From: Sasha Levin Date: Mon, 20 Sep 2021 15:39:39 +0000 (-0400) Subject: Fixes for 5.14 X-Git-Tag: v4.4.284~22 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=663a453b65297b10b40dd85268022f408e10fbd8;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.14 Signed-off-by: Sasha Levin --- diff --git a/queue-5.14/arc-export-clear_user_page-for-modules.patch b/queue-5.14/arc-export-clear_user_page-for-modules.patch new file mode 100644 index 00000000000..12e8f7cfc4a --- /dev/null +++ b/queue-5.14/arc-export-clear_user_page-for-modules.patch @@ -0,0 +1,45 @@ +From 8e6d5f1c6060d861e87c2f9c81d2411adea7a12f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Aug 2021 14:05:33 -0700 +Subject: ARC: export clear_user_page() for modules + +From: Randy Dunlap + +[ Upstream commit 6b5ff0405e4190f23780362ea324b250bc495683 ] + +0day bot reports a build error: + ERROR: modpost: "clear_user_page" [drivers/media/v4l2-core/videobuf-dma-sg.ko] undefined! +so export it in arch/arc/ to fix the build error. + +In most ARCHes, clear_user_page() is a macro. OTOH, in a few +ARCHes it is a function and needs to be exported. +PowerPC exported it in 2004. It looks like nds32 and nios2 +still need to have it exported. + +Fixes: 4102b53392d63 ("ARC: [mm] Aliasing VIPT dcache support 2/4") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Cc: Guenter Roeck +Cc: linux-snps-arc@lists.infradead.org +Signed-off-by: Vineet Gupta +Signed-off-by: Sasha Levin +--- + arch/arc/mm/cache.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c +index a2fbea3ee07c..102418ac5ff4 100644 +--- a/arch/arc/mm/cache.c ++++ b/arch/arc/mm/cache.c +@@ -1123,7 +1123,7 @@ void clear_user_page(void *to, unsigned long u_vaddr, struct page *page) + clear_page(to); + clear_bit(PG_dc_clean, &page->flags); + } +- ++EXPORT_SYMBOL(clear_user_page); + + /********************************************************************** + * Explicit Cache flush request from user space via syscall +-- +2.30.2 + diff --git a/queue-5.14/backlight-ktd253-stabilize-backlight.patch b/queue-5.14/backlight-ktd253-stabilize-backlight.patch new file mode 100644 index 00000000000..d48b6380a0e --- /dev/null +++ b/queue-5.14/backlight-ktd253-stabilize-backlight.patch @@ -0,0 +1,152 @@ +From f1dad4a3d40f09694e3b21c5cbbf9ccb0f1eb18c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jul 2021 13:36:36 +0200 +Subject: backlight: ktd253: Stabilize backlight + +From: Linus Walleij + +[ Upstream commit daa37361518bf2d1f591bbdaa7c68b2a43d7af48 ] + +Remove interrupt disablement during backlight setting. It is +way to dangerous and makes platforms instable by having it +miss vblank IRQs leading to the graphics derailing. + +The code is using ndelay() which is not available on +platforms such as ARM and will result in 32 * udelay(1) +which is substantial. + +Add some code to detect if an interrupt occurs during the +tight loop and in that case just redo it from the top. + +Fixes: 5317f37e48b9 ("backlight: Add Kinetic KTD253 backlight driver") +Cc: Stephan Gerhold +Reported-by: newbyte@disroot.org +Reviewed-by: Daniel Thompson +Signed-off-by: Linus Walleij +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/video/backlight/ktd253-backlight.c | 75 ++++++++++++++++------ + 1 file changed, 55 insertions(+), 20 deletions(-) + +diff --git a/drivers/video/backlight/ktd253-backlight.c b/drivers/video/backlight/ktd253-backlight.c +index a7df5bcca9da..37aa5a669530 100644 +--- a/drivers/video/backlight/ktd253-backlight.c ++++ b/drivers/video/backlight/ktd253-backlight.c +@@ -25,6 +25,7 @@ + + #define KTD253_T_LOW_NS (200 + 10) /* Additional 10ns as safety factor */ + #define KTD253_T_HIGH_NS (200 + 10) /* Additional 10ns as safety factor */ ++#define KTD253_T_OFF_CRIT_NS 100000 /* 100 us, now it doesn't look good */ + #define KTD253_T_OFF_MS 3 + + struct ktd253_backlight { +@@ -34,13 +35,50 @@ struct ktd253_backlight { + u16 ratio; + }; + ++static void ktd253_backlight_set_max_ratio(struct ktd253_backlight *ktd253) ++{ ++ gpiod_set_value_cansleep(ktd253->gpiod, 1); ++ ndelay(KTD253_T_HIGH_NS); ++ /* We always fall back to this when we power on */ ++} ++ ++static int ktd253_backlight_stepdown(struct ktd253_backlight *ktd253) ++{ ++ /* ++ * These GPIO operations absolutely can NOT sleep so no _cansleep ++ * suffixes, and no using GPIO expanders on slow buses for this! ++ * ++ * The maximum number of cycles of the loop is 32 so the time taken ++ * should nominally be: ++ * (T_LOW_NS + T_HIGH_NS + loop_time) * 32 ++ * ++ * Architectures do not always support ndelay() and we will get a few us ++ * instead. If we get to a critical time limit an interrupt has likely ++ * occured in the low part of the loop and we need to restart from the ++ * top so we have the backlight in a known state. ++ */ ++ u64 ns; ++ ++ ns = ktime_get_ns(); ++ gpiod_set_value(ktd253->gpiod, 0); ++ ndelay(KTD253_T_LOW_NS); ++ gpiod_set_value(ktd253->gpiod, 1); ++ ns = ktime_get_ns() - ns; ++ if (ns >= KTD253_T_OFF_CRIT_NS) { ++ dev_err(ktd253->dev, "PCM on backlight took too long (%llu ns)\n", ns); ++ return -EAGAIN; ++ } ++ ndelay(KTD253_T_HIGH_NS); ++ return 0; ++} ++ + static int ktd253_backlight_update_status(struct backlight_device *bl) + { + struct ktd253_backlight *ktd253 = bl_get_data(bl); + int brightness = backlight_get_brightness(bl); + u16 target_ratio; + u16 current_ratio = ktd253->ratio; +- unsigned long flags; ++ int ret; + + dev_dbg(ktd253->dev, "new brightness/ratio: %d/32\n", brightness); + +@@ -62,37 +100,34 @@ static int ktd253_backlight_update_status(struct backlight_device *bl) + } + + if (current_ratio == 0) { +- gpiod_set_value_cansleep(ktd253->gpiod, 1); +- ndelay(KTD253_T_HIGH_NS); +- /* We always fall back to this when we power on */ ++ ktd253_backlight_set_max_ratio(ktd253); + current_ratio = KTD253_MAX_RATIO; + } + +- /* +- * WARNING: +- * The loop to set the correct current level is performed +- * with interrupts disabled as it is timing critical. +- * The maximum number of cycles of the loop is 32 +- * so the time taken will be (T_LOW_NS + T_HIGH_NS + loop_time) * 32, +- */ +- local_irq_save(flags); + while (current_ratio != target_ratio) { + /* + * These GPIO operations absolutely can NOT sleep so no + * _cansleep suffixes, and no using GPIO expanders on + * slow buses for this! + */ +- gpiod_set_value(ktd253->gpiod, 0); +- ndelay(KTD253_T_LOW_NS); +- gpiod_set_value(ktd253->gpiod, 1); +- ndelay(KTD253_T_HIGH_NS); +- /* After 1/32 we loop back to 32/32 */ +- if (current_ratio == KTD253_MIN_RATIO) ++ ret = ktd253_backlight_stepdown(ktd253); ++ if (ret == -EAGAIN) { ++ /* ++ * Something disturbed the backlight setting code when ++ * running so we need to bring the PWM back to a known ++ * state. This shouldn't happen too much. ++ */ ++ gpiod_set_value_cansleep(ktd253->gpiod, 0); ++ msleep(KTD253_T_OFF_MS); ++ ktd253_backlight_set_max_ratio(ktd253); ++ current_ratio = KTD253_MAX_RATIO; ++ } else if (current_ratio == KTD253_MIN_RATIO) { ++ /* After 1/32 we loop back to 32/32 */ + current_ratio = KTD253_MAX_RATIO; +- else ++ } else { + current_ratio--; ++ } + } +- local_irq_restore(flags); + ktd253->ratio = current_ratio; + + dev_dbg(ktd253->dev, "new ratio set to %d/32\n", target_ratio); +-- +2.30.2 + diff --git a/queue-5.14/blkcg-fix-memory-leak-in-blk_iolatency_init.patch b/queue-5.14/blkcg-fix-memory-leak-in-blk_iolatency_init.patch new file mode 100644 index 00000000000..e4493d9bb5d --- /dev/null +++ b/queue-5.14/blkcg-fix-memory-leak-in-blk_iolatency_init.patch @@ -0,0 +1,80 @@ +From 4888e1f136844a3f399539357fdc480e816d2872 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Sep 2021 15:24:26 +0800 +Subject: blkcg: fix memory leak in blk_iolatency_init + +From: Yanfei Xu + +[ Upstream commit 6f5ddde41069fcd1f0993ec76c9dbbf9d021fd4d ] + +BUG: memory leak +unreferenced object 0xffff888129acdb80 (size 96): + comm "syz-executor.1", pid 12661, jiffies 4294962682 (age 15.220s) + hex dump (first 32 bytes): + 20 47 c9 85 ff ff ff ff 20 d4 8e 29 81 88 ff ff G...... ..).... + 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [] kmalloc include/linux/slab.h:591 [inline] + [] kzalloc include/linux/slab.h:721 [inline] + [] blk_iolatency_init+0x28/0x190 block/blk-iolatency.c:724 + [] blkcg_init_queue+0xb4/0x1c0 block/blk-cgroup.c:1185 + [] blk_alloc_queue+0x22a/0x2e0 block/blk-core.c:566 + [] blk_mq_init_queue_data block/blk-mq.c:3100 [inline] + [] __blk_mq_alloc_disk+0x25/0xd0 block/blk-mq.c:3124 + [] loop_add+0x1c3/0x360 drivers/block/loop.c:2344 + [] loop_control_get_free drivers/block/loop.c:2501 [inline] + [] loop_control_ioctl+0x17e/0x2e0 drivers/block/loop.c:2516 + [] vfs_ioctl fs/ioctl.c:51 [inline] + [] __do_sys_ioctl fs/ioctl.c:874 [inline] + [] __se_sys_ioctl fs/ioctl.c:860 [inline] + [] __x64_sys_ioctl+0xfc/0x140 fs/ioctl.c:860 + [] do_syscall_x64 arch/x86/entry/common.c:50 [inline] + [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 + [] entry_SYSCALL_64_after_hwframe+0x44/0xae + +Once blk_throtl_init() queue init failed, blkcg_iolatency_exit() will +not be invoked for cleanup. That leads a memory leak. Swap the +blk_throtl_init() and blk_iolatency_init() calls can solve this. + +Reported-by: syzbot+01321b15cc98e6bf96d6@syzkaller.appspotmail.com +Fixes: 19688d7f9592 (block/blk-cgroup: Swap the blk_throtl_init() and blk_iolatency_init() calls) +Signed-off-by: Yanfei Xu +Acked-by: Tejun Heo +Link: https://lore.kernel.org/r/20210915072426.4022924-1-yanfei.xu@windriver.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-cgroup.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 31fe9be179d9..26446f97deee 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -1201,10 +1201,6 @@ int blkcg_init_queue(struct request_queue *q) + if (preloaded) + radix_tree_preload_end(); + +- ret = blk_iolatency_init(q); +- if (ret) +- goto err_destroy_all; +- + ret = blk_ioprio_init(q); + if (ret) + goto err_destroy_all; +@@ -1213,6 +1209,12 @@ int blkcg_init_queue(struct request_queue *q) + if (ret) + goto err_destroy_all; + ++ ret = blk_iolatency_init(q); ++ if (ret) { ++ blk_throtl_exit(q); ++ goto err_destroy_all; ++ } ++ + return 0; + + err_destroy_all: +-- +2.30.2 + diff --git a/queue-5.14/block-bfq-honor-already-setup-queue-merges.patch b/queue-5.14/block-bfq-honor-already-setup-queue-merges.patch new file mode 100644 index 00000000000..582a2b6cf4b --- /dev/null +++ b/queue-5.14/block-bfq-honor-already-setup-queue-merges.patch @@ -0,0 +1,85 @@ +From 757574b0b51687473de1009bb5101ff1e464513b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Aug 2021 16:13:52 +0200 +Subject: block, bfq: honor already-setup queue merges + +From: Paolo Valente + +[ Upstream commit 2d52c58b9c9bdae0ca3df6a1eab5745ab3f7d80b ] + +The function bfq_setup_merge prepares the merging between two +bfq_queues, say bfqq and new_bfqq. To this goal, it assigns +bfqq->new_bfqq = new_bfqq. Then, each time some I/O for bfqq arrives, +the process that generated that I/O is disassociated from bfqq and +associated with new_bfqq (merging is actually a redirection). In this +respect, bfq_setup_merge increases new_bfqq->ref in advance, adding +the number of processes that are expected to be associated with +new_bfqq. + +Unfortunately, the stable-merging mechanism interferes with this +setup. After bfqq->new_bfqq has been set by bfq_setup_merge, and +before all the expected processes have been associated with +bfqq->new_bfqq, bfqq may happen to be stably merged with a different +queue than the current bfqq->new_bfqq. In this case, bfqq->new_bfqq +gets changed. So, some of the processes that have been already +accounted for in the ref counter of the previous new_bfqq will not be +associated with that queue. This creates an unbalance, because those +references will never be decremented. + +This commit fixes this issue by reestablishing the previous, natural +behaviour: once bfqq->new_bfqq has been set, it will not be changed +until all expected redirections have occurred. + +Signed-off-by: Davide Zini +Signed-off-by: Paolo Valente +Link: https://lore.kernel.org/r/20210802141352.74353-2-paolo.valente@linaro.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-iosched.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 9360c65169ff..3a1038b6eeb3 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -2662,6 +2662,15 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq) + * are likely to increase the throughput. + */ + bfqq->new_bfqq = new_bfqq; ++ /* ++ * The above assignment schedules the following redirections: ++ * each time some I/O for bfqq arrives, the process that ++ * generated that I/O is disassociated from bfqq and ++ * associated with new_bfqq. Here we increases new_bfqq->ref ++ * in advance, adding the number of processes that are ++ * expected to be associated with new_bfqq as they happen to ++ * issue I/O. ++ */ + new_bfqq->ref += process_refs; + return new_bfqq; + } +@@ -2724,6 +2733,10 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq, + { + struct bfq_queue *in_service_bfqq, *new_bfqq; + ++ /* if a merge has already been setup, then proceed with that first */ ++ if (bfqq->new_bfqq) ++ return bfqq->new_bfqq; ++ + /* + * Check delayed stable merge for rotational or non-queueing + * devs. For this branch to be executed, bfqq must not be +@@ -2825,9 +2838,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq, + if (bfq_too_late_for_merging(bfqq)) + return NULL; + +- if (bfqq->new_bfqq) +- return bfqq->new_bfqq; +- + if (!io_struct || unlikely(bfqq == &bfqd->oom_bfqq)) + return NULL; + +-- +2.30.2 + diff --git a/queue-5.14/bnxt_en-fix-asic.rev-in-devlink-dev-info-command.patch b/queue-5.14/bnxt_en-fix-asic.rev-in-devlink-dev-info-command.patch new file mode 100644 index 00000000000..497d8f6a4d5 --- /dev/null +++ b/queue-5.14/bnxt_en-fix-asic.rev-in-devlink-dev-info-command.patch @@ -0,0 +1,39 @@ +From 42e7bc5c6056783334c6cc58da0aa5f03956b8d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Sep 2021 14:10:57 -0400 +Subject: bnxt_en: Fix asic.rev in devlink dev info command + +From: Michael Chan + +[ Upstream commit 6fdab8a3ade2adc123bbf5c4fdec3394560b1fb1 ] + +The current asic.rev is incomplete and does not include the metal +revision. Add the metal revision and decode the complete asic +revision into the more common and readable form (A0, B0, etc). + +Fixes: 7154917a12b2 ("bnxt_en: Refactor bnxt_dl_info_get().") +Reviewed-by: Edwin Peer +Reviewed-by: Somnath Kotur +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c +index 8b7f6a0ad401..bb228619ec64 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c +@@ -449,7 +449,7 @@ static int bnxt_dl_info_get(struct devlink *dl, struct devlink_info_req *req, + return rc; + + ver_resp = &bp->ver_resp; +- sprintf(buf, "%X", ver_resp->chip_rev); ++ sprintf(buf, "%c%d", 'A' + ver_resp->chip_rev, ver_resp->chip_metal); + rc = bnxt_dl_info_put(bp, req, BNXT_VERSION_FIXED, + DEVLINK_INFO_VERSION_GENERIC_ASIC_REV, buf); + if (rc) +-- +2.30.2 + diff --git a/queue-5.14/bnxt_en-fix-possible-unintended-driver-initiated-err.patch b/queue-5.14/bnxt_en-fix-possible-unintended-driver-initiated-err.patch new file mode 100644 index 00000000000..ac20393074a --- /dev/null +++ b/queue-5.14/bnxt_en-fix-possible-unintended-driver-initiated-err.patch @@ -0,0 +1,96 @@ +From 186466376ac099868bc6908018216123bc0faebd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Sep 2021 14:10:59 -0400 +Subject: bnxt_en: Fix possible unintended driver initiated error recovery + +From: Michael Chan + +[ Upstream commit 1b2b91831983aeac3adcbb469aa8b0dc71453f89 ] + +If error recovery is already enabled, bnxt_timer() will periodically +check the heartbeat register and the reset counter. If we get an +error recovery async. notification from the firmware (e.g. change in +primary/secondary role), we will immediately read and update the +heartbeat register and the reset counter. If the timer for the next +health check expires soon after this, we may read the heartbeat register +again in quick succession and find that it hasn't changed. This will +trigger error recovery unintentionally. + +The likelihood is small because we also reset fw_health->tmr_counter +which will reset the interval for the next health check. But the +update is not protected and bnxt_timer() can miss the update and +perform the health check without waiting for the full interval. + +Fix it by only reading the heartbeat register and reset counter in +bnxt_async_event_process() if error recovery is trasitioning to the +enabled state. Also add proper memory barriers so that when enabling +for the first time, bnxt_timer() will see the tmr_counter interval and +perform the health check after the full interval has elapsed. + +Fixes: 7e914027f757 ("bnxt_en: Enable health monitoring.") +Reviewed-by: Edwin Peer +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 25 ++++++++++++++++------- + 1 file changed, 18 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 1acf8633399f..2660dfc6875a 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -2172,25 +2172,34 @@ static int bnxt_async_event_process(struct bnxt *bp, + if (!fw_health) + goto async_event_process_exit; + +- fw_health->enabled = EVENT_DATA1_RECOVERY_ENABLED(data1); +- fw_health->master = EVENT_DATA1_RECOVERY_MASTER_FUNC(data1); +- if (!fw_health->enabled) { ++ if (!EVENT_DATA1_RECOVERY_ENABLED(data1)) { ++ fw_health->enabled = false; + netif_info(bp, drv, bp->dev, + "Error recovery info: error recovery[0]\n"); + break; + } ++ fw_health->master = EVENT_DATA1_RECOVERY_MASTER_FUNC(data1); + fw_health->tmr_multiplier = + DIV_ROUND_UP(fw_health->polling_dsecs * HZ, + bp->current_interval * 10); + fw_health->tmr_counter = fw_health->tmr_multiplier; +- fw_health->last_fw_heartbeat = +- bnxt_fw_health_readl(bp, BNXT_FW_HEARTBEAT_REG); +- fw_health->last_fw_reset_cnt = +- bnxt_fw_health_readl(bp, BNXT_FW_RESET_CNT_REG); ++ if (!fw_health->enabled) { ++ fw_health->last_fw_heartbeat = ++ bnxt_fw_health_readl(bp, BNXT_FW_HEARTBEAT_REG); ++ fw_health->last_fw_reset_cnt = ++ bnxt_fw_health_readl(bp, BNXT_FW_RESET_CNT_REG); ++ } + netif_info(bp, drv, bp->dev, + "Error recovery info: error recovery[1], master[%d], reset count[%u], health status: 0x%x\n", + fw_health->master, fw_health->last_fw_reset_cnt, + bnxt_fw_health_readl(bp, BNXT_FW_HEALTH_REG)); ++ if (!fw_health->enabled) { ++ /* Make sure tmr_counter is set and visible to ++ * bnxt_health_check() before setting enabled to true. ++ */ ++ smp_wmb(); ++ fw_health->enabled = true; ++ } + goto async_event_process_exit; + } + case ASYNC_EVENT_CMPL_EVENT_ID_DEBUG_NOTIFICATION: +@@ -11250,6 +11259,8 @@ static void bnxt_fw_health_check(struct bnxt *bp) + if (!fw_health->enabled || test_bit(BNXT_STATE_IN_FW_RESET, &bp->state)) + return; + ++ /* Make sure it is enabled before checking the tmr_counter. */ ++ smp_rmb(); + if (fw_health->tmr_counter) { + fw_health->tmr_counter--; + return; +-- +2.30.2 + diff --git a/queue-5.14/bnxt_en-fix-stored-fw_psid-version-masks.patch b/queue-5.14/bnxt_en-fix-stored-fw_psid-version-masks.patch new file mode 100644 index 00000000000..ae44720889f --- /dev/null +++ b/queue-5.14/bnxt_en-fix-stored-fw_psid-version-masks.patch @@ -0,0 +1,38 @@ +From 56b329a77537cf42116b3cccca6d32e50980fffb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Sep 2021 14:10:55 -0400 +Subject: bnxt_en: fix stored FW_PSID version masks + +From: Edwin Peer + +[ Upstream commit 1656db67233e4259281d2ac35b25f712edbbc20b ] + +The FW_PSID version components are 8 bits wide, not 4. + +Fixes: db28b6c77f40 ("bnxt_en: Fix devlink info's stored fw.psid version format.") +Signed-off-by: Edwin Peer +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c +index 64381be935a8..8b7f6a0ad401 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c +@@ -471,8 +471,8 @@ static int bnxt_dl_info_get(struct devlink *dl, struct devlink_info_req *req, + if (BNXT_PF(bp) && !bnxt_hwrm_get_nvm_cfg_ver(bp, &nvm_cfg_ver)) { + u32 ver = nvm_cfg_ver.vu32; + +- sprintf(buf, "%d.%d.%d", (ver >> 16) & 0xf, (ver >> 8) & 0xf, +- ver & 0xf); ++ sprintf(buf, "%d.%d.%d", (ver >> 16) & 0xff, (ver >> 8) & 0xff, ++ ver & 0xff); + rc = bnxt_dl_info_put(bp, req, BNXT_VERSION_STORED, + DEVLINK_INFO_VERSION_GENERIC_FW_PSID, + buf); +-- +2.30.2 + diff --git a/queue-5.14/cxgb3-fix-oops-on-module-removal.patch b/queue-5.14/cxgb3-fix-oops-on-module-removal.patch new file mode 100644 index 00000000000..8de04ae3485 --- /dev/null +++ b/queue-5.14/cxgb3-fix-oops-on-module-removal.patch @@ -0,0 +1,80 @@ +From dee4642e6a6c49505168986fa707a60a65dff616 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Sep 2021 22:51:33 +0200 +Subject: cxgb3: fix oops on module removal + +From: Heiner Kallweit + +[ Upstream commit be27a47a760e3ad8ce979a680558776f672efffd ] + +When removing the driver module w/o bringing an interface up before +the error below occurs. Reason seems to be that cancel_work_sync() is +called in t3_sge_stop() for a queue that hasn't been initialized yet. + +[10085.941785] ------------[ cut here ]------------ +[10085.941799] WARNING: CPU: 1 PID: 5850 at kernel/workqueue.c:3074 __flush_work+0x3ff/0x480 +[10085.941819] Modules linked in: vfat snd_hda_codec_hdmi fat snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio led_class ee1004 iTCO_ +wdt intel_tcc_cooling x86_pkg_temp_thermal coretemp aesni_intel crypto_simd cryptd snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core r +8169 snd_pcm realtek mdio_devres snd_timer snd i2c_i801 i2c_smbus libphy i915 i2c_algo_bit cxgb3(-) intel_gtt ttm mdio drm_kms_helper mei_me s +yscopyarea sysfillrect sysimgblt mei fb_sys_fops acpi_pad sch_fq_codel crypto_user drm efivarfs ext4 mbcache jbd2 crc32c_intel +[10085.941944] CPU: 1 PID: 5850 Comm: rmmod Not tainted 5.14.0-rc7-next-20210826+ #6 +[10085.941974] Hardware name: System manufacturer System Product Name/PRIME H310I-PLUS, BIOS 2603 10/21/2019 +[10085.941992] RIP: 0010:__flush_work+0x3ff/0x480 +[10085.942003] Code: c0 74 6b 65 ff 0d d1 bd 78 75 e8 bc 2f 06 00 48 c7 c6 68 b1 88 8a 48 c7 c7 e0 5f b4 8b 45 31 ff e8 e6 66 04 00 e9 4b fe ff ff <0f> 0b 45 31 ff e9 41 fe ff ff e8 72 c1 79 00 85 c0 74 87 80 3d 22 +[10085.942036] RSP: 0018:ffffa1744383fc08 EFLAGS: 00010246 +[10085.942048] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000923 +[10085.942062] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff91c901710a88 +[10085.942076] RBP: ffffa1744383fce8 R08: 0000000000000001 R09: 0000000000000001 +[10085.942090] R10: 00000000000000c2 R11: 0000000000000000 R12: ffff91c901710a88 +[10085.942104] R13: 0000000000000000 R14: ffff91c909a96100 R15: 0000000000000001 +[10085.942118] FS: 00007fe417837740(0000) GS:ffff91c969d00000(0000) knlGS:0000000000000000 +[10085.942134] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[10085.942146] CR2: 000055a8d567ecd8 CR3: 0000000121690003 CR4: 00000000003706e0 +[10085.942160] Call Trace: +[10085.942166] ? __lock_acquire+0x3af/0x22e0 +[10085.942177] ? cancel_work_sync+0xb/0x10 +[10085.942187] __cancel_work_timer+0x128/0x1b0 +[10085.942197] ? __pm_runtime_resume+0x5b/0x90 +[10085.942208] cancel_work_sync+0xb/0x10 +[10085.942217] t3_sge_stop+0x2f/0x50 [cxgb3] +[10085.942234] remove_one+0x26/0x190 [cxgb3] +[10085.942248] pci_device_remove+0x39/0xa0 +[10085.942258] __device_release_driver+0x15e/0x240 +[10085.942269] driver_detach+0xd9/0x120 +[10085.942278] bus_remove_driver+0x53/0xd0 +[10085.942288] driver_unregister+0x2c/0x50 +[10085.942298] pci_unregister_driver+0x31/0x90 +[10085.942307] cxgb3_cleanup_module+0x10/0x18c [cxgb3] +[10085.942324] __do_sys_delete_module+0x191/0x250 +[10085.942336] ? syscall_enter_from_user_mode+0x21/0x60 +[10085.942347] ? trace_hardirqs_on+0x2a/0xe0 +[10085.942357] __x64_sys_delete_module+0x13/0x20 +[10085.942368] do_syscall_64+0x40/0x90 +[10085.942377] entry_SYSCALL_64_after_hwframe+0x44/0xae +[10085.942389] RIP: 0033:0x7fe41796323b + +Fixes: 5e0b8928927f ("net:cxgb3: replace tasklets with works") +Signed-off-by: Heiner Kallweit +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb3/sge.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/chelsio/cxgb3/sge.c b/drivers/net/ethernet/chelsio/cxgb3/sge.c +index cb5c79c43bc9..7bb81e08f953 100644 +--- a/drivers/net/ethernet/chelsio/cxgb3/sge.c ++++ b/drivers/net/ethernet/chelsio/cxgb3/sge.c +@@ -3306,6 +3306,9 @@ void t3_sge_stop(struct adapter *adap) + + t3_sge_stop_dma(adap); + ++ /* workqueues aren't initialized otherwise */ ++ if (!(adap->flags & FULL_INIT_DONE)) ++ return; + for (i = 0; i < SGE_QSETS; ++i) { + struct sge_qset *qs = &adap->sge.qs[i]; + +-- +2.30.2 + diff --git a/queue-5.14/drivers-hv-vmbus-fix-kernel-crash-upon-unbinding-a-d.patch b/queue-5.14/drivers-hv-vmbus-fix-kernel-crash-upon-unbinding-a-d.patch new file mode 100644 index 00000000000..9d68f2f8eca --- /dev/null +++ b/queue-5.14/drivers-hv-vmbus-fix-kernel-crash-upon-unbinding-a-d.patch @@ -0,0 +1,73 @@ +From c6c964aafde6360d3f99c584619f17669ba921cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Aug 2021 16:39:16 +0200 +Subject: Drivers: hv: vmbus: Fix kernel crash upon unbinding a device from + uio_hv_generic driver + +From: Vitaly Kuznetsov + +[ Upstream commit f1940d4e9cbe6208e7e77e433c587af108152a17 ] + +The following crash happens when a never-used device is unbound from +uio_hv_generic driver: + + kernel BUG at mm/slub.c:321! + invalid opcode: 0000 [#1] SMP PTI + CPU: 0 PID: 4001 Comm: bash Kdump: loaded Tainted: G X --------- --- 5.14.0-0.rc2.23.el9.x86_64 #1 + Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008 12/07/2018 + RIP: 0010:__slab_free+0x1d5/0x3d0 +... + Call Trace: + ? pick_next_task_fair+0x18e/0x3b0 + ? __cond_resched+0x16/0x40 + ? vunmap_pmd_range.isra.0+0x154/0x1c0 + ? __vunmap+0x22d/0x290 + ? hv_ringbuffer_cleanup+0x36/0x40 [hv_vmbus] + kfree+0x331/0x380 + ? hv_uio_remove+0x43/0x60 [uio_hv_generic] + hv_ringbuffer_cleanup+0x36/0x40 [hv_vmbus] + vmbus_free_ring+0x21/0x60 [hv_vmbus] + hv_uio_remove+0x4f/0x60 [uio_hv_generic] + vmbus_remove+0x23/0x30 [hv_vmbus] + __device_release_driver+0x17a/0x230 + device_driver_detach+0x3c/0xa0 + unbind_store+0x113/0x130 +... + +The problem appears to be that we free 'ring_info->pkt_buffer' twice: +first, when the device is unbound from in-kernel driver (netvsc in this +case) and second from hv_uio_remove(). Normally, ring buffer is supposed +to be re-initialized from hv_uio_open() but this happens when UIO device +is being opened and this is not guaranteed to happen. + +Generally, it is OK to call hv_ringbuffer_cleanup() twice for the same +channel (which is being handed over between in-kernel drivers and UIO) even +if we didn't call hv_ringbuffer_init() in between. We, however, need to +avoid kfree() call for an already freed pointer. + +Fixes: adae1e931acd ("Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the ring buffer") +Signed-off-by: Vitaly Kuznetsov +Reviewed-by: Andrea Parri +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/20210831143916.144983-1-vkuznets@redhat.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/ring_buffer.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c +index 2aee356840a2..314015d9e912 100644 +--- a/drivers/hv/ring_buffer.c ++++ b/drivers/hv/ring_buffer.c +@@ -245,6 +245,7 @@ void hv_ringbuffer_cleanup(struct hv_ring_buffer_info *ring_info) + mutex_unlock(&ring_info->ring_buffer_mutex); + + kfree(ring_info->pkt_buffer); ++ ring_info->pkt_buffer = NULL; + ring_info->pkt_buffer_size = 0; + } + +-- +2.30.2 + diff --git a/queue-5.14/dt-bindings-mtd-gpmc-fix-the-ecc-bytes-vs.-oob-bytes.patch b/queue-5.14/dt-bindings-mtd-gpmc-fix-the-ecc-bytes-vs.-oob-bytes.patch new file mode 100644 index 00000000000..36058d6313b --- /dev/null +++ b/queue-5.14/dt-bindings-mtd-gpmc-fix-the-ecc-bytes-vs.-oob-bytes.patch @@ -0,0 +1,43 @@ +From 9efeb4a9ac9437f6950377b3fab3b8766ac79fba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jun 2021 16:39:45 +0200 +Subject: dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation + +From: Miquel Raynal + +[ Upstream commit 778cb8e39f6ec252be50fc3850d66f3dcbd5dd5a ] + +"PAGESIZE / 512" is the number of ECC chunks. +"ECC_BYTES" is the number of bytes needed to store a single ECC code. +"2" is the space reserved by the bad block marker. + +"2 + (PAGESIZE / 512) * ECC_BYTES" should of course be lower or equal +than the total number of OOB bytes, otherwise it won't fit. + +Fix the equation by substituting s/>=/<=/. + +Suggested-by: Ryan J. Barnett +Signed-off-by: Miquel Raynal +Acked-by: Rob Herring +Link: https://lore.kernel.org/linux-mtd/20210610143945.3504781-1-miquel.raynal@bootlin.com +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/mtd/gpmc-nand.txt | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/mtd/gpmc-nand.txt b/Documentation/devicetree/bindings/mtd/gpmc-nand.txt +index 44919d48d241..c459f169a904 100644 +--- a/Documentation/devicetree/bindings/mtd/gpmc-nand.txt ++++ b/Documentation/devicetree/bindings/mtd/gpmc-nand.txt +@@ -122,7 +122,7 @@ on various other factors also like; + so the device should have enough free bytes available its OOB/Spare + area to accommodate ECC for entire page. In general following expression + helps in determining if given device can accommodate ECC syndrome: +- "2 + (PAGESIZE / 512) * ECC_BYTES" >= OOBSIZE" ++ "2 + (PAGESIZE / 512) * ECC_BYTES" <= OOBSIZE" + where + OOBSIZE number of bytes in OOB/spare area + PAGESIZE number of bytes in main-area of device page +-- +2.30.2 + diff --git a/queue-5.14/ethtool-fix-an-error-code-in-cxgb2.c.patch b/queue-5.14/ethtool-fix-an-error-code-in-cxgb2.c.patch new file mode 100644 index 00000000000..8c770f44a8b --- /dev/null +++ b/queue-5.14/ethtool-fix-an-error-code-in-cxgb2.c.patch @@ -0,0 +1,39 @@ +From a4dd536bcb4a0246eb531634293615eaaf5d5754 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Sep 2021 14:42:33 +0800 +Subject: ethtool: Fix an error code in cxgb2.c + +From: Yang Li + +[ Upstream commit 7db8263a12155c7ae4ad97e850f1e499c73765fc ] + +When adapter->registered_device_map is NULL, the value of err is +uncertain, we set err to -EINVAL to avoid ambiguity. + +Clean up smatch warning: +drivers/net/ethernet/chelsio/cxgb/cxgb2.c:1114 init_one() warn: missing +error code 'err' + +Reported-by: Abaci Robot +Signed-off-by: Yang Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb/cxgb2.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/chelsio/cxgb/cxgb2.c b/drivers/net/ethernet/chelsio/cxgb/cxgb2.c +index 512da98019c6..2a28a38da036 100644 +--- a/drivers/net/ethernet/chelsio/cxgb/cxgb2.c ++++ b/drivers/net/ethernet/chelsio/cxgb/cxgb2.c +@@ -1107,6 +1107,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + if (!adapter->registered_device_map) { + pr_err("%s: could not register any net devices\n", + pci_name(pdev)); ++ err = -EINVAL; + goto out_release_adapter_res; + } + +-- +2.30.2 + diff --git a/queue-5.14/flow-fix-object-size-mismatch-warning-in-flowi-4-6-_.patch b/queue-5.14/flow-fix-object-size-mismatch-warning-in-flowi-4-6-_.patch new file mode 100644 index 00000000000..38a75b8741b --- /dev/null +++ b/queue-5.14/flow-fix-object-size-mismatch-warning-in-flowi-4-6-_.patch @@ -0,0 +1,92 @@ +From ff69201edfe1dc0e59c2268d69fccb8384691bae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Sep 2021 14:36:17 +0900 +Subject: flow: fix object-size-mismatch warning in + flowi{4,6}_to_flowi_common() + +From: Tetsuo Handa + +[ Upstream commit b9edbfe1adecfc48fd11061dce68afb03d6adbdc ] + +Commit 3df98d79215ace13 ("lsm,selinux: pass flowi_common instead of flowi +to the LSM hooks") introduced flowi{4,6}_to_flowi_common() functions which +cause UBSAN warning when building with LLVM 11.0.1 on Ubuntu 21.04. + + ================================================================================ + UBSAN: object-size-mismatch in ./include/net/flow.h:197:33 + member access within address ffffc9000109fbd8 with insufficient space + for an object of type 'struct flowi' + CPU: 2 PID: 7410 Comm: systemd-resolve Not tainted 5.14.0 #51 + Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 02/27/2020 + Call Trace: + dump_stack_lvl+0x103/0x171 + ubsan_type_mismatch_common+0x1de/0x390 + __ubsan_handle_type_mismatch_v1+0x41/0x50 + udp_sendmsg+0xda2/0x1300 + ? ip_skb_dst_mtu+0x1f0/0x1f0 + ? sock_rps_record_flow+0xe/0x200 + ? inet_send_prepare+0x2d/0x90 + sock_sendmsg+0x49/0x80 + ____sys_sendmsg+0x269/0x370 + __sys_sendmsg+0x15e/0x1d0 + ? syscall_enter_from_user_mode+0xf0/0x1b0 + do_syscall_64+0x3d/0xb0 + entry_SYSCALL_64_after_hwframe+0x44/0xae + RIP: 0033:0x7f7081a50497 + Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 + RSP: 002b:00007ffc153870f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e + RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007f7081a50497 + RDX: 0000000000000000 RSI: 00007ffc15387140 RDI: 000000000000000c + RBP: 00007ffc15387140 R08: 0000563f29a5e4fc R09: 000000000000cd28 + R10: 0000563f29a68a30 R11: 0000000000000246 R12: 000000000000000c + R13: 0000000000000001 R14: 0000563f29a68a30 R15: 0000563f29a5e50c + ================================================================================ + +I don't think we need to call flowi{4,6}_to_flowi() from these functions +because the first member of "struct flowi4" and "struct flowi6" is + + struct flowi_common __fl_common; + +while the first member of "struct flowi" is + + union { + struct flowi_common __fl_common; + struct flowi4 ip4; + struct flowi6 ip6; + struct flowidn dn; + } u; + +which should point to the same address without access to "struct flowi". + +Signed-off-by: Tetsuo Handa +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/flow.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/net/flow.h b/include/net/flow.h +index 6f5e70240071..58beb16a49b8 100644 +--- a/include/net/flow.h ++++ b/include/net/flow.h +@@ -194,7 +194,7 @@ static inline struct flowi *flowi4_to_flowi(struct flowi4 *fl4) + + static inline struct flowi_common *flowi4_to_flowi_common(struct flowi4 *fl4) + { +- return &(flowi4_to_flowi(fl4)->u.__fl_common); ++ return &(fl4->__fl_common); + } + + static inline struct flowi *flowi6_to_flowi(struct flowi6 *fl6) +@@ -204,7 +204,7 @@ static inline struct flowi *flowi6_to_flowi(struct flowi6 *fl6) + + static inline struct flowi_common *flowi6_to_flowi_common(struct flowi6 *fl6) + { +- return &(flowi6_to_flowi(fl6)->u.__fl_common); ++ return &(fl6->__fl_common); + } + + static inline struct flowi *flowidn_to_flowi(struct flowidn *fldn) +-- +2.30.2 + diff --git a/queue-5.14/fq_codel-reject-silly-quantum-parameters.patch b/queue-5.14/fq_codel-reject-silly-quantum-parameters.patch new file mode 100644 index 00000000000..1b835cf8fed --- /dev/null +++ b/queue-5.14/fq_codel-reject-silly-quantum-parameters.patch @@ -0,0 +1,89 @@ +From 54583703ebed7ce2052b6634bb9c83a946d7903f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Sep 2021 15:03:43 -0700 +Subject: fq_codel: reject silly quantum parameters + +From: Eric Dumazet + +[ Upstream commit c7c5e6ff533fe1f9afef7d2fa46678987a1335a7 ] + +syzbot found that forcing a big quantum attribute would crash hosts fast, +essentially using this: + +tc qd replace dev eth0 root fq_codel quantum 4294967295 + +This is because fq_codel_dequeue() would have to loop +~2^31 times in : + + if (flow->deficit <= 0) { + flow->deficit += q->quantum; + list_move_tail(&flow->flowchain, &q->old_flows); + goto begin; + } + +SFQ max quantum is 2^19 (half a megabyte) +Lets adopt a max quantum of one megabyte for FQ_CODEL. + +Fixes: 4b549a2ef4be ("fq_codel: Fair Queue Codel AQM") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/uapi/linux/pkt_sched.h | 2 ++ + net/sched/sch_fq_codel.c | 12 ++++++++++-- + 2 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/include/uapi/linux/pkt_sched.h b/include/uapi/linux/pkt_sched.h +index 79a699f106b1..ec88590b3198 100644 +--- a/include/uapi/linux/pkt_sched.h ++++ b/include/uapi/linux/pkt_sched.h +@@ -827,6 +827,8 @@ struct tc_codel_xstats { + + /* FQ_CODEL */ + ++#define FQ_CODEL_QUANTUM_MAX (1 << 20) ++ + enum { + TCA_FQ_CODEL_UNSPEC, + TCA_FQ_CODEL_TARGET, +diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c +index bbd5f8753600..99e8db262198 100644 +--- a/net/sched/sch_fq_codel.c ++++ b/net/sched/sch_fq_codel.c +@@ -369,6 +369,7 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt, + { + struct fq_codel_sched_data *q = qdisc_priv(sch); + struct nlattr *tb[TCA_FQ_CODEL_MAX + 1]; ++ u32 quantum = 0; + int err; + + if (!opt) +@@ -386,6 +387,13 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt, + q->flows_cnt > 65536) + return -EINVAL; + } ++ if (tb[TCA_FQ_CODEL_QUANTUM]) { ++ quantum = max(256U, nla_get_u32(tb[TCA_FQ_CODEL_QUANTUM])); ++ if (quantum > FQ_CODEL_QUANTUM_MAX) { ++ NL_SET_ERR_MSG(extack, "Invalid quantum"); ++ return -EINVAL; ++ } ++ } + sch_tree_lock(sch); + + if (tb[TCA_FQ_CODEL_TARGET]) { +@@ -412,8 +420,8 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt, + if (tb[TCA_FQ_CODEL_ECN]) + q->cparams.ecn = !!nla_get_u32(tb[TCA_FQ_CODEL_ECN]); + +- if (tb[TCA_FQ_CODEL_QUANTUM]) +- q->quantum = max(256U, nla_get_u32(tb[TCA_FQ_CODEL_QUANTUM])); ++ if (quantum) ++ q->quantum = quantum; + + if (tb[TCA_FQ_CODEL_DROP_BATCH_SIZE]) + q->drop_batch_size = max(1U, nla_get_u32(tb[TCA_FQ_CODEL_DROP_BATCH_SIZE])); +-- +2.30.2 + diff --git a/queue-5.14/fuse-fix-use-after-free-in-fuse_read_interrupt.patch b/queue-5.14/fuse-fix-use-after-free-in-fuse_read_interrupt.patch new file mode 100644 index 00000000000..365353b8268 --- /dev/null +++ b/queue-5.14/fuse-fix-use-after-free-in-fuse_read_interrupt.patch @@ -0,0 +1,61 @@ +From 92ac45b81dd5bc2fc99b520091ace99cb633cfc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Aug 2021 13:22:58 +0200 +Subject: fuse: fix use after free in fuse_read_interrupt() + +From: Miklos Szeredi + +[ Upstream commit e1e71c168813564be0f6ea3d6740a059ca42d177 ] + +There is a potential race between fuse_read_interrupt() and +fuse_request_end(). + +TASK1 + in fuse_read_interrupt(): delete req->intr_entry (while holding + fiq->lock) + +TASK2 + in fuse_request_end(): req->intr_entry is empty -> skip fiq->lock + wake up TASK3 + +TASK3 + request is freed + +TASK1 + in fuse_read_interrupt(): dereference req->in.h.unique ***BAM*** + +Fix by always grabbing fiq->lock if the request was ever interrupted +(FR_INTERRUPTED set) thereby serializing with concurrent +fuse_read_interrupt() calls. + +FR_INTERRUPTED is set before the request is queued on fiq->interrupts. +Dequeing the request is done with list_del_init() but FR_INTERRUPTED is not +cleared in this case. + +Reported-by: lijiazi +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/fuse/dev.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c +index 1c8f79b3dd06..dde341a6388a 100644 +--- a/fs/fuse/dev.c ++++ b/fs/fuse/dev.c +@@ -288,10 +288,10 @@ void fuse_request_end(struct fuse_req *req) + + /* + * test_and_set_bit() implies smp_mb() between bit +- * changing and below intr_entry check. Pairs with ++ * changing and below FR_INTERRUPTED check. Pairs with + * smp_mb() from queue_interrupt(). + */ +- if (!list_empty(&req->intr_entry)) { ++ if (test_bit(FR_INTERRUPTED, &req->flags)) { + spin_lock(&fiq->lock); + list_del_init(&req->intr_entry); + spin_unlock(&fiq->lock); +-- +2.30.2 + diff --git a/queue-5.14/gpio-mpc8xxx-fix-a-potential-double-iounmap-call-in-.patch b/queue-5.14/gpio-mpc8xxx-fix-a-potential-double-iounmap-call-in-.patch new file mode 100644 index 00000000000..161436902d8 --- /dev/null +++ b/queue-5.14/gpio-mpc8xxx-fix-a-potential-double-iounmap-call-in-.patch @@ -0,0 +1,80 @@ +From ab13ed24c9739cb30c8ed3faa0812b656a65609b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Aug 2021 17:38:03 +0200 +Subject: gpio: mpc8xxx: Fix a potential double iounmap call in + 'mpc8xxx_probe()' + +From: Christophe JAILLET + +[ Upstream commit 7d6588931ccd4c09e70a08175cf2e0cf7fc3b869 ] + +Commit 76c47d1449fc ("gpio: mpc8xxx: Add ACPI support") has switched to a +managed version when dealing with 'mpc8xxx_gc->regs'. So the corresponding +'iounmap()' call in the error handling path and in the remove should be +removed to avoid a double unmap. + +This also allows some simplification in the probe. All the error handling +paths related to managed resources can be direct returns and a NULL check +in what remains in the error handling path can be removed. + +Fixes: 76c47d1449fc ("gpio: mpc8xxx: Add ACPI support") +Signed-off-by: Christophe JAILLET +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-mpc8xxx.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c +index 9acfa25ad6ee..fdb22c2e1085 100644 +--- a/drivers/gpio/gpio-mpc8xxx.c ++++ b/drivers/gpio/gpio-mpc8xxx.c +@@ -332,7 +332,7 @@ static int mpc8xxx_probe(struct platform_device *pdev) + mpc8xxx_gc->regs + GPIO_DIR, NULL, + BGPIOF_BIG_ENDIAN); + if (ret) +- goto err; ++ return ret; + dev_dbg(&pdev->dev, "GPIO registers are LITTLE endian\n"); + } else { + ret = bgpio_init(gc, &pdev->dev, 4, +@@ -342,7 +342,7 @@ static int mpc8xxx_probe(struct platform_device *pdev) + BGPIOF_BIG_ENDIAN + | BGPIOF_BIG_ENDIAN_BYTE_ORDER); + if (ret) +- goto err; ++ return ret; + dev_dbg(&pdev->dev, "GPIO registers are BIG endian\n"); + } + +@@ -384,7 +384,7 @@ static int mpc8xxx_probe(struct platform_device *pdev) + if (ret) { + dev_err(&pdev->dev, + "GPIO chip registration failed with status %d\n", ret); +- goto err; ++ return ret; + } + + mpc8xxx_gc->irqn = platform_get_irq(pdev, 0); +@@ -416,9 +416,7 @@ static int mpc8xxx_probe(struct platform_device *pdev) + + return 0; + err: +- if (mpc8xxx_gc->irq) +- irq_domain_remove(mpc8xxx_gc->irq); +- iounmap(mpc8xxx_gc->regs); ++ irq_domain_remove(mpc8xxx_gc->irq); + return ret; + } + +@@ -432,7 +430,6 @@ static int mpc8xxx_remove(struct platform_device *pdev) + } + + gpiochip_remove(&mpc8xxx_gc->gc); +- iounmap(mpc8xxx_gc->regs); + + return 0; + } +-- +2.30.2 + diff --git a/queue-5.14/gpio-mpc8xxx-fix-a-resources-leak-in-the-error-handl.patch b/queue-5.14/gpio-mpc8xxx-fix-a-resources-leak-in-the-error-handl.patch new file mode 100644 index 00000000000..ed3db718f97 --- /dev/null +++ b/queue-5.14/gpio-mpc8xxx-fix-a-resources-leak-in-the-error-handl.patch @@ -0,0 +1,41 @@ +From c40cfabe5c63b363ae11ccf33064d1c7e2e5938a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Aug 2021 17:37:55 +0200 +Subject: gpio: mpc8xxx: Fix a resources leak in the error handling path of + 'mpc8xxx_probe()' + +From: Christophe JAILLET + +[ Upstream commit 555bda42b0c1a5ffb72d3227c043e8afde778f1f ] + +Commit 698b8eeaed72 ("gpio/mpc8xxx: change irq handler from chained to normal") +has introduced a new 'goto err;' at the very end of the function, but has +not updated the error handling path accordingly. + +Add the now missing 'irq_domain_remove()' call which balances a previous +'irq_domain_create_linear() call. + +Fixes: 698b8eeaed72 ("gpio/mpc8xxx: change irq handler from chained to normal") +Signed-off-by: Christophe JAILLET +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-mpc8xxx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c +index 50b321a1ab1b..9acfa25ad6ee 100644 +--- a/drivers/gpio/gpio-mpc8xxx.c ++++ b/drivers/gpio/gpio-mpc8xxx.c +@@ -416,6 +416,8 @@ static int mpc8xxx_probe(struct platform_device *pdev) + + return 0; + err: ++ if (mpc8xxx_gc->irq) ++ irq_domain_remove(mpc8xxx_gc->irq); + iounmap(mpc8xxx_gc->regs); + return ret; + } +-- +2.30.2 + diff --git a/queue-5.14/gpio-mpc8xxx-use-devm_gpiochip_add_data-to-simplify-.patch b/queue-5.14/gpio-mpc8xxx-use-devm_gpiochip_add_data-to-simplify-.patch new file mode 100644 index 00000000000..6d0707fb08f --- /dev/null +++ b/queue-5.14/gpio-mpc8xxx-use-devm_gpiochip_add_data-to-simplify-.patch @@ -0,0 +1,49 @@ +From c06a02fa0717826e14c41c65dd07137e1a7a14cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Aug 2021 17:38:13 +0200 +Subject: gpio: mpc8xxx: Use 'devm_gpiochip_add_data()' to simplify the code + and avoid a leak + +From: Christophe JAILLET + +[ Upstream commit 889a1b3f35db6ba5ba6a0c23a3a55594570b6a17 ] + +If an error occurs after a 'gpiochip_add_data()' call it must be undone by +a corresponding 'gpiochip_remove()' as already done in the remove function. + +To simplify the code a fix a leak in the error handling path of the probe, +use the managed version instead (i.e. 'devm_gpiochip_add_data()') + +Fixes: 698b8eeaed72 ("gpio/mpc8xxx: change irq handler from chained to normal") +Signed-off-by: Christophe JAILLET +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-mpc8xxx.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c +index fdb22c2e1085..d574e8cb6d7c 100644 +--- a/drivers/gpio/gpio-mpc8xxx.c ++++ b/drivers/gpio/gpio-mpc8xxx.c +@@ -380,7 +380,7 @@ static int mpc8xxx_probe(struct platform_device *pdev) + is_acpi_node(fwnode)) + gc->write_reg(mpc8xxx_gc->regs + GPIO_IBE, 0xffffffff); + +- ret = gpiochip_add_data(gc, mpc8xxx_gc); ++ ret = devm_gpiochip_add_data(&pdev->dev, gc, mpc8xxx_gc); + if (ret) { + dev_err(&pdev->dev, + "GPIO chip registration failed with status %d\n", ret); +@@ -429,8 +429,6 @@ static int mpc8xxx_remove(struct platform_device *pdev) + irq_domain_remove(mpc8xxx_gc->irq); + } + +- gpiochip_remove(&mpc8xxx_gc->gc); +- + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.14/ice-correctly-deal-with-pfs-that-do-not-support-rdma.patch b/queue-5.14/ice-correctly-deal-with-pfs-that-do-not-support-rdma.patch new file mode 100644 index 00000000000..0b1b23d52f3 --- /dev/null +++ b/queue-5.14/ice-correctly-deal-with-pfs-that-do-not-support-rdma.patch @@ -0,0 +1,80 @@ +From 33e5f301084d448b2c6531558233ed0c7c4e6ece Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Sep 2021 08:12:23 -0700 +Subject: ice: Correctly deal with PFs that do not support RDMA + +From: Dave Ertman + +[ Upstream commit bfe84435090a6c85271b02a42b1d83fef9ff7cc7 ] + +There are two cases where the current PF does not support RDMA +functionality. The first is if the NVM loaded on the device is set +to not support RDMA (common_caps.rdma is false). The second is if +the kernel bonding driver has included the current PF in an active +link aggregate. + +When the driver has determined that this PF does not support RDMA, then +auxiliary devices should not be created on the auxiliary bus. Without +a device on the auxiliary bus, even if the irdma driver is present, there +will be no RDMA activity attempted on this PF. + +Currently, in the reset flow, an attempt to create auxiliary devices is +performed without regard to the ability of the PF. There needs to be a +check in ice_aux_plug_dev (as the central point that creates auxiliary +devices) to see if the PF is in a state to support the functionality. + +When disabling and re-enabling RDMA due to the inclusion/removal of the PF +in a link aggregate, we also need to set/clear the bit which controls +auxiliary device creation so that a reset recovery in a link aggregate +situation doesn't try to create auxiliary devices when it shouldn't. + +Fixes: f9f5301e7e2d ("ice: Register auxiliary device to provide RDMA") +Reported-by: Yongxin Liu +Signed-off-by: Dave Ertman +Signed-off-by: Tony Nguyen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice.h | 2 ++ + drivers/net/ethernet/intel/ice/ice_idc.c | 6 ++++++ + 2 files changed, 8 insertions(+) + +diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h +index eadcb9958346..3c4f08d20414 100644 +--- a/drivers/net/ethernet/intel/ice/ice.h ++++ b/drivers/net/ethernet/intel/ice/ice.h +@@ -695,6 +695,7 @@ static inline void ice_set_rdma_cap(struct ice_pf *pf) + { + if (pf->hw.func_caps.common_cap.rdma && pf->num_rdma_msix) { + set_bit(ICE_FLAG_RDMA_ENA, pf->flags); ++ set_bit(ICE_FLAG_AUX_ENA, pf->flags); + ice_plug_aux_dev(pf); + } + } +@@ -707,5 +708,6 @@ static inline void ice_clear_rdma_cap(struct ice_pf *pf) + { + ice_unplug_aux_dev(pf); + clear_bit(ICE_FLAG_RDMA_ENA, pf->flags); ++ clear_bit(ICE_FLAG_AUX_ENA, pf->flags); + } + #endif /* _ICE_H_ */ +diff --git a/drivers/net/ethernet/intel/ice/ice_idc.c b/drivers/net/ethernet/intel/ice/ice_idc.c +index 1f2afdf6cd48..adcc9a251595 100644 +--- a/drivers/net/ethernet/intel/ice/ice_idc.c ++++ b/drivers/net/ethernet/intel/ice/ice_idc.c +@@ -271,6 +271,12 @@ int ice_plug_aux_dev(struct ice_pf *pf) + struct auxiliary_device *adev; + int ret; + ++ /* if this PF doesn't support a technology that requires auxiliary ++ * devices, then gracefully exit ++ */ ++ if (!ice_is_aux_ena(pf)) ++ return 0; ++ + iadev = kzalloc(sizeof(*iadev), GFP_KERNEL); + if (!iadev) + return -ENOMEM; +-- +2.30.2 + diff --git a/queue-5.14/io_uring-retry-in-case-of-short-read-on-block-device.patch b/queue-5.14/io_uring-retry-in-case-of-short-read-on-block-device.patch new file mode 100644 index 00000000000..d69d8e7639f --- /dev/null +++ b/queue-5.14/io_uring-retry-in-case-of-short-read-on-block-device.patch @@ -0,0 +1,62 @@ +From 4e3adb15deeb9ab52c8de90960957ea74dde01f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Aug 2021 23:07:51 +0800 +Subject: io_uring: retry in case of short read on block device + +From: Ming Lei + +[ Upstream commit 7db304375e11741e5940f9bc549155035bfb4dc1 ] + +In case of buffered reading from block device, when short read happens, +we should retry to read more, otherwise the IO will be completed +partially, for example, the following fio expects to read 2MB, but it +can only read 1M or less bytes: + + fio --name=onessd --filename=/dev/nvme0n1 --filesize=2M \ + --rw=randread --bs=2M --direct=0 --overwrite=0 --numjobs=1 \ + --iodepth=1 --time_based=0 --runtime=2 --ioengine=io_uring \ + --registerfiles --fixedbufs --gtod_reduce=1 --group_reporting + +Fix the issue by allowing short read retry for block device, which sets +FMODE_BUF_RASYNC really. + +Fixes: 9a173346bd9e ("io_uring: fix short read retries for non-reg files") +Cc: Pavel Begunkov +Signed-off-by: Ming Lei +Reviewed-by: Pavel Begunkov +Link: https://lore.kernel.org/r/20210821150751.1290434-1-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/io_uring.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 0361c48c9cb0..43aaa3566431 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -3286,6 +3286,12 @@ static inline int io_iter_do_read(struct io_kiocb *req, struct iov_iter *iter) + return -EINVAL; + } + ++static bool need_read_all(struct io_kiocb *req) ++{ ++ return req->flags & REQ_F_ISREG || ++ S_ISBLK(file_inode(req->file)->i_mode); ++} ++ + static int io_read(struct io_kiocb *req, unsigned int issue_flags) + { + struct iovec inline_vecs[UIO_FASTIOV], *iovec = inline_vecs; +@@ -3340,7 +3346,7 @@ static int io_read(struct io_kiocb *req, unsigned int issue_flags) + } else if (ret == -EIOCBQUEUED) { + goto out_free; + } else if (ret <= 0 || ret == io_size || !force_nonblock || +- (req->flags & REQ_F_NOWAIT) || !(req->flags & REQ_F_ISREG)) { ++ (req->flags & REQ_F_NOWAIT) || !need_read_all(req)) { + /* read all, failed, already did sync or don't want to retry */ + goto done; + } +-- +2.30.2 + diff --git a/queue-5.14/ip6_gre-revert-ip6_gre-add-validation-for-csum_start.patch b/queue-5.14/ip6_gre-revert-ip6_gre-add-validation-for-csum_start.patch new file mode 100644 index 00000000000..069083314a2 --- /dev/null +++ b/queue-5.14/ip6_gre-revert-ip6_gre-add-validation-for-csum_start.patch @@ -0,0 +1,45 @@ +From 2e18327e8f11a6a18ad7315fb2e543cb8f5ff4e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Sep 2021 10:27:38 -0400 +Subject: ip6_gre: Revert "ip6_gre: add validation for csum_start" + +From: Willem de Bruijn + +[ Upstream commit fe63339ef36bfb1cc12962015a9b254170eea057 ] + +This reverts commit 9cf448c200ba9935baa94e7a0964598ce947db9d. + +This commit was added for equivalence with a similar fix to ip_gre. +That fix proved to have a bug. Upon closer inspection, ip6_gre is not +susceptible to the original bug. + +So revert the unnecessary extra check. + +In short, ipgre_xmit calls skb_pull to remove ipv4 headers previously +inserted by dev_hard_header. ip6gre_tunnel_xmit does not. + +Link: https://lore.kernel.org/netdev/CA+FuTSe+vJgTVLc9SojGuN-f9YQ+xWLPKE_S4f=f+w+_P2hgUg@mail.gmail.com/#t +Fixes: 9cf448c200ba ("ip6_gre: add validation for csum_start") +Signed-off-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/ip6_gre.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index 7a5e90e09363..bc224f917bbd 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -629,8 +629,6 @@ drop: + + static int gre_handle_offloads(struct sk_buff *skb, bool csum) + { +- if (csum && skb_checksum_start(skb) < skb->data) +- return -EINVAL; + return iptunnel_handle_offloads(skb, + csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE); + } +-- +2.30.2 + diff --git a/queue-5.14/ip_gre-validate-csum_start-only-on-pull.patch b/queue-5.14/ip_gre-validate-csum_start-only-on-pull.patch new file mode 100644 index 00000000000..329d21a3c68 --- /dev/null +++ b/queue-5.14/ip_gre-validate-csum_start-only-on-pull.patch @@ -0,0 +1,77 @@ +From 811e33640fd38564a7d3312a11dda7cd74cfda4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Sep 2021 11:21:09 -0400 +Subject: ip_gre: validate csum_start only on pull + +From: Willem de Bruijn + +[ Upstream commit 8a0ed250f911da31a2aef52101bc707846a800ff ] + +The GRE tunnel device can pull existing outer headers in ipge_xmit. +This is a rare path, apparently unique to this device. The below +commit ensured that pulling does not move skb->data beyond csum_start. + +But it has a false positive if ip_summed is not CHECKSUM_PARTIAL and +thus csum_start is irrelevant. + +Refine to exclude this. At the same time simplify and strengthen the +test. + +Simplify, by moving the check next to the offending pull, making it +more self documenting and removing an unnecessary branch from other +code paths. + +Strengthen, by also ensuring that the transport header is correct and +therefore the inner headers will be after skb_reset_inner_headers. +The transport header is set to csum_start in skb_partial_csum_set. + +Link: https://lore.kernel.org/netdev/YS+h%2FtqCJJiQei+W@shredder/ +Fixes: 1d011c4803c7 ("ip_gre: add validation for csum_start") +Reported-by: Ido Schimmel +Suggested-by: Alexander Duyck +Signed-off-by: Willem de Bruijn +Reviewed-by: Alexander Duyck +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_gre.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index 95419b7adf5c..6480c6dfe1bf 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -473,8 +473,6 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev, + + static int gre_handle_offloads(struct sk_buff *skb, bool csum) + { +- if (csum && skb_checksum_start(skb) < skb->data) +- return -EINVAL; + return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE); + } + +@@ -632,15 +630,20 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb, + } + + if (dev->header_ops) { ++ const int pull_len = tunnel->hlen + sizeof(struct iphdr); ++ + if (skb_cow_head(skb, 0)) + goto free_skb; + + tnl_params = (const struct iphdr *)skb->data; + ++ if (pull_len > skb_transport_offset(skb)) ++ goto free_skb; ++ + /* Pull skb since ip_tunnel_xmit() needs skb->data pointing + * to gre header. + */ +- skb_pull(skb, tunnel->hlen + sizeof(struct iphdr)); ++ skb_pull(skb, pull_len); + skb_reset_mac_header(skb); + } else { + if (skb_cow_head(skb, dev->needed_headroom)) +-- +2.30.2 + diff --git a/queue-5.14/iwlwifi-move-get-pnvm-file-name-to-a-separate-functi.patch b/queue-5.14/iwlwifi-move-get-pnvm-file-name-to-a-separate-functi.patch new file mode 100644 index 00000000000..f2d85755155 --- /dev/null +++ b/queue-5.14/iwlwifi-move-get-pnvm-file-name-to-a-separate-functi.patch @@ -0,0 +1,83 @@ +From b45046c74593527ec1525497336bee5684e6ecd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Aug 2021 22:47:39 +0300 +Subject: iwlwifi: move get pnvm file name to a separate function + +From: Dror Moshe + +[ Upstream commit b05c1d14a177eaffe3aa7fa18b39df3a3e1f3a47 ] + +Move code that generates the pnvm file name to a separate function, +so that it can be reused. + +Signed-off-by: Dror Moshe +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20210826224715.7d2dd18c75a2.I3652584755b9ab44909ddcd09ff4d80c6690a1ad@changeid +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/pnvm.c | 13 ++----------- + drivers/net/wireless/intel/iwlwifi/fw/pnvm.h | 20 ++++++++++++++++++++ + 2 files changed, 22 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c +index b4b1f75b9c2a..830257e94126 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c +@@ -230,19 +230,10 @@ static int iwl_pnvm_parse(struct iwl_trans *trans, const u8 *data, + static int iwl_pnvm_get_from_fs(struct iwl_trans *trans, u8 **data, size_t *len) + { + const struct firmware *pnvm; +- char pnvm_name[64]; ++ char pnvm_name[MAX_PNVM_NAME]; + int ret; + +- /* +- * The prefix unfortunately includes a hyphen at the end, so +- * don't add the dot here... +- */ +- snprintf(pnvm_name, sizeof(pnvm_name), "%spnvm", +- trans->cfg->fw_name_pre); +- +- /* ...but replace the hyphen with the dot here. */ +- if (strlen(trans->cfg->fw_name_pre) < sizeof(pnvm_name)) +- pnvm_name[strlen(trans->cfg->fw_name_pre) - 1] = '.'; ++ iwl_pnvm_get_fs_name(trans, pnvm_name, sizeof(pnvm_name)); + + ret = firmware_request_nowarn(&pnvm, pnvm_name, trans->dev); + if (ret) { +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.h b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.h +index 61d3d4e0b7d9..203c367dd4de 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.h ++++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.h +@@ -12,7 +12,27 @@ + + #define MVM_UCODE_PNVM_TIMEOUT (HZ / 4) + ++#define MAX_PNVM_NAME 64 ++ + int iwl_pnvm_load(struct iwl_trans *trans, + struct iwl_notif_wait_data *notif_wait); + ++static inline ++void iwl_pnvm_get_fs_name(struct iwl_trans *trans, ++ u8 *pnvm_name, size_t max_len) ++{ ++ int pre_len; ++ ++ /* ++ * The prefix unfortunately includes a hyphen at the end, so ++ * don't add the dot here... ++ */ ++ snprintf(pnvm_name, max_len, "%spnvm", trans->cfg->fw_name_pre); ++ ++ /* ...but replace the hyphen with the dot here. */ ++ pre_len = strlen(trans->cfg->fw_name_pre); ++ if (pre_len < max_len && pre_len > 0) ++ pnvm_name[pre_len - 1] = '.'; ++} ++ + #endif /* __IWL_PNVM_H__ */ +-- +2.30.2 + diff --git a/queue-5.14/iwlwifi-pnvm-fix-a-memory-leak-in-iwl_pnvm_get_from_.patch b/queue-5.14/iwlwifi-pnvm-fix-a-memory-leak-in-iwl_pnvm_get_from_.patch new file mode 100644 index 00000000000..c94083b656f --- /dev/null +++ b/queue-5.14/iwlwifi-pnvm-fix-a-memory-leak-in-iwl_pnvm_get_from_.patch @@ -0,0 +1,58 @@ +From 765c5abcec1755c8d53b5f35d429f98c3d90ec35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Sep 2021 22:38:11 +0200 +Subject: iwlwifi: pnvm: Fix a memory leak in 'iwl_pnvm_get_from_fs()' + +From: Christophe JAILLET + +[ Upstream commit 45010c080e6e7434fcae73212b0087a03590049f ] + +A firmware is requested but never released in this function. This leads to +a memory leak in the normal execution path. + +Add the missing 'release_firmware()' call. +Also introduce a temp variable (new_len) in order to keep the value of +'pnvm->size' after the firmware has been released. + +Fixes: cdda18fbbefa ("iwlwifi: pnvm: move file loading code to a separate function") +Signed-off-by: Christophe JAILLET +Reviewed-by: Dan Carpenter +Acked-by: Luca Coelho +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1b5d80f54c1dbf85710fd285243932943b498fe7.1630614969.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/pnvm.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c +index 830257e94126..513f9e538729 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c +@@ -231,6 +231,7 @@ static int iwl_pnvm_get_from_fs(struct iwl_trans *trans, u8 **data, size_t *len) + { + const struct firmware *pnvm; + char pnvm_name[MAX_PNVM_NAME]; ++ size_t new_len; + int ret; + + iwl_pnvm_get_fs_name(trans, pnvm_name, sizeof(pnvm_name)); +@@ -242,11 +243,14 @@ static int iwl_pnvm_get_from_fs(struct iwl_trans *trans, u8 **data, size_t *len) + return ret; + } + ++ new_len = pnvm->size; + *data = kmemdup(pnvm->data, pnvm->size, GFP_KERNEL); ++ release_firmware(pnvm); ++ + if (!*data) + return -ENOMEM; + +- *len = pnvm->size; ++ *len = new_len; + + return 0; + } +-- +2.30.2 + diff --git a/queue-5.14/kvm-arm64-fix-read-side-race-on-updates-to-vcpu-rese.patch b/queue-5.14/kvm-arm64-fix-read-side-race-on-updates-to-vcpu-rese.patch new file mode 100644 index 00000000000..431bb4b444c --- /dev/null +++ b/queue-5.14/kvm-arm64-fix-read-side-race-on-updates-to-vcpu-rese.patch @@ -0,0 +1,76 @@ +From cf5aa8a5a663f9b49801de3c73359fa73895881b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 20:21:30 +0000 +Subject: KVM: arm64: Fix read-side race on updates to vcpu reset state + +From: Oliver Upton + +[ Upstream commit 6654f9dfcb88fea3b9affc180dc3c04333d0f306 ] + +KVM correctly serializes writes to a vCPU's reset state, however since +we do not take the KVM lock on the read side it is entirely possible to +read state from two different reset requests. + +Cure the race for now by taking the KVM lock when reading the +reset_state structure. + +Fixes: 358b28f09f0a ("arm/arm64: KVM: Allow a VCPU to fully reset itself") +Signed-off-by: Oliver Upton +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20210818202133.1106786-2-oupton@google.com +Signed-off-by: Sasha Levin +--- + arch/arm64/kvm/reset.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c +index 78d4bd897fbc..d010778b93ff 100644 +--- a/arch/arm64/kvm/reset.c ++++ b/arch/arm64/kvm/reset.c +@@ -210,10 +210,16 @@ static bool vcpu_allowed_register_width(struct kvm_vcpu *vcpu) + */ + int kvm_reset_vcpu(struct kvm_vcpu *vcpu) + { ++ struct vcpu_reset_state reset_state; + int ret; + bool loaded; + u32 pstate; + ++ mutex_lock(&vcpu->kvm->lock); ++ reset_state = vcpu->arch.reset_state; ++ WRITE_ONCE(vcpu->arch.reset_state.reset, false); ++ mutex_unlock(&vcpu->kvm->lock); ++ + /* Reset PMU outside of the non-preemptible section */ + kvm_pmu_vcpu_reset(vcpu); + +@@ -276,8 +282,8 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu) + * Additional reset state handling that PSCI may have imposed on us. + * Must be done after all the sys_reg reset. + */ +- if (vcpu->arch.reset_state.reset) { +- unsigned long target_pc = vcpu->arch.reset_state.pc; ++ if (reset_state.reset) { ++ unsigned long target_pc = reset_state.pc; + + /* Gracefully handle Thumb2 entry point */ + if (vcpu_mode_is_32bit(vcpu) && (target_pc & 1)) { +@@ -286,13 +292,11 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu) + } + + /* Propagate caller endianness */ +- if (vcpu->arch.reset_state.be) ++ if (reset_state.be) + kvm_vcpu_set_be(vcpu); + + *vcpu_pc(vcpu) = target_pc; +- vcpu_set_reg(vcpu, 0, vcpu->arch.reset_state.r0); +- +- vcpu->arch.reset_state.reset = false; ++ vcpu_set_reg(vcpu, 0, reset_state.r0); + } + + /* Reset timer */ +-- +2.30.2 + diff --git a/queue-5.14/kvm-arm64-handle-psci-resets-before-userspace-touche.patch b/queue-5.14/kvm-arm64-handle-psci-resets-before-userspace-touche.patch new file mode 100644 index 00000000000..265ff384f13 --- /dev/null +++ b/queue-5.14/kvm-arm64-handle-psci-resets-before-userspace-touche.patch @@ -0,0 +1,51 @@ +From e030c9f681385da6e491369d07052b3b24fc840d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 20:21:31 +0000 +Subject: KVM: arm64: Handle PSCI resets before userspace touches vCPU state + +From: Oliver Upton + +[ Upstream commit 6826c6849b46aaa91300201213701eb861af4ba0 ] + +The CPU_ON PSCI call takes a payload that KVM uses to configure a +destination vCPU to run. This payload is non-architectural state and not +exposed through any existing UAPI. Effectively, we have a race between +CPU_ON and userspace saving/restoring a guest: if the target vCPU isn't +ran again before the VMM saves its state, the requested PC and context +ID are lost. When restored, the target vCPU will be runnable and start +executing at its old PC. + +We can avoid this race by making sure the reset payload is serviced +before userspace can access a vCPU's state. + +Fixes: 358b28f09f0a ("arm/arm64: KVM: Allow a VCPU to fully reset itself") +Signed-off-by: Oliver Upton +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20210818202133.1106786-3-oupton@google.com +Signed-off-by: Sasha Levin +--- + arch/arm64/kvm/arm.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c +index 5d1fc9c4bca5..45ee8abcf202 100644 +--- a/arch/arm64/kvm/arm.c ++++ b/arch/arm64/kvm/arm.c +@@ -1220,6 +1220,14 @@ long kvm_arch_vcpu_ioctl(struct file *filp, + if (copy_from_user(®, argp, sizeof(reg))) + break; + ++ /* ++ * We could owe a reset due to PSCI. Handle the pending reset ++ * here to ensure userspace register accesses are ordered after ++ * the reset. ++ */ ++ if (kvm_check_request(KVM_REQ_VCPU_RESET, vcpu)) ++ kvm_reset_vcpu(vcpu); ++ + if (ioctl == KVM_SET_ONE_REG) + r = kvm_arm_set_reg(vcpu, ®); + else +-- +2.30.2 + diff --git a/queue-5.14/kvm-arm64-make-hyp_panic-more-robust-when-protected-.patch b/queue-5.14/kvm-arm64-make-hyp_panic-more-robust-when-protected-.patch new file mode 100644 index 00000000000..d531575c214 --- /dev/null +++ b/queue-5.14/kvm-arm64-make-hyp_panic-more-robust-when-protected-.patch @@ -0,0 +1,136 @@ +From 318dccfcb794eb5d15e1f4c7edd92851a4678896 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 14:03:36 +0100 +Subject: KVM: arm64: Make hyp_panic() more robust when protected mode is + enabled + +From: Will Deacon + +[ Upstream commit ccac96977243d7916053550f62e6489760ad0adc ] + +When protected mode is enabled, the host is unable to access most parts +of the EL2 hypervisor image, including 'hyp_physvirt_offset' and the +contents of the hypervisor's '.rodata.str' section. Unfortunately, +nvhe_hyp_panic_handler() tries to read from both of these locations when +handling a BUG() triggered at EL2; the former for converting the ELR to +a physical address and the latter for displaying the name of the source +file where the BUG() occurred. + +Hack the EL2 panic asm to pass both physical and virtual ELR values to +the host and utilise the newly introduced CONFIG_NVHE_EL2_DEBUG so that +we disable stage-2 protection for the host before returning to the EL1 +panic handler. If the debug option is not enabled, display the address +instead of the source file:line information. + +Cc: Andrew Scull +Cc: Quentin Perret +Signed-off-by: Will Deacon +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20210813130336.8139-1-will@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/kvm/handle_exit.c | 23 ++++++++++++++--------- + arch/arm64/kvm/hyp/nvhe/host.S | 21 +++++++++++++++++---- + 2 files changed, 31 insertions(+), 13 deletions(-) + +diff --git a/arch/arm64/kvm/handle_exit.c b/arch/arm64/kvm/handle_exit.c +index 6f48336b1d86..04ebab299aa4 100644 +--- a/arch/arm64/kvm/handle_exit.c ++++ b/arch/arm64/kvm/handle_exit.c +@@ -292,11 +292,12 @@ void handle_exit_early(struct kvm_vcpu *vcpu, int exception_index) + kvm_handle_guest_serror(vcpu, kvm_vcpu_get_esr(vcpu)); + } + +-void __noreturn __cold nvhe_hyp_panic_handler(u64 esr, u64 spsr, u64 elr, ++void __noreturn __cold nvhe_hyp_panic_handler(u64 esr, u64 spsr, ++ u64 elr_virt, u64 elr_phys, + u64 par, uintptr_t vcpu, + u64 far, u64 hpfar) { +- u64 elr_in_kimg = __phys_to_kimg(__hyp_pa(elr)); +- u64 hyp_offset = elr_in_kimg - kaslr_offset() - elr; ++ u64 elr_in_kimg = __phys_to_kimg(elr_phys); ++ u64 hyp_offset = elr_in_kimg - kaslr_offset() - elr_virt; + u64 mode = spsr & PSR_MODE_MASK; + + /* +@@ -309,20 +310,24 @@ void __noreturn __cold nvhe_hyp_panic_handler(u64 esr, u64 spsr, u64 elr, + kvm_err("Invalid host exception to nVHE hyp!\n"); + } else if (ESR_ELx_EC(esr) == ESR_ELx_EC_BRK64 && + (esr & ESR_ELx_BRK64_ISS_COMMENT_MASK) == BUG_BRK_IMM) { +- struct bug_entry *bug = find_bug(elr_in_kimg); + const char *file = NULL; + unsigned int line = 0; + + /* All hyp bugs, including warnings, are treated as fatal. */ +- if (bug) +- bug_get_file_line(bug, &file, &line); ++ if (!is_protected_kvm_enabled() || ++ IS_ENABLED(CONFIG_NVHE_EL2_DEBUG)) { ++ struct bug_entry *bug = find_bug(elr_in_kimg); ++ ++ if (bug) ++ bug_get_file_line(bug, &file, &line); ++ } + + if (file) + kvm_err("nVHE hyp BUG at: %s:%u!\n", file, line); + else +- kvm_err("nVHE hyp BUG at: %016llx!\n", elr + hyp_offset); ++ kvm_err("nVHE hyp BUG at: %016llx!\n", elr_virt + hyp_offset); + } else { +- kvm_err("nVHE hyp panic at: %016llx!\n", elr + hyp_offset); ++ kvm_err("nVHE hyp panic at: %016llx!\n", elr_virt + hyp_offset); + } + + /* +@@ -334,5 +339,5 @@ void __noreturn __cold nvhe_hyp_panic_handler(u64 esr, u64 spsr, u64 elr, + kvm_err("Hyp Offset: 0x%llx\n", hyp_offset); + + panic("HYP panic:\nPS:%08llx PC:%016llx ESR:%08llx\nFAR:%016llx HPFAR:%016llx PAR:%016llx\nVCPU:%016lx\n", +- spsr, elr, esr, far, hpfar, par, vcpu); ++ spsr, elr_virt, esr, far, hpfar, par, vcpu); + } +diff --git a/arch/arm64/kvm/hyp/nvhe/host.S b/arch/arm64/kvm/hyp/nvhe/host.S +index 2b23400e0fb3..4b652ffb591d 100644 +--- a/arch/arm64/kvm/hyp/nvhe/host.S ++++ b/arch/arm64/kvm/hyp/nvhe/host.S +@@ -7,6 +7,7 @@ + #include + + #include ++#include + #include + #include + +@@ -85,12 +86,24 @@ SYM_FUNC_START(__hyp_do_panic) + + mov x29, x0 + ++#ifdef CONFIG_NVHE_EL2_DEBUG ++ /* Ensure host stage-2 is disabled */ ++ mrs x0, hcr_el2 ++ bic x0, x0, #HCR_VM ++ msr hcr_el2, x0 ++ isb ++ tlbi vmalls12e1 ++ dsb nsh ++#endif ++ + /* Load the panic arguments into x0-7 */ + mrs x0, esr_el2 +- get_vcpu_ptr x4, x5 +- mrs x5, far_el2 +- mrs x6, hpfar_el2 +- mov x7, xzr // Unused argument ++ mov x4, x3 ++ mov x3, x2 ++ hyp_pa x3, x6 ++ get_vcpu_ptr x5, x6 ++ mrs x6, far_el2 ++ mrs x7, hpfar_el2 + + /* Enter the host, conditionally restoring the host context. */ + cbz x29, __host_enter_without_restoring +-- +2.30.2 + diff --git a/queue-5.14/kvm-arm64-restrict-ipa-size-to-maximum-48-bits-on-4k.patch b/queue-5.14/kvm-arm64-restrict-ipa-size-to-maximum-48-bits-on-4k.patch new file mode 100644 index 00000000000..a3a6c6ac486 --- /dev/null +++ b/queue-5.14/kvm-arm64-restrict-ipa-size-to-maximum-48-bits-on-4k.patch @@ -0,0 +1,60 @@ +From 4decf8adb16425f326e9bea63bacb330f7a6d65d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Aug 2021 16:41:15 +0530 +Subject: KVM: arm64: Restrict IPA size to maximum 48 bits on 4K and 16K page + size + +From: Anshuman Khandual + +[ Upstream commit 5e5df9571c319fb107d7a523cc96fcc99961ee70 ] + +Even though ID_AA64MMFR0.PARANGE reports 52 bit PA size support, it cannot +be enabled as guest IPA size on 4K or 16K page size configurations. Hence +kvm_ipa_limit must be restricted to 48 bits. This change achieves required +IPA capping. + +Before the commit c9b69a0cf0b4 ("KVM: arm64: Don't constrain maximum IPA +size based on host configuration"), the problem here would have been just +latent via PHYS_MASK_SHIFT (which earlier in turn capped kvm_ipa_limit), +which remains capped at 48 bits on 4K and 16K configs. + +Cc: Marc Zyngier +Cc: James Morse +Cc: Alexandru Elisei +Cc: Suzuki K Poulose +Cc: Catalin Marinas +Cc: Will Deacon +Cc: linux-arm-kernel@lists.infradead.org +Cc: kvmarm@lists.cs.columbia.edu +Cc: linux-kernel@vger.kernel.org +Fixes: c9b69a0cf0b4 ("KVM: arm64: Don't constrain maximum IPA size based on host configuration") +Signed-off-by: Anshuman Khandual +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/1628680275-16578-1-git-send-email-anshuman.khandual@arm.com +Signed-off-by: Sasha Levin +--- + arch/arm64/kvm/reset.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c +index cba7872d69a8..78d4bd897fbc 100644 +--- a/arch/arm64/kvm/reset.c ++++ b/arch/arm64/kvm/reset.c +@@ -317,6 +317,14 @@ int kvm_set_ipa_limit(void) + mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1); + parange = cpuid_feature_extract_unsigned_field(mmfr0, + ID_AA64MMFR0_PARANGE_SHIFT); ++ /* ++ * IPA size beyond 48 bits could not be supported ++ * on either 4K or 16K page size. Hence let's cap ++ * it to 48 bits, in case it's reported as larger ++ * on the system. ++ */ ++ if (PAGE_SIZE != SZ_64K) ++ parange = min(parange, (unsigned int)ID_AA64MMFR0_PARANGE_48); + + /* + * Check with ARMv8.5-GTG that our PAGE_SIZE is supported at +-- +2.30.2 + diff --git a/queue-5.14/loop-reduce-the-loop_ctl_mutex-scope.patch b/queue-5.14/loop-reduce-the-loop_ctl_mutex-scope.patch new file mode 100644 index 00000000000..82776873bd2 --- /dev/null +++ b/queue-5.14/loop-reduce-the-loop_ctl_mutex-scope.patch @@ -0,0 +1,230 @@ +From 1e13eeec4f00e4b017ab4bb7e0530e03f6ddf691 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Sep 2021 09:07:35 +0900 +Subject: loop: reduce the loop_ctl_mutex scope + +From: Tetsuo Handa + +[ Upstream commit 1c500ad706383f1a6609e63d0b5d1723fd84dab9 ] + +syzbot is reporting circular locking problem at __loop_clr_fd() [1], for +commit a160c6159d4a0cf8 ("block: add an optional probe callback to +major_names") is calling the module's probe function with major_names_lock +held. + +Fortunately, since commit 990e78116d38059c ("block: loop: fix deadlock +between open and remove") stopped holding loop_ctl_mutex in lo_open(), +current role of loop_ctl_mutex is to serialize access to loop_index_idr +and loop_add()/loop_remove(); in other words, management of id for IDR. +To avoid holding loop_ctl_mutex during whole add/remove operation, use +a bool flag to indicate whether the loop device is ready for use. + +loop_unregister_transfer() which is called from cleanup_cryptoloop() +currently has possibility of use-after-free problem due to lack of +serialization between kfree() from loop_remove() from loop_control_remove() +and mutex_lock() from unregister_transfer_cb(). But since lo->lo_encryption +should be already NULL when this function is called due to module unload, +and commit 222013f9ac30b9ce ("cryptoloop: add a deprecation warning") +indicates that we will remove this function shortly, this patch updates +this function to emit warning instead of checking lo->lo_encryption. + +Holding loop_ctl_mutex in loop_exit() is pointless, for all users must +close /dev/loop-control and /dev/loop$num (in order to drop module's +refcount to 0) before loop_exit() starts, and nobody can open +/dev/loop-control or /dev/loop$num afterwards. + +Link: https://syzkaller.appspot.com/bug?id=7bb10e8b62f83e4d445cdf4c13d69e407e629558 [1] +Reported-by: syzbot +Signed-off-by: Tetsuo Handa +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/adb1e792-fc0e-ee81-7ea0-0906fc36419d@i-love.sakura.ne.jp +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/loop.c | 75 +++++++++++++++++++++++++++++--------------- + drivers/block/loop.h | 1 + + 2 files changed, 50 insertions(+), 26 deletions(-) + +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index f0cdff0c5fbf..1f91bd41a29b 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -2113,18 +2113,6 @@ int loop_register_transfer(struct loop_func_table *funcs) + return 0; + } + +-static int unregister_transfer_cb(int id, void *ptr, void *data) +-{ +- struct loop_device *lo = ptr; +- struct loop_func_table *xfer = data; +- +- mutex_lock(&lo->lo_mutex); +- if (lo->lo_encryption == xfer) +- loop_release_xfer(lo); +- mutex_unlock(&lo->lo_mutex); +- return 0; +-} +- + int loop_unregister_transfer(int number) + { + unsigned int n = number; +@@ -2132,9 +2120,20 @@ int loop_unregister_transfer(int number) + + if (n == 0 || n >= MAX_LO_CRYPT || (xfer = xfer_funcs[n]) == NULL) + return -EINVAL; ++ /* ++ * This function is called from only cleanup_cryptoloop(). ++ * Given that each loop device that has a transfer enabled holds a ++ * reference to the module implementing it we should never get here ++ * with a transfer that is set (unless forced module unloading is ++ * requested). Thus, check module's refcount and warn if this is ++ * not a clean unloading. ++ */ ++#ifdef CONFIG_MODULE_UNLOAD ++ if (xfer->owner && module_refcount(xfer->owner) != -1) ++ pr_err("Danger! Unregistering an in use transfer function.\n"); ++#endif + + xfer_funcs[n] = NULL; +- idr_for_each(&loop_index_idr, &unregister_transfer_cb, xfer); + return 0; + } + +@@ -2325,8 +2324,9 @@ static int loop_add(int i) + } else { + err = idr_alloc(&loop_index_idr, lo, 0, 0, GFP_KERNEL); + } ++ mutex_unlock(&loop_ctl_mutex); + if (err < 0) +- goto out_unlock; ++ goto out_free_dev; + i = err; + + err = -ENOMEM; +@@ -2392,15 +2392,19 @@ static int loop_add(int i) + disk->private_data = lo; + disk->queue = lo->lo_queue; + sprintf(disk->disk_name, "loop%d", i); ++ /* Make this loop device reachable from pathname. */ + add_disk(disk); ++ /* Show this loop device. */ ++ mutex_lock(&loop_ctl_mutex); ++ lo->idr_visible = true; + mutex_unlock(&loop_ctl_mutex); + return i; + + out_cleanup_tags: + blk_mq_free_tag_set(&lo->tag_set); + out_free_idr: ++ mutex_lock(&loop_ctl_mutex); + idr_remove(&loop_index_idr, i); +-out_unlock: + mutex_unlock(&loop_ctl_mutex); + out_free_dev: + kfree(lo); +@@ -2410,9 +2414,14 @@ out: + + static void loop_remove(struct loop_device *lo) + { ++ /* Make this loop device unreachable from pathname. */ + del_gendisk(lo->lo_disk); + blk_cleanup_disk(lo->lo_disk); + blk_mq_free_tag_set(&lo->tag_set); ++ mutex_lock(&loop_ctl_mutex); ++ idr_remove(&loop_index_idr, lo->lo_number); ++ mutex_unlock(&loop_ctl_mutex); ++ /* There is no route which can find this loop device. */ + mutex_destroy(&lo->lo_mutex); + kfree(lo); + } +@@ -2436,31 +2445,40 @@ static int loop_control_remove(int idx) + return -EINVAL; + } + ++ /* Hide this loop device for serialization. */ + ret = mutex_lock_killable(&loop_ctl_mutex); + if (ret) + return ret; +- + lo = idr_find(&loop_index_idr, idx); +- if (!lo) { ++ if (!lo || !lo->idr_visible) + ret = -ENODEV; +- goto out_unlock_ctrl; +- } ++ else ++ lo->idr_visible = false; ++ mutex_unlock(&loop_ctl_mutex); ++ if (ret) ++ return ret; + ++ /* Check whether this loop device can be removed. */ + ret = mutex_lock_killable(&lo->lo_mutex); + if (ret) +- goto out_unlock_ctrl; ++ goto mark_visible; + if (lo->lo_state != Lo_unbound || + atomic_read(&lo->lo_refcnt) > 0) { + mutex_unlock(&lo->lo_mutex); + ret = -EBUSY; +- goto out_unlock_ctrl; ++ goto mark_visible; + } ++ /* Mark this loop device no longer open()-able. */ + lo->lo_state = Lo_deleting; + mutex_unlock(&lo->lo_mutex); + +- idr_remove(&loop_index_idr, lo->lo_number); + loop_remove(lo); +-out_unlock_ctrl: ++ return 0; ++ ++mark_visible: ++ /* Show this loop device again. */ ++ mutex_lock(&loop_ctl_mutex); ++ lo->idr_visible = true; + mutex_unlock(&loop_ctl_mutex); + return ret; + } +@@ -2474,7 +2492,8 @@ static int loop_control_get_free(int idx) + if (ret) + return ret; + idr_for_each_entry(&loop_index_idr, lo, id) { +- if (lo->lo_state == Lo_unbound) ++ /* Hitting a race results in creating a new loop device which is harmless. */ ++ if (lo->idr_visible && data_race(lo->lo_state) == Lo_unbound) + goto found; + } + mutex_unlock(&loop_ctl_mutex); +@@ -2590,10 +2609,14 @@ static void __exit loop_exit(void) + unregister_blkdev(LOOP_MAJOR, "loop"); + misc_deregister(&loop_misc); + +- mutex_lock(&loop_ctl_mutex); ++ /* ++ * There is no need to use loop_ctl_mutex here, for nobody else can ++ * access loop_index_idr when this module is unloading (unless forced ++ * module unloading is requested). If this is not a clean unloading, ++ * we have no means to avoid kernel crash. ++ */ + idr_for_each_entry(&loop_index_idr, lo, id) + loop_remove(lo); +- mutex_unlock(&loop_ctl_mutex); + + idr_destroy(&loop_index_idr); + } +diff --git a/drivers/block/loop.h b/drivers/block/loop.h +index 1988899db63a..04c88dd6eabd 100644 +--- a/drivers/block/loop.h ++++ b/drivers/block/loop.h +@@ -68,6 +68,7 @@ struct loop_device { + struct blk_mq_tag_set tag_set; + struct gendisk *lo_disk; + struct mutex lo_mutex; ++ bool idr_visible; + }; + + struct loop_cmd { +-- +2.30.2 + diff --git a/queue-5.14/mfd-axp20x-update-axp288-volatile-ranges.patch b/queue-5.14/mfd-axp20x-update-axp288-volatile-ranges.patch new file mode 100644 index 00000000000..b62792b4e24 --- /dev/null +++ b/queue-5.14/mfd-axp20x-update-axp288-volatile-ranges.patch @@ -0,0 +1,80 @@ +From 93b5bcbb9632122735a484e337edd49f16dc754e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jun 2021 19:12:39 +0200 +Subject: mfd: axp20x: Update AXP288 volatile ranges + +From: Hans de Goede + +[ Upstream commit f949a9ebce7a18005266b859a17f10c891bb13d7 ] + +On Cherry Trail devices with an AXP288 PMIC the external SD-card slot +used the AXP's DLDO2 as card-voltage and either DLDO3 or GPIO1LDO +(GPIO1 pin in low noise LDO mode) as signal-voltage. + +These regulators are turned on/off and in case of the signal-voltage +also have their output-voltage changed by the _PS0 and _PS3 power- +management ACPI methods on the MMC-controllers ACPI fwnode as well as +by the _DSM ACPI method for changing the signal voltage. + +The AML code implementing these methods is directly accessing the +PMIC through ACPI I2C OpRegion accesses, instead of using the special +PMIC OpRegion handled by drivers/acpi/pmic/intel_pmic_xpower.c . + +This means that the contents of the involved PMIC registers can change +without the change being made through the regmap interface, so regmap +should not cache the contents of these registers. + +Mark the regulator power on/off, the regulator voltage control and the +GPIO1 control registers as volatile, to avoid regmap caching them. + +Specifically this fixes an issue on some models where the i915 driver +toggles another LDO using the same on/off register on/off through +MIPI sequences (through intel_soc_pmic_exec_mipi_pmic_seq_element()) +which then writes back a cached on/off register-value where the +card-voltage is off causing the external sdcard slot to stop working +when the screen goes blank, or comes back on again. + +The regulator register-range now marked volatile also includes the +buck regulator control registers. This is done on purpose these are +normally not touched by the AML code, but they are updated directly +by the SoC's PUNIT which means that they may also change without going +through regmap. + +Note the AXP288 PMIC is only used on Bay- and Cherry-Trail platforms, +so even though this is an ACPI specific problem there is no need to +make the new volatile ranges conditional since these platforms always +use ACPI. + +Fixes: dc91c3b6fe66 ("mfd: axp20x: Mark AXP20X_VBUS_IPSOUT_MGMT as volatile") +Fixes: cd53216625a0 ("mfd: axp20x: Fix axp288 volatile ranges") +Reported-and-tested-by: Clamshell +Signed-off-by: Hans de Goede +Reviewed-by: Chen-Yu Tsai +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/axp20x.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c +index 4145a38b3890..d0ac019850d1 100644 +--- a/drivers/mfd/axp20x.c ++++ b/drivers/mfd/axp20x.c +@@ -125,12 +125,13 @@ static const struct regmap_range axp288_writeable_ranges[] = { + + static const struct regmap_range axp288_volatile_ranges[] = { + regmap_reg_range(AXP20X_PWR_INPUT_STATUS, AXP288_POWER_REASON), ++ regmap_reg_range(AXP22X_PWR_OUT_CTRL1, AXP22X_ALDO3_V_OUT), + regmap_reg_range(AXP288_BC_GLOBAL, AXP288_BC_GLOBAL), + regmap_reg_range(AXP288_BC_DET_STAT, AXP20X_VBUS_IPSOUT_MGMT), + regmap_reg_range(AXP20X_CHRG_BAK_CTRL, AXP20X_CHRG_BAK_CTRL), + regmap_reg_range(AXP20X_IRQ1_EN, AXP20X_IPSOUT_V_HIGH_L), + regmap_reg_range(AXP20X_TIMER_CTRL, AXP20X_TIMER_CTRL), +- regmap_reg_range(AXP22X_GPIO_STATE, AXP22X_GPIO_STATE), ++ regmap_reg_range(AXP20X_GPIO1_CTRL, AXP22X_GPIO_STATE), + regmap_reg_range(AXP288_RT_BATT_V_H, AXP288_RT_BATT_V_L), + regmap_reg_range(AXP20X_FG_RES, AXP288_FG_CC_CAP_REG), + }; +-- +2.30.2 + diff --git a/queue-5.14/mfd-db8500-prcmu-adjust-map-to-reality.patch b/queue-5.14/mfd-db8500-prcmu-adjust-map-to-reality.patch new file mode 100644 index 00000000000..981d6ab9d1a --- /dev/null +++ b/queue-5.14/mfd-db8500-prcmu-adjust-map-to-reality.patch @@ -0,0 +1,59 @@ +From 6a46d8037b1237958ff4df0dcfdb7910a6bfd441 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Aug 2021 01:33:13 +0200 +Subject: mfd: db8500-prcmu: Adjust map to reality + +From: Linus Walleij + +[ Upstream commit ec343111c056ec3847800302f6dbc57281f833fa ] + +These are the actual frequencies reported by the PLL, so let's +report these. The roundoffs are inappropriate, we should round +to the frequency that the clock will later report. + +Drop some whitespace at the same time. + +Cc: phone-devel@vger.kernel.org +Signed-off-by: Linus Walleij +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/db8500-prcmu.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c +index 3bde7fda755f..dea4e4e8bed5 100644 +--- a/drivers/mfd/db8500-prcmu.c ++++ b/drivers/mfd/db8500-prcmu.c +@@ -1622,22 +1622,20 @@ static long round_clock_rate(u8 clock, unsigned long rate) + } + + static const unsigned long db8500_armss_freqs[] = { +- 200000000, +- 400000000, +- 800000000, ++ 199680000, ++ 399360000, ++ 798720000, + 998400000 + }; + + /* The DB8520 has slightly higher ARMSS max frequency */ + static const unsigned long db8520_armss_freqs[] = { +- 200000000, +- 400000000, +- 800000000, ++ 199680000, ++ 399360000, ++ 798720000, + 1152000000 + }; + +- +- + static long round_armss_rate(unsigned long rate) + { + unsigned long freq = 0; +-- +2.30.2 + diff --git a/queue-5.14/mfd-don-t-use-irq_create_mapping-to-resolve-a-mappin.patch b/queue-5.14/mfd-don-t-use-irq_create_mapping-to-resolve-a-mappin.patch new file mode 100644 index 00000000000..6c29495989f --- /dev/null +++ b/queue-5.14/mfd-don-t-use-irq_create_mapping-to-resolve-a-mappin.patch @@ -0,0 +1,95 @@ +From 9638e594cf41caea12fe848deb0bec6db8de24ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jul 2021 19:07:54 +0100 +Subject: mfd: Don't use irq_create_mapping() to resolve a mapping + +From: Marc Zyngier + +[ Upstream commit 9ff80e2de36d0554e3a6da18a171719fe8663c17 ] + +Although irq_create_mapping() is able to deal with duplicate +mappings, it really isn't supposed to be a substitute for +irq_find_mapping(), and can result in allocations that take place +in atomic context if the mapping didn't exist. + +Fix the handful of MFD drivers that use irq_create_mapping() in +interrupt context by using irq_find_mapping() instead. + +Cc: Linus Walleij +Cc: Lee Jones +Cc: Maxime Coquelin +Cc: Alexandre Torgue +Signed-off-by: Marc Zyngier +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/ab8500-core.c | 2 +- + drivers/mfd/stmpe.c | 4 ++-- + drivers/mfd/tc3589x.c | 2 +- + drivers/mfd/wm8994-irq.c | 2 +- + 4 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c +index 30489670ea52..cca0aac26148 100644 +--- a/drivers/mfd/ab8500-core.c ++++ b/drivers/mfd/ab8500-core.c +@@ -485,7 +485,7 @@ static int ab8500_handle_hierarchical_line(struct ab8500 *ab8500, + if (line == AB8540_INT_GPIO43F || line == AB8540_INT_GPIO44F) + line += 1; + +- handle_nested_irq(irq_create_mapping(ab8500->domain, line)); ++ handle_nested_irq(irq_find_mapping(ab8500->domain, line)); + } + + return 0; +diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c +index 1dd39483e7c1..58d09c615e67 100644 +--- a/drivers/mfd/stmpe.c ++++ b/drivers/mfd/stmpe.c +@@ -1095,7 +1095,7 @@ static irqreturn_t stmpe_irq(int irq, void *data) + + if (variant->id_val == STMPE801_ID || + variant->id_val == STMPE1600_ID) { +- int base = irq_create_mapping(stmpe->domain, 0); ++ int base = irq_find_mapping(stmpe->domain, 0); + + handle_nested_irq(base); + return IRQ_HANDLED; +@@ -1123,7 +1123,7 @@ static irqreturn_t stmpe_irq(int irq, void *data) + while (status) { + int bit = __ffs(status); + int line = bank * 8 + bit; +- int nestedirq = irq_create_mapping(stmpe->domain, line); ++ int nestedirq = irq_find_mapping(stmpe->domain, line); + + handle_nested_irq(nestedirq); + status &= ~(1 << bit); +diff --git a/drivers/mfd/tc3589x.c b/drivers/mfd/tc3589x.c +index 7614f8fe0e91..13583cdb93b6 100644 +--- a/drivers/mfd/tc3589x.c ++++ b/drivers/mfd/tc3589x.c +@@ -187,7 +187,7 @@ again: + + while (status) { + int bit = __ffs(status); +- int virq = irq_create_mapping(tc3589x->domain, bit); ++ int virq = irq_find_mapping(tc3589x->domain, bit); + + handle_nested_irq(virq); + status &= ~(1 << bit); +diff --git a/drivers/mfd/wm8994-irq.c b/drivers/mfd/wm8994-irq.c +index 6c3a619e2628..651a028bc519 100644 +--- a/drivers/mfd/wm8994-irq.c ++++ b/drivers/mfd/wm8994-irq.c +@@ -154,7 +154,7 @@ static irqreturn_t wm8994_edge_irq(int irq, void *data) + struct wm8994 *wm8994 = data; + + while (gpio_get_value_cansleep(wm8994->pdata.irq_gpio)) +- handle_nested_irq(irq_create_mapping(wm8994->edge_irq, 0)); ++ handle_nested_irq(irq_find_mapping(wm8994->edge_irq, 0)); + + return IRQ_HANDLED; + } +-- +2.30.2 + diff --git a/queue-5.14/mfd-lpc_sch-rename-gpiobase-to-prevent-build-error.patch b/queue-5.14/mfd-lpc_sch-rename-gpiobase-to-prevent-build-error.patch new file mode 100644 index 00000000000..793f7a74584 --- /dev/null +++ b/queue-5.14/mfd-lpc_sch-rename-gpiobase-to-prevent-build-error.patch @@ -0,0 +1,52 @@ +From ed97817bc0f342041624526cc2ce903dee941d30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Sep 2021 17:19:49 -0700 +Subject: mfd: lpc_sch: Rename GPIOBASE to prevent build error + +From: Randy Dunlap + +[ Upstream commit cdff1eda69326fb46de10c5454212b3efcf4bb41 ] + +One MIPS platform (mach-rc32434) defines GPIOBASE. This macro +conflicts with one of the same name in lpc_sch.c. Rename the latter one +to prevent the build error. + +../drivers/mfd/lpc_sch.c:25: error: "GPIOBASE" redefined [-Werror] + 25 | #define GPIOBASE 0x44 +../arch/mips/include/asm/mach-rc32434/rb.h:32: note: this is the location of the previous definition + 32 | #define GPIOBASE 0x050000 + +Cc: Denis Turischev +Fixes: e82c60ae7d3a ("mfd: Introduce lpc_sch for Intel SCH LPC bridge") +Signed-off-by: Randy Dunlap +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/lpc_sch.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mfd/lpc_sch.c b/drivers/mfd/lpc_sch.c +index 428a526cbe86..9ab9adce06fd 100644 +--- a/drivers/mfd/lpc_sch.c ++++ b/drivers/mfd/lpc_sch.c +@@ -22,7 +22,7 @@ + #define SMBASE 0x40 + #define SMBUS_IO_SIZE 64 + +-#define GPIOBASE 0x44 ++#define GPIO_BASE 0x44 + #define GPIO_IO_SIZE 64 + #define GPIO_IO_SIZE_CENTERTON 128 + +@@ -145,7 +145,7 @@ static int lpc_sch_probe(struct pci_dev *dev, const struct pci_device_id *id) + if (ret == 0) + cells++; + +- ret = lpc_sch_populate_cell(dev, GPIOBASE, "sch_gpio", ++ ret = lpc_sch_populate_cell(dev, GPIO_BASE, "sch_gpio", + info->io_size_gpio, + id->device, &lpc_sch_cells[cells]); + if (ret < 0) +-- +2.30.2 + diff --git a/queue-5.14/mfd-tqmx86-clear-gpio-irq-resource-when-no-irq-is-se.patch b/queue-5.14/mfd-tqmx86-clear-gpio-irq-resource-when-no-irq-is-se.patch new file mode 100644 index 00000000000..d136ccd75b6 --- /dev/null +++ b/queue-5.14/mfd-tqmx86-clear-gpio-irq-resource-when-no-irq-is-se.patch @@ -0,0 +1,40 @@ +From 9d0c71bfe618dee86731b28343ddcd1ba9a6ee40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jul 2021 12:00:48 +0200 +Subject: mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set + +From: Matthias Schiffer + +[ Upstream commit a946506c48f3bd09363c9d2b0a178e55733bcbb6 ] + +The driver was registering IRQ 0 when no IRQ was set. This leads to +warnings with newer kernels. + +Clear the resource flags, so no resource is registered at all in this +case. + +Fixes: 2f17dd34ffed ("mfd: tqmx86: IO controller with I2C, Wachdog and GPIO") +Signed-off-by: Matthias Schiffer +Reviewed-by: Andrew Lunn +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/tqmx86.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/mfd/tqmx86.c b/drivers/mfd/tqmx86.c +index ddddf08b6a4c..732013f40e4e 100644 +--- a/drivers/mfd/tqmx86.c ++++ b/drivers/mfd/tqmx86.c +@@ -209,6 +209,8 @@ static int tqmx86_probe(struct platform_device *pdev) + + /* Assumes the IRQ resource is first. */ + tqmx_gpio_resources[0].start = gpio_irq; ++ } else { ++ tqmx_gpio_resources[0].flags = 0; + } + + ocores_platfom_data.clock_khz = tqmx86_board_id_to_clk_rate(board_id); +-- +2.30.2 + diff --git a/queue-5.14/mlxbf_gige-clear-valid_polarity-upon-open.patch b/queue-5.14/mlxbf_gige-clear-valid_polarity-upon-open.patch new file mode 100644 index 00000000000..6ec6af858aa --- /dev/null +++ b/queue-5.14/mlxbf_gige-clear-valid_polarity-upon-open.patch @@ -0,0 +1,57 @@ +From dc9ea0c5a35f16dfbcb6a7a17600c9763e12ff62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Sep 2021 14:08:48 -0400 +Subject: mlxbf_gige: clear valid_polarity upon open + +From: David Thompson + +[ Upstream commit ee8a9600b5391f434905c46bec7f77d34505083e ] + +The network interface managed by the mlxbf_gige driver can +get into a problem state where traffic does not flow. +In this state, the interface will be up and enabled, but +will stop processing received packets. This problem state +will happen if three specific conditions occur: + 1) driver has received more than (N * RxRingSize) packets but + less than (N+1 * RxRingSize) packets, where N is an odd number + Note: the command "ethtool -g " will display the + current receive ring size, which currently defaults to 128 + 2) the driver's interface was disabled via "ifconfig oob_net0 down" + during the window described in #1. + 3) the driver's interface is re-enabled via "ifconfig oob_net0 up" + +This patch ensures that the driver's "valid_polarity" field is +cleared during the open() method so that it always matches the +receive polarity used by hardware. Without this fix, the driver +needs to be unloaded and reloaded to correct this problem state. + +Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver") +Reviewed-by: Asmaa Mnebhi +Signed-off-by: David Thompson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +index a0a059e0154f..04c7dc224eff 100644 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c ++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +@@ -142,6 +142,13 @@ static int mlxbf_gige_open(struct net_device *netdev) + err = mlxbf_gige_clean_port(priv); + if (err) + goto free_irqs; ++ ++ /* Clear driver's valid_polarity to match hardware, ++ * since the above call to clean_port() resets the ++ * receive polarity used by hardware. ++ */ ++ priv->valid_polarity = 0; ++ + err = mlxbf_gige_rx_init(priv); + if (err) + goto free_irqs; +-- +2.30.2 + diff --git a/queue-5.14/mptcp-fix-possible-divide-by-zero.patch b/queue-5.14/mptcp-fix-possible-divide-by-zero.patch new file mode 100644 index 00000000000..27bc868a614 --- /dev/null +++ b/queue-5.14/mptcp-fix-possible-divide-by-zero.patch @@ -0,0 +1,205 @@ +From c281dc614089ecc6e52491322182417f5c1d5fb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Sep 2021 10:15:36 -0700 +Subject: mptcp: fix possible divide by zero + +From: Paolo Abeni + +[ Upstream commit 1094c6fe7280e17e0e87934add5ad2585e990def ] + +Florian noted that if mptcp_alloc_tx_skb() allocation fails +in __mptcp_push_pending(), we can end-up invoking +mptcp_push_release()/tcp_push() with a zero mss, causing +a divide by 0 error. + +This change addresses the issue refactoring the skb allocation +code checking if skb collapsing will happen for sure and doing +the skb allocation only after such check. Skb allocation will +now happen only after the call to tcp_send_mss() which +correctly initializes mss_now. + +As side bonuses we now fill the skb tx cache only when needed, +and this also clean-up a bit the output path. + +v1 -> v2: + - use lockdep_assert_held_once() - Jakub + - fix indentation - Jakub + +Reported-by: Florian Westphal +Fixes: 724cfd2ee8aa ("mptcp: allocate TX skbs in msk context") +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mptcp/protocol.c | 76 ++++++++++++++++++++------------------------ + 1 file changed, 35 insertions(+), 41 deletions(-) + +diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c +index a88924947815..c018b591db0b 100644 +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -994,6 +994,13 @@ static void mptcp_wmem_uncharge(struct sock *sk, int size) + msk->wmem_reserved += size; + } + ++static void __mptcp_mem_reclaim_partial(struct sock *sk) ++{ ++ lockdep_assert_held_once(&sk->sk_lock.slock); ++ __mptcp_update_wmem(sk); ++ sk_mem_reclaim_partial(sk); ++} ++ + static void mptcp_mem_reclaim_partial(struct sock *sk) + { + struct mptcp_sock *msk = mptcp_sk(sk); +@@ -1069,12 +1076,8 @@ static void __mptcp_clean_una(struct sock *sk) + } + + out: +- if (cleaned) { +- if (tcp_under_memory_pressure(sk)) { +- __mptcp_update_wmem(sk); +- sk_mem_reclaim_partial(sk); +- } +- } ++ if (cleaned && tcp_under_memory_pressure(sk)) ++ __mptcp_mem_reclaim_partial(sk); + + if (snd_una == READ_ONCE(msk->snd_nxt)) { + if (msk->timer_ival && !mptcp_data_fin_enabled(msk)) +@@ -1154,6 +1157,7 @@ struct mptcp_sendmsg_info { + u16 limit; + u16 sent; + unsigned int flags; ++ bool data_lock_held; + }; + + static int mptcp_check_allowed_size(struct mptcp_sock *msk, u64 data_seq, +@@ -1225,17 +1229,17 @@ static bool __mptcp_alloc_tx_skb(struct sock *sk, struct sock *ssk, gfp_t gfp) + return false; + } + +-static bool mptcp_must_reclaim_memory(struct sock *sk, struct sock *ssk) ++static bool mptcp_alloc_tx_skb(struct sock *sk, struct sock *ssk, bool data_lock_held) + { +- return !ssk->sk_tx_skb_cache && +- tcp_under_memory_pressure(sk); +-} ++ gfp_t gfp = data_lock_held ? GFP_ATOMIC : sk->sk_allocation; + +-static bool mptcp_alloc_tx_skb(struct sock *sk, struct sock *ssk) +-{ +- if (unlikely(mptcp_must_reclaim_memory(sk, ssk))) +- mptcp_mem_reclaim_partial(sk); +- return __mptcp_alloc_tx_skb(sk, ssk, sk->sk_allocation); ++ if (unlikely(tcp_under_memory_pressure(sk))) { ++ if (data_lock_held) ++ __mptcp_mem_reclaim_partial(sk); ++ else ++ mptcp_mem_reclaim_partial(sk); ++ } ++ return __mptcp_alloc_tx_skb(sk, ssk, gfp); + } + + /* note: this always recompute the csum on the whole skb, even +@@ -1259,7 +1263,7 @@ static int mptcp_sendmsg_frag(struct sock *sk, struct sock *ssk, + bool zero_window_probe = false; + struct mptcp_ext *mpext = NULL; + struct sk_buff *skb, *tail; +- bool can_collapse = false; ++ bool must_collapse = false; + int size_bias = 0; + int avail_size; + size_t ret = 0; +@@ -1279,16 +1283,24 @@ static int mptcp_sendmsg_frag(struct sock *sk, struct sock *ssk, + * SSN association set here + */ + mpext = skb_ext_find(skb, SKB_EXT_MPTCP); +- can_collapse = (info->size_goal - skb->len > 0) && +- mptcp_skb_can_collapse_to(data_seq, skb, mpext); +- if (!can_collapse) { ++ if (!mptcp_skb_can_collapse_to(data_seq, skb, mpext)) { + TCP_SKB_CB(skb)->eor = 1; +- } else { ++ goto alloc_skb; ++ } ++ ++ must_collapse = (info->size_goal - skb->len > 0) && ++ (skb_shinfo(skb)->nr_frags < sysctl_max_skb_frags); ++ if (must_collapse) { + size_bias = skb->len; + avail_size = info->size_goal - skb->len; + } + } + ++alloc_skb: ++ if (!must_collapse && !ssk->sk_tx_skb_cache && ++ !mptcp_alloc_tx_skb(sk, ssk, info->data_lock_held)) ++ return 0; ++ + /* Zero window and all data acked? Probe. */ + avail_size = mptcp_check_allowed_size(msk, data_seq, avail_size); + if (avail_size == 0) { +@@ -1318,7 +1330,6 @@ static int mptcp_sendmsg_frag(struct sock *sk, struct sock *ssk, + if (skb == tail) { + TCP_SKB_CB(tail)->tcp_flags &= ~TCPHDR_PSH; + mpext->data_len += ret; +- WARN_ON_ONCE(!can_collapse); + WARN_ON_ONCE(zero_window_probe); + goto out; + } +@@ -1470,15 +1481,6 @@ static void __mptcp_push_pending(struct sock *sk, unsigned int flags) + if (ssk != prev_ssk || !prev_ssk) + lock_sock(ssk); + +- /* keep it simple and always provide a new skb for the +- * subflow, even if we will not use it when collapsing +- * on the pending one +- */ +- if (!mptcp_alloc_tx_skb(sk, ssk)) { +- mptcp_push_release(sk, ssk, &info); +- goto out; +- } +- + ret = mptcp_sendmsg_frag(sk, ssk, dfrag, &info); + if (ret <= 0) { + mptcp_push_release(sk, ssk, &info); +@@ -1512,7 +1514,9 @@ out: + static void __mptcp_subflow_push_pending(struct sock *sk, struct sock *ssk) + { + struct mptcp_sock *msk = mptcp_sk(sk); +- struct mptcp_sendmsg_info info; ++ struct mptcp_sendmsg_info info = { ++ .data_lock_held = true, ++ }; + struct mptcp_data_frag *dfrag; + struct sock *xmit_ssk; + int len, copied = 0; +@@ -1538,13 +1542,6 @@ static void __mptcp_subflow_push_pending(struct sock *sk, struct sock *ssk) + goto out; + } + +- if (unlikely(mptcp_must_reclaim_memory(sk, ssk))) { +- __mptcp_update_wmem(sk); +- sk_mem_reclaim_partial(sk); +- } +- if (!__mptcp_alloc_tx_skb(sk, ssk, GFP_ATOMIC)) +- goto out; +- + ret = mptcp_sendmsg_frag(sk, ssk, dfrag, &info); + if (ret <= 0) + goto out; +@@ -2296,9 +2293,6 @@ static void __mptcp_retrans(struct sock *sk) + info.sent = 0; + info.limit = READ_ONCE(msk->csum_enabled) ? dfrag->data_len : dfrag->already_sent; + while (info.sent < info.limit) { +- if (!mptcp_alloc_tx_skb(sk, ssk)) +- break; +- + ret = mptcp_sendmsg_frag(sk, ssk, dfrag, &info); + if (ret <= 0) + break; +-- +2.30.2 + diff --git a/queue-5.14/mptcp-only-send-extra-tcp-acks-in-eligible-socket-st.patch b/queue-5.14/mptcp-only-send-extra-tcp-acks-in-eligible-socket-st.patch new file mode 100644 index 00000000000..8ba42d03f46 --- /dev/null +++ b/queue-5.14/mptcp-only-send-extra-tcp-acks-in-eligible-socket-st.patch @@ -0,0 +1,168 @@ +From 988add7b0cff4a6fe81ac139fc83208565ea89ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Sep 2021 11:51:19 -0700 +Subject: mptcp: Only send extra TCP acks in eligible socket states + +From: Mat Martineau + +[ Upstream commit 340fa6667a696338e707cd5531a9631093d1be29 ] + +Recent changes exposed a bug where specifically-timed requests to the +path manager netlink API could trigger a divide-by-zero in +__tcp_select_window(), as syzkaller does: + +divide error: 0000 [#1] SMP KASAN NOPTI +CPU: 0 PID: 9667 Comm: syz-executor.0 Not tainted 5.14.0-rc6+ #3 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 +RIP: 0010:__tcp_select_window+0x509/0xa60 net/ipv4/tcp_output.c:3016 +Code: 44 89 ff e8 c9 29 e9 fd 45 39 e7 0f 8d 20 ff ff ff e8 db 28 e9 fd 44 89 e3 e9 13 ff ff ff e8 ce 28 e9 fd 44 89 e0 44 89 e3 99 7c 24 04 29 d3 e9 fc fe ff ff e8 b7 28 e9 fd 44 89 f1 48 89 ea +RSP: 0018:ffff888031ccf020 EFLAGS: 00010216 +RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000040000 +RDX: 0000000000000000 RSI: ffff88811532c080 RDI: 0000000000000002 +RBP: 0000000000000000 R08: ffffffff835807c2 R09: 0000000000000000 +R10: 0000000000000004 R11: ffffed1020b92441 R12: 0000000000000000 +R13: 1ffff11006399e08 R14: 0000000000000000 R15: 0000000000000000 +FS: 00007fa4c8344700(0000) GS:ffff88811ae00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000001b2f424000 CR3: 000000003e4e2003 CR4: 0000000000770ef0 +PKRU: 55555554 +Call Trace: + tcp_select_window net/ipv4/tcp_output.c:264 [inline] + __tcp_transmit_skb+0xc00/0x37a0 net/ipv4/tcp_output.c:1351 + __tcp_send_ack.part.0+0x3ec/0x760 net/ipv4/tcp_output.c:3972 + __tcp_send_ack net/ipv4/tcp_output.c:3978 [inline] + tcp_send_ack+0x7d/0xa0 net/ipv4/tcp_output.c:3978 + mptcp_pm_nl_addr_send_ack+0x1ab/0x380 net/mptcp/pm_netlink.c:654 + mptcp_pm_remove_addr+0x161/0x200 net/mptcp/pm.c:58 + mptcp_nl_remove_id_zero_address+0x197/0x460 net/mptcp/pm_netlink.c:1328 + mptcp_nl_cmd_del_addr+0x98b/0xd40 net/mptcp/pm_netlink.c:1359 + genl_family_rcv_msg_doit.isra.0+0x225/0x340 net/netlink/genetlink.c:731 + genl_family_rcv_msg net/netlink/genetlink.c:775 [inline] + genl_rcv_msg+0x341/0x5b0 net/netlink/genetlink.c:792 + netlink_rcv_skb+0x148/0x430 net/netlink/af_netlink.c:2504 + genl_rcv+0x24/0x40 net/netlink/genetlink.c:803 + netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] + netlink_unicast+0x537/0x750 net/netlink/af_netlink.c:1340 + netlink_sendmsg+0x846/0xd80 net/netlink/af_netlink.c:1929 + sock_sendmsg_nosec net/socket.c:704 [inline] + sock_sendmsg+0x14e/0x190 net/socket.c:724 + ____sys_sendmsg+0x709/0x870 net/socket.c:2403 + ___sys_sendmsg+0xff/0x170 net/socket.c:2457 + __sys_sendmsg+0xe5/0x1b0 net/socket.c:2486 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +mptcp_pm_nl_addr_send_ack() was attempting to send a TCP ACK on the +first subflow in the MPTCP socket's connection list without validating +that the subflow was in a suitable connection state. To address this, +always validate subflow state when sending extra ACKs on subflows +for address advertisement or subflow priority change. + +Fixes: 84dfe3677a6f ("mptcp: send out dedicated ADD_ADDR packet") +Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/229 +Co-developed-by: Paolo Abeni +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Acked-by: Geliang Tang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/mptcp/pm_netlink.c | 10 ++-------- + net/mptcp/protocol.c | 21 ++++++++++++--------- + net/mptcp/protocol.h | 1 + + 3 files changed, 15 insertions(+), 17 deletions(-) + +diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c +index 7b3794459783..89251cbe9f1a 100644 +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -540,7 +540,6 @@ void mptcp_pm_nl_addr_send_ack(struct mptcp_sock *msk) + subflow = list_first_entry_or_null(&msk->conn_list, typeof(*subflow), node); + if (subflow) { + struct sock *ssk = mptcp_subflow_tcp_sock(subflow); +- bool slow; + + spin_unlock_bh(&msk->pm.lock); + pr_debug("send ack for %s%s%s", +@@ -548,9 +547,7 @@ void mptcp_pm_nl_addr_send_ack(struct mptcp_sock *msk) + mptcp_pm_should_add_signal_ipv6(msk) ? " [ipv6]" : "", + mptcp_pm_should_add_signal_port(msk) ? " [port]" : ""); + +- slow = lock_sock_fast(ssk); +- tcp_send_ack(ssk); +- unlock_sock_fast(ssk, slow); ++ mptcp_subflow_send_ack(ssk); + spin_lock_bh(&msk->pm.lock); + } + } +@@ -567,7 +564,6 @@ int mptcp_pm_nl_mp_prio_send_ack(struct mptcp_sock *msk, + struct sock *ssk = mptcp_subflow_tcp_sock(subflow); + struct sock *sk = (struct sock *)msk; + struct mptcp_addr_info local; +- bool slow; + + local_address((struct sock_common *)ssk, &local); + if (!addresses_equal(&local, addr, addr->port)) +@@ -580,9 +576,7 @@ int mptcp_pm_nl_mp_prio_send_ack(struct mptcp_sock *msk, + + spin_unlock_bh(&msk->pm.lock); + pr_debug("send ack for mp_prio"); +- slow = lock_sock_fast(ssk); +- tcp_send_ack(ssk); +- unlock_sock_fast(ssk, slow); ++ mptcp_subflow_send_ack(ssk); + spin_lock_bh(&msk->pm.lock); + + return 0; +diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c +index c018b591db0b..acbead7cf50f 100644 +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -427,19 +427,22 @@ static bool tcp_can_send_ack(const struct sock *ssk) + (TCPF_SYN_SENT | TCPF_SYN_RECV | TCPF_TIME_WAIT | TCPF_CLOSE | TCPF_LISTEN)); + } + ++void mptcp_subflow_send_ack(struct sock *ssk) ++{ ++ bool slow; ++ ++ slow = lock_sock_fast(ssk); ++ if (tcp_can_send_ack(ssk)) ++ tcp_send_ack(ssk); ++ unlock_sock_fast(ssk, slow); ++} ++ + static void mptcp_send_ack(struct mptcp_sock *msk) + { + struct mptcp_subflow_context *subflow; + +- mptcp_for_each_subflow(msk, subflow) { +- struct sock *ssk = mptcp_subflow_tcp_sock(subflow); +- bool slow; +- +- slow = lock_sock_fast(ssk); +- if (tcp_can_send_ack(ssk)) +- tcp_send_ack(ssk); +- unlock_sock_fast(ssk, slow); +- } ++ mptcp_for_each_subflow(msk, subflow) ++ mptcp_subflow_send_ack(mptcp_subflow_tcp_sock(subflow)); + } + + static void mptcp_subflow_cleanup_rbuf(struct sock *ssk) +diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h +index 0f0c026c5f8b..6ac564d584c1 100644 +--- a/net/mptcp/protocol.h ++++ b/net/mptcp/protocol.h +@@ -560,6 +560,7 @@ void __init mptcp_subflow_init(void); + void mptcp_subflow_shutdown(struct sock *sk, struct sock *ssk, int how); + void mptcp_close_ssk(struct sock *sk, struct sock *ssk, + struct mptcp_subflow_context *subflow); ++void mptcp_subflow_send_ack(struct sock *ssk); + void mptcp_subflow_reset(struct sock *ssk); + void mptcp_sock_graft(struct sock *sk, struct socket *parent); + struct socket *__mptcp_nmpc_socket(const struct mptcp_sock *msk); +-- +2.30.2 + diff --git a/queue-5.14/mtd-mtdconcat-check-_read-_write-callbacks-existence.patch b/queue-5.14/mtd-mtdconcat-check-_read-_write-callbacks-existence.patch new file mode 100644 index 00000000000..bce928911b9 --- /dev/null +++ b/queue-5.14/mtd-mtdconcat-check-_read-_write-callbacks-existence.patch @@ -0,0 +1,57 @@ +From 2629ae8a09bb22e43626e066c4caa2909c85be31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Aug 2021 19:48:57 +0800 +Subject: mtd: mtdconcat: Check _read, _write callbacks existence before + assignment + +From: Zhihao Cheng + +[ Upstream commit a89d69a44e282be95ae76125dddc79515541efeb ] + +Since 2431c4f5b46c3 ("mtd: Implement mtd_{read,write}() as wrappers +around mtd_{read,write}_oob()") don't allow _write|_read and +_write_oob|_read_oob existing at the same time, we should check the +existence of callbacks "_read and _write" from subdev's master device +(We can trust master device since it has been registered) before +assigning, otherwise following warning occurs while making +concatenated device: + + WARNING: CPU: 2 PID: 6728 at drivers/mtd/mtdcore.c:595 + add_mtd_device+0x7f/0x7b0 + +Fixes: 2431c4f5b46c3 ("mtd: Implement mtd_{read,write}() around ...") +Signed-off-by: Zhihao Cheng +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20210817114857.2784825-3-chengzhihao1@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/mtdconcat.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c +index af51eee6b5e8..f685a581df48 100644 +--- a/drivers/mtd/mtdconcat.c ++++ b/drivers/mtd/mtdconcat.c +@@ -694,6 +694,10 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[], /* subdevices to c + concat->mtd._block_markbad = concat_block_markbad; + if (subdev_master->_panic_write) + concat->mtd._panic_write = concat_panic_write; ++ if (subdev_master->_read) ++ concat->mtd._read = concat_read; ++ if (subdev_master->_write) ++ concat->mtd._write = concat_write; + + concat->mtd.ecc_stats.badblocks = subdev[0]->ecc_stats.badblocks; + +@@ -755,8 +759,6 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[], /* subdevices to c + concat->mtd.name = name; + + concat->mtd._erase = concat_erase; +- concat->mtd._read = concat_read; +- concat->mtd._write = concat_write; + concat->mtd._sync = concat_sync; + concat->mtd._lock = concat_lock; + concat->mtd._unlock = concat_unlock; +-- +2.30.2 + diff --git a/queue-5.14/mtd-mtdconcat-judge-callback-existence-based-on-the-.patch b/queue-5.14/mtd-mtdconcat-judge-callback-existence-based-on-the-.patch new file mode 100644 index 00000000000..a6ed9ce266e --- /dev/null +++ b/queue-5.14/mtd-mtdconcat-judge-callback-existence-based-on-the-.patch @@ -0,0 +1,141 @@ +From 718c563d20d5c55072180bee85473ce817d6ef5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Aug 2021 19:48:56 +0800 +Subject: mtd: mtdconcat: Judge callback existence based on the master + +From: Zhihao Cheng + +[ Upstream commit f9e109a209a8e01e16f37e1252304f1eb3908be4 ] + +Since commit 46b5889cc2c5("mtd: implement proper partition handling") +applied, mtd partition device won't hold some callback functions, such +as _block_isbad, _block_markbad, etc. Besides, function mtd_block_isbad() +will get mtd device's master mtd device, then invokes master mtd device's +callback function. So, following process may result mtd_block_isbad() +always return 0, even though mtd device has bad blocks: + +1. Split a mtd device into 3 partitions: PA, PB, PC +[ Each mtd partition device won't has callback function _block_isbad(). ] +2. Concatenate PA and PB as a new mtd device PN +[ mtd_concat_create() finds out each subdev has no callback function +_block_isbad(), so PN won't be assigned callback function +concat_block_isbad(). ] +Then, mtd_block_isbad() checks "!master->_block_isbad" is true, will +always return 0. + +Reproducer: +// reproduce.c +static int __init init_diy_module(void) +{ + struct mtd_info *mtd[2]; + struct mtd_info *mtd_combine = NULL; + + mtd[0] = get_mtd_device_nm("NAND simulator partition 0"); + if (!mtd[0]) { + pr_err("cannot find mtd1\n"); + return -EINVAL; + } + mtd[1] = get_mtd_device_nm("NAND simulator partition 1"); + if (!mtd[1]) { + pr_err("cannot find mtd2\n"); + return -EINVAL; + } + + put_mtd_device(mtd[0]); + put_mtd_device(mtd[1]); + + mtd_combine = mtd_concat_create(mtd, 2, "Combine mtd"); + if (mtd_combine == NULL) { + pr_err("combine failed\n"); + return -EINVAL; + } + + mtd_device_register(mtd_combine, NULL, 0); + pr_info("Combine success\n"); + + return 0; +} + +1. ID="0x20,0xac,0x00,0x15" +2. modprobe nandsim id_bytes=$ID parts=50,100 badblocks=100 +3. insmod reproduce.ko +4. flash_erase /dev/mtd3 0 0 + libmtd: error!: MEMERASE64 ioctl failed for eraseblock 100 (mtd3) + error 5 (Input/output error) + // Should be "flash_erase: Skipping bad block at 00c80000" + +Fixes: 46b5889cc2c54bac ("mtd: implement proper partition handling") +Signed-off-by: Zhihao Cheng +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20210817114857.2784825-2-chengzhihao1@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/mtdconcat.c | 27 +++++++++++++++++++-------- + 1 file changed, 19 insertions(+), 8 deletions(-) + +diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c +index 6e4d0017c0bd..af51eee6b5e8 100644 +--- a/drivers/mtd/mtdconcat.c ++++ b/drivers/mtd/mtdconcat.c +@@ -641,6 +641,7 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[], /* subdevices to c + int i; + size_t size; + struct mtd_concat *concat; ++ struct mtd_info *subdev_master = NULL; + uint32_t max_erasesize, curr_erasesize; + int num_erase_region; + int max_writebufsize = 0; +@@ -679,17 +680,19 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[], /* subdevices to c + concat->mtd.subpage_sft = subdev[0]->subpage_sft; + concat->mtd.oobsize = subdev[0]->oobsize; + concat->mtd.oobavail = subdev[0]->oobavail; +- if (subdev[0]->_writev) ++ ++ subdev_master = mtd_get_master(subdev[0]); ++ if (subdev_master->_writev) + concat->mtd._writev = concat_writev; +- if (subdev[0]->_read_oob) ++ if (subdev_master->_read_oob) + concat->mtd._read_oob = concat_read_oob; +- if (subdev[0]->_write_oob) ++ if (subdev_master->_write_oob) + concat->mtd._write_oob = concat_write_oob; +- if (subdev[0]->_block_isbad) ++ if (subdev_master->_block_isbad) + concat->mtd._block_isbad = concat_block_isbad; +- if (subdev[0]->_block_markbad) ++ if (subdev_master->_block_markbad) + concat->mtd._block_markbad = concat_block_markbad; +- if (subdev[0]->_panic_write) ++ if (subdev_master->_panic_write) + concat->mtd._panic_write = concat_panic_write; + + concat->mtd.ecc_stats.badblocks = subdev[0]->ecc_stats.badblocks; +@@ -721,14 +724,22 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[], /* subdevices to c + subdev[i]->flags & MTD_WRITEABLE; + } + ++ subdev_master = mtd_get_master(subdev[i]); + concat->mtd.size += subdev[i]->size; + concat->mtd.ecc_stats.badblocks += + subdev[i]->ecc_stats.badblocks; + if (concat->mtd.writesize != subdev[i]->writesize || + concat->mtd.subpage_sft != subdev[i]->subpage_sft || + concat->mtd.oobsize != subdev[i]->oobsize || +- !concat->mtd._read_oob != !subdev[i]->_read_oob || +- !concat->mtd._write_oob != !subdev[i]->_write_oob) { ++ !concat->mtd._read_oob != !subdev_master->_read_oob || ++ !concat->mtd._write_oob != !subdev_master->_write_oob) { ++ /* ++ * Check against subdev[i] for data members, because ++ * subdev's attributes may be different from master ++ * mtd device. Check against subdev's master mtd ++ * device for callbacks, because the existence of ++ * subdev's callbacks is decided by master mtd device. ++ */ + kfree(concat); + printk("Incompatible OOB or ECC data on \"%s\"\n", + subdev[i]->name); +-- +2.30.2 + diff --git a/queue-5.14/mtd-rawnand-cafe-fix-a-resource-leak-in-the-error-ha.patch b/queue-5.14/mtd-rawnand-cafe-fix-a-resource-leak-in-the-error-ha.patch new file mode 100644 index 00000000000..eed03a8e32e --- /dev/null +++ b/queue-5.14/mtd-rawnand-cafe-fix-a-resource-leak-in-the-error-ha.patch @@ -0,0 +1,53 @@ +From e777b1180654c8972bdf1a9cb27234006576cff2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Aug 2021 09:58:45 +0200 +Subject: mtd: rawnand: cafe: Fix a resource leak in the error handling path of + 'cafe_nand_probe()' +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christophe JAILLET + +[ Upstream commit 6b430c7595e4eb95fae8fb54adc3c3ce002e75ae ] + +A successful 'init_rs_non_canonical()' call should be balanced by a +corresponding 'free_rs()' call in the error handling path of the probe, as +already done in the remove function. + +Update the error handling path accordingly. + +Fixes: 8c61b7a7f4d4 ("[MTD] [NAND] Use rslib for CAFÉ ECC") +Signed-off-by: Christophe JAILLET +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/fd313d3fb787458bcc73189e349f481133a2cdc9.1629532640.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/cafe_nand.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/cafe_nand.c b/drivers/mtd/nand/raw/cafe_nand.c +index d0e8ffd55c22..9dbf031716a6 100644 +--- a/drivers/mtd/nand/raw/cafe_nand.c ++++ b/drivers/mtd/nand/raw/cafe_nand.c +@@ -751,7 +751,7 @@ static int cafe_nand_probe(struct pci_dev *pdev, + "CAFE NAND", mtd); + if (err) { + dev_warn(&pdev->dev, "Could not register IRQ %d\n", pdev->irq); +- goto out_ior; ++ goto out_free_rs; + } + + /* Disable master reset, enable NAND clock */ +@@ -795,6 +795,8 @@ static int cafe_nand_probe(struct pci_dev *pdev, + /* Disable NAND IRQ in global IRQ mask register */ + cafe_writel(cafe, ~1 & cafe_readl(cafe, GLOBAL_IRQ_MASK), GLOBAL_IRQ_MASK); + free_irq(pdev->irq, mtd); ++ out_free_rs: ++ free_rs(cafe->rs); + out_ior: + pci_iounmap(pdev, cafe->mmio); + out_free_mtd: +-- +2.30.2 + diff --git a/queue-5.14/net-dsa-b53-fix-calculating-number-of-switch-ports.patch b/queue-5.14/net-dsa-b53-fix-calculating-number-of-switch-ports.patch new file mode 100644 index 00000000000..a37780c9a07 --- /dev/null +++ b/queue-5.14/net-dsa-b53-fix-calculating-number-of-switch-ports.patch @@ -0,0 +1,49 @@ +From bbe4795a6b6e583a7ad634ffeae77aecaf093733 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Sep 2021 10:30:50 +0200 +Subject: net: dsa: b53: Fix calculating number of switch ports +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit cdb067d31c0fe4cce98b9d15f1f2ef525acaa094 ] + +It isn't true that CPU port is always the last one. Switches BCM5301x +have 9 ports (port 6 being inactive) and they use port 5 as CPU by +default (depending on design some other may be CPU ports too). + +A more reliable way of determining number of ports is to check for the +last set bit in the "enabled_ports" bitfield. + +This fixes b53 internal state, it will allow providing accurate info to +the DSA and is required to fix BCM5301x support. + +Fixes: 967dd82ffc52 ("net: dsa: b53: Add support for Broadcom RoboSwitch") +Signed-off-by: Rafał Miłecki +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/b53/b53_common.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c +index bd1417a66cbf..dcf9d7e5ae14 100644 +--- a/drivers/net/dsa/b53/b53_common.c ++++ b/drivers/net/dsa/b53/b53_common.c +@@ -2612,9 +2612,8 @@ static int b53_switch_init(struct b53_device *dev) + dev->cpu_port = 5; + } + +- /* cpu port is always last */ +- dev->num_ports = dev->cpu_port + 1; + dev->enabled_ports |= BIT(dev->cpu_port); ++ dev->num_ports = fls(dev->enabled_ports); + + /* Include non standard CPU port built-in PHYs to be probed */ + if (is539x(dev) || is531x5(dev)) { +-- +2.30.2 + diff --git a/queue-5.14/net-dsa-b53-fix-imp-port-setup-on-bcm5301x.patch b/queue-5.14/net-dsa-b53-fix-imp-port-setup-on-bcm5301x.patch new file mode 100644 index 00000000000..18f74caa894 --- /dev/null +++ b/queue-5.14/net-dsa-b53-fix-imp-port-setup-on-bcm5301x.patch @@ -0,0 +1,257 @@ +From 7eeb6408bcd95df18709c1d7342449a8a1161cbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Sep 2021 19:23:28 +0200 +Subject: net: dsa: b53: Fix IMP port setup on BCM5301x +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 63f8428b4077de3664eb0b252393c839b0b293ec ] + +Broadcom's b53 switches have one IMP (Inband Management Port) that needs +to be programmed using its own designed register. IMP port may be +different than CPU port - especially on devices with multiple CPU ports. + +For that reason it's required to explicitly note IMP port index and +check for it when choosing a register to use. + +This commit fixes BCM5301x support. Those switches use CPU port 5 while +their IMP port is 8. Before this patch b53 was trying to program port 5 +with B53_PORT_OVERRIDE_CTRL instead of B53_GMII_PORT_OVERRIDE_CTRL(5). + +It may be possible to also replace "cpu_port" usages with +dsa_is_cpu_port() but that is out of the scope of thix BCM5301x fix. + +Fixes: 967dd82ffc52 ("net: dsa: b53: Add support for Broadcom RoboSwitch") +Signed-off-by: Rafał Miłecki +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/b53/b53_common.c | 28 +++++++++++++++++++++++++--- + drivers/net/dsa/b53/b53_priv.h | 1 + + 2 files changed, 26 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c +index 5646eb8afe38..604f54112665 100644 +--- a/drivers/net/dsa/b53/b53_common.c ++++ b/drivers/net/dsa/b53/b53_common.c +@@ -1144,7 +1144,7 @@ static void b53_force_link(struct b53_device *dev, int port, int link) + u8 reg, val, off; + + /* Override the port settings */ +- if (port == dev->cpu_port) { ++ if (port == dev->imp_port) { + off = B53_PORT_OVERRIDE_CTRL; + val = PORT_OVERRIDE_EN; + } else { +@@ -1168,7 +1168,7 @@ static void b53_force_port_config(struct b53_device *dev, int port, + u8 reg, val, off; + + /* Override the port settings */ +- if (port == dev->cpu_port) { ++ if (port == dev->imp_port) { + off = B53_PORT_OVERRIDE_CTRL; + val = PORT_OVERRIDE_EN; + } else { +@@ -1236,7 +1236,7 @@ static void b53_adjust_link(struct dsa_switch *ds, int port, + b53_force_link(dev, port, phydev->link); + + if (is531x5(dev) && phy_interface_is_rgmii(phydev)) { +- if (port == 8) ++ if (port == dev->imp_port) + off = B53_RGMII_CTRL_IMP; + else + off = B53_RGMII_CTRL_P(port); +@@ -2280,6 +2280,7 @@ struct b53_chip_data { + const char *dev_name; + u16 vlans; + u16 enabled_ports; ++ u8 imp_port; + u8 cpu_port; + u8 vta_regs[3]; + u8 arl_bins; +@@ -2304,6 +2305,7 @@ static const struct b53_chip_data b53_switch_chips[] = { + .enabled_ports = 0x1f, + .arl_bins = 2, + .arl_buckets = 1024, ++ .imp_port = 5, + .cpu_port = B53_CPU_PORT_25, + .duplex_reg = B53_DUPLEX_STAT_FE, + }, +@@ -2314,6 +2316,7 @@ static const struct b53_chip_data b53_switch_chips[] = { + .enabled_ports = 0x1f, + .arl_bins = 2, + .arl_buckets = 1024, ++ .imp_port = 5, + .cpu_port = B53_CPU_PORT_25, + .duplex_reg = B53_DUPLEX_STAT_FE, + }, +@@ -2324,6 +2327,7 @@ static const struct b53_chip_data b53_switch_chips[] = { + .enabled_ports = 0x1f, + .arl_bins = 4, + .arl_buckets = 1024, ++ .imp_port = 8, + .cpu_port = B53_CPU_PORT, + .vta_regs = B53_VTA_REGS, + .duplex_reg = B53_DUPLEX_STAT_GE, +@@ -2337,6 +2341,7 @@ static const struct b53_chip_data b53_switch_chips[] = { + .enabled_ports = 0x1f, + .arl_bins = 4, + .arl_buckets = 1024, ++ .imp_port = 8, + .cpu_port = B53_CPU_PORT, + .vta_regs = B53_VTA_REGS, + .duplex_reg = B53_DUPLEX_STAT_GE, +@@ -2350,6 +2355,7 @@ static const struct b53_chip_data b53_switch_chips[] = { + .enabled_ports = 0x1f, + .arl_bins = 4, + .arl_buckets = 1024, ++ .imp_port = 8, + .cpu_port = B53_CPU_PORT, + .vta_regs = B53_VTA_REGS_9798, + .duplex_reg = B53_DUPLEX_STAT_GE, +@@ -2363,6 +2369,7 @@ static const struct b53_chip_data b53_switch_chips[] = { + .enabled_ports = 0x7f, + .arl_bins = 4, + .arl_buckets = 1024, ++ .imp_port = 8, + .cpu_port = B53_CPU_PORT, + .vta_regs = B53_VTA_REGS_9798, + .duplex_reg = B53_DUPLEX_STAT_GE, +@@ -2377,6 +2384,7 @@ static const struct b53_chip_data b53_switch_chips[] = { + .arl_bins = 4, + .arl_buckets = 1024, + .vta_regs = B53_VTA_REGS, ++ .imp_port = 8, + .cpu_port = B53_CPU_PORT, + .duplex_reg = B53_DUPLEX_STAT_GE, + .jumbo_pm_reg = B53_JUMBO_PORT_MASK, +@@ -2389,6 +2397,7 @@ static const struct b53_chip_data b53_switch_chips[] = { + .enabled_ports = 0xff, + .arl_bins = 4, + .arl_buckets = 1024, ++ .imp_port = 8, + .cpu_port = B53_CPU_PORT, + .vta_regs = B53_VTA_REGS, + .duplex_reg = B53_DUPLEX_STAT_GE, +@@ -2402,6 +2411,7 @@ static const struct b53_chip_data b53_switch_chips[] = { + .enabled_ports = 0x1ff, + .arl_bins = 4, + .arl_buckets = 1024, ++ .imp_port = 8, + .cpu_port = B53_CPU_PORT, + .vta_regs = B53_VTA_REGS, + .duplex_reg = B53_DUPLEX_STAT_GE, +@@ -2415,6 +2425,7 @@ static const struct b53_chip_data b53_switch_chips[] = { + .enabled_ports = 0, /* pdata must provide them */ + .arl_bins = 4, + .arl_buckets = 1024, ++ .imp_port = 8, + .cpu_port = B53_CPU_PORT, + .vta_regs = B53_VTA_REGS_63XX, + .duplex_reg = B53_DUPLEX_STAT_63XX, +@@ -2428,6 +2439,7 @@ static const struct b53_chip_data b53_switch_chips[] = { + .enabled_ports = 0x1f, + .arl_bins = 4, + .arl_buckets = 1024, ++ .imp_port = 8, + .cpu_port = B53_CPU_PORT_25, /* TODO: auto detect */ + .vta_regs = B53_VTA_REGS, + .duplex_reg = B53_DUPLEX_STAT_GE, +@@ -2441,6 +2453,7 @@ static const struct b53_chip_data b53_switch_chips[] = { + .enabled_ports = 0x1bf, + .arl_bins = 4, + .arl_buckets = 1024, ++ .imp_port = 8, + .cpu_port = B53_CPU_PORT_25, /* TODO: auto detect */ + .vta_regs = B53_VTA_REGS, + .duplex_reg = B53_DUPLEX_STAT_GE, +@@ -2454,6 +2467,7 @@ static const struct b53_chip_data b53_switch_chips[] = { + .enabled_ports = 0x1bf, + .arl_bins = 4, + .arl_buckets = 1024, ++ .imp_port = 8, + .cpu_port = B53_CPU_PORT_25, /* TODO: auto detect */ + .vta_regs = B53_VTA_REGS, + .duplex_reg = B53_DUPLEX_STAT_GE, +@@ -2467,6 +2481,7 @@ static const struct b53_chip_data b53_switch_chips[] = { + .enabled_ports = 0x1f, + .arl_bins = 4, + .arl_buckets = 1024, ++ .imp_port = 8, + .cpu_port = B53_CPU_PORT_25, /* TODO: auto detect */ + .vta_regs = B53_VTA_REGS, + .duplex_reg = B53_DUPLEX_STAT_GE, +@@ -2480,6 +2495,7 @@ static const struct b53_chip_data b53_switch_chips[] = { + .enabled_ports = 0x1f, + .arl_bins = 4, + .arl_buckets = 1024, ++ .imp_port = 8, + .cpu_port = B53_CPU_PORT_25, /* TODO: auto detect */ + .vta_regs = B53_VTA_REGS, + .duplex_reg = B53_DUPLEX_STAT_GE, +@@ -2493,6 +2509,7 @@ static const struct b53_chip_data b53_switch_chips[] = { + .enabled_ports = 0x1ff, + .arl_bins = 4, + .arl_buckets = 1024, ++ .imp_port = 8, + .cpu_port = B53_CPU_PORT, + .vta_regs = B53_VTA_REGS, + .duplex_reg = B53_DUPLEX_STAT_GE, +@@ -2506,6 +2523,7 @@ static const struct b53_chip_data b53_switch_chips[] = { + .enabled_ports = 0x103, + .arl_bins = 4, + .arl_buckets = 1024, ++ .imp_port = 8, + .cpu_port = B53_CPU_PORT, + .vta_regs = B53_VTA_REGS, + .duplex_reg = B53_DUPLEX_STAT_GE, +@@ -2520,6 +2538,7 @@ static const struct b53_chip_data b53_switch_chips[] = { + .enabled_ports = 0x1bf, + .arl_bins = 4, + .arl_buckets = 256, ++ .imp_port = 8, + .cpu_port = 8, /* TODO: ports 4, 5, 8 */ + .vta_regs = B53_VTA_REGS, + .duplex_reg = B53_DUPLEX_STAT_GE, +@@ -2533,6 +2552,7 @@ static const struct b53_chip_data b53_switch_chips[] = { + .enabled_ports = 0x1ff, + .arl_bins = 4, + .arl_buckets = 1024, ++ .imp_port = 8, + .cpu_port = B53_CPU_PORT, + .vta_regs = B53_VTA_REGS, + .duplex_reg = B53_DUPLEX_STAT_GE, +@@ -2546,6 +2566,7 @@ static const struct b53_chip_data b53_switch_chips[] = { + .enabled_ports = 0x1ff, + .arl_bins = 4, + .arl_buckets = 256, ++ .imp_port = 8, + .cpu_port = B53_CPU_PORT, + .vta_regs = B53_VTA_REGS, + .duplex_reg = B53_DUPLEX_STAT_GE, +@@ -2571,6 +2592,7 @@ static int b53_switch_init(struct b53_device *dev) + dev->vta_regs[1] = chip->vta_regs[1]; + dev->vta_regs[2] = chip->vta_regs[2]; + dev->jumbo_pm_reg = chip->jumbo_pm_reg; ++ dev->imp_port = chip->imp_port; + dev->cpu_port = chip->cpu_port; + dev->num_vlans = chip->vlans; + dev->num_arl_bins = chip->arl_bins; +diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h +index 9bf8319342b0..5d068acf7cf8 100644 +--- a/drivers/net/dsa/b53/b53_priv.h ++++ b/drivers/net/dsa/b53/b53_priv.h +@@ -123,6 +123,7 @@ struct b53_device { + + /* used ports mask */ + u16 enabled_ports; ++ unsigned int imp_port; + unsigned int cpu_port; + + /* connect specific data */ +-- +2.30.2 + diff --git a/queue-5.14/net-dsa-b53-set-correct-number-of-ports-in-the-dsa-s.patch b/queue-5.14/net-dsa-b53-set-correct-number-of-ports-in-the-dsa-s.patch new file mode 100644 index 00000000000..76f0d95e62a --- /dev/null +++ b/queue-5.14/net-dsa-b53-set-correct-number-of-ports-in-the-dsa-s.patch @@ -0,0 +1,53 @@ +From a6e099a718cc6bb3a0cfa5d8f2647ceb00ad6da8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Sep 2021 10:30:51 +0200 +Subject: net: dsa: b53: Set correct number of ports in the DSA struct +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit d12e1c4649883e8ca5e8ff341e1948b3b6313259 ] + +Setting DSA_MAX_PORTS caused DSA to call b53 callbacks (e.g. +b53_disable_port() during dsa_register_switch()) for invalid +(non-existent) ports. That made b53 modify unrelated registers and is +one of reasons for a broken BCM5301x support. + +This problem exists for years but DSA_MAX_PORTS usage has changed few +times. It seems the most accurate to reference commit dropping +dsa_switch_alloc() in the Fixes tag. + +Fixes: 7e99e3470172 ("net: dsa: remove dsa_switch_alloc helper") +Signed-off-by: Rafał Miłecki +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/b53/b53_common.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c +index dcf9d7e5ae14..5646eb8afe38 100644 +--- a/drivers/net/dsa/b53/b53_common.c ++++ b/drivers/net/dsa/b53/b53_common.c +@@ -2615,6 +2615,8 @@ static int b53_switch_init(struct b53_device *dev) + dev->enabled_ports |= BIT(dev->cpu_port); + dev->num_ports = fls(dev->enabled_ports); + ++ dev->ds->num_ports = min_t(unsigned int, dev->num_ports, DSA_MAX_PORTS); ++ + /* Include non standard CPU port built-in PHYs to be probed */ + if (is539x(dev) || is531x5(dev)) { + for (i = 0; i < dev->num_ports; i++) { +@@ -2659,7 +2661,6 @@ struct b53_device *b53_switch_alloc(struct device *base, + return NULL; + + ds->dev = base; +- ds->num_ports = DSA_MAX_PORTS; + + dev = devm_kzalloc(base, sizeof(*dev), GFP_KERNEL); + if (!dev) +-- +2.30.2 + diff --git a/queue-5.14/net-dsa-flush-switchdev-workqueue-before-tearing-dow.patch b/queue-5.14/net-dsa-flush-switchdev-workqueue-before-tearing-dow.patch new file mode 100644 index 00000000000..ddcc69d3720 --- /dev/null +++ b/queue-5.14/net-dsa-flush-switchdev-workqueue-before-tearing-dow.patch @@ -0,0 +1,184 @@ +From 868d0ab443ce315e6bbe11e942b5f12e79767507 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Sep 2021 16:47:26 +0300 +Subject: net: dsa: flush switchdev workqueue before tearing down CPU/DSA ports + +From: Vladimir Oltean + +[ Upstream commit a57d8c217aadac75530b8e7ffb3a3e1b7bfd0330 ] + +Sometimes when unbinding the mv88e6xxx driver on Turris MOX, these error +messages appear: + +mv88e6085 d0032004.mdio-mii:12: port 1 failed to delete be:79:b4:9e:9e:96 vid 1 from fdb: -2 +mv88e6085 d0032004.mdio-mii:12: port 1 failed to delete be:79:b4:9e:9e:96 vid 0 from fdb: -2 +mv88e6085 d0032004.mdio-mii:12: port 1 failed to delete d8:58:d7:00:ca:6d vid 100 from fdb: -2 +mv88e6085 d0032004.mdio-mii:12: port 1 failed to delete d8:58:d7:00:ca:6d vid 1 from fdb: -2 +mv88e6085 d0032004.mdio-mii:12: port 1 failed to delete d8:58:d7:00:ca:6d vid 0 from fdb: -2 + +(and similarly for other ports) + +What happens is that DSA has a policy "even if there are bugs, let's at +least not leak memory" and dsa_port_teardown() clears the dp->fdbs and +dp->mdbs lists, which are supposed to be empty. + +But deleting that cleanup code, the warnings go away. + +=> the FDB and MDB lists (used for refcounting on shared ports, aka CPU +and DSA ports) will eventually be empty, but are not empty by the time +we tear down those ports. Aka we are deleting them too soon. + +The addresses that DSA complains about are host-trapped addresses: the +local addresses of the ports, and the MAC address of the bridge device. + +The problem is that offloading those entries happens from a deferred +work item scheduled by the SWITCHDEV_FDB_DEL_TO_DEVICE handler, and this +races with the teardown of the CPU and DSA ports where the refcounting +is kept. + +In fact, not only it races, but fundamentally speaking, if we iterate +through the port list linearly, we might end up tearing down the shared +ports even before we delete a DSA user port which has a bridge upper. + +So as it turns out, we need to first tear down the user ports (and the +unused ones, for no better place of doing that), then the shared ports +(the CPU and DSA ports). In between, we need to ensure that all work +items scheduled by our switchdev handlers (which only run for user +ports, hence the reason why we tear them down first) have finished. + +Fixes: 161ca59d39e9 ("net: dsa: reference count the MDB entries at the cross-chip notifier level") +Signed-off-by: Vladimir Oltean +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20210914134726.2305133-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/dsa.h | 5 +++++ + net/dsa/dsa.c | 5 +++++ + net/dsa/dsa2.c | 46 +++++++++++++++++++++++++++++++--------------- + net/dsa/dsa_priv.h | 1 + + 4 files changed, 42 insertions(+), 15 deletions(-) + +diff --git a/include/net/dsa.h b/include/net/dsa.h +index 048d297623c9..d833f717e802 100644 +--- a/include/net/dsa.h ++++ b/include/net/dsa.h +@@ -437,6 +437,11 @@ static inline bool dsa_port_is_user(struct dsa_port *dp) + return dp->type == DSA_PORT_TYPE_USER; + } + ++static inline bool dsa_port_is_unused(struct dsa_port *dp) ++{ ++ return dp->type == DSA_PORT_TYPE_UNUSED; ++} ++ + static inline bool dsa_is_unused_port(struct dsa_switch *ds, int p) + { + return dsa_to_port(ds, p)->type == DSA_PORT_TYPE_UNUSED; +diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c +index 84cad1be9ce4..e058a2e320e3 100644 +--- a/net/dsa/dsa.c ++++ b/net/dsa/dsa.c +@@ -345,6 +345,11 @@ bool dsa_schedule_work(struct work_struct *work) + return queue_work(dsa_owq, work); + } + ++void dsa_flush_workqueue(void) ++{ ++ flush_workqueue(dsa_owq); ++} ++ + int dsa_devlink_param_get(struct devlink *dl, u32 id, + struct devlink_param_gset_ctx *ctx) + { +diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c +index 185629f27f80..79267b00af68 100644 +--- a/net/dsa/dsa2.c ++++ b/net/dsa/dsa2.c +@@ -809,6 +809,33 @@ static void dsa_switch_teardown(struct dsa_switch *ds) + ds->setup = false; + } + ++/* First tear down the non-shared, then the shared ports. This ensures that ++ * all work items scheduled by our switchdev handlers for user ports have ++ * completed before we destroy the refcounting kept on the shared ports. ++ */ ++static void dsa_tree_teardown_ports(struct dsa_switch_tree *dst) ++{ ++ struct dsa_port *dp; ++ ++ list_for_each_entry(dp, &dst->ports, list) ++ if (dsa_port_is_user(dp) || dsa_port_is_unused(dp)) ++ dsa_port_teardown(dp); ++ ++ dsa_flush_workqueue(); ++ ++ list_for_each_entry(dp, &dst->ports, list) ++ if (dsa_port_is_dsa(dp) || dsa_port_is_cpu(dp)) ++ dsa_port_teardown(dp); ++} ++ ++static void dsa_tree_teardown_switches(struct dsa_switch_tree *dst) ++{ ++ struct dsa_port *dp; ++ ++ list_for_each_entry(dp, &dst->ports, list) ++ dsa_switch_teardown(dp->ds); ++} ++ + static int dsa_tree_setup_switches(struct dsa_switch_tree *dst) + { + struct dsa_port *dp; +@@ -835,26 +862,13 @@ static int dsa_tree_setup_switches(struct dsa_switch_tree *dst) + return 0; + + teardown: +- list_for_each_entry(dp, &dst->ports, list) +- dsa_port_teardown(dp); ++ dsa_tree_teardown_ports(dst); + +- list_for_each_entry(dp, &dst->ports, list) +- dsa_switch_teardown(dp->ds); ++ dsa_tree_teardown_switches(dst); + + return err; + } + +-static void dsa_tree_teardown_switches(struct dsa_switch_tree *dst) +-{ +- struct dsa_port *dp; +- +- list_for_each_entry(dp, &dst->ports, list) +- dsa_port_teardown(dp); +- +- list_for_each_entry(dp, &dst->ports, list) +- dsa_switch_teardown(dp->ds); +-} +- + static int dsa_tree_setup_master(struct dsa_switch_tree *dst) + { + struct dsa_port *dp; +@@ -964,6 +978,8 @@ static void dsa_tree_teardown(struct dsa_switch_tree *dst) + + dsa_tree_teardown_master(dst); + ++ dsa_tree_teardown_ports(dst); ++ + dsa_tree_teardown_switches(dst); + + dsa_tree_teardown_default_cpu(dst); +diff --git a/net/dsa/dsa_priv.h b/net/dsa/dsa_priv.h +index cddf7cb0f398..6c00557ca9bf 100644 +--- a/net/dsa/dsa_priv.h ++++ b/net/dsa/dsa_priv.h +@@ -158,6 +158,7 @@ void dsa_tag_driver_put(const struct dsa_device_ops *ops); + const struct dsa_device_ops *dsa_find_tagger_by_name(const char *buf); + + bool dsa_schedule_work(struct work_struct *work); ++void dsa_flush_workqueue(void); + const char *dsa_tag_protocol_to_str(const struct dsa_device_ops *ops); + + static inline int dsa_tag_protocol_overhead(const struct dsa_device_ops *ops) +-- +2.30.2 + diff --git a/queue-5.14/net-dsa-lantiq_gswip-add-200ms-assert-delay.patch b/queue-5.14/net-dsa-lantiq_gswip-add-200ms-assert-delay.patch new file mode 100644 index 00000000000..ab1105b2993 --- /dev/null +++ b/queue-5.14/net-dsa-lantiq_gswip-add-200ms-assert-delay.patch @@ -0,0 +1,44 @@ +From c2f387568f28ceccc55753db101802e1d86a88c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Sep 2021 13:58:07 +0200 +Subject: net: dsa: lantiq_gswip: Add 200ms assert delay + +From: Aleksander Jan Bajkowski + +[ Upstream commit 111b64e35ea03d58c882832744f571a88bb2e2e2 ] + +The delay is especially needed by the xRX300 and xRX330 SoCs. Without +this patch, some phys are sometimes not properly detected. + +The patch was tested on BT Home Hub 5A and D-Link DWR-966. + +Fixes: a09d042b0862 ("net: dsa: lantiq: allow to use all GPHYs on xRX300 and xRX330") +Signed-off-by: Aleksander Jan Bajkowski +Signed-off-by: Martin Blumenstingl +Acked-by: Hauke Mehrtens +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/lantiq_gswip.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/dsa/lantiq_gswip.c b/drivers/net/dsa/lantiq_gswip.c +index 64d6dfa83122..267324889dd6 100644 +--- a/drivers/net/dsa/lantiq_gswip.c ++++ b/drivers/net/dsa/lantiq_gswip.c +@@ -1885,6 +1885,12 @@ static int gswip_gphy_fw_load(struct gswip_priv *priv, struct gswip_gphy_fw *gph + + reset_control_assert(gphy_fw->reset); + ++ /* The vendor BSP uses a 200ms delay after asserting the reset line. ++ * Without this some users are observing that the PHY is not coming up ++ * on the MDIO bus. ++ */ ++ msleep(200); ++ + ret = request_firmware(&fw, gphy_fw->fw_name, dev); + if (ret) { + dev_err(dev, "failed to load firmware: %s, error: %i\n", +-- +2.30.2 + diff --git a/queue-5.14/net-dsa-qca8k-fix-kernel-panic-with-legacy-mdio-mapp.patch b/queue-5.14/net-dsa-qca8k-fix-kernel-panic-with-legacy-mdio-mapp.patch new file mode 100644 index 00000000000..7ea0e0788fc --- /dev/null +++ b/queue-5.14/net-dsa-qca8k-fix-kernel-panic-with-legacy-mdio-mapp.patch @@ -0,0 +1,90 @@ +From cc59a6e9f76fe6d287092c5629ebfe66939eb304 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Sep 2021 17:50:09 +0200 +Subject: net: dsa: qca8k: fix kernel panic with legacy mdio mapping + +From: Ansuel Smith + +[ Upstream commit ce062a0adbfe933b1932235fdfd874c4c91d1bb0 ] + +When the mdio legacy mapping is used the mii_bus priv registered by DSA +refer to the dsa switch struct instead of the qca8k_priv struct and +causes a kernel panic. Create dedicated function when the internal +dedicated mdio driver is used to properly handle the 2 different +implementation. + +Fixes: 759bafb8a322 ("net: dsa: qca8k: add support for internal phy and internal mdio") +Signed-off-by: Ansuel Smith +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/qca8k.c | 30 ++++++++++++++++++++++-------- + 1 file changed, 22 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c +index 1f63f50f73f1..bda5a9bf4f52 100644 +--- a/drivers/net/dsa/qca8k.c ++++ b/drivers/net/dsa/qca8k.c +@@ -643,10 +643,8 @@ qca8k_mdio_busy_wait(struct mii_bus *bus, u32 reg, u32 mask) + } + + static int +-qca8k_mdio_write(struct mii_bus *salve_bus, int phy, int regnum, u16 data) ++qca8k_mdio_write(struct mii_bus *bus, int phy, int regnum, u16 data) + { +- struct qca8k_priv *priv = salve_bus->priv; +- struct mii_bus *bus = priv->bus; + u16 r1, r2, page; + u32 val; + int ret; +@@ -682,10 +680,8 @@ exit: + } + + static int +-qca8k_mdio_read(struct mii_bus *salve_bus, int phy, int regnum) ++qca8k_mdio_read(struct mii_bus *bus, int phy, int regnum) + { +- struct qca8k_priv *priv = salve_bus->priv; +- struct mii_bus *bus = priv->bus; + u16 r1, r2, page; + u32 val; + int ret; +@@ -726,6 +722,24 @@ exit: + return ret; + } + ++static int ++qca8k_internal_mdio_write(struct mii_bus *slave_bus, int phy, int regnum, u16 data) ++{ ++ struct qca8k_priv *priv = slave_bus->priv; ++ struct mii_bus *bus = priv->bus; ++ ++ return qca8k_mdio_write(bus, phy, regnum, data); ++} ++ ++static int ++qca8k_internal_mdio_read(struct mii_bus *slave_bus, int phy, int regnum) ++{ ++ struct qca8k_priv *priv = slave_bus->priv; ++ struct mii_bus *bus = priv->bus; ++ ++ return qca8k_mdio_read(bus, phy, regnum); ++} ++ + static int + qca8k_phy_write(struct dsa_switch *ds, int port, int regnum, u16 data) + { +@@ -775,8 +789,8 @@ qca8k_mdio_register(struct qca8k_priv *priv, struct device_node *mdio) + + bus->priv = (void *)priv; + bus->name = "qca8k slave mii"; +- bus->read = qca8k_mdio_read; +- bus->write = qca8k_mdio_write; ++ bus->read = qca8k_internal_mdio_read; ++ bus->write = qca8k_internal_mdio_write; + snprintf(bus->id, MII_BUS_ID_SIZE, "qca8k-%d", + ds->index); + +-- +2.30.2 + diff --git a/queue-5.14/net-dsa-tag_rtl4_a-fix-egress-tags.patch b/queue-5.14/net-dsa-tag_rtl4_a-fix-egress-tags.patch new file mode 100644 index 00000000000..a448946bcf1 --- /dev/null +++ b/queue-5.14/net-dsa-tag_rtl4_a-fix-egress-tags.patch @@ -0,0 +1,60 @@ +From 287f535d42252baea8a6736be82b25dbdd7984e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Aug 2021 20:50:50 +0200 +Subject: net: dsa: tag_rtl4_a: Fix egress tags + +From: Linus Walleij + +[ Upstream commit 0e90dfa7a8d817db755c7b5d89d77b9c485e4180 ] + +I noticed that only port 0 worked on the RTL8366RB since we +started to use custom tags. + +It turns out that the format of egress custom tags is actually +different from ingress custom tags. While the lower bits just +contain the port number in ingress tags, egress tags need to +indicate destination port by setting the bit for the +corresponding port. + +It was working on port 0 because port 0 added 0x00 as port +number in the lower bits, and if you do this the packet appears +at all ports, including the intended port. Ooops. + +Fix this and all ports work again. Use the define for shifting +the "type A" into place while we're at it. + +Tested on the D-Link DIR-685 by sending traffic to each of +the ports in turn. It works. + +Fixes: 86dd9868b878 ("net: dsa: tag_rtl4_a: Support also egress tags") +Cc: DENG Qingfang +Cc: Mauri Sandberg +Signed-off-by: Linus Walleij +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/dsa/tag_rtl4_a.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/net/dsa/tag_rtl4_a.c b/net/dsa/tag_rtl4_a.c +index 57c46b4ab2b3..e34b80fa52e1 100644 +--- a/net/dsa/tag_rtl4_a.c ++++ b/net/dsa/tag_rtl4_a.c +@@ -54,9 +54,10 @@ static struct sk_buff *rtl4a_tag_xmit(struct sk_buff *skb, + p = (__be16 *)tag; + *p = htons(RTL4_A_ETHERTYPE); + +- out = (RTL4_A_PROTOCOL_RTL8366RB << 12) | (2 << 8); +- /* The lower bits is the port number */ +- out |= (u8)dp->index; ++ out = (RTL4_A_PROTOCOL_RTL8366RB << RTL4_A_PROTOCOL_SHIFT) | (2 << 8); ++ /* The lower bits indicate the port number */ ++ out |= BIT(dp->index); ++ + p = (__be16 *)(tag + 2); + *p = htons(out); + +-- +2.30.2 + diff --git a/queue-5.14/net-hns3-fix-the-exception-when-query-imp-info.patch b/queue-5.14/net-hns3-fix-the-exception-when-query-imp-info.patch new file mode 100644 index 00000000000..e8286e57ff5 --- /dev/null +++ b/queue-5.14/net-hns3-fix-the-exception-when-query-imp-info.patch @@ -0,0 +1,42 @@ +From 074f4305919e682bb594a4a1ef80e2f674fdbc8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Sep 2021 21:08:24 +0800 +Subject: net: hns3: fix the exception when query imp info + +From: Jiaran Zhang + +[ Upstream commit 472430a7b066f19afa1b55867d621b2d6d323e0d ] + +When the command for querying imp info is issued to the firmware, +if the firmware does not support the command, the returned value +of bd num is 0. +Add protection mechanism before alloc memory to prevent apply for +0-length memory. + +Fixes: 0b198b0d80ea ("net: hns3: refactor dump m7 info of debugfs") +Signed-off-by: Jiaran Zhang +Signed-off-by: Guangbin Huang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c +index 288788186ecc..e6e617aba2a4 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c +@@ -1710,6 +1710,10 @@ hclge_dbg_get_imp_stats_info(struct hclge_dev *hdev, char *buf, int len) + } + + bd_num = le32_to_cpu(req->bd_num); ++ if (!bd_num) { ++ dev_err(&hdev->pdev->dev, "imp statistics bd number is 0!\n"); ++ return -EINVAL; ++ } + + desc_src = kcalloc(bd_num, sizeof(struct hclge_desc), GFP_KERNEL); + if (!desc_src) +-- +2.30.2 + diff --git a/queue-5.14/net-hso-add-failure-handler-for-add_net_device.patch b/queue-5.14/net-hso-add-failure-handler-for-add_net_device.patch new file mode 100644 index 00000000000..da7d02819cd --- /dev/null +++ b/queue-5.14/net-hso-add-failure-handler-for-add_net_device.patch @@ -0,0 +1,66 @@ +From a5e8f42412e2af4932abe7b9ce9c27fd75bb1007 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Sep 2021 16:36:09 +0800 +Subject: net: hso: add failure handler for add_net_device + +From: Ziyang Xuan + +[ Upstream commit ecdc28defc46af476566fffd9e5cb4495a2f176e ] + +If the network devices connected to the system beyond +HSO_MAX_NET_DEVICES. add_net_device() in hso_create_net_device() +will be failed for the network_table is full. It will lead to +business failure which rely on network_table, for example, +hso_suspend() and hso_resume(). It will also lead to memory leak +because resource release process can not search the hso_device +object from network_table in hso_free_interface(). + +Add failure handler for add_net_device() in hso_create_net_device() +to solve the above problems. + +Fixes: 72dc1c096c70 ("HSO: add option hso driver") +Signed-off-by: Ziyang Xuan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/hso.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c +index dec96e8ab567..18e0ca85f653 100644 +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -2536,13 +2536,17 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface, + if (!hso_net->mux_bulk_tx_buf) + goto err_free_tx_urb; + +- add_net_device(hso_dev); ++ result = add_net_device(hso_dev); ++ if (result) { ++ dev_err(&interface->dev, "Failed to add net device\n"); ++ goto err_free_tx_buf; ++ } + + /* registering our net device */ + result = register_netdev(net); + if (result) { + dev_err(&interface->dev, "Failed to register device\n"); +- goto err_free_tx_buf; ++ goto err_rmv_ndev; + } + + hso_log_port(hso_dev); +@@ -2551,8 +2555,9 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface, + + return hso_dev; + +-err_free_tx_buf: ++err_rmv_ndev: + remove_net_device(hso_dev); ++err_free_tx_buf: + kfree(hso_net->mux_bulk_tx_buf); + err_free_tx_urb: + usb_free_urb(hso_net->mux_bulk_tx_urb); +-- +2.30.2 + diff --git a/queue-5.14/net-mlx5e-fix-mutual-exclusion-between-cqe-compressi.patch b/queue-5.14/net-mlx5e-fix-mutual-exclusion-between-cqe-compressi.patch new file mode 100644 index 00000000000..5b3431fe437 --- /dev/null +++ b/queue-5.14/net-mlx5e-fix-mutual-exclusion-between-cqe-compressi.patch @@ -0,0 +1,111 @@ +From f78f4ee29fb05bab69f946570163d869da25a8cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jul 2021 10:53:28 +0300 +Subject: net/mlx5e: Fix mutual exclusion between CQE compression and HW TS + +From: Aya Levin + +[ Upstream commit c91c1da72b47fc4c5e353cdd9099ba94ae07d2fa ] + +Some profiles of the driver don't support a dedicated PTP-RQ, hence can't +support HW TS and CQE compression simultaneously. When HW TS is enabled +the COE compression is disabled, and should be restored when the HW TS +is turned off. Add rx_filter as an input to modifying CQE compression to +enforce this restriction. + +Fixes: 256f79d13c1d ("net/mlx5e: Fix HW TS with CQE compression according to profile") +Signed-off-by: Aya Levin +Reviewed-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +- + drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 11 ++++++----- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 ++-- + 3 files changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h +index b1b51bbba054..3f67efbe12fc 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h +@@ -940,7 +940,7 @@ void mlx5e_set_rx_mode_work(struct work_struct *work); + + int mlx5e_hwstamp_set(struct mlx5e_priv *priv, struct ifreq *ifr); + int mlx5e_hwstamp_get(struct mlx5e_priv *priv, struct ifreq *ifr); +-int mlx5e_modify_rx_cqe_compression_locked(struct mlx5e_priv *priv, bool val); ++int mlx5e_modify_rx_cqe_compression_locked(struct mlx5e_priv *priv, bool val, bool rx_filter); + + int mlx5e_vlan_rx_add_vid(struct net_device *dev, __always_unused __be16 proto, + u16 vid); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +index bd72572e03d1..1cc279d389d6 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +@@ -1882,7 +1882,7 @@ static int set_pflag_rx_cqe_based_moder(struct net_device *netdev, bool enable) + return set_pflag_cqe_based_moder(netdev, enable, true); + } + +-int mlx5e_modify_rx_cqe_compression_locked(struct mlx5e_priv *priv, bool new_val) ++int mlx5e_modify_rx_cqe_compression_locked(struct mlx5e_priv *priv, bool new_val, bool rx_filter) + { + bool curr_val = MLX5E_GET_PFLAG(&priv->channels.params, MLX5E_PFLAG_RX_CQE_COMPRESS); + struct mlx5e_params new_params; +@@ -1894,8 +1894,7 @@ int mlx5e_modify_rx_cqe_compression_locked(struct mlx5e_priv *priv, bool new_val + if (curr_val == new_val) + return 0; + +- if (new_val && !priv->profile->rx_ptp_support && +- priv->tstamp.rx_filter != HWTSTAMP_FILTER_NONE) { ++ if (new_val && !priv->profile->rx_ptp_support && rx_filter) { + netdev_err(priv->netdev, + "Profile doesn't support enabling of CQE compression while hardware time-stamping is enabled.\n"); + return -EINVAL; +@@ -1903,7 +1902,7 @@ int mlx5e_modify_rx_cqe_compression_locked(struct mlx5e_priv *priv, bool new_val + + new_params = priv->channels.params; + MLX5E_SET_PFLAG(&new_params, MLX5E_PFLAG_RX_CQE_COMPRESS, new_val); +- if (priv->tstamp.rx_filter != HWTSTAMP_FILTER_NONE) ++ if (rx_filter) + new_params.ptp_rx = new_val; + + if (new_params.ptp_rx == priv->channels.params.ptp_rx) +@@ -1926,12 +1925,14 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev, + { + struct mlx5e_priv *priv = netdev_priv(netdev); + struct mlx5_core_dev *mdev = priv->mdev; ++ bool rx_filter; + int err; + + if (!MLX5_CAP_GEN(mdev, cqe_compression)) + return -EOPNOTSUPP; + +- err = mlx5e_modify_rx_cqe_compression_locked(priv, enable); ++ rx_filter = priv->tstamp.rx_filter != HWTSTAMP_FILTER_NONE; ++ err = mlx5e_modify_rx_cqe_compression_locked(priv, enable, rx_filter); + if (err) + return err; + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 2d53eaf3b924..fa718e71db2d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -4004,14 +4004,14 @@ static int mlx5e_hwstamp_config_no_ptp_rx(struct mlx5e_priv *priv, bool rx_filte + + if (!rx_filter) + /* Reset CQE compression to Admin default */ +- return mlx5e_modify_rx_cqe_compression_locked(priv, rx_cqe_compress_def); ++ return mlx5e_modify_rx_cqe_compression_locked(priv, rx_cqe_compress_def, false); + + if (!MLX5E_GET_PFLAG(&priv->channels.params, MLX5E_PFLAG_RX_CQE_COMPRESS)) + return 0; + + /* Disable CQE compression */ + netdev_warn(priv->netdev, "Disabling RX cqe compression\n"); +- err = mlx5e_modify_rx_cqe_compression_locked(priv, false); ++ err = mlx5e_modify_rx_cqe_compression_locked(priv, false, true); + if (err) + netdev_err(priv->netdev, "Failed disabling cqe compression err=%d\n", err); + +-- +2.30.2 + diff --git a/queue-5.14/net-phylink-add-suspend-resume-support.patch b/queue-5.14/net-phylink-add-suspend-resume-support.patch new file mode 100644 index 00000000000..ac938b4e16b --- /dev/null +++ b/queue-5.14/net-phylink-add-suspend-resume-support.patch @@ -0,0 +1,153 @@ +From 0119ff735f1224eee63d76adca319b493b394ee9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Sep 2021 18:56:46 +0800 +Subject: net: phylink: add suspend/resume support + +From: Russell King (Oracle) + +[ Upstream commit f97493657c6372eeefe70faadd214bf31488c44e ] + +Joakim Zhang reports that Wake-on-Lan with the stmmac ethernet driver broke +when moving the incorrect handling of mac link state out of mac_config(). +This reason this breaks is because the stmmac's WoL is handled by the MAC +rather than the PHY, and phylink doesn't cater for that scenario. + +This patch adds the necessary phylink code to handle suspend/resume events +according to whether the MAC still needs a valid link or not. This is the +barest minimum for this support. + +Reported-by: Joakim Zhang +Tested-by: Joakim Zhang +Signed-off-by: Russell King (Oracle) +Signed-off-by: Joakim Zhang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/phylink.c | 82 +++++++++++++++++++++++++++++++++++++++ + include/linux/phylink.h | 3 ++ + 2 files changed, 85 insertions(+) + +diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c +index eb29ef53d971..42e5a681183f 100644 +--- a/drivers/net/phy/phylink.c ++++ b/drivers/net/phy/phylink.c +@@ -33,6 +33,7 @@ + enum { + PHYLINK_DISABLE_STOPPED, + PHYLINK_DISABLE_LINK, ++ PHYLINK_DISABLE_MAC_WOL, + }; + + /** +@@ -1281,6 +1282,9 @@ EXPORT_SYMBOL_GPL(phylink_start); + * network device driver's &struct net_device_ops ndo_stop() method. The + * network device's carrier state should not be changed prior to calling this + * function. ++ * ++ * This will synchronously bring down the link if the link is not already ++ * down (in other words, it will trigger a mac_link_down() method call.) + */ + void phylink_stop(struct phylink *pl) + { +@@ -1300,6 +1304,84 @@ void phylink_stop(struct phylink *pl) + } + EXPORT_SYMBOL_GPL(phylink_stop); + ++/** ++ * phylink_suspend() - handle a network device suspend event ++ * @pl: a pointer to a &struct phylink returned from phylink_create() ++ * @mac_wol: true if the MAC needs to receive packets for Wake-on-Lan ++ * ++ * Handle a network device suspend event. There are several cases: ++ * - If Wake-on-Lan is not active, we can bring down the link between ++ * the MAC and PHY by calling phylink_stop(). ++ * - If Wake-on-Lan is active, and being handled only by the PHY, we ++ * can also bring down the link between the MAC and PHY. ++ * - If Wake-on-Lan is active, but being handled by the MAC, the MAC ++ * still needs to receive packets, so we can not bring the link down. ++ */ ++void phylink_suspend(struct phylink *pl, bool mac_wol) ++{ ++ ASSERT_RTNL(); ++ ++ if (mac_wol && (!pl->netdev || pl->netdev->wol_enabled)) { ++ /* Wake-on-Lan enabled, MAC handling */ ++ mutex_lock(&pl->state_mutex); ++ ++ /* Stop the resolver bringing the link up */ ++ __set_bit(PHYLINK_DISABLE_MAC_WOL, &pl->phylink_disable_state); ++ ++ /* Disable the carrier, to prevent transmit timeouts, ++ * but one would hope all packets have been sent. This ++ * also means phylink_resolve() will do nothing. ++ */ ++ netif_carrier_off(pl->netdev); ++ ++ /* We do not call mac_link_down() here as we want the ++ * link to remain up to receive the WoL packets. ++ */ ++ mutex_unlock(&pl->state_mutex); ++ } else { ++ phylink_stop(pl); ++ } ++} ++EXPORT_SYMBOL_GPL(phylink_suspend); ++ ++/** ++ * phylink_resume() - handle a network device resume event ++ * @pl: a pointer to a &struct phylink returned from phylink_create() ++ * ++ * Undo the effects of phylink_suspend(), returning the link to an ++ * operational state. ++ */ ++void phylink_resume(struct phylink *pl) ++{ ++ ASSERT_RTNL(); ++ ++ if (test_bit(PHYLINK_DISABLE_MAC_WOL, &pl->phylink_disable_state)) { ++ /* Wake-on-Lan enabled, MAC handling */ ++ ++ /* Call mac_link_down() so we keep the overall state balanced. ++ * Do this under the state_mutex lock for consistency. This ++ * will cause a "Link Down" message to be printed during ++ * resume, which is harmless - the true link state will be ++ * printed when we run a resolve. ++ */ ++ mutex_lock(&pl->state_mutex); ++ phylink_link_down(pl); ++ mutex_unlock(&pl->state_mutex); ++ ++ /* Re-apply the link parameters so that all the settings get ++ * restored to the MAC. ++ */ ++ phylink_mac_initial_config(pl, true); ++ ++ /* Re-enable and re-resolve the link parameters */ ++ clear_bit(PHYLINK_DISABLE_MAC_WOL, &pl->phylink_disable_state); ++ phylink_run_resolve(pl); ++ } else { ++ phylink_start(pl); ++ } ++} ++EXPORT_SYMBOL_GPL(phylink_resume); ++ + /** + * phylink_ethtool_get_wol() - get the wake on lan parameters for the PHY + * @pl: a pointer to a &struct phylink returned from phylink_create() +diff --git a/include/linux/phylink.h b/include/linux/phylink.h +index afb3ded0b691..237291196ce2 100644 +--- a/include/linux/phylink.h ++++ b/include/linux/phylink.h +@@ -451,6 +451,9 @@ void phylink_mac_change(struct phylink *, bool up); + void phylink_start(struct phylink *); + void phylink_stop(struct phylink *); + ++void phylink_suspend(struct phylink *pl, bool mac_wol); ++void phylink_resume(struct phylink *pl); ++ + void phylink_ethtool_get_wol(struct phylink *, struct ethtool_wolinfo *); + int phylink_ethtool_set_wol(struct phylink *, struct ethtool_wolinfo *); + +-- +2.30.2 + diff --git a/queue-5.14/net-renesas-sh_eth-fix-freeing-wrong-tx-descriptor.patch b/queue-5.14/net-renesas-sh_eth-fix-freeing-wrong-tx-descriptor.patch new file mode 100644 index 00000000000..69a6a12eda1 --- /dev/null +++ b/queue-5.14/net-renesas-sh_eth-fix-freeing-wrong-tx-descriptor.patch @@ -0,0 +1,40 @@ +From 3c189dba133bb7f7fb8697aaf3309c756c010c82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Sep 2021 20:29:40 +0900 +Subject: net: renesas: sh_eth: Fix freeing wrong tx descriptor + +From: Yoshihiro Shimoda + +[ Upstream commit 0341d5e3d1ee2a36dd5a49b5bef2ce4ad1cfa6b4 ] + +The cur_tx counter must be incremented after TACT bit of +txdesc->status was set. However, a CPU is possible to reorder +instructions and/or memory accesses between cur_tx and +txdesc->status. And then, if TX interrupt happened at such a +timing, the sh_eth_tx_free() may free the descriptor wrongly. +So, add wmb() before cur_tx++. +Otherwise NETDEV WATCHDOG timeout is possible to happen. + +Fixes: 86a74ff21a7a ("net: sh_eth: add support for Renesas SuperH Ethernet") +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/sh_eth.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c +index 840478692a37..dfd439eadd49 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -2533,6 +2533,7 @@ static netdev_tx_t sh_eth_start_xmit(struct sk_buff *skb, + else + txdesc->status |= cpu_to_le32(TD_TACT); + ++ wmb(); /* cur_tx must be incremented after TACT bit was set */ + mdp->cur_tx++; + + if (!(sh_eth_read(ndev, EDTRR) & mdp->cd->edtrr_trns)) +-- +2.30.2 + diff --git a/queue-5.14/net-usb-cdc_mbim-avoid-altsetting-toggling-for-telit.patch b/queue-5.14/net-usb-cdc_mbim-avoid-altsetting-toggling-for-telit.patch new file mode 100644 index 00000000000..6874ae4169f --- /dev/null +++ b/queue-5.14/net-usb-cdc_mbim-avoid-altsetting-toggling-for-telit.patch @@ -0,0 +1,38 @@ +From 1a1a19a93e07849f9391664e02abf14762135732 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Sep 2021 12:51:22 +0200 +Subject: net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920 + +From: Daniele Palmas + +[ Upstream commit aabbdc67f3485b5db27ab4eba01e5fbf1ffea62c ] + +Add quirk CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE for Telit LN920 +0x1061 composition in order to avoid bind error. + +Signed-off-by: Daniele Palmas +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/cdc_mbim.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c +index 4c4ab7b38d78..82bb5ed94c48 100644 +--- a/drivers/net/usb/cdc_mbim.c ++++ b/drivers/net/usb/cdc_mbim.c +@@ -654,6 +654,11 @@ static const struct usb_device_id mbim_devs[] = { + .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle, + }, + ++ /* Telit LN920 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x1061, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), ++ .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle, ++ }, ++ + /* default entry */ + { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), + .driver_info = (unsigned long)&cdc_mbim_info_zlp, +-- +2.30.2 + diff --git a/queue-5.14/netfilter-nft_ct-protect-nft_ct_pcpu_template_refcnt.patch b/queue-5.14/netfilter-nft_ct-protect-nft_ct_pcpu_template_refcnt.patch new file mode 100644 index 00000000000..7455af75fd5 --- /dev/null +++ b/queue-5.14/netfilter-nft_ct-protect-nft_ct_pcpu_template_refcnt.patch @@ -0,0 +1,73 @@ +From 72e59c35287ad87a89ebe9d12384e54102e8d6d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Aug 2021 15:59:20 +0300 +Subject: netfilter: nft_ct: protect nft_ct_pcpu_template_refcnt with mutex + +From: Pavel Skripkin + +[ Upstream commit e3245a7b7b34bd2e97f744fd79463add6e9d41f4 ] + +Syzbot hit use-after-free in nf_tables_dump_sets. The problem was in +missing lock protection for nft_ct_pcpu_template_refcnt. + +Before commit f102d66b335a ("netfilter: nf_tables: use dedicated +mutex to guard transactions") all transactions were serialized by global +mutex, but then global mutex was changed to local per netnamespace +commit_mutex. + +This change causes use-after-free bug, when 2 netnamespaces concurently +changing nft_ct_pcpu_template_refcnt without proper locking. Fix it by +adding nft_ct_pcpu_mutex and protect all nft_ct_pcpu_template_refcnt +changes with it. + +Fixes: f102d66b335a ("netfilter: nf_tables: use dedicated mutex to guard transactions") +Reported-and-tested-by: syzbot+649e339fa6658ee623d3@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Acked-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_ct.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c +index 337e22d8b40b..99b1de14ff7e 100644 +--- a/net/netfilter/nft_ct.c ++++ b/net/netfilter/nft_ct.c +@@ -41,6 +41,7 @@ struct nft_ct_helper_obj { + #ifdef CONFIG_NF_CONNTRACK_ZONES + static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template); + static unsigned int nft_ct_pcpu_template_refcnt __read_mostly; ++static DEFINE_MUTEX(nft_ct_pcpu_mutex); + #endif + + static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c, +@@ -525,8 +526,10 @@ static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv) + #endif + #ifdef CONFIG_NF_CONNTRACK_ZONES + case NFT_CT_ZONE: ++ mutex_lock(&nft_ct_pcpu_mutex); + if (--nft_ct_pcpu_template_refcnt == 0) + nft_ct_tmpl_put_pcpu(); ++ mutex_unlock(&nft_ct_pcpu_mutex); + break; + #endif + default: +@@ -564,9 +567,13 @@ static int nft_ct_set_init(const struct nft_ctx *ctx, + #endif + #ifdef CONFIG_NF_CONNTRACK_ZONES + case NFT_CT_ZONE: +- if (!nft_ct_tmpl_alloc_pcpu()) ++ mutex_lock(&nft_ct_pcpu_mutex); ++ if (!nft_ct_tmpl_alloc_pcpu()) { ++ mutex_unlock(&nft_ct_pcpu_mutex); + return -ENOMEM; ++ } + nft_ct_pcpu_template_refcnt++; ++ mutex_unlock(&nft_ct_pcpu_mutex); + len = sizeof(u16); + break; + #endif +-- +2.30.2 + diff --git a/queue-5.14/netfilter-socket-icmp6-fix-use-after-scope.patch b/queue-5.14/netfilter-socket-icmp6-fix-use-after-scope.patch new file mode 100644 index 00000000000..db90923c71b --- /dev/null +++ b/queue-5.14/netfilter-socket-icmp6-fix-use-after-scope.patch @@ -0,0 +1,64 @@ +From e911961225308a4dcf222e986d834de527d36b17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Sep 2021 15:23:35 +0200 +Subject: netfilter: socket: icmp6: fix use-after-scope + +From: Benjamin Hesmans + +[ Upstream commit 730affed24bffcd1eebd5903171960f5ff9f1f22 ] + +Bug reported by KASAN: + +BUG: KASAN: use-after-scope in inet6_ehashfn (net/ipv6/inet6_hashtables.c:40) +Call Trace: +(...) +inet6_ehashfn (net/ipv6/inet6_hashtables.c:40) +(...) +nf_sk_lookup_slow_v6 (net/ipv6/netfilter/nf_socket_ipv6.c:91 +net/ipv6/netfilter/nf_socket_ipv6.c:146) + +It seems that this bug has already been fixed by Eric Dumazet in the +past in: +commit 78296c97ca1f ("netfilter: xt_socket: fix a stack corruption bug") + +But a variant of the same issue has been introduced in +commit d64d80a2cde9 ("netfilter: x_tables: don't extract flow keys on early demuxed sks in socket match") + +`daddr` and `saddr` potentially hold a reference to ipv6_var that is no +longer in scope when the call to `nf_socket_get_sock_v6` is made. + +Fixes: d64d80a2cde9 ("netfilter: x_tables: don't extract flow keys on early demuxed sks in socket match") +Acked-by: Matthieu Baerts +Signed-off-by: Benjamin Hesmans +Reviewed-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/ipv6/netfilter/nf_socket_ipv6.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/net/ipv6/netfilter/nf_socket_ipv6.c b/net/ipv6/netfilter/nf_socket_ipv6.c +index 6fd54744cbc3..aa5bb8789ba0 100644 +--- a/net/ipv6/netfilter/nf_socket_ipv6.c ++++ b/net/ipv6/netfilter/nf_socket_ipv6.c +@@ -99,7 +99,7 @@ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb, + { + __be16 dport, sport; + const struct in6_addr *daddr = NULL, *saddr = NULL; +- struct ipv6hdr *iph = ipv6_hdr(skb); ++ struct ipv6hdr *iph = ipv6_hdr(skb), ipv6_var; + struct sk_buff *data_skb = NULL; + int doff = 0; + int thoff = 0, tproto; +@@ -129,8 +129,6 @@ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb, + thoff + sizeof(*hp); + + } else if (tproto == IPPROTO_ICMPV6) { +- struct ipv6hdr ipv6_var; +- + if (extract_icmp6_fields(skb, thoff, &tproto, &saddr, &daddr, + &sport, &dport, &ipv6_var)) + return NULL; +-- +2.30.2 + diff --git a/queue-5.14/ntb-fix-an-error-code-in-ntb_msit_probe.patch b/queue-5.14/ntb-fix-an-error-code-in-ntb_msit_probe.patch new file mode 100644 index 00000000000..cc0c55ba052 --- /dev/null +++ b/queue-5.14/ntb-fix-an-error-code-in-ntb_msit_probe.patch @@ -0,0 +1,44 @@ +From b80687aa08b9f5766a514620c81df841b54b9b01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jun 2021 13:56:20 +0800 +Subject: NTB: Fix an error code in ntb_msit_probe() + +From: Yang Li + +[ Upstream commit 319f83ac98d7afaabab84ce5281a819a358b9895 ] + +When the value of nm->isr_ctx is false, the value of ret is 0. +So, we set ret to -ENOMEM to indicate this error. + +Clean up smatch warning: +drivers/ntb/test/ntb_msi_test.c:373 ntb_msit_probe() warn: missing +error code 'ret'. + +Reported-by: Abaci Robot +Signed-off-by: Yang Li +Reviewed-by: Logan Gunthorpe +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/test/ntb_msi_test.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/ntb/test/ntb_msi_test.c b/drivers/ntb/test/ntb_msi_test.c +index 7095ecd6223a..4e18e08776c9 100644 +--- a/drivers/ntb/test/ntb_msi_test.c ++++ b/drivers/ntb/test/ntb_msi_test.c +@@ -369,8 +369,10 @@ static int ntb_msit_probe(struct ntb_client *client, struct ntb_dev *ntb) + if (ret) + goto remove_dbgfs; + +- if (!nm->isr_ctx) ++ if (!nm->isr_ctx) { ++ ret = -ENOMEM; + goto remove_dbgfs; ++ } + + ntb_link_enable(ntb, NTB_SPEED_AUTO, NTB_WIDTH_AUTO); + +-- +2.30.2 + diff --git a/queue-5.14/ntb-perf-fix-an-error-code-in-perf_setup_inbuf.patch b/queue-5.14/ntb-perf-fix-an-error-code-in-perf_setup_inbuf.patch new file mode 100644 index 00000000000..cc0afb45c35 --- /dev/null +++ b/queue-5.14/ntb-perf-fix-an-error-code-in-perf_setup_inbuf.patch @@ -0,0 +1,40 @@ +From 05aa21b9360b07eea5ba10a4c048cd0baf5b4c20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jun 2021 16:40:36 +0800 +Subject: NTB: perf: Fix an error code in perf_setup_inbuf() + +From: Yang Li + +[ Upstream commit 0097ae5f7af5684f961a5f803ff7ad3e6f933668 ] + +When the function IS_ALIGNED() returns false, the value of ret is 0. +So, we set ret to -EINVAL to indicate this error. + +Clean up smatch warning: +drivers/ntb/test/ntb_perf.c:602 perf_setup_inbuf() warn: missing error +code 'ret'. + +Reported-by: Abaci Robot +Signed-off-by: Yang Li +Reviewed-by: Serge Semin +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/test/ntb_perf.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c +index 89df1350fefd..65e1e5cf1b29 100644 +--- a/drivers/ntb/test/ntb_perf.c ++++ b/drivers/ntb/test/ntb_perf.c +@@ -598,6 +598,7 @@ static int perf_setup_inbuf(struct perf_peer *peer) + return -ENOMEM; + } + if (!IS_ALIGNED(peer->inbuf_xlat, xlat_align)) { ++ ret = -EINVAL; + dev_err(&perf->ntb->dev, "Unaligned inbuf allocated\n"); + goto err_free_inbuf; + } +-- +2.30.2 + diff --git a/queue-5.14/nvme-avoid-race-in-shutdown-namespace-removal.patch b/queue-5.14/nvme-avoid-race-in-shutdown-namespace-removal.patch new file mode 100644 index 00000000000..9e681fe7c93 --- /dev/null +++ b/queue-5.14/nvme-avoid-race-in-shutdown-namespace-removal.patch @@ -0,0 +1,69 @@ +From f02a6137dfc384d8c831985f590892da4e054f3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Sep 2021 11:20:02 +0200 +Subject: nvme: avoid race in shutdown namespace removal + +From: Daniel Wagner + +[ Upstream commit 9edceaf43050f5ba1dd7d0011bcf68a736a17743 ] + +When we remove the siblings entry, we update ns->head->list, hence we +can't separate the removal and test for being empty. They have to be +in the same critical section to avoid a race. + +To avoid breaking the refcounting imbalance again, add a list empty +check to nvme_find_ns_head. + +Fixes: 5396fdac56d8 ("nvme: fix refcounting imbalance when all paths are down") +Signed-off-by: Daniel Wagner +Reviewed-by: Hannes Reinecke +Tested-by: Hannes Reinecke +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 2f0cbaba12ac..84e7cb9f1968 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3496,7 +3496,9 @@ static struct nvme_ns_head *nvme_find_ns_head(struct nvme_subsystem *subsys, + lockdep_assert_held(&subsys->lock); + + list_for_each_entry(h, &subsys->nsheads, entry) { +- if (h->ns_id == nsid && nvme_tryget_ns_head(h)) ++ if (h->ns_id != nsid) ++ continue; ++ if (!list_empty(&h->list) && nvme_tryget_ns_head(h)) + return h; + } + +@@ -3821,6 +3823,10 @@ static void nvme_ns_remove(struct nvme_ns *ns) + + mutex_lock(&ns->ctrl->subsys->lock); + list_del_rcu(&ns->siblings); ++ if (list_empty(&ns->head->list)) { ++ list_del_init(&ns->head->entry); ++ last_path = true; ++ } + mutex_unlock(&ns->ctrl->subsys->lock); + + synchronize_rcu(); /* guarantee not available in head->list */ +@@ -3840,13 +3846,6 @@ static void nvme_ns_remove(struct nvme_ns *ns) + list_del_init(&ns->list); + up_write(&ns->ctrl->namespaces_rwsem); + +- /* Synchronize with nvme_init_ns_head() */ +- mutex_lock(&ns->head->subsys->lock); +- if (list_empty(&ns->head->list)) { +- list_del_init(&ns->head->entry); +- last_path = true; +- } +- mutex_unlock(&ns->head->subsys->lock); + if (last_path) + nvme_mpath_shutdown_disk(ns->head); + nvme_put_ns(ns); +-- +2.30.2 + diff --git a/queue-5.14/octeontx2-af-add-additional-register-check-to-rvu_po.patch b/queue-5.14/octeontx2-af-add-additional-register-check-to-rvu_po.patch new file mode 100644 index 00000000000..ffdcb801984 --- /dev/null +++ b/queue-5.14/octeontx2-af-add-additional-register-check-to-rvu_po.patch @@ -0,0 +1,61 @@ +From 0935cb4f2f6473e33f2e9e3fbd329f7f8373ab48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Sep 2021 11:08:59 +0530 +Subject: octeontx2-af: Add additional register check to rvu_poll_reg() + +From: Smadar Fuks + +[ Upstream commit 21274aa1781941884599a97ab59be7f8f36af98c ] + +Check one more time before exiting the API with an error. +Fix API to poll at least twice, in case there are other high priority +tasks and this API doesn't get CPU cycles for multiple jiffies update. + +In addition, increase timeout from usecs_to_jiffies(10000) to +usecs_to_jiffies(20000), to prevent the case that for CONFIG_100HZ +timeout will be a single jiffies. +A single jiffies results actual timeout that can be any time between +1usec and 10msec. To solve this, a value of usecs_to_jiffies(20000) +ensures that timeout is 2 jiffies. + +Signed-off-by: Smadar Fuks +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +index 5fe277e354f7..c10cae78e79f 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +@@ -92,7 +92,8 @@ static void rvu_setup_hw_capabilities(struct rvu *rvu) + */ + int rvu_poll_reg(struct rvu *rvu, u64 block, u64 offset, u64 mask, bool zero) + { +- unsigned long timeout = jiffies + usecs_to_jiffies(10000); ++ unsigned long timeout = jiffies + usecs_to_jiffies(20000); ++ bool twice = false; + void __iomem *reg; + u64 reg_val; + +@@ -107,6 +108,15 @@ again: + usleep_range(1, 5); + goto again; + } ++ /* In scenarios where CPU is scheduled out before checking ++ * 'time_before' (above) and gets scheduled in such that ++ * jiffies are beyond timeout value, then check again if HW is ++ * done with the operation in the meantime. ++ */ ++ if (!twice) { ++ twice = true; ++ goto again; ++ } + return -EBUSY; + } + +-- +2.30.2 + diff --git a/queue-5.14/pci-add-acs-quirks-for-cavium-multi-function-devices.patch b/queue-5.14/pci-add-acs-quirks-for-cavium-multi-function-devices.patch new file mode 100644 index 00000000000..ef1c9a7d65e --- /dev/null +++ b/queue-5.14/pci-add-acs-quirks-for-cavium-multi-function-devices.patch @@ -0,0 +1,44 @@ +From c995c018b6c19b2e1b2ff53a677102dd05073d76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Aug 2021 17:54:25 +0530 +Subject: PCI: Add ACS quirks for Cavium multi-function devices + +From: George Cherian + +[ Upstream commit 32837d8a8f63eb95dcb9cd005524a27f06478832 ] + +Some Cavium endpoints are implemented as multi-function devices without ACS +capability, but they actually don't support peer-to-peer transactions. + +Add ACS quirks to declare DMA isolation for the following devices: + + - BGX device found on Octeon-TX (8xxx) + - CGX device found on Octeon-TX2 (9xxx) + - RPM device found on Octeon-TX3 (10xxx) + +Link: https://lore.kernel.org/r/20210810122425.1115156-1-george.cherian@marvell.com +Signed-off-by: George Cherian +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 950290d8cafc..8c3c1ef92171 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4854,6 +4854,10 @@ static const struct pci_dev_acs_enabled { + { 0x10df, 0x720, pci_quirk_mf_endpoint_acs }, /* Emulex Skyhawk-R */ + /* Cavium ThunderX */ + { PCI_VENDOR_ID_CAVIUM, PCI_ANY_ID, pci_quirk_cavium_acs }, ++ /* Cavium multi-function devices */ ++ { PCI_VENDOR_ID_CAVIUM, 0xA026, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_CAVIUM, 0xA059, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_CAVIUM, 0xA060, pci_quirk_mf_endpoint_acs }, + /* APM X-Gene */ + { PCI_VENDOR_ID_AMCC, 0xE004, pci_quirk_xgene_acs }, + /* Ampere Computing */ +-- +2.30.2 + diff --git a/queue-5.14/pci-add-acs-quirks-for-nxp-lx2xx0-and-lx2xx2-platfor.patch b/queue-5.14/pci-add-acs-quirks-for-nxp-lx2xx0-and-lx2xx2-platfor.patch new file mode 100644 index 00000000000..446f049526e --- /dev/null +++ b/queue-5.14/pci-add-acs-quirks-for-nxp-lx2xx0-and-lx2xx2-platfor.patch @@ -0,0 +1,148 @@ +From 7bc51c653fb9985a3247d68e3d62ce0906ac14d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jul 2021 14:17:47 +0200 +Subject: PCI: Add ACS quirks for NXP LX2xx0 and LX2xx2 platforms + +From: Wasim Khan + +[ Upstream commit d08c8b855140e9f5240b3ffd1b8b9d435675e281 ] + +Root Ports in NXP LX2xx0 and LX2xx2, where each Root Port is a Root Complex +with unique segment numbers, do provide isolation features to disable peer +transactions and validate bus numbers in requests, but do not provide an +actual PCIe ACS capability. + +Add ACS quirks for NXP LX2xx0 A/C/E/N and LX2xx2 A/C/E/N platforms. + + LX2xx0A : without security features + CAN-FD + LX2160A (0x8d81) - 16 cores + LX2120A (0x8da1) - 12 cores + LX2080A (0x8d83) - 8 cores + + LX2xx0C : security features + CAN-FD + LX2160C (0x8d80) - 16 cores + LX2120C (0x8da0) - 12 cores + LX2080C (0x8d82) - 8 cores + + LX2xx0E : security features + CAN + LX2160E (0x8d90) - 16 cores + LX2120E (0x8db0) - 12 cores + LX2080E (0x8d92) - 8 cores + + LX2xx0N : without security features + CAN + LX2160N (0x8d91) - 16 cores + LX2120N (0x8db1) - 12 cores + LX2080N (0x8d93) - 8 cores + + LX2xx2A : without security features + CAN-FD + LX2162A (0x8d89) - 16 cores + LX2122A (0x8da9) - 12 cores + LX2082A (0x8d8b) - 8 cores + + LX2xx2C : security features + CAN-FD + LX2162C (0x8d88) - 16 cores + LX2122C (0x8da8) - 12 cores + LX2082C (0x8d8a) - 8 cores + + LX2xx2E : security features + CAN + LX2162E (0x8d98) - 16 cores + LX2122E (0x8db8) - 12 cores + LX2082E (0x8d9a) - 8 cores + + LX2xx2N : without security features + CAN + LX2162N (0x8d99) - 16 cores + LX2122N (0x8db9) - 12 cores + LX2082N (0x8d9b) - 8 cores + +[bhelgaas: put PCI_VENDOR_ID_NXP definition next to PCI_VENDOR_ID_FREESCALE +as a clue that they share the same Device ID namespace] +Link: https://lore.kernel.org/r/20210729121747.1823086-1-wasim.khan@oss.nxp.com +Link: https://lore.kernel.org/r/20210803180021.3252886-1-wasim.khan@oss.nxp.com +Signed-off-by: Wasim Khan +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 45 +++++++++++++++++++++++++++++++++++++++++ + include/linux/pci_ids.h | 3 ++- + 2 files changed, 47 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 642be905e77d..950290d8cafc 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4616,6 +4616,18 @@ static int pci_quirk_qcom_rp_acs(struct pci_dev *dev, u16 acs_flags) + PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF); + } + ++/* ++ * Each of these NXP Root Ports is in a Root Complex with a unique segment ++ * number and does provide isolation features to disable peer transactions ++ * and validate bus numbers in requests, but does not provide an ACS ++ * capability. ++ */ ++static int pci_quirk_nxp_rp_acs(struct pci_dev *dev, u16 acs_flags) ++{ ++ return pci_acs_ctrl_enabled(acs_flags, ++ PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF); ++} ++ + static int pci_quirk_al_acs(struct pci_dev *dev, u16 acs_flags) + { + if (pci_pcie_type(dev) != PCI_EXP_TYPE_ROOT_PORT) +@@ -4862,6 +4874,39 @@ static const struct pci_dev_acs_enabled { + { PCI_VENDOR_ID_ZHAOXIN, 0x3038, pci_quirk_mf_endpoint_acs }, + { PCI_VENDOR_ID_ZHAOXIN, 0x3104, pci_quirk_mf_endpoint_acs }, + { PCI_VENDOR_ID_ZHAOXIN, 0x9083, pci_quirk_mf_endpoint_acs }, ++ /* NXP root ports, xx=16, 12, or 08 cores */ ++ /* LX2xx0A : without security features + CAN-FD */ ++ { PCI_VENDOR_ID_NXP, 0x8d81, pci_quirk_nxp_rp_acs }, ++ { PCI_VENDOR_ID_NXP, 0x8da1, pci_quirk_nxp_rp_acs }, ++ { PCI_VENDOR_ID_NXP, 0x8d83, pci_quirk_nxp_rp_acs }, ++ /* LX2xx0C : security features + CAN-FD */ ++ { PCI_VENDOR_ID_NXP, 0x8d80, pci_quirk_nxp_rp_acs }, ++ { PCI_VENDOR_ID_NXP, 0x8da0, pci_quirk_nxp_rp_acs }, ++ { PCI_VENDOR_ID_NXP, 0x8d82, pci_quirk_nxp_rp_acs }, ++ /* LX2xx0E : security features + CAN */ ++ { PCI_VENDOR_ID_NXP, 0x8d90, pci_quirk_nxp_rp_acs }, ++ { PCI_VENDOR_ID_NXP, 0x8db0, pci_quirk_nxp_rp_acs }, ++ { PCI_VENDOR_ID_NXP, 0x8d92, pci_quirk_nxp_rp_acs }, ++ /* LX2xx0N : without security features + CAN */ ++ { PCI_VENDOR_ID_NXP, 0x8d91, pci_quirk_nxp_rp_acs }, ++ { PCI_VENDOR_ID_NXP, 0x8db1, pci_quirk_nxp_rp_acs }, ++ { PCI_VENDOR_ID_NXP, 0x8d93, pci_quirk_nxp_rp_acs }, ++ /* LX2xx2A : without security features + CAN-FD */ ++ { PCI_VENDOR_ID_NXP, 0x8d89, pci_quirk_nxp_rp_acs }, ++ { PCI_VENDOR_ID_NXP, 0x8da9, pci_quirk_nxp_rp_acs }, ++ { PCI_VENDOR_ID_NXP, 0x8d8b, pci_quirk_nxp_rp_acs }, ++ /* LX2xx2C : security features + CAN-FD */ ++ { PCI_VENDOR_ID_NXP, 0x8d88, pci_quirk_nxp_rp_acs }, ++ { PCI_VENDOR_ID_NXP, 0x8da8, pci_quirk_nxp_rp_acs }, ++ { PCI_VENDOR_ID_NXP, 0x8d8a, pci_quirk_nxp_rp_acs }, ++ /* LX2xx2E : security features + CAN */ ++ { PCI_VENDOR_ID_NXP, 0x8d98, pci_quirk_nxp_rp_acs }, ++ { PCI_VENDOR_ID_NXP, 0x8db8, pci_quirk_nxp_rp_acs }, ++ { PCI_VENDOR_ID_NXP, 0x8d9a, pci_quirk_nxp_rp_acs }, ++ /* LX2xx2N : without security features + CAN */ ++ { PCI_VENDOR_ID_NXP, 0x8d99, pci_quirk_nxp_rp_acs }, ++ { PCI_VENDOR_ID_NXP, 0x8db9, pci_quirk_nxp_rp_acs }, ++ { PCI_VENDOR_ID_NXP, 0x8d9b, pci_quirk_nxp_rp_acs }, + /* Zhaoxin Root/Downstream Ports */ + { PCI_VENDOR_ID_ZHAOXIN, PCI_ANY_ID, pci_quirk_zhaoxin_pcie_ports_acs }, + { 0 } +diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h +index 4bac1831de80..1a9b8589391c 100644 +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -2451,7 +2451,8 @@ + #define PCI_VENDOR_ID_TDI 0x192E + #define PCI_DEVICE_ID_TDI_EHCI 0x0101 + +-#define PCI_VENDOR_ID_FREESCALE 0x1957 ++#define PCI_VENDOR_ID_FREESCALE 0x1957 /* duplicate: NXP */ ++#define PCI_VENDOR_ID_NXP 0x1957 /* duplicate: FREESCALE */ + #define PCI_DEVICE_ID_MPC8308 0xc006 + #define PCI_DEVICE_ID_MPC8315E 0x00b4 + #define PCI_DEVICE_ID_MPC8315 0x00b5 +-- +2.30.2 + diff --git a/queue-5.14/pci-cadence-add-quirk-flag-to-set-minimum-delay-in-l.patch b/queue-5.14/pci-cadence-add-quirk-flag-to-set-minimum-delay-in-l.patch new file mode 100644 index 00000000000..55bf2ed85f3 --- /dev/null +++ b/queue-5.14/pci-cadence-add-quirk-flag-to-set-minimum-delay-in-l.patch @@ -0,0 +1,167 @@ +From 5c8d7ab3082366fb884077fc2eb82c5787a9e5b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Aug 2021 18:03:33 +0530 +Subject: PCI: cadence: Add quirk flag to set minimum delay in LTSSM + Detect.Quiet state + +From: Nadeem Athani + +[ Upstream commit 09c24094b2e3a15ef3fc44f54a191b3db522fb11 ] + +PCIe fails to link up if SERDES lanes not used by PCIe are assigned to +another protocol. For example, link training fails if lanes 2 and 3 are +assigned to another protocol while lanes 0 and 1 are used for PCIe to +form a two lane link. This failure is due to an incorrect tie-off on an +internal status signal indicating electrical idle. + +Status signals going from SERDES to PCIe Controller are tied-off when a +lane is not assigned to PCIe. Signal indicating electrical idle is +incorrectly tied-off to a state that indicates non-idle. As a result, +PCIe sees unused lanes to be out of electrical idle and this causes +LTSSM to exit Detect.Quiet state without waiting for 12ms timeout to +occur. If a receiver is not detected on the first receiver detection +attempt in Detect.Active state, LTSSM goes back to Detect.Quiet and +again moves forward to Detect.Active state without waiting for 12ms as +required by PCIe base specification. Since wait time in Detect.Quiet is +skipped, multiple receiver detect operations are performed back-to-back +without allowing time for capacitance on the transmit lines to +discharge. This causes subsequent receiver detection to always fail even +if a receiver gets connected eventually. + +Add a quirk flag "quirk_detect_quiet_flag" to program the minimum +time the LTSSM should wait on entering Detect.Quiet state here. +This has to be set for J7200 as it has an incorrect tie-off on unused +lanes. + +Link: https://lore.kernel.org/r/20210811123336.31357-3-kishon@ti.com +Signed-off-by: Nadeem Athani +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/cadence/pcie-cadence-ep.c | 4 ++++ + .../pci/controller/cadence/pcie-cadence-host.c | 3 +++ + drivers/pci/controller/cadence/pcie-cadence.c | 16 ++++++++++++++++ + drivers/pci/controller/cadence/pcie-cadence.h | 15 +++++++++++++++ + 4 files changed, 38 insertions(+) + +diff --git a/drivers/pci/controller/cadence/pcie-cadence-ep.c b/drivers/pci/controller/cadence/pcie-cadence-ep.c +index 897cdde02bd8..dd7df1ac7fda 100644 +--- a/drivers/pci/controller/cadence/pcie-cadence-ep.c ++++ b/drivers/pci/controller/cadence/pcie-cadence-ep.c +@@ -623,6 +623,10 @@ int cdns_pcie_ep_setup(struct cdns_pcie_ep *ep) + ep->irq_pci_addr = CDNS_PCIE_EP_IRQ_PCI_ADDR_NONE; + /* Reserve region 0 for IRQs */ + set_bit(0, &ep->ob_region_map); ++ ++ if (ep->quirk_detect_quiet_flag) ++ cdns_pcie_detect_quiet_min_delay_set(&ep->pcie); ++ + spin_lock_init(&ep->lock); + + return 0; +diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c +index ae1c55503513..fb96d37a135c 100644 +--- a/drivers/pci/controller/cadence/pcie-cadence-host.c ++++ b/drivers/pci/controller/cadence/pcie-cadence-host.c +@@ -498,6 +498,9 @@ int cdns_pcie_host_setup(struct cdns_pcie_rc *rc) + return PTR_ERR(rc->cfg_base); + rc->cfg_res = res; + ++ if (rc->quirk_detect_quiet_flag) ++ cdns_pcie_detect_quiet_min_delay_set(&rc->pcie); ++ + ret = cdns_pcie_start_link(pcie); + if (ret) { + dev_err(dev, "Failed to start link\n"); +diff --git a/drivers/pci/controller/cadence/pcie-cadence.c b/drivers/pci/controller/cadence/pcie-cadence.c +index 3c3646502d05..52767f26048f 100644 +--- a/drivers/pci/controller/cadence/pcie-cadence.c ++++ b/drivers/pci/controller/cadence/pcie-cadence.c +@@ -7,6 +7,22 @@ + + #include "pcie-cadence.h" + ++void cdns_pcie_detect_quiet_min_delay_set(struct cdns_pcie *pcie) ++{ ++ u32 delay = 0x3; ++ u32 ltssm_control_cap; ++ ++ /* ++ * Set the LTSSM Detect Quiet state min. delay to 2ms. ++ */ ++ ltssm_control_cap = cdns_pcie_readl(pcie, CDNS_PCIE_LTSSM_CONTROL_CAP); ++ ltssm_control_cap = ((ltssm_control_cap & ++ ~CDNS_PCIE_DETECT_QUIET_MIN_DELAY_MASK) | ++ CDNS_PCIE_DETECT_QUIET_MIN_DELAY(delay)); ++ ++ cdns_pcie_writel(pcie, CDNS_PCIE_LTSSM_CONTROL_CAP, ltssm_control_cap); ++} ++ + void cdns_pcie_set_outbound_region(struct cdns_pcie *pcie, u8 busnr, u8 fn, + u32 r, bool is_io, + u64 cpu_addr, u64 pci_addr, size_t size) +diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h +index bc27d126f239..4bde99b74135 100644 +--- a/drivers/pci/controller/cadence/pcie-cadence.h ++++ b/drivers/pci/controller/cadence/pcie-cadence.h +@@ -189,6 +189,14 @@ + /* AXI link down register */ + #define CDNS_PCIE_AT_LINKDOWN (CDNS_PCIE_AT_BASE + 0x0824) + ++/* LTSSM Capabilities register */ ++#define CDNS_PCIE_LTSSM_CONTROL_CAP (CDNS_PCIE_LM_BASE + 0x0054) ++#define CDNS_PCIE_DETECT_QUIET_MIN_DELAY_MASK GENMASK(2, 1) ++#define CDNS_PCIE_DETECT_QUIET_MIN_DELAY_SHIFT 1 ++#define CDNS_PCIE_DETECT_QUIET_MIN_DELAY(delay) \ ++ (((delay) << CDNS_PCIE_DETECT_QUIET_MIN_DELAY_SHIFT) & \ ++ CDNS_PCIE_DETECT_QUIET_MIN_DELAY_MASK) ++ + enum cdns_pcie_rp_bar { + RP_BAR_UNDEFINED = -1, + RP_BAR0, +@@ -295,6 +303,7 @@ struct cdns_pcie { + * @avail_ib_bar: Satus of RP_BAR0, RP_BAR1 and RP_NO_BAR if it's free or + * available + * @quirk_retrain_flag: Retrain link as quirk for PCIe Gen2 ++ * @quirk_detect_quiet_flag: LTSSM Detect Quiet min delay set as quirk + */ + struct cdns_pcie_rc { + struct cdns_pcie pcie; +@@ -304,6 +313,7 @@ struct cdns_pcie_rc { + u32 device_id; + bool avail_ib_bar[CDNS_PCIE_RP_MAX_IB]; + unsigned int quirk_retrain_flag:1; ++ unsigned int quirk_detect_quiet_flag:1; + }; + + /** +@@ -334,6 +344,7 @@ struct cdns_pcie_epf { + * registers fields (RMW) accessible by both remote RC and EP to + * minimize time between read and write + * @epf: Structure to hold info about endpoint function ++ * @quirk_detect_quiet_flag: LTSSM Detect Quiet min delay set as quirk + */ + struct cdns_pcie_ep { + struct cdns_pcie pcie; +@@ -348,6 +359,7 @@ struct cdns_pcie_ep { + /* protect writing to PCI_STATUS while raising legacy interrupts */ + spinlock_t lock; + struct cdns_pcie_epf *epf; ++ unsigned int quirk_detect_quiet_flag:1; + }; + + +@@ -508,6 +520,9 @@ static inline int cdns_pcie_ep_setup(struct cdns_pcie_ep *ep) + return 0; + } + #endif ++ ++void cdns_pcie_detect_quiet_min_delay_set(struct cdns_pcie *pcie); ++ + void cdns_pcie_set_outbound_region(struct cdns_pcie *pcie, u8 busnr, u8 fn, + u32 r, bool is_io, + u64 cpu_addr, u64 pci_addr, size_t size); +-- +2.30.2 + diff --git a/queue-5.14/pci-cadence-use-bitfield-for-quirk_retrain_flag-inst.patch b/queue-5.14/pci-cadence-use-bitfield-for-quirk_retrain_flag-inst.patch new file mode 100644 index 00000000000..4f16154a420 --- /dev/null +++ b/queue-5.14/pci-cadence-use-bitfield-for-quirk_retrain_flag-inst.patch @@ -0,0 +1,55 @@ +From dabadd85d09f27f1e9a39a013e20172fb331d5ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Aug 2021 18:03:32 +0530 +Subject: PCI: cadence: Use bitfield for *quirk_retrain_flag* instead of bool + +From: Kishon Vijay Abraham I + +[ Upstream commit f4455748b2126a9ba2bcc9cfb2fbcaa08de29bb2 ] + +No functional change. As we are intending to add additional 1-bit +members in struct j721e_pcie_data/struct cdns_pcie_rc, use bitfields +instead of bool since it takes less space. As discussed in [1], +the preference is to use bitfileds instead of bool inside structures. + +[1] -> https://lore.kernel.org/linux-fsdevel/CA+55aFzKQ6Pj18TB8p4Yr0M4t+S+BsiHH=BJNmn=76-NcjTj-g@mail.gmail.com/ + +Suggested-by: Bjorn Helgaas +Link: https://lore.kernel.org/r/20210811123336.31357-2-kishon@ti.com +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/cadence/pci-j721e.c | 2 +- + drivers/pci/controller/cadence/pcie-cadence.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c +index 35e61048e133..0c5813b230b4 100644 +--- a/drivers/pci/controller/cadence/pci-j721e.c ++++ b/drivers/pci/controller/cadence/pci-j721e.c +@@ -66,7 +66,7 @@ enum j721e_pcie_mode { + + struct j721e_pcie_data { + enum j721e_pcie_mode mode; +- bool quirk_retrain_flag; ++ unsigned int quirk_retrain_flag:1; + }; + + static inline u32 j721e_pcie_user_readl(struct j721e_pcie *pcie, u32 offset) +diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h +index 30db2d68c17a..bc27d126f239 100644 +--- a/drivers/pci/controller/cadence/pcie-cadence.h ++++ b/drivers/pci/controller/cadence/pcie-cadence.h +@@ -303,7 +303,7 @@ struct cdns_pcie_rc { + u32 vendor_id; + u32 device_id; + bool avail_ib_bar[CDNS_PCIE_RP_MAX_IB]; +- bool quirk_retrain_flag; ++ unsigned int quirk_retrain_flag:1; + }; + + /** +-- +2.30.2 + diff --git a/queue-5.14/pci-controller-pci_ixp4xx-should-depend-on-arch_ixp4.patch b/queue-5.14/pci-controller-pci_ixp4xx-should-depend-on-arch_ixp4.patch new file mode 100644 index 00000000000..547667d525d --- /dev/null +++ b/queue-5.14/pci-controller-pci_ixp4xx-should-depend-on-arch_ixp4.patch @@ -0,0 +1,42 @@ +From 40c5898f49de7dd3bf005318511b9c8e1597e67b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jun 2021 15:20:45 +0200 +Subject: PCI: controller: PCI_IXP4XX should depend on ARCH_IXP4XX + +From: Geert Uytterhoeven + +[ Upstream commit 9f1168cf263aab0474300f7118107f8ef73e7423 ] + +The Intel IXP4xx PCI controller is only present on Intel IXP4xx +XScale-based network processor SoCs. + +Add a dependency on ARCH_IXP4XX, to prevent asking the user about this +driver when configuring a kernel without support for the XScale +processor family. + +Link: https://lore.kernel.org/r/6a88e55fe58fc280f4ff1ca83c154e4895b6dcbf.1624972789.git.geert+renesas@glider.be +Fixes: f7821b4934584824 ("PCI: ixp4xx: Add a new driver for IXP4xx") +Signed-off-by: Geert Uytterhoeven +[lorenzo.pieralisi@arm.com: commit log] +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pci/controller/Kconfig b/drivers/pci/controller/Kconfig +index 5e1e3796efa4..326f7d13024f 100644 +--- a/drivers/pci/controller/Kconfig ++++ b/drivers/pci/controller/Kconfig +@@ -40,6 +40,7 @@ config PCI_FTPCI100 + config PCI_IXP4XX + bool "Intel IXP4xx PCI controller" + depends on ARM && OF ++ depends on ARCH_IXP4XX || COMPILE_TEST + default ARCH_IXP4XX + help + Say Y here if you want support for the PCI host controller found +-- +2.30.2 + diff --git a/queue-5.14/pci-fix-pci_dev_str_match_path-alloc-while-atomic-bu.patch b/queue-5.14/pci-fix-pci_dev_str_match_path-alloc-while-atomic-bu.patch new file mode 100644 index 00000000000..4424ff1b33e --- /dev/null +++ b/queue-5.14/pci-fix-pci_dev_str_match_path-alloc-while-atomic-bu.patch @@ -0,0 +1,42 @@ +From 96a97aef12354c7d175a088eb3d22c52cd9e6986 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 10:00:04 +0300 +Subject: PCI: Fix pci_dev_str_match_path() alloc while atomic bug + +From: Dan Carpenter + +[ Upstream commit 7eb6ea4148579b85540a41d57bcec315b8af8ff8 ] + +pci_dev_str_match_path() is often called with a spinlock held so the +allocation has to be atomic. The call tree is: + + pci_specified_resource_alignment() <-- takes spin_lock(); + pci_dev_str_match() + pci_dev_str_match_path() + +Fixes: 45db33709ccc ("PCI: Allow specifying devices using a base bus and path of devfns") +Link: https://lore.kernel.org/r/20210812070004.GC31863@kili +Signed-off-by: Dan Carpenter +Signed-off-by: Bjorn Helgaas +Reviewed-by: Logan Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/pci/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index a5e6759c407b..a4eb0c042ca3 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -265,7 +265,7 @@ static int pci_dev_str_match_path(struct pci_dev *dev, const char *path, + + *endptr = strchrnul(path, ';'); + +- wpath = kmemdup_nul(path, *endptr - path, GFP_KERNEL); ++ wpath = kmemdup_nul(path, *endptr - path, GFP_ATOMIC); + if (!wpath) + return -ENOMEM; + +-- +2.30.2 + diff --git a/queue-5.14/pci-ibmphp-fix-double-unmap-of-io_mem.patch b/queue-5.14/pci-ibmphp-fix-double-unmap-of-io_mem.patch new file mode 100644 index 00000000000..299eeea019b --- /dev/null +++ b/queue-5.14/pci-ibmphp-fix-double-unmap-of-io_mem.patch @@ -0,0 +1,64 @@ +From 095bd22ee1878cc2bee0ebe0f206cd635f017c80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 11:57:51 -0500 +Subject: PCI: ibmphp: Fix double unmap of io_mem + +From: Vishal Aslot + +[ Upstream commit faa2e05ad0dccf37f995bcfbb8d1980d66c02c11 ] + +ebda_rsrc_controller() calls iounmap(io_mem) on the error path. Its caller, +ibmphp_access_ebda(), also calls iounmap(io_mem) on good and error paths. + +Remove the iounmap(io_mem) invocation from ebda_rsrc_controller(). + +[bhelgaas: remove item from TODO] +Link: https://lore.kernel.org/r/20210818165751.591185-1-os.vaslot@gmail.com +Signed-off-by: Vishal Aslot +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/hotplug/TODO | 3 --- + drivers/pci/hotplug/ibmphp_ebda.c | 5 +---- + 2 files changed, 1 insertion(+), 7 deletions(-) + +diff --git a/drivers/pci/hotplug/TODO b/drivers/pci/hotplug/TODO +index a32070be5adf..cc6194aa24c1 100644 +--- a/drivers/pci/hotplug/TODO ++++ b/drivers/pci/hotplug/TODO +@@ -40,9 +40,6 @@ ibmphp: + + * The return value of pci_hp_register() is not checked. + +-* iounmap(io_mem) is called in the error path of ebda_rsrc_controller() +- and once more in the error path of its caller ibmphp_access_ebda(). +- + * The various slot data structures are difficult to follow and need to be + simplified. A lot of functions are too large and too complex, they need + to be broken up into smaller, manageable pieces. Negative examples are +diff --git a/drivers/pci/hotplug/ibmphp_ebda.c b/drivers/pci/hotplug/ibmphp_ebda.c +index 11a2661dc062..7fb75401ad8a 100644 +--- a/drivers/pci/hotplug/ibmphp_ebda.c ++++ b/drivers/pci/hotplug/ibmphp_ebda.c +@@ -714,8 +714,7 @@ static int __init ebda_rsrc_controller(void) + /* init hpc structure */ + hpc_ptr = alloc_ebda_hpc(slot_num, bus_num); + if (!hpc_ptr) { +- rc = -ENOMEM; +- goto error_no_hpc; ++ return -ENOMEM; + } + hpc_ptr->ctlr_id = ctlr_id; + hpc_ptr->ctlr_relative_id = ctlr; +@@ -910,8 +909,6 @@ error: + kfree(tmp_slot); + error_no_slot: + free_ebda_hpc(hpc_ptr); +-error_no_hpc: +- iounmap(io_mem); + return rc; + } + +-- +2.30.2 + diff --git a/queue-5.14/pci-iproc-fix-bcma-probe-resource-handling.patch b/queue-5.14/pci-iproc-fix-bcma-probe-resource-handling.patch new file mode 100644 index 00000000000..94497375fbe --- /dev/null +++ b/queue-5.14/pci-iproc-fix-bcma-probe-resource-handling.patch @@ -0,0 +1,88 @@ +From 462d7a1ce8f5da6821a2d469e0b00cbb141d9adb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Aug 2021 15:56:56 -0600 +Subject: PCI: iproc: Fix BCMA probe resource handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rob Herring + +[ Upstream commit aeaea8969b402e0081210cc9144404d13996efed ] + +In commit 7ef1c871da16 ("PCI: iproc: Use +pci_parse_request_of_pci_ranges()"), calling +devm_request_pci_bus_resources() was dropped from the common iProc +probe code, but is still needed for BCMA bus probing. Without it, there +will be lots of warnings like this: + +pci 0000:00:00.0: BAR 8: no space for [mem size 0x00c00000] +pci 0000:00:00.0: BAR 8: failed to assign [mem size 0x00c00000] + +Add back calling devm_request_pci_bus_resources() and adding the +resources to pci_host_bridge.windows for BCMA bus probe. + +Link: https://lore.kernel.org/r/20210803215656.3803204-2-robh@kernel.org +Fixes: 7ef1c871da16 ("PCI: iproc: Use pci_parse_request_of_pci_ranges()") +Reported-by: Rafał Miłecki +Tested-by: Rafał Miłecki +Signed-off-by: Rob Herring +Signed-off-by: Lorenzo Pieralisi +Cc: Srinath Mannam +Cc: Roman Bacik +Cc: Bharat Gooty +Cc: Abhishek Shah +Cc: Jitendra Bhivare +Cc: Ray Jui +Cc: Florian Fainelli +Cc: BCM Kernel Feedback +Cc: Scott Branden +Cc: Lorenzo Pieralisi +Cc: "Krzysztof Wilczyński" +Cc: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pcie-iproc-bcma.c | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +diff --git a/drivers/pci/controller/pcie-iproc-bcma.c b/drivers/pci/controller/pcie-iproc-bcma.c +index 56b8ee7bf330..f918c713afb0 100644 +--- a/drivers/pci/controller/pcie-iproc-bcma.c ++++ b/drivers/pci/controller/pcie-iproc-bcma.c +@@ -35,7 +35,6 @@ static int iproc_pcie_bcma_probe(struct bcma_device *bdev) + { + struct device *dev = &bdev->dev; + struct iproc_pcie *pcie; +- LIST_HEAD(resources); + struct pci_host_bridge *bridge; + int ret; + +@@ -60,19 +59,16 @@ static int iproc_pcie_bcma_probe(struct bcma_device *bdev) + pcie->mem.end = bdev->addr_s[0] + SZ_128M - 1; + pcie->mem.name = "PCIe MEM space"; + pcie->mem.flags = IORESOURCE_MEM; +- pci_add_resource(&resources, &pcie->mem); ++ pci_add_resource(&bridge->windows, &pcie->mem); ++ ret = devm_request_pci_bus_resources(dev, &bridge->windows); ++ if (ret) ++ return ret; + + pcie->map_irq = iproc_pcie_bcma_map_irq; + +- ret = iproc_pcie_setup(pcie, &resources); +- if (ret) { +- dev_err(dev, "PCIe controller setup failed\n"); +- pci_free_resource_list(&resources); +- return ret; +- } +- + bcma_set_drvdata(bdev, pcie); +- return 0; ++ ++ return iproc_pcie_setup(pcie, &bridge->windows); + } + + static void iproc_pcie_bcma_remove(struct bcma_device *bdev) +-- +2.30.2 + diff --git a/queue-5.14/pci-j721e-add-pcie-support-for-am64.patch b/queue-5.14/pci-j721e-add-pcie-support-for-am64.patch new file mode 100644 index 00000000000..34a0acd5bcf --- /dev/null +++ b/queue-5.14/pci-j721e-add-pcie-support-for-am64.patch @@ -0,0 +1,61 @@ +From 4a1d4e715a998fef7ce19016f5a6febfc88a4a2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Aug 2021 18:03:35 +0530 +Subject: PCI: j721e: Add PCIe support for AM64 + +From: Kishon Vijay Abraham I + +[ Upstream commit c8a375a8e15ac31293d7fda08008d6da8f5df3db ] + +AM64 has the same PCIe IP as in J7200 with certain erratas not +applicable (quirk_detect_quiet_flag). Add support for "ti,am64-pcie-host" +compatible and "ti,am64-pcie-ep" compatible that is specific to AM64. + +Link: https://lore.kernel.org/r/20210811123336.31357-5-kishon@ti.com +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/cadence/pci-j721e.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c +index 10b13b728284..ffb176d288cd 100644 +--- a/drivers/pci/controller/cadence/pci-j721e.c ++++ b/drivers/pci/controller/cadence/pci-j721e.c +@@ -310,6 +310,17 @@ static const struct j721e_pcie_data j7200_pcie_ep_data = { + .quirk_detect_quiet_flag = true, + }; + ++static const struct j721e_pcie_data am64_pcie_rc_data = { ++ .mode = PCI_MODE_RC, ++ .linkdown_irq_regfield = J7200_LINK_DOWN, ++ .byte_access_allowed = true, ++}; ++ ++static const struct j721e_pcie_data am64_pcie_ep_data = { ++ .mode = PCI_MODE_EP, ++ .linkdown_irq_regfield = J7200_LINK_DOWN, ++}; ++ + static const struct of_device_id of_j721e_pcie_match[] = { + { + .compatible = "ti,j721e-pcie-host", +@@ -327,6 +338,14 @@ static const struct of_device_id of_j721e_pcie_match[] = { + .compatible = "ti,j7200-pcie-ep", + .data = &j7200_pcie_ep_data, + }, ++ { ++ .compatible = "ti,am64-pcie-host", ++ .data = &am64_pcie_rc_data, ++ }, ++ { ++ .compatible = "ti,am64-pcie-ep", ++ .data = &am64_pcie_ep_data, ++ }, + {}, + }; + +-- +2.30.2 + diff --git a/queue-5.14/pci-j721e-add-pcie-support-for-j7200.patch b/queue-5.14/pci-j721e-add-pcie-support-for-j7200.patch new file mode 100644 index 00000000000..f6db8c22aa7 --- /dev/null +++ b/queue-5.14/pci-j721e-add-pcie-support-for-j7200.patch @@ -0,0 +1,150 @@ +From 784e2b5c9a40e2cf67d24c388db87a4a9f2eb49e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Aug 2021 18:03:34 +0530 +Subject: PCI: j721e: Add PCIe support for J7200 + +From: Kishon Vijay Abraham I + +[ Upstream commit f1de58802f0fff364cf49f5e47d1be744baa434f ] + +J7200 has the same PCIe IP as in J721E with minor changes in the +wrapper. J7200 allows byte access of bridge configuration space +registers and the register field for LINK_DOWN interrupt is different. +J7200 also requires "quirk_detect_quiet_flag" to be set. Configure these +changes as part of driver data applicable only to J7200. + +Link: https://lore.kernel.org/r/20210811123336.31357-4-kishon@ti.com +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/cadence/pci-j721e.c | 40 +++++++++++++++++++--- + 1 file changed, 36 insertions(+), 4 deletions(-) + +diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c +index 0c5813b230b4..10b13b728284 100644 +--- a/drivers/pci/controller/cadence/pci-j721e.c ++++ b/drivers/pci/controller/cadence/pci-j721e.c +@@ -27,6 +27,7 @@ + #define STATUS_REG_SYS_2 0x508 + #define STATUS_CLR_REG_SYS_2 0x708 + #define LINK_DOWN BIT(1) ++#define J7200_LINK_DOWN BIT(10) + + #define J721E_PCIE_USER_CMD_STATUS 0x4 + #define LINK_TRAINING_ENABLE BIT(0) +@@ -57,6 +58,7 @@ struct j721e_pcie { + struct cdns_pcie *cdns_pcie; + void __iomem *user_cfg_base; + void __iomem *intd_cfg_base; ++ u32 linkdown_irq_regfield; + }; + + enum j721e_pcie_mode { +@@ -67,6 +69,9 @@ enum j721e_pcie_mode { + struct j721e_pcie_data { + enum j721e_pcie_mode mode; + unsigned int quirk_retrain_flag:1; ++ unsigned int quirk_detect_quiet_flag:1; ++ u32 linkdown_irq_regfield; ++ unsigned int byte_access_allowed:1; + }; + + static inline u32 j721e_pcie_user_readl(struct j721e_pcie *pcie, u32 offset) +@@ -98,12 +103,12 @@ static irqreturn_t j721e_pcie_link_irq_handler(int irq, void *priv) + u32 reg; + + reg = j721e_pcie_intd_readl(pcie, STATUS_REG_SYS_2); +- if (!(reg & LINK_DOWN)) ++ if (!(reg & pcie->linkdown_irq_regfield)) + return IRQ_NONE; + + dev_err(dev, "LINK DOWN!\n"); + +- j721e_pcie_intd_writel(pcie, STATUS_CLR_REG_SYS_2, LINK_DOWN); ++ j721e_pcie_intd_writel(pcie, STATUS_CLR_REG_SYS_2, pcie->linkdown_irq_regfield); + return IRQ_HANDLED; + } + +@@ -112,7 +117,7 @@ static void j721e_pcie_config_link_irq(struct j721e_pcie *pcie) + u32 reg; + + reg = j721e_pcie_intd_readl(pcie, ENABLE_REG_SYS_2); +- reg |= LINK_DOWN; ++ reg |= pcie->linkdown_irq_regfield; + j721e_pcie_intd_writel(pcie, ENABLE_REG_SYS_2, reg); + } + +@@ -284,10 +289,25 @@ static struct pci_ops cdns_ti_pcie_host_ops = { + static const struct j721e_pcie_data j721e_pcie_rc_data = { + .mode = PCI_MODE_RC, + .quirk_retrain_flag = true, ++ .byte_access_allowed = false, ++ .linkdown_irq_regfield = LINK_DOWN, + }; + + static const struct j721e_pcie_data j721e_pcie_ep_data = { + .mode = PCI_MODE_EP, ++ .linkdown_irq_regfield = LINK_DOWN, ++}; ++ ++static const struct j721e_pcie_data j7200_pcie_rc_data = { ++ .mode = PCI_MODE_RC, ++ .quirk_detect_quiet_flag = true, ++ .linkdown_irq_regfield = J7200_LINK_DOWN, ++ .byte_access_allowed = true, ++}; ++ ++static const struct j721e_pcie_data j7200_pcie_ep_data = { ++ .mode = PCI_MODE_EP, ++ .quirk_detect_quiet_flag = true, + }; + + static const struct of_device_id of_j721e_pcie_match[] = { +@@ -299,6 +319,14 @@ static const struct of_device_id of_j721e_pcie_match[] = { + .compatible = "ti,j721e-pcie-ep", + .data = &j721e_pcie_ep_data, + }, ++ { ++ .compatible = "ti,j7200-pcie-host", ++ .data = &j7200_pcie_rc_data, ++ }, ++ { ++ .compatible = "ti,j7200-pcie-ep", ++ .data = &j7200_pcie_ep_data, ++ }, + {}, + }; + +@@ -332,6 +360,7 @@ static int j721e_pcie_probe(struct platform_device *pdev) + + pcie->dev = dev; + pcie->mode = mode; ++ pcie->linkdown_irq_regfield = data->linkdown_irq_regfield; + + base = devm_platform_ioremap_resource_byname(pdev, "intd_cfg"); + if (IS_ERR(base)) +@@ -391,9 +420,11 @@ static int j721e_pcie_probe(struct platform_device *pdev) + goto err_get_sync; + } + +- bridge->ops = &cdns_ti_pcie_host_ops; ++ if (!data->byte_access_allowed) ++ bridge->ops = &cdns_ti_pcie_host_ops; + rc = pci_host_bridge_priv(bridge); + rc->quirk_retrain_flag = data->quirk_retrain_flag; ++ rc->quirk_detect_quiet_flag = data->quirk_detect_quiet_flag; + + cdns_pcie = &rc->pcie; + cdns_pcie->dev = dev; +@@ -459,6 +490,7 @@ static int j721e_pcie_probe(struct platform_device *pdev) + ret = -ENOMEM; + goto err_get_sync; + } ++ ep->quirk_detect_quiet_flag = data->quirk_detect_quiet_flag; + + cdns_pcie = &ep->pcie; + cdns_pcie->dev = dev; +-- +2.30.2 + diff --git a/queue-5.14/pci-of-don-t-fail-devm_pci_alloc_host_bridge-on-miss.patch b/queue-5.14/pci-of-don-t-fail-devm_pci_alloc_host_bridge-on-miss.patch new file mode 100644 index 00000000000..4bdec2c75d1 --- /dev/null +++ b/queue-5.14/pci-of-don-t-fail-devm_pci_alloc_host_bridge-on-miss.patch @@ -0,0 +1,61 @@ +From f67e0ef1ad9241d378b68aaa03b9f06c3b0ed3bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Aug 2021 15:56:55 -0600 +Subject: PCI: of: Don't fail devm_pci_alloc_host_bridge() on missing 'ranges' +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rob Herring + +[ Upstream commit d277f6e88c88729b1d57d40bbfb00d0bfc961972 ] + +Commit 669cbc708122 ("PCI: Move DT resource setup into +devm_pci_alloc_host_bridge()") made devm_pci_alloc_host_bridge() fail on +any DT resource parsing errors, but Broadcom iProc uses +devm_pci_alloc_host_bridge() on BCMA bus devices that don't have DT +resources. In particular, there is no 'ranges' property. Fix iProc by +making 'ranges' optional. + +If 'ranges' is required by a platform, there's going to be more errors +latter on if it is missing. + +Link: https://lore.kernel.org/r/20210803215656.3803204-1-robh@kernel.org +Fixes: 669cbc708122 ("PCI: Move DT resource setup into devm_pci_alloc_host_bridge()") +Reported-by: Rafał Miłecki +Tested-by: Rafał Miłecki +Signed-off-by: Rob Herring +Signed-off-by: Lorenzo Pieralisi +Acked-by: Bjorn Helgaas +Cc: Srinath Mannam +Cc: Roman Bacik +Cc: Bharat Gooty +Cc: Abhishek Shah +Cc: Jitendra Bhivare +Cc: Ray Jui +Cc: Florian Fainelli +Cc: BCM Kernel Feedback +Cc: Scott Branden +Cc: Bjorn Helgaas +Cc: Lorenzo Pieralisi +Signed-off-by: Sasha Levin +--- + drivers/pci/of.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/of.c b/drivers/pci/of.c +index a143b02b2dcd..d84381ce82b5 100644 +--- a/drivers/pci/of.c ++++ b/drivers/pci/of.c +@@ -310,7 +310,7 @@ static int devm_of_pci_get_host_bridge_resources(struct device *dev, + /* Check for ranges property */ + err = of_pci_range_parser_init(&parser, dev_node); + if (err) +- goto failed; ++ return 0; + + dev_dbg(dev, "Parsing ranges property...\n"); + for_each_of_pci_range(&parser, &range) { +-- +2.30.2 + diff --git a/queue-5.14/pci-ptm-remove-error-message-at-boot.patch b/queue-5.14/pci-ptm-remove-error-message-at-boot.patch new file mode 100644 index 00000000000..9d01d5918ff --- /dev/null +++ b/queue-5.14/pci-ptm-remove-error-message-at-boot.patch @@ -0,0 +1,46 @@ +From 78d67580b6628acdfbcd1e531cc9b47e0af0713a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Aug 2021 11:59:55 -0700 +Subject: PCI/PTM: Remove error message at boot + +From: Jakub Kicinski + +[ Upstream commit ff3a52ab9cab01a53b168dc667fe789f56b90aa9 ] + +Since 39850ed51062 ("PCI/PTM: Save/restore Precision Time Measurement +Capability for suspend/resume"), devices that have PTM capability but +don't enable it see this message on calls to pci_save_state(): + + no suspend buffer for PTM + +Drop the message, it's perfectly fine not to use a capability. + +Fixes: 39850ed51062 ("PCI/PTM: Save/restore Precision Time Measurement Capability for suspend/resume") +Link: https://lore.kernel.org/r/20210811185955.3112534-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Bjorn Helgaas +Acked-by: David E. Box +Signed-off-by: Sasha Levin +--- + drivers/pci/pcie/ptm.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/pci/pcie/ptm.c b/drivers/pci/pcie/ptm.c +index 95d4eef2c9e8..4810faa67f52 100644 +--- a/drivers/pci/pcie/ptm.c ++++ b/drivers/pci/pcie/ptm.c +@@ -60,10 +60,8 @@ void pci_save_ptm_state(struct pci_dev *dev) + return; + + save_state = pci_find_saved_ext_cap(dev, PCI_EXT_CAP_ID_PTM); +- if (!save_state) { +- pci_err(dev, "no suspend buffer for PTM\n"); ++ if (!save_state) + return; +- } + + cap = (u16 *)&save_state->cap.data[0]; + pci_read_config_word(dev, ptm + PCI_PTM_CTRL, cap); +-- +2.30.2 + diff --git a/queue-5.14/pci-rcar-fix-runtime-pm-imbalance-in-rcar_pcie_ep_pr.patch b/queue-5.14/pci-rcar-fix-runtime-pm-imbalance-in-rcar_pcie_ep_pr.patch new file mode 100644 index 00000000000..ef57fc2707f --- /dev/null +++ b/queue-5.14/pci-rcar-fix-runtime-pm-imbalance-in-rcar_pcie_ep_pr.patch @@ -0,0 +1,43 @@ +From f34a2f207b44822aff5f74045409b215df506d2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 15:24:02 +0800 +Subject: PCI: rcar: Fix runtime PM imbalance in rcar_pcie_ep_probe() + +From: Dinghao Liu + +[ Upstream commit 1e29cd9983eba1b596bc07f94d81d728007f8a25 ] + +pm_runtime_get_sync() will increase the runtime PM counter +even it returns an error. Thus a pairing decrement is needed +to prevent refcount leak. Fix this by replacing this API with +pm_runtime_resume_and_get(), which will not change the runtime +PM counter on error. + +Link: https://lore.kernel.org/r/20210408072402.15069-1-dinghao.liu@zju.edu.cn +Signed-off-by: Dinghao Liu +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pcie-rcar-ep.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/controller/pcie-rcar-ep.c b/drivers/pci/controller/pcie-rcar-ep.c +index b4a288e24aaf..c91d85b15129 100644 +--- a/drivers/pci/controller/pcie-rcar-ep.c ++++ b/drivers/pci/controller/pcie-rcar-ep.c +@@ -492,9 +492,9 @@ static int rcar_pcie_ep_probe(struct platform_device *pdev) + pcie->dev = dev; + + pm_runtime_enable(dev); +- err = pm_runtime_get_sync(dev); ++ err = pm_runtime_resume_and_get(dev); + if (err < 0) { +- dev_err(dev, "pm_runtime_get_sync failed\n"); ++ dev_err(dev, "pm_runtime_resume_and_get failed\n"); + goto err_pm_disable; + } + +-- +2.30.2 + diff --git a/queue-5.14/pci-sync-__pci_register_driver-stub-for-config_pci-n.patch b/queue-5.14/pci-sync-__pci_register_driver-stub-for-config_pci-n.patch new file mode 100644 index 00000000000..d16da8fb3eb --- /dev/null +++ b/queue-5.14/pci-sync-__pci_register_driver-stub-for-config_pci-n.patch @@ -0,0 +1,42 @@ +From 405b55925d658340b4e70fc66a241c4b8bdfd5e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 18:36:19 +0300 +Subject: PCI: Sync __pci_register_driver() stub for CONFIG_PCI=n + +From: Andy Shevchenko + +[ Upstream commit 817f9916a6e96ae43acdd4e75459ef4f92d96eb1 ] + +The CONFIG_PCI=y case got a new parameter long time ago. Sync the stub as +well. + +[bhelgaas: add parameter names] +Fixes: 725522b5453d ("PCI: add the sysfs driver name to all modules") +Link: https://lore.kernel.org/r/20210813153619.89574-1-andriy.shevchenko@linux.intel.com +Reported-by: kernel test robot +Signed-off-by: Andy Shevchenko +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + include/linux/pci.h | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/include/linux/pci.h b/include/linux/pci.h +index 540b377ca8f6..acbed2ecf6e8 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -1740,8 +1740,9 @@ static inline void pci_disable_device(struct pci_dev *dev) { } + static inline int pcim_enable_device(struct pci_dev *pdev) { return -EIO; } + static inline int pci_assign_resource(struct pci_dev *dev, int i) + { return -EBUSY; } +-static inline int __pci_register_driver(struct pci_driver *drv, +- struct module *owner) ++static inline int __must_check __pci_register_driver(struct pci_driver *drv, ++ struct module *owner, ++ const char *mod_name) + { return 0; } + static inline int pci_register_driver(struct pci_driver *drv) + { return 0; } +-- +2.30.2 + diff --git a/queue-5.14/pci-tegra-fix-of-node-reference-leak.patch b/queue-5.14/pci-tegra-fix-of-node-reference-leak.patch new file mode 100644 index 00000000000..3dedbaad688 --- /dev/null +++ b/queue-5.14/pci-tegra-fix-of-node-reference-leak.patch @@ -0,0 +1,63 @@ +From 5bbe4424f635e4624244ce267cea2344f7292f8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 May 2021 19:17:42 +0200 +Subject: PCI: tegra: Fix OF node reference leak + +From: Christophe JAILLET + +[ Upstream commit eff21f5da308265678e7e59821795e606f3e560f ] + +Commit 9e38e690ace3 ("PCI: tegra: Fix OF node reference leak") has fixed +some node reference leaks in this function but missed some of them. + +In fact, having 'port' referenced in the 'rp' structure is not enough to +prevent the leak, until 'rp' is actually added in the 'pcie->ports' list. + +Add the missing 'goto err_node_put' accordingly. + +Link: https://lore.kernel.org/r/55b11e9a7fa2987fbc0869d68ae59888954d65e2.1620148539.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Christophe JAILLET +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Vidya Sagar +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-tegra.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c +index c979229a6d0d..b358212d71ab 100644 +--- a/drivers/pci/controller/pci-tegra.c ++++ b/drivers/pci/controller/pci-tegra.c +@@ -2193,13 +2193,15 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie) + rp->np = port; + + rp->base = devm_pci_remap_cfg_resource(dev, &rp->regs); +- if (IS_ERR(rp->base)) +- return PTR_ERR(rp->base); ++ if (IS_ERR(rp->base)) { ++ err = PTR_ERR(rp->base); ++ goto err_node_put; ++ } + + label = devm_kasprintf(dev, GFP_KERNEL, "pex-reset-%u", index); + if (!label) { +- dev_err(dev, "failed to create reset GPIO label\n"); +- return -ENOMEM; ++ err = -ENOMEM; ++ goto err_node_put; + } + + /* +@@ -2217,7 +2219,8 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie) + } else { + dev_err(dev, "failed to get reset GPIO: %ld\n", + PTR_ERR(rp->reset_gpio)); +- return PTR_ERR(rp->reset_gpio); ++ err = PTR_ERR(rp->reset_gpio); ++ goto err_node_put; + } + } + +-- +2.30.2 + diff --git a/queue-5.14/pci-tegra194-fix-handling-bme_chged-event.patch b/queue-5.14/pci-tegra194-fix-handling-bme_chged-event.patch new file mode 100644 index 00000000000..a9a65fde4d4 --- /dev/null +++ b/queue-5.14/pci-tegra194-fix-handling-bme_chged-event.patch @@ -0,0 +1,86 @@ +From c66e9cb176b738b56e5a40c6ce534275b3577989 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 15:35:21 +0530 +Subject: PCI: tegra194: Fix handling BME_CHGED event + +From: Om Prakash Singh + +[ Upstream commit ceb1412c1c8ca5b28c4252bdb15f2f1f17b4a1b0 ] + +In tegra_pcie_ep_hard_irq(), APPL_INTR_STATUS_L0 is stored in val and again +APPL_INTR_STATUS_L1_0_0 is also stored in val. So when execution reaches +"if (val & APPL_INTR_STATUS_L0_PCI_CMD_EN_INT)", val is not correct. + +Link: https://lore.kernel.org/r/20210623100525.19944-2-omp@nvidia.com +Signed-off-by: Om Prakash Singh +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Bjorn Helgaas +Acked-by: Vidya Sagar +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-tegra194.c | 30 +++++++++++----------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c +index 3ec7b29d5dc7..fd14e2f45bba 100644 +--- a/drivers/pci/controller/dwc/pcie-tegra194.c ++++ b/drivers/pci/controller/dwc/pcie-tegra194.c +@@ -497,19 +497,19 @@ static irqreturn_t tegra_pcie_ep_hard_irq(int irq, void *arg) + struct tegra_pcie_dw *pcie = arg; + struct dw_pcie_ep *ep = &pcie->pci.ep; + int spurious = 1; +- u32 val, tmp; ++ u32 status_l0, status_l1, link_status; + +- val = appl_readl(pcie, APPL_INTR_STATUS_L0); +- if (val & APPL_INTR_STATUS_L0_LINK_STATE_INT) { +- val = appl_readl(pcie, APPL_INTR_STATUS_L1_0_0); +- appl_writel(pcie, val, APPL_INTR_STATUS_L1_0_0); ++ status_l0 = appl_readl(pcie, APPL_INTR_STATUS_L0); ++ if (status_l0 & APPL_INTR_STATUS_L0_LINK_STATE_INT) { ++ status_l1 = appl_readl(pcie, APPL_INTR_STATUS_L1_0_0); ++ appl_writel(pcie, status_l1, APPL_INTR_STATUS_L1_0_0); + +- if (val & APPL_INTR_STATUS_L1_0_0_HOT_RESET_DONE) ++ if (status_l1 & APPL_INTR_STATUS_L1_0_0_HOT_RESET_DONE) + pex_ep_event_hot_rst_done(pcie); + +- if (val & APPL_INTR_STATUS_L1_0_0_RDLH_LINK_UP_CHGED) { +- tmp = appl_readl(pcie, APPL_LINK_STATUS); +- if (tmp & APPL_LINK_STATUS_RDLH_LINK_UP) { ++ if (status_l1 & APPL_INTR_STATUS_L1_0_0_RDLH_LINK_UP_CHGED) { ++ link_status = appl_readl(pcie, APPL_LINK_STATUS); ++ if (link_status & APPL_LINK_STATUS_RDLH_LINK_UP) { + dev_dbg(pcie->dev, "Link is up with Host\n"); + dw_pcie_ep_linkup(ep); + } +@@ -518,11 +518,11 @@ static irqreturn_t tegra_pcie_ep_hard_irq(int irq, void *arg) + spurious = 0; + } + +- if (val & APPL_INTR_STATUS_L0_PCI_CMD_EN_INT) { +- val = appl_readl(pcie, APPL_INTR_STATUS_L1_15); +- appl_writel(pcie, val, APPL_INTR_STATUS_L1_15); ++ if (status_l0 & APPL_INTR_STATUS_L0_PCI_CMD_EN_INT) { ++ status_l1 = appl_readl(pcie, APPL_INTR_STATUS_L1_15); ++ appl_writel(pcie, status_l1, APPL_INTR_STATUS_L1_15); + +- if (val & APPL_INTR_STATUS_L1_15_CFG_BME_CHGED) ++ if (status_l1 & APPL_INTR_STATUS_L1_15_CFG_BME_CHGED) + return IRQ_WAKE_THREAD; + + spurious = 0; +@@ -530,8 +530,8 @@ static irqreturn_t tegra_pcie_ep_hard_irq(int irq, void *arg) + + if (spurious) { + dev_warn(pcie->dev, "Random interrupt (STATUS = 0x%08X)\n", +- val); +- appl_writel(pcie, val, APPL_INTR_STATUS_L0); ++ status_l0); ++ appl_writel(pcie, status_l0, APPL_INTR_STATUS_L0); + } + + return IRQ_HANDLED; +-- +2.30.2 + diff --git a/queue-5.14/pci-tegra194-fix-msi-x-programming.patch b/queue-5.14/pci-tegra194-fix-msi-x-programming.patch new file mode 100644 index 00000000000..e17a6b6c1e2 --- /dev/null +++ b/queue-5.14/pci-tegra194-fix-msi-x-programming.patch @@ -0,0 +1,39 @@ +From 9c501bdef1df9c9b4a062a435876c0ee6d42ca68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 15:35:22 +0530 +Subject: PCI: tegra194: Fix MSI-X programming + +From: Om Prakash Singh + +[ Upstream commit 43537cf7e351264a1f05ed42ad402942bfc9140e ] + +Lower order MSI-X address is programmed in MSIX_ADDR_MATCH_HIGH_OFF +DBI register instead of higher order address. This patch fixes this +programming mistake. + +Link: https://lore.kernel.org/r/20210623100525.19944-3-omp@nvidia.com +Signed-off-by: Om Prakash Singh +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Bjorn Helgaas +Acked-by: Vidya Sagar +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-tegra194.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c +index fd14e2f45bba..55c8afb9a899 100644 +--- a/drivers/pci/controller/dwc/pcie-tegra194.c ++++ b/drivers/pci/controller/dwc/pcie-tegra194.c +@@ -1763,7 +1763,7 @@ static void pex_ep_event_pex_rst_deassert(struct tegra_pcie_dw *pcie) + val = (ep->msi_mem_phys & MSIX_ADDR_MATCH_LOW_OFF_MASK); + val |= MSIX_ADDR_MATCH_LOW_OFF_EN; + dw_pcie_writel_dbi(pci, MSIX_ADDR_MATCH_LOW_OFF, val); +- val = (lower_32_bits(ep->msi_mem_phys) & MSIX_ADDR_MATCH_HIGH_OFF_MASK); ++ val = (upper_32_bits(ep->msi_mem_phys) & MSIX_ADDR_MATCH_HIGH_OFF_MASK); + dw_pcie_writel_dbi(pci, MSIX_ADDR_MATCH_HIGH_OFF, val); + + ret = dw_pcie_ep_init_complete(ep); +-- +2.30.2 + diff --git a/queue-5.14/perf-bench-inject-buildid-handle-writen-errors.patch b/queue-5.14/perf-bench-inject-buildid-handle-writen-errors.patch new file mode 100644 index 00000000000..59f0a01d40b --- /dev/null +++ b/queue-5.14/perf-bench-inject-buildid-handle-writen-errors.patch @@ -0,0 +1,161 @@ +From 42872a4f3575c55764f8553dc6d1719a564eb53c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Aug 2021 11:50:37 -0300 +Subject: perf bench inject-buildid: Handle writen() errors + +From: Arnaldo Carvalho de Melo + +[ Upstream commit edf7b4a2d85e37a1ee77156bddaed4aa6af9c5e1 ] + +The build on fedora:35 and fedora:rawhide with clang is failing with: + + 49 41.00 fedora:35 : FAIL clang version 13.0.0 (Fedora 13.0.0~rc1-1.fc35) + bench/inject-buildid.c:351:6: error: variable 'len' set but not used [-Werror,-Wunused-but-set-variable] + u64 len = 0; + ^ + 1 error generated. + make[3]: *** [/git/perf-5.14.0-rc7/tools/build/Makefile.build:139: bench] Error 2 + 50 41.11 fedora:rawhide : FAIL clang version 13.0.0 (Fedora 13.0.0~rc1-1.fc35) + bench/inject-buildid.c:351:6: error: variable 'len' set but not used [-Werror,-Wunused-but-set-variable] + u64 len = 0; + ^ + 1 error generated. + make[3]: *** [/git/perf-5.14.0-rc7/tools/build/Makefile.build:139: bench] Error 2 + +That 'len' variable is not used at all, so just make sure all the +synthesize_RECORD() routines return ssize_t to propagate the writen() +return, as it may fail, ditch the 'ret' var and bail out if those +routines fail. + +Fixes: 0bf02a0d80427f26 ("perf bench: Add build-id injection benchmark") +Acked-by: Namhyung Kim +Link: http://lore.kernel.org/lkml/CAM9d7cgEZNSor+B+7Y2C+QYGme_v5aH0Zn0RLfxoQ+Fy83EHrg@mail.gmail.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/bench/inject-buildid.c | 52 ++++++++++++++++++------------- + 1 file changed, 30 insertions(+), 22 deletions(-) + +diff --git a/tools/perf/bench/inject-buildid.c b/tools/perf/bench/inject-buildid.c +index 55d373b75791..17672790f123 100644 +--- a/tools/perf/bench/inject-buildid.c ++++ b/tools/perf/bench/inject-buildid.c +@@ -133,7 +133,7 @@ static u64 dso_map_addr(struct bench_dso *dso) + return 0x400000ULL + dso->ino * 8192ULL; + } + +-static u32 synthesize_attr(struct bench_data *data) ++static ssize_t synthesize_attr(struct bench_data *data) + { + union perf_event event; + +@@ -151,7 +151,7 @@ static u32 synthesize_attr(struct bench_data *data) + return writen(data->input_pipe[1], &event, event.header.size); + } + +-static u32 synthesize_fork(struct bench_data *data) ++static ssize_t synthesize_fork(struct bench_data *data) + { + union perf_event event; + +@@ -169,8 +169,7 @@ static u32 synthesize_fork(struct bench_data *data) + return writen(data->input_pipe[1], &event, event.header.size); + } + +-static u32 synthesize_mmap(struct bench_data *data, struct bench_dso *dso, +- u64 timestamp) ++static ssize_t synthesize_mmap(struct bench_data *data, struct bench_dso *dso, u64 timestamp) + { + union perf_event event; + size_t len = offsetof(struct perf_record_mmap2, filename); +@@ -198,23 +197,25 @@ static u32 synthesize_mmap(struct bench_data *data, struct bench_dso *dso, + + if (len > sizeof(event.mmap2)) { + /* write mmap2 event first */ +- writen(data->input_pipe[1], &event, len - bench_id_hdr_size); ++ if (writen(data->input_pipe[1], &event, len - bench_id_hdr_size) < 0) ++ return -1; + /* zero-fill sample id header */ + memset(id_hdr_ptr, 0, bench_id_hdr_size); + /* put timestamp in the right position */ + ts_idx = (bench_id_hdr_size / sizeof(u64)) - 2; + id_hdr_ptr[ts_idx] = timestamp; +- writen(data->input_pipe[1], id_hdr_ptr, bench_id_hdr_size); +- } else { +- ts_idx = (len / sizeof(u64)) - 2; +- id_hdr_ptr[ts_idx] = timestamp; +- writen(data->input_pipe[1], &event, len); ++ if (writen(data->input_pipe[1], id_hdr_ptr, bench_id_hdr_size) < 0) ++ return -1; ++ ++ return len; + } +- return len; ++ ++ ts_idx = (len / sizeof(u64)) - 2; ++ id_hdr_ptr[ts_idx] = timestamp; ++ return writen(data->input_pipe[1], &event, len); + } + +-static u32 synthesize_sample(struct bench_data *data, struct bench_dso *dso, +- u64 timestamp) ++static ssize_t synthesize_sample(struct bench_data *data, struct bench_dso *dso, u64 timestamp) + { + union perf_event event; + struct perf_sample sample = { +@@ -233,7 +234,7 @@ static u32 synthesize_sample(struct bench_data *data, struct bench_dso *dso, + return writen(data->input_pipe[1], &event, event.header.size); + } + +-static u32 synthesize_flush(struct bench_data *data) ++static ssize_t synthesize_flush(struct bench_data *data) + { + struct perf_event_header header = { + .size = sizeof(header), +@@ -348,14 +349,16 @@ static int inject_build_id(struct bench_data *data, u64 *max_rss) + int status; + unsigned int i, k; + struct rusage rusage; +- u64 len = 0; + + /* this makes the child to run */ + if (perf_header__write_pipe(data->input_pipe[1]) < 0) + return -1; + +- len += synthesize_attr(data); +- len += synthesize_fork(data); ++ if (synthesize_attr(data) < 0) ++ return -1; ++ ++ if (synthesize_fork(data) < 0) ++ return -1; + + for (i = 0; i < nr_mmaps; i++) { + int idx = rand() % (nr_dsos - 1); +@@ -363,13 +366,18 @@ static int inject_build_id(struct bench_data *data, u64 *max_rss) + u64 timestamp = rand() % 1000000; + + pr_debug2(" [%d] injecting: %s\n", i+1, dso->name); +- len += synthesize_mmap(data, dso, timestamp); ++ if (synthesize_mmap(data, dso, timestamp) < 0) ++ return -1; + +- for (k = 0; k < nr_samples; k++) +- len += synthesize_sample(data, dso, timestamp + k * 1000); ++ for (k = 0; k < nr_samples; k++) { ++ if (synthesize_sample(data, dso, timestamp + k * 1000) < 0) ++ return -1; ++ } + +- if ((i + 1) % 10 == 0) +- len += synthesize_flush(data); ++ if ((i + 1) % 10 == 0) { ++ if (synthesize_flush(data) < 0) ++ return -1; ++ } + } + + /* this makes the child to finish */ +-- +2.30.2 + diff --git a/queue-5.14/perf-config-fix-caching-and-memory-leak-in-perf_home.patch b/queue-5.14/perf-config-fix-caching-and-memory-leak-in-perf_home.patch new file mode 100644 index 00000000000..c9aa15fe635 --- /dev/null +++ b/queue-5.14/perf-config-fix-caching-and-memory-leak-in-perf_home.patch @@ -0,0 +1,58 @@ +From 06afb2bbec60d8cbddeb014526b0e866b09da85a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Aug 2021 11:13:36 -0300 +Subject: perf config: Fix caching and memory leak in perf_home_perfconfig() + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 261f491133aecb943ccfdc3b3794e2d775607a87 ] + +Acaict, perf_home_perfconfig() is supposed to cache the result of +home_perfconfig, which returns the default location of perfconfig for +the user, given the HOME environment variable. + +However, the current implementation calls home_perfconfig every time +perf_home_perfconfig() is called (so no caching is actually performed), +replacing the previous pointer, thus also causing a memory leak. + +This patch adds a check of whether either config or failed is set and, +in that case, directly returns config without calling home_perfconfig at +each invocation. + +Fixes: f5f03e19ce14fc31 ("perf config: Add perf_home_perfconfig function") +Signed-off-by: Riccardo Mancini +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Jin Yao +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Song Liu +Link: http://lore.kernel.org/lkml/20210820130817.740536-1-rickyman7@gmail.com +[ Removed needless double check for the 'failed' variable ] +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/config.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/config.c b/tools/perf/util/config.c +index 63d472b336de..4fb5e90d7a57 100644 +--- a/tools/perf/util/config.c ++++ b/tools/perf/util/config.c +@@ -581,7 +581,10 @@ const char *perf_home_perfconfig(void) + static const char *config; + static bool failed; + +- config = failed ? NULL : home_perfconfig(); ++ if (failed || config) ++ return config; ++ ++ config = home_perfconfig(); + if (!config) + failed = true; + +-- +2.30.2 + diff --git a/queue-5.14/perf-unwind-do-not-overwrite-feature_check_ldflags-l.patch b/queue-5.14/perf-unwind-do-not-overwrite-feature_check_ldflags-l.patch new file mode 100644 index 00000000000..7631d34c209 --- /dev/null +++ b/queue-5.14/perf-unwind-do-not-overwrite-feature_check_ldflags-l.patch @@ -0,0 +1,138 @@ +From f4c1e228f7dc6de00297ee9d09a9bb090a6b20bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Aug 2021 21:43:40 +0800 +Subject: perf unwind: Do not overwrite + FEATURE_CHECK_LDFLAGS-libunwind-{x86,aarch64} + +From: Li Huafei + +[ Upstream commit cdf32b44678c382a31dc183d9a767306915cda7b ] + +When setting LIBUNWIND_DIR, we first set + + FEATURE_CHECK_LDFLAGS-libunwind-{aarch64,x86} = -L$(LIBUNWIND_DIR)/lib. + + +This happens a bit before, the overwritting, in: + + libunwind_arch_set_flags = $(eval $(libunwind_arch_set_flags_code)) + define libunwind_arch_set_flags_code + FEATURE_CHECK_CFLAGS-libunwind-$(1) = -I$(LIBUNWIND_DIR)/include + FEATURE_CHECK_LDFLAGS-libunwind-$(1) = -L$(LIBUNWIND_DIR)/lib + endef + + ifdef LIBUNWIND_DIR + LIBUNWIND_CFLAGS = -I$(LIBUNWIND_DIR)/include + LIBUNWIND_LDFLAGS = -L$(LIBUNWIND_DIR)/lib + LIBUNWIND_ARCHS = x86 x86_64 arm aarch64 debug-frame-arm debug-frame-aarch64 + $(foreach libunwind_arch,$(LIBUNWIND_ARCHS),$(call libunwind_arch_set_flags,$(libunwind_arch))) + endif + +Look at that 'foreach' on all the LIBUNWIND_ARCHS. + + +After commit 5c4d7c82c0dc ("perf unwind: Do not put libunwind-{x86,aarch64} +in FEATURE_TESTS_BASIC"), FEATURE_CHECK_LDFLAGS-libunwind-{x86,aarch64} is +overwritten. As a result, the remote libunwind libraries cannot be searched +from $(LIBUNWIND_DIR)/lib directory during feature check tests. Fix it with +variable appending. + +Before this patch: + + perf$ make VF=1 LIBUNWIND_DIR=/opt/libunwind_aarch64 + BUILD: Doing 'make -j16' parallel build + + ... + ... libopencsd: [ OFF ] + ... libunwind-x86: [ OFF ] + ... libunwind-x86_64: [ OFF ] + ... libunwind-arm: [ OFF ] + ... libunwind-aarch64: [ OFF ] + ... libunwind-debug-frame: [ OFF ] + ... libunwind-debug-frame-arm: [ OFF ] + ... libunwind-debug-frame-aarch64: [ OFF ] + ... cxx: [ OFF ] + + + perf$ cat ../build/feature/test-libunwind-aarch64.make.output + /usr/bin/ld: cannot find -lunwind-aarch64 + /usr/bin/ld: cannot find -lunwind-aarch64 + collect2: error: ld returned 1 exit status + +After this patch: + + perf$ make VF=1 LIBUNWIND_DIR=/opt/libunwind_aarch64 + BUILD: Doing 'make -j16' parallel build + + ... libopencsd: [ OFF ] + ... libunwind-x86: [ OFF ] + ... libunwind-x86_64: [ OFF ] + ... libunwind-arm: [ OFF ] + ... libunwind-aarch64: [ on ] + ... libunwind-debug-frame: [ OFF ] + ... libunwind-debug-frame-arm: [ OFF ] + ... libunwind-debug-frame-aarch64: [ OFF ] + ... cxx: [ OFF ] + + + perf$ cat ../build/feature/test-libunwind-aarch64.make.output + + perf$ ldd ./perf + linux-vdso.so.1 (0x00007ffdf07da000) + libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f30953dc000) + librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007f30951d4000) + libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f3094e36000) + libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f3094c32000) + libelf.so.1 => /usr/lib/x86_64-linux-gnu/libelf.so.1 (0x00007f3094a18000) + libdw.so.1 => /usr/lib/x86_64-linux-gnu/libdw.so.1 (0x00007f30947cc000) + libunwind-x86_64.so.8 => /usr/lib/x86_64-linux-gnu/libunwind-x86_64.so.8 (0x00007f30945ad000) + libunwind.so.8 => /usr/lib/x86_64-linux-gnu/libunwind.so.8 (0x00007f3094392000) + liblzma.so.5 => /lib/x86_64-linux-gnu/liblzma.so.5 (0x00007f309416c000) + libunwind-aarch64.so.8 => not found + libslang.so.2 => /lib/x86_64-linux-gnu/libslang.so.2 (0x00007f3093c8a000) + libpython2.7.so.1.0 => /usr/local/lib/libpython2.7.so.1.0 (0x00007f309386b000) + libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007f309364e000) + libnuma.so.1 => /usr/lib/x86_64-linux-gnu/libnuma.so.1 (0x00007f3093443000) + libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f3093052000) + /lib64/ld-linux-x86-64.so.2 (0x00007f3096097000) + libbz2.so.1.0 => /lib/x86_64-linux-gnu/libbz2.so.1.0 (0x00007f3092e42000) + libutil.so.1 => /lib/x86_64-linux-gnu/libutil.so.1 (0x00007f3092c3f000) + +Fixes: 5c4d7c82c0dceccf ("perf unwind: Do not put libunwind-{x86,aarch64} in FEATURE_TESTS_BASIC") +Signed-off-by: Li Huafei +Cc: Alexander Shishkin +Cc: He Kuang +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Zhang Jinhao +Link: http://lore.kernel.org/lkml/20210823134340.60955-1-lihuafei1@huawei.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/Makefile.config | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config +index eb8e487ef90b..29ffd57f5cd8 100644 +--- a/tools/perf/Makefile.config ++++ b/tools/perf/Makefile.config +@@ -133,10 +133,10 @@ FEATURE_CHECK_LDFLAGS-libunwind = $(LIBUNWIND_LDFLAGS) $(LIBUNWIND_LIBS) + FEATURE_CHECK_CFLAGS-libunwind-debug-frame = $(LIBUNWIND_CFLAGS) + FEATURE_CHECK_LDFLAGS-libunwind-debug-frame = $(LIBUNWIND_LDFLAGS) $(LIBUNWIND_LIBS) + +-FEATURE_CHECK_LDFLAGS-libunwind-arm = -lunwind -lunwind-arm +-FEATURE_CHECK_LDFLAGS-libunwind-aarch64 = -lunwind -lunwind-aarch64 +-FEATURE_CHECK_LDFLAGS-libunwind-x86 = -lunwind -llzma -lunwind-x86 +-FEATURE_CHECK_LDFLAGS-libunwind-x86_64 = -lunwind -llzma -lunwind-x86_64 ++FEATURE_CHECK_LDFLAGS-libunwind-arm += -lunwind -lunwind-arm ++FEATURE_CHECK_LDFLAGS-libunwind-aarch64 += -lunwind -lunwind-aarch64 ++FEATURE_CHECK_LDFLAGS-libunwind-x86 += -lunwind -llzma -lunwind-x86 ++FEATURE_CHECK_LDFLAGS-libunwind-x86_64 += -lunwind -llzma -lunwind-x86_64 + + FEATURE_CHECK_LDFLAGS-libcrypto = -lcrypto + +-- +2.30.2 + diff --git a/queue-5.14/qlcnic-remove-redundant-unlock-in-qlcnic_pinit_from_.patch b/queue-5.14/qlcnic-remove-redundant-unlock-in-qlcnic_pinit_from_.patch new file mode 100644 index 00000000000..d54b19dc46b --- /dev/null +++ b/queue-5.14/qlcnic-remove-redundant-unlock-in-qlcnic_pinit_from_.patch @@ -0,0 +1,38 @@ +From fe09ebc1fdf771d471b70ccf0a5cdf6b4df6c0d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Sep 2021 15:35:43 +0800 +Subject: qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom + +From: Dinghao Liu + +[ Upstream commit 9ddbc2a00d7f63fa9748f4278643193dac985f2d ] + +Previous commit 68233c583ab4 removes the qlcnic_rom_lock() +in qlcnic_pinit_from_rom(), but remains its corresponding +unlock function, which is odd. I'm not very sure whether the +lock is missing, or the unlock is redundant. This bug is +suggested by a static analysis tool, please advise. + +Fixes: 68233c583ab4 ("qlcnic: updated reset sequence") +Signed-off-by: Dinghao Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c +index e6784023bce4..aa7ee43f9252 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c +@@ -439,7 +439,6 @@ int qlcnic_pinit_from_rom(struct qlcnic_adapter *adapter) + QLCWR32(adapter, QLCNIC_CRB_PEG_NET_4 + 0x3c, 1); + msleep(20); + +- qlcnic_rom_unlock(adapter); + /* big hammer don't reset CAM block on reset */ + QLCWR32(adapter, QLCNIC_ROMUSB_GLB_SW_RESET, 0xfeffffff); + +-- +2.30.2 + diff --git a/queue-5.14/remoteproc-qcom-wcnss-fix-race-with-iris-probe.patch b/queue-5.14/remoteproc-qcom-wcnss-fix-race-with-iris-probe.patch new file mode 100644 index 00000000000..160209c183b --- /dev/null +++ b/queue-5.14/remoteproc-qcom-wcnss-fix-race-with-iris-probe.patch @@ -0,0 +1,319 @@ +From 25135d12e50b4ced5a5b1b39fcd5c233ad3c075e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Mar 2021 16:22:51 -0800 +Subject: remoteproc: qcom: wcnss: Fix race with iris probe + +From: Bjorn Andersson + +[ Upstream commit 1fcef985c8bdd542c43da0d87bd9d51980c3859b ] + +The remoteproc driver is split between the responsibilities of getting +the SoC-internal ARM core up and running and the external RF (aka +"Iris") part configured. + +In order to satisfy the regulator framework's need of a struct device * +to look up supplies this was implemented as two different drivers, using +of_platform_populate() in the remoteproc part to probe the iris part. + +Unfortunately it's possible that the iris part probe defers on yet not +available regulators and an attempt to start the remoteproc will have to +be rejected, until this has been resolved. But there's no useful +mechanism of knowing when this would be. + +Instead replace the of_platform_populate() and the iris probe with a +function that rolls its own struct device, with the relevant of_node +associated that is enough to acquire regulators and clocks specified in +the DT node and that may propagate the EPROBE_DEFER back to the wcnss +device's probe. + +Acked-by: Mathieu Poirier +Reported-by: Anibal Limon +Reported-by: Loic Poulain +Tested-by: Anibal Limon +Link: https://lore.kernel.org/r/20210312002251.3273013-1-bjorn.andersson@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_wcnss.c | 49 +++-------- + drivers/remoteproc/qcom_wcnss.h | 4 +- + drivers/remoteproc/qcom_wcnss_iris.c | 120 +++++++++++++++++---------- + 3 files changed, 89 insertions(+), 84 deletions(-) + +diff --git a/drivers/remoteproc/qcom_wcnss.c b/drivers/remoteproc/qcom_wcnss.c +index f1cbc6b2edbb..ebadc6c08e11 100644 +--- a/drivers/remoteproc/qcom_wcnss.c ++++ b/drivers/remoteproc/qcom_wcnss.c +@@ -142,18 +142,6 @@ static const struct wcnss_data pronto_v2_data = { + .num_vregs = 1, + }; + +-void qcom_wcnss_assign_iris(struct qcom_wcnss *wcnss, +- struct qcom_iris *iris, +- bool use_48mhz_xo) +-{ +- mutex_lock(&wcnss->iris_lock); +- +- wcnss->iris = iris; +- wcnss->use_48mhz_xo = use_48mhz_xo; +- +- mutex_unlock(&wcnss->iris_lock); +-} +- + static int wcnss_load(struct rproc *rproc, const struct firmware *fw) + { + struct qcom_wcnss *wcnss = (struct qcom_wcnss *)rproc->priv; +@@ -639,12 +627,20 @@ static int wcnss_probe(struct platform_device *pdev) + goto detach_pds; + } + ++ wcnss->iris = qcom_iris_probe(&pdev->dev, &wcnss->use_48mhz_xo); ++ if (IS_ERR(wcnss->iris)) { ++ ret = PTR_ERR(wcnss->iris); ++ goto detach_pds; ++ } ++ + ret = rproc_add(rproc); + if (ret) +- goto detach_pds; ++ goto remove_iris; + +- return of_platform_populate(pdev->dev.of_node, NULL, NULL, &pdev->dev); ++ return 0; + ++remove_iris: ++ qcom_iris_remove(wcnss->iris); + detach_pds: + wcnss_release_pds(wcnss); + free_rproc: +@@ -657,7 +653,7 @@ static int wcnss_remove(struct platform_device *pdev) + { + struct qcom_wcnss *wcnss = platform_get_drvdata(pdev); + +- of_platform_depopulate(&pdev->dev); ++ qcom_iris_remove(wcnss->iris); + + rproc_del(wcnss->rproc); + +@@ -686,28 +682,7 @@ static struct platform_driver wcnss_driver = { + }, + }; + +-static int __init wcnss_init(void) +-{ +- int ret; +- +- ret = platform_driver_register(&wcnss_driver); +- if (ret) +- return ret; +- +- ret = platform_driver_register(&qcom_iris_driver); +- if (ret) +- platform_driver_unregister(&wcnss_driver); +- +- return ret; +-} +-module_init(wcnss_init); +- +-static void __exit wcnss_exit(void) +-{ +- platform_driver_unregister(&qcom_iris_driver); +- platform_driver_unregister(&wcnss_driver); +-} +-module_exit(wcnss_exit); ++module_platform_driver(wcnss_driver); + + MODULE_DESCRIPTION("Qualcomm Peripheral Image Loader for Wireless Subsystem"); + MODULE_LICENSE("GPL v2"); +diff --git a/drivers/remoteproc/qcom_wcnss.h b/drivers/remoteproc/qcom_wcnss.h +index 62c8682d0a92..6d01ee6afa7f 100644 +--- a/drivers/remoteproc/qcom_wcnss.h ++++ b/drivers/remoteproc/qcom_wcnss.h +@@ -17,9 +17,9 @@ struct wcnss_vreg_info { + bool super_turbo; + }; + ++struct qcom_iris *qcom_iris_probe(struct device *parent, bool *use_48mhz_xo); ++void qcom_iris_remove(struct qcom_iris *iris); + int qcom_iris_enable(struct qcom_iris *iris); + void qcom_iris_disable(struct qcom_iris *iris); + +-void qcom_wcnss_assign_iris(struct qcom_wcnss *wcnss, struct qcom_iris *iris, bool use_48mhz_xo); +- + #endif +diff --git a/drivers/remoteproc/qcom_wcnss_iris.c b/drivers/remoteproc/qcom_wcnss_iris.c +index 169acd305ae3..09720ddddc85 100644 +--- a/drivers/remoteproc/qcom_wcnss_iris.c ++++ b/drivers/remoteproc/qcom_wcnss_iris.c +@@ -17,7 +17,7 @@ + #include "qcom_wcnss.h" + + struct qcom_iris { +- struct device *dev; ++ struct device dev; + + struct clk *xo_clk; + +@@ -75,7 +75,7 @@ int qcom_iris_enable(struct qcom_iris *iris) + + ret = clk_prepare_enable(iris->xo_clk); + if (ret) { +- dev_err(iris->dev, "failed to enable xo clk\n"); ++ dev_err(&iris->dev, "failed to enable xo clk\n"); + goto disable_regulators; + } + +@@ -93,43 +93,90 @@ void qcom_iris_disable(struct qcom_iris *iris) + regulator_bulk_disable(iris->num_vregs, iris->vregs); + } + +-static int qcom_iris_probe(struct platform_device *pdev) ++static const struct of_device_id iris_of_match[] = { ++ { .compatible = "qcom,wcn3620", .data = &wcn3620_data }, ++ { .compatible = "qcom,wcn3660", .data = &wcn3660_data }, ++ { .compatible = "qcom,wcn3660b", .data = &wcn3680_data }, ++ { .compatible = "qcom,wcn3680", .data = &wcn3680_data }, ++ {} ++}; ++ ++static void qcom_iris_release(struct device *dev) ++{ ++ struct qcom_iris *iris = container_of(dev, struct qcom_iris, dev); ++ ++ of_node_put(iris->dev.of_node); ++ kfree(iris); ++} ++ ++struct qcom_iris *qcom_iris_probe(struct device *parent, bool *use_48mhz_xo) + { ++ const struct of_device_id *match; + const struct iris_data *data; +- struct qcom_wcnss *wcnss; ++ struct device_node *of_node; + struct qcom_iris *iris; + int ret; + int i; + +- iris = devm_kzalloc(&pdev->dev, sizeof(struct qcom_iris), GFP_KERNEL); +- if (!iris) +- return -ENOMEM; ++ of_node = of_get_child_by_name(parent->of_node, "iris"); ++ if (!of_node) { ++ dev_err(parent, "No child node \"iris\" found\n"); ++ return ERR_PTR(-EINVAL); ++ } ++ ++ iris = kzalloc(sizeof(*iris), GFP_KERNEL); ++ if (!iris) { ++ of_node_put(of_node); ++ return ERR_PTR(-ENOMEM); ++ } ++ ++ device_initialize(&iris->dev); ++ iris->dev.parent = parent; ++ iris->dev.release = qcom_iris_release; ++ iris->dev.of_node = of_node; ++ ++ dev_set_name(&iris->dev, "%s.iris", dev_name(parent)); ++ ++ ret = device_add(&iris->dev); ++ if (ret) { ++ put_device(&iris->dev); ++ return ERR_PTR(ret); ++ } ++ ++ match = of_match_device(iris_of_match, &iris->dev); ++ if (!match) { ++ dev_err(&iris->dev, "no matching compatible for iris\n"); ++ ret = -EINVAL; ++ goto err_device_del; ++ } + +- data = of_device_get_match_data(&pdev->dev); +- wcnss = dev_get_drvdata(pdev->dev.parent); ++ data = match->data; + +- iris->xo_clk = devm_clk_get(&pdev->dev, "xo"); ++ iris->xo_clk = devm_clk_get(&iris->dev, "xo"); + if (IS_ERR(iris->xo_clk)) { +- if (PTR_ERR(iris->xo_clk) != -EPROBE_DEFER) +- dev_err(&pdev->dev, "failed to acquire xo clk\n"); +- return PTR_ERR(iris->xo_clk); ++ ret = PTR_ERR(iris->xo_clk); ++ if (ret != -EPROBE_DEFER) ++ dev_err(&iris->dev, "failed to acquire xo clk\n"); ++ goto err_device_del; + } + + iris->num_vregs = data->num_vregs; +- iris->vregs = devm_kcalloc(&pdev->dev, ++ iris->vregs = devm_kcalloc(&iris->dev, + iris->num_vregs, + sizeof(struct regulator_bulk_data), + GFP_KERNEL); +- if (!iris->vregs) +- return -ENOMEM; ++ if (!iris->vregs) { ++ ret = -ENOMEM; ++ goto err_device_del; ++ } + + for (i = 0; i < iris->num_vregs; i++) + iris->vregs[i].supply = data->vregs[i].name; + +- ret = devm_regulator_bulk_get(&pdev->dev, iris->num_vregs, iris->vregs); ++ ret = devm_regulator_bulk_get(&iris->dev, iris->num_vregs, iris->vregs); + if (ret) { +- dev_err(&pdev->dev, "failed to get regulators\n"); +- return ret; ++ dev_err(&iris->dev, "failed to get regulators\n"); ++ goto err_device_del; + } + + for (i = 0; i < iris->num_vregs; i++) { +@@ -143,34 +190,17 @@ static int qcom_iris_probe(struct platform_device *pdev) + data->vregs[i].load_uA); + } + +- qcom_wcnss_assign_iris(wcnss, iris, data->use_48mhz_xo); +- +- return 0; +-} ++ *use_48mhz_xo = data->use_48mhz_xo; + +-static int qcom_iris_remove(struct platform_device *pdev) +-{ +- struct qcom_wcnss *wcnss = dev_get_drvdata(pdev->dev.parent); ++ return iris; + +- qcom_wcnss_assign_iris(wcnss, NULL, false); ++err_device_del: ++ device_del(&iris->dev); + +- return 0; ++ return ERR_PTR(ret); + } + +-static const struct of_device_id iris_of_match[] = { +- { .compatible = "qcom,wcn3620", .data = &wcn3620_data }, +- { .compatible = "qcom,wcn3660", .data = &wcn3660_data }, +- { .compatible = "qcom,wcn3660b", .data = &wcn3680_data }, +- { .compatible = "qcom,wcn3680", .data = &wcn3680_data }, +- {} +-}; +-MODULE_DEVICE_TABLE(of, iris_of_match); +- +-struct platform_driver qcom_iris_driver = { +- .probe = qcom_iris_probe, +- .remove = qcom_iris_remove, +- .driver = { +- .name = "qcom-iris", +- .of_match_table = iris_of_match, +- }, +-}; ++void qcom_iris_remove(struct qcom_iris *iris) ++{ ++ device_del(&iris->dev); ++} +-- +2.30.2 + diff --git a/queue-5.14/riscv-fix-the-global-name-pfn_base-confliction-error.patch b/queue-5.14/riscv-fix-the-global-name-pfn_base-confliction-error.patch new file mode 100644 index 00000000000..345b3d510ad --- /dev/null +++ b/queue-5.14/riscv-fix-the-global-name-pfn_base-confliction-error.patch @@ -0,0 +1,68 @@ +From 11cc79eb82df2dd0b81caad899fb804487b3dd9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jul 2021 15:15:57 +0800 +Subject: riscv: fix the global name pfn_base confliction error + +From: Kenneth Lee + +[ Upstream commit fb31f0a499332a053477ed57312b214e42476e6d ] + +RISCV uses a global variable pfn_base for page/pfn translation. But this +is a common name and will be used elsewhere. In those cases, the +page-pfn macros which refer to this name will be referred to the +local/input variable instead. (such as in vfio_pin_pages_remote). This +make everything wrong. + +This patch changes the name from pfn_base to riscv_pfn_base to fix +this problem. + +Signed-off-by: Kenneth Lee +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/page.h | 4 ++-- + arch/riscv/mm/init.c | 6 +++--- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/riscv/include/asm/page.h b/arch/riscv/include/asm/page.h +index b0ca5058e7ae..767852ae5e84 100644 +--- a/arch/riscv/include/asm/page.h ++++ b/arch/riscv/include/asm/page.h +@@ -79,8 +79,8 @@ typedef struct page *pgtable_t; + #endif + + #ifdef CONFIG_MMU +-extern unsigned long pfn_base; +-#define ARCH_PFN_OFFSET (pfn_base) ++extern unsigned long riscv_pfn_base; ++#define ARCH_PFN_OFFSET (riscv_pfn_base) + #else + #define ARCH_PFN_OFFSET (PAGE_OFFSET >> PAGE_SHIFT) + #endif /* CONFIG_MMU */ +diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c +index 7cb4f391d106..9786100f3a14 100644 +--- a/arch/riscv/mm/init.c ++++ b/arch/riscv/mm/init.c +@@ -234,8 +234,8 @@ static struct pt_alloc_ops _pt_ops __initdata; + #define pt_ops _pt_ops + #endif + +-unsigned long pfn_base __ro_after_init; +-EXPORT_SYMBOL(pfn_base); ++unsigned long riscv_pfn_base __ro_after_init; ++EXPORT_SYMBOL(riscv_pfn_base); + + pgd_t swapper_pg_dir[PTRS_PER_PGD] __page_aligned_bss; + pgd_t trampoline_pg_dir[PTRS_PER_PGD] __page_aligned_bss; +@@ -579,7 +579,7 @@ asmlinkage void __init setup_vm(uintptr_t dtb_pa) + kernel_map.va_kernel_pa_offset = kernel_map.virt_addr - kernel_map.phys_addr; + #endif + +- pfn_base = PFN_DOWN(kernel_map.phys_addr); ++ riscv_pfn_base = PFN_DOWN(kernel_map.phys_addr); + + /* + * Enforce boot alignment requirements of RV32 and +-- +2.30.2 + diff --git a/queue-5.14/selftests-mptcp-clean-tmp-files-in-simult_flows.patch b/queue-5.14/selftests-mptcp-clean-tmp-files-in-simult_flows.patch new file mode 100644 index 00000000000..374cac6531e --- /dev/null +++ b/queue-5.14/selftests-mptcp-clean-tmp-files-in-simult_flows.patch @@ -0,0 +1,49 @@ +From 4d532ca7fe59ef04d63ce9e222141388689fd816 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Sep 2021 10:15:37 -0700 +Subject: selftests: mptcp: clean tmp files in simult_flows + +From: Matthieu Baerts + +[ Upstream commit bfd862a7e9318dd906844807a713d27cdd1a72b1 ] + +'$cin' and '$sin' variables are local to a function: they are then not +available from the cleanup trap. + +Instead, we need to use '$large' and '$small' that are not local and +defined just before setting the trap. + +Without this patch, running this script in a loop might cause a: + + write: No space left on device + +issue. + +Fixes: 1a418cb8e888 ("mptcp: simult flow self-tests") +Acked-by: Paolo Abeni +Signed-off-by: Matthieu Baerts +Signed-off-by: Mat Martineau +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/mptcp/simult_flows.sh | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/net/mptcp/simult_flows.sh b/tools/testing/selftests/net/mptcp/simult_flows.sh +index fd63ebfe9a2b..910d8126af8f 100755 +--- a/tools/testing/selftests/net/mptcp/simult_flows.sh ++++ b/tools/testing/selftests/net/mptcp/simult_flows.sh +@@ -22,8 +22,8 @@ usage() { + + cleanup() + { +- rm -f "$cin" "$cout" +- rm -f "$sin" "$sout" ++ rm -f "$cout" "$sout" ++ rm -f "$large" "$small" + rm -f "$capout" + + local netns +-- +2.30.2 + diff --git a/queue-5.14/series b/queue-5.14/series index 2292b221e98..7db1d87e265 100644 --- a/queue-5.14/series +++ b/queue-5.14/series @@ -77,3 +77,92 @@ net-hns3-change-affinity_mask-to-numa-node-range.patch net-hns3-disable-mac-in-flr-process.patch net-hns3-fix-the-timing-issue-of-vf-clearing-interrupt-sources.patch net-stmmac-platform-fix-build-warning-when-with-config_pm_sleep.patch +drivers-hv-vmbus-fix-kernel-crash-upon-unbinding-a-d.patch +net-mlx5e-fix-mutual-exclusion-between-cqe-compressi.patch +ice-correctly-deal-with-pfs-that-do-not-support-rdma.patch +net-dsa-qca8k-fix-kernel-panic-with-legacy-mdio-mapp.patch +net-dsa-lantiq_gswip-add-200ms-assert-delay.patch +net-hns3-fix-the-exception-when-query-imp-info.patch +nvme-avoid-race-in-shutdown-namespace-removal.patch +blkcg-fix-memory-leak-in-blk_iolatency_init.patch +net-dsa-flush-switchdev-workqueue-before-tearing-dow.patch +mlxbf_gige-clear-valid_polarity-upon-open.patch +dt-bindings-mtd-gpmc-fix-the-ecc-bytes-vs.-oob-bytes.patch +remoteproc-qcom-wcnss-fix-race-with-iris-probe.patch +mfd-db8500-prcmu-adjust-map-to-reality.patch +pci-add-acs-quirks-for-nxp-lx2xx0-and-lx2xx2-platfor.patch +fuse-fix-use-after-free-in-fuse_read_interrupt.patch +pci-tegra194-fix-handling-bme_chged-event.patch +pci-tegra194-fix-msi-x-programming.patch +pci-tegra-fix-of-node-reference-leak.patch +mfd-don-t-use-irq_create_mapping-to-resolve-a-mappin.patch +pci-rcar-fix-runtime-pm-imbalance-in-rcar_pcie_ep_pr.patch +riscv-fix-the-global-name-pfn_base-confliction-error.patch +kvm-arm64-make-hyp_panic-more-robust-when-protected-.patch +tracing-probes-reject-events-which-have-the-same-nam.patch +pci-cadence-use-bitfield-for-quirk_retrain_flag-inst.patch +pci-cadence-add-quirk-flag-to-set-minimum-delay-in-l.patch +pci-j721e-add-pcie-support-for-j7200.patch +pci-j721e-add-pcie-support-for-am64.patch +pci-add-acs-quirks-for-cavium-multi-function-devices.patch +watchdog-start-watchdog-in-watchdog_set_last_hw_keep.patch +octeontx2-af-add-additional-register-check-to-rvu_po.patch +set-fc_nlinfo-in-nh_create_ipv4-nh_create_ipv6.patch +flow-fix-object-size-mismatch-warning-in-flowi-4-6-_.patch +net-usb-cdc_mbim-avoid-altsetting-toggling-for-telit.patch +block-bfq-honor-already-setup-queue-merges.patch +pci-ibmphp-fix-double-unmap-of-io_mem.patch +loop-reduce-the-loop_ctl_mutex-scope.patch +ethtool-fix-an-error-code-in-cxgb2.c.patch +ntb-fix-an-error-code-in-ntb_msit_probe.patch +ntb-perf-fix-an-error-code-in-perf_setup_inbuf.patch +stmmac-dwmac-loongson-fix-missing-return-value.patch +net-phylink-add-suspend-resume-support.patch +mfd-axp20x-update-axp288-volatile-ranges.patch +backlight-ktd253-stabilize-backlight.patch +pci-controller-pci_ixp4xx-should-depend-on-arch_ixp4.patch +pci-of-don-t-fail-devm_pci_alloc_host_bridge-on-miss.patch +pci-iproc-fix-bcma-probe-resource-handling.patch +netfilter-nft_ct-protect-nft_ct_pcpu_template_refcnt.patch +kvm-arm64-restrict-ipa-size-to-maximum-48-bits-on-4k.patch +pci-fix-pci_dev_str_match_path-alloc-while-atomic-bu.patch +mfd-tqmx86-clear-gpio-irq-resource-when-no-irq-is-se.patch +tracing-boot-fix-a-hist-trigger-dependency-for-boot-.patch +mtd-mtdconcat-judge-callback-existence-based-on-the-.patch +mtd-mtdconcat-check-_read-_write-callbacks-existence.patch +kvm-arm64-fix-read-side-race-on-updates-to-vcpu-rese.patch +kvm-arm64-handle-psci-resets-before-userspace-touche.patch +pci-ptm-remove-error-message-at-boot.patch +pci-sync-__pci_register_driver-stub-for-config_pci-n.patch +watchdog-fix-null-pointer-dereference-when-releasing.patch +mtd-rawnand-cafe-fix-a-resource-leak-in-the-error-ha.patch +arc-export-clear_user_page-for-modules.patch +perf-config-fix-caching-and-memory-leak-in-perf_home.patch +perf-unwind-do-not-overwrite-feature_check_ldflags-l.patch +perf-bench-inject-buildid-handle-writen-errors.patch +gpio-mpc8xxx-fix-a-resources-leak-in-the-error-handl.patch +gpio-mpc8xxx-fix-a-potential-double-iounmap-call-in-.patch +gpio-mpc8xxx-use-devm_gpiochip_add_data-to-simplify-.patch +io_uring-retry-in-case-of-short-read-on-block-device.patch +net-dsa-tag_rtl4_a-fix-egress-tags.patch +tools-build-fix-feature-detect-clean-for-out-of-sour.patch +mptcp-fix-possible-divide-by-zero.patch +selftests-mptcp-clean-tmp-files-in-simult_flows.patch +net-hso-add-failure-handler-for-add_net_device.patch +net-dsa-b53-fix-calculating-number-of-switch-ports.patch +net-dsa-b53-set-correct-number-of-ports-in-the-dsa-s.patch +mptcp-only-send-extra-tcp-acks-in-eligible-socket-st.patch +netfilter-socket-icmp6-fix-use-after-scope.patch +fq_codel-reject-silly-quantum-parameters.patch +qlcnic-remove-redundant-unlock-in-qlcnic_pinit_from_.patch +iwlwifi-move-get-pnvm-file-name-to-a-separate-functi.patch +iwlwifi-pnvm-fix-a-memory-leak-in-iwl_pnvm_get_from_.patch +ip_gre-validate-csum_start-only-on-pull.patch +net-dsa-b53-fix-imp-port-setup-on-bcm5301x.patch +bnxt_en-fix-stored-fw_psid-version-masks.patch +bnxt_en-fix-asic.rev-in-devlink-dev-info-command.patch +bnxt_en-fix-possible-unintended-driver-initiated-err.patch +ip6_gre-revert-ip6_gre-add-validation-for-csum_start.patch +mfd-lpc_sch-rename-gpiobase-to-prevent-build-error.patch +cxgb3-fix-oops-on-module-removal.patch +net-renesas-sh_eth-fix-freeing-wrong-tx-descriptor.patch diff --git a/queue-5.14/set-fc_nlinfo-in-nh_create_ipv4-nh_create_ipv6.patch b/queue-5.14/set-fc_nlinfo-in-nh_create_ipv4-nh_create_ipv6.patch new file mode 100644 index 00000000000..df4c74d6743 --- /dev/null +++ b/queue-5.14/set-fc_nlinfo-in-nh_create_ipv4-nh_create_ipv6.patch @@ -0,0 +1,137 @@ +From 95d3586909f8bd4d98d197b013462d66b73ff172 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Sep 2021 05:20:14 +0000 +Subject: Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6 + +From: Ryoga Saito + +[ Upstream commit 9aca491e0dccf8a9d84a5b478e5eee3c6ea7803b ] + +This patch fixes kernel NULL pointer dereference when creating nexthop +which is bound with SRv6 decapsulation. In the creation of nexthop, +__seg6_end_dt_vrf_build is called. __seg6_end_dt_vrf_build expects +fc_lninfo in fib6_config is set correctly, but it isn't set in +nh_create_ipv6, which causes kernel crash. + +Here is steps to reproduce kernel crash: + +1. modprobe vrf +2. ip -6 nexthop add encap seg6local action End.DT4 vrftable 1 dev eth0 + +We got the following message: + +[ 901.370336] BUG: kernel NULL pointer dereference, address: 0000000000000ba0 +[ 901.371658] #PF: supervisor read access in kernel mode +[ 901.372672] #PF: error_code(0x0000) - not-present page +[ 901.373672] PGD 0 P4D 0 +[ 901.374248] Oops: 0000 [#1] SMP PTI +[ 901.374944] CPU: 0 PID: 8593 Comm: ip Not tainted 5.14-051400-generic #202108310811-Ubuntu +[ 901.376404] Hardware name: Red Hat KVM, BIOS 1.11.1-4.module_el8.2.0+320+13f867d7 04/01/2014 +[ 901.377907] RIP: 0010:vrf_ifindex_lookup_by_table_id+0x19/0x90 [vrf] +[ 901.379182] Code: c1 e9 72 ff ff ff e8 96 49 01 c2 66 0f 1f 44 00 00 0f 1f 44 00 00 55 48 89 e5 41 56 41 55 41 89 f5 41 54 53 8b 05 47 4c 00 00 <48> 8b 97 a0 0b 00 00 48 8b 1c c2 e8 57 27 53 c1 4c 8d a3 88 00 00 +[ 901.382652] RSP: 0018:ffffbf2d02043590 EFLAGS: 00010282 +[ 901.383746] RAX: 000000000000000b RBX: ffff990808255e70 RCX: ffffbf2d02043aa8 +[ 901.385436] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000000 +[ 901.386924] RBP: ffffbf2d020435b0 R08: 00000000000000c0 R09: ffff990808255e40 +[ 901.388537] R10: ffffffff83b08c90 R11: 0000000000000009 R12: 0000000000000000 +[ 901.389937] R13: 0000000000000001 R14: 0000000000000000 R15: 000000000000000b +[ 901.391226] FS: 00007fe49381f740(0000) GS:ffff99087dc00000(0000) knlGS:0000000000000000 +[ 901.392737] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 901.393803] CR2: 0000000000000ba0 CR3: 000000000e3e8003 CR4: 0000000000770ef0 +[ 901.395122] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 901.396496] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 901.397833] PKRU: 55555554 +[ 901.398578] Call Trace: +[ 901.399144] l3mdev_ifindex_lookup_by_table_id+0x3b/0x70 +[ 901.400179] __seg6_end_dt_vrf_build+0x34/0xd0 +[ 901.401067] seg6_end_dt4_build+0x16/0x20 +[ 901.401904] seg6_local_build_state+0x271/0x430 +[ 901.402797] lwtunnel_build_state+0x81/0x130 +[ 901.403645] fib_nh_common_init+0x82/0x100 +[ 901.404465] ? sock_def_readable+0x4b/0x80 +[ 901.405285] fib6_nh_init+0x115/0x7c0 +[ 901.406033] nh_create_ipv6.isra.0+0xe1/0x140 +[ 901.406932] rtm_new_nexthop+0x3b7/0xeb0 +[ 901.407828] rtnetlink_rcv_msg+0x152/0x3a0 +[ 901.408663] ? rtnl_calcit.isra.0+0x130/0x130 +[ 901.409535] netlink_rcv_skb+0x55/0x100 +[ 901.410319] rtnetlink_rcv+0x15/0x20 +[ 901.411026] netlink_unicast+0x1a8/0x250 +[ 901.411813] netlink_sendmsg+0x238/0x470 +[ 901.412602] ? _copy_from_user+0x2b/0x60 +[ 901.413394] sock_sendmsg+0x65/0x70 +[ 901.414112] ____sys_sendmsg+0x218/0x290 +[ 901.414929] ? copy_msghdr_from_user+0x5c/0x90 +[ 901.415814] ___sys_sendmsg+0x81/0xc0 +[ 901.416559] ? fsnotify_destroy_marks+0x27/0xf0 +[ 901.417447] ? call_rcu+0xa4/0x230 +[ 901.418153] ? kmem_cache_free+0x23f/0x410 +[ 901.418972] ? dentry_free+0x37/0x70 +[ 901.419705] ? mntput_no_expire+0x4c/0x260 +[ 901.420574] __sys_sendmsg+0x62/0xb0 +[ 901.421297] __x64_sys_sendmsg+0x1f/0x30 +[ 901.422057] do_syscall_64+0x5c/0xc0 +[ 901.422756] ? syscall_exit_to_user_mode+0x27/0x50 +[ 901.423675] ? __x64_sys_close+0x12/0x40 +[ 901.424462] ? do_syscall_64+0x69/0xc0 +[ 901.425219] ? irqentry_exit_to_user_mode+0x9/0x20 +[ 901.426149] ? irqentry_exit+0x19/0x30 +[ 901.426901] ? exc_page_fault+0x89/0x160 +[ 901.427709] ? asm_exc_page_fault+0x8/0x30 +[ 901.428536] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ 901.429514] RIP: 0033:0x7fe493945747 +[ 901.430248] Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 +[ 901.433549] RSP: 002b:00007ffe9932cf68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e +[ 901.434981] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe493945747 +[ 901.436303] RDX: 0000000000000000 RSI: 00007ffe9932cfe0 RDI: 0000000000000003 +[ 901.437607] RBP: 00000000613053f7 R08: 0000000000000001 R09: 00007ffe9932d07c +[ 901.438990] R10: 000055f4a903a010 R11: 0000000000000246 R12: 0000000000000001 +[ 901.440340] R13: 0000000000000001 R14: 000055f4a802b163 R15: 000055f4a8042020 +[ 901.441630] Modules linked in: vrf nls_utf8 isofs nls_iso8859_1 dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua intel_rapl_msr intel_rapl_common isst_if_mbox_msr isst_if_common nfit rapl input_leds joydev serio_raw qemu_fw_cfg mac_hid sch_fq_codel drm virtio_rng ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd virtio_net net_failover cryptd psmouse virtio_blk failover i2c_piix4 pata_acpi floppy +[ 901.450808] CR2: 0000000000000ba0 +[ 901.451514] ---[ end trace c27b934b99ade304 ]--- +[ 901.452403] RIP: 0010:vrf_ifindex_lookup_by_table_id+0x19/0x90 [vrf] +[ 901.453626] Code: c1 e9 72 ff ff ff e8 96 49 01 c2 66 0f 1f 44 00 00 0f 1f 44 00 00 55 48 89 e5 41 56 41 55 41 89 f5 41 54 53 8b 05 47 4c 00 00 <48> 8b 97 a0 0b 00 00 48 8b 1c c2 e8 57 27 53 c1 4c 8d a3 88 00 00 +[ 901.456910] RSP: 0018:ffffbf2d02043590 EFLAGS: 00010282 +[ 901.457912] RAX: 000000000000000b RBX: ffff990808255e70 RCX: ffffbf2d02043aa8 +[ 901.459238] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000000 +[ 901.460552] RBP: ffffbf2d020435b0 R08: 00000000000000c0 R09: ffff990808255e40 +[ 901.461882] R10: ffffffff83b08c90 R11: 0000000000000009 R12: 0000000000000000 +[ 901.463208] R13: 0000000000000001 R14: 0000000000000000 R15: 000000000000000b +[ 901.464529] FS: 00007fe49381f740(0000) GS:ffff99087dc00000(0000) knlGS:0000000000000000 +[ 901.466058] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 901.467189] CR2: 0000000000000ba0 CR3: 000000000e3e8003 CR4: 0000000000770ef0 +[ 901.468515] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 901.469858] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 901.471139] PKRU: 55555554 + +Signed-off-by: Ryoga Saito +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/nexthop.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c +index 4075230b14c6..75ca4b6e484f 100644 +--- a/net/ipv4/nexthop.c ++++ b/net/ipv4/nexthop.c +@@ -2490,6 +2490,7 @@ static int nh_create_ipv4(struct net *net, struct nexthop *nh, + .fc_gw4 = cfg->gw.ipv4, + .fc_gw_family = cfg->gw.ipv4 ? AF_INET : 0, + .fc_flags = cfg->nh_flags, ++ .fc_nlinfo = cfg->nlinfo, + .fc_encap = cfg->nh_encap, + .fc_encap_type = cfg->nh_encap_type, + }; +@@ -2528,6 +2529,7 @@ static int nh_create_ipv6(struct net *net, struct nexthop *nh, + .fc_ifindex = cfg->nh_ifindex, + .fc_gateway = cfg->gw.ipv6, + .fc_flags = cfg->nh_flags, ++ .fc_nlinfo = cfg->nlinfo, + .fc_encap = cfg->nh_encap, + .fc_encap_type = cfg->nh_encap_type, + .fc_is_fdb = cfg->nh_fdb, +-- +2.30.2 + diff --git a/queue-5.14/stmmac-dwmac-loongson-fix-missing-return-value.patch b/queue-5.14/stmmac-dwmac-loongson-fix-missing-return-value.patch new file mode 100644 index 00000000000..ecac465e57f --- /dev/null +++ b/queue-5.14/stmmac-dwmac-loongson-fix-missing-return-value.patch @@ -0,0 +1,37 @@ +From cdca6863ea0e6758ef93f060369670719ec499ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Sep 2021 15:21:07 +0800 +Subject: stmmac: dwmac-loongson:Fix missing return value + +From: zhaoxiao + +[ Upstream commit 5289de5929d1758a95477a4d160195397ccffa7b ] + +Add the return value when phy_mode < 0. + +Signed-off-by: zhaoxiao +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c +index 4c9a37dd0d3f..ecf759ee1c9f 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c +@@ -109,8 +109,10 @@ static int loongson_dwmac_probe(struct pci_dev *pdev, const struct pci_device_id + plat->bus_id = pci_dev_id(pdev); + + phy_mode = device_get_phy_mode(&pdev->dev); +- if (phy_mode < 0) ++ if (phy_mode < 0) { + dev_err(&pdev->dev, "phy_mode not found\n"); ++ return phy_mode; ++ } + + plat->phy_interface = phy_mode; + plat->interface = PHY_INTERFACE_MODE_GMII; +-- +2.30.2 + diff --git a/queue-5.14/tools-build-fix-feature-detect-clean-for-out-of-sour.patch b/queue-5.14/tools-build-fix-feature-detect-clean-for-out-of-sour.patch new file mode 100644 index 00000000000..bce9a12eacc --- /dev/null +++ b/queue-5.14/tools-build-fix-feature-detect-clean-for-out-of-sour.patch @@ -0,0 +1,52 @@ +From 38a434f0482861f681d9a48cbfd5ebb4060a3bc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Aug 2021 14:07:05 +0100 +Subject: tools build: Fix feature detect clean for out of source builds + +From: James Clark + +[ Upstream commit 8af52e69772d053bc7caab12ad1c59f18ef2e3e2 ] + +Currently the clean target when using O= isn't cleaning the feature +detect output. This is because O= and OUTPUT= are set to canonical +paths. For example in tools/perf/Makefile: + + FULL_O := $(shell cd $(PWD); readlink -f $(O) || echo $(O)) + +This means that OUTPUT ends in a / and most usages prepend it to a file +without adding an extra /. This line that was changed adds an extra / +before the 'feature' folder but not to the end, resulting in a clean +command like this: + + rm -f /tmp/build//featuretest-all.bin ... + +After the change the clean command looks like this: + + rm -f /tmp/build/feature/test-all.bin ... + +Fixes: 762323eb39a257c3 ("perf build: Move feature cleanup under tools/build") +Signed-off-by: James Clark +Acked-by: Jiri Olsa +Link: http://lore.kernel.org/lkml/20210816130705.1331868-1-james.clark@arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/build/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/build/Makefile b/tools/build/Makefile +index 5ed41b96fcde..6f11e6fc9ffe 100644 +--- a/tools/build/Makefile ++++ b/tools/build/Makefile +@@ -32,7 +32,7 @@ all: $(OUTPUT)fixdep + + # Make sure there's anything to clean, + # feature contains check for existing OUTPUT +-TMP_O := $(if $(OUTPUT),$(OUTPUT)/feature,./) ++TMP_O := $(if $(OUTPUT),$(OUTPUT)feature/,./) + + clean: + $(call QUIET_CLEAN, fixdep) +-- +2.30.2 + diff --git a/queue-5.14/tracing-boot-fix-a-hist-trigger-dependency-for-boot-.patch b/queue-5.14/tracing-boot-fix-a-hist-trigger-dependency-for-boot-.patch new file mode 100644 index 00000000000..71391dca548 --- /dev/null +++ b/queue-5.14/tracing-boot-fix-a-hist-trigger-dependency-for-boot-.patch @@ -0,0 +1,53 @@ +From efc9ef9552d7e3ee7e3502960a602d0d4089dd21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Aug 2021 11:07:14 +0900 +Subject: tracing/boot: Fix a hist trigger dependency for boot time tracing + +From: Masami Hiramatsu + +[ Upstream commit 6fe7c745f2acb73e4cc961d7f91125eef5a8861f ] + +Fixes a build error when CONFIG_HIST_TRIGGERS=n with boot-time +tracing. Since the trigger_process_regex() is defined only +when CONFIG_HIST_TRIGGERS=y, if it is disabled, the 'actions' +event option also must be disabled. + +Link: https://lkml.kernel.org/r/162856123376.203126.582144262622247352.stgit@devnote2 + +Fixes: 81a59555ff15 ("tracing/boot: Add per-event settings") +Signed-off-by: Masami Hiramatsu +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_boot.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/kernel/trace/trace_boot.c b/kernel/trace/trace_boot.c +index 94ef2d099e32..d713714cba67 100644 +--- a/kernel/trace/trace_boot.c ++++ b/kernel/trace/trace_boot.c +@@ -205,12 +205,15 @@ trace_boot_init_one_event(struct trace_array *tr, struct xbc_node *gnode, + pr_err("Failed to apply filter: %s\n", buf); + } + +- xbc_node_for_each_array_value(enode, "actions", anode, p) { +- if (strlcpy(buf, p, ARRAY_SIZE(buf)) >= ARRAY_SIZE(buf)) +- pr_err("action string is too long: %s\n", p); +- else if (trigger_process_regex(file, buf) < 0) +- pr_err("Failed to apply an action: %s\n", buf); +- } ++ if (IS_ENABLED(CONFIG_HIST_TRIGGERS)) { ++ xbc_node_for_each_array_value(enode, "actions", anode, p) { ++ if (strlcpy(buf, p, ARRAY_SIZE(buf)) >= ARRAY_SIZE(buf)) ++ pr_err("action string is too long: %s\n", p); ++ else if (trigger_process_regex(file, buf) < 0) ++ pr_err("Failed to apply an action: %s\n", buf); ++ } ++ } else if (xbc_node_find_value(enode, "actions", NULL)) ++ pr_err("Failed to apply event actions because CONFIG_HIST_TRIGGERS is not set.\n"); + + if (xbc_node_find_value(enode, "enable", NULL)) { + if (trace_event_enable_disable(file, 1, 0) < 0) +-- +2.30.2 + diff --git a/queue-5.14/tracing-probes-reject-events-which-have-the-same-nam.patch b/queue-5.14/tracing-probes-reject-events-which-have-the-same-nam.patch new file mode 100644 index 00000000000..daffa7b90e2 --- /dev/null +++ b/queue-5.14/tracing-probes-reject-events-which-have-the-same-nam.patch @@ -0,0 +1,129 @@ +From 074d8aac0d6fba7c6a7bd905d5828901f9bc91b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Aug 2021 19:26:02 +0900 +Subject: tracing/probes: Reject events which have the same name of existing + one + +From: Masami Hiramatsu + +[ Upstream commit 8e242060c6a4947e8ae7d29794af6a581db08841 ] + +Since kprobe_events and uprobe_events only check whether the +other same-type probe event has the same name or not, if the +user gives the same name of the existing tracepoint event (or +the other type of probe events), it silently fails to create +the tracefs entry (but registered.) as below. + +/sys/kernel/tracing # ls events/task/task_rename +enable filter format hist id trigger +/sys/kernel/tracing # echo p:task/task_rename vfs_read >> kprobe_events +[ 113.048508] Could not create tracefs 'task_rename' directory +/sys/kernel/tracing # cat kprobe_events +p:task/task_rename vfs_read + +To fix this issue, check whether the existing events have the +same name or not in trace_probe_register_event_call(). If exists, +it rejects to register the new event. + +Link: https://lkml.kernel.org/r/162936876189.187130.17558311387542061930.stgit@devnote2 + +Signed-off-by: Masami Hiramatsu +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_kprobe.c | 6 +++++- + kernel/trace/trace_probe.c | 25 +++++++++++++++++++++++++ + kernel/trace/trace_probe.h | 1 + + kernel/trace/trace_uprobe.c | 6 +++++- + 4 files changed, 36 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c +index ea6178cb5e33..032191977e34 100644 +--- a/kernel/trace/trace_kprobe.c ++++ b/kernel/trace/trace_kprobe.c +@@ -647,7 +647,11 @@ static int register_trace_kprobe(struct trace_kprobe *tk) + /* Register new event */ + ret = register_kprobe_event(tk); + if (ret) { +- pr_warn("Failed to register probe event(%d)\n", ret); ++ if (ret == -EEXIST) { ++ trace_probe_log_set_index(0); ++ trace_probe_log_err(0, EVENT_EXIST); ++ } else ++ pr_warn("Failed to register probe event(%d)\n", ret); + goto end; + } + +diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c +index 15413ad7cef2..0e29bb14fc8b 100644 +--- a/kernel/trace/trace_probe.c ++++ b/kernel/trace/trace_probe.c +@@ -1029,11 +1029,36 @@ error: + return ret; + } + ++static struct trace_event_call * ++find_trace_event_call(const char *system, const char *event_name) ++{ ++ struct trace_event_call *tp_event; ++ const char *name; ++ ++ list_for_each_entry(tp_event, &ftrace_events, list) { ++ if (!tp_event->class->system || ++ strcmp(system, tp_event->class->system)) ++ continue; ++ name = trace_event_name(tp_event); ++ if (!name || strcmp(event_name, name)) ++ continue; ++ return tp_event; ++ } ++ ++ return NULL; ++} ++ + int trace_probe_register_event_call(struct trace_probe *tp) + { + struct trace_event_call *call = trace_probe_event_call(tp); + int ret; + ++ lockdep_assert_held(&event_mutex); ++ ++ if (find_trace_event_call(trace_probe_group_name(tp), ++ trace_probe_name(tp))) ++ return -EEXIST; ++ + ret = register_trace_event(&call->event); + if (!ret) + return -ENODEV; +diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h +index 227d518e5ba5..9f14186d132e 100644 +--- a/kernel/trace/trace_probe.h ++++ b/kernel/trace/trace_probe.h +@@ -399,6 +399,7 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call, + C(NO_EVENT_NAME, "Event name is not specified"), \ + C(EVENT_TOO_LONG, "Event name is too long"), \ + C(BAD_EVENT_NAME, "Event name must follow the same rules as C identifiers"), \ ++ C(EVENT_EXIST, "Given group/event name is already used by another event"), \ + C(RETVAL_ON_PROBE, "$retval is not available on probe"), \ + C(BAD_STACK_NUM, "Invalid stack number"), \ + C(BAD_ARG_NUM, "Invalid argument number"), \ +diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c +index 9b50869a5ddb..957244ee07c8 100644 +--- a/kernel/trace/trace_uprobe.c ++++ b/kernel/trace/trace_uprobe.c +@@ -514,7 +514,11 @@ static int register_trace_uprobe(struct trace_uprobe *tu) + + ret = register_uprobe_event(tu); + if (ret) { +- pr_warn("Failed to register probe event(%d)\n", ret); ++ if (ret == -EEXIST) { ++ trace_probe_log_set_index(0); ++ trace_probe_log_err(0, EVENT_EXIST); ++ } else ++ pr_warn("Failed to register probe event(%d)\n", ret); + goto end; + } + +-- +2.30.2 + diff --git a/queue-5.14/watchdog-fix-null-pointer-dereference-when-releasing.patch b/queue-5.14/watchdog-fix-null-pointer-dereference-when-releasing.patch new file mode 100644 index 00000000000..f42d0b6ca02 --- /dev/null +++ b/queue-5.14/watchdog-fix-null-pointer-dereference-when-releasing.patch @@ -0,0 +1,50 @@ +From b4aa6c47413df79eb5ed68ccfafc9fd2fccd0cca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 23:26:23 -0700 +Subject: watchdog: Fix NULL pointer dereference when releasing cdev + +From: Curtis Klein + +[ Upstream commit c7b178dae139f8857edc50888cfbf251cd974a38 ] + +watchdog_hrtimer_pretimeout_stop needs the watchdog device to have a +valid pointer to the watchdog core data to stop the pretimeout hrtimer. +Therefore it needs to be called before the pointers are cleared in +watchdog_cdev_unregister. + +Fixes: 7b7d2fdc8c3e ("watchdog: Add hrtimer-based pretimeout feature") +Reported-by: Colin Ian King +Signed-off-by: Curtis Klein +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/1624429583-5720-1-git-send-email-curtis.klein@hpe.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/watchdog_dev.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c +index 6c73160386b9..0cc07d957b64 100644 +--- a/drivers/watchdog/watchdog_dev.c ++++ b/drivers/watchdog/watchdog_dev.c +@@ -1096,6 +1096,8 @@ static void watchdog_cdev_unregister(struct watchdog_device *wdd) + watchdog_stop(wdd); + } + ++ watchdog_hrtimer_pretimeout_stop(wdd); ++ + mutex_lock(&wd_data->lock); + wd_data->wdd = NULL; + wdd->wd_data = NULL; +@@ -1103,7 +1105,6 @@ static void watchdog_cdev_unregister(struct watchdog_device *wdd) + + hrtimer_cancel(&wd_data->timer); + kthread_cancel_work_sync(&wd_data->work); +- watchdog_hrtimer_pretimeout_stop(wdd); + + put_device(&wd_data->dev); + } +-- +2.30.2 + diff --git a/queue-5.14/watchdog-start-watchdog-in-watchdog_set_last_hw_keep.patch b/queue-5.14/watchdog-start-watchdog-in-watchdog_set_last_hw_keep.patch new file mode 100644 index 00000000000..28165a00ff7 --- /dev/null +++ b/queue-5.14/watchdog-start-watchdog-in-watchdog_set_last_hw_keep.patch @@ -0,0 +1,46 @@ +From d3761155cfd46660bcc5e7c34e6f22fd32e849ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 1 Aug 2021 09:56:25 +0200 +Subject: watchdog: Start watchdog in watchdog_set_last_hw_keepalive only if + appropriate + +From: Jan Kiszka + +[ Upstream commit dbe80cf471f940db3063197b7adb1169f89be9ed ] + +We must not pet a running watchdog when handle_boot_enabled is off +because this will kick off automatic triggering before userland is +running, defeating the purpose of the handle_boot_enabled control. +Furthermore, don't ping in case watchdog_set_last_hw_keepalive was +called incorrectly when the hardware watchdog is actually not running. + +Fixed: cef9572e9af3 ("watchdog: add support for adjusting last known HW keepalive time") +Signed-off-by: Jan Kiszka +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/93d56386-6e37-060b-55ce-84de8cde535f@web.de +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/watchdog_dev.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c +index 3bab32485273..6c73160386b9 100644 +--- a/drivers/watchdog/watchdog_dev.c ++++ b/drivers/watchdog/watchdog_dev.c +@@ -1172,7 +1172,10 @@ int watchdog_set_last_hw_keepalive(struct watchdog_device *wdd, + + wd_data->last_hw_keepalive = ktime_sub(now, ms_to_ktime(last_ping_ms)); + +- return __watchdog_ping(wdd); ++ if (watchdog_hw_running(wdd) && handle_boot_enabled) ++ return __watchdog_ping(wdd); ++ ++ return 0; + } + EXPORT_SYMBOL_GPL(watchdog_set_last_hw_keepalive); + +-- +2.30.2 +