From: Sasha Levin Date: Sun, 28 Mar 2021 03:51:21 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v5.11.11~57 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fb96ac961a2346aeb10c0ec59bdf2dac71345bde;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/arm-dts-imx6ull-fix-ubi-filesystem-mount-failed.patch b/queue-5.10/arm-dts-imx6ull-fix-ubi-filesystem-mount-failed.patch new file mode 100644 index 00000000000..dcc04b316df --- /dev/null +++ b/queue-5.10/arm-dts-imx6ull-fix-ubi-filesystem-mount-failed.patch @@ -0,0 +1,49 @@ +From 4f7c7f51441c54d6ea77583f8b8aba0a268eceab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 23:45:09 +0800 +Subject: ARM: dts: imx6ull: fix ubi filesystem mount failed + +From: dillon min + +[ Upstream commit e4817a1b6b77db538bc0141c3b138f2df803ce87 ] + +For NAND Ecc layout, there is a dependency from old kernel's nand driver +setting and current. if old kernel use 4 bit ecc , we should use 4 bit +in new kernel either. else will run into following error at filesystem +mounting. + +So, enable fsl,use-minimum-ecc from device tree, to fix this mismatch + +[ 9.449265] ubi0: scanning is finished +[ 9.463968] ubi0 warning: ubi_io_read: error -74 (ECC error) while reading +22528 bytes from PEB 513:4096, read only 22528 bytes, retry +[ 9.486940] ubi0 warning: ubi_io_read: error -74 (ECC error) while reading +22528 bytes from PEB 513:4096, read only 22528 bytes, retry +[ 9.509906] ubi0 warning: ubi_io_read: error -74 (ECC error) while reading +22528 bytes from PEB 513:4096, read only 22528 bytes, retry +[ 9.532845] ubi0 error: ubi_io_read: error -74 (ECC error) while reading +22528 bytes from PEB 513:4096, read 22528 bytes + +Fixes: f9ecf10cb88c ("ARM: dts: imx6ull: add MYiR MYS-6ULX SBC") +Signed-off-by: dillon min +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6ull-myir-mys-6ulx-eval.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/imx6ull-myir-mys-6ulx-eval.dts b/arch/arm/boot/dts/imx6ull-myir-mys-6ulx-eval.dts +index ecbb2cc5b9ab..79cc45728cd2 100644 +--- a/arch/arm/boot/dts/imx6ull-myir-mys-6ulx-eval.dts ++++ b/arch/arm/boot/dts/imx6ull-myir-mys-6ulx-eval.dts +@@ -14,5 +14,6 @@ + }; + + &gpmi { ++ fsl,use-minimum-ecc; + status = "okay"; + }; +-- +2.30.1 + diff --git a/queue-5.10/arm-omap2-fix-smartreflex-init-regression-after-drop.patch b/queue-5.10/arm-omap2-fix-smartreflex-init-regression-after-drop.patch new file mode 100644 index 00000000000..d378fd471fe --- /dev/null +++ b/queue-5.10/arm-omap2-fix-smartreflex-init-regression-after-drop.patch @@ -0,0 +1,162 @@ +From 5892ae66c5f7013f439402584fad4ffaff5ab48d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Feb 2021 10:53:48 +0200 +Subject: ARM: OMAP2+: Fix smartreflex init regression after dropping legacy + data + +From: Tony Lindgren + +[ Upstream commit fbfa463be8dc7957ee4f81556e9e1ea2a951807d ] + +When I dropped legacy data for omap4 and dra7 smartreflex in favor of +device tree based data, it seems I only testd for the "SmartReflex Class3 +initialized" line in dmesg. I missed the fact that there is also +omap_devinit_smartreflex() that happens later, and now it produces an +error on boot for "No Voltage table for the corresponding vdd. Cannot +create debugfs entries for n-values". + +This happens as we no longer have the smartreflex instance legacy data, +and have not yet moved completely to device tree based booting for the +driver. Let's fix the issue by changing the smartreflex init to use names. +This should all eventually go away in favor of doing the init in the +driver based on devicetree compatible value. + +Note that dra7xx_init_early() is not calling any voltage domain init like +omap54xx_voltagedomains_init(), or a dra7 specific voltagedomains init. +This means that on dra7 smartreflex is still not fully initialized, and +also seems to be missing the related devicetree nodes. + +Fixes: a6b1e717e942 ("ARM: OMAP2+: Drop legacy platform data for omap4 smartreflex") +Fixes: e54740b4afe8 ("ARM: OMAP2+: Drop legacy platform data for dra7 smartreflex") +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/sr_device.c | 75 +++++++++++++++++++++++++-------- + 1 file changed, 58 insertions(+), 17 deletions(-) + +diff --git a/arch/arm/mach-omap2/sr_device.c b/arch/arm/mach-omap2/sr_device.c +index 62df666c2bd0..17b66f0d0dee 100644 +--- a/arch/arm/mach-omap2/sr_device.c ++++ b/arch/arm/mach-omap2/sr_device.c +@@ -88,34 +88,26 @@ static void __init sr_set_nvalues(struct omap_volt_data *volt_data, + + extern struct omap_sr_data omap_sr_pdata[]; + +-static int __init sr_dev_init(struct omap_hwmod *oh, void *user) ++static int __init sr_init_by_name(const char *name, const char *voltdm) + { + struct omap_sr_data *sr_data = NULL; + struct omap_volt_data *volt_data; +- struct omap_smartreflex_dev_attr *sr_dev_attr; + static int i; + +- if (!strncmp(oh->name, "smartreflex_mpu_iva", 20) || +- !strncmp(oh->name, "smartreflex_mpu", 16)) ++ if (!strncmp(name, "smartreflex_mpu_iva", 20) || ++ !strncmp(name, "smartreflex_mpu", 16)) + sr_data = &omap_sr_pdata[OMAP_SR_MPU]; +- else if (!strncmp(oh->name, "smartreflex_core", 17)) ++ else if (!strncmp(name, "smartreflex_core", 17)) + sr_data = &omap_sr_pdata[OMAP_SR_CORE]; +- else if (!strncmp(oh->name, "smartreflex_iva", 16)) ++ else if (!strncmp(name, "smartreflex_iva", 16)) + sr_data = &omap_sr_pdata[OMAP_SR_IVA]; + + if (!sr_data) { +- pr_err("%s: Unknown instance %s\n", __func__, oh->name); ++ pr_err("%s: Unknown instance %s\n", __func__, name); + return -EINVAL; + } + +- sr_dev_attr = (struct omap_smartreflex_dev_attr *)oh->dev_attr; +- if (!sr_dev_attr || !sr_dev_attr->sensor_voltdm_name) { +- pr_err("%s: No voltage domain specified for %s. Cannot initialize\n", +- __func__, oh->name); +- goto exit; +- } +- +- sr_data->name = oh->name; ++ sr_data->name = name; + if (cpu_is_omap343x()) + sr_data->ip_type = 1; + else +@@ -136,10 +128,10 @@ static int __init sr_dev_init(struct omap_hwmod *oh, void *user) + } + } + +- sr_data->voltdm = voltdm_lookup(sr_dev_attr->sensor_voltdm_name); ++ sr_data->voltdm = voltdm_lookup(voltdm); + if (!sr_data->voltdm) { + pr_err("%s: Unable to get voltage domain pointer for VDD %s\n", +- __func__, sr_dev_attr->sensor_voltdm_name); ++ __func__, voltdm); + goto exit; + } + +@@ -160,6 +152,20 @@ exit: + return 0; + } + ++static int __init sr_dev_init(struct omap_hwmod *oh, void *user) ++{ ++ struct omap_smartreflex_dev_attr *sr_dev_attr; ++ ++ sr_dev_attr = (struct omap_smartreflex_dev_attr *)oh->dev_attr; ++ if (!sr_dev_attr || !sr_dev_attr->sensor_voltdm_name) { ++ pr_err("%s: No voltage domain specified for %s. Cannot initialize\n", ++ __func__, oh->name); ++ return 0; ++ } ++ ++ return sr_init_by_name(oh->name, sr_dev_attr->sensor_voltdm_name); ++} ++ + /* + * API to be called from board files to enable smartreflex + * autocompensation at init. +@@ -169,7 +175,42 @@ void __init omap_enable_smartreflex_on_init(void) + sr_enable_on_init = true; + } + ++static const char * const omap4_sr_instances[] = { ++ "mpu", ++ "iva", ++ "core", ++}; ++ ++static const char * const dra7_sr_instances[] = { ++ "mpu", ++ "core", ++}; ++ + int __init omap_devinit_smartreflex(void) + { ++ const char * const *sr_inst; ++ int i, nr_sr = 0; ++ ++ if (soc_is_omap44xx()) { ++ sr_inst = omap4_sr_instances; ++ nr_sr = ARRAY_SIZE(omap4_sr_instances); ++ ++ } else if (soc_is_dra7xx()) { ++ sr_inst = dra7_sr_instances; ++ nr_sr = ARRAY_SIZE(dra7_sr_instances); ++ } ++ ++ if (nr_sr) { ++ const char *name, *voltdm; ++ ++ for (i = 0; i < nr_sr; i++) { ++ name = kasprintf(GFP_KERNEL, "smartreflex_%s", sr_inst[i]); ++ voltdm = sr_inst[i]; ++ sr_init_by_name(name, voltdm); ++ } ++ ++ return 0; ++ } ++ + return omap_hwmod_for_each_by_class("smartreflex", sr_dev_init, NULL); + } +-- +2.30.1 + diff --git a/queue-5.10/arm64-kdump-update-ppos-when-reading-elfcorehdr.patch b/queue-5.10/arm64-kdump-update-ppos-when-reading-elfcorehdr.patch new file mode 100644 index 00000000000..3039d6be65c --- /dev/null +++ b/queue-5.10/arm64-kdump-update-ppos-when-reading-elfcorehdr.patch @@ -0,0 +1,40 @@ +From 58126b6df9dc56c36a94614ec3ce1b21676ad810 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 16:50:54 -0400 +Subject: arm64: kdump: update ppos when reading elfcorehdr + +From: Pavel Tatashin + +[ Upstream commit 141f8202cfa4192c3af79b6cbd68e7760bb01b5a ] + +The ppos points to a position in the old kernel memory (and in case of +arm64 in the crash kernel since elfcorehdr is passed as a segment). The +function should update the ppos by the amount that was read. This bug is +not exposed by accident, but other platforms update this value properly. +So, fix it in ARM64 version of elfcorehdr_read() as well. + +Signed-off-by: Pavel Tatashin +Fixes: e62aaeac426a ("arm64: kdump: provide /proc/vmcore file") +Reviewed-by: Tyler Hicks +Link: https://lore.kernel.org/r/20210319205054.743368-1-pasha.tatashin@soleen.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/crash_dump.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/kernel/crash_dump.c b/arch/arm64/kernel/crash_dump.c +index e6e284265f19..58303a9ec32c 100644 +--- a/arch/arm64/kernel/crash_dump.c ++++ b/arch/arm64/kernel/crash_dump.c +@@ -64,5 +64,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf, + ssize_t elfcorehdr_read(char *buf, size_t count, u64 *ppos) + { + memcpy(buf, phys_to_virt((phys_addr_t)*ppos), count); ++ *ppos += count; ++ + return count; + } +-- +2.30.1 + diff --git a/queue-5.10/arm64-mm-correct-the-inside-linear-map-range-during-.patch b/queue-5.10/arm64-mm-correct-the-inside-linear-map-range-during-.patch new file mode 100644 index 00000000000..ceb103c607d --- /dev/null +++ b/queue-5.10/arm64-mm-correct-the-inside-linear-map-range-during-.patch @@ -0,0 +1,75 @@ +From 6c0d0d9d497aab248d4dbe61844486545e2bab8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Feb 2021 10:03:51 -0500 +Subject: arm64: mm: correct the inside linear map range during hotplug check + +From: Pavel Tatashin + +[ Upstream commit ee7febce051945be28ad86d16a15886f878204de ] + +Memory hotplug may fail on systems with CONFIG_RANDOMIZE_BASE because the +linear map range is not checked correctly. + +The start physical address that linear map covers can be actually at the +end of the range because of randomization. Check that and if so reduce it +to 0. + +This can be verified on QEMU with setting kaslr-seed to ~0ul: + +memstart_offset_seed = 0xffff +START: __pa(_PAGE_OFFSET(vabits_actual)) = ffff9000c0000000 +END: __pa(PAGE_END - 1) = 1000bfffffff + +Signed-off-by: Pavel Tatashin +Fixes: 58284a901b42 ("arm64/mm: Validate hotplug range before creating linear mapping") +Tested-by: Tyler Hicks +Reviewed-by: Anshuman Khandual +Link: https://lore.kernel.org/r/20210216150351.129018-2-pasha.tatashin@soleen.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/mm/mmu.c | 21 +++++++++++++++++++-- + 1 file changed, 19 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c +index 0635803463a5..10938dbe1f11 100644 +--- a/arch/arm64/mm/mmu.c ++++ b/arch/arm64/mm/mmu.c +@@ -1448,6 +1448,22 @@ static void __remove_pgd_mapping(pgd_t *pgdir, unsigned long start, u64 size) + struct range arch_get_mappable_range(void) + { + struct range mhp_range; ++ u64 start_linear_pa = __pa(_PAGE_OFFSET(vabits_actual)); ++ u64 end_linear_pa = __pa(PAGE_END - 1); ++ ++ if (IS_ENABLED(CONFIG_RANDOMIZE_BASE)) { ++ /* ++ * Check for a wrap, it is possible because of randomized linear ++ * mapping the start physical address is actually bigger than ++ * the end physical address. In this case set start to zero ++ * because [0, end_linear_pa] range must still be able to cover ++ * all addressable physical addresses. ++ */ ++ if (start_linear_pa > end_linear_pa) ++ start_linear_pa = 0; ++ } ++ ++ WARN_ON(start_linear_pa > end_linear_pa); + + /* + * Linear mapping region is the range [PAGE_OFFSET..(PAGE_END - 1)] +@@ -1455,8 +1471,9 @@ struct range arch_get_mappable_range(void) + * range which can be mapped inside this linear mapping range, must + * also be derived from its end points. + */ +- mhp_range.start = __pa(_PAGE_OFFSET(vabits_actual)); +- mhp_range.end = __pa(PAGE_END - 1); ++ mhp_range.start = start_linear_pa; ++ mhp_range.end = end_linear_pa; ++ + return mhp_range; + } + +-- +2.30.1 + diff --git a/queue-5.10/arm64-mm-define-arch_get_mappable_range.patch b/queue-5.10/arm64-mm-define-arch_get_mappable_range.patch new file mode 100644 index 00000000000..46f1aa2567a --- /dev/null +++ b/queue-5.10/arm64-mm-define-arch_get_mappable_range.patch @@ -0,0 +1,83 @@ +From 300406ce621b676cd95235171c5ea67ee0468293 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 17:17:37 -0800 +Subject: arm64/mm: define arch_get_mappable_range() + +From: Anshuman Khandual + +[ Upstream commit 03aaf83fba6e5af08b5dd174c72edee9b7d9ed9b ] + +This overrides arch_get_mappable_range() on arm64 platform which will be +used with recently added generic framework. It drops +inside_linear_region() and subsequent check in arch_add_memory() which are +no longer required. It also adds a VM_BUG_ON() check that would ensure +that mhp_range_allowed() has already been called. + +Link: https://lkml.kernel.org/r/1612149902-7867-3-git-send-email-anshuman.khandual@arm.com +Signed-off-by: Anshuman Khandual +Reviewed-by: David Hildenbrand +Reviewed-by: Catalin Marinas +Cc: Will Deacon +Cc: Ard Biesheuvel +Cc: Mark Rutland +Cc: Heiko Carstens +Cc: Jason Wang +Cc: Jonathan Cameron +Cc: "Michael S. Tsirkin" +Cc: Michal Hocko +Cc: Oscar Salvador +Cc: Pankaj Gupta +Cc: Pankaj Gupta +Cc: teawater +Cc: Vasily Gorbik +Cc: Wei Yang +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/arm64/mm/mmu.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c +index 6aabf1eced31..0635803463a5 100644 +--- a/arch/arm64/mm/mmu.c ++++ b/arch/arm64/mm/mmu.c +@@ -1445,16 +1445,19 @@ static void __remove_pgd_mapping(pgd_t *pgdir, unsigned long start, u64 size) + free_empty_tables(start, end, PAGE_OFFSET, PAGE_END); + } + +-static bool inside_linear_region(u64 start, u64 size) ++struct range arch_get_mappable_range(void) + { ++ struct range mhp_range; ++ + /* + * Linear mapping region is the range [PAGE_OFFSET..(PAGE_END - 1)] + * accommodating both its ends but excluding PAGE_END. Max physical + * range which can be mapped inside this linear mapping range, must + * also be derived from its end points. + */ +- return start >= __pa(_PAGE_OFFSET(vabits_actual)) && +- (start + size - 1) <= __pa(PAGE_END - 1); ++ mhp_range.start = __pa(_PAGE_OFFSET(vabits_actual)); ++ mhp_range.end = __pa(PAGE_END - 1); ++ return mhp_range; + } + + int arch_add_memory(int nid, u64 start, u64 size, +@@ -1462,11 +1465,7 @@ int arch_add_memory(int nid, u64 start, u64 size, + { + int ret, flags = 0; + +- if (!inside_linear_region(start, size)) { +- pr_err("[%llx %llx] is outside linear mapping region\n", start, start + size); +- return -EINVAL; +- } +- ++ VM_BUG_ON(!mhp_range_allowed(start, size, true)); + if (rodata_full || debug_pagealloc_enabled()) + flags = NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS; + +-- +2.30.1 + diff --git a/queue-5.10/bpf-change-inode_storage-s-lookup_elem-return-value-.patch b/queue-5.10/bpf-change-inode_storage-s-lookup_elem-return-value-.patch new file mode 100644 index 00000000000..57fc69af3a7 --- /dev/null +++ b/queue-5.10/bpf-change-inode_storage-s-lookup_elem-return-value-.patch @@ -0,0 +1,43 @@ +From 25d97a19a20f01cfe2cadf0ca2fe35c562c1f4a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Mar 2021 14:09:48 +0200 +Subject: bpf: Change inode_storage's lookup_elem return value from NULL to + -EBADF + +From: Tal Lossos + +[ Upstream commit 769c18b254ca191b45047e1fcb3b2ce56fada0b6 ] + +bpf_fd_inode_storage_lookup_elem() returned NULL when getting a bad FD, +which caused -ENOENT in bpf_map_copy_value. -EBADF error is better than +-ENOENT for a bad FD behaviour. + +The patch was partially contributed by CyberArk Software, Inc. + +Fixes: 8ea636848aca ("bpf: Implement bpf_local_storage for inodes") +Signed-off-by: Tal Lossos +Signed-off-by: Daniel Borkmann +Acked-by: Yonghong Song +Acked-by: KP Singh +Link: https://lore.kernel.org/bpf/20210307120948.61414-1-tallossos@gmail.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/bpf_inode_storage.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/bpf/bpf_inode_storage.c b/kernel/bpf/bpf_inode_storage.c +index c2a501cd90eb..a4ac48c7dada 100644 +--- a/kernel/bpf/bpf_inode_storage.c ++++ b/kernel/bpf/bpf_inode_storage.c +@@ -109,7 +109,7 @@ static void *bpf_fd_inode_storage_lookup_elem(struct bpf_map *map, void *key) + fd = *(int *)key; + f = fget_raw(fd); + if (!f) +- return NULL; ++ return ERR_PTR(-EBADF); + + sdata = inode_storage_lookup(f->f_inode, map, true); + fput(f); +-- +2.30.1 + diff --git a/queue-5.10/bpf-don-t-do-bpf_cgroup_storage_set-for-kuprobe-tp-p.patch b/queue-5.10/bpf-don-t-do-bpf_cgroup_storage_set-for-kuprobe-tp-p.patch new file mode 100644 index 00000000000..612b34a883d --- /dev/null +++ b/queue-5.10/bpf-don-t-do-bpf_cgroup_storage_set-for-kuprobe-tp-p.patch @@ -0,0 +1,87 @@ +From bc340339b4e0e5968cb949deaf47b962c88d6fe4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Mar 2021 18:27:53 -0400 +Subject: bpf: Don't do bpf_cgroup_storage_set() for kuprobe/tp programs + +[ Upstream commit 05a68ce5fa51a83c360381630f823545c5757aa2 ] + +For kuprobe and tracepoint bpf programs, kernel calls +trace_call_bpf() which calls BPF_PROG_RUN_ARRAY_CHECK() +to run the program array. Currently, BPF_PROG_RUN_ARRAY_CHECK() +also calls bpf_cgroup_storage_set() to set percpu +cgroup local storage with NULL value. This is +due to Commit 394e40a29788 ("bpf: extend bpf_prog_array to store +pointers to the cgroup storage") which modified +__BPF_PROG_RUN_ARRAY() to call bpf_cgroup_storage_set() +and this macro is also used by BPF_PROG_RUN_ARRAY_CHECK(). + +kuprobe and tracepoint programs are not allowed to call +bpf_get_local_storage() helper hence does not +access percpu cgroup local storage. Let us +change BPF_PROG_RUN_ARRAY_CHECK() not to +modify percpu cgroup local storage. + +The issue is observed when I tried to debug [1] where +percpu data is overwritten due to + preempt_disable -> migration_disable +change. This patch does not completely fix the above issue, +which will be addressed separately, e.g., multiple cgroup +prog runs may preempt each other. But it does fix +any potential issue caused by tracing program +overwriting percpu cgroup storage: + - in a busy system, a tracing program is to run between + bpf_cgroup_storage_set() and the cgroup prog run. + - a kprobe program is triggered by a helper in cgroup prog + before bpf_get_local_storage() is called. + + [1] https://lore.kernel.org/bpf/CAKH8qBuXCfUz=w8L+Fj74OaUpbosO29niYwTki7e3Ag044_aww@mail.gmail.com/T + +Fixes: 394e40a29788 ("bpf: extend bpf_prog_array to store pointers to the cgroup storage") +Signed-off-by: Yonghong Song +Signed-off-by: Alexei Starovoitov +Acked-by: Roman Gushchin +Link: https://lore.kernel.org/bpf/20210309185028.3763817-1-yhs@fb.com +Signed-off-by: Sasha Levin +--- + include/linux/bpf.h | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index 76322b6452c8..dd236ef59db3 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -1059,7 +1059,7 @@ int bpf_prog_array_copy(struct bpf_prog_array *old_array, + struct bpf_prog *include_prog, + struct bpf_prog_array **new_array); + +-#define __BPF_PROG_RUN_ARRAY(array, ctx, func, check_non_null) \ ++#define __BPF_PROG_RUN_ARRAY(array, ctx, func, check_non_null, set_cg_storage) \ + ({ \ + struct bpf_prog_array_item *_item; \ + struct bpf_prog *_prog; \ +@@ -1072,7 +1072,8 @@ int bpf_prog_array_copy(struct bpf_prog_array *old_array, + goto _out; \ + _item = &_array->items[0]; \ + while ((_prog = READ_ONCE(_item->prog))) { \ +- bpf_cgroup_storage_set(_item->cgroup_storage); \ ++ if (set_cg_storage) \ ++ bpf_cgroup_storage_set(_item->cgroup_storage); \ + _ret &= func(_prog, ctx); \ + _item++; \ + } \ +@@ -1133,10 +1134,10 @@ _out: \ + }) + + #define BPF_PROG_RUN_ARRAY(array, ctx, func) \ +- __BPF_PROG_RUN_ARRAY(array, ctx, func, false) ++ __BPF_PROG_RUN_ARRAY(array, ctx, func, false, true) + + #define BPF_PROG_RUN_ARRAY_CHECK(array, ctx, func) \ +- __BPF_PROG_RUN_ARRAY(array, ctx, func, true) ++ __BPF_PROG_RUN_ARRAY(array, ctx, func, true, false) + + #ifdef CONFIG_BPF_SYSCALL + DECLARE_PER_CPU(int, bpf_prog_active); +-- +2.30.1 + diff --git a/queue-5.10/bpf-fix-umd-memory-leak-in-copy_process.patch b/queue-5.10/bpf-fix-umd-memory-leak-in-copy_process.patch new file mode 100644 index 00000000000..a7e641cc367 --- /dev/null +++ b/queue-5.10/bpf-fix-umd-memory-leak-in-copy_process.patch @@ -0,0 +1,141 @@ +From a6506e621791862eefd30b6e688a6260f46366a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 11:09:15 +0800 +Subject: bpf: Fix umd memory leak in copy_process() + +From: Zqiang + +[ Upstream commit f60a85cad677c4f9bb4cadd764f1d106c38c7cf8 ] + +The syzbot reported a memleak as follows: + +BUG: memory leak +unreferenced object 0xffff888101b41d00 (size 120): + comm "kworker/u4:0", pid 8, jiffies 4294944270 (age 12.780s) + backtrace: + [] alloc_pid+0x66/0x560 + [] copy_process+0x1465/0x25e0 + [] kernel_clone+0xf3/0x670 + [] kernel_thread+0x61/0x80 + [] call_usermodehelper_exec_work + [] call_usermodehelper_exec_work+0xc4/0x120 + [] process_one_work+0x2c9/0x600 + [] worker_thread+0x59/0x5d0 + [] kthread+0x178/0x1b0 + [] ret_from_fork+0x1f/0x30 + +unreferenced object 0xffff888110ef5c00 (size 232): + comm "kworker/u4:0", pid 8414, jiffies 4294944270 (age 12.780s) + backtrace: + [] kmem_cache_zalloc + [] __alloc_file+0x1f/0xf0 + [] alloc_empty_file+0x69/0x120 + [] alloc_file+0x33/0x1b0 + [] alloc_file_pseudo+0xb2/0x140 + [] create_pipe_files+0x138/0x2e0 + [] umd_setup+0x33/0x220 + [] call_usermodehelper_exec_async+0xb4/0x1b0 + [] ret_from_fork+0x1f/0x30 + +After the UMD process exits, the pipe_to_umh/pipe_from_umh and +tgid need to be released. + +Fixes: d71fa5c9763c ("bpf: Add kernel module with user mode driver that populates bpffs.") +Reported-by: syzbot+44908bb56d2bfe56b28e@syzkaller.appspotmail.com +Signed-off-by: Zqiang +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20210317030915.2865-1-qiang.zhang@windriver.com +Signed-off-by: Sasha Levin +--- + include/linux/usermode_driver.h | 1 + + kernel/bpf/preload/bpf_preload_kern.c | 19 +++++++++++++++---- + kernel/usermode_driver.c | 21 +++++++++++++++------ + 3 files changed, 31 insertions(+), 10 deletions(-) + +diff --git a/include/linux/usermode_driver.h b/include/linux/usermode_driver.h +index 073a9e0ec07d..ad970416260d 100644 +--- a/include/linux/usermode_driver.h ++++ b/include/linux/usermode_driver.h +@@ -14,5 +14,6 @@ struct umd_info { + int umd_load_blob(struct umd_info *info, const void *data, size_t len); + int umd_unload_blob(struct umd_info *info); + int fork_usermode_driver(struct umd_info *info); ++void umd_cleanup_helper(struct umd_info *info); + + #endif /* __LINUX_USERMODE_DRIVER_H__ */ +diff --git a/kernel/bpf/preload/bpf_preload_kern.c b/kernel/bpf/preload/bpf_preload_kern.c +index 79c5772465f1..53736e52c1df 100644 +--- a/kernel/bpf/preload/bpf_preload_kern.c ++++ b/kernel/bpf/preload/bpf_preload_kern.c +@@ -60,9 +60,12 @@ static int finish(void) + &magic, sizeof(magic), &pos); + if (n != sizeof(magic)) + return -EPIPE; ++ + tgid = umd_ops.info.tgid; +- wait_event(tgid->wait_pidfd, thread_group_exited(tgid)); +- umd_ops.info.tgid = NULL; ++ if (tgid) { ++ wait_event(tgid->wait_pidfd, thread_group_exited(tgid)); ++ umd_cleanup_helper(&umd_ops.info); ++ } + return 0; + } + +@@ -80,10 +83,18 @@ static int __init load_umd(void) + + static void __exit fini_umd(void) + { ++ struct pid *tgid; ++ + bpf_preload_ops = NULL; ++ + /* kill UMD in case it's still there due to earlier error */ +- kill_pid(umd_ops.info.tgid, SIGKILL, 1); +- umd_ops.info.tgid = NULL; ++ tgid = umd_ops.info.tgid; ++ if (tgid) { ++ kill_pid(tgid, SIGKILL, 1); ++ ++ wait_event(tgid->wait_pidfd, thread_group_exited(tgid)); ++ umd_cleanup_helper(&umd_ops.info); ++ } + umd_unload_blob(&umd_ops.info); + } + late_initcall(load_umd); +diff --git a/kernel/usermode_driver.c b/kernel/usermode_driver.c +index 0b35212ffc3d..bb7bb3b478ab 100644 +--- a/kernel/usermode_driver.c ++++ b/kernel/usermode_driver.c +@@ -139,13 +139,22 @@ static void umd_cleanup(struct subprocess_info *info) + struct umd_info *umd_info = info->data; + + /* cleanup if umh_setup() was successful but exec failed */ +- if (info->retval) { +- fput(umd_info->pipe_to_umh); +- fput(umd_info->pipe_from_umh); +- put_pid(umd_info->tgid); +- umd_info->tgid = NULL; +- } ++ if (info->retval) ++ umd_cleanup_helper(umd_info); ++} ++ ++/** ++ * umd_cleanup_helper - release the resources which were allocated in umd_setup ++ * @info: information about usermode driver ++ */ ++void umd_cleanup_helper(struct umd_info *info) ++{ ++ fput(info->pipe_to_umh); ++ fput(info->pipe_from_umh); ++ put_pid(info->tgid); ++ info->tgid = NULL; + } ++EXPORT_SYMBOL_GPL(umd_cleanup_helper); + + /** + * fork_usermode_driver - fork a usermode driver +-- +2.30.1 + diff --git a/queue-5.10/bus-omap_l3_noc-mark-l3-irqs-as-irqf_no_thread.patch b/queue-5.10/bus-omap_l3_noc-mark-l3-irqs-as-irqf_no_thread.patch new file mode 100644 index 00000000000..55ab378fc7d --- /dev/null +++ b/queue-5.10/bus-omap_l3_noc-mark-l3-irqs-as-irqf_no_thread.patch @@ -0,0 +1,51 @@ +From 5a996b959a631a68321b89b262af7ccc9718909f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jan 2021 21:15:48 +0200 +Subject: bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD + +From: Grygorii Strashko + +[ Upstream commit 7d7275b3e866cf8092bd12553ec53ba26864f7bb ] + +The main purpose of l3 IRQs is to catch OCP bus access errors and identify +corresponding code places by showing call stack, so it's important to +handle L3 interconnect errors as fast as possible. On RT these IRQs will +became threaded and will be scheduled much more late from the moment actual +error occurred so showing completely useless information. + +Hence, mark l3 IRQs as IRQF_NO_THREAD so they will not be forced threaded +on RT or if force_irqthreads = true. + +Fixes: 0ee7261c9212 ("drivers: bus: Move the OMAP interconnect driver to drivers/bus/") +Signed-off-by: Grygorii Strashko +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/omap_l3_noc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/bus/omap_l3_noc.c b/drivers/bus/omap_l3_noc.c +index b040447575ad..dcfb32ee5cb6 100644 +--- a/drivers/bus/omap_l3_noc.c ++++ b/drivers/bus/omap_l3_noc.c +@@ -285,7 +285,7 @@ static int omap_l3_probe(struct platform_device *pdev) + */ + l3->debug_irq = platform_get_irq(pdev, 0); + ret = devm_request_irq(l3->dev, l3->debug_irq, l3_interrupt_handler, +- 0x0, "l3-dbg-irq", l3); ++ IRQF_NO_THREAD, "l3-dbg-irq", l3); + if (ret) { + dev_err(l3->dev, "request_irq failed for %d\n", + l3->debug_irq); +@@ -294,7 +294,7 @@ static int omap_l3_probe(struct platform_device *pdev) + + l3->app_irq = platform_get_irq(pdev, 1); + ret = devm_request_irq(l3->dev, l3->app_irq, l3_interrupt_handler, +- 0x0, "l3-app-irq", l3); ++ IRQF_NO_THREAD, "l3-app-irq", l3); + if (ret) + dev_err(l3->dev, "request_irq failed for %d\n", l3->app_irq); + +-- +2.30.1 + diff --git a/queue-5.10/can-c_can-move-runtime-pm-enable-disable-to-c_can_pl.patch b/queue-5.10/can-c_can-move-runtime-pm-enable-disable-to-c_can_pl.patch new file mode 100644 index 00000000000..fc5050134ed --- /dev/null +++ b/queue-5.10/can-c_can-move-runtime-pm-enable-disable-to-c_can_pl.patch @@ -0,0 +1,136 @@ +From ea0eb9070bf9f6a3433bd72b020231829304bd1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Mar 2021 21:55:40 -0500 +Subject: can: c_can: move runtime PM enable/disable to c_can_platform +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tong Zhang + +[ Upstream commit 6e2fe01dd6f98da6cae8b07cd5cfa67abc70d97d ] + +Currently doing modprobe c_can_pci will make the kernel complain: + + Unbalanced pm_runtime_enable! + +this is caused by pm_runtime_enable() called before pm is initialized. + +This fix is similar to 227619c3ff7c, move those pm_enable/disable code +to c_can_platform. + +Fixes: 4cdd34b26826 ("can: c_can: Add runtime PM support to Bosch C_CAN/D_CAN controller") +Link: http://lore.kernel.org/r/20210302025542.987600-1-ztong0001@gmail.com +Signed-off-by: Tong Zhang +Tested-by: Uwe Kleine-König +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/c_can/c_can.c | 24 +----------------------- + drivers/net/can/c_can/c_can_platform.c | 6 +++++- + 2 files changed, 6 insertions(+), 24 deletions(-) + +diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c +index 1a9e9b9a4bf6..6c75e5897620 100644 +--- a/drivers/net/can/c_can/c_can.c ++++ b/drivers/net/can/c_can/c_can.c +@@ -212,18 +212,6 @@ static const struct can_bittiming_const c_can_bittiming_const = { + .brp_inc = 1, + }; + +-static inline void c_can_pm_runtime_enable(const struct c_can_priv *priv) +-{ +- if (priv->device) +- pm_runtime_enable(priv->device); +-} +- +-static inline void c_can_pm_runtime_disable(const struct c_can_priv *priv) +-{ +- if (priv->device) +- pm_runtime_disable(priv->device); +-} +- + static inline void c_can_pm_runtime_get_sync(const struct c_can_priv *priv) + { + if (priv->device) +@@ -1335,7 +1323,6 @@ static const struct net_device_ops c_can_netdev_ops = { + + int register_c_can_dev(struct net_device *dev) + { +- struct c_can_priv *priv = netdev_priv(dev); + int err; + + /* Deactivate pins to prevent DRA7 DCAN IP from being +@@ -1345,28 +1332,19 @@ int register_c_can_dev(struct net_device *dev) + */ + pinctrl_pm_select_sleep_state(dev->dev.parent); + +- c_can_pm_runtime_enable(priv); +- + dev->flags |= IFF_ECHO; /* we support local echo */ + dev->netdev_ops = &c_can_netdev_ops; + + err = register_candev(dev); +- if (err) +- c_can_pm_runtime_disable(priv); +- else ++ if (!err) + devm_can_led_init(dev); +- + return err; + } + EXPORT_SYMBOL_GPL(register_c_can_dev); + + void unregister_c_can_dev(struct net_device *dev) + { +- struct c_can_priv *priv = netdev_priv(dev); +- + unregister_candev(dev); +- +- c_can_pm_runtime_disable(priv); + } + EXPORT_SYMBOL_GPL(unregister_c_can_dev); + +diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c +index 05f425ceb53a..47b251b1607c 100644 +--- a/drivers/net/can/c_can/c_can_platform.c ++++ b/drivers/net/can/c_can/c_can_platform.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -386,6 +387,7 @@ static int c_can_plat_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, dev); + SET_NETDEV_DEV(dev, &pdev->dev); + ++ pm_runtime_enable(priv->device); + ret = register_c_can_dev(dev); + if (ret) { + dev_err(&pdev->dev, "registering %s failed (err=%d)\n", +@@ -398,6 +400,7 @@ static int c_can_plat_probe(struct platform_device *pdev) + return 0; + + exit_free_device: ++ pm_runtime_disable(priv->device); + free_c_can_dev(dev); + exit: + dev_err(&pdev->dev, "probe failed\n"); +@@ -408,9 +411,10 @@ exit: + static int c_can_plat_remove(struct platform_device *pdev) + { + struct net_device *dev = platform_get_drvdata(pdev); ++ struct c_can_priv *priv = netdev_priv(dev); + + unregister_c_can_dev(dev); +- ++ pm_runtime_disable(priv->device); + free_c_can_dev(dev); + + return 0; +-- +2.30.1 + diff --git a/queue-5.10/can-c_can_pci-c_can_pci_remove-fix-use-after-free.patch b/queue-5.10/can-c_can_pci-c_can_pci_remove-fix-use-after-free.patch new file mode 100644 index 00000000000..5ff9146cb11 --- /dev/null +++ b/queue-5.10/can-c_can_pci-c_can_pci_remove-fix-use-after-free.patch @@ -0,0 +1,44 @@ +From 4b51c5e15957aa00dbc71f62ddb257ad8a9a62e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Feb 2021 21:45:11 -0500 +Subject: can: c_can_pci: c_can_pci_remove(): fix use-after-free + +From: Tong Zhang + +[ Upstream commit 0429d6d89f97ebff4f17f13f5b5069c66bde8138 ] + +There is a UAF in c_can_pci_remove(). dev is released by +free_c_can_dev() and is used by pci_iounmap(pdev, priv->base) later. +To fix this issue, save the mmio address before releasing dev. + +Fixes: 5b92da0443c2 ("c_can_pci: generic module for C_CAN/D_CAN on PCI") +Link: https://lore.kernel.org/r/20210301024512.539039-1-ztong0001@gmail.com +Signed-off-by: Tong Zhang +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/c_can/c_can_pci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/c_can/c_can_pci.c b/drivers/net/can/c_can/c_can_pci.c +index 406b4847e5dc..7efb60b50876 100644 +--- a/drivers/net/can/c_can/c_can_pci.c ++++ b/drivers/net/can/c_can/c_can_pci.c +@@ -239,12 +239,13 @@ static void c_can_pci_remove(struct pci_dev *pdev) + { + struct net_device *dev = pci_get_drvdata(pdev); + struct c_can_priv *priv = netdev_priv(dev); ++ void __iomem *addr = priv->base; + + unregister_c_can_dev(dev); + + free_c_can_dev(dev); + +- pci_iounmap(pdev, priv->base); ++ pci_iounmap(pdev, addr); + pci_disable_msi(pdev); + pci_clear_master(pdev); + pci_release_regions(pdev); +-- +2.30.1 + diff --git a/queue-5.10/can-flexcan-flexcan_chip_freeze-fix-chip-freeze-for-.patch b/queue-5.10/can-flexcan-flexcan_chip_freeze-fix-chip-freeze-for-.patch new file mode 100644 index 00000000000..9d6788e1310 --- /dev/null +++ b/queue-5.10/can-flexcan-flexcan_chip_freeze-fix-chip-freeze-for-.patch @@ -0,0 +1,55 @@ +From 79c285b30816f1363c9d8bdc7c21c81a4319f227 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Mar 2021 00:15:10 +0100 +Subject: can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing + bitrate + +From: Angelo Dureghello + +[ Upstream commit 47c5e474bc1e1061fb037d13b5000b38967eb070 ] + +For cases when flexcan is built-in, bitrate is still not set at +registering. So flexcan_chip_freeze() generates: + +[ 1.860000] *** ZERO DIVIDE *** FORMAT=4 +[ 1.860000] Current process id is 1 +[ 1.860000] BAD KERNEL TRAP: 00000000 +[ 1.860000] PC: [<402e70c8>] flexcan_chip_freeze+0x1a/0xa8 + +To allow chip freeze, using an hardcoded timeout when bitrate is still +not set. + +Fixes: ec15e27cc890 ("can: flexcan: enable RX FIFO after FRZ/HALT valid") +Link: https://lore.kernel.org/r/20210315231510.650593-1-angelo@kernel-space.org +Signed-off-by: Angelo Dureghello +[mkl: use if instead of ? operator] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/flexcan.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index d712c6fdbc87..7cbaac238ff6 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -658,9 +658,15 @@ static int flexcan_chip_disable(struct flexcan_priv *priv) + static int flexcan_chip_freeze(struct flexcan_priv *priv) + { + struct flexcan_regs __iomem *regs = priv->regs; +- unsigned int timeout = 1000 * 1000 * 10 / priv->can.bittiming.bitrate; ++ unsigned int timeout; ++ u32 bitrate = priv->can.bittiming.bitrate; + u32 reg; + ++ if (bitrate) ++ timeout = 1000 * 1000 * 10 / bitrate; ++ else ++ timeout = FLEXCAN_TIMEOUT_US / 10; ++ + reg = priv->read(®s->mcr); + reg |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT; + priv->write(reg, ®s->mcr); +-- +2.30.1 + diff --git a/queue-5.10/can-isotp-isotp_setsockopt-only-allow-to-set-low-lev.patch b/queue-5.10/can-isotp-isotp_setsockopt-only-allow-to-set-low-lev.patch new file mode 100644 index 00000000000..271171cb2e4 --- /dev/null +++ b/queue-5.10/can-isotp-isotp_setsockopt-only-allow-to-set-low-lev.patch @@ -0,0 +1,42 @@ +From b20e027d3a6a745c9a296eca32ba58a7877cde5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Feb 2021 21:58:36 +0100 +Subject: can: isotp: isotp_setsockopt(): only allow to set low level TX flags + for CAN-FD + +From: Marc Kleine-Budde + +[ Upstream commit e4912459bd5edd493b61bc7c3a5d9b2eb17f5a89 ] + +CAN-FD frames have struct canfd_frame::flags, while classic CAN frames +don't. + +This patch refuses to set TX flags (struct +can_isotp_ll_options::tx_flags) on non CAN-FD isotp sockets. + +Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") +Link: https://lore.kernel.org/r/20210218215434.1708249-2-mkl@pengutronix.de +Cc: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/isotp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/can/isotp.c b/net/can/isotp.c +index 8bd565f2073e..a9b96a6e6317 100644 +--- a/net/can/isotp.c ++++ b/net/can/isotp.c +@@ -1212,7 +1212,8 @@ static int isotp_setsockopt(struct socket *sock, int level, int optname, + if (ll.mtu != CAN_MTU && ll.mtu != CANFD_MTU) + return -EINVAL; + +- if (ll.mtu == CAN_MTU && ll.tx_dl > CAN_MAX_DLEN) ++ if (ll.mtu == CAN_MTU && ++ (ll.tx_dl > CAN_MAX_DLEN || ll.tx_flags != 0)) + return -EINVAL; + + memcpy(&so->ll, &ll, sizeof(ll)); +-- +2.30.1 + diff --git a/queue-5.10/can-isotp-tx-path-ensure-that-can-frame-flags-are-in.patch b/queue-5.10/can-isotp-tx-path-ensure-that-can-frame-flags-are-in.patch new file mode 100644 index 00000000000..3507d434206 --- /dev/null +++ b/queue-5.10/can-isotp-tx-path-ensure-that-can-frame-flags-are-in.patch @@ -0,0 +1,71 @@ +From a26ade7317d17edf67288d8b69e993e3eee6fb96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Feb 2021 21:24:20 +0100 +Subject: can: isotp: TX-path: ensure that CAN frame flags are initialized + +From: Marc Kleine-Budde + +[ Upstream commit d4eb538e1f48b3cf7bb6cb9eb39fe3e9e8a701f7 ] + +The previous patch ensures that the TX flags (struct +can_isotp_ll_options::tx_flags) are 0 for classic CAN frames or a user +configured value for CAN-FD frames. + +This patch sets the CAN frames flags unconditionally to the ISO-TP TX +flags, so that they are initialized to a proper value. Otherwise when +running "candump -x" on a classical CAN ISO-TP stream shows wrongly +set "B" and "E" flags. + +| $ candump any,0:0,#FFFFFFFF -extA +| [...] +| can0 TX B E 713 [8] 2B 0A 0B 0C 0D 0E 0F 00 +| can0 TX B E 713 [8] 2C 01 02 03 04 05 06 07 +| can0 TX B E 713 [8] 2D 08 09 0A 0B 0C 0D 0E +| can0 TX B E 713 [8] 2E 0F 00 01 02 03 04 05 + +Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") +Link: https://lore.kernel.org/r/20210218215434.1708249-2-mkl@pengutronix.de +Cc: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/isotp.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/net/can/isotp.c b/net/can/isotp.c +index a9b96a6e6317..b01662d2f2cd 100644 +--- a/net/can/isotp.c ++++ b/net/can/isotp.c +@@ -215,8 +215,7 @@ static int isotp_send_fc(struct sock *sk, int ae, u8 flowstatus) + if (ae) + ncf->data[0] = so->opt.ext_address; + +- if (so->ll.mtu == CANFD_MTU) +- ncf->flags = so->ll.tx_flags; ++ ncf->flags = so->ll.tx_flags; + + can_send_ret = can_send(nskb, 1); + if (can_send_ret) +@@ -790,8 +789,7 @@ isotp_tx_burst: + so->tx.sn %= 16; + so->tx.bs++; + +- if (so->ll.mtu == CANFD_MTU) +- cf->flags = so->ll.tx_flags; ++ cf->flags = so->ll.tx_flags; + + skb->dev = dev; + can_skb_set_owner(skb, sk); +@@ -934,8 +932,7 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) + } + + /* send the first or only CAN frame */ +- if (so->ll.mtu == CANFD_MTU) +- cf->flags = so->ll.tx_flags; ++ cf->flags = so->ll.tx_flags; + + skb->dev = dev; + skb->sk = sk; +-- +2.30.1 + diff --git a/queue-5.10/can-isotp-tx-path-zero-initialize-outgoing-can-frame.patch b/queue-5.10/can-isotp-tx-path-zero-initialize-outgoing-can-frame.patch new file mode 100644 index 00000000000..1f76b5bc16a --- /dev/null +++ b/queue-5.10/can-isotp-tx-path-zero-initialize-outgoing-can-frame.patch @@ -0,0 +1,64 @@ +From b6d94f765f3508baff0eb7c8fa596689da113621 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 11:06:19 +0100 +Subject: can: isotp: tx-path: zero initialize outgoing CAN frames + +From: Oliver Hartkopp + +[ Upstream commit b5f020f82a8e41201c6ede20fa00389d6980b223 ] + +Commit d4eb538e1f48 ("can: isotp: TX-path: ensure that CAN frame flags are +initialized") ensured the TX flags to be properly set for outgoing CAN +frames. + +In fact the root cause of the issue results from a missing initialization +of outgoing CAN frames created by isotp. This is no problem on the CAN bus +as the CAN driver only picks the correctly defined content from the struct +can(fd)_frame. But when the outgoing frames are monitored (e.g. with +candump) we potentially leak some bytes in the unused content of +struct can(fd)_frame. + +Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") +Cc: Marc Kleine-Budde +Link: https://lore.kernel.org/r/20210319100619.10858-1-socketcan@hartkopp.net +Signed-off-by: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/isotp.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/can/isotp.c b/net/can/isotp.c +index b01662d2f2cd..ea1e227b8e54 100644 +--- a/net/can/isotp.c ++++ b/net/can/isotp.c +@@ -196,7 +196,7 @@ static int isotp_send_fc(struct sock *sk, int ae, u8 flowstatus) + nskb->dev = dev; + can_skb_set_owner(nskb, sk); + ncf = (struct canfd_frame *)nskb->data; +- skb_put(nskb, so->ll.mtu); ++ skb_put_zero(nskb, so->ll.mtu); + + /* create & send flow control reply */ + ncf->can_id = so->txid; +@@ -779,7 +779,7 @@ isotp_tx_burst: + can_skb_prv(skb)->skbcnt = 0; + + cf = (struct canfd_frame *)skb->data; +- skb_put(skb, so->ll.mtu); ++ skb_put_zero(skb, so->ll.mtu); + + /* create consecutive frame */ + isotp_fill_dataframe(cf, so, ae, 0); +@@ -887,7 +887,7 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) + so->tx.idx = 0; + + cf = (struct canfd_frame *)skb->data; +- skb_put(skb, so->ll.mtu); ++ skb_put_zero(skb, so->ll.mtu); + + /* take care of a potential SF_DL ESC offset for TX_DL > 8 */ + off = (so->tx.ll_dl > CAN_MAX_DLEN) ? 1 : 0; +-- +2.30.1 + diff --git a/queue-5.10/can-kvaser_pciefd-always-disable-bus-load-reporting.patch b/queue-5.10/can-kvaser_pciefd-always-disable-bus-load-reporting.patch new file mode 100644 index 00000000000..6ef3d52fa2a --- /dev/null +++ b/queue-5.10/can-kvaser_pciefd-always-disable-bus-load-reporting.patch @@ -0,0 +1,56 @@ +From d5d722bae9048b2228f855133431a0e488393f49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Mar 2021 10:17:23 +0100 +Subject: can: kvaser_pciefd: Always disable bus load reporting + +From: Jimmy Assarsson + +[ Upstream commit 7c6e6bce08f918b64459415f58061d4d6df44994 ] + +Under certain circumstances, when switching from Kvaser's linuxcan driver +(kvpciefd) to the SocketCAN driver (kvaser_pciefd), the bus load reporting +is not disabled. +This is flooding the kernel log with prints like: +[3485.574677] kvaser_pciefd 0000:02:00.0: Received unexpected packet type 0x00000009 + +Always put the controller in the expected state, instead of assuming that +bus load reporting is inactive. + +Note: If bus load reporting is enabled when the driver is loaded, you will + still get a number of bus load packages (and printouts), before it is + disabled. + +Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") +Link: https://lore.kernel.org/r/20210309091724.31262-1-jimmyassarsson@gmail.com +Signed-off-by: Jimmy Assarsson +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/kvaser_pciefd.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c +index 43151dd6cb1c..99323c273aa5 100644 +--- a/drivers/net/can/kvaser_pciefd.c ++++ b/drivers/net/can/kvaser_pciefd.c +@@ -57,6 +57,7 @@ MODULE_DESCRIPTION("CAN driver for Kvaser CAN/PCIe devices"); + #define KVASER_PCIEFD_KCAN_STAT_REG 0x418 + #define KVASER_PCIEFD_KCAN_MODE_REG 0x41c + #define KVASER_PCIEFD_KCAN_BTRN_REG 0x420 ++#define KVASER_PCIEFD_KCAN_BUS_LOAD_REG 0x424 + #define KVASER_PCIEFD_KCAN_BTRD_REG 0x428 + #define KVASER_PCIEFD_KCAN_PWM_REG 0x430 + /* Loopback control register */ +@@ -949,6 +950,9 @@ static int kvaser_pciefd_setup_can_ctrls(struct kvaser_pciefd *pcie) + timer_setup(&can->bec_poll_timer, kvaser_pciefd_bec_poll_timer, + 0); + ++ /* Disable Bus load reporting */ ++ iowrite32(0, can->reg_base + KVASER_PCIEFD_KCAN_BUS_LOAD_REG); ++ + tx_npackets = ioread32(can->reg_base + + KVASER_PCIEFD_KCAN_TX_NPACKETS_REG); + if (((tx_npackets >> KVASER_PCIEFD_KCAN_TX_NPACKETS_MAX_SHIFT) & +-- +2.30.1 + diff --git a/queue-5.10/can-m_can-m_can_do_rx_poll-fix-extraneous-msg-loss-w.patch b/queue-5.10/can-m_can-m_can_do_rx_poll-fix-extraneous-msg-loss-w.patch new file mode 100644 index 00000000000..d6fffc8d0b0 --- /dev/null +++ b/queue-5.10/can-m_can-m_can_do_rx_poll-fix-extraneous-msg-loss-w.patch @@ -0,0 +1,44 @@ +From b7d990e1d10afc3a21c9a6b3d9f5791d8bfebebd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 10:31:52 +0000 +Subject: can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning + +From: Torin Cooper-Bennun + +[ Upstream commit c0e399f3baf42279f48991554240af8c457535d1 ] + +Message loss from RX FIFO 0 is already handled in +m_can_handle_lost_msg(), with netdev output included. + +Removing this warning also improves driver performance under heavy +load, where m_can_do_rx_poll() may be called many times before this +interrupt is cleared, causing this message to be output many +times (thanks Mariusz Madej for this report). + +Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") +Link: https://lore.kernel.org/r/20210303103151.3760532-1-torin@maxiluxsystems.com +Reported-by: Mariusz Madej +Signed-off-by: Torin Cooper-Bennun +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index 3c1e37975168..6952d5b396e8 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -502,9 +502,6 @@ static int m_can_do_rx_poll(struct net_device *dev, int quota) + } + + while ((rxfs & RXFS_FFL_MASK) && (quota > 0)) { +- if (rxfs & RXFS_RFL) +- netdev_warn(dev, "Rx FIFO 0 Message Lost\n"); +- + m_can_read_fifo(dev, rxfs); + + quota--; +-- +2.30.1 + diff --git a/queue-5.10/can-m_can-m_can_rx_peripheral-fix-rx-being-blocked-b.patch b/queue-5.10/can-m_can-m_can_rx_peripheral-fix-rx-being-blocked-b.patch new file mode 100644 index 00000000000..cb8da95e823 --- /dev/null +++ b/queue-5.10/can-m_can-m_can_rx_peripheral-fix-rx-being-blocked-b.patch @@ -0,0 +1,42 @@ +From cd1251860637913d920fc10dfc11c528bc3bf0d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 14:43:51 +0000 +Subject: can: m_can: m_can_rx_peripheral(): fix RX being blocked by errors + +From: Torin Cooper-Bennun + +[ Upstream commit e98d9ee64ee2cc9b1d1a8e26610ec4d0392ebe50 ] + +For M_CAN peripherals, m_can_rx_handler() was called with quota = 1, +which caused any error handling to block RX from taking place until +the next time the IRQ handler is called. This had been observed to +cause RX to be blocked indefinitely in some cases. + +This is fixed by calling m_can_rx_handler with a sensibly high quota. + +Fixes: f524f829b75a ("can: m_can: Create a m_can platform framework") +Link: https://lore.kernel.org/r/20210303144350.4093750-1-torin@maxiluxsystems.com +Suggested-by: Marc Kleine-Budde +Signed-off-by: Torin Cooper-Bennun +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index 6952d5b396e8..6f0bf5db885c 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -882,7 +882,7 @@ static int m_can_rx_peripheral(struct net_device *dev) + { + struct m_can_classdev *cdev = netdev_priv(dev); + +- m_can_rx_handler(dev, 1); ++ m_can_rx_handler(dev, M_CAN_NAPI_WEIGHT); + + m_can_enable_all_interrupts(cdev); + +-- +2.30.1 + diff --git a/queue-5.10/can-peak_usb-add-forgotten-supported-devices.patch b/queue-5.10/can-peak_usb-add-forgotten-supported-devices.patch new file mode 100644 index 00000000000..a39c9b13b32 --- /dev/null +++ b/queue-5.10/can-peak_usb-add-forgotten-supported-devices.patch @@ -0,0 +1,39 @@ +From 3a133cd2ef10045fc9b52b139b28e24a8ed4500b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Mar 2021 09:21:27 +0100 +Subject: can: peak_usb: add forgotten supported devices + +From: Stephane Grosjean + +[ Upstream commit 59ec7b89ed3e921cd0625a8c83f31a30d485fdf8 ] + +Since the peak_usb driver also supports the CAN-USB interfaces +"PCAN-USB X6" and "PCAN-Chip USB" from PEAK-System GmbH, this patch adds +their names to the list of explicitly supported devices. + +Fixes: ea8b65b596d7 ("can: usb: Add support of PCAN-Chip USB stamp module") +Fixes: f00b534ded60 ("can: peak: Add support for PCAN-USB X6 USB interface") +Link: https://lore.kernel.org/r/20210309082128.23125-3-s.grosjean@peak-system.com +Signed-off-by: Stephane Grosjean +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c +index d56592283818..3f8d99286b1e 100644 +--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c ++++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c +@@ -18,6 +18,8 @@ + + MODULE_SUPPORTED_DEVICE("PEAK-System PCAN-USB FD adapter"); + MODULE_SUPPORTED_DEVICE("PEAK-System PCAN-USB Pro FD adapter"); ++MODULE_SUPPORTED_DEVICE("PEAK-System PCAN-Chip USB"); ++MODULE_SUPPORTED_DEVICE("PEAK-System PCAN-USB X6 adapter"); + + #define PCAN_USBPROFD_CHANNEL_COUNT 2 + #define PCAN_USBFD_CHANNEL_COUNT 1 +-- +2.30.1 + diff --git a/queue-5.10/clk-qcom-gcc-sc7180-use-floor-ops-for-the-correct-sd.patch b/queue-5.10/clk-qcom-gcc-sc7180-use-floor-ops-for-the-correct-sd.patch new file mode 100644 index 00000000000..42c0e73ff0a --- /dev/null +++ b/queue-5.10/clk-qcom-gcc-sc7180-use-floor-ops-for-the-correct-sd.patch @@ -0,0 +1,63 @@ +From 3190b5ab5ee58a371ef8991e22ccd58dfec473b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Feb 2021 09:50:25 -0800 +Subject: clk: qcom: gcc-sc7180: Use floor ops for the correct sdcc1 clk + +From: Douglas Anderson + +[ Upstream commit 148ddaa89d4a0a927c4353398096cc33687755c1 ] + +While picking commit a8cd989e1a57 ("mmc: sdhci-msm: Warn about +overclocking SD/MMC") back to my tree I was surprised that it was +reporting warnings. I thought I fixed those! Looking closer at the +fix, I see that I totally bungled it (or at least I halfway bungled +it). The SD card clock got fixed (and that was the one I was really +focused on fixing), but I totally adjusted the wrong clock for eMMC. +Sigh. Let's fix my dumb mistake. + +Now both SD and eMMC have floor for the "apps" clock. + +This doesn't matter a lot for the final clock rate for HS400 eMMC but +could matter if someone happens to put some slower eMMC on a sc7180. +We also transition through some of these lower rates sometimes and +having them wrong could cause problems during these transitions. +These were the messages I was seeing at boot: + mmc1: Card appears overclocked; req 52000000 Hz, actual 100000000 Hz + mmc1: Card appears overclocked; req 52000000 Hz, actual 100000000 Hz + mmc1: Card appears overclocked; req 104000000 Hz, actual 192000000 Hz + +Fixes: 6d37a8d19283 ("clk: qcom: gcc-sc7180: Use floor ops for sdcc clks") +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20210224095013.1.I2e2ba4978cfca06520dfb5d757768f9c42140f7c@changeid +Reviewed-by: Taniya Das +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sc7180.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-sc7180.c b/drivers/clk/qcom/gcc-sc7180.c +index b080739ab0c3..7e80dbd4a3f9 100644 +--- a/drivers/clk/qcom/gcc-sc7180.c ++++ b/drivers/clk/qcom/gcc-sc7180.c +@@ -620,7 +620,7 @@ static struct clk_rcg2 gcc_sdcc1_apps_clk_src = { + .name = "gcc_sdcc1_apps_clk_src", + .parent_data = gcc_parent_data_1, + .num_parents = 5, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_floor_ops, + }, + }; + +@@ -642,7 +642,7 @@ static struct clk_rcg2 gcc_sdcc1_ice_core_clk_src = { + .name = "gcc_sdcc1_ice_core_clk_src", + .parent_data = gcc_parent_data_0, + .num_parents = 4, +- .ops = &clk_rcg2_floor_ops, ++ .ops = &clk_rcg2_ops, + }, + }; + +-- +2.30.1 + diff --git a/queue-5.10/dm-table-fix-zoned-model-check-and-zone-sectors-chec.patch b/queue-5.10/dm-table-fix-zoned-model-check-and-zone-sectors-chec.patch new file mode 100644 index 00000000000..06d93833937 --- /dev/null +++ b/queue-5.10/dm-table-fix-zoned-model-check-and-zone-sectors-chec.patch @@ -0,0 +1,163 @@ +From e500ed74ca78e8dc1dfcb53afe60a4f73c8726e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Mar 2021 13:36:02 +0900 +Subject: dm table: Fix zoned model check and zone sectors check + +From: Shin'ichiro Kawasaki + +[ Upstream commit 2d669ceb69c276f7637cf760287ca4187add082e ] + +Commit 24f6b6036c9e ("dm table: fix zoned iterate_devices based device +capability checks") triggered dm table load failure when dm-zoned device +is set up for zoned block devices and a regular device for cache. + +The commit inverted logic of two callback functions for iterate_devices: +device_is_zoned_model() and device_matches_zone_sectors(). The logic of +device_is_zoned_model() was inverted then all destination devices of all +targets in dm table are required to have the expected zoned model. This +is fine for dm-linear, dm-flakey and dm-crypt on zoned block devices +since each target has only one destination device. However, this results +in failure for dm-zoned with regular cache device since that target has +both regular block device and zoned block devices. + +As for device_matches_zone_sectors(), the commit inverted the logic to +require all zoned block devices in each target have the specified +zone_sectors. This check also fails for regular block device which does +not have zones. + +To avoid the check failures, fix the zone model check and the zone +sectors check. For zone model check, introduce the new feature flag +DM_TARGET_MIXED_ZONED_MODEL, and set it to dm-zoned target. When the +target has this flag, allow it to have destination devices with any +zoned model. For zone sectors check, skip the check if the destination +device is not a zoned block device. Also add comments and improve an +error message to clarify expectations to the two checks. + +Fixes: 24f6b6036c9e ("dm table: fix zoned iterate_devices based device capability checks") +Signed-off-by: Shin'ichiro Kawasaki +Signed-off-by: Damien Le Moal +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-table.c | 33 +++++++++++++++++++++++++-------- + drivers/md/dm-zoned-target.c | 2 +- + include/linux/device-mapper.h | 15 ++++++++++++++- + 3 files changed, 40 insertions(+), 10 deletions(-) + +diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c +index 9b824c21580a..5c590895c14c 100644 +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -1387,6 +1387,13 @@ static int device_not_zoned_model(struct dm_target *ti, struct dm_dev *dev, + return !q || blk_queue_zoned_model(q) != *zoned_model; + } + ++/* ++ * Check the device zoned model based on the target feature flag. If the target ++ * has the DM_TARGET_ZONED_HM feature flag set, host-managed zoned devices are ++ * also accepted but all devices must have the same zoned model. If the target ++ * has the DM_TARGET_MIXED_ZONED_MODEL feature set, the devices can have any ++ * zoned model with all zoned devices having the same zone size. ++ */ + static bool dm_table_supports_zoned_model(struct dm_table *t, + enum blk_zoned_model zoned_model) + { +@@ -1396,13 +1403,15 @@ static bool dm_table_supports_zoned_model(struct dm_table *t, + for (i = 0; i < dm_table_get_num_targets(t); i++) { + ti = dm_table_get_target(t, i); + +- if (zoned_model == BLK_ZONED_HM && +- !dm_target_supports_zoned_hm(ti->type)) +- return false; +- +- if (!ti->type->iterate_devices || +- ti->type->iterate_devices(ti, device_not_zoned_model, &zoned_model)) +- return false; ++ if (dm_target_supports_zoned_hm(ti->type)) { ++ if (!ti->type->iterate_devices || ++ ti->type->iterate_devices(ti, device_not_zoned_model, ++ &zoned_model)) ++ return false; ++ } else if (!dm_target_supports_mixed_zoned_model(ti->type)) { ++ if (zoned_model == BLK_ZONED_HM) ++ return false; ++ } + } + + return true; +@@ -1414,9 +1423,17 @@ static int device_not_matches_zone_sectors(struct dm_target *ti, struct dm_dev * + struct request_queue *q = bdev_get_queue(dev->bdev); + unsigned int *zone_sectors = data; + ++ if (!blk_queue_is_zoned(q)) ++ return 0; ++ + return !q || blk_queue_zone_sectors(q) != *zone_sectors; + } + ++/* ++ * Check consistency of zoned model and zone sectors across all targets. For ++ * zone sectors, if the destination device is a zoned block device, it shall ++ * have the specified zone_sectors. ++ */ + static int validate_hardware_zoned_model(struct dm_table *table, + enum blk_zoned_model zoned_model, + unsigned int zone_sectors) +@@ -1435,7 +1452,7 @@ static int validate_hardware_zoned_model(struct dm_table *table, + return -EINVAL; + + if (dm_table_any_dev_attr(table, device_not_matches_zone_sectors, &zone_sectors)) { +- DMERR("%s: zone sectors is not consistent across all devices", ++ DMERR("%s: zone sectors is not consistent across all zoned devices", + dm_device_name(table->md)); + return -EINVAL; + } +diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c +index 697f9de37355..7e88df64d197 100644 +--- a/drivers/md/dm-zoned-target.c ++++ b/drivers/md/dm-zoned-target.c +@@ -1143,7 +1143,7 @@ static int dmz_message(struct dm_target *ti, unsigned int argc, char **argv, + static struct target_type dmz_type = { + .name = "zoned", + .version = {2, 0, 0}, +- .features = DM_TARGET_SINGLETON | DM_TARGET_ZONED_HM, ++ .features = DM_TARGET_SINGLETON | DM_TARGET_MIXED_ZONED_MODEL, + .module = THIS_MODULE, + .ctr = dmz_ctr, + .dtr = dmz_dtr, +diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h +index d2d7f9b6a276..50cc070cb1f7 100644 +--- a/include/linux/device-mapper.h ++++ b/include/linux/device-mapper.h +@@ -246,7 +246,11 @@ struct target_type { + #define dm_target_passes_integrity(type) ((type)->features & DM_TARGET_PASSES_INTEGRITY) + + /* +- * Indicates that a target supports host-managed zoned block devices. ++ * Indicates support for zoned block devices: ++ * - DM_TARGET_ZONED_HM: the target also supports host-managed zoned ++ * block devices but does not support combining different zoned models. ++ * - DM_TARGET_MIXED_ZONED_MODEL: the target supports combining multiple ++ * devices with different zoned models. + */ + #define DM_TARGET_ZONED_HM 0x00000040 + #define dm_target_supports_zoned_hm(type) ((type)->features & DM_TARGET_ZONED_HM) +@@ -257,6 +261,15 @@ struct target_type { + #define DM_TARGET_NOWAIT 0x00000080 + #define dm_target_supports_nowait(type) ((type)->features & DM_TARGET_NOWAIT) + ++#ifdef CONFIG_BLK_DEV_ZONED ++#define DM_TARGET_MIXED_ZONED_MODEL 0x00000200 ++#define dm_target_supports_mixed_zoned_model(type) \ ++ ((type)->features & DM_TARGET_MIXED_ZONED_MODEL) ++#else ++#define DM_TARGET_MIXED_ZONED_MODEL 0x00000000 ++#define dm_target_supports_mixed_zoned_model(type) (false) ++#endif ++ + struct dm_target { + struct dm_table *table; + struct target_type *type; +-- +2.30.1 + diff --git a/queue-5.10/drm-msm-dsi-fix-check-before-set-in-the-7nm-dsi_pll-.patch b/queue-5.10/drm-msm-dsi-fix-check-before-set-in-the-7nm-dsi_pll-.patch new file mode 100644 index 00000000000..0603f7c36dc --- /dev/null +++ b/queue-5.10/drm-msm-dsi-fix-check-before-set-in-the-7nm-dsi_pll-.patch @@ -0,0 +1,82 @@ +From fd6915ea9d310f8c984a836eca7e220e5026affe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 01:47:51 +0300 +Subject: drm/msm/dsi: fix check-before-set in the 7nm dsi_pll code + +From: Dmitry Baryshkov + +[ Upstream commit 3b24cdfc721a5f1098da22f9f68ff5f4a5efccc9 ] + +Fix setting min/max DSI PLL rate for the V4.1 7nm DSI PLL (used on +sm8250). Current code checks for pll->type before it is set (as it is +set in the msm_dsi_pll_init() after calling device-specific functions. + +Cc: Jonathan Marek +Fixes: 1ef7c99d145c ("drm/msm/dsi: add support for 7nm DSI PHY/PLL") +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/pll/dsi_pll.c | 2 +- + drivers/gpu/drm/msm/dsi/pll/dsi_pll.h | 6 ++++-- + drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c | 5 +++-- + 3 files changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll.c +index a45fe95aff49..3dc65877fa10 100644 +--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll.c ++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll.c +@@ -163,7 +163,7 @@ struct msm_dsi_pll *msm_dsi_pll_init(struct platform_device *pdev, + break; + case MSM_DSI_PHY_7NM: + case MSM_DSI_PHY_7NM_V4_1: +- pll = msm_dsi_pll_7nm_init(pdev, id); ++ pll = msm_dsi_pll_7nm_init(pdev, type, id); + break; + default: + pll = ERR_PTR(-ENXIO); +diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll.h b/drivers/gpu/drm/msm/dsi/pll/dsi_pll.h +index 3405982a092c..bbecb1de5678 100644 +--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll.h ++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll.h +@@ -117,10 +117,12 @@ msm_dsi_pll_10nm_init(struct platform_device *pdev, int id) + } + #endif + #ifdef CONFIG_DRM_MSM_DSI_7NM_PHY +-struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev, int id); ++struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev, ++ enum msm_dsi_phy_type type, int id); + #else + static inline struct msm_dsi_pll * +-msm_dsi_pll_7nm_init(struct platform_device *pdev, int id) ++msm_dsi_pll_7nm_init(struct platform_device *pdev, ++ enum msm_dsi_phy_type type, int id) + { + return ERR_PTR(-ENODEV); + } +diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c +index 93bf142e4a4e..c1f6708367ae 100644 +--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c ++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c +@@ -852,7 +852,8 @@ err_base_clk_hw: + return ret; + } + +-struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev, int id) ++struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev, ++ enum msm_dsi_phy_type type, int id) + { + struct dsi_pll_7nm *pll_7nm; + struct msm_dsi_pll *pll; +@@ -885,7 +886,7 @@ struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev, int id) + pll = &pll_7nm->base; + pll->min_rate = 1000000000UL; + pll->max_rate = 3500000000UL; +- if (pll->type == MSM_DSI_PHY_7NM_V4_1) { ++ if (type == MSM_DSI_PHY_7NM_V4_1) { + pll->min_rate = 600000000UL; + pll->max_rate = (unsigned long)5000000000ULL; + /* workaround for max rate overflowing on 32-bit builds: */ +-- +2.30.1 + diff --git a/queue-5.10/drm-msm-fix-shutdown-hook-in-case-gpu-components-fai.patch b/queue-5.10/drm-msm-fix-shutdown-hook-in-case-gpu-components-fai.patch new file mode 100644 index 00000000000..dee79a5155f --- /dev/null +++ b/queue-5.10/drm-msm-fix-shutdown-hook-in-case-gpu-components-fai.patch @@ -0,0 +1,95 @@ +From 9a5251eb4466b69957e0013d0aba836b8880e3ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Mar 2021 08:56:02 -0300 +Subject: drm/msm: fix shutdown hook in case GPU components failed to bind + +From: Dmitry Baryshkov + +[ Upstream commit 623f279c77811475ac8fd5635cc4e4451aa71291 ] + +If GPU components have failed to bind, shutdown callback would fail with +the following backtrace. Add safeguard check to stop that oops from +happening and allow the board to reboot. + +[ 66.617046] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 +[ 66.626066] Mem abort info: +[ 66.628939] ESR = 0x96000006 +[ 66.632088] EC = 0x25: DABT (current EL), IL = 32 bits +[ 66.637542] SET = 0, FnV = 0 +[ 66.640688] EA = 0, S1PTW = 0 +[ 66.643924] Data abort info: +[ 66.646889] ISV = 0, ISS = 0x00000006 +[ 66.650832] CM = 0, WnR = 0 +[ 66.653890] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000107f81000 +[ 66.660505] [0000000000000000] pgd=0000000100bb2003, p4d=0000000100bb2003, pud=0000000100897003, pmd=0000000000000000 +[ 66.671398] Internal error: Oops: 96000006 [#1] PREEMPT SMP +[ 66.677115] Modules linked in: +[ 66.680261] CPU: 6 PID: 352 Comm: reboot Not tainted 5.11.0-rc2-00309-g79e3faa756b2 #38 +[ 66.688473] Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) +[ 66.695347] pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--) +[ 66.701507] pc : msm_atomic_commit_tail+0x78/0x4e0 +[ 66.706437] lr : commit_tail+0xa4/0x184 +[ 66.710381] sp : ffff8000108f3af0 +[ 66.713791] x29: ffff8000108f3af0 x28: ffff418c44337000 +[ 66.719242] x27: 0000000000000000 x26: ffff418c40a24490 +[ 66.724693] x25: ffffd3a842a4f1a0 x24: 0000000000000008 +[ 66.730146] x23: ffffd3a84313f030 x22: ffff418c444ce000 +[ 66.735598] x21: ffff418c408a4980 x20: 0000000000000000 +[ 66.741049] x19: 0000000000000000 x18: ffff800010710fbc +[ 66.746500] x17: 000000000000000c x16: 0000000000000001 +[ 66.751954] x15: 0000000000010008 x14: 0000000000000068 +[ 66.757405] x13: 0000000000000001 x12: 0000000000000000 +[ 66.762855] x11: 0000000000000001 x10: 00000000000009b0 +[ 66.768306] x9 : ffffd3a843192000 x8 : ffff418c44337000 +[ 66.773757] x7 : 0000000000000000 x6 : 00000000a401b34e +[ 66.779210] x5 : 00ffffffffffffff x4 : 0000000000000000 +[ 66.784660] x3 : 0000000000000000 x2 : ffff418c444ce000 +[ 66.790111] x1 : ffffd3a841dce530 x0 : ffff418c444cf000 +[ 66.795563] Call trace: +[ 66.798075] msm_atomic_commit_tail+0x78/0x4e0 +[ 66.802633] commit_tail+0xa4/0x184 +[ 66.806217] drm_atomic_helper_commit+0x160/0x390 +[ 66.811051] drm_atomic_commit+0x4c/0x60 +[ 66.815082] drm_atomic_helper_disable_all+0x1f4/0x210 +[ 66.820355] drm_atomic_helper_shutdown+0x80/0x130 +[ 66.825276] msm_pdev_shutdown+0x14/0x20 +[ 66.829303] platform_shutdown+0x28/0x40 +[ 66.833330] device_shutdown+0x158/0x330 +[ 66.837357] kernel_restart+0x40/0xa0 +[ 66.841122] __do_sys_reboot+0x228/0x250 +[ 66.845148] __arm64_sys_reboot+0x28/0x34 +[ 66.849264] el0_svc_common.constprop.0+0x74/0x190 +[ 66.854187] do_el0_svc+0x24/0x90 +[ 66.857595] el0_svc+0x14/0x20 +[ 66.860739] el0_sync_handler+0x1a4/0x1b0 +[ 66.864858] el0_sync+0x174/0x180 +[ 66.868269] Code: 1ac020a0 2a000273 eb02007f 54ffff01 (f9400285) +[ 66.874525] ---[ end trace 20dedb2a3229fec8 ]--- + +Fixes: 9d5cbf5fe46e ("drm/msm: add shutdown support for display platform_driver") +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Fabio Estevam +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_drv.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c +index 3d0adfa6736a..45e325c982c2 100644 +--- a/drivers/gpu/drm/msm/msm_drv.c ++++ b/drivers/gpu/drm/msm/msm_drv.c +@@ -1318,6 +1318,10 @@ static int msm_pdev_remove(struct platform_device *pdev) + static void msm_pdev_shutdown(struct platform_device *pdev) + { + struct drm_device *drm = platform_get_drvdata(pdev); ++ struct msm_drm_private *priv = drm ? drm->dev_private : NULL; ++ ++ if (!priv || !priv->kms) ++ return; + + drm_atomic_helper_shutdown(drm); + } +-- +2.30.1 + diff --git a/queue-5.10/drm-msm-fix-suspend-resume-on-i.mx5.patch b/queue-5.10/drm-msm-fix-suspend-resume-on-i.mx5.patch new file mode 100644 index 00000000000..fe27ba6cf16 --- /dev/null +++ b/queue-5.10/drm-msm-fix-suspend-resume-on-i.mx5.patch @@ -0,0 +1,79 @@ +From 6c2b88eb88c9fd6871807dbf72b327a2b9363d90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Mar 2021 08:56:03 -0300 +Subject: drm/msm: Fix suspend/resume on i.MX5 + +From: Fabio Estevam + +[ Upstream commit a9748134ea4aad989e52a6a91479e0acfd306e5b ] + +When putting iMX5 into suspend, the following flow is +observed: + +[ 70.023427] [] (msm_atomic_commit_tail) from [] +(commit_tail+0x9c/0x18c) +[ 70.031890] [] (commit_tail) from [] +(drm_atomic_helper_commit+0x1a0/0x1d4) +[ 70.040627] [] (drm_atomic_helper_commit) from +[] (drm_atomic_helper_disable_all+0x1c4/0x1d4) +[ 70.050913] [] (drm_atomic_helper_disable_all) from +[] (drm_atomic_helper_suspend+0xb8/0x170) +[ 70.061198] [] (drm_atomic_helper_suspend) from +[] (drm_mode_config_helper_suspend+0x24/0x58) + +In the i.MX5 case, priv->kms is not populated (as i.MX5 does not use any +of the Qualcomm display controllers), causing a NULL pointer +dereference in msm_atomic_commit_tail(): + +[ 24.268964] 8<--- cut here --- +[ 24.274602] Unable to handle kernel NULL pointer dereference at +virtual address 00000000 +[ 24.283434] pgd = (ptrval) +[ 24.286387] [00000000] *pgd=ca212831 +[ 24.290788] Internal error: Oops: 17 [#1] SMP ARM +[ 24.295609] Modules linked in: +[ 24.298777] CPU: 0 PID: 197 Comm: init Not tainted 5.11.0-rc2-next-20210111 #333 +[ 24.306276] Hardware name: Freescale i.MX53 (Device Tree Support) +[ 24.312442] PC is at msm_atomic_commit_tail+0x54/0xb9c +[ 24.317743] LR is at commit_tail+0xa4/0x1b0 + +Fix the problem by calling drm_mode_config_helper_suspend/resume() +only when priv->kms is available. + +Fixes: ca8199f13498 ("drm/msm/dpu: ensure device suspend happens during PM sleep") +Signed-off-by: Fabio Estevam +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_drv.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c +index 45e325c982c2..b38ebccad42f 100644 +--- a/drivers/gpu/drm/msm/msm_drv.c ++++ b/drivers/gpu/drm/msm/msm_drv.c +@@ -1079,6 +1079,10 @@ static int __maybe_unused msm_pm_resume(struct device *dev) + static int __maybe_unused msm_pm_prepare(struct device *dev) + { + struct drm_device *ddev = dev_get_drvdata(dev); ++ struct msm_drm_private *priv = ddev ? ddev->dev_private : NULL; ++ ++ if (!priv || !priv->kms) ++ return 0; + + return drm_mode_config_helper_suspend(ddev); + } +@@ -1086,6 +1090,10 @@ static int __maybe_unused msm_pm_prepare(struct device *dev) + static void __maybe_unused msm_pm_complete(struct device *dev) + { + struct drm_device *ddev = dev_get_drvdata(dev); ++ struct msm_drm_private *priv = ddev ? ddev->dev_private : NULL; ++ ++ if (!priv || !priv->kms) ++ return; + + drm_mode_config_helper_resume(ddev); + } +-- +2.30.1 + diff --git a/queue-5.10/drop_monitor-perform-cleanup-upon-probe-registration.patch b/queue-5.10/drop_monitor-perform-cleanup-upon-probe-registration.patch new file mode 100644 index 00000000000..fee0e9dc519 --- /dev/null +++ b/queue-5.10/drop_monitor-perform-cleanup-upon-probe-registration.patch @@ -0,0 +1,135 @@ +From 8b29dc79a273969337501c790659b6b49f0882ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 12:28:01 +0200 +Subject: drop_monitor: Perform cleanup upon probe registration failure + +From: Ido Schimmel + +[ Upstream commit 9398e9c0b1d44eeb700e9e766c02bcc765c82570 ] + +In the rare case that drop_monitor fails to register its probe on the +'napi_poll' tracepoint, it will not deactivate its hysteresis timer as +part of the error path. If the hysteresis timer was armed by the shortly +lived 'kfree_skb' probe and user space retries to initiate tracing, a +warning will be emitted for trying to initialize an active object [1]. + +Fix this by properly undoing all the operations that were done prior to +probe registration, in both software and hardware code paths. + +Note that syzkaller managed to fail probe registration by injecting a +slab allocation failure [2]. + +[1] +ODEBUG: init active (active state 0) object type: timer_list hint: sched_send_work+0x0/0x60 include/linux/list.h:135 +WARNING: CPU: 1 PID: 8649 at lib/debugobjects.c:505 debug_print_object+0x16e/0x250 lib/debugobjects.c:505 +Modules linked in: +CPU: 1 PID: 8649 Comm: syz-executor.0 Not tainted 5.11.0-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:505 +[...] +Call Trace: + __debug_object_init+0x524/0xd10 lib/debugobjects.c:588 + debug_timer_init kernel/time/timer.c:722 [inline] + debug_init kernel/time/timer.c:770 [inline] + init_timer_key+0x2d/0x340 kernel/time/timer.c:814 + net_dm_trace_on_set net/core/drop_monitor.c:1111 [inline] + set_all_monitor_traces net/core/drop_monitor.c:1188 [inline] + net_dm_monitor_start net/core/drop_monitor.c:1295 [inline] + net_dm_cmd_trace+0x720/0x1220 net/core/drop_monitor.c:1339 + genl_family_rcv_msg_doit+0x228/0x320 net/netlink/genetlink.c:739 + genl_family_rcv_msg net/netlink/genetlink.c:783 [inline] + genl_rcv_msg+0x328/0x580 net/netlink/genetlink.c:800 + netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502 + genl_rcv+0x24/0x40 net/netlink/genetlink.c:811 + netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] + netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338 + netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927 + sock_sendmsg_nosec net/socket.c:652 [inline] + sock_sendmsg+0xcf/0x120 net/socket.c:672 + ____sys_sendmsg+0x6e8/0x810 net/socket.c:2348 + ___sys_sendmsg+0xf3/0x170 net/socket.c:2402 + __sys_sendmsg+0xe5/0x1b0 net/socket.c:2435 + do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +[2] + FAULT_INJECTION: forcing a failure. + name failslab, interval 1, probability 0, space 0, times 1 + CPU: 1 PID: 8645 Comm: syz-executor.0 Not tainted 5.11.0-syzkaller #0 + Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 + Call Trace: + dump_stack+0xfa/0x151 + should_fail.cold+0x5/0xa + should_failslab+0x5/0x10 + __kmalloc+0x72/0x3f0 + tracepoint_add_func+0x378/0x990 + tracepoint_probe_register+0x9c/0xe0 + net_dm_cmd_trace+0x7fc/0x1220 + genl_family_rcv_msg_doit+0x228/0x320 + genl_rcv_msg+0x328/0x580 + netlink_rcv_skb+0x153/0x420 + genl_rcv+0x24/0x40 + netlink_unicast+0x533/0x7d0 + netlink_sendmsg+0x856/0xd90 + sock_sendmsg+0xcf/0x120 + ____sys_sendmsg+0x6e8/0x810 + ___sys_sendmsg+0xf3/0x170 + __sys_sendmsg+0xe5/0x1b0 + do_syscall_64+0x2d/0x70 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Fixes: 70c69274f354 ("drop_monitor: Initialize timer and work item upon tracing enable") +Fixes: 8ee2267ad33e ("drop_monitor: Convert to using devlink tracepoint") +Reported-by: syzbot+779559d6503f3a56213d@syzkaller.appspotmail.com +Signed-off-by: Ido Schimmel +Reviewed-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/drop_monitor.c | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) + +diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c +index 571f191c06d9..db65ce62b625 100644 +--- a/net/core/drop_monitor.c ++++ b/net/core/drop_monitor.c +@@ -1053,6 +1053,20 @@ static int net_dm_hw_monitor_start(struct netlink_ext_ack *extack) + return 0; + + err_module_put: ++ for_each_possible_cpu(cpu) { ++ struct per_cpu_dm_data *hw_data = &per_cpu(dm_hw_cpu_data, cpu); ++ struct sk_buff *skb; ++ ++ del_timer_sync(&hw_data->send_timer); ++ cancel_work_sync(&hw_data->dm_alert_work); ++ while ((skb = __skb_dequeue(&hw_data->drop_queue))) { ++ struct devlink_trap_metadata *hw_metadata; ++ ++ hw_metadata = NET_DM_SKB_CB(skb)->hw_metadata; ++ net_dm_hw_metadata_free(hw_metadata); ++ consume_skb(skb); ++ } ++ } + module_put(THIS_MODULE); + return rc; + } +@@ -1134,6 +1148,15 @@ static int net_dm_trace_on_set(struct netlink_ext_ack *extack) + err_unregister_trace: + unregister_trace_kfree_skb(ops->kfree_skb_probe, NULL); + err_module_put: ++ for_each_possible_cpu(cpu) { ++ struct per_cpu_dm_data *data = &per_cpu(dm_cpu_data, cpu); ++ struct sk_buff *skb; ++ ++ del_timer_sync(&data->send_timer); ++ cancel_work_sync(&data->dm_alert_work); ++ while ((skb = __skb_dequeue(&data->drop_queue))) ++ consume_skb(skb); ++ } + module_put(THIS_MODULE); + return rc; + } +-- +2.30.1 + diff --git a/queue-5.10/e1000e-add-rtnl_lock-to-e1000_reset_task.patch b/queue-5.10/e1000e-add-rtnl_lock-to-e1000_reset_task.patch new file mode 100644 index 00000000000..e150a19c78c --- /dev/null +++ b/queue-5.10/e1000e-add-rtnl_lock-to-e1000_reset_task.patch @@ -0,0 +1,54 @@ +From d0e80d96c259d927ca7c3e5ad522e7de0925510b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Oct 2020 14:59:37 +0300 +Subject: e1000e: add rtnl_lock() to e1000_reset_task + +From: Vitaly Lifshits + +[ Upstream commit 21f857f0321d0d0ea9b1a758bd55dc63d1cb2437 ] + +A possible race condition was found in e1000_reset_task, +after discovering a similar issue in igb driver via +commit 024a8168b749 ("igb: reinit_locked() should be called +with rtnl_lock"). + +Added rtnl_lock() and rtnl_unlock() to avoid this. + +Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver (currently for ICH9 devices only)") +Suggested-by: Jakub Kicinski +Signed-off-by: Vitaly Lifshits +Tested-by: Dvora Fuxbrumer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e1000e/netdev.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index e9b82c209c2d..a0948002ddf8 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -5974,15 +5974,19 @@ static void e1000_reset_task(struct work_struct *work) + struct e1000_adapter *adapter; + adapter = container_of(work, struct e1000_adapter, reset_task); + ++ rtnl_lock(); + /* don't run the task if already down */ +- if (test_bit(__E1000_DOWN, &adapter->state)) ++ if (test_bit(__E1000_DOWN, &adapter->state)) { ++ rtnl_unlock(); + return; ++ } + + if (!(adapter->flags & FLAG_RESTART_NOW)) { + e1000e_dump(adapter); + e_err("Reset adapter unexpectedly\n"); + } + e1000e_reinit_locked(adapter); ++ rtnl_unlock(); + } + + /** +-- +2.30.1 + diff --git a/queue-5.10/e1000e-fix-error-handling-in-e1000_set_d0_lplu_state.patch b/queue-5.10/e1000e-fix-error-handling-in-e1000_set_d0_lplu_state.patch new file mode 100644 index 00000000000..28f790dad28 --- /dev/null +++ b/queue-5.10/e1000e-fix-error-handling-in-e1000_set_d0_lplu_state.patch @@ -0,0 +1,40 @@ +From 54d509d39dd3e797a043563328e31c708c1deb9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Feb 2021 17:44:23 +0800 +Subject: e1000e: Fix error handling in e1000_set_d0_lplu_state_82571 + +From: Dinghao Liu + +[ Upstream commit b52912b8293f2c496f42583e65599aee606a0c18 ] + +There is one e1e_wphy() call in e1000_set_d0_lplu_state_82571 +that we have caught its return value but lack further handling. +Check and terminate the execution flow just like other e1e_wphy() +in this function. + +Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver (currently for ICH9 devices only)") +Signed-off-by: Dinghao Liu +Acked-by: Sasha Neftin +Tested-by: Dvora Fuxbrumer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e1000e/82571.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c +index 88faf05e23ba..0b1e890dd583 100644 +--- a/drivers/net/ethernet/intel/e1000e/82571.c ++++ b/drivers/net/ethernet/intel/e1000e/82571.c +@@ -899,6 +899,8 @@ static s32 e1000_set_d0_lplu_state_82571(struct e1000_hw *hw, bool active) + } else { + data &= ~IGP02E1000_PM_D0_LPLU; + ret_val = e1e_wphy(hw, IGP02E1000_PHY_POWER_MGMT, data); ++ if (ret_val) ++ return ret_val; + /* LPLU and SmartSpeed are mutually exclusive. LPLU is used + * during Dx states where the power conservation is most + * important. During driver activity we should enable +-- +2.30.1 + diff --git a/queue-5.10/flow_dissector-fix-byteorder-of-dissected-icmp-id.patch b/queue-5.10/flow_dissector-fix-byteorder-of-dissected-icmp-id.patch new file mode 100644 index 00000000000..c4683924a70 --- /dev/null +++ b/queue-5.10/flow_dissector-fix-byteorder-of-dissected-icmp-id.patch @@ -0,0 +1,42 @@ +From 92b0ec51f9f6e8bc349b12db36c050fd364de983 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 20:08:57 +0000 +Subject: flow_dissector: fix byteorder of dissected ICMP ID + +From: Alexander Lobakin + +[ Upstream commit a25f822285420486f5da434efc8d940d42a83bce ] + +flow_dissector_key_icmp::id is of type u16 (CPU byteorder), +ICMP header has its ID field in network byteorder obviously. +Sparse says: + +net/core/flow_dissector.c:178:43: warning: restricted __be16 degrades to integer + +Convert ID value to CPU byteorder when storing it into +flow_dissector_key_icmp. + +Fixes: 5dec597e5cd0 ("flow_dissector: extract more ICMP information") +Signed-off-by: Alexander Lobakin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/flow_dissector.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c +index e21950a2c897..c79be25b2e0c 100644 +--- a/net/core/flow_dissector.c ++++ b/net/core/flow_dissector.c +@@ -175,7 +175,7 @@ void skb_flow_get_icmp_tci(const struct sk_buff *skb, + * avoid confusion with packets without such field + */ + if (icmp_has_id(ih->type)) +- key_icmp->id = ih->un.echo.id ? : 1; ++ key_icmp->id = ih->un.echo.id ? ntohs(ih->un.echo.id) : 1; + else + key_icmp->id = 0; + } +-- +2.30.1 + diff --git a/queue-5.10/ftgmac100-restart-mac-hw-once.patch b/queue-5.10/ftgmac100-restart-mac-hw-once.patch new file mode 100644 index 00000000000..a50a04b1c7f --- /dev/null +++ b/queue-5.10/ftgmac100-restart-mac-hw-once.patch @@ -0,0 +1,38 @@ +From eb806bfdb4b609d722954837ea7d624c2121c946 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 11:04:05 +1030 +Subject: ftgmac100: Restart MAC HW once + +From: Dylan Hung + +[ Upstream commit 6897087323a2fde46df32917462750c069668b2f ] + +The interrupt handler may set the flag to reset the mac in the future, +but that flag is not cleared once the reset has occurred. + +Fixes: 10cbd6407609 ("ftgmac100: Rework NAPI & interrupts handling") +Signed-off-by: Dylan Hung +Acked-by: Benjamin Herrenschmidt +Reviewed-by: Joel Stanley +Signed-off-by: Joel Stanley +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/faraday/ftgmac100.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c +index 80fb1f537bb3..c9c380c50879 100644 +--- a/drivers/net/ethernet/faraday/ftgmac100.c ++++ b/drivers/net/ethernet/faraday/ftgmac100.c +@@ -1308,6 +1308,7 @@ static int ftgmac100_poll(struct napi_struct *napi, int budget) + */ + if (unlikely(priv->need_mac_restart)) { + ftgmac100_start_hw(priv); ++ priv->need_mac_restart = false; + + /* Re-enable "bad" interrupts */ + iowrite32(FTGMAC100_INT_BAD, +-- +2.30.1 + diff --git a/queue-5.10/ftrace-fix-modify_ftrace_direct.patch b/queue-5.10/ftrace-fix-modify_ftrace_direct.patch new file mode 100644 index 00000000000..5f86c79c322 --- /dev/null +++ b/queue-5.10/ftrace-fix-modify_ftrace_direct.patch @@ -0,0 +1,121 @@ +From 288bf263ef53273c12853c0d4c54a6ffefda1b54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Mar 2021 12:58:15 -0700 +Subject: ftrace: Fix modify_ftrace_direct. + +From: Alexei Starovoitov + +[ Upstream commit 8a141dd7f7060d1e64c14a5257e0babae20ac99b ] + +The following sequence of commands: + register_ftrace_direct(ip, addr1); + modify_ftrace_direct(ip, addr1, addr2); + unregister_ftrace_direct(ip, addr2); +will cause the kernel to warn: +[ 30.179191] WARNING: CPU: 2 PID: 1961 at kernel/trace/ftrace.c:5223 unregister_ftrace_direct+0x130/0x150 +[ 30.180556] CPU: 2 PID: 1961 Comm: test_progs W O 5.12.0-rc2-00378-g86bc10a0a711-dirty #3246 +[ 30.182453] RIP: 0010:unregister_ftrace_direct+0x130/0x150 + +When modify_ftrace_direct() changes the addr from old to new it should update +the addr stored in ftrace_direct_funcs. Otherwise the final +unregister_ftrace_direct() won't find the address and will cause the splat. + +Fixes: 0567d6809182 ("ftrace: Add modify_ftrace_direct()") +Signed-off-by: Alexei Starovoitov +Signed-off-by: Daniel Borkmann +Reviewed-by: Steven Rostedt (VMware) +Link: https://lore.kernel.org/bpf/20210316195815.34714-1-alexei.starovoitov@gmail.com +Signed-off-by: Sasha Levin +--- + kernel/trace/ftrace.c | 43 ++++++++++++++++++++++++++++++++++++++----- + 1 file changed, 38 insertions(+), 5 deletions(-) + +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 9c1bba8cc51b..82041bbf8fc2 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -5045,6 +5045,20 @@ struct ftrace_direct_func *ftrace_find_direct_func(unsigned long addr) + return NULL; + } + ++static struct ftrace_direct_func *ftrace_alloc_direct_func(unsigned long addr) ++{ ++ struct ftrace_direct_func *direct; ++ ++ direct = kmalloc(sizeof(*direct), GFP_KERNEL); ++ if (!direct) ++ return NULL; ++ direct->addr = addr; ++ direct->count = 0; ++ list_add_rcu(&direct->next, &ftrace_direct_funcs); ++ ftrace_direct_func_count++; ++ return direct; ++} ++ + /** + * register_ftrace_direct - Call a custom trampoline directly + * @ip: The address of the nop at the beginning of a function +@@ -5120,15 +5134,11 @@ int register_ftrace_direct(unsigned long ip, unsigned long addr) + + direct = ftrace_find_direct_func(addr); + if (!direct) { +- direct = kmalloc(sizeof(*direct), GFP_KERNEL); ++ direct = ftrace_alloc_direct_func(addr); + if (!direct) { + kfree(entry); + goto out_unlock; + } +- direct->addr = addr; +- direct->count = 0; +- list_add_rcu(&direct->next, &ftrace_direct_funcs); +- ftrace_direct_func_count++; + } + + entry->ip = ip; +@@ -5329,6 +5339,7 @@ int __weak ftrace_modify_direct_caller(struct ftrace_func_entry *entry, + int modify_ftrace_direct(unsigned long ip, + unsigned long old_addr, unsigned long new_addr) + { ++ struct ftrace_direct_func *direct, *new_direct = NULL; + struct ftrace_func_entry *entry; + struct dyn_ftrace *rec; + int ret = -ENODEV; +@@ -5344,6 +5355,20 @@ int modify_ftrace_direct(unsigned long ip, + if (entry->direct != old_addr) + goto out_unlock; + ++ direct = ftrace_find_direct_func(old_addr); ++ if (WARN_ON(!direct)) ++ goto out_unlock; ++ if (direct->count > 1) { ++ ret = -ENOMEM; ++ new_direct = ftrace_alloc_direct_func(new_addr); ++ if (!new_direct) ++ goto out_unlock; ++ direct->count--; ++ new_direct->count++; ++ } else { ++ direct->addr = new_addr; ++ } ++ + /* + * If there's no other ftrace callback on the rec->ip location, + * then it can be changed directly by the architecture. +@@ -5357,6 +5382,14 @@ int modify_ftrace_direct(unsigned long ip, + ret = 0; + } + ++ if (unlikely(ret && new_direct)) { ++ direct->count++; ++ list_del_rcu(&new_direct->next); ++ synchronize_rcu_tasks(); ++ kfree(new_direct); ++ ftrace_direct_func_count--; ++ } ++ + out_unlock: + mutex_unlock(&ftrace_lock); + mutex_unlock(&direct_mutex); +-- +2.30.1 + diff --git a/queue-5.10/igb-avoid-premature-rx-buffer-reuse.patch b/queue-5.10/igb-avoid-premature-rx-buffer-reuse.patch new file mode 100644 index 00000000000..619f914900c --- /dev/null +++ b/queue-5.10/igb-avoid-premature-rx-buffer-reuse.patch @@ -0,0 +1,161 @@ +From e593ddefb42acf4ff5f54a111763944e188899b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jan 2021 13:54:23 -0800 +Subject: igb: avoid premature Rx buffer reuse + +From: Li RongQing + +[ Upstream commit 98dfb02aa22280bd8833836d1b00ab0488fa951f ] + +Igb needs a similar fix as commit 75aab4e10ae6a ("i40e: avoid +premature Rx buffer reuse") + +The page recycle code, incorrectly, relied on that a page fragment +could not be freed inside xdp_do_redirect(). This assumption leads to +that page fragments that are used by the stack/XDP redirect can be +reused and overwritten. + +To avoid this, store the page count prior invoking xdp_do_redirect(). + +Longer explanation: + +Intel NICs have a recycle mechanism. The main idea is that a page is +split into two parts. One part is owned by the driver, one part might +be owned by someone else, such as the stack. + +t0: Page is allocated, and put on the Rx ring + +--------------- +used by NIC ->| upper buffer +(rx_buffer) +--------------- + | lower buffer + +--------------- + page count == USHRT_MAX + rx_buffer->pagecnt_bias == USHRT_MAX + +t1: Buffer is received, and passed to the stack (e.g.) + +--------------- + | upper buff (skb) + +--------------- +used by NIC ->| lower buffer +(rx_buffer) +--------------- + page count == USHRT_MAX + rx_buffer->pagecnt_bias == USHRT_MAX - 1 + +t2: Buffer is received, and redirected + +--------------- + | upper buff (skb) + +--------------- +used by NIC ->| lower buffer +(rx_buffer) +--------------- + +Now, prior calling xdp_do_redirect(): + page count == USHRT_MAX + rx_buffer->pagecnt_bias == USHRT_MAX - 2 + +This means that buffer *cannot* be flipped/reused, because the skb is +still using it. + +The problem arises when xdp_do_redirect() actually frees the +segment. Then we get: + page count == USHRT_MAX - 1 + rx_buffer->pagecnt_bias == USHRT_MAX - 2 + +From a recycle perspective, the buffer can be flipped and reused, +which means that the skb data area is passed to the Rx HW ring! + +To work around this, the page count is stored prior calling +xdp_do_redirect(). + +Fixes: 9cbc948b5a20 ("igb: add XDP support") +Signed-off-by: Li RongQing +Reviewed-by: Alexander Duyck +Tested-by: Vishakha Jambekar +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igb/igb_main.c | 22 +++++++++++++++------- + 1 file changed, 15 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index ebe80ec6e437..fecfcfcf161c 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -8232,7 +8232,8 @@ static inline bool igb_page_is_reserved(struct page *page) + return (page_to_nid(page) != numa_mem_id()) || page_is_pfmemalloc(page); + } + +-static bool igb_can_reuse_rx_page(struct igb_rx_buffer *rx_buffer) ++static bool igb_can_reuse_rx_page(struct igb_rx_buffer *rx_buffer, ++ int rx_buf_pgcnt) + { + unsigned int pagecnt_bias = rx_buffer->pagecnt_bias; + struct page *page = rx_buffer->page; +@@ -8243,7 +8244,7 @@ static bool igb_can_reuse_rx_page(struct igb_rx_buffer *rx_buffer) + + #if (PAGE_SIZE < 8192) + /* if we are only owner of page we can reuse it */ +- if (unlikely((page_ref_count(page) - pagecnt_bias) > 1)) ++ if (unlikely((rx_buf_pgcnt - pagecnt_bias) > 1)) + return false; + #else + #define IGB_LAST_OFFSET \ +@@ -8633,11 +8634,17 @@ static unsigned int igb_rx_offset(struct igb_ring *rx_ring) + } + + static struct igb_rx_buffer *igb_get_rx_buffer(struct igb_ring *rx_ring, +- const unsigned int size) ++ const unsigned int size, int *rx_buf_pgcnt) + { + struct igb_rx_buffer *rx_buffer; + + rx_buffer = &rx_ring->rx_buffer_info[rx_ring->next_to_clean]; ++ *rx_buf_pgcnt = ++#if (PAGE_SIZE < 8192) ++ page_count(rx_buffer->page); ++#else ++ 0; ++#endif + prefetchw(rx_buffer->page); + + /* we are reusing so sync this buffer for CPU use */ +@@ -8653,9 +8660,9 @@ static struct igb_rx_buffer *igb_get_rx_buffer(struct igb_ring *rx_ring, + } + + static void igb_put_rx_buffer(struct igb_ring *rx_ring, +- struct igb_rx_buffer *rx_buffer) ++ struct igb_rx_buffer *rx_buffer, int rx_buf_pgcnt) + { +- if (igb_can_reuse_rx_page(rx_buffer)) { ++ if (igb_can_reuse_rx_page(rx_buffer, rx_buf_pgcnt)) { + /* hand second half of page back to the ring */ + igb_reuse_rx_page(rx_ring, rx_buffer); + } else { +@@ -8682,6 +8689,7 @@ static int igb_clean_rx_irq(struct igb_q_vector *q_vector, const int budget) + u16 cleaned_count = igb_desc_unused(rx_ring); + unsigned int xdp_xmit = 0; + struct xdp_buff xdp; ++ int rx_buf_pgcnt; + + xdp.rxq = &rx_ring->xdp_rxq; + +@@ -8712,7 +8720,7 @@ static int igb_clean_rx_irq(struct igb_q_vector *q_vector, const int budget) + */ + dma_rmb(); + +- rx_buffer = igb_get_rx_buffer(rx_ring, size); ++ rx_buffer = igb_get_rx_buffer(rx_ring, size, &rx_buf_pgcnt); + + /* retrieve a buffer from the ring */ + if (!skb) { +@@ -8755,7 +8763,7 @@ static int igb_clean_rx_irq(struct igb_q_vector *q_vector, const int budget) + break; + } + +- igb_put_rx_buffer(rx_ring, rx_buffer); ++ igb_put_rx_buffer(rx_ring, rx_buffer, rx_buf_pgcnt); + cleaned_count++; + + /* fetch next buffer in frame if non-eop */ +-- +2.30.1 + diff --git a/queue-5.10/igb-check-timestamp-validity.patch b/queue-5.10/igb-check-timestamp-validity.patch new file mode 100644 index 00000000000..77e14c27023 --- /dev/null +++ b/queue-5.10/igb-check-timestamp-validity.patch @@ -0,0 +1,154 @@ +From 497b82461356c709da2184017db3b985b5179c4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 12:51:03 -0800 +Subject: igb: check timestamp validity + +From: Jesse Brandeburg + +[ Upstream commit f0a03a026857d6c7766eb7d5835edbf5523ca15c ] + +Add a couple of checks to make sure timestamping is on and that the +timestamp value from DMA is valid. This avoids any functional issues +that could come from a misinterpreted time stamp. + +One of the functions changed doesn't need a return value added because +there was no value in checking from the calling locations. + +While here, fix a couple of reverse christmas tree issues next to +the code being changed. + +Fixes: f56e7bba22fa ("igb: Pull timestamp from fragment before adding it to skb") +Fixes: 9cbc948b5a20 ("igb: add XDP support") +Signed-off-by: Jesse Brandeburg +Tested-by: Dave Switzer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igb/igb.h | 4 +-- + drivers/net/ethernet/intel/igb/igb_main.c | 11 ++++---- + drivers/net/ethernet/intel/igb/igb_ptp.c | 31 ++++++++++++++++++----- + 3 files changed, 32 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igb/igb.h b/drivers/net/ethernet/intel/igb/igb.h +index aaa954aae574..7bda8c5edea5 100644 +--- a/drivers/net/ethernet/intel/igb/igb.h ++++ b/drivers/net/ethernet/intel/igb/igb.h +@@ -748,8 +748,8 @@ void igb_ptp_suspend(struct igb_adapter *adapter); + void igb_ptp_rx_hang(struct igb_adapter *adapter); + void igb_ptp_tx_hang(struct igb_adapter *adapter); + void igb_ptp_rx_rgtstamp(struct igb_q_vector *q_vector, struct sk_buff *skb); +-void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va, +- struct sk_buff *skb); ++int igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va, ++ struct sk_buff *skb); + int igb_ptp_set_ts_config(struct net_device *netdev, struct ifreq *ifr); + int igb_ptp_get_ts_config(struct net_device *netdev, struct ifreq *ifr); + void igb_set_flag_queue_pairs(struct igb_adapter *, const u32); +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index 0d343d050973..ebe80ec6e437 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -8319,9 +8319,10 @@ static struct sk_buff *igb_construct_skb(struct igb_ring *rx_ring, + return NULL; + + if (unlikely(igb_test_staterr(rx_desc, E1000_RXDADV_STAT_TSIP))) { +- igb_ptp_rx_pktstamp(rx_ring->q_vector, xdp->data, skb); +- xdp->data += IGB_TS_HDR_LEN; +- size -= IGB_TS_HDR_LEN; ++ if (!igb_ptp_rx_pktstamp(rx_ring->q_vector, xdp->data, skb)) { ++ xdp->data += IGB_TS_HDR_LEN; ++ size -= IGB_TS_HDR_LEN; ++ } + } + + /* Determine available headroom for copy */ +@@ -8382,8 +8383,8 @@ static struct sk_buff *igb_build_skb(struct igb_ring *rx_ring, + + /* pull timestamp out of packet data */ + if (igb_test_staterr(rx_desc, E1000_RXDADV_STAT_TSIP)) { +- igb_ptp_rx_pktstamp(rx_ring->q_vector, skb->data, skb); +- __skb_pull(skb, IGB_TS_HDR_LEN); ++ if (!igb_ptp_rx_pktstamp(rx_ring->q_vector, skb->data, skb)) ++ __skb_pull(skb, IGB_TS_HDR_LEN); + } + + /* update buffer offset */ +diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c +index 7cc5428c3b3d..86a576201f5f 100644 +--- a/drivers/net/ethernet/intel/igb/igb_ptp.c ++++ b/drivers/net/ethernet/intel/igb/igb_ptp.c +@@ -856,6 +856,9 @@ static void igb_ptp_tx_hwtstamp(struct igb_adapter *adapter) + dev_kfree_skb_any(skb); + } + ++#define IGB_RET_PTP_DISABLED 1 ++#define IGB_RET_PTP_INVALID 2 ++ + /** + * igb_ptp_rx_pktstamp - retrieve Rx per packet timestamp + * @q_vector: Pointer to interrupt specific structure +@@ -864,19 +867,29 @@ static void igb_ptp_tx_hwtstamp(struct igb_adapter *adapter) + * + * This function is meant to retrieve a timestamp from the first buffer of an + * incoming frame. The value is stored in little endian format starting on +- * byte 8. ++ * byte 8 ++ * ++ * Returns: 0 if success, nonzero if failure + **/ +-void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va, +- struct sk_buff *skb) ++int igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va, ++ struct sk_buff *skb) + { +- __le64 *regval = (__le64 *)va; + struct igb_adapter *adapter = q_vector->adapter; ++ __le64 *regval = (__le64 *)va; + int adjust = 0; + ++ if (!(adapter->ptp_flags & IGB_PTP_ENABLED)) ++ return IGB_RET_PTP_DISABLED; ++ + /* The timestamp is recorded in little endian format. + * DWORD: 0 1 2 3 + * Field: Reserved Reserved SYSTIML SYSTIMH + */ ++ ++ /* check reserved dwords are zero, be/le doesn't matter for zero */ ++ if (regval[0]) ++ return IGB_RET_PTP_INVALID; ++ + igb_ptp_systim_to_hwtstamp(adapter, skb_hwtstamps(skb), + le64_to_cpu(regval[1])); + +@@ -896,6 +909,8 @@ void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va, + } + skb_hwtstamps(skb)->hwtstamp = + ktime_sub_ns(skb_hwtstamps(skb)->hwtstamp, adjust); ++ ++ return 0; + } + + /** +@@ -906,13 +921,15 @@ void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va, + * This function is meant to retrieve a timestamp from the internal registers + * of the adapter and store it in the skb. + **/ +-void igb_ptp_rx_rgtstamp(struct igb_q_vector *q_vector, +- struct sk_buff *skb) ++void igb_ptp_rx_rgtstamp(struct igb_q_vector *q_vector, struct sk_buff *skb) + { + struct igb_adapter *adapter = q_vector->adapter; + struct e1000_hw *hw = &adapter->hw; +- u64 regval; + int adjust = 0; ++ u64 regval; ++ ++ if (!(adapter->ptp_flags & IGB_PTP_ENABLED)) ++ return; + + /* If this bit is set, then the RX registers contain the time stamp. No + * other packet will be time stamped until we read these registers, so +-- +2.30.1 + diff --git a/queue-5.10/igc-fix-igc_ptp_rx_pktstamp.patch b/queue-5.10/igc-fix-igc_ptp_rx_pktstamp.patch new file mode 100644 index 00000000000..d2ca427c4e7 --- /dev/null +++ b/queue-5.10/igc-fix-igc_ptp_rx_pktstamp.patch @@ -0,0 +1,140 @@ +From 2be1f0ffbed2a23ba7d905a7423f5027295aacd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Mar 2021 22:42:56 -0800 +Subject: igc: Fix igc_ptp_rx_pktstamp() + +From: Andre Guedes + +[ Upstream commit fc9e5020971d57d7d0b3fef9e2ab2108fcb5588b ] + +The comment describing the timestamps layout in the packet buffer is +wrong and the code is actually retrieving the timestamp in Timer 1 +reference instead of Timer 0. This hasn't been a big issue so far +because hardware is configured to report both timestamps using Timer 0 +(see IGC_SRRCTL register configuration in igc_ptp_enable_rx_timestamp() +helper). This patch fixes the comment and the code so we retrieve the +timestamp in Timer 0 reference as expected. + +This patch also takes the opportunity to get rid of the hw.mac.type check +since it is not required. + +Fixes: 81b055205e8ba ("igc: Add support for RX timestamping") +Signed-off-by: Andre Guedes +Signed-off-by: Vedang Patel +Signed-off-by: Jithu Joseph +Reviewed-by: Maciej Fijalkowski +Tested-by: Dvora Fuxbrumer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc.h | 2 +- + drivers/net/ethernet/intel/igc/igc_ptp.c | 72 +++++++++++++----------- + 2 files changed, 41 insertions(+), 33 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h +index 35baae900c1f..6dca67d9c25d 100644 +--- a/drivers/net/ethernet/intel/igc/igc.h ++++ b/drivers/net/ethernet/intel/igc/igc.h +@@ -545,7 +545,7 @@ void igc_ptp_init(struct igc_adapter *adapter); + void igc_ptp_reset(struct igc_adapter *adapter); + void igc_ptp_suspend(struct igc_adapter *adapter); + void igc_ptp_stop(struct igc_adapter *adapter); +-void igc_ptp_rx_pktstamp(struct igc_q_vector *q_vector, void *va, ++void igc_ptp_rx_pktstamp(struct igc_q_vector *q_vector, __le32 *va, + struct sk_buff *skb); + int igc_ptp_set_ts_config(struct net_device *netdev, struct ifreq *ifr); + int igc_ptp_get_ts_config(struct net_device *netdev, struct ifreq *ifr); +diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c +index ac0b9c85da7c..545f4d0e67cf 100644 +--- a/drivers/net/ethernet/intel/igc/igc_ptp.c ++++ b/drivers/net/ethernet/intel/igc/igc_ptp.c +@@ -152,46 +152,54 @@ static void igc_ptp_systim_to_hwtstamp(struct igc_adapter *adapter, + } + + /** +- * igc_ptp_rx_pktstamp - retrieve Rx per packet timestamp ++ * igc_ptp_rx_pktstamp - Retrieve timestamp from Rx packet buffer + * @q_vector: Pointer to interrupt specific structure + * @va: Pointer to address containing Rx buffer + * @skb: Buffer containing timestamp and packet + * +- * This function is meant to retrieve the first timestamp from the +- * first buffer of an incoming frame. The value is stored in little +- * endian format starting on byte 0. There's a second timestamp +- * starting on byte 8. +- **/ +-void igc_ptp_rx_pktstamp(struct igc_q_vector *q_vector, void *va, ++ * This function retrieves the timestamp saved in the beginning of packet ++ * buffer. While two timestamps are available, one in timer0 reference and the ++ * other in timer1 reference, this function considers only the timestamp in ++ * timer0 reference. ++ */ ++void igc_ptp_rx_pktstamp(struct igc_q_vector *q_vector, __le32 *va, + struct sk_buff *skb) + { + struct igc_adapter *adapter = q_vector->adapter; +- __le64 *regval = (__le64 *)va; +- int adjust = 0; +- +- /* The timestamp is recorded in little endian format. +- * DWORD: | 0 | 1 | 2 | 3 +- * Field: | Timer0 Low | Timer0 High | Timer1 Low | Timer1 High ++ u64 regval; ++ int adjust; ++ ++ /* Timestamps are saved in little endian at the beginning of the packet ++ * buffer following the layout: ++ * ++ * DWORD: | 0 | 1 | 2 | 3 | ++ * Field: | Timer1 SYSTIML | Timer1 SYSTIMH | Timer0 SYSTIML | Timer0 SYSTIMH | ++ * ++ * SYSTIML holds the nanoseconds part while SYSTIMH holds the seconds ++ * part of the timestamp. + */ +- igc_ptp_systim_to_hwtstamp(adapter, skb_hwtstamps(skb), +- le64_to_cpu(regval[0])); +- +- /* adjust timestamp for the RX latency based on link speed */ +- if (adapter->hw.mac.type == igc_i225) { +- switch (adapter->link_speed) { +- case SPEED_10: +- adjust = IGC_I225_RX_LATENCY_10; +- break; +- case SPEED_100: +- adjust = IGC_I225_RX_LATENCY_100; +- break; +- case SPEED_1000: +- adjust = IGC_I225_RX_LATENCY_1000; +- break; +- case SPEED_2500: +- adjust = IGC_I225_RX_LATENCY_2500; +- break; +- } ++ regval = le32_to_cpu(va[2]); ++ regval |= (u64)le32_to_cpu(va[3]) << 32; ++ igc_ptp_systim_to_hwtstamp(adapter, skb_hwtstamps(skb), regval); ++ ++ /* Adjust timestamp for the RX latency based on link speed */ ++ switch (adapter->link_speed) { ++ case SPEED_10: ++ adjust = IGC_I225_RX_LATENCY_10; ++ break; ++ case SPEED_100: ++ adjust = IGC_I225_RX_LATENCY_100; ++ break; ++ case SPEED_1000: ++ adjust = IGC_I225_RX_LATENCY_1000; ++ break; ++ case SPEED_2500: ++ adjust = IGC_I225_RX_LATENCY_2500; ++ break; ++ default: ++ adjust = 0; ++ netdev_warn_once(adapter->netdev, "Imprecise timestamp\n"); ++ break; + } + skb_hwtstamps(skb)->hwtstamp = + ktime_sub_ns(skb_hwtstamps(skb)->hwtstamp, adjust); +-- +2.30.1 + diff --git a/queue-5.10/igc-fix-pause-frame-advertising.patch b/queue-5.10/igc-fix-pause-frame-advertising.patch new file mode 100644 index 00000000000..08281d99458 --- /dev/null +++ b/queue-5.10/igc-fix-pause-frame-advertising.patch @@ -0,0 +1,48 @@ +From dd72abded0c4b57f16f25e653f78a2dc1084caf1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Feb 2021 00:36:47 +0800 +Subject: igc: Fix Pause Frame Advertising + +From: Muhammad Husaini Zulkifli + +[ Upstream commit 8876529465c368beafd51a70f79d7a738f2aadf4 ] + +Fix Pause Frame Advertising when getting the advertisement via ethtool. +Remove setting the "advertising" bit in link_ksettings during default +case when Tx and Rx are in off state with Auto Negotiate off. + +Below is the original output of advertisement link during Tx and Rx off: +Advertised pause frame use: Symmetric Receive-only + +Expected output: +Advertised pause frame use: No + +Fixes: 8c5ad0dae93c ("igc: Add ethtool support") +Signed-off-by: Muhammad Husaini Zulkifli +Reviewed-by: Malli C +Acked-by: Sasha Neftin +Tested-by: Dvora Fuxbrumer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_ethtool.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c +index ec8cd69d4992..35c104a02bed 100644 +--- a/drivers/net/ethernet/intel/igc/igc_ethtool.c ++++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c +@@ -1709,9 +1709,7 @@ static int igc_ethtool_get_link_ksettings(struct net_device *netdev, + Asym_Pause); + break; + default: +- ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause); +- ethtool_link_ksettings_add_link_mode(cmd, advertising, +- Asym_Pause); ++ break; + } + + status = pm_runtime_suspended(&adapter->pdev->dev) ? +-- +2.30.1 + diff --git a/queue-5.10/igc-fix-supported-pause-frame-link-setting.patch b/queue-5.10/igc-fix-supported-pause-frame-link-setting.patch new file mode 100644 index 00000000000..ade39916dae --- /dev/null +++ b/queue-5.10/igc-fix-supported-pause-frame-link-setting.patch @@ -0,0 +1,47 @@ +From 6146e3c6bf152215e42fd5892241058497f4221c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Feb 2021 00:36:48 +0800 +Subject: igc: Fix Supported Pause Frame Link Setting + +From: Muhammad Husaini Zulkifli + +[ Upstream commit 9a4a1cdc5ab52118c1f2b216f4240830b6528d32 ] + +The Supported Pause Frame always display "No" even though the Advertised +pause frame showing the correct setting based on the pause parameters via +ethtool. Set bit in link_ksettings to "Supported" for Pause Frame. + +Before output: +Supported pause frame use: No + +Expected output: +Supported pause frame use: Symmetric + +Fixes: 8c5ad0dae93c ("igc: Add ethtool support") +Signed-off-by: Muhammad Husaini Zulkifli +Reviewed-by: Malli C +Tested-by: Dvora Fuxbrumer +Acked-by: Sasha Neftin +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_ethtool.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c +index 35c104a02bed..da259cd59add 100644 +--- a/drivers/net/ethernet/intel/igc/igc_ethtool.c ++++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c +@@ -1695,6 +1695,9 @@ static int igc_ethtool_get_link_ksettings(struct net_device *netdev, + Autoneg); + } + ++ /* Set pause flow control settings */ ++ ethtool_link_ksettings_add_link_mode(cmd, supported, Pause); ++ + switch (hw->fc.requested_mode) { + case igc_fc_full: + ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause); +-- +2.30.1 + diff --git a/queue-5.10/igc-reinit_locked-should-be-called-with-rtnl_lock.patch b/queue-5.10/igc-reinit_locked-should-be-called-with-rtnl_lock.patch new file mode 100644 index 00000000000..370d4bfa1b4 --- /dev/null +++ b/queue-5.10/igc-reinit_locked-should-be-called-with-rtnl_lock.patch @@ -0,0 +1,51 @@ +From 60f1fa62a4de62904ead9fd80dab8f93b5f7e7ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Oct 2020 16:34:00 +0300 +Subject: igc: reinit_locked() should be called with rtnl_lock + +From: Sasha Neftin + +[ Upstream commit 6da262378c99b17b1a1ac2e42aa65acc1bd471c7 ] + +This commit applies to the igc_reset_task the same changes that +were applied to the igb driver in commit 024a8168b749 ("igb: +reinit_locked() should be called with rtnl_lock") +and fix possible race in reset subtask. + +Fixes: 0507ef8a0372 ("igc: Add transmit and receive fastpath and interrupt handlers") +Suggested-by: Jakub Kicinski +Signed-off-by: Sasha Neftin +Tested-by: Dvora Fuxbrumer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_main.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c +index b673ac1199bb..7b822cdcc6c5 100644 +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -3846,10 +3846,19 @@ static void igc_reset_task(struct work_struct *work) + + adapter = container_of(work, struct igc_adapter, reset_task); + ++ rtnl_lock(); ++ /* If we're already down or resetting, just bail */ ++ if (test_bit(__IGC_DOWN, &adapter->state) || ++ test_bit(__IGC_RESETTING, &adapter->state)) { ++ rtnl_unlock(); ++ return; ++ } ++ + igc_rings_dump(adapter); + igc_regs_dump(adapter); + netdev_err(adapter->netdev, "Reset adapter\n"); + igc_reinit_locked(adapter); ++ rtnl_unlock(); + } + + /** +-- +2.30.1 + diff --git a/queue-5.10/ionic-linearize-tso-skb-with-too-many-frags.patch b/queue-5.10/ionic-linearize-tso-skb-with-too-many-frags.patch new file mode 100644 index 00000000000..524d3bdd6a0 --- /dev/null +++ b/queue-5.10/ionic-linearize-tso-skb-with-too-many-frags.patch @@ -0,0 +1,64 @@ +From 287476c825efc1d467404b948c2238bfbc75e32e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Mar 2021 17:07:47 -0700 +Subject: ionic: linearize tso skb with too many frags + +From: Shannon Nelson + +[ Upstream commit d2c21422323b06938b3c070361dc544f047489d7 ] + +We were linearizing non-TSO skbs that had too many frags, but +we weren't checking number of frags on TSO skbs. This could +lead to a bad page reference when we received a TSO skb with +more frags than the Tx descriptor could support. + +v2: use gso_segs rather than yet another division + don't rework the check on the nr_frags + +Fixes: 0f3154e6bcb3 ("ionic: Add Tx and Rx handling") +Signed-off-by: Shannon Nelson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +index a81feffb09b8..909eca14f647 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +@@ -1077,15 +1077,17 @@ static int ionic_tx_descs_needed(struct ionic_queue *q, struct sk_buff *skb) + { + int sg_elems = q->lif->qtype_info[IONIC_QTYPE_TXQ].max_sg_elems; + struct ionic_tx_stats *stats = q_to_tx_stats(q); ++ int ndescs; + int err; + +- /* If TSO, need roundup(skb->len/mss) descs */ ++ /* Each desc is mss long max, so a descriptor for each gso_seg */ + if (skb_is_gso(skb)) +- return (skb->len / skb_shinfo(skb)->gso_size) + 1; ++ ndescs = skb_shinfo(skb)->gso_segs; ++ else ++ ndescs = 1; + +- /* If non-TSO, just need 1 desc and nr_frags sg elems */ + if (skb_shinfo(skb)->nr_frags <= sg_elems) +- return 1; ++ return ndescs; + + /* Too many frags, so linearize */ + err = skb_linearize(skb); +@@ -1094,8 +1096,7 @@ static int ionic_tx_descs_needed(struct ionic_queue *q, struct sk_buff *skb) + + stats->linearize++; + +- /* Need 1 desc and zero sg elems */ +- return 1; ++ return ndescs; + } + + static int ionic_maybe_stop_tx(struct ionic_queue *q, int ndescs) +-- +2.30.1 + diff --git a/queue-5.10/ipv6-fix-suspecious-rcu-usage-warning.patch b/queue-5.10/ipv6-fix-suspecious-rcu-usage-warning.patch new file mode 100644 index 00000000000..c25bc747990 --- /dev/null +++ b/queue-5.10/ipv6-fix-suspecious-rcu-usage-warning.patch @@ -0,0 +1,127 @@ +From 3a526bd3d9929f45445521c87ab33eb11387af7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Mar 2021 18:20:35 -0800 +Subject: ipv6: fix suspecious RCU usage warning + +From: Wei Wang + +[ Upstream commit 28259bac7f1dde06d8ba324e222bbec9d4e92f2b ] + +Syzbot reported the suspecious RCU usage in nexthop_fib6_nh() when +called from ipv6_route_seq_show(). The reason is ipv6_route_seq_start() +calls rcu_read_lock_bh(), while nexthop_fib6_nh() calls +rcu_dereference_rtnl(). +The fix proposed is to add a variant of nexthop_fib6_nh() to use +rcu_dereference_bh_rtnl() for ipv6_route_seq_show(). + +The reported trace is as follows: +./include/net/nexthop.h:416 suspicious rcu_dereference_check() usage! + +other info that might help us debug this: + +rcu_scheduler_active = 2, debug_locks = 1 +2 locks held by syz-executor.0/17895: + at: seq_read+0x71/0x12a0 fs/seq_file.c:169 + at: seq_file_net include/linux/seq_file_net.h:19 [inline] + at: ipv6_route_seq_start+0xaf/0x300 net/ipv6/ip6_fib.c:2616 + +stack backtrace: +CPU: 1 PID: 17895 Comm: syz-executor.0 Not tainted 4.15.0-syzkaller #0 +Call Trace: + [] __dump_stack lib/dump_stack.c:17 [inline] + [] dump_stack+0xd8/0x147 lib/dump_stack.c:53 + [] lockdep_rcu_suspicious+0x153/0x15d kernel/locking/lockdep.c:5745 + [] nexthop_fib6_nh include/net/nexthop.h:416 [inline] + [] ipv6_route_native_seq_show net/ipv6/ip6_fib.c:2488 [inline] + [] ipv6_route_seq_show+0x436/0x7a0 net/ipv6/ip6_fib.c:2673 + [] seq_read+0xccf/0x12a0 fs/seq_file.c:276 + [] proc_reg_read+0x10c/0x1d0 fs/proc/inode.c:231 + [] do_loop_readv_writev fs/read_write.c:714 [inline] + [] do_loop_readv_writev fs/read_write.c:701 [inline] + [] do_iter_read+0x49e/0x660 fs/read_write.c:935 + [] vfs_readv+0xfb/0x170 fs/read_write.c:997 + [] kernel_readv fs/splice.c:361 [inline] + [] default_file_splice_read+0x487/0x9c0 fs/splice.c:416 + [] do_splice_to+0x129/0x190 fs/splice.c:879 + [] splice_direct_to_actor+0x256/0x890 fs/splice.c:951 + [] do_splice_direct+0x1dd/0x2b0 fs/splice.c:1060 + [] do_sendfile+0x597/0xce0 fs/read_write.c:1459 + [] SYSC_sendfile64 fs/read_write.c:1520 [inline] + [] SyS_sendfile64+0x155/0x170 fs/read_write.c:1506 + [] do_syscall_64+0x1ff/0x310 arch/x86/entry/common.c:305 + [] entry_SYSCALL_64_after_hwframe+0x42/0xb7 + +Fixes: f88d8ea67fbdb ("ipv6: Plumb support for nexthop object in a fib6_info") +Reported-by: syzbot +Signed-off-by: Wei Wang +Cc: David Ahern +Cc: Ido Schimmel +Cc: Petr Machata +Cc: Eric Dumazet +Reviewed-by: Ido Schimmel +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/nexthop.h | 24 ++++++++++++++++++++++++ + net/ipv6/ip6_fib.c | 2 +- + 2 files changed, 25 insertions(+), 1 deletion(-) + +diff --git a/include/net/nexthop.h b/include/net/nexthop.h +index 2fd76a9b6dc8..4c8c9fe9a3f0 100644 +--- a/include/net/nexthop.h ++++ b/include/net/nexthop.h +@@ -362,6 +362,7 @@ static inline struct fib_nh *fib_info_nh(struct fib_info *fi, int nhsel) + int fib6_check_nexthop(struct nexthop *nh, struct fib6_config *cfg, + struct netlink_ext_ack *extack); + ++/* Caller should either hold rcu_read_lock(), or RTNL. */ + static inline struct fib6_nh *nexthop_fib6_nh(struct nexthop *nh) + { + struct nh_info *nhi; +@@ -382,6 +383,29 @@ static inline struct fib6_nh *nexthop_fib6_nh(struct nexthop *nh) + return NULL; + } + ++/* Variant of nexthop_fib6_nh(). ++ * Caller should either hold rcu_read_lock_bh(), or RTNL. ++ */ ++static inline struct fib6_nh *nexthop_fib6_nh_bh(struct nexthop *nh) ++{ ++ struct nh_info *nhi; ++ ++ if (nh->is_group) { ++ struct nh_group *nh_grp; ++ ++ nh_grp = rcu_dereference_bh_rtnl(nh->nh_grp); ++ nh = nexthop_mpath_select(nh_grp, 0); ++ if (!nh) ++ return NULL; ++ } ++ ++ nhi = rcu_dereference_bh_rtnl(nh->nh_info); ++ if (nhi->family == AF_INET6) ++ return &nhi->fib6_nh; ++ ++ return NULL; ++} ++ + static inline struct net_device *fib6_info_nh_dev(struct fib6_info *f6i) + { + struct fib6_nh *fib6_nh; +diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c +index f43e27555725..1fb79dbde0cb 100644 +--- a/net/ipv6/ip6_fib.c ++++ b/net/ipv6/ip6_fib.c +@@ -2485,7 +2485,7 @@ static int ipv6_route_native_seq_show(struct seq_file *seq, void *v) + const struct net_device *dev; + + if (rt->nh) +- fib6_nh = nexthop_fib6_nh(rt->nh); ++ fib6_nh = nexthop_fib6_nh_bh(rt->nh); + + seq_printf(seq, "%pi6 %02x ", &rt->fib6_dst.addr, rt->fib6_dst.plen); + +-- +2.30.1 + diff --git a/queue-5.10/ipv6-weaken-the-v4mapped-source-check.patch b/queue-5.10/ipv6-weaken-the-v4mapped-source-check.patch new file mode 100644 index 00000000000..fbfc90a0d6f --- /dev/null +++ b/queue-5.10/ipv6-weaken-the-v4mapped-source-check.patch @@ -0,0 +1,119 @@ +From 9c53285dfe6773570b8bb5e9493c9f3388033c9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 09:55:15 -0700 +Subject: ipv6: weaken the v4mapped source check + +From: Jakub Kicinski + +[ Upstream commit dcc32f4f183ab8479041b23a1525d48233df1d43 ] + +This reverts commit 6af1799aaf3f1bc8defedddfa00df3192445bbf3. + +Commit 6af1799aaf3f ("ipv6: drop incoming packets having a v4mapped +source address") introduced an input check against v4mapped addresses. +Use of such addresses on the wire is indeed questionable and not +allowed on public Internet. As the commit pointed out + + https://tools.ietf.org/html/draft-itojun-v6ops-v4mapped-harmful-02 + +lists potential issues. + +Unfortunately there are applications which use v4mapped addresses, +and breaking them is a clear regression. For example v4mapped +addresses (or any semi-valid addresses, really) may be used +for uni-direction event streams or packet export. + +Since the issue which sparked the addition of the check was with +TCP and request_socks in particular push the check down to TCPv6 +and DCCP. This restores the ability to receive UDPv6 packets with +v4mapped address as the source. + +Keep using the IPSTATS_MIB_INHDRERRORS statistic to minimize the +user-visible changes. + +Fixes: 6af1799aaf3f ("ipv6: drop incoming packets having a v4mapped source address") +Reported-by: Sunyi Shao +Signed-off-by: Jakub Kicinski +Acked-by: Mat Martineau +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/dccp/ipv6.c | 5 +++++ + net/ipv6/ip6_input.c | 10 ---------- + net/ipv6/tcp_ipv6.c | 5 +++++ + net/mptcp/subflow.c | 5 +++++ + 4 files changed, 15 insertions(+), 10 deletions(-) + +diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c +index 78ee1b5acf1f..49f4034bf126 100644 +--- a/net/dccp/ipv6.c ++++ b/net/dccp/ipv6.c +@@ -319,6 +319,11 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb) + if (!ipv6_unicast_destination(skb)) + return 0; /* discard, don't send a reset here */ + ++ if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) { ++ __IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS); ++ return 0; ++ } ++ + if (dccp_bad_service_code(sk, service)) { + dcb->dccpd_reset_code = DCCP_RESET_CODE_BAD_SERVICE_CODE; + goto drop; +diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c +index e96304d8a4a7..06d60662717d 100644 +--- a/net/ipv6/ip6_input.c ++++ b/net/ipv6/ip6_input.c +@@ -245,16 +245,6 @@ static struct sk_buff *ip6_rcv_core(struct sk_buff *skb, struct net_device *dev, + if (ipv6_addr_is_multicast(&hdr->saddr)) + goto err; + +- /* While RFC4291 is not explicit about v4mapped addresses +- * in IPv6 headers, it seems clear linux dual-stack +- * model can not deal properly with these. +- * Security models could be fooled by ::ffff:127.0.0.1 for example. +- * +- * https://tools.ietf.org/html/draft-itojun-v6ops-v4mapped-harmful-02 +- */ +- if (ipv6_addr_v4mapped(&hdr->saddr)) +- goto err; +- + skb->transport_header = skb->network_header + sizeof(*hdr); + IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr); + +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 991dc36f95ff..3f9bb6dd1f98 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -1170,6 +1170,11 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb) + if (!ipv6_unicast_destination(skb)) + goto drop; + ++ if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) { ++ __IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS); ++ return 0; ++ } ++ + return tcp_conn_request(&tcp6_request_sock_ops, + &tcp_request_sock_ipv6_ops, sk, skb); + +diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c +index 16adba172fb9..6317b9bc8681 100644 +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -398,6 +398,11 @@ static int subflow_v6_conn_request(struct sock *sk, struct sk_buff *skb) + if (!ipv6_unicast_destination(skb)) + goto drop; + ++ if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) { ++ __IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS); ++ return 0; ++ } ++ + return tcp_conn_request(&mptcp_subflow_request_sock_ops, + &subflow_request_sock_ipv6_ops, sk, skb); + +-- +2.30.1 + diff --git a/queue-5.10/libbpf-fix-btf-dump-of-pointer-to-array-of-struct.patch b/queue-5.10/libbpf-fix-btf-dump-of-pointer-to-array-of-struct.patch new file mode 100644 index 00000000000..458471c8e71 --- /dev/null +++ b/queue-5.10/libbpf-fix-btf-dump-of-pointer-to-array-of-struct.patch @@ -0,0 +1,90 @@ +From 981b57f442f4853fc4745235dab7540dfa232939 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 12:25:54 +0100 +Subject: libbpf: Fix BTF dump of pointer-to-array-of-struct +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jean-Philippe Brucker + +[ Upstream commit 901ee1d750f29a335423eeb9463c3ca461ca18c2 ] + +The vmlinux.h generated from BTF is invalid when building +drivers/phy/ti/phy-gmii-sel.c with clang: + +vmlinux.h:61702:27: error: array type has incomplete element type ‘struct reg_field’ +61702 | const struct reg_field (*regfields)[3]; + | ^~~~~~~~~ + +bpftool generates a forward declaration for this struct regfield, which +compilers aren't happy about. Here's a simplified reproducer: + + struct inner { + int val; + }; + struct outer { + struct inner (*ptr_to_array)[2]; + } A; + +After build with clang -> bpftool btf dump c -> clang/gcc: +./def-clang.h:11:23: error: array has incomplete element type 'struct inner' + struct inner (*ptr_to_array)[2]; + +Member ptr_to_array of struct outer is a pointer to an array of struct +inner. In the DWARF generated by clang, struct outer appears before +struct inner, so when converting BTF of struct outer into C, bpftool +issues a forward declaration to struct inner. With GCC the DWARF info is +reversed so struct inner gets fully defined. + +That forward declaration is not sufficient when compilers handle an +array of the struct, even when it's only used through a pointer. Note +that we can trigger the same issue with an intermediate typedef: + + struct inner { + int val; + }; + typedef struct inner inner2_t[2]; + struct outer { + inner2_t *ptr_to_array; + } A; + +Becomes: + + struct inner; + typedef struct inner inner2_t[2]; + +And causes: + +./def-clang.h:10:30: error: array has incomplete element type 'struct inner' + typedef struct inner inner2_t[2]; + +To fix this, clear through_ptr whenever we encounter an intermediate +array, to make the inner struct part of a strong link and force full +declaration. + +Fixes: 351131b51c7a ("libbpf: add btf_dump API for BTF-to-C conversion") +Signed-off-by: Jean-Philippe Brucker +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20210319112554.794552-2-jean-philippe@linaro.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/btf_dump.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c +index 2f9d685bd522..0911aea4cdbe 100644 +--- a/tools/lib/bpf/btf_dump.c ++++ b/tools/lib/bpf/btf_dump.c +@@ -462,7 +462,7 @@ static int btf_dump_order_type(struct btf_dump *d, __u32 id, bool through_ptr) + return err; + + case BTF_KIND_ARRAY: +- return btf_dump_order_type(d, btf_array(t)->type, through_ptr); ++ return btf_dump_order_type(d, btf_array(t)->type, false); + + case BTF_KIND_STRUCT: + case BTF_KIND_UNION: { +-- +2.30.1 + diff --git a/queue-5.10/libbpf-fix-error-path-in-bpf_object__elf_init.patch b/queue-5.10/libbpf-fix-error-path-in-bpf_object__elf_init.patch new file mode 100644 index 00000000000..a0234aa07e2 --- /dev/null +++ b/queue-5.10/libbpf-fix-error-path-in-bpf_object__elf_init.patch @@ -0,0 +1,38 @@ +From fc3f55223d658fe30ea5d30c6b100f966ff513b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 23:54:14 +0900 +Subject: libbpf: Fix error path in bpf_object__elf_init() + +From: Namhyung Kim + +[ Upstream commit 8f3f5792f2940c16ab63c614b26494c8689c9c1e ] + +When it failed to get section names, it should call into +bpf_object__elf_finish() like others. + +Fixes: 88a82120282b ("libbpf: Factor out common ELF operations and improve logging") +Signed-off-by: Namhyung Kim +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20210317145414.884817-1-namhyung@kernel.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index b954db52bb80..95eef7ebdac5 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -1162,7 +1162,8 @@ static int bpf_object__elf_init(struct bpf_object *obj) + if (!elf_rawdata(elf_getscn(obj->efile.elf, obj->efile.shstrndx), NULL)) { + pr_warn("elf: failed to get section names strings from %s: %s\n", + obj->path, elf_errmsg(-1)); +- return -LIBBPF_ERRNO__FORMAT; ++ err = -LIBBPF_ERRNO__FORMAT; ++ goto errout; + } + + /* Old LLVM set e_machine to EM_NONE */ +-- +2.30.1 + diff --git a/queue-5.10/libbpf-fix-install-flag-order.patch b/queue-5.10/libbpf-fix-install-flag-order.patch new file mode 100644 index 00000000000..75f192589c0 --- /dev/null +++ b/queue-5.10/libbpf-fix-install-flag-order.patch @@ -0,0 +1,41 @@ +From 117101b38308f6d24ad083c950d63ba20cd69b21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 10:30:38 -0800 +Subject: libbpf: Fix INSTALL flag order + +From: Georgi Valkov + +[ Upstream commit e7fb6465d4c8e767e39cbee72464e0060ab3d20c ] + +It was reported ([0]) that having optional -m flag between source and +destination arguments in install command breaks bpftools cross-build +on MacOS. Move -m to the front to fix this issue. + + [0] https://github.com/openwrt/openwrt/pull/3959 + +Fixes: 7110d80d53f4 ("libbpf: Makefile set specified permission mode") +Signed-off-by: Georgi Valkov +Signed-off-by: Andrii Nakryiko +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20210308183038.613432-1-andrii@kernel.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile +index 55bd78b3496f..310f647c2d5b 100644 +--- a/tools/lib/bpf/Makefile ++++ b/tools/lib/bpf/Makefile +@@ -236,7 +236,7 @@ define do_install + if [ ! -d '$(DESTDIR_SQ)$2' ]; then \ + $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$2'; \ + fi; \ +- $(INSTALL) $1 $(if $3,-m $3,) '$(DESTDIR_SQ)$2' ++ $(INSTALL) $(if $3,-m $3,) $1 '$(DESTDIR_SQ)$2' + endef + + install_lib: all_cmd +-- +2.30.1 + diff --git a/queue-5.10/libbpf-use-sock_cloexec-when-opening-the-netlink-soc.patch b/queue-5.10/libbpf-use-sock_cloexec-when-opening-the-netlink-soc.patch new file mode 100644 index 00000000000..853fe561fd4 --- /dev/null +++ b/queue-5.10/libbpf-use-sock_cloexec-when-opening-the-netlink-soc.patch @@ -0,0 +1,42 @@ +From 79b974bfee844067f66e10adfe782407fa07f454 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 17:28:58 +0530 +Subject: libbpf: Use SOCK_CLOEXEC when opening the netlink socket +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kumar Kartikeya Dwivedi + +[ Upstream commit 58bfd95b554f1a23d01228672f86bb489bdbf4ba ] + +Otherwise, there exists a small window between the opening and closing +of the socket fd where it may leak into processes launched by some other +thread. + +Fixes: 949abbe88436 ("libbpf: add function to setup XDP") +Signed-off-by: Kumar Kartikeya Dwivedi +Signed-off-by: Daniel Borkmann +Acked-by: Toke Høiland-Jørgensen +Link: https://lore.kernel.org/bpf/20210317115857.6536-1-memxor@gmail.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/netlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/netlink.c b/tools/lib/bpf/netlink.c +index 4dd73de00b6f..d2cb28e9ef52 100644 +--- a/tools/lib/bpf/netlink.c ++++ b/tools/lib/bpf/netlink.c +@@ -40,7 +40,7 @@ static int libbpf_netlink_open(__u32 *nl_pid) + memset(&sa, 0, sizeof(sa)); + sa.nl_family = AF_NETLINK; + +- sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); ++ sock = socket(AF_NETLINK, SOCK_RAW | SOCK_CLOEXEC, NETLINK_ROUTE); + if (sock < 0) + return -errno; + +-- +2.30.1 + diff --git a/queue-5.10/mac80211-allow-he-operation-to-be-longer-than-expect.patch b/queue-5.10/mac80211-allow-he-operation-to-be-longer-than-expect.patch new file mode 100644 index 00000000000..1a40435415d --- /dev/null +++ b/queue-5.10/mac80211-allow-he-operation-to-be-longer-than-expect.patch @@ -0,0 +1,65 @@ +From b9d3817cd669ee929fa670b9558786a0d773c69e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Feb 2021 13:19:26 +0800 +Subject: mac80211: Allow HE operation to be longer than expected. + +From: Brian Norris + +[ Upstream commit 0f7e90faddeef53a3568f449a0c3992d77510b66 ] + +We observed some Cisco APs sending the following HE Operation IE in +associate response: + + ff 0a 24 f4 3f 00 01 fc ff 00 00 00 + +Its HE operation parameter is 0x003ff4, so the expected total length is +7 which does not match the actual length = 10. This causes association +failing with "HE AP is missing HE Capability/operation." + +According to P802.11ax_D4 Table9-94, HE operation is extensible, and +according to 802.11-2016 10.27.8, STA should discard the part beyond +the maximum length and parse the truncated element. + +Allow HE operation element to be longer than expected to handle this +case and future extensions. + +Fixes: e4d005b80dee ("mac80211: refactor extended element parsing") +Signed-off-by: Brian Norris +Signed-off-by: Yen-lin Lai +Link: https://lore.kernel.org/r/20210223051926.2653301-1-yenlinlai@chromium.org +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/mlme.c | 2 +- + net/mac80211/util.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index 6adfcb9c06dc..3f483e84d5df 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -5023,7 +5023,7 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata, + he_oper_ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION, + ies->data, ies->len); + if (he_oper_ie && +- he_oper_ie[1] == ieee80211_he_oper_size(&he_oper_ie[3])) ++ he_oper_ie[1] >= ieee80211_he_oper_size(&he_oper_ie[3])) + he_oper = (void *)(he_oper_ie + 3); + else + he_oper = NULL; +diff --git a/net/mac80211/util.c b/net/mac80211/util.c +index 94e624e9439b..d8f9fb0646a4 100644 +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -967,7 +967,7 @@ static void ieee80211_parse_extension_element(u32 *crc, + break; + case WLAN_EID_EXT_HE_OPERATION: + if (len >= sizeof(*elems->he_operation) && +- len == ieee80211_he_oper_size(data) - 1) { ++ len >= ieee80211_he_oper_size(data) - 1) { + if (crc) + *crc = crc32_be(*crc, (void *)elem, + elem->datalen + 2); +-- +2.30.1 + diff --git a/queue-5.10/mac80211-fix-rate-mask-reset.patch b/queue-5.10/mac80211-fix-rate-mask-reset.patch new file mode 100644 index 00000000000..e226ce81f57 --- /dev/null +++ b/queue-5.10/mac80211-fix-rate-mask-reset.patch @@ -0,0 +1,57 @@ +From 8305e0f5cd886ca60dd8b106fd7bd05ef5288547 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Feb 2021 11:22:14 +0100 +Subject: mac80211: fix rate mask reset + +From: Johannes Berg + +[ Upstream commit 1944015fe9c1d9fa5e9eb7ffbbb5ef8954d6753b ] + +Coverity reported the strange "if (~...)" condition that's +always true. It suggested that ! was intended instead of ~, +but upon further analysis I'm convinced that what really was +intended was a comparison to 0xff/0xffff (in HT/VHT cases +respectively), since this indicates that all of the rates +are enabled. + +Change the comparison accordingly. + +I'm guessing this never really mattered because a reset to +not having a rate mask is basically equivalent to having a +mask that enables all rates. + +Reported-by: Colin Ian King +Fixes: 2ffbe6d33366 ("mac80211: fix and optimize MCS mask handling") +Fixes: b119ad6e726c ("mac80211: add rate mask logic for vht rates") +Reviewed-by: Colin Ian King +Link: https://lore.kernel.org/r/20210212112213.36b38078f569.I8546a20c80bc1669058eb453e213630b846e107b@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/cfg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 7276e66ae435..2bf6271d9e3f 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -2961,14 +2961,14 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy, + continue; + + for (j = 0; j < IEEE80211_HT_MCS_MASK_LEN; j++) { +- if (~sdata->rc_rateidx_mcs_mask[i][j]) { ++ if (sdata->rc_rateidx_mcs_mask[i][j] != 0xff) { + sdata->rc_has_mcs_mask[i] = true; + break; + } + } + + for (j = 0; j < NL80211_VHT_NSS_MAX; j++) { +- if (~sdata->rc_rateidx_vht_mcs_mask[i][j]) { ++ if (sdata->rc_rateidx_vht_mcs_mask[i][j] != 0xffff) { + sdata->rc_has_vht_mcs_mask[i] = true; + break; + } +-- +2.30.1 + diff --git a/queue-5.10/macvlan-macvlan_count_rx-needs-to-be-aware-of-preemp.patch b/queue-5.10/macvlan-macvlan_count_rx-needs-to-be-aware-of-preemp.patch new file mode 100644 index 00000000000..a275bac4787 --- /dev/null +++ b/queue-5.10/macvlan-macvlan_count_rx-needs-to-be-aware-of-preemp.patch @@ -0,0 +1,89 @@ +From b0f9d8da45d9b63bebe10fc470599ba8ca08da8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 01:56:36 -0800 +Subject: macvlan: macvlan_count_rx() needs to be aware of preemption + +From: Eric Dumazet + +[ Upstream commit dd4fa1dae9f4847cc1fd78ca468ad69e16e5db3e ] + +macvlan_count_rx() can be called from process context, it is thus +necessary to disable preemption before calling u64_stats_update_begin() + +syzbot was able to spot this on 32bit arch: + +WARNING: CPU: 1 PID: 4632 at include/linux/seqlock.h:271 __seqprop_assert include/linux/seqlock.h:271 [inline] +WARNING: CPU: 1 PID: 4632 at include/linux/seqlock.h:271 __seqprop_assert.constprop.0+0xf0/0x11c include/linux/seqlock.h:269 +Modules linked in: +Kernel panic - not syncing: panic_on_warn set ... +CPU: 1 PID: 4632 Comm: kworker/1:3 Not tainted 5.12.0-rc2-syzkaller #0 +Hardware name: ARM-Versatile Express +Workqueue: events macvlan_process_broadcast +Backtrace: +[<82740468>] (dump_backtrace) from [<827406dc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:252) + r7:00000080 r6:60000093 r5:00000000 r4:8422a3c4 +[<827406c4>] (show_stack) from [<82751b58>] (__dump_stack lib/dump_stack.c:79 [inline]) +[<827406c4>] (show_stack) from [<82751b58>] (dump_stack+0xb8/0xe8 lib/dump_stack.c:120) +[<82751aa0>] (dump_stack) from [<82741270>] (panic+0x130/0x378 kernel/panic.c:231) + r7:830209b4 r6:84069ea4 r5:00000000 r4:844350d0 +[<82741140>] (panic) from [<80244924>] (__warn+0xb0/0x164 kernel/panic.c:605) + r3:8404ec8c r2:00000000 r1:00000000 r0:830209b4 + r7:0000010f +[<80244874>] (__warn) from [<82741520>] (warn_slowpath_fmt+0x68/0xd4 kernel/panic.c:628) + r7:81363f70 r6:0000010f r5:83018e50 r4:00000000 +[<827414bc>] (warn_slowpath_fmt) from [<81363f70>] (__seqprop_assert include/linux/seqlock.h:271 [inline]) +[<827414bc>] (warn_slowpath_fmt) from [<81363f70>] (__seqprop_assert.constprop.0+0xf0/0x11c include/linux/seqlock.h:269) + r8:5a109000 r7:0000000f r6:a568dac0 r5:89802300 r4:00000001 +[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (u64_stats_update_begin include/linux/u64_stats_sync.h:128 [inline]) +[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (macvlan_count_rx include/linux/if_macvlan.h:47 [inline]) +[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (macvlan_broadcast+0x154/0x26c drivers/net/macvlan.c:291) + r5:89802300 r4:8a927740 +[<8136499c>] (macvlan_broadcast) from [<81365020>] (macvlan_process_broadcast+0x258/0x2d0 drivers/net/macvlan.c:317) + r10:81364f78 r9:8a86d000 r8:8a9c7e7c r7:8413aa5c r6:00000000 r5:00000000 + r4:89802840 +[<81364dc8>] (macvlan_process_broadcast) from [<802696a4>] (process_one_work+0x2d4/0x998 kernel/workqueue.c:2275) + r10:00000008 r9:8404ec98 r8:84367a02 r7:ddfe6400 r6:ddfe2d40 r5:898dac80 + r4:8a86d43c +[<802693d0>] (process_one_work) from [<80269dcc>] (worker_thread+0x64/0x54c kernel/workqueue.c:2421) + r10:00000008 r9:8a9c6000 r8:84006d00 r7:ddfe2d78 r6:898dac94 r5:ddfe2d40 + r4:898dac80 +[<80269d68>] (worker_thread) from [<80271f40>] (kthread+0x184/0x1a4 kernel/kthread.c:292) + r10:85247e64 r9:898dac80 r8:80269d68 r7:00000000 r6:8a9c6000 r5:89a2ee40 + r4:8a97bd00 +[<80271dbc>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:158) +Exception stack(0x8a9c7fb0 to 0x8a9c7ff8) + +Fixes: 412ca1550cbe ("macvlan: Move broadcasts into a work queue") +Signed-off-by: Eric Dumazet +Cc: Herbert Xu +Reported-by: syzbot +Acked-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/if_macvlan.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/linux/if_macvlan.h b/include/linux/if_macvlan.h +index a367ead4bf4b..e11555989090 100644 +--- a/include/linux/if_macvlan.h ++++ b/include/linux/if_macvlan.h +@@ -42,13 +42,14 @@ static inline void macvlan_count_rx(const struct macvlan_dev *vlan, + if (likely(success)) { + struct vlan_pcpu_stats *pcpu_stats; + +- pcpu_stats = this_cpu_ptr(vlan->pcpu_stats); ++ pcpu_stats = get_cpu_ptr(vlan->pcpu_stats); + u64_stats_update_begin(&pcpu_stats->syncp); + pcpu_stats->rx_packets++; + pcpu_stats->rx_bytes += len; + if (multicast) + pcpu_stats->rx_multicast++; + u64_stats_update_end(&pcpu_stats->syncp); ++ put_cpu_ptr(vlan->pcpu_stats); + } else { + this_cpu_inc(vlan->pcpu_stats->rx_errors); + } +-- +2.30.1 + diff --git a/queue-5.10/mm-mmu_notifiers-ensure-range_end-is-paired-with-ran.patch b/queue-5.10/mm-mmu_notifiers-ensure-range_end-is-paired-with-ran.patch new file mode 100644 index 00000000000..38445fdd529 --- /dev/null +++ b/queue-5.10/mm-mmu_notifiers-ensure-range_end-is-paired-with-ran.patch @@ -0,0 +1,126 @@ +From a34eea92637f7a2c13e2af6d20280163adcb0060 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 21:37:23 -0700 +Subject: mm/mmu_notifiers: ensure range_end() is paired with range_start() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sean Christopherson + +[ Upstream commit c2655835fd8cabdfe7dab737253de3ffb88da126 ] + +If one or more notifiers fails .invalidate_range_start(), invoke +.invalidate_range_end() for "all" notifiers. If there are multiple +notifiers, those that did not fail are expecting _start() and _end() to +be paired, e.g. KVM's mmu_notifier_count would become imbalanced. +Disallow notifiers that can fail _start() from implementing _end() so +that it's unnecessary to either track which notifiers rejected _start(), +or had already succeeded prior to a failed _start(). + +Note, the existing behavior of calling _start() on all notifiers even +after a previous notifier failed _start() was an unintented "feature". +Make it canon now that the behavior is depended on for correctness. + +As of today, the bug is likely benign: + + 1. The only caller of the non-blocking notifier is OOM kill. + 2. The only notifiers that can fail _start() are the i915 and Nouveau + drivers. + 3. The only notifiers that utilize _end() are the SGI UV GRU driver + and KVM. + 4. The GRU driver will never coincide with the i195/Nouveau drivers. + 5. An imbalanced kvm->mmu_notifier_count only causes soft lockup in the + _guest_, and the guest is already doomed due to being an OOM victim. + +Fix the bug now to play nice with future usage, e.g. KVM has a +potential use case for blocking memslot updates in KVM while an +invalidation is in-progress, and failure to unblock would result in said +updates being blocked indefinitely and hanging. + +Found by inspection. Verified by adding a second notifier in KVM that +periodically returns -EAGAIN on non-blockable ranges, triggering OOM, +and observing that KVM exits with an elevated notifier count. + +Link: https://lkml.kernel.org/r/20210311180057.1582638-1-seanjc@google.com +Fixes: 93065ac753e4 ("mm, oom: distinguish blockable mode for mmu notifiers") +Signed-off-by: Sean Christopherson +Suggested-by: Jason Gunthorpe +Reviewed-by: Jason Gunthorpe +Cc: David Rientjes +Cc: Ben Gardon +Cc: Michal Hocko +Cc: "Jérôme Glisse" +Cc: Andrea Arcangeli +Cc: Johannes Weiner +Cc: Dimitri Sivanich +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/linux/mmu_notifier.h | 10 +++++----- + mm/mmu_notifier.c | 23 +++++++++++++++++++++++ + 2 files changed, 28 insertions(+), 5 deletions(-) + +diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h +index b8200782dede..1a6a9eb6d3fa 100644 +--- a/include/linux/mmu_notifier.h ++++ b/include/linux/mmu_notifier.h +@@ -169,11 +169,11 @@ struct mmu_notifier_ops { + * the last refcount is dropped. + * + * If blockable argument is set to false then the callback cannot +- * sleep and has to return with -EAGAIN. 0 should be returned +- * otherwise. Please note that if invalidate_range_start approves +- * a non-blocking behavior then the same applies to +- * invalidate_range_end. +- * ++ * sleep and has to return with -EAGAIN if sleeping would be required. ++ * 0 should be returned otherwise. Please note that notifiers that can ++ * fail invalidate_range_start are not allowed to implement ++ * invalidate_range_end, as there is no mechanism for informing the ++ * notifier that its start failed. + */ + int (*invalidate_range_start)(struct mmu_notifier *subscription, + const struct mmu_notifier_range *range); +diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c +index 5654dd19addc..07f42a7a6065 100644 +--- a/mm/mmu_notifier.c ++++ b/mm/mmu_notifier.c +@@ -501,10 +501,33 @@ static int mn_hlist_invalidate_range_start( + ""); + WARN_ON(mmu_notifier_range_blockable(range) || + _ret != -EAGAIN); ++ /* ++ * We call all the notifiers on any EAGAIN, ++ * there is no way for a notifier to know if ++ * its start method failed, thus a start that ++ * does EAGAIN can't also do end. ++ */ ++ WARN_ON(ops->invalidate_range_end); + ret = _ret; + } + } + } ++ ++ if (ret) { ++ /* ++ * Must be non-blocking to get here. If there are multiple ++ * notifiers and one or more failed start, any that succeeded ++ * start are expecting their end to be called. Do so now. ++ */ ++ hlist_for_each_entry_rcu(subscription, &subscriptions->list, ++ hlist, srcu_read_lock_held(&srcu)) { ++ if (!subscription->ops->invalidate_range_end) ++ continue; ++ ++ subscription->ops->invalidate_range_end(subscription, ++ range); ++ } ++ } + srcu_read_unlock(&srcu, id); + + return ret; +-- +2.30.1 + diff --git a/queue-5.10/net-axienet-fix-probe-error-cleanup.patch b/queue-5.10/net-axienet-fix-probe-error-cleanup.patch new file mode 100644 index 00000000000..e39284dd58b --- /dev/null +++ b/queue-5.10/net-axienet-fix-probe-error-cleanup.patch @@ -0,0 +1,133 @@ +From d136245108dbf77d782dc64b91f69c307eceeda7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Mar 2021 14:05:18 -0600 +Subject: net: axienet: Fix probe error cleanup + +From: Robert Hancock + +[ Upstream commit 59cd4f19267a0aab87a8c07e4426eb7187ee548d ] + +The driver did not always clean up all allocated resources when probe +failed. Fix the probe cleanup path to clean up everything that was +allocated. + +Fixes: 57baf8cc70ea ("net: axienet: Handle deferred probe on clock properly") +Signed-off-by: Robert Hancock +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/xilinx/xilinx_axienet_main.c | 35 +++++++++++++------ + 1 file changed, 24 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +index 415676c2c11f..69c79cc24e6e 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +@@ -1848,7 +1848,7 @@ static int axienet_probe(struct platform_device *pdev) + if (IS_ERR(lp->regs)) { + dev_err(&pdev->dev, "could not map Axi Ethernet regs.\n"); + ret = PTR_ERR(lp->regs); +- goto free_netdev; ++ goto cleanup_clk; + } + lp->regs_start = ethres->start; + +@@ -1923,12 +1923,12 @@ static int axienet_probe(struct platform_device *pdev) + break; + default: + ret = -EINVAL; +- goto free_netdev; ++ goto cleanup_clk; + } + } else { + ret = of_get_phy_mode(pdev->dev.of_node, &lp->phy_mode); + if (ret) +- goto free_netdev; ++ goto cleanup_clk; + } + + /* Find the DMA node, map the DMA registers, and decode the DMA IRQs */ +@@ -1941,7 +1941,7 @@ static int axienet_probe(struct platform_device *pdev) + dev_err(&pdev->dev, + "unable to get DMA resource\n"); + of_node_put(np); +- goto free_netdev; ++ goto cleanup_clk; + } + lp->dma_regs = devm_ioremap_resource(&pdev->dev, + &dmares); +@@ -1961,12 +1961,12 @@ static int axienet_probe(struct platform_device *pdev) + if (IS_ERR(lp->dma_regs)) { + dev_err(&pdev->dev, "could not map DMA regs\n"); + ret = PTR_ERR(lp->dma_regs); +- goto free_netdev; ++ goto cleanup_clk; + } + if ((lp->rx_irq <= 0) || (lp->tx_irq <= 0)) { + dev_err(&pdev->dev, "could not determine irqs\n"); + ret = -ENOMEM; +- goto free_netdev; ++ goto cleanup_clk; + } + + /* Autodetect the need for 64-bit DMA pointers. +@@ -1996,7 +1996,7 @@ static int axienet_probe(struct platform_device *pdev) + ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(addr_width)); + if (ret) { + dev_err(&pdev->dev, "No suitable DMA available\n"); +- goto free_netdev; ++ goto cleanup_clk; + } + + /* Check for Ethernet core IRQ (optional) */ +@@ -2027,12 +2027,12 @@ static int axienet_probe(struct platform_device *pdev) + if (!lp->phy_node) { + dev_err(&pdev->dev, "phy-handle required for 1000BaseX/SGMII\n"); + ret = -EINVAL; +- goto free_netdev; ++ goto cleanup_mdio; + } + lp->pcs_phy = of_mdio_find_device(lp->phy_node); + if (!lp->pcs_phy) { + ret = -EPROBE_DEFER; +- goto free_netdev; ++ goto cleanup_mdio; + } + lp->phylink_config.pcs_poll = true; + } +@@ -2046,17 +2046,30 @@ static int axienet_probe(struct platform_device *pdev) + if (IS_ERR(lp->phylink)) { + ret = PTR_ERR(lp->phylink); + dev_err(&pdev->dev, "phylink_create error (%i)\n", ret); +- goto free_netdev; ++ goto cleanup_mdio; + } + + ret = register_netdev(lp->ndev); + if (ret) { + dev_err(lp->dev, "register_netdev() error (%i)\n", ret); +- goto free_netdev; ++ goto cleanup_phylink; + } + + return 0; + ++cleanup_phylink: ++ phylink_destroy(lp->phylink); ++ ++cleanup_mdio: ++ if (lp->pcs_phy) ++ put_device(&lp->pcs_phy->dev); ++ if (lp->mii_bus) ++ axienet_mdio_teardown(lp); ++ of_node_put(lp->phy_node); ++ ++cleanup_clk: ++ clk_disable_unprepare(lp->clk); ++ + free_netdev: + free_netdev(ndev); + +-- +2.30.1 + diff --git a/queue-5.10/net-axienet-properly-handle-pcs-pma-phy-for-1000base.patch b/queue-5.10/net-axienet-properly-handle-pcs-pma-phy-for-1000base.patch new file mode 100644 index 00000000000..e60a9f7fd6c --- /dev/null +++ b/queue-5.10/net-axienet-properly-handle-pcs-pma-phy-for-1000base.patch @@ -0,0 +1,177 @@ +From c30f879d723848cb35d441308799b5fff5fad045 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 11:14:29 -0600 +Subject: net: axienet: Properly handle PCS/PMA PHY for 1000BaseX mode + +From: Robert Hancock + +[ Upstream commit 1a02556086fc0eb16e0a0d09043e9ffb0e31c7db ] + +Update the axienet driver to properly support the Xilinx PCS/PMA PHY +component which is used for 1000BaseX and SGMII modes, including +properly configuring the auto-negotiation mode of the PHY and reading +the negotiated state from the PHY. + +Signed-off-by: Robert Hancock +Reviewed-by: Radhey Shyam Pandey +Link: https://lore.kernel.org/r/20201028171429.1699922-1-robert.hancock@calian.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/xilinx/xilinx_axienet.h | 3 + + .../net/ethernet/xilinx/xilinx_axienet_main.c | 94 ++++++++++++++----- + 2 files changed, 71 insertions(+), 26 deletions(-) + +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet.h b/drivers/net/ethernet/xilinx/xilinx_axienet.h +index f34c7903ff52..7326ad4d5e1c 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet.h ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet.h +@@ -419,6 +419,9 @@ struct axienet_local { + struct phylink *phylink; + struct phylink_config phylink_config; + ++ /* Reference to PCS/PMA PHY if used */ ++ struct mdio_device *pcs_phy; ++ + /* Clock for AXI bus */ + struct clk *clk; + +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +index eea0bb7c23ed..415676c2c11f 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +@@ -1517,10 +1517,27 @@ static void axienet_validate(struct phylink_config *config, + + phylink_set(mask, Asym_Pause); + phylink_set(mask, Pause); +- phylink_set(mask, 1000baseX_Full); +- phylink_set(mask, 10baseT_Full); +- phylink_set(mask, 100baseT_Full); +- phylink_set(mask, 1000baseT_Full); ++ ++ switch (state->interface) { ++ case PHY_INTERFACE_MODE_NA: ++ case PHY_INTERFACE_MODE_1000BASEX: ++ case PHY_INTERFACE_MODE_SGMII: ++ case PHY_INTERFACE_MODE_GMII: ++ case PHY_INTERFACE_MODE_RGMII: ++ case PHY_INTERFACE_MODE_RGMII_ID: ++ case PHY_INTERFACE_MODE_RGMII_RXID: ++ case PHY_INTERFACE_MODE_RGMII_TXID: ++ phylink_set(mask, 1000baseX_Full); ++ phylink_set(mask, 1000baseT_Full); ++ if (state->interface == PHY_INTERFACE_MODE_1000BASEX) ++ break; ++ fallthrough; ++ case PHY_INTERFACE_MODE_MII: ++ phylink_set(mask, 100baseT_Full); ++ phylink_set(mask, 10baseT_Full); ++ default: ++ break; ++ } + + bitmap_and(supported, supported, mask, + __ETHTOOL_LINK_MODE_MASK_NBITS); +@@ -1533,38 +1550,46 @@ static void axienet_mac_pcs_get_state(struct phylink_config *config, + { + struct net_device *ndev = to_net_dev(config->dev); + struct axienet_local *lp = netdev_priv(ndev); +- u32 emmc_reg, fcc_reg; +- +- state->interface = lp->phy_mode; +- +- emmc_reg = axienet_ior(lp, XAE_EMMC_OFFSET); +- if (emmc_reg & XAE_EMMC_LINKSPD_1000) +- state->speed = SPEED_1000; +- else if (emmc_reg & XAE_EMMC_LINKSPD_100) +- state->speed = SPEED_100; +- else +- state->speed = SPEED_10; +- +- state->pause = 0; +- fcc_reg = axienet_ior(lp, XAE_FCC_OFFSET); +- if (fcc_reg & XAE_FCC_FCTX_MASK) +- state->pause |= MLO_PAUSE_TX; +- if (fcc_reg & XAE_FCC_FCRX_MASK) +- state->pause |= MLO_PAUSE_RX; + +- state->an_complete = 0; +- state->duplex = 1; ++ switch (state->interface) { ++ case PHY_INTERFACE_MODE_SGMII: ++ case PHY_INTERFACE_MODE_1000BASEX: ++ phylink_mii_c22_pcs_get_state(lp->pcs_phy, state); ++ break; ++ default: ++ break; ++ } + } + + static void axienet_mac_an_restart(struct phylink_config *config) + { +- /* Unsupported, do nothing */ ++ struct net_device *ndev = to_net_dev(config->dev); ++ struct axienet_local *lp = netdev_priv(ndev); ++ ++ phylink_mii_c22_pcs_an_restart(lp->pcs_phy); + } + + static void axienet_mac_config(struct phylink_config *config, unsigned int mode, + const struct phylink_link_state *state) + { +- /* nothing meaningful to do */ ++ struct net_device *ndev = to_net_dev(config->dev); ++ struct axienet_local *lp = netdev_priv(ndev); ++ int ret; ++ ++ switch (state->interface) { ++ case PHY_INTERFACE_MODE_SGMII: ++ case PHY_INTERFACE_MODE_1000BASEX: ++ ret = phylink_mii_c22_pcs_config(lp->pcs_phy, mode, ++ state->interface, ++ state->advertising); ++ if (ret < 0) ++ netdev_warn(ndev, "Failed to configure PCS: %d\n", ++ ret); ++ break; ++ ++ default: ++ break; ++ } + } + + static void axienet_mac_link_down(struct phylink_config *config, +@@ -1997,6 +2022,20 @@ static int axienet_probe(struct platform_device *pdev) + dev_warn(&pdev->dev, + "error registering MDIO bus: %d\n", ret); + } ++ if (lp->phy_mode == PHY_INTERFACE_MODE_SGMII || ++ lp->phy_mode == PHY_INTERFACE_MODE_1000BASEX) { ++ if (!lp->phy_node) { ++ dev_err(&pdev->dev, "phy-handle required for 1000BaseX/SGMII\n"); ++ ret = -EINVAL; ++ goto free_netdev; ++ } ++ lp->pcs_phy = of_mdio_find_device(lp->phy_node); ++ if (!lp->pcs_phy) { ++ ret = -EPROBE_DEFER; ++ goto free_netdev; ++ } ++ lp->phylink_config.pcs_poll = true; ++ } + + lp->phylink_config.dev = &ndev->dev; + lp->phylink_config.type = PHYLINK_NETDEV; +@@ -2034,6 +2073,9 @@ static int axienet_remove(struct platform_device *pdev) + if (lp->phylink) + phylink_destroy(lp->phylink); + ++ if (lp->pcs_phy) ++ put_device(&lp->pcs_phy->dev); ++ + axienet_mdio_teardown(lp); + + clk_disable_unprepare(lp->clk); +-- +2.30.1 + diff --git a/queue-5.10/net-bpf-fix-ip6ip6-crash-with-collect_md-populated-s.patch b/queue-5.10/net-bpf-fix-ip6ip6-crash-with-collect_md-populated-s.patch new file mode 100644 index 00000000000..2d76548b9aa --- /dev/null +++ b/queue-5.10/net-bpf-fix-ip6ip6-crash-with-collect_md-populated-s.patch @@ -0,0 +1,90 @@ +From 89ea5a5f2609c184c85f89dfd2b84cafac93f5c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 01:38:10 +0100 +Subject: net, bpf: Fix ip6ip6 crash with collect_md populated skbs + +From: Daniel Borkmann + +[ Upstream commit a188bb5638d41aa99090ebf2f85d3505ab13fba5 ] + +I ran into a crash where setting up a ip6ip6 tunnel device which was /not/ +set to collect_md mode was receiving collect_md populated skbs for xmit. + +The BPF prog was populating the skb via bpf_skb_set_tunnel_key() which is +assigning special metadata dst entry and then redirecting the skb to the +device, taking ip6_tnl_start_xmit() -> ipxip6_tnl_xmit() -> ip6_tnl_xmit() +and in the latter it performs a neigh lookup based on skb_dst(skb) where +we trigger a NULL pointer dereference on dst->ops->neigh_lookup() since +the md_dst_ops do not populate neigh_lookup callback with a fake handler. + +Transform the md_dst_ops into generic dst_blackhole_ops that can also be +reused elsewhere when needed, and use them for the metadata dst entries as +callback ops. + +Also, remove the dst_md_discard{,_out}() ops and rely on dst_discard{,_out}() +from dst_init() which free the skb the same way modulo the splat. Given we +will be able to recover just fine from there, avoid any potential splats +iff this gets ever triggered in future (or worse, panic on warns when set). + +Fixes: f38a9eb1f77b ("dst: Metadata destinations") +Signed-off-by: Daniel Borkmann +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/dst.c | 31 +++++++++---------------------- + 1 file changed, 9 insertions(+), 22 deletions(-) + +diff --git a/net/core/dst.c b/net/core/dst.c +index 5f6315601776..fb3bcba87744 100644 +--- a/net/core/dst.c ++++ b/net/core/dst.c +@@ -275,37 +275,24 @@ unsigned int dst_blackhole_mtu(const struct dst_entry *dst) + } + EXPORT_SYMBOL_GPL(dst_blackhole_mtu); + +-static struct dst_ops md_dst_ops = { +- .family = AF_UNSPEC, ++static struct dst_ops dst_blackhole_ops = { ++ .family = AF_UNSPEC, ++ .neigh_lookup = dst_blackhole_neigh_lookup, ++ .check = dst_blackhole_check, ++ .cow_metrics = dst_blackhole_cow_metrics, ++ .update_pmtu = dst_blackhole_update_pmtu, ++ .redirect = dst_blackhole_redirect, ++ .mtu = dst_blackhole_mtu, + }; + +-static int dst_md_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb) +-{ +- WARN_ONCE(1, "Attempting to call output on metadata dst\n"); +- kfree_skb(skb); +- return 0; +-} +- +-static int dst_md_discard(struct sk_buff *skb) +-{ +- WARN_ONCE(1, "Attempting to call input on metadata dst\n"); +- kfree_skb(skb); +- return 0; +-} +- + static void __metadata_dst_init(struct metadata_dst *md_dst, + enum metadata_type type, u8 optslen) +- + { + struct dst_entry *dst; + + dst = &md_dst->dst; +- dst_init(dst, &md_dst_ops, NULL, 1, DST_OBSOLETE_NONE, ++ dst_init(dst, &dst_blackhole_ops, NULL, 1, DST_OBSOLETE_NONE, + DST_METADATA | DST_NOCOUNT); +- +- dst->input = dst_md_discard; +- dst->output = dst_md_discard_out; +- + memset(dst + 1, 0, sizeof(*md_dst) + optslen - sizeof(*dst)); + md_dst->type = type; + } +-- +2.30.1 + diff --git a/queue-5.10/net-bridge-don-t-notify-switchdev-for-local-fdb-addr.patch b/queue-5.10/net-bridge-don-t-notify-switchdev-for-local-fdb-addr.patch new file mode 100644 index 00000000000..b07ae75e802 --- /dev/null +++ b/queue-5.10/net-bridge-don-t-notify-switchdev-for-local-fdb-addr.patch @@ -0,0 +1,75 @@ +From 91ab7e940755e1ebf2479aa7293afd81c7e24e90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Mar 2021 20:21:08 +0200 +Subject: net: bridge: don't notify switchdev for local FDB addresses + +From: Vladimir Oltean + +[ Upstream commit 6ab4c3117aec4e08007d9e971fa4133e1de1082d ] + +As explained in this discussion: +https://lore.kernel.org/netdev/20210117193009.io3nungdwuzmo5f7@skbuf/ + +the switchdev notifiers for FDB entries managed to have a zero-day bug. +The bridge would not say that this entry is local: + +ip link add br0 type bridge +ip link set swp0 master br0 +bridge fdb add dev swp0 00:01:02:03:04:05 master local + +and the switchdev driver would be more than happy to offload it as a +normal static FDB entry. This is despite the fact that 'local' and +non-'local' entries have completely opposite directions: a local entry +is locally terminated and not forwarded, whereas a static entry is +forwarded and not locally terminated. So, for example, DSA would install +this entry on swp0 instead of installing it on the CPU port as it should. + +There is an even sadder part, which is that the 'local' flag is implicit +if 'static' is not specified, meaning that this command produces the +same result of adding a 'local' entry: + +bridge fdb add dev swp0 00:01:02:03:04:05 master + +I've updated the man pages for 'bridge', and after reading it now, it +should be pretty clear to any user that the commands above were broken +and should have never resulted in the 00:01:02:03:04:05 address being +forwarded (this behavior is coherent with non-switchdev interfaces): +https://patchwork.kernel.org/project/netdevbpf/cover/20210211104502.2081443-1-olteanv@gmail.com/ +If you're a user reading this and this is what you want, just use: + +bridge fdb add dev swp0 00:01:02:03:04:05 master static + +Because switchdev should have given drivers the means from day one to +classify FDB entries as local/non-local, but didn't, it means that all +drivers are currently broken. So we can just as well omit the switchdev +notifications for local FDB entries, which is exactly what this patch +does to close the bug in stable trees. For further development work +where drivers might want to trap the local FDB entries to the host, we +can add a 'bool is_local' to br_switchdev_fdb_call_notifiers(), and +selectively make drivers act upon that bit, while all the others ignore +those entries if the 'is_local' bit is set. + +Fixes: 6b26b51b1d13 ("net: bridge: Add support for notifying devices about FDB add/del") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/bridge/br_switchdev.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/bridge/br_switchdev.c b/net/bridge/br_switchdev.c +index 015209bf44aa..3c42095fa75f 100644 +--- a/net/bridge/br_switchdev.c ++++ b/net/bridge/br_switchdev.c +@@ -123,6 +123,8 @@ br_switchdev_fdb_notify(const struct net_bridge_fdb_entry *fdb, int type) + { + if (!fdb->dst) + return; ++ if (test_bit(BR_FDB_LOCAL, &fdb->flags)) ++ return; + + switch (type) { + case RTM_DELNEIGH: +-- +2.30.1 + diff --git a/queue-5.10/net-cdc-phonet-fix-data-interface-release-on-probe-f.patch b/queue-5.10/net-cdc-phonet-fix-data-interface-release-on-probe-f.patch new file mode 100644 index 00000000000..0526be6e39b --- /dev/null +++ b/queue-5.10/net-cdc-phonet-fix-data-interface-release-on-probe-f.patch @@ -0,0 +1,37 @@ +From 01b755ede192963d6fcf34e44fc88066c78dd6d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 16:57:49 +0100 +Subject: net: cdc-phonet: fix data-interface release on probe failure + +From: Johan Hovold + +[ Upstream commit c79a707072fe3fea0e3c92edee6ca85c1e53c29f ] + +Set the disconnected flag before releasing the data interface in case +netdev registration fails to avoid having the disconnect callback try to +deregister the never registered netdev (and trigger a WARN_ON()). + +Fixes: 87cf65601e17 ("USB host CDC Phonet network interface driver") +Signed-off-by: Johan Hovold +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/cdc-phonet.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c +index dba847f28096..2520421946a6 100644 +--- a/drivers/net/usb/cdc-phonet.c ++++ b/drivers/net/usb/cdc-phonet.c +@@ -387,6 +387,8 @@ static int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *i + + err = register_netdev(dev); + if (err) { ++ /* Set disconnected flag so that disconnect() returns early. */ ++ pnd->disconnected = 1; + usb_driver_release_interface(&usbpn_driver, data_intf); + goto out; + } +-- +2.30.1 + diff --git a/queue-5.10/net-check-all-name-nodes-in-__dev_alloc_name.patch b/queue-5.10/net-check-all-name-nodes-in-__dev_alloc_name.patch new file mode 100644 index 00000000000..93d534f4120 --- /dev/null +++ b/queue-5.10/net-check-all-name-nodes-in-__dev_alloc_name.patch @@ -0,0 +1,65 @@ +From 045059e0a203def72fcc39a06af9e04a87032697 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 04:42:53 +0100 +Subject: net: check all name nodes in __dev_alloc_name + +From: Jiri Bohac + +[ Upstream commit 6c015a2256801597fadcbc11d287774c9c512fa5 ] + +__dev_alloc_name(), when supplied with a name containing '%d', +will search for the first available device number to generate a +unique device name. + +Since commit ff92741270bf8b6e78aa885f166b68c7a67ab13a ("net: +introduce name_node struct to be used in hashlist") network +devices may have alternate names. __dev_alloc_name() does take +these alternate names into account, possibly generating a name +that is already taken and failing with -ENFILE as a result. + +This demonstrates the bug: + + # rmmod dummy 2>/dev/null + # ip link property add dev lo altname dummy0 + # modprobe dummy numdummies=1 + modprobe: ERROR: could not insert 'dummy': Too many open files in system + +Instead of creating a device named dummy1, modprobe fails. + +Fix this by checking all the names in the d->name_node list, not just d->name. + +Signed-off-by: Jiri Bohac +Fixes: ff92741270bf ("net: introduce name_node struct to be used in hashlist") +Reviewed-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/dev.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/net/core/dev.c b/net/core/dev.c +index 75ca6c6d01d6..dbc286fd2047 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -1195,6 +1195,18 @@ static int __dev_alloc_name(struct net *net, const char *name, char *buf) + return -ENOMEM; + + for_each_netdev(net, d) { ++ struct netdev_name_node *name_node; ++ list_for_each_entry(name_node, &d->name_node->list, list) { ++ if (!sscanf(name_node->name, name, &i)) ++ continue; ++ if (i < 0 || i >= max_netdevices) ++ continue; ++ ++ /* avoid cases where sscanf is not exact inverse of printf */ ++ snprintf(buf, IFNAMSIZ, name, i); ++ if (!strncmp(buf, name_node->name, IFNAMSIZ)) ++ set_bit(i, inuse); ++ } + if (!sscanf(d->name, name, &i)) + continue; + if (i < 0 || i >= max_netdevices) +-- +2.30.1 + diff --git a/queue-5.10/net-consolidate-common-blackhole-dst-ops.patch b/queue-5.10/net-consolidate-common-blackhole-dst-ops.patch new file mode 100644 index 00000000000..a67fb210901 --- /dev/null +++ b/queue-5.10/net-consolidate-common-blackhole-dst-ops.patch @@ -0,0 +1,201 @@ +From 49e65a89103d2a92497dc57daaf0690fdcc672ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 01:38:09 +0100 +Subject: net: Consolidate common blackhole dst ops + +From: Daniel Borkmann + +[ Upstream commit c4c877b2732466b4c63217baad05c96f775912c7 ] + +Move generic blackhole dst ops to the core and use them from both +ipv4_dst_blackhole_ops and ip6_dst_blackhole_ops where possible. No +functional change otherwise. We need these also in other locations +and having to define them over and over again is not great. + +Signed-off-by: Daniel Borkmann +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/dst.h | 11 +++++++++++ + net/core/dst.c | 38 ++++++++++++++++++++++++++++++++++++++ + net/ipv4/route.c | 45 ++++++++------------------------------------- + net/ipv6/route.c | 36 +++++++++--------------------------- + 4 files changed, 66 insertions(+), 64 deletions(-) + +diff --git a/include/net/dst.h b/include/net/dst.h +index 8ea8812b0b41..acd15c544cf3 100644 +--- a/include/net/dst.h ++++ b/include/net/dst.h +@@ -535,4 +535,15 @@ static inline void skb_dst_update_pmtu_no_confirm(struct sk_buff *skb, u32 mtu) + dst->ops->update_pmtu(dst, NULL, skb, mtu, false); + } + ++struct dst_entry *dst_blackhole_check(struct dst_entry *dst, u32 cookie); ++void dst_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk, ++ struct sk_buff *skb, u32 mtu, bool confirm_neigh); ++void dst_blackhole_redirect(struct dst_entry *dst, struct sock *sk, ++ struct sk_buff *skb); ++u32 *dst_blackhole_cow_metrics(struct dst_entry *dst, unsigned long old); ++struct neighbour *dst_blackhole_neigh_lookup(const struct dst_entry *dst, ++ struct sk_buff *skb, ++ const void *daddr); ++unsigned int dst_blackhole_mtu(const struct dst_entry *dst); ++ + #endif /* _NET_DST_H */ +diff --git a/net/core/dst.c b/net/core/dst.c +index 0c01bd8d9d81..5f6315601776 100644 +--- a/net/core/dst.c ++++ b/net/core/dst.c +@@ -237,6 +237,44 @@ void __dst_destroy_metrics_generic(struct dst_entry *dst, unsigned long old) + } + EXPORT_SYMBOL(__dst_destroy_metrics_generic); + ++struct dst_entry *dst_blackhole_check(struct dst_entry *dst, u32 cookie) ++{ ++ return NULL; ++} ++ ++u32 *dst_blackhole_cow_metrics(struct dst_entry *dst, unsigned long old) ++{ ++ return NULL; ++} ++ ++struct neighbour *dst_blackhole_neigh_lookup(const struct dst_entry *dst, ++ struct sk_buff *skb, ++ const void *daddr) ++{ ++ return NULL; ++} ++ ++void dst_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk, ++ struct sk_buff *skb, u32 mtu, ++ bool confirm_neigh) ++{ ++} ++EXPORT_SYMBOL_GPL(dst_blackhole_update_pmtu); ++ ++void dst_blackhole_redirect(struct dst_entry *dst, struct sock *sk, ++ struct sk_buff *skb) ++{ ++} ++EXPORT_SYMBOL_GPL(dst_blackhole_redirect); ++ ++unsigned int dst_blackhole_mtu(const struct dst_entry *dst) ++{ ++ unsigned int mtu = dst_metric_raw(dst, RTAX_MTU); ++ ++ return mtu ? : dst->dev->mtu; ++} ++EXPORT_SYMBOL_GPL(dst_blackhole_mtu); ++ + static struct dst_ops md_dst_ops = { + .family = AF_UNSPEC, + }; +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 9f43abeac3a8..50a6d935376f 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -2682,44 +2682,15 @@ out: + return rth; + } + +-static struct dst_entry *ipv4_blackhole_dst_check(struct dst_entry *dst, u32 cookie) +-{ +- return NULL; +-} +- +-static unsigned int ipv4_blackhole_mtu(const struct dst_entry *dst) +-{ +- unsigned int mtu = dst_metric_raw(dst, RTAX_MTU); +- +- return mtu ? : dst->dev->mtu; +-} +- +-static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu, +- bool confirm_neigh) +-{ +-} +- +-static void ipv4_rt_blackhole_redirect(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb) +-{ +-} +- +-static u32 *ipv4_rt_blackhole_cow_metrics(struct dst_entry *dst, +- unsigned long old) +-{ +- return NULL; +-} +- + static struct dst_ops ipv4_dst_blackhole_ops = { +- .family = AF_INET, +- .check = ipv4_blackhole_dst_check, +- .mtu = ipv4_blackhole_mtu, +- .default_advmss = ipv4_default_advmss, +- .update_pmtu = ipv4_rt_blackhole_update_pmtu, +- .redirect = ipv4_rt_blackhole_redirect, +- .cow_metrics = ipv4_rt_blackhole_cow_metrics, +- .neigh_lookup = ipv4_neigh_lookup, ++ .family = AF_INET, ++ .default_advmss = ipv4_default_advmss, ++ .neigh_lookup = ipv4_neigh_lookup, ++ .check = dst_blackhole_check, ++ .cow_metrics = dst_blackhole_cow_metrics, ++ .update_pmtu = dst_blackhole_update_pmtu, ++ .redirect = dst_blackhole_redirect, ++ .mtu = dst_blackhole_mtu, + }; + + struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_orig) +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 7e0ce7af8234..fa276448d5a2 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -258,34 +258,16 @@ static struct dst_ops ip6_dst_ops_template = { + .confirm_neigh = ip6_confirm_neigh, + }; + +-static unsigned int ip6_blackhole_mtu(const struct dst_entry *dst) +-{ +- unsigned int mtu = dst_metric_raw(dst, RTAX_MTU); +- +- return mtu ? : dst->dev->mtu; +-} +- +-static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb, u32 mtu, +- bool confirm_neigh) +-{ +-} +- +-static void ip6_rt_blackhole_redirect(struct dst_entry *dst, struct sock *sk, +- struct sk_buff *skb) +-{ +-} +- + static struct dst_ops ip6_dst_blackhole_ops = { +- .family = AF_INET6, +- .destroy = ip6_dst_destroy, +- .check = ip6_dst_check, +- .mtu = ip6_blackhole_mtu, +- .default_advmss = ip6_default_advmss, +- .update_pmtu = ip6_rt_blackhole_update_pmtu, +- .redirect = ip6_rt_blackhole_redirect, +- .cow_metrics = dst_cow_metrics_generic, +- .neigh_lookup = ip6_dst_neigh_lookup, ++ .family = AF_INET6, ++ .default_advmss = ip6_default_advmss, ++ .neigh_lookup = ip6_dst_neigh_lookup, ++ .check = ip6_dst_check, ++ .destroy = ip6_dst_destroy, ++ .cow_metrics = dst_cow_metrics_generic, ++ .update_pmtu = dst_blackhole_update_pmtu, ++ .redirect = dst_blackhole_redirect, ++ .mtu = dst_blackhole_mtu, + }; + + static const u32 ip6_template_metrics[RTAX_MAX] = { +-- +2.30.1 + diff --git a/queue-5.10/net-dsa-bcm_sf2-qualify-phydev-dev_flags-based-on-po.patch b/queue-5.10/net-dsa-bcm_sf2-qualify-phydev-dev_flags-based-on-po.patch new file mode 100644 index 00000000000..b88ebd8f818 --- /dev/null +++ b/queue-5.10/net-dsa-bcm_sf2-qualify-phydev-dev_flags-based-on-po.patch @@ -0,0 +1,43 @@ +From b4feddbce9c702e8183f9a6c4fbdf99fc2db9d93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 14:17:58 -0800 +Subject: net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port + +From: Florian Fainelli + +[ Upstream commit 47142ed6c34d544ae9f0463e58d482289cbe0d46 ] + +Similar to commit 92696286f3bb37ba50e4bd8d1beb24afb759a799 ("net: +bcmgenet: Set phydev->dev_flags only for internal PHYs") we need to +qualify the phydev->dev_flags based on whether the port is connected to +an internal or external PHY otherwise we risk having a flags collision +with a completely different interpretation depending on the driver. + +Fixes: aa9aef77c761 ("net: dsa: bcm_sf2: communicate integrated PHY revision to PHY driver") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/bcm_sf2.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c +index edb0a1027b38..510324916e91 100644 +--- a/drivers/net/dsa/bcm_sf2.c ++++ b/drivers/net/dsa/bcm_sf2.c +@@ -584,8 +584,10 @@ static u32 bcm_sf2_sw_get_phy_flags(struct dsa_switch *ds, int port) + * in bits 15:8 and the patch level in bits 7:0 which is exactly what + * the REG_PHY_REVISION register layout is. + */ +- +- return priv->hw_params.gphy_rev; ++ if (priv->int_phy_mask & BIT(port)) ++ return priv->hw_params.gphy_rev; ++ else ++ return 0; + } + + static void bcm_sf2_sw_validate(struct dsa_switch *ds, int port, +-- +2.30.1 + diff --git a/queue-5.10/net-hdlc_x25-prevent-racing-between-x25_close-and-x2.patch b/queue-5.10/net-hdlc_x25-prevent-racing-between-x25_close-and-x2.patch new file mode 100644 index 00000000000..f228e7223ea --- /dev/null +++ b/queue-5.10/net-hdlc_x25-prevent-racing-between-x25_close-and-x2.patch @@ -0,0 +1,167 @@ +From 585a1aa2737d8f813cb9b3833c0877fab6429e64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Mar 2021 04:21:01 -0700 +Subject: net: hdlc_x25: Prevent racing between "x25_close" and + "x25_xmit"/"x25_rx" + +From: Xie He + +[ Upstream commit bf0ffea336b493c0a8c8bc27b46683ecf1e8f294 ] + +"x25_close" is called by "hdlc_close" in "hdlc.c", which is called by +hardware drivers' "ndo_stop" function. +"x25_xmit" is called by "hdlc_start_xmit" in "hdlc.c", which is hardware +drivers' "ndo_start_xmit" function. +"x25_rx" is called by "hdlc_rcv" in "hdlc.c", which receives HDLC frames +from "net/core/dev.c". + +"x25_close" races with "x25_xmit" and "x25_rx" because their callers race. + +However, we need to ensure that the LAPB APIs called in "x25_xmit" and +"x25_rx" are called before "lapb_unregister" is called in "x25_close". + +This patch adds locking to ensure when "x25_xmit" and "x25_rx" are doing +their work, "lapb_unregister" is not yet called in "x25_close". + +Reasons for not solving the racing between "x25_close" and "x25_xmit" by +calling "netif_tx_disable" in "x25_close": +1. We still need to solve the racing between "x25_close" and "x25_rx"; +2. The design of the HDLC subsystem assumes the HDLC hardware drivers +have full control over the TX queue, and the HDLC protocol drivers (like +this driver) have no control. Controlling the queue here in the protocol +driver may interfere with hardware drivers' control of the queue. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Xie He +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/wan/hdlc_x25.c | 42 +++++++++++++++++++++++++++++++++++++- + 1 file changed, 41 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c +index 34bc53facd11..6938cb3bdf4e 100644 +--- a/drivers/net/wan/hdlc_x25.c ++++ b/drivers/net/wan/hdlc_x25.c +@@ -23,6 +23,8 @@ + + struct x25_state { + x25_hdlc_proto settings; ++ bool up; ++ spinlock_t up_lock; /* Protects "up" */ + }; + + static int x25_ioctl(struct net_device *dev, struct ifreq *ifr); +@@ -105,6 +107,8 @@ static void x25_data_transmit(struct net_device *dev, struct sk_buff *skb) + + static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev) + { ++ hdlc_device *hdlc = dev_to_hdlc(dev); ++ struct x25_state *x25st = state(hdlc); + int result; + + /* There should be a pseudo header of 1 byte added by upper layers. +@@ -115,12 +119,20 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev) + return NETDEV_TX_OK; + } + ++ spin_lock_bh(&x25st->up_lock); ++ if (!x25st->up) { ++ spin_unlock_bh(&x25st->up_lock); ++ kfree_skb(skb); ++ return NETDEV_TX_OK; ++ } ++ + switch (skb->data[0]) { + case X25_IFACE_DATA: /* Data to be transmitted */ + skb_pull(skb, 1); + skb_reset_network_header(skb); + if ((result = lapb_data_request(dev, skb)) != LAPB_OK) + dev_kfree_skb(skb); ++ spin_unlock_bh(&x25st->up_lock); + return NETDEV_TX_OK; + + case X25_IFACE_CONNECT: +@@ -149,6 +161,7 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev) + break; + } + ++ spin_unlock_bh(&x25st->up_lock); + dev_kfree_skb(skb); + return NETDEV_TX_OK; + } +@@ -166,6 +179,7 @@ static int x25_open(struct net_device *dev) + .data_transmit = x25_data_transmit, + }; + hdlc_device *hdlc = dev_to_hdlc(dev); ++ struct x25_state *x25st = state(hdlc); + struct lapb_parms_struct params; + int result; + +@@ -192,6 +206,10 @@ static int x25_open(struct net_device *dev) + if (result != LAPB_OK) + return -EINVAL; + ++ spin_lock_bh(&x25st->up_lock); ++ x25st->up = true; ++ spin_unlock_bh(&x25st->up_lock); ++ + return 0; + } + +@@ -199,6 +217,13 @@ static int x25_open(struct net_device *dev) + + static void x25_close(struct net_device *dev) + { ++ hdlc_device *hdlc = dev_to_hdlc(dev); ++ struct x25_state *x25st = state(hdlc); ++ ++ spin_lock_bh(&x25st->up_lock); ++ x25st->up = false; ++ spin_unlock_bh(&x25st->up_lock); ++ + lapb_unregister(dev); + } + +@@ -207,15 +232,28 @@ static void x25_close(struct net_device *dev) + static int x25_rx(struct sk_buff *skb) + { + struct net_device *dev = skb->dev; ++ hdlc_device *hdlc = dev_to_hdlc(dev); ++ struct x25_state *x25st = state(hdlc); + + if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL) { + dev->stats.rx_dropped++; + return NET_RX_DROP; + } + +- if (lapb_data_received(dev, skb) == LAPB_OK) ++ spin_lock_bh(&x25st->up_lock); ++ if (!x25st->up) { ++ spin_unlock_bh(&x25st->up_lock); ++ kfree_skb(skb); ++ dev->stats.rx_dropped++; ++ return NET_RX_DROP; ++ } ++ ++ if (lapb_data_received(dev, skb) == LAPB_OK) { ++ spin_unlock_bh(&x25st->up_lock); + return NET_RX_SUCCESS; ++ } + ++ spin_unlock_bh(&x25st->up_lock); + dev->stats.rx_errors++; + dev_kfree_skb_any(skb); + return NET_RX_DROP; +@@ -300,6 +338,8 @@ static int x25_ioctl(struct net_device *dev, struct ifreq *ifr) + return result; + + memcpy(&state(hdlc)->settings, &new_settings, size); ++ state(hdlc)->up = false; ++ spin_lock_init(&state(hdlc)->up_lock); + + /* There's no header_ops so hard_header_len should be 0. */ + dev->hard_header_len = 0; +-- +2.30.1 + diff --git a/queue-5.10/net-ipa-terminate-message-handler-arrays.patch b/queue-5.10/net-ipa-terminate-message-handler-arrays.patch new file mode 100644 index 00000000000..e84d7085db7 --- /dev/null +++ b/queue-5.10/net-ipa-terminate-message-handler-arrays.patch @@ -0,0 +1,55 @@ +From 3c4844e70a4224f9559bfcf033194482bf0d9803 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 09:12:48 -0600 +Subject: net: ipa: terminate message handler arrays + +From: Alex Elder + +[ Upstream commit 3a9ef3e11c5d33e5cb355b4aad1a4caad2407541 ] + +When a QMI handle is initialized, an array of message handler +structures is provided, defining how any received message should +be handled based on its type and message ID. The QMI core code +traverses this array when a message arrives and calls the function +associated with the (type, msg_id) found in the array. + +The array is supposed to be terminated with an empty (all zero) +entry though. Without it, an unsupported message will cause +the QMI core code to go past the end of the array. + +Fix this bug, by properly terminating the message handler arrays +provided when QMI handles are set up by the IPA driver. + +Fixes: 530f9216a9537 ("soc: qcom: ipa: AP/modem communications") +Reported-by: Sujit Kautkar +Signed-off-by: Alex Elder +Reviewed-by: Bjorn Andersson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ipa/ipa_qmi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ipa/ipa_qmi.c b/drivers/net/ipa/ipa_qmi.c +index 5090f0f923ad..1a87a49538c5 100644 +--- a/drivers/net/ipa/ipa_qmi.c ++++ b/drivers/net/ipa/ipa_qmi.c +@@ -249,6 +249,7 @@ static struct qmi_msg_handler ipa_server_msg_handlers[] = { + .decoded_size = IPA_QMI_DRIVER_INIT_COMPLETE_REQ_SZ, + .fn = ipa_server_driver_init_complete, + }, ++ { }, + }; + + /* Handle an INIT_DRIVER response message from the modem. */ +@@ -269,6 +270,7 @@ static struct qmi_msg_handler ipa_client_msg_handlers[] = { + .decoded_size = IPA_QMI_INIT_DRIVER_RSP_SZ, + .fn = ipa_client_init_driver, + }, ++ { }, + }; + + /* Return a pointer to an init modem driver request structure, which contains +-- +2.30.1 + diff --git a/queue-5.10/net-mlx5-add-back-multicast-stats-for-uplink-represe.patch b/queue-5.10/net-mlx5-add-back-multicast-stats-for-uplink-represe.patch new file mode 100644 index 00000000000..0a409282fde --- /dev/null +++ b/queue-5.10/net-mlx5-add-back-multicast-stats-for-uplink-represe.patch @@ -0,0 +1,46 @@ +From 13967615647277f45c1a7aa9dacb6f0e01fd8721 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 20:33:19 -0500 +Subject: net/mlx5: Add back multicast stats for uplink representor + +From: Huy Nguyen + +[ Upstream commit a07231084da2207629b42244380ae2f1e10bd9b4 ] + +The multicast counter got removed from uplink representor due to the +cited patch. + +Fixes: 47c97e6b10a1 ("net/mlx5e: Fix multicast counter not up-to-date in "ip -s"") +Signed-off-by: Huy Nguyen +Reviewed-by: Daniel Jurgens +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 0dc572aaf177..e2006c6053c9 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -3666,10 +3666,17 @@ mlx5e_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats) + } + + if (mlx5e_is_uplink_rep(priv)) { ++ struct mlx5e_vport_stats *vstats = &priv->stats.vport; ++ + stats->rx_packets = PPORT_802_3_GET(pstats, a_frames_received_ok); + stats->rx_bytes = PPORT_802_3_GET(pstats, a_octets_received_ok); + stats->tx_packets = PPORT_802_3_GET(pstats, a_frames_transmitted_ok); + stats->tx_bytes = PPORT_802_3_GET(pstats, a_octets_transmitted_ok); ++ ++ /* vport multicast also counts packets that are dropped due to steering ++ * or rx out of buffer ++ */ ++ stats->multicast = VPORT_COUNTER_GET(vstats, received_eth_multicast.packets); + } else { + mlx5e_fold_sw_stats64(priv, stats); + } +-- +2.30.1 + diff --git a/queue-5.10/net-mlx5e-allow-to-match-on-mpls-parameters-only-for.patch b/queue-5.10/net-mlx5e-allow-to-match-on-mpls-parameters-only-for.patch new file mode 100644 index 00000000000..317b3870278 --- /dev/null +++ b/queue-5.10/net-mlx5e-allow-to-match-on-mpls-parameters-only-for.patch @@ -0,0 +1,48 @@ +From fe60bdd8d42ea4d2268bf3f0d06bfa8249c2b3f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 17:01:46 +0200 +Subject: net/mlx5e: Allow to match on MPLS parameters only for MPLS over UDP + +From: Alaa Hleihel + +[ Upstream commit 7d6c86e3ccb5ceea767df5c7a9a17cdfccd3df9a ] + +Currently, we support hardware offload only for MPLS over UDP. +However, rules matching on MPLS parameters are now wrongly offloaded +for regular MPLS, without actually taking the parameters into +consideration when doing the offload. +Fix it by rejecting such unsupported rules. + +Fixes: 72046a91d134 ("net/mlx5e: Allow to match on mpls parameters") +Signed-off-by: Alaa Hleihel +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index 4b8a442f09cd..77ee24d52203 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -2597,6 +2597,16 @@ static int __parse_cls_flower(struct mlx5e_priv *priv, + *match_level = MLX5_MATCH_L4; + } + ++ /* Currenlty supported only for MPLS over UDP */ ++ if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_MPLS) && ++ !netif_is_bareudp(filter_dev)) { ++ NL_SET_ERR_MSG_MOD(extack, ++ "Matching on MPLS is supported only for MPLS over UDP"); ++ netdev_err(priv->netdev, ++ "Matching on MPLS is supported only for MPLS over UDP\n"); ++ return -EOPNOTSUPP; ++ } ++ + return 0; + } + +-- +2.30.1 + diff --git a/queue-5.10/net-mlx5e-don-t-match-on-geneve-options-in-case-opti.patch b/queue-5.10/net-mlx5e-don-t-match-on-geneve-options-in-case-opti.patch new file mode 100644 index 00000000000..2145dedb4a9 --- /dev/null +++ b/queue-5.10/net-mlx5e-don-t-match-on-geneve-options-in-case-opti.patch @@ -0,0 +1,46 @@ +From 590c1d542c4ccc318472c0669eb48bb0e71ab28a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Feb 2021 13:39:18 +0200 +Subject: net/mlx5e: Don't match on Geneve options in case option masks are all + zero + +From: Maor Dickman + +[ Upstream commit 385d40b042e60aa0b677d7b400a0fefb44bcbaf4 ] + +The cited change added offload support for Geneve options without verifying +the validity of the options masks, this caused offload of rules with match +on Geneve options with class,type and data masks which are zero to fail. + +Fix by ignoring the match on Geneve options in case option masks are +all zero. + +Fixes: 9272e3df3023 ("net/mlx5e: Geneve, Add support for encap/decap flows offload") +Signed-off-by: Maor Dickman +Reviewed-by: Roi Dayan +Reviewed-by: Oz Shlomo +Reviewed-by: Yevgeny Kliteynik +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c +index e472ed0eacfb..7ed3f9f79f11 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c +@@ -227,6 +227,10 @@ static int mlx5e_tc_tun_parse_geneve_options(struct mlx5e_priv *priv, + option_key = (struct geneve_opt *)&enc_opts.key->data[0]; + option_mask = (struct geneve_opt *)&enc_opts.mask->data[0]; + ++ if (option_mask->opt_class == 0 && option_mask->type == 0 && ++ !memchr_inv(option_mask->opt_data, 0, option_mask->length * 4)) ++ return 0; ++ + if (option_key->length > max_tlv_option_data_len) { + NL_SET_ERR_MSG_MOD(extack, + "Matching on GENEVE options: unsupported option len"); +-- +2.30.1 + diff --git a/queue-5.10/net-mlx5e-fix-error-path-for-ethtool-set-priv-flag.patch b/queue-5.10/net-mlx5e-fix-error-path-for-ethtool-set-priv-flag.patch new file mode 100644 index 00000000000..55e16d482d8 --- /dev/null +++ b/queue-5.10/net-mlx5e-fix-error-path-for-ethtool-set-priv-flag.patch @@ -0,0 +1,48 @@ +From eba123c23fe7d1d62429f54b0ad7cf2ad98556db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Mar 2021 17:46:35 +0200 +Subject: net/mlx5e: Fix error path for ethtool set-priv-flag + +From: Aya Levin + +[ Upstream commit 4eacfe72e3e037e3fc019113df32c39a705148c2 ] + +Expose error value when failing to comply to command: +$ ethtool --set-priv-flags eth2 rx_cqe_compress [on/off] + +Fixes: be7e87f92b58 ("net/mlx5e: Fail safe cqe compressing/moderation mode setting") +Signed-off-by: Aya Levin +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +index b8622440243b..bcd05457647e 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +@@ -1873,6 +1873,7 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev, + { + struct mlx5e_priv *priv = netdev_priv(netdev); + struct mlx5_core_dev *mdev = priv->mdev; ++ int err; + + if (!MLX5_CAP_GEN(mdev, cqe_compression)) + return -EOPNOTSUPP; +@@ -1882,7 +1883,10 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev, + return -EINVAL; + } + +- mlx5e_modify_rx_cqe_compression_locked(priv, enable); ++ err = mlx5e_modify_rx_cqe_compression_locked(priv, enable); ++ if (err) ++ return err; ++ + priv->channels.params.rx_cqe_compress_def = enable; + + return 0; +-- +2.30.1 + diff --git a/queue-5.10/net-mlx5e-offload-tuple-rewrite-for-non-ct-flows.patch b/queue-5.10/net-mlx5e-offload-tuple-rewrite-for-non-ct-flows.patch new file mode 100644 index 00000000000..9995e8e9ddf --- /dev/null +++ b/queue-5.10/net-mlx5e-offload-tuple-rewrite-for-non-ct-flows.patch @@ -0,0 +1,108 @@ +From d692bf6254310ffdd4cf5d95e1d86ef48b2597d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 21:28:11 +0200 +Subject: net/mlx5e: Offload tuple rewrite for non-CT flows + +From: Dima Chumak + +[ Upstream commit 96b5b4585843e3c83fb1930e5dfbefd0fb889c55 ] + +Setting connection tracking OVS flows and then setting non-CT flows that +use tuple rewrite action (e.g. mod_tp_dst), causes the latter flows not +being offloaded. + +Fix by using a stricter condition in modify_header_match_supported() to +check tuple rewrite support only for flows with CT action. The check is +factored out into standalone modify_tuple_supported() function to aid +readability. + +Fixes: 7e36feeb0467 ("net/mlx5e: CT: Don't offload tuple rewrites for established tuples") +Signed-off-by: Dima Chumak +Reviewed-by: Paul Blakey +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlx5/core/en/tc_ct.c | 3 +- + .../net/ethernet/mellanox/mlx5/core/en_tc.c | 44 ++++++++++++++----- + 2 files changed, 35 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c +index 24e2c0d955b9..b42396df3111 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c +@@ -1182,7 +1182,8 @@ int mlx5_tc_ct_add_no_trk_match(struct mlx5_flow_spec *spec) + + mlx5e_tc_match_to_reg_get_match(spec, CTSTATE_TO_REG, + &ctstate, &ctstate_mask); +- if (ctstate_mask) ++ ++ if ((ctstate & ctstate_mask) == MLX5_CT_STATE_TRK_BIT) + return -EOPNOTSUPP; + + ctstate_mask |= MLX5_CT_STATE_TRK_BIT; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index 77ee24d52203..930f19c598bb 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -3210,6 +3210,37 @@ static int is_action_keys_supported(const struct flow_action_entry *act, + return 0; + } + ++static bool modify_tuple_supported(bool modify_tuple, bool ct_clear, ++ bool ct_flow, struct netlink_ext_ack *extack, ++ struct mlx5e_priv *priv, ++ struct mlx5_flow_spec *spec) ++{ ++ if (!modify_tuple || ct_clear) ++ return true; ++ ++ if (ct_flow) { ++ NL_SET_ERR_MSG_MOD(extack, ++ "can't offload tuple modification with non-clear ct()"); ++ netdev_info(priv->netdev, ++ "can't offload tuple modification with non-clear ct()"); ++ return false; ++ } ++ ++ /* Add ct_state=-trk match so it will be offloaded for non ct flows ++ * (or after clear action), as otherwise, since the tuple is changed, ++ * we can't restore ct state ++ */ ++ if (mlx5_tc_ct_add_no_trk_match(spec)) { ++ NL_SET_ERR_MSG_MOD(extack, ++ "can't offload tuple modification with ct matches and no ct(clear) action"); ++ netdev_info(priv->netdev, ++ "can't offload tuple modification with ct matches and no ct(clear) action"); ++ return false; ++ } ++ ++ return true; ++} ++ + static bool modify_header_match_supported(struct mlx5e_priv *priv, + struct mlx5_flow_spec *spec, + struct flow_action *flow_action, +@@ -3248,18 +3279,9 @@ static bool modify_header_match_supported(struct mlx5e_priv *priv, + return err; + } + +- /* Add ct_state=-trk match so it will be offloaded for non ct flows +- * (or after clear action), as otherwise, since the tuple is changed, +- * we can't restore ct state +- */ +- if (!ct_clear && modify_tuple && +- mlx5_tc_ct_add_no_trk_match(spec)) { +- NL_SET_ERR_MSG_MOD(extack, +- "can't offload tuple modify header with ct matches"); +- netdev_info(priv->netdev, +- "can't offload tuple modify header with ct matches"); ++ if (!modify_tuple_supported(modify_tuple, ct_clear, ct_flow, extack, ++ priv, spec)) + return false; +- } + + ip_proto = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ip_protocol); + if (modify_ip_header && ip_proto != IPPROTO_TCP && +-- +2.30.1 + diff --git a/queue-5.10/net-mlx5e-rx-mind-the-mpwqe-gaps-when-calculating-of.patch b/queue-5.10/net-mlx5e-rx-mind-the-mpwqe-gaps-when-calculating-of.patch new file mode 100644 index 00000000000..27da73c98f0 --- /dev/null +++ b/queue-5.10/net-mlx5e-rx-mind-the-mpwqe-gaps-when-calculating-of.patch @@ -0,0 +1,102 @@ +From 1b7ff5df0d6cc68c45e792ce7f1ec604544df5b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jan 2021 13:21:17 +0200 +Subject: net/mlx5e: RX, Mind the MPWQE gaps when calculating offsets + +From: Tariq Toukan + +[ Upstream commit d5dd03b26ba49c4ffe67ee1937add82293c19794 ] + +Since cited patch, MLX5E_REQUIRED_WQE_MTTS is not a power of two. +Hence, usage of MLX5E_LOG_ALIGNED_MPWQE_PPW should be replaced, +as it lost some accuracy. Use the designated macro to calculate +the number of required MTTs. + +This makes sure the solution in cited patch works properly. + +While here, un-inline mlx5e_get_mpwqe_offset(), and remove the +unused RQ parameter. + +Fixes: c3c9402373fe ("net/mlx5e: Add resiliency in Striding RQ mode for packets larger than MTU") +Signed-off-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en.h | 7 ++++--- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 6 +++--- + drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 4 ++-- + 3 files changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h +index 2f05b0f9de01..9da34f82d466 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h +@@ -90,14 +90,15 @@ struct page_pool; + MLX5_MPWRQ_LOG_WQE_SZ - PAGE_SHIFT : 0) + #define MLX5_MPWRQ_PAGES_PER_WQE BIT(MLX5_MPWRQ_WQE_PAGE_ORDER) + +-#define MLX5_MTT_OCTW(npages) (ALIGN(npages, 8) / 2) ++#define MLX5_ALIGN_MTTS(mtts) (ALIGN(mtts, 8)) ++#define MLX5_ALIGNED_MTTS_OCTW(mtts) ((mtts) / 2) ++#define MLX5_MTT_OCTW(mtts) (MLX5_ALIGNED_MTTS_OCTW(MLX5_ALIGN_MTTS(mtts))) + /* Add another page to MLX5E_REQUIRED_WQE_MTTS as a buffer between + * WQEs, This page will absorb write overflow by the hardware, when + * receiving packets larger than MTU. These oversize packets are + * dropped by the driver at a later stage. + */ +-#define MLX5E_REQUIRED_WQE_MTTS (ALIGN(MLX5_MPWRQ_PAGES_PER_WQE + 1, 8)) +-#define MLX5E_LOG_ALIGNED_MPWQE_PPW (ilog2(MLX5E_REQUIRED_WQE_MTTS)) ++#define MLX5E_REQUIRED_WQE_MTTS (MLX5_ALIGN_MTTS(MLX5_MPWRQ_PAGES_PER_WQE + 1)) + #define MLX5E_REQUIRED_MTTS(wqes) (wqes * MLX5E_REQUIRED_WQE_MTTS) + #define MLX5E_MAX_RQ_NUM_MTTS \ + ((1 << 16) * 2) /* So that MLX5_MTT_OCTW(num_mtts) fits into u16 */ +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 6394f9d8c685..8b0826d689c0 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -303,9 +303,9 @@ static int mlx5e_create_rq_umr_mkey(struct mlx5_core_dev *mdev, struct mlx5e_rq + rq->wqe_overflow.addr); + } + +-static inline u64 mlx5e_get_mpwqe_offset(struct mlx5e_rq *rq, u16 wqe_ix) ++static u64 mlx5e_get_mpwqe_offset(u16 wqe_ix) + { +- return (wqe_ix << MLX5E_LOG_ALIGNED_MPWQE_PPW) << PAGE_SHIFT; ++ return MLX5E_REQUIRED_MTTS(wqe_ix) << PAGE_SHIFT; + } + + static void mlx5e_init_frags_partition(struct mlx5e_rq *rq) +@@ -544,7 +544,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c, + mlx5_wq_ll_get_wqe(&rq->mpwqe.wq, i); + u32 byte_count = + rq->mpwqe.num_strides << rq->mpwqe.log_stride_sz; +- u64 dma_offset = mlx5e_get_mpwqe_offset(rq, i); ++ u64 dma_offset = mlx5e_get_mpwqe_offset(i); + + wqe->data[0].addr = cpu_to_be64(dma_offset + rq->buff.headroom); + wqe->data[0].byte_count = cpu_to_be32(byte_count); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +index 6d2ba8b84187..7e1f8660dfec 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +@@ -506,7 +506,6 @@ static int mlx5e_alloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix) + struct mlx5e_icosq *sq = &rq->channel->icosq; + struct mlx5_wq_cyc *wq = &sq->wq; + struct mlx5e_umr_wqe *umr_wqe; +- u16 xlt_offset = ix << (MLX5E_LOG_ALIGNED_MPWQE_PPW - 1); + u16 pi; + int err; + int i; +@@ -537,7 +536,8 @@ static int mlx5e_alloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix) + umr_wqe->ctrl.opmod_idx_opcode = + cpu_to_be32((sq->pc << MLX5_WQE_CTRL_WQE_INDEX_SHIFT) | + MLX5_OPCODE_UMR); +- umr_wqe->uctrl.xlt_offset = cpu_to_be16(xlt_offset); ++ umr_wqe->uctrl.xlt_offset = ++ cpu_to_be16(MLX5_ALIGNED_MTTS_OCTW(MLX5E_REQUIRED_MTTS(ix))); + + sq->db.wqe_info[pi] = (struct mlx5e_icosq_wqe_info) { + .wqe_type = MLX5E_ICOSQ_WQE_UMR_RX, +-- +2.30.1 + diff --git a/queue-5.10/net-mlx5e-when-changing-xdp-program-without-reset-ta.patch b/queue-5.10/net-mlx5e-when-changing-xdp-program-without-reset-ta.patch new file mode 100644 index 00000000000..9b7c5eccb09 --- /dev/null +++ b/queue-5.10/net-mlx5e-when-changing-xdp-program-without-reset-ta.patch @@ -0,0 +1,46 @@ +From a5643261164ae6202fad0b56cc99e0320f97f487 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Feb 2021 15:51:11 +0200 +Subject: net/mlx5e: When changing XDP program without reset, take refs for XSK + RQs + +From: Maxim Mikityanskiy + +[ Upstream commit e5eb01344e9b09bb9d255b9727449186f7168df8 ] + +Each RQ (including XSK RQs) takes a reference to the XDP program. When +an XDP program is attached or detached, the channels and queues are +recreated, however, there is a special flow for changing an active XDP +program to another one. In that flow, channels and queues stay alive, +but the refcounts of the old and new XDP programs are adjusted. This +flow didn't increment refcount by the number of active XSK RQs, and this +commit fixes it. + +Fixes: db05815b36cb ("net/mlx5e: Add XSK zero-copy support") +Signed-off-by: Maxim Mikityanskiy +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 8b0826d689c0..0dc572aaf177 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -4494,8 +4494,10 @@ static int mlx5e_xdp_set(struct net_device *netdev, struct bpf_prog *prog) + struct mlx5e_channel *c = priv->channels.c[i]; + + mlx5e_rq_replace_xdp_prog(&c->rq, prog); +- if (test_bit(MLX5E_CHANNEL_STATE_XSK, c->state)) ++ if (test_bit(MLX5E_CHANNEL_STATE_XSK, c->state)) { ++ bpf_prog_inc(prog); + mlx5e_rq_replace_xdp_prog(&c->xskrq, prog); ++ } + } + + unlock: +-- +2.30.1 + diff --git a/queue-5.10/net-phy-broadcom-add-power-down-exit-reset-state-del.patch b/queue-5.10/net-phy-broadcom-add-power-down-exit-reset-state-del.patch new file mode 100644 index 00000000000..f3b8c2b9f14 --- /dev/null +++ b/queue-5.10/net-phy-broadcom-add-power-down-exit-reset-state-del.patch @@ -0,0 +1,41 @@ +From ac3e4918dfcd0369e8d16f224ac1db6f18fd5d8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 20:53:42 -0800 +Subject: net: phy: broadcom: Add power down exit reset state delay + +From: Florian Fainelli + +[ Upstream commit 7a1468ba0e02eee24ae1353e8933793a27198e20 ] + +Per the datasheet, when we clear the power down bit, the PHY remains in +an internal reset state for 40us and then resume normal operation. +Account for that delay to avoid any issues in the future if +genphy_resume() changes. + +Fixes: fe26821fa614 ("net: phy: broadcom: Wire suspend/resume for BCM54810") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/broadcom.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c +index cd271de9609b..69713ea36d4e 100644 +--- a/drivers/net/phy/broadcom.c ++++ b/drivers/net/phy/broadcom.c +@@ -332,6 +332,11 @@ static int bcm54xx_resume(struct phy_device *phydev) + if (ret < 0) + return ret; + ++ /* Upon exiting power down, the PHY remains in an internal reset state ++ * for 40us ++ */ ++ fsleep(40); ++ + return bcm54xx_config_init(phydev); + } + +-- +2.30.1 + diff --git a/queue-5.10/net-phy-broadcom-avoid-forward-for-bcm54xx_config_cl.patch b/queue-5.10/net-phy-broadcom-avoid-forward-for-bcm54xx_config_cl.patch new file mode 100644 index 00000000000..ed43568a291 --- /dev/null +++ b/queue-5.10/net-phy-broadcom-avoid-forward-for-bcm54xx_config_cl.patch @@ -0,0 +1,115 @@ +From a78a98398b86e5969b14404fe08181b6e84da4a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Feb 2021 19:46:30 -0800 +Subject: net: phy: broadcom: Avoid forward for bcm54xx_config_clock_delay() + +From: Florian Fainelli + +[ Upstream commit 133bf7b4fbbe58cff5492e37e95e75c88161f1b8 ] + +Avoid a forward declaration by moving the callers of +bcm54xx_config_clock_delay() below its body. + +Signed-off-by: Florian Fainelli +Reviewed-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/broadcom.c | 74 +++++++++++++++++++------------------- + 1 file changed, 36 insertions(+), 38 deletions(-) + +diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c +index 739efcce6dd5..88e9708e0562 100644 +--- a/drivers/net/phy/broadcom.c ++++ b/drivers/net/phy/broadcom.c +@@ -26,44 +26,6 @@ MODULE_DESCRIPTION("Broadcom PHY driver"); + MODULE_AUTHOR("Maciej W. Rozycki"); + MODULE_LICENSE("GPL"); + +-static int bcm54xx_config_clock_delay(struct phy_device *phydev); +- +-static int bcm54210e_config_init(struct phy_device *phydev) +-{ +- int val; +- +- bcm54xx_config_clock_delay(phydev); +- +- if (phydev->dev_flags & PHY_BRCM_EN_MASTER_MODE) { +- val = phy_read(phydev, MII_CTRL1000); +- val |= CTL1000_AS_MASTER | CTL1000_ENABLE_MASTER; +- phy_write(phydev, MII_CTRL1000, val); +- } +- +- return 0; +-} +- +-static int bcm54612e_config_init(struct phy_device *phydev) +-{ +- int reg; +- +- bcm54xx_config_clock_delay(phydev); +- +- /* Enable CLK125 MUX on LED4 if ref clock is enabled. */ +- if (!(phydev->dev_flags & PHY_BRCM_RX_REFCLK_UNUSED)) { +- int err; +- +- reg = bcm_phy_read_exp(phydev, BCM54612E_EXP_SPARE0); +- err = bcm_phy_write_exp(phydev, BCM54612E_EXP_SPARE0, +- BCM54612E_LED4_CLK125OUT_EN | reg); +- +- if (err < 0) +- return err; +- } +- +- return 0; +-} +- + static int bcm54xx_config_clock_delay(struct phy_device *phydev) + { + int rc, val; +@@ -105,6 +67,42 @@ static int bcm54xx_config_clock_delay(struct phy_device *phydev) + return 0; + } + ++static int bcm54210e_config_init(struct phy_device *phydev) ++{ ++ int val; ++ ++ bcm54xx_config_clock_delay(phydev); ++ ++ if (phydev->dev_flags & PHY_BRCM_EN_MASTER_MODE) { ++ val = phy_read(phydev, MII_CTRL1000); ++ val |= CTL1000_AS_MASTER | CTL1000_ENABLE_MASTER; ++ phy_write(phydev, MII_CTRL1000, val); ++ } ++ ++ return 0; ++} ++ ++static int bcm54612e_config_init(struct phy_device *phydev) ++{ ++ int reg; ++ ++ bcm54xx_config_clock_delay(phydev); ++ ++ /* Enable CLK125 MUX on LED4 if ref clock is enabled. */ ++ if (!(phydev->dev_flags & PHY_BRCM_RX_REFCLK_UNUSED)) { ++ int err; ++ ++ reg = bcm_phy_read_exp(phydev, BCM54612E_EXP_SPARE0); ++ err = bcm_phy_write_exp(phydev, BCM54612E_EXP_SPARE0, ++ BCM54612E_LED4_CLK125OUT_EN | reg); ++ ++ if (err < 0) ++ return err; ++ } ++ ++ return 0; ++} ++ + /* Needs SMDSP clock enabled via bcm54xx_phydsp_config() */ + static int bcm50610_a0_workaround(struct phy_device *phydev) + { +-- +2.30.1 + diff --git a/queue-5.10/net-phy-broadcom-fix-rgmii-delays-for-bcm50160-and-b.patch b/queue-5.10/net-phy-broadcom-fix-rgmii-delays-for-bcm50160-and-b.patch new file mode 100644 index 00000000000..8de5ebb7224 --- /dev/null +++ b/queue-5.10/net-phy-broadcom-fix-rgmii-delays-for-bcm50160-and-b.patch @@ -0,0 +1,39 @@ +From 48cca8094701156c9ebf36dbd13963c84290657f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Mar 2021 16:52:50 -0800 +Subject: net: phy: broadcom: Fix RGMII delays for BCM50160 and BCM50610M + +From: Florian Fainelli + +[ Upstream commit b1dd9bf688b0dcc5a34dca660de46c7570bd9243 ] + +The PHY driver entry for BCM50160 and BCM50610M calls +bcm54xx_config_init() but does not call bcm54xx_config_clock_delay() in +order to configuration appropriate clock delays on the PHY, fix that. + +Fixes: 733336262b28 ("net: phy: Allow BCM5481x PHYs to setup internal TX/RX clock delay") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/broadcom.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c +index 6f6e64f81924..dbed15dc0fe7 100644 +--- a/drivers/net/phy/broadcom.c ++++ b/drivers/net/phy/broadcom.c +@@ -340,6 +340,10 @@ static int bcm54xx_config_init(struct phy_device *phydev) + bcm54xx_adjust_rxrefclk(phydev); + + switch (BRCM_PHY_MODEL(phydev)) { ++ case PHY_ID_BCM50610: ++ case PHY_ID_BCM50610M: ++ err = bcm54xx_config_clock_delay(phydev); ++ break; + case PHY_ID_BCM54210E: + err = bcm54210e_config_init(phydev); + break; +-- +2.30.1 + diff --git a/queue-5.10/net-phy-broadcom-set-proper-1000basex-sgmii-interfac.patch b/queue-5.10/net-phy-broadcom-set-proper-1000basex-sgmii-interfac.patch new file mode 100644 index 00000000000..c7decf31544 --- /dev/null +++ b/queue-5.10/net-phy-broadcom-set-proper-1000basex-sgmii-interfac.patch @@ -0,0 +1,178 @@ +From 13bc4980e9e2723da1423f74635347fbe2cf040a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Feb 2021 16:54:52 -0600 +Subject: net: phy: broadcom: Set proper 1000BaseX/SGMII interface mode for + BCM54616S + +From: Robert Hancock + +[ Upstream commit 3afd0218992a8d1398e9791d6c2edd4c948ae7ee ] + +The default configuration for the BCM54616S PHY may not match the desired +mode when using 1000BaseX or SGMII interface modes, such as when it is on +an SFP module. Add code to explicitly set the correct mode using +programming sequences provided by Bel-Fuse: + +https://www.belfuse.com/resources/datasheets/powersolutions/ds-bps-sfp-1gbt-05-series.pdf +https://www.belfuse.com/resources/datasheets/powersolutions/ds-bps-sfp-1gbt-06-series.pdf + +Signed-off-by: Robert Hancock +Acked-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/broadcom.c | 84 ++++++++++++++++++++++++++++++++------ + include/linux/brcmphy.h | 4 ++ + 2 files changed, 76 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c +index 88e9708e0562..6f6e64f81924 100644 +--- a/drivers/net/phy/broadcom.c ++++ b/drivers/net/phy/broadcom.c +@@ -103,6 +103,64 @@ static int bcm54612e_config_init(struct phy_device *phydev) + return 0; + } + ++static int bcm54616s_config_init(struct phy_device *phydev) ++{ ++ int rc, val; ++ ++ if (phydev->interface != PHY_INTERFACE_MODE_SGMII && ++ phydev->interface != PHY_INTERFACE_MODE_1000BASEX) ++ return 0; ++ ++ /* Ensure proper interface mode is selected. */ ++ /* Disable RGMII mode */ ++ val = bcm54xx_auxctl_read(phydev, MII_BCM54XX_AUXCTL_SHDWSEL_MISC); ++ if (val < 0) ++ return val; ++ val &= ~MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_EN; ++ val |= MII_BCM54XX_AUXCTL_MISC_WREN; ++ rc = bcm54xx_auxctl_write(phydev, MII_BCM54XX_AUXCTL_SHDWSEL_MISC, ++ val); ++ if (rc < 0) ++ return rc; ++ ++ /* Select 1000BASE-X register set (primary SerDes) */ ++ val = bcm_phy_read_shadow(phydev, BCM54XX_SHD_MODE); ++ if (val < 0) ++ return val; ++ val |= BCM54XX_SHD_MODE_1000BX; ++ rc = bcm_phy_write_shadow(phydev, BCM54XX_SHD_MODE, val); ++ if (rc < 0) ++ return rc; ++ ++ /* Power down SerDes interface */ ++ rc = phy_set_bits(phydev, MII_BMCR, BMCR_PDOWN); ++ if (rc < 0) ++ return rc; ++ ++ /* Select proper interface mode */ ++ val &= ~BCM54XX_SHD_INTF_SEL_MASK; ++ val |= phydev->interface == PHY_INTERFACE_MODE_SGMII ? ++ BCM54XX_SHD_INTF_SEL_SGMII : ++ BCM54XX_SHD_INTF_SEL_GBIC; ++ rc = bcm_phy_write_shadow(phydev, BCM54XX_SHD_MODE, val); ++ if (rc < 0) ++ return rc; ++ ++ /* Power up SerDes interface */ ++ rc = phy_clear_bits(phydev, MII_BMCR, BMCR_PDOWN); ++ if (rc < 0) ++ return rc; ++ ++ /* Select copper register set */ ++ val &= ~BCM54XX_SHD_MODE_1000BX; ++ rc = bcm_phy_write_shadow(phydev, BCM54XX_SHD_MODE, val); ++ if (rc < 0) ++ return rc; ++ ++ /* Power up copper interface */ ++ return phy_clear_bits(phydev, MII_BMCR, BMCR_PDOWN); ++} ++ + /* Needs SMDSP clock enabled via bcm54xx_phydsp_config() */ + static int bcm50610_a0_workaround(struct phy_device *phydev) + { +@@ -281,15 +339,17 @@ static int bcm54xx_config_init(struct phy_device *phydev) + + bcm54xx_adjust_rxrefclk(phydev); + +- if (BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54210E) { ++ switch (BRCM_PHY_MODEL(phydev)) { ++ case PHY_ID_BCM54210E: + err = bcm54210e_config_init(phydev); +- if (err) +- return err; +- } else if (BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54612E) { ++ break; ++ case PHY_ID_BCM54612E: + err = bcm54612e_config_init(phydev); +- if (err) +- return err; +- } else if (BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54810) { ++ break; ++ case PHY_ID_BCM54616S: ++ err = bcm54616s_config_init(phydev); ++ break; ++ case PHY_ID_BCM54810: + /* For BCM54810, we need to disable BroadR-Reach function */ + val = bcm_phy_read_exp(phydev, + BCM54810_EXP_BROADREACH_LRE_MISC_CTL); +@@ -297,9 +357,10 @@ static int bcm54xx_config_init(struct phy_device *phydev) + err = bcm_phy_write_exp(phydev, + BCM54810_EXP_BROADREACH_LRE_MISC_CTL, + val); +- if (err < 0) +- return err; ++ break; + } ++ if (err) ++ return err; + + bcm54xx_phydsp_config(phydev); + +@@ -478,7 +539,7 @@ static int bcm5481_config_aneg(struct phy_device *phydev) + + static int bcm54616s_probe(struct phy_device *phydev) + { +- int val, intf_sel; ++ int val; + + val = bcm_phy_read_shadow(phydev, BCM54XX_SHD_MODE); + if (val < 0) +@@ -490,8 +551,7 @@ static int bcm54616s_probe(struct phy_device *phydev) + * RGMII-1000Base-X is properly supported, but RGMII-100Base-FX + * support is still missing as of now. + */ +- intf_sel = (val & BCM54XX_SHD_INTF_SEL_MASK) >> 1; +- if (intf_sel == 1) { ++ if ((val & BCM54XX_SHD_INTF_SEL_MASK) == BCM54XX_SHD_INTF_SEL_RGMII) { + val = bcm_phy_read_shadow(phydev, BCM54616S_SHD_100FX_CTRL); + if (val < 0) + return val; +diff --git a/include/linux/brcmphy.h b/include/linux/brcmphy.h +index d0bd226d6bd9..54665952d6ad 100644 +--- a/include/linux/brcmphy.h ++++ b/include/linux/brcmphy.h +@@ -136,6 +136,7 @@ + + #define MII_BCM54XX_AUXCTL_SHDWSEL_MISC 0x07 + #define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_WIRESPEED_EN 0x0010 ++#define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_EN 0x0080 + #define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN 0x0100 + #define MII_BCM54XX_AUXCTL_MISC_FORCE_AMDIX 0x0200 + #define MII_BCM54XX_AUXCTL_MISC_WREN 0x8000 +@@ -222,6 +223,9 @@ + /* 11111: Mode Control Register */ + #define BCM54XX_SHD_MODE 0x1f + #define BCM54XX_SHD_INTF_SEL_MASK GENMASK(2, 1) /* INTERF_SEL[1:0] */ ++#define BCM54XX_SHD_INTF_SEL_RGMII 0x02 ++#define BCM54XX_SHD_INTF_SEL_SGMII 0x04 ++#define BCM54XX_SHD_INTF_SEL_GBIC 0x06 + #define BCM54XX_SHD_MODE_1000BX BIT(0) /* Enable 1000-X registers */ + + /* +-- +2.30.1 + diff --git a/queue-5.10/net-phy-introduce-phydev-port.patch b/queue-5.10/net-phy-introduce-phydev-port.patch new file mode 100644 index 00000000000..063b4ddf463 --- /dev/null +++ b/queue-5.10/net-phy-introduce-phydev-port.patch @@ -0,0 +1,227 @@ +From 4f402c0aac65cc37b67edb7e0e7eda75c60d939c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 17:38:52 +0100 +Subject: net: phy: introduce phydev->port + +From: Michael Walle + +[ Upstream commit 4217a64e18a1647a0dbc68cb3169a5a06f054ec8 ] + +At the moment, PORT_MII is reported in the ethtool ops. This is odd +because it is an interface between the MAC and the PHY and no external +port. Some network card drivers will overwrite the port to twisted pair +or fiber, though. Even worse, the MDI/MDIX setting is only used by +ethtool if the port is twisted pair. + +Set the port to PORT_TP by default because most PHY drivers are copper +ones. If there is fibre support and it is enabled, the PHY driver will +set it to PORT_FIBRE. + +This will change reporting PORT_MII to either PORT_TP or PORT_FIBRE; +except for the genphy fallback driver. + +Suggested-by: Andrew Lunn +Signed-off-by: Michael Walle +Reviewed-by: Florian Fainelli +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/broadcom.c | 2 ++ + drivers/net/phy/dp83822.c | 3 +++ + drivers/net/phy/dp83869.c | 4 ++++ + drivers/net/phy/lxt.c | 1 + + drivers/net/phy/marvell.c | 1 + + drivers/net/phy/marvell10g.c | 2 ++ + drivers/net/phy/micrel.c | 14 +++++++++++--- + drivers/net/phy/phy.c | 2 +- + drivers/net/phy/phy_device.c | 9 +++++++++ + include/linux/phy.h | 2 ++ + 10 files changed, 36 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c +index 69713ea36d4e..739efcce6dd5 100644 +--- a/drivers/net/phy/broadcom.c ++++ b/drivers/net/phy/broadcom.c +@@ -505,6 +505,8 @@ static int bcm54616s_probe(struct phy_device *phydev) + */ + if (!(val & BCM54616S_100FX_MODE)) + phydev->dev_flags |= PHY_BCM_FLAGS_MODE_1000BX; ++ ++ phydev->port = PORT_FIBRE; + } + + return 0; +diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c +index c162c9551bd1..a9b058bb1be8 100644 +--- a/drivers/net/phy/dp83822.c ++++ b/drivers/net/phy/dp83822.c +@@ -534,6 +534,9 @@ static int dp83822_probe(struct phy_device *phydev) + + dp83822_of_init(phydev); + ++ if (dp83822->fx_enabled) ++ phydev->port = PORT_FIBRE; ++ + return 0; + } + +diff --git a/drivers/net/phy/dp83869.c b/drivers/net/phy/dp83869.c +index cf6dec7b7d8e..a9daff88006b 100644 +--- a/drivers/net/phy/dp83869.c ++++ b/drivers/net/phy/dp83869.c +@@ -821,6 +821,10 @@ static int dp83869_probe(struct phy_device *phydev) + if (ret) + return ret; + ++ if (dp83869->mode == DP83869_RGMII_100_BASE || ++ dp83869->mode == DP83869_RGMII_1000_BASE) ++ phydev->port = PORT_FIBRE; ++ + return dp83869_config_init(phydev); + } + +diff --git a/drivers/net/phy/lxt.c b/drivers/net/phy/lxt.c +index fec58ad69e02..cb8e4f0215fe 100644 +--- a/drivers/net/phy/lxt.c ++++ b/drivers/net/phy/lxt.c +@@ -218,6 +218,7 @@ static int lxt973_probe(struct phy_device *phydev) + phy_write(phydev, MII_BMCR, val); + /* Remember that the port is in fiber mode. */ + phydev->priv = lxt973_probe; ++ phydev->port = PORT_FIBRE; + } else { + phydev->priv = NULL; + } +diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c +index 5aec673a0120..5dbdaf0f5f09 100644 +--- a/drivers/net/phy/marvell.c ++++ b/drivers/net/phy/marvell.c +@@ -1449,6 +1449,7 @@ static int marvell_read_status_page(struct phy_device *phydev, int page) + phydev->asym_pause = 0; + phydev->speed = SPEED_UNKNOWN; + phydev->duplex = DUPLEX_UNKNOWN; ++ phydev->port = fiber ? PORT_FIBRE : PORT_TP; + + if (phydev->autoneg == AUTONEG_ENABLE) + err = marvell_read_status_page_an(phydev, fiber, status); +diff --git a/drivers/net/phy/marvell10g.c b/drivers/net/phy/marvell10g.c +index 1901ba277413..b1bb9b8e1e4e 100644 +--- a/drivers/net/phy/marvell10g.c ++++ b/drivers/net/phy/marvell10g.c +@@ -631,6 +631,7 @@ static int mv3310_read_status_10gbaser(struct phy_device *phydev) + phydev->link = 1; + phydev->speed = SPEED_10000; + phydev->duplex = DUPLEX_FULL; ++ phydev->port = PORT_FIBRE; + + return 0; + } +@@ -690,6 +691,7 @@ static int mv3310_read_status_copper(struct phy_device *phydev) + + phydev->duplex = cssr1 & MV_PCS_CSSR1_DUPLEX_FULL ? + DUPLEX_FULL : DUPLEX_HALF; ++ phydev->port = PORT_TP; + phydev->mdix = cssr1 & MV_PCS_CSSR1_MDIX ? + ETH_TP_MDI_X : ETH_TP_MDI; + +diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c +index 47ae1d1723c5..9b0bc8b74bc0 100644 +--- a/drivers/net/phy/micrel.c ++++ b/drivers/net/phy/micrel.c +@@ -308,14 +308,19 @@ static int kszphy_config_init(struct phy_device *phydev) + return kszphy_config_reset(phydev); + } + ++static int ksz8041_fiber_mode(struct phy_device *phydev) ++{ ++ struct device_node *of_node = phydev->mdio.dev.of_node; ++ ++ return of_property_read_bool(of_node, "micrel,fiber-mode"); ++} ++ + static int ksz8041_config_init(struct phy_device *phydev) + { + __ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, }; + +- struct device_node *of_node = phydev->mdio.dev.of_node; +- + /* Limit supported and advertised modes in fiber mode */ +- if (of_property_read_bool(of_node, "micrel,fiber-mode")) { ++ if (ksz8041_fiber_mode(phydev)) { + phydev->dev_flags |= MICREL_PHY_FXEN; + linkmode_set_bit(ETHTOOL_LINK_MODE_100baseT_Full_BIT, mask); + linkmode_set_bit(ETHTOOL_LINK_MODE_100baseT_Half_BIT, mask); +@@ -1143,6 +1148,9 @@ static int kszphy_probe(struct phy_device *phydev) + } + } + ++ if (ksz8041_fiber_mode(phydev)) ++ phydev->port = PORT_FIBRE; ++ + /* Support legacy board-file configuration */ + if (phydev->dev_flags & MICREL_PHY_50MHZ_CLK) { + priv->rmii_ref_clk_sel = true; +diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c +index 49e96ca585ff..28ddaad721ed 100644 +--- a/drivers/net/phy/phy.c ++++ b/drivers/net/phy/phy.c +@@ -327,7 +327,7 @@ void phy_ethtool_ksettings_get(struct phy_device *phydev, + if (phydev->interface == PHY_INTERFACE_MODE_MOCA) + cmd->base.port = PORT_BNC; + else +- cmd->base.port = PORT_MII; ++ cmd->base.port = phydev->port; + cmd->base.transceiver = phy_is_internal(phydev) ? + XCVR_INTERNAL : XCVR_EXTERNAL; + cmd->base.phy_address = phydev->mdio.addr; +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index 2d4eed2d61ce..85f3cde5ffd0 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -576,6 +576,7 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, u32 phy_id, + dev->pause = 0; + dev->asym_pause = 0; + dev->link = 0; ++ dev->port = PORT_TP; + dev->interface = PHY_INTERFACE_MODE_GMII; + + dev->autoneg = AUTONEG_ENABLE; +@@ -1384,6 +1385,14 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev, + + phydev->state = PHY_READY; + ++ /* Port is set to PORT_TP by default and the actual PHY driver will set ++ * it to different value depending on the PHY configuration. If we have ++ * the generic PHY driver we can't figure it out, thus set the old ++ * legacy PORT_MII value. ++ */ ++ if (using_genphy) ++ phydev->port = PORT_MII; ++ + /* Initial carrier state is off as the phy is about to be + * (re)initialized. + */ +diff --git a/include/linux/phy.h b/include/linux/phy.h +index 56563e5e0dc7..08725a262f32 100644 +--- a/include/linux/phy.h ++++ b/include/linux/phy.h +@@ -499,6 +499,7 @@ struct macsec_ops; + * + * @speed: Current link speed + * @duplex: Current duplex ++ * @port: Current port + * @pause: Current pause + * @asym_pause: Current asymmetric pause + * @supported: Combined MAC/PHY supported linkmodes +@@ -577,6 +578,7 @@ struct phy_device { + */ + int speed; + int duplex; ++ int port; + int pause; + int asym_pause; + u8 master_slave_get; +-- +2.30.1 + diff --git a/queue-5.10/net-phylink-fix-phylink_err-function-name-error-in-p.patch b/queue-5.10/net-phylink-fix-phylink_err-function-name-error-in-p.patch new file mode 100644 index 00000000000..be864cbfa86 --- /dev/null +++ b/queue-5.10/net-phylink-fix-phylink_err-function-name-error-in-p.patch @@ -0,0 +1,37 @@ +From 1d0ae50113d77753120dea1fae40c5a488317190 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Mar 2021 12:33:42 +0800 +Subject: net: phylink: Fix phylink_err() function name error in + phylink_major_config + +From: Ong Boon Leong + +[ Upstream commit d82c6c1aaccd2877b6082cebcb1746a13648a16d ] + +if pl->mac_ops->mac_finish() failed, phylink_err should use +"mac_finish" instead of "mac_prepare". + +Fixes: b7ad14c2fe2d4 ("net: phylink: re-implement interface configuration with PCS") +Signed-off-by: Ong Boon Leong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/phylink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c +index fe2296fdda19..6072e87ed6c3 100644 +--- a/drivers/net/phy/phylink.c ++++ b/drivers/net/phy/phylink.c +@@ -472,7 +472,7 @@ static void phylink_major_config(struct phylink *pl, bool restart, + err = pl->mac_ops->mac_finish(pl->config, pl->cur_link_an_mode, + state->interface); + if (err < 0) +- phylink_err(pl, "mac_prepare failed: %pe\n", ++ phylink_err(pl, "mac_finish failed: %pe\n", + ERR_PTR(err)); + } + } +-- +2.30.1 + diff --git a/queue-5.10/net-qlcnic-fix-a-use-after-free-in-qlcnic_83xx_get_m.patch b/queue-5.10/net-qlcnic-fix-a-use-after-free-in-qlcnic_83xx_get_m.patch new file mode 100644 index 00000000000..77aa943d0e9 --- /dev/null +++ b/queue-5.10/net-qlcnic-fix-a-use-after-free-in-qlcnic_83xx_get_m.patch @@ -0,0 +1,44 @@ +From 8d610dea95a3b876723f30391487c24211be744d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 20:01:40 -0800 +Subject: net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template + +From: Lv Yunlong + +[ Upstream commit db74623a3850db99cb9692fda9e836a56b74198d ] + +In qlcnic_83xx_get_minidump_template, fw_dump->tmpl_hdr was freed by +vfree(). But unfortunately, it is used when extended is true. + +Fixes: 7061b2bdd620e ("qlogic: Deletion of unnecessary checks before two function calls") +Signed-off-by: Lv Yunlong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c +index 7760a3394e93..7ecb3dfe30bd 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c +@@ -1425,6 +1425,7 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter) + + if (fw_dump->tmpl_hdr == NULL || current_version > prev_version) { + vfree(fw_dump->tmpl_hdr); ++ fw_dump->tmpl_hdr = NULL; + + if (qlcnic_83xx_md_check_extended_dump_capability(adapter)) + extended = !qlcnic_83xx_extend_md_capab(adapter); +@@ -1443,6 +1444,8 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter) + struct qlcnic_83xx_dump_template_hdr *hdr; + + hdr = fw_dump->tmpl_hdr; ++ if (!hdr) ++ return; + hdr->drv_cap_mask = 0x1f; + fw_dump->cap_mask = 0x1f; + dev_info(&pdev->dev, +-- +2.30.1 + diff --git a/queue-5.10/net-qrtr-fix-a-kernel-infoleak-in-qrtr_recvmsg.patch b/queue-5.10/net-qrtr-fix-a-kernel-infoleak-in-qrtr_recvmsg.patch new file mode 100644 index 00000000000..5196a1eb70a --- /dev/null +++ b/queue-5.10/net-qrtr-fix-a-kernel-infoleak-in-qrtr_recvmsg.patch @@ -0,0 +1,82 @@ +From 63e4ee925d7ac9b905bda992f9ed7103b3ae5f40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 08:59:48 -0800 +Subject: net: qrtr: fix a kernel-infoleak in qrtr_recvmsg() + +From: Eric Dumazet + +[ Upstream commit 50535249f624d0072cd885bcdce4e4b6fb770160 ] + +struct sockaddr_qrtr has a 2-byte hole, and qrtr_recvmsg() currently +does not clear it before copying kernel data to user space. + +It might be too late to name the hole since sockaddr_qrtr structure is uapi. + +BUG: KMSAN: kernel-infoleak in kmsan_copy_to_user+0x9c/0xb0 mm/kmsan/kmsan_hooks.c:249 +CPU: 0 PID: 29705 Comm: syz-executor.3 Not tainted 5.11.0-rc7-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Call Trace: + __dump_stack lib/dump_stack.c:79 [inline] + dump_stack+0x21c/0x280 lib/dump_stack.c:120 + kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 + kmsan_internal_check_memory+0x202/0x520 mm/kmsan/kmsan.c:402 + kmsan_copy_to_user+0x9c/0xb0 mm/kmsan/kmsan_hooks.c:249 + instrument_copy_to_user include/linux/instrumented.h:121 [inline] + _copy_to_user+0x1ac/0x270 lib/usercopy.c:33 + copy_to_user include/linux/uaccess.h:209 [inline] + move_addr_to_user+0x3a2/0x640 net/socket.c:237 + ____sys_recvmsg+0x696/0xd50 net/socket.c:2575 + ___sys_recvmsg net/socket.c:2610 [inline] + do_recvmmsg+0xa97/0x22d0 net/socket.c:2710 + __sys_recvmmsg net/socket.c:2789 [inline] + __do_sys_recvmmsg net/socket.c:2812 [inline] + __se_sys_recvmmsg+0x24a/0x410 net/socket.c:2805 + __x64_sys_recvmmsg+0x62/0x80 net/socket.c:2805 + do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 +RIP: 0033:0x465f69 +Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007f43659d6188 EFLAGS: 00000246 ORIG_RAX: 000000000000012b +RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465f69 +RDX: 0000000000000008 RSI: 0000000020003e40 RDI: 0000000000000003 +RBP: 00000000004bfa8f R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000010060 R11: 0000000000000246 R12: 000000000056bf60 +R13: 0000000000a9fb1f R14: 00007f43659d6300 R15: 0000000000022000 + +Local variable ----addr@____sys_recvmsg created at: + ____sys_recvmsg+0x168/0xd50 net/socket.c:2550 + ____sys_recvmsg+0x168/0xd50 net/socket.c:2550 + +Bytes 2-3 of 12 are uninitialized +Memory access of size 12 starts at ffff88817c627b40 +Data copied to user address 0000000020000140 + +Fixes: bdabad3e363d ("net: Add Qualcomm IPC router") +Signed-off-by: Eric Dumazet +Cc: Courtney Cavin +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/qrtr/qrtr.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c +index 54031ee079a2..45fbf5f4dcd2 100644 +--- a/net/qrtr/qrtr.c ++++ b/net/qrtr/qrtr.c +@@ -1035,6 +1035,11 @@ static int qrtr_recvmsg(struct socket *sock, struct msghdr *msg, + rc = copied; + + if (addr) { ++ /* There is an anonymous 2-byte hole after sq_family, ++ * make sure to clear it. ++ */ ++ memset(addr, 0, sizeof(*addr)); ++ + addr->sq_family = AF_QIPCRTR; + addr->sq_node = cb->src_node; + addr->sq_port = cb->src_port; +-- +2.30.1 + diff --git a/queue-5.10/net-sched-cls_flower-fix-only-mask-bit-check-in-the-.patch b/queue-5.10/net-sched-cls_flower-fix-only-mask-bit-check-in-the-.patch new file mode 100644 index 00000000000..43d5d428e13 --- /dev/null +++ b/queue-5.10/net-sched-cls_flower-fix-only-mask-bit-check-in-the-.patch @@ -0,0 +1,49 @@ +From 90d15c677b21eab6e46ee25f9186154329da4376 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 12:02:43 +0800 +Subject: net/sched: cls_flower: fix only mask bit check in the + validate_ct_state + +From: wenxu + +[ Upstream commit afa536d8405a9ca36e45ba035554afbb8da27b82 ] + +The ct_state validate should not only check the mask bit and also +check mask_bit & key_bit.. +For the +new+est case example, The 'new' and 'est' bits should be +set in both state_mask and state flags. Or the -new-est case also +will be reject by kernel. +When Openvswitch with two flows +ct_state=+trk+new,action=commit,forward +ct_state=+trk+est,action=forward + +A packet go through the kernel and the contrack state is invalid, +The ct_state will be +trk-inv. Upcall to the ovs-vswitchd, the +finally dp action will be drop with -new-est+trk. + +Fixes: 1bcc51ac0731 ("net/sched: cls_flower: Reject invalid ct_state flags rules") +Fixes: 3aed8b63336c ("net/sched: cls_flower: validate ct_state for invalid and reply flags") +Signed-off-by: wenxu +Reviewed-by: Marcelo Ricardo Leitner +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/cls_flower.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c +index 46c1b3e9f66a..14316ba9b3b3 100644 +--- a/net/sched/cls_flower.c ++++ b/net/sched/cls_flower.c +@@ -1432,7 +1432,7 @@ static int fl_set_key_ct(struct nlattr **tb, + &mask->ct_state, TCA_FLOWER_KEY_CT_STATE_MASK, + sizeof(key->ct_state)); + +- err = fl_validate_ct_state(mask->ct_state, ++ err = fl_validate_ct_state(key->ct_state & mask->ct_state, + tb[TCA_FLOWER_KEY_CT_STATE_MASK], + extack); + if (err) +-- +2.30.1 + diff --git a/queue-5.10/net-sched-validate-stab-values.patch b/queue-5.10/net-sched-validate-stab-values.patch new file mode 100644 index 00000000000..f09b3d861ea --- /dev/null +++ b/queue-5.10/net-sched-validate-stab-values.patch @@ -0,0 +1,191 @@ +From 1c5e8aa345679db0259171b12eab9e2d590d544d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 08:26:41 -0800 +Subject: net: sched: validate stab values + +From: Eric Dumazet + +[ Upstream commit e323d865b36134e8c5c82c834df89109a5c60dab ] + +iproute2 package is well behaved, but malicious user space can +provide illegal shift values and trigger UBSAN reports. + +Add stab parameter to red_check_params() to validate user input. + +syzbot reported: + +UBSAN: shift-out-of-bounds in ./include/net/red.h:312:18 +shift exponent 111 is too large for 64-bit type 'long unsigned int' +CPU: 1 PID: 14662 Comm: syz-executor.3 Not tainted 5.12.0-rc2-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Call Trace: + __dump_stack lib/dump_stack.c:79 [inline] + dump_stack+0x141/0x1d7 lib/dump_stack.c:120 + ubsan_epilogue+0xb/0x5a lib/ubsan.c:148 + __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327 + red_calc_qavg_from_idle_time include/net/red.h:312 [inline] + red_calc_qavg include/net/red.h:353 [inline] + choke_enqueue.cold+0x18/0x3dd net/sched/sch_choke.c:221 + __dev_xmit_skb net/core/dev.c:3837 [inline] + __dev_queue_xmit+0x1943/0x2e00 net/core/dev.c:4150 + neigh_hh_output include/net/neighbour.h:499 [inline] + neigh_output include/net/neighbour.h:508 [inline] + ip6_finish_output2+0x911/0x1700 net/ipv6/ip6_output.c:117 + __ip6_finish_output net/ipv6/ip6_output.c:182 [inline] + __ip6_finish_output+0x4c1/0xe10 net/ipv6/ip6_output.c:161 + ip6_finish_output+0x35/0x200 net/ipv6/ip6_output.c:192 + NF_HOOK_COND include/linux/netfilter.h:290 [inline] + ip6_output+0x1e4/0x530 net/ipv6/ip6_output.c:215 + dst_output include/net/dst.h:448 [inline] + NF_HOOK include/linux/netfilter.h:301 [inline] + NF_HOOK include/linux/netfilter.h:295 [inline] + ip6_xmit+0x127e/0x1eb0 net/ipv6/ip6_output.c:320 + inet6_csk_xmit+0x358/0x630 net/ipv6/inet6_connection_sock.c:135 + dccp_transmit_skb+0x973/0x12c0 net/dccp/output.c:138 + dccp_send_reset+0x21b/0x2b0 net/dccp/output.c:535 + dccp_finish_passive_close net/dccp/proto.c:123 [inline] + dccp_finish_passive_close+0xed/0x140 net/dccp/proto.c:118 + dccp_terminate_connection net/dccp/proto.c:958 [inline] + dccp_close+0xb3c/0xe60 net/dccp/proto.c:1028 + inet_release+0x12e/0x280 net/ipv4/af_inet.c:431 + inet6_release+0x4c/0x70 net/ipv6/af_inet6.c:478 + __sock_release+0xcd/0x280 net/socket.c:599 + sock_close+0x18/0x20 net/socket.c:1258 + __fput+0x288/0x920 fs/file_table.c:280 + task_work_run+0xdd/0x1a0 kernel/task_work.c:140 + tracehook_notify_resume include/linux/tracehook.h:189 [inline] + +Fixes: 8afa10cbe281 ("net_sched: red: Avoid illegal values") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/red.h | 10 +++++++++- + net/sched/sch_choke.c | 7 ++++--- + net/sched/sch_gred.c | 2 +- + net/sched/sch_red.c | 7 +++++-- + net/sched/sch_sfq.c | 2 +- + 5 files changed, 20 insertions(+), 8 deletions(-) + +diff --git a/include/net/red.h b/include/net/red.h +index 932f0d79d60c..9e6647c4ccd1 100644 +--- a/include/net/red.h ++++ b/include/net/red.h +@@ -168,7 +168,8 @@ static inline void red_set_vars(struct red_vars *v) + v->qcount = -1; + } + +-static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_log) ++static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, ++ u8 Scell_log, u8 *stab) + { + if (fls(qth_min) + Wlog > 32) + return false; +@@ -178,6 +179,13 @@ static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_ + return false; + if (qth_max < qth_min) + return false; ++ if (stab) { ++ int i; ++ ++ for (i = 0; i < RED_STAB_SIZE; i++) ++ if (stab[i] >= 32) ++ return false; ++ } + return true; + } + +diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c +index 50f680f03a54..2adbd945bf15 100644 +--- a/net/sched/sch_choke.c ++++ b/net/sched/sch_choke.c +@@ -345,6 +345,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt, + struct sk_buff **old = NULL; + unsigned int mask; + u32 max_P; ++ u8 *stab; + + if (opt == NULL) + return -EINVAL; +@@ -361,8 +362,8 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt, + max_P = tb[TCA_CHOKE_MAX_P] ? nla_get_u32(tb[TCA_CHOKE_MAX_P]) : 0; + + ctl = nla_data(tb[TCA_CHOKE_PARMS]); +- +- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) ++ stab = nla_data(tb[TCA_CHOKE_STAB]); ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab)) + return -EINVAL; + + if (ctl->limit > CHOKE_MAX_QUEUE) +@@ -412,7 +413,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt, + + red_set_parms(&q->parms, ctl->qth_min, ctl->qth_max, ctl->Wlog, + ctl->Plog, ctl->Scell_log, +- nla_data(tb[TCA_CHOKE_STAB]), ++ stab, + max_P); + red_set_vars(&q->vars); + +diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c +index e0bc77533acc..f4132dc25ac0 100644 +--- a/net/sched/sch_gred.c ++++ b/net/sched/sch_gred.c +@@ -480,7 +480,7 @@ static inline int gred_change_vq(struct Qdisc *sch, int dp, + struct gred_sched *table = qdisc_priv(sch); + struct gred_sched_data *q = table->tab[dp]; + +- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) { ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab)) { + NL_SET_ERR_MSG_MOD(extack, "invalid RED parameters"); + return -EINVAL; + } +diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c +index b4ae34d7aa96..40adf1f07a82 100644 +--- a/net/sched/sch_red.c ++++ b/net/sched/sch_red.c +@@ -242,6 +242,7 @@ static int __red_change(struct Qdisc *sch, struct nlattr **tb, + unsigned char flags; + int err; + u32 max_P; ++ u8 *stab; + + if (tb[TCA_RED_PARMS] == NULL || + tb[TCA_RED_STAB] == NULL) +@@ -250,7 +251,9 @@ static int __red_change(struct Qdisc *sch, struct nlattr **tb, + max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0; + + ctl = nla_data(tb[TCA_RED_PARMS]); +- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) ++ stab = nla_data(tb[TCA_RED_STAB]); ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ++ ctl->Scell_log, stab)) + return -EINVAL; + + err = red_get_flags(ctl->flags, TC_RED_HISTORIC_FLAGS, +@@ -288,7 +291,7 @@ static int __red_change(struct Qdisc *sch, struct nlattr **tb, + red_set_parms(&q->parms, + ctl->qth_min, ctl->qth_max, ctl->Wlog, + ctl->Plog, ctl->Scell_log, +- nla_data(tb[TCA_RED_STAB]), ++ stab, + max_P); + red_set_vars(&q->vars); + +diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c +index b25e51440623..066754a18569 100644 +--- a/net/sched/sch_sfq.c ++++ b/net/sched/sch_sfq.c +@@ -647,7 +647,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt) + } + + if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max, +- ctl_v1->Wlog, ctl_v1->Scell_log)) ++ ctl_v1->Wlog, ctl_v1->Scell_log, NULL)) + return -EINVAL; + if (ctl_v1 && ctl_v1->qth_min) { + p = kmalloc(sizeof(*p), GFP_KERNEL); +-- +2.30.1 + diff --git a/queue-5.10/net-stmmac-dwmac-sun8i-provide-tx-and-rx-fifo-sizes.patch b/queue-5.10/net-stmmac-dwmac-sun8i-provide-tx-and-rx-fifo-sizes.patch new file mode 100644 index 00000000000..f7a54aba3d8 --- /dev/null +++ b/queue-5.10/net-stmmac-dwmac-sun8i-provide-tx-and-rx-fifo-sizes.patch @@ -0,0 +1,47 @@ +From bde67090213d6102bb63828e412f6e6c8a291b5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 13:44:22 +0000 +Subject: net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes + +From: Corentin Labbe + +[ Upstream commit 014dfa26ce1c647af09bf506285ef67e0e3f0a6b ] + +MTU cannot be changed on dwmac-sun8i. (ip link set eth0 mtu xxx returning EINVAL) +This is due to tx_fifo_size being 0, since this value is used to compute valid +MTU range. +Like dwmac-sunxi (with commit 806fd188ce2a ("net: stmmac: dwmac-sunxi: Provide TX and RX fifo sizes")) +dwmac-sun8i need to have tx and rx fifo sizes set. +I have used values from datasheets. +After this patch, setting a non-default MTU (like 1000) value works and network is still useable. + +Tested-on: sun8i-h3-orangepi-pc +Tested-on: sun8i-r40-bananapi-m2-ultra +Tested-on: sun50i-a64-bananapi-m64 +Tested-on: sun50i-h5-nanopi-neo-plus2 +Tested-on: sun50i-h6-pine-h64 +Fixes: 9f93ac8d408 ("net-next: stmmac: Add dwmac-sun8i") +Reported-by: Belisko Marek +Signed-off-by: Corentin Labbe +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +index a5e0eff4a387..9f5ccf1a0a54 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +@@ -1217,6 +1217,8 @@ static int sun8i_dwmac_probe(struct platform_device *pdev) + plat_dat->init = sun8i_dwmac_init; + plat_dat->exit = sun8i_dwmac_exit; + plat_dat->setup = sun8i_dwmac_setup; ++ plat_dat->tx_fifo_size = 4096; ++ plat_dat->rx_fifo_size = 16384; + + ret = sun8i_dwmac_set_syscon(&pdev->dev, plat_dat); + if (ret) +-- +2.30.1 + diff --git a/queue-5.10/netfilter-ctnetlink-fix-dump-of-the-expect-mask-attr.patch b/queue-5.10/netfilter-ctnetlink-fix-dump-of-the-expect-mask-attr.patch new file mode 100644 index 00000000000..4625d9cb618 --- /dev/null +++ b/queue-5.10/netfilter-ctnetlink-fix-dump-of-the-expect-mask-attr.patch @@ -0,0 +1,41 @@ +From 10a93c1cfa5fc002bc1d9a762ee7da1788562552 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Mar 2021 11:31:09 +0100 +Subject: netfilter: ctnetlink: fix dump of the expect mask attribute + +From: Florian Westphal + +[ Upstream commit b58f33d49e426dc66e98ed73afb5d97b15a25f2d ] + +Before this change, the mask is never included in the netlink message, so +"conntrack -E expect" always prints 0.0.0.0. + +In older kernels the l3num callback struct was passed as argument, based +on tuple->src.l3num. After the l3num indirection got removed, the call +chain is based on m.src.l3num, but this value is 0xffff. + +Init l3num to the correct value. + +Fixes: f957be9d349a3 ("netfilter: conntrack: remove ctnetlink callbacks from l3 protocol trackers") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_netlink.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 3d0fd33be018..c1bfd8181341 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -2960,6 +2960,7 @@ static int ctnetlink_exp_dump_mask(struct sk_buff *skb, + memset(&m, 0xFF, sizeof(m)); + memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3)); + m.src.u.all = mask->src.u.all; ++ m.src.l3num = tuple->src.l3num; + m.dst.protonum = tuple->dst.protonum; + + nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK); +-- +2.30.1 + diff --git a/queue-5.10/netfilter-flowtable-make-sure-gc-works-periodically-.patch b/queue-5.10/netfilter-flowtable-make-sure-gc-works-periodically-.patch new file mode 100644 index 00000000000..824c1e8014e --- /dev/null +++ b/queue-5.10/netfilter-flowtable-make-sure-gc-works-periodically-.patch @@ -0,0 +1,43 @@ +From e0f5cc0ad13a0b421ee3c94f1f72ff505a749de0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 13:42:24 +0100 +Subject: netfilter: flowtable: Make sure GC works periodically in idle system + +From: Yinjun Zhang + +[ Upstream commit 740b486a8d1f966e68ac0666f1fd57441a7cda94 ] + +Currently flowtable's GC work is initialized as deferrable, which +means GC cannot work on time when system is idle. So the hardware +offloaded flow may be deleted for timeout, since its used time is +not timely updated. + +Resolve it by initializing the GC work as delayed work instead of +deferrable. + +Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") +Signed-off-by: Yinjun Zhang +Signed-off-by: Louis Peens +Signed-off-by: Simon Horman +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_flow_table_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c +index 4a4acbba78ff..b03feb6e1226 100644 +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -506,7 +506,7 @@ int nf_flow_table_init(struct nf_flowtable *flowtable) + { + int err; + +- INIT_DEFERRABLE_WORK(&flowtable->gc_work, nf_flow_offload_work_gc); ++ INIT_DELAYED_WORK(&flowtable->gc_work, nf_flow_offload_work_gc); + flow_block_init(&flowtable->flow_block); + init_rwsem(&flowtable->flow_block_lock); + +-- +2.30.1 + diff --git a/queue-5.10/netfilter-nftables-allow-to-update-flowtable-flags.patch b/queue-5.10/netfilter-nftables-allow-to-update-flowtable-flags.patch new file mode 100644 index 00000000000..df7a6a980e5 --- /dev/null +++ b/queue-5.10/netfilter-nftables-allow-to-update-flowtable-flags.patch @@ -0,0 +1,91 @@ +From 728703e57b8d74aa3b0f7109a1968645a4ffd5f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 12:54:57 +0100 +Subject: netfilter: nftables: allow to update flowtable flags + +From: Pablo Neira Ayuso + +[ Upstream commit 7b35582cd04ace2fd1807c1b624934e465cc939d ] + +Honor flowtable flags from the control update path. Disallow disabling +to toggle hardware offload support though. + +Fixes: 8bb69f3b2918 ("netfilter: nf_tables: add flowtable offload control plane") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_tables.h | 3 +++ + net/netfilter/nf_tables_api.c | 15 +++++++++++++++ + 2 files changed, 18 insertions(+) + +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index c1c0a4ff92ae..ed4a9d098164 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -1508,6 +1508,7 @@ struct nft_trans_flowtable { + struct nft_flowtable *flowtable; + bool update; + struct list_head hook_list; ++ u32 flags; + }; + + #define nft_trans_flowtable(trans) \ +@@ -1516,6 +1517,8 @@ struct nft_trans_flowtable { + (((struct nft_trans_flowtable *)trans->data)->update) + #define nft_trans_flowtable_hooks(trans) \ + (((struct nft_trans_flowtable *)trans->data)->hook_list) ++#define nft_trans_flowtable_flags(trans) \ ++ (((struct nft_trans_flowtable *)trans->data)->flags) + + int __init nft_chain_filter_init(void); + void nft_chain_filter_fini(void); +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 7cdbe8733540..978a968d7aed 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -6632,6 +6632,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, + struct nft_hook *hook, *next; + struct nft_trans *trans; + bool unregister = false; ++ u32 flags; + int err; + + err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK], +@@ -6646,6 +6647,17 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, + } + } + ++ if (nla[NFTA_FLOWTABLE_FLAGS]) { ++ flags = ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS])); ++ if (flags & ~NFT_FLOWTABLE_MASK) ++ return -EOPNOTSUPP; ++ if ((flowtable->data.flags & NFT_FLOWTABLE_HW_OFFLOAD) ^ ++ (flags & NFT_FLOWTABLE_HW_OFFLOAD)) ++ return -EOPNOTSUPP; ++ } else { ++ flags = flowtable->data.flags; ++ } ++ + err = nft_register_flowtable_net_hooks(ctx->net, ctx->table, + &flowtable_hook.list, flowtable); + if (err < 0) +@@ -6659,6 +6671,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, + goto err_flowtable_update_hook; + } + ++ nft_trans_flowtable_flags(trans) = flags; + nft_trans_flowtable(trans) = flowtable; + nft_trans_flowtable_update(trans) = true; + INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); +@@ -7968,6 +7981,8 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) + break; + case NFT_MSG_NEWFLOWTABLE: + if (nft_trans_flowtable_update(trans)) { ++ nft_trans_flowtable(trans)->data.flags = ++ nft_trans_flowtable_flags(trans); + nf_tables_flowtable_notify(&trans->ctx, + nft_trans_flowtable(trans), + &nft_trans_flowtable_hooks(trans), +-- +2.30.1 + diff --git a/queue-5.10/netfilter-nftables-report-eopnotsupp-on-unsupported-.patch b/queue-5.10/netfilter-nftables-report-eopnotsupp-on-unsupported-.patch new file mode 100644 index 00000000000..4f15775cc65 --- /dev/null +++ b/queue-5.10/netfilter-nftables-report-eopnotsupp-on-unsupported-.patch @@ -0,0 +1,37 @@ +From 6beeab2162ba1756f2d80576fe870ca36e62d0b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 11:31:55 +0100 +Subject: netfilter: nftables: report EOPNOTSUPP on unsupported flowtable flags + +From: Pablo Neira Ayuso + +[ Upstream commit 7e6136f1b7272b2202817cff37ada355eb5e6784 ] + +Error was not set accordingly. + +Fixes: 8bb69f3b2918 ("netfilter: nf_tables: add flowtable offload control plane") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 8739ef135156..7cdbe8733540 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -6753,8 +6753,10 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk, + if (nla[NFTA_FLOWTABLE_FLAGS]) { + flowtable->data.flags = + ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS])); +- if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK) ++ if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK) { ++ err = -EOPNOTSUPP; + goto err3; ++ } + } + + write_pnet(&flowtable->data.net, net); +-- +2.30.1 + diff --git a/queue-5.10/netfilter-x_tables-use-correct-memory-barriers.patch b/queue-5.10/netfilter-x_tables-use-correct-memory-barriers.patch new file mode 100644 index 00000000000..55aec1a67c0 --- /dev/null +++ b/queue-5.10/netfilter-x_tables-use-correct-memory-barriers.patch @@ -0,0 +1,63 @@ +From dede2fc2b442beae5122be9265b53a25ad924d6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 14:24:13 +1300 +Subject: netfilter: x_tables: Use correct memory barriers. + +From: Mark Tomlinson + +[ Upstream commit 175e476b8cdf2a4de7432583b49c871345e4f8a1 ] + +When a new table value was assigned, it was followed by a write memory +barrier. This ensured that all writes before this point would complete +before any writes after this point. However, to determine whether the +rules are unused, the sequence counter is read. To ensure that all +writes have been done before these reads, a full memory barrier is +needed, not just a write memory barrier. The same argument applies when +incrementing the counter, before the rules are read. + +Changing to using smp_mb() instead of smp_wmb() fixes the kernel panic +reported in cc00bcaa5899 (which is still present), while still +maintaining the same speed of replacing tables. + +The smb_mb() barriers potentially slow the packet path, however testing +has shown no measurable change in performance on a 4-core MIPS64 +platform. + +Fixes: 7f5c6d4f665b ("netfilter: get rid of atomic ops in fast path") +Signed-off-by: Mark Tomlinson +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/linux/netfilter/x_tables.h | 2 +- + net/netfilter/x_tables.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h +index 5deb099d156d..8ec48466410a 100644 +--- a/include/linux/netfilter/x_tables.h ++++ b/include/linux/netfilter/x_tables.h +@@ -376,7 +376,7 @@ static inline unsigned int xt_write_recseq_begin(void) + * since addend is most likely 1 + */ + __this_cpu_add(xt_recseq.sequence, addend); +- smp_wmb(); ++ smp_mb(); + + return addend; + } +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index 7df3aef39c5c..6bd31a7a27fc 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -1389,7 +1389,7 @@ xt_replace_table(struct xt_table *table, + table->private = newinfo; + + /* make sure all cpus see new ->private value */ +- smp_wmb(); ++ smp_mb(); + + /* + * Even though table entries have now been swapped, other CPU's +-- +2.30.1 + diff --git a/queue-5.10/nfp-flower-add-ipv6-bit-to-pre_tunnel-control-messag.patch b/queue-5.10/nfp-flower-add-ipv6-bit-to-pre_tunnel-control-messag.patch new file mode 100644 index 00000000000..38a474ca877 --- /dev/null +++ b/queue-5.10/nfp-flower-add-ipv6-bit-to-pre_tunnel-control-messag.patch @@ -0,0 +1,64 @@ +From b8ccde2abea25f2fbc794bbd82fcdbf1b8e8c58c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Mar 2021 19:13:09 +0100 +Subject: nfp: flower: add ipv6 bit to pre_tunnel control message + +From: Louis Peens + +[ Upstream commit 5c4f5e19d6a8e159127b9d653bb67e0dc7a28047 ] + +Differentiate between ipv4 and ipv6 flows when configuring the pre_tunnel +table to prevent them trampling each other in the table. + +Fixes: 783461604f7e ("nfp: flower: update flow merge code to support IPv6 tunnels") +Signed-off-by: Louis Peens +Signed-off-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../ethernet/netronome/nfp/flower/tunnel_conf.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c +index 7248d248f604..d19c02e99114 100644 +--- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c ++++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c +@@ -16,8 +16,9 @@ + #define NFP_FL_MAX_ROUTES 32 + + #define NFP_TUN_PRE_TUN_RULE_LIMIT 32 +-#define NFP_TUN_PRE_TUN_RULE_DEL 0x1 +-#define NFP_TUN_PRE_TUN_IDX_BIT 0x8 ++#define NFP_TUN_PRE_TUN_RULE_DEL BIT(0) ++#define NFP_TUN_PRE_TUN_IDX_BIT BIT(3) ++#define NFP_TUN_PRE_TUN_IPV6_BIT BIT(7) + + /** + * struct nfp_tun_pre_run_rule - rule matched before decap +@@ -1268,6 +1269,7 @@ int nfp_flower_xmit_pre_tun_flow(struct nfp_app *app, + { + struct nfp_flower_priv *app_priv = app->priv; + struct nfp_tun_offloaded_mac *mac_entry; ++ struct nfp_flower_meta_tci *key_meta; + struct nfp_tun_pre_tun_rule payload; + struct net_device *internal_dev; + int err; +@@ -1290,6 +1292,15 @@ int nfp_flower_xmit_pre_tun_flow(struct nfp_app *app, + if (!mac_entry) + return -ENOENT; + ++ /* Set/clear IPV6 bit. cpu_to_be16() swap will lead to MSB being ++ * set/clear for port_idx. ++ */ ++ key_meta = (struct nfp_flower_meta_tci *)flow->unmasked_data; ++ if (key_meta->nfp_flow_key_layer & NFP_FLOWER_LAYER_IPV6) ++ mac_entry->index |= NFP_TUN_PRE_TUN_IPV6_BIT; ++ else ++ mac_entry->index &= ~NFP_TUN_PRE_TUN_IPV6_BIT; ++ + payload.port_idx = cpu_to_be16(mac_entry->index); + + /* Copy mac id and vlan to flow - dev may not exist at delete time. */ +-- +2.30.1 + diff --git a/queue-5.10/nfp-flower-fix-pre_tun-mask-id-allocation.patch b/queue-5.10/nfp-flower-fix-pre_tun-mask-id-allocation.patch new file mode 100644 index 00000000000..d95bbf80c38 --- /dev/null +++ b/queue-5.10/nfp-flower-fix-pre_tun-mask-id-allocation.patch @@ -0,0 +1,85 @@ +From 28c45cd22cb3a21ce71391fb50d98ba1607fbd96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Mar 2021 19:13:10 +0100 +Subject: nfp: flower: fix pre_tun mask id allocation + +From: Louis Peens + +[ Upstream commit d8ce0275e45ec809a33f98fc080fe7921b720dfb ] + +pre_tun_rule flows does not follow the usual add-flow path, instead +they are used to update the pre_tun table on the firmware. This means +that if the mask-id gets allocated here the firmware will never see the +"NFP_FL_META_FLAG_MANAGE_MASK" flag for the specific mask id, which +triggers the allocation on the firmware side. This leads to the firmware +mask being corrupted and causing all sorts of strange behaviour. + +Fixes: f12725d98cbe ("nfp: flower: offload pre-tunnel rules") +Signed-off-by: Louis Peens +Signed-off-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../ethernet/netronome/nfp/flower/metadata.c | 24 +++++++++++++------ + 1 file changed, 17 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/netronome/nfp/flower/metadata.c b/drivers/net/ethernet/netronome/nfp/flower/metadata.c +index 5defd31d481c..aa06fcb38f8b 100644 +--- a/drivers/net/ethernet/netronome/nfp/flower/metadata.c ++++ b/drivers/net/ethernet/netronome/nfp/flower/metadata.c +@@ -327,8 +327,14 @@ int nfp_compile_flow_metadata(struct nfp_app *app, + goto err_free_ctx_entry; + } + ++ /* Do net allocate a mask-id for pre_tun_rules. These flows are used to ++ * configure the pre_tun table and are never actually send to the ++ * firmware as an add-flow message. This causes the mask-id allocation ++ * on the firmware to get out of sync if allocated here. ++ */ + new_mask_id = 0; +- if (!nfp_check_mask_add(app, nfp_flow->mask_data, ++ if (!nfp_flow->pre_tun_rule.dev && ++ !nfp_check_mask_add(app, nfp_flow->mask_data, + nfp_flow->meta.mask_len, + &nfp_flow->meta.flags, &new_mask_id)) { + NL_SET_ERR_MSG_MOD(extack, "invalid entry: cannot allocate a new mask id"); +@@ -359,7 +365,8 @@ int nfp_compile_flow_metadata(struct nfp_app *app, + goto err_remove_mask; + } + +- if (!nfp_check_mask_remove(app, nfp_flow->mask_data, ++ if (!nfp_flow->pre_tun_rule.dev && ++ !nfp_check_mask_remove(app, nfp_flow->mask_data, + nfp_flow->meta.mask_len, + NULL, &new_mask_id)) { + NL_SET_ERR_MSG_MOD(extack, "invalid entry: cannot release mask id"); +@@ -374,8 +381,10 @@ int nfp_compile_flow_metadata(struct nfp_app *app, + return 0; + + err_remove_mask: +- nfp_check_mask_remove(app, nfp_flow->mask_data, nfp_flow->meta.mask_len, +- NULL, &new_mask_id); ++ if (!nfp_flow->pre_tun_rule.dev) ++ nfp_check_mask_remove(app, nfp_flow->mask_data, ++ nfp_flow->meta.mask_len, ++ NULL, &new_mask_id); + err_remove_rhash: + WARN_ON_ONCE(rhashtable_remove_fast(&priv->stats_ctx_table, + &ctx_entry->ht_node, +@@ -406,9 +415,10 @@ int nfp_modify_flow_metadata(struct nfp_app *app, + + __nfp_modify_flow_metadata(priv, nfp_flow); + +- nfp_check_mask_remove(app, nfp_flow->mask_data, +- nfp_flow->meta.mask_len, &nfp_flow->meta.flags, +- &new_mask_id); ++ if (!nfp_flow->pre_tun_rule.dev) ++ nfp_check_mask_remove(app, nfp_flow->mask_data, ++ nfp_flow->meta.mask_len, &nfp_flow->meta.flags, ++ &new_mask_id); + + /* Update flow payload with mask ids. */ + nfp_flow->unmasked_data[NFP_FL_MASK_ID_LOCATION] = new_mask_id; +-- +2.30.1 + diff --git a/queue-5.10/nfp-flower-fix-unsupported-pre_tunnel-flows.patch b/queue-5.10/nfp-flower-fix-unsupported-pre_tunnel-flows.patch new file mode 100644 index 00000000000..84b84222d5c --- /dev/null +++ b/queue-5.10/nfp-flower-fix-unsupported-pre_tunnel-flows.patch @@ -0,0 +1,71 @@ +From 9fff89ea5570f0cb5eb964e89822f46b9945b8ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Mar 2021 19:13:08 +0100 +Subject: nfp: flower: fix unsupported pre_tunnel flows + +From: Louis Peens + +[ Upstream commit 982e5ee23d764fe6158f67a7813d416335e978b0 ] + +There are some pre_tunnel flows combinations which are incorrectly being +offloaded without proper support, fix these. + +- Matching on MPLS is not supported for pre_tun. +- Match on IPv4/IPv6 layer must be present. +- Destination MAC address must match pre_tun.dev MAC + +Fixes: 120ffd84a9ec ("nfp: flower: verify pre-tunnel rules") +Signed-off-by: Louis Peens +Signed-off-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../ethernet/netronome/nfp/flower/offload.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/net/ethernet/netronome/nfp/flower/offload.c b/drivers/net/ethernet/netronome/nfp/flower/offload.c +index 1c59aff2163c..d72225d64a75 100644 +--- a/drivers/net/ethernet/netronome/nfp/flower/offload.c ++++ b/drivers/net/ethernet/netronome/nfp/flower/offload.c +@@ -1142,6 +1142,12 @@ nfp_flower_validate_pre_tun_rule(struct nfp_app *app, + return -EOPNOTSUPP; + } + ++ if (!(key_layer & NFP_FLOWER_LAYER_IPV4) && ++ !(key_layer & NFP_FLOWER_LAYER_IPV6)) { ++ NL_SET_ERR_MSG_MOD(extack, "unsupported pre-tunnel rule: match on ipv4/ipv6 eth_type must be present"); ++ return -EOPNOTSUPP; ++ } ++ + /* Skip fields known to exist. */ + mask += sizeof(struct nfp_flower_meta_tci); + ext += sizeof(struct nfp_flower_meta_tci); +@@ -1152,6 +1158,13 @@ nfp_flower_validate_pre_tun_rule(struct nfp_app *app, + mask += sizeof(struct nfp_flower_in_port); + ext += sizeof(struct nfp_flower_in_port); + ++ /* Ensure destination MAC address matches pre_tun_dev. */ ++ mac = (struct nfp_flower_mac_mpls *)ext; ++ if (memcmp(&mac->mac_dst[0], flow->pre_tun_rule.dev->dev_addr, 6)) { ++ NL_SET_ERR_MSG_MOD(extack, "unsupported pre-tunnel rule: dest MAC must match output dev MAC"); ++ return -EOPNOTSUPP; ++ } ++ + /* Ensure destination MAC address is fully matched. */ + mac = (struct nfp_flower_mac_mpls *)mask; + if (!is_broadcast_ether_addr(&mac->mac_dst[0])) { +@@ -1159,6 +1172,11 @@ nfp_flower_validate_pre_tun_rule(struct nfp_app *app, + return -EOPNOTSUPP; + } + ++ if (mac->mpls_lse) { ++ NL_SET_ERR_MSG_MOD(extack, "unsupported pre-tunnel rule: MPLS not supported"); ++ return -EOPNOTSUPP; ++ } ++ + mask += sizeof(struct nfp_flower_mac_mpls); + ext += sizeof(struct nfp_flower_mac_mpls); + if (key_layer & NFP_FLOWER_LAYER_IPV4 || +-- +2.30.1 + diff --git a/queue-5.10/octeontx2-af-fix-infinite-loop-in-unmapping-npc-coun.patch b/queue-5.10/octeontx2-af-fix-infinite-loop-in-unmapping-npc-coun.patch new file mode 100644 index 00000000000..03269765cf2 --- /dev/null +++ b/queue-5.10/octeontx2-af-fix-infinite-loop-in-unmapping-npc-coun.patch @@ -0,0 +1,47 @@ +From 38f02cfbbb7e8ead205cdfacc5e9cf6133e9ace6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 19:45:48 +0530 +Subject: octeontx2-af: fix infinite loop in unmapping NPC counter + +From: Hariprasad Kelam + +[ Upstream commit 64451b98306bf1334a62bcd020ec92bdb4cb68db ] + +unmapping npc counter works in a way by traversing all mcam +entries to find which mcam rule is associated with counter. +But loop cursor variable 'entry' is not incremented before +checking next mcam entry which resulting in infinite loop. + +This in turn hogs the kworker thread forever and no other +mbox message is processed by AF driver after that. +Fix this by updating entry value before checking next +mcam entry. + +Fixes: a958dd59f9ce ("octeontx2-af: Map or unmap NPC MCAM entry and counter") +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Kovvuri Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +index 511b01dd03ed..169ae491f978 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +@@ -2035,10 +2035,10 @@ int rvu_mbox_handler_npc_mcam_free_counter(struct rvu *rvu, + index = find_next_bit(mcam->bmap, mcam->bmap_entries, entry); + if (index >= mcam->bmap_entries) + break; ++ entry = index + 1; + if (mcam->entry2cntr_map[index] != req->cntr) + continue; + +- entry = index + 1; + npc_unmap_mcam_entry_and_cntr(rvu, mcam, blkaddr, + index, req->cntr); + } +-- +2.30.1 + diff --git a/queue-5.10/octeontx2-af-fix-irq-free-in-rvu-teardown.patch b/queue-5.10/octeontx2-af-fix-irq-free-in-rvu-teardown.patch new file mode 100644 index 00000000000..205c78e78a3 --- /dev/null +++ b/queue-5.10/octeontx2-af-fix-irq-free-in-rvu-teardown.patch @@ -0,0 +1,43 @@ +From 0c1bfff248f12e7e8f9c8e985dbd71c87faf407c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 19:45:46 +0530 +Subject: octeontx2-af: Fix irq free in rvu teardown + +From: Geetha sowjanya + +[ Upstream commit ae2619dd4fccdad9876aa5f900bd85484179c50f ] + +Current devlink code try to free already freed irqs as the +irq_allocate flag is not cleared after free leading to kernel +crash while removing rvu driver. The patch fixes the irq free +sequence and clears the irq_allocate flag on free. + +Fixes: 7304ac4567bc ("octeontx2-af: Add mailbox IRQ and msg handlers") +Signed-off-by: Geetha sowjanya +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Kovvuri Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +index e1f918960730..644d28b0692b 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +@@ -2151,8 +2151,10 @@ static void rvu_unregister_interrupts(struct rvu *rvu) + INTR_MASK(rvu->hw->total_pfs) & ~1ULL); + + for (irq = 0; irq < rvu->num_vec; irq++) { +- if (rvu->irq_allocated[irq]) ++ if (rvu->irq_allocated[irq]) { + free_irq(pci_irq_vector(rvu->pdev, irq), rvu); ++ rvu->irq_allocated[irq] = false; ++ } + } + + pci_free_irq_vectors(rvu->pdev); +-- +2.30.1 + diff --git a/queue-5.10/octeontx2-af-fix-memory-leak-of-object-buf.patch b/queue-5.10/octeontx2-af-fix-memory-leak-of-object-buf.patch new file mode 100644 index 00000000000..2b17944e6ec --- /dev/null +++ b/queue-5.10/octeontx2-af-fix-memory-leak-of-object-buf.patch @@ -0,0 +1,41 @@ +From bd2a6b02f21f64e75771e197e7e173862a537e87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 12:32:45 +0000 +Subject: octeontx2-af: Fix memory leak of object buf + +From: Colin Ian King + +[ Upstream commit 9e0a537d06fc36861e4f78d0a7df1fe2b3592714 ] + +Currently the error return path when lfs fails to allocate is not free'ing +the memory allocated to buf. Fix this by adding the missing kfree. + +Addresses-Coverity: ("Resource leak") +Fixes: f7884097141b ("octeontx2-af: Formatting debugfs entry rsrc_alloc.") +Signed-off-by: Colin Ian King +Acked-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c +index c018121d4cc5..bc870bff14df 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c +@@ -163,8 +163,10 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp, + return -ENOSPC; + + lfs = kzalloc(lf_str_size, GFP_KERNEL); +- if (!lfs) ++ if (!lfs) { ++ kfree(buf); + return -ENOMEM; ++ } + off += scnprintf(&buf[off], buf_size - 1 - off, "%-*s", lf_str_size, + "pcifunc"); + for (index = 0; index < BLK_COUNT; index++) +-- +2.30.1 + diff --git a/queue-5.10/octeontx2-af-formatting-debugfs-entry-rsrc_alloc.patch b/queue-5.10/octeontx2-af-formatting-debugfs-entry-rsrc_alloc.patch new file mode 100644 index 00000000000..3661a0d3c5d --- /dev/null +++ b/queue-5.10/octeontx2-af-formatting-debugfs-entry-rsrc_alloc.patch @@ -0,0 +1,140 @@ +From dd5828a8cef8cedbe68eed862103b457168afd15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 19:45:43 +0530 +Subject: octeontx2-af: Formatting debugfs entry rsrc_alloc. + +From: Rakesh Babu + +[ Upstream commit f7884097141b615b6ce89c16f456a53902b4eec3 ] + +With the existing rsrc_alloc's format, there is misalignment for the +pcifunc entries whose VF's index is a double digit. This patch fixes +this. + + pcifunc NPA NIX0 NIX1 SSO GROUP SSOWS + TIM CPT0 CPT1 REE0 REE1 + PF0:VF0 8 5 + PF0:VF1 9 3 + PF0:VF10 18 10 + PF0:VF11 19 8 + PF0:VF12 20 11 + PF0:VF13 21 9 + PF0:VF14 22 12 + PF0:VF15 23 10 + PF1 0 0 + +Fixes: 23205e6d06d4 ("octeontx2-af: Dump current resource provisioning status") +Signed-off-by: Rakesh Babu +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Kovvuri Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../marvell/octeontx2/af/rvu_debugfs.c | 46 ++++++++++++------- + 1 file changed, 29 insertions(+), 17 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c +index 809f50ab0432..c018121d4cc5 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c +@@ -144,12 +144,14 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp, + char __user *buffer, + size_t count, loff_t *ppos) + { +- int index, off = 0, flag = 0, go_back = 0, off_prev; ++ int index, off = 0, flag = 0, go_back = 0, len = 0; + struct rvu *rvu = filp->private_data; + int lf, pf, vf, pcifunc; + struct rvu_block block; + int bytes_not_copied; ++ int lf_str_size = 12; + int buf_size = 2048; ++ char *lfs; + char *buf; + + /* don't allow partial reads */ +@@ -159,12 +161,18 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp, + buf = kzalloc(buf_size, GFP_KERNEL); + if (!buf) + return -ENOSPC; +- off += scnprintf(&buf[off], buf_size - 1 - off, "\npcifunc\t\t"); ++ ++ lfs = kzalloc(lf_str_size, GFP_KERNEL); ++ if (!lfs) ++ return -ENOMEM; ++ off += scnprintf(&buf[off], buf_size - 1 - off, "%-*s", lf_str_size, ++ "pcifunc"); + for (index = 0; index < BLK_COUNT; index++) +- if (strlen(rvu->hw->block[index].name)) +- off += scnprintf(&buf[off], buf_size - 1 - off, +- "%*s\t", (index - 1) * 2, +- rvu->hw->block[index].name); ++ if (strlen(rvu->hw->block[index].name)) { ++ off += scnprintf(&buf[off], buf_size - 1 - off, ++ "%-*s", lf_str_size, ++ rvu->hw->block[index].name); ++ } + off += scnprintf(&buf[off], buf_size - 1 - off, "\n"); + for (pf = 0; pf < rvu->hw->total_pfs; pf++) { + for (vf = 0; vf <= rvu->hw->total_vfs; vf++) { +@@ -173,14 +181,15 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp, + continue; + + if (vf) { ++ sprintf(lfs, "PF%d:VF%d", pf, vf - 1); + go_back = scnprintf(&buf[off], + buf_size - 1 - off, +- "PF%d:VF%d\t\t", pf, +- vf - 1); ++ "%-*s", lf_str_size, lfs); + } else { ++ sprintf(lfs, "PF%d", pf); + go_back = scnprintf(&buf[off], + buf_size - 1 - off, +- "PF%d\t\t", pf); ++ "%-*s", lf_str_size, lfs); + } + + off += go_back; +@@ -188,20 +197,22 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp, + block = rvu->hw->block[index]; + if (!strlen(block.name)) + continue; +- off_prev = off; ++ len = 0; ++ lfs[len] = '\0'; + for (lf = 0; lf < block.lf.max; lf++) { + if (block.fn_map[lf] != pcifunc) + continue; + flag = 1; +- off += scnprintf(&buf[off], buf_size - 1 +- - off, "%3d,", lf); ++ len += sprintf(&lfs[len], "%d,", lf); + } +- if (flag && off_prev != off) +- off--; +- else +- go_back++; ++ ++ if (flag) ++ len--; ++ lfs[len] = '\0'; + off += scnprintf(&buf[off], buf_size - 1 - off, +- "\t"); ++ "%-*s", lf_str_size, lfs); ++ if (!strlen(lfs)) ++ go_back += lf_str_size; + } + if (!flag) + off -= go_back; +@@ -213,6 +224,7 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp, + } + + bytes_not_copied = copy_to_user(buffer, buf, off); ++ kfree(lfs); + kfree(buf); + + if (bytes_not_copied) +-- +2.30.1 + diff --git a/queue-5.10/octeontx2-af-modify-default-kex-profile-to-extract-t.patch b/queue-5.10/octeontx2-af-modify-default-kex-profile-to-extract-t.patch new file mode 100644 index 00000000000..a3a9c96d58e --- /dev/null +++ b/queue-5.10/octeontx2-af-modify-default-kex-profile-to-extract-t.patch @@ -0,0 +1,237 @@ +From 3192dd2f363e1e926cc58c115d340b27148e8d3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Nov 2020 01:22:51 +0530 +Subject: octeontx2-af: Modify default KEX profile to extract TX packet fields + +From: Stanislaw Kardach + +[ Upstream commit f1517f6f1d6fd97a18836b0fb6921f2cb105eeb4 ] + +The current default Key Extraction(KEX) profile can only use RX +packet fields while generating the MCAM search key. The profile +can't be used for matching TX packet fields. This patch modifies +the default KEX profile to add support for extracting TX packet +fields into MCAM search key. Enabled Tx KPU packet parsing by +configuring TX PKIND in tx_parse_cfg. + +Modified the KEX profile to extract 2 bytes of VLAN TCI from an +offset of 2 bytes from LB_PTR. The LB_PTR points to the byte offset +where the VLAN header starts. The NPC KPU parser profile has been +modified to point LB_PTR to the starting byte offset of VLAN header +which points to the tpid field. + +Signed-off-by: Stanislaw Kardach +Signed-off-by: Sunil Goutham +Signed-off-by: Naveen Mamindlapalli +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/marvell/octeontx2/af/npc.h | 31 ++++++ + .../marvell/octeontx2/af/npc_profile.h | 99 ++++++++++++++++--- + .../ethernet/marvell/octeontx2/af/rvu_nix.c | 4 + + 3 files changed, 120 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/npc.h b/drivers/net/ethernet/marvell/octeontx2/af/npc.h +index 91a9d00e4fb5..407b9477da24 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/npc.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/npc.h +@@ -140,6 +140,15 @@ enum npc_kpu_lh_ltype { + NPC_LT_LH_CUSTOM1 = 0xF, + }; + ++/* NPC port kind defines how the incoming or outgoing packets ++ * are processed. NPC accepts packets from up to 64 pkinds. ++ * Software assigns pkind for each incoming port such as CGX ++ * Ethernet interfaces, LBK interfaces, etc. ++ */ ++enum npc_pkind_type { ++ NPC_TX_DEF_PKIND = 63ULL, /* NIX-TX PKIND */ ++}; ++ + struct npc_kpu_profile_cam { + u8 state; + u8 state_mask; +@@ -300,6 +309,28 @@ struct nix_rx_action { + /* NPC_AF_INTFX_KEX_CFG field masks */ + #define NPC_PARSE_NIBBLE GENMASK_ULL(30, 0) + ++/* NPC_PARSE_KEX_S nibble definitions for each field */ ++#define NPC_PARSE_NIBBLE_CHAN GENMASK_ULL(2, 0) ++#define NPC_PARSE_NIBBLE_ERRLEV BIT_ULL(3) ++#define NPC_PARSE_NIBBLE_ERRCODE GENMASK_ULL(5, 4) ++#define NPC_PARSE_NIBBLE_L2L3_BCAST BIT_ULL(6) ++#define NPC_PARSE_NIBBLE_LA_FLAGS GENMASK_ULL(8, 7) ++#define NPC_PARSE_NIBBLE_LA_LTYPE BIT_ULL(9) ++#define NPC_PARSE_NIBBLE_LB_FLAGS GENMASK_ULL(11, 10) ++#define NPC_PARSE_NIBBLE_LB_LTYPE BIT_ULL(12) ++#define NPC_PARSE_NIBBLE_LC_FLAGS GENMASK_ULL(14, 13) ++#define NPC_PARSE_NIBBLE_LC_LTYPE BIT_ULL(15) ++#define NPC_PARSE_NIBBLE_LD_FLAGS GENMASK_ULL(17, 16) ++#define NPC_PARSE_NIBBLE_LD_LTYPE BIT_ULL(18) ++#define NPC_PARSE_NIBBLE_LE_FLAGS GENMASK_ULL(20, 19) ++#define NPC_PARSE_NIBBLE_LE_LTYPE BIT_ULL(21) ++#define NPC_PARSE_NIBBLE_LF_FLAGS GENMASK_ULL(23, 22) ++#define NPC_PARSE_NIBBLE_LF_LTYPE BIT_ULL(24) ++#define NPC_PARSE_NIBBLE_LG_FLAGS GENMASK_ULL(26, 25) ++#define NPC_PARSE_NIBBLE_LG_LTYPE BIT_ULL(27) ++#define NPC_PARSE_NIBBLE_LH_FLAGS GENMASK_ULL(29, 28) ++#define NPC_PARSE_NIBBLE_LH_LTYPE BIT_ULL(30) ++ + /* NIX Receive Vtag Action Structure */ + #define VTAG0_VALID_BIT BIT_ULL(15) + #define VTAG0_TYPE_MASK GENMASK_ULL(14, 12) +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h b/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h +index 77bb4ed32600..077efc5007dd 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h +@@ -148,6 +148,20 @@ + (((bytesm1) << 16) | ((hdr_ofs) << 8) | ((ena) << 7) | \ + ((flags_ena) << 6) | ((key_ofs) & 0x3F)) + ++/* Rx parse key extract nibble enable */ ++#define NPC_PARSE_NIBBLE_INTF_RX (NPC_PARSE_NIBBLE_CHAN | \ ++ NPC_PARSE_NIBBLE_LA_LTYPE | \ ++ NPC_PARSE_NIBBLE_LB_LTYPE | \ ++ NPC_PARSE_NIBBLE_LC_LTYPE | \ ++ NPC_PARSE_NIBBLE_LD_LTYPE | \ ++ NPC_PARSE_NIBBLE_LE_LTYPE) ++/* Tx parse key extract nibble enable */ ++#define NPC_PARSE_NIBBLE_INTF_TX (NPC_PARSE_NIBBLE_LA_LTYPE | \ ++ NPC_PARSE_NIBBLE_LB_LTYPE | \ ++ NPC_PARSE_NIBBLE_LC_LTYPE | \ ++ NPC_PARSE_NIBBLE_LD_LTYPE | \ ++ NPC_PARSE_NIBBLE_LE_LTYPE) ++ + enum npc_kpu_parser_state { + NPC_S_NA = 0, + NPC_S_KPU1_ETHER, +@@ -13385,9 +13399,10 @@ static const struct npc_mcam_kex npc_mkex_default = { + .name = "default", + .kpu_version = NPC_KPU_PROFILE_VER, + .keyx_cfg = { +- /* nibble: LA..LE (ltype only) + Channel */ +- [NIX_INTF_RX] = ((u64)NPC_MCAM_KEY_X2 << 32) | 0x49247, +- [NIX_INTF_TX] = ((u64)NPC_MCAM_KEY_X2 << 32) | ((1ULL << 19) - 1), ++ /* nibble: LA..LE (ltype only) + channel */ ++ [NIX_INTF_RX] = ((u64)NPC_MCAM_KEY_X2 << 32) | NPC_PARSE_NIBBLE_INTF_RX, ++ /* nibble: LA..LE (ltype only) */ ++ [NIX_INTF_TX] = ((u64)NPC_MCAM_KEY_X2 << 32) | NPC_PARSE_NIBBLE_INTF_TX, + }, + .intf_lid_lt_ld = { + /* Default RX MCAM KEX profile */ +@@ -13405,12 +13420,14 @@ static const struct npc_mcam_kex npc_mkex_default = { + /* Layer B: Single VLAN (CTAG) */ + /* CTAG VLAN[2..3] + Ethertype, 4 bytes, KW0[63:32] */ + [NPC_LT_LB_CTAG] = { +- KEX_LD_CFG(0x03, 0x0, 0x1, 0x0, 0x4), ++ KEX_LD_CFG(0x03, 0x2, 0x1, 0x0, 0x4), + }, + /* Layer B: Stacked VLAN (STAG|QinQ) */ + [NPC_LT_LB_STAG_QINQ] = { +- /* CTAG VLAN[2..3] + Ethertype, 4 bytes, KW0[63:32] */ +- KEX_LD_CFG(0x03, 0x4, 0x1, 0x0, 0x4), ++ /* Outer VLAN: 2 bytes, KW0[63:48] */ ++ KEX_LD_CFG(0x01, 0x2, 0x1, 0x0, 0x6), ++ /* Ethertype: 2 bytes, KW0[47:32] */ ++ KEX_LD_CFG(0x01, 0x8, 0x1, 0x0, 0x4), + }, + [NPC_LT_LB_FDSA] = { + /* SWITCH PORT: 1 byte, KW0[63:48] */ +@@ -13436,17 +13453,71 @@ static const struct npc_mcam_kex npc_mkex_default = { + [NPC_LID_LD] = { + /* Layer D:UDP */ + [NPC_LT_LD_UDP] = { +- /* SPORT: 2 bytes, KW3[15:0] */ +- KEX_LD_CFG(0x1, 0x0, 0x1, 0x0, 0x18), +- /* DPORT: 2 bytes, KW3[31:16] */ +- KEX_LD_CFG(0x1, 0x2, 0x1, 0x0, 0x1a), ++ /* SPORT+DPORT: 4 bytes, KW3[31:0] */ ++ KEX_LD_CFG(0x3, 0x0, 0x1, 0x0, 0x18), ++ }, ++ /* Layer D:TCP */ ++ [NPC_LT_LD_TCP] = { ++ /* SPORT+DPORT: 4 bytes, KW3[31:0] */ ++ KEX_LD_CFG(0x3, 0x0, 0x1, 0x0, 0x18), ++ }, ++ }, ++ }, ++ ++ /* Default TX MCAM KEX profile */ ++ [NIX_INTF_TX] = { ++ [NPC_LID_LA] = { ++ /* Layer A: NIX_INST_HDR_S + Ethernet */ ++ /* NIX appends 8 bytes of NIX_INST_HDR_S at the ++ * start of each TX packet supplied to NPC. ++ */ ++ [NPC_LT_LA_IH_NIX_ETHER] = { ++ /* PF_FUNC: 2B , KW0 [47:32] */ ++ KEX_LD_CFG(0x01, 0x0, 0x1, 0x0, 0x4), ++ /* DMAC: 6 bytes, KW1[63:16] */ ++ KEX_LD_CFG(0x05, 0x8, 0x1, 0x0, 0xa), ++ }, ++ }, ++ [NPC_LID_LB] = { ++ /* Layer B: Single VLAN (CTAG) */ ++ [NPC_LT_LB_CTAG] = { ++ /* CTAG VLAN[2..3] KW0[63:48] */ ++ KEX_LD_CFG(0x01, 0x2, 0x1, 0x0, 0x6), ++ /* CTAG VLAN[2..3] KW1[15:0] */ ++ KEX_LD_CFG(0x01, 0x4, 0x1, 0x0, 0x8), ++ }, ++ /* Layer B: Stacked VLAN (STAG|QinQ) */ ++ [NPC_LT_LB_STAG_QINQ] = { ++ /* Outer VLAN: 2 bytes, KW0[63:48] */ ++ KEX_LD_CFG(0x01, 0x2, 0x1, 0x0, 0x6), ++ /* Outer VLAN: 2 Bytes, KW1[15:0] */ ++ KEX_LD_CFG(0x01, 0x8, 0x1, 0x0, 0x8), ++ }, ++ }, ++ [NPC_LID_LC] = { ++ /* Layer C: IPv4 */ ++ [NPC_LT_LC_IP] = { ++ /* SIP+DIP: 8 bytes, KW2[63:0] */ ++ KEX_LD_CFG(0x07, 0xc, 0x1, 0x0, 0x10), ++ /* TOS: 1 byte, KW1[63:56] */ ++ KEX_LD_CFG(0x0, 0x1, 0x1, 0x0, 0xf), ++ }, ++ /* Layer C: IPv6 */ ++ [NPC_LT_LC_IP6] = { ++ /* Everything up to SADDR: 8 bytes, KW2[63:0] */ ++ KEX_LD_CFG(0x07, 0x0, 0x1, 0x0, 0x10), ++ }, ++ }, ++ [NPC_LID_LD] = { ++ /* Layer D:UDP */ ++ [NPC_LT_LD_UDP] = { ++ /* SPORT+DPORT: 4 bytes, KW3[31:0] */ ++ KEX_LD_CFG(0x3, 0x0, 0x1, 0x0, 0x18), + }, + /* Layer D:TCP */ + [NPC_LT_LD_TCP] = { +- /* SPORT: 2 bytes, KW3[15:0] */ +- KEX_LD_CFG(0x1, 0x0, 0x1, 0x0, 0x18), +- /* DPORT: 2 bytes, KW3[31:16] */ +- KEX_LD_CFG(0x1, 0x2, 0x1, 0x0, 0x1a), ++ /* SPORT+DPORT: 4 bytes, KW3[31:0] */ ++ KEX_LD_CFG(0x3, 0x0, 0x1, 0x0, 0x18), + }, + }, + }, +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index 21a89dd76d3c..f6a3cf3e6f23 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -1129,6 +1129,10 @@ int rvu_mbox_handler_nix_lf_alloc(struct rvu *rvu, + /* Config Rx pkt length, csum checks and apad enable / disable */ + rvu_write64(rvu, blkaddr, NIX_AF_LFX_RX_CFG(nixlf), req->rx_cfg); + ++ /* Configure pkind for TX parse config */ ++ cfg = NPC_TX_DEF_PKIND; ++ rvu_write64(rvu, blkaddr, NIX_AF_LFX_TX_PARSE_CFG(nixlf), cfg); ++ + intf = is_afvf(pcifunc) ? NIX_INTF_TYPE_LBK : NIX_INTF_TYPE_CGX; + err = nix_interface_init(rvu, pcifunc, intf, nixlf); + if (err) +-- +2.30.1 + diff --git a/queue-5.10/octeontx2-af-remove-tos-field-from-mkex-tx.patch b/queue-5.10/octeontx2-af-remove-tos-field-from-mkex-tx.patch new file mode 100644 index 00000000000..a1023d84785 --- /dev/null +++ b/queue-5.10/octeontx2-af-remove-tos-field-from-mkex-tx.patch @@ -0,0 +1,49 @@ +From c32a517350461cbaef26755d6b27a400575c2bae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 19:45:44 +0530 +Subject: octeontx2-af: Remove TOS field from MKEX TX + +From: Subbaraya Sundeep + +[ Upstream commit ce86c2a531e2f2995ee55ea527c1f39ba1d95f73 ] + +The MKEX profile describes what packet fields need to be extracted from +the input packet and how to place those packet fields in the output key +for MCAM matching. The MKEX profile can be in a way where higher layer +packet fields can overwrite lower layer packet fields in output MCAM +Key. +Hence MKEX profile is always ensured that there are no overlaps between +any of the layers. But the commit 42006910b5ea +("octeontx2-af: cleanup KPU config data") introduced TX TOS field which +overlaps with DMAC in MCAM key. +This led to AF driver returning error when TX rule is installed with +DMAC as match criteria since DMAC gets overwritten and cannot be +supported. This patch fixes the issue by removing TOS field from MKEX TX +profile. + +Fixes: 42006910b5ea ("octeontx2-af: cleanup KPU config data") +Signed-off-by: Subbaraya Sundeep +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Kovvuri Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h b/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h +index 077efc5007dd..0e4af93be0fb 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h +@@ -13499,8 +13499,6 @@ static const struct npc_mcam_kex npc_mkex_default = { + [NPC_LT_LC_IP] = { + /* SIP+DIP: 8 bytes, KW2[63:0] */ + KEX_LD_CFG(0x07, 0xc, 0x1, 0x0, 0x10), +- /* TOS: 1 byte, KW1[63:56] */ +- KEX_LD_CFG(0x0, 0x1, 0x1, 0x0, 0xf), + }, + /* Layer C: IPv6 */ + [NPC_LT_LC_IP6] = { +-- +2.30.1 + diff --git a/queue-5.10/octeontx2-pf-clear-rss-enable-flag-on-interace-down.patch b/queue-5.10/octeontx2-pf-clear-rss-enable-flag-on-interace-down.patch new file mode 100644 index 00000000000..64f02ffc7e4 --- /dev/null +++ b/queue-5.10/octeontx2-pf-clear-rss-enable-flag-on-interace-down.patch @@ -0,0 +1,51 @@ +From 335ed8a8c099120a49d8efa76503c7e3feb048e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 19:45:47 +0530 +Subject: octeontx2-pf: Clear RSS enable flag on interace down + +From: Geetha sowjanya + +[ Upstream commit f12098ce9b43e1a6fcaa524acbd90f9118a74c0a ] + +RSS configuration can not be get/set when interface is in down state +as they required mbox communication. RSS enable flag status +is used for set/get configuration. Current code do not clear the +RSS enable flag on interface down which lead to mbox error while +trying to set/get RSS configuration. + +Fixes: 85069e95e531 ("octeontx2-pf: Receive side scaling support") +Signed-off-by: Geetha sowjanya +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Kovvuri Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +index 66f1a212f1f4..9fef9be015e5 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +@@ -1616,6 +1616,7 @@ int otx2_stop(struct net_device *netdev) + struct otx2_nic *pf = netdev_priv(netdev); + struct otx2_cq_poll *cq_poll = NULL; + struct otx2_qset *qset = &pf->qset; ++ struct otx2_rss_info *rss; + int qidx, vec, wrk; + + netif_carrier_off(netdev); +@@ -1628,6 +1629,10 @@ int otx2_stop(struct net_device *netdev) + /* First stop packet Rx/Tx */ + otx2_rxtx_enable(pf, false); + ++ /* Clear RSS enable flag */ ++ rss = &pf->hw.rss_info; ++ rss->enable = false; ++ + /* Cleanup Queue IRQ */ + vec = pci_irq_vector(pf->pdev, + pf->hw.nix_msixoff + NIX_LF_QINT_VEC_START); +-- +2.30.1 + diff --git a/queue-5.10/pm-em-postpone-creating-the-debugfs-dir-till-fs_init.patch b/queue-5.10/pm-em-postpone-creating-the-debugfs-dir-till-fs_init.patch new file mode 100644 index 00000000000..74bade94382 --- /dev/null +++ b/queue-5.10/pm-em-postpone-creating-the-debugfs-dir-till-fs_init.patch @@ -0,0 +1,52 @@ +From 8931f35582fbf8d89a47c6ddbcb25bccd546b102 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 14:56:08 +0000 +Subject: PM: EM: postpone creating the debugfs dir till fs_initcall + +From: Lukasz Luba + +[ Upstream commit fb9d62b27ab1e07d625591549c314b7d406d21df ] + +The debugfs directory '/sys/kernel/debug/energy_model' is needed before +the Energy Model registration can happen. With the recent change in +debugfs subsystem it's not allowed to create this directory at early +stage (core_initcall). Thus creating this directory would fail. + +Postpone the creation of the EM debug dir to later stage: fs_initcall. + +It should be safe since all clients: CPUFreq drivers, Devfreq drivers +will be initialized in later stages. + +The custom debug log below prints the time of creation the EM debug dir +at fs_initcall and successful registration of EMs at later stages. + +[ 1.505717] energy_model: creating rootdir +[ 3.698307] cpu cpu0: EM: created perf domain +[ 3.709022] cpu cpu1: EM: created perf domain + +Fixes: 56348560d495 ("debugfs: do not attempt to create a new file before the filesystem is initalized") +Reported-by: Ionela Voinescu +Signed-off-by: Lukasz Luba +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + kernel/power/energy_model.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/power/energy_model.c b/kernel/power/energy_model.c +index c1ff7fa030ab..994ca8353543 100644 +--- a/kernel/power/energy_model.c ++++ b/kernel/power/energy_model.c +@@ -85,7 +85,7 @@ static int __init em_debug_init(void) + + return 0; + } +-core_initcall(em_debug_init); ++fs_initcall(em_debug_init); + #else /* CONFIG_DEBUG_FS */ + static void em_debug_create_pd(struct device *dev) {} + static void em_debug_remove_pd(struct device *dev) {} +-- +2.30.1 + diff --git a/queue-5.10/pm-runtime-defer-suspending-suppliers.patch b/queue-5.10/pm-runtime-defer-suspending-suppliers.patch new file mode 100644 index 00000000000..8d65798f1ff --- /dev/null +++ b/queue-5.10/pm-runtime-defer-suspending-suppliers.patch @@ -0,0 +1,131 @@ +From ce991ecddda76279db6ade5784a8e481d772ffa7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 15:47:31 +0100 +Subject: PM: runtime: Defer suspending suppliers + +From: Rafael J. Wysocki + +[ Upstream commit 5244f5e2d801259af877ee759e8c22364c607072 ] + +Because the PM-runtime status of the device is not updated in +__rpm_callback(), attempts to suspend the suppliers of the given +device triggered by the rpm_put_suppliers() call in there may +cause a supplier to be suspended completely before the status of +the consumer is updated to RPM_SUSPENDED, which is confusing. + +To avoid that (1) modify __rpm_callback() to only decrease the +PM-runtime usage counter of each supplier and (2) make rpm_suspend() +try to suspend the suppliers after changing the consumer's status to +RPM_SUSPENDED, in analogy with the device's parent. + +Link: https://lore.kernel.org/linux-pm/CAPDyKFqm06KDw_p8WXsM4dijDbho4bb6T4k50UqqvR1_COsp8g@mail.gmail.com/ +Fixes: 21d5c57b3726 ("PM / runtime: Use device links") +Reported-by: elaine.zhang +Diagnosed-by: Ulf Hansson +Reviewed-by: Ulf Hansson +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/power/runtime.c | 45 +++++++++++++++++++++++++++++++----- + 1 file changed, 39 insertions(+), 6 deletions(-) + +diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c +index bfda153b1a41..5ef67bacb585 100644 +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -305,7 +305,7 @@ static int rpm_get_suppliers(struct device *dev) + return 0; + } + +-static void rpm_put_suppliers(struct device *dev) ++static void __rpm_put_suppliers(struct device *dev, bool try_to_suspend) + { + struct device_link *link; + +@@ -313,10 +313,30 @@ static void rpm_put_suppliers(struct device *dev) + device_links_read_lock_held()) { + + while (refcount_dec_not_one(&link->rpm_active)) +- pm_runtime_put(link->supplier); ++ pm_runtime_put_noidle(link->supplier); ++ ++ if (try_to_suspend) ++ pm_request_idle(link->supplier); + } + } + ++static void rpm_put_suppliers(struct device *dev) ++{ ++ __rpm_put_suppliers(dev, true); ++} ++ ++static void rpm_suspend_suppliers(struct device *dev) ++{ ++ struct device_link *link; ++ int idx = device_links_read_lock(); ++ ++ list_for_each_entry_rcu(link, &dev->links.suppliers, c_node, ++ device_links_read_lock_held()) ++ pm_request_idle(link->supplier); ++ ++ device_links_read_unlock(idx); ++} ++ + /** + * __rpm_callback - Run a given runtime PM callback for a given device. + * @cb: Runtime PM callback to run. +@@ -344,8 +364,10 @@ static int __rpm_callback(int (*cb)(struct device *), struct device *dev) + idx = device_links_read_lock(); + + retval = rpm_get_suppliers(dev); +- if (retval) ++ if (retval) { ++ rpm_put_suppliers(dev); + goto fail; ++ } + + device_links_read_unlock(idx); + } +@@ -368,9 +390,9 @@ static int __rpm_callback(int (*cb)(struct device *), struct device *dev) + || (dev->power.runtime_status == RPM_RESUMING && retval))) { + idx = device_links_read_lock(); + +- fail: +- rpm_put_suppliers(dev); ++ __rpm_put_suppliers(dev, false); + ++fail: + device_links_read_unlock(idx); + } + +@@ -642,8 +664,11 @@ static int rpm_suspend(struct device *dev, int rpmflags) + goto out; + } + ++ if (dev->power.irq_safe) ++ goto out; ++ + /* Maybe the parent is now able to suspend. */ +- if (parent && !parent->power.ignore_children && !dev->power.irq_safe) { ++ if (parent && !parent->power.ignore_children) { + spin_unlock(&dev->power.lock); + + spin_lock(&parent->power.lock); +@@ -652,6 +677,14 @@ static int rpm_suspend(struct device *dev, int rpmflags) + + spin_lock(&dev->power.lock); + } ++ /* Maybe the suppliers are now able to suspend. */ ++ if (dev->power.links_count > 0) { ++ spin_unlock_irq(&dev->power.lock); ++ ++ rpm_suspend_suppliers(dev); ++ ++ spin_lock_irq(&dev->power.lock); ++ } + + out: + trace_rpm_return_int_rcuidle(dev, _THIS_IP_, retval); +-- +2.30.1 + diff --git a/queue-5.10/r8152-limit-the-rx-buffer-size-of-rtl8153a-for-usb-2.patch b/queue-5.10/r8152-limit-the-rx-buffer-size-of-rtl8153a-for-usb-2.patch new file mode 100644 index 00000000000..a012de9150d --- /dev/null +++ b/queue-5.10/r8152-limit-the-rx-buffer-size-of-rtl8153a-for-usb-2.patch @@ -0,0 +1,50 @@ +From 0ad9b1d46517aad4d2433b578ab0977cb1a77466 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 15:37:21 +0800 +Subject: r8152: limit the RX buffer size of RTL8153A for USB 2.0 + +From: Hayes Wang + +[ Upstream commit f91a50d8b51b5c8ef1cfb08115a005bba4250507 ] + +If the USB host controller is EHCI, the throughput is reduced from +300Mb/s to 60Mb/s, when the rx buffer size is modified from 16K to +32K. + +According to the EHCI spec, the maximum size of the qTD is 20K. +Therefore, when the driver uses more than 20K buffer, the latency +time of EHCI would be increased. And, it let the RTL8153A get worse +throughput. + +However, the driver uses alloc_pages() for rx buffer, so I limit +the rx buffer to 16K rather than 20K. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=205923 +Fixes: ec5791c202ac ("r8152: separate the rx buffer size") +Reported-by: Robert Davies +Signed-off-by: Hayes Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index d2862071b697..f5010f8ac1ec 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -6519,7 +6519,10 @@ static int rtl_ops_init(struct r8152 *tp) + ops->in_nway = rtl8153_in_nway; + ops->hw_phy_cfg = r8153_hw_phy_cfg; + ops->autosuspend_en = rtl8153_runtime_enable; +- tp->rx_buf_sz = 32 * 1024; ++ if (tp->udev->speed < USB_SPEED_SUPER) ++ tp->rx_buf_sz = 16 * 1024; ++ else ++ tp->rx_buf_sz = 32 * 1024; + tp->eee_en = true; + tp->eee_adv = MDIO_EEE_1000T | MDIO_EEE_100TX; + break; +-- +2.30.1 + diff --git a/queue-5.10/rdma-cxgb4-fix-adapter-le-hash-errors-while-destroyi.patch b/queue-5.10/rdma-cxgb4-fix-adapter-le-hash-errors-while-destroyi.patch new file mode 100644 index 00000000000..4f5134ddfec --- /dev/null +++ b/queue-5.10/rdma-cxgb4-fix-adapter-le-hash-errors-while-destroyi.patch @@ -0,0 +1,48 @@ +From 663939c9b463cd6d054ac916c00de4f443174575 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 00:34:53 +0530 +Subject: RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 + listening server + +From: Potnuri Bharat Teja + +[ Upstream commit 3408be145a5d6418ff955fe5badde652be90e700 ] + +Not setting the ipv6 bit while destroying ipv6 listening servers may +result in potential fatal adapter errors due to lookup engine memory hash +errors. Therefore always set ipv6 field while destroying ipv6 listening +servers. + +Fixes: 830662f6f032 ("RDMA/cxgb4: Add support for active and passive open connection with IPv6 address") +Link: https://lore.kernel.org/r/20210324190453.8171-1-bharat@chelsio.com +Signed-off-by: Potnuri Bharat Teja +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/cm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index 8769e7aa097f..81903749d241 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -3610,13 +3610,13 @@ int c4iw_destroy_listen(struct iw_cm_id *cm_id) + ep->com.local_addr.ss_family == AF_INET) { + err = cxgb4_remove_server_filter( + ep->com.dev->rdev.lldi.ports[0], ep->stid, +- ep->com.dev->rdev.lldi.rxq_ids[0], 0); ++ ep->com.dev->rdev.lldi.rxq_ids[0], false); + } else { + struct sockaddr_in6 *sin6; + c4iw_init_wr_wait(ep->com.wr_waitp); + err = cxgb4_remove_server( + ep->com.dev->rdev.lldi.ports[0], ep->stid, +- ep->com.dev->rdev.lldi.rxq_ids[0], 0); ++ ep->com.dev->rdev.lldi.rxq_ids[0], true); + if (err) + goto done; + err = c4iw_wait_for_reply(&ep->com.dev->rdev, ep->com.wr_waitp, +-- +2.30.1 + diff --git a/queue-5.10/revert-netfilter-x_tables-switch-synchronization-to-.patch b/queue-5.10/revert-netfilter-x_tables-switch-synchronization-to-.patch new file mode 100644 index 00000000000..0f6083d5f24 --- /dev/null +++ b/queue-5.10/revert-netfilter-x_tables-switch-synchronization-to-.patch @@ -0,0 +1,363 @@ +From ecd04ae59f22d443fb744fddd39ff534aca23187 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 14:24:12 +1300 +Subject: Revert "netfilter: x_tables: Switch synchronization to RCU" + +From: Mark Tomlinson + +[ Upstream commit d3d40f237480abf3268956daf18cdc56edd32834 ] + +This reverts commit cc00bcaa589914096edef7fb87ca5cee4a166b5c. + +This (and the preceding) patch basically re-implemented the RCU +mechanisms of patch 784544739a25. That patch was replaced because of the +performance problems that it created when replacing tables. Now, we have +the same issue: the call to synchronize_rcu() makes replacing tables +slower by as much as an order of magnitude. + +Prior to using RCU a script calling "iptables" approx. 200 times was +taking 1.16s. With RCU this increased to 11.59s. + +Revert these patches and fix the issue in a different way. + +Signed-off-by: Mark Tomlinson +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/linux/netfilter/x_tables.h | 5 +-- + net/ipv4/netfilter/arp_tables.c | 14 ++++----- + net/ipv4/netfilter/ip_tables.c | 14 ++++----- + net/ipv6/netfilter/ip6_tables.c | 14 ++++----- + net/netfilter/x_tables.c | 49 +++++++++++++++++++++--------- + 5 files changed, 56 insertions(+), 40 deletions(-) + +diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h +index 8ebb64193757..5deb099d156d 100644 +--- a/include/linux/netfilter/x_tables.h ++++ b/include/linux/netfilter/x_tables.h +@@ -227,7 +227,7 @@ struct xt_table { + unsigned int valid_hooks; + + /* Man behind the curtain... */ +- struct xt_table_info __rcu *private; ++ struct xt_table_info *private; + + /* Set this to THIS_MODULE if you are a module, otherwise NULL */ + struct module *me; +@@ -448,9 +448,6 @@ xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu) + + struct nf_hook_ops *xt_hook_ops_alloc(const struct xt_table *, nf_hookfn *); + +-struct xt_table_info +-*xt_table_get_private_protected(const struct xt_table *table); +- + #ifdef CONFIG_COMPAT + #include + +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index c576a63d09db..04a2010755a6 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -203,7 +203,7 @@ unsigned int arpt_do_table(struct sk_buff *skb, + + local_bh_disable(); + addend = xt_write_recseq_begin(); +- private = rcu_access_pointer(table->private); ++ private = READ_ONCE(table->private); /* Address dependency. */ + cpu = smp_processor_id(); + table_base = private->entries; + jumpstack = (struct arpt_entry **)private->jumpstack[cpu]; +@@ -649,7 +649,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) + { + unsigned int countersize; + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + + /* We need atomic snapshot of counters: rest doesn't change + * (other than comefrom, which userspace doesn't care +@@ -673,7 +673,7 @@ static int copy_entries_to_user(unsigned int total_size, + unsigned int off, num; + const struct arpt_entry *e; + struct xt_counters *counters; +- struct xt_table_info *private = xt_table_get_private_protected(table); ++ struct xt_table_info *private = table->private; + int ret = 0; + void *loc_cpu_entry; + +@@ -807,7 +807,7 @@ static int get_info(struct net *net, void __user *user, const int *len) + t = xt_request_find_table_lock(net, NFPROTO_ARP, name); + if (!IS_ERR(t)) { + struct arpt_getinfo info; +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + #ifdef CONFIG_COMPAT + struct xt_table_info tmp; + +@@ -860,7 +860,7 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr, + + t = xt_find_table_lock(net, NFPROTO_ARP, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + + if (get.size == private->size) + ret = copy_entries_to_user(private->size, +@@ -1017,7 +1017,7 @@ static int do_add_counters(struct net *net, sockptr_t arg, unsigned int len) + } + + local_bh_disable(); +- private = xt_table_get_private_protected(t); ++ private = t->private; + if (private->number != tmp.num_counters) { + ret = -EINVAL; + goto unlock_up_free; +@@ -1330,7 +1330,7 @@ static int compat_copy_entries_to_user(unsigned int total_size, + void __user *userptr) + { + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + void __user *pos; + unsigned int size; + int ret = 0; +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index e8f6f9d86237..a5b63f92b7f3 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -258,7 +258,7 @@ ipt_do_table(struct sk_buff *skb, + WARN_ON(!(table->valid_hooks & (1 << hook))); + local_bh_disable(); + addend = xt_write_recseq_begin(); +- private = rcu_access_pointer(table->private); ++ private = READ_ONCE(table->private); /* Address dependency. */ + cpu = smp_processor_id(); + table_base = private->entries; + jumpstack = (struct ipt_entry **)private->jumpstack[cpu]; +@@ -791,7 +791,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) + { + unsigned int countersize; + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + + /* We need atomic snapshot of counters: rest doesn't change + (other than comefrom, which userspace doesn't care +@@ -815,7 +815,7 @@ copy_entries_to_user(unsigned int total_size, + unsigned int off, num; + const struct ipt_entry *e; + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + int ret = 0; + const void *loc_cpu_entry; + +@@ -964,7 +964,7 @@ static int get_info(struct net *net, void __user *user, const int *len) + t = xt_request_find_table_lock(net, AF_INET, name); + if (!IS_ERR(t)) { + struct ipt_getinfo info; +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + #ifdef CONFIG_COMPAT + struct xt_table_info tmp; + +@@ -1018,7 +1018,7 @@ get_entries(struct net *net, struct ipt_get_entries __user *uptr, + + t = xt_find_table_lock(net, AF_INET, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + if (get.size == private->size) + ret = copy_entries_to_user(private->size, + t, uptr->entrytable); +@@ -1173,7 +1173,7 @@ do_add_counters(struct net *net, sockptr_t arg, unsigned int len) + } + + local_bh_disable(); +- private = xt_table_get_private_protected(t); ++ private = t->private; + if (private->number != tmp.num_counters) { + ret = -EINVAL; + goto unlock_up_free; +@@ -1543,7 +1543,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table, + void __user *userptr) + { + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + void __user *pos; + unsigned int size; + int ret = 0; +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index 0d453fa9e327..81c042940b21 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -280,7 +280,7 @@ ip6t_do_table(struct sk_buff *skb, + + local_bh_disable(); + addend = xt_write_recseq_begin(); +- private = rcu_access_pointer(table->private); ++ private = READ_ONCE(table->private); /* Address dependency. */ + cpu = smp_processor_id(); + table_base = private->entries; + jumpstack = (struct ip6t_entry **)private->jumpstack[cpu]; +@@ -807,7 +807,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) + { + unsigned int countersize; + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + + /* We need atomic snapshot of counters: rest doesn't change + (other than comefrom, which userspace doesn't care +@@ -831,7 +831,7 @@ copy_entries_to_user(unsigned int total_size, + unsigned int off, num; + const struct ip6t_entry *e; + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + int ret = 0; + const void *loc_cpu_entry; + +@@ -980,7 +980,7 @@ static int get_info(struct net *net, void __user *user, const int *len) + t = xt_request_find_table_lock(net, AF_INET6, name); + if (!IS_ERR(t)) { + struct ip6t_getinfo info; +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + #ifdef CONFIG_COMPAT + struct xt_table_info tmp; + +@@ -1035,7 +1035,7 @@ get_entries(struct net *net, struct ip6t_get_entries __user *uptr, + + t = xt_find_table_lock(net, AF_INET6, get.name); + if (!IS_ERR(t)) { +- struct xt_table_info *private = xt_table_get_private_protected(t); ++ struct xt_table_info *private = t->private; + if (get.size == private->size) + ret = copy_entries_to_user(private->size, + t, uptr->entrytable); +@@ -1189,7 +1189,7 @@ do_add_counters(struct net *net, sockptr_t arg, unsigned int len) + } + + local_bh_disable(); +- private = xt_table_get_private_protected(t); ++ private = t->private; + if (private->number != tmp.num_counters) { + ret = -EINVAL; + goto unlock_up_free; +@@ -1552,7 +1552,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table, + void __user *userptr) + { + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + void __user *pos; + unsigned int size; + int ret = 0; +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index bce6ca203d46..7df3aef39c5c 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -1351,14 +1351,6 @@ struct xt_counters *xt_counters_alloc(unsigned int counters) + } + EXPORT_SYMBOL(xt_counters_alloc); + +-struct xt_table_info +-*xt_table_get_private_protected(const struct xt_table *table) +-{ +- return rcu_dereference_protected(table->private, +- mutex_is_locked(&xt[table->af].mutex)); +-} +-EXPORT_SYMBOL(xt_table_get_private_protected); +- + struct xt_table_info * + xt_replace_table(struct xt_table *table, + unsigned int num_counters, +@@ -1366,6 +1358,7 @@ xt_replace_table(struct xt_table *table, + int *error) + { + struct xt_table_info *private; ++ unsigned int cpu; + int ret; + + ret = xt_jumpstack_alloc(newinfo); +@@ -1375,20 +1368,47 @@ xt_replace_table(struct xt_table *table, + } + + /* Do the substitution. */ +- private = xt_table_get_private_protected(table); ++ local_bh_disable(); ++ private = table->private; + + /* Check inside lock: is the old number correct? */ + if (num_counters != private->number) { + pr_debug("num_counters != table->private->number (%u/%u)\n", + num_counters, private->number); ++ local_bh_enable(); + *error = -EAGAIN; + return NULL; + } + + newinfo->initial_entries = private->initial_entries; ++ /* ++ * Ensure contents of newinfo are visible before assigning to ++ * private. ++ */ ++ smp_wmb(); ++ table->private = newinfo; ++ ++ /* make sure all cpus see new ->private value */ ++ smp_wmb(); + +- rcu_assign_pointer(table->private, newinfo); +- synchronize_rcu(); ++ /* ++ * Even though table entries have now been swapped, other CPU's ++ * may still be using the old entries... ++ */ ++ local_bh_enable(); ++ ++ /* ... so wait for even xt_recseq on all cpus */ ++ for_each_possible_cpu(cpu) { ++ seqcount_t *s = &per_cpu(xt_recseq, cpu); ++ u32 seq = raw_read_seqcount(s); ++ ++ if (seq & 1) { ++ do { ++ cond_resched(); ++ cpu_relax(); ++ } while (seq == raw_read_seqcount(s)); ++ } ++ } + + audit_log_nfcfg(table->name, table->af, private->number, + !private->number ? AUDIT_XT_OP_REGISTER : +@@ -1424,12 +1444,12 @@ struct xt_table *xt_register_table(struct net *net, + } + + /* Simplifies replace_table code. */ +- rcu_assign_pointer(table->private, bootstrap); ++ table->private = bootstrap; + + if (!xt_replace_table(table, 0, newinfo, &ret)) + goto unlock; + +- private = xt_table_get_private_protected(table); ++ private = table->private; + pr_debug("table->private->number = %u\n", private->number); + + /* save number of initial entries */ +@@ -1452,8 +1472,7 @@ void *xt_unregister_table(struct xt_table *table) + struct xt_table_info *private; + + mutex_lock(&xt[table->af].mutex); +- private = xt_table_get_private_protected(table); +- RCU_INIT_POINTER(table->private, NULL); ++ private = table->private; + list_del(&table->list); + mutex_unlock(&xt[table->af].mutex); + audit_log_nfcfg(table->name, table->af, private->number, +-- +2.30.1 + diff --git a/queue-5.10/revert-netfilter-x_tables-update-remaining-dereferen.patch b/queue-5.10/revert-netfilter-x_tables-update-remaining-dereferen.patch new file mode 100644 index 00000000000..c0ef0e0cba0 --- /dev/null +++ b/queue-5.10/revert-netfilter-x_tables-update-remaining-dereferen.patch @@ -0,0 +1,70 @@ +From 965444e379db1987dea79eae4d67c069633461bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 14:24:11 +1300 +Subject: Revert "netfilter: x_tables: Update remaining dereference to RCU" + +From: Mark Tomlinson + +[ Upstream commit abe7034b9a8d57737e80cc16d60ed3666990bdbf ] + +This reverts commit 443d6e86f821a165fae3fc3fc13086d27ac140b1. + +This (and the following) patch basically re-implemented the RCU +mechanisms of patch 784544739a25. That patch was replaced because of the +performance problems that it created when replacing tables. Now, we have +the same issue: the call to synchronize_rcu() makes replacing tables +slower by as much as an order of magnitude. + +Revert these patches and fix the issue in a different way. + +Signed-off-by: Mark Tomlinson +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/ipv4/netfilter/arp_tables.c | 2 +- + net/ipv4/netfilter/ip_tables.c | 2 +- + net/ipv6/netfilter/ip6_tables.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index 04a2010755a6..d1e04d2b5170 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -1379,7 +1379,7 @@ static int compat_get_entries(struct net *net, + xt_compat_lock(NFPROTO_ARP); + t = xt_find_table_lock(net, NFPROTO_ARP, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + struct xt_table_info info; + + ret = compat_table_info(private, &info); +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index a5b63f92b7f3..f15bc21d7301 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -1589,7 +1589,7 @@ compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr, + xt_compat_lock(AF_INET); + t = xt_find_table_lock(net, AF_INET, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + struct xt_table_info info; + ret = compat_table_info(private, &info); + if (!ret && get.size == info.size) +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index 81c042940b21..2e2119bfcf13 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -1598,7 +1598,7 @@ compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr, + xt_compat_lock(AF_INET6); + t = xt_find_table_lock(net, AF_INET6, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + struct xt_table_info info; + ret = compat_table_info(private, &info); + if (!ret && get.size == info.size) +-- +2.30.1 + diff --git a/queue-5.10/selftests-bpf-set-gopt-opt_class-to-0-if-get-tunnel-.patch b/queue-5.10/selftests-bpf-set-gopt-opt_class-to-0-if-get-tunnel-.patch new file mode 100644 index 00000000000..2e1b9b9e887 --- /dev/null +++ b/queue-5.10/selftests-bpf-set-gopt-opt_class-to-0-if-get-tunnel-.patch @@ -0,0 +1,47 @@ +From aa9ce2a68e380cce44097a5c0502df1d70ec468d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Mar 2021 11:22:14 +0800 +Subject: selftests/bpf: Set gopt opt_class to 0 if get tunnel opt failed + +From: Hangbin Liu + +[ Upstream commit 31254dc9566221429d2cfb45fd5737985d70f2b6 ] + +When fixing the bpf test_tunnel.sh geneve failure. I only fixed the IPv4 +part but forgot the IPv6 issue. Similar with the IPv4 fixes 557c223b643a +("selftests/bpf: No need to drop the packet when there is no geneve opt"), +when there is no tunnel option and bpf_skb_get_tunnel_opt() returns error, +there is no need to drop the packets and break all geneve rx traffic. +Just set opt_class to 0 and keep returning TC_ACT_OK at the end. + +Fixes: 557c223b643a ("selftests/bpf: No need to drop the packet when there is no geneve opt") +Fixes: 933a741e3b82 ("selftests/bpf: bpf tunnel test.") +Signed-off-by: Hangbin Liu +Signed-off-by: Daniel Borkmann +Acked-by: William Tu +Link: https://lore.kernel.org/bpf/20210309032214.2112438-1-liuhangbin@gmail.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/progs/test_tunnel_kern.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c +index 9afe947cfae9..ba6eadfec565 100644 +--- a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c ++++ b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c +@@ -508,10 +508,8 @@ int _ip6geneve_get_tunnel(struct __sk_buff *skb) + } + + ret = bpf_skb_get_tunnel_opt(skb, &gopt, sizeof(gopt)); +- if (ret < 0) { +- ERROR(ret); +- return TC_ACT_SHOT; +- } ++ if (ret < 0) ++ gopt.opt_class = 0; + + bpf_trace_printk(fmt, sizeof(fmt), + key.tunnel_id, key.remote_ipv4, gopt.opt_class); +-- +2.30.1 + diff --git a/queue-5.10/selftests-forwarding-vxlan_bridge_1d-fix-vxlan-ecn-d.patch b/queue-5.10/selftests-forwarding-vxlan_bridge_1d-fix-vxlan-ecn-d.patch new file mode 100644 index 00000000000..27bf92bc33c --- /dev/null +++ b/queue-5.10/selftests-forwarding-vxlan_bridge_1d-fix-vxlan-ecn-d.patch @@ -0,0 +1,46 @@ +From 9a99c6741385066788ba97388e6193fb0f3749b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 22:33:14 +0800 +Subject: selftests: forwarding: vxlan_bridge_1d: Fix vxlan ecn decapsulate + value + +From: Hangbin Liu + +[ Upstream commit 5aa3c334a449bab24519c4967f5ac2b3304c8dcf ] + +The ECN bit defines ECT(1) = 1, ECT(0) = 2. So inner 0x02 + outer 0x01 +should be inner ECT(0) + outer ECT(1). Based on the description of +__INET_ECN_decapsulate, the final decapsulate value should be +ECT(1). So fix the test expect value to 0x01. + +Before the fix: +TEST: VXLAN: ECN decap: 01/02->0x02 [FAIL] + Expected to capture 10 packets, got 0. + +After the fix: +TEST: VXLAN: ECN decap: 01/02->0x01 [ OK ] + +Fixes: a0b61f3d8ebf ("selftests: forwarding: vxlan_bridge_1d: Add an ECN decap test") +Signed-off-by: Hangbin Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh +index ce6bea9675c0..0ccb1dda099a 100755 +--- a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh ++++ b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh +@@ -658,7 +658,7 @@ test_ecn_decap() + # In accordance with INET_ECN_decapsulate() + __test_ecn_decap 00 00 0x00 + __test_ecn_decap 01 01 0x01 +- __test_ecn_decap 02 01 0x02 ++ __test_ecn_decap 02 01 0x01 + __test_ecn_decap 01 03 0x03 + __test_ecn_decap 02 03 0x03 + test_ecn_decap_error +-- +2.30.1 + diff --git a/queue-5.10/selftests-net-fix-warnings-on-reuseaddr_ports_exhaus.patch b/queue-5.10/selftests-net-fix-warnings-on-reuseaddr_ports_exhaus.patch new file mode 100644 index 00000000000..13d73f775c1 --- /dev/null +++ b/queue-5.10/selftests-net-fix-warnings-on-reuseaddr_ports_exhaus.patch @@ -0,0 +1,73 @@ +From 240332c28c9c779c48c31142ff5bef68a1d6d9a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Mar 2021 01:04:29 +0000 +Subject: selftests/net: fix warnings on reuseaddr_ports_exhausted + +From: Carlos Llamas + +[ Upstream commit 81f711d67a973bf8a6db9556faf299b4074d536e ] + +Fix multiple warnings seen with gcc 10.2.1: +reuseaddr_ports_exhausted.c:32:41: warning: missing braces around initializer [-Wmissing-braces] + 32 | struct reuse_opts unreusable_opts[12] = { + | ^ + 33 | {0, 0, 0, 0}, + | { } { } + +Fixes: 7f204a7de8b0 ("selftests: net: Add SO_REUSEADDR test to check if 4-tuples are fully utilized.") +Signed-off-by: Carlos Llamas +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../selftests/net/reuseaddr_ports_exhausted.c | 32 +++++++++---------- + 1 file changed, 16 insertions(+), 16 deletions(-) + +diff --git a/tools/testing/selftests/net/reuseaddr_ports_exhausted.c b/tools/testing/selftests/net/reuseaddr_ports_exhausted.c +index 7b01b7c2ec10..066efd30e294 100644 +--- a/tools/testing/selftests/net/reuseaddr_ports_exhausted.c ++++ b/tools/testing/selftests/net/reuseaddr_ports_exhausted.c +@@ -30,25 +30,25 @@ struct reuse_opts { + }; + + struct reuse_opts unreusable_opts[12] = { +- {0, 0, 0, 0}, +- {0, 0, 0, 1}, +- {0, 0, 1, 0}, +- {0, 0, 1, 1}, +- {0, 1, 0, 0}, +- {0, 1, 0, 1}, +- {0, 1, 1, 0}, +- {0, 1, 1, 1}, +- {1, 0, 0, 0}, +- {1, 0, 0, 1}, +- {1, 0, 1, 0}, +- {1, 0, 1, 1}, ++ {{0, 0}, {0, 0}}, ++ {{0, 0}, {0, 1}}, ++ {{0, 0}, {1, 0}}, ++ {{0, 0}, {1, 1}}, ++ {{0, 1}, {0, 0}}, ++ {{0, 1}, {0, 1}}, ++ {{0, 1}, {1, 0}}, ++ {{0, 1}, {1, 1}}, ++ {{1, 0}, {0, 0}}, ++ {{1, 0}, {0, 1}}, ++ {{1, 0}, {1, 0}}, ++ {{1, 0}, {1, 1}}, + }; + + struct reuse_opts reusable_opts[4] = { +- {1, 1, 0, 0}, +- {1, 1, 0, 1}, +- {1, 1, 1, 0}, +- {1, 1, 1, 1}, ++ {{1, 1}, {0, 0}}, ++ {{1, 1}, {0, 1}}, ++ {{1, 1}, {1, 0}}, ++ {{1, 1}, {1, 1}}, + }; + + int bind_port(struct __test_metadata *_metadata, int reuseaddr, int reuseport) +-- +2.30.1 + diff --git a/queue-5.10/selinux-vsock-set-sid-for-socket-returned-by-accept.patch b/queue-5.10/selinux-vsock-set-sid-for-socket-returned-by-accept.patch new file mode 100644 index 00000000000..a43a58cac5f --- /dev/null +++ b/queue-5.10/selinux-vsock-set-sid-for-socket-returned-by-accept.patch @@ -0,0 +1,41 @@ +From 69f42a7fa439bbf4c76d2645fd10f56f49598142 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 13:05:41 +0000 +Subject: selinux: vsock: Set SID for socket returned by accept() + +From: David Brazdil + +[ Upstream commit 1f935e8e72ec28dddb2dc0650b3b6626a293d94b ] + +For AF_VSOCK, accept() currently returns sockets that are unlabelled. +Other socket families derive the child's SID from the SID of the parent +and the SID of the incoming packet. This is typically done as the +connected socket is placed in the queue that accept() removes from. + +Reuse the existing 'security_sk_clone' hook to copy the SID from the +parent (server) socket to the child. There is no packet SID in this +case. + +Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") +Signed-off-by: David Brazdil +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/af_vsock.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c +index 791955f5e7ec..cf86c1376b1a 100644 +--- a/net/vmw_vsock/af_vsock.c ++++ b/net/vmw_vsock/af_vsock.c +@@ -738,6 +738,7 @@ static struct sock *__vsock_create(struct net *net, + vsk->buffer_size = psk->buffer_size; + vsk->buffer_min_size = psk->buffer_min_size; + vsk->buffer_max_size = psk->buffer_max_size; ++ security_sk_clone(parent, sk); + } else { + vsk->trusted = ns_capable_noaudit(&init_user_ns, CAP_NET_ADMIN); + vsk->owner = get_current_cred(); +-- +2.30.1 + diff --git a/queue-5.10/series b/queue-5.10/series index 9a15a80c7d2..bfd6a60124d 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -88,3 +88,108 @@ drm-amdgpu-add-additional-sienna-cichlid-pci-id.patch drm-i915-fix-the-gt-fence-revocation-runtime-pm-logic.patch dm-verity-fix-dm_verity_opts_max-value.patch dm-ioctl-fix-out-of-bounds-array-access-when-no-devices.patch +bus-omap_l3_noc-mark-l3-irqs-as-irqf_no_thread.patch +arm-omap2-fix-smartreflex-init-regression-after-drop.patch +soc-ti-omap-prm-fix-occasional-abort-on-reset-deasse.patch +veth-store-queue_mapping-independently-of-xdp-prog-p.patch +bpf-change-inode_storage-s-lookup_elem-return-value-.patch +libbpf-fix-install-flag-order.patch +net-mlx5e-rx-mind-the-mpwqe-gaps-when-calculating-of.patch +net-mlx5e-when-changing-xdp-program-without-reset-ta.patch +net-mlx5e-don-t-match-on-geneve-options-in-case-opti.patch +ipv6-fix-suspecious-rcu-usage-warning.patch +drop_monitor-perform-cleanup-upon-probe-registration.patch +macvlan-macvlan_count_rx-needs-to-be-aware-of-preemp.patch +net-sched-validate-stab-values.patch +net-dsa-bcm_sf2-qualify-phydev-dev_flags-based-on-po.patch +igc-reinit_locked-should-be-called-with-rtnl_lock.patch +igc-fix-pause-frame-advertising.patch +igc-fix-supported-pause-frame-link-setting.patch +igc-fix-igc_ptp_rx_pktstamp.patch +e1000e-add-rtnl_lock-to-e1000_reset_task.patch +e1000e-fix-error-handling-in-e1000_set_d0_lplu_state.patch +net-qlcnic-fix-a-use-after-free-in-qlcnic_83xx_get_m.patch +net-phy-broadcom-add-power-down-exit-reset-state-del.patch +ftgmac100-restart-mac-hw-once.patch +clk-qcom-gcc-sc7180-use-floor-ops-for-the-correct-sd.patch +net-ipa-terminate-message-handler-arrays.patch +net-qrtr-fix-a-kernel-infoleak-in-qrtr_recvmsg.patch +flow_dissector-fix-byteorder-of-dissected-icmp-id.patch +selftests-bpf-set-gopt-opt_class-to-0-if-get-tunnel-.patch +netfilter-ctnetlink-fix-dump-of-the-expect-mask-attr.patch +net-hdlc_x25-prevent-racing-between-x25_close-and-x2.patch +net-phylink-fix-phylink_err-function-name-error-in-p.patch +tipc-better-validate-user-input-in-tipc_nl_retrieve_.patch +tcp-relookup-sock-for-rst-ack-packets-handled-by-obs.patch +can-isotp-isotp_setsockopt-only-allow-to-set-low-lev.patch +can-isotp-tx-path-ensure-that-can-frame-flags-are-in.patch +can-peak_usb-add-forgotten-supported-devices.patch +can-flexcan-flexcan_chip_freeze-fix-chip-freeze-for-.patch +can-kvaser_pciefd-always-disable-bus-load-reporting.patch +can-c_can_pci-c_can_pci_remove-fix-use-after-free.patch +can-c_can-move-runtime-pm-enable-disable-to-c_can_pl.patch +can-m_can-m_can_do_rx_poll-fix-extraneous-msg-loss-w.patch +can-m_can-m_can_rx_peripheral-fix-rx-being-blocked-b.patch +mac80211-fix-rate-mask-reset.patch +mac80211-allow-he-operation-to-be-longer-than-expect.patch +selftests-net-fix-warnings-on-reuseaddr_ports_exhaus.patch +nfp-flower-fix-unsupported-pre_tunnel-flows.patch +nfp-flower-add-ipv6-bit-to-pre_tunnel-control-messag.patch +nfp-flower-fix-pre_tun-mask-id-allocation.patch +ftrace-fix-modify_ftrace_direct.patch +drm-msm-dsi-fix-check-before-set-in-the-7nm-dsi_pll-.patch +ionic-linearize-tso-skb-with-too-many-frags.patch +net-sched-cls_flower-fix-only-mask-bit-check-in-the-.patch +netfilter-nftables-report-eopnotsupp-on-unsupported-.patch +netfilter-nftables-allow-to-update-flowtable-flags.patch +netfilter-flowtable-make-sure-gc-works-periodically-.patch +libbpf-fix-error-path-in-bpf_object__elf_init.patch +libbpf-use-sock_cloexec-when-opening-the-netlink-soc.patch +arm-dts-imx6ull-fix-ubi-filesystem-mount-failed.patch +ipv6-weaken-the-v4mapped-source-check.patch +octeontx2-af-formatting-debugfs-entry-rsrc_alloc.patch +octeontx2-af-modify-default-kex-profile-to-extract-t.patch +octeontx2-af-remove-tos-field-from-mkex-tx.patch +octeontx2-af-fix-irq-free-in-rvu-teardown.patch +octeontx2-pf-clear-rss-enable-flag-on-interace-down.patch +octeontx2-af-fix-infinite-loop-in-unmapping-npc-coun.patch +net-check-all-name-nodes-in-__dev_alloc_name.patch +net-cdc-phonet-fix-data-interface-release-on-probe-f.patch +igb-check-timestamp-validity.patch +r8152-limit-the-rx-buffer-size-of-rtl8153a-for-usb-2.patch +net-stmmac-dwmac-sun8i-provide-tx-and-rx-fifo-sizes.patch +selinux-vsock-set-sid-for-socket-returned-by-accept.patch +selftests-forwarding-vxlan_bridge_1d-fix-vxlan-ecn-d.patch +libbpf-fix-btf-dump-of-pointer-to-array-of-struct.patch +bpf-fix-umd-memory-leak-in-copy_process.patch +can-isotp-tx-path-zero-initialize-outgoing-can-frame.patch +drm-msm-fix-shutdown-hook-in-case-gpu-components-fai.patch +drm-msm-fix-suspend-resume-on-i.mx5.patch +arm64-kdump-update-ppos-when-reading-elfcorehdr.patch +pm-runtime-defer-suspending-suppliers.patch +net-mlx5-add-back-multicast-stats-for-uplink-represe.patch +net-mlx5e-allow-to-match-on-mpls-parameters-only-for.patch +net-mlx5e-offload-tuple-rewrite-for-non-ct-flows.patch +net-mlx5e-fix-error-path-for-ethtool-set-priv-flag.patch +pm-em-postpone-creating-the-debugfs-dir-till-fs_init.patch +net-bridge-don-t-notify-switchdev-for-local-fdb-addr.patch +octeontx2-af-fix-memory-leak-of-object-buf.patch +xen-x86-make-xen_balloon_memory_hotplug_limit-depend.patch +rdma-cxgb4-fix-adapter-le-hash-errors-while-destroyi.patch +bpf-don-t-do-bpf_cgroup_storage_set-for-kuprobe-tp-p.patch +net-consolidate-common-blackhole-dst-ops.patch +net-bpf-fix-ip6ip6-crash-with-collect_md-populated-s.patch +igb-avoid-premature-rx-buffer-reuse.patch +net-axienet-properly-handle-pcs-pma-phy-for-1000base.patch +net-axienet-fix-probe-error-cleanup.patch +net-phy-introduce-phydev-port.patch +net-phy-broadcom-avoid-forward-for-bcm54xx_config_cl.patch +net-phy-broadcom-set-proper-1000basex-sgmii-interfac.patch +net-phy-broadcom-fix-rgmii-delays-for-bcm50160-and-b.patch +revert-netfilter-x_tables-switch-synchronization-to-.patch +netfilter-x_tables-use-correct-memory-barriers.patch +arm64-mm-define-arch_get_mappable_range.patch +arm64-mm-correct-the-inside-linear-map-range-during-.patch +dm-table-fix-zoned-model-check-and-zone-sectors-chec.patch +mm-mmu_notifiers-ensure-range_end-is-paired-with-ran.patch +revert-netfilter-x_tables-update-remaining-dereferen.patch diff --git a/queue-5.10/soc-ti-omap-prm-fix-occasional-abort-on-reset-deasse.patch b/queue-5.10/soc-ti-omap-prm-fix-occasional-abort-on-reset-deasse.patch new file mode 100644 index 00000000000..5e23c500190 --- /dev/null +++ b/queue-5.10/soc-ti-omap-prm-fix-occasional-abort-on-reset-deasse.patch @@ -0,0 +1,58 @@ +From 9c996a9ccf46b96343e2e88b3672a7ffb9d37a55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Feb 2021 13:46:33 +0200 +Subject: soc: ti: omap-prm: Fix occasional abort on reset deassert for dra7 + iva + +From: Tony Lindgren + +[ Upstream commit effe89e40037038db7711bdab5d3401fe297d72c ] + +On reset deassert, we must wait a bit after the rstst bit change before +we allow clockdomain autoidle again. Otherwise we get the following oops +sometimes on dra7 with iva: + +Unhandled fault: imprecise external abort (0x1406) at 0x00000000 +44000000.ocp:L3 Standard Error: MASTER MPU TARGET IVA_CONFIG (Read Link): +At Address: 0x0005A410 : Data Access in User mode during Functional access +Internal error: : 1406 [#1] SMP ARM +... +(sysc_write_sysconfig) from [] (sysc_enable_module+0xcc/0x260) +(sysc_enable_module) from [] (sysc_runtime_resume+0xc8/0x174) +(sysc_runtime_resume) from [] (genpd_runtime_resume+0x94/0x224) +(genpd_runtime_resume) from [] (__rpm_callback+0xd8/0x180) + +It is unclear what all devices this might affect, but presumably other +devices with the rstst bit too can be affected. So let's just enable the +delay for all the devices with rstst bit for now. Later on we may want to +limit the list to the know affected devices if needed. + +Fixes: d30cd83f6853 ("soc: ti: omap-prm: add support for denying idle for reset clockdomain") +Reported-by: Yongqin Liu +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/soc/ti/omap_prm.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/ti/omap_prm.c b/drivers/soc/ti/omap_prm.c +index c8b14b3a171f..fb067b5e4a97 100644 +--- a/drivers/soc/ti/omap_prm.c ++++ b/drivers/soc/ti/omap_prm.c +@@ -522,8 +522,12 @@ static int omap_reset_deassert(struct reset_controller_dev *rcdev, + reset->prm->data->name, id); + + exit: +- if (reset->clkdm) ++ if (reset->clkdm) { ++ /* At least dra7 iva needs a delay before clkdm idle */ ++ if (has_rstst) ++ udelay(1); + pdata->clkdm_allow_idle(reset->clkdm); ++ } + + return ret; + } +-- +2.30.1 + diff --git a/queue-5.10/tcp-relookup-sock-for-rst-ack-packets-handled-by-obs.patch b/queue-5.10/tcp-relookup-sock-for-rst-ack-packets-handled-by-obs.patch new file mode 100644 index 00000000000..5df5d131338 --- /dev/null +++ b/queue-5.10/tcp-relookup-sock-for-rst-ack-packets-handled-by-obs.patch @@ -0,0 +1,88 @@ +From a5412e001ae58a6cc51f2ef43330086ae52c2fa7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Mar 2021 14:05:45 +0300 +Subject: tcp: relookup sock for RST+ACK packets handled by obsolete req sock + +From: Alexander Ovechkin + +[ Upstream commit 7233da86697efef41288f8b713c10c2499cffe85 ] + +Currently tcp_check_req can be called with obsolete req socket for which big +socket have been already created (because of CPU race or early demux +assigning req socket to multiple packets in gro batch). + +Commit e0f9759f530bf789e984 ("tcp: try to keep packet if SYN_RCV race +is lost") added retry in case when tcp_check_req is called for PSH|ACK packet. +But if client sends RST+ACK immediatly after connection being +established (it is performing healthcheck, for example) retry does not +occur. In that case tcp_check_req tries to close req socket, +leaving big socket active. + +Fixes: e0f9759f530 ("tcp: try to keep packet if SYN_RCV race is lost") +Signed-off-by: Alexander Ovechkin +Reported-by: Oleg Senin +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/inet_connection_sock.h | 2 +- + net/ipv4/inet_connection_sock.c | 7 +++++-- + net/ipv4/tcp_minisocks.c | 7 +++++-- + 3 files changed, 11 insertions(+), 5 deletions(-) + +diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h +index 111d7771b208..aa92af3dd444 100644 +--- a/include/net/inet_connection_sock.h ++++ b/include/net/inet_connection_sock.h +@@ -284,7 +284,7 @@ static inline int inet_csk_reqsk_queue_is_full(const struct sock *sk) + return inet_csk_reqsk_queue_len(sk) >= sk->sk_max_ack_backlog; + } + +-void inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req); ++bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req); + void inet_csk_reqsk_queue_drop_and_put(struct sock *sk, struct request_sock *req); + + static inline void inet_csk_prepare_for_destroy_sock(struct sock *sk) +diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c +index 48d2b615edc2..1dfa561e8f98 100644 +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -705,12 +705,15 @@ static bool reqsk_queue_unlink(struct request_sock *req) + return found; + } + +-void inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req) ++bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req) + { +- if (reqsk_queue_unlink(req)) { ++ bool unlinked = reqsk_queue_unlink(req); ++ ++ if (unlinked) { + reqsk_queue_removed(&inet_csk(sk)->icsk_accept_queue, req); + reqsk_put(req); + } ++ return unlinked; + } + EXPORT_SYMBOL(inet_csk_reqsk_queue_drop); + +diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c +index 495dda2449fe..f0f67b25c97a 100644 +--- a/net/ipv4/tcp_minisocks.c ++++ b/net/ipv4/tcp_minisocks.c +@@ -804,8 +804,11 @@ embryonic_reset: + tcp_reset(sk); + } + if (!fastopen) { +- inet_csk_reqsk_queue_drop(sk, req); +- __NET_INC_STATS(sock_net(sk), LINUX_MIB_EMBRYONICRSTS); ++ bool unlinked = inet_csk_reqsk_queue_drop(sk, req); ++ ++ if (unlinked) ++ __NET_INC_STATS(sock_net(sk), LINUX_MIB_EMBRYONICRSTS); ++ *req_stolen = !unlinked; + } + return NULL; + } +-- +2.30.1 + diff --git a/queue-5.10/tipc-better-validate-user-input-in-tipc_nl_retrieve_.patch b/queue-5.10/tipc-better-validate-user-input-in-tipc_nl_retrieve_.patch new file mode 100644 index 00000000000..ef35dbd1491 --- /dev/null +++ b/queue-5.10/tipc-better-validate-user-input-in-tipc_nl_retrieve_.patch @@ -0,0 +1,130 @@ +From ec3bb1583046a5a5d2c28395bb067817a7a81139 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Mar 2021 03:06:58 -0700 +Subject: tipc: better validate user input in tipc_nl_retrieve_key() + +From: Eric Dumazet + +[ Upstream commit 0217ed2848e8538bcf9172d97ed2eeb4a26041bb ] + +Before calling tipc_aead_key_size(ptr), we need to ensure +we have enough data to dereference ptr->keylen. + +We probably also want to make sure tipc_aead_key_size() +wont overflow with malicious ptr->keylen values. + +Syzbot reported: + +BUG: KMSAN: uninit-value in __tipc_nl_node_set_key net/tipc/node.c:2971 [inline] +BUG: KMSAN: uninit-value in tipc_nl_node_set_key+0x9bf/0x13b0 net/tipc/node.c:3023 +CPU: 0 PID: 21060 Comm: syz-executor.5 Not tainted 5.11.0-rc7-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Call Trace: + __dump_stack lib/dump_stack.c:79 [inline] + dump_stack+0x21c/0x280 lib/dump_stack.c:120 + kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 + __msan_warning+0x5f/0xa0 mm/kmsan/kmsan_instr.c:197 + __tipc_nl_node_set_key net/tipc/node.c:2971 [inline] + tipc_nl_node_set_key+0x9bf/0x13b0 net/tipc/node.c:3023 + genl_family_rcv_msg_doit net/netlink/genetlink.c:739 [inline] + genl_family_rcv_msg net/netlink/genetlink.c:783 [inline] + genl_rcv_msg+0x1319/0x1610 net/netlink/genetlink.c:800 + netlink_rcv_skb+0x6fa/0x810 net/netlink/af_netlink.c:2494 + genl_rcv+0x63/0x80 net/netlink/genetlink.c:811 + netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline] + netlink_unicast+0x11d6/0x14a0 net/netlink/af_netlink.c:1330 + netlink_sendmsg+0x1740/0x1840 net/netlink/af_netlink.c:1919 + sock_sendmsg_nosec net/socket.c:652 [inline] + sock_sendmsg net/socket.c:672 [inline] + ____sys_sendmsg+0xcfc/0x12f0 net/socket.c:2345 + ___sys_sendmsg net/socket.c:2399 [inline] + __sys_sendmsg+0x714/0x830 net/socket.c:2432 + __compat_sys_sendmsg net/compat.c:347 [inline] + __do_compat_sys_sendmsg net/compat.c:354 [inline] + __se_compat_sys_sendmsg+0xa7/0xc0 net/compat.c:351 + __ia32_compat_sys_sendmsg+0x4a/0x70 net/compat.c:351 + do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] + __do_fast_syscall_32+0x102/0x160 arch/x86/entry/common.c:141 + do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:166 + do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:209 + entry_SYSENTER_compat_after_hwframe+0x4d/0x5c +RIP: 0023:0xf7f60549 +Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 +RSP: 002b:00000000f555a5fc EFLAGS: 00000296 ORIG_RAX: 0000000000000172 +RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020000200 +RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 +RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 + +Uninit was created at: + kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline] + kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104 + kmsan_slab_alloc+0x8d/0xe0 mm/kmsan/kmsan_hooks.c:76 + slab_alloc_node mm/slub.c:2907 [inline] + __kmalloc_node_track_caller+0xa37/0x1430 mm/slub.c:4527 + __kmalloc_reserve net/core/skbuff.c:142 [inline] + __alloc_skb+0x2f8/0xb30 net/core/skbuff.c:210 + alloc_skb include/linux/skbuff.h:1099 [inline] + netlink_alloc_large_skb net/netlink/af_netlink.c:1176 [inline] + netlink_sendmsg+0xdbc/0x1840 net/netlink/af_netlink.c:1894 + sock_sendmsg_nosec net/socket.c:652 [inline] + sock_sendmsg net/socket.c:672 [inline] + ____sys_sendmsg+0xcfc/0x12f0 net/socket.c:2345 + ___sys_sendmsg net/socket.c:2399 [inline] + __sys_sendmsg+0x714/0x830 net/socket.c:2432 + __compat_sys_sendmsg net/compat.c:347 [inline] + __do_compat_sys_sendmsg net/compat.c:354 [inline] + __se_compat_sys_sendmsg+0xa7/0xc0 net/compat.c:351 + __ia32_compat_sys_sendmsg+0x4a/0x70 net/compat.c:351 + do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] + __do_fast_syscall_32+0x102/0x160 arch/x86/entry/common.c:141 + do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:166 + do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:209 + entry_SYSENTER_compat_after_hwframe+0x4d/0x5c + +Fixes: e1f32190cf7d ("tipc: add support for AEAD key setting via netlink") +Signed-off-by: Eric Dumazet +Cc: Tuong Lien +Cc: Jon Maloy +Cc: Ying Xue +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/node.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/net/tipc/node.c b/net/tipc/node.c +index 83978d5dae59..e4452d55851f 100644 +--- a/net/tipc/node.c ++++ b/net/tipc/node.c +@@ -2855,17 +2855,22 @@ int tipc_nl_node_dump_monitor_peer(struct sk_buff *skb, + + #ifdef CONFIG_TIPC_CRYPTO + static int tipc_nl_retrieve_key(struct nlattr **attrs, +- struct tipc_aead_key **key) ++ struct tipc_aead_key **pkey) + { + struct nlattr *attr = attrs[TIPC_NLA_NODE_KEY]; ++ struct tipc_aead_key *key; + + if (!attr) + return -ENODATA; + +- *key = (struct tipc_aead_key *)nla_data(attr); +- if (nla_len(attr) < tipc_aead_key_size(*key)) ++ if (nla_len(attr) < sizeof(*key)) ++ return -EINVAL; ++ key = (struct tipc_aead_key *)nla_data(attr); ++ if (key->keylen > TIPC_AEAD_KEYLEN_MAX || ++ nla_len(attr) < tipc_aead_key_size(key)) + return -EINVAL; + ++ *pkey = key; + return 0; + } + +-- +2.30.1 + diff --git a/queue-5.10/veth-store-queue_mapping-independently-of-xdp-prog-p.patch b/queue-5.10/veth-store-queue_mapping-independently-of-xdp-prog-p.patch new file mode 100644 index 00000000000..e146dce3b5e --- /dev/null +++ b/queue-5.10/veth-store-queue_mapping-independently-of-xdp-prog-p.patch @@ -0,0 +1,46 @@ +From 3b65f35128d1b6b01601993e29218f5a5cb734b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 16:29:03 +0100 +Subject: veth: Store queue_mapping independently of XDP prog presence + +From: Maciej Fijalkowski + +[ Upstream commit edbea922025169c0e5cdca5ebf7bf5374cc5566c ] + +Currently, veth_xmit() would call the skb_record_rx_queue() only when +there is XDP program loaded on peer interface in native mode. + +If peer has XDP prog in generic mode, then netif_receive_generic_xdp() +has a call to netif_get_rxqueue(skb), so for multi-queue veth it will +not be possible to grab a correct rxq. + +To fix that, store queue_mapping independently of XDP prog presence on +peer interface. + +Fixes: 638264dc9022 ("veth: Support per queue XDP ring") +Signed-off-by: Maciej Fijalkowski +Signed-off-by: Daniel Borkmann +Acked-by: Toshiaki Makita +Link: https://lore.kernel.org/bpf/20210303152903.11172-1-maciej.fijalkowski@intel.com +Signed-off-by: Sasha Levin +--- + drivers/net/veth.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/veth.c b/drivers/net/veth.c +index 8c737668008a..be18b243642f 100644 +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -301,8 +301,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev) + if (rxq < rcv->real_num_rx_queues) { + rq = &rcv_priv->rq[rxq]; + rcv_xdp = rcu_access_pointer(rq->xdp_prog); +- if (rcv_xdp) +- skb_record_rx_queue(skb, rxq); ++ skb_record_rx_queue(skb, rxq); + } + + skb_tx_timestamp(skb); +-- +2.30.1 + diff --git a/queue-5.10/xen-x86-make-xen_balloon_memory_hotplug_limit-depend.patch b/queue-5.10/xen-x86-make-xen_balloon_memory_hotplug_limit-depend.patch new file mode 100644 index 00000000000..1c8cc9a1f6b --- /dev/null +++ b/queue-5.10/xen-x86-make-xen_balloon_memory_hotplug_limit-depend.patch @@ -0,0 +1,69 @@ +From 1b6607f9897d17300ff2c93c5c5b45b31521ab1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 13:24:23 +0100 +Subject: xen/x86: make XEN_BALLOON_MEMORY_HOTPLUG_LIMIT depend on + MEMORY_HOTPLUG +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Roger Pau Monne + +[ Upstream commit 2b514ec72706a31bea0c3b97e622b81535b5323a ] + +The Xen memory hotplug limit should depend on the memory hotplug +generic option, rather than the Xen balloon configuration. It's +possible to have a kernel with generic memory hotplug enabled, but +without Xen balloon enabled, at which point memory hotplug won't work +correctly due to the size limitation of the p2m. + +Rename the option to XEN_MEMORY_HOTPLUG_LIMIT since it's no longer +tied to ballooning. + +Fixes: 9e2369c06c8a18 ("xen: add helpers to allocate unpopulated memory") +Signed-off-by: Roger Pau Monné +Reviewed-by: Boris Ostrovsky +Link: https://lore.kernel.org/r/20210324122424.58685-2-roger.pau@citrix.com +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +--- + arch/x86/xen/p2m.c | 4 ++-- + drivers/xen/Kconfig | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c +index 60da7e793385..674b83ffe4d6 100644 +--- a/arch/x86/xen/p2m.c ++++ b/arch/x86/xen/p2m.c +@@ -98,8 +98,8 @@ EXPORT_SYMBOL_GPL(xen_p2m_size); + unsigned long xen_max_p2m_pfn __read_mostly; + EXPORT_SYMBOL_GPL(xen_max_p2m_pfn); + +-#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG_LIMIT +-#define P2M_LIMIT CONFIG_XEN_BALLOON_MEMORY_HOTPLUG_LIMIT ++#ifdef CONFIG_XEN_MEMORY_HOTPLUG_LIMIT ++#define P2M_LIMIT CONFIG_XEN_MEMORY_HOTPLUG_LIMIT + #else + #define P2M_LIMIT 0 + #endif +diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig +index 41645fe6ad48..ea0efd290c37 100644 +--- a/drivers/xen/Kconfig ++++ b/drivers/xen/Kconfig +@@ -50,11 +50,11 @@ config XEN_BALLOON_MEMORY_HOTPLUG + + SUBSYSTEM=="memory", ACTION=="add", RUN+="/bin/sh -c '[ -f /sys$devpath/state ] && echo online > /sys$devpath/state'" + +-config XEN_BALLOON_MEMORY_HOTPLUG_LIMIT ++config XEN_MEMORY_HOTPLUG_LIMIT + int "Hotplugged memory limit (in GiB) for a PV guest" + default 512 + depends on XEN_HAVE_PVMMU +- depends on XEN_BALLOON_MEMORY_HOTPLUG ++ depends on MEMORY_HOTPLUG + help + Maxmium amount of memory (in GiB) that a PV guest can be + expanded to when using memory hotplug. +-- +2.30.1 +