From d3674617ffab4a412aa13465654be6895fc8d165 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sat, 13 Nov 2021 08:48:30 -0500 Subject: [PATCH] Fixes for 5.4 Signed-off-by: Sasha Levin --- ...0-olinuxino-lime2-fix-ethernet-phy-m.patch | 45 +++++++ ...f_jit_alloc_exec_limit-for-arm64-jit.patch | 38 ++++++ ...t-increasing-bpf_jit_limit-above-max.patch | 71 +++++++++++ ...-return-values-of-the-probe-function.patch | 44 +++++++ ...gative-value-when-pci_alloc_irq_vect.patch | 35 ++++++ ...ation-quirks-add-quirk-for-aya-neo-2.patch | 39 ++++++ ...tation-quirks-add-quirk-for-gpd-win3.patch | 39 ++++++ .../hyperv-vmbus-include-linux-bitops.h.patch | 45 +++++++ .../mmc-winbond-don-t-build-on-m68k.patch | 45 +++++++ ...lculate-csum-of-looped-back-and-forw.patch | 98 +++++++++++++++ ...ct-spelling-mistake-to-tcpf_syn_recv.patch | 35 ++++++ ...og-rejection-for-mtu-check-through-m.patch | 114 ++++++++++++++++++ ...a-memory-leak-when-releasing-a-queue.patch | 51 ++++++++ ...t-tcp-fix-header-digest-verification.patch | 37 ++++++ ...add-device-10ec-8162-to-driver-r8169.patch | 36 ++++++ ...d-empty-driver-allowing-consumers-to.patch | 61 ++++++++++ ...-bpmp-handle-errors-in-bpmp-response.patch | 52 ++++++++ ...a2xxx-fix-unmap-of-already-freed-sgl.patch | 90 ++++++++++++++ ...a2xxx-return-enomem-if-kzalloc-fails.patch | 37 ++++++ queue-5.4/series | 24 ++++ ...e-netif_info-before-net_device-setup.patch | 66 ++++++++++ ...pl022-fix-microwire-full-duplex-mode.patch | 44 +++++++ ...top-tx-queues-after-netif_device_det.patch | 34 ++++++ ...dog-fix-omap-watchdog-early-handling.patch | 44 +++++++ ...stop-tx-queues-during-live-migration.patch | 67 ++++++++++ 25 files changed, 1291 insertions(+) create mode 100644 queue-5.4/arm-dts-sun7i-a20-olinuxino-lime2-fix-ethernet-phy-m.patch create mode 100644 queue-5.4/bpf-define-bpf_jit_alloc_exec_limit-for-arm64-jit.patch create mode 100644 queue-5.4/bpf-prevent-increasing-bpf_jit_limit-above-max.patch create mode 100644 queue-5.4/cavium-fix-return-values-of-the-probe-function.patch create mode 100644 queue-5.4/cavium-return-negative-value-when-pci_alloc_irq_vect.patch create mode 100644 queue-5.4/drm-panel-orientation-quirks-add-quirk-for-aya-neo-2.patch create mode 100644 queue-5.4/drm-panel-orientation-quirks-add-quirk-for-gpd-win3.patch create mode 100644 queue-5.4/hyperv-vmbus-include-linux-bitops.h.patch create mode 100644 queue-5.4/mmc-winbond-don-t-build-on-m68k.patch create mode 100644 queue-5.4/net-multicast-calculate-csum-of-looped-back-and-forw.patch create mode 100644 queue-5.4/net-smc-correct-spelling-mistake-to-tcpf_syn_recv.patch create mode 100644 queue-5.4/nfp-bpf-relax-prog-rejection-for-mtu-check-through-m.patch create mode 100644 queue-5.4/nvmet-tcp-fix-a-memory-leak-when-releasing-a-queue.patch create mode 100644 queue-5.4/nvmet-tcp-fix-header-digest-verification.patch create mode 100644 queue-5.4/r8169-add-device-10ec-8162-to-driver-r8169.patch create mode 100644 queue-5.4/reset-socfpga-add-empty-driver-allowing-consumers-to.patch create mode 100644 queue-5.4/reset-tegra-bpmp-handle-errors-in-bpmp-response.patch create mode 100644 queue-5.4/scsi-qla2xxx-fix-unmap-of-already-freed-sgl.patch create mode 100644 queue-5.4/scsi-qla2xxx-return-enomem-if-kzalloc-fails.patch create mode 100644 queue-5.4/sfc-don-t-use-netif_info-before-net_device-setup.patch create mode 100644 queue-5.4/spi-spl022-fix-microwire-full-duplex-mode.patch create mode 100644 queue-5.4/vmxnet3-do-not-stop-tx-queues-after-netif_device_det.patch create mode 100644 queue-5.4/watchdog-fix-omap-watchdog-early-handling.patch create mode 100644 queue-5.4/xen-netfront-stop-tx-queues-during-live-migration.patch diff --git a/queue-5.4/arm-dts-sun7i-a20-olinuxino-lime2-fix-ethernet-phy-m.patch b/queue-5.4/arm-dts-sun7i-a20-olinuxino-lime2-fix-ethernet-phy-m.patch new file mode 100644 index 00000000000..dfc15cc2585 --- /dev/null +++ b/queue-5.4/arm-dts-sun7i-a20-olinuxino-lime2-fix-ethernet-phy-m.patch @@ -0,0 +1,45 @@ +From 08f4df7674763b5f3151f330bf2a8c0dcc1c4d37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Sep 2021 08:17:21 +0000 +Subject: ARM: dts: sun7i: A20-olinuxino-lime2: Fix ethernet phy-mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bastien Roucariès + +[ Upstream commit 55dd7e059098ce4bd0a55c251cb78e74604abb57 ] + +Commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx delay +config") sets the RX/TX delay according to the phy-mode property in the +device tree. For the A20-olinuxino-lime2 board this is "rgmii", which is the +wrong setting. + +Following the example of a900cac3750b ("ARM: dts: sun7i: a20: bananapro: +Fix ethernet phy-mode") the phy-mode is changed to "rgmii-id" which gets +the Ethernet working again on this board. + +Signed-off-by: Bastien Roucariès +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20210916081721.237137-1-rouca@debian.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts +index 9ba62774e89a1..488933b87ad5a 100644 +--- a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts ++++ b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts +@@ -112,7 +112,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&gmac_rgmii_pins>; + phy-handle = <&phy1>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + status = "okay"; + }; + +-- +2.33.0 + diff --git a/queue-5.4/bpf-define-bpf_jit_alloc_exec_limit-for-arm64-jit.patch b/queue-5.4/bpf-define-bpf_jit_alloc_exec_limit-for-arm64-jit.patch new file mode 100644 index 00000000000..53dfaea0230 --- /dev/null +++ b/queue-5.4/bpf-define-bpf_jit_alloc_exec_limit-for-arm64-jit.patch @@ -0,0 +1,38 @@ +From 2418f499c0f8f3702c85d1486587305797f1cec3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Oct 2021 15:25:52 +0100 +Subject: bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT + +From: Lorenz Bauer + +[ Upstream commit 5d63ae908242f028bd10860cba98450d11c079b8 ] + +Expose the maximum amount of useable memory from the arm64 JIT. + +Signed-off-by: Lorenz Bauer +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20211014142554.53120-3-lmb@cloudflare.com +Signed-off-by: Sasha Levin +--- + arch/arm64/net/bpf_jit_comp.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c +index afc7d41347f73..a343677837c77 100644 +--- a/arch/arm64/net/bpf_jit_comp.c ++++ b/arch/arm64/net/bpf_jit_comp.c +@@ -996,6 +996,11 @@ out: + return prog; + } + ++u64 bpf_jit_alloc_exec_limit(void) ++{ ++ return BPF_JIT_REGION_SIZE; ++} ++ + void *bpf_jit_alloc_exec(unsigned long size) + { + return __vmalloc_node_range(size, PAGE_SIZE, BPF_JIT_REGION_START, +-- +2.33.0 + diff --git a/queue-5.4/bpf-prevent-increasing-bpf_jit_limit-above-max.patch b/queue-5.4/bpf-prevent-increasing-bpf_jit_limit-above-max.patch new file mode 100644 index 00000000000..9ab48bdcd87 --- /dev/null +++ b/queue-5.4/bpf-prevent-increasing-bpf_jit_limit-above-max.patch @@ -0,0 +1,71 @@ +From a6dc241f54ddee9da991ba36f7763c80b245380f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Oct 2021 15:25:53 +0100 +Subject: bpf: Prevent increasing bpf_jit_limit above max + +From: Lorenz Bauer + +[ Upstream commit fadb7ff1a6c2c565af56b4aacdd086b067eed440 ] + +Restrict bpf_jit_limit to the maximum supported by the arch's JIT. + +Signed-off-by: Lorenz Bauer +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20211014142554.53120-4-lmb@cloudflare.com +Signed-off-by: Sasha Levin +--- + include/linux/filter.h | 1 + + kernel/bpf/core.c | 4 +++- + net/core/sysctl_net_core.c | 2 +- + 3 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/include/linux/filter.h b/include/linux/filter.h +index c4f89340f4986..440014875acf4 100644 +--- a/include/linux/filter.h ++++ b/include/linux/filter.h +@@ -952,6 +952,7 @@ extern int bpf_jit_enable; + extern int bpf_jit_harden; + extern int bpf_jit_kallsyms; + extern long bpf_jit_limit; ++extern long bpf_jit_limit_max; + + typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size); + +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index d9a3d995bd966..1238ef9c569df 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -523,6 +523,7 @@ int bpf_jit_enable __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_ALWAYS_ON); + int bpf_jit_harden __read_mostly; + int bpf_jit_kallsyms __read_mostly; + long bpf_jit_limit __read_mostly; ++long bpf_jit_limit_max __read_mostly; + + static __always_inline void + bpf_get_prog_addr_region(const struct bpf_prog *prog, +@@ -759,7 +760,8 @@ u64 __weak bpf_jit_alloc_exec_limit(void) + static int __init bpf_jit_charge_init(void) + { + /* Only used as heuristic here to derive limit. */ +- bpf_jit_limit = min_t(u64, round_up(bpf_jit_alloc_exec_limit() >> 2, ++ bpf_jit_limit_max = bpf_jit_alloc_exec_limit(); ++ bpf_jit_limit = min_t(u64, round_up(bpf_jit_limit_max >> 2, + PAGE_SIZE), LONG_MAX); + return 0; + } +diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c +index 669cbe1609d9e..48041f50ecfb4 100644 +--- a/net/core/sysctl_net_core.c ++++ b/net/core/sysctl_net_core.c +@@ -424,7 +424,7 @@ static struct ctl_table net_core_table[] = { + .mode = 0600, + .proc_handler = proc_dolongvec_minmax_bpf_restricted, + .extra1 = &long_one, +- .extra2 = &long_max, ++ .extra2 = &bpf_jit_limit_max, + }, + #endif + { +-- +2.33.0 + diff --git a/queue-5.4/cavium-fix-return-values-of-the-probe-function.patch b/queue-5.4/cavium-fix-return-values-of-the-probe-function.patch new file mode 100644 index 00000000000..d44185359b0 --- /dev/null +++ b/queue-5.4/cavium-fix-return-values-of-the-probe-function.patch @@ -0,0 +1,44 @@ +From 5697ef5816bc449009c5ccfd48c94b7814e38f55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Oct 2021 14:32:57 +0000 +Subject: cavium: Fix return values of the probe function + +From: Zheyu Ma + +[ Upstream commit c69b2f46876825c726bd8a97c7fa852d8932bc32 ] + +During the process of driver probing, the probe function should return < 0 +for failure, otherwise, the kernel will treat value > 0 as success. + +Signed-off-by: Zheyu Ma +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cavium/thunder/nicvf_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c +index 5c45c0c6dd234..27ea528ef4484 100644 +--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c ++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c +@@ -1226,7 +1226,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic) + if (ret < 0) { + netdev_err(nic->netdev, + "Req for #%d msix vectors failed\n", nic->num_vec); +- return 1; ++ return ret; + } + + sprintf(nic->irq_name[irq], "%s Mbox", "NICVF"); +@@ -1245,7 +1245,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic) + if (!nicvf_check_pf_ready(nic)) { + nicvf_disable_intr(nic, NICVF_INTR_MBOX, 0); + nicvf_unregister_interrupts(nic); +- return 1; ++ return -EIO; + } + + return 0; +-- +2.33.0 + diff --git a/queue-5.4/cavium-return-negative-value-when-pci_alloc_irq_vect.patch b/queue-5.4/cavium-return-negative-value-when-pci_alloc_irq_vect.patch new file mode 100644 index 00000000000..c5ed42716a6 --- /dev/null +++ b/queue-5.4/cavium-return-negative-value-when-pci_alloc_irq_vect.patch @@ -0,0 +1,35 @@ +From 75d800b9d63739ce9a52fa80199ca313ac375ae2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Oct 2021 02:16:22 +0000 +Subject: cavium: Return negative value when pci_alloc_irq_vectors() fails + +From: Zheyu Ma + +[ Upstream commit b2cddb44bddc1a9c5949a978bb454bba863264db ] + +During the process of driver probing, the probe function should return < 0 +for failure, otherwise, the kernel will treat value > 0 as success. + +Signed-off-by: Zheyu Ma +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cavium/thunder/nic_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c +index 9361f964bb9b2..816453a4f8d6c 100644 +--- a/drivers/net/ethernet/cavium/thunder/nic_main.c ++++ b/drivers/net/ethernet/cavium/thunder/nic_main.c +@@ -1193,7 +1193,7 @@ static int nic_register_interrupts(struct nicpf *nic) + dev_err(&nic->pdev->dev, + "Request for #%d msix vectors failed, returned %d\n", + nic->num_vec, ret); +- return 1; ++ return ret; + } + + /* Register mailbox interrupt handler */ +-- +2.33.0 + diff --git a/queue-5.4/drm-panel-orientation-quirks-add-quirk-for-aya-neo-2.patch b/queue-5.4/drm-panel-orientation-quirks-add-quirk-for-aya-neo-2.patch new file mode 100644 index 00000000000..519c9fd49f0 --- /dev/null +++ b/queue-5.4/drm-panel-orientation-quirks-add-quirk-for-aya-neo-2.patch @@ -0,0 +1,39 @@ +From 5472268555711be2955958bd504a95ca2a5d09c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Oct 2021 09:24:33 -0500 +Subject: drm: panel-orientation-quirks: Add quirk for Aya Neo 2021 + +From: Bryant Mairs + +[ Upstream commit def0c3697287f6e85d5ac68b21302966c95474f9 ] + +Fixes screen orientation for the Aya Neo 2021 handheld gaming console. + +Signed-off-by: Bryant Mairs +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20211019142433.4295-1-bryant@mai.rs +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index f6bdec7fa9253..30c17a76f49ae 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -134,6 +134,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"), + }, + .driver_data = (void *)&lcd800x1280_rightside_up, ++ }, { /* AYA NEO 2021 */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYADEVICE"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "AYA NEO 2021"), ++ }, ++ .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* GPD MicroPC (generic strings, also match on bios date) */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"), +-- +2.33.0 + diff --git a/queue-5.4/drm-panel-orientation-quirks-add-quirk-for-gpd-win3.patch b/queue-5.4/drm-panel-orientation-quirks-add-quirk-for-gpd-win3.patch new file mode 100644 index 00000000000..69cc1334c2d --- /dev/null +++ b/queue-5.4/drm-panel-orientation-quirks-add-quirk-for-gpd-win3.patch @@ -0,0 +1,39 @@ +From 8eabe49c035cccb50074bedf40de2ed907eebaf5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Oct 2021 13:27:37 +0200 +Subject: drm: panel-orientation-quirks: Add quirk for GPD Win3 + +From: Mario + +[ Upstream commit 61b1d445f3bfe4c3ba4335ceeb7e8ba688fd31e2 ] + +Fixes screen orientation for GPD Win 3 handheld gaming console. + +Signed-off-by: Mario Risoldi +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20211026112737.9181-1-awxkrnl@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 30c17a76f49ae..e1b2ce4921ae7 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -191,6 +191,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"), + }, + .driver_data = (void *)&gpd_win2, ++ }, { /* GPD Win 3 */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "G1618-03") ++ }, ++ .driver_data = (void *)&lcd720x1280_rightside_up, + }, { /* I.T.Works TW891 */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "To be filled by O.E.M."), +-- +2.33.0 + diff --git a/queue-5.4/hyperv-vmbus-include-linux-bitops.h.patch b/queue-5.4/hyperv-vmbus-include-linux-bitops.h.patch new file mode 100644 index 00000000000..cc2fb6ca0dc --- /dev/null +++ b/queue-5.4/hyperv-vmbus-include-linux-bitops.h.patch @@ -0,0 +1,45 @@ +From e65f57310bc4077c1b6be698469e85962669861f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Oct 2021 15:19:08 +0200 +Subject: hyperv/vmbus: include linux/bitops.h + +From: Arnd Bergmann + +[ Upstream commit 8017c99680fa65e1e8d999df1583de476a187830 ] + +On arm64 randconfig builds, hyperv sometimes fails with this +error: + +In file included from drivers/hv/hv_trace.c:3: +In file included from drivers/hv/hyperv_vmbus.h:16: +In file included from arch/arm64/include/asm/sync_bitops.h:5: +arch/arm64/include/asm/bitops.h:11:2: error: only can be included directly +In file included from include/asm-generic/bitops/hweight.h:5: +include/asm-generic/bitops/arch_hweight.h:9:9: error: implicit declaration of function '__sw_hweight32' [-Werror,-Wimplicit-function-declaration] +include/asm-generic/bitops/atomic.h:17:7: error: implicit declaration of function 'BIT_WORD' [-Werror,-Wimplicit-function-declaration] + +Include the correct header first. + +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20211018131929.2260087-1-arnd@kernel.org +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/hyperv_vmbus.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h +index cabcb66e7c5ef..356382a340b2c 100644 +--- a/drivers/hv/hyperv_vmbus.h ++++ b/drivers/hv/hyperv_vmbus.h +@@ -13,6 +13,7 @@ + #define _HYPERV_VMBUS_H + + #include ++#include + #include + #include + #include +-- +2.33.0 + diff --git a/queue-5.4/mmc-winbond-don-t-build-on-m68k.patch b/queue-5.4/mmc-winbond-don-t-build-on-m68k.patch new file mode 100644 index 00000000000..e5ecc41b8ac --- /dev/null +++ b/queue-5.4/mmc-winbond-don-t-build-on-m68k.patch @@ -0,0 +1,45 @@ +From 3274f4b7dbaa20faf705d4c6cd70f4ae2bef9201 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Oct 2021 10:59:49 -0700 +Subject: mmc: winbond: don't build on M68K + +From: Randy Dunlap + +[ Upstream commit 162079f2dccd02cb4b6654defd32ca387dd6d4d4 ] + +The Winbond MMC driver fails to build on ARCH=m68k so prevent +that build config. Silences these build errors: + +../drivers/mmc/host/wbsd.c: In function 'wbsd_request_end': +../drivers/mmc/host/wbsd.c:212:28: error: implicit declaration of function 'claim_dma_lock' [-Werror=implicit-function-declaration] + 212 | dmaflags = claim_dma_lock(); +../drivers/mmc/host/wbsd.c:215:17: error: implicit declaration of function 'release_dma_lock'; did you mean 'release_task'? [-Werror=implicit-function-declaration] + 215 | release_dma_lock(dmaflags); + +Signed-off-by: Randy Dunlap +Cc: Pierre Ossman +Cc: Geert Uytterhoeven +Cc: Arnd Bergmann +Link: https://lore.kernel.org/r/20211017175949.23838-1-rdunlap@infradead.org +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig +index 49ea02c467bf1..1b4a40d910cfb 100644 +--- a/drivers/mmc/host/Kconfig ++++ b/drivers/mmc/host/Kconfig +@@ -449,7 +449,7 @@ config MMC_OMAP_HS + + config MMC_WBSD + tristate "Winbond W83L51xD SD/MMC Card Interface support" +- depends on ISA_DMA_API ++ depends on ISA_DMA_API && !M68K + help + This selects the Winbond(R) W83L51xD Secure digital and + Multimedia card Interface. +-- +2.33.0 + diff --git a/queue-5.4/net-multicast-calculate-csum-of-looped-back-and-forw.patch b/queue-5.4/net-multicast-calculate-csum-of-looped-back-and-forw.patch new file mode 100644 index 00000000000..3da7df54181 --- /dev/null +++ b/queue-5.4/net-multicast-calculate-csum-of-looped-back-and-forw.patch @@ -0,0 +1,98 @@ +From a329883a9552622084947afbfe1679e8146d067d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Oct 2021 22:14:25 +0200 +Subject: net: multicast: calculate csum of looped-back and forwarded packets + +From: Cyril Strejc + +[ Upstream commit 9122a70a6333705c0c35614ddc51c274ed1d3637 ] + +During a testing of an user-space application which transmits UDP +multicast datagrams and utilizes multicast routing to send the UDP +datagrams out of defined network interfaces, I've found a multicast +router does not fill-in UDP checksum into locally produced, looped-back +and forwarded UDP datagrams, if an original output NIC the datagrams +are sent to has UDP TX checksum offload enabled. + +The datagrams are sent malformed out of the NIC the datagrams have been +forwarded to. + +It is because: + +1. If TX checksum offload is enabled on the output NIC, UDP checksum + is not calculated by kernel and is not filled into skb data. + +2. dev_loopback_xmit(), which is called solely by + ip_mc_finish_output(), sets skb->ip_summed = CHECKSUM_UNNECESSARY + unconditionally. + +3. Since 35fc92a9 ("[NET]: Allow forwarding of ip_summed except + CHECKSUM_COMPLETE"), the ip_summed value is preserved during + forwarding. + +4. If ip_summed != CHECKSUM_PARTIAL, checksum is not calculated during + a packet egress. + +The minimum fix in dev_loopback_xmit(): + +1. Preserves skb->ip_summed CHECKSUM_PARTIAL. This is the + case when the original output NIC has TX checksum offload enabled. + The effects are: + + a) If the forwarding destination interface supports TX checksum + offloading, the NIC driver is responsible to fill-in the + checksum. + + b) If the forwarding destination interface does NOT support TX + checksum offloading, checksums are filled-in by kernel before + skb is submitted to the NIC driver. + + c) For local delivery, checksum validation is skipped as in the + case of CHECKSUM_UNNECESSARY, thanks to skb_csum_unnecessary(). + +2. Translates ip_summed CHECKSUM_NONE to CHECKSUM_UNNECESSARY. It + means, for CHECKSUM_NONE, the behavior is unmodified and is there + to skip a looped-back packet local delivery checksum validation. + +Signed-off-by: Cyril Strejc +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/udp.h | 5 +++-- + net/core/dev.c | 3 ++- + 2 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/include/net/udp.h b/include/net/udp.h +index fabf507bce5d1..d9d39cc20a847 100644 +--- a/include/net/udp.h ++++ b/include/net/udp.h +@@ -480,8 +480,9 @@ static inline struct sk_buff *udp_rcv_segment(struct sock *sk, + * CHECKSUM_NONE in __udp_gso_segment. UDP GRO indeed builds partial + * packets in udp_gro_complete_segment. As does UDP GSO, verified by + * udp_send_skb. But when those packets are looped in dev_loopback_xmit +- * their ip_summed is set to CHECKSUM_UNNECESSARY. Reset in this +- * specific case, where PARTIAL is both correct and required. ++ * their ip_summed CHECKSUM_NONE is changed to CHECKSUM_UNNECESSARY. ++ * Reset in this specific case, where PARTIAL is both correct and ++ * required. + */ + if (skb->pkt_type == PACKET_LOOPBACK) + skb->ip_summed = CHECKSUM_PARTIAL; +diff --git a/net/core/dev.c b/net/core/dev.c +index e4e492bf72af0..82dc094c03971 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -3487,7 +3487,8 @@ int dev_loopback_xmit(struct net *net, struct sock *sk, struct sk_buff *skb) + skb_reset_mac_header(skb); + __skb_pull(skb, skb_network_offset(skb)); + skb->pkt_type = PACKET_LOOPBACK; +- skb->ip_summed = CHECKSUM_UNNECESSARY; ++ if (skb->ip_summed == CHECKSUM_NONE) ++ skb->ip_summed = CHECKSUM_UNNECESSARY; + WARN_ON(!skb_dst(skb)); + skb_dst_force(skb); + netif_rx_ni(skb); +-- +2.33.0 + diff --git a/queue-5.4/net-smc-correct-spelling-mistake-to-tcpf_syn_recv.patch b/queue-5.4/net-smc-correct-spelling-mistake-to-tcpf_syn_recv.patch new file mode 100644 index 00000000000..fee96047284 --- /dev/null +++ b/queue-5.4/net-smc-correct-spelling-mistake-to-tcpf_syn_recv.patch @@ -0,0 +1,35 @@ +From d317d19c6281034fac5b5ba915ca1d9edda59740 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Oct 2021 15:13:47 +0800 +Subject: net/smc: Correct spelling mistake to TCPF_SYN_RECV + +From: Wen Gu + +[ Upstream commit f3a3a0fe0b644582fa5d83dd94b398f99fc57914 ] + +There should use TCPF_SYN_RECV instead of TCP_SYN_RECV. + +Signed-off-by: Wen Gu +Reviewed-by: Tony Lu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/af_smc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 51986f7ead819..2b3c13a0b2e5b 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -783,7 +783,7 @@ static void smc_connect_work(struct work_struct *work) + if (smc->clcsock->sk->sk_err) { + smc->sk.sk_err = smc->clcsock->sk->sk_err; + } else if ((1 << smc->clcsock->sk->sk_state) & +- (TCPF_SYN_SENT | TCP_SYN_RECV)) { ++ (TCPF_SYN_SENT | TCPF_SYN_RECV)) { + rc = sk_stream_wait_connect(smc->clcsock->sk, &timeo); + if ((rc == -EPIPE) && + ((1 << smc->clcsock->sk->sk_state) & +-- +2.33.0 + diff --git a/queue-5.4/nfp-bpf-relax-prog-rejection-for-mtu-check-through-m.patch b/queue-5.4/nfp-bpf-relax-prog-rejection-for-mtu-check-through-m.patch new file mode 100644 index 00000000000..4b0f9bc5859 --- /dev/null +++ b/queue-5.4/nfp-bpf-relax-prog-rejection-for-mtu-check-through-m.patch @@ -0,0 +1,114 @@ +From c62be13f029d6c958ad3ffb1a67c3abd46ca5366 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Oct 2021 12:00:36 +0200 +Subject: nfp: bpf: relax prog rejection for mtu check through max_pkt_offset + +From: Yu Xiao + +[ Upstream commit 90a881fc352a953f1c8beb61977a2db0818157d4 ] + +MTU change is refused whenever the value of new MTU is bigger than +the max packet bytes that fits in NFP Cluster Target Memory (CTM). +However, an eBPF program doesn't always need to access the whole +packet data. + +The maximum direct packet access (DPA) offset has always been +caculated by verifier and stored in the max_pkt_offset field of prog +aux data. + +Signed-off-by: Yu Xiao +Reviewed-by: Yinjun Zhang +Reviewed-by: Niklas Soderlund +Signed-off-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/netronome/nfp/bpf/main.c | 16 +++++++++++----- + drivers/net/ethernet/netronome/nfp/bpf/main.h | 2 ++ + .../net/ethernet/netronome/nfp/bpf/offload.c | 17 +++++++++++++---- + 3 files changed, 26 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.c b/drivers/net/ethernet/netronome/nfp/bpf/main.c +index 8f732771d3fad..bd2966eb6b7d3 100644 +--- a/drivers/net/ethernet/netronome/nfp/bpf/main.c ++++ b/drivers/net/ethernet/netronome/nfp/bpf/main.c +@@ -182,15 +182,21 @@ static int + nfp_bpf_check_mtu(struct nfp_app *app, struct net_device *netdev, int new_mtu) + { + struct nfp_net *nn = netdev_priv(netdev); +- unsigned int max_mtu; ++ struct nfp_bpf_vnic *bv; ++ struct bpf_prog *prog; + + if (~nn->dp.ctrl & NFP_NET_CFG_CTRL_BPF) + return 0; + +- max_mtu = nn_readb(nn, NFP_NET_CFG_BPF_INL_MTU) * 64 - 32; +- if (new_mtu > max_mtu) { +- nn_info(nn, "BPF offload active, MTU over %u not supported\n", +- max_mtu); ++ if (nn->xdp_hw.prog) { ++ prog = nn->xdp_hw.prog; ++ } else { ++ bv = nn->app_priv; ++ prog = bv->tc_prog; ++ } ++ ++ if (nfp_bpf_offload_check_mtu(nn, prog, new_mtu)) { ++ nn_info(nn, "BPF offload active, potential packet access beyond hardware packet boundary"); + return -EBUSY; + } + return 0; +diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.h b/drivers/net/ethernet/netronome/nfp/bpf/main.h +index fac9c6f9e197b..c74620fcc539c 100644 +--- a/drivers/net/ethernet/netronome/nfp/bpf/main.h ++++ b/drivers/net/ethernet/netronome/nfp/bpf/main.h +@@ -560,6 +560,8 @@ bool nfp_is_subprog_start(struct nfp_insn_meta *meta); + void nfp_bpf_jit_prepare(struct nfp_prog *nfp_prog); + int nfp_bpf_jit(struct nfp_prog *prog); + bool nfp_bpf_supported_opcode(u8 code); ++bool nfp_bpf_offload_check_mtu(struct nfp_net *nn, struct bpf_prog *prog, ++ unsigned int mtu); + + int nfp_verify_insn(struct bpf_verifier_env *env, int insn_idx, + int prev_insn_idx); +diff --git a/drivers/net/ethernet/netronome/nfp/bpf/offload.c b/drivers/net/ethernet/netronome/nfp/bpf/offload.c +index 88fab6a82acff..7ff388ecc7e3a 100644 +--- a/drivers/net/ethernet/netronome/nfp/bpf/offload.c ++++ b/drivers/net/ethernet/netronome/nfp/bpf/offload.c +@@ -477,19 +477,28 @@ int nfp_bpf_event_output(struct nfp_app_bpf *bpf, const void *data, + return 0; + } + ++bool nfp_bpf_offload_check_mtu(struct nfp_net *nn, struct bpf_prog *prog, ++ unsigned int mtu) ++{ ++ unsigned int fw_mtu, pkt_off; ++ ++ fw_mtu = nn_readb(nn, NFP_NET_CFG_BPF_INL_MTU) * 64 - 32; ++ pkt_off = min(prog->aux->max_pkt_offset, mtu); ++ ++ return fw_mtu < pkt_off; ++} ++ + static int + nfp_net_bpf_load(struct nfp_net *nn, struct bpf_prog *prog, + struct netlink_ext_ack *extack) + { + struct nfp_prog *nfp_prog = prog->aux->offload->dev_priv; +- unsigned int fw_mtu, pkt_off, max_stack, max_prog_len; ++ unsigned int max_stack, max_prog_len; + dma_addr_t dma_addr; + void *img; + int err; + +- fw_mtu = nn_readb(nn, NFP_NET_CFG_BPF_INL_MTU) * 64 - 32; +- pkt_off = min(prog->aux->max_pkt_offset, nn->dp.netdev->mtu); +- if (fw_mtu < pkt_off) { ++ if (nfp_bpf_offload_check_mtu(nn, prog, nn->dp.netdev->mtu)) { + NL_SET_ERR_MSG_MOD(extack, "BPF offload not supported with potential packet access beyond HW packet split boundary"); + return -EOPNOTSUPP; + } +-- +2.33.0 + diff --git a/queue-5.4/nvmet-tcp-fix-a-memory-leak-when-releasing-a-queue.patch b/queue-5.4/nvmet-tcp-fix-a-memory-leak-when-releasing-a-queue.patch new file mode 100644 index 00000000000..d73968d0bed --- /dev/null +++ b/queue-5.4/nvmet-tcp-fix-a-memory-leak-when-releasing-a-queue.patch @@ -0,0 +1,51 @@ +From 40bb90514f4d2be468e2f5c21e9e846354914f8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Oct 2021 10:26:34 +0200 +Subject: nvmet-tcp: fix a memory leak when releasing a queue + +From: Maurizio Lombardi + +[ Upstream commit 926245c7d22271307606c88b1fbb2539a8550e94 ] + +page_frag_free() won't completely release the memory +allocated for the commands, the cache page must be explicitly +freed by calling __page_frag_cache_drain(). + +This bug can be easily reproduced by repeatedly +executing the following command on the initiator: + +$echo 1 > /sys/devices/virtual/nvme-fabrics/ctl/nvme0/reset_controller + +Signed-off-by: Maurizio Lombardi +Reviewed-by: Sagi Grimberg +Reviewed-by: John Meneghini +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/tcp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index 2f4e512bd449f..1328ee373e596 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -1343,6 +1343,7 @@ static void nvmet_tcp_uninit_data_in_cmds(struct nvmet_tcp_queue *queue) + + static void nvmet_tcp_release_queue_work(struct work_struct *w) + { ++ struct page *page; + struct nvmet_tcp_queue *queue = + container_of(w, struct nvmet_tcp_queue, release_work); + +@@ -1362,6 +1363,8 @@ static void nvmet_tcp_release_queue_work(struct work_struct *w) + nvmet_tcp_free_crypto(queue); + ida_simple_remove(&nvmet_tcp_queue_ida, queue->idx); + ++ page = virt_to_head_page(queue->pf_cache.va); ++ __page_frag_cache_drain(page, queue->pf_cache.pagecnt_bias); + kfree(queue); + } + +-- +2.33.0 + diff --git a/queue-5.4/nvmet-tcp-fix-header-digest-verification.patch b/queue-5.4/nvmet-tcp-fix-header-digest-verification.patch new file mode 100644 index 00000000000..8262da21ea6 --- /dev/null +++ b/queue-5.4/nvmet-tcp-fix-header-digest-verification.patch @@ -0,0 +1,37 @@ +From 1eb822aa82a1d081dee7bb5cb40f1835a63c4a3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Oct 2021 09:49:27 +0300 +Subject: nvmet-tcp: fix header digest verification + +From: Amit Engel + +[ Upstream commit 86aeda32b887cdaeb0f4b7bfc9971e36377181c7 ] + +Pass the correct length to nvmet_tcp_verify_hdgst, which is the pdu +header length. This fixes a wrong behaviour where header digest +verification passes although the digest is wrong. + +Signed-off-by: Amit Engel +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/tcp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index 1328ee373e596..6b3d1ba7db7ee 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -1020,7 +1020,7 @@ recv: + } + + if (queue->hdr_digest && +- nvmet_tcp_verify_hdgst(queue, &queue->pdu, queue->offset)) { ++ nvmet_tcp_verify_hdgst(queue, &queue->pdu, hdr->hlen)) { + nvmet_tcp_fatal_error(queue); /* fatal */ + return -EPROTO; + } +-- +2.33.0 + diff --git a/queue-5.4/r8169-add-device-10ec-8162-to-driver-r8169.patch b/queue-5.4/r8169-add-device-10ec-8162-to-driver-r8169.patch new file mode 100644 index 00000000000..ee94385962c --- /dev/null +++ b/queue-5.4/r8169-add-device-10ec-8162-to-driver-r8169.patch @@ -0,0 +1,36 @@ +From 3985ab105db4055f058af0e09f7ecdbf2efbbe60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Oct 2021 07:12:42 +0000 +Subject: r8169: Add device 10ec:8162 to driver r8169 + +From: Janghyub Seo + +[ Upstream commit 72f898ca0ab85fde6facf78b14d9f67a4a7b32d1 ] + +This patch makes the driver r8169 pick up device Realtek Semiconductor Co. +, Ltd. Device [10ec:8162]. + +Signed-off-by: Janghyub Seo +Suggested-by: Rushab Shah +Link: https://lore.kernel.org/r/1635231849296.1489250046.441294000@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 623d86e5e970f..8d2b184ff5758 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -212,6 +212,7 @@ static const struct pci_device_id rtl8169_pci_tbl[] = { + { PCI_VDEVICE(REALTEK, 0x8129) }, + { PCI_VDEVICE(REALTEK, 0x8136), RTL_CFG_NO_GBIT }, + { PCI_VDEVICE(REALTEK, 0x8161) }, ++ { PCI_VDEVICE(REALTEK, 0x8162) }, + { PCI_VDEVICE(REALTEK, 0x8167) }, + { PCI_VDEVICE(REALTEK, 0x8168) }, + { PCI_VDEVICE(NCUBE, 0x8168) }, +-- +2.33.0 + diff --git a/queue-5.4/reset-socfpga-add-empty-driver-allowing-consumers-to.patch b/queue-5.4/reset-socfpga-add-empty-driver-allowing-consumers-to.patch new file mode 100644 index 00000000000..46d7f516196 --- /dev/null +++ b/queue-5.4/reset-socfpga-add-empty-driver-allowing-consumers-to.patch @@ -0,0 +1,61 @@ +From 2bb2d17625834f1c017a55a472b2dc285f740a81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Sep 2021 14:41:41 +0200 +Subject: reset: socfpga: add empty driver allowing consumers to probe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Paweł Anikiel + +[ Upstream commit 3ad60b4b3570937f3278509fe6797a5093ce53f8 ] + +The early reset driver doesn't ever probe, which causes consuming +devices to be unable to probe. Add an empty driver to set this device +as available, allowing consumers to probe. + +Signed-off-by: Paweł Anikiel +Link: https://lore.kernel.org/r/20210920124141.1166544-4-pan@semihalf.com +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/reset/reset-socfpga.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +diff --git a/drivers/reset/reset-socfpga.c b/drivers/reset/reset-socfpga.c +index 96953992c2bb5..1c5236a69dc49 100644 +--- a/drivers/reset/reset-socfpga.c ++++ b/drivers/reset/reset-socfpga.c +@@ -86,3 +86,29 @@ void __init socfpga_reset_init(void) + for_each_matching_node(np, socfpga_early_reset_dt_ids) + a10_reset_init(np); + } ++ ++/* ++ * The early driver is problematic, because it doesn't register ++ * itself as a driver. This causes certain device links to prevent ++ * consumer devices from probing. The hacky solution is to register ++ * an empty driver, whose only job is to attach itself to the reset ++ * manager and call probe. ++ */ ++static const struct of_device_id socfpga_reset_dt_ids[] = { ++ { .compatible = "altr,rst-mgr", }, ++ { /* sentinel */ }, ++}; ++ ++static int reset_simple_probe(struct platform_device *pdev) ++{ ++ return 0; ++} ++ ++static struct platform_driver reset_socfpga_driver = { ++ .probe = reset_simple_probe, ++ .driver = { ++ .name = "socfpga-reset", ++ .of_match_table = socfpga_reset_dt_ids, ++ }, ++}; ++builtin_platform_driver(reset_socfpga_driver); +-- +2.33.0 + diff --git a/queue-5.4/reset-tegra-bpmp-handle-errors-in-bpmp-response.patch b/queue-5.4/reset-tegra-bpmp-handle-errors-in-bpmp-response.patch new file mode 100644 index 00000000000..f1172041e48 --- /dev/null +++ b/queue-5.4/reset-tegra-bpmp-handle-errors-in-bpmp-response.patch @@ -0,0 +1,52 @@ +From 98bd616e275cc6d5513f032870e5eef8ac7cf482 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Sep 2021 11:55:14 +0300 +Subject: reset: tegra-bpmp: Handle errors in BPMP response + +From: Mikko Perttunen + +[ Upstream commit c045ceb5a145d2a9a4bf33cbc55185ddf99f60ab ] + +The return value from tegra_bpmp_transfer indicates the success or +failure of the IPC transaction with BPMP. If the transaction +succeeded, we also need to check the actual command's result code. +Add code to do this. + +Signed-off-by: Mikko Perttunen +Link: https://lore.kernel.org/r/20210915085517.1669675-2-mperttunen@nvidia.com +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/reset/tegra/reset-bpmp.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/reset/tegra/reset-bpmp.c b/drivers/reset/tegra/reset-bpmp.c +index 24d3395964cc4..4c5bba52b1059 100644 +--- a/drivers/reset/tegra/reset-bpmp.c ++++ b/drivers/reset/tegra/reset-bpmp.c +@@ -20,6 +20,7 @@ static int tegra_bpmp_reset_common(struct reset_controller_dev *rstc, + struct tegra_bpmp *bpmp = to_tegra_bpmp(rstc); + struct mrq_reset_request request; + struct tegra_bpmp_message msg; ++ int err; + + memset(&request, 0, sizeof(request)); + request.cmd = command; +@@ -30,7 +31,13 @@ static int tegra_bpmp_reset_common(struct reset_controller_dev *rstc, + msg.tx.data = &request; + msg.tx.size = sizeof(request); + +- return tegra_bpmp_transfer(bpmp, &msg); ++ err = tegra_bpmp_transfer(bpmp, &msg); ++ if (err) ++ return err; ++ if (msg.rx.ret) ++ return -EINVAL; ++ ++ return 0; + } + + static int tegra_bpmp_reset_module(struct reset_controller_dev *rstc, +-- +2.33.0 + diff --git a/queue-5.4/scsi-qla2xxx-fix-unmap-of-already-freed-sgl.patch b/queue-5.4/scsi-qla2xxx-fix-unmap-of-already-freed-sgl.patch new file mode 100644 index 00000000000..432f83a5779 --- /dev/null +++ b/queue-5.4/scsi-qla2xxx-fix-unmap-of-already-freed-sgl.patch @@ -0,0 +1,90 @@ +From a1218b41c67c6352f0c7e08bf291d8caae07f335 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Oct 2021 15:26:50 +0300 +Subject: scsi: qla2xxx: Fix unmap of already freed sgl + +From: Dmitry Bogdanov + +[ Upstream commit 4a8f71014b4d56c4fb287607e844c0a9f68f46d9 ] + +The sgl is freed in the target stack in target_release_cmd_kref() before +calling qlt_free_cmd() but there is an unmap of sgl in qlt_free_cmd() that +causes a panic if sgl is not yet DMA unmapped: + +NIP dma_direct_unmap_sg+0xdc/0x180 +LR dma_direct_unmap_sg+0xc8/0x180 +Call Trace: + ql_dbg_prefix+0x68/0xc0 [qla2xxx] (unreliable) + dma_unmap_sg_attrs+0x54/0xf0 + qlt_unmap_sg.part.19+0x54/0x1c0 [qla2xxx] + qlt_free_cmd+0x124/0x1d0 [qla2xxx] + tcm_qla2xxx_release_cmd+0x4c/0xa0 [tcm_qla2xxx] + target_put_sess_cmd+0x198/0x370 [target_core_mod] + transport_generic_free_cmd+0x6c/0x1b0 [target_core_mod] + tcm_qla2xxx_complete_free+0x6c/0x90 [tcm_qla2xxx] + +The sgl may be left unmapped in error cases of response sending. For +instance, qlt_rdy_to_xfer() maps sgl and exits when session is being +deleted keeping the sgl mapped. + +This patch removes use-after-free of the sgl and ensures that the sgl is +unmapped for any command that was not sent to firmware. + +Link: https://lore.kernel.org/r/20211018122650.11846-1-d.bogdanov@yadro.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Dmitry Bogdanov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_target.c | 14 +++++--------- + 1 file changed, 5 insertions(+), 9 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 57068e2faef54..0111c543f0e64 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -3251,8 +3251,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type, + "RESET-RSP online/active/old-count/new-count = %d/%d/%d/%d.\n", + vha->flags.online, qla2x00_reset_active(vha), + cmd->reset_count, qpair->chip_reset); +- spin_unlock_irqrestore(qpair->qp_lock_ptr, flags); +- return 0; ++ goto out_unmap_unlock; + } + + /* Does F/W have an IOCBs for this request */ +@@ -3375,10 +3374,6 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd) + prm.sg = NULL; + prm.req_cnt = 1; + +- /* Calculate number of entries and segments required */ +- if (qlt_pci_map_calc_cnt(&prm) != 0) +- return -EAGAIN; +- + if (!qpair->fw_started || (cmd->reset_count != qpair->chip_reset) || + (cmd->sess && cmd->sess->deleted)) { + /* +@@ -3396,6 +3391,10 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd) + return 0; + } + ++ /* Calculate number of entries and segments required */ ++ if (qlt_pci_map_calc_cnt(&prm) != 0) ++ return -EAGAIN; ++ + spin_lock_irqsave(qpair->qp_lock_ptr, flags); + /* Does F/W have an IOCBs for this request */ + res = qlt_check_reserve_free_req(qpair, prm.req_cnt); +@@ -3800,9 +3799,6 @@ void qlt_free_cmd(struct qla_tgt_cmd *cmd) + + BUG_ON(cmd->cmd_in_wq); + +- if (cmd->sg_mapped) +- qlt_unmap_sg(cmd->vha, cmd); +- + if (!cmd->q_full) + qlt_decr_num_pend_cmds(cmd->vha); + +-- +2.33.0 + diff --git a/queue-5.4/scsi-qla2xxx-return-enomem-if-kzalloc-fails.patch b/queue-5.4/scsi-qla2xxx-return-enomem-if-kzalloc-fails.patch new file mode 100644 index 00000000000..44c049a8844 --- /dev/null +++ b/queue-5.4/scsi-qla2xxx-return-enomem-if-kzalloc-fails.patch @@ -0,0 +1,37 @@ +From b0a3da7db71e315843796ba52c13229d32331e33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Oct 2021 01:56:21 +0000 +Subject: scsi: qla2xxx: Return -ENOMEM if kzalloc() fails + +From: Zheyu Ma + +[ Upstream commit 06634d5b6e923ed0d4772aba8def5a618f44c7fe ] + +The driver probing function should return < 0 for failure, otherwise +kernel will treat value > 0 as success. + +Link: https://lore.kernel.org/r/1634522181-31166-1-git-send-email-zheyuma97@gmail.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Zheyu Ma +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_os.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 8b68879058132..049a68c59c137 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -4066,7 +4066,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len, + ql_dbg_pci(ql_dbg_init, ha->pdev, + 0xe0ee, "%s: failed alloc dsd\n", + __func__); +- return 1; ++ return -ENOMEM; + } + ha->dif_bundle_kallocs++; + +-- +2.33.0 + diff --git a/queue-5.4/series b/queue-5.4/series index ea7912d8423..2ce21c4359a 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -33,3 +33,27 @@ fuse-fix-page-stealing.patch x86-sme-use-define-use_early_pgtable_l5-in-mem_encrypt_identity.c.patch x86-cpu-fix-migration-safety-with-x86_bug_null_sel.patch x86-irq-ensure-pi-wakeup-handler-is-unregistered-before-module-unload.patch +cavium-return-negative-value-when-pci_alloc_irq_vect.patch +scsi-qla2xxx-return-enomem-if-kzalloc-fails.patch +scsi-qla2xxx-fix-unmap-of-already-freed-sgl.patch +cavium-fix-return-values-of-the-probe-function.patch +sfc-don-t-use-netif_info-before-net_device-setup.patch +hyperv-vmbus-include-linux-bitops.h.patch +arm-dts-sun7i-a20-olinuxino-lime2-fix-ethernet-phy-m.patch +reset-tegra-bpmp-handle-errors-in-bpmp-response.patch +reset-socfpga-add-empty-driver-allowing-consumers-to.patch +mmc-winbond-don-t-build-on-m68k.patch +drm-panel-orientation-quirks-add-quirk-for-aya-neo-2.patch +bpf-define-bpf_jit_alloc_exec_limit-for-arm64-jit.patch +bpf-prevent-increasing-bpf_jit_limit-above-max.patch +xen-netfront-stop-tx-queues-during-live-migration.patch +nvmet-tcp-fix-a-memory-leak-when-releasing-a-queue.patch +spi-spl022-fix-microwire-full-duplex-mode.patch +net-multicast-calculate-csum-of-looped-back-and-forw.patch +watchdog-fix-omap-watchdog-early-handling.patch +drm-panel-orientation-quirks-add-quirk-for-gpd-win3.patch +nvmet-tcp-fix-header-digest-verification.patch +r8169-add-device-10ec-8162-to-driver-r8169.patch +vmxnet3-do-not-stop-tx-queues-after-netif_device_det.patch +nfp-bpf-relax-prog-rejection-for-mtu-check-through-m.patch +net-smc-correct-spelling-mistake-to-tcpf_syn_recv.patch diff --git a/queue-5.4/sfc-don-t-use-netif_info-before-net_device-setup.patch b/queue-5.4/sfc-don-t-use-netif_info-before-net_device-setup.patch new file mode 100644 index 00000000000..b26119f561f --- /dev/null +++ b/queue-5.4/sfc-don-t-use-netif_info-before-net_device-setup.patch @@ -0,0 +1,66 @@ +From b7abd54e6cdc06d6bd4d825396fcb9fbf07e5987 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Oct 2021 00:40:16 +0200 +Subject: sfc: Don't use netif_info before net_device setup + +From: Erik Ekman + +[ Upstream commit bf6abf345dfa77786aca554bc58c64bd428ecb1d ] + +Use pci_info instead to avoid unnamed/uninitialized noise: + +[197088.688729] sfc 0000:01:00.0: Solarflare NIC detected +[197088.690333] sfc 0000:01:00.0: Part Number : SFN5122F +[197088.729061] sfc 0000:01:00.0 (unnamed net_device) (uninitialized): no SR-IOV VFs probed +[197088.729071] sfc 0000:01:00.0 (unnamed net_device) (uninitialized): no PTP support + +Inspired by fa44821a4ddd ("sfc: don't use netif_info et al before +net_device is registered") from Heiner Kallweit. + +Signed-off-by: Erik Ekman +Acked-by: Martin Habets +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/ptp.c | 4 ++-- + drivers/net/ethernet/sfc/siena_sriov.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c +index 59b4f16896a81..1fa1b71dbfa11 100644 +--- a/drivers/net/ethernet/sfc/ptp.c ++++ b/drivers/net/ethernet/sfc/ptp.c +@@ -648,7 +648,7 @@ static int efx_ptp_get_attributes(struct efx_nic *efx) + } else if (rc == -EINVAL) { + fmt = MC_CMD_PTP_OUT_GET_ATTRIBUTES_SECONDS_NANOSECONDS; + } else if (rc == -EPERM) { +- netif_info(efx, probe, efx->net_dev, "no PTP support\n"); ++ pci_info(efx->pci_dev, "no PTP support\n"); + return rc; + } else { + efx_mcdi_display_error(efx, MC_CMD_PTP, sizeof(inbuf), +@@ -824,7 +824,7 @@ static int efx_ptp_disable(struct efx_nic *efx) + * should only have been called during probe. + */ + if (rc == -ENOSYS || rc == -EPERM) +- netif_info(efx, probe, efx->net_dev, "no PTP support\n"); ++ pci_info(efx->pci_dev, "no PTP support\n"); + else if (rc) + efx_mcdi_display_error(efx, MC_CMD_PTP, + MC_CMD_PTP_IN_DISABLE_LEN, +diff --git a/drivers/net/ethernet/sfc/siena_sriov.c b/drivers/net/ethernet/sfc/siena_sriov.c +index dfbdf05dcf794..68f092881d137 100644 +--- a/drivers/net/ethernet/sfc/siena_sriov.c ++++ b/drivers/net/ethernet/sfc/siena_sriov.c +@@ -1056,7 +1056,7 @@ void efx_siena_sriov_probe(struct efx_nic *efx) + return; + + if (efx_siena_sriov_cmd(efx, false, &efx->vi_scale, &count)) { +- netif_info(efx, probe, efx->net_dev, "no SR-IOV VFs probed\n"); ++ pci_info(efx->pci_dev, "no SR-IOV VFs probed\n"); + return; + } + if (count > 0 && count > max_vfs) +-- +2.33.0 + diff --git a/queue-5.4/spi-spl022-fix-microwire-full-duplex-mode.patch b/queue-5.4/spi-spl022-fix-microwire-full-duplex-mode.patch new file mode 100644 index 00000000000..0ed119afbbf --- /dev/null +++ b/queue-5.4/spi-spl022-fix-microwire-full-duplex-mode.patch @@ -0,0 +1,44 @@ +From e554dc8b6fcbc61025c126a6889650a75696ece0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Oct 2021 16:21:04 +0200 +Subject: spi: spl022: fix Microwire full duplex mode + +From: Thomas Perrot + +[ Upstream commit d81d0e41ed5fe7229a2c9a29d13bad288c7cf2d2 ] + +There are missing braces in the function that verify controller parameters, +then an error is always returned when the parameter to select Microwire +frames operation is used on devices allowing it. + +Signed-off-by: Thomas Perrot +Link: https://lore.kernel.org/r/20211022142104.1386379-1-thomas.perrot@bootlin.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-pl022.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c +index 7fedea67159c5..8523bb4f6a62e 100644 +--- a/drivers/spi/spi-pl022.c ++++ b/drivers/spi/spi-pl022.c +@@ -1720,12 +1720,13 @@ static int verify_controller_parameters(struct pl022 *pl022, + return -EINVAL; + } + } else { +- if (chip_info->duplex != SSP_MICROWIRE_CHANNEL_FULL_DUPLEX) ++ if (chip_info->duplex != SSP_MICROWIRE_CHANNEL_FULL_DUPLEX) { + dev_err(&pl022->adev->dev, + "Microwire half duplex mode requested," + " but this is only available in the" + " ST version of PL022\n"); +- return -EINVAL; ++ return -EINVAL; ++ } + } + } + return 0; +-- +2.33.0 + diff --git a/queue-5.4/vmxnet3-do-not-stop-tx-queues-after-netif_device_det.patch b/queue-5.4/vmxnet3-do-not-stop-tx-queues-after-netif_device_det.patch new file mode 100644 index 00000000000..73c0ea679bc --- /dev/null +++ b/queue-5.4/vmxnet3-do-not-stop-tx-queues-after-netif_device_det.patch @@ -0,0 +1,34 @@ +From a8a79418b942979eca8ed8ab33db7ce0d6a28d6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Oct 2021 14:50:31 -0700 +Subject: vmxnet3: do not stop tx queues after netif_device_detach() + +From: Dongli Zhang + +[ Upstream commit 9159f102402a64ac85e676b75cc1f9c62c5b4b73 ] + +The netif_device_detach() conditionally stops all tx queues if the queues +are running. There is no need to call netif_tx_stop_all_queues() again. + +Signed-off-by: Dongli Zhang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/vmxnet3/vmxnet3_drv.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c +index a06e6ab453f50..cf090f88dac03 100644 +--- a/drivers/net/vmxnet3/vmxnet3_drv.c ++++ b/drivers/net/vmxnet3/vmxnet3_drv.c +@@ -3634,7 +3634,6 @@ vmxnet3_suspend(struct device *device) + vmxnet3_free_intr_resources(adapter); + + netif_device_detach(netdev); +- netif_tx_stop_all_queues(netdev); + + /* Create wake-up filters. */ + pmConf = adapter->pm_conf; +-- +2.33.0 + diff --git a/queue-5.4/watchdog-fix-omap-watchdog-early-handling.patch b/queue-5.4/watchdog-fix-omap-watchdog-early-handling.patch new file mode 100644 index 00000000000..027b19bf3ee --- /dev/null +++ b/queue-5.4/watchdog-fix-omap-watchdog-early-handling.patch @@ -0,0 +1,44 @@ +From ed54143a8e736892b1f41b9cd65937e8eacb808d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Oct 2021 12:22:29 +0200 +Subject: watchdog: Fix OMAP watchdog early handling + +From: Walter Stoll + +[ Upstream commit cd004d8299f1dc6cfa6a4eea8f94cb45eaedf070 ] + +TI's implementation does not service the watchdog even if the kernel +command line parameter omap_wdt.early_enable is set to 1. This patch +fixes the issue. + +Signed-off-by: Walter Stoll +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/88a8fe5229cd68fa0f1fd22f5d66666c1b7057a0.camel@duagon.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/omap_wdt.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c +index 9b91882fe3c41..6d7ccbc0b666c 100644 +--- a/drivers/watchdog/omap_wdt.c ++++ b/drivers/watchdog/omap_wdt.c +@@ -268,8 +268,12 @@ static int omap_wdt_probe(struct platform_device *pdev) + wdev->wdog.bootstatus = WDIOF_CARDRESET; + } + +- if (!early_enable) ++ if (early_enable) { ++ omap_wdt_start(&wdev->wdog); ++ set_bit(WDOG_HW_RUNNING, &wdev->wdog.status); ++ } else { + omap_wdt_disable(wdev); ++ } + + ret = watchdog_register_device(&wdev->wdog); + if (ret) { +-- +2.33.0 + diff --git a/queue-5.4/xen-netfront-stop-tx-queues-during-live-migration.patch b/queue-5.4/xen-netfront-stop-tx-queues-during-live-migration.patch new file mode 100644 index 00000000000..4d63901cbf9 --- /dev/null +++ b/queue-5.4/xen-netfront-stop-tx-queues-during-live-migration.patch @@ -0,0 +1,67 @@ +From 8eb4a8841f528c109749f02101dfb4a4c50d2f9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Oct 2021 16:31:39 -0700 +Subject: xen/netfront: stop tx queues during live migration + +From: Dongli Zhang + +[ Upstream commit 042b2046d0f05cf8124c26ff65dbb6148a4404fb ] + +The tx queues are not stopped during the live migration. As a result, the +ndo_start_xmit() may access netfront_info->queues which is freed by +talk_to_netback()->xennet_destroy_queues(). + +This patch is to netif_device_detach() at the beginning of xen-netfront +resuming, and netif_device_attach() at the end of resuming. + + CPU A CPU B + + talk_to_netback() + -> if (info->queues) + xennet_destroy_queues(info); + to free netfront_info->queues + + xennet_start_xmit() + to access netfront_info->queues + + -> err = xennet_create_queues(info, &num_queues); + +The idea is borrowed from virtio-net. + +Cc: Joe Jin +Signed-off-by: Dongli Zhang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/xen-netfront.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index 88280057e0321..7d389c2cc9026 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -1439,6 +1439,10 @@ static int netfront_resume(struct xenbus_device *dev) + + dev_dbg(&dev->dev, "%s\n", dev->nodename); + ++ netif_tx_lock_bh(info->netdev); ++ netif_device_detach(info->netdev); ++ netif_tx_unlock_bh(info->netdev); ++ + xennet_disconnect_backend(info); + return 0; + } +@@ -1987,6 +1991,10 @@ static int xennet_connect(struct net_device *dev) + * domain a kick because we've probably just requeued some + * packets. + */ ++ netif_tx_lock_bh(np->netdev); ++ netif_device_attach(np->netdev); ++ netif_tx_unlock_bh(np->netdev); ++ + netif_carrier_on(np->netdev); + for (j = 0; j < num_queues; ++j) { + queue = &np->queues[j]; +-- +2.33.0 + -- 2.47.2