From: Greg Kroah-Hartman Date: Mon, 20 Sep 2021 08:17:46 +0000 (+0200) Subject: 5.14-stable patches X-Git-Tag: v4.4.284~45 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=be9caab608deec30eb90c413dd328acdaeaf1ac0;p=thirdparty%2Fkernel%2Fstable-queue.git 5.14-stable patches added patches: dccp-don-t-duplicate-ccid-when-cloning-dccp-sock.patch drm-i915-dp-return-proper-dprx-link-training-result.patch drm-rockchip-cdn-dp-core-make-cdn_dp_core_resume-__maybe_unused.patch igc-fix-tunnel-offloading.patch net-caif-avoid-user-triggerable-warn_on-1.patch net-l2tp-fix-reference-count-leak-in-l2tp_udp_recv_core.patch net-mlx5-fix-potential-sleeping-in-atomic-context.patch net-mlx5-fwtrace-cancel-work-on-alloc-pd-error-flow.patch net-stmmac-fix-system-hang-caused-by-eee_ctrl_timer-during-suspend-resume.patch nvme-tcp-fix-io_work-priority-inversion.patch parisc-declare-pci_iounmap-parisc-version-only-when-config_pci-enabled.patch perf-machine-initialize-srcline-string-member-in-add_location-struct.patch ptp-dp83640-don-t-define-page0.patch r6040-restore-mdio-clock-frequency-after-mac-reset.patch rtc-cmos-disable-irq-around-direct-invocation-of-cmos_interrupt.patch tipc-increase-timeout-in-tipc_sk_enqueue.patch --- diff --git a/queue-5.14/dccp-don-t-duplicate-ccid-when-cloning-dccp-sock.patch b/queue-5.14/dccp-don-t-duplicate-ccid-when-cloning-dccp-sock.patch new file mode 100644 index 00000000000..fea77eca8f5 --- /dev/null +++ b/queue-5.14/dccp-don-t-duplicate-ccid-when-cloning-dccp-sock.patch @@ -0,0 +1,41 @@ +From d9ea761fdd197351890418acd462c51f241014a7 Mon Sep 17 00:00:00 2001 +From: "Lin, Zhenpeng" +Date: Wed, 8 Sep 2021 03:40:59 +0000 +Subject: dccp: don't duplicate ccid when cloning dccp sock + +From: Lin, Zhenpeng + +commit d9ea761fdd197351890418acd462c51f241014a7 upstream. + +Commit 2677d2067731 ("dccp: don't free ccid2_hc_tx_sock ...") fixed +a UAF but reintroduced CVE-2017-6074. + +When the sock is cloned, two dccps_hc_tx_ccid will reference to the +same ccid. So one can free the ccid object twice from two socks after +cloning. + +This issue was found by "Hadar Manor" as well and assigned with +CVE-2020-16119, which was fixed in Ubuntu's kernel. So here I port +the patch from Ubuntu to fix it. + +The patch prevents cloned socks from referencing the same ccid. + +Fixes: 2677d2067731410 ("dccp: don't free ccid2_hc_tx_sock ...") +Signed-off-by: Zhenpeng Lin +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/dccp/minisocks.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/dccp/minisocks.c ++++ b/net/dccp/minisocks.c +@@ -94,6 +94,8 @@ struct sock *dccp_create_openreq_child(c + newdp->dccps_role = DCCP_ROLE_SERVER; + newdp->dccps_hc_rx_ackvec = NULL; + newdp->dccps_service_list = NULL; ++ newdp->dccps_hc_rx_ccid = NULL; ++ newdp->dccps_hc_tx_ccid = NULL; + newdp->dccps_service = dreq->dreq_service; + newdp->dccps_timestamp_echo = dreq->dreq_timestamp_echo; + newdp->dccps_timestamp_time = dreq->dreq_timestamp_time; diff --git a/queue-5.14/drm-i915-dp-return-proper-dprx-link-training-result.patch b/queue-5.14/drm-i915-dp-return-proper-dprx-link-training-result.patch new file mode 100644 index 00000000000..096deafd6a6 --- /dev/null +++ b/queue-5.14/drm-i915-dp-return-proper-dprx-link-training-result.patch @@ -0,0 +1,42 @@ +From 9af4bf2171c1a9e3f2ebb21140c0e34e60b2a22a Mon Sep 17 00:00:00 2001 +From: Lee Shawn C +Date: Tue, 6 Jul 2021 23:25:41 +0800 +Subject: drm/i915/dp: return proper DPRX link training result + +From: Lee Shawn C + +commit 9af4bf2171c1a9e3f2ebb21140c0e34e60b2a22a upstream. + +After DPRX link training, intel_dp_link_train_phy() did not +return the training result properly. If link training failed, +i915 driver would not run into link train fallback function. +And no hotplug uevent would be received by user space application. + +Fixes: b30edfd8d0b4 ("drm/i915: Switch to LTTPR non-transparent mode link training") +Cc: Ville Syrjala +Cc: Imre Deak +Cc: Jani Nikula +Cc: Cooper Chiou +Cc: William Tseng +Signed-off-by: Lee Shawn C +Reviewed-by: Imre Deak +Signed-off-by: Imre Deak +Link: https://patchwork.freedesktop.org/patch/msgid/20210706152541.25021-1-shawn.c.lee@intel.com +(cherry picked from commit dab1b47e57e053b2a02c22ead8e7449f79961335) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_dp_link_training.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/display/intel_dp_link_training.c ++++ b/drivers/gpu/drm/i915/display/intel_dp_link_training.c +@@ -848,7 +848,7 @@ intel_dp_link_train_all_phys(struct inte + } + + if (ret) +- intel_dp_link_train_phy(intel_dp, crtc_state, DP_PHY_DPRX); ++ ret = intel_dp_link_train_phy(intel_dp, crtc_state, DP_PHY_DPRX); + + if (intel_dp->set_idle_link_train) + intel_dp->set_idle_link_train(intel_dp, crtc_state); diff --git a/queue-5.14/drm-rockchip-cdn-dp-core-make-cdn_dp_core_resume-__maybe_unused.patch b/queue-5.14/drm-rockchip-cdn-dp-core-make-cdn_dp_core_resume-__maybe_unused.patch new file mode 100644 index 00000000000..8547548acd2 --- /dev/null +++ b/queue-5.14/drm-rockchip-cdn-dp-core-make-cdn_dp_core_resume-__maybe_unused.patch @@ -0,0 +1,45 @@ +From 040b8907ccf1c78d020aca29800036565d761d73 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Tue, 28 Apr 2020 23:31:24 +0200 +Subject: drm/rockchip: cdn-dp-core: Make cdn_dp_core_resume __maybe_unused + +From: Arnd Bergmann + +commit 040b8907ccf1c78d020aca29800036565d761d73 upstream. + +With the new static annotation, the compiler warns when the functions +are actually unused: + + drivers/gpu/drm/rockchip/cdn-dp-core.c:1123:12: error: 'cdn_dp_resume' defined but not used [-Werror=unused-function] + 1123 | static int cdn_dp_resume(struct device *dev) + | ^~~~~~~~~~~~~ + +Mark them __maybe_unused to suppress that warning as well. + +[ Not so 'new' static annotations any more, and I removed the part of + the patch that added __maybe_unused to cdn_dp_suspend(), because it's + used by the shutdown/remove code. + + So only the resume function ends up possibly unused if CONFIG_PM isn't + set - Linus ] + +Fixes: 7c49abb4c2f8 ("drm/rockchip: cdn-dp-core: Make cdn_dp_core_suspend/resume static") +Signed-off-by: Arnd Bergmann +Reviewed-by: Enric Balletbo i Serra +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/rockchip/cdn-dp-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/rockchip/cdn-dp-core.c ++++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c +@@ -1123,7 +1123,7 @@ static int cdn_dp_suspend(struct device + return ret; + } + +-static int cdn_dp_resume(struct device *dev) ++static __maybe_unused int cdn_dp_resume(struct device *dev) + { + struct cdn_dp_device *dp = dev_get_drvdata(dev); + diff --git a/queue-5.14/igc-fix-tunnel-offloading.patch b/queue-5.14/igc-fix-tunnel-offloading.patch new file mode 100644 index 00000000000..32bc0f18a7d --- /dev/null +++ b/queue-5.14/igc-fix-tunnel-offloading.patch @@ -0,0 +1,100 @@ +From 40ee363c844fcb6ae0f1f5cfea68aed7e268c2f4 Mon Sep 17 00:00:00 2001 +From: Paolo Abeni +Date: Wed, 15 Sep 2021 10:19:07 -0700 +Subject: igc: fix tunnel offloading + +From: Paolo Abeni + +commit 40ee363c844fcb6ae0f1f5cfea68aed7e268c2f4 upstream. + +Checking tunnel offloading, it turns out that offloading doesn't work +as expected. The following script allows to reproduce the issue. +Call it as `testscript DEVICE LOCALIP REMOTEIP NETMASK' + +=== SNIP === +if [ $# -ne 4 ] +then + echo "Usage $0 DEVICE LOCALIP REMOTEIP NETMASK" + exit 1 +fi +DEVICE="$1" +LOCAL_ADDRESS="$2" +REMOTE_ADDRESS="$3" +NWMASK="$4" +echo "Driver: $(ethtool -i ${DEVICE} | awk '/^driver:/{print $2}') " +ethtool -k "${DEVICE}" | grep tx-udp +echo +echo "Set up NIC and tunnel..." +ip addr add "${LOCAL_ADDRESS}/${NWMASK}" dev "${DEVICE}" +ip link set "${DEVICE}" up +sleep 2 +ip link add vxlan1 type vxlan id 42 \ + remote "${REMOTE_ADDRESS}" \ + local "${LOCAL_ADDRESS}" \ + dstport 0 \ + dev "${DEVICE}" +ip addr add fc00::1/64 dev vxlan1 +ip link set vxlan1 up +sleep 2 +rm -f vxlan.pcap +echo "Running tcpdump and iperf3..." +( nohup tcpdump -i any -w vxlan.pcap >/dev/null 2>&1 ) & +sleep 2 +iperf3 -c fc00::2 >/dev/null +pkill tcpdump +echo +echo -n "Max. Paket Size: " +tcpdump -r vxlan.pcap -nnle 2>/dev/null \ +| grep "${LOCAL_ADDRESS}.*> ${REMOTE_ADDRESS}.*OTV" \ +| awk '{print $8}' | awk -F ':' '{print $1}' \ +| sort -n | tail -1 +echo +ip link del vxlan1 +ip addr del ${LOCAL_ADDRESS}/${NWMASK} dev "${DEVICE}" +=== SNAP === + +The expected outcome is + + Max. Paket Size: 64904 + +This is what you see on igb, the code igc has been taken from. +However, on igc the output is + + Max. Paket Size: 1516 + +so the GSO aggregate packets are segmented by the kernel before calling +igc_xmit_frame. Inside the subsequent call to igc_tso, the check for +skb_is_gso(skb) fails and the function returns prematurely. + +It turns out that this occurs because the feature flags aren't set +entirely correctly in igc_probe. In contrast to the original code +from igb_probe, igc_probe neglects to set the flags required to allow +tunnel offloading. + +Setting the same flags as igb fixes the issue on igc. + +Fixes: 34428dff3679 ("igc: Add GSO partial support") +Signed-off-by: Paolo Abeni +Tested-by: Corinna Vinschen +Acked-by: Sasha Neftin +Tested-by: Nechama Kraus +Signed-off-by: Tony Nguyen +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/igc/igc_main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -5962,7 +5962,9 @@ static int igc_probe(struct pci_dev *pde + if (pci_using_dac) + netdev->features |= NETIF_F_HIGHDMA; + +- netdev->vlan_features |= netdev->features; ++ netdev->vlan_features |= netdev->features | NETIF_F_TSO_MANGLEID; ++ netdev->mpls_features |= NETIF_F_HW_CSUM; ++ netdev->hw_enc_features |= netdev->vlan_features; + + /* MTU range: 68 - 9216 */ + netdev->min_mtu = ETH_MIN_MTU; diff --git a/queue-5.14/net-caif-avoid-user-triggerable-warn_on-1.patch b/queue-5.14/net-caif-avoid-user-triggerable-warn_on-1.patch new file mode 100644 index 00000000000..5dab6b0b870 --- /dev/null +++ b/queue-5.14/net-caif-avoid-user-triggerable-warn_on-1.patch @@ -0,0 +1,112 @@ +From 550ac9c1aaaaf51fd42e20d461f0b1cdbd55b3d2 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Mon, 13 Sep 2021 11:08:36 -0700 +Subject: net-caif: avoid user-triggerable WARN_ON(1) + +From: Eric Dumazet + +commit 550ac9c1aaaaf51fd42e20d461f0b1cdbd55b3d2 upstream. + +syszbot triggers this warning, which looks something +we can easily prevent. + +If we initialize priv->list_field in chnl_net_init(), +then always use list_del_init(), we can remove robust_list_del() +completely. + +WARNING: CPU: 0 PID: 3233 at net/caif/chnl_net.c:67 robust_list_del net/caif/chnl_net.c:67 [inline] +WARNING: CPU: 0 PID: 3233 at net/caif/chnl_net.c:67 chnl_net_uninit+0xc9/0x2e0 net/caif/chnl_net.c:375 +Modules linked in: +CPU: 0 PID: 3233 Comm: syz-executor.3 Not tainted 5.14.0-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +RIP: 0010:robust_list_del net/caif/chnl_net.c:67 [inline] +RIP: 0010:chnl_net_uninit+0xc9/0x2e0 net/caif/chnl_net.c:375 +Code: 89 eb e8 3a a3 ba f8 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 bf 01 00 00 48 81 fb 00 14 4e 8d 48 8b 2b 75 d0 e8 17 a3 ba f8 <0f> 0b 5b 5d 41 5c 41 5d e9 0a a3 ba f8 4c 89 e3 e8 02 a3 ba f8 4c +RSP: 0018:ffffc90009067248 EFLAGS: 00010202 +RAX: 0000000000008780 RBX: ffffffff8d4e1400 RCX: ffffc9000fd34000 +RDX: 0000000000040000 RSI: ffffffff88bb6e49 RDI: 0000000000000003 +RBP: ffff88802cd9ee08 R08: 0000000000000000 R09: ffffffff8d0e6647 +R10: ffffffff88bb6dc2 R11: 0000000000000000 R12: ffff88803791ae08 +R13: dffffc0000000000 R14: 00000000e600ffce R15: ffff888073ed3480 +FS: 00007fed10fa0700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000001b2c322000 CR3: 00000000164a6000 CR4: 00000000001506e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + register_netdevice+0xadf/0x1500 net/core/dev.c:10347 + ipcaif_newlink+0x4c/0x260 net/caif/chnl_net.c:468 + __rtnl_newlink+0x106d/0x1750 net/core/rtnetlink.c:3458 + rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3506 + rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5572 + netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 + netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] + netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 + netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929 + sock_sendmsg_nosec net/socket.c:704 [inline] + sock_sendmsg+0xcf/0x120 net/socket.c:724 + __sys_sendto+0x21c/0x320 net/socket.c:2036 + __do_sys_sendto net/socket.c:2048 [inline] + __se_sys_sendto net/socket.c:2044 [inline] + __x64_sys_sendto+0xdd/0x1b0 net/socket.c:2044 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Fixes: cc36a070b590 ("net-caif: add CAIF netdevice") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/caif/chnl_net.c | 19 +++---------------- + 1 file changed, 3 insertions(+), 16 deletions(-) + +--- a/net/caif/chnl_net.c ++++ b/net/caif/chnl_net.c +@@ -53,20 +53,6 @@ struct chnl_net { + enum caif_states state; + }; + +-static void robust_list_del(struct list_head *delete_node) +-{ +- struct list_head *list_node; +- struct list_head *n; +- ASSERT_RTNL(); +- list_for_each_safe(list_node, n, &chnl_net_list) { +- if (list_node == delete_node) { +- list_del(list_node); +- return; +- } +- } +- WARN_ON(1); +-} +- + static int chnl_recv_cb(struct cflayer *layr, struct cfpkt *pkt) + { + struct sk_buff *skb; +@@ -364,6 +350,7 @@ static int chnl_net_init(struct net_devi + ASSERT_RTNL(); + priv = netdev_priv(dev); + strncpy(priv->name, dev->name, sizeof(priv->name)); ++ INIT_LIST_HEAD(&priv->list_field); + return 0; + } + +@@ -372,7 +359,7 @@ static void chnl_net_uninit(struct net_d + struct chnl_net *priv; + ASSERT_RTNL(); + priv = netdev_priv(dev); +- robust_list_del(&priv->list_field); ++ list_del_init(&priv->list_field); + } + + static const struct net_device_ops netdev_ops = { +@@ -537,7 +524,7 @@ static void __exit chnl_exit_module(void + rtnl_lock(); + list_for_each_safe(list_node, _tmp, &chnl_net_list) { + dev = list_entry(list_node, struct chnl_net, list_field); +- list_del(list_node); ++ list_del_init(list_node); + delete_device(dev); + } + rtnl_unlock(); diff --git a/queue-5.14/net-l2tp-fix-reference-count-leak-in-l2tp_udp_recv_core.patch b/queue-5.14/net-l2tp-fix-reference-count-leak-in-l2tp_udp_recv_core.patch new file mode 100644 index 00000000000..02cd21cabfe --- /dev/null +++ b/queue-5.14/net-l2tp-fix-reference-count-leak-in-l2tp_udp_recv_core.patch @@ -0,0 +1,43 @@ +From 9b6ff7eb666415e1558f1ba8a742f5db6a9954de Mon Sep 17 00:00:00 2001 +From: Xiyu Yang +Date: Thu, 9 Sep 2021 12:32:00 +0800 +Subject: net/l2tp: Fix reference count leak in l2tp_udp_recv_core + +From: Xiyu Yang + +commit 9b6ff7eb666415e1558f1ba8a742f5db6a9954de upstream. + +The reference count leak issue may take place in an error handling +path. If both conditions of tunnel->version == L2TP_HDR_VER_3 and the +return value of l2tp_v3_ensure_opt_in_linear is nonzero, the function +would directly jump to label invalid, without decrementing the reference +count of the l2tp_session object session increased earlier by +l2tp_tunnel_get_session(). This may result in refcount leaks. + +Fix this issue by decrease the reference count before jumping to the +label invalid. + +Fixes: 4522a70db7aa ("l2tp: fix reading optional fields of L2TPv3") +Signed-off-by: Xiyu Yang +Signed-off-by: Xin Xiong +Signed-off-by: Xin Tan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/l2tp/l2tp_core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -869,8 +869,10 @@ static int l2tp_udp_recv_core(struct l2t + } + + if (tunnel->version == L2TP_HDR_VER_3 && +- l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr)) ++ l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr)) { ++ l2tp_session_dec_refcount(session); + goto invalid; ++ } + + l2tp_recv_common(session, skb, ptr, optr, hdrflags, length); + l2tp_session_dec_refcount(session); diff --git a/queue-5.14/net-mlx5-fix-potential-sleeping-in-atomic-context.patch b/queue-5.14/net-mlx5-fix-potential-sleeping-in-atomic-context.patch new file mode 100644 index 00000000000..e88016db724 --- /dev/null +++ b/queue-5.14/net-mlx5-fix-potential-sleeping-in-atomic-context.patch @@ -0,0 +1,45 @@ +From ee27e330a953595903979ffdb84926843595a9fe Mon Sep 17 00:00:00 2001 +From: Maor Gottlieb +Date: Wed, 1 Sep 2021 11:48:13 +0300 +Subject: net/mlx5: Fix potential sleeping in atomic context + +From: Maor Gottlieb + +commit ee27e330a953595903979ffdb84926843595a9fe upstream. + +Fixes the below flow of sleeping in atomic context by releasing +the RCU lock before calling to free_match_list. + +build_match_list() <- disables preempt +-> free_match_list() + -> tree_put_node() + -> down_write_ref_node() <- take write lock + +Fixes: 693c6883bbc4 ("net/mlx5: Add hash table for flow groups in flow table") +Reported-by: Dan Carpenter +Signed-off-by: Maor Gottlieb +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +@@ -1682,14 +1682,13 @@ static int build_match_list(struct match + + curr_match = kmalloc(sizeof(*curr_match), GFP_ATOMIC); + if (!curr_match) { ++ rcu_read_unlock(); + free_match_list(match_head, ft_locked); +- err = -ENOMEM; +- goto out; ++ return -ENOMEM; + } + curr_match->g = g; + list_add_tail(&curr_match->list, &match_head->list); + } +-out: + rcu_read_unlock(); + return err; + } diff --git a/queue-5.14/net-mlx5-fwtrace-cancel-work-on-alloc-pd-error-flow.patch b/queue-5.14/net-mlx5-fwtrace-cancel-work-on-alloc-pd-error-flow.patch new file mode 100644 index 00000000000..c48e2d538f7 --- /dev/null +++ b/queue-5.14/net-mlx5-fwtrace-cancel-work-on-alloc-pd-error-flow.patch @@ -0,0 +1,41 @@ +From dfe6fd72b5f1878b16aa2c8603e031bbcd66b96d Mon Sep 17 00:00:00 2001 +From: Saeed Mahameed +Date: Wed, 18 Aug 2021 13:09:26 -0700 +Subject: net/mlx5: FWTrace, cancel work on alloc pd error flow + +From: Saeed Mahameed + +commit dfe6fd72b5f1878b16aa2c8603e031bbcd66b96d upstream. + +Handle error flow on mlx5_core_alloc_pd() failure, +read_fw_strings_work must be canceled. + +Fixes: c71ad41ccb0c ("net/mlx5: FW tracer, events handling") +Reported-by: Pavel Machek (CIP) +Suggested-by: Pavel Machek (CIP) +Signed-off-by: Saeed Mahameed +Reviewed-by: Aya Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +@@ -1007,7 +1007,7 @@ int mlx5_fw_tracer_init(struct mlx5_fw_t + err = mlx5_core_alloc_pd(dev, &tracer->buff.pdn); + if (err) { + mlx5_core_warn(dev, "FWTracer: Failed to allocate PD %d\n", err); +- return err; ++ goto err_cancel_work; + } + + err = mlx5_fw_tracer_create_mkey(tracer); +@@ -1031,6 +1031,7 @@ err_notifier_unregister: + mlx5_core_destroy_mkey(dev, &tracer->buff.mkey); + err_dealloc_pd: + mlx5_core_dealloc_pd(dev, tracer->buff.pdn); ++err_cancel_work: + cancel_work_sync(&tracer->read_fw_strings_work); + return err; + } diff --git a/queue-5.14/net-stmmac-fix-system-hang-caused-by-eee_ctrl_timer-during-suspend-resume.patch b/queue-5.14/net-stmmac-fix-system-hang-caused-by-eee_ctrl_timer-during-suspend-resume.patch new file mode 100644 index 00000000000..39cbe83f7b4 --- /dev/null +++ b/queue-5.14/net-stmmac-fix-system-hang-caused-by-eee_ctrl_timer-during-suspend-resume.patch @@ -0,0 +1,148 @@ +From 276aae377206d60b9b7b7df4586cd9f2a813f5d0 Mon Sep 17 00:00:00 2001 +From: Joakim Zhang +Date: Wed, 8 Sep 2021 15:43:35 +0800 +Subject: net: stmmac: fix system hang caused by eee_ctrl_timer during suspend/resume + +From: Joakim Zhang + +commit 276aae377206d60b9b7b7df4586cd9f2a813f5d0 upstream. + +commit 5f58591323bf ("net: stmmac: delete the eee_ctrl_timer after +napi disabled"), this patch tries to fix system hang caused by eee_ctrl_timer, +unfortunately, it only can resolve it for system reboot stress test. System +hang also can be reproduced easily during system suspend/resume stess test +when mount NFS on i.MX8MP EVK board. + +In stmmac driver, eee feature is combined to phylink framework. When do +system suspend, phylink_stop() would queue delayed work, it invokes +stmmac_mac_link_down(), where to deactivate eee_ctrl_timer synchronizly. +In above commit, try to fix issue by deactivating eee_ctrl_timer obviously, +but it is not enough. Looking into eee_ctrl_timer expire callback +stmmac_eee_ctrl_timer(), it could enable hareware eee mode again. What is +unexpected is that LPI interrupt (MAC_Interrupt_Enable.LPIEN bit) is always +asserted. This interrupt has chance to be issued when LPI state entry/exit +from the MAC, and at that time, clock could have been already disabled. +The result is that system hang when driver try to touch register from +interrupt handler. + +The reason why above commit can fix system hang issue in stmmac_release() +is that, deactivate eee_ctrl_timer not just after napi disabled, further +after irq freed. + +In conclusion, hardware would generate LPI interrupt when clock has been +disabled during suspend or resume, since hardware is in eee mode and LPI +interrupt enabled. + +Interrupts from MAC, MTL and DMA level are enabled and never been disabled +when system suspend, so postpone clocks management from suspend stage to +noirq suspend stage should be more safe. + +Fixes: 5f58591323bf ("net: stmmac: delete the eee_ctrl_timer after napi disabled") +Signed-off-by: Joakim Zhang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 14 ----- + drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 44 ++++++++++++++++++ + 2 files changed, 44 insertions(+), 14 deletions(-) + +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -7113,7 +7113,6 @@ int stmmac_suspend(struct device *dev) + struct net_device *ndev = dev_get_drvdata(dev); + struct stmmac_priv *priv = netdev_priv(ndev); + u32 chan; +- int ret; + + if (!ndev || !netif_running(ndev)) + return 0; +@@ -7155,13 +7154,6 @@ int stmmac_suspend(struct device *dev) + + stmmac_mac_set(priv, priv->ioaddr, false); + pinctrl_pm_select_sleep_state(priv->device); +- /* Disable clock in case of PWM is off */ +- clk_disable_unprepare(priv->plat->clk_ptp_ref); +- ret = pm_runtime_force_suspend(dev); +- if (ret) { +- mutex_unlock(&priv->lock); +- return ret; +- } + } + + mutex_unlock(&priv->lock); +@@ -7237,12 +7229,6 @@ int stmmac_resume(struct device *dev) + priv->irq_wake = 0; + } else { + pinctrl_pm_select_default_state(priv->device); +- /* enable the clk previously disabled */ +- ret = pm_runtime_force_resume(dev); +- if (ret) +- return ret; +- if (priv->plat->clk_ptp_ref) +- clk_prepare_enable(priv->plat->clk_ptp_ref); + /* reset the phy so that it's ready */ + if (priv->mii) + stmmac_mdio_reset(priv->mii); +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +@@ -9,6 +9,7 @@ + *******************************************************************************/ + + #include ++#include + #include + #include + #include +@@ -771,9 +772,52 @@ static int __maybe_unused stmmac_runtime + return stmmac_bus_clks_config(priv, true); + } + ++static int stmmac_pltfr_noirq_suspend(struct device *dev) ++{ ++ struct net_device *ndev = dev_get_drvdata(dev); ++ struct stmmac_priv *priv = netdev_priv(ndev); ++ int ret; ++ ++ if (!netif_running(ndev)) ++ return 0; ++ ++ if (!device_may_wakeup(priv->device) || !priv->plat->pmt) { ++ /* Disable clock in case of PWM is off */ ++ clk_disable_unprepare(priv->plat->clk_ptp_ref); ++ ++ ret = pm_runtime_force_suspend(dev); ++ if (ret) ++ return ret; ++ } ++ ++ return 0; ++} ++ ++static int stmmac_pltfr_noirq_resume(struct device *dev) ++{ ++ struct net_device *ndev = dev_get_drvdata(dev); ++ struct stmmac_priv *priv = netdev_priv(ndev); ++ int ret; ++ ++ if (!netif_running(ndev)) ++ return 0; ++ ++ if (!device_may_wakeup(priv->device) || !priv->plat->pmt) { ++ /* enable the clk previously disabled */ ++ ret = pm_runtime_force_resume(dev); ++ if (ret) ++ return ret; ++ ++ clk_prepare_enable(priv->plat->clk_ptp_ref); ++ } ++ ++ return 0; ++} ++ + const struct dev_pm_ops stmmac_pltfr_pm_ops = { + SET_SYSTEM_SLEEP_PM_OPS(stmmac_pltfr_suspend, stmmac_pltfr_resume) + SET_RUNTIME_PM_OPS(stmmac_runtime_suspend, stmmac_runtime_resume, NULL) ++ SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(stmmac_pltfr_noirq_suspend, stmmac_pltfr_noirq_resume) + }; + EXPORT_SYMBOL_GPL(stmmac_pltfr_pm_ops); + diff --git a/queue-5.14/nvme-tcp-fix-io_work-priority-inversion.patch b/queue-5.14/nvme-tcp-fix-io_work-priority-inversion.patch new file mode 100644 index 00000000000..3d4ffd4a1f6 --- /dev/null +++ b/queue-5.14/nvme-tcp-fix-io_work-priority-inversion.patch @@ -0,0 +1,81 @@ +From 70f437fb4395ad4d1d16fab9a1ad9fbc9fc0579b Mon Sep 17 00:00:00 2001 +From: Keith Busch +Date: Thu, 9 Sep 2021 08:54:52 -0700 +Subject: nvme-tcp: fix io_work priority inversion + +From: Keith Busch + +commit 70f437fb4395ad4d1d16fab9a1ad9fbc9fc0579b upstream. + +Dispatching requests inline with the .queue_rq() call may block while +holding the send_mutex. If the tcp io_work also happens to schedule, it +may see the req_list is non-empty, leaving "pending" true and remaining +in TASK_RUNNING. Since io_work is of higher scheduling priority, the +.queue_rq task may not get a chance to run, blocking forward progress +and leading to io timeouts. + +Instead of checking for pending requests within io_work, let the queueing +restart io_work outside the send_mutex lock if there is more work to be +done. + +Fixes: a0fdd1418007f ("nvme-tcp: rerun io_work if req_list is not empty") +Reported-by: Samuel Jones +Signed-off-by: Keith Busch +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/tcp.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -273,6 +273,12 @@ static inline void nvme_tcp_send_all(str + } while (ret > 0); + } + ++static inline bool nvme_tcp_queue_more(struct nvme_tcp_queue *queue) ++{ ++ return !list_empty(&queue->send_list) || ++ !llist_empty(&queue->req_list) || queue->more_requests; ++} ++ + static inline void nvme_tcp_queue_request(struct nvme_tcp_request *req, + bool sync, bool last) + { +@@ -293,9 +299,10 @@ static inline void nvme_tcp_queue_reques + nvme_tcp_send_all(queue); + queue->more_requests = false; + mutex_unlock(&queue->send_mutex); +- } else if (last) { +- queue_work_on(queue->io_cpu, nvme_tcp_wq, &queue->io_work); + } ++ ++ if (last && nvme_tcp_queue_more(queue)) ++ queue_work_on(queue->io_cpu, nvme_tcp_wq, &queue->io_work); + } + + static void nvme_tcp_process_req_list(struct nvme_tcp_queue *queue) +@@ -893,12 +900,6 @@ done: + read_unlock_bh(&sk->sk_callback_lock); + } + +-static inline bool nvme_tcp_queue_more(struct nvme_tcp_queue *queue) +-{ +- return !list_empty(&queue->send_list) || +- !llist_empty(&queue->req_list) || queue->more_requests; +-} +- + static inline void nvme_tcp_done_send_req(struct nvme_tcp_queue *queue) + { + queue->request = NULL; +@@ -1132,8 +1133,7 @@ static void nvme_tcp_io_work(struct work + pending = true; + else if (unlikely(result < 0)) + break; +- } else +- pending = !llist_empty(&queue->req_list); ++ } + + result = nvme_tcp_try_recv(queue); + if (result > 0) diff --git a/queue-5.14/parisc-declare-pci_iounmap-parisc-version-only-when-config_pci-enabled.patch b/queue-5.14/parisc-declare-pci_iounmap-parisc-version-only-when-config_pci-enabled.patch new file mode 100644 index 00000000000..53d86f2f954 --- /dev/null +++ b/queue-5.14/parisc-declare-pci_iounmap-parisc-version-only-when-config_pci-enabled.patch @@ -0,0 +1,94 @@ +From 9caea0007601d3bc6debec04f8b4cd6f4c2394be Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sun, 19 Sep 2021 10:36:09 -0700 +Subject: parisc: Declare pci_iounmap() parisc version only when CONFIG_PCI enabled + +From: Helge Deller + +commit 9caea0007601d3bc6debec04f8b4cd6f4c2394be upstream. + +Linus noticed odd declaration rules for pci_iounmap() in iomap.h and +pci_iomap.h, where it dependend on either NO_GENERIC_PCI_IOPORT_MAP or +GENERIC_IOMAP when CONFIG_PCI was disabled. + +Testing on parisc seems to indicate that we need pci_iounmap() only when +CONFIG_PCI is enabled, so the declaration of pci_iounmap() can be moved +cleanly into pci_iomap.h in sync with the declarations of pci_iomap(). + +Link: https://lore.kernel.org/all/CAHk-=wjRrh98pZoQ+AzfWmsTZacWxTJKXZ9eKU2X_0+jM=O8nw@mail.gmail.com/ +Signed-off-by: Helge Deller +Suggested-by: Linus Torvalds +Fixes: 97a29d59fc22 ("[PARISC] fix compile break caused by iomap: make IOPORT/PCI mapping functions conditional") +Cc: Arnd Bergmann +Cc: Guenter Roeck +Cc: Ulrich Teichert +Cc: James Bottomley +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + arch/parisc/lib/iomap.c | 4 +++- + include/asm-generic/iomap.h | 10 ---------- + include/asm-generic/pci_iomap.h | 3 +++ + 3 files changed, 6 insertions(+), 11 deletions(-) + +--- a/arch/parisc/lib/iomap.c ++++ b/arch/parisc/lib/iomap.c +@@ -513,12 +513,15 @@ void ioport_unmap(void __iomem *addr) + } + } + ++#ifdef CONFIG_PCI + void pci_iounmap(struct pci_dev *dev, void __iomem * addr) + { + if (!INDIRECT_ADDR(addr)) { + iounmap(addr); + } + } ++EXPORT_SYMBOL(pci_iounmap); ++#endif + + EXPORT_SYMBOL(ioread8); + EXPORT_SYMBOL(ioread16); +@@ -544,4 +547,3 @@ EXPORT_SYMBOL(iowrite16_rep); + EXPORT_SYMBOL(iowrite32_rep); + EXPORT_SYMBOL(ioport_map); + EXPORT_SYMBOL(ioport_unmap); +-EXPORT_SYMBOL(pci_iounmap); +--- a/include/asm-generic/iomap.h ++++ b/include/asm-generic/iomap.h +@@ -110,16 +110,6 @@ static inline void __iomem *ioremap_np(p + } + #endif + +-#ifdef CONFIG_PCI +-/* Destroy a virtual mapping cookie for a PCI BAR (memory or IO) */ +-struct pci_dev; +-extern void pci_iounmap(struct pci_dev *dev, void __iomem *); +-#elif defined(CONFIG_GENERIC_IOMAP) +-struct pci_dev; +-static inline void pci_iounmap(struct pci_dev *dev, void __iomem *addr) +-{ } +-#endif +- + #include + + #endif +--- a/include/asm-generic/pci_iomap.h ++++ b/include/asm-generic/pci_iomap.h +@@ -18,6 +18,7 @@ extern void __iomem *pci_iomap_range(str + extern void __iomem *pci_iomap_wc_range(struct pci_dev *dev, int bar, + unsigned long offset, + unsigned long maxlen); ++extern void pci_iounmap(struct pci_dev *dev, void __iomem *); + /* Create a virtual mapping cookie for a port on a given PCI device. + * Do not call this directly, it exists to make it easier for architectures + * to override */ +@@ -50,6 +51,8 @@ static inline void __iomem *pci_iomap_wc + { + return NULL; + } ++static inline void pci_iounmap(struct pci_dev *dev, void __iomem *addr) ++{ } + #endif + + #endif /* __ASM_GENERIC_IO_H */ diff --git a/queue-5.14/perf-machine-initialize-srcline-string-member-in-add_location-struct.patch b/queue-5.14/perf-machine-initialize-srcline-string-member-in-add_location-struct.patch new file mode 100644 index 00000000000..6c4b6ec33a7 --- /dev/null +++ b/queue-5.14/perf-machine-initialize-srcline-string-member-in-add_location-struct.patch @@ -0,0 +1,132 @@ +From 57f0ff059e3daa4e70a811cb1d31a49968262d20 Mon Sep 17 00:00:00 2001 +From: Michael Petlan +Date: Mon, 19 Jul 2021 16:53:32 +0200 +Subject: perf machine: Initialize srcline string member in add_location struct + +From: Michael Petlan + +commit 57f0ff059e3daa4e70a811cb1d31a49968262d20 upstream. + +It's later supposed to be either a correct address or NULL. Without the +initialization, it may contain an undefined value which results in the +following segmentation fault: + + # perf top --sort comm -g --ignore-callees=do_idle + +terminates with: + + #0 0x00007ffff56b7685 in __strlen_avx2 () from /lib64/libc.so.6 + #1 0x00007ffff55e3802 in strdup () from /lib64/libc.so.6 + #2 0x00005555558cb139 in hist_entry__init (callchain_size=, sample_self=true, template=0x7fffde7fb110, he=0x7fffd801c250) at util/hist.c:489 + #3 hist_entry__new (template=template@entry=0x7fffde7fb110, sample_self=sample_self@entry=true) at util/hist.c:564 + #4 0x00005555558cb4ba in hists__findnew_entry (hists=hists@entry=0x5555561d9e38, entry=entry@entry=0x7fffde7fb110, al=al@entry=0x7fffde7fb420, + sample_self=sample_self@entry=true) at util/hist.c:657 + #5 0x00005555558cba1b in __hists__add_entry (hists=hists@entry=0x5555561d9e38, al=0x7fffde7fb420, sym_parent=, bi=bi@entry=0x0, mi=mi@entry=0x0, + sample=sample@entry=0x7fffde7fb4b0, sample_self=true, ops=0x0, block_info=0x0) at util/hist.c:288 + #6 0x00005555558cbb70 in hists__add_entry (sample_self=true, sample=0x7fffde7fb4b0, mi=0x0, bi=0x0, sym_parent=, al=, hists=0x5555561d9e38) + at util/hist.c:1056 + #7 iter_add_single_cumulative_entry (iter=0x7fffde7fb460, al=) at util/hist.c:1056 + #8 0x00005555558cc8a4 in hist_entry_iter__add (iter=iter@entry=0x7fffde7fb460, al=al@entry=0x7fffde7fb420, max_stack_depth=, arg=arg@entry=0x7fffffff7db0) + at util/hist.c:1231 + #9 0x00005555557cdc9a in perf_event__process_sample (machine=, sample=0x7fffde7fb4b0, evsel=, event=, tool=0x7fffffff7db0) + at builtin-top.c:842 + #10 deliver_event (qe=, qevent=) at builtin-top.c:1202 + #11 0x00005555558a9318 in do_flush (show_progress=false, oe=0x7fffffff80e0) at util/ordered-events.c:244 + #12 __ordered_events__flush (oe=oe@entry=0x7fffffff80e0, how=how@entry=OE_FLUSH__TOP, timestamp=timestamp@entry=0) at util/ordered-events.c:323 + #13 0x00005555558a9789 in __ordered_events__flush (timestamp=, how=, oe=) at util/ordered-events.c:339 + #14 ordered_events__flush (how=OE_FLUSH__TOP, oe=0x7fffffff80e0) at util/ordered-events.c:341 + #15 ordered_events__flush (oe=oe@entry=0x7fffffff80e0, how=how@entry=OE_FLUSH__TOP) at util/ordered-events.c:339 + #16 0x00005555557cd631 in process_thread (arg=0x7fffffff7db0) at builtin-top.c:1114 + #17 0x00007ffff7bb817a in start_thread () from /lib64/libpthread.so.0 + #18 0x00007ffff5656dc3 in clone () from /lib64/libc.so.6 + +If you look at the frame #2, the code is: + +488 if (he->srcline) { +489 he->srcline = strdup(he->srcline); +490 if (he->srcline == NULL) +491 goto err_rawdata; +492 } + +If he->srcline is not NULL (it is not NULL if it is uninitialized rubbish), +it gets strdupped and strdupping a rubbish random string causes the problem. + +Also, if you look at the commit 1fb7d06a509e, it adds the srcline property +into the struct, but not initializing it everywhere needed. + +Committer notes: + +Now I see, when using --ignore-callees=do_idle we end up here at line +2189 in add_callchain_ip(): + +2181 if (al.sym != NULL) { +2182 if (perf_hpp_list.parent && !*parent && +2183 symbol__match_regex(al.sym, &parent_regex)) +2184 *parent = al.sym; +2185 else if (have_ignore_callees && root_al && +2186 symbol__match_regex(al.sym, &ignore_callees_regex)) { +2187 /* Treat this symbol as the root, +2188 forgetting its callees. */ +2189 *root_al = al; +2190 callchain_cursor_reset(cursor); +2191 } +2192 } + +And the al that doesn't have the ->srcline field initialized will be +copied to the root_al, so then, back to: + +1211 int hist_entry_iter__add(struct hist_entry_iter *iter, struct addr_location *al, +1212 int max_stack_depth, void *arg) +1213 { +1214 int err, err2; +1215 struct map *alm = NULL; +1216 +1217 if (al) +1218 alm = map__get(al->map); +1219 +1220 err = sample__resolve_callchain(iter->sample, &callchain_cursor, &iter->parent, +1221 iter->evsel, al, max_stack_depth); +1222 if (err) { +1223 map__put(alm); +1224 return err; +1225 } +1226 +1227 err = iter->ops->prepare_entry(iter, al); +1228 if (err) +1229 goto out; +1230 +1231 err = iter->ops->add_single_entry(iter, al); +1232 if (err) +1233 goto out; +1234 + +That al at line 1221 is what hist_entry_iter__add() (called from +sample__resolve_callchain()) saw as 'root_al', and then: + + iter->ops->add_single_entry(iter, al); + +will go on with al->srcline with a bogus value, I'll add the above +sequence to the cset and apply, thanks! + +Signed-off-by: Michael Petlan +CC: Milian Wolff +Cc: Jiri Olsa +Fixes: 1fb7d06a509e ("perf report Use srcline from callchain for hist entries") +Link: https //lore.kernel.org/r/20210719145332.29747-1-mpetlan@redhat.com +Reported-by: Juri Lelli +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/machine.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/tools/perf/util/machine.c ++++ b/tools/perf/util/machine.c +@@ -2149,6 +2149,7 @@ static int add_callchain_ip(struct threa + + al.filtered = 0; + al.sym = NULL; ++ al.srcline = NULL; + if (!cpumode) { + thread__find_cpumode_addr_location(thread, ip, &al); + } else { diff --git a/queue-5.14/ptp-dp83640-don-t-define-page0.patch b/queue-5.14/ptp-dp83640-don-t-define-page0.patch new file mode 100644 index 00000000000..6f7797f82b4 --- /dev/null +++ b/queue-5.14/ptp-dp83640-don-t-define-page0.patch @@ -0,0 +1,46 @@ +From 7366c23ff492ad260776a3ee1aaabba9fc773a8b Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Mon, 13 Sep 2021 15:06:05 -0700 +Subject: ptp: dp83640: don't define PAGE0 + +From: Randy Dunlap + +commit 7366c23ff492ad260776a3ee1aaabba9fc773a8b upstream. + +Building dp83640.c on arch/parisc/ produces a build warning for +PAGE0 being redefined. Since the macro is not used in the dp83640 +driver, just make it a comment for documentation purposes. + +In file included from ../drivers/net/phy/dp83640.c:23: +../drivers/net/phy/dp83640_reg.h:8: warning: "PAGE0" redefined + 8 | #define PAGE0 0x0000 + from ../drivers/net/phy/dp83640.c:11: +../arch/parisc/include/asm/page.h:187: note: this is the location of the previous definition + 187 | #define PAGE0 ((struct zeropage *)__PAGE_OFFSET) + +Fixes: cb646e2b02b2 ("ptp: Added a clock driver for the National Semiconductor PHYTER.") +Signed-off-by: Randy Dunlap +Reported-by: Geert Uytterhoeven +Cc: Richard Cochran +Cc: John Stultz +Cc: Heiner Kallweit +Cc: Russell King +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20210913220605.19682-1-rdunlap@infradead.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/dp83640_reg.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/phy/dp83640_reg.h ++++ b/drivers/net/phy/dp83640_reg.h +@@ -5,7 +5,7 @@ + #ifndef HAVE_DP83640_REGISTERS + #define HAVE_DP83640_REGISTERS + +-#define PAGE0 0x0000 ++/* #define PAGE0 0x0000 */ + #define PHYCR2 0x001c /* PHY Control Register 2 */ + + #define PAGE4 0x0004 diff --git a/queue-5.14/r6040-restore-mdio-clock-frequency-after-mac-reset.patch b/queue-5.14/r6040-restore-mdio-clock-frequency-after-mac-reset.patch new file mode 100644 index 00000000000..c8f5d3b52a8 --- /dev/null +++ b/queue-5.14/r6040-restore-mdio-clock-frequency-after-mac-reset.patch @@ -0,0 +1,73 @@ +From e3f0cc1a945fcefec0c7c9d9dfd028a51daa1846 Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Thu, 9 Sep 2021 10:33:28 -0700 +Subject: r6040: Restore MDIO clock frequency after MAC reset + +From: Florian Fainelli + +commit e3f0cc1a945fcefec0c7c9d9dfd028a51daa1846 upstream. + +A number of users have reported that they were not able to get the PHY +to successfully link up, especially after commit c36757eb9dee ("net: +phy: consider AN_RESTART status when reading link status") where we +stopped reading just BMSR, but we also read BMCR to determine the link +status. + +Andrius at NetBSD did a wonderful job at debugging the problem +and found out that the MDIO bus clock frequency would be incorrectly set +back to its default value which would prevent the MDIO bus controller +from reading PHY registers properly. Back when we only read BMSR, if we +read all 1s, we could falsely indicate a link status, though in general +there is a cable plugged in, so this went unnoticed. After a second read +of BMCR was added, a wrong read will lead to the inability to determine +a link UP condition which is when it started to be visibly broken, even +if it was long before that. + +The fix consists in restoring the value of the MD_CSR register that was +set prior to the MAC reset. + +Link: http://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=53494 +Fixes: 90f750a81a29 ("r6040: consolidate MAC reset to its own function") +Reported-by: Andrius V +Reported-by: Darek Strugacz +Tested-by: Darek Strugacz +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/rdc/r6040.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/rdc/r6040.c ++++ b/drivers/net/ethernet/rdc/r6040.c +@@ -119,6 +119,8 @@ + #define PHY_ST 0x8A /* PHY status register */ + #define MAC_SM 0xAC /* MAC status machine */ + #define MAC_SM_RST 0x0002 /* MAC status machine reset */ ++#define MD_CSC 0xb6 /* MDC speed control register */ ++#define MD_CSC_DEFAULT 0x0030 + #define MAC_ID 0xBE /* Identifier register */ + + #define TX_DCNT 0x80 /* TX descriptor count */ +@@ -355,8 +357,9 @@ static void r6040_reset_mac(struct r6040 + { + void __iomem *ioaddr = lp->base; + int limit = MAC_DEF_TIMEOUT; +- u16 cmd; ++ u16 cmd, md_csc; + ++ md_csc = ioread16(ioaddr + MD_CSC); + iowrite16(MAC_RST, ioaddr + MCR1); + while (limit--) { + cmd = ioread16(ioaddr + MCR1); +@@ -368,6 +371,10 @@ static void r6040_reset_mac(struct r6040 + iowrite16(MAC_SM_RST, ioaddr + MAC_SM); + iowrite16(0, ioaddr + MAC_SM); + mdelay(5); ++ ++ /* Restore MDIO clock frequency */ ++ if (md_csc != MD_CSC_DEFAULT) ++ iowrite16(md_csc, ioaddr + MD_CSC); + } + + static void r6040_init_mac_regs(struct net_device *dev) diff --git a/queue-5.14/rtc-cmos-disable-irq-around-direct-invocation-of-cmos_interrupt.patch b/queue-5.14/rtc-cmos-disable-irq-around-direct-invocation-of-cmos_interrupt.patch new file mode 100644 index 00000000000..830ef4e4c5e --- /dev/null +++ b/queue-5.14/rtc-cmos-disable-irq-around-direct-invocation-of-cmos_interrupt.patch @@ -0,0 +1,144 @@ +From 13be2efc390acd2a46a69a359f6efc00ca434599 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Fri, 5 Mar 2021 12:21:40 +0000 +Subject: rtc: cmos: Disable irq around direct invocation of cmos_interrupt() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chris Wilson + +commit 13be2efc390acd2a46a69a359f6efc00ca434599 upstream. + +As previously noted in commit 66e4f4a9cc38 ("rtc: cmos: Use +spin_lock_irqsave() in cmos_interrupt()"): + +<4>[ 254.192378] WARNING: inconsistent lock state +<4>[ 254.192384] 5.12.0-rc1-CI-CI_DRM_9834+ #1 Not tainted +<4>[ 254.192396] -------------------------------- +<4>[ 254.192400] inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. +<4>[ 254.192409] rtcwake/5309 [HC0[0]:SC0[0]:HE1:SE1] takes: +<4>[ 254.192429] ffffffff8263c5f8 (rtc_lock){?...}-{2:2}, at: cmos_interrupt+0x18/0x100 +<4>[ 254.192481] {IN-HARDIRQ-W} state was registered at: +<4>[ 254.192488] lock_acquire+0xd1/0x3d0 +<4>[ 254.192504] _raw_spin_lock+0x2a/0x40 +<4>[ 254.192519] cmos_interrupt+0x18/0x100 +<4>[ 254.192536] rtc_handler+0x1f/0xc0 +<4>[ 254.192553] acpi_ev_fixed_event_detect+0x109/0x13c +<4>[ 254.192574] acpi_ev_sci_xrupt_handler+0xb/0x28 +<4>[ 254.192596] acpi_irq+0x13/0x30 +<4>[ 254.192620] __handle_irq_event_percpu+0x43/0x2c0 +<4>[ 254.192641] handle_irq_event_percpu+0x2b/0x70 +<4>[ 254.192661] handle_irq_event+0x2f/0x50 +<4>[ 254.192680] handle_fasteoi_irq+0x9e/0x150 +<4>[ 254.192693] __common_interrupt+0x76/0x140 +<4>[ 254.192715] common_interrupt+0x96/0xc0 +<4>[ 254.192732] asm_common_interrupt+0x1e/0x40 +<4>[ 254.192750] _raw_spin_unlock_irqrestore+0x38/0x60 +<4>[ 254.192767] resume_irqs+0xba/0xf0 +<4>[ 254.192786] dpm_resume_noirq+0x245/0x3d0 +<4>[ 254.192811] suspend_devices_and_enter+0x230/0xaa0 +<4>[ 254.192835] pm_suspend.cold.8+0x301/0x34a +<4>[ 254.192859] state_store+0x7b/0xe0 +<4>[ 254.192879] kernfs_fop_write_iter+0x11d/0x1c0 +<4>[ 254.192899] new_sync_write+0x11d/0x1b0 +<4>[ 254.192916] vfs_write+0x265/0x390 +<4>[ 254.192933] ksys_write+0x5a/0xd0 +<4>[ 254.192949] do_syscall_64+0x33/0x80 +<4>[ 254.192965] entry_SYSCALL_64_after_hwframe+0x44/0xae +<4>[ 254.192986] irq event stamp: 43775 +<4>[ 254.192994] hardirqs last enabled at (43775): [] asm_sysvec_apic_timer_interrupt+0x12/0x20 +<4>[ 254.193023] hardirqs last disabled at (43774): [] sysvec_apic_timer_interrupt+0xa/0xb0 +<4>[ 254.193049] softirqs last enabled at (42548): [] __do_softirq+0x342/0x48e +<4>[ 254.193074] softirqs last disabled at (42543): [] irq_exit_rcu+0xad/0xd0 +<4>[ 254.193101] + other info that might help us debug this: +<4>[ 254.193107] Possible unsafe locking scenario: + +<4>[ 254.193112] CPU0 +<4>[ 254.193117] ---- +<4>[ 254.193121] lock(rtc_lock); +<4>[ 254.193137] +<4>[ 254.193142] lock(rtc_lock); +<4>[ 254.193156] + *** DEADLOCK *** + +<4>[ 254.193161] 6 locks held by rtcwake/5309: +<4>[ 254.193174] #0: ffff888104861430 (sb_writers#5){.+.+}-{0:0}, at: ksys_write+0x5a/0xd0 +<4>[ 254.193232] #1: ffff88810f823288 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0xe7/0x1c0 +<4>[ 254.193282] #2: ffff888100cef3c0 (kn->active#285 +<7>[ 254.192706] i915 0000:00:02.0: [drm:intel_modeset_setup_hw_state [i915]] [CRTC:51:pipe A] hw state readout: disabled +<4>[ 254.193307] ){.+.+}-{0:0}, at: kernfs_fop_write_iter+0xf0/0x1c0 +<4>[ 254.193333] #3: ffffffff82649fa8 (system_transition_mutex){+.+.}-{3:3}, at: pm_suspend.cold.8+0xce/0x34a +<4>[ 254.193387] #4: ffffffff827a2108 (acpi_scan_lock){+.+.}-{3:3}, at: acpi_suspend_begin+0x47/0x70 +<4>[ 254.193433] #5: ffff8881019ea178 (&dev->mutex){....}-{3:3}, at: device_resume+0x68/0x1e0 +<4>[ 254.193485] + stack backtrace: +<4>[ 254.193492] CPU: 1 PID: 5309 Comm: rtcwake Not tainted 5.12.0-rc1-CI-CI_DRM_9834+ #1 +<4>[ 254.193514] Hardware name: Google Soraka/Soraka, BIOS MrChromebox-4.10 08/25/2019 +<4>[ 254.193524] Call Trace: +<4>[ 254.193536] dump_stack+0x7f/0xad +<4>[ 254.193567] mark_lock.part.47+0x8ca/0xce0 +<4>[ 254.193604] __lock_acquire+0x39b/0x2590 +<4>[ 254.193626] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 +<4>[ 254.193660] lock_acquire+0xd1/0x3d0 +<4>[ 254.193677] ? cmos_interrupt+0x18/0x100 +<4>[ 254.193716] _raw_spin_lock+0x2a/0x40 +<4>[ 254.193735] ? cmos_interrupt+0x18/0x100 +<4>[ 254.193758] cmos_interrupt+0x18/0x100 +<4>[ 254.193785] cmos_resume+0x2ac/0x2d0 +<4>[ 254.193813] ? acpi_pm_set_device_wakeup+0x1f/0x110 +<4>[ 254.193842] ? pnp_bus_suspend+0x10/0x10 +<4>[ 254.193864] pnp_bus_resume+0x5e/0x90 +<4>[ 254.193885] dpm_run_callback+0x5f/0x240 +<4>[ 254.193914] device_resume+0xb2/0x1e0 +<4>[ 254.193942] ? pm_dev_err+0x25/0x25 +<4>[ 254.193974] dpm_resume+0xea/0x3f0 +<4>[ 254.194005] dpm_resume_end+0x8/0x10 +<4>[ 254.194030] suspend_devices_and_enter+0x29b/0xaa0 +<4>[ 254.194066] pm_suspend.cold.8+0x301/0x34a +<4>[ 254.194094] state_store+0x7b/0xe0 +<4>[ 254.194124] kernfs_fop_write_iter+0x11d/0x1c0 +<4>[ 254.194151] new_sync_write+0x11d/0x1b0 +<4>[ 254.194183] vfs_write+0x265/0x390 +<4>[ 254.194207] ksys_write+0x5a/0xd0 +<4>[ 254.194232] do_syscall_64+0x33/0x80 +<4>[ 254.194251] entry_SYSCALL_64_after_hwframe+0x44/0xae +<4>[ 254.194274] RIP: 0033:0x7f07d79691e7 +<4>[ 254.194293] Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 +<4>[ 254.194312] RSP: 002b:00007ffd9cc2c768 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 +<4>[ 254.194337] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f07d79691e7 +<4>[ 254.194352] RDX: 0000000000000004 RSI: 0000556ebfc63590 RDI: 000000000000000b +<4>[ 254.194366] RBP: 0000556ebfc63590 R08: 0000000000000000 R09: 0000000000000004 +<4>[ 254.194379] R10: 0000556ebf0ec2a6 R11: 0000000000000246 R12: 0000000000000004 + +which breaks S3-resume on fi-kbl-soraka presumably as that's slow enough +to trigger the alarm during the suspend. + +Fixes: 6950d046eb6e ("rtc: cmos: Replace spin_lock_irqsave with spin_lock in hard IRQ") +References: 66e4f4a9cc38 ("rtc: cmos: Use spin_lock_irqsave() in cmos_interrupt()"): +Signed-off-by: Chris Wilson +Cc: Xiaofei Tan +Cc: Alexandre Belloni +Cc: Alessandro Zummo +Cc: Ville Syrjälä +Reviewed-by: Ville Syrjälä +Signed-off-by: Alexandre Belloni +Link: https://lore.kernel.org/r/20210305122140.28774-1-chris@chris-wilson.co.uk +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/rtc-cmos.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -1053,7 +1053,9 @@ static void cmos_check_wkalrm(struct dev + * ACK the rtc irq here + */ + if (t_now >= cmos->alarm_expires && cmos_use_acpi_alarm()) { ++ local_irq_disable(); + cmos_interrupt(0, (void *)cmos->rtc); ++ local_irq_enable(); + return; + } + diff --git a/queue-5.14/series b/queue-5.14/series index 4d7a706408e..9ffa874e4ad 100644 --- a/queue-5.14/series +++ b/queue-5.14/series @@ -38,3 +38,19 @@ tipc-fix-an-use-after-free-issue-in-tipc_recvmsg.patch ethtool-fix-rxnfc-copy-to-user-buffer-overflow.patch net-remove-the-unnecessary-check-in-cipso_v4_doi_free.patch net-mlx5-nfp-bnxt-remove-unnecessary-rtnl-lock-assert.patch +net-caif-avoid-user-triggerable-warn_on-1.patch +ptp-dp83640-don-t-define-page0.patch +dccp-don-t-duplicate-ccid-when-cloning-dccp-sock.patch +net-l2tp-fix-reference-count-leak-in-l2tp_udp_recv_core.patch +parisc-declare-pci_iounmap-parisc-version-only-when-config_pci-enabled.patch +r6040-restore-mdio-clock-frequency-after-mac-reset.patch +tipc-increase-timeout-in-tipc_sk_enqueue.patch +drm-rockchip-cdn-dp-core-make-cdn_dp_core_resume-__maybe_unused.patch +rtc-cmos-disable-irq-around-direct-invocation-of-cmos_interrupt.patch +drm-i915-dp-return-proper-dprx-link-training-result.patch +perf-machine-initialize-srcline-string-member-in-add_location-struct.patch +net-mlx5-fwtrace-cancel-work-on-alloc-pd-error-flow.patch +net-mlx5-fix-potential-sleeping-in-atomic-context.patch +net-stmmac-fix-system-hang-caused-by-eee_ctrl_timer-during-suspend-resume.patch +igc-fix-tunnel-offloading.patch +nvme-tcp-fix-io_work-priority-inversion.patch diff --git a/queue-5.14/tipc-increase-timeout-in-tipc_sk_enqueue.patch b/queue-5.14/tipc-increase-timeout-in-tipc_sk_enqueue.patch new file mode 100644 index 00000000000..a0330918fd1 --- /dev/null +++ b/queue-5.14/tipc-increase-timeout-in-tipc_sk_enqueue.patch @@ -0,0 +1,39 @@ +From f4bb62e64c88c93060c051195d3bbba804e56945 Mon Sep 17 00:00:00 2001 +From: Hoang Le +Date: Mon, 13 Sep 2021 16:28:52 +0700 +Subject: tipc: increase timeout in tipc_sk_enqueue() + +From: Hoang Le + +commit f4bb62e64c88c93060c051195d3bbba804e56945 upstream. + +In tipc_sk_enqueue() we use hardcoded 2 jiffies to extract +socket buffer from generic queue to particular socket. +The 2 jiffies is too short in case there are other high priority +tasks get CPU cycles for multiple jiffies update. As result, no +buffer could be enqueued to particular socket. + +To solve this, we switch to use constant timeout 20msecs. +Then, the function will be expired between 2 jiffies (CONFIG_100HZ) +and 20 jiffies (CONFIG_1000HZ). + +Fixes: c637c1035534 ("tipc: resolve race problem at unicast message reception") +Acked-by: Jon Maloy +Signed-off-by: Hoang Le +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/tipc/socket.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -2423,7 +2423,7 @@ static int tipc_sk_backlog_rcv(struct so + static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk, + u32 dport, struct sk_buff_head *xmitq) + { +- unsigned long time_limit = jiffies + 2; ++ unsigned long time_limit = jiffies + usecs_to_jiffies(20000); + struct sk_buff *skb; + unsigned int lim; + atomic_t *dcnt;