From: Sasha Levin Date: Sun, 21 Nov 2021 23:00:32 +0000 (-0500) Subject: Fixes for 5.10 X-Git-Tag: v5.15.5~82 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=748fa70e3565682afa1976e76b81034f3cee4cab;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/alsa-gus-fix-null-pointer-dereference-on-pointer-blo.patch b/queue-5.10/alsa-gus-fix-null-pointer-dereference-on-pointer-blo.patch new file mode 100644 index 00000000000..14b65505806 --- /dev/null +++ b/queue-5.10/alsa-gus-fix-null-pointer-dereference-on-pointer-blo.patch @@ -0,0 +1,37 @@ +From ef82f7d841a8f2c7e53a7a9a1be039d59adf8b29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Oct 2021 03:46:11 -0700 +Subject: ALSA: gus: fix null pointer dereference on pointer block + +From: Chengfeng Ye + +[ Upstream commit a0d21bb3279476c777434c40d969ea88ca64f9aa ] + +The pointer block return from snd_gf1_dma_next_block could be +null, so there is a potential null pointer dereference issue. +Fix this by adding a null check before dereference. + +Signed-off-by: Chengfeng Ye +Link: https://lore.kernel.org/r/20211024104611.9919-1-cyeaa@connect.ust.hk +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/isa/gus/gus_dma.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/isa/gus/gus_dma.c b/sound/isa/gus/gus_dma.c +index a1c770d826dda..6d664dd8dde0b 100644 +--- a/sound/isa/gus/gus_dma.c ++++ b/sound/isa/gus/gus_dma.c +@@ -126,6 +126,8 @@ static void snd_gf1_dma_interrupt(struct snd_gus_card * gus) + } + block = snd_gf1_dma_next_block(gus); + spin_unlock(&gus->dma_lock); ++ if (!block) ++ return; + snd_gf1_dma_program(gus, block->addr, block->buf_addr, block->count, (unsigned short) block->cmd); + kfree(block); + #if 0 +-- +2.33.0 + diff --git a/queue-5.10/alsa-intel-dsp-config-add-quirk-for-apl-glk-tgl-devi.patch b/queue-5.10/alsa-intel-dsp-config-add-quirk-for-apl-glk-tgl-devi.patch new file mode 100644 index 00000000000..36bde37a558 --- /dev/null +++ b/queue-5.10/alsa-intel-dsp-config-add-quirk-for-apl-glk-tgl-devi.patch @@ -0,0 +1,103 @@ +From 0889653c8fda455091059a4f0d8b0133e70d9ace Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 16:35:09 -0500 +Subject: ALSA: intel-dsp-config: add quirk for APL/GLK/TGL devices based on + ES8336 codec + +From: Pierre-Louis Bossart + +[ Upstream commit 9d36ceab94151f07cf3fcb067213ac87937adf12 ] + +These devices are based on an I2C/I2S device, we need to force the use +of the SOF driver otherwise the legacy HDaudio driver will be loaded - +only HDMI will be supported. + +Co-developed-by: Huajun Li +Signed-off-by: Huajun Li +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20211004213512.220836-3-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/hda/intel-dsp-config.c | 22 ++++++++++++++++++++-- + 1 file changed, 20 insertions(+), 2 deletions(-) + +diff --git a/sound/hda/intel-dsp-config.c b/sound/hda/intel-dsp-config.c +index 61e1de6d7be0a..6cdb3db7507b1 100644 +--- a/sound/hda/intel-dsp-config.c ++++ b/sound/hda/intel-dsp-config.c +@@ -30,6 +30,7 @@ struct config_entry { + u32 flags; + u16 device; + const struct dmi_system_id *dmi_table; ++ u8 codec_hid[ACPI_ID_LEN]; + }; + + /* +@@ -55,7 +56,7 @@ static const struct config_entry config_table[] = { + /* + * Apollolake (Broxton-P) + * the legacy HDAudio driver is used except on Up Squared (SOF) and +- * Chromebooks (SST) ++ * Chromebooks (SST), as well as devices based on the ES8336 codec + */ + #if IS_ENABLED(CONFIG_SND_SOC_SOF_APOLLOLAKE) + { +@@ -72,6 +73,11 @@ static const struct config_entry config_table[] = { + {} + } + }, ++ { ++ .flags = FLAG_SOF, ++ .device = 0x5a98, ++ .codec_hid = "ESSX8336", ++ }, + #endif + #if IS_ENABLED(CONFIG_SND_SOC_INTEL_APL) + { +@@ -136,7 +142,7 @@ static const struct config_entry config_table[] = { + + /* + * Geminilake uses legacy HDAudio driver except for Google +- * Chromebooks ++ * Chromebooks and devices based on the ES8336 codec + */ + /* Geminilake */ + #if IS_ENABLED(CONFIG_SND_SOC_SOF_GEMINILAKE) +@@ -153,6 +159,11 @@ static const struct config_entry config_table[] = { + {} + } + }, ++ { ++ .flags = FLAG_SOF, ++ .device = 0x3198, ++ .codec_hid = "ESSX8336", ++ }, + #endif + + /* +@@ -310,6 +321,11 @@ static const struct config_entry config_table[] = { + .flags = FLAG_SOF | FLAG_SOF_ONLY_IF_DMIC_OR_SOUNDWIRE, + .device = 0x43c8, + }, ++ { ++ .flags = FLAG_SOF, ++ .device = 0xa0c8, ++ .codec_hid = "ESSX8336", ++ }, + #endif + + /* Elkhart Lake */ +@@ -337,6 +353,8 @@ static const struct config_entry *snd_intel_dsp_find_config + continue; + if (table->dmi_table && !dmi_check_system(table->dmi_table)) + continue; ++ if (table->codec_hid[0] && !acpi_dev_present(table->codec_hid, NULL, -1)) ++ continue; + return table; + } + return NULL; +-- +2.33.0 + diff --git a/queue-5.10/alsa-isa-not-for-m68k.patch b/queue-5.10/alsa-isa-not-for-m68k.patch new file mode 100644 index 00000000000..b9bf0440499 --- /dev/null +++ b/queue-5.10/alsa-isa-not-for-m68k.patch @@ -0,0 +1,88 @@ +From be7d0cf35daba342a648574ed5e1abc22a8a1427 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Oct 2021 23:26:02 -0700 +Subject: ALSA: ISA: not for M68K + +From: Randy Dunlap + +[ Upstream commit 3c05f1477e62ea5a0a8797ba6a545b1dc751fb31 ] + +On m68k, compiling drivers under SND_ISA causes build errors: + +../sound/core/isadma.c: In function 'snd_dma_program': +../sound/core/isadma.c:33:17: error: implicit declaration of function 'claim_dma_lock' [-Werror=implicit-function-declaration] + 33 | flags = claim_dma_lock(); + | ^~~~~~~~~~~~~~ +../sound/core/isadma.c:41:9: error: implicit declaration of function 'release_dma_lock' [-Werror=implicit-function-declaration] + 41 | release_dma_lock(flags); + | ^~~~~~~~~~~~~~~~ + +../sound/isa/sb/sb16_main.c: In function 'snd_sb16_playback_prepare': +../sound/isa/sb/sb16_main.c:253:72: error: 'DMA_AUTOINIT' undeclared (first use in this function) + 253 | snd_dma_program(dma, runtime->dma_addr, size, DMA_MODE_WRITE | DMA_AUTOINIT); + | ^~~~~~~~~~~~ +../sound/isa/sb/sb16_main.c:253:72: note: each undeclared identifier is reported only once for each function it appears in +../sound/isa/sb/sb16_main.c: In function 'snd_sb16_capture_prepare': +../sound/isa/sb/sb16_main.c:322:71: error: 'DMA_AUTOINIT' undeclared (first use in this function) + 322 | snd_dma_program(dma, runtime->dma_addr, size, DMA_MODE_READ | DMA_AUTOINIT); + | ^~~~~~~~~~~~ + +and more... + +Signed-off-by: Randy Dunlap +Cc: Jaroslav Kysela +Cc: Takashi Iwai +Cc: alsa-devel@alsa-project.org +Cc: linux-m68k@lists.linux-m68k.org +Cc: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20211016062602.3588-1-rdunlap@infradead.org +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/Makefile | 2 ++ + sound/isa/Kconfig | 2 +- + sound/pci/Kconfig | 1 + + 3 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/core/Makefile b/sound/core/Makefile +index ee4a4a6b99ba7..d123587c0fd8f 100644 +--- a/sound/core/Makefile ++++ b/sound/core/Makefile +@@ -9,7 +9,9 @@ ifneq ($(CONFIG_SND_PROC_FS),) + snd-y += info.o + snd-$(CONFIG_SND_OSSEMUL) += info_oss.o + endif ++ifneq ($(CONFIG_M68K),y) + snd-$(CONFIG_ISA_DMA_API) += isadma.o ++endif + snd-$(CONFIG_SND_OSSEMUL) += sound_oss.o + snd-$(CONFIG_SND_VMASTER) += vmaster.o + snd-$(CONFIG_SND_JACK) += ctljack.o jack.o +diff --git a/sound/isa/Kconfig b/sound/isa/Kconfig +index 6ffa48dd59830..570b88e0b2018 100644 +--- a/sound/isa/Kconfig ++++ b/sound/isa/Kconfig +@@ -22,7 +22,7 @@ config SND_SB16_DSP + menuconfig SND_ISA + bool "ISA sound devices" + depends on ISA || COMPILE_TEST +- depends on ISA_DMA_API ++ depends on ISA_DMA_API && !M68K + default y + help + Support for sound devices connected via the ISA bus. +diff --git a/sound/pci/Kconfig b/sound/pci/Kconfig +index 93bc9bef7641f..41ce125971777 100644 +--- a/sound/pci/Kconfig ++++ b/sound/pci/Kconfig +@@ -279,6 +279,7 @@ config SND_CS46XX_NEW_DSP + config SND_CS5530 + tristate "CS5530 Audio" + depends on ISA_DMA_API && (X86_32 || COMPILE_TEST) ++ depends on !M68K + select SND_SB16_DSP + help + Say Y here to include support for audio on Cyrix/NatSemi CS5530 chips. +-- +2.33.0 + diff --git a/queue-5.10/arm-bcm53016-specify-switch-ports-for-meraki-mr32.patch b/queue-5.10/arm-bcm53016-specify-switch-ports-for-meraki-mr32.patch new file mode 100644 index 00000000000..317af3434c0 --- /dev/null +++ b/queue-5.10/arm-bcm53016-specify-switch-ports-for-meraki-mr32.patch @@ -0,0 +1,67 @@ +From 274635fa0b23c4d317ff4279fcaad92207757d4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Sep 2021 19:29:30 +0200 +Subject: ARM: BCM53016: Specify switch ports for Meraki MR32 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian Lamparter + +[ Upstream commit 6abc4ca5a28070945e0d68cb4160b309bfbf4b8b ] + +the switch identifies itself as a BCM53012 (rev 5)... +This patch has been tested & verified on OpenWrt's +snapshot with Linux 5.10 (didn't test any older kernels). +The MR32 is able to "talk to the network" as before with +OpenWrt's SWITCHDEV b53 driver. + +| b53-srab-switch 18007000.ethernet-switch: found switch: BCM53012, rev 5 +| libphy: dsa slave smi: probed +| b53-srab-switch 18007000.ethernet-switch poe (uninitialized): +| PHY [dsa-0.0:00] driver [Generic PHY] (irq=POLL) +| b53-srab-switch 18007000.ethernet-switch: Using legacy PHYLIB callbacks. +| Please migrate to PHYLINK! +| DSA: tree 0 setup + +Reported-by: Rafał Miłecki +Signed-off-by: Christian Lamparter +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm53016-meraki-mr32.dts | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/arch/arm/boot/dts/bcm53016-meraki-mr32.dts b/arch/arm/boot/dts/bcm53016-meraki-mr32.dts +index 612d61852bfb9..577a4dc604d93 100644 +--- a/arch/arm/boot/dts/bcm53016-meraki-mr32.dts ++++ b/arch/arm/boot/dts/bcm53016-meraki-mr32.dts +@@ -195,3 +195,25 @@ + }; + }; + }; ++ ++&srab { ++ status = "okay"; ++ ++ ports { ++ port@0 { ++ reg = <0>; ++ label = "poe"; ++ }; ++ ++ port@5 { ++ reg = <5>; ++ label = "cpu"; ++ ethernet = <&gmac0>; ++ ++ fixed-link { ++ speed = <1000>; ++ duplex-full; ++ }; ++ }; ++ }; ++}; +-- +2.33.0 + diff --git a/queue-5.10/arm-dts-ls1021a-move-thermal-zones-node-out-of-soc.patch b/queue-5.10/arm-dts-ls1021a-move-thermal-zones-node-out-of-soc.patch new file mode 100644 index 00000000000..cd7903380c9 --- /dev/null +++ b/queue-5.10/arm-dts-ls1021a-move-thermal-zones-node-out-of-soc.patch @@ -0,0 +1,105 @@ +From 233785bd6a7553c874b29a09affb670d2a9ab8f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Oct 2021 18:58:22 -0500 +Subject: ARM: dts: ls1021a: move thermal-zones node out of soc/ + +From: Li Yang + +[ Upstream commit 1ee1500ef717eefb5d9bdaf97905cb81b4e69aa4 ] + +This fixes dtbs-check error from simple-bus schema: +soc: thermal-zones: {'type': 'object'} is not allowed for {'cpu-thermal': ..... } + From schema: /home/leo/.local/lib/python3.8/site-packages/dtschema/schemas/simple-bus.yaml + +Signed-off-by: Li Yang +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ls1021a.dtsi | 66 +++++++++++++++++----------------- + 1 file changed, 33 insertions(+), 33 deletions(-) + +diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi +index 827373ef1a547..37026b2fa6497 100644 +--- a/arch/arm/boot/dts/ls1021a.dtsi ++++ b/arch/arm/boot/dts/ls1021a.dtsi +@@ -331,39 +331,6 @@ + #thermal-sensor-cells = <1>; + }; + +- thermal-zones { +- cpu_thermal: cpu-thermal { +- polling-delay-passive = <1000>; +- polling-delay = <5000>; +- +- thermal-sensors = <&tmu 0>; +- +- trips { +- cpu_alert: cpu-alert { +- temperature = <85000>; +- hysteresis = <2000>; +- type = "passive"; +- }; +- cpu_crit: cpu-crit { +- temperature = <95000>; +- hysteresis = <2000>; +- type = "critical"; +- }; +- }; +- +- cooling-maps { +- map0 { +- trip = <&cpu_alert>; +- cooling-device = +- <&cpu0 THERMAL_NO_LIMIT +- THERMAL_NO_LIMIT>, +- <&cpu1 THERMAL_NO_LIMIT +- THERMAL_NO_LIMIT>; +- }; +- }; +- }; +- }; +- + dspi0: spi@2100000 { + compatible = "fsl,ls1021a-v1.0-dspi"; + #address-cells = <1>; +@@ -1018,4 +985,37 @@ + big-endian; + }; + }; ++ ++ thermal-zones { ++ cpu_thermal: cpu-thermal { ++ polling-delay-passive = <1000>; ++ polling-delay = <5000>; ++ ++ thermal-sensors = <&tmu 0>; ++ ++ trips { ++ cpu_alert: cpu-alert { ++ temperature = <85000>; ++ hysteresis = <2000>; ++ type = "passive"; ++ }; ++ cpu_crit: cpu-crit { ++ temperature = <95000>; ++ hysteresis = <2000>; ++ type = "critical"; ++ }; ++ }; ++ ++ cooling-maps { ++ map0 { ++ trip = <&cpu_alert>; ++ cooling-device = ++ <&cpu0 THERMAL_NO_LIMIT ++ THERMAL_NO_LIMIT>, ++ <&cpu1 THERMAL_NO_LIMIT ++ THERMAL_NO_LIMIT>; ++ }; ++ }; ++ }; ++ }; + }; +-- +2.33.0 + diff --git a/queue-5.10/arm-dts-ls1021a-tsn-use-generic-jedec-spi-nor-compat.patch b/queue-5.10/arm-dts-ls1021a-tsn-use-generic-jedec-spi-nor-compat.patch new file mode 100644 index 00000000000..7f89098ddbc --- /dev/null +++ b/queue-5.10/arm-dts-ls1021a-tsn-use-generic-jedec-spi-nor-compat.patch @@ -0,0 +1,39 @@ +From 5ed28ae41ee533fb3cc46f99b986feb1a72b5acc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Oct 2021 18:58:23 -0500 +Subject: ARM: dts: ls1021a-tsn: use generic "jedec,spi-nor" compatible for + flash + +From: Li Yang + +[ Upstream commit 05e63b48b20fa70726be505a7660d1a07bc1cffb ] + +We cannot list all the possible chips used in different board revisions, +just use the generic "jedec,spi-nor" compatible instead. This also +fixes dtbs_check error: +['jedec,spi-nor', 's25fl256s1', 's25fl512s'] is too long + +Signed-off-by: Li Yang +Reviewed-by: Kuldeep Singh +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ls1021a-tsn.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/ls1021a-tsn.dts b/arch/arm/boot/dts/ls1021a-tsn.dts +index 9d8f0c2a8aba3..aca78b5eddf20 100644 +--- a/arch/arm/boot/dts/ls1021a-tsn.dts ++++ b/arch/arm/boot/dts/ls1021a-tsn.dts +@@ -251,7 +251,7 @@ + + flash@0 { + /* Rev. A uses 64MB flash, Rev. B & C use 32MB flash */ +- compatible = "jedec,spi-nor", "s25fl256s1", "s25fl512s"; ++ compatible = "jedec,spi-nor"; + spi-max-frequency = <20000000>; + #address-cells = <1>; + #size-cells = <1>; +-- +2.33.0 + diff --git a/queue-5.10/arm-dts-nsp-fix-mpcore-mmc-node-names.patch b/queue-5.10/arm-dts-nsp-fix-mpcore-mmc-node-names.patch new file mode 100644 index 00000000000..9d1fd33537a --- /dev/null +++ b/queue-5.10/arm-dts-nsp-fix-mpcore-mmc-node-names.patch @@ -0,0 +1,50 @@ +From e13a054e9a6ae9d5ee3dbab040bb1a98faf93a06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Aug 2021 22:37:48 +0000 +Subject: ARM: dts: NSP: Fix mpcore, mmc node names + +From: Matthew Hagan + +[ Upstream commit 15a563d008ef9d04df525f0c476cd7d7127bb883 ] + +Running dtbs_check yielded the issues with bcm-nsp.dtsi. + +Firstly this patch fixes the following message by appending "-bus" to +the mpcore node name: +mpcore@19000000: $nodename:0: 'mpcore@19000000' does not match '^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$' + +Secondly mmc node name. The label name can remain as is. +sdhci@21000: $nodename:0: 'sdhci@21000' does not match '^mmc(@.*)?$' + +Signed-off-by: Matthew Hagan +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm-nsp.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm-nsp.dtsi b/arch/arm/boot/dts/bcm-nsp.dtsi +index 605b6d2f4a569..1dae02bb82c2d 100644 +--- a/arch/arm/boot/dts/bcm-nsp.dtsi ++++ b/arch/arm/boot/dts/bcm-nsp.dtsi +@@ -77,7 +77,7 @@ + interrupt-affinity = <&cpu0>, <&cpu1>; + }; + +- mpcore@19000000 { ++ mpcore-bus@19000000 { + compatible = "simple-bus"; + ranges = <0x00000000 0x19000000 0x00023000>; + #address-cells = <1>; +@@ -219,7 +219,7 @@ + status = "disabled"; + }; + +- sdio: sdhci@21000 { ++ sdio: mmc@21000 { + compatible = "brcm,sdhci-iproc-cygnus"; + reg = <0x21000 0x100>; + interrupts = ; +-- +2.33.0 + diff --git a/queue-5.10/arm-dts-omap-fix-gpmc-mux-add-data-type.patch b/queue-5.10/arm-dts-omap-fix-gpmc-mux-add-data-type.patch new file mode 100644 index 00000000000..71ae1fa8215 --- /dev/null +++ b/queue-5.10/arm-dts-omap-fix-gpmc-mux-add-data-type.patch @@ -0,0 +1,52 @@ +From 76cf4573219dbf39da4815f0d19638cee0bb4507 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Oct 2021 15:08:30 +0300 +Subject: ARM: dts: omap: fix gpmc,mux-add-data type + +From: Roger Quadros + +[ Upstream commit 51b9e22ffd3c4c56cbb7caae9750f70e55ffa603 ] + +gpmc,mux-add-data is not boolean. + +Fixes the below errors flagged by dtbs_check. + +"ethernet@4,0:gpmc,mux-add-data: True is not of type 'array'" + +Signed-off-by: Roger Quadros +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi | 2 +- + arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi b/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi +index 7f6aefd134514..e7534fe9c53cf 100644 +--- a/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi ++++ b/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi +@@ -29,7 +29,7 @@ + compatible = "smsc,lan9221","smsc,lan9115"; + bank-width = <2>; + +- gpmc,mux-add-data; ++ gpmc,mux-add-data = <0>; + gpmc,cs-on-ns = <0>; + gpmc,cs-rd-off-ns = <42>; + gpmc,cs-wr-off-ns = <36>; +diff --git a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi +index e5da3bc6f1050..218a10c0d8159 100644 +--- a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi ++++ b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi +@@ -22,7 +22,7 @@ + compatible = "smsc,lan9221","smsc,lan9115"; + bank-width = <2>; + +- gpmc,mux-add-data; ++ gpmc,mux-add-data = <0>; + gpmc,cs-on-ns = <0>; + gpmc,cs-rd-off-ns = <42>; + gpmc,cs-wr-off-ns = <36>; +-- +2.33.0 + diff --git a/queue-5.10/arm-dts-qcom-fix-memory-and-mdio-nodes-naming-for-rb.patch b/queue-5.10/arm-dts-qcom-fix-memory-and-mdio-nodes-naming-for-rb.patch new file mode 100644 index 00000000000..126e10569ad --- /dev/null +++ b/queue-5.10/arm-dts-qcom-fix-memory-and-mdio-nodes-naming-for-rb.patch @@ -0,0 +1,51 @@ +From a2eca34e1177e70f48033506cb95fcf49d1f49b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Oct 2021 23:47:41 +0200 +Subject: ARM: dts: qcom: fix memory and mdio nodes naming for RB3011 + +From: David Heidelberg + +[ Upstream commit 14a1f6c9d8017ffbf388e82e1a1f023196d98612 ] + +Fixes warnings regarding to memory and mdio nodes and +apply new naming following dt-schema. + +Signed-off-by: David Heidelberg +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20211020214741.261509-1-david@ixit.cz +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-ipq8064-rb3011.dts | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/qcom-ipq8064-rb3011.dts b/arch/arm/boot/dts/qcom-ipq8064-rb3011.dts +index 282b89ce3d451..33545cf40f3ab 100644 +--- a/arch/arm/boot/dts/qcom-ipq8064-rb3011.dts ++++ b/arch/arm/boot/dts/qcom-ipq8064-rb3011.dts +@@ -19,12 +19,12 @@ + stdout-path = "serial0:115200n8"; + }; + +- memory@0 { ++ memory@42000000 { + reg = <0x42000000 0x3e000000>; + device_type = "memory"; + }; + +- mdio0: mdio@0 { ++ mdio0: mdio-0 { + status = "okay"; + compatible = "virtual,mdio-gpio"; + gpios = <&qcom_pinmux 1 GPIO_ACTIVE_HIGH>, +@@ -91,7 +91,7 @@ + }; + }; + +- mdio1: mdio@1 { ++ mdio1: mdio-1 { + status = "okay"; + compatible = "virtual,mdio-gpio"; + gpios = <&qcom_pinmux 11 GPIO_ACTIVE_HIGH>, +-- +2.33.0 + diff --git a/queue-5.10/arm-dts-sunxi-fix-opps-node-name.patch b/queue-5.10/arm-dts-sunxi-fix-opps-node-name.patch new file mode 100644 index 00000000000..320483be69a --- /dev/null +++ b/queue-5.10/arm-dts-sunxi-fix-opps-node-name.patch @@ -0,0 +1,135 @@ +From 0d76ce210c8ddbcc95fae5ea6b0eb9c6ef3df089 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Sep 2021 11:18:42 +0200 +Subject: ARM: dts: sunxi: Fix OPPs node name + +From: Maxime Ripard + +[ Upstream commit ffbe853a3f5a37fa0a511265b21abf097ffdbe45 ] + +The operating-points-v2 nodes are named inconsistently, but mostly +either opp_table0 or gpu-opp-table. However, the underscore is an +invalid character for a node name and the thermal zone binding +explicitly requires that zones are called opp-table-*. Let's fix it. + +Signed-off-by: Maxime Ripard +Acked-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20210901091852.479202-43-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-a33.dtsi | 4 ++-- + arch/arm/boot/dts/sun8i-a83t.dtsi | 4 ++-- + arch/arm/boot/dts/sun8i-h3.dtsi | 4 ++-- + arch/arm64/boot/dts/allwinner/sun50i-a64-cpu-opp.dtsi | 2 +- + arch/arm64/boot/dts/allwinner/sun50i-h5-cpu-opp.dtsi | 2 +- + arch/arm64/boot/dts/allwinner/sun50i-h6-cpu-opp.dtsi | 2 +- + 6 files changed, 9 insertions(+), 9 deletions(-) + +diff --git a/arch/arm/boot/dts/sun8i-a33.dtsi b/arch/arm/boot/dts/sun8i-a33.dtsi +index c458f5fb124fb..46f4242e9f95d 100644 +--- a/arch/arm/boot/dts/sun8i-a33.dtsi ++++ b/arch/arm/boot/dts/sun8i-a33.dtsi +@@ -46,7 +46,7 @@ + #include + + / { +- cpu0_opp_table: opp_table0 { ++ cpu0_opp_table: opp-table-cpu { + compatible = "operating-points-v2"; + opp-shared; + +@@ -164,7 +164,7 @@ + io-channels = <&ths>; + }; + +- mali_opp_table: gpu-opp-table { ++ mali_opp_table: opp-table-gpu { + compatible = "operating-points-v2"; + + opp-144000000 { +diff --git a/arch/arm/boot/dts/sun8i-a83t.dtsi b/arch/arm/boot/dts/sun8i-a83t.dtsi +index c010b27fdb6a6..a746e449b0bae 100644 +--- a/arch/arm/boot/dts/sun8i-a83t.dtsi ++++ b/arch/arm/boot/dts/sun8i-a83t.dtsi +@@ -200,7 +200,7 @@ + status = "disabled"; + }; + +- cpu0_opp_table: opp_table0 { ++ cpu0_opp_table: opp-table-cluster0 { + compatible = "operating-points-v2"; + opp-shared; + +@@ -253,7 +253,7 @@ + }; + }; + +- cpu1_opp_table: opp_table1 { ++ cpu1_opp_table: opp-table-cluster1 { + compatible = "operating-points-v2"; + opp-shared; + +diff --git a/arch/arm/boot/dts/sun8i-h3.dtsi b/arch/arm/boot/dts/sun8i-h3.dtsi +index 4e89701df91f8..ae4f933abb895 100644 +--- a/arch/arm/boot/dts/sun8i-h3.dtsi ++++ b/arch/arm/boot/dts/sun8i-h3.dtsi +@@ -44,7 +44,7 @@ + #include + + / { +- cpu0_opp_table: opp_table0 { ++ cpu0_opp_table: opp-table-cpu { + compatible = "operating-points-v2"; + opp-shared; + +@@ -112,7 +112,7 @@ + }; + }; + +- gpu_opp_table: gpu-opp-table { ++ gpu_opp_table: opp-table-gpu { + compatible = "operating-points-v2"; + + opp-120000000 { +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-cpu-opp.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64-cpu-opp.dtsi +index 578c37490d901..e39db51eb4489 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-cpu-opp.dtsi ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-cpu-opp.dtsi +@@ -4,7 +4,7 @@ + */ + + / { +- cpu0_opp_table: opp_table0 { ++ cpu0_opp_table: opp-table-cpu { + compatible = "operating-points-v2"; + opp-shared; + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-cpu-opp.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h5-cpu-opp.dtsi +index b2657201957eb..1afad8b437d72 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-cpu-opp.dtsi ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-cpu-opp.dtsi +@@ -2,7 +2,7 @@ + // Copyright (C) 2020 Chen-Yu Tsai + + / { +- cpu_opp_table: cpu-opp-table { ++ cpu_opp_table: opp-table-cpu { + compatible = "operating-points-v2"; + opp-shared; + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-cpu-opp.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6-cpu-opp.dtsi +index 1a5eddc5a40f3..653452926d857 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-cpu-opp.dtsi ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-cpu-opp.dtsi +@@ -3,7 +3,7 @@ + // Copyright (C) 2020 Clément Péron + + / { +- cpu_opp_table: cpu-opp-table { ++ cpu_opp_table: opp-table-cpu { + compatible = "allwinner,sun50i-h6-operating-points"; + nvmem-cells = <&cpu_speed_grade>; + opp-shared; +-- +2.33.0 + diff --git a/queue-5.10/arm-dts-ux500-skomer-regulator-fixes.patch b/queue-5.10/arm-dts-ux500-skomer-regulator-fixes.patch new file mode 100644 index 00000000000..fd5144a9964 --- /dev/null +++ b/queue-5.10/arm-dts-ux500-skomer-regulator-fixes.patch @@ -0,0 +1,50 @@ +From 3c8a7953d2c04d14e08804896cafa6475d273632 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 00:00:04 +0200 +Subject: ARM: dts: ux500: Skomer regulator fixes + +From: Linus Walleij + +[ Upstream commit 7aee0288beab72cdfa35af51f62e94373fca595d ] + +AUX2 has slightly wrong voltage and AUX5 doesn't need to be +always on. + +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ste-ux500-samsung-skomer.dts | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/ste-ux500-samsung-skomer.dts b/arch/arm/boot/dts/ste-ux500-samsung-skomer.dts +index 27722c42b61c4..08bddbf0336da 100644 +--- a/arch/arm/boot/dts/ste-ux500-samsung-skomer.dts ++++ b/arch/arm/boot/dts/ste-ux500-samsung-skomer.dts +@@ -262,10 +262,10 @@ + }; + + ab8500_ldo_aux2 { +- /* Supplies the Cypress TMA140 touchscreen only with 3.3V */ ++ /* Supplies the Cypress TMA140 touchscreen only with 3.0V */ + regulator-name = "AUX2"; +- regulator-min-microvolt = <3300000>; +- regulator-max-microvolt = <3300000>; ++ regulator-min-microvolt = <3000000>; ++ regulator-max-microvolt = <3000000>; + }; + + ab8500_ldo_aux3 { +@@ -284,9 +284,9 @@ + + ab8500_ldo_aux5 { + regulator-name = "AUX5"; ++ /* Intended for 1V8 for touchscreen but actually left unused */ + regulator-min-microvolt = <1050000>; + regulator-max-microvolt = <2790000>; +- regulator-always-on; + }; + + ab8500_ldo_aux6 { +-- +2.33.0 + diff --git a/queue-5.10/arm64-dts-allwinner-a100-fix-thermal-zone-node-name.patch b/queue-5.10/arm64-dts-allwinner-a100-fix-thermal-zone-node-name.patch new file mode 100644 index 00000000000..321adf1be9f --- /dev/null +++ b/queue-5.10/arm64-dts-allwinner-a100-fix-thermal-zone-node-name.patch @@ -0,0 +1,52 @@ +From 5cf820a62b7dc772f20af6eacd42834b9a884f22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Sep 2021 11:18:49 +0200 +Subject: arm64: dts: allwinner: a100: Fix thermal zone node name + +From: Maxime Ripard + +[ Upstream commit 5c34c4e46e601554bfa370b23c8ae3c3c734e9f7 ] + +The thermal zones one the A100 are called $device-thermal-zone. + +However, the thermal zone binding explicitly requires that zones are +called *-thermal. Let's fix it. + +Signed-off-by: Maxime Ripard +Acked-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20210901091852.479202-50-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-a100.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a100.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a100.dtsi +index cc321c04f1219..f6d7d7f7fdabe 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a100.dtsi ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a100.dtsi +@@ -343,19 +343,19 @@ + }; + + thermal-zones { +- cpu-thermal-zone { ++ cpu-thermal { + polling-delay-passive = <0>; + polling-delay = <0>; + thermal-sensors = <&ths 0>; + }; + +- ddr-thermal-zone { ++ ddr-thermal { + polling-delay-passive = <0>; + polling-delay = <0>; + thermal-sensors = <&ths 2>; + }; + +- gpu-thermal-zone { ++ gpu-thermal { + polling-delay-passive = <0>; + polling-delay = <0>; + thermal-sensors = <&ths 1>; +-- +2.33.0 + diff --git a/queue-5.10/arm64-dts-allwinner-h5-fix-gpu-thermal-zone-node-nam.patch b/queue-5.10/arm64-dts-allwinner-h5-fix-gpu-thermal-zone-node-nam.patch new file mode 100644 index 00000000000..37440e8aed2 --- /dev/null +++ b/queue-5.10/arm64-dts-allwinner-h5-fix-gpu-thermal-zone-node-nam.patch @@ -0,0 +1,37 @@ +From 3a72d4e7ead10d027e7528c7f2e577bf4640f96a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Sep 2021 11:18:47 +0200 +Subject: arm64: dts: allwinner: h5: Fix GPU thermal zone node name + +From: Maxime Ripard + +[ Upstream commit 94a0f2b0e4e0953d8adf319c44244ef7a57de32c ] + +The GPU thermal zone is named gpu_thermal. However, the underscore is +an invalid character for a node name and the thermal zone binding +explicitly requires that zones are called *-thermal. Let's fix it. + +Signed-off-by: Maxime Ripard +Acked-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20210901091852.479202-48-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi +index 10489e5086956..0ee8a5adf02b0 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi +@@ -204,7 +204,7 @@ + }; + }; + +- gpu_thermal { ++ gpu-thermal { + polling-delay-passive = <0>; + polling-delay = <0>; + thermal-sensors = <&ths 1>; +-- +2.33.0 + diff --git a/queue-5.10/arm64-dts-freescale-fix-arm-sp805-compatible-string.patch b/queue-5.10/arm64-dts-freescale-fix-arm-sp805-compatible-string.patch new file mode 100644 index 00000000000..3582f53fd0c --- /dev/null +++ b/queue-5.10/arm64-dts-freescale-fix-arm-sp805-compatible-string.patch @@ -0,0 +1,164 @@ +From 318ab248ac9b2dbdab92768c9e81cbf8d62d28d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Aug 2021 14:35:28 +0200 +Subject: arm64: dts: freescale: fix arm,sp805 compatible string + +From: Michael Walle + +[ Upstream commit 99a7cacc66cae92db40139b57689be2af75fc6b8 ] + +According to Documentation/devicetree/bindings/watchdog/arm,sp805.yaml +the compatible is: + compatible = "arm,sp805", "arm,primecell"; + +The current compatible string doesn't exist at all. Fix it. + +Signed-off-by: Michael Walle +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi | 16 ++++++++-------- + arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi | 16 ++++++++-------- + 2 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi +index 692d8f4a206da..334af263d7b5d 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi +@@ -673,56 +673,56 @@ + }; + + cluster1_core0_watchdog: wdt@c000000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc000000 0x0 0x1000>; + clocks = <&clockgen 4 15>, <&clockgen 4 15>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster1_core1_watchdog: wdt@c010000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc010000 0x0 0x1000>; + clocks = <&clockgen 4 15>, <&clockgen 4 15>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster1_core2_watchdog: wdt@c020000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc020000 0x0 0x1000>; + clocks = <&clockgen 4 15>, <&clockgen 4 15>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster1_core3_watchdog: wdt@c030000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc030000 0x0 0x1000>; + clocks = <&clockgen 4 15>, <&clockgen 4 15>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster2_core0_watchdog: wdt@c100000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc100000 0x0 0x1000>; + clocks = <&clockgen 4 15>, <&clockgen 4 15>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster2_core1_watchdog: wdt@c110000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc110000 0x0 0x1000>; + clocks = <&clockgen 4 15>, <&clockgen 4 15>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster2_core2_watchdog: wdt@c120000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc120000 0x0 0x1000>; + clocks = <&clockgen 4 15>, <&clockgen 4 15>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster2_core3_watchdog: wdt@c130000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc130000 0x0 0x1000>; + clocks = <&clockgen 4 15>, <&clockgen 4 15>; + clock-names = "wdog_clk", "apb_pclk"; +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi +index 4d34d82b898a4..eb6641a3566e1 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi +@@ -351,56 +351,56 @@ + }; + + cluster1_core0_watchdog: wdt@c000000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc000000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster1_core1_watchdog: wdt@c010000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc010000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster2_core0_watchdog: wdt@c100000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc100000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster2_core1_watchdog: wdt@c110000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc110000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster3_core0_watchdog: wdt@c200000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc200000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster3_core1_watchdog: wdt@c210000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc210000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster4_core0_watchdog: wdt@c300000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc300000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster4_core1_watchdog: wdt@c310000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc310000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; +-- +2.33.0 + diff --git a/queue-5.10/arm64-dts-hisilicon-fix-arm-sp805-compatible-string.patch b/queue-5.10/arm64-dts-hisilicon-fix-arm-sp805-compatible-string.patch new file mode 100644 index 00000000000..cb31bdd63e5 --- /dev/null +++ b/queue-5.10/arm64-dts-hisilicon-fix-arm-sp805-compatible-string.patch @@ -0,0 +1,61 @@ +From d2011e44150c4c2ea9339ef10852f70c80347171 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Aug 2021 18:51:13 +0200 +Subject: arm64: dts: hisilicon: fix arm,sp805 compatible string + +From: Michael Walle + +[ Upstream commit 894d4f1f77d0e88f1f81af2e1e37333c1c41b631 ] + +According to Documentation/devicetree/bindings/watchdog/arm,sp805.yaml +the compatible is: + compatible = "arm,sp805", "arm,primecell"; + +The current compatible string doesn't exist at all. Fix it. + +Signed-off-by: Michael Walle +Signed-off-by: Wei Xu +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/hisilicon/hi3660.dtsi | 4 ++-- + arch/arm64/boot/dts/hisilicon/hi6220.dtsi | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/hisilicon/hi3660.dtsi b/arch/arm64/boot/dts/hisilicon/hi3660.dtsi +index 994140fbc916e..fe4dce23ef7e1 100644 +--- a/arch/arm64/boot/dts/hisilicon/hi3660.dtsi ++++ b/arch/arm64/boot/dts/hisilicon/hi3660.dtsi +@@ -1086,7 +1086,7 @@ + }; + + watchdog0: watchdog@e8a06000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xe8a06000 0x0 0x1000>; + interrupts = ; + clocks = <&crg_ctrl HI3660_OSC32K>, +@@ -1095,7 +1095,7 @@ + }; + + watchdog1: watchdog@e8a07000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xe8a07000 0x0 0x1000>; + interrupts = ; + clocks = <&crg_ctrl HI3660_OSC32K>, +diff --git a/arch/arm64/boot/dts/hisilicon/hi6220.dtsi b/arch/arm64/boot/dts/hisilicon/hi6220.dtsi +index 014735a9bc731..fbce014bdc270 100644 +--- a/arch/arm64/boot/dts/hisilicon/hi6220.dtsi ++++ b/arch/arm64/boot/dts/hisilicon/hi6220.dtsi +@@ -840,7 +840,7 @@ + }; + + watchdog0: watchdog@f8005000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xf8005000 0x0 0x1000>; + interrupts = ; + clocks = <&ao_ctrl HI6220_WDT0_PCLK>, +-- +2.33.0 + diff --git a/queue-5.10/arm64-dts-qcom-ipq6018-fix-qcom-controlled-remotely-.patch b/queue-5.10/arm64-dts-qcom-ipq6018-fix-qcom-controlled-remotely-.patch new file mode 100644 index 00000000000..2a2f4de9b99 --- /dev/null +++ b/queue-5.10/arm64-dts-qcom-ipq6018-fix-qcom-controlled-remotely-.patch @@ -0,0 +1,35 @@ +From e2a45282a26d7acf27afa2b9756538e22e2d569a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Aug 2021 19:16:26 +0800 +Subject: arm64: dts: qcom: ipq6018: Fix qcom,controlled-remotely property + +From: Shawn Guo + +[ Upstream commit 3509de752ea14c7e5781b3a56a4a0bf832f5723a ] + +Property qcom,controlled-remotely should be boolean. Fix it. + +Signed-off-by: Shawn Guo +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20210829111628.5543-2-shawn.guo@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq6018.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +index 3ceb36cac512f..9cb8f7a052df9 100644 +--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +@@ -200,7 +200,7 @@ + clock-names = "bam_clk"; + #dma-cells = <1>; + qcom,ee = <1>; +- qcom,controlled-remotely = <1>; ++ qcom,controlled-remotely; + qcom,config-pipe-trust-reg = <0>; + }; + +-- +2.33.0 + diff --git a/queue-5.10/arm64-dts-qcom-msm8916-add-cpu-acc-and-saw-spm.patch b/queue-5.10/arm64-dts-qcom-msm8916-add-cpu-acc-and-saw-spm.patch new file mode 100644 index 00000000000..154089f4522 --- /dev/null +++ b/queue-5.10/arm64-dts-qcom-msm8916-add-cpu-acc-and-saw-spm.patch @@ -0,0 +1,131 @@ +From eed9a37a47452c7b83480a6b9d575a6cfd9cdc1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 22:49:53 +0200 +Subject: arm64: dts: qcom: msm8916: Add CPU ACC and SAW/SPM + +From: Stephan Gerhold + +[ Upstream commit a22f9a766e1dc61f8f6ee2edfe83d4d23d78e059 ] + +Add the device tree nodes necessary for SMP bring-up and cpuidle +without PSCI on ARM32. The hardware is typically controlled by the +PSCI implementation in the TrustZone firmware and is therefore marked +as status = "reserved" by default (from the device tree specification): + + "Indicates that the device is operational, but should not be used. + Typically this is used for devices that are controlled by another + software component, such as platform firmware." + +Since this is part of the MSM8916 SoC it should be added to msm8916.dtsi +but in practice these nodes should only get enabled via an extra include +on ARM32. + +This is necessary for some devices with signed firmware which is missing +both ARM64 and PSCI support and can therefore only boot ARM32 kernels. + +Signed-off-by: Stephan Gerhold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20211004204955.21077-13-stephan@gerhold.net +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8916.dtsi | 56 +++++++++++++++++++++++++++ + 1 file changed, 56 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi +index d26f9acf8e126..fd4c44b8eb58a 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi +@@ -123,6 +123,8 @@ + #cooling-cells = <2>; + power-domains = <&CPU_PD0>; + power-domain-names = "psci"; ++ qcom,acc = <&cpu0_acc>; ++ qcom,saw = <&cpu0_saw>; + }; + + CPU1: cpu@1 { +@@ -136,6 +138,8 @@ + #cooling-cells = <2>; + power-domains = <&CPU_PD1>; + power-domain-names = "psci"; ++ qcom,acc = <&cpu1_acc>; ++ qcom,saw = <&cpu1_saw>; + }; + + CPU2: cpu@2 { +@@ -149,6 +153,8 @@ + #cooling-cells = <2>; + power-domains = <&CPU_PD2>; + power-domain-names = "psci"; ++ qcom,acc = <&cpu2_acc>; ++ qcom,saw = <&cpu2_saw>; + }; + + CPU3: cpu@3 { +@@ -162,6 +168,8 @@ + #cooling-cells = <2>; + power-domains = <&CPU_PD3>; + power-domain-names = "psci"; ++ qcom,acc = <&cpu3_acc>; ++ qcom,saw = <&cpu3_saw>; + }; + + L2_0: l2-cache { +@@ -1794,6 +1802,54 @@ + status = "disabled"; + }; + }; ++ ++ cpu0_acc: power-manager@b088000 { ++ compatible = "qcom,msm8916-acc"; ++ reg = <0x0b088000 0x1000>; ++ status = "reserved"; /* Controlled by PSCI firmware */ ++ }; ++ ++ cpu0_saw: power-manager@b089000 { ++ compatible = "qcom,msm8916-saw2-v3.0-cpu", "qcom,saw2"; ++ reg = <0x0b089000 0x1000>; ++ status = "reserved"; /* Controlled by PSCI firmware */ ++ }; ++ ++ cpu1_acc: power-manager@b098000 { ++ compatible = "qcom,msm8916-acc"; ++ reg = <0x0b098000 0x1000>; ++ status = "reserved"; /* Controlled by PSCI firmware */ ++ }; ++ ++ cpu1_saw: power-manager@b099000 { ++ compatible = "qcom,msm8916-saw2-v3.0-cpu", "qcom,saw2"; ++ reg = <0x0b099000 0x1000>; ++ status = "reserved"; /* Controlled by PSCI firmware */ ++ }; ++ ++ cpu2_acc: power-manager@b0a8000 { ++ compatible = "qcom,msm8916-acc"; ++ reg = <0x0b0a8000 0x1000>; ++ status = "reserved"; /* Controlled by PSCI firmware */ ++ }; ++ ++ cpu2_saw: power-manager@b0a9000 { ++ compatible = "qcom,msm8916-saw2-v3.0-cpu", "qcom,saw2"; ++ reg = <0x0b0a9000 0x1000>; ++ status = "reserved"; /* Controlled by PSCI firmware */ ++ }; ++ ++ cpu3_acc: power-manager@b0b8000 { ++ compatible = "qcom,msm8916-acc"; ++ reg = <0x0b0b8000 0x1000>; ++ status = "reserved"; /* Controlled by PSCI firmware */ ++ }; ++ ++ cpu3_saw: power-manager@b0b9000 { ++ compatible = "qcom,msm8916-saw2-v3.0-cpu", "qcom,saw2"; ++ reg = <0x0b0b9000 0x1000>; ++ status = "reserved"; /* Controlled by PSCI firmware */ ++ }; + }; + + thermal-zones { +-- +2.33.0 + diff --git a/queue-5.10/arm64-dts-qcom-msm8916-add-unit-name-for-soc-node.patch b/queue-5.10/arm64-dts-qcom-msm8916-add-unit-name-for-soc-node.patch new file mode 100644 index 00000000000..470b0097bef --- /dev/null +++ b/queue-5.10/arm64-dts-qcom-msm8916-add-unit-name-for-soc-node.patch @@ -0,0 +1,38 @@ +From 13f3fed257093ae8496db10d29ba5d200e460e41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Sep 2021 17:21:18 +0200 +Subject: arm64: dts: qcom: msm8916: Add unit name for /soc node + +From: Stephan Gerhold + +[ Upstream commit 7a62bfebc8c94bdb6eb8f54f49889dc6b5b79601 ] + +This fixes the following warning when building with W=1: +Warning (unit_address_vs_reg): /soc: node has a reg or ranges property, +but no unit name + +Signed-off-by: Stephan Gerhold +Reviewed-by: Stephen Boyd +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20210921152120.6710-1-stephan@gerhold.net +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi +index b1ffc056eea0b..d26f9acf8e126 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi +@@ -384,7 +384,7 @@ + }; + }; + +- soc: soc { ++ soc: soc@0 { + #address-cells = <1>; + #size-cells = <1>; + ranges = <0 0 0 0xffffffff>; +-- +2.33.0 + diff --git a/queue-5.10/arm64-dts-qcom-msm8998-fix-cpu-l2-idle-state-latency.patch b/queue-5.10/arm64-dts-qcom-msm8998-fix-cpu-l2-idle-state-latency.patch new file mode 100644 index 00000000000..92be6fba71e --- /dev/null +++ b/queue-5.10/arm64-dts-qcom-msm8998-fix-cpu-l2-idle-state-latency.patch @@ -0,0 +1,95 @@ +From 7a0bb5207390034befdde9425552253882529378 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Sep 2021 20:31:21 +0200 +Subject: arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and + residency + +From: AngeloGioacchino Del Regno + +[ Upstream commit 3f1dcaff642e75c1d2ad03f783fa8a3b1f56dd50 ] + +The entry/exit latency and minimum residency in state for the idle +states of MSM8998 were ..bad: first of all, for all of them the +timings were written for CPU sleep but the min-residency-us param +was miscalculated (supposedly, while porting this from downstream); +Then, the power collapse states are setting PC on both the CPU +cluster *and* the L2 cache, which have different timings: in the +specific case of L2 the times are higher so these ones should be +taken into account instead of the CPU ones. + +This parameter misconfiguration was not giving particular issues +because on MSM8998 there was no CPU scaling at all, so cluster/L2 +power collapse was rarely (if ever) hit. +When CPU scaling is enabled, though, the wrong timings will produce +SoC unstability shown to the user as random, apparently error-less, +sudden reboots and/or lockups. + +This set of parameters are stabilizing the SoC when CPU scaling is +ON and when power collapse is frequently hit. + +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20210901183123.1087392-3-angelogioacchino.delregno@somainline.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8998.dtsi | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi +index c45870600909f..9e04ac3f596d0 100644 +--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi +@@ -300,38 +300,42 @@ + LITTLE_CPU_SLEEP_0: cpu-sleep-0-0 { + compatible = "arm,idle-state"; + idle-state-name = "little-retention"; ++ /* CPU Retention (C2D), L2 Active */ + arm,psci-suspend-param = <0x00000002>; + entry-latency-us = <81>; + exit-latency-us = <86>; +- min-residency-us = <200>; ++ min-residency-us = <504>; + }; + + LITTLE_CPU_SLEEP_1: cpu-sleep-0-1 { + compatible = "arm,idle-state"; + idle-state-name = "little-power-collapse"; ++ /* CPU + L2 Power Collapse (C3, D4) */ + arm,psci-suspend-param = <0x40000003>; +- entry-latency-us = <273>; +- exit-latency-us = <612>; +- min-residency-us = <1000>; ++ entry-latency-us = <814>; ++ exit-latency-us = <4562>; ++ min-residency-us = <9183>; + local-timer-stop; + }; + + BIG_CPU_SLEEP_0: cpu-sleep-1-0 { + compatible = "arm,idle-state"; + idle-state-name = "big-retention"; ++ /* CPU Retention (C2D), L2 Active */ + arm,psci-suspend-param = <0x00000002>; + entry-latency-us = <79>; + exit-latency-us = <82>; +- min-residency-us = <200>; ++ min-residency-us = <1302>; + }; + + BIG_CPU_SLEEP_1: cpu-sleep-1-1 { + compatible = "arm,idle-state"; + idle-state-name = "big-power-collapse"; ++ /* CPU + L2 Power Collapse (C3, D4) */ + arm,psci-suspend-param = <0x40000003>; +- entry-latency-us = <336>; +- exit-latency-us = <525>; +- min-residency-us = <1000>; ++ entry-latency-us = <724>; ++ exit-latency-us = <2027>; ++ min-residency-us = <9419>; + local-timer-stop; + }; + }; +-- +2.33.0 + diff --git a/queue-5.10/arm64-dts-rockchip-disable-cdn-dp-on-pinebook-pro.patch b/queue-5.10/arm64-dts-rockchip-disable-cdn-dp-on-pinebook-pro.patch new file mode 100644 index 00000000000..7a112f67e63 --- /dev/null +++ b/queue-5.10/arm64-dts-rockchip-disable-cdn-dp-on-pinebook-pro.patch @@ -0,0 +1,43 @@ +From dab11918fd85547bfc42e6f0089be4b5df40c7b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jul 2021 18:41:01 +0200 +Subject: arm64: dts: rockchip: Disable CDN DP on Pinebook Pro + +From: Matthias Brugger + +[ Upstream commit 2513fa5c25d42f55ca5f0f0ab247af7c9fbfa3b1 ] + +The CDN DP needs a PHY and a extcon to work correctly. But no extcon is +provided by the device-tree, which leads to an error: +cdn-dp fec00000.dp: [drm:cdn_dp_probe [rockchipdrm]] *ERROR* missing extcon or phy +cdn-dp: probe of fec00000.dp failed with error -22 + +Disable the CDN DP to make graphic work on the Pinebook Pro. + +Reported-by: Guillaume Gardet +Signed-off-by: Matthias Brugger +Link: https://lore.kernel.org/r/20210715164101.11486-1-matthias.bgg@kernel.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +index 219b7507a10fb..4297c1db5a413 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +@@ -379,10 +379,6 @@ + }; + }; + +-&cdn_dp { +- status = "okay"; +-}; +- + &cpu_b0 { + cpu-supply = <&vdd_cpu_b>; + }; +-- +2.33.0 + diff --git a/queue-5.10/arm64-zynqmp-do-not-duplicate-flash-partition-label-.patch b/queue-5.10/arm64-zynqmp-do-not-duplicate-flash-partition-label-.patch new file mode 100644 index 00000000000..00e56c39d1d --- /dev/null +++ b/queue-5.10/arm64-zynqmp-do-not-duplicate-flash-partition-label-.patch @@ -0,0 +1,54 @@ +From eb6f4ff38a3766a5f6ba7c54f77902f14e660f59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Jun 2021 17:25:10 +0200 +Subject: arm64: zynqmp: Do not duplicate flash partition label property + +From: Amit Kumar Mahapatra + +[ Upstream commit 167721a5909f867f8c18c8e78ea58e705ad9bbd4 ] + +In kernel 5.4, support has been added for reading MTD devices via the nvmem +API. +For this the mtd devices are registered as read-only NVMEM providers under +sysfs with the same name as the flash partition label property. + +So if flash partition label property of multiple flash devices are +identical then the second mtd device fails to get registered as a NVMEM +provider. + +This patch fixes the issue by having different label property for different +flashes. + +Signed-off-by: Amit Kumar Mahapatra +Signed-off-by: Michal Simek +Link: https://lore.kernel.org/r/6c4b9b9232b93d9e316a63c086540fd5bf6b8687.1623684253.git.michal.simek@xilinx.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts +index 4a86efa32d687..f7124e15f0ff6 100644 +--- a/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts ++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts +@@ -131,7 +131,7 @@ + reg = <0>; + + partition@0 { +- label = "data"; ++ label = "spi0-data"; + reg = <0x0 0x100000>; + }; + }; +@@ -149,7 +149,7 @@ + reg = <0>; + + partition@0 { +- label = "data"; ++ label = "spi1-data"; + reg = <0x0 0x84000>; + }; + }; +-- +2.33.0 + diff --git a/queue-5.10/arm64-zynqmp-fix-serial-compatible-string.patch b/queue-5.10/arm64-zynqmp-fix-serial-compatible-string.patch new file mode 100644 index 00000000000..9cdf764c4c3 --- /dev/null +++ b/queue-5.10/arm64-zynqmp-fix-serial-compatible-string.patch @@ -0,0 +1,46 @@ +From 80aa70624267adc57b90518b84f565c9ec53f5fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Aug 2021 10:58:29 +0200 +Subject: arm64: zynqmp: Fix serial compatible string + +From: Michal Simek + +[ Upstream commit 812fa2f0e9d33564bd0131a69750e0d165f4c82a ] + +Based on commit 65a2c14d4f00 ("dt-bindings: serial: convert Cadence UART +bindings to YAML") compatible string should look like differently that's +why fix it to be aligned with dt binding. + +Signed-off-by: Michal Simek +Reviewed-by: Laurent Pinchart +Link: https://lore.kernel.org/r/89b36e0a6187cc6b05b27a035efdf79173bd4486.1628240307.git.michal.simek@xilinx.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +index 771f60e0346d0..9e198cacc37dd 100644 +--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi ++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +@@ -688,7 +688,7 @@ + }; + + uart0: serial@ff000000 { +- compatible = "cdns,uart-r1p12", "xlnx,xuartps"; ++ compatible = "xlnx,zynqmp-uart", "cdns,uart-r1p12"; + status = "disabled"; + interrupt-parent = <&gic>; + interrupts = <0 21 4>; +@@ -698,7 +698,7 @@ + }; + + uart1: serial@ff010000 { +- compatible = "cdns,uart-r1p12", "xlnx,xuartps"; ++ compatible = "xlnx,zynqmp-uart", "cdns,uart-r1p12"; + status = "disabled"; + interrupt-parent = <&gic>; + interrupts = <0 22 4>; +-- +2.33.0 + diff --git a/queue-5.10/asoc-intel-sof_sdw-add-missing-quirk-for-dell-sku-0a.patch b/queue-5.10/asoc-intel-sof_sdw-add-missing-quirk-for-dell-sku-0a.patch new file mode 100644 index 00000000000..d0c653814d5 --- /dev/null +++ b/queue-5.10/asoc-intel-sof_sdw-add-missing-quirk-for-dell-sku-0a.patch @@ -0,0 +1,47 @@ +From 3e4b711a9cbf3797c80562499e363e2ef9929879 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 16:35:12 -0500 +Subject: ASoC: Intel: sof_sdw: add missing quirk for Dell SKU 0A45 + +From: Pierre-Louis Bossart + +[ Upstream commit 64ba6d2ce72ffde70dc5a1794917bf1573203716 ] + +This device is based on SDCA codecs but with a single amplifier +instead of two. + +BugLink: https://github.com/thesofproject/linux/issues/3161 +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Rander Wang +Reviewed-by: Bard Liao +Link: https://lore.kernel.org/r/20211004213512.220836-6-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_sdw.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index 25548555d8d79..d9b864856be19 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -187,6 +187,16 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + SOF_RT715_DAI_ID_FIX | + SOF_SDW_FOUR_SPK), + }, ++ { ++ .callback = sof_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0A45") ++ }, ++ .driver_data = (void *)(SOF_SDW_TGL_HDMI | ++ RT711_JD2 | ++ SOF_RT715_DAI_ID_FIX), ++ }, + /* AlderLake devices */ + { + .callback = sof_sdw_quirk_cb, +-- +2.33.0 + diff --git a/queue-5.10/asoc-nau8824-add-dmi-quirk-mechanism-for-active-high.patch b/queue-5.10/asoc-nau8824-add-dmi-quirk-mechanism-for-active-high.patch new file mode 100644 index 00000000000..ef0686fa85a --- /dev/null +++ b/queue-5.10/asoc-nau8824-add-dmi-quirk-mechanism-for-active-high.patch @@ -0,0 +1,98 @@ +From a82a9c1a2e3dc1c8dedcd1bb9a74bcf5142b79e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Oct 2021 23:14:57 +0200 +Subject: ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect + +From: Hans de Goede + +[ Upstream commit 92d3360108f1839ca40451bad20ff67dd24a1964 ] + +Add a quirk mechanism to allow specifying that active-high jack-detection +should be used on platforms where this info is not available in devicetree. + +And add an entry for the Cyberbook T116 tablet to the DMI table, so that +jack-detection will work properly on this tablet. + +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20211002211459.110124-2-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8824.c | 40 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 40 insertions(+) + +diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c +index 15bd8335f6678..c8ccfa2fff848 100644 +--- a/sound/soc/codecs/nau8824.c ++++ b/sound/soc/codecs/nau8824.c +@@ -8,6 +8,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -27,6 +28,12 @@ + + #include "nau8824.h" + ++#define NAU8824_JD_ACTIVE_HIGH BIT(0) ++ ++static int nau8824_quirk; ++static int quirk_override = -1; ++module_param_named(quirk, quirk_override, uint, 0444); ++MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static int nau8824_config_sysclk(struct nau8824 *nau8824, + int clk_id, unsigned int freq); +@@ -1875,6 +1882,34 @@ static int nau8824_read_device_properties(struct device *dev, + return 0; + } + ++/* Please keep this list alphabetically sorted */ ++static const struct dmi_system_id nau8824_quirk_table[] = { ++ { ++ /* Cyberbook T116 rugged tablet */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "20170531"), ++ }, ++ .driver_data = (void *)(NAU8824_JD_ACTIVE_HIGH), ++ }, ++ {} ++}; ++ ++static void nau8824_check_quirks(void) ++{ ++ const struct dmi_system_id *dmi_id; ++ ++ if (quirk_override != -1) { ++ nau8824_quirk = quirk_override; ++ return; ++ } ++ ++ dmi_id = dmi_first_match(nau8824_quirk_table); ++ if (dmi_id) ++ nau8824_quirk = (unsigned long)dmi_id->driver_data; ++} ++ + static int nau8824_i2c_probe(struct i2c_client *i2c, + const struct i2c_device_id *id) + { +@@ -1899,6 +1934,11 @@ static int nau8824_i2c_probe(struct i2c_client *i2c, + nau8824->irq = i2c->irq; + sema_init(&nau8824->jd_sem, 1); + ++ nau8824_check_quirks(); ++ ++ if (nau8824_quirk & NAU8824_JD_ACTIVE_HIGH) ++ nau8824->jkdet_polarity = 0; ++ + nau8824_print_device_properties(nau8824); + + ret = regmap_read(nau8824->regmap, NAU8824_REG_I2C_DEVICE_ID, &value); +-- +2.33.0 + diff --git a/queue-5.10/asoc-sof-intel-hda-dai-fix-potential-locking-issue.patch b/queue-5.10/asoc-sof-intel-hda-dai-fix-potential-locking-issue.patch new file mode 100644 index 00000000000..6ed31d35e9a --- /dev/null +++ b/queue-5.10/asoc-sof-intel-hda-dai-fix-potential-locking-issue.patch @@ -0,0 +1,53 @@ +From cc0802df67f89fc414508b71a199d477beed475a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Sep 2021 14:24:17 -0500 +Subject: ASoC: SOF: Intel: hda-dai: fix potential locking issue + +From: Pierre-Louis Bossart + +[ Upstream commit a20f3b10de61add5e14b6ce4df982f4df2a4cbbc ] + +The initial hdac_stream code was adapted a third time with the same +locking issues. Move the spin_lock outside the loops and make sure the +fields are protected on read/write. + +Signed-off-by: Pierre-Louis Bossart +Acked-by: Mark Brown +Link: https://lore.kernel.org/r/20210924192417.169243-5-pierre-louis.bossart@linux.intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-dai.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c +index c6cb8c212eca5..ef316311e959a 100644 +--- a/sound/soc/sof/intel/hda-dai.c ++++ b/sound/soc/sof/intel/hda-dai.c +@@ -68,6 +68,7 @@ static struct hdac_ext_stream * + return NULL; + } + ++ spin_lock_irq(&bus->reg_lock); + list_for_each_entry(stream, &bus->stream_list, list) { + struct hdac_ext_stream *hstream = + stream_to_hdac_ext_stream(stream); +@@ -107,12 +108,12 @@ static struct hdac_ext_stream * + * is updated in snd_hdac_ext_stream_decouple(). + */ + if (!res->decoupled) +- snd_hdac_ext_stream_decouple(bus, res, true); +- spin_lock_irq(&bus->reg_lock); ++ snd_hdac_ext_stream_decouple_locked(bus, res, true); ++ + res->link_locked = 1; + res->link_substream = substream; +- spin_unlock_irq(&bus->reg_lock); + } ++ spin_unlock_irq(&bus->reg_lock); + + return res; + } +-- +2.33.0 + diff --git a/queue-5.10/blkcg-remove-extra-blkcg_bio_issue_init.patch b/queue-5.10/blkcg-remove-extra-blkcg_bio_issue_init.patch new file mode 100644 index 00000000000..e3b2c40afd2 --- /dev/null +++ b/queue-5.10/blkcg-remove-extra-blkcg_bio_issue_init.patch @@ -0,0 +1,147 @@ +From e163ff0c7dfca67845920ee629143ab9068498bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Nov 2021 17:33:54 +0800 +Subject: blkcg: Remove extra blkcg_bio_issue_init + +From: Laibin Qiu + +[ Upstream commit b781d8db580c058ecd54ed7d5dde7f8270b25f5b ] + +KASAN reports a use-after-free report when doing block test: + +================================================================== +[10050.967049] BUG: KASAN: use-after-free in +submit_bio_checks+0x1539/0x1550 + +[10050.977638] Call Trace: +[10050.978190] dump_stack+0x9b/0xce +[10050.979674] print_address_description.constprop.6+0x3e/0x60 +[10050.983510] kasan_report.cold.9+0x22/0x3a +[10050.986089] submit_bio_checks+0x1539/0x1550 +[10050.989576] submit_bio_noacct+0x83/0xc80 +[10050.993714] submit_bio+0xa7/0x330 +[10050.994435] mpage_readahead+0x380/0x500 +[10050.998009] read_pages+0x1c1/0xbf0 +[10051.002057] page_cache_ra_unbounded+0x4c2/0x6f0 +[10051.007413] do_page_cache_ra+0xda/0x110 +[10051.008207] force_page_cache_ra+0x23d/0x3d0 +[10051.009087] page_cache_sync_ra+0xca/0x300 +[10051.009970] generic_file_buffered_read+0xbea/0x2130 +[10051.012685] generic_file_read_iter+0x315/0x490 +[10051.014472] blkdev_read_iter+0x113/0x1b0 +[10051.015300] aio_read+0x2ad/0x450 +[10051.023786] io_submit_one+0xc8e/0x1d60 +[10051.029855] __se_sys_io_submit+0x125/0x350 +[10051.033442] do_syscall_64+0x2d/0x40 +[10051.034156] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +[10051.048733] Allocated by task 18598: +[10051.049482] kasan_save_stack+0x19/0x40 +[10051.050263] __kasan_kmalloc.constprop.1+0xc1/0xd0 +[10051.051230] kmem_cache_alloc+0x146/0x440 +[10051.052060] mempool_alloc+0x125/0x2f0 +[10051.052818] bio_alloc_bioset+0x353/0x590 +[10051.053658] mpage_alloc+0x3b/0x240 +[10051.054382] do_mpage_readpage+0xddf/0x1ef0 +[10051.055250] mpage_readahead+0x264/0x500 +[10051.056060] read_pages+0x1c1/0xbf0 +[10051.056758] page_cache_ra_unbounded+0x4c2/0x6f0 +[10051.057702] do_page_cache_ra+0xda/0x110 +[10051.058511] force_page_cache_ra+0x23d/0x3d0 +[10051.059373] page_cache_sync_ra+0xca/0x300 +[10051.060198] generic_file_buffered_read+0xbea/0x2130 +[10051.061195] generic_file_read_iter+0x315/0x490 +[10051.062189] blkdev_read_iter+0x113/0x1b0 +[10051.063015] aio_read+0x2ad/0x450 +[10051.063686] io_submit_one+0xc8e/0x1d60 +[10051.064467] __se_sys_io_submit+0x125/0x350 +[10051.065318] do_syscall_64+0x2d/0x40 +[10051.066082] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +[10051.067455] Freed by task 13307: +[10051.068136] kasan_save_stack+0x19/0x40 +[10051.068931] kasan_set_track+0x1c/0x30 +[10051.069726] kasan_set_free_info+0x1b/0x30 +[10051.070621] __kasan_slab_free+0x111/0x160 +[10051.071480] kmem_cache_free+0x94/0x460 +[10051.072256] mempool_free+0xd6/0x320 +[10051.072985] bio_free+0xe0/0x130 +[10051.073630] bio_put+0xab/0xe0 +[10051.074252] bio_endio+0x3a6/0x5d0 +[10051.074984] blk_update_request+0x590/0x1370 +[10051.075870] scsi_end_request+0x7d/0x400 +[10051.076667] scsi_io_completion+0x1aa/0xe50 +[10051.077503] scsi_softirq_done+0x11b/0x240 +[10051.078344] blk_mq_complete_request+0xd4/0x120 +[10051.079275] scsi_mq_done+0xf0/0x200 +[10051.080036] virtscsi_vq_done+0xbc/0x150 +[10051.080850] vring_interrupt+0x179/0x390 +[10051.081650] __handle_irq_event_percpu+0xf7/0x490 +[10051.082626] handle_irq_event_percpu+0x7b/0x160 +[10051.083527] handle_irq_event+0xcc/0x170 +[10051.084297] handle_edge_irq+0x215/0xb20 +[10051.085122] asm_call_irq_on_stack+0xf/0x20 +[10051.085986] common_interrupt+0xae/0x120 +[10051.086830] asm_common_interrupt+0x1e/0x40 + +================================================================== + +Bio will be checked at beginning of submit_bio_noacct(). If bio needs +to be throttled, it will start the timer and stop submit bio directly. +Bio will submit in blk_throtl_dispatch_work_fn() when the timer expires. +But in the current process, if bio is throttled, it will still set bio +issue->value by blkcg_bio_issue_init(). This is redundant and may cause +the above use-after-free. + +CPU0 CPU1 +submit_bio +submit_bio_noacct + submit_bio_checks + blk_throtl_bio() + <=mod_timer(&sq->pending_timer + blk_throtl_dispatch_work_fn + submit_bio_noacct() <= bio have + throttle tag, will throw directly + and bio issue->value will be set + here + + bio_endio() + bio_put() + bio_free() <= free this bio + + blkcg_bio_issue_init(bio) + <= bio has been freed and + will lead to UAF + return BLK_QC_T_NONE + +Fix this by remove extra blkcg_bio_issue_init. + +Fixes: e439bedf6b24 (blkcg: consolidate bio_issue_init() to be a part of core) +Signed-off-by: Laibin Qiu +Link: https://lore.kernel.org/r/20211112093354.3581504-1-qiulaibin@huawei.com +Reviewed-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-core.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/block/blk-core.c b/block/blk-core.c +index fbc39756f37de..26664f2a139eb 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -897,10 +897,8 @@ static noinline_for_stack bool submit_bio_checks(struct bio *bio) + if (unlikely(!current->io_context)) + create_task_io_context(current, GFP_ATOMIC, q->node); + +- if (blk_throtl_bio(bio)) { +- blkcg_bio_issue_init(bio); ++ if (blk_throtl_bio(bio)) + return false; +- } + + blk_cgroup_bio_start(bio); + blkcg_bio_issue_init(bio); +-- +2.33.0 + diff --git a/queue-5.10/bnxt_en-reject-indirect-blk-offload-when-hw-tc-offlo.patch b/queue-5.10/bnxt_en-reject-indirect-blk-offload-when-hw-tc-offlo.patch new file mode 100644 index 00000000000..87e56462743 --- /dev/null +++ b/queue-5.10/bnxt_en-reject-indirect-blk-offload-when-hw-tc-offlo.patch @@ -0,0 +1,46 @@ +From c44fc2b065a00ced4f7842b149185b4d1d912f62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Nov 2021 02:38:01 -0500 +Subject: bnxt_en: reject indirect blk offload when hw-tc-offload is off + +From: Sriharsha Basavapatna + +[ Upstream commit b0757491a118ae5727cf9f1c3a11544397d46596 ] + +The driver does not check if hw-tc-offload is enabled for the device +before offloading a flow in the context of indirect block callback. +Fix this by checking NETIF_F_HW_TC in the features flag and rejecting +the offload request. This will avoid unnecessary dmesg error logs when +hw-tc-offload is disabled, such as these: + +bnxt_en 0000:19:00.1 eno2np1: dev(ifindex=294) not on same switch +bnxt_en 0000:19:00.1 eno2np1: Error: bnxt_tc_add_flow: cookie=0xffff8dace1c88000 error=-22 +bnxt_en 0000:19:00.0 eno1np0: dev(ifindex=294) not on same switch +bnxt_en 0000:19:00.0 eno1np0: Error: bnxt_tc_add_flow: cookie=0xffff8dace1c88000 error=-22 + +Reported-by: Marcelo Ricardo Leitner +Fixes: 627c89d00fb9 ("bnxt_en: flow_offload: offload tunnel decap rules via indirect callbacks") +Signed-off-by: Sriharsha Basavapatna +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c +index 2186706cf9130..3e9b1f59e381d 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c +@@ -1854,7 +1854,7 @@ static int bnxt_tc_setup_indr_block_cb(enum tc_setup_type type, + struct flow_cls_offload *flower = type_data; + struct bnxt *bp = priv->bp; + +- if (flower->common.chain_index) ++ if (!tc_cls_can_offload_and_chain0(bp->dev, type_data)) + return -EOPNOTSUPP; + + switch (type) { +-- +2.33.0 + diff --git a/queue-5.10/bus-ti-sysc-add-quirk-handling-for-reinit-on-context.patch b/queue-5.10/bus-ti-sysc-add-quirk-handling-for-reinit-on-context.patch new file mode 100644 index 00000000000..0c3049afed5 --- /dev/null +++ b/queue-5.10/bus-ti-sysc-add-quirk-handling-for-reinit-on-context.patch @@ -0,0 +1,229 @@ +From c1d3f59f584d740de6f89bfd6ee659b517be80ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Sep 2021 12:42:25 +0300 +Subject: bus: ti-sysc: Add quirk handling for reinit on context lost + +From: Tony Lindgren + +[ Upstream commit 9d881361206ebcf6285c2ec2ef275aff80875347 ] + +Some interconnect target modules such as otg and gpmc on am335x need a +re-init after resume. As we also have PM runtime cases where the context +may be lost, let's handle these all with cpu_pm. + +For the am335x resume path, we already have cpu_pm_resume() call +cpu_pm_cluster_exit(). + +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 108 ++++++++++++++++++++++++-- + include/linux/platform_data/ti-sysc.h | 1 + + 2 files changed, 103 insertions(+), 6 deletions(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 2ff437e5c7051..1622b0f268230 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -6,6 +6,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -52,11 +53,18 @@ struct sysc_address { + struct list_head node; + }; + ++struct sysc_module { ++ struct sysc *ddata; ++ struct list_head node; ++}; ++ + struct sysc_soc_info { + unsigned long general_purpose:1; + enum sysc_soc soc; +- struct mutex list_lock; /* disabled modules list lock */ ++ struct mutex list_lock; /* disabled and restored modules list lock */ + struct list_head disabled_modules; ++ struct list_head restored_modules; ++ struct notifier_block nb; + }; + + enum sysc_clocks { +@@ -2429,6 +2437,79 @@ static struct dev_pm_domain sysc_child_pm_domain = { + } + }; + ++/* Caller needs to take list_lock if ever used outside of cpu_pm */ ++static void sysc_reinit_modules(struct sysc_soc_info *soc) ++{ ++ struct sysc_module *module; ++ struct list_head *pos; ++ struct sysc *ddata; ++ int error = 0; ++ ++ list_for_each(pos, &sysc_soc->restored_modules) { ++ module = list_entry(pos, struct sysc_module, node); ++ ddata = module->ddata; ++ error = sysc_reinit_module(ddata, ddata->enabled); ++ } ++} ++ ++/** ++ * sysc_context_notifier - optionally reset and restore module after idle ++ * @nb: notifier block ++ * @cmd: unused ++ * @v: unused ++ * ++ * Some interconnect target modules need to be restored, or reset and restored ++ * on CPU_PM CPU_PM_CLUSTER_EXIT notifier. This is needed at least for am335x ++ * OTG and GPMC target modules even if the modules are unused. ++ */ ++static int sysc_context_notifier(struct notifier_block *nb, unsigned long cmd, ++ void *v) ++{ ++ struct sysc_soc_info *soc; ++ ++ soc = container_of(nb, struct sysc_soc_info, nb); ++ ++ switch (cmd) { ++ case CPU_CLUSTER_PM_ENTER: ++ break; ++ case CPU_CLUSTER_PM_ENTER_FAILED: /* No need to restore context */ ++ break; ++ case CPU_CLUSTER_PM_EXIT: ++ sysc_reinit_modules(soc); ++ break; ++ } ++ ++ return NOTIFY_OK; ++} ++ ++/** ++ * sysc_add_restored - optionally add reset and restore quirk hanlling ++ * @ddata: device data ++ */ ++static void sysc_add_restored(struct sysc *ddata) ++{ ++ struct sysc_module *restored_module; ++ ++ restored_module = kzalloc(sizeof(*restored_module), GFP_KERNEL); ++ if (!restored_module) ++ return; ++ ++ restored_module->ddata = ddata; ++ ++ mutex_lock(&sysc_soc->list_lock); ++ ++ list_add(&restored_module->node, &sysc_soc->restored_modules); ++ ++ if (sysc_soc->nb.notifier_call) ++ goto out_unlock; ++ ++ sysc_soc->nb.notifier_call = sysc_context_notifier; ++ cpu_pm_register_notifier(&sysc_soc->nb); ++ ++out_unlock: ++ mutex_unlock(&sysc_soc->list_lock); ++} ++ + /** + * sysc_legacy_idle_quirk - handle children in omap_device compatible way + * @ddata: device driver data +@@ -2928,12 +3009,14 @@ static int sysc_add_disabled(unsigned long base) + } + + /* +- * One time init to detect the booted SoC and disable unavailable features. ++ * One time init to detect the booted SoC, disable unavailable features ++ * and initialize list for optional cpu_pm notifier. ++ * + * Note that we initialize static data shared across all ti-sysc instances + * so ddata is only used for SoC type. This can be called from module_init + * once we no longer need to rely on platform data. + */ +-static int sysc_init_soc(struct sysc *ddata) ++static int sysc_init_static_data(struct sysc *ddata) + { + const struct soc_device_attribute *match; + struct ti_sysc_platform_data *pdata; +@@ -2948,6 +3031,7 @@ static int sysc_init_soc(struct sysc *ddata) + + mutex_init(&sysc_soc->list_lock); + INIT_LIST_HEAD(&sysc_soc->disabled_modules); ++ INIT_LIST_HEAD(&sysc_soc->restored_modules); + sysc_soc->general_purpose = true; + + pdata = dev_get_platdata(ddata->dev); +@@ -2994,15 +3078,24 @@ static int sysc_init_soc(struct sysc *ddata) + return 0; + } + +-static void sysc_cleanup_soc(void) ++static void sysc_cleanup_static_data(void) + { ++ struct sysc_module *restored_module; + struct sysc_address *disabled_module; + struct list_head *pos, *tmp; + + if (!sysc_soc) + return; + ++ if (sysc_soc->nb.notifier_call) ++ cpu_pm_unregister_notifier(&sysc_soc->nb); ++ + mutex_lock(&sysc_soc->list_lock); ++ list_for_each_safe(pos, tmp, &sysc_soc->restored_modules) { ++ restored_module = list_entry(pos, struct sysc_module, node); ++ list_del(pos); ++ kfree(restored_module); ++ } + list_for_each_safe(pos, tmp, &sysc_soc->disabled_modules) { + disabled_module = list_entry(pos, struct sysc_address, node); + list_del(pos); +@@ -3067,7 +3160,7 @@ static int sysc_probe(struct platform_device *pdev) + ddata->dev = &pdev->dev; + platform_set_drvdata(pdev, ddata); + +- error = sysc_init_soc(ddata); ++ error = sysc_init_static_data(ddata); + if (error) + return error; + +@@ -3166,6 +3259,9 @@ static int sysc_probe(struct platform_device *pdev) + pm_runtime_put(&pdev->dev); + } + ++ if (ddata->cfg.quirks & SYSC_QUIRK_REINIT_ON_CTX_LOST) ++ sysc_add_restored(ddata); ++ + return 0; + + err: +@@ -3248,7 +3344,7 @@ static void __exit sysc_exit(void) + { + bus_unregister_notifier(&platform_bus_type, &sysc_nb); + platform_driver_unregister(&sysc_driver); +- sysc_cleanup_soc(); ++ sysc_cleanup_static_data(); + } + module_exit(sysc_exit); + +diff --git a/include/linux/platform_data/ti-sysc.h b/include/linux/platform_data/ti-sysc.h +index 9837fb011f2fb..989aa30c598dc 100644 +--- a/include/linux/platform_data/ti-sysc.h ++++ b/include/linux/platform_data/ti-sysc.h +@@ -50,6 +50,7 @@ struct sysc_regbits { + s8 emufree_shift; + }; + ++#define SYSC_QUIRK_REINIT_ON_CTX_LOST BIT(28) + #define SYSC_QUIRK_REINIT_ON_RESUME BIT(27) + #define SYSC_QUIRK_GPMC_DEBUG BIT(26) + #define SYSC_MODULE_QUIRK_ENA_RESETDONE BIT(25) +-- +2.33.0 + diff --git a/queue-5.10/bus-ti-sysc-use-context-lost-quirk-for-otg.patch b/queue-5.10/bus-ti-sysc-use-context-lost-quirk-for-otg.patch new file mode 100644 index 00000000000..f00c47c2aae --- /dev/null +++ b/queue-5.10/bus-ti-sysc-use-context-lost-quirk-for-otg.patch @@ -0,0 +1,35 @@ +From 19914a943e1af1623921bf55389b1dee4333fd1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Sep 2021 12:42:25 +0300 +Subject: bus: ti-sysc: Use context lost quirk for otg + +From: Tony Lindgren + +[ Upstream commit 9067839ff45a528bcb015cc2f24f656126b91e3f ] + +Let's use SYSC_QUIRK_REINIT_ON_CTX_LOST quirk for am335x otg instead of +SYSC_QUIRK_REINIT_ON_RESUME quirk as we can now handle the context loss +in a more generic way. + +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 1622b0f268230..43603dc9da430 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -1563,7 +1563,7 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = { + 0xffffffff, SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_SWSUP_MSTANDBY), + SYSC_QUIRK("usb_otg_hs", 0, 0, 0x10, -ENODEV, 0x4ea2080d, 0xffffffff, + SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_SWSUP_MSTANDBY | +- SYSC_QUIRK_REINIT_ON_RESUME), ++ SYSC_QUIRK_REINIT_ON_CTX_LOST), + SYSC_QUIRK("wdt", 0, 0, 0x10, 0x14, 0x502a0500, 0xfffff0f0, + SYSC_MODULE_QUIRK_WDT), + /* PRUSS on am3, am4 and am5 */ +-- +2.33.0 + diff --git a/queue-5.10/clk-ast2600-fix-soc-revision-for-ahb.patch b/queue-5.10/clk-ast2600-fix-soc-revision-for-ahb.patch new file mode 100644 index 00000000000..c2170b97b88 --- /dev/null +++ b/queue-5.10/clk-ast2600-fix-soc-revision-for-ahb.patch @@ -0,0 +1,80 @@ +From 041272e3baf4a5c12cd16e8d1e88913486f2bc34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Sep 2021 09:24:49 +0930 +Subject: clk/ast2600: Fix soc revision for AHB + +From: Joel Stanley + +[ Upstream commit f45c5b1c27293f834682e89003f88b3512329ab4 ] + +Move the soc revision parsing to the initial probe, saving the driver +from parsing the register multiple times. + +Use this variable to select the correct divisor table for the AHB clock. +Before this fix the A2 would have used the A0 table. + +Fixes: 2d491066ccd4 ("clk: ast2600: Fix AHB clock divider for A1") +Signed-off-by: Joel Stanley +Link: https://lore.kernel.org/r/20210922235449.213631-1-joel@jms.id.au +Reviewed-by: Andrew Jeffery +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-ast2600.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/clk/clk-ast2600.c b/drivers/clk/clk-ast2600.c +index bc3be5f3eae15..24dab2312bc6f 100644 +--- a/drivers/clk/clk-ast2600.c ++++ b/drivers/clk/clk-ast2600.c +@@ -51,6 +51,8 @@ static DEFINE_SPINLOCK(aspeed_g6_clk_lock); + static struct clk_hw_onecell_data *aspeed_g6_clk_data; + + static void __iomem *scu_g6_base; ++/* AST2600 revision: A0, A1, A2, etc */ ++static u8 soc_rev; + + /* + * Clocks marked with CLK_IS_CRITICAL: +@@ -191,9 +193,8 @@ static struct clk_hw *ast2600_calc_pll(const char *name, u32 val) + static struct clk_hw *ast2600_calc_apll(const char *name, u32 val) + { + unsigned int mult, div; +- u32 chip_id = readl(scu_g6_base + ASPEED_G6_SILICON_REV); + +- if (((chip_id & CHIP_REVISION_ID) >> 16) >= 2) { ++ if (soc_rev >= 2) { + if (val & BIT(24)) { + /* Pass through mode */ + mult = div = 1; +@@ -707,7 +708,7 @@ static const u32 ast2600_a1_axi_ahb200_tbl[] = { + static void __init aspeed_g6_cc(struct regmap *map) + { + struct clk_hw *hw; +- u32 val, div, divbits, chip_id, axi_div, ahb_div; ++ u32 val, div, divbits, axi_div, ahb_div; + + clk_hw_register_fixed_rate(NULL, "clkin", NULL, 0, 25000000); + +@@ -738,8 +739,7 @@ static void __init aspeed_g6_cc(struct regmap *map) + axi_div = 2; + + divbits = (val >> 11) & 0x3; +- regmap_read(map, ASPEED_G6_SILICON_REV, &chip_id); +- if (chip_id & BIT(16)) { ++ if (soc_rev >= 1) { + if (!divbits) { + ahb_div = ast2600_a1_axi_ahb200_tbl[(val >> 8) & 0x3]; + if (val & BIT(16)) +@@ -784,6 +784,8 @@ static void __init aspeed_g6_cc_init(struct device_node *np) + if (!scu_g6_base) + return; + ++ soc_rev = (readl(scu_g6_base + ASPEED_G6_SILICON_REV) & CHIP_REVISION_ID) >> 16; ++ + aspeed_g6_clk_data = kzalloc(struct_size(aspeed_g6_clk_data, hws, + ASPEED_G6_NUM_CLKS), GFP_KERNEL); + if (!aspeed_g6_clk_data) +-- +2.33.0 + diff --git a/queue-5.10/clk-imx-imx6ul-move-csi_sel-mux-to-correct-base-regi.patch b/queue-5.10/clk-imx-imx6ul-move-csi_sel-mux-to-correct-base-regi.patch new file mode 100644 index 00000000000..3934b7e8a9a --- /dev/null +++ b/queue-5.10/clk-imx-imx6ul-move-csi_sel-mux-to-correct-base-regi.patch @@ -0,0 +1,51 @@ +From 3b2f5aab147b0edfbba677ead48f0abac5c658c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Sep 2021 09:28:56 +0200 +Subject: clk: imx: imx6ul: Move csi_sel mux to correct base register + +From: Stefan Riedmueller + +[ Upstream commit 2f9d61869640f732599ec36b984c2b5c46067519 ] + +The csi_sel mux register is located in the CCM register base and not the +CCM_ANALOG register base. So move it to the correct position in code. + +Otherwise changing the parent of the csi clock can lead to a complete +system failure due to the CCM_ANALOG_PLL_SYS_TOG register being falsely +modified. + +Also remove the SET_RATE_PARENT flag since one possible supply for the +csi_sel mux is the system PLL which we don't want to modify. + +Signed-off-by: Stefan Riedmueller +Reviewed-by: Abel Vesa +Link: https://lore.kernel.org/r/20210927072857.3940880-1-s.riedmueller@phytec.de +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx6ul.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/imx/clk-imx6ul.c b/drivers/clk/imx/clk-imx6ul.c +index 5dbb6a9377324..206e4c43f68f8 100644 +--- a/drivers/clk/imx/clk-imx6ul.c ++++ b/drivers/clk/imx/clk-imx6ul.c +@@ -161,7 +161,6 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) + hws[IMX6UL_PLL5_BYPASS] = imx_clk_hw_mux_flags("pll5_bypass", base + 0xa0, 16, 1, pll5_bypass_sels, ARRAY_SIZE(pll5_bypass_sels), CLK_SET_RATE_PARENT); + hws[IMX6UL_PLL6_BYPASS] = imx_clk_hw_mux_flags("pll6_bypass", base + 0xe0, 16, 1, pll6_bypass_sels, ARRAY_SIZE(pll6_bypass_sels), CLK_SET_RATE_PARENT); + hws[IMX6UL_PLL7_BYPASS] = imx_clk_hw_mux_flags("pll7_bypass", base + 0x20, 16, 1, pll7_bypass_sels, ARRAY_SIZE(pll7_bypass_sels), CLK_SET_RATE_PARENT); +- hws[IMX6UL_CLK_CSI_SEL] = imx_clk_hw_mux_flags("csi_sel", base + 0x3c, 9, 2, csi_sels, ARRAY_SIZE(csi_sels), CLK_SET_RATE_PARENT); + + /* Do not bypass PLLs initially */ + clk_set_parent(hws[IMX6UL_PLL1_BYPASS]->clk, hws[IMX6UL_CLK_PLL1]->clk); +@@ -270,6 +269,7 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) + hws[IMX6UL_CLK_ECSPI_SEL] = imx_clk_hw_mux("ecspi_sel", base + 0x38, 18, 1, ecspi_sels, ARRAY_SIZE(ecspi_sels)); + hws[IMX6UL_CLK_LCDIF_PRE_SEL] = imx_clk_hw_mux_flags("lcdif_pre_sel", base + 0x38, 15, 3, lcdif_pre_sels, ARRAY_SIZE(lcdif_pre_sels), CLK_SET_RATE_PARENT); + hws[IMX6UL_CLK_LCDIF_SEL] = imx_clk_hw_mux("lcdif_sel", base + 0x38, 9, 3, lcdif_sels, ARRAY_SIZE(lcdif_sels)); ++ hws[IMX6UL_CLK_CSI_SEL] = imx_clk_hw_mux("csi_sel", base + 0x3c, 9, 2, csi_sels, ARRAY_SIZE(csi_sels)); + + hws[IMX6UL_CLK_LDB_DI0_DIV_SEL] = imx_clk_hw_mux("ldb_di0", base + 0x20, 10, 1, ldb_di0_div_sels, ARRAY_SIZE(ldb_di0_div_sels)); + hws[IMX6UL_CLK_LDB_DI1_DIV_SEL] = imx_clk_hw_mux("ldb_di1", base + 0x20, 11, 1, ldb_di1_div_sels, ARRAY_SIZE(ldb_di1_div_sels)); +-- +2.33.0 + diff --git a/queue-5.10/clk-ingenic-fix-bugs-with-divided-dividers.patch b/queue-5.10/clk-ingenic-fix-bugs-with-divided-dividers.patch new file mode 100644 index 00000000000..664b3adf260 --- /dev/null +++ b/queue-5.10/clk-ingenic-fix-bugs-with-divided-dividers.patch @@ -0,0 +1,58 @@ +From ec1a5439a3ced36f2301aadafcebbc7d4ed50041 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Oct 2021 18:20:33 +0100 +Subject: clk: ingenic: Fix bugs with divided dividers + +From: Paul Cercueil + +[ Upstream commit ed84ef1cd7eddf933d4ffce2caa8161d6f947245 ] + +Two fixes in one: + +- In the "impose hardware constraints" block, the "logical" divider + value (aka. not translated to the hardware) was clamped to fit in the + register area, but this totally ignored the fact that the divider + value can itself have a fixed divider. + +- The code that made sure that the divider value returned by the + function was a multiple of its own fixed divider could result in a + wrong value being calculated, because it was rounded down instead of + rounded up. + +Fixes: 4afe2d1a6ed5 ("clk: ingenic: Allow divider value to be divided") +Co-developed-by: Artur Rojek +Signed-off-by: Artur Rojek +Signed-off-by: Paul Cercueil +Link: https://lore.kernel.org/r/20211001172033.122329-1-paul@crapouillou.net +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ingenic/cgu.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/clk/ingenic/cgu.c b/drivers/clk/ingenic/cgu.c +index c8e9cb6c8e39c..2b9bb7d55efc8 100644 +--- a/drivers/clk/ingenic/cgu.c ++++ b/drivers/clk/ingenic/cgu.c +@@ -425,15 +425,15 @@ ingenic_clk_calc_div(const struct ingenic_cgu_clk_info *clk_info, + } + + /* Impose hardware constraints */ +- div = min_t(unsigned, div, 1 << clk_info->div.bits); +- div = max_t(unsigned, div, 1); ++ div = clamp_t(unsigned int, div, clk_info->div.div, ++ clk_info->div.div << clk_info->div.bits); + + /* + * If the divider value itself must be divided before being written to + * the divider register, we must ensure we don't have any bits set that + * would be lost as a result of doing so. + */ +- div /= clk_info->div.div; ++ div = DIV_ROUND_UP(div, clk_info->div.div); + div *= clk_info->div.div; + + return div; +-- +2.33.0 + diff --git a/queue-5.10/clk-qcom-gcc-msm8996-drop-again-gcc_aggre1_pnoc_ahb_.patch b/queue-5.10/clk-qcom-gcc-msm8996-drop-again-gcc_aggre1_pnoc_ahb_.patch new file mode 100644 index 00000000000..62160ec4d9b --- /dev/null +++ b/queue-5.10/clk-qcom-gcc-msm8996-drop-again-gcc_aggre1_pnoc_ahb_.patch @@ -0,0 +1,69 @@ +From 1e9fc954c7d10f9461d1b83399522582432e3932 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Nov 2021 04:11:55 +0300 +Subject: clk: qcom: gcc-msm8996: Drop (again) gcc_aggre1_pnoc_ahb_clk + +From: Dmitry Baryshkov + +[ Upstream commit 05cf3ec00d460b50088d421fb878a0f83f57e262 ] + +The gcc_aggre1_pnoc_ahb_clk is crucial for the proper MSM8996/APQ8096 +functioning. If it gets disabled, several subsytems will stop working +(including eMMC/SDCC and USB). There are no in-kernel users of this +clock, so it is much simpler to remove from the kernel. + +The clock was first removed in the commit 9e60de1cf270 ("clk: qcom: +Remove gcc_aggre1_pnoc_ahb_clk from msm8996") by Stephen Boyd, but got +added back in the commit b567752144e3 ("clk: qcom: Add some missing gcc +clks for msm8996") by Rajendra Nayak. + +Let's remove it again in hope that nobody adds it back. + +Reported-by: Vladimir Zapolskiy +Cc: Rajendra Nayak +Cc: Konrad Dybcio +Fixes: b567752144e3 ("clk: qcom: Add some missing gcc clks for msm8996") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20211104011155.2209654-1-dmitry.baryshkov@linaro.org +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-msm8996.c | 15 --------------- + 1 file changed, 15 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-msm8996.c b/drivers/clk/qcom/gcc-msm8996.c +index 3c3a7ff045621..9b1674b28d45d 100644 +--- a/drivers/clk/qcom/gcc-msm8996.c ++++ b/drivers/clk/qcom/gcc-msm8996.c +@@ -2937,20 +2937,6 @@ static struct clk_branch gcc_smmu_aggre0_ahb_clk = { + }, + }; + +-static struct clk_branch gcc_aggre1_pnoc_ahb_clk = { +- .halt_reg = 0x82014, +- .clkr = { +- .enable_reg = 0x82014, +- .enable_mask = BIT(0), +- .hw.init = &(struct clk_init_data){ +- .name = "gcc_aggre1_pnoc_ahb_clk", +- .parent_names = (const char *[]){ "periph_noc_clk_src" }, +- .num_parents = 1, +- .ops = &clk_branch2_ops, +- }, +- }, +-}; +- + static struct clk_branch gcc_aggre2_ufs_axi_clk = { + .halt_reg = 0x83014, + .clkr = { +@@ -3474,7 +3460,6 @@ static struct clk_regmap *gcc_msm8996_clocks[] = { + [GCC_AGGRE0_CNOC_AHB_CLK] = &gcc_aggre0_cnoc_ahb_clk.clkr, + [GCC_SMMU_AGGRE0_AXI_CLK] = &gcc_smmu_aggre0_axi_clk.clkr, + [GCC_SMMU_AGGRE0_AHB_CLK] = &gcc_smmu_aggre0_ahb_clk.clkr, +- [GCC_AGGRE1_PNOC_AHB_CLK] = &gcc_aggre1_pnoc_ahb_clk.clkr, + [GCC_AGGRE2_UFS_AXI_CLK] = &gcc_aggre2_ufs_axi_clk.clkr, + [GCC_AGGRE2_USB3_AXI_CLK] = &gcc_aggre2_usb3_axi_clk.clkr, + [GCC_QSPI_AHB_CLK] = &gcc_qspi_ahb_clk.clkr, +-- +2.33.0 + diff --git a/queue-5.10/cpuidle-tegra-check-whether-pmc-is-ready.patch b/queue-5.10/cpuidle-tegra-check-whether-pmc-is-ready.patch new file mode 100644 index 00000000000..d106aa57afb --- /dev/null +++ b/queue-5.10/cpuidle-tegra-check-whether-pmc-is-ready.patch @@ -0,0 +1,39 @@ +From 23c14eacbd57f267e348f8ade7d2e1da53825735 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Sep 2021 23:29:07 +0300 +Subject: cpuidle: tegra: Check whether PMC is ready + +From: Dmitry Osipenko + +[ Upstream commit bdb1ffdad3b73e4d0538098fc02e2ea87a6b27cd ] + +Check whether PMC is ready before proceeding with the cpuidle registration. +This fixes racing with the PMC driver probe order, which results in a +disabled deepest CC6 idling state if cpuidle driver is probed before the +PMC. + +Acked-by: Daniel Lezcano +Signed-off-by: Dmitry Osipenko +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/cpuidle/cpuidle-tegra.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/cpuidle/cpuidle-tegra.c b/drivers/cpuidle/cpuidle-tegra.c +index 29c5e83500d33..e6f96d272d240 100644 +--- a/drivers/cpuidle/cpuidle-tegra.c ++++ b/drivers/cpuidle/cpuidle-tegra.c +@@ -346,6 +346,9 @@ static void tegra_cpuidle_setup_tegra114_c7_state(void) + + static int tegra_cpuidle_probe(struct platform_device *pdev) + { ++ if (tegra_pmc_get_suspend_mode() == TEGRA_SUSPEND_NOT_READY) ++ return -EPROBE_DEFER; ++ + /* LP2 could be disabled in device-tree */ + if (tegra_pmc_get_suspend_mode() < TEGRA_SUSPEND_LP2) + tegra_cpuidle_disable_state(TEGRA_CC6); +-- +2.33.0 + diff --git a/queue-5.10/drm-nouveau-hdmigv100.c-fix-corrupted-hdmi-vendor-in.patch b/queue-5.10/drm-nouveau-hdmigv100.c-fix-corrupted-hdmi-vendor-in.patch new file mode 100644 index 00000000000..3543d7967a3 --- /dev/null +++ b/queue-5.10/drm-nouveau-hdmigv100.c-fix-corrupted-hdmi-vendor-in.patch @@ -0,0 +1,41 @@ +From 5655e7abe718853529232719c2e0088213a36bb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Nov 2021 16:36:04 +0100 +Subject: drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame + +From: Hans Verkuil + +[ Upstream commit 3cc1ae1fa70ab369e4645e38ce335a19438093ad ] + +gv100_hdmi_ctrl() writes vendor_infoframe.subpack0_high to 0x6f0110, and +then overwrites it with 0. Just drop the overwrite with 0, that's clearly +a mistake. + +Because of this issue the HDMI VIC is 0 instead of 1 in the HDMI Vendor +InfoFrame when transmitting 4kp30. + +Signed-off-by: Hans Verkuil +Fixes: 290ffeafcc1a ("drm/nouveau/disp/gv100: initial support") +Reviewed-by: Ben Skeggs +Signed-off-by: Karol Herbst +Link: https://patchwork.freedesktop.org/patch/msgid/3d3bd0f7-c150-2479-9350-35d394ee772d@xs4all.nl +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c +index 6e3c450eaacef..3ff49344abc77 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c +@@ -62,7 +62,6 @@ gv100_hdmi_ctrl(struct nvkm_ior *ior, int head, bool enable, u8 max_ac_packet, + nvkm_wr32(device, 0x6f0108 + hdmi, vendor_infoframe.header); + nvkm_wr32(device, 0x6f010c + hdmi, vendor_infoframe.subpack0_low); + nvkm_wr32(device, 0x6f0110 + hdmi, vendor_infoframe.subpack0_high); +- nvkm_wr32(device, 0x6f0110 + hdmi, 0x00000000); + nvkm_wr32(device, 0x6f0114 + hdmi, 0x00000000); + nvkm_wr32(device, 0x6f0118 + hdmi, 0x00000000); + nvkm_wr32(device, 0x6f011c + hdmi, 0x00000000); +-- +2.33.0 + diff --git a/queue-5.10/e100-fix-device-suspend-resume.patch b/queue-5.10/e100-fix-device-suspend-resume.patch new file mode 100644 index 00000000000..72b3ff6e2b8 --- /dev/null +++ b/queue-5.10/e100-fix-device-suspend-resume.patch @@ -0,0 +1,95 @@ +From 6e5ac2c16fc2dfc1faf51ede0307bdf9221a4407 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Nov 2021 12:59:52 -0800 +Subject: e100: fix device suspend/resume + +From: Jesse Brandeburg + +[ Upstream commit 5d2ca2e12dfb2aff3388ca57b06f570fa6206ced ] + +As reported in [1], e100 was no longer working for suspend/resume +cycles. The previous commit mentioned in the fixes appears to have +broken things and this attempts to practice best known methods for +device power management and keep wake-up working while allowing +suspend/resume to work. To do this, I reorder a little bit of code +and fix the resume path to make sure the device is enabled. + +[1] https://bugzilla.kernel.org/show_bug.cgi?id=214933 + +Fixes: 69a74aef8a18 ("e100: use generic power management") +Cc: Vaibhav Gupta +Reported-by: Alexey Kuznetsov +Signed-off-by: Jesse Brandeburg +Tested-by: Alexey Kuznetsov +Signed-off-by: Tony Nguyen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e100.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c +index ee86ea12fa379..9295a9a1efc73 100644 +--- a/drivers/net/ethernet/intel/e100.c ++++ b/drivers/net/ethernet/intel/e100.c +@@ -2997,9 +2997,10 @@ static void __e100_shutdown(struct pci_dev *pdev, bool *enable_wake) + struct net_device *netdev = pci_get_drvdata(pdev); + struct nic *nic = netdev_priv(netdev); + ++ netif_device_detach(netdev); ++ + if (netif_running(netdev)) + e100_down(nic); +- netif_device_detach(netdev); + + if ((nic->flags & wol_magic) | e100_asf(nic)) { + /* enable reverse auto-negotiation */ +@@ -3016,7 +3017,7 @@ static void __e100_shutdown(struct pci_dev *pdev, bool *enable_wake) + *enable_wake = false; + } + +- pci_clear_master(pdev); ++ pci_disable_device(pdev); + } + + static int __e100_power_off(struct pci_dev *pdev, bool wake) +@@ -3036,8 +3037,6 @@ static int __maybe_unused e100_suspend(struct device *dev_d) + + __e100_shutdown(to_pci_dev(dev_d), &wake); + +- device_wakeup_disable(dev_d); +- + return 0; + } + +@@ -3045,6 +3044,14 @@ static int __maybe_unused e100_resume(struct device *dev_d) + { + struct net_device *netdev = dev_get_drvdata(dev_d); + struct nic *nic = netdev_priv(netdev); ++ int err; ++ ++ err = pci_enable_device(to_pci_dev(dev_d)); ++ if (err) { ++ netdev_err(netdev, "Resume cannot enable PCI device, aborting\n"); ++ return err; ++ } ++ pci_set_master(to_pci_dev(dev_d)); + + /* disable reverse auto-negotiation */ + if (nic->phy == phy_82552_v) { +@@ -3056,10 +3063,11 @@ static int __maybe_unused e100_resume(struct device *dev_d) + smartspeed & ~(E100_82552_REV_ANEG)); + } + +- netif_device_attach(netdev); + if (netif_running(netdev)) + e100_up(nic); + ++ netif_device_attach(netdev); ++ + return 0; + } + +-- +2.33.0 + diff --git a/queue-5.10/f2fs-compress-disallow-disabling-compress-on-non-emp.patch b/queue-5.10/f2fs-compress-disallow-disabling-compress-on-non-emp.patch new file mode 100644 index 00000000000..3ed897c2cb3 --- /dev/null +++ b/queue-5.10/f2fs-compress-disallow-disabling-compress-on-non-emp.patch @@ -0,0 +1,43 @@ +From fa82ca01595551d6464b805bd075f6aadf489e1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Oct 2021 13:16:00 +0900 +Subject: f2fs: compress: disallow disabling compress on non-empty compressed + file + +From: Hyeong-Jun Kim + +[ Upstream commit 02d58cd253d7536c412993573fc6b3b4454960eb ] + +Compresse file and normal file has differ in i_addr addressing, +specifically addrs per inode/block. So, we will face data loss, if we +disable the compression flag on non-empty files. Therefore we should +disallow not only enabling but disabling the compression flag on +non-empty files. + +Fixes: 4c8ff7095bef ("f2fs: support data compression") +Signed-off-by: Sungjong Seo +Signed-off-by: Hyeong-Jun Kim +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/f2fs.h | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 2d7799bd30b10..bc488a7d01903 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -3908,8 +3908,7 @@ static inline bool f2fs_disable_compressed_file(struct inode *inode) + + if (!f2fs_compressed_file(inode)) + return true; +- if (S_ISREG(inode->i_mode) && +- (get_dirty_pages(inode) || atomic_read(&fi->i_compr_blocks))) ++ if (S_ISREG(inode->i_mode) && F2FS_HAS_BLOCKS(inode)) + return false; + + fi->i_flags &= ~F2FS_COMPR_FL; +-- +2.33.0 + diff --git a/queue-5.10/f2fs-fix-incorrect-return-value-in-f2fs_sanity_check.patch b/queue-5.10/f2fs-fix-incorrect-return-value-in-f2fs_sanity_check.patch new file mode 100644 index 00000000000..bc5b16c7d53 --- /dev/null +++ b/queue-5.10/f2fs-fix-incorrect-return-value-in-f2fs_sanity_check.patch @@ -0,0 +1,46 @@ +From 2c9318731986ba901e57bf4843f4450ca41fa16a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Oct 2021 20:45:08 +0800 +Subject: f2fs: fix incorrect return value in f2fs_sanity_check_ckpt() + +From: Chao Yu + +[ Upstream commit ca98d72141dd81f42893a9a43d7ededab3355fba ] + +As Pavel Machek reported in [1] + +This code looks quite confused: part of function returns 1 on +corruption, part returns -errno. The problem is not stable-specific. + +[1] https://lkml.org/lkml/2021/9/19/207 + +Let's fix to make 'insane cp_payload case' to return 1 rater than +EFSCORRUPTED, so that return value can be kept consistent for all +error cases, it can avoid confusion of code logic. + +Fixes: 65ddf6564843 ("f2fs: fix to do sanity check for sb/cp fields correctly") +Reported-by: Pavel Machek +Reviewed-by: Pavel Machek +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 70b513e66af77..b7287b722e9e1 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -3081,7 +3081,7 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi) + NR_CURSEG_PERSIST_TYPE + nat_bits_blocks >= blocks_per_seg)) { + f2fs_warn(sbi, "Insane cp_payload: %u, nat_bits_blocks: %u)", + cp_payload, nat_bits_blocks); +- return -EFSCORRUPTED; ++ return 1; + } + + if (unlikely(f2fs_cp_error(sbi))) { +-- +2.33.0 + diff --git a/queue-5.10/f2fs-fix-to-use-whint_mode.patch b/queue-5.10/f2fs-fix-to-use-whint_mode.patch new file mode 100644 index 00000000000..0bccab62dc3 --- /dev/null +++ b/queue-5.10/f2fs-fix-to-use-whint_mode.patch @@ -0,0 +1,43 @@ +From c809f3d16d8c2296de90419a87120cc27e4ecb0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Sep 2021 15:06:48 +0900 +Subject: f2fs: fix to use WHINT_MODE + +From: Keoseong Park + +[ Upstream commit 011e0868e0cf1237675b22e36fffa958fb08f46e ] + +Since active_logs can be set to 2 or 4 or NR_CURSEG_PERSIST_TYPE(6), +it cannot be set to NR_CURSEG_TYPE(8). +That is, whint_mode is always off. + +Therefore, the condition is changed from NR_CURSEG_TYPE to NR_CURSEG_PERSIST_TYPE. + +Cc: Chao Yu +Fixes: d0b9e42ab615 (f2fs: introduce inmem curseg) +Reported-by: tanghuan +Signed-off-by: Keoseong Park +Signed-off-by: Fengnan Chang +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index de543168b3708..70b513e66af77 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -1020,7 +1020,7 @@ static int parse_options(struct super_block *sb, char *options, bool is_remount) + /* Not pass down write hints if the number of active logs is lesser + * than NR_CURSEG_PERSIST_TYPE. + */ +- if (F2FS_OPTION(sbi).active_logs != NR_CURSEG_TYPE) ++ if (F2FS_OPTION(sbi).active_logs != NR_CURSEG_PERSIST_TYPE) + F2FS_OPTION(sbi).whint_mode = WHINT_MODE_OFF; + return 0; + } +-- +2.33.0 + diff --git a/queue-5.10/f2fs-fix-up-f2fs_lookup-tracepoints.patch b/queue-5.10/f2fs-fix-up-f2fs_lookup-tracepoints.patch new file mode 100644 index 00000000000..f9646d0095e --- /dev/null +++ b/queue-5.10/f2fs-fix-up-f2fs_lookup-tracepoints.patch @@ -0,0 +1,77 @@ +From 49c4da5ab659aae0b9755121d42425f2993d5863 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Sep 2021 22:37:30 +0800 +Subject: f2fs: fix up f2fs_lookup tracepoints + +From: Gao Xiang + +[ Upstream commit 70a9ac36ffd807ac506ed0b849f3e8ce3c6623f2 ] + +Fix up a misuse that the filename pointer isn't always valid in +the ring buffer, and we should copy the content instead. + +Fixes: 0c5e36db17f5 ("f2fs: trace f2fs_lookup") +Signed-off-by: Gao Xiang +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + include/trace/events/f2fs.h | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/include/trace/events/f2fs.h b/include/trace/events/f2fs.h +index 56b113e3cd6aa..df293bc7f03b8 100644 +--- a/include/trace/events/f2fs.h ++++ b/include/trace/events/f2fs.h +@@ -807,20 +807,20 @@ TRACE_EVENT(f2fs_lookup_start, + TP_STRUCT__entry( + __field(dev_t, dev) + __field(ino_t, ino) +- __field(const char *, name) ++ __string(name, dentry->d_name.name) + __field(unsigned int, flags) + ), + + TP_fast_assign( + __entry->dev = dir->i_sb->s_dev; + __entry->ino = dir->i_ino; +- __entry->name = dentry->d_name.name; ++ __assign_str(name, dentry->d_name.name); + __entry->flags = flags; + ), + + TP_printk("dev = (%d,%d), pino = %lu, name:%s, flags:%u", + show_dev_ino(__entry), +- __entry->name, ++ __get_str(name), + __entry->flags) + ); + +@@ -834,7 +834,7 @@ TRACE_EVENT(f2fs_lookup_end, + TP_STRUCT__entry( + __field(dev_t, dev) + __field(ino_t, ino) +- __field(const char *, name) ++ __string(name, dentry->d_name.name) + __field(nid_t, cino) + __field(int, err) + ), +@@ -842,14 +842,14 @@ TRACE_EVENT(f2fs_lookup_end, + TP_fast_assign( + __entry->dev = dir->i_sb->s_dev; + __entry->ino = dir->i_ino; +- __entry->name = dentry->d_name.name; ++ __assign_str(name, dentry->d_name.name); + __entry->cino = ino; + __entry->err = err; + ), + + TP_printk("dev = (%d,%d), pino = %lu, name:%s, ino:%u, err:%d", + show_dev_ino(__entry), +- __entry->name, ++ __get_str(name), + __entry->cino, + __entry->err) + ); +-- +2.33.0 + diff --git a/queue-5.10/firmware_loader-fix-pre-allocated-buf-built-in-firmw.patch b/queue-5.10/firmware_loader-fix-pre-allocated-buf-built-in-firmw.patch new file mode 100644 index 00000000000..2346d56cb51 --- /dev/null +++ b/queue-5.10/firmware_loader-fix-pre-allocated-buf-built-in-firmw.patch @@ -0,0 +1,83 @@ +From f9292582c2b45e18e5f0841280aad9c09acb7f72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Sep 2021 11:22:13 -0700 +Subject: firmware_loader: fix pre-allocated buf built-in firmware use + +From: Luis Chamberlain + +[ Upstream commit f7a07f7b96033df7709042ff38e998720a3f7119 ] + +The firmware_loader can be used with a pre-allocated buffer +through the use of the API calls: + + o request_firmware_into_buf() + o request_partial_firmware_into_buf() + +If the firmware was built-in and present, our current check +for if the built-in firmware fits into the pre-allocated buffer +does not return any errors, and we proceed to tell the caller +that everything worked fine. It's a lie and no firmware would +end up being copied into the pre-allocated buffer. So if the +caller trust the result it may end up writing a bunch of 0's +to a device! + +Fix this by making the function that checks for the pre-allocated +buffer return non-void. Since the typical use case is when no +pre-allocated buffer is provided make this return successfully +for that case. If the built-in firmware does *not* fit into the +pre-allocated buffer size return a failure as we should have +been doing before. + +I'm not aware of users of the built-in firmware using the API +calls with a pre-allocated buffer, as such I doubt this fixes +any real life issue. But you never know... perhaps some oddball +private tree might use it. + +In so far as upstream is concerned this just fixes our code for +correctness. + +Signed-off-by: Luis Chamberlain +Link: https://lore.kernel.org/r/20210917182226.3532898-2-mcgrof@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/firmware_loader/main.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c +index f41e4e4993d37..1372f40d0371f 100644 +--- a/drivers/base/firmware_loader/main.c ++++ b/drivers/base/firmware_loader/main.c +@@ -99,12 +99,15 @@ static struct firmware_cache fw_cache; + extern struct builtin_fw __start_builtin_fw[]; + extern struct builtin_fw __end_builtin_fw[]; + +-static void fw_copy_to_prealloc_buf(struct firmware *fw, ++static bool fw_copy_to_prealloc_buf(struct firmware *fw, + void *buf, size_t size) + { +- if (!buf || size < fw->size) +- return; ++ if (!buf) ++ return true; ++ if (size < fw->size) ++ return false; + memcpy(buf, fw->data, fw->size); ++ return true; + } + + static bool fw_get_builtin_firmware(struct firmware *fw, const char *name, +@@ -116,9 +119,7 @@ static bool fw_get_builtin_firmware(struct firmware *fw, const char *name, + if (strcmp(name, b_fw->name) == 0) { + fw->size = b_fw->size; + fw->data = b_fw->data; +- fw_copy_to_prealloc_buf(fw, buf, size); +- +- return true; ++ return fw_copy_to_prealloc_buf(fw, buf, size); + } + } + +-- +2.33.0 + diff --git a/queue-5.10/i40e-fix-changing-previously-set-num_queue_pairs-for.patch b/queue-5.10/i40e-fix-changing-previously-set-num_queue_pairs-for.patch new file mode 100644 index 00000000000..8438c28acc4 --- /dev/null +++ b/queue-5.10/i40e-fix-changing-previously-set-num_queue_pairs-for.patch @@ -0,0 +1,135 @@ +From b1110608ad304faabdd48c6f13b22e33facab61d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 13:43:25 +0200 +Subject: i40e: Fix changing previously set num_queue_pairs for PFs + +From: Eryk Rybak + +[ Upstream commit d2a69fefd75683004ffe87166de5635b3267ee07 ] + +Currently, the i40e_vsi_setup_queue_map is basing the count of queues in +TCs on a VSI's alloc_queue_pairs member which is not changed throughout +any user's action (for example via ethtool's set_channels callback). + +This implies that vsi->tc_config.tc_info[n].qcount value that is given +to the kernel via netdev_set_tc_queue() that notifies about the count of +queues per particular traffic class is constant even if user has changed +the total count of queues. + +This in turn caused the kernel warning after setting the queue count to +the lower value than the initial one: + +$ ethtool -l ens801f0 +Channel parameters for ens801f0: +Pre-set maximums: +RX: 0 +TX: 0 +Other: 1 +Combined: 64 +Current hardware settings: +RX: 0 +TX: 0 +Other: 1 +Combined: 64 + +$ ethtool -L ens801f0 combined 40 + +[dmesg] +Number of in use tx queues changed invalidating tc mappings. Priority +traffic classification disabled! + +Reason was that vsi->alloc_queue_pairs stayed at 64 value which was used +to set the qcount on TC0 (by default only TC0 exists so all of the +existing queues are assigned to TC0). we update the offset/qcount via +netdev_set_tc_queue() back to the old value but then the +netif_set_real_num_tx_queues() is using the vsi->num_queue_pairs as a +value which got set to 40. + +Fix it by using vsi->req_queue_pairs as a queue count that will be +distributed across TCs. Do it only for non-zero values, which implies +that user actually requested the new count of queues. + +For VSIs other than main, stay with the vsi->alloc_queue_pairs as we +only allow manipulating the queue count on main VSI. + +Fixes: bc6d33c8d93f ("i40e: Fix the number of queues available to be mapped for use") +Co-developed-by: Maciej Fijalkowski +Signed-off-by: Maciej Fijalkowski +Co-developed-by: Przemyslaw Patynowski +Signed-off-by: Przemyslaw Patynowski +Signed-off-by: Eryk Rybak +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 35 ++++++++++++++------- + 1 file changed, 23 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 72405a0aabde7..48856dea512c8 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -1789,6 +1789,7 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi, + bool is_add) + { + struct i40e_pf *pf = vsi->back; ++ u16 num_tc_qps = 0; + u16 sections = 0; + u8 netdev_tc = 0; + u16 numtc = 1; +@@ -1796,13 +1797,29 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi, + u8 offset; + u16 qmap; + int i; +- u16 num_tc_qps = 0; + + sections = I40E_AQ_VSI_PROP_QUEUE_MAP_VALID; + offset = 0; + ++ if (vsi->type == I40E_VSI_MAIN) { ++ /* This code helps add more queue to the VSI if we have ++ * more cores than RSS can support, the higher cores will ++ * be served by ATR or other filters. Furthermore, the ++ * non-zero req_queue_pairs says that user requested a new ++ * queue count via ethtool's set_channels, so use this ++ * value for queues distribution across traffic classes ++ */ ++ if (vsi->req_queue_pairs > 0) ++ vsi->num_queue_pairs = vsi->req_queue_pairs; ++ else if (pf->flags & I40E_FLAG_MSIX_ENABLED) ++ vsi->num_queue_pairs = pf->num_lan_msix; ++ } ++ + /* Number of queues per enabled TC */ +- num_tc_qps = vsi->alloc_queue_pairs; ++ if (vsi->type == I40E_VSI_MAIN) ++ num_tc_qps = vsi->num_queue_pairs; ++ else ++ num_tc_qps = vsi->alloc_queue_pairs; + if (enabled_tc && (vsi->back->flags & I40E_FLAG_DCB_ENABLED)) { + /* Find numtc from enabled TC bitmap */ + for (i = 0, numtc = 0; i < I40E_MAX_TRAFFIC_CLASS; i++) { +@@ -1880,16 +1897,10 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi, + } + ctxt->info.tc_mapping[i] = cpu_to_le16(qmap); + } +- +- /* Set actual Tx/Rx queue pairs */ +- vsi->num_queue_pairs = offset; +- if ((vsi->type == I40E_VSI_MAIN) && (numtc == 1)) { +- if (vsi->req_queue_pairs > 0) +- vsi->num_queue_pairs = vsi->req_queue_pairs; +- else if (pf->flags & I40E_FLAG_MSIX_ENABLED) +- vsi->num_queue_pairs = pf->num_lan_msix; +- } +- ++ /* Do not change previously set num_queue_pairs for PFs */ ++ if ((vsi->type == I40E_VSI_MAIN && numtc != 1) || ++ vsi->type != I40E_VSI_MAIN) ++ vsi->num_queue_pairs = offset; + /* Scheduler section valid can only be set for ADD VSI */ + if (is_add) { + sections |= I40E_AQ_VSI_PROP_SCHED_VALID; +-- +2.33.0 + diff --git a/queue-5.10/i40e-fix-correct-max_pkt_size-on-vf-rx-queue.patch b/queue-5.10/i40e-fix-correct-max_pkt_size-on-vf-rx-queue.patch new file mode 100644 index 00000000000..e9d70884cc5 --- /dev/null +++ b/queue-5.10/i40e-fix-correct-max_pkt_size-on-vf-rx-queue.patch @@ -0,0 +1,118 @@ +From 7405f195cf08a97fedd378961bc1a2ed2971d9e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jan 2021 16:17:22 +0000 +Subject: i40e: Fix correct max_pkt_size on VF RX queue + +From: Eryk Rybak + +[ Upstream commit 6afbd7b3c53cb7417189f476e99d431daccb85b0 ] + +Setting VLAN port increasing RX queue max_pkt_size +by 4 bytes to take VLAN tag into account. +Trigger the VF reset when setting port VLAN for +VF to renegotiate its capabilities and reinitialize. + +Fixes: ba4e003d29c1 ("i40e: don't hold spinlock while resetting VF") +Signed-off-by: Sylwester Dziedziuch +Signed-off-by: Aleksandr Loktionov +Signed-off-by: Eryk Rybak +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 53 ++++--------------- + 1 file changed, 9 insertions(+), 44 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index a02167cce81e1..dacd1453b7311 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -621,14 +621,13 @@ static int i40e_config_vsi_rx_queue(struct i40e_vf *vf, u16 vsi_id, + u16 vsi_queue_id, + struct virtchnl_rxq_info *info) + { ++ u16 pf_queue_id = i40e_vc_get_pf_queue_id(vf, vsi_id, vsi_queue_id); + struct i40e_pf *pf = vf->pf; ++ struct i40e_vsi *vsi = pf->vsi[vf->lan_vsi_idx]; + struct i40e_hw *hw = &pf->hw; + struct i40e_hmc_obj_rxq rx_ctx; +- u16 pf_queue_id; + int ret = 0; + +- pf_queue_id = i40e_vc_get_pf_queue_id(vf, vsi_id, vsi_queue_id); +- + /* clear the context structure first */ + memset(&rx_ctx, 0, sizeof(struct i40e_hmc_obj_rxq)); + +@@ -666,6 +665,10 @@ static int i40e_config_vsi_rx_queue(struct i40e_vf *vf, u16 vsi_id, + } + rx_ctx.rxmax = info->max_pkt_size; + ++ /* if port VLAN is configured increase the max packet size */ ++ if (vsi->info.pvid) ++ rx_ctx.rxmax += VLAN_HLEN; ++ + /* enable 32bytes desc always */ + rx_ctx.dsize = 1; + +@@ -4133,34 +4136,6 @@ error_param: + return ret; + } + +-/** +- * i40e_vsi_has_vlans - True if VSI has configured VLANs +- * @vsi: pointer to the vsi +- * +- * Check if a VSI has configured any VLANs. False if we have a port VLAN or if +- * we have no configured VLANs. Do not call while holding the +- * mac_filter_hash_lock. +- */ +-static bool i40e_vsi_has_vlans(struct i40e_vsi *vsi) +-{ +- bool have_vlans; +- +- /* If we have a port VLAN, then the VSI cannot have any VLANs +- * configured, as all MAC/VLAN filters will be assigned to the PVID. +- */ +- if (vsi->info.pvid) +- return false; +- +- /* Since we don't have a PVID, we know that if the device is in VLAN +- * mode it must be because of a VLAN filter configured on this VSI. +- */ +- spin_lock_bh(&vsi->mac_filter_hash_lock); +- have_vlans = i40e_is_vsi_in_vlan(vsi); +- spin_unlock_bh(&vsi->mac_filter_hash_lock); +- +- return have_vlans; +-} +- + /** + * i40e_ndo_set_vf_port_vlan + * @netdev: network interface device structure +@@ -4217,19 +4192,9 @@ int i40e_ndo_set_vf_port_vlan(struct net_device *netdev, int vf_id, + /* duplicate request, so just return success */ + goto error_pvid; + +- if (i40e_vsi_has_vlans(vsi)) { +- dev_err(&pf->pdev->dev, +- "VF %d has already configured VLAN filters and the administrator is requesting a port VLAN override.\nPlease unload and reload the VF driver for this change to take effect.\n", +- vf_id); +- /* Administrator Error - knock the VF offline until he does +- * the right thing by reconfiguring his network correctly +- * and then reloading the VF driver. +- */ +- i40e_vc_disable_vf(vf); +- /* During reset the VF got a new VSI, so refresh the pointer. */ +- vsi = pf->vsi[vf->lan_vsi_idx]; +- } +- ++ i40e_vc_disable_vf(vf); ++ /* During reset the VF got a new VSI, so refresh a pointer. */ ++ vsi = pf->vsi[vf->lan_vsi_idx]; + /* Locked once because multiple functions below iterate list */ + spin_lock_bh(&vsi->mac_filter_hash_lock); + +-- +2.33.0 + diff --git a/queue-5.10/i40e-fix-creation-of-first-queue-by-omitting-it-if-i.patch b/queue-5.10/i40e-fix-creation-of-first-queue-by-omitting-it-if-i.patch new file mode 100644 index 00000000000..2483964c894 --- /dev/null +++ b/queue-5.10/i40e-fix-creation-of-first-queue-by-omitting-it-if-i.patch @@ -0,0 +1,117 @@ +From 81c3212c4d8c3c92d7594956e529200b899ead4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 08:37:31 +0000 +Subject: i40e: Fix creation of first queue by omitting it if is not power of + two + +From: Jedrzej Jagielski + +[ Upstream commit 2e6d218c1ec6fb9cd70693b78134cbc35ae0b5a9 ] + +Reject TCs creation with proper message if the first queue +assignment is not equal to the power of two. +The first queue number was checked too late in the second queue +iteration, if second queue was configured at all. Now if first queue value +is not a power of two, then trying to create qdisc will be rejected. + +Fixes: 8f88b3034db3 ("i40e: Add infrastructure for queue channel support") +Signed-off-by: Grzegorz Szczurek +Signed-off-by: Jedrzej Jagielski +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 59 +++++++-------------- + 1 file changed, 19 insertions(+), 40 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 7f224dbe9c0ae..8cb80798efb2b 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -5753,24 +5753,6 @@ static void i40e_remove_queue_channels(struct i40e_vsi *vsi) + INIT_LIST_HEAD(&vsi->ch_list); + } + +-/** +- * i40e_is_any_channel - channel exist or not +- * @vsi: ptr to VSI to which channels are associated with +- * +- * Returns true or false if channel(s) exist for associated VSI or not +- **/ +-static bool i40e_is_any_channel(struct i40e_vsi *vsi) +-{ +- struct i40e_channel *ch, *ch_tmp; +- +- list_for_each_entry_safe(ch, ch_tmp, &vsi->ch_list, list) { +- if (ch->initialized) +- return true; +- } +- +- return false; +-} +- + /** + * i40e_get_max_queues_for_channel + * @vsi: ptr to VSI to which channels are associated with +@@ -6276,26 +6258,15 @@ int i40e_create_queue_channel(struct i40e_vsi *vsi, + /* By default we are in VEPA mode, if this is the first VF/VMDq + * VSI to be added switch to VEB mode. + */ +- if ((!(pf->flags & I40E_FLAG_VEB_MODE_ENABLED)) || +- (!i40e_is_any_channel(vsi))) { +- if (!is_power_of_2(vsi->tc_config.tc_info[0].qcount)) { +- dev_dbg(&pf->pdev->dev, +- "Failed to create channel. Override queues (%u) not power of 2\n", +- vsi->tc_config.tc_info[0].qcount); +- return -EINVAL; +- } + +- if (!(pf->flags & I40E_FLAG_VEB_MODE_ENABLED)) { +- pf->flags |= I40E_FLAG_VEB_MODE_ENABLED; ++ if (!(pf->flags & I40E_FLAG_VEB_MODE_ENABLED)) { ++ pf->flags |= I40E_FLAG_VEB_MODE_ENABLED; + +- if (vsi->type == I40E_VSI_MAIN) { +- if (pf->flags & I40E_FLAG_TC_MQPRIO) +- i40e_do_reset(pf, I40E_PF_RESET_FLAG, +- true); +- else +- i40e_do_reset_safe(pf, +- I40E_PF_RESET_FLAG); +- } ++ if (vsi->type == I40E_VSI_MAIN) { ++ if (pf->flags & I40E_FLAG_TC_MQPRIO) ++ i40e_do_reset(pf, I40E_PF_RESET_FLAG, true); ++ else ++ i40e_do_reset_safe(pf, I40E_PF_RESET_FLAG); + } + /* now onwards for main VSI, number of queues will be value + * of TC0's queue count +@@ -7622,12 +7593,20 @@ config_tc: + vsi->seid); + need_reset = true; + goto exit; +- } else { +- dev_info(&vsi->back->pdev->dev, +- "Setup channel (id:%u) utilizing num_queues %d\n", +- vsi->seid, vsi->tc_config.tc_info[0].qcount); ++ } else if (enabled_tc && ++ (!is_power_of_2(vsi->tc_config.tc_info[0].qcount))) { ++ netdev_info(netdev, ++ "Failed to create channel. Override queues (%u) not power of 2\n", ++ vsi->tc_config.tc_info[0].qcount); ++ ret = -EINVAL; ++ need_reset = true; ++ goto exit; + } + ++ dev_info(&vsi->back->pdev->dev, ++ "Setup channel (id:%u) utilizing num_queues %d\n", ++ vsi->seid, vsi->tc_config.tc_info[0].qcount); ++ + if (pf->flags & I40E_FLAG_TC_MQPRIO) { + if (vsi->mqprio_qopt.max_rate[0]) { + u64 max_tx_rate = vsi->mqprio_qopt.max_rate[0]; +-- +2.33.0 + diff --git a/queue-5.10/i40e-fix-display-error-code-in-dmesg.patch b/queue-5.10/i40e-fix-display-error-code-in-dmesg.patch new file mode 100644 index 00000000000..fc5ed04f94b --- /dev/null +++ b/queue-5.10/i40e-fix-display-error-code-in-dmesg.patch @@ -0,0 +1,42 @@ +From 4a2a2b4d8ec80ff649a1353123455f5a5637a63b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Oct 2021 11:26:01 +0200 +Subject: i40e: Fix display error code in dmesg + +From: Grzegorz Szczurek + +[ Upstream commit 5aff430d4e33a0b48a6b3d5beb06f79da23f9916 ] + +Fix misleading display error in dmesg if tc filter return fail. +Only i40e status error code should be converted to string, not linux +error code. Otherwise, we return false information about the error. + +Fixes: 2f4b411a3d67 ("i40e: Enable cloud filters via tc-flower") +Signed-off-by: Grzegorz Szczurek +Signed-off-by: Mateusz Palczewski +Tested-by: Dave Switzer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 8cb80798efb2b..583eae71cda4b 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -8171,9 +8171,8 @@ static int i40e_configure_clsflower(struct i40e_vsi *vsi, + err = i40e_add_del_cloud_filter(vsi, filter, true); + + if (err) { +- dev_err(&pf->pdev->dev, +- "Failed to add cloud filter, err %s\n", +- i40e_stat_str(&pf->hw, err)); ++ dev_err(&pf->pdev->dev, "Failed to add cloud filter, err %d\n", ++ err); + goto err; + } + +-- +2.33.0 + diff --git a/queue-5.10/i40e-fix-null-ptr-dereference-on-vsi-filter-sync.patch b/queue-5.10/i40e-fix-null-ptr-dereference-on-vsi-filter-sync.patch new file mode 100644 index 00000000000..2f6d185a8e0 --- /dev/null +++ b/queue-5.10/i40e-fix-null-ptr-dereference-on-vsi-filter-sync.patch @@ -0,0 +1,68 @@ +From ce7428f23784a2f1aa490fbc40ee5ad77373367d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Feb 2021 12:07:48 +0000 +Subject: i40e: Fix NULL ptr dereference on VSI filter sync + +From: Michal Maloszewski + +[ Upstream commit 37d9e304acd903a445df8208b8a13d707902dea6 ] + +Remove the reason of null pointer dereference in sync VSI filters. +Added new I40E_VSI_RELEASING flag to signalize deleting and releasing +of VSI resources to sync this thread with sync filters subtask. +Without this patch it is possible to start update the VSI filter list +after VSI is removed, that's causing a kernel oops. + +Fixes: 41c445ff0f48 ("i40e: main driver core") +Signed-off-by: Grzegorz Szczurek +Signed-off-by: Michal Maloszewski +Reviewed-by: Przemyslaw Patynowski +Reviewed-by: Witold Fijalkowski +Reviewed-by: Jaroslaw Gawin +Reviewed-by: Aleksandr Loktionov +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e.h | 1 + + drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +++-- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h +index fe1258778cbc4..1f31f503fa92b 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -159,6 +159,7 @@ enum i40e_vsi_state_t { + __I40E_VSI_OVERFLOW_PROMISC, + __I40E_VSI_REINIT_REQUESTED, + __I40E_VSI_DOWN_REQUESTED, ++ __I40E_VSI_RELEASING, + /* This must be last as it determines the size of the BITMAP */ + __I40E_VSI_STATE_SIZE__, + }; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 52c2d6fdeb7a0..72405a0aabde7 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -2622,7 +2622,8 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf) + + for (v = 0; v < pf->num_alloc_vsi; v++) { + if (pf->vsi[v] && +- (pf->vsi[v]->flags & I40E_VSI_FLAG_FILTER_CHANGED)) { ++ (pf->vsi[v]->flags & I40E_VSI_FLAG_FILTER_CHANGED) && ++ !test_bit(__I40E_VSI_RELEASING, pf->vsi[v]->state)) { + int ret = i40e_sync_vsi_filters(pf->vsi[v]); + + if (ret) { +@@ -13308,7 +13309,7 @@ int i40e_vsi_release(struct i40e_vsi *vsi) + dev_info(&pf->pdev->dev, "Can't remove PF VSI\n"); + return -ENODEV; + } +- ++ set_bit(__I40E_VSI_RELEASING, vsi->state); + uplink_seid = vsi->uplink_seid; + if (vsi->type != I40E_VSI_SRIOV) { + if (vsi->netdev_registered) { +-- +2.33.0 + diff --git a/queue-5.10/i40e-fix-ping-is-lost-after-configuring-adq-on-vf.patch b/queue-5.10/i40e-fix-ping-is-lost-after-configuring-adq-on-vf.patch new file mode 100644 index 00000000000..c6de5346202 --- /dev/null +++ b/queue-5.10/i40e-fix-ping-is-lost-after-configuring-adq-on-vf.patch @@ -0,0 +1,184 @@ +From b2efee83b318da8c51fe6f63512f5506829d0048 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 13:43:26 +0200 +Subject: i40e: Fix ping is lost after configuring ADq on VF + +From: Eryk Rybak + +[ Upstream commit 9e0a603cb7dce2a19d98116d42de84b6db26d716 ] + +Properly reconfigure VF VSIs after VF request ADQ. +Created new function to update queue mapping and queue pairs per TC +with AQ update VSI. This sets proper RSS size on NIC. +VFs num_queue_pairs should not be changed during setup of queue maps. +Previously, VF main VSI in ADQ had configured too many queues and had +wrong RSS size, which lead to packets not being consumed and drops in +connectivity. + +Fixes: bc6d33c8d93f ("i40e: Fix the number of queues available to be mapped for use") +Co-developed-by: Przemyslaw Patynowski +Signed-off-by: Przemyslaw Patynowski +Signed-off-by: Eryk Rybak +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e.h | 1 + + drivers/net/ethernet/intel/i40e/i40e_main.c | 64 ++++++++++++++++++- + .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 17 +++-- + 3 files changed, 74 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h +index 1f31f503fa92b..5b83d1bc0e74d 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -1145,6 +1145,7 @@ void i40e_ptp_save_hw_time(struct i40e_pf *pf); + void i40e_ptp_restore_hw_time(struct i40e_pf *pf); + void i40e_ptp_init(struct i40e_pf *pf); + void i40e_ptp_stop(struct i40e_pf *pf); ++int i40e_update_adq_vsi_queues(struct i40e_vsi *vsi, int vsi_offset); + int i40e_is_vsi_uplink_mode_veb(struct i40e_vsi *vsi); + i40e_status i40e_get_partition_bw_setting(struct i40e_pf *pf); + i40e_status i40e_set_partition_bw_setting(struct i40e_pf *pf); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 48856dea512c8..7f224dbe9c0ae 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -1800,6 +1800,8 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi, + + sections = I40E_AQ_VSI_PROP_QUEUE_MAP_VALID; + offset = 0; ++ /* zero out queue mapping, it will get updated on the end of the function */ ++ memset(ctxt->info.queue_mapping, 0, sizeof(ctxt->info.queue_mapping)); + + if (vsi->type == I40E_VSI_MAIN) { + /* This code helps add more queue to the VSI if we have +@@ -1816,10 +1818,12 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi, + } + + /* Number of queues per enabled TC */ +- if (vsi->type == I40E_VSI_MAIN) ++ if (vsi->type == I40E_VSI_MAIN || ++ (vsi->type == I40E_VSI_SRIOV && vsi->num_queue_pairs != 0)) + num_tc_qps = vsi->num_queue_pairs; + else + num_tc_qps = vsi->alloc_queue_pairs; ++ + if (enabled_tc && (vsi->back->flags & I40E_FLAG_DCB_ENABLED)) { + /* Find numtc from enabled TC bitmap */ + for (i = 0, numtc = 0; i < I40E_MAX_TRAFFIC_CLASS; i++) { +@@ -1897,10 +1901,12 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi, + } + ctxt->info.tc_mapping[i] = cpu_to_le16(qmap); + } +- /* Do not change previously set num_queue_pairs for PFs */ ++ /* Do not change previously set num_queue_pairs for PFs and VFs*/ + if ((vsi->type == I40E_VSI_MAIN && numtc != 1) || +- vsi->type != I40E_VSI_MAIN) ++ (vsi->type == I40E_VSI_SRIOV && vsi->num_queue_pairs == 0) || ++ (vsi->type != I40E_VSI_MAIN && vsi->type != I40E_VSI_SRIOV)) + vsi->num_queue_pairs = offset; ++ + /* Scheduler section valid can only be set for ADD VSI */ + if (is_add) { + sections |= I40E_AQ_VSI_PROP_SCHED_VALID; +@@ -5405,6 +5411,58 @@ static void i40e_vsi_update_queue_map(struct i40e_vsi *vsi, + sizeof(vsi->info.tc_mapping)); + } + ++/** ++ * i40e_update_adq_vsi_queues - update queue mapping for ADq VSI ++ * @vsi: the VSI being reconfigured ++ * @vsi_offset: offset from main VF VSI ++ */ ++int i40e_update_adq_vsi_queues(struct i40e_vsi *vsi, int vsi_offset) ++{ ++ struct i40e_vsi_context ctxt = {}; ++ struct i40e_pf *pf; ++ struct i40e_hw *hw; ++ int ret; ++ ++ if (!vsi) ++ return I40E_ERR_PARAM; ++ pf = vsi->back; ++ hw = &pf->hw; ++ ++ ctxt.seid = vsi->seid; ++ ctxt.pf_num = hw->pf_id; ++ ctxt.vf_num = vsi->vf_id + hw->func_caps.vf_base_id + vsi_offset; ++ ctxt.uplink_seid = vsi->uplink_seid; ++ ctxt.connection_type = I40E_AQ_VSI_CONN_TYPE_NORMAL; ++ ctxt.flags = I40E_AQ_VSI_TYPE_VF; ++ ctxt.info = vsi->info; ++ ++ i40e_vsi_setup_queue_map(vsi, &ctxt, vsi->tc_config.enabled_tc, ++ false); ++ if (vsi->reconfig_rss) { ++ vsi->rss_size = min_t(int, pf->alloc_rss_size, ++ vsi->num_queue_pairs); ++ ret = i40e_vsi_config_rss(vsi); ++ if (ret) { ++ dev_info(&pf->pdev->dev, "Failed to reconfig rss for num_queues\n"); ++ return ret; ++ } ++ vsi->reconfig_rss = false; ++ } ++ ++ ret = i40e_aq_update_vsi_params(hw, &ctxt, NULL); ++ if (ret) { ++ dev_info(&pf->pdev->dev, "Update vsi config failed, err %s aq_err %s\n", ++ i40e_stat_str(hw, ret), ++ i40e_aq_str(hw, hw->aq.asq_last_status)); ++ return ret; ++ } ++ /* update the local VSI info with updated queue map */ ++ i40e_vsi_update_queue_map(vsi, &ctxt); ++ vsi->info.valid_sections = 0; ++ ++ return ret; ++} ++ + /** + * i40e_vsi_config_tc - Configure VSI Tx Scheduler for given TC map + * @vsi: VSI to be configured +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index dacd1453b7311..7cf572d8bd140 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -2166,11 +2166,12 @@ static int i40e_vc_config_queues_msg(struct i40e_vf *vf, u8 *msg) + struct virtchnl_vsi_queue_config_info *qci = + (struct virtchnl_vsi_queue_config_info *)msg; + struct virtchnl_queue_pair_info *qpi; +- struct i40e_pf *pf = vf->pf; + u16 vsi_id, vsi_queue_id = 0; +- u16 num_qps_all = 0; ++ struct i40e_pf *pf = vf->pf; + i40e_status aq_ret = 0; + int i, j = 0, idx = 0; ++ struct i40e_vsi *vsi; ++ u16 num_qps_all = 0; + + if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) { + aq_ret = I40E_ERR_PARAM; +@@ -2259,9 +2260,15 @@ static int i40e_vc_config_queues_msg(struct i40e_vf *vf, u8 *msg) + pf->vsi[vf->lan_vsi_idx]->num_queue_pairs = + qci->num_queue_pairs; + } else { +- for (i = 0; i < vf->num_tc; i++) +- pf->vsi[vf->ch[i].vsi_idx]->num_queue_pairs = +- vf->ch[i].num_qps; ++ for (i = 0; i < vf->num_tc; i++) { ++ vsi = pf->vsi[vf->ch[i].vsi_idx]; ++ vsi->num_queue_pairs = vf->ch[i].num_qps; ++ ++ if (i40e_update_adq_vsi_queues(vsi, i)) { ++ aq_ret = I40E_ERR_CONFIG; ++ goto error_param; ++ } ++ } + } + + error_param: +-- +2.33.0 + diff --git a/queue-5.10/i40e-fix-warning-message-and-call-stack-during-rmmod.patch b/queue-5.10/i40e-fix-warning-message-and-call-stack-during-rmmod.patch new file mode 100644 index 00000000000..d903578f34f --- /dev/null +++ b/queue-5.10/i40e-fix-warning-message-and-call-stack-during-rmmod.patch @@ -0,0 +1,163 @@ +From 09c03127090c7511f0bb674f4db7e0e9f78ef76b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Apr 2021 10:19:41 +0200 +Subject: i40e: Fix warning message and call stack during rmmod i40e driver + +From: Karen Sornek + +[ Upstream commit 3a3b311e3881172fc8e019b6508f04bc40c92d9d ] + +Restore part of reset functionality used when reset is called +from the VF to reset itself. Without this fix warning message +is displayed when VF is being removed via sysfs. + +Fix the crash of the VF during reset by ensuring +that the PF receives the reset message successfully. +Refactor code to use one function instead of two. + +Fixes: 5c3c48ac6bf5 ("i40e: implement virtual device interface") +Signed-off-by: Grzegorz Szczurek +Signed-off-by: Karen Sornek +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 53 ++++++++----------- + 1 file changed, 21 insertions(+), 32 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 7cf572d8bd140..41c0a103119c1 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -130,17 +130,18 @@ void i40e_vc_notify_vf_reset(struct i40e_vf *vf) + /***********************misc routines*****************************/ + + /** +- * i40e_vc_disable_vf ++ * i40e_vc_reset_vf + * @vf: pointer to the VF info +- * +- * Disable the VF through a SW reset. ++ * @notify_vf: notify vf about reset or not ++ * Reset VF handler. + **/ +-static inline void i40e_vc_disable_vf(struct i40e_vf *vf) ++static void i40e_vc_reset_vf(struct i40e_vf *vf, bool notify_vf) + { + struct i40e_pf *pf = vf->pf; + int i; + +- i40e_vc_notify_vf_reset(vf); ++ if (notify_vf) ++ i40e_vc_notify_vf_reset(vf); + + /* We want to ensure that an actual reset occurs initiated after this + * function was called. However, we do not want to wait forever, so +@@ -158,9 +159,14 @@ static inline void i40e_vc_disable_vf(struct i40e_vf *vf) + usleep_range(10000, 20000); + } + +- dev_warn(&vf->pf->pdev->dev, +- "Failed to initiate reset for VF %d after 200 milliseconds\n", +- vf->vf_id); ++ if (notify_vf) ++ dev_warn(&vf->pf->pdev->dev, ++ "Failed to initiate reset for VF %d after 200 milliseconds\n", ++ vf->vf_id); ++ else ++ dev_dbg(&vf->pf->pdev->dev, ++ "Failed to initiate reset for VF %d after 200 milliseconds\n", ++ vf->vf_id); + } + + /** +@@ -2054,20 +2060,6 @@ err: + return ret; + } + +-/** +- * i40e_vc_reset_vf_msg +- * @vf: pointer to the VF info +- * +- * called from the VF to reset itself, +- * unlike other virtchnl messages, PF driver +- * doesn't send the response back to the VF +- **/ +-static void i40e_vc_reset_vf_msg(struct i40e_vf *vf) +-{ +- if (test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) +- i40e_reset_vf(vf, false); +-} +- + /** + * i40e_vc_config_promiscuous_mode_msg + * @vf: pointer to the VF info +@@ -2563,8 +2555,7 @@ static int i40e_vc_request_queues_msg(struct i40e_vf *vf, u8 *msg) + } else { + /* successful request */ + vf->num_req_queues = req_pairs; +- i40e_vc_notify_vf_reset(vf); +- i40e_reset_vf(vf, false); ++ i40e_vc_reset_vf(vf, true); + return 0; + } + +@@ -3777,8 +3768,7 @@ static int i40e_vc_add_qch_msg(struct i40e_vf *vf, u8 *msg) + vf->num_req_queues = 0; + + /* reset the VF in order to allocate resources */ +- i40e_vc_notify_vf_reset(vf); +- i40e_reset_vf(vf, false); ++ i40e_vc_reset_vf(vf, true); + + return I40E_SUCCESS; + +@@ -3818,8 +3808,7 @@ static int i40e_vc_del_qch_msg(struct i40e_vf *vf, u8 *msg) + } + + /* reset the VF in order to allocate resources */ +- i40e_vc_notify_vf_reset(vf); +- i40e_reset_vf(vf, false); ++ i40e_vc_reset_vf(vf, true); + + return I40E_SUCCESS; + +@@ -3881,7 +3870,7 @@ int i40e_vc_process_vf_msg(struct i40e_pf *pf, s16 vf_id, u32 v_opcode, + i40e_vc_notify_vf_link_state(vf); + break; + case VIRTCHNL_OP_RESET_VF: +- i40e_vc_reset_vf_msg(vf); ++ i40e_vc_reset_vf(vf, false); + ret = 0; + break; + case VIRTCHNL_OP_CONFIG_PROMISCUOUS_MODE: +@@ -4135,7 +4124,7 @@ int i40e_ndo_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac) + /* Force the VF interface down so it has to bring up with new MAC + * address + */ +- i40e_vc_disable_vf(vf); ++ i40e_vc_reset_vf(vf, true); + dev_info(&pf->pdev->dev, "Bring down and up the VF interface to make this change effective.\n"); + + error_param: +@@ -4199,7 +4188,7 @@ int i40e_ndo_set_vf_port_vlan(struct net_device *netdev, int vf_id, + /* duplicate request, so just return success */ + goto error_pvid; + +- i40e_vc_disable_vf(vf); ++ i40e_vc_reset_vf(vf, true); + /* During reset the VF got a new VSI, so refresh a pointer. */ + vsi = pf->vsi[vf->lan_vsi_idx]; + /* Locked once because multiple functions below iterate list */ +@@ -4582,7 +4571,7 @@ int i40e_ndo_set_vf_trust(struct net_device *netdev, int vf_id, bool setting) + goto out; + + vf->trusted = setting; +- i40e_vc_disable_vf(vf); ++ i40e_vc_reset_vf(vf, true); + dev_info(&pf->pdev->dev, "VF %u is now %strusted\n", + vf_id, setting ? "" : "un"); + +-- +2.33.0 + diff --git a/queue-5.10/iavf-check-for-null-in-iavf_fix_features.patch b/queue-5.10/iavf-check-for-null-in-iavf_fix_features.patch new file mode 100644 index 00000000000..18fe5a531af --- /dev/null +++ b/queue-5.10/iavf-check-for-null-in-iavf_fix_features.patch @@ -0,0 +1,41 @@ +From 2acdb24dc8bd8a3e328523f89368486a505f7ee5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 09:48:53 -0700 +Subject: iavf: check for null in iavf_fix_features + +From: Nicholas Nunley + +[ Upstream commit 8a4a126f4be88eb8b5f00a165ab58c35edf4ef76 ] + +If the driver has lost contact with the PF then it enters a disabled state +and frees adapter->vf_res. However, ndo_fix_features can still be called on +the interface, so we need to check for this condition first. Since we have +no information on the features at this time simply leave them unmodified +and return. + +Fixes: c4445aedfe09 ("i40evf: Fix VLAN features") +Signed-off-by: Nicholas Nunley +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index f06c079e812ec..ef0103a216d1e 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -3419,7 +3419,8 @@ static netdev_features_t iavf_fix_features(struct net_device *netdev, + { + struct iavf_adapter *adapter = netdev_priv(netdev); + +- if (!(adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN)) ++ if (adapter->vf_res && ++ !(adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN)) + features &= ~(NETIF_F_HW_VLAN_CTAG_TX | + NETIF_F_HW_VLAN_CTAG_RX | + NETIF_F_HW_VLAN_CTAG_FILTER); +-- +2.33.0 + diff --git a/queue-5.10/iavf-fix-failure-to-exit-out-from-last-all-multicast.patch b/queue-5.10/iavf-fix-failure-to-exit-out-from-last-all-multicast.patch new file mode 100644 index 00000000000..f70cbaf0810 --- /dev/null +++ b/queue-5.10/iavf-fix-failure-to-exit-out-from-last-all-multicast.patch @@ -0,0 +1,41 @@ +From 75cf756642582e974763c5a869fe63c29984f46d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 09:48:56 -0700 +Subject: iavf: Fix failure to exit out from last all-multicast mode + +From: Piotr Marczak + +[ Upstream commit 8905072a192fffe9389255489db250c73ecab008 ] + +The driver could only quit allmulti when allmulti and promisc modes are +turn on at the same time. If promisc had been off there was no way to turn +off allmulti mode. +The patch corrects this behavior. Switching allmulti does not depends on +promisc state mode anymore + +Fixes: f42a5c74da99 ("i40e: Add allmulti support for the VF") +Signed-off-by: Piotr Marczak +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 3e4bf3559d13b..b0fe5aafd1b26 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -1616,8 +1616,7 @@ static int iavf_process_aq_command(struct iavf_adapter *adapter) + iavf_set_promiscuous(adapter, FLAG_VF_MULTICAST_PROMISC); + return 0; + } +- +- if ((adapter->aq_required & IAVF_FLAG_AQ_RELEASE_PROMISC) && ++ if ((adapter->aq_required & IAVF_FLAG_AQ_RELEASE_PROMISC) || + (adapter->aq_required & IAVF_FLAG_AQ_RELEASE_ALLMULTI)) { + iavf_set_promiscuous(adapter, 0); + return 0; +-- +2.33.0 + diff --git a/queue-5.10/iavf-fix-for-setting-queues-to-0.patch b/queue-5.10/iavf-fix-for-setting-queues-to-0.patch new file mode 100644 index 00000000000..c672ca5f6a4 --- /dev/null +++ b/queue-5.10/iavf-fix-for-setting-queues-to-0.patch @@ -0,0 +1,41 @@ +From e1f087a42fd9edd1971449e235dee2431101d10e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 09:49:00 -0700 +Subject: iavf: Fix for setting queues to 0 + +From: Grzegorz Szczurek + +[ Upstream commit 9a6e9e483a9684a34573fd9f9e30ecfb047cb8cb ] + +Now setting combine to 0 will be rejected with the +appropriate error code. +This has been implemented by adding a condition that checks +the value of combine equal to zero. +Without this patch, when the user requested it, no error was +returned and combine was set to the default value for VF. + +Fixes: 5520deb15326 ("iavf: Enable support for up to 16 queues") +Signed-off-by: Grzegorz Szczurek +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c +index 5508ccbf9f57b..ea85b06857fa2 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c +@@ -903,7 +903,7 @@ static int iavf_set_channels(struct net_device *netdev, + /* All of these should have already been checked by ethtool before this + * even gets to us, but just to be sure. + */ +- if (num_req > adapter->vsi_res->num_queue_pairs) ++ if (num_req == 0 || num_req > adapter->vsi_res->num_queue_pairs) + return -EINVAL; + + if (num_req == adapter->num_active_queues) +-- +2.33.0 + diff --git a/queue-5.10/iavf-fix-for-the-false-positive-asq-arq-errors-while.patch b/queue-5.10/iavf-fix-for-the-false-positive-asq-arq-errors-while.patch new file mode 100644 index 00000000000..7ae8e1b82a5 --- /dev/null +++ b/queue-5.10/iavf-fix-for-the-false-positive-asq-arq-errors-while.patch @@ -0,0 +1,43 @@ +From b76f8a48c03aeedb08823c1aafbd5fd6087fa17a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 09:48:59 -0700 +Subject: iavf: Fix for the false positive ASQ/ARQ errors while issuing VF + reset + +From: Surabhi Boob + +[ Upstream commit 321421b57a12e933f92b228e0e6d0b2c6541f41d ] + +While issuing VF Reset from the guest OS, the VF driver prints +logs about critical / Overflow error detection. This is not an +actual error since the VF_MBX_ARQLEN register is set to all FF's +for a short period of time and the VF would catch the bits set if +it was reading the register during that spike of time. +This patch introduces an additional check to ignore this condition +since the VF is in reset. + +Fixes: 19b73d8efaa4 ("i40evf: Add additional check for reset") +Signed-off-by: Surabhi Boob +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 90a9379b4e467..643679cad8657 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -2329,7 +2329,7 @@ static void iavf_adminq_task(struct work_struct *work) + + /* check for error indications */ + val = rd32(hw, hw->aq.arq.len); +- if (val == 0xdeadbeef) /* indicates device in reset */ ++ if (val == 0xdeadbeef || val == 0xffffffff) /* device in reset */ + goto freedom; + oldval = val; + if (val & IAVF_VF_ARQLEN1_ARQVFE_MASK) { +-- +2.33.0 + diff --git a/queue-5.10/iavf-fix-return-of-set-the-new-channel-count.patch b/queue-5.10/iavf-fix-return-of-set-the-new-channel-count.patch new file mode 100644 index 00000000000..b14d84b4685 --- /dev/null +++ b/queue-5.10/iavf-fix-return-of-set-the-new-channel-count.patch @@ -0,0 +1,62 @@ +From 3ae63fc4588ab0ae0489f8da46f574015872a8b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 11:59:38 +0000 +Subject: iavf: Fix return of set the new channel count + +From: Mateusz Palczewski + +[ Upstream commit 4e5e6b5d9d1334d3490326b6922a2daaf56a867f ] + +Fixed return correct code from set the new channel count. +Implemented by check if reset is done in appropriate time. +This solution give a extra time to pf for reset vf in case +when user want set new channel count for all vfs. +Without this patch it is possible to return misleading output +code to user and vf reset not to be correctly performed by pf. + +Fixes: 5520deb15326 ("iavf: Enable support for up to 16 queues") +Signed-off-by: Grzegorz Szczurek +Signed-off-by: Mateusz Palczewski +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c +index c93567f4d0f79..17ec36c4e6c19 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c +@@ -892,6 +892,7 @@ static int iavf_set_channels(struct net_device *netdev, + { + struct iavf_adapter *adapter = netdev_priv(netdev); + u32 num_req = ch->combined_count; ++ int i; + + if ((adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ADQ) && + adapter->num_tc) { +@@ -914,6 +915,20 @@ static int iavf_set_channels(struct net_device *netdev, + adapter->num_req_queues = num_req; + adapter->flags |= IAVF_FLAG_REINIT_ITR_NEEDED; + iavf_schedule_reset(adapter); ++ ++ /* wait for the reset is done */ ++ for (i = 0; i < IAVF_RESET_WAIT_COMPLETE_COUNT; i++) { ++ msleep(IAVF_RESET_WAIT_MS); ++ if (adapter->flags & IAVF_FLAG_RESET_PENDING) ++ continue; ++ break; ++ } ++ if (i == IAVF_RESET_WAIT_COMPLETE_COUNT) { ++ adapter->flags &= ~IAVF_FLAG_REINIT_ITR_NEEDED; ++ adapter->num_active_queues = num_req; ++ return -EOPNOTSUPP; ++ } ++ + return 0; + } + +-- +2.33.0 + diff --git a/queue-5.10/iavf-free-q_vectors-before-queues-in-iavf_disable_vf.patch b/queue-5.10/iavf-free-q_vectors-before-queues-in-iavf_disable_vf.patch new file mode 100644 index 00000000000..a9b8d0aca8c --- /dev/null +++ b/queue-5.10/iavf-free-q_vectors-before-queues-in-iavf_disable_vf.patch @@ -0,0 +1,41 @@ +From 93751221828cb0d6152417e8d9784a55a41808cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 09:48:54 -0700 +Subject: iavf: free q_vectors before queues in iavf_disable_vf + +From: Nicholas Nunley + +[ Upstream commit 89f22f129696ab53cfbc608e0a2184d0fea46ac1 ] + +iavf_free_queues() clears adapter->num_active_queues, which +iavf_free_q_vectors() relies on, so swap the order of these two function +calls in iavf_disable_vf(). This resolves a panic encountered when the +interface is disabled and then later brought up again after PF +communication is restored. + +Fixes: 65c7006f234c ("i40evf: assign num_active_queues inside i40evf_alloc_queues") +Signed-off-by: Nicholas Nunley +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index ef0103a216d1e..3e4bf3559d13b 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -2047,8 +2047,8 @@ static void iavf_disable_vf(struct iavf_adapter *adapter) + + iavf_free_misc_irq(adapter); + iavf_reset_interrupt_capability(adapter); +- iavf_free_queues(adapter); + iavf_free_q_vectors(adapter); ++ iavf_free_queues(adapter); + memset(adapter->vf_res, 0, IAVF_VIRTCHNL_VF_RESOURCE_SIZE); + iavf_shutdown_adminq(&adapter->hw); + adapter->netdev->flags &= ~IFF_UP; +-- +2.33.0 + diff --git a/queue-5.10/iavf-prevent-accidental-free-of-filter-structure.patch b/queue-5.10/iavf-prevent-accidental-free-of-filter-structure.patch new file mode 100644 index 00000000000..56416d8bc32 --- /dev/null +++ b/queue-5.10/iavf-prevent-accidental-free-of-filter-structure.patch @@ -0,0 +1,55 @@ +From 7e7997cd3cae71432cf8cff84b05086b5af1ccec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 09:48:57 -0700 +Subject: iavf: prevent accidental free of filter structure + +From: Jacob Keller + +[ Upstream commit 4f0400803818f2642f066d3eacaf013f23554cc7 ] + +In iavf_config_clsflower, the filter structure could be accidentally +released at the end, if iavf_parse_cls_flower or iavf_handle_tclass ever +return a non-zero but positive value. + +In this case, the function continues through to the end, and will call +kfree() on the filter structure even though it has been added to the +linked list. + +This can actually happen because iavf_parse_cls_flower will return +a positive IAVF_ERR_CONFIG value instead of the traditional negative +error codes. + +Fix this by ensuring that the kfree() check and error checks are +similar. Use the more idiomatic "if (err)" to catch all non-zero error +codes. + +Fixes: 0075fa0fadd0 ("i40evf: Add support to apply cloud filters") +Signed-off-by: Jacob Keller +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index b0fe5aafd1b26..90a9379b4e467 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -3027,11 +3027,11 @@ static int iavf_configure_clsflower(struct iavf_adapter *adapter, + /* start out with flow type and eth type IPv4 to begin with */ + filter->f.flow_type = VIRTCHNL_TCP_V4_FLOW; + err = iavf_parse_cls_flower(adapter, cls_flower, filter); +- if (err < 0) ++ if (err) + goto err; + + err = iavf_handle_tclass(adapter, tc, filter); +- if (err < 0) ++ if (err) + goto err; + + /* add filter to the list */ +-- +2.33.0 + diff --git a/queue-5.10/iavf-validate-pointers.patch b/queue-5.10/iavf-validate-pointers.patch new file mode 100644 index 00000000000..bfe1505bd73 --- /dev/null +++ b/queue-5.10/iavf-validate-pointers.patch @@ -0,0 +1,50 @@ +From 153f3442ee269a0ce620e7b30757a1310654f6bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 09:48:58 -0700 +Subject: iavf: validate pointers + +From: Mitch Williams + +[ Upstream commit 131b0edc4028bb88bb472456b1ddba526cfb7036 ] + +In some cases, the ethtool get_rxfh handler may be called with a null +key or indir parameter. So check these pointers, or you will have a very +bad day. + +Fixes: 43a3d9ba34c9 ("i40evf: Allow PF driver to configure RSS") +Signed-off-by: Mitch Williams +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c +index 17ec36c4e6c19..5508ccbf9f57b 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c +@@ -975,14 +975,13 @@ static int iavf_get_rxfh(struct net_device *netdev, u32 *indir, u8 *key, + + if (hfunc) + *hfunc = ETH_RSS_HASH_TOP; +- if (!indir) +- return 0; +- +- memcpy(key, adapter->rss_key, adapter->rss_key_size); ++ if (key) ++ memcpy(key, adapter->rss_key, adapter->rss_key_size); + +- /* Each 32 bits pointed by 'indir' is stored with a lut entry */ +- for (i = 0; i < adapter->rss_lut_size; i++) +- indir[i] = (u32)adapter->rss_lut[i]; ++ if (indir) ++ /* Each 32 bits pointed by 'indir' is stored with a lut entry */ ++ for (i = 0; i < adapter->rss_lut_size; i++) ++ indir[i] = (u32)adapter->rss_lut[i]; + + return 0; + } +-- +2.33.0 + diff --git a/queue-5.10/iio-imu-st_lsm6dsx-avoid-potential-array-overflow-in.patch b/queue-5.10/iio-imu-st_lsm6dsx-avoid-potential-array-overflow-in.patch new file mode 100644 index 00000000000..43bd6dcbcb6 --- /dev/null +++ b/queue-5.10/iio-imu-st_lsm6dsx-avoid-potential-array-overflow-in.patch @@ -0,0 +1,65 @@ +From 9c1f76b7eb0dbced60ff2d5f32b674677e4add49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Oct 2021 19:40:03 +0800 +Subject: iio: imu: st_lsm6dsx: Avoid potential array overflow in + st_lsm6dsx_set_odr() + +From: Teng Qi + +[ Upstream commit 94be878c882d8d784ff44c639bf55f3b029f85af ] + +The length of hw->settings->odr_table is 2 and ref_sensor->id is an enum +variable whose value is between 0 and 5. +However, the value ST_LSM6DSX_ID_MAX (i.e. 5) is not caught properly in + switch (sensor->id) { + +If ref_sensor->id is ST_LSM6DSX_ID_MAX, an array overflow will ocurrs in +function st_lsm6dsx_check_odr(): + odr_table = &sensor->hw->settings->odr_table[sensor->id]; + +and in function st_lsm6dsx_set_odr(): + reg = &hw->settings->odr_table[ref_sensor->id].reg; + +To avoid this array overflow, handle ST_LSM6DSX_ID_GYRO explicitly and +return -EINVAL for the default case. + +The enum value ST_LSM6DSX_ID_MAX is only present as an easy way to check +the limit and as such is never used, however this is not locally obvious. + +Reported-by: TOTE Robot +Signed-off-by: Teng Qi +Acked-by: Lorenzo Bianconi +Link: https://lore.kernel.org/r/20211011114003.976221-1-starmiku1207184332@gmail.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +index 2ab1ac5a2412f..558ca3843bb95 100644 +--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c ++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +@@ -1465,6 +1465,8 @@ st_lsm6dsx_set_odr(struct st_lsm6dsx_sensor *sensor, u32 req_odr) + int err; + + switch (sensor->id) { ++ case ST_LSM6DSX_ID_GYRO: ++ break; + case ST_LSM6DSX_ID_EXT0: + case ST_LSM6DSX_ID_EXT1: + case ST_LSM6DSX_ID_EXT2: +@@ -1490,8 +1492,8 @@ st_lsm6dsx_set_odr(struct st_lsm6dsx_sensor *sensor, u32 req_odr) + } + break; + } +- default: +- break; ++ default: /* should never occur */ ++ return -EINVAL; + } + + if (req_odr > 0) { +-- +2.33.0 + diff --git a/queue-5.10/maple-fix-wrong-return-value-of-maple_bus_init.patch b/queue-5.10/maple-fix-wrong-return-value-of-maple_bus_init.patch new file mode 100644 index 00000000000..21e5416cfd8 --- /dev/null +++ b/queue-5.10/maple-fix-wrong-return-value-of-maple_bus_init.patch @@ -0,0 +1,50 @@ +From 048830004b26ffc319684fc1dbf1cb4799800880 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 10:43:11 +0800 +Subject: maple: fix wrong return value of maple_bus_init(). + +From: Lu Wei + +[ Upstream commit bde82ee391fa6d3ad054313c4aa7b726d32515ce ] + +If KMEM_CACHE or maple_alloc_dev failed, the maple_bus_init() will return 0 +rather than error, because the retval is not changed after KMEM_CACHE or +maple_alloc_dev failed. + +Fixes: 17be2d2b1c33 ("sh: Add maple bus support for the SEGA Dreamcast.") +Reported-by: Hulk Robot +Signed-off-by: Lu Wei +Acked-by: John Paul Adrian Glaubitz +Signed-off-by: Rich Felker +Signed-off-by: Sasha Levin +--- + drivers/sh/maple/maple.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/sh/maple/maple.c b/drivers/sh/maple/maple.c +index e5d7fb81ad665..44a931d41a132 100644 +--- a/drivers/sh/maple/maple.c ++++ b/drivers/sh/maple/maple.c +@@ -835,8 +835,10 @@ static int __init maple_bus_init(void) + + maple_queue_cache = KMEM_CACHE(maple_buffer, SLAB_HWCACHE_ALIGN); + +- if (!maple_queue_cache) ++ if (!maple_queue_cache) { ++ retval = -ENOMEM; + goto cleanup_bothirqs; ++ } + + INIT_LIST_HEAD(&maple_waitq); + INIT_LIST_HEAD(&maple_sentq); +@@ -849,6 +851,7 @@ static int __init maple_bus_init(void) + if (!mdev[i]) { + while (i-- > 0) + maple_free_dev(mdev[i]); ++ retval = -ENOMEM; + goto cleanup_cache; + } + baseunits[i] = mdev[i]; +-- +2.33.0 + diff --git a/queue-5.10/mips-bcm63xx-add-support-for-clk_get_parent.patch b/queue-5.10/mips-bcm63xx-add-support-for-clk_get_parent.patch new file mode 100644 index 00000000000..6c8b5c79a23 --- /dev/null +++ b/queue-5.10/mips-bcm63xx-add-support-for-clk_get_parent.patch @@ -0,0 +1,65 @@ +From a3922199c8fd65eb6ba15738ed05511c1fcb6293 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Nov 2021 16:42:18 -0800 +Subject: mips: bcm63xx: add support for clk_get_parent() + +From: Randy Dunlap + +[ Upstream commit e8f67482e5a4bc8d0b65d606d08cb60ee123b468 ] + +BCM63XX selects HAVE_LEGACY_CLK but does not provide/support +clk_get_parent(), so add a simple implementation of that +function so that callers of it will build without errors. + +Fixes these build errors: + +mips-linux-ld: drivers/iio/adc/ingenic-adc.o: in function `jz4770_adc_init_clk_div': +ingenic-adc.c:(.text+0xe4): undefined reference to `clk_get_parent' +mips-linux-ld: drivers/iio/adc/ingenic-adc.o: in function `jz4725b_adc_init_clk_div': +ingenic-adc.c:(.text+0x1b8): undefined reference to `clk_get_parent' + +Fixes: e7300d04bd08 ("MIPS: BCM63xx: Add support for the Broadcom BCM63xx family of SOCs." ) +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Suggested-by: Russell King (Oracle) +Cc: Artur Rojek +Cc: Paul Cercueil +Cc: linux-mips@vger.kernel.org +Cc: Jonathan Cameron +Cc: Lars-Peter Clausen +Cc: linux-iio@vger.kernel.org +Cc: Florian Fainelli +Cc: Andy Shevchenko +Cc: Russell King +Cc: bcm-kernel-feedback-list@broadcom.com +Cc: Jonas Gorski +Reviewed-by: Andy Shevchenko +Acked-by: Jonathan Cameron +Acked-by: Russell King (Oracle) +Acked-by: Florian Fainelli +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/bcm63xx/clk.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/mips/bcm63xx/clk.c b/arch/mips/bcm63xx/clk.c +index 164115944a7fd..aba6e2d6a736c 100644 +--- a/arch/mips/bcm63xx/clk.c ++++ b/arch/mips/bcm63xx/clk.c +@@ -381,6 +381,12 @@ void clk_disable(struct clk *clk) + + EXPORT_SYMBOL(clk_disable); + ++struct clk *clk_get_parent(struct clk *clk) ++{ ++ return NULL; ++} ++EXPORT_SYMBOL(clk_get_parent); ++ + unsigned long clk_get_rate(struct clk *clk) + { + if (!clk) +-- +2.33.0 + diff --git a/queue-5.10/mips-bcm63xx-ensure-that-cpu_supports_32bit_kernel-i.patch b/queue-5.10/mips-bcm63xx-ensure-that-cpu_supports_32bit_kernel-i.patch new file mode 100644 index 00000000000..16dddbb1ece --- /dev/null +++ b/queue-5.10/mips-bcm63xx-ensure-that-cpu_supports_32bit_kernel-i.patch @@ -0,0 +1,64 @@ +From 7eb6abe7c244fecc79abec23c431e584fcd123c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Nov 2021 08:49:11 -0700 +Subject: mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set + +From: Randy Dunlap + +[ Upstream commit 5eeaafc8d69373c095e461bdb39e5c9b62228ac5 ] + +Several header files need info on CONFIG_32BIT or CONFIG_64BIT, +but kconfig symbol BCM63XX does not provide that info. This leads +to many build errors, e.g.: + + arch/mips/include/asm/page.h:196:13: error: use of undeclared identifier 'CAC_BASE' + return x - PAGE_OFFSET + PHYS_OFFSET; + arch/mips/include/asm/mach-generic/spaces.h:91:23: note: expanded from macro 'PAGE_OFFSET' + #define PAGE_OFFSET (CAC_BASE + PHYS_OFFSET) + arch/mips/include/asm/io.h:134:28: error: use of undeclared identifier 'CAC_BASE' + return (void *)(address + PAGE_OFFSET - PHYS_OFFSET); + arch/mips/include/asm/mach-generic/spaces.h:91:23: note: expanded from macro 'PAGE_OFFSET' + #define PAGE_OFFSET (CAC_BASE + PHYS_OFFSET) + +arch/mips/include/asm/uaccess.h:82:10: error: use of undeclared identifier '__UA_LIMIT' + return (__UA_LIMIT & (addr | (addr + size) | __ua_size(size))) == 0; + +Selecting the SYS_HAS_CPU_BMIPS* symbols causes SYS_HAS_CPU_BMIPS to be +set, which then selects CPU_SUPPORT_32BIT_KERNEL, which causes +CONFIG_32BIT to be set. (a bit more indirect than v1 [RFC].) + +Fixes: e7300d04bd08 ("MIPS: BCM63xx: Add support for the Broadcom BCM63xx family of SOCs.") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Cc: Thomas Bogendoerfer +Cc: Florian Fainelli +Cc: bcm-kernel-feedback-list@broadcom.com +Cc: linux-mips@vger.kernel.org +Cc: Paul Burton +Cc: Maxime Bizon +Cc: Ralf Baechle +Suggested-by: Florian Fainelli +Acked-by: Florian Fainelli +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/Kconfig | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig +index 5c6e9ed9b2a75..94a748e95231b 100644 +--- a/arch/mips/Kconfig ++++ b/arch/mips/Kconfig +@@ -320,6 +320,9 @@ config BCM63XX + select SYS_SUPPORTS_32BIT_KERNEL + select SYS_SUPPORTS_BIG_ENDIAN + select SYS_HAS_EARLY_PRINTK ++ select SYS_HAS_CPU_BMIPS32_3300 ++ select SYS_HAS_CPU_BMIPS4350 ++ select SYS_HAS_CPU_BMIPS4380 + select SWAP_IO_SPACE + select GPIOLIB + select MIPS_L1_CACHE_SHIFT_4 +-- +2.33.0 + diff --git a/queue-5.10/mips-generic-yamon-dt-fix-uninitialized-variable-err.patch b/queue-5.10/mips-generic-yamon-dt-fix-uninitialized-variable-err.patch new file mode 100644 index 00000000000..df70d47a4aa --- /dev/null +++ b/queue-5.10/mips-generic-yamon-dt-fix-uninitialized-variable-err.patch @@ -0,0 +1,41 @@ +From 58494cfdf152ea934ab7c5452fbc31e5de335cf8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Nov 2021 23:28:24 +0000 +Subject: MIPS: generic/yamon-dt: fix uninitialized variable error + +From: Colin Ian King + +[ Upstream commit 255e51da15baed47531beefd02f222e4dc01f1c1 ] + +In the case where fw_getenv returns an error when fetching values +for ememsizea and memsize then variable phys_memsize is not assigned +a variable and will be uninitialized on a zero check of phys_memsize. +Fix this by initializing phys_memsize to zero. + +Cleans up cppcheck error: +arch/mips/generic/yamon-dt.c:100:7: error: Uninitialized variable: phys_memsize [uninitvar] + +Fixes: f41d2430bbd6 ("MIPS: generic/yamon-dt: Support > 256MB of RAM") +Signed-off-by: Colin Ian King +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/generic/yamon-dt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/generic/yamon-dt.c b/arch/mips/generic/yamon-dt.c +index a3aa22c77cadc..a07a5edbcda78 100644 +--- a/arch/mips/generic/yamon-dt.c ++++ b/arch/mips/generic/yamon-dt.c +@@ -75,7 +75,7 @@ static unsigned int __init gen_fdt_mem_array( + __init int yamon_dt_append_memory(void *fdt, + const struct yamon_mem_region *regions) + { +- unsigned long phys_memsize, memsize; ++ unsigned long phys_memsize = 0, memsize; + __be32 mem_array[2 * MAX_MEM_ARRAY_ENTRIES]; + unsigned int mem_entries; + int i, err, mem_off; +-- +2.33.0 + diff --git a/queue-5.10/mips-lantiq-add-support-for-clk_get_parent.patch b/queue-5.10/mips-lantiq-add-support-for-clk_get_parent.patch new file mode 100644 index 00000000000..aa5b98e217f --- /dev/null +++ b/queue-5.10/mips-lantiq-add-support-for-clk_get_parent.patch @@ -0,0 +1,53 @@ +From 3230858ac6b43096076b52ca2a80aee584676633 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Nov 2021 17:20:51 -0800 +Subject: mips: lantiq: add support for clk_get_parent() + +From: Randy Dunlap + +[ Upstream commit fc1aabb088860d6cf9dd03612b7a6f0de91ccac2 ] + +Provide a simple implementation of clk_get_parent() in the +lantiq subarch so that callers of it will build without errors. + +Fixes this build error: +ERROR: modpost: "clk_get_parent" [drivers/iio/adc/ingenic-adc.ko] undefined! + +Fixes: 171bb2f19ed6 ("MIPS: Lantiq: Add initial support for Lantiq SoCs") +Signed-off-by: Randy Dunlap +Suggested-by: Russell King (Oracle) +Cc: linux-mips@vger.kernel.org +Cc: John Crispin +Cc: Thomas Bogendoerfer +Cc: Jonathan Cameron +Cc: linux-iio@vger.kernel.org +Cc: Russell King +Cc: Andy Shevchenko +Acked-by: Jonathan Cameron +Acked-by: John Crispin +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/lantiq/clk.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/mips/lantiq/clk.c b/arch/mips/lantiq/clk.c +index dd819e31fcbbf..4916cccf378fd 100644 +--- a/arch/mips/lantiq/clk.c ++++ b/arch/mips/lantiq/clk.c +@@ -158,6 +158,12 @@ void clk_deactivate(struct clk *clk) + } + EXPORT_SYMBOL(clk_deactivate); + ++struct clk *clk_get_parent(struct clk *clk) ++{ ++ return NULL; ++} ++EXPORT_SYMBOL(clk_get_parent); ++ + static inline u32 get_counter_resolution(void) + { + u32 res; +-- +2.33.0 + diff --git a/queue-5.10/mips-sni-fix-the-build.patch b/queue-5.10/mips-sni-fix-the-build.patch new file mode 100644 index 00000000000..5832b50993c --- /dev/null +++ b/queue-5.10/mips-sni-fix-the-build.patch @@ -0,0 +1,54 @@ +From 0f43936caad0b04d69b51f5890c711f32846df33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Oct 2021 15:23:12 -0700 +Subject: MIPS: sni: Fix the build +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bart Van Assche + +[ Upstream commit c91cf42f61dc77b289784ea7b15a8531defa41c0 ] + +This patch fixes the following gcc 10 build error: + +arch/mips/sni/time.c: In function ‘a20r_set_periodic’: +arch/mips/sni/time.c:15:26: error: unsigned conversion from ‘int’ to ‘u8’ {aka ‘volatile unsigned char’} changes value from ‘576’ to ‘64’ [-Werror=overflow] + 15 | #define SNI_COUNTER0_DIV ((SNI_CLOCK_TICK_RATE / SNI_COUNTER2_DIV) / HZ) + | ^ +arch/mips/sni/time.c:21:45: note: in expansion of macro ‘SNI_COUNTER0_DIV’ + 21 | *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV; + | ^~~~~~~~~~~~~~~~ + +Cc: linux-mips@vger.kernel.org +Signed-off-by: Bart Van Assche +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/sni/time.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/sni/time.c b/arch/mips/sni/time.c +index 240bb68ec2478..ff3ba7e778901 100644 +--- a/arch/mips/sni/time.c ++++ b/arch/mips/sni/time.c +@@ -18,14 +18,14 @@ static int a20r_set_periodic(struct clock_event_device *evt) + { + *(volatile u8 *)(A20R_PT_CLOCK_BASE + 12) = 0x34; + wmb(); +- *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV; ++ *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV & 0xff; + wmb(); + *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV >> 8; + wmb(); + + *(volatile u8 *)(A20R_PT_CLOCK_BASE + 12) = 0xb4; + wmb(); +- *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV; ++ *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV & 0xff; + wmb(); + *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV >> 8; + wmb(); +-- +2.33.0 + diff --git a/queue-5.10/net-bnx2x-fix-variable-dereferenced-before-check.patch b/queue-5.10/net-bnx2x-fix-variable-dereferenced-before-check.patch new file mode 100644 index 00000000000..eb14d2e8a7c --- /dev/null +++ b/queue-5.10/net-bnx2x-fix-variable-dereferenced-before-check.patch @@ -0,0 +1,46 @@ +From 8cff8c00bbd2968b91f63372576734c65dbb9679 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Nov 2021 01:36:36 +0300 +Subject: net: bnx2x: fix variable dereferenced before check + +From: Pavel Skripkin + +[ Upstream commit f8885ac89ce310570e5391fe0bf0ec9c7c9b4fdc ] + +Smatch says: + bnx2x_init_ops.h:640 bnx2x_ilt_client_mem_op() + warn: variable dereferenced before check 'ilt' (see line 638) + +Move ilt_cli variable initialization _after_ ilt validation, because +it's unsafe to deref the pointer before validation check. + +Fixes: 523224a3b3cd ("bnx2x, cnic, bnx2i: use new FW/HSI") +Signed-off-by: Pavel Skripkin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h +index 1835d2e451c01..fc7fce642666c 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h +@@ -635,11 +635,13 @@ static int bnx2x_ilt_client_mem_op(struct bnx2x *bp, int cli_num, + { + int i, rc; + struct bnx2x_ilt *ilt = BP_ILT(bp); +- struct ilt_client_info *ilt_cli = &ilt->clients[cli_num]; ++ struct ilt_client_info *ilt_cli; + + if (!ilt || !ilt->lines) + return -1; + ++ ilt_cli = &ilt->clients[cli_num]; ++ + if (ilt_cli->flags & (ILT_CLIENT_SKIP_INIT | ILT_CLIENT_SKIP_MEM)) + return 0; + +-- +2.33.0 + diff --git a/queue-5.10/net-dpaa2-eth-fix-use-after-free-in-dpaa2_eth_remove.patch b/queue-5.10/net-dpaa2-eth-fix-use-after-free-in-dpaa2_eth_remove.patch new file mode 100644 index 00000000000..7d782301cda --- /dev/null +++ b/queue-5.10/net-dpaa2-eth-fix-use-after-free-in-dpaa2_eth_remove.patch @@ -0,0 +1,40 @@ +From 7d326eb28806aabf13096667d2f498fa80b6a5aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 18:17:12 +0300 +Subject: net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove + +From: Pavel Skripkin + +[ Upstream commit 9b5a333272a48c2f8b30add7a874e46e8b26129c ] + +Access to netdev after free_netdev() will cause use-after-free bug. +Move debug log before free_netdev() call to avoid it. + +Fixes: 7472dd9f6499 ("staging: fsl-dpaa2/eth: Move print message") +Signed-off-by: Pavel Skripkin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +index f91c67489e629..a4ef35216e2f7 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +@@ -4432,10 +4432,10 @@ static int dpaa2_eth_remove(struct fsl_mc_device *ls_dev) + + fsl_mc_portal_free(priv->mc_io); + +- free_netdev(net_dev); +- + dev_dbg(net_dev->dev.parent, "Removed interface %s\n", net_dev->name); + ++ free_netdev(net_dev); ++ + return 0; + } + +-- +2.33.0 + diff --git a/queue-5.10/net-ipa-disable-holb-drop-when-updating-timer.patch b/queue-5.10/net-ipa-disable-holb-drop-when-updating-timer.patch new file mode 100644 index 00000000000..129e1db2680 --- /dev/null +++ b/queue-5.10/net-ipa-disable-holb-drop-when-updating-timer.patch @@ -0,0 +1,48 @@ +From 9f9dce3fa02594b45aae12f423dfce94771e5a76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Nov 2021 16:22:10 -0600 +Subject: net: ipa: disable HOLB drop when updating timer + +From: Alex Elder + +[ Upstream commit 816316cacad2b5abd5b41423cf04e4845239abd4 ] + +The head-of-line blocking timer should only be modified when +head-of-line drop is disabled. + +One of the steps in recovering from a modem crash is to enable +dropping of packets with timeout of 0 (immediate). We don't know +how the modem configured its endpoints, so before we program the +timer, we need to ensure HOL_BLOCK is disabled. + +Fixes: 84f9bd12d46db ("soc: qcom: ipa: IPA endpoints") +Signed-off-by: Alex Elder +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ipa/ipa_endpoint.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ipa/ipa_endpoint.c b/drivers/net/ipa/ipa_endpoint.c +index b7ec9b3ce3129..b0637774ad29c 100644 +--- a/drivers/net/ipa/ipa_endpoint.c ++++ b/drivers/net/ipa/ipa_endpoint.c +@@ -703,6 +703,7 @@ static void ipa_endpoint_init_hol_block_timer(struct ipa_endpoint *endpoint, + u32 offset; + u32 val; + ++ /* This should only be changed when HOL_BLOCK_EN is disabled */ + offset = IPA_REG_ENDP_INIT_HOL_BLOCK_TIMER_N_OFFSET(endpoint_id); + val = ipa_reg_init_hol_block_timer_val(ipa, microseconds); + iowrite32(val, ipa->reg_virt + offset); +@@ -733,6 +734,7 @@ void ipa_endpoint_modem_hol_block_clear_all(struct ipa *ipa) + if (endpoint->toward_ipa || endpoint->ee_id != GSI_EE_MODEM) + continue; + ++ ipa_endpoint_init_hol_block_enable(endpoint, false); + ipa_endpoint_init_hol_block_timer(endpoint, 0); + ipa_endpoint_init_hol_block_enable(endpoint, true); + } +-- +2.33.0 + diff --git a/queue-5.10/net-ipa-holb-register-sometimes-must-be-written-twic.patch b/queue-5.10/net-ipa-holb-register-sometimes-must-be-written-twic.patch new file mode 100644 index 00000000000..da18a59fccb --- /dev/null +++ b/queue-5.10/net-ipa-holb-register-sometimes-must-be-written-twic.patch @@ -0,0 +1,37 @@ +From bb5ce29ab5c594d95ff9d87c4b1a1e61355a1657 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Nov 2021 16:22:09 -0600 +Subject: net: ipa: HOLB register sometimes must be written twice + +From: Alex Elder + +[ Upstream commit 6e228d8cbb1cc6ba78022d406340e901e08d26e0 ] + +Starting with IPA v4.5, the HOL_BLOCK_EN register must be written +twice when enabling head-of-line blocking avoidance. + +Fixes: 84f9bd12d46db ("soc: qcom: ipa: IPA endpoints") +Signed-off-by: Alex Elder +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ipa/ipa_endpoint.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ipa/ipa_endpoint.c b/drivers/net/ipa/ipa_endpoint.c +index b40b711cf4bd5..b7ec9b3ce3129 100644 +--- a/drivers/net/ipa/ipa_endpoint.c ++++ b/drivers/net/ipa/ipa_endpoint.c +@@ -718,6 +718,9 @@ ipa_endpoint_init_hol_block_enable(struct ipa_endpoint *endpoint, bool enable) + val = enable ? HOL_BLOCK_EN_FMASK : 0; + offset = IPA_REG_ENDP_INIT_HOL_BLOCK_EN_N_OFFSET(endpoint_id); + iowrite32(val, endpoint->ipa->reg_virt + offset); ++ /* When enabling, the register must be written twice for IPA v4.5+ */ ++ if (enable && endpoint->ipa->version >= IPA_VERSION_4_5) ++ iowrite32(val, endpoint->ipa->reg_virt + offset); + } + + void ipa_endpoint_modem_hol_block_clear_all(struct ipa *ipa) +-- +2.33.0 + diff --git a/queue-5.10/net-mlx5-e-switch-change-mode-lock-from-mutex-to-rw-.patch b/queue-5.10/net-mlx5-e-switch-change-mode-lock-from-mutex-to-rw-.patch new file mode 100644 index 00000000000..12d96315211 --- /dev/null +++ b/queue-5.10/net-mlx5-e-switch-change-mode-lock-from-mutex-to-rw-.patch @@ -0,0 +1,214 @@ +From 105526ab6db50b4e941d2c7535a695a9e757a8c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 10:11:42 +0300 +Subject: net/mlx5: E-Switch, Change mode lock from mutex to rw semaphore + +From: Roi Dayan + +[ Upstream commit c55479d0cb6a28029844d0e90730704a0fb5efd3 ] + +E-Switch mode change routine will take the write lock to prevent any +consumer to access the E-Switch resources while E-Switch is going +through a mode change. + +In the next patch +E-Switch consumers (e.g vport representors) will take read_lock prior to +accessing E-Switch resources to prevent E-Switch mode changing in the +middle of the operation. + +Signed-off-by: Roi Dayan +Reviewed-by: Parav Pandit +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/eswitch.c | 11 ++++---- + .../net/ethernet/mellanox/mlx5/core/eswitch.h | 2 +- + .../mellanox/mlx5/core/eswitch_offloads.c | 26 +++++++++---------- + 3 files changed, 19 insertions(+), 20 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +index 401b2f5128dd4..78cc6f0bbc72b 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +@@ -1663,7 +1663,7 @@ int mlx5_eswitch_enable(struct mlx5_eswitch *esw, int num_vfs) + if (!ESW_ALLOWED(esw)) + return 0; + +- mutex_lock(&esw->mode_lock); ++ down_write(&esw->mode_lock); + if (esw->mode == MLX5_ESWITCH_NONE) { + ret = mlx5_eswitch_enable_locked(esw, MLX5_ESWITCH_LEGACY, num_vfs); + } else { +@@ -1675,7 +1675,7 @@ int mlx5_eswitch_enable(struct mlx5_eswitch *esw, int num_vfs) + if (!ret) + esw->esw_funcs.num_vfs = num_vfs; + } +- mutex_unlock(&esw->mode_lock); ++ up_write(&esw->mode_lock); + return ret; + } + +@@ -1719,10 +1719,10 @@ void mlx5_eswitch_disable(struct mlx5_eswitch *esw, bool clear_vf) + if (!ESW_ALLOWED(esw)) + return; + +- mutex_lock(&esw->mode_lock); ++ down_write(&esw->mode_lock); + mlx5_eswitch_disable_locked(esw, clear_vf); + esw->esw_funcs.num_vfs = 0; +- mutex_unlock(&esw->mode_lock); ++ up_write(&esw->mode_lock); + } + + int mlx5_eswitch_init(struct mlx5_core_dev *dev) +@@ -1778,7 +1778,7 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev) + atomic64_set(&esw->offloads.num_flows, 0); + ida_init(&esw->offloads.vport_metadata_ida); + mutex_init(&esw->state_lock); +- mutex_init(&esw->mode_lock); ++ init_rwsem(&esw->mode_lock); + + mlx5_esw_for_all_vports(esw, i, vport) { + vport->vport = mlx5_eswitch_index_to_vport_num(esw, i); +@@ -1813,7 +1813,6 @@ void mlx5_eswitch_cleanup(struct mlx5_eswitch *esw) + esw->dev->priv.eswitch = NULL; + destroy_workqueue(esw->work_queue); + esw_offloads_cleanup_reps(esw); +- mutex_destroy(&esw->mode_lock); + mutex_destroy(&esw->state_lock); + ida_destroy(&esw->offloads.vport_metadata_ida); + mlx5e_mod_hdr_tbl_destroy(&esw->offloads.mod_hdr); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +index cf87de94418ff..59c674f157a8c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +@@ -262,7 +262,7 @@ struct mlx5_eswitch { + /* Protects eswitch mode change that occurs via one or more + * user commands, i.e. sriov state change, devlink commands. + */ +- struct mutex mode_lock; ++ struct rw_semaphore mode_lock; + + struct { + bool enabled; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +index 5801f55ff0771..164e8cd9ad4ad 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +@@ -2508,7 +2508,7 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode, + if (esw_mode_from_devlink(mode, &mlx5_mode)) + return -EINVAL; + +- mutex_lock(&esw->mode_lock); ++ down_write(&esw->mode_lock); + cur_mlx5_mode = esw->mode; + if (cur_mlx5_mode == mlx5_mode) + goto unlock; +@@ -2521,7 +2521,7 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode, + err = -EINVAL; + + unlock: +- mutex_unlock(&esw->mode_lock); ++ up_write(&esw->mode_lock); + return err; + } + +@@ -2534,14 +2534,14 @@ int mlx5_devlink_eswitch_mode_get(struct devlink *devlink, u16 *mode) + if (IS_ERR(esw)) + return PTR_ERR(esw); + +- mutex_lock(&esw->mode_lock); ++ down_write(&esw->mode_lock); + err = eswitch_devlink_esw_mode_check(esw); + if (err) + goto unlock; + + err = esw_mode_to_devlink(esw->mode, mode); + unlock: +- mutex_unlock(&esw->mode_lock); ++ up_write(&esw->mode_lock); + return err; + } + +@@ -2557,7 +2557,7 @@ int mlx5_devlink_eswitch_inline_mode_set(struct devlink *devlink, u8 mode, + if (IS_ERR(esw)) + return PTR_ERR(esw); + +- mutex_lock(&esw->mode_lock); ++ down_write(&esw->mode_lock); + err = eswitch_devlink_esw_mode_check(esw); + if (err) + goto out; +@@ -2599,7 +2599,7 @@ int mlx5_devlink_eswitch_inline_mode_set(struct devlink *devlink, u8 mode, + } + + esw->offloads.inline_mode = mlx5_mode; +- mutex_unlock(&esw->mode_lock); ++ up_write(&esw->mode_lock); + return 0; + + revert_inline_mode: +@@ -2609,7 +2609,7 @@ revert_inline_mode: + vport, + esw->offloads.inline_mode); + out: +- mutex_unlock(&esw->mode_lock); ++ up_write(&esw->mode_lock); + return err; + } + +@@ -2622,14 +2622,14 @@ int mlx5_devlink_eswitch_inline_mode_get(struct devlink *devlink, u8 *mode) + if (IS_ERR(esw)) + return PTR_ERR(esw); + +- mutex_lock(&esw->mode_lock); ++ down_write(&esw->mode_lock); + err = eswitch_devlink_esw_mode_check(esw); + if (err) + goto unlock; + + err = esw_inline_mode_to_devlink(esw->offloads.inline_mode, mode); + unlock: +- mutex_unlock(&esw->mode_lock); ++ up_write(&esw->mode_lock); + return err; + } + +@@ -2645,7 +2645,7 @@ int mlx5_devlink_eswitch_encap_mode_set(struct devlink *devlink, + if (IS_ERR(esw)) + return PTR_ERR(esw); + +- mutex_lock(&esw->mode_lock); ++ down_write(&esw->mode_lock); + err = eswitch_devlink_esw_mode_check(esw); + if (err) + goto unlock; +@@ -2691,7 +2691,7 @@ int mlx5_devlink_eswitch_encap_mode_set(struct devlink *devlink, + } + + unlock: +- mutex_unlock(&esw->mode_lock); ++ up_write(&esw->mode_lock); + return err; + } + +@@ -2706,14 +2706,14 @@ int mlx5_devlink_eswitch_encap_mode_get(struct devlink *devlink, + return PTR_ERR(esw); + + +- mutex_lock(&esw->mode_lock); ++ down_write(&esw->mode_lock); + err = eswitch_devlink_esw_mode_check(esw); + if (err) + goto unlock; + + *encap = esw->offloads.encap; + unlock: +- mutex_unlock(&esw->mode_lock); ++ up_write(&esw->mode_lock); + return 0; + } + +-- +2.33.0 + diff --git a/queue-5.10/net-mlx5-e-switch-return-error-if-encap-isn-t-suppor.patch b/queue-5.10/net-mlx5-e-switch-return-error-if-encap-isn-t-suppor.patch new file mode 100644 index 00000000000..36dfe2d23e9 --- /dev/null +++ b/queue-5.10/net-mlx5-e-switch-return-error-if-encap-isn-t-suppor.patch @@ -0,0 +1,41 @@ +From 227409e99f6dbc55f12393659bd6edce02721419 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Nov 2021 16:18:53 +0200 +Subject: net/mlx5: E-Switch, return error if encap isn't supported + +From: Raed Salem + +[ Upstream commit c4c3176739dfa6efcc5b1d1de4b3fd2b51b048c7 ] + +On regular ConnectX HCAs getting encap mode isn't supported when the +E-Switch is in NONE mode. Current code would return no error code when +trying to get encap mode in such case which is wrong. + +Fix by returning error value to indicate failure to caller in such case. + +Fixes: 8e0aa4bc959c ("net/mlx5: E-switch, Protect eswitch mode changes") +Signed-off-by: Raed Salem +Reviewed-by: Mark Bloch +Reviewed-by: Maor Dickman +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +index 164e8cd9ad4ad..e06b1ba7d2349 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +@@ -2714,7 +2714,7 @@ int mlx5_devlink_eswitch_encap_mode_get(struct devlink *devlink, + *encap = esw->offloads.encap; + unlock: + up_write(&esw->mode_lock); +- return 0; ++ return err; + } + + static bool +-- +2.33.0 + diff --git a/queue-5.10/net-mlx5-lag-update-tracker-when-state-change-event-.patch b/queue-5.10/net-mlx5-lag-update-tracker-when-state-change-event-.patch new file mode 100644 index 00000000000..16d0f3e9860 --- /dev/null +++ b/queue-5.10/net-mlx5-lag-update-tracker-when-state-change-event-.patch @@ -0,0 +1,100 @@ +From df7306e1ca514809e0fe36e530e87cbd4fb81ef9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Nov 2021 11:19:48 +0200 +Subject: net/mlx5: Lag, update tracker when state change event received + +From: Maher Sanalla + +[ Upstream commit ae396d85c01c7bdc9eeceecde1f493d03f793465 ] + +Currently, In NETDEV_CHANGELOWERSTATE/NETDEV_CHANGEUPPERSTATE events +handling, tracking is not fully completed if the LAG device is not ready +at the time the events occur. But, we must keep track of the upper and +lower states after receiving the events because RoCE needs this info in +mlx5_lag_get_roce_netdev() - in order to return the corresponding port +that its running on. Returning the wrong (not most recent) port will lead +to gids table being incorrect. + +For example: If during the attachment of a slave to the bond, the other +non-attached port performs pci_reload, then the LAG device is not ready, +but that should not result in dismissing attached slave tracker update +automatically (which is performed in mlx5_handle_changelowerstate()), Since +these events might not come later, which can lead to both bond ports +having tx_enabled=0 - which is not a valid state of LAG bond. + +Fixes: 9b412cc35f00 ("net/mlx5e: Add LAG warning if bond slave is not lag master") +Signed-off-by: Maher Sanalla +Reviewed-by: Mark Bloch +Reviewed-by: Jianbo Liu +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/lag.c | 28 +++++++++---------- + 1 file changed, 13 insertions(+), 15 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag.c +index fe5476a76464f..11cc3ea5010aa 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c +@@ -365,6 +365,7 @@ static int mlx5_handle_changeupper_event(struct mlx5_lag *ldev, + bool is_bonded, is_in_lag, mode_supported; + int bond_status = 0; + int num_slaves = 0; ++ int changed = 0; + int idx; + + if (!netif_is_lag_master(upper)) +@@ -401,27 +402,27 @@ static int mlx5_handle_changeupper_event(struct mlx5_lag *ldev, + */ + is_in_lag = num_slaves == MLX5_MAX_PORTS && bond_status == 0x3; + +- if (!mlx5_lag_is_ready(ldev) && is_in_lag) { +- NL_SET_ERR_MSG_MOD(info->info.extack, +- "Can't activate LAG offload, PF is configured with more than 64 VFs"); +- return 0; +- } +- + /* Lag mode must be activebackup or hash. */ + mode_supported = tracker->tx_type == NETDEV_LAG_TX_TYPE_ACTIVEBACKUP || + tracker->tx_type == NETDEV_LAG_TX_TYPE_HASH; + +- if (is_in_lag && !mode_supported) +- NL_SET_ERR_MSG_MOD(info->info.extack, +- "Can't activate LAG offload, TX type isn't supported"); +- + is_bonded = is_in_lag && mode_supported; + if (tracker->is_bonded != is_bonded) { + tracker->is_bonded = is_bonded; +- return 1; ++ changed = 1; + } + +- return 0; ++ if (!is_in_lag) ++ return changed; ++ ++ if (!mlx5_lag_is_ready(ldev)) ++ NL_SET_ERR_MSG_MOD(info->info.extack, ++ "Can't activate LAG offload, PF is configured with more than 64 VFs"); ++ else if (!mode_supported) ++ NL_SET_ERR_MSG_MOD(info->info.extack, ++ "Can't activate LAG offload, TX type isn't supported"); ++ ++ return changed; + } + + static int mlx5_handle_changelowerstate_event(struct mlx5_lag *ldev, +@@ -464,9 +465,6 @@ static int mlx5_lag_netdev_event(struct notifier_block *this, + + ldev = container_of(this, struct mlx5_lag, nb); + +- if (!mlx5_lag_is_ready(ldev) && event == NETDEV_CHANGELOWERSTATE) +- return NOTIFY_DONE; +- + tracker = ldev->tracker; + + switch (event) { +-- +2.33.0 + diff --git a/queue-5.10/net-mlx5e-nullify-cq-dbg-pointer-in-mlx5_debug_cq_re.patch b/queue-5.10/net-mlx5e-nullify-cq-dbg-pointer-in-mlx5_debug_cq_re.patch new file mode 100644 index 00000000000..f9749d43c2e --- /dev/null +++ b/queue-5.10/net-mlx5e-nullify-cq-dbg-pointer-in-mlx5_debug_cq_re.patch @@ -0,0 +1,102 @@ +From 464d5b1527374fde5573d0dadcd45e01ee764bbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Oct 2021 11:42:41 +0300 +Subject: net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() + +From: Valentine Fatiev + +[ Upstream commit 76ded29d3fcda4928da8849ffc446ea46871c1c2 ] + +Prior to this patch in case mlx5_core_destroy_cq() failed it proceeds +to rest of destroy operations. mlx5_core_destroy_cq() could be called again +by user and cause additional call of mlx5_debug_cq_remove(). +cq->dbg was not nullify in previous call and cause the crash. + +Fix it by nullify cq->dbg pointer after removal. + +Also proceed to destroy operations only if FW return 0 +for MLX5_CMD_OP_DESTROY_CQ command. + +general protection fault, probably for non-canonical address 0x2000300004058: 0000 [#1] SMP PTI +CPU: 5 PID: 1228 Comm: python Not tainted 5.15.0-rc5_for_upstream_min_debug_2021_10_14_11_06 #1 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 +RIP: 0010:lockref_get+0x1/0x60 +Code: 5d e9 53 ff ff ff 48 8d 7f 70 e8 0a 2e 48 00 c7 85 d0 00 00 00 02 +00 00 00 c6 45 70 00 fb 5d c3 c3 cc cc cc cc cc cc cc cc 53 <48> 8b 17 +48 89 fb 85 d2 75 3d 48 89 d0 bf 64 00 00 00 48 89 c1 48 +RSP: 0018:ffff888137dd7a38 EFLAGS: 00010206 +RAX: 0000000000000000 RBX: ffff888107d5f458 RCX: 00000000fffffffe +RDX: 000000000002c2b0 RSI: ffffffff8155e2e0 RDI: 0002000300004058 +RBP: ffff888137dd7a88 R08: 0002000300004058 R09: ffff8881144a9f88 +R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881141d4000 +R13: ffff888137dd7c68 R14: ffff888137dd7d58 R15: ffff888137dd7cc0 +FS: 00007f4644f2a4c0(0000) GS:ffff8887a2d40000(0000) +knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 000055b4500f4380 CR3: 0000000114f7a003 CR4: 0000000000170ea0 +Call Trace: + simple_recursive_removal+0x33/0x2e0 + ? debugfs_remove+0x60/0x60 + debugfs_remove+0x40/0x60 + mlx5_debug_cq_remove+0x32/0x70 [mlx5_core] + mlx5_core_destroy_cq+0x41/0x1d0 [mlx5_core] + devx_obj_cleanup+0x151/0x330 [mlx5_ib] + ? __pollwait+0xd0/0xd0 + ? xas_load+0x5/0x70 + ? xa_load+0x62/0xa0 + destroy_hw_idr_uobject+0x20/0x80 [ib_uverbs] + uverbs_destroy_uobject+0x3b/0x360 [ib_uverbs] + uobj_destroy+0x54/0xa0 [ib_uverbs] + ib_uverbs_cmd_verbs+0xaf2/0x1160 [ib_uverbs] + ? uverbs_finalize_object+0xd0/0xd0 [ib_uverbs] + ib_uverbs_ioctl+0xc4/0x1b0 [ib_uverbs] + __x64_sys_ioctl+0x3e4/0x8e0 + +Fixes: 94b960b9deff ("net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path") +Signed-off-by: Valentine Fatiev +Reviewed-by: Leon Romanovsky +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/cq.c | 5 +++-- + drivers/net/ethernet/mellanox/mlx5/core/debugfs.c | 4 +++- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cq.c b/drivers/net/ethernet/mellanox/mlx5/core/cq.c +index c74600be570ed..68d7ca17b6f51 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cq.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cq.c +@@ -163,13 +163,14 @@ int mlx5_core_destroy_cq(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq) + MLX5_SET(destroy_cq_in, in, cqn, cq->cqn); + MLX5_SET(destroy_cq_in, in, uid, cq->uid); + err = mlx5_cmd_exec_in(dev, destroy_cq, in); ++ if (err) ++ return err; + + synchronize_irq(cq->irqn); +- + mlx5_cq_put(cq); + wait_for_completion(&cq->free); + +- return err; ++ return 0; + } + EXPORT_SYMBOL(mlx5_core_destroy_cq); + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c b/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c +index 07c8d9811bc81..10d195042ab55 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c +@@ -507,6 +507,8 @@ void mlx5_debug_cq_remove(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq) + if (!mlx5_debugfs_root) + return; + +- if (cq->dbg) ++ if (cq->dbg) { + rem_res_tree(cq->dbg); ++ cq->dbg = NULL; ++ } + } +-- +2.33.0 + diff --git a/queue-5.10/net-nfc-nci-change-the-nci-close-sequence.patch b/queue-5.10/net-nfc-nci-change-the-nci-close-sequence.patch new file mode 100644 index 00000000000..595e1f20574 --- /dev/null +++ b/queue-5.10/net-nfc-nci-change-the-nci-close-sequence.patch @@ -0,0 +1,46 @@ +From 4ba29536100d2c098bb89cb061a391e417e35f62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Dec 2020 11:59:26 +0900 +Subject: net: nfc: nci: Change the NCI close sequence + +From: Bongsu Jeon + +[ Upstream commit f011539e723c737b74876ac47345e40270a3c384 ] + +If there is a NCI command in work queue after closing the NCI device at +nci_unregister_device, The NCI command timer starts at flush_workqueue +function and then NCI command timeout handler would be called 5 second +after flushing the NCI command work queue and destroying the queue. +At that time, the timeout handler would try to use NCI command work queue +that is destroyed already. it will causes the problem. To avoid this +abnormal situation, change the sequence to prevent the NCI command timeout +handler from being called after destroying the NCI command work queue. + +Signed-off-by: Bongsu Jeon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/nfc/nci/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c +index 5e55cb6c087a2..4d3ab0f44c9f4 100644 +--- a/net/nfc/nci/core.c ++++ b/net/nfc/nci/core.c +@@ -568,11 +568,11 @@ static int nci_close_device(struct nci_dev *ndev) + + clear_bit(NCI_INIT, &ndev->flags); + +- del_timer_sync(&ndev->cmd_timer); +- + /* Flush cmd wq */ + flush_workqueue(ndev->cmd_wq); + ++ del_timer_sync(&ndev->cmd_timer); ++ + /* Clear flags */ + ndev->flags = 0; + +-- +2.33.0 + diff --git a/queue-5.10/net-reduce-indentation-level-in-sk_clone_lock.patch b/queue-5.10/net-reduce-indentation-level-in-sk_clone_lock.patch new file mode 100644 index 00000000000..df681665625 --- /dev/null +++ b/queue-5.10/net-reduce-indentation-level-in-sk_clone_lock.patch @@ -0,0 +1,244 @@ +From 26fc99f45ccf90dfd3bcd43a03b90ab55fbc57ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Jan 2021 07:27:31 -0800 +Subject: net: reduce indentation level in sk_clone_lock() + +From: Eric Dumazet + +[ Upstream commit bbc20b70424aeb3c84f833860f6340adda5141fc ] + +Rework initial test to jump over init code +if memory allocation has failed. + +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20210127152731.748663-1-eric.dumazet@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/sock.c | 189 ++++++++++++++++++++++++------------------------ + 1 file changed, 93 insertions(+), 96 deletions(-) + +diff --git a/net/core/sock.c b/net/core/sock.c +index f9c835167391d..3da4cd632ba8e 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -1883,123 +1883,120 @@ static void sk_init_common(struct sock *sk) + struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) + { + struct proto *prot = READ_ONCE(sk->sk_prot); +- struct sock *newsk; ++ struct sk_filter *filter; + bool is_charged = true; ++ struct sock *newsk; + + newsk = sk_prot_alloc(prot, priority, sk->sk_family); +- if (newsk != NULL) { +- struct sk_filter *filter; ++ if (!newsk) ++ goto out; + +- sock_copy(newsk, sk); ++ sock_copy(newsk, sk); + +- newsk->sk_prot_creator = prot; ++ newsk->sk_prot_creator = prot; + +- /* SANITY */ +- if (likely(newsk->sk_net_refcnt)) +- get_net(sock_net(newsk)); +- sk_node_init(&newsk->sk_node); +- sock_lock_init(newsk); +- bh_lock_sock(newsk); +- newsk->sk_backlog.head = newsk->sk_backlog.tail = NULL; +- newsk->sk_backlog.len = 0; ++ /* SANITY */ ++ if (likely(newsk->sk_net_refcnt)) ++ get_net(sock_net(newsk)); ++ sk_node_init(&newsk->sk_node); ++ sock_lock_init(newsk); ++ bh_lock_sock(newsk); ++ newsk->sk_backlog.head = newsk->sk_backlog.tail = NULL; ++ newsk->sk_backlog.len = 0; + +- atomic_set(&newsk->sk_rmem_alloc, 0); +- /* +- * sk_wmem_alloc set to one (see sk_free() and sock_wfree()) +- */ +- refcount_set(&newsk->sk_wmem_alloc, 1); +- atomic_set(&newsk->sk_omem_alloc, 0); +- sk_init_common(newsk); ++ atomic_set(&newsk->sk_rmem_alloc, 0); + +- newsk->sk_dst_cache = NULL; +- newsk->sk_dst_pending_confirm = 0; +- newsk->sk_wmem_queued = 0; +- newsk->sk_forward_alloc = 0; +- atomic_set(&newsk->sk_drops, 0); +- newsk->sk_send_head = NULL; +- newsk->sk_userlocks = sk->sk_userlocks & ~SOCK_BINDPORT_LOCK; +- atomic_set(&newsk->sk_zckey, 0); ++ /* sk_wmem_alloc set to one (see sk_free() and sock_wfree()) */ ++ refcount_set(&newsk->sk_wmem_alloc, 1); + +- sock_reset_flag(newsk, SOCK_DONE); ++ atomic_set(&newsk->sk_omem_alloc, 0); ++ sk_init_common(newsk); + +- /* sk->sk_memcg will be populated at accept() time */ +- newsk->sk_memcg = NULL; ++ newsk->sk_dst_cache = NULL; ++ newsk->sk_dst_pending_confirm = 0; ++ newsk->sk_wmem_queued = 0; ++ newsk->sk_forward_alloc = 0; ++ atomic_set(&newsk->sk_drops, 0); ++ newsk->sk_send_head = NULL; ++ newsk->sk_userlocks = sk->sk_userlocks & ~SOCK_BINDPORT_LOCK; ++ atomic_set(&newsk->sk_zckey, 0); + +- cgroup_sk_clone(&newsk->sk_cgrp_data); ++ sock_reset_flag(newsk, SOCK_DONE); + +- rcu_read_lock(); +- filter = rcu_dereference(sk->sk_filter); +- if (filter != NULL) +- /* though it's an empty new sock, the charging may fail +- * if sysctl_optmem_max was changed between creation of +- * original socket and cloning +- */ +- is_charged = sk_filter_charge(newsk, filter); +- RCU_INIT_POINTER(newsk->sk_filter, filter); +- rcu_read_unlock(); ++ /* sk->sk_memcg will be populated at accept() time */ ++ newsk->sk_memcg = NULL; + +- if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk, sk))) { +- /* We need to make sure that we don't uncharge the new +- * socket if we couldn't charge it in the first place +- * as otherwise we uncharge the parent's filter. +- */ +- if (!is_charged) +- RCU_INIT_POINTER(newsk->sk_filter, NULL); +- sk_free_unlock_clone(newsk); +- newsk = NULL; +- goto out; +- } +- RCU_INIT_POINTER(newsk->sk_reuseport_cb, NULL); ++ cgroup_sk_clone(&newsk->sk_cgrp_data); + +- if (bpf_sk_storage_clone(sk, newsk)) { +- sk_free_unlock_clone(newsk); +- newsk = NULL; +- goto out; +- } ++ rcu_read_lock(); ++ filter = rcu_dereference(sk->sk_filter); ++ if (filter != NULL) ++ /* though it's an empty new sock, the charging may fail ++ * if sysctl_optmem_max was changed between creation of ++ * original socket and cloning ++ */ ++ is_charged = sk_filter_charge(newsk, filter); ++ RCU_INIT_POINTER(newsk->sk_filter, filter); ++ rcu_read_unlock(); + +- /* Clear sk_user_data if parent had the pointer tagged +- * as not suitable for copying when cloning. ++ if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk, sk))) { ++ /* We need to make sure that we don't uncharge the new ++ * socket if we couldn't charge it in the first place ++ * as otherwise we uncharge the parent's filter. + */ +- if (sk_user_data_is_nocopy(newsk)) +- newsk->sk_user_data = NULL; ++ if (!is_charged) ++ RCU_INIT_POINTER(newsk->sk_filter, NULL); ++ sk_free_unlock_clone(newsk); ++ newsk = NULL; ++ goto out; ++ } ++ RCU_INIT_POINTER(newsk->sk_reuseport_cb, NULL); + +- newsk->sk_err = 0; +- newsk->sk_err_soft = 0; +- newsk->sk_priority = 0; +- newsk->sk_incoming_cpu = raw_smp_processor_id(); +- if (likely(newsk->sk_net_refcnt)) +- sock_inuse_add(sock_net(newsk), 1); ++ if (bpf_sk_storage_clone(sk, newsk)) { ++ sk_free_unlock_clone(newsk); ++ newsk = NULL; ++ goto out; ++ } + +- /* +- * Before updating sk_refcnt, we must commit prior changes to memory +- * (Documentation/RCU/rculist_nulls.rst for details) +- */ +- smp_wmb(); +- refcount_set(&newsk->sk_refcnt, 2); ++ /* Clear sk_user_data if parent had the pointer tagged ++ * as not suitable for copying when cloning. ++ */ ++ if (sk_user_data_is_nocopy(newsk)) ++ newsk->sk_user_data = NULL; + +- /* +- * Increment the counter in the same struct proto as the master +- * sock (sk_refcnt_debug_inc uses newsk->sk_prot->socks, that +- * is the same as sk->sk_prot->socks, as this field was copied +- * with memcpy). +- * +- * This _changes_ the previous behaviour, where +- * tcp_create_openreq_child always was incrementing the +- * equivalent to tcp_prot->socks (inet_sock_nr), so this have +- * to be taken into account in all callers. -acme +- */ +- sk_refcnt_debug_inc(newsk); +- sk_set_socket(newsk, NULL); +- sk_tx_queue_clear(newsk); +- RCU_INIT_POINTER(newsk->sk_wq, NULL); ++ newsk->sk_err = 0; ++ newsk->sk_err_soft = 0; ++ newsk->sk_priority = 0; ++ newsk->sk_incoming_cpu = raw_smp_processor_id(); ++ if (likely(newsk->sk_net_refcnt)) ++ sock_inuse_add(sock_net(newsk), 1); + +- if (newsk->sk_prot->sockets_allocated) +- sk_sockets_allocated_inc(newsk); ++ /* Before updating sk_refcnt, we must commit prior changes to memory ++ * (Documentation/RCU/rculist_nulls.rst for details) ++ */ ++ smp_wmb(); ++ refcount_set(&newsk->sk_refcnt, 2); + +- if (sock_needs_netstamp(sk) && +- newsk->sk_flags & SK_FLAGS_TIMESTAMP) +- net_enable_timestamp(); +- } ++ /* Increment the counter in the same struct proto as the master ++ * sock (sk_refcnt_debug_inc uses newsk->sk_prot->socks, that ++ * is the same as sk->sk_prot->socks, as this field was copied ++ * with memcpy). ++ * ++ * This _changes_ the previous behaviour, where ++ * tcp_create_openreq_child always was incrementing the ++ * equivalent to tcp_prot->socks (inet_sock_nr), so this have ++ * to be taken into account in all callers. -acme ++ */ ++ sk_refcnt_debug_inc(newsk); ++ sk_set_socket(newsk, NULL); ++ sk_tx_queue_clear(newsk); ++ RCU_INIT_POINTER(newsk->sk_wq, NULL); ++ ++ if (newsk->sk_prot->sockets_allocated) ++ sk_sockets_allocated_inc(newsk); ++ ++ if (sock_needs_netstamp(sk) && newsk->sk_flags & SK_FLAGS_TIMESTAMP) ++ net_enable_timestamp(); + out: + return newsk; + } +-- +2.33.0 + diff --git a/queue-5.10/net-sched-act_mirred-drop-dst-for-the-direction-from.patch b/queue-5.10/net-sched-act_mirred-drop-dst-for-the-direction-from.patch new file mode 100644 index 00000000000..3a9effb4f71 --- /dev/null +++ b/queue-5.10/net-sched-act_mirred-drop-dst-for-the-direction-from.patch @@ -0,0 +1,79 @@ +From c97733e6c45f62c20e3bca01adb0e666f7eaf8e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Nov 2021 11:33:11 -0500 +Subject: net: sched: act_mirred: drop dst for the direction from egress to + ingress + +From: Xin Long + +[ Upstream commit f799ada6bf2397c351220088b9b0980125c77280 ] + +Without dropping dst, the packets sent from local mirred/redirected +to ingress will may still use the old dst. ip_rcv() will drop it as +the old dst is for output and its .input is dst_discard. + +This patch is to fix by also dropping dst for those packets that are +mirred or redirected from egress to ingress in act_mirred. + +Note that we don't drop it for the direction change from ingress to +egress, as on which there might be a user case attaching a metadata +dst by act_tunnel_key that would be used later. + +Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct") +Signed-off-by: Xin Long +Acked-by: Cong Wang +Reviewed-by: Marcelo Ricardo Leitner +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/act_mirred.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c +index 0b0eb18919c09..24d561d8d9c97 100644 +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -218,6 +219,7 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, + bool want_ingress; + bool is_redirect; + bool expects_nh; ++ bool at_ingress; + int m_eaction; + int mac_len; + bool at_nh; +@@ -253,7 +255,8 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, + * ingress - that covers the TC S/W datapath. + */ + is_redirect = tcf_mirred_is_act_redirect(m_eaction); +- use_reinsert = skb_at_tc_ingress(skb) && is_redirect && ++ at_ingress = skb_at_tc_ingress(skb); ++ use_reinsert = at_ingress && is_redirect && + tcf_mirred_can_reinsert(retval); + if (!use_reinsert) { + skb2 = skb_clone(skb, GFP_ATOMIC); +@@ -261,10 +264,12 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, + goto out; + } + ++ want_ingress = tcf_mirred_act_wants_ingress(m_eaction); ++ + /* All mirred/redirected skbs should clear previous ct info */ + nf_reset_ct(skb2); +- +- want_ingress = tcf_mirred_act_wants_ingress(m_eaction); ++ if (want_ingress && !at_ingress) /* drop dst for egress -> ingress */ ++ skb_dst_drop(skb2); + + expects_nh = want_ingress || !m_mac_header_xmit; + at_nh = skb->data == skb_network_header(skb); +-- +2.33.0 + diff --git a/queue-5.10/net-smc-make-sure-the-link_id-is-unique.patch b/queue-5.10/net-smc-make-sure-the-link_id-is-unique.patch new file mode 100644 index 00000000000..6202eca2571 --- /dev/null +++ b/queue-5.10/net-smc-make-sure-the-link_id-is-unique.patch @@ -0,0 +1,45 @@ +From fd83e696b3962af4c28459aa23795742e074813e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Nov 2021 17:45:07 +0800 +Subject: net/smc: Make sure the link_id is unique + +From: Wen Gu + +[ Upstream commit cf4f5530bb55ef7d5a91036b26676643b80b1616 ] + +The link_id is supposed to be unique, but smcr_next_link_id() doesn't +skip the used link_id as expected. So the patch fixes this. + +Fixes: 026c381fb477 ("net/smc: introduce link_idx for link group array") +Signed-off-by: Wen Gu +Reviewed-by: Tony Lu +Acked-by: Karsten Graul +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/smc_core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index c491dd8e67cda..109d790eaebe2 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -287,13 +287,14 @@ static u8 smcr_next_link_id(struct smc_link_group *lgr) + int i; + + while (1) { ++again: + link_id = ++lgr->next_link_id; + if (!link_id) /* skip zero as link_id */ + link_id = ++lgr->next_link_id; + for (i = 0; i < SMC_LINKS_PER_LGR_MAX; i++) { + if (smc_link_usable(&lgr->lnk[i]) && + lgr->lnk[i].link_id == link_id) +- continue; ++ goto again; + } + break; + } +-- +2.33.0 + diff --git a/queue-5.10/net-virtio_net_hdr_to_skb-count-transport-header-in-.patch b/queue-5.10/net-virtio_net_hdr_to_skb-count-transport-header-in-.patch new file mode 100644 index 00000000000..101b3c17638 --- /dev/null +++ b/queue-5.10/net-virtio_net_hdr_to_skb-count-transport-header-in-.patch @@ -0,0 +1,75 @@ +From eeafda7cdc4fd4f9ba89a099211ba281393dceb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 17:42:42 +0000 +Subject: net: virtio_net_hdr_to_skb: count transport header in UFO + +From: Jonathan Davies + +[ Upstream commit cf9acc90c80ecbee00334aa85d92f4e74014bcff ] + +virtio_net_hdr_to_skb does not set the skb's gso_size and gso_type +correctly for UFO packets received via virtio-net that are a little over +the GSO size. This can lead to problems elsewhere in the networking +stack, e.g. ovs_vport_send dropping over-sized packets if gso_size is +not set. + +This is due to the comparison + + if (skb->len - p_off > gso_size) + +not properly accounting for the transport layer header. + +p_off includes the size of the transport layer header (thlen), so +skb->len - p_off is the size of the TCP/UDP payload. + +gso_size is read from the virtio-net header. For UFO, fragmentation +happens at the IP level so does not need to include the UDP header. + +Hence the calculation could be comparing a TCP/UDP payload length with +an IP payload length, causing legitimate virtio-net packets to have +lack gso_type/gso_size information. + +Example: a UDP packet with payload size 1473 has IP payload size 1481. +If the guest used UFO, it is not fragmented and the virtio-net header's +flags indicate that it is a GSO frame (VIRTIO_NET_HDR_GSO_UDP), with +gso_size = 1480 for an MTU of 1500. skb->len will be 1515 and p_off +will be 42, so skb->len - p_off = 1473. Hence the comparison fails, and +shinfo->gso_size and gso_type are not set as they should be. + +Instead, add the UDP header length before comparing to gso_size when +using UFO. In this way, it is the size of the IP payload that is +compared to gso_size. + +Fixes: 6dd912f82680 ("net: check untrusted gso_size at kernel entry") +Signed-off-by: Jonathan Davies +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/virtio_net.h | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h +index b465f8f3e554f..04e87f4b9417c 100644 +--- a/include/linux/virtio_net.h ++++ b/include/linux/virtio_net.h +@@ -120,10 +120,15 @@ retry: + + if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { + u16 gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size); ++ unsigned int nh_off = p_off; + struct skb_shared_info *shinfo = skb_shinfo(skb); + ++ /* UFO may not include transport header in gso_size. */ ++ if (gso_type & SKB_GSO_UDP) ++ nh_off -= thlen; ++ + /* Too small packets are not really GSO ones. */ +- if (skb->len - p_off > gso_size) { ++ if (skb->len - nh_off > gso_size) { + shinfo->gso_size = gso_size; + shinfo->gso_type = gso_type; + +-- +2.33.0 + diff --git a/queue-5.10/net-zerocopy-copy-straggler-unaligned-data-for-tcp-r.patch b/queue-5.10/net-zerocopy-copy-straggler-unaligned-data-for-tcp-r.patch new file mode 100644 index 00000000000..6294ccbfedf --- /dev/null +++ b/queue-5.10/net-zerocopy-copy-straggler-unaligned-data-for-tcp-r.patch @@ -0,0 +1,190 @@ +From ab6f7bbad3dd6fadc2df2d4f1d37ec45dc1b363e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Dec 2020 14:53:42 -0800 +Subject: net-zerocopy: Copy straggler unaligned data for TCP Rx. zerocopy. + +From: Arjun Roy + +[ Upstream commit 18fb76ed53865c1b5d5f0157b1b825704590beb5 ] + +When TCP receive zerocopy does not successfully map the entire +requested space, it outputs a 'hint' that the caller should recvmsg(). + +Augment zerocopy to accept a user buffer that it tries to copy this +hint into - if it is possible to copy the entire hint, it will do so. +This elides a recvmsg() call for received traffic that isn't exactly +page-aligned in size. + +This was tested with RPC-style traffic of arbitrary sizes. Normally, +each received message required at least one getsockopt() call, and one +recvmsg() call for the remaining unaligned data. + +With this change, almost all of the recvmsg() calls are eliminated, +leading to a savings of about 25%-50% in number of system calls +for RPC-style workloads. + +Signed-off-by: Arjun Roy +Signed-off-by: Eric Dumazet +Signed-off-by: Soheil Hassas Yeganeh +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/uapi/linux/tcp.h | 2 + + net/ipv4/tcp.c | 84 ++++++++++++++++++++++++++++++++-------- + 2 files changed, 70 insertions(+), 16 deletions(-) + +diff --git a/include/uapi/linux/tcp.h b/include/uapi/linux/tcp.h +index cfcb10b754838..62db78b9c1a0a 100644 +--- a/include/uapi/linux/tcp.h ++++ b/include/uapi/linux/tcp.h +@@ -349,5 +349,7 @@ struct tcp_zerocopy_receive { + __u32 recv_skip_hint; /* out: amount of bytes to skip */ + __u32 inq; /* out: amount of bytes in read queue */ + __s32 err; /* out: socket error */ ++ __u64 copybuf_address; /* in: copybuf address (small reads) */ ++ __s32 copybuf_len; /* in/out: copybuf bytes avail/used or error */ + }; + #endif /* _UAPI_LINUX_TCP_H */ +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index e8aca226c4ae3..ba6e4c6db3b0a 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1746,6 +1746,52 @@ int tcp_mmap(struct file *file, struct socket *sock, + } + EXPORT_SYMBOL(tcp_mmap); + ++static int tcp_copy_straggler_data(struct tcp_zerocopy_receive *zc, ++ struct sk_buff *skb, u32 copylen, ++ u32 *offset, u32 *seq) ++{ ++ unsigned long copy_address = (unsigned long)zc->copybuf_address; ++ struct msghdr msg = {}; ++ struct iovec iov; ++ int err; ++ ++ if (copy_address != zc->copybuf_address) ++ return -EINVAL; ++ ++ err = import_single_range(READ, (void __user *)copy_address, ++ copylen, &iov, &msg.msg_iter); ++ if (err) ++ return err; ++ err = skb_copy_datagram_msg(skb, *offset, &msg, copylen); ++ if (err) ++ return err; ++ zc->recv_skip_hint -= copylen; ++ *offset += copylen; ++ *seq += copylen; ++ return (__s32)copylen; ++} ++ ++static int tcp_zerocopy_handle_leftover_data(struct tcp_zerocopy_receive *zc, ++ struct sock *sk, ++ struct sk_buff *skb, ++ u32 *seq, ++ s32 copybuf_len) ++{ ++ u32 offset, copylen = min_t(u32, copybuf_len, zc->recv_skip_hint); ++ ++ if (!copylen) ++ return 0; ++ /* skb is null if inq < PAGE_SIZE. */ ++ if (skb) ++ offset = *seq - TCP_SKB_CB(skb)->seq; ++ else ++ skb = tcp_recv_skb(sk, *seq, &offset); ++ ++ zc->copybuf_len = tcp_copy_straggler_data(zc, skb, copylen, &offset, ++ seq); ++ return zc->copybuf_len < 0 ? 0 : copylen; ++} ++ + static int tcp_zerocopy_vm_insert_batch(struct vm_area_struct *vma, + struct page **pages, + unsigned long pages_to_map, +@@ -1779,8 +1825,10 @@ static int tcp_zerocopy_vm_insert_batch(struct vm_area_struct *vma, + static int tcp_zerocopy_receive(struct sock *sk, + struct tcp_zerocopy_receive *zc) + { ++ u32 length = 0, offset, vma_len, avail_len, aligned_len, copylen = 0; + unsigned long address = (unsigned long)zc->address; +- u32 length = 0, seq, offset, zap_len; ++ s32 copybuf_len = zc->copybuf_len; ++ struct tcp_sock *tp = tcp_sk(sk); + #define PAGE_BATCH_SIZE 8 + struct page *pages[PAGE_BATCH_SIZE]; + const skb_frag_t *frags = NULL; +@@ -1788,10 +1836,12 @@ static int tcp_zerocopy_receive(struct sock *sk, + struct sk_buff *skb = NULL; + unsigned long pg_idx = 0; + unsigned long curr_addr; +- struct tcp_sock *tp; +- int inq; ++ u32 seq = tp->copied_seq; ++ int inq = tcp_inq(sk); + int ret; + ++ zc->copybuf_len = 0; ++ + if (address & (PAGE_SIZE - 1) || address != zc->address) + return -EINVAL; + +@@ -1800,8 +1850,6 @@ static int tcp_zerocopy_receive(struct sock *sk, + + sock_rps_record_flow(sk); + +- tp = tcp_sk(sk); +- + mmap_read_lock(current->mm); + + vma = find_vma(current->mm, address); +@@ -1809,17 +1857,16 @@ static int tcp_zerocopy_receive(struct sock *sk, + mmap_read_unlock(current->mm); + return -EINVAL; + } +- zc->length = min_t(unsigned long, zc->length, vma->vm_end - address); +- +- seq = tp->copied_seq; +- inq = tcp_inq(sk); +- zc->length = min_t(u32, zc->length, inq); +- zap_len = zc->length & ~(PAGE_SIZE - 1); +- if (zap_len) { +- zap_page_range(vma, address, zap_len); ++ vma_len = min_t(unsigned long, zc->length, vma->vm_end - address); ++ avail_len = min_t(u32, vma_len, inq); ++ aligned_len = avail_len & ~(PAGE_SIZE - 1); ++ if (aligned_len) { ++ zap_page_range(vma, address, aligned_len); ++ zc->length = aligned_len; + zc->recv_skip_hint = 0; + } else { +- zc->recv_skip_hint = zc->length; ++ zc->length = avail_len; ++ zc->recv_skip_hint = avail_len; + } + ret = 0; + curr_addr = address; +@@ -1888,13 +1935,18 @@ static int tcp_zerocopy_receive(struct sock *sk, + } + out: + mmap_read_unlock(current->mm); +- if (length) { ++ /* Try to copy straggler data. */ ++ if (!ret) ++ copylen = tcp_zerocopy_handle_leftover_data(zc, sk, skb, &seq, ++ copybuf_len); ++ ++ if (length + copylen) { + WRITE_ONCE(tp->copied_seq, seq); + tcp_rcv_space_adjust(sk); + + /* Clean up data we have read: This will do ACK frames. */ + tcp_recv_skb(sk, seq, &offset); +- tcp_cleanup_rbuf(sk, length); ++ tcp_cleanup_rbuf(sk, length + copylen); + ret = 0; + if (length == zc->length) + zc->recv_skip_hint = 0; +-- +2.33.0 + diff --git a/queue-5.10/net-zerocopy-refactor-skb-frag-fast-forward-op.patch b/queue-5.10/net-zerocopy-refactor-skb-frag-fast-forward-op.patch new file mode 100644 index 00000000000..8b3dce4698d --- /dev/null +++ b/queue-5.10/net-zerocopy-refactor-skb-frag-fast-forward-op.patch @@ -0,0 +1,99 @@ +From 6f23b1624849f1cdea558ced7f77126b0be763c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Dec 2020 14:53:44 -0800 +Subject: net-zerocopy: Refactor skb frag fast-forward op. + +From: Arjun Roy + +[ Upstream commit 7fba5309efe24e4f0284ef4b8663cdf401035e72 ] + +Refactor skb frag fast-forwarding for tcp receive zerocopy. This is +part of a patch set that introduces short-circuited hybrid copies +for small receive operations, which results in roughly 33% fewer +syscalls for small RPC scenarios. + +skb_advance_to_frag(), given a skb and an offset into the skb, +iterates from the first frag for the skb until we're at the frag +specified by the offset. Assuming the offset provided refers to how +many bytes in the skb are already read, the returned frag points to +the next frag we may read from, while offset_frag is set to the number +of bytes from this frag that we have already read. + +If frag is not null and offset_frag is equal to 0, then we may be able +to map this frag's page into the process address space with +vm_insert_page(). However, if offset_frag is not equal to 0, then we +cannot do so. + +Signed-off-by: Arjun Roy +Signed-off-by: Eric Dumazet +Signed-off-by: Soheil Hassas Yeganeh +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 35 ++++++++++++++++++++++++++--------- + 1 file changed, 26 insertions(+), 9 deletions(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index ba6e4c6db3b0a..b3721cff45023 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1746,6 +1746,28 @@ int tcp_mmap(struct file *file, struct socket *sock, + } + EXPORT_SYMBOL(tcp_mmap); + ++static skb_frag_t *skb_advance_to_frag(struct sk_buff *skb, u32 offset_skb, ++ u32 *offset_frag) ++{ ++ skb_frag_t *frag; ++ ++ offset_skb -= skb_headlen(skb); ++ if ((int)offset_skb < 0 || skb_has_frag_list(skb)) ++ return NULL; ++ ++ frag = skb_shinfo(skb)->frags; ++ while (offset_skb) { ++ if (skb_frag_size(frag) > offset_skb) { ++ *offset_frag = offset_skb; ++ return frag; ++ } ++ offset_skb -= skb_frag_size(frag); ++ ++frag; ++ } ++ *offset_frag = 0; ++ return frag; ++} ++ + static int tcp_copy_straggler_data(struct tcp_zerocopy_receive *zc, + struct sk_buff *skb, u32 copylen, + u32 *offset, u32 *seq) +@@ -1872,6 +1894,8 @@ static int tcp_zerocopy_receive(struct sock *sk, + curr_addr = address; + while (length + PAGE_SIZE <= zc->length) { + if (zc->recv_skip_hint < PAGE_SIZE) { ++ u32 offset_frag; ++ + /* If we're here, finish the current batch. */ + if (pg_idx) { + ret = tcp_zerocopy_vm_insert_batch(vma, pages, +@@ -1892,16 +1916,9 @@ static int tcp_zerocopy_receive(struct sock *sk, + skb = tcp_recv_skb(sk, seq, &offset); + } + zc->recv_skip_hint = skb->len - offset; +- offset -= skb_headlen(skb); +- if ((int)offset < 0 || skb_has_frag_list(skb)) ++ frags = skb_advance_to_frag(skb, offset, &offset_frag); ++ if (!frags || offset_frag) + break; +- frags = skb_shinfo(skb)->frags; +- while (offset) { +- if (skb_frag_size(frags) > offset) +- goto out; +- offset -= skb_frag_size(frags); +- frags++; +- } + } + if (skb_frag_size(frags) != PAGE_SIZE || skb_frag_off(frags)) { + int remaining = zc->recv_skip_hint; +-- +2.33.0 + diff --git a/queue-5.10/nfc-add-nci_unreg-flag-to-eliminate-the-race.patch b/queue-5.10/nfc-add-nci_unreg-flag-to-eliminate-the-race.patch new file mode 100644 index 00000000000..5ef4bd165d7 --- /dev/null +++ b/queue-5.10/nfc-add-nci_unreg-flag-to-eliminate-the-race.patch @@ -0,0 +1,123 @@ +From b92f5c2d7595629c0446de24cbb6fc1fddc9935e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 23:27:32 +0800 +Subject: NFC: add NCI_UNREG flag to eliminate the race + +From: Lin Ma + +[ Upstream commit 48b71a9e66c2eab60564b1b1c85f4928ed04e406 ] + +There are two sites that calls queue_work() after the +destroy_workqueue() and lead to possible UAF. + +The first site is nci_send_cmd(), which can happen after the +nci_close_device as below + +nfcmrvl_nci_unregister_dev | nfc_genl_dev_up + nci_close_device | + flush_workqueue | + del_timer_sync | + nci_unregister_device | nfc_get_device + destroy_workqueue | nfc_dev_up + nfc_unregister_device | nci_dev_up + device_del | nci_open_device + | __nci_request + | nci_send_cmd + | queue_work !!! + +Another site is nci_cmd_timer, awaked by the nci_cmd_work from the +nci_send_cmd. + + ... | ... + nci_unregister_device | queue_work + destroy_workqueue | + nfc_unregister_device | ... + device_del | nci_cmd_work + | mod_timer + | ... + | nci_cmd_timer + | queue_work !!! + +For the above two UAF, the root cause is that the nfc_dev_up can race +between the nci_unregister_device routine. Therefore, this patch +introduce NCI_UNREG flag to easily eliminate the possible race. In +addition, the mutex_lock in nci_close_device can act as a barrier. + +Signed-off-by: Lin Ma +Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") +Reviewed-by: Jakub Kicinski +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20211116152732.19238-1-linma@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/nfc/nci_core.h | 1 + + net/nfc/nci/core.c | 19 +++++++++++++++++-- + 2 files changed, 18 insertions(+), 2 deletions(-) + +diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h +index 33979017b7824..004e49f748419 100644 +--- a/include/net/nfc/nci_core.h ++++ b/include/net/nfc/nci_core.h +@@ -30,6 +30,7 @@ enum nci_flag { + NCI_UP, + NCI_DATA_EXCHANGE, + NCI_DATA_EXCHANGE_TO, ++ NCI_UNREG, + }; + + /* NCI device states */ +diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c +index 4d3ab0f44c9f4..e38719e2ee582 100644 +--- a/net/nfc/nci/core.c ++++ b/net/nfc/nci/core.c +@@ -473,6 +473,11 @@ static int nci_open_device(struct nci_dev *ndev) + + mutex_lock(&ndev->req_lock); + ++ if (test_bit(NCI_UNREG, &ndev->flags)) { ++ rc = -ENODEV; ++ goto done; ++ } ++ + if (test_bit(NCI_UP, &ndev->flags)) { + rc = -EALREADY; + goto done; +@@ -536,6 +541,10 @@ done: + static int nci_close_device(struct nci_dev *ndev) + { + nci_req_cancel(ndev, ENODEV); ++ ++ /* This mutex needs to be held as a barrier for ++ * caller nci_unregister_device ++ */ + mutex_lock(&ndev->req_lock); + + if (!test_and_clear_bit(NCI_UP, &ndev->flags)) { +@@ -573,8 +582,8 @@ static int nci_close_device(struct nci_dev *ndev) + + del_timer_sync(&ndev->cmd_timer); + +- /* Clear flags */ +- ndev->flags = 0; ++ /* Clear flags except NCI_UNREG */ ++ ndev->flags &= BIT(NCI_UNREG); + + mutex_unlock(&ndev->req_lock); + +@@ -1259,6 +1268,12 @@ void nci_unregister_device(struct nci_dev *ndev) + { + struct nci_conn_info *conn_info, *n; + ++ /* This set_bit is not protected with specialized barrier, ++ * However, it is fine because the mutex_lock(&ndev->req_lock); ++ * in nci_close_device() will help to emit one. ++ */ ++ set_bit(NCI_UNREG, &ndev->flags); ++ + nci_close_device(ndev); + + destroy_workqueue(ndev->cmd_wq); +-- +2.33.0 + diff --git a/queue-5.10/nfc-reorder-the-logic-in-nfc_-un-register_device.patch b/queue-5.10/nfc-reorder-the-logic-in-nfc_-un-register_device.patch new file mode 100644 index 00000000000..075bb251ab5 --- /dev/null +++ b/queue-5.10/nfc-reorder-the-logic-in-nfc_-un-register_device.patch @@ -0,0 +1,129 @@ +From 61e65242dca7f65ade7b98899bef1ee78f6e395c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 23:26:52 +0800 +Subject: NFC: reorder the logic in nfc_{un,}register_device + +From: Lin Ma + +[ Upstream commit 3e3b5dfcd16a3e254aab61bd1e8c417dd4503102 ] + +There is a potential UAF between the unregistration routine and the NFC +netlink operations. + +The race that cause that UAF can be shown as below: + + (FREE) | (USE) +nfcmrvl_nci_unregister_dev | nfc_genl_dev_up + nci_close_device | + nci_unregister_device | nfc_get_device + nfc_unregister_device | nfc_dev_up + rfkill_destory | + device_del | rfkill_blocked + ... | ... + +The root cause for this race is concluded below: +1. The rfkill_blocked (USE) in nfc_dev_up is supposed to be placed after +the device_is_registered check. +2. Since the netlink operations are possible just after the device_add +in nfc_register_device, the nfc_dev_up() can happen anywhere during the +rfkill creation process, which leads to data race. + +This patch reorder these actions to permit +1. Once device_del is finished, the nfc_dev_up cannot dereference the +rfkill object. +2. The rfkill_register need to be placed after the device_add of nfc_dev +because the parent device need to be created first. So this patch keeps +the order but inject device_lock to prevent the data race. + +Signed-off-by: Lin Ma +Fixes: be055b2f89b5 ("NFC: RFKILL support") +Reviewed-by: Jakub Kicinski +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20211116152652.19217-1-linma@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/nfc/core.c | 32 ++++++++++++++++++-------------- + 1 file changed, 18 insertions(+), 14 deletions(-) + +diff --git a/net/nfc/core.c b/net/nfc/core.c +index eb377f87bcae8..6800470dd6df7 100644 +--- a/net/nfc/core.c ++++ b/net/nfc/core.c +@@ -94,13 +94,13 @@ int nfc_dev_up(struct nfc_dev *dev) + + device_lock(&dev->dev); + +- if (dev->rfkill && rfkill_blocked(dev->rfkill)) { +- rc = -ERFKILL; ++ if (!device_is_registered(&dev->dev)) { ++ rc = -ENODEV; + goto error; + } + +- if (!device_is_registered(&dev->dev)) { +- rc = -ENODEV; ++ if (dev->rfkill && rfkill_blocked(dev->rfkill)) { ++ rc = -ERFKILL; + goto error; + } + +@@ -1117,11 +1117,7 @@ int nfc_register_device(struct nfc_dev *dev) + if (rc) + pr_err("Could not register llcp device\n"); + +- rc = nfc_genl_device_added(dev); +- if (rc) +- pr_debug("The userspace won't be notified that the device %s was added\n", +- dev_name(&dev->dev)); +- ++ device_lock(&dev->dev); + dev->rfkill = rfkill_alloc(dev_name(&dev->dev), &dev->dev, + RFKILL_TYPE_NFC, &nfc_rfkill_ops, dev); + if (dev->rfkill) { +@@ -1130,6 +1126,12 @@ int nfc_register_device(struct nfc_dev *dev) + dev->rfkill = NULL; + } + } ++ device_unlock(&dev->dev); ++ ++ rc = nfc_genl_device_added(dev); ++ if (rc) ++ pr_debug("The userspace won't be notified that the device %s was added\n", ++ dev_name(&dev->dev)); + + return 0; + } +@@ -1146,10 +1148,17 @@ void nfc_unregister_device(struct nfc_dev *dev) + + pr_debug("dev_name=%s\n", dev_name(&dev->dev)); + ++ rc = nfc_genl_device_removed(dev); ++ if (rc) ++ pr_debug("The userspace won't be notified that the device %s " ++ "was removed\n", dev_name(&dev->dev)); ++ ++ device_lock(&dev->dev); + if (dev->rfkill) { + rfkill_unregister(dev->rfkill); + rfkill_destroy(dev->rfkill); + } ++ device_unlock(&dev->dev); + + if (dev->ops->check_presence) { + device_lock(&dev->dev); +@@ -1159,11 +1168,6 @@ void nfc_unregister_device(struct nfc_dev *dev) + cancel_work_sync(&dev->check_pres_work); + } + +- rc = nfc_genl_device_removed(dev); +- if (rc) +- pr_debug("The userspace won't be notified that the device %s " +- "was removed\n", dev_name(&dev->dev)); +- + nfc_llcp_unregister_device(dev); + + mutex_lock(&nfc_devlist_mutex); +-- +2.33.0 + diff --git a/queue-5.10/nfc-reorganize-the-functions-in-nci_request.patch b/queue-5.10/nfc-reorganize-the-functions-in-nci_request.patch new file mode 100644 index 00000000000..8e9264e4d70 --- /dev/null +++ b/queue-5.10/nfc-reorganize-the-functions-in-nci_request.patch @@ -0,0 +1,62 @@ +From a4ac86aaac35c08039df2b0ca83e48e6faa746db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Nov 2021 22:56:00 +0800 +Subject: NFC: reorganize the functions in nci_request + +From: Lin Ma + +[ Upstream commit 86cdf8e38792545161dbe3350a7eced558ba4d15 ] + +There is a possible data race as shown below: + +thread-A in nci_request() | thread-B in nci_close_device() + | mutex_lock(&ndev->req_lock); +test_bit(NCI_UP, &ndev->flags); | +... | test_and_clear_bit(NCI_UP, &ndev->flags) +mutex_lock(&ndev->req_lock); | + | + +This race will allow __nci_request() to be awaked while the device is +getting removed. + +Similar to commit e2cb6b891ad2 ("bluetooth: eliminate the potential race +condition when removing the HCI controller"). this patch alters the +function sequence in nci_request() to prevent the data races between the +nci_close_device(). + +Signed-off-by: Lin Ma +Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") +Link: https://lore.kernel.org/r/20211115145600.8320-1-linma@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/nfc/nci/core.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c +index 32e8154363cab..5e55cb6c087a2 100644 +--- a/net/nfc/nci/core.c ++++ b/net/nfc/nci/core.c +@@ -144,12 +144,15 @@ inline int nci_request(struct nci_dev *ndev, + { + int rc; + +- if (!test_bit(NCI_UP, &ndev->flags)) +- return -ENETDOWN; +- + /* Serialize all requests */ + mutex_lock(&ndev->req_lock); +- rc = __nci_request(ndev, req, opt, timeout); ++ /* check the state after obtaing the lock against any races ++ * from nci_close_device when the device gets removed. ++ */ ++ if (test_bit(NCI_UP, &ndev->flags)) ++ rc = __nci_request(ndev, req, opt, timeout); ++ else ++ rc = -ENETDOWN; + mutex_unlock(&ndev->req_lock); + + return rc; +-- +2.33.0 + diff --git a/queue-5.10/perf-bench-fix-two-memory-leaks-detected-with-asan.patch b/queue-5.10/perf-bench-fix-two-memory-leaks-detected-with-asan.patch new file mode 100644 index 00000000000..c6391c1c77b --- /dev/null +++ b/queue-5.10/perf-bench-fix-two-memory-leaks-detected-with-asan.patch @@ -0,0 +1,56 @@ +From e492a415127093857d11f286a55c51c43ab525d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Nov 2021 04:20:11 +0200 +Subject: perf bench: Fix two memory leaks detected with ASan + +From: Sohaib Mohamed + +[ Upstream commit 92723ea0f11d92496687db8c9725248e9d1e5e1d ] + +ASan reports memory leaks while running: + + $ perf bench sched all + +Fixes: e27454cc6352c422 ("perf bench: Add sched-messaging.c: Benchmark for scheduler and IPC mechanisms based on hackbench") +Signed-off-by: Sohaib Mohamed +Acked-by: Ian Rogers +Cc: Alexander Shishkin +Cc: Hitoshi Mitake +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Paul Russel +Cc: Peter Zijlstra +Cc: Pierre Gondois +Link: http://lore.kernel.org/lkml/20211110022012.16620-1-sohaib.amhmd@gmail.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/bench/sched-messaging.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tools/perf/bench/sched-messaging.c b/tools/perf/bench/sched-messaging.c +index cecce93ccc636..9ce72fa873768 100644 +--- a/tools/perf/bench/sched-messaging.c ++++ b/tools/perf/bench/sched-messaging.c +@@ -223,6 +223,8 @@ static unsigned int group(pthread_t *pth, + snd_ctx->out_fds[i] = fds[1]; + if (!thread_mode) + close(fds[0]); ++ ++ free(ctx); + } + + /* Now we have all the fds, fork the senders */ +@@ -239,6 +241,8 @@ static unsigned int group(pthread_t *pth, + for (i = 0; i < num_fds; i++) + close(snd_ctx->out_fds[i]); + ++ free(snd_ctx); ++ + /* Return number of children to reap */ + return num_fds * 2; + } +-- +2.33.0 + diff --git a/queue-5.10/perf-bench-futex-fix-memory-leak-of-perf_cpu_map__ne.patch b/queue-5.10/perf-bench-futex-fix-memory-leak-of-perf_cpu_map__ne.patch new file mode 100644 index 00000000000..780f5c44f1a --- /dev/null +++ b/queue-5.10/perf-bench-futex-fix-memory-leak-of-perf_cpu_map__ne.patch @@ -0,0 +1,93 @@ +From 7041c849bdff95dd2b29709d430f8f35e8938e38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Nov 2021 22:11:33 +0200 +Subject: perf bench futex: Fix memory leak of perf_cpu_map__new() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sohaib Mohamed + +[ Upstream commit 88e48238d53682281c9de2a0b65d24d3b64542a0 ] + +ASan reports memory leaks while running: + + $ sudo ./perf bench futex all + +The leaks are caused by perf_cpu_map__new not being freed. +This patch adds the missing perf_cpu_map__put since it calls +cpu_map_delete implicitly. + +Fixes: 9c3516d1b850ea93 ("libperf: Add perf_cpu_map__new()/perf_cpu_map__read() functions") +Signed-off-by: Sohaib Mohamed +Cc: Alexander Shishkin +Cc: André Almeida +Cc: Darren Hart +Cc: Davidlohr Bueso +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Sohaib Mohamed +Cc: Thomas Gleixner +Link: http://lore.kernel.org/lkml/20211112201134.77892-1-sohaib.amhmd@gmail.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/bench/futex-lock-pi.c | 1 + + tools/perf/bench/futex-requeue.c | 1 + + tools/perf/bench/futex-wake-parallel.c | 1 + + tools/perf/bench/futex-wake.c | 1 + + 4 files changed, 4 insertions(+) + +diff --git a/tools/perf/bench/futex-lock-pi.c b/tools/perf/bench/futex-lock-pi.c +index bb25d8beb3b85..159bc89e6a79a 100644 +--- a/tools/perf/bench/futex-lock-pi.c ++++ b/tools/perf/bench/futex-lock-pi.c +@@ -226,6 +226,7 @@ int bench_futex_lock_pi(int argc, const char **argv) + print_summary(); + + free(worker); ++ perf_cpu_map__put(cpu); + return ret; + err: + usage_with_options(bench_futex_lock_pi_usage, options); +diff --git a/tools/perf/bench/futex-requeue.c b/tools/perf/bench/futex-requeue.c +index 7a15c2e610228..105b36cdc42d3 100644 +--- a/tools/perf/bench/futex-requeue.c ++++ b/tools/perf/bench/futex-requeue.c +@@ -216,6 +216,7 @@ int bench_futex_requeue(int argc, const char **argv) + print_summary(); + + free(worker); ++ perf_cpu_map__put(cpu); + return ret; + err: + usage_with_options(bench_futex_requeue_usage, options); +diff --git a/tools/perf/bench/futex-wake-parallel.c b/tools/perf/bench/futex-wake-parallel.c +index cd2b81a845acb..a129c94eb3fe1 100644 +--- a/tools/perf/bench/futex-wake-parallel.c ++++ b/tools/perf/bench/futex-wake-parallel.c +@@ -320,6 +320,7 @@ int bench_futex_wake_parallel(int argc, const char **argv) + print_summary(); + + free(blocked_worker); ++ perf_cpu_map__put(cpu); + return ret; + } + #endif /* HAVE_PTHREAD_BARRIER */ +diff --git a/tools/perf/bench/futex-wake.c b/tools/perf/bench/futex-wake.c +index 2dfcef3e371e4..507ff533612c6 100644 +--- a/tools/perf/bench/futex-wake.c ++++ b/tools/perf/bench/futex-wake.c +@@ -210,5 +210,6 @@ int bench_futex_wake(int argc, const char **argv) + print_summary(); + + free(worker); ++ perf_cpu_map__put(cpu); + return ret; + } +-- +2.33.0 + diff --git a/queue-5.10/perf-bpf-avoid-memory-leak-from-perf_env__insert_btf.patch b/queue-5.10/perf-bpf-avoid-memory-leak-from-perf_env__insert_btf.patch new file mode 100644 index 00000000000..6812389934b --- /dev/null +++ b/queue-5.10/perf-bpf-avoid-memory-leak-from-perf_env__insert_btf.patch @@ -0,0 +1,114 @@ +From f67b9afc5acd9cf716a62ee85b12058b4f98f49b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Nov 2021 23:45:25 -0800 +Subject: perf bpf: Avoid memory leak from perf_env__insert_btf() + +From: Ian Rogers + +[ Upstream commit 4924b1f7c46711762fd0e65c135ccfbcfd6ded1f ] + +perf_env__insert_btf() doesn't insert if a duplicate BTF id is +encountered and this causes a memory leak. Modify the function to return +a success/error value and then free the memory if insertion didn't +happen. + +v2. Adds a return -1 when the insertion error occurs in + perf_env__fetch_btf. This doesn't affect anything as the result is + never checked. + +Fixes: 3792cb2ff43b1b19 ("perf bpf: Save BTF in a rbtree in perf_env") +Signed-off-by: Ian Rogers +Cc: Alexander Shishkin +Cc: Alexei Starovoitov +Cc: Andrii Nakryiko +Cc: Daniel Borkmann +Cc: Jiri Olsa +Cc: John Fastabend +Cc: KP Singh +Cc: Mark Rutland +Cc: Martin KaFai Lau +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Song Liu +Cc: Stephane Eranian +Cc: Tiezhu Yang +Cc: Yonghong Song +Cc: bpf@vger.kernel.org +Cc: netdev@vger.kernel.org +Link: http://lore.kernel.org/lkml/20211112074525.121633-1-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf-event.c | 6 +++++- + tools/perf/util/env.c | 5 ++++- + tools/perf/util/env.h | 2 +- + 3 files changed, 10 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c +index c8101575dbf45..4eb02762104ba 100644 +--- a/tools/perf/util/bpf-event.c ++++ b/tools/perf/util/bpf-event.c +@@ -109,7 +109,11 @@ static int perf_env__fetch_btf(struct perf_env *env, + node->data_size = data_size; + memcpy(node->data, data, data_size); + +- perf_env__insert_btf(env, node); ++ if (!perf_env__insert_btf(env, node)) { ++ /* Insertion failed because of a duplicate. */ ++ free(node); ++ return -1; ++ } + return 0; + } + +diff --git a/tools/perf/util/env.c b/tools/perf/util/env.c +index f0dceb527ca38..d81ed1bc14bdc 100644 +--- a/tools/perf/util/env.c ++++ b/tools/perf/util/env.c +@@ -71,12 +71,13 @@ out: + return node; + } + +-void perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node) ++bool perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node) + { + struct rb_node *parent = NULL; + __u32 btf_id = btf_node->id; + struct btf_node *node; + struct rb_node **p; ++ bool ret = true; + + down_write(&env->bpf_progs.lock); + p = &env->bpf_progs.btfs.rb_node; +@@ -90,6 +91,7 @@ void perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node) + p = &(*p)->rb_right; + } else { + pr_debug("duplicated btf %u\n", btf_id); ++ ret = false; + goto out; + } + } +@@ -99,6 +101,7 @@ void perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node) + env->bpf_progs.btfs_cnt++; + out: + up_write(&env->bpf_progs.lock); ++ return ret; + } + + struct btf_node *perf_env__find_btf(struct perf_env *env, __u32 btf_id) +diff --git a/tools/perf/util/env.h b/tools/perf/util/env.h +index a129726520064..01378a955dd5e 100644 +--- a/tools/perf/util/env.h ++++ b/tools/perf/util/env.h +@@ -143,7 +143,7 @@ void perf_env__insert_bpf_prog_info(struct perf_env *env, + struct bpf_prog_info_node *info_node); + struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env, + __u32 prog_id); +-void perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node); ++bool perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node); + struct btf_node *perf_env__find_btf(struct perf_env *env, __u32 btf_id); + + int perf_env__numa_node(struct perf_env *env, int cpu); +-- +2.33.0 + diff --git a/queue-5.10/perf-tests-remove-bash-construct-from-record-zstd_co.patch b/queue-5.10/perf-tests-remove-bash-construct-from-record-zstd_co.patch new file mode 100644 index 00000000000..62dd141001f --- /dev/null +++ b/queue-5.10/perf-tests-remove-bash-construct-from-record-zstd_co.patch @@ -0,0 +1,62 @@ +From 7ca2e99b9987f8e87614f7025b08deb5425dd06e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Oct 2021 14:48:26 +0100 +Subject: perf tests: Remove bash construct from record+zstd_comp_decomp.sh + +From: James Clark + +[ Upstream commit a9cdc1c5e3700a5200e5ca1f90b6958b6483845b ] + +Commit 463538a383a2 ("perf tests: Fix test 68 zstd compression for +s390") inadvertently removed the -g flag from all platforms rather than +just s390, because the [[ ]] construct fails in sh. Changing to single +brackets restores testing of call graphs and removes the following error +from the output: + + $ ./perf test -v 85 + 85: Zstd perf.data compression/decompression : + --- start --- + test child forked, pid 50643 + Collecting compressed record file: + ./tests/shell/record+zstd_comp_decomp.sh: 15: [[: not found + +Fixes: 463538a383a2 ("perf tests: Fix test 68 zstd compression for s390") +Signed-off-by: James Clark +Cc: Alexander Shishkin +Cc: Florian Fainelli +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: John Fastabend +Cc: KP Singh +Cc: Mark Rutland +Cc: Martin KaFai Lau +Cc: Namhyung Kim +Cc: Song Liu +Cc: Sumanth Korikkar +Cc: Thomas Richter +Cc: Yonghong Song +Cc: bpf@vger.kernel.org +Cc: netdev@vger.kernel.org +Link: https://lore.kernel.org/r/20211028134828.65774-3-james.clark@arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/record+zstd_comp_decomp.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/tests/shell/record+zstd_comp_decomp.sh b/tools/perf/tests/shell/record+zstd_comp_decomp.sh +index 045723b3d9928..c62af807198de 100755 +--- a/tools/perf/tests/shell/record+zstd_comp_decomp.sh ++++ b/tools/perf/tests/shell/record+zstd_comp_decomp.sh +@@ -12,7 +12,7 @@ skip_if_no_z_record() { + + collect_z_record() { + echo "Collecting compressed record file:" +- [[ "$(uname -m)" != s390x ]] && gflag='-g' ++ [ "$(uname -m)" != s390x ] && gflag='-g' + $perf_tool record -o $trace_file $gflag -z -F 5000 -- \ + dd count=500 if=/dev/urandom of=/dev/null + } +-- +2.33.0 + diff --git a/queue-5.10/perf-x86-vlbr-add-c-flags-to-vlbr-event-constraints.patch b/queue-5.10/perf-x86-vlbr-add-c-flags-to-vlbr-event-constraints.patch new file mode 100644 index 00000000000..e2178af2ea5 --- /dev/null +++ b/queue-5.10/perf-x86-vlbr-add-c-flags-to-vlbr-event-constraints.patch @@ -0,0 +1,44 @@ +From b73f838b9291537d6f1ce53bace5129e85ae3c48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Nov 2021 17:17:16 +0800 +Subject: perf/x86/vlbr: Add c->flags to vlbr event constraints + +From: Like Xu + +[ Upstream commit 5863702561e625903ec678551cb056a4b19e0b8a ] + +Just like what we do in the x86_get_event_constraints(), the +PERF_X86_EVENT_LBR_SELECT flag should also be propagated +to event->hw.flags so that the host lbr driver can save/restore +MSR_LBR_SELECT for the special vlbr event created by KVM or BPF. + +Fixes: 097e4311cda9 ("perf/x86: Add constraint to create guest LBR event without hw counter") +Reported-by: Wanpeng Li +Signed-off-by: Like Xu +Signed-off-by: Peter Zijlstra (Intel) +Tested-by: Wanpeng Li +Link: https://lore.kernel.org/r/20211103091716.59906-1-likexu@tencent.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index 4684bf9fcc428..a521135247eb6 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -2879,8 +2879,10 @@ intel_vlbr_constraints(struct perf_event *event) + { + struct event_constraint *c = &vlbr_constraint; + +- if (unlikely(constraint_match(c, event->hw.config))) ++ if (unlikely(constraint_match(c, event->hw.config))) { ++ event->hw.flags |= c->flags; + return c; ++ } + + return NULL; + } +-- +2.33.0 + diff --git a/queue-5.10/platform-x86-hp_accel-fix-an-error-handling-path-in-.patch b/queue-5.10/platform-x86-hp_accel-fix-an-error-handling-path-in-.patch new file mode 100644 index 00000000000..a64509ea5c9 --- /dev/null +++ b/queue-5.10/platform-x86-hp_accel-fix-an-error-handling-path-in-.patch @@ -0,0 +1,46 @@ +From 6b654a502ce2c4ade80793aeb416c39951695764 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Nov 2021 20:57:07 +0100 +Subject: platform/x86: hp_accel: Fix an error handling path in + 'lis3lv02d_probe()' + +From: Christophe JAILLET + +[ Upstream commit c961a7d2aa23ae19e0099fbcdf1040fb760eea83 ] + +If 'led_classdev_register()' fails, some additional resources should be +released. + +Add the missing 'i8042_remove_filter()' and 'lis3lv02d_remove_fs()' calls +that are already in the remove function but are missing here. + +Fixes: a4c724d0723b ("platform: hp_accel: add a i8042 filter to remove HPQ6000 data from kb bus stream") +Fixes: 9e0c79782143 ("lis3lv02d: merge with leds hp disk") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/5a4f218f8f16d2e3a7906b7ca3654ffa946895f8.1636314074.git.christophe.jaillet@wanadoo.fr +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/hp_accel.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c +index 8c0867bda8280..0dfaa1a43b674 100644 +--- a/drivers/platform/x86/hp_accel.c ++++ b/drivers/platform/x86/hp_accel.c +@@ -372,9 +372,11 @@ static int lis3lv02d_add(struct acpi_device *device) + INIT_WORK(&hpled_led.work, delayed_set_status_worker); + ret = led_classdev_register(NULL, &hpled_led.led_classdev); + if (ret) { ++ i8042_remove_filter(hp_accel_i8042_filter); + lis3lv02d_joystick_disable(&lis3_dev); + lis3lv02d_poweroff(&lis3_dev); + flush_work(&hpled_led.work); ++ lis3lv02d_remove_fs(&lis3_dev); + return ret; + } + +-- +2.33.0 + diff --git a/queue-5.10/powerpc-5200-dts-fix-memory-node-unit-name.patch b/queue-5.10/powerpc-5200-dts-fix-memory-node-unit-name.patch new file mode 100644 index 00000000000..93df4267f36 --- /dev/null +++ b/queue-5.10/powerpc-5200-dts-fix-memory-node-unit-name.patch @@ -0,0 +1,191 @@ +From 19927a0575a0a5f5014f1d958aaed2d4aefd5d2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Oct 2021 00:05:31 +0200 +Subject: powerpc/5200: dts: fix memory node unit name + +From: Anatolij Gustschin + +[ Upstream commit aed2886a5e9ffc8269a4220bff1e9e030d3d2eb1 ] + +Fixes build warnings: +Warning (unit_address_vs_reg): /memory: node has a reg or ranges property, but no unit name + +Signed-off-by: Anatolij Gustschin +Reviewed-by: Rob Herring +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20211013220532.24759-4-agust@denx.de +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/dts/charon.dts | 2 +- + arch/powerpc/boot/dts/digsy_mtc.dts | 2 +- + arch/powerpc/boot/dts/lite5200.dts | 2 +- + arch/powerpc/boot/dts/lite5200b.dts | 2 +- + arch/powerpc/boot/dts/media5200.dts | 2 +- + arch/powerpc/boot/dts/mpc5200b.dtsi | 2 +- + arch/powerpc/boot/dts/o2d.dts | 2 +- + arch/powerpc/boot/dts/o2d.dtsi | 2 +- + arch/powerpc/boot/dts/o2dnt2.dts | 2 +- + arch/powerpc/boot/dts/o3dnt.dts | 2 +- + arch/powerpc/boot/dts/pcm032.dts | 2 +- + arch/powerpc/boot/dts/tqm5200.dts | 2 +- + 12 files changed, 12 insertions(+), 12 deletions(-) + +diff --git a/arch/powerpc/boot/dts/charon.dts b/arch/powerpc/boot/dts/charon.dts +index 408b486b13dff..cd589539f313f 100644 +--- a/arch/powerpc/boot/dts/charon.dts ++++ b/arch/powerpc/boot/dts/charon.dts +@@ -35,7 +35,7 @@ + }; + }; + +- memory { ++ memory@0 { + device_type = "memory"; + reg = <0x00000000 0x08000000>; // 128MB + }; +diff --git a/arch/powerpc/boot/dts/digsy_mtc.dts b/arch/powerpc/boot/dts/digsy_mtc.dts +index 0e5e9d3acf79f..19a14e62e65f4 100644 +--- a/arch/powerpc/boot/dts/digsy_mtc.dts ++++ b/arch/powerpc/boot/dts/digsy_mtc.dts +@@ -16,7 +16,7 @@ + model = "intercontrol,digsy-mtc"; + compatible = "intercontrol,digsy-mtc"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x02000000>; // 32MB + }; + +diff --git a/arch/powerpc/boot/dts/lite5200.dts b/arch/powerpc/boot/dts/lite5200.dts +index cb2782dd6132c..e7b194775d783 100644 +--- a/arch/powerpc/boot/dts/lite5200.dts ++++ b/arch/powerpc/boot/dts/lite5200.dts +@@ -32,7 +32,7 @@ + }; + }; + +- memory { ++ memory@0 { + device_type = "memory"; + reg = <0x00000000 0x04000000>; // 64MB + }; +diff --git a/arch/powerpc/boot/dts/lite5200b.dts b/arch/powerpc/boot/dts/lite5200b.dts +index 2b86c81f90485..547cbe726ff23 100644 +--- a/arch/powerpc/boot/dts/lite5200b.dts ++++ b/arch/powerpc/boot/dts/lite5200b.dts +@@ -31,7 +31,7 @@ + led4 { gpios = <&gpio_simple 2 1>; }; + }; + +- memory { ++ memory@0 { + reg = <0x00000000 0x10000000>; // 256MB + }; + +diff --git a/arch/powerpc/boot/dts/media5200.dts b/arch/powerpc/boot/dts/media5200.dts +index 61cae9dcddef4..f3188018faceb 100644 +--- a/arch/powerpc/boot/dts/media5200.dts ++++ b/arch/powerpc/boot/dts/media5200.dts +@@ -32,7 +32,7 @@ + }; + }; + +- memory { ++ memory@0 { + reg = <0x00000000 0x08000000>; // 128MB RAM + }; + +diff --git a/arch/powerpc/boot/dts/mpc5200b.dtsi b/arch/powerpc/boot/dts/mpc5200b.dtsi +index 648fe31795f49..8b796f3b11da7 100644 +--- a/arch/powerpc/boot/dts/mpc5200b.dtsi ++++ b/arch/powerpc/boot/dts/mpc5200b.dtsi +@@ -33,7 +33,7 @@ + }; + }; + +- memory: memory { ++ memory: memory@0 { + device_type = "memory"; + reg = <0x00000000 0x04000000>; // 64MB + }; +diff --git a/arch/powerpc/boot/dts/o2d.dts b/arch/powerpc/boot/dts/o2d.dts +index 24a46f65e5299..e0a8d3034417f 100644 +--- a/arch/powerpc/boot/dts/o2d.dts ++++ b/arch/powerpc/boot/dts/o2d.dts +@@ -12,7 +12,7 @@ + model = "ifm,o2d"; + compatible = "ifm,o2d"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x08000000>; // 128MB + }; + +diff --git a/arch/powerpc/boot/dts/o2d.dtsi b/arch/powerpc/boot/dts/o2d.dtsi +index 6661955a2be47..b55a9e5bd828c 100644 +--- a/arch/powerpc/boot/dts/o2d.dtsi ++++ b/arch/powerpc/boot/dts/o2d.dtsi +@@ -19,7 +19,7 @@ + model = "ifm,o2d"; + compatible = "ifm,o2d"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x04000000>; // 64MB + }; + +diff --git a/arch/powerpc/boot/dts/o2dnt2.dts b/arch/powerpc/boot/dts/o2dnt2.dts +index eeba7f5507d5d..c2eedbd1f5fcb 100644 +--- a/arch/powerpc/boot/dts/o2dnt2.dts ++++ b/arch/powerpc/boot/dts/o2dnt2.dts +@@ -12,7 +12,7 @@ + model = "ifm,o2dnt2"; + compatible = "ifm,o2d"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x08000000>; // 128MB + }; + +diff --git a/arch/powerpc/boot/dts/o3dnt.dts b/arch/powerpc/boot/dts/o3dnt.dts +index fd00396b0593e..e4c1bdd412716 100644 +--- a/arch/powerpc/boot/dts/o3dnt.dts ++++ b/arch/powerpc/boot/dts/o3dnt.dts +@@ -12,7 +12,7 @@ + model = "ifm,o3dnt"; + compatible = "ifm,o2d"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x04000000>; // 64MB + }; + +diff --git a/arch/powerpc/boot/dts/pcm032.dts b/arch/powerpc/boot/dts/pcm032.dts +index 780e13d99e7b8..1895bc95900cc 100644 +--- a/arch/powerpc/boot/dts/pcm032.dts ++++ b/arch/powerpc/boot/dts/pcm032.dts +@@ -20,7 +20,7 @@ + model = "phytec,pcm032"; + compatible = "phytec,pcm032"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x08000000>; // 128MB + }; + +diff --git a/arch/powerpc/boot/dts/tqm5200.dts b/arch/powerpc/boot/dts/tqm5200.dts +index 9ed0bc78967e1..5bb25a9e40a01 100644 +--- a/arch/powerpc/boot/dts/tqm5200.dts ++++ b/arch/powerpc/boot/dts/tqm5200.dts +@@ -32,7 +32,7 @@ + }; + }; + +- memory { ++ memory@0 { + device_type = "memory"; + reg = <0x00000000 0x04000000>; // 64MB + }; +-- +2.33.0 + diff --git a/queue-5.10/powerpc-8xx-fix-oops-with-strict_kernel_rwx-without-.patch b/queue-5.10/powerpc-8xx-fix-oops-with-strict_kernel_rwx-without-.patch new file mode 100644 index 00000000000..0eff2a4ec55 --- /dev/null +++ b/queue-5.10/powerpc-8xx-fix-oops-with-strict_kernel_rwx-without-.patch @@ -0,0 +1,69 @@ +From 5a2696b81675a2c2783269fb46602c7edc041a48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Oct 2021 17:10:45 +0200 +Subject: powerpc/8xx: Fix Oops with STRICT_KERNEL_RWX without + DEBUG_RODATA_TEST + +From: Christophe Leroy + +[ Upstream commit c12ab8dbc492b992e1ea717db933cee568780c47 ] + +Until now, all tests involving CONFIG_STRICT_KERNEL_RWX were done with +DEBUG_RODATA_TEST to check the result. But now that +CONFIG_STRICT_KERNEL_RWX is selected by default, it came without +CONFIG_DEBUG_RODATA_TEST and led to the following Oops + +[ 6.830908] Freeing unused kernel image (initmem) memory: 352K +[ 6.840077] BUG: Unable to handle kernel data access on write at 0xc1285200 +[ 6.846836] Faulting instruction address: 0xc0004b6c +[ 6.851745] Oops: Kernel access of bad area, sig: 11 [#1] +[ 6.857075] BE PAGE_SIZE=16K PREEMPT CMPC885 +[ 6.861348] SAF3000 DIE NOTIFICATION +[ 6.864830] CPU: 0 PID: 1 Comm: swapper Not tainted 5.15.0-rc5-s3k-dev-02255-g2747d7b7916f #451 +[ 6.873429] NIP: c0004b6c LR: c0004b60 CTR: 00000000 +[ 6.878419] REGS: c902be60 TRAP: 0300 Not tainted (5.15.0-rc5-s3k-dev-02255-g2747d7b7916f) +[ 6.886852] MSR: 00009032 CR: 53000335 XER: 8000ff40 +[ 6.893564] DAR: c1285200 DSISR: 82000000 +[ 6.893564] GPR00: 0c000000 c902bf20 c20f4000 08000000 00000001 04001f00 c1800000 00000035 +[ 6.893564] GPR08: ff0001ff c1280000 00000002 c0004b60 00001000 00000000 c0004b1c 00000000 +[ 6.893564] GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +[ 6.893564] GPR24: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 c1060000 +[ 6.932034] NIP [c0004b6c] kernel_init+0x50/0x138 +[ 6.936682] LR [c0004b60] kernel_init+0x44/0x138 +[ 6.941245] Call Trace: +[ 6.943653] [c902bf20] [c0004b60] kernel_init+0x44/0x138 (unreliable) +[ 6.950022] [c902bf30] [c001122c] ret_from_kernel_thread+0x5c/0x64 +[ 6.956135] Instruction dump: +[ 6.959060] 48ffc521 48045469 4800d8cd 3d20c086 89295fa0 2c090000 41820058 480796c9 +[ 6.966890] 4800e48d 3d20c128 39400002 3fe0c106 <91495200> 3bff8000 4806fa1d 481f7d75 +[ 6.974902] ---[ end trace 1e397bacba4aa610 ]--- + +0xc1285200 corresponds to 'system_state' global var that the kernel is trying to set to +SYSTEM_RUNNING. This var is above the RO/RW limit so it shouldn't Oops. + +It oopses because the dirty bit is missing. + +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/3d5800b0bbcd7b19761b98f50421358667b45331.1635520232.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/head_8xx.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S +index ce5fd93499a74..896a1f8d3e6ac 100644 +--- a/arch/powerpc/kernel/head_8xx.S ++++ b/arch/powerpc/kernel/head_8xx.S +@@ -788,7 +788,7 @@ _GLOBAL(mmu_pin_tlb) + cmplw r6, r9 + bdnzt lt, 2b + +-4: LOAD_REG_IMMEDIATE(r8, 0xf0 | _PAGE_SPS | _PAGE_SH | _PAGE_PRESENT) ++4: LOAD_REG_IMMEDIATE(r8, 0xf0 | _PAGE_DIRTY | _PAGE_SPS | _PAGE_SH | _PAGE_PRESENT) + 2: ori r0, r6, MD_EVALID + mtspr SPRN_MD_CTR, r5 + mtspr SPRN_MD_EPN, r0 +-- +2.33.0 + diff --git a/queue-5.10/powerpc-dcr-use-cmplwi-instead-of-3-argument-cmpli.patch b/queue-5.10/powerpc-dcr-use-cmplwi-instead-of-3-argument-cmpli.patch new file mode 100644 index 00000000000..ae264745d0f --- /dev/null +++ b/queue-5.10/powerpc-dcr-use-cmplwi-instead-of-3-argument-cmpli.patch @@ -0,0 +1,66 @@ +From b2399fd1260f3f1b2c4e9417a052d8cd42de715d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Oct 2021 13:44:24 +1100 +Subject: powerpc/dcr: Use cmplwi instead of 3-argument cmpli +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Ellerman + +[ Upstream commit fef071be57dc43679a32d5b0e6ee176d6f12e9f2 ] + +In dcr-low.S we use cmpli with three arguments, instead of four +arguments as defined in the ISA: + + cmpli cr0,r3,1024 + +This appears to be a PPC440-ism, looking at the "PPC440x5 CPU Core +User’s Manual" it shows cmpli having no L field, but implied to be 0 due +to the core being 32-bit. It mentions that the ISA defines four +arguments and recommends using cmplwi. + +It also corresponds to the old POWER instruction set, which had no L +field there, a reserved bit instead. + +dcr-low.S is only built 32-bit, because it is only built when +DCR_NATIVE=y, which is only selected by 40x and 44x. Looking at the +generated code (with gcc/gas) we see cmplwi as expected. + +Although gas is happy with the 3-argument version when building for +32-bit, the LLVM assembler is not and errors out with: + + arch/powerpc/sysdev/dcr-low.S:27:10: error: invalid operand for instruction + cmpli 0,%r3,1024; ... + ^ + +Switch to the cmplwi extended opcode, which avoids any confusion when +reading the ISA, fixes the issue with the LLVM assembler, and also means +the code could be built 64-bit in future (though that's very unlikely). + +Reported-by: Nick Desaulniers +Reviewed-by: Nick Desaulniers +Signed-off-by: Michael Ellerman +BugLink: https://github.com/ClangBuiltLinux/linux/issues/1419 +Link: https://lore.kernel.org/r/20211014024424.528848-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/sysdev/dcr-low.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/sysdev/dcr-low.S b/arch/powerpc/sysdev/dcr-low.S +index efeeb1b885a17..329b9c4ae5429 100644 +--- a/arch/powerpc/sysdev/dcr-low.S ++++ b/arch/powerpc/sysdev/dcr-low.S +@@ -11,7 +11,7 @@ + #include + + #define DCR_ACCESS_PROLOG(table) \ +- cmpli cr0,r3,1024; \ ++ cmplwi cr0,r3,1024; \ + rlwinm r3,r3,4,18,27; \ + lis r5,table@h; \ + ori r5,r5,table@l; \ +-- +2.33.0 + diff --git a/queue-5.10/rdma-bnxt_re-check-if-the-vlan-is-valid-before-repor.patch b/queue-5.10/rdma-bnxt_re-check-if-the-vlan-is-valid-before-repor.patch new file mode 100644 index 00000000000..e1f2286c88b --- /dev/null +++ b/queue-5.10/rdma-bnxt_re-check-if-the-vlan-is-valid-before-repor.patch @@ -0,0 +1,57 @@ +From 3727aabf7c6278051aaeebdc65a9bf73c5df2d45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Sep 2021 05:32:42 -0700 +Subject: RDMA/bnxt_re: Check if the vlan is valid before reporting + +From: Selvin Xavier + +[ Upstream commit 6bda39149d4b8920fdb8744090653aca3daa792d ] + +When VF is configured with default vlan, HW strips the vlan from the +packet and driver receives it in Rx completion. VLAN needs to be reported +for UD work completion only if the vlan is configured on the host. Add a +check for valid vlan in the UD receive path. + +Link: https://lore.kernel.org/r/1631709163-2287-12-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index 441952a5eca4a..10d77f50f818b 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -3368,8 +3368,11 @@ static void bnxt_re_process_res_ud_wc(struct bnxt_re_qp *qp, + struct ib_wc *wc, + struct bnxt_qplib_cqe *cqe) + { ++ struct bnxt_re_dev *rdev; ++ u16 vlan_id = 0; + u8 nw_type; + ++ rdev = qp->rdev; + wc->opcode = IB_WC_RECV; + wc->status = __rc_to_ib_wc_status(cqe->status); + +@@ -3381,9 +3384,12 @@ static void bnxt_re_process_res_ud_wc(struct bnxt_re_qp *qp, + memcpy(wc->smac, cqe->smac, ETH_ALEN); + wc->wc_flags |= IB_WC_WITH_SMAC; + if (cqe->flags & CQ_RES_UD_FLAGS_META_FORMAT_VLAN) { +- wc->vlan_id = (cqe->cfa_meta & 0xFFF); +- if (wc->vlan_id < 0x1000) +- wc->wc_flags |= IB_WC_WITH_VLAN; ++ vlan_id = (cqe->cfa_meta & 0xFFF); ++ } ++ /* Mark only if vlan_id is non zero */ ++ if (vlan_id && bnxt_re_check_if_vlan_valid(rdev, vlan_id)) { ++ wc->vlan_id = vlan_id; ++ wc->wc_flags |= IB_WC_WITH_VLAN; + } + nw_type = (cqe->flags & CQ_RES_UD_FLAGS_ROCE_IP_VER_MASK) >> + CQ_RES_UD_FLAGS_ROCE_IP_VER_SFT; +-- +2.33.0 + diff --git a/queue-5.10/sched-core-mitigate-race-cpus_share_cache-update_top.patch b/queue-5.10/sched-core-mitigate-race-cpus_share_cache-update_top.patch new file mode 100644 index 00000000000..bebf0aa5804 --- /dev/null +++ b/queue-5.10/sched-core-mitigate-race-cpus_share_cache-update_top.patch @@ -0,0 +1,61 @@ +From 43cdadee8eaf552c040bd262b84febaedd5b0e10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Nov 2021 17:51:20 +0000 +Subject: sched/core: Mitigate race + cpus_share_cache()/update_top_cache_domain() + +From: Vincent Donnefort + +[ Upstream commit 42dc938a590c96eeb429e1830123fef2366d9c80 ] + +Nothing protects the access to the per_cpu variable sd_llc_id. When testing +the same CPU (i.e. this_cpu == that_cpu), a race condition exists with +update_top_cache_domain(). One scenario being: + + CPU1 CPU2 + ================================================================== + + per_cpu(sd_llc_id, CPUX) => 0 + partition_sched_domains_locked() + detach_destroy_domains() + cpus_share_cache(CPUX, CPUX) update_top_cache_domain(CPUX) + per_cpu(sd_llc_id, CPUX) => 0 + per_cpu(sd_llc_id, CPUX) = CPUX + per_cpu(sd_llc_id, CPUX) => CPUX + return false + +ttwu_queue_cond() wouldn't catch smp_processor_id() == cpu and the result +is a warning triggered from ttwu_queue_wakelist(). + +Avoid a such race in cpus_share_cache() by always returning true when +this_cpu == that_cpu. + +Fixes: 518cd6234178 ("sched: Only queue remote wakeups when crossing cache boundaries") +Reported-by: Jing-Ting Wu +Signed-off-by: Vincent Donnefort +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Valentin Schneider +Reviewed-by: Vincent Guittot +Link: https://lore.kernel.org/r/20211104175120.857087-1-vincent.donnefort@arm.com +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index bc8ff11e60242..e456cce772a3a 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -2650,6 +2650,9 @@ out: + + bool cpus_share_cache(int this_cpu, int that_cpu) + { ++ if (this_cpu == that_cpu) ++ return true; ++ + return per_cpu(sd_llc_id, this_cpu) == per_cpu(sd_llc_id, that_cpu); + } + +-- +2.33.0 + diff --git a/queue-5.10/scsi-advansys-fix-kernel-pointer-leak.patch b/queue-5.10/scsi-advansys-fix-kernel-pointer-leak.patch new file mode 100644 index 00000000000..dc7bf71a5fc --- /dev/null +++ b/queue-5.10/scsi-advansys-fix-kernel-pointer-leak.patch @@ -0,0 +1,40 @@ +From cda3b2bf73f3c6aeca2cff9dab97c0bb426c2322 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Sep 2021 20:25:37 +0800 +Subject: scsi: advansys: Fix kernel pointer leak + +From: Guo Zhi + +[ Upstream commit d4996c6eac4c81b8872043e9391563f67f13e406 ] + +Pointers should be printed with %p or %px rather than cast to 'unsigned +long' and printed with %lx. + +Change %lx to %p to print the hashed pointer. + +Link: https://lore.kernel.org/r/20210929122538.1158235-1-qtxuning1999@sjtu.edu.cn +Signed-off-by: Guo Zhi +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/advansys.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c +index c2c7850ff7b42..727d8f019eddd 100644 +--- a/drivers/scsi/advansys.c ++++ b/drivers/scsi/advansys.c +@@ -3366,8 +3366,8 @@ static void asc_prt_adv_board_info(struct seq_file *m, struct Scsi_Host *shost) + shost->host_no); + + seq_printf(m, +- " iop_base 0x%lx, cable_detect: %X, err_code %u\n", +- (unsigned long)v->iop_base, ++ " iop_base 0x%p, cable_detect: %X, err_code %u\n", ++ v->iop_base, + AdvReadWordRegister(iop_base,IOPW_SCSI_CFG1) & CABLE_DETECT, + v->err_code); + +-- +2.33.0 + diff --git a/queue-5.10/scsi-core-sysfs-fix-hang-when-device-state-is-set-vi.patch b/queue-5.10/scsi-core-sysfs-fix-hang-when-device-state-is-set-vi.patch new file mode 100644 index 00000000000..8e9a9a0c5d2 --- /dev/null +++ b/queue-5.10/scsi-core-sysfs-fix-hang-when-device-state-is-set-vi.patch @@ -0,0 +1,102 @@ +From 4c73a72a0d54be9a963c3d0c47339c4ad72b187b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Nov 2021 17:10:48 -0500 +Subject: scsi: core: sysfs: Fix hang when device state is set via sysfs + +From: Mike Christie + +[ Upstream commit 4edd8cd4e86dd3047e5294bbefcc0a08f66a430f ] + +This fixes a regression added with: + +commit f0f82e2476f6 ("scsi: core: Fix capacity set to zero after +offlinining device") + +The problem is that after iSCSI recovery, iscsid will call into the kernel +to set the dev's state to running, and with that patch we now call +scsi_rescan_device() with the state_mutex held. If the SCSI error handler +thread is just starting to test the device in scsi_send_eh_cmnd() then it's +going to try to grab the state_mutex. + +We are then stuck, because when scsi_rescan_device() tries to send its I/O +scsi_queue_rq() calls -> scsi_host_queue_ready() -> scsi_host_in_recovery() +which will return true (the host state is still in recovery) and I/O will +just be requeued. scsi_send_eh_cmnd() will then never be able to grab the +state_mutex to finish error handling. + +To prevent the deadlock move the rescan-related code to after we drop the +state_mutex. + +This also adds a check for if we are already in the running state. This +prevents extra scans and helps the iscsid case where if the transport class +has already onlined the device during its recovery process then we don't +need userspace to do it again plus possibly block that daemon. + +Link: https://lore.kernel.org/r/20211105221048.6541-3-michael.christie@oracle.com +Fixes: f0f82e2476f6 ("scsi: core: Fix capacity set to zero after offlinining device") +Cc: Bart Van Assche +Cc: lijinlin +Cc: Wu Bo +Reviewed-by: Lee Duncan +Reviewed-by: Wu Bo +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_sysfs.c | 30 +++++++++++++++++++----------- + 1 file changed, 19 insertions(+), 11 deletions(-) + +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index 1378bb1a7371c..8de67679a8782 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -796,6 +796,7 @@ store_state_field(struct device *dev, struct device_attribute *attr, + int i, ret; + struct scsi_device *sdev = to_scsi_device(dev); + enum scsi_device_state state = 0; ++ bool rescan_dev = false; + + for (i = 0; i < ARRAY_SIZE(sdev_states); i++) { + const int len = strlen(sdev_states[i].name); +@@ -814,20 +815,27 @@ store_state_field(struct device *dev, struct device_attribute *attr, + } + + mutex_lock(&sdev->state_mutex); +- ret = scsi_device_set_state(sdev, state); +- /* +- * If the device state changes to SDEV_RUNNING, we need to +- * run the queue to avoid I/O hang, and rescan the device +- * to revalidate it. Running the queue first is necessary +- * because another thread may be waiting inside +- * blk_mq_freeze_queue_wait() and because that call may be +- * waiting for pending I/O to finish. +- */ +- if (ret == 0 && state == SDEV_RUNNING) { ++ if (sdev->sdev_state == SDEV_RUNNING && state == SDEV_RUNNING) { ++ ret = count; ++ } else { ++ ret = scsi_device_set_state(sdev, state); ++ if (ret == 0 && state == SDEV_RUNNING) ++ rescan_dev = true; ++ } ++ mutex_unlock(&sdev->state_mutex); ++ ++ if (rescan_dev) { ++ /* ++ * If the device state changes to SDEV_RUNNING, we need to ++ * run the queue to avoid I/O hang, and rescan the device ++ * to revalidate it. Running the queue first is necessary ++ * because another thread may be waiting inside ++ * blk_mq_freeze_queue_wait() and because that call may be ++ * waiting for pending I/O to finish. ++ */ + blk_mq_run_hw_queues(sdev->request_queue, true); + scsi_rescan_device(dev); + } +- mutex_unlock(&sdev->state_mutex); + + return ret == 0 ? count : -EINVAL; + } +-- +2.33.0 + diff --git a/queue-5.10/scsi-lpfc-fix-list_add-corruption-in-lpfc_drain_txq.patch b/queue-5.10/scsi-lpfc-fix-list_add-corruption-in-lpfc_drain_txq.patch new file mode 100644 index 00000000000..7ca99388345 --- /dev/null +++ b/queue-5.10/scsi-lpfc-fix-list_add-corruption-in-lpfc_drain_txq.patch @@ -0,0 +1,48 @@ +From d0ecd472690295dab42df4f1b2c143137ff9d4e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Sep 2021 16:31:46 -0700 +Subject: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() + +From: James Smart + +[ Upstream commit 99154581b05c8fb22607afb7c3d66c1bace6aa5d ] + +When parsing the txq list in lpfc_drain_txq(), the driver attempts to pass +the requests to the adapter. If such an attempt fails, a local "fail_msg" +string is set and a log message output. The job is then added to a +completions list for cancellation. + +Processing of any further jobs from the txq list continues, but since +"fail_msg" remains set, jobs are added to the completions list regardless +of whether a wqe was passed to the adapter. If successfully added to +txcmplq, jobs are added to both lists resulting in list corruption. + +Fix by clearing the fail_msg string after adding a job to the completions +list. This stops the subsequent jobs from being added to the completions +list unless they had an appropriate failure. + +Link: https://lore.kernel.org/r/20210910233159.115896-2-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_sli.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 990b700de6892..06a23718a7c7f 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -20080,6 +20080,7 @@ lpfc_drain_txq(struct lpfc_hba *phba) + fail_msg, + piocbq->iotag, piocbq->sli4_xritag); + list_add_tail(&piocbq->list, &completions); ++ fail_msg = NULL; + } + spin_unlock_irqrestore(&pring->ring_lock, iflags); + } +-- +2.33.0 + diff --git a/queue-5.10/scsi-scsi_debug-fix-out-of-bound-read-in-resp_readca.patch b/queue-5.10/scsi-scsi_debug-fix-out-of-bound-read-in-resp_readca.patch new file mode 100644 index 00000000000..e5037e6f7fe --- /dev/null +++ b/queue-5.10/scsi-scsi_debug-fix-out-of-bound-read-in-resp_readca.patch @@ -0,0 +1,89 @@ +From 696246abb3fa255bf1eaf79596ea3f2ab652d68c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Oct 2021 11:39:12 +0800 +Subject: scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() + +From: Ye Bin + +[ Upstream commit 4e3ace0051e7e504b55d239daab8789dd89b863c ] + +The following warning was observed running syzkaller: + +[ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in; +[ 3813.830724] program syz-executor not setting count and/or reply_len properly +[ 3813.836956] ================================================================== +[ 3813.839465] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x157/0x1e0 +[ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549 +[ 3813.846612] Call Trace: +[ 3813.846995] dump_stack+0x108/0x15f +[ 3813.847524] print_address_description+0xa5/0x372 +[ 3813.848243] kasan_report.cold+0x236/0x2a8 +[ 3813.849439] check_memory_region+0x240/0x270 +[ 3813.850094] memcpy+0x30/0x80 +[ 3813.850553] sg_copy_buffer+0x157/0x1e0 +[ 3813.853032] sg_copy_from_buffer+0x13/0x20 +[ 3813.853660] fill_from_dev_buffer+0x135/0x370 +[ 3813.854329] resp_readcap16+0x1ac/0x280 +[ 3813.856917] schedule_resp+0x41f/0x1630 +[ 3813.858203] scsi_debug_queuecommand+0xb32/0x17e0 +[ 3813.862699] scsi_dispatch_cmd+0x330/0x950 +[ 3813.863329] scsi_request_fn+0xd8e/0x1710 +[ 3813.863946] __blk_run_queue+0x10b/0x230 +[ 3813.864544] blk_execute_rq_nowait+0x1d8/0x400 +[ 3813.865220] sg_common_write.isra.0+0xe61/0x2420 +[ 3813.871637] sg_write+0x6c8/0xef0 +[ 3813.878853] __vfs_write+0xe4/0x800 +[ 3813.883487] vfs_write+0x17b/0x530 +[ 3813.884008] ksys_write+0x103/0x270 +[ 3813.886268] __x64_sys_write+0x77/0xc0 +[ 3813.886841] do_syscall_64+0x106/0x360 +[ 3813.887415] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +This issue can be reproduced with the following syzkaller log: + +r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) +r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd/3\x00') +open_by_handle_at(r1, &(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000) +r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40782) +write$binfmt_aout(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="00000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d"], 0x126) + +In resp_readcap16() we get "int alloc_len" value -1104926854, and then pass +the huge arr_len to fill_from_dev_buffer(), but arr is only 32 bytes. This +leads to OOB in sg_copy_buffer(). + +To solve this issue, define alloc_len as u32. + +Link: https://lore.kernel.org/r/20211013033913.2551004-2-yebin10@huawei.com +Acked-by: Douglas Gilbert +Signed-off-by: Ye Bin +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_debug.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c +index b6540b92f5661..63504dc63d878 100644 +--- a/drivers/scsi/scsi_debug.c ++++ b/drivers/scsi/scsi_debug.c +@@ -1855,7 +1855,7 @@ static int resp_readcap16(struct scsi_cmnd *scp, + { + unsigned char *cmd = scp->cmnd; + unsigned char arr[SDEBUG_READCAP16_ARR_SZ]; +- int alloc_len; ++ u32 alloc_len; + + alloc_len = get_unaligned_be32(cmd + 10); + /* following just in case virtual_gb changed */ +@@ -1884,7 +1884,7 @@ static int resp_readcap16(struct scsi_cmnd *scp, + } + + return fill_from_dev_buffer(scp, arr, +- min_t(int, alloc_len, SDEBUG_READCAP16_ARR_SZ)); ++ min_t(u32, alloc_len, SDEBUG_READCAP16_ARR_SZ)); + } + + #define SDEBUG_MAX_TGTPGS_ARR_SZ 1412 +-- +2.33.0 + diff --git a/queue-5.10/scsi-scsi_debug-fix-out-of-bound-read-in-resp_report.patch b/queue-5.10/scsi-scsi_debug-fix-out-of-bound-read-in-resp_report.patch new file mode 100644 index 00000000000..1ab4a4ec718 --- /dev/null +++ b/queue-5.10/scsi-scsi_debug-fix-out-of-bound-read-in-resp_report.patch @@ -0,0 +1,89 @@ +From 9768811ac12d6c15dd3656daeb928d54ef2bb6fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Oct 2021 11:39:13 +0800 +Subject: scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() + +From: Ye Bin + +[ Upstream commit f347c26836c270199de1599c3cd466bb7747caa9 ] + +The following issue was observed running syzkaller: + +BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:377 [inline] +BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 +Read of size 2132 at addr ffff8880aea95dc8 by task syz-executor.0/9815 + +CPU: 0 PID: 9815 Comm: syz-executor.0 Not tainted 4.19.202-00874-gfc0fe04215a9 #2 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 +Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0xe4/0x14a lib/dump_stack.c:118 + print_address_description+0x73/0x280 mm/kasan/report.c:253 + kasan_report_error mm/kasan/report.c:352 [inline] + kasan_report+0x272/0x370 mm/kasan/report.c:410 + memcpy+0x1f/0x50 mm/kasan/kasan.c:302 + memcpy include/linux/string.h:377 [inline] + sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 + fill_from_dev_buffer+0x14f/0x340 drivers/scsi/scsi_debug.c:1021 + resp_report_tgtpgs+0x5aa/0x770 drivers/scsi/scsi_debug.c:1772 + schedule_resp+0x464/0x12f0 drivers/scsi/scsi_debug.c:4429 + scsi_debug_queuecommand+0x467/0x1390 drivers/scsi/scsi_debug.c:5835 + scsi_dispatch_cmd+0x3fc/0x9b0 drivers/scsi/scsi_lib.c:1896 + scsi_request_fn+0x1042/0x1810 drivers/scsi/scsi_lib.c:2034 + __blk_run_queue_uncond block/blk-core.c:464 [inline] + __blk_run_queue+0x1a4/0x380 block/blk-core.c:484 + blk_execute_rq_nowait+0x1c2/0x2d0 block/blk-exec.c:78 + sg_common_write.isra.19+0xd74/0x1dc0 drivers/scsi/sg.c:847 + sg_write.part.23+0x6e0/0xd00 drivers/scsi/sg.c:716 + sg_write+0x64/0xa0 drivers/scsi/sg.c:622 + __vfs_write+0xed/0x690 fs/read_write.c:485 +kill_bdev:block_device:00000000e138492c + vfs_write+0x184/0x4c0 fs/read_write.c:549 + ksys_write+0x107/0x240 fs/read_write.c:599 + do_syscall_64+0xc2/0x560 arch/x86/entry/common.c:293 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +We get 'alen' from command its type is int. If userspace passes a large +length we will get a negative 'alen'. + +Switch n, alen, and rlen to u32. + +Link: https://lore.kernel.org/r/20211013033913.2551004-3-yebin10@huawei.com +Acked-by: Douglas Gilbert +Signed-off-by: Ye Bin +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_debug.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c +index 63504dc63d878..3fc7c2a31c191 100644 +--- a/drivers/scsi/scsi_debug.c ++++ b/drivers/scsi/scsi_debug.c +@@ -1895,8 +1895,9 @@ static int resp_report_tgtpgs(struct scsi_cmnd *scp, + unsigned char *cmd = scp->cmnd; + unsigned char *arr; + int host_no = devip->sdbg_host->shost->host_no; +- int n, ret, alen, rlen; + int port_group_a, port_group_b, port_a, port_b; ++ u32 alen, n, rlen; ++ int ret; + + alen = get_unaligned_be32(cmd + 6); + arr = kzalloc(SDEBUG_MAX_TGTPGS_ARR_SZ, GFP_ATOMIC); +@@ -1958,9 +1959,9 @@ static int resp_report_tgtpgs(struct scsi_cmnd *scp, + * - The constructed command length + * - The maximum array size + */ +- rlen = min_t(int, alen, n); ++ rlen = min(alen, n); + ret = fill_from_dev_buffer(scp, arr, +- min_t(int, rlen, SDEBUG_MAX_TGTPGS_ARR_SZ)); ++ min_t(u32, rlen, SDEBUG_MAX_TGTPGS_ARR_SZ)); + kfree(arr); + return ret; + } +-- +2.33.0 + diff --git a/queue-5.10/scsi-target-fix-alua_tg_pt_gps_count-tracking.patch b/queue-5.10/scsi-target-fix-alua_tg_pt_gps_count-tracking.patch new file mode 100644 index 00000000000..08da0ceec03 --- /dev/null +++ b/queue-5.10/scsi-target-fix-alua_tg_pt_gps_count-tracking.patch @@ -0,0 +1,45 @@ +From 55d936476a14dddaa96ad0c46a74e7ca568d3ca6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Sep 2021 21:04:20 -0500 +Subject: scsi: target: Fix alua_tg_pt_gps_count tracking + +From: Mike Christie + +[ Upstream commit 1283c0d1a32bb924324481586b5d6e8e76f676ba ] + +We can't free the tg_pt_gp in core_alua_set_tg_pt_gp_id() because it's +still accessed via configfs. Its release must go through the normal +configfs/refcount process. + +The max alua_tg_pt_gps_count check should probably have been done in +core_alua_allocate_tg_pt_gp(), but with the current code userspace could +have created 0x0000ffff + 1 groups, but only set the id for 0x0000ffff. +Then it could have deleted a group with an ID set, and then set the ID for +that extra group and it would work ok. + +It's unlikely, but just in case this patch continues to allow that type of +behavior, and just fixes the kfree() while in use bug. + +Link: https://lore.kernel.org/r/20210930020422.92578-4-michael.christie@oracle.com +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_alua.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c +index 6b72afee2f8b7..b240bd1ccb71d 100644 +--- a/drivers/target/target_core_alua.c ++++ b/drivers/target/target_core_alua.c +@@ -1702,7 +1702,6 @@ int core_alua_set_tg_pt_gp_id( + pr_err("Maximum ALUA alua_tg_pt_gps_count:" + " 0x0000ffff reached\n"); + spin_unlock(&dev->t10_alua.tg_pt_gps_lock); +- kmem_cache_free(t10_alua_tg_pt_gp_cache, tg_pt_gp); + return -ENOSPC; + } + again: +-- +2.33.0 + diff --git a/queue-5.10/scsi-target-fix-ordered-tag-handling.patch b/queue-5.10/scsi-target-fix-ordered-tag-handling.patch new file mode 100644 index 00000000000..ff3bccb48ae --- /dev/null +++ b/queue-5.10/scsi-target-fix-ordered-tag-handling.patch @@ -0,0 +1,266 @@ +From f6f86340061aec91044af0756fd4d8e052240b6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Sep 2021 21:04:19 -0500 +Subject: scsi: target: Fix ordered tag handling + +From: Mike Christie + +[ Upstream commit ed1227e080990ffec5bf39006ec8a57358e6689a ] + +This patch fixes the following bugs: + +1. If there are multiple ordered cmds queued and multiple simple cmds + completing, target_restart_delayed_cmds() could be called on different + CPUs and each instance could start a ordered cmd. They could then run in + different orders than they were queued. + +2. target_restart_delayed_cmds() and target_handle_task_attr() can race + where: + + 1. target_handle_task_attr() has passed the simple_cmds == 0 check. + + 2. transport_complete_task_attr() then decrements simple_cmds to 0. + + 3. transport_complete_task_attr() runs target_restart_delayed_cmds() and + it does not see any cmds on the delayed_cmd_list. + + 4. target_handle_task_attr() adds the cmd to the delayed_cmd_list. + + The cmd will then end up timing out. + +3. If we are sent > 1 ordered cmds and simple_cmds == 0, we can execute + them out of order, because target_handle_task_attr() will hit that + simple_cmds check first and return false for all ordered cmds sent. + +4. We run target_restart_delayed_cmds() after every cmd completion, so if + there is more than 1 simple cmd running, we start executing ordered cmds + after that first cmd instead of waiting for all of them to complete. + +5. Ordered cmds are not supposed to start until HEAD OF QUEUE and all older + cmds have completed, and not just simple. + +6. It's not a bug but it doesn't make sense to take the delayed_cmd_lock + for every cmd completion when ordered cmds are almost never used. Just + replacing that lock with an atomic increases IOPs by up to 10% when + completions are spread over multiple CPUs and there are multiple + sessions/ mqs/thread accessing the same device. + +This patch moves the queued delayed handling to a per device work to +serialze the cmd executions for each device and adds a new counter to track +HEAD_OF_QUEUE and SIMPLE cmds. We can then check the new counter to +determine when to run the work on the completion path. + +Link: https://lore.kernel.org/r/20210930020422.92578-3-michael.christie@oracle.com +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_device.c | 2 + + drivers/target/target_core_internal.h | 1 + + drivers/target/target_core_transport.c | 76 ++++++++++++++++++-------- + include/target/target_core_base.h | 6 +- + 4 files changed, 61 insertions(+), 24 deletions(-) + +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c +index 405d82d447176..109f019d21480 100644 +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -758,6 +758,8 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name) + INIT_LIST_HEAD(&dev->t10_alua.lba_map_list); + spin_lock_init(&dev->t10_alua.lba_map_lock); + ++ INIT_WORK(&dev->delayed_cmd_work, target_do_delayed_work); ++ + dev->t10_wwn.t10_dev = dev; + dev->t10_alua.t10_dev = dev; + +diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h +index e7b3c6e5d5744..e4f072a680d41 100644 +--- a/drivers/target/target_core_internal.h ++++ b/drivers/target/target_core_internal.h +@@ -150,6 +150,7 @@ int transport_dump_vpd_ident(struct t10_vpd *, unsigned char *, int); + void transport_clear_lun_ref(struct se_lun *); + sense_reason_t target_cmd_size_check(struct se_cmd *cmd, unsigned int size); + void target_qf_do_work(struct work_struct *work); ++void target_do_delayed_work(struct work_struct *work); + bool target_check_wce(struct se_device *dev); + bool target_check_fua(struct se_device *dev); + void __target_execute_cmd(struct se_cmd *, bool); +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 61b79804d462c..bca3a32a4bfb7 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -2065,32 +2065,35 @@ static bool target_handle_task_attr(struct se_cmd *cmd) + */ + switch (cmd->sam_task_attr) { + case TCM_HEAD_TAG: ++ atomic_inc_mb(&dev->non_ordered); + pr_debug("Added HEAD_OF_QUEUE for CDB: 0x%02x\n", + cmd->t_task_cdb[0]); + return false; + case TCM_ORDERED_TAG: +- atomic_inc_mb(&dev->dev_ordered_sync); ++ atomic_inc_mb(&dev->delayed_cmd_count); + + pr_debug("Added ORDERED for CDB: 0x%02x to ordered list\n", + cmd->t_task_cdb[0]); +- +- /* +- * Execute an ORDERED command if no other older commands +- * exist that need to be completed first. +- */ +- if (!atomic_read(&dev->simple_cmds)) +- return false; + break; + default: + /* + * For SIMPLE and UNTAGGED Task Attribute commands + */ +- atomic_inc_mb(&dev->simple_cmds); ++ atomic_inc_mb(&dev->non_ordered); ++ ++ if (atomic_read(&dev->delayed_cmd_count) == 0) ++ return false; + break; + } + +- if (atomic_read(&dev->dev_ordered_sync) == 0) +- return false; ++ if (cmd->sam_task_attr != TCM_ORDERED_TAG) { ++ atomic_inc_mb(&dev->delayed_cmd_count); ++ /* ++ * We will account for this when we dequeue from the delayed ++ * list. ++ */ ++ atomic_dec_mb(&dev->non_ordered); ++ } + + spin_lock(&dev->delayed_cmd_lock); + list_add_tail(&cmd->se_delayed_node, &dev->delayed_cmd_list); +@@ -2098,6 +2101,12 @@ static bool target_handle_task_attr(struct se_cmd *cmd) + + pr_debug("Added CDB: 0x%02x Task Attr: 0x%02x to delayed CMD listn", + cmd->t_task_cdb[0], cmd->sam_task_attr); ++ /* ++ * We may have no non ordered cmds when this function started or we ++ * could have raced with the last simple/head cmd completing, so kick ++ * the delayed handler here. ++ */ ++ schedule_work(&dev->delayed_cmd_work); + return true; + } + +@@ -2135,29 +2144,48 @@ EXPORT_SYMBOL(target_execute_cmd); + * Process all commands up to the last received ORDERED task attribute which + * requires another blocking boundary + */ +-static void target_restart_delayed_cmds(struct se_device *dev) ++void target_do_delayed_work(struct work_struct *work) + { +- for (;;) { ++ struct se_device *dev = container_of(work, struct se_device, ++ delayed_cmd_work); ++ ++ spin_lock(&dev->delayed_cmd_lock); ++ while (!dev->ordered_sync_in_progress) { + struct se_cmd *cmd; + +- spin_lock(&dev->delayed_cmd_lock); +- if (list_empty(&dev->delayed_cmd_list)) { +- spin_unlock(&dev->delayed_cmd_lock); ++ if (list_empty(&dev->delayed_cmd_list)) + break; +- } + + cmd = list_entry(dev->delayed_cmd_list.next, + struct se_cmd, se_delayed_node); ++ ++ if (cmd->sam_task_attr == TCM_ORDERED_TAG) { ++ /* ++ * Check if we started with: ++ * [ordered] [simple] [ordered] ++ * and we are now at the last ordered so we have to wait ++ * for the simple cmd. ++ */ ++ if (atomic_read(&dev->non_ordered) > 0) ++ break; ++ ++ dev->ordered_sync_in_progress = true; ++ } ++ + list_del(&cmd->se_delayed_node); ++ atomic_dec_mb(&dev->delayed_cmd_count); + spin_unlock(&dev->delayed_cmd_lock); + ++ if (cmd->sam_task_attr != TCM_ORDERED_TAG) ++ atomic_inc_mb(&dev->non_ordered); ++ + cmd->transport_state |= CMD_T_SENT; + + __target_execute_cmd(cmd, true); + +- if (cmd->sam_task_attr == TCM_ORDERED_TAG) +- break; ++ spin_lock(&dev->delayed_cmd_lock); + } ++ spin_unlock(&dev->delayed_cmd_lock); + } + + /* +@@ -2175,14 +2203,17 @@ static void transport_complete_task_attr(struct se_cmd *cmd) + goto restart; + + if (cmd->sam_task_attr == TCM_SIMPLE_TAG) { +- atomic_dec_mb(&dev->simple_cmds); ++ atomic_dec_mb(&dev->non_ordered); + dev->dev_cur_ordered_id++; + } else if (cmd->sam_task_attr == TCM_HEAD_TAG) { ++ atomic_dec_mb(&dev->non_ordered); + dev->dev_cur_ordered_id++; + pr_debug("Incremented dev_cur_ordered_id: %u for HEAD_OF_QUEUE\n", + dev->dev_cur_ordered_id); + } else if (cmd->sam_task_attr == TCM_ORDERED_TAG) { +- atomic_dec_mb(&dev->dev_ordered_sync); ++ spin_lock(&dev->delayed_cmd_lock); ++ dev->ordered_sync_in_progress = false; ++ spin_unlock(&dev->delayed_cmd_lock); + + dev->dev_cur_ordered_id++; + pr_debug("Incremented dev_cur_ordered_id: %u for ORDERED\n", +@@ -2191,7 +2222,8 @@ static void transport_complete_task_attr(struct se_cmd *cmd) + cmd->se_cmd_flags &= ~SCF_TASK_ATTR_SET; + + restart: +- target_restart_delayed_cmds(dev); ++ if (atomic_read(&dev->delayed_cmd_count) > 0) ++ schedule_work(&dev->delayed_cmd_work); + } + + static void transport_complete_qf(struct se_cmd *cmd) +diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h +index 549947d407cfd..18a5dcd275f88 100644 +--- a/include/target/target_core_base.h ++++ b/include/target/target_core_base.h +@@ -788,8 +788,9 @@ struct se_device { + atomic_long_t read_bytes; + atomic_long_t write_bytes; + /* Active commands on this virtual SE device */ +- atomic_t simple_cmds; +- atomic_t dev_ordered_sync; ++ atomic_t non_ordered; ++ bool ordered_sync_in_progress; ++ atomic_t delayed_cmd_count; + atomic_t dev_qf_count; + u32 export_count; + spinlock_t delayed_cmd_lock; +@@ -811,6 +812,7 @@ struct se_device { + struct list_head dev_sep_list; + struct list_head dev_tmr_list; + struct work_struct qf_work_queue; ++ struct work_struct delayed_cmd_work; + struct list_head delayed_cmd_list; + struct list_head state_list; + struct list_head qf_cmd_list; +-- +2.33.0 + diff --git a/queue-5.10/series b/queue-5.10/series new file mode 100644 index 00000000000..14826f795be --- /dev/null +++ b/queue-5.10/series @@ -0,0 +1,114 @@ +arm64-zynqmp-do-not-duplicate-flash-partition-label-.patch +arm64-zynqmp-fix-serial-compatible-string.patch +arm-dts-sunxi-fix-opps-node-name.patch +arm64-dts-allwinner-h5-fix-gpu-thermal-zone-node-nam.patch +arm64-dts-allwinner-a100-fix-thermal-zone-node-name.patch +staging-wfx-ensure-irq-is-ready-before-enabling-it.patch +arm-dts-nsp-fix-mpcore-mmc-node-names.patch +scsi-lpfc-fix-list_add-corruption-in-lpfc_drain_txq.patch +arm64-dts-rockchip-disable-cdn-dp-on-pinebook-pro.patch +arm64-dts-hisilicon-fix-arm-sp805-compatible-string.patch +rdma-bnxt_re-check-if-the-vlan-is-valid-before-repor.patch +bus-ti-sysc-add-quirk-handling-for-reinit-on-context.patch +bus-ti-sysc-use-context-lost-quirk-for-otg.patch +usb-musb-tusb6010-check-return-value-after-calling-p.patch +usb-typec-tipd-remove-warn_on-in-tps6598x_block_read.patch +arm-dts-ux500-skomer-regulator-fixes.patch +staging-rtl8723bs-remove-possible-deadlock-when-disc.patch +arm-bcm53016-specify-switch-ports-for-meraki-mr32.patch +arm64-dts-qcom-msm8998-fix-cpu-l2-idle-state-latency.patch +arm64-dts-qcom-ipq6018-fix-qcom-controlled-remotely-.patch +arm64-dts-qcom-msm8916-add-unit-name-for-soc-node.patch +arm64-dts-freescale-fix-arm-sp805-compatible-string.patch +asoc-sof-intel-hda-dai-fix-potential-locking-issue.patch +clk-imx-imx6ul-move-csi_sel-mux-to-correct-base-regi.patch +asoc-nau8824-add-dmi-quirk-mechanism-for-active-high.patch +scsi-advansys-fix-kernel-pointer-leak.patch +alsa-intel-dsp-config-add-quirk-for-apl-glk-tgl-devi.patch +asoc-intel-sof_sdw-add-missing-quirk-for-dell-sku-0a.patch +firmware_loader-fix-pre-allocated-buf-built-in-firmw.patch +cpuidle-tegra-check-whether-pmc-is-ready.patch +arm-dts-omap-fix-gpmc-mux-add-data-type.patch +usb-host-ohci-tmio-check-return-value-after-calling-.patch +arm-dts-ls1021a-move-thermal-zones-node-out-of-soc.patch +arm-dts-ls1021a-tsn-use-generic-jedec-spi-nor-compat.patch +alsa-isa-not-for-m68k.patch +tty-tty_buffer-fix-the-softlockup-issue-in-flush_to_.patch +mips-sni-fix-the-build.patch +scsi-scsi_debug-fix-out-of-bound-read-in-resp_readca.patch +scsi-scsi_debug-fix-out-of-bound-read-in-resp_report.patch +scsi-target-fix-ordered-tag-handling.patch +scsi-target-fix-alua_tg_pt_gps_count-tracking.patch +iio-imu-st_lsm6dsx-avoid-potential-array-overflow-in.patch +powerpc-5200-dts-fix-memory-node-unit-name.patch +arm64-dts-qcom-msm8916-add-cpu-acc-and-saw-spm.patch +arm-dts-qcom-fix-memory-and-mdio-nodes-naming-for-rb.patch +alsa-gus-fix-null-pointer-dereference-on-pointer-blo.patch +powerpc-dcr-use-cmplwi-instead-of-3-argument-cmpli.patch +powerpc-8xx-fix-oops-with-strict_kernel_rwx-without-.patch +sh-check-return-code-of-request_irq.patch +maple-fix-wrong-return-value-of-maple_bus_init.patch +f2fs-fix-up-f2fs_lookup-tracepoints.patch +f2fs-fix-to-use-whint_mode.patch +sh-fix-kconfig-unmet-dependency-warning-for-frame_po.patch +sh-math-emu-drop-unused-functions.patch +sh-define-__big_endian-for-math-emu.patch +f2fs-compress-disallow-disabling-compress-on-non-emp.patch +f2fs-fix-incorrect-return-value-in-f2fs_sanity_check.patch +clk-ingenic-fix-bugs-with-divided-dividers.patch +clk-ast2600-fix-soc-revision-for-ahb.patch +clk-qcom-gcc-msm8996-drop-again-gcc_aggre1_pnoc_ahb_.patch +mips-bcm63xx-ensure-that-cpu_supports_32bit_kernel-i.patch +sched-core-mitigate-race-cpus_share_cache-update_top.patch +perf-x86-vlbr-add-c-flags-to-vlbr-event-constraints.patch +blkcg-remove-extra-blkcg_bio_issue_init.patch +tracing-histogram-do-not-copy-the-fixed-size-char-ar.patch +perf-bpf-avoid-memory-leak-from-perf_env__insert_btf.patch +perf-bench-futex-fix-memory-leak-of-perf_cpu_map__ne.patch +perf-tests-remove-bash-construct-from-record-zstd_co.patch +drm-nouveau-hdmigv100.c-fix-corrupted-hdmi-vendor-in.patch +net-zerocopy-copy-straggler-unaligned-data-for-tcp-r.patch +net-zerocopy-refactor-skb-frag-fast-forward-op.patch +tcp-fix-uninitialized-access-in-skb-frags-array-for-.patch +tracing-add-length-protection-to-histogram-string-co.patch +net-ipa-holb-register-sometimes-must-be-written-twic.patch +net-ipa-disable-holb-drop-when-updating-timer.patch +net-bnx2x-fix-variable-dereferenced-before-check.patch +bnxt_en-reject-indirect-blk-offload-when-hw-tc-offlo.patch +tipc-only-accept-encrypted-msg_crypto-msgs.patch +net-reduce-indentation-level-in-sk_clone_lock.patch +sock-fix-proc-net-sockstat-underflow-in-sk_clone_loc.patch +net-smc-make-sure-the-link_id-is-unique.patch +iavf-fix-return-of-set-the-new-channel-count.patch +iavf-check-for-null-in-iavf_fix_features.patch +iavf-free-q_vectors-before-queues-in-iavf_disable_vf.patch +iavf-fix-failure-to-exit-out-from-last-all-multicast.patch +iavf-prevent-accidental-free-of-filter-structure.patch +iavf-validate-pointers.patch +iavf-fix-for-the-false-positive-asq-arq-errors-while.patch +iavf-fix-for-setting-queues-to-0.patch +mips-generic-yamon-dt-fix-uninitialized-variable-err.patch +mips-bcm63xx-add-support-for-clk_get_parent.patch +mips-lantiq-add-support-for-clk_get_parent.patch +platform-x86-hp_accel-fix-an-error-handling-path-in-.patch +net-mlx5e-nullify-cq-dbg-pointer-in-mlx5_debug_cq_re.patch +net-mlx5-lag-update-tracker-when-state-change-event-.patch +net-mlx5-e-switch-change-mode-lock-from-mutex-to-rw-.patch +net-mlx5-e-switch-return-error-if-encap-isn-t-suppor.patch +scsi-core-sysfs-fix-hang-when-device-state-is-set-vi.patch +net-sched-act_mirred-drop-dst-for-the-direction-from.patch +net-dpaa2-eth-fix-use-after-free-in-dpaa2_eth_remove.patch +net-virtio_net_hdr_to_skb-count-transport-header-in-.patch +i40e-fix-correct-max_pkt_size-on-vf-rx-queue.patch +i40e-fix-null-ptr-dereference-on-vsi-filter-sync.patch +i40e-fix-changing-previously-set-num_queue_pairs-for.patch +i40e-fix-ping-is-lost-after-configuring-adq-on-vf.patch +i40e-fix-warning-message-and-call-stack-during-rmmod.patch +i40e-fix-creation-of-first-queue-by-omitting-it-if-i.patch +i40e-fix-display-error-code-in-dmesg.patch +nfc-reorganize-the-functions-in-nci_request.patch +nfc-reorder-the-logic-in-nfc_-un-register_device.patch +net-nfc-nci-change-the-nci-close-sequence.patch +nfc-add-nci_unreg-flag-to-eliminate-the-race.patch +e100-fix-device-suspend-resume.patch +perf-bench-fix-two-memory-leaks-detected-with-asan.patch diff --git a/queue-5.10/sh-check-return-code-of-request_irq.patch b/queue-5.10/sh-check-return-code-of-request_irq.patch new file mode 100644 index 00000000000..e608d6318ef --- /dev/null +++ b/queue-5.10/sh-check-return-code-of-request_irq.patch @@ -0,0 +1,45 @@ +From 4edb1a7f9af4b94d9130f9114ee44c98577de654 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Dec 2020 12:54:01 -0800 +Subject: sh: check return code of request_irq + +From: Nick Desaulniers + +[ Upstream commit 0e38225c92c7964482a8bb6b3e37fde4319e965c ] + +request_irq is marked __must_check, but the call in shx3_prepare_cpus +has a void return type, so it can't propagate failure to the caller. +Follow cues from hexagon and just print an error. + +Fixes: c7936b9abcf5 ("sh: smp: Hook in to the generic IPI handler for SH-X3 SMP.") +Cc: Miguel Ojeda +Cc: Paul Mundt +Reported-by: Guenter Roeck +Signed-off-by: Nick Desaulniers +Tested-by: John Paul Adrian Glaubitz +Reviewed-by: Miguel Ojeda +Signed-off-by: Rich Felker +Signed-off-by: Sasha Levin +--- + arch/sh/kernel/cpu/sh4a/smp-shx3.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/sh/kernel/cpu/sh4a/smp-shx3.c b/arch/sh/kernel/cpu/sh4a/smp-shx3.c +index f8a2bec0f260b..1261dc7b84e8b 100644 +--- a/arch/sh/kernel/cpu/sh4a/smp-shx3.c ++++ b/arch/sh/kernel/cpu/sh4a/smp-shx3.c +@@ -73,8 +73,9 @@ static void shx3_prepare_cpus(unsigned int max_cpus) + BUILD_BUG_ON(SMP_MSG_NR >= 8); + + for (i = 0; i < SMP_MSG_NR; i++) +- request_irq(104 + i, ipi_interrupt_handler, +- IRQF_PERCPU, "IPI", (void *)(long)i); ++ if (request_irq(104 + i, ipi_interrupt_handler, ++ IRQF_PERCPU, "IPI", (void *)(long)i)) ++ pr_err("Failed to request irq %d\n", i); + + for (i = 0; i < max_cpus; i++) + set_cpu_present(i, true); +-- +2.33.0 + diff --git a/queue-5.10/sh-define-__big_endian-for-math-emu.patch b/queue-5.10/sh-define-__big_endian-for-math-emu.patch new file mode 100644 index 00000000000..d62e8751ed4 --- /dev/null +++ b/queue-5.10/sh-define-__big_endian-for-math-emu.patch @@ -0,0 +1,59 @@ +From a39db208ca5c3c0cd09668de8f11ad1261eb1426 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 17:19:13 -0700 +Subject: sh: define __BIG_ENDIAN for math-emu + +From: Randy Dunlap + +[ Upstream commit b929926f01f2d14635345d22eafcf60feed1085e ] + +Fix this by defining both ENDIAN macros in + so that they can be utilized in + according to the latter's comment: +/* Allow sfp-machine to have its own byte order definitions. */ + +(This is what is done in arch/nds32/include/asm/sfp-machine.h.) + +This placates these build warnings: + +In file included from ../arch/sh/math-emu/math.c:23: +.../include/math-emu/single.h:50:21: warning: "__BIG_ENDIAN" is not defined, evaluates to 0 [-Wundef] + 50 | #if __BYTE_ORDER == __BIG_ENDIAN +In file included from ../arch/sh/math-emu/math.c:24: +.../include/math-emu/double.h:59:21: warning: "__BIG_ENDIAN" is not defined, evaluates to 0 [-Wundef] + 59 | #if __BYTE_ORDER == __BIG_ENDIAN + +Fixes: 4b565680d163 ("sh: math-emu support") +Signed-off-by: Randy Dunlap +Cc: Yoshinori Sato +Cc: John Paul Adrian Glaubitz +Reviewed-by: Geert Uytterhoeven +Tested-by: John Paul Adrian Glaubitz +Signed-off-by: Rich Felker +Signed-off-by: Sasha Levin +--- + arch/sh/include/asm/sfp-machine.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/sh/include/asm/sfp-machine.h b/arch/sh/include/asm/sfp-machine.h +index cbc7cf8c97ce6..2d2423478b71d 100644 +--- a/arch/sh/include/asm/sfp-machine.h ++++ b/arch/sh/include/asm/sfp-machine.h +@@ -13,6 +13,14 @@ + #ifndef _SFP_MACHINE_H + #define _SFP_MACHINE_H + ++#ifdef __BIG_ENDIAN__ ++#define __BYTE_ORDER __BIG_ENDIAN ++#define __LITTLE_ENDIAN 0 ++#else ++#define __BYTE_ORDER __LITTLE_ENDIAN ++#define __BIG_ENDIAN 0 ++#endif ++ + #define _FP_W_TYPE_SIZE 32 + #define _FP_W_TYPE unsigned long + #define _FP_WS_TYPE signed long +-- +2.33.0 + diff --git a/queue-5.10/sh-fix-kconfig-unmet-dependency-warning-for-frame_po.patch b/queue-5.10/sh-fix-kconfig-unmet-dependency-warning-for-frame_po.patch new file mode 100644 index 00000000000..b1466adc532 --- /dev/null +++ b/queue-5.10/sh-fix-kconfig-unmet-dependency-warning-for-frame_po.patch @@ -0,0 +1,47 @@ +From 7359149f5760c0f91f4b1e88efcbdd917c20c66d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 17:19:10 -0700 +Subject: sh: fix kconfig unmet dependency warning for FRAME_POINTER + +From: Randy Dunlap + +[ Upstream commit fda1bc533094a7db68b11e7503d2c6c73993d12a ] + +FRAME_POINTER depends on DEBUG_KERNEL so DWARF_UNWINDER should +depend on DEBUG_KERNEL before selecting FRAME_POINTER. + +WARNING: unmet direct dependencies detected for FRAME_POINTER + Depends on [n]: DEBUG_KERNEL [=n] && (M68K || UML || SUPERH [=y]) || ARCH_WANT_FRAME_POINTERS [=n] + Selected by [y]: + - DWARF_UNWINDER [=y] + +Fixes: bd353861c735 ("sh: dwarf unwinder support.") +Signed-off-by: Randy Dunlap +Cc: Matt Fleming +Cc: Matt Fleming +Cc: Yoshinori Sato +Cc: John Paul Adrian Glaubitz +Cc: Geert Uytterhoeven +Reviewed-by: Geert Uytterhoeven +Tested-by: John Paul Adrian Glaubitz +Signed-off-by: Rich Felker +Signed-off-by: Sasha Levin +--- + arch/sh/Kconfig.debug | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/sh/Kconfig.debug b/arch/sh/Kconfig.debug +index 28a43d63bde1f..97b0e26cf05a1 100644 +--- a/arch/sh/Kconfig.debug ++++ b/arch/sh/Kconfig.debug +@@ -57,6 +57,7 @@ config DUMP_CODE + + config DWARF_UNWINDER + bool "Enable the DWARF unwinder for stacktraces" ++ depends on DEBUG_KERNEL + select FRAME_POINTER + default n + help +-- +2.33.0 + diff --git a/queue-5.10/sh-math-emu-drop-unused-functions.patch b/queue-5.10/sh-math-emu-drop-unused-functions.patch new file mode 100644 index 00000000000..15cead8cb0d --- /dev/null +++ b/queue-5.10/sh-math-emu-drop-unused-functions.patch @@ -0,0 +1,147 @@ +From 851ab5b47351ae607ebf3499e2ac3c072ae197b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 17:19:12 -0700 +Subject: sh: math-emu: drop unused functions + +From: Randy Dunlap + +[ Upstream commit e25c252a9b033523c626f039d4b9a304f12f6775 ] + +Delete ieee_fpe_handler() since it is not used. After that is done, +delete denormal_to_double() since it is not used: + +.../arch/sh/math-emu/math.c:505:12: error: 'ieee_fpe_handler' defined but not used [-Werror=unused-function] + 505 | static int ieee_fpe_handler(struct pt_regs *regs) + +.../arch/sh/math-emu/math.c:477:13: error: 'denormal_to_double' defined but not used [-Werror=unused-function] + 477 | static void denormal_to_double(struct sh_fpu_soft_struct *fpu, int n) + +Fixes: 7caf62de25554da3 ("sh: remove unused do_fpu_error") +Signed-off-by: Randy Dunlap +Cc: Takashi YOSHII +Cc: Yoshinori Sato +Cc: John Paul Adrian Glaubitz +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Rich Felker +Signed-off-by: Sasha Levin +--- + arch/sh/math-emu/math.c | 103 ---------------------------------------- + 1 file changed, 103 deletions(-) + +diff --git a/arch/sh/math-emu/math.c b/arch/sh/math-emu/math.c +index e8be0eca0444a..615ba932c398e 100644 +--- a/arch/sh/math-emu/math.c ++++ b/arch/sh/math-emu/math.c +@@ -467,109 +467,6 @@ static int fpu_emulate(u16 code, struct sh_fpu_soft_struct *fregs, struct pt_reg + return id_sys(fregs, regs, code); + } + +-/** +- * denormal_to_double - Given denormalized float number, +- * store double float +- * +- * @fpu: Pointer to sh_fpu_soft structure +- * @n: Index to FP register +- */ +-static void denormal_to_double(struct sh_fpu_soft_struct *fpu, int n) +-{ +- unsigned long du, dl; +- unsigned long x = fpu->fpul; +- int exp = 1023 - 126; +- +- if (x != 0 && (x & 0x7f800000) == 0) { +- du = (x & 0x80000000); +- while ((x & 0x00800000) == 0) { +- x <<= 1; +- exp--; +- } +- x &= 0x007fffff; +- du |= (exp << 20) | (x >> 3); +- dl = x << 29; +- +- fpu->fp_regs[n] = du; +- fpu->fp_regs[n+1] = dl; +- } +-} +- +-/** +- * ieee_fpe_handler - Handle denormalized number exception +- * +- * @regs: Pointer to register structure +- * +- * Returns 1 when it's handled (should not cause exception). +- */ +-static int ieee_fpe_handler(struct pt_regs *regs) +-{ +- unsigned short insn = *(unsigned short *)regs->pc; +- unsigned short finsn; +- unsigned long nextpc; +- int nib[4] = { +- (insn >> 12) & 0xf, +- (insn >> 8) & 0xf, +- (insn >> 4) & 0xf, +- insn & 0xf}; +- +- if (nib[0] == 0xb || +- (nib[0] == 0x4 && nib[2] == 0x0 && nib[3] == 0xb)) /* bsr & jsr */ +- regs->pr = regs->pc + 4; +- +- if (nib[0] == 0xa || nib[0] == 0xb) { /* bra & bsr */ +- nextpc = regs->pc + 4 + ((short) ((insn & 0xfff) << 4) >> 3); +- finsn = *(unsigned short *) (regs->pc + 2); +- } else if (nib[0] == 0x8 && nib[1] == 0xd) { /* bt/s */ +- if (regs->sr & 1) +- nextpc = regs->pc + 4 + ((char) (insn & 0xff) << 1); +- else +- nextpc = regs->pc + 4; +- finsn = *(unsigned short *) (regs->pc + 2); +- } else if (nib[0] == 0x8 && nib[1] == 0xf) { /* bf/s */ +- if (regs->sr & 1) +- nextpc = regs->pc + 4; +- else +- nextpc = regs->pc + 4 + ((char) (insn & 0xff) << 1); +- finsn = *(unsigned short *) (regs->pc + 2); +- } else if (nib[0] == 0x4 && nib[3] == 0xb && +- (nib[2] == 0x0 || nib[2] == 0x2)) { /* jmp & jsr */ +- nextpc = regs->regs[nib[1]]; +- finsn = *(unsigned short *) (regs->pc + 2); +- } else if (nib[0] == 0x0 && nib[3] == 0x3 && +- (nib[2] == 0x0 || nib[2] == 0x2)) { /* braf & bsrf */ +- nextpc = regs->pc + 4 + regs->regs[nib[1]]; +- finsn = *(unsigned short *) (regs->pc + 2); +- } else if (insn == 0x000b) { /* rts */ +- nextpc = regs->pr; +- finsn = *(unsigned short *) (regs->pc + 2); +- } else { +- nextpc = regs->pc + 2; +- finsn = insn; +- } +- +- if ((finsn & 0xf1ff) == 0xf0ad) { /* fcnvsd */ +- struct task_struct *tsk = current; +- +- if ((tsk->thread.xstate->softfpu.fpscr & (1 << 17))) { +- /* FPU error */ +- denormal_to_double (&tsk->thread.xstate->softfpu, +- (finsn >> 8) & 0xf); +- tsk->thread.xstate->softfpu.fpscr &= +- ~(FPSCR_CAUSE_MASK | FPSCR_FLAG_MASK); +- task_thread_info(tsk)->status |= TS_USEDFPU; +- } else { +- force_sig_fault(SIGFPE, FPE_FLTINV, +- (void __user *)regs->pc); +- } +- +- regs->pc = nextpc; +- return 1; +- } +- +- return 0; +-} +- + /** + * fpu_init - Initialize FPU registers + * @fpu: Pointer to software emulated FPU registers. +-- +2.33.0 + diff --git a/queue-5.10/sock-fix-proc-net-sockstat-underflow-in-sk_clone_loc.patch b/queue-5.10/sock-fix-proc-net-sockstat-underflow-in-sk_clone_loc.patch new file mode 100644 index 00000000000..4a26e1618d4 --- /dev/null +++ b/queue-5.10/sock-fix-proc-net-sockstat-underflow-in-sk_clone_loc.patch @@ -0,0 +1,49 @@ +From eedab7c49531f4be13b9539a77589ab5f0d6f72a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Nov 2021 19:16:56 +0900 +Subject: sock: fix /proc/net/sockstat underflow in sk_clone_lock() + +From: Tetsuo Handa + +[ Upstream commit 938cca9e4109b30ee1d476904538225a825e54eb ] + +sk_clone_lock() needs to call sock_inuse_add(1) before entering the +sk_free_unlock_clone() error path, for __sk_free() from sk_free() from +sk_free_unlock_clone() calls sock_inuse_add(-1). + +Signed-off-by: Tetsuo Handa +Fixes: 648845ab7e200993 ("sock: Move the socket inuse to namespace.") +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/sock.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/core/sock.c b/net/core/sock.c +index 3da4cd632ba8e..6d9af4ef93d7a 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -1896,8 +1896,10 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) + newsk->sk_prot_creator = prot; + + /* SANITY */ +- if (likely(newsk->sk_net_refcnt)) ++ if (likely(newsk->sk_net_refcnt)) { + get_net(sock_net(newsk)); ++ sock_inuse_add(sock_net(newsk), 1); ++ } + sk_node_init(&newsk->sk_node); + sock_lock_init(newsk); + bh_lock_sock(newsk); +@@ -1968,8 +1970,6 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) + newsk->sk_err_soft = 0; + newsk->sk_priority = 0; + newsk->sk_incoming_cpu = raw_smp_processor_id(); +- if (likely(newsk->sk_net_refcnt)) +- sock_inuse_add(sock_net(newsk), 1); + + /* Before updating sk_refcnt, we must commit prior changes to memory + * (Documentation/RCU/rculist_nulls.rst for details) +-- +2.33.0 + diff --git a/queue-5.10/staging-rtl8723bs-remove-possible-deadlock-when-disc.patch b/queue-5.10/staging-rtl8723bs-remove-possible-deadlock-when-disc.patch new file mode 100644 index 00000000000..f8ceb885490 --- /dev/null +++ b/queue-5.10/staging-rtl8723bs-remove-possible-deadlock-when-disc.patch @@ -0,0 +1,444 @@ +From 5adfabc2fb9625e489b513c17343dcb74b84f1ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Sep 2021 16:55:00 +0200 +Subject: staging: rtl8723bs: remove possible deadlock when disconnect (v2) + +From: Fabio Aiuto + +[ Upstream commit 54659ca026e586bbb33a7e60daa6443a3ac6b5df ] + +when turning off a connection, lockdep complains with the +following warning (a modprobe has been done but the same +happens with a disconnection from NetworkManager, +it's enough to trigger a cfg80211_disconnect call): + +[ 682.855867] ====================================================== +[ 682.855877] WARNING: possible circular locking dependency detected +[ 682.855887] 5.14.0-rc6+ #16 Tainted: G C OE +[ 682.855898] ------------------------------------------------------ +[ 682.855906] modprobe/1770 is trying to acquire lock: +[ 682.855916] ffffb6d000332b00 (&pxmitpriv->lock){+.-.}-{2:2}, + at: rtw_free_stainfo+0x52/0x4a0 [r8723bs] +[ 682.856073] + but task is already holding lock: +[ 682.856081] ffffb6d0003336a8 (&pstapriv->sta_hash_lock){+.-.}-{2:2}, + at: rtw_free_assoc_resources+0x48/0x110 [r8723bs] +[ 682.856207] + which lock already depends on the new lock. + +[ 682.856215] + the existing dependency chain (in reverse order) is: +[ 682.856223] + -> #1 (&pstapriv->sta_hash_lock){+.-.}-{2:2}: +[ 682.856247] _raw_spin_lock_bh+0x34/0x40 +[ 682.856265] rtw_get_stainfo+0x9a/0x110 [r8723bs] +[ 682.856389] rtw_xmit_classifier+0x27/0x130 [r8723bs] +[ 682.856515] rtw_xmitframe_enqueue+0xa/0x20 [r8723bs] +[ 682.856642] rtl8723bs_hal_xmit+0x3b/0xb0 [r8723bs] +[ 682.856752] rtw_xmit+0x4ef/0x890 [r8723bs] +[ 682.856879] _rtw_xmit_entry+0xba/0x350 [r8723bs] +[ 682.856981] dev_hard_start_xmit+0xee/0x320 +[ 682.856999] sch_direct_xmit+0x8c/0x330 +[ 682.857014] __dev_queue_xmit+0xba5/0xf00 +[ 682.857030] packet_sendmsg+0x981/0x1b80 +[ 682.857047] sock_sendmsg+0x5b/0x60 +[ 682.857060] __sys_sendto+0xf1/0x160 +[ 682.857073] __x64_sys_sendto+0x24/0x30 +[ 682.857087] do_syscall_64+0x3a/0x80 +[ 682.857102] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ 682.857117] + -> #0 (&pxmitpriv->lock){+.-.}-{2:2}: +[ 682.857142] __lock_acquire+0xfd9/0x1b50 +[ 682.857158] lock_acquire+0xb4/0x2c0 +[ 682.857172] _raw_spin_lock_bh+0x34/0x40 +[ 682.857185] rtw_free_stainfo+0x52/0x4a0 [r8723bs] +[ 682.857308] rtw_free_assoc_resources+0x53/0x110 [r8723bs] +[ 682.857415] cfg80211_rtw_disconnect+0x4b/0x70 [r8723bs] +[ 682.857522] cfg80211_disconnect+0x12e/0x2f0 [cfg80211] +[ 682.857759] cfg80211_leave+0x2b/0x40 [cfg80211] +[ 682.857961] cfg80211_netdev_notifier_call+0xa9/0x560 [cfg80211] +[ 682.858163] raw_notifier_call_chain+0x41/0x50 +[ 682.858180] __dev_close_many+0x62/0x100 +[ 682.858195] dev_close_many+0x7d/0x120 +[ 682.858209] unregister_netdevice_many+0x416/0x680 +[ 682.858225] unregister_netdevice_queue+0xab/0xf0 +[ 682.858240] unregister_netdev+0x18/0x20 +[ 682.858255] rtw_unregister_netdevs+0x28/0x40 [r8723bs] +[ 682.858360] rtw_dev_remove+0x24/0xd0 [r8723bs] +[ 682.858463] sdio_bus_remove+0x31/0xd0 [mmc_core] +[ 682.858532] device_release_driver_internal+0xf7/0x1d0 +[ 682.858550] driver_detach+0x47/0x90 +[ 682.858564] bus_remove_driver+0x77/0xd0 +[ 682.858579] rtw_drv_halt+0xc/0x678 [r8723bs] +[ 682.858685] __x64_sys_delete_module+0x13f/0x250 +[ 682.858699] do_syscall_64+0x3a/0x80 +[ 682.858715] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ 682.858729] + other info that might help us debug this: + +[ 682.858737] Possible unsafe locking scenario: + +[ 682.858744] CPU0 CPU1 +[ 682.858751] ---- ---- +[ 682.858758] lock(&pstapriv->sta_hash_lock); +[ 682.858772] lock(&pxmitpriv->lock); +[ 682.858786] lock(&pstapriv->sta_hash_lock); +[ 682.858799] lock(&pxmitpriv->lock); +[ 682.858812] + *** DEADLOCK *** + +[ 682.858820] 5 locks held by modprobe/1770: +[ 682.858831] #0: ffff8d870697d980 (&dev->mutex){....}-{3:3}, + at: device_release_driver_internal+0x1a/0x1d0 +[ 682.858869] #1: ffffffffbdbbf1c8 (rtnl_mutex){+.+.}-{3:3}, + at: unregister_netdev+0xe/0x20 +[ 682.858906] #2: ffff8d87054ee5e8 (&rdev->wiphy.mtx){+.+.}-{3:3}, + at: cfg80211_netdev_notifier_call+0x9e/0x560 [cfg80211] +[ 682.859131] #3: ffff8d870f2bc8f0 (&wdev->mtx){+.+.}-{3:3}, + at: cfg80211_leave+0x20/0x40 [cfg80211] +[ 682.859354] #4: ffffb6d0003336a8 (&pstapriv->sta_hash_lock){+.-.}-{2:2}, + at: rtw_free_assoc_resources+0x48/0x110 [r8723bs] +[ 682.859482] + stack backtrace: +[ 682.859491] CPU: 1 PID: 1770 Comm: modprobe Tainted: G + C OE 5.14.0-rc6+ #16 +[ 682.859507] Hardware name: LENOVO 80NR/Madrid, BIOS DACN25WW 08/20/2015 +[ 682.859517] Call Trace: +[ 682.859531] dump_stack_lvl+0x56/0x6f +[ 682.859551] check_noncircular+0xdb/0xf0 +[ 682.859579] __lock_acquire+0xfd9/0x1b50 +[ 682.859606] lock_acquire+0xb4/0x2c0 +[ 682.859623] ? rtw_free_stainfo+0x52/0x4a0 [r8723bs] +[ 682.859752] ? mark_held_locks+0x48/0x70 +[ 682.859769] ? rtw_free_stainfo+0x4a/0x4a0 [r8723bs] +[ 682.859898] _raw_spin_lock_bh+0x34/0x40 +[ 682.859914] ? rtw_free_stainfo+0x52/0x4a0 [r8723bs] +[ 682.860039] rtw_free_stainfo+0x52/0x4a0 [r8723bs] +[ 682.860171] rtw_free_assoc_resources+0x53/0x110 [r8723bs] +[ 682.860286] cfg80211_rtw_disconnect+0x4b/0x70 [r8723bs] +[ 682.860397] cfg80211_disconnect+0x12e/0x2f0 [cfg80211] +[ 682.860629] cfg80211_leave+0x2b/0x40 [cfg80211] +[ 682.860836] cfg80211_netdev_notifier_call+0xa9/0x560 [cfg80211] +[ 682.861048] ? __lock_acquire+0x4dc/0x1b50 +[ 682.861070] ? lock_is_held_type+0xa8/0x110 +[ 682.861089] ? lock_is_held_type+0xa8/0x110 +[ 682.861104] ? find_held_lock+0x2d/0x90 +[ 682.861120] ? packet_notifier+0x173/0x300 +[ 682.861141] ? lock_release+0xb3/0x250 +[ 682.861160] ? packet_notifier+0x192/0x300 +[ 682.861184] raw_notifier_call_chain+0x41/0x50 +[ 682.861205] __dev_close_many+0x62/0x100 +[ 682.861224] dev_close_many+0x7d/0x120 +[ 682.861245] unregister_netdevice_many+0x416/0x680 +[ 682.861264] ? find_held_lock+0x2d/0x90 +[ 682.861284] unregister_netdevice_queue+0xab/0xf0 +[ 682.861306] unregister_netdev+0x18/0x20 +[ 682.861325] rtw_unregister_netdevs+0x28/0x40 [r8723bs] +[ 682.861434] rtw_dev_remove+0x24/0xd0 [r8723bs] +[ 682.861542] sdio_bus_remove+0x31/0xd0 [mmc_core] +[ 682.861615] device_release_driver_internal+0xf7/0x1d0 +[ 682.861637] driver_detach+0x47/0x90 +[ 682.861656] bus_remove_driver+0x77/0xd0 +[ 682.861674] rtw_drv_halt+0xc/0x678 [r8723bs] +[ 682.861782] __x64_sys_delete_module+0x13f/0x250 +[ 682.861801] ? lockdep_hardirqs_on_prepare+0xf3/0x170 +[ 682.861817] ? syscall_enter_from_user_mode+0x20/0x70 +[ 682.861836] do_syscall_64+0x3a/0x80 +[ 682.861855] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ 682.861873] RIP: 0033:0x7f6dbe85400b +[ 682.861890] Code: 73 01 c3 48 8b 0d 6d 1e 0c 00 f7 d8 64 89 +01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa +b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 3d +1e 0c 00 f7 d8 64 89 01 48 +[ 682.861906] RSP: 002b:00007ffe7a82f538 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 +[ 682.861923] RAX: ffffffffffffffda RBX: 000055a64693bd20 RCX: 00007f6dbe85400b +[ 682.861935] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055a64693bd88 +[ 682.861946] RBP: 000055a64693bd20 R08: 0000000000000000 R09: 0000000000000000 +[ 682.861957] R10: 00007f6dbe8c7ac0 R11: 0000000000000206 R12: 000055a64693bd88 +[ 682.861967] R13: 0000000000000000 R14: 000055a64693bd88 R15: 00007ffe7a831848 + +This happens because when we enqueue a frame for +transmission we do it under xmit_priv lock, then calling +rtw_get_stainfo (needed for enqueuing) takes sta_hash_lock +and this leads to the following lock dependency: + +xmit_priv->lock -> sta_hash_lock + +Turning off a connection will bring to call +rtw_free_assoc_resources which will set up +the inverse dependency: + +sta_hash_lock -> xmit_priv_lock + +This could lead to a deadlock as lockdep complains. + +Fix it by removing the xmit_priv->lock around +rtw_xmitframe_enqueue call inside rtl8723bs_hal_xmit +and put it in a smaller critical section inside +rtw_xmit_classifier, the only place where +xmit_priv data are actually accessed. + +Replace spin_{lock,unlock}_bh(pxmitpriv->lock) +in other tx paths leading to rtw_xmitframe_enqueue +call with spin_{lock,unlock}_bh(psta->sleep_q.lock) +- it's not clear why accessing a sleep_q was protected +by a spinlock on xmitpriv->lock. + +This way is avoided the same faulty lock nesting +order. + +Extra changes in v2 by Hans de Goede: +-Lift the taking of the struct __queue.lock spinlock out of + rtw_free_xmitframe_queue() into the callers this allows also + protecting a bunch of related state in rtw_free_stainfo(): +-Protect psta->sleepq_len on rtw_free_xmitframe_queue(&psta->sleep_q); +-Protect struct tx_servq.tx_pending and tx_servq.qcnt when + calling rtw_free_xmitframe_queue(&tx_servq.sta_pending) +-This also allows moving the spin_lock_bh(&pxmitpriv->lock); to below + the sleep_q free-ing code, avoiding another ABBA locking issue + +CC: Larry Finger +Co-developed-by: Hans de Goede +Tested-on: Lenovo Ideapad MiiX 300-10IBY +Signed-off-by: Fabio Aiuto +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20210920145502.155454-1-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 7 ++---- + drivers/staging/rtl8723bs/core/rtw_recv.c | 10 +++------ + drivers/staging/rtl8723bs/core/rtw_sta_mgt.c | 22 ++++++++++--------- + drivers/staging/rtl8723bs/core/rtw_xmit.c | 16 ++++++-------- + .../staging/rtl8723bs/hal/rtl8723bs_xmit.c | 2 -- + 5 files changed, 24 insertions(+), 33 deletions(-) + +diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +index b912ad2f4b720..4df6d04315e39 100644 +--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c ++++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +@@ -6679,7 +6679,6 @@ u8 chk_bmc_sleepq_hdl(struct adapter *padapter, unsigned char *pbuf) + struct sta_info *psta_bmc; + struct list_head *xmitframe_plist, *xmitframe_phead; + struct xmit_frame *pxmitframe = NULL; +- struct xmit_priv *pxmitpriv = &padapter->xmitpriv; + struct sta_priv *pstapriv = &padapter->stapriv; + + /* for BC/MC Frames */ +@@ -6690,8 +6689,7 @@ u8 chk_bmc_sleepq_hdl(struct adapter *padapter, unsigned char *pbuf) + if ((pstapriv->tim_bitmap&BIT(0)) && (psta_bmc->sleepq_len > 0)) { + msleep(10);/* 10ms, ATIM(HIQ) Windows */ + +- /* spin_lock_bh(&psta_bmc->sleep_q.lock); */ +- spin_lock_bh(&pxmitpriv->lock); ++ spin_lock_bh(&psta_bmc->sleep_q.lock); + + xmitframe_phead = get_list_head(&psta_bmc->sleep_q); + xmitframe_plist = get_next(xmitframe_phead); +@@ -6717,8 +6715,7 @@ u8 chk_bmc_sleepq_hdl(struct adapter *padapter, unsigned char *pbuf) + rtw_hal_xmitframe_enqueue(padapter, pxmitframe); + } + +- /* spin_unlock_bh(&psta_bmc->sleep_q.lock); */ +- spin_unlock_bh(&pxmitpriv->lock); ++ spin_unlock_bh(&psta_bmc->sleep_q.lock); + + /* check hi queue and bmc_sleepq */ + rtw_chk_hi_queue_cmd(padapter); +diff --git a/drivers/staging/rtl8723bs/core/rtw_recv.c b/drivers/staging/rtl8723bs/core/rtw_recv.c +index 6979f8dbccb84..0d47e6e121777 100644 +--- a/drivers/staging/rtl8723bs/core/rtw_recv.c ++++ b/drivers/staging/rtl8723bs/core/rtw_recv.c +@@ -1144,10 +1144,8 @@ sint validate_recv_ctrl_frame(struct adapter *padapter, union recv_frame *precv_ + if ((psta->state&WIFI_SLEEP_STATE) && (pstapriv->sta_dz_bitmap&BIT(psta->aid))) { + struct list_head *xmitframe_plist, *xmitframe_phead; + struct xmit_frame *pxmitframe = NULL; +- struct xmit_priv *pxmitpriv = &padapter->xmitpriv; + +- /* spin_lock_bh(&psta->sleep_q.lock); */ +- spin_lock_bh(&pxmitpriv->lock); ++ spin_lock_bh(&psta->sleep_q.lock); + + xmitframe_phead = get_list_head(&psta->sleep_q); + xmitframe_plist = get_next(xmitframe_phead); +@@ -1182,12 +1180,10 @@ sint validate_recv_ctrl_frame(struct adapter *padapter, union recv_frame *precv_ + update_beacon(padapter, _TIM_IE_, NULL, true); + } + +- /* spin_unlock_bh(&psta->sleep_q.lock); */ +- spin_unlock_bh(&pxmitpriv->lock); ++ spin_unlock_bh(&psta->sleep_q.lock); + + } else { +- /* spin_unlock_bh(&psta->sleep_q.lock); */ +- spin_unlock_bh(&pxmitpriv->lock); ++ spin_unlock_bh(&psta->sleep_q.lock); + + /* DBG_871X("no buffered packets to xmit\n"); */ + if (pstapriv->tim_bitmap&BIT(psta->aid)) { +diff --git a/drivers/staging/rtl8723bs/core/rtw_sta_mgt.c b/drivers/staging/rtl8723bs/core/rtw_sta_mgt.c +index e3f56c6cc882e..b1784b4e466f3 100644 +--- a/drivers/staging/rtl8723bs/core/rtw_sta_mgt.c ++++ b/drivers/staging/rtl8723bs/core/rtw_sta_mgt.c +@@ -330,46 +330,48 @@ u32 rtw_free_stainfo(struct adapter *padapter, struct sta_info *psta) + + /* list_del_init(&psta->wakeup_list); */ + +- spin_lock_bh(&pxmitpriv->lock); +- ++ spin_lock_bh(&psta->sleep_q.lock); + rtw_free_xmitframe_queue(pxmitpriv, &psta->sleep_q); + psta->sleepq_len = 0; ++ spin_unlock_bh(&psta->sleep_q.lock); ++ ++ spin_lock_bh(&pxmitpriv->lock); + + /* vo */ +- /* spin_lock_bh(&(pxmitpriv->vo_pending.lock)); */ ++ spin_lock_bh(&pstaxmitpriv->vo_q.sta_pending.lock); + rtw_free_xmitframe_queue(pxmitpriv, &pstaxmitpriv->vo_q.sta_pending); + list_del_init(&(pstaxmitpriv->vo_q.tx_pending)); + phwxmit = pxmitpriv->hwxmits; + phwxmit->accnt -= pstaxmitpriv->vo_q.qcnt; + pstaxmitpriv->vo_q.qcnt = 0; +- /* spin_unlock_bh(&(pxmitpriv->vo_pending.lock)); */ ++ spin_unlock_bh(&pstaxmitpriv->vo_q.sta_pending.lock); + + /* vi */ +- /* spin_lock_bh(&(pxmitpriv->vi_pending.lock)); */ ++ spin_lock_bh(&pstaxmitpriv->vi_q.sta_pending.lock); + rtw_free_xmitframe_queue(pxmitpriv, &pstaxmitpriv->vi_q.sta_pending); + list_del_init(&(pstaxmitpriv->vi_q.tx_pending)); + phwxmit = pxmitpriv->hwxmits+1; + phwxmit->accnt -= pstaxmitpriv->vi_q.qcnt; + pstaxmitpriv->vi_q.qcnt = 0; +- /* spin_unlock_bh(&(pxmitpriv->vi_pending.lock)); */ ++ spin_unlock_bh(&pstaxmitpriv->vi_q.sta_pending.lock); + + /* be */ +- /* spin_lock_bh(&(pxmitpriv->be_pending.lock)); */ ++ spin_lock_bh(&pstaxmitpriv->be_q.sta_pending.lock); + rtw_free_xmitframe_queue(pxmitpriv, &pstaxmitpriv->be_q.sta_pending); + list_del_init(&(pstaxmitpriv->be_q.tx_pending)); + phwxmit = pxmitpriv->hwxmits+2; + phwxmit->accnt -= pstaxmitpriv->be_q.qcnt; + pstaxmitpriv->be_q.qcnt = 0; +- /* spin_unlock_bh(&(pxmitpriv->be_pending.lock)); */ ++ spin_unlock_bh(&pstaxmitpriv->be_q.sta_pending.lock); + + /* bk */ +- /* spin_lock_bh(&(pxmitpriv->bk_pending.lock)); */ ++ spin_lock_bh(&pstaxmitpriv->bk_q.sta_pending.lock); + rtw_free_xmitframe_queue(pxmitpriv, &pstaxmitpriv->bk_q.sta_pending); + list_del_init(&(pstaxmitpriv->bk_q.tx_pending)); + phwxmit = pxmitpriv->hwxmits+3; + phwxmit->accnt -= pstaxmitpriv->bk_q.qcnt; + pstaxmitpriv->bk_q.qcnt = 0; +- /* spin_unlock_bh(&(pxmitpriv->bk_pending.lock)); */ ++ spin_unlock_bh(&pstaxmitpriv->bk_q.sta_pending.lock); + + spin_unlock_bh(&pxmitpriv->lock); + +diff --git a/drivers/staging/rtl8723bs/core/rtw_xmit.c b/drivers/staging/rtl8723bs/core/rtw_xmit.c +index 6ecaff9728fd4..d78cff7ed6a01 100644 +--- a/drivers/staging/rtl8723bs/core/rtw_xmit.c ++++ b/drivers/staging/rtl8723bs/core/rtw_xmit.c +@@ -1871,8 +1871,6 @@ void rtw_free_xmitframe_queue(struct xmit_priv *pxmitpriv, struct __queue *pfram + struct list_head *plist, *phead; + struct xmit_frame *pxmitframe; + +- spin_lock_bh(&pframequeue->lock); +- + phead = get_list_head(pframequeue); + plist = get_next(phead); + +@@ -1883,7 +1881,6 @@ void rtw_free_xmitframe_queue(struct xmit_priv *pxmitpriv, struct __queue *pfram + + rtw_free_xmitframe(pxmitpriv, pxmitframe); + } +- spin_unlock_bh(&pframequeue->lock); + } + + s32 rtw_xmitframe_enqueue(struct adapter *padapter, struct xmit_frame *pxmitframe) +@@ -1946,6 +1943,7 @@ s32 rtw_xmit_classifier(struct adapter *padapter, struct xmit_frame *pxmitframe) + struct sta_info *psta; + struct tx_servq *ptxservq; + struct pkt_attrib *pattrib = &pxmitframe->attrib; ++ struct xmit_priv *xmit_priv = &padapter->xmitpriv; + struct hw_xmit *phwxmits = padapter->xmitpriv.hwxmits; + sint res = _SUCCESS; + +@@ -1974,12 +1972,14 @@ s32 rtw_xmit_classifier(struct adapter *padapter, struct xmit_frame *pxmitframe) + + ptxservq = rtw_get_sta_pending(padapter, psta, pattrib->priority, (u8 *)(&ac_index)); + ++ spin_lock_bh(&xmit_priv->lock); + if (list_empty(&ptxservq->tx_pending)) + list_add_tail(&ptxservq->tx_pending, get_list_head(phwxmits[ac_index].sta_queue)); + + list_add_tail(&pxmitframe->list, get_list_head(&ptxservq->sta_pending)); + ptxservq->qcnt++; + phwxmits[ac_index].accnt++; ++ spin_unlock_bh(&xmit_priv->lock); + + exit: + +@@ -2397,11 +2397,10 @@ void wakeup_sta_to_xmit(struct adapter *padapter, struct sta_info *psta) + struct list_head *xmitframe_plist, *xmitframe_phead; + struct xmit_frame *pxmitframe = NULL; + struct sta_priv *pstapriv = &padapter->stapriv; +- struct xmit_priv *pxmitpriv = &padapter->xmitpriv; + + psta_bmc = rtw_get_bcmc_stainfo(padapter); + +- spin_lock_bh(&pxmitpriv->lock); ++ spin_lock_bh(&psta->sleep_q.lock); + + xmitframe_phead = get_list_head(&psta->sleep_q); + xmitframe_plist = get_next(xmitframe_phead); +@@ -2509,7 +2508,7 @@ void wakeup_sta_to_xmit(struct adapter *padapter, struct sta_info *psta) + + _exit: + +- spin_unlock_bh(&pxmitpriv->lock); ++ spin_unlock_bh(&psta->sleep_q.lock); + + if (update_mask) + update_beacon(padapter, _TIM_IE_, NULL, true); +@@ -2521,9 +2520,8 @@ void xmit_delivery_enabled_frames(struct adapter *padapter, struct sta_info *pst + struct list_head *xmitframe_plist, *xmitframe_phead; + struct xmit_frame *pxmitframe = NULL; + struct sta_priv *pstapriv = &padapter->stapriv; +- struct xmit_priv *pxmitpriv = &padapter->xmitpriv; + +- spin_lock_bh(&pxmitpriv->lock); ++ spin_lock_bh(&psta->sleep_q.lock); + + xmitframe_phead = get_list_head(&psta->sleep_q); + xmitframe_plist = get_next(xmitframe_phead); +@@ -2579,7 +2577,7 @@ void xmit_delivery_enabled_frames(struct adapter *padapter, struct sta_info *pst + } + } + +- spin_unlock_bh(&pxmitpriv->lock); ++ spin_unlock_bh(&psta->sleep_q.lock); + } + + void enqueue_pending_xmitbuf( +diff --git a/drivers/staging/rtl8723bs/hal/rtl8723bs_xmit.c b/drivers/staging/rtl8723bs/hal/rtl8723bs_xmit.c +index 44799c4a9f35b..ce5bf2861d0c1 100644 +--- a/drivers/staging/rtl8723bs/hal/rtl8723bs_xmit.c ++++ b/drivers/staging/rtl8723bs/hal/rtl8723bs_xmit.c +@@ -572,9 +572,7 @@ s32 rtl8723bs_hal_xmit( + rtw_issue_addbareq_cmd(padapter, pxmitframe); + } + +- spin_lock_bh(&pxmitpriv->lock); + err = rtw_xmitframe_enqueue(padapter, pxmitframe); +- spin_unlock_bh(&pxmitpriv->lock); + if (err != _SUCCESS) { + RT_TRACE(_module_hal_xmit_c_, _drv_err_, ("rtl8723bs_hal_xmit: enqueue xmitframe fail\n")); + rtw_free_xmitframe(pxmitpriv, pxmitframe); +-- +2.33.0 + diff --git a/queue-5.10/staging-wfx-ensure-irq-is-ready-before-enabling-it.patch b/queue-5.10/staging-wfx-ensure-irq-is-ready-before-enabling-it.patch new file mode 100644 index 00000000000..add7f68cc18 --- /dev/null +++ b/queue-5.10/staging-wfx-ensure-irq-is-ready-before-enabling-it.patch @@ -0,0 +1,125 @@ +From b0a17b011451fa6f291c2298010ea06fbcb2b6e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Sep 2021 15:02:03 +0200 +Subject: staging: wfx: ensure IRQ is ready before enabling it +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jérôme Pouiller + +[ Upstream commit 5e57c668dc097c6c27c973504706edec53f79281 ] + +Since commit 5561770f80b1 ("staging: wfx: repair external IRQ for +SDIO"), wfx_sdio_irq_subscribe() enforce the device to use IRQs. +However, there is currently a race in this code. An IRQ may happen +before the IRQ has been registered. + +The problem has observed during debug session when the device crashes +before the IRQ set up: + + [ 1.546] wfx-sdio mmc0:0001:1: started firmware 3.12.2 "WF200_ASIC_WFM_(Jenkins)_FW3.12.2" (API: 3.7, keyset: C0, caps: 0x00000002) + [ 2.559] wfx-sdio mmc0:0001:1: time out while polling control register + [ 3.565] wfx-sdio mmc0:0001:1: chip is abnormally long to answer + [ 6.563] wfx-sdio mmc0:0001:1: chip did not answer + [ 6.568] wfx-sdio mmc0:0001:1: hardware request CONFIGURATION (0x09) on vif 2 returned error -110 + [ 6.577] wfx-sdio mmc0:0001:1: PDS bytes 0 to 12: chip didn't reply (corrupted file?) + [ 6.585] Unable to handle kernel NULL pointer dereference at virtual address 00000000 + [ 6.592] pgd = c0004000 + [ 6.595] [00000000] *pgd=00000000 + [ 6.598] Internal error: Oops - BUG: 17 [#1] THUMB2 + [ 6.603] Modules linked in: + [ 6.606] CPU: 0 PID: 23 Comm: kworker/u2:1 Not tainted 3.18.19 #78 + [ 6.612] Workqueue: kmmcd mmc_rescan + [ 6.616] task: c176d100 ti: c0e50000 task.ti: c0e50000 + [ 6.621] PC is at wake_up_process+0xa/0x14 + [ 6.625] LR is at sdio_irq+0x61/0x250 + [ 6.629] pc : [] lr : [] psr: 600001b3 + [ 6.629] sp : c0e51bd8 ip : c0e51cc8 fp : 00000001 + [ 6.640] r10: 00000003 r9 : 00000000 r8 : c0003c34 + [ 6.644] r7 : c0e51bd8 r6 : c0003c30 r5 : 00000001 r4 : c0e78c00 + [ 6.651] r3 : 00000000 r2 : 00000000 r1 : 00000003 r0 : 00000000 + [ 6.657] Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA Thumb Segment kernel + [ 6.664] Control: 50c53c7d Table: 11fd8059 DAC: 00000015 + [ 6.670] Process kworker/u2:1 (pid: 23, stack limit = 0xc0e501b0) + [ 6.676] Stack: (0xc0e51bd8 to 0xc0e52000) + [...] + [ 6.949] [] (wake_up_process) from [] (sdio_irq+0x61/0x250) + [ 6.956] [] (sdio_irq) from [] (handle_irq_event_percpu+0x17/0x92) + [ 6.964] [] (handle_irq_event_percpu) from [] (handle_irq_event+0x1b/0x24) + [ 6.973] [] (handle_irq_event) from [] (handle_level_irq+0x5d/0x76) + [ 6.981] [] (handle_level_irq) from [] (generic_handle_irq+0x13/0x1c) + [ 6.989] [] (generic_handle_irq) from [] (__handle_domain_irq+0x31/0x48) + [ 6.997] [] (__handle_domain_irq) from [] (ov_handle_irq+0x31/0xe0) + [ 7.005] [] (ov_handle_irq) from [] (__irq_svc+0x3b/0x5c) + [ 7.013] Exception stack(0xc0e51c68 to 0xc0e51cb0) + [...] + [ 7.038] [] (__irq_svc) from [] (wait_for_common+0x9e/0xc4) + [ 7.045] [] (wait_for_common) from [] (mmc_wait_for_req+0x4b/0xdc) + [ 7.053] [] (mmc_wait_for_req) from [] (mmc_wait_for_cmd+0x2f/0x34) + [ 7.061] [] (mmc_wait_for_cmd) from [] (mmc_io_rw_direct_host+0x71/0xac) + [ 7.070] [] (mmc_io_rw_direct_host) from [] (sdio_claim_irq+0x6b/0x116) + [ 7.078] [] (sdio_claim_irq) from [] (wfx_sdio_irq_subscribe+0x19/0x94) + [ 7.086] [] (wfx_sdio_irq_subscribe) from [] (wfx_probe+0x189/0x2ac) + [ 7.095] [] (wfx_probe) from [] (wfx_sdio_probe+0x8f/0xcc) + [ 7.102] [] (wfx_sdio_probe) from [] (sdio_bus_probe+0x5f/0xa8) + [ 7.109] [] (sdio_bus_probe) from [] (driver_probe_device+0x59/0x134) + [ 7.118] [] (driver_probe_device) from [] (bus_for_each_drv+0x3f/0x4a) + [ 7.126] [] (bus_for_each_drv) from [] (device_attach+0x3b/0x52) + [ 7.134] [] (device_attach) from [] (bus_probe_device+0x17/0x4c) + [ 7.141] [] (bus_probe_device) from [] (device_add+0x2c5/0x334) + [ 7.149] [] (device_add) from [] (sdio_add_func+0x23/0x44) + [ 7.156] [] (sdio_add_func) from [] (mmc_attach_sdio+0x187/0x1ec) + [ 7.164] [] (mmc_attach_sdio) from [] (mmc_rescan+0x18d/0x1fc) + [ 7.172] [] (mmc_rescan) from [] (process_one_work+0xd7/0x170) + [ 7.179] [] (process_one_work) from [] (worker_thread+0x103/0x1bc) + [ 7.187] [] (worker_thread) from [] (kthread+0x7d/0x90) + [ 7.194] [] (kthread) from [] (ret_from_fork+0x11/0x30) + [ 7.201] Code: 2103 b580 2200 af00 (681b) 46bd + [ 7.206] ---[ end trace 3ab50aced42eedb4 ]--- + +Signed-off-by: Jérôme Pouiller +Link: https://lore.kernel.org/r/20210913130203.1903622-33-Jerome.Pouiller@silabs.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/wfx/bus_sdio.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/staging/wfx/bus_sdio.c b/drivers/staging/wfx/bus_sdio.c +index e06d7e1ebe9c3..61b8cc05f2935 100644 +--- a/drivers/staging/wfx/bus_sdio.c ++++ b/drivers/staging/wfx/bus_sdio.c +@@ -120,19 +120,22 @@ static int wfx_sdio_irq_subscribe(void *priv) + return ret; + } + ++ flags = irq_get_trigger_type(bus->of_irq); ++ if (!flags) ++ flags = IRQF_TRIGGER_HIGH; ++ flags |= IRQF_ONESHOT; ++ ret = devm_request_threaded_irq(&bus->func->dev, bus->of_irq, NULL, ++ wfx_sdio_irq_handler_ext, flags, ++ "wfx", bus); ++ if (ret) ++ return ret; + sdio_claim_host(bus->func); + cccr = sdio_f0_readb(bus->func, SDIO_CCCR_IENx, NULL); + cccr |= BIT(0); + cccr |= BIT(bus->func->num); + sdio_f0_writeb(bus->func, cccr, SDIO_CCCR_IENx, NULL); + sdio_release_host(bus->func); +- flags = irq_get_trigger_type(bus->of_irq); +- if (!flags) +- flags = IRQF_TRIGGER_HIGH; +- flags |= IRQF_ONESHOT; +- return devm_request_threaded_irq(&bus->func->dev, bus->of_irq, NULL, +- wfx_sdio_irq_handler_ext, flags, +- "wfx", bus); ++ return 0; + } + + static int wfx_sdio_irq_unsubscribe(void *priv) +-- +2.33.0 + diff --git a/queue-5.10/tcp-fix-uninitialized-access-in-skb-frags-array-for-.patch b/queue-5.10/tcp-fix-uninitialized-access-in-skb-frags-array-for-.patch new file mode 100644 index 00000000000..201fc80690c --- /dev/null +++ b/queue-5.10/tcp-fix-uninitialized-access-in-skb-frags-array-for-.patch @@ -0,0 +1,80 @@ +From c8b00b41801261a55a05a14f2f7174909ebf587b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Nov 2021 15:52:15 -0800 +Subject: tcp: Fix uninitialized access in skb frags array for Rx 0cp. + +From: Arjun Roy + +[ Upstream commit 70701b83e208767f2720d8cd3e6a62cddafb3a30 ] + +TCP Receive zerocopy iterates through the SKB queue via +tcp_recv_skb(), acquiring a pointer to an SKB and an offset within +that SKB to read from. From there, it iterates the SKB frags array to +determine which offset to start remapping pages from. + +However, this is built on the assumption that the offset read so far +within the SKB is smaller than the SKB length. If this assumption is +violated, we can attempt to read an invalid frags array element, which +would cause a fault. + +tcp_recv_skb() can cause such an SKB to be returned when the TCP FIN +flag is set. Therefore, we must guard against this occurrence inside +skb_advance_frag(). + +One way that we can reproduce this error follows: +1) In a receiver program, call getsockopt(TCP_ZEROCOPY_RECEIVE) with: +char some_array[32 * 1024]; +struct tcp_zerocopy_receive zc = { + .copybuf_address = (__u64) &some_array[0], + .copybuf_len = 32 * 1024, +}; + +2) In a sender program, after a TCP handshake, send the following +sequence of packets: + i) Seq = [X, X+4000] + ii) Seq = [X+4000, X+5000] + iii) Seq = [X+4000, X+5000], Flags = FIN | URG, urgptr=1000 + +(This can happen without URG, if we have a signal pending, but URG is +a convenient way to reproduce the behaviour). + +In this case, the following event sequence will occur on the receiver: + +tcp_zerocopy_receive(): +-> receive_fallback_to_copy() // copybuf_len >= inq +-> tcp_recvmsg_locked() // reads 5000 bytes, then breaks due to URG +-> tcp_recv_skb() // yields skb with skb->len == offset +-> tcp_zerocopy_set_hint_for_skb() +-> skb_advance_to_frag() // will returns a frags ptr. >= nr_frags +-> find_next_mappable_frag() // will dereference this bad frags ptr. + +With this patch, skb_advance_to_frag() will no longer return an +invalid frags pointer, and will return NULL instead, fixing the issue. + +Signed-off-by: Arjun Roy +Signed-off-by: Eric Dumazet +Fixes: 05255b823a61 ("tcp: add TCP_ZEROCOPY_RECEIVE support for zerocopy receive") +Link: https://lore.kernel.org/r/20211111235215.2605384-1-arjunroy.kdev@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index b3721cff45023..bb16c88f58a3c 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1751,6 +1751,9 @@ static skb_frag_t *skb_advance_to_frag(struct sk_buff *skb, u32 offset_skb, + { + skb_frag_t *frag; + ++ if (unlikely(offset_skb >= skb->len)) ++ return NULL; ++ + offset_skb -= skb_headlen(skb); + if ((int)offset_skb < 0 || skb_has_frag_list(skb)) + return NULL; +-- +2.33.0 + diff --git a/queue-5.10/tipc-only-accept-encrypted-msg_crypto-msgs.patch b/queue-5.10/tipc-only-accept-encrypted-msg_crypto-msgs.patch new file mode 100644 index 00000000000..ef4b2b8051a --- /dev/null +++ b/queue-5.10/tipc-only-accept-encrypted-msg_crypto-msgs.patch @@ -0,0 +1,52 @@ +From e034eb7cda0c45a01d7755867145f11fd1ff9a0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Nov 2021 07:45:24 -0500 +Subject: tipc: only accept encrypted MSG_CRYPTO msgs + +From: Xin Long + +[ Upstream commit 271351d255b09e39c7f6437738cba595f9b235be ] + +The MSG_CRYPTO msgs are always encrypted and sent to other nodes +for keys' deployment. But when receiving in peers, if those nodes +do not validate it and make sure it's encrypted, one could craft +a malicious MSG_CRYPTO msg to deploy its key with no need to know +other nodes' keys. + +This patch is to do that by checking TIPC_SKB_CB(skb)->decrypted +and discard it if this packet never got decrypted. + +Note that this is also a supplementary fix to CVE-2021-43267 that +can be triggered by an unencrypted malicious MSG_CRYPTO msg. + +Fixes: 1ef6f7c9390f ("tipc: add automatic session key exchange") +Acked-by: Ying Xue +Acked-by: Jon Maloy +Signed-off-by: Xin Long +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/link.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/net/tipc/link.c b/net/tipc/link.c +index c92e6984933cb..29591955d08a5 100644 +--- a/net/tipc/link.c ++++ b/net/tipc/link.c +@@ -1258,8 +1258,11 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb, + return false; + #ifdef CONFIG_TIPC_CRYPTO + case MSG_CRYPTO: +- tipc_crypto_msg_rcv(l->net, skb); +- return true; ++ if (TIPC_SKB_CB(skb)->decrypted) { ++ tipc_crypto_msg_rcv(l->net, skb); ++ return true; ++ } ++ fallthrough; + #endif + default: + pr_warn("Dropping received illegal msg type\n"); +-- +2.33.0 + diff --git a/queue-5.10/tracing-add-length-protection-to-histogram-string-co.patch b/queue-5.10/tracing-add-length-protection-to-histogram-string-co.patch new file mode 100644 index 00000000000..a4ab843af18 --- /dev/null +++ b/queue-5.10/tracing-add-length-protection-to-histogram-string-co.patch @@ -0,0 +1,87 @@ +From 296874248b06c4fb598e792dce2fa8217f41adb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Nov 2021 13:28:34 -0500 +Subject: tracing: Add length protection to histogram string copies + +From: Steven Rostedt (VMware) + +[ Upstream commit 938aa33f14657c9ed9deea348b7d6f14b6d69cb7 ] + +The string copies to the histogram storage has a max size of 256 bytes +(defined by MAX_FILTER_STR_VAL). Only the string size of the event field +needs to be copied to the event storage, but no more than what is in the +event storage. Although nothing should be bigger than 256 bytes, there's +no protection against overwriting of the storage if one day there is. + +Copy no more than the destination size, and enforce it. + +Also had to turn MAX_FILTER_STR_VAL into an unsigned int, to keep the +min() comparison of the string sizes of comparable types. + +Link: https://lore.kernel.org/all/CAHk-=wjREUihCGrtRBwfX47y_KrLCGjiq3t6QtoNJpmVrAEb1w@mail.gmail.com/ +Link: https://lkml.kernel.org/r/20211114132834.183429a4@rorschach.local.home + +Cc: Ingo Molnar +Cc: Andrew Morton +Cc: Tom Zanussi +Reported-by: Linus Torvalds +Reviewed-by: Masami Hiramatsu +Fixes: 63f84ae6b82b ("tracing/histogram: Do not copy the fixed-size char array field over the field size") +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + include/linux/trace_events.h | 2 +- + kernel/trace/trace_events_hist.c | 9 +++++++-- + 2 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h +index d321fe5ad1a14..c57b79301a75e 100644 +--- a/include/linux/trace_events.h ++++ b/include/linux/trace_events.h +@@ -571,7 +571,7 @@ struct trace_event_file { + + #define PERF_MAX_TRACE_SIZE 2048 + +-#define MAX_FILTER_STR_VAL 256 /* Should handle KSYM_SYMBOL_LEN */ ++#define MAX_FILTER_STR_VAL 256U /* Should handle KSYM_SYMBOL_LEN */ + + enum event_trigger_type { + ETT_NONE = (0), +diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c +index 642e4645f6406..c2ec467a5766b 100644 +--- a/kernel/trace/trace_events_hist.c ++++ b/kernel/trace/trace_events_hist.c +@@ -2624,8 +2624,10 @@ static inline void __update_field_vars(struct tracing_map_elt *elt, + if (val->flags & HIST_FIELD_FL_STRING) { + char *str = elt_data->field_var_str[j++]; + char *val_str = (char *)(uintptr_t)var_val; ++ unsigned int size; + +- strscpy(str, val_str, val->size); ++ size = min(val->size, STR_VAR_LEN_MAX); ++ strscpy(str, val_str, size); + var_val = (u64)(uintptr_t)str; + } + tracing_map_set_var(elt, var_idx, var_val); +@@ -4465,6 +4467,7 @@ static void hist_trigger_elt_update(struct hist_trigger_data *hist_data, + if (hist_field->flags & HIST_FIELD_FL_STRING) { + unsigned int str_start, var_str_idx, idx; + char *str, *val_str; ++ unsigned int size; + + str_start = hist_data->n_field_var_str + + hist_data->n_save_var_str; +@@ -4473,7 +4476,9 @@ static void hist_trigger_elt_update(struct hist_trigger_data *hist_data, + + str = elt_data->field_var_str[idx]; + val_str = (char *)(uintptr_t)hist_val; +- strscpy(str, val_str, hist_field->size); ++ ++ size = min(hist_field->size, STR_VAR_LEN_MAX); ++ strscpy(str, val_str, size); + + hist_val = (u64)(uintptr_t)str; + } +-- +2.33.0 + diff --git a/queue-5.10/tracing-histogram-do-not-copy-the-fixed-size-char-ar.patch b/queue-5.10/tracing-histogram-do-not-copy-the-fixed-size-char-ar.patch new file mode 100644 index 00000000000..e12b3d79f20 --- /dev/null +++ b/queue-5.10/tracing-histogram-do-not-copy-the-fixed-size-char-ar.patch @@ -0,0 +1,69 @@ +From f412980f8762e29ff35628cf8ce8505fc03fc1a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Nov 2021 01:02:08 +0900 +Subject: tracing/histogram: Do not copy the fixed-size char array field over + the field size + +From: Masami Hiramatsu + +[ Upstream commit 63f84ae6b82bb4dff672f76f30c6fd7b9d3766bc ] + +Do not copy the fixed-size char array field of the events over +the field size. The histogram treats char array as a string and +there are 2 types of char array in the event, fixed-size and +dynamic string. The dynamic string (__data_loc) field must be +null terminated, but the fixed-size char array field may not +be null terminated (not a string, but just a data). +In that case, histogram can copy the data after the field. +This uses the original field size for fixed-size char array +field to restrict the histogram not to access over the original +field size. + +Link: https://lkml.kernel.org/r/163673292822.195747.3696966210526410250.stgit@devnote2 + +Fixes: 02205a6752f2 (tracing: Add support for 'field variables') +Signed-off-by: Masami Hiramatsu +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_events_hist.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c +index 1b7f90e00eb05..642e4645f6406 100644 +--- a/kernel/trace/trace_events_hist.c ++++ b/kernel/trace/trace_events_hist.c +@@ -1684,9 +1684,10 @@ static struct hist_field *create_hist_field(struct hist_trigger_data *hist_data, + if (!hist_field->type) + goto free; + +- if (field->filter_type == FILTER_STATIC_STRING) ++ if (field->filter_type == FILTER_STATIC_STRING) { + hist_field->fn = hist_field_string; +- else if (field->filter_type == FILTER_DYN_STRING) ++ hist_field->size = field->size; ++ } else if (field->filter_type == FILTER_DYN_STRING) + hist_field->fn = hist_field_dynstring; + else + hist_field->fn = hist_field_pstring; +@@ -2624,7 +2625,7 @@ static inline void __update_field_vars(struct tracing_map_elt *elt, + char *str = elt_data->field_var_str[j++]; + char *val_str = (char *)(uintptr_t)var_val; + +- strscpy(str, val_str, STR_VAR_LEN_MAX); ++ strscpy(str, val_str, val->size); + var_val = (u64)(uintptr_t)str; + } + tracing_map_set_var(elt, var_idx, var_val); +@@ -4472,7 +4473,7 @@ static void hist_trigger_elt_update(struct hist_trigger_data *hist_data, + + str = elt_data->field_var_str[idx]; + val_str = (char *)(uintptr_t)hist_val; +- strscpy(str, val_str, STR_VAR_LEN_MAX); ++ strscpy(str, val_str, hist_field->size); + + hist_val = (u64)(uintptr_t)str; + } +-- +2.33.0 + diff --git a/queue-5.10/tty-tty_buffer-fix-the-softlockup-issue-in-flush_to_.patch b/queue-5.10/tty-tty_buffer-fix-the-softlockup-issue-in-flush_to_.patch new file mode 100644 index 00000000000..7bdce9659ec --- /dev/null +++ b/queue-5.10/tty-tty_buffer-fix-the-softlockup-issue-in-flush_to_.patch @@ -0,0 +1,69 @@ +From a804a0bc925556b9cdb879aea9b5e7da1c1c2888 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Oct 2021 22:08:24 +0800 +Subject: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc + +From: Guanghui Feng + +[ Upstream commit 3968ddcf05fb4b9409cd1859feb06a5b0550a1c1 ] + +When running ltp testcase(ltp/testcases/kernel/pty/pty04.c) with arm64, there is a soft lockup, +which look like this one: + + Workqueue: events_unbound flush_to_ldisc + Call trace: + dump_backtrace+0x0/0x1ec + show_stack+0x24/0x30 + dump_stack+0xd0/0x128 + panic+0x15c/0x374 + watchdog_timer_fn+0x2b8/0x304 + __run_hrtimer+0x88/0x2c0 + __hrtimer_run_queues+0xa4/0x120 + hrtimer_interrupt+0xfc/0x270 + arch_timer_handler_phys+0x40/0x50 + handle_percpu_devid_irq+0x94/0x220 + __handle_domain_irq+0x88/0xf0 + gic_handle_irq+0x84/0xfc + el1_irq+0xc8/0x180 + slip_unesc+0x80/0x214 [slip] + tty_ldisc_receive_buf+0x64/0x80 + tty_port_default_receive_buf+0x50/0x90 + flush_to_ldisc+0xbc/0x110 + process_one_work+0x1d4/0x4b0 + worker_thread+0x180/0x430 + kthread+0x11c/0x120 + +In the testcase pty04, The first process call the write syscall to send +data to the pty master. At the same time, the workqueue will do the +flush_to_ldisc to pop data in a loop until there is no more data left. +When the sender and workqueue running in different core, the sender sends +data fastly in full time which will result in workqueue doing work in loop +for a long time and occuring softlockup in flush_to_ldisc with kernel +configured without preempt. So I add need_resched check and cond_resched +in the flush_to_ldisc loop to avoid it. + +Signed-off-by: Guanghui Feng +Link: https://lore.kernel.org/r/1633961304-24759-1-git-send-email-guanghuifeng@linux.alibaba.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/tty_buffer.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c +index bd2d91546e327..0fc473321d3e3 100644 +--- a/drivers/tty/tty_buffer.c ++++ b/drivers/tty/tty_buffer.c +@@ -534,6 +534,9 @@ static void flush_to_ldisc(struct work_struct *work) + if (!count) + break; + head->read += count; ++ ++ if (need_resched()) ++ cond_resched(); + } + + mutex_unlock(&buf->lock); +-- +2.33.0 + diff --git a/queue-5.10/usb-host-ohci-tmio-check-return-value-after-calling-.patch b/queue-5.10/usb-host-ohci-tmio-check-return-value-after-calling-.patch new file mode 100644 index 00000000000..4d1fea614bd --- /dev/null +++ b/queue-5.10/usb-host-ohci-tmio-check-return-value-after-calling-.patch @@ -0,0 +1,38 @@ +From 4c4a93805c4b8f13a5d493fe5896423ecd7b2271 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Oct 2021 21:49:20 +0800 +Subject: usb: host: ohci-tmio: check return value after calling + platform_get_resource() + +From: Yang Yingliang + +[ Upstream commit 9eff2b2e59fda25051ab36cd1cb5014661df657b ] + +It will cause null-ptr-deref if platform_get_resource() returns NULL, +we need check the return value. + +Acked-by: Alan Stern +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20211011134920.118477-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/ohci-tmio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/ohci-tmio.c b/drivers/usb/host/ohci-tmio.c +index 08ec2ab0d95a5..3f3d62dc06746 100644 +--- a/drivers/usb/host/ohci-tmio.c ++++ b/drivers/usb/host/ohci-tmio.c +@@ -199,7 +199,7 @@ static int ohci_hcd_tmio_drv_probe(struct platform_device *dev) + if (usb_disabled()) + return -ENODEV; + +- if (!cell) ++ if (!cell || !regs || !config || !sram) + return -EINVAL; + + if (irq < 0) +-- +2.33.0 + diff --git a/queue-5.10/usb-musb-tusb6010-check-return-value-after-calling-p.patch b/queue-5.10/usb-musb-tusb6010-check-return-value-after-calling-p.patch new file mode 100644 index 00000000000..e007209868c --- /dev/null +++ b/queue-5.10/usb-musb-tusb6010-check-return-value-after-calling-p.patch @@ -0,0 +1,40 @@ +From 76d453fb498e8780176e3d544e57bf5d6d21d18b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Sep 2021 11:49:25 +0800 +Subject: usb: musb: tusb6010: check return value after calling + platform_get_resource() + +From: Yang Yingliang + +[ Upstream commit 14651496a3de6807a17c310f63c894ea0c5d858e ] + +It will cause null-ptr-deref if platform_get_resource() returns NULL, +we need check the return value. + +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20210915034925.2399823-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/musb/tusb6010.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c +index 0c2afed4131bc..038307f661985 100644 +--- a/drivers/usb/musb/tusb6010.c ++++ b/drivers/usb/musb/tusb6010.c +@@ -1103,6 +1103,11 @@ static int tusb_musb_init(struct musb *musb) + + /* dma address for async dma */ + mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!mem) { ++ pr_debug("no async dma resource?\n"); ++ ret = -ENODEV; ++ goto done; ++ } + musb->async = mem->start; + + /* dma address for sync dma */ +-- +2.33.0 + diff --git a/queue-5.10/usb-typec-tipd-remove-warn_on-in-tps6598x_block_read.patch b/queue-5.10/usb-typec-tipd-remove-warn_on-in-tps6598x_block_read.patch new file mode 100644 index 00000000000..6698269fcd0 --- /dev/null +++ b/queue-5.10/usb-typec-tipd-remove-warn_on-in-tps6598x_block_read.patch @@ -0,0 +1,38 @@ +From 105aba5392efeced95a9b7fde9860e2022c8a3fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Sep 2021 16:02:35 +0200 +Subject: usb: typec: tipd: Remove WARN_ON in tps6598x_block_read + +From: Sven Peter + +[ Upstream commit b7a0a63f3fed57d413bb857de164ea9c3984bc4e ] + +Calling tps6598x_block_read with a higher than allowed len can be +handled by just returning an error. There's no need to crash systems +with panic-on-warn enabled. + +Reviewed-by: Heikki Krogerus +Signed-off-by: Sven Peter +Link: https://lore.kernel.org/r/20210914140235.65955-3-sven@svenpeter.dev +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/tps6598x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/typec/tps6598x.c b/drivers/usb/typec/tps6598x.c +index 30bfc314b743c..6cb5c8e2c8535 100644 +--- a/drivers/usb/typec/tps6598x.c ++++ b/drivers/usb/typec/tps6598x.c +@@ -109,7 +109,7 @@ tps6598x_block_read(struct tps6598x *tps, u8 reg, void *val, size_t len) + u8 data[TPS_MAX_LEN + 1]; + int ret; + +- if (WARN_ON(len + 1 > sizeof(data))) ++ if (len + 1 > sizeof(data)) + return -EINVAL; + + if (!tps->i2c_protocol) +-- +2.33.0 +