From 4a9d0fe0b6c091101f09678689fc2482b9af4928 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sat, 13 Nov 2021 08:48:29 -0500 Subject: [PATCH] Fixes for 5.10 Signed-off-by: Sasha Levin --- ...-fixes-hp-spectre-x360-15-eb1xxx-spe.patch | 123 +++++ ...0-olinuxino-lime2-fix-ethernet-phy-m.patch | 45 ++ ...x-null-ptr-deref-in-snd_soc_del_comp.patch | 51 +++ ...ueue-restart-after-blk_sts_zone_reso.patch | 95 ++++ ...f_jit_alloc_exec_limit-for-arm64-jit.patch | 38 ++ ...t-increasing-bpf_jit_limit-above-max.patch | 71 +++ ...-return-values-of-the-probe-function.patch | 44 ++ ...gative-value-when-pci_alloc_irq_vect.patch | 35 ++ ...ation-quirks-add-quirk-for-aya-neo-2.patch | 39 ++ ...tation-quirks-add-quirk-for-gpd-win3.patch | 39 ++ ...hanging-ping-nettest-binaries-on-cle.patch | 44 ++ ...2.c-add-check-for-bgpio_init-failure.patch | 37 ++ .../hyperv-vmbus-include-linux-bitops.h.patch | 45 ++ ...-return-values-of-the-probe-function.patch | 61 +++ .../mmc-winbond-don-t-build-on-m68k.patch | 45 ++ ...lculate-csum-of-looped-back-and-forw.patch | 98 ++++ ...ct-spelling-mistake-to-tcpf_syn_recv.patch | 35 ++ ...-smc_link-llc_testlink_time-overflow.patch | 40 ++ ...og-rejection-for-mtu-check-through-m.patch | 114 +++++ ...a-memory-leak-when-releasing-a-queue.patch | 51 +++ ...t-tcp-fix-header-digest-verification.patch | 37 ++ ...add-device-10ec-8162-to-driver-r8169.patch | 36 ++ queue-5.10/rds-stop-using-dmapool.patch | 432 ++++++++++++++++++ ...d-empty-driver-allowing-consumers-to.patch | 61 +++ ...-bpmp-handle-errors-in-bpmp-response.patch | 52 +++ ...a2xxx-fix-unmap-of-already-freed-sgl.patch | 90 ++++ ...a2xxx-return-enomem-if-kzalloc-fails.patch | 37 ++ queue-5.10/series | 33 ++ ...e-netif_info-before-net_device-setup.patch | 66 +++ ...-fibre-specific-supported-link-modes.patch | 179 ++++++++ ...pl022-fix-microwire-full-duplex-mode.patch | 44 ++ ...top-tx-queues-after-netif_device_det.patch | 34 ++ ...dog-fix-omap-watchdog-early-handling.patch | 44 ++ ...stop-tx-queues-during-live-migration.patch | 67 +++ 34 files changed, 2362 insertions(+) create mode 100644 queue-5.10/alsa-hda-realtek-fixes-hp-spectre-x360-15-eb1xxx-spe.patch create mode 100644 queue-5.10/arm-dts-sun7i-a20-olinuxino-lime2-fix-ethernet-phy-m.patch create mode 100644 queue-5.10/asoc-soc-core-fix-null-ptr-deref-in-snd_soc_del_comp.patch create mode 100644 queue-5.10/block-schedule-queue-restart-after-blk_sts_zone_reso.patch create mode 100644 queue-5.10/bpf-define-bpf_jit_alloc_exec_limit-for-arm64-jit.patch create mode 100644 queue-5.10/bpf-prevent-increasing-bpf_jit_limit-above-max.patch create mode 100644 queue-5.10/cavium-fix-return-values-of-the-probe-function.patch create mode 100644 queue-5.10/cavium-return-negative-value-when-pci_alloc_irq_vect.patch create mode 100644 queue-5.10/drm-panel-orientation-quirks-add-quirk-for-aya-neo-2.patch create mode 100644 queue-5.10/drm-panel-orientation-quirks-add-quirk-for-gpd-win3.patch create mode 100644 queue-5.10/fcnal-test-kill-hanging-ping-nettest-binaries-on-cle.patch create mode 100644 queue-5.10/gpio-mlxbf2.c-add-check-for-bgpio_init-failure.patch create mode 100644 queue-5.10/hyperv-vmbus-include-linux-bitops.h.patch create mode 100644 queue-5.10/misdn-fix-return-values-of-the-probe-function.patch create mode 100644 queue-5.10/mmc-winbond-don-t-build-on-m68k.patch create mode 100644 queue-5.10/net-multicast-calculate-csum-of-looped-back-and-forw.patch create mode 100644 queue-5.10/net-smc-correct-spelling-mistake-to-tcpf_syn_recv.patch create mode 100644 queue-5.10/net-smc-fix-smc_link-llc_testlink_time-overflow.patch create mode 100644 queue-5.10/nfp-bpf-relax-prog-rejection-for-mtu-check-through-m.patch create mode 100644 queue-5.10/nvmet-tcp-fix-a-memory-leak-when-releasing-a-queue.patch create mode 100644 queue-5.10/nvmet-tcp-fix-header-digest-verification.patch create mode 100644 queue-5.10/r8169-add-device-10ec-8162-to-driver-r8169.patch create mode 100644 queue-5.10/rds-stop-using-dmapool.patch create mode 100644 queue-5.10/reset-socfpga-add-empty-driver-allowing-consumers-to.patch create mode 100644 queue-5.10/reset-tegra-bpmp-handle-errors-in-bpmp-response.patch create mode 100644 queue-5.10/scsi-qla2xxx-fix-unmap-of-already-freed-sgl.patch create mode 100644 queue-5.10/scsi-qla2xxx-return-enomem-if-kzalloc-fails.patch create mode 100644 queue-5.10/sfc-don-t-use-netif_info-before-net_device-setup.patch create mode 100644 queue-5.10/sfc-export-fibre-specific-supported-link-modes.patch create mode 100644 queue-5.10/spi-spl022-fix-microwire-full-duplex-mode.patch create mode 100644 queue-5.10/vmxnet3-do-not-stop-tx-queues-after-netif_device_det.patch create mode 100644 queue-5.10/watchdog-fix-omap-watchdog-early-handling.patch create mode 100644 queue-5.10/xen-netfront-stop-tx-queues-during-live-migration.patch diff --git a/queue-5.10/alsa-hda-realtek-fixes-hp-spectre-x360-15-eb1xxx-spe.patch b/queue-5.10/alsa-hda-realtek-fixes-hp-spectre-x360-15-eb1xxx-spe.patch new file mode 100644 index 00000000000..953dd41af1c --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-fixes-hp-spectre-x360-15-eb1xxx-spe.patch @@ -0,0 +1,123 @@ +From 829cbc4f65c73da409e6a80474d5c6225e70dc05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Oct 2021 09:21:22 +0200 +Subject: ALSA: hda/realtek: Fixes HP Spectre x360 15-eb1xxx speakers + +From: Davide Baldo + +[ Upstream commit d94befbb5ae379f6dfd4fa6d460eacc09fa7b9c3 ] + +In laptop 'HP Spectre x360 Convertible 15-eb1xxx/8811' both front and +rear speakers are silent, this patch fixes that by overriding the pin +layout and by initializing the amplifier which needs a GPIO pin to be +set to 1 then 0, similar to the existing HP Spectre x360 14 model. + +In order to have volume control, both front and rear speakers were +forced to use the DAC1. + +This patch also correctly map the mute LED but since there is no +microphone on/off switch exposed by the alsa subsystem it never turns +on by itself. + +There are still known audio issues in this laptop: headset microphone +doesn't work, the button to mute/unmute microphone is not yet mapped, +the LED of the mute/unmute speakers doesn't seems to be exposed via +GPIO and never turns on. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=213953 +Signed-off-by: Davide Baldo +Link: https://lore.kernel.org/r/20211015072121.5287-1-davide@baldo.me +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 46 +++++++++++++++++++++++++++++++++++ + 1 file changed, 46 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 5b28275147057..2eb06351de1fb 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6363,6 +6363,44 @@ static void alc_fixup_no_int_mic(struct hda_codec *codec, + } + } + ++/* GPIO1 = amplifier on/off ++ * GPIO3 = mic mute LED ++ */ ++static void alc285_fixup_hp_spectre_x360_eb1(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ static const hda_nid_t conn[] = { 0x02 }; ++ ++ struct alc_spec *spec = codec->spec; ++ static const struct hda_pintbl pincfgs[] = { ++ { 0x14, 0x90170110 }, /* front/high speakers */ ++ { 0x17, 0x90170130 }, /* back/bass speakers */ ++ { } ++ }; ++ ++ //enable micmute led ++ alc_fixup_hp_gpio_led(codec, action, 0x00, 0x04); ++ ++ switch (action) { ++ case HDA_FIXUP_ACT_PRE_PROBE: ++ spec->micmute_led_polarity = 1; ++ /* needed for amp of back speakers */ ++ spec->gpio_mask |= 0x01; ++ spec->gpio_dir |= 0x01; ++ snd_hda_apply_pincfgs(codec, pincfgs); ++ /* share DAC to have unified volume control */ ++ snd_hda_override_conn_list(codec, 0x14, ARRAY_SIZE(conn), conn); ++ snd_hda_override_conn_list(codec, 0x17, ARRAY_SIZE(conn), conn); ++ break; ++ case HDA_FIXUP_ACT_INIT: ++ /* need to toggle GPIO to enable the amp of back speakers */ ++ alc_update_gpio_data(codec, 0x01, true); ++ msleep(100); ++ alc_update_gpio_data(codec, 0x01, false); ++ break; ++ } ++} ++ + static void alc285_fixup_hp_spectre_x360(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -6515,6 +6553,7 @@ enum { + ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED, + ALC280_FIXUP_HP_9480M, + ALC245_FIXUP_HP_X360_AMP, ++ ALC285_FIXUP_HP_SPECTRE_X360_EB1, + ALC288_FIXUP_DELL_HEADSET_MODE, + ALC288_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC288_FIXUP_DELL_XPS_13, +@@ -8205,6 +8244,10 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_hp_spectre_x360, + }, ++ [ALC285_FIXUP_HP_SPECTRE_X360_EB1] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc285_fixup_hp_spectre_x360_eb1 ++ }, + [ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_ideapad_s740_coef, +@@ -8555,6 +8598,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x87f7, "HP Spectre x360 14", ALC245_FIXUP_HP_X360_AMP), + SND_PCI_QUIRK(0x103c, 0x8805, "HP ProBook 650 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x880d, "HP EliteBook 830 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x8811, "HP Spectre x360 15-eb1xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1), ++ SND_PCI_QUIRK(0x103c, 0x8812, "HP Spectre x360 15-eb1xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1), + SND_PCI_QUIRK(0x103c, 0x8846, "HP EliteBook 850 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8847, "HP EliteBook x360 830 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x884b, "HP EliteBook 840 Aero G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED), +@@ -8979,6 +9024,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {.id = ALC245_FIXUP_HP_X360_AMP, .name = "alc245-hp-x360-amp"}, + {.id = ALC295_FIXUP_HP_OMEN, .name = "alc295-hp-omen"}, + {.id = ALC285_FIXUP_HP_SPECTRE_X360, .name = "alc285-hp-spectre-x360"}, ++ {.id = ALC285_FIXUP_HP_SPECTRE_X360_EB1, .name = "alc285-hp-spectre-x360-eb1"}, + {.id = ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP, .name = "alc287-ideapad-bass-spk-amp"}, + {.id = ALC623_FIXUP_LENOVO_THINKSTATION_P340, .name = "alc623-lenovo-thinkstation-p340"}, + {.id = ALC255_FIXUP_ACER_HEADPHONE_AND_MIC, .name = "alc255-acer-headphone-and-mic"}, +-- +2.33.0 + diff --git a/queue-5.10/arm-dts-sun7i-a20-olinuxino-lime2-fix-ethernet-phy-m.patch b/queue-5.10/arm-dts-sun7i-a20-olinuxino-lime2-fix-ethernet-phy-m.patch new file mode 100644 index 00000000000..080cc8709e9 --- /dev/null +++ b/queue-5.10/arm-dts-sun7i-a20-olinuxino-lime2-fix-ethernet-phy-m.patch @@ -0,0 +1,45 @@ +From a6f65bcc4d20fbc37badad1d5564881b88e43c25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Sep 2021 08:17:21 +0000 +Subject: ARM: dts: sun7i: A20-olinuxino-lime2: Fix ethernet phy-mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bastien Roucariès + +[ Upstream commit 55dd7e059098ce4bd0a55c251cb78e74604abb57 ] + +Commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx delay +config") sets the RX/TX delay according to the phy-mode property in the +device tree. For the A20-olinuxino-lime2 board this is "rgmii", which is the +wrong setting. + +Following the example of a900cac3750b ("ARM: dts: sun7i: a20: bananapro: +Fix ethernet phy-mode") the phy-mode is changed to "rgmii-id" which gets +the Ethernet working again on this board. + +Signed-off-by: Bastien Roucariès +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20210916081721.237137-1-rouca@debian.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts +index 9ba62774e89a1..488933b87ad5a 100644 +--- a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts ++++ b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts +@@ -112,7 +112,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&gmac_rgmii_pins>; + phy-handle = <&phy1>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + status = "okay"; + }; + +-- +2.33.0 + diff --git a/queue-5.10/asoc-soc-core-fix-null-ptr-deref-in-snd_soc_del_comp.patch b/queue-5.10/asoc-soc-core-fix-null-ptr-deref-in-snd_soc_del_comp.patch new file mode 100644 index 00000000000..ba97938c98e --- /dev/null +++ b/queue-5.10/asoc-soc-core-fix-null-ptr-deref-in-snd_soc_del_comp.patch @@ -0,0 +1,51 @@ +From 34bc79ec78f4c73059600d578ef9b2d87ac1b4c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Oct 2021 14:58:40 +0800 +Subject: ASoC: soc-core: fix null-ptr-deref in + snd_soc_del_component_unlocked() + +From: Yang Yingliang + +[ Upstream commit c448b7aa3e66042fc0f849d9a0fb90d1af82e948 ] + +'component' is allocated in snd_soc_register_component(), but component->list +is not initalized, this may cause snd_soc_del_component_unlocked() deref null +ptr in the error handing case. + +KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] +RIP: 0010:__list_del_entry_valid+0x81/0xf0 +Call Trace: + snd_soc_del_component_unlocked+0x69/0x1b0 [snd_soc_core] + snd_soc_add_component.cold+0x54/0x6c [snd_soc_core] + snd_soc_register_component+0x70/0x90 [snd_soc_core] + devm_snd_soc_register_component+0x5e/0xd0 [snd_soc_core] + tas2552_probe+0x265/0x320 [snd_soc_tas2552] + ? tas2552_component_probe+0x1e0/0x1e0 [snd_soc_tas2552] + i2c_device_probe+0xa31/0xbe0 + +Fix by adding INIT_LIST_HEAD() to snd_soc_component_initialize(). + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20211009065840.3196239-1-yangyingliang@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c +index e677422c10585..1332965968646 100644 +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -2454,6 +2454,7 @@ int snd_soc_component_initialize(struct snd_soc_component *component, + INIT_LIST_HEAD(&component->dai_list); + INIT_LIST_HEAD(&component->dobj_list); + INIT_LIST_HEAD(&component->card_list); ++ INIT_LIST_HEAD(&component->list); + mutex_init(&component->io_mutex); + + component->name = fmt_single_name(dev, &component->id); +-- +2.33.0 + diff --git a/queue-5.10/block-schedule-queue-restart-after-blk_sts_zone_reso.patch b/queue-5.10/block-schedule-queue-restart-after-blk_sts_zone_reso.patch new file mode 100644 index 00000000000..f6457d82670 --- /dev/null +++ b/queue-5.10/block-schedule-queue-restart-after-blk_sts_zone_reso.patch @@ -0,0 +1,95 @@ +From bf51c4f6f2dada12b7d6f1522a579005a89018b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Oct 2021 01:51:27 +0900 +Subject: block: schedule queue restart after BLK_STS_ZONE_RESOURCE + +From: Naohiro Aota + +[ Upstream commit 9586e67b911c95ba158fcc247b230e9c2d718623 ] + +When dispatching a zone append write request to a SCSI zoned block device, +if the target zone of the request is already locked, the device driver will +return BLK_STS_ZONE_RESOURCE and the request will be pushed back to the +hctx dipatch queue. The queue will be marked as RESTART in +dd_finish_request() and restarted in __blk_mq_free_request(). However, this +restart applies to the hctx of the completed request. If the requeued +request is on a different hctx, dispatch will no be retried until another +request is submitted or the next periodic queue run triggers, leading to up +to 30 seconds latency for the requeued request. + +Fix this problem by scheduling a queue restart similarly to the +BLK_STS_RESOURCE case or when we cannot get the budget. + +Also, consolidate the checks into the "need_resource" variable to simplify +the condition. + +Signed-off-by: Naohiro Aota +Reviewed-by: Christoph Hellwig +Cc: Niklas Cassel +Link: https://lore.kernel.org/r/20211026165127.4151055-1-naohiro.aota@wdc.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index eed9a4c1519df..69cc552c3dfc9 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1327,6 +1327,7 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list, + int errors, queued; + blk_status_t ret = BLK_STS_OK; + LIST_HEAD(zone_list); ++ bool needs_resource = false; + + if (list_empty(list)) + return false; +@@ -1372,6 +1373,8 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list, + queued++; + break; + case BLK_STS_RESOURCE: ++ needs_resource = true; ++ fallthrough; + case BLK_STS_DEV_RESOURCE: + blk_mq_handle_dev_resource(rq, list); + goto out; +@@ -1382,6 +1385,7 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list, + * accept. + */ + blk_mq_handle_zone_resource(rq, &zone_list); ++ needs_resource = true; + break; + default: + errors++; +@@ -1408,7 +1412,6 @@ out: + /* For non-shared tags, the RESTART check will suffice */ + bool no_tag = prep == PREP_DISPATCH_NO_TAG && + (hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED); +- bool no_budget_avail = prep == PREP_DISPATCH_NO_BUDGET; + + blk_mq_release_budgets(q, nr_budgets); + +@@ -1448,14 +1451,16 @@ out: + * If driver returns BLK_STS_RESOURCE and SCHED_RESTART + * bit is set, run queue after a delay to avoid IO stalls + * that could otherwise occur if the queue is idle. We'll do +- * similar if we couldn't get budget and SCHED_RESTART is set. ++ * similar if we couldn't get budget or couldn't lock a zone ++ * and SCHED_RESTART is set. + */ + needs_restart = blk_mq_sched_needs_restart(hctx); ++ if (prep == PREP_DISPATCH_NO_BUDGET) ++ needs_resource = true; + if (!needs_restart || + (no_tag && list_empty_careful(&hctx->dispatch_wait.entry))) + blk_mq_run_hw_queue(hctx, true); +- else if (needs_restart && (ret == BLK_STS_RESOURCE || +- no_budget_avail)) ++ else if (needs_restart && needs_resource) + blk_mq_delay_run_hw_queue(hctx, BLK_MQ_RESOURCE_DELAY); + + blk_mq_update_dispatch_busy(hctx, true); +-- +2.33.0 + diff --git a/queue-5.10/bpf-define-bpf_jit_alloc_exec_limit-for-arm64-jit.patch b/queue-5.10/bpf-define-bpf_jit_alloc_exec_limit-for-arm64-jit.patch new file mode 100644 index 00000000000..567966aa961 --- /dev/null +++ b/queue-5.10/bpf-define-bpf_jit_alloc_exec_limit-for-arm64-jit.patch @@ -0,0 +1,38 @@ +From c1e7e7052dab95580a32b910cf57dc78dd8883e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Oct 2021 15:25:52 +0100 +Subject: bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT + +From: Lorenz Bauer + +[ Upstream commit 5d63ae908242f028bd10860cba98450d11c079b8 ] + +Expose the maximum amount of useable memory from the arm64 JIT. + +Signed-off-by: Lorenz Bauer +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20211014142554.53120-3-lmb@cloudflare.com +Signed-off-by: Sasha Levin +--- + arch/arm64/net/bpf_jit_comp.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c +index 345066b8e9fc8..064577ff9ff59 100644 +--- a/arch/arm64/net/bpf_jit_comp.c ++++ b/arch/arm64/net/bpf_jit_comp.c +@@ -1134,6 +1134,11 @@ out: + return prog; + } + ++u64 bpf_jit_alloc_exec_limit(void) ++{ ++ return BPF_JIT_REGION_SIZE; ++} ++ + void *bpf_jit_alloc_exec(unsigned long size) + { + return __vmalloc_node_range(size, PAGE_SIZE, BPF_JIT_REGION_START, +-- +2.33.0 + diff --git a/queue-5.10/bpf-prevent-increasing-bpf_jit_limit-above-max.patch b/queue-5.10/bpf-prevent-increasing-bpf_jit_limit-above-max.patch new file mode 100644 index 00000000000..71e1f6a122d --- /dev/null +++ b/queue-5.10/bpf-prevent-increasing-bpf_jit_limit-above-max.patch @@ -0,0 +1,71 @@ +From 17a62789e693a40e9de0eef45e48409acd38a954 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Oct 2021 15:25:53 +0100 +Subject: bpf: Prevent increasing bpf_jit_limit above max + +From: Lorenz Bauer + +[ Upstream commit fadb7ff1a6c2c565af56b4aacdd086b067eed440 ] + +Restrict bpf_jit_limit to the maximum supported by the arch's JIT. + +Signed-off-by: Lorenz Bauer +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20211014142554.53120-4-lmb@cloudflare.com +Signed-off-by: Sasha Levin +--- + include/linux/filter.h | 1 + + kernel/bpf/core.c | 4 +++- + net/core/sysctl_net_core.c | 2 +- + 3 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/include/linux/filter.h b/include/linux/filter.h +index 822b701c803d1..bc6ce4b202a80 100644 +--- a/include/linux/filter.h ++++ b/include/linux/filter.h +@@ -998,6 +998,7 @@ extern int bpf_jit_enable; + extern int bpf_jit_harden; + extern int bpf_jit_kallsyms; + extern long bpf_jit_limit; ++extern long bpf_jit_limit_max; + + typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size); + +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index 72e4bf0ee5460..d3a1f25f8ec2e 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -528,6 +528,7 @@ int bpf_jit_enable __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON); + int bpf_jit_kallsyms __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON); + int bpf_jit_harden __read_mostly; + long bpf_jit_limit __read_mostly; ++long bpf_jit_limit_max __read_mostly; + + static void + bpf_prog_ksym_set_addr(struct bpf_prog *prog) +@@ -821,7 +822,8 @@ u64 __weak bpf_jit_alloc_exec_limit(void) + static int __init bpf_jit_charge_init(void) + { + /* Only used as heuristic here to derive limit. */ +- bpf_jit_limit = min_t(u64, round_up(bpf_jit_alloc_exec_limit() >> 2, ++ bpf_jit_limit_max = bpf_jit_alloc_exec_limit(); ++ bpf_jit_limit = min_t(u64, round_up(bpf_jit_limit_max >> 2, + PAGE_SIZE), LONG_MAX); + return 0; + } +diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c +index d86d8d11cfe4a..2e0a4378e778a 100644 +--- a/net/core/sysctl_net_core.c ++++ b/net/core/sysctl_net_core.c +@@ -419,7 +419,7 @@ static struct ctl_table net_core_table[] = { + .mode = 0600, + .proc_handler = proc_dolongvec_minmax_bpf_restricted, + .extra1 = &long_one, +- .extra2 = &long_max, ++ .extra2 = &bpf_jit_limit_max, + }, + #endif + { +-- +2.33.0 + diff --git a/queue-5.10/cavium-fix-return-values-of-the-probe-function.patch b/queue-5.10/cavium-fix-return-values-of-the-probe-function.patch new file mode 100644 index 00000000000..4782018f224 --- /dev/null +++ b/queue-5.10/cavium-fix-return-values-of-the-probe-function.patch @@ -0,0 +1,44 @@ +From 7d9d250ba90c44ae4751a57b2377ba1ff6337eee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Oct 2021 14:32:57 +0000 +Subject: cavium: Fix return values of the probe function + +From: Zheyu Ma + +[ Upstream commit c69b2f46876825c726bd8a97c7fa852d8932bc32 ] + +During the process of driver probing, the probe function should return < 0 +for failure, otherwise, the kernel will treat value > 0 as success. + +Signed-off-by: Zheyu Ma +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cavium/thunder/nicvf_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c +index f3b7b443f9648..c00f1a7ffc15f 100644 +--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c ++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c +@@ -1226,7 +1226,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic) + if (ret < 0) { + netdev_err(nic->netdev, + "Req for #%d msix vectors failed\n", nic->num_vec); +- return 1; ++ return ret; + } + + sprintf(nic->irq_name[irq], "%s Mbox", "NICVF"); +@@ -1245,7 +1245,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic) + if (!nicvf_check_pf_ready(nic)) { + nicvf_disable_intr(nic, NICVF_INTR_MBOX, 0); + nicvf_unregister_interrupts(nic); +- return 1; ++ return -EIO; + } + + return 0; +-- +2.33.0 + diff --git a/queue-5.10/cavium-return-negative-value-when-pci_alloc_irq_vect.patch b/queue-5.10/cavium-return-negative-value-when-pci_alloc_irq_vect.patch new file mode 100644 index 00000000000..8494f9ecd1b --- /dev/null +++ b/queue-5.10/cavium-return-negative-value-when-pci_alloc_irq_vect.patch @@ -0,0 +1,35 @@ +From 793cffed19060eacb46ef7f9d7443b641f803770 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Oct 2021 02:16:22 +0000 +Subject: cavium: Return negative value when pci_alloc_irq_vectors() fails + +From: Zheyu Ma + +[ Upstream commit b2cddb44bddc1a9c5949a978bb454bba863264db ] + +During the process of driver probing, the probe function should return < 0 +for failure, otherwise, the kernel will treat value > 0 as success. + +Signed-off-by: Zheyu Ma +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cavium/thunder/nic_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c +index 9361f964bb9b2..816453a4f8d6c 100644 +--- a/drivers/net/ethernet/cavium/thunder/nic_main.c ++++ b/drivers/net/ethernet/cavium/thunder/nic_main.c +@@ -1193,7 +1193,7 @@ static int nic_register_interrupts(struct nicpf *nic) + dev_err(&nic->pdev->dev, + "Request for #%d msix vectors failed, returned %d\n", + nic->num_vec, ret); +- return 1; ++ return ret; + } + + /* Register mailbox interrupt handler */ +-- +2.33.0 + diff --git a/queue-5.10/drm-panel-orientation-quirks-add-quirk-for-aya-neo-2.patch b/queue-5.10/drm-panel-orientation-quirks-add-quirk-for-aya-neo-2.patch new file mode 100644 index 00000000000..918a0b61a08 --- /dev/null +++ b/queue-5.10/drm-panel-orientation-quirks-add-quirk-for-aya-neo-2.patch @@ -0,0 +1,39 @@ +From d9d77fbe04b7bec5c9d975dd8e1b63295753191a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Oct 2021 09:24:33 -0500 +Subject: drm: panel-orientation-quirks: Add quirk for Aya Neo 2021 + +From: Bryant Mairs + +[ Upstream commit def0c3697287f6e85d5ac68b21302966c95474f9 ] + +Fixes screen orientation for the Aya Neo 2021 handheld gaming console. + +Signed-off-by: Bryant Mairs +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20211019142433.4295-1-bryant@mai.rs +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index f6bdec7fa9253..30c17a76f49ae 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -134,6 +134,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"), + }, + .driver_data = (void *)&lcd800x1280_rightside_up, ++ }, { /* AYA NEO 2021 */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYADEVICE"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "AYA NEO 2021"), ++ }, ++ .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* GPD MicroPC (generic strings, also match on bios date) */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"), +-- +2.33.0 + diff --git a/queue-5.10/drm-panel-orientation-quirks-add-quirk-for-gpd-win3.patch b/queue-5.10/drm-panel-orientation-quirks-add-quirk-for-gpd-win3.patch new file mode 100644 index 00000000000..0b80c2779e6 --- /dev/null +++ b/queue-5.10/drm-panel-orientation-quirks-add-quirk-for-gpd-win3.patch @@ -0,0 +1,39 @@ +From 800f64c18b8dd6f502e1f3d7c9f1ad64193cf36a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Oct 2021 13:27:37 +0200 +Subject: drm: panel-orientation-quirks: Add quirk for GPD Win3 + +From: Mario + +[ Upstream commit 61b1d445f3bfe4c3ba4335ceeb7e8ba688fd31e2 ] + +Fixes screen orientation for GPD Win 3 handheld gaming console. + +Signed-off-by: Mario Risoldi +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20211026112737.9181-1-awxkrnl@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 30c17a76f49ae..e1b2ce4921ae7 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -191,6 +191,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"), + }, + .driver_data = (void *)&gpd_win2, ++ }, { /* GPD Win 3 */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "G1618-03") ++ }, ++ .driver_data = (void *)&lcd720x1280_rightside_up, + }, { /* I.T.Works TW891 */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "To be filled by O.E.M."), +-- +2.33.0 + diff --git a/queue-5.10/fcnal-test-kill-hanging-ping-nettest-binaries-on-cle.patch b/queue-5.10/fcnal-test-kill-hanging-ping-nettest-binaries-on-cle.patch new file mode 100644 index 00000000000..914a6fbe42d --- /dev/null +++ b/queue-5.10/fcnal-test-kill-hanging-ping-nettest-binaries-on-cle.patch @@ -0,0 +1,44 @@ +From e420e542d792abe62efd72228da305c99a4113f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Oct 2021 16:02:47 +0200 +Subject: fcnal-test: kill hanging ping/nettest binaries on cleanup + +From: Florian Westphal + +[ Upstream commit 1f83b835a3eaa5ae4bd825fb07182698bfc243ba ] + +On my box I see a bunch of ping/nettest processes hanging +around after fcntal-test.sh is done. + +Clean those up before netns deletion. + +Signed-off-by: Florian Westphal +Acked-by: David Ahern +Link: https://lore.kernel.org/r/20211021140247.29691-1-fw@strlen.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/fcnal-test.sh | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh +index 02b0b9ead40b9..225440f5f99eb 100755 +--- a/tools/testing/selftests/net/fcnal-test.sh ++++ b/tools/testing/selftests/net/fcnal-test.sh +@@ -436,10 +436,13 @@ cleanup() + ip -netns ${NSA} link set dev ${NSA_DEV} down + ip -netns ${NSA} link del dev ${NSA_DEV} + ++ ip netns pids ${NSA} | xargs kill 2>/dev/null + ip netns del ${NSA} + fi + ++ ip netns pids ${NSB} | xargs kill 2>/dev/null + ip netns del ${NSB} ++ ip netns pids ${NSC} | xargs kill 2>/dev/null + ip netns del ${NSC} >/dev/null 2>&1 + } + +-- +2.33.0 + diff --git a/queue-5.10/gpio-mlxbf2.c-add-check-for-bgpio_init-failure.patch b/queue-5.10/gpio-mlxbf2.c-add-check-for-bgpio_init-failure.patch new file mode 100644 index 00000000000..0505742232f --- /dev/null +++ b/queue-5.10/gpio-mlxbf2.c-add-check-for-bgpio_init-failure.patch @@ -0,0 +1,37 @@ +From b6fa14e267516679a673e4092e61de9278b3d87c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Oct 2021 09:44:38 -0400 +Subject: gpio: mlxbf2.c: Add check for bgpio_init failure + +From: Asmaa Mnebhi + +[ Upstream commit c0eee6fbfa2b3377f1efed10dad539abeb7312aa ] + +Add a check if bgpio_init fails. + +Signed-off-by: Asmaa Mnebhi +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-mlxbf2.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpio/gpio-mlxbf2.c b/drivers/gpio/gpio-mlxbf2.c +index befa5e1099439..d4b250b470b41 100644 +--- a/drivers/gpio/gpio-mlxbf2.c ++++ b/drivers/gpio/gpio-mlxbf2.c +@@ -268,6 +268,11 @@ mlxbf2_gpio_probe(struct platform_device *pdev) + NULL, + 0); + ++ if (ret) { ++ dev_err(dev, "bgpio_init failed\n"); ++ return ret; ++ } ++ + gc->direction_input = mlxbf2_gpio_direction_input; + gc->direction_output = mlxbf2_gpio_direction_output; + gc->ngpio = npins; +-- +2.33.0 + diff --git a/queue-5.10/hyperv-vmbus-include-linux-bitops.h.patch b/queue-5.10/hyperv-vmbus-include-linux-bitops.h.patch new file mode 100644 index 00000000000..8c581431d79 --- /dev/null +++ b/queue-5.10/hyperv-vmbus-include-linux-bitops.h.patch @@ -0,0 +1,45 @@ +From da6cb66515597774c262832614c0613c19d5b12b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Oct 2021 15:19:08 +0200 +Subject: hyperv/vmbus: include linux/bitops.h + +From: Arnd Bergmann + +[ Upstream commit 8017c99680fa65e1e8d999df1583de476a187830 ] + +On arm64 randconfig builds, hyperv sometimes fails with this +error: + +In file included from drivers/hv/hv_trace.c:3: +In file included from drivers/hv/hyperv_vmbus.h:16: +In file included from arch/arm64/include/asm/sync_bitops.h:5: +arch/arm64/include/asm/bitops.h:11:2: error: only can be included directly +In file included from include/asm-generic/bitops/hweight.h:5: +include/asm-generic/bitops/arch_hweight.h:9:9: error: implicit declaration of function '__sw_hweight32' [-Werror,-Wimplicit-function-declaration] +include/asm-generic/bitops/atomic.h:17:7: error: implicit declaration of function 'BIT_WORD' [-Werror,-Wimplicit-function-declaration] + +Include the correct header first. + +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20211018131929.2260087-1-arnd@kernel.org +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/hyperv_vmbus.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h +index 40e2b9f91163c..7845fa5de79e9 100644 +--- a/drivers/hv/hyperv_vmbus.h ++++ b/drivers/hv/hyperv_vmbus.h +@@ -13,6 +13,7 @@ + #define _HYPERV_VMBUS_H + + #include ++#include + #include + #include + #include +-- +2.33.0 + diff --git a/queue-5.10/misdn-fix-return-values-of-the-probe-function.patch b/queue-5.10/misdn-fix-return-values-of-the-probe-function.patch new file mode 100644 index 00000000000..facee51a6c4 --- /dev/null +++ b/queue-5.10/misdn-fix-return-values-of-the-probe-function.patch @@ -0,0 +1,61 @@ +From 60bf4004d940dab48bfad9770a6bcc2d39af8220 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Oct 2021 14:20:38 +0000 +Subject: mISDN: Fix return values of the probe function + +From: Zheyu Ma + +[ Upstream commit e211210098cb7490db2183d725f5c0f10463a704 ] + +During the process of driver probing, the probe function should return < 0 +for failure, otherwise, the kernel will treat value > 0 as success. + +Signed-off-by: Zheyu Ma +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/isdn/hardware/mISDN/hfcpci.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c +index e501cb03f211d..bd087cca1c1d2 100644 +--- a/drivers/isdn/hardware/mISDN/hfcpci.c ++++ b/drivers/isdn/hardware/mISDN/hfcpci.c +@@ -1994,14 +1994,14 @@ setup_hw(struct hfc_pci *hc) + pci_set_master(hc->pdev); + if (!hc->irq) { + printk(KERN_WARNING "HFC-PCI: No IRQ for PCI card found\n"); +- return 1; ++ return -EINVAL; + } + hc->hw.pci_io = + (char __iomem *)(unsigned long)hc->pdev->resource[1].start; + + if (!hc->hw.pci_io) { + printk(KERN_WARNING "HFC-PCI: No IO-Mem for PCI card found\n"); +- return 1; ++ return -ENOMEM; + } + /* Allocate memory for FIFOS */ + /* the memory needs to be on a 32k boundary within the first 4G */ +@@ -2012,7 +2012,7 @@ setup_hw(struct hfc_pci *hc) + if (!buffer) { + printk(KERN_WARNING + "HFC-PCI: Error allocating memory for FIFO!\n"); +- return 1; ++ return -ENOMEM; + } + hc->hw.fifos = buffer; + pci_write_config_dword(hc->pdev, 0x80, hc->hw.dmahandle); +@@ -2022,7 +2022,7 @@ setup_hw(struct hfc_pci *hc) + "HFC-PCI: Error in ioremap for PCI!\n"); + dma_free_coherent(&hc->pdev->dev, 0x8000, hc->hw.fifos, + hc->hw.dmahandle); +- return 1; ++ return -ENOMEM; + } + + printk(KERN_INFO +-- +2.33.0 + diff --git a/queue-5.10/mmc-winbond-don-t-build-on-m68k.patch b/queue-5.10/mmc-winbond-don-t-build-on-m68k.patch new file mode 100644 index 00000000000..9f4c0614fe3 --- /dev/null +++ b/queue-5.10/mmc-winbond-don-t-build-on-m68k.patch @@ -0,0 +1,45 @@ +From 95ee9d32be62eeefc29b1bc8042de1d43d511da8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Oct 2021 10:59:49 -0700 +Subject: mmc: winbond: don't build on M68K + +From: Randy Dunlap + +[ Upstream commit 162079f2dccd02cb4b6654defd32ca387dd6d4d4 ] + +The Winbond MMC driver fails to build on ARCH=m68k so prevent +that build config. Silences these build errors: + +../drivers/mmc/host/wbsd.c: In function 'wbsd_request_end': +../drivers/mmc/host/wbsd.c:212:28: error: implicit declaration of function 'claim_dma_lock' [-Werror=implicit-function-declaration] + 212 | dmaflags = claim_dma_lock(); +../drivers/mmc/host/wbsd.c:215:17: error: implicit declaration of function 'release_dma_lock'; did you mean 'release_task'? [-Werror=implicit-function-declaration] + 215 | release_dma_lock(dmaflags); + +Signed-off-by: Randy Dunlap +Cc: Pierre Ossman +Cc: Geert Uytterhoeven +Cc: Arnd Bergmann +Link: https://lore.kernel.org/r/20211017175949.23838-1-rdunlap@infradead.org +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig +index 31481c9fcc2ec..30ff42fd173e2 100644 +--- a/drivers/mmc/host/Kconfig ++++ b/drivers/mmc/host/Kconfig +@@ -503,7 +503,7 @@ config MMC_OMAP_HS + + config MMC_WBSD + tristate "Winbond W83L51xD SD/MMC Card Interface support" +- depends on ISA_DMA_API ++ depends on ISA_DMA_API && !M68K + help + This selects the Winbond(R) W83L51xD Secure digital and + Multimedia card Interface. +-- +2.33.0 + diff --git a/queue-5.10/net-multicast-calculate-csum-of-looped-back-and-forw.patch b/queue-5.10/net-multicast-calculate-csum-of-looped-back-and-forw.patch new file mode 100644 index 00000000000..e14b2f9d6bc --- /dev/null +++ b/queue-5.10/net-multicast-calculate-csum-of-looped-back-and-forw.patch @@ -0,0 +1,98 @@ +From 21a123447b92df7545b4126da96360fb717864ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Oct 2021 22:14:25 +0200 +Subject: net: multicast: calculate csum of looped-back and forwarded packets + +From: Cyril Strejc + +[ Upstream commit 9122a70a6333705c0c35614ddc51c274ed1d3637 ] + +During a testing of an user-space application which transmits UDP +multicast datagrams and utilizes multicast routing to send the UDP +datagrams out of defined network interfaces, I've found a multicast +router does not fill-in UDP checksum into locally produced, looped-back +and forwarded UDP datagrams, if an original output NIC the datagrams +are sent to has UDP TX checksum offload enabled. + +The datagrams are sent malformed out of the NIC the datagrams have been +forwarded to. + +It is because: + +1. If TX checksum offload is enabled on the output NIC, UDP checksum + is not calculated by kernel and is not filled into skb data. + +2. dev_loopback_xmit(), which is called solely by + ip_mc_finish_output(), sets skb->ip_summed = CHECKSUM_UNNECESSARY + unconditionally. + +3. Since 35fc92a9 ("[NET]: Allow forwarding of ip_summed except + CHECKSUM_COMPLETE"), the ip_summed value is preserved during + forwarding. + +4. If ip_summed != CHECKSUM_PARTIAL, checksum is not calculated during + a packet egress. + +The minimum fix in dev_loopback_xmit(): + +1. Preserves skb->ip_summed CHECKSUM_PARTIAL. This is the + case when the original output NIC has TX checksum offload enabled. + The effects are: + + a) If the forwarding destination interface supports TX checksum + offloading, the NIC driver is responsible to fill-in the + checksum. + + b) If the forwarding destination interface does NOT support TX + checksum offloading, checksums are filled-in by kernel before + skb is submitted to the NIC driver. + + c) For local delivery, checksum validation is skipped as in the + case of CHECKSUM_UNNECESSARY, thanks to skb_csum_unnecessary(). + +2. Translates ip_summed CHECKSUM_NONE to CHECKSUM_UNNECESSARY. It + means, for CHECKSUM_NONE, the behavior is unmodified and is there + to skip a looped-back packet local delivery checksum validation. + +Signed-off-by: Cyril Strejc +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/udp.h | 5 +++-- + net/core/dev.c | 3 ++- + 2 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/include/net/udp.h b/include/net/udp.h +index 949ae14a54250..435cc009e6eaa 100644 +--- a/include/net/udp.h ++++ b/include/net/udp.h +@@ -488,8 +488,9 @@ static inline struct sk_buff *udp_rcv_segment(struct sock *sk, + * CHECKSUM_NONE in __udp_gso_segment. UDP GRO indeed builds partial + * packets in udp_gro_complete_segment. As does UDP GSO, verified by + * udp_send_skb. But when those packets are looped in dev_loopback_xmit +- * their ip_summed is set to CHECKSUM_UNNECESSARY. Reset in this +- * specific case, where PARTIAL is both correct and required. ++ * their ip_summed CHECKSUM_NONE is changed to CHECKSUM_UNNECESSARY. ++ * Reset in this specific case, where PARTIAL is both correct and ++ * required. + */ + if (skb->pkt_type == PACKET_LOOPBACK) + skb->ip_summed = CHECKSUM_PARTIAL; +diff --git a/net/core/dev.c b/net/core/dev.c +index 6a4e0e3c59fec..e14294e9ba321 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -3867,7 +3867,8 @@ int dev_loopback_xmit(struct net *net, struct sock *sk, struct sk_buff *skb) + skb_reset_mac_header(skb); + __skb_pull(skb, skb_network_offset(skb)); + skb->pkt_type = PACKET_LOOPBACK; +- skb->ip_summed = CHECKSUM_UNNECESSARY; ++ if (skb->ip_summed == CHECKSUM_NONE) ++ skb->ip_summed = CHECKSUM_UNNECESSARY; + WARN_ON(!skb_dst(skb)); + skb_dst_force(skb); + netif_rx_ni(skb); +-- +2.33.0 + diff --git a/queue-5.10/net-smc-correct-spelling-mistake-to-tcpf_syn_recv.patch b/queue-5.10/net-smc-correct-spelling-mistake-to-tcpf_syn_recv.patch new file mode 100644 index 00000000000..8d42475601f --- /dev/null +++ b/queue-5.10/net-smc-correct-spelling-mistake-to-tcpf_syn_recv.patch @@ -0,0 +1,35 @@ +From f69416e990d8ab8a050daa49098b081a62abe38e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Oct 2021 15:13:47 +0800 +Subject: net/smc: Correct spelling mistake to TCPF_SYN_RECV + +From: Wen Gu + +[ Upstream commit f3a3a0fe0b644582fa5d83dd94b398f99fc57914 ] + +There should use TCPF_SYN_RECV instead of TCP_SYN_RECV. + +Signed-off-by: Wen Gu +Reviewed-by: Tony Lu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/af_smc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 030d7f30b13fe..cc2af94e74507 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -1018,7 +1018,7 @@ static void smc_connect_work(struct work_struct *work) + if (smc->clcsock->sk->sk_err) { + smc->sk.sk_err = smc->clcsock->sk->sk_err; + } else if ((1 << smc->clcsock->sk->sk_state) & +- (TCPF_SYN_SENT | TCP_SYN_RECV)) { ++ (TCPF_SYN_SENT | TCPF_SYN_RECV)) { + rc = sk_stream_wait_connect(smc->clcsock->sk, &timeo); + if ((rc == -EPIPE) && + ((1 << smc->clcsock->sk->sk_state) & +-- +2.33.0 + diff --git a/queue-5.10/net-smc-fix-smc_link-llc_testlink_time-overflow.patch b/queue-5.10/net-smc-fix-smc_link-llc_testlink_time-overflow.patch new file mode 100644 index 00000000000..98e0a75f897 --- /dev/null +++ b/queue-5.10/net-smc-fix-smc_link-llc_testlink_time-overflow.patch @@ -0,0 +1,40 @@ +From e80ec2c6832d6e21a3e58bcc45a25090d3393244 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Oct 2021 15:13:45 +0800 +Subject: net/smc: Fix smc_link->llc_testlink_time overflow + +From: Tony Lu + +[ Upstream commit c4a146c7cf5e8ad76231523b174d161bf152c6e7 ] + +The value of llc_testlink_time is set to the value stored in +net->ipv4.sysctl_tcp_keepalive_time when linkgroup init. The value of +sysctl_tcp_keepalive_time is already jiffies, so we don't need to +multiply by HZ, which would cause smc_link->llc_testlink_time overflow, +and test_link send flood. + +Signed-off-by: Tony Lu +Reviewed-by: Xuan Zhuo +Reviewed-by: Wen Gu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/smc_llc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c +index 2e7560eba9812..d8fe4e1f24d1f 100644 +--- a/net/smc/smc_llc.c ++++ b/net/smc/smc_llc.c +@@ -1787,7 +1787,7 @@ void smc_llc_link_active(struct smc_link *link) + link->smcibdev->ibdev->name, link->ibport); + link->state = SMC_LNK_ACTIVE; + if (link->lgr->llc_testlink_time) { +- link->llc_testlink_time = link->lgr->llc_testlink_time * HZ; ++ link->llc_testlink_time = link->lgr->llc_testlink_time; + schedule_delayed_work(&link->llc_testlink_wrk, + link->llc_testlink_time); + } +-- +2.33.0 + diff --git a/queue-5.10/nfp-bpf-relax-prog-rejection-for-mtu-check-through-m.patch b/queue-5.10/nfp-bpf-relax-prog-rejection-for-mtu-check-through-m.patch new file mode 100644 index 00000000000..c39f8042735 --- /dev/null +++ b/queue-5.10/nfp-bpf-relax-prog-rejection-for-mtu-check-through-m.patch @@ -0,0 +1,114 @@ +From c70a9be5dfbdb5b6e7729746977fa8879d419fc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Oct 2021 12:00:36 +0200 +Subject: nfp: bpf: relax prog rejection for mtu check through max_pkt_offset + +From: Yu Xiao + +[ Upstream commit 90a881fc352a953f1c8beb61977a2db0818157d4 ] + +MTU change is refused whenever the value of new MTU is bigger than +the max packet bytes that fits in NFP Cluster Target Memory (CTM). +However, an eBPF program doesn't always need to access the whole +packet data. + +The maximum direct packet access (DPA) offset has always been +caculated by verifier and stored in the max_pkt_offset field of prog +aux data. + +Signed-off-by: Yu Xiao +Reviewed-by: Yinjun Zhang +Reviewed-by: Niklas Soderlund +Signed-off-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/netronome/nfp/bpf/main.c | 16 +++++++++++----- + drivers/net/ethernet/netronome/nfp/bpf/main.h | 2 ++ + .../net/ethernet/netronome/nfp/bpf/offload.c | 17 +++++++++++++---- + 3 files changed, 26 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.c b/drivers/net/ethernet/netronome/nfp/bpf/main.c +index 11c83a99b0140..f469950c72657 100644 +--- a/drivers/net/ethernet/netronome/nfp/bpf/main.c ++++ b/drivers/net/ethernet/netronome/nfp/bpf/main.c +@@ -182,15 +182,21 @@ static int + nfp_bpf_check_mtu(struct nfp_app *app, struct net_device *netdev, int new_mtu) + { + struct nfp_net *nn = netdev_priv(netdev); +- unsigned int max_mtu; ++ struct nfp_bpf_vnic *bv; ++ struct bpf_prog *prog; + + if (~nn->dp.ctrl & NFP_NET_CFG_CTRL_BPF) + return 0; + +- max_mtu = nn_readb(nn, NFP_NET_CFG_BPF_INL_MTU) * 64 - 32; +- if (new_mtu > max_mtu) { +- nn_info(nn, "BPF offload active, MTU over %u not supported\n", +- max_mtu); ++ if (nn->xdp_hw.prog) { ++ prog = nn->xdp_hw.prog; ++ } else { ++ bv = nn->app_priv; ++ prog = bv->tc_prog; ++ } ++ ++ if (nfp_bpf_offload_check_mtu(nn, prog, new_mtu)) { ++ nn_info(nn, "BPF offload active, potential packet access beyond hardware packet boundary"); + return -EBUSY; + } + return 0; +diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.h b/drivers/net/ethernet/netronome/nfp/bpf/main.h +index fac9c6f9e197b..c74620fcc539c 100644 +--- a/drivers/net/ethernet/netronome/nfp/bpf/main.h ++++ b/drivers/net/ethernet/netronome/nfp/bpf/main.h +@@ -560,6 +560,8 @@ bool nfp_is_subprog_start(struct nfp_insn_meta *meta); + void nfp_bpf_jit_prepare(struct nfp_prog *nfp_prog); + int nfp_bpf_jit(struct nfp_prog *prog); + bool nfp_bpf_supported_opcode(u8 code); ++bool nfp_bpf_offload_check_mtu(struct nfp_net *nn, struct bpf_prog *prog, ++ unsigned int mtu); + + int nfp_verify_insn(struct bpf_verifier_env *env, int insn_idx, + int prev_insn_idx); +diff --git a/drivers/net/ethernet/netronome/nfp/bpf/offload.c b/drivers/net/ethernet/netronome/nfp/bpf/offload.c +index 53851853562c6..9d97cd281f18e 100644 +--- a/drivers/net/ethernet/netronome/nfp/bpf/offload.c ++++ b/drivers/net/ethernet/netronome/nfp/bpf/offload.c +@@ -481,19 +481,28 @@ int nfp_bpf_event_output(struct nfp_app_bpf *bpf, const void *data, + return 0; + } + ++bool nfp_bpf_offload_check_mtu(struct nfp_net *nn, struct bpf_prog *prog, ++ unsigned int mtu) ++{ ++ unsigned int fw_mtu, pkt_off; ++ ++ fw_mtu = nn_readb(nn, NFP_NET_CFG_BPF_INL_MTU) * 64 - 32; ++ pkt_off = min(prog->aux->max_pkt_offset, mtu); ++ ++ return fw_mtu < pkt_off; ++} ++ + static int + nfp_net_bpf_load(struct nfp_net *nn, struct bpf_prog *prog, + struct netlink_ext_ack *extack) + { + struct nfp_prog *nfp_prog = prog->aux->offload->dev_priv; +- unsigned int fw_mtu, pkt_off, max_stack, max_prog_len; ++ unsigned int max_stack, max_prog_len; + dma_addr_t dma_addr; + void *img; + int err; + +- fw_mtu = nn_readb(nn, NFP_NET_CFG_BPF_INL_MTU) * 64 - 32; +- pkt_off = min(prog->aux->max_pkt_offset, nn->dp.netdev->mtu); +- if (fw_mtu < pkt_off) { ++ if (nfp_bpf_offload_check_mtu(nn, prog, nn->dp.netdev->mtu)) { + NL_SET_ERR_MSG_MOD(extack, "BPF offload not supported with potential packet access beyond HW packet split boundary"); + return -EOPNOTSUPP; + } +-- +2.33.0 + diff --git a/queue-5.10/nvmet-tcp-fix-a-memory-leak-when-releasing-a-queue.patch b/queue-5.10/nvmet-tcp-fix-a-memory-leak-when-releasing-a-queue.patch new file mode 100644 index 00000000000..2f7f57282b2 --- /dev/null +++ b/queue-5.10/nvmet-tcp-fix-a-memory-leak-when-releasing-a-queue.patch @@ -0,0 +1,51 @@ +From 80605dd7994b7638cdb513ec3d0391f9d9d5eaa6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Oct 2021 10:26:34 +0200 +Subject: nvmet-tcp: fix a memory leak when releasing a queue + +From: Maurizio Lombardi + +[ Upstream commit 926245c7d22271307606c88b1fbb2539a8550e94 ] + +page_frag_free() won't completely release the memory +allocated for the commands, the cache page must be explicitly +freed by calling __page_frag_cache_drain(). + +This bug can be easily reproduced by repeatedly +executing the following command on the initiator: + +$echo 1 > /sys/devices/virtual/nvme-fabrics/ctl/nvme0/reset_controller + +Signed-off-by: Maurizio Lombardi +Reviewed-by: Sagi Grimberg +Reviewed-by: John Meneghini +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/tcp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index 5266d534c4b31..b4ef7e9e8461f 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -1398,6 +1398,7 @@ static void nvmet_tcp_uninit_data_in_cmds(struct nvmet_tcp_queue *queue) + + static void nvmet_tcp_release_queue_work(struct work_struct *w) + { ++ struct page *page; + struct nvmet_tcp_queue *queue = + container_of(w, struct nvmet_tcp_queue, release_work); + +@@ -1417,6 +1418,8 @@ static void nvmet_tcp_release_queue_work(struct work_struct *w) + nvmet_tcp_free_crypto(queue); + ida_simple_remove(&nvmet_tcp_queue_ida, queue->idx); + ++ page = virt_to_head_page(queue->pf_cache.va); ++ __page_frag_cache_drain(page, queue->pf_cache.pagecnt_bias); + kfree(queue); + } + +-- +2.33.0 + diff --git a/queue-5.10/nvmet-tcp-fix-header-digest-verification.patch b/queue-5.10/nvmet-tcp-fix-header-digest-verification.patch new file mode 100644 index 00000000000..56acba1257e --- /dev/null +++ b/queue-5.10/nvmet-tcp-fix-header-digest-verification.patch @@ -0,0 +1,37 @@ +From 83c12b907a4e30d4c6a955b8c2e8edfa4f30887c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Oct 2021 09:49:27 +0300 +Subject: nvmet-tcp: fix header digest verification + +From: Amit Engel + +[ Upstream commit 86aeda32b887cdaeb0f4b7bfc9971e36377181c7 ] + +Pass the correct length to nvmet_tcp_verify_hdgst, which is the pdu +header length. This fixes a wrong behaviour where header digest +verification passes although the digest is wrong. + +Signed-off-by: Amit Engel +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/tcp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index b4ef7e9e8461f..58dc517fe8678 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -1084,7 +1084,7 @@ recv: + } + + if (queue->hdr_digest && +- nvmet_tcp_verify_hdgst(queue, &queue->pdu, queue->offset)) { ++ nvmet_tcp_verify_hdgst(queue, &queue->pdu, hdr->hlen)) { + nvmet_tcp_fatal_error(queue); /* fatal */ + return -EPROTO; + } +-- +2.33.0 + diff --git a/queue-5.10/r8169-add-device-10ec-8162-to-driver-r8169.patch b/queue-5.10/r8169-add-device-10ec-8162-to-driver-r8169.patch new file mode 100644 index 00000000000..10368daee72 --- /dev/null +++ b/queue-5.10/r8169-add-device-10ec-8162-to-driver-r8169.patch @@ -0,0 +1,36 @@ +From cb095648374f416ff205b4b2d588d60b5287dc9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Oct 2021 07:12:42 +0000 +Subject: r8169: Add device 10ec:8162 to driver r8169 + +From: Janghyub Seo + +[ Upstream commit 72f898ca0ab85fde6facf78b14d9f67a4a7b32d1 ] + +This patch makes the driver r8169 pick up device Realtek Semiconductor Co. +, Ltd. Device [10ec:8162]. + +Signed-off-by: Janghyub Seo +Suggested-by: Rushab Shah +Link: https://lore.kernel.org/r/1635231849296.1489250046.441294000@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 30be18bac8063..5eac3f494d9e9 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -157,6 +157,7 @@ static const struct pci_device_id rtl8169_pci_tbl[] = { + { PCI_VDEVICE(REALTEK, 0x8129) }, + { PCI_VDEVICE(REALTEK, 0x8136), RTL_CFG_NO_GBIT }, + { PCI_VDEVICE(REALTEK, 0x8161) }, ++ { PCI_VDEVICE(REALTEK, 0x8162) }, + { PCI_VDEVICE(REALTEK, 0x8167) }, + { PCI_VDEVICE(REALTEK, 0x8168) }, + { PCI_VDEVICE(NCUBE, 0x8168) }, +-- +2.33.0 + diff --git a/queue-5.10/rds-stop-using-dmapool.patch b/queue-5.10/rds-stop-using-dmapool.patch new file mode 100644 index 00000000000..756f20db082 --- /dev/null +++ b/queue-5.10/rds-stop-using-dmapool.patch @@ -0,0 +1,432 @@ +From 98d46c2d432d334d8ec46b54f399578c05b05eaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Nov 2020 19:19:36 +0100 +Subject: rds: stop using dmapool + +From: Christoph Hellwig + +[ Upstream commit 42f2611cc1738b201701e717246e11e86bef4e1e ] + +RDMA ULPs should only perform DMA through the ib_dma_* API instead of +using the hidden dma_device directly. In addition using the dma coherent +API family that dmapool is a part of can be very ineffcient on plaforms +that are not DMA coherent. Switch to use slab allocations and the +ib_dma_* APIs instead. + +Link: https://lore.kernel.org/r/20201106181941.1878556-6-hch@lst.de +Signed-off-by: Christoph Hellwig +Acked-by: Santosh Shilimkar +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + net/rds/ib.c | 10 ---- + net/rds/ib.h | 6 --- + net/rds/ib_cm.c | 128 ++++++++++++++++++++++++++++------------------ + net/rds/ib_recv.c | 18 +++++-- + net/rds/ib_send.c | 8 +++ + 5 files changed, 101 insertions(+), 69 deletions(-) + +diff --git a/net/rds/ib.c b/net/rds/ib.c +index deecbdcdae84e..24c9a9005a6fb 100644 +--- a/net/rds/ib.c ++++ b/net/rds/ib.c +@@ -30,7 +30,6 @@ + * SOFTWARE. + * + */ +-#include + #include + #include + #include +@@ -108,7 +107,6 @@ static void rds_ib_dev_free(struct work_struct *work) + rds_ib_destroy_mr_pool(rds_ibdev->mr_1m_pool); + if (rds_ibdev->pd) + ib_dealloc_pd(rds_ibdev->pd); +- dma_pool_destroy(rds_ibdev->rid_hdrs_pool); + + list_for_each_entry_safe(i_ipaddr, i_next, &rds_ibdev->ipaddr_list, list) { + list_del(&i_ipaddr->list); +@@ -191,14 +189,6 @@ static int rds_ib_add_one(struct ib_device *device) + rds_ibdev->pd = NULL; + goto put_dev; + } +- rds_ibdev->rid_hdrs_pool = dma_pool_create(device->name, +- device->dma_device, +- sizeof(struct rds_header), +- L1_CACHE_BYTES, 0); +- if (!rds_ibdev->rid_hdrs_pool) { +- ret = -ENOMEM; +- goto put_dev; +- } + + rds_ibdev->mr_1m_pool = + rds_ib_create_mr_pool(rds_ibdev, RDS_IB_MR_1M_POOL); +diff --git a/net/rds/ib.h b/net/rds/ib.h +index c23a11d9ad362..2ba71102b1f1f 100644 +--- a/net/rds/ib.h ++++ b/net/rds/ib.h +@@ -246,7 +246,6 @@ struct rds_ib_device { + struct list_head conn_list; + struct ib_device *dev; + struct ib_pd *pd; +- struct dma_pool *rid_hdrs_pool; /* RDS headers DMA pool */ + u8 odp_capable:1; + + unsigned int max_mrs; +@@ -380,11 +379,6 @@ int rds_ib_cm_handle_connect(struct rdma_cm_id *cm_id, + int rds_ib_cm_initiate_connect(struct rdma_cm_id *cm_id, bool isv6); + void rds_ib_cm_connect_complete(struct rds_connection *conn, + struct rdma_cm_event *event); +-struct rds_header **rds_dma_hdrs_alloc(struct ib_device *ibdev, +- struct dma_pool *pool, +- dma_addr_t **dma_addrs, u32 num_hdrs); +-void rds_dma_hdrs_free(struct dma_pool *pool, struct rds_header **hdrs, +- dma_addr_t *dma_addrs, u32 num_hdrs); + + #define rds_ib_conn_error(conn, fmt...) \ + __rds_ib_conn_error(conn, KERN_WARNING "RDS/IB: " fmt) +diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c +index b36b60668b1da..f5cbe963cd8f7 100644 +--- a/net/rds/ib_cm.c ++++ b/net/rds/ib_cm.c +@@ -30,7 +30,6 @@ + * SOFTWARE. + * + */ +-#include + #include + #include + #include +@@ -441,42 +440,87 @@ static inline void ibdev_put_vector(struct rds_ib_device *rds_ibdev, int index) + rds_ibdev->vector_load[index]--; + } + ++static void rds_dma_hdr_free(struct ib_device *dev, struct rds_header *hdr, ++ dma_addr_t dma_addr, enum dma_data_direction dir) ++{ ++ ib_dma_unmap_single(dev, dma_addr, sizeof(*hdr), dir); ++ kfree(hdr); ++} ++ ++static struct rds_header *rds_dma_hdr_alloc(struct ib_device *dev, ++ dma_addr_t *dma_addr, enum dma_data_direction dir) ++{ ++ struct rds_header *hdr; ++ ++ hdr = kzalloc_node(sizeof(*hdr), GFP_KERNEL, ibdev_to_node(dev)); ++ if (!hdr) ++ return NULL; ++ ++ *dma_addr = ib_dma_map_single(dev, hdr, sizeof(*hdr), ++ DMA_BIDIRECTIONAL); ++ if (ib_dma_mapping_error(dev, *dma_addr)) { ++ kfree(hdr); ++ return NULL; ++ } ++ ++ return hdr; ++} ++ ++/* Free the DMA memory used to store struct rds_header. ++ * ++ * @dev: the RDS IB device ++ * @hdrs: pointer to the array storing DMA memory pointers ++ * @dma_addrs: pointer to the array storing DMA addresses ++ * @num_hdars: number of headers to free. ++ */ ++static void rds_dma_hdrs_free(struct rds_ib_device *dev, ++ struct rds_header **hdrs, dma_addr_t *dma_addrs, u32 num_hdrs, ++ enum dma_data_direction dir) ++{ ++ u32 i; ++ ++ for (i = 0; i < num_hdrs; i++) ++ rds_dma_hdr_free(dev->dev, hdrs[i], dma_addrs[i], dir); ++ kvfree(hdrs); ++ kvfree(dma_addrs); ++} ++ ++ + /* Allocate DMA coherent memory to be used to store struct rds_header for + * sending/receiving packets. The pointers to the DMA memory and the + * associated DMA addresses are stored in two arrays. + * +- * @ibdev: the IB device +- * @pool: the DMA memory pool ++ * @dev: the RDS IB device + * @dma_addrs: pointer to the array for storing DMA addresses + * @num_hdrs: number of headers to allocate + * + * It returns the pointer to the array storing the DMA memory pointers. On + * error, NULL pointer is returned. + */ +-struct rds_header **rds_dma_hdrs_alloc(struct ib_device *ibdev, +- struct dma_pool *pool, +- dma_addr_t **dma_addrs, u32 num_hdrs) ++static struct rds_header **rds_dma_hdrs_alloc(struct rds_ib_device *dev, ++ dma_addr_t **dma_addrs, u32 num_hdrs, ++ enum dma_data_direction dir) + { + struct rds_header **hdrs; + dma_addr_t *hdr_daddrs; + u32 i; + + hdrs = kvmalloc_node(sizeof(*hdrs) * num_hdrs, GFP_KERNEL, +- ibdev_to_node(ibdev)); ++ ibdev_to_node(dev->dev)); + if (!hdrs) + return NULL; + + hdr_daddrs = kvmalloc_node(sizeof(*hdr_daddrs) * num_hdrs, GFP_KERNEL, +- ibdev_to_node(ibdev)); ++ ibdev_to_node(dev->dev)); + if (!hdr_daddrs) { + kvfree(hdrs); + return NULL; + } + + for (i = 0; i < num_hdrs; i++) { +- hdrs[i] = dma_pool_zalloc(pool, GFP_KERNEL, &hdr_daddrs[i]); ++ hdrs[i] = rds_dma_hdr_alloc(dev->dev, &hdr_daddrs[i], dir); + if (!hdrs[i]) { +- rds_dma_hdrs_free(pool, hdrs, hdr_daddrs, i); ++ rds_dma_hdrs_free(dev, hdrs, hdr_daddrs, i, dir); + return NULL; + } + } +@@ -485,24 +529,6 @@ struct rds_header **rds_dma_hdrs_alloc(struct ib_device *ibdev, + return hdrs; + } + +-/* Free the DMA memory used to store struct rds_header. +- * +- * @pool: the DMA memory pool +- * @hdrs: pointer to the array storing DMA memory pointers +- * @dma_addrs: pointer to the array storing DMA addresses +- * @num_hdars: number of headers to free. +- */ +-void rds_dma_hdrs_free(struct dma_pool *pool, struct rds_header **hdrs, +- dma_addr_t *dma_addrs, u32 num_hdrs) +-{ +- u32 i; +- +- for (i = 0; i < num_hdrs; i++) +- dma_pool_free(pool, hdrs[i], dma_addrs[i]); +- kvfree(hdrs); +- kvfree(dma_addrs); +-} +- + /* + * This needs to be very careful to not leave IS_ERR pointers around for + * cleanup to trip over. +@@ -516,7 +542,6 @@ static int rds_ib_setup_qp(struct rds_connection *conn) + struct rds_ib_device *rds_ibdev; + unsigned long max_wrs; + int ret, fr_queue_space; +- struct dma_pool *pool; + + /* + * It's normal to see a null device if an incoming connection races +@@ -612,25 +637,26 @@ static int rds_ib_setup_qp(struct rds_connection *conn) + goto recv_cq_out; + } + +- pool = rds_ibdev->rid_hdrs_pool; +- ic->i_send_hdrs = rds_dma_hdrs_alloc(dev, pool, &ic->i_send_hdrs_dma, +- ic->i_send_ring.w_nr); ++ ic->i_send_hdrs = rds_dma_hdrs_alloc(rds_ibdev, &ic->i_send_hdrs_dma, ++ ic->i_send_ring.w_nr, ++ DMA_TO_DEVICE); + if (!ic->i_send_hdrs) { + ret = -ENOMEM; + rdsdebug("DMA send hdrs alloc failed\n"); + goto qp_out; + } + +- ic->i_recv_hdrs = rds_dma_hdrs_alloc(dev, pool, &ic->i_recv_hdrs_dma, +- ic->i_recv_ring.w_nr); ++ ic->i_recv_hdrs = rds_dma_hdrs_alloc(rds_ibdev, &ic->i_recv_hdrs_dma, ++ ic->i_recv_ring.w_nr, ++ DMA_FROM_DEVICE); + if (!ic->i_recv_hdrs) { + ret = -ENOMEM; + rdsdebug("DMA recv hdrs alloc failed\n"); + goto send_hdrs_dma_out; + } + +- ic->i_ack = dma_pool_zalloc(pool, GFP_KERNEL, +- &ic->i_ack_dma); ++ ic->i_ack = rds_dma_hdr_alloc(rds_ibdev->dev, &ic->i_ack_dma, ++ DMA_TO_DEVICE); + if (!ic->i_ack) { + ret = -ENOMEM; + rdsdebug("DMA ack header alloc failed\n"); +@@ -666,18 +692,19 @@ sends_out: + vfree(ic->i_sends); + + ack_dma_out: +- dma_pool_free(pool, ic->i_ack, ic->i_ack_dma); ++ rds_dma_hdr_free(rds_ibdev->dev, ic->i_ack, ic->i_ack_dma, ++ DMA_TO_DEVICE); + ic->i_ack = NULL; + + recv_hdrs_dma_out: +- rds_dma_hdrs_free(pool, ic->i_recv_hdrs, ic->i_recv_hdrs_dma, +- ic->i_recv_ring.w_nr); ++ rds_dma_hdrs_free(rds_ibdev, ic->i_recv_hdrs, ic->i_recv_hdrs_dma, ++ ic->i_recv_ring.w_nr, DMA_FROM_DEVICE); + ic->i_recv_hdrs = NULL; + ic->i_recv_hdrs_dma = NULL; + + send_hdrs_dma_out: +- rds_dma_hdrs_free(pool, ic->i_send_hdrs, ic->i_send_hdrs_dma, +- ic->i_send_ring.w_nr); ++ rds_dma_hdrs_free(rds_ibdev, ic->i_send_hdrs, ic->i_send_hdrs_dma, ++ ic->i_send_ring.w_nr, DMA_TO_DEVICE); + ic->i_send_hdrs = NULL; + ic->i_send_hdrs_dma = NULL; + +@@ -1110,29 +1137,30 @@ void rds_ib_conn_path_shutdown(struct rds_conn_path *cp) + } + + if (ic->rds_ibdev) { +- struct dma_pool *pool; +- +- pool = ic->rds_ibdev->rid_hdrs_pool; +- + /* then free the resources that ib callbacks use */ + if (ic->i_send_hdrs) { +- rds_dma_hdrs_free(pool, ic->i_send_hdrs, ++ rds_dma_hdrs_free(ic->rds_ibdev, ++ ic->i_send_hdrs, + ic->i_send_hdrs_dma, +- ic->i_send_ring.w_nr); ++ ic->i_send_ring.w_nr, ++ DMA_TO_DEVICE); + ic->i_send_hdrs = NULL; + ic->i_send_hdrs_dma = NULL; + } + + if (ic->i_recv_hdrs) { +- rds_dma_hdrs_free(pool, ic->i_recv_hdrs, ++ rds_dma_hdrs_free(ic->rds_ibdev, ++ ic->i_recv_hdrs, + ic->i_recv_hdrs_dma, +- ic->i_recv_ring.w_nr); ++ ic->i_recv_ring.w_nr, ++ DMA_FROM_DEVICE); + ic->i_recv_hdrs = NULL; + ic->i_recv_hdrs_dma = NULL; + } + + if (ic->i_ack) { +- dma_pool_free(pool, ic->i_ack, ic->i_ack_dma); ++ rds_dma_hdr_free(ic->rds_ibdev->dev, ic->i_ack, ++ ic->i_ack_dma, DMA_TO_DEVICE); + ic->i_ack = NULL; + } + } else { +diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c +index 3cffcec5fb371..6fdedd9dbbc28 100644 +--- a/net/rds/ib_recv.c ++++ b/net/rds/ib_recv.c +@@ -662,10 +662,16 @@ static void rds_ib_send_ack(struct rds_ib_connection *ic, unsigned int adv_credi + seq = rds_ib_get_ack(ic); + + rdsdebug("send_ack: ic %p ack %llu\n", ic, (unsigned long long) seq); ++ ++ ib_dma_sync_single_for_cpu(ic->rds_ibdev->dev, ic->i_ack_dma, ++ sizeof(*hdr), DMA_TO_DEVICE); + rds_message_populate_header(hdr, 0, 0, 0); + hdr->h_ack = cpu_to_be64(seq); + hdr->h_credit = adv_credits; + rds_message_make_checksum(hdr); ++ ib_dma_sync_single_for_device(ic->rds_ibdev->dev, ic->i_ack_dma, ++ sizeof(*hdr), DMA_TO_DEVICE); ++ + ic->i_ack_queued = jiffies; + + ret = ib_post_send(ic->i_cm_id->qp, &ic->i_ack_wr, NULL); +@@ -845,6 +851,7 @@ static void rds_ib_process_recv(struct rds_connection *conn, + struct rds_ib_connection *ic = conn->c_transport_data; + struct rds_ib_incoming *ibinc = ic->i_ibinc; + struct rds_header *ihdr, *hdr; ++ dma_addr_t dma_addr = ic->i_recv_hdrs_dma[recv - ic->i_recvs]; + + /* XXX shut down the connection if port 0,0 are seen? */ + +@@ -863,6 +870,8 @@ static void rds_ib_process_recv(struct rds_connection *conn, + + ihdr = ic->i_recv_hdrs[recv - ic->i_recvs]; + ++ ib_dma_sync_single_for_cpu(ic->rds_ibdev->dev, dma_addr, ++ sizeof(*ihdr), DMA_FROM_DEVICE); + /* Validate the checksum. */ + if (!rds_message_verify_checksum(ihdr)) { + rds_ib_conn_error(conn, "incoming message " +@@ -870,7 +879,7 @@ static void rds_ib_process_recv(struct rds_connection *conn, + "forcing a reconnect\n", + &conn->c_faddr); + rds_stats_inc(s_recv_drop_bad_checksum); +- return; ++ goto done; + } + + /* Process the ACK sequence which comes with every packet */ +@@ -899,7 +908,7 @@ static void rds_ib_process_recv(struct rds_connection *conn, + */ + rds_ib_frag_free(ic, recv->r_frag); + recv->r_frag = NULL; +- return; ++ goto done; + } + + /* +@@ -933,7 +942,7 @@ static void rds_ib_process_recv(struct rds_connection *conn, + hdr->h_dport != ihdr->h_dport) { + rds_ib_conn_error(conn, + "fragment header mismatch; forcing reconnect\n"); +- return; ++ goto done; + } + } + +@@ -965,6 +974,9 @@ static void rds_ib_process_recv(struct rds_connection *conn, + + rds_inc_put(&ibinc->ii_inc); + } ++done: ++ ib_dma_sync_single_for_device(ic->rds_ibdev->dev, dma_addr, ++ sizeof(*ihdr), DMA_FROM_DEVICE); + } + + void rds_ib_recv_cqe_handler(struct rds_ib_connection *ic, +diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c +index dfe778220657a..92b4a8689aae7 100644 +--- a/net/rds/ib_send.c ++++ b/net/rds/ib_send.c +@@ -638,6 +638,10 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm, + send->s_sge[0].length = sizeof(struct rds_header); + send->s_sge[0].lkey = ic->i_pd->local_dma_lkey; + ++ ib_dma_sync_single_for_cpu(ic->rds_ibdev->dev, ++ ic->i_send_hdrs_dma[pos], ++ sizeof(struct rds_header), ++ DMA_TO_DEVICE); + memcpy(ic->i_send_hdrs[pos], &rm->m_inc.i_hdr, + sizeof(struct rds_header)); + +@@ -688,6 +692,10 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm, + adv_credits = 0; + rds_ib_stats_inc(s_ib_tx_credit_updates); + } ++ ib_dma_sync_single_for_device(ic->rds_ibdev->dev, ++ ic->i_send_hdrs_dma[pos], ++ sizeof(struct rds_header), ++ DMA_TO_DEVICE); + + if (prev) + prev->s_wr.next = &send->s_wr; +-- +2.33.0 + diff --git a/queue-5.10/reset-socfpga-add-empty-driver-allowing-consumers-to.patch b/queue-5.10/reset-socfpga-add-empty-driver-allowing-consumers-to.patch new file mode 100644 index 00000000000..5cb97013451 --- /dev/null +++ b/queue-5.10/reset-socfpga-add-empty-driver-allowing-consumers-to.patch @@ -0,0 +1,61 @@ +From e3092e28fd743a8113555056e72988d3c227e17d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Sep 2021 14:41:41 +0200 +Subject: reset: socfpga: add empty driver allowing consumers to probe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Paweł Anikiel + +[ Upstream commit 3ad60b4b3570937f3278509fe6797a5093ce53f8 ] + +The early reset driver doesn't ever probe, which causes consuming +devices to be unable to probe. Add an empty driver to set this device +as available, allowing consumers to probe. + +Signed-off-by: Paweł Anikiel +Link: https://lore.kernel.org/r/20210920124141.1166544-4-pan@semihalf.com +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/reset/reset-socfpga.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +diff --git a/drivers/reset/reset-socfpga.c b/drivers/reset/reset-socfpga.c +index bdd9842961960..f9fa7fde7afb1 100644 +--- a/drivers/reset/reset-socfpga.c ++++ b/drivers/reset/reset-socfpga.c +@@ -85,3 +85,29 @@ void __init socfpga_reset_init(void) + for_each_matching_node(np, socfpga_early_reset_dt_ids) + a10_reset_init(np); + } ++ ++/* ++ * The early driver is problematic, because it doesn't register ++ * itself as a driver. This causes certain device links to prevent ++ * consumer devices from probing. The hacky solution is to register ++ * an empty driver, whose only job is to attach itself to the reset ++ * manager and call probe. ++ */ ++static const struct of_device_id socfpga_reset_dt_ids[] = { ++ { .compatible = "altr,rst-mgr", }, ++ { /* sentinel */ }, ++}; ++ ++static int reset_simple_probe(struct platform_device *pdev) ++{ ++ return 0; ++} ++ ++static struct platform_driver reset_socfpga_driver = { ++ .probe = reset_simple_probe, ++ .driver = { ++ .name = "socfpga-reset", ++ .of_match_table = socfpga_reset_dt_ids, ++ }, ++}; ++builtin_platform_driver(reset_socfpga_driver); +-- +2.33.0 + diff --git a/queue-5.10/reset-tegra-bpmp-handle-errors-in-bpmp-response.patch b/queue-5.10/reset-tegra-bpmp-handle-errors-in-bpmp-response.patch new file mode 100644 index 00000000000..0bf4c103810 --- /dev/null +++ b/queue-5.10/reset-tegra-bpmp-handle-errors-in-bpmp-response.patch @@ -0,0 +1,52 @@ +From c69a43097a24911f61670941846f886211c8776a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Sep 2021 11:55:14 +0300 +Subject: reset: tegra-bpmp: Handle errors in BPMP response + +From: Mikko Perttunen + +[ Upstream commit c045ceb5a145d2a9a4bf33cbc55185ddf99f60ab ] + +The return value from tegra_bpmp_transfer indicates the success or +failure of the IPC transaction with BPMP. If the transaction +succeeded, we also need to check the actual command's result code. +Add code to do this. + +Signed-off-by: Mikko Perttunen +Link: https://lore.kernel.org/r/20210915085517.1669675-2-mperttunen@nvidia.com +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/reset/tegra/reset-bpmp.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/reset/tegra/reset-bpmp.c b/drivers/reset/tegra/reset-bpmp.c +index 24d3395964cc4..4c5bba52b1059 100644 +--- a/drivers/reset/tegra/reset-bpmp.c ++++ b/drivers/reset/tegra/reset-bpmp.c +@@ -20,6 +20,7 @@ static int tegra_bpmp_reset_common(struct reset_controller_dev *rstc, + struct tegra_bpmp *bpmp = to_tegra_bpmp(rstc); + struct mrq_reset_request request; + struct tegra_bpmp_message msg; ++ int err; + + memset(&request, 0, sizeof(request)); + request.cmd = command; +@@ -30,7 +31,13 @@ static int tegra_bpmp_reset_common(struct reset_controller_dev *rstc, + msg.tx.data = &request; + msg.tx.size = sizeof(request); + +- return tegra_bpmp_transfer(bpmp, &msg); ++ err = tegra_bpmp_transfer(bpmp, &msg); ++ if (err) ++ return err; ++ if (msg.rx.ret) ++ return -EINVAL; ++ ++ return 0; + } + + static int tegra_bpmp_reset_module(struct reset_controller_dev *rstc, +-- +2.33.0 + diff --git a/queue-5.10/scsi-qla2xxx-fix-unmap-of-already-freed-sgl.patch b/queue-5.10/scsi-qla2xxx-fix-unmap-of-already-freed-sgl.patch new file mode 100644 index 00000000000..136e426818f --- /dev/null +++ b/queue-5.10/scsi-qla2xxx-fix-unmap-of-already-freed-sgl.patch @@ -0,0 +1,90 @@ +From e2ef701336f070cd609aef9da9e682853e4f4d37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Oct 2021 15:26:50 +0300 +Subject: scsi: qla2xxx: Fix unmap of already freed sgl + +From: Dmitry Bogdanov + +[ Upstream commit 4a8f71014b4d56c4fb287607e844c0a9f68f46d9 ] + +The sgl is freed in the target stack in target_release_cmd_kref() before +calling qlt_free_cmd() but there is an unmap of sgl in qlt_free_cmd() that +causes a panic if sgl is not yet DMA unmapped: + +NIP dma_direct_unmap_sg+0xdc/0x180 +LR dma_direct_unmap_sg+0xc8/0x180 +Call Trace: + ql_dbg_prefix+0x68/0xc0 [qla2xxx] (unreliable) + dma_unmap_sg_attrs+0x54/0xf0 + qlt_unmap_sg.part.19+0x54/0x1c0 [qla2xxx] + qlt_free_cmd+0x124/0x1d0 [qla2xxx] + tcm_qla2xxx_release_cmd+0x4c/0xa0 [tcm_qla2xxx] + target_put_sess_cmd+0x198/0x370 [target_core_mod] + transport_generic_free_cmd+0x6c/0x1b0 [target_core_mod] + tcm_qla2xxx_complete_free+0x6c/0x90 [tcm_qla2xxx] + +The sgl may be left unmapped in error cases of response sending. For +instance, qlt_rdy_to_xfer() maps sgl and exits when session is being +deleted keeping the sgl mapped. + +This patch removes use-after-free of the sgl and ensures that the sgl is +unmapped for any command that was not sent to firmware. + +Link: https://lore.kernel.org/r/20211018122650.11846-1-d.bogdanov@yadro.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Dmitry Bogdanov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_target.c | 14 +++++--------- + 1 file changed, 5 insertions(+), 9 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 8d4976725a75a..ebed14bed7835 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -3256,8 +3256,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type, + "RESET-RSP online/active/old-count/new-count = %d/%d/%d/%d.\n", + vha->flags.online, qla2x00_reset_active(vha), + cmd->reset_count, qpair->chip_reset); +- spin_unlock_irqrestore(qpair->qp_lock_ptr, flags); +- return 0; ++ goto out_unmap_unlock; + } + + /* Does F/W have an IOCBs for this request */ +@@ -3380,10 +3379,6 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd) + prm.sg = NULL; + prm.req_cnt = 1; + +- /* Calculate number of entries and segments required */ +- if (qlt_pci_map_calc_cnt(&prm) != 0) +- return -EAGAIN; +- + if (!qpair->fw_started || (cmd->reset_count != qpair->chip_reset) || + (cmd->sess && cmd->sess->deleted)) { + /* +@@ -3401,6 +3396,10 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd) + return 0; + } + ++ /* Calculate number of entries and segments required */ ++ if (qlt_pci_map_calc_cnt(&prm) != 0) ++ return -EAGAIN; ++ + spin_lock_irqsave(qpair->qp_lock_ptr, flags); + /* Does F/W have an IOCBs for this request */ + res = qlt_check_reserve_free_req(qpair, prm.req_cnt); +@@ -3805,9 +3804,6 @@ void qlt_free_cmd(struct qla_tgt_cmd *cmd) + + BUG_ON(cmd->cmd_in_wq); + +- if (cmd->sg_mapped) +- qlt_unmap_sg(cmd->vha, cmd); +- + if (!cmd->q_full) + qlt_decr_num_pend_cmds(cmd->vha); + +-- +2.33.0 + diff --git a/queue-5.10/scsi-qla2xxx-return-enomem-if-kzalloc-fails.patch b/queue-5.10/scsi-qla2xxx-return-enomem-if-kzalloc-fails.patch new file mode 100644 index 00000000000..c6a70e7169d --- /dev/null +++ b/queue-5.10/scsi-qla2xxx-return-enomem-if-kzalloc-fails.patch @@ -0,0 +1,37 @@ +From 72c6f870af389de94fe0b622e017e163bd7fddef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Oct 2021 01:56:21 +0000 +Subject: scsi: qla2xxx: Return -ENOMEM if kzalloc() fails + +From: Zheyu Ma + +[ Upstream commit 06634d5b6e923ed0d4772aba8def5a618f44c7fe ] + +The driver probing function should return < 0 for failure, otherwise +kernel will treat value > 0 as success. + +Link: https://lore.kernel.org/r/1634522181-31166-1-git-send-email-zheyuma97@gmail.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Zheyu Ma +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_os.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index e075f855f298e..813abaf1b0872 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -4079,7 +4079,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len, + ql_dbg_pci(ql_dbg_init, ha->pdev, + 0xe0ee, "%s: failed alloc dsd\n", + __func__); +- return 1; ++ return -ENOMEM; + } + ha->dif_bundle_kallocs++; + +-- +2.33.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 5cc53b313be..8fb01168573 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -47,3 +47,36 @@ fuse-fix-page-stealing.patch x86-sme-use-define-use_early_pgtable_l5-in-mem_encrypt_identity.c.patch x86-cpu-fix-migration-safety-with-x86_bug_null_sel.patch x86-irq-ensure-pi-wakeup-handler-is-unregistered-before-module-unload.patch +asoc-soc-core-fix-null-ptr-deref-in-snd_soc_del_comp.patch +alsa-hda-realtek-fixes-hp-spectre-x360-15-eb1xxx-spe.patch +cavium-return-negative-value-when-pci_alloc_irq_vect.patch +scsi-qla2xxx-return-enomem-if-kzalloc-fails.patch +scsi-qla2xxx-fix-unmap-of-already-freed-sgl.patch +misdn-fix-return-values-of-the-probe-function.patch +cavium-fix-return-values-of-the-probe-function.patch +sfc-export-fibre-specific-supported-link-modes.patch +sfc-don-t-use-netif_info-before-net_device-setup.patch +hyperv-vmbus-include-linux-bitops.h.patch +arm-dts-sun7i-a20-olinuxino-lime2-fix-ethernet-phy-m.patch +reset-tegra-bpmp-handle-errors-in-bpmp-response.patch +reset-socfpga-add-empty-driver-allowing-consumers-to.patch +mmc-winbond-don-t-build-on-m68k.patch +drm-panel-orientation-quirks-add-quirk-for-aya-neo-2.patch +fcnal-test-kill-hanging-ping-nettest-binaries-on-cle.patch +bpf-define-bpf_jit_alloc_exec_limit-for-arm64-jit.patch +bpf-prevent-increasing-bpf_jit_limit-above-max.patch +gpio-mlxbf2.c-add-check-for-bgpio_init-failure.patch +xen-netfront-stop-tx-queues-during-live-migration.patch +nvmet-tcp-fix-a-memory-leak-when-releasing-a-queue.patch +spi-spl022-fix-microwire-full-duplex-mode.patch +net-multicast-calculate-csum-of-looped-back-and-forw.patch +watchdog-fix-omap-watchdog-early-handling.patch +drm-panel-orientation-quirks-add-quirk-for-gpd-win3.patch +block-schedule-queue-restart-after-blk_sts_zone_reso.patch +nvmet-tcp-fix-header-digest-verification.patch +r8169-add-device-10ec-8162-to-driver-r8169.patch +vmxnet3-do-not-stop-tx-queues-after-netif_device_det.patch +nfp-bpf-relax-prog-rejection-for-mtu-check-through-m.patch +net-smc-fix-smc_link-llc_testlink_time-overflow.patch +net-smc-correct-spelling-mistake-to-tcpf_syn_recv.patch +rds-stop-using-dmapool.patch diff --git a/queue-5.10/sfc-don-t-use-netif_info-before-net_device-setup.patch b/queue-5.10/sfc-don-t-use-netif_info-before-net_device-setup.patch new file mode 100644 index 00000000000..d8fd5acc6ad --- /dev/null +++ b/queue-5.10/sfc-don-t-use-netif_info-before-net_device-setup.patch @@ -0,0 +1,66 @@ +From c1561fe59bc43574d34eff4f5654035fdd9266d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Oct 2021 00:40:16 +0200 +Subject: sfc: Don't use netif_info before net_device setup + +From: Erik Ekman + +[ Upstream commit bf6abf345dfa77786aca554bc58c64bd428ecb1d ] + +Use pci_info instead to avoid unnamed/uninitialized noise: + +[197088.688729] sfc 0000:01:00.0: Solarflare NIC detected +[197088.690333] sfc 0000:01:00.0: Part Number : SFN5122F +[197088.729061] sfc 0000:01:00.0 (unnamed net_device) (uninitialized): no SR-IOV VFs probed +[197088.729071] sfc 0000:01:00.0 (unnamed net_device) (uninitialized): no PTP support + +Inspired by fa44821a4ddd ("sfc: don't use netif_info et al before +net_device is registered") from Heiner Kallweit. + +Signed-off-by: Erik Ekman +Acked-by: Martin Habets +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/ptp.c | 4 ++-- + drivers/net/ethernet/sfc/siena_sriov.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c +index a39c5143b3864..797e51802ccbb 100644 +--- a/drivers/net/ethernet/sfc/ptp.c ++++ b/drivers/net/ethernet/sfc/ptp.c +@@ -648,7 +648,7 @@ static int efx_ptp_get_attributes(struct efx_nic *efx) + } else if (rc == -EINVAL) { + fmt = MC_CMD_PTP_OUT_GET_ATTRIBUTES_SECONDS_NANOSECONDS; + } else if (rc == -EPERM) { +- netif_info(efx, probe, efx->net_dev, "no PTP support\n"); ++ pci_info(efx->pci_dev, "no PTP support\n"); + return rc; + } else { + efx_mcdi_display_error(efx, MC_CMD_PTP, sizeof(inbuf), +@@ -824,7 +824,7 @@ static int efx_ptp_disable(struct efx_nic *efx) + * should only have been called during probe. + */ + if (rc == -ENOSYS || rc == -EPERM) +- netif_info(efx, probe, efx->net_dev, "no PTP support\n"); ++ pci_info(efx->pci_dev, "no PTP support\n"); + else if (rc) + efx_mcdi_display_error(efx, MC_CMD_PTP, + MC_CMD_PTP_IN_DISABLE_LEN, +diff --git a/drivers/net/ethernet/sfc/siena_sriov.c b/drivers/net/ethernet/sfc/siena_sriov.c +index 83dcfcae3d4b5..441e7f3e53751 100644 +--- a/drivers/net/ethernet/sfc/siena_sriov.c ++++ b/drivers/net/ethernet/sfc/siena_sriov.c +@@ -1057,7 +1057,7 @@ void efx_siena_sriov_probe(struct efx_nic *efx) + return; + + if (efx_siena_sriov_cmd(efx, false, &efx->vi_scale, &count)) { +- netif_info(efx, probe, efx->net_dev, "no SR-IOV VFs probed\n"); ++ pci_info(efx->pci_dev, "no SR-IOV VFs probed\n"); + return; + } + if (count > 0 && count > max_vfs) +-- +2.33.0 + diff --git a/queue-5.10/sfc-export-fibre-specific-supported-link-modes.patch b/queue-5.10/sfc-export-fibre-specific-supported-link-modes.patch new file mode 100644 index 00000000000..26e87720ba1 --- /dev/null +++ b/queue-5.10/sfc-export-fibre-specific-supported-link-modes.patch @@ -0,0 +1,179 @@ +From cb5df82c95041cdaa92ef8ada3039ae2eba0f55e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Oct 2021 23:13:32 +0200 +Subject: sfc: Export fibre-specific supported link modes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Erik Ekman + +[ Upstream commit c62041c5baa9ded3bc6fd38d3f724de70683b489 ] + +The 1/10GbaseT modes were set up for cards with SFP+ cages in +3497ed8c852a5 ("sfc: report supported link speeds on SFP connections"). +10GbaseT was likely used since no 10G fibre mode existed. + +The missing fibre modes for 1/10G were added to ethtool.h in 5711a9822144 +("net: ethtool: add support for 1000BaseX and missing 10G link modes") +shortly thereafter. + +The user guide available at https://support-nic.xilinx.com/wp/drivers +lists support for the following cable and transceiver types in section 2.9: +- QSFP28 100G Direct Attach Cables +- QSFP28 100G SR Optical Transceivers (with SR4 modules listed) +- SFP28 25G Direct Attach Cables +- SFP28 25G SR Optical Transceivers +- QSFP+ 40G Direct Attach Cables +- QSFP+ 40G Active Optical Cables +- QSFP+ 40G SR4 Optical Transceivers +- QSFP+ to SFP+ Breakout Direct Attach Cables +- QSFP+ to SFP+ Breakout Active Optical Cables +- SFP+ 10G Direct Attach Cables +- SFP+ 10G SR Optical Transceivers +- SFP+ 10G LR Optical Transceivers +- SFP 1000BASE‐T Transceivers +- 1G Optical Transceivers +(From user guide issue 28. Issue 16 which also includes older cards like +SFN5xxx/SFN6xxx has matching lists for 1/10/40G transceiver types.) + +Regarding SFP+ 10GBASE‐T transceivers the latest guide says: +"Solarflare adapters do not support 10GBASE‐T transceiver modules." + +Tested using SFN5122F-R7 (with 2 SFP+ ports). Supported link modes do not change +depending on module used (tested with 1000BASE-T, 1000BASE-BX10, 10GBASE-LR). +Before: + +$ ethtool ext +Settings for ext: + Supported ports: [ FIBRE ] + Supported link modes: 1000baseT/Full + 10000baseT/Full + Supported pause frame use: Symmetric Receive-only + Supports auto-negotiation: No + Supported FEC modes: Not reported + Advertised link modes: Not reported + Advertised pause frame use: No + Advertised auto-negotiation: No + Advertised FEC modes: Not reported + Link partner advertised link modes: Not reported + Link partner advertised pause frame use: No + Link partner advertised auto-negotiation: No + Link partner advertised FEC modes: Not reported + Speed: 1000Mb/s + Duplex: Full + Auto-negotiation: off + Port: FIBRE + PHYAD: 255 + Transceiver: internal + Current message level: 0x000020f7 (8439) + drv probe link ifdown ifup rx_err tx_err hw + Link detected: yes + +After: + +$ ethtool ext +Settings for ext: + Supported ports: [ FIBRE ] + Supported link modes: 1000baseT/Full + 1000baseX/Full + 10000baseCR/Full + 10000baseSR/Full + 10000baseLR/Full + Supported pause frame use: Symmetric Receive-only + Supports auto-negotiation: No + Supported FEC modes: Not reported + Advertised link modes: Not reported + Advertised pause frame use: No + Advertised auto-negotiation: No + Advertised FEC modes: Not reported + Link partner advertised link modes: Not reported + Link partner advertised pause frame use: No + Link partner advertised auto-negotiation: No + Link partner advertised FEC modes: Not reported + Speed: 1000Mb/s + Duplex: Full + Auto-negotiation: off + Port: FIBRE + PHYAD: 255 + Transceiver: internal + Supports Wake-on: g + Wake-on: d + Current message level: 0x000020f7 (8439) + drv probe link ifdown ifup rx_err tx_err hw + Link detected: yes + +Signed-off-by: Erik Ekman +Acked-by: Martin Habets +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/mcdi_port_common.c | 37 +++++++++++++++------ + 1 file changed, 26 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/sfc/mcdi_port_common.c b/drivers/net/ethernet/sfc/mcdi_port_common.c +index 4bd3ef8f3384e..c4fe3c48ac46a 100644 +--- a/drivers/net/ethernet/sfc/mcdi_port_common.c ++++ b/drivers/net/ethernet/sfc/mcdi_port_common.c +@@ -132,16 +132,27 @@ void mcdi_to_ethtool_linkset(u32 media, u32 cap, unsigned long *linkset) + case MC_CMD_MEDIA_SFP_PLUS: + case MC_CMD_MEDIA_QSFP_PLUS: + SET_BIT(FIBRE); +- if (cap & (1 << MC_CMD_PHY_CAP_1000FDX_LBN)) ++ if (cap & (1 << MC_CMD_PHY_CAP_1000FDX_LBN)) { + SET_BIT(1000baseT_Full); +- if (cap & (1 << MC_CMD_PHY_CAP_10000FDX_LBN)) +- SET_BIT(10000baseT_Full); +- if (cap & (1 << MC_CMD_PHY_CAP_40000FDX_LBN)) ++ SET_BIT(1000baseX_Full); ++ } ++ if (cap & (1 << MC_CMD_PHY_CAP_10000FDX_LBN)) { ++ SET_BIT(10000baseCR_Full); ++ SET_BIT(10000baseLR_Full); ++ SET_BIT(10000baseSR_Full); ++ } ++ if (cap & (1 << MC_CMD_PHY_CAP_40000FDX_LBN)) { + SET_BIT(40000baseCR4_Full); +- if (cap & (1 << MC_CMD_PHY_CAP_100000FDX_LBN)) ++ SET_BIT(40000baseSR4_Full); ++ } ++ if (cap & (1 << MC_CMD_PHY_CAP_100000FDX_LBN)) { + SET_BIT(100000baseCR4_Full); +- if (cap & (1 << MC_CMD_PHY_CAP_25000FDX_LBN)) ++ SET_BIT(100000baseSR4_Full); ++ } ++ if (cap & (1 << MC_CMD_PHY_CAP_25000FDX_LBN)) { + SET_BIT(25000baseCR_Full); ++ SET_BIT(25000baseSR_Full); ++ } + if (cap & (1 << MC_CMD_PHY_CAP_50000FDX_LBN)) + SET_BIT(50000baseCR2_Full); + break; +@@ -192,15 +203,19 @@ u32 ethtool_linkset_to_mcdi_cap(const unsigned long *linkset) + result |= (1 << MC_CMD_PHY_CAP_100FDX_LBN); + if (TEST_BIT(1000baseT_Half)) + result |= (1 << MC_CMD_PHY_CAP_1000HDX_LBN); +- if (TEST_BIT(1000baseT_Full) || TEST_BIT(1000baseKX_Full)) ++ if (TEST_BIT(1000baseT_Full) || TEST_BIT(1000baseKX_Full) || ++ TEST_BIT(1000baseX_Full)) + result |= (1 << MC_CMD_PHY_CAP_1000FDX_LBN); +- if (TEST_BIT(10000baseT_Full) || TEST_BIT(10000baseKX4_Full)) ++ if (TEST_BIT(10000baseT_Full) || TEST_BIT(10000baseKX4_Full) || ++ TEST_BIT(10000baseCR_Full) || TEST_BIT(10000baseLR_Full) || ++ TEST_BIT(10000baseSR_Full)) + result |= (1 << MC_CMD_PHY_CAP_10000FDX_LBN); +- if (TEST_BIT(40000baseCR4_Full) || TEST_BIT(40000baseKR4_Full)) ++ if (TEST_BIT(40000baseCR4_Full) || TEST_BIT(40000baseKR4_Full) || ++ TEST_BIT(40000baseSR4_Full)) + result |= (1 << MC_CMD_PHY_CAP_40000FDX_LBN); +- if (TEST_BIT(100000baseCR4_Full)) ++ if (TEST_BIT(100000baseCR4_Full) || TEST_BIT(100000baseSR4_Full)) + result |= (1 << MC_CMD_PHY_CAP_100000FDX_LBN); +- if (TEST_BIT(25000baseCR_Full)) ++ if (TEST_BIT(25000baseCR_Full) || TEST_BIT(25000baseSR_Full)) + result |= (1 << MC_CMD_PHY_CAP_25000FDX_LBN); + if (TEST_BIT(50000baseCR2_Full)) + result |= (1 << MC_CMD_PHY_CAP_50000FDX_LBN); +-- +2.33.0 + diff --git a/queue-5.10/spi-spl022-fix-microwire-full-duplex-mode.patch b/queue-5.10/spi-spl022-fix-microwire-full-duplex-mode.patch new file mode 100644 index 00000000000..0493a179002 --- /dev/null +++ b/queue-5.10/spi-spl022-fix-microwire-full-duplex-mode.patch @@ -0,0 +1,44 @@ +From d386e8ac715d2fdb2fb80b649fd485e09925043a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Oct 2021 16:21:04 +0200 +Subject: spi: spl022: fix Microwire full duplex mode + +From: Thomas Perrot + +[ Upstream commit d81d0e41ed5fe7229a2c9a29d13bad288c7cf2d2 ] + +There are missing braces in the function that verify controller parameters, +then an error is always returned when the parameter to select Microwire +frames operation is used on devices allowing it. + +Signed-off-by: Thomas Perrot +Link: https://lore.kernel.org/r/20211022142104.1386379-1-thomas.perrot@bootlin.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-pl022.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c +index d1776fea287e5..e4ee8b0847993 100644 +--- a/drivers/spi/spi-pl022.c ++++ b/drivers/spi/spi-pl022.c +@@ -1723,12 +1723,13 @@ static int verify_controller_parameters(struct pl022 *pl022, + return -EINVAL; + } + } else { +- if (chip_info->duplex != SSP_MICROWIRE_CHANNEL_FULL_DUPLEX) ++ if (chip_info->duplex != SSP_MICROWIRE_CHANNEL_FULL_DUPLEX) { + dev_err(&pl022->adev->dev, + "Microwire half duplex mode requested," + " but this is only available in the" + " ST version of PL022\n"); +- return -EINVAL; ++ return -EINVAL; ++ } + } + } + return 0; +-- +2.33.0 + diff --git a/queue-5.10/vmxnet3-do-not-stop-tx-queues-after-netif_device_det.patch b/queue-5.10/vmxnet3-do-not-stop-tx-queues-after-netif_device_det.patch new file mode 100644 index 00000000000..bfade44a869 --- /dev/null +++ b/queue-5.10/vmxnet3-do-not-stop-tx-queues-after-netif_device_det.patch @@ -0,0 +1,34 @@ +From fba971bdfa425fe9007f7948a306d5b099243d4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Oct 2021 14:50:31 -0700 +Subject: vmxnet3: do not stop tx queues after netif_device_detach() + +From: Dongli Zhang + +[ Upstream commit 9159f102402a64ac85e676b75cc1f9c62c5b4b73 ] + +The netif_device_detach() conditionally stops all tx queues if the queues +are running. There is no need to call netif_tx_stop_all_queues() again. + +Signed-off-by: Dongli Zhang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/vmxnet3/vmxnet3_drv.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c +index 336504b7531d9..932a39945cc62 100644 +--- a/drivers/net/vmxnet3/vmxnet3_drv.c ++++ b/drivers/net/vmxnet3/vmxnet3_drv.c +@@ -3765,7 +3765,6 @@ vmxnet3_suspend(struct device *device) + vmxnet3_free_intr_resources(adapter); + + netif_device_detach(netdev); +- netif_tx_stop_all_queues(netdev); + + /* Create wake-up filters. */ + pmConf = adapter->pm_conf; +-- +2.33.0 + diff --git a/queue-5.10/watchdog-fix-omap-watchdog-early-handling.patch b/queue-5.10/watchdog-fix-omap-watchdog-early-handling.patch new file mode 100644 index 00000000000..4dfa505486b --- /dev/null +++ b/queue-5.10/watchdog-fix-omap-watchdog-early-handling.patch @@ -0,0 +1,44 @@ +From 6d0237bdb7dbc1bc0d023e5da32518cb4eabb073 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Oct 2021 12:22:29 +0200 +Subject: watchdog: Fix OMAP watchdog early handling + +From: Walter Stoll + +[ Upstream commit cd004d8299f1dc6cfa6a4eea8f94cb45eaedf070 ] + +TI's implementation does not service the watchdog even if the kernel +command line parameter omap_wdt.early_enable is set to 1. This patch +fixes the issue. + +Signed-off-by: Walter Stoll +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/88a8fe5229cd68fa0f1fd22f5d66666c1b7057a0.camel@duagon.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/omap_wdt.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c +index 1616f93dfad7f..74d785b2b478f 100644 +--- a/drivers/watchdog/omap_wdt.c ++++ b/drivers/watchdog/omap_wdt.c +@@ -268,8 +268,12 @@ static int omap_wdt_probe(struct platform_device *pdev) + wdev->wdog.bootstatus = WDIOF_CARDRESET; + } + +- if (!early_enable) ++ if (early_enable) { ++ omap_wdt_start(&wdev->wdog); ++ set_bit(WDOG_HW_RUNNING, &wdev->wdog.status); ++ } else { + omap_wdt_disable(wdev); ++ } + + ret = watchdog_register_device(&wdev->wdog); + if (ret) { +-- +2.33.0 + diff --git a/queue-5.10/xen-netfront-stop-tx-queues-during-live-migration.patch b/queue-5.10/xen-netfront-stop-tx-queues-during-live-migration.patch new file mode 100644 index 00000000000..13f8837271e --- /dev/null +++ b/queue-5.10/xen-netfront-stop-tx-queues-during-live-migration.patch @@ -0,0 +1,67 @@ +From f993295b6fb95efe0a8c74eb2b4691191eff2811 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Oct 2021 16:31:39 -0700 +Subject: xen/netfront: stop tx queues during live migration + +From: Dongli Zhang + +[ Upstream commit 042b2046d0f05cf8124c26ff65dbb6148a4404fb ] + +The tx queues are not stopped during the live migration. As a result, the +ndo_start_xmit() may access netfront_info->queues which is freed by +talk_to_netback()->xennet_destroy_queues(). + +This patch is to netif_device_detach() at the beginning of xen-netfront +resuming, and netif_device_attach() at the end of resuming. + + CPU A CPU B + + talk_to_netback() + -> if (info->queues) + xennet_destroy_queues(info); + to free netfront_info->queues + + xennet_start_xmit() + to access netfront_info->queues + + -> err = xennet_create_queues(info, &num_queues); + +The idea is borrowed from virtio-net. + +Cc: Joe Jin +Signed-off-by: Dongli Zhang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/xen-netfront.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index 3e9895bec15f0..dd79534910b05 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -1671,6 +1671,10 @@ static int netfront_resume(struct xenbus_device *dev) + + dev_dbg(&dev->dev, "%s\n", dev->nodename); + ++ netif_tx_lock_bh(info->netdev); ++ netif_device_detach(info->netdev); ++ netif_tx_unlock_bh(info->netdev); ++ + xennet_disconnect_backend(info); + return 0; + } +@@ -2285,6 +2289,10 @@ static int xennet_connect(struct net_device *dev) + * domain a kick because we've probably just requeued some + * packets. + */ ++ netif_tx_lock_bh(np->netdev); ++ netif_device_attach(np->netdev); ++ netif_tx_unlock_bh(np->netdev); ++ + netif_carrier_on(np->netdev); + for (j = 0; j < num_queues; ++j) { + queue = &np->queues[j]; +-- +2.33.0 + -- 2.47.2