From: Sasha Levin Date: Mon, 15 Feb 2021 04:28:15 +0000 (-0500) Subject: Fixes for 5.10 X-Git-Tag: v5.4.99~30 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=52894c0e4cf0b81c5326dd228d06c21496ea370e;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/ath9k-fix-build-error-with-leds_class-m.patch b/queue-5.10/ath9k-fix-build-error-with-leds_class-m.patch new file mode 100644 index 00000000000..9f35d546abe --- /dev/null +++ b/queue-5.10/ath9k-fix-build-error-with-leds_class-m.patch @@ -0,0 +1,86 @@ +From c834d4e992dbbb63e7bcf5804367b0dafdd4c33e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Jan 2021 12:36:42 +0100 +Subject: ath9k: fix build error with LEDS_CLASS=m + +From: Arnd Bergmann + +[ Upstream commit b64acb28da8394485f0762e657470c9fc33aca4d ] + +When CONFIG_ATH9K is built-in but LED support is in a loadable +module, both ath9k drivers fails to link: + +x86_64-linux-ld: drivers/net/wireless/ath/ath9k/gpio.o: in function `ath_deinit_leds': +gpio.c:(.text+0x36): undefined reference to `led_classdev_unregister' +x86_64-linux-ld: drivers/net/wireless/ath/ath9k/gpio.o: in function `ath_init_leds': +gpio.c:(.text+0x179): undefined reference to `led_classdev_register_ext' + +The problem is that the 'imply' keyword does not enforce any dependency +but is only a weak hint to Kconfig to enable another symbol from a +defconfig file. + +Change imply to a 'depends on LEDS_CLASS' that prevents the incorrect +configuration but still allows building the driver without LED support. + +The 'select MAC80211_LEDS' is now ensures that the LED support is +actually used if it is present, and the added Kconfig dependency +on MAC80211_LEDS ensures that it cannot be enabled manually when it +has no effect. + +Fixes: 197f466e93f5 ("ath9k_htc: Do not select MAC80211_LEDS by default") +Signed-off-by: Arnd Bergmann +Acked-by: Johannes Berg +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210125113654.2408057-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/Kconfig | 8 ++------ + net/mac80211/Kconfig | 2 +- + 2 files changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig +index a84bb9b6573f8..e150d82eddb6c 100644 +--- a/drivers/net/wireless/ath/ath9k/Kconfig ++++ b/drivers/net/wireless/ath/ath9k/Kconfig +@@ -21,11 +21,9 @@ config ATH9K_BTCOEX_SUPPORT + config ATH9K + tristate "Atheros 802.11n wireless cards support" + depends on MAC80211 && HAS_DMA ++ select MAC80211_LEDS if LEDS_CLASS=y || LEDS_CLASS=MAC80211 + select ATH9K_HW + select ATH9K_COMMON +- imply NEW_LEDS +- imply LEDS_CLASS +- imply MAC80211_LEDS + help + This module adds support for wireless adapters based on + Atheros IEEE 802.11n AR5008, AR9001 and AR9002 family +@@ -176,11 +174,9 @@ config ATH9K_PCI_NO_EEPROM + config ATH9K_HTC + tristate "Atheros HTC based wireless cards support" + depends on USB && MAC80211 ++ select MAC80211_LEDS if LEDS_CLASS=y || LEDS_CLASS=MAC80211 + select ATH9K_HW + select ATH9K_COMMON +- imply NEW_LEDS +- imply LEDS_CLASS +- imply MAC80211_LEDS + help + Support for Atheros HTC based cards. + Chipsets supported: AR9271 +diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig +index cd9a9bd242bab..51ec8256b7fa9 100644 +--- a/net/mac80211/Kconfig ++++ b/net/mac80211/Kconfig +@@ -69,7 +69,7 @@ config MAC80211_MESH + config MAC80211_LEDS + bool "Enable LED triggers" + depends on MAC80211 +- depends on LEDS_CLASS ++ depends on LEDS_CLASS=y || LEDS_CLASS=MAC80211 + select LEDS_TRIGGERS + help + This option enables a few LED triggers for different +-- +2.27.0 + diff --git a/queue-5.10/bpf-check-for-integer-overflow-when-using-roundup_po.patch b/queue-5.10/bpf-check-for-integer-overflow-when-using-roundup_po.patch new file mode 100644 index 00000000000..658d31df52a --- /dev/null +++ b/queue-5.10/bpf-check-for-integer-overflow-when-using-roundup_po.patch @@ -0,0 +1,37 @@ +From edd66be3d1dd913afc07ddf62d2902751083bb1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Jan 2021 06:36:53 +0000 +Subject: bpf: Check for integer overflow when using roundup_pow_of_two() + +From: Bui Quang Minh + +[ Upstream commit 6183f4d3a0a2ad230511987c6c362ca43ec0055f ] + +On 32-bit architecture, roundup_pow_of_two() can return 0 when the argument +has upper most bit set due to resulting 1UL << 32. Add a check for this case. + +Fixes: d5a3b1f69186 ("bpf: introduce BPF_MAP_TYPE_STACK_TRACE") +Signed-off-by: Bui Quang Minh +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20210127063653.3576-1-minhquangbui99@gmail.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/stackmap.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c +index 06065fa271241..6e83bf8c080db 100644 +--- a/kernel/bpf/stackmap.c ++++ b/kernel/bpf/stackmap.c +@@ -116,6 +116,8 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr) + + /* hash table size must be power of 2 */ + n_buckets = roundup_pow_of_two(attr->max_entries); ++ if (!n_buckets) ++ return ERR_PTR(-E2BIG); + + cost = n_buckets * sizeof(struct stack_map_bucket *) + sizeof(*smap); + cost += n_buckets * (value_size + sizeof(struct stack_map_bucket)); +-- +2.27.0 + diff --git a/queue-5.10/bpf-unbreak-bpf_prog_type_kprobe-when-kprobe-is-call.patch b/queue-5.10/bpf-unbreak-bpf_prog_type_kprobe-when-kprobe-is-call.patch new file mode 100644 index 00000000000..1edf6f6ca28 --- /dev/null +++ b/queue-5.10/bpf-unbreak-bpf_prog_type_kprobe-when-kprobe-is-call.patch @@ -0,0 +1,45 @@ +From 2b0e2ff63c4e0f8e445423c46da75d8f367d93cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Feb 2021 23:06:36 -0800 +Subject: bpf: Unbreak BPF_PROG_TYPE_KPROBE when kprobe is called via do_int3 + +From: Alexei Starovoitov + +[ Upstream commit 548f1191d86ccb9bde2a5305988877b7584c01eb ] + +The commit 0d00449c7a28 ("x86: Replace ist_enter() with nmi_enter()") +converted do_int3 handler to be "NMI-like". +That made old if (in_nmi()) check abort execution of bpf programs +attached to kprobe when kprobe is firing via int3 +(For example when kprobe is placed in the middle of the function). +Remove the check to restore user visible behavior. + +Fixes: 0d00449c7a28 ("x86: Replace ist_enter() with nmi_enter()") +Reported-by: Nikolay Borisov +Signed-off-by: Alexei Starovoitov +Signed-off-by: Daniel Borkmann +Tested-by: Nikolay Borisov +Reviewed-by: Masami Hiramatsu +Link: https://lore.kernel.org/bpf/20210203070636.70926-1-alexei.starovoitov@gmail.com +Signed-off-by: Sasha Levin +--- + kernel/trace/bpf_trace.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index 0dde84b9d29fe..fcbfc95649967 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -93,9 +93,6 @@ unsigned int trace_call_bpf(struct trace_event_call *call, void *ctx) + { + unsigned int ret; + +- if (in_nmi()) /* not supported yet */ +- return 1; +- + cant_sleep(); + + if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) { +-- +2.27.0 + diff --git a/queue-5.10/cgroup-v1-add-disabled-controller-check-in-cgroup1_p.patch b/queue-5.10/cgroup-v1-add-disabled-controller-check-in-cgroup1_p.patch new file mode 100644 index 00000000000..e8ee58af2b1 --- /dev/null +++ b/queue-5.10/cgroup-v1-add-disabled-controller-check-in-cgroup1_p.patch @@ -0,0 +1,50 @@ +From af907d76125b1262dee0bfa9259aea75b841f5a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jan 2021 17:37:17 +0800 +Subject: cgroup-v1: add disabled controller check in cgroup1_parse_param() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chen Zhou + +[ Upstream commit 61e960b07b637f0295308ad91268501d744c21b5 ] + +When mounting a cgroup hierarchy with disabled controller in cgroup v1, +all available controllers will be attached. +For example, boot with cgroup_no_v1=cpu or cgroup_disable=cpu, and then +mount with "mount -t cgroup -ocpu cpu /sys/fs/cgroup/cpu", then all +enabled controllers will be attached except cpu. + +Fix this by adding disabled controller check in cgroup1_parse_param(). +If the specified controller is disabled, just return error with information +"Disabled controller xx" rather than attaching all the other enabled +controllers. + +Fixes: f5dfb5315d34 ("cgroup: take options parsing into ->parse_monolithic()") +Signed-off-by: Chen Zhou +Reviewed-by: Zefan Li +Reviewed-by: Michal Koutný +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cgroup-v1.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c +index 32596fdbcd5b8..a5751784ad740 100644 +--- a/kernel/cgroup/cgroup-v1.c ++++ b/kernel/cgroup/cgroup-v1.c +@@ -917,6 +917,9 @@ int cgroup1_parse_param(struct fs_context *fc, struct fs_parameter *param) + for_each_subsys(ss, i) { + if (strcmp(param->key, ss->legacy_name)) + continue; ++ if (!cgroup_ssid_enabled(i) || cgroup1_ssid_disabled(i)) ++ return invalfc(fc, "Disabled controller '%s'", ++ param->key); + ctx->subsys_mask |= (1 << i); + return 0; + } +-- +2.27.0 + diff --git a/queue-5.10/clk-sunxi-ng-mp-fix-parent-rate-change-flag-check.patch b/queue-5.10/clk-sunxi-ng-mp-fix-parent-rate-change-flag-check.patch new file mode 100644 index 00000000000..437383f8346 --- /dev/null +++ b/queue-5.10/clk-sunxi-ng-mp-fix-parent-rate-change-flag-check.patch @@ -0,0 +1,40 @@ +From cd0b173e585ba0ed00d8e7da52a06ead1e0adcf8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 18:58:56 +0100 +Subject: clk: sunxi-ng: mp: fix parent rate change flag check + +From: Jernej Skrabec + +[ Upstream commit 245090ab2636c0869527ce563afbfb8aff29e825 ] + +CLK_SET_RATE_PARENT flag is checked on parent clock instead of current +one. Fix that. + +Fixes: 3f790433c3cb ("clk: sunxi-ng: Adjust MP clock parent rate when allowed") +Reviewed-by: Chen-Yu Tsai +Tested-by: Andre Heider +Signed-off-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20210209175900.7092-2-jernej.skrabec@siol.net +Acked-by: Maxime Ripard +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu_mp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/sunxi-ng/ccu_mp.c b/drivers/clk/sunxi-ng/ccu_mp.c +index fa4ecb9155909..9d3a76604d94c 100644 +--- a/drivers/clk/sunxi-ng/ccu_mp.c ++++ b/drivers/clk/sunxi-ng/ccu_mp.c +@@ -108,7 +108,7 @@ static unsigned long ccu_mp_round_rate(struct ccu_mux_internal *mux, + max_m = cmp->m.max ?: 1 << cmp->m.width; + max_p = cmp->p.max ?: 1 << ((1 << cmp->p.width) - 1); + +- if (!(clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT)) { ++ if (!clk_hw_can_set_rate_parent(&cmp->common.hw)) { + ccu_mp_find_best(*parent_rate, rate, max_m, max_p, &m, &p); + rate = *parent_rate / p / m; + } else { +-- +2.27.0 + diff --git a/queue-5.10/dmaengine-idxd-check-device-state-before-issue-comma.patch b/queue-5.10/dmaengine-idxd-check-device-state-before-issue-comma.patch new file mode 100644 index 00000000000..dfda83bd4b6 --- /dev/null +++ b/queue-5.10/dmaengine-idxd-check-device-state-before-issue-comma.patch @@ -0,0 +1,116 @@ +From fa15b7baa4741257b0de5229989300cec2b521ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Feb 2021 08:26:14 -0700 +Subject: dmaengine: idxd: check device state before issue command + +From: Dave Jiang + +[ Upstream commit 89e3becd8f821e507052e012d2559dcda59f538e ] + +Add device state check before executing command. Without the check the +command can be issued while device is in halt state and causes the driver to +block while waiting for the completion of the command. + +Reported-by: Sanjay Kumar +Signed-off-by: Dave Jiang +Tested-by: Sanjay Kumar +Fixes: 0d5c10b4c84d ("dmaengine: idxd: add work queue drain support") +Link: https://lore.kernel.org/r/161219313921.2976211.12222625226450097465.stgit@djiang5-desk3.ch.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/idxd/device.c | 23 ++++++++++++++++++++++- + drivers/dma/idxd/idxd.h | 2 +- + drivers/dma/idxd/init.c | 5 ++++- + 3 files changed, 27 insertions(+), 3 deletions(-) + +diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c +index 663344987e3f3..a6704838ffcb7 100644 +--- a/drivers/dma/idxd/device.c ++++ b/drivers/dma/idxd/device.c +@@ -325,17 +325,31 @@ static inline bool idxd_is_enabled(struct idxd_device *idxd) + return false; + } + ++static inline bool idxd_device_is_halted(struct idxd_device *idxd) ++{ ++ union gensts_reg gensts; ++ ++ gensts.bits = ioread32(idxd->reg_base + IDXD_GENSTATS_OFFSET); ++ ++ return (gensts.state == IDXD_DEVICE_STATE_HALT); ++} ++ + /* + * This is function is only used for reset during probe and will + * poll for completion. Once the device is setup with interrupts, + * all commands will be done via interrupt completion. + */ +-void idxd_device_init_reset(struct idxd_device *idxd) ++int idxd_device_init_reset(struct idxd_device *idxd) + { + struct device *dev = &idxd->pdev->dev; + union idxd_command_reg cmd; + unsigned long flags; + ++ if (idxd_device_is_halted(idxd)) { ++ dev_warn(&idxd->pdev->dev, "Device is HALTED!\n"); ++ return -ENXIO; ++ } ++ + memset(&cmd, 0, sizeof(cmd)); + cmd.cmd = IDXD_CMD_RESET_DEVICE; + dev_dbg(dev, "%s: sending reset for init.\n", __func__); +@@ -346,6 +360,7 @@ void idxd_device_init_reset(struct idxd_device *idxd) + IDXD_CMDSTS_ACTIVE) + cpu_relax(); + spin_unlock_irqrestore(&idxd->dev_lock, flags); ++ return 0; + } + + static void idxd_cmd_exec(struct idxd_device *idxd, int cmd_code, u32 operand, +@@ -355,6 +370,12 @@ static void idxd_cmd_exec(struct idxd_device *idxd, int cmd_code, u32 operand, + DECLARE_COMPLETION_ONSTACK(done); + unsigned long flags; + ++ if (idxd_device_is_halted(idxd)) { ++ dev_warn(&idxd->pdev->dev, "Device is HALTED!\n"); ++ *status = IDXD_CMDSTS_HW_ERR; ++ return; ++ } ++ + memset(&cmd, 0, sizeof(cmd)); + cmd.cmd = cmd_code; + cmd.operand = operand; +diff --git a/drivers/dma/idxd/idxd.h b/drivers/dma/idxd/idxd.h +index d48f193daacc0..953ef6536aac4 100644 +--- a/drivers/dma/idxd/idxd.h ++++ b/drivers/dma/idxd/idxd.h +@@ -281,7 +281,7 @@ void idxd_mask_msix_vector(struct idxd_device *idxd, int vec_id); + void idxd_unmask_msix_vector(struct idxd_device *idxd, int vec_id); + + /* device control */ +-void idxd_device_init_reset(struct idxd_device *idxd); ++int idxd_device_init_reset(struct idxd_device *idxd); + int idxd_device_enable(struct idxd_device *idxd); + int idxd_device_disable(struct idxd_device *idxd); + void idxd_device_reset(struct idxd_device *idxd); +diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c +index 0a4432b063b5c..fa8c4228f358a 100644 +--- a/drivers/dma/idxd/init.c ++++ b/drivers/dma/idxd/init.c +@@ -289,7 +289,10 @@ static int idxd_probe(struct idxd_device *idxd) + int rc; + + dev_dbg(dev, "%s entered and resetting device\n", __func__); +- idxd_device_init_reset(idxd); ++ rc = idxd_device_init_reset(idxd); ++ if (rc < 0) ++ return rc; ++ + dev_dbg(dev, "IDXD reset complete\n"); + + idxd_read_caps(idxd); +-- +2.27.0 + diff --git a/queue-5.10/dmaengine-idxd-fix-misc-interrupt-completion.patch b/queue-5.10/dmaengine-idxd-fix-misc-interrupt-completion.patch new file mode 100644 index 00000000000..c80ea7d5996 --- /dev/null +++ b/queue-5.10/dmaengine-idxd-fix-misc-interrupt-completion.patch @@ -0,0 +1,99 @@ +From 344f177c591e3c70f55a03393bd26881f5e4e1cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jan 2021 14:52:33 -0700 +Subject: dmaengine: idxd: fix misc interrupt completion + +From: Dave Jiang + +[ Upstream commit f5cc9ace24fbdf41b4814effbb2f9bad7046e988 ] + +Nikhil reported the misc interrupt handler can sometimes miss handling +the command interrupt when an error interrupt happens near the same time. +Have the irq handling thread continue to process the misc interrupts until +all interrupts are processed. This is a low usage interrupt and is not +expected to handle high volume traffic. Therefore there is no concern of +this thread running for a long time. + +Fixes: 0d5c10b4c84d ("dmaengine: idxd: add work queue drain support") +Reported-by: Nikhil Rao +Signed-off-by: Dave Jiang +Link: https://lore.kernel.org/r/161074755329.2183844.13295528344116907983.stgit@djiang5-desk3.ch.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/idxd/irq.c | 36 +++++++++++++++++++++++++++--------- + 1 file changed, 27 insertions(+), 9 deletions(-) + +diff --git a/drivers/dma/idxd/irq.c b/drivers/dma/idxd/irq.c +index 17a65a13fb649..552e2e2707058 100644 +--- a/drivers/dma/idxd/irq.c ++++ b/drivers/dma/idxd/irq.c +@@ -53,19 +53,14 @@ irqreturn_t idxd_irq_handler(int vec, void *data) + return IRQ_WAKE_THREAD; + } + +-irqreturn_t idxd_misc_thread(int vec, void *data) ++static int process_misc_interrupts(struct idxd_device *idxd, u32 cause) + { +- struct idxd_irq_entry *irq_entry = data; +- struct idxd_device *idxd = irq_entry->idxd; + struct device *dev = &idxd->pdev->dev; + union gensts_reg gensts; +- u32 cause, val = 0; ++ u32 val = 0; + int i; + bool err = false; + +- cause = ioread32(idxd->reg_base + IDXD_INTCAUSE_OFFSET); +- iowrite32(cause, idxd->reg_base + IDXD_INTCAUSE_OFFSET); +- + if (cause & IDXD_INTC_ERR) { + spin_lock_bh(&idxd->dev_lock); + for (i = 0; i < 4; i++) +@@ -123,7 +118,7 @@ irqreturn_t idxd_misc_thread(int vec, void *data) + val); + + if (!err) +- goto out; ++ return 0; + + gensts.bits = ioread32(idxd->reg_base + IDXD_GENSTATS_OFFSET); + if (gensts.state == IDXD_DEVICE_STATE_HALT) { +@@ -144,10 +139,33 @@ irqreturn_t idxd_misc_thread(int vec, void *data) + gensts.reset_type == IDXD_DEVICE_RESET_FLR ? + "FLR" : "system reset"); + spin_unlock_bh(&idxd->dev_lock); ++ return -ENXIO; + } + } + +- out: ++ return 0; ++} ++ ++irqreturn_t idxd_misc_thread(int vec, void *data) ++{ ++ struct idxd_irq_entry *irq_entry = data; ++ struct idxd_device *idxd = irq_entry->idxd; ++ int rc; ++ u32 cause; ++ ++ cause = ioread32(idxd->reg_base + IDXD_INTCAUSE_OFFSET); ++ if (cause) ++ iowrite32(cause, idxd->reg_base + IDXD_INTCAUSE_OFFSET); ++ ++ while (cause) { ++ rc = process_misc_interrupts(idxd, cause); ++ if (rc < 0) ++ break; ++ cause = ioread32(idxd->reg_base + IDXD_INTCAUSE_OFFSET); ++ if (cause) ++ iowrite32(cause, idxd->reg_base + IDXD_INTCAUSE_OFFSET); ++ } ++ + idxd_unmask_msix_vector(idxd, irq_entry->id); + return IRQ_HANDLED; + } +-- +2.27.0 + diff --git a/queue-5.10/drm-sun4i-dw-hdmi-always-set-clock-rate.patch b/queue-5.10/drm-sun4i-dw-hdmi-always-set-clock-rate.patch new file mode 100644 index 00000000000..72cd3bb9929 --- /dev/null +++ b/queue-5.10/drm-sun4i-dw-hdmi-always-set-clock-rate.patch @@ -0,0 +1,65 @@ +From 700bad093b2618f8e8d8b652ea17562823454776 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 18:58:58 +0100 +Subject: drm/sun4i: dw-hdmi: always set clock rate + +From: Jernej Skrabec + +[ Upstream commit 36b53581fe0dc2e25b67de4e58920307f22d195a ] + +As expected, HDMI controller clock should always match pixel clock. In +the past, changing HDMI controller rate would seemingly worsen +situation. However, that was the result of other bugs which are now +fixed. + +Fix that by removing set_rate quirk and always set clock rate. + +Fixes: 40bb9d3147b2 ("drm/sun4i: Add support for H6 DW HDMI controller") +Reviewed-by: Chen-Yu Tsai +Tested-by: Andre Heider +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20210209175900.7092-4-jernej.skrabec@siol.net +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 4 +--- + drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h | 1 - + 2 files changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c +index 92add2cef2e7d..23773a5e0650b 100644 +--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c ++++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c +@@ -21,8 +21,7 @@ static void sun8i_dw_hdmi_encoder_mode_set(struct drm_encoder *encoder, + { + struct sun8i_dw_hdmi *hdmi = encoder_to_sun8i_dw_hdmi(encoder); + +- if (hdmi->quirks->set_rate) +- clk_set_rate(hdmi->clk_tmds, mode->crtc_clock * 1000); ++ clk_set_rate(hdmi->clk_tmds, mode->crtc_clock * 1000); + } + + static const struct drm_encoder_helper_funcs +@@ -295,7 +294,6 @@ static int sun8i_dw_hdmi_remove(struct platform_device *pdev) + + static const struct sun8i_dw_hdmi_quirks sun8i_a83t_quirks = { + .mode_valid = sun8i_dw_hdmi_mode_valid_a83t, +- .set_rate = true, + }; + + static const struct sun8i_dw_hdmi_quirks sun50i_h6_quirks = { +diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h +index d983746fa194c..d4b55af0592f8 100644 +--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h ++++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h +@@ -179,7 +179,6 @@ struct sun8i_dw_hdmi_quirks { + enum drm_mode_status (*mode_valid)(struct dw_hdmi *hdmi, void *data, + const struct drm_display_info *info, + const struct drm_display_mode *mode); +- unsigned int set_rate : 1; + unsigned int use_drm_infoframe : 1; + }; + +-- +2.27.0 + diff --git a/queue-5.10/drm-sun4i-dw-hdmi-fix-max.-frequency-for-h6.patch b/queue-5.10/drm-sun4i-dw-hdmi-fix-max.-frequency-for-h6.patch new file mode 100644 index 00000000000..6778a850a29 --- /dev/null +++ b/queue-5.10/drm-sun4i-dw-hdmi-fix-max.-frequency-for-h6.patch @@ -0,0 +1,48 @@ +From 119d7b0498e530645ef7b5723119fad6e747cd00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 18:59:00 +0100 +Subject: drm/sun4i: dw-hdmi: Fix max. frequency for H6 + +From: Jernej Skrabec + +[ Upstream commit 1926a0508d8947cf081280d85ff035300dc71da7 ] + +It turns out that reasoning for lowering max. supported frequency is +wrong. Scrambling works just fine. Several now fixed bugs prevented +proper functioning, even with rates lower than 340 MHz. Issues were just +more pronounced with higher frequencies. + +Fix that by allowing max. supported frequency in HW and fix the comment. + +Fixes: cd9063757a22 ("drm/sun4i: DW HDMI: Lower max. supported rate for H6") +Reviewed-by: Chen-Yu Tsai +Tested-by: Andre Heider +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20210209175900.7092-6-jernej.skrabec@siol.net +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c +index 23773a5e0650b..bbdfd5e26ec88 100644 +--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c ++++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c +@@ -47,11 +47,9 @@ sun8i_dw_hdmi_mode_valid_h6(struct dw_hdmi *hdmi, void *data, + { + /* + * Controller support maximum of 594 MHz, which correlates to +- * 4K@60Hz 4:4:4 or RGB. However, for frequencies greater than +- * 340 MHz scrambling has to be enabled. Because scrambling is +- * not yet implemented, just limit to 340 MHz for now. ++ * 4K@60Hz 4:4:4 or RGB. + */ +- if (mode->clock > 340000) ++ if (mode->clock > 594000) + return MODE_CLOCK_HIGH; + + return MODE_OK; +-- +2.27.0 + diff --git a/queue-5.10/drm-sun4i-fix-h6-hdmi-phy-configuration.patch b/queue-5.10/drm-sun4i-fix-h6-hdmi-phy-configuration.patch new file mode 100644 index 00000000000..9169b89254b --- /dev/null +++ b/queue-5.10/drm-sun4i-fix-h6-hdmi-phy-configuration.patch @@ -0,0 +1,79 @@ +From a374fbccf265f15815e42936495caa48874b6b68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 18:58:59 +0100 +Subject: drm/sun4i: Fix H6 HDMI PHY configuration + +From: Jernej Skrabec + +[ Upstream commit 6a155216c48f2f65c8dcb02c4c27549c170d24a9 ] + +As it turns out, vendor HDMI PHY driver for H6 has a pretty big table +of predefined values for various pixel clocks. However, most of them are +not useful/tested because they come from reference driver code. Vendor +PHY driver is concerned with only few of those, namely 27 MHz, 74.25 +MHz, 148.5 MHz, 297 MHz and 594 MHz. These are all frequencies for +standard CEA modes. + +Fix sun50i_h6_cur_ctr and sun50i_h6_phy_config with the values only for +aforementioned frequencies. + +Table sun50i_h6_mpll_cfg doesn't need to be changed because values are +actually frequency dependent and not so much SoC dependent. See i.MX6 +documentation for explanation of those values for similar PHY. + +Fixes: c71c9b2fee17 ("drm/sun4i: Add support for Synopsys HDMI PHY") +Tested-by: Andre Heider +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20210209175900.7092-5-jernej.skrabec@siol.net +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c | 26 +++++++++----------------- + 1 file changed, 9 insertions(+), 17 deletions(-) + +diff --git a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c +index 35c2133724e2d..9994edf675096 100644 +--- a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c ++++ b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c +@@ -104,29 +104,21 @@ static const struct dw_hdmi_mpll_config sun50i_h6_mpll_cfg[] = { + + static const struct dw_hdmi_curr_ctrl sun50i_h6_cur_ctr[] = { + /* pixelclk bpp8 bpp10 bpp12 */ +- { 25175000, { 0x0000, 0x0000, 0x0000 }, }, + { 27000000, { 0x0012, 0x0000, 0x0000 }, }, +- { 59400000, { 0x0008, 0x0008, 0x0008 }, }, +- { 72000000, { 0x0008, 0x0008, 0x001b }, }, +- { 74250000, { 0x0013, 0x0013, 0x0013 }, }, +- { 90000000, { 0x0008, 0x001a, 0x001b }, }, +- { 118800000, { 0x001b, 0x001a, 0x001b }, }, +- { 144000000, { 0x001b, 0x001a, 0x0034 }, }, +- { 180000000, { 0x001b, 0x0033, 0x0034 }, }, +- { 216000000, { 0x0036, 0x0033, 0x0034 }, }, +- { 237600000, { 0x0036, 0x0033, 0x001b }, }, +- { 288000000, { 0x0036, 0x001b, 0x001b }, }, +- { 297000000, { 0x0019, 0x001b, 0x0019 }, }, +- { 330000000, { 0x0036, 0x001b, 0x001b }, }, +- { 594000000, { 0x003f, 0x001b, 0x001b }, }, ++ { 74250000, { 0x0013, 0x001a, 0x001b }, }, ++ { 148500000, { 0x0019, 0x0033, 0x0034 }, }, ++ { 297000000, { 0x0019, 0x001b, 0x001b }, }, ++ { 594000000, { 0x0010, 0x001b, 0x001b }, }, + { ~0UL, { 0x0000, 0x0000, 0x0000 }, } + }; + + static const struct dw_hdmi_phy_config sun50i_h6_phy_config[] = { + /*pixelclk symbol term vlev*/ +- { 74250000, 0x8009, 0x0004, 0x0232}, +- { 148500000, 0x8029, 0x0004, 0x0273}, +- { 594000000, 0x8039, 0x0004, 0x014a}, ++ { 27000000, 0x8009, 0x0007, 0x02b0 }, ++ { 74250000, 0x8009, 0x0006, 0x022d }, ++ { 148500000, 0x8029, 0x0006, 0x0270 }, ++ { 297000000, 0x8039, 0x0005, 0x01ab }, ++ { 594000000, 0x8029, 0x0000, 0x008a }, + { ~0UL, 0x0000, 0x0000, 0x0000} + }; + +-- +2.27.0 + diff --git a/queue-5.10/drm-sun4i-tcon-set-sync-polarity-for-tcon1-channel.patch b/queue-5.10/drm-sun4i-tcon-set-sync-polarity-for-tcon1-channel.patch new file mode 100644 index 00000000000..1396de24d8f --- /dev/null +++ b/queue-5.10/drm-sun4i-tcon-set-sync-polarity-for-tcon1-channel.patch @@ -0,0 +1,102 @@ +From abef385d32a7bfde3136f7b12335dac969d733d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 18:58:57 +0100 +Subject: drm/sun4i: tcon: set sync polarity for tcon1 channel + +From: Jernej Skrabec + +[ Upstream commit 50791f5d7b6a14b388f46c8885f71d1b98216d1d ] + +Channel 1 has polarity bits for vsync and hsync signals but driver never +sets them. It turns out that with pre-HDMI2 controllers seemingly there +is no issue if polarity is not set. However, with HDMI2 controllers +(H6) there often comes to de-synchronization due to phase shift. This +causes flickering screen. It's safe to assume that similar issues might +happen also with pre-HDMI2 controllers. + +Solve issue with setting vsync and hsync polarity. Note that display +stacks with tcon top have polarity bits actually in tcon0 polarity +register. + +Fixes: 9026e0d122ac ("drm: Add Allwinner A10 Display Engine support") +Reviewed-by: Chen-Yu Tsai +Tested-by: Andre Heider +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20210209175900.7092-3-jernej.skrabec@siol.net +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun4i_tcon.c | 25 +++++++++++++++++++++++++ + drivers/gpu/drm/sun4i/sun4i_tcon.h | 6 ++++++ + 2 files changed, 31 insertions(+) + +diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c +index eaaf5d70e3529..1e643bc7e786a 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c ++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c +@@ -689,6 +689,30 @@ static void sun4i_tcon1_mode_set(struct sun4i_tcon *tcon, + SUN4I_TCON1_BASIC5_V_SYNC(vsync) | + SUN4I_TCON1_BASIC5_H_SYNC(hsync)); + ++ /* Setup the polarity of multiple signals */ ++ if (tcon->quirks->polarity_in_ch0) { ++ val = 0; ++ ++ if (mode->flags & DRM_MODE_FLAG_PHSYNC) ++ val |= SUN4I_TCON0_IO_POL_HSYNC_POSITIVE; ++ ++ if (mode->flags & DRM_MODE_FLAG_PVSYNC) ++ val |= SUN4I_TCON0_IO_POL_VSYNC_POSITIVE; ++ ++ regmap_write(tcon->regs, SUN4I_TCON0_IO_POL_REG, val); ++ } else { ++ /* according to vendor driver, this bit must be always set */ ++ val = SUN4I_TCON1_IO_POL_UNKNOWN; ++ ++ if (mode->flags & DRM_MODE_FLAG_PHSYNC) ++ val |= SUN4I_TCON1_IO_POL_HSYNC_POSITIVE; ++ ++ if (mode->flags & DRM_MODE_FLAG_PVSYNC) ++ val |= SUN4I_TCON1_IO_POL_VSYNC_POSITIVE; ++ ++ regmap_write(tcon->regs, SUN4I_TCON1_IO_POL_REG, val); ++ } ++ + /* Map output pins to channel 1 */ + regmap_update_bits(tcon->regs, SUN4I_TCON_GCTL_REG, + SUN4I_TCON_GCTL_IOMAP_MASK, +@@ -1517,6 +1541,7 @@ static const struct sun4i_tcon_quirks sun8i_a83t_tv_quirks = { + + static const struct sun4i_tcon_quirks sun8i_r40_tv_quirks = { + .has_channel_1 = true, ++ .polarity_in_ch0 = true, + .set_mux = sun8i_r40_tcon_tv_set_mux, + }; + +diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.h b/drivers/gpu/drm/sun4i/sun4i_tcon.h +index cfbf4e6c16799..ee555318e3c2f 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_tcon.h ++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.h +@@ -153,6 +153,11 @@ + #define SUN4I_TCON1_BASIC5_V_SYNC(height) (((height) - 1) & 0x3ff) + + #define SUN4I_TCON1_IO_POL_REG 0xf0 ++/* there is no documentation about this bit */ ++#define SUN4I_TCON1_IO_POL_UNKNOWN BIT(26) ++#define SUN4I_TCON1_IO_POL_HSYNC_POSITIVE BIT(25) ++#define SUN4I_TCON1_IO_POL_VSYNC_POSITIVE BIT(24) ++ + #define SUN4I_TCON1_IO_TRI_REG 0xf4 + + #define SUN4I_TCON_ECC_FIFO_REG 0xf8 +@@ -235,6 +240,7 @@ struct sun4i_tcon_quirks { + bool needs_de_be_mux; /* sun6i needs mux to select backend */ + bool needs_edp_reset; /* a80 edp reset needed for tcon0 access */ + bool supports_lvds; /* Does the TCON support an LVDS output? */ ++ bool polarity_in_ch0; /* some tcon1 channels have polarity bits in tcon0 pol register */ + u8 dclk_min_div; /* minimum divider for TCON0 DCLK */ + + /* callback to handle tcon muxing options */ +-- +2.27.0 + diff --git a/queue-5.10/drm-vc4-hvs-fix-buffer-overflow-with-the-dlist-handl.patch b/queue-5.10/drm-vc4-hvs-fix-buffer-overflow-with-the-dlist-handl.patch new file mode 100644 index 00000000000..268cf248a34 --- /dev/null +++ b/queue-5.10/drm-vc4-hvs-fix-buffer-overflow-with-the-dlist-handl.patch @@ -0,0 +1,81 @@ +From 888ad067c1a92dbb2c0d736baac8e81165c1de63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Jan 2021 17:06:47 +0100 +Subject: drm/vc4: hvs: Fix buffer overflow with the dlist handling + +From: Maxime Ripard + +[ Upstream commit facd93f4285c405f9a91b05166147cb39e860666 ] + +Commit 0a038c1c29a7 ("drm/vc4: Move LBM creation out of +vc4_plane_mode_set()") changed the LBM allocation logic from first +allocating the LBM memory for the plane to running mode_set, +adding a gap in the LBM, and then running the dlist allocation filling +that gap. + +The gap was introduced by incrementing the dlist array index, but was +never checking whether or not we were over the array length, leading +eventually to memory corruptions if we ever crossed this limit. + +vc4_dlist_write had that logic though, and was reallocating a larger +dlist array when reaching the end of the buffer. Let's share the logic +between both functions. + +Cc: Boris Brezillon +Cc: Eric Anholt +Fixes: 0a038c1c29a7 ("drm/vc4: Move LBM creation out of vc4_plane_mode_set()") +Signed-off-by: Maxime Ripard +Acked-by: Thomas Zimmermann +Reviewed-by: Dave Stevenson +Link: https://patchwork.freedesktop.org/patch/msgid/20210129160647.128373-1-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_plane.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c +index 5612cab552270..af4b8944a6032 100644 +--- a/drivers/gpu/drm/vc4/vc4_plane.c ++++ b/drivers/gpu/drm/vc4/vc4_plane.c +@@ -220,7 +220,7 @@ static void vc4_plane_reset(struct drm_plane *plane) + __drm_atomic_helper_plane_reset(plane, &vc4_state->base); + } + +-static void vc4_dlist_write(struct vc4_plane_state *vc4_state, u32 val) ++static void vc4_dlist_counter_increment(struct vc4_plane_state *vc4_state) + { + if (vc4_state->dlist_count == vc4_state->dlist_size) { + u32 new_size = max(4u, vc4_state->dlist_count * 2); +@@ -235,7 +235,15 @@ static void vc4_dlist_write(struct vc4_plane_state *vc4_state, u32 val) + vc4_state->dlist_size = new_size; + } + +- vc4_state->dlist[vc4_state->dlist_count++] = val; ++ vc4_state->dlist_count++; ++} ++ ++static void vc4_dlist_write(struct vc4_plane_state *vc4_state, u32 val) ++{ ++ unsigned int idx = vc4_state->dlist_count; ++ ++ vc4_dlist_counter_increment(vc4_state); ++ vc4_state->dlist[idx] = val; + } + + /* Returns the scl0/scl1 field based on whether the dimensions need to +@@ -978,8 +986,10 @@ static int vc4_plane_mode_set(struct drm_plane *plane, + * be set when calling vc4_plane_allocate_lbm(). + */ + if (vc4_state->y_scaling[0] != VC4_SCALING_NONE || +- vc4_state->y_scaling[1] != VC4_SCALING_NONE) +- vc4_state->lbm_offset = vc4_state->dlist_count++; ++ vc4_state->y_scaling[1] != VC4_SCALING_NONE) { ++ vc4_state->lbm_offset = vc4_state->dlist_count; ++ vc4_dlist_counter_increment(vc4_state); ++ } + + if (num_planes > 1) { + /* Emit Cb/Cr as channel 0 and Y as channel +-- +2.27.0 + diff --git a/queue-5.10/firmware_loader-align-.builtin_fw-to-8.patch b/queue-5.10/firmware_loader-align-.builtin_fw-to-8.patch new file mode 100644 index 00000000000..e3b0cd386a3 --- /dev/null +++ b/queue-5.10/firmware_loader-align-.builtin_fw-to-8.patch @@ -0,0 +1,54 @@ +From b0eecfa1ed57da5333a0ed5501c637b5f7e00fd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 13:42:07 -0800 +Subject: firmware_loader: align .builtin_fw to 8 + +From: Fangrui Song + +[ Upstream commit 793f49a87aae24e5bcf92ad98d764153fc936570 ] + +arm64 references the start address of .builtin_fw (__start_builtin_fw) +with a pair of R_AARCH64_ADR_PREL_PG_HI21/R_AARCH64_LDST64_ABS_LO12_NC +relocations. The compiler is allowed to emit the +R_AARCH64_LDST64_ABS_LO12_NC relocation because struct builtin_fw in +include/linux/firmware.h is 8-byte aligned. + +The R_AARCH64_LDST64_ABS_LO12_NC relocation requires the address to be a +multiple of 8, which may not be the case if .builtin_fw is empty. +Unconditionally align .builtin_fw to fix the linker error. 32-bit +architectures could use ALIGN(4) but that would add unnecessary +complexity, so just use ALIGN(8). + +Link: https://lkml.kernel.org/r/20201208054646.2913063-1-maskray@google.com +Link: https://github.com/ClangBuiltLinux/linux/issues/1204 +Fixes: 5658c76 ("firmware: allow firmware files to be built into kernel image") +Signed-off-by: Fangrui Song +Reported-by: kernel test robot +Acked-by: Arnd Bergmann +Reviewed-by: Nick Desaulniers +Tested-by: Nick Desaulniers +Tested-by: Douglas Anderson +Acked-by: Nathan Chancellor +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/asm-generic/vmlinux.lds.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h +index b2b3d81b1535a..b97c628ad91ff 100644 +--- a/include/asm-generic/vmlinux.lds.h ++++ b/include/asm-generic/vmlinux.lds.h +@@ -459,7 +459,7 @@ + } \ + \ + /* Built-in firmware blobs */ \ +- .builtin_fw : AT(ADDR(.builtin_fw) - LOAD_OFFSET) { \ ++ .builtin_fw : AT(ADDR(.builtin_fw) - LOAD_OFFSET) ALIGN(8) { \ + __start_builtin_fw = .; \ + KEEP(*(.builtin_fw)) \ + __end_builtin_fw = .; \ +-- +2.27.0 + diff --git a/queue-5.10/h8300-fix-preemption-build-ti_pre_count-undefined.patch b/queue-5.10/h8300-fix-preemption-build-ti_pre_count-undefined.patch new file mode 100644 index 00000000000..e853a6f5486 --- /dev/null +++ b/queue-5.10/h8300-fix-preemption-build-ti_pre_count-undefined.patch @@ -0,0 +1,44 @@ +From f28388e14af94965638f195c4ac929413ec4ff18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Feb 2021 20:52:54 -0800 +Subject: h8300: fix PREEMPTION build, TI_PRE_COUNT undefined + +From: Randy Dunlap + +[ Upstream commit ade9679c159d5bbe14fb7e59e97daf6062872e2b ] + +Fix a build error for undefined 'TI_PRE_COUNT' by adding it to +asm-offsets.c. + + h8300-linux-ld: arch/h8300/kernel/entry.o: in function `resume_kernel': (.text+0x29a): undefined reference to `TI_PRE_COUNT' + +Link: https://lkml.kernel.org/r/20210212021650.22740-1-rdunlap@infradead.org +Fixes: df2078b8daa7 ("h8300: Low level entry") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Cc: Yoshinori Sato +Cc: Thomas Gleixner +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/h8300/kernel/asm-offsets.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/h8300/kernel/asm-offsets.c b/arch/h8300/kernel/asm-offsets.c +index 85e60509f0a83..d4b53af657c84 100644 +--- a/arch/h8300/kernel/asm-offsets.c ++++ b/arch/h8300/kernel/asm-offsets.c +@@ -63,6 +63,9 @@ int main(void) + OFFSET(TI_FLAGS, thread_info, flags); + OFFSET(TI_CPU, thread_info, cpu); + OFFSET(TI_PRE, thread_info, preempt_count); ++#ifdef CONFIG_PREEMPTION ++ DEFINE(TI_PRE_COUNT, offsetof(struct thread_info, preempt_count)); ++#endif + + return 0; + } +-- +2.27.0 + diff --git a/queue-5.10/hv_netvsc-reset-the-rsc-count-if-nvsp_stat_fail-in-n.patch b/queue-5.10/hv_netvsc-reset-the-rsc-count-if-nvsp_stat_fail-in-n.patch new file mode 100644 index 00000000000..f9951d72f5c --- /dev/null +++ b/queue-5.10/hv_netvsc-reset-the-rsc-count-if-nvsp_stat_fail-in-n.patch @@ -0,0 +1,60 @@ +From d880ab89f1862f603b5b8bf36cf4cfcaa74341bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Feb 2021 12:36:02 +0100 +Subject: hv_netvsc: Reset the RSC count if NVSP_STAT_FAIL in netvsc_receive() + +From: Andrea Parri (Microsoft) + +[ Upstream commit 12bc8dfb83b5292fe387b795210018b7632ee08b ] + +Commit 44144185951a0f ("hv_netvsc: Add validation for untrusted Hyper-V +values") added validation to rndis_filter_receive_data() (and +rndis_filter_receive()) which introduced NVSP_STAT_FAIL-scenarios where +the count is not updated/reset. Fix this omission, and prevent similar +scenarios from occurring in the future. + +Reported-by: Juan Vazquez +Signed-off-by: Andrea Parri (Microsoft) +Fixes: 44144185951a0f ("hv_netvsc: Add validation for untrusted Hyper-V values") +Reviewed-by: Jesse Brandeburg +Link: https://lore.kernel.org/r/20210203113602.558916-1-parri.andrea@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/hyperv/netvsc.c | 5 ++++- + drivers/net/hyperv/rndis_filter.c | 2 -- + 2 files changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c +index 0c3de94b51787..6a7ab930ef70d 100644 +--- a/drivers/net/hyperv/netvsc.c ++++ b/drivers/net/hyperv/netvsc.c +@@ -1253,8 +1253,11 @@ static int netvsc_receive(struct net_device *ndev, + ret = rndis_filter_receive(ndev, net_device, + nvchan, data, buflen); + +- if (unlikely(ret != NVSP_STAT_SUCCESS)) ++ if (unlikely(ret != NVSP_STAT_SUCCESS)) { ++ /* Drop incomplete packet */ ++ nvchan->rsc.cnt = 0; + status = NVSP_STAT_FAIL; ++ } + } + + enq_receive_complete(ndev, net_device, q_idx, +diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c +index b22e47bcfeca1..90bc0008fa2fd 100644 +--- a/drivers/net/hyperv/rndis_filter.c ++++ b/drivers/net/hyperv/rndis_filter.c +@@ -508,8 +508,6 @@ static int rndis_filter_receive_data(struct net_device *ndev, + return ret; + + drop: +- /* Drop incomplete packet */ +- nvchan->rsc.cnt = 0; + return NVSP_STAT_FAIL; + } + +-- +2.27.0 + diff --git a/queue-5.10/i2c-stm32f7-fix-configuration-of-the-digital-filter.patch b/queue-5.10/i2c-stm32f7-fix-configuration-of-the-digital-filter.patch new file mode 100644 index 00000000000..8f7f8875292 --- /dev/null +++ b/queue-5.10/i2c-stm32f7-fix-configuration-of-the-digital-filter.patch @@ -0,0 +1,62 @@ +From 2dd5774047b20787baa7ccddfbe5f495275f8579 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Feb 2021 09:51:40 +0100 +Subject: i2c: stm32f7: fix configuration of the digital filter + +From: Alain Volmat + +[ Upstream commit 3d6a3d3a2a7a3a60a824e7c04e95fd50dec57812 ] + +The digital filter related computation are present in the driver +however the programming of the filter within the IP is missing. +The maximum value for the DNF is wrong and should be 15 instead of 16. + +Fixes: aeb068c57214 ("i2c: i2c-stm32f7: add driver") + +Signed-off-by: Alain Volmat +Signed-off-by: Pierre-Yves MORDRET +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-stm32f7.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c +index f41f51a176a1d..6747353345475 100644 +--- a/drivers/i2c/busses/i2c-stm32f7.c ++++ b/drivers/i2c/busses/i2c-stm32f7.c +@@ -57,6 +57,8 @@ + #define STM32F7_I2C_CR1_RXDMAEN BIT(15) + #define STM32F7_I2C_CR1_TXDMAEN BIT(14) + #define STM32F7_I2C_CR1_ANFOFF BIT(12) ++#define STM32F7_I2C_CR1_DNF_MASK GENMASK(11, 8) ++#define STM32F7_I2C_CR1_DNF(n) (((n) & 0xf) << 8) + #define STM32F7_I2C_CR1_ERRIE BIT(7) + #define STM32F7_I2C_CR1_TCIE BIT(6) + #define STM32F7_I2C_CR1_STOPIE BIT(5) +@@ -160,7 +162,7 @@ enum { + }; + + #define STM32F7_I2C_DNF_DEFAULT 0 +-#define STM32F7_I2C_DNF_MAX 16 ++#define STM32F7_I2C_DNF_MAX 15 + + #define STM32F7_I2C_ANALOG_FILTER_ENABLE 1 + #define STM32F7_I2C_ANALOG_FILTER_DELAY_MIN 50 /* ns */ +@@ -725,6 +727,13 @@ static void stm32f7_i2c_hw_config(struct stm32f7_i2c_dev *i2c_dev) + else + stm32f7_i2c_set_bits(i2c_dev->base + STM32F7_I2C_CR1, + STM32F7_I2C_CR1_ANFOFF); ++ ++ /* Program the Digital Filter */ ++ stm32f7_i2c_clr_bits(i2c_dev->base + STM32F7_I2C_CR1, ++ STM32F7_I2C_CR1_DNF_MASK); ++ stm32f7_i2c_set_bits(i2c_dev->base + STM32F7_I2C_CR1, ++ STM32F7_I2C_CR1_DNF(i2c_dev->setup.dnf)); ++ + stm32f7_i2c_set_bits(i2c_dev->base + STM32F7_I2C_CR1, + STM32F7_I2C_CR1_PE); + } +-- +2.27.0 + diff --git a/queue-5.10/ibmvnic-clear-failover_pending-if-unable-to-schedule.patch b/queue-5.10/ibmvnic-clear-failover_pending-if-unable-to-schedule.patch new file mode 100644 index 00000000000..22e7560b343 --- /dev/null +++ b/queue-5.10/ibmvnic-clear-failover_pending-if-unable-to-schedule.patch @@ -0,0 +1,57 @@ +From ed7bd75552b9a8e7ff09752f3d2acbaa0f398901 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Feb 2021 21:08:02 -0800 +Subject: ibmvnic: Clear failover_pending if unable to schedule + +From: Sukadev Bhattiprolu + +[ Upstream commit ef66a1eace968ff22a35f45e6e8ec36b668b6116 ] + +Normally we clear the failover_pending flag when processing the reset. +But if we are unable to schedule a failover reset we must clear the +flag ourselves. We could fail to schedule the reset if we are in PROBING +state (eg: when booting via kexec) or because we could not allocate memory. + +Thanks to Cris Forno for helping isolate the problem and for testing. + +Fixes: 1d8504937478 ("powerpc/vnic: Extend "failover pending" window") +Signed-off-by: Sukadev Bhattiprolu +Tested-by: Cristobal Forno +Link: https://lore.kernel.org/r/20210203050802.680772-1-sukadev@linux.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 2f281d0f98070..ee16e0e4fa5fc 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -4813,7 +4813,22 @@ static void ibmvnic_handle_crq(union ibmvnic_crq *crq, + complete(&adapter->init_done); + adapter->init_done_rc = -EIO; + } +- ibmvnic_reset(adapter, VNIC_RESET_FAILOVER); ++ rc = ibmvnic_reset(adapter, VNIC_RESET_FAILOVER); ++ if (rc && rc != -EBUSY) { ++ /* We were unable to schedule the failover ++ * reset either because the adapter was still ++ * probing (eg: during kexec) or we could not ++ * allocate memory. Clear the failover_pending ++ * flag since no one else will. We ignore ++ * EBUSY because it means either FAILOVER reset ++ * is already scheduled or the adapter is ++ * being removed. ++ */ ++ netdev_err(netdev, ++ "Error %ld scheduling failover reset\n", ++ rc); ++ adapter->failover_pending = false; ++ } + break; + case IBMVNIC_CRQ_INIT_COMPLETE: + dev_info(dev, "Partner initialization complete\n"); +-- +2.27.0 + diff --git a/queue-5.10/mt76-dma-fix-a-possible-memory-leak-in-mt76_add_frag.patch b/queue-5.10/mt76-dma-fix-a-possible-memory-leak-in-mt76_add_frag.patch new file mode 100644 index 00000000000..40a447372a4 --- /dev/null +++ b/queue-5.10/mt76-dma-fix-a-possible-memory-leak-in-mt76_add_frag.patch @@ -0,0 +1,51 @@ +From 88716ab83d2337c4917ac5da8ef47543033d6971 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jan 2021 12:02:13 +0100 +Subject: mt76: dma: fix a possible memory leak in mt76_add_fragment() + +From: Lorenzo Bianconi + +[ Upstream commit 93a1d4791c10d443bc67044def7efee2991d48b7 ] + +Fix a memory leak in mt76_add_fragment routine returning the buffer +to the page_frag_cache when we receive a new fragment and the +skb_shared_info frag array is full. + +Fixes: b102f0c522cf6 ("mt76: fix array overflow on receiving too many fragments for a packet") +Signed-off-by: Lorenzo Bianconi +Acked-by: Felix Fietkau +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/4f9dd73407da88b2a552517ce8db242d86bf4d5c.1611616130.git.lorenzo@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/dma.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c +index 145e839fea4e5..917617aad8d3c 100644 +--- a/drivers/net/wireless/mediatek/mt76/dma.c ++++ b/drivers/net/wireless/mediatek/mt76/dma.c +@@ -519,15 +519,17 @@ static void + mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data, + int len, bool more) + { +- struct page *page = virt_to_head_page(data); +- int offset = data - page_address(page); + struct sk_buff *skb = q->rx_head; + struct skb_shared_info *shinfo = skb_shinfo(skb); + + if (shinfo->nr_frags < ARRAY_SIZE(shinfo->frags)) { +- offset += q->buf_offset; ++ struct page *page = virt_to_head_page(data); ++ int offset = data - page_address(page) + q->buf_offset; ++ + skb_add_rx_frag(skb, shinfo->nr_frags, page, offset, len, + q->buf_size); ++ } else { ++ skb_free_frag(data); + } + + if (more) +-- +2.27.0 + diff --git a/queue-5.10/net-dsa-felix-implement-port-flushing-on-.phylink_ma.patch b/queue-5.10/net-dsa-felix-implement-port-flushing-on-.phylink_ma.patch new file mode 100644 index 00000000000..cc9b457f62a --- /dev/null +++ b/queue-5.10/net-dsa-felix-implement-port-flushing-on-.phylink_ma.patch @@ -0,0 +1,204 @@ +From 7a40641c732dceaddacbe2410fde526fd56d532d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Feb 2021 19:36:27 +0200 +Subject: net: dsa: felix: implement port flushing on .phylink_mac_link_down + +From: Vladimir Oltean + +[ Upstream commit eb4733d7cffc547e08fe5a216e4f03663bb71108 ] + +There are several issues which may be seen when the link goes down while +forwarding traffic, all of which can be attributed to the fact that the +port flushing procedure from the reference manual was not closely +followed. + +With flow control enabled on both the ingress port and the egress port, +it may happen when a link goes down that Ethernet packets are in flight. +In flow control mode, frames are held back and not dropped. When there +is enough traffic in flight (example: iperf3 TCP), then the ingress port +might enter congestion and never exit that state. This is a problem, +because it is the egress port's link that went down, and that has caused +the inability of the ingress port to send packets to any other port. +This is solved by flushing the egress port's queues when it goes down. + +There is also a problem when performing stream splitting for +IEEE 802.1CB traffic (not yet upstream, but a sort of multicast, +basically). There, if one port from the destination ports mask goes +down, splitting the stream towards the other destinations will no longer +be performed. This can be traced down to this line: + + ocelot_port_writel(ocelot_port, 0, DEV_MAC_ENA_CFG); + +which should have been instead, as per the reference manual: + + ocelot_port_rmwl(ocelot_port, 0, DEV_MAC_ENA_CFG_RX_ENA, + DEV_MAC_ENA_CFG); + +Basically only DEV_MAC_ENA_CFG_RX_ENA should be disabled, but not +DEV_MAC_ENA_CFG_TX_ENA - I don't have further insight into why that is +the case, but apparently multicasting to several ports will cause issues +if at least one of them doesn't have DEV_MAC_ENA_CFG_TX_ENA set. + +I am not sure what the state of the Ocelot VSC7514 driver is, but +probably not as bad as Felix/Seville, since VSC7514 uses phylib and has +the following in ocelot_adjust_link: + + if (!phydev->link) + return; + +therefore the port is not really put down when the link is lost, unlike +the DSA drivers which use .phylink_mac_link_down for that. + +Nonetheless, I put ocelot_port_flush() in the common ocelot.c because it +needs to access some registers from drivers/net/ethernet/mscc/ocelot_rew.h +which are not exported in include/soc/mscc/ and a bugfix patch should +probably not move headers around. + +Fixes: bdeced75b13f ("net: dsa: felix: Add PCS operations for PHYLINK") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/ocelot/felix.c | 17 ++++++++- + drivers/net/ethernet/mscc/ocelot.c | 54 +++++++++++++++++++++++++++ + drivers/net/ethernet/mscc/ocelot_io.c | 8 ++++ + include/soc/mscc/ocelot.h | 2 + + 4 files changed, 80 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c +index c444ef3da3e24..89d7c9b231863 100644 +--- a/drivers/net/dsa/ocelot/felix.c ++++ b/drivers/net/dsa/ocelot/felix.c +@@ -214,9 +214,24 @@ static void felix_phylink_mac_link_down(struct dsa_switch *ds, int port, + { + struct ocelot *ocelot = ds->priv; + struct ocelot_port *ocelot_port = ocelot->ports[port]; ++ int err; ++ ++ ocelot_port_rmwl(ocelot_port, 0, DEV_MAC_ENA_CFG_RX_ENA, ++ DEV_MAC_ENA_CFG); + +- ocelot_port_writel(ocelot_port, 0, DEV_MAC_ENA_CFG); + ocelot_fields_write(ocelot, port, QSYS_SWITCH_PORT_MODE_PORT_ENA, 0); ++ ++ err = ocelot_port_flush(ocelot, port); ++ if (err) ++ dev_err(ocelot->dev, "failed to flush port %d: %d\n", ++ port, err); ++ ++ /* Put the port in reset. */ ++ ocelot_port_writel(ocelot_port, ++ DEV_CLOCK_CFG_MAC_TX_RST | ++ DEV_CLOCK_CFG_MAC_RX_RST | ++ DEV_CLOCK_CFG_LINK_SPEED(OCELOT_SPEED_1000), ++ DEV_CLOCK_CFG); + } + + static void felix_phylink_mac_link_up(struct dsa_switch *ds, int port, +diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c +index d4768dcb6c699..aa400b925b08e 100644 +--- a/drivers/net/ethernet/mscc/ocelot.c ++++ b/drivers/net/ethernet/mscc/ocelot.c +@@ -348,6 +348,60 @@ static void ocelot_vlan_init(struct ocelot *ocelot) + } + } + ++static u32 ocelot_read_eq_avail(struct ocelot *ocelot, int port) ++{ ++ return ocelot_read_rix(ocelot, QSYS_SW_STATUS, port); ++} ++ ++int ocelot_port_flush(struct ocelot *ocelot, int port) ++{ ++ int err, val; ++ ++ /* Disable dequeuing from the egress queues */ ++ ocelot_rmw_rix(ocelot, QSYS_PORT_MODE_DEQUEUE_DIS, ++ QSYS_PORT_MODE_DEQUEUE_DIS, ++ QSYS_PORT_MODE, port); ++ ++ /* Disable flow control */ ++ ocelot_fields_write(ocelot, port, SYS_PAUSE_CFG_PAUSE_ENA, 0); ++ ++ /* Disable priority flow control */ ++ ocelot_fields_write(ocelot, port, ++ QSYS_SWITCH_PORT_MODE_TX_PFC_ENA, 0); ++ ++ /* Wait at least the time it takes to receive a frame of maximum length ++ * at the port. ++ * Worst-case delays for 10 kilobyte jumbo frames are: ++ * 8 ms on a 10M port ++ * 800 μs on a 100M port ++ * 80 μs on a 1G port ++ * 32 μs on a 2.5G port ++ */ ++ usleep_range(8000, 10000); ++ ++ /* Disable half duplex backpressure. */ ++ ocelot_rmw_rix(ocelot, 0, SYS_FRONT_PORT_MODE_HDX_MODE, ++ SYS_FRONT_PORT_MODE, port); ++ ++ /* Flush the queues associated with the port. */ ++ ocelot_rmw_gix(ocelot, REW_PORT_CFG_FLUSH_ENA, REW_PORT_CFG_FLUSH_ENA, ++ REW_PORT_CFG, port); ++ ++ /* Enable dequeuing from the egress queues. */ ++ ocelot_rmw_rix(ocelot, 0, QSYS_PORT_MODE_DEQUEUE_DIS, QSYS_PORT_MODE, ++ port); ++ ++ /* Wait until flushing is complete. */ ++ err = read_poll_timeout(ocelot_read_eq_avail, val, !val, ++ 100, 2000000, false, ocelot, port); ++ ++ /* Clear flushing again. */ ++ ocelot_rmw_gix(ocelot, 0, REW_PORT_CFG_FLUSH_ENA, REW_PORT_CFG, port); ++ ++ return err; ++} ++EXPORT_SYMBOL(ocelot_port_flush); ++ + void ocelot_adjust_link(struct ocelot *ocelot, int port, + struct phy_device *phydev) + { +diff --git a/drivers/net/ethernet/mscc/ocelot_io.c b/drivers/net/ethernet/mscc/ocelot_io.c +index 0acb459484185..ea4e83410fe4d 100644 +--- a/drivers/net/ethernet/mscc/ocelot_io.c ++++ b/drivers/net/ethernet/mscc/ocelot_io.c +@@ -71,6 +71,14 @@ void ocelot_port_writel(struct ocelot_port *port, u32 val, u32 reg) + } + EXPORT_SYMBOL(ocelot_port_writel); + ++void ocelot_port_rmwl(struct ocelot_port *port, u32 val, u32 mask, u32 reg) ++{ ++ u32 cur = ocelot_port_readl(port, reg); ++ ++ ocelot_port_writel(port, (cur & (~mask)) | val, reg); ++} ++EXPORT_SYMBOL(ocelot_port_rmwl); ++ + u32 __ocelot_target_read_ix(struct ocelot *ocelot, enum ocelot_target target, + u32 reg, u32 offset) + { +diff --git a/include/soc/mscc/ocelot.h b/include/soc/mscc/ocelot.h +index 49b46df476f2c..4971b45860a4d 100644 +--- a/include/soc/mscc/ocelot.h ++++ b/include/soc/mscc/ocelot.h +@@ -703,6 +703,7 @@ struct ocelot_policer { + /* I/O */ + u32 ocelot_port_readl(struct ocelot_port *port, u32 reg); + void ocelot_port_writel(struct ocelot_port *port, u32 val, u32 reg); ++void ocelot_port_rmwl(struct ocelot_port *port, u32 val, u32 mask, u32 reg); + u32 __ocelot_read_ix(struct ocelot *ocelot, u32 reg, u32 offset); + void __ocelot_write_ix(struct ocelot *ocelot, u32 val, u32 reg, u32 offset); + void __ocelot_rmw_ix(struct ocelot *ocelot, u32 val, u32 mask, u32 reg, +@@ -731,6 +732,7 @@ int ocelot_get_sset_count(struct ocelot *ocelot, int port, int sset); + int ocelot_get_ts_info(struct ocelot *ocelot, int port, + struct ethtool_ts_info *info); + void ocelot_set_ageing_time(struct ocelot *ocelot, unsigned int msecs); ++int ocelot_port_flush(struct ocelot *ocelot, int port); + void ocelot_adjust_link(struct ocelot *ocelot, int port, + struct phy_device *phydev); + int ocelot_port_vlan_filtering(struct ocelot *ocelot, int port, bool enabled, +-- +2.27.0 + diff --git a/queue-5.10/net-enetc-initialize-the-rfs-and-rss-memories.patch b/queue-5.10/net-enetc-initialize-the-rfs-and-rss-memories.patch new file mode 100644 index 00000000000..cc8279f60c3 --- /dev/null +++ b/queue-5.10/net-enetc-initialize-the-rfs-and-rss-memories.patch @@ -0,0 +1,162 @@ +From e9ac6d084519e37806fbbb59eb3772229b95cff7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Feb 2021 15:45:11 +0200 +Subject: net: enetc: initialize the RFS and RSS memories + +From: Vladimir Oltean + +[ Upstream commit 07bf34a50e327975b21a9dee64d220c3dcb72ee9 ] + +Michael tried to enable Advanced Error Reporting through the ENETC's +Root Complex Event Collector, and the system started spitting out single +bit correctable ECC errors coming from the ENETC interfaces: + +pcieport 0000:00:1f.0: AER: Multiple Corrected error received: 0000:00:00.0 +fsl_enetc 0000:00:00.0: PCIe Bus Error: severity=Corrected, type=Transaction Layer, (Receiver ID) +fsl_enetc 0000:00:00.0: device [1957:e100] error status/mask=00004000/00000000 +fsl_enetc 0000:00:00.0: [14] CorrIntErr +fsl_enetc 0000:00:00.1: PCIe Bus Error: severity=Corrected, type=Transaction Layer, (Receiver ID) +fsl_enetc 0000:00:00.1: device [1957:e100] error status/mask=00004000/00000000 +fsl_enetc 0000:00:00.1: [14] CorrIntErr + +Further investigating the port correctable memory error detect register +(PCMEDR) shows that these AER errors have an associated SOURCE_ID of 6 +(RFS/RSS): + +$ devmem 0x1f8010e10 32 +0xC0000006 +$ devmem 0x1f8050e10 32 +0xC0000006 + +Discussion with the hardware design engineers reveals that on LS1028A, +the hardware does not do initialization of that RFS/RSS memory, and that +software should clear/initialize the entire table before starting to +operate. That comes as a bit of a surprise, since the driver does not do +initialization of the RFS memory. Also, the initialization of the +Receive Side Scaling is done only partially. + +Even though the entire ENETC IP has a single shared flow steering +memory, the flow steering service should returns matches only for TCAM +entries that are within the range of the Station Interface that is doing +the search. Therefore, it should be sufficient for a Station Interface +to initialize all of its own entries in order to avoid any ECC errors, +and only the Station Interfaces in use should need initialization. + +There are Physical Station Interfaces associated with PCIe PFs and +Virtual Station Interfaces associated with PCIe VFs. We let the PF +driver initialize the entire port's memory, which includes the RFS +entries which are going to be used by the VF. + +Reported-by: Michael Walle +Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers") +Signed-off-by: Vladimir Oltean +Tested-by: Michael Walle +Reviewed-by: Jesse Brandeburg +Link: https://lore.kernel.org/r/20210204134511.2640309-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/freescale/enetc/enetc_hw.h | 2 + + .../net/ethernet/freescale/enetc/enetc_pf.c | 59 +++++++++++++++++++ + 2 files changed, 61 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_hw.h b/drivers/net/ethernet/freescale/enetc/enetc_hw.h +index 4cbf1667d7ff4..014ca6ae121f8 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_hw.h ++++ b/drivers/net/ethernet/freescale/enetc/enetc_hw.h +@@ -196,6 +196,8 @@ enum enetc_bdr_type {TX, RX}; + #define ENETC_CBS_BW_MASK GENMASK(6, 0) + #define ENETC_PTCCBSR1(n) (0x1114 + (n) * 8) /* n = 0 to 7*/ + #define ENETC_RSSHASH_KEY_SIZE 40 ++#define ENETC_PRSSCAPR 0x1404 ++#define ENETC_PRSSCAPR_GET_NUM_RSS(val) (BIT((val) & 0xf) * 32) + #define ENETC_PRSSK(n) (0x1410 + (n) * 4) /* n = [0..9] */ + #define ENETC_PSIVLANFMR 0x1700 + #define ENETC_PSIVLANFMR_VS BIT(0) +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c +index 419306342ac51..06514af0df106 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c +@@ -1004,6 +1004,51 @@ static void enetc_phylink_destroy(struct enetc_ndev_priv *priv) + phylink_destroy(priv->phylink); + } + ++/* Initialize the entire shared memory for the flow steering entries ++ * of this port (PF + VFs) ++ */ ++static int enetc_init_port_rfs_memory(struct enetc_si *si) ++{ ++ struct enetc_cmd_rfse rfse = {0}; ++ struct enetc_hw *hw = &si->hw; ++ int num_rfs, i, err = 0; ++ u32 val; ++ ++ val = enetc_port_rd(hw, ENETC_PRFSCAPR); ++ num_rfs = ENETC_PRFSCAPR_GET_NUM_RFS(val); ++ ++ for (i = 0; i < num_rfs; i++) { ++ err = enetc_set_fs_entry(si, &rfse, i); ++ if (err) ++ break; ++ } ++ ++ return err; ++} ++ ++static int enetc_init_port_rss_memory(struct enetc_si *si) ++{ ++ struct enetc_hw *hw = &si->hw; ++ int num_rss, err; ++ int *rss_table; ++ u32 val; ++ ++ val = enetc_port_rd(hw, ENETC_PRSSCAPR); ++ num_rss = ENETC_PRSSCAPR_GET_NUM_RSS(val); ++ if (!num_rss) ++ return 0; ++ ++ rss_table = kcalloc(num_rss, sizeof(*rss_table), GFP_KERNEL); ++ if (!rss_table) ++ return -ENOMEM; ++ ++ err = enetc_set_rss_table(si, rss_table, num_rss); ++ ++ kfree(rss_table); ++ ++ return err; ++} ++ + static int enetc_pf_probe(struct pci_dev *pdev, + const struct pci_device_id *ent) + { +@@ -1058,6 +1103,18 @@ static int enetc_pf_probe(struct pci_dev *pdev, + goto err_alloc_si_res; + } + ++ err = enetc_init_port_rfs_memory(si); ++ if (err) { ++ dev_err(&pdev->dev, "Failed to initialize RFS memory\n"); ++ goto err_init_port_rfs; ++ } ++ ++ err = enetc_init_port_rss_memory(si); ++ if (err) { ++ dev_err(&pdev->dev, "Failed to initialize RSS memory\n"); ++ goto err_init_port_rss; ++ } ++ + err = enetc_alloc_msix(priv); + if (err) { + dev_err(&pdev->dev, "MSIX alloc failed\n"); +@@ -1086,6 +1143,8 @@ err_phylink_create: + enetc_mdiobus_destroy(pf); + err_mdiobus_create: + enetc_free_msix(priv); ++err_init_port_rss: ++err_init_port_rfs: + err_alloc_msix: + enetc_free_si_resources(priv); + err_alloc_si_res: +-- +2.27.0 + diff --git a/queue-5.10/net-hdlc_x25-return-meaningful-error-code-in-x25_ope.patch b/queue-5.10/net-hdlc_x25-return-meaningful-error-code-in-x25_ope.patch new file mode 100644 index 00000000000..60bad79fa58 --- /dev/null +++ b/queue-5.10/net-hdlc_x25-return-meaningful-error-code-in-x25_ope.patch @@ -0,0 +1,55 @@ +From 59b1ae81cab7fedc4d8c678c10762f83c85b2263 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Feb 2021 23:15:41 -0800 +Subject: net: hdlc_x25: Return meaningful error code in x25_open + +From: Xie He + +[ Upstream commit 81b8be68ef8e8915d0cc6cedd2ac425c74a24813 ] + +It's not meaningful to pass on LAPB error codes to HDLC code or other +parts of the system, because they will not understand the error codes. + +Instead, use system-wide recognizable error codes. + +Fixes: f362e5fe0f1f ("wan/hdlc_x25: make lapb params configurable") +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Xie He +Acked-by: Martin Schiller +Link: https://lore.kernel.org/r/20210203071541.86138-1-xie.he.0141@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/wan/hdlc_x25.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c +index f52b9fed05931..34bc53facd11c 100644 +--- a/drivers/net/wan/hdlc_x25.c ++++ b/drivers/net/wan/hdlc_x25.c +@@ -171,11 +171,11 @@ static int x25_open(struct net_device *dev) + + result = lapb_register(dev, &cb); + if (result != LAPB_OK) +- return result; ++ return -ENOMEM; + + result = lapb_getparms(dev, ¶ms); + if (result != LAPB_OK) +- return result; ++ return -EINVAL; + + if (state(hdlc)->settings.dce) + params.mode = params.mode | LAPB_DCE; +@@ -190,7 +190,7 @@ static int x25_open(struct net_device *dev) + + result = lapb_setparms(dev, ¶ms); + if (result != LAPB_OK) +- return result; ++ return -EINVAL; + + return 0; + } +-- +2.27.0 + diff --git a/queue-5.10/net-hns3-add-a-check-for-index-in-hclge_get_rss_key.patch b/queue-5.10/net-hns3-add-a-check-for-index-in-hclge_get_rss_key.patch new file mode 100644 index 00000000000..f446e3a5218 --- /dev/null +++ b/queue-5.10/net-hns3-add-a-check-for-index-in-hclge_get_rss_key.patch @@ -0,0 +1,47 @@ +From dbf192ec038e115629b3fd34bf20c7df5a54107a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 17:03:07 +0800 +Subject: net: hns3: add a check for index in hclge_get_rss_key() + +From: Yufeng Mo + +[ Upstream commit 532cfc0df1e4d68e74522ef4a0dcbf6ebbe68287 ] + +The index is received from vf, if use it directly, +an out-of-bound issue may be caused, so add a check for +this index before using it in hclge_get_rss_key(). + +Fixes: a638b1d8cc87 ("net: hns3: fix get VF RSS issue") +Signed-off-by: Yufeng Mo +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +index c997c90371550..9c8004fc9dc4f 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +@@ -591,6 +591,17 @@ static void hclge_get_rss_key(struct hclge_vport *vport, + + index = mbx_req->msg.data[0]; + ++ /* Check the query index of rss_hash_key from VF, make sure no ++ * more than the size of rss_hash_key. ++ */ ++ if (((index + 1) * HCLGE_RSS_MBX_RESP_LEN) > ++ sizeof(vport[0].rss_hash_key)) { ++ dev_warn(&hdev->pdev->dev, ++ "failed to get the rss hash key, the index(%u) invalid !\n", ++ index); ++ return; ++ } ++ + memcpy(resp_msg->data, + &hdev->vport[0].rss_hash_key[index * HCLGE_RSS_MBX_RESP_LEN], + HCLGE_RSS_MBX_RESP_LEN); +-- +2.27.0 + diff --git a/queue-5.10/net-hns3-add-a-check-for-queue_id-in-hclge_reset_vf_.patch b/queue-5.10/net-hns3-add-a-check-for-queue_id-in-hclge_reset_vf_.patch new file mode 100644 index 00000000000..185b35a2918 --- /dev/null +++ b/queue-5.10/net-hns3-add-a-check-for-queue_id-in-hclge_reset_vf_.patch @@ -0,0 +1,49 @@ +From 3b8614e887498680a37e0ffe1b1cf1f8a9a4bc75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 17:03:05 +0800 +Subject: net: hns3: add a check for queue_id in hclge_reset_vf_queue() + +From: Yufeng Mo + +[ Upstream commit 67a69f84cab60484f02eb8cbc7a76edffbb28a25 ] + +The queue_id is received from vf, if use it directly, +an out-of-bound issue may be caused, so add a check for +this queue_id before using it in hclge_reset_vf_queue(). + +Fixes: 1a426f8b40fc ("net: hns3: fix the VF queue reset flow error") +Signed-off-by: Yufeng Mo +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 4321132a4f630..c40820baf48a6 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -9404,12 +9404,19 @@ int hclge_reset_tqp(struct hnae3_handle *handle, u16 queue_id) + + void hclge_reset_vf_queue(struct hclge_vport *vport, u16 queue_id) + { ++ struct hnae3_handle *handle = &vport->nic; + struct hclge_dev *hdev = vport->back; + int reset_try_times = 0; + int reset_status; + u16 queue_gid; + int ret; + ++ if (queue_id >= handle->kinfo.num_tqps) { ++ dev_warn(&hdev->pdev->dev, "Invalid vf queue id(%u)\n", ++ queue_id); ++ return; ++ } ++ + queue_gid = hclge_covert_handle_qid_global(&vport->nic, queue_id); + + ret = hclge_send_reset_tqp_cmd(hdev, queue_gid, true); +-- +2.27.0 + diff --git a/queue-5.10/net-hns3-add-a-check-for-tqp_index-in-hclge_get_ring.patch b/queue-5.10/net-hns3-add-a-check-for-tqp_index-in-hclge_get_ring.patch new file mode 100644 index 00000000000..80aa0b3f72f --- /dev/null +++ b/queue-5.10/net-hns3-add-a-check-for-tqp_index-in-hclge_get_ring.patch @@ -0,0 +1,66 @@ +From 0649776003cebc1fa8f0b65b426ab7489fa3419a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 17:03:06 +0800 +Subject: net: hns3: add a check for tqp_index in + hclge_get_ring_chain_from_mbx() + +From: Yufeng Mo + +[ Upstream commit 326334aad024a60f46dc5e7dbe1efe32da3ca66f ] + +The tqp_index is received from vf, if use it directly, +an out-of-bound issue may be caused, so add a check for +this tqp_index before using it in hclge_get_ring_chain_from_mbx(). + +Fixes: 84e095d64ed9 ("net: hns3: Change PF to add ring-vect binding & resetQ to mailbox") +Signed-off-by: Yufeng Mo +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +index 3ab6db2588d31..c997c90371550 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +@@ -158,21 +158,31 @@ static int hclge_get_ring_chain_from_mbx( + struct hclge_vport *vport) + { + struct hnae3_ring_chain_node *cur_chain, *new_chain; ++ struct hclge_dev *hdev = vport->back; + int ring_num; +- int i = 0; ++ int i; + + ring_num = req->msg.ring_num; + + if (ring_num > HCLGE_MBX_MAX_RING_CHAIN_PARAM_NUM) + return -ENOMEM; + ++ for (i = 0; i < ring_num; i++) { ++ if (req->msg.param[i].tqp_index >= vport->nic.kinfo.rss_size) { ++ dev_err(&hdev->pdev->dev, "tqp index(%u) is out of range(0-%u)\n", ++ req->msg.param[i].tqp_index, ++ vport->nic.kinfo.rss_size - 1); ++ return -EINVAL; ++ } ++ } ++ + hnae3_set_bit(ring_chain->flag, HNAE3_RING_TYPE_B, +- req->msg.param[i].ring_type); ++ req->msg.param[0].ring_type); + ring_chain->tqp_index = + hclge_get_queue_id(vport->nic.kinfo.tqp +- [req->msg.param[i].tqp_index]); ++ [req->msg.param[0].tqp_index]); + hnae3_set_field(ring_chain->int_gl_idx, HNAE3_RING_GL_IDX_M, +- HNAE3_RING_GL_IDX_S, req->msg.param[i].int_gl_index); ++ HNAE3_RING_GL_IDX_S, req->msg.param[0].int_gl_index); + + cur_chain = ring_chain; + +-- +2.27.0 + diff --git a/queue-5.10/net-ipa-set-error-code-in-gsi_channel_setup.patch b/queue-5.10/net-ipa-set-error-code-in-gsi_channel_setup.patch new file mode 100644 index 00000000000..f32131d423b --- /dev/null +++ b/queue-5.10/net-ipa-set-error-code-in-gsi_channel_setup.patch @@ -0,0 +1,39 @@ +From 61fdd785b8df62daa6c0cb94fe88145500b722ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Feb 2021 19:06:55 -0600 +Subject: net: ipa: set error code in gsi_channel_setup() + +From: Alex Elder + +[ Upstream commit 1d23a56b0296d29e7047b41fe0a42a001036160d ] + +In gsi_channel_setup(), we check to see if the configuration data +contains any information about channels that are not supported by +the hardware. If one is found, we abort the setup process, but +the error code (ret) is not set in this case. Fix this bug. + +Fixes: 650d1603825d8 ("soc: qcom: ipa: the generic software interface") +Reported-by: Dan Carpenter +Signed-off-by: Alex Elder +Link: https://lore.kernel.org/r/20210204010655.15619-1-elder@linaro.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ipa/gsi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ipa/gsi.c b/drivers/net/ipa/gsi.c +index 4a68da7115d19..2a65efd3e8da9 100644 +--- a/drivers/net/ipa/gsi.c ++++ b/drivers/net/ipa/gsi.c +@@ -1573,6 +1573,7 @@ static int gsi_channel_setup(struct gsi *gsi, bool legacy) + if (!channel->gsi) + continue; /* Ignore uninitialized channels */ + ++ ret = -EINVAL; + dev_err(gsi->dev, "channel %u not supported by hardware\n", + channel_id - 1); + channel_id = gsi->channel_count; +-- +2.27.0 + diff --git a/queue-5.10/net-stmmac-set-txq-mode-back-to-dcb-after-disabling-.patch b/queue-5.10/net-stmmac-set-txq-mode-back-to-dcb-after-disabling-.patch new file mode 100644 index 00000000000..20f45b3106e --- /dev/null +++ b/queue-5.10/net-stmmac-set-txq-mode-back-to-dcb-after-disabling-.patch @@ -0,0 +1,52 @@ +From 24742f3976c97ab02cda64ada1daa78f6426fafb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Feb 2021 22:03:16 +0800 +Subject: net: stmmac: set TxQ mode back to DCB after disabling CBS + +From: Mohammad Athari Bin Ismail + +[ Upstream commit f317e2ea8c88737aa36228167b2292baef3f0430 ] + +When disable CBS, mode_to_use parameter is not updated even the operation +mode of Tx Queue is changed to Data Centre Bridging (DCB). Therefore, +when tc_setup_cbs() function is called to re-enable CBS, the operation +mode of Tx Queue remains at DCB, which causing CBS fails to work. + +This patch updates the value of mode_to_use parameter to MTL_QUEUE_DCB +after operation mode of Tx Queue is changed to DCB in stmmac_dma_qmode() +callback function. + +Fixes: 1f705bc61aee ("net: stmmac: Add support for CBS QDISC") +Suggested-by: Vinicius Costa Gomes +Signed-off-by: Mohammad Athari Bin Ismail +Signed-off-by: Song, Yoong Siang +Reviewed-by: Jesse Brandeburg +Acked-by: Vinicius Costa Gomes +Link: https://lore.kernel.org/r/1612447396-20351-1-git-send-email-yoong.siang.song@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +index 06553d028d746..6088071cb1923 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +@@ -330,7 +330,12 @@ static int tc_setup_cbs(struct stmmac_priv *priv, + + priv->plat->tx_queues_cfg[queue].mode_to_use = MTL_QUEUE_AVB; + } else if (!qopt->enable) { +- return stmmac_dma_qmode(priv, priv->ioaddr, queue, MTL_QUEUE_DCB); ++ ret = stmmac_dma_qmode(priv, priv->ioaddr, queue, ++ MTL_QUEUE_DCB); ++ if (ret) ++ return ret; ++ ++ priv->plat->tx_queues_cfg[queue].mode_to_use = MTL_QUEUE_DCB; + } + + /* Port Transmit Rate and Speed Divider */ +-- +2.27.0 + diff --git a/queue-5.10/netfilter-conntrack-skip-identical-origin-tuple-in-s.patch b/queue-5.10/netfilter-conntrack-skip-identical-origin-tuple-in-s.patch new file mode 100644 index 00000000000..b1aab8f6b86 --- /dev/null +++ b/queue-5.10/netfilter-conntrack-skip-identical-origin-tuple-in-s.patch @@ -0,0 +1,43 @@ +From 7760b03753f29c63c2726311c5c66027c440b275 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Feb 2021 12:56:43 +0100 +Subject: netfilter: conntrack: skip identical origin tuple in same zone only + +From: Florian Westphal + +[ Upstream commit 07998281c268592963e1cd623fe6ab0270b65ae4 ] + +The origin skip check needs to re-test the zone. Else, we might skip +a colliding tuple in the reply direction. + +This only occurs when using 'directional zones' where origin tuples +reside in different zones but the reply tuples share the same zone. + +This causes the new conntrack entry to be dropped at confirmation time +because NAT clash resolution was elided. + +Fixes: 4e35c1cb9460240 ("netfilter: nf_nat: skip nat clash resolution for same-origin entries") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index 234b7cab37c30..ff0168736f6ea 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -1229,7 +1229,8 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple, + * Let nf_ct_resolve_clash() deal with this later. + */ + if (nf_ct_tuple_equal(&ignored_conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple, +- &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple)) ++ &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple) && ++ nf_ct_zone_equal(ct, zone, IP_CT_DIR_ORIGINAL)) + continue; + + NF_CT_STAT_INC_ATOMIC(net, found); +-- +2.27.0 + diff --git a/queue-5.10/netfilter-flowtable-fix-tcp-and-udp-header-checksum-.patch b/queue-5.10/netfilter-flowtable-fix-tcp-and-udp-header-checksum-.patch new file mode 100644 index 00000000000..7c18390f066 --- /dev/null +++ b/queue-5.10/netfilter-flowtable-fix-tcp-and-udp-header-checksum-.patch @@ -0,0 +1,54 @@ +From cd02e627cd67f64ab6bacc63b93fa5b166644c40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Feb 2021 18:01:16 +0100 +Subject: netfilter: flowtable: fix tcp and udp header checksum update + +From: Sven Auhagen + +[ Upstream commit 8d6bca156e47d68551750a384b3ff49384c67be3 ] + +When updating the tcp or udp header checksum on port nat the function +inet_proto_csum_replace2 with the last parameter pseudohdr as true. +This leads to an error in the case that GRO is used and packets are +split up in GSO. The tcp or udp checksum of all packets is incorrect. + +The error is probably masked due to the fact the most network driver +implement tcp/udp checksum offloading. It also only happens when GRO is +applied and not on single packets. + +The error is most visible when using a pppoe connection which is not +triggering the tcp/udp checksum offload. + +Fixes: ac2a66665e23 ("netfilter: add generic flow table infrastructure") +Signed-off-by: Sven Auhagen +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_flow_table_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c +index 513f78db3cb2f..4a4acbba78ff7 100644 +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -399,7 +399,7 @@ static int nf_flow_nat_port_tcp(struct sk_buff *skb, unsigned int thoff, + return -1; + + tcph = (void *)(skb_network_header(skb) + thoff); +- inet_proto_csum_replace2(&tcph->check, skb, port, new_port, true); ++ inet_proto_csum_replace2(&tcph->check, skb, port, new_port, false); + + return 0; + } +@@ -415,7 +415,7 @@ static int nf_flow_nat_port_udp(struct sk_buff *skb, unsigned int thoff, + udph = (void *)(skb_network_header(skb) + thoff); + if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) { + inet_proto_csum_replace2(&udph->check, skb, port, +- new_port, true); ++ new_port, false); + if (!udph->check) + udph->check = CSUM_MANGLED_0; + } +-- +2.27.0 + diff --git a/queue-5.10/netfilter-nftables-fix-possible-uaf-over-chains-from.patch b/queue-5.10/netfilter-nftables-fix-possible-uaf-over-chains-from.patch new file mode 100644 index 00000000000..6d6b41fd377 --- /dev/null +++ b/queue-5.10/netfilter-nftables-fix-possible-uaf-over-chains-from.patch @@ -0,0 +1,88 @@ +From d56326dca321dbef2990181245ce446fcdd6769a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Feb 2021 16:07:37 +0100 +Subject: netfilter: nftables: fix possible UAF over chains from packet path in + netns + +From: Pablo Neira Ayuso + +[ Upstream commit 767d1216bff82507c945e92fe719dff2083bb2f4 ] + +Although hooks are released via call_rcu(), chain and rule objects are +immediately released while packets are still walking over these bits. + +This patch adds the .pre_exit callback which is invoked before +synchronize_rcu() in the netns framework to stay safe. + +Remove a comment which is not valid anymore since the core does not use +synchronize_net() anymore since 8c873e219970 ("netfilter: core: free +hooks with call_rcu"). + +Suggested-by: Florian Westphal +Fixes: df05ef874b28 ("netfilter: nf_tables: release objects on netns destruction") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 25 +++++++++++++++++++------ + 1 file changed, 19 insertions(+), 6 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 9a080767667b7..8739ef135156b 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -8775,6 +8775,17 @@ int __nft_release_basechain(struct nft_ctx *ctx) + } + EXPORT_SYMBOL_GPL(__nft_release_basechain); + ++static void __nft_release_hooks(struct net *net) ++{ ++ struct nft_table *table; ++ struct nft_chain *chain; ++ ++ list_for_each_entry(table, &net->nft.tables, list) { ++ list_for_each_entry(chain, &table->chains, list) ++ nf_tables_unregister_hook(net, table, chain); ++ } ++} ++ + static void __nft_release_tables(struct net *net) + { + struct nft_flowtable *flowtable, *nf; +@@ -8790,10 +8801,6 @@ static void __nft_release_tables(struct net *net) + + list_for_each_entry_safe(table, nt, &net->nft.tables, list) { + ctx.family = table->family; +- +- list_for_each_entry(chain, &table->chains, list) +- nf_tables_unregister_hook(net, table, chain); +- /* No packets are walking on these chains anymore. */ + ctx.table = table; + list_for_each_entry(chain, &table->chains, list) { + ctx.chain = chain; +@@ -8842,6 +8849,11 @@ static int __net_init nf_tables_init_net(struct net *net) + return 0; + } + ++static void __net_exit nf_tables_pre_exit_net(struct net *net) ++{ ++ __nft_release_hooks(net); ++} ++ + static void __net_exit nf_tables_exit_net(struct net *net) + { + mutex_lock(&net->nft.commit_mutex); +@@ -8855,8 +8867,9 @@ static void __net_exit nf_tables_exit_net(struct net *net) + } + + static struct pernet_operations nf_tables_net_ops = { +- .init = nf_tables_init_net, +- .exit = nf_tables_exit_net, ++ .init = nf_tables_init_net, ++ .pre_exit = nf_tables_pre_exit_net, ++ .exit = nf_tables_exit_net, + }; + + static int __init nf_tables_module_init(void) +-- +2.27.0 + diff --git a/queue-5.10/netfilter-xt_recent-fix-attempt-to-update-deleted-en.patch b/queue-5.10/netfilter-xt_recent-fix-attempt-to-update-deleted-en.patch new file mode 100644 index 00000000000..00939d821f2 --- /dev/null +++ b/queue-5.10/netfilter-xt_recent-fix-attempt-to-update-deleted-en.patch @@ -0,0 +1,66 @@ +From c12a2b3b47309bfbfd2ae06bca190ec705740b45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Jan 2021 20:57:43 +0100 +Subject: netfilter: xt_recent: Fix attempt to update deleted entry + +From: Jozsef Kadlecsik + +[ Upstream commit b1bdde33b72366da20d10770ab7a49fe87b5e190 ] + +When both --reap and --update flag are specified, there's a code +path at which the entry to be updated is reaped beforehand, +which then leads to kernel crash. Reap only entries which won't be +updated. + +Fixes kernel bugzilla #207773. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=207773 +Reported-by: Reindl Harald +Fixes: 0079c5aee348 ("netfilter: xt_recent: add an entry reaper") +Signed-off-by: Jozsef Kadlecsik +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/xt_recent.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c +index 606411869698e..0446307516cdf 100644 +--- a/net/netfilter/xt_recent.c ++++ b/net/netfilter/xt_recent.c +@@ -152,7 +152,8 @@ static void recent_entry_remove(struct recent_table *t, struct recent_entry *e) + /* + * Drop entries with timestamps older then 'time'. + */ +-static void recent_entry_reap(struct recent_table *t, unsigned long time) ++static void recent_entry_reap(struct recent_table *t, unsigned long time, ++ struct recent_entry *working, bool update) + { + struct recent_entry *e; + +@@ -161,6 +162,12 @@ static void recent_entry_reap(struct recent_table *t, unsigned long time) + */ + e = list_entry(t->lru_list.next, struct recent_entry, lru_list); + ++ /* ++ * Do not reap the entry which are going to be updated. ++ */ ++ if (e == working && update) ++ return; ++ + /* + * The last time stamp is the most recent. + */ +@@ -303,7 +310,8 @@ recent_mt(const struct sk_buff *skb, struct xt_action_param *par) + + /* info->seconds must be non-zero */ + if (info->check_set & XT_RECENT_REAP) +- recent_entry_reap(t, time); ++ recent_entry_reap(t, time, e, ++ info->check_set & XT_RECENT_UPDATE && ret); + } + + if (info->check_set & XT_RECENT_SET || +-- +2.27.0 + diff --git a/queue-5.10/scsi-scsi_debug-fix-a-memory-leak.patch b/queue-5.10/scsi-scsi_debug-fix-a-memory-leak.patch new file mode 100644 index 00000000000..60093d434ba --- /dev/null +++ b/queue-5.10/scsi-scsi_debug-fix-a-memory-leak.patch @@ -0,0 +1,51 @@ +From 13dfd3314563746b11b3e78dcea6d0f30bfec958 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Feb 2021 12:17:34 +0100 +Subject: scsi: scsi_debug: Fix a memory leak + +From: Maurizio Lombardi + +[ Upstream commit f852c596f2ee6f0eb364ea8f28f89da6da0ae7b5 ] + +The sdebug_q_arr pointer must be freed when the module is unloaded. + +$ cat /sys/kernel/debug/kmemleak +unreferenced object 0xffff888e1cfb0000 (size 4096): + comm "modprobe", pid 165555, jiffies 4325987516 (age 685.194s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<00000000458f4f5d>] 0xffffffffc06702d9 + [<000000003edc4b1f>] do_one_initcall+0xe9/0x57d + [<00000000da7d518c>] do_init_module+0x1d1/0x6f0 + [<000000009a6a9248>] load_module+0x36bd/0x4f50 + [<00000000ddb0c3ce>] __do_sys_init_module+0x1db/0x260 + [<000000009532db57>] do_syscall_64+0xa5/0x420 + [<000000002916b13d>] entry_SYSCALL_64_after_hwframe+0x6a/0xdf + +Fixes: 87c715dcde63 ("scsi: scsi_debug: Add per_host_store option") +Link: https://lore.kernel.org/r/20210208111734.34034-1-mlombard@redhat.com +Acked-by: Douglas Gilbert +Signed-off-by: Maurizio Lombardi +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_debug.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c +index 4a08c450b756f..b6540b92f5661 100644 +--- a/drivers/scsi/scsi_debug.c ++++ b/drivers/scsi/scsi_debug.c +@@ -6881,6 +6881,7 @@ static void __exit scsi_debug_exit(void) + + sdebug_erase_all_stores(false); + xa_destroy(per_store_ap); ++ kfree(sdebug_q_arr); + } + + device_initcall(scsi_debug_init); +-- +2.27.0 + diff --git a/queue-5.10/selftests-netfilter-fix-current-year.patch b/queue-5.10/selftests-netfilter-fix-current-year.patch new file mode 100644 index 00000000000..b65e298e0da --- /dev/null +++ b/queue-5.10/selftests-netfilter-fix-current-year.patch @@ -0,0 +1,37 @@ +From 1aba20a562bf56d6da7310f1fd4483104e6c0d57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Jan 2021 11:14:25 +0100 +Subject: selftests: netfilter: fix current year + +From: Fabian Frederick + +[ Upstream commit a3005b0f83f217c888393c6bf9cd36e3d1616bca ] + +use date %Y instead of %G to read current year +Problem appeared when running lkp-tests on 01/01/2021 + +Fixes: 48d072c4e8cd ("selftests: netfilter: add time counter check") +Reported-by: kernel test robot +Signed-off-by: Fabian Frederick +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/netfilter/nft_meta.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/netfilter/nft_meta.sh b/tools/testing/selftests/netfilter/nft_meta.sh +index 087f0e6e71ce7..f33154c04d344 100755 +--- a/tools/testing/selftests/netfilter/nft_meta.sh ++++ b/tools/testing/selftests/netfilter/nft_meta.sh +@@ -23,7 +23,7 @@ ip -net "$ns0" addr add 127.0.0.1 dev lo + + trap cleanup EXIT + +-currentyear=$(date +%G) ++currentyear=$(date +%Y) + lastyear=$((currentyear-1)) + ip netns exec "$ns0" nft -f /dev/stdin < +Date: Thu, 4 Feb 2021 20:50:34 +0300 +Subject: selftests: txtimestamp: fix compilation issue + +From: Vadim Fedorenko + +[ Upstream commit 647b8dd5184665432cc8a2b5bca46a201f690c37 ] + +PACKET_TX_TIMESTAMP is defined in if_packet.h but it is not included in +test. Include it instead of otherwise the error of +redefinition arrives. +Also fix the compiler warning about ambiguous control flow by adding +explicit braces. + +Fixes: 8fe2f761cae9 ("net-timestamp: expand documentation") +Suggested-by: Willem de Bruijn +Signed-off-by: Vadim Fedorenko +Acked-by: Willem de Bruijn +Link: https://lore.kernel.org/r/1612461034-24524-1-git-send-email-vfedorenko@novek.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/txtimestamp.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/net/txtimestamp.c b/tools/testing/selftests/net/txtimestamp.c +index 490a8cca708a8..fabb1d555ee5c 100644 +--- a/tools/testing/selftests/net/txtimestamp.c ++++ b/tools/testing/selftests/net/txtimestamp.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -34,7 +35,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -495,12 +495,12 @@ static void do_test(int family, unsigned int report_opt) + total_len = cfg_payload_len; + if (cfg_use_pf_packet || cfg_proto == SOCK_RAW) { + total_len += sizeof(struct udphdr); +- if (cfg_use_pf_packet || cfg_ipproto == IPPROTO_RAW) ++ if (cfg_use_pf_packet || cfg_ipproto == IPPROTO_RAW) { + if (family == PF_INET) + total_len += sizeof(struct iphdr); + else + total_len += sizeof(struct ipv6hdr); +- ++ } + /* special case, only rawv6_sendmsg: + * pass proto in sin6_port if not connected + * also see ANK comment in net/ipv4/raw.c +-- +2.27.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 5ea6299bd1a..6da9cf89c95 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -47,3 +47,38 @@ x86-efi-remove-efi-pgd-build-time-checks.patch lkdtm-don-t-move-ctors-to-.rodata.patch arm64-mte-allow-ptrace_peekmtetags-access-to-the-zer.patch kvm-x86-cleanup-cr3-reserved-bits-checks.patch +cgroup-v1-add-disabled-controller-check-in-cgroup1_p.patch +dmaengine-idxd-fix-misc-interrupt-completion.patch +ath9k-fix-build-error-with-leds_class-m.patch +mt76-dma-fix-a-possible-memory-leak-in-mt76_add_frag.patch +drm-vc4-hvs-fix-buffer-overflow-with-the-dlist-handl.patch +dmaengine-idxd-check-device-state-before-issue-comma.patch +bpf-unbreak-bpf_prog_type_kprobe-when-kprobe-is-call.patch +bpf-check-for-integer-overflow-when-using-roundup_po.patch +netfilter-xt_recent-fix-attempt-to-update-deleted-en.patch +selftests-netfilter-fix-current-year.patch +netfilter-nftables-fix-possible-uaf-over-chains-from.patch +netfilter-flowtable-fix-tcp-and-udp-header-checksum-.patch +xen-netback-avoid-race-in-xenvif_rx_ring_slots_avail.patch +net-hdlc_x25-return-meaningful-error-code-in-x25_ope.patch +net-ipa-set-error-code-in-gsi_channel_setup.patch +hv_netvsc-reset-the-rsc-count-if-nvsp_stat_fail-in-n.patch +net-enetc-initialize-the-rfs-and-rss-memories.patch +selftests-txtimestamp-fix-compilation-issue.patch +net-stmmac-set-txq-mode-back-to-dcb-after-disabling-.patch +ibmvnic-clear-failover_pending-if-unable-to-schedule.patch +netfilter-conntrack-skip-identical-origin-tuple-in-s.patch +scsi-scsi_debug-fix-a-memory-leak.patch +x86-build-disable-cet-instrumentation-in-the-kernel-.patch +net-dsa-felix-implement-port-flushing-on-.phylink_ma.patch +net-hns3-add-a-check-for-queue_id-in-hclge_reset_vf_.patch +net-hns3-add-a-check-for-tqp_index-in-hclge_get_ring.patch +net-hns3-add-a-check-for-index-in-hclge_get_rss_key.patch +firmware_loader-align-.builtin_fw-to-8.patch +drm-sun4i-tcon-set-sync-polarity-for-tcon1-channel.patch +drm-sun4i-dw-hdmi-always-set-clock-rate.patch +drm-sun4i-fix-h6-hdmi-phy-configuration.patch +drm-sun4i-dw-hdmi-fix-max.-frequency-for-h6.patch +clk-sunxi-ng-mp-fix-parent-rate-change-flag-check.patch +i2c-stm32f7-fix-configuration-of-the-digital-filter.patch +h8300-fix-preemption-build-ti_pre_count-undefined.patch diff --git a/queue-5.10/x86-build-disable-cet-instrumentation-in-the-kernel-.patch b/queue-5.10/x86-build-disable-cet-instrumentation-in-the-kernel-.patch new file mode 100644 index 00000000000..256d63f0fff --- /dev/null +++ b/queue-5.10/x86-build-disable-cet-instrumentation-in-the-kernel-.patch @@ -0,0 +1,56 @@ +From ffa63377425cd852f6e35d1c9d614f0b043bb424 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Feb 2021 16:43:30 +0100 +Subject: x86/build: Disable CET instrumentation in the kernel for 32-bit too + +From: Borislav Petkov + +[ Upstream commit 256b92af784d5043eeb7d559b6d5963dcc2ecb10 ] + +Commit + + 20bf2b378729 ("x86/build: Disable CET instrumentation in the kernel") + +disabled CET instrumentation which gets added by default by the Ubuntu +gcc9 and 10 by default, but did that only for 64-bit builds. It would +still fail when building a 32-bit target. So disable CET for all x86 +builds. + +Fixes: 20bf2b378729 ("x86/build: Disable CET instrumentation in the kernel") +Reported-by: AC +Signed-off-by: Borislav Petkov +Acked-by: Josh Poimboeuf +Tested-by: AC +Link: https://lkml.kernel.org/r/YCCIgMHkzh/xT4ex@arch-chirva.localdomain +Signed-off-by: Sasha Levin +--- + arch/x86/Makefile | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/Makefile b/arch/x86/Makefile +index 6a7efa78eba22..0a6d497221e49 100644 +--- a/arch/x86/Makefile ++++ b/arch/x86/Makefile +@@ -57,6 +57,9 @@ export BITS + KBUILD_CFLAGS += -mno-sse -mno-mmx -mno-sse2 -mno-3dnow + KBUILD_CFLAGS += $(call cc-option,-mno-avx,) + ++# Intel CET isn't enabled in the kernel ++KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none) ++ + ifeq ($(CONFIG_X86_32),y) + BITS := 32 + UTS_MACHINE := i386 +@@ -127,9 +130,6 @@ else + + KBUILD_CFLAGS += -mno-red-zone + KBUILD_CFLAGS += -mcmodel=kernel +- +- # Intel CET isn't enabled in the kernel +- KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none) + endif + + ifdef CONFIG_X86_X32 +-- +2.27.0 + diff --git a/queue-5.10/xen-netback-avoid-race-in-xenvif_rx_ring_slots_avail.patch b/queue-5.10/xen-netback-avoid-race-in-xenvif_rx_ring_slots_avail.patch new file mode 100644 index 00000000000..386002a3c42 --- /dev/null +++ b/queue-5.10/xen-netback-avoid-race-in-xenvif_rx_ring_slots_avail.patch @@ -0,0 +1,58 @@ +From 92722f97078aa1c8c8446412377773962dc5e05c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Feb 2021 08:09:38 +0100 +Subject: xen/netback: avoid race in xenvif_rx_ring_slots_available() + +From: Juergen Gross + +[ Upstream commit ec7d8e7dd3a59528e305a18e93f1cb98f7faf83b ] + +Since commit 23025393dbeb3b8b3 ("xen/netback: use lateeoi irq binding") +xenvif_rx_ring_slots_available() is no longer called only from the rx +queue kernel thread, so it needs to access the rx queue with the +associated queue held. + +Reported-by: Igor Druzhinin +Fixes: 23025393dbeb3b8b3 ("xen/netback: use lateeoi irq binding") +Signed-off-by: Juergen Gross +Acked-by: Wei Liu +Link: https://lore.kernel.org/r/20210202070938.7863-1-jgross@suse.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/xen-netback/rx.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/xen-netback/rx.c b/drivers/net/xen-netback/rx.c +index b8febe1d1bfd3..accc991d153f7 100644 +--- a/drivers/net/xen-netback/rx.c ++++ b/drivers/net/xen-netback/rx.c +@@ -38,10 +38,15 @@ static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue) + RING_IDX prod, cons; + struct sk_buff *skb; + int needed; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&queue->rx_queue.lock, flags); + + skb = skb_peek(&queue->rx_queue); +- if (!skb) ++ if (!skb) { ++ spin_unlock_irqrestore(&queue->rx_queue.lock, flags); + return false; ++ } + + needed = DIV_ROUND_UP(skb->len, XEN_PAGE_SIZE); + if (skb_is_gso(skb)) +@@ -49,6 +54,8 @@ static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue) + if (skb->sw_hash) + needed++; + ++ spin_unlock_irqrestore(&queue->rx_queue.lock, flags); ++ + do { + prod = queue->rx.sring->req_prod; + cons = queue->rx.req_cons; +-- +2.27.0 +