From: Sasha Levin Date: Sun, 13 Feb 2022 05:47:34 +0000 (-0500) Subject: Fixes for 5.16 X-Git-Tag: v4.9.302~32 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b46c91cb16275892b1d4b04f277068212d3e88e9;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.16 Signed-off-by: Sasha Levin --- diff --git a/queue-5.16/acpi-pm-s2idle-cancel-wakeup-before-dispatching-ec-g.patch b/queue-5.16/acpi-pm-s2idle-cancel-wakeup-before-dispatching-ec-g.patch new file mode 100644 index 00000000000..ab2a6f445ff --- /dev/null +++ b/queue-5.16/acpi-pm-s2idle-cancel-wakeup-before-dispatching-ec-g.patch @@ -0,0 +1,81 @@ +From 617ff015c5756e0bdcb8578faf79df4a7845f380 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Feb 2022 18:31:02 +0100 +Subject: ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE + +From: Rafael J. Wysocki + +[ Upstream commit dc0075ba7f387fe4c48a8c674b11ab6f374a6acc ] + +Commit 4a9af6cac050 ("ACPI: EC: Rework flushing of EC work while +suspended to idle") made acpi_ec_dispatch_gpe() check +pm_wakeup_pending(), but that is before canceling the SCI wakeup, +so pm_wakeup_pending() is always true. This causes the loop in +acpi_ec_dispatch_gpe() to always terminate after one iteration which +may not be correct. + +Address this issue by canceling the SCI wakeup earlier, from +acpi_ec_dispatch_gpe() itself. + +Fixes: 4a9af6cac050 ("ACPI: EC: Rework flushing of EC work while suspended to idle") +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/ec.c | 10 ++++++++++ + drivers/acpi/sleep.c | 14 ++++---------- + 2 files changed, 14 insertions(+), 10 deletions(-) + +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index b9c44e6c5e400..1712990bf2ad8 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -2051,6 +2051,16 @@ bool acpi_ec_dispatch_gpe(void) + if (acpi_any_gpe_status_set(first_ec->gpe)) + return true; + ++ /* ++ * Cancel the SCI wakeup and process all pending events in case there ++ * are any wakeup ones in there. ++ * ++ * Note that if any non-EC GPEs are active at this point, the SCI will ++ * retrigger after the rearming in acpi_s2idle_wake(), so no events ++ * should be missed by canceling the wakeup here. ++ */ ++ pm_system_cancel_wakeup(); ++ + /* + * Dispatch the EC GPE in-band, but do not report wakeup in any case + * to allow the caller to process events properly after that. +diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c +index 9f237dc9d45fc..8513410ca2fc2 100644 +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -739,21 +739,15 @@ bool acpi_s2idle_wake(void) + return true; + } + +- /* Check non-EC GPE wakeups and dispatch the EC GPE. */ ++ /* ++ * Check non-EC GPE wakeups and if there are none, cancel the ++ * SCI-related wakeup and dispatch the EC GPE. ++ */ + if (acpi_ec_dispatch_gpe()) { + pm_pr_dbg("ACPI non-EC GPE wakeup\n"); + return true; + } + +- /* +- * Cancel the SCI wakeup and process all pending events in case +- * there are any wakeup ones in there. +- * +- * Note that if any non-EC GPEs are active at this point, the +- * SCI will retrigger after the rearming below, so no events +- * should be missed by canceling the wakeup here. +- */ +- pm_system_cancel_wakeup(); + acpi_os_wait_events_complete(); + + /* +-- +2.34.1 + diff --git a/queue-5.16/arm-dts-fix-timer-regression-for-beagleboard-revisio.patch b/queue-5.16/arm-dts-fix-timer-regression-for-beagleboard-revisio.patch new file mode 100644 index 00000000000..6df0ff1dcaa --- /dev/null +++ b/queue-5.16/arm-dts-fix-timer-regression-for-beagleboard-revisio.patch @@ -0,0 +1,180 @@ +From f96b5c79f8df924b980a18557b9019ae9857b7de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Nov 2021 16:48:34 +0200 +Subject: ARM: dts: Fix timer regression for beagleboard revision c + +From: Tony Lindgren + +[ Upstream commit 23885389dbbbbc698986e77a45c1fc44a6e3632e ] + +Commit e428e250fde6 ("ARM: dts: Configure system timers for omap3") +caused a timer regression for beagleboard revision c where the system +clockevent stops working if omap3isp module is unloaded. + +Turns out we still have beagleboard revisions a-b4 capacitor c70 quirks +applied that limit the usable timers for no good reason. This also affects +the power management as we use the system clock instead of the 32k clock +source. + +Let's fix the issue by adding a new omap3-beagle-ab4.dts for the old timer +quirks. This allows us to remove the timer quirks for later beagleboard +revisions. We also need to update the related timer quirk check for the +correct compatible property. + +Fixes: e428e250fde6 ("ARM: dts: Configure system timers for omap3") +Cc: linux-kernel@vger.kernel.org +Cc: Daniel Lezcano +Cc: Thomas Gleixner +Cc: Rob Herring +Reported-by: Jarkko Nikula +Tested-by: Jarkko Nikula +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + .../devicetree/bindings/arm/omap/omap.txt | 3 ++ + arch/arm/boot/dts/Makefile | 1 + + arch/arm/boot/dts/omap3-beagle-ab4.dts | 47 +++++++++++++++++++ + arch/arm/boot/dts/omap3-beagle.dts | 33 ------------- + drivers/clocksource/timer-ti-dm-systimer.c | 2 +- + 5 files changed, 52 insertions(+), 34 deletions(-) + create mode 100644 arch/arm/boot/dts/omap3-beagle-ab4.dts + +diff --git a/Documentation/devicetree/bindings/arm/omap/omap.txt b/Documentation/devicetree/bindings/arm/omap/omap.txt +index e77635c5422c6..fa8b31660cadd 100644 +--- a/Documentation/devicetree/bindings/arm/omap/omap.txt ++++ b/Documentation/devicetree/bindings/arm/omap/omap.txt +@@ -119,6 +119,9 @@ Boards (incomplete list of examples): + - OMAP3 BeagleBoard : Low cost community board + compatible = "ti,omap3-beagle", "ti,omap3430", "ti,omap3" + ++- OMAP3 BeagleBoard A to B4 : Early BeagleBoard revisions A to B4 with a timer quirk ++ compatible = "ti,omap3-beagle-ab4", "ti,omap3-beagle", "ti,omap3430", "ti,omap3" ++ + - OMAP3 Tobi with Overo : Commercial expansion board with daughter board + compatible = "gumstix,omap3-overo-tobi", "gumstix,omap3-overo", "ti,omap3430", "ti,omap3" + +diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile +index 0de64f237cd87..a387ebe8919b1 100644 +--- a/arch/arm/boot/dts/Makefile ++++ b/arch/arm/boot/dts/Makefile +@@ -794,6 +794,7 @@ dtb-$(CONFIG_ARCH_OMAP3) += \ + logicpd-som-lv-37xx-devkit.dtb \ + omap3430-sdp.dtb \ + omap3-beagle.dtb \ ++ omap3-beagle-ab4.dtb \ + omap3-beagle-xm.dtb \ + omap3-beagle-xm-ab.dtb \ + omap3-cm-t3517.dtb \ +diff --git a/arch/arm/boot/dts/omap3-beagle-ab4.dts b/arch/arm/boot/dts/omap3-beagle-ab4.dts +new file mode 100644 +index 0000000000000..990ff2d846868 +--- /dev/null ++++ b/arch/arm/boot/dts/omap3-beagle-ab4.dts +@@ -0,0 +1,47 @@ ++// SPDX-License-Identifier: GPL-2.0-only ++/dts-v1/; ++ ++#include "omap3-beagle.dts" ++ ++/ { ++ model = "TI OMAP3 BeagleBoard A to B4"; ++ compatible = "ti,omap3-beagle-ab4", "ti,omap3-beagle", "ti,omap3430", "ti,omap3"; ++}; ++ ++/* ++ * Workaround for capacitor C70 issue, see "Boards revision A and < B5" ++ * section at https://elinux.org/BeagleBoard_Community ++ */ ++ ++/* Unusable as clocksource because of unreliable oscillator */ ++&counter32k { ++ status = "disabled"; ++}; ++ ++/* Unusable as clockevent because of unreliable oscillator, allow to idle */ ++&timer1_target { ++ /delete-property/ti,no-reset-on-init; ++ /delete-property/ti,no-idle; ++ timer@0 { ++ /delete-property/ti,timer-alwon; ++ }; ++}; ++ ++/* Preferred always-on timer for clocksource */ ++&timer12_target { ++ ti,no-reset-on-init; ++ ti,no-idle; ++ timer@0 { ++ /* Always clocked by secure_32k_fck */ ++ }; ++}; ++ ++/* Preferred timer for clockevent */ ++&timer2_target { ++ ti,no-reset-on-init; ++ ti,no-idle; ++ timer@0 { ++ assigned-clocks = <&gpt2_fck>; ++ assigned-clock-parents = <&sys_ck>; ++ }; ++}; +diff --git a/arch/arm/boot/dts/omap3-beagle.dts b/arch/arm/boot/dts/omap3-beagle.dts +index f9f34b8458e91..0548b391334fd 100644 +--- a/arch/arm/boot/dts/omap3-beagle.dts ++++ b/arch/arm/boot/dts/omap3-beagle.dts +@@ -304,39 +304,6 @@ &usbhsehci { + phys = <0 &hsusb2_phy>; + }; + +-/* Unusable as clocksource because of unreliable oscillator */ +-&counter32k { +- status = "disabled"; +-}; +- +-/* Unusable as clockevent because if unreliable oscillator, allow to idle */ +-&timer1_target { +- /delete-property/ti,no-reset-on-init; +- /delete-property/ti,no-idle; +- timer@0 { +- /delete-property/ti,timer-alwon; +- }; +-}; +- +-/* Preferred always-on timer for clocksource */ +-&timer12_target { +- ti,no-reset-on-init; +- ti,no-idle; +- timer@0 { +- /* Always clocked by secure_32k_fck */ +- }; +-}; +- +-/* Preferred timer for clockevent */ +-&timer2_target { +- ti,no-reset-on-init; +- ti,no-idle; +- timer@0 { +- assigned-clocks = <&gpt2_fck>; +- assigned-clock-parents = <&sys_ck>; +- }; +-}; +- + &twl_gpio { + ti,use-leds; + /* pullups: BIT(1) */ +diff --git a/drivers/clocksource/timer-ti-dm-systimer.c b/drivers/clocksource/timer-ti-dm-systimer.c +index b6f97960d8ee0..5c40ca1d4740e 100644 +--- a/drivers/clocksource/timer-ti-dm-systimer.c ++++ b/drivers/clocksource/timer-ti-dm-systimer.c +@@ -241,7 +241,7 @@ static void __init dmtimer_systimer_assign_alwon(void) + bool quirk_unreliable_oscillator = false; + + /* Quirk unreliable 32 KiHz oscillator with incomplete dts */ +- if (of_machine_is_compatible("ti,omap3-beagle") || ++ if (of_machine_is_compatible("ti,omap3-beagle-ab4") || + of_machine_is_compatible("timll,omap3-devkit8000")) { + quirk_unreliable_oscillator = true; + counter_32k = -ENODEV; +-- +2.34.1 + diff --git a/queue-5.16/arm-dts-imx6qdl-udoo-properly-describe-the-sd-card-d.patch b/queue-5.16/arm-dts-imx6qdl-udoo-properly-describe-the-sd-card-d.patch new file mode 100644 index 00000000000..7d2c2896634 --- /dev/null +++ b/queue-5.16/arm-dts-imx6qdl-udoo-properly-describe-the-sd-card-d.patch @@ -0,0 +1,54 @@ +From feda021b8530f089dfc6595cd028789d68ab5928 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Dec 2021 19:42:15 -0300 +Subject: ARM: dts: imx6qdl-udoo: Properly describe the SD card detect + +From: Fabio Estevam + +[ Upstream commit 993d66140f8d1c1853a3b58b77b43b681eb64dee ] + +GPIO7_IO00 is used as SD card detect. + +Properly describe this in the devicetree. + +Fixes: 40cdaa542cf0 ("ARM: dts: imx6q-udoo: Add initial board support") +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-udoo.dtsi | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-udoo.dtsi b/arch/arm/boot/dts/imx6qdl-udoo.dtsi +index d07d8f83456d2..ccfa8e320be62 100644 +--- a/arch/arm/boot/dts/imx6qdl-udoo.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-udoo.dtsi +@@ -5,6 +5,8 @@ + * Author: Fabio Estevam + */ + ++#include ++ + / { + aliases { + backlight = &backlight; +@@ -226,6 +228,7 @@ MX6QDL_PAD_SD3_DAT0__SD3_DATA0 0x17059 + MX6QDL_PAD_SD3_DAT1__SD3_DATA1 0x17059 + MX6QDL_PAD_SD3_DAT2__SD3_DATA2 0x17059 + MX6QDL_PAD_SD3_DAT3__SD3_DATA3 0x17059 ++ MX6QDL_PAD_SD3_DAT5__GPIO7_IO00 0x1b0b0 + >; + }; + +@@ -304,7 +307,7 @@ &usbotg { + &usdhc3 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_usdhc3>; +- non-removable; ++ cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>; + status = "okay"; + }; + +-- +2.34.1 + diff --git a/queue-5.16/arm-dts-imx7ulp-fix-assigned-clocks-parents-typo.patch b/queue-5.16/arm-dts-imx7ulp-fix-assigned-clocks-parents-typo.patch new file mode 100644 index 00000000000..6dbe89cbb92 --- /dev/null +++ b/queue-5.16/arm-dts-imx7ulp-fix-assigned-clocks-parents-typo.patch @@ -0,0 +1,37 @@ +From de27eaa12e357d3affa6f36b1815db047400677b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jan 2022 11:23:55 -0600 +Subject: ARM: dts: imx7ulp: Fix 'assigned-clocks-parents' typo + +From: Rob Herring + +[ Upstream commit 6d58c5e21a3fe355ce6d1808e96d02a610265218 ] + +The correct property name is 'assigned-clock-parents', not +'assigned-clocks-parents'. Though if the platform works with the typo, one +has to wonder if the property is even needed. + +Signed-off-by: Rob Herring +Fixes: 8b8c7d97e2c7 ("ARM: dts: imx7ulp: Add wdog1 node") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx7ulp.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx7ulp.dtsi b/arch/arm/boot/dts/imx7ulp.dtsi +index b7ea37ad4e55c..bcec98b964114 100644 +--- a/arch/arm/boot/dts/imx7ulp.dtsi ++++ b/arch/arm/boot/dts/imx7ulp.dtsi +@@ -259,7 +259,7 @@ wdog1: watchdog@403d0000 { + interrupts = ; + clocks = <&pcc2 IMX7ULP_CLK_WDG1>; + assigned-clocks = <&pcc2 IMX7ULP_CLK_WDG1>; +- assigned-clocks-parents = <&scg1 IMX7ULP_CLK_FIRC_BUS_CLK>; ++ assigned-clock-parents = <&scg1 IMX7ULP_CLK_FIRC_BUS_CLK>; + timeout-sec = <40>; + }; + +-- +2.34.1 + diff --git a/queue-5.16/arm-dts-meson-fix-the-uart-compatible-strings.patch b/queue-5.16/arm-dts-meson-fix-the-uart-compatible-strings.patch new file mode 100644 index 00000000000..66c1e655d04 --- /dev/null +++ b/queue-5.16/arm-dts-meson-fix-the-uart-compatible-strings.patch @@ -0,0 +1,70 @@ +From a422838c0fd1addfe19edb21eed62df9e2fabc7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Dec 2021 19:00:24 +0100 +Subject: ARM: dts: meson: Fix the UART compatible strings + +From: Martin Blumenstingl + +[ Upstream commit 5225e1b87432dcf0d0fc3440824b91d04c1d6cc1 ] + +The dt-bindings for the UART controller only allow the following values +for Meson6 SoCs: +- "amlogic,meson6-uart", "amlogic,meson-ao-uart" +- "amlogic,meson6-uart" + +Use the correct fallback compatible string "amlogic,meson-ao-uart" for +AO UART. Drop the "amlogic,meson-uart" compatible string from the EE +domain UART controllers. + +Fixes: ec9b59162fd831 ("ARM: dts: meson6: use stable UART bindings") +Signed-off-by: Martin Blumenstingl +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20211227180026.4068352-2-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/meson.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/meson.dtsi b/arch/arm/boot/dts/meson.dtsi +index 3be7cba603d5a..26eaba3fa96f3 100644 +--- a/arch/arm/boot/dts/meson.dtsi ++++ b/arch/arm/boot/dts/meson.dtsi +@@ -59,7 +59,7 @@ hwrng: rng@8100 { + }; + + uart_A: serial@84c0 { +- compatible = "amlogic,meson6-uart", "amlogic,meson-uart"; ++ compatible = "amlogic,meson6-uart"; + reg = <0x84c0 0x18>; + interrupts = ; + fifo-size = <128>; +@@ -67,7 +67,7 @@ uart_A: serial@84c0 { + }; + + uart_B: serial@84dc { +- compatible = "amlogic,meson6-uart", "amlogic,meson-uart"; ++ compatible = "amlogic,meson6-uart"; + reg = <0x84dc 0x18>; + interrupts = ; + status = "disabled"; +@@ -105,7 +105,7 @@ saradc: adc@8680 { + }; + + uart_C: serial@8700 { +- compatible = "amlogic,meson6-uart", "amlogic,meson-uart"; ++ compatible = "amlogic,meson6-uart"; + reg = <0x8700 0x18>; + interrupts = ; + status = "disabled"; +@@ -228,7 +228,7 @@ ir_receiver: ir-receiver@480 { + }; + + uart_AO: serial@4c0 { +- compatible = "amlogic,meson6-uart", "amlogic,meson-ao-uart", "amlogic,meson-uart"; ++ compatible = "amlogic,meson6-uart", "amlogic,meson-ao-uart"; + reg = <0x4c0 0x18>; + interrupts = ; + status = "disabled"; +-- +2.34.1 + diff --git a/queue-5.16/arm-dts-meson8-fix-the-uart-device-tree-schema-valid.patch b/queue-5.16/arm-dts-meson8-fix-the-uart-device-tree-schema-valid.patch new file mode 100644 index 00000000000..7f34df5ce9b --- /dev/null +++ b/queue-5.16/arm-dts-meson8-fix-the-uart-device-tree-schema-valid.patch @@ -0,0 +1,77 @@ +From 9914de96a373af813b0d1d7b92bb6c74313ec853 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Dec 2021 19:00:25 +0100 +Subject: ARM: dts: meson8: Fix the UART device-tree schema validation + +From: Martin Blumenstingl + +[ Upstream commit 57007bfb5469ba31cacf69d52195e8b75f43e32d ] + +The dt-bindings for the UART controller only allow the following values +for Meson8 SoCs: +- "amlogic,meson8-uart", "amlogic,meson-ao-uart" +- "amlogic,meson8-uart" + +Use the correct fallback compatible string "amlogic,meson-ao-uart" for +AO UART. Drop the "amlogic,meson-uart" compatible string from the EE +domain UART controllers. + +Also update the order of the clocks to match the order defined in the +yaml schema. + +Fixes: 6ca77502050eff ("ARM: dts: meson8: use stable UART bindings with correct gate clock") +Signed-off-by: Martin Blumenstingl +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20211227180026.4068352-3-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/meson8.dtsi | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/arch/arm/boot/dts/meson8.dtsi b/arch/arm/boot/dts/meson8.dtsi +index f80ddc98d3a2b..9997a5d0333a3 100644 +--- a/arch/arm/boot/dts/meson8.dtsi ++++ b/arch/arm/boot/dts/meson8.dtsi +@@ -736,27 +736,27 @@ &timer_abcde { + }; + + &uart_AO { +- compatible = "amlogic,meson8-uart", "amlogic,meson-uart"; +- clocks = <&clkc CLKID_CLK81>, <&xtal>, <&clkc CLKID_CLK81>; +- clock-names = "baud", "xtal", "pclk"; ++ compatible = "amlogic,meson8-uart", "amlogic,meson-ao-uart"; ++ clocks = <&xtal>, <&clkc CLKID_CLK81>, <&clkc CLKID_CLK81>; ++ clock-names = "xtal", "pclk", "baud"; + }; + + &uart_A { +- compatible = "amlogic,meson8-uart", "amlogic,meson-uart"; +- clocks = <&clkc CLKID_CLK81>, <&xtal>, <&clkc CLKID_UART0>; +- clock-names = "baud", "xtal", "pclk"; ++ compatible = "amlogic,meson8-uart"; ++ clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>; ++ clock-names = "xtal", "pclk", "baud"; + }; + + &uart_B { +- compatible = "amlogic,meson8-uart", "amlogic,meson-uart"; +- clocks = <&clkc CLKID_CLK81>, <&xtal>, <&clkc CLKID_UART1>; +- clock-names = "baud", "xtal", "pclk"; ++ compatible = "amlogic,meson8-uart"; ++ clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>; ++ clock-names = "xtal", "pclk", "baud"; + }; + + &uart_C { +- compatible = "amlogic,meson8-uart", "amlogic,meson-uart"; +- clocks = <&clkc CLKID_CLK81>, <&xtal>, <&clkc CLKID_UART2>; +- clock-names = "baud", "xtal", "pclk"; ++ compatible = "amlogic,meson8-uart"; ++ clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>; ++ clock-names = "xtal", "pclk", "baud"; + }; + + &usb0 { +-- +2.34.1 + diff --git a/queue-5.16/arm-dts-meson8b-fix-the-uart-device-tree-schema-vali.patch b/queue-5.16/arm-dts-meson8b-fix-the-uart-device-tree-schema-vali.patch new file mode 100644 index 00000000000..394baa96dfd --- /dev/null +++ b/queue-5.16/arm-dts-meson8b-fix-the-uart-device-tree-schema-vali.patch @@ -0,0 +1,77 @@ +From 62dc04282ad056055bf5c07954dd3cc23ee78ed8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Dec 2021 19:00:26 +0100 +Subject: ARM: dts: meson8b: Fix the UART device-tree schema validation + +From: Martin Blumenstingl + +[ Upstream commit 3375aa77135f6aeb1107ed839a2050a4118444bc ] + +The dt-bindings for the UART controller only allow the following values +for Meson8 SoCs: +- "amlogic,meson8b-uart", "amlogic,meson-ao-uart" +- "amlogic,meson8b-uart" + +Use the correct fallback compatible string "amlogic,meson-ao-uart" for +AO UART. Drop the "amlogic,meson-uart" compatible string from the EE +domain UART controllers. + +Also update the order of the clocks to match the order defined in the +yaml bindings. + +Fixes: b02d6e73f5fc96 ("ARM: dts: meson8b: use stable UART bindings with correct gate clock") +Signed-off-by: Martin Blumenstingl +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20211227180026.4068352-4-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/meson8b.dtsi | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/arch/arm/boot/dts/meson8b.dtsi b/arch/arm/boot/dts/meson8b.dtsi +index b49b7cbaed4ee..94f1c03deccef 100644 +--- a/arch/arm/boot/dts/meson8b.dtsi ++++ b/arch/arm/boot/dts/meson8b.dtsi +@@ -724,27 +724,27 @@ &timer_abcde { + }; + + &uart_AO { +- compatible = "amlogic,meson8b-uart", "amlogic,meson-uart"; +- clocks = <&clkc CLKID_CLK81>, <&xtal>, <&clkc CLKID_CLK81>; +- clock-names = "baud", "xtal", "pclk"; ++ compatible = "amlogic,meson8b-uart", "amlogic,meson-ao-uart"; ++ clocks = <&xtal>, <&clkc CLKID_CLK81>, <&clkc CLKID_CLK81>; ++ clock-names = "xtal", "pclk", "baud"; + }; + + &uart_A { +- compatible = "amlogic,meson8b-uart", "amlogic,meson-uart"; +- clocks = <&clkc CLKID_CLK81>, <&xtal>, <&clkc CLKID_UART0>; +- clock-names = "baud", "xtal", "pclk"; ++ compatible = "amlogic,meson8b-uart"; ++ clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>; ++ clock-names = "xtal", "pclk", "baud"; + }; + + &uart_B { +- compatible = "amlogic,meson8b-uart", "amlogic,meson-uart"; +- clocks = <&clkc CLKID_CLK81>, <&xtal>, <&clkc CLKID_UART1>; +- clock-names = "baud", "xtal", "pclk"; ++ compatible = "amlogic,meson8b-uart"; ++ clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>; ++ clock-names = "xtal", "pclk", "baud"; + }; + + &uart_C { +- compatible = "amlogic,meson8b-uart", "amlogic,meson-uart"; +- clocks = <&clkc CLKID_CLK81>, <&xtal>, <&clkc CLKID_UART2>; +- clock-names = "baud", "xtal", "pclk"; ++ compatible = "amlogic,meson8b-uart"; ++ clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>; ++ clock-names = "xtal", "pclk", "baud"; + }; + + &usb0 { +-- +2.34.1 + diff --git a/queue-5.16/arm64-dts-imx8mq-fix-mipi_csi-bidirectional-port-num.patch b/queue-5.16/arm64-dts-imx8mq-fix-mipi_csi-bidirectional-port-num.patch new file mode 100644 index 00000000000..791a27e851f --- /dev/null +++ b/queue-5.16/arm64-dts-imx8mq-fix-mipi_csi-bidirectional-port-num.patch @@ -0,0 +1,51 @@ +From 5115a1557657aba633e30bd9f4d5e02bbbbb5110 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 10:33:25 +0100 +Subject: arm64: dts: imx8mq: fix mipi_csi bidirectional port numbers + +From: Martin Kepplinger + +[ Upstream commit 283d45145fbf460dbaf0229cacd7ed60ec52f364 ] + +The port numbers for the imx8mq mipi csi controller are wrong and +the mipi driver can't find any media devices as port@1 is connected +to the CSI bridge, not port@0. And port@0 is connected to the +source - the sensor. Fix this. + +Fixes: bcadd5f66c2a ("arm64: dts: imx8mq: add mipi csi phy and csi bridge descriptions") +Signed-off-by: Martin Kepplinger +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mq.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mq.dtsi b/arch/arm64/boot/dts/freescale/imx8mq.dtsi +index 71bf497f99c25..c222d93f5e649 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mq.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mq.dtsi +@@ -1123,8 +1123,8 @@ ports { + #address-cells = <1>; + #size-cells = <0>; + +- port@0 { +- reg = <0>; ++ port@1 { ++ reg = <1>; + + csi1_mipi_ep: endpoint { + remote-endpoint = <&csi1_ep>; +@@ -1175,8 +1175,8 @@ ports { + #address-cells = <1>; + #size-cells = <0>; + +- port@0 { +- reg = <0>; ++ port@1 { ++ reg = <1>; + + csi2_mipi_ep: endpoint { + remote-endpoint = <&csi2_ep>; +-- +2.34.1 + diff --git a/queue-5.16/arm64-dts-meson-g12b-odroid-n2-fix-typo-dio2133.patch b/queue-5.16/arm64-dts-meson-g12b-odroid-n2-fix-typo-dio2133.patch new file mode 100644 index 00000000000..c69e5313ce6 --- /dev/null +++ b/queue-5.16/arm64-dts-meson-g12b-odroid-n2-fix-typo-dio2133.patch @@ -0,0 +1,47 @@ +From f085bcc8a0f6b94fb528a2f92ae4d07b8b66dd77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jan 2022 21:29:25 +0900 +Subject: arm64: dts: meson-g12b-odroid-n2: fix typo 'dio2133' + +From: Dongjin Kim + +[ Upstream commit bc41099f060ea74ac8d02c51bd0f5f46d969bedf ] + +Typo in audio amplifier node, dioo2133 -> dio2133 + +Signed-off-by: Dongjin Kim +Fixes: ef599f5f3e10 ("arm64: dts: meson: convert ODROID-N2 to dtsi") +Fixes: 67d141c1f8e6 ("arm64: dts: meson: odroid-n2: add jack audio output support") +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/YfKQJejh0bfGYvof@anyang +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi +index 3e968b2441918..fd3fa82e4c330 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi +@@ -17,7 +17,7 @@ aliases { + rtc1 = &vrtc; + }; + +- dioo2133: audio-amplifier-0 { ++ dio2133: audio-amplifier-0 { + compatible = "simple-audio-amplifier"; + enable-gpios = <&gpio_ao GPIOAO_2 GPIO_ACTIVE_HIGH>; + VCC-supply = <&vcc_5v>; +@@ -219,7 +219,7 @@ sound { + audio-widgets = "Line", "Lineout"; + audio-aux-devs = <&tdmout_b>, <&tdmout_c>, <&tdmin_a>, + <&tdmin_b>, <&tdmin_c>, <&tdmin_lb>, +- <&dioo2133>; ++ <&dio2133>; + audio-routing = "TDMOUT_B IN 0", "FRDDR_A OUT 1", + "TDMOUT_B IN 1", "FRDDR_B OUT 1", + "TDMOUT_B IN 2", "FRDDR_C OUT 1", +-- +2.34.1 + diff --git a/queue-5.16/arm64-dts-meson-sm1-bananapi-m5-fix-wrong-gpio-domai.patch b/queue-5.16/arm64-dts-meson-sm1-bananapi-m5-fix-wrong-gpio-domai.patch new file mode 100644 index 00000000000..9b63bce02a9 --- /dev/null +++ b/queue-5.16/arm64-dts-meson-sm1-bananapi-m5-fix-wrong-gpio-domai.patch @@ -0,0 +1,39 @@ +From 8b3896c9a7449540069ddd0fbb87f4840f721760 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jan 2022 00:16:56 +0900 +Subject: arm64: dts: meson-sm1-bananapi-m5: fix wrong GPIO domain for GPIOE_2 + +From: Dongjin Kim + +[ Upstream commit a5be3e5d46f373fe1d2ee835c7ede31769c241cd ] + +GPIOE_2 is in AO domain and "<&gpio GPIOE_2 ...>" changes the state of +TF_PWR_EN of 'FC8731' on BPI-M5 + +Fixes: 976e920183e4 ("arm64: dts: meson-sm1: add Banana PI BPI-M5 board dts") + +Signed-off-by: Dongjin Kim +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20220127151656.GA2419733@paju +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts +index 212c6aa5a3b86..5751c48620edf 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts +@@ -123,7 +123,7 @@ vddio_c: regulator-vddio_c { + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; + +- enable-gpio = <&gpio GPIOE_2 GPIO_ACTIVE_HIGH>; ++ enable-gpio = <&gpio_ao GPIOE_2 GPIO_ACTIVE_HIGH>; + enable-active-high; + regulator-always-on; + +-- +2.34.1 + diff --git a/queue-5.16/arm64-dts-meson-sm1-odroid-fix-boot-loop-after-reboo.patch b/queue-5.16/arm64-dts-meson-sm1-odroid-fix-boot-loop-after-reboo.patch new file mode 100644 index 00000000000..3693c12703f --- /dev/null +++ b/queue-5.16/arm64-dts-meson-sm1-odroid-fix-boot-loop-after-reboo.patch @@ -0,0 +1,51 @@ +From 7804c0fa82ba7da7bf13112217917a8d5d93c60f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jan 2022 20:31:50 +0100 +Subject: arm64: dts: meson-sm1-odroid: fix boot loop after reboot + +From: Lutz Koschorreck + +[ Upstream commit e6b03375132fefddc55cf700418cf794b3884e0c ] + +Since the correct gpio pin is used for enabling tf-io regulator the +system did not boot correctly after calling reboot. + +[ 36.862443] reboot: Restarting system +bl31 reboot reason: 0xd +bl31 reboot reason: 0x0 +system cmd 1. +SM1:BL:511f6b:81ca2f;FEAT:A0F83180:20282000;POC:B;RCY:0;SPINOR:0;CHK:1F;EMMC:800;NAND:81;SD?:0;SD:0;READ:0;0.0;CHK:0; +bl2_stage_init 0x01 +bl2_stage_init 0x81 +hw id: +SM1:BL:511f6b:81ca2f;FEAT:A0F83180:20282000;POC:B;RCY:0;SPINOR:0;CHK:1F;EMMC:800;NAND:81;SD?:0;SD:400;USB:8;LOOP:1;... + +Setting the gpio to open drain solves the issue. + +Fixes: 1f80a5cf74a6 ("arm64: dts: meson-sm1-odroid: add missing enable gpio and supply for tf_io regulator") +Signed-off-by: Lutz Koschorreck +Reviewed-by: Neil Armstrong +[narmstrong: reduced serial log & removed invalid character in commit message] +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20220128193150.GA1304381@odroid-VirtualBox +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-sm1-odroid.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid.dtsi b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid.dtsi +index 328f4adfaaa9d..76ad052fbf0c9 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid.dtsi +@@ -48,7 +48,7 @@ tf_io: gpio-regulator-tf_io { + regulator-max-microvolt = <3300000>; + vin-supply = <&vcc_5v>; + +- enable-gpio = <&gpio_ao GPIOE_2 GPIO_ACTIVE_HIGH>; ++ enable-gpio = <&gpio_ao GPIOE_2 GPIO_OPEN_DRAIN>; + enable-active-high; + regulator-always-on; + +-- +2.34.1 + diff --git a/queue-5.16/arm64-dts-meson-sm1-odroid-use-correct-enable-gpio-p.patch b/queue-5.16/arm64-dts-meson-sm1-odroid-use-correct-enable-gpio-p.patch new file mode 100644 index 00000000000..47dd969d96f --- /dev/null +++ b/queue-5.16/arm64-dts-meson-sm1-odroid-use-correct-enable-gpio-p.patch @@ -0,0 +1,71 @@ +From 6d84f1247121ee9a5ed2b12d813559a72025dd78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jan 2022 14:05:37 +0100 +Subject: arm64: dts: meson-sm1-odroid: use correct enable-gpio pin for tf-io + regulator + +From: Lutz Koschorreck + +[ Upstream commit 323ca765bfe9d637fa774373baec0bc41e51fcfa ] + +The interrupt pin of the external ethernet phy is used, instead of the +enable-gpio pin of the tf-io regulator. The GPIOE_2 pin is located in +the gpio_ao bank. + +This causes phy interrupt problems at system startup. +[ 76.645190] irq 36: nobody cared (try booting with the "irqpoll" option) +[ 76.649617] CPU: 0 PID: 1416 Comm: irq/36-0.0:00 Not tainted 5.16.0 #2 +[ 76.649629] Hardware name: Hardkernel ODROID-HC4 (DT) +[ 76.649635] Call trace: +[ 76.649638] dump_backtrace+0x0/0x1c8 +[ 76.649658] show_stack+0x14/0x60 +[ 76.649667] dump_stack_lvl+0x64/0x7c +[ 76.649676] dump_stack+0x14/0x2c +[ 76.649683] __report_bad_irq+0x38/0xe8 +[ 76.649695] note_interrupt+0x220/0x3a0 +[ 76.649704] handle_irq_event_percpu+0x58/0x88 +[ 76.649713] handle_irq_event+0x44/0xd8 +[ 76.649721] handle_fasteoi_irq+0xa8/0x130 +[ 76.649730] generic_handle_domain_irq+0x38/0x58 +[ 76.649738] gic_handle_irq+0x9c/0xb8 +[ 76.649747] call_on_irq_stack+0x28/0x38 +[ 76.649755] do_interrupt_handler+0x7c/0x80 +[ 76.649763] el1_interrupt+0x34/0x80 +[ 76.649772] el1h_64_irq_handler+0x14/0x20 +[ 76.649781] el1h_64_irq+0x74/0x78 +[ 76.649788] irq_finalize_oneshot.part.56+0x68/0xf8 +[ 76.649796] irq_thread_fn+0x5c/0x98 +[ 76.649804] irq_thread+0x13c/0x260 +[ 76.649812] kthread+0x144/0x178 +[ 76.649822] ret_from_fork+0x10/0x20 +[ 76.649830] handlers: +[ 76.653170] [<0000000025a6cd31>] irq_default_primary_handler threaded [<0000000093580eb7>] phy_interrupt +[ 76.661256] Disabling IRQ #36 + +Fixes: 1f80a5cf74a6 ("arm64: dts: meson-sm1-odroid: add missing enable gpio and supply for tf_io regulator") +Signed-off-by: Lutz Koschorreck +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +[narmstrong: removed spurious invalid & blank lines from commit message] +Link: https://lore.kernel.org/r/20220127130537.GA187347@odroid-VirtualBox +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-sm1-odroid.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid.dtsi b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid.dtsi +index 5779e70caccd3..328f4adfaaa9d 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid.dtsi +@@ -48,7 +48,7 @@ tf_io: gpio-regulator-tf_io { + regulator-max-microvolt = <3300000>; + vin-supply = <&vcc_5v>; + +- enable-gpio = <&gpio GPIOE_2 GPIO_ACTIVE_HIGH>; ++ enable-gpio = <&gpio_ao GPIOE_2 GPIO_ACTIVE_HIGH>; + enable-active-high; + regulator-always-on; + +-- +2.34.1 + diff --git a/queue-5.16/arm64-enable-cortex-a510-erratum-2051678-by-default.patch b/queue-5.16/arm64-enable-cortex-a510-erratum-2051678-by-default.patch new file mode 100644 index 00000000000..1b2fb629aa7 --- /dev/null +++ b/queue-5.16/arm64-enable-cortex-a510-erratum-2051678-by-default.patch @@ -0,0 +1,38 @@ +From 5a42909dffbfb9a6f7fb0cb38cae249094736e43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Feb 2022 14:48:38 +0000 +Subject: arm64: Enable Cortex-A510 erratum 2051678 by default + +From: Mark Brown + +[ Upstream commit a4b92cebc31d49b7e6ef0ce584c7f2a2e112877d ] + +The recently added configuration option for Cortex A510 erratum 2051678 does +not have a "default y" unlike other errata fixes. This appears to simply be +an oversight since the help text suggests enabling the option if unsure and +there's nothing in the commit log to suggest it is intentional. + +Fixes: 297ae1eb23b0 ("arm64: cpufeature: List early Cortex-A510 parts as having broken dbm") +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20220201144838.20037-1-broonie@kernel.org +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index 38e7f19df14d4..ae0e93871ee5f 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -672,6 +672,7 @@ config ARM64_WORKAROUND_TRBE_OVERWRITE_FILL_MODE + + config ARM64_ERRATUM_2051678 + bool "Cortex-A510: 2051678: disable Hardware Update of the page table dirty bit" ++ default y + help + This options adds the workaround for ARM Cortex-A510 erratum ARM64_ERRATUM_2051678. + Affected Coretex-A510 might not respect the ordering rules for +-- +2.34.1 + diff --git a/queue-5.16/bonding-pair-enable_port-with-slave_arr_updates.patch b/queue-5.16/bonding-pair-enable_port-with-slave_arr_updates.patch new file mode 100644 index 00000000000..fea8fdf1b85 --- /dev/null +++ b/queue-5.16/bonding-pair-enable_port-with-slave_arr_updates.patch @@ -0,0 +1,55 @@ +From 9b1e3f4751c3683fb2f81abcf9e4c263bab0252e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Feb 2022 14:29:01 -0800 +Subject: bonding: pair enable_port with slave_arr_updates + +From: Mahesh Bandewar + +[ Upstream commit 23de0d7b6f0e3f9a6283a882594c479949da1120 ] + +When 803.2ad mode enables a participating port, it should update +the slave-array. I have observed that the member links are participating +and are part of the active aggregator while the traffic is egressing via +only one member link (in a case where two links are participating). Via +kprobes I discovered that slave-arr has only one link added while +the other participating link wasn't part of the slave-arr. + +I couldn't see what caused that situation but the simple code-walk +through provided me hints that the enable_port wasn't always associated +with the slave-array update. + +Fixes: ee6377147409 ("bonding: Simplify the xmit function for modes that use xmit_hash") +Signed-off-by: Mahesh Bandewar +Acked-by: Jay Vosburgh +Link: https://lore.kernel.org/r/20220207222901.1795287-1-maheshb@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_3ad.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c +index 6006c2e8fa2bc..9fd1d6cba3cda 100644 +--- a/drivers/net/bonding/bond_3ad.c ++++ b/drivers/net/bonding/bond_3ad.c +@@ -1021,8 +1021,8 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) + if (port->aggregator && + port->aggregator->is_active && + !__port_is_enabled(port)) { +- + __enable_port(port); ++ *update_slave_arr = true; + } + } + break; +@@ -1779,6 +1779,7 @@ static void ad_agg_selection_logic(struct aggregator *agg, + port = port->next_port_in_aggregator) { + __enable_port(port); + } ++ *update_slave_arr = true; + } + } + +-- +2.34.1 + diff --git a/queue-5.16/dpaa2-eth-unregister-the-netdev-before-disconnecting.patch b/queue-5.16/dpaa2-eth-unregister-the-netdev-before-disconnecting.patch new file mode 100644 index 00000000000..3dd1f30da86 --- /dev/null +++ b/queue-5.16/dpaa2-eth-unregister-the-netdev-before-disconnecting.patch @@ -0,0 +1,45 @@ +From ddc15f01741bf8da06a4b065f0ac78d8107a2469 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Feb 2022 17:57:43 +0200 +Subject: dpaa2-eth: unregister the netdev before disconnecting from the PHY + +From: Robert-Ionut Alexa + +[ Upstream commit 9ccc6e0c8959a019bb40f6b18704b142c04b19a8 ] + +The netdev should be unregistered before we are disconnecting from the +MAC/PHY so that the dev_close callback is called and the PHY and the +phylink workqueues are actually stopped before we are disconnecting and +destroying the phylink instance. + +Fixes: 719479230893 ("dpaa2-eth: add MAC/PHY support through phylink") +Signed-off-by: Robert-Ionut Alexa +Signed-off-by: Ioana Ciornei +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +index 8e643567abce2..70c8dd6cf3508 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +@@ -4523,12 +4523,12 @@ static int dpaa2_eth_remove(struct fsl_mc_device *ls_dev) + #ifdef CONFIG_DEBUG_FS + dpaa2_dbg_remove(priv); + #endif ++ ++ unregister_netdev(net_dev); + rtnl_lock(); + dpaa2_eth_disconnect_mac(priv); + rtnl_unlock(); + +- unregister_netdev(net_dev); +- + dpaa2_eth_dl_port_del(priv); + dpaa2_eth_dl_traps_unregister(priv); + dpaa2_eth_dl_free(priv); +-- +2.34.1 + diff --git a/queue-5.16/drm-amd-pm-fix-hwmon-node-of-power1_label-create-iss.patch b/queue-5.16/drm-amd-pm-fix-hwmon-node-of-power1_label-create-iss.patch new file mode 100644 index 00000000000..3abbdbf2eff --- /dev/null +++ b/queue-5.16/drm-amd-pm-fix-hwmon-node-of-power1_label-create-iss.patch @@ -0,0 +1,42 @@ +From a0c52e2e445d80e146af1532ecc42ee199865afc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Feb 2022 14:23:55 +0800 +Subject: drm/amd/pm: fix hwmon node of power1_label create issue + +From: Yang Wang + +[ Upstream commit a8b1e8636a3252daa729762b2e3cc9015cc91a5c ] + +it will cause hwmon node of power1_label is not created. + +v2: +the hwmon node of "power1_label" is always needed for all ASICs. +and the patch will remove ASIC type check for "power1_label". + +Fixes: ae07970a0621d6 ("drm/amd/pm: add support for hwmon control of slow and fast PPT limit on vangogh") + +Signed-off-by: Yang Wang +Reviewed-by: Kenneth Feng +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/amdgpu_pm.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c b/drivers/gpu/drm/amd/pm/amdgpu_pm.c +index f8370d54100e8..d31719b3418fa 100644 +--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c ++++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c +@@ -3451,8 +3451,7 @@ static umode_t hwmon_attributes_visible(struct kobject *kobj, + attr == &sensor_dev_attr_power2_cap_min.dev_attr.attr || + attr == &sensor_dev_attr_power2_cap.dev_attr.attr || + attr == &sensor_dev_attr_power2_cap_default.dev_attr.attr || +- attr == &sensor_dev_attr_power2_label.dev_attr.attr || +- attr == &sensor_dev_attr_power1_label.dev_attr.attr)) ++ attr == &sensor_dev_attr_power2_label.dev_attr.attr)) + return 0; + + return effective_mode; +-- +2.34.1 + diff --git a/queue-5.16/drm-panel-simple-assign-data-from-panel_dpi_probe-co.patch b/queue-5.16/drm-panel-simple-assign-data-from-panel_dpi_probe-co.patch new file mode 100644 index 00000000000..b1cc23fd7a1 --- /dev/null +++ b/queue-5.16/drm-panel-simple-assign-data-from-panel_dpi_probe-co.patch @@ -0,0 +1,47 @@ +From d8621eb8bc2b5ebf77328ea6e991d61396e368bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Feb 2022 12:01:53 +0100 +Subject: drm/panel: simple: Assign data from panel_dpi_probe() correctly + +From: Christoph Niedermaier + +[ Upstream commit 6df4432a5eca101b5fd80fbee41d309f3d67928d ] + +In the function panel_simple_probe() the pointer panel->desc is +assigned to the passed pointer desc. If function panel_dpi_probe() +is called panel->desc will be updated, but further on only desc +will be evaluated. So update the desc pointer to be able to use +the data from the function panel_dpi_probe(). + +Fixes: 4a1d0dbc8332 ("drm/panel: simple: add panel-dpi support") + +Signed-off-by: Christoph Niedermaier +Cc: Marek Vasut +Cc: Thierry Reding +Cc: Sam Ravnborg +Cc: David Airlie +Cc: Daniel Vetter +To: dri-devel@lists.freedesktop.org +Reviewed-by: Sam Ravnborg +Signed-off-by: Marek Vasut +Link: https://patchwork.freedesktop.org/patch/msgid/20220201110153.3479-1-cniedermaier@dh-electronics.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-simple.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index eb475a3a774b7..87f30bced7b7e 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -588,6 +588,7 @@ static int panel_simple_probe(struct device *dev, const struct panel_desc *desc) + err = panel_dpi_probe(dev, panel); + if (err) + goto free_ddc; ++ desc = panel->desc; + } else { + if (!of_get_display_timing(dev->of_node, "panel-timing", &dt)) + panel_simple_parse_panel_timing_node(dev, panel, &dt); +-- +2.34.1 + diff --git a/queue-5.16/drm-vc4-hdmi-allow-dblclk-modes-even-if-horz-timing-.patch b/queue-5.16/drm-vc4-hdmi-allow-dblclk-modes-even-if-horz-timing-.patch new file mode 100644 index 00000000000..aacc8528355 --- /dev/null +++ b/queue-5.16/drm-vc4-hdmi-allow-dblclk-modes-even-if-horz-timing-.patch @@ -0,0 +1,52 @@ +From c394790d7f32c24c95ac934fa051fa650e2d9366 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jan 2022 14:51:16 +0100 +Subject: drm/vc4: hdmi: Allow DBLCLK modes even if horz timing is odd. + +From: Dave Stevenson + +[ Upstream commit 1d118965965f89948236ebe23072bb1fca5e7832 ] + +The 2711 pixel valve can't produce odd horizontal timings, and +checks were added to vc4_hdmi_encoder_atomic_check and +vc4_hdmi_encoder_mode_valid to filter out/block selection of +such modes. + +Modes with DRM_MODE_FLAG_DBLCLK double all the horizontal timing +values before programming them into the PV. The PV values, +therefore, can not be odd, and so the modes can be supported. + +Amend the filtering appropriately. + +Fixes: 57fb32e632be ("drm/vc4: hdmi: Block odd horizontal timings") +Signed-off-by: Dave Stevenson +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20220127135116.298278-1-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_hdmi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c +index c000946996edb..24f11c07bc3c7 100644 +--- a/drivers/gpu/drm/vc4/vc4_hdmi.c ++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c +@@ -1090,6 +1090,7 @@ static int vc4_hdmi_encoder_atomic_check(struct drm_encoder *encoder, + unsigned long long tmds_rate; + + if (vc4_hdmi->variant->unsupported_odd_h_timings && ++ !(mode->flags & DRM_MODE_FLAG_DBLCLK) && + ((mode->hdisplay % 2) || (mode->hsync_start % 2) || + (mode->hsync_end % 2) || (mode->htotal % 2))) + return -EINVAL; +@@ -1137,6 +1138,7 @@ vc4_hdmi_encoder_mode_valid(struct drm_encoder *encoder, + struct vc4_hdmi *vc4_hdmi = encoder_to_vc4_hdmi(encoder); + + if (vc4_hdmi->variant->unsupported_odd_h_timings && ++ !(mode->flags & DRM_MODE_FLAG_DBLCLK) && + ((mode->hdisplay % 2) || (mode->hsync_start % 2) || + (mode->hsync_end % 2) || (mode->htotal % 2))) + return MODE_H_ILLEGAL; +-- +2.34.1 + diff --git a/queue-5.16/fbcon-avoid-cap-set-but-not-used-warning.patch b/queue-5.16/fbcon-avoid-cap-set-but-not-used-warning.patch new file mode 100644 index 00000000000..1e98dc16803 --- /dev/null +++ b/queue-5.16/fbcon-avoid-cap-set-but-not-used-warning.patch @@ -0,0 +1,62 @@ +From 1a86f17388fc94e168319d6fffd6d8a4710a4008 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Feb 2022 16:59:31 +0100 +Subject: fbcon: Avoid 'cap' set but not used warning + +From: Helge Deller + +[ Upstream commit 50b10528aad568c95f772039d4b3093b4aea7439 ] + +Fix this kernel test robot warning: + + drivers/video/fbdev/core/fbcon.c: In function 'fbcon_init': + drivers/video/fbdev/core/fbcon.c:1028:6: warning: variable 'cap' set but not used [-Wunused-but-set-variable] + +The cap variable is only used when CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION +is enabled. Drop the temporary variable and use info->flags instead. + +Fixes: 87ab9f6b7417 ("Revert "fbcon: Disable accelerated scrolling") +Reported-by: kernel test robot +Signed-off-by: Helge Deller +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/YgFB4xqI+As196FR@p100 +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/fbcon.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index f36829eeb5a93..2fc1b80a26ad9 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -1025,7 +1025,7 @@ static void fbcon_init(struct vc_data *vc, int init) + struct vc_data *svc = *default_mode; + struct fbcon_display *t, *p = &fb_display[vc->vc_num]; + int logo = 1, new_rows, new_cols, rows, cols; +- int cap, ret; ++ int ret; + + if (WARN_ON(info_idx == -1)) + return; +@@ -1034,7 +1034,6 @@ static void fbcon_init(struct vc_data *vc, int init) + con2fb_map[vc->vc_num] = info_idx; + + info = registered_fb[con2fb_map[vc->vc_num]]; +- cap = info->flags; + + if (logo_shown < 0 && console_loglevel <= CONSOLE_LOGLEVEL_QUIET) + logo_shown = FBCON_LOGO_DONTSHOW; +@@ -1137,8 +1136,8 @@ static void fbcon_init(struct vc_data *vc, int init) + ops->graphics = 0; + + #ifdef CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION +- if ((cap & FBINFO_HWACCEL_COPYAREA) && +- !(cap & FBINFO_HWACCEL_DISABLED)) ++ if ((info->flags & FBINFO_HWACCEL_COPYAREA) && ++ !(info->flags & FBINFO_HWACCEL_DISABLED)) + p->scrollmode = SCROLL_MOVE; + else /* default to something safe */ + p->scrollmode = SCROLL_REDRAW; +-- +2.34.1 + diff --git a/queue-5.16/gpio-aggregator-fix-calling-into-sleeping-gpio-contr.patch b/queue-5.16/gpio-aggregator-fix-calling-into-sleeping-gpio-contr.patch new file mode 100644 index 00000000000..055f6315671 --- /dev/null +++ b/queue-5.16/gpio-aggregator-fix-calling-into-sleeping-gpio-contr.patch @@ -0,0 +1,84 @@ +From 8ac479b4610b7810ed04d5c6195326a243afb934 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Jan 2022 11:35:53 +0100 +Subject: gpio: aggregator: Fix calling into sleeping GPIO controllers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit 2cba05451a6d0c703bb74f1a250691404f27c4f1 ] + +If the parent GPIO controller is a sleeping controller (e.g. a GPIO +controller connected to I2C), getting or setting a GPIO triggers a +might_sleep() warning. This happens because the GPIO Aggregator takes +the can_sleep flag into account only for its internal locking, not for +calling into the parent GPIO controller. + +Fix this by using the gpiod_[gs]et*_cansleep() APIs when calling into a +sleeping GPIO controller. + +Reported-by: Mikko Salomäki +Fixes: 828546e24280f721 ("gpio: Add GPIO Aggregator") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Andy Shevchenko +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-aggregator.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpio/gpio-aggregator.c b/drivers/gpio/gpio-aggregator.c +index e9671d1660ef4..ac20f9bd1be61 100644 +--- a/drivers/gpio/gpio-aggregator.c ++++ b/drivers/gpio/gpio-aggregator.c +@@ -278,7 +278,8 @@ static int gpio_fwd_get(struct gpio_chip *chip, unsigned int offset) + { + struct gpiochip_fwd *fwd = gpiochip_get_data(chip); + +- return gpiod_get_value(fwd->descs[offset]); ++ return chip->can_sleep ? gpiod_get_value_cansleep(fwd->descs[offset]) ++ : gpiod_get_value(fwd->descs[offset]); + } + + static int gpio_fwd_get_multiple(struct gpiochip_fwd *fwd, unsigned long *mask, +@@ -293,7 +294,10 @@ static int gpio_fwd_get_multiple(struct gpiochip_fwd *fwd, unsigned long *mask, + for_each_set_bit(i, mask, fwd->chip.ngpio) + descs[j++] = fwd->descs[i]; + +- error = gpiod_get_array_value(j, descs, NULL, values); ++ if (fwd->chip.can_sleep) ++ error = gpiod_get_array_value_cansleep(j, descs, NULL, values); ++ else ++ error = gpiod_get_array_value(j, descs, NULL, values); + if (error) + return error; + +@@ -328,7 +332,10 @@ static void gpio_fwd_set(struct gpio_chip *chip, unsigned int offset, int value) + { + struct gpiochip_fwd *fwd = gpiochip_get_data(chip); + +- gpiod_set_value(fwd->descs[offset], value); ++ if (chip->can_sleep) ++ gpiod_set_value_cansleep(fwd->descs[offset], value); ++ else ++ gpiod_set_value(fwd->descs[offset], value); + } + + static void gpio_fwd_set_multiple(struct gpiochip_fwd *fwd, unsigned long *mask, +@@ -343,7 +350,10 @@ static void gpio_fwd_set_multiple(struct gpiochip_fwd *fwd, unsigned long *mask, + descs[j++] = fwd->descs[i]; + } + +- gpiod_set_array_value(j, descs, NULL, values); ++ if (fwd->chip.can_sleep) ++ gpiod_set_array_value_cansleep(j, descs, NULL, values); ++ else ++ gpiod_set_array_value(j, descs, NULL, values); + } + + static void gpio_fwd_set_multiple_locked(struct gpio_chip *chip, +-- +2.34.1 + diff --git a/queue-5.16/gpio-sifive-use-the-correct-register-to-read-output-.patch b/queue-5.16/gpio-sifive-use-the-correct-register-to-read-output-.patch new file mode 100644 index 00000000000..4171d007842 --- /dev/null +++ b/queue-5.16/gpio-sifive-use-the-correct-register-to-read-output-.patch @@ -0,0 +1,45 @@ +From b53901a62482357d10f91b11e995aa0c8299edb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Feb 2022 13:02:25 +0000 +Subject: gpio: sifive: use the correct register to read output values + +From: Niklas Cassel + +[ Upstream commit cc38ef936840ac29204d806deb4d1836ec509594 ] + +Setting the output of a GPIO to 1 using gpiod_set_value(), followed by +reading the same GPIO using gpiod_get_value(), will currently yield an +incorrect result. + +This is because the SiFive GPIO device stores the output values in reg_set, +not reg_dat. + +Supply the flag BGPIOF_READ_OUTPUT_REG_SET to bgpio_init() so that the +generic driver reads the correct register. + +Fixes: 96868dce644d ("gpio/sifive: Add GPIO driver for SiFive SoCs") +Signed-off-by: Niklas Cassel +Reviewed-by: Linus Walleij +[Bartosz: added the Fixes tag] +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-sifive.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-sifive.c b/drivers/gpio/gpio-sifive.c +index 403f9e833d6a3..7d82388b4ab7c 100644 +--- a/drivers/gpio/gpio-sifive.c ++++ b/drivers/gpio/gpio-sifive.c +@@ -223,7 +223,7 @@ static int sifive_gpio_probe(struct platform_device *pdev) + NULL, + chip->base + SIFIVE_GPIO_OUTPUT_EN, + chip->base + SIFIVE_GPIO_INPUT_EN, +- 0); ++ BGPIOF_READ_OUTPUT_REG_SET); + if (ret) { + dev_err(dev, "unable to init generic GPIO\n"); + return ret; +-- +2.34.1 + diff --git a/queue-5.16/gpiolib-never-return-internal-error-codes-to-user-sp.patch b/queue-5.16/gpiolib-never-return-internal-error-codes-to-user-sp.patch new file mode 100644 index 00000000000..bb409036a93 --- /dev/null +++ b/queue-5.16/gpiolib-never-return-internal-error-codes-to-user-sp.patch @@ -0,0 +1,104 @@ +From 1d4b1f71eddb562305712236637957a8afddb48c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Feb 2022 17:27:55 +0200 +Subject: gpiolib: Never return internal error codes to user space + +From: Andy Shevchenko + +[ Upstream commit 95a4eed7dd5b7c1c3664a626174290686ddbee9f ] + +Currently it's possible that character device interface may return +the error codes which are not supposed to be seen by user space. +In this case it's EPROBE_DEFER. + +Wrap it to return -ENODEV instead as sysfs does. + +Fixes: d7c51b47ac11 ("gpio: userspace ABI for reading/writing GPIO lines") +Fixes: 61f922db7221 ("gpio: userspace ABI for reading GPIO line events") +Fixes: 3c0d9c635ae2 ("gpiolib: cdev: support GPIO_V2_GET_LINE_IOCTL and GPIO_V2_LINE_GET_VALUES_IOCTL") +Reported-by: Suresh Balakrishnan +Signed-off-by: Andy Shevchenko +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib-cdev.c | 6 +++--- + drivers/gpio/gpiolib-sysfs.c | 7 ++----- + drivers/gpio/gpiolib.h | 12 ++++++++++++ + 3 files changed, 17 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c +index c7b5446d01fd2..ffa0256cad5a0 100644 +--- a/drivers/gpio/gpiolib-cdev.c ++++ b/drivers/gpio/gpiolib-cdev.c +@@ -330,7 +330,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip) + goto out_free_lh; + } + +- ret = gpiod_request(desc, lh->label); ++ ret = gpiod_request_user(desc, lh->label); + if (ret) + goto out_free_lh; + lh->descs[i] = desc; +@@ -1378,7 +1378,7 @@ static int linereq_create(struct gpio_device *gdev, void __user *ip) + goto out_free_linereq; + } + +- ret = gpiod_request(desc, lr->label); ++ ret = gpiod_request_user(desc, lr->label); + if (ret) + goto out_free_linereq; + +@@ -1764,7 +1764,7 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip) + } + } + +- ret = gpiod_request(desc, le->label); ++ ret = gpiod_request_user(desc, le->label); + if (ret) + goto out_free_le; + le->desc = desc; +diff --git a/drivers/gpio/gpiolib-sysfs.c b/drivers/gpio/gpiolib-sysfs.c +index 4098bc7f88b7e..44c1ad51b3fe9 100644 +--- a/drivers/gpio/gpiolib-sysfs.c ++++ b/drivers/gpio/gpiolib-sysfs.c +@@ -475,12 +475,9 @@ static ssize_t export_store(struct class *class, + * they may be undone on its behalf too. + */ + +- status = gpiod_request(desc, "sysfs"); +- if (status) { +- if (status == -EPROBE_DEFER) +- status = -ENODEV; ++ status = gpiod_request_user(desc, "sysfs"); ++ if (status) + goto done; +- } + + status = gpiod_set_transitory(desc, false); + if (!status) { +diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h +index 30bc3f80f83e6..c31f4626915de 100644 +--- a/drivers/gpio/gpiolib.h ++++ b/drivers/gpio/gpiolib.h +@@ -135,6 +135,18 @@ struct gpio_desc { + + int gpiod_request(struct gpio_desc *desc, const char *label); + void gpiod_free(struct gpio_desc *desc); ++ ++static inline int gpiod_request_user(struct gpio_desc *desc, const char *label) ++{ ++ int ret; ++ ++ ret = gpiod_request(desc, label); ++ if (ret == -EPROBE_DEFER) ++ ret = -ENODEV; ++ ++ return ret; ++} ++ + int gpiod_configure_flags(struct gpio_desc *desc, const char *con_id, + unsigned long lflags, enum gpiod_flags dflags); + int gpio_set_debounce_timeout(struct gpio_desc *desc, unsigned int debounce); +-- +2.34.1 + diff --git a/queue-5.16/gve-recording-rx-queue-before-sending-to-napi.patch b/queue-5.16/gve-recording-rx-queue-before-sending-to-napi.patch new file mode 100644 index 00000000000..ac9ed9fd391 --- /dev/null +++ b/queue-5.16/gve-recording-rx-queue-before-sending-to-napi.patch @@ -0,0 +1,36 @@ +From 949e6ff686f2bafddd71a144ff8f688b38aa9fd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Feb 2022 09:59:01 -0800 +Subject: gve: Recording rx queue before sending to napi + +From: Tao Liu + +[ Upstream commit 084cbb2ec3af2d23be9de65fcc9493e21e265859 ] + +This caused a significant performance degredation when using generic XDP +with multiple queues. + +Fixes: f5cedc84a30d2 ("gve: Add transmit and receive support") +Signed-off-by: Tao Liu +Link: https://lore.kernel.org/r/20220207175901.2486596-1-jeroendb@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/google/gve/gve_rx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/google/gve/gve_rx.c b/drivers/net/ethernet/google/gve/gve_rx.c +index 04a08904305a9..3453e565472c1 100644 +--- a/drivers/net/ethernet/google/gve/gve_rx.c ++++ b/drivers/net/ethernet/google/gve/gve_rx.c +@@ -609,6 +609,7 @@ static bool gve_rx(struct gve_rx_ring *rx, netdev_features_t feat, + + *packet_size_bytes = skb->len + (skb->protocol ? ETH_HLEN : 0); + *work_done = work_cnt; ++ skb_record_rx_queue(skb, rx->q_num); + if (skb_is_nonlinear(skb)) + napi_gro_frags(napi); + else +-- +2.34.1 + diff --git a/queue-5.16/ibmvnic-don-t-release-napi-in-__ibmvnic_open.patch b/queue-5.16/ibmvnic-don-t-release-napi-in-__ibmvnic_open.patch new file mode 100644 index 00000000000..d387bfdd2aa --- /dev/null +++ b/queue-5.16/ibmvnic-don-t-release-napi-in-__ibmvnic_open.patch @@ -0,0 +1,112 @@ +From 17fbe6d19f770b9719b22f53222aab18e42fc662 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Feb 2022 16:19:18 -0800 +Subject: ibmvnic: don't release napi in __ibmvnic_open() + +From: Sukadev Bhattiprolu + +[ Upstream commit 61772b0908c640d0309c40f7d41d062ca4e979fa ] + +If __ibmvnic_open() encounters an error such as when setting link state, +it calls release_resources() which frees the napi structures needlessly. +Instead, have __ibmvnic_open() only clean up the work it did so far (i.e. +disable napi and irqs) and leave the rest to the callers. + +If caller of __ibmvnic_open() is ibmvnic_open(), it should release the +resources immediately. If the caller is do_reset() or do_hard_reset(), +they will release the resources on the next reset. + +This fixes following crash that occurred when running the drmgr command +several times to add/remove a vnic interface: + + [102056] ibmvnic 30000003 env3: Disabling rx_scrq[6] irq + [102056] ibmvnic 30000003 env3: Disabling rx_scrq[7] irq + [102056] ibmvnic 30000003 env3: Replenished 8 pools + Kernel attempted to read user page (10) - exploit attempt? (uid: 0) + BUG: Kernel NULL pointer dereference on read at 0x00000010 + Faulting instruction address: 0xc000000000a3c840 + Oops: Kernel access of bad area, sig: 11 [#1] + LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries + ... + CPU: 9 PID: 102056 Comm: kworker/9:2 Kdump: loaded Not tainted 5.16.0-rc5-autotest-g6441998e2e37 #1 + Workqueue: events_long __ibmvnic_reset [ibmvnic] + NIP: c000000000a3c840 LR: c0080000029b5378 CTR: c000000000a3c820 + REGS: c0000000548e37e0 TRAP: 0300 Not tainted (5.16.0-rc5-autotest-g6441998e2e37) + MSR: 8000000000009033 CR: 28248484 XER: 00000004 + CFAR: c0080000029bdd24 DAR: 0000000000000010 DSISR: 40000000 IRQMASK: 0 + GPR00: c0080000029b55d0 c0000000548e3a80 c0000000028f0200 0000000000000000 + ... + NIP [c000000000a3c840] napi_enable+0x20/0xc0 + LR [c0080000029b5378] __ibmvnic_open+0xf0/0x430 [ibmvnic] + Call Trace: + [c0000000548e3a80] [0000000000000006] 0x6 (unreliable) + [c0000000548e3ab0] [c0080000029b55d0] __ibmvnic_open+0x348/0x430 [ibmvnic] + [c0000000548e3b40] [c0080000029bcc28] __ibmvnic_reset+0x500/0xdf0 [ibmvnic] + [c0000000548e3c60] [c000000000176228] process_one_work+0x288/0x570 + [c0000000548e3d00] [c000000000176588] worker_thread+0x78/0x660 + [c0000000548e3da0] [c0000000001822f0] kthread+0x1c0/0x1d0 + [c0000000548e3e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64 + Instruction dump: + 7d2948f8 792307e0 4e800020 60000000 3c4c01eb 384239e0 f821ffd1 39430010 + 38a0fff6 e92d1100 f9210028 39200000 f9010020 60420000 e9210020 + ---[ end trace 5f8033b08fd27706 ]--- + +Fixes: ed651a10875f ("ibmvnic: Updated reset handling") +Reported-by: Abdul Haleem +Signed-off-by: Sukadev Bhattiprolu +Reviewed-by: Dany Madden +Link: https://lore.kernel.org/r/20220208001918.900602-1-sukadev@linux.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 682a440151a87..d5d33325a413e 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -110,6 +110,7 @@ static void ibmvnic_tx_scrq_clean_buffer(struct ibmvnic_adapter *adapter, + struct ibmvnic_sub_crq_queue *tx_scrq); + static void free_long_term_buff(struct ibmvnic_adapter *adapter, + struct ibmvnic_long_term_buff *ltb); ++static void ibmvnic_disable_irqs(struct ibmvnic_adapter *adapter); + + struct ibmvnic_stat { + char name[ETH_GSTRING_LEN]; +@@ -1418,7 +1419,7 @@ static int __ibmvnic_open(struct net_device *netdev) + rc = set_link_state(adapter, IBMVNIC_LOGICAL_LNK_UP); + if (rc) { + ibmvnic_napi_disable(adapter); +- release_resources(adapter); ++ ibmvnic_disable_irqs(adapter); + return rc; + } + +@@ -1468,9 +1469,6 @@ static int ibmvnic_open(struct net_device *netdev) + rc = init_resources(adapter); + if (rc) { + netdev_err(netdev, "failed to initialize resources\n"); +- release_resources(adapter); +- release_rx_pools(adapter); +- release_tx_pools(adapter); + goto out; + } + } +@@ -1487,6 +1485,13 @@ static int ibmvnic_open(struct net_device *netdev) + adapter->state = VNIC_OPEN; + rc = 0; + } ++ ++ if (rc) { ++ release_resources(adapter); ++ release_rx_pools(adapter); ++ release_tx_pools(adapter); ++ } ++ + return rc; + } + +-- +2.34.1 + diff --git a/queue-5.16/ice-avoid-rtnl-lock-when-re-creating-auxiliary-devic.patch b/queue-5.16/ice-avoid-rtnl-lock-when-re-creating-auxiliary-devic.patch new file mode 100644 index 00000000000..e8ae7cf1382 --- /dev/null +++ b/queue-5.16/ice-avoid-rtnl-lock-when-re-creating-auxiliary-devic.patch @@ -0,0 +1,69 @@ +From c03e68dd153e8609c57e29fc08eaed7666c46c90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jan 2022 16:27:56 -0800 +Subject: ice: Avoid RTNL lock when re-creating auxiliary device + +From: Dave Ertman + +[ Upstream commit 5dbbbd01cbba831233c6ea9a3e6bfa133606d3c0 ] + +If a call to re-create the auxiliary device happens in a context that has +already taken the RTNL lock, then the call flow that recreates auxiliary +device can hang if there is another attempt to claim the RTNL lock by the +auxiliary driver. + +To avoid this, any call to re-create auxiliary devices that comes from +an source that is holding the RTNL lock (e.g. netdev notifier when +interface exits a bond) should execute in a separate thread. To +accomplish this, add a flag to the PF that will be evaluated in the +service task and dealt with there. + +Fixes: f9f5301e7e2d ("ice: Register auxiliary device to provide RDMA") +Signed-off-by: Dave Ertman +Reviewed-by: Jonathan Toppins +Tested-by: Gurucharan G +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice.h | 3 ++- + drivers/net/ethernet/intel/ice/ice_main.c | 3 +++ + 2 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h +index b2db39ee5f85c..b3e1fc6a0a8eb 100644 +--- a/drivers/net/ethernet/intel/ice/ice.h ++++ b/drivers/net/ethernet/intel/ice/ice.h +@@ -483,6 +483,7 @@ enum ice_pf_flags { + ICE_FLAG_VF_TRUE_PROMISC_ENA, + ICE_FLAG_MDD_AUTO_RESET_VF, + ICE_FLAG_LINK_LENIENT_MODE_ENA, ++ ICE_FLAG_PLUG_AUX_DEV, + ICE_PF_FLAGS_NBITS /* must be last */ + }; + +@@ -880,7 +881,7 @@ static inline void ice_set_rdma_cap(struct ice_pf *pf) + if (pf->hw.func_caps.common_cap.rdma && pf->num_rdma_msix) { + set_bit(ICE_FLAG_RDMA_ENA, pf->flags); + set_bit(ICE_FLAG_AUX_ENA, pf->flags); +- ice_plug_aux_dev(pf); ++ set_bit(ICE_FLAG_PLUG_AUX_DEV, pf->flags); + } + } + +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 68d3de6d42218..5b4be432b60ce 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -2235,6 +2235,9 @@ static void ice_service_task(struct work_struct *work) + return; + } + ++ if (test_and_clear_bit(ICE_FLAG_PLUG_AUX_DEV, pf->flags)) ++ ice_plug_aux_dev(pf); ++ + ice_clean_adminq_subtask(pf); + ice_check_media_subtask(pf); + ice_check_for_hang_subtask(pf); +-- +2.34.1 + diff --git a/queue-5.16/ice-fix-an-error-code-in-ice_cfg_phy_fec.patch b/queue-5.16/ice-fix-an-error-code-in-ice_cfg_phy_fec.patch new file mode 100644 index 00000000000..fcd184439e8 --- /dev/null +++ b/queue-5.16/ice-fix-an-error-code-in-ice_cfg_phy_fec.patch @@ -0,0 +1,38 @@ +From a51528a398a81ef5be07d0e1e0dfe073dafba167 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jan 2022 11:02:06 +0300 +Subject: ice: fix an error code in ice_cfg_phy_fec() + +From: Dan Carpenter + +[ Upstream commit 21338d58736ef70eaae5fd75d567a358ff7902f9 ] + +Propagate the error code from ice_get_link_default_override() instead +of returning success. + +Fixes: ea78ce4dab05 ("ice: add link lenient and default override support") +Signed-off-by: Dan Carpenter +Tested-by: Gurucharan G +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_common.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_common.c b/drivers/net/ethernet/intel/ice/ice_common.c +index b3066d0fea8ba..e9a0159cb8b92 100644 +--- a/drivers/net/ethernet/intel/ice/ice_common.c ++++ b/drivers/net/ethernet/intel/ice/ice_common.c +@@ -3321,7 +3321,8 @@ ice_cfg_phy_fec(struct ice_port_info *pi, struct ice_aqc_set_phy_cfg_data *cfg, + !ice_fw_supports_report_dflt_cfg(hw)) { + struct ice_link_default_override_tlv tlv; + +- if (ice_get_link_default_override(&tlv, pi)) ++ status = ice_get_link_default_override(&tlv, pi); ++ if (status) + goto out; + + if (!(tlv.options & ICE_LINK_OVERRIDE_STRICT_MODE) && +-- +2.34.1 + diff --git a/queue-5.16/ice-fix-ipip-and-sit-tso-offload.patch b/queue-5.16/ice-fix-ipip-and-sit-tso-offload.patch new file mode 100644 index 00000000000..7eb58916f7a --- /dev/null +++ b/queue-5.16/ice-fix-ipip-and-sit-tso-offload.patch @@ -0,0 +1,102 @@ +From 9aa37bcb0e3f825a2098198870a19be3a869ee37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jan 2022 15:38:39 -0800 +Subject: ice: fix IPIP and SIT TSO offload + +From: Jesse Brandeburg + +[ Upstream commit 46b699c50c0304cdbd725d7740073a7f9d5edb10 ] + +The driver was avoiding offload for IPIP (at least) frames due to +parsing the inner header offsets incorrectly when trying to check +lengths. + +This length check works for VXLAN frames but fails on IPIP frames +because skb_transport_offset points to the inner header in IPIP +frames, which meant the subtraction of transport_header from +inner_network_header returns a negative value (-20). + +With the code before this patch, everything continued to work, but GSO +was being used to segment, causing throughputs of 1.5Gb/s per thread. +After this patch, throughput is more like 10Gb/s per thread for IPIP +traffic. + +Fixes: e94d44786693 ("ice: Implement filter sync, NDO operations and bump version") +Signed-off-by: Jesse Brandeburg +Reviewed-by: Paul Menzel +Tested-by: Gurucharan G +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + .../net/ethernet/intel/ice/ice_lan_tx_rx.h | 1 + + drivers/net/ethernet/intel/ice/ice_main.c | 25 +++++++++++++------ + 2 files changed, 18 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h b/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h +index d981dc6f23235..85a612838a898 100644 +--- a/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h ++++ b/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h +@@ -568,6 +568,7 @@ struct ice_tx_ctx_desc { + (0x3FFFFULL << ICE_TXD_CTX_QW1_TSO_LEN_S) + + #define ICE_TXD_CTX_QW1_MSS_S 50 ++#define ICE_TXD_CTX_MIN_MSS 64 + + #define ICE_TXD_CTX_QW1_VSI_S 50 + #define ICE_TXD_CTX_QW1_VSI_M (0x3FFULL << ICE_TXD_CTX_QW1_VSI_S) +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 73c61cdb036f9..68d3de6d42218 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -8540,6 +8540,7 @@ ice_features_check(struct sk_buff *skb, + struct net_device __always_unused *netdev, + netdev_features_t features) + { ++ bool gso = skb_is_gso(skb); + size_t len; + + /* No point in doing any of this if neither checksum nor GSO are +@@ -8552,24 +8553,32 @@ ice_features_check(struct sk_buff *skb, + /* We cannot support GSO if the MSS is going to be less than + * 64 bytes. If it is then we need to drop support for GSO. + */ +- if (skb_is_gso(skb) && (skb_shinfo(skb)->gso_size < 64)) ++ if (gso && (skb_shinfo(skb)->gso_size < ICE_TXD_CTX_MIN_MSS)) + features &= ~NETIF_F_GSO_MASK; + +- len = skb_network_header(skb) - skb->data; ++ len = skb_network_offset(skb); + if (len > ICE_TXD_MACLEN_MAX || len & 0x1) + goto out_rm_features; + +- len = skb_transport_header(skb) - skb_network_header(skb); ++ len = skb_network_header_len(skb); + if (len > ICE_TXD_IPLEN_MAX || len & 0x1) + goto out_rm_features; + + if (skb->encapsulation) { +- len = skb_inner_network_header(skb) - skb_transport_header(skb); +- if (len > ICE_TXD_L4LEN_MAX || len & 0x1) +- goto out_rm_features; ++ /* this must work for VXLAN frames AND IPIP/SIT frames, and in ++ * the case of IPIP frames, the transport header pointer is ++ * after the inner header! So check to make sure that this ++ * is a GRE or UDP_TUNNEL frame before doing that math. ++ */ ++ if (gso && (skb_shinfo(skb)->gso_type & ++ (SKB_GSO_GRE | SKB_GSO_UDP_TUNNEL))) { ++ len = skb_inner_network_header(skb) - ++ skb_transport_header(skb); ++ if (len > ICE_TXD_L4LEN_MAX || len & 0x1) ++ goto out_rm_features; ++ } + +- len = skb_inner_transport_header(skb) - +- skb_inner_network_header(skb); ++ len = skb_inner_network_header_len(skb); + if (len > ICE_TXD_IPLEN_MAX || len & 0x1) + goto out_rm_features; + } +-- +2.34.1 + diff --git a/queue-5.16/ice-fix-kasan-error-in-lag-netdev_unregister-handler.patch b/queue-5.16/ice-fix-kasan-error-in-lag-netdev_unregister-handler.patch new file mode 100644 index 00000000000..512f513c6eb --- /dev/null +++ b/queue-5.16/ice-fix-kasan-error-in-lag-netdev_unregister-handler.patch @@ -0,0 +1,93 @@ +From 903bdf1082a0183bd1ac48c9dc28db716321bcd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jan 2022 13:08:20 -0800 +Subject: ice: Fix KASAN error in LAG NETDEV_UNREGISTER handler + +From: Dave Ertman + +[ Upstream commit bea1898f65b9b7096cb4e73e97c83b94718f1fa1 ] + +Currently, the same handler is called for both a NETDEV_BONDING_INFO +LAG unlink notification as for a NETDEV_UNREGISTER call. This is +causing a problem though, since the netdev_notifier_info passed has +a different structure depending on which event is passed. The problem +manifests as a call trace from a BUG: KASAN stack-out-of-bounds error. + +Fix this by creating a handler specific to NETDEV_UNREGISTER that only +is passed valid elements in the netdev_notifier_info struct for the +NETDEV_UNREGISTER event. + +Also included is the removal of an unbalanced dev_put on the peer_netdev +and related braces. + +Fixes: 6a8b357278f5 ("ice: Respond to a NETDEV_UNREGISTER event for LAG") +Signed-off-by: Dave Ertman +Acked-by: Jonathan Toppins +Tested-by: Sunitha Mekala +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_lag.c | 34 +++++++++++++++++++----- + 1 file changed, 28 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_lag.c b/drivers/net/ethernet/intel/ice/ice_lag.c +index e375ac849aecd..4f954db01b929 100644 +--- a/drivers/net/ethernet/intel/ice/ice_lag.c ++++ b/drivers/net/ethernet/intel/ice/ice_lag.c +@@ -204,17 +204,39 @@ ice_lag_unlink(struct ice_lag *lag, + lag->upper_netdev = NULL; + } + +- if (lag->peer_netdev) { +- dev_put(lag->peer_netdev); +- lag->peer_netdev = NULL; +- } +- ++ lag->peer_netdev = NULL; + ice_set_sriov_cap(pf); + ice_set_rdma_cap(pf); + lag->bonded = false; + lag->role = ICE_LAG_NONE; + } + ++/** ++ * ice_lag_unregister - handle netdev unregister events ++ * @lag: LAG info struct ++ * @netdev: netdev reporting the event ++ */ ++static void ice_lag_unregister(struct ice_lag *lag, struct net_device *netdev) ++{ ++ struct ice_pf *pf = lag->pf; ++ ++ /* check to see if this event is for this netdev ++ * check that we are in an aggregate ++ */ ++ if (netdev != lag->netdev || !lag->bonded) ++ return; ++ ++ if (lag->upper_netdev) { ++ dev_put(lag->upper_netdev); ++ lag->upper_netdev = NULL; ++ ice_set_sriov_cap(pf); ++ ice_set_rdma_cap(pf); ++ } ++ /* perform some cleanup in case we come back */ ++ lag->bonded = false; ++ lag->role = ICE_LAG_NONE; ++} ++ + /** + * ice_lag_changeupper_event - handle LAG changeupper event + * @lag: LAG info struct +@@ -307,7 +329,7 @@ ice_lag_event_handler(struct notifier_block *notif_blk, unsigned long event, + ice_lag_info_event(lag, ptr); + break; + case NETDEV_UNREGISTER: +- ice_lag_unlink(lag, ptr); ++ ice_lag_unregister(lag, netdev); + break; + default: + break; +-- +2.34.1 + diff --git a/queue-5.16/ipmr-ip6mr-acquire-rtnl-before-calling-ip-6-mr_free_.patch b/queue-5.16/ipmr-ip6mr-acquire-rtnl-before-calling-ip-6-mr_free_.patch new file mode 100644 index 00000000000..a4f627580d5 --- /dev/null +++ b/queue-5.16/ipmr-ip6mr-acquire-rtnl-before-calling-ip-6-mr_free_.patch @@ -0,0 +1,101 @@ +From 246787374cf64ee0d1586e226f7a8e46d140903f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Feb 2022 21:34:51 -0800 +Subject: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on + failure path + +From: Eric Dumazet + +[ Upstream commit 5611a00697c8ecc5aad04392bea629e9d6a20463 ] + +ip[6]mr_free_table() can only be called under RTNL lock. + +RTNL: assertion failed at net/core/dev.c (10367) +WARNING: CPU: 1 PID: 5890 at net/core/dev.c:10367 unregister_netdevice_many+0x1246/0x1850 net/core/dev.c:10367 +Modules linked in: +CPU: 1 PID: 5890 Comm: syz-executor.2 Not tainted 5.16.0-syzkaller-11627-g422ee58dc0ef #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +RIP: 0010:unregister_netdevice_many+0x1246/0x1850 net/core/dev.c:10367 +Code: 0f 85 9b ee ff ff e8 69 07 4b fa ba 7f 28 00 00 48 c7 c6 00 90 ae 8a 48 c7 c7 40 90 ae 8a c6 05 6d b1 51 06 01 e8 8c 90 d8 01 <0f> 0b e9 70 ee ff ff e8 3e 07 4b fa 4c 89 e7 e8 86 2a 59 fa e9 ee +RSP: 0018:ffffc900046ff6e0 EFLAGS: 00010286 +RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 +RDX: ffff888050f51d00 RSI: ffffffff815fa008 RDI: fffff520008dfece +RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 +R10: ffffffff815f3d6e R11: 0000000000000000 R12: 00000000fffffff4 +R13: dffffc0000000000 R14: ffffc900046ff750 R15: ffff88807b7dc000 +FS: 00007f4ab736e700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007fee0b4f8990 CR3: 000000001e7d2000 CR4: 00000000003506e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + mroute_clean_tables+0x244/0xb40 net/ipv6/ip6mr.c:1509 + ip6mr_free_table net/ipv6/ip6mr.c:389 [inline] + ip6mr_rules_init net/ipv6/ip6mr.c:246 [inline] + ip6mr_net_init net/ipv6/ip6mr.c:1306 [inline] + ip6mr_net_init+0x3f0/0x4e0 net/ipv6/ip6mr.c:1298 + ops_init+0xaf/0x470 net/core/net_namespace.c:140 + setup_net+0x54f/0xbb0 net/core/net_namespace.c:331 + copy_net_ns+0x318/0x760 net/core/net_namespace.c:475 + create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110 + copy_namespaces+0x391/0x450 kernel/nsproxy.c:178 + copy_process+0x2e0c/0x7300 kernel/fork.c:2167 + kernel_clone+0xe7/0xab0 kernel/fork.c:2555 + __do_sys_clone+0xc8/0x110 kernel/fork.c:2672 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae +RIP: 0033:0x7f4ab89f9059 +Code: Unable to access opcode bytes at RIP 0x7f4ab89f902f. +RSP: 002b:00007f4ab736e118 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 +RAX: ffffffffffffffda RBX: 00007f4ab8b0bf60 RCX: 00007f4ab89f9059 +RDX: 0000000020000280 RSI: 0000000020000270 RDI: 0000000040200000 +RBP: 00007f4ab8a5308d R08: 0000000020000300 R09: 0000000020000300 +R10: 00000000200002c0 R11: 0000000000000206 R12: 0000000000000000 +R13: 00007ffc3977cc1f R14: 00007f4ab736e300 R15: 0000000000022000 + + +Fixes: f243e5a7859a ("ipmr,ip6mr: call ip6mr_free_table() on failure path") +Signed-off-by: Eric Dumazet +Cc: Cong Wang +Reported-by: syzbot +Link: https://lore.kernel.org/r/20220208053451.2885398-1-eric.dumazet@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/ipmr.c | 2 ++ + net/ipv6/ip6mr.c | 2 ++ + 2 files changed, 4 insertions(+) + +diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c +index 2dda856ca2602..aea29d97f8dfa 100644 +--- a/net/ipv4/ipmr.c ++++ b/net/ipv4/ipmr.c +@@ -261,7 +261,9 @@ static int __net_init ipmr_rules_init(struct net *net) + return 0; + + err2: ++ rtnl_lock(); + ipmr_free_table(mrt); ++ rtnl_unlock(); + err1: + fib_rules_unregister(ops); + return err; +diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c +index 36ed9efb88254..6a4065d81aa91 100644 +--- a/net/ipv6/ip6mr.c ++++ b/net/ipv6/ip6mr.c +@@ -248,7 +248,9 @@ static int __net_init ip6mr_rules_init(struct net *net) + return 0; + + err2: ++ rtnl_lock(); + ip6mr_free_table(mrt); ++ rtnl_unlock(); + err1: + fib_rules_unregister(ops); + return err; +-- +2.34.1 + diff --git a/queue-5.16/ixgbevf-require-large-buffers-for-build_skb-on-82599.patch b/queue-5.16/ixgbevf-require-large-buffers-for-build_skb-on-82599.patch new file mode 100644 index 00000000000..fda1a481ef5 --- /dev/null +++ b/queue-5.16/ixgbevf-require-large-buffers-for-build_skb-on-82599.patch @@ -0,0 +1,74 @@ +From 023aecdd51888d82f5f7da628b6c161b055ad5b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Feb 2022 14:49:16 -0800 +Subject: ixgbevf: Require large buffers for build_skb on 82599VF + +From: Samuel Mendoza-Jonas + +[ Upstream commit fe68195daf34d5dddacd3f93dd3eafc4beca3a0e ] + +From 4.17 onwards the ixgbevf driver uses build_skb() to build an skb +around new data in the page buffer shared with the ixgbe PF. +This uses either a 2K or 3K buffer, and offsets the DMA mapping by +NET_SKB_PAD + NET_IP_ALIGN. When using a smaller buffer RXDCTL is set to +ensure the PF does not write a full 2K bytes into the buffer, which is +actually 2K minus the offset. + +However on the 82599 virtual function, the RXDCTL mechanism is not +available. The driver attempts to work around this by using the SET_LPE +mailbox method to lower the maximm frame size, but the ixgbe PF driver +ignores this in order to keep the PF and all VFs in sync[0]. + +This means the PF will write up to the full 2K set in SRRCTL, causing it +to write NET_SKB_PAD + NET_IP_ALIGN bytes past the end of the buffer. +With 4K pages split into two buffers, this means it either writes +NET_SKB_PAD + NET_IP_ALIGN bytes past the first buffer (and into the +second), or NET_SKB_PAD + NET_IP_ALIGN bytes past the end of the DMA +mapping. + +Avoid this by only enabling build_skb when using "large" buffers (3K). +These are placed in each half of an order-1 page, preventing the PF from +writing past the end of the mapping. + +[0]: Technically it only ever raises the max frame size, see +ixgbe_set_vf_lpe() in ixgbe_sriov.c + +Fixes: f15c5ba5b6cd ("ixgbevf: add support for using order 1 pages to receive large frames") +Signed-off-by: Samuel Mendoza-Jonas +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +index d81811ab4ec48..c2f87a2d0ef46 100644 +--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c ++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +@@ -1984,14 +1984,15 @@ static void ixgbevf_set_rx_buffer_len(struct ixgbevf_adapter *adapter, + if (adapter->flags & IXGBEVF_FLAGS_LEGACY_RX) + return; + +- set_ring_build_skb_enabled(rx_ring); ++ if (PAGE_SIZE < 8192) ++ if (max_frame > IXGBEVF_MAX_FRAME_BUILD_SKB) ++ set_ring_uses_large_buffer(rx_ring); + +- if (PAGE_SIZE < 8192) { +- if (max_frame <= IXGBEVF_MAX_FRAME_BUILD_SKB) +- return; ++ /* 82599 can't rely on RXDCTL.RLPML to restrict the size of the frame */ ++ if (adapter->hw.mac.type == ixgbe_mac_82599_vf && !ring_uses_large_buffer(rx_ring)) ++ return; + +- set_ring_uses_large_buffer(rx_ring); +- } ++ set_ring_build_skb_enabled(rx_ring); + } + + /** +-- +2.34.1 + diff --git a/queue-5.16/misc-fastrpc-avoid-double-fput-on-failed-usercopy.patch b/queue-5.16/misc-fastrpc-avoid-double-fput-on-failed-usercopy.patch new file mode 100644 index 00000000000..d36b8fd1dbd --- /dev/null +++ b/queue-5.16/misc-fastrpc-avoid-double-fput-on-failed-usercopy.patch @@ -0,0 +1,58 @@ +From 8cbebebe752c948ded6caced4c94f7b920da8b28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jan 2022 14:02:18 +0100 +Subject: misc: fastrpc: avoid double fput() on failed usercopy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mathias Krause + +[ Upstream commit 46963e2e0629cb31c96b1d47ddd89dc3d8990b34 ] + +If the copy back to userland fails for the FASTRPC_IOCTL_ALLOC_DMA_BUFF +ioctl(), we shouldn't assume that 'buf->dmabuf' is still valid. In fact, +dma_buf_fd() called fd_install() before, i.e. "consumed" one reference, +leaving us with none. + +Calling dma_buf_put() will therefore put a reference we no longer own, +leading to a valid file descritor table entry for an already released +'file' object which is a straight use-after-free. + +Simply avoid calling dma_buf_put() and rely on the process exit code to +do the necessary cleanup, if needed, i.e. if the file descriptor is +still valid. + +Fixes: 6cffd79504ce ("misc: fastrpc: Add support for dmabuf exporter") +Acked-by: Christian König +Signed-off-by: Mathias Krause +Link: https://lore.kernel.org/r/20220127130218.809261-1-minipli@grsecurity.net +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/fastrpc.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c +index 4ccbf43e6bfa9..aa1682b94a23b 100644 +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -1288,7 +1288,14 @@ static int fastrpc_dmabuf_alloc(struct fastrpc_user *fl, char __user *argp) + } + + if (copy_to_user(argp, &bp, sizeof(bp))) { +- dma_buf_put(buf->dmabuf); ++ /* ++ * The usercopy failed, but we can't do much about it, as ++ * dma_buf_fd() already called fd_install() and made the ++ * file descriptor accessible for the current process. It ++ * might already be closed and dmabuf no longer valid when ++ * we reach this point. Therefore "leak" the fd and rely on ++ * the process exit path to do any required cleanup. ++ */ + return -EFAULT; + } + +-- +2.34.1 + diff --git a/queue-5.16/mptcp-netlink-process-ipv6-addrs-in-creating-listeni.patch b/queue-5.16/mptcp-netlink-process-ipv6-addrs-in-creating-listeni.patch new file mode 100644 index 00000000000..8d750d68cc4 --- /dev/null +++ b/queue-5.16/mptcp-netlink-process-ipv6-addrs-in-creating-listeni.patch @@ -0,0 +1,51 @@ +From 856dd11223e88951bf80cb3ffd10d840f490082b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Feb 2022 17:25:08 -0800 +Subject: mptcp: netlink: process IPv6 addrs in creating listening sockets + +From: Kishen Maloor + +[ Upstream commit 029744cd4bc6e9eb3bd833b4a033348296d34645 ] + +This change updates mptcp_pm_nl_create_listen_socket() to create +listening sockets bound to IPv6 addresses (where IPv6 is supported). + +Fixes: 1729cf186d8a ("mptcp: create the listening socket for new port") +Acked-by: Geliang Tang +Signed-off-by: Kishen Maloor +Signed-off-by: Mat Martineau +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mptcp/pm_netlink.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c +index 5d305fafd0e99..5eada95dd76b3 100644 +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -878,6 +878,7 @@ static int mptcp_pm_nl_append_new_local_addr(struct pm_nl_pernet *pernet, + static int mptcp_pm_nl_create_listen_socket(struct sock *sk, + struct mptcp_pm_addr_entry *entry) + { ++ int addrlen = sizeof(struct sockaddr_in); + struct sockaddr_storage addr; + struct mptcp_sock *msk; + struct socket *ssock; +@@ -902,8 +903,11 @@ static int mptcp_pm_nl_create_listen_socket(struct sock *sk, + } + + mptcp_info2sockaddr(&entry->addr, &addr, entry->addr.family); +- err = kernel_bind(ssock, (struct sockaddr *)&addr, +- sizeof(struct sockaddr_in)); ++#if IS_ENABLED(CONFIG_MPTCP_IPV6) ++ if (entry->addr.family == AF_INET6) ++ addrlen = sizeof(struct sockaddr_in6); ++#endif ++ err = kernel_bind(ssock, (struct sockaddr *)&addr, addrlen); + if (err) { + pr_warn("kernel_bind error, err=%d", err); + goto out; +-- +2.34.1 + diff --git a/queue-5.16/net-amd-xgbe-disable-interrupts-during-pci-removal.patch b/queue-5.16/net-amd-xgbe-disable-interrupts-during-pci-removal.patch new file mode 100644 index 00000000000..d7299b55d0d --- /dev/null +++ b/queue-5.16/net-amd-xgbe-disable-interrupts-during-pci-removal.patch @@ -0,0 +1,41 @@ +From 2b587415e8a1c950ae1812d34cacc46b143e5ab6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Feb 2022 10:02:01 +0530 +Subject: net: amd-xgbe: disable interrupts during pci removal + +From: Raju Rangoju + +[ Upstream commit 68c2d6af1f1e469544d6cbe9a601d96fb9c00e7f ] + +Hardware interrupts are enabled during the pci probe, however, +they are not disabled during pci removal. + +Disable all hardware interrupts during pci removal to avoid any +issues. + +Fixes: e75377404726 ("amd-xgbe: Update PCI support to use new IRQ functions") +Suggested-by: Selwin Sebastian +Signed-off-by: Raju Rangoju +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-pci.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c +index 90cb55eb54665..014513ce00a14 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c +@@ -418,6 +418,9 @@ static void xgbe_pci_remove(struct pci_dev *pdev) + + pci_free_irq_vectors(pdata->pcidev); + ++ /* Disable all interrupts in the hardware */ ++ XP_IOWRITE(pdata, XP_INT_EN, 0x0); ++ + xgbe_free_pdata(pdata); + } + +-- +2.34.1 + diff --git a/queue-5.16/net-do-not-keep-the-dst-cache-when-uncloning-an-skb-.patch b/queue-5.16/net-do-not-keep-the-dst-cache-when-uncloning-an-skb-.patch new file mode 100644 index 00000000000..a00d0db2263 --- /dev/null +++ b/queue-5.16/net-do-not-keep-the-dst-cache-when-uncloning-an-skb-.patch @@ -0,0 +1,65 @@ +From c200d42b31a020e2771fe7cbf31705c0becdd0b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Feb 2022 18:13:18 +0100 +Subject: net: do not keep the dst cache when uncloning an skb dst and its + metadata + +From: Antoine Tenart + +[ Upstream commit cfc56f85e72f5b9c5c5be26dc2b16518d36a7868 ] + +When uncloning an skb dst and its associated metadata a new dst+metadata +is allocated and the tunnel information from the old metadata is copied +over there. + +The issue is the tunnel metadata has references to cached dst, which are +copied along the way. When a dst+metadata refcount drops to 0 the +metadata is freed including the cached dst entries. As they are also +referenced in the initial dst+metadata, this ends up in UaFs. + +In practice the above did not happen because of another issue, the +dst+metadata was never freed because its refcount never dropped to 0 +(this will be fixed in a subsequent patch). + +Fix this by initializing the dst cache after copying the tunnel +information from the old metadata to also unshare the dst cache. + +Fixes: d71785ffc7e7 ("net: add dst_cache to ovs vxlan lwtunnel") +Cc: Paolo Abeni +Reported-by: Vlad Buslov +Tested-by: Vlad Buslov +Signed-off-by: Antoine Tenart +Acked-by: Paolo Abeni +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/dst_metadata.h | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/include/net/dst_metadata.h b/include/net/dst_metadata.h +index 14efa0ded75dd..b997e0c1e3627 100644 +--- a/include/net/dst_metadata.h ++++ b/include/net/dst_metadata.h +@@ -123,6 +123,19 @@ static inline struct metadata_dst *tun_dst_unclone(struct sk_buff *skb) + + memcpy(&new_md->u.tun_info, &md_dst->u.tun_info, + sizeof(struct ip_tunnel_info) + md_size); ++#ifdef CONFIG_DST_CACHE ++ /* Unclone the dst cache if there is one */ ++ if (new_md->u.tun_info.dst_cache.cache) { ++ int ret; ++ ++ ret = dst_cache_init(&new_md->u.tun_info.dst_cache, GFP_ATOMIC); ++ if (ret) { ++ metadata_dst_free(new_md); ++ return ERR_PTR(ret); ++ } ++ } ++#endif ++ + skb_dst_drop(skb); + dst_hold(&new_md->dst); + skb_dst_set(skb, &new_md->dst); +-- +2.34.1 + diff --git a/queue-5.16/net-dsa-ar9331-register-the-mdiobus-under-devres.patch b/queue-5.16/net-dsa-ar9331-register-the-mdiobus-under-devres.patch new file mode 100644 index 00000000000..20bc21bfa86 --- /dev/null +++ b/queue-5.16/net-dsa-ar9331-register-the-mdiobus-under-devres.patch @@ -0,0 +1,69 @@ +From c082fba253828b917f1e089ac08e29b3a041c6d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Feb 2022 18:15:48 +0200 +Subject: net: dsa: ar9331: register the mdiobus under devres + +From: Vladimir Oltean + +[ Upstream commit 50facd86e9fbc4b93fe02e5fe05776047f45dbfb ] + +As explained in commits: +74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") +5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres") + +mdiobus_free() will panic when called from devm_mdiobus_free() <- +devres_release_all() <- __device_release_driver(), and that mdiobus was +not previously unregistered. + +The ar9331 is an MDIO device, so the initial set of constraints that I +thought would cause this (I2C or SPI buses which call ->remove on +->shutdown) do not apply. But there is one more which applies here. + +If the DSA master itself is on a bus that calls ->remove from ->shutdown +(like dpaa2-eth, which is on the fsl-mc bus), there is a device link +between the switch and the DSA master, and device_links_unbind_consumers() +will unbind the ar9331 switch driver on shutdown. + +So the same treatment must be applied to all DSA switch drivers, which +is: either use devres for both the mdiobus allocation and registration, +or don't use devres at all. + +The ar9331 driver doesn't have a complex code structure for mdiobus +removal, so just replace of_mdiobus_register with the devres variant in +order to be all-devres and ensure that we don't free a still-registered +bus. + +Fixes: ac3a68d56651 ("net: phy: don't abuse devres in devm_mdiobus_register()") +Signed-off-by: Vladimir Oltean +Reviewed-by: Florian Fainelli +Tested-by: Oleksij Rempel +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/qca/ar9331.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/qca/ar9331.c b/drivers/net/dsa/qca/ar9331.c +index da0d7e68643a9..c39de2a4c1fe0 100644 +--- a/drivers/net/dsa/qca/ar9331.c ++++ b/drivers/net/dsa/qca/ar9331.c +@@ -378,7 +378,7 @@ static int ar9331_sw_mbus_init(struct ar9331_sw_priv *priv) + if (!mnp) + return -ENODEV; + +- ret = of_mdiobus_register(mbus, mnp); ++ ret = devm_of_mdiobus_register(dev, mbus, mnp); + of_node_put(mnp); + if (ret) + return ret; +@@ -1091,7 +1091,6 @@ static void ar9331_sw_remove(struct mdio_device *mdiodev) + } + + irq_domain_remove(priv->irqdomain); +- mdiobus_unregister(priv->mbus); + dsa_unregister_switch(&priv->ds); + + reset_control_assert(priv->sw_reset); +-- +2.34.1 + diff --git a/queue-5.16/net-dsa-bcm_sf2-don-t-use-devres-for-mdiobus.patch b/queue-5.16/net-dsa-bcm_sf2-don-t-use-devres-for-mdiobus.patch new file mode 100644 index 00000000000..3b3841e3509 --- /dev/null +++ b/queue-5.16/net-dsa-bcm_sf2-don-t-use-devres-for-mdiobus.patch @@ -0,0 +1,81 @@ +From 7e8251c730d10e4589c51181a80f005e9eb175fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Feb 2022 18:15:49 +0200 +Subject: net: dsa: bcm_sf2: don't use devres for mdiobus + +From: Vladimir Oltean + +[ Upstream commit 08f1a20822349004bb9cc1b153ecb516e9f2889d ] + +As explained in commits: +74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") +5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres") + +mdiobus_free() will panic when called from devm_mdiobus_free() <- +devres_release_all() <- __device_release_driver(), and that mdiobus was +not previously unregistered. + +The Starfighter 2 is a platform device, so the initial set of +constraints that I thought would cause this (I2C or SPI buses which call +->remove on ->shutdown) do not apply. But there is one more which +applies here. + +If the DSA master itself is on a bus that calls ->remove from ->shutdown +(like dpaa2-eth, which is on the fsl-mc bus), there is a device link +between the switch and the DSA master, and device_links_unbind_consumers() +will unbind the bcm_sf2 switch driver on shutdown. + +So the same treatment must be applied to all DSA switch drivers, which +is: either use devres for both the mdiobus allocation and registration, +or don't use devres at all. + +The bcm_sf2 driver has the code structure in place for orderly mdiobus +removal, so just replace devm_mdiobus_alloc() with the non-devres +variant, and add manual free where necessary, to ensure that we don't +let devres free a still-registered bus. + +Fixes: ac3a68d56651 ("net: phy: don't abuse devres in devm_mdiobus_register()") +Signed-off-by: Vladimir Oltean +Reviewed-by: Florian Fainelli +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/bcm_sf2.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c +index 13aa43b5cffd9..1502d200682f8 100644 +--- a/drivers/net/dsa/bcm_sf2.c ++++ b/drivers/net/dsa/bcm_sf2.c +@@ -584,7 +584,7 @@ static int bcm_sf2_mdio_register(struct dsa_switch *ds) + get_device(&priv->master_mii_bus->dev); + priv->master_mii_dn = dn; + +- priv->slave_mii_bus = devm_mdiobus_alloc(ds->dev); ++ priv->slave_mii_bus = mdiobus_alloc(); + if (!priv->slave_mii_bus) { + of_node_put(dn); + return -ENOMEM; +@@ -644,8 +644,10 @@ static int bcm_sf2_mdio_register(struct dsa_switch *ds) + } + + err = mdiobus_register(priv->slave_mii_bus); +- if (err && dn) ++ if (err && dn) { ++ mdiobus_free(priv->slave_mii_bus); + of_node_put(dn); ++ } + + return err; + } +@@ -653,6 +655,7 @@ static int bcm_sf2_mdio_register(struct dsa_switch *ds) + static void bcm_sf2_mdio_unregister(struct bcm_sf2_priv *priv) + { + mdiobus_unregister(priv->slave_mii_bus); ++ mdiobus_free(priv->slave_mii_bus); + of_node_put(priv->master_mii_dn); + } + +-- +2.34.1 + diff --git a/queue-5.16/net-dsa-felix-don-t-use-devres-for-mdiobus.patch b/queue-5.16/net-dsa-felix-don-t-use-devres-for-mdiobus.patch new file mode 100644 index 00000000000..fac7e87967f --- /dev/null +++ b/queue-5.16/net-dsa-felix-don-t-use-devres-for-mdiobus.patch @@ -0,0 +1,77 @@ +From 440ce0bb9f1cd8c500021b51259596b0a44b1c37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Feb 2022 18:15:50 +0200 +Subject: net: dsa: felix: don't use devres for mdiobus + +From: Vladimir Oltean + +[ Upstream commit 209bdb7ec6a28c7cdf580a0a98afbc9fc3b98932 ] + +As explained in commits: +74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") +5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres") + +mdiobus_free() will panic when called from devm_mdiobus_free() <- +devres_release_all() <- __device_release_driver(), and that mdiobus was +not previously unregistered. + +The Felix VSC9959 switch is a PCI device, so the initial set of +constraints that I thought would cause this (I2C or SPI buses which call +->remove on ->shutdown) do not apply. But there is one more which +applies here. + +If the DSA master itself is on a bus that calls ->remove from ->shutdown +(like dpaa2-eth, which is on the fsl-mc bus), there is a device link +between the switch and the DSA master, and device_links_unbind_consumers() +will unbind the felix switch driver on shutdown. + +So the same treatment must be applied to all DSA switch drivers, which +is: either use devres for both the mdiobus allocation and registration, +or don't use devres at all. + +The felix driver has the code structure in place for orderly mdiobus +removal, so just replace devm_mdiobus_alloc_size() with the non-devres +variant, and add manual free where necessary, to ensure that we don't +let devres free a still-registered bus. + +Fixes: ac3a68d56651 ("net: phy: don't abuse devres in devm_mdiobus_register()") +Signed-off-by: Vladimir Oltean +Reviewed-by: Florian Fainelli +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/ocelot/felix_vsc9959.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/ocelot/felix_vsc9959.c b/drivers/net/dsa/ocelot/felix_vsc9959.c +index 45c5ec7a83eaf..12c2acbc2427b 100644 +--- a/drivers/net/dsa/ocelot/felix_vsc9959.c ++++ b/drivers/net/dsa/ocelot/felix_vsc9959.c +@@ -1064,7 +1064,7 @@ static int vsc9959_mdio_bus_alloc(struct ocelot *ocelot) + return PTR_ERR(hw); + } + +- bus = devm_mdiobus_alloc_size(dev, sizeof(*mdio_priv)); ++ bus = mdiobus_alloc_size(sizeof(*mdio_priv)); + if (!bus) + return -ENOMEM; + +@@ -1084,6 +1084,7 @@ static int vsc9959_mdio_bus_alloc(struct ocelot *ocelot) + rc = mdiobus_register(bus); + if (rc < 0) { + dev_err(dev, "failed to register MDIO bus\n"); ++ mdiobus_free(bus); + return rc; + } + +@@ -1133,6 +1134,7 @@ static void vsc9959_mdio_bus_free(struct ocelot *ocelot) + lynx_pcs_destroy(pcs); + } + mdiobus_unregister(felix->imdio); ++ mdiobus_free(felix->imdio); + } + + static void vsc9959_sched_speed_set(struct ocelot *ocelot, int port, +-- +2.34.1 + diff --git a/queue-5.16/net-dsa-fix-panic-when-dsa-master-device-unbinds-on-.patch b/queue-5.16/net-dsa-fix-panic-when-dsa-master-device-unbinds-on-.patch new file mode 100644 index 00000000000..7ad0314d192 --- /dev/null +++ b/queue-5.16/net-dsa-fix-panic-when-dsa-master-device-unbinds-on-.patch @@ -0,0 +1,129 @@ +From 469aec9808ba7afcc42a61f906af30cdccbf5fc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Feb 2022 14:04:33 +0200 +Subject: net: dsa: fix panic when DSA master device unbinds on shutdown + +From: Vladimir Oltean + +[ Upstream commit ee534378f00561207656663d93907583958339ae ] + +Rafael reports that on a system with LX2160A and Marvell DSA switches, +if a reboot occurs while the DSA master (dpaa2-eth) is up, the following +panic can be seen: + +systemd-shutdown[1]: Rebooting. +Unable to handle kernel paging request at virtual address 00a0000800000041 +[00a0000800000041] address between user and kernel address ranges +Internal error: Oops: 96000004 [#1] PREEMPT SMP +CPU: 6 PID: 1 Comm: systemd-shutdow Not tainted 5.16.5-00042-g8f5585009b24 #32 +pc : dsa_slave_netdevice_event+0x130/0x3e4 +lr : raw_notifier_call_chain+0x50/0x6c +Call trace: + dsa_slave_netdevice_event+0x130/0x3e4 + raw_notifier_call_chain+0x50/0x6c + call_netdevice_notifiers_info+0x54/0xa0 + __dev_close_many+0x50/0x130 + dev_close_many+0x84/0x120 + unregister_netdevice_many+0x130/0x710 + unregister_netdevice_queue+0x8c/0xd0 + unregister_netdev+0x20/0x30 + dpaa2_eth_remove+0x68/0x190 + fsl_mc_driver_remove+0x20/0x5c + __device_release_driver+0x21c/0x220 + device_release_driver_internal+0xac/0xb0 + device_links_unbind_consumers+0xd4/0x100 + __device_release_driver+0x94/0x220 + device_release_driver+0x28/0x40 + bus_remove_device+0x118/0x124 + device_del+0x174/0x420 + fsl_mc_device_remove+0x24/0x40 + __fsl_mc_device_remove+0xc/0x20 + device_for_each_child+0x58/0xa0 + dprc_remove+0x90/0xb0 + fsl_mc_driver_remove+0x20/0x5c + __device_release_driver+0x21c/0x220 + device_release_driver+0x28/0x40 + bus_remove_device+0x118/0x124 + device_del+0x174/0x420 + fsl_mc_bus_remove+0x80/0x100 + fsl_mc_bus_shutdown+0xc/0x1c + platform_shutdown+0x20/0x30 + device_shutdown+0x154/0x330 + __do_sys_reboot+0x1cc/0x250 + __arm64_sys_reboot+0x20/0x30 + invoke_syscall.constprop.0+0x4c/0xe0 + do_el0_svc+0x4c/0x150 + el0_svc+0x24/0xb0 + el0t_64_sync_handler+0xa8/0xb0 + el0t_64_sync+0x178/0x17c + +It can be seen from the stack trace that the problem is that the +deregistration of the master causes a dev_close(), which gets notified +as NETDEV_GOING_DOWN to dsa_slave_netdevice_event(). +But dsa_switch_shutdown() has already run, and this has unregistered the +DSA slave interfaces, and yet, the NETDEV_GOING_DOWN handler attempts to +call dev_close_many() on those slave interfaces, leading to the problem. + +The previous attempt to avoid the NETDEV_GOING_DOWN on the master after +dsa_switch_shutdown() was called seems improper. Unregistering the slave +interfaces is unnecessary and unhelpful. Instead, after the slaves have +stopped being uppers of the DSA master, we can now reset to NULL the +master->dsa_ptr pointer, which will make DSA start ignoring all future +notifier events on the master. + +Fixes: 0650bf52b31f ("net: dsa: be compatible with masters which unregister on shutdown") +Reported-by: Rafael Richter +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/dsa/dsa2.c | 25 ++++++------------------- + 1 file changed, 6 insertions(+), 19 deletions(-) + +diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c +index 826957b6442b0..7578b1350f182 100644 +--- a/net/dsa/dsa2.c ++++ b/net/dsa/dsa2.c +@@ -1609,7 +1609,6 @@ EXPORT_SYMBOL_GPL(dsa_unregister_switch); + void dsa_switch_shutdown(struct dsa_switch *ds) + { + struct net_device *master, *slave_dev; +- LIST_HEAD(unregister_list); + struct dsa_port *dp; + + mutex_lock(&dsa2_mutex); +@@ -1620,25 +1619,13 @@ void dsa_switch_shutdown(struct dsa_switch *ds) + slave_dev = dp->slave; + + netdev_upper_dev_unlink(master, slave_dev); +- /* Just unlinking ourselves as uppers of the master is not +- * sufficient. When the master net device unregisters, that will +- * also call dev_close, which we will catch as NETDEV_GOING_DOWN +- * and trigger a dev_close on our own devices (dsa_slave_close). +- * In turn, that will call dev_mc_unsync on the master's net +- * device. If the master is also a DSA switch port, this will +- * trigger dsa_slave_set_rx_mode which will call dev_mc_sync on +- * its own master. Lockdep will complain about the fact that +- * all cascaded masters have the same dsa_master_addr_list_lock_key, +- * which it normally would not do if the cascaded masters would +- * be in a proper upper/lower relationship, which we've just +- * destroyed. +- * To suppress the lockdep warnings, let's actually unregister +- * the DSA slave interfaces too, to avoid the nonsensical +- * multicast address list synchronization on shutdown. +- */ +- unregister_netdevice_queue(slave_dev, &unregister_list); + } +- unregister_netdevice_many(&unregister_list); ++ ++ /* Disconnect from further netdevice notifiers on the master, ++ * since netdev_uses_dsa() will now return false. ++ */ ++ dsa_switch_for_each_cpu_port(dp, ds) ++ dp->master->dsa_ptr = NULL; + + rtnl_unlock(); + mutex_unlock(&dsa2_mutex); +-- +2.34.1 + diff --git a/queue-5.16/net-dsa-lantiq_gswip-don-t-use-devres-for-mdiobus.patch b/queue-5.16/net-dsa-lantiq_gswip-don-t-use-devres-for-mdiobus.patch new file mode 100644 index 00000000000..2a246e153f3 --- /dev/null +++ b/queue-5.16/net-dsa-lantiq_gswip-don-t-use-devres-for-mdiobus.patch @@ -0,0 +1,95 @@ +From 4dd5ad7894282dea37d0b89e9983f1e1a3032db7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Feb 2022 18:15:53 +0200 +Subject: net: dsa: lantiq_gswip: don't use devres for mdiobus + +From: Vladimir Oltean + +[ Upstream commit 0d120dfb5d67edc5bcd1804e167dba2b30809afd ] + +As explained in commits: +74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") +5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres") + +mdiobus_free() will panic when called from devm_mdiobus_free() <- +devres_release_all() <- __device_release_driver(), and that mdiobus was +not previously unregistered. + +The GSWIP switch is a platform device, so the initial set of constraints +that I thought would cause this (I2C or SPI buses which call ->remove on +->shutdown) do not apply. But there is one more which applies here. + +If the DSA master itself is on a bus that calls ->remove from ->shutdown +(like dpaa2-eth, which is on the fsl-mc bus), there is a device link +between the switch and the DSA master, and device_links_unbind_consumers() +will unbind the GSWIP switch driver on shutdown. + +So the same treatment must be applied to all DSA switch drivers, which +is: either use devres for both the mdiobus allocation and registration, +or don't use devres at all. + +The gswip driver has the code structure in place for orderly mdiobus +removal, so just replace devm_mdiobus_alloc() with the non-devres +variant, and add manual free where necessary, to ensure that we don't +let devres free a still-registered bus. + +Fixes: ac3a68d56651 ("net: phy: don't abuse devres in devm_mdiobus_register()") +Signed-off-by: Vladimir Oltean +Reviewed-by: Florian Fainelli +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/lantiq_gswip.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/dsa/lantiq_gswip.c b/drivers/net/dsa/lantiq_gswip.c +index 7056d98d8177b..0909b05d02133 100644 +--- a/drivers/net/dsa/lantiq_gswip.c ++++ b/drivers/net/dsa/lantiq_gswip.c +@@ -498,8 +498,9 @@ static int gswip_mdio_rd(struct mii_bus *bus, int addr, int reg) + static int gswip_mdio(struct gswip_priv *priv, struct device_node *mdio_np) + { + struct dsa_switch *ds = priv->ds; ++ int err; + +- ds->slave_mii_bus = devm_mdiobus_alloc(priv->dev); ++ ds->slave_mii_bus = mdiobus_alloc(); + if (!ds->slave_mii_bus) + return -ENOMEM; + +@@ -512,7 +513,11 @@ static int gswip_mdio(struct gswip_priv *priv, struct device_node *mdio_np) + ds->slave_mii_bus->parent = priv->dev; + ds->slave_mii_bus->phy_mask = ~ds->phys_mii_mask; + +- return of_mdiobus_register(ds->slave_mii_bus, mdio_np); ++ err = of_mdiobus_register(ds->slave_mii_bus, mdio_np); ++ if (err) ++ mdiobus_free(ds->slave_mii_bus); ++ ++ return err; + } + + static int gswip_pce_table_entry_read(struct gswip_priv *priv, +@@ -2186,8 +2191,10 @@ static int gswip_probe(struct platform_device *pdev) + gswip_mdio_mask(priv, GSWIP_MDIO_GLOB_ENABLE, 0, GSWIP_MDIO_GLOB); + dsa_unregister_switch(priv->ds); + mdio_bus: +- if (mdio_np) ++ if (mdio_np) { + mdiobus_unregister(priv->ds->slave_mii_bus); ++ mdiobus_free(priv->ds->slave_mii_bus); ++ } + put_mdio_node: + of_node_put(mdio_np); + for (i = 0; i < priv->num_gphy_fw; i++) +@@ -2210,6 +2217,7 @@ static int gswip_remove(struct platform_device *pdev) + + if (priv->ds->slave_mii_bus) { + mdiobus_unregister(priv->ds->slave_mii_bus); ++ mdiobus_free(priv->ds->slave_mii_bus); + of_node_put(priv->ds->slave_mii_bus->dev.of_node); + } + +-- +2.34.1 + diff --git a/queue-5.16/net-dsa-mt7530-fix-kernel-bug-in-mdiobus_free-when-u.patch b/queue-5.16/net-dsa-mt7530-fix-kernel-bug-in-mdiobus_free-when-u.patch new file mode 100644 index 00000000000..a2a14385bd4 --- /dev/null +++ b/queue-5.16/net-dsa-mt7530-fix-kernel-bug-in-mdiobus_free-when-u.patch @@ -0,0 +1,50 @@ +From 3a0104dbd78c692c7d35bc48ff2af80872eab681 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Feb 2022 18:15:52 +0200 +Subject: net: dsa: mt7530: fix kernel bug in mdiobus_free() when unbinding + +From: Vladimir Oltean + +[ Upstream commit 9ffe3d09e32da45bb5a29cf2e80ec8d7534010c5 ] + +Nobody in this driver calls mdiobus_unregister(), which is necessary if +mdiobus_register() completes successfully. So if the devres callbacks +that free the mdiobus get invoked (this is the case when unbinding the +driver), mdiobus_free() will BUG if the mdiobus is still registered, +which it is. + +My speculation is that this is due to the fact that prior to commit +ac3a68d56651 ("net: phy: don't abuse devres in devm_mdiobus_register()") +from June 2020, _devm_mdiobus_free() used to call mdiobus_unregister(). +But at the time that the mt7530 support was introduced in May 2021, the +API was already changed. It's therefore likely that the blamed patch was +developed on an older tree, and incorrectly adapted to net-next. This +makes the Fixes: tag correct. + +Fix the problem by using the devres variant of mdiobus_register. + +Fixes: ba751e28d442 ("net: dsa: mt7530: add interrupt support") +Signed-off-by: Vladimir Oltean +Reviewed-by: Florian Fainelli +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mt7530.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index 9890672a206d0..fb59efc7f9266 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -2066,7 +2066,7 @@ mt7530_setup_mdio(struct mt7530_priv *priv) + if (priv->irq) + mt7530_setup_mdio_irq(priv); + +- ret = mdiobus_register(bus); ++ ret = devm_mdiobus_register(dev, bus); + if (ret) { + dev_err(dev, "failed to register MDIO bus: %d\n", ret); + if (priv->irq) +-- +2.34.1 + diff --git a/queue-5.16/net-dsa-mv88e6xxx-don-t-use-devres-for-mdiobus.patch b/queue-5.16/net-dsa-mv88e6xxx-don-t-use-devres-for-mdiobus.patch new file mode 100644 index 00000000000..2ced5d53b12 --- /dev/null +++ b/queue-5.16/net-dsa-mv88e6xxx-don-t-use-devres-for-mdiobus.patch @@ -0,0 +1,144 @@ +From 64441f22cd21e44471d5a4374831b29509285bbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Feb 2022 18:15:47 +0200 +Subject: net: dsa: mv88e6xxx: don't use devres for mdiobus + +From: Vladimir Oltean + +[ Upstream commit f53a2ce893b2c7884ef94471f170839170a4eba0 ] + +As explained in commits: +74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") +5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres") + +mdiobus_free() will panic when called from devm_mdiobus_free() <- +devres_release_all() <- __device_release_driver(), and that mdiobus was +not previously unregistered. + +The mv88e6xxx is an MDIO device, so the initial set of constraints that +I thought would cause this (I2C or SPI buses which call ->remove on +->shutdown) do not apply. But there is one more which applies here. + +If the DSA master itself is on a bus that calls ->remove from ->shutdown +(like dpaa2-eth, which is on the fsl-mc bus), there is a device link +between the switch and the DSA master, and device_links_unbind_consumers() +will unbind the Marvell switch driver on shutdown. + +systemd-shutdown[1]: Powering off. +mv88e6085 0x0000000008b96000:00 sw_gl0: Link is Down +fsl-mc dpbp.9: Removing from iommu group 7 +fsl-mc dpbp.8: Removing from iommu group 7 +------------[ cut here ]------------ +kernel BUG at drivers/net/phy/mdio_bus.c:677! +Internal error: Oops - BUG: 0 [#1] PREEMPT SMP +Modules linked in: +CPU: 0 PID: 1 Comm: systemd-shutdow Not tainted 5.16.5-00040-gdc05f73788e5 #15 +pc : mdiobus_free+0x44/0x50 +lr : devm_mdiobus_free+0x10/0x20 +Call trace: + mdiobus_free+0x44/0x50 + devm_mdiobus_free+0x10/0x20 + devres_release_all+0xa0/0x100 + __device_release_driver+0x190/0x220 + device_release_driver_internal+0xac/0xb0 + device_links_unbind_consumers+0xd4/0x100 + __device_release_driver+0x4c/0x220 + device_release_driver_internal+0xac/0xb0 + device_links_unbind_consumers+0xd4/0x100 + __device_release_driver+0x94/0x220 + device_release_driver+0x28/0x40 + bus_remove_device+0x118/0x124 + device_del+0x174/0x420 + fsl_mc_device_remove+0x24/0x40 + __fsl_mc_device_remove+0xc/0x20 + device_for_each_child+0x58/0xa0 + dprc_remove+0x90/0xb0 + fsl_mc_driver_remove+0x20/0x5c + __device_release_driver+0x21c/0x220 + device_release_driver+0x28/0x40 + bus_remove_device+0x118/0x124 + device_del+0x174/0x420 + fsl_mc_bus_remove+0x80/0x100 + fsl_mc_bus_shutdown+0xc/0x1c + platform_shutdown+0x20/0x30 + device_shutdown+0x154/0x330 + kernel_power_off+0x34/0x6c + __do_sys_reboot+0x15c/0x250 + __arm64_sys_reboot+0x20/0x30 + invoke_syscall.constprop.0+0x4c/0xe0 + do_el0_svc+0x4c/0x150 + el0_svc+0x24/0xb0 + el0t_64_sync_handler+0xa8/0xb0 + el0t_64_sync+0x178/0x17c + +So the same treatment must be applied to all DSA switch drivers, which +is: either use devres for both the mdiobus allocation and registration, +or don't use devres at all. + +The Marvell driver already has a good structure for mdiobus removal, so +just plug in mdiobus_free and get rid of devres. + +Fixes: ac3a68d56651 ("net: phy: don't abuse devres in devm_mdiobus_register()") +Reported-by: Rafael Richter +Signed-off-by: Vladimir Oltean +Tested-by: Daniel Klauer +Reviewed-by: Andrew Lunn +Reviewed-by: Florian Fainelli +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index cd8462d1e27c0..fcd648d0f6372 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -3415,7 +3415,7 @@ static int mv88e6xxx_mdio_register(struct mv88e6xxx_chip *chip, + return err; + } + +- bus = devm_mdiobus_alloc_size(chip->dev, sizeof(*mdio_bus)); ++ bus = mdiobus_alloc_size(sizeof(*mdio_bus)); + if (!bus) + return -ENOMEM; + +@@ -3440,14 +3440,14 @@ static int mv88e6xxx_mdio_register(struct mv88e6xxx_chip *chip, + if (!external) { + err = mv88e6xxx_g2_irq_mdio_setup(chip, bus); + if (err) +- return err; ++ goto out; + } + + err = of_mdiobus_register(bus, np); + if (err) { + dev_err(chip->dev, "Cannot register MDIO bus (%d)\n", err); + mv88e6xxx_g2_irq_mdio_free(chip, bus); +- return err; ++ goto out; + } + + if (external) +@@ -3456,6 +3456,10 @@ static int mv88e6xxx_mdio_register(struct mv88e6xxx_chip *chip, + list_add(&mdio_bus->list, &chip->mdios); + + return 0; ++ ++out: ++ mdiobus_free(bus); ++ return err; + } + + static void mv88e6xxx_mdios_unregister(struct mv88e6xxx_chip *chip) +@@ -3471,6 +3475,7 @@ static void mv88e6xxx_mdios_unregister(struct mv88e6xxx_chip *chip) + mv88e6xxx_g2_irq_mdio_free(chip, bus); + + mdiobus_unregister(bus); ++ mdiobus_free(bus); + } + } + +-- +2.34.1 + diff --git a/queue-5.16/net-dsa-mv88e6xxx-fix-use-after-free-in-mv88e6xxx_md.patch b/queue-5.16/net-dsa-mv88e6xxx-fix-use-after-free-in-mv88e6xxx_md.patch new file mode 100644 index 00000000000..efd199ed4d5 --- /dev/null +++ b/queue-5.16/net-dsa-mv88e6xxx-fix-use-after-free-in-mv88e6xxx_md.patch @@ -0,0 +1,48 @@ +From b5ba9ea7bb1e1016f0f8c2a1401459553e82c11b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Feb 2022 19:40:17 +0200 +Subject: net: dsa: mv88e6xxx: fix use-after-free in mv88e6xxx_mdios_unregister + +From: Vladimir Oltean + +[ Upstream commit 51a04ebf21122d5c76a716ecd9bfc33ea44b2b39 ] + +Since struct mv88e6xxx_mdio_bus *mdio_bus is the bus->priv of something +allocated with mdiobus_alloc_size(), this means that mdiobus_free(bus) +will free the memory backing the mdio_bus as well. Therefore, the +mdio_bus->list element is freed memory, but we continue to iterate +through the list of MDIO buses using that list element. + +To fix this, use the proper list iterator that handles element deletion +by keeping a copy of the list element next pointer. + +Fixes: f53a2ce893b2 ("net: dsa: mv88e6xxx: don't use devres for mdiobus") +Reported-by: Rafael Richter +Signed-off-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20220210174017.3271099-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index fcd648d0f6372..70cea1b95298a 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -3465,10 +3465,10 @@ static int mv88e6xxx_mdio_register(struct mv88e6xxx_chip *chip, + static void mv88e6xxx_mdios_unregister(struct mv88e6xxx_chip *chip) + + { +- struct mv88e6xxx_mdio_bus *mdio_bus; ++ struct mv88e6xxx_mdio_bus *mdio_bus, *p; + struct mii_bus *bus; + +- list_for_each_entry(mdio_bus, &chip->mdios, list) { ++ list_for_each_entry_safe(mdio_bus, p, &chip->mdios, list) { + bus = mdio_bus->bus; + + if (!mdio_bus->external) +-- +2.34.1 + diff --git a/queue-5.16/net-dsa-ocelot-seville-utilize-of_mdiobus_register.patch b/queue-5.16/net-dsa-ocelot-seville-utilize-of_mdiobus_register.patch new file mode 100644 index 00000000000..e1c2a01a927 --- /dev/null +++ b/queue-5.16/net-dsa-ocelot-seville-utilize-of_mdiobus_register.patch @@ -0,0 +1,47 @@ +From e36472c36a803120cbc9ecf287a44e618746359b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Nov 2021 17:57:36 -0800 +Subject: net: dsa: ocelot: seville: utilize of_mdiobus_register + +From: Colin Foster + +[ Upstream commit 5186c4a05b9713138b762a49467a8ab9753cdb36 ] + +Switch seville to use of_mdiobus_register(bus, NULL) instead of just +mdiobus_register. This code is about to be pulled into a separate module +that can optionally define ports by the device_node. + +Signed-off-by: Colin Foster +Reviewed-by: Florian Fainelli +Reviewed-by: Vladimir Oltean +Tested-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/ocelot/seville_vsc9953.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/ocelot/seville_vsc9953.c b/drivers/net/dsa/ocelot/seville_vsc9953.c +index 92eae63150eae..5ee7d1592a721 100644 +--- a/drivers/net/dsa/ocelot/seville_vsc9953.c ++++ b/drivers/net/dsa/ocelot/seville_vsc9953.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include "felix.h" + + #define MSCC_MIIM_CMD_OPR_WRITE BIT(1) +@@ -1108,7 +1109,7 @@ static int vsc9953_mdio_bus_alloc(struct ocelot *ocelot) + snprintf(bus->id, MII_BUS_ID_SIZE, "%s-imdio", dev_name(dev)); + + /* Needed in order to initialize the bus mutex lock */ +- rc = mdiobus_register(bus); ++ rc = of_mdiobus_register(bus, NULL); + if (rc < 0) { + dev_err(dev, "failed to register MDIO bus\n"); + return rc; +-- +2.34.1 + diff --git a/queue-5.16/net-dsa-seville-register-the-mdiobus-under-devres.patch b/queue-5.16/net-dsa-seville-register-the-mdiobus-under-devres.patch new file mode 100644 index 00000000000..e484776edd1 --- /dev/null +++ b/queue-5.16/net-dsa-seville-register-the-mdiobus-under-devres.patch @@ -0,0 +1,75 @@ +From 3ab87a574428de8bf7910b071f3b0ce05722d9d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Feb 2022 18:15:51 +0200 +Subject: net: dsa: seville: register the mdiobus under devres + +From: Vladimir Oltean + +[ Upstream commit bd488afc3b39e045ba71aab472233f2a78726e7b ] + +As explained in commits: +74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") +5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres") + +mdiobus_free() will panic when called from devm_mdiobus_free() <- +devres_release_all() <- __device_release_driver(), and that mdiobus was +not previously unregistered. + +The Seville VSC9959 switch is a platform device, so the initial set of +constraints that I thought would cause this (I2C or SPI buses which call +->remove on ->shutdown) do not apply. But there is one more which +applies here. + +If the DSA master itself is on a bus that calls ->remove from ->shutdown +(like dpaa2-eth, which is on the fsl-mc bus), there is a device link +between the switch and the DSA master, and device_links_unbind_consumers() +will unbind the seville switch driver on shutdown. + +So the same treatment must be applied to all DSA switch drivers, which +is: either use devres for both the mdiobus allocation and registration, +or don't use devres at all. + +The seville driver has a code structure that could accommodate both the +mdiobus_unregister and mdiobus_free calls, but it has an external +dependency upon mscc_miim_setup() from mdio-mscc-miim.c, which calls +devm_mdiobus_alloc_size() on its behalf. So rather than restructuring +that, and exporting yet one more symbol mscc_miim_teardown(), let's work +with devres and replace of_mdiobus_register with the devres variant. +When we use all-devres, we can ensure that devres doesn't free a +still-registered bus (it either runs both callbacks, or none). + +Fixes: ac3a68d56651 ("net: phy: don't abuse devres in devm_mdiobus_register()") +Signed-off-by: Vladimir Oltean +Reviewed-by: Florian Fainelli +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/ocelot/seville_vsc9953.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/ocelot/seville_vsc9953.c b/drivers/net/dsa/ocelot/seville_vsc9953.c +index 5ee7d1592a721..40d6d1f2c724f 100644 +--- a/drivers/net/dsa/ocelot/seville_vsc9953.c ++++ b/drivers/net/dsa/ocelot/seville_vsc9953.c +@@ -1109,7 +1109,7 @@ static int vsc9953_mdio_bus_alloc(struct ocelot *ocelot) + snprintf(bus->id, MII_BUS_ID_SIZE, "%s-imdio", dev_name(dev)); + + /* Needed in order to initialize the bus mutex lock */ +- rc = of_mdiobus_register(bus, NULL); ++ rc = devm_of_mdiobus_register(dev, bus, NULL); + if (rc < 0) { + dev_err(dev, "failed to register MDIO bus\n"); + return rc; +@@ -1161,7 +1161,8 @@ static void vsc9953_mdio_bus_free(struct ocelot *ocelot) + mdio_device_free(pcs->mdio); + lynx_pcs_destroy(pcs); + } +- mdiobus_unregister(felix->imdio); ++ ++ /* mdiobus_unregister and mdiobus_free handled by devres */ + } + + static const struct felix_info seville_info_vsc9953 = { +-- +2.34.1 + diff --git a/queue-5.16/net-ethernet-litex-add-the-dependency-on-has_iomem.patch b/queue-5.16/net-ethernet-litex-add-the-dependency-on-has_iomem.patch new file mode 100644 index 00000000000..2e221b59eb1 --- /dev/null +++ b/queue-5.16/net-ethernet-litex-add-the-dependency-on-has_iomem.patch @@ -0,0 +1,37 @@ +From efa52f667d17931c2b3d0582b8ffb31369cc867b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Feb 2022 09:33:08 +0800 +Subject: net: ethernet: litex: Add the dependency on HAS_IOMEM + +From: Cai Huoqing + +[ Upstream commit 2427f03fb42f9dc14c53108f2c9b5563eb37e770 ] + +The LiteX driver uses devm io function API which +needs HAS_IOMEM enabled, so add the dependency on HAS_IOMEM. + +Fixes: ee7da21ac4c3 ("net: Add driver for LiteX's LiteETH network interface") +Signed-off-by: Cai Huoqing +Link: https://lore.kernel.org/r/20220208013308.6563-1-cai.huoqing@linux.dev +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/litex/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/litex/Kconfig b/drivers/net/ethernet/litex/Kconfig +index f99adbf26ab4e..04345b929d8e5 100644 +--- a/drivers/net/ethernet/litex/Kconfig ++++ b/drivers/net/ethernet/litex/Kconfig +@@ -17,7 +17,7 @@ if NET_VENDOR_LITEX + + config LITEX_LITEETH + tristate "LiteX Ethernet support" +- depends on OF ++ depends on OF && HAS_IOMEM + help + If you wish to compile a kernel for hardware with a LiteX LiteEth + device then you should answer Y to this. +-- +2.34.1 + diff --git a/queue-5.16/net-fix-a-memleak-when-uncloning-an-skb-dst-and-its-.patch b/queue-5.16/net-fix-a-memleak-when-uncloning-an-skb-dst-and-its-.patch new file mode 100644 index 00000000000..6025a31e897 --- /dev/null +++ b/queue-5.16/net-fix-a-memleak-when-uncloning-an-skb-dst-and-its-.patch @@ -0,0 +1,49 @@ +From 69c8376ea778423580d3fd7baee371c35a26c39b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Feb 2022 18:13:19 +0100 +Subject: net: fix a memleak when uncloning an skb dst and its metadata + +From: Antoine Tenart + +[ Upstream commit 9eeabdf17fa0ab75381045c867c370f4cc75a613 ] + +When uncloning an skb dst and its associated metadata, a new +dst+metadata is allocated and later replaces the old one in the skb. +This is helpful to have a non-shared dst+metadata attached to a specific +skb. + +The issue is the uncloned dst+metadata is initialized with a refcount of +1, which is increased to 2 before attaching it to the skb. When +tun_dst_unclone returns, the dst+metadata is only referenced from a +single place (the skb) while its refcount is 2. Its refcount will never +drop to 0 (when the skb is consumed), leading to a memory leak. + +Fix this by removing the call to dst_hold in tun_dst_unclone, as the +dst+metadata refcount is already 1. + +Fixes: fc4099f17240 ("openvswitch: Fix egress tunnel info.") +Cc: Pravin B Shelar +Reported-by: Vlad Buslov +Tested-by: Vlad Buslov +Signed-off-by: Antoine Tenart +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/dst_metadata.h | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/include/net/dst_metadata.h b/include/net/dst_metadata.h +index b997e0c1e3627..adab27ba1ecbf 100644 +--- a/include/net/dst_metadata.h ++++ b/include/net/dst_metadata.h +@@ -137,7 +137,6 @@ static inline struct metadata_dst *tun_dst_unclone(struct sk_buff *skb) + #endif + + skb_dst_drop(skb); +- dst_hold(&new_md->dst); + skb_dst_set(skb, &new_md->dst); + return new_md; + } +-- +2.34.1 + diff --git a/queue-5.16/net-mdio-aspeed-add-missing-module_device_table.patch b/queue-5.16/net-mdio-aspeed-add-missing-module_device_table.patch new file mode 100644 index 00000000000..5d4a3d74516 --- /dev/null +++ b/queue-5.16/net-mdio-aspeed-add-missing-module_device_table.patch @@ -0,0 +1,36 @@ +From fd961fad56bd11c1712e71154021e3074df251cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Feb 2022 10:33:59 +1030 +Subject: net: mdio: aspeed: Add missing MODULE_DEVICE_TABLE + +From: Joel Stanley + +[ Upstream commit bc1c3c3b10db4f37c41e6107751a8d450d9c431c ] + +Fix loading of the driver when built as a module. + +Fixes: f160e99462c6 ("net: phy: Add mdio-aspeed") +Signed-off-by: Joel Stanley +Reviewed-by: Andrew Lunn +Acked-by: Andrew Jeffery +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/mdio/mdio-aspeed.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/mdio/mdio-aspeed.c b/drivers/net/mdio/mdio-aspeed.c +index 966c3b4ad59d1..e2273588c75b6 100644 +--- a/drivers/net/mdio/mdio-aspeed.c ++++ b/drivers/net/mdio/mdio-aspeed.c +@@ -148,6 +148,7 @@ static const struct of_device_id aspeed_mdio_of_match[] = { + { .compatible = "aspeed,ast2600-mdio", }, + { }, + }; ++MODULE_DEVICE_TABLE(of, aspeed_mdio_of_match); + + static struct platform_driver aspeed_mdio_driver = { + .driver = { +-- +2.34.1 + diff --git a/queue-5.16/net-mscc-ocelot-fix-all-ip-traffic-getting-trapped-t.patch b/queue-5.16/net-mscc-ocelot-fix-all-ip-traffic-getting-trapped-t.patch new file mode 100644 index 00000000000..24665e714cc --- /dev/null +++ b/queue-5.16/net-mscc-ocelot-fix-all-ip-traffic-getting-trapped-t.patch @@ -0,0 +1,76 @@ +From faccb3ca582650532914e0e9366acccdc76886f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Feb 2022 01:03:21 +0200 +Subject: net: mscc: ocelot: fix all IP traffic getting trapped to CPU with PTP + over IP + +From: Vladimir Oltean + +[ Upstream commit 59085208e4a2183998964844f8684fea0378128d ] + +The filters for the PTP trap keys are incorrectly configured, in the +sense that is2_entry_set() only looks at trap->key.ipv4.dport or +trap->key.ipv6.dport if trap->key.ipv4.proto or trap->key.ipv6.proto is +set to IPPROTO_TCP or IPPROTO_UDP. + +But we don't do that, so is2_entry_set() goes through the "else" branch +of the IP protocol check, and ends up installing a rule for "Any IP +protocol match" (because msk is also 0). The UDP port is ignored. + +This means that when we run "ptp4l -i swp0 -4", all IP traffic is +trapped to the CPU, which hinders bridging. + +Fix this by specifying the IP protocol in the VCAP IS2 filters for PTP +over UDP. + +Fixes: 96ca08c05838 ("net: mscc: ocelot: set up traps for PTP packets") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mscc/ocelot.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c +index 294bb4eb3833f..ac5849436d021 100644 +--- a/drivers/net/ethernet/mscc/ocelot.c ++++ b/drivers/net/ethernet/mscc/ocelot.c +@@ -1292,6 +1292,8 @@ static void + ocelot_populate_ipv4_ptp_event_trap_key(struct ocelot_vcap_filter *trap) + { + trap->key_type = OCELOT_VCAP_KEY_IPV4; ++ trap->key.ipv4.proto.value[0] = IPPROTO_UDP; ++ trap->key.ipv4.proto.mask[0] = 0xff; + trap->key.ipv4.dport.value = PTP_EV_PORT; + trap->key.ipv4.dport.mask = 0xffff; + } +@@ -1300,6 +1302,8 @@ static void + ocelot_populate_ipv6_ptp_event_trap_key(struct ocelot_vcap_filter *trap) + { + trap->key_type = OCELOT_VCAP_KEY_IPV6; ++ trap->key.ipv4.proto.value[0] = IPPROTO_UDP; ++ trap->key.ipv4.proto.mask[0] = 0xff; + trap->key.ipv6.dport.value = PTP_EV_PORT; + trap->key.ipv6.dport.mask = 0xffff; + } +@@ -1308,6 +1312,8 @@ static void + ocelot_populate_ipv4_ptp_general_trap_key(struct ocelot_vcap_filter *trap) + { + trap->key_type = OCELOT_VCAP_KEY_IPV4; ++ trap->key.ipv4.proto.value[0] = IPPROTO_UDP; ++ trap->key.ipv4.proto.mask[0] = 0xff; + trap->key.ipv4.dport.value = PTP_GEN_PORT; + trap->key.ipv4.dport.mask = 0xffff; + } +@@ -1316,6 +1322,8 @@ static void + ocelot_populate_ipv6_ptp_general_trap_key(struct ocelot_vcap_filter *trap) + { + trap->key_type = OCELOT_VCAP_KEY_IPV6; ++ trap->key.ipv4.proto.value[0] = IPPROTO_UDP; ++ trap->key.ipv4.proto.mask[0] = 0xff; + trap->key.ipv6.dport.value = PTP_GEN_PORT; + trap->key.ipv6.dport.mask = 0xffff; + } +-- +2.34.1 + diff --git a/queue-5.16/net-mscc-ocelot-fix-mutex-lock-error-during-ethtool-.patch b/queue-5.16/net-mscc-ocelot-fix-mutex-lock-error-during-ethtool-.patch new file mode 100644 index 00000000000..c2a6359dfe1 --- /dev/null +++ b/queue-5.16/net-mscc-ocelot-fix-mutex-lock-error-during-ethtool-.patch @@ -0,0 +1,85 @@ +From 2a0bd3387e9da985f3d067bc59d76b15d0ce23b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Feb 2022 07:04:51 -0800 +Subject: net: mscc: ocelot: fix mutex lock error during ethtool stats read + +From: Colin Foster + +[ Upstream commit 7fbf6795d127a3b1bb39b0e42579904cf6db1624 ] + +An ongoing workqueue populates the stats buffer. At the same time, a user +might query the statistics. While writing to the buffer is mutex-locked, +reading from the buffer wasn't. This could lead to buggy reads by ethtool. + +This patch fixes the former blamed commit, but the bug was introduced in +the latter. + +Signed-off-by: Colin Foster +Fixes: 1e1caa9735f90 ("ocelot: Clean up stats update deferred work") +Fixes: a556c76adc052 ("net: mscc: Add initial Ocelot switch support") +Reported-by: Vladimir Oltean +Reviewed-by: Vladimir Oltean +Link: https://lore.kernel.org/all/20220210150451.416845-2-colin.foster@in-advantage.com/ +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mscc/ocelot.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c +index ac5849436d021..02edd383dea22 100644 +--- a/drivers/net/ethernet/mscc/ocelot.c ++++ b/drivers/net/ethernet/mscc/ocelot.c +@@ -1609,12 +1609,11 @@ void ocelot_get_strings(struct ocelot *ocelot, int port, u32 sset, u8 *data) + } + EXPORT_SYMBOL(ocelot_get_strings); + ++/* Caller must hold &ocelot->stats_lock */ + static void ocelot_update_stats(struct ocelot *ocelot) + { + int i, j; + +- mutex_lock(&ocelot->stats_lock); +- + for (i = 0; i < ocelot->num_phys_ports; i++) { + /* Configure the port to read the stats from */ + ocelot_write(ocelot, SYS_STAT_CFG_STAT_VIEW(i), SYS_STAT_CFG); +@@ -1633,8 +1632,6 @@ static void ocelot_update_stats(struct ocelot *ocelot) + ~(u64)U32_MAX) + val; + } + } +- +- mutex_unlock(&ocelot->stats_lock); + } + + static void ocelot_check_stats_work(struct work_struct *work) +@@ -1643,7 +1640,9 @@ static void ocelot_check_stats_work(struct work_struct *work) + struct ocelot *ocelot = container_of(del_work, struct ocelot, + stats_work); + ++ mutex_lock(&ocelot->stats_lock); + ocelot_update_stats(ocelot); ++ mutex_unlock(&ocelot->stats_lock); + + queue_delayed_work(ocelot->stats_queue, &ocelot->stats_work, + OCELOT_STATS_CHECK_DELAY); +@@ -1653,12 +1652,16 @@ void ocelot_get_ethtool_stats(struct ocelot *ocelot, int port, u64 *data) + { + int i; + ++ mutex_lock(&ocelot->stats_lock); ++ + /* check and update now */ + ocelot_update_stats(ocelot); + + /* Copy all counters */ + for (i = 0; i < ocelot->num_stats; i++) + *data++ = ocelot->stats[port * ocelot->num_stats + i]; ++ ++ mutex_unlock(&ocelot->stats_lock); + } + EXPORT_SYMBOL(ocelot_get_ethtool_stats); + +-- +2.34.1 + diff --git a/queue-5.16/net-sparx5-fix-get_stat64-crash-in-tcpdump.patch b/queue-5.16/net-sparx5-fix-get_stat64-crash-in-tcpdump.patch new file mode 100644 index 00000000000..232b3cf9a25 --- /dev/null +++ b/queue-5.16/net-sparx5-fix-get_stat64-crash-in-tcpdump.patch @@ -0,0 +1,40 @@ +From 7d8a5208e83e44370ccceceec204288b45fdae8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Feb 2022 11:29:00 +0100 +Subject: net: sparx5: Fix get_stat64 crash in tcpdump + +From: Steen Hegelund + +[ Upstream commit ed14fc7a79ab43e9f2cb1fa9c1733fdc133bba30 ] + +This problem was found with Sparx5 when the tcpdump tool requests the +do_get_stats64 (sparx5_get_stats64) statistic. + +The portstats pointer was incorrectly incremented when fetching priority +based statistics. + +Fixes: af4b11022e2d (net: sparx5: add ethtool configuration and statistics support) +Signed-off-by: Steen Hegelund +Link: https://lore.kernel.org/r/20220203102900.528987-1-steen.hegelund@microchip.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c b/drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c +index 59783fc46a7b9..10b866e9f7266 100644 +--- a/drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c ++++ b/drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c +@@ -1103,7 +1103,7 @@ void sparx5_get_stats64(struct net_device *ndev, + stats->tx_carrier_errors = portstats[spx5_stats_tx_csense_cnt]; + stats->tx_window_errors = portstats[spx5_stats_tx_late_coll_cnt]; + stats->rx_dropped = portstats[spx5_stats_ana_ac_port_stat_lsb_cnt]; +- for (idx = 0; idx < 2 * SPX5_PRIOS; ++idx, ++stats) ++ for (idx = 0; idx < 2 * SPX5_PRIOS; ++idx) + stats->rx_dropped += portstats[spx5_stats_green_p0_rx_port_drop + + idx]; + stats->tx_dropped = portstats[spx5_stats_tx_local_drop]; +-- +2.34.1 + diff --git a/queue-5.16/netfilter-ctnetlink-disable-helper-autoassign.patch b/queue-5.16/netfilter-ctnetlink-disable-helper-autoassign.patch new file mode 100644 index 00000000000..d8cfe5527e6 --- /dev/null +++ b/queue-5.16/netfilter-ctnetlink-disable-helper-autoassign.patch @@ -0,0 +1,72 @@ +From a3276fa2d34ddedf73718f23eacb1c7a755c865b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Feb 2022 12:00:56 +0100 +Subject: netfilter: ctnetlink: disable helper autoassign + +From: Florian Westphal + +[ Upstream commit d1ca60efc53d665cf89ed847a14a510a81770b81 ] + +When userspace, e.g. conntrackd, inserts an entry with a specified helper, +its possible that the helper is lost immediately after its added: + +ctnetlink_create_conntrack + -> nf_ct_helper_ext_add + assign helper + -> ctnetlink_setup_nat + -> ctnetlink_parse_nat_setup + -> parse_nat_setup -> nfnetlink_parse_nat_setup + -> nf_nat_setup_info + -> nf_conntrack_alter_reply + -> __nf_ct_try_assign_helper + +... and __nf_ct_try_assign_helper will zero the helper again. + +Set IPS_HELPER bit to bypass auto-assign logic, its unwanted, just like +when helper is assigned via ruleset. + +Dropped old 'not strictly necessary' comment, it referred to use of +rcu_assign_pointer() before it got replaced by RCU_INIT_POINTER(). + +NB: Fixes tag intentionally incorrect, this extends the referenced commit, +but this change won't build without IPS_HELPER introduced there. + +Fixes: 6714cf5465d280 ("netfilter: nf_conntrack: fix explicit helper attachment and NAT") +Reported-by: Pham Thanh Tuyen +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/uapi/linux/netfilter/nf_conntrack_common.h | 2 +- + net/netfilter/nf_conntrack_netlink.c | 3 ++- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/include/uapi/linux/netfilter/nf_conntrack_common.h b/include/uapi/linux/netfilter/nf_conntrack_common.h +index 4b3395082d15c..26071021e986f 100644 +--- a/include/uapi/linux/netfilter/nf_conntrack_common.h ++++ b/include/uapi/linux/netfilter/nf_conntrack_common.h +@@ -106,7 +106,7 @@ enum ip_conntrack_status { + IPS_NAT_CLASH = IPS_UNTRACKED, + #endif + +- /* Conntrack got a helper explicitly attached via CT target. */ ++ /* Conntrack got a helper explicitly attached (ruleset, ctnetlink). */ + IPS_HELPER_BIT = 13, + IPS_HELPER = (1 << IPS_HELPER_BIT), + +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index ec4164c32d270..2d7f63ad33604 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -2311,7 +2311,8 @@ ctnetlink_create_conntrack(struct net *net, + if (helper->from_nlattr) + helper->from_nlattr(helpinfo, ct); + +- /* not in hash table yet so not strictly necessary */ ++ /* disable helper auto-assignment for this entry */ ++ ct->status |= IPS_HELPER; + RCU_INIT_POINTER(help->helper, helper); + } + } else { +-- +2.34.1 + diff --git a/queue-5.16/netfilter-nft_payload-don-t-allow-th-access-for-frag.patch b/queue-5.16/netfilter-nft_payload-don-t-allow-th-access-for-frag.patch new file mode 100644 index 00000000000..d37d36d67db --- /dev/null +++ b/queue-5.16/netfilter-nft_payload-don-t-allow-th-access-for-frag.patch @@ -0,0 +1,81 @@ +From 927cb45efe67a48941d4daa3ac84401360e19a71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Jan 2022 17:13:23 +0100 +Subject: netfilter: nft_payload: don't allow th access for fragments + +From: Florian Westphal + +[ Upstream commit a9e8503def0fd4ed89ade1f61c315f904581d439 ] + +Loads relative to ->thoff naturally expect that this points to the +transport header, but this is only true if pkt->fragoff == 0. + +This has little effect for rulesets with connection tracking/nat because +these enable ip defra. For other rulesets this prevents false matches. + +Fixes: 96518518cc41 ("netfilter: add nftables") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_exthdr.c | 2 +- + net/netfilter/nft_payload.c | 9 +++++---- + 2 files changed, 6 insertions(+), 5 deletions(-) + +diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c +index dbe1f2e7dd9ed..9e927ab4df151 100644 +--- a/net/netfilter/nft_exthdr.c ++++ b/net/netfilter/nft_exthdr.c +@@ -167,7 +167,7 @@ nft_tcp_header_pointer(const struct nft_pktinfo *pkt, + { + struct tcphdr *tcph; + +- if (pkt->tprot != IPPROTO_TCP) ++ if (pkt->tprot != IPPROTO_TCP || pkt->fragoff) + return NULL; + + tcph = skb_header_pointer(pkt->skb, nft_thoff(pkt), sizeof(*tcph), buffer); +diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c +index 58e96a0fe0b4c..a4fbce560bddb 100644 +--- a/net/netfilter/nft_payload.c ++++ b/net/netfilter/nft_payload.c +@@ -83,7 +83,7 @@ static int __nft_payload_inner_offset(struct nft_pktinfo *pkt) + { + unsigned int thoff = nft_thoff(pkt); + +- if (!(pkt->flags & NFT_PKTINFO_L4PROTO)) ++ if (!(pkt->flags & NFT_PKTINFO_L4PROTO) || pkt->fragoff) + return -1; + + switch (pkt->tprot) { +@@ -147,7 +147,7 @@ void nft_payload_eval(const struct nft_expr *expr, + offset = skb_network_offset(skb); + break; + case NFT_PAYLOAD_TRANSPORT_HEADER: +- if (!(pkt->flags & NFT_PKTINFO_L4PROTO)) ++ if (!(pkt->flags & NFT_PKTINFO_L4PROTO) || pkt->fragoff) + goto err; + offset = nft_thoff(pkt); + break; +@@ -657,7 +657,7 @@ static void nft_payload_set_eval(const struct nft_expr *expr, + offset = skb_network_offset(skb); + break; + case NFT_PAYLOAD_TRANSPORT_HEADER: +- if (!(pkt->flags & NFT_PKTINFO_L4PROTO)) ++ if (!(pkt->flags & NFT_PKTINFO_L4PROTO) || pkt->fragoff) + goto err; + offset = nft_thoff(pkt); + break; +@@ -696,7 +696,8 @@ static void nft_payload_set_eval(const struct nft_expr *expr, + if (priv->csum_type == NFT_PAYLOAD_CSUM_SCTP && + pkt->tprot == IPPROTO_SCTP && + skb->ip_summed != CHECKSUM_PARTIAL) { +- if (nft_payload_csum_sctp(skb, nft_thoff(pkt))) ++ if (pkt->fragoff == 0 && ++ nft_payload_csum_sctp(skb, nft_thoff(pkt))) + goto err; + } + +-- +2.34.1 + diff --git a/queue-5.16/nfp-flower-fix-ida_idx-not-being-released.patch b/queue-5.16/nfp-flower-fix-ida_idx-not-being-released.patch new file mode 100644 index 00000000000..6acf6184026 --- /dev/null +++ b/queue-5.16/nfp-flower-fix-ida_idx-not-being-released.patch @@ -0,0 +1,82 @@ +From 0f7e903c1b397f0870d7c9612e64b557467d59c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Feb 2022 11:14:53 +0100 +Subject: nfp: flower: fix ida_idx not being released + +From: Louis Peens + +[ Upstream commit 7db788ad627aabff2b74d4f1a3b68516d0fee0d7 ] + +When looking for a global mac index the extra NFP_TUN_PRE_TUN_IDX_BIT +that gets set if nfp_flower_is_supported_bridge is true is not taken +into account. Consequently the path that should release the ida_index +in cleanup is never triggered, causing messages like: + + nfp 0000:02:00.0: nfp: Failed to offload MAC on br-ex. + nfp 0000:02:00.0: nfp: Failed to offload MAC on br-ex. + nfp 0000:02:00.0: nfp: Failed to offload MAC on br-ex. + +after NFP_MAX_MAC_INDEX number of reconfigs. Ultimately this lead to +new tunnel flows not being offloaded. + +Fix this by unsetting the NFP_TUN_PRE_TUN_IDX_BIT before checking if +the port is of type OTHER. + +Fixes: 2e0bc7f3cb55 ("nfp: flower: encode mac indexes with pre-tunnel rule check") +Signed-off-by: Louis Peens +Signed-off-by: Simon Horman +Link: https://lore.kernel.org/r/20220208101453.321949-1-simon.horman@corigine.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/netronome/nfp/flower/tunnel_conf.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c +index dfb4468fe287a..0a326e04e6923 100644 +--- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c ++++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c +@@ -1011,6 +1011,7 @@ nfp_tunnel_del_shared_mac(struct nfp_app *app, struct net_device *netdev, + struct nfp_flower_repr_priv *repr_priv; + struct nfp_tun_offloaded_mac *entry; + struct nfp_repr *repr; ++ u16 nfp_mac_idx; + int ida_idx; + + entry = nfp_tunnel_lookup_offloaded_macs(app, mac); +@@ -1029,8 +1030,6 @@ nfp_tunnel_del_shared_mac(struct nfp_app *app, struct net_device *netdev, + entry->bridge_count--; + + if (!entry->bridge_count && entry->ref_count) { +- u16 nfp_mac_idx; +- + nfp_mac_idx = entry->index & ~NFP_TUN_PRE_TUN_IDX_BIT; + if (__nfp_tunnel_offload_mac(app, mac, nfp_mac_idx, + false)) { +@@ -1046,7 +1045,6 @@ nfp_tunnel_del_shared_mac(struct nfp_app *app, struct net_device *netdev, + + /* If MAC is now used by 1 repr set the offloaded MAC index to port. */ + if (entry->ref_count == 1 && list_is_singular(&entry->repr_list)) { +- u16 nfp_mac_idx; + int port, err; + + repr_priv = list_first_entry(&entry->repr_list, +@@ -1074,8 +1072,14 @@ nfp_tunnel_del_shared_mac(struct nfp_app *app, struct net_device *netdev, + WARN_ON_ONCE(rhashtable_remove_fast(&priv->tun.offloaded_macs, + &entry->ht_node, + offloaded_macs_params)); ++ ++ if (nfp_flower_is_supported_bridge(netdev)) ++ nfp_mac_idx = entry->index & ~NFP_TUN_PRE_TUN_IDX_BIT; ++ else ++ nfp_mac_idx = entry->index; ++ + /* If MAC has global ID then extract and free the ida entry. */ +- if (nfp_tunnel_is_mac_idx_global(entry->index)) { ++ if (nfp_tunnel_is_mac_idx_global(nfp_mac_idx)) { + ida_idx = nfp_tunnel_get_ida_from_global_mac_idx(entry->index); + ida_simple_remove(&priv->tun.mac_off_ids, ida_idx); + } +-- +2.34.1 + diff --git a/queue-5.16/nfs-avoid-duplicate-uncached-readdir-calls-on-eof.patch b/queue-5.16/nfs-avoid-duplicate-uncached-readdir-calls-on-eof.patch new file mode 100644 index 00000000000..902fcb6a27e --- /dev/null +++ b/queue-5.16/nfs-avoid-duplicate-uncached-readdir-calls-on-eof.patch @@ -0,0 +1,129 @@ +From 33163d349d623a4e07881f6d8d6c9ee8750b6797 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jan 2022 22:10:52 -0500 +Subject: NFS: Avoid duplicate uncached readdir calls on eof + +From: Trond Myklebust + +[ Upstream commit e1d2699b96793d19388e302fa095e0da2c145701 ] + +If we've reached the end of the directory, then cache that information +in the context so that we don't need to do an uncached readdir in order +to rediscover that fact. + +Fixes: 794092c57f89 ("NFS: Do uncached readdir when we're seeking a cookie in an empty page cache") +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/dir.c | 20 +++++++++++++++----- + include/linux/nfs_fs.h | 1 + + 2 files changed, 16 insertions(+), 5 deletions(-) + +diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c +index 63d7da0b7e32c..b2460a0504411 100644 +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -79,6 +79,7 @@ static struct nfs_open_dir_context *alloc_nfs_open_dir_context(struct inode *dir + ctx->dir_cookie = 0; + ctx->dup_cookie = 0; + ctx->page_index = 0; ++ ctx->eof = false; + spin_lock(&dir->i_lock); + if (list_empty(&nfsi->open_files) && + (nfsi->cache_validity & NFS_INO_DATA_INVAL_DEFER)) +@@ -167,6 +168,7 @@ struct nfs_readdir_descriptor { + unsigned int cache_entry_index; + signed char duped; + bool plus; ++ bool eob; + bool eof; + }; + +@@ -988,7 +990,7 @@ static void nfs_do_filldir(struct nfs_readdir_descriptor *desc, + ent = &array->array[i]; + if (!dir_emit(desc->ctx, ent->name, ent->name_len, + nfs_compat_user_ino64(ent->ino), ent->d_type)) { +- desc->eof = true; ++ desc->eob = true; + break; + } + memcpy(desc->verf, verf, sizeof(desc->verf)); +@@ -1004,7 +1006,7 @@ static void nfs_do_filldir(struct nfs_readdir_descriptor *desc, + desc->duped = 1; + } + if (array->page_is_eof) +- desc->eof = true; ++ desc->eof = !desc->eob; + + kunmap(desc->page); + dfprintk(DIRCACHE, "NFS: nfs_do_filldir() filling ended @ cookie %llu\n", +@@ -1047,7 +1049,7 @@ static int uncached_readdir(struct nfs_readdir_descriptor *desc) + + status = nfs_readdir_xdr_to_array(desc, desc->verf, verf, arrays, sz); + +- for (i = 0; !desc->eof && i < sz && arrays[i]; i++) { ++ for (i = 0; !desc->eob && i < sz && arrays[i]; i++) { + desc->page = arrays[i]; + nfs_do_filldir(desc, verf); + } +@@ -1106,9 +1108,15 @@ static int nfs_readdir(struct file *file, struct dir_context *ctx) + desc->duped = dir_ctx->duped; + page_index = dir_ctx->page_index; + desc->attr_gencount = dir_ctx->attr_gencount; ++ desc->eof = dir_ctx->eof; + memcpy(desc->verf, dir_ctx->verf, sizeof(desc->verf)); + spin_unlock(&file->f_lock); + ++ if (desc->eof) { ++ res = 0; ++ goto out_free; ++ } ++ + if (test_and_clear_bit(NFS_INO_FORCE_READDIR, &nfsi->flags) && + list_is_singular(&nfsi->open_files)) + invalidate_mapping_pages(inode->i_mapping, page_index + 1, -1); +@@ -1142,7 +1150,7 @@ static int nfs_readdir(struct file *file, struct dir_context *ctx) + + nfs_do_filldir(desc, nfsi->cookieverf); + nfs_readdir_page_unlock_and_put_cached(desc); +- } while (!desc->eof); ++ } while (!desc->eob && !desc->eof); + + spin_lock(&file->f_lock); + dir_ctx->dir_cookie = desc->dir_cookie; +@@ -1150,9 +1158,10 @@ static int nfs_readdir(struct file *file, struct dir_context *ctx) + dir_ctx->duped = desc->duped; + dir_ctx->attr_gencount = desc->attr_gencount; + dir_ctx->page_index = desc->page_index; ++ dir_ctx->eof = desc->eof; + memcpy(dir_ctx->verf, desc->verf, sizeof(dir_ctx->verf)); + spin_unlock(&file->f_lock); +- ++out_free: + kfree(desc); + + out: +@@ -1194,6 +1203,7 @@ static loff_t nfs_llseek_dir(struct file *filp, loff_t offset, int whence) + if (offset == 0) + memset(dir_ctx->verf, 0, sizeof(dir_ctx->verf)); + dir_ctx->duped = 0; ++ dir_ctx->eof = false; + } + spin_unlock(&filp->f_lock); + return offset; +diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h +index f33559acbcc28..29a2ab5de1daa 100644 +--- a/include/linux/nfs_fs.h ++++ b/include/linux/nfs_fs.h +@@ -105,6 +105,7 @@ struct nfs_open_dir_context { + __u64 dup_cookie; + pgoff_t page_index; + signed char duped; ++ bool eof; + }; + + /* +-- +2.34.1 + diff --git a/queue-5.16/nfs-don-t-overfill-uncached-readdir-pages.patch b/queue-5.16/nfs-don-t-overfill-uncached-readdir-pages.patch new file mode 100644 index 00000000000..714fee256ce --- /dev/null +++ b/queue-5.16/nfs-don-t-overfill-uncached-readdir-pages.patch @@ -0,0 +1,40 @@ +From 08fffdb3373c72d64ae7dcdcc0cb14d02843cfeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jan 2022 19:25:42 -0500 +Subject: NFS: Don't overfill uncached readdir pages + +From: trondmy@kernel.org + +[ Upstream commit d9c4e39c1f8f8a8ebaccf00b8f22c14364b2d27e ] + +If we're doing an uncached read of the directory, then we ideally want +to read only the exact set of entries that will fit in the buffer +supplied by the getdents() system call. So unlike the case where we're +reading into the page cache, let's send only one READDIR call, before +trying to fill up the buffer. + +Fixes: 35df59d3ef69 ("NFS: Reduce number of RPC calls when doing uncached readdir") +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/dir.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c +index faf5168880223..13740f1e3972e 100644 +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -866,7 +866,8 @@ static int nfs_readdir_xdr_to_array(struct nfs_readdir_descriptor *desc, + + status = nfs_readdir_page_filler(desc, entry, pages, pglen, + arrays, narrays); +- } while (!status && nfs_readdir_page_needs_filling(page)); ++ } while (!status && nfs_readdir_page_needs_filling(page) && ++ page_mapping(page)); + + nfs_readdir_free_pages(pages, array_size); + out: +-- +2.34.1 + diff --git a/queue-5.16/nfs-don-t-skip-directory-entries-when-doing-uncached.patch b/queue-5.16/nfs-don-t-skip-directory-entries-when-doing-uncached.patch new file mode 100644 index 00000000000..9f1a724276e --- /dev/null +++ b/queue-5.16/nfs-don-t-skip-directory-entries-when-doing-uncached.patch @@ -0,0 +1,35 @@ +From 3e80294bf2d9fd7b77ac0af6138311611a640061 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jan 2022 19:52:16 -0500 +Subject: NFS: Don't skip directory entries when doing uncached readdir + +From: trondmy@kernel.org + +[ Upstream commit ce292d8faf41f62e0fb0c78476c6fce5d629235a ] + +Ensure that we initialise desc->cache_entry_index correctly in +uncached_readdir(). + +Fixes: d1bacf9eb2fd ("NFS: add readdir cache array") +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/dir.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c +index 13740f1e3972e..63d7da0b7e32c 100644 +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -1041,6 +1041,7 @@ static int uncached_readdir(struct nfs_readdir_descriptor *desc) + goto out; + + desc->page_index = 0; ++ desc->cache_entry_index = 0; + desc->last_cookie = desc->dir_cookie; + desc->duped = 0; + +-- +2.34.1 + diff --git a/queue-5.16/optee-add-error-checks-in-optee_ffa_do_call_with_arg.patch b/queue-5.16/optee-add-error-checks-in-optee_ffa_do_call_with_arg.patch new file mode 100644 index 00000000000..c3dc3785768 --- /dev/null +++ b/queue-5.16/optee-add-error-checks-in-optee_ffa_do_call_with_arg.patch @@ -0,0 +1,48 @@ +From 6488b2235e485f8ae7f8feb1c9bcae8193f9dbe1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Dec 2021 21:25:57 +0100 +Subject: optee: add error checks in optee_ffa_do_call_with_arg() + +From: Jens Wiklander + +[ Upstream commit 4064c461148ab129dfe5eaeea129b4af6cf4b9b7 ] + +Adds error checking in optee_ffa_do_call_with_arg() for correctness. + +Fixes: 4615e5a34b95 ("optee: add FF-A support") +Reviewed-by: Sumit Garg +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/optee/ffa_abi.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/drivers/tee/optee/ffa_abi.c b/drivers/tee/optee/ffa_abi.c +index d8c8683863aa0..28d7c0eafc025 100644 +--- a/drivers/tee/optee/ffa_abi.c ++++ b/drivers/tee/optee/ffa_abi.c +@@ -619,9 +619,18 @@ static int optee_ffa_do_call_with_arg(struct tee_context *ctx, + .data2 = (u32)(shm->sec_world_id >> 32), + .data3 = shm->offset, + }; +- struct optee_msg_arg *arg = tee_shm_get_va(shm, 0); +- unsigned int rpc_arg_offs = OPTEE_MSG_GET_ARG_SIZE(arg->num_params); +- struct optee_msg_arg *rpc_arg = tee_shm_get_va(shm, rpc_arg_offs); ++ struct optee_msg_arg *arg; ++ unsigned int rpc_arg_offs; ++ struct optee_msg_arg *rpc_arg; ++ ++ arg = tee_shm_get_va(shm, 0); ++ if (IS_ERR(arg)) ++ return PTR_ERR(arg); ++ ++ rpc_arg_offs = OPTEE_MSG_GET_ARG_SIZE(arg->num_params); ++ rpc_arg = tee_shm_get_va(shm, rpc_arg_offs); ++ if (IS_ERR(rpc_arg)) ++ return PTR_ERR(rpc_arg); + + return optee_ffa_yielding_call(ctx, &data, rpc_arg); + } +-- +2.34.1 + diff --git a/queue-5.16/phy-broadcom-kconfig-fix-phy_brcm_usb-config-option.patch b/queue-5.16/phy-broadcom-kconfig-fix-phy_brcm_usb-config-option.patch new file mode 100644 index 00000000000..4f93bab1ede --- /dev/null +++ b/queue-5.16/phy-broadcom-kconfig-fix-phy_brcm_usb-config-option.patch @@ -0,0 +1,47 @@ +From 10ad2747546e989e238f7dc6e8400239c16d0707 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Dec 2021 13:06:53 -0500 +Subject: phy: broadcom: Kconfig: Fix PHY_BRCM_USB config option +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Al Cooper + +[ Upstream commit 5070ce86246a8a4ebacd0c15b121e6b6325bc167 ] + +The previous commit 4b402fa8e0b7 ("phy: phy-brcm-usb: support PHY on +the BCM4908") added a second "default" line for ARCH_BCM_4908 above +the original "default" line for ARCH_BRCMSTB. When two "default" +lines are used, only the first is used and this change stopped +the PHY_BRCM_USB option for being enabled for ARCH_BRCMSTB. +The fix is to use one "default line with "||". + +Fixes: 4b402fa8e0b7 ("phy: phy-brcm-usb: support PHY on the BCM4908") +Signed-off-by: Al Cooper +Acked-by: Rafał Miłecki +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20211201180653.35097-4-alcooperx@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/broadcom/Kconfig | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/phy/broadcom/Kconfig b/drivers/phy/broadcom/Kconfig +index f81e237420799..849c4204f5506 100644 +--- a/drivers/phy/broadcom/Kconfig ++++ b/drivers/phy/broadcom/Kconfig +@@ -97,8 +97,7 @@ config PHY_BRCM_USB + depends on OF + select GENERIC_PHY + select SOC_BRCMSTB if ARCH_BRCMSTB +- default ARCH_BCM4908 +- default ARCH_BRCMSTB ++ default ARCH_BCM4908 || ARCH_BRCMSTB + help + Enable this to support the Broadcom STB USB PHY. + This driver is required by the USB XHCI, EHCI and OHCI +-- +2.34.1 + diff --git a/queue-5.16/phy-dphy-correct-clk_pre-parameter.patch b/queue-5.16/phy-dphy-correct-clk_pre-parameter.patch new file mode 100644 index 00000000000..ee59cc2686a --- /dev/null +++ b/queue-5.16/phy-dphy-correct-clk_pre-parameter.patch @@ -0,0 +1,159 @@ +From d1269127178e64015b6138143aa43e6c4b5deeee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jan 2022 10:40:07 +0800 +Subject: phy: dphy: Correct clk_pre parameter +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Liu Ying + +[ Upstream commit 9a8406ba1a9a2965c27e0db1d7753471d12ee9ff ] + +The D-PHY specification (v1.2) explicitly mentions that the T-CLK-PRE +parameter's unit is Unit Interval(UI) and the minimum value is 8. Also, +kernel doc of the 'clk_pre' member of struct phy_configure_opts_mipi_dphy +mentions that it should be in UI. However, the dphy core driver wrongly +sets 'clk_pre' to 8000, which seems to hint that it's in picoseconds. + +So, let's fix the dphy core driver to correctly reflect the T-CLK-PRE +parameter's minimum value according to the D-PHY specification. + +I'm assuming that all impacted custom drivers shall program values in +TxByteClkHS cycles into hardware for the T-CLK-PRE parameter. The D-PHY +specification mentions that the frequency of TxByteClkHS is exactly 1/8 +the High-Speed(HS) bit rate(each HS bit consumes one UI). So, relevant +custom driver code is changed to program those values as +DIV_ROUND_UP(cfg->clk_pre, BITS_PER_BYTE), then. + +Note that I've only tested the patch with RM67191 DSI panel on i.MX8mq EVK. +Help is needed to test with other i.MX8mq, Meson and Rockchip platforms, +as I don't have the hardwares. + +Fixes: 2ed869990e14 ("phy: Add MIPI D-PHY configuration options") +Tested-by: Liu Ying # RM67191 DSI panel on i.MX8mq EVK +Reviewed-by: Andrzej Hajda +Reviewed-by: Neil Armstrong # for phy-meson-axg-mipi-dphy.c +Tested-by: Neil Armstrong # for phy-meson-axg-mipi-dphy.c +Tested-by: Guido Günther # Librem 5 (imx8mq) with it's rather picky panel +Reviewed-by: Laurent Pinchart +Signed-off-by: Liu Ying +Link: https://lore.kernel.org/r/20220124024007.1465018-1-victor.liu@nxp.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/nwl-dsi.c | 12 +++++------- + drivers/phy/amlogic/phy-meson-axg-mipi-dphy.c | 3 ++- + drivers/phy/phy-core-mipi-dphy.c | 4 ++-- + drivers/phy/rockchip/phy-rockchip-inno-dsidphy.c | 3 ++- + 4 files changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/nwl-dsi.c b/drivers/gpu/drm/bridge/nwl-dsi.c +index a7389a0facfb4..af07eeb47ca02 100644 +--- a/drivers/gpu/drm/bridge/nwl-dsi.c ++++ b/drivers/gpu/drm/bridge/nwl-dsi.c +@@ -7,6 +7,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -196,12 +197,9 @@ static u32 ps2bc(struct nwl_dsi *dsi, unsigned long long ps) + /* + * ui2bc - UI time periods to byte clock cycles + */ +-static u32 ui2bc(struct nwl_dsi *dsi, unsigned long long ui) ++static u32 ui2bc(unsigned int ui) + { +- u32 bpp = mipi_dsi_pixel_format_to_bpp(dsi->format); +- +- return DIV64_U64_ROUND_UP(ui * dsi->lanes, +- dsi->mode.clock * 1000 * bpp); ++ return DIV_ROUND_UP(ui, BITS_PER_BYTE); + } + + /* +@@ -232,12 +230,12 @@ static int nwl_dsi_config_host(struct nwl_dsi *dsi) + } + + /* values in byte clock cycles */ +- cycles = ui2bc(dsi, cfg->clk_pre); ++ cycles = ui2bc(cfg->clk_pre); + DRM_DEV_DEBUG_DRIVER(dsi->dev, "cfg_t_pre: 0x%x\n", cycles); + nwl_dsi_write(dsi, NWL_DSI_CFG_T_PRE, cycles); + cycles = ps2bc(dsi, cfg->lpx + cfg->clk_prepare + cfg->clk_zero); + DRM_DEV_DEBUG_DRIVER(dsi->dev, "cfg_tx_gap (pre): 0x%x\n", cycles); +- cycles += ui2bc(dsi, cfg->clk_pre); ++ cycles += ui2bc(cfg->clk_pre); + DRM_DEV_DEBUG_DRIVER(dsi->dev, "cfg_t_post: 0x%x\n", cycles); + nwl_dsi_write(dsi, NWL_DSI_CFG_T_POST, cycles); + cycles = ps2bc(dsi, cfg->hs_exit); +diff --git a/drivers/phy/amlogic/phy-meson-axg-mipi-dphy.c b/drivers/phy/amlogic/phy-meson-axg-mipi-dphy.c +index cd2332bf0e31a..fdbd64c03e12b 100644 +--- a/drivers/phy/amlogic/phy-meson-axg-mipi-dphy.c ++++ b/drivers/phy/amlogic/phy-meson-axg-mipi-dphy.c +@@ -9,6 +9,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -250,7 +251,7 @@ static int phy_meson_axg_mipi_dphy_power_on(struct phy *phy) + (DIV_ROUND_UP(priv->config.clk_zero, temp) << 16) | + (DIV_ROUND_UP(priv->config.clk_prepare, temp) << 24)); + regmap_write(priv->regmap, MIPI_DSI_CLK_TIM1, +- DIV_ROUND_UP(priv->config.clk_pre, temp)); ++ DIV_ROUND_UP(priv->config.clk_pre, BITS_PER_BYTE)); + + regmap_write(priv->regmap, MIPI_DSI_HS_TIM, + DIV_ROUND_UP(priv->config.hs_exit, temp) | +diff --git a/drivers/phy/phy-core-mipi-dphy.c b/drivers/phy/phy-core-mipi-dphy.c +index 288c9c67aa748..ccb4045685cdd 100644 +--- a/drivers/phy/phy-core-mipi-dphy.c ++++ b/drivers/phy/phy-core-mipi-dphy.c +@@ -36,7 +36,7 @@ int phy_mipi_dphy_get_default_config(unsigned long pixel_clock, + + cfg->clk_miss = 0; + cfg->clk_post = 60000 + 52 * ui; +- cfg->clk_pre = 8000; ++ cfg->clk_pre = 8; + cfg->clk_prepare = 38000; + cfg->clk_settle = 95000; + cfg->clk_term_en = 0; +@@ -97,7 +97,7 @@ int phy_mipi_dphy_config_validate(struct phy_configure_opts_mipi_dphy *cfg) + if (cfg->clk_post < (60000 + 52 * ui)) + return -EINVAL; + +- if (cfg->clk_pre < 8000) ++ if (cfg->clk_pre < 8) + return -EINVAL; + + if (cfg->clk_prepare < 38000 || cfg->clk_prepare > 95000) +diff --git a/drivers/phy/rockchip/phy-rockchip-inno-dsidphy.c b/drivers/phy/rockchip/phy-rockchip-inno-dsidphy.c +index 347dc79a18c18..630e01b5c19b9 100644 +--- a/drivers/phy/rockchip/phy-rockchip-inno-dsidphy.c ++++ b/drivers/phy/rockchip/phy-rockchip-inno-dsidphy.c +@@ -5,6 +5,7 @@ + * Author: Wyon Bi + */ + ++#include + #include + #include + #include +@@ -364,7 +365,7 @@ static void inno_dsidphy_mipi_mode_enable(struct inno_dsidphy *inno) + * The value of counter for HS Tclk-pre + * Tclk-pre = Tpin_txbyteclkhs * value + */ +- clk_pre = DIV_ROUND_UP(cfg->clk_pre, t_txbyteclkhs); ++ clk_pre = DIV_ROUND_UP(cfg->clk_pre, BITS_PER_BYTE); + + /* + * The value of counter for HS Tlpx Time +-- +2.34.1 + diff --git a/queue-5.16/phy-stm32-fix-a-refcount-leak-in-stm32_usbphyc_pll_e.patch b/queue-5.16/phy-stm32-fix-a-refcount-leak-in-stm32_usbphyc_pll_e.patch new file mode 100644 index 00000000000..9d3d91b7e58 --- /dev/null +++ b/queue-5.16/phy-stm32-fix-a-refcount-leak-in-stm32_usbphyc_pll_e.patch @@ -0,0 +1,37 @@ +From 642a77a727f8b280e1c7c804a327a25f79dddd81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jan 2022 14:17:24 +0300 +Subject: phy: stm32: fix a refcount leak in stm32_usbphyc_pll_enable() + +From: Dan Carpenter + +[ Upstream commit cfc826c88a79e22ba5d8001556eb2c7efd8a01b6 ] + +This error path needs to decrement "usbphyc->n_pll_cons.counter" before +returning. + +Fixes: 5b1af71280ab ("phy: stm32: rework PLL Lock detection") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20220112111724.GB3019@kili +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/st/phy-stm32-usbphyc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/st/phy-stm32-usbphyc.c b/drivers/phy/st/phy-stm32-usbphyc.c +index e4f4a9be51320..1ecdc26689ce8 100644 +--- a/drivers/phy/st/phy-stm32-usbphyc.c ++++ b/drivers/phy/st/phy-stm32-usbphyc.c +@@ -304,7 +304,7 @@ static int stm32_usbphyc_pll_enable(struct stm32_usbphyc *usbphyc) + + ret = __stm32_usbphyc_pll_disable(usbphyc); + if (ret) +- return ret; ++ goto dec_n_pll_cons; + } + + ret = stm32_usbphyc_regulators_enable(usbphyc); +-- +2.34.1 + diff --git a/queue-5.16/phy-xilinx-zynqmp-fix-bus-width-setting-for-sgmii.patch b/queue-5.16/phy-xilinx-zynqmp-fix-bus-width-setting-for-sgmii.patch new file mode 100644 index 00000000000..d64f0d7920f --- /dev/null +++ b/queue-5.16/phy-xilinx-zynqmp-fix-bus-width-setting-for-sgmii.patch @@ -0,0 +1,62 @@ +From c0da7d0ebc5fa046d79e78f72fdd32f0d090e2bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jan 2022 18:16:00 -0600 +Subject: phy: xilinx: zynqmp: Fix bus width setting for SGMII + +From: Robert Hancock + +[ Upstream commit 37291f60d0822f191748c2a54ce63b0bc669020f ] + +TX_PROT_BUS_WIDTH and RX_PROT_BUS_WIDTH are single registers with +separate bit fields for each lane. The code in xpsgtr_phy_init_sgmii was +not preserving the existing register value for other lanes, so enabling +the PHY in SGMII mode on one lane zeroed out the settings for all other +lanes, causing other PS-GTR peripherals such as USB3 to malfunction. + +Use xpsgtr_clr_set to only manipulate the desired bits in the register. + +Fixes: 4a33bea00314 ("phy: zynqmp: Add PHY driver for the Xilinx ZynqMP Gigabit Transceiver") +Signed-off-by: Robert Hancock +Acked-by: Michal Simek +Reviewed-by: Laurent Pinchart +Link: https://lore.kernel.org/r/20220126001600.1592218-1-robert.hancock@calian.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/xilinx/phy-zynqmp.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/phy/xilinx/phy-zynqmp.c b/drivers/phy/xilinx/phy-zynqmp.c +index f478d8a17115b..9be9535ad7ab7 100644 +--- a/drivers/phy/xilinx/phy-zynqmp.c ++++ b/drivers/phy/xilinx/phy-zynqmp.c +@@ -134,7 +134,8 @@ + #define PROT_BUS_WIDTH_10 0x0 + #define PROT_BUS_WIDTH_20 0x1 + #define PROT_BUS_WIDTH_40 0x2 +-#define PROT_BUS_WIDTH_SHIFT 2 ++#define PROT_BUS_WIDTH_SHIFT(n) ((n) * 2) ++#define PROT_BUS_WIDTH_MASK(n) GENMASK((n) * 2 + 1, (n) * 2) + + /* Number of GT lanes */ + #define NUM_LANES 4 +@@ -445,12 +446,12 @@ static void xpsgtr_phy_init_sata(struct xpsgtr_phy *gtr_phy) + static void xpsgtr_phy_init_sgmii(struct xpsgtr_phy *gtr_phy) + { + struct xpsgtr_dev *gtr_dev = gtr_phy->dev; ++ u32 mask = PROT_BUS_WIDTH_MASK(gtr_phy->lane); ++ u32 val = PROT_BUS_WIDTH_10 << PROT_BUS_WIDTH_SHIFT(gtr_phy->lane); + + /* Set SGMII protocol TX and RX bus width to 10 bits. */ +- xpsgtr_write(gtr_dev, TX_PROT_BUS_WIDTH, +- PROT_BUS_WIDTH_10 << (gtr_phy->lane * PROT_BUS_WIDTH_SHIFT)); +- xpsgtr_write(gtr_dev, RX_PROT_BUS_WIDTH, +- PROT_BUS_WIDTH_10 << (gtr_phy->lane * PROT_BUS_WIDTH_SHIFT)); ++ xpsgtr_clr_set(gtr_dev, TX_PROT_BUS_WIDTH, mask, val); ++ xpsgtr_clr_set(gtr_dev, RX_PROT_BUS_WIDTH, mask, val); + + xpsgtr_bypass_scrambler_8b10b(gtr_phy); + } +-- +2.34.1 + diff --git a/queue-5.16/s390-module-fix-building-test_modules_helpers.o-with.patch b/queue-5.16/s390-module-fix-building-test_modules_helpers.o-with.patch new file mode 100644 index 00000000000..0859c91e354 --- /dev/null +++ b/queue-5.16/s390-module-fix-building-test_modules_helpers.o-with.patch @@ -0,0 +1,52 @@ +From 20f0a2189da82b2d388b289b470c473badfec9bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Jan 2022 14:17:11 +0100 +Subject: s390/module: fix building test_modules_helpers.o with clang + +From: Ilya Leoshkevich + +[ Upstream commit e286f231eab410793f3e91c924e6dbd23edee05a ] + +Move test_modules_return_* prototypes into a header file in order to +placate -Wmissing-prototypes. + +Fixes: 90c5318795ee ("s390/module: test loading modules with a lot of relocations") +Reported-by: kernel test robot +Reviewed-by: Heiko Carstens +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/lib/test_modules.c | 3 --- + arch/s390/lib/test_modules.h | 3 +++ + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/s390/lib/test_modules.c b/arch/s390/lib/test_modules.c +index d056baa8fbb0c..9894009fc1f25 100644 +--- a/arch/s390/lib/test_modules.c ++++ b/arch/s390/lib/test_modules.c +@@ -5,9 +5,6 @@ + + #include "test_modules.h" + +-#define DECLARE_RETURN(i) int test_modules_return_ ## i(void) +-REPEAT_10000(DECLARE_RETURN); +- + /* + * Test that modules with many relocations are loaded properly. + */ +diff --git a/arch/s390/lib/test_modules.h b/arch/s390/lib/test_modules.h +index 43b5e4b4af3e4..6371fcf176845 100644 +--- a/arch/s390/lib/test_modules.h ++++ b/arch/s390/lib/test_modules.h +@@ -47,4 +47,7 @@ + __REPEAT_10000_1(f, 8); \ + __REPEAT_10000_1(f, 9) + ++#define DECLARE_RETURN(i) int test_modules_return_ ## i(void) ++REPEAT_10000(DECLARE_RETURN); ++ + #endif +-- +2.34.1 + diff --git a/queue-5.16/series b/queue-5.16/series index 011ea7fc343..af689f33323 100644 --- a/queue-5.16/series +++ b/queue-5.16/series @@ -90,3 +90,72 @@ drm-i915-disable-drrs-on-ivb-hsw-port-a.patch drm-i915-allow-join_mbus-cases-for-adlp-dbuf-configuration.patch drm-i915-populate-pipe-dbuf-slices-more-accurately-during-readout.patch drm-i915-workaround-broken-bios-dbuf-configuration-on-tgl-rkl.patch +arm-dts-fix-timer-regression-for-beagleboard-revisio.patch +arm-dts-meson-fix-the-uart-compatible-strings.patch +arm-dts-meson8-fix-the-uart-device-tree-schema-valid.patch +arm-dts-meson8b-fix-the-uart-device-tree-schema-vali.patch +phy-broadcom-kconfig-fix-phy_brcm_usb-config-option.patch +tee-optee-do-not-check-memref-size-on-return-from-se.patch +optee-add-error-checks-in-optee_ffa_do_call_with_arg.patch +staging-fbtft-fix-error-path-in-fbtft_driver_module_.patch +arm-dts-imx6qdl-udoo-properly-describe-the-sd-card-d.patch +phy-xilinx-zynqmp-fix-bus-width-setting-for-sgmii.patch +phy-stm32-fix-a-refcount-leak-in-stm32_usbphyc_pll_e.patch +arm-dts-imx7ulp-fix-assigned-clocks-parents-typo.patch +arm64-dts-imx8mq-fix-mipi_csi-bidirectional-port-num.patch +usb-f_fs-fix-use-after-free-for-epfile.patch +arm64-enable-cortex-a510-erratum-2051678-by-default.patch +phy-dphy-correct-clk_pre-parameter.patch +gpio-aggregator-fix-calling-into-sleeping-gpio-contr.patch +nfs-don-t-overfill-uncached-readdir-pages.patch +nfs-don-t-skip-directory-entries-when-doing-uncached.patch +nfs-avoid-duplicate-uncached-readdir-calls-on-eof.patch +drm-vc4-hdmi-allow-dblclk-modes-even-if-horz-timing-.patch +misc-fastrpc-avoid-double-fput-on-failed-usercopy.patch +net-sparx5-fix-get_stat64-crash-in-tcpdump.patch +netfilter-nft_payload-don-t-allow-th-access-for-frag.patch +netfilter-ctnetlink-disable-helper-autoassign.patch +arm64-dts-meson-g12b-odroid-n2-fix-typo-dio2133.patch +arm64-dts-meson-sm1-odroid-use-correct-enable-gpio-p.patch +arm64-dts-meson-sm1-bananapi-m5-fix-wrong-gpio-domai.patch +arm64-dts-meson-sm1-odroid-fix-boot-loop-after-reboo.patch +ixgbevf-require-large-buffers-for-build_skb-on-82599.patch +tcp-take-care-of-mixed-splice-sendmsg-msg_zerocopy-c.patch +net-mscc-ocelot-fix-all-ip-traffic-getting-trapped-t.patch +drm-panel-simple-assign-data-from-panel_dpi_probe-co.patch +s390-module-fix-building-test_modules_helpers.o-with.patch +acpi-pm-s2idle-cancel-wakeup-before-dispatching-ec-g.patch +gpiolib-never-return-internal-error-codes-to-user-sp.patch +gpio-sifive-use-the-correct-register-to-read-output-.patch +fbcon-avoid-cap-set-but-not-used-warning.patch +sunrpc-lock-against-sock-changing-during-sysfs-read.patch +gve-recording-rx-queue-before-sending-to-napi.patch +bonding-pair-enable_port-with-slave_arr_updates.patch +net-dsa-mv88e6xxx-don-t-use-devres-for-mdiobus.patch +net-dsa-ar9331-register-the-mdiobus-under-devres.patch +net-dsa-bcm_sf2-don-t-use-devres-for-mdiobus.patch +net-dsa-felix-don-t-use-devres-for-mdiobus.patch +net-dsa-ocelot-seville-utilize-of_mdiobus_register.patch +net-dsa-seville-register-the-mdiobus-under-devres.patch +net-dsa-mt7530-fix-kernel-bug-in-mdiobus_free-when-u.patch +net-dsa-lantiq_gswip-don-t-use-devres-for-mdiobus.patch +ibmvnic-don-t-release-napi-in-__ibmvnic_open.patch +net-ethernet-litex-add-the-dependency-on-has_iomem.patch +ipmr-ip6mr-acquire-rtnl-before-calling-ip-6-mr_free_.patch +nfp-flower-fix-ida_idx-not-being-released.patch +net-do-not-keep-the-dst-cache-when-uncloning-an-skb-.patch +net-fix-a-memleak-when-uncloning-an-skb-dst-and-its-.patch +veth-fix-races-around-rq-rx_notify_masked.patch +net-mdio-aspeed-add-missing-module_device_table.patch +tipc-rate-limit-warning-for-received-illegal-binding.patch +net-amd-xgbe-disable-interrupts-during-pci-removal.patch +net-dsa-fix-panic-when-dsa-master-device-unbinds-on-.patch +drm-amd-pm-fix-hwmon-node-of-power1_label-create-iss.patch +mptcp-netlink-process-ipv6-addrs-in-creating-listeni.patch +dpaa2-eth-unregister-the-netdev-before-disconnecting.patch +ice-fix-an-error-code-in-ice_cfg_phy_fec.patch +ice-fix-ipip-and-sit-tso-offload.patch +ice-fix-kasan-error-in-lag-netdev_unregister-handler.patch +ice-avoid-rtnl-lock-when-re-creating-auxiliary-devic.patch +net-mscc-ocelot-fix-mutex-lock-error-during-ethtool-.patch +net-dsa-mv88e6xxx-fix-use-after-free-in-mv88e6xxx_md.patch diff --git a/queue-5.16/staging-fbtft-fix-error-path-in-fbtft_driver_module_.patch b/queue-5.16/staging-fbtft-fix-error-path-in-fbtft_driver_module_.patch new file mode 100644 index 00000000000..7ee190260db --- /dev/null +++ b/queue-5.16/staging-fbtft-fix-error-path-in-fbtft_driver_module_.patch @@ -0,0 +1,43 @@ +From 5ac659252125545b2cb27086e0f35505a9a1baa9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jan 2022 19:13:37 +0100 +Subject: staging: fbtft: Fix error path in fbtft_driver_module_init() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 426aca16e903b387a0b0001d62207a745c67cfd3 ] + +If registering the platform driver fails, the function must not return +without undoing the spi driver registration first. + +Fixes: c296d5f9957c ("staging: fbtft: core support") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20220118181338.207943-1-u.kleine-koenig@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/fbtft/fbtft.h | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/fbtft/fbtft.h b/drivers/staging/fbtft/fbtft.h +index 6869f3603b0e6..9a6c906820f22 100644 +--- a/drivers/staging/fbtft/fbtft.h ++++ b/drivers/staging/fbtft/fbtft.h +@@ -334,7 +334,10 @@ static int __init fbtft_driver_module_init(void) \ + ret = spi_register_driver(&fbtft_driver_spi_driver); \ + if (ret < 0) \ + return ret; \ +- return platform_driver_register(&fbtft_driver_platform_driver); \ ++ ret = platform_driver_register(&fbtft_driver_platform_driver); \ ++ if (ret < 0) \ ++ spi_unregister_driver(&fbtft_driver_spi_driver); \ ++ return ret; \ + } \ + \ + static void __exit fbtft_driver_module_exit(void) \ +-- +2.34.1 + diff --git a/queue-5.16/sunrpc-lock-against-sock-changing-during-sysfs-read.patch b/queue-5.16/sunrpc-lock-against-sock-changing-during-sysfs-read.patch new file mode 100644 index 00000000000..329df864372 --- /dev/null +++ b/queue-5.16/sunrpc-lock-against-sock-changing-during-sysfs-read.patch @@ -0,0 +1,67 @@ +From 1c50034b0715cf7e40a266fd29e2019cbf4269a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jan 2022 16:36:53 +1100 +Subject: SUNRPC: lock against ->sock changing during sysfs read + +From: NeilBrown + +[ Upstream commit b49ea673e119f59c71645e2f65b3ccad857c90ee ] + +->sock can be set to NULL asynchronously unless ->recv_mutex is held. +So it is important to hold that mutex. Otherwise a sysfs read can +trigger an oops. +Commit 17f09d3f619a ("SUNRPC: Check if the xprt is connected before +handling sysfs reads") appears to attempt to fix this problem, but it +only narrows the race window. + +Fixes: 17f09d3f619a ("SUNRPC: Check if the xprt is connected before handling sysfs reads") +Fixes: a8482488a7d6 ("SUNRPC query transport's source port") +Signed-off-by: NeilBrown +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + net/sunrpc/sysfs.c | 5 ++++- + net/sunrpc/xprtsock.c | 7 ++++++- + 2 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/net/sunrpc/sysfs.c b/net/sunrpc/sysfs.c +index 8f309bcdf84fe..0c28280dd3bcb 100644 +--- a/net/sunrpc/sysfs.c ++++ b/net/sunrpc/sysfs.c +@@ -115,11 +115,14 @@ static ssize_t rpc_sysfs_xprt_srcaddr_show(struct kobject *kobj, + } + + sock = container_of(xprt, struct sock_xprt, xprt); +- if (kernel_getsockname(sock->sock, (struct sockaddr *)&saddr) < 0) ++ mutex_lock(&sock->recv_mutex); ++ if (sock->sock == NULL || ++ kernel_getsockname(sock->sock, (struct sockaddr *)&saddr) < 0) + goto out; + + ret = sprintf(buf, "%pISc\n", &saddr); + out: ++ mutex_unlock(&sock->recv_mutex); + xprt_put(xprt); + return ret + 1; + } +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index d8ee06a9650a1..03770e56df361 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -1641,7 +1641,12 @@ static int xs_get_srcport(struct sock_xprt *transport) + unsigned short get_srcport(struct rpc_xprt *xprt) + { + struct sock_xprt *sock = container_of(xprt, struct sock_xprt, xprt); +- return xs_sock_getport(sock->sock); ++ unsigned short ret = 0; ++ mutex_lock(&sock->recv_mutex); ++ if (sock->sock) ++ ret = xs_sock_getport(sock->sock); ++ mutex_unlock(&sock->recv_mutex); ++ return ret; + } + EXPORT_SYMBOL(get_srcport); + +-- +2.34.1 + diff --git a/queue-5.16/tcp-take-care-of-mixed-splice-sendmsg-msg_zerocopy-c.patch b/queue-5.16/tcp-take-care-of-mixed-splice-sendmsg-msg_zerocopy-c.patch new file mode 100644 index 00000000000..c7397d19e37 --- /dev/null +++ b/queue-5.16/tcp-take-care-of-mixed-splice-sendmsg-msg_zerocopy-c.patch @@ -0,0 +1,102 @@ +From d74260e4e8d88fd277cdb90381e69f2a3da2ff28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Feb 2022 14:55:47 -0800 +Subject: tcp: take care of mixed splice()/sendmsg(MSG_ZEROCOPY) case + +From: Eric Dumazet + +[ Upstream commit f8d9d938514f46c4892aff6bfe32f425e84d81cc ] + +syzbot found that mixing sendpage() and sendmsg(MSG_ZEROCOPY) +calls over the same TCP socket would again trigger the +infamous warning in inet_sock_destruct() + + WARN_ON(sk_forward_alloc_get(sk)); + +While Talal took into account a mix of regular copied data +and MSG_ZEROCOPY one in the same skb, the sendpage() path +has been forgotten. + +We want the charging to happen for sendpage(), because +pages could be coming from a pipe. What is missing is the +downgrading of pure zerocopy status to make sure +sk_forward_alloc will stay synced. + +Add tcp_downgrade_zcopy_pure() helper so that we can +use it from the two callers. + +Fixes: 9b65b17db723 ("net: avoid double accounting for pure zerocopy skbs") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Cc: Talal Ahmad +Cc: Arjun Roy +Cc: Willem de Bruijn +Acked-by: Soheil Hassas Yeganeh +Link: https://lore.kernel.org/r/20220203225547.665114-1-eric.dumazet@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 33 +++++++++++++++++++-------------- + 1 file changed, 19 insertions(+), 14 deletions(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 94cbba9fb12b1..28abb0bb1c515 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -936,6 +936,22 @@ void tcp_remove_empty_skb(struct sock *sk) + } + } + ++/* skb changing from pure zc to mixed, must charge zc */ ++static int tcp_downgrade_zcopy_pure(struct sock *sk, struct sk_buff *skb) ++{ ++ if (unlikely(skb_zcopy_pure(skb))) { ++ u32 extra = skb->truesize - ++ SKB_TRUESIZE(skb_end_offset(skb)); ++ ++ if (!sk_wmem_schedule(sk, extra)) ++ return -ENOMEM; ++ ++ sk_mem_charge(sk, extra); ++ skb_shinfo(skb)->flags &= ~SKBFL_PURE_ZEROCOPY; ++ } ++ return 0; ++} ++ + static struct sk_buff *tcp_build_frag(struct sock *sk, int size_goal, int flags, + struct page *page, int offset, size_t *size) + { +@@ -971,7 +987,7 @@ static struct sk_buff *tcp_build_frag(struct sock *sk, int size_goal, int flags, + tcp_mark_push(tp, skb); + goto new_segment; + } +- if (!sk_wmem_schedule(sk, copy)) ++ if (tcp_downgrade_zcopy_pure(sk, skb) || !sk_wmem_schedule(sk, copy)) + return NULL; + + if (can_coalesce) { +@@ -1319,19 +1335,8 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size) + + copy = min_t(int, copy, pfrag->size - pfrag->offset); + +- /* skb changing from pure zc to mixed, must charge zc */ +- if (unlikely(skb_zcopy_pure(skb))) { +- u32 extra = skb->truesize - +- SKB_TRUESIZE(skb_end_offset(skb)); +- +- if (!sk_wmem_schedule(sk, extra)) +- goto wait_for_space; +- +- sk_mem_charge(sk, extra); +- skb_shinfo(skb)->flags &= ~SKBFL_PURE_ZEROCOPY; +- } +- +- if (!sk_wmem_schedule(sk, copy)) ++ if (tcp_downgrade_zcopy_pure(sk, skb) || ++ !sk_wmem_schedule(sk, copy)) + goto wait_for_space; + + err = skb_copy_to_page_nocache(sk, &msg->msg_iter, skb, +-- +2.34.1 + diff --git a/queue-5.16/tee-optee-do-not-check-memref-size-on-return-from-se.patch b/queue-5.16/tee-optee-do-not-check-memref-size-on-return-from-se.patch new file mode 100644 index 00000000000..ee3d92d52e4 --- /dev/null +++ b/queue-5.16/tee-optee-do-not-check-memref-size-on-return-from-se.patch @@ -0,0 +1,47 @@ +From 30f7daa5e62cd133fb4cad02dd5862e6e686089c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jan 2022 16:27:13 +0100 +Subject: tee: optee: do not check memref size on return from Secure World + +From: Jerome Forissier + +[ Upstream commit abc8dc34d1f6e34ed346c6e3fc554127e421b769 ] + +Commit c650b8dc7a79 ("tee: optee: do not check memref size on return +from Secure World") was mistakenly lost in commit 4602c5842f64 ("optee: +refactor driver with internal callbacks"). Remove the unwanted code +again. + +Fixes: 4602c5842f64 ("optee: refactor driver with internal callbacks") +Signed-off-by: Jerome Forissier +Reviewed-by: Sumit Garg +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/optee/smc_abi.c | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/drivers/tee/optee/smc_abi.c b/drivers/tee/optee/smc_abi.c +index cf2e3293567d9..09e7ec673bb6b 100644 +--- a/drivers/tee/optee/smc_abi.c ++++ b/drivers/tee/optee/smc_abi.c +@@ -71,16 +71,6 @@ static int from_msg_param_tmp_mem(struct tee_param *p, u32 attr, + p->u.memref.shm_offs = mp->u.tmem.buf_ptr - pa; + p->u.memref.shm = shm; + +- /* Check that the memref is covered by the shm object */ +- if (p->u.memref.size) { +- size_t o = p->u.memref.shm_offs + +- p->u.memref.size - 1; +- +- rc = tee_shm_get_pa(shm, o, NULL); +- if (rc) +- return rc; +- } +- + return 0; + } + +-- +2.34.1 + diff --git a/queue-5.16/tipc-rate-limit-warning-for-received-illegal-binding.patch b/queue-5.16/tipc-rate-limit-warning-for-received-illegal-binding.patch new file mode 100644 index 00000000000..b3ba12e570a --- /dev/null +++ b/queue-5.16/tipc-rate-limit-warning-for-received-illegal-binding.patch @@ -0,0 +1,38 @@ +From c1b514d169a01a3a7b5771c155d1bcd37931ccb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Feb 2022 22:22:37 -0500 +Subject: tipc: rate limit warning for received illegal binding update + +From: Jon Maloy + +[ Upstream commit c7223d687758462826a20e9735305d55bb874c70 ] + +It would be easy to craft a message containing an illegal binding table +update operation. This is handled correctly by the code, but the +corresponding warning printout is not rate limited as is should be. +We fix this now. + +Fixes: b97bf3fd8f6a ("[TIPC] Initial merge") +Signed-off-by: Jon Maloy +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/name_distr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c +index bda902caa8147..8267b751a526a 100644 +--- a/net/tipc/name_distr.c ++++ b/net/tipc/name_distr.c +@@ -313,7 +313,7 @@ static bool tipc_update_nametbl(struct net *net, struct distr_item *i, + pr_warn_ratelimited("Failed to remove binding %u,%u from %u\n", + ua.sr.type, ua.sr.lower, node); + } else { +- pr_warn("Unrecognized name table message received\n"); ++ pr_warn_ratelimited("Unknown name table message received\n"); + } + return false; + } +-- +2.34.1 + diff --git a/queue-5.16/usb-f_fs-fix-use-after-free-for-epfile.patch b/queue-5.16/usb-f_fs-fix-use-after-free-for-epfile.patch new file mode 100644 index 00000000000..59702f56904 --- /dev/null +++ b/queue-5.16/usb-f_fs-fix-use-after-free-for-epfile.patch @@ -0,0 +1,163 @@ +From a472c57c7ac72a59687646d1ddbdb06aa94d16b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jan 2022 09:39:55 +0530 +Subject: usb: f_fs: Fix use-after-free for epfile + +From: Udipto Goswami + +[ Upstream commit ebe2b1add1055b903e2acd86b290a85297edc0b3 ] + +Consider a case where ffs_func_eps_disable is called from +ffs_func_disable as part of composition switch and at the +same time ffs_epfile_release get called from userspace. +ffs_epfile_release will free up the read buffer and call +ffs_data_closed which in turn destroys ffs->epfiles and +mark it as NULL. While this was happening the driver has +already initialized the local epfile in ffs_func_eps_disable +which is now freed and waiting to acquire the spinlock. Once +spinlock is acquired the driver proceeds with the stale value +of epfile and tries to free the already freed read buffer +causing use-after-free. + +Following is the illustration of the race: + + CPU1 CPU2 + + ffs_func_eps_disable + epfiles (local copy) + ffs_epfile_release + ffs_data_closed + if (last file closed) + ffs_data_reset + ffs_data_clear + ffs_epfiles_destroy +spin_lock +dereference epfiles + +Fix this races by taking epfiles local copy & assigning it under +spinlock and if epfiles(local) is null then update it in ffs->epfiles +then finally destroy it. +Extending the scope further from the race, protecting the ep related +structures, and concurrent accesses. + +Fixes: a9e6f83c2df1 ("usb: gadget: f_fs: stop sleeping in ffs_func_eps_disable") +Co-developed-by: Udipto Goswami +Reviewed-by: John Keeping +Signed-off-by: Pratham Pratap +Signed-off-by: Udipto Goswami +Link: https://lore.kernel.org/r/1643256595-10797-1-git-send-email-quic_ugoswami@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_fs.c | 56 ++++++++++++++++++++++-------- + 1 file changed, 42 insertions(+), 14 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 25ad1e97a4585..1922fd02043c5 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1711,16 +1711,24 @@ static void ffs_data_put(struct ffs_data *ffs) + + static void ffs_data_closed(struct ffs_data *ffs) + { ++ struct ffs_epfile *epfiles; ++ unsigned long flags; ++ + ENTER(); + + if (atomic_dec_and_test(&ffs->opened)) { + if (ffs->no_disconnect) { + ffs->state = FFS_DEACTIVATED; +- if (ffs->epfiles) { +- ffs_epfiles_destroy(ffs->epfiles, +- ffs->eps_count); +- ffs->epfiles = NULL; +- } ++ spin_lock_irqsave(&ffs->eps_lock, flags); ++ epfiles = ffs->epfiles; ++ ffs->epfiles = NULL; ++ spin_unlock_irqrestore(&ffs->eps_lock, ++ flags); ++ ++ if (epfiles) ++ ffs_epfiles_destroy(epfiles, ++ ffs->eps_count); ++ + if (ffs->setup_state == FFS_SETUP_PENDING) + __ffs_ep0_stall(ffs); + } else { +@@ -1767,14 +1775,27 @@ static struct ffs_data *ffs_data_new(const char *dev_name) + + static void ffs_data_clear(struct ffs_data *ffs) + { ++ struct ffs_epfile *epfiles; ++ unsigned long flags; ++ + ENTER(); + + ffs_closed(ffs); + + BUG_ON(ffs->gadget); + +- if (ffs->epfiles) { +- ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count); ++ spin_lock_irqsave(&ffs->eps_lock, flags); ++ epfiles = ffs->epfiles; ++ ffs->epfiles = NULL; ++ spin_unlock_irqrestore(&ffs->eps_lock, flags); ++ ++ /* ++ * potential race possible between ffs_func_eps_disable ++ * & ffs_epfile_release therefore maintaining a local ++ * copy of epfile will save us from use-after-free. ++ */ ++ if (epfiles) { ++ ffs_epfiles_destroy(epfiles, ffs->eps_count); + ffs->epfiles = NULL; + } + +@@ -1922,12 +1943,15 @@ static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count) + + static void ffs_func_eps_disable(struct ffs_function *func) + { +- struct ffs_ep *ep = func->eps; +- struct ffs_epfile *epfile = func->ffs->epfiles; +- unsigned count = func->ffs->eps_count; ++ struct ffs_ep *ep; ++ struct ffs_epfile *epfile; ++ unsigned short count; + unsigned long flags; + + spin_lock_irqsave(&func->ffs->eps_lock, flags); ++ count = func->ffs->eps_count; ++ epfile = func->ffs->epfiles; ++ ep = func->eps; + while (count--) { + /* pending requests get nuked */ + if (ep->ep) +@@ -1945,14 +1969,18 @@ static void ffs_func_eps_disable(struct ffs_function *func) + + static int ffs_func_eps_enable(struct ffs_function *func) + { +- struct ffs_data *ffs = func->ffs; +- struct ffs_ep *ep = func->eps; +- struct ffs_epfile *epfile = ffs->epfiles; +- unsigned count = ffs->eps_count; ++ struct ffs_data *ffs; ++ struct ffs_ep *ep; ++ struct ffs_epfile *epfile; ++ unsigned short count; + unsigned long flags; + int ret = 0; + + spin_lock_irqsave(&func->ffs->eps_lock, flags); ++ ffs = func->ffs; ++ ep = func->eps; ++ epfile = ffs->epfiles; ++ count = ffs->eps_count; + while(count--) { + ep->ep->driver_data = ep; + +-- +2.34.1 + diff --git a/queue-5.16/veth-fix-races-around-rq-rx_notify_masked.patch b/queue-5.16/veth-fix-races-around-rq-rx_notify_masked.patch new file mode 100644 index 00000000000..6f4353a6c0f --- /dev/null +++ b/queue-5.16/veth-fix-races-around-rq-rx_notify_masked.patch @@ -0,0 +1,156 @@ +From f8c0d9cfe438755de3ffc6ad83300df98381a710 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Feb 2022 15:28:22 -0800 +Subject: veth: fix races around rq->rx_notify_masked + +From: Eric Dumazet + +[ Upstream commit 68468d8c4cd4222a4ca1f185ab5a1c14480d078c ] + +veth being NETIF_F_LLTX enabled, we need to be more careful +whenever we read/write rq->rx_notify_masked. + +BUG: KCSAN: data-race in veth_xmit / veth_xmit + +write to 0xffff888133d9a9f8 of 1 bytes by task 23552 on cpu 0: + __veth_xdp_flush drivers/net/veth.c:269 [inline] + veth_xmit+0x307/0x470 drivers/net/veth.c:350 + __netdev_start_xmit include/linux/netdevice.h:4683 [inline] + netdev_start_xmit include/linux/netdevice.h:4697 [inline] + xmit_one+0x105/0x2f0 net/core/dev.c:3473 + dev_hard_start_xmit net/core/dev.c:3489 [inline] + __dev_queue_xmit+0x86d/0xf90 net/core/dev.c:4116 + dev_queue_xmit+0x13/0x20 net/core/dev.c:4149 + br_dev_queue_push_xmit+0x3ce/0x430 net/bridge/br_forward.c:53 + NF_HOOK include/linux/netfilter.h:307 [inline] + br_forward_finish net/bridge/br_forward.c:66 [inline] + NF_HOOK include/linux/netfilter.h:307 [inline] + __br_forward+0x2e4/0x400 net/bridge/br_forward.c:115 + br_flood+0x521/0x5c0 net/bridge/br_forward.c:242 + br_dev_xmit+0x8b6/0x960 + __netdev_start_xmit include/linux/netdevice.h:4683 [inline] + netdev_start_xmit include/linux/netdevice.h:4697 [inline] + xmit_one+0x105/0x2f0 net/core/dev.c:3473 + dev_hard_start_xmit net/core/dev.c:3489 [inline] + __dev_queue_xmit+0x86d/0xf90 net/core/dev.c:4116 + dev_queue_xmit+0x13/0x20 net/core/dev.c:4149 + neigh_hh_output include/net/neighbour.h:525 [inline] + neigh_output include/net/neighbour.h:539 [inline] + ip_finish_output2+0x6f8/0xb70 net/ipv4/ip_output.c:228 + ip_finish_output+0xfb/0x240 net/ipv4/ip_output.c:316 + NF_HOOK_COND include/linux/netfilter.h:296 [inline] + ip_output+0xf3/0x1a0 net/ipv4/ip_output.c:430 + dst_output include/net/dst.h:451 [inline] + ip_local_out net/ipv4/ip_output.c:126 [inline] + ip_send_skb+0x6e/0xe0 net/ipv4/ip_output.c:1570 + udp_send_skb+0x641/0x880 net/ipv4/udp.c:967 + udp_sendmsg+0x12ea/0x14c0 net/ipv4/udp.c:1254 + inet_sendmsg+0x5f/0x80 net/ipv4/af_inet.c:819 + sock_sendmsg_nosec net/socket.c:705 [inline] + sock_sendmsg net/socket.c:725 [inline] + ____sys_sendmsg+0x39a/0x510 net/socket.c:2413 + ___sys_sendmsg net/socket.c:2467 [inline] + __sys_sendmmsg+0x267/0x4c0 net/socket.c:2553 + __do_sys_sendmmsg net/socket.c:2582 [inline] + __se_sys_sendmmsg net/socket.c:2579 [inline] + __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2579 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +read to 0xffff888133d9a9f8 of 1 bytes by task 23563 on cpu 1: + __veth_xdp_flush drivers/net/veth.c:268 [inline] + veth_xmit+0x2d6/0x470 drivers/net/veth.c:350 + __netdev_start_xmit include/linux/netdevice.h:4683 [inline] + netdev_start_xmit include/linux/netdevice.h:4697 [inline] + xmit_one+0x105/0x2f0 net/core/dev.c:3473 + dev_hard_start_xmit net/core/dev.c:3489 [inline] + __dev_queue_xmit+0x86d/0xf90 net/core/dev.c:4116 + dev_queue_xmit+0x13/0x20 net/core/dev.c:4149 + br_dev_queue_push_xmit+0x3ce/0x430 net/bridge/br_forward.c:53 + NF_HOOK include/linux/netfilter.h:307 [inline] + br_forward_finish net/bridge/br_forward.c:66 [inline] + NF_HOOK include/linux/netfilter.h:307 [inline] + __br_forward+0x2e4/0x400 net/bridge/br_forward.c:115 + br_flood+0x521/0x5c0 net/bridge/br_forward.c:242 + br_dev_xmit+0x8b6/0x960 + __netdev_start_xmit include/linux/netdevice.h:4683 [inline] + netdev_start_xmit include/linux/netdevice.h:4697 [inline] + xmit_one+0x105/0x2f0 net/core/dev.c:3473 + dev_hard_start_xmit net/core/dev.c:3489 [inline] + __dev_queue_xmit+0x86d/0xf90 net/core/dev.c:4116 + dev_queue_xmit+0x13/0x20 net/core/dev.c:4149 + neigh_hh_output include/net/neighbour.h:525 [inline] + neigh_output include/net/neighbour.h:539 [inline] + ip_finish_output2+0x6f8/0xb70 net/ipv4/ip_output.c:228 + ip_finish_output+0xfb/0x240 net/ipv4/ip_output.c:316 + NF_HOOK_COND include/linux/netfilter.h:296 [inline] + ip_output+0xf3/0x1a0 net/ipv4/ip_output.c:430 + dst_output include/net/dst.h:451 [inline] + ip_local_out net/ipv4/ip_output.c:126 [inline] + ip_send_skb+0x6e/0xe0 net/ipv4/ip_output.c:1570 + udp_send_skb+0x641/0x880 net/ipv4/udp.c:967 + udp_sendmsg+0x12ea/0x14c0 net/ipv4/udp.c:1254 + inet_sendmsg+0x5f/0x80 net/ipv4/af_inet.c:819 + sock_sendmsg_nosec net/socket.c:705 [inline] + sock_sendmsg net/socket.c:725 [inline] + ____sys_sendmsg+0x39a/0x510 net/socket.c:2413 + ___sys_sendmsg net/socket.c:2467 [inline] + __sys_sendmmsg+0x267/0x4c0 net/socket.c:2553 + __do_sys_sendmmsg net/socket.c:2582 [inline] + __se_sys_sendmmsg net/socket.c:2579 [inline] + __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2579 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +value changed: 0x00 -> 0x01 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 PID: 23563 Comm: syz-executor.5 Not tainted 5.17.0-rc2-syzkaller-00064-gc36c04c2e132 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 + +Fixes: 948d4f214fde ("veth: Add driver XDP") +Signed-off-by: Eric Dumazet +Cc: Toshiaki Makita +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/veth.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/veth.c b/drivers/net/veth.c +index ecbc09cbe2590..f478fe7e2b820 100644 +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -272,9 +272,10 @@ static void __veth_xdp_flush(struct veth_rq *rq) + { + /* Write ptr_ring before reading rx_notify_masked */ + smp_mb(); +- if (!rq->rx_notify_masked) { +- rq->rx_notify_masked = true; +- napi_schedule(&rq->xdp_napi); ++ if (!READ_ONCE(rq->rx_notify_masked) && ++ napi_schedule_prep(&rq->xdp_napi)) { ++ WRITE_ONCE(rq->rx_notify_masked, true); ++ __napi_schedule(&rq->xdp_napi); + } + } + +@@ -919,8 +920,10 @@ static int veth_poll(struct napi_struct *napi, int budget) + /* Write rx_notify_masked before reading ptr_ring */ + smp_store_mb(rq->rx_notify_masked, false); + if (unlikely(!__ptr_ring_empty(&rq->xdp_ring))) { +- rq->rx_notify_masked = true; +- napi_schedule(&rq->xdp_napi); ++ if (napi_schedule_prep(&rq->xdp_napi)) { ++ WRITE_ONCE(rq->rx_notify_masked, true); ++ __napi_schedule(&rq->xdp_napi); ++ } + } + } + +-- +2.34.1 +