dev.parent = dev; + i2c->adap.dev.of_node = pdev->dev.of_node; ++ i2c->adap.dev.fwnode = dev->fwnode; + snprintf(i2c->adap.name, sizeof(i2c->adap.name), + "Cavium ThunderX i2c adapter at %s", dev_name(dev)); + i2c_set_adapdata(&i2c->adap, i2c); +-- +2.35.1 + diff --git a/queue-5.10/i2c-ismt-provide-a-dma-buffer-for-interrupt-cause-lo.patch b/queue-5.10/i2c-ismt-provide-a-dma-buffer-for-interrupt-cause-lo.patch new file mode 100644 index 00000000000..d6b04a9762c --- /dev/null +++ b/queue-5.10/i2c-ismt-provide-a-dma-buffer-for-interrupt-cause-lo.patch @@ -0,0 +1,88 @@ +From 2e5ab9529286fd6b9ce61d6529d0d3552fab3aa3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 13:19:10 +0300 +Subject: i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging + +From: Mika Westerberg + +[ Upstream commit 17a0f3acdc6ec8b89ad40f6e22165a4beee25663 ] + +Before sending a MSI the hardware writes information pertinent to the +interrupt cause to a memory location pointed by SMTICL register. This +memory holds three double words where the least significant bit tells +whether the interrupt cause of master/target/error is valid. The driver +does not use this but we need to set it up because otherwise it will +perform DMA write to the default address (0) and this will cause an +IOMMU fault such as below: + + DMAR: DRHD: handling fault status reg 2 + DMAR: [DMA Write] Request device [00:12.0] PASID ffffffff fault addr 0 + [fault reason 05] PTE Write access is not set + +To prevent this from happening, provide a proper DMA buffer for this +that then gets mapped by the IOMMU accordingly. + +Signed-off-by: Mika Westerberg +Reviewed-by: From: Andy Shevchenko +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-ismt.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c +index a35a27c320e7..3d2d92640651 100644 +--- a/drivers/i2c/busses/i2c-ismt.c ++++ b/drivers/i2c/busses/i2c-ismt.c +@@ -82,6 +82,7 @@ + + #define ISMT_DESC_ENTRIES 2 /* number of descriptor entries */ + #define ISMT_MAX_RETRIES 3 /* number of SMBus retries to attempt */ ++#define ISMT_LOG_ENTRIES 3 /* number of interrupt cause log entries */ + + /* Hardware Descriptor Constants - Control Field */ + #define ISMT_DESC_CWRL 0x01 /* Command/Write Length */ +@@ -175,6 +176,8 @@ struct ismt_priv { + u8 head; /* ring buffer head pointer */ + struct completion cmp; /* interrupt completion */ + u8 buffer[I2C_SMBUS_BLOCK_MAX + 16]; /* temp R/W data buffer */ ++ dma_addr_t log_dma; ++ u32 *log; + }; + + static const struct pci_device_id ismt_ids[] = { +@@ -409,6 +412,9 @@ static int ismt_access(struct i2c_adapter *adap, u16 addr, + memset(desc, 0, sizeof(struct ismt_desc)); + desc->tgtaddr_rw = ISMT_DESC_ADDR_RW(addr, read_write); + ++ /* Always clear the log entries */ ++ memset(priv->log, 0, ISMT_LOG_ENTRIES * sizeof(u32)); ++ + /* Initialize common control bits */ + if (likely(pci_dev_msi_enabled(priv->pci_dev))) + desc->control = ISMT_DESC_INT | ISMT_DESC_FAIR; +@@ -693,6 +699,8 @@ static void ismt_hw_init(struct ismt_priv *priv) + /* initialize the Master Descriptor Base Address (MDBA) */ + writeq(priv->io_rng_dma, priv->smba + ISMT_MSTR_MDBA); + ++ writeq(priv->log_dma, priv->smba + ISMT_GR_SMTICL); ++ + /* initialize the Master Control Register (MCTRL) */ + writel(ISMT_MCTRL_MEIE, priv->smba + ISMT_MSTR_MCTRL); + +@@ -780,6 +788,12 @@ static int ismt_dev_init(struct ismt_priv *priv) + priv->head = 0; + init_completion(&priv->cmp); + ++ priv->log = dmam_alloc_coherent(&priv->pci_dev->dev, ++ ISMT_LOG_ENTRIES * sizeof(u32), ++ &priv->log_dma, GFP_KERNEL); ++ if (!priv->log) ++ return -ENOMEM; ++ + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.10/net-af_key-check-encryption-module-availability-cons.patch b/queue-5.10/net-af_key-check-encryption-module-availability-cons.patch new file mode 100644 index 00000000000..ff7bf329454 --- /dev/null +++ b/queue-5.10/net-af_key-check-encryption-module-availability-cons.patch @@ -0,0 +1,55 @@ +From 2ef722ad96bb48fe4865c8ea3840ca9b0209427c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 08:32:18 +0200 +Subject: net: af_key: check encryption module availability consistency + +From: Thomas Bartschies + +[ Upstream commit 015c44d7bff3f44d569716117becd570c179ca32 ] + +Since the recent introduction supporting the SM3 and SM4 hash algos for IPsec, the kernel +produces invalid pfkey acquire messages, when these encryption modules are disabled. This +happens because the availability of the algos wasn't checked in all necessary functions. +This patch adds these checks. + +Signed-off-by: Thomas Bartschies +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/key/af_key.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/key/af_key.c b/net/key/af_key.c +index 61505b0df57d..6b7ed5568c09 100644 +--- a/net/key/af_key.c ++++ b/net/key/af_key.c +@@ -2904,7 +2904,7 @@ static int count_ah_combs(const struct xfrm_tmpl *t) + break; + if (!aalg->pfkey_supported) + continue; +- if (aalg_tmpl_set(t, aalg)) ++ if (aalg_tmpl_set(t, aalg) && aalg->available) + sz += sizeof(struct sadb_comb); + } + return sz + sizeof(struct sadb_prop); +@@ -2922,7 +2922,7 @@ static int count_esp_combs(const struct xfrm_tmpl *t) + if (!ealg->pfkey_supported) + continue; + +- if (!(ealg_tmpl_set(t, ealg))) ++ if (!(ealg_tmpl_set(t, ealg) && ealg->available)) + continue; + + for (k = 1; ; k++) { +@@ -2933,7 +2933,7 @@ static int count_esp_combs(const struct xfrm_tmpl *t) + if (!aalg->pfkey_supported) + continue; + +- if (aalg_tmpl_set(t, aalg)) ++ if (aalg_tmpl_set(t, aalg) && aalg->available) + sz += sizeof(struct sadb_comb); + } + } +-- +2.35.1 + diff --git a/queue-5.10/net-ftgmac100-disable-hardware-checksum-on-ast2600.patch b/queue-5.10/net-ftgmac100-disable-hardware-checksum-on-ast2600.patch new file mode 100644 index 00000000000..58355b93ad1 --- /dev/null +++ b/queue-5.10/net-ftgmac100-disable-hardware-checksum-on-ast2600.patch @@ -0,0 +1,92 @@ +From 78b9231c8b7650fbf76c159a6e99ec21dd571044 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 May 2022 18:52:17 +0930 +Subject: net: ftgmac100: Disable hardware checksum on AST2600 + +From: Joel Stanley + +[ Upstream commit 6fd45e79e8b93b8d22fb8fe22c32fbad7e9190bd ] + +The AST2600 when using the i210 NIC over NC-SI has been observed to +produce incorrect checksum results with specific MTU values. This was +first observed when sending data across a long distance set of networks. + +On a local network, the following test was performed using a 1MB file of +random data. + +On the receiver run this script: + + #!/bin/bash + while [ 1 ]; do + # Zero the stats + nstat -r > /dev/null + nc -l 9899 > test-file + # Check for checksum errors + TcpInCsumErrors=$(nstat | grep TcpInCsumErrors) + if [ -z "$TcpInCsumErrors" ]; then + echo No TcpInCsumErrors + else + echo TcpInCsumErrors = $TcpInCsumErrors + fi + done + +On an AST2600 system: + + # nc 9899 < test-file + +The test was repeated with various MTU values: + + # ip link set mtu 1410 dev eth0 + +The observed results: + + 1500 - good + 1434 - bad + 1400 - good + 1410 - bad + 1420 - good + +The test was repeated after disabling tx checksumming: + + # ethtool -K eth0 tx-checksumming off + +And all MTU values tested resulted in transfers without error. + +An issue with the driver cannot be ruled out, however there has been no +bug discovered so far. + +David has done the work to take the original bug report of slow data +transfer between long distance connections and triaged it down to this +test case. + +The vendor suspects this this is a hardware issue when using NC-SI. The +fixes line refers to the patch that introduced AST2600 support. + +Reported-by: David Wilder +Reviewed-by: Dylan Hung +Signed-off-by: Joel Stanley +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/faraday/ftgmac100.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c +index 5bc11d1bb9df..eea4bd3116e8 100644 +--- a/drivers/net/ethernet/faraday/ftgmac100.c ++++ b/drivers/net/ethernet/faraday/ftgmac100.c +@@ -1893,6 +1893,11 @@ static int ftgmac100_probe(struct platform_device *pdev) + /* AST2400 doesn't have working HW checksum generation */ + if (np && (of_device_is_compatible(np, "aspeed,ast2400-mac"))) + netdev->hw_features &= ~NETIF_F_HW_CSUM; ++ ++ /* AST2600 tx checksum with NCSI is broken */ ++ if (priv->use_ncsi && of_device_is_compatible(np, "aspeed,ast2600-mac")) ++ netdev->hw_features &= ~NETIF_F_HW_CSUM; ++ + if (np && of_get_property(np, "no-hw-checksum", NULL)) + netdev->hw_features &= ~(NETIF_F_HW_CSUM | NETIF_F_RXCSUM); + netdev->features |= netdev->hw_features; +-- +2.35.1 + diff --git a/queue-5.10/nfc-pn533-fix-buggy-cleanup-order.patch b/queue-5.10/nfc-pn533-fix-buggy-cleanup-order.patch new file mode 100644 index 00000000000..e8f3d192561 --- /dev/null +++ b/queue-5.10/nfc-pn533-fix-buggy-cleanup-order.patch @@ -0,0 +1,66 @@ +From e1c4c593a312ebd540f906fb73422e364eb3682b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 18:53:21 +0800 +Subject: nfc: pn533: Fix buggy cleanup order + +From: Lin Ma + +[ Upstream commit b8cedb7093b2d1394cae9b86494cba4b62d3a30a ] + +When removing the pn533 device (i2c or USB), there is a logic error. The +original code first cancels the worker (flush_delayed_work) and then +destroys the workqueue (destroy_workqueue), leaving the timer the last +one to be deleted (del_timer). This result in a possible race condition +in a multi-core preempt-able kernel. That is, if the cleanup +(pn53x_common_clean) is concurrently run with the timer handler +(pn533_listen_mode_timer), the timer can queue the poll_work to the +already destroyed workqueue, causing use-after-free. + +This patch reorder the cleanup: it uses the del_timer_sync to make sure +the handler is finished before the routine will destroy the workqueue. +Note that the timer cannot be activated by the worker again. + +static void pn533_wq_poll(struct work_struct *work) +... + rc = pn533_send_poll_frame(dev); + if (rc) + return; + + if (cur_mod->len == 0 && dev->poll_mod_count > 1) + mod_timer(&dev->listen_timer, ...); + +That is, the mod_timer can be called only when pn533_send_poll_frame() +returns no error, which is impossible because the device is detaching +and the lower driver should return ENODEV code. + +Signed-off-by: Lin Ma +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/nfc/pn533/pn533.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c +index d2c011615775..8d7e29d953b7 100644 +--- a/drivers/nfc/pn533/pn533.c ++++ b/drivers/nfc/pn533/pn533.c +@@ -2844,13 +2844,14 @@ void pn53x_common_clean(struct pn533 *priv) + { + struct pn533_cmd *cmd, *n; + ++ /* delete the timer before cleanup the worker */ ++ del_timer_sync(&priv->listen_timer); ++ + flush_delayed_work(&priv->poll_work); + destroy_workqueue(priv->wq); + + skb_queue_purge(&priv->resp_q); + +- del_timer(&priv->listen_timer); +- + list_for_each_entry_safe(cmd, n, &priv->cmd_queue, queue) { + list_del(&cmd->queue); + kfree(cmd); +-- +2.35.1 + diff --git a/queue-5.10/percpu_ref_init-clean-percpu_count_ref-on-failure.patch b/queue-5.10/percpu_ref_init-clean-percpu_count_ref-on-failure.patch new file mode 100644 index 00000000000..6dde194f3b2 --- /dev/null +++ b/queue-5.10/percpu_ref_init-clean-percpu_count_ref-on-failure.patch @@ -0,0 +1,41 @@ +From b2a6e8417f2c2da36a58ac1e0ff0f020d84ea1a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 02:13:40 -0400 +Subject: percpu_ref_init(): clean ->percpu_count_ref on failure + +From: Al Viro + +[ Upstream commit a91714312eb16f9ecd1f7f8b3efe1380075f28d4 ] + +That way percpu_ref_exit() is safe after failing percpu_ref_init(). +At least one user (cgroup_create()) had a double-free that way; +there might be other similar bugs. Easier to fix in percpu_ref_init(), +rather than playing whack-a-mole in sloppy users... + +Usual symptoms look like a messed refcounting in one of subsystems +that use percpu allocations (might be percpu-refcount, might be +something else). Having refcounts for two different objects share +memory is Not Nice(tm)... + +Reported-by: syzbot+5b1e53987f858500ec00@syzkaller.appspotmail.com +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + lib/percpu-refcount.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/lib/percpu-refcount.c b/lib/percpu-refcount.c +index e59eda07305e..493093b97093 100644 +--- a/lib/percpu-refcount.c ++++ b/lib/percpu-refcount.c +@@ -75,6 +75,7 @@ int percpu_ref_init(struct percpu_ref *ref, percpu_ref_func_t *release, + data = kzalloc(sizeof(*ref->data), gfp); + if (!data) { + free_percpu((void __percpu *)ref->percpu_count_ptr); ++ ref->percpu_count_ptr = 0; + return -ENOMEM; + } + +-- +2.35.1 + diff --git a/queue-5.10/pinctrl-sunxi-fix-f1c100s-uart2-function.patch b/queue-5.10/pinctrl-sunxi-fix-f1c100s-uart2-function.patch new file mode 100644 index 00000000000..edd61e0021d --- /dev/null +++ b/queue-5.10/pinctrl-sunxi-fix-f1c100s-uart2-function.patch @@ -0,0 +1,45 @@ +From 3be88b135f2290d42352e2bad86f540688c1f945 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 19:59:04 +0800 +Subject: pinctrl: sunxi: fix f1c100s uart2 function + +From: IotaHydrae + +[ Upstream commit fa8785e5931367e2b43f2c507f26bcf3e281c0ca ] + +Change suniv f1c100s pinctrl,PD14 multiplexing function lvds1 to uart2 + +When the pin PD13 and PD14 is setting up to uart2 function in dts, +there's an error occurred: +1c20800.pinctrl: unsupported function uart2 on pin PD14 + +Because 'uart2' is not any one multiplexing option of PD14, +and pinctrl don't know how to configure it. + +So change the pin PD14 lvds1 function to uart2. + +Signed-off-by: IotaHydrae +Reviewed-by: Andre Przywara +Link: https://lore.kernel.org/r/tencent_70C1308DDA794C81CAEF389049055BACEC09@qq.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sunxi/pinctrl-suniv-f1c100s.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/sunxi/pinctrl-suniv-f1c100s.c b/drivers/pinctrl/sunxi/pinctrl-suniv-f1c100s.c +index 2801ca706273..68a5b627fb9b 100644 +--- a/drivers/pinctrl/sunxi/pinctrl-suniv-f1c100s.c ++++ b/drivers/pinctrl/sunxi/pinctrl-suniv-f1c100s.c +@@ -204,7 +204,7 @@ static const struct sunxi_desc_pin suniv_f1c100s_pins[] = { + SUNXI_FUNCTION(0x0, "gpio_in"), + SUNXI_FUNCTION(0x1, "gpio_out"), + SUNXI_FUNCTION(0x2, "lcd"), /* D20 */ +- SUNXI_FUNCTION(0x3, "lvds1"), /* RX */ ++ SUNXI_FUNCTION(0x3, "uart2"), /* RX */ + SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 14)), + SUNXI_PIN(SUNXI_PINCTRL_PIN(D, 15), + SUNXI_FUNCTION(0x0, "gpio_in"), +-- +2.35.1 + diff --git a/queue-5.10/series b/queue-5.10/series index 9293d2b2811..280b8c38cac 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -161,3 +161,10 @@ random-convert-to-using-fops-write_iter.patch random-wire-up-fops-splice_-read-write-_iter.patch random-check-for-signals-after-page-of-pool-writes.patch alsa-ctxfi-add-sb046x-pci-id.patch +pinctrl-sunxi-fix-f1c100s-uart2-function.patch +percpu_ref_init-clean-percpu_count_ref-on-failure.patch +net-af_key-check-encryption-module-availability-cons.patch +nfc-pn533-fix-buggy-cleanup-order.patch +net-ftgmac100-disable-hardware-checksum-on-ast2600.patch +i2c-ismt-provide-a-dma-buffer-for-interrupt-cause-lo.patch +drivers-i2c-thunderx-allow-driver-to-work-with-acpi-.patch